diff --git a/.github/actions/install-node-dependencies/action.yml b/.github/actions/install-node-dependencies/action.yml
index 30c98070f31..7bf1d8cd43b 100644
--- a/.github/actions/install-node-dependencies/action.yml
+++ b/.github/actions/install-node-dependencies/action.yml
@@ -2,6 +2,10 @@ name: Install Node dependencies
 description: Installs the Node toolchain and repository dependencies for CI jobs, with optional Electron archive caching.
 
 inputs:
+  cache-pnpm-verification:
+    description: Restore pnpm's policy-checked lockfile verification record on Linux.
+    required: false
+    default: 'true'
   native-runtime:
     description: Native runtime to prepare after the script-free install (none, node, or electron).
     required: false
@@ -24,6 +28,15 @@ inputs:
     default: 'false'
 
 outputs:
+  verification-cache-hit:
+    description: Whether pnpm's verification record was restored.
+    value: ${{ steps.verification-cache-restore.outputs.cache-hit }}
+  verification-cache-path:
+    description: The small pnpm-owned verification record, without registry metadata.
+    value: ${{ steps.verification-cache.outputs.path }}
+  verification-cache-key:
+    description: Exact verification record key, also used by the isolated PR benchmark.
+    value: ${{ steps.verification-cache.outputs.key }}
   node-version:
     description: Resolved Node.js version used for the install.
     value: ${{ steps.requested-node.outputs.node-version || steps.default-node.outputs.node-version }}
@@ -50,8 +63,9 @@ runs:
       uses: actions/setup-node@v6
       with:
         node-version-file: package.json
-        cache: pnpm
+        cache: ${{ github.event_name != 'pull_request' && 'pnpm' || '' }}
         cache-dependency-path: ${{ inputs.cache-dependency-path }}
+        package-manager-cache: false
 
     - name: Setup requested Node.js
       id: requested-node
@@ -59,8 +73,50 @@ runs:
       uses: actions/setup-node@v6
       with:
         node-version: ${{ inputs.node-version }}
-        cache: pnpm
+        cache: ${{ github.event_name != 'pull_request' && 'pnpm' || '' }}
         cache-dependency-path: ${{ inputs.cache-dependency-path }}
+        package-manager-cache: false
+
+    # PR-local stores compete with reusable build caches for the repository quota.
+    - name: Resolve pnpm download store
+      id: pnpm-store
+      if: github.event_name == 'pull_request'
+      shell: bash
+      env:
+        LOCKFILE_HASH: ${{ hashFiles(inputs.cache-dependency-path) }}
+      run: |
+        test -n "$LOCKFILE_HASH"
+        cache_path="$(pnpm store path --silent)"
+        test -n "$cache_path"
+        printf 'path=%s\n' "$cache_path" >> "$GITHUB_OUTPUT"
+        printf 'arch=%s\n' "$(node -p 'require("node:os").arch()')" >> "$GITHUB_OUTPUT"
+
+    # Match setup-node's key and path so existing default-branch stores remain reusable.
+    - name: Restore pnpm download store without saving
+      if: github.event_name == 'pull_request'
+      uses: actions/cache/restore@v5
+      with:
+        path: ${{ steps.pnpm-store.outputs.path }}
+        key: node-cache-${{ runner.os }}-${{ steps.pnpm-store.outputs.arch }}-pnpm-${{ hashFiles(inputs.cache-dependency-path) }}
+
+    - name: Resolve pnpm verification cache
+      id: verification-cache
+      if: runner.os == 'Linux' && inputs.cache-pnpm-verification == 'true'
+      shell: bash
+      env:
+        POLICY_HASH: ${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', '.npmrc') }}
+      run: |
+        printf 'path=%s/lockfile-verified.jsonl\n' "$(pnpm cache path)" >> "$GITHUB_OUTPUT"
+        printf 'key=pnpm-verification-v1-%s-%s-%s-%s\n' "$RUNNER_OS" "$RUNNER_ARCH" "$(pnpm --version)" "$POLICY_HASH" >> "$GITHUB_OUTPUT"
+
+    - name: Restore pnpm verification record
+      id: verification-cache-restore
+      if: steps.verification-cache.outputs.key != ''
+      continue-on-error: true
+      uses: actions/cache/restore@v5
+      with:
+        path: ${{ steps.verification-cache.outputs.path }}
+        key: ${{ steps.verification-cache.outputs.key }}
 
     - name: Validate native runtime
       shell: bash
@@ -96,6 +152,15 @@ runs:
           git -C "$GITHUB_WORKSPACE" diff --exit-code -- package.json pnpm-lock.yaml pnpm-workspace.yaml
         fi
 
+    # pnpm checks the cached record's policy and validity; never bypass verification.
+    - name: Save pnpm verification record on main
+      if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request' && steps.verification-cache.outputs.key != '' && steps.verification-cache-restore.outputs.cache-hit != 'true'
+      continue-on-error: true
+      uses: actions/cache/save@v5
+      with:
+        path: ${{ steps.verification-cache.outputs.path }}
+        key: ${{ steps.verification-cache.outputs.key }}
+
     - name: Resolve Electron package cache
       id: electron-package-cache
       if: inputs.native-runtime == 'electron' || inputs.cache-electron-package == 'true'
@@ -116,12 +181,19 @@ runs:
         printf 'version=%s\n' "$(node -p "require('./node_modules/electron/package.json').version")" >> "$GITHUB_OUTPUT"
 
     - name: Cache Electron package archive
-      if: inputs.native-runtime == 'electron' || inputs.cache-electron-package == 'true'
+      if: (github.event_name != 'pull_request' || runner.os != 'Linux') && steps.electron-package-cache.outputs.version != ''
       uses: actions/cache@v5
       with:
         path: ${{ steps.electron-package-cache.outputs.cache-root }}
         key: electron-package-${{ runner.os }}-${{ runner.arch }}-${{ steps.electron-package-cache.outputs.version }}
 
+    - name: Restore Electron package archive without saving
+      if: github.event_name == 'pull_request' && runner.os == 'Linux' && steps.electron-package-cache.outputs.version != ''
+      uses: actions/cache/restore@v5
+      with:
+        path: ${{ steps.electron-package-cache.outputs.cache-root }}
+        key: electron-package-${{ runner.os }}-${{ runner.arch }}-${{ steps.electron-package-cache.outputs.version }}
+
     # Why cached: `--ignore-scripts` leaves node-pty without build/Release, so
     # ensure-native-runtime node-gyp-compiles it in every job that asks for a runtime.
     # The artifacts are ABI-bound, so the key carries the target runtime, the resolved
diff --git a/.github/actions/prepare-git-compatibility/action.yml b/.github/actions/prepare-git-compatibility/action.yml
new file mode 100644
index 00000000000..058d31a064c
--- /dev/null
+++ b/.github/actions/prepare-git-compatibility/action.yml
@@ -0,0 +1,32 @@
+name: Prepare baseline Git compatibility binary
+description: Restore or build the pinned Linux Git binary for the compatibility contract.
+
+runs:
+  using: composite
+  steps:
+    # The default-branch warmer shares this key across PRs; a PR save is private to its merge ref.
+    # Cache eviction remains possible, so keep the checksum-verified cold build below.
+    - name: Cache baseline Git build
+      uses: actions/cache@v5
+      with:
+        path: ~/.cache/orca-git-compat/git-2.25.5
+        key: git-compat-baseline-${{ runner.os }}-${{ runner.arch }}-2.25.5
+
+    # Finish the CPU-heavy build before any timed compatibility lanes start.
+    - name: Build the baseline Git binary
+      shell: bash
+      run: |
+        archive="$RUNNER_TEMP/git-2.25.5.tar.gz"
+        source="$HOME/.cache/orca-git-compat/git-2.25.5"
+        if [ -x "$source/git" ]; then
+          exit 0
+        fi
+        curl -fsSL https://www.kernel.org/pub/software/scm/git/git-2.25.5.tar.gz -o "$archive"
+        echo "41662c52fc16fec4963bfc41075e71f8ead6b5e386797eb6f9a1111ff95a8ddf  $archive" \
+          | sha256sum --check
+        mkdir -p "$source"
+        tar -xzf "$archive" -C "$source" --strip-components=1
+        make -C "$source" -j"$(nproc)" \
+          NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PYTHON=YesPlease git
+        # Object files are no longer needed after linking the cached binary.
+        find "$source" -name '*.o' -delete
diff --git a/.github/actions/prepare-linux-package-fixture/action.yml b/.github/actions/prepare-linux-package-fixture/action.yml
new file mode 100644
index 00000000000..a84568b3e06
--- /dev/null
+++ b/.github/actions/prepare-linux-package-fixture/action.yml
@@ -0,0 +1,63 @@
+name: Prepare cached Linux package fixture
+description: Restore Docker build layers; only the main warmer builds and saves missing images.
+inputs:
+  fixture:
+    description: Directory name below config/docker.
+    required: true
+  save-cache:
+    description: Build and save a missing fixture on the default branch.
+    default: 'false'
+outputs:
+  image:
+    description: Loaded image to use as a Docker build cache, or empty on a cache miss.
+    value: ${{ steps.image.outputs.image }}
+runs:
+  using: composite
+  steps:
+    - name: Restore fixture image
+      id: cache
+      uses: actions/cache/restore@v5
+      continue-on-error: true
+      with:
+        path: ${{ runner.temp }}/orca-package-fixtures/${{ inputs.fixture }}.tar
+        key: linux-package-fixture-v1-${{ runner.os }}-${{ runner.arch }}-linux-amd64-${{ inputs.fixture }}-${{ hashFiles(format('config/docker/{0}/**', inputs.fixture), '.github/actions/prepare-linux-package-fixture/action.yml') }}
+
+    - name: Load or seed fixture build cache
+      id: image
+      shell: bash
+      env:
+        FIXTURE: ${{ inputs.fixture }}
+        SAVE_CACHE: ${{ inputs.save-cache }}
+        CACHE_HIT: ${{ steps.cache.outputs.cache-hit }}
+      run: |
+        set -euo pipefail
+        case "$FIXTURE" in
+          headless-serve-shutdown|cli-launch-contract) ;;
+          *) echo "Unsupported package fixture: $FIXTURE" >&2; exit 1 ;;
+        esac
+        archive="$RUNNER_TEMP/orca-package-fixtures/$FIXTURE.tar"
+        image="orca-package-fixture-$FIXTURE:cache"
+        if [[ "$CACHE_HIT" == true ]] && docker load --input "$archive"; then
+          if docker image inspect "$image" > /dev/null; then
+            echo "image=$image" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+        fi
+        if [[ "$SAVE_CACHE" != true ]]; then
+          echo 'No usable fixture cache; the package runner will build normally.'
+          exit 0
+        fi
+        docker build --platform linux/amd64 --build-arg BUILDKIT_INLINE_CACHE=1 \
+          --tag "$image" --file "config/docker/$FIXTURE/Dockerfile" "config/docker/$FIXTURE"
+        mkdir -p "$(dirname "$archive")"
+        docker save --output "$archive" "$image"
+        echo "image=$image" >> "$GITHUB_OUTPUT"
+        echo 'built=true' >> "$GITHUB_OUTPUT"
+
+    - name: Save fixture image
+      if: inputs.save-cache == 'true' && steps.cache.outputs.cache-hit != 'true' && steps.image.outputs.built == 'true'
+      uses: actions/cache/save@v5
+      continue-on-error: true
+      with:
+        path: ${{ runner.temp }}/orca-package-fixtures/${{ inputs.fixture }}.tar
+        key: ${{ steps.cache.outputs.cache-primary-key }}
diff --git a/.github/actions/prepare-xterm-dependencies/action.yml b/.github/actions/prepare-xterm-dependencies/action.yml
new file mode 100644
index 00000000000..8fa54bd85ae
--- /dev/null
+++ b/.github/actions/prepare-xterm-dependencies/action.yml
@@ -0,0 +1,33 @@
+name: Restore xterm build dependencies
+description: Reuse installed dependencies for the pinned upstream checkout.
+outputs:
+  cache-key:
+    description: Exact dependency cache key.
+    value: ${{ steps.restore.outputs.cache-primary-key }}
+  cache-hit:
+    description: Whether the exact installed dependency cache was restored.
+    value: ${{ steps.restore.outputs.cache-hit }}
+runs:
+  using: composite
+  steps:
+    - id: runtime
+      shell: bash
+      run: |
+        . /etc/os-release
+        echo "image=$ID-$VERSION_ID" >> "$GITHUB_OUTPUT"
+        echo "node=$(node --version)" >> "$GITHUB_OUTPUT"
+    - id: restore
+      uses: actions/cache/restore@v5
+      with:
+        path: |
+          ${{ runner.temp }}/xterm-patch-build/upstream/.git
+          ${{ runner.temp }}/xterm-patch-build/upstream/node_modules
+        key: xterm-dependencies-v1-${{ runner.os }}-${{ steps.runtime.outputs.image }}-${{ runner.arch }}-${{ steps.runtime.outputs.node }}-${{ hashFiles('config/patches/xterm-upstream.json', 'config/scripts/regenerate-xterm-patches.mjs', 'config/scripts/xterm-patch-text.mjs', '.github/actions/prepare-xterm-dependencies/action.yml') }}
+    - name: Restore download cache on an installed-dependency miss
+      if: steps.restore.outputs.cache-hit != 'true'
+      uses: actions/cache/restore@v5
+      with:
+        path: |
+          ~/.npm
+          ${{ runner.temp }}/xterm-patch-build/upstream/.git
+        key: xterm-upstream-${{ hashFiles('config/patches/xterm-upstream.json') }}
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 9d7a73a6b88..326de25e153 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -12,7 +12,8 @@
 
 ## Linked Issue
 
-<!-- Link the issue this PR addresses, there should ALWAYS be one -->
+<!-- Link the issue this PR addresses, there should ALWAYS be one (for outside contributors) -->
+<!-- SPECIAL CASE: If you are a maintainer (member of stablyai org) AVOID opening needless issues. Only attach pre-existing ones -->
 
 Fixes #
 
diff --git a/.github/workflows/bun-profile-tests.yml b/.github/workflows/bun-profile-tests.yml
new file mode 100644
index 00000000000..1a292292510
--- /dev/null
+++ b/.github/workflows/bun-profile-tests.yml
@@ -0,0 +1,171 @@
+name: Bun profile persistence
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    paths:
+      - 'src/**'
+      - 'config/**'
+      - 'native/**'
+      - 'tests/**'
+      - 'resources/**'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - 'tsconfig.json'
+      - '.npmrc'
+      - '.pnpmfile.cjs'
+      - '.github/actions/install-node-dependencies/**'
+      - '.github/workflows/bun-profile-tests.yml'
+  # The pull request qualifies one platform for an unflavoured change; this is where all six
+  # are re-qualified, so a platform break surfaces minutes after merge instead of next cron.
+  push:
+    branches: [main]
+    paths:
+      - 'src/**'
+      - 'config/**'
+      - 'native/**'
+      - 'tests/**'
+      - 'resources/**'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - 'tsconfig.json'
+      - '.npmrc'
+      - '.pnpmfile.cjs'
+      - '.github/actions/install-node-dependencies/**'
+      - '.github/workflows/bun-profile-tests.yml'
+  workflow_dispatch:
+  schedule:
+    - cron: '30 11 * * *'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: bun-profile-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  changes:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      should_run: ${{ steps.scope.outputs.should_run }}
+      qualification: ${{ steps.scope.outputs.qualification }}
+      runners: ${{ steps.scope.outputs.runners }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 2
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+      - name: Detect Bun build and test inputs
+        id: scope
+        shell: bash
+        run: |
+          # Compare the tested merge with its base, retaining both sides of renames.
+          if git diff --name-only --no-renames -z HEAD^1 HEAD > "$RUNNER_TEMP/bun-changes"; then
+            node config/scripts/bun-profile-change-scope.mjs "$RUNNER_TEMP/bun-changes"
+          else
+            echo 'should_run=true' >> "$GITHUB_OUTPUT"
+          fi
+
+  persistence:
+    needs: changes
+    # Missing/failed detection runs the full matrix; manual runs remain unconditional.
+    # A draft carries no platform verdict; readiness re-triggers this workflow. Spelled against
+    # the event name so the push and schedule paths do not rest on a null property comparison.
+    if: >-
+      ${{ !cancelled() && needs.changes.outputs.should_run != 'false' &&
+      (github.event_name != 'pull_request' || github.event.pull_request.draft != true) }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ fromJSON(needs.changes.outputs.runners || '["ubuntu-22.04","ubuntu-24.04-arm","macos-14","macos-15-intel","windows-2022","windows-11-arm"]') }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: ${{ runner.os == 'Windows' && 'node' || 'none' }}
+      # build:orcad reuses the host addon validated by native-runtime preparation.
+      - run: pnpm build:orcad
+      - run: pnpm test:bun:profile --artifact
+      - uses: actions/setup-node@v6
+        if: runner.arch == 'X64'
+        with:
+          node-version: '18'
+      - name: Verify Node 18 loads and hands off to bundled Bun
+        if: runner.arch == 'X64'
+        run: |
+          node out/orcad/orcad.js --orcad-smoke-load-check
+          node out/orcad/orcad.js --orcad-profile-state-preflight 00000000-0000-4000-8000-000000000018
+
+  linux_glibc_floor:
+    needs: [changes, persistence]
+    # A failed smoke already blocks qualification; missing scope still selects every platform.
+    if: >-
+      ${{ !cancelled() && needs.persistence.result == 'success' &&
+      needs.changes.outputs.should_run != 'false' &&
+      needs.changes.outputs.qualification != 'false' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, ubuntu-24.04-arm]
+    runs-on: ${{ matrix.os }}
+    container: ubuntu:20.04
+    timeout-minutes: 20
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - name: Install Ubuntu 20.04 prerequisites
+        run: apt-get update && apt-get install -y build-essential ca-certificates git python3 unzip
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Trust the checked-out workspace
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      - uses: ./.github/actions/install-node-dependencies
+      - run: pnpm build:orcad
+      - run: pnpm test:bun:profile --artifact
+
+  linux_musl:
+    needs: [changes, persistence]
+    # A failed smoke already blocks qualification; missing scope still selects every platform.
+    if: >-
+      ${{ !cancelled() && needs.persistence.result == 'success' &&
+      needs.changes.outputs.should_run != 'false' &&
+      needs.changes.outputs.qualification != 'false' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, ubuntu-24.04-arm]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Verify native Alpine artifact and persistence
+        run: |
+          docker run --rm --init -i \
+            -e ORCA_BACKGROUND_LAUNCH=1 \
+            -v "$GITHUB_WORKSPACE:/work" -w /work \
+            node:24-alpine3.23 sh -s <<'BUN_QUALIFICATION'
+          set -eu
+          apk add --no-cache bash git libstdc++ python3 make g++
+          git config --global --add safe.directory /work
+          npm install -g "$(node -p "require('./package.json').packageManager.split('+')[0]")"
+          pnpm install --frozen-lockfile --ignore-scripts
+          pnpm build:orcad
+          pnpm test:bun:profile --artifact
+          BUN_QUALIFICATION
diff --git a/.github/workflows/ci-cache-warmup.yml b/.github/workflows/ci-cache-warmup.yml
new file mode 100644
index 00000000000..7309f7e3912
--- /dev/null
+++ b/.github/workflows/ci-cache-warmup.yml
@@ -0,0 +1,131 @@
+name: Warm shared CI caches
+
+on:
+  schedule:
+    - cron: '41 * * * *'
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - '.github/workflows/ci-cache-warmup.yml'
+      - '.github/actions/install-node-dependencies/**'
+      - '.github/actions/prepare-git-compatibility/**'
+      - '.github/actions/prepare-linux-package-fixture/**'
+      - 'config/docker/headless-serve-shutdown/**'
+      - 'config/docker/cli-launch-contract/**'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - 'config/tsconfig*.json'
+      - 'config/scripts/ensure-native-runtime.mjs'
+      - 'config/scripts/rebuild-native-deps.mjs'
+      - 'config/patches/node-pty@1.1.0.patch'
+      - 'config/patches/@vscode__windows-process-tree@0.8.0.patch'
+      - 'native/windows-registry/**'
+  pull_request:
+    paths:
+      - '.github/workflows/ci-cache-warmup.yml'
+      - '.github/actions/prepare-git-compatibility/**'
+      - '.github/actions/prepare-linux-package-fixture/**'
+      - 'config/docker/headless-serve-shutdown/**'
+      - 'config/docker/cli-launch-contract/**'
+      - 'config/scripts/ci-cache-warmup-workflow.test.mjs'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-cache-warmup-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  warm:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      # Default-branch caches can be restored by every PR; PR caches cannot.
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: node
+          node-version: '24'
+          cache-electron-package: 'true'
+
+      - name: Populate shared Electron archive
+        run: node config/scripts/install-electron-package-binary.mjs
+
+      - uses: ./.github/actions/prepare-git-compatibility
+
+      - name: Cache TypeScript incremental state
+        id: typecheck-cache
+        uses: actions/cache@v5
+        with:
+          path: config/*.tsbuildinfo
+          key: tsbuildinfo-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml', 'config/tsconfig*.json') }}-${{ github.sha }}
+          restore-keys: |
+            tsbuildinfo-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml', 'config/tsconfig*.json') }}-
+
+      - name: Refresh TypeScript state for this commit
+        if: steps.typecheck-cache.outputs.cache-hit != 'true'
+        run: pnpm run typecheck
+
+  warm-linux-arm:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 10
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: node
+          node-version: '24'
+          cache-electron-package: 'true'
+      - name: Populate shared Electron archive
+        run: node config/scripts/install-electron-package-binary.mjs
+      - name: Verify native cache is usable
+        run: node config/scripts/ensure-native-runtime.mjs --check-only
+
+  warm-windows:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-2022, windows-11-arm]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: node
+      - name: Verify native cache is usable
+        run: node config/scripts/ensure-native-runtime.mjs --check-only
+
+  warm-linux-package-fixtures:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/prepare-linux-package-fixture
+        with:
+          fixture: headless-serve-shutdown
+          save-cache: ${{ github.event_name != 'pull_request' }}
+      - uses: ./.github/actions/prepare-linux-package-fixture
+        with:
+          fixture: cli-launch-contract
+          save-cache: ${{ github.event_name != 'pull_request' }}
diff --git a/.github/workflows/ci-closed-pr-caches.yml b/.github/workflows/ci-closed-pr-caches.yml
new file mode 100644
index 00000000000..38cf5803a14
--- /dev/null
+++ b/.github/workflows/ci-closed-pr-caches.yml
@@ -0,0 +1,33 @@
+name: Clean closed PR caches
+
+on:
+  pull_request_target:
+    types: [closed]
+
+permissions:
+  actions: write
+
+jobs:
+  clean:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      # No checkout: this runs trusted default-branch code, including for fork PRs.
+      - uses: actions/github-script@v8
+        with:
+          script: |
+            const ref = `refs/pull/${context.payload.pull_request.number}/merge`
+            const caches = await github.paginate(github.rest.actions.getActionsCacheList, {
+              ...context.repo, ref, per_page: 100
+            })
+            for (const cache of caches) {
+              if (cache.ref !== ref) throw new Error(`Unexpected cache ref: ${cache.ref}`)
+              try {
+                await github.rest.actions.deleteActionsCacheById({
+                  ...context.repo, cache_id: cache.id
+                })
+              } catch (error) {
+                if (error.status !== 404) throw error
+              }
+            }
+            core.info(`Removed ${caches.length} caches scoped to ${ref}`)
diff --git a/.github/workflows/ci-pnpm-verification-pilot.yml b/.github/workflows/ci-pnpm-verification-pilot.yml
new file mode 100644
index 00000000000..2a35a52fcd0
--- /dev/null
+++ b/.github/workflows/ci-pnpm-verification-pilot.yml
@@ -0,0 +1,65 @@
+name: pnpm verification cache pilot
+
+on:
+  pull_request:
+    paths: ['.github/workflows/ci-pnpm-verification-pilot.yml']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pnpm-verification-pilot-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  ORCA_BACKGROUND_LAUNCH: '1'
+
+jobs:
+  seed:
+    strategy:
+      matrix:
+        runner: [ubuntu-latest, ubuntu-24.04-arm]
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+        id: deps
+      # PR caches are scoped to the PR merge ref; main never restores them.
+      - uses: actions/cache/save@v5
+        if: steps.deps.outputs.verification-cache-hit != 'true'
+        with:
+          path: ${{ steps.deps.outputs.verification-cache-path }}
+          key: ${{ steps.deps.outputs.verification-cache-key }}
+
+  measure:
+    needs: seed
+    name: measure ${{ matrix.runner }} sample ${{ matrix.sample }} cache ${{ matrix.cache }}
+    strategy:
+      fail-fast: false
+      max-parallel: 4
+      matrix:
+        runner: [ubuntu-latest, ubuntu-24.04-arm]
+        sample: [1, 2, 3]
+        cache: ['false', 'true']
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+        id: deps
+        with:
+          cache-pnpm-verification: ${{ matrix.cache }}
+      - name: Validate treatment and frozen install
+        env:
+          CACHE_ENABLED: ${{ matrix.cache }}
+          CACHE_HIT: ${{ steps.deps.outputs.verification-cache-hit }}
+        run: |
+          if [ "$CACHE_ENABLED" = true ]; then test "$CACHE_HIT" = true; fi
+          git diff --exit-code -- package.json pnpm-lock.yaml pnpm-workspace.yaml
+          node -e "require.resolve('vitest'); require.resolve('electron')"
diff --git a/.github/workflows/ci-runner-demand.yml b/.github/workflows/ci-runner-demand.yml
new file mode 100644
index 00000000000..966813a65e4
--- /dev/null
+++ b/.github/workflows/ci-runner-demand.yml
@@ -0,0 +1,33 @@
+name: CI runner demand
+
+on:
+  schedule:
+    - cron: '23 4 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: ci-runner-demand
+  cancel-in-progress: false
+
+jobs:
+  report:
+    runs-on: ubuntu-slim
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          sparse-checkout: config/scripts
+          persist-credentials: false
+      - name: Measure the previous complete 24 hours
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node config/scripts/ci-runner-demand.mjs
+      - uses: actions/upload-artifact@v7
+        with:
+          name: ci-runner-demand-${{ github.run_id }}
+          path: ci-demand/
+          retention-days: 30
diff --git a/.github/workflows/ci-xterm-cache.yml b/.github/workflows/ci-xterm-cache.yml
new file mode 100644
index 00000000000..fada7ea8cab
--- /dev/null
+++ b/.github/workflows/ci-xterm-cache.yml
@@ -0,0 +1,55 @@
+name: Shared xterm dependency cache
+on:
+  push:
+    branches: [main]
+    paths:
+      - '.github/workflows/ci-xterm-cache.yml'
+      - '.github/actions/prepare-xterm-dependencies/**'
+      - 'config/patches/xterm-upstream.json'
+      - 'config/scripts/regenerate-xterm-patches.mjs'
+      - 'config/scripts/xterm-patch-text.mjs'
+      - 'package.json'
+  # Refresh after Node patch releases or cache eviction without rebuilding on hits.
+  schedule:
+    - cron: '17 5 * * *'
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: xterm-cache-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+env:
+  ORCA_BACKGROUND_LAUNCH: '1'
+jobs:
+  seed:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: package.json
+          package-manager-cache: false
+      - uses: ./.github/actions/prepare-xterm-dependencies
+        id: cache
+      - name: Verify and populate dependencies
+        if: steps.cache.outputs.cache-hit != 'true'
+        run: node config/scripts/regenerate-xterm-patches.mjs --check --work-dir="$RUNNER_TEMP/xterm-patch-build"
+      - uses: actions/cache/save@v5
+        if: steps.cache.outputs.cache-hit != 'true'
+        with:
+          path: |
+            ${{ runner.temp }}/xterm-patch-build/upstream/.git
+            ${{ runner.temp }}/xterm-patch-build/upstream/node_modules
+          key: ${{ steps.cache.outputs.cache-key }}
+      - name: Preserve fallback downloads
+        if: steps.cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v5
+        with:
+          path: |
+            ~/.npm
+            ${{ runner.temp }}/xterm-patch-build/upstream/.git
+          key: xterm-upstream-${{ hashFiles('config/patches/xterm-upstream.json') }}
diff --git a/.github/workflows/cloud-verify.yml b/.github/workflows/cloud-verify.yml
index 6191552dab9..6c4cb9a53a1 100644
--- a/.github/workflows/cloud-verify.yml
+++ b/.github/workflows/cloud-verify.yml
@@ -32,9 +32,30 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          fetch-depth: 0
+          fetch-depth: 1
+
+      - name: Pull Gitleaks image
+        id: gitleaks-image
+        background: true
+        run: docker pull zricethezav/gitleaks@sha256:cdbb7c955abce02001a9f6c9f602fb195b7fadc1e812065883f695d1eeaba854
+
+      - name: Pull TruffleHog image
+        id: trufflehog-image
+        background: true
+        run: docker pull trufflesecurity/trufflehog@sha256:5dc064868ba7933601b5cbaea6954954d524ddd5dc6222a9667acea70068bf7d
+
+      # Scan every ancestor of HEAD without downloading unrelated branch/tag histories.
+      - name: Fetch complete scan history
+        working-directory: .
+        run: |
+          git fetch --no-tags --unshallow origin "$GITHUB_SHA"
+          test "$(git rev-parse --is-shallow-repository)" = false
+
+      - wait: [gitleaks-image, trufflehog-image]
 
       - name: Scan Cloud history reachable from HEAD with Gitleaks
+        id: history-scan
+        background: true
         run: >-
           docker run --rm
           --volume "${GITHUB_WORKSPACE}:/repo:ro"
@@ -51,6 +72,8 @@ jobs:
           --include-paths=/repo/cloud/.trufflehog-include-paths.txt
           --exclude-paths=/repo/cloud/.trufflehog-exclude-paths.txt
 
+      - wait: history-scan
+
   # Compiles the workspace. No Postgres service: nothing here reaches a
   # database, and the service container costs ~13s of startup.
   build:
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index f42d1184ce9..4177b141d8a 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -32,9 +32,8 @@ on:
         required: false
         type: string
   schedule:
-    # Why: GitHub cron uses UTC; these slots map to 10am and 3pm
-    # America/Phoenix for the default-branch E2E run.
-    - cron: '0 17,22 * * *'
+    # One complete daily reference run; targeted PR coverage remains unchanged.
+    - cron: '0 17 * * *'
 
 jobs:
   build:
@@ -62,11 +61,26 @@ jobs:
           status=0
           pnpm run build:relay &
           relay_pid=$!
-          npx electron-vite build --mode e2e || status=1
-          pnpm run build:web-from-renderer || status=1
+          pnpm run build:electron-vite:parallel --mode e2e || status=1
           wait "$relay_pid" || status=1
           exit "$status"
 
+      # The CLI emits into out/main too; start only after Electron finishes clearing that tree.
+      - name: Build shared E2E CLI
+        id: e2e-cli
+        background: true
+        run: |
+          if node -e 'process.exit(require("./package.json").scripts["prepare:cli-output"] ? 0 : 1)'; then
+            pnpm run build:cli
+          else
+            echo "Older ref: let each consumer build and install its CLI."
+          fi
+
+      - name: Project shared E2E web client
+        run: pnpm run build:web-from-renderer
+
+      - wait: e2e-cli
+
       - name: Upload E2E build output
         uses: actions/upload-artifact@v7
         with:
@@ -186,7 +200,14 @@ jobs:
           node config/scripts/ci-e2e-shard-plan.mjs --verify ci-shards/assignment.json ci-shards/selected-discovery.json
 
       - name: Run E2E tests (${{ matrix.shard_name }})
-        run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 ORCA_E2E_WEB_CLIENT=1 ORCA_RELAY_PATH="$GITHUB_WORKSPACE/out/relay" pnpm run test:e2e --test-list=ci-shards/selected.txt
+        env:
+          PLAYWRIGHT_JSON_OUTPUT_FILE: ci-shards/results.json
+        run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 ORCA_E2E_WEB_CLIENT=1 ORCA_RELAY_PATH="$GITHUB_WORKSPACE/out/relay" pnpm run test:e2e --test-list=ci-shards/selected.txt --reporter=list,json
+
+      - name: Summarize E2E failures
+        if: always()
+        continue-on-error: true
+        run: node config/scripts/ci-e2e-failure-summary.mjs ci-shards/results.json
 
       - name: Upload E2E shard assignment
         if: always()
@@ -221,8 +242,6 @@ jobs:
     needs: [build, prepare-native-cache]
     if: inputs.test_files != ''
     runs-on: ubuntu-latest
-    # Why 45: pr.yml now maps SSH source edits onto Docker-backed specs, so this lane can
-    # pay a container image build plus ~22 serial SSH tests on top of the changed specs.
     timeout-minutes: 45
 
     steps:
@@ -256,14 +275,38 @@ jobs:
           # ORCA_E2E_NATIVE_IBUS_HANGUL, which this lane cannot set because it has no ibus
           # session. Running it here reported a green skip as coverage.
           mapfile -t TEST_FILES < <(jq -r '.[] | select(
+            . != "tests/e2e/local-ssh-browser-routing.spec.ts" and
+            . != "tests/e2e/ssh-client-hosted-browser-drop-reconnect.spec.ts" and
+            . != "tests/e2e/pty-input-write-queue-ssh.spec.ts" and
+            . != "tests/e2e/ssh-ai-vault-session-history.spec.ts" and
+            . != "tests/e2e/ssh-codex-display-artifacts-repro.spec.ts" and
+            . != "tests/e2e/ssh-cold-activation-restore.spec.ts" and
+            . != "tests/e2e/ssh-cold-hydration-gap-tab-seeding.spec.ts" and
+            . != "tests/e2e/ssh-docker-five-pane-input-under-flood.spec.ts" and
+            . != "tests/e2e/ssh-docker-bulk-open-freeze-repro.spec.ts" and
+            . != "tests/e2e/ssh-docker-half-open-link.spec.ts" and
+            . != "tests/e2e/ssh-docker-quick-open-large-listing.spec.ts" and
+            . != "tests/e2e/ssh-docker-reconnect-pane-restore.spec.ts" and
+            . != "tests/e2e/ssh-docker-relay-stall-credential.spec.ts" and
+            . != "tests/e2e/ssh-docker-resource-accumulation.spec.ts" and
+            . != "tests/e2e/ssh-docker-transport-drop-recovery.spec.ts" and
+            . != "tests/e2e/ssh-external-image-preview.spec.ts" and
+            . != "tests/e2e/ssh-lost-kill-tab-resurrection.spec.ts" and
+            . != "tests/e2e/ssh-pi-compatible-agent-title.spec.ts" and
+            . != "tests/e2e/ssh-port-forward-lifecycle.spec.ts" and
+            . != "tests/e2e/ssh-reconnect-tab-destruction.spec.ts" and
+            . != "tests/e2e/ssh-restart-tab-accumulation.spec.ts" and
+            . != "tests/e2e/ssh-skill-installation.spec.ts" and
+            . != "tests/e2e/ssh-stale-resume-execution-host-scope.spec.ts" and
+            . != "tests/e2e/ssh-terminal-window-wake-stale-grid-repro.spec.ts" and
+            . != "tests/e2e/terminal-inline-images-ssh.spec.ts" and
+            . != "tests/e2e/ssh-docker-watcher-isolation.spec.ts" and
+            . != "tests/e2e/ssh-terminal-parking.spec.ts" and
+            . != "tests/e2e/terminal-retention-budget.spec.ts" and
             . != "tests/e2e/ssh-startup-exec-readiness.spec.ts" and
             . != "tests/e2e/paired-startup-exec-readiness.spec.ts" and
-            . != "tests/e2e/ssh-docker-five-pane-input-under-flood.spec.ts" and
-            . != "tests/e2e/local-ssh-browser-routing.spec.ts" and
             . != "tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts" and
             . != "tests/e2e/ssh-localhost.spec.ts" and
-            . != "tests/e2e/ssh-client-hosted-browser-drop-reconnect.spec.ts" and
-            . != "tests/e2e/ssh-docker-bulk-open-freeze-repro.spec.ts" and
             . != "tests/e2e/terminal-ibus-hangul-native.spec.ts"
           )' <<<"$TEST_FILES_JSON")
           if [ "${#TEST_FILES[@]}" -eq 0 ]; then
@@ -295,25 +338,47 @@ jobs:
           if-no-files-found: ignore
 
   ssh-docker-watcher-isolation:
-    name: ssh docker watcher isolation
+    name: ssh docker watcher isolation (${{ matrix.shard }}/4)
     needs: [build, prepare-native-cache]
-    # effect of one route listing a startup-readiness spec — pruning that spec would have
-    # silently retired the whole lane. The signal is now derived from the SSH routes directly.
-    # The explicit spec clauses stay for their honest purpose: changed-e2e hands these specs to this
-    # lane, so editing one must still run it here.
+    # Each excluded changed spec must trigger its dedicated owner.
     if: >-
       inputs.test_files == '' ||
       inputs.ssh_source_changed == 'true' ||
-      contains(inputs.test_files, 'tests/e2e/ssh-docker-five-pane-input-under-flood.spec.ts') ||
       contains(inputs.test_files, 'tests/e2e/local-ssh-browser-routing.spec.ts') ||
       contains(inputs.test_files, 'tests/e2e/ssh-client-hosted-browser-drop-reconnect.spec.ts') ||
-      contains(inputs.test_files, 'tests/e2e/ssh-startup-exec-readiness.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/pty-input-write-queue-ssh.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-ai-vault-session-history.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-codex-display-artifacts-repro.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-cold-activation-restore.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-cold-hydration-gap-tab-seeding.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-docker-five-pane-input-under-flood.spec.ts') ||
       contains(inputs.test_files, 'tests/e2e/ssh-docker-bulk-open-freeze-repro.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-docker-half-open-link.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-docker-quick-open-large-listing.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-docker-reconnect-pane-restore.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-docker-relay-stall-credential.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-docker-resource-accumulation.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-docker-transport-drop-recovery.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-external-image-preview.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-lost-kill-tab-resurrection.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-pi-compatible-agent-title.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-port-forward-lifecycle.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-reconnect-tab-destruction.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-restart-tab-accumulation.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-skill-installation.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-stale-resume-execution-host-scope.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-terminal-window-wake-stale-grid-repro.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/terminal-inline-images-ssh.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-docker-watcher-isolation.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-terminal-parking.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/terminal-retention-budget.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-startup-exec-readiness.spec.ts') ||
       contains(inputs.test_files, 'tests/e2e/paired-startup-exec-readiness.spec.ts')
     runs-on: ubuntu-latest
-    # Why 60: this lane now also runs the remaining Docker-SSH specs serially. They average
-    # ~18s but several budget 4-10 minutes per test, so a slow run lands far above the old 35
-    # — and the sharded lanes already show that a lane which times out is a lane nobody trusts.
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
     timeout-minutes: 60
 
     steps:
@@ -338,13 +403,14 @@ jobs:
       # Why: this is the release-path proof that the deployed Linux relay keeps
       # its PTY and explorer live across a real watcher SIGSEGV.
       - name: Run Docker SSH watcher isolation E2E
+        if: matrix.shard == 1
         run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker-watcher-isolation
 
       # Why: Playwright empties test-results/ when it starts, so each step here used to
       # destroy the previous step's traces. Only the last lane's failure was ever
       # diagnosable from the artifact; set each lane aside before the next one runs.
       - name: Keep watcher-isolation traces
-        if: always()
+        if: always() && matrix.shard == 1
         run: |
           if [ -d test-results ]; then
             mkdir -p e2e-traces
@@ -354,24 +420,21 @@ jobs:
       # Why always(): this lane gates SSH parking/retention plus startup-exec
       # readiness across live SSH, headed paired, and headless serve topologies.
       - name: Run Docker SSH terminal parking + startup readiness E2E
-        if: always()
+        if: always() && matrix.shard == 1
         run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker-terminal-parking
 
       - name: Keep terminal-parking traces
-        if: always()
+        if: always() && matrix.shard == 1
         run: |
           if [ -d test-results ]; then
             mkdir -p e2e-traces
             mv test-results "e2e-traces/terminal-parking"
           fi
 
-      # Why here rather than the sharded lanes: the shards set no ORCA_E2E_SSH_DOCKER, so every
-      # spec below skipped itself while the shard still reported green. Running them on this one
-      # VM pays the fixture image build once instead of ten times, and keeps an SSH regression
-      # legible as an SSH-named failure.
+      # Separate VMs isolate destructive SSH fixtures while keeping one worker per shard.
       - name: Run remaining Docker SSH E2E
         if: always()
-        run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker
+        run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker --shard=${{ matrix.shard }}/4
 
       - name: Keep remaining-ssh-docker traces
         if: always()
@@ -385,7 +448,7 @@ jobs:
         if: failure()
         uses: actions/upload-artifact@v7
         with:
-          name: playwright-traces-ssh-docker-watcher-isolation
+          name: playwright-traces-ssh-docker-watcher-isolation-${{ matrix.shard }}
           path: e2e-traces/
           retention-days: 7
           if-no-files-found: ignore
diff --git a/.github/workflows/git-command-termination-runtime.yml b/.github/workflows/git-command-termination-runtime.yml
index 1602bae956a..6b49177ed56 100644
--- a/.github/workflows/git-command-termination-runtime.yml
+++ b/.github/workflows/git-command-termination-runtime.yml
@@ -7,6 +7,9 @@ on:
   workflow_dispatch:
 permissions:
   contents: read
+concurrency:
+  group: git-command-termination-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   windows-exit:
     runs-on: windows-latest
diff --git a/.github/workflows/golden-e2e-experiment.yml b/.github/workflows/golden-e2e-experiment.yml
index 11cfa866c67..0b80662d716 100644
--- a/.github/workflows/golden-e2e-experiment.yml
+++ b/.github/workflows/golden-e2e-experiment.yml
@@ -66,10 +66,10 @@ jobs:
       - name: Run golden E2E tests on Linux
         if: runner.os == 'Linux'
         run: |
-          xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e -- tests/e2e/golden-core-flows.spec.ts
+          xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e tests/e2e/golden-core-flows.spec.ts
           xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run --if-present test:e2e:workspace-session-golden
           if [ -f tests/e2e/golden-fresh-profile-terminal.spec.ts ]; then
-            xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e -- tests/e2e/golden-fresh-profile-terminal.spec.ts tests/e2e/golden-shell-command.spec.ts
+            xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e tests/e2e/golden-fresh-profile-terminal.spec.ts tests/e2e/golden-shell-command.spec.ts
           fi
           xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:terminal-rendering-golden
           xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run --if-present test:e2e:posix-profile-index-golden
@@ -80,10 +80,10 @@ jobs:
       - name: Run golden E2E tests on macOS
         if: runner.os == 'macOS'
         run: |
-          env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e -- tests/e2e/golden-core-flows.spec.ts
+          env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e tests/e2e/golden-core-flows.spec.ts
           env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run --if-present test:e2e:workspace-session-golden
           if [ -f tests/e2e/golden-fresh-profile-terminal.spec.ts ]; then
-            env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e -- tests/e2e/golden-fresh-profile-terminal.spec.ts tests/e2e/golden-shell-command.spec.ts
+            env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e tests/e2e/golden-fresh-profile-terminal.spec.ts tests/e2e/golden-shell-command.spec.ts
           fi
           env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:terminal-rendering-golden
           env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run --if-present test:e2e:posix-profile-index-golden
@@ -104,7 +104,7 @@ jobs:
           pnpm run --if-present test:e2e:tab-bar-agent-launch-golden
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           if (Test-Path tests/e2e/golden-fresh-profile-terminal.spec.ts) {
-            pnpm run test:e2e -- tests/e2e/golden-fresh-profile-terminal.spec.ts tests/e2e/golden-shell-command.spec.ts
+            pnpm run test:e2e tests/e2e/golden-fresh-profile-terminal.spec.ts tests/e2e/golden-shell-command.spec.ts
             if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           }
           pnpm run --if-present test:e2e:source-control-golden
diff --git a/.github/workflows/homebrew-bump.yml b/.github/workflows/homebrew-bump.yml
index 9b04d3205fc..a5f9b352f6e 100644
--- a/.github/workflows/homebrew-bump.yml
+++ b/.github/workflows/homebrew-bump.yml
@@ -132,11 +132,10 @@ jobs:
           print(src)
           PY
 
-      # Why: reuse the existing buf0-bot GitHub App (also used by
-      # track-community-prs.yaml) instead of minting a new PAT. The app is
-      # installed org-wide, so it has access to stablyai/homebrew-orca
-      # automatically. GITHUB_TOKEN cannot push cross-repo; a short-lived
-      # installation token can.
+      # Why: reuse the existing buf0-bot GitHub App instead of minting a new
+      # PAT. The app is installed org-wide, so it has access to
+      # stablyai/homebrew-orca automatically. GITHUB_TOKEN cannot push
+      # cross-repo; a short-lived installation token can.
       - name: Generate buf0-bot token
         id: app-token
         uses: actions/create-github-app-token@v3
diff --git a/.github/workflows/issue-os-labeler.yaml b/.github/workflows/issue-os-labeler.yaml
index c437db7f21a..cf0ee59a842 100644
--- a/.github/workflows/issue-os-labeler.yaml
+++ b/.github/workflows/issue-os-labeler.yaml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   apply-os-label:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     timeout-minutes: 5
     steps:
       - name: Apply OS label from issue form
diff --git a/.github/workflows/mobile.yml b/.github/workflows/mobile.yml
index aae50234bf9..bc9f8241f94 100644
--- a/.github/workflows/mobile.yml
+++ b/.github/workflows/mobile.yml
@@ -6,7 +6,6 @@ on:
       - opened
       - synchronize
       - reopened
-      - ready_for_review
     paths:
       - 'mobile/**'
       # Mobile launch contracts exercise the real host dispatcher and durable receipt store.
@@ -38,9 +37,12 @@ on:
       - '.github/workflows/mobile.yml'
       - '.github/actions/install-node-dependencies/**'
       - '.github/workflows/mobile-ios-release.yml'
-  # Why main too: a behaviour-change branch legitimately pins its own last fenced commit, and that
-  # commit only stops being reachable when the branch squash-merges. The pull_request run cannot
-  # see that; this one is where the pin guard finds it.
+      - 'config/scripts/mobile-release-check-scope*'
+      - 'config/scripts/mobile-test-change-scope*'
+      - 'config/scripts/pr-code-change-scope.mjs'
+      - 'config/scripts/mobile-recording-pin-checkout.test.mjs'
+  # Why main too: a squash is where a spliced corpus lands, and where a behaviour-change branch's
+  # own pinned commit leaves main's history for its pull request's head ref, which the guard follows.
   push:
     branches:
       - main
@@ -58,7 +60,10 @@ concurrency:
 jobs:
   verify:
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
+    # Why ARM: 209s of this job is Vitest and nothing here needs x86: no Android SDK, emulator, gradle,
+    # Hermes or Watchman, no docker, and no artifacts. The Gemfile.lock lists the generic `ruby`
+    # platform, so frozen bundler installs without an aarch64-linux entry.
+    runs-on: ubuntu-24.04-arm
 
     env:
       # Why: an unfrozen bundler silently re-resolves when Gemfile.lock drifts
@@ -73,6 +78,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          fetch-depth: 2
 
       - uses: ./.github/actions/install-node-dependencies
         with:
@@ -80,10 +87,23 @@ jobs:
             pnpm-lock.yaml
             mobile/pnpm-lock.yaml
 
+      - name: Detect Ruby release inputs
+        id: ruby-scope
+        shell: bash
+        working-directory: .
+        run: |
+          # Keep deletions when release files move into an application directory.
+          if ! git diff --name-only --no-renames -z HEAD^1 HEAD > "$RUNNER_TEMP/mobile-release-changes"; then
+            echo 'should_run=true' >> "$GITHUB_OUTPUT"
+          elif ! node config/scripts/mobile-release-check-scope.mjs "$RUNNER_TEMP/mobile-release-changes"; then
+            echo 'should_run=true' >> "$GITHUB_OUTPUT"
+          fi
+
       # bundler-cache installs mobile/Gemfile.lock, so this job is also what
       # proves the pinned fastlane the release workflow depends on still
       # resolves — before a release run finds out.
       - name: Setup Ruby and fastlane
+        if: steps.ruby-scope.outputs.should_run != 'false'
         uses: ruby/setup-ruby@v1
         with:
           ruby-version: '3.3'
@@ -93,7 +113,10 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      # Both compilers are read-only; finish them before starting the test workers.
       - name: Typecheck
+        id: production-types
+        background: true
         run: pnpm typecheck
 
       # Why a ratchet and not the raw typecheck: mobile/tsconfig.json excludes test files, so until
@@ -103,19 +126,37 @@ jobs:
       - name: Typecheck tests (ratchet)
         run: pnpm run check:tests-typecheck
 
+      - wait: production-types
+
       # This includes the bridged replay of the whole recording corpus, which used to be a second
       # step of its own behind RPC_FOUNDATION_BRIDGE=1. A gate nobody can forget to set is the point:
       # it fails when a divergence class grows, when a divergence lands in no class at all, or when
       # one of the 103 goldens inside the C1 page closure changes the verdict it is pinned to. It is
       # ~3 min of test time on its own, and Vitest runs it on a worker beside the rest of the suite,
       # so folding it in costs a fraction of that in wall time and one step less to skip.
+      - name: Detect mobile test inputs
+        id: test-scope
+        shell: bash
+        working-directory: .
+        run: |
+          if ! git diff --name-only --no-renames -z HEAD^1 HEAD > "$RUNNER_TEMP/mobile-test-changes"; then
+            echo 'should_run=true' >> "$GITHUB_OUTPUT"
+          elif ! node config/scripts/mobile-test-change-scope.mjs "$RUNNER_TEMP/mobile-test-changes"; then
+            echo 'should_run=true' >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Test
+        if: steps.test-scope.outputs.should_run != 'false'
+        env:
+          ORCA_BACKGROUND_LAUNCH: '1'
         run: pnpm test
 
       - name: Test iOS release version resolution
+        if: steps.ruby-scope.outputs.should_run != 'false'
         run: ruby fastlane/ios_release_version_test.rb
 
       - name: Test TestFlight lane arguments
+        if: steps.ruby-scope.outputs.should_run != 'false'
         run: ruby fastlane/fastfile_testflight_arguments_test.rb
 
       # Why: nothing else in CI loads the Fastfile, so a syntax error, a broken
@@ -124,6 +165,7 @@ jobs:
       # loads and lists, so it needs no App Store Connect credentials and makes
       # no network calls to Apple.
       - name: Smoke-check the Fastfile
+        if: steps.ruby-scope.outputs.should_run != 'false'
         env:
           FASTLANE_SKIP_UPDATE_CHECK: '1'
           FASTLANE_OPT_OUT_USAGE: '1'
@@ -137,7 +179,12 @@ jobs:
 
   recording-pin:
     name: RPC recording pin
-    runs-on: ubuntu-latest
+    # Why ARM: pure Node plus git; the golden comparison masks `platform`.
+    runs-on: ubuntu-24.04-arm
+    # Why pull-requests: the guard asks GitHub which pull requests hold a pin main's history lacks.
+    permissions:
+      contents: read
+      pull-requests: read
 
     defaults:
       run:
@@ -147,11 +194,13 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
         with:
-          # The ancestry verdict is read straight off history. On a shallow checkout
+          # The reachability verdict is read straight off history. On a shallow checkout
           # `git merge-base --is-ancestor` answers from grafted parents, so the guard refuses to
           # answer at all rather than reporting a pass it has no evidence for -- and the pinned tree
           # below has to be checkable out.
           fetch-depth: 0
+          # Ancestry needs commits; the pinned worktree fetches its historical blobs on demand.
+          filter: blob:none
 
       - uses: ./.github/actions/install-node-dependencies
         with:
@@ -165,12 +214,14 @@ jobs:
       # Seconds. No `--ref`, so the pin is judged against the same tree it was read out of. On a
       # pull request that is the merge preview, which already carries main's repins; judging the
       # branch head instead fails every branch cut before the day's repin, and its instruction would
-      # tell the author to pin their own head -- creating the break this guard exists to catch. A
-      # branch that pins its own commit passes here and fails on the push after the squash, which is
-      # where the pin actually leaves the history.
+      # tell the author to pin their own head. A branch that pins its own commit still passes on the
+      # push after the squash: the guard asks GitHub which pull requests hold the pin and fetches
+      # their `refs/pull/<n>/head`, which GitHub keeps for good. The token lifts the API rate limit.
       - name: Check the recording pin is reachable
         shell: bash
-        run: pnpm exec tsx scripts/rpc-recording-pin-guard.mts ancestry
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: pnpm exec tsx scripts/rpc-recording-pin-guard.mts reachable
 
       # ~2 min locally for the record itself, so it is gated rather than run twice over. A pull
       # request that moves none of the corpus, the manifest or the recorder cannot move this
@@ -180,6 +231,7 @@ jobs:
       - name: Reproduce the corpus from the pinned tree
         shell: bash
         env:
+          GITHUB_TOKEN: ${{ github.token }}
           PIN_GUARD_BASE: ${{ github.event.pull_request.base.sha }}
         run: |
           if [ -n "$PIN_GUARD_BASE" ]; then
diff --git a/.github/workflows/node-next-compat.yml b/.github/workflows/node-next-compat.yml
index 43556c864dc..fc9b9cedaf9 100644
--- a/.github/workflows/node-next-compat.yml
+++ b/.github/workflows/node-next-compat.yml
@@ -1,8 +1,8 @@
-name: Node next compatibility
+name: Scheduled x86 unit compatibility
 
 on:
   schedule:
-    # Full future-runtime coverage is useful, but not worth doubling every PR matrix.
+    # Keep current and future Node coverage on x86 while PR unit shards use ARM.
     - cron: '0 10 * * *'
   workflow_dispatch:
 
@@ -14,9 +14,13 @@ permissions:
   contents: read
 
 jobs:
-  # A cold cache would otherwise make all eight Node 26 shards compile the same native addons.
+  # Prime each Node ABI before its shards restore native modules.
   test_native_cache:
-    name: prepare test native cache node 26
+    name: prepare test native cache node ${{ matrix.node }}
+    strategy:
+      fail-fast: false
+      matrix:
+        node: ['24', '26']
     runs-on: ubuntu-latest
 
     steps:
@@ -28,10 +32,14 @@ jobs:
       - uses: ./.github/actions/install-node-dependencies
         with:
           native-runtime: node
-          node-version: '26'
+          node-version: ${{ matrix.node }}
+
+  unit_plan:
+    uses: ./.github/workflows/unit-plan.yml
 
   test:
-    needs: [test_native_cache]
+    needs: [test_native_cache, unit_plan]
     uses: ./.github/workflows/unit-tests.yml
     with:
-      node_versions: '["26"]'
+      node_versions: '["24", "26"]'
+      shards: ${{ needs.unit_plan.outputs.shards }}
diff --git a/.github/workflows/packaged-browser-e2e.yml b/.github/workflows/packaged-browser-e2e.yml
index 2a23ac58988..7d36e7fd1b1 100644
--- a/.github/workflows/packaged-browser-e2e.yml
+++ b/.github/workflows/packaged-browser-e2e.yml
@@ -39,7 +39,11 @@ jobs:
           root=pathlib.Path(os.environ['RUNNER_TEMP'])/'old-orca'
           package=root/'orca-ide_1.4.188_amd64.deb'
           expected='uGONFUDfinYggxcT9ac72wnnlofLQaqasDDeP0HWOSqarBwTi1Ax3khmzKUY3vUnvuYOpSCEmsH4InzLZ2vg6g=='
-          assert base64.b64encode(hashlib.sha512(package.read_bytes()).digest()).decode()==expected
+          digest=hashlib.sha512()
+          with package.open('rb') as archive:
+              for block in iter(lambda: archive.read(1024*1024), b''):
+                  digest.update(block)
+          assert base64.b64encode(digest.digest()).decode()==expected
           extracted=root/'extracted'
           subprocess.run(['dpkg-deb','-x',str(package),str(extracted)],check=True)
           executable=extracted/'opt'/'Orca'/'orca-ide'
diff --git a/.github/workflows/pi-owner-runtime.yml b/.github/workflows/pi-owner-runtime.yml
index 9f9df4f9b0b..592bc75bb5e 100644
--- a/.github/workflows/pi-owner-runtime.yml
+++ b/.github/workflows/pi-owner-runtime.yml
@@ -9,6 +9,9 @@ on:
   workflow_dispatch:
 permissions:
   contents: read
+concurrency:
+  group: pi-owner-runtime-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   runtime:
     strategy:
diff --git a/.github/workflows/pi-provider-runtime.yml b/.github/workflows/pi-provider-runtime.yml
index 837c38baf9a..31046737499 100644
--- a/.github/workflows/pi-provider-runtime.yml
+++ b/.github/workflows/pi-provider-runtime.yml
@@ -7,6 +7,9 @@ on:
       - '.github/workflows/pi-provider-runtime.yml'
 permissions:
   contents: read
+concurrency:
+  group: pi-provider-runtime-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   runtime:
     strategy:
diff --git a/.github/workflows/pr-test-loc.yml b/.github/workflows/pr-test-loc.yml
index a884aedc636..340c6c7b70d 100644
--- a/.github/workflows/pr-test-loc.yml
+++ b/.github/workflows/pr-test-loc.yml
@@ -6,7 +6,6 @@ on:
       - opened
       - synchronize
       - reopened
-      - ready_for_review
 
 concurrency:
   group: pr-test-loc-${{ github.event.pull_request.number }}
@@ -19,7 +18,8 @@ permissions:
 jobs:
   loc:
     name: test vs non-test LoC
-    runs-on: ubuntu-latest
+    # API calls and a small Node script fit the free single-CPU container runner.
+    runs-on: ubuntu-slim
     timeout-minutes: 2
     steps:
       # Why no checkout: the Files API already has per-file additions/deletions.
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 1b52aac7571..c961f525a38 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -1,4 +1,5 @@
 name: PR Checks
+run-name: "PR ${{ github.event.pull_request.number }} | source ${{ github.sha }} | workflow ${{ github.workflow_sha }} | unit ${{ github.event.pull_request.draft && vars.ORCA_UNIT_SELECTION_MODE == 'selected' && 'selected' || 'full' }}"
 
 on:
   pull_request:
@@ -23,25 +24,32 @@ jobs:
   # Per-job outputs also skip git-compat/xterm/packaging/shell when those
   # inputs are unchanged; empty diffs fail closed and run everything.
   code_paths:
-    name: detect code-relevant changes
-    runs-on: ubuntu-latest
+    name: detect changes and check repository guards
+    # Reuse one lightweight checkout for detection and the always-required guards.
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: read
     outputs:
       should_run: ${{ steps.filter.outputs.should_run }}
-      native_cache_changed: ${{ steps.filter.outputs.native_cache_changed }}
+      reused_run_id: ${{ steps.readiness.outputs.run_id }}
+      # A proven success masks required work only; advisory routing still uses the full diff.
+      native_cache_changed: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.native_cache_changed }}
       mobile_dependencies: ${{ steps.filter.outputs.mobile_dependencies }}
-      mobile_web_app: ${{ steps.filter.outputs.mobile_web_app }}
-      static_analysis: ${{ steps.filter.outputs.static_analysis }}
-      typecheck: ${{ steps.filter.outputs.typecheck }}
-      git_compatibility: ${{ steps.filter.outputs.git_compatibility }}
-      codex_index_heal_contract: ${{ steps.filter.outputs.codex_index_heal_contract }}
-      xterm_patch_sync: ${{ steps.filter.outputs.xterm_patch_sync }}
-      shell_contracts: ${{ steps.filter.outputs.shell_contracts }}
-      test: ${{ steps.filter.outputs.test }}
-      orcad_browser: ${{ steps.filter.outputs.orcad_browser }}
-      cross-version-wire: ${{ steps.filter.outputs.cross-version-wire }}
-      managed_hook_node18: ${{ steps.filter.outputs.managed_hook_node18 }}
-      package: ${{ steps.filter.outputs.package }}
-      package_windows: ${{ steps.filter.outputs.package_windows }}
+      mobile_web_app: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.mobile_web_app }}
+      static_analysis: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.static_analysis }}
+      typecheck: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.typecheck }}
+      git_compatibility: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.git_compatibility }}
+      codex_index_heal_contract: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.codex_index_heal_contract }}
+      xterm_patch_sync: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.xterm_patch_sync }}
+      shell_contracts: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.shell_contracts }}
+      test: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.test }}
+      orcad_browser: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.orcad_browser }}
+      cross-version-wire: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.cross-version-wire }}
+      managed_hook_node18: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.managed_hook_node18 }}
+      package: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.package }}
+      package_windows: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.package_windows }}
       e2e_should_run: ${{ steps.e2e_filter.outputs.should_run }}
       test_files: ${{ steps.e2e_filter.outputs.test_files }}
       ssh_source_changed: ${{ steps.e2e_filter.outputs.ssh_source_changed }}
@@ -51,23 +59,59 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
         with:
-          # Why blob:none: full history is needed for the merge-base diff, but historical
-          # file contents are not. Blobs are ~89% of this repo's pack, and Git fetches the
-          # few this job actually reads on demand.
-          fetch-depth: 0
+          # Why depth 50 and not 0: every diff below resolves to HEAD^1, so only the merge commit
+          # and a little slack are needed. Fetching all 8127 refs' commit graph cost ~20s here and
+          # is charged to the start of all 22 jobs, since they all need this one.
+          # Why blob:none stays: the sparse tree below is ~7 files, so there are no blobs to
+          # materialize and no promisor refetch. Measured 9.5s -> 1.6s against 20.7s today.
+          fetch-depth: 50
           filter: blob:none
+          sparse-checkout: |
+            /config/scripts/git-pull-request-diff-base.mjs
+            /package.json
+            /README.md
+            /docs/readme/
+            /.github/scripts/check-root-directory-entries.mjs
+            /config/scripts/check-readme-local-links.mjs
+            /config/scripts/pr-code-change-scope.mjs
+            /config/scripts/pr-e2e-source-routing.mjs
+            /config/scripts/pr-ready-check-reuse.mjs
+          sparse-checkout-cone-mode: false
           persist-credentials: false
 
+      - name: Reject new root-level files and folders
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          DIFF_BASE="$(node config/scripts/git-pull-request-diff-base.mjs "$BASE_SHA")"
+          node .github/scripts/check-root-directory-entries.mjs "$DIFF_BASE" HEAD
+
+      # The full Git index retains link targets outside the sparse working tree.
+      - name: Check README local links
+        run: node config/scripts/check-readme-local-links.mjs
+
+      # Readiness changes eligibility for advisory tests, not the already-tested source.
+      - name: Find identical successful required checks
+        id: readiness
+        if: github.event.action == 'ready_for_review'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_CHECK_WORKFLOW_SHA: ${{ github.workflow_sha }}
+        run: node config/scripts/pr-ready-check-reuse.mjs
+
       - name: Classify changed paths
         id: filter
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
           set -euo pipefail
+          # Why HEAD^1 and not --merge-base: HEAD is the pull request merge commit, so its first
+          # parent is the base side already. Computing a merge base instead would require the
+          # payload base SHA to be in the graph, which is what forced a full-history checkout.
+          DIFF_BASE="$(node config/scripts/git-pull-request-diff-base.mjs "$BASE_SHA")"
           # Why --no-renames: name-only rename detection can report only the destination.
           # A code file moved under docs/ must still expose its code-side deletion.
-          CHANGED="$(git diff --name-only --no-renames --diff-filter=ACDMR --merge-base "$BASE_SHA" "$HEAD_SHA")"
+          CHANGED="$(git diff --name-only --no-renames --diff-filter=ACDMR "$DIFF_BASE" HEAD)"
           echo "Changed paths:"
           printf '%s\n' "$CHANGED"
           printf '%s\n' "$CHANGED" | node config/scripts/pr-code-change-scope.mjs | tee -a "$GITHUB_OUTPUT"
@@ -79,8 +123,8 @@ jobs:
         run: |
           set -euo pipefail
           BASE="${{ github.event.pull_request.base.sha }}"
-          HEAD="${{ github.event.pull_request.head.sha }}"
-          CHANGED="$(git diff --name-only --diff-filter=AMCR --merge-base "$BASE" "$HEAD")"
+          DIFF_BASE="$(node config/scripts/git-pull-request-diff-base.mjs "$BASE")"
+          CHANGED="$(git diff --name-only --diff-filter=AMCR "$DIFF_BASE" HEAD)"
           # Source routes are executable contracts so a test can prove exact
           # authorities, exclusions, and sentinels without evaluating workflow shell.
           TEST_FILES_JSON="$(printf '%s\n' "$CHANGED" | node config/scripts/pr-e2e-source-routing.mjs)"
@@ -94,7 +138,7 @@ jobs:
           # trigger on IME source rather than on a spec name in some route's list.
           NATIVE_IME_SOURCE_CHANGED="$(printf '%s\n' "$CHANGED" | node config/scripts/pr-e2e-source-routing.mjs --native-ime-source)"
           echo "native_ime_source_changed=$NATIVE_IME_SOURCE_CHANGED" >> "$GITHUB_OUTPUT"
-          WSL_CHANGED="$(git diff --name-only --no-renames --diff-filter=ACDMR --merge-base "$BASE" "$HEAD")"
+          WSL_CHANGED="$(git diff --name-only --no-renames --diff-filter=ACDMR "$DIFF_BASE" HEAD)"
           WSL_SOURCE_CHANGED="$(printf '%s\n' "$WSL_CHANGED" | node config/scripts/pr-e2e-source-routing.mjs --wsl-source)"
           echo "wsl_source_changed=$WSL_SOURCE_CHANGED" >> "$GITHUB_OUTPUT"
           echo "Native IME source changed: $NATIVE_IME_SOURCE_CHANGED"
@@ -111,38 +155,63 @@ jobs:
     name: static analysis
     needs: [code_paths]
     if: needs.code_paths.outputs.static_analysis == 'true'
-    runs-on: ubuntu-latest
+    # Why ARM: measured 128s against 172s on ubuntu-latest, with every compute step faster --
+    # type-aware 24s->15s, anti-slop 28->19s, localization extraction 67->46s, the orcad smoke
+    # 39->14s. Both lint engines ship linux-arm64 and the Bun target follows process.arch, so
+    # the whole toolchain resolves. Free for public repositories, same as the typecheck job.
+    runs-on: ubuntu-24.04-arm
 
     steps:
       - name: Checkout
         uses: actions/checkout@v6
         with:
-          # Why blob:none: full history is needed for the merge-base diff, but historical
-          # file contents are not. Blobs are ~89% of this repo's pack, and Git fetches the
-          # few this job actually reads on demand.
-          fetch-depth: 0
-          filter: blob:none
+          # Why depth 50: the gates below diff against HEAD^1, so no merge base is computed and
+          # the payload base SHA need not be in the graph.
+          # Why no blob:none here, unlike code_paths: this job checks out all 30,226 files, and
+          # the filter then forces a second promisor fetch of nearly every blob. Measured 23s
+          # blobless against ~11s without it.
+          fetch-depth: 50
           persist-credentials: false
 
+      # Why two guarded installs: the mixed root+mobile store entry is 537 MB against
+      # 321 MB for root alone, and restoring it costs 8.6s against 4.6s. Most PRs skip the
+      # mobile install below, so they were paying 216 MB for packages they never link. The
+      # root-only key is also the one the hourly warmer reseeds. Only one of these runs.
       - uses: ./.github/actions/install-node-dependencies
+        if: needs.code_paths.outputs.mobile_dependencies != 'true'
+        with:
+          native-runtime: node
+
+      - uses: ./.github/actions/install-node-dependencies
+        if: needs.code_paths.outputs.mobile_dependencies == 'true'
         with:
           native-runtime: node
           cache-dependency-path: |
             pnpm-lock.yaml
             mobile/pnpm-lock.yaml
 
+      # Keep each check in its own log while sharing this runner.
       - name: Lint
+        id: root-lint
+        background: true
         run: pnpm exec oxlint --format github
 
       - name: Reject low-evidence patterns
         run: pnpm run audit:anti-slop
 
+      - wait: root-lint
+
       - name: Enforce focused code-quality plugins
+        id: native-code-quality
+        background: true
         run: pnpm run audit:code-quality:native
 
       - name: Enforce type-aware code-quality baseline
         run: pnpm run audit:code-quality:type-aware
 
+      # Mobile installation changes import resolution for the native cycle check.
+      - wait: native-code-quality
+
       # Why here: the changed-code gate lints mobile files too, and its type-aware pass
       # resolves types from mobile/node_modules. Without the install every mobile type
       # degrades to an `error` type — reported as phantom findings against the changed lines.
@@ -150,11 +219,15 @@ jobs:
         if: needs.code_paths.outputs.mobile_dependencies == 'true'
 
       - name: Enforce changed-code quality
+        id: changed-code-quality
+        background: true
         run: pnpm run check:code-quality:changed -- "${{ github.event.pull_request.base.sha }}"
 
       - name: Enforce React Doctor on changed lines
         run: pnpm run check:react-doctor:changed -- "${{ github.event.pull_request.base.sha }}"
 
+      - wait: changed-code-quality
+
       - name: Check Zustand selector fan-out budget
         run: pnpm run check:zustand-selector-fanout
 
@@ -167,9 +240,9 @@ jobs:
       - name: Check VM runtime rollback compatibility
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
-          if git diff --quiet --merge-base "$BASE_SHA" "$HEAD_SHA" -- \
+          DIFF_BASE="$(node config/scripts/git-pull-request-diff-base.mjs "$BASE_SHA")"
+          if git diff --quiet "$DIFF_BASE" HEAD -- \
             src/shared/ephemeral-vm-runtime-store.ts \
             src/shared/ephemeral-vm-runtime-feature-store.ts \
             src/shared/ephemeral-vm-runtime-rollback-projection.ts \
@@ -194,11 +267,39 @@ jobs:
       - name: Enforce runtime Electron-import ratchet
         run: pnpm run check:runtime-electron-ratchet
 
+      # Why: extraction writes sorted evidence to an isolated temporary path,
+      # so feature PRs need one normalized AST pass rather than a three-OS matrix.
+      - name: Verify localization extraction
+        id: localization-extraction
+        background: true
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          # Detection failures run the full check; renames retain the removed input path.
+          DIFF_BASE="$(node config/scripts/git-pull-request-diff-base.mjs "$BASE_SHA")"
+          if git diff --name-only --no-renames -z "$DIFF_BASE" HEAD > "$RUNNER_TEMP/localization-changes" &&
+            scope="$(node config/scripts/localization-extraction-change-scope.mjs "$RUNNER_TEMP/localization-changes")" && [ "$scope" = false ]; then
+            echo "Localization extraction inputs are unchanged."
+          else
+            pnpm run verify:localization-extraction
+          fi
+
       # Why both: the ratchet proves nothing reachable from the runtime imports electron,
       # which is a property of the import graph. This proves the Node artifact it enables
       # actually boots, pairs, creates a worktree and round-trips a real PTY.
       - name: Boot orcad and round-trip a terminal
-        run: pnpm run smoke:orcad-terminal
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          ORCA_BACKGROUND_LAUNCH: '1'
+        run: |
+          # Detection failures run the smoke; renames retain the removed input path.
+          DIFF_BASE="$(node config/scripts/git-pull-request-diff-base.mjs "$BASE_SHA")"
+          if git diff --name-only --no-renames -z "$DIFF_BASE" HEAD > "$RUNNER_TEMP/orcad-smoke-changes" &&
+            scope="$(node config/scripts/orcad-terminal-smoke-change-scope.mjs "$RUNNER_TEMP/orcad-smoke-changes")" && [ "$scope" = false ]; then
+            echo "Orcad terminal smoke inputs are unchanged."
+          else
+            pnpm run smoke:orcad-terminal
+          fi
 
       - name: Verify the generated RPC params catalog
         run: pnpm run verify:rpc-params-catalog
@@ -209,23 +310,16 @@ jobs:
       - name: Verify skill freshness manifest
         run: pnpm run verify:skill-bundle-manifest
 
-      - name: Verify localization catalog
-        run: pnpm run verify:localization-catalog
-
-      # Why: the renderer ships only the English entries i18next cannot rebuild
-      # from each call site's inline default, so the generated subset has to
-      # track en.json and those defaults.
-      - name: Verify runtime-required localization catalog
-        run: pnpm run verify:localization-runtime-catalog
-
-      # Why: extraction writes sorted evidence to an isolated temporary path,
-      # so feature PRs need one normalized AST pass rather than a three-OS matrix.
-      - name: Verify localization extraction
-        run: pnpm run verify:localization-extraction
+      - name: Verify localization catalogs
+        id: localization-catalogs
+        background: true
+        run: pnpm run verify:localization-catalogs
 
       - name: Verify localization coverage
         run: pnpm run verify:localization-coverage
 
+      - wait: [localization-catalogs, localization-extraction]
+
       # Why: project-owned type declarations must live in .ts so tsc
       # actually checks them. TypeScript's skipLibCheck: true (inherited
       # from @electron-toolkit/tsconfig) silently widens unresolved names
@@ -249,37 +343,11 @@ jobs:
       - name: Verify macOS entitlements
         run: pnpm verify:macos-entitlements
 
-  root_directory_guard:
-    name: root directory guard
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          # Why blob:none: full history is needed for the merge-base diff, but historical
-          # file contents are not. Blobs are ~89% of this repo's pack, and Git fetches the
-          # few this job actually reads on demand.
-          fetch-depth: 0
-          filter: blob:none
-          persist-credentials: false
-
-      - name: Reject new root-level files and folders
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: node .github/scripts/check-root-directory-entries.mjs "$BASE_SHA" "$HEAD_SHA"
-
-      # Why here: the READMEs embed media owned by docs/site and resources/onboarding,
-      # and the classifier skips static_analysis for docs-only diffs. This job runs
-      # on every PR and needs no install.
-      - name: Check README local links
-        run: node config/scripts/check-readme-local-links.mjs
-
   typecheck:
     needs: [code_paths]
     if: needs.code_paths.outputs.typecheck == 'true'
-    runs-on: ubuntu-latest
+    # Typechecking uses no native runtime, so it can use the free public ARM runner.
+    runs-on: ubuntu-24.04-arm
 
     steps:
       - name: Checkout
@@ -317,39 +385,7 @@ jobs:
 
       - uses: ./.github/actions/install-node-dependencies
 
-      # Why: the 2.25.5 lane is a source build of a pinned tarball, so it produced the
-      # same binary on every PR for minutes of runner time. The key carries the version
-      # because that is the only input; the sha256 assertion below still guards the
-      # tarball on the miss path that actually builds. Only this PR's own later pushes
-      # can restore it — GitHub scopes a cache written from a pull_request run to that
-      # ref — so a first push always takes the build path below.
-      - name: Cache baseline Git build
-        uses: actions/cache@v5
-        with:
-          path: ~/.cache/orca-git-compat/git-2.25.5
-          key: git-compat-baseline-${{ runner.os }}-${{ runner.arch }}-2.25.5
-
-      # Why its own step: this is `make -j$(nproc)` on every core, and the lanes below
-      # spend their wall clock waiting on container starts, not on Git. Sharing a runner
-      # with the build stretched one ~1.5s boundary case past Vitest's 30s timeout, so
-      # the build has to finish before anything timed starts.
-      - name: Build the baseline Git binary
-        run: |
-          archive="$RUNNER_TEMP/git-2.25.5.tar.gz"
-          source="$HOME/.cache/orca-git-compat/git-2.25.5"
-          if [ -x "$source/git" ]; then
-            exit 0
-          fi
-          curl -fsSL https://www.kernel.org/pub/software/scm/git/git-2.25.5.tar.gz -o "$archive"
-          echo "41662c52fc16fec4963bfc41075e71f8ead6b5e386797eb6f9a1111ff95a8ddf  $archive" \
-            | sha256sum --check
-          mkdir -p "$source"
-          tar -xzf "$archive" -C "$source" --strip-components=1
-          make -C "$source" -j"$(nproc)" \
-            NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PYTHON=YesPlease git
-          # Why: the linked binaries are what the next run needs; the objects that
-          # produced them are most of the tree and would bloat the cache entry.
-          find "$source" -name '*.o' -delete
+      - uses: ./.github/actions/prepare-git-compatibility
 
       - name: Verify Git binary compatibility matrix
         run: |
@@ -399,9 +435,12 @@ jobs:
     name: Codex index-heal contract
     needs: [code_paths]
     if: needs.code_paths.outputs.codex_index_heal_contract == 'true'
-    runs-on: ubuntu-latest
+    # Why ARM: @openai/codex ships @openai/codex-linux-arm64.
+    runs-on: ubuntu-24.04-arm
     env:
       CODEX_CLI_VERSION: '0.150.1'
+      # Why a second pin: --no-daemon only exists from 0.156, and Orca's codex wrapper relies on it.
+      CODEX_NO_DAEMON_CLI_VERSION: '0.158.0'
 
     steps:
       - name: Checkout
@@ -430,11 +469,30 @@ jobs:
             pnpm exec vitest run --config config/vitest.config.ts \
             src/main/codex/codex-index-heal-binary-contract.test.ts
 
+      - name: Install pinned no-daemon Codex CLI
+        run: |
+          set -euo pipefail
+          npm install --no-audit --no-fund --prefix "$RUNNER_TEMP/codex-cli-no-daemon" \
+            "@openai/codex@$CODEX_NO_DAEMON_CLI_VERSION"
+
+      - name: Verify Codex --no-daemon contract
+        env:
+          ORCA_CODEX_NO_DAEMON_CONTRACT_REQUIRED: '1'
+          ORCA_CODEX_NO_DAEMON_CONTRACT_VERSION: ${{ env.CODEX_NO_DAEMON_CLI_VERSION }}
+        run: |
+          set -euo pipefail
+          ORCA_CODEX_NO_DAEMON_CONTRACT_BINARY="$RUNNER_TEMP/codex-cli-no-daemon/node_modules/.bin/codex" \
+            pnpm exec vitest run --config config/vitest.config.ts \
+            src/main/pty/codex-no-daemon-binary-contract.test.ts
+
   xterm_patch_sync:
     name: xterm patch sync
     needs: [code_paths]
     if: needs.code_paths.outputs.xterm_patch_sync == 'true'
-    runs-on: ubuntu-latest
+    # Why ARM: the patch check rebuilds 4 packages x 2 builds and byte-compares against the
+    # checked-in bundles. Those were generated on Linux x64 and reproduce byte-for-byte on
+    # darwin-arm64, so the output is neither host-arch nor host-OS dependent.
+    runs-on: ubuntu-24.04-arm
 
     steps:
       - name: Checkout
@@ -442,21 +500,14 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: ./.github/actions/install-node-dependencies
-
-      # Why: the check rebuilds every package in the manifest from a pinned upstream
-      # commit — @xterm/xterm and its three addons, each built twice (once unmodified to
-      # prove the toolchain still reproduces the published bundles, once patched). Caching
-      # the npm metadata and the shallow clone keeps the repeated cost to the builds
-      # themselves; the key is the manifest, so a commit, package or toolchain bump
-      # invalidates it.
-      - name: Restore upstream xterm build inputs
-        uses: actions/cache@v5
+      # The generator uses Node built-ins and installs its own upstream toolchain.
+      - uses: actions/setup-node@v6
         with:
-          path: |
-            ~/.npm
-            ${{ runner.temp }}/xterm-patch-build/upstream/.git
-          key: xterm-upstream-${{ hashFiles('config/patches/xterm-upstream.json') }}
+          node-version-file: package.json
+          package-manager-cache: false
+
+      # Rebuild both pristine and patched bundles; reuse only the pinned toolchain.
+      - uses: ./.github/actions/prepare-xterm-dependencies
 
       - name: Verify xterm patches match the pinned upstream build
         env:
@@ -467,7 +518,8 @@ jobs:
     name: shell contracts
     needs: [code_paths]
     if: needs.code_paths.outputs.shell_contracts == 'true'
-    runs-on: ubuntu-latest
+    # Why ARM: fish 4.x is published for noble/arm64 and zsh is in the arm64 archive.
+    runs-on: ubuntu-24.04-arm
     # Why: this job's cost is almost entirely package download, and a stalled mirror has
     # no wall-clock bound of its own. A successful run finishes in ~4.5 minutes, so this
     # is generous; it exists so a wedge fails the job instead of holding the whole run
@@ -479,6 +531,8 @@ jobs:
       # and its fish lane is the only end-to-end guard for #9993, so a skip would
       # report green with nothing exercised. Turns those skips into failures.
       ORCA_REQUIRE_FISH: '1'
+      # Why: the runner image ships pwsh, and the codex wrapper's PowerShell lane must not skip.
+      ORCA_REQUIRE_PWSH: '1'
 
     steps:
       - name: Checkout
@@ -493,6 +547,8 @@ jobs:
       # fish-color-scheme-child-stdin.node-pty.test.ts (#9993) needs it. Noble ships
       # 3.7, so the PPA is what makes that lane real.
       - name: Install zsh and fish
+        id: shells
+        background: true
         run: |
           # Why the update/PPA/fish steps are tolerant: a repo the runner image already
           # ships can lack a Release file for this suite, and a failed add-apt-repository
@@ -541,6 +597,12 @@ jobs:
           # first install command in this step to prove the lane really installs them.
           timeout 300 sudo apt-get install -y zsh fish
 
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: node
+
+      - wait: shells
+
       # Separate from the install so the failure names the contract, not an apt error.
       # ORCA_REQUIRE_FISH re-checks this at test time; this step just fails in seconds
       # instead of after a full dependency install.
@@ -556,10 +618,6 @@ jobs:
             exit 1
           fi
 
-      - uses: ./.github/actions/install-node-dependencies
-        with:
-          native-runtime: node
-
       - name: Test real shell contracts
         run: |
           pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
@@ -569,6 +627,7 @@ jobs:
             src/main/providers/local-pty-shell-ready-zsh-launch-environment.test.ts \
             src/main/providers/__tests__/shell-ready-framework-example.test.ts \
             src/main/pty/codex-shell-launch-preflight.test.ts \
+            src/main/pty/codex-shell-no-daemon.test.ts \
             src/main/pty/omp-shell-wrapper-alias-safety.test.ts \
             src/main/pty/omp-shell-wrapper.node-pty.test.ts \
             src/main/shell-startup-feature-channel.test.ts \
@@ -576,6 +635,7 @@ jobs:
             src/main/zsh-scoped-histfile.live-shell.test.ts \
             src/main/zsh-startup-hook-user-config-equivalence.live-shell.test.ts \
             src/main/zsh-wrapper-version-mismatch.live-shell.test.ts \
+            src/main/runtime/structured-session-cli-login-shell.live-shell.test.ts \
             src/renderer/src/components/terminal-pane/fish-color-scheme-child-stdin.node-pty.test.ts \
             src/shared/fish-query-reply-child-stdin.node-pty.test.ts \
             src/shared/pty-reply-echo-shapes.node-pty.test.ts \
@@ -588,7 +648,7 @@ jobs:
     name: prepare test native cache node 24
     needs: [code_paths]
     if: needs.code_paths.outputs.native_cache_changed == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-arm
 
     steps:
       - name: Checkout
@@ -601,15 +661,40 @@ jobs:
           native-runtime: node
           node-version: '24'
 
+  # Why hoisted out of unit-tests.yml: a caller's `needs` gate the whole called workflow, so
+  # while planning lived in there it queued behind static analysis and typecheck and the shards
+  # then queued behind it. Planning needs none of their output, so running it against
+  # code_paths alone overlaps it with the gate. Measured a median 93s off the matrix's start.
+  unit_plan:
+    needs: [code_paths]
+    if: needs.code_paths.outputs.test == 'true'
+    uses: ./.github/workflows/unit-plan.yml
+    with:
+      selection_mode: ${{ vars.ORCA_UNIT_SELECTION_MODE || 'shadow' }}
+
   test:
-    needs: [code_paths, test_native_cache]
+    needs: [code_paths, unit_plan, test_native_cache, static_analysis, typecheck]
+    # Honor cancellation while allowing the optional native-cache primer to skip.
     if: >-
-      always() &&
+      !cancelled() &&
       needs.code_paths.outputs.test == 'true' &&
+      needs.unit_plan.result == 'success' &&
+      needs.static_analysis.result == 'success' &&
+      needs.typecheck.result == 'success' &&
       (needs.test_native_cache.result == 'success' || needs.test_native_cache.result == 'skipped')
     uses: ./.github/workflows/unit-tests.yml
     with:
       node_versions: '["24"]'
+      runner: ubuntu-24.04-arm
+      shards: ${{ needs.unit_plan.outputs.shards }}
+
+  # Why a sibling and not part of the test workflow: it is advisory, so it must not delay the
+  # gate. Inside unit-tests.yml a caller's `needs: test` waited for it, holding verify ~36s
+  # after the last shard. Deliberately absent from verify's needs for the same reason.
+  unit_selection_evidence:
+    needs: [test]
+    if: ${{ !cancelled() && needs.test.result == 'success' }}
+    uses: ./.github/workflows/unit-selection-evidence.yml
 
   # Why a separate job: the test needs a real Chrome, and the sharded `test` matrix
   # would pay for it on every shard to run one file in whichever shard it landed in.
@@ -673,9 +758,22 @@ jobs:
             pnpm-lock.yaml
             mobile/pnpm-lock.yaml
 
+      # The drawer check runs on WebKit as well as Chrome, because the shell's iOS WebView is
+      # WebKit and the Chrome above cannot stand in for it. Downloaded rather than resolved from
+      # the runner: Ubuntu ships no WebKit build to point at.
+      - name: Install WebKit for the drawer check
+        id: webkit
+        background: true
+        run: pnpm exec playwright install --with-deps webkit
+
       # The entry lives in mobile/ so one React resolves; without this every RN import is nothing.
       - uses: ./.github/actions/install-mobile-dependencies
 
+      - name: Prepare mobile route snapshot
+        id: mobile-routes
+        background: true
+        run: node config/scripts/run-mobile-web-app-checks.mjs --prepare-route-snapshot "$RUNNER_TEMP/mobile-routes.json"
+
       # Why the runner's Google Chrome and not a downloaded chromium: same reason as the orcad
       # browser job -- Ubuntu 24.04 only ships an AppArmor userns profile for the Chrome .deb.
       # Why fail instead of skip: a silently skipped render check is the failure this job exists
@@ -691,15 +789,12 @@ jobs:
           "$chrome" --version
           echo "ORCA_MOBILE_WEB_RENDER_BROWSER=$chrome" >> "$GITHUB_ENV"
 
-      # The drawer check runs on WebKit as well as Chrome, because the shell's iOS WebView is
-      # WebKit and the Chrome above cannot stand in for it. Downloaded rather than resolved from
-      # the runner: Ubuntu ships no WebKit build to point at.
-      - name: Install WebKit for the drawer check
-        run: pnpm exec playwright install --with-deps webkit
-
       - name: Build and verify the app bundle
         run: pnpm run build:mobile-web
 
+      # Browser checks must observe both a finished install and the built bundle.
+      - wait: [webkit, mobile-routes]
+
       # The bundling tests skip themselves where mobile dependencies are absent, which is how they
       # stay green in the sharded `test` job. This is the job that installs them, so here a missing
       # install has to fail rather than skip everything the job exists to run.
@@ -709,23 +804,20 @@ jobs:
       # one `pr-code-change-scope.mjs` fires this job on, so naming a test into the family is all
       # it takes to have it run. Quoted because these are vitest filename filters, matched as
       # substrings against the discovered files, and the shell must not touch them.
-      #
-      # Cost: 18 files in 25-30s wall, of which the frame-budget sweep is 2.5s. That sweep encodes
-      # 111 noise JPEGs in Chromium, so it is the one step here whose cost grows with its viewport
-      # set; adding rows to that set is a decision about this job's runtime.
+      # Route censuses share fresh dependency lists for this invocation; scratch builds stay independent.
       - name: Builder, override census and render checks
         env:
           ORCA_MOBILE_WEB_APP_DEPS_REQUIRED: '1'
+          ORCA_MOBILE_WEB_PREPARED_ROUTE_SNAPSHOT: ${{ runner.temp }}/mobile-routes.json
         run: |
-          pnpm exec vitest run --config config/vitest.config.ts \
-            'config/scripts/mobile-web-app-' \
-            'config/scripts/build-mobile-web-app-bundle.test.mjs'
+          node config/scripts/run-mobile-web-app-checks.mjs
 
   cross-version-wire:
     name: cross-version wire compatibility
     needs: [code_paths]
     if: needs.code_paths.outputs.cross-version-wire == 'true'
-    runs-on: ubuntu-latest
+    # Why ARM: source-only: tagged checkout plus in-process vitest, no docker or browser.
+    runs-on: ubuntu-24.04-arm
 
     steps:
       # Why fetch-depth 0: the harness extracts the newest release tag to skew
@@ -757,12 +849,16 @@ jobs:
           tests/e2e/cross-version-wire/cross-version-agent-session-wire.unit.test.ts
           tests/e2e/cross-version-wire/cross-version-worktree-identity-downgrade.unit.test.ts
           tests/e2e/cross-version-wire/cross-version-session-tabs-retirement-proof.unit.test.ts
+          tests/e2e/cross-version-wire/agent-session-resume-marker-downgrade.unit.test.ts
+          tests/e2e/cross-version-wire/agent-session-unproven-release-downgrade.unit.test.ts
+          tests/e2e/cross-version-wire/cross-version-worktree-ps-verdict.unit.test.ts
 
   managed_hook_node18:
     name: managed hooks on Node 18
     needs: [code_paths]
     if: needs.code_paths.outputs.managed_hook_node18 == 'true'
-    runs-on: ubuntu-latest
+    # Why ARM: Node 18 publishes linux-arm64; the per-platform runtime files are read as data.
+    runs-on: ubuntu-24.04-arm
 
     steps:
       - name: Checkout
@@ -785,7 +881,7 @@ jobs:
 
   package:
     name: package
-    needs: [code_paths]
+    needs: [code_paths, static_analysis, typecheck]
     if: needs.code_paths.outputs.package == 'true'
     runs-on: ubuntu-latest
     # Let the serial Docker gates reach their own deadlines and report cleanup failures.
@@ -798,7 +894,7 @@ jobs:
           persist-credentials: false
 
       - name: Cache electron-builder downloads
-        uses: actions/cache@v5
+        uses: actions/cache/restore@v5
         with:
           path: ~/.cache/electron-builder
           key: electron-builder-linux-${{ hashFiles('pnpm-lock.yaml') }}
@@ -835,6 +931,24 @@ jobs:
           src/main/browser/browser-route-h3-egress.electron.test.ts
           src/main/browser/browser-route-dns-prefetch.electron.test.ts
 
+      # Restore independent fixtures during builds; keep native lifecycle probes serial.
+      - uses: ./.github/actions/prepare-linux-package-fixture
+        id: shutdown-fixture-cache
+        background: true
+        with:
+          fixture: headless-serve-shutdown
+
+      - uses: ./.github/actions/prepare-linux-package-fixture
+        id: cli-fixture-cache
+        background: true
+        with:
+          fixture: cli-launch-contract
+
+      - name: Install Linux package tooling
+        id: linux-package-tools
+        background: true
+        run: sudo apt-get update && sudo apt-get install -y cpio rpm
+
       - name: Build package inputs
         run: |
           status=0
@@ -853,6 +967,8 @@ jobs:
           exit "$status"
 
       - name: Project web client from renderer build
+        id: web-client
+        background: true
         run: pnpm run build:web-from-renderer
 
       # Why here and not inside "Build package inputs": this job assembles packaging inputs step by
@@ -864,17 +980,16 @@ jobs:
       - name: Build native components
         run: pnpm run build:native
 
-      - name: Install Linux package tooling
-        run: sudo apt-get update && sudo apt-get install -y cpio rpm
+      - wait: [linux-package-tools, web-client]
 
       - name: Package unpacked app
         env:
+          ORCA_BACKGROUND_LAUNCH: '1'
           ORCA_REUSE_PREPARED_NATIVE_RUNTIME: '1'
-        # PR artifacts are only inspected locally; gzip avoids release-size xz compression.
-        run: >-
-          pnpm exec electron-builder --config config/electron-builder.config.cjs
-          --linux AppImage deb rpm --x64 --publish never
-          --config.deb.compression=gz --config.rpm.compression=gzip
+        # Prepare once with every hook, then isolate the format-specific mutations.
+        run: |
+          pnpm exec electron-builder --config config/electron-builder.config.cjs --linux dir --x64 --publish never
+          node config/scripts/package-linux-formats.mjs
 
       - name: Verify root-package marker payloads
         run: |
@@ -889,13 +1004,21 @@ jobs:
           [[ "$deb_marker" == deb ]] || { echo "Expected deb marker, got: $deb_marker"; exit 1; }
           [[ "$rpm_marker" == rpm ]] || { echo "Expected rpm marker, got: $rpm_marker"; exit 1; }
 
+      - wait: shutdown-fixture-cache
+
       - name: Verify headless serve signal shutdown
+        env:
+          ORCA_SHUTDOWN_FIXTURE_CACHE_IMAGE: ${{ steps.shutdown-fixture-cache.outputs.image }}
         run: >-
           node config/scripts/run-headless-serve-shutdown-docker.mjs
           --appimage dist/orca-linux.AppImage --all-entrypoints
 
       # A default container reproduces the hostile AppImage launch environment.
+      - wait: cli-fixture-cache
+
       - name: Verify Linux CLI launch contract
+        env:
+          ORCA_CLI_FIXTURE_CACHE_IMAGE: ${{ steps.cli-fixture-cache.outputs.image }}
         run: node config/scripts/run-linux-cli-launch-contract-docker.mjs --appimage dist/orca-linux.AppImage
 
       - name: Smoke packaged CLI
@@ -906,7 +1029,7 @@ jobs:
 
   package_windows:
     name: package (windows)
-    needs: [code_paths]
+    needs: [code_paths, static_analysis, typecheck]
     if: needs.code_paths.outputs.package_windows == 'true'
     runs-on: windows-2022
     timeout-minutes: 30
@@ -918,14 +1041,15 @@ jobs:
           persist-credentials: false
 
       - name: Cache electron-builder downloads
-        uses: actions/cache@v5
+        uses: actions/cache/restore@v5
         with:
           path: |
             ~\AppData\Local\electron\Cache
             ~\AppData\Local\electron-builder\Cache
-          key: electron-builder-windows-${{ hashFiles('pnpm-lock.yaml') }}
+          # Release builds seed this exact path set; PR-local copies cannot serve other PRs.
+          key: electron-builder-win-${{ hashFiles('pnpm-lock.yaml') }}
           restore-keys: |
-            electron-builder-windows-
+            electron-builder-win-
 
       # Why persist-native-cache false: this job later rebuilds the same path for
       # Electron. A post-job save would store the Electron ABI under the Node key.
@@ -954,6 +1078,12 @@ jobs:
 
       # vitest runs here directly rather than through `pnpm test`, so the addon
       # assertions only hold once install-node-dependencies has rebuilt natives.
+      - name: Test Windows installer process probe
+        # Keep cold CIM startup out of the concurrent Electron/native process workload.
+        run: >-
+          pnpm exec vitest run --config config/vitest.config.ts
+          config/scripts/nsis-process-check.test.mjs
+
       - name: Test Windows-specific boundaries
         run: >-
           pnpm exec vitest run --config config/vitest.config.ts
@@ -989,6 +1119,7 @@ jobs:
           src/main/windows/windows-host-job.win32.test.ts
           src/main/windows/windows-process-tree-command-line-patch.test.ts
           src/main/windows/windows-process-table-native-addon.win32.test.ts
+          src/main/persistence/profile-state/profile-state-access-windows-native.win32.test.ts
           src/main/windows-live-tree-kill.win32.test.ts
           src/main/wsl/wsl-runner.test.ts
           src/main/wsl/wsl-guest-environment.test.ts
@@ -1017,11 +1148,9 @@ jobs:
         uses: actions/cache@v5
         with:
           path: native/windows-cli-launcher/.build
-          key: windows-cli-launcher-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('native/windows-cli-launcher/**', 'config/scripts/build-windows-cli-launcher.mjs') }}
+          key: windows-cli-launcher-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('native/windows-cli-launcher/**', 'config/scripts/build-windows-cli-launcher.mjs', 'resources/build/icon.ico', 'package.json') }}
 
       - name: Build package inputs
-        env:
-          ORCA_REUSE_WINDOWS_CLI_LAUNCHER: '1'
         run: pnpm run build:release:parallel
 
       - name: Restore compiled Electron native modules
@@ -1088,11 +1217,10 @@ jobs:
       ref: ${{ github.event.pull_request.head.sha }}
 
   verify:
-    if: always()
+    if: ${{ !cancelled() }}
     needs:
       - code_paths
       - static_analysis
-      - root_directory_guard
       - typecheck
       - git_compatibility
       - codex_index_heal_contract
@@ -1105,7 +1233,9 @@ jobs:
       - managed_hook_node18
       - package
       - package_windows
-    runs-on: ubuntu-latest
+    # Evaluating job results only needs the lightweight container runner.
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
 
     steps:
       # Why: e2e is deliberately absent from needs. The suite is currently red on
@@ -1122,7 +1252,6 @@ jobs:
           SHOULD_RUN: ${{ needs.code_paths.outputs.should_run }}
           STATIC_ANALYSIS: ${{ needs.static_analysis.result }}
           STATIC_ANALYSIS_SHOULD_RUN: ${{ needs.code_paths.outputs.static_analysis }}
-          ROOT_DIRECTORY_GUARD: ${{ needs.root_directory_guard.result }}
           TYPECHECK: ${{ needs.typecheck.result }}
           TYPECHECK_SHOULD_RUN: ${{ needs.code_paths.outputs.typecheck }}
           GIT_COMPATIBILITY: ${{ needs.git_compatibility.result }}
@@ -1151,9 +1280,6 @@ jobs:
           if [ "$CODE_PATHS" != "success" ]; then
             exit 1
           fi
-          if [ "$ROOT_DIRECTORY_GUARD" != "success" ]; then
-            exit 1
-          fi
           if [ "$SHOULD_RUN" != "true" ]; then
             echo "Docs-only change; expensive PR checks skipped."
           fi
diff --git a/.github/workflows/pullfrog.yml b/.github/workflows/pullfrog.yml
index d5030252f88..2fc81c887bb 100644
--- a/.github/workflows/pullfrog.yml
+++ b/.github/workflows/pullfrog.yml
@@ -1,6 +1,6 @@
-# PULLFROG ACTION — DO NOT EDIT EXCEPT WHERE INDICATED
+# Explicit review identities share workflow concurrency; legacy names use ordered cancellation.
 name: Pullfrog
-run-name: ${{ inputs.name || github.workflow }}
+run-name: ${{ inputs.name || github.workflow }}${{ inputs.pull_request_number && format(' | PR {0}', inputs.pull_request_number) || '' }}
 on:
   workflow_dispatch:
     inputs:
@@ -11,21 +11,71 @@ on:
         type: string
         description: Run name
 
+      pull_request_number:
+        type: string
+        description: Optional PR identity for cancelling superseded reviews
+      head_sha:
+        type: string
+        description: Optional expected PR head; stale reviews are skipped
+
 permissions:
   contents: read
+  pull-requests: read
+
+concurrency:
+  group: ${{ inputs.pull_request_number && format('pullfrog-pr-{0}', inputs.pull_request_number) || format('pullfrog-run-{0}', github.run_id) }}
+  cancel-in-progress: true
 
 jobs:
+  review_scope:
+    runs-on: ubuntu-slim
+    permissions:
+      contents: read
+      pull-requests: read
+      actions: write
+    outputs:
+      current: ${{ steps.scope.outputs.current }}
+      number: ${{ steps.scope.outputs.number }}
+      head: ${{ steps.scope.outputs.head }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          sparse-checkout: config/scripts/pullfrog-review-scope.cjs
+          sparse-checkout-cone-mode: false
+          persist-credentials: false
+      - uses: actions/github-script@v8
+        id: scope
+        with:
+          script: |
+            const { reviewScope } = require('./config/scripts/pullfrog-review-scope.cjs')
+            await reviewScope({ github, context, core })
+
   pullfrog:
+    needs: review_scope
+    if: needs.review_scope.outputs.current == 'true'
     runs-on: ubuntu-latest
     permissions:
       id-token: write
       contents: read
+      pull-requests: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
         with:
           fetch-depth: 1
+      - name: Recheck review head before starting agent
+        id: freshness
+        if: needs.review_scope.outputs.number != ''
+        uses: actions/github-script@v8
+        env:
+          REVIEW_NUMBER: ${{ needs.review_scope.outputs.number }}
+          REVIEW_HEAD: ${{ needs.review_scope.outputs.head }}
+        with:
+          script: |
+            const { data: pr } = await github.rest.pulls.get({ ...context.repo, pull_number: Number(process.env.REVIEW_NUMBER) })
+            core.setOutput('current', pr.state === 'open' && pr.head.sha === process.env.REVIEW_HEAD)
       - name: Run agent
+        if: needs.review_scope.outputs.number == '' || steps.freshness.outputs.current == 'true'
         uses: pullfrog/pullfrog@v0
         with:
           prompt: ${{ inputs.prompt }}
diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml
index b2ac03e2b08..01f90060c5e 100644
--- a/.github/workflows/release-cut.yml
+++ b/.github/workflows/release-cut.yml
@@ -1314,6 +1314,16 @@ jobs:
           restore-keys: |
             electron-builder-${{ matrix.platform }}-
 
+      # PRs cache tools separately from Electron; identical paths preserve their cache version.
+      - name: Seed shared Linux packaging downloads
+        if: matrix.platform == 'linux-x64' && github.ref == 'refs/heads/main'
+        uses: actions/cache@v5
+        with:
+          path: ~/.cache/electron-builder
+          key: electron-builder-linux-${{ hashFiles('pnpm-lock.yaml') }}
+          # The release cache above restores the same tools, so this only needs to save on a miss.
+          lookup-only: true
+
       # Why: pnpm install triggers electron's postinstall, which downloads the
       # Electron binary from GitHub release assets. GitHub's download CDN
       # occasionally returns 504s that fail the whole release. Retry on
@@ -1530,6 +1540,7 @@ jobs:
           }
 
       - name: Install SignPath PowerShell module
+        id: install-signpath
         if: matrix.platform == 'win' && github.run_attempt == 1
         uses: ./.github/actions/install-signpath-module
 
@@ -1540,18 +1551,14 @@ jobs:
       # existing installer signing request below. The NSIS uninstaller rides
       # this same request (it is the MDE update cluster: old-uninstaller.exe /
       # Uninstall Orca.exe), captured through electron-builder's sign hook and
-      # swapped back in during the rebuild — no third approval wait. Every step is
-      # fail-open (continue-on-error + outcome gating): any failure ships the
-      # original installer with unsigned inner binaries, exactly like releases
-      # did before this chain existed. Rehearsed end to end in run 28988432001
-      # (.github/workflows/windows-signing-rehearsal.yml).
+      # swapped back in during the rebuild — no third approval wait. Production
+      # releases require the entire signing chain to succeed (#23383).
 
       # Why: only unsigned PE files go to SignPath. Files that already carry a
       # valid signature (Microsoft's OpenConsole.exe) must keep their signer.
       - name: Stage unsigned inner PE files for signing
         id: stage-inner
         if: matrix.platform == 'win' && github.run_attempt == 1
-        continue-on-error: true
         shell: pwsh
         run: |
           $root = Resolve-Path 'dist/win-unpacked'
@@ -1593,34 +1600,18 @@ jobs:
           # out of inner-signing-list.txt: that list drives the copy-back into
           # dist/win-unpacked, and the uninstaller does not live there — it is
           # re-injected through the sign hook during the rebuild instead.
-          # Why this name and not "Uninstall Orca.exe": the restore loop below
-          # matches staged files by suffix (`-like "*$relative"`) and takes the
-          # first hit, so any staged path ending in "Orca.exe" is separated from
-          # the real Orca.exe only by Get-ChildItem's enumeration order. That
-          # order happens to favour the root file today, but it is not a
-          # documented guarantee; a name that cannot suffix-match is.
-          # Why the whole block is caught rather than just Test-Path'd: this
-          # step's outcome gates the upload of every inner binary, so a locked
-          # file or a full disk here would cost all of them their signatures -
-          # worse than shipping no uninstaller signature at all.
-          try {
-            $exportedUninstaller = Join-Path $env:RUNNER_TEMP 'uninstaller-signing\unsigned\orca-uninstaller.exe'
-            if (Test-Path -LiteralPath $exportedUninstaller) {
-              $uninstallerStagePath = Join-Path $stage.FullName 'uninstaller\orca-uninstaller.exe'
-              New-Item -ItemType Directory -Force -Path (Split-Path $uninstallerStagePath) -ErrorAction Stop | Out-Null
-              Copy-Item -LiteralPath $exportedUninstaller -Destination $uninstallerStagePath -Force -ErrorAction Stop
-              Write-Host 'Staged the NSIS uninstaller for signing: uninstaller\orca-uninstaller.exe'
-            } else {
-              Write-Host "::warning::No exported NSIS uninstaller at $exportedUninstaller; this release ships an unsigned uninstaller (fail-open)."
-            }
-          } catch {
-            Write-Host "::warning::Could not stage the NSIS uninstaller ($_); this release ships an unsigned uninstaller (fail-open)."
+          $exportedUninstaller = Join-Path $env:RUNNER_TEMP 'uninstaller-signing\unsigned\orca-uninstaller.exe'
+          if (-not (Test-Path -LiteralPath $exportedUninstaller)) {
+            throw "No exported NSIS uninstaller at $exportedUninstaller."
           }
+          $uninstallerStagePath = Join-Path $stage.FullName 'uninstaller\orca-uninstaller.exe'
+          New-Item -ItemType Directory -Force -Path (Split-Path $uninstallerStagePath) -ErrorAction Stop | Out-Null
+          Copy-Item -LiteralPath $exportedUninstaller -Destination $uninstallerStagePath -Force -ErrorAction Stop
+          Write-Host 'Staged the NSIS uninstaller for signing: uninstaller\orca-uninstaller.exe'
 
       - name: Upload unsigned inner binaries for SignPath
         id: upload-unsigned-inner
         if: matrix.platform == 'win' && github.run_attempt == 1 && steps.stage-inner.outcome == 'success'
-        continue-on-error: true
         uses: actions/upload-artifact@v7
         with:
           name: orca-windows-inner-unsigned-${{ needs.cut.outputs.tag }}
@@ -1630,7 +1621,6 @@ jobs:
       - name: Submit inner binaries signing request
         id: submit-inner-signing
         if: matrix.platform == 'win' && github.run_attempt == 1 && steps.upload-unsigned-inner.outcome == 'success'
-        continue-on-error: true
         uses: signpath/github-action-submit-signing-request@v2
         with:
           api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
@@ -1643,8 +1633,8 @@ jobs:
 
       - name: Notify Slack that inner-binary signing is waiting for approval
         id: notify-inner-signing
-        if: matrix.platform == 'win' && github.run_attempt == 1 && steps.submit-inner-signing.outcome == 'success'
         continue-on-error: true
+        if: matrix.platform == 'win' && github.run_attempt == 1 && steps.submit-inner-signing.outcome == 'success'
         shell: pwsh
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
@@ -1704,15 +1694,10 @@ jobs:
 
           Invoke-RestMethod -Method Post -Uri $env:SLACK_WEBHOOK_URL -ContentType 'application/json' -Body $payload
 
-      # Why gate on the notify outcome too: if nobody was told to approve,
-      # don't hold the release for the approval window — fall through and
-      # ship like today instead. The 1h wait (vs the installer's 4h) keeps
-      # both waits plus the build inside the 360-minute job cap; missing it
-      # falls through to today's unsigned-inner flow rather than blocking.
+      # Approval remains required even when the notification service is unavailable.
       - name: Download signed inner binaries from SignPath
         id: download-signed-inner
-        if: matrix.platform == 'win' && github.run_attempt == 1 && steps.submit-inner-signing.outcome == 'success' && steps.notify-inner-signing.outcome == 'success'
-        continue-on-error: true
+        if: matrix.platform == 'win' && github.run_attempt == 1 && steps.submit-inner-signing.outcome == 'success'
         shell: pwsh
         env:
           SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }}
@@ -1730,27 +1715,31 @@ jobs:
           Expand-Archive -Path signed-inner.zip -DestinationPath signed-inner -Force
 
       # Why: copy back strictly by the staged list so a layout mismatch in the
-      # returned artifact fails loudly (into fail-open) instead of silently
+      # returned artifact fails before publication instead of silently
       # shipping a mix of signed and unsigned binaries.
       - name: Restore signed inner binaries into unpacked app
         id: restore-signed-inner
         if: matrix.platform == 'win' && github.run_attempt == 1 && steps.download-signed-inner.outcome == 'success'
-        continue-on-error: true
         shell: pwsh
+        env:
+          SIGNING_POLICY: release-signing
         run: |
+          $requireValid = $env:SIGNING_POLICY -ne 'test-signing'
           $root = Resolve-Path 'dist/win-unpacked'
           $failures = New-Object System.Collections.Generic.List[string]
           foreach ($relative in Get-Content 'inner-signing-list.txt') {
-            $signed = Get-ChildItem -Path signed-inner -Recurse -File |
-              Where-Object { [System.IO.Path]::GetRelativePath((Resolve-Path 'signed-inner'), $_.FullName).TrimStart('\', '/') -like "*$relative" } |
-              Select-Object -First 1
-            if ($null -eq $signed) {
-              $failures.Add("missing from signed artifact: $relative")
+            $candidates = @(
+              (Join-Path 'signed-inner' $relative),
+              (Join-Path 'signed-inner/signing-stage' $relative)
+            ) | Where-Object { Test-Path -LiteralPath $_ -PathType Leaf }
+            if (@($candidates).Count -ne 1) {
+              $failures.Add("missing or ambiguous signed artifact path: $relative")
               continue
             }
+            $signed = Get-Item -LiteralPath @($candidates)[0]
             $signature = Get-AuthenticodeSignature -FilePath $signed.FullName
-            if ($null -eq $signature.SignerCertificate) {
-              $failures.Add("returned without a signature: $relative")
+            if ($null -eq $signature.SignerCertificate -or ($requireValid -and ($signature.Status -ne 'Valid' -or $signature.SignerCertificate.Subject -notlike '*CN=SignPath Foundation*'))) {
+              $failures.Add("returned without a valid SignPath signature: $relative")
               continue
             }
             Copy-Item -Path $signed.FullName -Destination (Join-Path $root $relative) -Force
@@ -1761,25 +1750,26 @@ jobs:
             throw "Signed inner artifact did not round-trip cleanly ($($failures.Count) failures)."
           }
 
-      # Why gated separately from the inner restore above: if SignPath's
-      # windows-inner-binaries-zip artifact configuration does not (yet) cover the
-      # uninstaller/ directory, the uninstaller comes back missing. That must cost
-      # only the uninstaller signature — the rebuild below still runs and still
-      # ships the signed inner binaries, exactly as it does today.
+      # The uninstaller must return signed before rebuilding the installer.
       - name: Restore signed uninstaller for the installer rebuild
         id: restore-signed-uninstaller
         if: matrix.platform == 'win' && github.run_attempt == 1 && steps.restore-signed-inner.outcome == 'success'
-        continue-on-error: true
         shell: pwsh
+        env:
+          SIGNING_POLICY: release-signing
         run: |
-          $signed = Get-ChildItem -Path signed-inner -Recurse -File -Filter 'orca-uninstaller.exe' |
-            Select-Object -First 1
-          if ($null -eq $signed) {
-            throw 'SignPath did not return uninstaller/orca-uninstaller.exe; check the windows-inner-binaries-zip artifact configuration covers it.'
+          $requireValid = $env:SIGNING_POLICY -ne 'test-signing'
+          $candidates = @(
+            (Join-Path 'signed-inner' 'uninstaller\orca-uninstaller.exe'),
+            (Join-Path 'signed-inner/signing-stage' 'uninstaller\orca-uninstaller.exe')
+          ) | Where-Object { Test-Path -LiteralPath $_ -PathType Leaf }
+          if (@($candidates).Count -ne 1) {
+            throw 'Missing or ambiguous uninstaller/orca-uninstaller.exe in the signed artifact; check the windows-inner-binaries-zip configuration.'
           }
+          $signed = Get-Item -LiteralPath @($candidates)[0]
           $signature = Get-AuthenticodeSignature -FilePath $signed.FullName
-          if ($null -eq $signature.SignerCertificate) {
-            throw 'The returned NSIS uninstaller carries no signature.'
+          if ($null -eq $signature.SignerCertificate -or ($requireValid -and ($signature.Status -ne 'Valid' -or $signature.SignerCertificate.Subject -notlike '*CN=SignPath Foundation*'))) {
+            throw 'The returned NSIS uninstaller carries no valid SignPath signature.'
           }
           $signedDir = Join-Path $env:RUNNER_TEMP 'uninstaller-signing\signed'
           New-Item -ItemType Directory -Force -Path $signedDir | Out-Null
@@ -1804,13 +1794,11 @@ jobs:
       - name: Replace cached elevate.exe with the signed copy
         id: sign-elevate-cache
         if: matrix.platform == 'win' && github.run_attempt == 1 && steps.restore-signed-inner.outcome == 'success'
-        continue-on-error: true
         shell: pwsh
         run: |
           $signed = 'dist/win-unpacked/resources/elevate.exe'
           if (-not (Test-Path $signed)) {
-            Write-Host '::warning::No elevate.exe in win-unpacked resources; nothing to protect from the rebuild clobber.'
-            exit 0
+            throw 'No elevate.exe in win-unpacked resources.'
           }
           # Why this guard stays: windows-signing-rehearsal.yml shares the
           # electron-builder-win-<lockfile hash> cache key with this workflow, so a
@@ -1818,8 +1806,7 @@ jobs:
           $signature = Get-AuthenticodeSignature -FilePath $signed
           $subject = if ($null -eq $signature.SignerCertificate) { '<none>' } else { $signature.SignerCertificate.Subject }
           if ($signature.Status -ne 'Valid' -or $subject -notlike '*CN=SignPath Foundation*') {
-            Write-Host "::warning::win-unpacked elevate.exe is not SignPath-signed ($($signature.Status), $subject); skipping cache swap."
-            exit 0
+            throw "win-unpacked elevate.exe is not SignPath-signed ($($signature.Status), $subject)."
           }
           node config/scripts/replace-cached-nsis-elevate.mjs $signed
           if ($LASTEXITCODE -ne 0) {
@@ -1837,35 +1824,16 @@ jobs:
       - name: Rebuild NSIS installer from signed unpacked app
         id: rebuild-nsis-signed
         if: matrix.platform == 'win' && github.run_attempt == 1 && steps.restore-signed-inner.outcome == 'success'
-        continue-on-error: true
         shell: pwsh
         env:
-          # Why unconditional: the sign hook keys off the file existing, which it
-          # only does when the restore step above succeeded. A missing file logs a
-          # warning and embeds the freshly built unsigned uninstaller instead.
           ORCA_WIN_UNINSTALLER_SIGNED_PATH: ${{ runner.temp }}\uninstaller-signing\signed\orca-uninstaller.exe
         run: |
-          # Why: keep the pre-rebuild artifacts so a failed rebuild can fall
-          # back to shipping them unchanged (fail-open).
-          New-Item -ItemType Directory -Path prepack-backup -Force | Out-Null
-          Copy-Item 'dist/orca-windows-setup.exe' 'prepack-backup/orca-windows-setup.exe' -Force
-          Copy-Item 'dist/latest.yml' 'prepack-backup/latest.yml' -Force
-
           pnpm exec electron-builder --config config/electron-builder.config.cjs --win --publish never --prepackaged "$env:GITHUB_WORKSPACE\dist\win-unpacked"
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           if (-not (Test-Path 'dist/orca-windows-setup.exe')) {
             throw 'electron-builder --prepackaged did not produce dist/orca-windows-setup.exe'
           }
 
-      - name: Roll back to original installer after failed rebuild
-        if: matrix.platform == 'win' && github.run_attempt == 1 && steps.rebuild-nsis-signed.outcome == 'failure'
-        shell: pwsh
-        run: |
-          if (Test-Path 'prepack-backup/orca-windows-setup.exe') {
-            Copy-Item 'prepack-backup/orca-windows-setup.exe' 'dist/orca-windows-setup.exe' -Force
-            Copy-Item 'prepack-backup/latest.yml' 'dist/latest.yml' -Force
-            Write-Warning 'Restored pre-rebuild installer; this release ships with unsigned inner binaries.'
-          }
       # ── End Windows inner-binary signing ───────────────────────────────
       - name: Upload unsigned Windows installer for SignPath
         if: matrix.platform == 'win' && github.run_attempt == 1
@@ -1919,7 +1887,7 @@ jobs:
             $requestUrl = "https://app.signpath.io/Web/$env:SIGNPATH_ORGANIZATION_ID/SigningRequests/$env:SIGNPATH_REQUEST_ID"
           }
 
-          # Why: releases where inner signing fell through have only this one request.
+          # Keep the two approval requests distinguishable in the notification.
           $stage = if ($env:INNER_SIGNING_SUBMITTED -eq 'true') { 'installer signing request (2 of 2)' } else { 'signing request' }
           # Why: approvers need tag + source ref/commit + who cut, not only the tag.
           $sourceRef = if (-not [string]::IsNullOrWhiteSpace($env:SOURCE_REF)) { $env:SOURCE_REF } else { 'unknown' }
@@ -2026,24 +1994,18 @@ jobs:
 
       # Why: evidence gate for inner-binary signing (issue #7785, supersedes
       # PR #7170's Orca.exe-only gate — this covers every staged .exe/.dll/.node
-      # by extracting the shipped installer). Warn-only until the flow has been
-      # proven on a real release, then flip ORCA_WINDOWS_INNER_SIGNATURE_REQUIRED
-      # to 'true' so unsigned inner binaries block the release.
+      # by extracting the shipped installer). Unsigned binaries block publication.
       - name: Verify Windows inner binary signatures
         if: matrix.platform == 'win' && github.run_attempt == 1
         shell: pwsh
         env:
-          ORCA_WINDOWS_INNER_SIGNATURE_REQUIRED: 'false'
+          ORCA_WINDOWS_INNER_SIGNATURE_REQUIRED: 'true'
           INNER_SIGNING_COMPLETED: ${{ steps.rebuild-nsis-signed.outcome == 'success' }}
           UNINSTALLER_SIGNING_COMPLETED: ${{ steps.restore-signed-uninstaller.outcome == 'success' }}
         run: |
           $required = $env:ORCA_WINDOWS_INNER_SIGNATURE_REQUIRED -eq 'true'
 
-          # Why: a fail-open gate that writes nothing is indistinguishable from a
-          # gate that passed. Always leave a verdict in the evidence artifact and
-          # the job summary so a silent degradation is visible (#6487).
-          # Why best-effort: while warn-only, a disk-full or permission error
-          # writing the verdict must not become the thing that fails the release.
+          # Keep diagnostics best-effort so they cannot mask a signature failure.
           function Add-GateEvidence([string]$line) {
             try {
               Add-Content -Path 'inner-signing-evidence.txt' -Value "`n$line" -ErrorAction Stop
@@ -2071,19 +2033,14 @@ jobs:
           }
 
           if ($env:INNER_SIGNING_COMPLETED -ne 'true') {
-            $message = 'Windows inner-binary signing did not complete; this release ships unsigned inner binaries (fail-open, issue #7785).'
+            $message = 'Windows inner-binary signing did not complete; publication is blocked.'
             Write-GateVerdict "NOT VERIFIED — $message"
             if ($required) { throw $message }
             Write-Host "::warning::$message"
             exit 0
           }
 
-          # Why try/catch: while the gate is warn-only, even an unexpected
-          # script error (extraction hiccup, missing file) must not block
-          # the release — only the flip to required makes failures fatal.
-          # Why tracked separately: a required-mode signature failure must not be
-          # rewritten as ERRORED by the catch below, which would replace the
-          # per-file report with an exception string and lose the diagnostics.
+          # Keep signature failures outside the catch to preserve the per-file report.
           $policyFailure = $null
 
           try {
@@ -2105,14 +2062,19 @@ jobs:
             }
             New-Item -ItemType Directory -Path inner-evidence-extract -Force | Out-Null
             & $7za x 'dist/orca-windows-setup.exe' '-oinner-evidence-extract' -y | Out-Null
+            if ($LASTEXITCODE -ne 0) { throw 'Could not extract the shipped installer payload.' }
 
             $root = Resolve-Path 'inner-evidence-extract'
+            # Verify the CLI even when a cached signed copy bypassed staging (#23383).
             # Why elevate.exe is always appended: staging skips already-signed
             # files, and the persisted electron-builder cache can carry a
             # previously signed elevate.exe — so it may be absent from the list
             # in some runs, yet it is the file most at risk of losing its
             # signature in the NSIS rebuild. Verify it in every release.
             $targets = @(Get-Content 'inner-signing-list.txt')
+            foreach ($requiredTarget in @('Orca.exe', 'resources\bin\orca.exe')) {
+              if ($targets -notcontains $requiredTarget) { $targets += $requiredTarget }
+            }
             if ($targets -notcontains 'resources\elevate.exe') {
               $targets += 'resources\elevate.exe'
             }
@@ -2147,7 +2109,7 @@ jobs:
                 }
               }
             } else {
-              Write-Host '::warning::The NSIS uninstaller was not signed on this run; it is excluded from the evidence gate (fail-open).'
+              $failures.Add('The NSIS uninstaller signing did not complete.')
             }
             foreach ($relative in $targets) {
               $path = Join-Path $root $relative
@@ -2197,6 +2159,38 @@ jobs:
           # Outside the catch so the FAILED evidence report survives intact.
           if ($policyFailure) { throw $policyFailure }
 
+      - name: Notify Slack when Windows signing fails
+        if: failure() && matrix.platform == 'win' && github.run_attempt == 1 && steps.install-signpath.outcome != '' && steps.install-signpath.outcome != 'skipped'
+        continue-on-error: true
+        shell: pwsh
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+          TAG: ${{ needs.cut.outputs.tag }}
+          GITHUB_RUN_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          INNER_REQUEST_ID: ${{ steps.submit-inner-signing.outputs.signing-request-id }}
+          INSTALLER_REQUEST_ID: ${{ steps.submit-signing-request.outputs.signing-request-id }}
+          INSTALLER_SUBMISSION_OUTCOME: ${{ steps.submit-signing-request.outcome }}
+        run: |
+          if ([string]::IsNullOrWhiteSpace($env:SLACK_WEBHOOK_URL)) {
+            throw 'SLACK_WEBHOOK_URL is missing; cannot notify release approvers of the signing failure.'
+          }
+          $stage = 'inner-binary signing or installer rebuild'
+          if ($env:INSTALLER_SUBMISSION_OUTCOME -in @('success', 'failure')) {
+            $stage = 'installer signing or final signature verification'
+          }
+          $message = "Orca Windows release ``$($env:TAG)`` failed during $stage (including approval timeouts). Publication is blocked.`n<$($env:GITHUB_RUN_URL)|Open failed GitHub Actions run>"
+          foreach ($request in @(
+            @{ Id = $env:INNER_REQUEST_ID; Label = 'Inner-binary signing request' },
+            @{ Id = $env:INSTALLER_REQUEST_ID; Label = 'Installer signing request' }
+          )) {
+            if (-not [string]::IsNullOrWhiteSpace($request.Id)) {
+              $message += "`n<https://app.signpath.io/Web/c37aa192-a27a-4377-9c90-5d6c95912dc0/SigningRequests/$($request.Id)|$($request.Label)>"
+            }
+          }
+          $message += "`nCheck the failed step before retrying. Late SignPath approval does not resume this run; missing Windows assets require a fresh release dispatch, not Re-run failed jobs."
+          $payload = @{ text = $message } | ConvertTo-Json
+          Invoke-RestMethod -Method Post -Uri $env:SLACK_WEBHOOK_URL -ContentType 'application/json' -Body $payload
+
       - name: Upload Windows inner signing evidence
         if: always() && matrix.platform == 'win' && github.run_attempt == 1
         uses: actions/upload-artifact@v7
diff --git a/.github/workflows/release-policy.yml b/.github/workflows/release-policy.yml
index 8014145939b..53decc5e7e3 100644
--- a/.github/workflows/release-policy.yml
+++ b/.github/workflows/release-policy.yml
@@ -16,83 +16,21 @@ concurrency:
 jobs:
   enforce:
     if: github.repository == 'stablyai/orca'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     timeout-minutes: 5
     steps:
+      # Why: release events run this file from the tagged commit, so load the module from the same commit.
+      - uses: actions/checkout@v6
+        with:
+          sparse-checkout: config/scripts/release-policy.mjs
+          sparse-checkout-cone-mode: false
+          persist-credentials: false
       - name: Enforce release policy
         uses: actions/github-script@v8
         with:
           script: |
-            const release = context.payload.release;
-            const tag = release.tag_name;
-            const author = release.author?.login;
-            const number = "(?:0|[1-9][0-9]*)";
-            const version = `${number}\\.${number}\\.${number}`;
-            const stableTag = new RegExp(`^v${version}$`);
-            const prereleaseTag = new RegExp(
-              `^(?:v${version}-rc\\.${number}(?:\\.[0-9A-Za-z]+)?|mobile(?:-android)?-v${version})$`,
-            );
-            const expectedPrerelease = prereleaseTag.test(tag);
-            const allowed = author === "github-actions[bot]" &&
-              (stableTag.test(tag) || expectedPrerelease);
-            const { owner, repo } = context.repo;
-
-            async function restoreLatestStable() {
-              const releases = await github.paginate(github.rest.repos.listReleases, {
-                owner,
-                repo,
-                per_page: 100,
-              });
-              const stable = releases
-                .filter((candidate) =>
-                  !candidate.draft &&
-                  !candidate.prerelease &&
-                  candidate.author?.login === "github-actions[bot]" &&
-                  stableTag.test(candidate.tag_name),
-                )
-                .sort((left, right) => {
-                  const a = left.tag_name.slice(1).split(".").map(Number);
-                  const b = right.tag_name.slice(1).split(".").map(Number);
-                  return a.reduce((result, part, index) => result || part - b[index], 0);
-                })
-                .at(-1);
-              if (stable) {
-                await github.rest.repos.updateRelease({
-                  owner,
-                  repo,
-                  release_id: stable.id,
-                  make_latest: "true",
-                });
-              }
-            }
-
-            if (allowed) {
-              if (release.prerelease !== expectedPrerelease) {
-                await github.rest.repos.updateRelease({
-                  owner,
-                  repo,
-                  release_id: release.id,
-                  prerelease: expectedPrerelease,
-                  make_latest: expectedPrerelease ? "false" : "legacy",
-                });
-              }
-              await restoreLatestStable();
-              return;
-            }
-
-            await github.rest.repos.updateRelease({
-              owner,
-              repo,
-              release_id: release.id,
-              draft: true,
-              prerelease: true,
-              make_latest: "false",
-            });
-            await restoreLatestStable();
-            await github.rest.repos.deleteRelease({ owner, repo, release_id: release.id });
-            try {
-              await github.rest.git.deleteRef({ owner, repo, ref: `tags/${tag}` });
-            } catch (error) {
-              if (error.status !== 404) throw error;
-            }
-            core.warning(`Deleted unauthorized release ${tag} created by ${author || "unknown"}.`);
+            const { pathToFileURL } = await import("node:url")
+            const { enforceReleasePolicy } = await import(
+              pathToFileURL(`${process.env.GITHUB_WORKSPACE}/config/scripts/release-policy.mjs`).href
+            )
+            await enforceReleasePolicy({ github, context, core })
diff --git a/.github/workflows/terminal-ime-e2e.yml b/.github/workflows/terminal-ime-e2e.yml
index bd6be26bd27..168280f9ac2 100644
--- a/.github/workflows/terminal-ime-e2e.yml
+++ b/.github/workflows/terminal-ime-e2e.yml
@@ -49,7 +49,7 @@ jobs:
         run: >-
           xvfb-run --auto-servernum
           env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1
-          pnpm run test:e2e --
+          pnpm run test:e2e
           tests/e2e/terminal-ime-exact-byte.spec.ts
           --workers=1
 
diff --git a/.github/workflows/track-community-prs.yaml b/.github/workflows/track-community-prs.yaml
deleted file mode 100644
index 5a5dcb670c2..00000000000
--- a/.github/workflows/track-community-prs.yaml
+++ /dev/null
@@ -1,119 +0,0 @@
-name: Track Community PRs
-
-on:
-  pull_request_target:
-    types: [opened, reopened, ready_for_review]
-  workflow_dispatch:
-    inputs:
-      pr_number:
-        description: 'PR number to backfill or retry'
-        required: true
-        type: number
-
-permissions:
-  contents: read
-
-jobs:
-  track-community-pr:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Generate bufo-bot token
-        id: app-token
-        uses: actions/create-github-app-token@v3
-        with:
-          app-id: 2590194
-          private-key: ${{ secrets.BUFO_BOT_PRIVATE_KEY }}
-          owner: stablyai
-
-      - name: Add PR to project
-        uses: actions/github-script@v8
-        env:
-          PROJECT_OWNER: stablyai
-          PROJECT_NUMBER: '13'
-          INTERNAL_TEAM_SLUG: stably-eng
-        with:
-          github-token: ${{ steps.app-token.outputs.token }}
-          script: |
-            const projectOwner = process.env.PROJECT_OWNER;
-            const projectNumber = Number(process.env.PROJECT_NUMBER);
-            const internalTeamSlug = process.env.INTERNAL_TEAM_SLUG;
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-
-            const prNumber = context.eventName === 'workflow_dispatch'
-              ? Number(context.payload.inputs.pr_number)
-              : context.payload.pull_request.number;
-
-            const { data: pr } = await github.rest.pulls.get({
-              owner,
-              repo,
-              pull_number: prNumber,
-            });
-
-            const author = pr.user.login;
-
-            const skippedAuthors = new Set([
-              'github-actions[bot]',
-              'dependabot[bot]',
-            ]);
-
-            if (skippedAuthors.has(author)) {
-              core.info(`Skipping bot PR author ${author}.`);
-              return;
-            }
-
-            let isInternalAuthor = false;
-            try {
-              const membership = await github.rest.teams.getMembershipForUserInOrg({
-                org: projectOwner,
-                team_slug: internalTeamSlug,
-                username: author,
-              });
-              isInternalAuthor = membership.data.state === 'active';
-            } catch (error) {
-              if (error.status !== 404) {
-                throw error;
-              }
-            }
-
-            if (isInternalAuthor) {
-              core.info(`Skipping internal PR author ${author}.`);
-              return;
-            }
-
-            const projectResult = await github.graphql(
-              `
-                query($owner: String!, $number: Int!) {
-                  organization(login: $owner) {
-                    projectV2(number: $number) {
-                      id
-                    }
-                  }
-                }
-              `,
-              { owner: projectOwner, number: projectNumber },
-            );
-
-            const projectId = projectResult.organization.projectV2.id;
-
-            await github.graphql(
-              `
-                mutation($projectId: ID!, $contentId: ID!) {
-                  addProjectV2ItemById(input: {
-                    projectId: $projectId,
-                    contentId: $contentId
-                  }) {
-                    item {
-                      id
-                    }
-                  }
-                }
-              `,
-              {
-                projectId,
-                contentId: pr.node_id,
-              },
-            );
-
-            core.info(`Added PR #${pr.number} (${pr.html_url}) to project ${projectOwner}/${projectNumber}.`);
diff --git a/.github/workflows/unit-plan.yml b/.github/workflows/unit-plan.yml
new file mode 100644
index 00000000000..b427908b26d
--- /dev/null
+++ b/.github/workflows/unit-plan.yml
@@ -0,0 +1,48 @@
+name: Unit plan
+
+# Why its own workflow: the caller's `needs` gate the whole called workflow, so while this lived
+# inside unit-tests.yml it waited on static analysis and typecheck before it could even start —
+# and the shards then waited on it. Planning needs neither (its inputs are the checkout, a git
+# diff against HEAD^1, the import graph, and the checked-in timing baseline), so hoisting it out
+# lets it overlap the gate instead of queueing behind it. Measured: a median 93s off the shard
+# matrix's start.
+on:
+  workflow_call:
+    inputs:
+      selection_mode:
+        description: Shadow validates selection; selected applies it only to draft PRs.
+        required: false
+        default: shadow
+        type: string
+
+    outputs:
+      shards:
+        description: JSON array of shard assignments for the unit matrix.
+        value: ${{ jobs.plan.outputs.shards }}
+
+permissions:
+  contents: read
+
+jobs:
+  plan:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      shards: ${{ steps.plan.outputs.shards }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 2
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+      - name: Plan unit selection
+        id: plan
+        env:
+          ORCA_UNIT_SELECTION_MODE: ${{ inputs.selection_mode }}
+        run: node config/scripts/ci-unit-plan.mjs
+      - uses: actions/upload-artifact@v7
+        continue-on-error: true
+        with:
+          name: unit-selection-attempt-${{ github.run_attempt }}
+          path: ci-shards/unit-selection.json
+          retention-days: 14
diff --git a/.github/workflows/unit-selection-evidence.yml b/.github/workflows/unit-selection-evidence.yml
new file mode 100644
index 00000000000..4ff46be84d0
--- /dev/null
+++ b/.github/workflows/unit-selection-evidence.yml
@@ -0,0 +1,41 @@
+name: Unit selection evidence
+
+# Why its own workflow: this job is advisory -- `continue-on-error` on both the job and its
+# comparison step, so it can never fail a PR. But a caller's `needs: test` waits for every job in
+# the called workflow, so while it lived in unit-tests.yml it held `verify` for ~36s after the
+# last shard finished. Called as a sibling instead, it still runs on every PR and still uploads
+# its review artifact; it just no longer sits on the critical path.
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  selection_evidence:
+    if: ${{ !cancelled() }}
+    continue-on-error: true
+    runs-on: ubuntu-slim
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          sparse-checkout: config/scripts/ci-unit-selection-review.mjs
+          sparse-checkout-cone-mode: false
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: unit-shard-node-*-attempt-${{ github.run_attempt }}
+          path: unit-evidence/
+      - name: Compare selection with full results
+        continue-on-error: true
+        run: node config/scripts/ci-unit-selection-review.mjs unit-evidence
+      - uses: actions/upload-artifact@v7
+        if: always()
+        continue-on-error: true
+        with:
+          name: unit-selection-review-attempt-${{ github.run_attempt }}
+          path: unit-evidence/selection-review.json
+          retention-days: 30
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 4ed5063e318..abe9cf28a41 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -8,19 +8,29 @@ on:
         required: true
         type: string
 
+      runner:
+        description: Hosted runner for the unit shards; relay integration keeps its x86 host.
+        required: false
+        default: ubuntu-latest
+        type: string
+
+      shards:
+        description: JSON array of shard assignments, produced by unit-plan.yml.
+        required: true
+        type: string
+
 permissions:
   contents: read
 
 jobs:
   test:
-    name: tests node ${{ matrix.node }} ${{ matrix.shard }}/${{ matrix.shard_total }}
-    runs-on: ubuntu-latest
+    name: tests node ${{ matrix.node }} ${{ matrix.shard.index }}/${{ matrix.shard.count }}
+    runs-on: ${{ inputs.runner }}
     strategy:
       fail-fast: false
       matrix:
         node: ${{ fromJSON(inputs.node_versions) }}
-        shard: [1, 2, 3, 4, 5, 6, 7, 8]
-        shard_total: [8]
+        shard: ${{ fromJSON(inputs.shards) }}
 
     steps:
       - name: Checkout
@@ -33,41 +43,26 @@ jobs:
           native-runtime: node
           node-version: ${{ matrix.node }}
           cache-electron-package: 'true'
-          cache-dependency-path: |
-            pnpm-lock.yaml
-            cloud/pnpm-lock.yaml
 
       - name: Install Electron package binary for tests
         run: node config/scripts/install-electron-package-binary.mjs
 
+      - uses: actions/download-artifact@v8
+        continue-on-error: true
+        with:
+          name: unit-selection-attempt-${{ github.run_attempt }}
+          path: ci-shards/
+
       - name: Test shard
         env:
           ORCA_BALANCE_UNIT_SHARDS: '1'
           ORCA_BACKGROUND_LAUNCH: '1'
         run: |
-          export ORCA_SHARD_SOURCE_SHA="$(git rev-parse HEAD)"
+          ORCA_SHARD_SOURCE_SHA="$(git rev-parse HEAD)"
+          export ORCA_SHARD_SOURCE_SHA
           pnpm exec vitest run --config config/vitest.config.ts \
-            --exclude=src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts \
-            --exclude=src/main/daemon/shell-ready.test.ts \
-            --exclude=src/main/daemon/node-pty-fd-leak.test.ts \
-            --exclude=src/main/providers/local-pty-shell-ready-zsh-launch-environment.test.ts \
-            --exclude=src/main/providers/__tests__/shell-ready-framework-example.test.ts \
-            --exclude=src/main/pty/omp-shell-wrapper-alias-safety.test.ts \
-            --exclude=src/main/pty/omp-shell-wrapper.node-pty.test.ts \
-            --exclude=src/main/shell-startup-feature-channel.test.ts \
-            --exclude=src/main/terminal-history-fish-session.node-pty.test.ts \
-            --exclude=src/main/zsh-scoped-histfile.live-shell.test.ts \
-            --exclude=src/main/zsh-startup-hook-user-config-equivalence.live-shell.test.ts \
-            --exclude=src/main/zsh-wrapper-version-mismatch.live-shell.test.ts \
-            --exclude=src/renderer/src/components/terminal-pane/fish-color-scheme-child-stdin.node-pty.test.ts \
-            --exclude=src/shared/fish-query-reply-child-stdin.node-pty.test.ts \
-            --exclude=src/shared/pty-reply-echo-shapes.node-pty.test.ts \
-            --exclude=src/shared/startup-shell-portability.live-shell.test.ts \
-            --exclude=src/shared/posix-command-path-lookup.test.ts \
-            --exclude=tests/e2e/relay-region-compatibility.unit.test.ts \
-            --exclude=tests/e2e/relay-region-correction.unit.test.ts \
-            --exclude=tests/e2e/cross-version-wire/** \
-            --shard=${{ matrix.shard }}/${{ matrix.shard_total }}
+            --shard=${{ matrix.shard.index }}/${{ matrix.shard.count }} \
+            ${{ inputs.runner == 'ubuntu-24.04-arm' && '--maxWorkers=4' || '' }}
 
       - name: Upload unit shard assignment
         if: always()
@@ -75,13 +70,17 @@ jobs:
         continue-on-error: true
         uses: actions/upload-artifact@v7
         with:
-          name: unit-shard-node-${{ matrix.node }}-${{ matrix.shard }}-attempt-${{ github.run_attempt }}
+          name: unit-shard-node-${{ matrix.node }}-${{ matrix.shard.index }}-attempt-${{ github.run_attempt }}
           path: ci-shards/
           retention-days: 14
           if-no-files-found: warn
 
   relay_integration:
-    name: relay integration node ${{ fromJSON(inputs.node_versions)[0] }}
+    name: relay integration node ${{ matrix.node }}
+    strategy:
+      fail-fast: false
+      matrix:
+        node: ${{ fromJSON(inputs.node_versions) }}
     runs-on: ubuntu-latest
 
     steps:
@@ -93,7 +92,7 @@ jobs:
       - uses: ./.github/actions/install-node-dependencies
         with:
           native-runtime: node
-          node-version: ${{ fromJSON(inputs.node_versions)[0] }}
+          node-version: ${{ matrix.node }}
           cache-electron-package: 'true'
           cache-dependency-path: |
             pnpm-lock.yaml
diff --git a/.github/workflows/win-crash-survival-e2e.yml b/.github/workflows/win-crash-survival-e2e.yml
index e0d7b80d047..53c231111db 100644
--- a/.github/workflows/win-crash-survival-e2e.yml
+++ b/.github/workflows/win-crash-survival-e2e.yml
@@ -35,6 +35,7 @@ jobs:
     timeout-minutes: 50
     env:
       EXPECT: ${{ inputs.expect || 'survival' }}
+      ORCA_BACKGROUND_LAUNCH: '1'
 
     steps:
       - name: Checkout
diff --git a/.github/workflows/win-update-survival-e2e.yml b/.github/workflows/win-update-survival-e2e.yml
index 50c38f2e3ad..b709f82b788 100644
--- a/.github/workflows/win-update-survival-e2e.yml
+++ b/.github/workflows/win-update-survival-e2e.yml
@@ -29,6 +29,21 @@ on:
         options:
           - survival
           - cold-restore
+      trace_installer:
+        description: Trace installer process checks in this disposable build
+        type: boolean
+        default: false
+      policy:
+        description: Execution policy inherited by harness child processes
+        type: choice
+        default: inherited
+        options:
+          - inherited
+          - Restricted
+      from_release:
+        description: Optional base release tag; blank uses this branch build
+        type: string
+        default: ''
 
 permissions:
   contents: read
@@ -39,7 +54,7 @@ concurrency:
 
 jobs:
   survival:
-    name: survival (branch build over itself)
+    name: update ${{ inputs.from_release || 'branch' }} to branch (${{ inputs.expect || 'survival' }}, policy=${{ inputs.policy || 'inherited' }})
     runs-on: windows-2022
     timeout-minutes: 50
     env:
@@ -62,18 +77,23 @@ jobs:
         with:
           install: false
 
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
       # Why: cache the built installer keyed on the inputs that affect it, so a
       # harness-only edit skips the ~20 min electron-builder build. The daemon
       # relocation code lives under src/, so changing it correctly rebuilds.
+      # Hash before installation creates native build artifacts under native/.
       - name: Cache branch installer
         id: cache-installer
-        uses: actions/cache@v4
+        uses: actions/cache/restore@v4
         with:
           path: dist/orca-windows-setup.exe
-          key: branch-installer-${{ hashFiles('src/**', 'config/**', 'native/**', 'resources/win32/**', 'package.json', 'pnpm-lock.yaml') }}
+          key: branch-installer-${{ inputs.trace_installer && format('trace-{0}-', hashFiles('tests/tools/win-update-e2e/trace-installer-branches.mjs')) || '' }}${{ hashFiles('src/**', 'config/**', 'native/**', 'resources/**', 'mobile/**', 'patches/**', 'package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml') }}
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Instrument disposable installer and uninstaller
+        if: inputs.trace_installer && steps.cache-installer.outputs.cache-hit != 'true'
+        run: node tests/tools/win-update-e2e/trace-installer-branches.mjs
 
       # Why here: electron-builder's beforePack requires out/mobile-web, and the bundle
       # build resolves React Native and Expo from mobile/node_modules. Gated with the
@@ -88,26 +108,46 @@ jobs:
           pnpm run build:desktop
           pnpm exec electron-builder --config config/electron-builder.config.cjs --win --publish never
 
-      # Why: install the branch build, open a terminal, update the SAME build
-      # over it, and assert the relocated daemon survives. Same build on both
-      # sides isolates the survival mechanism (NSIS kill sweep + userData daemon
-      # + adoption) from cross-version staleness policy. No --install-dir: a CI
-      # runner has no real Orca to protect.
+      - name: Cache successfully built installer before survival verification
+        if: steps.cache-installer.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v4
+        with:
+          path: dist/orca-windows-setup.exe
+          key: ${{ steps.cache-installer.outputs.cache-primary-key }}
+
+      # A released base also exercises its old uninstaller; default runs isolate this branch.
       - name: Run survival harness
         id: harness
         shell: pwsh
         env:
           ORCA_E2E_DIAG_DIR: artifacts/diag
+          ORCA_BACKGROUND_LAUNCH: '1'
+          DEBUG: 'pw:browser'
+          ORCA_E2E_NSIS_TRACE: ${{ github.workspace }}\artifacts\nsis-process-trace.log
+          ORCA_E2E_PROCESS_POLICY: ${{ inputs.policy || 'inherited' }}
+          FROM_RELEASE: ${{ inputs.from_release }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           New-Item -ItemType Directory -Force artifacts | Out-Null
           $exe = "dist/orca-windows-setup.exe"
           if (-not (Test-Path $exe)) { throw "Installer not found at $exe" }
           $log = "artifacts/survival-output.log"
-          node tests/tools/win-update-e2e/run.mjs `
-            --from "$exe" `
-            --to "$exe" `
-            --expect "$env:EXPECT" `
-            --soak-seconds 60 2>&1 | Tee-Object -FilePath $log
+          $harnessArgs = @('--to', $exe, '--expect', $env:EXPECT, '--soak-seconds', '60')
+          if ($env:FROM_RELEASE) {
+            $harnessArgs += @('--from-release', $env:FROM_RELEASE)
+          } else {
+            $harnessArgs += @('--from', $exe)
+          }
+          # Only the harness and its children inherit the test policy.
+          $launch = @'
+          if (process.env.ORCA_E2E_PROCESS_POLICY === 'Restricted') {
+            process.env.PSExecutionPolicyPreference = 'Restricted'
+          }
+          console.log('Harness child process policy: ' + (process.env.PSExecutionPolicyPreference || 'inherited'))
+          process.argv.splice(1, 0, 'tests/tools/win-update-e2e/run.mjs')
+          await import('./tests/tools/win-update-e2e/run.mjs')
+          '@
+          node --input-type=module -e $launch -- @harnessArgs 2>&1 | Tee-Object -FilePath $log
           exit $LASTEXITCODE
 
       - name: Upload survival output
@@ -117,6 +157,7 @@ jobs:
           name: win-update-survival-output
           path: |
             artifacts/survival-output.log
+            artifacts/nsis-process-trace.log
             artifacts/diag/**
           retention-days: 7
           if-no-files-found: warn
diff --git a/.github/workflows/windows-signing-rehearsal.yml b/.github/workflows/windows-signing-rehearsal.yml
index 0fa2a31cd97..c2364330164 100644
--- a/.github/workflows/windows-signing-rehearsal.yml
+++ b/.github/workflows/windows-signing-rehearsal.yml
@@ -210,20 +210,25 @@ jobs:
       # signed and unsigned binaries.
       - name: Restore signed inner binaries into unpacked app
         shell: pwsh
+        env:
+          SIGNING_POLICY: ${{ inputs.signing-policy-slug || 'test-signing' }}
         run: |
+          $requireValid = $env:SIGNING_POLICY -ne 'test-signing'
           $root = Resolve-Path 'dist/win-unpacked'
           $failures = New-Object System.Collections.Generic.List[string]
           foreach ($relative in Get-Content 'inner-signing-list.txt') {
-            $signed = Get-ChildItem -Path signed-inner -Recurse -File |
-              Where-Object { [System.IO.Path]::GetRelativePath((Resolve-Path 'signed-inner'), $_.FullName).TrimStart('\', '/') -like "*$relative" } |
-              Select-Object -First 1
-            if ($null -eq $signed) {
-              $failures.Add("missing from signed artifact: $relative")
+            $candidates = @(
+              (Join-Path 'signed-inner' $relative),
+              (Join-Path 'signed-inner/signing-stage' $relative)
+            ) | Where-Object { Test-Path -LiteralPath $_ -PathType Leaf }
+            if (@($candidates).Count -ne 1) {
+              $failures.Add("missing or ambiguous signed artifact path: $relative")
               continue
             }
+            $signed = Get-Item -LiteralPath @($candidates)[0]
             $signature = Get-AuthenticodeSignature -FilePath $signed.FullName
-            if ($null -eq $signature.SignerCertificate) {
-              $failures.Add("returned without a signature: $relative")
+            if ($null -eq $signature.SignerCertificate -or ($requireValid -and ($signature.Status -ne 'Valid' -or $signature.SignerCertificate.Subject -notlike '*CN=SignPath Foundation*'))) {
+              $failures.Add("returned without a valid SignPath signature: $relative")
               continue
             }
             Copy-Item -Path $signed.FullName -Destination (Join-Path $root $relative) -Force
@@ -236,15 +241,21 @@ jobs:
 
       - name: Restore signed uninstaller for the installer rebuild
         shell: pwsh
+        env:
+          SIGNING_POLICY: ${{ inputs.signing-policy-slug || 'test-signing' }}
         run: |
-          $signed = Get-ChildItem -Path signed-inner -Recurse -File -Filter 'orca-uninstaller.exe' |
-            Select-Object -First 1
-          if ($null -eq $signed) {
-            throw 'SignPath did not return uninstaller/orca-uninstaller.exe; check the inner-binaries artifact configuration covers it.'
+          $requireValid = $env:SIGNING_POLICY -ne 'test-signing'
+          $candidates = @(
+            (Join-Path 'signed-inner' 'uninstaller\orca-uninstaller.exe'),
+            (Join-Path 'signed-inner/signing-stage' 'uninstaller\orca-uninstaller.exe')
+          ) | Where-Object { Test-Path -LiteralPath $_ -PathType Leaf }
+          if (@($candidates).Count -ne 1) {
+            throw 'Missing or ambiguous uninstaller/orca-uninstaller.exe in the signed artifact; check the windows-inner-binaries-zip configuration.'
           }
+          $signed = Get-Item -LiteralPath @($candidates)[0]
           $signature = Get-AuthenticodeSignature -FilePath $signed.FullName
-          if ($null -eq $signature.SignerCertificate) {
-            throw 'The returned NSIS uninstaller carries no signature.'
+          if ($null -eq $signature.SignerCertificate -or ($requireValid -and ($signature.Status -ne 'Valid' -or $signature.SignerCertificate.Subject -notlike '*CN=SignPath Foundation*'))) {
+            throw 'The returned NSIS uninstaller carries no valid SignPath signature.'
           }
           $signedDir = Join-Path $env:RUNNER_TEMP 'uninstaller-signing\signed'
           New-Item -ItemType Directory -Force -Path $signedDir | Out-Null
@@ -487,7 +498,11 @@ jobs:
             Test-Signature "shipped: Uninstall Orca.exe (via $installedVia)" $installedUninstaller.FullName
           }
 
-          foreach ($relative in Get-Content 'inner-signing-list.txt') {
+          $targets = @(Get-Content 'inner-signing-list.txt')
+          foreach ($requiredTarget in @('Orca.exe', 'resources\bin\orca.exe')) {
+            if ($targets -notcontains $requiredTarget) { $targets += $requiredTarget }
+          }
+          foreach ($relative in $targets) {
             $path = Join-Path $root $relative
             if (-not (Test-Path $path)) {
               $failures.Add("missing from installer payload: $relative")
diff --git a/.github/workflows/windows-terminal-restart-e2e.yml b/.github/workflows/windows-terminal-restart-e2e.yml
index abb8dc89aa8..d576ee65049 100644
--- a/.github/workflows/windows-terminal-restart-e2e.yml
+++ b/.github/workflows/windows-terminal-restart-e2e.yml
@@ -22,6 +22,7 @@ jobs:
     timeout-minutes: 30
     env:
       NODE_OPTIONS: --max-old-space-size=4096
+      ORCA_BACKGROUND_LAUNCH: '1'
 
     steps:
       - name: Checkout
diff --git a/.oxfmtrc.json b/.oxfmtrc.json
index 86931f1f9ec..19856d6ca84 100644
--- a/.oxfmtrc.json
+++ b/.oxfmtrc.json
@@ -6,7 +6,9 @@
   "trailingComma": "none",
   "ignorePatterns": [
     "cloud/**",
+    "resources/licenses/**",
     ".github/actions/cloud-sql-rollout-lease/**",
-    ".anti-slop-plugin/**"
+    ".anti-slop-plugin/**",
+    "src/main/runtime/__fixtures__/*.timing.json"
   ]
 }
diff --git a/.oxlintrc.json b/.oxlintrc.json
index 7de99d4461e..7a0753c06e2 100644
--- a/.oxlintrc.json
+++ b/.oxlintrc.json
@@ -143,7 +143,26 @@
     {
       "files": ["src/renderer/src/**/*.{ts,tsx}"],
       "rules": {
-        "renderer-scrollbar-style/require-styled-vertical-scrollbar": "error"
+        "renderer-scrollbar-style/require-styled-vertical-scrollbar": "error",
+        "no-restricted-properties": [
+          "error",
+          {
+            "property": "randomUUID",
+            "message": "crypto.randomUUID is missing in non-secure contexts (Remote Web over plain HTTP), which white-screens the app. Use createBrowserUuid() from '@/lib/browser-uuid'."
+          }
+        ]
+      }
+    },
+    {
+      "files": ["src/shared/**/*.ts"],
+      "rules": {
+        "no-restricted-properties": [
+          "error",
+          {
+            "property": "randomUUID",
+            "message": "src/shared is compiled into the web bundle, where crypto.randomUUID is missing in non-secure contexts (Remote Web over plain HTTP). Use createNonSecureContextUuid() from './non-secure-context-uuid', or import randomUUID from 'node:crypto' in main-only code."
+          }
+        ]
       }
     },
     {
diff --git a/Casks/orca.rb b/Casks/orca.rb
index 6b97b27d52e..1abc9b3a912 100644
--- a/Casks/orca.rb
+++ b/Casks/orca.rb
@@ -5,8 +5,7 @@ cask "orca" do
   sha256 arm:   "fc707f290ff3b631b7b7947bf339885b61a43d2e89475997c125b61268ed4966",
          intel: "5f677c13a08f7a5740442e29d388285a86488c8c1f7aa5f10a8721a2c6ede8e4"
 
-  url "https://github.com/stablyai/orca/releases/download/v#{version}/orca-macos-#{arch}.dmg",
-      verified: "github.com/stablyai/orca/"
+  url "https://github.com/stablyai/orca/releases/download/v#{version}/orca-macos-#{arch}.dmg"
   name "Orca"
   desc "IDE for orchestrating AI coding agents across terminals and worktrees"
   homepage "https://onorca.dev/"
diff --git a/Casks/orca@rc.rb b/Casks/orca@rc.rb
index 63bc843b640..08eaeeca459 100644
--- a/Casks/orca@rc.rb
+++ b/Casks/orca@rc.rb
@@ -5,8 +5,7 @@ cask "orca@rc" do
   sha256 arm:   "563b6b14323fc9d5489299c82442d514bc12cabffc9d06d3964ed572af4b3955",
          intel: "457088c7021f07de1a419197f7b2bd00092741ad4727d4fef3d86af38a6831e7"
 
-  url "https://github.com/stablyai/orca/releases/download/v#{version}/orca-macos-#{arch}.dmg",
-      verified: "github.com/stablyai/orca/"
+  url "https://github.com/stablyai/orca/releases/download/v#{version}/orca-macos-#{arch}.dmg"
   name "Orca RC"
   desc "IDE for orchestrating AI coding agents across terminals and worktrees"
   homepage "https://onorca.dev/"
diff --git a/README.md b/README.md
index 98efc301c2f..93e09614609 100644
--- a/README.md
+++ b/README.md
@@ -36,7 +36,7 @@
 
 Monitor and steer your agents from your phone — get notified when an agent finishes and send follow-ups from anywhere.
 
-[iOS App Store](https://apps.apple.com/us/app/orca-ide/id6766130217) · [TestFlight](https://testflight.apple.com/join/YjeGMQBA) · [Android APK 0.0.50](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.50/app-release.apk) · [Docs →](https://www.onorca.dev/docs/mobile)
+[iOS App Store](https://apps.apple.com/us/app/orca-ide/id6766130217) · [Android APK 0.0.50](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.50/app-release.apk) · [Docs →](https://www.onorca.dev/docs/mobile)
 
 </td>
 <td width="50%">
@@ -179,6 +179,7 @@ Works with **any CLI agent** — if it runs in a terminal, it runs in Orca.
   <a href="https://cursor.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=cursor.com&sz=64" alt="Cursor logo" width="16" valign="middle" /> Cursor</kbd></a> &nbsp;
   <a href="https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli"><kbd><img src="https://www.google.com/s2/favicons?domain=github.com&sz=64" alt="GitHub Copilot logo" width="16" valign="middle" /> GitHub Copilot</kbd></a> &nbsp;
   <a href="https://dev.meta.ai/docs/muse-code"><kbd><img src="src/shared/agent-icons/muse.png" alt="Muse logo" width="16" valign="middle" /> Muse</kbd></a> &nbsp;
+  <a href="https://deepseek-harness.github.io/deepseek-harness/"><kbd><img src="src/shared/agent-icons/dsh.png" alt="DeepSeek Harness logo" width="16" valign="middle" /> DeepSeek Harness</kbd></a> &nbsp;
   <a href="https://zcode.z.ai/en/docs"><kbd><img src="src/shared/agent-icons/zcode.png" alt="ZCode logo" width="16" valign="middle" /> ZCode</kbd></a> &nbsp;
   <a href="https://opencode.ai/docs/cli/"><kbd><img src="https://www.google.com/s2/favicons?domain=opencode.ai&sz=64" alt="OpenCode logo" width="16" valign="middle" /> OpenCode</kbd></a> &nbsp;
   <a href="https://mimo.xiaomi.com/coder"><kbd><img src="https://www.google.com/s2/favicons?domain=mimo.xiaomi.com&sz=64" alt="MiMo Code logo" width="16" valign="middle" /> MiMo Code</kbd></a> &nbsp;
@@ -194,7 +195,9 @@ Works with **any CLI agent** — if it runs in a terminal, it runs in Orca.
   <a href="https://github.com/autohandai/code-cli"><kbd><img src="https://www.google.com/s2/favicons?domain=autohand.ai&sz=64" alt="Autohand Code logo" width="16" valign="middle" /> Autohand Code</kbd></a> &nbsp;
   <a href="https://github.com/charmbracelet/crush"><kbd><img src="https://www.google.com/s2/favicons?domain=charm.sh&sz=64" alt="Charm logo" width="16" valign="middle" /> Charm</kbd></a> &nbsp;
   <a href="https://docs.cline.bot/cline-cli/overview"><kbd><img src="https://www.google.com/s2/favicons?domain=cline.bot&sz=64" alt="Cline logo" width="16" valign="middle" /> Cline</kbd></a> &nbsp;
+  <a href="https://www.codebuddy.ai/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=codebuddy.ai&sz=64" alt="CodeBuddy logo" width="16" valign="middle" /> CodeBuddy</kbd></a> &nbsp;
   <a href="https://www.codebuff.com/docs/help/quick-start"><kbd><img src="https://www.google.com/s2/favicons?domain=codebuff.com&sz=64" alt="Codebuff logo" width="16" valign="middle" /> Codebuff</kbd></a> &nbsp;
+  <a href="https://freebuff.com"><kbd><img src="src/shared/agent-icons/freebuff.png" alt="Freebuff logo" width="16" valign="middle" /> Freebuff</kbd></a> &nbsp;
   <a href="https://commandcode.ai/docs/quickstart"><kbd><img src="https://www.google.com/s2/favicons?domain=commandcode.ai&sz=64" alt="Command Code logo" width="16" valign="middle" /> Command Code</kbd></a> &nbsp;
   <a href="https://docs.continue.dev/guides/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=continue.dev&sz=64" alt="Continue logo" width="16" valign="middle" /> Continue</kbd></a> &nbsp;
   <a href="https://docs.factory.ai/cli/getting-started/quickstart"><kbd><img src="docs/assets/droid-logo.svg" alt="Droid logo" width="16" valign="middle" /> Droid</kbd></a> &nbsp;
@@ -231,7 +234,7 @@ yay -S stably-orca-bin
 
 Pair with your desktop app to monitor and steer your agents from your phone.
 
-- **iOS:** [Download on the App Store](https://apps.apple.com/us/app/orca-ide/id6766130217) or [join TestFlight](https://testflight.apple.com/join/YjeGMQBA)
+- **iOS:** [Download on the App Store](https://apps.apple.com/us/app/orca-ide/id6766130217)
 - **Android:** [Download APK 0.0.50](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.50/app-release.apk) · [Install guide](https://www.onorca.dev/docs/android-apk)
 
 ---
diff --git a/cloud/apps/push/src/durable-push-claim.test.ts b/cloud/apps/push/src/durable-push-claim.test.ts
index f43588bd2c3..c7a228a0559 100644
--- a/cloud/apps/push/src/durable-push-claim.test.ts
+++ b/cloud/apps/push/src/durable-push-claim.test.ts
@@ -157,7 +157,7 @@ it('keeps claim, exclusion and prune correct without the queue index', async ()
   for (const claim of leased) await store.finish(claim)
   expect((await store.claim())?.notification.notificationSeq).toBe(2)
   advance(10 * 60_000)
-  expect(await store.prune()).toBe(1)
+  expect(await store.prune()).toEqual({ deleted: 1, saturated: false })
   expect(await batchCount(db)).toBe(0)
 })
 
@@ -211,11 +211,11 @@ it('prunes a large backlog in bounded calls without touching live or leased work
     [JSON.stringify(notification(9)), now - 1, now - 1, now + 1000, now - 1]
   )
   await store.accept('host', 'phone-live', notification(1))
-  expect(await store.prune()).toBe(perCall)
-  expect(await store.prune()).toBe(500)
-  expect(await store.prune()).toBe(0)
+  expect(await store.prune()).toEqual({ deleted: perCall, saturated: true })
+  expect(await store.prune()).toEqual({ deleted: 500, saturated: false })
+  expect(await store.prune()).toEqual({ deleted: 0, saturated: false })
   advance(1000)
-  expect(await store.prune()).toBe(1)
+  expect(await store.prune()).toEqual({ deleted: 1, saturated: false })
   expect(await batchCount(db)).toBe(1)
   expect(await store.pendingCount('phone-live')).toBe(1)
 })
diff --git a/cloud/apps/push/src/durable-push-store.ts b/cloud/apps/push/src/durable-push-store.ts
index 61fed235018..02d26f20b3e 100644
--- a/cloud/apps/push/src/durable-push-store.ts
+++ b/cloud/apps/push/src/durable-push-store.ts
@@ -12,6 +12,8 @@ const CLAIM_CANDIDATE_ATTEMPTS = 4
 export const PRUNE_BATCH_ROWS = 2_000
 export const PRUNE_MAX_BATCHES = 50
 export const DELIVERY_LEASE_MS = 30_000
+// `saturated` means the batch budget ran out with rows still matching, so a backlog remains.
+export type PushPruneSweep = { deleted: number; saturated: boolean }
 export type QueuedPushDelivery = {
   id: string
   registrationId: string
@@ -200,10 +202,10 @@ export class DurablePushStore {
   }
 
   // Bounded per call and per statement, so it drains any backlog on its own without holding locks.
-  async prune(): Promise<number> {
+  async prune(): Promise<PushPruneSweep> {
     const now = this.now()
     // Also clears terminal rows older revisions kept, since each carries a past expires_at.
-    let deleted = await this.deleteInBatches(
+    let { deleted, saturated } = await this.deleteInBatches(
       'push_delivery_batches',
       'batch_id',
       'expires_at <= ? AND lease_until <= ?',
@@ -215,9 +217,11 @@ export class DurablePushStore {
       ['push_event_recipients', 'event_id, registration_id'],
       ['push_events', 'event_id']
     ] as const) {
-      deleted += await this.deleteInBatches(table, key, 'created_at < ?', [now - RETENTION_MS])
+      const sweep = await this.deleteInBatches(table, key, 'created_at < ?', [now - RETENTION_MS])
+      deleted += sweep.deleted
+      saturated ||= sweep.saturated
     }
-    return deleted
+    return { deleted, saturated }
   }
 
   private async deleteInBatches(
@@ -225,7 +229,7 @@ export class DurablePushStore {
     key: string,
     where: string,
     params: unknown[]
-  ): Promise<number> {
+  ): Promise<PushPruneSweep> {
     const lockRows = this.background.dialect === 'postgres' ? ' FOR UPDATE SKIP LOCKED' : ''
     let total = 0
     for (let batch = 0; batch < PRUNE_MAX_BATCHES; batch++) {
@@ -235,8 +239,9 @@ export class DurablePushStore {
       )
       const changes = Number(result?.changes ?? 0)
       total += changes
-      if (changes < PRUNE_BATCH_ROWS) break
+      // A short batch drained the predicate; only a full last batch leaves rows behind.
+      if (changes < PRUNE_BATCH_ROWS) return { deleted: total, saturated: false }
     }
-    return total
+    return { deleted: total, saturated: true }
   }
 }
diff --git a/cloud/apps/push/src/push-background.test.ts b/cloud/apps/push/src/push-background.test.ts
new file mode 100644
index 00000000000..21598ef67a2
--- /dev/null
+++ b/cloud/apps/push/src/push-background.test.ts
@@ -0,0 +1,174 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import { startPushBackground } from './push-background.js'
+import { createPushServerHarness } from './push-server-harness.test-fixture.js'
+import { reserveRequestConnection } from './push-background-database.js'
+import { DurablePushStore, PRUNE_BATCH_ROWS, type PushPruneSweep } from './durable-push-store.js'
+import type { PushDatabase } from './push-database.js'
+
+const cleanups: (() => Promise<void>)[] = []
+afterEach(async () => {
+  for (const cleanup of cleanups.splice(0)) await cleanup()
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+})
+
+async function fixture(mode: 'active' | 'validation' = 'active') {
+  const harness = await createPushServerHarness()
+  const runtime = harness.server
+  const challenges = vi.spyOn(runtime.challenges, 'pruneExpired').mockResolvedValue(0)
+  const sessions = vi.spyOn(runtime.sessions, 'pruneExpired').mockResolvedValue(0)
+  const deliveries = vi
+    .spyOn(runtime.deliveryStore, 'prune')
+    .mockResolvedValue({ deleted: 0, saturated: false })
+  vi.spyOn(runtime.worker, 'start').mockImplementation(() => {})
+  const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+  vi.useFakeTimers()
+  const stop = startPushBackground({ mode }, runtime)
+  cleanups.push(async () => {
+    await stop()
+    await harness.close()
+  })
+  return { stop, challenges, sessions, deliveries, warn }
+}
+
+it('keeps one slow sweep per store while other stores keep their cadence', async () => {
+  const h = await fixture()
+  let finish!: (sweep: PushPruneSweep) => void
+  h.deliveries.mockImplementationOnce(
+    () => new Promise<PushPruneSweep>((resolve) => (finish = resolve))
+  )
+  try {
+    await vi.advanceTimersByTimeAsync(10 * 60_000)
+    expect(h.deliveries).toHaveBeenCalledTimes(1)
+    expect(h.challenges).toHaveBeenCalledTimes(10)
+    expect(h.sessions).toHaveBeenCalledTimes(1)
+  } finally {
+    finish({ deleted: 100_000, saturated: false })
+  }
+  await vi.advanceTimersByTimeAsync(60_000)
+  expect(h.deliveries).toHaveBeenCalledTimes(2)
+  await h.stop()
+  await vi.advanceTimersByTimeAsync(10 * 60_000)
+  expect(h.deliveries).toHaveBeenCalledTimes(2)
+  expect(h.challenges).toHaveBeenCalledTimes(11)
+  expect(h.sessions).toHaveBeenCalledTimes(1)
+})
+
+it('reports a sweep that is still running a full interval after it started', async () => {
+  const h = await fixture()
+  let finish!: (sweep: PushPruneSweep) => void
+  h.deliveries.mockImplementationOnce(
+    () => new Promise<PushPruneSweep>((resolve) => (finish = resolve))
+  )
+  try {
+    await vi.advanceTimersByTimeAsync(119_999)
+    expect(h.warn).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(1)
+    expect(h.warn).toHaveBeenCalledWith(
+      JSON.stringify({ event: 'orca_push_prune_overdue', target: 'deliveries' })
+    )
+  } finally {
+    finish({ deleted: 0, saturated: false })
+  }
+  // One report per sweep: the settled sweep clears its own watchdog.
+  await vi.advanceTimersByTimeAsync(10 * 60_000)
+  expect(h.warn).toHaveBeenCalledTimes(1)
+})
+
+it('releases a failed sweep so the next scheduled sweep can recover', async () => {
+  const h = await fixture()
+  h.deliveries.mockRejectedValueOnce(new Error('database unavailable'))
+  await vi.advanceTimersByTimeAsync(60_000)
+  expect(h.deliveries).toHaveBeenCalledTimes(1)
+  expect(h.warn).toHaveBeenCalledWith(
+    JSON.stringify({ event: 'orca_push_prune_failed', target: 'deliveries', error: 'Error' })
+  )
+  await vi.advanceTimersByTimeAsync(60_000)
+  expect(h.deliveries).toHaveBeenCalledTimes(2)
+  expect(h.warn).toHaveBeenCalledTimes(1)
+})
+
+it('resumes a saturated sweep at once rather than waiting out the interval', async () => {
+  const h = await fixture()
+  let backlogSweeps = 3
+  h.deliveries.mockImplementation(async () => {
+    const saturated = backlogSweeps-- > 0
+    return { deleted: saturated ? PRUNE_BATCH_ROWS : 0, saturated }
+  })
+  await vi.advanceTimersByTimeAsync(60_000)
+  expect(h.deliveries).toHaveBeenCalledTimes(1)
+  // Three saturated sweeps resume within milliseconds instead of costing an interval each.
+  await vi.advanceTimersByTimeAsync(10)
+  expect(h.deliveries).toHaveBeenCalledTimes(4)
+  await vi.advanceTimersByTimeAsync(59_000)
+  expect(h.deliveries).toHaveBeenCalledTimes(4)
+  await vi.advanceTimersByTimeAsync(1_000)
+  expect(h.deliveries).toHaveBeenCalledTimes(5)
+})
+
+it('keeps a delivery claim behind one statement while a backlog drains back to back', async () => {
+  const h = await fixture()
+  let backlog = true
+  let finishedDeletes = 0
+  const database: PushDatabase = {
+    dialect: 'postgres',
+    query: async (sql) => {
+      if (!sql.startsWith('DELETE')) return []
+      await new Promise((resolve) => setTimeout(resolve, 4_000))
+      finishedDeletes++
+      // Only deliveries hold a backlog, so each sweep spends its whole budget there and returns.
+      if (!backlog || !sql.includes('push_delivery_batches')) return [{ changes: 0 }]
+      return [{ changes: PRUNE_BATCH_ROWS }]
+    },
+    transaction: (operation) => operation(database),
+    lockQuotaScope: async () => {},
+    tryLockScope: async () => true,
+    tryLockSharedScope: async () => true,
+    close: async () => {}
+  }
+  const store = new DurablePushStore(database, Date.now, reserveRequestConnection(database, 2))
+  const sweeps: Promise<PushPruneSweep>[] = []
+  let inFlight = 0
+  let concurrentSweeps = 0
+  h.deliveries.mockImplementation(() => {
+    concurrentSweeps = Math.max(concurrentSweeps, ++inFlight)
+    const sweep = store.prune().finally(() => void inFlight--)
+    sweeps.push(sweep)
+    return sweep
+  })
+  try {
+    await vi.advanceTimersByTimeAsync(10 * 60_000)
+    const queuedAt = finishedDeletes
+    const startedAt = Date.now()
+    let statementsAhead: number | undefined
+    let claimDelay: number | undefined
+    const claim = store.claim().then(() => {
+      statementsAhead = finishedDeletes - queuedAt
+      claimDelay = Date.now() - startedAt
+    })
+    await vi.advanceTimersByTimeAsync(44_000)
+    await claim
+    // Sweeping serially parks one statement ahead of the claim no matter how long the drain runs.
+    expect({ statementsAhead, concurrentSweeps }).toEqual({
+      statementsAhead: 1,
+      concurrentSweeps: 1
+    })
+    expect(claimDelay).toBeLessThanOrEqual(4_000)
+    // Each sweep exhausts its 50-batch budget, so the drain continues instead of idling out the tick.
+    expect(sweeps.length).toBeGreaterThan(1)
+  } finally {
+    await h.stop()
+    backlog = false
+    await vi.advanceTimersByTimeAsync(10 * 60_000)
+    await Promise.all(sweeps)
+  }
+})
+
+it('keeps validation mode free of sweeps and timers', async () => {
+  const h = await fixture('validation')
+  await vi.advanceTimersByTimeAsync(20 * 60_000)
+  expect(h.challenges).not.toHaveBeenCalled()
+  expect(h.sessions).not.toHaveBeenCalled()
+  expect(h.deliveries).not.toHaveBeenCalled()
+  expect(vi.getTimerCount()).toBe(0)
+})
diff --git a/cloud/apps/push/src/push-background.ts b/cloud/apps/push/src/push-background.ts
index 8925fd41fed..9fad4700e7b 100644
--- a/cloud/apps/push/src/push-background.ts
+++ b/cloud/apps/push/src/push-background.ts
@@ -1,26 +1,55 @@
 import type { PushConfig } from './config.js'
+import type { PushPruneSweep } from './durable-push-store.js'
 import type { createPushServer } from './push-server.js'
 
 const CHALLENGE_PRUNE_INTERVAL_MS = 60_000
 const SESSION_PRUNE_INTERVAL_MS = 10 * 60_000
 const DELIVERY_PRUNE_INTERVAL_MS = 60_000
 
-function prune(label: string, run: () => Promise<number>, intervalMs: number): NodeJS.Timeout {
-  const timer = setInterval(() => {
-    void run().catch((error: unknown) => {
-      console.warn(
-        JSON.stringify({
-          event: 'orca_push_prune_failed',
-          target: label,
-          error: error instanceof Error ? error.name : 'unknown'
-        })
-      )
-    })
-  }, intervalMs)
-  timer.unref()
-  return timer
+// Chained rather than periodic, so a sweep spanning many bounded statements never overlaps itself and
+// one that exhausted its batch budget resumes at once instead of idling out the rest of the interval.
+function prune(label: string, run: () => Promise<PushPruneSweep>, intervalMs: number): () => void {
+  let timer: NodeJS.Timeout | undefined
+  let overdue: NodeJS.Timeout | undefined
+  let stopped = false
+  function schedule(delayMs: number): void {
+    if (stopped) return
+    timer = setTimeout(tick, delayMs)
+    timer.unref()
+  }
+  function tick(): void {
+    // Admission waits are untimed, so a lost slot release would otherwise stall retention silently.
+    overdue = setTimeout(() => {
+      console.warn(JSON.stringify({ event: 'orca_push_prune_overdue', target: label }))
+    }, intervalMs)
+    overdue.unref()
+    void run()
+      .then((sweep) => schedule(sweep.saturated ? 0 : intervalMs))
+      .catch((error: unknown) => {
+        console.warn(
+          JSON.stringify({
+            event: 'orca_push_prune_failed',
+            target: label,
+            error: error instanceof Error ? error.name : 'unknown'
+          })
+        )
+        schedule(intervalMs)
+      })
+      .finally(() => clearTimeout(overdue))
+  }
+  schedule(intervalMs)
+  return () => {
+    stopped = true
+    clearTimeout(timer)
+    clearTimeout(overdue)
+  }
 }
 
+// One DELETE under a statement timeout: there is no batch budget for it to exhaust.
+const unbatchedSweep =
+  (run: () => Promise<number>) =>
+  async (): Promise<PushPruneSweep> => ({ deleted: await run(), saturated: false })
+
 export function startPushBackground(
   config: Pick<PushConfig, 'mode'>,
   runtime: Pick<
@@ -30,14 +59,22 @@ export function startPushBackground(
 ): () => Promise<void> {
   if (config.mode === 'validation') return async () => {}
   const { challenges, sessions, deliveryStore, worker } = runtime
-  const timers = [
-    prune('challenges', () => challenges.pruneExpired(), CHALLENGE_PRUNE_INTERVAL_MS),
-    prune('sessions', () => sessions.pruneExpired(), SESSION_PRUNE_INTERVAL_MS),
+  const stops = [
+    prune(
+      'challenges',
+      unbatchedSweep(() => challenges.pruneExpired()),
+      CHALLENGE_PRUNE_INTERVAL_MS
+    ),
+    prune(
+      'sessions',
+      unbatchedSweep(() => sessions.pruneExpired()),
+      SESSION_PRUNE_INTERVAL_MS
+    ),
     prune('deliveries', () => deliveryStore.prune(), DELIVERY_PRUNE_INTERVAL_MS)
   ]
   worker.start()
   return async () => {
-    for (const timer of timers) clearInterval(timer)
+    for (const stop of stops) stop()
     await worker.stop()
   }
 }
diff --git a/cloud/apps/push/src/push-database.ts b/cloud/apps/push/src/push-database.ts
index b1a7415297b..9957a7c28b5 100644
--- a/cloud/apps/push/src/push-database.ts
+++ b/cloud/apps/push/src/push-database.ts
@@ -85,15 +85,17 @@ class SqliteDatabase extends SqliteTransaction {
     let release!: () => void
     this.tail = new Promise((resolve) => (release = resolve))
     await previous
-    this.database.exec('BEGIN IMMEDIATE')
-    const transaction = new SqliteTransaction(this.database)
     try {
-      const result = await operation(transaction)
-      this.database.exec('COMMIT')
-      return result
-    } catch (error) {
-      this.database.exec('ROLLBACK')
-      throw error
+      this.database.exec('BEGIN IMMEDIATE')
+      const transaction = new SqliteTransaction(this.database)
+      try {
+        const result = await operation(transaction)
+        this.database.exec('COMMIT')
+        return result
+      } catch (error) {
+        this.database.exec('ROLLBACK')
+        throw error
+      }
     } finally {
       release()
     }
diff --git a/cloud/apps/push/src/sqlite-transaction-queue.test.ts b/cloud/apps/push/src/sqlite-transaction-queue.test.ts
new file mode 100644
index 00000000000..1ee5e8b3d52
--- /dev/null
+++ b/cloud/apps/push/src/sqlite-transaction-queue.test.ts
@@ -0,0 +1,101 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { DatabaseSync } from 'node:sqlite'
+import { setImmediate } from 'node:timers/promises'
+import { expect, it, vi } from 'vitest'
+import { openPushDatabase } from './push-database.js'
+
+it('releases queued work and close after a SQLite transaction cannot acquire its lock', async () => {
+  const dataDir = mkdtempSync(join(tmpdir(), 'orca-push-sqlite-queue-'))
+  let connection: DatabaseSync | undefined
+  const prepare = DatabaseSync.prototype.prepare
+  // Keep the native handle reachable for cleanup even if a queue regression strands close().
+  const capture = vi
+    .spyOn(DatabaseSync.prototype, 'prepare')
+    .mockImplementation(function (this: DatabaseSync, sql) {
+      connection = this
+      return prepare.call(this, sql)
+    })
+  const database = await openPushDatabase({ dataDir })
+  capture.mockRestore()
+  const blocker = new DatabaseSync(join(dataDir, 'orca-push.sqlite'))
+  try {
+    await database.query('CREATE TABLE queue_progress (value INTEGER)')
+    await database.query('INSERT INTO queue_progress VALUES (0)')
+    blocker.exec('BEGIN IMMEDIATE')
+    const operation = vi.fn(async () => undefined)
+    await expect(database.transaction(operation)).rejects.toThrow('database is locked')
+    let lockFailures = 0
+    const blocked = Array.from({ length: 5 }, () =>
+      database.transaction(operation).catch(() => {
+        lockFailures += 1
+      })
+    )
+    await setImmediate()
+    expect(lockFailures).toBe(5)
+    await Promise.all(blocked)
+    expect(operation).not.toHaveBeenCalled()
+    blocker.exec('ROLLBACK')
+    let completed = 0
+    const pending = Array.from({ length: 100 }, () =>
+      database.transaction(async (transaction) => {
+        await transaction.query('UPDATE queue_progress SET value = value + 1')
+        completed += 1
+      })
+    )
+    for (const request of pending) void request.catch(() => undefined)
+    await setImmediate()
+    expect(completed).toBe(100)
+    await Promise.all(pending)
+    expect(await database.query('SELECT value FROM queue_progress')).toEqual([{ value: 100 }])
+    let closed = false
+    const closing = database.close().then(() => {
+      closed = true
+    })
+    await setImmediate()
+    expect(closed).toBe(true)
+    await closing
+  } finally {
+    capture.mockRestore()
+    blocker.close()
+    if (connection?.isOpen) connection.close()
+    rmSync(dataDir, { recursive: true, force: true })
+  }
+})
+
+it('does not roll back a transaction when BEGIN failed before taking ownership', async () => {
+  const dataDir = mkdtempSync(join(tmpdir(), 'orca-push-sqlite-owner-'))
+  let connection: DatabaseSync | undefined
+  const prepare = DatabaseSync.prototype.prepare
+  const capture = vi
+    .spyOn(DatabaseSync.prototype, 'prepare')
+    .mockImplementation(function (this: DatabaseSync, sql) {
+      connection = this
+      return prepare.call(this, sql)
+    })
+  const database = await openPushDatabase({ dataDir })
+  capture.mockRestore()
+  try {
+    await database.query('CREATE TABLE queue_owner (value INTEGER)')
+    await database.query('BEGIN IMMEDIATE')
+    await database.query('INSERT INTO queue_owner VALUES (7)')
+    await expect(database.transaction(async () => undefined)).rejects.toThrow(
+      'cannot start a transaction within a transaction'
+    )
+    expect(connection?.isTransaction).toBe(true)
+    let rows: unknown
+    void database.query('SELECT value FROM queue_owner').then((result) => {
+      rows = result
+    })
+    await setImmediate()
+    expect(rows).toEqual([{ value: 7 }])
+    await database.query('ROLLBACK')
+    expect(await database.query('SELECT value FROM queue_owner')).toEqual([])
+    await database.close()
+  } finally {
+    capture.mockRestore()
+    if (connection?.isOpen) connection.close()
+    rmSync(dataDir, { recursive: true, force: true })
+  }
+})
diff --git a/cloud/apps/relay/src/assignment-headroom-scope.test.ts b/cloud/apps/relay/src/assignment-headroom-scope.test.ts
new file mode 100644
index 00000000000..9862849d8e0
--- /dev/null
+++ b/cloud/apps/relay/src/assignment-headroom-scope.test.ts
@@ -0,0 +1,129 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import { RelayAssignmentStore } from './assignment-store.js'
+import { openInMemoryRelayDatabase, type RelayDatabase } from './database.js'
+
+const NOW = 100_000
+const CELL_COUNT = 32
+const identity = { userId: 'headroom-user', relayHostId: 'headroomhost0001' }
+
+function observeHeadroom(database: RelayDatabase, rowCounts: number[]): RelayDatabase {
+  return {
+    dialect: database.dialect,
+    async query(sql, params) {
+      const rows = await database.query(sql, params)
+      if (sql.includes('FROM relay_cell_connection_limits limits')) rowCounts.push(rows.length)
+      return rows
+    },
+    queryLocked: (sql, params, options) => database.queryLocked(sql, params, options),
+    transaction: (operation, options) =>
+      database.transaction((transaction) => operation(observeHeadroom(transaction, rowCounts)), options),
+    close: () => database.close()
+  }
+}
+
+describe('assignment headroom query scope', () => {
+  let database: RelayDatabase | undefined
+  afterEach(async () => await database?.close())
+
+  async function setup() {
+    database = await openInMemoryRelayDatabase()
+    const rowCounts: number[] = []
+    const store = new RelayAssignmentStore(observeHeadroom(database, rowCounts), () => NOW, {
+      requireLiveCells: true,
+      heartbeatTtlMs: 45_000
+    })
+    const cells = Array.from({ length: CELL_COUNT }, (_, index) => ({
+      id: `cell-${String(index).padStart(2, '0')}`,
+      url: `https://cell-${index}.example.com`,
+      capacityRequests: 1_000,
+      connectionHardCap: 600 as const,
+      connectionUnobservedBound: 50
+    }))
+    await store.reconcileCells(cells)
+    for (const cell of cells) {
+      await store.recordCellHeartbeat({
+        cellId: cell.id,
+        cellUrl: cell.url,
+        cellIncarnation: '11111111-1111-4111-8111-111111111111',
+        startedAt: NOW - 10,
+        ready: true,
+        observedRequests: 0,
+        totalConnections: 0,
+        inFlightConnections: 0,
+        reservedConnectionUnits: 0,
+        enforcedConnectionUnits: 0,
+        connectionHardCap: 600,
+        connectionUnobservedBound: 50
+      })
+    }
+    await database.query(
+      `INSERT INTO relay_assignments
+       (user_id, relay_host_id, cell_id, assignment_epoch, lease_expires_at,
+        last_activity_at, reserved_controls, reserved_splices, reserved_invites,
+        pending_installs, pending_confirmations, migration_leases)
+       VALUES (?, ?, 'cell-00', 1, ?, ?, 0, 0, 0, 0, 0, 0)`,
+      [identity.userId, identity.relayHostId, NOW + 90_000, NOW]
+    )
+    await store.acquireActivity(identity, {
+      activityId: 'existing-splice',
+      kind: 'splice',
+      cellId: 'cell-00'
+    })
+    rowCounts.length = 0
+    return { store, rowCounts, database }
+  }
+
+  it('reads one cell for a sticky assignment even when the capped fleet grows', async () => {
+    const { store, rowCounts } = await setup()
+    await expect(store.assign(identity)).resolves.toMatchObject({
+      ...identity,
+      cellId: 'cell-00',
+      assignmentEpoch: 1
+    })
+    console.info('sticky headroom rows', { fleetCells: CELL_COUNT, rowCounts })
+    expect(rowCounts).toEqual([1])
+  })
+
+  it('still considers the full fleet for a new placement', async () => {
+    const { store, rowCounts } = await setup()
+    await expect(
+      store.assign({ userId: 'new-user', relayHostId: 'newheadroomhost1' })
+    ).resolves.toMatchObject({ cellId: 'cell-01', assignmentEpoch: 1 })
+    expect(rowCounts).toEqual([CELL_COUNT])
+  })
+
+  it.each([
+    ['missing snapshot', `DELETE FROM relay_cell_connection_snapshots WHERE cell_id = 'cell-00'`],
+    ['expired snapshot', `UPDATE relay_cell_connection_snapshots SET snapshot_at = ${NOW - 45_000} WHERE cell_id = 'cell-00'`],
+    ['old incarnation', `UPDATE relay_cell_connection_snapshots SET cell_incarnation = 'old' WHERE cell_id = 'cell-00'`],
+    ['capacity boundary', `UPDATE relay_cell_connection_snapshots SET enforced_connection_units = 450 WHERE cell_id = 'cell-00'`]
+  ])('rejects the pinned active host with %s', async (_name, sql) => {
+    const { store, database } = await setup()
+    await database.query(sql)
+    await expect(store.assign(identity)).rejects.toThrow('relay_connection_headroom_exhausted')
+  })
+
+  it('preserves admission for cells without a connection limit', async () => {
+    const { store, rowCounts, database } = await setup()
+    await database.query(`DELETE FROM relay_cell_connection_limits WHERE cell_id = 'cell-00'`)
+    await expect(store.assign(identity)).resolves.toMatchObject({ cellId: 'cell-00' })
+    expect(rowCounts).toEqual([0])
+  })
+
+  it('counts outstanding reservations at the admission boundary', async () => {
+    const { store, database } = await setup()
+    await database.query(
+      `UPDATE relay_cell_connection_snapshots SET enforced_connection_units = 449
+       WHERE cell_id = 'cell-00'`
+    )
+    await database.query(
+      `INSERT INTO relay_control_connection_reservations
+       (reservation_id, idempotency_key, user_id, relay_host_id, assignment_epoch,
+        cell_id, state, created_at, timeout_at, updated_at)
+       VALUES ('pending', 'pending', 'other-user', 'other-host', 1,
+        'cell-00', 'reserved', ?, ?, ?)`,
+      [NOW, NOW + 90_000, NOW]
+    )
+    await expect(store.assign(identity)).rejects.toThrow('relay_connection_headroom_exhausted')
+  })
+})
diff --git a/cloud/apps/relay/src/assignment-store.ts b/cloud/apps/relay/src/assignment-store.ts
index 3cb5dcfeee9..9a5cd9d4165 100644
--- a/cloud/apps/relay/src/assignment-store.ts
+++ b/cloud/apps/relay/src/assignment-store.ts
@@ -7466,10 +7466,16 @@ export class RelayAssignmentStore {
   }
 
   private async connectionHeadroomByCell(
-    database: RelayDatabase
+    database: RelayDatabase,
+    cellId?: string
   ): Promise<Map<string, boolean>> {
     const now = this.now()
-    const rows = await database.query(ASSIGNMENT_CONNECTION_HEADROOM_QUERY)
+    const rows = await database.query(
+      cellId === undefined
+        ? ASSIGNMENT_CONNECTION_HEADROOM_QUERY
+        : `${ASSIGNMENT_CONNECTION_HEADROOM_QUERY} WHERE limits.cell_id = ?`,
+      cellId === undefined ? [] : [cellId]
+    )
     return new Map(
       rows.map((row) => {
         const heartbeat = optionalInteger(row, 'last_heartbeat_at')
@@ -7503,7 +7509,7 @@ export class RelayAssignmentStore {
     database: RelayDatabase,
     cellId: string
   ): Promise<boolean> {
-    return (await this.connectionHeadroomByCell(database)).get(cellId) !== false
+    return (await this.connectionHeadroomByCell(database, cellId)).get(cellId) !== false
   }
 
   private async cellIsLive(
@@ -8476,7 +8482,7 @@ function isDatabaseLockUnavailable(error: unknown): boolean {
   return error instanceof Error && error.message === 'database_lock_unavailable'
 }
 
-export function cellInventoryLockOptions(mode: CellInventoryLockMode): RelayLockOptions {
+function cellInventoryLockOptions(mode: CellInventoryLockMode): RelayLockOptions {
   if (mode === 'nowait') return { failIfUnavailable: true, measureHoldMs: true }
   if (mode === 'pool-default') return { measureHoldMs: true }
   return { lockTimeoutMs: CELL_INVENTORY_LOCK_TIMEOUT_MS, measureHoldMs: true }
diff --git a/cloud/apps/relay/src/cell-inventory-lock-census.test.ts b/cloud/apps/relay/src/cell-inventory-lock-census.test.ts
deleted file mode 100644
index e26d8d0551e..00000000000
--- a/cloud/apps/relay/src/cell-inventory-lock-census.test.ts
+++ /dev/null
@@ -1,335 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { describe, expect, it } from 'vitest'
-import { cellInventoryLockOptions, type CellInventoryLockMode } from './assignment-store.js'
-
-// Which entry points can reach a call site. A site a sweep can enter must never
-// take the bounded wait: its 55P03 becomes a terminal transaction failure, and
-// the incident monitor freezes on a single one.
-type Reachability = 'request' | 'sweep' | 'both' | 'orphan'
-
-// 'caller' is not a CellInventoryLockMode: those sites take the mode threaded
-// from `assign`, which is 'request' for a client and 'pool-default' for the
-// evacuateDeadCells sweep.
-type CensusMode = CellInventoryLockMode | 'caller'
-
-type CensusEntry = { method: string; mode: CensusMode; reach: Reachability }
-
-// Every lockCellInventory / lockGeneralCellInventory call site in
-// assignment-store.ts, in source order. A new site fails this test until it is
-// classified here, which is the point.
-const CENSUS: CensusEntry[] = [
-  // assignStickyOnce is gone from this list: its retry now locks only the row
-  // the host is pinned to (lockCellRows), which is what a sticky refresh
-  // touches. Placement below is the one genuinely fleet-wide decision left.
-  { method: 'assignOnce', mode: 'caller', reach: 'both' },
-  { method: 'assignOnce', mode: 'caller', reach: 'both' },
-  { method: 'assignOnce', mode: 'nowait', reach: 'both' },
-  { method: 'assignOnce', mode: 'nowait', reach: 'both' },
-  { method: 'assignOnce', mode: 'nowait', reach: 'both' },
-  { method: 'refreshDrainMigrationLeasesOnce', mode: 'request', reach: 'request' },
-  // changeActivity, acquireActivity, activateControl and
-  // removeSupersededSameCellControls no longer take the inventory: they lock
-  // only the one or two cell rows they touch, in cell_id order (lockCellRows),
-  // so they cannot cycle with placement's ordered inventory lock, and the
-  // 23-row lock there had serialised every reconnect in the fleet behind every
-  // other one. The control accept path went one step further and takes no cell
-  // read lock at all: its single conditional write is the last statement before
-  // COMMIT.
-  { method: 'startEvacuation', mode: 'request', reach: 'request' },
-  { method: 'completeEvacuationFromDeadSourceOnce', mode: 'request', reach: 'request' },
-  { method: 'completeEvacuationFromDeadSourceOnce', mode: 'nowait', reach: 'request' },
-  { method: 'supersedeRegisteredEvacuationOnce', mode: 'request', reach: 'request' },
-  { method: 'supersedeRegisteredEvacuationOnce', mode: 'nowait', reach: 'request' },
-  { method: 'prepareRegisteredCellSupersession', mode: 'request', reach: 'request' },
-  { method: 'prepareRegisteredCellSupersession', mode: 'request', reach: 'request' },
-  { method: 'completeEvacuation', mode: 'nowait', reach: 'both' },
-  { method: 'completeEvacuation', mode: 'pool-default', reach: 'both' },
-  { method: 'rebalanceDormant', mode: 'request', reach: 'request' },
-  // startRegionalRehomeCandidate is gone: the rehome commit reads the inventory
-  // unlocked and locks only its target row, NOWAIT, as the statement before
-  // COMMIT (reserveRegionalRehomeTargetRow below).
-  { method: 'completeRegionalRehomeCandidate', mode: 'nowait', reach: 'sweep' },
-  // Both regional-rehome abort sweeps share this rollback; only the 24-hour
-  // one also disables the durable switch.
-  { method: 'rollBackStalledRegionalRehomes', mode: 'nowait', reach: 'sweep' },
-  { method: 'abortExpiredEvacuations', mode: 'nowait', reach: 'sweep' },
-  { method: 'abortExpiredEvacuations', mode: 'nowait', reach: 'sweep' },
-  { method: 'releaseExpiredActivityLeases', mode: 'nowait', reach: 'sweep' },
-  { method: 'releaseExpiredActivity', mode: 'nowait', reach: 'sweep' }
-  // reconcileReservationAccounting and leastLoadedCell are gone too: the first
-  // repairs exactly two cells' counters and now holds only those rows, and the
-  // second selects from the inventory its single caller has already locked.
-]
-
-// Every inline `FROM relay_cells ... FOR UPDATE` outside the named lock helpers,
-// in source order: whole-table locks in reconciliation and sticky placement,
-// and single-row locks for a cell the method is already scoped to (heartbeat,
-// fence, drain generation, configuration, or a reservation adjust that runs
-// under a lock its caller already holds). A new inline lock fails the census
-// below until it is listed here; per-connection paths that touch more than one
-// cell go through lockCellRows so the order is fixed.
-const NAMED_LOCK_HELPERS = ['lockCellInventory', 'lockGeneralCellInventory', 'lockCellRows']
-
-const INLINE_CELL_LOCK_SITES = [
-  'reconcileCellsWithOptions',
-  'assignStickyOnce',
-  'recordCellHeartbeat',
-  'attestCellFence',
-  'adoptLegacyCellFence',
-  'commitLegacyCellFenceAdoption',
-  'prepareCellFenceAttempt',
-  'attestCellFenceAttempt',
-  'attestCellFenceAttempt',
-  'configureCell',
-  'reserveRegionalRehomeTargetRow',
-  'assertDrainCellGeneration',
-  'adjustCellReservation'
-]
-
-// The background sweeps, and nothing else. A method reachable from one of these
-// can be entered by a sweep tick, whatever else can also enter it. Both lists are
-// read from source, so a new sweep step or a new route widens the derivation here
-// instead of silently widening what a bounded wait can be entered from.
-const SWEEP_ENTRY_FILES = ['./assignment-cleanup-steps.ts', './regional-rehome-worker.ts']
-const REQUEST_ENTRY_FILES = [
-  './app.ts',
-  './relay-server.ts',
-  './host-session-registry.ts',
-  './cell-admission-startup.ts'
-]
-
-const DECLARATION = /^ {2}(?:private |public )?(?:static )?(?:async )?([A-Za-z_][\w]*)[(<]/
-
-function storeSource(): string[] {
-  return readFileSync(new URL('./assignment-store.ts', import.meta.url), 'utf8').split('\n')
-}
-
-function entryPoints(files: string[]): string[] {
-  return files.flatMap((file) =>
-    [
-      ...readFileSync(new URL(file, import.meta.url), 'utf8').matchAll(
-        /assignments\.([A-Za-z_][\w]*)\(/g
-      )
-    ].map((call) => call[1]!)
-  )
-}
-
-// Same-class call graph: store methods only ever reach each other through `this.`.
-function storeCallGraph(lines: string[]): Map<string, Set<string>> {
-  const bounds: { name: string; start: number }[] = []
-  lines.forEach((line, index) => {
-    const declaration = DECLARATION.exec(line)
-    if (declaration) bounds.push({ name: declaration[1]!, start: index })
-  })
-  const callees = new Map<string, Set<string>>()
-  bounds.forEach((method, index) => {
-    const end = bounds[index + 1]?.start ?? lines.length
-    const names = callees.get(method.name) ?? new Set<string>()
-    for (const call of lines
-      .slice(method.start, end)
-      .join('\n')
-      .matchAll(/this\.([A-Za-z_][\w]*)\s*\(/g)) {
-      names.add(call[1]!)
-    }
-    callees.set(method.name, names)
-  })
-  return callees
-}
-
-function closure(callees: Map<string, Set<string>>, roots: string[]): Set<string> {
-  const reached = new Set<string>()
-  const pending = [...roots]
-  while (pending.length > 0) {
-    const name = pending.pop()!
-    if (reached.has(name)) continue
-    reached.add(name)
-    for (const callee of callees.get(name) ?? []) if (!reached.has(callee)) pending.push(callee)
-  }
-  return reached
-}
-
-// Why: a hand-written reachability column is a claim, not a check. Derive both
-// directions, so a new sweep edge into a bounded site fails here instead of in
-// production, and so 'sweep' and 'both' stop being asserted by hand.
-function derivedReachability(lines: string[]): (method: string) => Reachability {
-  const callees = storeCallGraph(lines)
-  const sweep = closure(callees, entryPoints(SWEEP_ENTRY_FILES))
-  const request = closure(callees, entryPoints(REQUEST_ENTRY_FILES))
-  return (method) =>
-    sweep.has(method)
-      ? request.has(method)
-        ? 'both'
-        : 'sweep'
-      : request.has(method)
-        ? 'request'
-        : 'orphan'
-}
-
-function readCallSites(): { method: string; mode: CensusMode }[] {
-  const sites: { method: string; mode: CensusMode }[] = []
-  let method = '<module>'
-  for (const line of storeSource()) {
-    const declaration = DECLARATION.exec(line)
-    if (declaration) method = declaration[1]!
-    if (/private async lock(General)?CellInventory\(/.test(line)) continue
-    const call = /lock(?:General)?CellInventory\(\s*\w+\s*,\s*(?:'([a-z-]+)'|(\w+))\s*\)/.exec(line)
-    if (!call) continue
-    sites.push({ method, mode: (call[1] ?? 'caller') as CensusMode })
-  }
-  return sites
-}
-
-
-// Tier 3 and tier 4 of the row lock order documented in assignment-store.ts. A
-// transaction that takes relay_cells before this host's reservation rows can
-// cycle with one that takes them the other way round, and PostgreSQL resolves
-// that as a 40P01 during exactly the drain and rehome waves these paths exist
-// to run. The cell row is the one every host on a cell shares, so it is the
-// lock that must be taken last, which fixes the direction for everyone else.
-const CELL_LOCK_CALL =
-  /this\.(?:lockCellInventory|lockGeneralCellInventory|lockCellRows|adjustCellReservationAtomically|adjustCellReservation)\(|UPDATE relay_cells/
-const RESERVATION_LOCK_CALL =
-  /this\.(?:lockControlConnectionReservations|insertControlConnectionReservation|claimControlConnectionReservation|releaseSupersededControlConnectionReservations)\(|(?:UPDATE|INTO|DELETE FROM)\s+relay_control_connection_reservations/
-
-// The lock helpers themselves, plus the one reporting query that reads both
-// tables without locking either.
-const ROW_LOCK_ORDER_EXEMPT = [
-  'lockCellInventory',
-  'lockGeneralCellInventory',
-  'lockCellRows',
-  'lockControlConnectionReservations',
-  'adjustCellReservation',
-  'adjustCellReservationAtomically',
-  'insertControlConnectionReservation',
-  'claimControlConnectionReservation',
-  'releaseSupersededControlConnectionReservations',
-  'cellDeploymentStatus'
-]
-
-function methodSpans(lines: string[]): { name: string; start: number; end: number }[] {
-  const starts: { name: string; start: number }[] = []
-  lines.forEach((line, index) => {
-    const declaration = DECLARATION.exec(line)
-    if (declaration) starts.push({ name: declaration[1]!, start: index })
-  })
-  return starts.map((entry, index) => ({
-    ...entry,
-    end: starts[index + 1]?.start ?? lines.length
-  }))
-}
-
-function pathsTakingCellsBeforeReservations(lines: string[]): string[] {
-  const offending: string[] = []
-  for (const span of methodSpans(lines)) {
-    if (ROW_LOCK_ORDER_EXEMPT.includes(span.name)) continue
-    let cell = Number.POSITIVE_INFINITY
-    let reservation = Number.POSITIVE_INFINITY
-    for (let index = span.start; index < span.end; index++) {
-      const line = lines[index]!
-      if (CELL_LOCK_CALL.test(line)) cell = Math.min(cell, index)
-      if (RESERVATION_LOCK_CALL.test(line)) reservation = Math.min(reservation, index)
-    }
-    if (cell < reservation && reservation !== Number.POSITIVE_INFINITY) {
-      offending.push(span.name)
-    }
-  }
-  return offending
-}
-
-describe('cell inventory lock call-site census', () => {
-  it('classifies every call site exactly as recorded', () => {
-    expect(readCallSites()).toEqual(CENSUS.map(({ method, mode }) => ({ method, mode })))
-  })
-
-  // Why: the census only sees lockCellInventory calls, so a hand-written
-  // `relay_cells ... FOR UPDATE` would escape classification entirely.
-  it('routes every relay_cells row lock through a named lock helper', () => {
-    const lines = storeSource()
-    const rawSites: string[] = []
-    // Whole statements, not a fixed window: a wide column list or a raw
-    // FOR UPDATE inside query() must not slip past.
-    const source = lines.join('\n')
-    const bounds: { name: string; start: number }[] = []
-    lines.forEach((line, index) => {
-      const declaration = DECLARATION.exec(line)
-      if (declaration) bounds.push({ name: declaration[1]!, start: index })
-    })
-    const methodAt = (offset: number): string => {
-      const lineIndex = source.slice(0, offset).split('\n').length - 1
-      let name = '<module>'
-      for (const bound of bounds) if (bound.start <= lineIndex) name = bound.name
-      return name
-    }
-    const tick = String.fromCharCode(96)
-    const statementCall = new RegExp(
-      '\\.(queryLocked|query)\\(\\s*' + tick + '([^' + tick + ']*)' + tick,
-      'g'
-    )
-    for (const call of source.matchAll(statementCall)) {
-      const statement = call[2]!
-      if (!/\bFROM\s+relay_cells\b/.test(statement)) continue
-      const locks = call[1] === 'queryLocked' || /\bFOR\s+UPDATE\b/.test(statement)
-      if (!locks) continue
-      const method = methodAt(call.index)
-      if (NAMED_LOCK_HELPERS.includes(method)) continue
-      rawSites.push(method)
-    }
-    expect(rawSites).toEqual(INLINE_CELL_LOCK_SITES)
-  })
-
-  it('takes the host reservation rows before the shared cell row everywhere', () => {
-    expect(pathsTakingCellsBeforeReservations(storeSource())).toEqual([])
-  })
-
-  it('leaves no call site taking the inventory without naming a mode', () => {
-    const source = readFileSync(new URL('./assignment-store.ts', import.meta.url), 'utf8')
-    const unclassified = source
-      .split('\n')
-      .filter((line) => /lock(?:General)?CellInventory\(\s*\w+\s*\)/.test(line))
-      .filter((line) => !line.includes('private async'))
-
-    expect(unclassified).toEqual([])
-  })
-
-  it('derives the same reachability the census claims', () => {
-    const reachOf = derivedReachability(storeSource())
-
-    expect(readCallSites().map(({ method }) => reachOf(method))).toEqual(
-      CENSUS.map((entry) => entry.reach)
-    )
-  })
-
-  // Why: this is the whole point of the classification. A shorter wait on a
-  // sweep-reachable site turns contention into a terminal transaction failure
-  // that counts against the incident gate's relayPostgresRetryExhausted bar.
-  // Why: the hold distribution is what the 500ms bound will be tuned against, so
-  // a mode that stops asking for it goes unmeasured in exactly the lane that
-  // matters. Nothing else in the suite reads the pool-default branch.
-  it('measures the hold in every lock mode', () => {
-    const modes: CellInventoryLockMode[] = ['request', 'nowait', 'pool-default']
-
-    expect(modes.map((mode) => cellInventoryLockOptions(mode).measureHoldMs)).toEqual([
-      true,
-      true,
-      true
-    ])
-  })
-
-  it('never puts a sweep-reachable site on the bounded wait', () => {
-    const reachOf = derivedReachability(storeSource())
-    const bounded = readCallSites().filter(
-      (site) => site.mode === 'request' && ['sweep', 'both'].includes(reachOf(site.method))
-    )
-
-    expect(bounded).toEqual([])
-  })
-
-  it('routes every sweep-only site to NOWAIT so it can skip the tick', () => {
-    const reachOf = derivedReachability(storeSource())
-    const queueing = readCallSites().filter(
-      (site) => reachOf(site.method) === 'sweep' && site.mode !== 'nowait'
-    )
-
-    expect(queueing).toEqual([])
-  })
-})
diff --git a/cloud/apps/relay/src/cell-inventory-lock-contention.test.ts b/cloud/apps/relay/src/cell-inventory-lock-contention.test.ts
index 44a4b990ea8..1bf3153f3e4 100644
--- a/cloud/apps/relay/src/cell-inventory-lock-contention.test.ts
+++ b/cloud/apps/relay/src/cell-inventory-lock-contention.test.ts
@@ -1,4 +1,3 @@
-import { readFileSync } from 'node:fs'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 
 const fakes = vi.hoisted(() => ({
@@ -78,7 +77,6 @@ describe('bounded cell-inventory lock wait', () => {
   // Why: a bound at or above the pool default would fence nothing, and one far
   // below the hold time would convert ordinary contention into terminal failures.
   it('keeps the request bound strictly inside the pool default', () => {
-    expect(CELL_INVENTORY_LOCK_TIMEOUT_MS).toBe(500)
     expect(CELL_INVENTORY_LOCK_TIMEOUT_MS).toBeLessThan(POSTGRES_LOCK_TIMEOUT_MS)
   })
 
@@ -361,15 +359,6 @@ describe('bounded cell-inventory lock wait', () => {
     await database.close()
   })
 
-  // Why: index.ts boots a server on import, so its wiring can only be read. An
-  // unspread hold metric is invisible: the flush simply omits the fields.
-  it('spreads the hold counts into the runtime metrics flush', () => {
-    const source = readFileSync(new URL('./index.ts', import.meta.url), 'utf8')
-    const flush = /observability\.start\(\(\) => \(\{([^}]*)\}\)\)/.exec(source)
-
-    expect(flush?.[1]).toContain('...consumeRelayCellInventoryHold(database)')
-  })
-
   // Why: 500ms is a first value, not a measurement. Tuning it needs the hold
   // distribution, which no runtime metric carried.
   it('reports how long the inventory lock was held to COMMIT', async () => {
@@ -492,25 +481,6 @@ describe('background sweeps skip a contended cell inventory', () => {
     expect(warnings.entries).toEqual([])
     await database.close()
   })
-
-  it('still aborts the expired evacuation once the inventory is free', async () => {
-    const database = await openInMemoryRelayDatabase()
-    const probe = new InventoryLockProbe(database)
-    let now = 1_000
-    const store = new RelayAssignmentStore(probe, () => now)
-    await store.reconcileCells(CELLS)
-    const assignment = await store.assign(identity)
-    await store.activateControl(identity, {
-      cellId: assignment.cellId,
-      assignmentEpoch: assignment.assignmentEpoch,
-      generation: 1
-    })
-    await store.startEvacuation(identity, 'cell-b')
-    now += 24 * 60 * 60_000
-
-    expect(await store.abortExpiredEvacuations()).toBe(1)
-    await database.close()
-  })
 })
 
 // Returns each inventory lock the run took, as its bound or 'nowait'.
diff --git a/cloud/apps/relay/src/database.ts b/cloud/apps/relay/src/database.ts
index db1203bc45c..6a8a1fc202a 100644
--- a/cloud/apps/relay/src/database.ts
+++ b/cloud/apps/relay/src/database.ts
@@ -852,16 +852,18 @@ class SqliteDatabase extends SqliteTransaction {
     let release!: () => void
     this.tail = new Promise((resolve) => (release = resolve))
     await previous
-    this.database.exec('BEGIN IMMEDIATE')
-    const transaction = new SqliteTransaction(this.database)
     try {
-      const result = await operation(transaction)
-      this.database.exec('COMMIT')
-      recordMeasuredHold(this.holds, transaction)
-      return result
-    } catch (error) {
-      this.database.exec('ROLLBACK')
-      throw error
+      this.database.exec('BEGIN IMMEDIATE')
+      const transaction = new SqliteTransaction(this.database)
+      try {
+        const result = await operation(transaction)
+        this.database.exec('COMMIT')
+        recordMeasuredHold(this.holds, transaction)
+        return result
+      } catch (error) {
+        this.database.exec('ROLLBACK')
+        throw error
+      }
     } finally {
       release()
     }
diff --git a/cloud/apps/relay/src/host-session-registry.test.ts b/cloud/apps/relay/src/host-session-registry.test.ts
index 69697cce60e..fcf73695b40 100644
--- a/cloud/apps/relay/src/host-session-registry.test.ts
+++ b/cloud/apps/relay/src/host-session-registry.test.ts
@@ -535,6 +535,8 @@ describe('host session cleanup races', () => {
     const socket = new FakeSocket()
 
     const activation = activate(socket as unknown as WebSocket, identity, null, 1, false, 1)
+    await vi.advanceTimersByTimeAsync(0)
+    expect(activateControl).toHaveBeenCalledOnce()
     socket.close()
     blocked.resolve('control:production-gce-c3:1')
     await activation
@@ -560,6 +562,8 @@ describe('host session cleanup races', () => {
 
     const rebindSocket = new FakeSocket()
     const rebinding = activate(rebindSocket as unknown as WebSocket, identity, original, 1, true, 1)
+    await vi.advanceTimersByTimeAsync(0)
+    expect(activateControl).toHaveBeenCalledTimes(2)
     rebindSocket.close()
     blocked.resolve('control:production-gce-c3:1')
     await rebinding
@@ -574,6 +578,49 @@ describe('host session cleanup races', () => {
     )
   })
 
+  it('skips a closed queued control so its live retry avoids abandoned database work', async () => {
+    const stalled = deferred<string>()
+    const activateControl = vi
+      .fn<RelayAssignmentStore['activateControl']>()
+      .mockReturnValueOnce(stalled.promise)
+      .mockImplementation(async () => {
+        await new Promise<void>((resolve) => setTimeout(resolve, 4_000))
+        return 'control:production-gce-c3:1'
+      })
+    const { registry, activate, releaseActivity } = createRegistry(activateControl)
+    const firstSocket = new FakeSocket()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: FakeSocket implements the registry's WebSocket event and lifecycle surface.
+    const first = activate(firstSocket as unknown as WebSocket, identity, null, 1, false, 1)
+    await vi.advanceTimersByTimeAsync(0)
+    expect(activateControl).toHaveBeenCalledOnce()
+    const abandonedSocket = new FakeSocket()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: FakeSocket implements the registry's WebSocket event and lifecycle surface.
+    const abandoned = activate(abandonedSocket as unknown as WebSocket, identity, null, 1, false, 1)
+    const liveSocket = new FakeSocket()
+    const startedAt = Date.now()
+    let liveCompletedAt: number | undefined
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: FakeSocket implements the registry's WebSocket event and lifecycle surface.
+    const live = activate(liveSocket as unknown as WebSocket, identity, null, 1, false, 1)
+      .then(() => { liveCompletedAt = Date.now() })
+    firstSocket.close()
+    abandonedSocket.close()
+    stalled.resolve('control:production-gce-c3:1')
+    await vi.advanceTimersByTimeAsync(8_000)
+    await Promise.all([first, abandoned, live])
+
+    console.log(JSON.stringify({
+      scenario: 'closed queued control before a live retry',
+      activationCalls: activateControl.mock.calls.length,
+      activityReleases: releaseActivity.mock.calls.length,
+      liveReadyMs: liveCompletedAt === undefined ? null : liveCompletedAt - startedAt
+    }))
+    expect(activateControl).toHaveBeenCalledTimes(2)
+    expect(releaseActivity).toHaveBeenCalledOnce()
+    expect(liveCompletedAt! - startedAt).toBe(4_000)
+    expect(registry.get({ userId: identity.sub, relayHostId: identity.relayHostId })?.socket)
+      .toBe(liveSocket)
+  })
+
   it('rejects client lookup when the indexed control socket is not open', async () => {
     const reservation = {
       userId: identity.sub,
diff --git a/cloud/apps/relay/src/host-session-registry.ts b/cloud/apps/relay/src/host-session-registry.ts
index 380ccfbc9c6..4e3372ce692 100644
--- a/cloud/apps/relay/src/host-session-registry.ts
+++ b/cloud/apps/relay/src/host-session-registry.ts
@@ -1103,7 +1103,7 @@ export class HostSessionRegistry {
       .catch(() => undefined)
       .then(async () => {
         clearTimeout(queueWaitTimer)
-        if (queueWaitExpired) return
+        if (queueWaitExpired || socket.readyState !== socket.OPEN) return
         if ((this.sessions.get(key) ?? null) !== existing) {
           socket.close(RELAY_CLOSE_CODE.PEER_DROPPED, 'control activation superseded')
           return
diff --git a/cloud/apps/relay/src/relay-first-frame-close.blackbox.test.ts b/cloud/apps/relay/src/relay-first-frame-close.blackbox.test.ts
new file mode 100644
index 00000000000..8a3d797cdfb
--- /dev/null
+++ b/cloud/apps/relay/src/relay-first-frame-close.blackbox.test.ts
@@ -0,0 +1,272 @@
+import { connect, type Socket } from 'node:net'
+import { afterEach, expect, it, vi } from 'vitest'
+import { RELAY_CLOSE_CODE, RELAY_PROTOCOL_LIMITS } from '@orca-cloud/relay-contract'
+import { loadRelayConfig } from './config.js'
+import type { RelayDatabase } from './database.js'
+import { createRelayServer } from './relay-server.js'
+
+const cleanups: (() => Promise<void> | void)[] = []
+afterEach(async () => {
+  for (const cleanup of cleanups.splice(0).reverse()) await cleanup()
+  vi.restoreAllMocks()
+})
+
+const IDLE_LEDGER = {
+  physicalConnections: 0,
+  inFlightConnections: 0,
+  reservedConnectionUnits: 0,
+  enforcedConnectionUnits: 0
+}
+
+async function fixture(
+  options: { role?: 'cell' | 'director'; hardCap?: number } = {}
+) {
+  const role = options.role ?? 'cell'
+  const database: RelayDatabase = {
+    query: vi.fn(async () => []),
+    queryLocked: vi.fn(async () => []),
+    transaction: (operation) => operation(database),
+    close: async () => {}
+  }
+  const config = loadRelayConfig({
+    ORCA_RELAY_PUBLIC_URL: 'http://127.0.0.1',
+    ORCA_RELAY_CELL_URL: 'http://127.0.0.1',
+    ORCA_RELAY_AUTH_ISSUER: 'https://auth.example.test',
+    ORCA_RELAY_JWKS_URL: 'https://auth.example.test/jwks',
+    ORCA_RELAY_ASSIGNMENT_SIGNING_KEY: 'synthetic-assignment-key-for-test-only',
+    ORCA_RELAY_ROLE: role,
+    ORCA_RELAY_ADMIN_AUDIENCE: 'https://auth.example.test/admin',
+    ORCA_RELAY_DEPLOY_SERVICE_ACCOUNT: 'deploy@example.test',
+    ORCA_RELAY_CELL_CONNECTION_HARD_CAP: '600',
+    ORCA_RELAY_CELL_CONNECTION_UNOBSERVED_BOUND: '60',
+    ...(role === 'director'
+      ? {
+          ORCA_RELAY_CELLS_JSON: JSON.stringify([
+            { id: 'cell-1', url: 'https://cell-1.example.test', capacityRequests: 900 }
+          ])
+        }
+      : {})
+  })
+  const relay = createRelayServer(config, database, {
+    connectionLedgerLimits: { hardCap: options.hardCap ?? 3, controlReserve: 1 }
+  })
+  await new Promise<void>((resolve) => relay.server.listen(0, '127.0.0.1', resolve))
+  cleanups.push(() => new Promise<void>((resolve) => relay.server.close(() => resolve())))
+  const address = relay.server.address()
+  if (!address || typeof address === 'string') throw new Error('missing test port')
+  return { relay, port: address.port, database }
+}
+
+type RawPeer = {
+  socket: Socket
+  received: () => Buffer
+  transport: () => { ended: boolean; error: string | null }
+}
+
+async function silentUpgrade(port: number, target: string): Promise<RawPeer> {
+  const socket = connect(port, '127.0.0.1')
+  cleanups.push(() => {
+    socket.destroy()
+  })
+  await new Promise<void>((resolve, reject) => {
+    let header = ''
+    socket.once('error', reject)
+    socket.once('connect', () => {
+      socket.write(
+        `GET ${target} HTTP/1.1\r\nHost: 127.0.0.1\r\nConnection: Upgrade\r\n` +
+          'Upgrade: websocket\r\nSec-WebSocket-Version: 13\r\n' +
+          // RFC 6455 example nonce, matching the existing raw-upgrade fixture.
+          'Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n\r\n'
+      )
+    })
+    const readHeader = (chunk: Buffer): void => {
+      header += chunk.toString()
+      if (!header.includes('\r\n\r\n')) return
+      socket.off('data', readHeader)
+      if (header.startsWith('HTTP/1.1 101 ')) resolve()
+      else reject(new Error(header.split('\r\n')[0]))
+    }
+    socket.on('data', readHeader)
+  })
+  socket.removeAllListeners('error')
+  // This raw peer reads frames without answering the server's close handshake.
+  const chunks: Buffer[] = []
+  let ended = false
+  let error: string | null = null
+  socket.on('data', (chunk: Buffer) => chunks.push(chunk))
+  socket.on('end', () => {
+    ended = true
+  })
+  socket.on('error', (caught: Error) => {
+    error = caught.message
+  })
+  return {
+    socket,
+    received: () => Buffer.concat(chunks),
+    transport: () => ({ ended, error })
+  }
+}
+
+// A 43-character base64url credential is the shortest value RelayAuthSchema accepts.
+const WELL_FORMED_CREDENTIAL = 'abcdefghijklmnopqrstuvwxyzABCDEFGH012345678'
+
+function maskedTextFrame(payload: string): Buffer {
+  const body = Buffer.from(payload)
+  const mask = Buffer.from([1, 2, 3, 4])
+  const masked = Buffer.from(body.map((byte, index) => byte ^ mask[index % 4]!))
+  return Buffer.concat([Buffer.from([0x81, 0x80 | body.length]), mask, masked])
+}
+
+function relayAuthFrame(): Buffer {
+  return maskedTextFrame(
+    JSON.stringify({
+      type: 'relay-auth',
+      v: 1,
+      mode: 'connect',
+      credential: WELL_FORMED_CREDENTIAL
+    })
+  )
+}
+
+// The close frame is the last unmasked frame a rejected peer receives: 0x88, length,
+// then a big-endian status code followed by the UTF-8 reason.
+function readCloseFrame(received: Buffer): { code: number; reason: string } | null {
+  const start = received.lastIndexOf(0x88)
+  if (start < 0 || received.length < start + 4) return null
+  const length = received[start + 1]!
+  return {
+    code: received.readUInt16BE(start + 2),
+    reason: received.subarray(start + 4, start + 2 + length).toString('utf8')
+  }
+}
+
+async function expectIdleLedger(
+  relay: Awaited<ReturnType<typeof fixture>>['relay'],
+  timeout: number
+): Promise<void> {
+  await vi.waitFor(() => expect(relay.connectionSnapshot()).toMatchObject(IDLE_LEDGER), { timeout })
+}
+
+const PHONE_TARGET = '/v1/connect/abcdefghijklmnop'
+
+it.each([
+  { label: 'first-frame timeout', target: PHONE_TARGET, opcode: undefined },
+  { label: 'binary first frame', target: PHONE_TARGET, opcode: 0x82 },
+  { label: 'invalid phone auth', target: PHONE_TARGET, opcode: 0x81 },
+  { label: 'invalid host-data auth', target: '/v1/host/data/connection-1', opcode: 0x81 }
+])(
+  'releases admission after $label even when the peer ignores close',
+  async ({ target, opcode }) => {
+    const { relay, port, database } = await fixture()
+    const peer = await silentUpgrade(port, target)
+    const firstFrameDeadline = opcode === undefined ? RELAY_PROTOCOL_LIMITS.firstFrameDeadlineMs : 0
+    if (opcode !== undefined) peer.socket.write(Buffer.from([opcode, 0x80, 0, 0, 0, 0]))
+    await expectIdleLedger(relay, firstFrameDeadline + 2_000)
+    expect(relay.runtimeCounts().preAuthConnections).toBe(0)
+    expect(database.query).not.toHaveBeenCalled()
+    expect(database.queryLocked).not.toHaveBeenCalled()
+    await silentUpgrade(port, PHONE_TARGET)
+    expect(relay.connectionSnapshot()?.enforcedConnectionUnits).toBe(2)
+  }
+)
+
+it('releases admission after a rejected director invite when the peer ignores close', async () => {
+  const { relay, port } = await fixture({ role: 'director' })
+  const peer = await silentUpgrade(port, PHONE_TARGET)
+  peer.socket.write(relayAuthFrame())
+  await expectIdleLedger(relay, 2_000)
+  expect(readCloseFrame(peer.received())).toEqual({
+    code: RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL,
+    reason: 'invalid invite'
+  })
+  expect(relay.runtimeCounts().preAuthConnections).toBe(0)
+  await silentUpgrade(port, PHONE_TARGET)
+  expect(relay.connectionSnapshot()?.enforcedConnectionUnits).toBe(2)
+})
+
+it('releases admission after a director move redirect when the peer ignores close', async () => {
+  const { relay, port } = await fixture({ role: 'director' })
+  const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
+  vi.spyOn(relay.store, 'resolveInviteForMove').mockResolvedValue({
+    userId: identity.userId,
+    relayDeviceId: 'device-1'
+  })
+  vi.spyOn(relay.assignments, 'resolve').mockResolvedValue({
+    ...identity,
+    cellId: 'cell-1',
+    cellUrl: 'https://cell-1.example.test',
+    assignmentEpoch: 1,
+    leaseExpiresAt: Date.now() + 60_000
+  })
+  const peer = await silentUpgrade(port, PHONE_TARGET)
+  peer.socket.write(relayAuthFrame())
+  await expectIdleLedger(relay, 2_000)
+  expect(peer.received().toString('utf8')).toContain('"type":"relay-moved"')
+  expect(readCloseFrame(peer.received())).toEqual({
+    code: RELAY_CLOSE_CODE.DRAINING,
+    reason: 'connect to assigned cell'
+  })
+  await silentUpgrade(port, PHONE_TARGET)
+  expect(relay.connectionSnapshot()?.enforcedConnectionUnits).toBe(2)
+})
+
+// A peer that keeps draining its socket does get the rejection: the close frame is written
+// before the force-close timer can fire, and TCP delivers those bytes ahead of the FIN.
+//
+// Scope, deliberately narrow: this peer reads every byte as it arrives, so the assertion below
+// speaks only for a responsive peer. It is not evidence that delivery survives backpressure —
+// `terminate()` destroys the socket a second later, and a frame still queued in the kernel or in
+// `ws`'s own buffer goes unsent. Treat the rejection as best effort; the bound on the close is
+// what the trade-off actually buys.
+it('delivers the rejection code and a graceful FIN to a peer that keeps reading', async () => {
+  const { relay, port } = await fixture()
+  const peer = await silentUpgrade(port, PHONE_TARGET)
+  peer.socket.write(maskedTextFrame(JSON.stringify({ type: 'relay-auth', v: 1, mode: 'wrong' })))
+  await vi.waitFor(() => expect(peer.transport().ended).toBe(true), { timeout: 3_000 })
+  expect(peer.received().toString('utf8')).toContain('"code":4401')
+  expect(readCloseFrame(peer.received())).toEqual({
+    code: RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL,
+    reason: 'invalid relay auth'
+  })
+  expect(peer.transport().error).toBeNull()
+  await expectIdleLedger(relay, 2_000)
+})
+
+const BINARY_FIRST_FRAME = Buffer.from([0x82, 0x80, 0, 0, 0, 0])
+// maxPreAuthPerSource caps how many unauthenticated sockets one source may hold at once.
+const CONCURRENT_PEERS_PER_SOURCE = 4
+
+it('returns capacity to its exact baseline after repeated bursts of rejections', async () => {
+  const { relay, port } = await fixture({ hardCap: 2 * CONCURRENT_PEERS_PER_SOURCE + 1 })
+  for (let wave = 0; wave < 3; wave++) {
+    const peers = await Promise.all(
+      Array.from({ length: CONCURRENT_PEERS_PER_SOURCE }, () =>
+        silentUpgrade(port, PHONE_TARGET)
+      )
+    )
+    expect(relay.connectionSnapshot()).toMatchObject({
+      enforcedConnectionUnits: 2 * CONCURRENT_PEERS_PER_SOURCE
+    })
+    for (const peer of peers) peer.socket.write(BINARY_FIRST_FRAME)
+    await expectIdleLedger(relay, 3_000)
+    expect(relay.runtimeCounts().preAuthConnections).toBe(0)
+  }
+})
+
+// A rejection racing the peer's own disconnect must release once, not twice: the ledger
+// does not clamp at zero, so a double release shows up as a negative count here.
+it('releases exactly once when a rejected peer disconnects at the same moment', async () => {
+  const { relay, port } = await fixture({ hardCap: 2 * CONCURRENT_PEERS_PER_SOURCE + 1 })
+  const peers = await Promise.all(
+    Array.from({ length: CONCURRENT_PEERS_PER_SOURCE }, () => silentUpgrade(port, PHONE_TARGET))
+  )
+  for (const peer of peers) {
+    peer.socket.write(BINARY_FIRST_FRAME)
+    peer.socket.destroy()
+  }
+  await expectIdleLedger(relay, 3_000)
+  expect(relay.connectionSnapshot()).toMatchObject(IDLE_LEDGER)
+  expect(relay.runtimeCounts().preAuthConnections).toBe(0)
+  await silentUpgrade(port, PHONE_TARGET)
+  expect(relay.connectionSnapshot()?.enforcedConnectionUnits).toBe(2)
+})
diff --git a/cloud/apps/relay/src/relay-readiness-coalescing.test.ts b/cloud/apps/relay/src/relay-readiness-coalescing.test.ts
new file mode 100644
index 00000000000..2dc8ca0af22
--- /dev/null
+++ b/cloud/apps/relay/src/relay-readiness-coalescing.test.ts
@@ -0,0 +1,106 @@
+import { expect, it, vi } from 'vitest'
+import type { RelayDatabase } from './database.js'
+import { createRelayReadiness } from './relay-readiness.js'
+
+function database(query: RelayDatabase['query']): RelayDatabase {
+  return {
+    query,
+    queryLocked: query,
+    transaction: (operation) => operation(database(query)),
+    close: async () => {}
+  }
+}
+
+function gate() {
+  let release!: () => void
+  const wait = new Promise<void>((resolve) => (release = resolve))
+  return { wait, release }
+}
+
+it('shares both dependency probes and caches from completion for concurrent callers', async () => {
+  const sql = gate()
+  let now = 1_000
+  const query = vi.fn(async () => {
+    await sql.wait
+    return [{ ready: 1 }]
+  })
+  const fetchImpl = vi.fn(async () => new Response('{}'))
+  const observe = vi.fn()
+  const readiness = createRelayReadiness(database(query), 'https://jwks.example.test', {
+    fetch: fetchImpl,
+    now: () => now,
+    observe
+  })
+  const checks = Array.from({ length: 100 }, () => readiness.check())
+  try {
+    expect({ sql: query.mock.calls.length, jwks: fetchImpl.mock.calls.length }).toEqual({
+      sql: 1,
+      jwks: 1
+    })
+    expect(observe).not.toHaveBeenCalled()
+    now = 5_000
+  } finally {
+    sql.release()
+  }
+  expect(await Promise.all(checks)).toEqual(Array(100).fill(true))
+  expect(observe).toHaveBeenCalledTimes(1)
+  now = 14_999
+  expect(await readiness.check()).toBe(true)
+  expect(query).toHaveBeenCalledTimes(1)
+  now = 15_000
+  expect(await Promise.all(Array.from({ length: 100 }, () => readiness.check()))).toEqual(
+    Array(100).fill(true)
+  )
+  expect(query).toHaveBeenCalledTimes(2)
+  expect(fetchImpl).toHaveBeenCalledTimes(2)
+})
+
+it('shares failures, retains the failure cache, and retries after expiry', async () => {
+  let healthy = false
+  let now = 1_000
+  const query = vi.fn(async () => {
+    if (!healthy) throw new Error('offline')
+    return [{ ready: 1 }]
+  })
+  const fetchImpl = vi.fn(async () => new Response('{}', { status: healthy ? 200 : 503 }))
+  const observe = vi.fn()
+  const readiness = createRelayReadiness(database(query), 'https://jwks.example.test', {
+    fetch: fetchImpl,
+    now: () => now,
+    observe
+  })
+  expect(await Promise.all(Array.from({ length: 100 }, () => readiness.check()))).toEqual(
+    Array(100).fill(false)
+  )
+  expect(query).toHaveBeenCalledTimes(1)
+  expect(fetchImpl).toHaveBeenCalledTimes(1)
+  expect(observe).toHaveBeenCalledTimes(1)
+  expect(readiness.degradedDependencies()).toEqual([])
+  healthy = true
+  now = 10_999
+  expect(await readiness.check()).toBe(false)
+  expect(query).toHaveBeenCalledTimes(1)
+  now = 11_000
+  expect(await Promise.all(Array.from({ length: 100 }, () => readiness.check()))).toEqual(
+    Array(100).fill(true)
+  )
+  expect(query).toHaveBeenCalledTimes(2)
+  expect(fetchImpl).toHaveBeenCalledTimes(2)
+  expect(observe).toHaveBeenCalledTimes(2)
+})
+
+it('keeps separate readiness owners independent', async () => {
+  const query = vi.fn(async () => [{ ready: 1 }])
+  const fetchImpl = vi.fn(async () => new Response('{}'))
+  const first = createRelayReadiness(database(query), 'https://one.example.test', {
+    fetch: fetchImpl
+  })
+  const second = createRelayReadiness(database(query), 'https://two.example.test', {
+    fetch: fetchImpl
+  })
+  expect(await Promise.all([first.check(), first.check(), second.check(), second.check()])).toEqual(
+    [true, true, true, true]
+  )
+  expect(query).toHaveBeenCalledTimes(2)
+  expect(fetchImpl).toHaveBeenCalledTimes(2)
+})
diff --git a/cloud/apps/relay/src/relay-readiness.ts b/cloud/apps/relay/src/relay-readiness.ts
index 973a827e104..72d3cd5c471 100644
--- a/cloud/apps/relay/src/relay-readiness.ts
+++ b/cloud/apps/relay/src/relay-readiness.ts
@@ -131,6 +131,7 @@ export function createRelayReadiness(
   const settleSql = createDependencyGrace('sql', options.sqlGraceMs ?? RELAY_READINESS_SQL_GRACE_MS)
   let cachedAt = Number.NEGATIVE_INFINITY
   let cached = false
+  let pending: Promise<boolean> | null = null
   let lastObservedReady: boolean | undefined
   let degraded: RelayReadinessDependency[] = []
 
@@ -153,8 +154,7 @@ export function createRelayReadiness(
     }
   }
 
-  const check = async (): Promise<boolean> => {
-    if (now() - cachedAt < cacheMs) return cached
+  const probe = async (): Promise<boolean> => {
     const startedAt = now()
     const [jwks, sql] = await Promise.all([timed(now, probeJwks), timed(now, probeSql)])
     const completedAt = now()
@@ -185,5 +185,13 @@ export function createRelayReadiness(
     return cached
   }
 
+  const check = async (): Promise<boolean> => {
+    if (now() - cachedAt < cacheMs) return cached
+    pending ??= probe().finally(() => {
+      pending = null
+    })
+    return pending
+  }
+
   return { check, degradedDependencies: () => [...degraded] }
 }
diff --git a/cloud/apps/relay/src/relay-server.ts b/cloud/apps/relay/src/relay-server.ts
index e9a08398da9..b90c322d1c2 100644
--- a/cloud/apps/relay/src/relay-server.ts
+++ b/cloud/apps/relay/src/relay-server.ts
@@ -276,7 +276,7 @@ export function createRelayServer(
       finished = true
       authenticated(source)
       observability.recordAuth(false)
-      socket.close(RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL, 'first frame timeout')
+      closeRelayWebSocket(socket, RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL, 'first frame timeout')
     }, RELAY_PROTOCOL_LIMITS.firstFrameDeadlineMs)
     socket.once('message', (raw, binary) => {
       if (finished) return
@@ -285,7 +285,11 @@ export function createRelayServer(
       authenticated(source)
       if (binary) {
         observability.recordAuth(false)
-        socket.close(RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL, 'first frame must be text')
+        closeRelayWebSocket(
+          socket,
+          RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL,
+          'first frame must be text'
+        )
         return
       }
       void callback(raw).catch((error: unknown) => {
@@ -356,7 +360,11 @@ export function createRelayServer(
               webSocket.send(
                 JSON.stringify({ type: 'relay-hello', ok: false, code: RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL })
               )
-              webSocket.close(RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL, 'invalid relay auth')
+              closeRelayWebSocket(
+                webSocket,
+                RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL,
+                'invalid relay auth'
+              )
               return
             }
             if (config.role === 'director') {
@@ -376,7 +384,11 @@ export function createRelayServer(
                     code: RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL
                   })
                 )
-                webSocket.close(RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL, 'invalid invite')
+                closeRelayWebSocket(
+                  webSocket,
+                  RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL,
+                  'invalid invite'
+                )
                 return
               }
               phoneAdmission?.hostData.release()
@@ -389,7 +401,7 @@ export function createRelayServer(
                   assignmentEpoch: assignment.assignmentEpoch
                 })
               )
-              webSocket.close(RELAY_CLOSE_CODE.DRAINING, 'connect to assigned cell')
+              closeRelayWebSocket(webSocket, RELAY_CLOSE_CODE.DRAINING, 'connect to assigned cell')
               return
             }
             await sessions.acceptClient(
@@ -442,7 +454,11 @@ export function createRelayServer(
             const auth = HostDataAuthSchema.safeParse(firstPayload(raw, 'host-data-auth'))
             if (!auth.success) {
               observability.recordAuth(false)
-              webSocket.close(RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL, 'invalid host data auth')
+              closeRelayWebSocket(
+                webSocket,
+                RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL,
+                'invalid host data auth'
+              )
               return
             }
             const accepted = await sessions.acceptHostData(
@@ -566,8 +582,3 @@ export function createRelayServer(
     cellIncarnation
   }
 }
-
-export function closeWithDrain(socket: WebSocket, graceMs: number): void {
-  socket.send(JSON.stringify({ type: 'drain', graceMs, recovery: 'resolve-director' }))
-  socket.close(RELAY_CLOSE_CODE.DRAINING, 'resolve configured director')
-}
diff --git a/cloud/apps/relay/src/relay-sweep-schedule.test.ts b/cloud/apps/relay/src/relay-sweep-schedule.test.ts
index 79f65a92582..1b72c3ab031 100644
--- a/cloud/apps/relay/src/relay-sweep-schedule.test.ts
+++ b/cloud/apps/relay/src/relay-sweep-schedule.test.ts
@@ -45,21 +45,6 @@ describe('sweep schedule jitter', () => {
     expect(timers).toEqual([6_600])
   })
 
-  // Why: index.ts boots a server on import, so its wiring can only be read.
-  it('jitters the director assignment cleanup tick', () => {
-    const source = readFileSync(new URL('./index.ts', import.meta.url), 'utf8')
-    const cleanup = /runAssignmentCleanup\(assignments\)\s*\},\s*([^\n]*?)\)\n/.exec(source)
-
-    expect(cleanup?.[1]).toBe('jitteredSweepIntervalMs(30_000)')
-  })
-
-  it('jitters the credential cleanup tick', () => {
-    const source = readFileSync(new URL('./index.ts', import.meta.url), 'utf8')
-    const cleanup = /'\[orca-relay\] credential cleanup failed'\s*\),\s*([^\n]*?)\n/.exec(source)
-
-    expect(cleanup?.[1]).toBe('jitteredSweepIntervalMs(30_000)')
-  })
-
   // A census, not a list of the timers that happen to be gated today: an ungated sweep runs in
   // every cell as well as the director, which multiplies one table scan by the fleet size.
   it('gates every periodic sweep in index.ts on the maintenance role', () => {
diff --git a/cloud/apps/relay/src/relay-websocket-close.ts b/cloud/apps/relay/src/relay-websocket-close.ts
index d4a7f61a3ee..4b0517c3e53 100644
--- a/cloud/apps/relay/src/relay-websocket-close.ts
+++ b/cloud/apps/relay/src/relay-websocket-close.ts
@@ -3,6 +3,14 @@ import type WebSocket from 'ws'
 const RELAY_WEBSOCKET_FORCE_CLOSE_MS = 1_000
 const forceCloseTimers = new WeakMap<WebSocket, ReturnType<typeof setTimeout>>()
 
+// Delivering the rejection is best effort, and deliberately so. The close frame carrying the
+// code and reason is written before the timer can fire, so a peer reading normally gets its
+// rejection ahead of the FIN — that much is asserted in relay-first-frame-close.blackbox.test.ts.
+// It is not a delivery guarantee: `ws` writes the frame to the socket, and `terminate()` destroys
+// the socket a second later, so under backpressure the frame (and any `relay-moved` message queued
+// before it) can still be dropped unsent even though the peer never stopped reading. Bounding the
+// close is what keeps a stalled peer from holding admission, and no finite grace makes delivery
+// certain. Keep the close write ahead of any new wait added here.
 export function closeRelayWebSocket(socket: WebSocket, code: number, reason: string): void {
   if (socket.readyState === socket.CLOSED) return
   if (!forceCloseTimers.has(socket)) {
diff --git a/cloud/apps/relay/src/sqlite-transaction-queue.test.ts b/cloud/apps/relay/src/sqlite-transaction-queue.test.ts
new file mode 100644
index 00000000000..99fb311ae25
--- /dev/null
+++ b/cloud/apps/relay/src/sqlite-transaction-queue.test.ts
@@ -0,0 +1,101 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { DatabaseSync } from 'node:sqlite'
+import { setImmediate } from 'node:timers/promises'
+import { expect, it, vi } from 'vitest'
+import { openRelayDatabase } from './database.js'
+
+it('releases queued work and close after a SQLite transaction cannot acquire its lock', async () => {
+  const dataDir = mkdtempSync(join(tmpdir(), 'orca-relay-sqlite-queue-'))
+  let connection: DatabaseSync | undefined
+  const prepare = DatabaseSync.prototype.prepare
+  // Keep the native handle reachable for cleanup even if a queue regression strands close().
+  const capture = vi
+    .spyOn(DatabaseSync.prototype, 'prepare')
+    .mockImplementation(function (this: DatabaseSync, sql) {
+      connection = this
+      return prepare.call(this, sql)
+    })
+  const database = await openRelayDatabase({ dataDir })
+  capture.mockRestore()
+  const blocker = new DatabaseSync(join(dataDir, 'orca-relay.sqlite'))
+  try {
+    await database.query('CREATE TABLE queue_progress (value INTEGER)')
+    await database.query('INSERT INTO queue_progress VALUES (0)')
+    blocker.exec('BEGIN IMMEDIATE')
+    const operation = vi.fn(async () => undefined)
+    await expect(database.transaction(operation)).rejects.toThrow('database is locked')
+    let lockFailures = 0
+    const blocked = Array.from({ length: 5 }, () =>
+      database.transaction(operation).catch(() => {
+        lockFailures += 1
+      })
+    )
+    await setImmediate()
+    expect(lockFailures).toBe(5)
+    await Promise.all(blocked)
+    expect(operation).not.toHaveBeenCalled()
+    blocker.exec('ROLLBACK')
+    let completed = 0
+    const pending = Array.from({ length: 100 }, () =>
+      database.transaction(async (transaction) => {
+        await transaction.query('UPDATE queue_progress SET value = value + 1')
+        completed += 1
+      })
+    )
+    for (const request of pending) void request.catch(() => undefined)
+    await setImmediate()
+    expect(completed).toBe(100)
+    await Promise.all(pending)
+    expect(await database.query('SELECT value FROM queue_progress')).toEqual([{ value: 100 }])
+    let closed = false
+    const closing = database.close().then(() => {
+      closed = true
+    })
+    await setImmediate()
+    expect(closed).toBe(true)
+    await closing
+  } finally {
+    capture.mockRestore()
+    blocker.close()
+    if (connection?.isOpen) connection.close()
+    rmSync(dataDir, { recursive: true, force: true })
+  }
+})
+
+it('does not roll back a transaction when BEGIN failed before taking ownership', async () => {
+  const dataDir = mkdtempSync(join(tmpdir(), 'orca-relay-sqlite-owner-'))
+  let connection: DatabaseSync | undefined
+  const prepare = DatabaseSync.prototype.prepare
+  const capture = vi
+    .spyOn(DatabaseSync.prototype, 'prepare')
+    .mockImplementation(function (this: DatabaseSync, sql) {
+      connection = this
+      return prepare.call(this, sql)
+    })
+  const database = await openRelayDatabase({ dataDir })
+  capture.mockRestore()
+  try {
+    await database.query('CREATE TABLE queue_owner (value INTEGER)')
+    await database.query('BEGIN IMMEDIATE')
+    await database.query('INSERT INTO queue_owner VALUES (7)')
+    await expect(database.transaction(async () => undefined)).rejects.toThrow(
+      'cannot start a transaction within a transaction'
+    )
+    expect(connection?.isTransaction).toBe(true)
+    let rows: unknown
+    void database.query('SELECT value FROM queue_owner').then((result) => {
+      rows = result
+    })
+    await setImmediate()
+    expect(rows).toEqual([{ value: 7 }])
+    await database.query('ROLLBACK')
+    expect(await database.query('SELECT value FROM queue_owner')).toEqual([])
+    await database.close()
+  } finally {
+    capture.mockRestore()
+    if (connection?.isOpen) connection.close()
+    rmSync(dataDir, { recursive: true, force: true })
+  }
+})
diff --git a/cloud/dev/scripts/prepare-relay-production-capacity-canary.test.mjs b/cloud/dev/scripts/prepare-relay-production-capacity-canary.test.mjs
index 5588bcd27fc..ee30b6340fa 100644
--- a/cloud/dev/scripts/prepare-relay-production-capacity-canary.test.mjs
+++ b/cloud/dev/scripts/prepare-relay-production-capacity-canary.test.mjs
@@ -2,8 +2,7 @@ import assert from 'node:assert/strict'
 import { describe, it } from 'node:test'
 import {
   parseProductionCapacityCellArguments,
-  prepareProductionCapacityCell,
-  PRODUCTION_CAPACITY_CELL_IDS
+  prepareProductionCapacityCell
 } from './prepare-relay-production-capacity-canary.mjs'
 
 const config = {
@@ -63,24 +62,6 @@ function canaryFetch() {
 
 describe('production Relay capacity cell admission', () => {
   it('allows only the serving rollout cells', () => {
-    assert.deepEqual(PRODUCTION_CAPACITY_CELL_IDS, [
-      'production-gce-c7',
-      'production-gce-c8',
-      'production-gce-c9',
-      'production-gce-c10',
-      'production-gce-c13',
-      'production-gce-c14',
-      'production-gce-c15',
-      'production-gce-c16',
-      'production-gce-c19',
-      'production-gce-c20',
-      'production-gce-c21',
-      'production-gce-c22',
-      'production-gce-c23',
-      'production-gce-c24',
-      'production-gce-c25',
-      'production-gce-c26'
-    ])
     assert.deepEqual(parseProductionCapacityCellArguments([
       '--director-origin', 'https://relay.onorca.dev',
       '--cell-origin', 'https://c7.relay.onorca.dev',
diff --git a/cloud/dev/scripts/production-cloud-sql-rollout-lock.test.mjs b/cloud/dev/scripts/production-cloud-sql-rollout-lock.test.mjs
index d79d4f91046..628b09176da 100644
--- a/cloud/dev/scripts/production-cloud-sql-rollout-lock.test.mjs
+++ b/cloud/dev/scripts/production-cloud-sql-rollout-lock.test.mjs
@@ -1,5 +1,4 @@
 import assert from 'node:assert/strict'
-import { readFileSync } from 'node:fs'
 import { test } from 'node:test'
 import {
   LEASED_WORKFLOWS,
@@ -21,7 +20,6 @@ import {
   revisionMintingScripts,
   workflowFiles
 } from './cloud-sql-rollout-lock-census.mjs'
-import { relayWorkflowFile } from './relay-repository.mjs'
 
 const expectedLease = { production: PRODUCTION_LEASE, staging: STAGING_LEASE, selectable: SELECTABLE_LEASE }
 const leasedFiles = Object.keys(LEASED_WORKFLOWS)
@@ -182,29 +180,3 @@ test('census: no workflow rolls out against the shared instance outside the leas
     assert.ok(!(file in NOT_A_CLOUD_SQL_CANDIDATE), `${file} cannot be both leased and a non-candidate`)
   }
 })
-
-// The API and auth deploy scripts share this contract but stay in the private repository.
-const serviceCapScripts = ['dev/scripts/deploy-relay-blue-green.mjs']
-
-test('budgets tagged Cloud Run candidates outside the service-wide instance cap', () => {
-  for (const file of serviceCapScripts) {
-    const script = readFileSync(new URL(`../../${file}`, import.meta.url), 'utf8')
-    assert.match(script, /'--no-traffic'/, file)
-    assert.match(script, /'--max'/, file)
-  }
-  const budget = readFileSync(
-    new URL('../../dev/scripts/relay-cloud-sql-connection-budget.mjs', import.meta.url),
-    'utf8'
-  )
-  assert.match(budget, /directly addressable tagged revisions outside service-level caps/)
-  assert.match(
-    budget,
-    /apiCandidate: retainedDirectorRollback \+ inputs\.apiInstances \* inputs\.apiPoolMax/
-  )
-  const director = readWorkflow(relayWorkflowFile('deploy-relay-production-director.yml'))
-  const capacity = readWorkflow(relayWorkflowFile('deploy-relay-production-capacity-job.yml'))
-  const asia = readWorkflow(relayWorkflowFile('operate-relay-asia-admission.yml'))
-  assert.match(director, /--max-instances "\$\{DIRECTOR_MAX_INSTANCES\}"/)
-  assert.match(capacity, /--max-instances 5/)
-  assert.match(asia, /--max-instances "\$\{DIRECTOR_MAX_INSTANCES\}"/)
-})
diff --git a/cloud/dev/scripts/push-gateway-workflow.test.mjs b/cloud/dev/scripts/push-gateway-workflow.test.mjs
index 3ee4fabe410..5a8349c1855 100644
--- a/cloud/dev/scripts/push-gateway-workflow.test.mjs
+++ b/cloud/dev/scripts/push-gateway-workflow.test.mjs
@@ -309,11 +309,6 @@ test('push credentials cannot assume the shared Relay deploy identity', () => {
   assert.doesNotMatch(terraform('push-gateway.tf'), /member\s*=\s*local\.relay_github_deploy_service_account_member/)
 })
 
-// A latest revision needs a successor even when validation is inert.
-test('dedicated database admits three simultaneous revision pools', () => {
-  assert.match(terraform('push-gateway.tf'), /var\.push_max_instances \* var\.push_database_pool_max \* 3 <= 64/)
-})
-
 test('push has only a dedicated database attachment and a narrowly scoped deployment lease', () => {
   const service = terraform('push-gateway.tf')
   const database = terraform('push-dedicated-database.tf')
diff --git a/cloud/dev/scripts/push-validation-workflow.test.mjs b/cloud/dev/scripts/push-validation-workflow.test.mjs
deleted file mode 100644
index e26769cfeb3..00000000000
--- a/cloud/dev/scripts/push-validation-workflow.test.mjs
+++ /dev/null
@@ -1,48 +0,0 @@
-import assert from 'node:assert/strict'
-import { readFileSync } from 'node:fs'
-import test from 'node:test'
-import { readRelayWorkflow } from './relay-repository.mjs'
-
-const workflow = readRelayWorkflow('push-deploy.yml')
-const position = (name) => {
-  const index = workflow.indexOf(`- name: ${name}`)
-  assert.notEqual(index, -1)
-  return index
-}
-const capability = position('Require image support for inert validation')
-const deploy = position('Deploy the candidate revision with no traffic')
-const activation = position('Retire inert validation and activate the verified image')
-const shift = position('Shift all traffic to the verified candidate')
-
-test('the exact build digest must support validation before production boot', () => {
-  assert.match(workflow, /docker buildx build --push --platform linux\/amd64 --provenance=false --metadata-file/)
-  assert.match(workflow, /containerimage\.digest/)
-  assert.doesNotMatch(workflow, /gcloud artifacts docker images describe/)
-  assert.ok(capability < deploy)
-  const preflight = workflow.slice(capability, deploy)
-  assert.match(preflight, /docker run --rm --network none --entrypoint node "\$\{IMAGE\}"/)
-  assert.match(preflight, /loadPushConfig\(env\)\.mode !== "validation"/)
-  assert.match(preflight, /validation_mode_not_fail_closed/)
-})
-
-test('inert validation and credential checks precede deliberate activation of the same digest', () => {
-  assert.match(workflow.slice(deploy, activation), /--update-env-vars ORCA_PUSH_MODE=validation/)
-  assert.match(workflow.slice(deploy, activation), /\.mode == "validation"/)
-  assert.ok(position('Prove the runtime identity can reach FCM') < activation)
-  const active = workflow.slice(activation, shift)
-  assert.ok(active.indexOf('gcloud run deploy') < active.indexOf('gcloud run revisions delete'))
-  assert.match(active, /--image "\$\{IMAGE\}"/)
-  assert.match(active, /--remove-env-vars ORCA_PUSH_MODE/)
-  assert.match(active, /\.spec\.containers\[0\]\.image == \$image/)
-  assert.match(active, /\.spec\.serviceAccountName == \$account/)
-  assert.match(active, /\.mode == "active"/)
-  assert.ok(active.indexOf('ACTIVATION_ATTEMPTED=true') < active.indexOf('gcloud run deploy'))
-  assert.match(workflow, /deletion below must stop its workers/)
-})
-
-test('production startup connects read-only and gates all background work in validation', () => {
-  const entry = readFileSync(new URL('../../apps/push/src/index.ts', import.meta.url), 'utf8')
-  assert.match(entry, /readOnly: config\.mode === 'validation'/)
-  assert.match(entry, /startPushBackground\(config,/)
-  assert.doesNotMatch(entry, /worker\.start\(/)
-})
diff --git a/cloud/dev/scripts/relay-asia-admission-workflow.test.mjs b/cloud/dev/scripts/relay-asia-admission-workflow.test.mjs
deleted file mode 100644
index 8283d43ca44..00000000000
--- a/cloud/dev/scripts/relay-asia-admission-workflow.test.mjs
+++ /dev/null
@@ -1,375 +0,0 @@
-import assert from 'node:assert/strict'
-import { readFileSync } from 'node:fs'
-import { test } from 'node:test'
-import { relayWorkflowUrl } from './relay-repository.mjs'
-
-const workflow = readFileSync(
-  relayWorkflowUrl('operate-relay-asia-admission.yml'),
-  'utf8'
-)
-const iam = readFileSync(new URL('../../infra/terraform/relay-github-actions.tf', import.meta.url), 'utf8')
-const stagingProof = readFileSync(
-  relayWorkflowUrl('prove-relay-asia-staging.yml'),
-  'utf8'
-)
-const directorWorkflow = readFileSync(
-  relayWorkflowUrl('deploy-relay-production-director.yml'),
-  'utf8'
-)
-const terraformReadme = readFileSync(
-  new URL('../../infra/terraform/README.md', import.meta.url),
-  'utf8'
-)
-const proofIam = readFileSync(
-  new URL('../../infra/terraform/relay-asia-proof-iam.tf', import.meta.url),
-  'utf8'
-)
-const relayTerraform = readFileSync(
-  new URL('../../infra/terraform/relay.tf', import.meta.url),
-  'utf8'
-)
-const rolloutEvidence = readFileSync(
-  new URL('./relay-asia-rollout-evidence.mjs', import.meta.url),
-  'utf8'
-)
-const admissionBudgets = readFileSync(
-  new URL('../../packages/relay-contract/src/admission-budgets.ts', import.meta.url),
-  'utf8'
-)
-
-test('offers the exact audited admission modes under the shared deployment lock', () => {
-  for (const mode of [
-    'inspect', 'initialize', 'verify', 'register', 'configure', 'promote', 'rollback'
-  ]) {
-    assert.match(workflow, new RegExp(`\\b${mode}\\b`))
-  }
-  assert.match(workflow, /production-cloud-sql-rollout/)
-  assert.match(workflow, /relay-staging-mutation/)
-  assert.match(workflow, /selector-generation/)
-  assert.match(workflow, /selector-attempt-id/)
-})
-
-test('requires exact confirmations and uses the existing admin identity', () => {
-  assert.match(workflow, /INITIALIZE_ADMISSION_SELECTOR/)
-  assert.match(workflow, /REGISTER_ASIA_MIGRATION_ONLY/)
-  assert.match(workflow, /PROMOTE_ASIA_GENERAL/)
-  assert.match(workflow, /ROLLBACK_ASIA_MIGRATION_ONLY/)
-  assert.match(workflow, /CONFIGURE_ASIA_DIRECTOR/)
-  assert.match(workflow, /GCP_RELAY_DEPLOY_SERVICE_ACCOUNT/)
-  assert.match(workflow, /id_token_audience: \$\{\{ env\.DIRECTOR_ORIGIN \}\}\/v1\/admin\/drain/)
-  assert.match(iam, /"operate-relay-asia-admission\.yml"/)
-})
-
-test('discovers generation read-only and explicitly initializes only generation zero', () => {
-  assert.match(workflow, /leave empty only for inspect/)
-  assert.match(workflow, /test -z "\$\{EXPECTED_SELECTOR_GENERATION\}"/)
-  assert.match(workflow, /test "\$\{EXPECTED_SELECTOR_GENERATION\}" = 0/)
-  assert.match(workflow, /\^\(0\|\[1-9\]\[0-9\]\*\)\$/)
-  assert.match(workflow, /selector-membership-sha256/)
-  assert.match(workflow, /\^\[a-f0-9\]\{64\}\$/)
-  assert.match(workflow, /director-image-digest/)
-  assert.match(workflow, /\.spec\.containers\[0\]\.image == \$image/)
-})
-
-test('uploads one sanitized machine-readable admission result', () => {
-  assert.match(workflow, /sanitize-relay-asia-admission-result\.mjs/)
-  const upload = /- name: Upload sanitized admission result\n([\s\S]*?)(?=\n      - name:)/
-    .exec(workflow)?.[1]
-  assert.ok(upload)
-  assert.match(
-    upload,
-    /if: \$\{\{ inputs\.mode != 'configure' && steps\.admission-operation\.outcome == 'success' \}\}/
-  )
-  assert.match(upload, /uses: actions\/upload-artifact@v4/)
-  assert.match(
-    upload,
-    /relay-asia-admission-result-\$\{\{ github\.run_id \}\}-\$\{\{ github\.run_attempt \}\}/
-  )
-  assert.match(upload, /path: \$\{\{ runner\.temp \}\}\/relay-asia-admission-result\/result\.json/)
-  assert.match(upload, /if-no-files-found: error/)
-  assert.match(upload, /retention-days: 7/)
-  assert.ok(
-    workflow.indexOf('Upload sanitized admission result') >
-      workflow.indexOf('Upload immutable canary evidence')
-  )
-})
-
-test('binds selector operations and director configuration to reviewed implementations', () => {
-  assert.match(workflow, /operate-relay-asia-admission\.mjs/)
-  assert.match(workflow, /prepare-relay-asia-director-cells\.mjs/)
-  assert.match(workflow, /deploy-relay-blue-green\.mjs/)
-  assert.match(workflow, /--prune-revisions false/)
-  assert.doesNotMatch(workflow, /gcloud secrets versions add/)
-  assert.match(workflow, /orca-cloud-relay-regional-placement-enabled/)
-  assert.match(workflow, /\.valueSource\.secretKeyRef/)
-  assert.match(workflow, /jq -er --arg secret "\$\{REGIONAL_PLACEMENT_SECRET\}"/)
-  assert.doesNotMatch(workflow, /jq -e --arg secret "\$\{REGIONAL_PLACEMENT_SECRET\}"/)
-  assert.doesNotMatch(workflow, /--regional-placement-enabled/)
-  assert.doesNotMatch(workflow, /"\$\{\{ inputs\./)
-  assert.doesNotMatch(workflow, /dns/i)
-})
-
-test('requires immutable staged evidence and a timed production canary before expansion', () => {
-  assert.match(workflow, /actions: read/)
-  assert.match(workflow, /actions\/download-artifact@v4/)
-  assert.match(workflow, /relay-asia-staging-\$\{EVIDENCE_RUN_ID\}-\$\{EVIDENCE_RUN_ATTEMPT\}/)
-  assert.match(workflow, /evidence_kind=staging/)
-  assert.match(workflow, /load-relay-controls\.mjs/)
-  assert.match(workflow, /--controls 1/)
-  assert.match(workflow, /--splices 1/)
-  assert.match(workflow, /--splice-hold-seconds 60/)
-  assert.match(workflow, /--relay-asia-load-principals 1/)
-  assert.match(workflow, /--duration-seconds 300/)
-  assert.match(workflow, /--required-lease-horizons 2/)
-  assert.match(workflow, /pnpm\/action-setup@v4/)
-  assert.match(workflow, /Install exact canary dependencies/)
-  assert.match(workflow, /pnpm install --frozen-lockfile/)
-  assert.match(workflow, /pnpm --filter @orca-cloud\/relay-contract build/)
-  assert.ok(
-    workflow.indexOf('Build the canary Relay contract') <
-      workflow.indexOf('Run a real five-minute canary control and splice')
-  )
-  assert.match(workflow, /--load-report "\$\{RUNNER_TEMP\}\/relay-asia-canary-load\.json"/)
-  assert.match(workflow, /"production-gce-c28":"migration-only","production-gce-c29":"migration-only"/)
-  // C28/C29 promotion downloads C27's canary under exactly this name.
-  assert.match(workflow, /relay-asia-\$\{\{ steps\.inputs\.outputs\.canary_hostname \}\}-canary-\$\{\{ github\.run_id \}\}-\$\{\{ github\.run_attempt \}\}/)
-  assert.match(workflow, /echo "canary_hostname=\$\{canary_cell##\*-\}"/)
-  assert.match(workflow, /id: canary-evidence-upload/)
-  assert.match(workflow, /Return an unproven canary cell to migration-only/)
-  assert.match(workflow, /steps\.canary-evidence-upload\.outcome != 'success'/)
-  assert.match(workflow, /--mode recover-promotion[\s\S]*?--attempt-id "\$\{SELECTOR_ATTEMPT_ID\}"/)
-  assert.match(workflow, /--attempt-id "\$\{SELECTOR_ATTEMPT_ID\}-rollback"/)
-  assert.match(workflow, /evidence_kind=c27/)
-  assert.match(workflow, /orca_relay_runtime_metrics/)
-  assert.match(workflow, /relay-asia-rollout-evidence\.mjs create-canary \\\n\s+--cell-id "\$\{CANARY_CELL\}"/)
-  assert.match(workflow, /retention-days: 7/)
-  assert.match(workflow, /Require the exact director image before promotion/)
-  assert.match(workflow, /DIRECTOR_ORIGIN.*\/v1\/admin\/runtime-status/)
-  assert.match(workflow, /\.imageDigest.*IMAGE_DIGEST/)
-  const provenance = /- name: Verify evidence provenance and rollout binding before authentication\n([\s\S]*?)(?=\n      - id: auth)/
-    .exec(workflow)?.[1]
-  assert.ok(provenance)
-  assert.match(provenance, /\.head_sha \| select\(type == "string" and test\("\^\[a-f0-9\]\{40\}\$"\)\)/)
-  assert.match(provenance, /--commit-sha "\$\{evidence_commit_sha\}"/)
-  assert.doesNotMatch(provenance, /--commit-sha "\$\{GITHUB_SHA\}"/)
-})
-
-test('binds each production promotion wave to its exact evidence and canary', () => {
-  const cases = /case "\$\{TARGET_CELL_IDS\}" in\n([\s\S]*?)\n\s*esac/.exec(workflow)?.[1]
-  assert.ok(cases)
-  const waves = Object.fromEntries(
-    [...cases.matchAll(/^ {14}([a-z0-9,-]+)\)\n([\s\S]*?);;/gm)].map((match) => [match[1], {
-      evidence: /evidence_kind=([a-z0-9]+)/.exec(match[2])?.[1] ?? 'none',
-      canary: /canary_cell=([a-z0-9-]+)/.exec(match[2])?.[1] ?? 'none'
-    }])
-  )
-  assert.deepEqual(waves, {
-    'production-gce-c27': { evidence: 'staging', canary: 'production-gce-c27' },
-    'production-gce-c28,production-gce-c29': { evidence: 'c27', canary: 'none' },
-    'production-gce-c30': { evidence: 'none', canary: 'production-gce-c30' }
-  })
-  assert.match(cases, /\*\) echo "production promotion wave is not reviewed" >&2; exit 1 ;;/)
-  assert.match(workflow, /if test "\$\{evidence_kind\}" = none; then\n\s+test -z "\$\{EVIDENCE_RUN_ID\}"/)
-  assert.doesNotMatch(workflow, /inputs\.cell-ids == /)
-})
-
-test('runs the timed canary and its automatic rollback for C27 and C30 alike', () => {
-  const steps = workflow.split(/\n(?=      - )/)
-  const named = (name) => steps.find((step) => step.includes(`name: ${name}`))
-  for (const name of [
-    'Install exact canary dependencies',
-    'Build the canary Relay contract',
-    'Verify the canary cell state and start the timed canary',
-    'Run a real five-minute canary control and splice',
-    'Collect regional, Relay SQL, and Cloud SQL canary evidence',
-    'Upload immutable canary evidence'
-  ]) {
-    assert.match(named(name), /if: \$\{\{ steps\.inputs\.outputs\.canary == 'true' \}\}/, name)
-  }
-  assert.match(
-    workflow,
-    /if: \$\{\{ inputs\.mode == 'configure' \|\| steps\.inputs\.outputs\.canary == 'true' \}\}/
-  )
-  const rollback = named('Return an unproven canary cell to migration-only')
-  assert.match(
-    rollback,
-    /if: \$\{\{ always\(\) && steps\.inputs\.outputs\.canary == 'true' && steps\.admission-operation\.outcome != 'skipped' && steps\.canary-evidence-upload\.outcome != 'success' \}\}/
-  )
-  assert.match(rollback, /CANARY_CELL: \$\{\{ steps\.inputs\.outputs\.canary_cell \}\}/)
-  assert.match(rollback, /--mode recover-promotion \\\n\s+--cell-ids "\$\{CANARY_CELL\}"/)
-  assert.match(rollback, /--mode rollback \\\n\s+--cell-ids "\$\{CANARY_CELL\}"/)
-  assert.match(rollback, /'\.states\[\$cell\]' <<< "\$\{result\}"\)" = migration-only/)
-  const start = named('Verify the canary cell state and start the timed canary')
-  assert.match(start, /production-gce-c30\)\n\s+verify_cells=production-gce-c30\n\s+expected_states='\{"production-gce-c30":"general"\}'/)
-  assert.match(start, /test "\$\(jq -cS '\.states' <<< "\$\{result\}"\)" = "\$\(jq -cS '\.' <<< "\$\{expected_states\}"\)"/)
-  assert.match(named('Run a real five-minute canary control and splice'), /--duration-seconds 300/)
-})
-
-test('creates staging evidence only after the bounded launch-path load and rollback', () => {
-  assert.match(stagingProof, /runs-on: \[self-hosted, linux, x64, relay-asia-east2-load\]/)
-  assert.doesNotMatch(stagingProof, /group: relay-asia-east2-load/)
-  assert.match(stagingProof, /pnpm\/action-setup@v4/)
-  assert.match(stagingProof, /pnpm install --frozen-lockfile/)
-  assert.match(stagingProof, /pnpm --filter @orca-cloud\/relay-contract build/)
-  assert.match(stagingProof, /run_phase launch 5 5/)
-  assert.doesNotMatch(stagingProof, /run_phase control|run_phase mixed/)
-  assert.match(stagingProof, /--aggregate-controls "\$\(\(controls \* 4\)\)"/)
-  assert.match(stagingProof, /--aggregate-splices "\$\(\(splices \* 4\)\)"/)
-  assert.match(stagingProof, /--required-lease-horizons 2/)
-  assert.match(stagingProof, /--splice-ramp-seconds 120/)
-  assert.match(stagingProof, /--max-generator-rss-growth-mib 512/)
-  assert.match(stagingProof, /--relay-asia-load-principals 32/)
-  assert.match(stagingProof, /ulimit -n/)
-  assert.match(stagingProof, /--region-behavior-probes 1/)
-  assert.match(stagingProof, /--capacity-cell-origin https:\/\/c4\.relay-staging\.onorca\.dev/)
-  assert.match(stagingProof, /--rebind-probes 2/)
-  assert.match(stagingProof, /--skip-rebind-overflow-check/)
-  assert.doesNotMatch(stagingProof, /--request-unit-invites|--regional-fallback-probes/)
-  assert.match(stagingProof, /--aggregate-reader-splices.*echo 5/)
-  assert.match(stagingProof, /--aggregate-reader-bytes.*echo 12582912/)
-  assert.match(stagingProof, /--phase-barrier-dir "\$\{proof_dir\}\/\$\{phase\}-barrier"/)
-  assert.match(stagingProof, /--duration-seconds 210/)
-  assert.match(stagingProof, /trap stop_shards EXIT/)
-  assert.match(stagingProof, /if ! wait "\$\{pid\}"; then failed=1; break; fi/)
-  assert.match(stagingProof, /connectionFailuresByReason/)
-  assert.match(stagingProof, /--launch-report "\$\{proof_dir\}\/launch\.json"/)
-  assert.match(stagingProof, /id-token: write/)
-  assert.match(stagingProof, /STAGING_GCP_RELAY_ASIA_PROOF_WORKLOAD_IDENTITY_PROVIDER/)
-  assert.match(stagingProof, /STAGING_GCP_RELAY_ASIA_PROOF_SERVICE_ACCOUNT/)
-  assert.doesNotMatch(stagingProof, /STAGING_GCP_DEPLOY_SERVICE_ACCOUNT/)
-  assert.doesNotMatch(stagingProof, /STAGING_RELAY_LOAD_ACCESS_TOKEN/)
-  assert.doesNotMatch(stagingProof, /secrets versions access|signing-key-file/)
-  assert.match(stagingProof, /relay-asia-rollout-evidence\.mjs create-staging/)
-  assert.match(stagingProof, /Require the exact staging director image before promotion/)
-  assert.match(stagingProof, /DIRECTOR_ORIGIN.*\/v1\/admin\/runtime-status/)
-  assert.match(stagingProof, /\.imageDigest.*IMAGE_DIGEST/)
-  assert.match(stagingProof, /Return staging C4 to migration-only/)
-  assert.match(stagingProof, /steps\.promote\.outcome != 'skipped'/)
-  assert.match(stagingProof, /--mode recover-promotion[\s\S]*?--attempt-id "\$\{PROMOTE_ATTEMPT_ID\}"/)
-  assert.match(stagingProof, /--mode rollback[\s\S]*?--expected-generation "\$\{promoted_generation\}"/)
-  assert.match(stagingProof, /if: \$\{\{ success\(\) \}\}/)
-  assert.match(
-    stagingProof,
-    /recover:\n    if: \$\{\{ always\(\) && github\.ref == 'refs\/heads\/main' \}\}/
-  )
-  assert.match(stagingProof, /needs: prove/)
-  assert.match(stagingProof, /Recover staging C4 with a fresh identity/)
-  assert.equal((stagingProof.match(/google-github-actions\/auth@v2/g) ?? []).length, 2)
-  assert.equal((stagingProof.match(/--mode recover-promotion/g) ?? []).length, 2)
-  assert.equal((stagingProof.match(/--mode rollback/g) ?? []).length, 2)
-})
-
-test('keeps the private runner below its 64-port Cloud NAT allocation', () => {
-  const profile = /run_phase launch (\d+) (\d+)/.exec(stagingProof)
-  const controlsPerShard = Number(profile?.[1])
-  const splicesPerShard = Number(profile?.[2])
-  const rebindProbes = Number(/--rebind-probes (\d+)/.exec(stagingProof)?.[1])
-  const runtimeStatusSockets = 1
-  assert.ok(
-    controlsPerShard * 4 + splicesPerShard * 4 * 2 + rebindProbes + runtimeStatusSockets < 64
-  )
-})
-
-test('paces one-source staging upgrades below the Relay anti-abuse ceiling', () => {
-  const splicesPerShard = Number(/run_phase launch \d+ (\d+)/.exec(stagingProof)?.[1])
-  const rebindProbes = Number(/--rebind-probes (\d+)/.exec(stagingProof)?.[1])
-  const spliceRampMs = Number(/--splice-ramp-seconds (\d+)/.exec(stagingProof)?.[1]) * 1000
-  const ceiling = Number(
-    /maxPreAuthAttemptsPerSourcePerMinute: (\d+)/.exec(admissionBudgets)?.[1]
-  )
-  const totalSplices = splicesPerShard * 4
-  const attempts = Array.from({ length: totalSplices }, (_, ordinal) =>
-    Math.floor(ordinal * spliceRampMs / (totalSplices - 1))
-  ).flatMap((startedAt) => [startedAt, startedAt])
-  attempts.push(...Array.from({ length: 4 + rebindProbes }, () => 0))
-  const busiestMinute = Math.max(...attempts.map((startedAt) =>
-    attempts.filter((attempt) => attempt >= startedAt && attempt < startedAt + 60_000).length
-  ))
-  assert.ok(busiestMinute < ceiling)
-})
-
-test('reserves rollback time beyond the complete bounded staging proof envelope', () => {
-  const timeoutMinutes = Number(/timeout-minutes: (\d+)/.exec(stagingProof)?.[1])
-  assert.equal(timeoutMinutes, 75)
-  const spliceRampSeconds = Number(/--splice-ramp-seconds (\d+)/.exec(stagingProof)?.[1])
-  const launchSeconds = 180 + spliceRampSeconds + 210 + 60
-  const setupEvidenceAndRollbackSeconds = 10 * 60
-  const envelopeMinutes = Math.ceil((launchSeconds + setupEvidenceAndRollbackSeconds) / 60)
-  assert.ok(timeoutMinutes - envelopeMinutes >= 30)
-  assert.match(stagingProof, /--ramp-seconds 180/)
-  assert.match(stagingProof, /--duration-seconds 210/)
-})
-
-test('binds the staging proof to one least-privilege Google identity', () => {
-  assert.match(
-    proofIam,
-    /github_relay_asia_proof_workflow_file = "prove-relay-asia-staging\.yml"/
-  )
-  assert.match(
-    proofIam,
-    /assertion\.workflow_ref == '\$\{prefix\}\$\{local\.github_relay_asia_proof_workflow_file\}@refs\/heads\/main'/
-  )
-  assert.match(proofIam, /assertion\.environment == 'staging'/)
-  assert.match(proofIam, /assertion\.event_name == 'workflow_dispatch'/)
-  assert.match(proofIam, /roles\/logging\.viewer/)
-  assert.match(proofIam, /roles\/monitoring\.viewer/)
-  assert.match(rolloutEvidence, /readCloudSqlBackends/)
-  assert.match(rolloutEvidence, /cloudSql: await readCloudSqlBackends/)
-  assert.doesNotMatch(proofIam, /compute\.|cloudsql\.|secretmanager\.|roles\/editor|roles\/run\./)
-})
-
-test('keeps the production US-first switch in durable Secret Manager state', () => {
-  assert.match(directorWorkflow, /options: \[preserve, enable, disable\]/)
-  assert.match(directorWorkflow, /default: preserve/)
-  assert.match(directorWorkflow, /gcloud secrets versions add/)
-  assert.match(directorWorkflow, /preserve\) desired="\$\{current\}"/)
-  assert.match(directorWorkflow, /--regional-placement-secret-version "\$\{target_version\}"/)
-  assert.match(directorWorkflow, /test "\$\{CEILING\}" = "\$\{DIRECTOR_MAX_INSTANCES\}"/)
-  assert.match(directorWorkflow, /orca-cloud-relay-regional-placement-enabled/)
-  assert.match(directorWorkflow, /\.valueSource\.secretKeyRef \/\/ \.valueFrom\.secretKeyRef/)
-  assert.match(directorWorkflow, /\.version \/\/ \.key/)
-  assert.match(directorWorkflow, /\.secret \/\/ \.name/)
-  assert.match(workflow, /\.valueSource\.secretKeyRef \/\/ \.valueFrom\.secretKeyRef/)
-  assert.doesNotMatch(directorWorkflow, /--regional-placement-enabled/)
-  assert.doesNotMatch(workflow, /inputs\.regional-placement-enabled/)
-})
-
-test('prunes incompatible production revisions only when explicitly confirmed', () => {
-  assert.match(
-    directorWorkflow,
-    /prune-incompatible-revisions:[\s\S]*?default: false[\s\S]*?type: boolean/
-  )
-  assert.match(directorWorkflow, /PRUNE_INCOMPATIBLE_RELAY_DIRECTOR_REVISIONS/)
-  assert.match(
-    directorWorkflow,
-    /test "\$\{REGIONAL_PLACEMENT_MODE\}" = preserve[\s\S]*?test "\$\{CONFIRMATION\}" = PRUNE_INCOMPATIBLE_RELAY_DIRECTOR_REVISIONS/
-  )
-  assert.match(
-    directorWorkflow,
-    /--prune-revisions "\$\{PRUNE_INCOMPATIBLE_REVISIONS\}"/
-  )
-})
-
-test('documents the exact regional-placement secret bootstrap before director rollout', () => {
-  for (const address of [
-    'google_secret_manager_secret.relay_regional_placement_enabled',
-    'google_secret_manager_secret_version.relay_regional_placement_enabled',
-    'google_secret_manager_secret_iam_member.relay_regional_placement_runtime_accessor',
-    'google_secret_manager_secret_iam_member.relay_regional_placement_deploy_accessor[0]',
-    'google_secret_manager_secret_iam_member.relay_regional_placement_deploy_adder[0]',
-    'google_secret_manager_secret_iam_member.relay_regional_placement_deploy_viewer[0]'
-  ]) {
-    assert.match(terraformReadme, new RegExp(address.replaceAll(/[.[\]]/g, '\\$&')))
-  }
-  assert.match(terraformReadme, /Before the first director deployment/)
-  assert.match(terraformReadme, /Pass the exact environment tfvars/)
-  // The Cloudflare records left with the apps root; a -var for a variable this root no longer
-  // declares is a hard error, so no relay procedure may still tell an operator to pass it.
-  assert.doesNotMatch(terraformReadme, /manage_artifact_dns/)
-  assert.match(terraformReadme, /exactly these six additions/)
-  assert.match(terraformReadme, /version metadata/)
-  assert.match(
-    relayTerraform,
-    /resource "google_secret_manager_secret_iam_member" "relay_regional_placement_deploy_viewer"[\s\S]*?role\s+= "roles\/secretmanager\.viewer"/
-  )
-})
diff --git a/cloud/dev/scripts/relay-load-control-peer.mjs b/cloud/dev/scripts/relay-load-control-peer.mjs
index a075d6bf4e7..26d0ca6a69b 100644
--- a/cloud/dev/scripts/relay-load-control-peer.mjs
+++ b/cloud/dev/scripts/relay-load-control-peer.mjs
@@ -860,11 +860,12 @@ export class RelayLoadControlPeer {
 
   scheduleRefresh(delayMs) {
     if (this.stopped) return
+    const socket = this.socket
+    const reschedule = () => {
+      if (this.socket === socket) this.scheduleRefresh(this.phase.refreshIntervalMs)
+    }
     this.refreshTimer = setTimeout(() => {
-      void this.refresh().then(
-        () => this.scheduleRefresh(this.phase.refreshIntervalMs),
-        () => this.scheduleRefresh(this.phase.refreshIntervalMs)
-      )
+      void this.refresh().then(reschedule, reschedule)
     }, delayMs)
   }
 
diff --git a/cloud/dev/scripts/relay-load-control-peer.test.mjs b/cloud/dev/scripts/relay-load-control-peer.test.mjs
index 95ebd89e1ef..08bb3291a11 100644
--- a/cloud/dev/scripts/relay-load-control-peer.test.mjs
+++ b/cloud/dev/scripts/relay-load-control-peer.test.mjs
@@ -901,3 +901,105 @@ test('shutdown closes both splice legs and waits for the in-flight splice', asyn
   assert.equal(observations.at(-1).type, 'shutdown')
   assert.equal(observations.at(-1).detail.activeSpliceSockets, 0)
 })
+
+function trackRefreshTimers(context) {
+  const schedule = global.setTimeout
+  const cancel = global.clearTimeout
+  const timers = new Map()
+  context.mock.method(global, 'setTimeout', (callback, milliseconds, ...args) => {
+    const timer = schedule(() => {
+      timers.delete(timer)
+      callback(...args)
+    }, milliseconds)
+    timers.set(timer, milliseconds)
+    return timer
+  })
+  context.mock.method(global, 'clearTimeout', (timer) => {
+    timers.delete(timer)
+    cancel(timer)
+  })
+  context.after(() => {
+    for (const timer of timers.keys()) cancel(timer)
+  })
+  return () => [...timers.values()].filter((milliseconds) => milliseconds >= 180_000).length
+}
+
+function reconnectingPeer(context, observations) {
+  const peer = new RelayLoadControlPeer(
+    0,
+    peerOptions({
+      directorOrigin: undefined,
+      targetOrigin: 'https://cell.test',
+      accessToken: 'test-access-token'
+    }),
+    (type) => observations.push(type)
+  )
+  peer.phase.refreshOffsetMs = 180_000
+  peer.phase.refreshIntervalMs = 200_000
+  peer.createSocket = () => {
+    const socket = fakeHandshakeSocket()
+    socket.send = (raw) => {
+      const message = JSON.parse(raw)
+      if (message.type === 'host-hello') {
+        queueMicrotask(() => socket.message(validChallenge(peer)))
+      } else if (message.type === 'host-challenge-ack') {
+        queueMicrotask(() =>
+          socket.message({
+            type: 'host-hello-ack',
+            generation: 1,
+            controlResumeSecret: 'test-secret'
+          })
+        )
+      }
+    }
+    return openOnNextTurn(socket)
+  }
+  context.after(() => peer.shutdown())
+  return peer
+}
+
+for (const outcome of ['success', 'failure']) {
+  for (const owner of ['current connection', 'replacement connection', 'shutdown']) {
+    test(`refresh ${outcome} respects its ${owner} ownership`, async (context) => {
+      const refreshTimers = trackRefreshTimers(context)
+      const observations = []
+      const peer = reconnectingPeer(context, observations)
+      const pendingResponse = deferred()
+      const requestStarted = deferred()
+      let delayResponse = false
+      context.mock.method(global, 'fetch', async () => {
+        if (delayResponse) {
+          requestStarted.resolve()
+          return await pendingResponse.promise
+        }
+        return response({ relayToken: 'test-relay-token' })
+      })
+      await peer.connect()
+      assert.equal(refreshTimers(), 1)
+      clearTimeout(peer.refreshTimer)
+      delayResponse = true
+      peer.scheduleRefresh(0)
+      await requestStarted.promise
+      delayResponse = false
+      if (owner !== 'current connection') {
+        peer.socket.close(1006)
+        await new Promise((resolve) => setImmediate(resolve))
+        await peer.connect()
+        assert.equal(refreshTimers(), 1)
+      }
+      const shutdown = owner === 'shutdown' ? peer.shutdown() : undefined
+      if (outcome === 'success') pendingResponse.resolve(response({ relayToken: 'fresh-token' }))
+      else pendingResponse.reject(new Error('token request failed'))
+      await new Promise((resolve) => setImmediate(resolve))
+      const timersAfterCompletion = refreshTimers()
+      await (shutdown ?? peer.shutdown())
+
+      assert.equal(timersAfterCompletion, owner === 'shutdown' ? 0 : 1)
+      assert.equal(refreshTimers(), 0)
+      assert.equal(
+        observations.filter((type) => type === 'refresh').length,
+        owner === 'current connection' && outcome === 'success' ? 1 : 0
+      )
+    })
+  }
+}
diff --git a/cloud/dev/scripts/relay-regional-rehome-workflow.test.mjs b/cloud/dev/scripts/relay-regional-rehome-workflow.test.mjs
deleted file mode 100644
index aabf80a65f0..00000000000
--- a/cloud/dev/scripts/relay-regional-rehome-workflow.test.mjs
+++ /dev/null
@@ -1,269 +0,0 @@
-import assert from 'node:assert/strict'
-import { readFileSync } from 'node:fs'
-import { test } from 'node:test'
-import { fileURLToPath } from 'node:url'
-import { relayWorkflowUrl } from './relay-repository.mjs'
-
-function workflow(name) {
-  return readFileSync(
-    fileURLToPath(relayWorkflowUrl(name)),
-    'utf8'
-  )
-}
-
-test('same-cap wrapper is reusable, canary-bound, and sequential', () => {
-  const wrapper = workflow('deploy-relay-production-same-cap.yml')
-  const job = workflow('deploy-relay-production-same-cap-job.yml')
-  assert.match(wrapper, /options: \[verify, canary-apply, batch-apply, rollback\]/)
-  assert.match(wrapper, /relay-same-cap-canary-\$\{\{ inputs\.canary-run-id \}\}/)
-  assert.match(wrapper, /needs: \[gate, cell_1\]/)
-  assert.match(wrapper, /needs: \[gate, cell_2\]/)
-  assert.match(wrapper, /needs: \[gate, cell_3\]/)
-  assert.match(job, /on:\n  workflow_call:/)
-  assert.match(job, /c27\|c28\|c29\|c30\)/)
-  assert.match(job, /EXPECTED_HARD_CAP=3000/)
-  assert.match(job, /EXPECTED_REGION=asia-east2/)
-  assert.match(job, /--hard-cap "\$\{EXPECTED_HARD_CAP\}"/)
-  assert.match(job, /--regional-rehome-protocol "\$\{DESIRED_REHOME_PROTOCOL\}"/)
-  assert.match(job, /--argjson protocol "\$\{PREDECESSOR_REHOME_PROTOCOL\}"/)
-  assert.match(job, /runtime predecessor mismatch fields=/)
-  // A rollback interrupted between apply and restore must be resumable.
-  assert.match(job, /ROLLBACK_RESUME=true/)
-  assert.match(job, /test "\$\{LIVE_IMAGE_DIGEST\}" = "\$\{DESIRED_IMAGE_DIGEST\}"/)
-  // Resume must skip BOTH the drain (no restart will clear the flag) and the
-  // apply (state already converged), and prove convergence instead.
-  assert.match(
-    job,
-    /Reversibly isolate and drain only the selected cell\n        if: \$\{\{ inputs\.mode != 'verify' && env\.ROLLBACK_RESUME != 'true' \}\}/
-  )
-  assert.match(
-    job,
-    /Apply only the selected same-cap template and MIG\n        if: \$\{\{ inputs\.mode != 'verify' && env\.ROLLBACK_RESUME != 'true' \}\}/
-  )
-  assert.match(
-    job,
-    /Require converged Terraform state and a stable MIG on resume\n        if: \$\{\{ inputs\.mode != 'verify' && env\.ROLLBACK_RESUME == 'true' \}\}/
-  )
-  assert.match(job, /resume found unconverged resources/)
-  // A canary or batch cell that failed before its template apply also
-  // resumes here with template drift from repo changes since its last roll;
-  // only a plan the reviewed validator approves for the image the cell
-  // already serves may pass, and resume still applies nothing.
-  assert.match(job, /requiring reviewed rollback-image drift/)
-  assert.match(
-    job,
-    /--image "\$\{DESIRED_IMAGE\}" \\\n {16}--rollback-image "\$\{DESIRED_IMAGE\}"/
-  )
-  // The relaxation is only safe if the reviewed validator actually runs on
-  // the NON-converged branch, in same-cap-cell mode, with the trust config
-  // the validator requires, restricted to the template-and-MIG change pair.
-  assert.match(
-    job,
-    /if ! terraform -chdir=infra\/terraform show -json[\s\S]{0,220}\| length == 0' >\/dev\/null\n          then\n/
-  )
-  assert.match(
-    job,
-    /requiring reviewed rollback-image drift'\n[\s\S]{0,400}?\n {16}--mode same-cap-cell --cell-id "\$\{TARGET_CELL_ID\}" \\\n/
-  )
-  assert.match(
-    job,
-    /Require converged Terraform state and a stable MIG on resume[\s\S]{0,300}CAPACITY_SERVICE_ACCOUNT: \$\{\{ vars\.PRODUCTION_GCP_RELAY_CAPACITY_SERVICE_ACCOUNT \}\}\n {10}DIRECTOR_RUNTIME_SERVICE_ACCOUNT: \$\{\{ vars\.PRODUCTION_GCP_RELAY_DIRECTOR_RUNTIME_SERVICE_ACCOUNT \}\}/
-  )
-  assert.match(
-    job,
-    /--rollback-image "\$\{DESIRED_IMAGE\}" \\\n {16}--capacity-service-account "\$\{CAPACITY_SERVICE_ACCOUNT\}" \\\n {16}--rehome-director-service-account "\$\{DIRECTOR_RUNTIME_SERVICE_ACCOUNT\}"/
-  )
-  assert.match(
-    job,
-    /host-drain \\\n {16}--regional-rehome-protocol "\$\{DESIRED_REHOME_PROTOCOL\}" \\\n {16}"\$\{POOL_ARGUMENTS\[@\]\}"\)"\n {12}echo "\$\{RESUME_REVIEW\}"\n {12}jq -e '\.changes == 2' <<< "\$\{RESUME_REVIEW\}" >\/dev\/null/
-  )
-  // A resume applies nothing at all, which is what a resume means: the only accepted
-  // unconverged plan is the template-and-MIG rollback-image drift, and it is left pending.
-  const resumeStep = job.slice(
-    job.indexOf('- name: Require converged Terraform state and a stable MIG on resume'),
-    job.indexOf('- name: Apply only the selected same-cap template and MIG')
-  )
-  assert.equal(resumeStep.split('terraform -chdir=infra/terraform apply').length, 1)
-  assert.match(job, /resume requires the isolated migration-only cell/)
-  assert.match(job, /test "\$\{TARGET_INCARNATION\}" = "\$\{SOURCE_INCARNATION\}"/)
-  assert.match(job, /\(.regionalRehomeProtocol \/\/ 0\) == \$protocol/)
-  assert.match(job, /\(\.draining == false or \$drainingOk\)/)
-  // Selector expectations must follow the mutations' returned generations,
-  // not fixed offsets: isolate is a no-op on a cell a failed canary already
-  // isolated, and the restore inspect must expect post-restore membership.
-  assert.match(job, /SELECTOR_GENERATION_AFTER_ISOLATE=\$\{EFFECTIVE_SELECTOR_GENERATION\}/)
-  assert.match(job, /SELECTOR_GENERATION_AFTER_ISOLATE=\$\{ISOLATE_GENERATION\}/)
-  assert.match(job, /--expected-selector-generation "\$\{SELECTOR_GENERATION_AFTER_ISOLATE\}"/)
-  assert.match(job, /--expected-selector-generation "\$\{SELECTOR_GENERATION_AFTER_RESTORE\}"/)
-  assert.match(job, /--expected-migration-only-cells "\$\{RESTORED_MIGRATION_CELLS\}"/)
-  assert.match(job, /--expected-general-cells "\$\{RESTORED_GENERAL_CELLS\}"/)
-  assert.match(job, /FAILSAFE_GENERATION/)
-  // Later batch waves start after ~16-min predecessor rolls, so BOTH evidence
-  // age checks must scale by wave or cell_2+ can never pass; the bound's
-  // per-wave step is the cell job timeout, so the two must move together.
-  assert.match(job, /--required-migration-policy strict \\\n            --wave-index "\$\{WAVE_INDEX\}"/)
-  // Wave 0 must retry freshness-only failures too: one Cloud Monitoring publish
-  // lag at the sample instant is not health evidence, and single-shot wave 0
-  // failed a whole batch on a series that was fresh again a minute later.
-  assert.match(
-    job,
-    /dry-run\.state\.json" \\\n {14}--wave-index "\$\{WAVE_INDEX\}" \\\n {14}--selector-wave-delta "\$\{SELECTOR_WAVE_DELTA\}" --retry-freshness/
-  )
-  assert.doesNotMatch(job, /RETRY_ARGS/)
-  // Break-glass: the override skips the aggregate 15-minute monitor evidence and
-  // nothing else. The live per-wave recheck still runs on the override path, off
-  // the dispatch inputs the rehome inspect below verifies against the director.
-  assert.match(
-    job,
-    /if test -n "\$\{GATE_OVERRIDE_CONFIRMATION\}"; then[\s\S]{0,700}?--no-monitor-state \\\n {14}--expected-selector-generation "\$\{EXPECTED_SELECTOR_GENERATION\}" \\\n {14}--selector-membership-file[\s\S]{0,160}?--wave-index "\$\{WAVE_INDEX\}" \\\n {14}--selector-wave-delta "\$\{SELECTOR_WAVE_DELTA\}" --retry-freshness/
-  )
-  // The override is re-validated here, not trusted from the caller, and it is
-  // bound to the digest this wave installs.
-  assert.match(
-    job,
-    /test "\$\{GATE_OVERRIDE_CONFIRMATION\}" = \\\n {14}"SKIP_RELAY_MONITOR_GATE \$\{TARGET_IMAGE_DIGEST\}"/
-  )
-  assert.match(job, /\[\[ "\$\{GATE_OVERRIDE_REASON\}" =~ \^\[\[:print:\]\]\{12,500\}\$ \]\]/)
-  // Exactly the aggregate-evidence steps are skipped, and only them: every step
-  // that reads or spends the sealed monitor artifact carries the override guard.
-  const overrideSkipped = [
-    'Require fresh aggregate monitor evidence reference',
-    'Download private aggregate monitor evidence',
-    'Verify monitor evidence provenance',
-    "Download this wave's single-use safety authority",
-    'Require safety evidence consumed by this workflow'
-  ]
-  for (const name of overrideSkipped) {
-    assert.match(
-      job,
-      new RegExp(`- name: ${name}\\n {8}if: \\$\\{\\{ inputs\\.mode != 'verify' && inputs\\.gate-override-confirmation == '' \\}\\}`)
-    )
-  }
-  assert.equal(
-    job.match(/inputs\.gate-override-confirmation == ''/g).length,
-    overrideSkipped.length
-  )
-  // The wrapper validates the override before anything runs, passes it to every
-  // cell, seals it into the canary artifact, and prints it in the run summary.
-  assert.match(wrapper, /--gate-override-reason "\$\{GATE_OVERRIDE_REASON\}" \\\n {12}--gate-override-confirmation "\$\{GATE_OVERRIDE_CONFIRMATION\}"\)/)
-  // One per cell job in the serial cell_1..cell_10 chain.
-  assert.equal(
-    wrapper.match(/gate-override-confirmation: \$\{\{ inputs\.gate-override-confirmation \}\}/g).length,
-    10
-  )
-  assert.match(wrapper, /Aggregate monitor gate overridden \(break-glass\)/)
-  assert.match(wrapper, /ACTOR: \$\{\{ github\.actor \}\}/)
-  for (const name of [
-    'Reject previously consumed aggregate safety evidence',
-    'Consume aggregate safety evidence for this exact wave'
-  ]) {
-    assert.match(
-      wrapper,
-      new RegExp(`- name: ${name}\\n {8}if: \\$\\{\\{ inputs\\.mode != 'verify' && inputs\\.gate-override-confirmation == '' \\}\\}`)
-    )
-  }
-  assert.match(job, /timeout-minutes: 75/)
-  // Both age gates step by the cell job timeout above; the constant is
-  // duplicated across the two languages, so pin each copy to it.
-  for (const source of [
-    '../../dev/scripts/relay-monitor-evidence.mjs',
-    '../../apps/relay-ops/src/incident-live-preflight-cli.ts'
-  ]) {
-    const body = readFileSync(fileURLToPath(new URL(source, import.meta.url)), 'utf8')
-    assert.match(body, /WAVE_PREDECESSOR_TIMEOUT_MS = 75 \* 60_000/)
-    assert.match(body, /\^\[0-9\]\$/)
-  }
-  // Aged-evidence replay via job re-runs is fenced: mutations are
-  // single-dispatch, so a failed cell needs a fresh gate and monitor run.
-  assert.match(job, /test "\$\{GITHUB_RUN_ATTEMPT\}" = 1/)
-  for (const index of [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]) {
-    assert.match(wrapper, new RegExp(`wave-index: '${index}'`))
-  }
-  assert.doesNotMatch(job, /EFFECTIVE_SELECTOR_GENERATION \+ 1\)/)
-  assert.doesNotMatch(job, /EFFECTIVE_SELECTOR_GENERATION \+ 2\)/)
-  assert.match(job, /\$region == "us-central1" and \$protocol == 0 and [.]region == null/)
-  assert.match(job, /[.]regionalRehomeProtocol \/\/ 0/)
-  assert.match(job, /runtime predecessor normalized legacy fields=/)
-  assert.match(job, /probe-relay-rehome-trust[.]mjs/)
-  assert.doesNotMatch(job, /service_account: \$\{\{ vars\.PRODUCTION_GCP_RELAY_(?:DIRECTOR_)?RUNTIME_SERVICE_ACCOUNT/)
-  assert.doesNotMatch(job, /roles\/iam\.serviceAccountTokenCreator/)
-})
-
-// Why: the same-cap caller defines release_lease itself, and a caller-defined job presents the
-// caller as job_workflow_ref, so the pair must admit the caller alongside its reusable job.
-test('shared deploy WIF admits the exact same-cap reusable workflow pair and the caller itself', () => {
-  const terraform = readFileSync(
-    fileURLToPath(new URL('../../infra/terraform/relay-github-actions.tf', import.meta.url)),
-    'utf8'
-  )
-  const providerStart = terraform.indexOf(
-    'resource "google_iam_workload_identity_pool_provider" "github"'
-  )
-  const providerEnd = terraform.indexOf('\nresource "', providerStart + 1)
-  const sharedProvider = terraform.slice(providerStart, providerEnd)
-  assert.ok(providerStart >= 0 && providerEnd > providerStart)
-  assert.match(sharedProvider, /local\.relay_github_workflow_conditions\["github"\]/)
-  // The pairing itself now lives in the clause the provider renders, once per accepted repository.
-  assert.match(
-    terraform,
-    /assertion\.workflow_ref == '\$\{prefix\}\$\{local\.github_production_relay_same_cap_workflow_file\}@refs\/heads\/main' && \(assertion\.job_workflow_ref == '\$\{prefix\}\$\{local\.github_production_relay_same_cap_job_workflow_file\}@refs\/heads\/main' \|\| assertion\.job_workflow_ref == '\$\{prefix\}\$\{local\.github_production_relay_same_cap_workflow_file\}@refs\/heads\/main'\)/
-  )
-})
-
-test('pause and disable precede optional installation and cloud diagnostics', () => {
-  const job = workflow('operate-relay-production-rehome-job.yml')
-  const emergency = job.indexOf('Apply emergency durable pause or disable before diagnostics')
-  const install = job.indexOf('pnpm install --frozen-lockfile')
-  const revision = job.indexOf('Verify exact serving and rollback director identities')
-  assert.ok(emergency > 0)
-  assert.ok(emergency < install)
-  assert.ok(emergency < revision)
-  assert.match(job, /inputs\.mode == 'pause' \|\| inputs\.mode == 'disable'/)
-  assert.match(job, /Seal 24-hour aggregate region observation evidence/)
-  assert.match(job, /--freshness=25h --limit=30000/)
-  assert.match(job, /relay-region-observation-\$\{\{ github\.run_id \}\}-\$\{\{ github\.run_attempt \}\}/)
-  assert.match(job, /test "\$\{RATE_PER_MINUTE\}" = 10/)
-})
-
-test('a failed enable independently restores and verifies durable disabled state', () => {
-  const job = workflow('operate-relay-production-rehome-job.yml')
-  const enable = job.indexOf('Apply exact durable regional rehome enable')
-  const evidence = job.indexOf('Read fresh aggregate completion and abort evidence')
-  const summary = job.indexOf('Publish aggregate control evidence')
-  const recovery = job.indexOf('Fail closed after an unsuccessful enable run')
-  assert.ok(enable > 0 && enable < evidence && evidence < summary && summary < recovery)
-  const recoveryStep = job.slice(recovery)
-  assert.match(
-    recoveryStep,
-    /failure\(\) && inputs\.mode == 'enable' && steps\.google-auth\.outcome == 'success'/
-  )
-  assert.match(recoveryStep, /--mode recover-enable/)
-  assert.match(recoveryStep, /--expected-control-generation "\$\{EXPECTED_CONTROL_GENERATION\}"/)
-  assert.match(recoveryStep, /RECOVER_FAILED_REGIONAL_REHOME_ENABLE/)
-  assert.match(recoveryStep, /\.control\.enabled == false/)
-  assert.doesNotMatch(recoveryStep, /gcloud|pnpm/)
-})
-
-test('director rollout has a strict one-time identity bootstrap', () => {
-  const workflowBody = workflow('deploy-relay-production-director.yml')
-  const script = readFileSync(
-    fileURLToPath(new URL('./deploy-relay-blue-green.mjs', import.meta.url)),
-    'utf8'
-  )
-  assert.match(workflowBody, /BOOTSTRAP_RELAY_DIRECTOR_REHOME_IDENTITY/)
-  assert.match(workflowBody, /--predecessor-runtime-service-account/)
-  assert.match(workflowBody, /--expected-rehome-generation/)
-  assert.match(script, /args\.push\('--service-account', config\['runtime-service-account'\]\)/)
-  assert.match(script, /director predecessor runtime service account does not match/)
-  const candidateProof = script.indexOf('await verifyRehomeDisabled(candidate.origin)')
-  const trafficMove = script.indexOf('operations.updateTraffic(config, [`--to-tags=')
-  assert.ok(candidateProof > 0 && candidateProof < trafficMove)
-  assert.equal(script.indexOf('verifyRehomeDisabled', trafficMove), -1)
-})
-
-test('rehome job pipes every control result through tee under pipefail', () => {
-  const job = workflow('operate-relay-production-rehome-job.yml')
-  // Without `shell: bash` the step exit code is tee's, so a thrown inspect/apply passes green.
-  assert.match(job, /defaults:\n  run:\n(?:    #.*\n)*    shell: bash\n/)
-  assert.ok((job.match(/\| tee "\$\{RUNNER_TEMP\}/g) ?? []).length >= 5)
-})
diff --git a/cloud/dev/scripts/relay-same-cap-script-census.test.mjs b/cloud/dev/scripts/relay-same-cap-script-census.test.mjs
index 1e023ce0c9d..ff2c265ee72 100644
--- a/cloud/dev/scripts/relay-same-cap-script-census.test.mjs
+++ b/cloud/dev/scripts/relay-same-cap-script-census.test.mjs
@@ -13,7 +13,6 @@ import { readRelayWorkflow } from './relay-repository.mjs'
 import { validateCapacityPlan } from './validate-relay-capacity-plan.mjs'
 
 const workflow = readRelayWorkflow('deploy-relay-production-same-cap-job.yml')
-const capacityWorkflow = readRelayWorkflow('deploy-relay-production-capacity-job.yml')
 const production = readFileSync(
   new URL('../../infra/terraform/environments/production.tfvars', import.meta.url),
   'utf8'
@@ -295,74 +294,10 @@ describe('same-cap roll scripts accept every same-cap cell', () => {
     assert.equal(resolveCellShape('production-gce-c31').status, 1)
   })
 
-  it('passes the same-cap allowlist on every canary invocation the job runs', () => {
-    const invocations = workflow.split('prepare-relay-production-capacity-canary.mjs').slice(1)
-    assert.equal(invocations.length, 4)
-    for (const invocation of invocations) {
-      const lines = invocation.split('\n')
-      const end = lines.findIndex((line) => !line.endsWith('\\'))
-      const call = lines.slice(0, end + 1).join(' ')
-      assert.match(call, /--approved-cells same-cap/)
-      // The restore call picks its mode from the cell's entry admission class.
-      assert.match(call, /--mode (isolate|drain|activate|"\$\{RESTORE_MODE\}")/)
-    }
-  })
 
-  it('paces the drain it sends to the selected cell', () => {
-    const drain = workflow.split('--mode drain')[1] ?? ''
-    assert.match(drain.split('\n').slice(0, 2).join(' '), /--pace-window-ms "\$\{DRAIN_PACE_WINDOW_MS\}"/)
-    // 5 min is the cell's DRAIN_PACE_WINDOW_MAX_MS; a 2,700-host cell at 2 min overruns the director's sticky lane.
-    assert.match(workflow, /DRAIN_PACE_WINDOW_MS: '300000'/)
-    // The transition wait has to outlast the pacing window on top of the leases it waits on.
-    assert.match(workflow, /--activity restart-safe[\s\S]*?--timeout-ms 1200000/)
-  })
 
-  it('passes this cell\'s rehome protocol and pool on every plan validation the job runs', () => {
-    const invocations = workflow.split('validate-relay-capacity-plan.mjs').slice(1)
-    assert.equal(invocations.length, 2)
-    for (const invocation of invocations) {
-      const lines = invocation.split('\n')
-      const end = lines.findIndex((line) => !line.trimEnd().endsWith('\\'))
-      const call = lines.slice(0, end + 1).join(' ')
-      assert.match(call, /--mode same-cap-cell/)
-      assert.match(call, /--regional-rehome-protocol "\$\{DESIRED_REHOME_PROTOCOL\}"/)
-      assert.match(call, /"\$\{POOL_ARGUMENTS\[@\]\}"/)
-    }
-    // Each of those steps must build the flag from the resolved pool, and only when there is one.
-    const builders = workflow.split(
-      'if test -n "${EXPECTED_DATABASE_POOL_MAX}"; then\n' +
-        '            POOL_ARGUMENTS=(--database-pool-max "${EXPECTED_DATABASE_POOL_MAX}")'
-    )
-    assert.equal(builders.length, 3)
-    assert.equal(workflow.split('POOL_ARGUMENTS=()').length, 3)
-  })
 
-  // One cell's compute path and nothing else: the template and the MIG bound to it. The cell
-  // backend service stays out because the capacity role has no compute.backendServices.update,
-  // so naming it fails the apply after the MIG has already rolled.
-  it('targets exactly this cell template and MIG on every plan the job runs', () => {
-    const plans = workflow.split('terraform -chdir=infra/terraform plan').slice(1)
-    assert.equal(plans.length, 2)
-    for (const plan of plans) {
-      const lines = plan.split('\n')
-      const end = lines.findIndex((line) => !line.trimEnd().endsWith('\\'))
-      const call = lines.slice(0, end + 1).join('\n')
-      assert.deepEqual(
-        [...call.matchAll(/-target=([\w.]+)\[\\"\$\{TARGET_CELL_ID\}\\"\]/g)]
-          .map(([, resource]) => resource),
-        [
-          'google_compute_instance_template.relay_gce_cell',
-          'google_compute_instance_group_manager.relay_gce_cell'
-        ]
-      )
-      // Any target that is not one of those two, or not scoped to this cell, fails here.
-      assert.equal(call.split('-target=').length, 3)
-    }
-  })
 
-  it('never names a backend service on any plan or apply in the job', () => {
-    assert.equal(workflow.includes('google_compute_backend_service'), false)
-  })
 
   it('validates a correct plan for every wave cell at that cell\'s rehome protocol', () => {
     const trusted = SAME_CAP_CELLS.filter((cell) => REHOME_SOURCE_CELLS.has(cell))
@@ -569,25 +504,6 @@ describe('same-cap roll scripts accept every same-cap cell', () => {
     )
   })
 
-  it('pins the capacity identity on every plan validation the job runs', () => {
-    const invocations = workflow.split('validate-relay-capacity-plan.mjs').slice(1)
-    assert.equal(invocations.length, 2)
-    for (const invocation of invocations) {
-      const lines = invocation.split('\n')
-      const end = lines.findIndex((line) => !line.trimEnd().endsWith('\\'))
-      assert.match(
-        lines.slice(0, end + 1).join(' '),
-        /--capacity-service-account "\$\{CAPACITY_SERVICE_ACCOUNT\}"/
-      )
-    }
-    // Both steps must read it from the same repository variable the job already requires.
-    assert.equal(
-      workflow.split(
-        'CAPACITY_SERVICE_ACCOUNT: ${{ vars.PRODUCTION_GCP_RELAY_CAPACITY_SERVICE_ACCOUNT }}'
-      ).length,
-      4
-    )
-  })
 
   it('decides the predecessor draining rule from the real block, for both classes', () => {
     // A zero-host cell sheds nothing, and a failed canary's own drain leaves the flag set
@@ -777,29 +693,5 @@ describe('same-cap roll scripts accept every same-cap cell', () => {
     assert.equal(rolls('resume', { changes: 0 }), 'no-replace')
     assert.equal(rolls('none', { changes: 0 }), 'no-replace')
   })
-
-  it('waits on the image a stranded cell actually serves', () => {
-    const isolate = workflow
-      .split('name: Reversibly isolate and drain only the selected cell')[1]
-      .split('\n      - id:')[0]
-    assert.match(isolate, /--expected-image-digests "\$\{PREDECESSOR_IMAGE_DIGEST\}"/)
-    // A stranded cell has to come back on a new process, which is what clears the drain.
-    const after = workflow
-      .split('name: Verify new incarnation, exact image, protocol, and durable safety')[1]
-      .split('\n      - name:')[0]
-    assert.match(after, /test "\$\{TARGET_INCARNATION\}" != "\$\{SOURCE_INCARNATION\}"/)
-    assert.match(after, /if test "\$\{ROLLBACK_RESUME\}" = true; then/)
-  })
-
-  it('leaves the US-only capacity job on the default allowlist', () => {
-    assert.doesNotMatch(capacityWorkflow, /--approved-cells/)
-  })
 })
 
-// Both trusted versions must prove the same authenticated drain boundary.
-it('proves rehome trust for protocol 3 on forward and rollback rolls', () => {
-  const step = workflow.split('name: Prove exact per-host trust and idempotent no-neighbor behavior')[1].split('\n      - name:')[0]
-  assert.match(step, /inputs\.rollback-rehome-protocol != '0'/)
-  assert.match(step, /inputs\.target-rehome-protocol != '0'/)
-  assert.match(step, /probe-relay-rehome-trust\.mjs/)
-})
diff --git a/cloud/package.json b/cloud/package.json
index 545f5387bcf..c029b06d6fa 100644
--- a/cloud/package.json
+++ b/cloud/package.json
@@ -20,13 +20,13 @@
     "load:relay:model": "node dev/scripts/run-relay-load-model.mjs",
     "load:relay:recovery-gate": "node dev/scripts/run-relay-recovery-wave-gate.mjs",
     "ops:relay": "pnpm --filter @orca-cloud/relay-ops dev",
-    "pretest": "node --test dev/scripts/capture-terraform-plan-baseline.test.mjs dev/scripts/operate-relay-asia-admission.test.mjs dev/scripts/prepare-relay-asia-director-cells.test.mjs dev/scripts/prepare-relay-asia-topology-input.test.mjs dev/scripts/production-cloud-sql-rollout-lock.test.mjs dev/scripts/read-relay-serving-regional-placement-version.test.mjs dev/scripts/relay-asia-admission-workflow.test.mjs dev/scripts/relay-asia-rollout-evidence.test.mjs dev/scripts/relay-asia-topology-workflow.test.mjs dev/scripts/relay-cloud-sql-connection-budget.test.mjs dev/scripts/relay-load-reader-evidence.test.mjs dev/scripts/relay-lock-contention-alerts.test.mjs dev/scripts/relay-region-hint-metrics.test.mjs dev/scripts/relay-staging-deploy-identity.test.mjs dev/scripts/sanitize-relay-asia-admission-result.test.mjs dev/scripts/terraform-root-partition.test.mjs dev/scripts/validate-relay-asia-topology-plan.test.mjs ../.github/actions/cloud-sql-rollout-lease/action-contract.test.mjs ../.github/actions/cloud-sql-rollout-lease/storage-lease.test.mjs",
-    "test": "pnpm -r test && node --test dev/scripts/classify-relay-production-capacity-director.test.mjs dev/scripts/classify-relay-staging-bootstrap.test.mjs dev/scripts/deploy-relay-blue-green.test.mjs dev/scripts/deploy-relay-gce-candidate.test.mjs dev/scripts/deploy-relay-gce-multi-target.test.mjs dev/scripts/github-smoke-token.test.mjs dev/scripts/infra.test.mjs dev/scripts/operate-relay-regional-rehome.test.mjs dev/scripts/power-staging-relay.test.mjs dev/scripts/prepare-relay-capacity-canary.test.mjs dev/scripts/prepare-relay-production-capacity-canary.test.mjs dev/scripts/probe-relay-legacy-admission.test.mjs dev/scripts/probe-relay-rehome-trust.test.mjs dev/scripts/production-cell-image-digest-consistency.test.mjs dev/scripts/push-gateway-workflow.test.mjs dev/scripts/push-gateway-recovery.test.mjs dev/scripts/push-validation-workflow.test.mjs dev/scripts/read-relay-production-capacity-identity.test.mjs dev/scripts/relay-admin-endpoint-retry-workflow.test.mjs dev/scripts/relay-admin-transient-retry.test.mjs dev/scripts/relay-admission-selector.test.mjs dev/scripts/relay-gce-terraform-fence.test.mjs dev/scripts/relay-load-connection-failure.test.mjs dev/scripts/relay-load-control-peer.test.mjs dev/scripts/relay-load-director-capacity-gate.test.mjs dev/scripts/relay-load-model.test.mjs dev/scripts/relay-load-phase-barrier.test.mjs dev/scripts/relay-load-placement-boundary.test.mjs dev/scripts/relay-load-profile.test.mjs dev/scripts/relay-load-rebind-boundary.test.mjs dev/scripts/relay-load-region-behavior.test.mjs dev/scripts/relay-load-request-unit-boundary.test.mjs dev/scripts/relay-load-run-lifecycle.test.mjs dev/scripts/relay-monitor-evidence.test.mjs dev/scripts/relay-production-capacity-wave.test.mjs dev/scripts/relay-production-capacity-workflow.test.mjs dev/scripts/relay-production-identity-boundaries.test.mjs dev/scripts/relay-production-same-cap-wave.test.mjs dev/scripts/relay-public-workflow-contract.test.mjs dev/scripts/relay-recovery-wave-gate.test.mjs dev/scripts/relay-region-observation-evidence.test.mjs dev/scripts/relay-regional-rehome-workflow.test.mjs dev/scripts/relay-rehome-aggregate-evidence.test.mjs dev/scripts/relay-repository.test.mjs dev/scripts/relay-same-cap-script-census.test.mjs dev/scripts/relay-same-cap-shadow-gate.test.mjs dev/scripts/relay-staging-c4-refresh-workflow.test.mjs dev/scripts/relay-staging-capacity-identity.test.mjs dev/scripts/staging-relay-apply-guard.test.mjs dev/scripts/validate-relay-capacity-plan.test.mjs dev/scripts/verify-relay-capacity-transition.test.mjs dev/scripts/verify-relay-legacy-bootstrap.test.mjs dev/scripts/workload-identity-attribute-conditions.test.mjs",
+    "pretest": "node --test dev/scripts/capture-terraform-plan-baseline.test.mjs dev/scripts/operate-relay-asia-admission.test.mjs dev/scripts/prepare-relay-asia-director-cells.test.mjs dev/scripts/prepare-relay-asia-topology-input.test.mjs dev/scripts/production-cloud-sql-rollout-lock.test.mjs dev/scripts/read-relay-serving-regional-placement-version.test.mjs dev/scripts/relay-asia-rollout-evidence.test.mjs dev/scripts/relay-asia-topology-workflow.test.mjs dev/scripts/relay-cloud-sql-connection-budget.test.mjs dev/scripts/relay-load-reader-evidence.test.mjs dev/scripts/relay-lock-contention-alerts.test.mjs dev/scripts/relay-region-hint-metrics.test.mjs dev/scripts/relay-staging-deploy-identity.test.mjs dev/scripts/sanitize-relay-asia-admission-result.test.mjs dev/scripts/terraform-root-partition.test.mjs dev/scripts/validate-relay-asia-topology-plan.test.mjs ../.github/actions/cloud-sql-rollout-lease/action-contract.test.mjs ../.github/actions/cloud-sql-rollout-lease/storage-lease.test.mjs",
+    "test": "pnpm -r test && node --test dev/scripts/classify-relay-production-capacity-director.test.mjs dev/scripts/classify-relay-staging-bootstrap.test.mjs dev/scripts/deploy-relay-blue-green.test.mjs dev/scripts/deploy-relay-gce-candidate.test.mjs dev/scripts/deploy-relay-gce-multi-target.test.mjs dev/scripts/github-smoke-token.test.mjs dev/scripts/infra.test.mjs dev/scripts/operate-relay-regional-rehome.test.mjs dev/scripts/power-staging-relay.test.mjs dev/scripts/prepare-relay-capacity-canary.test.mjs dev/scripts/prepare-relay-production-capacity-canary.test.mjs dev/scripts/probe-relay-legacy-admission.test.mjs dev/scripts/probe-relay-rehome-trust.test.mjs dev/scripts/production-cell-image-digest-consistency.test.mjs dev/scripts/push-gateway-workflow.test.mjs dev/scripts/push-gateway-recovery.test.mjs dev/scripts/read-relay-production-capacity-identity.test.mjs dev/scripts/relay-admin-endpoint-retry-workflow.test.mjs dev/scripts/relay-admin-transient-retry.test.mjs dev/scripts/relay-admission-selector.test.mjs dev/scripts/relay-gce-terraform-fence.test.mjs dev/scripts/relay-load-connection-failure.test.mjs dev/scripts/relay-load-control-peer.test.mjs dev/scripts/relay-load-director-capacity-gate.test.mjs dev/scripts/relay-load-model.test.mjs dev/scripts/relay-load-phase-barrier.test.mjs dev/scripts/relay-load-placement-boundary.test.mjs dev/scripts/relay-load-profile.test.mjs dev/scripts/relay-load-rebind-boundary.test.mjs dev/scripts/relay-load-region-behavior.test.mjs dev/scripts/relay-load-request-unit-boundary.test.mjs dev/scripts/relay-load-run-lifecycle.test.mjs dev/scripts/relay-monitor-evidence.test.mjs dev/scripts/relay-production-capacity-wave.test.mjs dev/scripts/relay-production-capacity-workflow.test.mjs dev/scripts/relay-production-identity-boundaries.test.mjs dev/scripts/relay-production-same-cap-wave.test.mjs dev/scripts/relay-public-workflow-contract.test.mjs dev/scripts/relay-recovery-wave-gate.test.mjs dev/scripts/relay-region-observation-evidence.test.mjs dev/scripts/relay-rehome-aggregate-evidence.test.mjs dev/scripts/relay-repository.test.mjs dev/scripts/relay-same-cap-script-census.test.mjs dev/scripts/relay-same-cap-shadow-gate.test.mjs dev/scripts/relay-staging-c4-refresh-workflow.test.mjs dev/scripts/relay-staging-capacity-identity.test.mjs dev/scripts/staging-relay-apply-guard.test.mjs dev/scripts/validate-relay-capacity-plan.test.mjs dev/scripts/verify-relay-capacity-transition.test.mjs dev/scripts/verify-relay-legacy-bootstrap.test.mjs dev/scripts/workload-identity-attribute-conditions.test.mjs",
     "typecheck": "pnpm -r typecheck"
   },
   "devDependencies": {
     "@types/node": "^24.10.0",
-    "tsx": "^4.21.0",
+    "tsx": "^4.23.15",
     "typescript": "^5.9.3",
     "vitest": "^4.1.11"
   }
diff --git a/cloud/pnpm-lock.yaml b/cloud/pnpm-lock.yaml
index 4849a4ecea6..6042ee85cd4 100644
--- a/cloud/pnpm-lock.yaml
+++ b/cloud/pnpm-lock.yaml
@@ -12,14 +12,14 @@ importers:
         specifier: ^24.10.0
         version: 24.13.2
       tsx:
-        specifier: ^4.21.0
-        version: 4.22.4
+        specifier: ^4.23.15
+        version: 4.23.15
       typescript:
         specifier: ^5.9.3
         version: 5.9.3
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))
+        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15))
 
   apps/push:
     dependencies:
@@ -65,7 +65,7 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))
+        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4))
 
   apps/relay:
     dependencies:
@@ -114,7 +114,7 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))
+        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4))
 
   apps/relay-fence-broker:
     dependencies:
@@ -139,7 +139,7 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))
+        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4))
 
   apps/relay-ops:
     dependencies:
@@ -164,7 +164,7 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))
+        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4))
 
   packages/postgres-schema:
     devDependencies:
@@ -176,7 +176,7 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))
+        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15))
 
   packages/push-contract:
     dependencies:
@@ -192,7 +192,7 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))
+        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15))
 
   packages/relay-contract:
     dependencies:
@@ -208,7 +208,7 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))
+        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15))
 
 packages:
 
@@ -227,156 +227,312 @@ packages:
     cpu: [ppc64]
     os: [aix]
 
+  '@esbuild/aix-ppc64@0.28.2':
+    resolution: {integrity: sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
   '@esbuild/android-arm64@0.28.1':
     resolution: {integrity: sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [android]
 
+  '@esbuild/android-arm64@0.28.2':
+    resolution: {integrity: sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
   '@esbuild/android-arm@0.28.1':
     resolution: {integrity: sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [android]
 
+  '@esbuild/android-arm@0.28.2':
+    resolution: {integrity: sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
   '@esbuild/android-x64@0.28.1':
     resolution: {integrity: sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [android]
 
+  '@esbuild/android-x64@0.28.2':
+    resolution: {integrity: sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
   '@esbuild/darwin-arm64@0.28.1':
     resolution: {integrity: sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [darwin]
 
+  '@esbuild/darwin-arm64@0.28.2':
+    resolution: {integrity: sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
   '@esbuild/darwin-x64@0.28.1':
     resolution: {integrity: sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [darwin]
 
+  '@esbuild/darwin-x64@0.28.2':
+    resolution: {integrity: sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
   '@esbuild/freebsd-arm64@0.28.1':
     resolution: {integrity: sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [freebsd]
 
+  '@esbuild/freebsd-arm64@0.28.2':
+    resolution: {integrity: sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
   '@esbuild/freebsd-x64@0.28.1':
     resolution: {integrity: sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [freebsd]
 
+  '@esbuild/freebsd-x64@0.28.2':
+    resolution: {integrity: sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
   '@esbuild/linux-arm64@0.28.1':
     resolution: {integrity: sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [linux]
 
+  '@esbuild/linux-arm64@0.28.2':
+    resolution: {integrity: sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
   '@esbuild/linux-arm@0.28.1':
     resolution: {integrity: sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [linux]
 
+  '@esbuild/linux-arm@0.28.2':
+    resolution: {integrity: sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
   '@esbuild/linux-ia32@0.28.1':
     resolution: {integrity: sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [linux]
 
+  '@esbuild/linux-ia32@0.28.2':
+    resolution: {integrity: sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
   '@esbuild/linux-loong64@0.28.1':
     resolution: {integrity: sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==}
     engines: {node: '>=18'}
     cpu: [loong64]
     os: [linux]
 
+  '@esbuild/linux-loong64@0.28.2':
+    resolution: {integrity: sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
   '@esbuild/linux-mips64el@0.28.1':
     resolution: {integrity: sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==}
     engines: {node: '>=18'}
     cpu: [mips64el]
     os: [linux]
 
+  '@esbuild/linux-mips64el@0.28.2':
+    resolution: {integrity: sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
   '@esbuild/linux-ppc64@0.28.1':
     resolution: {integrity: sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==}
     engines: {node: '>=18'}
     cpu: [ppc64]
     os: [linux]
 
+  '@esbuild/linux-ppc64@0.28.2':
+    resolution: {integrity: sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
   '@esbuild/linux-riscv64@0.28.1':
     resolution: {integrity: sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==}
     engines: {node: '>=18'}
     cpu: [riscv64]
     os: [linux]
 
+  '@esbuild/linux-riscv64@0.28.2':
+    resolution: {integrity: sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
   '@esbuild/linux-s390x@0.28.1':
     resolution: {integrity: sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==}
     engines: {node: '>=18'}
     cpu: [s390x]
     os: [linux]
 
+  '@esbuild/linux-s390x@0.28.2':
+    resolution: {integrity: sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
   '@esbuild/linux-x64@0.28.1':
     resolution: {integrity: sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [linux]
 
+  '@esbuild/linux-x64@0.28.2':
+    resolution: {integrity: sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
   '@esbuild/netbsd-arm64@0.28.1':
     resolution: {integrity: sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [netbsd]
 
+  '@esbuild/netbsd-arm64@0.28.2':
+    resolution: {integrity: sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
   '@esbuild/netbsd-x64@0.28.1':
     resolution: {integrity: sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [netbsd]
 
+  '@esbuild/netbsd-x64@0.28.2':
+    resolution: {integrity: sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
   '@esbuild/openbsd-arm64@0.28.1':
     resolution: {integrity: sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [openbsd]
 
+  '@esbuild/openbsd-arm64@0.28.2':
+    resolution: {integrity: sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
   '@esbuild/openbsd-x64@0.28.1':
     resolution: {integrity: sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [openbsd]
 
+  '@esbuild/openbsd-x64@0.28.2':
+    resolution: {integrity: sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
   '@esbuild/openharmony-arm64@0.28.1':
     resolution: {integrity: sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [openharmony]
 
+  '@esbuild/openharmony-arm64@0.28.2':
+    resolution: {integrity: sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
   '@esbuild/sunos-x64@0.28.1':
     resolution: {integrity: sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [sunos]
 
+  '@esbuild/sunos-x64@0.28.2':
+    resolution: {integrity: sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
   '@esbuild/win32-arm64@0.28.1':
     resolution: {integrity: sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [win32]
 
+  '@esbuild/win32-arm64@0.28.2':
+    resolution: {integrity: sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
   '@esbuild/win32-ia32@0.28.1':
     resolution: {integrity: sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [win32]
 
+  '@esbuild/win32-ia32@0.28.2':
+    resolution: {integrity: sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
   '@esbuild/win32-x64@0.28.1':
     resolution: {integrity: sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [win32]
 
+  '@esbuild/win32-x64@0.28.2':
+    resolution: {integrity: sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
   '@hono/node-server@1.19.17':
     resolution: {integrity: sha512-dSneS5qhiauZWGDCeK4o695Xd9nUNjviSZCMQrj10eetr8Uln1ucn6bbphOM6UynAMMtNIzZNSpL9vnASJwrPQ==}
     engines: {node: '>=18.14.1'}
@@ -593,6 +749,11 @@ packages:
     engines: {node: '>=18'}
     hasBin: true
 
+  esbuild@0.28.2:
+    resolution: {integrity: sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA==}
+    engines: {node: '>=18'}
+    hasBin: true
+
   estree-walker@3.0.3:
     resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==}
 
@@ -871,6 +1032,11 @@ packages:
     engines: {node: '>=18.0.0'}
     hasBin: true
 
+  tsx@4.23.15:
+    resolution: {integrity: sha512-Yiex1Ovn8z2xPpOWckIiysV1SSyRMY9BkLF++q0yKiDxCqRhosKfMg3janKkiLBwZ5c/YryloKwGZcrEmtwxKw==}
+    engines: {node: '>=18.0.0'}
+    hasBin: true
+
   tweetnacl@1.0.3:
     resolution: {integrity: sha512-6rt+RN7aOi1nGMyC4Xa5DdYiukl2UWCbcJft7YhxReBGQD7OAM8Pbxw6YMo4r2diNEA8FEmu32YOn9rhaiE5yw==}
 
@@ -1015,81 +1181,159 @@ snapshots:
   '@esbuild/aix-ppc64@0.28.1':
     optional: true
 
+  '@esbuild/aix-ppc64@0.28.2':
+    optional: true
+
   '@esbuild/android-arm64@0.28.1':
     optional: true
 
+  '@esbuild/android-arm64@0.28.2':
+    optional: true
+
   '@esbuild/android-arm@0.28.1':
     optional: true
 
+  '@esbuild/android-arm@0.28.2':
+    optional: true
+
   '@esbuild/android-x64@0.28.1':
     optional: true
 
+  '@esbuild/android-x64@0.28.2':
+    optional: true
+
   '@esbuild/darwin-arm64@0.28.1':
     optional: true
 
+  '@esbuild/darwin-arm64@0.28.2':
+    optional: true
+
   '@esbuild/darwin-x64@0.28.1':
     optional: true
 
+  '@esbuild/darwin-x64@0.28.2':
+    optional: true
+
   '@esbuild/freebsd-arm64@0.28.1':
     optional: true
 
+  '@esbuild/freebsd-arm64@0.28.2':
+    optional: true
+
   '@esbuild/freebsd-x64@0.28.1':
     optional: true
 
+  '@esbuild/freebsd-x64@0.28.2':
+    optional: true
+
   '@esbuild/linux-arm64@0.28.1':
     optional: true
 
+  '@esbuild/linux-arm64@0.28.2':
+    optional: true
+
   '@esbuild/linux-arm@0.28.1':
     optional: true
 
+  '@esbuild/linux-arm@0.28.2':
+    optional: true
+
   '@esbuild/linux-ia32@0.28.1':
     optional: true
 
+  '@esbuild/linux-ia32@0.28.2':
+    optional: true
+
   '@esbuild/linux-loong64@0.28.1':
     optional: true
 
+  '@esbuild/linux-loong64@0.28.2':
+    optional: true
+
   '@esbuild/linux-mips64el@0.28.1':
     optional: true
 
+  '@esbuild/linux-mips64el@0.28.2':
+    optional: true
+
   '@esbuild/linux-ppc64@0.28.1':
     optional: true
 
+  '@esbuild/linux-ppc64@0.28.2':
+    optional: true
+
   '@esbuild/linux-riscv64@0.28.1':
     optional: true
 
+  '@esbuild/linux-riscv64@0.28.2':
+    optional: true
+
   '@esbuild/linux-s390x@0.28.1':
     optional: true
 
+  '@esbuild/linux-s390x@0.28.2':
+    optional: true
+
   '@esbuild/linux-x64@0.28.1':
     optional: true
 
+  '@esbuild/linux-x64@0.28.2':
+    optional: true
+
   '@esbuild/netbsd-arm64@0.28.1':
     optional: true
 
+  '@esbuild/netbsd-arm64@0.28.2':
+    optional: true
+
   '@esbuild/netbsd-x64@0.28.1':
     optional: true
 
+  '@esbuild/netbsd-x64@0.28.2':
+    optional: true
+
   '@esbuild/openbsd-arm64@0.28.1':
     optional: true
 
+  '@esbuild/openbsd-arm64@0.28.2':
+    optional: true
+
   '@esbuild/openbsd-x64@0.28.1':
     optional: true
 
+  '@esbuild/openbsd-x64@0.28.2':
+    optional: true
+
   '@esbuild/openharmony-arm64@0.28.1':
     optional: true
 
+  '@esbuild/openharmony-arm64@0.28.2':
+    optional: true
+
   '@esbuild/sunos-x64@0.28.1':
     optional: true
 
+  '@esbuild/sunos-x64@0.28.2':
+    optional: true
+
   '@esbuild/win32-arm64@0.28.1':
     optional: true
 
+  '@esbuild/win32-arm64@0.28.2':
+    optional: true
+
   '@esbuild/win32-ia32@0.28.1':
     optional: true
 
+  '@esbuild/win32-ia32@0.28.2':
+    optional: true
+
   '@esbuild/win32-x64@0.28.1':
     optional: true
 
+  '@esbuild/win32-x64@0.28.2':
+    optional: true
+
   '@hono/node-server@1.19.17(hono@4.13.7)':
     dependencies:
       hono: 4.13.7
@@ -1195,13 +1439,21 @@ snapshots:
       chai: 6.2.2
       tinyrainbow: 3.1.0
 
-  '@vitest/mocker@4.1.11(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))':
+  '@vitest/mocker@4.1.11(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4))':
     dependencies:
       '@vitest/spy': 4.1.11
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
-      vite: 8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4)
+      vite: 8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4)
+
+  '@vitest/mocker@4.1.11(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15))':
+    dependencies:
+      '@vitest/spy': 4.1.11
+      estree-walker: 3.0.3
+      magic-string: 0.30.21
+    optionalDependencies:
+      vite: 8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15)
 
   '@vitest/pretty-format@4.1.11':
     dependencies:
@@ -1284,6 +1536,35 @@ snapshots:
       '@esbuild/win32-ia32': 0.28.1
       '@esbuild/win32-x64': 0.28.1
 
+  esbuild@0.28.2:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.28.2
+      '@esbuild/android-arm': 0.28.2
+      '@esbuild/android-arm64': 0.28.2
+      '@esbuild/android-x64': 0.28.2
+      '@esbuild/darwin-arm64': 0.28.2
+      '@esbuild/darwin-x64': 0.28.2
+      '@esbuild/freebsd-arm64': 0.28.2
+      '@esbuild/freebsd-x64': 0.28.2
+      '@esbuild/linux-arm': 0.28.2
+      '@esbuild/linux-arm64': 0.28.2
+      '@esbuild/linux-ia32': 0.28.2
+      '@esbuild/linux-loong64': 0.28.2
+      '@esbuild/linux-mips64el': 0.28.2
+      '@esbuild/linux-ppc64': 0.28.2
+      '@esbuild/linux-riscv64': 0.28.2
+      '@esbuild/linux-s390x': 0.28.2
+      '@esbuild/linux-x64': 0.28.2
+      '@esbuild/netbsd-arm64': 0.28.2
+      '@esbuild/netbsd-x64': 0.28.2
+      '@esbuild/openbsd-arm64': 0.28.2
+      '@esbuild/openbsd-x64': 0.28.2
+      '@esbuild/openharmony-arm64': 0.28.2
+      '@esbuild/sunos-x64': 0.28.2
+      '@esbuild/win32-arm64': 0.28.2
+      '@esbuild/win32-ia32': 0.28.2
+      '@esbuild/win32-x64': 0.28.2
+
   estree-walker@3.0.3:
     dependencies:
       '@types/estree': 1.0.9
@@ -1542,13 +1823,19 @@ snapshots:
     optionalDependencies:
       fsevents: 2.3.3
 
+  tsx@4.23.15:
+    dependencies:
+      esbuild: 0.28.2
+    optionalDependencies:
+      fsevents: 2.3.3
+
   tweetnacl@1.0.3: {}
 
   typescript@5.9.3: {}
 
   undici-types@7.18.2: {}
 
-  vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4):
+  vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4):
     dependencies:
       lightningcss: 1.33.0
       picomatch: 4.0.7
@@ -1557,14 +1844,27 @@ snapshots:
       tinyglobby: 0.2.17
     optionalDependencies:
       '@types/node': 24.13.2
-      esbuild: 0.28.1
+      esbuild: 0.28.2
       fsevents: 2.3.3
       tsx: 4.22.4
 
-  vitest@4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4)):
+  vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15):
+    dependencies:
+      lightningcss: 1.33.0
+      picomatch: 4.0.7
+      postcss: 8.5.28
+      rolldown: 1.0.3
+      tinyglobby: 0.2.17
+    optionalDependencies:
+      '@types/node': 24.13.2
+      esbuild: 0.28.2
+      fsevents: 2.3.3
+      tsx: 4.23.15
+
+  vitest@4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4)):
     dependencies:
       '@vitest/expect': 4.1.11
-      '@vitest/mocker': 4.1.11(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))
+      '@vitest/mocker': 4.1.11(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4))
       '@vitest/pretty-format': 4.1.11
       '@vitest/runner': 4.1.11
       '@vitest/snapshot': 4.1.11
@@ -1581,7 +1881,34 @@ snapshots:
       tinyexec: 1.2.4
       tinyglobby: 0.2.17
       tinyrainbow: 3.1.0
-      vite: 8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4)
+      vite: 8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4)
+      why-is-node-running: 2.3.0
+    optionalDependencies:
+      '@types/node': 24.13.2
+    transitivePeerDependencies:
+      - msw
+
+  vitest@4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15)):
+    dependencies:
+      '@vitest/expect': 4.1.11
+      '@vitest/mocker': 4.1.11(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15))
+      '@vitest/pretty-format': 4.1.11
+      '@vitest/runner': 4.1.11
+      '@vitest/snapshot': 4.1.11
+      '@vitest/spy': 4.1.11
+      '@vitest/utils': 4.1.11
+      es-module-lexer: 2.1.0
+      expect-type: 1.3.0
+      magic-string: 0.30.21
+      obug: 2.1.3
+      pathe: 2.0.3
+      picomatch: 4.0.4
+      std-env: 4.1.0
+      tinybench: 2.9.0
+      tinyexec: 1.2.4
+      tinyglobby: 0.2.17
+      tinyrainbow: 3.1.0
+      vite: 8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15)
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@types/node': 24.13.2
diff --git a/config/build-plugins/pdfjs-viewer-assets.ts b/config/build-plugins/pdfjs-viewer-assets.ts
index c212194ec71..a632a7aa2d6 100644
--- a/config/build-plugins/pdfjs-viewer-assets.ts
+++ b/config/build-plugins/pdfjs-viewer-assets.ts
@@ -76,6 +76,9 @@ export function createPdfjsViewerAssetsPlugin(root = pdfjsRoot()): Plugin {
           next()
           return
         }
+        if (response.destroyed) {
+          return
+        }
         response.statusCode = 200
         response.setHeader('Content-Length', size)
         response.setHeader(
@@ -86,7 +89,18 @@ export function createPdfjsViewerAssetsPlugin(root = pdfjsRoot()): Plugin {
           response.end()
           return
         }
-        createReadStream(filePath).pipe(response)
+        const stream = createReadStream(filePath)
+        const stopReading = (): void => {
+          stream.destroy()
+        }
+        response.once('close', stopReading)
+        response.once('error', stopReading)
+        stream.once('close', () => {
+          response.off('close', stopReading)
+          response.off('error', stopReading)
+        })
+        stream.once('error', () => response.destroy())
+        stream.pipe(response)
       })
     },
     writeBundle(options) {
diff --git a/config/build-plugins/plain-node-entry-guard.ts b/config/build-plugins/plain-node-entry-guard.ts
index 7dc017b9c98..c4f58fa521c 100644
--- a/config/build-plugins/plain-node-entry-guard.ts
+++ b/config/build-plugins/plain-node-entry-guard.ts
@@ -16,15 +16,34 @@ type OutputChunk = Rollup.OutputChunk
 // electron, and smoke-loads daemon-entry under plain Node to prove its module
 // graph still resolves.
 
-// Entries executed as plain Node (ELECTRON_RUN_AS_NODE / no electron runtime):
-// forked daemon, parcel-watcher, WSL filesystem and computer sidecars, and the CLI-run
-// agent-hooks entry. require("electron") throws MODULE_NOT_FOUND in all of them.
+// The CLI loads these paths after electron-vite replaces out/main.
+export const CLI_MAIN_ENTRY_NAMES = [
+  'agent-hooks/managed-agent-hook-controls',
+  'orca-profiles/profile-index-store',
+  'codex/managed-home-shell-preflight',
+  'claude-accounts/keychain',
+  ...[
+    'access',
+    'active-location',
+    'storage-classification',
+    'offline-settings',
+    'backup-path',
+    'database-recovery',
+    'domain-reader',
+    'recovery-command'
+  ].map((module) => `persistence/profile-state/profile-state-${module}`),
+  'persistence/profile-state/legacy-json/profile-state-export-path',
+  'persistence/profile-state/legacy-json/profile-state-recovery',
+  'startup/http1-compatibility-marker'
+] as const
+
+// Plain-Node processes and CLI modules cannot load Electron's API.
 const PLAIN_NODE_ENTRY_NAMES = [
   'daemon-entry',
   'parcel-watcher-process-entry',
   'computer-sidecar',
   'wsl-transcript-fs-process-entry',
-  'agent-hooks/managed-agent-hook-controls'
+  ...CLI_MAIN_ENTRY_NAMES
 ] as const
 
 // Entries executed as worker threads of the main process. Electron's module is
@@ -41,7 +60,9 @@ const WORKER_THREAD_ENTRY_NAMES = [
   'session-scanner-worker-entry',
   'main-thread-hang-watchdog-entry',
   'port-scan-command-worker-entry',
-  'usage-scan-worker-entry'
+  'usage-scan-worker-entry',
+  'profile-state-backup-worker-entry',
+  'profile-state-writer-worker-entry'
 ] as const
 
 export const GUARDED_ENTRY_NAMES = [
diff --git a/config/docker/cli-launch-contract/Dockerfile b/config/docker/cli-launch-contract/Dockerfile
index c90cbcd979c..bc9ba2947f4 100644
--- a/config/docker/cli-launch-contract/Dockerfile
+++ b/config/docker/cli-launch-contract/Dockerfile
@@ -1,4 +1,4 @@
-ARG BASE_IMAGE=ubuntu:24.04
+ARG BASE_IMAGE=ubuntu@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90
 FROM ${BASE_IMAGE}
 
 ARG LIBASOUND_PACKAGE=libasound2t64
diff --git a/config/e2e-failure-tracking.json b/config/e2e-failure-tracking.json
new file mode 100644
index 00000000000..fe51488c706
--- /dev/null
+++ b/config/e2e-failure-tracking.json
@@ -0,0 +1 @@
+[]
diff --git a/config/electron-builder-pr-linux.config.cjs b/config/electron-builder-pr-linux.config.cjs
new file mode 100644
index 00000000000..54056e80996
--- /dev/null
+++ b/config/electron-builder-pr-linux.config.cjs
@@ -0,0 +1,8 @@
+const release = require('./electron-builder.config.cjs')
+
+// CI discards these packages after smoke tests; keep release compression unchanged.
+module.exports = {
+  ...release,
+  deb: { ...release.deb, fpm: [...(release.deb.fpm ?? []), '--deb-compression-level=1'] },
+  rpm: { ...release.rpm, fpm: [...(release.rpm.fpm ?? []), '--rpm-compression-level=1'] }
+}
diff --git a/config/electron-builder.config.cjs b/config/electron-builder.config.cjs
index 84c31376833..7032e635d93 100644
--- a/config/electron-builder.config.cjs
+++ b/config/electron-builder.config.cjs
@@ -188,6 +188,9 @@ module.exports = {
     // Why: these repo-only inputs are either bundled into out/ or copied via
     // extraResources. Shipping them in app.asar bloats the desktop bundle.
     '!src{,/**/*}',
+    '!out/orcad{,/**/*}',
+    '!out/orcad-template{,/**/*}',
+    '!out/.orcad-*{,/**/*}',
     '!config{,/**/*}',
     '!docs{,/**/*}',
     '!mobile{,/**/*}',
@@ -207,6 +210,8 @@ module.exports = {
     // it is gitignored, but exclude it defensively so a stray local capture at
     // package time never bloats app.asar.
     '!pr-evidence{,/**/*}',
+    // Local build logs and rollback copies are never application resources.
+    '!notes{,/**/*}',
     // Why: local agent/tooling directories may contain worktree symlink loops;
     // they are never runtime inputs and must not be traversed by electron-builder.
     '!{.claude,.grok,.agents,.codex}{,/**/*}',
@@ -281,6 +286,9 @@ module.exports = {
     'out/main/gemini/**',
     'out/main/grok/**',
     'out/main/hermes/**',
+    'out/main/orca-profiles/profile-index-store.js',
+    'out/main/persistence/profile-state/**',
+    'out/main/startup/http1-compatibility-marker.js',
     'out/main/daemon-entry.js',
     'out/main/session-scanner-service-entry.js',
     'out/main/wsl-transcript-fs-process-entry.js',
diff --git a/config/nsis/orca-installer-hooks.nsh b/config/nsis/orca-installer-hooks.nsh
index d89439073ab..a6fb31f9aec 100644
--- a/config/nsis/orca-installer-hooks.nsh
+++ b/config/nsis/orca-installer-hooks.nsh
@@ -3,6 +3,8 @@
 ; electron-builder accepts exactly ONE `nsis.include` file, so every customInstall /
 ; customUnInstall hook Orca needs lives here.
 
+!include "${__FILEDIR__}\orca-process-check.nsh"
+
 ; ---------------------------------------------------------------------------
 ; Markdown "Open with Orca" (issue #10138)
 ;
diff --git a/config/nsis/orca-process-check.nsh b/config/nsis/orca-process-check.nsh
new file mode 100644
index 00000000000..4acedf5afc8
--- /dev/null
+++ b/config/nsis/orca-process-check.nsh
@@ -0,0 +1,17 @@
+; Defining the hook suppresses electron-builder's process-info declarations.
+!include "getProcessInfo.nsh"
+Var pid
+Var /GLOBAL IsPowerShellAvailable
+
+!macro customCheckAppRunning
+  ; Restricted permits inline commands; test the process query rather than script-file policy.
+  ; Match upstream FIND/KILL's profile behavior so the probe cannot skip a failing profile.
+  nsExec::Exec `"$PowerShellPath" -Command "try { Get-CimInstance -ClassName Win32_Process -ErrorAction Stop | Out-Null; exit 0 } catch { exit 1 }"`
+  Pop $0
+  ; Launch errors, timeouts, and failed queries retain upstream's image-name fallback.
+  StrCpy $IsPowerShellAvailable 1
+  ${if} $0 == 0
+    StrCpy $IsPowerShellAvailable 0
+  ${endIf}
+  !insertmacro _CHECK_APP_RUNNING
+!macroend
diff --git a/config/oxlint-anti-slop.json b/config/oxlint-anti-slop.json
index 4728c38a7e9..ae5bd3c217b 100644
--- a/config/oxlint-anti-slop.json
+++ b/config/oxlint-anti-slop.json
@@ -113,7 +113,7 @@
     // `shapedSidebar` is a persisted onboarding-checklist field and a telemetry enum member;
     // renaming it would orphan saved state.
     {
-      "files": ["**/src/shared/constants.ts", "**/src/shared/onboarding-state-types.ts"],
+      "files": ["**/src/shared/onboarding-defaults.ts", "**/src/shared/onboarding-state-types.ts"],
       "rules": {
         "anti-slop/no-shape-in-symbol-names": "off"
       }
diff --git a/config/patches/@vscode__windows-process-tree@0.8.0.patch b/config/patches/@vscode__windows-process-tree@0.8.0.patch
index 7c930a5fca5..3855e187ec6 100644
--- a/config/patches/@vscode__windows-process-tree@0.8.0.patch
+++ b/config/patches/@vscode__windows-process-tree@0.8.0.patch
@@ -28,13 +28,14 @@ index 855bd4b86f0a3c18c7594212c0e42b6e35bc4001..0bb2af7923b6e6f1f0da40cae8067304
                  "/guard:cf",
                  "/sdl",
 diff --git a/lib/index.js b/lib/index.js
-index 9747a7402600cd252859144d32580ed45c8c93f7..001e81fa8bc89091971d06aaf9d051ba20906615 100644
+index e586cd6ead522a4ff060f5338201f45e3467d639..0ee62c35558ff40e2298c464fdf6e9485f9d181d 100644
 --- a/lib/index.js
 +++ b/lib/index.js
-@@ -7,11 +7,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
+@@ -7,11 +7,14 @@
  exports.getAllProcesses = exports.getProcessTree = exports.getProcessCpuUsage = exports.getProcessList = exports.filterProcessList = exports.buildProcessTree = exports.ProcessDataFlag = void 0;
  const util_1 = require("util");
  const native = process.platform === 'win32' ? require('../build/Release/windows_process_tree.node') : undefined;
++exports.getProcessCreationTime = native === undefined ? undefined : native.getProcessCreationTime;
 +exports.supportedProcessDataFlags = native === undefined ? undefined : native.supportedProcessDataFlags;
  var ProcessDataFlag;
  (function (ProcessDataFlag) {
@@ -45,7 +46,7 @@ index 9747a7402600cd252859144d32580ed45c8c93f7..001e81fa8bc89091971d06aaf9d051ba
  })(ProcessDataFlag = exports.ProcessDataFlag || (exports.ProcessDataFlag = {}));
  // requestInProgress is used for any function that uses CreateToolhelp32Snapshot, as multiple calls
  // to this cannot be done at the same time.
-@@ -66,11 +68,12 @@ function buildProcessTree(rootPid, processList, maxDepth = MAX_FILTER_DEPTH) {
+@@ -66,11 +69,12 @@
      // • the properties are inlined/splatted
      // • the 'ppid' field is omitted
      // • the depth of the tree is limited by `maxDepth`
@@ -60,13 +61,14 @@ index 9747a7402600cd252859144d32580ed45c8c93f7..001e81fa8bc89091971d06aaf9d051ba
      });
      return buildNode(root, maxDepth);
 diff --git a/lib/index.ts b/lib/index.ts
-index f9aa005d9ced9e42885b8a976de5eb5bd61899ee..1b509af0b9065918bcb5cb75f2d7f23821d4a56a 100644
+index 7b53aad05c3682a5c7d814d81a39c3f391ae97e3..284dae185b56241244b4d6bcab9e08f7530b8cf3 100644
 --- a/lib/index.ts
 +++ b/lib/index.ts
-@@ -6,12 +6,15 @@
+@@ -6,12 +6,16 @@
  import { promisify } from 'util';
  
  const native = process.platform === 'win32' ? require('../build/Release/windows_process_tree.node') : undefined;
++export const getProcessCreationTime: ((pid: number) => number | undefined) | undefined = native?.getProcessCreationTime;
 +/** The flag bits this compiled addon reports; undefined off win32. */
 +export const supportedProcessDataFlags: number | undefined = native?.supportedProcessDataFlags;
  import { IProcessInfo, IProcessTreeNode, IProcessCpuInfo } from '@vscode/windows-process-tree';
@@ -80,7 +82,7 @@ index f9aa005d9ced9e42885b8a976de5eb5bd61899ee..1b509af0b9065918bcb5cb75f2d7f238
  }
  
  type RequestCallback = (processList: IProcessInfo[]) => void;
-@@ -81,11 +84,12 @@ export function buildProcessTree(rootPid: number, processList: Iterable<IProcess
+@@ -81,11 +85,12 @@
    // • the properties are inlined/splatted
    // • the 'ppid' field is omitted
    // • the depth of the tree is limited by `maxDepth`
@@ -95,11 +97,33 @@ index f9aa005d9ced9e42885b8a976de5eb5bd61899ee..1b509af0b9065918bcb5cb75f2d7f238
    });
  
 diff --git a/src/addon.cc b/src/addon.cc
-index 9214aff281251e797a70ecb9f6e0b52932a0503f..722edd42ddb4740296bfc47582a181bd6d00c464 100644
+index 5253960ad97496b53c4a02572b64b270302af22f..a801526e20af72b6442c769a8ba1640386c23f46 100644
 --- a/src/addon.cc
 +++ b/src/addon.cc
-@@ -53,6 +53,10 @@ void GetProcessCpuUsage(const Napi::CallbackInfo& args) {
+@@ -50,9 +50,32 @@
+   worker->Queue();
+ }
+
++Napi::Value ReadProcessCreationTime(const Napi::CallbackInfo& args) {
++  Napi::Env env(args.Env());
++  if (args.Length() != 1 || !args[0].IsNumber()) {
++    return env.Undefined();
++  }
++  const double pid = args[0].As<Napi::Number>().DoubleValue();
++  if (!(pid >= 1 && pid <= MAXDWORD) || pid != static_cast<DWORD>(pid)) {
++    return env.Undefined();
++  }
++  ProcessInfo pinfo{};
++  pinfo.pid = static_cast<DWORD>(pid);
++  GetProcessCreationTime(pinfo);
++  if (pinfo.creationTimeMs == 0) {
++    return env.Undefined();
++  }
++  return Napi::Number::New(env, static_cast<double>(pinfo.creationTimeMs));
++}
++
  Napi::Object Init(Napi::Env env, Napi::Object exports) {
++  exports.Set("getProcessCreationTime", Napi::Function::New(env, ReadProcessCreationTime));
    exports.Set("getProcessList", Napi::Function::New(env, GetProcessList));
    exports.Set("getProcessCpuUsage", Napi::Function::New(env, GetProcessCpuUsage));
 +  // Lets a caller prove THIS BINARY understands CREATIONTIME. The JS enum is
@@ -398,10 +422,10 @@ index c9e3457a759c1acaa2644231a4917d45aed951f8..3f26a354477f062b34bd31fbd17be529
    }
  
 diff --git a/typings/windows-process-tree.d.ts b/typings/windows-process-tree.d.ts
-index 08bdac2fdc5ead6f0fcfb5ee5a021e2298c7d523..458981566fc45c0084badff566b1e3791ec1b629 100644
+index 70e242b123e76d43c452007be1ce92a6d224c8bb..b1d0a53c0c18cc16531b394c19bb256bdbaf782f 100644
 --- a/typings/windows-process-tree.d.ts
 +++ b/typings/windows-process-tree.d.ts
-@@ -7,9 +7,17 @@ declare module '@vscode/windows-process-tree' {
+@@ -7,8 +7,17 @@
    export enum ProcessDataFlag {
      None = 0,
      Memory = 1,
@@ -409,18 +433,18 @@ index 08bdac2fdc5ead6f0fcfb5ee5a021e2298c7d523..458981566fc45c0084badff566b1e379
 +    CommandLine = 2,
 +    CreationTime = 4
    }
- 
++
 +  /**
 +   * The flag bits the compiled addon actually understands, or undefined off
 +   * win32. `ProcessDataFlag` above is source; this is what the binary reports,
 +   * so it is the only way to tell a patched build from a stale prebuilt.
 +   */
 +  export const supportedProcessDataFlags: number | undefined;
-+
++  export const getProcessCreationTime: ((pid: number) => number | undefined) | undefined;
+
    export interface IProcessInfo {
      pid: number;
-     ppid: number;
-@@ -24,6 +32,9 @@ declare module '@vscode/windows-process-tree' {
+@@ -24,6 +33,9 @@
       * The string returned is at most 512 chars, strings exceeding this length are truncated.
       */
      commandLine?: string;
@@ -430,7 +454,7 @@ index 08bdac2fdc5ead6f0fcfb5ee5a021e2298c7d523..458981566fc45c0084badff566b1e379
    }
  
    export interface IProcessCpuInfo extends IProcessInfo {
-@@ -35,6 +46,7 @@ declare module '@vscode/windows-process-tree' {
+@@ -35,6 +47,7 @@
      name: string;
      memory?: number;
      commandLine?: string;
diff --git a/config/patches/@xterm__addon-image@0.10.0-beta.300.patch b/config/patches/@xterm__addon-image@0.10.0-beta.300.patch
index c44cb33d2d5..44d6ac32c14 100644
--- a/config/patches/@xterm__addon-image@0.10.0-beta.300.patch
+++ b/config/patches/@xterm__addon-image@0.10.0-beta.300.patch
@@ -1,24 +1,24 @@
 diff --git a/lib/addon-image.js b/lib/addon-image.js
-index 38cf9e8708a5f314b8d587e5428ce7facb0d4076..4807d674d75a5aeaba40cf86972ce0a6158a33f4 100644
+index 38cf9e8708a5f314b8d587e5428ce7facb0d4076..4c5f44e00b0972978d762df5990de86002537649 100644
 --- a/lib/addon-image.js
 +++ b/lib/addon-image.js
 @@ -1,3 +1,3 @@
  /*! For license information please see addon-image.js.LICENSE.txt */
 -!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.ImageAddon=t():e.ImageAddon=t()}(globalThis,()=>(()=>{"use strict";var e={939(e,t){function A(e){return 255&e}function i(e){return e>>>8&255}function s(e){return e>>>16&255}function r(e,t,A,i=255){return((255&i)<<24|(255&A)<<16|(255&t)<<8|255&e)>>>0}function o(e,t,A){return Math.max(e,Math.min(A,t))}function a(e,t,A){return A<0&&(A+=1),A>1&&(A-=1),6*A<1?t+6*(e-t)*A:2*A<1?e:3*A<2?t+(e-t)*(4-6*A):t}function n(e,t,A){return(4278190080|Math.round(A/100*255)<<16|Math.round(t/100*255)<<8|Math.round(e/100*255))>>>0}Object.defineProperty(t,"__esModule",{value:!0}),t.DEFAULT_FOREGROUND=t.DEFAULT_BACKGROUND=t.PALETTE_ANSI_256=t.PALETTE_VT340_GREY=t.PALETTE_VT340_COLOR=t.normalizeHLS=t.normalizeRGB=t.nearestColorIndex=t.fromRGBA8888=t.toRGBA8888=t.alpha=t.blue=t.green=t.red=t.BIG_ENDIAN=void 0,t.BIG_ENDIAN=255===new Uint8Array(new Uint32Array([4278190080]).buffer)[0],t.BIG_ENDIAN&&console.warn("BE platform detected. This version of node-sixel works only on LE properly."),t.red=A,t.green=i,t.blue=s,t.alpha=function(e){return e>>>24&255},t.toRGBA8888=r,t.fromRGBA8888=function(e){return[255&e,e>>8&255,e>>16&255,e>>>24]},t.nearestColorIndex=function(e,t){const r=A(e),o=i(e),a=s(e);let n=Number.MAX_SAFE_INTEGER,h=-1;for(let e=0;e<t.length;++e){const A=r-t[e][0],i=o-t[e][1],s=a-t[e][2],g=A*A+i*i+s*s;if(!g)return e;g<n&&(n=g,h=e)}return h},t.normalizeRGB=n,t.normalizeHLS=function(e,t,A){return function(e,t,A){if(!A){const e=Math.round(255*t);return r(e,e,e)}const i=t<.5?t*(1+A):t+A-t*A,s=2*t-i;return r(o(0,255,Math.round(255*a(i,s,e+1/3))),o(0,255,Math.round(255*a(i,s,e))),o(0,255,Math.round(255*a(i,s,e-1/3))))}((e+240)/360,t/100,A/100)},t.PALETTE_VT340_COLOR=new Uint32Array([n(0,0,0),n(20,20,80),n(80,13,13),n(20,80,20),n(80,20,80),n(20,80,80),n(80,80,20),n(53,53,53),n(26,26,26),n(33,33,60),n(60,26,26),n(33,60,33),n(60,33,60),n(33,60,60),n(60,60,33),n(80,80,80)]),t.PALETTE_VT340_GREY=new Uint32Array([n(0,0,0),n(13,13,13),n(26,26,26),n(40,40,40),n(6,6,6),n(20,20,20),n(33,33,33),n(46,46,46),n(0,0,0),n(13,13,13),n(26,26,26),n(40,40,40),n(6,6,6),n(20,20,20),n(33,33,33),n(46,46,46)]),t.PALETTE_ANSI_256=(()=>{const e=[r(0,0,0),r(205,0,0),r(0,205,0),r(205,205,0),r(0,0,238),r(205,0,205),r(0,250,205),r(229,229,229),r(127,127,127),r(255,0,0),r(0,255,0),r(255,255,0),r(92,92,255),r(255,0,255),r(0,255,255),r(255,255,255)],t=[0,95,135,175,215,255];for(let A=0;A<6;++A)for(let i=0;i<6;++i)for(let s=0;s<6;++s)e.push(r(t[A],t[i],t[s]));for(let t=8;t<=238;t+=10)e.push(r(t,t,t));return new Uint32Array(e)})(),t.DEFAULT_BACKGROUND=r(0,0,0,255),t.DEFAULT_FOREGROUND=r(255,255,255,255)},591(e,t,A){Object.defineProperty(t,"__esModule",{value:!0}),t.decodeAsync=t.decode=t.Decoder=t.DecoderAsync=void 0;const i=A(939),s=A(199),r=function(e){if("undefined"!=typeof Buffer)return Buffer.from(e,"base64");const t=atob(e),A=new Uint8Array(t.length);for(let e=0;e<A.length;++e)A[e]=t.charCodeAt(e);return A}(s.LIMITS.BYTES);let o;const a=new Uint32Array;class n{constructor(){this.bandHandler=e=>1,this.modeHandler=e=>1}handle_band(e){return this.bandHandler(e)}mode_parsed(e){return this.modeHandler(e)}}const h={memoryLimit:134217728,sixelColor:i.DEFAULT_FOREGROUND,fillColor:i.DEFAULT_BACKGROUND,palette:i.PALETTE_VT340_COLOR,paletteLimit:s.LIMITS.PALETTE_SIZE,truncate:!0};function g(e){const t=new n,A={env:{handle_band:t.handle_band.bind(t),mode_parsed:t.mode_parsed.bind(t)}};return WebAssembly.instantiate(o||r,A).then(A=>(o=o||A.module,new d(e,A.instance||A,t)))}t.DecoderAsync=g;class d{constructor(e,t,A){if(this._PIXEL_OFFSET=s.LIMITS.MAX_WIDTH+4,this._canvas=a,this._bandWidths=[],this._maxWidth=0,this._minWidth=s.LIMITS.MAX_WIDTH,this._lastOffset=0,this._currentHeight=0,this._opts=Object.assign({},h,e),this._opts.paletteLimit>s.LIMITS.PALETTE_SIZE)throw new Error(`DecoderOptions.paletteLimit must not exceed ${s.LIMITS.PALETTE_SIZE}`);if(t)A.bandHandler=this._handle_band.bind(this),A.modeHandler=this._initCanvas.bind(this);else{const e=o||(o=new WebAssembly.Module(r));t=new WebAssembly.Instance(e,{env:{handle_band:this._handle_band.bind(this),mode_parsed:this._initCanvas.bind(this)}})}this._instance=t,this._wasm=this._instance.exports,this._chunk=new Uint8Array(this._wasm.memory.buffer,this._wasm.get_chunk_address(),s.LIMITS.CHUNK_SIZE),this._states=new Uint32Array(this._wasm.memory.buffer,this._wasm.get_state_address(),12),this._palette=new Uint32Array(this._wasm.memory.buffer,this._wasm.get_palette_address(),s.LIMITS.PALETTE_SIZE),this._palette.set(this._opts.palette),this._pSrc=new Uint32Array(this._wasm.memory.buffer,this._wasm.get_p0_address()),this._wasm.init(i.DEFAULT_FOREGROUND,0,this._opts.paletteLimit,0)}get _fillColor(){return this._states[0]}get _truncate(){return this._states[8]}get _rasterWidth(){return this._states[6]}get _rasterHeight(){return this._states[7]}get _width(){return this._states[2]?this._states[2]-4:0}get _height(){return this._states[3]}get _level(){return this._states[9]}get _mode(){return this._states[10]}get _paletteLimit(){return this._states[11]}_initCanvas(e){if(2===e){const e=this.width*this.height;if(e>this._canvas.length){if(this._opts.memoryLimit&&4*e>this._opts.memoryLimit)throw this.release(),new Error("image exceeds memory limit");this._canvas=new Uint32Array(e)}this._maxWidth=this._width}else if(1===e)if(2===this._level){const e=Math.min(this._rasterWidth,s.LIMITS.MAX_WIDTH)*this._rasterHeight;if(e>this._canvas.length){if(this._opts.memoryLimit&&4*e>this._opts.memoryLimit)throw this.release(),new Error("image exceeds memory limit");this._canvas=new Uint32Array(e)}}else this._canvas.length<65536&&(this._canvas=new Uint32Array(65536));return 0}_realloc(e,t){const A=e+t;if(A>this._canvas.length){if(this._opts.memoryLimit&&4*A>this._opts.memoryLimit)throw this.release(),new Error("image exceeds memory limit");const e=new Uint32Array(65536*Math.ceil(A/65536));e.set(this._canvas),this._canvas=e}}_handle_band(e){const t=this._PIXEL_OFFSET;let A=this._lastOffset;if(2===this._mode){let i=this.height-this._currentHeight,s=0;for(;s<6&&i>0;)this._canvas.set(this._pSrc.subarray(t*s,t*s+e),A+e*s),s++,i--;this._lastOffset+=e*s,this._currentHeight+=s}else if(1===this._mode){this._realloc(A,6*e),this._maxWidth=Math.max(this._maxWidth,e),this._minWidth=Math.min(this._minWidth,e);for(let i=0;i<6;++i)this._canvas.set(this._pSrc.subarray(t*i,t*i+e),A+e*i);this._bandWidths.push(e),this._lastOffset+=6*e,this._currentHeight+=6}return 0}get width(){return 1!==this._mode?this._width:Math.max(this._maxWidth,this._wasm.current_width())}get height(){return 1!==this._mode?this._height:this._wasm.current_width()?6*this._bandWidths.length+this._wasm.current_height():6*this._bandWidths.length}get palette(){return this._palette.subarray(0,this._paletteLimit)}get memoryUsage(){return this._canvas.byteLength+this._wasm.memory.buffer.byteLength+8*this._bandWidths.length}get properties(){return{width:this.width,height:this.height,mode:this._mode,level:this._level,truncate:!!this._truncate,paletteLimit:this._paletteLimit,fillColor:this._fillColor,memUsage:this.memoryUsage,rasterAttributes:{numerator:this._states[4],denominator:this._states[5],width:this._rasterWidth,height:this._rasterHeight}}}init(e=this._opts.fillColor,t=this._opts.palette,A=this._opts.paletteLimit,i=this._opts.truncate){this._wasm.init(this._opts.sixelColor,e,A,i?1:0),t&&this._palette.set(t.subarray(0,s.LIMITS.PALETTE_SIZE)),this._bandWidths.length=0,this._maxWidth=0,this._minWidth=s.LIMITS.MAX_WIDTH,this._lastOffset=0,this._currentHeight=0}decode(e,t=0,A=e.length){let i=t;for(;i<A;){const t=Math.min(A-i,s.LIMITS.CHUNK_SIZE);this._chunk.set(e.subarray(i,i+=t)),this._wasm.decode(0,t)}}decodeString(e,t=0,A=e.length){let i=t;for(;i<A;){const t=Math.min(A-i,s.LIMITS.CHUNK_SIZE);for(let A=0,s=i;A<t;++A,++s)this._chunk[A]=e.charCodeAt(s);i+=t,this._wasm.decode(0,t)}}get data32(){if(0===this._mode||!this.width||!this.height)return a;const e=this._wasm.current_width();if(2===this._mode){let t=this.height-this._currentHeight;if(t>0){const A=this._PIXEL_OFFSET;let i=this._lastOffset,s=0;for(;s<6&&t>0;)this._canvas.set(this._pSrc.subarray(A*s,A*s+e),i+e*s),s++,t--;t&&this._canvas.fill(this._fillColor,i+e*s)}return this._canvas.subarray(0,this.width*this.height)}if(1===this._mode){if(this._minWidth===this._maxWidth){let t=!1;if(e)if(e!==this._minWidth)t=!0;else{const t=this._PIXEL_OFFSET;let A=this._lastOffset;this._realloc(A,6*e);for(let i=0;i<6;++i)this._canvas.set(this._pSrc.subarray(t*i,t*i+e),A+e*i)}if(!t)return this._canvas.subarray(0,this.width*this.height)}const t=new Uint32Array(this.width*this.height);t.fill(this._fillColor);let A=0,i=0;for(let e=0;e<this._bandWidths.length;++e){const s=this._bandWidths[e];for(let e=0;e<6;++e)t.set(this._canvas.subarray(i,i+=s),A),A+=this.width}if(e){const i=this._PIXEL_OFFSET,s=this._wasm.current_height();for(let r=0;r<s;++r)t.set(this._pSrc.subarray(i*r,i*r+e),A+this.width*r)}return t}return a}get data8(){return new Uint8ClampedArray(this.data32.buffer,0,this.width*this.height*4)}release(){this._canvas=a,this._bandWidths.length=0,this._maxWidth=0,this._minWidth=s.LIMITS.MAX_WIDTH,this._wasm.init(i.DEFAULT_FOREGROUND,0,this._opts.paletteLimit,0)}}t.Decoder=d,t.decode=function(e,t){const A=new d(t);return A.init(),"string"==typeof e?A.decodeString(e):A.decode(e),{width:A.width,height:A.height,data32:A.data32,data8:A.data8}},t.decodeAsync=async function(e,t){const A=await g(t);return A.init(),"string"==typeof e?A.decodeString(e):A.decode(e),{width:A.width,height:A.height,data32:A.data32,data8:A.data8}}},199(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.LIMITS=void 0,t.LIMITS={CHUNK_SIZE:16384,PALETTE_SIZE:4096,MAX_WIDTH:16384,BYTES:"AGFzbQEAAAABJAdgAAF/YAJ/fwBgA39/fwF/YAF/AX9gAABgBH9/f38AYAF/AAIlAgNlbnYLaGFuZGxlX2JhbmQAAwNlbnYLbW9kZV9wYXJzZWQAAwMTEgQAAAAAAQQBAQUBAAACAgAGAwQFAXABBwcFBAEBBwcGCAF/AUGAihoLB9wBDgZtZW1vcnkCABFnZXRfc3RhdGVfYWRkcmVzcwADEWdldF9jaHVua19hZGRyZXNzAAQOZ2V0X3AwX2FkZHJlc3MABRNnZXRfcGFsZXR0ZV9hZGRyZXNzAAYEaW5pdAALBmRlY29kZQAMDWN1cnJlbnRfd2lkdGgADQ5jdXJyZW50X2hlaWdodAAOGV9faW5kaXJlY3RfZnVuY3Rpb25fdGFibGUBAAtfaW5pdGlhbGl6ZQACCXN0YWNrU2F2ZQARDHN0YWNrUmVzdG9yZQASCnN0YWNrQWxsb2MAEwkMAQBBAQsGCgcJDxACDAEBCq5UEgMAAQsFAEGgCAsGAEGQiQELBgBBsIkCCwUAQZAJC+okAQh/QeQIKAIAIQVB4AgoAgAhA0HoCCgCACEIIAFBkIkBaiIJQf8BOgAAIAAgAUgEQCAAQZCJAWohBgNAIAMhBCAGQQFqIQECQCAGLQAAQf8AcSIDQTBrQQlLBEAgASEGDAELQewIKAIAQQJ0QewIaiICKAIAIQADQCACIAMgAEEKbGpBMGsiADYCACABLQAAIQMgAUEBaiIGIQEgA0H/AHEiA0Ewa0EKSQ0ACwsCQAJAAkACQAJAAkACQAJ/AkACQCADQT9rIgBBP00EQCAERQ0BIARBIUYEQAJAQfAIKAIAIgFBASABGyIHIAhqIgFB1AgoAgAiA0gNACADQf//AEoNAANAIANBAnQiAkGgiQJqIgRBoAgpAwA3AwAgAkGoiQJqQaAIKQMANwMAIAJBsIkCakGgCCkDADcDACACQbiJAmpBoAgpAwA3AwAgAkHAiQJqQaAIKQMANwMAIAJByIkCakGgCCkDADcDACACQdCJAmpBoAgpAwA3AwAgAkHYiQJqQaAIKQMANwMAIAJB4IkCakGgCCkDADcDACACQeiJAmpBoAgpAwA3AwAgAkHwiQJqQaAIKQMANwMAIAJB+IkCakGgCCkDADcDACACQYCKAmpBoAgpAwA3AwAgAkGIigJqQaAIKQMANwMAIAJBkIoCakGgCCkDADcDACACQZiKAmpBoAgpAwA3AwAgAkGgigJqQaAIKQMANwMAIAJBqIoCakGgCCkDADcDACACQbCKAmpBoAgpAwA3AwAgAkG4igJqQaAIKQMANwMAIAJBwIoCakGgCCkDADcDACACQciKAmpBoAgpAwA3AwAgAkHQigJqQaAIKQMANwMAIAJB2IoCakGgCCkDADcDACACQeCKAmpBoAgpAwA3AwAgAkHoigJqQaAIKQMANwMAIAJB8IoCakGgCCkDADcDACACQfiKAmpBoAgpAwA3AwAgAkGAiwJqQaAIKQMANwMAIAJBiIsCakGgCCkDADcDACACQZCLAmpBoAgpAwA3AwAgAkGYiwJqQaAIKQMANwMAIAJBoIsCakGgCCkDADcDACACQaiLAmpBoAgpAwA3AwAgAkGwiwJqQaAIKQMANwMAIAJBuIsCakGgCCkDADcDACACQcCLAmpBoAgpAwA3AwAgAkHIiwJqQaAIKQMANwMAIAJB0IsCakGgCCkDADcDACACQdiLAmpBoAgpAwA3AwAgAkHgiwJqQaAIKQMANwMAIAJB6IsCakGgCCkDADcDACACQfCLAmpBoAgpAwA3AwAgAkH4iwJqQaAIKQMANwMAIAJBgIwCakGgCCkDADcDACACQYiMAmpBoAgpAwA3AwAgAkGQjAJqQaAIKQMANwMAIAJBmIwCakGgCCkDADcDACACQaCMAmpBoAgpAwA3AwAgAkGojAJqQaAIKQMANwMAIAJBsIwCakGgCCkDADcDACACQbiMAmpBoAgpAwA3AwAgAkHAjAJqQaAIKQMANwMAIAJByIwCakGgCCkDADcDACACQdCMAmpBoAgpAwA3AwAgAkHYjAJqQaAIKQMANwMAIAJB4IwCakGgCCkDADcDACACQeiMAmpBoAgpAwA3AwAgAkHwjAJqQaAIKQMANwMAIAJB+IwCakGgCCkDADcDACACQYCNAmpBoAgpAwA3AwAgAkGIjQJqQaAIKQMANwMAIAJBkI0CakGgCCkDADcDACACQZiNAmpBoAgpAwA3AwAgAkGwiQZqIARBgAT8CgAAQdQIKAIAQQJ0QcCJCmogBEGABPwKAABB1AgoAgBBAnRB0IkOaiAEQYAE/AoAAEHUCCgCAEECdEHgiRJqIARBgAT8CgAAQdQIKAIAQQJ0QfCJFmogBEGABPwKAABB1AhB1AgoAgAiAkGAAWoiAzYCACABIANIDQEgAkGA/wBIDQALCwJAIABFDQAgCEH//wBLDQBBgIABIAhrIAcgAUH//wBLGyECAkAgAEEBcUUNACACRQ0AIAhBAnRBoIkCaiEDIAIhBCACQQdxIgcEQANAIAMgBTYCACADQQRqIQMgBEEBayEEIAdBAWsiBw0ACwsgAkEBa0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgBEEIayIEDQALCwJAIABBAnFFDQAgAkUNACAIQQJ0QbCJBmohAyACIQQgAkEHcSIHBEADQCADIAU2AgAgA0EEaiEDIARBAWshBCAHQQFrIgcNAAsLIAJBAWtBB0kNAANAIAMgBTYCHCADIAU2AhggAyAFNgIUIAMgBTYCECADIAU2AgwgAyAFNgIIIAMgBTYCBCADIAU2AgAgA0EgaiEDIARBCGsiBA0ACwsCQCAAQQRxRQ0AIAJFDQAgCEECdEHAiQpqIQMgAiEEIAJBB3EiBwRAA0AgAyAFNgIAIANBBGohAyAEQQFrIQQgB0EBayIHDQALCyACQQFrQQdJDQADQCADIAU2AhwgAyAFNgIYIAMgBTYCFCADIAU2AhAgAyAFNgIMIAMgBTYCCCADIAU2AgQgAyAFNgIAIANBIGohAyAEQQhrIgQNAAsLAkAgAEEIcUUNACACRQ0AIAhBAnRB0IkOaiEDIAIhBCACQQdxIgcEQANAIAMgBTYCACADQQRqIQMgBEEBayEEIAdBAWsiBw0ACwsgAkEBa0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgBEEIayIEDQALCwJAIABBEHFFDQAgAkUNACAIQQJ0QeCJEmohAyACIQQgAkEHcSIHBEADQCADIAU2AgAgA0EEaiEDIARBAWshBCAHQQFrIgcNAAsLIAJBAWtBB0kNAANAIAMgBTYCHCADIAU2AhggAyAFNgIUIAMgBTYCECADIAU2AgwgAyAFNgIIIAMgBTYCBCADIAU2AgAgA0EgaiEDIARBCGsiBA0ACwsgAEEgcUUNACACRQ0AIAJBAWshByAIQQJ0QfCJFmohAyACQQdxIgQEQANAIAMgBTYCACADQQRqIQMgAkEBayECIARBAWsiBA0ACwsgB0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgAkEIayICDQALC0HcCEHcCCgCACAAcjYCACAGQQFqIgIgBi0AAEH/AHEiA0E/ayIAQT9LDQQaDAMLAkBB7AgoAgAiBEEBRgRAQfAIKAIAIgNBzAgoAgAiAUkNASADIAFwIQMMAQtB+AgoAgAhAkH0CCgCACEBAkACQCAEQQVHDQAgAUEBRw0AIAJB6QJODQQMAQsgAkHkAEoNA0H8CCgCAEHkAEoNA0GACSgCAEHkAEoNAwsCQCABRQ0AIAFBAkoNACACQfwIKAIAQYAJKAIAIAFBAnRBiAhqKAIAEQIAIQFB8AgoAgAiA0HMCCgCACICTwR/IAMgAnAFIAMLQQJ0QZAJaiABNgIAC0HwCCgCACIDQcwIKAIAIgFJDQAgAyABcCEDCyADQQJ0QZAJaigCACEFDAELIANB/QBxQSFHBEAgCCEBIAYhAgwECyAEQSNHDQQCQEHsCCgCACICQQFGBEBB8AgoAgAiAUHMCCgCACIASQ0BIAEgAHAhAQwBC0H4CCgCACEBQfQIKAIAIQACQAJAIAJBBUcNACAAQQFHDQAgAUHpAkgNAQwHCyABQeQASg0GQfwIKAIAQeQASg0GQYAJKAIAQeQASg0GCwJAIABFDQAgAEECSg0AIAFB/AgoAgBBgAkoAgAgAEECdEGICGooAgARAgAhAEHwCCgCACIBQcwIKAIAIgJPBH8gASACcAUgAQtBAnRBkAlqIAA2AgALQfAIKAIAIgFBzAgoAgAiAEkNACABIABwIQELIAFBAnRBkAlqKAIAIQUMBAsgCCEBIAYhAgtB1AgoAgAhBgNAAkAgASAGSA0AIAZB//8ASg0AIAZBAnQiBEGgiQJqIgZBoAgpAwA3AwAgBEGoiQJqQaAIKQMANwMAIARBsIkCakGgCCkDADcDACAEQbiJAmpBoAgpAwA3AwAgBEHAiQJqQaAIKQMANwMAIARByIkCakGgCCkDADcDACAEQdCJAmpBoAgpAwA3AwAgBEHYiQJqQaAIKQMANwMAIARB4IkCakGgCCkDADcDACAEQeiJAmpBoAgpAwA3AwAgBEHwiQJqQaAIKQMANwMAIARB+IkCakGgCCkDADcDACAEQYCKAmpBoAgpAwA3AwAgBEGIigJqQaAIKQMANwMAIARBkIoCakGgCCkDADcDACAEQZiKAmpBoAgpAwA3AwAgBEGgigJqQaAIKQMANwMAIARBqIoCakGgCCkDADcDACAEQbCKAmpBoAgpAwA3AwAgBEG4igJqQaAIKQMANwMAIARBwIoCakGgCCkDADcDACAEQciKAmpBoAgpAwA3AwAgBEHQigJqQaAIKQMANwMAIARB2IoCakGgCCkDADcDACAEQeCKAmpBoAgpAwA3AwAgBEHoigJqQaAIKQMANwMAIARB8IoCakGgCCkDADcDACAEQfiKAmpBoAgpAwA3AwAgBEGAiwJqQaAIKQMANwMAIARBiIsCakGgCCkDADcDACAEQZCLAmpBoAgpAwA3AwAgBEGYiwJqQaAIKQMANwMAIARBoIsCakGgCCkDADcDACAEQaiLAmpBoAgpAwA3AwAgBEGwiwJqQaAIKQMANwMAIARBuIsCakGgCCkDADcDACAEQcCLAmpBoAgpAwA3AwAgBEHIiwJqQaAIKQMANwMAIARB0IsCakGgCCkDADcDACAEQdiLAmpBoAgpAwA3AwAgBEHgiwJqQaAIKQMANwMAIARB6IsCakGgCCkDADcDACAEQfCLAmpBoAgpAwA3AwAgBEH4iwJqQaAIKQMANwMAIARBgIwCakGgCCkDADcDACAEQYiMAmpBoAgpAwA3AwAgBEGQjAJqQaAIKQMANwMAIARBmIwCakGgCCkDADcDACAEQaCMAmpBoAgpAwA3AwAgBEGojAJqQaAIKQMANwMAIARBsIwCakGgCCkDADcDACAEQbiMAmpBoAgpAwA3AwAgBEHAjAJqQaAIKQMANwMAIARByIwCakGgCCkDADcDACAEQdCMAmpBoAgpAwA3AwAgBEHYjAJqQaAIKQMANwMAIARB4IwCakGgCCkDADcDACAEQeiMAmpBoAgpAwA3AwAgBEHwjAJqQaAIKQMANwMAIARB+IwCakGgCCkDADcDACAEQYCNAmpBoAgpAwA3AwAgBEGIjQJqQaAIKQMANwMAIARBkI0CakGgCCkDADcDACAEQZiNAmpBoAgpAwA3AwAgBEGwiQZqIAZBgAT8CgAAQdQIKAIAQQJ0QcCJCmogBkGABPwKAABB1AgoAgBBAnRB0IkOaiAGQYAE/AoAAEHUCCgCAEECdEHgiRJqIAZBgAT8CgAAQdQIKAIAQQJ0QfCJFmogBkGABPwKAABB1AhB1AgoAgBBgAFqIgY2AgALIAFB//8ATQRAIABBAXEgAWxBAnRBoIkCaiAFNgIAIABBAXZBAXEgAWxBAnRBsIkGaiAFNgIAIABBAnZBAXEgAWxBAnRBwIkKaiAFNgIAIABBA3ZBAXEgAWxBAnRB0IkOaiAFNgIAIABBBHZBAXEgAWxBAnRB4IkSaiAFNgIAIABBBXYgAWxBAnRB8IkWaiAFNgIAQdQIKAIAIQYLIAFBAWohAUHcCEHcCCgCACAAcjYCACACLQAAIQAgAkEBaiIEIQIgAEH/AHEiA0E/ayIAQcAASQ0ACyAECyECQQAhBCACIQYgASEIIANB/QBxQSFGDQELIANBJGsOCgEDAwMDAwMDAwIDC0HsCEIBNwIADAQLQdgIIAFB2AgoAgAiACAAIAFIGyIAQYCAASAAQYCAAUgbNgIADAILQegIIAFB2AgoAgAiACAAIAFIGyIAQYCAASAAQYCAAUgbIgA2AgBB2AggADYCACAAQQRrEAAEQEHoCEEENgIAQdgIQQQ2AgBB0AhBATYCAA8LEAgMAQsCQCADQTtHDQBB7AgoAgAiAEEHSg0AQewIIABBAWo2AgAgAEECdEHwCGpBADYCAAsgAiEGIAQhAyABIQgMAQtBBCEIIAIhBiAEIQMLIAYgCUkNAAsLQeQIIAU2AgBB4AggAzYCAEHoCCAINgIAC9ELAgF+CH9B2AhCBDcDAEGojQJBoAgpAwAiADcDAEGgjQIgADcDAEGYjQIgADcDAEGQjQIgADcDAEGIjQIgADcDAEGAjQIgADcDAEH4jAIgADcDAEHwjAIgADcDAEHojAIgADcDAEHgjAIgADcDAEHYjAIgADcDAEHQjAIgADcDAEHIjAIgADcDAEHAjAIgADcDAEG4jAIgADcDAEGwjAIgADcDAEGojAIgADcDAEGgjAIgADcDAEGYjAIgADcDAEGQjAIgADcDAEGIjAIgADcDAEGAjAIgADcDAEH4iwIgADcDAEHwiwIgADcDAEHoiwIgADcDAEHgiwIgADcDAEHYiwIgADcDAEHQiwIgADcDAEHIiwIgADcDAEHAiwIgADcDAEG4iwIgADcDAEGwiwIgADcDAEGoiwIgADcDAEGgiwIgADcDAEGYiwIgADcDAEGQiwIgADcDAEGIiwIgADcDAEGAiwIgADcDAEH4igIgADcDAEHwigIgADcDAEHoigIgADcDAEHgigIgADcDAEHYigIgADcDAEHQigIgADcDAEHIigIgADcDAEHAigIgADcDAEG4igIgADcDAEGwigIgADcDAEGoigIgADcDAEGgigIgADcDAEGYigIgADcDAEGQigIgADcDAEGIigIgADcDAEGAigIgADcDAEH4iQIgADcDAEHwiQIgADcDAEHoiQIgADcDAEHgiQIgADcDAEHYiQIgADcDAEHQiQIgADcDAEHIiQIgADcDAEHAiQIgADcDAEG4iQIgADcDAEGwiQIgADcDAEGoCCgCACIEQf8AakGAAW0hCAJAIARBgQFIDQBBASEBIAhBAiAIQQJKG0EBayICQQFxIQMgBEGBAk4EQCACQX5xIQIDQCABQQl0IgdBEHJBoIkCakGwiQJBgAT8CgAAIAdBsI0CakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsLIANFDQAgAUEJdEEQckGgiQJqQbCJAkGABPwKAAALAkAgBEEBSA0AIAhBASAIQQFKGyIDQQFxIQUCQCADQQFrIgdFBEBBACEBDAELIANB/v///wdxIQJBACEBA0AgAUEJdCIGQRByQbCJBmpBsIkCQYAE/AoAACAGQZAEckGwiQZqQbCJAkGABPwKAAAgAUECaiEBIAJBAmsiAg0ACwsgBQRAIAFBCXRBEHJBsIkGakGwiQJBgAT8CgAACyAEQQFIDQAgA0EBcSEFIAcEfyADQf7///8HcSECQQAhAQNAIAFBCXQiBkEQckHAiQpqQbCJAkGABPwKAAAgBkGQBHJBwIkKakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsgAUEHdEEEcgVBBAshASAFBEAgAUECdEHAiQpqQbCJAkGABPwKAAALIARBAUgNACADQQFxIQUgBwR/IANB/v///wdxIQJBACEBA0AgAUEJdCIGQRByQdCJDmpBsIkCQYAE/AoAACAGQZAEckHQiQ5qQbCJAkGABPwKAAAgAUECaiEBIAJBAmsiAg0ACyABQQd0QQRyBUEECyEBIAUEQCABQQJ0QdCJDmpBsIkCQYAE/AoAAAsgBEEBSA0AIANBAXEhBSAHBH8gA0H+////B3EhAkEAIQEDQCABQQl0IgZBEHJB4IkSakGwiQJBgAT8CgAAIAZBkARyQeCJEmpBsIkCQYAE/AoAACABQQJqIQEgAkECayICDQALIAFBB3RBBHIFQQQLIQEgBQRAIAFBAnRB4IkSakGwiQJBgAT8CgAACyAEQQFIDQAgA0EBcSEEIAcEfyADQf7///8HcSECQQAhAQNAIAFBCXQiA0EQckHwiRZqQbCJAkGABPwKAAAgA0GQBHJB8IkWakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsgAUEHdEEEcgVBBAshASAERQ0AIAFBAnRB8IkWakGwiQJBgAT8CgAAC0HUCCAIQQd0QQRyNgIAC58TAgh/AX5B5AgoAgAhA0HgCCgCACECQegIKAIAIQcgAUGQiQFqIglB/wE6AAAgACABSARAIABBkIkBaiEIA0AgAiEEIAhBAWohAQJAIAgtAABB/wBxIgJBMGtBCUsEQCABIQgMAQtB7AgoAgBBAnRB7AhqIgUoAgAhAANAIAUgAiAAQQpsakEwayIANgIAIAEtAAAhAiABQQFqIgghASACQf8AcSICQTBrQQpJDQALCwJAAkACQAJAAkACQAJ/AkAgAkE/ayIAQT9NBEAgBEUNASAEQSFGBEBB8AgoAgAiAUEBIAEbIgQgB2ohAQJAIABFDQAgB0H//wBLDQBBgIABIAdrIAQgAUH//wBLGyEFAkAgAEEBcUUNACAHQQJ0QaCJAmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEECcUUNACAHQQJ0QbCJBmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEEcUUNACAHQQJ0QcCJCmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEIcUUNACAHQQJ0QdCJDmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEQcUUNACAHQQJ0QeCJEmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLIABBIHFFDQAgBUEBayEEIAdBAnRB8IkWaiEAIAVBB3EiAgRAA0AgACADNgIAIABBBGohACAFQQFrIQUgAkEBayICDQALCyAEQQdJDQADQCAAIAM2AhwgACADNgIYIAAgAzYCFCAAIAM2AhAgACADNgIMIAAgAzYCCCAAIAM2AgQgACADNgIAIABBIGohACAFQQhrIgUNAAsLIAhBAWoiBSAILQAAQf8AcSICQT9rIgBBP00NAxoMBAsCQEHsCCgCACIFQQFGBEBB8AgoAgAiAUHMCCgCACIESQ0BIAEgBHAhAQwBC0H4CCgCACEEQfQIKAIAIQECQAJAIAVBBUcNACABQQFHDQAgBEHpAk4NBAwBCyAEQeQASg0DQfwIKAIAQeQASg0DQYAJKAIAQeQASg0DCwJAIAFFDQAgAUECSg0AIARB/AgoAgBBgAkoAgAgAUECdEGICGooAgARAgAhBEHwCCgCACIBQcwIKAIAIgVPBH8gASAFcAUgAQtBAnRBkAlqIAQ2AgALQfAIKAIAIgFBzAgoAgAiBEkNACABIARwIQELIAFBAnRBkAlqKAIAIQMMAQsgAkH9AHFBIUcEQCAHIQEgAiEADAQLIARBI0cNBAJAQewIKAIAIgRBAUYEQEHwCCgCACIBQcwIKAIAIgBJDQEgASAAcCEBDAELQfgIKAIAIQFB9AgoAgAhAAJAAkAgBEEFRw0AIABBAUcNACABQekCSA0BDAcLIAFB5ABKDQZB/AgoAgBB5ABKDQZBgAkoAgBB5ABKDQYLAkAgAEUNACAAQQJKDQAgAUH8CCgCAEGACSgCACAAQQJ0QYgIaigCABECACEAQfAIKAIAIgFBzAgoAgAiBE8EfyABIARwBSABC0ECdEGQCWogADYCAAtB8AgoAgAiAUHMCCgCACIASQ0AIAEgAHAhAQsgAUECdEGQCWooAgAhAwwECyAHIQEgCAshBQNAIAFB//8ATQRAIABBAXEgAWxBAnRBoIkCaiADNgIAIABBAXZBAXEgAWxBAnRBsIkGaiADNgIAIABBAnZBAXEgAWxBAnRBwIkKaiADNgIAIABBA3ZBAXEgAWxBAnRB0IkOaiADNgIAIABBBHZBAXEgAWxBAnRB4IkSaiADNgIAIABBBXYgAWxBAnRB8IkWaiADNgIACyABQQFqIQEgBS0AACEAIAVBAWoiBCEFIABB/wBxIgJBP2siAEHAAEkNAAsgBCEFC0EAIQQgBSEIIAEhByACIQAgAkH9AHFBIUYNAQtBBCEHIAQhAiAAQSRrDgoDAgICAgICAgIBAgtB7AhCATcCAAwCC0GoCCgCAEEEaxAABEBB0AhBATYCAA8LAkBBqAgoAgAiBkEFSA0AQaAIKQMAIQogBkEDa0EBdiIBQQdxIQJBACEAIAFBAWtBB08EQCABQfj///8HcSEFA0AgAEEDdCIBQbCJAmogCjcDACABQQhyQbCJAmogCjcDACABQRByQbCJAmogCjcDACABQRhyQbCJAmogCjcDACABQSByQbCJAmogCjcDACABQShyQbCJAmogCjcDACABQTByQbCJAmogCjcDACABQThyQbCJAmogCjcDACAAQQhqIQAgBUEIayIFDQALCyACRQ0AA0AgAEEDdEGwiQJqIAo3AwAgAEEBaiEAIAJBAWsiAg0ACwtBwIkGQbCJAiAGQQJ0IgD8CgAAQdCJCkGwiQIgAPwKAABB4IkOQbCJAiAA/AoAAEHwiRJBsIkCIAD8CgAAQYCKFkGwiQIgAPwKAAAgBCECDAELAkAgAEE7Rw0AQewIKAIAIgBBB0oNAEHsCCAAQQFqNgIAIABBAnRB8AhqQQA2AgALIAEhBwsgCCAJSQ0ACwtB5AggAzYCAEHgCCACNgIAQegIIAc2AgAL4gcCBX8BfgJAQdAIAn8CQAJAIAAgAU4NACABQZCJAWohBiAAQZCJAWohBQNAIAUtAAAiA0H/AHEhAgJAAkACQAJAAkACQAJAQeAIKAIAIgRBIkcEQCAEDQcgAkEiRgRAQewIQgE3AgBB4AhBIjYCAAwICyACQT9rQcAASQ0GIANBIWsiAkEMTQ0BDAULAkAgAkEwayIEQQlNBEBB7AgoAgBBAnRB7AhqIgIgBCACKAIAQQpsajYCAAwBC0HsCCgCACEEIAJBO0YEQCAEQQdKDQFB7AggBEEBajYCACAEQQJ0QfAIakEANgIADAELIARBBEYEQEHECEECNgIAQbAIQfAIKQMANwMAQbgIQfgIKAIAIgI2AgBBvAhB/AgoAgAiBDYCAEHICEECQQFBwAgoAgAiAxs2AgBBrAggBEEAIAMbNgIAQagIIAJBgIABIAJBgIABSBtBBGpBACADGzYCAEHgCEEANgIADAoLIAJBP2tBwABJDQQLIANBIWsiAkEMTQ0BDAILQQEgAnRBjSBxRQ0DDAQLQQEgAnRBjSBxDQELIANBoQFrIgJBDEsNA0EBIAJ0QY0gcUUNAwtBxAhCgYCAgBA3AgBBsAhB8AgoAgBBAEHsCCgCACICQQBKGzYCAEG0CEH0CCgCAEEAIAJBAUobNgIAQbgIQfgIKAIAQQAgAkECShs2AgBB4AhBADYCAEG8CEEANgIADAQLIANBoQFrIgJBDEsNAUEBIAJ0QY0gcUUNAQtBxAhCgYCAgBA3AgBBsAhCADcDAEG4CEIANwMADAMLIAVBAWoiBSAGSQ0ACwsCQEHICCgCAA4DAwEAAQsCQEGoCCgCACIFQQVIDQBBoAgpAwAhByAFQQNrQQF2IgNBB3EhBEEAIQIgA0EBa0EHTwRAIANB+P///wdxIQYDQCACQQN0IgNBsIkCaiAHNwMAIANBCHJBsIkCaiAHNwMAIANBEHJBsIkCaiAHNwMAIANBGHJBsIkCaiAHNwMAIANBIHJBsIkCaiAHNwMAIANBKHJBsIkCaiAHNwMAIANBMHJBsIkCaiAHNwMAIANBOHJBsIkCaiAHNwMAIAJBCGohAiAGQQhrIgYNAAsLIARFDQADQCACQQN0QbCJAmogBzcDACACQQFqIQIgBEEBayIEDQALC0HAiQZBsIkCIAVBAnQiA/wKAABB0IkKQbCJAiAD/AoAAEHgiQ5BsIkCIAP8CgAAQfCJEkGwiQIgA/wKAABBgIoWQbCJAiAD/AoAAEECDAELEAhByAgoAgALEAEiAjYCACACDQAgACABQcgIKAIAQQJ0QYAIaigCABEBAAsLdABB6AhBBDYCAEHkCCAANgIAQewIQgE3AgBBxAhCADcCAEHACCADNgIAQdwIQgA3AgBBqAhCADcDAEGwCEIANwMAQbgIQgA3AwBBzAggAkGAICACQYAgSRs2AgBBoAggAa1CgYCAgBB+NwMAQdAIQQA2AgALIwBB0AgoAgBFBEAgACABQcgIKAIAQQJ0QYAIaigCABEBAAsLWgECfwJAAkACQEHICCgCAEEBaw4CAAECC0HYCEHoCCgCACIAQdgIKAIAIgEgACABShsiAEGAgAEgAEGAgAFIGyIANgIAIABBBGsPC0GoCCgCAEEEayEACyAAC0IBAX8Cf0EGQdwIKAIAIgBBIHENABpBBSAAQRBxDQAaQQQgAEEIcQ0AGkEDIABBBHENABpBAiAAQQFxIABBAnEbCwu9BQEFfQJ/IAJFBEAgAUH/AWxBMmpB5ABtIgBBCHQgAHIgAEEQdHIMAQsgArJDAADIQpUhBiAAQfABarJDAAC0Q5UhBQJ9IAGyQwAAyEKVIgNDAAAAP10EQCADIAZDAACAP5KUDAELIAYgA0MAAIA/IAaTlJILIQcgAyADkiEGAkAgBUOrqqo+kiIEQwAAAABdBEAgBEMAAIA/kiEEDAELIARDAACAP15FDQAgBEMAAIC/kiEECyAGIAeTIQMgBUMAAAAAXSEAAn8CfSADIAcgA5NDAADAQJQgBJSSIARDq6oqPl0NABogByAEQwAAAD9dDQAaIAMgBEOrqio/XUUNABogAyAHIAOTIARDAADAwJRDAACAQJKUkgtDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALIQECQCAABEAgBUMAAIA/kiEEDAELIAUiBEMAAIA/XkUNACAFQwAAgL+SIQQLIAVDq6qqvpIiBUMAAAAAXSECAn8CfSADIAcgA5NDAADAQJQgBJSSIARDq6oqPl0NABogByAEQwAAAD9dDQAaIAMgBEOrqio/XUUNABogAyAHIAOTIARDAADAwJRDAACAQJKUkgtDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALIQACQCACBEAgBUMAAIA/kiEFDAELIAVDAACAP15FDQAgBUMAAIC/kiEFCwJAIAVDq6oqPl0EQCADIAcgA5NDAADAQJQgBZSSIQcMAQsgBUMAAAA/XQ0AIAVDq6oqP11FBEAgAyEHDAELIAMgByADkyAFQwAAwMCUQwAAgECSlJIhBwsgAEEIdAJ/IAdDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALQRB0ciABcgtBgICAeHILNwAgAEH/AWxBMmpB5ABtIAFB/wFsQTJqQeQAbUEIdHIgAkH/AWxBMmpB5ABtQRB0ckGAgIB4cgsEACMACwYAIAAkAAsQACMAIABrQXBxIgAkACAACwsYAQBBgAgLEQEAAAACAAAAAwAAAAQAAAAF"}},414(e,t,A){Object.defineProperty(t,"__esModule",{value:!0}),t.EventUtils=t.Emitter=void 0;const i=A(426);var s;t.Emitter=class{constructor(){this._listeners=[],this._disposed=!1}get event(){return this._event||(this._event=(e,t,A)=>{if(this._disposed)return(0,i.toDisposable)(()=>{});const s={fn:e,thisArgs:t};this._listeners=this._listeners.slice(),this._listeners.push(s);const r=(0,i.toDisposable)(()=>{const e=this._listeners.indexOf(s);-1!==e&&(this._listeners=this._listeners.slice(),this._listeners.splice(e,1))});return A&&(Array.isArray(A)?A.push(r):A.add(r)),r}),this._event}fire(e){if(this._disposed||!this._listeners.length)return;if(1===this._listeners.length)return void this._listeners[0].fn.call(this._listeners[0].thisArgs,e);const t=this._listeners;for(let A=0,i=t.length;A<i;++A)t[A].fn.call(t[A].thisArgs,e)}dispose(){this._disposed||(this._disposed=!0,this._listeners.length=0)}},function(e){e.forward=function(e,t){return e(e=>t.fire(e))},e.map=function(e,t){return(A,i,s)=>e(e=>A.call(i,t(e)),void 0,s)},e.any=function(...e){return(t,A,s)=>{const r=new i.DisposableStore;for(const i of e)r.add(i(e=>t.call(A,e)));return s&&(Array.isArray(s)?s.push(r):s.add(r)),r}},e.runAndSubscribe=function(e,t,A){return t(A),e(e=>t(e))}}(s||(t.EventUtils=s={}))},426(e,t){function A(e){return{dispose:e}}function i(e){if(!e)return e;if(Array.isArray(e)){for(const t of e)t.dispose();return[]}return e.dispose(),e}Object.defineProperty(t,"__esModule",{value:!0}),t.MutableDisposable=t.Disposable=t.DisposableStore=void 0,t.toDisposable=A,t.dispose=i,t.combinedDisposable=function(...e){return A(()=>i(e))};class s{constructor(){this._disposables=new Set,this._isDisposed=!1}get isDisposed(){return this._isDisposed}add(e){return this._isDisposed?e.dispose():this._disposables.add(e),e}dispose(){if(!this._isDisposed){this._isDisposed=!0;for(const e of this._disposables)e.dispose();this._disposables.clear()}}clear(){for(const e of this._disposables)e.dispose();this._disposables.clear()}}t.DisposableStore=s;class r{constructor(){this._store=new s}dispose(){this._store.dispose()}_register(e){return this._store.add(e)}}t.Disposable=r,r.None=Object.freeze({dispose(){}}),t.MutableDisposable=class{constructor(){this._isDisposed=!1}get value(){return this._isDisposed?void 0:this._value}set value(e){this._isDisposed||e===this._value||(this._value?.dispose(),this._value=e)}clear(){this.value=void 0}dispose(){this._isDisposed=!0,this._value?.dispose(),this._value=void 0}}},795(e,t,A){var i=this&&this.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.IIPHandler=void 0;const s=A(463),r=A(699),o=i(A(669)),a=i(A(61)),n=A(389),h=A(462),g={type:0,name:"Unnamed file",size:0,width:"auto",height:"auto",preserveAspectRatio:1,inline:0};t.IIPHandler=class{constructor(e,t,A,i){this._opts=e,this._renderer=t,this._storage=A,this._coreTerminal=i,this._aborted=!1,this._hp=new n.HeaderParser,this._header=g,this._isMultipart=!1,this._abortMulti=!1;const s=Math.ceil(4*this._opts.iipSizeLimit/3),r=Math.min(1048576,s);this._dec=new o.default(4194304,s,r),this._qoiDec=new a.default(4194304)}reset(){this._hp.reset(),this._dec.release(),this._qoiDec.release()}start(){this._aborted=!1,this._hp.reset()}put(e,t,A){if(!this._aborted)if(4===this._hp.state)0!==this._dec.put(e.subarray(t,A))&&(this._dec.release(),this._aborted=!0);else{const i=this._hp.parse(e,t,A);if(-1===i)return void(this._aborted=!0);if(i>0){if(1===this._hp.fields.type){if(this._isMultipart&&(this._isMultipart=!1,this._abortMulti=!1,this._dec.release()),this._header=Object.assign({},g,this._hp.fields),!this._header.inline)return void(this._aborted=!0);this._dec.init()}else if(this._abortMulti)return void(this._aborted=!0);0!==this._dec.put(e.subarray(i,A))&&(this._dec.release(),this._aborted=!0,this._isMultipart&&(this._abortMulti=!0))}}}end(e){var t,A,i;if(this._aborted)return!0;if(4!==this._hp.state&&this._hp.end())return!0;const o=this._hp.fields.type;if(3===o)return!0;if(5===o){let e=r.CELL_SIZE_DEFAULT.width,A=r.CELL_SIZE_DEFAULT.height;this._renderer.dimensions&&(e=this._renderer.dimensions.css.canvas.width/this._coreTerminal.cols,A=this._renderer.dimensions.css.canvas.height/this._coreTerminal.rows);const s=null!==(i=null===(t=this._coreTerminal._core._coreBrowserService)||void 0===t?void 0:t.dpr)&&void 0!==i?i:1,o=`]1337;ReportCellSize=${A.toFixed(3)};${e.toFixed(3)};${s.toFixed(3)}\\`;return this._coreTerminal.input(o,!1),!0}if(2===o)return this._header=Object.assign({},g,this._hp.fields),this._isMultipart=!0,this._abortMulti=!1,this._dec.release(),this._dec.init(),!0;if(4===o){if(!this._isMultipart)return!0;if(this._isMultipart=!1,this._abortMulti||2!==this._header.type)return!0}let a,n,d=0,l=0,I=h.UNSUPPORTED_TYPE;if((a=e)&&((a=!this._dec.end())?(I=(0,h.imageType)(this._dec.data8),(a="unsupported"!==I.mime)?(d=I.width,l=I.height,(a=d&&l&&d*l<this._opts.pixelLimit)?([d,l]=this._resize(d,l).map(Math.floor),a=d&&l&&d*l<this._opts.pixelLimit):console.warn(`IIP: image dimension issue ${I.width}x${I.height}`)):console.warn("IIP: unsupported image type")):console.warn("IIP: error during BASE64 decoding")),!a)return this._dec.release(),!0;if("image/qoi"===I.mime){const e=this._qoiDec.decode(this._dec.data8);if(n=new ImageData(new Uint8ClampedArray(e.buffer,e.byteOffset,e.byteLength),this._qoiDec.width,this._qoiDec.height),this._qoiDec.release(),d===this._qoiDec.width&&l===this._qoiDec.height){this._dec.release();const e=s.ImageRenderer.createCanvas(void 0,this._qoiDec.width,this._qoiDec.height);return null===(A=e.getContext("2d"))||void 0===A||A.putImageData(n,0,0),this._storage.addImage(e),!0}}else n=new Blob([this._dec.data8],{type:I.mime});return this._dec.release(),createImageBitmap(n,{resizeWidth:d,resizeHeight:l}).then(e=>(this._storage.addImage(e),!0)).catch(e=>(console.warn(`IIP: decoding error ${I.mime} ${I.width}x${I.height}`,e),!0))}_resize(e,t){var A,i,s,o;const a=(null===(A=this._renderer.dimensions)||void 0===A?void 0:A.css.cell.width)||r.CELL_SIZE_DEFAULT.width,n=(null===(i=this._renderer.dimensions)||void 0===i?void 0:i.css.cell.height)||r.CELL_SIZE_DEFAULT.height,h=(null===(s=this._renderer.dimensions)||void 0===s?void 0:s.css.canvas.width)||a*this._coreTerminal.cols,g=(null===(o=this._renderer.dimensions)||void 0===o?void 0:o.css.canvas.height)||n*this._coreTerminal.rows,d=this._dim(this._header.width,h,a),l=this._dim(this._header.height,g,n);if(!d&&!l){const A=h/e,i=(g-n)/t,s=Math.min(A,i);return s<1?[e*s,t*s]:[e,t]}return d?!this._header.preserveAspectRatio&&d&&l?[d,l]:[d,t*d/e]:[e*l/t,l]}_dim(e,t,A){return"auto"===e?0:e.endsWith("%")?parseInt(e.slice(0,-1),10)*t/100:e.endsWith("px")?parseInt(e.slice(0,-2),10):parseInt(e,10)*A}}},389(e,t){function A(e){let t="";for(let A=0;A<e.length;++A)t+=String.fromCharCode(e[A]);return t}function i(e){let t=0;for(let A=0;A<e.length;++A){if(e[A]<48||e[A]>57)throw new Error("illegal char");t=10*t+e[A]-48}return t}function s(e){const t=A(e);if(!t.match(/^((auto)|(\d+?((px)|(%)){0,1}))$/))throw new Error("illegal size");return t}Object.defineProperty(t,"__esModule",{value:!0}),t.HeaderParser=void 0;const r={inline:i,size:i,name:function(e){if("undefined"!=typeof Buffer)return Buffer.from(A(e),"base64").toString();const t=atob(A(e)),i=new Uint8Array(t.length);for(let e=0;e<i.length;++e)i[e]=t.charCodeAt(e);return(new TextDecoder).decode(i)},width:s,height:s,preserveAspectRatio:i},o=[70,105,108,101],a=[77,117,108,116,105,112,97,114,116,70,105,108,101],n=[70,105,108,101,80,97,114,116],h=[70,105,108,101,69,110,100],g=[82,101,112,111,114,116,67,101,108,108,83,105,122,101],d=1024;t.HeaderParser=class{constructor(){this.state=0,this._buffer=new Uint32Array(d),this._position=0,this._key="",this.fields={}}reset(){this._buffer.fill(0),this.state=0,this._position=0,this.fields={},this._key=""}end(){if(0===this.state){if(this._position===h.length){for(let e=0;e<h.length;++e)if(this._buffer[e]!==h[e])return this._a();return this.fields.type=4,this.state=4,0}if(this._position===g.length){for(let e=0;e<g.length;++e)if(this._buffer[e]!==g[e])return this._a();return this.fields.type=5,this.state=4,0}return this._a()}return 4===this.state?0:3===this.state&&2===this.fields.type&&this._storeValue(this._position)?(this.state=4,0):this._a()}parse(e,t,A){let i=this.state,s=this._position;const r=this._buffer;if(1===i||4===i)return-1;if(0===i&&s>14)return-1;for(let h=t;h<A;++h){const t=e[h];switch(t){case 59:if(!this._storeValue(s))return this._a();i=2,s=0;break;case 61:if(0===i){if(70===r[0]){let e=0;for(;e<o.length;++e)if(r[e]!==o[e])return this._a();if(this.fields.type=1,s===n.length){for(;e<n.length;++e)if(r[e]!==n[e])return this._a();return this.fields.type=3,this.state=4,h+1}}else{if(77!==r[0])return this._a();for(let e=0;e<a.length;++e)if(r[e]!==a[e])return this._a();this.fields.type=2}i=2,s=0}else if(2===i){if(!this._storeKey(s))return this._a();i=3,s=0}else if(3===i){if(s>=d)return this._a();r[s++]=t}break;case 58:return 3!==i||this._storeValue(s)?(this.state=4,h+1):this._a();default:if(s>=d)return this._a();r[s++]=t}}return this.state=i,this._position=s,-2}_a(){return this.fields.type=0,this.state=1,-1}_storeKey(e){const t=A(this._buffer.subarray(0,e));return!!t&&(this._key=t,this.fields[t]=null,!0)}_storeValue(e){if(this._key){try{const t=this._buffer.slice(0,e);this.fields[this._key]=r[this._key]?r[this._key](t):t}catch(e){return!1}return!0}return!1}}},649(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.IIPImageStorage=void 0,t.IIPImageStorage=class{constructor(e){this._storage=e,this._addImageOpts={scrolling:!0,layer:"top",zIndex:0,cursorPos:"iip"}}addImage(e){this._storage.addImage(e,this._addImageOpts)}}},462(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.UNSUPPORTED_TYPE=void 0,t.imageType=function(e){if(e.length<32)return t.UNSUPPORTED_TYPE;const A=new Uint32Array(e.buffer,e.byteOffset,8);if(1196314761===A[0]&&169478669===A[1]&&1380206665===A[3])return{mime:"image/png",width:e[16]<<24|e[17]<<16|e[18]<<8|e[19],height:e[20]<<24|e[21]<<16|e[22]<<8|e[23]};if(255===e[0]&&216===e[1]&&255===e[2]){const[t,A]=function(e){const t=e.length;let A=4,i=e[A]<<8|e[A+1];for(;;){if(A+=i,A>=t)return[0,0];if(255!==e[A])return[0,0];if(192===e[A+1]||194===e[A+1])return A+8<t?[e[A+7]<<8|e[A+8],e[A+5]<<8|e[A+6]]:[0,0];A+=2,i=e[A]<<8|e[A+1]}}(e);return{mime:"image/jpeg",width:t,height:A}}if(944130375===A[0]&&(55===e[4]||57===e[4])&&97===e[5])return{mime:"image/gif",width:e[7]<<8|e[6],height:e[9]<<8|e[8]};if(1718185841===A[0])return{mime:"image/qoi",width:e[4]<<24|e[5]<<16|e[6]<<8|e[7],height:e[8]<<24|e[9]<<16|e[10]<<8|e[11]};if(1179011410===A[0]&&1346520407===A[2]&&3690582==(16777215&A[3])){switch(e[15]){case 88:return{mime:"image/webp",width:1+(e[24]|e[25]<<8|e[26]<<16),height:1+(e[27]|e[28]<<8|e[29]<<16)};case 76:if(47!==e[20])return t.UNSUPPORTED_TYPE;const A=e[21]|e[22]<<8|e[23]<<16|e[24]<<24;return{mime:"image/webp",width:1+(16383&A),height:1+(A>>>14&16383)};case 32:return 157!==e[23]||1!==e[24]||42!==e[25]?t.UNSUPPORTED_TYPE:{mime:"image/webp",width:16383&(e[26]|e[27]<<8),height:16383&(e[28]|e[29]<<8)}}return t.UNSUPPORTED_TYPE}if(1887007846===A[1]&&(1718187617===A[2]||1936291425===A[2])){let A=-1;const i=Math.min(e.length-16,1024);for(let t=8;t<i;t++)if(105===e[t]&&115===e[t+1]&&112===e[t+2]&&101===e[t+3]){A=t;break}if(-1!==A){const t=e[A+8]<<24|e[A+9]<<16|e[A+10]<<8|e[A+11],i=e[A+12]<<24|e[A+13]<<16|e[A+14]<<8|e[A+15];if(t>0&&i>0)return{mime:"image/avif",width:t,height:i}}return t.UNSUPPORTED_TYPE}return t.UNSUPPORTED_TYPE},t.UNSUPPORTED_TYPE={mime:"unsupported",width:0,height:0}},463(e,t,A){Object.defineProperty(t,"__esModule",{value:!0}),t.ImageRenderer=void 0;const i=A(939),s=A(426);class r extends s.Disposable{get canvas(){var e;return null===(e=this._layers.get("top"))||void 0===e?void 0:e.canvas}static createCanvas(e,t,A){const i=(null!=e?e:document).createElement("canvas");return i.width=0|t,i.height=0|A,i}static createImageData(e,t,A,i){if("function"!=typeof ImageData){const s=e.createImageData(t,A);return i&&s.data.set(new Uint8ClampedArray(i,0,t*A*4)),s}return i?new ImageData(new Uint8ClampedArray(i,0,t*A*4),t,A):new ImageData(t,A)}static createImageBitmap(e){return"function"!=typeof createImageBitmap?Promise.resolve(void 0):createImageBitmap(e)}constructor(e){super(),this._terminal=e,this._layers=new Map,this._optionsRefresh=this._register(new s.MutableDisposable),this._oldOpen=this._terminal._core.open,this._terminal._core.open=e=>{var t;null===(t=this._oldOpen)||void 0===t||t.call(this._terminal._core,e),this._open()},this._terminal._core.screenElement&&this._open(),this._optionsRefresh.value=this._terminal._core.optionsService.onOptionChange(e=>{var t;"fontSize"===e&&(this.rescaleCanvas(),null===(t=this._renderService)||void 0===t||t.refreshRows(0,this._terminal.rows))}),this._register((0,s.toDisposable)(()=>{var e;this.removeLayerFromDom(),this.removeLayerFromDom("bottom"),this._terminal._core&&this._oldOpen&&(this._terminal._core.open=this._oldOpen,this._oldOpen=void 0),this._renderService&&this._oldSetRenderer&&(this._renderService.setRenderer=this._oldSetRenderer,this._oldSetRenderer=void 0),this._renderService=void 0,this._layers.clear(),null===(e=this._placeholderBitmap)||void 0===e||e.close(),this._placeholderBitmap=void 0,this._placeholder=void 0}))}showPlaceholder(e){var t,A;e?this._placeholder||-1===this.cellSize.height||this._createPlaceHolder(Math.max(this.cellSize.height+1,24)):(null===(t=this._placeholderBitmap)||void 0===t||t.close(),this._placeholderBitmap=void 0,this._placeholder=void 0),null===(A=this._renderService)||void 0===A||A.refreshRows(0,this._terminal.rows)}get dimensions(){return this._terminal.dimensions}get cellSize(){var e,t;return{width:(null===(e=this.dimensions)||void 0===e?void 0:e.css.cell.width)||-1,height:(null===(t=this.dimensions)||void 0===t?void 0:t.css.cell.height)||-1}}clearLines(e,t,A){var i,s,r,o,a;const n=e*((null===(i=this.dimensions)||void 0===i?void 0:i.css.cell.height)||0),h=(null===(s=this.dimensions)||void 0===s?void 0:s.css.canvas.width)||0,g=(t+1-e)*((null===(r=this.dimensions)||void 0===r?void 0:r.css.cell.height)||0);A&&"top"!==A||null===(o=this._layers.get("top"))||void 0===o||o.clearRect(0,n,h,g),A&&"bottom"!==A||null===(a=this._layers.get("bottom"))||void 0===a||a.clearRect(0,n,h,g)}clearAll(e){if(!e||"top"===e){const e=this._layers.get("top");null==e||e.clearRect(0,0,e.canvas.width,e.canvas.height)}if(!e||"bottom"===e){const e=this._layers.get("bottom");null==e||e.clearRect(0,0,e.canvas.width,e.canvas.height)}}draw(e,t,A,i,s=1){const r=this._layers.get(e.layer);if(!r)return;const{width:o,height:a}=this.cellSize;if(-1===o||-1===a)return;this._rescaleImage(e,o,a);const n=e.actual,h=Math.ceil(n.width/o),g=t%h*o,d=Math.floor(t/h)*a,l=A*o,I=i*a,c=s*o+g>n.width?n.width-g:s*o,_=d+a>n.height?n.height-d:a;r.drawImage(n,Math.floor(g),Math.floor(d),Math.ceil(c),Math.ceil(_),Math.floor(l),Math.floor(I),Math.ceil(c),Math.ceil(_))}extractTile(e,t){const{width:A,height:i}=this.cellSize;if(-1===A||-1===i)return;this._rescaleImage(e,A,i);const s=e.actual,o=Math.ceil(s.width/A),a=t%o*A,n=Math.floor(t/o)*i,h=A+a>s.width?s.width-a:A,g=n+i>s.height?s.height-n:i,d=r.createCanvas(this.document,h,g),l=d.getContext("2d");return l?(l.drawImage(s,Math.floor(a),Math.floor(n),Math.floor(h),Math.floor(g),0,0,Math.floor(h),Math.floor(g)),d):void 0}drawPlaceholder(e,t,A=1){var i;const s=this._layers.get("top");if(s){const{width:r,height:o}=this.cellSize;if(-1===r||-1===o)return;if(this._placeholder?o>=this._placeholder.height&&this._createPlaceHolder(o+1):this._createPlaceHolder(Math.max(o+1,24)),!this._placeholder)return;s.drawImage(null!==(i=this._placeholderBitmap)&&void 0!==i?i:this._placeholder,e*r,t*o%2?0:1,r*A,o,e*r,t*o,r*A,o)}}rescaleCanvas(){var e,t;const A=(null===(e=this.dimensions)||void 0===e?void 0:e.css.canvas.width)||0,i=(null===(t=this.dimensions)||void 0===t?void 0:t.css.canvas.height)||0;for(const e of this._layers.values())e.canvas.width===A&&e.canvas.height===i||(e.canvas.width=A,e.canvas.height=i)}_rescaleImage(e,t,A){if(t===e.actualCellSize.width&&A===e.actualCellSize.height)return;const{width:i,height:s}=e.origCellSize;if(t===i&&A===s)return e.actual=e.orig,e.actualCellSize.width=i,void(e.actualCellSize.height=s);const o=r.createCanvas(this.document,Math.ceil(e.orig.width*t/i),Math.ceil(e.orig.height*A/s)),a=o.getContext("2d");a&&(a.drawImage(e.orig,0,0,o.width,o.height),e.actual=o,e.actualCellSize.width=t,e.actualCellSize.height=A)}_open(){this._renderService=this._terminal._core._renderService,this._oldSetRenderer=this._renderService.setRenderer.bind(this._renderService),this._renderService.setRenderer=e=>{var t;for(const e of[...this._layers.keys()])this.removeLayerFromDom(e);null===(t=this._oldSetRenderer)||void 0===t||t.call(this._renderService,e)}}insertLayerToDom(e="top"){var t,A;if(!this.document||!this._terminal._core.screenElement)return void console.warn("image addon: cannot insert output canvas to DOM, missing document or screenElement");if(this._layers.has(e))return;const i=r.createCanvas(this.document,(null===(t=this.dimensions)||void 0===t?void 0:t.css.canvas.width)||0,(null===(A=this.dimensions)||void 0===A?void 0:A.css.canvas.height)||0);i.classList.add(`xterm-image-layer-${e}`);const s=this._terminal._core.screenElement;s.style.isolation="isolate","bottom"===e?(i.style.zIndex="-1",s.insertBefore(i,s.firstChild)):(i.style.zIndex="0",s.appendChild(i));const o=i.getContext("2d",{alpha:!0});o?(this._layers.set(e,o),this.clearAll(e)):i.remove()}removeLayerFromDom(e="top"){const t=this._layers.get(e);t&&(t.canvas.remove(),this._layers.delete(e))}hasLayer(e){return this._layers.has(e)}_createPlaceHolder(e=24){var t;null===(t=this._placeholderBitmap)||void 0===t||t.close(),this._placeholderBitmap=void 0;const A=32,s=r.createCanvas(this.document,A,e),o=s.getContext("2d",{alpha:!1});if(!o)return;const a=r.createImageData(o,A,e),n=new Uint32Array(a.data.buffer),h=(0,i.toRGBA8888)(0,0,0),g=(0,i.toRGBA8888)(255,255,255);n.fill(h);for(let t=0;t<e;++t){const e=t%2,i=t*A;for(let t=0;t<A;t+=2)n[i+t+e]=g}o.putImageData(a,0,0);const d=screen.width+A-1&-32||4096;this._placeholder=r.createCanvas(this.document,d,e);const l=this._placeholder.getContext("2d",{alpha:!1});if(l){for(let e=0;e<d;e+=A)l.drawImage(s,e,0);r.createImageBitmap(this._placeholder).then(e=>this._placeholderBitmap=e)}else this._placeholder=void 0}get document(){var e;return null===(e=this._terminal._core._coreBrowserService)||void 0===e?void 0:e.window.document}}t.ImageRenderer=r},699(e,t,A){Object.defineProperty(t,"__esModule",{value:!0}),t.ImageStorage=t.CELL_SIZE_DEFAULT=void 0;const i=A(463);t.CELL_SIZE_DEFAULT={width:7,height:14};class s{get ext(){return this._urlId?-469762049&this._ext|this.underlineStyle<<26:this._ext}set ext(e){this._ext=e}get underlineStyle(){return this._urlId?5:(469762048&this._ext)>>26}set underlineStyle(e){this._ext&=-469762049,this._ext|=e<<26&469762048}get underlineColor(){return 67108863&this._ext}set underlineColor(e){this._ext&=-67108864,this._ext|=67108863&e}get underlineVariantOffset(){const e=(3758096384&this._ext)>>29;return e<0?4294967288^e:e}set underlineVariantOffset(e){this._ext&=536870911,this._ext|=e<<29&3758096384}get urlId(){return this._urlId}set urlId(e){this._urlId=e}constructor(e=0,t=0,A=-1,i=-1){this.imageId=A,this.tileId=i,this._ext=0,this._urlId=0,this._ext=e,this._urlId=t}clone(){return new s(this._ext,this._urlId,this.imageId,this.tileId)}isEmpty(){return 0===this.underlineStyle&&0===this._urlId&&-1===this.imageId}}const r=new s;t.ImageStorage=class{constructor(e,t,A){this._terminal=e,this._renderer=t,this._opts=A,this._images=new Map,this._lastId=0,this._lowestId=0,this._fullyCleared=!1,this._needsFullClear=!1,this._pixelLimit=25e5;try{this.setLimit(this._opts.storageLimit)}catch(e){e instanceof Error&&console.error(e.message),console.warn(`storageLimit is set to ${this.getLimit()} MB`)}this._viewportMetrics={cols:this._terminal.cols,rows:this._terminal.rows}}dispose(){this.reset()}reset(){var e;for(const t of this._images.values())null===(e=t.marker)||void 0===e||e.dispose();this._images.clear(),this._renderer.clearAll()}getLimit(){return 4*this._pixelLimit/1e6}setLimit(e){if(e<.5||e>1e3)throw RangeError("invalid storageLimit, should be at least 0.5 MB and not exceed 1G");this._pixelLimit=e/4*1e6>>>0,this._evictOldest(0)}getUsage(){return 4*this._getStoredPixels()/1e6}_getStoredPixels(){let e=0;for(const t of this._images.values())t.orig&&(e+=t.orig.width*t.orig.height,t.actual&&t.actual!==t.orig&&(e+=t.actual.width*t.actual.height));return e}_delImg(e){var t;const A=this._images.get(e);A&&(this._images.delete(e),window.ImageBitmap&&A.orig instanceof ImageBitmap&&A.orig.close(),null===(t=this.onImageDeleted)||void 0===t||t.call(this,e))}wipeAlternate(){var e;const t=[];for(const[A,i]of this._images.entries())"alternate"===i.bufferType&&(null===(e=i.marker)||void 0===e||e.dispose(),t.push(A));for(const e of t)this._delImg(e);this._needsFullClear=!0,this._fullyCleared=!1}deleteImage(e){var t;const A=this._images.get(e);A&&(null===(t=A.marker)||void 0===t||t.dispose(),this._delImg(e))}addImage(e,A){var i,s;this._evictOldest(e.width*e.height);let r=this._renderer.cellSize;-1!==r.width&&-1!==r.height||(r=t.CELL_SIZE_DEFAULT);const o=Math.ceil(e.width/r.width),a=Math.ceil(e.height/r.height),n=++this._lastId,h=this._terminal._core.buffer,g=this._terminal.cols,d=this._terminal.rows,l=h.x,I=h.y;let c=l,_=0;A.scrolling||(h.x=0,h.y=0,c=0),this._terminal._core._inputHandler._dirtyRowTracker.markDirty(h.y);for(let e=0;e<a;++e){const t=h.lines.get(h.y+h.ybase);for(let A=0;A<o&&!(c+A>=g);++A)this._writeToCell(t,c+A,n,e*o+A),_++;if(A.scrolling)e<a-1&&this._terminal._core._inputHandler.lineFeed();else if(++h.y>=d)break;h.x=c}this._terminal._core._inputHandler._dirtyRowTracker.markDirty(h.y),A.scrolling?"iip"===A.cursorPos?h.x=Math.min(c+o,g):h.x=c:(h.x=l,h.y=I);const C=[];for(const[e,t]of this._images.entries())t.tileCount<1&&(null===(i=t.marker)||void 0===i||i.dispose(),C.push(e));for(const e of C)this._delImg(e);const B=this._terminal.registerMarker(0);null==B||B.onDispose(()=>{this._images.get(n)&&this._delImg(n)}),"alternate"===this._terminal.buffer.active.type&&this._evictOnAlternate();const Q={orig:e,origCellSize:r,actual:e,actualCellSize:Object.assign({},r),marker:B||void 0,tileCount:_,bufferType:this._terminal.buffer.active.type,layer:A.layer,zIndex:A.zIndex};return this._images.set(n,Q),null===(s=this.onImageAdded)||void 0===s||s.call(this),n}render(e){var t,A;let i=!1,s=!1;for(const e of this._images.values())if("bottom"===e.layer?s=!0:i=!0,i&&s)break;if(i&&!this._renderer.hasLayer("top")&&(this._renderer.insertLayerToDom("top"),!this._renderer.hasLayer("top")))return;if(s&&!this._renderer.hasLayer("bottom")&&this._renderer.insertLayerToDom("bottom"),this._renderer.rescaleCanvas(),!this._images.size)return this._fullyCleared||(this._renderer.clearAll(),this._fullyCleared=!0,this._needsFullClear=!1),this._renderer.hasLayer("top")&&this._renderer.removeLayerFromDom("top"),void(this._renderer.hasLayer("bottom")&&this._renderer.removeLayerFromDom("bottom"));!i&&this._renderer.hasLayer("top")&&(this._renderer.clearAll("top"),this._renderer.removeLayerFromDom("top")),!s&&this._renderer.hasLayer("bottom")&&(this._renderer.clearAll("bottom"),this._renderer.removeLayerFromDom("bottom")),this._needsFullClear&&(this._renderer.clearAll(),this._fullyCleared=!0,this._needsFullClear=!1);const{start:o,end:a}=e,n=this._terminal._core.buffer,h=this._terminal._core.cols;this._renderer.clearLines(o,a);const g=[],d=[];for(let e=o;e<=a;++e){const i=n.lines.get(e+n.ydisp);if(!i)return;for(let s=0;s<h;++s)if(268435456&i.getBg(s)){let o=null!==(t=i._extendedAttrs[s])&&void 0!==t?t:r;const a=o.imageId;if(void 0===a||-1===a)continue;const n=this._images.get(a);if(-1!==o.tileId){const t=o.tileId,l=s;let I=1;for(;++s<h&&268435456&i.getBg(s)&&(o=null!==(A=i._extendedAttrs[s])&&void 0!==A?A:r)&&o.imageId===a&&o.tileId===t+I;)I++;s--,n?n.actual&&g.push({imgSpec:n,tileId:t,col:l,row:e,count:I}):this._opts.showPlaceholder&&d.push({col:l,row:e,count:I}),this._fullyCleared=!1}}}g.sort((e,t)=>e.imgSpec.zIndex-t.imgSpec.zIndex);for(const e of d)this._renderer.drawPlaceholder(e.col,e.row,e.count);for(const e of g)this._renderer.draw(e.imgSpec,e.tileId,e.col,e.row,e.count)}viewportResize(e){var t,A;if(!this._images.size)return void(this._viewportMetrics=e);if(this._viewportMetrics.cols>=e.cols)return void(this._viewportMetrics=e);const i=this._terminal._core.buffer,s=i.lines.length,o=this._viewportMetrics.cols-1;for(let a=0;a<s;++a){const s=i.lines.get(a);if(268435456&s.getBg(o)){const i=null!==(A=s._extendedAttrs[o])&&void 0!==A?A:r,a=i.imageId;if(void 0===a||-1===a)continue;const n=this._images.get(a);if(!n)continue;const h=Math.ceil(((null===(t=n.actual)||void 0===t?void 0:t.width)||0)/n.actualCellSize.width);if(i.tileId%h+1>=h)continue;let g=!1;for(let t=o+1;t>e.cols;++t)if(4194303&s._data[3*t+0]){g=!0;break}if(g)continue;const d=Math.min(e.cols,h-i.tileId%h+o);let l=i.tileId;for(let e=o+1;e<d;++e)this._writeToCell(s,e,a,++l),n.tileCount++}}this._viewportMetrics=e}getImageAtBufferCell(e,t){var A,s,o;const a=this._terminal._core.buffer.lines.get(t);if(a&&268435456&a.getBg(e)){const t=null!==(o=a._extendedAttrs[e])&&void 0!==o?o:r;if(t.imageId&&-1!==t.imageId){const e=null===(A=this._images.get(t.imageId))||void 0===A?void 0:A.orig;if(window.ImageBitmap&&e instanceof ImageBitmap){const t=i.ImageRenderer.createCanvas(window.document,e.width,e.height);return null===(s=t.getContext("2d"))||void 0===s||s.drawImage(e,0,0,e.width,e.height),t}return e}}}extractTileAtBufferCell(e,t){var A;const i=this._terminal._core.buffer.lines.get(t);if(i&&268435456&i.getBg(e)){const t=null!==(A=i._extendedAttrs[e])&&void 0!==A?A:r;if(t.imageId&&-1!==t.imageId&&-1!==t.tileId){const e=this._images.get(t.imageId);if(e)return this._renderer.extractTile(e,t.tileId)}}}_evictOldest(e){var t;const A=this._getStoredPixels();let i=A;for(;this._pixelLimit<i+e&&this._images.size;){const e=this._images.get(++this._lowestId);e&&e.orig&&(i-=e.orig.width*e.orig.height,e.actual&&e.orig!==e.actual&&(i-=e.actual.width*e.actual.height),null===(t=e.marker)||void 0===t||t.dispose(),this._delImg(this._lowestId))}return A-i}_writeToCell(e,t,A,i){if(268435456&e._data[3*t+2]){const r=e._extendedAttrs[t];if(r){if(void 0!==r.imageId){const e=this._images.get(r.imageId);return e&&e.tileCount--,r.imageId=A,void(r.tileId=i)}return void(e._extendedAttrs[t]=new s(r.ext,r.urlId,A,i))}}e._data[3*t+2]|=268435456,e._extendedAttrs[t]=new s(0,0,A,i)}_evictOnAlternate(){var e,t;for(const e of this._images.values())"alternate"===e.bufferType&&(e.tileCount=0);const A=this._terminal._core.buffer;for(let t=0;t<this._terminal.rows;++t){const i=A.lines.get(t);if(i)for(let t=0;t<this._terminal.cols;++t)if(268435456&i._data[3*t+2]){const A=null===(e=i._extendedAttrs[t])||void 0===e?void 0:e.imageId;if(A){const e=this._images.get(A);e&&e.tileCount++}}}const i=[];for(const[e,A]of this._images.entries())"alternate"!==A.bufferType||A.tileCount||(null===(t=A.marker)||void 0===t||t.dispose(),i.push(e));for(const e of i)this._delImg(e)}}},566(e,t,A){Object.defineProperty(t,"__esModule",{value:!0}),t.SixelHandler=void 0;const i=A(939),s=A(463),r=A(591),o=i.PALETTE_ANSI_256;function a(e){return i.BIG_ENDIAN?e:(255&e)<<24|(e>>>8&255)<<16|(e>>>16&255)<<8|e>>>24&255}o.set(i.PALETTE_VT340_COLOR),t.SixelHandler=class{constructor(e,t,A){this._opts=e,this._storage=t,this._coreTerminal=A,this._size=0,this._aborted=!1,(0,r.DecoderAsync)({memoryLimit:4*this._opts.pixelLimit,palette:o,paletteLimit:this._opts.sixelPaletteLimit}).then(e=>this._dec=e)}reset(){this._dec&&(this._dec.release(),this._dec._palette.fill(0),this._dec.init(0,o,this._opts.sixelPaletteLimit))}hook(e){var t;if(this._size=0,this._aborted=!1,this._dec){const A=1===e.params[1]?0:function(e,t){let A=0;if(!t)return A;if(e.isInverse())if(e.isFgDefault())A=a(t.foreground.rgba);else if(e.isFgRGB()){const t=e.constructor.toColorRGB(e.getFgColor());A=(0,i.toRGBA8888)(...t)}else A=a(t.ansi[e.getFgColor()].rgba);else if(e.isBgDefault())A=a(t.background.rgba);else if(e.isBgRGB()){const t=e.constructor.toColorRGB(e.getBgColor());A=(0,i.toRGBA8888)(...t)}else A=a(t.ansi[e.getBgColor()].rgba);return A}(this._coreTerminal._core._inputHandler._curAttrData,null===(t=this._coreTerminal._core._themeService)||void 0===t?void 0:t.colors);this._dec.init(A,null,this._opts.sixelPaletteLimit)}}put(e,t,A){if(!this._aborted&&this._dec){if(this._size+=A-t,this._size>this._opts.sixelSizeLimit)return console.warn("SIXEL: too much data, aborting"),this._aborted=!0,void this._dec.release();try{this._dec.decode(e,t,A)}catch(e){console.warn(`SIXEL: error while decoding image - ${e}`),this._aborted=!0,this._dec.release()}}}unhook(e){var t;if(this._aborted||!e||!this._dec)return!0;const A=this._dec.width,i=this._dec.height;if(!A||!i)return i&&this._storage.advanceCursor(i),!0;const r=s.ImageRenderer.createCanvas(void 0,A,i);return null===(t=r.getContext("2d"))||void 0===t||t.putImageData(new ImageData(this._dec.data8,A,i),0,0),this._dec.memoryUsage>4194304&&this._dec.release(),this._storage.addImage(r),!0}}},994(e,t,A){Object.defineProperty(t,"__esModule",{value:!0}),t.SixelImageStorage=void 0;const i=A(699);t.SixelImageStorage=class{constructor(e,t,A,i){this._storage=e,this._opts=t,this._renderer=A,this._terminal=i,this._addImageOpts={scrolling:!0,layer:"top",zIndex:0,cursorPos:"vt340"}}addImage(e){this._addImageOpts.scrolling=this._opts.sixelScrolling,this._storage.addImage(e,this._addImageOpts)}advanceCursor(e){if(this._opts.sixelScrolling){let t=this._renderer.cellSize;-1!==t.width&&-1!==t.height||(t=i.CELL_SIZE_DEFAULT);const A=Math.ceil(e/t.height);for(let e=1;e<A;++e)this._terminal._core._inputHandler.lineFeed()}}}},23(e,t,A){var i=this&&this.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.KittyGraphicsHandler=void 0;const s=A(463),r=A(699),o=i(A(669)),a=A(470);t.KittyGraphicsHandler=class{constructor(e,t,A,i){this._opts=e,this._renderer=t,this._kittyStorage=A,this._coreTerminal=i,this._aborted=!1,this._decodeError=!1,this._activeDecoder=null,this._inControlData=!0,this._controlData=new Uint32Array(512),this._controlLength=0,this._encodedSizeLimit=0,this._totalEncodedSize=0,this._parsedCommand=null,this._pendingTransmissions=new Map,this._maxEncodedBytes=Math.ceil(4*this._opts.kittySizeLimit/3),this._initialEncodedBytes=Math.min(4194304,this._maxEncodedBytes)}reset(){this._cleanupAllPending(),this._activeDecoder&&(this._activeDecoder.release(),this._activeDecoder=null),this._kittyStorage.reset()}dispose(){this.reset()}_removePendingEntry(e){this._pendingTransmissions.delete(e),this._lastPendingKey===e&&(this._lastPendingKey=void 0)}_cleanupAllPending(){for(const e of this._pendingTransmissions.values())e.decoder.release();this._pendingTransmissions.clear(),this._lastPendingKey=void 0}start(){this._aborted=!1,this._decodeError=!1,this._inControlData=!0,this._controlLength=0,this._parsedCommand=null,this._encodedSizeLimit=this._maxEncodedBytes,this._totalEncodedSize=0,this._activeDecoder=null}put(e,t,A){var i;if(!this._aborted)if(this._inControlData){let s=A;for(let i=t;i<A;i++)if(59===e[i]){this._inControlData=!1,s=i;break}const r=s-t;if(this._controlLength+r>512)return void(this._aborted=!0);if(this._controlData.set(e.subarray(t,s),this._controlLength),this._controlLength+=r,!this._inControlData){if(this._parsedCommand=(0,a.parseKittyCommand)(this._parseControlDataString()),void 0!==this._parsedCommand.id&&void 0!==this._parsedCommand.imageNumber)return this._sendResponse(this._parsedCommand.id,"EINVAL:cannot specify both i and I keys",null!==(i=this._parsedCommand.quiet)&&void 0!==i?i:0),void(this._aborted=!0);if("d"===this._parsedCommand.action)return;const t=s+1;t<A&&this._streamPayload(e,t,A)}}else this._streamPayload(e,t,A)}_streamPayload(e,t,A){var i,s,r,a,n;if(this._aborted)return;const h=null!==(r=null!==(s=null===(i=this._parsedCommand)||void 0===i?void 0:i.id)&&void 0!==s?s:this._lastPendingKey)&&void 0!==r?r:0,g=this._pendingTransmissions.get(h),d=null!==(a=null==g?void 0:g.totalEncodedSize)&&void 0!==a?a:0;if(this._totalEncodedSize+=A-t,d+this._totalEncodedSize>this._encodedSizeLimit){const e=null!==(n=this._activeDecoder)&&void 0!==n?n:null==g?void 0:g.decoder;return e&&e.release(),this._activeDecoder=null,g&&this._removePendingEntry(h),void(this._aborted=!0)}this._decodeError||((null==g?void 0:g.decoder)&&!this._activeDecoder&&(this._activeDecoder=g.decoder),this._activeDecoder||(this._activeDecoder=new o.default(4194304,this._maxEncodedBytes,this._initialEncodedBytes),this._activeDecoder.init()),0!==this._activeDecoder.put(e.subarray(t,A))&&(this._activeDecoder.release(),this._activeDecoder=null,this._decodeError=!0,g&&this._removePendingEntry(h)))}end(e){var t,A;if(this._aborted||!e)return this._activeDecoder&&(this._activeDecoder.release(),this._activeDecoder=null),!0;if(this._inControlData)return this._handleNoPayloadCommand();const i=this._parsedCommand;if("d"===i.action)return this._handleDelete(i);const s=null!==(A=null!==(t=i.id)&&void 0!==t?t:this._lastPendingKey)&&void 0!==A?A:0,r=1===i.more,o=this._pendingTransmissions.get(s);if(r)return this._activeDecoder&&(o?(o.totalEncodedSize+=this._totalEncodedSize,o.decodeError=o.decodeError||this._decodeError):this._pendingTransmissions.set(s,{cmd:Object.assign({},i),decoder:this._activeDecoder,totalEncodedSize:this._totalEncodedSize,decodeError:this._decodeError}),this._lastPendingKey=s,this._activeDecoder=null),!0;o&&(this._lastPendingKey=void 0);let a=this._decodeError,n=i,h=this._activeDecoder;o&&(n=o.cmd,h=o.decoder,a=a||o.decodeError,this._pendingTransmissions.delete(s));let g=new Uint8Array(0);h&&(0!==h.end()&&(a=!0),g=h.data8),this._activeDecoder=null;const d=this._handleCommandWithBytesAndCmd(n,g,a);return h&&h.release(),d}_parseControlDataString(){let e="";for(let t=0;t<this._controlLength;t++)e+=String.fromCodePoint(this._controlData[t]);return e}_handleNoPayloadCommand(){var e,t,A,i,s;const r=(0,a.parseKittyCommand)(this._parseControlDataString());if(void 0!==r.id&&void 0!==r.imageNumber)return this._sendResponse(r.id,"EINVAL:cannot specify both i and I keys",null!==(e=r.quiet)&&void 0!==e?e:0),!0;switch(null!==(t=r.action)&&void 0!==t?t:"t"){case"d":return this._handleDelete(r);case"q":return this._sendResponse(null!==(A=r.id)&&void 0!==A?A:0,"OK",null!==(i=r.quiet)&&void 0!==i?i:0),!0;case"p":return this._handlePlacement(r);default:return void 0!==r.id&&this._sendResponse(r.id,"EINVAL:unsupported action",null!==(s=r.quiet)&&void 0!==s?s:0),!0}}_handleCommandWithBytesAndCmd(e,t,A){var i,s,r,o,a;switch(null!==(i=e.action)&&void 0!==i?i:"t"){case"t":{const i=this._handleTransmit(e,t,A);return"d"===(null!==(s=e.transmission)&&void 0!==s?s:"d")&&void 0!==e.id&&(A?this._sendResponse(e.id,"EINVAL:invalid base64 data",null!==(r=e.quiet)&&void 0!==r?r:0):t.length>0&&this._sendResponse(e.id,"OK",null!==(o=e.quiet)&&void 0!==o?o:0)),i}case"T":return this._handleTransmitDisplay(e,t,A);case"q":return this._handleQuery(e,t,A);case"p":return this._handlePlacement(e);default:return void 0!==e.id&&this._sendResponse(e.id,"EINVAL:unsupported action",null!==(a=e.quiet)&&void 0!==a?a:0),!0}}_handlePlacement(e){var t;if(void 0===e.id)return!0;const A=e.id,i=this._kittyStorage.getImage(A);return i?this._displayImage(i,e).then(t=>{var i;return this._sendResponse(A,t?"OK":"EINVAL:image rendering failed",null!==(i=e.quiet)&&void 0!==i?i:0,e.placementId),!0}):(this._sendResponse(A,"ENOENT:image not found",null!==(t=e.quiet)&&void 0!==t?t:0,e.placementId),!0)}_handleTransmit(e,t,A){var i,s,r,o,a,n;return"d"!==(null!==(i=e.transmission)&&void 0!==i?i:"d")?(void 0!==e.id&&this._sendResponse(e.id,"EINVAL:unsupported transmission medium",null!==(s=e.quiet)&&void 0!==s?s:0),!0):(A||0===t.length||this._kittyStorage.storeImage(e.id,{data:new Blob([t]),width:null!==(r=e.width)&&void 0!==r?r:0,height:null!==(o=e.height)&&void 0!==o?o:0,format:null!==(a=e.format)&&void 0!==a?a:32,compression:null!==(n=e.compression)&&void 0!==n?n:""}),!0)}_handleTransmitDisplay(e,t,A){var i,s;if(A)return void 0!==e.id&&this._sendResponse(e.id,"EINVAL:invalid base64 data",null!==(i=e.quiet)&&void 0!==i?i:0),!0;this._handleTransmit(e,t,A);const r=null!==(s=e.id)&&void 0!==s?s:this._kittyStorage.lastImageId,o=this._kittyStorage.getImage(r);if(o){const t=this._displayImage(o,e);return void 0!==e.id?t.then(t=>{var A;return this._sendResponse(r,t?"OK":"EINVAL:image rendering failed",null!==(A=e.quiet)&&void 0!==A?A:0),!0}):t.then(()=>!0)}return!0}_handleQuery(e,t,A){var i,s,r,o,a,n;const h=null!==(i=e.id)&&void 0!==i?i:0,g=null!==(s=e.quiet)&&void 0!==s?s:0;if("d"!==(null!==(r=e.transmission)&&void 0!==r?r:"d"))return this._sendResponse(h,"EINVAL:unsupported transmission medium",g),!0;if(A)return this._sendResponse(h,"EINVAL:invalid base64 data",g),!0;if(0===t.length)return this._sendResponse(h,"OK",g),!0;const d=null!==(o=e.format)&&void 0!==o?o:32;if(100===d)this._sendResponse(h,"OK",g);else{const A=null!==(a=e.width)&&void 0!==a?a:0,i=null!==(n=e.height)&&void 0!==n?n:0;if(!A||!i)return this._sendResponse(h,"EINVAL:width and height required for raw pixel data",g),!0;const s=A*i*(32===d?4:3);if(t.length<s)return this._sendResponse(h,"EINVAL:insufficient pixel data",g),!0;this._sendResponse(h,"OK",g)}return!0}_handleDelete(e){var t;switch(null!==(t=e.deleteSelector)&&void 0!==t?t:"a"){case"a":case"A":this._cleanupAllPending(),this._kittyStorage.deleteAll();break;case"i":case"I":if(void 0!==e.id){const t=this._pendingTransmissions.get(e.id);t&&t.decoder.release(),this._removePendingEntry(e.id),this._kittyStorage.deleteById(e.id)}}return!0}_sendResponse(e,t,A,i){const s="OK"===t;if(s&&A>=1)return;if(!s&&A>=2)return;const r=`_Gi=${e}${i?`,p=${i}`:""};${t}\\`;this._coreTerminal._core.coreService.triggerDataEvent(r)}_displayImage(e,t){return this._decodeAndDisplay(e,t).then(()=>!0).catch(()=>!1)}async _decodeAndDisplay(e,t){var A,i,o,a,n,h,g;let d=await this._createBitmap(e);try{const l=Math.max(0,null!==(o=t.x)&&void 0!==o?o:0),I=Math.max(0,null!==(a=t.y)&&void 0!==a?a:0),c=t.sourceWidth||d.width-l,_=t.sourceHeight||d.height-I,C=Math.max(0,d.width-l),B=Math.max(0,d.height-I),Q=Math.max(0,Math.min(c,C)),m=Math.max(0,Math.min(_,B));if(0===Q||0===m)throw new Error("invalid source rectangle");if(0!==l||0!==I||Q!==d.width||m!==d.height){const e=await createImageBitmap(d,l,I,Q,m);d.close(),d=e}const E=(null===(A=this._renderer.dimensions)||void 0===A?void 0:A.css.cell.width)||r.CELL_SIZE_DEFAULT.width,u=(null===(i=this._renderer.dimensions)||void 0===i?void 0:i.css.cell.height)||r.CELL_SIZE_DEFAULT.height;let w,p;void 0!==t.columns&&void 0!==t.rows?(w=t.columns,p=t.rows):void 0!==t.columns?(w=t.columns,p=Math.max(1,Math.ceil(d.height/d.width*(w*E)/u))):void 0!==t.rows?(p=t.rows,w=Math.max(1,Math.ceil(d.width/d.height*(p*u)/E))):(w=Math.ceil(d.width/E),p=Math.ceil(d.height/u));let f=d.width,D=d.height;if(void 0===t.columns&&void 0===t.rows||(f=Math.round(w*E),D=Math.round(p*u)),f*D>this._opts.pixelLimit)throw new Error("image exceeds pixel limit");const y=this._coreTerminal._core.buffer,v=y.x,k=y.y,M=y.ybase,b=void 0!==t.zIndex&&t.zIndex<0?"bottom":"top";if(f!==d.width||D!==d.height){const e=await createImageBitmap(d,{resizeWidth:f,resizeHeight:D});d.close(),d=e}const S=Math.min(Math.max(0,null!==(n=t.xOffset)&&void 0!==n?n:0),E-1),L=Math.min(Math.max(0,null!==(h=t.yOffset)&&void 0!==h?h:0),u-1);if(0!==S||0!==L){const e=void 0!==t.columns?Math.round(w*E):d.width+S,A=void 0!==t.rows?Math.round(p*u):d.height+L,i=s.ImageRenderer.createCanvas(window.document,e,A),r=i.getContext("2d");if(!r)throw new Error("Failed to create offset canvas context");r.drawImage(d,S,L);const o=await createImageBitmap(i);if(i.width=i.height=0,d.close(),d=o,f=d.width,D=d.height,f*D>this._opts.pixelLimit)throw new Error("image exceeds pixel limit");void 0===t.columns&&(w=Math.ceil(d.width/E)),void 0===t.rows&&(p=Math.ceil(d.height/u))}const N=null!==(g=t.zIndex)&&void 0!==g?g:0;if(this._kittyStorage.addImage(e.id,d,!0,b,N),d=void 0,1===t.cursorMovement){const e=y.ybase-M;y.x=v,y.y=Math.max(k-e,0)}else y.x=Math.min(v+w,this._coreTerminal.cols)}catch(e){throw null==d||d.close(),e}}async _createBitmap(e){let t=new Uint8Array(await e.data.arrayBuffer());if("z"===e.compression&&(t=await this._decompressZlib(t)),100===e.format){const e=new Blob([t],{type:"image/png"});if(!window.createImageBitmap){const t=URL.createObjectURL(e),A=new Image;return new Promise((e,i)=>{A.addEventListener("load",()=>{var r;URL.revokeObjectURL(t);const o=s.ImageRenderer.createCanvas(window.document,A.width,A.height);null===(r=o.getContext("2d"))||void 0===r||r.drawImage(A,0,0),createImageBitmap(o).then(e).catch(i)}),A.addEventListener("error",()=>{URL.revokeObjectURL(t),i(new Error("Failed to load image"))}),A.src=t})}return createImageBitmap(e)}const A=e.width,i=e.height;if(!A||!i)throw new Error("Width and height required for raw pixel data");const r=A*i*(32===e.format?4:3);if(t.length<r)throw new Error("Insufficient pixel data");const o=A*i;if(32===e.format)return createImageBitmap(new ImageData(new Uint8ClampedArray(t.buffer,t.byteOffset,4*o),A,i));const a=new Uint8ClampedArray(4*o),n=new Uint32Array(t.buffer,t.byteOffset,Math.floor(t.byteLength/4)),h=new Uint32Array(a.buffer),g=-4&o;let d=0,l=0;for(let e=0;e<g;e+=4){const e=n[d++],t=n[d++],A=n[d++];h[l++]=4278190080|e,h[l++]=4278190080|e>>>24|t<<8,h[l++]=4278190080|t>>>16|A<<16,h[l++]=4278190080|A>>>8}let I=3*g,c=4*g;for(let e=g;e<o;e++)a[c]=t[I],a[c+1]=t[I+1],a[c+2]=t[I+2],a[c+3]=255,I+=3,c+=4;return createImageBitmap(new ImageData(a,A,i))}async _decompressZlib(e){try{return await this._decompress(e,"deflate")}catch(t){return await this._decompress(e,"deflate-raw")}}async _decompress(e,t){const A=new DecompressionStream(t),i=A.writable.getWriter();i.write(e),i.close();const s=[],r=A.readable.getReader();for(;;){const{done:e,value:t}=await r.read();if(e)break;s.push(t)}const o=s.reduce((e,t)=>e+t.length,0),a=new Uint8Array(o);let n=0;for(const e of s)a.set(e,n),n+=e.length;return a}get images(){return this._kittyStorage.images}get _kittyIdToStorageId(){return this._kittyStorage.kittyIdToStorageId}get pendingTransmissions(){return this._pendingTransmissions}}},470(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.parseKittyCommand=function(e){const t={},A=e.split(",");for(const e of A){const A=e.indexOf("=");if(-1===A)continue;const i=e.substring(0,A),s=e.substring(A+1);if("a"===i){t.action=s;continue}if("o"===i){t.compression=s;continue}if("t"===i){t.transmission=s;continue}if("d"===i){t.deleteSelector=s;continue}const r=parseInt(s,10);switch(i){case"f":t.format=r;break;case"i":t.id=r;break;case"I":t.imageNumber=r;break;case"s":t.width=r;break;case"v":t.height=r;break;case"x":t.x=r;break;case"y":t.y=r;break;case"w":t.sourceWidth=r;break;case"h":t.sourceHeight=r;break;case"X":t.xOffset=r;break;case"Y":t.yOffset=r;break;case"c":t.columns=r;break;case"r":t.rows=r;break;case"m":t.more=r;break;case"q":t.quiet=r;break;case"C":t.cursorMovement=r;break;case"z":t.zIndex=r;break;case"p":t.placementId=r}}return t}},235(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.KittyImageStorage=void 0;class A{constructor(e){this._storage=e,this._nextImageId=1,this._images=new Map,this._kittyIdToStorageId=new Map,this._storageIdToKittyId=new Map,this._handleStorageImageDeleted=e=>{const t=this._storageIdToKittyId.get(e);void 0!==t&&(this._kittyIdToStorageId.delete(t),this._storageIdToKittyId.delete(e),this._images.delete(t))},this._addImageOpts={scrolling:!0,layer:"top",zIndex:0,cursorPos:"iip"},this._previousOnImageDeleted=this._storage.onImageDeleted,this._wrappedOnImageDeleted=e=>{var t;null===(t=this._previousOnImageDeleted)||void 0===t||t.call(this,e),this._handleStorageImageDeleted(e)},this._storage.onImageDeleted=this._wrappedOnImageDeleted}reset(){this._nextImageId=1,this._images.clear(),this._kittyIdToStorageId.clear(),this._storageIdToKittyId.clear()}dispose(){this.reset(),this._storage.onImageDeleted===this._wrappedOnImageDeleted&&(this._storage.onImageDeleted=this._previousOnImageDeleted)}storeImage(e,t){const i=null!=e?e:this._nextImageId++,s=this._kittyIdToStorageId.get(i);return void 0!==s&&(this._storage.deleteImage(s),this._kittyIdToStorageId.delete(i),this._storageIdToKittyId.delete(s)),!this._images.has(i)&&this._images.size>=A._maxStoredImages&&this._evictUndisplayedImages(),this._images.set(i,Object.assign(Object.assign({},t),{id:i})),i}addImage(e,t,A,i,s){const r=this._kittyIdToStorageId.get(e);void 0!==r&&this._storageIdToKittyId.delete(r),this._addImageOpts.scrolling=A,this._addImageOpts.layer=i,this._addImageOpts.zIndex=s;const o=this._storage.addImage(t,this._addImageOpts);this._kittyIdToStorageId.set(e,o),this._storageIdToKittyId.set(o,e)}getImage(e){return this._images.get(e)}deleteById(e){this._images.delete(e);const t=this._kittyIdToStorageId.get(e);void 0!==t&&(this._storage.deleteImage(t),this._kittyIdToStorageId.delete(e),this._storageIdToKittyId.delete(t))}deleteAll(){this._images.clear();for(const e of this._kittyIdToStorageId.values())this._storage.deleteImage(e);this._kittyIdToStorageId.clear(),this._storageIdToKittyId.clear()}get images(){return this._images}get kittyIdToStorageId(){return this._kittyIdToStorageId}get lastImageId(){return this._nextImageId-1}_evictUndisplayedImages(){for(const[e]of this._images){if(this._images.size<=A._maxStoredImages/2)break;this._kittyIdToStorageId.has(e)||this._images.delete(e)}}}t.KittyImageStorage=A,A._maxStoredImages=256},669(e,t,A){Object.defineProperty(t,"__esModule",{value:!0});const i=(0,A(552).InWasm)({s:1,t:0,d:"AGFzbQEAAAABBQFgAAF/Ag8BA2VudgZtZW1vcnkCAAEDAwIAAAcNAgNkZWMAAANlbmQAAQqLBgKZBAEKf0GIKCgCAEGgKGohAUGEKCgCACIDQaAoaiEAQYAoKAIAQQFrQXxxIgRBoChqIQUgBEEQayADSgRAIARBkChqIQMDQCABIABBA2otAABBAnQoAoAgIABBAmotAABBAnQoAoAYIABBAWotAABBAnQoAoAQIAAtAABBAnQoAoAIcnJyIgY2AgAgAUEDaiAAQQdqLQAAQQJ0KAKAICAAQQZqLQAAQQJ0KAKAGCAAQQVqLQAAQQJ0KAKAECAAQQRqLQAAQQJ0KAKACHJyciIHNgIAIAFBBmogAEELai0AAEECdCgCgCAgAEEKai0AAEECdCgCgBggAEEJai0AAEECdCgCgBAgAEEIai0AAEECdCgCgAhycnIiCDYCACABQQlqIABBD2otAABBAnQoAoAgIABBDmotAABBAnQoAoAYIABBDWotAABBAnQoAoAQIABBDGotAABBAnQoAoAIcnJyIgk2AgAgAiAGciAHciAIciAJciECIAFBDGohASAAQRBqIgAgA0kNAAsLIAAgBUkEQANAIAEgAEEDai0AAEECdCgCgCAgAEECai0AAEECdCgCgBggAEEBai0AAEECdCgCgBAgAC0AAEECdCgCgAhycnIiAzYCACACIANyIQIgAUEDaiEBIABBBGoiACAFSQ0ACwtBfyEAIAJB////B00Ef0GEKCAENgIAQYgoIAFBoChrNgIAQQAFQX8LC+0BAQR/AkBBgCgoAgAiAUGEKCgCACIAa0EFTgRAQX8hAxAADQFBgCgoAgAhAUGEKCgCACEAC0F/IQMgASAAayIBQQJIDQAgAC0AoShBAnQoAoAQIAAtAKAoQQJ0KAKACHIhAgJ/IAFBBEYEQEEDQQQgAC0AoyhBPUYbIAAtAKIoQT1GayEBC0EBIAFBA0kNABogAC0AoihBAnQoAoAYIAJyIQJBAiABQQRHDQAaIAAtAKMoQQJ0KAKAICACciECQQMLIQEgAkH///8HSw0AQQAhA0GIKCgCACIAIAI2AKAoQYgoIAAgAWo2AgALIAML"}),s=new Uint8Array("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".split("").map(e=>e.charCodeAt(0))),r=new Uint32Array(1024);r.fill(4278190080);for(let e=0;e<s.length;++e)r[s[e]]=e<<2;for(let e=0;e<s.length;++e)r[256+s[e]]=e>>4|(e<<4&255)<<8;for(let e=0;e<s.length;++e)r[512+s[e]]=e>>2<<8|(e<<6&255)<<16;for(let e=0;e<s.length;++e)r[768+s[e]]=e<<16;const o=new Uint8Array(0);t.default=class{constructor(e,t,A){if(this._inst=null,this._ended=!0,this._bytes=0,this.keepSize=null!=e?e:1048576,this.maxBytes=null!=t?t:4294901760,this._bytes=null!=A?A:32768,this._bytes>this.maxBytes||this.maxBytes>4294901760)throw new Error("invalid byte settings")}get data8(){return this._inst?this._d.subarray(0,this._m32[1282]):o}release(){this._inst&&(this._bytes>this.keepSize?this._inst=this._m32=this._d=this._mem=null:(this._m32[1280]=0,this._m32[1281]=0,this._m32[1282]=0))}init(e,t){if(this.maxBytes=null!=e?e:this.maxBytes,this._bytes=null!=t?t:Math.min(this._bytes,this.maxBytes),this._bytes>this.maxBytes||this.maxBytes>4294901760)throw Error("invalid byte settings");let A=this._m32;const s=this._bytes+5152;this._inst?this._mem.buffer.byteLength<s&&(this._mem.grow(Math.ceil((s-this._mem.buffer.byteLength)/65536)),A=new Uint32Array(this._mem.buffer,0),this._d=new Uint8Array(this._mem.buffer,5152)):(this._mem=new WebAssembly.Memory({initial:Math.ceil(s/65536)}),this._inst=i({env:{memory:this._mem}}),A=new Uint32Array(this._mem.buffer,0),A.set(r,256),this._d=new Uint8Array(this._mem.buffer,5152)),A[1280]=0,A[1281]=0,A[1282]=0,this._m32=A,this._ended=!1}_realloc(e){const t=this._m32[1280]+e;if(this._bytes<t){if(t>this.maxBytes)return-3;let e=this._bytes;for(;(e*=2)<t;);if(e=Math.min(e,this.maxBytes),e<t)return-3;if(e+5152>this._mem.buffer.byteLength){const t=Math.ceil((e+5152-this._mem.buffer.byteLength)/65536);this._mem.grow(t),this._m32=new Uint32Array(this._mem.buffer,0),this._d=new Uint8Array(this._mem.buffer,5152)}this._bytes=e}return 0}put(e){if(!this._inst||this._ended)return-2;if(this._realloc(e.length))return-3;const t=this._m32;return this._d.set(e,t[1280]),t[1280]+=e.length,t[1280]-t[1281]>=131072?this._inst.exports.dec():0}end(){return this._ended=!0,this._inst?this._inst.exports.end():-2}get loadedBytes(){return this._inst?this._m32[1280]:0}get freeBytes(){return this._inst?this.maxBytes-this._m32[1280]:0}}},61(e,t,A){Object.defineProperty(t,"__esModule",{value:!0});const i=(0,A(552).InWasm)({s:1,t:0,d:"AGFzbQEAAAABCgJgAABgA39/fwACDwEDZW52Bm1lbW9yeQIAAQMDAgABBwcBA2RlYwABCAEACu4EAgwAQQBBAEGAAvwLAAveBAEJf0EAQQBBgAL8CwAgAUEXTgRAIAAgAWpBCGshCkGACCEBIAJBAnRBgAhqIQsgAEEOaiEDQf8BIQZBACECA0AgA0EBaiEHIAMtAAAiCEE/cSEAAkACQCAIQcABcSIJRQRAIABBAnQiAC0AAyEGIAAtAAIhBCAALQABIQUgAC0AACECIAchAwwBCwJAIAhB/QFLDQAgCUHAAUcNACAFQQVsIAJBA2xqIARBB2xqIAZBC2xqQT9xQQJ0IgMgBDoAAiADIAU6AAEgAyACOgAAIANBA2ogBjoAAANAIAEgAjoAACABQQNqIAY6AAAgAUECaiAEOgAAIAFBAWogBToAACABQQRqIQEgAEUEQCAHIQMMBAsgAEEBayEAIAEgC0kNAAsgByEDDAILAn8CQAJAAkAgCEH+AWsOAgABAgsgAy0AAyEEIAMtAAIhBSADLQABIQIgA0EEagwCCyADKAIBIgJBGHYhBiACQRB2IQQgAkEIdiEFIANBBWoMAQsgCUGAAUcEQCAHIAlBwABHDQEaIAQgCEEDcWpBAmshBCACIABBBHZqQQJrIQIgBSAIQQJ2QQNxakECayEFIAcMAQsgBCAAQShrIgkgAy0AASIHQQ9xamohBCACIAdBBHYgCWpqIQIgACAFakEgayEFIANBAmoLIQMgBUEFbCACQQNsaiAEQQdsaiAGQQtsakE/cUECdCIAIAQ6AAIgACAFOgABIAAgAjoAACAAQQNqIAY6AAALIAEgBjoAAyABIAQ6AAIgASAFOgABIAEgAjoAACABQQRqIQELIAMgCkkNAAsLCw=="});t.default=class{constructor(e){this.keepSize=e,this.width=0,this.height=0}decode(e){this.width=e[4]<<24|e[5]<<16|e[6]<<8|e[7],this.height=e[8]<<24|e[9]<<16|e[10]<<8|e[11];const t=this.width*this.height,A=4*t,s=e.length,r=Math.max(A,s)+(Math.min(A,s)>>1)+4096;this._inst?this._mem.buffer.byteLength<r&&(this._mem.grow(Math.ceil((r-this._mem.buffer.byteLength)/65536)),this._d=null):(this._mem=new WebAssembly.Memory({initial:Math.ceil(r/65536)}),this._inst=i({env:{memory:this._mem}})),this._d||(this._d=new Uint8Array(this._mem.buffer));const o=this._mem.buffer.byteLength-s&-256;return this._d.set(e,o),this._inst.exports.dec(o,s,t),this._d.subarray(1024,1024+A)}release(){this._inst&&this._mem.buffer.byteLength>this.keepSize&&(this._inst=this._d=this._mem=null)}}},552(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.InWasm=function(e){if(e.d){const{t,s:i,d:s}=e;let r,o;const a=WebAssembly;return 0===t?i?e=>new a.Instance(o||(o=new a.Module(r||(r=A(s)))),e):e=>o?a.instantiate(o,e):a.instantiate(r||(r=A(s)),e).then(e=>(o=e.module)&&e.instance):1===t?i?()=>o||(o=new a.Module(r||(r=A(s)))):()=>o?Promise.resolve(o):a.compile(r||(r=A(s))).then(e=>o=e):i?()=>r||(r=A(s)):()=>Promise.resolve(r||(r=A(s)))}if("undefined"==typeof _wasmCtx)throw new Error('must run "inwasm"');_wasmCtx.add(e)};let A=e=>{if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e);if("undefined"!=typeof Buffer)return Buffer.from(e,"base64");const t=atob(e),A=new Uint8Array(t.length);for(let e=0;e<A.length;++e)A[e]=t.charCodeAt(e);return A}}},t={};function A(i){var s=t[i];if(void 0!==s)return s.exports;var r=t[i]={exports:{}};return e[i].call(r.exports,r,r.exports,A),r.exports}var i={};return(()=>{var e=i;Object.defineProperty(e,"__esModule",{value:!0}),e.ImageAddon=void 0;const t=A(414),s=A(795),r=A(463),o=A(699),a=A(23),n=A(235),h=A(566),g=A(994),d=A(649),l={enableSizeReports:!0,pixelLimit:16777216,sixelSupport:!0,sixelScrolling:!0,sixelPaletteLimit:4096,sixelSizeLimit:33554432,storageLimit:128,showPlaceholder:!0,iipSupport:!0,iipSizeLimit:33554432,kittySupport:!0,kittySizeLimit:33554432};e.ImageAddon=class{constructor(e){this._disposables=[],this._handlers=new Map,this._onImageAdded=new t.Emitter,this.onImageAdded=this._onImageAdded.event,this._opts=Object.assign({},l,e),this._defaultOpts=Object.assign({},l,e)}dispose(){for(const e of this._disposables)e.dispose();this._disposables.length=0,this._handlers.clear(),this._onImageAdded.dispose()}_disposeLater(...e){for(const t of e)this._disposables.push(t)}activate(e){var t;if(this._terminal=e,this._renderer=new r.ImageRenderer(e),this._storage=new o.ImageStorage(e,this._renderer,this._opts),this._storage.onImageAdded=()=>this._onImageAdded.fire(),this._opts.enableSizeReports){const A=null!==(t=e.options.windowOptions)&&void 0!==t?t:{};A.getWinSizePixels=!0,A.getCellSizePixels=!0,A.getWinSizeChars=!0,e.options.windowOptions=A}if(this._disposeLater(this._renderer,this._storage,e.parser.registerCsiHandler({prefix:"?",final:"h"},e=>this._decset(e)),e.parser.registerCsiHandler({prefix:"?",final:"l"},e=>this._decrst(e)),e.parser.registerCsiHandler({final:"c"},e=>this._da1(e)),e.parser.registerCsiHandler({prefix:"?",final:"S"},e=>this._xtermGraphicsAttributes(e)),e.onRender(e=>{var t;return null===(t=this._storage)||void 0===t?void 0:t.render(e)}),e.parser.registerCsiHandler({intermediates:"!",final:"p"},()=>this.reset()),e.parser.registerEscHandler({final:"c"},()=>this.reset()),e._core._inputHandler.onRequestReset(()=>this.reset()),e.buffer.onBufferChange(()=>{var e;return null===(e=this._storage)||void 0===e?void 0:e.wipeAlternate()}),e.onResize(e=>{var t;return null===(t=this._storage)||void 0===t?void 0:t.viewportResize(e)})),this._opts.sixelSupport){const t=new g.SixelImageStorage(this._storage,this._opts,this._renderer,e),A=new h.SixelHandler(this._opts,t,e);this._handlers.set("sixel",A),this._disposeLater(e._core._inputHandler._parser.registerDcsHandler({final:"q"},A))}if(this._opts.iipSupport){const t=new d.IIPImageStorage(this._storage),A=new s.IIPHandler(this._opts,this._renderer,t,e);this._handlers.set("iip",A),this._disposeLater(e._core._inputHandler._parser.registerOscHandler(1337,A))}if(this._opts.kittySupport){const t=new n.KittyImageStorage(this._storage),A=new a.KittyGraphicsHandler(this._opts,this._renderer,t,e);this._handlers.set("kitty",A),this._disposeLater(t,A,e._core._inputHandler._parser.registerApcHandler({final:"G"},A))}}reset(){var e;this._opts.sixelScrolling=this._defaultOpts.sixelScrolling,this._opts.sixelPaletteLimit=this._defaultOpts.sixelPaletteLimit,null===(e=this._storage)||void 0===e||e.reset();for(const e of this._handlers.values())e.reset();return!1}get storageLimit(){var e;return(null===(e=this._storage)||void 0===e?void 0:e.getLimit())||-1}set storageLimit(e){var t;null===(t=this._storage)||void 0===t||t.setLimit(e),this._opts.storageLimit=e}get storageUsage(){return this._storage?this._storage.getUsage():-1}get showPlaceholder(){return this._opts.showPlaceholder}set showPlaceholder(e){var t;this._opts.showPlaceholder=e,null===(t=this._renderer)||void 0===t||t.showPlaceholder(e)}getImageAtBufferCell(e,t){var A;return null===(A=this._storage)||void 0===A?void 0:A.getImageAtBufferCell(e,t)}extractTileAtBufferCell(e,t){var A;return null===(A=this._storage)||void 0===A?void 0:A.extractTileAtBufferCell(e,t)}_report(e){var t;null===(t=this._terminal)||void 0===t||t._core.input(e,!1)}_decset(e){for(let t=0;t<e.length;++t)80===e[t]&&(this._opts.sixelScrolling=!1);return!1}_decrst(e){for(let t=0;t<e.length;++t)80===e[t]&&(this._opts.sixelScrolling=!0);return!1}_da1(e){return!!e[0]||!!this._opts.sixelSupport&&(this._report("[?62;4;9;22c"),!0)}_xtermGraphicsAttributes(e){var t,A,i,s,r,a;if(e.length<2)return!0;if(1===e[0])switch(e[1]){case 1:return this._report(`[?${e[0]};0;${this._opts.sixelPaletteLimit}S`),!0;case 2:this._opts.sixelPaletteLimit=this._defaultOpts.sixelPaletteLimit,this._report(`[?${e[0]};0;${this._opts.sixelPaletteLimit}S`);for(const e of this._handlers.values())e.reset();return!0;case 3:return e.length>2&&!(e[2]instanceof Array)&&e[2]<=4096?(this._opts.sixelPaletteLimit=e[2],this._report(`[?${e[0]};0;${this._opts.sixelPaletteLimit}S`)):this._report(`[?${e[0]};2S`),!0;case 4:return this._report(`[?${e[0]};0;4096S`),!0;default:return this._report(`[?${e[0]};2S`),!0}if(2===e[0])switch(e[1]){case 1:let n=null===(A=null===(t=this._renderer)||void 0===t?void 0:t.dimensions)||void 0===A?void 0:A.css.canvas.width,h=null===(s=null===(i=this._renderer)||void 0===i?void 0:i.dimensions)||void 0===s?void 0:s.css.canvas.height;if(!n||!h){const e=o.CELL_SIZE_DEFAULT;n=((null===(r=this._terminal)||void 0===r?void 0:r.cols)||80)*e.width,h=((null===(a=this._terminal)||void 0===a?void 0:a.rows)||24)*e.height}if(n*h<this._opts.pixelLimit)this._report(`[?${e[0]};0;${n.toFixed(0)};${h.toFixed(0)}S`);else{const t=Math.floor(Math.sqrt(this._opts.pixelLimit));this._report(`[?${e[0]};0;${t};${t}S`)}return!0;case 4:const g=Math.floor(Math.sqrt(this._opts.pixelLimit));return this._report(`[?${e[0]};0;${g};${g}S`),!0;default:return this._report(`[?${e[0]};2S`),!0}return this._report(`[?${e[0]};1S`),!0}}})(),i})());
-+!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.ImageAddon=t():e.ImageAddon=t()}(globalThis,()=>(()=>{"use strict";var e={939(e,t){function i(e){return 255&e}function A(e){return e>>>8&255}function s(e){return e>>>16&255}function r(e,t,i,A=255){return((255&A)<<24|(255&i)<<16|(255&t)<<8|255&e)>>>0}function o(e,t,i){return Math.max(e,Math.min(i,t))}function a(e,t,i){return i<0&&(i+=1),i>1&&(i-=1),6*i<1?t+6*(e-t)*i:2*i<1?e:3*i<2?t+(e-t)*(4-6*i):t}function n(e,t,i){return(4278190080|Math.round(i/100*255)<<16|Math.round(t/100*255)<<8|Math.round(e/100*255))>>>0}Object.defineProperty(t,"__esModule",{value:!0}),t.DEFAULT_FOREGROUND=t.DEFAULT_BACKGROUND=t.PALETTE_ANSI_256=t.PALETTE_VT340_GREY=t.PALETTE_VT340_COLOR=t.normalizeHLS=t.normalizeRGB=t.nearestColorIndex=t.fromRGBA8888=t.toRGBA8888=t.alpha=t.blue=t.green=t.red=t.BIG_ENDIAN=void 0,t.BIG_ENDIAN=255===new Uint8Array(new Uint32Array([4278190080]).buffer)[0],t.BIG_ENDIAN&&console.warn("BE platform detected. This version of node-sixel works only on LE properly."),t.red=i,t.green=A,t.blue=s,t.alpha=function(e){return e>>>24&255},t.toRGBA8888=r,t.fromRGBA8888=function(e){return[255&e,e>>8&255,e>>16&255,e>>>24]},t.nearestColorIndex=function(e,t){const r=i(e),o=A(e),a=s(e);let n=Number.MAX_SAFE_INTEGER,h=-1;for(let e=0;e<t.length;++e){const i=r-t[e][0],A=o-t[e][1],s=a-t[e][2],g=i*i+A*A+s*s;if(!g)return e;g<n&&(n=g,h=e)}return h},t.normalizeRGB=n,t.normalizeHLS=function(e,t,i){return function(e,t,i){if(!i){const e=Math.round(255*t);return r(e,e,e)}const A=t<.5?t*(1+i):t+i-t*i,s=2*t-A;return r(o(0,255,Math.round(255*a(A,s,e+1/3))),o(0,255,Math.round(255*a(A,s,e))),o(0,255,Math.round(255*a(A,s,e-1/3))))}((e+240)/360,t/100,i/100)},t.PALETTE_VT340_COLOR=new Uint32Array([n(0,0,0),n(20,20,80),n(80,13,13),n(20,80,20),n(80,20,80),n(20,80,80),n(80,80,20),n(53,53,53),n(26,26,26),n(33,33,60),n(60,26,26),n(33,60,33),n(60,33,60),n(33,60,60),n(60,60,33),n(80,80,80)]),t.PALETTE_VT340_GREY=new Uint32Array([n(0,0,0),n(13,13,13),n(26,26,26),n(40,40,40),n(6,6,6),n(20,20,20),n(33,33,33),n(46,46,46),n(0,0,0),n(13,13,13),n(26,26,26),n(40,40,40),n(6,6,6),n(20,20,20),n(33,33,33),n(46,46,46)]),t.PALETTE_ANSI_256=(()=>{const e=[r(0,0,0),r(205,0,0),r(0,205,0),r(205,205,0),r(0,0,238),r(205,0,205),r(0,250,205),r(229,229,229),r(127,127,127),r(255,0,0),r(0,255,0),r(255,255,0),r(92,92,255),r(255,0,255),r(0,255,255),r(255,255,255)],t=[0,95,135,175,215,255];for(let i=0;i<6;++i)for(let A=0;A<6;++A)for(let s=0;s<6;++s)e.push(r(t[i],t[A],t[s]));for(let t=8;t<=238;t+=10)e.push(r(t,t,t));return new Uint32Array(e)})(),t.DEFAULT_BACKGROUND=r(0,0,0,255),t.DEFAULT_FOREGROUND=r(255,255,255,255)},591(e,t,i){Object.defineProperty(t,"__esModule",{value:!0}),t.decodeAsync=t.decode=t.Decoder=t.DecoderAsync=void 0;const A=i(939),s=i(199),r=function(e){if("undefined"!=typeof Buffer)return Buffer.from(e,"base64");const t=atob(e),i=new Uint8Array(t.length);for(let e=0;e<i.length;++e)i[e]=t.charCodeAt(e);return i}(s.LIMITS.BYTES);let o;const a=new Uint32Array;class n{constructor(){this.bandHandler=e=>1,this.modeHandler=e=>1}handle_band(e){return this.bandHandler(e)}mode_parsed(e){return this.modeHandler(e)}}const h={memoryLimit:134217728,sixelColor:A.DEFAULT_FOREGROUND,fillColor:A.DEFAULT_BACKGROUND,palette:A.PALETTE_VT340_COLOR,paletteLimit:s.LIMITS.PALETTE_SIZE,truncate:!0};function g(e){const t=new n,i={env:{handle_band:t.handle_band.bind(t),mode_parsed:t.mode_parsed.bind(t)}};return WebAssembly.instantiate(o||r,i).then(i=>(o=o||i.module,new d(e,i.instance||i,t)))}t.DecoderAsync=g;class d{constructor(e,t,i){if(this._PIXEL_OFFSET=s.LIMITS.MAX_WIDTH+4,this._canvas=a,this._bandWidths=[],this._maxWidth=0,this._minWidth=s.LIMITS.MAX_WIDTH,this._lastOffset=0,this._currentHeight=0,this._opts=Object.assign({},h,e),this._opts.paletteLimit>s.LIMITS.PALETTE_SIZE)throw new Error(`DecoderOptions.paletteLimit must not exceed ${s.LIMITS.PALETTE_SIZE}`);if(t)i.bandHandler=this._handle_band.bind(this),i.modeHandler=this._initCanvas.bind(this);else{const e=o||(o=new WebAssembly.Module(r));t=new WebAssembly.Instance(e,{env:{handle_band:this._handle_band.bind(this),mode_parsed:this._initCanvas.bind(this)}})}this._instance=t,this._wasm=this._instance.exports,this._chunk=new Uint8Array(this._wasm.memory.buffer,this._wasm.get_chunk_address(),s.LIMITS.CHUNK_SIZE),this._states=new Uint32Array(this._wasm.memory.buffer,this._wasm.get_state_address(),12),this._palette=new Uint32Array(this._wasm.memory.buffer,this._wasm.get_palette_address(),s.LIMITS.PALETTE_SIZE),this._palette.set(this._opts.palette),this._pSrc=new Uint32Array(this._wasm.memory.buffer,this._wasm.get_p0_address()),this._wasm.init(A.DEFAULT_FOREGROUND,0,this._opts.paletteLimit,0)}get _fillColor(){return this._states[0]}get _truncate(){return this._states[8]}get _rasterWidth(){return this._states[6]}get _rasterHeight(){return this._states[7]}get _width(){return this._states[2]?this._states[2]-4:0}get _height(){return this._states[3]}get _level(){return this._states[9]}get _mode(){return this._states[10]}get _paletteLimit(){return this._states[11]}_initCanvas(e){if(2===e){const e=this.width*this.height;if(e>this._canvas.length){if(this._opts.memoryLimit&&4*e>this._opts.memoryLimit)throw this.release(),new Error("image exceeds memory limit");this._canvas=new Uint32Array(e)}this._maxWidth=this._width}else if(1===e)if(2===this._level){const e=Math.min(this._rasterWidth,s.LIMITS.MAX_WIDTH)*this._rasterHeight;if(e>this._canvas.length){if(this._opts.memoryLimit&&4*e>this._opts.memoryLimit)throw this.release(),new Error("image exceeds memory limit");this._canvas=new Uint32Array(e)}}else this._canvas.length<65536&&(this._canvas=new Uint32Array(65536));return 0}_realloc(e,t){const i=e+t;if(i>this._canvas.length){if(this._opts.memoryLimit&&4*i>this._opts.memoryLimit)throw this.release(),new Error("image exceeds memory limit");const e=new Uint32Array(65536*Math.ceil(i/65536));e.set(this._canvas),this._canvas=e}}_handle_band(e){const t=this._PIXEL_OFFSET;let i=this._lastOffset;if(2===this._mode){let A=this.height-this._currentHeight,s=0;for(;s<6&&A>0;)this._canvas.set(this._pSrc.subarray(t*s,t*s+e),i+e*s),s++,A--;this._lastOffset+=e*s,this._currentHeight+=s}else if(1===this._mode){this._realloc(i,6*e),this._maxWidth=Math.max(this._maxWidth,e),this._minWidth=Math.min(this._minWidth,e);for(let A=0;A<6;++A)this._canvas.set(this._pSrc.subarray(t*A,t*A+e),i+e*A);this._bandWidths.push(e),this._lastOffset+=6*e,this._currentHeight+=6}return 0}get width(){return 1!==this._mode?this._width:Math.max(this._maxWidth,this._wasm.current_width())}get height(){return 1!==this._mode?this._height:this._wasm.current_width()?6*this._bandWidths.length+this._wasm.current_height():6*this._bandWidths.length}get palette(){return this._palette.subarray(0,this._paletteLimit)}get memoryUsage(){return this._canvas.byteLength+this._wasm.memory.buffer.byteLength+8*this._bandWidths.length}get properties(){return{width:this.width,height:this.height,mode:this._mode,level:this._level,truncate:!!this._truncate,paletteLimit:this._paletteLimit,fillColor:this._fillColor,memUsage:this.memoryUsage,rasterAttributes:{numerator:this._states[4],denominator:this._states[5],width:this._rasterWidth,height:this._rasterHeight}}}init(e=this._opts.fillColor,t=this._opts.palette,i=this._opts.paletteLimit,A=this._opts.truncate){this._wasm.init(this._opts.sixelColor,e,i,A?1:0),t&&this._palette.set(t.subarray(0,s.LIMITS.PALETTE_SIZE)),this._bandWidths.length=0,this._maxWidth=0,this._minWidth=s.LIMITS.MAX_WIDTH,this._lastOffset=0,this._currentHeight=0}decode(e,t=0,i=e.length){let A=t;for(;A<i;){const t=Math.min(i-A,s.LIMITS.CHUNK_SIZE);this._chunk.set(e.subarray(A,A+=t)),this._wasm.decode(0,t)}}decodeString(e,t=0,i=e.length){let A=t;for(;A<i;){const t=Math.min(i-A,s.LIMITS.CHUNK_SIZE);for(let i=0,s=A;i<t;++i,++s)this._chunk[i]=e.charCodeAt(s);A+=t,this._wasm.decode(0,t)}}get data32(){if(0===this._mode||!this.width||!this.height)return a;const e=this._wasm.current_width();if(2===this._mode){let t=this.height-this._currentHeight;if(t>0){const i=this._PIXEL_OFFSET;let A=this._lastOffset,s=0;for(;s<6&&t>0;)this._canvas.set(this._pSrc.subarray(i*s,i*s+e),A+e*s),s++,t--;t&&this._canvas.fill(this._fillColor,A+e*s)}return this._canvas.subarray(0,this.width*this.height)}if(1===this._mode){if(this._minWidth===this._maxWidth){let t=!1;if(e)if(e!==this._minWidth)t=!0;else{const t=this._PIXEL_OFFSET;let i=this._lastOffset;this._realloc(i,6*e);for(let A=0;A<6;++A)this._canvas.set(this._pSrc.subarray(t*A,t*A+e),i+e*A)}if(!t)return this._canvas.subarray(0,this.width*this.height)}const t=new Uint32Array(this.width*this.height);t.fill(this._fillColor);let i=0,A=0;for(let e=0;e<this._bandWidths.length;++e){const s=this._bandWidths[e];for(let e=0;e<6;++e)t.set(this._canvas.subarray(A,A+=s),i),i+=this.width}if(e){const A=this._PIXEL_OFFSET,s=this._wasm.current_height();for(let r=0;r<s;++r)t.set(this._pSrc.subarray(A*r,A*r+e),i+this.width*r)}return t}return a}get data8(){return new Uint8ClampedArray(this.data32.buffer,0,this.width*this.height*4)}release(){this._canvas=a,this._bandWidths.length=0,this._maxWidth=0,this._minWidth=s.LIMITS.MAX_WIDTH,this._wasm.init(A.DEFAULT_FOREGROUND,0,this._opts.paletteLimit,0)}}t.Decoder=d,t.decode=function(e,t){const i=new d(t);return i.init(),"string"==typeof e?i.decodeString(e):i.decode(e),{width:i.width,height:i.height,data32:i.data32,data8:i.data8}},t.decodeAsync=async function(e,t){const i=await g(t);return i.init(),"string"==typeof e?i.decodeString(e):i.decode(e),{width:i.width,height:i.height,data32:i.data32,data8:i.data8}}},199(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.LIMITS=void 0,t.LIMITS={CHUNK_SIZE:16384,PALETTE_SIZE:4096,MAX_WIDTH:16384,BYTES:"AGFzbQEAAAABJAdgAAF/YAJ/fwBgA39/fwF/YAF/AX9gAABgBH9/f38AYAF/AAIlAgNlbnYLaGFuZGxlX2JhbmQAAwNlbnYLbW9kZV9wYXJzZWQAAwMTEgQAAAAAAQQBAQUBAAACAgAGAwQFAXABBwcFBAEBBwcGCAF/AUGAihoLB9wBDgZtZW1vcnkCABFnZXRfc3RhdGVfYWRkcmVzcwADEWdldF9jaHVua19hZGRyZXNzAAQOZ2V0X3AwX2FkZHJlc3MABRNnZXRfcGFsZXR0ZV9hZGRyZXNzAAYEaW5pdAALBmRlY29kZQAMDWN1cnJlbnRfd2lkdGgADQ5jdXJyZW50X2hlaWdodAAOGV9faW5kaXJlY3RfZnVuY3Rpb25fdGFibGUBAAtfaW5pdGlhbGl6ZQACCXN0YWNrU2F2ZQARDHN0YWNrUmVzdG9yZQASCnN0YWNrQWxsb2MAEwkMAQBBAQsGCgcJDxACDAEBCq5UEgMAAQsFAEGgCAsGAEGQiQELBgBBsIkCCwUAQZAJC+okAQh/QeQIKAIAIQVB4AgoAgAhA0HoCCgCACEIIAFBkIkBaiIJQf8BOgAAIAAgAUgEQCAAQZCJAWohBgNAIAMhBCAGQQFqIQECQCAGLQAAQf8AcSIDQTBrQQlLBEAgASEGDAELQewIKAIAQQJ0QewIaiICKAIAIQADQCACIAMgAEEKbGpBMGsiADYCACABLQAAIQMgAUEBaiIGIQEgA0H/AHEiA0Ewa0EKSQ0ACwsCQAJAAkACQAJAAkACQAJ/AkACQCADQT9rIgBBP00EQCAERQ0BIARBIUYEQAJAQfAIKAIAIgFBASABGyIHIAhqIgFB1AgoAgAiA0gNACADQf//AEoNAANAIANBAnQiAkGgiQJqIgRBoAgpAwA3AwAgAkGoiQJqQaAIKQMANwMAIAJBsIkCakGgCCkDADcDACACQbiJAmpBoAgpAwA3AwAgAkHAiQJqQaAIKQMANwMAIAJByIkCakGgCCkDADcDACACQdCJAmpBoAgpAwA3AwAgAkHYiQJqQaAIKQMANwMAIAJB4IkCakGgCCkDADcDACACQeiJAmpBoAgpAwA3AwAgAkHwiQJqQaAIKQMANwMAIAJB+IkCakGgCCkDADcDACACQYCKAmpBoAgpAwA3AwAgAkGIigJqQaAIKQMANwMAIAJBkIoCakGgCCkDADcDACACQZiKAmpBoAgpAwA3AwAgAkGgigJqQaAIKQMANwMAIAJBqIoCakGgCCkDADcDACACQbCKAmpBoAgpAwA3AwAgAkG4igJqQaAIKQMANwMAIAJBwIoCakGgCCkDADcDACACQciKAmpBoAgpAwA3AwAgAkHQigJqQaAIKQMANwMAIAJB2IoCakGgCCkDADcDACACQeCKAmpBoAgpAwA3AwAgAkHoigJqQaAIKQMANwMAIAJB8IoCakGgCCkDADcDACACQfiKAmpBoAgpAwA3AwAgAkGAiwJqQaAIKQMANwMAIAJBiIsCakGgCCkDADcDACACQZCLAmpBoAgpAwA3AwAgAkGYiwJqQaAIKQMANwMAIAJBoIsCakGgCCkDADcDACACQaiLAmpBoAgpAwA3AwAgAkGwiwJqQaAIKQMANwMAIAJBuIsCakGgCCkDADcDACACQcCLAmpBoAgpAwA3AwAgAkHIiwJqQaAIKQMANwMAIAJB0IsCakGgCCkDADcDACACQdiLAmpBoAgpAwA3AwAgAkHgiwJqQaAIKQMANwMAIAJB6IsCakGgCCkDADcDACACQfCLAmpBoAgpAwA3AwAgAkH4iwJqQaAIKQMANwMAIAJBgIwCakGgCCkDADcDACACQYiMAmpBoAgpAwA3AwAgAkGQjAJqQaAIKQMANwMAIAJBmIwCakGgCCkDADcDACACQaCMAmpBoAgpAwA3AwAgAkGojAJqQaAIKQMANwMAIAJBsIwCakGgCCkDADcDACACQbiMAmpBoAgpAwA3AwAgAkHAjAJqQaAIKQMANwMAIAJByIwCakGgCCkDADcDACACQdCMAmpBoAgpAwA3AwAgAkHYjAJqQaAIKQMANwMAIAJB4IwCakGgCCkDADcDACACQeiMAmpBoAgpAwA3AwAgAkHwjAJqQaAIKQMANwMAIAJB+IwCakGgCCkDADcDACACQYCNAmpBoAgpAwA3AwAgAkGIjQJqQaAIKQMANwMAIAJBkI0CakGgCCkDADcDACACQZiNAmpBoAgpAwA3AwAgAkGwiQZqIARBgAT8CgAAQdQIKAIAQQJ0QcCJCmogBEGABPwKAABB1AgoAgBBAnRB0IkOaiAEQYAE/AoAAEHUCCgCAEECdEHgiRJqIARBgAT8CgAAQdQIKAIAQQJ0QfCJFmogBEGABPwKAABB1AhB1AgoAgAiAkGAAWoiAzYCACABIANIDQEgAkGA/wBIDQALCwJAIABFDQAgCEH//wBLDQBBgIABIAhrIAcgAUH//wBLGyECAkAgAEEBcUUNACACRQ0AIAhBAnRBoIkCaiEDIAIhBCACQQdxIgcEQANAIAMgBTYCACADQQRqIQMgBEEBayEEIAdBAWsiBw0ACwsgAkEBa0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgBEEIayIEDQALCwJAIABBAnFFDQAgAkUNACAIQQJ0QbCJBmohAyACIQQgAkEHcSIHBEADQCADIAU2AgAgA0EEaiEDIARBAWshBCAHQQFrIgcNAAsLIAJBAWtBB0kNAANAIAMgBTYCHCADIAU2AhggAyAFNgIUIAMgBTYCECADIAU2AgwgAyAFNgIIIAMgBTYCBCADIAU2AgAgA0EgaiEDIARBCGsiBA0ACwsCQCAAQQRxRQ0AIAJFDQAgCEECdEHAiQpqIQMgAiEEIAJBB3EiBwRAA0AgAyAFNgIAIANBBGohAyAEQQFrIQQgB0EBayIHDQALCyACQQFrQQdJDQADQCADIAU2AhwgAyAFNgIYIAMgBTYCFCADIAU2AhAgAyAFNgIMIAMgBTYCCCADIAU2AgQgAyAFNgIAIANBIGohAyAEQQhrIgQNAAsLAkAgAEEIcUUNACACRQ0AIAhBAnRB0IkOaiEDIAIhBCACQQdxIgcEQANAIAMgBTYCACADQQRqIQMgBEEBayEEIAdBAWsiBw0ACwsgAkEBa0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgBEEIayIEDQALCwJAIABBEHFFDQAgAkUNACAIQQJ0QeCJEmohAyACIQQgAkEHcSIHBEADQCADIAU2AgAgA0EEaiEDIARBAWshBCAHQQFrIgcNAAsLIAJBAWtBB0kNAANAIAMgBTYCHCADIAU2AhggAyAFNgIUIAMgBTYCECADIAU2AgwgAyAFNgIIIAMgBTYCBCADIAU2AgAgA0EgaiEDIARBCGsiBA0ACwsgAEEgcUUNACACRQ0AIAJBAWshByAIQQJ0QfCJFmohAyACQQdxIgQEQANAIAMgBTYCACADQQRqIQMgAkEBayECIARBAWsiBA0ACwsgB0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgAkEIayICDQALC0HcCEHcCCgCACAAcjYCACAGQQFqIgIgBi0AAEH/AHEiA0E/ayIAQT9LDQQaDAMLAkBB7AgoAgAiBEEBRgRAQfAIKAIAIgNBzAgoAgAiAUkNASADIAFwIQMMAQtB+AgoAgAhAkH0CCgCACEBAkACQCAEQQVHDQAgAUEBRw0AIAJB6QJODQQMAQsgAkHkAEoNA0H8CCgCAEHkAEoNA0GACSgCAEHkAEoNAwsCQCABRQ0AIAFBAkoNACACQfwIKAIAQYAJKAIAIAFBAnRBiAhqKAIAEQIAIQFB8AgoAgAiA0HMCCgCACICTwR/IAMgAnAFIAMLQQJ0QZAJaiABNgIAC0HwCCgCACIDQcwIKAIAIgFJDQAgAyABcCEDCyADQQJ0QZAJaigCACEFDAELIANB/QBxQSFHBEAgCCEBIAYhAgwECyAEQSNHDQQCQEHsCCgCACICQQFGBEBB8AgoAgAiAUHMCCgCACIASQ0BIAEgAHAhAQwBC0H4CCgCACEBQfQIKAIAIQACQAJAIAJBBUcNACAAQQFHDQAgAUHpAkgNAQwHCyABQeQASg0GQfwIKAIAQeQASg0GQYAJKAIAQeQASg0GCwJAIABFDQAgAEECSg0AIAFB/AgoAgBBgAkoAgAgAEECdEGICGooAgARAgAhAEHwCCgCACIBQcwIKAIAIgJPBH8gASACcAUgAQtBAnRBkAlqIAA2AgALQfAIKAIAIgFBzAgoAgAiAEkNACABIABwIQELIAFBAnRBkAlqKAIAIQUMBAsgCCEBIAYhAgtB1AgoAgAhBgNAAkAgASAGSA0AIAZB//8ASg0AIAZBAnQiBEGgiQJqIgZBoAgpAwA3AwAgBEGoiQJqQaAIKQMANwMAIARBsIkCakGgCCkDADcDACAEQbiJAmpBoAgpAwA3AwAgBEHAiQJqQaAIKQMANwMAIARByIkCakGgCCkDADcDACAEQdCJAmpBoAgpAwA3AwAgBEHYiQJqQaAIKQMANwMAIARB4IkCakGgCCkDADcDACAEQeiJAmpBoAgpAwA3AwAgBEHwiQJqQaAIKQMANwMAIARB+IkCakGgCCkDADcDACAEQYCKAmpBoAgpAwA3AwAgBEGIigJqQaAIKQMANwMAIARBkIoCakGgCCkDADcDACAEQZiKAmpBoAgpAwA3AwAgBEGgigJqQaAIKQMANwMAIARBqIoCakGgCCkDADcDACAEQbCKAmpBoAgpAwA3AwAgBEG4igJqQaAIKQMANwMAIARBwIoCakGgCCkDADcDACAEQciKAmpBoAgpAwA3AwAgBEHQigJqQaAIKQMANwMAIARB2IoCakGgCCkDADcDACAEQeCKAmpBoAgpAwA3AwAgBEHoigJqQaAIKQMANwMAIARB8IoCakGgCCkDADcDACAEQfiKAmpBoAgpAwA3AwAgBEGAiwJqQaAIKQMANwMAIARBiIsCakGgCCkDADcDACAEQZCLAmpBoAgpAwA3AwAgBEGYiwJqQaAIKQMANwMAIARBoIsCakGgCCkDADcDACAEQaiLAmpBoAgpAwA3AwAgBEGwiwJqQaAIKQMANwMAIARBuIsCakGgCCkDADcDACAEQcCLAmpBoAgpAwA3AwAgBEHIiwJqQaAIKQMANwMAIARB0IsCakGgCCkDADcDACAEQdiLAmpBoAgpAwA3AwAgBEHgiwJqQaAIKQMANwMAIARB6IsCakGgCCkDADcDACAEQfCLAmpBoAgpAwA3AwAgBEH4iwJqQaAIKQMANwMAIARBgIwCakGgCCkDADcDACAEQYiMAmpBoAgpAwA3AwAgBEGQjAJqQaAIKQMANwMAIARBmIwCakGgCCkDADcDACAEQaCMAmpBoAgpAwA3AwAgBEGojAJqQaAIKQMANwMAIARBsIwCakGgCCkDADcDACAEQbiMAmpBoAgpAwA3AwAgBEHAjAJqQaAIKQMANwMAIARByIwCakGgCCkDADcDACAEQdCMAmpBoAgpAwA3AwAgBEHYjAJqQaAIKQMANwMAIARB4IwCakGgCCkDADcDACAEQeiMAmpBoAgpAwA3AwAgBEHwjAJqQaAIKQMANwMAIARB+IwCakGgCCkDADcDACAEQYCNAmpBoAgpAwA3AwAgBEGIjQJqQaAIKQMANwMAIARBkI0CakGgCCkDADcDACAEQZiNAmpBoAgpAwA3AwAgBEGwiQZqIAZBgAT8CgAAQdQIKAIAQQJ0QcCJCmogBkGABPwKAABB1AgoAgBBAnRB0IkOaiAGQYAE/AoAAEHUCCgCAEECdEHgiRJqIAZBgAT8CgAAQdQIKAIAQQJ0QfCJFmogBkGABPwKAABB1AhB1AgoAgBBgAFqIgY2AgALIAFB//8ATQRAIABBAXEgAWxBAnRBoIkCaiAFNgIAIABBAXZBAXEgAWxBAnRBsIkGaiAFNgIAIABBAnZBAXEgAWxBAnRBwIkKaiAFNgIAIABBA3ZBAXEgAWxBAnRB0IkOaiAFNgIAIABBBHZBAXEgAWxBAnRB4IkSaiAFNgIAIABBBXYgAWxBAnRB8IkWaiAFNgIAQdQIKAIAIQYLIAFBAWohAUHcCEHcCCgCACAAcjYCACACLQAAIQAgAkEBaiIEIQIgAEH/AHEiA0E/ayIAQcAASQ0ACyAECyECQQAhBCACIQYgASEIIANB/QBxQSFGDQELIANBJGsOCgEDAwMDAwMDAwIDC0HsCEIBNwIADAQLQdgIIAFB2AgoAgAiACAAIAFIGyIAQYCAASAAQYCAAUgbNgIADAILQegIIAFB2AgoAgAiACAAIAFIGyIAQYCAASAAQYCAAUgbIgA2AgBB2AggADYCACAAQQRrEAAEQEHoCEEENgIAQdgIQQQ2AgBB0AhBATYCAA8LEAgMAQsCQCADQTtHDQBB7AgoAgAiAEEHSg0AQewIIABBAWo2AgAgAEECdEHwCGpBADYCAAsgAiEGIAQhAyABIQgMAQtBBCEIIAIhBiAEIQMLIAYgCUkNAAsLQeQIIAU2AgBB4AggAzYCAEHoCCAINgIAC9ELAgF+CH9B2AhCBDcDAEGojQJBoAgpAwAiADcDAEGgjQIgADcDAEGYjQIgADcDAEGQjQIgADcDAEGIjQIgADcDAEGAjQIgADcDAEH4jAIgADcDAEHwjAIgADcDAEHojAIgADcDAEHgjAIgADcDAEHYjAIgADcDAEHQjAIgADcDAEHIjAIgADcDAEHAjAIgADcDAEG4jAIgADcDAEGwjAIgADcDAEGojAIgADcDAEGgjAIgADcDAEGYjAIgADcDAEGQjAIgADcDAEGIjAIgADcDAEGAjAIgADcDAEH4iwIgADcDAEHwiwIgADcDAEHoiwIgADcDAEHgiwIgADcDAEHYiwIgADcDAEHQiwIgADcDAEHIiwIgADcDAEHAiwIgADcDAEG4iwIgADcDAEGwiwIgADcDAEGoiwIgADcDAEGgiwIgADcDAEGYiwIgADcDAEGQiwIgADcDAEGIiwIgADcDAEGAiwIgADcDAEH4igIgADcDAEHwigIgADcDAEHoigIgADcDAEHgigIgADcDAEHYigIgADcDAEHQigIgADcDAEHIigIgADcDAEHAigIgADcDAEG4igIgADcDAEGwigIgADcDAEGoigIgADcDAEGgigIgADcDAEGYigIgADcDAEGQigIgADcDAEGIigIgADcDAEGAigIgADcDAEH4iQIgADcDAEHwiQIgADcDAEHoiQIgADcDAEHgiQIgADcDAEHYiQIgADcDAEHQiQIgADcDAEHIiQIgADcDAEHAiQIgADcDAEG4iQIgADcDAEGwiQIgADcDAEGoCCgCACIEQf8AakGAAW0hCAJAIARBgQFIDQBBASEBIAhBAiAIQQJKG0EBayICQQFxIQMgBEGBAk4EQCACQX5xIQIDQCABQQl0IgdBEHJBoIkCakGwiQJBgAT8CgAAIAdBsI0CakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsLIANFDQAgAUEJdEEQckGgiQJqQbCJAkGABPwKAAALAkAgBEEBSA0AIAhBASAIQQFKGyIDQQFxIQUCQCADQQFrIgdFBEBBACEBDAELIANB/v///wdxIQJBACEBA0AgAUEJdCIGQRByQbCJBmpBsIkCQYAE/AoAACAGQZAEckGwiQZqQbCJAkGABPwKAAAgAUECaiEBIAJBAmsiAg0ACwsgBQRAIAFBCXRBEHJBsIkGakGwiQJBgAT8CgAACyAEQQFIDQAgA0EBcSEFIAcEfyADQf7///8HcSECQQAhAQNAIAFBCXQiBkEQckHAiQpqQbCJAkGABPwKAAAgBkGQBHJBwIkKakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsgAUEHdEEEcgVBBAshASAFBEAgAUECdEHAiQpqQbCJAkGABPwKAAALIARBAUgNACADQQFxIQUgBwR/IANB/v///wdxIQJBACEBA0AgAUEJdCIGQRByQdCJDmpBsIkCQYAE/AoAACAGQZAEckHQiQ5qQbCJAkGABPwKAAAgAUECaiEBIAJBAmsiAg0ACyABQQd0QQRyBUEECyEBIAUEQCABQQJ0QdCJDmpBsIkCQYAE/AoAAAsgBEEBSA0AIANBAXEhBSAHBH8gA0H+////B3EhAkEAIQEDQCABQQl0IgZBEHJB4IkSakGwiQJBgAT8CgAAIAZBkARyQeCJEmpBsIkCQYAE/AoAACABQQJqIQEgAkECayICDQALIAFBB3RBBHIFQQQLIQEgBQRAIAFBAnRB4IkSakGwiQJBgAT8CgAACyAEQQFIDQAgA0EBcSEEIAcEfyADQf7///8HcSECQQAhAQNAIAFBCXQiA0EQckHwiRZqQbCJAkGABPwKAAAgA0GQBHJB8IkWakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsgAUEHdEEEcgVBBAshASAERQ0AIAFBAnRB8IkWakGwiQJBgAT8CgAAC0HUCCAIQQd0QQRyNgIAC58TAgh/AX5B5AgoAgAhA0HgCCgCACECQegIKAIAIQcgAUGQiQFqIglB/wE6AAAgACABSARAIABBkIkBaiEIA0AgAiEEIAhBAWohAQJAIAgtAABB/wBxIgJBMGtBCUsEQCABIQgMAQtB7AgoAgBBAnRB7AhqIgUoAgAhAANAIAUgAiAAQQpsakEwayIANgIAIAEtAAAhAiABQQFqIgghASACQf8AcSICQTBrQQpJDQALCwJAAkACQAJAAkACQAJ/AkAgAkE/ayIAQT9NBEAgBEUNASAEQSFGBEBB8AgoAgAiAUEBIAEbIgQgB2ohAQJAIABFDQAgB0H//wBLDQBBgIABIAdrIAQgAUH//wBLGyEFAkAgAEEBcUUNACAHQQJ0QaCJAmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEECcUUNACAHQQJ0QbCJBmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEEcUUNACAHQQJ0QcCJCmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEIcUUNACAHQQJ0QdCJDmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEQcUUNACAHQQJ0QeCJEmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLIABBIHFFDQAgBUEBayEEIAdBAnRB8IkWaiEAIAVBB3EiAgRAA0AgACADNgIAIABBBGohACAFQQFrIQUgAkEBayICDQALCyAEQQdJDQADQCAAIAM2AhwgACADNgIYIAAgAzYCFCAAIAM2AhAgACADNgIMIAAgAzYCCCAAIAM2AgQgACADNgIAIABBIGohACAFQQhrIgUNAAsLIAhBAWoiBSAILQAAQf8AcSICQT9rIgBBP00NAxoMBAsCQEHsCCgCACIFQQFGBEBB8AgoAgAiAUHMCCgCACIESQ0BIAEgBHAhAQwBC0H4CCgCACEEQfQIKAIAIQECQAJAIAVBBUcNACABQQFHDQAgBEHpAk4NBAwBCyAEQeQASg0DQfwIKAIAQeQASg0DQYAJKAIAQeQASg0DCwJAIAFFDQAgAUECSg0AIARB/AgoAgBBgAkoAgAgAUECdEGICGooAgARAgAhBEHwCCgCACIBQcwIKAIAIgVPBH8gASAFcAUgAQtBAnRBkAlqIAQ2AgALQfAIKAIAIgFBzAgoAgAiBEkNACABIARwIQELIAFBAnRBkAlqKAIAIQMMAQsgAkH9AHFBIUcEQCAHIQEgAiEADAQLIARBI0cNBAJAQewIKAIAIgRBAUYEQEHwCCgCACIBQcwIKAIAIgBJDQEgASAAcCEBDAELQfgIKAIAIQFB9AgoAgAhAAJAAkAgBEEFRw0AIABBAUcNACABQekCSA0BDAcLIAFB5ABKDQZB/AgoAgBB5ABKDQZBgAkoAgBB5ABKDQYLAkAgAEUNACAAQQJKDQAgAUH8CCgCAEGACSgCACAAQQJ0QYgIaigCABECACEAQfAIKAIAIgFBzAgoAgAiBE8EfyABIARwBSABC0ECdEGQCWogADYCAAtB8AgoAgAiAUHMCCgCACIASQ0AIAEgAHAhAQsgAUECdEGQCWooAgAhAwwECyAHIQEgCAshBQNAIAFB//8ATQRAIABBAXEgAWxBAnRBoIkCaiADNgIAIABBAXZBAXEgAWxBAnRBsIkGaiADNgIAIABBAnZBAXEgAWxBAnRBwIkKaiADNgIAIABBA3ZBAXEgAWxBAnRB0IkOaiADNgIAIABBBHZBAXEgAWxBAnRB4IkSaiADNgIAIABBBXYgAWxBAnRB8IkWaiADNgIACyABQQFqIQEgBS0AACEAIAVBAWoiBCEFIABB/wBxIgJBP2siAEHAAEkNAAsgBCEFC0EAIQQgBSEIIAEhByACIQAgAkH9AHFBIUYNAQtBBCEHIAQhAiAAQSRrDgoDAgICAgICAgIBAgtB7AhCATcCAAwCC0GoCCgCAEEEaxAABEBB0AhBATYCAA8LAkBBqAgoAgAiBkEFSA0AQaAIKQMAIQogBkEDa0EBdiIBQQdxIQJBACEAIAFBAWtBB08EQCABQfj///8HcSEFA0AgAEEDdCIBQbCJAmogCjcDACABQQhyQbCJAmogCjcDACABQRByQbCJAmogCjcDACABQRhyQbCJAmogCjcDACABQSByQbCJAmogCjcDACABQShyQbCJAmogCjcDACABQTByQbCJAmogCjcDACABQThyQbCJAmogCjcDACAAQQhqIQAgBUEIayIFDQALCyACRQ0AA0AgAEEDdEGwiQJqIAo3AwAgAEEBaiEAIAJBAWsiAg0ACwtBwIkGQbCJAiAGQQJ0IgD8CgAAQdCJCkGwiQIgAPwKAABB4IkOQbCJAiAA/AoAAEHwiRJBsIkCIAD8CgAAQYCKFkGwiQIgAPwKAAAgBCECDAELAkAgAEE7Rw0AQewIKAIAIgBBB0oNAEHsCCAAQQFqNgIAIABBAnRB8AhqQQA2AgALIAEhBwsgCCAJSQ0ACwtB5AggAzYCAEHgCCACNgIAQegIIAc2AgAL4gcCBX8BfgJAQdAIAn8CQAJAIAAgAU4NACABQZCJAWohBiAAQZCJAWohBQNAIAUtAAAiA0H/AHEhAgJAAkACQAJAAkACQAJAQeAIKAIAIgRBIkcEQCAEDQcgAkEiRgRAQewIQgE3AgBB4AhBIjYCAAwICyACQT9rQcAASQ0GIANBIWsiAkEMTQ0BDAULAkAgAkEwayIEQQlNBEBB7AgoAgBBAnRB7AhqIgIgBCACKAIAQQpsajYCAAwBC0HsCCgCACEEIAJBO0YEQCAEQQdKDQFB7AggBEEBajYCACAEQQJ0QfAIakEANgIADAELIARBBEYEQEHECEECNgIAQbAIQfAIKQMANwMAQbgIQfgIKAIAIgI2AgBBvAhB/AgoAgAiBDYCAEHICEECQQFBwAgoAgAiAxs2AgBBrAggBEEAIAMbNgIAQagIIAJBgIABIAJBgIABSBtBBGpBACADGzYCAEHgCEEANgIADAoLIAJBP2tBwABJDQQLIANBIWsiAkEMTQ0BDAILQQEgAnRBjSBxRQ0DDAQLQQEgAnRBjSBxDQELIANBoQFrIgJBDEsNA0EBIAJ0QY0gcUUNAwtBxAhCgYCAgBA3AgBBsAhB8AgoAgBBAEHsCCgCACICQQBKGzYCAEG0CEH0CCgCAEEAIAJBAUobNgIAQbgIQfgIKAIAQQAgAkECShs2AgBB4AhBADYCAEG8CEEANgIADAQLIANBoQFrIgJBDEsNAUEBIAJ0QY0gcUUNAQtBxAhCgYCAgBA3AgBBsAhCADcDAEG4CEIANwMADAMLIAVBAWoiBSAGSQ0ACwsCQEHICCgCAA4DAwEAAQsCQEGoCCgCACIFQQVIDQBBoAgpAwAhByAFQQNrQQF2IgNBB3EhBEEAIQIgA0EBa0EHTwRAIANB+P///wdxIQYDQCACQQN0IgNBsIkCaiAHNwMAIANBCHJBsIkCaiAHNwMAIANBEHJBsIkCaiAHNwMAIANBGHJBsIkCaiAHNwMAIANBIHJBsIkCaiAHNwMAIANBKHJBsIkCaiAHNwMAIANBMHJBsIkCaiAHNwMAIANBOHJBsIkCaiAHNwMAIAJBCGohAiAGQQhrIgYNAAsLIARFDQADQCACQQN0QbCJAmogBzcDACACQQFqIQIgBEEBayIEDQALC0HAiQZBsIkCIAVBAnQiA/wKAABB0IkKQbCJAiAD/AoAAEHgiQ5BsIkCIAP8CgAAQfCJEkGwiQIgA/wKAABBgIoWQbCJAiAD/AoAAEECDAELEAhByAgoAgALEAEiAjYCACACDQAgACABQcgIKAIAQQJ0QYAIaigCABEBAAsLdABB6AhBBDYCAEHkCCAANgIAQewIQgE3AgBBxAhCADcCAEHACCADNgIAQdwIQgA3AgBBqAhCADcDAEGwCEIANwMAQbgIQgA3AwBBzAggAkGAICACQYAgSRs2AgBBoAggAa1CgYCAgBB+NwMAQdAIQQA2AgALIwBB0AgoAgBFBEAgACABQcgIKAIAQQJ0QYAIaigCABEBAAsLWgECfwJAAkACQEHICCgCAEEBaw4CAAECC0HYCEHoCCgCACIAQdgIKAIAIgEgACABShsiAEGAgAEgAEGAgAFIGyIANgIAIABBBGsPC0GoCCgCAEEEayEACyAAC0IBAX8Cf0EGQdwIKAIAIgBBIHENABpBBSAAQRBxDQAaQQQgAEEIcQ0AGkEDIABBBHENABpBAiAAQQFxIABBAnEbCwu9BQEFfQJ/IAJFBEAgAUH/AWxBMmpB5ABtIgBBCHQgAHIgAEEQdHIMAQsgArJDAADIQpUhBiAAQfABarJDAAC0Q5UhBQJ9IAGyQwAAyEKVIgNDAAAAP10EQCADIAZDAACAP5KUDAELIAYgA0MAAIA/IAaTlJILIQcgAyADkiEGAkAgBUOrqqo+kiIEQwAAAABdBEAgBEMAAIA/kiEEDAELIARDAACAP15FDQAgBEMAAIC/kiEECyAGIAeTIQMgBUMAAAAAXSEAAn8CfSADIAcgA5NDAADAQJQgBJSSIARDq6oqPl0NABogByAEQwAAAD9dDQAaIAMgBEOrqio/XUUNABogAyAHIAOTIARDAADAwJRDAACAQJKUkgtDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALIQECQCAABEAgBUMAAIA/kiEEDAELIAUiBEMAAIA/XkUNACAFQwAAgL+SIQQLIAVDq6qqvpIiBUMAAAAAXSECAn8CfSADIAcgA5NDAADAQJQgBJSSIARDq6oqPl0NABogByAEQwAAAD9dDQAaIAMgBEOrqio/XUUNABogAyAHIAOTIARDAADAwJRDAACAQJKUkgtDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALIQACQCACBEAgBUMAAIA/kiEFDAELIAVDAACAP15FDQAgBUMAAIC/kiEFCwJAIAVDq6oqPl0EQCADIAcgA5NDAADAQJQgBZSSIQcMAQsgBUMAAAA/XQ0AIAVDq6oqP11FBEAgAyEHDAELIAMgByADkyAFQwAAwMCUQwAAgECSlJIhBwsgAEEIdAJ/IAdDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALQRB0ciABcgtBgICAeHILNwAgAEH/AWxBMmpB5ABtIAFB/wFsQTJqQeQAbUEIdHIgAkH/AWxBMmpB5ABtQRB0ckGAgIB4cgsEACMACwYAIAAkAAsQACMAIABrQXBxIgAkACAACwsYAQBBgAgLEQEAAAACAAAAAwAAAAQAAAAF"}},414(e,t,i){Object.defineProperty(t,"__esModule",{value:!0}),t.EventUtils=t.Emitter=void 0;const A=i(426);var s;t.Emitter=class{constructor(){this._listeners=[],this._disposed=!1}get event(){return this._event||(this._event=(e,t,i)=>{if(this._disposed)return(0,A.toDisposable)(()=>{});const s={fn:e,thisArgs:t};this._listeners=this._listeners.slice(),this._listeners.push(s);const r=(0,A.toDisposable)(()=>{const e=this._listeners.indexOf(s);-1!==e&&(this._listeners=this._listeners.slice(),this._listeners.splice(e,1))});return i&&(Array.isArray(i)?i.push(r):i.add(r)),r}),this._event}fire(e){if(this._disposed||!this._listeners.length)return;if(1===this._listeners.length)return void this._listeners[0].fn.call(this._listeners[0].thisArgs,e);const t=this._listeners;for(let i=0,A=t.length;i<A;++i)t[i].fn.call(t[i].thisArgs,e)}dispose(){this._disposed||(this._disposed=!0,this._listeners.length=0)}},function(e){e.forward=function(e,t){return e(e=>t.fire(e))},e.map=function(e,t){return(i,A,s)=>e(e=>i.call(A,t(e)),void 0,s)},e.any=function(...e){return(t,i,s)=>{const r=new A.DisposableStore;for(const A of e)r.add(A(e=>t.call(i,e)));return s&&(Array.isArray(s)?s.push(r):s.add(r)),r}},e.runAndSubscribe=function(e,t,i){return t(i),e(e=>t(e))}}(s||(t.EventUtils=s={}))},426(e,t){function i(e){return{dispose:e}}function A(e){if(!e)return e;if(Array.isArray(e)){for(const t of e)t.dispose();return[]}return e.dispose(),e}Object.defineProperty(t,"__esModule",{value:!0}),t.MutableDisposable=t.Disposable=t.DisposableStore=void 0,t.toDisposable=i,t.dispose=A,t.combinedDisposable=function(...e){return i(()=>A(e))};class s{constructor(){this._disposables=new Set,this._isDisposed=!1}get isDisposed(){return this._isDisposed}add(e){return this._isDisposed?e.dispose():this._disposables.add(e),e}dispose(){if(!this._isDisposed){this._isDisposed=!0;for(const e of this._disposables)e.dispose();this._disposables.clear()}}clear(){for(const e of this._disposables)e.dispose();this._disposables.clear()}}t.DisposableStore=s;class r{constructor(){this._store=new s}dispose(){this._store.dispose()}_register(e){return this._store.add(e)}}t.Disposable=r,r.None=Object.freeze({dispose(){}}),t.MutableDisposable=class{constructor(){this._isDisposed=!1}get value(){return this._isDisposed?void 0:this._value}set value(e){this._isDisposed||e===this._value||(this._value?.dispose(),this._value=e)}clear(){this.value=void 0}dispose(){this._isDisposed=!0,this._value?.dispose(),this._value=void 0}}},795(e,t,i){var A=this&&this.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.IIPHandler=void 0;const s=i(463),r=i(699),o=A(i(669)),a=A(i(61)),n=i(389),h=i(462),g={type:0,name:"Unnamed file",size:0,width:"auto",height:"auto",preserveAspectRatio:1,inline:0};t.IIPHandler=class{constructor(e,t,i,A){this._opts=e,this._renderer=t,this._storage=i,this._coreTerminal=A,this._generation=0,this._aborted=!1,this._hp=new n.HeaderParser,this._header=g,this._isMultipart=!1,this._abortMulti=!1;const s=Math.ceil(4*this._opts.iipSizeLimit/3),r=Math.min(1048576,s);this._dec=new o.default(4194304,s,r),this._qoiDec=new a.default(4194304)}reset(){this._generation++,this._hp.reset(),this._dec.release(),this._qoiDec.release()}start(){this._aborted=!1,this._hp.reset()}put(e,t,i){if(!this._aborted)if(4===this._hp.state)0!==this._dec.put(e.subarray(t,i))&&(this._dec.release(),this._aborted=!0);else{const A=this._hp.parse(e,t,i);if(-1===A)return void(this._aborted=!0);if(A>0){if(1===this._hp.fields.type){if(this._isMultipart&&(this._isMultipart=!1,this._abortMulti=!1,this._dec.release()),this._header=Object.assign({},g,this._hp.fields),!this._header.inline)return void(this._aborted=!0);this._dec.init()}else if(this._abortMulti)return void(this._aborted=!0);0!==this._dec.put(e.subarray(A,i))&&(this._dec.release(),this._aborted=!0,this._isMultipart&&(this._abortMulti=!0))}}}end(e){var t,i,A;if(this._aborted)return!0;if(4!==this._hp.state&&this._hp.end())return!0;const o=this._hp.fields.type;if(3===o)return!0;if(5===o){let e=r.CELL_SIZE_DEFAULT.width,i=r.CELL_SIZE_DEFAULT.height;this._renderer.dimensions&&(e=this._renderer.dimensions.css.canvas.width/this._coreTerminal.cols,i=this._renderer.dimensions.css.canvas.height/this._coreTerminal.rows);const s=null!==(A=null===(t=this._coreTerminal._core._coreBrowserService)||void 0===t?void 0:t.dpr)&&void 0!==A?A:1,o=`]1337;ReportCellSize=${i.toFixed(3)};${e.toFixed(3)};${s.toFixed(3)}\\`;return this._coreTerminal.input(o,!1),!0}if(2===o)return this._header=Object.assign({},g,this._hp.fields),this._isMultipart=!0,this._abortMulti=!1,this._dec.release(),this._dec.init(),!0;if(4===o){if(!this._isMultipart)return!0;if(this._isMultipart=!1,this._abortMulti||2!==this._header.type)return!0}let a,n,d=0,l=0,I=h.UNSUPPORTED_TYPE;if((a=e)&&((a=!this._dec.end())?(I=(0,h.imageType)(this._dec.data8),(a="unsupported"!==I.mime)?(d=I.width,l=I.height,(a=d&&l&&d*l<this._opts.pixelLimit)?([d,l]=this._resize(d,l).map(Math.floor),a=d&&l&&d*l<this._opts.pixelLimit):console.warn(`IIP: image dimension issue ${I.width}x${I.height}`)):console.warn("IIP: unsupported image type")):console.warn("IIP: error during BASE64 decoding")),!a)return this._dec.release(),!0;if("image/qoi"===I.mime){const e=this._qoiDec.decode(this._dec.data8);if(n=new ImageData(new Uint8ClampedArray(e.buffer,e.byteOffset,e.byteLength),this._qoiDec.width,this._qoiDec.height),this._qoiDec.release(),d===this._qoiDec.width&&l===this._qoiDec.height){this._dec.release();const e=s.ImageRenderer.createCanvas(void 0,this._qoiDec.width,this._qoiDec.height);return null===(i=e.getContext("2d"))||void 0===i||i.putImageData(n,0,0),this._storage.addImage(e),!0}}else n=new Blob([this._dec.data8],{type:I.mime});this._dec.release();const c=this._generation;return createImageBitmap(n,{resizeWidth:d,resizeHeight:l}).then(e=>c!==this._generation?(e.close(),!0):(this._storage.addImage(e),!0)).catch(e=>(console.warn(`IIP: decoding error ${I.mime} ${I.width}x${I.height}`,e),!0))}_resize(e,t){var i,A,s,o;const a=(null===(i=this._renderer.dimensions)||void 0===i?void 0:i.css.cell.width)||r.CELL_SIZE_DEFAULT.width,n=(null===(A=this._renderer.dimensions)||void 0===A?void 0:A.css.cell.height)||r.CELL_SIZE_DEFAULT.height,h=(null===(s=this._renderer.dimensions)||void 0===s?void 0:s.css.canvas.width)||a*this._coreTerminal.cols,g=(null===(o=this._renderer.dimensions)||void 0===o?void 0:o.css.canvas.height)||n*this._coreTerminal.rows,d=this._dim(this._header.width,h,a),l=this._dim(this._header.height,g,n);if(!d&&!l){const i=h/e,A=(g-n)/t,s=Math.min(i,A);return s<1?[e*s,t*s]:[e,t]}return d?!this._header.preserveAspectRatio&&d&&l?[d,l]:[d,t*d/e]:[e*l/t,l]}_dim(e,t,i){return"auto"===e?0:e.endsWith("%")?parseInt(e.slice(0,-1),10)*t/100:e.endsWith("px")?parseInt(e.slice(0,-2),10):parseInt(e,10)*i}}},389(e,t){function i(e){let t="";for(let i=0;i<e.length;++i)t+=String.fromCharCode(e[i]);return t}function A(e){let t=0;for(let i=0;i<e.length;++i){if(e[i]<48||e[i]>57)throw new Error("illegal char");t=10*t+e[i]-48}return t}function s(e){const t=i(e);if(!t.match(/^((auto)|(\d+?((px)|(%)){0,1}))$/))throw new Error("illegal size");return t}Object.defineProperty(t,"__esModule",{value:!0}),t.HeaderParser=void 0;const r={inline:A,size:A,name:function(e){if("undefined"!=typeof Buffer)return Buffer.from(i(e),"base64").toString();const t=atob(i(e)),A=new Uint8Array(t.length);for(let e=0;e<A.length;++e)A[e]=t.charCodeAt(e);return(new TextDecoder).decode(A)},width:s,height:s,preserveAspectRatio:A},o=[70,105,108,101],a=[77,117,108,116,105,112,97,114,116,70,105,108,101],n=[70,105,108,101,80,97,114,116],h=[70,105,108,101,69,110,100],g=[82,101,112,111,114,116,67,101,108,108,83,105,122,101],d=1024;t.HeaderParser=class{constructor(){this.state=0,this._buffer=new Uint32Array(d),this._position=0,this._key="",this.fields={}}reset(){this._buffer.fill(0),this.state=0,this._position=0,this.fields={},this._key=""}end(){if(0===this.state){if(this._position===h.length){for(let e=0;e<h.length;++e)if(this._buffer[e]!==h[e])return this._a();return this.fields.type=4,this.state=4,0}if(this._position===g.length){for(let e=0;e<g.length;++e)if(this._buffer[e]!==g[e])return this._a();return this.fields.type=5,this.state=4,0}return this._a()}return 4===this.state?0:3===this.state&&2===this.fields.type&&this._storeValue(this._position)?(this.state=4,0):this._a()}parse(e,t,i){let A=this.state,s=this._position;const r=this._buffer;if(1===A||4===A)return-1;if(0===A&&s>14)return-1;for(let h=t;h<i;++h){const t=e[h];switch(t){case 59:if(!this._storeValue(s))return this._a();A=2,s=0;break;case 61:if(0===A){if(70===r[0]){let e=0;for(;e<o.length;++e)if(r[e]!==o[e])return this._a();if(this.fields.type=1,s===n.length){for(;e<n.length;++e)if(r[e]!==n[e])return this._a();return this.fields.type=3,this.state=4,h+1}}else{if(77!==r[0])return this._a();for(let e=0;e<a.length;++e)if(r[e]!==a[e])return this._a();this.fields.type=2}A=2,s=0}else if(2===A){if(!this._storeKey(s))return this._a();A=3,s=0}else if(3===A){if(s>=d)return this._a();r[s++]=t}break;case 58:return 3!==A||this._storeValue(s)?(this.state=4,h+1):this._a();default:if(s>=d)return this._a();r[s++]=t}}return this.state=A,this._position=s,-2}_a(){return this.fields.type=0,this.state=1,-1}_storeKey(e){const t=i(this._buffer.subarray(0,e));return!!t&&(this._key=t,this.fields[t]=null,!0)}_storeValue(e){if(this._key){try{const t=this._buffer.slice(0,e);this.fields[this._key]=r[this._key]?r[this._key](t):t}catch(e){return!1}return!0}return!1}}},649(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.IIPImageStorage=void 0,t.IIPImageStorage=class{constructor(e){this._storage=e,this._addImageOpts={scrolling:!0,layer:"top",zIndex:0,cursorPos:"iip"}}addImage(e){this._storage.addImage(e,this._addImageOpts)}}},462(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.UNSUPPORTED_TYPE=void 0,t.imageType=function(e){if(e.length<32)return t.UNSUPPORTED_TYPE;const i=new Uint32Array(e.buffer,e.byteOffset,8);if(1196314761===i[0]&&169478669===i[1]&&1380206665===i[3])return{mime:"image/png",width:e[16]<<24|e[17]<<16|e[18]<<8|e[19],height:e[20]<<24|e[21]<<16|e[22]<<8|e[23]};if(255===e[0]&&216===e[1]&&255===e[2]){const[t,i]=function(e){const t=e.length;let i=4,A=e[i]<<8|e[i+1];for(;;){if(i+=A,i>=t)return[0,0];if(255!==e[i])return[0,0];if(192===e[i+1]||194===e[i+1])return i+8<t?[e[i+7]<<8|e[i+8],e[i+5]<<8|e[i+6]]:[0,0];i+=2,A=e[i]<<8|e[i+1]}}(e);return{mime:"image/jpeg",width:t,height:i}}if(944130375===i[0]&&(55===e[4]||57===e[4])&&97===e[5])return{mime:"image/gif",width:e[7]<<8|e[6],height:e[9]<<8|e[8]};if(1718185841===i[0])return{mime:"image/qoi",width:e[4]<<24|e[5]<<16|e[6]<<8|e[7],height:e[8]<<24|e[9]<<16|e[10]<<8|e[11]};if(1179011410===i[0]&&1346520407===i[2]&&3690582==(16777215&i[3])){switch(e[15]){case 88:return{mime:"image/webp",width:1+(e[24]|e[25]<<8|e[26]<<16),height:1+(e[27]|e[28]<<8|e[29]<<16)};case 76:if(47!==e[20])return t.UNSUPPORTED_TYPE;const i=e[21]|e[22]<<8|e[23]<<16|e[24]<<24;return{mime:"image/webp",width:1+(16383&i),height:1+(i>>>14&16383)};case 32:return 157!==e[23]||1!==e[24]||42!==e[25]?t.UNSUPPORTED_TYPE:{mime:"image/webp",width:16383&(e[26]|e[27]<<8),height:16383&(e[28]|e[29]<<8)}}return t.UNSUPPORTED_TYPE}if(1887007846===i[1]&&(1718187617===i[2]||1936291425===i[2])){let i=-1;const A=Math.min(e.length-16,1024);for(let t=8;t<A;t++)if(105===e[t]&&115===e[t+1]&&112===e[t+2]&&101===e[t+3]){i=t;break}if(-1!==i){const t=e[i+8]<<24|e[i+9]<<16|e[i+10]<<8|e[i+11],A=e[i+12]<<24|e[i+13]<<16|e[i+14]<<8|e[i+15];if(t>0&&A>0)return{mime:"image/avif",width:t,height:A}}return t.UNSUPPORTED_TYPE}return t.UNSUPPORTED_TYPE},t.UNSUPPORTED_TYPE={mime:"unsupported",width:0,height:0}},463(e,t,i){Object.defineProperty(t,"__esModule",{value:!0}),t.ImageRenderer=void 0;const A=i(939),s=i(426);class r extends s.Disposable{get canvas(){var e;return null===(e=this._layers.get("top"))||void 0===e?void 0:e.canvas}static createCanvas(e,t,i){const A=(null!=e?e:document).createElement("canvas");return A.width=0|t,A.height=0|i,A}static createImageData(e,t,i,A){if("function"!=typeof ImageData){const s=e.createImageData(t,i);return A&&s.data.set(new Uint8ClampedArray(A,0,t*i*4)),s}return A?new ImageData(new Uint8ClampedArray(A,0,t*i*4),t,i):new ImageData(t,i)}static createImageBitmap(e){return"function"!=typeof createImageBitmap?Promise.resolve(void 0):createImageBitmap(e)}constructor(e){super(),this._terminal=e,this._layers=new Map,this._optionsRefresh=this._register(new s.MutableDisposable),this._oldOpen=this._terminal._core.open,this._terminal._core.open=e=>{var t;null===(t=this._oldOpen)||void 0===t||t.call(this._terminal._core,e),this._open()},this._terminal._core.screenElement&&this._open(),this._optionsRefresh.value=this._terminal._core.optionsService.onOptionChange(e=>{var t;"fontSize"===e&&(this.rescaleCanvas(),null===(t=this._renderService)||void 0===t||t.refreshRows(0,this._terminal.rows))}),this._register((0,s.toDisposable)(()=>{var e;this.removeLayerFromDom(),this.removeLayerFromDom("bottom"),this._terminal._core&&this._oldOpen&&(this._terminal._core.open=this._oldOpen,this._oldOpen=void 0),this._renderService&&this._oldSetRenderer&&(this._renderService.setRenderer=this._oldSetRenderer,this._oldSetRenderer=void 0),this._renderService=void 0,this._layers.clear(),null===(e=this._placeholderBitmap)||void 0===e||e.close(),this._placeholderBitmap=void 0,this._placeholder=void 0}))}showPlaceholder(e){var t,i;e?this._placeholder||-1===this.cellSize.height||this._createPlaceHolder(Math.max(this.cellSize.height+1,24)):(null===(t=this._placeholderBitmap)||void 0===t||t.close(),this._placeholderBitmap=void 0,this._placeholder=void 0),null===(i=this._renderService)||void 0===i||i.refreshRows(0,this._terminal.rows)}get dimensions(){return this._terminal.dimensions}get cellSize(){var e,t;return{width:(null===(e=this.dimensions)||void 0===e?void 0:e.css.cell.width)||-1,height:(null===(t=this.dimensions)||void 0===t?void 0:t.css.cell.height)||-1}}clearLines(e,t,i){var A,s,r,o,a;const n=e*((null===(A=this.dimensions)||void 0===A?void 0:A.css.cell.height)||0),h=(null===(s=this.dimensions)||void 0===s?void 0:s.css.canvas.width)||0,g=(t+1-e)*((null===(r=this.dimensions)||void 0===r?void 0:r.css.cell.height)||0);i&&"top"!==i||null===(o=this._layers.get("top"))||void 0===o||o.clearRect(0,n,h,g),i&&"bottom"!==i||null===(a=this._layers.get("bottom"))||void 0===a||a.clearRect(0,n,h,g)}clearAll(e){if(!e||"top"===e){const e=this._layers.get("top");null==e||e.clearRect(0,0,e.canvas.width,e.canvas.height)}if(!e||"bottom"===e){const e=this._layers.get("bottom");null==e||e.clearRect(0,0,e.canvas.width,e.canvas.height)}}draw(e,t,i,A,s=1){const r=this._layers.get(e.layer);if(!r)return;const{width:o,height:a}=this.cellSize;if(-1===o||-1===a)return;this._rescaleImage(e,o,a);const n=e.actual,{width:h,height:g}=e.actualCellSize,d=Math.ceil(n.width/h),l=t%d*h,I=Math.floor(t/d)*g,c=i*o,_=A*a,C=s*h+l>n.width?n.width-l:s*h,B=I+g>n.height?n.height-I:g;r.drawImage(n,Math.floor(l),Math.floor(I),Math.ceil(C),Math.ceil(B),Math.floor(c),Math.floor(_),Math.ceil(C*o/h),Math.ceil(B*a/g))}extractTile(e,t){const{width:i,height:A}=this.cellSize;if(-1===i||-1===A)return;this._rescaleImage(e,i,A);const s=e.actual,{width:o,height:a}=e.actualCellSize,n=Math.ceil(s.width/o),h=t%n*o,g=Math.floor(t/n)*a,d=o+h>s.width?s.width-h:o,l=g+a>s.height?s.height-g:a,I=r.createCanvas(this.document,Math.ceil(d*i/o),Math.ceil(l*A/a)),c=I.getContext("2d");return c?(c.drawImage(s,Math.floor(h),Math.floor(g),Math.floor(d),Math.floor(l),0,0,I.width,I.height),I):void 0}drawPlaceholder(e,t,i=1){var A;const s=this._layers.get("top");if(s){const{width:r,height:o}=this.cellSize;if(-1===r||-1===o)return;if(this._placeholder?o>=this._placeholder.height&&this._createPlaceHolder(o+1):this._createPlaceHolder(Math.max(o+1,24)),!this._placeholder)return;s.drawImage(null!==(A=this._placeholderBitmap)&&void 0!==A?A:this._placeholder,e*r,t*o%2?0:1,r*i,o,e*r,t*o,r*i,o)}}rescaleCanvas(){var e,t;const i=(null===(e=this.dimensions)||void 0===e?void 0:e.css.canvas.width)||0,A=(null===(t=this.dimensions)||void 0===t?void 0:t.css.canvas.height)||0;for(const e of this._layers.values())e.canvas.width===i&&e.canvas.height===A||(e.canvas.width=i,e.canvas.height=A)}_rescaleImage(e,t,i){if(t===e.actualCellSize.width&&i===e.actualCellSize.height)return;const{width:A,height:s}=e.origCellSize;if(t===A&&i===s)return e.actual=e.orig,e.actualCellSize.width=A,void(e.actualCellSize.height=s);const o=Math.ceil(e.orig.width*t/A),a=Math.ceil(e.orig.height*i/s);if(o*a>e.orig.width*e.orig.height)return e.actual=e.orig,e.actualCellSize.width=A,void(e.actualCellSize.height=s);const n=r.createCanvas(this.document,o,a),h=n.getContext("2d");h&&(h.drawImage(e.orig,0,0,n.width,n.height),e.actual=n,e.actualCellSize.width=t,e.actualCellSize.height=i)}_open(){this._renderService=this._terminal._core._renderService,this._oldSetRenderer=this._renderService.setRenderer.bind(this._renderService),this._renderService.setRenderer=e=>{var t;for(const e of[...this._layers.keys()])this.removeLayerFromDom(e);null===(t=this._oldSetRenderer)||void 0===t||t.call(this._renderService,e)}}insertLayerToDom(e="top"){var t,i;if(!this.document||!this._terminal._core.screenElement)return void console.warn("image addon: cannot insert output canvas to DOM, missing document or screenElement");if(this._layers.has(e))return;const A=r.createCanvas(this.document,(null===(t=this.dimensions)||void 0===t?void 0:t.css.canvas.width)||0,(null===(i=this.dimensions)||void 0===i?void 0:i.css.canvas.height)||0);A.classList.add(`xterm-image-layer-${e}`);const s=this._terminal._core.screenElement;s.style.isolation="isolate","bottom"===e?(A.style.zIndex="-1",s.insertBefore(A,s.firstChild)):(A.style.zIndex="0",s.appendChild(A));const o=A.getContext("2d",{alpha:!0});o?(this._layers.set(e,o),this.clearAll(e)):A.remove()}removeLayerFromDom(e="top"){const t=this._layers.get(e);t&&(t.canvas.remove(),this._layers.delete(e))}hasLayer(e){return this._layers.has(e)}_createPlaceHolder(e=24){var t;null===(t=this._placeholderBitmap)||void 0===t||t.close(),this._placeholderBitmap=void 0;const i=32,s=r.createCanvas(this.document,i,e),o=s.getContext("2d",{alpha:!1});if(!o)return;const a=r.createImageData(o,i,e),n=new Uint32Array(a.data.buffer),h=(0,A.toRGBA8888)(0,0,0),g=(0,A.toRGBA8888)(255,255,255);n.fill(h);for(let t=0;t<e;++t){const e=t%2,A=t*i;for(let t=0;t<i;t+=2)n[A+t+e]=g}o.putImageData(a,0,0);const d=screen.width+i-1&-32||4096;this._placeholder=r.createCanvas(this.document,d,e);const l=this._placeholder.getContext("2d",{alpha:!1});if(!l)return void(this._placeholder=void 0);for(let e=0;e<d;e+=i)l.drawImage(s,e,0);const I=this._placeholder;r.createImageBitmap(I).then(e=>{this._placeholder!==I?null==e||e.close():this._placeholderBitmap=e}).catch(()=>{})}get document(){var e;return null===(e=this._terminal._core._coreBrowserService)||void 0===e?void 0:e.window.document}}t.ImageRenderer=r},699(e,t,i){Object.defineProperty(t,"__esModule",{value:!0}),t.ImageStorage=t.CELL_SIZE_DEFAULT=void 0;const A=i(463);t.CELL_SIZE_DEFAULT={width:7,height:14};class s{get ext(){return this._urlId?-469762049&this._ext|this.underlineStyle<<26:this._ext}set ext(e){this._ext=e}get underlineStyle(){return this._urlId?5:(469762048&this._ext)>>26}set underlineStyle(e){this._ext&=-469762049,this._ext|=e<<26&469762048}get underlineColor(){return 67108863&this._ext}set underlineColor(e){this._ext&=-67108864,this._ext|=67108863&e}get underlineVariantOffset(){const e=(3758096384&this._ext)>>29;return e<0?4294967288^e:e}set underlineVariantOffset(e){this._ext&=536870911,this._ext|=e<<29&3758096384}get urlId(){return this._urlId}set urlId(e){this._urlId=e}constructor(e=0,t=0,i=-1,A=-1){this.imageId=i,this.tileId=A,this._ext=0,this._urlId=0,this._ext=e,this._urlId=t}clone(){return new s(this._ext,this._urlId,this.imageId,this.tileId)}isEmpty(){return 0===this.underlineStyle&&0===this._urlId&&-1===this.imageId}}const r=new s;t.ImageStorage=class{constructor(e,t,i){this._terminal=e,this._renderer=t,this._opts=i,this._images=new Map,this._lastId=0,this._lowestId=0,this._fullyCleared=!1,this._needsFullClear=!1,this._pixelLimit=25e5;try{this.setLimit(this._opts.storageLimit)}catch(e){e instanceof Error&&console.error(e.message),console.warn(`storageLimit is set to ${this.getLimit()} MB`)}this._viewportMetrics={cols:this._terminal.cols,rows:this._terminal.rows}}dispose(){this.reset()}reset(){var e;for(const t of this._images.values())null===(e=t.marker)||void 0===e||e.dispose();this._images.clear(),this._renderer.clearAll()}getLimit(){return 4*this._pixelLimit/1e6}setLimit(e){if(e<.5||e>1e3)throw RangeError("invalid storageLimit, should be at least 0.5 MB and not exceed 1G");this._pixelLimit=e/4*1e6>>>0,this._evictOldest(0)}getUsage(){return 4*this._getStoredPixels()/1e6}_getStoredPixels(){let e=0;for(const t of this._images.values())t.orig&&(e+=t.orig.width*t.orig.height,t.actual&&t.actual!==t.orig&&(e+=t.actual.width*t.actual.height));return e}_delImg(e){var t;const i=this._images.get(e);i&&(this._images.delete(e),window.ImageBitmap&&i.orig instanceof ImageBitmap&&i.orig.close(),null===(t=this.onImageDeleted)||void 0===t||t.call(this,e))}wipeAlternate(){var e;const t=[];for(const[i,A]of this._images.entries())"alternate"===A.bufferType&&(null===(e=A.marker)||void 0===e||e.dispose(),t.push(i));for(const e of t)this._delImg(e);this._needsFullClear=!0,this._fullyCleared=!1}deleteImage(e){var t;const i=this._images.get(e);i&&(null===(t=i.marker)||void 0===t||t.dispose(),this._delImg(e))}addImage(e,i){var A,s;this._evictOldest(e.width*e.height);let r=this._renderer.cellSize;-1!==r.width&&-1!==r.height||(r=t.CELL_SIZE_DEFAULT);const o=Math.ceil(e.width/r.width),a=Math.ceil(e.height/r.height),n=++this._lastId,h=this._terminal._core.buffer,g=this._terminal.cols,d=this._terminal.rows,l=h.x,I=h.y;let c=l,_=0;i.scrolling||(h.x=0,h.y=0,c=0),this._terminal._core._inputHandler._dirtyRowTracker.markDirty(h.y);for(let e=0;e<a;++e){const t=h.lines.get(h.y+h.ybase);for(let i=0;i<o&&!(c+i>=g);++i)this._writeToCell(t,c+i,n,e*o+i),_++;if(i.scrolling)e<a-1&&this._terminal._core._inputHandler.lineFeed();else if(++h.y>=d)break;h.x=c}this._terminal._core._inputHandler._dirtyRowTracker.markDirty(h.y),i.scrolling?"iip"===i.cursorPos?h.x=Math.min(c+o,g):h.x=c:(h.x=l,h.y=I);const C=[];for(const[e,t]of this._images.entries())t.tileCount<1&&(null===(A=t.marker)||void 0===A||A.dispose(),C.push(e));for(const e of C)this._delImg(e);const B=this._terminal.registerMarker(0);null==B||B.onDispose(()=>{this._images.get(n)&&this._delImg(n)}),"alternate"===this._terminal.buffer.active.type&&this._evictOnAlternate();const Q={orig:e,origCellSize:r,actual:e,actualCellSize:Object.assign({},r),marker:B||void 0,tileCount:_,bufferType:this._terminal.buffer.active.type,layer:i.layer,zIndex:i.zIndex};return this._images.set(n,Q),null===(s=this.onImageAdded)||void 0===s||s.call(this),n}render(e){var t,i;let A=!1,s=!1;for(const e of this._images.values())if("bottom"===e.layer?s=!0:A=!0,A&&s)break;if(A&&!this._renderer.hasLayer("top")&&(this._renderer.insertLayerToDom("top"),!this._renderer.hasLayer("top")))return;if(s&&!this._renderer.hasLayer("bottom")&&this._renderer.insertLayerToDom("bottom"),this._renderer.rescaleCanvas(),!this._images.size)return this._fullyCleared||(this._renderer.clearAll(),this._fullyCleared=!0,this._needsFullClear=!1),this._renderer.hasLayer("top")&&this._renderer.removeLayerFromDom("top"),void(this._renderer.hasLayer("bottom")&&this._renderer.removeLayerFromDom("bottom"));!A&&this._renderer.hasLayer("top")&&(this._renderer.clearAll("top"),this._renderer.removeLayerFromDom("top")),!s&&this._renderer.hasLayer("bottom")&&(this._renderer.clearAll("bottom"),this._renderer.removeLayerFromDom("bottom")),this._needsFullClear&&(this._renderer.clearAll(),this._fullyCleared=!0,this._needsFullClear=!1);const{start:o,end:a}=e,n=this._terminal._core.buffer,h=this._terminal._core.cols;this._renderer.clearLines(o,a);const g=[],d=[];for(let e=o;e<=a;++e){const A=n.lines.get(e+n.ydisp);if(!A)return;for(let s=0;s<h;++s)if(268435456&A.getBg(s)){let o=null!==(t=A._extendedAttrs[s])&&void 0!==t?t:r;const a=o.imageId;if(void 0===a||-1===a)continue;const n=this._images.get(a);if(-1!==o.tileId){const t=o.tileId,l=s;let I=1;for(;++s<h&&268435456&A.getBg(s)&&(o=null!==(i=A._extendedAttrs[s])&&void 0!==i?i:r)&&o.imageId===a&&o.tileId===t+I;)I++;s--,n?n.actual&&g.push({imgSpec:n,tileId:t,col:l,row:e,count:I}):this._opts.showPlaceholder&&d.push({col:l,row:e,count:I}),this._fullyCleared=!1}}}g.sort((e,t)=>e.imgSpec.zIndex-t.imgSpec.zIndex);for(const e of d)this._renderer.drawPlaceholder(e.col,e.row,e.count);for(const e of g)this._renderer.draw(e.imgSpec,e.tileId,e.col,e.row,e.count)}viewportResize(e){var t,i;if(!this._images.size)return void(this._viewportMetrics=e);if(this._viewportMetrics.cols>=e.cols)return void(this._viewportMetrics=e);const A=this._terminal._core.buffer,s=A.lines.length,o=this._viewportMetrics.cols-1;for(let a=0;a<s;++a){const s=A.lines.get(a);if(268435456&s.getBg(o)){const A=null!==(i=s._extendedAttrs[o])&&void 0!==i?i:r,a=A.imageId;if(void 0===a||-1===a)continue;const n=this._images.get(a);if(!n)continue;const h=Math.ceil(((null===(t=n.actual)||void 0===t?void 0:t.width)||0)/n.actualCellSize.width);if(A.tileId%h+1>=h)continue;let g=!1;for(let t=o+1;t>e.cols;++t)if(4194303&s._data[3*t+0]){g=!0;break}if(g)continue;const d=Math.min(e.cols,h-A.tileId%h+o);let l=A.tileId;for(let e=o+1;e<d;++e)this._writeToCell(s,e,a,++l),n.tileCount++}}this._viewportMetrics=e}getImageAtBufferCell(e,t){var i,s,o;const a=this._terminal._core.buffer.lines.get(t);if(a&&268435456&a.getBg(e)){const t=null!==(o=a._extendedAttrs[e])&&void 0!==o?o:r;if(t.imageId&&-1!==t.imageId){const e=null===(i=this._images.get(t.imageId))||void 0===i?void 0:i.orig;if(window.ImageBitmap&&e instanceof ImageBitmap){const t=A.ImageRenderer.createCanvas(window.document,e.width,e.height);return null===(s=t.getContext("2d"))||void 0===s||s.drawImage(e,0,0,e.width,e.height),t}return e}}}extractTileAtBufferCell(e,t){var i;const A=this._terminal._core.buffer.lines.get(t);if(A&&268435456&A.getBg(e)){const t=null!==(i=A._extendedAttrs[e])&&void 0!==i?i:r;if(t.imageId&&-1!==t.imageId&&-1!==t.tileId){const e=this._images.get(t.imageId);if(e)return this._renderer.extractTile(e,t.tileId)}}}_evictOldest(e){var t;const i=this._getStoredPixels();let A=i;for(;this._pixelLimit<A+e&&this._images.size;){const e=this._images.get(++this._lowestId);e&&e.orig&&(A-=e.orig.width*e.orig.height,e.actual&&e.orig!==e.actual&&(A-=e.actual.width*e.actual.height),null===(t=e.marker)||void 0===t||t.dispose(),this._delImg(this._lowestId))}return i-A}_writeToCell(e,t,i,A){if(268435456&e._data[3*t+2]){const r=e._extendedAttrs[t];if(r){if(void 0!==r.imageId){const e=this._images.get(r.imageId);return e&&e.tileCount--,r.imageId=i,void(r.tileId=A)}return void(e._extendedAttrs[t]=new s(r.ext,r.urlId,i,A))}}e._data[3*t+2]|=268435456,e._extendedAttrs[t]=new s(0,0,i,A)}_evictOnAlternate(){var e,t;for(const e of this._images.values())"alternate"===e.bufferType&&(e.tileCount=0);const i=this._terminal._core.buffer;for(let t=0;t<this._terminal.rows;++t){const A=i.lines.get(t);if(A)for(let t=0;t<this._terminal.cols;++t)if(268435456&A._data[3*t+2]){const i=null===(e=A._extendedAttrs[t])||void 0===e?void 0:e.imageId;if(i){const e=this._images.get(i);e&&e.tileCount++}}}const A=[];for(const[e,i]of this._images.entries())"alternate"!==i.bufferType||i.tileCount||(null===(t=i.marker)||void 0===t||t.dispose(),A.push(e));for(const e of A)this._delImg(e)}}},566(e,t,i){Object.defineProperty(t,"__esModule",{value:!0}),t.SixelHandler=void 0;const A=i(939),s=i(463),r=i(591),o=A.PALETTE_ANSI_256;function a(e){return A.BIG_ENDIAN?e:(255&e)<<24|(e>>>8&255)<<16|(e>>>16&255)<<8|e>>>24&255}o.set(A.PALETTE_VT340_COLOR),t.SixelHandler=class{constructor(e,t,i){this._opts=e,this._storage=t,this._coreTerminal=i,this._size=0,this._aborted=!1,(0,r.DecoderAsync)({memoryLimit:4*this._opts.pixelLimit,palette:o,paletteLimit:this._opts.sixelPaletteLimit}).then(e=>this._dec=e)}reset(){this._dec&&(this._dec.release(),this._dec._palette.fill(0),this._dec.init(0,o,this._opts.sixelPaletteLimit))}hook(e){var t;if(this._size=0,this._aborted=!1,this._dec){const i=1===e.params[1]?0:function(e,t){let i=0;if(!t)return i;if(e.isInverse())if(e.isFgDefault())i=a(t.foreground.rgba);else if(e.isFgRGB()){const t=e.constructor.toColorRGB(e.getFgColor());i=(0,A.toRGBA8888)(...t)}else i=a(t.ansi[e.getFgColor()].rgba);else if(e.isBgDefault())i=a(t.background.rgba);else if(e.isBgRGB()){const t=e.constructor.toColorRGB(e.getBgColor());i=(0,A.toRGBA8888)(...t)}else i=a(t.ansi[e.getBgColor()].rgba);return i}(this._coreTerminal._core._inputHandler._curAttrData,null===(t=this._coreTerminal._core._themeService)||void 0===t?void 0:t.colors);this._dec.init(i,null,this._opts.sixelPaletteLimit)}}put(e,t,i){if(!this._aborted&&this._dec){if(this._size+=i-t,this._size>this._opts.sixelSizeLimit)return console.warn("SIXEL: too much data, aborting"),this._aborted=!0,void this._dec.release();try{this._dec.decode(e,t,i)}catch(e){console.warn(`SIXEL: error while decoding image - ${e}`),this._aborted=!0,this._dec.release()}}}unhook(e){var t;if(this._aborted||!e||!this._dec)return!0;const i=this._dec.width,A=this._dec.height;if(!i||!A)return A&&this._storage.advanceCursor(A),!0;const r=s.ImageRenderer.createCanvas(void 0,i,A);return null===(t=r.getContext("2d"))||void 0===t||t.putImageData(new ImageData(this._dec.data8,i,A),0,0),this._dec.memoryUsage>4194304&&this._dec.release(),this._storage.addImage(r),!0}}},994(e,t,i){Object.defineProperty(t,"__esModule",{value:!0}),t.SixelImageStorage=void 0;const A=i(699);t.SixelImageStorage=class{constructor(e,t,i,A){this._storage=e,this._opts=t,this._renderer=i,this._terminal=A,this._addImageOpts={scrolling:!0,layer:"top",zIndex:0,cursorPos:"vt340"}}addImage(e){this._addImageOpts.scrolling=this._opts.sixelScrolling,this._storage.addImage(e,this._addImageOpts)}advanceCursor(e){if(this._opts.sixelScrolling){let t=this._renderer.cellSize;-1!==t.width&&-1!==t.height||(t=A.CELL_SIZE_DEFAULT);const i=Math.ceil(e/t.height);for(let e=1;e<i;++e)this._terminal._core._inputHandler.lineFeed()}}}},23(e,t,i){var A=this&&this.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.KittyGraphicsHandler=void 0;const s=i(463),r=i(699),o=i(462),a=A(i(669)),n=i(470);t.KittyGraphicsHandler=class{constructor(e,t,i,A){this._opts=e,this._renderer=t,this._kittyStorage=i,this._coreTerminal=A,this._aborted=!1,this._generation=0,this._decodeError=!1,this._activeDecoder=null,this._inControlData=!0,this._controlData=new Uint32Array(512),this._controlLength=0,this._encodedSizeLimit=0,this._totalEncodedSize=0,this._parsedCommand=null,this._pendingTransmissions=new Map,this._maxEncodedBytes=Math.ceil(4*this._opts.kittySizeLimit/3),this._initialEncodedBytes=Math.min(4194304,this._maxEncodedBytes)}reset(){this._generation++,this._cleanupAllPending(),this._activeDecoder&&(this._activeDecoder.release(),this._activeDecoder=null),this._kittyStorage.reset()}dispose(){this.reset()}_removePendingEntry(e){this._pendingTransmissions.delete(e),this._lastPendingKey===e&&(this._lastPendingKey=void 0)}_cleanupAllPending(){for(const e of this._pendingTransmissions.values())e.decoder.release();this._pendingTransmissions.clear(),this._lastPendingKey=void 0}start(){this._aborted=!1,this._decodeError=!1,this._inControlData=!0,this._controlLength=0,this._parsedCommand=null,this._encodedSizeLimit=this._maxEncodedBytes,this._totalEncodedSize=0,this._activeDecoder=null}put(e,t,i){var A;if(!this._aborted)if(this._inControlData){let s=i;for(let A=t;A<i;A++)if(59===e[A]){this._inControlData=!1,s=A;break}const r=s-t;if(this._controlLength+r>512)return void(this._aborted=!0);if(this._controlData.set(e.subarray(t,s),this._controlLength),this._controlLength+=r,!this._inControlData){if(this._parsedCommand=(0,n.parseKittyCommand)(this._parseControlDataString()),void 0!==this._parsedCommand.id&&void 0!==this._parsedCommand.imageNumber)return this._sendResponse(this._parsedCommand.id,"EINVAL:cannot specify both i and I keys",null!==(A=this._parsedCommand.quiet)&&void 0!==A?A:0),void(this._aborted=!0);if("d"===this._parsedCommand.action)return;const t=s+1;t<i&&this._streamPayload(e,t,i)}}else this._streamPayload(e,t,i)}_streamPayload(e,t,i){var A,s,r,o,n,h,g,d;if(this._aborted)return;const l=null!==(o=null!==(r=null===(A=this._parsedCommand)||void 0===A?void 0:A.id)&&void 0!==r?r:this._lastPendingKey)&&void 0!==o?o:0,I=this._pendingTransmissions.get(l),c=null!==(n=null==I?void 0:I.totalEncodedSize)&&void 0!==n?n:0;if(this._totalEncodedSize+=i-t,c+this._totalEncodedSize>this._encodedSizeLimit){const e=null!==(h=this._activeDecoder)&&void 0!==h?h:null==I?void 0:I.decoder;return e&&e.release(),this._activeDecoder=null,I&&this._removePendingEntry(l),void(this._aborted=!0)}if(!this._decodeError){if((null==I?void 0:I.decoder)&&!this._activeDecoder&&(this._activeDecoder=I.decoder),!this._activeDecoder){const e=this._maxEncodedBytes+131072;if(e>1e6*this._opts.storageLimit)return this._aborted=!0,void(void 0!==(null===(s=this._parsedCommand)||void 0===s?void 0:s.id)&&this._sendResponse(this._parsedCommand.id,"ENOMEM:pending image budget exceeded",null!==(g=this._parsedCommand.quiet)&&void 0!==g?g:0));const t=Math.max(1,Math.floor(1e6*this._opts.storageLimit/e));for(;this._pendingTransmissions.size>=t;){const e=this._pendingTransmissions.entries().next().value;if(!e)break;e[1].decoder.release(),this._removePendingEntry(e[0]),void 0!==e[1].cmd.id&&this._sendResponse(e[1].cmd.id,"ENOMEM:pending image budget exceeded",null!==(d=e[1].cmd.quiet)&&void 0!==d?d:0)}this._activeDecoder=new a.default(4194304,this._maxEncodedBytes,this._initialEncodedBytes),this._activeDecoder.init()}0!==this._activeDecoder.put(e.subarray(t,i))&&(this._activeDecoder.release(),this._activeDecoder=null,this._decodeError=!0,I&&this._removePendingEntry(l))}}end(e){var t,i;if(this._aborted||!e)return this._activeDecoder&&(this._activeDecoder.release(),this._activeDecoder=null),!0;if(this._inControlData)return this._handleNoPayloadCommand();const A=this._parsedCommand;if("d"===A.action)return this._handleDelete(A);const s=null!==(i=null!==(t=A.id)&&void 0!==t?t:this._lastPendingKey)&&void 0!==i?i:0,r=1===A.more,o=this._pendingTransmissions.get(s);if(r)return this._activeDecoder&&(o?(o.totalEncodedSize+=this._totalEncodedSize,o.decodeError=o.decodeError||this._decodeError):this._pendingTransmissions.set(s,{cmd:Object.assign({},A),decoder:this._activeDecoder,totalEncodedSize:this._totalEncodedSize,decodeError:this._decodeError}),this._lastPendingKey=s,this._activeDecoder=null),!0;o&&(this._lastPendingKey=void 0);let a=this._decodeError,n=A,h=this._activeDecoder;o&&(n=o.cmd,h=o.decoder,a=a||o.decodeError,this._pendingTransmissions.delete(s));let g=new Uint8Array(0);h&&(0!==h.end()&&(a=!0),g=h.data8),this._activeDecoder=null;const d=this._handleCommandWithBytesAndCmd(n,g,a);return h&&h.release(),d}_parseControlDataString(){let e="";for(let t=0;t<this._controlLength;t++)e+=String.fromCodePoint(this._controlData[t]);return e}_handleNoPayloadCommand(){var e,t,i,A,s;const r=(0,n.parseKittyCommand)(this._parseControlDataString());if(void 0!==r.id&&void 0!==r.imageNumber)return this._sendResponse(r.id,"EINVAL:cannot specify both i and I keys",null!==(e=r.quiet)&&void 0!==e?e:0),!0;switch(null!==(t=r.action)&&void 0!==t?t:"t"){case"d":return this._handleDelete(r);case"q":return this._sendResponse(null!==(i=r.id)&&void 0!==i?i:0,"OK",null!==(A=r.quiet)&&void 0!==A?A:0),!0;case"p":return this._handlePlacement(r);default:return void 0!==r.id&&this._sendResponse(r.id,"EINVAL:unsupported action",null!==(s=r.quiet)&&void 0!==s?s:0),!0}}_handleCommandWithBytesAndCmd(e,t,i){var A,s,r,o,a;switch(null!==(A=e.action)&&void 0!==A?A:"t"){case"t":{const A=this._handleTransmit(e,t,i);return"d"===(null!==(s=e.transmission)&&void 0!==s?s:"d")&&void 0!==e.id&&(i?this._sendResponse(e.id,"EINVAL:invalid base64 data",null!==(r=e.quiet)&&void 0!==r?r:0):t.length>0&&this._sendResponse(e.id,"OK",null!==(o=e.quiet)&&void 0!==o?o:0)),A}case"T":return this._handleTransmitDisplay(e,t,i);case"q":return this._handleQuery(e,t,i);case"p":return this._handlePlacement(e);default:return void 0!==e.id&&this._sendResponse(e.id,"EINVAL:unsupported action",null!==(a=e.quiet)&&void 0!==a?a:0),!0}}_handlePlacement(e){var t;if(void 0===e.id)return!0;const i=e.id,A=this._kittyStorage.getImage(i);return A?this._displayImage(A,e).then(t=>{var A;return this._sendResponse(i,t?"OK":"EINVAL:image rendering failed",null!==(A=e.quiet)&&void 0!==A?A:0,e.placementId),!0}):(this._sendResponse(i,"ENOENT:image not found",null!==(t=e.quiet)&&void 0!==t?t:0,e.placementId),!0)}_handleTransmit(e,t,i){var A,s,r,o,a,n;return"d"!==(null!==(A=e.transmission)&&void 0!==A?A:"d")?(void 0!==e.id&&this._sendResponse(e.id,"EINVAL:unsupported transmission medium",null!==(s=e.quiet)&&void 0!==s?s:0),!0):(i||0===t.length||this._kittyStorage.storeImage(e.id,{data:new Blob([t]),width:null!==(r=e.width)&&void 0!==r?r:0,height:null!==(o=e.height)&&void 0!==o?o:0,format:null!==(a=e.format)&&void 0!==a?a:32,compression:null!==(n=e.compression)&&void 0!==n?n:""}),!0)}_handleTransmitDisplay(e,t,i){var A,s;if(i)return void 0!==e.id&&this._sendResponse(e.id,"EINVAL:invalid base64 data",null!==(A=e.quiet)&&void 0!==A?A:0),!0;this._handleTransmit(e,t,i);const r=null!==(s=e.id)&&void 0!==s?s:this._kittyStorage.lastImageId,o=this._kittyStorage.getImage(r);if(o){const t=this._displayImage(o,e);return void 0!==e.id?t.then(t=>{var i;return this._sendResponse(r,t?"OK":"EINVAL:image rendering failed",null!==(i=e.quiet)&&void 0!==i?i:0),!0}):t.then(()=>!0)}return!0}_handleQuery(e,t,i){var A,s,r,o,a,n;const h=null!==(A=e.id)&&void 0!==A?A:0,g=null!==(s=e.quiet)&&void 0!==s?s:0;if("d"!==(null!==(r=e.transmission)&&void 0!==r?r:"d"))return this._sendResponse(h,"EINVAL:unsupported transmission medium",g),!0;if(i)return this._sendResponse(h,"EINVAL:invalid base64 data",g),!0;if(0===t.length)return this._sendResponse(h,"OK",g),!0;const d=null!==(o=e.format)&&void 0!==o?o:32;if(100===d)this._sendResponse(h,"OK",g);else{const i=null!==(a=e.width)&&void 0!==a?a:0,A=null!==(n=e.height)&&void 0!==n?n:0;if(!i||!A)return this._sendResponse(h,"EINVAL:width and height required for raw pixel data",g),!0;const s=i*A*(32===d?4:3);if(t.length<s)return this._sendResponse(h,"EINVAL:insufficient pixel data",g),!0;this._sendResponse(h,"OK",g)}return!0}_handleDelete(e){var t;switch(null!==(t=e.deleteSelector)&&void 0!==t?t:"a"){case"a":case"A":this._cleanupAllPending(),this._kittyStorage.deleteAll();break;case"i":case"I":if(void 0!==e.id){const t=this._pendingTransmissions.get(e.id);t&&t.decoder.release(),this._removePendingEntry(e.id),this._kittyStorage.deleteById(e.id)}}return!0}_sendResponse(e,t,i,A){const s="OK"===t;if(s&&i>=1)return;if(!s&&i>=2)return;const r=`_Gi=${e}${A?`,p=${A}`:""};${t}\\`;this._coreTerminal._core.coreService.triggerDataEvent(r)}_displayImage(e,t){return this._decodeAndDisplay(e,t).then(()=>!0).catch(()=>!1)}async _decodeAndDisplay(e,t){var i,A,o,a,n,h,g;const d=this._generation;let l=await this._createBitmap(e);try{if(d!==this._generation)throw new Error("image decode canceled");const I=Math.max(0,null!==(o=t.x)&&void 0!==o?o:0),c=Math.max(0,null!==(a=t.y)&&void 0!==a?a:0),_=t.sourceWidth||l.width-I,C=t.sourceHeight||l.height-c,B=Math.max(0,l.width-I),Q=Math.max(0,l.height-c),m=Math.max(0,Math.min(_,B)),E=Math.max(0,Math.min(C,Q));if(0===m||0===E)throw new Error("invalid source rectangle");if(0!==I||0!==c||m!==l.width||E!==l.height){const e=await createImageBitmap(l,I,c,m,E);l.close(),l=e}const u=(null===(i=this._renderer.dimensions)||void 0===i?void 0:i.css.cell.width)||r.CELL_SIZE_DEFAULT.width,p=(null===(A=this._renderer.dimensions)||void 0===A?void 0:A.css.cell.height)||r.CELL_SIZE_DEFAULT.height;let w,f;void 0!==t.columns&&void 0!==t.rows?(w=t.columns,f=t.rows):void 0!==t.columns?(w=t.columns,f=Math.max(1,Math.ceil(l.height/l.width*(w*u)/p))):void 0!==t.rows?(f=t.rows,w=Math.max(1,Math.ceil(l.width/l.height*(f*p)/u))):(w=Math.ceil(l.width/u),f=Math.ceil(l.height/p));let D=l.width,y=l.height;if(void 0===t.columns&&void 0===t.rows||(D=Math.round(w*u),y=Math.round(f*p)),D*y>this._opts.pixelLimit)throw new Error("image exceeds pixel limit");const v=this._coreTerminal._core.buffer,k=v.x,M=v.y,b=v.ybase,S=void 0!==t.zIndex&&t.zIndex<0?"bottom":"top";if(D!==l.width||y!==l.height){const e=await createImageBitmap(l,{resizeWidth:D,resizeHeight:y});l.close(),l=e}const L=Math.min(Math.max(0,null!==(n=t.xOffset)&&void 0!==n?n:0),u-1),N=Math.min(Math.max(0,null!==(h=t.yOffset)&&void 0!==h?h:0),p-1);if(0!==L||0!==N){const e=void 0!==t.columns?Math.round(w*u):l.width+L,i=void 0!==t.rows?Math.round(f*p):l.height+N,A=s.ImageRenderer.createCanvas(window.document,e,i),r=A.getContext("2d");if(!r)throw new Error("Failed to create offset canvas context");r.drawImage(l,L,N);const o=await createImageBitmap(A);if(A.width=A.height=0,l.close(),l=o,D=l.width,y=l.height,D*y>this._opts.pixelLimit)throw new Error("image exceeds pixel limit");void 0===t.columns&&(w=Math.ceil(l.width/u)),void 0===t.rows&&(f=Math.ceil(l.height/p))}if(d!==this._generation)throw new Error("image decode canceled");const G=null!==(g=t.zIndex)&&void 0!==g?g:0;if(this._kittyStorage.addImage(e.id,l,!0,S,G),l=void 0,1===t.cursorMovement){const e=v.ybase-b;v.x=k,v.y=Math.max(M-e,0)}else v.x=Math.min(k+w,this._coreTerminal.cols)}catch(e){throw null==l||l.close(),e}}async _createBitmap(e){let t=new Uint8Array(await e.data.arrayBuffer());if("z"===e.compression&&(t=await this._decompressZlib(t)),100===e.format){const e=(0,o.imageType)(t);if("image/png"!==e.mime||!(e.width>0)||!(e.height>0)||e.width*e.height>this._opts.pixelLimit)throw new RangeError("PNG exceeds pixel limit or has invalid dimensions");const i=new Blob([t],{type:"image/png"});if(!window.createImageBitmap){const e=URL.createObjectURL(i),t=new Image;return new Promise((i,A)=>{t.addEventListener("load",()=>{var r;URL.revokeObjectURL(e);const o=s.ImageRenderer.createCanvas(window.document,t.width,t.height);null===(r=o.getContext("2d"))||void 0===r||r.drawImage(t,0,0),createImageBitmap(o).then(i).catch(A)}),t.addEventListener("error",()=>{URL.revokeObjectURL(e),A(new Error("Failed to load image"))}),t.src=e})}return createImageBitmap(i)}const i=e.width,A=e.height;if(!i||!A)throw new Error("Width and height required for raw pixel data");const r=i*A*(32===e.format?4:3);if(t.length<r)throw new Error("Insufficient pixel data");const a=i*A;if(32===e.format)return createImageBitmap(new ImageData(new Uint8ClampedArray(t.buffer,t.byteOffset,4*a),i,A));const n=new Uint8ClampedArray(4*a),h=new Uint32Array(t.buffer,t.byteOffset,Math.floor(t.byteLength/4)),g=new Uint32Array(n.buffer),d=-4&a;let l=0,I=0;for(let e=0;e<d;e+=4){const e=h[l++],t=h[l++],i=h[l++];g[I++]=4278190080|e,g[I++]=4278190080|e>>>24|t<<8,g[I++]=4278190080|t>>>16|i<<16,g[I++]=4278190080|i>>>8}let c=3*d,_=4*d;for(let e=d;e<a;e++)n[_]=t[c],n[_+1]=t[c+1],n[_+2]=t[c+2],n[_+3]=255,c+=3,_+=4;return createImageBitmap(new ImageData(n,i,A))}async _decompressZlib(e){try{return await this._decompress(e,"deflate")}catch(t){if(t instanceof RangeError)throw t;return await this._decompress(e,"deflate-raw")}}async _decompress(e,t){const i=Math.min(this._opts.kittySizeLimit,4*this._opts.pixelLimit,1e6*this._opts.storageLimit);let A=0;const s=new ReadableStream({pull(t){if(A>=e.length)return void t.close();const i=Math.min(A+4096,e.length);t.enqueue(new Uint8Array(e.subarray(A,i))),A=i}}).pipeThrough(new DecompressionStream(t)).getReader(),r=[];let o=0;try{for(;;){const{done:e,value:t}=await s.read();if(e)break;if(o+=t.byteLength,o>i)throw await s.cancel().catch(()=>{}),new RangeError("decompressed image exceeds byte limit");r.push(t)}}finally{s.releaseLock()}const a=new Uint8Array(o);let n=0;for(const e of r)a.set(e,n),n+=e.length;return a}get images(){return this._kittyStorage.images}get _kittyIdToStorageId(){return this._kittyStorage.kittyIdToStorageId}get pendingTransmissions(){return this._pendingTransmissions}}},470(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.parseKittyCommand=function(e){const t={},i=e.split(",");for(const e of i){const i=e.indexOf("=");if(-1===i)continue;const A=e.substring(0,i),s=e.substring(i+1);if("a"===A){t.action=s;continue}if("o"===A){t.compression=s;continue}if("t"===A){t.transmission=s;continue}if("d"===A){t.deleteSelector=s;continue}const r=parseInt(s,10);switch(A){case"f":t.format=r;break;case"i":t.id=r;break;case"I":t.imageNumber=r;break;case"s":t.width=r;break;case"v":t.height=r;break;case"x":t.x=r;break;case"y":t.y=r;break;case"w":t.sourceWidth=r;break;case"h":t.sourceHeight=r;break;case"X":t.xOffset=r;break;case"Y":t.yOffset=r;break;case"c":t.columns=r;break;case"r":t.rows=r;break;case"m":t.more=r;break;case"q":t.quiet=r;break;case"C":t.cursorMovement=r;break;case"z":t.zIndex=r;break;case"p":t.placementId=r}}return t}},235(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.KittyImageStorage=void 0;class i{constructor(e){this._storage=e,this._nextImageId=1,this._images=new Map,this._kittyIdToStorageId=new Map,this._storageIdToKittyId=new Map,this._handleStorageImageDeleted=e=>{const t=this._storageIdToKittyId.get(e);void 0!==t&&(this._kittyIdToStorageId.delete(t),this._storageIdToKittyId.delete(e),this._images.delete(t))},this._addImageOpts={scrolling:!0,layer:"top",zIndex:0,cursorPos:"iip"},this._previousOnImageDeleted=this._storage.onImageDeleted,this._wrappedOnImageDeleted=e=>{var t;null===(t=this._previousOnImageDeleted)||void 0===t||t.call(this,e),this._handleStorageImageDeleted(e)},this._storage.onImageDeleted=this._wrappedOnImageDeleted}reset(){this._nextImageId=1,this._images.clear(),this._kittyIdToStorageId.clear(),this._storageIdToKittyId.clear()}dispose(){this.reset(),this._storage.onImageDeleted===this._wrappedOnImageDeleted&&(this._storage.onImageDeleted=this._previousOnImageDeleted)}storeImage(e,t){const A=null!=e?e:this._nextImageId++,s=this._kittyIdToStorageId.get(A);void 0!==s&&(this._storage.deleteImage(s),this._kittyIdToStorageId.delete(A),this._storageIdToKittyId.delete(s)),!this._images.has(A)&&this._images.size>=i._maxStoredImages&&this._evictUndisplayedImages();const r=1e6*this._storage.getLimit();this._images.delete(A);let o=0;for(const e of this._images.values())o+=e.data.size;for(const e of[!1,!0])for(const[i,A]of this._images){if(o+t.data.size<=r)break;this._kittyIdToStorageId.has(i)===e&&(o-=A.data.size,this.deleteById(i))}return this._images.set(A,Object.assign(Object.assign({},t),{id:A})),A}addImage(e,t,i,A,s){const r=this._kittyIdToStorageId.get(e);void 0!==r&&this._storageIdToKittyId.delete(r),this._addImageOpts.scrolling=i,this._addImageOpts.layer=A,this._addImageOpts.zIndex=s;const o=this._storage.addImage(t,this._addImageOpts);this._kittyIdToStorageId.set(e,o),this._storageIdToKittyId.set(o,e)}getImage(e){return this._images.get(e)}deleteById(e){this._images.delete(e);const t=this._kittyIdToStorageId.get(e);void 0!==t&&(this._storage.deleteImage(t),this._kittyIdToStorageId.delete(e),this._storageIdToKittyId.delete(t))}deleteAll(){this._images.clear();for(const e of this._kittyIdToStorageId.values())this._storage.deleteImage(e);this._kittyIdToStorageId.clear(),this._storageIdToKittyId.clear()}get images(){return this._images}get kittyIdToStorageId(){return this._kittyIdToStorageId}get lastImageId(){return this._nextImageId-1}_evictUndisplayedImages(){for(const[e]of this._images){if(this._images.size<=i._maxStoredImages/2)break;this._kittyIdToStorageId.has(e)||this._images.delete(e)}}}t.KittyImageStorage=i,i._maxStoredImages=256},669(e,t,i){Object.defineProperty(t,"__esModule",{value:!0});const A=(0,i(552).InWasm)({s:1,t:0,d:"AGFzbQEAAAABBQFgAAF/Ag8BA2VudgZtZW1vcnkCAAEDAwIAAAcNAgNkZWMAAANlbmQAAQqLBgKZBAEKf0GIKCgCAEGgKGohAUGEKCgCACIDQaAoaiEAQYAoKAIAQQFrQXxxIgRBoChqIQUgBEEQayADSgRAIARBkChqIQMDQCABIABBA2otAABBAnQoAoAgIABBAmotAABBAnQoAoAYIABBAWotAABBAnQoAoAQIAAtAABBAnQoAoAIcnJyIgY2AgAgAUEDaiAAQQdqLQAAQQJ0KAKAICAAQQZqLQAAQQJ0KAKAGCAAQQVqLQAAQQJ0KAKAECAAQQRqLQAAQQJ0KAKACHJyciIHNgIAIAFBBmogAEELai0AAEECdCgCgCAgAEEKai0AAEECdCgCgBggAEEJai0AAEECdCgCgBAgAEEIai0AAEECdCgCgAhycnIiCDYCACABQQlqIABBD2otAABBAnQoAoAgIABBDmotAABBAnQoAoAYIABBDWotAABBAnQoAoAQIABBDGotAABBAnQoAoAIcnJyIgk2AgAgAiAGciAHciAIciAJciECIAFBDGohASAAQRBqIgAgA0kNAAsLIAAgBUkEQANAIAEgAEEDai0AAEECdCgCgCAgAEECai0AAEECdCgCgBggAEEBai0AAEECdCgCgBAgAC0AAEECdCgCgAhycnIiAzYCACACIANyIQIgAUEDaiEBIABBBGoiACAFSQ0ACwtBfyEAIAJB////B00Ef0GEKCAENgIAQYgoIAFBoChrNgIAQQAFQX8LC+0BAQR/AkBBgCgoAgAiAUGEKCgCACIAa0EFTgRAQX8hAxAADQFBgCgoAgAhAUGEKCgCACEAC0F/IQMgASAAayIBQQJIDQAgAC0AoShBAnQoAoAQIAAtAKAoQQJ0KAKACHIhAgJ/IAFBBEYEQEEDQQQgAC0AoyhBPUYbIAAtAKIoQT1GayEBC0EBIAFBA0kNABogAC0AoihBAnQoAoAYIAJyIQJBAiABQQRHDQAaIAAtAKMoQQJ0KAKAICACciECQQMLIQEgAkH///8HSw0AQQAhA0GIKCgCACIAIAI2AKAoQYgoIAAgAWo2AgALIAML"}),s=new Uint8Array("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".split("").map(e=>e.charCodeAt(0))),r=new Uint32Array(1024);r.fill(4278190080);for(let e=0;e<s.length;++e)r[s[e]]=e<<2;for(let e=0;e<s.length;++e)r[256+s[e]]=e>>4|(e<<4&255)<<8;for(let e=0;e<s.length;++e)r[512+s[e]]=e>>2<<8|(e<<6&255)<<16;for(let e=0;e<s.length;++e)r[768+s[e]]=e<<16;const o=new Uint8Array(0);t.default=class{constructor(e,t,i){if(this._inst=null,this._ended=!0,this._bytes=0,this.keepSize=null!=e?e:1048576,this.maxBytes=null!=t?t:4294901760,this._bytes=null!=i?i:32768,this._bytes>this.maxBytes||this.maxBytes>4294901760)throw new Error("invalid byte settings")}get data8(){return this._inst?this._d.subarray(0,this._m32[1282]):o}release(){this._inst&&(this._bytes>this.keepSize?this._inst=this._m32=this._d=this._mem=null:(this._m32[1280]=0,this._m32[1281]=0,this._m32[1282]=0))}init(e,t){if(this.maxBytes=null!=e?e:this.maxBytes,this._bytes=null!=t?t:Math.min(this._bytes,this.maxBytes),this._bytes>this.maxBytes||this.maxBytes>4294901760)throw Error("invalid byte settings");let i=this._m32;const s=this._bytes+5152;this._inst?this._mem.buffer.byteLength<s&&(this._mem.grow(Math.ceil((s-this._mem.buffer.byteLength)/65536)),i=new Uint32Array(this._mem.buffer,0),this._d=new Uint8Array(this._mem.buffer,5152)):(this._mem=new WebAssembly.Memory({initial:Math.ceil(s/65536)}),this._inst=A({env:{memory:this._mem}}),i=new Uint32Array(this._mem.buffer,0),i.set(r,256),this._d=new Uint8Array(this._mem.buffer,5152)),i[1280]=0,i[1281]=0,i[1282]=0,this._m32=i,this._ended=!1}_realloc(e){const t=this._m32[1280]+e;if(this._bytes<t){if(t>this.maxBytes)return-3;let e=this._bytes;for(;(e*=2)<t;);if(e=Math.min(e,this.maxBytes),e<t)return-3;if(e+5152>this._mem.buffer.byteLength){const t=Math.ceil((e+5152-this._mem.buffer.byteLength)/65536);this._mem.grow(t),this._m32=new Uint32Array(this._mem.buffer,0),this._d=new Uint8Array(this._mem.buffer,5152)}this._bytes=e}return 0}put(e){if(!this._inst||this._ended)return-2;if(this._realloc(e.length))return-3;const t=this._m32;return this._d.set(e,t[1280]),t[1280]+=e.length,t[1280]-t[1281]>=131072?this._inst.exports.dec():0}end(){return this._ended=!0,this._inst?this._inst.exports.end():-2}get loadedBytes(){return this._inst?this._m32[1280]:0}get freeBytes(){return this._inst?this.maxBytes-this._m32[1280]:0}}},61(e,t,i){Object.defineProperty(t,"__esModule",{value:!0});const A=(0,i(552).InWasm)({s:1,t:0,d:"AGFzbQEAAAABCgJgAABgA39/fwACDwEDZW52Bm1lbW9yeQIAAQMDAgABBwcBA2RlYwABCAEACu4EAgwAQQBBAEGAAvwLAAveBAEJf0EAQQBBgAL8CwAgAUEXTgRAIAAgAWpBCGshCkGACCEBIAJBAnRBgAhqIQsgAEEOaiEDQf8BIQZBACECA0AgA0EBaiEHIAMtAAAiCEE/cSEAAkACQCAIQcABcSIJRQRAIABBAnQiAC0AAyEGIAAtAAIhBCAALQABIQUgAC0AACECIAchAwwBCwJAIAhB/QFLDQAgCUHAAUcNACAFQQVsIAJBA2xqIARBB2xqIAZBC2xqQT9xQQJ0IgMgBDoAAiADIAU6AAEgAyACOgAAIANBA2ogBjoAAANAIAEgAjoAACABQQNqIAY6AAAgAUECaiAEOgAAIAFBAWogBToAACABQQRqIQEgAEUEQCAHIQMMBAsgAEEBayEAIAEgC0kNAAsgByEDDAILAn8CQAJAAkAgCEH+AWsOAgABAgsgAy0AAyEEIAMtAAIhBSADLQABIQIgA0EEagwCCyADKAIBIgJBGHYhBiACQRB2IQQgAkEIdiEFIANBBWoMAQsgCUGAAUcEQCAHIAlBwABHDQEaIAQgCEEDcWpBAmshBCACIABBBHZqQQJrIQIgBSAIQQJ2QQNxakECayEFIAcMAQsgBCAAQShrIgkgAy0AASIHQQ9xamohBCACIAdBBHYgCWpqIQIgACAFakEgayEFIANBAmoLIQMgBUEFbCACQQNsaiAEQQdsaiAGQQtsakE/cUECdCIAIAQ6AAIgACAFOgABIAAgAjoAACAAQQNqIAY6AAALIAEgBjoAAyABIAQ6AAIgASAFOgABIAEgAjoAACABQQRqIQELIAMgCkkNAAsLCw=="});t.default=class{constructor(e){this.keepSize=e,this.width=0,this.height=0}decode(e){this.width=e[4]<<24|e[5]<<16|e[6]<<8|e[7],this.height=e[8]<<24|e[9]<<16|e[10]<<8|e[11];const t=this.width*this.height,i=4*t,s=e.length,r=Math.max(i,s)+(Math.min(i,s)>>1)+4096;this._inst?this._mem.buffer.byteLength<r&&(this._mem.grow(Math.ceil((r-this._mem.buffer.byteLength)/65536)),this._d=null):(this._mem=new WebAssembly.Memory({initial:Math.ceil(r/65536)}),this._inst=A({env:{memory:this._mem}})),this._d||(this._d=new Uint8Array(this._mem.buffer));const o=this._mem.buffer.byteLength-s&-256;return this._d.set(e,o),this._inst.exports.dec(o,s,t),this._d.subarray(1024,1024+i)}release(){this._inst&&this._mem.buffer.byteLength>this.keepSize&&(this._inst=this._d=this._mem=null)}}},552(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.InWasm=function(e){if(e.d){const{t,s:A,d:s}=e;let r,o;const a=WebAssembly;return 0===t?A?e=>new a.Instance(o||(o=new a.Module(r||(r=i(s)))),e):e=>o?a.instantiate(o,e):a.instantiate(r||(r=i(s)),e).then(e=>(o=e.module)&&e.instance):1===t?A?()=>o||(o=new a.Module(r||(r=i(s)))):()=>o?Promise.resolve(o):a.compile(r||(r=i(s))).then(e=>o=e):A?()=>r||(r=i(s)):()=>Promise.resolve(r||(r=i(s)))}if("undefined"==typeof _wasmCtx)throw new Error('must run "inwasm"');_wasmCtx.add(e)};let i=e=>{if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e);if("undefined"!=typeof Buffer)return Buffer.from(e,"base64");const t=atob(e),i=new Uint8Array(t.length);for(let e=0;e<i.length;++e)i[e]=t.charCodeAt(e);return i}}},t={};function i(A){var s=t[A];if(void 0!==s)return s.exports;var r=t[A]={exports:{}};return e[A].call(r.exports,r,r.exports,i),r.exports}var A={};return(()=>{var e=A;Object.defineProperty(e,"__esModule",{value:!0}),e.ImageAddon=void 0;const t=i(414),s=i(795),r=i(463),o=i(699),a=i(23),n=i(235),h=i(566),g=i(994),d=i(649),l={enableSizeReports:!0,pixelLimit:16777216,sixelSupport:!0,sixelScrolling:!0,sixelPaletteLimit:4096,sixelSizeLimit:33554432,storageLimit:128,showPlaceholder:!0,iipSupport:!0,iipSizeLimit:33554432,kittySupport:!0,kittySizeLimit:33554432};e.ImageAddon=class{constructor(e){this._disposables=[],this._handlers=new Map,this._onImageAdded=new t.Emitter,this.onImageAdded=this._onImageAdded.event,this._opts=Object.assign({},l,e),this._defaultOpts=Object.assign({},l,e)}dispose(){for(const e of this._handlers.values())e.reset();for(const e of this._disposables)e.dispose();this._disposables.length=0,this._handlers.clear(),this._onImageAdded.dispose()}_disposeLater(...e){for(const t of e)this._disposables.push(t)}activate(e){var t;if(this._terminal=e,this._renderer=new r.ImageRenderer(e),this._storage=new o.ImageStorage(e,this._renderer,this._opts),this._storage.onImageAdded=()=>this._onImageAdded.fire(),this._opts.enableSizeReports){const i=null!==(t=e.options.windowOptions)&&void 0!==t?t:{};i.getWinSizePixels=!0,i.getCellSizePixels=!0,i.getWinSizeChars=!0,e.options.windowOptions=i}if(this._disposeLater(this._renderer,this._storage,e.parser.registerCsiHandler({prefix:"?",final:"h"},e=>this._decset(e)),e.parser.registerCsiHandler({prefix:"?",final:"l"},e=>this._decrst(e)),e.parser.registerCsiHandler({final:"c"},e=>this._da1(e)),e.parser.registerCsiHandler({prefix:"?",final:"S"},e=>this._xtermGraphicsAttributes(e)),e.onRender(e=>{var t;return null===(t=this._storage)||void 0===t?void 0:t.render(e)}),e.parser.registerCsiHandler({intermediates:"!",final:"p"},()=>this.reset()),e.parser.registerEscHandler({final:"c"},()=>this.reset()),e._core._inputHandler.onRequestReset(()=>this.reset()),e.buffer.onBufferChange(()=>{var e;return null===(e=this._storage)||void 0===e?void 0:e.wipeAlternate()}),e.onResize(e=>{var t;return null===(t=this._storage)||void 0===t?void 0:t.viewportResize(e)})),this._opts.sixelSupport){const t=new g.SixelImageStorage(this._storage,this._opts,this._renderer,e),i=new h.SixelHandler(this._opts,t,e);this._handlers.set("sixel",i),this._disposeLater(e._core._inputHandler._parser.registerDcsHandler({final:"q"},i))}if(this._opts.iipSupport){const t=new d.IIPImageStorage(this._storage),i=new s.IIPHandler(this._opts,this._renderer,t,e);this._handlers.set("iip",i),this._disposeLater(e._core._inputHandler._parser.registerOscHandler(1337,i))}if(this._opts.kittySupport){const t=new n.KittyImageStorage(this._storage),i=new a.KittyGraphicsHandler(this._opts,this._renderer,t,e);this._handlers.set("kitty",i),this._disposeLater(t,i,e._core._inputHandler._parser.registerApcHandler({final:"G"},i))}}reset(){var e;this._opts.sixelScrolling=this._defaultOpts.sixelScrolling,this._opts.sixelPaletteLimit=this._defaultOpts.sixelPaletteLimit,null===(e=this._storage)||void 0===e||e.reset();for(const e of this._handlers.values())e.reset();return!1}get storageLimit(){var e;return(null===(e=this._storage)||void 0===e?void 0:e.getLimit())||-1}set storageLimit(e){var t;null===(t=this._storage)||void 0===t||t.setLimit(e),this._opts.storageLimit=e}get storageUsage(){return this._storage?this._storage.getUsage():-1}get showPlaceholder(){return this._opts.showPlaceholder}set showPlaceholder(e){var t;this._opts.showPlaceholder=e,null===(t=this._renderer)||void 0===t||t.showPlaceholder(e)}getImageAtBufferCell(e,t){var i;return null===(i=this._storage)||void 0===i?void 0:i.getImageAtBufferCell(e,t)}extractTileAtBufferCell(e,t){var i;return null===(i=this._storage)||void 0===i?void 0:i.extractTileAtBufferCell(e,t)}_report(e){var t;null===(t=this._terminal)||void 0===t||t._core.input(e,!1)}_decset(e){for(let t=0;t<e.length;++t)80===e[t]&&(this._opts.sixelScrolling=!1);return!1}_decrst(e){for(let t=0;t<e.length;++t)80===e[t]&&(this._opts.sixelScrolling=!0);return!1}_da1(e){return!!e[0]||!!this._opts.sixelSupport&&(this._report("[?62;4;9;22c"),!0)}_xtermGraphicsAttributes(e){var t,i,A,s,r,a;if(e.length<2)return!0;if(1===e[0])switch(e[1]){case 1:return this._report(`[?${e[0]};0;${this._opts.sixelPaletteLimit}S`),!0;case 2:this._opts.sixelPaletteLimit=this._defaultOpts.sixelPaletteLimit,this._report(`[?${e[0]};0;${this._opts.sixelPaletteLimit}S`);for(const e of this._handlers.values())e.reset();return!0;case 3:return e.length>2&&!(e[2]instanceof Array)&&e[2]<=4096?(this._opts.sixelPaletteLimit=e[2],this._report(`[?${e[0]};0;${this._opts.sixelPaletteLimit}S`)):this._report(`[?${e[0]};2S`),!0;case 4:return this._report(`[?${e[0]};0;4096S`),!0;default:return this._report(`[?${e[0]};2S`),!0}if(2===e[0])switch(e[1]){case 1:let n=null===(i=null===(t=this._renderer)||void 0===t?void 0:t.dimensions)||void 0===i?void 0:i.css.canvas.width,h=null===(s=null===(A=this._renderer)||void 0===A?void 0:A.dimensions)||void 0===s?void 0:s.css.canvas.height;if(!n||!h){const e=o.CELL_SIZE_DEFAULT;n=((null===(r=this._terminal)||void 0===r?void 0:r.cols)||80)*e.width,h=((null===(a=this._terminal)||void 0===a?void 0:a.rows)||24)*e.height}if(n*h<this._opts.pixelLimit)this._report(`[?${e[0]};0;${n.toFixed(0)};${h.toFixed(0)}S`);else{const t=Math.floor(Math.sqrt(this._opts.pixelLimit));this._report(`[?${e[0]};0;${t};${t}S`)}return!0;case 4:const g=Math.floor(Math.sqrt(this._opts.pixelLimit));return this._report(`[?${e[0]};0;${g};${g}S`),!0;default:return this._report(`[?${e[0]};2S`),!0}return this._report(`[?${e[0]};1S`),!0}}})(),A})());
++!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.ImageAddon=t():e.ImageAddon=t()}(globalThis,()=>(()=>{"use strict";var e={939(e,t){function i(e){return 255&e}function A(e){return e>>>8&255}function s(e){return e>>>16&255}function r(e,t,i,A=255){return((255&A)<<24|(255&i)<<16|(255&t)<<8|255&e)>>>0}function o(e,t,i){return Math.max(e,Math.min(i,t))}function a(e,t,i){return i<0&&(i+=1),i>1&&(i-=1),6*i<1?t+6*(e-t)*i:2*i<1?e:3*i<2?t+(e-t)*(4-6*i):t}function n(e,t,i){return(4278190080|Math.round(i/100*255)<<16|Math.round(t/100*255)<<8|Math.round(e/100*255))>>>0}Object.defineProperty(t,"__esModule",{value:!0}),t.DEFAULT_FOREGROUND=t.DEFAULT_BACKGROUND=t.PALETTE_ANSI_256=t.PALETTE_VT340_GREY=t.PALETTE_VT340_COLOR=t.normalizeHLS=t.normalizeRGB=t.nearestColorIndex=t.fromRGBA8888=t.toRGBA8888=t.alpha=t.blue=t.green=t.red=t.BIG_ENDIAN=void 0,t.BIG_ENDIAN=255===new Uint8Array(new Uint32Array([4278190080]).buffer)[0],t.BIG_ENDIAN&&console.warn("BE platform detected. This version of node-sixel works only on LE properly."),t.red=i,t.green=A,t.blue=s,t.alpha=function(e){return e>>>24&255},t.toRGBA8888=r,t.fromRGBA8888=function(e){return[255&e,e>>8&255,e>>16&255,e>>>24]},t.nearestColorIndex=function(e,t){const r=i(e),o=A(e),a=s(e);let n=Number.MAX_SAFE_INTEGER,h=-1;for(let e=0;e<t.length;++e){const i=r-t[e][0],A=o-t[e][1],s=a-t[e][2],g=i*i+A*A+s*s;if(!g)return e;g<n&&(n=g,h=e)}return h},t.normalizeRGB=n,t.normalizeHLS=function(e,t,i){return function(e,t,i){if(!i){const e=Math.round(255*t);return r(e,e,e)}const A=t<.5?t*(1+i):t+i-t*i,s=2*t-A;return r(o(0,255,Math.round(255*a(A,s,e+1/3))),o(0,255,Math.round(255*a(A,s,e))),o(0,255,Math.round(255*a(A,s,e-1/3))))}((e+240)/360,t/100,i/100)},t.PALETTE_VT340_COLOR=new Uint32Array([n(0,0,0),n(20,20,80),n(80,13,13),n(20,80,20),n(80,20,80),n(20,80,80),n(80,80,20),n(53,53,53),n(26,26,26),n(33,33,60),n(60,26,26),n(33,60,33),n(60,33,60),n(33,60,60),n(60,60,33),n(80,80,80)]),t.PALETTE_VT340_GREY=new Uint32Array([n(0,0,0),n(13,13,13),n(26,26,26),n(40,40,40),n(6,6,6),n(20,20,20),n(33,33,33),n(46,46,46),n(0,0,0),n(13,13,13),n(26,26,26),n(40,40,40),n(6,6,6),n(20,20,20),n(33,33,33),n(46,46,46)]),t.PALETTE_ANSI_256=(()=>{const e=[r(0,0,0),r(205,0,0),r(0,205,0),r(205,205,0),r(0,0,238),r(205,0,205),r(0,250,205),r(229,229,229),r(127,127,127),r(255,0,0),r(0,255,0),r(255,255,0),r(92,92,255),r(255,0,255),r(0,255,255),r(255,255,255)],t=[0,95,135,175,215,255];for(let i=0;i<6;++i)for(let A=0;A<6;++A)for(let s=0;s<6;++s)e.push(r(t[i],t[A],t[s]));for(let t=8;t<=238;t+=10)e.push(r(t,t,t));return new Uint32Array(e)})(),t.DEFAULT_BACKGROUND=r(0,0,0,255),t.DEFAULT_FOREGROUND=r(255,255,255,255)},591(e,t,i){Object.defineProperty(t,"__esModule",{value:!0}),t.decodeAsync=t.decode=t.Decoder=t.DecoderAsync=void 0;const A=i(939),s=i(199),r=function(e){if("undefined"!=typeof Buffer)return Buffer.from(e,"base64");const t=atob(e),i=new Uint8Array(t.length);for(let e=0;e<i.length;++e)i[e]=t.charCodeAt(e);return i}(s.LIMITS.BYTES);let o;const a=new Uint32Array;class n{constructor(){this.bandHandler=e=>1,this.modeHandler=e=>1}handle_band(e){return this.bandHandler(e)}mode_parsed(e){return this.modeHandler(e)}}const h={memoryLimit:134217728,sixelColor:A.DEFAULT_FOREGROUND,fillColor:A.DEFAULT_BACKGROUND,palette:A.PALETTE_VT340_COLOR,paletteLimit:s.LIMITS.PALETTE_SIZE,truncate:!0};function g(e){const t=new n,i={env:{handle_band:t.handle_band.bind(t),mode_parsed:t.mode_parsed.bind(t)}};return WebAssembly.instantiate(o||r,i).then(i=>(o=o||i.module,new d(e,i.instance||i,t)))}t.DecoderAsync=g;class d{constructor(e,t,i){if(this._PIXEL_OFFSET=s.LIMITS.MAX_WIDTH+4,this._canvas=a,this._bandWidths=[],this._maxWidth=0,this._minWidth=s.LIMITS.MAX_WIDTH,this._lastOffset=0,this._currentHeight=0,this._opts=Object.assign({},h,e),this._opts.paletteLimit>s.LIMITS.PALETTE_SIZE)throw new Error(`DecoderOptions.paletteLimit must not exceed ${s.LIMITS.PALETTE_SIZE}`);if(t)i.bandHandler=this._handle_band.bind(this),i.modeHandler=this._initCanvas.bind(this);else{const e=o||(o=new WebAssembly.Module(r));t=new WebAssembly.Instance(e,{env:{handle_band:this._handle_band.bind(this),mode_parsed:this._initCanvas.bind(this)}})}this._instance=t,this._wasm=this._instance.exports,this._chunk=new Uint8Array(this._wasm.memory.buffer,this._wasm.get_chunk_address(),s.LIMITS.CHUNK_SIZE),this._states=new Uint32Array(this._wasm.memory.buffer,this._wasm.get_state_address(),12),this._palette=new Uint32Array(this._wasm.memory.buffer,this._wasm.get_palette_address(),s.LIMITS.PALETTE_SIZE),this._palette.set(this._opts.palette),this._pSrc=new Uint32Array(this._wasm.memory.buffer,this._wasm.get_p0_address()),this._wasm.init(A.DEFAULT_FOREGROUND,0,this._opts.paletteLimit,0)}get _fillColor(){return this._states[0]}get _truncate(){return this._states[8]}get _rasterWidth(){return this._states[6]}get _rasterHeight(){return this._states[7]}get _width(){return this._states[2]?this._states[2]-4:0}get _height(){return this._states[3]}get _level(){return this._states[9]}get _mode(){return this._states[10]}get _paletteLimit(){return this._states[11]}_initCanvas(e){if(2===e){const e=this.width*this.height;if(e>this._canvas.length){if(this._opts.memoryLimit&&4*e>this._opts.memoryLimit)throw this.release(),new Error("image exceeds memory limit");this._canvas=new Uint32Array(e)}this._maxWidth=this._width}else if(1===e)if(2===this._level){const e=Math.min(this._rasterWidth,s.LIMITS.MAX_WIDTH)*this._rasterHeight;if(e>this._canvas.length){if(this._opts.memoryLimit&&4*e>this._opts.memoryLimit)throw this.release(),new Error("image exceeds memory limit");this._canvas=new Uint32Array(e)}}else this._canvas.length<65536&&(this._canvas=new Uint32Array(65536));return 0}_realloc(e,t){const i=e+t;if(i>this._canvas.length){if(this._opts.memoryLimit&&4*i>this._opts.memoryLimit)throw this.release(),new Error("image exceeds memory limit");const e=new Uint32Array(65536*Math.ceil(i/65536));e.set(this._canvas),this._canvas=e}}_handle_band(e){const t=this._PIXEL_OFFSET;let i=this._lastOffset;if(2===this._mode){let A=this.height-this._currentHeight,s=0;for(;s<6&&A>0;)this._canvas.set(this._pSrc.subarray(t*s,t*s+e),i+e*s),s++,A--;this._lastOffset+=e*s,this._currentHeight+=s}else if(1===this._mode){this._realloc(i,6*e),this._maxWidth=Math.max(this._maxWidth,e),this._minWidth=Math.min(this._minWidth,e);for(let A=0;A<6;++A)this._canvas.set(this._pSrc.subarray(t*A,t*A+e),i+e*A);this._bandWidths.push(e),this._lastOffset+=6*e,this._currentHeight+=6}return 0}get width(){return 1!==this._mode?this._width:Math.max(this._maxWidth,this._wasm.current_width())}get height(){return 1!==this._mode?this._height:this._wasm.current_width()?6*this._bandWidths.length+this._wasm.current_height():6*this._bandWidths.length}get palette(){return this._palette.subarray(0,this._paletteLimit)}get memoryUsage(){return this._canvas.byteLength+this._wasm.memory.buffer.byteLength+8*this._bandWidths.length}get properties(){return{width:this.width,height:this.height,mode:this._mode,level:this._level,truncate:!!this._truncate,paletteLimit:this._paletteLimit,fillColor:this._fillColor,memUsage:this.memoryUsage,rasterAttributes:{numerator:this._states[4],denominator:this._states[5],width:this._rasterWidth,height:this._rasterHeight}}}init(e=this._opts.fillColor,t=this._opts.palette,i=this._opts.paletteLimit,A=this._opts.truncate){this._wasm.init(this._opts.sixelColor,e,i,A?1:0),t&&this._palette.set(t.subarray(0,s.LIMITS.PALETTE_SIZE)),this._bandWidths.length=0,this._maxWidth=0,this._minWidth=s.LIMITS.MAX_WIDTH,this._lastOffset=0,this._currentHeight=0}decode(e,t=0,i=e.length){let A=t;for(;A<i;){const t=Math.min(i-A,s.LIMITS.CHUNK_SIZE);this._chunk.set(e.subarray(A,A+=t)),this._wasm.decode(0,t)}}decodeString(e,t=0,i=e.length){let A=t;for(;A<i;){const t=Math.min(i-A,s.LIMITS.CHUNK_SIZE);for(let i=0,s=A;i<t;++i,++s)this._chunk[i]=e.charCodeAt(s);A+=t,this._wasm.decode(0,t)}}get data32(){if(0===this._mode||!this.width||!this.height)return a;const e=this._wasm.current_width();if(2===this._mode){let t=this.height-this._currentHeight;if(t>0){const i=this._PIXEL_OFFSET;let A=this._lastOffset,s=0;for(;s<6&&t>0;)this._canvas.set(this._pSrc.subarray(i*s,i*s+e),A+e*s),s++,t--;t&&this._canvas.fill(this._fillColor,A+e*s)}return this._canvas.subarray(0,this.width*this.height)}if(1===this._mode){if(this._minWidth===this._maxWidth){let t=!1;if(e)if(e!==this._minWidth)t=!0;else{const t=this._PIXEL_OFFSET;let i=this._lastOffset;this._realloc(i,6*e);for(let A=0;A<6;++A)this._canvas.set(this._pSrc.subarray(t*A,t*A+e),i+e*A)}if(!t)return this._canvas.subarray(0,this.width*this.height)}const t=new Uint32Array(this.width*this.height);t.fill(this._fillColor);let i=0,A=0;for(let e=0;e<this._bandWidths.length;++e){const s=this._bandWidths[e];for(let e=0;e<6;++e)t.set(this._canvas.subarray(A,A+=s),i),i+=this.width}if(e){const A=this._PIXEL_OFFSET,s=this._wasm.current_height();for(let r=0;r<s;++r)t.set(this._pSrc.subarray(A*r,A*r+e),i+this.width*r)}return t}return a}get data8(){return new Uint8ClampedArray(this.data32.buffer,0,this.width*this.height*4)}release(){this._canvas=a,this._bandWidths.length=0,this._maxWidth=0,this._minWidth=s.LIMITS.MAX_WIDTH,this._wasm.init(A.DEFAULT_FOREGROUND,0,this._opts.paletteLimit,0)}}t.Decoder=d,t.decode=function(e,t){const i=new d(t);return i.init(),"string"==typeof e?i.decodeString(e):i.decode(e),{width:i.width,height:i.height,data32:i.data32,data8:i.data8}},t.decodeAsync=async function(e,t){const i=await g(t);return i.init(),"string"==typeof e?i.decodeString(e):i.decode(e),{width:i.width,height:i.height,data32:i.data32,data8:i.data8}}},199(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.LIMITS=void 0,t.LIMITS={CHUNK_SIZE:16384,PALETTE_SIZE:4096,MAX_WIDTH:16384,BYTES:"AGFzbQEAAAABJAdgAAF/YAJ/fwBgA39/fwF/YAF/AX9gAABgBH9/f38AYAF/AAIlAgNlbnYLaGFuZGxlX2JhbmQAAwNlbnYLbW9kZV9wYXJzZWQAAwMTEgQAAAAAAQQBAQUBAAACAgAGAwQFAXABBwcFBAEBBwcGCAF/AUGAihoLB9wBDgZtZW1vcnkCABFnZXRfc3RhdGVfYWRkcmVzcwADEWdldF9jaHVua19hZGRyZXNzAAQOZ2V0X3AwX2FkZHJlc3MABRNnZXRfcGFsZXR0ZV9hZGRyZXNzAAYEaW5pdAALBmRlY29kZQAMDWN1cnJlbnRfd2lkdGgADQ5jdXJyZW50X2hlaWdodAAOGV9faW5kaXJlY3RfZnVuY3Rpb25fdGFibGUBAAtfaW5pdGlhbGl6ZQACCXN0YWNrU2F2ZQARDHN0YWNrUmVzdG9yZQASCnN0YWNrQWxsb2MAEwkMAQBBAQsGCgcJDxACDAEBCq5UEgMAAQsFAEGgCAsGAEGQiQELBgBBsIkCCwUAQZAJC+okAQh/QeQIKAIAIQVB4AgoAgAhA0HoCCgCACEIIAFBkIkBaiIJQf8BOgAAIAAgAUgEQCAAQZCJAWohBgNAIAMhBCAGQQFqIQECQCAGLQAAQf8AcSIDQTBrQQlLBEAgASEGDAELQewIKAIAQQJ0QewIaiICKAIAIQADQCACIAMgAEEKbGpBMGsiADYCACABLQAAIQMgAUEBaiIGIQEgA0H/AHEiA0Ewa0EKSQ0ACwsCQAJAAkACQAJAAkACQAJ/AkACQCADQT9rIgBBP00EQCAERQ0BIARBIUYEQAJAQfAIKAIAIgFBASABGyIHIAhqIgFB1AgoAgAiA0gNACADQf//AEoNAANAIANBAnQiAkGgiQJqIgRBoAgpAwA3AwAgAkGoiQJqQaAIKQMANwMAIAJBsIkCakGgCCkDADcDACACQbiJAmpBoAgpAwA3AwAgAkHAiQJqQaAIKQMANwMAIAJByIkCakGgCCkDADcDACACQdCJAmpBoAgpAwA3AwAgAkHYiQJqQaAIKQMANwMAIAJB4IkCakGgCCkDADcDACACQeiJAmpBoAgpAwA3AwAgAkHwiQJqQaAIKQMANwMAIAJB+IkCakGgCCkDADcDACACQYCKAmpBoAgpAwA3AwAgAkGIigJqQaAIKQMANwMAIAJBkIoCakGgCCkDADcDACACQZiKAmpBoAgpAwA3AwAgAkGgigJqQaAIKQMANwMAIAJBqIoCakGgCCkDADcDACACQbCKAmpBoAgpAwA3AwAgAkG4igJqQaAIKQMANwMAIAJBwIoCakGgCCkDADcDACACQciKAmpBoAgpAwA3AwAgAkHQigJqQaAIKQMANwMAIAJB2IoCakGgCCkDADcDACACQeCKAmpBoAgpAwA3AwAgAkHoigJqQaAIKQMANwMAIAJB8IoCakGgCCkDADcDACACQfiKAmpBoAgpAwA3AwAgAkGAiwJqQaAIKQMANwMAIAJBiIsCakGgCCkDADcDACACQZCLAmpBoAgpAwA3AwAgAkGYiwJqQaAIKQMANwMAIAJBoIsCakGgCCkDADcDACACQaiLAmpBoAgpAwA3AwAgAkGwiwJqQaAIKQMANwMAIAJBuIsCakGgCCkDADcDACACQcCLAmpBoAgpAwA3AwAgAkHIiwJqQaAIKQMANwMAIAJB0IsCakGgCCkDADcDACACQdiLAmpBoAgpAwA3AwAgAkHgiwJqQaAIKQMANwMAIAJB6IsCakGgCCkDADcDACACQfCLAmpBoAgpAwA3AwAgAkH4iwJqQaAIKQMANwMAIAJBgIwCakGgCCkDADcDACACQYiMAmpBoAgpAwA3AwAgAkGQjAJqQaAIKQMANwMAIAJBmIwCakGgCCkDADcDACACQaCMAmpBoAgpAwA3AwAgAkGojAJqQaAIKQMANwMAIAJBsIwCakGgCCkDADcDACACQbiMAmpBoAgpAwA3AwAgAkHAjAJqQaAIKQMANwMAIAJByIwCakGgCCkDADcDACACQdCMAmpBoAgpAwA3AwAgAkHYjAJqQaAIKQMANwMAIAJB4IwCakGgCCkDADcDACACQeiMAmpBoAgpAwA3AwAgAkHwjAJqQaAIKQMANwMAIAJB+IwCakGgCCkDADcDACACQYCNAmpBoAgpAwA3AwAgAkGIjQJqQaAIKQMANwMAIAJBkI0CakGgCCkDADcDACACQZiNAmpBoAgpAwA3AwAgAkGwiQZqIARBgAT8CgAAQdQIKAIAQQJ0QcCJCmogBEGABPwKAABB1AgoAgBBAnRB0IkOaiAEQYAE/AoAAEHUCCgCAEECdEHgiRJqIARBgAT8CgAAQdQIKAIAQQJ0QfCJFmogBEGABPwKAABB1AhB1AgoAgAiAkGAAWoiAzYCACABIANIDQEgAkGA/wBIDQALCwJAIABFDQAgCEH//wBLDQBBgIABIAhrIAcgAUH//wBLGyECAkAgAEEBcUUNACACRQ0AIAhBAnRBoIkCaiEDIAIhBCACQQdxIgcEQANAIAMgBTYCACADQQRqIQMgBEEBayEEIAdBAWsiBw0ACwsgAkEBa0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgBEEIayIEDQALCwJAIABBAnFFDQAgAkUNACAIQQJ0QbCJBmohAyACIQQgAkEHcSIHBEADQCADIAU2AgAgA0EEaiEDIARBAWshBCAHQQFrIgcNAAsLIAJBAWtBB0kNAANAIAMgBTYCHCADIAU2AhggAyAFNgIUIAMgBTYCECADIAU2AgwgAyAFNgIIIAMgBTYCBCADIAU2AgAgA0EgaiEDIARBCGsiBA0ACwsCQCAAQQRxRQ0AIAJFDQAgCEECdEHAiQpqIQMgAiEEIAJBB3EiBwRAA0AgAyAFNgIAIANBBGohAyAEQQFrIQQgB0EBayIHDQALCyACQQFrQQdJDQADQCADIAU2AhwgAyAFNgIYIAMgBTYCFCADIAU2AhAgAyAFNgIMIAMgBTYCCCADIAU2AgQgAyAFNgIAIANBIGohAyAEQQhrIgQNAAsLAkAgAEEIcUUNACACRQ0AIAhBAnRB0IkOaiEDIAIhBCACQQdxIgcEQANAIAMgBTYCACADQQRqIQMgBEEBayEEIAdBAWsiBw0ACwsgAkEBa0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgBEEIayIEDQALCwJAIABBEHFFDQAgAkUNACAIQQJ0QeCJEmohAyACIQQgAkEHcSIHBEADQCADIAU2AgAgA0EEaiEDIARBAWshBCAHQQFrIgcNAAsLIAJBAWtBB0kNAANAIAMgBTYCHCADIAU2AhggAyAFNgIUIAMgBTYCECADIAU2AgwgAyAFNgIIIAMgBTYCBCADIAU2AgAgA0EgaiEDIARBCGsiBA0ACwsgAEEgcUUNACACRQ0AIAJBAWshByAIQQJ0QfCJFmohAyACQQdxIgQEQANAIAMgBTYCACADQQRqIQMgAkEBayECIARBAWsiBA0ACwsgB0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgAkEIayICDQALC0HcCEHcCCgCACAAcjYCACAGQQFqIgIgBi0AAEH/AHEiA0E/ayIAQT9LDQQaDAMLAkBB7AgoAgAiBEEBRgRAQfAIKAIAIgNBzAgoAgAiAUkNASADIAFwIQMMAQtB+AgoAgAhAkH0CCgCACEBAkACQCAEQQVHDQAgAUEBRw0AIAJB6QJODQQMAQsgAkHkAEoNA0H8CCgCAEHkAEoNA0GACSgCAEHkAEoNAwsCQCABRQ0AIAFBAkoNACACQfwIKAIAQYAJKAIAIAFBAnRBiAhqKAIAEQIAIQFB8AgoAgAiA0HMCCgCACICTwR/IAMgAnAFIAMLQQJ0QZAJaiABNgIAC0HwCCgCACIDQcwIKAIAIgFJDQAgAyABcCEDCyADQQJ0QZAJaigCACEFDAELIANB/QBxQSFHBEAgCCEBIAYhAgwECyAEQSNHDQQCQEHsCCgCACICQQFGBEBB8AgoAgAiAUHMCCgCACIASQ0BIAEgAHAhAQwBC0H4CCgCACEBQfQIKAIAIQACQAJAIAJBBUcNACAAQQFHDQAgAUHpAkgNAQwHCyABQeQASg0GQfwIKAIAQeQASg0GQYAJKAIAQeQASg0GCwJAIABFDQAgAEECSg0AIAFB/AgoAgBBgAkoAgAgAEECdEGICGooAgARAgAhAEHwCCgCACIBQcwIKAIAIgJPBH8gASACcAUgAQtBAnRBkAlqIAA2AgALQfAIKAIAIgFBzAgoAgAiAEkNACABIABwIQELIAFBAnRBkAlqKAIAIQUMBAsgCCEBIAYhAgtB1AgoAgAhBgNAAkAgASAGSA0AIAZB//8ASg0AIAZBAnQiBEGgiQJqIgZBoAgpAwA3AwAgBEGoiQJqQaAIKQMANwMAIARBsIkCakGgCCkDADcDACAEQbiJAmpBoAgpAwA3AwAgBEHAiQJqQaAIKQMANwMAIARByIkCakGgCCkDADcDACAEQdCJAmpBoAgpAwA3AwAgBEHYiQJqQaAIKQMANwMAIARB4IkCakGgCCkDADcDACAEQeiJAmpBoAgpAwA3AwAgBEHwiQJqQaAIKQMANwMAIARB+IkCakGgCCkDADcDACAEQYCKAmpBoAgpAwA3AwAgBEGIigJqQaAIKQMANwMAIARBkIoCakGgCCkDADcDACAEQZiKAmpBoAgpAwA3AwAgBEGgigJqQaAIKQMANwMAIARBqIoCakGgCCkDADcDACAEQbCKAmpBoAgpAwA3AwAgBEG4igJqQaAIKQMANwMAIARBwIoCakGgCCkDADcDACAEQciKAmpBoAgpAwA3AwAgBEHQigJqQaAIKQMANwMAIARB2IoCakGgCCkDADcDACAEQeCKAmpBoAgpAwA3AwAgBEHoigJqQaAIKQMANwMAIARB8IoCakGgCCkDADcDACAEQfiKAmpBoAgpAwA3AwAgBEGAiwJqQaAIKQMANwMAIARBiIsCakGgCCkDADcDACAEQZCLAmpBoAgpAwA3AwAgBEGYiwJqQaAIKQMANwMAIARBoIsCakGgCCkDADcDACAEQaiLAmpBoAgpAwA3AwAgBEGwiwJqQaAIKQMANwMAIARBuIsCakGgCCkDADcDACAEQcCLAmpBoAgpAwA3AwAgBEHIiwJqQaAIKQMANwMAIARB0IsCakGgCCkDADcDACAEQdiLAmpBoAgpAwA3AwAgBEHgiwJqQaAIKQMANwMAIARB6IsCakGgCCkDADcDACAEQfCLAmpBoAgpAwA3AwAgBEH4iwJqQaAIKQMANwMAIARBgIwCakGgCCkDADcDACAEQYiMAmpBoAgpAwA3AwAgBEGQjAJqQaAIKQMANwMAIARBmIwCakGgCCkDADcDACAEQaCMAmpBoAgpAwA3AwAgBEGojAJqQaAIKQMANwMAIARBsIwCakGgCCkDADcDACAEQbiMAmpBoAgpAwA3AwAgBEHAjAJqQaAIKQMANwMAIARByIwCakGgCCkDADcDACAEQdCMAmpBoAgpAwA3AwAgBEHYjAJqQaAIKQMANwMAIARB4IwCakGgCCkDADcDACAEQeiMAmpBoAgpAwA3AwAgBEHwjAJqQaAIKQMANwMAIARB+IwCakGgCCkDADcDACAEQYCNAmpBoAgpAwA3AwAgBEGIjQJqQaAIKQMANwMAIARBkI0CakGgCCkDADcDACAEQZiNAmpBoAgpAwA3AwAgBEGwiQZqIAZBgAT8CgAAQdQIKAIAQQJ0QcCJCmogBkGABPwKAABB1AgoAgBBAnRB0IkOaiAGQYAE/AoAAEHUCCgCAEECdEHgiRJqIAZBgAT8CgAAQdQIKAIAQQJ0QfCJFmogBkGABPwKAABB1AhB1AgoAgBBgAFqIgY2AgALIAFB//8ATQRAIABBAXEgAWxBAnRBoIkCaiAFNgIAIABBAXZBAXEgAWxBAnRBsIkGaiAFNgIAIABBAnZBAXEgAWxBAnRBwIkKaiAFNgIAIABBA3ZBAXEgAWxBAnRB0IkOaiAFNgIAIABBBHZBAXEgAWxBAnRB4IkSaiAFNgIAIABBBXYgAWxBAnRB8IkWaiAFNgIAQdQIKAIAIQYLIAFBAWohAUHcCEHcCCgCACAAcjYCACACLQAAIQAgAkEBaiIEIQIgAEH/AHEiA0E/ayIAQcAASQ0ACyAECyECQQAhBCACIQYgASEIIANB/QBxQSFGDQELIANBJGsOCgEDAwMDAwMDAwIDC0HsCEIBNwIADAQLQdgIIAFB2AgoAgAiACAAIAFIGyIAQYCAASAAQYCAAUgbNgIADAILQegIIAFB2AgoAgAiACAAIAFIGyIAQYCAASAAQYCAAUgbIgA2AgBB2AggADYCACAAQQRrEAAEQEHoCEEENgIAQdgIQQQ2AgBB0AhBATYCAA8LEAgMAQsCQCADQTtHDQBB7AgoAgAiAEEHSg0AQewIIABBAWo2AgAgAEECdEHwCGpBADYCAAsgAiEGIAQhAyABIQgMAQtBBCEIIAIhBiAEIQMLIAYgCUkNAAsLQeQIIAU2AgBB4AggAzYCAEHoCCAINgIAC9ELAgF+CH9B2AhCBDcDAEGojQJBoAgpAwAiADcDAEGgjQIgADcDAEGYjQIgADcDAEGQjQIgADcDAEGIjQIgADcDAEGAjQIgADcDAEH4jAIgADcDAEHwjAIgADcDAEHojAIgADcDAEHgjAIgADcDAEHYjAIgADcDAEHQjAIgADcDAEHIjAIgADcDAEHAjAIgADcDAEG4jAIgADcDAEGwjAIgADcDAEGojAIgADcDAEGgjAIgADcDAEGYjAIgADcDAEGQjAIgADcDAEGIjAIgADcDAEGAjAIgADcDAEH4iwIgADcDAEHwiwIgADcDAEHoiwIgADcDAEHgiwIgADcDAEHYiwIgADcDAEHQiwIgADcDAEHIiwIgADcDAEHAiwIgADcDAEG4iwIgADcDAEGwiwIgADcDAEGoiwIgADcDAEGgiwIgADcDAEGYiwIgADcDAEGQiwIgADcDAEGIiwIgADcDAEGAiwIgADcDAEH4igIgADcDAEHwigIgADcDAEHoigIgADcDAEHgigIgADcDAEHYigIgADcDAEHQigIgADcDAEHIigIgADcDAEHAigIgADcDAEG4igIgADcDAEGwigIgADcDAEGoigIgADcDAEGgigIgADcDAEGYigIgADcDAEGQigIgADcDAEGIigIgADcDAEGAigIgADcDAEH4iQIgADcDAEHwiQIgADcDAEHoiQIgADcDAEHgiQIgADcDAEHYiQIgADcDAEHQiQIgADcDAEHIiQIgADcDAEHAiQIgADcDAEG4iQIgADcDAEGwiQIgADcDAEGoCCgCACIEQf8AakGAAW0hCAJAIARBgQFIDQBBASEBIAhBAiAIQQJKG0EBayICQQFxIQMgBEGBAk4EQCACQX5xIQIDQCABQQl0IgdBEHJBoIkCakGwiQJBgAT8CgAAIAdBsI0CakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsLIANFDQAgAUEJdEEQckGgiQJqQbCJAkGABPwKAAALAkAgBEEBSA0AIAhBASAIQQFKGyIDQQFxIQUCQCADQQFrIgdFBEBBACEBDAELIANB/v///wdxIQJBACEBA0AgAUEJdCIGQRByQbCJBmpBsIkCQYAE/AoAACAGQZAEckGwiQZqQbCJAkGABPwKAAAgAUECaiEBIAJBAmsiAg0ACwsgBQRAIAFBCXRBEHJBsIkGakGwiQJBgAT8CgAACyAEQQFIDQAgA0EBcSEFIAcEfyADQf7///8HcSECQQAhAQNAIAFBCXQiBkEQckHAiQpqQbCJAkGABPwKAAAgBkGQBHJBwIkKakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsgAUEHdEEEcgVBBAshASAFBEAgAUECdEHAiQpqQbCJAkGABPwKAAALIARBAUgNACADQQFxIQUgBwR/IANB/v///wdxIQJBACEBA0AgAUEJdCIGQRByQdCJDmpBsIkCQYAE/AoAACAGQZAEckHQiQ5qQbCJAkGABPwKAAAgAUECaiEBIAJBAmsiAg0ACyABQQd0QQRyBUEECyEBIAUEQCABQQJ0QdCJDmpBsIkCQYAE/AoAAAsgBEEBSA0AIANBAXEhBSAHBH8gA0H+////B3EhAkEAIQEDQCABQQl0IgZBEHJB4IkSakGwiQJBgAT8CgAAIAZBkARyQeCJEmpBsIkCQYAE/AoAACABQQJqIQEgAkECayICDQALIAFBB3RBBHIFQQQLIQEgBQRAIAFBAnRB4IkSakGwiQJBgAT8CgAACyAEQQFIDQAgA0EBcSEEIAcEfyADQf7///8HcSECQQAhAQNAIAFBCXQiA0EQckHwiRZqQbCJAkGABPwKAAAgA0GQBHJB8IkWakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsgAUEHdEEEcgVBBAshASAERQ0AIAFBAnRB8IkWakGwiQJBgAT8CgAAC0HUCCAIQQd0QQRyNgIAC58TAgh/AX5B5AgoAgAhA0HgCCgCACECQegIKAIAIQcgAUGQiQFqIglB/wE6AAAgACABSARAIABBkIkBaiEIA0AgAiEEIAhBAWohAQJAIAgtAABB/wBxIgJBMGtBCUsEQCABIQgMAQtB7AgoAgBBAnRB7AhqIgUoAgAhAANAIAUgAiAAQQpsakEwayIANgIAIAEtAAAhAiABQQFqIgghASACQf8AcSICQTBrQQpJDQALCwJAAkACQAJAAkACQAJ/AkAgAkE/ayIAQT9NBEAgBEUNASAEQSFGBEBB8AgoAgAiAUEBIAEbIgQgB2ohAQJAIABFDQAgB0H//wBLDQBBgIABIAdrIAQgAUH//wBLGyEFAkAgAEEBcUUNACAHQQJ0QaCJAmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEECcUUNACAHQQJ0QbCJBmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEEcUUNACAHQQJ0QcCJCmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEIcUUNACAHQQJ0QdCJDmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEQcUUNACAHQQJ0QeCJEmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLIABBIHFFDQAgBUEBayEEIAdBAnRB8IkWaiEAIAVBB3EiAgRAA0AgACADNgIAIABBBGohACAFQQFrIQUgAkEBayICDQALCyAEQQdJDQADQCAAIAM2AhwgACADNgIYIAAgAzYCFCAAIAM2AhAgACADNgIMIAAgAzYCCCAAIAM2AgQgACADNgIAIABBIGohACAFQQhrIgUNAAsLIAhBAWoiBSAILQAAQf8AcSICQT9rIgBBP00NAxoMBAsCQEHsCCgCACIFQQFGBEBB8AgoAgAiAUHMCCgCACIESQ0BIAEgBHAhAQwBC0H4CCgCACEEQfQIKAIAIQECQAJAIAVBBUcNACABQQFHDQAgBEHpAk4NBAwBCyAEQeQASg0DQfwIKAIAQeQASg0DQYAJKAIAQeQASg0DCwJAIAFFDQAgAUECSg0AIARB/AgoAgBBgAkoAgAgAUECdEGICGooAgARAgAhBEHwCCgCACIBQcwIKAIAIgVPBH8gASAFcAUgAQtBAnRBkAlqIAQ2AgALQfAIKAIAIgFBzAgoAgAiBEkNACABIARwIQELIAFBAnRBkAlqKAIAIQMMAQsgAkH9AHFBIUcEQCAHIQEgAiEADAQLIARBI0cNBAJAQewIKAIAIgRBAUYEQEHwCCgCACIBQcwIKAIAIgBJDQEgASAAcCEBDAELQfgIKAIAIQFB9AgoAgAhAAJAAkAgBEEFRw0AIABBAUcNACABQekCSA0BDAcLIAFB5ABKDQZB/AgoAgBB5ABKDQZBgAkoAgBB5ABKDQYLAkAgAEUNACAAQQJKDQAgAUH8CCgCAEGACSgCACAAQQJ0QYgIaigCABECACEAQfAIKAIAIgFBzAgoAgAiBE8EfyABIARwBSABC0ECdEGQCWogADYCAAtB8AgoAgAiAUHMCCgCACIASQ0AIAEgAHAhAQsgAUECdEGQCWooAgAhAwwECyAHIQEgCAshBQNAIAFB//8ATQRAIABBAXEgAWxBAnRBoIkCaiADNgIAIABBAXZBAXEgAWxBAnRBsIkGaiADNgIAIABBAnZBAXEgAWxBAnRBwIkKaiADNgIAIABBA3ZBAXEgAWxBAnRB0IkOaiADNgIAIABBBHZBAXEgAWxBAnRB4IkSaiADNgIAIABBBXYgAWxBAnRB8IkWaiADNgIACyABQQFqIQEgBS0AACEAIAVBAWoiBCEFIABB/wBxIgJBP2siAEHAAEkNAAsgBCEFC0EAIQQgBSEIIAEhByACIQAgAkH9AHFBIUYNAQtBBCEHIAQhAiAAQSRrDgoDAgICAgICAgIBAgtB7AhCATcCAAwCC0GoCCgCAEEEaxAABEBB0AhBATYCAA8LAkBBqAgoAgAiBkEFSA0AQaAIKQMAIQogBkEDa0EBdiIBQQdxIQJBACEAIAFBAWtBB08EQCABQfj///8HcSEFA0AgAEEDdCIBQbCJAmogCjcDACABQQhyQbCJAmogCjcDACABQRByQbCJAmogCjcDACABQRhyQbCJAmogCjcDACABQSByQbCJAmogCjcDACABQShyQbCJAmogCjcDACABQTByQbCJAmogCjcDACABQThyQbCJAmogCjcDACAAQQhqIQAgBUEIayIFDQALCyACRQ0AA0AgAEEDdEGwiQJqIAo3AwAgAEEBaiEAIAJBAWsiAg0ACwtBwIkGQbCJAiAGQQJ0IgD8CgAAQdCJCkGwiQIgAPwKAABB4IkOQbCJAiAA/AoAAEHwiRJBsIkCIAD8CgAAQYCKFkGwiQIgAPwKAAAgBCECDAELAkAgAEE7Rw0AQewIKAIAIgBBB0oNAEHsCCAAQQFqNgIAIABBAnRB8AhqQQA2AgALIAEhBwsgCCAJSQ0ACwtB5AggAzYCAEHgCCACNgIAQegIIAc2AgAL4gcCBX8BfgJAQdAIAn8CQAJAIAAgAU4NACABQZCJAWohBiAAQZCJAWohBQNAIAUtAAAiA0H/AHEhAgJAAkACQAJAAkACQAJAQeAIKAIAIgRBIkcEQCAEDQcgAkEiRgRAQewIQgE3AgBB4AhBIjYCAAwICyACQT9rQcAASQ0GIANBIWsiAkEMTQ0BDAULAkAgAkEwayIEQQlNBEBB7AgoAgBBAnRB7AhqIgIgBCACKAIAQQpsajYCAAwBC0HsCCgCACEEIAJBO0YEQCAEQQdKDQFB7AggBEEBajYCACAEQQJ0QfAIakEANgIADAELIARBBEYEQEHECEECNgIAQbAIQfAIKQMANwMAQbgIQfgIKAIAIgI2AgBBvAhB/AgoAgAiBDYCAEHICEECQQFBwAgoAgAiAxs2AgBBrAggBEEAIAMbNgIAQagIIAJBgIABIAJBgIABSBtBBGpBACADGzYCAEHgCEEANgIADAoLIAJBP2tBwABJDQQLIANBIWsiAkEMTQ0BDAILQQEgAnRBjSBxRQ0DDAQLQQEgAnRBjSBxDQELIANBoQFrIgJBDEsNA0EBIAJ0QY0gcUUNAwtBxAhCgYCAgBA3AgBBsAhB8AgoAgBBAEHsCCgCACICQQBKGzYCAEG0CEH0CCgCAEEAIAJBAUobNgIAQbgIQfgIKAIAQQAgAkECShs2AgBB4AhBADYCAEG8CEEANgIADAQLIANBoQFrIgJBDEsNAUEBIAJ0QY0gcUUNAQtBxAhCgYCAgBA3AgBBsAhCADcDAEG4CEIANwMADAMLIAVBAWoiBSAGSQ0ACwsCQEHICCgCAA4DAwEAAQsCQEGoCCgCACIFQQVIDQBBoAgpAwAhByAFQQNrQQF2IgNBB3EhBEEAIQIgA0EBa0EHTwRAIANB+P///wdxIQYDQCACQQN0IgNBsIkCaiAHNwMAIANBCHJBsIkCaiAHNwMAIANBEHJBsIkCaiAHNwMAIANBGHJBsIkCaiAHNwMAIANBIHJBsIkCaiAHNwMAIANBKHJBsIkCaiAHNwMAIANBMHJBsIkCaiAHNwMAIANBOHJBsIkCaiAHNwMAIAJBCGohAiAGQQhrIgYNAAsLIARFDQADQCACQQN0QbCJAmogBzcDACACQQFqIQIgBEEBayIEDQALC0HAiQZBsIkCIAVBAnQiA/wKAABB0IkKQbCJAiAD/AoAAEHgiQ5BsIkCIAP8CgAAQfCJEkGwiQIgA/wKAABBgIoWQbCJAiAD/AoAAEECDAELEAhByAgoAgALEAEiAjYCACACDQAgACABQcgIKAIAQQJ0QYAIaigCABEBAAsLdABB6AhBBDYCAEHkCCAANgIAQewIQgE3AgBBxAhCADcCAEHACCADNgIAQdwIQgA3AgBBqAhCADcDAEGwCEIANwMAQbgIQgA3AwBBzAggAkGAICACQYAgSRs2AgBBoAggAa1CgYCAgBB+NwMAQdAIQQA2AgALIwBB0AgoAgBFBEAgACABQcgIKAIAQQJ0QYAIaigCABEBAAsLWgECfwJAAkACQEHICCgCAEEBaw4CAAECC0HYCEHoCCgCACIAQdgIKAIAIgEgACABShsiAEGAgAEgAEGAgAFIGyIANgIAIABBBGsPC0GoCCgCAEEEayEACyAAC0IBAX8Cf0EGQdwIKAIAIgBBIHENABpBBSAAQRBxDQAaQQQgAEEIcQ0AGkEDIABBBHENABpBAiAAQQFxIABBAnEbCwu9BQEFfQJ/IAJFBEAgAUH/AWxBMmpB5ABtIgBBCHQgAHIgAEEQdHIMAQsgArJDAADIQpUhBiAAQfABarJDAAC0Q5UhBQJ9IAGyQwAAyEKVIgNDAAAAP10EQCADIAZDAACAP5KUDAELIAYgA0MAAIA/IAaTlJILIQcgAyADkiEGAkAgBUOrqqo+kiIEQwAAAABdBEAgBEMAAIA/kiEEDAELIARDAACAP15FDQAgBEMAAIC/kiEECyAGIAeTIQMgBUMAAAAAXSEAAn8CfSADIAcgA5NDAADAQJQgBJSSIARDq6oqPl0NABogByAEQwAAAD9dDQAaIAMgBEOrqio/XUUNABogAyAHIAOTIARDAADAwJRDAACAQJKUkgtDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALIQECQCAABEAgBUMAAIA/kiEEDAELIAUiBEMAAIA/XkUNACAFQwAAgL+SIQQLIAVDq6qqvpIiBUMAAAAAXSECAn8CfSADIAcgA5NDAADAQJQgBJSSIARDq6oqPl0NABogByAEQwAAAD9dDQAaIAMgBEOrqio/XUUNABogAyAHIAOTIARDAADAwJRDAACAQJKUkgtDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALIQACQCACBEAgBUMAAIA/kiEFDAELIAVDAACAP15FDQAgBUMAAIC/kiEFCwJAIAVDq6oqPl0EQCADIAcgA5NDAADAQJQgBZSSIQcMAQsgBUMAAAA/XQ0AIAVDq6oqP11FBEAgAyEHDAELIAMgByADkyAFQwAAwMCUQwAAgECSlJIhBwsgAEEIdAJ/IAdDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALQRB0ciABcgtBgICAeHILNwAgAEH/AWxBMmpB5ABtIAFB/wFsQTJqQeQAbUEIdHIgAkH/AWxBMmpB5ABtQRB0ckGAgIB4cgsEACMACwYAIAAkAAsQACMAIABrQXBxIgAkACAACwsYAQBBgAgLEQEAAAACAAAAAwAAAAQAAAAF"}},414(e,t,i){Object.defineProperty(t,"__esModule",{value:!0}),t.EventUtils=t.Emitter=void 0;const A=i(426);var s;t.Emitter=class{constructor(){this._listeners=[],this._disposed=!1}get event(){return this._event||(this._event=(e,t,i)=>{if(this._disposed)return(0,A.toDisposable)(()=>{});const s={fn:e,thisArgs:t};this._listeners=this._listeners.slice(),this._listeners.push(s);const r=(0,A.toDisposable)(()=>{const e=this._listeners.indexOf(s);-1!==e&&(this._listeners=this._listeners.slice(),this._listeners.splice(e,1))});return i&&(Array.isArray(i)?i.push(r):i.add(r)),r}),this._event}fire(e){if(this._disposed||!this._listeners.length)return;if(1===this._listeners.length)return void this._listeners[0].fn.call(this._listeners[0].thisArgs,e);const t=this._listeners;for(let i=0,A=t.length;i<A;++i)t[i].fn.call(t[i].thisArgs,e)}dispose(){this._disposed||(this._disposed=!0,this._listeners.length=0)}},function(e){e.forward=function(e,t){return e(e=>t.fire(e))},e.map=function(e,t){return(i,A,s)=>e(e=>i.call(A,t(e)),void 0,s)},e.any=function(...e){return(t,i,s)=>{const r=new A.DisposableStore;for(const A of e)r.add(A(e=>t.call(i,e)));return s&&(Array.isArray(s)?s.push(r):s.add(r)),r}},e.runAndSubscribe=function(e,t,i){return t(i),e(e=>t(e))}}(s||(t.EventUtils=s={}))},426(e,t){function i(e){return{dispose:e}}function A(e){if(!e)return e;if(Array.isArray(e)){for(const t of e)t.dispose();return[]}return e.dispose(),e}Object.defineProperty(t,"__esModule",{value:!0}),t.MutableDisposable=t.Disposable=t.DisposableStore=void 0,t.toDisposable=i,t.dispose=A,t.combinedDisposable=function(...e){return i(()=>A(e))};class s{constructor(){this._disposables=new Set,this._isDisposed=!1}get isDisposed(){return this._isDisposed}add(e){return this._isDisposed?e.dispose():this._disposables.add(e),e}dispose(){if(!this._isDisposed){this._isDisposed=!0;for(const e of this._disposables)e.dispose();this._disposables.clear()}}clear(){for(const e of this._disposables)e.dispose();this._disposables.clear()}}t.DisposableStore=s;class r{constructor(){this._store=new s}dispose(){this._store.dispose()}_register(e){return this._store.add(e)}}t.Disposable=r,r.None=Object.freeze({dispose(){}}),t.MutableDisposable=class{constructor(){this._isDisposed=!1}get value(){return this._isDisposed?void 0:this._value}set value(e){this._isDisposed||e===this._value||(this._value?.dispose(),this._value=e)}clear(){this.value=void 0}dispose(){this._isDisposed=!0,this._value?.dispose(),this._value=void 0}}},795(e,t,i){var A=this&&this.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.IIPHandler=void 0;const s=i(463),r=i(699),o=A(i(669)),a=A(i(61)),n=i(389),h=i(462),g={type:0,name:"Unnamed file",size:0,width:"auto",height:"auto",preserveAspectRatio:1,inline:0};t.IIPHandler=class{constructor(e,t,i,A){this._opts=e,this._renderer=t,this._storage=i,this._coreTerminal=A,this._generation=0,this._aborted=!1,this._hp=new n.HeaderParser,this._header=g,this._isMultipart=!1,this._abortMulti=!1;const s=Math.ceil(4*this._opts.iipSizeLimit/3),r=Math.min(1048576,s);this._dec=new o.default(0,s,r),this._qoiDec=new a.default(0)}reset(){this._generation++,this._hp.reset(),this._dec.release(),this._qoiDec.release()}start(){this._aborted=!1,this._hp.reset()}put(e,t,i){if(!this._aborted)if(4===this._hp.state)0!==this._dec.put(e.subarray(t,i))&&(this._dec.release(),this._aborted=!0);else{const A=this._hp.parse(e,t,i);if(-1===A)return void(this._aborted=!0);if(A>0){if(1===this._hp.fields.type){if(this._isMultipart&&(this._isMultipart=!1,this._abortMulti=!1,this._dec.release()),this._header=Object.assign({},g,this._hp.fields),!this._header.inline)return void(this._aborted=!0);if(!this._initDecoder())return void(this._aborted=!0)}else if(this._abortMulti)return void(this._aborted=!0);0!==this._dec.put(e.subarray(A,i))&&(this._dec.release(),this._aborted=!0,this._isMultipart&&(this._abortMulti=!0))}}}end(e){var t,i,A;if(this._aborted)return!0;if(4!==this._hp.state&&this._hp.end())return!0;const o=this._hp.fields.type;if(3===o)return!0;if(5===o){let e=r.CELL_SIZE_DEFAULT.width,i=r.CELL_SIZE_DEFAULT.height;this._renderer.dimensions&&(e=this._renderer.dimensions.css.canvas.width/this._coreTerminal.cols,i=this._renderer.dimensions.css.canvas.height/this._coreTerminal.rows);const s=null!==(A=null===(t=this._coreTerminal._core._coreBrowserService)||void 0===t?void 0:t.dpr)&&void 0!==A?A:1,o=`]1337;ReportCellSize=${i.toFixed(3)};${e.toFixed(3)};${s.toFixed(3)}\\`;return this._coreTerminal.input(o,!1),!0}if(2===o)return this._header=Object.assign({},g,this._hp.fields),this._isMultipart=!0,this._abortMulti=!1,this._dec.release(),this._initDecoder()||(this._abortMulti=!0),!0;if(4===o){if(!this._isMultipart)return!0;if(this._isMultipart=!1,this._abortMulti||2!==this._header.type)return!0}let a,n,d=0,l=0,I=h.UNSUPPORTED_TYPE;if((a=e)&&((a=!this._dec.end())?(I=(0,h.imageType)(this._dec.data8),(a="unsupported"!==I.mime)?(d=I.width,l=I.height,(a=d&&l&&d*l<this._opts.pixelLimit)?([d,l]=this._resize(d,l).map(Math.floor),a=d&&l&&d*l<this._opts.pixelLimit):console.warn(`IIP: image dimension issue ${I.width}x${I.height}`)):console.warn("IIP: unsupported image type")):console.warn("IIP: error during BASE64 decoding")),!a)return this._dec.release(),!0;if("image/qoi"===I.mime){let e;try{e=this._qoiDec.decode(this._dec.data8)}catch(e){return console.warn("IIP: could not decode QOI image",e),this._dec.release(),this._qoiDec.release(),!0}if(n=new ImageData(new Uint8ClampedArray(e.buffer,e.byteOffset,e.byteLength),this._qoiDec.width,this._qoiDec.height),this._qoiDec.release(),d===this._qoiDec.width&&l===this._qoiDec.height){this._dec.release();const e=s.ImageRenderer.createCanvas(void 0,this._qoiDec.width,this._qoiDec.height);return null===(i=e.getContext("2d"))||void 0===i||i.putImageData(n,0,0),this._storage.addImage(e),!0}}else n=new Blob([this._dec.data8],{type:I.mime});this._dec.release();const c=this._generation;return createImageBitmap(n,{resizeWidth:d,resizeHeight:l}).then(e=>c!==this._generation?(e.close(),!0):(this._storage.addImage(e),!0)).catch(e=>(console.warn(`IIP: decoding error ${I.mime} ${I.width}x${I.height}`,e),!0))}_initDecoder(){try{return this._dec.init(),!0}catch(e){return console.warn("IIP: could not allocate decoder",e),this._dec.release(),!1}}_resize(e,t){var i,A,s,o;const a=(null===(i=this._renderer.dimensions)||void 0===i?void 0:i.css.cell.width)||r.CELL_SIZE_DEFAULT.width,n=(null===(A=this._renderer.dimensions)||void 0===A?void 0:A.css.cell.height)||r.CELL_SIZE_DEFAULT.height,h=(null===(s=this._renderer.dimensions)||void 0===s?void 0:s.css.canvas.width)||a*this._coreTerminal.cols,g=(null===(o=this._renderer.dimensions)||void 0===o?void 0:o.css.canvas.height)||n*this._coreTerminal.rows,d=this._dim(this._header.width,h,a),l=this._dim(this._header.height,g,n);if(!d&&!l){const i=h/e,A=(g-n)/t,s=Math.min(i,A);return s<1?[e*s,t*s]:[e,t]}return d?!this._header.preserveAspectRatio&&d&&l?[d,l]:[d,t*d/e]:[e*l/t,l]}_dim(e,t,i){return"auto"===e?0:e.endsWith("%")?parseInt(e.slice(0,-1),10)*t/100:e.endsWith("px")?parseInt(e.slice(0,-2),10):parseInt(e,10)*i}}},389(e,t){function i(e){let t="";for(let i=0;i<e.length;++i)t+=String.fromCharCode(e[i]);return t}function A(e){let t=0;for(let i=0;i<e.length;++i){if(e[i]<48||e[i]>57)throw new Error("illegal char");t=10*t+e[i]-48}return t}function s(e){const t=i(e);if(!t.match(/^((auto)|(\d+?((px)|(%)){0,1}))$/))throw new Error("illegal size");return t}Object.defineProperty(t,"__esModule",{value:!0}),t.HeaderParser=void 0;const r={inline:A,size:A,name:function(e){if("undefined"!=typeof Buffer)return Buffer.from(i(e),"base64").toString();const t=atob(i(e)),A=new Uint8Array(t.length);for(let e=0;e<A.length;++e)A[e]=t.charCodeAt(e);return(new TextDecoder).decode(A)},width:s,height:s,preserveAspectRatio:A},o=[70,105,108,101],a=[77,117,108,116,105,112,97,114,116,70,105,108,101],n=[70,105,108,101,80,97,114,116],h=[70,105,108,101,69,110,100],g=[82,101,112,111,114,116,67,101,108,108,83,105,122,101],d=1024;t.HeaderParser=class{constructor(){this.state=0,this._buffer=new Uint32Array(d),this._position=0,this._key="",this.fields={}}reset(){this._buffer.fill(0),this.state=0,this._position=0,this.fields={},this._key=""}end(){if(0===this.state){if(this._position===h.length){for(let e=0;e<h.length;++e)if(this._buffer[e]!==h[e])return this._a();return this.fields.type=4,this.state=4,0}if(this._position===g.length){for(let e=0;e<g.length;++e)if(this._buffer[e]!==g[e])return this._a();return this.fields.type=5,this.state=4,0}return this._a()}return 4===this.state?0:3===this.state&&2===this.fields.type&&this._storeValue(this._position)?(this.state=4,0):this._a()}parse(e,t,i){let A=this.state,s=this._position;const r=this._buffer;if(1===A||4===A)return-1;if(0===A&&s>14)return-1;for(let h=t;h<i;++h){const t=e[h];switch(t){case 59:if(!this._storeValue(s))return this._a();A=2,s=0;break;case 61:if(0===A){if(70===r[0]){let e=0;for(;e<o.length;++e)if(r[e]!==o[e])return this._a();if(this.fields.type=1,s===n.length){for(;e<n.length;++e)if(r[e]!==n[e])return this._a();return this.fields.type=3,this.state=4,h+1}}else{if(77!==r[0])return this._a();for(let e=0;e<a.length;++e)if(r[e]!==a[e])return this._a();this.fields.type=2}A=2,s=0}else if(2===A){if(!this._storeKey(s))return this._a();A=3,s=0}else if(3===A){if(s>=d)return this._a();r[s++]=t}break;case 58:return 3!==A||this._storeValue(s)?(this.state=4,h+1):this._a();default:if(s>=d)return this._a();r[s++]=t}}return this.state=A,this._position=s,-2}_a(){return this.fields.type=0,this.state=1,-1}_storeKey(e){const t=i(this._buffer.subarray(0,e));return!!t&&(this._key=t,this.fields[t]=null,!0)}_storeValue(e){if(this._key){try{const t=this._buffer.slice(0,e);this.fields[this._key]=r[this._key]?r[this._key](t):t}catch(e){return!1}return!0}return!1}}},649(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.IIPImageStorage=void 0,t.IIPImageStorage=class{constructor(e){this._storage=e,this._addImageOpts={scrolling:!0,layer:"top",zIndex:0,cursorPos:"iip"}}addImage(e){this._storage.addImage(e,this._addImageOpts)}}},462(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.UNSUPPORTED_TYPE=void 0,t.imageType=function(e){if(e.length<32)return t.UNSUPPORTED_TYPE;const i=new Uint32Array(e.buffer,e.byteOffset,8);if(1196314761===i[0]&&169478669===i[1]&&1380206665===i[3])return{mime:"image/png",width:e[16]<<24|e[17]<<16|e[18]<<8|e[19],height:e[20]<<24|e[21]<<16|e[22]<<8|e[23]};if(255===e[0]&&216===e[1]&&255===e[2]){const[t,i]=function(e){const t=e.length;let i=4,A=e[i]<<8|e[i+1];for(;;){if(i+=A,i>=t)return[0,0];if(255!==e[i])return[0,0];if(192===e[i+1]||194===e[i+1])return i+8<t?[e[i+7]<<8|e[i+8],e[i+5]<<8|e[i+6]]:[0,0];i+=2,A=e[i]<<8|e[i+1]}}(e);return{mime:"image/jpeg",width:t,height:i}}if(944130375===i[0]&&(55===e[4]||57===e[4])&&97===e[5])return{mime:"image/gif",width:e[7]<<8|e[6],height:e[9]<<8|e[8]};if(1718185841===i[0])return{mime:"image/qoi",width:e[4]<<24|e[5]<<16|e[6]<<8|e[7],height:e[8]<<24|e[9]<<16|e[10]<<8|e[11]};if(1179011410===i[0]&&1346520407===i[2]&&3690582==(16777215&i[3])){switch(e[15]){case 88:return{mime:"image/webp",width:1+(e[24]|e[25]<<8|e[26]<<16),height:1+(e[27]|e[28]<<8|e[29]<<16)};case 76:if(47!==e[20])return t.UNSUPPORTED_TYPE;const i=e[21]|e[22]<<8|e[23]<<16|e[24]<<24;return{mime:"image/webp",width:1+(16383&i),height:1+(i>>>14&16383)};case 32:return 157!==e[23]||1!==e[24]||42!==e[25]?t.UNSUPPORTED_TYPE:{mime:"image/webp",width:16383&(e[26]|e[27]<<8),height:16383&(e[28]|e[29]<<8)}}return t.UNSUPPORTED_TYPE}if(1887007846===i[1]&&(1718187617===i[2]||1936291425===i[2])){let i=-1;const A=Math.min(e.length-16,1024);for(let t=8;t<A;t++)if(105===e[t]&&115===e[t+1]&&112===e[t+2]&&101===e[t+3]){i=t;break}if(-1!==i){const t=e[i+8]<<24|e[i+9]<<16|e[i+10]<<8|e[i+11],A=e[i+12]<<24|e[i+13]<<16|e[i+14]<<8|e[i+15];if(t>0&&A>0)return{mime:"image/avif",width:t,height:A}}return t.UNSUPPORTED_TYPE}return t.UNSUPPORTED_TYPE},t.UNSUPPORTED_TYPE={mime:"unsupported",width:0,height:0}},463(e,t,i){Object.defineProperty(t,"__esModule",{value:!0}),t.ImageRenderer=void 0;const A=i(939),s=i(426);class r extends s.Disposable{get canvas(){var e;return null===(e=this._layers.get("top"))||void 0===e?void 0:e.canvas}static createCanvas(e,t,i){const A=(null!=e?e:document).createElement("canvas");return A.width=0|t,A.height=0|i,A}static createImageData(e,t,i,A){if("function"!=typeof ImageData){const s=e.createImageData(t,i);return A&&s.data.set(new Uint8ClampedArray(A,0,t*i*4)),s}return A?new ImageData(new Uint8ClampedArray(A,0,t*i*4),t,i):new ImageData(t,i)}static createImageBitmap(e){return"function"!=typeof createImageBitmap?Promise.resolve(void 0):createImageBitmap(e)}constructor(e){super(),this._terminal=e,this._layers=new Map,this._optionsRefresh=this._register(new s.MutableDisposable),this._oldOpen=this._terminal._core.open,this._terminal._core.open=e=>{var t;null===(t=this._oldOpen)||void 0===t||t.call(this._terminal._core,e),this._open()},this._terminal._core.screenElement&&this._open(),this._optionsRefresh.value=this._terminal._core.optionsService.onOptionChange(e=>{var t;"fontSize"===e&&(this.rescaleCanvas(),null===(t=this._renderService)||void 0===t||t.refreshRows(0,this._terminal.rows))}),this._register((0,s.toDisposable)(()=>{var e;this.removeLayerFromDom(),this.removeLayerFromDom("bottom"),this._terminal._core&&this._oldOpen&&(this._terminal._core.open=this._oldOpen,this._oldOpen=void 0),this._renderService&&this._oldSetRenderer&&(this._renderService.setRenderer=this._oldSetRenderer,this._oldSetRenderer=void 0),this._renderService=void 0,this._layers.clear(),null===(e=this._placeholderBitmap)||void 0===e||e.close(),this._placeholderBitmap=void 0,this._placeholder=void 0}))}showPlaceholder(e){var t,i;e?this._placeholder||-1===this.cellSize.height||this._createPlaceHolder(Math.max(this.cellSize.height+1,24)):(null===(t=this._placeholderBitmap)||void 0===t||t.close(),this._placeholderBitmap=void 0,this._placeholder=void 0),null===(i=this._renderService)||void 0===i||i.refreshRows(0,this._terminal.rows)}get dimensions(){return this._terminal.dimensions}get cellSize(){var e,t;return{width:(null===(e=this.dimensions)||void 0===e?void 0:e.css.cell.width)||-1,height:(null===(t=this.dimensions)||void 0===t?void 0:t.css.cell.height)||-1}}clearLines(e,t,i){var A,s,r,o,a;const n=e*((null===(A=this.dimensions)||void 0===A?void 0:A.css.cell.height)||0),h=(null===(s=this.dimensions)||void 0===s?void 0:s.css.canvas.width)||0,g=(t+1-e)*((null===(r=this.dimensions)||void 0===r?void 0:r.css.cell.height)||0);i&&"top"!==i||null===(o=this._layers.get("top"))||void 0===o||o.clearRect(0,n,h,g),i&&"bottom"!==i||null===(a=this._layers.get("bottom"))||void 0===a||a.clearRect(0,n,h,g)}clearAll(e){if(!e||"top"===e){const e=this._layers.get("top");null==e||e.clearRect(0,0,e.canvas.width,e.canvas.height)}if(!e||"bottom"===e){const e=this._layers.get("bottom");null==e||e.clearRect(0,0,e.canvas.width,e.canvas.height)}}draw(e,t,i,A,s=1){const r=this._layers.get(e.layer);if(!r)return;const{width:o,height:a}=this.cellSize;if(-1===o||-1===a)return;this._rescaleImage(e,o,a);const n=e.actual,{width:h,height:g}=e.actualCellSize,d=Math.ceil(n.width/h),l=t%d*h,I=Math.floor(t/d)*g,c=i*o,_=A*a,C=s*h+l>n.width?n.width-l:s*h,B=I+g>n.height?n.height-I:g;r.drawImage(n,Math.floor(l),Math.floor(I),Math.ceil(C),Math.ceil(B),Math.floor(c),Math.floor(_),Math.ceil(C*o/h),Math.ceil(B*a/g))}extractTile(e,t){const{width:i,height:A}=this.cellSize;if(-1===i||-1===A)return;this._rescaleImage(e,i,A);const s=e.actual,{width:o,height:a}=e.actualCellSize,n=Math.ceil(s.width/o),h=t%n*o,g=Math.floor(t/n)*a,d=o+h>s.width?s.width-h:o,l=g+a>s.height?s.height-g:a,I=r.createCanvas(this.document,Math.ceil(d*i/o),Math.ceil(l*A/a)),c=I.getContext("2d");return c?(c.drawImage(s,Math.floor(h),Math.floor(g),Math.floor(d),Math.floor(l),0,0,I.width,I.height),I):void 0}drawPlaceholder(e,t,i=1){var A;const s=this._layers.get("top");if(s){const{width:r,height:o}=this.cellSize;if(-1===r||-1===o)return;if(this._placeholder?o>=this._placeholder.height&&this._createPlaceHolder(o+1):this._createPlaceHolder(Math.max(o+1,24)),!this._placeholder)return;s.drawImage(null!==(A=this._placeholderBitmap)&&void 0!==A?A:this._placeholder,e*r,t*o%2?0:1,r*i,o,e*r,t*o,r*i,o)}}rescaleCanvas(){var e,t;const i=(null===(e=this.dimensions)||void 0===e?void 0:e.css.canvas.width)||0,A=(null===(t=this.dimensions)||void 0===t?void 0:t.css.canvas.height)||0;for(const e of this._layers.values())e.canvas.width===i&&e.canvas.height===A||(e.canvas.width=i,e.canvas.height=A)}_rescaleImage(e,t,i){if(t===e.actualCellSize.width&&i===e.actualCellSize.height)return;const{width:A,height:s}=e.origCellSize;if(t===A&&i===s)return e.actual=e.orig,e.actualCellSize.width=A,void(e.actualCellSize.height=s);const o=Math.ceil(e.orig.width*t/A),a=Math.ceil(e.orig.height*i/s);if(o*a>e.orig.width*e.orig.height)return e.actual=e.orig,e.actualCellSize.width=A,void(e.actualCellSize.height=s);const n=r.createCanvas(this.document,o,a),h=n.getContext("2d");h&&(h.drawImage(e.orig,0,0,n.width,n.height),e.actual=n,e.actualCellSize.width=t,e.actualCellSize.height=i)}_open(){this._renderService=this._terminal._core._renderService,this._oldSetRenderer=this._renderService.setRenderer.bind(this._renderService),this._renderService.setRenderer=e=>{var t;for(const e of[...this._layers.keys()])this.removeLayerFromDom(e);null===(t=this._oldSetRenderer)||void 0===t||t.call(this._renderService,e)}}insertLayerToDom(e="top"){var t,i;if(!this.document||!this._terminal._core.screenElement)return void console.warn("image addon: cannot insert output canvas to DOM, missing document or screenElement");if(this._layers.has(e))return;const A=r.createCanvas(this.document,(null===(t=this.dimensions)||void 0===t?void 0:t.css.canvas.width)||0,(null===(i=this.dimensions)||void 0===i?void 0:i.css.canvas.height)||0);A.classList.add(`xterm-image-layer-${e}`);const s=this._terminal._core.screenElement;s.style.isolation="isolate","bottom"===e?(A.style.zIndex="-1",s.insertBefore(A,s.firstChild)):(A.style.zIndex="0",s.appendChild(A));const o=A.getContext("2d",{alpha:!0});o?(this._layers.set(e,o),this.clearAll(e)):A.remove()}removeLayerFromDom(e="top"){const t=this._layers.get(e);t&&(t.canvas.remove(),this._layers.delete(e))}hasLayer(e){return this._layers.has(e)}_createPlaceHolder(e=24){var t;null===(t=this._placeholderBitmap)||void 0===t||t.close(),this._placeholderBitmap=void 0;const i=32,s=r.createCanvas(this.document,i,e),o=s.getContext("2d",{alpha:!1});if(!o)return;const a=r.createImageData(o,i,e),n=new Uint32Array(a.data.buffer),h=(0,A.toRGBA8888)(0,0,0),g=(0,A.toRGBA8888)(255,255,255);n.fill(h);for(let t=0;t<e;++t){const e=t%2,A=t*i;for(let t=0;t<i;t+=2)n[A+t+e]=g}o.putImageData(a,0,0);const d=screen.width+i-1&-32||4096;this._placeholder=r.createCanvas(this.document,d,e);const l=this._placeholder.getContext("2d",{alpha:!1});if(!l)return void(this._placeholder=void 0);for(let e=0;e<d;e+=i)l.drawImage(s,e,0);const I=this._placeholder;r.createImageBitmap(I).then(e=>{this._placeholder!==I?null==e||e.close():this._placeholderBitmap=e}).catch(()=>{})}get document(){var e;return null===(e=this._terminal._core._coreBrowserService)||void 0===e?void 0:e.window.document}}t.ImageRenderer=r},699(e,t,i){Object.defineProperty(t,"__esModule",{value:!0}),t.ImageStorage=t.CELL_SIZE_DEFAULT=void 0;const A=i(463);t.CELL_SIZE_DEFAULT={width:7,height:14};class s{get ext(){return this._urlId?-469762049&this._ext|this.underlineStyle<<26:this._ext}set ext(e){this._ext=e}get underlineStyle(){return this._urlId?5:(469762048&this._ext)>>26}set underlineStyle(e){this._ext&=-469762049,this._ext|=e<<26&469762048}get underlineColor(){return 67108863&this._ext}set underlineColor(e){this._ext&=-67108864,this._ext|=67108863&e}get underlineVariantOffset(){const e=(3758096384&this._ext)>>29;return e<0?4294967288^e:e}set underlineVariantOffset(e){this._ext&=536870911,this._ext|=e<<29&3758096384}get urlId(){return this._urlId}set urlId(e){this._urlId=e}constructor(e=0,t=0,i=-1,A=-1){this.imageId=i,this.tileId=A,this._ext=0,this._urlId=0,this._ext=e,this._urlId=t}clone(){return new s(this._ext,this._urlId,this.imageId,this.tileId)}isEmpty(){return 0===this.underlineStyle&&0===this._urlId&&-1===this.imageId}}const r=new s;t.ImageStorage=class{constructor(e,t,i){this._terminal=e,this._renderer=t,this._opts=i,this._images=new Map,this._lastId=0,this._lowestId=0,this._fullyCleared=!1,this._needsFullClear=!1,this._pixelLimit=25e5;try{this.setLimit(this._opts.storageLimit)}catch(e){e instanceof Error&&console.error(e.message),console.warn(`storageLimit is set to ${this.getLimit()} MB`)}this._viewportMetrics={cols:this._terminal.cols,rows:this._terminal.rows}}dispose(){this.reset()}reset(){var e;for(const t of this._images.values())null===(e=t.marker)||void 0===e||e.dispose();this._images.clear(),this._renderer.clearAll()}getLimit(){return 4*this._pixelLimit/1e6}setLimit(e){if(e<.5||e>1e3)throw RangeError("invalid storageLimit, should be at least 0.5 MB and not exceed 1G");this._pixelLimit=e/4*1e6>>>0,this._evictOldest(0)}getUsage(){return 4*this._getStoredPixels()/1e6}_getStoredPixels(){let e=0;for(const t of this._images.values())t.orig&&(e+=t.orig.width*t.orig.height,t.actual&&t.actual!==t.orig&&(e+=t.actual.width*t.actual.height));return e}_delImg(e){var t;const i=this._images.get(e);i&&(this._images.delete(e),window.ImageBitmap&&i.orig instanceof ImageBitmap&&i.orig.close(),null===(t=this.onImageDeleted)||void 0===t||t.call(this,e))}wipeAlternate(){var e;const t=[];for(const[i,A]of this._images.entries())"alternate"===A.bufferType&&(null===(e=A.marker)||void 0===e||e.dispose(),t.push(i));for(const e of t)this._delImg(e);this._needsFullClear=!0,this._fullyCleared=!1}deleteImage(e){var t;const i=this._images.get(e);i&&(null===(t=i.marker)||void 0===t||t.dispose(),this._delImg(e))}addImage(e,i){var A,s;this._evictOldest(e.width*e.height);let r=this._renderer.cellSize;-1!==r.width&&-1!==r.height||(r=t.CELL_SIZE_DEFAULT);const o=Math.ceil(e.width/r.width),a=Math.ceil(e.height/r.height),n=++this._lastId,h=this._terminal._core.buffer,g=this._terminal.cols,d=this._terminal.rows,l=h.x,I=h.y;let c=l,_=0;i.scrolling||(h.x=0,h.y=0,c=0),this._terminal._core._inputHandler._dirtyRowTracker.markDirty(h.y);for(let e=0;e<a;++e){const t=h.lines.get(h.y+h.ybase);for(let i=0;i<o&&!(c+i>=g);++i)this._writeToCell(t,c+i,n,e*o+i),_++;if(i.scrolling)e<a-1&&this._terminal._core._inputHandler.lineFeed();else if(++h.y>=d)break;h.x=c}this._terminal._core._inputHandler._dirtyRowTracker.markDirty(h.y),i.scrolling?"iip"===i.cursorPos?h.x=Math.min(c+o,g):h.x=c:(h.x=l,h.y=I);const C=[];for(const[e,t]of this._images.entries())t.tileCount<1&&(null===(A=t.marker)||void 0===A||A.dispose(),C.push(e));for(const e of C)this._delImg(e);const B=this._terminal.registerMarker(0);null==B||B.onDispose(()=>{this._images.get(n)&&this._delImg(n)}),"alternate"===this._terminal.buffer.active.type&&this._evictOnAlternate();const Q={orig:e,origCellSize:r,actual:e,actualCellSize:Object.assign({},r),marker:B||void 0,tileCount:_,bufferType:this._terminal.buffer.active.type,layer:i.layer,zIndex:i.zIndex};return this._images.set(n,Q),null===(s=this.onImageAdded)||void 0===s||s.call(this),n}render(e){var t,i;let A=!1,s=!1;for(const e of this._images.values())if("bottom"===e.layer?s=!0:A=!0,A&&s)break;if(A&&!this._renderer.hasLayer("top")&&(this._renderer.insertLayerToDom("top"),!this._renderer.hasLayer("top")))return;if(s&&!this._renderer.hasLayer("bottom")&&this._renderer.insertLayerToDom("bottom"),this._renderer.rescaleCanvas(),!this._images.size)return this._fullyCleared||(this._renderer.clearAll(),this._fullyCleared=!0,this._needsFullClear=!1),this._renderer.hasLayer("top")&&this._renderer.removeLayerFromDom("top"),void(this._renderer.hasLayer("bottom")&&this._renderer.removeLayerFromDom("bottom"));!A&&this._renderer.hasLayer("top")&&(this._renderer.clearAll("top"),this._renderer.removeLayerFromDom("top")),!s&&this._renderer.hasLayer("bottom")&&(this._renderer.clearAll("bottom"),this._renderer.removeLayerFromDom("bottom")),this._needsFullClear&&(this._renderer.clearAll(),this._fullyCleared=!0,this._needsFullClear=!1);const{start:o,end:a}=e,n=this._terminal._core.buffer,h=this._terminal._core.cols;this._renderer.clearLines(o,a);const g=[],d=[];for(let e=o;e<=a;++e){const A=n.lines.get(e+n.ydisp);if(!A)return;for(let s=0;s<h;++s)if(268435456&A.getBg(s)){let o=null!==(t=A._extendedAttrs[s])&&void 0!==t?t:r;const a=o.imageId;if(void 0===a||-1===a)continue;const n=this._images.get(a);if(-1!==o.tileId){const t=o.tileId,l=s;let I=1;for(;++s<h&&268435456&A.getBg(s)&&(o=null!==(i=A._extendedAttrs[s])&&void 0!==i?i:r)&&o.imageId===a&&o.tileId===t+I;)I++;s--,n?n.actual&&g.push({imgSpec:n,tileId:t,col:l,row:e,count:I}):this._opts.showPlaceholder&&d.push({col:l,row:e,count:I}),this._fullyCleared=!1}}}g.sort((e,t)=>e.imgSpec.zIndex-t.imgSpec.zIndex);for(const e of d)this._renderer.drawPlaceholder(e.col,e.row,e.count);for(const e of g)this._renderer.draw(e.imgSpec,e.tileId,e.col,e.row,e.count)}viewportResize(e){var t,i;if(!this._images.size)return void(this._viewportMetrics=e);if(this._viewportMetrics.cols>=e.cols)return void(this._viewportMetrics=e);const A=this._terminal._core.buffer,s=A.lines.length,o=this._viewportMetrics.cols-1;for(let a=0;a<s;++a){const s=A.lines.get(a);if(268435456&s.getBg(o)){const A=null!==(i=s._extendedAttrs[o])&&void 0!==i?i:r,a=A.imageId;if(void 0===a||-1===a)continue;const n=this._images.get(a);if(!n)continue;const h=Math.ceil(((null===(t=n.actual)||void 0===t?void 0:t.width)||0)/n.actualCellSize.width);if(A.tileId%h+1>=h)continue;let g=!1;for(let t=o+1;t>e.cols;++t)if(4194303&s._data[3*t+0]){g=!0;break}if(g)continue;const d=Math.min(e.cols,h-A.tileId%h+o);let l=A.tileId;for(let e=o+1;e<d;++e)this._writeToCell(s,e,a,++l),n.tileCount++}}this._viewportMetrics=e}getImageAtBufferCell(e,t){var i,s,o;const a=this._terminal._core.buffer.lines.get(t);if(a&&268435456&a.getBg(e)){const t=null!==(o=a._extendedAttrs[e])&&void 0!==o?o:r;if(t.imageId&&-1!==t.imageId){const e=null===(i=this._images.get(t.imageId))||void 0===i?void 0:i.orig;if(window.ImageBitmap&&e instanceof ImageBitmap){const t=A.ImageRenderer.createCanvas(window.document,e.width,e.height);return null===(s=t.getContext("2d"))||void 0===s||s.drawImage(e,0,0,e.width,e.height),t}return e}}}extractTileAtBufferCell(e,t){var i;const A=this._terminal._core.buffer.lines.get(t);if(A&&268435456&A.getBg(e)){const t=null!==(i=A._extendedAttrs[e])&&void 0!==i?i:r;if(t.imageId&&-1!==t.imageId&&-1!==t.tileId){const e=this._images.get(t.imageId);if(e)return this._renderer.extractTile(e,t.tileId)}}}_evictOldest(e){var t;const i=this._getStoredPixels();let A=i;for(;this._pixelLimit<A+e&&this._images.size;){const e=this._images.get(++this._lowestId);e&&e.orig&&(A-=e.orig.width*e.orig.height,e.actual&&e.orig!==e.actual&&(A-=e.actual.width*e.actual.height),null===(t=e.marker)||void 0===t||t.dispose(),this._delImg(this._lowestId))}return i-A}_writeToCell(e,t,i,A){if(268435456&e._data[3*t+2]){const r=e._extendedAttrs[t];if(r){if(void 0!==r.imageId){const e=this._images.get(r.imageId);return e&&e.tileCount--,r.imageId=i,void(r.tileId=A)}return void(e._extendedAttrs[t]=new s(r.ext,r.urlId,i,A))}}e._data[3*t+2]|=268435456,e._extendedAttrs[t]=new s(0,0,i,A)}_evictOnAlternate(){var e,t;for(const e of this._images.values())"alternate"===e.bufferType&&(e.tileCount=0);const i=this._terminal._core.buffer;for(let t=0;t<this._terminal.rows;++t){const A=i.lines.get(t);if(A)for(let t=0;t<this._terminal.cols;++t)if(268435456&A._data[3*t+2]){const i=null===(e=A._extendedAttrs[t])||void 0===e?void 0:e.imageId;if(i){const e=this._images.get(i);e&&e.tileCount++}}}const A=[];for(const[e,i]of this._images.entries())"alternate"!==i.bufferType||i.tileCount||(null===(t=i.marker)||void 0===t||t.dispose(),A.push(e));for(const e of A)this._delImg(e)}}},566(e,t,i){Object.defineProperty(t,"__esModule",{value:!0}),t.SixelHandler=void 0;const A=i(939),s=i(463),r=i(591),o=i(199),a=A.PALETTE_ANSI_256;a.set(A.PALETTE_VT340_COLOR);const n=new Map;let h=!1;function g(e,t){var i;e.memoryUsage>4194304&&e.release();const A=null!==(i=n.get(t))&&void 0!==i?i:[];A.length<2&&(A.push(e),n.set(t,A))}function d(e){return A.BIG_ENDIAN?e:(255&e)<<24|(e>>>8&255)<<16|(e>>>16&255)<<8|e>>>24&255}t.SixelHandler=class{constructor(e,t,i){var A;this._opts=e,this._storage=t,this._coreTerminal=i,this._size=0,this._aborted=!1,this._decMemoryLimit=0,this._palette=new Uint32Array(o.LIMITS.PALETTE_SIZE),this._palette.set(a),A=4*this._opts.pixelLimit,h||(h=!0,(0,r.DecoderAsync)({memoryLimit:A,palette:a}).then(e=>g(e,A),()=>{h=!1}))}reset(){this._returnDecoder(),this._palette.fill(0),this._palette.set(a)}hook(e){var t;this._size=0,this._aborted=!1,this._returnDecoder();const i=4*this._opts.pixelLimit;try{this._dec=function(e){var t,i;return null!==(i=null===(t=n.get(e))||void 0===t?void 0:t.pop())&&void 0!==i?i:new r.Decoder({memoryLimit:e,palette:a})}(i)}catch(e){return console.warn(`SIXEL: could not allocate decoder - ${e}`),void(this._aborted=!0)}this._decMemoryLimit=i;const s=1===e.params[1]?0:function(e,t){let i=0;if(!t)return i;if(e.isInverse())if(e.isFgDefault())i=d(t.foreground.rgba);else if(e.isFgRGB()){const t=e.constructor.toColorRGB(e.getFgColor());i=(0,A.toRGBA8888)(...t)}else i=d(t.ansi[e.getFgColor()].rgba);else if(e.isBgDefault())i=d(t.background.rgba);else if(e.isBgRGB()){const t=e.constructor.toColorRGB(e.getBgColor());i=(0,A.toRGBA8888)(...t)}else i=d(t.ansi[e.getBgColor()].rgba);return i}(this._coreTerminal._core._inputHandler._curAttrData,null===(t=this._coreTerminal._core._themeService)||void 0===t?void 0:t.colors);this._dec.init(s,this._palette,this._opts.sixelPaletteLimit)}_returnDecoder(){const e=this._dec;e&&(this._dec=void 0,this._palette.set(e.palette),g(e,this._decMemoryLimit))}put(e,t,i){if(!this._aborted&&this._dec){if(this._size+=i-t,this._size>this._opts.sixelSizeLimit)return console.warn("SIXEL: too much data, aborting"),this._aborted=!0,void this._dec.release();try{this._dec.decode(e,t,i)}catch(e){console.warn(`SIXEL: error while decoding image - ${e}`),this._aborted=!0,this._dec.release()}}}unhook(e){try{return this._unhook(e)}finally{this._returnDecoder()}}_unhook(e){var t;if(this._aborted||!e||!this._dec)return!0;const i=this._dec.width,A=this._dec.height;if(!i||!A)return A&&this._storage.advanceCursor(A),!0;const r=s.ImageRenderer.createCanvas(void 0,i,A);return null===(t=r.getContext("2d"))||void 0===t||t.putImageData(new ImageData(this._dec.data8,i,A),0,0),this._storage.addImage(r),!0}}},994(e,t,i){Object.defineProperty(t,"__esModule",{value:!0}),t.SixelImageStorage=void 0;const A=i(699);t.SixelImageStorage=class{constructor(e,t,i,A){this._storage=e,this._opts=t,this._renderer=i,this._terminal=A,this._addImageOpts={scrolling:!0,layer:"top",zIndex:0,cursorPos:"vt340"}}addImage(e){this._addImageOpts.scrolling=this._opts.sixelScrolling,this._storage.addImage(e,this._addImageOpts)}advanceCursor(e){if(this._opts.sixelScrolling){let t=this._renderer.cellSize;-1!==t.width&&-1!==t.height||(t=A.CELL_SIZE_DEFAULT);const i=Math.ceil(e/t.height);for(let e=1;e<i;++e)this._terminal._core._inputHandler.lineFeed()}}}},23(e,t,i){var A=this&&this.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.KittyGraphicsHandler=void 0;const s=i(463),r=i(699),o=i(462),a=A(i(669)),n=i(470);t.KittyGraphicsHandler=class{constructor(e,t,i,A){this._opts=e,this._renderer=t,this._kittyStorage=i,this._coreTerminal=A,this._aborted=!1,this._generation=0,this._decodeError=!1,this._activeDecoder=null,this._inControlData=!0,this._controlData=new Uint32Array(512),this._controlLength=0,this._encodedSizeLimit=0,this._totalEncodedSize=0,this._parsedCommand=null,this._pendingTransmissions=new Map,this._maxEncodedBytes=Math.ceil(4*this._opts.kittySizeLimit/3),this._initialEncodedBytes=Math.min(4194304,this._maxEncodedBytes)}reset(){this._generation++,this._cleanupAllPending(),this._activeDecoder&&(this._activeDecoder.release(),this._activeDecoder=null),this._kittyStorage.reset()}dispose(){this.reset()}_removePendingEntry(e){this._pendingTransmissions.delete(e),this._lastPendingKey===e&&(this._lastPendingKey=void 0)}_cleanupAllPending(){for(const e of this._pendingTransmissions.values())e.decoder.release();this._pendingTransmissions.clear(),this._lastPendingKey=void 0}start(){this._aborted=!1,this._decodeError=!1,this._inControlData=!0,this._controlLength=0,this._parsedCommand=null,this._encodedSizeLimit=this._maxEncodedBytes,this._totalEncodedSize=0,this._activeDecoder=null}put(e,t,i){var A;if(!this._aborted)if(this._inControlData){let s=i;for(let A=t;A<i;A++)if(59===e[A]){this._inControlData=!1,s=A;break}const r=s-t;if(this._controlLength+r>512)return void(this._aborted=!0);if(this._controlData.set(e.subarray(t,s),this._controlLength),this._controlLength+=r,!this._inControlData){if(this._parsedCommand=(0,n.parseKittyCommand)(this._parseControlDataString()),void 0!==this._parsedCommand.id&&void 0!==this._parsedCommand.imageNumber)return this._sendResponse(this._parsedCommand.id,"EINVAL:cannot specify both i and I keys",null!==(A=this._parsedCommand.quiet)&&void 0!==A?A:0),void(this._aborted=!0);if("d"===this._parsedCommand.action)return;const t=s+1;t<i&&this._streamPayload(e,t,i)}}else this._streamPayload(e,t,i)}_streamPayload(e,t,i){var A,s,r,o,n,h,g,d,l,I;if(this._aborted)return;const c=null!==(n=null!==(o=null===(A=this._parsedCommand)||void 0===A?void 0:A.id)&&void 0!==o?o:this._lastPendingKey)&&void 0!==n?n:0,_=this._pendingTransmissions.get(c),C=null!==(h=null==_?void 0:_.totalEncodedSize)&&void 0!==h?h:0;if(this._totalEncodedSize+=i-t,C+this._totalEncodedSize>this._encodedSizeLimit){const e=null!==(g=this._activeDecoder)&&void 0!==g?g:null==_?void 0:_.decoder;return e&&e.release(),this._activeDecoder=null,_&&this._removePendingEntry(c),void(this._aborted=!0)}if(!this._decodeError){if((null==_?void 0:_.decoder)&&!this._activeDecoder&&(this._activeDecoder=_.decoder),!this._activeDecoder){const e=this._maxEncodedBytes+131072;if(e>1e6*this._opts.storageLimit)return this._aborted=!0,void(void 0!==(null===(s=this._parsedCommand)||void 0===s?void 0:s.id)&&this._sendResponse(this._parsedCommand.id,"ENOMEM:pending image budget exceeded",null!==(d=this._parsedCommand.quiet)&&void 0!==d?d:0));const t=Math.max(1,Math.floor(1e6*this._opts.storageLimit/e));for(;this._pendingTransmissions.size>=t;){const e=this._pendingTransmissions.entries().next().value;if(!e)break;e[1].decoder.release(),this._removePendingEntry(e[0]),void 0!==e[1].cmd.id&&this._sendResponse(e[1].cmd.id,"ENOMEM:pending image budget exceeded",null!==(l=e[1].cmd.quiet)&&void 0!==l?l:0)}const i=new a.default(4194304,this._maxEncodedBytes,this._initialEncodedBytes);try{i.init()}catch(e){return console.warn("KITTY: could not allocate decoder",e),this._aborted=!0,void(void 0!==(null===(r=this._parsedCommand)||void 0===r?void 0:r.id)&&this._sendResponse(this._parsedCommand.id,"ENOMEM:could not allocate decoder",null!==(I=this._parsedCommand.quiet)&&void 0!==I?I:0))}this._activeDecoder=i}0!==this._activeDecoder.put(e.subarray(t,i))&&(this._activeDecoder.release(),this._activeDecoder=null,this._decodeError=!0,_&&this._removePendingEntry(c))}}end(e){var t,i;if(this._aborted||!e)return this._activeDecoder&&(this._activeDecoder.release(),this._activeDecoder=null),!0;if(this._inControlData)return this._handleNoPayloadCommand();const A=this._parsedCommand;if("d"===A.action)return this._handleDelete(A);const s=null!==(i=null!==(t=A.id)&&void 0!==t?t:this._lastPendingKey)&&void 0!==i?i:0,r=1===A.more,o=this._pendingTransmissions.get(s);if(r)return this._activeDecoder&&(o?(o.totalEncodedSize+=this._totalEncodedSize,o.decodeError=o.decodeError||this._decodeError):this._pendingTransmissions.set(s,{cmd:Object.assign({},A),decoder:this._activeDecoder,totalEncodedSize:this._totalEncodedSize,decodeError:this._decodeError}),this._lastPendingKey=s,this._activeDecoder=null),!0;o&&(this._lastPendingKey=void 0);let a=this._decodeError,n=A,h=this._activeDecoder;o&&(n=o.cmd,h=o.decoder,a=a||o.decodeError,this._pendingTransmissions.delete(s));let g=new Uint8Array(0);h&&(0!==h.end()&&(a=!0),g=h.data8),this._activeDecoder=null;const d=this._handleCommandWithBytesAndCmd(n,g,a);return h&&h.release(),d}_parseControlDataString(){let e="";for(let t=0;t<this._controlLength;t++)e+=String.fromCodePoint(this._controlData[t]);return e}_handleNoPayloadCommand(){var e,t,i,A,s;const r=(0,n.parseKittyCommand)(this._parseControlDataString());if(void 0!==r.id&&void 0!==r.imageNumber)return this._sendResponse(r.id,"EINVAL:cannot specify both i and I keys",null!==(e=r.quiet)&&void 0!==e?e:0),!0;switch(null!==(t=r.action)&&void 0!==t?t:"t"){case"d":return this._handleDelete(r);case"q":return this._sendResponse(null!==(i=r.id)&&void 0!==i?i:0,"OK",null!==(A=r.quiet)&&void 0!==A?A:0),!0;case"p":return this._handlePlacement(r);default:return void 0!==r.id&&this._sendResponse(r.id,"EINVAL:unsupported action",null!==(s=r.quiet)&&void 0!==s?s:0),!0}}_handleCommandWithBytesAndCmd(e,t,i){var A,s,r,o,a;switch(null!==(A=e.action)&&void 0!==A?A:"t"){case"t":{const A=this._handleTransmit(e,t,i);return"d"===(null!==(s=e.transmission)&&void 0!==s?s:"d")&&void 0!==e.id&&(i?this._sendResponse(e.id,"EINVAL:invalid base64 data",null!==(r=e.quiet)&&void 0!==r?r:0):t.length>0&&this._sendResponse(e.id,"OK",null!==(o=e.quiet)&&void 0!==o?o:0)),A}case"T":return this._handleTransmitDisplay(e,t,i);case"q":return this._handleQuery(e,t,i);case"p":return this._handlePlacement(e);default:return void 0!==e.id&&this._sendResponse(e.id,"EINVAL:unsupported action",null!==(a=e.quiet)&&void 0!==a?a:0),!0}}_handlePlacement(e){var t;if(void 0===e.id)return!0;const i=e.id,A=this._kittyStorage.getImage(i);return A?this._displayImage(A,e).then(t=>{var A;return this._sendResponse(i,t?"OK":"EINVAL:image rendering failed",null!==(A=e.quiet)&&void 0!==A?A:0,e.placementId),!0}):(this._sendResponse(i,"ENOENT:image not found",null!==(t=e.quiet)&&void 0!==t?t:0,e.placementId),!0)}_handleTransmit(e,t,i){var A,s,r,o,a,n;return"d"!==(null!==(A=e.transmission)&&void 0!==A?A:"d")?(void 0!==e.id&&this._sendResponse(e.id,"EINVAL:unsupported transmission medium",null!==(s=e.quiet)&&void 0!==s?s:0),!0):(i||0===t.length||this._kittyStorage.storeImage(e.id,{data:new Blob([t]),width:null!==(r=e.width)&&void 0!==r?r:0,height:null!==(o=e.height)&&void 0!==o?o:0,format:null!==(a=e.format)&&void 0!==a?a:32,compression:null!==(n=e.compression)&&void 0!==n?n:""}),!0)}_handleTransmitDisplay(e,t,i){var A,s;if(i)return void 0!==e.id&&this._sendResponse(e.id,"EINVAL:invalid base64 data",null!==(A=e.quiet)&&void 0!==A?A:0),!0;this._handleTransmit(e,t,i);const r=null!==(s=e.id)&&void 0!==s?s:this._kittyStorage.lastImageId,o=this._kittyStorage.getImage(r);if(o){const t=this._displayImage(o,e);return void 0!==e.id?t.then(t=>{var i;return this._sendResponse(r,t?"OK":"EINVAL:image rendering failed",null!==(i=e.quiet)&&void 0!==i?i:0),!0}):t.then(()=>!0)}return!0}_handleQuery(e,t,i){var A,s,r,o,a,n;const h=null!==(A=e.id)&&void 0!==A?A:0,g=null!==(s=e.quiet)&&void 0!==s?s:0;if("d"!==(null!==(r=e.transmission)&&void 0!==r?r:"d"))return this._sendResponse(h,"EINVAL:unsupported transmission medium",g),!0;if(i)return this._sendResponse(h,"EINVAL:invalid base64 data",g),!0;if(0===t.length)return this._sendResponse(h,"OK",g),!0;const d=null!==(o=e.format)&&void 0!==o?o:32;if(100===d)this._sendResponse(h,"OK",g);else{const i=null!==(a=e.width)&&void 0!==a?a:0,A=null!==(n=e.height)&&void 0!==n?n:0;if(!i||!A)return this._sendResponse(h,"EINVAL:width and height required for raw pixel data",g),!0;const s=i*A*(32===d?4:3);if(t.length<s)return this._sendResponse(h,"EINVAL:insufficient pixel data",g),!0;this._sendResponse(h,"OK",g)}return!0}_handleDelete(e){var t;switch(null!==(t=e.deleteSelector)&&void 0!==t?t:"a"){case"a":case"A":this._cleanupAllPending(),this._kittyStorage.deleteAll();break;case"i":case"I":if(void 0!==e.id){const t=this._pendingTransmissions.get(e.id);t&&t.decoder.release(),this._removePendingEntry(e.id),this._kittyStorage.deleteById(e.id)}}return!0}_sendResponse(e,t,i,A){const s="OK"===t;if(s&&i>=1)return;if(!s&&i>=2)return;const r=`_Gi=${e}${A?`,p=${A}`:""};${t}\\`;this._coreTerminal._core.coreService.triggerDataEvent(r)}_displayImage(e,t){return this._decodeAndDisplay(e,t).then(()=>!0).catch(()=>!1)}async _decodeAndDisplay(e,t){var i,A,o,a,n,h,g;const d=this._generation;let l=await this._createBitmap(e);try{if(d!==this._generation)throw new Error("image decode canceled");const I=Math.max(0,null!==(o=t.x)&&void 0!==o?o:0),c=Math.max(0,null!==(a=t.y)&&void 0!==a?a:0),_=t.sourceWidth||l.width-I,C=t.sourceHeight||l.height-c,B=Math.max(0,l.width-I),Q=Math.max(0,l.height-c),m=Math.max(0,Math.min(_,B)),u=Math.max(0,Math.min(C,Q));if(0===m||0===u)throw new Error("invalid source rectangle");if(0!==I||0!==c||m!==l.width||u!==l.height){const e=await createImageBitmap(l,I,c,m,u);l.close(),l=e}const E=(null===(i=this._renderer.dimensions)||void 0===i?void 0:i.css.cell.width)||r.CELL_SIZE_DEFAULT.width,p=(null===(A=this._renderer.dimensions)||void 0===A?void 0:A.css.cell.height)||r.CELL_SIZE_DEFAULT.height;let w,f;void 0!==t.columns&&void 0!==t.rows?(w=t.columns,f=t.rows):void 0!==t.columns?(w=t.columns,f=Math.max(1,Math.ceil(l.height/l.width*(w*E)/p))):void 0!==t.rows?(f=t.rows,w=Math.max(1,Math.ceil(l.width/l.height*(f*p)/E))):(w=Math.ceil(l.width/E),f=Math.ceil(l.height/p));let D=l.width,y=l.height;if(void 0===t.columns&&void 0===t.rows||(D=Math.round(w*E),y=Math.round(f*p)),D*y>this._opts.pixelLimit)throw new Error("image exceeds pixel limit");const v=this._coreTerminal._core.buffer,M=v.x,k=v.y,b=v.ybase,S=void 0!==t.zIndex&&t.zIndex<0?"bottom":"top";if(D!==l.width||y!==l.height){const e=await createImageBitmap(l,{resizeWidth:D,resizeHeight:y});l.close(),l=e}const L=Math.min(Math.max(0,null!==(n=t.xOffset)&&void 0!==n?n:0),E-1),N=Math.min(Math.max(0,null!==(h=t.yOffset)&&void 0!==h?h:0),p-1);if(0!==L||0!==N){const e=void 0!==t.columns?Math.round(w*E):l.width+L,i=void 0!==t.rows?Math.round(f*p):l.height+N,A=s.ImageRenderer.createCanvas(window.document,e,i),r=A.getContext("2d");if(!r)throw new Error("Failed to create offset canvas context");r.drawImage(l,L,N);const o=await createImageBitmap(A);if(A.width=A.height=0,l.close(),l=o,D=l.width,y=l.height,D*y>this._opts.pixelLimit)throw new Error("image exceeds pixel limit");void 0===t.columns&&(w=Math.ceil(l.width/E)),void 0===t.rows&&(f=Math.ceil(l.height/p))}if(d!==this._generation)throw new Error("image decode canceled");const G=null!==(g=t.zIndex)&&void 0!==g?g:0;if(this._kittyStorage.addImage(e.id,l,!0,S,G),l=void 0,1===t.cursorMovement){const e=v.ybase-b;v.x=M,v.y=Math.max(k-e,0)}else v.x=Math.min(M+w,this._coreTerminal.cols)}catch(e){throw null==l||l.close(),e}}async _createBitmap(e){let t=new Uint8Array(await e.data.arrayBuffer());if("z"===e.compression&&(t=await this._decompressZlib(t)),100===e.format){const e=(0,o.imageType)(t);if("image/png"!==e.mime||!(e.width>0)||!(e.height>0)||e.width*e.height>this._opts.pixelLimit)throw new RangeError("PNG exceeds pixel limit or has invalid dimensions");const i=new Blob([t],{type:"image/png"});if(!window.createImageBitmap){const e=URL.createObjectURL(i),t=new Image;return new Promise((i,A)=>{t.addEventListener("load",()=>{var r;URL.revokeObjectURL(e);const o=s.ImageRenderer.createCanvas(window.document,t.width,t.height);null===(r=o.getContext("2d"))||void 0===r||r.drawImage(t,0,0),createImageBitmap(o).then(i).catch(A)}),t.addEventListener("error",()=>{URL.revokeObjectURL(e),A(new Error("Failed to load image"))}),t.src=e})}return createImageBitmap(i)}const i=e.width,A=e.height;if(!i||!A)throw new Error("Width and height required for raw pixel data");const r=i*A*(32===e.format?4:3);if(t.length<r)throw new Error("Insufficient pixel data");const a=i*A;if(32===e.format)return createImageBitmap(new ImageData(new Uint8ClampedArray(t.buffer,t.byteOffset,4*a),i,A));const n=new Uint8ClampedArray(4*a),h=new Uint32Array(t.buffer,t.byteOffset,Math.floor(t.byteLength/4)),g=new Uint32Array(n.buffer),d=-4&a;let l=0,I=0;for(let e=0;e<d;e+=4){const e=h[l++],t=h[l++],i=h[l++];g[I++]=4278190080|e,g[I++]=4278190080|e>>>24|t<<8,g[I++]=4278190080|t>>>16|i<<16,g[I++]=4278190080|i>>>8}let c=3*d,_=4*d;for(let e=d;e<a;e++)n[_]=t[c],n[_+1]=t[c+1],n[_+2]=t[c+2],n[_+3]=255,c+=3,_+=4;return createImageBitmap(new ImageData(n,i,A))}async _decompressZlib(e){try{return await this._decompress(e,"deflate")}catch(t){if(t instanceof RangeError)throw t;return await this._decompress(e,"deflate-raw")}}async _decompress(e,t){const i=Math.min(this._opts.kittySizeLimit,4*this._opts.pixelLimit,1e6*this._opts.storageLimit);let A=0;const s=new ReadableStream({pull(t){if(A>=e.length)return void t.close();const i=Math.min(A+4096,e.length);t.enqueue(new Uint8Array(e.subarray(A,i))),A=i}}).pipeThrough(new DecompressionStream(t)).getReader(),r=[];let o=0;try{for(;;){const{done:e,value:t}=await s.read();if(e)break;if(o+=t.byteLength,o>i)throw await s.cancel().catch(()=>{}),new RangeError("decompressed image exceeds byte limit");r.push(t)}}finally{s.releaseLock()}const a=new Uint8Array(o);let n=0;for(const e of r)a.set(e,n),n+=e.length;return a}get images(){return this._kittyStorage.images}get _kittyIdToStorageId(){return this._kittyStorage.kittyIdToStorageId}get pendingTransmissions(){return this._pendingTransmissions}}},470(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.parseKittyCommand=function(e){const t={},i=e.split(",");for(const e of i){const i=e.indexOf("=");if(-1===i)continue;const A=e.substring(0,i),s=e.substring(i+1);if("a"===A){t.action=s;continue}if("o"===A){t.compression=s;continue}if("t"===A){t.transmission=s;continue}if("d"===A){t.deleteSelector=s;continue}const r=parseInt(s,10);switch(A){case"f":t.format=r;break;case"i":t.id=r;break;case"I":t.imageNumber=r;break;case"s":t.width=r;break;case"v":t.height=r;break;case"x":t.x=r;break;case"y":t.y=r;break;case"w":t.sourceWidth=r;break;case"h":t.sourceHeight=r;break;case"X":t.xOffset=r;break;case"Y":t.yOffset=r;break;case"c":t.columns=r;break;case"r":t.rows=r;break;case"m":t.more=r;break;case"q":t.quiet=r;break;case"C":t.cursorMovement=r;break;case"z":t.zIndex=r;break;case"p":t.placementId=r}}return t}},235(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.KittyImageStorage=void 0;class i{constructor(e){this._storage=e,this._nextImageId=1,this._images=new Map,this._kittyIdToStorageId=new Map,this._storageIdToKittyId=new Map,this._handleStorageImageDeleted=e=>{const t=this._storageIdToKittyId.get(e);void 0!==t&&(this._kittyIdToStorageId.delete(t),this._storageIdToKittyId.delete(e),this._images.delete(t))},this._addImageOpts={scrolling:!0,layer:"top",zIndex:0,cursorPos:"iip"},this._previousOnImageDeleted=this._storage.onImageDeleted,this._wrappedOnImageDeleted=e=>{var t;null===(t=this._previousOnImageDeleted)||void 0===t||t.call(this,e),this._handleStorageImageDeleted(e)},this._storage.onImageDeleted=this._wrappedOnImageDeleted}reset(){this._nextImageId=1,this._images.clear(),this._kittyIdToStorageId.clear(),this._storageIdToKittyId.clear()}dispose(){this.reset(),this._storage.onImageDeleted===this._wrappedOnImageDeleted&&(this._storage.onImageDeleted=this._previousOnImageDeleted)}storeImage(e,t){const A=null!=e?e:this._nextImageId++,s=this._kittyIdToStorageId.get(A);void 0!==s&&(this._storage.deleteImage(s),this._kittyIdToStorageId.delete(A),this._storageIdToKittyId.delete(s)),!this._images.has(A)&&this._images.size>=i._maxStoredImages&&this._evictUndisplayedImages();const r=1e6*this._storage.getLimit();this._images.delete(A);let o=0;for(const e of this._images.values())o+=e.data.size;for(const e of[!1,!0])for(const[i,A]of this._images){if(o+t.data.size<=r)break;this._kittyIdToStorageId.has(i)===e&&(o-=A.data.size,this.deleteById(i))}return this._images.set(A,Object.assign(Object.assign({},t),{id:A})),A}addImage(e,t,i,A,s){const r=this._kittyIdToStorageId.get(e);void 0!==r&&this._storageIdToKittyId.delete(r),this._addImageOpts.scrolling=i,this._addImageOpts.layer=A,this._addImageOpts.zIndex=s;const o=this._storage.addImage(t,this._addImageOpts);this._kittyIdToStorageId.set(e,o),this._storageIdToKittyId.set(o,e)}getImage(e){return this._images.get(e)}deleteById(e){this._images.delete(e);const t=this._kittyIdToStorageId.get(e);void 0!==t&&(this._storage.deleteImage(t),this._kittyIdToStorageId.delete(e),this._storageIdToKittyId.delete(t))}deleteAll(){this._images.clear();for(const e of this._kittyIdToStorageId.values())this._storage.deleteImage(e);this._kittyIdToStorageId.clear(),this._storageIdToKittyId.clear()}get images(){return this._images}get kittyIdToStorageId(){return this._kittyIdToStorageId}get lastImageId(){return this._nextImageId-1}_evictUndisplayedImages(){for(const[e]of this._images){if(this._images.size<=i._maxStoredImages/2)break;this._kittyIdToStorageId.has(e)||this._images.delete(e)}}}t.KittyImageStorage=i,i._maxStoredImages=256},669(e,t,i){Object.defineProperty(t,"__esModule",{value:!0});const A=(0,i(552).InWasm)({s:1,t:0,d:"AGFzbQEAAAABBQFgAAF/Ag8BA2VudgZtZW1vcnkCAAEDAwIAAAcNAgNkZWMAAANlbmQAAQqLBgKZBAEKf0GIKCgCAEGgKGohAUGEKCgCACIDQaAoaiEAQYAoKAIAQQFrQXxxIgRBoChqIQUgBEEQayADSgRAIARBkChqIQMDQCABIABBA2otAABBAnQoAoAgIABBAmotAABBAnQoAoAYIABBAWotAABBAnQoAoAQIAAtAABBAnQoAoAIcnJyIgY2AgAgAUEDaiAAQQdqLQAAQQJ0KAKAICAAQQZqLQAAQQJ0KAKAGCAAQQVqLQAAQQJ0KAKAECAAQQRqLQAAQQJ0KAKACHJyciIHNgIAIAFBBmogAEELai0AAEECdCgCgCAgAEEKai0AAEECdCgCgBggAEEJai0AAEECdCgCgBAgAEEIai0AAEECdCgCgAhycnIiCDYCACABQQlqIABBD2otAABBAnQoAoAgIABBDmotAABBAnQoAoAYIABBDWotAABBAnQoAoAQIABBDGotAABBAnQoAoAIcnJyIgk2AgAgAiAGciAHciAIciAJciECIAFBDGohASAAQRBqIgAgA0kNAAsLIAAgBUkEQANAIAEgAEEDai0AAEECdCgCgCAgAEECai0AAEECdCgCgBggAEEBai0AAEECdCgCgBAgAC0AAEECdCgCgAhycnIiAzYCACACIANyIQIgAUEDaiEBIABBBGoiACAFSQ0ACwtBfyEAIAJB////B00Ef0GEKCAENgIAQYgoIAFBoChrNgIAQQAFQX8LC+0BAQR/AkBBgCgoAgAiAUGEKCgCACIAa0EFTgRAQX8hAxAADQFBgCgoAgAhAUGEKCgCACEAC0F/IQMgASAAayIBQQJIDQAgAC0AoShBAnQoAoAQIAAtAKAoQQJ0KAKACHIhAgJ/IAFBBEYEQEEDQQQgAC0AoyhBPUYbIAAtAKIoQT1GayEBC0EBIAFBA0kNABogAC0AoihBAnQoAoAYIAJyIQJBAiABQQRHDQAaIAAtAKMoQQJ0KAKAICACciECQQMLIQEgAkH///8HSw0AQQAhA0GIKCgCACIAIAI2AKAoQYgoIAAgAWo2AgALIAML"}),s=new Uint8Array("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".split("").map(e=>e.charCodeAt(0))),r=new Uint32Array(1024);r.fill(4278190080);for(let e=0;e<s.length;++e)r[s[e]]=e<<2;for(let e=0;e<s.length;++e)r[256+s[e]]=e>>4|(e<<4&255)<<8;for(let e=0;e<s.length;++e)r[512+s[e]]=e>>2<<8|(e<<6&255)<<16;for(let e=0;e<s.length;++e)r[768+s[e]]=e<<16;const o=new Uint8Array(0);t.default=class{constructor(e,t,i){if(this._inst=null,this._ended=!0,this._bytes=0,this.keepSize=null!=e?e:1048576,this.maxBytes=null!=t?t:4294901760,this._bytes=null!=i?i:32768,this._bytes>this.maxBytes||this.maxBytes>4294901760)throw new Error("invalid byte settings")}get data8(){return this._inst?this._d.subarray(0,this._m32[1282]):o}release(){this._inst&&(this._bytes>this.keepSize?this._inst=this._m32=this._d=this._mem=null:(this._m32[1280]=0,this._m32[1281]=0,this._m32[1282]=0))}init(e,t){if(this.maxBytes=null!=e?e:this.maxBytes,this._bytes=null!=t?t:Math.min(this._bytes,this.maxBytes),this._bytes>this.maxBytes||this.maxBytes>4294901760)throw Error("invalid byte settings");let i=this._m32;const s=this._bytes+5152;this._inst?this._mem.buffer.byteLength<s&&(this._mem.grow(Math.ceil((s-this._mem.buffer.byteLength)/65536)),i=new Uint32Array(this._mem.buffer,0),this._d=new Uint8Array(this._mem.buffer,5152)):(this._mem=new WebAssembly.Memory({initial:Math.ceil(s/65536)}),this._inst=A({env:{memory:this._mem}}),i=new Uint32Array(this._mem.buffer,0),i.set(r,256),this._d=new Uint8Array(this._mem.buffer,5152)),i[1280]=0,i[1281]=0,i[1282]=0,this._m32=i,this._ended=!1}_realloc(e){const t=this._m32[1280]+e;if(this._bytes<t){if(t>this.maxBytes)return-3;let e=this._bytes;for(;(e*=2)<t;);if(e=Math.min(e,this.maxBytes),e<t)return-3;if(e+5152>this._mem.buffer.byteLength){const t=Math.ceil((e+5152-this._mem.buffer.byteLength)/65536);this._mem.grow(t),this._m32=new Uint32Array(this._mem.buffer,0),this._d=new Uint8Array(this._mem.buffer,5152)}this._bytes=e}return 0}put(e){if(!this._inst||this._ended)return-2;if(this._realloc(e.length))return-3;const t=this._m32;return this._d.set(e,t[1280]),t[1280]+=e.length,t[1280]-t[1281]>=131072?this._inst.exports.dec():0}end(){return this._ended=!0,this._inst?this._inst.exports.end():-2}get loadedBytes(){return this._inst?this._m32[1280]:0}get freeBytes(){return this._inst?this.maxBytes-this._m32[1280]:0}}},61(e,t,i){Object.defineProperty(t,"__esModule",{value:!0});const A=(0,i(552).InWasm)({s:1,t:0,d:"AGFzbQEAAAABCgJgAABgA39/fwACDwEDZW52Bm1lbW9yeQIAAQMDAgABBwcBA2RlYwABCAEACu4EAgwAQQBBAEGAAvwLAAveBAEJf0EAQQBBgAL8CwAgAUEXTgRAIAAgAWpBCGshCkGACCEBIAJBAnRBgAhqIQsgAEEOaiEDQf8BIQZBACECA0AgA0EBaiEHIAMtAAAiCEE/cSEAAkACQCAIQcABcSIJRQRAIABBAnQiAC0AAyEGIAAtAAIhBCAALQABIQUgAC0AACECIAchAwwBCwJAIAhB/QFLDQAgCUHAAUcNACAFQQVsIAJBA2xqIARBB2xqIAZBC2xqQT9xQQJ0IgMgBDoAAiADIAU6AAEgAyACOgAAIANBA2ogBjoAAANAIAEgAjoAACABQQNqIAY6AAAgAUECaiAEOgAAIAFBAWogBToAACABQQRqIQEgAEUEQCAHIQMMBAsgAEEBayEAIAEgC0kNAAsgByEDDAILAn8CQAJAAkAgCEH+AWsOAgABAgsgAy0AAyEEIAMtAAIhBSADLQABIQIgA0EEagwCCyADKAIBIgJBGHYhBiACQRB2IQQgAkEIdiEFIANBBWoMAQsgCUGAAUcEQCAHIAlBwABHDQEaIAQgCEEDcWpBAmshBCACIABBBHZqQQJrIQIgBSAIQQJ2QQNxakECayEFIAcMAQsgBCAAQShrIgkgAy0AASIHQQ9xamohBCACIAdBBHYgCWpqIQIgACAFakEgayEFIANBAmoLIQMgBUEFbCACQQNsaiAEQQdsaiAGQQtsakE/cUECdCIAIAQ6AAIgACAFOgABIAAgAjoAACAAQQNqIAY6AAALIAEgBjoAAyABIAQ6AAIgASAFOgABIAEgAjoAACABQQRqIQELIAMgCkkNAAsLCw=="});t.default=class{constructor(e){this.keepSize=e,this.width=0,this.height=0}decode(e){this.width=e[4]<<24|e[5]<<16|e[6]<<8|e[7],this.height=e[8]<<24|e[9]<<16|e[10]<<8|e[11];const t=this.width*this.height,i=4*t,s=e.length,r=Math.max(i,s)+(Math.min(i,s)>>1)+4096;this._inst?this._mem.buffer.byteLength<r&&(this._mem.grow(Math.ceil((r-this._mem.buffer.byteLength)/65536)),this._d=null):(this._mem=new WebAssembly.Memory({initial:Math.ceil(r/65536)}),this._inst=A({env:{memory:this._mem}})),this._d||(this._d=new Uint8Array(this._mem.buffer));const o=this._mem.buffer.byteLength-s&-256;return this._d.set(e,o),this._inst.exports.dec(o,s,t),this._d.subarray(1024,1024+i)}release(){this._inst&&this._mem.buffer.byteLength>this.keepSize&&(this._inst=this._d=this._mem=null)}}},552(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.InWasm=function(e){if(e.d){const{t,s:A,d:s}=e;let r,o;const a=WebAssembly;return 0===t?A?e=>new a.Instance(o||(o=new a.Module(r||(r=i(s)))),e):e=>o?a.instantiate(o,e):a.instantiate(r||(r=i(s)),e).then(e=>(o=e.module)&&e.instance):1===t?A?()=>o||(o=new a.Module(r||(r=i(s)))):()=>o?Promise.resolve(o):a.compile(r||(r=i(s))).then(e=>o=e):A?()=>r||(r=i(s)):()=>Promise.resolve(r||(r=i(s)))}if("undefined"==typeof _wasmCtx)throw new Error('must run "inwasm"');_wasmCtx.add(e)};let i=e=>{if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e);if("undefined"!=typeof Buffer)return Buffer.from(e,"base64");const t=atob(e),i=new Uint8Array(t.length);for(let e=0;e<i.length;++e)i[e]=t.charCodeAt(e);return i}}},t={};function i(A){var s=t[A];if(void 0!==s)return s.exports;var r=t[A]={exports:{}};return e[A].call(r.exports,r,r.exports,i),r.exports}var A={};return(()=>{var e=A;Object.defineProperty(e,"__esModule",{value:!0}),e.ImageAddon=void 0;const t=i(414),s=i(795),r=i(463),o=i(699),a=i(23),n=i(235),h=i(566),g=i(994),d=i(649),l={enableSizeReports:!0,pixelLimit:16777216,sixelSupport:!0,sixelScrolling:!0,sixelPaletteLimit:4096,sixelSizeLimit:33554432,storageLimit:128,showPlaceholder:!0,iipSupport:!0,iipSizeLimit:33554432,kittySupport:!0,kittySizeLimit:33554432};e.ImageAddon=class{constructor(e){this._disposables=[],this._handlers=new Map,this._onImageAdded=new t.Emitter,this.onImageAdded=this._onImageAdded.event,this._opts=Object.assign({},l,e),this._defaultOpts=Object.assign({},l,e)}dispose(){for(const e of this._handlers.values())e.reset();for(const e of this._disposables)e.dispose();this._disposables.length=0,this._handlers.clear(),this._onImageAdded.dispose()}_disposeLater(...e){for(const t of e)this._disposables.push(t)}activate(e){var t;if(this._terminal=e,this._renderer=new r.ImageRenderer(e),this._storage=new o.ImageStorage(e,this._renderer,this._opts),this._storage.onImageAdded=()=>this._onImageAdded.fire(),this._opts.enableSizeReports){const i=null!==(t=e.options.windowOptions)&&void 0!==t?t:{};i.getWinSizePixels=!0,i.getCellSizePixels=!0,i.getWinSizeChars=!0,e.options.windowOptions=i}if(this._disposeLater(this._renderer,this._storage,e.parser.registerCsiHandler({prefix:"?",final:"h"},e=>this._decset(e)),e.parser.registerCsiHandler({prefix:"?",final:"l"},e=>this._decrst(e)),e.parser.registerCsiHandler({final:"c"},e=>this._da1(e)),e.parser.registerCsiHandler({prefix:"?",final:"S"},e=>this._xtermGraphicsAttributes(e)),e.onRender(e=>{var t;return null===(t=this._storage)||void 0===t?void 0:t.render(e)}),e.parser.registerCsiHandler({intermediates:"!",final:"p"},()=>this.reset()),e.parser.registerEscHandler({final:"c"},()=>this.reset()),e._core._inputHandler.onRequestReset(()=>this.reset()),e.buffer.onBufferChange(()=>{var e;return null===(e=this._storage)||void 0===e?void 0:e.wipeAlternate()}),e.onResize(e=>{var t;return null===(t=this._storage)||void 0===t?void 0:t.viewportResize(e)})),this._opts.sixelSupport){const t=new g.SixelImageStorage(this._storage,this._opts,this._renderer,e),i=new h.SixelHandler(this._opts,t,e);this._handlers.set("sixel",i),this._disposeLater(e._core._inputHandler._parser.registerDcsHandler({final:"q"},i))}if(this._opts.iipSupport){const t=new d.IIPImageStorage(this._storage),i=new s.IIPHandler(this._opts,this._renderer,t,e);this._handlers.set("iip",i),this._disposeLater(e._core._inputHandler._parser.registerOscHandler(1337,i))}if(this._opts.kittySupport){const t=new n.KittyImageStorage(this._storage),i=new a.KittyGraphicsHandler(this._opts,this._renderer,t,e);this._handlers.set("kitty",i),this._disposeLater(t,i,e._core._inputHandler._parser.registerApcHandler({final:"G"},i))}}reset(){var e;this._opts.sixelScrolling=this._defaultOpts.sixelScrolling,this._opts.sixelPaletteLimit=this._defaultOpts.sixelPaletteLimit,null===(e=this._storage)||void 0===e||e.reset();for(const e of this._handlers.values())e.reset();return!1}get storageLimit(){var e;return(null===(e=this._storage)||void 0===e?void 0:e.getLimit())||-1}set storageLimit(e){var t;null===(t=this._storage)||void 0===t||t.setLimit(e),this._opts.storageLimit=e}get storageUsage(){return this._storage?this._storage.getUsage():-1}get showPlaceholder(){return this._opts.showPlaceholder}set showPlaceholder(e){var t;this._opts.showPlaceholder=e,null===(t=this._renderer)||void 0===t||t.showPlaceholder(e)}getImageAtBufferCell(e,t){var i;return null===(i=this._storage)||void 0===i?void 0:i.getImageAtBufferCell(e,t)}extractTileAtBufferCell(e,t){var i;return null===(i=this._storage)||void 0===i?void 0:i.extractTileAtBufferCell(e,t)}_report(e){var t;null===(t=this._terminal)||void 0===t||t._core.input(e,!1)}_decset(e){for(let t=0;t<e.length;++t)80===e[t]&&(this._opts.sixelScrolling=!1);return!1}_decrst(e){for(let t=0;t<e.length;++t)80===e[t]&&(this._opts.sixelScrolling=!0);return!1}_da1(e){return!!e[0]||!!this._opts.sixelSupport&&(this._report("[?62;4;9;22c"),!0)}_xtermGraphicsAttributes(e){var t,i,A,s,r,a;if(e.length<2)return!0;if(1===e[0])switch(e[1]){case 1:return this._report(`[?${e[0]};0;${this._opts.sixelPaletteLimit}S`),!0;case 2:this._opts.sixelPaletteLimit=this._defaultOpts.sixelPaletteLimit,this._report(`[?${e[0]};0;${this._opts.sixelPaletteLimit}S`);for(const e of this._handlers.values())e.reset();return!0;case 3:return e.length>2&&!(e[2]instanceof Array)&&e[2]<=4096?(this._opts.sixelPaletteLimit=e[2],this._report(`[?${e[0]};0;${this._opts.sixelPaletteLimit}S`)):this._report(`[?${e[0]};2S`),!0;case 4:return this._report(`[?${e[0]};0;4096S`),!0;default:return this._report(`[?${e[0]};2S`),!0}if(2===e[0])switch(e[1]){case 1:let n=null===(i=null===(t=this._renderer)||void 0===t?void 0:t.dimensions)||void 0===i?void 0:i.css.canvas.width,h=null===(s=null===(A=this._renderer)||void 0===A?void 0:A.dimensions)||void 0===s?void 0:s.css.canvas.height;if(!n||!h){const e=o.CELL_SIZE_DEFAULT;n=((null===(r=this._terminal)||void 0===r?void 0:r.cols)||80)*e.width,h=((null===(a=this._terminal)||void 0===a?void 0:a.rows)||24)*e.height}if(n*h<this._opts.pixelLimit)this._report(`[?${e[0]};0;${n.toFixed(0)};${h.toFixed(0)}S`);else{const t=Math.floor(Math.sqrt(this._opts.pixelLimit));this._report(`[?${e[0]};0;${t};${t}S`)}return!0;case 4:const g=Math.floor(Math.sqrt(this._opts.pixelLimit));return this._report(`[?${e[0]};0;${g};${g}S`),!0;default:return this._report(`[?${e[0]};2S`),!0}return this._report(`[?${e[0]};1S`),!0}}})(),A})());
  //# sourceMappingURL=addon-image.js.map
 \ No newline at end of file
 diff --git a/lib/addon-image.js.map b/lib/addon-image.js.map
-index 7a6ca6fc4405bd466272eac7d835a08b330f7be6..7a5eff4c47b4042eb1b4f72ec2283754988ca223 100644
+index 7a6ca6fc4405bd466272eac7d835a08b330f7be6..490d4c101a2f9d36f4e1d3727ec9714ae6255e0e 100644
 --- a/lib/addon-image.js.map
 +++ b/lib/addon-image.js.map
 @@ -1 +1 @@
 -{"version":3,"file":"addon-image.js","mappings":";CAAA,SAAAA,EAAAC,GACA,iBAAAC,SAAA,iBAAAC,OACAA,OAAAD,QAAAD,IACA,mBAAAG,QAAAA,OAAAC,IACAD,OAAA,GAAAH,GACA,iBAAAC,QACAA,QAAA,WAAAD,IAEAD,EAAA,WAAAC,GACC,CATD,CASCK,WAAA,uCCKD,SAAAC,EAAAC,GACA,WAAAA,CACA,CAEA,SAAAC,EAAAD,GACA,OAAAA,IAAA,KACA,CAEA,SAAAE,EAAAF,GACA,OAAAA,IAAA,MACA,CASA,SAAAG,EAAAC,EAAAC,EAAAC,EAAAC,EAAA,KACA,YAAAA,IAAA,QAAAD,IAAA,QAAAD,IAAA,MAAAD,KAAA,CACA,CAqCA,SAAAI,EAAAC,EAAAC,EAAAC,GACA,OAAAC,KAAAC,IAAAJ,EAAAG,KAAAE,IAAAH,EAAAD,GACA,CACA,SAAAK,EAAAC,EAAAC,EAAAC,GAKA,OAJAA,EAAA,IACAA,GAAA,GACAA,EAAA,IACAA,GAAA,GACA,EAAAA,EAAA,EACAD,EAAA,GAAAD,EAAAC,GAAAC,EACA,EAAAA,EAAA,EACAF,EACA,EAAAE,EAAA,EACAD,GAAAD,EAAAC,IAAA,IAAAC,GACAD,CACA,CAaA,SAAAE,EAAAf,EAAAC,EAAAC,GACA,kBAAAM,KAAAQ,MAAAd,EAAA,aAAAM,KAAAQ,MAAAf,EAAA,YAAAO,KAAAQ,MAAAhB,EAAA,aACA,CAjGAiB,OAAAC,eAAA5B,EAAA,cAA+CiB,OAAA,IAC/CjB,EAAA6B,mBAA6B7B,EAAA8B,mBAA6B9B,EAAA+B,iBAA2B/B,EAAAgC,mBAA6BhC,EAAAiC,oBAA8BjC,EAAAkC,aAAuBlC,EAAAyB,aAAuBzB,EAAAmC,kBAA4BnC,EAAAoC,aAAuBpC,EAAAS,WAAqBT,EAAAqC,MAAgBrC,EAAAQ,KAAeR,EAAAO,MAAgBP,EAAAK,IAAcL,EAAAsC,gBAAkB,EAGrVtC,EAAAsC,WAAkB,UAAAC,WAAA,IAAAC,YAAA,cAAAC,QAAA,GAClBzC,EAAAsC,YACAI,QAAAC,KAAA,+EAMA3C,EAAAK,IAAWA,EAIXL,EAAAO,MAAaA,EAIbP,EAAAQ,KAAYA,EAIZR,EAAAqC,MAHA,SAAA/B,GACA,OAAAA,IAAA,MACA,EAQAN,EAAAS,WAAkBA,EAOlBT,EAAAoC,aAHA,SAAAQ,GACA,WAAAA,EAAAA,GAAA,MAAAA,GAAA,OAAAA,IAAA,GACA,EA2BA5C,EAAAmC,kBArBA,SAAAS,EAAAC,GACA,MAAAnC,EAAAL,EAAAuC,GACAjC,EAAAJ,EAAAqC,GACAhC,EAAAJ,EAAAoC,GACA,IAAAxB,EAAA0B,OAAAC,iBACAC,GAAA,EAEA,QAAAC,EAAA,EAAoBA,EAAAJ,EAAAK,SAAoBD,EAAA,CACxC,MAAAE,EAAAzC,EAAAmC,EAAAI,GAAA,GACAG,EAAAzC,EAAAkC,EAAAI,GAAA,GACAI,EAAAzC,EAAAiC,EAAAI,GAAA,GACAK,EAAAH,EAAAA,EAAAC,EAAAA,EAAAC,EAAAA,EACA,IAAAC,EACA,OAAAL,EACAK,EAAAlC,IACAA,EAAAkC,EACAN,EAAAC,EAEA,CACA,OAAAD,CACA,EAmCAhD,EAAAyB,aAAoBA,EAQpBzB,EAAAkC,aAJA,SAAAqB,EAAAC,EAAAC,GAEA,OArBA,SAAAF,EAAAC,EAAAC,GACA,IAAAA,EAAA,CACA,MAAAC,EAAAxC,KAAAQ,MAAA,IAAA8B,GACA,OAAA/C,EAAAiD,EAAAA,EAAAA,EACA,CACA,MAAApC,EAAAkC,EAAA,GAAAA,GAAA,EAAAC,GAAAD,EAAAC,EAAAD,EAAAC,EACAlC,EAAA,EAAAiC,EAAAlC,EACA,OAAAb,EAAAK,EAAA,MAAAI,KAAAQ,MAAA,IAAAL,EAAAC,EAAAC,EAAAgC,EAAA,OAAAzC,EAAA,MAAAI,KAAAQ,MAAA,IAAAL,EAAAC,EAAAC,EAAAgC,KAAAzC,EAAA,MAAAI,KAAAQ,MAAA,IAAAL,EAAAC,EAAAC,EAAAgC,EAAA,OACA,CAaAI,EAAAJ,EAAA,SAAAC,EAAA,IAAAC,EAAA,IACA,EA+BAzD,EAAAiC,oBAA2B,IAAAO,YAAA,CAC3Bf,EAAA,OACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,YA0BAzB,EAAAgC,mBAA0B,IAAAQ,YAAA,CAC1Bf,EAAA,OACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,OACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,OACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,OACAA,EAAA,UACAA,EAAA,UACAA,EAAA,YAOAzB,EAAA+B,iBAAwB,MAExB,MAAA6B,EAAA,CACAnD,EAAA,OACAA,EAAA,SACAA,EAAA,SACAA,EAAA,WACAA,EAAA,SACAA,EAAA,WACAA,EAAA,WACAA,EAAA,aACAA,EAAA,aACAA,EAAA,SACAA,EAAA,SACAA,EAAA,WACAA,EAAA,WACAA,EAAA,WACAA,EAAA,WACAA,EAAA,cAGA6C,EAAA,uBACA,QAAA5C,EAAA,EAAoBA,EAAA,IAAOA,EAC3B,QAAAC,EAAA,EAAwBA,EAAA,IAAOA,EAC/B,QAAAC,EAAA,EAA4BA,EAAA,IAAOA,EACnCgD,EAAAC,KAAApD,EAAA6C,EAAA5C,GAAA4C,EAAA3C,GAAA2C,EAAA1C,KAKA,QAAA8C,EAAA,EAAoBA,GAAA,IAAUA,GAAA,GAC9BE,EAAAC,KAAApD,EAAAiD,EAAAA,EAAAA,IAEA,WAAAlB,YAAAoB,EACC,EAlCuB,GA0CxB5D,EAAA8B,mBAA0BrB,EAAA,WAC1BT,EAAA6B,mBAA0BpB,EAAA,6BCpP1BkB,OAAAC,eAAA5B,EAAA,cAA+CiB,OAAA,IAC/CjB,EAAA8D,YAAsB9D,EAAA+D,OAAiB/D,EAAAgE,QAAkBhE,EAAAiE,kBAAoB,EAC7E,MAAAC,EAAiBC,EAAQ,KACzBC,EAAeD,EAAQ,KAavBE,EAXA,SAAAZ,GACA,uBAAAa,OACA,OAAAA,OAAAC,KAAAd,EAAA,UAEA,MAAAe,EAAAC,KAAAhB,GACAiB,EAAA,IAAAnC,WAAAiC,EAAAtB,QACA,QAAAD,EAAA,EAAoBA,EAAAyB,EAAAxB,SAAmBD,EACvCyB,EAAAzB,GAAAuB,EAAAG,WAAA1B,GAEA,OAAAyB,CACA,CACAE,CAAAR,EAAAS,OAAAC,OACA,IAAAC,EAEA,MAAAC,EAAA,IAAAxC,YAEA,MAAAyC,EACA,WAAAC,GACAC,KAAAC,YAAAC,GAAA,EACAF,KAAAG,YAAAC,GAAA,CACA,CACA,WAAAC,CAAAH,GACA,OAAAF,KAAAC,YAAAC,EACA,CACA,WAAAI,CAAAF,GACA,OAAAJ,KAAAG,YAAAC,EACA,EAGA,MAAAG,EAAA,CACAC,YAAA,UACAC,WAAA1B,EAAArC,mBACAgE,UAAA3B,EAAApC,mBACAe,QAAAqB,EAAAjC,oBACA6D,aAAA1B,EAAAS,OAAAkB,aACAC,UAAA,GAMA,SAAA/B,EAAAgC,GACA,MAAAC,EAAA,IAAAjB,EACAkB,EAAA,CACAC,IAAA,CACAZ,YAAAU,EAAAV,YAAAa,KAAAH,GACAT,YAAAS,EAAAT,YAAAY,KAAAH,KAGA,OAAAI,YAAAC,YAAAxB,GAAAV,EAAA8B,GACAK,KAAAC,IACA1B,EAAAA,GAAA0B,EAAAxG,OACA,IAAA+D,EAAAiC,EAAAQ,EAAAC,UAAAD,EAAAP,IAEA,CACAlG,EAAAiE,aAAoBA,EAiCpB,MAAAD,EAKA,WAAAkB,CAAAe,EAAAU,EAAAC,GASA,GARAzB,KAAA0B,cAAAzC,EAAAS,OAAAiC,UAAA,EACA3B,KAAA4B,QAAA/B,EACAG,KAAA6B,YAAA,GACA7B,KAAA8B,UAAA,EACA9B,KAAA+B,UAAA9C,EAAAS,OAAAiC,UACA3B,KAAAgC,YAAA,EACAhC,KAAAiC,eAAA,EACAjC,KAAAkC,MAAA1F,OAAA2F,OAAA,GAAqC5B,EAAAO,GACrCd,KAAAkC,MAAAvB,aAAA1B,EAAAS,OAAAkB,aACA,UAAAwB,MAAA,+CAA2EnD,EAAAS,OAAAkB,gBAE3E,GAAAY,EAUAC,EAAAxB,YAAAD,KAAAqC,aAAAnB,KAAAlB,MACAyB,EAAAtB,YAAAH,KAAAsC,YAAApB,KAAAlB,UAXA,CACA,MAAAlF,EAAA8E,IAAAA,EAAA,IAAAuB,YAAAoB,OAAArD,IACAsC,EAAA,IAAAL,YAAAqB,SAAA1H,EAAA,CACAmG,IAAA,CACAZ,YAAAL,KAAAqC,aAAAnB,KAAAlB,MACAM,YAAAN,KAAAsC,YAAApB,KAAAlB,QAGA,CAKAA,KAAAwB,UAAAA,EACAxB,KAAAyC,MAAAzC,KAAAwB,UAAA3G,QACAmF,KAAA0C,OAAA,IAAAtF,WAAA4C,KAAAyC,MAAAE,OAAArF,OAAA0C,KAAAyC,MAAAG,oBAAA3D,EAAAS,OAAAmD,YACA7C,KAAA8C,QAAA,IAAAzF,YAAA2C,KAAAyC,MAAAE,OAAArF,OAAA0C,KAAAyC,MAAAM,oBAAA,IACA/C,KAAAgD,SAAA,IAAA3F,YAAA2C,KAAAyC,MAAAE,OAAArF,OAAA0C,KAAAyC,MAAAQ,sBAAAhE,EAAAS,OAAAkB,cACAZ,KAAAgD,SAAAE,IAAAlD,KAAAkC,MAAAxE,SACAsC,KAAAmD,MAAA,IAAA9F,YAAA2C,KAAAyC,MAAAE,OAAArF,OAAA0C,KAAAyC,MAAAW,kBACApD,KAAAyC,MAAAY,KAAAtE,EAAArC,mBAAA,EAAAsD,KAAAkC,MAAAvB,aAAA,EACA,CAEA,cAAA2C,GAAuB,OAAAtD,KAAA8C,QAAA,GACvB,aAAAS,GAAsB,OAAAvD,KAAA8C,QAAA,GACtB,gBAAAU,GAAyB,OAAAxD,KAAA8C,QAAA,GACzB,iBAAAW,GAA0B,OAAAzD,KAAA8C,QAAA,GAC1B,UAAAY,GAAmB,OAAA1D,KAAA8C,QAAA,GAAA9C,KAAA8C,QAAA,OACnB,WAAAa,GAAoB,OAAA3D,KAAA8C,QAAA,GACpB,UAAAc,GAAmB,OAAA5D,KAAA8C,QAAA,GACnB,SAAAe,GAAkB,OAAA7D,KAAA8C,QAAA,IAClB,iBAAAgB,GAA0B,OAAA9D,KAAA8C,QAAA,IAC1B,WAAAR,CAAAlC,GACA,OAAAA,EAAA,CACA,MAAA2D,EAAA/D,KAAAE,MAAAF,KAAAgE,OACA,GAAAD,EAAA/D,KAAA4B,QAAA7D,OAAA,CACA,GAAAiC,KAAAkC,MAAA1B,aAAA,EAAAuD,EAAA/D,KAAAkC,MAAA1B,YAEA,MADAR,KAAAiE,UACA,IAAA7B,MAAA,8BAEApC,KAAA4B,QAAA,IAAAvE,YAAA0G,EACA,CACA/D,KAAA8B,UAAA9B,KAAA0D,MACA,MACA,OAAAtD,EACA,OAAAJ,KAAA4D,OAAA,CAEA,MAAAG,EAAAhI,KAAAE,IAAA+D,KAAAwD,aAAAvE,EAAAS,OAAAiC,WAAA3B,KAAAyD,cACA,GAAAM,EAAA/D,KAAA4B,QAAA7D,OAAA,CACA,GAAAiC,KAAAkC,MAAA1B,aAAA,EAAAuD,EAAA/D,KAAAkC,MAAA1B,YAEA,MADAR,KAAAiE,UACA,IAAA7B,MAAA,8BAEApC,KAAA4B,QAAA,IAAAvE,YAAA0G,EACA,CACA,MAGA/D,KAAA4B,QAAA7D,OAAA,QACAiC,KAAA4B,QAAA,IAAAvE,YAAA,QAIA,QACA,CACA,QAAA6G,CAAAC,EAAAC,GACA,MAAAL,EAAAI,EAAAC,EACA,GAAAL,EAAA/D,KAAA4B,QAAA7D,OAAA,CACA,GAAAiC,KAAAkC,MAAA1B,aAAA,EAAAuD,EAAA/D,KAAAkC,MAAA1B,YAEA,MADAR,KAAAiE,UACA,IAAA7B,MAAA,8BAGA,MAAAiC,EAAA,IAAAhH,YAAA,MAAAtB,KAAAuI,KAAAP,EAAA,QACAM,EAAAnB,IAAAlD,KAAA4B,SACA5B,KAAA4B,QAAAyC,CACA,CACA,CACA,YAAAhC,CAAAnC,GACA,MAAAqE,EAAAvE,KAAA0B,cACA,IAAAyC,EAAAnE,KAAAgC,YACA,OAAAhC,KAAA6D,MAAA,CACA,IAAAW,EAAAxE,KAAAgE,OAAAhE,KAAAiC,eACA5F,EAAA,EACA,KAAAA,EAAA,GAAAmI,EAAA,GACAxE,KAAA4B,QAAAsB,IAAAlD,KAAAmD,MAAAsB,SAAAF,EAAAlI,EAAAkI,EAAAlI,EAAA6D,GAAAiE,EAAAjE,EAAA7D,GACAA,IACAmI,IAEAxE,KAAAgC,aAAA9B,EAAA7D,EACA2D,KAAAiC,gBAAA5F,CACA,MACA,OAAA2D,KAAA6D,MAAA,CACA7D,KAAAkE,SAAAC,EAAA,EAAAjE,GACAF,KAAA8B,UAAA/F,KAAAC,IAAAgE,KAAA8B,UAAA5B,GACAF,KAAA+B,UAAAhG,KAAAE,IAAA+D,KAAA+B,UAAA7B,GACA,QAAApC,EAAA,EAA4BA,EAAA,IAAOA,EACnCkC,KAAA4B,QAAAsB,IAAAlD,KAAAmD,MAAAsB,SAAAF,EAAAzG,EAAAyG,EAAAzG,EAAAoC,GAAAiE,EAAAjE,EAAApC,GAEAkC,KAAA6B,YAAAnD,KAAAwB,GACAF,KAAAgC,aAAA,EAAA9B,EACAF,KAAAiC,gBAAA,CACA,CACA,QACA,CAMA,SAAA/B,GACA,WAAAF,KAAA6D,MACA7D,KAAA0D,OACA3H,KAAAC,IAAAgE,KAAA8B,UAAA9B,KAAAyC,MAAAiC,gBACA,CAMA,UAAAV,GACA,WAAAhE,KAAA6D,MACA7D,KAAA2D,QACA3D,KAAAyC,MAAAiC,gBACA,EAAA1E,KAAA6B,YAAA9D,OAAAiC,KAAAyC,MAAAkC,iBACA,EAAA3E,KAAA6B,YAAA9D,MACA,CAIA,WAAAL,GACA,OAAAsC,KAAAgD,SAAAyB,SAAA,EAAAzE,KAAA8D,cACA,CAUA,eAAAc,GACA,OAAA5E,KAAA4B,QAAAiD,WAAA7E,KAAAyC,MAAAE,OAAArF,OAAAuH,WAAA,EAAA7E,KAAA6B,YAAA9D,MACA,CAIA,cAAA+G,GACA,OACA5E,MAAAF,KAAAE,MACA8D,OAAAhE,KAAAgE,OACA5D,KAAAJ,KAAA6D,MACAkB,MAAA/E,KAAA4D,OACA/C,WAAAb,KAAAuD,UACA5C,aAAAX,KAAA8D,cACApD,UAAAV,KAAAsD,WACA0B,SAAAhF,KAAA4E,YACAK,iBAAA,CACAC,UAAAlF,KAAA8C,QAAA,GACAqC,YAAAnF,KAAA8C,QAAA,GACA5C,MAAAF,KAAAwD,aACAQ,OAAAhE,KAAAyD,eAGA,CAMA,IAAAJ,CAAA3C,EAAAV,KAAAkC,MAAAxB,UAAAhD,EAAAsC,KAAAkC,MAAAxE,QAAAiD,EAAAX,KAAAkC,MAAAvB,aAAAE,EAAAb,KAAAkC,MAAArB,UACAb,KAAAyC,MAAAY,KAAArD,KAAAkC,MAAAzB,WAAAC,EAAAC,EAAAE,EAAA,KACAnD,GACAsC,KAAAgD,SAAAE,IAAAxF,EAAA+G,SAAA,EAAAxF,EAAAS,OAAAkB,eAEAZ,KAAA6B,YAAA9D,OAAA,EACAiC,KAAA8B,UAAA,EACA9B,KAAA+B,UAAA9C,EAAAS,OAAAiC,UACA3B,KAAAgC,YAAA,EACAhC,KAAAiC,eAAA,CACA,CAKA,MAAArD,CAAAwG,EAAAC,EAAA,EAAAC,EAAAF,EAAArH,QACA,IAAAU,EAAA4G,EACA,KAAA5G,EAAA6G,GAAA,CACA,MAAAvH,EAAAhC,KAAAE,IAAAqJ,EAAA7G,EAAAQ,EAAAS,OAAAmD,YACA7C,KAAA0C,OAAAQ,IAAAkC,EAAAX,SAAAhG,EAAAA,GAAAV,IACAiC,KAAAyC,MAAA7D,OAAA,EAAAb,EACA,CACA,CAMA,YAAAwH,CAAAH,EAAAC,EAAA,EAAAC,EAAAF,EAAArH,QACA,IAAAU,EAAA4G,EACA,KAAA5G,EAAA6G,GAAA,CACA,MAAAvH,EAAAhC,KAAAE,IAAAqJ,EAAA7G,EAAAQ,EAAAS,OAAAmD,YACA,QAAA/E,EAAA,EAAA0H,EAAA/G,EAAmCX,EAAAC,IAAYD,IAAA0H,EAC/CxF,KAAA0C,OAAA5E,GAAAsH,EAAA5F,WAAAgG,GAEA/G,GAAAV,EACAiC,KAAAyC,MAAA7D,OAAA,EAAAb,EACA,CACA,CAKA,UAAA0H,GACA,OAAAzF,KAAA6D,QAAA7D,KAAAE,QAAAF,KAAAgE,OACA,OAAAnE,EAGA,MAAA6F,EAAA1F,KAAAyC,MAAAiC,gBACA,OAAA1E,KAAA6D,MAAA,CACA,IAAAW,EAAAxE,KAAAgE,OAAAhE,KAAAiC,eACA,GAAAuC,EAAA,GACA,MAAAD,EAAAvE,KAAA0B,cACA,IAAAyC,EAAAnE,KAAAgC,YACA3F,EAAA,EACA,KAAAA,EAAA,GAAAmI,EAAA,GACAxE,KAAA4B,QAAAsB,IAAAlD,KAAAmD,MAAAsB,SAAAF,EAAAlI,EAAAkI,EAAAlI,EAAAqJ,GAAAvB,EAAAuB,EAAArJ,GACAA,IACAmI,IAEAA,GACAxE,KAAA4B,QAAA+D,KAAA3F,KAAAsD,WAAAa,EAAAuB,EAAArJ,EAEA,CACA,OAAA2D,KAAA4B,QAAA6C,SAAA,EAAAzE,KAAAE,MAAAF,KAAAgE,OACA,CACA,OAAAhE,KAAA6D,MAAA,CACA,GAAA7D,KAAA+B,YAAA/B,KAAA8B,UAAA,CACA,IAAA8D,GAAA,EACA,GAAAF,EACA,GAAAA,IAAA1F,KAAA+B,UACA6D,GAAA,MAEA,CACA,MAAArB,EAAAvE,KAAA0B,cACA,IAAAyC,EAAAnE,KAAAgC,YACAhC,KAAAkE,SAAAC,EAAA,EAAAuB,GACA,QAAA5H,EAAA,EAAwCA,EAAA,IAAOA,EAC/CkC,KAAA4B,QAAAsB,IAAAlD,KAAAmD,MAAAsB,SAAAF,EAAAzG,EAAAyG,EAAAzG,EAAA4H,GAAAvB,EAAAuB,EAAA5H,EAEA,CAEA,IAAA8H,EACA,OAAA5F,KAAA4B,QAAA6C,SAAA,EAAAzE,KAAAE,MAAAF,KAAAgE,OAEA,CAGA,MAAA6B,EAAA,IAAAxI,YAAA2C,KAAAE,MAAAF,KAAAgE,QACA6B,EAAAF,KAAA3F,KAAAsD,YACA,IAAAwC,EAAA,EACAT,EAAA,EACA,QAAAvH,EAAA,EAA4BA,EAAAkC,KAAA6B,YAAA9D,SAA6BD,EAAA,CACzD,MAAAiI,EAAA/F,KAAA6B,YAAA/D,GACA,QAAAW,EAAA,EAAgCA,EAAA,IAAOA,EACvCoH,EAAA3C,IAAAlD,KAAA4B,QAAA6C,SAAAY,EAAAA,GAAAU,GAAAD,GACAA,GAAA9F,KAAAE,KAEA,CAEA,GAAAwF,EAAA,CACA,MAAAnB,EAAAvE,KAAA0B,cAEAsE,EAAAhG,KAAAyC,MAAAkC,iBACA,QAAA7G,EAAA,EAAgCA,EAAAkI,IAAmBlI,EACnD+H,EAAA3C,IAAAlD,KAAAmD,MAAAsB,SAAAF,EAAAzG,EAAAyG,EAAAzG,EAAA4H,GAAAI,EAAA9F,KAAAE,MAAApC,EAEA,CACA,OAAA+H,CACA,CAEA,OAAAhG,CACA,CAKA,SAAAoG,GACA,WAAAC,kBAAAlG,KAAAyF,OAAAnI,OAAA,EAAA0C,KAAAE,MAAAF,KAAAgE,OAAA,EACA,CAaA,OAAAC,GACAjE,KAAA4B,QAAA/B,EACAG,KAAA6B,YAAA9D,OAAA,EACAiC,KAAA8B,UAAA,EACA9B,KAAA+B,UAAA9C,EAAAS,OAAAiC,UAGA3B,KAAAyC,MAAAY,KAAAtE,EAAArC,mBAAA,EAAAsD,KAAAkC,MAAAvB,aAAA,EACA,EAEA9F,EAAAgE,QAAeA,EAyBfhE,EAAA+D,OAXA,SAAAwG,EAAAtE,GACA,MAAAqF,EAAA,IAAAtH,EAAAiC,GAGA,OAFAqF,EAAA9C,OACA,iBAAA+B,EAAAe,EAAAZ,aAAAH,GAAAe,EAAAvH,OAAAwG,GACA,CACAlF,MAAAiG,EAAAjG,MACA8D,OAAAmC,EAAAnC,OACAyB,OAAAU,EAAAV,OACAQ,MAAAE,EAAAF,MAEA,EAkBApL,EAAA8D,YAXAyH,eAAAhB,EAAAtE,GACA,MAAAqF,QAAArH,EAAAgC,GAGA,OAFAqF,EAAA9C,OACA,iBAAA+B,EAAAe,EAAAZ,aAAAH,GAAAe,EAAAvH,OAAAwG,GACA,CACAlF,MAAAiG,EAAAjG,MACA8D,OAAAmC,EAAAnC,OACAyB,OAAAU,EAAAV,OACAQ,MAAAE,EAAAF,MAEA,YCpdAzJ,OAAAC,eAAA5B,EAAA,cAA+CiB,OAAA,IAC/CjB,EAAA6E,YAAc,EACd7E,EAAA6E,OAAc,CACdmD,WAAA,MACAjC,aAAA,KACAe,UAAA,MACAhC,MAAA,+qdCCA,MAAA0G,EAAArH,EAAA,KAoEA,IAAiBsH,YA9DjB,iBAAAvG,GACUC,KAAAuG,WAAqD,GACrDvG,KAAAwG,WAAY,CA0DtB,CAvDE,SAAWC,GACT,OAAIzG,KAAK0G,SAGT1G,KAAK0G,OAAS,CAACC,EAAyBC,EAAgBC,KACtD,GAAI7G,KAAKwG,UACP,OAAO,EAAAH,EAAAS,cAAa,QAGtB,MAAMC,EAAQ,CAAEC,GAAIL,EAAUC,YAC9B5G,KAAKuG,WAAavG,KAAKuG,WAAWU,QAClCjH,KAAKuG,WAAW7H,KAAKqI,GAErB,MAAMxH,GAAS,EAAA8G,EAAAS,cAAa,KAC1B,MAAMjJ,EAAMmC,KAAKuG,WAAWW,QAAQH,IACvB,IAATlJ,IACFmC,KAAKuG,WAAavG,KAAKuG,WAAWU,QAClCjH,KAAKuG,WAAWY,OAAOtJ,EAAK,MAYhC,OARIgJ,IACEO,MAAMC,QAAQR,GAChBA,EAAYnI,KAAKa,GAEjBsH,EAAYS,IAAI/H,IAIbA,IA3BAS,KAAK0G,MA8BhB,CAEO,IAAAa,CAAKd,GACV,GAAIzG,KAAKwG,YAAcxG,KAAKuG,WAAWxI,OACrC,OAEF,GAA+B,IAA3BiC,KAAKuG,WAAWxI,OAElB,YADAiC,KAAKuG,WAAW,GAAGS,GAAGQ,KAAKxH,KAAKuG,WAAW,GAAGK,SAAUH,GAG1D,MAAMgB,EAAYzH,KAAKuG,WACvB,IAAK,IAAIzI,EAAI,EAAG4J,EAAMD,EAAU1J,OAAQD,EAAI4J,IAAO5J,EACjD2J,EAAU3J,GAAGkJ,GAAGQ,KAAKC,EAAU3J,GAAG8I,SAAUH,EAEhD,CAEO,OAAAkB,GACD3H,KAAKwG,YAGTxG,KAAKwG,WAAY,EACjBxG,KAAKuG,WAAWxI,OAAS,EAC3B,GAGF,SAAiBuI,GACCA,EAAAsB,QAAhB,SAA2BxI,EAAiByI,GAC1C,OAAOzI,EAAK0I,GAAKD,EAAGN,KAAKO,GAC3B,EAEgBxB,EAAAyB,IAAhB,SAA0BtB,EAAkBsB,GAC1C,MAAO,CAACpB,EAAyBC,EAAgBC,IACxCJ,EAAM3I,GAAK6I,EAASa,KAAKZ,EAAUmB,EAAIjK,SAAKkK,EAAWnB,EAElE,EAIgBP,EAAA2B,IAAhB,YAA0BC,GACxB,MAAO,CAACvB,EAAyBC,EAAgBC,KAC/C,MAAMsB,EAAQ,IAAI9B,EAAA+B,gBAClB,IAAK,MAAM3B,KAASyB,EAClBC,EAAMb,IAAIb,EAAMqB,GAAKnB,EAASa,KAAKZ,EAAUkB,KAS/C,OAPIjB,IACEO,MAAMC,QAAQR,GAChBA,EAAYnI,KAAKyJ,GAEjBtB,EAAYS,IAAIa,IAGbA,EAEX,EAIgB7B,EAAA+B,gBAAhB,SAAmC5B,EAAkB6B,EAAqCC,GAExF,OADAD,EAAQC,GACD9B,EAAMqB,GAAKQ,EAAQR,GAC5B,CACD,CApCD,CAAiBxB,IAAUzL,EAAAyL,WAAVA,EAAU,eChE3B,SAAAQ,EAA6BE,GAC3B,MAAO,CAAEW,QAASX,EACpB,CAKA,SAAAW,EAA+Ca,GAC7C,IAAKA,EACH,OAAOA,EAET,GAAIpB,MAAMC,QAAQmB,GAAM,CACtB,IAAK,MAAMrK,KAAKqK,EACdrK,EAAEwJ,UAEJ,MAAO,EACT,CAEA,OADAa,EAAIb,UACGa,CACT,8JAEA,YAAsC3B,GACpC,OAAOC,EAAa,IAAMa,EAAQd,GACpC,EAEA,MAAAuB,EAAA,WAAArI,GACmBC,KAAAyI,aAAe,IAAIC,IAC5B1I,KAAA2I,aAAc,CAgCxB,CA9BE,cAAWC,GACT,OAAO5I,KAAK2I,WACd,CAEO,GAAArB,CAA2BuB,GAMhC,OALI7I,KAAK2I,YACPE,EAAElB,UAEF3H,KAAKyI,aAAanB,IAAIuB,GAEjBA,CACT,CAEO,OAAAlB,GACL,IAAI3H,KAAK2I,YAAT,CAGA3I,KAAK2I,aAAc,EACnB,IAAK,MAAMxK,KAAK6B,KAAKyI,aACnBtK,EAAEwJ,UAEJ3H,KAAKyI,aAAaK,OALlB,CAMF,CAEO,KAAAA,GACL,IAAK,MAAM3K,KAAK6B,KAAKyI,aACnBtK,EAAEwJ,UAEJ3H,KAAKyI,aAAaK,OACpB,sBAGF,MAAAC,EAAA,WAAAhJ,GAGqBC,KAAAgJ,OAAS,IAAIZ,CASlC,CAPS,OAAAT,GACL3H,KAAKgJ,OAAOrB,SACd,CAEU,SAAAsB,CAAiCJ,GACzC,OAAO7I,KAAKgJ,OAAO1B,IAAIuB,EACzB,iBAVuBE,EAAAG,KAAoB1M,OAAO2M,OAAO,CAAE,OAAAxB,GAAY,wBAazE,iBAAA5H,GAEUC,KAAA2I,aAAc,CAuBxB,CArBE,SAAW7M,GACT,OAAOkE,KAAK2I,iBAAcX,EAAYhI,KAAKoJ,MAC7C,CAEA,SAAWtN,CAAMA,GACXkE,KAAK2I,aAAe7M,IAAUkE,KAAKoJ,SAGvCpJ,KAAKoJ,QAAQzB,UACb3H,KAAKoJ,OAAStN,EAChB,CAEO,KAAAgN,GACL9I,KAAKlE,WAAQkM,CACf,CAEO,OAAAL,GACL3H,KAAK2I,aAAc,EACnB3I,KAAKoJ,QAAQzB,UACb3H,KAAKoJ,YAASpB,CAChB,wKC1GF,MAAAqB,EAAArK,EAAA,KAEAsK,EAAAtK,EAAA,KACAuK,EAAAC,EAAAxK,EAAA,MACAyK,EAAAD,EAAAxK,EAAA,KACA0K,EAAA1K,EAAA,KACA2K,EAAA3K,EAAA,KAaM4K,EAAgC,CACpCC,KAAI,EACJC,KAAM,eACNC,KAAM,EACN7J,MAAO,OACP8D,OAAQ,OACRgG,oBAAqB,EACrBC,OAAQ,gBAIV,MASE,WAAAlK,CACmBmC,EACAgI,EACAC,EACAC,GAHApK,KAAAkC,MAAAA,EACAlC,KAAAkK,UAAAA,EACAlK,KAAAmK,SAAAA,EACAnK,KAAAoK,cAAAA,EAZXpK,KAAAqK,UAAW,EACXrK,KAAAsK,IAAM,IAAIZ,EAAAa,aACVvK,KAAAwK,QAAyBZ,EAGzB5J,KAAAyK,cAAe,EACfzK,KAAA0K,aAAc,EAQpB,MAAMC,EAAkB5O,KAAKuI,KAA+B,EAA1BtE,KAAKkC,MAAM0I,aAAmB,GAC1DC,EAAe9O,KAAKE,IAAG,QAA4B0O,GACzD3K,KAAK8K,KAAO,IAAIvB,EAAAwB,QAAa,QAAyBJ,EAAiBE,GACvE7K,KAAKgL,QAAU,IAAIvB,EAAAsB,QAAU,QAC/B,CAEO,KAAAE,GACLjL,KAAKsK,IAAIW,QACTjL,KAAK8K,KAAK7G,UACVjE,KAAKgL,QAAQ/G,SACf,CAEO,KAAAoB,GACLrF,KAAKqK,UAAW,EAChBrK,KAAKsK,IAAIW,OACX,CAEO,GAAAC,CAAI9F,EAAmBC,EAAeC,GAC3C,IAAItF,KAAKqK,SAET,GAAkB,IAAdrK,KAAKsK,IAAIa,MAC6C,IAAnDnL,KAAK8K,KAAKI,IAAI9F,EAAKX,SAASY,EAAOC,MACtCtF,KAAK8K,KAAK7G,UACVjE,KAAKqK,UAAW,OAEb,CACL,MAAMe,EAAUpL,KAAKsK,IAAIe,MAAMjG,EAAMC,EAAOC,GAC5C,IAAiB,IAAb8F,EAEF,YADApL,KAAKqK,UAAW,GAGlB,GAAIe,EAAU,EAAG,CAEf,GAAW,IADKpL,KAAKsK,IAAIgB,OAAOzB,KACG,CAOjC,GANI7J,KAAKyK,eACPzK,KAAKyK,cAAe,EACpBzK,KAAK0K,aAAc,EACnB1K,KAAK8K,KAAK7G,WAEZjE,KAAKwK,QAAUhO,OAAO2F,OAAO,GAAIyH,EAAgB5J,KAAKsK,IAAIgB,SACrDtL,KAAKwK,QAAQP,OAEhB,YADAjK,KAAKqK,UAAW,GAGlBrK,KAAK8K,KAAKzH,MACZ,MAAO,GAAIrD,KAAK0K,YAEd,YADA1K,KAAKqK,UAAW,GAGwC,IAArDrK,KAAK8K,KAAKI,IAAI9F,EAAKX,SAAS2G,EAAS9F,MACxCtF,KAAK8K,KAAK7G,UACVjE,KAAKqK,UAAW,EACZrK,KAAKyK,eAAczK,KAAK0K,aAAc,GAE9C,CACF,CACF,CAEO,GAAApF,CAAIiG,aACT,GAAIvL,KAAKqK,SAAU,OAAO,EAE1B,GAAkB,IAAdrK,KAAKsK,IAAIa,OACPnL,KAAKsK,IAAIhF,MAAO,OAAO,EAE7B,MAAMkG,EAAUxL,KAAKsK,IAAIgB,OAAOzB,KAEhC,GAAW,IAAP2B,EAAmC,OAAO,EAE9C,GAAW,IAAPA,EAAyC,CAE3C,IAAIC,EAAInC,EAAAoC,kBAAkBxL,MACtB9B,EAAIkL,EAAAoC,kBAAkB1H,OACtBhE,KAAKkK,UAAUyB,aACjBF,EAAIzL,KAAKkK,UAAUyB,WAAWC,IAAIC,OAAO3L,MAAQF,KAAKoK,cAAc0B,KACpE1N,EAAI4B,KAAKkK,UAAUyB,WAAWC,IAAIC,OAAO7H,OAAShE,KAAKoK,cAAc2B,MAEvE,MAAMC,EAAyD,QAApDC,EAA+C,QAA5CC,EAAAlM,KAAKoK,cAAc+B,MAAMC,2BAAmB,IAAAF,OAAA,EAAAA,EAAEG,WAAG,IAAAJ,EAAAA,EAAI,EAC7DK,EAAS,yBAA4BlO,EAAEmO,QAAQ,MAAMd,EAAEc,QAAQ,MAAMP,EAAMO,QAAQ,QAEzF,OADAvM,KAAKoK,cAAcoC,MAAMF,GAAQ,IAC1B,CACT,CAEA,GAAW,IAAPd,EAMF,OALAxL,KAAKwK,QAAUhO,OAAO2F,OAAO,GAAIyH,EAAgB5J,KAAKsK,IAAIgB,QAC1DtL,KAAKyK,cAAe,EACpBzK,KAAK0K,aAAc,EACnB1K,KAAK8K,KAAK7G,UACVjE,KAAK8K,KAAKzH,QACH,EAGT,GAAW,IAAPmI,EAAkC,CACpC,IAAKxL,KAAKyK,aAAc,OAAO,EAE/B,GADAzK,KAAKyK,cAAe,EAChBzK,KAAK0K,aAAgC,IAAjB1K,KAAKwK,QAAQX,KAAqC,OAAO,CACnF,CAIA,IAII4C,EA0BAC,EA9BAjB,EAAI,EACJrN,EAAI,EAIJuO,EAAUhD,EAAAiD,iBAoBd,IAnBIH,EAAOlB,MACLkB,GAAQzM,KAAK8K,KAAKxF,QACpBqH,GAAU,EAAAhD,EAAAkD,WAAU7M,KAAK8K,KAAK7E,QAC1BwG,EAAwB,gBAAjBE,EAAQG,OACjBrB,EAAIkB,EAAQzM,MACZ9B,EAAIuO,EAAQ3I,QACRyI,EAAOhB,GAAKrN,GAAKqN,EAAIrN,EAAI4B,KAAKkC,MAAM6K,cACrCtB,EAAGrN,GAAK4B,KAAKgN,QAAQvB,EAAGrN,GAAG2J,IAAIhM,KAAKkR,OACrCR,EAAOhB,GAAKrN,GAAKqN,EAAIrN,EAAI4B,KAAKkC,MAAM6K,YAEpCxP,QAAQC,KAAK,8BAA8BmP,EAAQzM,SAASyM,EAAQ3I,WAGtEzG,QAAQC,KAAK,gCAGfD,QAAQC,KAAK,uCAGZiP,EAEH,OADAzM,KAAK8K,KAAK7G,WACH,EAIT,GAAqB,cAAjB0I,EAAQG,KAAsB,CAChC,MAAM1H,EAAOpF,KAAKgL,QAAQpM,OAAOoB,KAAK8K,KAAK7E,OAO3C,GANAyG,EAAO,IAAIQ,UACT,IAAIhH,kBAAkBd,EAAK9H,OAAQ8H,EAAK+H,WAAY/H,EAAKP,YACzD7E,KAAKgL,QAAQ9K,MACbF,KAAKgL,QAAQhH,QAEfhE,KAAKgL,QAAQ/G,UACTwH,IAAMzL,KAAKgL,QAAQ9K,OAAS9B,IAAM4B,KAAKgL,QAAQhH,OAAQ,CAEzDhE,KAAK8K,KAAK7G,UACV,MAAM4H,EAASxC,EAAA+D,cAAcC,kBAAarF,EAAWhI,KAAKgL,QAAQ9K,MAAOF,KAAKgL,QAAQhH,QAGtF,OAFuB,QAAvBsJ,EAAAzB,EAAO0B,WAAW,aAAK,IAAAD,GAAAA,EAAEE,aAAad,EAAM,EAAG,GAC/C1M,KAAKmK,SAASsD,SAAS5B,IAChB,CACT,CACF,MACEa,EAAO,IAAIgB,KAAK,CAAC1N,KAAK8K,KAAK7E,OAAQ,CAAE4D,KAAM8C,EAAQG,OAGrD,OADA9M,KAAK8K,KAAK7G,UACH0J,kBAAkBjB,EAAM,CAAEkB,YAAanC,EAAGoC,aAAczP,IAC5DiD,KAAKyM,IACJ9N,KAAKmK,SAASsD,SAASK,IAChB,IAERC,MAAMjG,IACLvK,QAAQC,KAAK,uBAAuBmP,EAAQG,QAAQH,EAAQzM,SAASyM,EAAQ3I,SAAU8D,IAChF,GAEb,CAEQ,OAAAkF,CAAQvB,EAAWrN,eACzB,MAAM4P,GAA8B,QAAzB9B,EAAAlM,KAAKkK,UAAUyB,kBAAU,IAAAO,OAAA,EAAAA,EAAEN,IAAIqC,KAAK/N,QAASoJ,EAAAoC,kBAAkBxL,MACpEgO,GAA8B,QAAzBZ,EAAAtN,KAAKkK,UAAUyB,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIqC,KAAKjK,SAAUsF,EAAAoC,kBAAkB1H,OACrE9D,GAAiC,QAAzB+L,EAAAjM,KAAKkK,UAAUyB,kBAAU,IAAAM,OAAA,EAAAA,EAAEL,IAAIC,OAAO3L,QAAS8N,EAAKhO,KAAKoK,cAAc0B,KAC/E9H,GAAkC,QAAzBmK,EAAAnO,KAAKkK,UAAUyB,kBAAU,IAAAwC,OAAA,EAAAA,EAAEvC,IAAIC,OAAO7H,SAAUkK,EAAKlO,KAAKoK,cAAc2B,KAEjFqC,EAAKpO,KAAKqO,KAAKrO,KAAKwK,QAAQtK,MAAQA,EAAO8N,GAC3CM,EAAKtO,KAAKqO,KAAKrO,KAAKwK,QAAQxG,OAASA,EAAQkK,GACnD,IAAKE,IAAOE,EAAI,CACd,MAAMC,EAAKrO,EAAQuL,EACb+C,GAAMxK,EAASkK,GAAM9P,EACrBqQ,EAAI1S,KAAKE,IAAIsS,EAAIC,GACvB,OAAOC,EAAI,EAAI,CAAChD,EAAIgD,EAAGrQ,EAAIqQ,GAAK,CAAChD,EAAGrN,EACtC,CACA,OAAQgQ,GAEJpO,KAAKwK,QAAQR,qBAAwBoE,GAAOE,EACvB,CAACF,EAAIE,GAAxB,CAACF,EAAIhQ,EAAIgQ,EAAK3C,GAFhB,CAACA,EAAI6C,EAAKlQ,EAAGkQ,EAGnB,CAEQ,IAAAD,CAAK/P,EAAWoQ,EAAeC,GACrC,MAAU,SAANrQ,EAAqB,EACrBA,EAAEsQ,SAAS,KAAaC,SAASvQ,EAAE2I,MAAM,GAAI,GAAI,IAAMyH,EAAQ,IAC/DpQ,EAAEsQ,SAAS,MAAcC,SAASvQ,EAAE2I,MAAM,GAAI,GAAI,IAC/C4H,SAASvQ,EAAG,IAAMqQ,CAC3B,aCxLF,SAASG,EAAM1J,GACb,IAAI9G,EAAI,GACR,IAAK,IAAIR,EAAI,EAAGA,EAAIsH,EAAKrH,SAAUD,EACjCQ,GAAKyQ,OAAOC,aAAa5J,EAAKtH,IAEhC,OAAOQ,CACT,CAGA,SAAS2Q,EAAM7J,GACb,IAAI7G,EAAI,EACR,IAAK,IAAIT,EAAI,EAAGA,EAAIsH,EAAKrH,SAAUD,EAAG,CACpC,GAAIsH,EAAKtH,GAAK,IAAMsH,EAAKtH,GAAK,GAC5B,MAAM,IAAIsE,MAAM,gBAElB7D,EAAQ,GAAJA,EAAS6G,EAAKtH,GAAK,EACzB,CACA,OAAOS,CACT,CAGA,SAAS2Q,EAAO9J,GACd,MAAM7G,EAAIuQ,EAAM1J,GAChB,IAAK7G,EAAE4Q,MAAM,oCACX,MAAM,IAAI/M,MAAM,gBAElB,OAAO7D,CACT,wEAeA,MAAM6Q,EAAiE,CACrEnF,OAAQgF,EACRlF,KAAMkF,EACNnF,KAfF,SAAgB1E,GACd,GAAsB,oBAAXjG,OACT,OAAOA,OAAOC,KAAK0P,EAAM1J,GAAO,UAAUiK,WAE5C,MAAMC,EAAKhQ,KAAKwP,EAAM1J,IAChB3J,EAAI,IAAI2B,WAAWkS,EAAGvR,QAC5B,IAAK,IAAID,EAAI,EAAGA,EAAIrC,EAAEsC,SAAUD,EAC9BrC,EAAEqC,GAAKwR,EAAG9P,WAAW1B,GAEvB,OAAO,IAAIyR,aAAc3Q,OAAOnD,EAClC,EAMEyE,MAAOgP,EACPlL,OAAQkL,EACRlF,oBAAqBiF,GAMjBO,EAAc,CAAC,GAAI,IAAK,IAAK,KAE7BC,EAAuB,CAAC,GAAI,IAAK,IAAK,IAAK,IAAK,IAAK,GAAI,IAAK,IAAK,GAAI,IAAK,IAAK,KAEjFC,EAAkB,CAAC,GAAI,IAAK,IAAK,IAAK,GAAI,GAAI,IAAK,KAEnDC,EAAiB,CAAC,GAAI,IAAK,IAAK,IAAK,GAAI,IAAK,KAE9CC,EAAwB,CAAC,GAAI,IAAK,IAAK,IAAK,IAAK,IAAK,GAAI,IAAK,IAAK,IAAK,GAAI,IAAK,IAAK,KAGvFC,EAAiB,oBAGvB,iBAAA9P,GACSC,KAAAmL,MAAK,EACJnL,KAAA8P,QAAU,IAAIzS,YAAYwS,GAC1B7P,KAAA+P,UAAY,EACZ/P,KAAAgQ,KAAO,GACRhQ,KAAAsL,OAA4E,EAwIrF,CAtIS,KAAAL,GACLjL,KAAK8P,QAAQnK,KAAK,GAClB3F,KAAKmL,MAAK,EACVnL,KAAK+P,UAAY,EACjB/P,KAAKsL,OAAS,GACdtL,KAAKgQ,KAAO,EACd,CAEO,GAAA1K,GACL,GAAc,IAAVtF,KAAKmL,MAA6B,CACpC,GAAInL,KAAK+P,YAAcJ,EAAe5R,OAAQ,CAC5C,IAAK,IAAIkS,EAAI,EAAGA,EAAIN,EAAe5R,SAAUkS,EAC3C,GAAIjQ,KAAK8P,QAAQG,KAAON,EAAeM,GAAI,OAAOjQ,KAAKkM,KAIzD,OAFAlM,KAAKsL,OAAa,KAAC,EACnBtL,KAAKmL,MAAK,EACH,CACT,CACA,GAAInL,KAAK+P,YAAcH,EAAsB7R,OAAQ,CACnD,IAAK,IAAIkS,EAAI,EAAGA,EAAIL,EAAsB7R,SAAUkS,EAClD,GAAIjQ,KAAK8P,QAAQG,KAAOL,EAAsBK,GAAI,OAAOjQ,KAAKkM,KAIhE,OAFAlM,KAAKsL,OAAa,KAAC,EACnBtL,KAAKmL,MAAK,EACH,CACT,CACA,OAAOnL,KAAKkM,IACd,CACA,OAAc,IAAVlM,KAAKmL,MAAkC,EAC7B,IAAVnL,KAAKmL,OACY,IAAhBnL,KAAKsL,OAAOzB,MAEV7J,KAAKkQ,YAAYlQ,KAAK+P,YAC3B/P,KAAKmL,MAAK,EACH,GAEFnL,KAAKkM,IACd,CAEO,KAAAb,CAAMjG,EAAmBC,EAAeC,GAC7C,IAAI6F,EAAQnL,KAAKmL,MACbgF,EAAMnQ,KAAK+P,UACf,MAAMzS,EAAS0C,KAAK8P,QACpB,GAAS,IAAL3E,GAAoC,IAALA,EAA2B,OAAQ,EACtE,GAAS,IAALA,GAA+BgF,EAAM,GAAI,OAAQ,EACrD,IAAK,IAAIrS,EAAIuH,EAAOvH,EAAIwH,IAAOxH,EAAG,CAChC,MAAMzB,EAAI+I,EAAKtH,GACf,OAAQzB,GACN,KAAK,GACH,IAAK2D,KAAKkQ,YAAYC,GAAM,OAAOnQ,KAAKkM,KACxCf,EAAK,EACLgF,EAAM,EACN,MACF,KAAK,GACH,GAAS,IAALhF,EAA6B,CAC/B,GAAkB,KAAd7N,EAAO,GAAW,CAEpB,IAAI2S,EAAI,EACR,KAAOA,EAAIT,EAAYzR,SAAUkS,EAC/B,GAAI3S,EAAO2S,KAAOT,EAAYS,GAAI,OAAOjQ,KAAKkM,KAGhD,GADAlM,KAAKsL,OAAa,KAAC,EACf6E,IAAQT,EAAgB3R,OAAQ,CAClC,KAAOkS,EAAIP,EAAgB3R,SAAUkS,EACnC,GAAI3S,EAAO2S,KAAOP,EAAgBO,GAAI,OAAOjQ,KAAKkM,KAIpD,OAFAlM,KAAKsL,OAAa,KAAC,EACnBtL,KAAKmL,MAAK,EACHrN,EAAI,CACb,CACF,KAAO,IAAkB,KAAdR,EAAO,GAOhB,OAAO0C,KAAKkM,KALZ,IAAK,IAAI+D,EAAI,EAAGA,EAAIR,EAAqB1R,SAAUkS,EACjD,GAAI3S,EAAO2S,KAAOR,EAAqBQ,GAAI,OAAOjQ,KAAKkM,KAEzDlM,KAAKsL,OAAa,KAAC,CAGrB,CACAH,EAAK,EACLgF,EAAM,CACR,MAAO,GAAS,IAALhF,EAA2B,CACpC,IAAKnL,KAAKoQ,UAAUD,GAAM,OAAOnQ,KAAKkM,KACtCf,EAAK,EACLgF,EAAM,CACR,MAAO,GAAS,IAALhF,EAA6B,CACtC,GAAIgF,GAAON,EAAgB,OAAO7P,KAAKkM,KACvC5O,EAAO6S,KAAS9T,CAClB,CACA,MACF,KAAK,GACH,OAAS,IAAL8O,GACGnL,KAAKkQ,YAAYC,IAExBnQ,KAAKmL,MAAK,EACHrN,EAAI,GAH0BkC,KAAKkM,KAI5C,QACE,GAAIiE,GAAON,EAAgB,OAAO7P,KAAKkM,KACvC5O,EAAO6S,KAAS9T,EAEtB,CAGA,OAFA2D,KAAKmL,MAAQA,EACbnL,KAAK+P,UAAYI,GACT,CACV,CAEQ,EAAAjE,GAGN,OAFAlM,KAAKsL,OAAOzB,KAAI,EAChB7J,KAAKmL,MAAK,GACF,CACV,CAEQ,SAAAiF,CAAUD,GAChB,MAAMF,EAAInB,EAAM9O,KAAK8P,QAAQrL,SAAS,EAAG0L,IACzC,QAAIF,IACFjQ,KAAKgQ,KAAOC,EACZjQ,KAAKsL,OAAO2E,GAAK,MACV,EAGX,CAEQ,WAAAC,CAAYC,GAClB,GAAInQ,KAAKgQ,KAAM,CACb,IACE,MAAMzR,EAAIyB,KAAK8P,QAAQ7I,MAAM,EAAGkJ,GAChCnQ,KAAKsL,OAAOtL,KAAKgQ,MAAQZ,EAASpP,KAAKgQ,MAAQZ,EAASpP,KAAKgQ,MAAMzR,GAAKA,CAC1E,UACE,OAAO,CACT,CACA,OAAO,CACT,CACA,OAAO,CACT,yGCtPF,MAEE,WAAAwB,CACmBoK,GAAAnK,KAAAmK,SAAAA,EAFXnK,KAAAqQ,cAA+B,CAAEC,WAAW,EAAMC,MAAO,MAAOC,OAAQ,EAAGC,UAAW,MAG3F,CAMI,QAAAhD,CAASiD,GACd1Q,KAAKmK,SAASsD,SAASiD,EAAK1Q,KAAKqQ,cACnC,oGCNF,SAA0BlS,GACxB,GAAIA,EAAEJ,OAAS,GACb,OAAOlD,EAAA+R,iBAET,MAAM+D,EAAM,IAAItT,YAAYc,EAAEb,OAAQa,EAAEgP,WAAY,GAGpD,GAAe,aAAXwD,EAAI,IAAgC,YAAXA,EAAI,IAAgC,aAAXA,EAAI,GACxD,MAAO,CACL7D,KAAM,YACN5M,MAAQ/B,EAAE,KAAO,GAAKA,EAAE,KAAO,GAAKA,EAAE,KAAO,EAAIA,EAAE,IACnD6F,OAAQ7F,EAAE,KAAO,GAAKA,EAAE,KAAO,GAAKA,EAAE,KAAO,EAAIA,EAAE,KAIvD,GAAa,MAATA,EAAE,IAAwB,MAATA,EAAE,IAAwB,MAATA,EAAE,GAAa,CACnD,MAAO+B,EAAO8D,GAgFlB,SAAiB7F,GACf,MAAMuJ,EAAMvJ,EAAEJ,OACd,IAAID,EAAI,EACJ8S,EAAczS,EAAEL,IAAM,EAAIK,EAAEL,EAAI,GACpC,OAAa,CAEX,GADAA,GAAK8S,EACD9S,GAAK4J,EAEP,MAAO,CAAC,EAAG,GAEb,GAAa,MAATvJ,EAAEL,GACJ,MAAO,CAAC,EAAG,GAEb,GAAiB,MAAbK,EAAEL,EAAI,IAA4B,MAAbK,EAAEL,EAAI,GAC7B,OAAIA,EAAI,EAAI4J,EACH,CACLvJ,EAAEL,EAAI,IAAM,EAAIK,EAAEL,EAAI,GACtBK,EAAEL,EAAI,IAAM,EAAIK,EAAEL,EAAI,IAGnB,CAAC,EAAG,GAEbA,GAAK,EACL8S,EAAczS,EAAEL,IAAM,EAAIK,EAAEL,EAAI,EAClC,CACF,CAzG4B+S,CAAQ1S,GAChC,MAAO,CAAE2O,KAAM,aAAc5M,QAAO8D,SACtC,CAEA,GAAe,YAAX2M,EAAI,KAA+B,KAATxS,EAAE,IAAwB,KAATA,EAAE,KAAyB,KAATA,EAAE,GACjE,MAAO,CACL2O,KAAM,YACN5M,MAAQ/B,EAAE,IAAM,EAAIA,EAAE,GACtB6F,OAAQ7F,EAAE,IAAM,EAAIA,EAAE,IAI1B,GAAe,aAAXwS,EAAI,GACN,MAAO,CACL7D,KAAM,YACN5M,MAAQ/B,EAAE,IAAM,GAAKA,EAAE,IAAM,GAAKA,EAAE,IAAM,EAAIA,EAAE,GAChD6F,OAAQ7F,EAAE,IAAM,GAAKA,EAAE,IAAM,GAAKA,EAAE,KAAO,EAAIA,EAAE,KAIrD,GAAe,aAAXwS,EAAI,IAAgC,aAAXA,EAAI,IAA6C,UAAd,SAATA,EAAI,IAA6B,CACtF,OAAQxS,EAAE,KACR,KAAK,GACH,MAAO,CACL2O,KAAM,aACN5M,MAA6C,GAApC/B,EAAE,IAAMA,EAAE,KAAO,EAAIA,EAAE,KAAO,IACvC6F,OAA6C,GAApC7F,EAAE,IAAMA,EAAE,KAAO,EAAIA,EAAE,KAAO,KAE3C,KAAK,GACH,GAAc,KAAVA,EAAE,IAAc,OAAOtD,EAAA+R,iBAC3B,MAAMkE,EAAM3S,EAAE,IAAMA,EAAE,KAAO,EAAIA,EAAE,KAAO,GAAKA,EAAE,KAAO,GACxD,MAAO,CACL2O,KAAM,aACN5M,MAAgC,GAAV,MAAb4Q,GACT9M,OAAgC,GAAvB8M,IAAQ,GAAK,QAE1B,KAAK,GACH,OAAc,MAAV3S,EAAE,KAA0B,IAAVA,EAAE,KAA0B,KAAVA,EAAE,IAAqBtD,EAAA+R,iBACxD,CACLE,KAAM,aACN5M,MAA+B,OAAtB/B,EAAE,IAAMA,EAAE,KAAO,GAC1B6F,OAA+B,OAAtB7F,EAAE,IAAMA,EAAE,KAAO,IAGhC,OAAOtD,EAAA+R,gBACT,CAEA,GAAe,aAAX+D,EAAI,KAAiC,aAAXA,EAAI,IAAgC,aAAXA,EAAI,IAAoB,CAC7E,IAAIR,GAAO,EAEX,MAAMY,EAAQhV,KAAKE,IAAIkC,EAAEJ,OAAS,GAAI,MACtC,IAAK,IAAID,EAAI,EAAGA,EAAIiT,EAAOjT,IAEzB,GAAa,MAATK,EAAEL,IAA4B,MAAbK,EAAEL,EAAI,IAA4B,MAAbK,EAAEL,EAAI,IAA4B,MAAbK,EAAEL,EAAI,GAAa,CAChFqS,EAAMrS,EACN,KACF,CAEF,IAAa,IAATqS,EAAY,CAEd,MAAMjQ,EACJ/B,EAAEgS,EAAO,IAAM,GACfhS,EAAEgS,EAAO,IAAM,GACfhS,EAAEgS,EAAM,KAAQ,EAChBhS,EAAEgS,EAAM,IACJnM,EACJ7F,EAAEgS,EAAM,KAAO,GACfhS,EAAEgS,EAAM,KAAO,GACfhS,EAAEgS,EAAM,KAAQ,EAChBhS,EAAEgS,EAAM,IACV,GAAIjQ,EAAQ,GAAK8D,EAAS,EACxB,MAAO,CAAE8I,KAAM,aAAc5M,QAAO8D,SAExC,CACA,OAAOnJ,EAAA+R,gBACT,CACA,OAAO/R,EAAA+R,gBACT,EAnGa/R,EAAA+R,iBAA6B,CACxCE,KAAM,cACN5M,MAAO,EACP8D,OAAQ,uFCZV,MAAAjF,EAAAC,EAAA,KAGAqH,EAAArH,EAAA,KAaA,MAAAoO,UAAmC/G,EAAA0C,WAEjC,UAAW8C,GAAM,IAAAK,EAAoC,OAA8B,QAAvBA,EAAAlM,KAAKgR,QAAQC,IAAI,cAAM,IAAA/E,OAAA,EAAAA,EAAEL,MAAQ,CAUtF,mBAAOwB,CAAa6D,EAAqChR,EAAe8D,GAU7E,MAAM6H,GAAUqF,QAAAA,EAAiBC,UAAUC,cAAc,UAGzD,OAFAvF,EAAO3L,MAAgB,EAARA,EACf2L,EAAO7H,OAAkB,EAATA,EACT6H,CACT,CAGO,sBAAOwF,CAAgBC,EAA+BpR,EAAe8D,EAAgB1G,GAC1F,GAAyB,mBAAd4P,UAA0B,CACnC,MAAMqE,EAAUD,EAAID,gBAAgBnR,EAAO8D,GAI3C,OAHI1G,GACFiU,EAAQnM,KAAKlC,IAAI,IAAIgD,kBAAkB5I,EAAQ,EAAG4C,EAAQ8D,EAAS,IAE9DuN,CACT,CACA,OAAOjU,EACH,IAAI4P,UAAU,IAAIhH,kBAAkB5I,EAAQ,EAAG4C,EAAQ8D,EAAS,GAAI9D,EAAO8D,GAC3E,IAAIkJ,UAAUhN,EAAO8D,EAC3B,CAGO,wBAAO2J,CAAkB+C,GAC9B,MAAiC,mBAAtB/C,kBACF6D,QAAQC,aAAQzJ,GAElB2F,kBAAkB+C,EAC3B,CAGA,WAAA3Q,CAAoB2R,GAClBC,QADkB3R,KAAA0R,UAAAA,EAhDZ1R,KAAAgR,QAAU,IAAIY,IAGd5R,KAAA6R,gBAAkB7R,KAAKiJ,UAAU,IAAI5C,EAAAyL,mBA+C3C9R,KAAK+R,SAAW/R,KAAK0R,UAAUvF,MAAM6F,KACrChS,KAAK0R,UAAUvF,MAAM6F,KAAQC,UACd,QAAb/F,EAAAlM,KAAK+R,gBAAQ,IAAA7F,GAAAA,EAAE1E,KAAKxH,KAAK0R,UAAUvF,MAAO8F,GAC1CjS,KAAKkS,SAEHlS,KAAK0R,UAAUvF,MAAMgG,eACvBnS,KAAKkS,QAGPlS,KAAK6R,gBAAgB/V,MAAQkE,KAAK0R,UAAUvF,MAAMiG,eAAeC,eAAeC,UAC/D,aAAXA,IACFtS,KAAKuS,gBACc,QAAnBrG,EAAAlM,KAAKwS,sBAAc,IAAAtG,GAAAA,EAAEuG,YAAY,EAAGzS,KAAK0R,UAAU3F,SAGvD/L,KAAKiJ,WAAU,EAAA5C,EAAAS,cAAa,WAC1B9G,KAAK0S,qBACL1S,KAAK0S,mBAAmB,UACpB1S,KAAK0R,UAAUvF,OAASnM,KAAK+R,WAC/B/R,KAAK0R,UAAUvF,MAAM6F,KAAOhS,KAAK+R,SACjC/R,KAAK+R,cAAW/J,GAEdhI,KAAKwS,gBAAkBxS,KAAK2S,kBAC9B3S,KAAKwS,eAAeI,YAAc5S,KAAK2S,gBACvC3S,KAAK2S,qBAAkB3K,GAEzBhI,KAAKwS,oBAAiBxK,EACtBhI,KAAKgR,QAAQlI,QACU,QAAvBoD,EAAAlM,KAAK6S,0BAAkB,IAAA3G,GAAAA,EAAE4G,QACzB9S,KAAK6S,wBAAqB7K,EAC1BhI,KAAK+S,kBAAe/K,IAExB,CAKO,eAAAgL,CAAgBlX,WACjBA,EACGkE,KAAK+S,eAA0C,IAA1B/S,KAAKiT,SAASjP,QACtChE,KAAKkT,mBAAmBnX,KAAKC,IAAIgE,KAAKiT,SAASjP,OAAS,EAAC,MAGpC,QAAvBkI,EAAAlM,KAAK6S,0BAAkB,IAAA3G,GAAAA,EAAE4G,QACzB9S,KAAK6S,wBAAqB7K,EAC1BhI,KAAK+S,kBAAe/K,GAEH,QAAnBsF,EAAAtN,KAAKwS,sBAAc,IAAAlF,GAAAA,EAAEmF,YAAY,EAAGzS,KAAK0R,UAAU3F,KACrD,CAMA,cAAWJ,GACT,OAAO3L,KAAK0R,UAAU/F,UACxB,CAKA,YAAWsH,WACT,MAAO,CACL/S,OAAsB,QAAfgM,EAAAlM,KAAK2L,kBAAU,IAAAO,OAAA,EAAAA,EAAEN,IAAIqC,KAAK/N,SAAU,EAC3C8D,QAAuB,QAAfsJ,EAAAtN,KAAK2L,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIqC,KAAKjK,UAAW,EAEjD,CAKO,UAAAmP,CAAW9N,EAAeC,EAAaiL,iBAC5C,MAAM6C,EAAI/N,IAAwB,QAAf6G,EAAAlM,KAAK2L,kBAAU,IAAAO,OAAA,EAAAA,EAAEN,IAAIqC,KAAKjK,SAAU,GACjDyH,GAAmB,QAAf6B,EAAAtN,KAAK2L,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIC,OAAO3L,QAAS,EACzC9B,GAAKkH,EAAM,EAAID,KAAyB,QAAf4G,EAAAjM,KAAK2L,kBAAU,IAAAM,OAAA,EAAAA,EAAEL,IAAIqC,KAAKjK,SAAU,GAC9DuM,GAAmB,QAAVA,GACW,QAAvBpC,EAAAnO,KAAKgR,QAAQC,IAAI,cAAM,IAAA9C,GAAAA,EAAEkF,UAAU,EAAGD,EAAG3H,EAAGrN,GAEzCmS,GAAmB,WAAVA,GACc,QAA1B+C,EAAAtT,KAAKgR,QAAQC,IAAI,iBAAS,IAAAqC,GAAAA,EAAED,UAAU,EAAGD,EAAG3H,EAAGrN,EAEnD,CAKO,QAAAmV,CAAShD,GACd,IAAKA,GAAmB,QAAVA,EAAiB,CAC7B,MAAMe,EAAMtR,KAAKgR,QAAQC,IAAI,OAC7BK,SAAAA,EAAK+B,UAAU,EAAG,EAAG/B,EAAIzF,OAAO3L,MAAOoR,EAAIzF,OAAO7H,OACpD,CACA,IAAKuM,GAAmB,WAAVA,EAAoB,CAChC,MAAMe,EAAMtR,KAAKgR,QAAQC,IAAI,UAC7BK,SAAAA,EAAK+B,UAAU,EAAG,EAAG/B,EAAIzF,OAAO3L,MAAOoR,EAAIzF,OAAO7H,OACpD,CACF,CAKO,IAAAwP,CAAKC,EAAqBC,EAAgBC,EAAaC,EAAaC,EAAgB,GACzF,MAAMvC,EAAMtR,KAAKgR,QAAQC,IAAIwC,EAAQlD,OACrC,IAAKe,EACH,OAEF,MAAMpR,MAAEA,EAAK8D,OAAEA,GAAWhE,KAAKiT,SAG/B,IAAe,IAAX/S,IAA4B,IAAZ8D,EAClB,OAGFhE,KAAK8T,cAAcL,EAASvT,EAAO8D,GACnC,MAAM0M,EAAM+C,EAAQM,OACdjI,EAAO/P,KAAKuI,KAAKoM,EAAIxQ,MAAQA,GAE7B8T,EAAMN,EAAS5H,EAAQ5L,EACvB+T,EAAKlY,KAAKkR,MAAMyG,EAAS5H,GAAQ9H,EACjCkQ,EAAKP,EAAMzT,EACXiU,EAAKP,EAAM5P,EAGXoQ,EAAaP,EAAQ3T,EAAQ8T,EAAKtD,EAAIxQ,MAAQwQ,EAAIxQ,MAAQ8T,EAAKH,EAAQ3T,EACvEmU,EAAcJ,EAAKjQ,EAAS0M,EAAI1M,OAAS0M,EAAI1M,OAASiQ,EAAKjQ,EAMjEsN,EAAIgD,UACF5D,EACA3U,KAAKkR,MAAM+G,GAAKjY,KAAKkR,MAAMgH,GAAKlY,KAAKuI,KAAK8P,GAAarY,KAAKuI,KAAK+P,GACjEtY,KAAKkR,MAAMiH,GAAKnY,KAAKkR,MAAMkH,GAAKpY,KAAKuI,KAAK8P,GAAarY,KAAKuI,KAAK+P,GAErE,CAKO,WAAAE,CAAYd,EAAqBC,GACtC,MAAMxT,MAAEA,EAAK8D,OAAEA,GAAWhE,KAAKiT,SAE/B,IAAe,IAAX/S,IAA4B,IAAZ8D,EAClB,OAEFhE,KAAK8T,cAAcL,EAASvT,EAAO8D,GACnC,MAAM0M,EAAM+C,EAAQM,OACdjI,EAAO/P,KAAKuI,KAAKoM,EAAIxQ,MAAQA,GAC7B8T,EAAMN,EAAS5H,EAAQ5L,EACvB+T,EAAKlY,KAAKkR,MAAMyG,EAAS5H,GAAQ9H,EACjCoQ,EAAalU,EAAQ8T,EAAKtD,EAAIxQ,MAAQwQ,EAAIxQ,MAAQ8T,EAAK9T,EACvDmU,EAAcJ,EAAKjQ,EAAS0M,EAAI1M,OAAS0M,EAAI1M,OAASiQ,EAAKjQ,EAE3D6H,EAASuB,EAAcC,aAAarN,KAAKmR,SAAUiD,EAAYC,GAC/D/C,EAAMzF,EAAO0B,WAAW,MAC9B,OAAI+D,GACFA,EAAIgD,UACF5D,EACA3U,KAAKkR,MAAM+G,GAAKjY,KAAKkR,MAAMgH,GAAKlY,KAAKkR,MAAMmH,GAAarY,KAAKkR,MAAMoH,GACnE,EAAG,EAAGtY,KAAKkR,MAAMmH,GAAarY,KAAKkR,MAAMoH,IAEpCxI,QANT,CAQF,CAKO,eAAA2I,CAAgBb,EAAaC,EAAaC,EAAgB,SAC/D,MAAMvC,EAAMtR,KAAKgR,QAAQC,IAAI,OAC7B,GAAIK,EAAK,CACP,MAAMpR,MAAEA,EAAK8D,OAAEA,GAAWhE,KAAKiT,SAG/B,IAAe,IAAX/S,IAA4B,IAAZ8D,EAClB,OAQF,GALKhE,KAAK+S,aAEC/O,GAAUhE,KAAK+S,aAAc/O,QACtChE,KAAKkT,mBAAmBlP,EAAS,GAFjChE,KAAKkT,mBAAmBnX,KAAKC,IAAIgI,EAAS,EAAC,MAIxChE,KAAK+S,aAAc,OACxBzB,EAAIgD,UACqB,QADZpI,EACXlM,KAAK6S,0BAAkB,IAAA3G,EAAAA,EAAIlM,KAAK+S,aAChCY,EAAMzT,EACL0T,EAAM5P,EAAU,EAAI,EAAI,EACzB9D,EAAQ2T,EACR7P,EACA2P,EAAMzT,EACN0T,EAAM5P,EACN9D,EAAQ2T,EACR7P,EAEJ,CACF,CAMO,aAAAuO,WACL,MAAM9G,GAAmB,QAAfS,EAAAlM,KAAK2L,kBAAU,IAAAO,OAAA,EAAAA,EAAEN,IAAIC,OAAO3L,QAAS,EACzC9B,GAAmB,QAAfkP,EAAAtN,KAAK2L,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIC,OAAO7H,SAAU,EAChD,IAAK,MAAMsN,KAAOtR,KAAKgR,QAAQyD,SACzBnD,EAAIzF,OAAO3L,QAAUuL,GAAK6F,EAAIzF,OAAO7H,SAAW5F,IAClDkT,EAAIzF,OAAO3L,MAAQuL,EACnB6F,EAAIzF,OAAO7H,OAAS5F,EAG1B,CAKQ,aAAA0V,CAAcY,EAAkBhP,EAAsBM,GAC5D,GAAIN,IAAiBgP,EAAKC,eAAezU,OAAS8F,IAAkB0O,EAAKC,eAAe3Q,OACtF,OAEF,MAAQ9D,MAAO0U,EAAe5Q,OAAQ6Q,GAAmBH,EAAKI,aAC9D,GAAIpP,IAAiBkP,GAAiB5O,IAAkB6O,EAItD,OAHAH,EAAKX,OAASW,EAAKK,KACnBL,EAAKC,eAAezU,MAAQ0U,OAC5BF,EAAKC,eAAe3Q,OAAS6Q,GAG/B,MAAMhJ,EAASuB,EAAcC,aAC3BrN,KAAKmR,SACLpV,KAAKuI,KAAKoQ,EAAKK,KAAM7U,MAAQwF,EAAekP,GAC5C7Y,KAAKuI,KAAKoQ,EAAKK,KAAM/Q,OAASgC,EAAgB6O,IAE1CvD,EAAMzF,EAAO0B,WAAW,MAC1B+D,IACFA,EAAIgD,UAAUI,EAAKK,KAAO,EAAG,EAAGlJ,EAAO3L,MAAO2L,EAAO7H,QACrD0Q,EAAKX,OAASlI,EACd6I,EAAKC,eAAezU,MAAQwF,EAC5BgP,EAAKC,eAAe3Q,OAASgC,EAEjC,CAKQ,KAAAkM,GACNlS,KAAKwS,eAAiBxS,KAAK0R,UAAUvF,MAAMqG,eAC3CxS,KAAK2S,gBAAkB3S,KAAKwS,eAAeI,YAAY1R,KAAKlB,KAAKwS,gBACjExS,KAAKwS,eAAeI,YAAeoC,UACjC,IAAK,MAAMC,IAAO,IAAIjV,KAAKgR,QAAQkE,QACjClV,KAAK0S,mBAAmBuC,GAEN,QAApB/I,EAAAlM,KAAK2S,uBAAe,IAAAzG,GAAAA,EAAE1E,KAAKxH,KAAKwS,eAAgBwC,GAEpD,CAEO,gBAAAG,CAAiB5E,EAAoB,eAE1C,IAAKvQ,KAAKmR,WAAanR,KAAK0R,UAAUvF,MAAMgG,cAE1C,YADA5U,QAAQC,KAAK,sFAGf,GAAIwC,KAAKgR,QAAQoE,IAAI7E,GACnB,OAEF,MAAM1E,EAASuB,EAAcC,aAC3BrN,KAAKmR,UAAyB,QAAfjF,EAAAlM,KAAK2L,kBAAU,IAAAO,OAAA,EAAAA,EAAEN,IAAIC,OAAO3L,QAAS,GACrC,QAAfoN,EAAAtN,KAAK2L,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIC,OAAO7H,SAAU,GAExC6H,EAAOwJ,UAAU/N,IAAI,qBAAqBiJ,KAC1C,MAAM4B,EAAgBnS,KAAK0R,UAAUvF,MAAMgG,cAI3CA,EAAcmD,MAAMC,UAAY,UAClB,WAAVhF,GAKF1E,EAAOyJ,MAAM9E,OAAS,KACtB2B,EAAcqD,aAAa3J,EAAQsG,EAAcsD,cAKjD5J,EAAOyJ,MAAM9E,OAAS,IACtB2B,EAAcuD,YAAY7J,IAE5B,MAAMyF,EAAMzF,EAAO0B,WAAW,KAAM,CAAErQ,OAAO,IACxCoU,GAILtR,KAAKgR,QAAQ9N,IAAIqN,EAAOe,GACxBtR,KAAKuT,SAAShD,IAJZ1E,EAAO8J,QAKX,CAEO,kBAAAjD,CAAmBnC,EAAoB,OAC5C,MAAMe,EAAMtR,KAAKgR,QAAQC,IAAIV,GACzBe,IACFA,EAAIzF,OAAO8J,SACX3V,KAAKgR,QAAQ4E,OAAOrF,GAExB,CAEO,QAAAsF,CAAStF,GACd,OAAOvQ,KAAKgR,QAAQoE,IAAI7E,EAC1B,CAEQ,kBAAA2C,CAAmBlP,EAAM,UACR,QAAvBkI,EAAAlM,KAAK6S,0BAAkB,IAAA3G,GAAAA,EAAE4G,QACzB9S,KAAK6S,wBAAqB7K,EAG1B,MAAM8N,EAAS,GACTC,EAAY3I,EAAcC,aAAarN,KAAKmR,SAAU2E,EAAQ9R,GAC9DsN,EAAMyE,EAAUxI,WAAW,KAAM,CAAErQ,OAAO,IAChD,IAAKoU,EAAK,OACV,MAAMC,EAAUnE,EAAciE,gBAAgBC,EAAKwE,EAAQ9R,GACrD2M,EAAM,IAAItT,YAAYkU,EAAQnM,KAAK9H,QACnC0Y,GAAQ,EAAAjX,EAAAzD,YAAW,EAAG,EAAG,GACzB2a,GAAQ,EAAAlX,EAAAzD,YAAW,IAAK,IAAK,KACnCqV,EAAIhL,KAAKqQ,GACT,IAAK,IAAI5C,EAAI,EAAGA,EAAIpP,IAAUoP,EAAG,CAC/B,MAAM8C,EAAQ9C,EAAI,EACZjP,EAASiP,EAAI0C,EACnB,IAAK,IAAIK,EAAI,EAAGA,EAAIL,EAAQK,GAAK,EAC/BxF,EAAIxM,EAASgS,EAAID,GAASD,CAE9B,CACA3E,EAAI9D,aAAa+D,EAAS,EAAG,GAG7B,MAAMrR,EAASkW,OAAOlW,MAAQ4V,EAAS,GAAK,IAAa,KACzD9V,KAAK+S,aAAe3F,EAAcC,aAAarN,KAAKmR,SAAUjR,EAAO8D,GACrE,MAAMqS,EAAOrW,KAAK+S,aAAaxF,WAAW,KAAM,CAAErQ,OAAO,IACzD,GAAKmZ,EAAL,CAIA,IAAK,IAAIvY,EAAI,EAAGA,EAAIoC,EAAOpC,GAAKgY,EAC9BO,EAAK/B,UAAUyB,EAAWjY,EAAG,GAE/BsP,EAAcO,kBAAkB3N,KAAK+S,cAAc1R,KAAKiV,GAAUtW,KAAK6S,mBAAqByD,EAJ5F,MAFEtW,KAAK+S,kBAAe/K,CAOxB,CAEA,YAAWmJ,SACT,OAA+C,QAAxCjF,EAAAlM,KAAK0R,UAAUvF,MAAMC,2BAAmB,IAAAF,OAAA,EAAAA,EAAEqK,OAAOpF,QAC1D,2HChaF,MAAA9H,EAAArK,EAAA,KASanE,EAAA6Q,kBAA+B,CAC1CxL,MAAO,EACP8D,OAAQ,IASV,MAAMwS,EAEJ,OAAWC,GACT,OAAIzW,KAAK0W,QAEQ,UAAZ1W,KAAK2W,KACL3W,KAAK4W,gBAAkB,GAGrB5W,KAAK2W,IACd,CACA,OAAWF,CAAI3a,GAAiBkE,KAAK2W,KAAO7a,CAAO,CAEnD,kBAAW8a,GAET,OAAI5W,KAAK0W,OACP,GAEe,UAAT1W,KAAK2W,OAAoC,EACnD,CACA,kBAAWC,CAAe9a,GACxBkE,KAAK2W,OAAQ,UACb3W,KAAK2W,MAAS7a,GAAS,GAAG,SAC5B,CAEA,kBAAW+a,GACT,OAAmB,SAAZ7W,KAAK2W,IACd,CACA,kBAAWE,CAAe/a,GACxBkE,KAAK2W,OAAQ,SACb3W,KAAK2W,MAAgB,SAAR7a,CACf,CAEA,0BAAWgb,GACT,MAAMC,GAAgB,WAAT/W,KAAK2W,OAAmC,GACrD,OAAII,EAAM,EACK,WAANA,EAEFA,CACT,CACA,0BAAWD,CAAuBhb,GAChCkE,KAAK2W,MAAQ,UACb3W,KAAK2W,MAAS7a,GAAS,GAAG,UAC5B,CAGA,SAAWkb,GACT,OAAOhX,KAAK0W,MACd,CACA,SAAWM,CAAMlb,GACfkE,KAAK0W,OAAS5a,CAChB,CAEA,WAAAiE,CACE0W,EAAc,EACdO,EAAgB,EACTC,GAAU,EACVvD,GAAS,GADT1T,KAAAiX,QAAAA,EACAjX,KAAA0T,OAAAA,EAxDD1T,KAAA2W,KAAe,EA4Cf3W,KAAA0W,OAAiB,EAcvB1W,KAAK2W,KAAOF,EACZzW,KAAK0W,OAASM,CAChB,CAEO,KAAAE,GASL,OAAO,IAAIV,EAAmBxW,KAAK2W,KAAM3W,KAAK0W,OAAQ1W,KAAKiX,QAASjX,KAAK0T,OAC3E,CAEO,OAAAyD,GACL,OAA0B,IAAnBnX,KAAK4W,gBAA0D,IAAhB5W,KAAK0W,SAAkC,IAAlB1W,KAAKiX,OAClF,EAEF,MAAMG,EAAc,IAAIZ,iBAUxB,MAkBE,WAAAzW,CACU2R,EACAxH,EACAhI,GAFAlC,KAAA0R,UAAAA,EACA1R,KAAAkK,UAAAA,EACAlK,KAAAkC,MAAAA,EAnBFlC,KAAAqX,QAAmC,IAAIzF,IAEvC5R,KAAAsX,QAAU,EAEVtX,KAAAuX,UAAY,EAEZvX,KAAAwX,eAAgB,EAEhBxX,KAAAyX,iBAAkB,EAElBzX,KAAA0X,YAAsB,KAW5B,IACE1X,KAAK2X,SAAS3X,KAAKkC,MAAM0V,aAC3B,CAAE,MAAO9P,GACHA,aAAa1F,OACf7E,QAAQsa,MAAM/P,EAAEgQ,SAElBva,QAAQC,KAAK,0BAA0BwC,KAAK+X,gBAC9C,CACA/X,KAAKgY,iBAAmB,CACtBlM,KAAM9L,KAAK0R,UAAU5F,KACrBC,KAAM/L,KAAK0R,UAAU3F,KAEzB,CAEO,OAAApE,GACL3H,KAAKiL,OACP,CAEO,KAAAA,SACL,IAAK,MAAMyJ,KAAQ1U,KAAKqX,QAAQ5C,SACnB,QAAXvI,EAAAwI,EAAKuD,cAAM,IAAA/L,GAAAA,EAAEvE,UAIf3H,KAAKqX,QAAQvO,QACb9I,KAAKkK,UAAUqJ,UACjB,CAEO,QAAAwE,GACL,OAA0B,EAAnB/X,KAAK0X,YAAkB,GAChC,CAEO,QAAAC,CAAS7b,GACd,GAAIA,EAAQ,IAAOA,EAAQ,IACzB,MAAMoc,WAAW,qEAEnBlY,KAAK0X,YAAe5b,EAAQ,EAAI,MAAa,EAC7CkE,KAAKmY,aAAa,EACpB,CAEO,QAAAC,GACL,OAAiC,EAA1BpY,KAAKqY,mBAAyB,GACvC,CAEQ,gBAAAA,GACN,IAAIC,EAAe,EACnB,IAAK,MAAM5D,KAAQ1U,KAAKqX,QAAQ5C,SAC1BC,EAAKK,OACPuD,GAAgB5D,EAAKK,KAAK7U,MAAQwU,EAAKK,KAAK/Q,OACxC0Q,EAAKX,QAAUW,EAAKX,SAAWW,EAAKK,OACtCuD,GAAgB5D,EAAKX,OAAO7T,MAAQwU,EAAKX,OAAO/P,SAItD,OAAOsU,CACT,CAEQ,OAAAC,CAAQC,SACd,MAAM9D,EAAO1U,KAAKqX,QAAQpG,IAAIuH,GACzB9D,IACL1U,KAAKqX,QAAQzB,OAAO4C,GAEhBjC,OAAOkC,aAAe/D,EAAKK,gBAAgB0D,aAC7C/D,EAAKK,KAAKjC,QAEO,QAAnB5G,EAAAlM,KAAK0Y,sBAAc,IAAAxM,GAAAA,EAAA1E,KAAnBxH,KAAsBwY,GACxB,CAKO,aAAAG,SAEL,MAAMC,EAAO,GACb,IAAK,MAAOJ,EAAI9D,KAAS1U,KAAKqX,QAAQwB,UACZ,cAApBnE,EAAKoE,aACI,QAAX5M,EAAAwI,EAAKuD,cAAM,IAAA/L,GAAAA,EAAEvE,UACbiR,EAAKla,KAAK8Z,IAGd,IAAK,MAAMA,KAAMI,EACf5Y,KAAKuY,QAAQC,GAGfxY,KAAKyX,iBAAkB,EACvBzX,KAAKwX,eAAgB,CACvB,CAMO,WAAAuB,CAAYP,SACjB,MAAM9D,EAAO1U,KAAKqX,QAAQpG,IAAIuH,GAC1B9D,IACS,QAAXxI,EAAAwI,EAAKuD,cAAM,IAAA/L,GAAAA,EAAEvE,UACb3H,KAAKuY,QAAQC,GAEjB,CAaO,QAAA/K,CAASiD,EAAsC5P,WAEpDd,KAAKmY,aAAazH,EAAIxQ,MAAQwQ,EAAI1M,QAGlC,IAAIiP,EAAWjT,KAAKkK,UAAU+I,UACN,IAApBA,EAAS/S,QAAqC,IAArB+S,EAASjP,SACpCiP,EAAWpY,EAAA6Q,mBAEb,MAAMI,EAAO/P,KAAKuI,KAAKoM,EAAIxQ,MAAQ+S,EAAS/S,OACtC6L,EAAOhQ,KAAKuI,KAAKoM,EAAI1M,OAASiP,EAASjP,QAEvCiT,IAAYjX,KAAKsX,QAEjBha,EAAS0C,KAAK0R,UAAUvF,MAAM7O,OAC9B0b,EAAWhZ,KAAK0R,UAAU5F,KAC1BmN,EAAWjZ,KAAK0R,UAAU3F,KAC1BmN,EAAU5b,EAAO6Y,EACjBgD,EAAU7b,EAAO8V,EACvB,IAAIjP,EAAS+U,EACTE,EAAY,EAEXtY,EAAKwP,YACRhT,EAAO6Y,EAAI,EACX7Y,EAAO8V,EAAI,EACXjP,EAAS,GAGXnE,KAAK0R,UAAUvF,MAAMkN,cAAcC,iBAAiBC,UAAUjc,EAAO8V,GACrE,IAAK,IAAIQ,EAAM,EAAGA,EAAM7H,IAAQ6H,EAAK,CACnC,MAAM4F,EAAOlc,EAAOmc,MAAMxI,IAAI3T,EAAO8V,EAAI9V,EAAOoc,OAChD,IAAK,IAAI/F,EAAM,EAAGA,EAAM7H,KAClB3H,EAASwP,GAAOqF,KADUrF,EAE9B3T,KAAK2Z,aAAaH,EAAwBrV,EAASwP,EAAKsD,EAASrD,EAAM9H,EAAO6H,GAC9EyF,IAEF,GAAItY,EAAKwP,UACHsD,EAAM7H,EAAO,GAAG/L,KAAK0R,UAAUvF,MAAMkN,cAAcO,gBAEvD,KAAMtc,EAAO8V,GAAK6F,EAAU,MAE9B3b,EAAO6Y,EAAIhS,CACb,CACAnE,KAAK0R,UAAUvF,MAAMkN,cAAcC,iBAAiBC,UAAUjc,EAAO8V,GAGjEtS,EAAKwP,UACgB,QAAnBxP,EAAK2P,UACPnT,EAAO6Y,EAAIpa,KAAKE,IAAIkI,EAAS2H,EAAMkN,GAEnC1b,EAAO6Y,EAAIhS,GAGb7G,EAAO6Y,EAAI+C,EACX5b,EAAO8V,EAAI+F,GAIb,MAAMP,EAAO,GACb,IAAK,MAAOJ,EAAI9D,KAAS1U,KAAKqX,QAAQwB,UAChCnE,EAAK0E,UAAY,IACR,QAAXlN,EAAAwI,EAAKuD,cAAM,IAAA/L,GAAAA,EAAEvE,UACbiR,EAAKla,KAAK8Z,IAGd,IAAK,MAAMA,KAAMI,EACf5Y,KAAKuY,QAAQC,GAKf,MAAMqB,EAAY7Z,KAAK0R,UAAUoI,eAAe,GAChDD,SAAAA,EAAWE,UAAU,KACN/Z,KAAKqX,QAAQpG,IAAIgG,IAE5BjX,KAAKuY,QAAQtB,KAMyB,cAAtCjX,KAAK0R,UAAUpU,OAAO0c,OAAOnQ,MAC/B7J,KAAKia,oBAIP,MAAMxG,EAAsB,CAC1BsB,KAAMrE,EACNoE,aAAc7B,EACdc,OAAQrD,EACRiE,eAAcnY,OAAA2F,OAAA,GAAO8Q,GACrBgF,OAAQ4B,QAAa7R,EACrBoR,YACAN,WAAY9Y,KAAK0R,UAAUpU,OAAO0c,OAAOnQ,KACzC0G,MAAOzP,EAAKyP,MACZC,OAAQ1P,EAAK0P,QAMf,OAFAxQ,KAAKqX,QAAQnU,IAAI+T,EAASxD,GACT,QAAjBnG,EAAAtN,KAAKka,oBAAY,IAAA5M,GAAAA,EAAA9F,KAAjBxH,MACOiX,CACT,CAQO,MAAAkD,CAAOC,WAEZ,IAAIC,GAAe,EACfC,GAAkB,EACtB,IAAK,MAAM5F,KAAQ1U,KAAKqX,QAAQ5C,SAM9B,GALmB,WAAfC,EAAKnE,MACP+J,GAAkB,EAElBD,GAAe,EAEbA,GAAgBC,EAAiB,MAIvC,GAAID,IAAiBra,KAAKkK,UAAU2L,SAAS,SAC3C7V,KAAKkK,UAAUiL,iBAAiB,QAC3BnV,KAAKkK,UAAU2L,SAAS,QAAQ,OAUvC,GARIyE,IAAoBta,KAAKkK,UAAU2L,SAAS,WAC9C7V,KAAKkK,UAAUiL,iBAAiB,UAIlCnV,KAAKkK,UAAUqI,iBAGVvS,KAAKqX,QAAQtN,KAYhB,OAXK/J,KAAKwX,gBACRxX,KAAKkK,UAAUqJ,WACfvT,KAAKwX,eAAgB,EACrBxX,KAAKyX,iBAAkB,GAErBzX,KAAKkK,UAAU2L,SAAS,QAC1B7V,KAAKkK,UAAUwI,mBAAmB,YAEhC1S,KAAKkK,UAAU2L,SAAS,WAC1B7V,KAAKkK,UAAUwI,mBAAmB,YAMjC2H,GAAgBra,KAAKkK,UAAU2L,SAAS,SAC3C7V,KAAKkK,UAAUqJ,SAAS,OACxBvT,KAAKkK,UAAUwI,mBAAmB,SAE/B4H,GAAmBta,KAAKkK,UAAU2L,SAAS,YAC9C7V,KAAKkK,UAAUqJ,SAAS,UACxBvT,KAAKkK,UAAUwI,mBAAmB,WAIhC1S,KAAKyX,kBACPzX,KAAKkK,UAAUqJ,WACfvT,KAAKwX,eAAgB,EACrBxX,KAAKyX,iBAAkB,GAGzB,MAAMpS,MAAEA,EAAKC,IAAEA,GAAQ8U,EACjB9c,EAAS0C,KAAK0R,UAAUvF,MAAM7O,OAC9BwO,EAAO9L,KAAK0R,UAAUvF,MAAML,KAGlC9L,KAAKkK,UAAUiJ,WAAW9N,EAAOC,GAGjC,MAAMiV,EAAgG,GAChGC,EAAkE,GAGxE,IAAK,IAAI5G,EAAMvO,EAAOuO,GAAOtO,IAAOsO,EAAK,CACvC,MAAM4F,EAAOlc,EAAOmc,MAAMxI,IAAI2C,EAAMtW,EAAOmd,OAC3C,IAAKjB,EAAM,OACX,IAAK,IAAI7F,EAAM,EAAGA,EAAM7H,IAAQ6H,EAC9B,GAAmB,UAAf6F,EAAKkB,MAAM/G,GAA6B,CAC1C,IAAI7L,EAAiD,QAAhDoE,EAAwBsN,EAAKmB,eAAehH,UAAI,IAAAzH,EAAAA,EAAIkL,EACzD,MAAMH,EAAUnP,EAAEmP,QAClB,QAAgBjP,IAAZiP,IAAsC,IAAbA,EAC3B,SAEF,MAAMxD,EAAUzT,KAAKqX,QAAQpG,IAAIgG,GACjC,IAAkB,IAAdnP,EAAE4L,OAAe,CACnB,MAAMkH,EAAY9S,EAAE4L,OACdmH,EAAWlH,EACjB,IAAIE,EAAQ,EAOZ,OACIF,EAAM7H,GACW,UAAf0N,EAAKkB,MAAM/G,KACX7L,EAA4B,QAA3BwF,EAAGkM,EAAKmB,eAAehH,UAAI,IAAArG,EAAAA,EAAI8J,IAChCtP,EAAEmP,UAAYA,GACdnP,EAAE4L,SAAWkH,EAAY/G,GAE7BA,IAEFF,IACIF,EACEA,EAAQM,QACVwG,EAAU7b,KAAK,CAAE+U,UAASC,OAAQkH,EAAWjH,IAAKkH,EAAUjH,MAAKC,UAE1D7T,KAAKkC,MAAM8Q,iBACpBwH,EAAiB9b,KAAK,CAAEiV,IAAKkH,EAAUjH,MAAKC,UAE9C7T,KAAKwX,eAAgB,CACvB,CACF,CAEJ,CAGA+C,EAAUO,KAAK,CAACpf,EAAGD,IAAMC,EAAE+X,QAAQjD,OAAS/U,EAAEgY,QAAQjD,QAGtD,IAAK,MAAMhJ,KAAQgT,EACjBxa,KAAKkK,UAAUsK,gBAAgBhN,EAAKmM,IAAKnM,EAAKoM,IAAKpM,EAAKqM,OAI1D,IAAK,MAAMrM,KAAQ+S,EACjBva,KAAKkK,UAAUsJ,KAAKhM,EAAKiM,QAASjM,EAAKkM,OAAQlM,EAAKmM,IAAKnM,EAAKoM,IAAKpM,EAAKqM,MAE5E,CAEO,cAAAkH,CAAepO,WAEpB,IAAK3M,KAAKqX,QAAQtN,KAEhB,YADA/J,KAAKgY,iBAAmBrL,GAM1B,GAAI3M,KAAKgY,iBAAiBlM,MAAQa,EAAQb,KAExC,YADA9L,KAAKgY,iBAAmBrL,GAK1B,MAAMrP,EAAS0C,KAAK0R,UAAUvF,MAAM7O,OAC9ByO,EAAOzO,EAAOmc,MAAM1b,OACpBid,EAAShb,KAAKgY,iBAAiBlM,KAAO,EAC5C,IAAK,IAAI8H,EAAM,EAAGA,EAAM7H,IAAQ6H,EAAK,CACnC,MAAM4F,EAAOlc,EAAOmc,MAAMxI,IAAI2C,GAC9B,GAAsB,UAAlB4F,EAAKkB,MAAMM,GAAgC,CAC7C,MAAMlT,EAAoD,QAAnDwF,EAAwBkM,EAAKmB,eAAeK,UAAO,IAAA1N,EAAAA,EAAI8J,EACxDH,EAAUnP,EAAEmP,QAClB,QAAgBjP,IAAZiP,IAAsC,IAAbA,EAC3B,SAEF,MAAMxD,EAAUzT,KAAKqX,QAAQpG,IAAIgG,GACjC,IAAKxD,EACH,SAGF,MAAMwH,EAAclf,KAAKuI,OAAoB,QAAd4H,EAAAuH,EAAQM,cAAM,IAAA7H,OAAA,EAAAA,EAAEhM,QAAS,GAAKuT,EAAQkB,eAAezU,OACpF,GAAK4H,EAAE4L,OAASuH,EAAe,GAAKA,EAClC,SAGF,IAAIC,GAAU,EACd,IAAK,IAAIC,EAAWH,EAAS,EAAGG,EAAWxO,EAAQb,OAAQqP,EACzD,GAAmD,QAA/C3B,EAAK4B,MAAc,EAARD,EAAoB,GAA6C,CAC9ED,GAAU,EACV,KACF,CAEF,GAAIA,EACF,SAGF,MAAM5V,EAAMvJ,KAAKE,IAAI0Q,EAAQb,KAAMmP,EAAenT,EAAE4L,OAASuH,EAAeD,GAC5E,IAAIK,EAAWvT,EAAE4L,OACjB,IAAK,IAAI4H,EAAYN,EAAS,EAAGM,EAAYhW,IAAOgW,EAClDtb,KAAK2Z,aAAaH,EAAwB8B,EAAWrE,IAAWoE,GAChE5H,EAAQ2F,WAEZ,CACF,CAEApZ,KAAKgY,iBAAmBrL,CAC1B,CAKO,oBAAA4O,CAAqBpF,EAAW/C,aACrC,MACMoG,EADSxZ,KAAK0R,UAAUvF,MAAM7O,OAChBmc,MAAMxI,IAAImC,GAC9B,GAAIoG,GAAqB,UAAbA,EAAKkB,MAAMvE,GAA2B,CAChD,MAAMrO,EAA+C,QAA9CmE,EAAwBuN,EAAKmB,eAAexE,UAAE,IAAAlK,EAAAA,EAAImL,EACzD,GAAItP,EAAEmP,UAA0B,IAAfnP,EAAEmP,QAAgB,CACjC,MAAMlC,EAAkC,QAA3B7I,EAAAlM,KAAKqX,QAAQpG,IAAInJ,EAAEmP,gBAAQ,IAAA/K,OAAA,EAAAA,EAAE6I,KAC1C,GAAIwB,OAAOkC,aAAe1D,aAAgB0D,YAAa,CACrD,MAAM5M,EAASxC,EAAA+D,cAAcC,aAAakJ,OAAOpF,SAAU4D,EAAK7U,MAAO6U,EAAK/Q,QAE5E,OADuB,QAAvBsJ,EAAAzB,EAAO0B,WAAW,aAAK,IAAAD,GAAAA,EAAEgH,UAAUS,EAAM,EAAG,EAAGA,EAAK7U,MAAO6U,EAAK/Q,QACzD6H,CACT,CACA,OAAOkJ,CACT,CACF,CACF,CAKO,uBAAAyG,CAAwBrF,EAAW/C,SACxC,MACMoG,EADSxZ,KAAK0R,UAAUvF,MAAM7O,OAChBmc,MAAMxI,IAAImC,GAC9B,GAAIoG,GAAqB,UAAbA,EAAKkB,MAAMvE,GAA2B,CAChD,MAAMrO,EAA+C,QAA9CoE,EAAwBsN,EAAKmB,eAAexE,UAAE,IAAAjK,EAAAA,EAAIkL,EACzD,GAAItP,EAAEmP,UAA0B,IAAfnP,EAAEmP,UAAgC,IAAdnP,EAAE4L,OAAe,CACpD,MAAMgB,EAAO1U,KAAKqX,QAAQpG,IAAInJ,EAAEmP,SAChC,GAAIvC,EACF,OAAO1U,KAAKkK,UAAUqK,YAAYG,EAAM5M,EAAE4L,OAE9C,CACF,CACF,CAIQ,YAAAyE,CAAasD,SACnB,MAAMC,EAAO1b,KAAKqY,mBAClB,IAAIsD,EAAUD,EACd,KAAO1b,KAAK0X,YAAciE,EAAUF,GAAQzb,KAAKqX,QAAQtN,MAAM,CAC7D,MAAM2K,EAAO1U,KAAKqX,QAAQpG,MAAMjR,KAAKuX,WACjC7C,GAAQA,EAAKK,OACf4G,GAAWjH,EAAKK,KAAK7U,MAAQwU,EAAKK,KAAK/Q,OACnC0Q,EAAKX,QAAUW,EAAKK,OAASL,EAAKX,SACpC4H,GAAWjH,EAAKX,OAAO7T,MAAQwU,EAAKX,OAAO/P,QAElC,QAAXkI,EAAAwI,EAAKuD,cAAM,IAAA/L,GAAAA,EAAEvE,UACb3H,KAAKuY,QAAQvY,KAAKuX,WAEtB,CACA,OAAOmE,EAAOC,CAChB,CAEQ,YAAAhC,CAAaH,EAAsBrD,EAAWc,EAAiBvD,GACrE,GAAuC,UAAnC8F,EAAK4B,MAAO,EAADjF,EAAa,GAAoC,CAC9D,MAAMyF,EAAMpC,EAAKmB,eAAexE,GAChC,GAAIyF,EAAK,CACP,QAAoB5T,IAAhB4T,EAAI3E,QAAuB,CAI7B,MAAM4E,EAAU7b,KAAKqX,QAAQpG,IAAI2K,EAAI3E,SAOrC,OANI4E,GAEFA,EAAQzC,YAEVwC,EAAI3E,QAAUA,OACd2E,EAAIlI,OAASA,EAEf,CAGA,YADA8F,EAAKmB,eAAexE,GAAK,IAAIK,EAAmBoF,EAAInF,IAAKmF,EAAI5E,MAAOC,EAASvD,GAE/E,CACF,CAEA8F,EAAK4B,MAAO,EAADjF,EAAa,IAAW,UACnCqD,EAAKmB,eAAexE,GAAK,IAAIK,EAAmB,EAAG,EAAGS,EAASvD,EACjE,CAEQ,iBAAAuG,WAEN,IAAK,MAAMvF,KAAQ1U,KAAKqX,QAAQ5C,SACN,cAApBC,EAAKoE,aACPpE,EAAK0E,UAAY,GAIrB,MAAM9b,EAAS0C,KAAK0R,UAAUvF,MAAM7O,OACpC,IAAK,IAAI8V,EAAI,EAAGA,EAAIpT,KAAK0R,UAAU3F,OAAQqH,EAAG,CAC5C,MAAMoG,EAAOlc,EAAOmc,MAAMxI,IAAImC,GAC9B,GAAKoG,EAGL,IAAK,IAAIrD,EAAI,EAAGA,EAAInW,KAAK0R,UAAU5F,OAAQqK,EACzC,GAAuC,UAAnCqD,EAAK4B,MAAO,EAADjF,EAAa,GAAoC,CAC9D,MAAM2F,EAA8B,QAAtB5P,EAAAsN,EAAKmB,eAAexE,UAAE,IAAAjK,OAAA,EAAAA,EAAE+K,QACtC,GAAI6E,EAAO,CACT,MAAMpH,EAAO1U,KAAKqX,QAAQpG,IAAI6K,GAC1BpH,GACFA,EAAK0E,WAET,CACF,CAEJ,CAEA,MAAMR,EAAO,GACb,IAAK,MAAOJ,EAAI9D,KAAS1U,KAAKqX,QAAQwB,UACZ,cAApBnE,EAAKoE,YAA+BpE,EAAK0E,YAChC,QAAX9L,EAAAoH,EAAKuD,cAAM,IAAA3K,GAAAA,EAAE3F,UACbiR,EAAKla,KAAK8Z,IAGd,IAAK,MAAMA,KAAMI,EACf5Y,KAAKuY,QAAQC,EAEjB,sFCnpBF,MAAAzZ,EAAAC,EAAA,KAEAqK,EAAArK,EAAA,KAEA+c,EAAA/c,EAAA,KAMMgd,EAAkBjd,EAAAnC,iBAkIxB,SAASqf,EAAUxe,GACjB,OAAIsB,EAAA5B,WAAmBM,GACP,IAARA,IAAiB,IAAMA,IAAU,EAAI,MAAS,IAAMA,IAAU,GAAK,MAAS,EAAIA,IAAU,GAAK,GACzG,CApIAue,EAAgB9Y,IAAInE,EAAAjC,oCAGpB,MAKE,WAAAiD,CACmBmC,EACAiI,EACAC,GAFApK,KAAAkC,MAAAA,EACAlC,KAAAmK,SAAAA,EACAnK,KAAAoK,cAAAA,EAPXpK,KAAAkc,MAAQ,EACRlc,KAAAqK,UAAW,GAQjB,EAAA0R,EAAAjd,cAAa,CACX0B,YAAqC,EAAxBR,KAAKkC,MAAM6K,WACxBrP,QAASse,EACTrb,aAAcX,KAAKkC,MAAMia,oBACxB9a,KAAKlD,GAAK6B,KAAK8K,KAAO3M,EAC3B,CAEO,KAAA8M,GAODjL,KAAK8K,OACP9K,KAAK8K,KAAK7G,UAETjE,KAAK8K,KAAa9H,SAAS2C,KAAK,GACjC3F,KAAK8K,KAAKzH,KAAK,EAAG2Y,EAAiBhc,KAAKkC,MAAMia,mBAElD,CAEO,IAAAC,CAAKC,SAGV,GAFArc,KAAKkc,MAAQ,EACblc,KAAKqK,UAAW,EACZrK,KAAK8K,KAAM,CACb,MAAMpK,EAAiC,IAArB2b,EAAOA,OAAO,GAAW,EA4DjD,SAAyBC,EAAqBC,GAC5C,IAAIC,EAAK,EACT,IAAKD,EAGH,OAAOC,EAET,GAAIF,EAAKG,YACP,GAAIH,EAAKI,cACPF,EAAKP,EAAUM,EAAOI,WAAWC,WAC5B,GAAIN,EAAKO,UAAW,CACzB,MAAMC,EAAKR,EAAKvc,YAAqCgd,WAAWT,EAAKU,cACrER,GAAK,EAAAzd,EAAAzD,eAAcwhB,EACrB,MACEN,EAAKP,EAAUM,EAAOU,KAAKX,EAAKU,cAAcJ,WAGhD,GAAIN,EAAKY,cACPV,EAAKP,EAAUM,EAAOY,WAAWP,WAC5B,GAAIN,EAAKc,UAAW,CACzB,MAAMN,EAAKR,EAAKvc,YAAqCgd,WAAWT,EAAKe,cACrEb,GAAK,EAAAzd,EAAAzD,eAAcwhB,EACrB,MACEN,EAAKP,EAAUM,EAAOU,KAAKX,EAAKe,cAAcT,MAGlD,OAAOJ,CACT,CAvFqDc,CAC7Ctd,KAAKoK,cAAc+B,MAAMkN,cAAckE,aACD,QAAtCrR,EAAAlM,KAAKoK,cAAc+B,MAAMqR,qBAAa,IAAAtR,OAAA,EAAAA,EAAEqQ,QAC1Cvc,KAAK8K,KAAKzH,KAAK3C,EAAW,KAAMV,KAAKkC,MAAMia,kBAC7C,CACF,CAEO,GAAAjR,CAAI9F,EAAmBC,EAAeC,GAC3C,IAAItF,KAAKqK,UAAarK,KAAK8K,KAA3B,CAIA,GADA9K,KAAKkc,OAAS5W,EAAMD,EAChBrF,KAAKkc,MAAQlc,KAAKkC,MAAMub,eAI1B,OAHAlgB,QAAQC,KAAK,kCACbwC,KAAKqK,UAAW,OAChBrK,KAAK8K,KAAK7G,UAGZ,IACEjE,KAAK8K,KAAKlM,OAAOwG,EAAMC,EAAOC,EAChC,CAAE,MAAOwC,GACPvK,QAAQC,KAAK,uCAAuCsK,KACpD9H,KAAKqK,UAAW,EAChBrK,KAAK8K,KAAK7G,SACZ,CAdA,CAeF,CAEO,MAAAyZ,CAAOnS,SACZ,GAAIvL,KAAKqK,WAAakB,IAAYvL,KAAK8K,KACrC,OAAO,EAGT,MAAM5K,EAAQF,KAAK8K,KAAK5K,MAClB8D,EAAShE,KAAK8K,KAAK9G,OAGzB,IAAK9D,IAAU8D,EAIb,OAHIA,GACFhE,KAAKmK,SAASwT,cAAc3Z,IAEvB,EAGT,MAAM6H,EAASxC,EAAA+D,cAAcC,kBAAarF,EAAW9H,EAAO8D,GAM5D,OALuB,QAAvBkI,EAAAL,EAAO0B,WAAW,aAAK,IAAArB,GAAAA,EAAEsB,aAAa,IAAIN,UAAUlN,KAAK8K,KAAK7E,MAAyC/F,EAAO8D,GAAS,EAAG,GACtHhE,KAAK8K,KAAKlG,YAxFM,SAyFlB5E,KAAK8K,KAAK7G,UAEZjE,KAAKmK,SAASsD,SAAS5B,IAChB,CACT,2FCtGF,MAAAvC,EAAAtK,EAAA,yBAWA,MAEE,WAAAe,CACmBoK,EACAjI,EACAgI,EACAwH,GAHA1R,KAAAmK,SAAAA,EACAnK,KAAAkC,MAAAA,EACAlC,KAAAkK,UAAAA,EACAlK,KAAA0R,UAAAA,EALX1R,KAAAqQ,cAA+B,CAAEC,WAAW,EAAMC,MAAO,MAAOC,OAAQ,EAAGC,UAAW,QAM3F,CAMI,QAAAhD,CAASiD,GACd1Q,KAAKqQ,cAAcC,UAAYtQ,KAAKkC,MAAM0b,eAC1C5d,KAAKmK,SAASsD,SAASiD,EAAK1Q,KAAKqQ,cACnC,CAOO,aAAAsN,CAAc3Z,GACnB,GAAIhE,KAAKkC,MAAM0b,eAAgB,CAC7B,IAAI3K,EAAWjT,KAAKkK,UAAU+I,UACN,IAApBA,EAAS/S,QAAqC,IAArB+S,EAASjP,SACpCiP,EAAW3J,EAAAoC,mBAEb,MAAMK,EAAOhQ,KAAKuI,KAAKN,EAASiP,EAASjP,QACzC,IAAK,IAAIlG,EAAI,EAAGA,EAAIiO,IAAQjO,EAC1BkC,KAAK0R,UAAUvF,MAAMkN,cAAcO,UAEvC,CACF,iLC3CF,MAAAvQ,EAAArK,EAAA,KACAsK,EAAAtK,EAAA,KAEAuK,EAAAC,EAAAxK,EAAA,MACA6e,EAAA7e,EAAA,4BA0BA,MAgCE,WAAAe,CACmBmC,EACAgI,EACA4T,EACA1T,GAHApK,KAAAkC,MAAAA,EACAlC,KAAAkK,UAAAA,EACAlK,KAAA8d,cAAAA,EACA9d,KAAAoK,cAAAA,EAnCXpK,KAAAqK,UAAW,EACXrK,KAAA+d,cAAe,EAEf/d,KAAAge,eAAuC,KAOvChe,KAAAie,gBAAiB,EAGjBje,KAAAke,aAAe,IAAI7gB,YAAW,KAC9B2C,KAAAme,eAAiB,EAGjBne,KAAAoe,kBAAoB,EACpBpe,KAAAqe,kBAAoB,EAGpBre,KAAAse,eAAuC,KAIvCte,KAAAue,sBAA2D,IAAI3M,IAarE5R,KAAKwe,iBAAmBziB,KAAKuI,KAAiC,EAA5BtE,KAAKkC,MAAMuc,eAAqB,GAElEze,KAAK0e,qBAAuB3iB,KAAKE,IAAG,QAAiC+D,KAAKwe,iBAC5E,CAEO,KAAAvT,GACLjL,KAAK2e,qBACD3e,KAAKge,iBACPhe,KAAKge,eAAe/Z,UACpBjE,KAAKge,eAAiB,MAExBhe,KAAK8d,cAAc7S,OACrB,CAEO,OAAAtD,GACL3H,KAAKiL,OACP,CAEQ,mBAAA2T,CAAoB3J,GAC1BjV,KAAKue,sBAAsB3I,OAAOX,GAC9BjV,KAAK6e,kBAAoB5J,IAC3BjV,KAAK6e,qBAAkB7W,EAE3B,CAEQ,kBAAA2W,GACN,IAAK,MAAMG,KAAW9e,KAAKue,sBAAsB9J,SAC/CqK,EAAQC,QAAQ9a,UAElBjE,KAAKue,sBAAsBzV,QAC3B9I,KAAK6e,qBAAkB7W,CACzB,CAEO,KAAA3C,GACLrF,KAAKqK,UAAW,EAChBrK,KAAK+d,cAAe,EACpB/d,KAAKie,gBAAiB,EACtBje,KAAKme,eAAiB,EACtBne,KAAKse,eAAiB,KAEtBte,KAAKoe,kBAAoBpe,KAAKwe,iBAC9Bxe,KAAKqe,kBAAoB,EACzBre,KAAKge,eAAiB,IACxB,CAEO,GAAA9S,CAAI9F,EAAmBC,EAAeC,SAC3C,IAAItF,KAAKqK,SAET,GAAKrK,KAAKie,eAEH,CAEL,IAAIe,EAAa1Z,EACjB,IAAK,IAAIxH,EAAIuH,EAAOvH,EAAIwH,EAAKxH,IAC3B,GAAW,KAAPsH,EAAKtH,GAA4B,CACnCkC,KAAKie,gBAAiB,EACtBe,EAAalhB,EACb,KACF,CAIF,MAAMmhB,EAAaD,EAAa3Z,EAChC,GAAIrF,KAAKme,eAAiBc,EAAU,IAElC,YADAjf,KAAKqK,UAAW,GAMlB,GAHArK,KAAKke,aAAahb,IAAIkC,EAAKX,SAASY,EAAO2Z,GAAahf,KAAKme,gBAC7Dne,KAAKme,gBAAkBc,GAElBjf,KAAKie,eAAgB,CAKxB,GAHAje,KAAKse,gBAAiB,EAAAT,EAAAqB,mBAAkBlf,KAAKmf,gCAGdnX,IAA3BhI,KAAKse,eAAe9F,SAAwDxQ,IAApChI,KAAKse,eAAec,YAG9D,OAFApf,KAAKqf,cAAcrf,KAAKse,eAAe9F,GAAI,0CAAoE,QAA3BtM,EAAElM,KAAKse,eAAegB,aAAK,IAAApT,EAAAA,EAAI,QACnHlM,KAAKqK,UAAW,GAKlB,GAA8B,MAA1BrK,KAAKse,eAAeiB,OACtB,OAIF,MAAMC,EAAeR,EAAa,EAC9BQ,EAAela,GACjBtF,KAAKyf,eAAera,EAAMoa,EAAcla,EAE5C,CACF,MA3CEtF,KAAKyf,eAAera,EAAMC,EAAOC,EA4CrC,CAGQ,cAAAma,CAAera,EAAmBC,EAAeC,iBACvD,GAAItF,KAAKqK,SAAU,OAKnB,MAAMqV,EAA4D,QAAlDzT,EAA0B,QAA1BqB,EAAsB,QAAnBpB,EAAAlM,KAAKse,sBAAc,IAAApS,OAAA,EAAAA,EAAEsM,UAAE,IAAAlL,EAAAA,EAAItN,KAAK6e,uBAAe,IAAA5S,EAAAA,EAAI,EAChE6S,EAAU9e,KAAKue,sBAAsBtN,IAAIyO,GACzCC,EAA+C,QAA5BxR,EAAG2Q,aAAO,EAAPA,EAASc,wBAAgB,IAAAzR,EAAAA,EAAI,EAGzD,GAFAnO,KAAKqe,mBAAqB/Y,EAAMD,EACFsa,EAAsB3f,KAAKqe,kBAC7Bre,KAAKoe,kBAAmB,CAClD,MAAMyB,EAAsC,QAAtBvM,EAAGtT,KAAKge,sBAAc,IAAA1K,EAAAA,EAAIwL,aAAO,EAAPA,EAASC,QASzD,OARIc,GACFA,EAAiB5b,UAEnBjE,KAAKge,eAAiB,KAClBc,GACF9e,KAAK4e,oBAAoBc,QAE3B1f,KAAKqK,UAAW,EAElB,CAEIrK,KAAK+d,gBAELe,aAAO,EAAPA,EAASC,WAAY/e,KAAKge,iBAC5Bhe,KAAKge,eAAiBc,EAAQC,SAE3B/e,KAAKge,iBACRhe,KAAKge,eAAiB,IAAIzU,EAAAwB,QAAa,QAA8B/K,KAAKwe,iBAAkBxe,KAAK0e,sBACjG1e,KAAKge,eAAe3a,QAzKP,IA4KXrD,KAAKge,eAAe9S,IAAI9F,EAAKX,SAASY,EAAOC,MAC/CtF,KAAKge,eAAe/Z,UACpBjE,KAAKge,eAAiB,KACtBhe,KAAK+d,cAAe,EAChBe,GACF9e,KAAK4e,oBAAoBc,IAG/B,CAEO,GAAApa,CAAIiG,WACT,GAAIvL,KAAKqK,WAAakB,EAKpB,OAJIvL,KAAKge,iBACPhe,KAAKge,eAAe/Z,UACpBjE,KAAKge,eAAiB,OAEjB,EAIT,GAAIhe,KAAKie,eACP,OAAOje,KAAK8f,0BAId,MAAMC,EAAM/f,KAAKse,eAGjB,GAAc,MAAVyB,EAAIR,OACN,OAAOvf,KAAKggB,cAAcD,GAI5B,MAAML,EAA2C,QAAjCpS,EAAS,QAATpB,EAAG6T,EAAIvH,UAAE,IAAAtM,EAAAA,EAAIlM,KAAK6e,uBAAe,IAAAvR,EAAAA,EAAI,EAC/C2S,EAA4B,IAAbF,EAAIG,KACnBpB,EAAU9e,KAAKue,sBAAsBtN,IAAIyO,GAE/C,GAAIO,EAgBF,OAfIjgB,KAAKge,iBACHc,GACFA,EAAQc,kBAAoB5f,KAAKqe,kBACjCS,EAAQqB,YAAcrB,EAAQqB,aAAengB,KAAK+d,cAElD/d,KAAKue,sBAAsBrb,IAAIwc,EAAY,CACzCK,IAAGvjB,OAAA2F,OAAA,GAAO4d,GACVhB,QAAS/e,KAAKge,eACd4B,iBAAkB5f,KAAKqe,kBACvB8B,YAAangB,KAAK+d,eAGtB/d,KAAK6e,gBAAkBa,EACvB1f,KAAKge,eAAiB,OAEjB,EAILc,IACF9e,KAAK6e,qBAAkB7W,GAGzB,IAAImY,EAAcngB,KAAK+d,aACnBqC,EAAWL,EACXhB,EAAU/e,KAAKge,eAEfc,IACFsB,EAAWtB,EAAQiB,IACnBhB,EAAUD,EAAQC,QAClBoB,EAAcA,GAAerB,EAAQqB,YACrCngB,KAAKue,sBAAsB3I,OAAO8J,IAGpC,IAAIW,EAAa,IAAIjjB,WAAW,GAC5B2hB,IArPW,IAsPTA,EAAQzZ,QACV6a,GAAc,GAEhBE,EAAatB,EAAQ9Y,OAEvBjG,KAAKge,eAAiB,KAKtB,MAAMze,EAASS,KAAKsgB,8BAA8BF,EAAUC,EAAYF,GAIxE,OAHIpB,GACFA,EAAQ9a,UAEH1E,CACT,CAIQ,uBAAA4f,GACN,IAAIoB,EAAM,GACV,IAAK,IAAIziB,EAAI,EAAGA,EAAIkC,KAAKme,eAAgBrgB,IACvCyiB,GAAOxR,OAAOyR,cAAcxgB,KAAKke,aAAapgB,IAEhD,OAAOyiB,CACT,CAEQ,uBAAAT,iBACN,MAAMC,GAAM,EAAAlC,EAAAqB,mBAAkBlf,KAAKmf,2BAGnC,QAAenX,IAAX+X,EAAIvH,SAAwCxQ,IAApB+X,EAAIX,YAE9B,OADApf,KAAKqf,cAAcU,EAAIvH,GAAI,0CAAoD,QAAXtM,EAAE6T,EAAIT,aAAK,IAAApT,EAAAA,EAAI,IAC5E,EAKT,OAFyB,QAAboB,EAAGyS,EAAIR,cAAM,IAAAjS,EAAAA,EAAI,KAG3B,QACE,OAAOtN,KAAKggB,cAAcD,GAC5B,QAEE,OADA/f,KAAKqf,cAAoB,QAAPpT,EAAC8T,EAAIvH,UAAE,IAAAvM,EAAAA,EAAI,EAAG,KAAe,QAAXkC,EAAE4R,EAAIT,aAAK,IAAAnR,EAAAA,EAAI,IAC5C,EACT,QACE,OAAOnO,KAAKygB,iBAAiBV,GAC/B,QAQE,YAHe/X,IAAX+X,EAAIvH,IACNxY,KAAKqf,cAAcU,EAAIvH,GAAI,4BAAsC,QAAXlF,EAAEyM,EAAIT,aAAK,IAAAhM,EAAAA,EAAI,IAEhE,EAEb,CAEQ,6BAAAgN,CAA8BP,EAAoBW,EAAmBP,iBAG3E,OAFyB,QAAbjU,EAAG6T,EAAIR,cAAM,IAAArT,EAAAA,EAAI,KAG3B,QAA2B,CACzB,MAAM3M,EAASS,KAAK2gB,gBAAgBZ,EAAKW,EAAOP,GAUhD,MAPkC,OAAb,QAAjB7S,EAACyS,EAAIa,oBAAY,IAAAtT,EAAAA,EAAI,WAA2BtF,IAAX+X,EAAIvH,KACvC2H,EACFngB,KAAKqf,cAAcU,EAAIvH,GAAI,6BAAuC,QAAXvM,EAAE8T,EAAIT,aAAK,IAAArT,EAAAA,EAAI,GAC7DyU,EAAM3iB,OAAS,GACxBiC,KAAKqf,cAAcU,EAAIvH,GAAI,KAAe,QAAXrK,EAAE4R,EAAIT,aAAK,IAAAnR,EAAAA,EAAI,IAG3C5O,CACT,CACA,QACE,OAAOS,KAAK6gB,uBAAuBd,EAAKW,EAAOP,GACjD,QACE,OAAOngB,KAAK8gB,aAAaf,EAAKW,EAAOP,GACvC,QAEE,OAAOngB,KAAKygB,iBAAiBV,GAC/B,QAQE,YAHe/X,IAAX+X,EAAIvH,IACNxY,KAAKqf,cAAcU,EAAIvH,GAAI,4BAAsC,QAAXlF,EAAEyM,EAAIT,aAAK,IAAAhM,EAAAA,EAAI,IAEhE,EAEb,CAEQ,gBAAAmN,CAAiBV,SACvB,QAAe/X,IAAX+X,EAAIvH,GACN,OAAO,EAET,MAAMA,EAAKuH,EAAIvH,GACTuI,EAAQ/gB,KAAK8d,cAAckD,SAASxI,GAC1C,OAAKuI,EAIU/gB,KAAKihB,cAAcF,EAAOhB,GAC3B1e,KAAKkK,UAEjB,OADAvL,KAAKqf,cAAc7G,EAAIjN,EAAU,KAAO,gCAA0C,QAAXW,EAAE6T,EAAIT,aAAK,IAAApT,EAAAA,EAAI,EAAG6T,EAAImB,cACtF,KANPlhB,KAAKqf,cAAc7G,EAAI,yBAAmC,QAAXtM,EAAE6T,EAAIT,aAAK,IAAApT,EAAAA,EAAI,EAAG6T,EAAImB,cAC9D,EAOX,CAEQ,eAAAP,CAAgBZ,EAAoBW,EAAmBP,mBAY7D,MAAqB,OADgB,QAAnBjU,EAAG6T,EAAIa,oBAAY,IAAA1U,EAAAA,EAAI,WAExBlE,IAAX+X,EAAIvH,IACNxY,KAAKqf,cAAcU,EAAIvH,GAAI,yCAAmD,QAAXlL,EAAEyS,EAAIT,aAAK,IAAAhS,EAAAA,EAAI,IAE7E,IAGL6S,GAAgC,IAAjBO,EAAM3iB,QAEzBiC,KAAK8d,cAAcqD,WAAWpB,EAAIvH,GAAI,CACpCpT,KAAM,IAAIsI,KAAK,CAACgT,IAChBxgB,MAAgB,QAAX+L,EAAE8T,EAAI7f,aAAK,IAAA+L,EAAAA,EAAI,EACpBjI,OAAkB,QAAZmK,EAAE4R,EAAI/b,cAAM,IAAAmK,EAAAA,EAAI,EACtBiT,OAAmB,QAAX9N,EAACyM,EAAIqB,cAAM,IAAA9N,EAAAA,EAAA,GACnB+N,YAA4B,QAAjBC,EAAEvB,EAAIsB,mBAAW,IAAAC,EAAAA,EAAI,MAPY,EAUhD,CAEQ,sBAAAT,CAAuBd,EAAoBW,EAAmBP,WACpE,GAAIA,EAIF,YAHenY,IAAX+X,EAAIvH,IACNxY,KAAKqf,cAAcU,EAAIvH,GAAI,6BAAuC,QAAXtM,EAAE6T,EAAIT,aAAK,IAAApT,EAAAA,EAAI,IAEjE,EAGTlM,KAAK2gB,gBAAgBZ,EAAKW,EAAOP,GAEjC,MAAM3H,EAAW,QAATlL,EAAGyS,EAAIvH,UAAE,IAAAlL,EAAAA,EAAItN,KAAK8d,cAAcyD,YAClCR,EAAQ/gB,KAAK8d,cAAckD,SAASxI,GAC1C,GAAIuI,EAAO,CACT,MAAMxhB,EAASS,KAAKihB,cAAcF,EAAOhB,GACzC,YAAe/X,IAAX+X,EAAIvH,GACCjZ,EAAO8B,KAAKkK,UAEjB,OADAvL,KAAKqf,cAAc7G,EAAIjN,EAAU,KAAO,gCAA0C,QAAXW,EAAE6T,EAAIT,aAAK,IAAApT,EAAAA,EAAI,IAC/E,IAGJ3M,EAAO8B,KAAK,KAAM,EAC3B,CACA,OAAO,CACT,CAEQ,YAAAyf,CAAaf,EAAoBW,EAAmBP,mBAC1D,MAAM3H,EAAW,QAATtM,EAAG6T,EAAIvH,UAAE,IAAAtM,EAAAA,EAAI,EACfoT,EAAiB,QAAZhS,EAAGyS,EAAIT,aAAK,IAAAhS,EAAAA,EAAI,EAM3B,GAAqB,OADgB,QAAnBrB,EAAG8T,EAAIa,oBAAY,IAAA3U,EAAAA,EAAI,KAGvC,OADAjM,KAAKqf,cAAc7G,EAAI,yCAA0C8G,IAC1D,EAIT,GAAIa,EAEF,OADAngB,KAAKqf,cAAc7G,EAAI,6BAA8B8G,IAC9C,EAIT,GAAqB,IAAjBoB,EAAM3iB,OAER,OADAiC,KAAKqf,cAAc7G,EAAI,KAAM8G,IACtB,EAGT,MAAM8B,EAAmB,QAAbjT,EAAG4R,EAAIqB,cAAM,IAAAjT,EAAAA,EAAA,GAEzB,GAAU,MAANiT,EACFphB,KAAKqf,cAAc7G,EAAI,KAAM8G,OACxB,CACL,MAAMpf,EAAiB,QAAZoT,EAAGyM,EAAI7f,aAAK,IAAAoT,EAAAA,EAAI,EACrBtP,EAAmB,QAAbsd,EAAGvB,EAAI/b,cAAM,IAAAsd,EAAAA,EAAI,EAE7B,IAAKphB,IAAU8D,EAEb,OADAhE,KAAKqf,cAAc7G,EAAI,sDAAuD8G,IACvE,EAGT,MACMkC,EAAgBthB,EAAQ8D,GADF,KAANod,EAA6B,EAA2C,GAG9F,GAAIV,EAAM3iB,OAASyjB,EAEjB,OADAxhB,KAAKqf,cAAc7G,EAAI,iCAAkC8G,IAClD,EAGTtf,KAAKqf,cAAc7G,EAAI,KAAM8G,EAC/B,CACA,OAAO,CACT,CAEQ,aAAAU,CAAcD,SAOpB,OALmC,QAArB7T,EAAG6T,EAAI0B,sBAAc,IAAAvV,EAAAA,EAAI,KAMrC,IAAK,IACL,IAAK,IACHlM,KAAK2e,qBACL3e,KAAK8d,cAAc4D,YACnB,MACF,IAAK,IACL,IAAK,IAKH,QAAe1Z,IAAX+X,EAAIvH,GAAkB,CACxB,MAAMsG,EAAU9e,KAAKue,sBAAsBtN,IAAI8O,EAAIvH,IAC/CsG,GACFA,EAAQC,QAAQ9a,UAElBjE,KAAK4e,oBAAoBmB,EAAIvH,IAC7BxY,KAAK8d,cAAc6D,WAAW5B,EAAIvH,GACpC,EAMJ,OAAO,CACT,CAEQ,aAAA6G,CAAc7G,EAAYV,EAAiBwH,EAAe4B,GAChE,MAAMU,EAAmB,OAAZ9J,EACb,GAAI8J,GAAQtC,GAAS,EAAG,OACxB,IAAKsC,GAAQtC,GAAS,EAAG,OAEzB,MACMuC,EAAW,QAAWrJ,IADd0I,EAAc,MAAMA,IAAgB,MACRpJ,OAC1C9X,KAAKoK,cAAc+B,MAAM2V,YAAYC,iBAAiBF,EACxD,CAIQ,aAAAZ,CAAcF,EAAwBhB,GAC5C,OAAO/f,KAAKgiB,kBAAkBjB,EAAOhB,GAClC1e,KAAK,KAAM,GACX0M,MAAM,KAAM,EACjB,CAEQ,uBAAMiU,CAAkBjB,EAAwBhB,qBACtD,IAAIzJ,QAAwCtW,KAAKiiB,cAAclB,GAE/D,IACE,MAAMmB,EAAQnmB,KAAKC,IAAI,EAAQ,QAAPiQ,EAAE8T,EAAI5J,SAAC,IAAAlK,EAAAA,EAAI,GAC7BkW,EAAQpmB,KAAKC,IAAI,EAAQ,QAAPmS,EAAE4R,EAAI3M,SAAC,IAAAjF,EAAAA,EAAI,GAC7BiU,EAAQrC,EAAIsC,aAAgB/L,EAAOpW,MAAQgiB,EAC3CI,EAAQvC,EAAIwC,cAAiBjM,EAAOtS,OAASme,EAE7CK,EAAWzmB,KAAKC,IAAI,EAAGsa,EAAOpW,MAAQgiB,GACtCO,EAAW1mB,KAAKC,IAAI,EAAGsa,EAAOtS,OAASme,GACvCO,EAAa3mB,KAAKC,IAAI,EAAGD,KAAKE,IAAImmB,EAAOI,IACzCG,EAAa5mB,KAAKC,IAAI,EAAGD,KAAKE,IAAIqmB,EAAOG,IAE/C,GAAmB,IAAfC,GAAmC,IAAfC,EACtB,MAAM,IAAIvgB,MAAM,4BAGlB,GAAc,IAAV8f,GAAyB,IAAVC,GAAeO,IAAepM,EAAOpW,OAASyiB,IAAerM,EAAOtS,OAAQ,CAC7F,MAAM4e,QAAgBjV,kBAAkB2I,EAAQ4L,EAAOC,EAAOO,EAAYC,GAC1ErM,EAAOxD,QACPwD,EAASsM,CACX,CAEA,MAAM5U,GAA8B,QAAzB9B,EAAAlM,KAAKkK,UAAUyB,kBAAU,IAAAO,OAAA,EAAAA,EAAEN,IAAIqC,KAAK/N,QAASoJ,EAAAoC,kBAAkBxL,MACpEgO,GAA8B,QAAzBZ,EAAAtN,KAAKkK,UAAUyB,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIqC,KAAKjK,SAAUsF,EAAAoC,kBAAkB1H,OAI3E,IAAI6e,EACAC,OACgB9a,IAAhB+X,EAAIgD,cAAsC/a,IAAb+X,EAAIhU,MACnC8W,EAAU9C,EAAIgD,QACdD,EAAU/C,EAAIhU,WACW/D,IAAhB+X,EAAIgD,SACbF,EAAU9C,EAAIgD,QACdD,EAAU/mB,KAAKC,IAAI,EAAGD,KAAKuI,KAAMgS,EAAOtS,OAASsS,EAAOpW,OAAU2iB,EAAU7U,GAAME,UAC5DlG,IAAb+X,EAAIhU,MACb+W,EAAU/C,EAAIhU,KACd8W,EAAU9mB,KAAKC,IAAI,EAAGD,KAAKuI,KAAMgS,EAAOpW,MAAQoW,EAAOtS,QAAW8e,EAAU5U,GAAMF,MAElF6U,EAAU9mB,KAAKuI,KAAKgS,EAAOpW,MAAQ8N,GACnC8U,EAAU/mB,KAAKuI,KAAKgS,EAAOtS,OAASkK,IAGtC,IAAIzC,EAAI6K,EAAOpW,MACX9B,EAAIkY,EAAOtS,OAQf,QALoBgE,IAAhB+X,EAAIgD,cAAsC/a,IAAb+X,EAAIhU,OACnCN,EAAI1P,KAAKQ,MAAMsmB,EAAU7U,GACzB5P,EAAIrC,KAAKQ,MAAMumB,EAAU5U,IAGvBzC,EAAIrN,EAAI4B,KAAKkC,MAAM6K,WACrB,MAAM,IAAI3K,MAAM,6BAIlB,MAAM9E,EAAS0C,KAAKoK,cAAc+B,MAAM7O,OAClC0lB,EAAS1lB,EAAO6Y,EAChB8M,EAAS3lB,EAAO8V,EAChB8P,EAAa5lB,EAAOoc,MAOpBnJ,OAD6BvI,IAAf+X,EAAIvP,QAAwBuP,EAAIvP,OAAS,EACrB,SAAW,MAEnD,GAAI/E,IAAM6K,EAAOpW,OAAS9B,IAAMkY,EAAOtS,OAAQ,CAC7C,MAAMmf,QAAexV,kBAAkB2I,EAAQ,CAAE1I,YAAanC,EAAGoC,aAAczP,IAC/EkY,EAAOxD,QACPwD,EAAS6M,CACX,CAGA,MAAMC,EAAUrnB,KAAKE,IAAIF,KAAKC,IAAI,EAAc,QAAbsX,EAAEyM,EAAIqD,eAAO,IAAA9P,EAAAA,EAAI,GAAItF,EAAK,GACvDqV,EAAUtnB,KAAKE,IAAIF,KAAKC,IAAI,EAAc,QAAbslB,EAAEvB,EAAIsD,eAAO,IAAA/B,EAAAA,EAAI,GAAIpT,EAAK,GAC7D,GAAgB,IAAZkV,GAA6B,IAAZC,EAAe,CAKlC,MAAMC,OAA2Btb,IAAhB+X,EAAIgD,QAAyBhnB,KAAKQ,MAAMsmB,EAAU7U,GAAMsI,EAAOpW,MAAQkjB,EAClFG,OAAwBvb,IAAb+X,EAAIhU,KAAsBhQ,KAAKQ,MAAMumB,EAAU5U,GAAMoI,EAAOtS,OAASqf,EAChFG,EAAena,EAAA+D,cAAcC,aAAakJ,OAAOpF,SAAUmS,EAASC,GACpEE,EAAYD,EAAajW,WAAW,MAC1C,IAAKkW,EACH,MAAM,IAAIrhB,MAAM,0CAElBqhB,EAAUnP,UAAUgC,EAAQ8M,EAASC,GAErC,MAAMK,QAAqB/V,kBAAkB6V,GAM7C,GALAA,EAAatjB,MAAQsjB,EAAaxf,OAAS,EAC3CsS,EAAOxD,QACPwD,EAASoN,EACTjY,EAAI6K,EAAOpW,MACX9B,EAAIkY,EAAOtS,OACPyH,EAAIrN,EAAI4B,KAAKkC,MAAM6K,WACrB,MAAM,IAAI3K,MAAM,kCAEE4F,IAAhB+X,EAAIgD,UACNF,EAAU9mB,KAAKuI,KAAKgS,EAAOpW,MAAQ8N,SAEpBhG,IAAb+X,EAAIhU,OACN+W,EAAU/mB,KAAKuI,KAAKgS,EAAOtS,OAASkK,GAExC,CAEA,MAAMsC,EAAmB,QAAbmT,EAAG5D,EAAIvP,cAAM,IAAAmT,EAAAA,EAAI,EAO7B,GANA3jB,KAAK8d,cAAcrQ,SAASsT,EAAMvI,GAAIlC,GAAQ,EAAM/F,EAAOC,GAC3D8F,OAAStO,EAKkB,IAAvB+X,EAAI6D,eAAsB,CAE5B,MAAMC,EAAWvmB,EAAOoc,MAAQwJ,EAChC5lB,EAAO6Y,EAAI6M,EAEX1lB,EAAO8V,EAAIrX,KAAKC,IAAIinB,EAASY,EAAU,EACzC,MAGEvmB,EAAO6Y,EAAIpa,KAAKE,IAAI+mB,EAASH,EAAS7iB,KAAKoK,cAAc0B,KAE7D,CAAE,MAAOhE,GAEP,MADAwO,SAAAA,EAAQxD,QACFhL,CACR,CACF,CAGQ,mBAAMma,CAAclB,GAC1B,IAAIL,EAAoB,IAAItjB,iBAAiB2jB,EAAM3b,KAAK0e,eAMxD,GAJqB,MAAjB/C,EAAMM,cACRX,QAAc1gB,KAAK+jB,gBAAgBrD,IAGrB,MAAZK,EAAMK,OAA4B,CACpC,MAAM1U,EAAO,IAAIgB,KAAK,CAACgT,GAAoB,CAAE7W,KAAM,cACnD,IAAK0M,OAAO5I,kBAAmB,CAC7B,MAAMqW,EAAMC,IAAIC,gBAAgBxX,GAC1BgE,EAAM,IAAIyT,MAChB,OAAO,IAAI3S,QAAqB,CAACC,EAAS2S,KACxC1T,EAAI2T,iBAAiB,OAAQ,WAC3BJ,IAAIK,gBAAgBN,GACpB,MAAMnY,EAASxC,EAAA+D,cAAcC,aAAakJ,OAAOpF,SAAUT,EAAIxQ,MAAOwQ,EAAI1M,QACnD,QAAvBkI,EAAAL,EAAO0B,WAAW,aAAK,IAAArB,GAAAA,EAAEoI,UAAU5D,EAAK,EAAG,GAC3C/C,kBAAkB9B,GAAQxK,KAAKoQ,GAAS1D,MAAMqW,KAEhD1T,EAAI2T,iBAAiB,QAAS,KAC5BJ,IAAIK,gBAAgBN,GACpBI,EAAO,IAAIhiB,MAAM,2BAEnBsO,EAAI6T,IAAMP,GAEd,CACA,OAAOrW,kBAAkBjB,EAC3B,CAGA,MAAMxM,EAAQ6gB,EAAM7gB,MACd8D,EAAS+c,EAAM/c,OAErB,IAAK9D,IAAU8D,EACb,MAAM,IAAI5B,MAAM,gDAGlB,MACMof,EAAgBthB,EAAQ8D,GADI,KAAZ+c,EAAMK,OAA6B,EAA2C,GAGpG,GAAIV,EAAM3iB,OAASyjB,EACjB,MAAM,IAAIpf,MAAM,2BAGlB,MAAMoiB,EAAatkB,EAAQ8D,EAE3B,GAAgB,KAAZ+c,EAAMK,OAER,OAAOzT,kBAAkB,IAAIT,UAAU,IAAIhH,kBAAkBwa,EAAMpjB,OAAuBojB,EAAMvT,WAAsB,EAAVqX,GAAwDtkB,EAAO8D,IAM7K,MAAMoB,EAAO,IAAIc,kBAA4B,EAAVse,GAC7BC,EAAQ,IAAIpnB,YAAYqjB,EAAMpjB,OAAQojB,EAAMvT,WAAYpR,KAAKkR,MAAMyT,EAAM7b,WAAa,IACtF6f,EAAQ,IAAIrnB,YAAY+H,EAAK9H,QAC7BqnB,GAA6B,EAAbH,EAEtB,IAAII,EAAY,EACZC,EAAY,EAChB,IAAK,IAAI/mB,EAAI,EAAGA,EAAI6mB,EAAe7mB,GAAK,EAAG,CACzC,MAAMgnB,EAAKL,EAAMG,KACXG,EAAKN,EAAMG,KACXI,EAAKP,EAAMG,KAEjBF,EAAMG,KAAe,WAAaC,EAClCJ,EAAMG,KAAe,WAAcC,IAAO,GAAOC,GAAM,EACvDL,EAAMG,KAAe,WAAcE,IAAO,GAAOC,GAAM,GACvDN,EAAMG,KAAe,WAAcG,IAAO,CAC5C,CAGA,IAAIC,EAAuB,EAAbN,EACVO,EAAuB,EAAbP,EACd,IAAK,IAAI7mB,EAAI6mB,EAAe7mB,EAAI0mB,EAAY1mB,IAC1CsH,EAAK8f,GAAexE,EAAMuE,GAC1B7f,EAAK8f,EAAU,GAAKxE,EAAMuE,EAAU,GACpC7f,EAAK8f,EAAU,GAAKxE,EAAMuE,EAAU,GACpC7f,EAAK8f,EAAU,GAAE,IACjBD,GAAO,EACPC,GAAO,EAGT,OAAOvX,kBAAkB,IAAIT,UAAU9H,EAAMlF,EAAO8D,GACtD,CAEQ,qBAAM+f,CAAgBoB,GAC5B,IACE,aAAanlB,KAAKolB,YAAYD,EAAY,UAC5C,UACE,aAAanlB,KAAKolB,YAAYD,EAAY,cAC5C,CACF,CAEQ,iBAAMC,CAAYD,EAAwB/D,GAChD,MAAMiE,EAAK,IAAIC,oBAAoBlE,GAC7BmE,EAASF,EAAGG,SAASC,YAC3BF,EAAOG,MAAMP,GACbI,EAAOzS,QAEP,MAAM6S,EAAuB,GACvBC,EAASP,EAAGQ,SAASC,YAE3B,OAAa,CACX,MAAMC,KAAEA,EAAIjqB,MAAEA,SAAgB8pB,EAAOI,OACrC,GAAID,EAAM,MACVJ,EAAOjnB,KAAK5C,EACd,CAEA,MAAMmqB,EAAcN,EAAOO,OAAO,CAACC,EAAKC,IAAUD,EAAMC,EAAMroB,OAAQ,GAChEwB,EAAS,IAAInC,WAAW6oB,GAC9B,IAAI9hB,EAAS,EACb,IAAK,MAAMiiB,KAAST,EAClBpmB,EAAO2D,IAAIkjB,EAAOjiB,GAClBA,GAAUiiB,EAAMroB,OAElB,OAAOwB,CACT,CAEA,UAAW8mB,GACT,OAAOrmB,KAAK8d,cAAcuI,MAC5B,CAEA,uBAAWC,GACT,OAAOtmB,KAAK8d,cAAcyI,kBAC5B,CAEA,wBAAWC,GACT,OAAOxmB,KAAKue,qBACd,kFCnqBF,SAAkCnZ,GAChC,MAAM2a,EAAqB,GACrB0G,EAAQrhB,EAAKshB,MAAM,KAEzB,IAAK,MAAMC,KAAQF,EAAO,CACxB,MAAMG,EAAQD,EAAKzf,QAAQ,KAC3B,IAAe,IAAX0f,EAAc,SAElB,MAAM3R,EAAM0R,EAAKE,UAAU,EAAGD,GACxB9qB,EAAQ6qB,EAAKE,UAAUD,EAAQ,GAGrC,GAAO,MAAH3R,EAAyB,CAC3B8K,EAAIR,OAASzjB,EACb,QACF,CACA,GAAO,MAAHmZ,EAA8B,CAChC8K,EAAIsB,YAAcvlB,EAClB,QACF,CACA,GAAO,MAAHmZ,EAA+B,CACjC8K,EAAIa,aAAe9kB,EACnB,QACF,CACA,GAAO,MAAHmZ,EAAkC,CACpC8K,EAAI0B,eAAiB3lB,EACrB,QACF,CACA,MAAMgrB,EAAWjY,SAAS/S,EAAO,IACjC,OAAQmZ,GACN,QAAsB8K,EAAIqB,OAAS0F,EAAU,MAC7C,QAAkB/G,EAAIvH,GAAKsO,EAAU,MACrC,QAA4B/G,EAAIX,YAAc0H,EAAU,MACxD,QAAqB/G,EAAI7f,MAAQ4mB,EAAU,MAC3C,QAAsB/G,EAAI/b,OAAS8iB,EAAU,MAC7C,QAAwB/G,EAAI5J,EAAI2Q,EAAU,MAC1C,QAAwB/G,EAAI3M,EAAI0T,EAAU,MAC1C,QAA4B/G,EAAIsC,YAAcyE,EAAU,MACxD,QAA6B/G,EAAIwC,aAAeuE,EAAU,MAC1D,QAAkC/G,EAAIqD,QAAU0D,EAAU,MAC1D,QAAkC/G,EAAIsD,QAAUyD,EAAU,MAC1D,QAAuB/G,EAAIgD,QAAU+D,EAAU,MAC/C,QAAoB/G,EAAIhU,KAAO+a,EAAU,MACzC,QAAoB/G,EAAIG,KAAO4G,EAAU,MACzC,QAAqB/G,EAAIT,MAAQwH,EAAU,MAC3C,QAA+B/G,EAAI6D,eAAiBkD,EAAU,MAC9D,QAAuB/G,EAAIvP,OAASsW,EAAU,MAC9C,QAA4B/G,EAAImB,YAAc4F,EAElD,CAEA,OAAO/G,CACT,wFCjLA,MAAAgH,EA6BE,WAAAhnB,CACmBoK,GAAAnK,KAAAmK,SAAAA,EA3BXnK,KAAAgnB,aAAe,EACNhnB,KAAAqX,QAAwC,IAAIzF,IAU5C5R,KAAAsmB,oBAA2C,IAAI1U,IAC/C5R,KAAAinB,oBAA2C,IAAIrV,IAI/C5R,KAAAknB,2BAA8BC,IAC7C,MAAMC,EAAUpnB,KAAKinB,oBAAoBhW,IAAIkW,QAC7Bnf,IAAZof,IACFpnB,KAAKsmB,oBAAoB1Q,OAAOwR,GAChCpnB,KAAKinB,oBAAoBrR,OAAOuR,GAChCnnB,KAAKqX,QAAQzB,OAAOwR,KAGhBpnB,KAAAqQ,cAA+B,CAAEC,WAAW,EAAMC,MAAO,MAAOC,OAAQ,EAAGC,UAAW,OAK5FzQ,KAAKqnB,wBAA0BrnB,KAAKmK,SAASuO,eAC7C1Y,KAAKsnB,uBAA0BH,UACD,QAA5Bjb,EAAAlM,KAAKqnB,+BAAuB,IAAAnb,GAAAA,EAAA1E,KAA5BxH,KAA+BmnB,GAC/BnnB,KAAKknB,2BAA2BC,IAElCnnB,KAAKmK,SAASuO,eAAiB1Y,KAAKsnB,sBACtC,CAEO,KAAArc,GACLjL,KAAKgnB,aAAe,EACpBhnB,KAAKqX,QAAQvO,QACb9I,KAAKsmB,oBAAoBxd,QACzB9I,KAAKinB,oBAAoBne,OAC3B,CAEO,OAAAnB,GACL3H,KAAKiL,QACDjL,KAAKmK,SAASuO,iBAAmB1Y,KAAKsnB,yBACxCtnB,KAAKmK,SAASuO,eAAiB1Y,KAAKqnB,wBAExC,CAEO,UAAAlG,CAAW3I,EAAwB+O,GACxC,MAAMtQ,EAAUuB,QAAAA,EAAMxY,KAAKgnB,eAErBQ,EAAexnB,KAAKsmB,oBAAoBrV,IAAIgG,GAelD,YAdqBjP,IAAjBwf,IACFxnB,KAAKmK,SAAS4O,YAAYyO,GAC1BxnB,KAAKsmB,oBAAoB1Q,OAAOqB,GAChCjX,KAAKinB,oBAAoBrR,OAAO4R,KAG7BxnB,KAAKqX,QAAQjC,IAAI6B,IAAYjX,KAAKqX,QAAQtN,MAAQgd,EAAkBU,kBACvEznB,KAAK0nB,0BAGP1nB,KAAKqX,QAAQnU,IAAI+T,EAAOza,OAAA2F,OAAA3F,OAAA2F,OAAA,GACnBolB,GAAS,CACZ/O,GAAIvB,KAECA,CACT,CAEO,QAAAxJ,CAAS2Z,EAAiBrG,EAAwCzQ,EAAoBC,EAAmBC,GAK9G,MAAMgX,EAAexnB,KAAKsmB,oBAAoBrV,IAAImW,QAC7Bpf,IAAjBwf,GACFxnB,KAAKinB,oBAAoBrR,OAAO4R,GAElCxnB,KAAKqQ,cAAcC,UAAYA,EAC/BtQ,KAAKqQ,cAAcE,MAAQA,EAC3BvQ,KAAKqQ,cAAcG,OAASA,EAC5B,MAAM2W,EAAYnnB,KAAKmK,SAASsD,SAASsT,EAAO/gB,KAAKqQ,eACrDrQ,KAAKsmB,oBAAoBpjB,IAAIkkB,EAASD,GACtCnnB,KAAKinB,oBAAoB/jB,IAAIikB,EAAWC,EAC1C,CAEO,QAAApG,CAASoG,GACd,OAAOpnB,KAAKqX,QAAQpG,IAAImW,EAC1B,CAEO,UAAAzF,CAAWyF,GAChBpnB,KAAKqX,QAAQzB,OAAOwR,GACpB,MAAMD,EAAYnnB,KAAKsmB,oBAAoBrV,IAAImW,QAC7Bpf,IAAdmf,IACFnnB,KAAKmK,SAAS4O,YAAYoO,GAC1BnnB,KAAKsmB,oBAAoB1Q,OAAOwR,GAChCpnB,KAAKinB,oBAAoBrR,OAAOuR,GAEpC,CAEO,SAAAzF,GACL1hB,KAAKqX,QAAQvO,QACb,IAAK,MAAMqe,KAAannB,KAAKsmB,oBAAoB7R,SAC/CzU,KAAKmK,SAAS4O,YAAYoO,GAE5BnnB,KAAKsmB,oBAAoBxd,QACzB9I,KAAKinB,oBAAoBne,OAC3B,CAEA,UAAWud,GACT,OAAOrmB,KAAKqX,OACd,CAEA,sBAAWkP,GACT,OAAOvmB,KAAKsmB,mBACd,CAEA,eAAW/E,GACT,OAAOvhB,KAAKgnB,aAAe,CAC7B,CAEQ,uBAAAU,GACN,IAAK,MAAON,KAAYpnB,KAAKqX,QAAS,CACpC,GAAIrX,KAAKqX,QAAQtN,MAAQgd,EAAkBU,iBAAmB,EAC5D,MAEGznB,KAAKsmB,oBAAoBlR,IAAIgS,IAChCpnB,KAAKqX,QAAQzB,OAAOwR,EAExB,CACF,wBAvIwBL,EAAAU,iBAAmB,gBCjB7CjrB,OAAAC,eAAA5B,EAAA,cAA+CiB,OAAA,IAK/C,MAIA6rB,GAAA,EAJyB3oB,EAAQ,KAIjC4oB,QAAA,CAAgGtpB,EAAA,EAAAwe,EAAA,EAAA3e,EAAA,6lCAuJhG0pB,EAAA,IAAAzqB,WAAA,mEACAspB,MAAA,IACA3e,IAAA+f,GAAAA,EAAAtoB,WAAA,KAEAuoB,EAAA,IAAA1qB,YAAA,MACA0qB,EAAApiB,KAAA,YACA,QAAA7H,EAAA,EAAgBA,EAAA+pB,EAAA9pB,SAAgBD,EAChCiqB,EAAAF,EAAA/pB,IAAAA,GAAA,EACA,QAAAA,EAAA,EAAgBA,EAAA+pB,EAAA9pB,SAAgBD,EAChCiqB,EAAA,IAAAF,EAAA/pB,IAAAA,GAAA,GAAAA,GAAA,UACA,QAAAA,EAAA,EAAgBA,EAAA+pB,EAAA9pB,SAAgBD,EAChCiqB,EAAA,IAAAF,EAAA/pB,IAAAA,GAAA,MAAAA,GAAA,WACA,QAAAA,EAAA,EAAgBA,EAAA+pB,EAAA9pB,SAAgBD,EAChCiqB,EAAA,IAAAF,EAAA/pB,IAAAA,GAAA,GACA,MAAAkqB,EAAA,IAAA5qB,WAAA,GAkKAvC,EAAA,QAvJA,MAMA,WAAAkF,CAAAkoB,EAAAC,EAAArd,GAOA,GANA7K,KAAAmoB,MAAA,KACAnoB,KAAAooB,QAAA,EACApoB,KAAAqoB,OAAA,EACAroB,KAAAioB,SAAAA,QAAAA,EAAA,QACAjoB,KAAAkoB,SAAAA,QAAAA,EAAA,WACAloB,KAAAqoB,OAAAxd,QAAAA,EAAA,MACA7K,KAAAqoB,OAAAroB,KAAAkoB,UAAAloB,KAAAkoB,SAAA,WACA,UAAA9lB,MAAA,wBAEA,CAKA,SAAA6D,GACA,OAAAjG,KAAAmoB,MAAAnoB,KAAAmO,GAAA1J,SAAA,EAAAzE,KAAAsoB,KAAA,OAAAN,CACA,CAMA,OAAA/jB,GACAjE,KAAAmoB,QAEAnoB,KAAAqoB,OAAAroB,KAAAioB,SACAjoB,KAAAmoB,MAAAnoB,KAAAsoB,KAAAtoB,KAAAmO,GAAAnO,KAAAuoB,KAAA,MAGAvoB,KAAAsoB,KAAA,QACAtoB,KAAAsoB,KAAA,QACAtoB,KAAAsoB,KAAA,SAEA,CASA,IAAAjlB,CAAA6kB,EAAArd,GAGA,GAFA7K,KAAAkoB,SAAAA,QAAAA,EAAAloB,KAAAkoB,SACAloB,KAAAqoB,OAAAxd,QAAAA,EAAA9O,KAAAE,IAAA+D,KAAAqoB,OAAAroB,KAAAkoB,UACAloB,KAAAqoB,OAAAroB,KAAAkoB,UAAAloB,KAAAkoB,SAAA,WACA,MAAA9lB,MAAA,yBAEA,IAAAomB,EAAAxoB,KAAAsoB,KACA,MAAA5H,EAAA1gB,KAAAqoB,OAAA,KACAroB,KAAAmoB,MAOAnoB,KAAAuoB,KAAAjrB,OAAAuH,WAAA6b,IACA1gB,KAAAuoB,KAAAE,KAAA1sB,KAAAuI,MAAAoc,EAAA1gB,KAAAuoB,KAAAjrB,OAAAuH,YAAA,QACA2jB,EAAA,IAAAnrB,YAAA2C,KAAAuoB,KAAAjrB,OAAA,GACA0C,KAAAmO,GAAA,IAAA/Q,WAAA4C,KAAAuoB,KAAAjrB,OAAA,QATA0C,KAAAuoB,KAAA,IAAApnB,YAAAunB,OAAA,CAAiDngB,QAAAxM,KAAAuI,KAAAoc,EAAA,SACjD1gB,KAAAmoB,MAAAR,EAAA,CAAsC1mB,IAAA,CAAO0B,OAAA3C,KAAAuoB,QAC7CC,EAAA,IAAAnrB,YAAA2C,KAAAuoB,KAAAjrB,OAAA,GACAkrB,EAAAtlB,IAAA6kB,EAAA,KACA/nB,KAAAmO,GAAA,IAAA/Q,WAAA4C,KAAAuoB,KAAAjrB,OAAA,OAOAkrB,EAAA,QACAA,EAAA,QACAA,EAAA,QACAxoB,KAAAsoB,KAAAE,EACAxoB,KAAAooB,QAAA,CACA,CAOA,QAAAlkB,CAAAykB,GACA,MAAAC,EAAA5oB,KAAAsoB,KAAA,MAAAK,EACA,GAAA3oB,KAAAqoB,OAAAO,EAAA,CACA,GAAAA,EAAA5oB,KAAAkoB,SACA,SAEA,IAAAW,EAAA7oB,KAAAqoB,OACA,MAAAQ,GAAA,GAAAD,IAEA,GADAC,EAAA9sB,KAAAE,IAAA4sB,EAAA7oB,KAAAkoB,UACAW,EAAAD,EACA,SAEA,GAAAC,EAAA,KAAA7oB,KAAAuoB,KAAAjrB,OAAAuH,WAAA,CACA,MAAAikB,EAAA/sB,KAAAuI,MAAAukB,EAAA,KAAA7oB,KAAAuoB,KAAAjrB,OAAAuH,YAAA,OACA7E,KAAAuoB,KAAAE,KAAAK,GACA9oB,KAAAsoB,KAAA,IAAAjrB,YAAA2C,KAAAuoB,KAAAjrB,OAAA,GACA0C,KAAAmO,GAAA,IAAA/Q,WAAA4C,KAAAuoB,KAAAjrB,OAAA,KACA,CACA0C,KAAAqoB,OAAAQ,CACA,CACA,QACA,CAOA,GAAA3d,CAAA9F,GACA,IAAApF,KAAAmoB,OAAAnoB,KAAAooB,OACA,SAEA,GAAApoB,KAAAkE,SAAAkB,EAAArH,QACA,SAEA,MAAAyqB,EAAAxoB,KAAAsoB,KAIA,OAHAtoB,KAAAmO,GAAAjL,IAAAkC,EAAAojB,EAAA,OACAA,EAAA,OAAApjB,EAAArH,OAEAyqB,EAAA,MAAAA,EAAA,cACAxoB,KAAAmoB,MAAAttB,QAAAsL,MACA,CACA,CAKA,GAAAb,GAEA,OADAtF,KAAAooB,QAAA,EACApoB,KAAAmoB,MACAnoB,KAAAmoB,MAAAttB,QAAAyK,OACA,CACA,CAIA,eAAAyjB,GACA,OAAA/oB,KAAAmoB,MACAnoB,KAAAsoB,KAAA,MACA,CACA,CAIA,aAAAU,GACA,OAAAhpB,KAAAmoB,MACAnoB,KAAAkoB,SAAAloB,KAAAsoB,KAAA,MACA,CACA,cC9UA9rB,OAAAC,eAAA5B,EAAA,cAA+CiB,OAAA,IAK/C,MACAmtB,GAAA,EADyBjqB,EAAQ,KACjC4oB,QAAA,CAAuGtpB,EAAA,EAAAwe,EAAA,EAAA3e,EAAA,i5BA8DvGtD,EAAA,QA7DA,MACA,WAAAkF,CAAAkoB,GACAjoB,KAAAioB,SAAAA,EACAjoB,KAAAE,MAAA,EACAF,KAAAgE,OAAA,CACA,CACA,MAAApF,CAAAT,GACA6B,KAAAE,MAAA/B,EAAA,OAAAA,EAAA,OAAAA,EAAA,MAAAA,EAAA,GACA6B,KAAAgE,OAAA7F,EAAA,OAAAA,EAAA,OAAAA,EAAA,OAAAA,EAAA,IACA,MAAA4F,EAAA/D,KAAAE,MAAAF,KAAAgE,OACAklB,EAAA,EAAAnlB,EACAolB,EAAAhrB,EAAAJ,OAwBA2iB,EAAA3kB,KAAAC,IAAAktB,EAAAC,IAAAptB,KAAAE,IAAAitB,EAAAC,IAAA,QACAnpB,KAAAmoB,MAIAnoB,KAAAuoB,KAAAjrB,OAAAuH,WAAA6b,IACA1gB,KAAAuoB,KAAAE,KAAA1sB,KAAAuI,MAAAoc,EAAA1gB,KAAAuoB,KAAAjrB,OAAAuH,YAAA,QACA7E,KAAAmO,GAAA,OALAnO,KAAAuoB,KAAA,IAAApnB,YAAAunB,OAAA,CAAiDngB,QAAAxM,KAAAuI,KAAAoc,EAAA,SACjD1gB,KAAAmoB,MAAAc,EAAA,CAAyChoB,IAAA,CAAO0B,OAAA3C,KAAAuoB,SAMhDvoB,KAAAmO,KACAnO,KAAAmO,GAAA,IAAA/Q,WAAA4C,KAAAuoB,KAAAjrB,SAGA,MAAA8rB,EAAAppB,KAAAuoB,KAAAjrB,OAAAuH,WAAAskB,GAAA,IAGA,OAFAnpB,KAAAmO,GAAAjL,IAAA/E,EAAAirB,GACAppB,KAAAmoB,MAAAttB,QAAAsL,IAAAijB,EAAAD,EAAAplB,GACA/D,KAAAmO,GAAA1J,SAAA,UAAAykB,EACA,CACA,OAAAjlB,GACAjE,KAAAmoB,OAEAnoB,KAAAuoB,KAAAjrB,OAAAuH,WAAA7E,KAAAioB,WACAjoB,KAAAmoB,MAAAnoB,KAAAmO,GAAAnO,KAAAuoB,KAAA,KAEA,aC9DA/rB,OAAAC,eAAA5B,EAAA,cAA+CiB,OAAA,IAC/CjB,EAAA+sB,OAYA,SAAAyB,GACA,GAAAA,EAAAlrB,EAAA,CACA,MAAA2e,EAAgBxe,EAAAA,EAAAH,EAAAA,GAAUkrB,EAC1B,IAAA5tB,EACA+sB,EACA,MAAAc,EAAAnoB,YACA,WAAA2b,EACAxe,EACAwJ,GAAA,IAAAwhB,EAAA9mB,SAAAgmB,IAAAA,EAAA,IAAAc,EAAA/mB,OAAA9G,IAAAA,EAAA8tB,EAAAprB,MAAA2J,GACAA,GAAA0gB,EACAc,EAAAloB,YAAAonB,EAAA1gB,GACAwhB,EAAAloB,YAAA3F,IAAAA,EAAA8tB,EAAAprB,IAAA2J,GAAAzG,KAAA9F,IAAAitB,EAAAjtB,EAAAT,SAAAS,EAAAgG,UAEA,IAAAub,EACAxe,EACA,IAAAkqB,IAAAA,EAAA,IAAAc,EAAA/mB,OAAA9G,IAAAA,EAAA8tB,EAAAprB,MACA,IAAAqqB,EACAhX,QAAAC,QAAA+W,GACAc,EAAAE,QAAA/tB,IAAAA,EAAA8tB,EAAAprB,KAAAkD,KAAA9F,GAAAitB,EAAAjtB,GAEA+C,EACA,IAAA7C,IAAAA,EAAA8tB,EAAAprB,IACA,IAAAqT,QAAAC,QAAAhW,IAAAA,EAAA8tB,EAAAprB,IACA,CACA,uBAAAsrB,SACA,UAAArnB,MAAA,qBACAqnB,SAAAniB,IAAA+hB,EACA,EAtCA,IAAAE,EAAAjrB,IACA,GAAAlB,WAAAssB,WACA,OAAAtsB,WAAAssB,WAAAprB,GACA,uBAAAa,OACA,OAAAA,OAAAC,KAAAd,EAAA,UACA,MAAA7C,EAAA6D,KAAAhB,GACA/C,EAAA,IAAA6B,WAAA3B,EAAAsC,QACA,QAAAD,EAAA,EAAoBA,EAAAvC,EAAAwC,SAAcD,EAClCvC,EAAAuC,GAAArC,EAAA+D,WAAA1B,GACA,OAAAvC,KCfAouB,EAAA,GAGA,SAAA3qB,EAAA4qB,GAEA,IAAAC,EAAAF,EAAAC,GACA,QAAA5hB,IAAA6hB,EACA,OAAAA,EAAAhvB,QAGA,IAAAC,EAAA6uB,EAAAC,GAAA,CAGA/uB,QAAA,IAOA,OAHAivB,EAAAF,GAAApiB,KAAA1M,EAAAD,QAAAC,EAAAA,EAAAD,QAAAmE,GAGAlE,EAAAD,OACA,mGCfA,MAAAkvB,EAAA/qB,EAAA,KACAgrB,EAAAhrB,EAAA,KACAqK,EAAArK,EAAA,KACAsK,EAAAtK,EAAA,KACAirB,EAAAjrB,EAAA,IACAkrB,EAAAlrB,EAAA,KACAmrB,EAAAnrB,EAAA,KACAorB,EAAAprB,EAAA,KACAqrB,EAAArrB,EAAA,KA6CMuB,EAAsC,CAC1C+pB,mBAAmB,EACnBvd,WAAY,SACZwd,cAAc,EACd3M,gBAAgB,EAChBzB,kBAAmB,KACnBsB,eAAgB,SAChB7F,aAAc,IACd5E,iBAAiB,EACjBwX,YAAY,EACZ5f,aAAc,SACd6f,cAAc,EACdhM,eAAgB,uBA0BlB,MAWE,WAAA1e,CAAYe,GANJd,KAAAyI,aAA8B,GAE9BzI,KAAA0qB,UAAwC,IAAI9Y,IACnC5R,KAAA2qB,cAAgB,IAAIZ,EAAAa,QACrB5qB,KAAAka,aAA6Bla,KAAK2qB,cAAclkB,MAG9DzG,KAAKkC,MAAQ1F,OAAO2F,OAAO,GAAI5B,EAAiBO,GAChDd,KAAK6qB,aAAeruB,OAAO2F,OAAO,GAAI5B,EAAiBO,EACzD,CAEO,OAAA6G,GACL,IAAK,MAAMmjB,KAAO9qB,KAAKyI,aACrBqiB,EAAInjB,UAEN3H,KAAKyI,aAAa1K,OAAS,EAC3BiC,KAAK0qB,UAAU5hB,QACf9I,KAAK2qB,cAAchjB,SACrB,CAEQ,aAAAojB,IAAiBC,GACvB,IAAK,MAAMF,KAAOE,EAChBhrB,KAAKyI,aAAa/J,KAAKosB,EAE3B,CAEO,QAAAG,CAASC,SASd,GARAlrB,KAAK0R,UAAYwZ,EAGjBlrB,KAAKkK,UAAY,IAAIb,EAAA+D,cAAc8d,GACnClrB,KAAKmK,SAAW,IAAIb,EAAA6hB,aAAaD,EAAUlrB,KAAKkK,UAAWlK,KAAKkC,OAChElC,KAAKmK,SAAS+P,aAAe,IAAMla,KAAK2qB,cAAcpjB,OAGlDvH,KAAKkC,MAAMooB,kBAAmB,CAChC,MAAMc,EAA0C,QAAjClf,EAAGgf,EAASG,QAAQC,qBAAa,IAAApf,EAAAA,EAAI,GACpDkf,EAAUG,kBAAmB,EAC7BH,EAAUI,mBAAoB,EAC9BJ,EAAUK,iBAAkB,EAC5BP,EAASG,QAAQC,cAAgBF,CACnC,CAiCA,GA/BAprB,KAAK+qB,cACH/qB,KAAKkK,UACLlK,KAAKmK,SAGL+gB,EAASQ,OAAOC,mBAAmB,CAAEC,OAAQ,IAAK/lB,MAAO,KAAOwW,GAAUrc,KAAK6rB,QAAQxP,IACvF6O,EAASQ,OAAOC,mBAAmB,CAAEC,OAAQ,IAAK/lB,MAAO,KAAOwW,GAAUrc,KAAK8rB,QAAQzP,IACvF6O,EAASQ,OAAOC,mBAAmB,CAAE9lB,MAAO,KAAOwW,GAAUrc,KAAK+rB,KAAK1P,IACvE6O,EAASQ,OAAOC,mBAAmB,CAAEC,OAAQ,IAAK/lB,MAAO,KAAOwW,GAAUrc,KAAKgsB,yBAAyB3P,IAGxG6O,EAASe,SAAS7R,IAAQ,IAAAlO,EAAA,OAAc,QAAbA,EAAAlM,KAAKmK,gBAAQ,IAAA+B,OAAA,EAAAA,EAAEiO,OAAOC,KAQjD8Q,EAASQ,OAAOC,mBAAmB,CAAEO,cAAe,IAAKrmB,MAAO,KAAO,IAAM7F,KAAKiL,SAClFigB,EAASQ,OAAOS,mBAAmB,CAAEtmB,MAAO,KAAO,IAAM7F,KAAKiL,SAC9DigB,EAAS/e,MAAMkN,cAAc+S,eAAe,IAAMpsB,KAAKiL,SAGvDigB,EAAS5tB,OAAO+uB,eAAe,KAAK,IAAAngB,EAAA,OAAc,QAAbA,EAAAlM,KAAKmK,gBAAQ,IAAA+B,OAAA,EAAAA,EAAEyM,kBAGpDuS,EAASoB,SAAS3f,IAAU,IAAAT,EAAA,OAAc,QAAbA,EAAAlM,KAAKmK,gBAAQ,IAAA+B,OAAA,EAAAA,EAAE6O,eAAepO,MAIzD3M,KAAKkC,MAAMqoB,aAAc,CAC3B,MAAMgC,EAAe,IAAInC,EAAAoC,kBAAkBxsB,KAAKmK,SAAWnK,KAAKkC,MAAOlC,KAAKkK,UAAYghB,GAClFuB,EAAe,IAAItC,EAAAuC,aAAa1sB,KAAKkC,MAAOqqB,EAAcrB,GAChElrB,KAAK0qB,UAAUxnB,IAAI,QAASupB,GAC5BzsB,KAAK+qB,cACHG,EAAS/e,MAAMkN,cAAcsT,QAAQC,mBAAmB,CAAE/mB,MAAO,KAAO4mB,GAE5E,CAGA,GAAIzsB,KAAKkC,MAAMsoB,WAAY,CACzB,MAAMqC,EAAa,IAAIxC,EAAAyC,gBAAgB9sB,KAAKmK,UACtC4iB,EAAa,IAAI/C,EAAAgD,WAAWhtB,KAAKkC,MAAOlC,KAAKkK,UAAY2iB,EAAY3B,GAC3ElrB,KAAK0qB,UAAUxnB,IAAI,MAAO6pB,GAC1B/sB,KAAK+qB,cACHG,EAAS/e,MAAMkN,cAAcsT,QAAQM,mBAAmB,KAAMF,GAElE,CAGA,GAAI/sB,KAAKkC,MAAMuoB,aAAc,CAC3B,MAAMyC,EAAe,IAAIhD,EAAAnD,kBAAkB/mB,KAAKmK,UAC1CgjB,EAAe,IAAIlD,EAAAmD,qBAAqBptB,KAAKkC,MAAOlC,KAAKkK,UAAYgjB,EAAchC,GACzFlrB,KAAK0qB,UAAUxnB,IAAI,QAASiqB,GAC5BntB,KAAK+qB,cACHmC,EACAC,EACAjC,EAAS/e,MAAMkN,cAAcsT,QAAQU,mBAAmB,CAAExnB,MAAO,KAAOsnB,GAE5E,CACF,CAGO,KAAAliB,SAELjL,KAAKkC,MAAM0b,eAAiB5d,KAAK6qB,aAAajN,eAC9C5d,KAAKkC,MAAMia,kBAAoBnc,KAAK6qB,aAAa1O,kBAEpC,QAAbjQ,EAAAlM,KAAKmK,gBAAQ,IAAA+B,GAAAA,EAAEjB,QAEf,IAAK,MAAM3C,KAAWtI,KAAK0qB,UAAUjW,SACnCnM,EAAQ2C,QAEV,OAAO,CACT,CAEA,gBAAW2M,SACT,OAAoB,QAAb1L,EAAAlM,KAAKmK,gBAAQ,IAAA+B,OAAA,EAAAA,EAAE6L,cAAe,CACvC,CAEA,gBAAWH,CAAa7G,SACT,QAAb7E,EAAAlM,KAAKmK,gBAAQ,IAAA+B,GAAAA,EAAEyL,SAAS5G,GACxB/Q,KAAKkC,MAAM0V,aAAe7G,CAC5B,CAEA,gBAAWuc,GACT,OAAIttB,KAAKmK,SACAnK,KAAKmK,SAASiO,YAEf,CACV,CAEA,mBAAWpF,GACT,OAAOhT,KAAKkC,MAAM8Q,eACpB,CAEA,mBAAWA,CAAgBlX,SACzBkE,KAAKkC,MAAM8Q,gBAAkBlX,EACf,QAAdoQ,EAAAlM,KAAKkK,iBAAS,IAAAgC,GAAAA,EAAE8G,gBAAgBlX,EAClC,CAEO,oBAAAyf,CAAqBpF,EAAW/C,SACrC,OAAoB,QAAblH,EAAAlM,KAAKmK,gBAAQ,IAAA+B,OAAA,EAAAA,EAAEqP,qBAAqBpF,EAAG/C,EAChD,CAEO,uBAAAoI,CAAwBrF,EAAW/C,SACxC,OAAoB,QAAblH,EAAAlM,KAAKmK,gBAAQ,IAAA+B,OAAA,EAAAA,EAAEsP,wBAAwBrF,EAAG/C,EACnD,CAEQ,OAAAma,CAAQjvB,SACA,QAAd4N,EAAAlM,KAAK0R,iBAAS,IAAAxF,GAAAA,EAAEC,MAAMK,MAAMlO,GAAG,EACjC,CAEQ,OAAAutB,CAAQxP,GACd,IAAK,IAAIve,EAAI,EAAGA,EAAIue,EAAOte,SAAUD,EAE5B,KADCue,EAAOve,KAEXkC,KAAKkC,MAAM0b,gBAAiB,GAIlC,OAAO,CACT,CAEQ,OAAAkO,CAAQzP,GACd,IAAK,IAAIve,EAAI,EAAGA,EAAIue,EAAOte,SAAUD,EAE5B,KADCue,EAAOve,KAEXkC,KAAKkC,MAAM0b,gBAAiB,GAIlC,OAAO,CACT,CAGQ,IAAAmO,CAAK1P,GACX,QAAIA,EAAO,MAQPrc,KAAKkC,MAAMqoB,eACbvqB,KAAKutB,QAAQ,kBACN,EAGX,CAYQ,wBAAAvB,CAAyB3P,mBAC/B,GAAIA,EAAOte,OAAS,EAClB,OAAO,EAET,GAAa,IAATse,EAAO,GACT,OAAQA,EAAO,IACb,OAEE,OADArc,KAAKutB,QAAQ,MAASlR,EAAO,QAA0Brc,KAAKkC,MAAMia,uBAC3D,EACT,OACEnc,KAAKkC,MAAMia,kBAAoBnc,KAAK6qB,aAAa1O,kBACjDnc,KAAKutB,QAAQ,MAASlR,EAAO,QAA0Brc,KAAKkC,MAAMia,sBAElE,IAAK,MAAM7T,KAAWtI,KAAK0qB,UAAUjW,SACnCnM,EAAQ2C,QAEV,OAAO,EACT,OAOE,OANIoR,EAAOte,OAAS,KAAOse,EAAO,aAAcjV,QAAUiV,EAAO,IA3P5C,MA4PnBrc,KAAKkC,MAAMia,kBAAoBE,EAAO,GACtCrc,KAAKutB,QAAQ,MAASlR,EAAO,QAA0Brc,KAAKkC,MAAMia,uBAElEnc,KAAKutB,QAAQ,MAASlR,EAAO,UAExB,EACT,OAEE,OADArc,KAAKutB,QAAQ,MAASlR,EAAO,eACtB,EACT,QAEE,OADArc,KAAKutB,QAAQ,MAASlR,EAAO,UACtB,EAGb,GAAa,IAATA,EAAO,GACT,OAAQA,EAAO,IAEb,OACE,IAAInc,EAAkC,QAA1BoN,EAAc,QAAdpB,EAAAlM,KAAKkK,iBAAS,IAAAgC,OAAA,EAAAA,EAAEP,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIC,OAAO3L,MAC/C8D,EAAmC,QAA1BmK,EAAc,QAAdlC,EAAAjM,KAAKkK,iBAAS,IAAA+B,OAAA,EAAAA,EAAEN,kBAAU,IAAAwC,OAAA,EAAAA,EAAEvC,IAAIC,OAAO7H,OACpD,IAAK9D,IAAU8D,EAAQ,CAGrB,MAAMiP,EAAW3J,EAAAoC,kBACjBxL,IAAuB,QAAdoT,EAAAtT,KAAK0R,iBAAS,IAAA4B,OAAA,EAAAA,EAAExH,OAAQ,IAAMmH,EAAS/S,MAChD8D,IAAwB,QAAdsd,EAAAthB,KAAK0R,iBAAS,IAAA4P,OAAA,EAAAA,EAAEvV,OAAQ,IAAMkH,EAASjP,MACnD,CACA,GAAI9D,EAAQ8D,EAAShE,KAAKkC,MAAM6K,WAC9B/M,KAAKutB,QAAQ,MAASlR,EAAO,QAA0Bnc,EAAMqM,QAAQ,MAAMvI,EAAOuI,QAAQ,WACrF,CAEL,MAAM4J,EAAIpa,KAAKkR,MAAMlR,KAAKyxB,KAAKxtB,KAAKkC,MAAM6K,aAC1C/M,KAAKutB,QAAQ,MAASlR,EAAO,QAA0BlG,KAAKA,KAC9D,CACA,OAAO,EACT,OAEE,MAAMA,EAAIpa,KAAKkR,MAAMlR,KAAKyxB,KAAKxtB,KAAKkC,MAAM6K,aAE1C,OADA/M,KAAKutB,QAAQ,MAASlR,EAAO,QAA0BlG,KAAKA,OACrD,EACT,QAEE,OADAnW,KAAKutB,QAAQ,MAASlR,EAAO,UACtB,EAKb,OADArc,KAAKutB,QAAQ,MAASlR,EAAO,UACtB,CACT","sources":["webpack://ImageAddon/webpack/universalModuleDefinition","webpack://ImageAddon/../node_modules/sixel/lib/Colors.js","webpack://ImageAddon/../node_modules/sixel/lib/Decoder.js","webpack://ImageAddon/../node_modules/sixel/lib/wasm.js","webpack://ImageAddon/../src/common/Event.ts","webpack://ImageAddon/../src/common/Lifecycle.ts","webpack://ImageAddon/./src/IIPHandler.ts","webpack://ImageAddon/./src/IIPHeaderParser.ts","webpack://ImageAddon/./src/IIPImageStorage.ts","webpack://ImageAddon/./src/IIPMetrics.ts","webpack://ImageAddon/./src/ImageRenderer.ts","webpack://ImageAddon/./src/ImageStorage.ts","webpack://ImageAddon/./src/SixelHandler.ts","webpack://ImageAddon/./src/SixelImageStorage.ts","webpack://ImageAddon/./src/kitty/KittyGraphicsHandler.ts","webpack://ImageAddon/./src/kitty/KittyGraphicsTypes.ts","webpack://ImageAddon/./src/kitty/KittyImageStorage.ts","webpack://ImageAddon/../node_modules/xterm-wasm-parts/lib/base64/Base64Decoder.wasm.js","webpack://ImageAddon/../node_modules/xterm-wasm-parts/lib/qoi/QoiDecoder.wasm.js","webpack://ImageAddon/javascript/node_modules/inwasm-runtime/lib/index.cjs","webpack://ImageAddon/webpack/bootstrap","webpack://ImageAddon/./src/ImageAddon.ts"],"sourcesContent":["(function webpackUniversalModuleDefinition(root, factory) {\n\tif(typeof exports === 'object' && typeof module === 'object')\n\t\tmodule.exports = factory();\n\telse if(typeof define === 'function' && define.amd)\n\t\tdefine([], factory);\n\telse if(typeof exports === 'object')\n\t\texports[\"ImageAddon\"] = factory();\n\telse\n\t\troot[\"ImageAddon\"] = factory();\n})(globalThis, () => {\nreturn ","\"use strict\";\n/**\n * Copyright (c) 2019 Joerg Breitbart.\n * @license MIT\n */\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.DEFAULT_FOREGROUND = exports.DEFAULT_BACKGROUND = exports.PALETTE_ANSI_256 = exports.PALETTE_VT340_GREY = exports.PALETTE_VT340_COLOR = exports.normalizeHLS = exports.normalizeRGB = exports.nearestColorIndex = exports.fromRGBA8888 = exports.toRGBA8888 = exports.alpha = exports.blue = exports.green = exports.red = exports.BIG_ENDIAN = void 0;\n// FIXME: cleanup this mess, move things either to decoder/encoder, keep only shared things\n// system endianess\nexports.BIG_ENDIAN = new Uint8Array(new Uint32Array([0xFF000000]).buffer)[0] === 0xFF;\nif (exports.BIG_ENDIAN) {\n    console.warn('BE platform detected. This version of node-sixel works only on LE properly.');\n}\n// channel values\nfunction red(n) {\n    return n & 0xFF;\n}\nexports.red = red;\nfunction green(n) {\n    return (n >>> 8) & 0xFF;\n}\nexports.green = green;\nfunction blue(n) {\n    return (n >>> 16) & 0xFF;\n}\nexports.blue = blue;\nfunction alpha(n) {\n    return (n >>> 24) & 0xFF;\n}\nexports.alpha = alpha;\n/**\n * Convert RGB channels to native color RGBA8888.\n */\nfunction toRGBA8888(r, g, b, a = 255) {\n    return ((a & 0xFF) << 24 | (b & 0xFF) << 16 | (g & 0xFF) << 8 | (r & 0xFF)) >>> 0; // ABGR32\n}\nexports.toRGBA8888 = toRGBA8888;\n/**\n * Convert native color to [r, g, b, a].\n */\nfunction fromRGBA8888(color) {\n    return [color & 0xFF, (color >> 8) & 0xFF, (color >> 16) & 0xFF, color >>> 24];\n}\nexports.fromRGBA8888 = fromRGBA8888;\n/**\n * Get index of nearest color in `palette` for `color`.\n * Uses euclidean distance without any luminescence correction.\n */\nfunction nearestColorIndex(color, palette) {\n    const r = red(color);\n    const g = green(color);\n    const b = blue(color);\n    let min = Number.MAX_SAFE_INTEGER;\n    let idx = -1;\n    // use euclidean distance (manhattan gives very poor results)\n    for (let i = 0; i < palette.length; ++i) {\n        const dr = r - palette[i][0];\n        const dg = g - palette[i][1];\n        const db = b - palette[i][2];\n        const d = dr * dr + dg * dg + db * db;\n        if (!d)\n            return i;\n        if (d < min) {\n            min = d;\n            idx = i;\n        }\n    }\n    return idx;\n}\nexports.nearestColorIndex = nearestColorIndex;\n// color conversions\n// HLS taken from: http://www.niwa.nu/2013/05/math-behind-colorspace-conversions-rgb-hsl\nfunction clamp(low, high, value) {\n    return Math.max(low, Math.min(value, high));\n}\nfunction h2c(t1, t2, c) {\n    if (c < 0)\n        c += 1;\n    if (c > 1)\n        c -= 1;\n    return c * 6 < 1\n        ? t2 + (t1 - t2) * 6 * c\n        : c * 2 < 1\n            ? t1\n            : c * 3 < 2\n                ? t2 + (t1 - t2) * (4 - c * 6)\n                : t2;\n}\nfunction HLStoRGB(h, l, s) {\n    if (!s) {\n        const v = Math.round(l * 255);\n        return toRGBA8888(v, v, v);\n    }\n    const t1 = l < 0.5 ? l * (1 + s) : l + s - l * s;\n    const t2 = 2 * l - t1;\n    return toRGBA8888(clamp(0, 255, Math.round(h2c(t1, t2, h + 1 / 3) * 255)), clamp(0, 255, Math.round(h2c(t1, t2, h) * 255)), clamp(0, 255, Math.round(h2c(t1, t2, h - 1 / 3) * 255)));\n}\n/**\n * Normalize SIXEL RGB values (percent based, 0-100) to RGBA8888.\n */\nfunction normalizeRGB(r, g, b) {\n    return (0xFF000000 | Math.round(b / 100 * 255) << 16 | Math.round(g / 100 * 255) << 8 | Math.round(r / 100 * 255)) >>> 0; // ABGR32\n}\nexports.normalizeRGB = normalizeRGB;\n/**\n * Normalize SIXEL HLS values to RGBA8888. Applies hue correction of +240°.\n */\nfunction normalizeHLS(h, l, s) {\n    // Note: hue value is turned by 240° in VT340, all values given as fractions\n    return HLStoRGB((h + 240 % 360) / 360, l / 100, s / 100);\n}\nexports.normalizeHLS = normalizeHLS;\n/**\n * default palettes\n */\n// FIXME: move palettes to Decoder.ts\n/**\n * 16 predefined color registers of VT340 (values in %):\n * ```\n *                R   G   B\n * 0  Black       0   0   0\n * 1  Blue        20  20  80\n * 2  Red         80  13  13\n * 3  Green       20  80  20\n * 4  Magenta     80  20  80\n * 5  Cyan        20  80  80\n * 6  Yellow      80  80  20\n * 7  Gray 50%    53  53  53\n * 8  Gray 25%    26  26  26\n * 9  Blue*       33  33  60\n * 10 Red*        60  26  26\n * 11 Green*      33  60  33\n * 12 Magenta*    60  33  60\n * 13 Cyan*       33  60  60\n * 14 Yellow*     60  60  33\n * 15 Gray 75%    80  80  80\n * ```\n * (*) less saturated\n *\n * @see https://vt100.net/docs/vt3xx-gp/chapter2.html#S2.4\n*/\nexports.PALETTE_VT340_COLOR = new Uint32Array([\n    normalizeRGB(0, 0, 0),\n    normalizeRGB(20, 20, 80),\n    normalizeRGB(80, 13, 13),\n    normalizeRGB(20, 80, 20),\n    normalizeRGB(80, 20, 80),\n    normalizeRGB(20, 80, 80),\n    normalizeRGB(80, 80, 20),\n    normalizeRGB(53, 53, 53),\n    normalizeRGB(26, 26, 26),\n    normalizeRGB(33, 33, 60),\n    normalizeRGB(60, 26, 26),\n    normalizeRGB(33, 60, 33),\n    normalizeRGB(60, 33, 60),\n    normalizeRGB(33, 60, 60),\n    normalizeRGB(60, 60, 33),\n    normalizeRGB(80, 80, 80)\n]);\n/**\n * 16 predefined monochrome registers of VT340 (values in %):\n * ```\n *              R   G   B\n * 0  Black     0   0   0\n * 1  Gray-2    13  13  13\n * 2  Gray-4    26  26  26\n * 3  Gray-6    40  40  40\n * 4  Gray-1    6   6   6\n * 5  Gray-3    20  20  20\n * 6  Gray-5    33  33  33\n * 7  White 7   46  46  46\n * 8  Black 0   0   0   0\n * 9  Gray-2    13  13  13\n * 10 Gray-4    26  26  26\n * 11 Gray-6    40  40  40\n * 12 Gray-1    6   6   6\n * 13 Gray-3    20  20  20\n * 14 Gray-5    33  33  33\n * 15 White 7   46  46  46\n * ```\n *\n * @see https://vt100.net/docs/vt3xx-gp/chapter2.html#S2.4\n */\nexports.PALETTE_VT340_GREY = new Uint32Array([\n    normalizeRGB(0, 0, 0),\n    normalizeRGB(13, 13, 13),\n    normalizeRGB(26, 26, 26),\n    normalizeRGB(40, 40, 40),\n    normalizeRGB(6, 6, 6),\n    normalizeRGB(20, 20, 20),\n    normalizeRGB(33, 33, 33),\n    normalizeRGB(46, 46, 46),\n    normalizeRGB(0, 0, 0),\n    normalizeRGB(13, 13, 13),\n    normalizeRGB(26, 26, 26),\n    normalizeRGB(40, 40, 40),\n    normalizeRGB(6, 6, 6),\n    normalizeRGB(20, 20, 20),\n    normalizeRGB(33, 33, 33),\n    normalizeRGB(46, 46, 46)\n]);\n/**\n * 256 predefined ANSI colors.\n *\n * @see https://en.wikipedia.org/wiki/ANSI_escape_code#8-bit\n */\nexports.PALETTE_ANSI_256 = (() => {\n    // 16 lower colors (taken from xterm)\n    const p = [\n        toRGBA8888(0, 0, 0),\n        toRGBA8888(205, 0, 0),\n        toRGBA8888(0, 205, 0),\n        toRGBA8888(205, 205, 0),\n        toRGBA8888(0, 0, 238),\n        toRGBA8888(205, 0, 205),\n        toRGBA8888(0, 250, 205),\n        toRGBA8888(229, 229, 229),\n        toRGBA8888(127, 127, 127),\n        toRGBA8888(255, 0, 0),\n        toRGBA8888(0, 255, 0),\n        toRGBA8888(255, 255, 0),\n        toRGBA8888(92, 92, 255),\n        toRGBA8888(255, 0, 255),\n        toRGBA8888(0, 255, 255),\n        toRGBA8888(255, 255, 255),\n    ];\n    // colors up to 232\n    const d = [0, 95, 135, 175, 215, 255];\n    for (let r = 0; r < 6; ++r) {\n        for (let g = 0; g < 6; ++g) {\n            for (let b = 0; b < 6; ++b) {\n                p.push(toRGBA8888(d[r], d[g], d[b]));\n            }\n        }\n    }\n    // grey scale to up 255\n    for (let v = 8; v <= 238; v += 10) {\n        p.push(toRGBA8888(v, v, v));\n    }\n    return new Uint32Array(p);\n})();\n/**\n * Background: Black by default.\n * Foreground: White by default.\n *\n * Background color is used whenever a fill color is needed and not explicitly set.\n * Foreground color is used as default initial sixel color.\n */\nexports.DEFAULT_BACKGROUND = toRGBA8888(0, 0, 0, 255);\nexports.DEFAULT_FOREGROUND = toRGBA8888(255, 255, 255, 255);\n//# sourceMappingURL=Colors.js.map","\"use strict\";\n/**\n * Copyright (c) 2021 Joerg Breitbart.\n * @license MIT\n */\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.decodeAsync = exports.decode = exports.Decoder = exports.DecoderAsync = void 0;\nconst Colors_1 = require(\"./Colors\");\nconst wasm_1 = require(\"./wasm\");\n/* istanbul ignore next */\nfunction decodeBase64(s) {\n    if (typeof Buffer !== 'undefined') {\n        return Buffer.from(s, 'base64');\n    }\n    const bytestring = atob(s);\n    const result = new Uint8Array(bytestring.length);\n    for (let i = 0; i < result.length; ++i) {\n        result[i] = bytestring.charCodeAt(i);\n    }\n    return result;\n}\nconst WASM_BYTES = decodeBase64(wasm_1.LIMITS.BYTES);\nlet WASM_MODULE;\n// empty canvas\nconst NULL_CANVAS = new Uint32Array();\n// proxy for lazy binding of decoder methods to wasm env callbacks\nclass CallbackProxy {\n    constructor() {\n        this.bandHandler = (width) => 1;\n        this.modeHandler = (mode) => 1;\n    }\n    handle_band(width) {\n        return this.bandHandler(width);\n    }\n    mode_parsed(mode) {\n        return this.modeHandler(mode);\n    }\n}\n// default decoder options\nconst DEFAULT_OPTIONS = {\n    memoryLimit: 2048 * 65536,\n    sixelColor: Colors_1.DEFAULT_FOREGROUND,\n    fillColor: Colors_1.DEFAULT_BACKGROUND,\n    palette: Colors_1.PALETTE_VT340_COLOR,\n    paletteLimit: wasm_1.LIMITS.PALETTE_SIZE,\n    truncate: true\n};\n/**\n * Create a decoder instance asynchronously.\n * To be used in the browser main thread.\n */\nfunction DecoderAsync(opts) {\n    const cbProxy = new CallbackProxy();\n    const importObj = {\n        env: {\n            handle_band: cbProxy.handle_band.bind(cbProxy),\n            mode_parsed: cbProxy.mode_parsed.bind(cbProxy)\n        }\n    };\n    return WebAssembly.instantiate(WASM_MODULE || WASM_BYTES, importObj)\n        .then((inst) => {\n        WASM_MODULE = WASM_MODULE || inst.module;\n        return new Decoder(opts, inst.instance || inst, cbProxy);\n    });\n}\nexports.DecoderAsync = DecoderAsync;\n/**\n * Decoder - web assembly based sixel stream decoder.\n *\n * Usage pattern:\n *  - call `init` to initialize decoder for new image\n *  - feed data chunks to `decode` or `decodeString`\n *  - grab pixels from `data32`\n *  - optional: call `release` to free memory (e.g. after big images)\n *  - start over with next image by calling `init`\n *\n * Properties:\n *  - max width of 2^14 - 4 pixels (compile time setting in wasm)\n *  - no explicit height limit (only limited by memory)\n *  - max 4096 colors palette (compile time setting in wasm)\n *\n * Explanation operation modes:\n * - M1   Mode chosen for level 1 images (no raster attributes),\n *        or for level 2 images with `truncate=false`.\n * - M2   Mode chosen for level 2 images with `truncate=true` (default).\n *        While this mode is not fully spec conform (decoder not expected to truncate),\n *        it is what spec conform encoders should create (should not excess raster).\n *        This mode has several advantages:\n *        - ~15% faster decoding speed\n *        - image dimensions can be evaluated early without processing the whole data\n *        - faster pixel access in `data32` (precalulated)\n *        - image height is not reported as multiple of 6 pixels\n * - M0   Undecided mode state after `init`.\n * The level of an image is determined during early decoding based on the fact,\n * whether the data contains valid raster attributes before any sixel data.\n * Until then the mode of an image is marked as M0, meaning the real operation mode\n * could not be decided yet.\n */\nclass Decoder {\n    /**\n     * Synchonous ctor. Can be called from nodejs or a webworker context.\n     * For instantiation in the browser main thread use `WasmDecoderAsync` instead.\n     */\n    constructor(opts, _instance, _cbProxy) {\n        this._PIXEL_OFFSET = wasm_1.LIMITS.MAX_WIDTH + 4;\n        this._canvas = NULL_CANVAS;\n        this._bandWidths = [];\n        this._maxWidth = 0;\n        this._minWidth = wasm_1.LIMITS.MAX_WIDTH;\n        this._lastOffset = 0;\n        this._currentHeight = 0;\n        this._opts = Object.assign({}, DEFAULT_OPTIONS, opts);\n        if (this._opts.paletteLimit > wasm_1.LIMITS.PALETTE_SIZE) {\n            throw new Error(`DecoderOptions.paletteLimit must not exceed ${wasm_1.LIMITS.PALETTE_SIZE}`);\n        }\n        if (!_instance) {\n            const module = WASM_MODULE || (WASM_MODULE = new WebAssembly.Module(WASM_BYTES));\n            _instance = new WebAssembly.Instance(module, {\n                env: {\n                    handle_band: this._handle_band.bind(this),\n                    mode_parsed: this._initCanvas.bind(this)\n                }\n            });\n        }\n        else {\n            _cbProxy.bandHandler = this._handle_band.bind(this);\n            _cbProxy.modeHandler = this._initCanvas.bind(this);\n        }\n        this._instance = _instance;\n        this._wasm = this._instance.exports;\n        this._chunk = new Uint8Array(this._wasm.memory.buffer, this._wasm.get_chunk_address(), wasm_1.LIMITS.CHUNK_SIZE);\n        this._states = new Uint32Array(this._wasm.memory.buffer, this._wasm.get_state_address(), 12);\n        this._palette = new Uint32Array(this._wasm.memory.buffer, this._wasm.get_palette_address(), wasm_1.LIMITS.PALETTE_SIZE);\n        this._palette.set(this._opts.palette);\n        this._pSrc = new Uint32Array(this._wasm.memory.buffer, this._wasm.get_p0_address());\n        this._wasm.init(Colors_1.DEFAULT_FOREGROUND, 0, this._opts.paletteLimit, 0);\n    }\n    // some readonly parser states for internal usage\n    get _fillColor() { return this._states[0]; }\n    get _truncate() { return this._states[8]; }\n    get _rasterWidth() { return this._states[6]; }\n    get _rasterHeight() { return this._states[7]; }\n    get _width() { return this._states[2] ? this._states[2] - 4 : 0; }\n    get _height() { return this._states[3]; }\n    get _level() { return this._states[9]; }\n    get _mode() { return this._states[10]; }\n    get _paletteLimit() { return this._states[11]; }\n    _initCanvas(mode) {\n        if (mode === 2 /* M2 */) {\n            const pixels = this.width * this.height;\n            if (pixels > this._canvas.length) {\n                if (this._opts.memoryLimit && pixels * 4 > this._opts.memoryLimit) {\n                    this.release();\n                    throw new Error('image exceeds memory limit');\n                }\n                this._canvas = new Uint32Array(pixels);\n            }\n            this._maxWidth = this._width;\n        }\n        else if (mode === 1 /* M1 */) {\n            if (this._level === 2) {\n                // got raster attributes, use them as initial size hint\n                const pixels = Math.min(this._rasterWidth, wasm_1.LIMITS.MAX_WIDTH) * this._rasterHeight;\n                if (pixels > this._canvas.length) {\n                    if (this._opts.memoryLimit && pixels * 4 > this._opts.memoryLimit) {\n                        this.release();\n                        throw new Error('image exceeds memory limit');\n                    }\n                    this._canvas = new Uint32Array(pixels);\n                }\n            }\n            else {\n                // else fallback to generic resizing, starting with 256*256 pixels\n                if (this._canvas.length < 65536) {\n                    this._canvas = new Uint32Array(65536);\n                }\n            }\n        }\n        return 0; // 0 - continue, 1 - abort right away\n    }\n    _realloc(offset, additionalPixels) {\n        const pixels = offset + additionalPixels;\n        if (pixels > this._canvas.length) {\n            if (this._opts.memoryLimit && pixels * 4 > this._opts.memoryLimit) {\n                this.release();\n                throw new Error('image exceeds memory limit');\n            }\n            // extend in 65536 pixel blocks\n            const newCanvas = new Uint32Array(Math.ceil(pixels / 65536) * 65536);\n            newCanvas.set(this._canvas);\n            this._canvas = newCanvas;\n        }\n    }\n    _handle_band(width) {\n        const adv = this._PIXEL_OFFSET;\n        let offset = this._lastOffset;\n        if (this._mode === 2 /* M2 */) {\n            let remaining = this.height - this._currentHeight;\n            let c = 0;\n            while (c < 6 && remaining > 0) {\n                this._canvas.set(this._pSrc.subarray(adv * c, adv * c + width), offset + width * c);\n                c++;\n                remaining--;\n            }\n            this._lastOffset += width * c;\n            this._currentHeight += c;\n        }\n        else if (this._mode === 1 /* M1 */) {\n            this._realloc(offset, width * 6);\n            this._maxWidth = Math.max(this._maxWidth, width);\n            this._minWidth = Math.min(this._minWidth, width);\n            for (let i = 0; i < 6; ++i) {\n                this._canvas.set(this._pSrc.subarray(adv * i, adv * i + width), offset + width * i);\n            }\n            this._bandWidths.push(width);\n            this._lastOffset += width * 6;\n            this._currentHeight += 6;\n        }\n        return 0; // 0 - continue, 1 - abort right away\n    }\n    /**\n     * Width of the image data.\n     * Returns the rasterWidth in level2/truncating mode,\n     * otherwise the max width, that has been seen so far.\n     */\n    get width() {\n        return this._mode !== 1 /* M1 */\n            ? this._width\n            : Math.max(this._maxWidth, this._wasm.current_width());\n    }\n    /**\n     * Height of the image data.\n     * Returns the rasterHeight in level2/truncating mode,\n     * otherwise height touched by sixels.\n     */\n    get height() {\n        return this._mode !== 1 /* M1 */\n            ? this._height\n            : this._wasm.current_width()\n                ? this._bandWidths.length * 6 + this._wasm.current_height()\n                : this._bandWidths.length * 6;\n    }\n    /**\n     * Get active palette colors as RGBA8888[] (borrowed).\n     */\n    get palette() {\n        return this._palette.subarray(0, this._paletteLimit);\n    }\n    /**\n     * Get the memory used by the decoder.\n     *\n     * This is a rough estimate accounting the wasm instance memory\n     * and pixel buffers held on JS side (real value will be slightly\n     * higher due to JS book-keeping).\n     * Note that the decoder does not free ressources on its own,\n     * call `release` to free excess memory.\n     */\n    get memoryUsage() {\n        return this._canvas.byteLength + this._wasm.memory.buffer.byteLength + 8 * this._bandWidths.length;\n    }\n    /**\n     * Get various properties of the decoder and the current image.\n     */\n    get properties() {\n        return {\n            width: this.width,\n            height: this.height,\n            mode: this._mode,\n            level: this._level,\n            truncate: !!this._truncate,\n            paletteLimit: this._paletteLimit,\n            fillColor: this._fillColor,\n            memUsage: this.memoryUsage,\n            rasterAttributes: {\n                numerator: this._states[4],\n                denominator: this._states[5],\n                width: this._rasterWidth,\n                height: this._rasterHeight,\n            }\n        };\n    }\n    /**\n     * Initialize decoder for next image. Must be called before\n     * any calls to `decode` or `decodeString`.\n     */\n    // FIXME: reorder arguments, better palette handling\n    init(fillColor = this._opts.fillColor, palette = this._opts.palette, paletteLimit = this._opts.paletteLimit, truncate = this._opts.truncate) {\n        this._wasm.init(this._opts.sixelColor, fillColor, paletteLimit, truncate ? 1 : 0);\n        if (palette) {\n            this._palette.set(palette.subarray(0, wasm_1.LIMITS.PALETTE_SIZE));\n        }\n        this._bandWidths.length = 0;\n        this._maxWidth = 0;\n        this._minWidth = wasm_1.LIMITS.MAX_WIDTH;\n        this._lastOffset = 0;\n        this._currentHeight = 0;\n    }\n    /**\n     * Decode next chunk of data from start to end index (exclusive).\n     * @throws Will throw if the image exceeds the memory limit.\n     */\n    decode(data, start = 0, end = data.length) {\n        let p = start;\n        while (p < end) {\n            const length = Math.min(end - p, wasm_1.LIMITS.CHUNK_SIZE);\n            this._chunk.set(data.subarray(p, p += length));\n            this._wasm.decode(0, length);\n        }\n    }\n    /**\n     * Decode next chunk of string data from start to end index (exclusive).\n     * Note: Decoding from string data is rather slow, use `decode` with byte data instead.\n     * @throws Will throw if the image exceeds the memory limit.\n     */\n    decodeString(data, start = 0, end = data.length) {\n        let p = start;\n        while (p < end) {\n            const length = Math.min(end - p, wasm_1.LIMITS.CHUNK_SIZE);\n            for (let i = 0, j = p; i < length; ++i, ++j) {\n                this._chunk[i] = data.charCodeAt(j);\n            }\n            p += length;\n            this._wasm.decode(0, length);\n        }\n    }\n    /**\n     * Get current pixel data as 32-bit typed array (RGBA8888).\n     * Also peeks into pixel data of the current band, that got not pushed yet.\n     */\n    get data32() {\n        if (this._mode === 0 /* M0 */ || !this.width || !this.height) {\n            return NULL_CANVAS;\n        }\n        // get width of pending band to peek into left-over data\n        const currentWidth = this._wasm.current_width();\n        if (this._mode === 2 /* M2 */) {\n            let remaining = this.height - this._currentHeight;\n            if (remaining > 0) {\n                const adv = this._PIXEL_OFFSET;\n                let offset = this._lastOffset;\n                let c = 0;\n                while (c < 6 && remaining > 0) {\n                    this._canvas.set(this._pSrc.subarray(adv * c, adv * c + currentWidth), offset + currentWidth * c);\n                    c++;\n                    remaining--;\n                }\n                if (remaining) {\n                    this._canvas.fill(this._fillColor, offset + currentWidth * c);\n                }\n            }\n            return this._canvas.subarray(0, this.width * this.height);\n        }\n        if (this._mode === 1 /* M1 */) {\n            if (this._minWidth === this._maxWidth) {\n                let escape = false;\n                if (currentWidth) {\n                    if (currentWidth !== this._minWidth) {\n                        escape = true;\n                    }\n                    else {\n                        const adv = this._PIXEL_OFFSET;\n                        let offset = this._lastOffset;\n                        this._realloc(offset, currentWidth * 6);\n                        for (let i = 0; i < 6; ++i) {\n                            this._canvas.set(this._pSrc.subarray(adv * i, adv * i + currentWidth), offset + currentWidth * i);\n                        }\n                    }\n                }\n                if (!escape) {\n                    return this._canvas.subarray(0, this.width * this.height);\n                }\n            }\n            // worst case: re-align pixels if we have bands with different width\n            // This is somewhat allocation intensive, any way to do that in-place, and just once?\n            const final = new Uint32Array(this.width * this.height);\n            final.fill(this._fillColor);\n            let finalOffset = 0;\n            let start = 0;\n            for (let i = 0; i < this._bandWidths.length; ++i) {\n                const bw = this._bandWidths[i];\n                for (let p = 0; p < 6; ++p) {\n                    final.set(this._canvas.subarray(start, start += bw), finalOffset);\n                    finalOffset += this.width;\n                }\n            }\n            // also handle left-over pixels of the current band\n            if (currentWidth) {\n                const adv = this._PIXEL_OFFSET;\n                // other than finished bands, this runs only up to currentHeight\n                const currentHeight = this._wasm.current_height();\n                for (let i = 0; i < currentHeight; ++i) {\n                    final.set(this._pSrc.subarray(adv * i, adv * i + currentWidth), finalOffset + this.width * i);\n                }\n            }\n            return final;\n        }\n        // fallthrough for all not handled cases\n        return NULL_CANVAS;\n    }\n    /**\n     * Same as `data32`, but returning pixel data as Uint8ClampedArray suitable\n     * for direct usage with `ImageData`.\n     */\n    get data8() {\n        return new Uint8ClampedArray(this.data32.buffer, 0, this.width * this.height * 4);\n    }\n    /**\n     * Release image ressources on JS side held by the decoder.\n     *\n     * The decoder tries to re-use memory ressources of a previous image\n     * to lower allocation and GC pressure. Decoding a single big image\n     * will grow the memory usage of the decoder permanently.\n     * Call `release` to reset the internal buffers and free the memory.\n     * Note that this destroys the image data, call it when done processing\n     * a rather big image, otherwise it is not needed. Use `memoryUsage`\n     * to decide, whether the held memory is still within your limits.\n     * This does not affect the wasm module (operates on static memory).\n     */\n    release() {\n        this._canvas = NULL_CANVAS;\n        this._bandWidths.length = 0;\n        this._maxWidth = 0;\n        this._minWidth = wasm_1.LIMITS.MAX_WIDTH;\n        // also nullify parser states in wasm to avoid\n        // width/height reporting potential out-of-bound values\n        this._wasm.init(Colors_1.DEFAULT_FOREGROUND, 0, this._opts.paletteLimit, 0);\n    }\n}\nexports.Decoder = Decoder;\n/**\n * Convenient decoding functions for easier usage.\n *\n * These can be used for casual decoding of sixel images,\n * that dont come in as stream chunks.\n * Note that the functions instantiate a stream decoder for every call,\n * which comes with a performance penalty of ~25%.\n */\n/**\n * Decode function with synchronous wasm loading.\n * Can be used in a web worker or in nodejs. Does not work reliable in normal browser context.\n * @throws Will throw if the image exceeds the memory limit.\n */\nfunction decode(data, opts) {\n    const dec = new Decoder(opts);\n    dec.init();\n    typeof data === 'string' ? dec.decodeString(data) : dec.decode(data);\n    return {\n        width: dec.width,\n        height: dec.height,\n        data32: dec.data32,\n        data8: dec.data8\n    };\n}\nexports.decode = decode;\n/**\n * Decode function with asynchronous wasm loading.\n * Use this version in normal browser context.\n * @throws Will throw if the image exceeds the memory limit.\n */\nasync function decodeAsync(data, opts) {\n    const dec = await DecoderAsync(opts);\n    dec.init();\n    typeof data === 'string' ? dec.decodeString(data) : dec.decode(data);\n    return {\n        width: dec.width,\n        height: dec.height,\n        data32: dec.data32,\n        data8: dec.data8\n    };\n}\nexports.decodeAsync = decodeAsync;\n//# sourceMappingURL=Decoder.js.map","\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.LIMITS = void 0;\nexports.LIMITS = {\n    CHUNK_SIZE: 16384,\n    PALETTE_SIZE: 4096,\n    MAX_WIDTH: 16384,\n    BYTES: 'AGFzbQEAAAABJAdgAAF/YAJ/fwBgA39/fwF/YAF/AX9gAABgBH9/f38AYAF/AAIlAgNlbnYLaGFuZGxlX2JhbmQAAwNlbnYLbW9kZV9wYXJzZWQAAwMTEgQAAAAAAQQBAQUBAAACAgAGAwQFAXABBwcFBAEBBwcGCAF/AUGAihoLB9wBDgZtZW1vcnkCABFnZXRfc3RhdGVfYWRkcmVzcwADEWdldF9jaHVua19hZGRyZXNzAAQOZ2V0X3AwX2FkZHJlc3MABRNnZXRfcGFsZXR0ZV9hZGRyZXNzAAYEaW5pdAALBmRlY29kZQAMDWN1cnJlbnRfd2lkdGgADQ5jdXJyZW50X2hlaWdodAAOGV9faW5kaXJlY3RfZnVuY3Rpb25fdGFibGUBAAtfaW5pdGlhbGl6ZQACCXN0YWNrU2F2ZQARDHN0YWNrUmVzdG9yZQASCnN0YWNrQWxsb2MAEwkMAQBBAQsGCgcJDxACDAEBCq5UEgMAAQsFAEGgCAsGAEGQiQELBgBBsIkCCwUAQZAJC+okAQh/QeQIKAIAIQVB4AgoAgAhA0HoCCgCACEIIAFBkIkBaiIJQf8BOgAAIAAgAUgEQCAAQZCJAWohBgNAIAMhBCAGQQFqIQECQCAGLQAAQf8AcSIDQTBrQQlLBEAgASEGDAELQewIKAIAQQJ0QewIaiICKAIAIQADQCACIAMgAEEKbGpBMGsiADYCACABLQAAIQMgAUEBaiIGIQEgA0H/AHEiA0Ewa0EKSQ0ACwsCQAJAAkACQAJAAkACQAJ/AkACQCADQT9rIgBBP00EQCAERQ0BIARBIUYEQAJAQfAIKAIAIgFBASABGyIHIAhqIgFB1AgoAgAiA0gNACADQf//AEoNAANAIANBAnQiAkGgiQJqIgRBoAgpAwA3AwAgAkGoiQJqQaAIKQMANwMAIAJBsIkCakGgCCkDADcDACACQbiJAmpBoAgpAwA3AwAgAkHAiQJqQaAIKQMANwMAIAJByIkCakGgCCkDADcDACACQdCJAmpBoAgpAwA3AwAgAkHYiQJqQaAIKQMANwMAIAJB4IkCakGgCCkDADcDACACQeiJAmpBoAgpAwA3AwAgAkHwiQJqQaAIKQMANwMAIAJB+IkCakGgCCkDADcDACACQYCKAmpBoAgpAwA3AwAgAkGIigJqQaAIKQMANwMAIAJBkIoCakGgCCkDADcDACACQZiKAmpBoAgpAwA3AwAgAkGgigJqQaAIKQMANwMAIAJBqIoCakGgCCkDADcDACACQbCKAmpBoAgpAwA3AwAgAkG4igJqQaAIKQMANwMAIAJBwIoCakGgCCkDADcDACACQciKAmpBoAgpAwA3AwAgAkHQigJqQaAIKQMANwMAIAJB2IoCakGgCCkDADcDACACQeCKAmpBoAgpAwA3AwAgAkHoigJqQaAIKQMANwMAIAJB8IoCakGgCCkDADcDACACQfiKAmpBoAgpAwA3AwAgAkGAiwJqQaAIKQMANwMAIAJBiIsCakGgCCkDADcDACACQZCLAmpBoAgpAwA3AwAgAkGYiwJqQaAIKQMANwMAIAJBoIsCakGgCCkDADcDACACQaiLAmpBoAgpAwA3AwAgAkGwiwJqQaAIKQMANwMAIAJBuIsCakGgCCkDADcDACACQcCLAmpBoAgpAwA3AwAgAkHIiwJqQaAIKQMANwMAIAJB0IsCakGgCCkDADcDACACQdiLAmpBoAgpAwA3AwAgAkHgiwJqQaAIKQMANwMAIAJB6IsCakGgCCkDADcDACACQfCLAmpBoAgpAwA3AwAgAkH4iwJqQaAIKQMANwMAIAJBgIwCakGgCCkDADcDACACQYiMAmpBoAgpAwA3AwAgAkGQjAJqQaAIKQMANwMAIAJBmIwCakGgCCkDADcDACACQaCMAmpBoAgpAwA3AwAgAkGojAJqQaAIKQMANwMAIAJBsIwCakGgCCkDADcDACACQbiMAmpBoAgpAwA3AwAgAkHAjAJqQaAIKQMANwMAIAJByIwCakGgCCkDADcDACACQdCMAmpBoAgpAwA3AwAgAkHYjAJqQaAIKQMANwMAIAJB4IwCakGgCCkDADcDACACQeiMAmpBoAgpAwA3AwAgAkHwjAJqQaAIKQMANwMAIAJB+IwCakGgCCkDADcDACACQYCNAmpBoAgpAwA3AwAgAkGIjQJqQaAIKQMANwMAIAJBkI0CakGgCCkDADcDACACQZiNAmpBoAgpAwA3AwAgAkGwiQZqIARBgAT8CgAAQdQIKAIAQQJ0QcCJCmogBEGABPwKAABB1AgoAgBBAnRB0IkOaiAEQYAE/AoAAEHUCCgCAEECdEHgiRJqIARBgAT8CgAAQdQIKAIAQQJ0QfCJFmogBEGABPwKAABB1AhB1AgoAgAiAkGAAWoiAzYCACABIANIDQEgAkGA/wBIDQALCwJAIABFDQAgCEH//wBLDQBBgIABIAhrIAcgAUH//wBLGyECAkAgAEEBcUUNACACRQ0AIAhBAnRBoIkCaiEDIAIhBCACQQdxIgcEQANAIAMgBTYCACADQQRqIQMgBEEBayEEIAdBAWsiBw0ACwsgAkEBa0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgBEEIayIEDQALCwJAIABBAnFFDQAgAkUNACAIQQJ0QbCJBmohAyACIQQgAkEHcSIHBEADQCADIAU2AgAgA0EEaiEDIARBAWshBCAHQQFrIgcNAAsLIAJBAWtBB0kNAANAIAMgBTYCHCADIAU2AhggAyAFNgIUIAMgBTYCECADIAU2AgwgAyAFNgIIIAMgBTYCBCADIAU2AgAgA0EgaiEDIARBCGsiBA0ACwsCQCAAQQRxRQ0AIAJFDQAgCEECdEHAiQpqIQMgAiEEIAJBB3EiBwRAA0AgAyAFNgIAIANBBGohAyAEQQFrIQQgB0EBayIHDQALCyACQQFrQQdJDQADQCADIAU2AhwgAyAFNgIYIAMgBTYCFCADIAU2AhAgAyAFNgIMIAMgBTYCCCADIAU2AgQgAyAFNgIAIANBIGohAyAEQQhrIgQNAAsLAkAgAEEIcUUNACACRQ0AIAhBAnRB0IkOaiEDIAIhBCACQQdxIgcEQANAIAMgBTYCACADQQRqIQMgBEEBayEEIAdBAWsiBw0ACwsgAkEBa0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgBEEIayIEDQALCwJAIABBEHFFDQAgAkUNACAIQQJ0QeCJEmohAyACIQQgAkEHcSIHBEADQCADIAU2AgAgA0EEaiEDIARBAWshBCAHQQFrIgcNAAsLIAJBAWtBB0kNAANAIAMgBTYCHCADIAU2AhggAyAFNgIUIAMgBTYCECADIAU2AgwgAyAFNgIIIAMgBTYCBCADIAU2AgAgA0EgaiEDIARBCGsiBA0ACwsgAEEgcUUNACACRQ0AIAJBAWshByAIQQJ0QfCJFmohAyACQQdxIgQEQANAIAMgBTYCACADQQRqIQMgAkEBayECIARBAWsiBA0ACwsgB0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgAkEIayICDQALC0HcCEHcCCgCACAAcjYCACAGQQFqIgIgBi0AAEH/AHEiA0E/ayIAQT9LDQQaDAMLAkBB7AgoAgAiBEEBRgRAQfAIKAIAIgNBzAgoAgAiAUkNASADIAFwIQMMAQtB+AgoAgAhAkH0CCgCACEBAkACQCAEQQVHDQAgAUEBRw0AIAJB6QJODQQMAQsgAkHkAEoNA0H8CCgCAEHkAEoNA0GACSgCAEHkAEoNAwsCQCABRQ0AIAFBAkoNACACQfwIKAIAQYAJKAIAIAFBAnRBiAhqKAIAEQIAIQFB8AgoAgAiA0HMCCgCACICTwR/IAMgAnAFIAMLQQJ0QZAJaiABNgIAC0HwCCgCACIDQcwIKAIAIgFJDQAgAyABcCEDCyADQQJ0QZAJaigCACEFDAELIANB/QBxQSFHBEAgCCEBIAYhAgwECyAEQSNHDQQCQEHsCCgCACICQQFGBEBB8AgoAgAiAUHMCCgCACIASQ0BIAEgAHAhAQwBC0H4CCgCACEBQfQIKAIAIQACQAJAIAJBBUcNACAAQQFHDQAgAUHpAkgNAQwHCyABQeQASg0GQfwIKAIAQeQASg0GQYAJKAIAQeQASg0GCwJAIABFDQAgAEECSg0AIAFB/AgoAgBBgAkoAgAgAEECdEGICGooAgARAgAhAEHwCCgCACIBQcwIKAIAIgJPBH8gASACcAUgAQtBAnRBkAlqIAA2AgALQfAIKAIAIgFBzAgoAgAiAEkNACABIABwIQELIAFBAnRBkAlqKAIAIQUMBAsgCCEBIAYhAgtB1AgoAgAhBgNAAkAgASAGSA0AIAZB//8ASg0AIAZBAnQiBEGgiQJqIgZBoAgpAwA3AwAgBEGoiQJqQaAIKQMANwMAIARBsIkCakGgCCkDADcDACAEQbiJAmpBoAgpAwA3AwAgBEHAiQJqQaAIKQMANwMAIARByIkCakGgCCkDADcDACAEQdCJAmpBoAgpAwA3AwAgBEHYiQJqQaAIKQMANwMAIARB4IkCakGgCCkDADcDACAEQeiJAmpBoAgpAwA3AwAgBEHwiQJqQaAIKQMANwMAIARB+IkCakGgCCkDADcDACAEQYCKAmpBoAgpAwA3AwAgBEGIigJqQaAIKQMANwMAIARBkIoCakGgCCkDADcDACAEQZiKAmpBoAgpAwA3AwAgBEGgigJqQaAIKQMANwMAIARBqIoCakGgCCkDADcDACAEQbCKAmpBoAgpAwA3AwAgBEG4igJqQaAIKQMANwMAIARBwIoCakGgCCkDADcDACAEQciKAmpBoAgpAwA3AwAgBEHQigJqQaAIKQMANwMAIARB2IoCakGgCCkDADcDACAEQeCKAmpBoAgpAwA3AwAgBEHoigJqQaAIKQMANwMAIARB8IoCakGgCCkDADcDACAEQfiKAmpBoAgpAwA3AwAgBEGAiwJqQaAIKQMANwMAIARBiIsCakGgCCkDADcDACAEQZCLAmpBoAgpAwA3AwAgBEGYiwJqQaAIKQMANwMAIARBoIsCakGgCCkDADcDACAEQaiLAmpBoAgpAwA3AwAgBEGwiwJqQaAIKQMANwMAIARBuIsCakGgCCkDADcDACAEQcCLAmpBoAgpAwA3AwAgBEHIiwJqQaAIKQMANwMAIARB0IsCakGgCCkDADcDACAEQdiLAmpBoAgpAwA3AwAgBEHgiwJqQaAIKQMANwMAIARB6IsCakGgCCkDADcDACAEQfCLAmpBoAgpAwA3AwAgBEH4iwJqQaAIKQMANwMAIARBgIwCakGgCCkDADcDACAEQYiMAmpBoAgpAwA3AwAgBEGQjAJqQaAIKQMANwMAIARBmIwCakGgCCkDADcDACAEQaCMAmpBoAgpAwA3AwAgBEGojAJqQaAIKQMANwMAIARBsIwCakGgCCkDADcDACAEQbiMAmpBoAgpAwA3AwAgBEHAjAJqQaAIKQMANwMAIARByIwCakGgCCkDADcDACAEQdCMAmpBoAgpAwA3AwAgBEHYjAJqQaAIKQMANwMAIARB4IwCakGgCCkDADcDACAEQeiMAmpBoAgpAwA3AwAgBEHwjAJqQaAIKQMANwMAIARB+IwCakGgCCkDADcDACAEQYCNAmpBoAgpAwA3AwAgBEGIjQJqQaAIKQMANwMAIARBkI0CakGgCCkDADcDACAEQZiNAmpBoAgpAwA3AwAgBEGwiQZqIAZBgAT8CgAAQdQIKAIAQQJ0QcCJCmogBkGABPwKAABB1AgoAgBBAnRB0IkOaiAGQYAE/AoAAEHUCCgCAEECdEHgiRJqIAZBgAT8CgAAQdQIKAIAQQJ0QfCJFmogBkGABPwKAABB1AhB1AgoAgBBgAFqIgY2AgALIAFB//8ATQRAIABBAXEgAWxBAnRBoIkCaiAFNgIAIABBAXZBAXEgAWxBAnRBsIkGaiAFNgIAIABBAnZBAXEgAWxBAnRBwIkKaiAFNgIAIABBA3ZBAXEgAWxBAnRB0IkOaiAFNgIAIABBBHZBAXEgAWxBAnRB4IkSaiAFNgIAIABBBXYgAWxBAnRB8IkWaiAFNgIAQdQIKAIAIQYLIAFBAWohAUHcCEHcCCgCACAAcjYCACACLQAAIQAgAkEBaiIEIQIgAEH/AHEiA0E/ayIAQcAASQ0ACyAECyECQQAhBCACIQYgASEIIANB/QBxQSFGDQELIANBJGsOCgEDAwMDAwMDAwIDC0HsCEIBNwIADAQLQdgIIAFB2AgoAgAiACAAIAFIGyIAQYCAASAAQYCAAUgbNgIADAILQegIIAFB2AgoAgAiACAAIAFIGyIAQYCAASAAQYCAAUgbIgA2AgBB2AggADYCACAAQQRrEAAEQEHoCEEENgIAQdgIQQQ2AgBB0AhBATYCAA8LEAgMAQsCQCADQTtHDQBB7AgoAgAiAEEHSg0AQewIIABBAWo2AgAgAEECdEHwCGpBADYCAAsgAiEGIAQhAyABIQgMAQtBBCEIIAIhBiAEIQMLIAYgCUkNAAsLQeQIIAU2AgBB4AggAzYCAEHoCCAINgIAC9ELAgF+CH9B2AhCBDcDAEGojQJBoAgpAwAiADcDAEGgjQIgADcDAEGYjQIgADcDAEGQjQIgADcDAEGIjQIgADcDAEGAjQIgADcDAEH4jAIgADcDAEHwjAIgADcDAEHojAIgADcDAEHgjAIgADcDAEHYjAIgADcDAEHQjAIgADcDAEHIjAIgADcDAEHAjAIgADcDAEG4jAIgADcDAEGwjAIgADcDAEGojAIgADcDAEGgjAIgADcDAEGYjAIgADcDAEGQjAIgADcDAEGIjAIgADcDAEGAjAIgADcDAEH4iwIgADcDAEHwiwIgADcDAEHoiwIgADcDAEHgiwIgADcDAEHYiwIgADcDAEHQiwIgADcDAEHIiwIgADcDAEHAiwIgADcDAEG4iwIgADcDAEGwiwIgADcDAEGoiwIgADcDAEGgiwIgADcDAEGYiwIgADcDAEGQiwIgADcDAEGIiwIgADcDAEGAiwIgADcDAEH4igIgADcDAEHwigIgADcDAEHoigIgADcDAEHgigIgADcDAEHYigIgADcDAEHQigIgADcDAEHIigIgADcDAEHAigIgADcDAEG4igIgADcDAEGwigIgADcDAEGoigIgADcDAEGgigIgADcDAEGYigIgADcDAEGQigIgADcDAEGIigIgADcDAEGAigIgADcDAEH4iQIgADcDAEHwiQIgADcDAEHoiQIgADcDAEHgiQIgADcDAEHYiQIgADcDAEHQiQIgADcDAEHIiQIgADcDAEHAiQIgADcDAEG4iQIgADcDAEGwiQIgADcDAEGoCCgCACIEQf8AakGAAW0hCAJAIARBgQFIDQBBASEBIAhBAiAIQQJKG0EBayICQQFxIQMgBEGBAk4EQCACQX5xIQIDQCABQQl0IgdBEHJBoIkCakGwiQJBgAT8CgAAIAdBsI0CakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsLIANFDQAgAUEJdEEQckGgiQJqQbCJAkGABPwKAAALAkAgBEEBSA0AIAhBASAIQQFKGyIDQQFxIQUCQCADQQFrIgdFBEBBACEBDAELIANB/v///wdxIQJBACEBA0AgAUEJdCIGQRByQbCJBmpBsIkCQYAE/AoAACAGQZAEckGwiQZqQbCJAkGABPwKAAAgAUECaiEBIAJBAmsiAg0ACwsgBQRAIAFBCXRBEHJBsIkGakGwiQJBgAT8CgAACyAEQQFIDQAgA0EBcSEFIAcEfyADQf7///8HcSECQQAhAQNAIAFBCXQiBkEQckHAiQpqQbCJAkGABPwKAAAgBkGQBHJBwIkKakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsgAUEHdEEEcgVBBAshASAFBEAgAUECdEHAiQpqQbCJAkGABPwKAAALIARBAUgNACADQQFxIQUgBwR/IANB/v///wdxIQJBACEBA0AgAUEJdCIGQRByQdCJDmpBsIkCQYAE/AoAACAGQZAEckHQiQ5qQbCJAkGABPwKAAAgAUECaiEBIAJBAmsiAg0ACyABQQd0QQRyBUEECyEBIAUEQCABQQJ0QdCJDmpBsIkCQYAE/AoAAAsgBEEBSA0AIANBAXEhBSAHBH8gA0H+////B3EhAkEAIQEDQCABQQl0IgZBEHJB4IkSakGwiQJBgAT8CgAAIAZBkARyQeCJEmpBsIkCQYAE/AoAACABQQJqIQEgAkECayICDQALIAFBB3RBBHIFQQQLIQEgBQRAIAFBAnRB4IkSakGwiQJBgAT8CgAACyAEQQFIDQAgA0EBcSEEIAcEfyADQf7///8HcSECQQAhAQNAIAFBCXQiA0EQckHwiRZqQbCJAkGABPwKAAAgA0GQBHJB8IkWakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsgAUEHdEEEcgVBBAshASAERQ0AIAFBAnRB8IkWakGwiQJBgAT8CgAAC0HUCCAIQQd0QQRyNgIAC58TAgh/AX5B5AgoAgAhA0HgCCgCACECQegIKAIAIQcgAUGQiQFqIglB/wE6AAAgACABSARAIABBkIkBaiEIA0AgAiEEIAhBAWohAQJAIAgtAABB/wBxIgJBMGtBCUsEQCABIQgMAQtB7AgoAgBBAnRB7AhqIgUoAgAhAANAIAUgAiAAQQpsakEwayIANgIAIAEtAAAhAiABQQFqIgghASACQf8AcSICQTBrQQpJDQALCwJAAkACQAJAAkACQAJ/AkAgAkE/ayIAQT9NBEAgBEUNASAEQSFGBEBB8AgoAgAiAUEBIAEbIgQgB2ohAQJAIABFDQAgB0H//wBLDQBBgIABIAdrIAQgAUH//wBLGyEFAkAgAEEBcUUNACAHQQJ0QaCJAmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEECcUUNACAHQQJ0QbCJBmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEEcUUNACAHQQJ0QcCJCmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEIcUUNACAHQQJ0QdCJDmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEQcUUNACAHQQJ0QeCJEmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLIABBIHFFDQAgBUEBayEEIAdBAnRB8IkWaiEAIAVBB3EiAgRAA0AgACADNgIAIABBBGohACAFQQFrIQUgAkEBayICDQALCyAEQQdJDQADQCAAIAM2AhwgACADNgIYIAAgAzYCFCAAIAM2AhAgACADNgIMIAAgAzYCCCAAIAM2AgQgACADNgIAIABBIGohACAFQQhrIgUNAAsLIAhBAWoiBSAILQAAQf8AcSICQT9rIgBBP00NAxoMBAsCQEHsCCgCACIFQQFGBEBB8AgoAgAiAUHMCCgCACIESQ0BIAEgBHAhAQwBC0H4CCgCACEEQfQIKAIAIQECQAJAIAVBBUcNACABQQFHDQAgBEHpAk4NBAwBCyAEQeQASg0DQfwIKAIAQeQASg0DQYAJKAIAQeQASg0DCwJAIAFFDQAgAUECSg0AIARB/AgoAgBBgAkoAgAgAUECdEGICGooAgARAgAhBEHwCCgCACIBQcwIKAIAIgVPBH8gASAFcAUgAQtBAnRBkAlqIAQ2AgALQfAIKAIAIgFBzAgoAgAiBEkNACABIARwIQELIAFBAnRBkAlqKAIAIQMMAQsgAkH9AHFBIUcEQCAHIQEgAiEADAQLIARBI0cNBAJAQewIKAIAIgRBAUYEQEHwCCgCACIBQcwIKAIAIgBJDQEgASAAcCEBDAELQfgIKAIAIQFB9AgoAgAhAAJAAkAgBEEFRw0AIABBAUcNACABQekCSA0BDAcLIAFB5ABKDQZB/AgoAgBB5ABKDQZBgAkoAgBB5ABKDQYLAkAgAEUNACAAQQJKDQAgAUH8CCgCAEGACSgCACAAQQJ0QYgIaigCABECACEAQfAIKAIAIgFBzAgoAgAiBE8EfyABIARwBSABC0ECdEGQCWogADYCAAtB8AgoAgAiAUHMCCgCACIASQ0AIAEgAHAhAQsgAUECdEGQCWooAgAhAwwECyAHIQEgCAshBQNAIAFB//8ATQRAIABBAXEgAWxBAnRBoIkCaiADNgIAIABBAXZBAXEgAWxBAnRBsIkGaiADNgIAIABBAnZBAXEgAWxBAnRBwIkKaiADNgIAIABBA3ZBAXEgAWxBAnRB0IkOaiADNgIAIABBBHZBAXEgAWxBAnRB4IkSaiADNgIAIABBBXYgAWxBAnRB8IkWaiADNgIACyABQQFqIQEgBS0AACEAIAVBAWoiBCEFIABB/wBxIgJBP2siAEHAAEkNAAsgBCEFC0EAIQQgBSEIIAEhByACIQAgAkH9AHFBIUYNAQtBBCEHIAQhAiAAQSRrDgoDAgICAgICAgIBAgtB7AhCATcCAAwCC0GoCCgCAEEEaxAABEBB0AhBATYCAA8LAkBBqAgoAgAiBkEFSA0AQaAIKQMAIQogBkEDa0EBdiIBQQdxIQJBACEAIAFBAWtBB08EQCABQfj///8HcSEFA0AgAEEDdCIBQbCJAmogCjcDACABQQhyQbCJAmogCjcDACABQRByQbCJAmogCjcDACABQRhyQbCJAmogCjcDACABQSByQbCJAmogCjcDACABQShyQbCJAmogCjcDACABQTByQbCJAmogCjcDACABQThyQbCJAmogCjcDACAAQQhqIQAgBUEIayIFDQALCyACRQ0AA0AgAEEDdEGwiQJqIAo3AwAgAEEBaiEAIAJBAWsiAg0ACwtBwIkGQbCJAiAGQQJ0IgD8CgAAQdCJCkGwiQIgAPwKAABB4IkOQbCJAiAA/AoAAEHwiRJBsIkCIAD8CgAAQYCKFkGwiQIgAPwKAAAgBCECDAELAkAgAEE7Rw0AQewIKAIAIgBBB0oNAEHsCCAAQQFqNgIAIABBAnRB8AhqQQA2AgALIAEhBwsgCCAJSQ0ACwtB5AggAzYCAEHgCCACNgIAQegIIAc2AgAL4gcCBX8BfgJAQdAIAn8CQAJAIAAgAU4NACABQZCJAWohBiAAQZCJAWohBQNAIAUtAAAiA0H/AHEhAgJAAkACQAJAAkACQAJAQeAIKAIAIgRBIkcEQCAEDQcgAkEiRgRAQewIQgE3AgBB4AhBIjYCAAwICyACQT9rQcAASQ0GIANBIWsiAkEMTQ0BDAULAkAgAkEwayIEQQlNBEBB7AgoAgBBAnRB7AhqIgIgBCACKAIAQQpsajYCAAwBC0HsCCgCACEEIAJBO0YEQCAEQQdKDQFB7AggBEEBajYCACAEQQJ0QfAIakEANgIADAELIARBBEYEQEHECEECNgIAQbAIQfAIKQMANwMAQbgIQfgIKAIAIgI2AgBBvAhB/AgoAgAiBDYCAEHICEECQQFBwAgoAgAiAxs2AgBBrAggBEEAIAMbNgIAQagIIAJBgIABIAJBgIABSBtBBGpBACADGzYCAEHgCEEANgIADAoLIAJBP2tBwABJDQQLIANBIWsiAkEMTQ0BDAILQQEgAnRBjSBxRQ0DDAQLQQEgAnRBjSBxDQELIANBoQFrIgJBDEsNA0EBIAJ0QY0gcUUNAwtBxAhCgYCAgBA3AgBBsAhB8AgoAgBBAEHsCCgCACICQQBKGzYCAEG0CEH0CCgCAEEAIAJBAUobNgIAQbgIQfgIKAIAQQAgAkECShs2AgBB4AhBADYCAEG8CEEANgIADAQLIANBoQFrIgJBDEsNAUEBIAJ0QY0gcUUNAQtBxAhCgYCAgBA3AgBBsAhCADcDAEG4CEIANwMADAMLIAVBAWoiBSAGSQ0ACwsCQEHICCgCAA4DAwEAAQsCQEGoCCgCACIFQQVIDQBBoAgpAwAhByAFQQNrQQF2IgNBB3EhBEEAIQIgA0EBa0EHTwRAIANB+P///wdxIQYDQCACQQN0IgNBsIkCaiAHNwMAIANBCHJBsIkCaiAHNwMAIANBEHJBsIkCaiAHNwMAIANBGHJBsIkCaiAHNwMAIANBIHJBsIkCaiAHNwMAIANBKHJBsIkCaiAHNwMAIANBMHJBsIkCaiAHNwMAIANBOHJBsIkCaiAHNwMAIAJBCGohAiAGQQhrIgYNAAsLIARFDQADQCACQQN0QbCJAmogBzcDACACQQFqIQIgBEEBayIEDQALC0HAiQZBsIkCIAVBAnQiA/wKAABB0IkKQbCJAiAD/AoAAEHgiQ5BsIkCIAP8CgAAQfCJEkGwiQIgA/wKAABBgIoWQbCJAiAD/AoAAEECDAELEAhByAgoAgALEAEiAjYCACACDQAgACABQcgIKAIAQQJ0QYAIaigCABEBAAsLdABB6AhBBDYCAEHkCCAANgIAQewIQgE3AgBBxAhCADcCAEHACCADNgIAQdwIQgA3AgBBqAhCADcDAEGwCEIANwMAQbgIQgA3AwBBzAggAkGAICACQYAgSRs2AgBBoAggAa1CgYCAgBB+NwMAQdAIQQA2AgALIwBB0AgoAgBFBEAgACABQcgIKAIAQQJ0QYAIaigCABEBAAsLWgECfwJAAkACQEHICCgCAEEBaw4CAAECC0HYCEHoCCgCACIAQdgIKAIAIgEgACABShsiAEGAgAEgAEGAgAFIGyIANgIAIABBBGsPC0GoCCgCAEEEayEACyAAC0IBAX8Cf0EGQdwIKAIAIgBBIHENABpBBSAAQRBxDQAaQQQgAEEIcQ0AGkEDIABBBHENABpBAiAAQQFxIABBAnEbCwu9BQEFfQJ/IAJFBEAgAUH/AWxBMmpB5ABtIgBBCHQgAHIgAEEQdHIMAQsgArJDAADIQpUhBiAAQfABarJDAAC0Q5UhBQJ9IAGyQwAAyEKVIgNDAAAAP10EQCADIAZDAACAP5KUDAELIAYgA0MAAIA/IAaTlJILIQcgAyADkiEGAkAgBUOrqqo+kiIEQwAAAABdBEAgBEMAAIA/kiEEDAELIARDAACAP15FDQAgBEMAAIC/kiEECyAGIAeTIQMgBUMAAAAAXSEAAn8CfSADIAcgA5NDAADAQJQgBJSSIARDq6oqPl0NABogByAEQwAAAD9dDQAaIAMgBEOrqio/XUUNABogAyAHIAOTIARDAADAwJRDAACAQJKUkgtDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALIQECQCAABEAgBUMAAIA/kiEEDAELIAUiBEMAAIA/XkUNACAFQwAAgL+SIQQLIAVDq6qqvpIiBUMAAAAAXSECAn8CfSADIAcgA5NDAADAQJQgBJSSIARDq6oqPl0NABogByAEQwAAAD9dDQAaIAMgBEOrqio/XUUNABogAyAHIAOTIARDAADAwJRDAACAQJKUkgtDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALIQACQCACBEAgBUMAAIA/kiEFDAELIAVDAACAP15FDQAgBUMAAIC/kiEFCwJAIAVDq6oqPl0EQCADIAcgA5NDAADAQJQgBZSSIQcMAQsgBUMAAAA/XQ0AIAVDq6oqP11FBEAgAyEHDAELIAMgByADkyAFQwAAwMCUQwAAgECSlJIhBwsgAEEIdAJ/IAdDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALQRB0ciABcgtBgICAeHILNwAgAEH/AWxBMmpB5ABtIAFB/wFsQTJqQeQAbUEIdHIgAkH/AWxBMmpB5ABtQRB0ckGAgIB4cgsEACMACwYAIAAkAAsQACMAIABrQXBxIgAkACAACwsYAQBBgAgLEQEAAAACAAAAAwAAAAQAAAAF'\n};\n//# sourceMappingURL=wasm.js.map","/**\n * Copyright (c) 2024-2026 The xterm.js authors. All rights reserved.\n * @license MIT\n *\n * Minimal event utilities for xterm.js core.\n * Simplified from VS Code's event.ts - no leak detection/profiling.\n */\n\nimport { IDisposable, DisposableStore, toDisposable } from './Lifecycle';\n\nexport interface IEvent<T> {\n  (listener: (e: T) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore): IDisposable;\n}\n\nexport class Emitter<T> {\n  private _listeners: { fn: (e: T) => any, thisArgs: any }[] = [];\n  private _disposed = false;\n  private _event: IEvent<T> | undefined;\n\n  public get event(): IEvent<T> {\n    if (this._event) {\n      return this._event;\n    }\n    this._event = (listener: (e: T) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore) => {\n      if (this._disposed) {\n        return toDisposable(() => {});\n      }\n\n      const entry = { fn: listener, thisArgs };\n      this._listeners = this._listeners.slice();\n      this._listeners.push(entry);\n\n      const result = toDisposable(() => {\n        const idx = this._listeners.indexOf(entry);\n        if (idx !== -1) {\n          this._listeners = this._listeners.slice();\n          this._listeners.splice(idx, 1);\n        }\n      });\n\n      if (disposables) {\n        if (Array.isArray(disposables)) {\n          disposables.push(result);\n        } else {\n          disposables.add(result);\n        }\n      }\n\n      return result;\n    };\n    return this._event;\n  }\n\n  public fire(event: T): void {\n    if (this._disposed || !this._listeners.length) {\n      return;\n    }\n    if (this._listeners.length === 1) {\n      this._listeners[0].fn.call(this._listeners[0].thisArgs, event);\n      return;\n    }\n    const listeners = this._listeners;\n    for (let i = 0, len = listeners.length; i < len; ++i) {\n      listeners[i].fn.call(listeners[i].thisArgs, event);\n    }\n  }\n\n  public dispose(): void {\n    if (this._disposed) {\n      return;\n    }\n    this._disposed = true;\n    this._listeners.length = 0;\n  }\n}\n\nexport namespace EventUtils {\n  export function forward<T>(from: IEvent<T>, to: Emitter<T>): IDisposable {\n    return from(e => to.fire(e));\n  }\n\n  export function map<I, O>(event: IEvent<I>, map: (i: I) => O): IEvent<O> {\n    return (listener: (e: O) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore) => {\n      return event(i => listener.call(thisArgs, map(i)), undefined, disposables);\n    };\n  }\n\n  export function any<T>(...events: IEvent<T>[]): IEvent<T>;\n  export function any(...events: IEvent<any>[]): IEvent<void>;\n  export function any<T>(...events: IEvent<T>[]): IEvent<T> {\n    return (listener: (e: T) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore) => {\n      const store = new DisposableStore();\n      for (const event of events) {\n        store.add(event(e => listener.call(thisArgs, e)));\n      }\n      if (disposables) {\n        if (Array.isArray(disposables)) {\n          disposables.push(store);\n        } else {\n          disposables.add(store);\n        }\n      }\n      return store;\n    };\n  }\n\n  export function runAndSubscribe<T>(event: IEvent<T>, handler: (e: T) => void, initial: T): IDisposable;\n  export function runAndSubscribe<T>(event: IEvent<T>, handler: (e: T | undefined) => void): IDisposable;\n  export function runAndSubscribe<T>(event: IEvent<T>, handler: (e: T | undefined) => void, initial?: T): IDisposable {\n    handler(initial);\n    return event(e => handler(e));\n  }\n}\n","/**\n * Copyright (c) 2024-2026 The xterm.js authors. All rights reserved.\n * @license MIT\n *\n * Minimal lifecycle utilities for xterm.js core.\n * Simplified from VS Code's lifecycle.ts - no tracking/leak detection.\n */\n\nexport interface IDisposable {\n  dispose(): void;\n}\n\nexport function toDisposable(fn: () => void): IDisposable {\n  return { dispose: fn };\n}\n\nexport function dispose<T extends IDisposable>(disposable: T): T;\nexport function dispose<T extends IDisposable>(disposable: T | undefined): T | undefined;\nexport function dispose<T extends IDisposable>(disposables: T[]): T[];\nexport function dispose<T extends IDisposable>(arg: T | T[] | undefined): T | T[] | undefined {\n  if (!arg) {\n    return arg;\n  }\n  if (Array.isArray(arg)) {\n    for (const d of arg) {\n      d.dispose();\n    }\n    return [];\n  }\n  arg.dispose();\n  return arg;\n}\n\nexport function combinedDisposable(...disposables: IDisposable[]): IDisposable {\n  return toDisposable(() => dispose(disposables));\n}\n\nexport class DisposableStore implements IDisposable {\n  private readonly _disposables = new Set<IDisposable>();\n  private _isDisposed = false;\n\n  public get isDisposed(): boolean {\n    return this._isDisposed;\n  }\n\n  public add<T extends IDisposable>(o: T): T {\n    if (this._isDisposed) {\n      o.dispose();\n    } else {\n      this._disposables.add(o);\n    }\n    return o;\n  }\n\n  public dispose(): void {\n    if (this._isDisposed) {\n      return;\n    }\n    this._isDisposed = true;\n    for (const d of this._disposables) {\n      d.dispose();\n    }\n    this._disposables.clear();\n  }\n\n  public clear(): void {\n    for (const d of this._disposables) {\n      d.dispose();\n    }\n    this._disposables.clear();\n  }\n}\n\nexport abstract class Disposable implements IDisposable {\n  public static readonly None: IDisposable = Object.freeze({ dispose() { } });\n\n  protected readonly _store = new DisposableStore();\n\n  public dispose(): void {\n    this._store.dispose();\n  }\n\n  protected _register<T extends IDisposable>(o: T): T {\n    return this._store.add(o);\n  }\n}\n\nexport class MutableDisposable<T extends IDisposable> implements IDisposable {\n  private _value: T | undefined;\n  private _isDisposed = false;\n\n  public get value(): T | undefined {\n    return this._isDisposed ? undefined : this._value;\n  }\n\n  public set value(value: T | undefined) {\n    if (this._isDisposed || value === this._value) {\n      return;\n    }\n    this._value?.dispose();\n    this._value = value;\n  }\n\n  public clear(): void {\n    this.value = undefined;\n  }\n\n  public dispose(): void {\n    this._isDisposed = true;\n    this._value?.dispose();\n    this._value = undefined;\n  }\n}\n","/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\nimport { IImageAddonOptions, IOscHandler, IResetHandler, ITerminalExt } from './Types';\nimport { ImageRenderer } from './ImageRenderer';\nimport { IIPImageStorage } from './IIPImageStorage';\nimport { CELL_SIZE_DEFAULT } from './ImageStorage';\nimport Base64Decoder from 'xterm-wasm-parts/lib/base64/Base64Decoder.wasm';\nimport QoiDecoder from 'xterm-wasm-parts/lib/qoi/QoiDecoder.wasm';\nimport { HeaderParser, IHeaderFields, HeaderState, SequenceType } from './IIPHeaderParser';\nimport { imageType, UNSUPPORTED_TYPE } from './IIPMetrics';\n\n// Local const enum mirror - esbuild can't inline const enums from external packages\nconst enum DecoderConst {\n  // Limit held memory in base64 decoder (encoded bytes).\n  KEEP_DATA = 4194304,\n  // Initial buffer allocation for the decoder.\n  INITIAL_DATA = 1048576,\n  // Local mirror of const enum (esbuild can't inline const enums from external packages)\n  OK = 0\n}\n\n// default IIP header values\nconst DEFAULT_HEADER: IHeaderFields = {\n  type: SequenceType.INVALID,\n  name: 'Unnamed file',\n  size: 0,\n  width: 'auto',\n  height: 'auto',\n  preserveAspectRatio: 1,\n  inline: 0\n};\n\n\nexport class IIPHandler implements IOscHandler, IResetHandler {\n  private _aborted = false;\n  private _hp = new HeaderParser();\n  private _header: IHeaderFields = DEFAULT_HEADER;\n  private _dec: Base64Decoder;\n  private _qoiDec: QoiDecoder;\n  private _isMultipart = false;\n  private _abortMulti = false;\n\n  constructor(\n    private readonly _opts: IImageAddonOptions,\n    private readonly _renderer: ImageRenderer,\n    private readonly _storage: IIPImageStorage,\n    private readonly _coreTerminal: ITerminalExt\n  ) {\n    const maxEncodedBytes = Math.ceil(this._opts.iipSizeLimit * 4 / 3);\n    const initialBytes = Math.min(DecoderConst.INITIAL_DATA, maxEncodedBytes);\n    this._dec = new Base64Decoder(DecoderConst.KEEP_DATA, maxEncodedBytes, initialBytes);\n    this._qoiDec = new QoiDecoder(DecoderConst.KEEP_DATA);\n  }\n\n  public reset(): void {\n    this._hp.reset();\n    this._dec.release();\n    this._qoiDec.release();\n  }\n\n  public start(): void {\n    this._aborted = false;\n    this._hp.reset();\n  }\n\n  public put(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted) return;\n\n    if (this._hp.state === HeaderState.END) {\n      if ((this._dec.put(data.subarray(start, end)) as number) !== DecoderConst.OK) {\n        this._dec.release();\n        this._aborted = true;\n      }\n    } else {\n      const dataPos = this._hp.parse(data, start, end);\n      if (dataPos === -1) {\n        this._aborted = true;\n        return;\n      }\n      if (dataPos > 0) {\n        const seqType = this._hp.fields.type;\n        if (seqType === SequenceType.FILE) {\n          if (this._isMultipart) {\n            this._isMultipart = false;\n            this._abortMulti = false;\n            this._dec.release();\n          }\n          this._header = Object.assign({}, DEFAULT_HEADER, this._hp.fields);\n          if (!this._header.inline) {\n            this._aborted = true;\n            return;\n          }\n          this._dec.init();\n        } else if (this._abortMulti) {\n          this._aborted = true;\n          return;\n        }\n        if ((this._dec.put(data.subarray(dataPos, end)) as number) !== DecoderConst.OK) {\n          this._dec.release();\n          this._aborted = true;\n          if (this._isMultipart) this._abortMulti = true;\n        }\n      }\n    }\n  }\n\n  public end(success: boolean): boolean | Promise<boolean> {\n    if (this._aborted) return true;\n\n    if (this._hp.state !== HeaderState.END) {\n      if (this._hp.end()) return true;\n    }\n    const seqType = this._hp.fields.type;\n\n    if (seqType === SequenceType.FILEPART) return true;\n\n    if (seqType === SequenceType.REPORTCELLSIZE) {\n      // OSC 1337 ; ReportCellSize=[height];[width];[scale] ST\n      let w = CELL_SIZE_DEFAULT.width;\n      let h = CELL_SIZE_DEFAULT.height;\n      if (this._renderer.dimensions) {\n        w = this._renderer.dimensions.css.canvas.width / this._coreTerminal.cols;\n        h = this._renderer.dimensions.css.canvas.height / this._coreTerminal.rows;\n      }\n      const scale = this._coreTerminal._core._coreBrowserService?.dpr ?? 1;\n      const report = `\\x1b]1337;ReportCellSize=${h.toFixed(3)};${w.toFixed(3)};${scale.toFixed(3)}\\x1b\\\\`;\n      this._coreTerminal.input(report, false);\n      return true;\n    }\n\n    if (seqType === SequenceType.MULTIPARTFILE) {\n      this._header = Object.assign({}, DEFAULT_HEADER, this._hp.fields);\n      this._isMultipart = true;\n      this._abortMulti = false;\n      this._dec.release();\n      this._dec.init();\n      return true;\n    }\n\n    if (seqType === SequenceType.FILEEND) {\n      if (!this._isMultipart) return true;\n      this._isMultipart = false;\n      if (this._abortMulti || this._header.type !== SequenceType.MULTIPARTFILE) return true;\n    }\n\n    // fallthrough for SequenceType.FILE & SequenceType.FILEEND\n\n    let w = 0;\n    let h = 0;\n\n    // early exit condition chain\n    let cond: number | boolean;\n    let metrics = UNSUPPORTED_TYPE;\n    if (cond = success) {\n      if (cond = !this._dec.end()) {\n        metrics = imageType(this._dec.data8);\n        if (cond = metrics.mime !== 'unsupported') {\n          w = metrics.width;\n          h = metrics.height;\n          if (cond = w && h && w * h < this._opts.pixelLimit) {\n            [w, h] = this._resize(w, h).map(Math.floor);\n            cond = w && h && w * h < this._opts.pixelLimit;\n          } else {\n            console.warn(`IIP: image dimension issue ${metrics.width}x${metrics.height}`);\n          }\n        } else {\n          console.warn('IIP: unsupported image type');\n        }\n      } else {\n        console.warn('IIP: error during BASE64 decoding');\n      }\n    }\n    if (!cond) {\n      this._dec.release();\n      return true;\n    }\n\n    let blob: Blob | ImageData;\n    if (metrics.mime === 'image/qoi') {\n      const data = this._qoiDec.decode(this._dec.data8);\n      blob = new ImageData(\n        new Uint8ClampedArray(data.buffer, data.byteOffset, data.byteLength),\n        this._qoiDec.width,\n        this._qoiDec.height\n      );\n      this._qoiDec.release();\n      if (w === this._qoiDec.width && h === this._qoiDec.height) {\n        // use fast-path if we don't need to rescale\n        this._dec.release();\n        const canvas = ImageRenderer.createCanvas(undefined, this._qoiDec.width, this._qoiDec.height);\n        canvas.getContext('2d')?.putImageData(blob, 0, 0);\n        this._storage.addImage(canvas);\n        return true;\n      }\n    } else {\n      blob = new Blob([this._dec.data8], { type: metrics.mime });\n    }\n    this._dec.release();\n    return createImageBitmap(blob, { resizeWidth: w, resizeHeight: h })\n      .then(bm => {\n        this._storage.addImage(bm);\n        return true;\n      })\n      .catch(e => {\n        console.warn(`IIP: decoding error ${metrics.mime} ${metrics.width}x${metrics.height}`, e);\n        return true;\n      });\n  }\n\n  private _resize(w: number, h: number): [number, number] {\n    const cw = this._renderer.dimensions?.css.cell.width || CELL_SIZE_DEFAULT.width;\n    const ch = this._renderer.dimensions?.css.cell.height || CELL_SIZE_DEFAULT.height;\n    const width = this._renderer.dimensions?.css.canvas.width || cw * this._coreTerminal.cols;\n    const height = this._renderer.dimensions?.css.canvas.height || ch * this._coreTerminal.rows;\n\n    const rw = this._dim(this._header.width!, width, cw);\n    const rh = this._dim(this._header.height!, height, ch);\n    if (!rw && !rh) {\n      const wf = width / w;         // TODO: should this respect initial cursor offset?\n      const hf = (height - ch) / h; // TODO: fix offset issues from float cell height\n      const f = Math.min(wf, hf);\n      return f < 1 ? [w * f, h * f] : [w, h];\n    }\n    return !rw\n      ? [w * rh / h, rh]\n      : this._header.preserveAspectRatio || !rw || !rh\n        ? [rw, h * rw / w] : [rw, rh];\n  }\n\n  private _dim(s: string, total: number, cdim: number): number {\n    if (s === 'auto') return 0;\n    if (s.endsWith('%')) return parseInt(s.slice(0, -1), 10) * total / 100;\n    if (s.endsWith('px')) return parseInt(s.slice(0, -2), 10);\n    return parseInt(s, 10) * cdim;\n  }\n}\n","/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\n// eslint-disable-next-line\ndeclare const Buffer: any;\n\nexport const enum HeaderState {\n  START = 0,\n  ABORT = 1,\n  KEY = 2,\n  VALUE = 3,\n  END = 4\n}\n\nexport const enum SequenceType {\n  INVALID = 0,\n  FILE = 1,\n  MULTIPARTFILE = 2,\n  FILEPART = 3,\n  FILEEND = 4,\n  REPORTCELLSIZE = 5\n}\n\nexport interface IHeaderFields {\n  [key: string]: number | string | Uint32Array | null | undefined;\n  // sequence type\n  type: SequenceType;\n  // base-64 encoded filename. Defaults to \"Unnamed file\".\n  name: string;\n  // File size in bytes. The file transfer will be canceled if this size is exceeded.\n  size: number;\n  /**\n   * Optional width and height to render:\n   * - N: N character cells.\n   * - Npx: N pixels.\n   * - N%: N percent of the session's width or height.\n   * - auto: The image's inherent size will be used to determine an appropriate dimension.\n   */\n  width?: string;\n  height?: string;\n  // Optional, defaults to 1 respecting aspect ratio (width takes precedence).\n  preserveAspectRatio?: number;\n  // Optional, defaults to 0. If set to 1, the file will be displayed inline, else downloaded\n  // (download not supported).\n  inline?: number;\n}\n\n// field value decoders\n\n// ASCII bytes to string\nfunction toStr(data: Uint32Array): string {\n  let s = '';\n  for (let i = 0; i < data.length; ++i) {\n    s += String.fromCharCode(data[i]);\n  }\n  return s;\n}\n\n// digits to integer\nfunction toInt(data: Uint32Array): number {\n  let v = 0;\n  for (let i = 0; i < data.length; ++i) {\n    if (data[i] < 48 || data[i] > 57) {\n      throw new Error('illegal char');\n    }\n    v = v * 10 + data[i] - 48;\n  }\n  return v;\n}\n\n// check for correct size entry\nfunction toSize(data: Uint32Array): string {\n  const v = toStr(data);\n  if (!v.match(/^((auto)|(\\d+?((px)|(%)){0,1}))$/)) {\n    throw new Error('illegal size');\n  }\n  return v;\n}\n\n// name is base64 encoded utf-8\nfunction toName(data: Uint32Array): string {\n  if (typeof Buffer !== 'undefined') {\n    return Buffer.from(toStr(data), 'base64').toString();\n  }\n  const bs = atob(toStr(data));\n  const b = new Uint8Array(bs.length);\n  for (let i = 0; i < b.length; ++i) {\n    b[i] = bs.charCodeAt(i);\n  }\n  return new TextDecoder().decode(b);\n}\n\nconst DECODERS: {[key: string]: (v: Uint32Array) => number | string} = {\n  inline: toInt,\n  size: toInt,\n  name: toName,\n  width: toSize,\n  height: toSize,\n  preserveAspectRatio: toInt\n};\n\n\n// sequence type markers\n// File\nconst FILE_MARKER = [70, 105, 108, 101];\n// MultipartFile\nconst MULTIPARTFILE_MARKER = [77, 117, 108, 116, 105, 112, 97, 114, 116, 70, 105, 108, 101];\n// FilePart\nconst FILEPART_MARKER = [70, 105, 108, 101, 80, 97, 114, 116];\n// FileEnd\nconst FILEEND_MARKER = [70, 105, 108, 101, 69, 110, 100];\n// ReportCellSize\nconst REPORTCELLSIZE_MARKER = [82, 101, 112, 111, 114, 116, 67, 101, 108, 108, 83, 105, 122, 101];\n\n// max allowed chars for sequence header\nconst MAX_FIELDCHARS = 1024;\n\n\nexport class HeaderParser {\n  public state: HeaderState = HeaderState.START;\n  private _buffer = new Uint32Array(MAX_FIELDCHARS);\n  private _position = 0;\n  private _key = '';\n  public fields: {[key: string]: number | string | Uint32Array | null | undefined} = {};\n\n  public reset(): void {\n    this._buffer.fill(0);\n    this.state = HeaderState.START;\n    this._position = 0;\n    this.fields = {};\n    this._key = '';\n  }\n\n  public end(): number {\n    if (this.state === HeaderState.START) {\n      if (this._position === FILEEND_MARKER.length) {\n        for (let k = 0; k < FILEEND_MARKER.length; ++k) {\n          if (this._buffer[k] !== FILEEND_MARKER[k]) return this._a();\n        }\n        this.fields['type'] = SequenceType.FILEEND;\n        this.state = HeaderState.END;\n        return 0;\n      }\n      if (this._position === REPORTCELLSIZE_MARKER.length) {\n        for (let k = 0; k < REPORTCELLSIZE_MARKER.length; ++k) {\n          if (this._buffer[k] !== REPORTCELLSIZE_MARKER[k]) return this._a();\n        }\n        this.fields['type'] = SequenceType.REPORTCELLSIZE;\n        this.state = HeaderState.END;\n        return 0;\n      }\n      return this._a();\n    }\n    if (this.state === HeaderState.END) return 0;\n    if (this.state === HeaderState.VALUE\n      && this.fields.type === SequenceType.MULTIPARTFILE\n    ) {\n      if (!this._storeValue(this._position)) return this._a();\n      this.state = HeaderState.END;\n      return 0;\n    }\n    return this._a();\n  }\n\n  public parse(data: Uint32Array, start: number, end: number): number {\n    let state = this.state;\n    let pos = this._position;\n    const buffer = this._buffer;\n    if (state === HeaderState.ABORT || state === HeaderState.END) return -1;\n    if (state === HeaderState.START && pos > 14) return -1;\n    for (let i = start; i < end; ++i) {\n      const c = data[i];\n      switch (c) {\n        case 59: // ;\n          if (!this._storeValue(pos)) return this._a();\n          state = HeaderState.KEY;\n          pos = 0;\n          break;\n        case 61: // =\n          if (state === HeaderState.START) {\n            if (buffer[0] === 70) {\n              // 'File' or 'FilePart'\n              let k = 0;\n              for (; k < FILE_MARKER.length; ++k) {\n                if (buffer[k] !== FILE_MARKER[k]) return this._a();\n              }\n              this.fields['type'] = SequenceType.FILE;\n              if (pos === FILEPART_MARKER.length) {\n                for (; k < FILEPART_MARKER.length; ++k) {\n                  if (buffer[k] !== FILEPART_MARKER[k]) return this._a();\n                }\n                this.fields['type'] = SequenceType.FILEPART;\n                this.state = HeaderState.END;\n                return i + 1;\n              }\n            } else if (buffer[0] === 77) {\n              // 'MultipartFile'\n              for (let k = 0; k < MULTIPARTFILE_MARKER.length; ++k) {\n                if (buffer[k] !== MULTIPARTFILE_MARKER[k]) return this._a();\n              }\n              this.fields['type'] = SequenceType.MULTIPARTFILE;\n            } else {\n              return this._a();\n            }\n            state = HeaderState.KEY;\n            pos = 0;\n          } else if (state === HeaderState.KEY) {\n            if (!this._storeKey(pos)) return this._a();\n            state = HeaderState.VALUE;\n            pos = 0;\n          } else if (state === HeaderState.VALUE) {\n            if (pos >= MAX_FIELDCHARS) return this._a();\n            buffer[pos++] = c;\n          }\n          break;\n        case 58: // :\n          if (state === HeaderState.VALUE) {\n            if (!this._storeValue(pos)) return this._a();\n          }\n          this.state = HeaderState.END;\n          return i + 1;\n        default:\n          if (pos >= MAX_FIELDCHARS) return this._a();\n          buffer[pos++] = c;\n      }\n    }\n    this.state = state;\n    this._position = pos;\n    return -2;\n  }\n\n  private _a(): number {\n    this.fields.type = SequenceType.INVALID;\n    this.state = HeaderState.ABORT;\n    return -1;\n  }\n\n  private _storeKey(pos: number): boolean {\n    const k = toStr(this._buffer.subarray(0, pos));\n    if (k) {\n      this._key = k;\n      this.fields[k] = null;\n      return true;\n    }\n    return false;\n  }\n\n  private _storeValue(pos: number): boolean {\n    if (this._key) {\n      try {\n        const v = this._buffer.slice(0, pos);\n        this.fields[this._key] = DECODERS[this._key] ? DECODERS[this._key](v) : v;\n      } catch {\n        return false;\n      }\n      return true;\n    }\n    return false;\n  }\n}\n","/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IAddImageOpts } from './Types';\nimport { ImageStorage } from './ImageStorage';\n\n/**\n * IIP (iTerm Image Protocol) specific image storage controller.\n *\n * Wraps the shared ImageStorage with IIP protocol semantics:\n * - Always uses scrolling mode (cursor advances with image)\n */\nexport class IIPImageStorage {\n  private _addImageOpts: IAddImageOpts = { scrolling: true, layer: 'top', zIndex: 0, cursorPos: 'iip' };\n  constructor(\n    private readonly _storage: ImageStorage\n  ) {}\n\n  /**\n   * Add an IIP image to storage.\n   * Always uses scrolling mode — cursor advances past the image.\n   */\n  public addImage(img: HTMLCanvasElement | ImageBitmap): void {\n    this._storage.addImage(img, this._addImageOpts);\n  }\n}\n","/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\n\nexport type ImageType = 'image/png' | 'image/jpeg' | 'image/gif' | 'image/qoi' | 'image/webp' | 'image/avif' | 'unsupported' | '';\n\nexport interface IMetrics {\n  mime: ImageType;\n  width: number;\n  height: number;\n}\n\nexport const UNSUPPORTED_TYPE: IMetrics = {\n  mime: 'unsupported',\n  width: 0,\n  height: 0\n};\n\nexport function imageType(d: Uint8Array): IMetrics {\n  if (d.length < 32) {\n    return UNSUPPORTED_TYPE;\n  }\n  const d32 = new Uint32Array(d.buffer, d.byteOffset, 8);\n  // PNG: 89 50 4E 47 0D 0A 1A 0A (8 first bytes == magic number for PNG)\n  // + first chunk must be IHDR\n  if (d32[0] === 0x474E5089 && d32[1] === 0x0A1A0A0D && d32[3] === 0x52444849) {\n    return {\n      mime: 'image/png',\n      width:  d[16] << 24 | d[17] << 16 | d[18] << 8 | d[19],\n      height: d[20] << 24 | d[21] << 16 | d[22] << 8 | d[23]\n    };\n  }\n  // JPEG: FF D8 FF\n  if (d[0] === 0xFF && d[1] === 0xD8 && d[2] === 0xFF) {\n    const [width, height] = jpgSize(d);\n    return { mime: 'image/jpeg', width, height };\n  }\n  // GIF: GIF87a or GIF89a\n  if (d32[0] === 0x38464947 && (d[4] === 0x37 || d[4] === 0x39) && d[5] === 0x61) {\n    return {\n      mime: 'image/gif',\n      width:  d[7] << 8 | d[6],\n      height: d[9] << 8 | d[8]\n    };\n  }\n  // QOI: qoif\n  if (d32[0] === 0x66696F71) {\n    return {\n      mime: 'image/qoi',\n      width:  d[4] << 24 | d[5] << 16 | d[6] << 8 | d[7],\n      height: d[8] << 24 | d[9] << 16 | d[10] << 8 | d[11]\n    };\n  }\n  // WEBP: RIFF | xxxx | WEBP | VP8x\n  if (d32[0] === 0x46464952 && d32[2] === 0x50424557 && (d32[3] & 0xFFFFFF) === 0x385056) {\n    switch (d[15]) {\n      case 0x58:  // Extended WebP VP8X --> \"X\"\n        return {\n          mime: 'image/webp',\n          width:  (d[24] | d[25] << 8 | d[26] << 16) + 1,\n          height: (d[27] | d[28] << 8 | d[29] << 16) + 1\n        };\n      case 0x4C:  // Lossless WebP VP8L --> \"L\"\n        if (d[20] !== 0x2f) return UNSUPPORTED_TYPE;\n        const dim = d[21] | d[22] << 8 | d[23] << 16 | d[24] << 24;\n        return {\n          mime: 'image/webp',\n          width:  (dim        & 0x3FFF) + 1,\n          height: (dim >>> 14 & 0x3FFF) + 1\n        };\n      case 0x20:  // Lossy WebP VP8  --> \" \"\n        if (d[23] !== 0x9d || d[24] !== 0x01 || d[25] !== 0x2a) return UNSUPPORTED_TYPE;\n        return {\n          mime: 'image/webp',\n          width:  (d[26] | d[27] << 8) & 0x3FFF,\n          height: (d[28] | d[29] << 8) & 0x3FFF\n        };\n    }\n    return UNSUPPORTED_TYPE;\n  }\n  // AVIF: Box size | ftyp | avif/avis\n  if (d32[1] === 0x70797466 && (d32[2] === 0x66697661 || d32[2] === 0x73697661)) {\n    let pos = -1;\n    // search for ispe box within first 1024 bytes\n    const limit = Math.min(d.length - 16, 1024);\n    for (let i = 8; i < limit; i++) {\n      // scan for ispe\n      if (d[i] === 0x69 && d[i + 1] === 0x73 && d[i + 2] === 0x70 && d[i + 3] === 0x65) {\n        pos = i;\n        break;\n      }\n    }\n    if (pos !== -1) {\n      // dimensions are in BE at +8 (width) at +12 (height)\n      const width =\n        d[pos +  8] << 24 |\n        d[pos +  9] << 16 |\n        d[pos + 10] <<  8 |\n        d[pos + 11];\n      const height =\n        d[pos + 12] << 24 |\n        d[pos + 13] << 16 |\n        d[pos + 14] <<  8 |\n        d[pos + 15];\n      if (width > 0 && height > 0) {\n        return { mime: 'image/avif', width, height };\n      }\n    }\n    return UNSUPPORTED_TYPE;\n  }\n  return UNSUPPORTED_TYPE;\n}\n\n\nfunction jpgSize(d: Uint8Array): [number, number] {\n  const len = d.length;\n  let i = 4;\n  let blockLength = d[i] << 8 | d[i + 1];\n  while (true) {\n    i += blockLength;\n    if (i >= len) {\n      // exhausted without size info\n      return [0, 0];\n    }\n    if (d[i] !== 0xFF) {\n      return [0, 0];\n    }\n    if (d[i + 1] === 0xC0 || d[i + 1] === 0xC2) {\n      if (i + 8 < len) {\n        return [\n          d[i + 7] << 8 | d[i + 8],\n          d[i + 5] << 8 | d[i + 6]\n        ];\n      }\n      return [0, 0];\n    }\n    i += 2;\n    blockLength = d[i] << 8 | d[i + 1];\n  }\n}\n","/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { toRGBA8888 } from 'sixel/lib/Colors';\nimport { IDisposable } from '@xterm/xterm';\nimport { ICellSize, ImageLayer, ITerminalExt, IImageSpec, IRenderDimensions, IRenderService } from './Types';\nimport { Disposable, MutableDisposable, toDisposable } from 'common/Lifecycle';\n\nconst enum Constants {\n  PLACEHOLDER_LENGTH = 4096,\n  PLACEHOLDER_HEIGHT = 24\n}\n\n/**\n * ImageRenderer - terminal frontend extension:\n * - provide primitives for canvas, ImageData, Bitmap (static)\n * - add canvas layer to DOM (browser only for now)\n * - draw image tiles onRender\n */\nexport class ImageRenderer extends Disposable implements IDisposable {\n  /** @deprecated Kept for backward compat — points to top layer canvas. */\n  public get canvas(): HTMLCanvasElement | undefined { return this._layers.get('top')?.canvas; }\n  private _layers = new Map<ImageLayer, CanvasRenderingContext2D>();\n  private _placeholder: HTMLCanvasElement | undefined;\n  private _placeholderBitmap: ImageBitmap | undefined;\n  private _optionsRefresh = this._register(new MutableDisposable());\n  private _oldOpen: ((parent: HTMLElement) => void) | undefined;\n  private _renderService: IRenderService | undefined;\n  private _oldSetRenderer: ((renderer: any) => void) | undefined;\n\n  // drawing primitive - canvas\n  public static createCanvas(localDocument: Document | undefined, width: number, height: number): HTMLCanvasElement {\n    /**\n     * NOTE: We normally dont care, from which document the canvas\n     * gets created, so we can fall back to global document,\n     * if the terminal has no document associated yet.\n     * This way early image loads before calling .open keep working\n     * (still discouraged though, as the metrics will be screwed up).\n     * Only the DOM output canvas should be on the terminal's document,\n     * which gets explicitly checked in `insertLayerToDom`.\n     */\n    const canvas = (localDocument ?? document).createElement('canvas');\n    canvas.width = width | 0;\n    canvas.height = height | 0;\n    return canvas;\n  }\n\n  // drawing primitive - ImageData with optional buffer\n  public static createImageData(ctx: CanvasRenderingContext2D, width: number, height: number, buffer?: ArrayBuffer): ImageData {\n    if (typeof ImageData !== 'function') {\n      const imgData = ctx.createImageData(width, height);\n      if (buffer) {\n        imgData.data.set(new Uint8ClampedArray(buffer, 0, width * height * 4));\n      }\n      return imgData;\n    }\n    return buffer\n      ? new ImageData(new Uint8ClampedArray(buffer, 0, width * height * 4), width, height)\n      : new ImageData(width, height);\n  }\n\n  // drawing primitive - ImageBitmap\n  public static createImageBitmap(img: ImageBitmapSource): Promise<ImageBitmap | undefined> {\n    if (typeof createImageBitmap !== 'function') {\n      return Promise.resolve(undefined);\n    }\n    return createImageBitmap(img);\n  }\n\n\n  constructor(private _terminal: ITerminalExt) {\n    super();\n    this._oldOpen = this._terminal._core.open;\n    this._terminal._core.open = (parent: HTMLElement): void => {\n      this._oldOpen?.call(this._terminal._core, parent);\n      this._open();\n    };\n    if (this._terminal._core.screenElement) {\n      this._open();\n    }\n    // hack to spot fontSize changes\n    this._optionsRefresh.value = this._terminal._core.optionsService.onOptionChange(option => {\n      if (option === 'fontSize') {\n        this.rescaleCanvas();\n        this._renderService?.refreshRows(0, this._terminal.rows);\n      }\n    });\n    this._register(toDisposable(() => {\n      this.removeLayerFromDom();\n      this.removeLayerFromDom('bottom');\n      if (this._terminal._core && this._oldOpen) {\n        this._terminal._core.open = this._oldOpen;\n        this._oldOpen = undefined;\n      }\n      if (this._renderService && this._oldSetRenderer) {\n        this._renderService.setRenderer = this._oldSetRenderer;\n        this._oldSetRenderer = undefined;\n      }\n      this._renderService = undefined;\n      this._layers.clear();\n      this._placeholderBitmap?.close();\n      this._placeholderBitmap = undefined;\n      this._placeholder = undefined;\n    }));\n  }\n\n  /**\n   * Enable the placeholder.\n   */\n  public showPlaceholder(value: boolean): void {\n    if (value) {\n      if (!this._placeholder && this.cellSize.height !== -1) {\n        this._createPlaceHolder(Math.max(this.cellSize.height + 1, Constants.PLACEHOLDER_HEIGHT));\n      }\n    } else {\n      this._placeholderBitmap?.close();\n      this._placeholderBitmap = undefined;\n      this._placeholder = undefined;\n    }\n    this._renderService?.refreshRows(0, this._terminal.rows);\n  }\n\n  /**\n   * Dimensions of the terminal.\n   * Forwarded from internal render service.\n   */\n  public get dimensions(): IRenderDimensions | undefined {\n    return this._terminal.dimensions;\n  }\n\n  /**\n   * Current cell size (float).\n   */\n  public get cellSize(): ICellSize {\n    return {\n      width: this.dimensions?.css.cell.width || -1,\n      height: this.dimensions?.css.cell.height || -1\n    };\n  }\n\n  /**\n   * Clear a region of the image layer canvas.\n   */\n  public clearLines(start: number, end: number, layer?: ImageLayer): void {\n    const y = start * (this.dimensions?.css.cell.height || 0);\n    const w = this.dimensions?.css.canvas.width || 0;\n    const h = (end + 1 - start) * (this.dimensions?.css.cell.height || 0);\n    if (!layer || layer === 'top') {\n      this._layers.get('top')?.clearRect(0, y, w, h);\n    }\n    if (!layer || layer === 'bottom') {\n      this._layers.get('bottom')?.clearRect(0, y, w, h);\n    }\n  }\n\n  /**\n   * Clear whole image canvas.\n   */\n  public clearAll(layer?: ImageLayer): void {\n    if (!layer || layer === 'top') {\n      const ctx = this._layers.get('top');\n      ctx?.clearRect(0, 0, ctx.canvas.width, ctx.canvas.height);\n    }\n    if (!layer || layer === 'bottom') {\n      const ctx = this._layers.get('bottom');\n      ctx?.clearRect(0, 0, ctx.canvas.width, ctx.canvas.height);\n    }\n  }\n\n  /**\n   * Draw neighboring tiles on the image layer canvas.\n   */\n  public draw(imgSpec: IImageSpec, tileId: number, col: number, row: number, count: number = 1): void {\n    const ctx = this._layers.get(imgSpec.layer);\n    if (!ctx) {\n      return;\n    }\n    const { width, height } = this.cellSize;\n\n    // Don't try to draw anything, if we cannot get valid renderer metrics.\n    if (width === -1 || height === -1) {\n      return;\n    }\n\n    this._rescaleImage(imgSpec, width, height);\n    const img = imgSpec.actual!;\n    const cols = Math.ceil(img.width / width);\n\n    const sx = (tileId % cols) * width;\n    const sy = Math.floor(tileId / cols) * height;\n    const dx = col * width;\n    const dy = row * height;\n\n    // safari bug: never access image source out of bounds\n    const finalWidth = count * width + sx > img.width ? img.width - sx : count * width;\n    const finalHeight = sy + height > img.height ? img.height - sy : height;\n\n    // Floor all pixel offsets to get stable tile mapping without any overflows.\n    // Note: For not pixel perfect aligned cells like in the DOM renderer\n    // this will move a tile slightly to the top/left (subpixel range, thus ignore it).\n    // FIX #34: avoid striping on displays with pixelDeviceRatio != 1 by ceiling height and width\n    ctx.drawImage(\n      img,\n      Math.floor(sx), Math.floor(sy), Math.ceil(finalWidth), Math.ceil(finalHeight),\n      Math.floor(dx), Math.floor(dy), Math.ceil(finalWidth), Math.ceil(finalHeight)\n    );\n  }\n\n  /**\n   * Extract a single tile from an image.\n   */\n  public extractTile(imgSpec: IImageSpec, tileId: number): HTMLCanvasElement | undefined {\n    const { width, height } = this.cellSize;\n    // Don't try to draw anything, if we cannot get valid renderer metrics.\n    if (width === -1 || height === -1) {\n      return;\n    }\n    this._rescaleImage(imgSpec, width, height);\n    const img = imgSpec.actual!;\n    const cols = Math.ceil(img.width / width);\n    const sx = (tileId % cols) * width;\n    const sy = Math.floor(tileId / cols) * height;\n    const finalWidth = width + sx > img.width ? img.width - sx : width;\n    const finalHeight = sy + height > img.height ? img.height - sy : height;\n\n    const canvas = ImageRenderer.createCanvas(this.document, finalWidth, finalHeight);\n    const ctx = canvas.getContext('2d');\n    if (ctx) {\n      ctx.drawImage(\n        img,\n        Math.floor(sx), Math.floor(sy), Math.floor(finalWidth), Math.floor(finalHeight),\n        0, 0, Math.floor(finalWidth), Math.floor(finalHeight)\n      );\n      return canvas;\n    }\n  }\n\n  /**\n   * Draw a line with placeholder on the image layer canvas.\n   */\n  public drawPlaceholder(col: number, row: number, count: number = 1): void {\n    const ctx = this._layers.get('top');\n    if (ctx) {\n      const { width, height } = this.cellSize;\n\n      // Don't try to draw anything, if we cannot get valid renderer metrics.\n      if (width === -1 || height === -1) {\n        return;\n      }\n\n      if (!this._placeholder) {\n        this._createPlaceHolder(Math.max(height + 1, Constants.PLACEHOLDER_HEIGHT));\n      } else if (height >= this._placeholder!.height) {\n        this._createPlaceHolder(height + 1);\n      }\n      if (!this._placeholder) return;\n      ctx.drawImage(\n        this._placeholderBitmap ?? this._placeholder!,\n        col * width,\n        (row * height) % 2 ? 0 : 1,  // needs %2 offset correction\n        width * count,\n        height,\n        col * width,\n        row * height,\n        width * count,\n        height\n      );\n    }\n  }\n\n  /**\n   * Rescale image layer canvas if needed.\n   * Checked once from `ImageStorage.render`.\n   */\n  public rescaleCanvas(): void {\n    const w = this.dimensions?.css.canvas.width || 0;\n    const h = this.dimensions?.css.canvas.height || 0;\n    for (const ctx of this._layers.values()) {\n      if (ctx.canvas.width !== w || ctx.canvas.height !== h) {\n        ctx.canvas.width = w;\n        ctx.canvas.height = h;\n      }\n    }\n  }\n\n  /**\n   * Rescale image in storage if needed.\n   */\n  private _rescaleImage(spec: IImageSpec, currentWidth: number, currentHeight: number): void {\n    if (currentWidth === spec.actualCellSize.width && currentHeight === spec.actualCellSize.height) {\n      return;\n    }\n    const { width: originalWidth, height: originalHeight } = spec.origCellSize;\n    if (currentWidth === originalWidth && currentHeight === originalHeight) {\n      spec.actual = spec.orig;\n      spec.actualCellSize.width = originalWidth;\n      spec.actualCellSize.height = originalHeight;\n      return;\n    }\n    const canvas = ImageRenderer.createCanvas(\n      this.document,\n      Math.ceil(spec.orig!.width * currentWidth / originalWidth),\n      Math.ceil(spec.orig!.height * currentHeight / originalHeight)\n    );\n    const ctx = canvas.getContext('2d');\n    if (ctx) {\n      ctx.drawImage(spec.orig!, 0, 0, canvas.width, canvas.height);\n      spec.actual = canvas;\n      spec.actualCellSize.width = currentWidth;\n      spec.actualCellSize.height = currentHeight;\n    }\n  }\n\n  /**\n   * Lazy init for the renderer.\n   */\n  private _open(): void {\n    this._renderService = this._terminal._core._renderService;\n    this._oldSetRenderer = this._renderService.setRenderer.bind(this._renderService);\n    this._renderService.setRenderer = (renderer: any) => {\n      for (const key of [...this._layers.keys()]) {\n        this.removeLayerFromDom(key);\n      }\n      this._oldSetRenderer?.call(this._renderService, renderer);\n    };\n  }\n\n  public insertLayerToDom(layer: ImageLayer = 'top'): void {\n    // make sure that the terminal is attached to a document and to DOM\n    if (!this.document || !this._terminal._core.screenElement) {\n      console.warn('image addon: cannot insert output canvas to DOM, missing document or screenElement');\n      return;\n    }\n    if (this._layers.has(layer)) {\n      return;\n    }\n    const canvas = ImageRenderer.createCanvas(\n      this.document, this.dimensions?.css.canvas.width || 0,\n      this.dimensions?.css.canvas.height || 0\n    );\n    canvas.classList.add(`xterm-image-layer-${layer}`);\n    const screenElement = this._terminal._core.screenElement;\n    // Use isolation to create a stacking context without overriding z-index,\n    // which would conflict with integrators (e.g. VS Code) that set their\n    // own z-index on the screen element.\n    screenElement.style.isolation = 'isolate';\n    if (layer === 'bottom') {\n      // Use z-index:-1 so it paints behind non-positioned text elements.\n      // The screen element needs to be a stacking context (via isolation)\n      // to contain the negative z-index, otherwise it would go behind the\n      // entire terminal.\n      canvas.style.zIndex = '-1';\n      screenElement.insertBefore(canvas, screenElement.firstChild);\n    } else {\n      // Explicit z-index ensures the image canvas reliably stacks above\n      // the text layer (DOM renderer rows). z-index: 0 is below the\n      // selection overlay (z-index: 1).\n      canvas.style.zIndex = '0';\n      screenElement.appendChild(canvas);\n    }\n    const ctx = canvas.getContext('2d', { alpha: true });\n    if (!ctx) {\n      canvas.remove();\n      return;\n    }\n    this._layers.set(layer, ctx);\n    this.clearAll(layer);\n  }\n\n  public removeLayerFromDom(layer: ImageLayer = 'top'): void {\n    const ctx = this._layers.get(layer);\n    if (ctx) {\n      ctx.canvas.remove();\n      this._layers.delete(layer);\n    }\n  }\n\n  public hasLayer(layer: ImageLayer): boolean {\n    return this._layers.has(layer);\n  }\n\n  private _createPlaceHolder(height: number = Constants.PLACEHOLDER_HEIGHT): void {\n    this._placeholderBitmap?.close();\n    this._placeholderBitmap = undefined;\n\n    // create blueprint to fill placeholder with\n    const bWidth = 32;  // must be 2^n\n    const blueprint = ImageRenderer.createCanvas(this.document, bWidth, height);\n    const ctx = blueprint.getContext('2d', { alpha: false });\n    if (!ctx) return;\n    const imgData = ImageRenderer.createImageData(ctx, bWidth, height);\n    const d32 = new Uint32Array(imgData.data.buffer);\n    const black = toRGBA8888(0, 0, 0);\n    const white = toRGBA8888(255, 255, 255);\n    d32.fill(black);\n    for (let y = 0; y < height; ++y) {\n      const shift = y % 2;\n      const offset = y * bWidth;\n      for (let x = 0; x < bWidth; x += 2) {\n        d32[offset + x + shift] = white;\n      }\n    }\n    ctx.putImageData(imgData, 0, 0);\n\n    // create placeholder line, width aligned to blueprint width\n    const width = (screen.width + bWidth - 1) & ~(bWidth - 1) || Constants.PLACEHOLDER_LENGTH;\n    this._placeholder = ImageRenderer.createCanvas(this.document, width, height);\n    const ctx2 = this._placeholder.getContext('2d', { alpha: false });\n    if (!ctx2) {\n      this._placeholder = undefined;\n      return;\n    }\n    for (let i = 0; i < width; i += bWidth) {\n      ctx2.drawImage(blueprint, i, 0);\n    }\n    ImageRenderer.createImageBitmap(this._placeholder).then(bitmap => this._placeholderBitmap = bitmap);\n  }\n\n  public get document(): Document | undefined {\n    return this._terminal._core._coreBrowserService?.window.document;\n  }\n}\n","/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IDisposable } from '@xterm/xterm';\nimport { ImageRenderer } from './ImageRenderer';\nimport {\n  ITerminalExt, IExtendedAttrsImage, IImageAddonOptions, IImageSpec,\n  IBufferLineExt, BgFlags, Cell, Content, ICellSize, ExtFlags, Attributes,\n  UnderlineStyle, IAddImageOpts\n} from './Types';\n\n\n// fallback default cell size\nexport const CELL_SIZE_DEFAULT: ICellSize = {\n  width: 7,\n  height: 14\n};\n\n/**\n * Extend extended attribute to also hold image tile information.\n *\n * Object definition is copied from base repo to fully mimick its behavior.\n * Image data is added as additional public properties `imageId` and `tileId`.\n */\nclass ExtendedAttrsImage implements IExtendedAttrsImage {\n  private _ext: number = 0;\n  public get ext(): number {\n    if (this._urlId) {\n      return (\n        (this._ext & ~ExtFlags.UNDERLINE_STYLE) |\n        (this.underlineStyle << 26)\n      );\n    }\n    return this._ext;\n  }\n  public set ext(value: number) { this._ext = value; }\n\n  public get underlineStyle(): UnderlineStyle {\n    // Always return the URL style if it has one\n    if (this._urlId) {\n      return UnderlineStyle.DASHED;\n    }\n    return (this._ext & ExtFlags.UNDERLINE_STYLE) >> 26;\n  }\n  public set underlineStyle(value: UnderlineStyle) {\n    this._ext &= ~ExtFlags.UNDERLINE_STYLE;\n    this._ext |= (value << 26) & ExtFlags.UNDERLINE_STYLE;\n  }\n\n  public get underlineColor(): number {\n    return this._ext & (Attributes.CM_MASK | Attributes.RGB_MASK);\n  }\n  public set underlineColor(value: number) {\n    this._ext &= ~(Attributes.CM_MASK | Attributes.RGB_MASK);\n    this._ext |= value & (Attributes.CM_MASK | Attributes.RGB_MASK);\n  }\n\n  public get underlineVariantOffset(): number {\n    const val = (this._ext & ExtFlags.VARIANT_OFFSET) >> 29;\n    if (val < 0) {\n      return val ^ 0xFFFFFFF8;\n    }\n    return val;\n  }\n  public set underlineVariantOffset(value: number) {\n    this._ext &= ~ExtFlags.VARIANT_OFFSET;\n    this._ext |= (value << 29) & ExtFlags.VARIANT_OFFSET;\n  }\n\n  private _urlId: number = 0;\n  public get urlId(): number {\n    return this._urlId;\n  }\n  public set urlId(value: number) {\n    this._urlId = value;\n  }\n\n  constructor(\n    ext: number = 0,\n    urlId: number = 0,\n    public imageId = -1,\n    public tileId = -1\n  ) {\n    this._ext = ext;\n    this._urlId = urlId;\n  }\n\n  public clone(): IExtendedAttrsImage {\n    /**\n     * Technically we dont need a clone variant of ExtendedAttrsImage,\n     * as we never clone a cell holding image data.\n     * Note: Clone is only meant to be used by the InputHandler for\n     * sticky attributes, which is never the case for image data.\n     * We still provide a proper clone method to reflect the full ext attr\n     * state in case there are future use cases for clone.\n     */\n    return new ExtendedAttrsImage(this._ext, this._urlId, this.imageId, this.tileId);\n  }\n\n  public isEmpty(): boolean {\n    return this.underlineStyle === UnderlineStyle.NONE && this._urlId === 0 && this.imageId === -1;\n  }\n}\nconst EMPTY_ATTRS = new ExtendedAttrsImage();\n\n\n/**\n * ImageStorage - extension of CoreTerminal:\n * - hold image data\n * - write/read image data to/from buffer\n *\n * TODO: image composition for overwrites\n */\nexport class ImageStorage implements IDisposable {\n  // storage\n  private _images: Map<number, IImageSpec> = new Map();\n  // last used id\n  private _lastId = 0;\n  // last evicted id\n  private _lowestId = 0;\n  // whether a full clear happened before\n  private _fullyCleared = false;\n  // whether render should do a full clear\n  private _needsFullClear = false;\n  // hard limit of stored pixels (fallback limit of 10 MB)\n  private _pixelLimit: number = 2500000;\n\n  private _viewportMetrics: { cols: number, rows: number };\n  public onImageAdded: (() => void) | undefined;\n  public onImageDeleted: ((storageId: number) => void) | undefined;\n\n  constructor(\n    private _terminal: ITerminalExt,\n    private _renderer: ImageRenderer,\n    private _opts: IImageAddonOptions\n  ) {\n    try {\n      this.setLimit(this._opts.storageLimit);\n    } catch (e: unknown) {\n      if (e instanceof Error) {\n        console.error(e.message);\n      }\n      console.warn(`storageLimit is set to ${this.getLimit()} MB`);\n    }\n    this._viewportMetrics = {\n      cols: this._terminal.cols,\n      rows: this._terminal.rows\n    };\n  }\n\n  public dispose(): void {\n    this.reset();\n  }\n\n  public reset(): void {\n    for (const spec of this._images.values()) {\n      spec.marker?.dispose();\n    }\n    // NOTE: marker.dispose above already calls ImageBitmap.close\n    // therefore we can just wipe the map here\n    this._images.clear();\n    this._renderer.clearAll();\n  }\n\n  public getLimit(): number {\n    return this._pixelLimit * 4 / 1000000;\n  }\n\n  public setLimit(value: number): void {\n    if (value < 0.5 || value > 1000) {\n      throw RangeError('invalid storageLimit, should be at least 0.5 MB and not exceed 1G');\n    }\n    this._pixelLimit = (value / 4 * 1000000) >>> 0;\n    this._evictOldest(0);\n  }\n\n  public getUsage(): number {\n    return this._getStoredPixels() * 4 / 1000000;\n  }\n\n  private _getStoredPixels(): number {\n    let storedPixels = 0;\n    for (const spec of this._images.values()) {\n      if (spec.orig) {\n        storedPixels += spec.orig.width * spec.orig.height;\n        if (spec.actual && spec.actual !== spec.orig) {\n          storedPixels += spec.actual.width * spec.actual.height;\n        }\n      }\n    }\n    return storedPixels;\n  }\n\n  private _delImg(id: number): void {\n    const spec = this._images.get(id);\n    if (!spec) return;\n    this._images.delete(id);\n    // FIXME: really ugly workaround to get bitmaps deallocated :(\n    if (window.ImageBitmap && spec.orig instanceof ImageBitmap) {\n      spec.orig.close();\n    }\n    this.onImageDeleted?.(id);\n  }\n\n  /**\n   * Wipe canvas and images on alternate buffer.\n   */\n  public wipeAlternate(): void {\n    // remove all alternate tagged images\n    const zero = [];\n    for (const [id, spec] of this._images.entries()) {\n      if (spec.bufferType === 'alternate') {\n        spec.marker?.dispose();\n        zero.push(id);\n      }\n    }\n    for (const id of zero) {\n      this._delImg(id);\n    }\n    // mark canvas to be wiped on next render\n    this._needsFullClear = true;\n    this._fullyCleared = false;\n  }\n\n  /**\n   * Delete an image by its internal storage ID.\n   * Used by protocols that support explicit deletion (e.g. Kitty a=d).\n   */\n  public deleteImage(id: number): void {\n    const spec = this._images.get(id);\n    if (spec) {\n      spec.marker?.dispose();\n      this._delImg(id);\n    }\n  }\n\n  /**\n   * Method to add an image to the storage.\n   * @param img - The image to add (canvas or bitmap).\n   * @param opts - Options for addImage:\n   *   - scrolling:  When true, cursor advances with the image.\n   *                 When false, image is placed at ORIGIN and cursor does not move.\n   *   - layer:      Which canvas layer to render on ('top' or 'bottom').\n   *   - zIndex:     Z-index for image layering within the same layer.\n   *   - cursorPos:  'vt340' for bottom-left, 'iip' for bottom.right.\n   * @returns The internal image ID assigned to the stored image.\n   */\n  public addImage(img: HTMLCanvasElement | ImageBitmap, opts: IAddImageOpts): number {\n    // never allow storage to exceed memory limit\n    this._evictOldest(img.width * img.height);\n\n    // calc rows x cols needed to display the image\n    let cellSize = this._renderer.cellSize;\n    if (cellSize.width === -1 || cellSize.height === -1) {\n      cellSize = CELL_SIZE_DEFAULT;\n    }\n    const cols = Math.ceil(img.width / cellSize.width);\n    const rows = Math.ceil(img.height / cellSize.height);\n\n    const imageId = ++this._lastId;\n\n    const buffer = this._terminal._core.buffer;\n    const termCols = this._terminal.cols;\n    const termRows = this._terminal.rows;\n    const originX = buffer.x;\n    const originY = buffer.y;\n    let offset = originX;\n    let tileCount = 0;\n\n    if (!opts.scrolling) {\n      buffer.x = 0;\n      buffer.y = 0;\n      offset = 0;\n    }\n\n    this._terminal._core._inputHandler._dirtyRowTracker.markDirty(buffer.y);\n    for (let row = 0; row < rows; ++row) {\n      const line = buffer.lines.get(buffer.y + buffer.ybase);\n      for (let col = 0; col < cols; ++col) {\n        if (offset + col >= termCols) break;\n        this._writeToCell(line as IBufferLineExt, offset + col, imageId, row * cols + col);\n        tileCount++;\n      }\n      if (opts.scrolling) {\n        if (row < rows - 1) this._terminal._core._inputHandler.lineFeed();\n      } else {\n        if (++buffer.y >= termRows) break;\n      }\n      buffer.x = offset;\n    }\n    this._terminal._core._inputHandler._dirtyRowTracker.markDirty(buffer.y);\n\n    // cursor positioning modes\n    if (opts.scrolling) {\n      if (opts.cursorPos === 'iip') {\n        buffer.x = Math.min(offset + cols, termCols);\n      } else {\n        buffer.x = offset;\n      }\n    } else {\n      buffer.x = originX;\n      buffer.y = originY;\n    }\n\n    // deleted images with zero tile count\n    const zero = [];\n    for (const [id, spec] of this._images.entries()) {\n      if (spec.tileCount < 1) {\n        spec.marker?.dispose();\n        zero.push(id);\n      }\n    }\n    for (const id of zero) {\n      this._delImg(id);\n    }\n\n    // eviction marker:\n    // delete the image when the marker gets disposed\n    const endMarker = this._terminal.registerMarker(0);\n    endMarker?.onDispose(() => {\n      const spec = this._images.get(imageId);\n      if (spec) {\n        this._delImg(imageId);\n      }\n    });\n\n    // since markers do not work on alternate for some reason,\n    // we evict images here manually\n    if (this._terminal.buffer.active.type === 'alternate') {\n      this._evictOnAlternate();\n    }\n\n    // create storage entry\n    const imgSpec: IImageSpec = {\n      orig: img,\n      origCellSize: cellSize,\n      actual: img,\n      actualCellSize: { ...cellSize },  // clone needed, since later modified\n      marker: endMarker || undefined,\n      tileCount,\n      bufferType: this._terminal.buffer.active.type,\n      layer: opts.layer,\n      zIndex: opts.zIndex\n    };\n\n    // finally add the image\n    this._images.set(imageId, imgSpec);\n    this.onImageAdded?.();\n    return imageId;\n  }\n\n\n  /**\n   * Render method. Collects buffer information and triggers\n   * canvas updates.\n   */\n  // TODO: Should we move this to the ImageRenderer?\n  public render(range: { start: number, end: number }): void {\n    // Determine which layers have images\n    let hasTopImages = false;\n    let hasBottomImages = false;\n    for (const spec of this._images.values()) {\n      if (spec.layer === 'bottom') {\n        hasBottomImages = true;\n      } else {\n        hasTopImages = true;\n      }\n      if (hasTopImages && hasBottomImages) break;\n    }\n\n    // Lazily insert layers that are needed\n    if (hasTopImages && !this._renderer.hasLayer('top')) {\n      this._renderer.insertLayerToDom('top');\n      if (!this._renderer.hasLayer('top')) return;\n    }\n    if (hasBottomImages && !this._renderer.hasLayer('bottom')) {\n      this._renderer.insertLayerToDom('bottom');\n    }\n\n    // rescale if needed\n    this._renderer.rescaleCanvas();\n\n    // exit early if we dont have any images to test for\n    if (!this._images.size) {\n      if (!this._fullyCleared) {\n        this._renderer.clearAll();\n        this._fullyCleared = true;\n        this._needsFullClear = false;\n      }\n      if (this._renderer.hasLayer('top')) {\n        this._renderer.removeLayerFromDom('top');\n      }\n      if (this._renderer.hasLayer('bottom')) {\n        this._renderer.removeLayerFromDom('bottom');\n      }\n      return;\n    }\n\n    // Remove layers no longer needed\n    if (!hasTopImages && this._renderer.hasLayer('top')) {\n      this._renderer.clearAll('top');\n      this._renderer.removeLayerFromDom('top');\n    }\n    if (!hasBottomImages && this._renderer.hasLayer('bottom')) {\n      this._renderer.clearAll('bottom');\n      this._renderer.removeLayerFromDom('bottom');\n    }\n\n    // buffer switches force a full clear\n    if (this._needsFullClear) {\n      this._renderer.clearAll();\n      this._fullyCleared = true;\n      this._needsFullClear = false;\n    }\n\n    const { start, end } = range;\n    const buffer = this._terminal._core.buffer;\n    const cols = this._terminal._core.cols;\n\n    // clear drawing area\n    this._renderer.clearLines(start, end);\n\n    // Collect draw calls so we can sort by z-index (lower z drawn first).\n    const drawCalls: { imgSpec: IImageSpec, tileId: number, col: number, row: number, count: number }[] = [];\n    const placeholderCalls: { col: number, row: number, count: number }[] = [];\n\n    // walk all cells in viewport and collect tiles found\n    for (let row = start; row <= end; ++row) {\n      const line = buffer.lines.get(row + buffer.ydisp) as IBufferLineExt;\n      if (!line) return;\n      for (let col = 0; col < cols; ++col) {\n        if (line.getBg(col) & BgFlags.HAS_EXTENDED) {\n          let e: IExtendedAttrsImage = line._extendedAttrs[col] ?? EMPTY_ATTRS;\n          const imageId = e.imageId;\n          if (imageId === undefined || imageId === -1) {\n            continue;\n          }\n          const imgSpec = this._images.get(imageId);\n          if (e.tileId !== -1) {\n            const startTile = e.tileId;\n            const startCol = col;\n            let count = 1;\n            /**\n             * merge tiles to the right into a single draw call, if:\n             * - not at end of line\n             * - cell has same image id\n             * - cell has consecutive tile id\n             */\n            while (\n              ++col < cols\n              && (line.getBg(col) & BgFlags.HAS_EXTENDED)\n              && (e = line._extendedAttrs[col] ?? EMPTY_ATTRS)\n              && (e.imageId === imageId)\n              && (e.tileId === startTile + count)\n            ) {\n              count++;\n            }\n            col--;\n            if (imgSpec) {\n              if (imgSpec.actual) {\n                drawCalls.push({ imgSpec, tileId: startTile, col: startCol, row, count });\n              }\n            } else if (this._opts.showPlaceholder) {\n              placeholderCalls.push({ col: startCol, row, count });\n            }\n            this._fullyCleared = false;\n          }\n        }\n      }\n    }\n\n    // Sort by z-index so lower z draws first (higher z renders on top)\n    drawCalls.sort((a, b) => a.imgSpec.zIndex - b.imgSpec.zIndex);\n\n    // Draw placeholders first (lowest priority)\n    for (const call of placeholderCalls) {\n      this._renderer.drawPlaceholder(call.col, call.row, call.count);\n    }\n\n    // Draw images in z-index order\n    for (const call of drawCalls) {\n      this._renderer.draw(call.imgSpec, call.tileId, call.col, call.row, call.count);\n    }\n  }\n\n  public viewportResize(metrics: { cols: number, rows: number }): void {\n    // exit early if we have nothing in storage\n    if (!this._images.size) {\n      this._viewportMetrics = metrics;\n      return;\n    }\n\n    // handle only viewport width enlargements, exit all other cases\n    // TODO: needs patch for tile counter\n    if (this._viewportMetrics.cols >= metrics.cols) {\n      this._viewportMetrics = metrics;\n      return;\n    }\n\n    // walk scrollbuffer at old col width to find all possible expansion matches\n    const buffer = this._terminal._core.buffer;\n    const rows = buffer.lines.length;\n    const oldCol = this._viewportMetrics.cols - 1;\n    for (let row = 0; row < rows; ++row) {\n      const line = buffer.lines.get(row) as IBufferLineExt;\n      if (line.getBg(oldCol) & BgFlags.HAS_EXTENDED) {\n        const e: IExtendedAttrsImage = line._extendedAttrs[oldCol] ?? EMPTY_ATTRS;\n        const imageId = e.imageId;\n        if (imageId === undefined || imageId === -1) {\n          continue;\n        }\n        const imgSpec = this._images.get(imageId);\n        if (!imgSpec) {\n          continue;\n        }\n        // found an image tile at oldCol, check if it qualifies for right exapansion\n        const tilesPerRow = Math.ceil((imgSpec.actual?.width || 0) / imgSpec.actualCellSize.width);\n        if ((e.tileId % tilesPerRow) + 1 >= tilesPerRow) {\n          continue;\n        }\n        // expand only if right side is empty (nothing got wrapped from below)\n        let hasData = false;\n        for (let rightCol = oldCol + 1; rightCol > metrics.cols; ++rightCol) {\n          if (line._data[rightCol * Cell.SIZE + Cell.CONTENT] & Content.HAS_CONTENT_MASK) {\n            hasData = true;\n            break;\n          }\n        }\n        if (hasData) {\n          continue;\n        }\n        // do right expansion on terminal buffer\n        const end = Math.min(metrics.cols, tilesPerRow - (e.tileId % tilesPerRow) + oldCol);\n        let lastTile = e.tileId;\n        for (let expandCol = oldCol + 1; expandCol < end; ++expandCol) {\n          this._writeToCell(line as IBufferLineExt, expandCol, imageId, ++lastTile);\n          imgSpec.tileCount++;\n        }\n      }\n    }\n    // store new viewport metrics\n    this._viewportMetrics = metrics;\n  }\n\n  /**\n   * Retrieve original canvas at buffer position.\n   */\n  public getImageAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    const buffer = this._terminal._core.buffer;\n    const line = buffer.lines.get(y) as IBufferLineExt;\n    if (line && line.getBg(x) & BgFlags.HAS_EXTENDED) {\n      const e: IExtendedAttrsImage = line._extendedAttrs[x] ?? EMPTY_ATTRS;\n      if (e.imageId && e.imageId !== -1) {\n        const orig = this._images.get(e.imageId)?.orig;\n        if (window.ImageBitmap && orig instanceof ImageBitmap) {\n          const canvas = ImageRenderer.createCanvas(window.document, orig.width, orig.height);\n          canvas.getContext('2d')?.drawImage(orig, 0, 0, orig.width, orig.height);\n          return canvas;\n        }\n        return orig as HTMLCanvasElement;\n      }\n    }\n  }\n\n  /**\n   * Extract active single tile at buffer position.\n   */\n  public extractTileAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    const buffer = this._terminal._core.buffer;\n    const line = buffer.lines.get(y) as IBufferLineExt;\n    if (line && line.getBg(x) & BgFlags.HAS_EXTENDED) {\n      const e: IExtendedAttrsImage = line._extendedAttrs[x] ?? EMPTY_ATTRS;\n      if (e.imageId && e.imageId !== -1 && e.tileId !== -1) {\n        const spec = this._images.get(e.imageId);\n        if (spec) {\n          return this._renderer.extractTile(spec, e.tileId);\n        }\n      }\n    }\n  }\n\n  // TODO: Do we need some blob offloading tricks here to avoid early eviction?\n  // also see https://stackoverflow.com/questions/28307789/is-there-any-limitation-on-javascript-max-blob-size\n  private _evictOldest(room: number): number {\n    const used = this._getStoredPixels();\n    let current = used;\n    while (this._pixelLimit < current + room && this._images.size) {\n      const spec = this._images.get(++this._lowestId);\n      if (spec && spec.orig) {\n        current -= spec.orig.width * spec.orig.height;\n        if (spec.actual && spec.orig !== spec.actual) {\n          current -= spec.actual.width * spec.actual.height;\n        }\n        spec.marker?.dispose();\n        this._delImg(this._lowestId);\n      }\n    }\n    return used - current;\n  }\n\n  private _writeToCell(line: IBufferLineExt, x: number, imageId: number, tileId: number): void {\n    if (line._data[x * Cell.SIZE + Cell.BG] & BgFlags.HAS_EXTENDED) {\n      const old = line._extendedAttrs[x];\n      if (old) {\n        if (old.imageId !== undefined) {\n          // found an old ExtendedAttrsImage, since we know that\n          // they are always isolated instances (single cell usage),\n          // we can re-use it and just update their id entries\n          const oldSpec = this._images.get(old.imageId);\n          if (oldSpec) {\n            // early eviction for in-viewport overwrites\n            oldSpec.tileCount--;\n          }\n          old.imageId = imageId;\n          old.tileId = tileId;\n          return;\n        }\n        // found a plain ExtendedAttrs instance, clone it to new entry\n        line._extendedAttrs[x] = new ExtendedAttrsImage(old.ext, old.urlId, imageId, tileId);\n        return;\n      }\n    }\n    // fall-through: always create new ExtendedAttrsImage entry\n    line._data[x * Cell.SIZE + Cell.BG] |= BgFlags.HAS_EXTENDED;\n    line._extendedAttrs[x] = new ExtendedAttrsImage(0, 0, imageId, tileId);\n  }\n\n  private _evictOnAlternate(): void {\n    // nullify tile count of all images on alternate buffer\n    for (const spec of this._images.values()) {\n      if (spec.bufferType === 'alternate') {\n        spec.tileCount = 0;\n      }\n    }\n    // re-count tiles on whole buffer\n    const buffer = this._terminal._core.buffer;\n    for (let y = 0; y < this._terminal.rows; ++y) {\n      const line = buffer.lines.get(y) as IBufferLineExt;\n      if (!line) {\n        continue;\n      }\n      for (let x = 0; x < this._terminal.cols; ++x) {\n        if (line._data[x * Cell.SIZE + Cell.BG] & BgFlags.HAS_EXTENDED) {\n          const imgId = line._extendedAttrs[x]?.imageId;\n          if (imgId) {\n            const spec = this._images.get(imgId);\n            if (spec) {\n              spec.tileCount++;\n            }\n          }\n        }\n      }\n    }\n    // deleted images with zero tile count\n    const zero = [];\n    for (const [id, spec] of this._images.entries()) {\n      if (spec.bufferType === 'alternate' && !spec.tileCount) {\n        spec.marker?.dispose();\n        zero.push(id);\n      }\n    }\n    for (const id of zero) {\n      this._delImg(id);\n    }\n  }\n}\n","/**\n * Copyright (c) 2020, 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { SixelImageStorage } from './SixelImageStorage';\nimport { IDcsHandler, IParams, IImageAddonOptions, ITerminalExt, AttributeData, IResetHandler, ReadonlyColorSet } from './Types';\nimport { toRGBA8888, BIG_ENDIAN, PALETTE_ANSI_256, PALETTE_VT340_COLOR } from 'sixel/lib/Colors';\nimport { RGBA8888 } from 'sixel/lib/Types';\nimport { ImageRenderer } from './ImageRenderer';\n\nimport { DecoderAsync, Decoder } from 'sixel/lib/Decoder';\n\n// always free decoder ressources after decoding if it exceeds this limit\nconst MEM_PERMA_LIMIT = 4194304; // 1024 pixels * 1024 pixels * 4 channels = 4MB\n\n// custom default palette: VT340 (lower 16 colors) + ANSI256 (up to 256) + zeroed (up to 4096)\nconst DEFAULT_PALETTE = PALETTE_ANSI_256;\nDEFAULT_PALETTE.set(PALETTE_VT340_COLOR);\n\n\nexport class SixelHandler implements IDcsHandler, IResetHandler {\n  private _size = 0;\n  private _aborted = false;\n  private _dec: Decoder | undefined;\n\n  constructor(\n    private readonly _opts: IImageAddonOptions,\n    private readonly _storage: SixelImageStorage,\n    private readonly _coreTerminal: ITerminalExt\n  ) {\n    DecoderAsync({\n      memoryLimit: this._opts.pixelLimit * 4,\n      palette: DEFAULT_PALETTE,\n      paletteLimit: this._opts.sixelPaletteLimit\n    }).then(d => this._dec = d);\n  }\n\n  public reset(): void {\n    /**\n     * reset sixel decoder to defaults:\n     * - release all memory\n     * - nullify palette (4096)\n     * - apply default palette (256)\n     */\n    if (this._dec) {\n      this._dec.release();\n      // FIXME: missing interface on decoder to nullify full palette\n      (this._dec as any)._palette.fill(0);\n      this._dec.init(0, DEFAULT_PALETTE, this._opts.sixelPaletteLimit);\n    }\n  }\n\n  public hook(params: IParams): void {\n    this._size = 0;\n    this._aborted = false;\n    if (this._dec) {\n      const fillColor = params.params[1] === 1 ? 0 : extractActiveBg(\n        this._coreTerminal._core._inputHandler._curAttrData,\n        this._coreTerminal._core._themeService?.colors);\n      this._dec.init(fillColor, null, this._opts.sixelPaletteLimit);\n    }\n  }\n\n  public put(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted || !this._dec) {\n      return;\n    }\n    this._size += end - start;\n    if (this._size > this._opts.sixelSizeLimit) {\n      console.warn(`SIXEL: too much data, aborting`);\n      this._aborted = true;\n      this._dec.release();\n      return;\n    }\n    try {\n      this._dec.decode(data, start, end);\n    } catch (e) {\n      console.warn(`SIXEL: error while decoding image - ${e}`);\n      this._aborted = true;\n      this._dec.release();\n    }\n  }\n\n  public unhook(success: boolean): boolean | Promise<boolean> {\n    if (this._aborted || !success || !this._dec) {\n      return true;\n    }\n\n    const width = this._dec.width;\n    const height = this._dec.height;\n\n    // partial fix for https://github.com/jerch/xterm-addon-image/issues/37\n    if (!width || !height) {\n      if (height) {\n        this._storage.advanceCursor(height);\n      }\n      return true;\n    }\n\n    const canvas = ImageRenderer.createCanvas(undefined, width, height);\n    canvas.getContext('2d')?.putImageData(new ImageData(this._dec.data8 as Uint8ClampedArray<ArrayBuffer>, width, height), 0, 0);\n    if (this._dec.memoryUsage > MEM_PERMA_LIMIT) {\n      this._dec.release();\n    }\n    this._storage.addImage(canvas);\n    return true;\n  }\n}\n\n\n/**\n * Some helpers to extract current terminal colors.\n */\n\n// get currently active background color from terminal\n// also respect INVERSE setting\nfunction extractActiveBg(attr: AttributeData, colors: ReadonlyColorSet | undefined): RGBA8888 {\n  let bg = 0;\n  if (!colors) {\n    // FIXME: theme service is prolly not available yet,\n    // happens if .open() was not called yet (bug in core?)\n    return bg;\n  }\n  if (attr.isInverse()) {\n    if (attr.isFgDefault()) {\n      bg = convertLe(colors.foreground.rgba);\n    } else if (attr.isFgRGB()) {\n      const t = (attr.constructor as typeof AttributeData).toColorRGB(attr.getFgColor());\n      bg = toRGBA8888(...t);\n    } else {\n      bg = convertLe(colors.ansi[attr.getFgColor()].rgba);\n    }\n  } else {\n    if (attr.isBgDefault()) {\n      bg = convertLe(colors.background.rgba);\n    } else if (attr.isBgRGB()) {\n      const t = (attr.constructor as typeof AttributeData).toColorRGB(attr.getBgColor());\n      bg = toRGBA8888(...t);\n    } else {\n      bg = convertLe(colors.ansi[attr.getBgColor()].rgba);\n    }\n  }\n  return bg;\n}\n\n// rgba values on the color managers are always in BE, thus convert to LE\nfunction convertLe(color: number): RGBA8888 {\n  if (BIG_ENDIAN) return color;\n  return (color & 0xFF) << 24 | (color >>> 8 & 0xFF) << 16 | (color >>> 16 & 0xFF) << 8 | color >>> 24 & 0xFF;\n}\n","/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { ImageStorage, CELL_SIZE_DEFAULT } from './ImageStorage';\nimport { IImageAddonOptions, ITerminalExt, IAddImageOpts } from './Types';\nimport { ImageRenderer } from './ImageRenderer';\n\n/**\n * Sixel-specific image storage controller.\n *\n * Wraps the shared ImageStorage with sixel protocol semantics:\n * - Cursor behavior governed by DECSET 80 (sixelScrolling option)\n * - advanceCursor for empty sixels carrying only height\n */\nexport class SixelImageStorage {\n  private _addImageOpts: IAddImageOpts = { scrolling: true, layer: 'top', zIndex: 0, cursorPos: 'vt340' };\n  constructor(\n    private readonly _storage: ImageStorage,\n    private readonly _opts: IImageAddonOptions,\n    private readonly _renderer: ImageRenderer,\n    private readonly _terminal: ITerminalExt\n  ) {}\n\n  /**\n   * Add a sixel image to storage.\n   * Cursor behavior depends on the sixelScrolling option (DECSET 80).\n   */\n  public addImage(img: HTMLCanvasElement | ImageBitmap): void {\n    this._addImageOpts.scrolling = this._opts.sixelScrolling;\n    this._storage.addImage(img, this._addImageOpts);\n  }\n\n  /**\n   * Only advance text cursor.\n   * This is an edge case from empty sixels carrying only a height but no pixels.\n   * Partially fixes https://github.com/jerch/xterm-addon-image/issues/37.\n   */\n  public advanceCursor(height: number): void {\n    if (this._opts.sixelScrolling) {\n      let cellSize = this._renderer.cellSize;\n      if (cellSize.width === -1 || cellSize.height === -1) {\n        cellSize = CELL_SIZE_DEFAULT;\n      }\n      const rows = Math.ceil(height / cellSize.height);\n      for (let i = 1; i < rows; ++i) {\n        this._terminal._core._inputHandler.lineFeed();\n      }\n    }\n  }\n}\n","/**\n * Copyright (c) 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IDisposable } from '@xterm/xterm';\nimport { IApcHandler, IImageAddonOptions, IResetHandler, ITerminalExt, ImageLayer } from '../Types';\nimport { ImageRenderer } from '../ImageRenderer';\nimport { CELL_SIZE_DEFAULT } from '../ImageStorage';\nimport { KittyImageStorage } from './KittyImageStorage';\nimport Base64Decoder, { type DecodeStatus } from 'xterm-wasm-parts/lib/base64/Base64Decoder.wasm';\nimport {\n  KittyAction,\n  KittyFormat,\n  KittyCompression,\n  IKittyCommand,\n  IPendingTransmission,\n  IKittyImageData,\n  KittyPixelConstants,\n  parseKittyCommand\n} from './KittyGraphicsTypes';\n\nconst enum Constants {\n  // Memory limit for base64 decoder (4MB, same as IIPHandler)\n  DECODER_KEEP_DATA = 4194304,\n  DECODER_INITIAL_DATA = 4194304, // 4MB\n  // Local mirror of const enum (esbuild can't inline const enums from external packages)\n  DECODER_OK = 0,\n  // Maximum control data size\n  MAX_CONTROL_DATA_SIZE = 512,\n  // Semicolon codepoint\n  SEMICOLON = 0x3B\n}\n\nconst DECODER_OK = Constants.DECODER_OK as unknown as DecodeStatus.OK;\n\n// Kitty graphics protocol handler with streaming base64 decoding.\nexport class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDisposable {\n  private _aborted = false;\n  private _decodeError = false;\n\n  private _activeDecoder: Base64Decoder | null = null;\n  private readonly _maxEncodedBytes: number;\n  private readonly _initialEncodedBytes: number;\n\n  // Streaming related states\n\n  // True while receiving control data (before semicolon).\n  private _inControlData = true;\n\n  // Buffer for control data.\n  private _controlData = new Uint32Array(Constants.MAX_CONTROL_DATA_SIZE);\n  private _controlLength = 0;\n\n  // Pre-calculated encoded size limit\n  private _encodedSizeLimit = 0;\n  private _totalEncodedSize = 0;\n\n  // Parsed command. These are the control data before semicolon.\n  private _parsedCommand: IKittyCommand | null = null;\n\n  // Storage related states\n\n  private _pendingTransmissions: Map<number, IPendingTransmission> = new Map();\n  // Tracks the pending key of the most recently started chunked upload.\n  // Per spec, subsequent chunks only need m= (and optionally q=), without i=.\n  // When a chunk arrives with no i=, this key is used to find the pending upload.\n  private _lastPendingKey: number | undefined;\n\n  constructor(\n    private readonly _opts: IImageAddonOptions,\n    private readonly _renderer: ImageRenderer,\n    private readonly _kittyStorage: KittyImageStorage,\n    private readonly _coreTerminal: ITerminalExt\n  ) {\n    // Convert decoded size limit -> max encoded bytes.\n    this._maxEncodedBytes = Math.ceil(this._opts.kittySizeLimit * 4 / 3);\n    // ensure we preallocate more than configured limit while using 4mb initial size.\n    this._initialEncodedBytes = Math.min(Constants.DECODER_INITIAL_DATA, this._maxEncodedBytes);\n  }\n\n  public reset(): void {\n    this._cleanupAllPending();\n    if (this._activeDecoder) {\n      this._activeDecoder.release();\n      this._activeDecoder = null;\n    }\n    this._kittyStorage.reset();\n  }\n\n  public dispose(): void {\n    this.reset();\n  }\n\n  private _removePendingEntry(key: number): void {\n    this._pendingTransmissions.delete(key);\n    if (this._lastPendingKey === key) {\n      this._lastPendingKey = undefined;\n    }\n  }\n\n  private _cleanupAllPending(): void {\n    for (const pending of this._pendingTransmissions.values()) {\n      pending.decoder.release();\n    }\n    this._pendingTransmissions.clear();\n    this._lastPendingKey = undefined;\n  }\n\n  public start(): void {\n    this._aborted = false;\n    this._decodeError = false;\n    this._inControlData = true;\n    this._controlLength = 0;\n    this._parsedCommand = null;\n    // Pre-calculate encoded limit once: base64 is 4 bytes encoded → 3 bytes decoded\n    this._encodedSizeLimit = this._maxEncodedBytes;\n    this._totalEncodedSize = 0;\n    this._activeDecoder = null;\n  }\n\n  public put(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted) return;\n\n    if (!this._inControlData) {\n      this._streamPayload(data, start, end);\n    } else {\n      // Scan for semicolon\n      let controlEnd = end;\n      for (let i = start; i < end; i++) {\n        if (data[i] === Constants.SEMICOLON) {\n          this._inControlData = false;\n          controlEnd = i;\n          break;\n        }\n      }\n\n      // Copy control data\n      const copyLength = controlEnd - start;\n      if (this._controlLength + copyLength > Constants.MAX_CONTROL_DATA_SIZE) {\n        this._aborted = true;\n        return;\n      }\n      this._controlData.set(data.subarray(start, controlEnd), this._controlLength);\n      this._controlLength += copyLength;\n\n      if (!this._inControlData) {\n        // Found semicolon - parse control data early for validation\n        this._parsedCommand = parseKittyCommand(this._parseControlDataString());\n\n        // Early validation: i+I conflict\n        if (this._parsedCommand.id !== undefined && this._parsedCommand.imageNumber !== undefined) {\n          this._sendResponse(this._parsedCommand.id, 'EINVAL:cannot specify both i and I keys', this._parsedCommand.quiet ?? 0);\n          this._aborted = true;\n          return;\n        }\n\n        // Delete action doesn't need payload - skip streaming\n        if (this._parsedCommand.action === KittyAction.DELETE) {\n          return;\n        }\n\n        // Stream remaining as payload\n        const payloadStart = controlEnd + 1;\n        if (payloadStart < end) {\n          this._streamPayload(data, payloadStart, end);\n        }\n      }\n    }\n  }\n\n  // Stream payload bytes into the base64 decoder.\n  private _streamPayload(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted) return;\n\n    // Check size limit (compare encoded bytes against pre-calculated limit)\n    // Include cumulative size from pending transmission for multi-chunk images.\n    // Per spec, subsequent chunks may omit i=, so fall back to _lastPendingKey.\n    const pendingKey = this._parsedCommand?.id ?? this._lastPendingKey ?? 0;\n    const pending = this._pendingTransmissions.get(pendingKey);\n    const previousEncodedSize = pending?.totalEncodedSize ?? 0;\n    this._totalEncodedSize += end - start;\n    const cumulativeEncodedSize = previousEncodedSize + this._totalEncodedSize;\n    if (cumulativeEncodedSize > this._encodedSizeLimit) {\n      const decoderToRelease = this._activeDecoder ?? pending?.decoder;\n      if (decoderToRelease) {\n        decoderToRelease.release();\n      }\n      this._activeDecoder = null;\n      if (pending) {\n        this._removePendingEntry(pendingKey);\n      }\n      this._aborted = true;\n      return;\n    }\n\n    if (this._decodeError) return;\n\n    if (pending?.decoder && !this._activeDecoder) {\n      this._activeDecoder = pending.decoder;\n    }\n    if (!this._activeDecoder) {\n      this._activeDecoder = new Base64Decoder(Constants.DECODER_KEEP_DATA, this._maxEncodedBytes, this._initialEncodedBytes);\n      this._activeDecoder.init();\n    }\n\n    if (this._activeDecoder.put(data.subarray(start, end)) !== DECODER_OK) {\n      this._activeDecoder.release();\n      this._activeDecoder = null;\n      this._decodeError = true;\n      if (pending) {\n        this._removePendingEntry(pendingKey);\n      }\n    }\n  }\n\n  public end(success: boolean): boolean | Promise<boolean> {\n    if (this._aborted || !success) {\n      if (this._activeDecoder) {\n        this._activeDecoder.release();\n        this._activeDecoder = null;\n      }\n      return true;\n    }\n\n    // No semicolon = no payload (delete, capability query)\n    if (this._inControlData) {\n      return this._handleNoPayloadCommand();\n    }\n\n    // Use command parsed early in put() - i+I already validated there\n    const cmd = this._parsedCommand!;\n\n    // Delete action was handled by skipping payload - just execute\n    if (cmd.action === KittyAction.DELETE) {\n      return this._handleDelete(cmd);\n    }\n\n    // Per spec, subsequent chunks may omit i=, so fall back to _lastPendingKey.\n    const pendingKey = cmd.id ?? this._lastPendingKey ?? 0;\n    const isMoreComing = cmd.more === 1;\n    const pending = this._pendingTransmissions.get(pendingKey);\n\n    if (isMoreComing) {\n      if (this._activeDecoder) {\n        if (pending) {\n          pending.totalEncodedSize += this._totalEncodedSize;\n          pending.decodeError = pending.decodeError || this._decodeError;\n        } else {\n          this._pendingTransmissions.set(pendingKey, {\n            cmd: { ...cmd },\n            decoder: this._activeDecoder,\n            totalEncodedSize: this._totalEncodedSize,\n            decodeError: this._decodeError\n          });\n        }\n        this._lastPendingKey = pendingKey;\n        this._activeDecoder = null;\n      }\n      return true;\n    }\n\n    // Final chunk received — clear the last pending key\n    if (pending) {\n      this._lastPendingKey = undefined;\n    }\n\n    let decodeError = this._decodeError;\n    let finalCmd = cmd;\n    let decoder = this._activeDecoder;\n\n    if (pending) {\n      finalCmd = pending.cmd;\n      decoder = pending.decoder;\n      decodeError = decodeError || pending.decodeError;\n      this._pendingTransmissions.delete(pendingKey);\n    }\n\n    let imageBytes = new Uint8Array(0);\n    if (decoder) {\n      if (decoder.end() !== DECODER_OK) {\n        decodeError = true;\n      }\n      imageBytes = decoder.data8;\n    }\n    this._activeDecoder = null;\n\n    // Handle command first — handlers create Blob/ImageData from imageBytes,\n    // which copies the data. Only then is it safe to release the decoder's\n    // wasm memory that imageBytes points into.\n    const result = this._handleCommandWithBytesAndCmd(finalCmd, imageBytes, decodeError);\n    if (decoder) {\n      decoder.release();\n    }\n    return result;\n  }\n\n  // Command handling\n\n  private _parseControlDataString(): string {\n    let str = '';\n    for (let i = 0; i < this._controlLength; i++) {\n      str += String.fromCodePoint(this._controlData[i]);\n    }\n    return str;\n  }\n\n  private _handleNoPayloadCommand(): boolean | Promise<boolean> {\n    const cmd = parseKittyCommand(this._parseControlDataString());\n\n    // Per spec: specifying both i and I is an error\n    if (cmd.id !== undefined && cmd.imageNumber !== undefined) {\n      this._sendResponse(cmd.id, 'EINVAL:cannot specify both i and I keys', cmd.quiet ?? 0);\n      return true;\n    }\n\n    const action = cmd.action ?? 't';\n\n    switch (action) {\n      case KittyAction.DELETE:\n        return this._handleDelete(cmd);\n      case KittyAction.QUERY:\n        this._sendResponse(cmd.id ?? 0, 'OK', cmd.quiet ?? 0);\n        return true;\n      case KittyAction.PLACEMENT:\n        return this._handlePlacement(cmd);\n      default:\n        // TODO: Implement remaining actions when needed:\n        // - a=f (frame): animation frame operations\n        // - a=a (animation): animation control\n        // - a=c (compose): compose images\n        if (cmd.id !== undefined) {\n          this._sendResponse(cmd.id, 'EINVAL:unsupported action', cmd.quiet ?? 0);\n        }\n        return true;\n    }\n  }\n\n  private _handleCommandWithBytesAndCmd(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean | Promise<boolean> {\n    const action = cmd.action ?? 't';\n\n    switch (action) {\n      case KittyAction.TRANSMIT: {\n        const result = this._handleTransmit(cmd, bytes, decodeError);\n        // Only send response when _handleTransmit didn't already respond\n        // (it handles unsupported transmission medium responses internally)\n        if ((cmd.transmission ?? 'd') === 'd' && cmd.id !== undefined) {\n          if (decodeError) {\n            this._sendResponse(cmd.id, 'EINVAL:invalid base64 data', cmd.quiet ?? 0);\n          } else if (bytes.length > 0) {\n            this._sendResponse(cmd.id, 'OK', cmd.quiet ?? 0);\n          }\n        }\n        return result;\n      }\n      case KittyAction.TRANSMIT_DISPLAY:\n        return this._handleTransmitDisplay(cmd, bytes, decodeError);\n      case KittyAction.QUERY:\n        return this._handleQuery(cmd, bytes, decodeError);\n      case KittyAction.PLACEMENT:\n        // a=p ignores any payload — image data was already transmitted\n        return this._handlePlacement(cmd);\n      default:\n        // TODO: Implement remaining actions when needed:\n        // - a=f (frame): animation frame operations\n        // - a=a (animation): animation control\n        // - a=c (compose): compose images\n        if (cmd.id !== undefined) {\n          this._sendResponse(cmd.id, 'EINVAL:unsupported action', cmd.quiet ?? 0);\n        }\n        return true;\n    }\n  }\n\n  private _handlePlacement(cmd: IKittyCommand): boolean | Promise<boolean> {\n    if (cmd.id === undefined) {\n      return true;\n    }\n    const id = cmd.id;\n    const image = this._kittyStorage.getImage(id);\n    if (!image) {\n      this._sendResponse(id, 'ENOENT:image not found', cmd.quiet ?? 0, cmd.placementId);\n      return true;\n    }\n    const result = this._displayImage(image, cmd);\n    return result.then(success => {\n      this._sendResponse(id, success ? 'OK' : 'EINVAL:image rendering failed', cmd.quiet ?? 0, cmd.placementId);\n      return true;\n    });\n  }\n\n  private _handleTransmit(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean {\n    // TODO: Support file-based transmission modes (t=f, t=t, t=s)\n    // Currently only supports direct transmission (t=d, the default).\n    // - t=f (file): Payload is base64-encoded file path. Terminal reads image from that path.\n    // - t=t (temp file): Payload is base64-encoded path in temp directory. Terminal reads, deletes.\n    // - t=s: Payload is base64-encoded POSIX shm name. Terminal reads from shared memory.\n    // These modes require filesystem/IPC access not available in browsers. For Node.js/Electron:\n    // 1. Check cmd.transmission (t key) before treating bytes as image data\n    // 2. For t=f/t/s: decode bytes as UTF-8 string (the path/name), then read file contents\n    // 3. For t=d: treat bytes as image data (current behavior)\n    // When implementing, also update _handleQuery to accept these transmission mediums.\n    const transmission = cmd.transmission ?? 'd';\n    if (transmission !== 'd') {\n      if (cmd.id !== undefined) {\n        this._sendResponse(cmd.id, 'EINVAL:unsupported transmission medium', cmd.quiet ?? 0);\n      }\n      return true;\n    }\n\n    if (decodeError || bytes.length === 0) return true;\n\n    this._kittyStorage.storeImage(cmd.id, {\n      data: new Blob([bytes as BlobPart]),\n      width: cmd.width ?? 0,\n      height: cmd.height ?? 0,\n      format: (cmd.format ?? KittyFormat.RGBA) as 24 | 32 | 100,\n      compression: cmd.compression ?? ''\n    });\n    return true;\n  }\n\n  private _handleTransmitDisplay(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean | Promise<boolean> {\n    if (decodeError) {\n      if (cmd.id !== undefined) {\n        this._sendResponse(cmd.id, 'EINVAL:invalid base64 data', cmd.quiet ?? 0);\n      }\n      return true;\n    }\n\n    this._handleTransmit(cmd, bytes, decodeError);\n\n    const id = cmd.id ?? this._kittyStorage.lastImageId;\n    const image = this._kittyStorage.getImage(id);\n    if (image) {\n      const result = this._displayImage(image, cmd);\n      if (cmd.id !== undefined) {\n        return result.then(success => {\n          this._sendResponse(id, success ? 'OK' : 'EINVAL:image rendering failed', cmd.quiet ?? 0);\n          return true;\n        });\n      }\n      return result.then(() => true);\n    }\n    return true;\n  }\n\n  private _handleQuery(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean {\n    const id = cmd.id ?? 0;\n    const quiet = cmd.quiet ?? 0;\n\n    // Per spec: reject unsupported transmission mediums (only t=d is supported atm)\n    // TODO: When filesystem support is added (Node.js/Electron), update this to accept\n    // t=f (file), t=t (temp file), and t=s (shared memory) and respond OK for queries.\n    const transmission = cmd.transmission ?? 'd';\n    if (transmission !== 'd') {\n      this._sendResponse(id, 'EINVAL:unsupported transmission medium', quiet);\n      return true;\n    }\n\n    // Check decode error first (invalid base64)\n    if (decodeError) {\n      this._sendResponse(id, 'EINVAL:invalid base64 data', quiet);\n      return true;\n    }\n\n    // Capability query (no payload) - just respond OK\n    if (bytes.length === 0) {\n      this._sendResponse(id, 'OK', quiet);\n      return true;\n    }\n\n    const format = cmd.format ?? KittyFormat.RGBA;\n\n    if (format === KittyFormat.PNG) {\n      this._sendResponse(id, 'OK', quiet);\n    } else {\n      const width = cmd.width ?? 0;\n      const height = cmd.height ?? 0;\n\n      if (!width || !height) {\n        this._sendResponse(id, 'EINVAL:width and height required for raw pixel data', quiet);\n        return true;\n      }\n\n      const bytesPerPixel = format === KittyFormat.RGBA ? KittyPixelConstants.BYTES_PER_PIXEL_RGBA : KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n      const expectedBytes = width * height * bytesPerPixel;\n\n      if (bytes.length < expectedBytes) {\n        this._sendResponse(id, `EINVAL:insufficient pixel data`, quiet);\n        return true;\n      }\n\n      this._sendResponse(id, 'OK', quiet);\n    }\n    return true;\n  }\n\n  private _handleDelete(cmd: IKittyCommand): boolean {\n    // Per spec: default delete selector is 'a' (delete all visible placements)\n    const selector = cmd.deleteSelector ?? 'a';\n\n    // TODO: Distinguish lowercase (delete placements only) from uppercase\n    // (delete placements + free stored image data). Currently both variants\n    // free everything since we don't separate stored data from placements.\n    switch (selector) {\n      case 'a':\n      case 'A':\n        this._cleanupAllPending();\n        this._kittyStorage.deleteAll();\n        break;\n      case 'i':\n      case 'I':\n        // TODO: When placement id tracking is implemented (see TODO in\n        // KittyImageStorage), d=i with p=<pid> should delete only that\n        // specific placement, while d=i without p should delete all\n        // placements for the image.\n        if (cmd.id !== undefined) {\n          const pending = this._pendingTransmissions.get(cmd.id);\n          if (pending) {\n            pending.decoder.release();\n          }\n          this._removePendingEntry(cmd.id);\n          this._kittyStorage.deleteById(cmd.id);\n        }\n        break;\n      default:\n        // Unsupported selectors (c, n, p, q, r, x, y, z, f) — ignore for now\n        break;\n    }\n    return true;\n  }\n\n  private _sendResponse(id: number, message: string, quiet: number, placementId?: number): void {\n    const isOk = message === 'OK';\n    if (isOk && quiet >= 1) return;\n    if (!isOk && quiet >= 2) return;\n\n    const pPart = placementId ? `,p=${placementId}` : '';\n    const response = `\\x1b_Gi=${id}${pPart};${message}\\x1b\\\\`;\n    this._coreTerminal._core.coreService.triggerDataEvent(response);\n  }\n\n  // Image display\n\n  private _displayImage(image: IKittyImageData, cmd: IKittyCommand): Promise<boolean> {\n    return this._decodeAndDisplay(image, cmd)\n      .then(() => true)\n      .catch(() => false);\n  }\n\n  private async _decodeAndDisplay(image: IKittyImageData, cmd: IKittyCommand): Promise<void> {\n    let bitmap: ImageBitmap | undefined = await this._createBitmap(image);\n\n    try {\n      const cropX = Math.max(0, cmd.x ?? 0);\n      const cropY = Math.max(0, cmd.y ?? 0);\n      const cropW = cmd.sourceWidth || (bitmap.width - cropX);\n      const cropH = cmd.sourceHeight || (bitmap.height - cropY);\n\n      const maxCropW = Math.max(0, bitmap.width - cropX);\n      const maxCropH = Math.max(0, bitmap.height - cropY);\n      const finalCropW = Math.max(0, Math.min(cropW, maxCropW));\n      const finalCropH = Math.max(0, Math.min(cropH, maxCropH));\n\n      if (finalCropW === 0 || finalCropH === 0) {\n        throw new Error('invalid source rectangle');\n      }\n\n      if (cropX !== 0 || cropY !== 0 || finalCropW !== bitmap.width || finalCropH !== bitmap.height) {\n        const cropped = await createImageBitmap(bitmap, cropX, cropY, finalCropW, finalCropH);\n        bitmap.close();\n        bitmap = cropped;\n      }\n\n      const cw = this._renderer.dimensions?.css.cell.width || CELL_SIZE_DEFAULT.width;\n      const ch = this._renderer.dimensions?.css.cell.height || CELL_SIZE_DEFAULT.height;\n\n      // Per spec: c/r default to image's natural cell dimensions.\n      // If only one of c/r is specified, compute the other from image aspect ratio.\n      let imgCols: number;\n      let imgRows: number;\n      if (cmd.columns !== undefined && cmd.rows !== undefined) {\n        imgCols = cmd.columns;\n        imgRows = cmd.rows;\n      } else if (cmd.columns !== undefined) {\n        imgCols = cmd.columns;\n        imgRows = Math.max(1, Math.ceil((bitmap.height / bitmap.width) * (imgCols * cw) / ch));\n      } else if (cmd.rows !== undefined) {\n        imgRows = cmd.rows;\n        imgCols = Math.max(1, Math.ceil((bitmap.width / bitmap.height) * (imgRows * ch) / cw));\n      } else {\n        imgCols = Math.ceil(bitmap.width / cw);\n        imgRows = Math.ceil(bitmap.height / ch);\n      }\n\n      let w = bitmap.width;\n      let h = bitmap.height;\n\n      // Scale bitmap to fit placement rectangle when c/r are specified\n      if (cmd.columns !== undefined || cmd.rows !== undefined) {\n        w = Math.round(imgCols * cw);\n        h = Math.round(imgRows * ch);\n      }\n\n      if (w * h > this._opts.pixelLimit) {\n        throw new Error('image exceeds pixel limit');\n      }\n\n      // Save cursor position before addImage modifies it\n      const buffer = this._coreTerminal._core.buffer;\n      const savedX = buffer.x;\n      const savedY = buffer.y;\n      const savedYbase = buffer.ybase;\n\n      // Determine layer based on z-index: negative = behind text, 0+ = on top.\n      // When z<0 we always use the bottom layer even without allowTransparency —\n      // the image will simply be hidden behind the opaque text background, which\n      // is the correct behavior (client asked for \"behind text\").\n      const wantsBottom = cmd.zIndex !== undefined && cmd.zIndex < 0;\n      const layer: ImageLayer = wantsBottom ? 'bottom' : 'top';\n\n      if (w !== bitmap.width || h !== bitmap.height) {\n        const scaled = await createImageBitmap(bitmap, { resizeWidth: w, resizeHeight: h });\n        bitmap.close();\n        bitmap = scaled;\n      }\n\n      // Per spec: X/Y are pixel offsets within the first cell, so clamp to cell dimensions\n      const xOffset = Math.min(Math.max(0, cmd.xOffset ?? 0), cw - 1);\n      const yOffset = Math.min(Math.max(0, cmd.yOffset ?? 0), ch - 1);\n      if (xOffset !== 0 || yOffset !== 0) {\n        // Per spec: X/Y is not added to c/r area. When c/r are explicit, the\n        // total placement area remains c*cw × r*ch pixels and the offset image\n        // is clipped to fit. When c/r are unset, the padded canvas determines\n        // the natural cell dimensions.\n        const canvasW = (cmd.columns !== undefined) ? Math.round(imgCols * cw) : bitmap.width + xOffset;\n        const canvasH = (cmd.rows !== undefined) ? Math.round(imgRows * ch) : bitmap.height + yOffset;\n        const offsetCanvas = ImageRenderer.createCanvas(window.document, canvasW, canvasH);\n        const offsetCtx = offsetCanvas.getContext('2d');\n        if (!offsetCtx) {\n          throw new Error('Failed to create offset canvas context');\n        }\n        offsetCtx.drawImage(bitmap, xOffset, yOffset);\n\n        const offsetBitmap = await createImageBitmap(offsetCanvas);\n        offsetCanvas.width = offsetCanvas.height = 0;\n        bitmap.close();\n        bitmap = offsetBitmap;\n        w = bitmap.width;\n        h = bitmap.height;\n        if (w * h > this._opts.pixelLimit) {\n          throw new Error('image exceeds pixel limit');\n        }\n        if (cmd.columns === undefined) {\n          imgCols = Math.ceil(bitmap.width / cw);\n        }\n        if (cmd.rows === undefined) {\n          imgRows = Math.ceil(bitmap.height / ch);\n        }\n      }\n\n      const zIndex = cmd.zIndex ?? 0;\n      this._kittyStorage.addImage(image.id, bitmap, true, layer, zIndex);\n      bitmap = undefined;  // ownership transferred to storage\n\n      // Kitty cursor movement\n      // Per spec: cursor placed at first column after last image column,\n      // on the last row of the image. C=1 means don't move cursor.\n      if (cmd.cursorMovement === 1) {\n        // C=1: restore cursor to position before image was placed\n        const scrolled = buffer.ybase - savedYbase;\n        buffer.x = savedX;\n        // Can't restore cursor to scrollback?\n        buffer.y = Math.max(savedY - scrolled, 0);\n      } else {\n        // Default (C=0): advance cursor horizontally past the image\n        // addImage already positioned cursor on the last row via lineFeeds\n        buffer.x = Math.min(savedX + imgCols, this._coreTerminal.cols);\n      }\n    } catch (e) {\n      bitmap?.close();\n      throw e;\n    }\n  }\n\n  // Create ImageBitmap from already-decoded image data.\n  private async _createBitmap(image: IKittyImageData): Promise<ImageBitmap> {\n    let bytes: Uint8Array = new Uint8Array(await image.data.arrayBuffer());\n\n    if (image.compression === KittyCompression.ZLIB) {\n      bytes = await this._decompressZlib(bytes);\n    }\n\n    if (image.format === KittyFormat.PNG) {\n      const blob = new Blob([bytes as BlobPart], { type: 'image/png' });\n      if (!window.createImageBitmap) {\n        const url = URL.createObjectURL(blob);\n        const img = new Image();\n        return new Promise<ImageBitmap>((resolve, reject) => {\n          img.addEventListener('load', () => {\n            URL.revokeObjectURL(url);\n            const canvas = ImageRenderer.createCanvas(window.document, img.width, img.height);\n            canvas.getContext('2d')?.drawImage(img, 0, 0);\n            createImageBitmap(canvas).then(resolve).catch(reject);\n          });\n          img.addEventListener('error', () => {\n            URL.revokeObjectURL(url);\n            reject(new Error('Failed to load image'));\n          });\n          img.src = url;\n        });\n      }\n      return createImageBitmap(blob);\n    }\n\n    // Raw pixel data\n    const width = image.width;\n    const height = image.height;\n\n    if (!width || !height) {\n      throw new Error('Width and height required for raw pixel data');\n    }\n\n    const bytesPerPixel = image.format === KittyFormat.RGBA ? KittyPixelConstants.BYTES_PER_PIXEL_RGBA : KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n    const expectedBytes = width * height * bytesPerPixel;\n\n    if (bytes.length < expectedBytes) {\n      throw new Error('Insufficient pixel data');\n    }\n\n    const pixelCount = width * height;\n\n    if (image.format === KittyFormat.RGBA) {\n      // RGBA: use bytes directly — no copy needed\n      return createImageBitmap(new ImageData(new Uint8ClampedArray(bytes.buffer as ArrayBuffer, bytes.byteOffset, pixelCount * KittyPixelConstants.BYTES_PER_PIXEL_RGBA), width, height));\n    }\n\n    // RGB→RGBA: interleave alpha using uint32 block processing (4 pixels per iteration).\n    // 3 uint32 reads + 4 uint32 writes per 4 pixels vs 28 byte reads/writes — ~6x faster.\n    // Assumes little-endian (all modern browsers/Node.js).\n    const data = new Uint8ClampedArray(pixelCount * KittyPixelConstants.BYTES_PER_PIXEL_RGBA);\n    const src32 = new Uint32Array(bytes.buffer, bytes.byteOffset, Math.floor(bytes.byteLength / 4));\n    const dst32 = new Uint32Array(data.buffer);\n    const alignedPixels = pixelCount & ~3;  // round down to multiple of 4\n\n    let srcOffset = 0;\n    let dstOffset = 0;\n    for (let i = 0; i < alignedPixels; i += 4) {\n      const b0 = src32[srcOffset++];\n      const b1 = src32[srcOffset++];\n      const b2 = src32[srcOffset++];\n      // Little-endian: pixel bytes are [R,G,B] → uint32 ABGR layout\n      dst32[dstOffset++] = 0xFF000000 | b0;\n      dst32[dstOffset++] = 0xFF000000 | (b0 >>> 24) | (b1 << 8);\n      dst32[dstOffset++] = 0xFF000000 | (b1 >>> 16) | (b2 << 16);\n      dst32[dstOffset++] = 0xFF000000 | (b2 >>> 8);\n    }\n\n    // Handle remaining 1–3 pixels\n    let srcByte = alignedPixels * KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n    let dstByte = alignedPixels * KittyPixelConstants.BYTES_PER_PIXEL_RGBA;\n    for (let i = alignedPixels; i < pixelCount; i++) {\n      data[dstByte]     = bytes[srcByte];\n      data[dstByte + 1] = bytes[srcByte + 1];\n      data[dstByte + 2] = bytes[srcByte + 2];\n      data[dstByte + 3] = KittyPixelConstants.ALPHA_OPAQUE;\n      srcByte += KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n      dstByte += KittyPixelConstants.BYTES_PER_PIXEL_RGBA;\n    }\n\n    return createImageBitmap(new ImageData(data, width, height));\n  }\n\n  private async _decompressZlib(compressed: Uint8Array): Promise<Uint8Array> {\n    try {\n      return await this._decompress(compressed, 'deflate');\n    } catch {\n      return await this._decompress(compressed, 'deflate-raw');\n    }\n  }\n\n  private async _decompress(compressed: Uint8Array, format: 'deflate' | 'deflate-raw'): Promise<Uint8Array> {\n    const ds = new DecompressionStream(format);\n    const writer = ds.writable.getWriter();\n    writer.write(compressed as BufferSource);\n    writer.close();\n\n    const chunks: Uint8Array[] = [];\n    const reader = ds.readable.getReader();\n\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) break;\n      chunks.push(value);\n    }\n\n    const totalLength = chunks.reduce((sum, chunk) => sum + chunk.length, 0);\n    const result = new Uint8Array(totalLength);\n    let offset = 0;\n    for (const chunk of chunks) {\n      result.set(chunk, offset);\n      offset += chunk.length;\n    }\n    return result;\n  }\n\n  public get images(): ReadonlyMap<number, IKittyImageData> {\n    return this._kittyStorage.images;\n  }\n\n  public get _kittyIdToStorageId(): ReadonlyMap<number, number> {\n    return this._kittyStorage.kittyIdToStorageId;\n  }\n\n  public get pendingTransmissions(): ReadonlyMap<number, IPendingTransmission> {\n    return this._pendingTransmissions;\n  }\n}\n","/**\n * Copyright (c) 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n *\n * Kitty graphics protocol types, constants, and parsing utilities.\n */\n\nimport type Base64Decoder from 'xterm-wasm-parts/lib/base64/Base64Decoder.wasm';\n\n// Kitty graphics protocol action types.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference under key 'a'.\nexport const enum KittyAction {\n  TRANSMIT = 't',\n  TRANSMIT_DISPLAY = 'T',\n  QUERY = 'q',\n  PLACEMENT = 'p',\n  DELETE = 'd'\n}\n\n// Kitty graphics protocol format types.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference\nexport const enum KittyFormat {\n  RGB = 24,\n  RGBA = 32,\n  PNG = 100\n}\n\n// Kitty graphics protocol compression types.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference under key 'o'.\nexport const enum KittyCompression {\n  NONE = '',\n  ZLIB = 'z'\n}\n\n// Kitty graphics protocol control data keys.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference\nexport const enum KittyKey {\n  // Action to perform (t=transmit, T=transmit+display, q=query, p=placement, d=delete)\n  ACTION = 'a',\n  // Image format (24=RGB, 32=RGBA, 100=PNG)\n  FORMAT = 'f',\n  // Image ID for referencing stored images\n  ID = 'i',\n  // Image number (alternative to ID, terminal assigns ID)\n  IMAGE_NUMBER = 'I',\n  // Source image width in pixels\n  WIDTH = 's',\n  // Source image height in pixels\n  HEIGHT = 'v',\n  // The left edge (in pixels) of the image area to display\n  X_OFFSET = 'x',\n  // The top edge (in pixels) of the image area to display\n  Y_OFFSET = 'y',\n  // Width (in pixels) of the source rectangle to display\n  SOURCE_WIDTH = 'w',\n  // Height (in pixels) of the source rectangle to display\n  SOURCE_HEIGHT = 'h',\n  // Horizontal offset (in pixels) within the first cell\n  X_PLACEMENT_OFFSET = 'X',\n  // Vertical offset (in pixels) within the first cell\n  Y_PLACEMENT_OFFSET = 'Y',\n  // Number of terminal columns to display the image over\n  COLUMNS = 'c',\n  // Number of terminal rows to display the image over\n  ROWS = 'r',\n  // More data flag (1=more chunks coming, 0=final chunk)\n  MORE = 'm',\n  // Compression type (z=zlib). This is essential for chunking larger images.\n  COMPRESSION = 'o',\n  // Quiet mode (1=suppress OK responses, 2=suppress error responses)\n  QUIET = 'q',\n  // Cursor movement policy (0=move cursor after image, 1=don't move cursor)\n  CURSOR_MOVEMENT = 'C',\n  // Z-index for image layering (negative = behind text, 0+ = on top)\n  Z_INDEX = 'z',\n  // Transmission medium (d=direct, f=file, t=temp file, s=shared memory)\n  TRANSMISSION = 't',\n  // Delete selector (a/A=all, i/I=by id, c/C=at cursor, etc.) — only used when a=d\n  DELETE_SELECTOR = 'd',\n  // Placement ID for targeting specific placements\n  PLACEMENT_ID = 'p'\n}\n\n// Pixel format constants\nexport const enum KittyPixelConstants {\n  BYTES_PER_PIXEL_RGB = 3,\n  BYTES_PER_PIXEL_RGBA = 4,\n  ALPHA_OPAQUE = 255\n}\n\n// Parsed Kitty graphics command.\nexport interface IKittyCommand {\n  action?: string;\n  format?: number;\n  id?: number;\n  imageNumber?: number;\n  width?: number;\n  height?: number;\n  x?: number;\n  y?: number;\n  sourceWidth?: number;\n  sourceHeight?: number;\n  xOffset?: number;\n  yOffset?: number;\n  columns?: number;\n  rows?: number;\n  more?: number;\n  quiet?: number;\n  cursorMovement?: number;\n  zIndex?: number;\n  transmission?: string;\n  deleteSelector?: string;\n  placementId?: number;\n  compression?: string;\n  payload?: string;\n}\n\n// Pending chunked transmission state.\n// Stores metadata from the first chunk while accumulating decoded payload data.\nexport interface IPendingTransmission {\n  // The parsed command from the first chunk (contains action, format, dimensions, etc.)\n  cmd: IKittyCommand;\n  // Decoder used across chunked payloads\n  decoder: Base64Decoder;\n  // Total encoded (base64) bytes received across all chunks - for size limit enforcement\n  totalEncodedSize: number;\n  // Whether any chunk has failed to decode\n  decodeError: boolean;\n}\n\n// Stored Kitty image data.\nexport interface IKittyImageData {\n  id: number;\n  // Decoded image data stored as Blob (off JS heap) to avoid 2GB heap limit\n  data: Blob;\n  width: number;\n  height: number;\n  format: 24 | 32 | 100;\n  compression?: string;\n}\n\n// Parses Kitty graphics control data into a command object.\nexport function parseKittyCommand(data: string): IKittyCommand {\n  const cmd: IKittyCommand = {};\n  const parts = data.split(',');\n\n  for (const part of parts) {\n    const eqIdx = part.indexOf('=');\n    if (eqIdx === -1) continue;\n\n    const key = part.substring(0, eqIdx);\n    const value = part.substring(eqIdx + 1);\n\n    // Handle string keys first\n    if (key === KittyKey.ACTION) {\n      cmd.action = value;\n      continue;\n    }\n    if (key === KittyKey.COMPRESSION) {\n      cmd.compression = value;\n      continue;\n    }\n    if (key === KittyKey.TRANSMISSION) {\n      cmd.transmission = value;\n      continue;\n    }\n    if (key === KittyKey.DELETE_SELECTOR) {\n      cmd.deleteSelector = value;\n      continue;\n    }\n    const numValue = parseInt(value, 10);\n    switch (key) {\n      case KittyKey.FORMAT: cmd.format = numValue; break;\n      case KittyKey.ID: cmd.id = numValue; break;\n      case KittyKey.IMAGE_NUMBER: cmd.imageNumber = numValue; break;\n      case KittyKey.WIDTH: cmd.width = numValue; break;\n      case KittyKey.HEIGHT: cmd.height = numValue; break;\n      case KittyKey.X_OFFSET: cmd.x = numValue; break;\n      case KittyKey.Y_OFFSET: cmd.y = numValue; break;\n      case KittyKey.SOURCE_WIDTH: cmd.sourceWidth = numValue; break;\n      case KittyKey.SOURCE_HEIGHT: cmd.sourceHeight = numValue; break;\n      case KittyKey.X_PLACEMENT_OFFSET: cmd.xOffset = numValue; break;\n      case KittyKey.Y_PLACEMENT_OFFSET: cmd.yOffset = numValue; break;\n      case KittyKey.COLUMNS: cmd.columns = numValue; break;\n      case KittyKey.ROWS: cmd.rows = numValue; break;\n      case KittyKey.MORE: cmd.more = numValue; break;\n      case KittyKey.QUIET: cmd.quiet = numValue; break;\n      case KittyKey.CURSOR_MOVEMENT: cmd.cursorMovement = numValue; break;\n      case KittyKey.Z_INDEX: cmd.zIndex = numValue; break;\n      case KittyKey.PLACEMENT_ID: cmd.placementId = numValue; break;\n    }\n  }\n\n  return cmd;\n}\n","/**\n * Copyright (c) 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IDisposable } from '@xterm/xterm';\nimport { ImageStorage } from '../ImageStorage';\nimport { ImageLayer, IAddImageOpts } from '../Types';\nimport { IKittyImageData } from './KittyGraphicsTypes';\n\n// Kitty-specific image storage controller.\n//\n// Wraps shared ImageStorage with kitty protocol semantics:\n// - tracks transmitted image payloads by kitty image id\n// - tracks kitty image id -> shared ImageStorage id mapping for displayed images\n// - mirrors shared-storage evictions into kitty maps\n// - applies protocol-level undisplayed-image eviction policy\nexport class KittyImageStorage implements IDisposable {\n  private static readonly _maxStoredImages = 256;\n\n  private _nextImageId = 1;\n  private readonly _images: Map<number, IKittyImageData> = new Map();\n  // TODO: Support multiple placements per image. The kitty spec identifies\n  // placements by an (image id, placement id) pair — same i + different p\n  // values should coexist, and same i + same p should replace the prior\n  // placement. Currently we track only one storage entry per kitty image id,\n  // so multiple placements of the same image overwrite each other. Fixing\n  // this requires changing these maps to Map<number, Map<number, number>>\n  // (kittyId → placementId → storageId) and updating addImage/deleteById\n  // accordingly. The underlying shared ImageStorage would also need to\n  // support multiple entries per logical image.\n  private readonly _kittyIdToStorageId: Map<number, number> = new Map();\n  private readonly _storageIdToKittyId: Map<number, number> = new Map();\n\n  private readonly _previousOnImageDeleted: ((storageId: number) => void) | undefined;\n  private readonly _wrappedOnImageDeleted: (storageId: number) => void;\n  private readonly _handleStorageImageDeleted = (storageId: number): void => {\n    const kittyId = this._storageIdToKittyId.get(storageId);\n    if (kittyId !== undefined) {\n      this._kittyIdToStorageId.delete(kittyId);\n      this._storageIdToKittyId.delete(storageId);\n      this._images.delete(kittyId);\n    }\n  };\n  private _addImageOpts: IAddImageOpts = { scrolling: true, layer: 'top', zIndex: 0, cursorPos: 'iip' };\n\n  constructor(\n    private readonly _storage: ImageStorage\n  ) {\n    this._previousOnImageDeleted = this._storage.onImageDeleted;\n    this._wrappedOnImageDeleted = (storageId: number) => {\n      this._previousOnImageDeleted?.(storageId);\n      this._handleStorageImageDeleted(storageId);\n    };\n    this._storage.onImageDeleted = this._wrappedOnImageDeleted;\n  }\n\n  public reset(): void {\n    this._nextImageId = 1;\n    this._images.clear();\n    this._kittyIdToStorageId.clear();\n    this._storageIdToKittyId.clear();\n  }\n\n  public dispose(): void {\n    this.reset();\n    if (this._storage.onImageDeleted === this._wrappedOnImageDeleted) {\n      this._storage.onImageDeleted = this._previousOnImageDeleted;\n    }\n  }\n\n  public storeImage(id: number | undefined, imageData: Omit<IKittyImageData, 'id'>): number {\n    const imageId = id ?? this._nextImageId++;\n\n    const oldStorageId = this._kittyIdToStorageId.get(imageId);\n    if (oldStorageId !== undefined) {\n      this._storage.deleteImage(oldStorageId);\n      this._kittyIdToStorageId.delete(imageId);\n      this._storageIdToKittyId.delete(oldStorageId);\n    }\n\n    if (!this._images.has(imageId) && this._images.size >= KittyImageStorage._maxStoredImages) {\n      this._evictUndisplayedImages();\n    }\n\n    this._images.set(imageId, {\n      ...imageData,\n      id: imageId\n    });\n    return imageId;\n  }\n\n  public addImage(kittyId: number, image: HTMLCanvasElement | ImageBitmap, scrolling: boolean, layer: ImageLayer, zIndex: number): void {\n    // Clean up stale reverse-mapping from a previous placement of the same\n    // kitty image.  The old shared-storage entry is kept (it may still be\n    // visible on screen) but its reverse mapping is removed so that eviction\n    // of the old entry won't incorrectly delete the kitty image data.\n    const oldStorageId = this._kittyIdToStorageId.get(kittyId);\n    if (oldStorageId !== undefined) {\n      this._storageIdToKittyId.delete(oldStorageId);\n    }\n    this._addImageOpts.scrolling = scrolling;\n    this._addImageOpts.layer = layer;\n    this._addImageOpts.zIndex = zIndex;\n    const storageId = this._storage.addImage(image, this._addImageOpts);\n    this._kittyIdToStorageId.set(kittyId, storageId);\n    this._storageIdToKittyId.set(storageId, kittyId);\n  }\n\n  public getImage(kittyId: number): IKittyImageData | undefined {\n    return this._images.get(kittyId);\n  }\n\n  public deleteById(kittyId: number): void {\n    this._images.delete(kittyId);\n    const storageId = this._kittyIdToStorageId.get(kittyId);\n    if (storageId !== undefined) {\n      this._storage.deleteImage(storageId);\n      this._kittyIdToStorageId.delete(kittyId);\n      this._storageIdToKittyId.delete(storageId);\n    }\n  }\n\n  public deleteAll(): void {\n    this._images.clear();\n    for (const storageId of this._kittyIdToStorageId.values()) {\n      this._storage.deleteImage(storageId);\n    }\n    this._kittyIdToStorageId.clear();\n    this._storageIdToKittyId.clear();\n  }\n\n  public get images(): ReadonlyMap<number, IKittyImageData> {\n    return this._images;\n  }\n\n  public get kittyIdToStorageId(): ReadonlyMap<number, number> {\n    return this._kittyIdToStorageId;\n  }\n\n  public get lastImageId(): number {\n    return this._nextImageId - 1;\n  }\n\n  private _evictUndisplayedImages(): void {\n    for (const [kittyId] of this._images) {\n      if (this._images.size <= KittyImageStorage._maxStoredImages / 2) {\n        break;\n      }\n      if (!this._kittyIdToStorageId.has(kittyId)) {\n        this._images.delete(kittyId);\n      }\n    }\n  }\n}\n","\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\n/**\n * Copyright (c) 2023, 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n */\nconst inwasm_runtime_1 = require(\"inwasm-runtime\");\n/**\n * wasm base64 decoder.\n */\nconst wasmDecode = (0, inwasm_runtime_1.InWasm)(/*inwasm#828e69684093b2c6:rdef-start:\"decode\"*/{s:1,t:0,d:'AGFzbQEAAAABBQFgAAF/Ag8BA2VudgZtZW1vcnkCAAEDAwIAAAcNAgNkZWMAAANlbmQAAQqLBgKZBAEKf0GIKCgCAEGgKGohAUGEKCgCACIDQaAoaiEAQYAoKAIAQQFrQXxxIgRBoChqIQUgBEEQayADSgRAIARBkChqIQMDQCABIABBA2otAABBAnQoAoAgIABBAmotAABBAnQoAoAYIABBAWotAABBAnQoAoAQIAAtAABBAnQoAoAIcnJyIgY2AgAgAUEDaiAAQQdqLQAAQQJ0KAKAICAAQQZqLQAAQQJ0KAKAGCAAQQVqLQAAQQJ0KAKAECAAQQRqLQAAQQJ0KAKACHJyciIHNgIAIAFBBmogAEELai0AAEECdCgCgCAgAEEKai0AAEECdCgCgBggAEEJai0AAEECdCgCgBAgAEEIai0AAEECdCgCgAhycnIiCDYCACABQQlqIABBD2otAABBAnQoAoAgIABBDmotAABBAnQoAoAYIABBDWotAABBAnQoAoAQIABBDGotAABBAnQoAoAIcnJyIgk2AgAgAiAGciAHciAIciAJciECIAFBDGohASAAQRBqIgAgA0kNAAsLIAAgBUkEQANAIAEgAEEDai0AAEECdCgCgCAgAEECai0AAEECdCgCgBggAEEBai0AAEECdCgCgBAgAC0AAEECdCgCgAhycnIiAzYCACACIANyIQIgAUEDaiEBIABBBGoiACAFSQ0ACwtBfyEAIAJB////B00Ef0GEKCAENgIAQYgoIAFBoChrNgIAQQAFQX8LC+0BAQR/AkBBgCgoAgAiAUGEKCgCACIAa0EFTgRAQX8hAxAADQFBgCgoAgAhAUGEKCgCACEAC0F/IQMgASAAayIBQQJIDQAgAC0AoShBAnQoAoAQIAAtAKAoQQJ0KAKACHIhAgJ/IAFBBEYEQEEDQQQgAC0AoyhBPUYbIAAtAKIoQT1GayEBC0EBIAFBA0kNABogAC0AoihBAnQoAoAYIAJyIQJBAiABQQRHDQAaIAAtAKMoQQJ0KAKAICACciECQQMLIQEgAkH///8HSw0AQQAhA0GIKCgCACIAIAI2AKAoQYgoIAAgAWo2AgALIAML'}/*inwasm#828e69684093b2c6:rdef-end:\"decode\"*/);\n// SIMD version (speedup ~1.4x, not covered by tests yet)\n/*\nconst wasmDecode = InWasm({\n  name: 'decode',\n  type: OutputType.INSTANCE,\n  mode: OutputMode.SYNC,\n  srctype: 'Clang-C',\n  imports: {\n    env: { memory: new WebAssembly.Memory({ initial: 1 }) }\n  },\n  exports: {\n    dec: () => 0,\n    end: () => 0\n  },\n  compile: {\n    switches: ['-msimd128', '-Wl,-z,stack-size=0', '-Wl,--stack-first']\n  },\n  code: `\n    #include <wasm_simd128.h>\n    typedef struct {\n      unsigned int wp;\n      unsigned int sp;\n      unsigned int dp;\n      unsigned int e_size;\n      unsigned int dummy[4];\n      unsigned char data[0];\n    } State;\n\n    unsigned int *D0 = (unsigned int *) ${P32.D0 * 4};\n    unsigned int *D1 = (unsigned int *) ${P32.D1 * 4};\n    unsigned int *D2 = (unsigned int *) ${P32.D2 * 4};\n    unsigned int *D3 = (unsigned int *) ${P32.D3 * 4};\n    State *state = (State *) ${P32.STATE * 4};\n\n    #define packed_byte(x) wasm_i8x16_splat((char) x)\n    #define packed_dword(x) wasm_i32x4_splat(x)\n    #define masked(x, mask) wasm_v128_and(x, wasm_i32x4_splat(mask))\n\n    __attribute__((noinline)) int dec() {\n      unsigned int nsp = (state->wp - 1) & ~3;\n      unsigned char *src = state->data + state->sp;\n      unsigned char *end = state->data + nsp;\n      unsigned char *dst = state->data + state->dp;\n      unsigned int error = 0;\n\n      v128_t err = wasm_i8x16_splat(0);\n      unsigned char *end16 = state->data + (nsp & ~15);\n      while (src < end16) {\n        v128_t data = wasm_v128_load((v128_t *) src);\n\n        // wasm-simd rewrite of http://0x80.pl/notesen/2016-01-17-sse-base64-decoding.html#vector-lookup-pshufb\n        const v128_t higher_nibble = wasm_u32x4_shr(data, 4) & packed_byte(0x0f);\n        const char linv = 1;\n        const char hinv = 0;\n\n        const v128_t lower_bound_LUT = wasm_i8x16_const(\n          // order: 0 1 2 3 4 5 6 7 8 9 a b c d e f\n          linv, linv, 0x2b, 0x30,\n          0x41, 0x50, 0x61, 0x70,\n          linv, linv, linv, linv,\n          linv, linv, linv, linv\n        );\n        const v128_t upper_bound_LUT = wasm_i8x16_const(\n          // order: 0 1 2 3 4 5 6 7 8 9 a b c d e f\n          hinv, hinv, 0x2b, 0x39,\n          0x4f, 0x5a, 0x6f, 0x7a,\n          hinv, hinv, hinv, hinv,\n          hinv, hinv, hinv, hinv\n        );\n        // the difference between the shift and lower bound\n        const v128_t shift_LUT = wasm_i8x16_const(\n          // order: 0 1 2 3 4 5 6 7 8 9 a b c d e f\n          0x00,        0x00,        0x3e - 0x2b, 0x34 - 0x30,\n          0x00 - 0x41, 0x0f - 0x50, 0x1a - 0x61, 0x29 - 0x70,\n          0x00,        0x00,        0x00,        0x00,\n          0x00,        0x00,        0x00,        0x00\n        );\n\n        const v128_t upper_bound = wasm_i8x16_swizzle(upper_bound_LUT, higher_nibble);\n        const v128_t lower_bound = wasm_i8x16_swizzle(lower_bound_LUT, higher_nibble);\n\n        const v128_t below = wasm_i8x16_lt(data, lower_bound);\n        const v128_t above = wasm_i8x16_gt(data, upper_bound);\n        const v128_t eq_2f = wasm_i8x16_eq(data, packed_byte(0x2f));\n\n        // in_range = not (below or above) or eq_2f\n        // outside  = not in_range = below or above and not eq_2f (from deMorgan law)\n        const v128_t outside = wasm_v128_andnot(eq_2f, above | below);\n        err = wasm_v128_or(err, outside);\n\n        const v128_t shift  = wasm_i8x16_swizzle(shift_LUT, higher_nibble);\n        const v128_t t0     = wasm_i8x16_add(data, shift);\n        v128_t v = wasm_i8x16_add(t0, wasm_v128_and(eq_2f, packed_byte(-3)));\n\n        // pack bytes\n        const v128_t ca = masked(v, 0x003f003f);\n        const v128_t db = masked(v, 0x3f003f00);\n        const v128_t t00 = wasm_v128_or(wasm_u32x4_shr(db, 8), wasm_i32x4_shl(ca, 6));\n        v128_t res = wasm_v128_or(wasm_u32x4_shr(t00, 16), wasm_i32x4_shl(t00, 12));\n        res = wasm_i8x16_swizzle(res, wasm_i8x16_const(2, 1, 0, 6, 5, 4, 10, 9, 8, 14, 13, 12, 16, 16, 16, 16));\n\n        wasm_v128_store((v128_t *) dst, res);\n        dst += 12;\n        src += 16;\n      }\n      //if (wasm_i8x16_bitmask(err) != 0) return -1;\n      if (wasm_v128_any_true(err)) return -1;\n\n      // operate on 4-byte blocks\n      while (src < end) {\n        error |= *((unsigned int *) dst) = D0[src[0]] | D1[src[1]] | D2[src[2]] | D3[src[3]];\n        dst += 3;\n        src += 4;\n      }\n      if (error >> 24) return -1;\n      state->sp = nsp;\n      state->dp = dst - state->data;\n      return 0;\n    }\n\n    int end() {\n      int rem = state->wp - state->sp;\n      if (rem > 4 && dec()) return -1;\n      rem = state->wp - state->sp;\n      if (rem < 2) return -1;\n\n      unsigned char *src = state->data + state->sp;\n      if (rem == 4) {\n        if (src[3] == 61) rem--;\n        if (src[2] == 61) rem--;\n      }\n      unsigned int accu = D0[src[0]] | D1[src[1]];\n      int dp = 1;\n      if (rem > 2) {\n        accu |= D2[src[2]];\n        dp++;\n        if (rem == 4) {\n          accu |= D3[src[3]];\n          dp++;\n        }\n      }\n      if (accu >> 24) return -1;\n      *((unsigned int *) (state->data + state->dp)) = accu;\n      state->dp += dp;\n      return 0;\n    }\n    `\n});\n*/\n// base64 map\nconst MAP = new Uint8Array('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'\n    .split('')\n    .map(el => el.charCodeAt(0)));\n// init decoder maps in LE order\nconst D = new Uint32Array(1024);\nD.fill(0xFF000000);\nfor (let i = 0; i < MAP.length; ++i)\n    D[MAP[i]] = i << 2;\nfor (let i = 0; i < MAP.length; ++i)\n    D[256 + MAP[i]] = i >> 4 | ((i << 4) & 0xFF) << 8;\nfor (let i = 0; i < MAP.length; ++i)\n    D[512 + MAP[i]] = (i >> 2) << 8 | ((i << 6) & 0xFF) << 16;\nfor (let i = 0; i < MAP.length; ++i)\n    D[768 + MAP[i]] = i << 16;\nconst EMPTY = new Uint8Array(0);\n/**\n * base64 stream decoder.\n *\n * Features / assumptions:\n * - lazy chunkwise decoding\n * - errors out on any non base64 chars (no support for NL formatted base64)\n * - decodes in wasm\n * - inplace decoding to save memory\n * - supports a keepSize for lazy memory release\n */\nclass Base64Decoder {\n    /**\n     * @param keepSize Keep the wasm instance below this limit when calling `release()`.\n     * @param maxBytes Max allowed bytes to allocate.\n     * @param initialBytes Initial bytes to allocate.\n     */\n    constructor(keepSize, maxBytes, initialBytes) {\n        this._inst = null;\n        this._ended = true;\n        this._bytes = 0;\n        this.keepSize = keepSize !== null && keepSize !== void 0 ? keepSize : 1048576 /* Bytes.KEEP */;\n        this.maxBytes = maxBytes !== null && maxBytes !== void 0 ? maxBytes : 4294901760 /* Bytes.MAX */;\n        this._bytes = initialBytes !== null && initialBytes !== void 0 ? initialBytes : 32768 /* Bytes.INITIAL */;\n        if (this._bytes > this.maxBytes || this.maxBytes > 4294901760 /* Bytes.MAX */) {\n            throw new Error('invalid byte settings');\n        }\n    }\n    /**\n     * Currently decoded bytes (borrowed).\n     * Must be accessed before calling `release` or `init`.\n     */\n    get data8() {\n        return this._inst ? this._d.subarray(0, this._m32[1282 /* P32.STATE_DP */]) : EMPTY;\n    }\n    /**\n     * Release memory conditionally based on `keepSize`.\n     * If memory gets released, also the wasm instance will be freed and recreated on next `init`,\n     * otherwise the instance will be reused.\n     */\n    release() {\n        if (!this._inst)\n            return;\n        if (this._bytes > this.keepSize) {\n            this._inst = this._m32 = this._d = this._mem = null;\n        }\n        else {\n            this._m32[1280 /* P32.STATE_WP */] = 0;\n            this._m32[1281 /* P32.STATE_SP */] = 0;\n            this._m32[1282 /* P32.STATE_DP */] = 0;\n        }\n    }\n    /**\n     * Initializes the decoder for new base64 data.\n     * Must be called before doing any decoding attempts.\n     * The method will either spawn a new wasm instance or grow\n     * the needed memory of an existing instance.\n     * @param maxBytes Max allowed bytes to allocate (overwrites ctor value).\n     * @param initialBytes Initial bytes to allocate (overwrites ctor value).\n     */\n    init(maxBytes, initialBytes) {\n        this.maxBytes = maxBytes !== null && maxBytes !== void 0 ? maxBytes : this.maxBytes;\n        this._bytes = initialBytes !== null && initialBytes !== void 0 ? initialBytes : Math.min(this._bytes, this.maxBytes);\n        if (this._bytes > this.maxBytes || this.maxBytes > 4294901760 /* Bytes.MAX */) {\n            throw Error('invalid byte settings');\n        }\n        let m = this._m32;\n        const bytes = this._bytes + 5152 /* Bytes._DATA_OFFSET */;\n        if (!this._inst) {\n            this._mem = new WebAssembly.Memory({ initial: Math.ceil(bytes / 65536) });\n            this._inst = wasmDecode({ env: { memory: this._mem } });\n            m = new Uint32Array(this._mem.buffer, 0);\n            m.set(D, 256 /* P32.D0 */);\n            this._d = new Uint8Array(this._mem.buffer, 5152 /* Bytes._DATA_OFFSET */);\n        }\n        else if (this._mem.buffer.byteLength < bytes) {\n            this._mem.grow(Math.ceil((bytes - this._mem.buffer.byteLength) / 65536));\n            m = new Uint32Array(this._mem.buffer, 0);\n            this._d = new Uint8Array(this._mem.buffer, 5152 /* Bytes._DATA_OFFSET */);\n        }\n        m[1280 /* P32.STATE_WP */] = 0;\n        m[1281 /* P32.STATE_SP */] = 0;\n        m[1282 /* P32.STATE_DP */] = 0;\n        this._m32 = m;\n        this._ended = false;\n    }\n    /**\n     * Realloc memory. Realloc only happens, if the requested\n     * size doesn't fit in the current memory.\n     * The new size will be capped by `maxBytes`.\n     * @param requested Bytes to be stored.\n     */\n    _realloc(requested) {\n        const needed = this._m32[1280 /* P32.STATE_WP */] + requested;\n        if (this._bytes < needed) {\n            if (needed > this.maxBytes) {\n                return -3 /* DecodeStatus.SIZE_EXCEEDED */;\n            }\n            let newSize = this._bytes;\n            while ((newSize *= 2) < needed) { }\n            newSize = Math.min(newSize, this.maxBytes);\n            if (newSize < needed) {\n                return -3 /* DecodeStatus.SIZE_EXCEEDED */;\n            }\n            if (newSize + 5152 /* Bytes._DATA_OFFSET */ > this._mem.buffer.byteLength) {\n                const addPages = Math.ceil((newSize + 5152 /* Bytes._DATA_OFFSET */ - this._mem.buffer.byteLength) / 65536);\n                this._mem.grow(addPages);\n                this._m32 = new Uint32Array(this._mem.buffer, 0);\n                this._d = new Uint8Array(this._mem.buffer, 5152 /* Bytes._DATA_OFFSET */);\n            }\n            this._bytes = newSize;\n        }\n        return 0 /* DecodeStatus.OK */;\n    }\n    /**\n     * Put bytes in `data` into the decoder.\n     * Additionally decodes the payload, if it reached 2^17 bytes.\n     * The return value indicates the type of issue.\n     * @param data Bytes to be loaded.\n     */\n    put(data) {\n        if (!this._inst || this._ended) {\n            return -2 /* DecodeStatus.NOT_INITIALIZED */;\n        }\n        if (this._realloc(data.length)) {\n            return -3 /* DecodeStatus.SIZE_EXCEEDED */;\n        }\n        const m = this._m32;\n        this._d.set(data, m[1280 /* P32.STATE_WP */]);\n        m[1280 /* P32.STATE_WP */] += data.length;\n        // max chunk in input handler is 2^17, try to run in \"tandem mode\"\n        return m[1280 /* P32.STATE_WP */] - m[1281 /* P32.STATE_SP */] >= 131072\n            ? this._inst.exports.dec()\n            : 0 /* DecodeStatus.OK */;\n    }\n    /**\n     * End the current decoding.\n     * Also decodes leftover payload from previous put calls.\n     */\n    end() {\n        this._ended = true;\n        return this._inst\n            ? this._inst.exports.end()\n            : -2 /* DecodeStatus.NOT_INITIALIZED */;\n    }\n    /**\n     * Bytes loaded into the decoder.\n     */\n    get loadedBytes() {\n        return this._inst\n            ? this._m32[1280 /* P32.STATE_WP */]\n            : 0;\n    }\n    /**\n     * Free bytes to feed to the decoder.\n     */\n    get freeBytes() {\n        return this._inst\n            ? this.maxBytes - this._m32[1280 /* P32.STATE_WP */]\n            : 0;\n    }\n}\nexports.default = Base64Decoder;\n//# sourceMappingURL=Base64Decoder.wasm.js.map","\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\n/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\nconst inwasm_runtime_1 = require(\"inwasm-runtime\");\nconst wasmQoiDecode = (0, inwasm_runtime_1.InWasm)(/*inwasm#459f9e1bfb80b1a8:rdef-start:\"qoi_decode\"*/{s:1,t:0,d:'AGFzbQEAAAABCgJgAABgA39/fwACDwEDZW52Bm1lbW9yeQIAAQMDAgABBwcBA2RlYwABCAEACu4EAgwAQQBBAEGAAvwLAAveBAEJf0EAQQBBgAL8CwAgAUEXTgRAIAAgAWpBCGshCkGACCEBIAJBAnRBgAhqIQsgAEEOaiEDQf8BIQZBACECA0AgA0EBaiEHIAMtAAAiCEE/cSEAAkACQCAIQcABcSIJRQRAIABBAnQiAC0AAyEGIAAtAAIhBCAALQABIQUgAC0AACECIAchAwwBCwJAIAhB/QFLDQAgCUHAAUcNACAFQQVsIAJBA2xqIARBB2xqIAZBC2xqQT9xQQJ0IgMgBDoAAiADIAU6AAEgAyACOgAAIANBA2ogBjoAAANAIAEgAjoAACABQQNqIAY6AAAgAUECaiAEOgAAIAFBAWogBToAACABQQRqIQEgAEUEQCAHIQMMBAsgAEEBayEAIAEgC0kNAAsgByEDDAILAn8CQAJAAkAgCEH+AWsOAgABAgsgAy0AAyEEIAMtAAIhBSADLQABIQIgA0EEagwCCyADKAIBIgJBGHYhBiACQRB2IQQgAkEIdiEFIANBBWoMAQsgCUGAAUcEQCAHIAlBwABHDQEaIAQgCEEDcWpBAmshBCACIABBBHZqQQJrIQIgBSAIQQJ2QQNxakECayEFIAcMAQsgBCAAQShrIgkgAy0AASIHQQ9xamohBCACIAdBBHYgCWpqIQIgACAFakEgayEFIANBAmoLIQMgBUEFbCACQQNsaiAEQQdsaiAGQQtsakE/cUECdCIAIAQ6AAIgACAFOgABIAAgAjoAACAAQQNqIAY6AAALIAEgBjoAAyABIAQ6AAIgASAFOgABIAEgAjoAACABQQRqIQELIAMgCkkNAAsLCw=='}/*inwasm#459f9e1bfb80b1a8:rdef-end:\"qoi_decode\"*/);\nclass QoiDecoder {\n    constructor(keepSize) {\n        this.keepSize = keepSize;\n        this.width = 0;\n        this.height = 0;\n    }\n    decode(d) {\n        this.width = d[4] << 24 | d[5] << 16 | d[6] << 8 | d[7];\n        this.height = d[8] << 24 | d[9] << 16 | d[10] << 8 | d[11];\n        const pixels = this.width * this.height;\n        const ib = pixels * 4;\n        const dl = d.length;\n        /**\n         * byte/offset calculation:\n         * To save some memory we dont reserve full memory for decoded + encoded,\n         * but place encoded at the end of decoded plus 50% security distance\n         * to avoid reads before writes positions:\n         *\n         * encoded < decoded (good compression)\n         *    enc                                              ####################\n         *    dec                 #######################################\n         *                        ^                            ^\n         *                        DST_P                        CHUNK_P\n         *\n         * encoded > decoded (degenerated compression, should not happen)\n         *    enc                           ##############################\n         *    dec                 ####################\n         *                        ^         ^\n         *                        DST_P     CHUNK_P\n         *\n         * There is still a chance for overlapping r/w positions in case the compressed\n         * data has very different pixel progression, yet the 50% security distance\n         * should deal with that, as QOI will bloat data by 25% at max (RGB -> OP byte + RGB).\n         * Since we always assume RGBA at decoding stage, the possible bloat reduces to 20% at max.\n         */\n        const bytes = Math.max(ib, dl) + (Math.min(ib, dl) >> 1) + 4096;\n        if (!this._inst) {\n            this._mem = new WebAssembly.Memory({ initial: Math.ceil(bytes / 65536) });\n            this._inst = wasmQoiDecode({ env: { memory: this._mem } });\n        }\n        else if (this._mem.buffer.byteLength < bytes) {\n            this._mem.grow(Math.ceil((bytes - this._mem.buffer.byteLength) / 65536));\n            this._d = null;\n        }\n        if (!this._d) {\n            this._d = new Uint8Array(this._mem.buffer);\n        }\n        // put src data at the end of memory, also align to 256\n        const chunkP = (this._mem.buffer.byteLength - dl) & ~0xFF;\n        this._d.set(d, chunkP);\n        this._inst.exports.dec(chunkP, dl, pixels);\n        return this._d.subarray(1024 /* P8.DST_P */, 1024 /* P8.DST_P */ + ib);\n    }\n    release() {\n        if (!this._inst)\n            return;\n        if (this._mem.buffer.byteLength > this.keepSize) {\n            this._inst = this._d = this._mem = null;\n        }\n    }\n}\nexports.default = QoiDecoder;\n//# sourceMappingURL=QoiDecoder.wasm.js.map","\"use strict\";\n/**\n * Copyright (c) 2022, 2026 Joerg Breitbart\n * @license MIT\n */\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.InWasm = InWasm;\nlet z = (s) => {\n    if (Uint8Array.fromBase64)\n        return Uint8Array.fromBase64(s);\n    if (typeof Buffer !== 'undefined')\n        return Buffer.from(s, 'base64');\n    const b = atob(s);\n    const r = new Uint8Array(b.length);\n    for (let i = 0; i < r.length; ++i)\n        r[i] = b.charCodeAt(i);\n    return r;\n};\nfunction InWasm(def) {\n    if (def.d) {\n        const { t, s, d } = def;\n        let b;\n        let m;\n        const W = WebAssembly;\n        if (t === 0 /* OutputType.INSTANCE */) {\n            if (s)\n                return (e) => new W.Instance(m || (m = new W.Module(b || (b = z(d)))), e);\n            return (e) => m\n                ? W.instantiate(m, e)\n                : W.instantiate(b || (b = z(d)), e).then(r => (m = r.module) && r.instance);\n        }\n        if (t === 1 /* OutputType.MODULE */) {\n            if (s)\n                return () => m || (m = new W.Module(b || (b = z(d))));\n            return () => m\n                ? Promise.resolve(m)\n                : W.compile(b || (b = z(d))).then(r => m = r);\n        }\n        if (s)\n            return () => b || (b = z(d));\n        return () => Promise.resolve(b || (b = z(d)));\n    }\n    if (typeof _wasmCtx === 'undefined')\n        throw new Error('must run \"inwasm\"');\n    _wasmCtx.add(def);\n}\n//# sourceMappingURL=index.js.map","// The module cache\nvar __webpack_module_cache__ = {};\n\n// The require function\nfunction __webpack_require__(moduleId) {\n\t// Check if module is in cache\n\tvar cachedModule = __webpack_module_cache__[moduleId];\n\tif (cachedModule !== undefined) {\n\t\treturn cachedModule.exports;\n\t}\n\t// Create a new module (and put it into the cache)\n\tvar module = __webpack_module_cache__[moduleId] = {\n\t\t// no module.id needed\n\t\t// no module.loaded needed\n\t\texports: {}\n\t};\n\n\t// Execute the module function\n\t__webpack_modules__[moduleId].call(module.exports, module, module.exports, __webpack_require__);\n\n\t// Return the exports of the module\n\treturn module.exports;\n}\n\n","/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport type { ITerminalAddon, IDisposable } from '@xterm/xterm';\nimport type { ImageAddon as IImageApi } from '@xterm/addon-image';\nimport { Emitter, type IEvent } from 'common/Event';\nimport { IIPHandler } from './IIPHandler';\nimport { ImageRenderer } from './ImageRenderer';\nimport { ImageStorage, CELL_SIZE_DEFAULT } from './ImageStorage';\nimport { KittyGraphicsHandler } from './kitty/KittyGraphicsHandler';\nimport { KittyImageStorage } from './kitty/KittyImageStorage';\nimport { SixelHandler } from './SixelHandler';\nimport { SixelImageStorage } from './SixelImageStorage';\nimport { IIPImageStorage } from './IIPImageStorage';\nimport { ITerminalExt, IImageAddonOptions, IResetHandler } from './Types';\n\n\n/**\n * Document VT features provided by this addon.\n *\n * @vt: #E[Supported via @xterm/addon-image.] DCS SIXEL \"SIXEL Graphics\"  \"DCS Ps ; Ps ; Ps ; q Pt ST\"  \"Draw SIXEL image.\"\n *\n * Sixel support is provided by the addon @xterm/addon-image with these limitations:\n * - immediate coloring (no shared palette, allows high color settings of `img2sixel`)\n * - max. palette size of 4096 colors\n * - max. pixel width of 16K\n * - max. 25 MB per sixel sequence\n * - VT340 cursor positioning (begin of last sixel data row)\n *\n * See [addon readme](https://github.com/xtermjs/xterm.js/tree/master/addons/addon-image) for more details.\n *\n *\n * @vt: #E[Supported via @xterm/addon-image.] OSC 1337  \"iTerm2 Commands\"   \"OSC 1337 ; Pt BEL\"  \"Custom iTerm2 commands.\"\n *\n * Only the inline image protocol (IIP) is supported by the addon @xterm/addon-image with\n * the following limitations:\n * - sequence:\n *   - format: `OSC 1337 ; File=inline=1 ; size=<unencoded size> ; ... : <base64 payload> BEL`\n *   - size param must be set and payload may not exceed CEIL(size * 4 / 3)\n *   - strict base64 handling as of RFC4648 §4 (standard alphabet, optional padding,\n *     no separator bytes allowed)\n *   - supported params: size, name, width, height, preserveAspectRatio\n * - image formats: PNG, JPEG and GIF\n * - no animation support (renders first image of a GIF)\n * - no multipart support\n * - VT340 cursor positioning (begin of last sixel data row)\n *\n * See [addon readme](https://github.com/xtermjs/xterm.js/tree/master/addons/addon-image)\n * and [iTerm2 IIP docs](https://iterm2.com/documentation-images.html) for more details.\n *\n *\n * @vt: #E[Supported via @xterm/addon-image.] APC KITTY_GRAPHICS \"Kitty Graphics\"  \"APC G Pt ST\"  \"Kitty Graphics Protocol.\"\n *\n * Kitty graphics support is provided by the addon @xterm/addon-image.\n * Note that while basic image output already works, this is still work in progress.\n */\n\n// default values of addon ctor options\nconst DEFAULT_OPTIONS: IImageAddonOptions = {\n  enableSizeReports: true,\n  pixelLimit: 16777216, // limit to 4096 * 4096 pixels\n  sixelSupport: true,\n  sixelScrolling: true,\n  sixelPaletteLimit: 4096,\n  sixelSizeLimit: 33554432,\n  storageLimit: 128,\n  showPlaceholder: true,\n  iipSupport: true,\n  iipSizeLimit: 33554432,\n  kittySupport: true,\n  kittySizeLimit: 33554432\n};\n\n// max palette size supported by the sixel lib (compile time setting)\nconst MAX_SIXEL_PALETTE_SIZE = 4096;\n\n// definitions for _xtermGraphicsAttributes sequence\nconst enum GaItem {\n  COLORS = 1,\n  SIXEL_GEO = 2,\n  REGIS_GEO = 3\n}\nconst enum GaAction {\n  READ = 1,\n  SET_DEFAULT = 2,\n  SET = 3,\n  READ_MAX = 4\n}\nconst enum GaStatus {\n  SUCCESS = 0,\n  ITEM_ERROR = 1,\n  ACTION_ERROR = 2,\n  FAILURE = 3\n}\n\n\nexport class ImageAddon implements ITerminalAddon, IImageApi {\n  private _opts: IImageAddonOptions;\n  private _defaultOpts: IImageAddonOptions;\n  private _storage: ImageStorage | undefined;\n  private _renderer: ImageRenderer | undefined;\n  private _disposables: IDisposable[] = [];\n  private _terminal: ITerminalExt | undefined;\n  private _handlers: Map<String, IResetHandler> = new Map();\n  private readonly _onImageAdded = new Emitter<void>();\n  public readonly onImageAdded: IEvent<void> = this._onImageAdded.event;\n\n  constructor(opts?: Partial<IImageAddonOptions>) {\n    this._opts = Object.assign({}, DEFAULT_OPTIONS, opts);\n    this._defaultOpts = Object.assign({}, DEFAULT_OPTIONS, opts);\n  }\n\n  public dispose(): void {\n    for (const obj of this._disposables) {\n      obj.dispose();\n    }\n    this._disposables.length = 0;\n    this._handlers.clear();\n    this._onImageAdded.dispose();\n  }\n\n  private _disposeLater(...args: IDisposable[]): void {\n    for (const obj of args) {\n      this._disposables.push(obj);\n    }\n  }\n\n  public activate(terminal: ITerminalExt): void {\n    this._terminal = terminal;\n\n    // internal data structures\n    this._renderer = new ImageRenderer(terminal);\n    this._storage = new ImageStorage(terminal, this._renderer, this._opts);\n    this._storage.onImageAdded = () => this._onImageAdded.fire();\n\n    // enable size reports\n    if (this._opts.enableSizeReports) {\n      const windowOps = terminal.options.windowOptions ?? {};\n      windowOps.getWinSizePixels = true;\n      windowOps.getCellSizePixels = true;\n      windowOps.getWinSizeChars = true;\n      terminal.options.windowOptions = windowOps;\n    }\n\n    this._disposeLater(\n      this._renderer,\n      this._storage,\n\n      // DECSET/DECRST/DA1/XTSMGRAPHICS handlers\n      terminal.parser.registerCsiHandler({ prefix: '?', final: 'h' }, params => this._decset(params)),\n      terminal.parser.registerCsiHandler({ prefix: '?', final: 'l' }, params => this._decrst(params)),\n      terminal.parser.registerCsiHandler({ final: 'c' }, params => this._da1(params)),\n      terminal.parser.registerCsiHandler({ prefix: '?', final: 'S' }, params => this._xtermGraphicsAttributes(params)),\n\n      // render hook\n      terminal.onRender(range => this._storage?.render(range)),\n\n      /**\n       * reset handlers covered:\n       * - DECSTR\n       * - RIS\n       * - Terminal.reset()\n       */\n      terminal.parser.registerCsiHandler({ intermediates: '!', final: 'p' }, () => this.reset()),\n      terminal.parser.registerEscHandler({ final: 'c' }, () => this.reset()),\n      terminal._core._inputHandler.onRequestReset(() => this.reset()),\n\n      // wipe canvas and delete alternate images on buffer switch\n      terminal.buffer.onBufferChange(() => this._storage?.wipeAlternate()),\n\n      // extend images to the right on resize\n      terminal.onResize(metrics => this._storage?.viewportResize(metrics))\n    );\n\n    // SIXEL handler\n    if (this._opts.sixelSupport) {\n      const sixelStorage = new SixelImageStorage(this._storage!, this._opts, this._renderer!, terminal);\n      const sixelHandler = new SixelHandler(this._opts, sixelStorage, terminal);\n      this._handlers.set('sixel', sixelHandler);\n      this._disposeLater(\n        terminal._core._inputHandler._parser.registerDcsHandler({ final: 'q' }, sixelHandler)\n      );\n    }\n\n    // iTerm IIP handler\n    if (this._opts.iipSupport) {\n      const iipStorage = new IIPImageStorage(this._storage!);\n      const iipHandler = new IIPHandler(this._opts, this._renderer!, iipStorage, terminal);\n      this._handlers.set('iip', iipHandler);\n      this._disposeLater(\n        terminal._core._inputHandler._parser.registerOscHandler(1337, iipHandler)\n      );\n    }\n\n    // Kitty graphics handler\n    if (this._opts.kittySupport) {\n      const kittyStorage = new KittyImageStorage(this._storage!);\n      const kittyHandler = new KittyGraphicsHandler(this._opts, this._renderer!, kittyStorage, terminal);\n      this._handlers.set('kitty', kittyHandler);\n      this._disposeLater(\n        kittyStorage,\n        kittyHandler,\n        terminal._core._inputHandler._parser.registerApcHandler({ final: 'G' }, kittyHandler)\n      );\n    }\n  }\n\n  // Note: storageLimit is skipped here to not intoduce a surprising side effect.\n  public reset(): boolean {\n    // reset options customizable by sequences to defaults\n    this._opts.sixelScrolling = this._defaultOpts.sixelScrolling;\n    this._opts.sixelPaletteLimit = this._defaultOpts.sixelPaletteLimit;\n    // also clear image storage\n    this._storage?.reset();\n    // reset protocol handlers\n    for (const handler of this._handlers.values()) {\n      handler.reset();\n    }\n    return false;\n  }\n\n  public get storageLimit(): number {\n    return this._storage?.getLimit() || -1;\n  }\n\n  public set storageLimit(limit: number) {\n    this._storage?.setLimit(limit);\n    this._opts.storageLimit = limit;\n  }\n\n  public get storageUsage(): number {\n    if (this._storage) {\n      return this._storage.getUsage();\n    }\n    return -1;\n  }\n\n  public get showPlaceholder(): boolean {\n    return this._opts.showPlaceholder;\n  }\n\n  public set showPlaceholder(value: boolean) {\n    this._opts.showPlaceholder = value;\n    this._renderer?.showPlaceholder(value);\n  }\n\n  public getImageAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    return this._storage?.getImageAtBufferCell(x, y);\n  }\n\n  public extractTileAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    return this._storage?.extractTileAtBufferCell(x, y);\n  }\n\n  private _report(s: string): void {\n    this._terminal?._core.input(s, false);\n  }\n\n  private _decset(params: (number | number[])[]): boolean {\n    for (let i = 0; i < params.length; ++i) {\n      switch (params[i]) {\n        case 80:\n          this._opts.sixelScrolling = false;\n          break;\n      }\n    }\n    return false;\n  }\n\n  private _decrst(params: (number | number[])[]): boolean {\n    for (let i = 0; i < params.length; ++i) {\n      switch (params[i]) {\n        case 80:\n          this._opts.sixelScrolling = true;\n          break;\n      }\n    }\n    return false;\n  }\n\n  // overload DA to return something more appropriate\n  private _da1(params: (number | number[])[]): boolean {\n    if (params[0]) {\n      return true;\n    }\n    // reported features:\n    // 62 - VT220\n    // 4 - SIXEL support\n    // 9 - charsets\n    // 22 - ANSI colors\n    if (this._opts.sixelSupport) {\n      this._report(`\\x1b[?62;4;9;22c`);\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * Implementation of xterm's graphics attribute sequence.\n   *\n   * Supported features:\n   * - read/change palette limits (max 4096 by sixel lib)\n   * - read SIXEL canvas geometry (reports current window canvas or\n   *   squared pixelLimit if canvas > pixel limit)\n   *\n   * Everything else is deactivated.\n   */\n  private _xtermGraphicsAttributes(params: (number | number[])[]): boolean {\n    if (params.length < 2) {\n      return true;\n    }\n    if (params[0] === GaItem.COLORS) {\n      switch (params[1]) {\n        case GaAction.READ:\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${this._opts.sixelPaletteLimit}S`);\n          return true;\n        case GaAction.SET_DEFAULT:\n          this._opts.sixelPaletteLimit = this._defaultOpts.sixelPaletteLimit;\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${this._opts.sixelPaletteLimit}S`);\n          // also reset protocol handlers for now\n          for (const handler of this._handlers.values()) {\n            handler.reset();\n          }\n          return true;\n        case GaAction.SET:\n          if (params.length > 2 && !(params[2] instanceof Array) && params[2] <= MAX_SIXEL_PALETTE_SIZE) {\n            this._opts.sixelPaletteLimit = params[2];\n            this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${this._opts.sixelPaletteLimit}S`);\n          } else {\n            this._report(`\\x1b[?${params[0]};${GaStatus.ACTION_ERROR}S`);\n          }\n          return true;\n        case GaAction.READ_MAX:\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${MAX_SIXEL_PALETTE_SIZE}S`);\n          return true;\n        default:\n          this._report(`\\x1b[?${params[0]};${GaStatus.ACTION_ERROR}S`);\n          return true;\n      }\n    }\n    if (params[0] === GaItem.SIXEL_GEO) {\n      switch (params[1]) {\n        // we only implement read and read_max here\n        case GaAction.READ:\n          let width = this._renderer?.dimensions?.css.canvas.width;\n          let height = this._renderer?.dimensions?.css.canvas.height;\n          if (!width || !height) {\n            // for some reason we have no working image renderer\n            // --> fallback to default cell size\n            const cellSize = CELL_SIZE_DEFAULT;\n            width = (this._terminal?.cols || 80) * cellSize.width;\n            height = (this._terminal?.rows || 24) * cellSize.height;\n          }\n          if (width * height < this._opts.pixelLimit) {\n            this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${width.toFixed(0)};${height.toFixed(0)}S`);\n          } else {\n            // if we overflow pixelLimit report that squared instead\n            const x = Math.floor(Math.sqrt(this._opts.pixelLimit));\n            this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${x};${x}S`);\n          }\n          return true;\n        case GaAction.READ_MAX:\n          // read_max returns pixelLimit as square area\n          const x = Math.floor(Math.sqrt(this._opts.pixelLimit));\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${x};${x}S`);\n          return true;\n        default:\n          this._report(`\\x1b[?${params[0]};${GaStatus.ACTION_ERROR}S`);\n          return true;\n      }\n    }\n    // exit with error on ReGIS or any other requests\n    this._report(`\\x1b[?${params[0]};${GaStatus.ITEM_ERROR}S`);\n    return true;\n  }\n}\n"],"names":["root","factory","exports","module","define","amd","globalThis","red","n","green","blue","toRGBA8888","r","g","b","a","clamp","low","high","value","Math","max","min","h2c","t1","t2","c","normalizeRGB","round","Object","defineProperty","DEFAULT_FOREGROUND","DEFAULT_BACKGROUND","PALETTE_ANSI_256","PALETTE_VT340_GREY","PALETTE_VT340_COLOR","normalizeHLS","nearestColorIndex","fromRGBA8888","alpha","BIG_ENDIAN","Uint8Array","Uint32Array","buffer","console","warn","color","palette","Number","MAX_SAFE_INTEGER","idx","i","length","dr","dg","db","d","h","l","s","v","HLStoRGB","p","push","decodeAsync","decode","Decoder","DecoderAsync","Colors_1","__webpack_require__","wasm_1","WASM_BYTES","Buffer","from","bytestring","atob","result","charCodeAt","decodeBase64","LIMITS","BYTES","WASM_MODULE","NULL_CANVAS","CallbackProxy","constructor","this","bandHandler","width","modeHandler","mode","handle_band","mode_parsed","DEFAULT_OPTIONS","memoryLimit","sixelColor","fillColor","paletteLimit","PALETTE_SIZE","truncate","opts","cbProxy","importObj","env","bind","WebAssembly","instantiate","then","inst","instance","_instance","_cbProxy","_PIXEL_OFFSET","MAX_WIDTH","_canvas","_bandWidths","_maxWidth","_minWidth","_lastOffset","_currentHeight","_opts","assign","Error","_handle_band","_initCanvas","Module","Instance","_wasm","_chunk","memory","get_chunk_address","CHUNK_SIZE","_states","get_state_address","_palette","get_palette_address","set","_pSrc","get_p0_address","init","_fillColor","_truncate","_rasterWidth","_rasterHeight","_width","_height","_level","_mode","_paletteLimit","pixels","height","release","_realloc","offset","additionalPixels","newCanvas","ceil","adv","remaining","subarray","current_width","current_height","memoryUsage","byteLength","properties","level","memUsage","rasterAttributes","numerator","denominator","data","start","end","decodeString","j","data32","currentWidth","fill","escape","final","finalOffset","bw","currentHeight","data8","Uint8ClampedArray","dec","async","Lifecycle_1","EventUtils","_listeners","_disposed","event","_event","listener","thisArgs","disposables","toDisposable","entry","fn","slice","indexOf","splice","Array","isArray","add","fire","call","listeners","len","dispose","forward","to","e","map","undefined","any","events","store","DisposableStore","runAndSubscribe","handler","initial","arg","_disposables","Set","_isDisposed","isDisposed","o","clear","Disposable","_store","_register","None","freeze","_value","ImageRenderer_1","ImageStorage_1","Base64Decoder_wasm_1","__importDefault","QoiDecoder_wasm_1","IIPHeaderParser_1","IIPMetrics_1","DEFAULT_HEADER","type","name","size","preserveAspectRatio","inline","_renderer","_storage","_coreTerminal","_aborted","_hp","HeaderParser","_header","_isMultipart","_abortMulti","maxEncodedBytes","iipSizeLimit","initialBytes","_dec","default","_qoiDec","reset","put","state","dataPos","parse","fields","success","seqType","w","CELL_SIZE_DEFAULT","dimensions","css","canvas","cols","rows","scale","_c","_a","_core","_coreBrowserService","dpr","report","toFixed","input","cond","blob","metrics","UNSUPPORTED_TYPE","imageType","mime","pixelLimit","_resize","floor","ImageData","byteOffset","ImageRenderer","createCanvas","_b","getContext","putImageData","addImage","Blob","createImageBitmap","resizeWidth","resizeHeight","bm","catch","cw","cell","ch","_d","rw","_dim","rh","wf","hf","f","total","cdim","endsWith","parseInt","toStr","String","fromCharCode","toInt","toSize","match","DECODERS","toString","bs","TextDecoder","FILE_MARKER","MULTIPARTFILE_MARKER","FILEPART_MARKER","FILEEND_MARKER","REPORTCELLSIZE_MARKER","MAX_FIELDCHARS","_buffer","_position","_key","k","_storeValue","pos","_storeKey","_addImageOpts","scrolling","layer","zIndex","cursorPos","img","d32","blockLength","jpgSize","dim","limit","_layers","get","localDocument","document","createElement","createImageData","ctx","imgData","Promise","resolve","_terminal","super","Map","_optionsRefresh","MutableDisposable","_oldOpen","open","parent","_open","screenElement","optionsService","onOptionChange","option","rescaleCanvas","_renderService","refreshRows","removeLayerFromDom","_oldSetRenderer","setRenderer","_placeholderBitmap","close","_placeholder","showPlaceholder","cellSize","_createPlaceHolder","clearLines","y","clearRect","_e","clearAll","draw","imgSpec","tileId","col","row","count","_rescaleImage","actual","sx","sy","dx","dy","finalWidth","finalHeight","drawImage","extractTile","drawPlaceholder","values","spec","actualCellSize","originalWidth","originalHeight","origCellSize","orig","renderer","key","keys","insertLayerToDom","has","classList","style","isolation","insertBefore","firstChild","appendChild","remove","delete","hasLayer","bWidth","blueprint","black","white","shift","x","screen","ctx2","bitmap","window","ExtendedAttrsImage","ext","_urlId","_ext","underlineStyle","underlineColor","underlineVariantOffset","val","urlId","imageId","clone","isEmpty","EMPTY_ATTRS","_images","_lastId","_lowestId","_fullyCleared","_needsFullClear","_pixelLimit","setLimit","storageLimit","error","message","getLimit","_viewportMetrics","marker","RangeError","_evictOldest","getUsage","_getStoredPixels","storedPixels","_delImg","id","ImageBitmap","onImageDeleted","wipeAlternate","zero","entries","bufferType","deleteImage","termCols","termRows","originX","originY","tileCount","_inputHandler","_dirtyRowTracker","markDirty","line","lines","ybase","_writeToCell","lineFeed","endMarker","registerMarker","onDispose","active","_evictOnAlternate","onImageAdded","render","range","hasTopImages","hasBottomImages","drawCalls","placeholderCalls","ydisp","getBg","_extendedAttrs","startTile","startCol","sort","viewportResize","oldCol","tilesPerRow","hasData","rightCol","_data","lastTile","expandCol","getImageAtBufferCell","extractTileAtBufferCell","room","used","current","old","oldSpec","imgId","Decoder_1","DEFAULT_PALETTE","convertLe","_size","sixelPaletteLimit","hook","params","attr","colors","bg","isInverse","isFgDefault","foreground","rgba","isFgRGB","t","toColorRGB","getFgColor","ansi","isBgDefault","background","isBgRGB","getBgColor","extractActiveBg","_curAttrData","_themeService","sixelSizeLimit","unhook","advanceCursor","sixelScrolling","KittyGraphicsTypes_1","_kittyStorage","_decodeError","_activeDecoder","_inControlData","_controlData","_controlLength","_encodedSizeLimit","_totalEncodedSize","_parsedCommand","_pendingTransmissions","_maxEncodedBytes","kittySizeLimit","_initialEncodedBytes","_cleanupAllPending","_removePendingEntry","_lastPendingKey","pending","decoder","controlEnd","copyLength","parseKittyCommand","_parseControlDataString","imageNumber","_sendResponse","quiet","action","payloadStart","_streamPayload","pendingKey","previousEncodedSize","totalEncodedSize","decoderToRelease","_handleNoPayloadCommand","cmd","_handleDelete","isMoreComing","more","decodeError","finalCmd","imageBytes","_handleCommandWithBytesAndCmd","str","fromCodePoint","_handlePlacement","bytes","_handleTransmit","transmission","_handleTransmitDisplay","_handleQuery","image","getImage","_displayImage","placementId","storeImage","format","compression","_f","lastImageId","expectedBytes","deleteSelector","deleteAll","deleteById","isOk","response","coreService","triggerDataEvent","_decodeAndDisplay","_createBitmap","cropX","cropY","cropW","sourceWidth","cropH","sourceHeight","maxCropW","maxCropH","finalCropW","finalCropH","cropped","imgCols","imgRows","columns","savedX","savedY","savedYbase","scaled","xOffset","yOffset","canvasW","canvasH","offsetCanvas","offsetCtx","offsetBitmap","_g","cursorMovement","scrolled","arrayBuffer","_decompressZlib","url","URL","createObjectURL","Image","reject","addEventListener","revokeObjectURL","src","pixelCount","src32","dst32","alignedPixels","srcOffset","dstOffset","b0","b1","b2","srcByte","dstByte","compressed","_decompress","ds","DecompressionStream","writer","writable","getWriter","write","chunks","reader","readable","getReader","done","read","totalLength","reduce","sum","chunk","images","_kittyIdToStorageId","kittyIdToStorageId","pendingTransmissions","parts","split","part","eqIdx","substring","numValue","KittyImageStorage","_nextImageId","_storageIdToKittyId","_handleStorageImageDeleted","storageId","kittyId","_previousOnImageDeleted","_wrappedOnImageDeleted","imageData","oldStorageId","_maxStoredImages","_evictUndisplayedImages","wasmDecode","InWasm","MAP","el","D","EMPTY","keepSize","maxBytes","_inst","_ended","_bytes","_m32","_mem","m","grow","Memory","requested","needed","newSize","addPages","loadedBytes","freeBytes","wasmQoiDecode","ib","dl","chunkP","def","W","z","compile","_wasmCtx","fromBase64","__webpack_module_cache__","moduleId","cachedModule","__webpack_modules__","Event_1","IIPHandler_1","KittyGraphicsHandler_1","KittyImageStorage_1","SixelHandler_1","SixelImageStorage_1","IIPImageStorage_1","enableSizeReports","sixelSupport","iipSupport","kittySupport","_handlers","_onImageAdded","Emitter","_defaultOpts","obj","_disposeLater","args","activate","terminal","ImageStorage","windowOps","options","windowOptions","getWinSizePixels","getCellSizePixels","getWinSizeChars","parser","registerCsiHandler","prefix","_decset","_decrst","_da1","_xtermGraphicsAttributes","onRender","intermediates","registerEscHandler","onRequestReset","onBufferChange","onResize","sixelStorage","SixelImageStorage","sixelHandler","SixelHandler","_parser","registerDcsHandler","iipStorage","IIPImageStorage","iipHandler","IIPHandler","registerOscHandler","kittyStorage","kittyHandler","KittyGraphicsHandler","registerApcHandler","storageUsage","_report","sqrt"],"sourceRoot":""}
 \ No newline at end of file
-+{"version":3,"file":"addon-image.js","mappings":";CAAA,SAAAA,EAAAC,GACA,iBAAAC,SAAA,iBAAAC,OACAA,OAAAD,QAAAD,IACA,mBAAAG,QAAAA,OAAAC,IACAD,OAAA,GAAAH,GACA,iBAAAC,QACAA,QAAA,WAAAD,IAEAD,EAAA,WAAAC,GACC,CATD,CASCK,WAAA,uCCKD,SAAAC,EAAAC,GACA,WAAAA,CACA,CAEA,SAAAC,EAAAD,GACA,OAAAA,IAAA,KACA,CAEA,SAAAE,EAAAF,GACA,OAAAA,IAAA,MACA,CASA,SAAAG,EAAAC,EAAAC,EAAAC,EAAAC,EAAA,KACA,YAAAA,IAAA,QAAAD,IAAA,QAAAD,IAAA,MAAAD,KAAA,CACA,CAqCA,SAAAI,EAAAC,EAAAC,EAAAC,GACA,OAAAC,KAAAC,IAAAJ,EAAAG,KAAAE,IAAAH,EAAAD,GACA,CACA,SAAAK,EAAAC,EAAAC,EAAAC,GAKA,OAJAA,EAAA,IACAA,GAAA,GACAA,EAAA,IACAA,GAAA,GACA,EAAAA,EAAA,EACAD,EAAA,GAAAD,EAAAC,GAAAC,EACA,EAAAA,EAAA,EACAF,EACA,EAAAE,EAAA,EACAD,GAAAD,EAAAC,IAAA,IAAAC,GACAD,CACA,CAaA,SAAAE,EAAAf,EAAAC,EAAAC,GACA,kBAAAM,KAAAQ,MAAAd,EAAA,aAAAM,KAAAQ,MAAAf,EAAA,YAAAO,KAAAQ,MAAAhB,EAAA,aACA,CAjGAiB,OAAAC,eAAA5B,EAAA,cAA+CiB,OAAA,IAC/CjB,EAAA6B,mBAA6B7B,EAAA8B,mBAA6B9B,EAAA+B,iBAA2B/B,EAAAgC,mBAA6BhC,EAAAiC,oBAA8BjC,EAAAkC,aAAuBlC,EAAAyB,aAAuBzB,EAAAmC,kBAA4BnC,EAAAoC,aAAuBpC,EAAAS,WAAqBT,EAAAqC,MAAgBrC,EAAAQ,KAAeR,EAAAO,MAAgBP,EAAAK,IAAcL,EAAAsC,gBAAkB,EAGrVtC,EAAAsC,WAAkB,UAAAC,WAAA,IAAAC,YAAA,cAAAC,QAAA,GAClBzC,EAAAsC,YACAI,QAAAC,KAAA,+EAMA3C,EAAAK,IAAWA,EAIXL,EAAAO,MAAaA,EAIbP,EAAAQ,KAAYA,EAIZR,EAAAqC,MAHA,SAAA/B,GACA,OAAAA,IAAA,MACA,EAQAN,EAAAS,WAAkBA,EAOlBT,EAAAoC,aAHA,SAAAQ,GACA,WAAAA,EAAAA,GAAA,MAAAA,GAAA,OAAAA,IAAA,GACA,EA2BA5C,EAAAmC,kBArBA,SAAAS,EAAAC,GACA,MAAAnC,EAAAL,EAAAuC,GACAjC,EAAAJ,EAAAqC,GACAhC,EAAAJ,EAAAoC,GACA,IAAAxB,EAAA0B,OAAAC,iBACAC,GAAA,EAEA,QAAAC,EAAA,EAAoBA,EAAAJ,EAAAK,SAAoBD,EAAA,CACxC,MAAAE,EAAAzC,EAAAmC,EAAAI,GAAA,GACAG,EAAAzC,EAAAkC,EAAAI,GAAA,GACAI,EAAAzC,EAAAiC,EAAAI,GAAA,GACAK,EAAAH,EAAAA,EAAAC,EAAAA,EAAAC,EAAAA,EACA,IAAAC,EACA,OAAAL,EACAK,EAAAlC,IACAA,EAAAkC,EACAN,EAAAC,EAEA,CACA,OAAAD,CACA,EAmCAhD,EAAAyB,aAAoBA,EAQpBzB,EAAAkC,aAJA,SAAAqB,EAAAC,EAAAC,GAEA,OArBA,SAAAF,EAAAC,EAAAC,GACA,IAAAA,EAAA,CACA,MAAAC,EAAAxC,KAAAQ,MAAA,IAAA8B,GACA,OAAA/C,EAAAiD,EAAAA,EAAAA,EACA,CACA,MAAApC,EAAAkC,EAAA,GAAAA,GAAA,EAAAC,GAAAD,EAAAC,EAAAD,EAAAC,EACAlC,EAAA,EAAAiC,EAAAlC,EACA,OAAAb,EAAAK,EAAA,MAAAI,KAAAQ,MAAA,IAAAL,EAAAC,EAAAC,EAAAgC,EAAA,OAAAzC,EAAA,MAAAI,KAAAQ,MAAA,IAAAL,EAAAC,EAAAC,EAAAgC,KAAAzC,EAAA,MAAAI,KAAAQ,MAAA,IAAAL,EAAAC,EAAAC,EAAAgC,EAAA,OACA,CAaAI,EAAAJ,EAAA,SAAAC,EAAA,IAAAC,EAAA,IACA,EA+BAzD,EAAAiC,oBAA2B,IAAAO,YAAA,CAC3Bf,EAAA,OACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,YA0BAzB,EAAAgC,mBAA0B,IAAAQ,YAAA,CAC1Bf,EAAA,OACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,OACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,OACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,OACAA,EAAA,UACAA,EAAA,UACAA,EAAA,YAOAzB,EAAA+B,iBAAwB,MAExB,MAAA6B,EAAA,CACAnD,EAAA,OACAA,EAAA,SACAA,EAAA,SACAA,EAAA,WACAA,EAAA,SACAA,EAAA,WACAA,EAAA,WACAA,EAAA,aACAA,EAAA,aACAA,EAAA,SACAA,EAAA,SACAA,EAAA,WACAA,EAAA,WACAA,EAAA,WACAA,EAAA,WACAA,EAAA,cAGA6C,EAAA,uBACA,QAAA5C,EAAA,EAAoBA,EAAA,IAAOA,EAC3B,QAAAC,EAAA,EAAwBA,EAAA,IAAOA,EAC/B,QAAAC,EAAA,EAA4BA,EAAA,IAAOA,EACnCgD,EAAAC,KAAApD,EAAA6C,EAAA5C,GAAA4C,EAAA3C,GAAA2C,EAAA1C,KAKA,QAAA8C,EAAA,EAAoBA,GAAA,IAAUA,GAAA,GAC9BE,EAAAC,KAAApD,EAAAiD,EAAAA,EAAAA,IAEA,WAAAlB,YAAAoB,EACC,EAlCuB,GA0CxB5D,EAAA8B,mBAA0BrB,EAAA,WAC1BT,EAAA6B,mBAA0BpB,EAAA,6BCpP1BkB,OAAAC,eAAA5B,EAAA,cAA+CiB,OAAA,IAC/CjB,EAAA8D,YAAsB9D,EAAA+D,OAAiB/D,EAAAgE,QAAkBhE,EAAAiE,kBAAoB,EAC7E,MAAAC,EAAiBC,EAAQ,KACzBC,EAAeD,EAAQ,KAavBE,EAXA,SAAAZ,GACA,uBAAAa,OACA,OAAAA,OAAAC,KAAAd,EAAA,UAEA,MAAAe,EAAAC,KAAAhB,GACAiB,EAAA,IAAAnC,WAAAiC,EAAAtB,QACA,QAAAD,EAAA,EAAoBA,EAAAyB,EAAAxB,SAAmBD,EACvCyB,EAAAzB,GAAAuB,EAAAG,WAAA1B,GAEA,OAAAyB,CACA,CACAE,CAAAR,EAAAS,OAAAC,OACA,IAAAC,EAEA,MAAAC,EAAA,IAAAxC,YAEA,MAAAyC,EACA,WAAAC,GACAC,KAAAC,YAAAC,GAAA,EACAF,KAAAG,YAAAC,GAAA,CACA,CACA,WAAAC,CAAAH,GACA,OAAAF,KAAAC,YAAAC,EACA,CACA,WAAAI,CAAAF,GACA,OAAAJ,KAAAG,YAAAC,EACA,EAGA,MAAAG,EAAA,CACAC,YAAA,UACAC,WAAA1B,EAAArC,mBACAgE,UAAA3B,EAAApC,mBACAe,QAAAqB,EAAAjC,oBACA6D,aAAA1B,EAAAS,OAAAkB,aACAC,UAAA,GAMA,SAAA/B,EAAAgC,GACA,MAAAC,EAAA,IAAAjB,EACAkB,EAAA,CACAC,IAAA,CACAZ,YAAAU,EAAAV,YAAAa,KAAAH,GACAT,YAAAS,EAAAT,YAAAY,KAAAH,KAGA,OAAAI,YAAAC,YAAAxB,GAAAV,EAAA8B,GACAK,KAAAC,IACA1B,EAAAA,GAAA0B,EAAAxG,OACA,IAAA+D,EAAAiC,EAAAQ,EAAAC,UAAAD,EAAAP,IAEA,CACAlG,EAAAiE,aAAoBA,EAiCpB,MAAAD,EAKA,WAAAkB,CAAAe,EAAAU,EAAAC,GASA,GARAzB,KAAA0B,cAAAzC,EAAAS,OAAAiC,UAAA,EACA3B,KAAA4B,QAAA/B,EACAG,KAAA6B,YAAA,GACA7B,KAAA8B,UAAA,EACA9B,KAAA+B,UAAA9C,EAAAS,OAAAiC,UACA3B,KAAAgC,YAAA,EACAhC,KAAAiC,eAAA,EACAjC,KAAAkC,MAAA1F,OAAA2F,OAAA,GAAqC5B,EAAAO,GACrCd,KAAAkC,MAAAvB,aAAA1B,EAAAS,OAAAkB,aACA,UAAAwB,MAAA,+CAA2EnD,EAAAS,OAAAkB,gBAE3E,GAAAY,EAUAC,EAAAxB,YAAAD,KAAAqC,aAAAnB,KAAAlB,MACAyB,EAAAtB,YAAAH,KAAAsC,YAAApB,KAAAlB,UAXA,CACA,MAAAlF,EAAA8E,IAAAA,EAAA,IAAAuB,YAAAoB,OAAArD,IACAsC,EAAA,IAAAL,YAAAqB,SAAA1H,EAAA,CACAmG,IAAA,CACAZ,YAAAL,KAAAqC,aAAAnB,KAAAlB,MACAM,YAAAN,KAAAsC,YAAApB,KAAAlB,QAGA,CAKAA,KAAAwB,UAAAA,EACAxB,KAAAyC,MAAAzC,KAAAwB,UAAA3G,QACAmF,KAAA0C,OAAA,IAAAtF,WAAA4C,KAAAyC,MAAAE,OAAArF,OAAA0C,KAAAyC,MAAAG,oBAAA3D,EAAAS,OAAAmD,YACA7C,KAAA8C,QAAA,IAAAzF,YAAA2C,KAAAyC,MAAAE,OAAArF,OAAA0C,KAAAyC,MAAAM,oBAAA,IACA/C,KAAAgD,SAAA,IAAA3F,YAAA2C,KAAAyC,MAAAE,OAAArF,OAAA0C,KAAAyC,MAAAQ,sBAAAhE,EAAAS,OAAAkB,cACAZ,KAAAgD,SAAAE,IAAAlD,KAAAkC,MAAAxE,SACAsC,KAAAmD,MAAA,IAAA9F,YAAA2C,KAAAyC,MAAAE,OAAArF,OAAA0C,KAAAyC,MAAAW,kBACApD,KAAAyC,MAAAY,KAAAtE,EAAArC,mBAAA,EAAAsD,KAAAkC,MAAAvB,aAAA,EACA,CAEA,cAAA2C,GAAuB,OAAAtD,KAAA8C,QAAA,GACvB,aAAAS,GAAsB,OAAAvD,KAAA8C,QAAA,GACtB,gBAAAU,GAAyB,OAAAxD,KAAA8C,QAAA,GACzB,iBAAAW,GAA0B,OAAAzD,KAAA8C,QAAA,GAC1B,UAAAY,GAAmB,OAAA1D,KAAA8C,QAAA,GAAA9C,KAAA8C,QAAA,OACnB,WAAAa,GAAoB,OAAA3D,KAAA8C,QAAA,GACpB,UAAAc,GAAmB,OAAA5D,KAAA8C,QAAA,GACnB,SAAAe,GAAkB,OAAA7D,KAAA8C,QAAA,IAClB,iBAAAgB,GAA0B,OAAA9D,KAAA8C,QAAA,IAC1B,WAAAR,CAAAlC,GACA,OAAAA,EAAA,CACA,MAAA2D,EAAA/D,KAAAE,MAAAF,KAAAgE,OACA,GAAAD,EAAA/D,KAAA4B,QAAA7D,OAAA,CACA,GAAAiC,KAAAkC,MAAA1B,aAAA,EAAAuD,EAAA/D,KAAAkC,MAAA1B,YAEA,MADAR,KAAAiE,UACA,IAAA7B,MAAA,8BAEApC,KAAA4B,QAAA,IAAAvE,YAAA0G,EACA,CACA/D,KAAA8B,UAAA9B,KAAA0D,MACA,MACA,OAAAtD,EACA,OAAAJ,KAAA4D,OAAA,CAEA,MAAAG,EAAAhI,KAAAE,IAAA+D,KAAAwD,aAAAvE,EAAAS,OAAAiC,WAAA3B,KAAAyD,cACA,GAAAM,EAAA/D,KAAA4B,QAAA7D,OAAA,CACA,GAAAiC,KAAAkC,MAAA1B,aAAA,EAAAuD,EAAA/D,KAAAkC,MAAA1B,YAEA,MADAR,KAAAiE,UACA,IAAA7B,MAAA,8BAEApC,KAAA4B,QAAA,IAAAvE,YAAA0G,EACA,CACA,MAGA/D,KAAA4B,QAAA7D,OAAA,QACAiC,KAAA4B,QAAA,IAAAvE,YAAA,QAIA,QACA,CACA,QAAA6G,CAAAC,EAAAC,GACA,MAAAL,EAAAI,EAAAC,EACA,GAAAL,EAAA/D,KAAA4B,QAAA7D,OAAA,CACA,GAAAiC,KAAAkC,MAAA1B,aAAA,EAAAuD,EAAA/D,KAAAkC,MAAA1B,YAEA,MADAR,KAAAiE,UACA,IAAA7B,MAAA,8BAGA,MAAAiC,EAAA,IAAAhH,YAAA,MAAAtB,KAAAuI,KAAAP,EAAA,QACAM,EAAAnB,IAAAlD,KAAA4B,SACA5B,KAAA4B,QAAAyC,CACA,CACA,CACA,YAAAhC,CAAAnC,GACA,MAAAqE,EAAAvE,KAAA0B,cACA,IAAAyC,EAAAnE,KAAAgC,YACA,OAAAhC,KAAA6D,MAAA,CACA,IAAAW,EAAAxE,KAAAgE,OAAAhE,KAAAiC,eACA5F,EAAA,EACA,KAAAA,EAAA,GAAAmI,EAAA,GACAxE,KAAA4B,QAAAsB,IAAAlD,KAAAmD,MAAAsB,SAAAF,EAAAlI,EAAAkI,EAAAlI,EAAA6D,GAAAiE,EAAAjE,EAAA7D,GACAA,IACAmI,IAEAxE,KAAAgC,aAAA9B,EAAA7D,EACA2D,KAAAiC,gBAAA5F,CACA,MACA,OAAA2D,KAAA6D,MAAA,CACA7D,KAAAkE,SAAAC,EAAA,EAAAjE,GACAF,KAAA8B,UAAA/F,KAAAC,IAAAgE,KAAA8B,UAAA5B,GACAF,KAAA+B,UAAAhG,KAAAE,IAAA+D,KAAA+B,UAAA7B,GACA,QAAApC,EAAA,EAA4BA,EAAA,IAAOA,EACnCkC,KAAA4B,QAAAsB,IAAAlD,KAAAmD,MAAAsB,SAAAF,EAAAzG,EAAAyG,EAAAzG,EAAAoC,GAAAiE,EAAAjE,EAAApC,GAEAkC,KAAA6B,YAAAnD,KAAAwB,GACAF,KAAAgC,aAAA,EAAA9B,EACAF,KAAAiC,gBAAA,CACA,CACA,QACA,CAMA,SAAA/B,GACA,WAAAF,KAAA6D,MACA7D,KAAA0D,OACA3H,KAAAC,IAAAgE,KAAA8B,UAAA9B,KAAAyC,MAAAiC,gBACA,CAMA,UAAAV,GACA,WAAAhE,KAAA6D,MACA7D,KAAA2D,QACA3D,KAAAyC,MAAAiC,gBACA,EAAA1E,KAAA6B,YAAA9D,OAAAiC,KAAAyC,MAAAkC,iBACA,EAAA3E,KAAA6B,YAAA9D,MACA,CAIA,WAAAL,GACA,OAAAsC,KAAAgD,SAAAyB,SAAA,EAAAzE,KAAA8D,cACA,CAUA,eAAAc,GACA,OAAA5E,KAAA4B,QAAAiD,WAAA7E,KAAAyC,MAAAE,OAAArF,OAAAuH,WAAA,EAAA7E,KAAA6B,YAAA9D,MACA,CAIA,cAAA+G,GACA,OACA5E,MAAAF,KAAAE,MACA8D,OAAAhE,KAAAgE,OACA5D,KAAAJ,KAAA6D,MACAkB,MAAA/E,KAAA4D,OACA/C,WAAAb,KAAAuD,UACA5C,aAAAX,KAAA8D,cACApD,UAAAV,KAAAsD,WACA0B,SAAAhF,KAAA4E,YACAK,iBAAA,CACAC,UAAAlF,KAAA8C,QAAA,GACAqC,YAAAnF,KAAA8C,QAAA,GACA5C,MAAAF,KAAAwD,aACAQ,OAAAhE,KAAAyD,eAGA,CAMA,IAAAJ,CAAA3C,EAAAV,KAAAkC,MAAAxB,UAAAhD,EAAAsC,KAAAkC,MAAAxE,QAAAiD,EAAAX,KAAAkC,MAAAvB,aAAAE,EAAAb,KAAAkC,MAAArB,UACAb,KAAAyC,MAAAY,KAAArD,KAAAkC,MAAAzB,WAAAC,EAAAC,EAAAE,EAAA,KACAnD,GACAsC,KAAAgD,SAAAE,IAAAxF,EAAA+G,SAAA,EAAAxF,EAAAS,OAAAkB,eAEAZ,KAAA6B,YAAA9D,OAAA,EACAiC,KAAA8B,UAAA,EACA9B,KAAA+B,UAAA9C,EAAAS,OAAAiC,UACA3B,KAAAgC,YAAA,EACAhC,KAAAiC,eAAA,CACA,CAKA,MAAArD,CAAAwG,EAAAC,EAAA,EAAAC,EAAAF,EAAArH,QACA,IAAAU,EAAA4G,EACA,KAAA5G,EAAA6G,GAAA,CACA,MAAAvH,EAAAhC,KAAAE,IAAAqJ,EAAA7G,EAAAQ,EAAAS,OAAAmD,YACA7C,KAAA0C,OAAAQ,IAAAkC,EAAAX,SAAAhG,EAAAA,GAAAV,IACAiC,KAAAyC,MAAA7D,OAAA,EAAAb,EACA,CACA,CAMA,YAAAwH,CAAAH,EAAAC,EAAA,EAAAC,EAAAF,EAAArH,QACA,IAAAU,EAAA4G,EACA,KAAA5G,EAAA6G,GAAA,CACA,MAAAvH,EAAAhC,KAAAE,IAAAqJ,EAAA7G,EAAAQ,EAAAS,OAAAmD,YACA,QAAA/E,EAAA,EAAA0H,EAAA/G,EAAmCX,EAAAC,IAAYD,IAAA0H,EAC/CxF,KAAA0C,OAAA5E,GAAAsH,EAAA5F,WAAAgG,GAEA/G,GAAAV,EACAiC,KAAAyC,MAAA7D,OAAA,EAAAb,EACA,CACA,CAKA,UAAA0H,GACA,OAAAzF,KAAA6D,QAAA7D,KAAAE,QAAAF,KAAAgE,OACA,OAAAnE,EAGA,MAAA6F,EAAA1F,KAAAyC,MAAAiC,gBACA,OAAA1E,KAAA6D,MAAA,CACA,IAAAW,EAAAxE,KAAAgE,OAAAhE,KAAAiC,eACA,GAAAuC,EAAA,GACA,MAAAD,EAAAvE,KAAA0B,cACA,IAAAyC,EAAAnE,KAAAgC,YACA3F,EAAA,EACA,KAAAA,EAAA,GAAAmI,EAAA,GACAxE,KAAA4B,QAAAsB,IAAAlD,KAAAmD,MAAAsB,SAAAF,EAAAlI,EAAAkI,EAAAlI,EAAAqJ,GAAAvB,EAAAuB,EAAArJ,GACAA,IACAmI,IAEAA,GACAxE,KAAA4B,QAAA+D,KAAA3F,KAAAsD,WAAAa,EAAAuB,EAAArJ,EAEA,CACA,OAAA2D,KAAA4B,QAAA6C,SAAA,EAAAzE,KAAAE,MAAAF,KAAAgE,OACA,CACA,OAAAhE,KAAA6D,MAAA,CACA,GAAA7D,KAAA+B,YAAA/B,KAAA8B,UAAA,CACA,IAAA8D,GAAA,EACA,GAAAF,EACA,GAAAA,IAAA1F,KAAA+B,UACA6D,GAAA,MAEA,CACA,MAAArB,EAAAvE,KAAA0B,cACA,IAAAyC,EAAAnE,KAAAgC,YACAhC,KAAAkE,SAAAC,EAAA,EAAAuB,GACA,QAAA5H,EAAA,EAAwCA,EAAA,IAAOA,EAC/CkC,KAAA4B,QAAAsB,IAAAlD,KAAAmD,MAAAsB,SAAAF,EAAAzG,EAAAyG,EAAAzG,EAAA4H,GAAAvB,EAAAuB,EAAA5H,EAEA,CAEA,IAAA8H,EACA,OAAA5F,KAAA4B,QAAA6C,SAAA,EAAAzE,KAAAE,MAAAF,KAAAgE,OAEA,CAGA,MAAA6B,EAAA,IAAAxI,YAAA2C,KAAAE,MAAAF,KAAAgE,QACA6B,EAAAF,KAAA3F,KAAAsD,YACA,IAAAwC,EAAA,EACAT,EAAA,EACA,QAAAvH,EAAA,EAA4BA,EAAAkC,KAAA6B,YAAA9D,SAA6BD,EAAA,CACzD,MAAAiI,EAAA/F,KAAA6B,YAAA/D,GACA,QAAAW,EAAA,EAAgCA,EAAA,IAAOA,EACvCoH,EAAA3C,IAAAlD,KAAA4B,QAAA6C,SAAAY,EAAAA,GAAAU,GAAAD,GACAA,GAAA9F,KAAAE,KAEA,CAEA,GAAAwF,EAAA,CACA,MAAAnB,EAAAvE,KAAA0B,cAEAsE,EAAAhG,KAAAyC,MAAAkC,iBACA,QAAA7G,EAAA,EAAgCA,EAAAkI,IAAmBlI,EACnD+H,EAAA3C,IAAAlD,KAAAmD,MAAAsB,SAAAF,EAAAzG,EAAAyG,EAAAzG,EAAA4H,GAAAI,EAAA9F,KAAAE,MAAApC,EAEA,CACA,OAAA+H,CACA,CAEA,OAAAhG,CACA,CAKA,SAAAoG,GACA,WAAAC,kBAAAlG,KAAAyF,OAAAnI,OAAA,EAAA0C,KAAAE,MAAAF,KAAAgE,OAAA,EACA,CAaA,OAAAC,GACAjE,KAAA4B,QAAA/B,EACAG,KAAA6B,YAAA9D,OAAA,EACAiC,KAAA8B,UAAA,EACA9B,KAAA+B,UAAA9C,EAAAS,OAAAiC,UAGA3B,KAAAyC,MAAAY,KAAAtE,EAAArC,mBAAA,EAAAsD,KAAAkC,MAAAvB,aAAA,EACA,EAEA9F,EAAAgE,QAAeA,EAyBfhE,EAAA+D,OAXA,SAAAwG,EAAAtE,GACA,MAAAqF,EAAA,IAAAtH,EAAAiC,GAGA,OAFAqF,EAAA9C,OACA,iBAAA+B,EAAAe,EAAAZ,aAAAH,GAAAe,EAAAvH,OAAAwG,GACA,CACAlF,MAAAiG,EAAAjG,MACA8D,OAAAmC,EAAAnC,OACAyB,OAAAU,EAAAV,OACAQ,MAAAE,EAAAF,MAEA,EAkBApL,EAAA8D,YAXAyH,eAAAhB,EAAAtE,GACA,MAAAqF,QAAArH,EAAAgC,GAGA,OAFAqF,EAAA9C,OACA,iBAAA+B,EAAAe,EAAAZ,aAAAH,GAAAe,EAAAvH,OAAAwG,GACA,CACAlF,MAAAiG,EAAAjG,MACA8D,OAAAmC,EAAAnC,OACAyB,OAAAU,EAAAV,OACAQ,MAAAE,EAAAF,MAEA,YCpdAzJ,OAAAC,eAAA5B,EAAA,cAA+CiB,OAAA,IAC/CjB,EAAA6E,YAAc,EACd7E,EAAA6E,OAAc,CACdmD,WAAA,MACAjC,aAAA,KACAe,UAAA,MACAhC,MAAA,+qdCCA,MAAA0G,EAAArH,EAAA,KAoEA,IAAiBsH,YA9DjB,iBAAAvG,GACUC,KAAAuG,WAAqD,GACrDvG,KAAAwG,WAAY,CA0DtB,CAvDE,SAAWC,GACT,OAAIzG,KAAK0G,SAGT1G,KAAK0G,OAAS,CAACC,EAAyBC,EAAgBC,KACtD,GAAI7G,KAAKwG,UACP,OAAO,EAAAH,EAAAS,cAAa,QAGtB,MAAMC,EAAQ,CAAEC,GAAIL,EAAUC,YAC9B5G,KAAKuG,WAAavG,KAAKuG,WAAWU,QAClCjH,KAAKuG,WAAW7H,KAAKqI,GAErB,MAAMxH,GAAS,EAAA8G,EAAAS,cAAa,KAC1B,MAAMjJ,EAAMmC,KAAKuG,WAAWW,QAAQH,IACvB,IAATlJ,IACFmC,KAAKuG,WAAavG,KAAKuG,WAAWU,QAClCjH,KAAKuG,WAAWY,OAAOtJ,EAAK,MAYhC,OARIgJ,IACEO,MAAMC,QAAQR,GAChBA,EAAYnI,KAAKa,GAEjBsH,EAAYS,IAAI/H,IAIbA,IA3BAS,KAAK0G,MA8BhB,CAEO,IAAAa,CAAKd,GACV,GAAIzG,KAAKwG,YAAcxG,KAAKuG,WAAWxI,OACrC,OAEF,GAA+B,IAA3BiC,KAAKuG,WAAWxI,OAElB,YADAiC,KAAKuG,WAAW,GAAGS,GAAGQ,KAAKxH,KAAKuG,WAAW,GAAGK,SAAUH,GAG1D,MAAMgB,EAAYzH,KAAKuG,WACvB,IAAK,IAAIzI,EAAI,EAAG4J,EAAMD,EAAU1J,OAAQD,EAAI4J,IAAO5J,EACjD2J,EAAU3J,GAAGkJ,GAAGQ,KAAKC,EAAU3J,GAAG8I,SAAUH,EAEhD,CAEO,OAAAkB,GACD3H,KAAKwG,YAGTxG,KAAKwG,WAAY,EACjBxG,KAAKuG,WAAWxI,OAAS,EAC3B,GAGF,SAAiBuI,GACCA,EAAAsB,QAAhB,SAA2BxI,EAAiByI,GAC1C,OAAOzI,EAAK0I,GAAKD,EAAGN,KAAKO,GAC3B,EAEgBxB,EAAAyB,IAAhB,SAA0BtB,EAAkBsB,GAC1C,MAAO,CAACpB,EAAyBC,EAAgBC,IACxCJ,EAAM3I,GAAK6I,EAASa,KAAKZ,EAAUmB,EAAIjK,SAAKkK,EAAWnB,EAElE,EAIgBP,EAAA2B,IAAhB,YAA0BC,GACxB,MAAO,CAACvB,EAAyBC,EAAgBC,KAC/C,MAAMsB,EAAQ,IAAI9B,EAAA+B,gBAClB,IAAK,MAAM3B,KAASyB,EAClBC,EAAMb,IAAIb,EAAMqB,GAAKnB,EAASa,KAAKZ,EAAUkB,KAS/C,OAPIjB,IACEO,MAAMC,QAAQR,GAChBA,EAAYnI,KAAKyJ,GAEjBtB,EAAYS,IAAIa,IAGbA,EAEX,EAIgB7B,EAAA+B,gBAAhB,SAAmC5B,EAAkB6B,EAAqCC,GAExF,OADAD,EAAQC,GACD9B,EAAMqB,GAAKQ,EAAQR,GAC5B,CACD,CApCD,CAAiBxB,IAAUzL,EAAAyL,WAAVA,EAAU,eChE3B,SAAAQ,EAA6BE,GAC3B,MAAO,CAAEW,QAASX,EACpB,CAKA,SAAAW,EAA+Ca,GAC7C,IAAKA,EACH,OAAOA,EAET,GAAIpB,MAAMC,QAAQmB,GAAM,CACtB,IAAK,MAAMrK,KAAKqK,EACdrK,EAAEwJ,UAEJ,MAAO,EACT,CAEA,OADAa,EAAIb,UACGa,CACT,8JAEA,YAAsC3B,GACpC,OAAOC,EAAa,IAAMa,EAAQd,GACpC,EAEA,MAAAuB,EAAA,WAAArI,GACmBC,KAAAyI,aAAe,IAAIC,IAC5B1I,KAAA2I,aAAc,CAgCxB,CA9BE,cAAWC,GACT,OAAO5I,KAAK2I,WACd,CAEO,GAAArB,CAA2BuB,GAMhC,OALI7I,KAAK2I,YACPE,EAAElB,UAEF3H,KAAKyI,aAAanB,IAAIuB,GAEjBA,CACT,CAEO,OAAAlB,GACL,IAAI3H,KAAK2I,YAAT,CAGA3I,KAAK2I,aAAc,EACnB,IAAK,MAAMxK,KAAK6B,KAAKyI,aACnBtK,EAAEwJ,UAEJ3H,KAAKyI,aAAaK,OALlB,CAMF,CAEO,KAAAA,GACL,IAAK,MAAM3K,KAAK6B,KAAKyI,aACnBtK,EAAEwJ,UAEJ3H,KAAKyI,aAAaK,OACpB,sBAGF,MAAAC,EAAA,WAAAhJ,GAGqBC,KAAAgJ,OAAS,IAAIZ,CASlC,CAPS,OAAAT,GACL3H,KAAKgJ,OAAOrB,SACd,CAEU,SAAAsB,CAAiCJ,GACzC,OAAO7I,KAAKgJ,OAAO1B,IAAIuB,EACzB,iBAVuBE,EAAAG,KAAoB1M,OAAO2M,OAAO,CAAE,OAAAxB,GAAY,wBAazE,iBAAA5H,GAEUC,KAAA2I,aAAc,CAuBxB,CArBE,SAAW7M,GACT,OAAOkE,KAAK2I,iBAAcX,EAAYhI,KAAKoJ,MAC7C,CAEA,SAAWtN,CAAMA,GACXkE,KAAK2I,aAAe7M,IAAUkE,KAAKoJ,SAGvCpJ,KAAKoJ,QAAQzB,UACb3H,KAAKoJ,OAAStN,EAChB,CAEO,KAAAgN,GACL9I,KAAKlE,WAAQkM,CACf,CAEO,OAAAL,GACL3H,KAAK2I,aAAc,EACnB3I,KAAKoJ,QAAQzB,UACb3H,KAAKoJ,YAASpB,CAChB,wKC1GF,MAAAqB,EAAArK,EAAA,KAEAsK,EAAAtK,EAAA,KACAuK,EAAAC,EAAAxK,EAAA,MACAyK,EAAAD,EAAAxK,EAAA,KACA0K,EAAA1K,EAAA,KACA2K,EAAA3K,EAAA,KAaM4K,EAAgC,CACpCC,KAAI,EACJC,KAAM,eACNC,KAAM,EACN7J,MAAO,OACP8D,OAAQ,OACRgG,oBAAqB,EACrBC,OAAQ,gBAIV,MAUE,WAAAlK,CACmBmC,EACAgI,EACAC,EACAC,GAHApK,KAAAkC,MAAAA,EACAlC,KAAAkK,UAAAA,EACAlK,KAAAmK,SAAAA,EACAnK,KAAAoK,cAAAA,EAbXpK,KAAAqK,YAAc,EACdrK,KAAAsK,UAAW,EACXtK,KAAAuK,IAAM,IAAIb,EAAAc,aACVxK,KAAAyK,QAAyBb,EAGzB5J,KAAA0K,cAAe,EACf1K,KAAA2K,aAAc,EAQpB,MAAMC,EAAkB7O,KAAKuI,KAA+B,EAA1BtE,KAAKkC,MAAM2I,aAAmB,GAC1DC,EAAe/O,KAAKE,IAAG,QAA4B2O,GACzD5K,KAAK+K,KAAO,IAAIxB,EAAAyB,QAAa,QAAyBJ,EAAiBE,GACvE9K,KAAKiL,QAAU,IAAIxB,EAAAuB,QAAU,QAC/B,CAEO,KAAAE,GACLlL,KAAKqK,cACLrK,KAAKuK,IAAIW,QACTlL,KAAK+K,KAAK9G,UACVjE,KAAKiL,QAAQhH,SACf,CAEO,KAAAoB,GACLrF,KAAKsK,UAAW,EAChBtK,KAAKuK,IAAIW,OACX,CAEO,GAAAC,CAAI/F,EAAmBC,EAAeC,GAC3C,IAAItF,KAAKsK,SAET,GAAkB,IAAdtK,KAAKuK,IAAIa,MAC6C,IAAnDpL,KAAK+K,KAAKI,IAAI/F,EAAKX,SAASY,EAAOC,MACtCtF,KAAK+K,KAAK9G,UACVjE,KAAKsK,UAAW,OAEb,CACL,MAAMe,EAAUrL,KAAKuK,IAAIe,MAAMlG,EAAMC,EAAOC,GAC5C,IAAiB,IAAb+F,EAEF,YADArL,KAAKsK,UAAW,GAGlB,GAAIe,EAAU,EAAG,CAEf,GAAW,IADKrL,KAAKuK,IAAIgB,OAAO1B,KACG,CAOjC,GANI7J,KAAK0K,eACP1K,KAAK0K,cAAe,EACpB1K,KAAK2K,aAAc,EACnB3K,KAAK+K,KAAK9G,WAEZjE,KAAKyK,QAAUjO,OAAO2F,OAAO,GAAIyH,EAAgB5J,KAAKuK,IAAIgB,SACrDvL,KAAKyK,QAAQR,OAEhB,YADAjK,KAAKsK,UAAW,GAGlBtK,KAAK+K,KAAK1H,MACZ,MAAO,GAAIrD,KAAK2K,YAEd,YADA3K,KAAKsK,UAAW,GAGwC,IAArDtK,KAAK+K,KAAKI,IAAI/F,EAAKX,SAAS4G,EAAS/F,MACxCtF,KAAK+K,KAAK9G,UACVjE,KAAKsK,UAAW,EACZtK,KAAK0K,eAAc1K,KAAK2K,aAAc,GAE9C,CACF,CACF,CAEO,GAAArF,CAAIkG,aACT,GAAIxL,KAAKsK,SAAU,OAAO,EAE1B,GAAkB,IAAdtK,KAAKuK,IAAIa,OACPpL,KAAKuK,IAAIjF,MAAO,OAAO,EAE7B,MAAMmG,EAAUzL,KAAKuK,IAAIgB,OAAO1B,KAEhC,GAAW,IAAP4B,EAAmC,OAAO,EAE9C,GAAW,IAAPA,EAAyC,CAE3C,IAAIC,EAAIpC,EAAAqC,kBAAkBzL,MACtB9B,EAAIkL,EAAAqC,kBAAkB3H,OACtBhE,KAAKkK,UAAU0B,aACjBF,EAAI1L,KAAKkK,UAAU0B,WAAWC,IAAIC,OAAO5L,MAAQF,KAAKoK,cAAc2B,KACpE3N,EAAI4B,KAAKkK,UAAU0B,WAAWC,IAAIC,OAAO9H,OAAShE,KAAKoK,cAAc4B,MAEvE,MAAMC,EAAyD,QAApDC,EAA+C,QAA5CC,EAAAnM,KAAKoK,cAAcgC,MAAMC,2BAAmB,IAAAF,OAAA,EAAAA,EAAEG,WAAG,IAAAJ,EAAAA,EAAI,EAC7DK,EAAS,yBAA4BnO,EAAEoO,QAAQ,MAAMd,EAAEc,QAAQ,MAAMP,EAAMO,QAAQ,QAEzF,OADAxM,KAAKoK,cAAcqC,MAAMF,GAAQ,IAC1B,CACT,CAEA,GAAW,IAAPd,EAMF,OALAzL,KAAKyK,QAAUjO,OAAO2F,OAAO,GAAIyH,EAAgB5J,KAAKuK,IAAIgB,QAC1DvL,KAAK0K,cAAe,EACpB1K,KAAK2K,aAAc,EACnB3K,KAAK+K,KAAK9G,UACVjE,KAAK+K,KAAK1H,QACH,EAGT,GAAW,IAAPoI,EAAkC,CACpC,IAAKzL,KAAK0K,aAAc,OAAO,EAE/B,GADA1K,KAAK0K,cAAe,EAChB1K,KAAK2K,aAAgC,IAAjB3K,KAAKyK,QAAQZ,KAAqC,OAAO,CACnF,CAIA,IAII6C,EA0BAC,EA9BAjB,EAAI,EACJtN,EAAI,EAIJwO,EAAUjD,EAAAkD,iBAoBd,IAnBIH,EAAOlB,MACLkB,GAAQ1M,KAAK+K,KAAKzF,QACpBsH,GAAU,EAAAjD,EAAAmD,WAAU9M,KAAK+K,KAAK9E,QAC1ByG,EAAwB,gBAAjBE,EAAQG,OACjBrB,EAAIkB,EAAQ1M,MACZ9B,EAAIwO,EAAQ5I,QACR0I,EAAOhB,GAAKtN,GAAKsN,EAAItN,EAAI4B,KAAKkC,MAAM8K,cACrCtB,EAAGtN,GAAK4B,KAAKiN,QAAQvB,EAAGtN,GAAG2J,IAAIhM,KAAKmR,OACrCR,EAAOhB,GAAKtN,GAAKsN,EAAItN,EAAI4B,KAAKkC,MAAM8K,YAEpCzP,QAAQC,KAAK,8BAA8BoP,EAAQ1M,SAAS0M,EAAQ5I,WAGtEzG,QAAQC,KAAK,gCAGfD,QAAQC,KAAK,uCAGZkP,EAEH,OADA1M,KAAK+K,KAAK9G,WACH,EAIT,GAAqB,cAAjB2I,EAAQG,KAAsB,CAChC,MAAM3H,EAAOpF,KAAKiL,QAAQrM,OAAOoB,KAAK+K,KAAK9E,OAO3C,GANA0G,EAAO,IAAIQ,UACT,IAAIjH,kBAAkBd,EAAK9H,OAAQ8H,EAAKgI,WAAYhI,EAAKP,YACzD7E,KAAKiL,QAAQ/K,MACbF,KAAKiL,QAAQjH,QAEfhE,KAAKiL,QAAQhH,UACTyH,IAAM1L,KAAKiL,QAAQ/K,OAAS9B,IAAM4B,KAAKiL,QAAQjH,OAAQ,CAEzDhE,KAAK+K,KAAK9G,UACV,MAAM6H,EAASzC,EAAAgE,cAAcC,kBAAatF,EAAWhI,KAAKiL,QAAQ/K,MAAOF,KAAKiL,QAAQjH,QAGtF,OAFuB,QAAvBuJ,EAAAzB,EAAO0B,WAAW,aAAK,IAAAD,GAAAA,EAAEE,aAAad,EAAM,EAAG,GAC/C3M,KAAKmK,SAASuD,SAAS5B,IAChB,CACT,CACF,MACEa,EAAO,IAAIgB,KAAK,CAAC3N,KAAK+K,KAAK9E,OAAQ,CAAE4D,KAAM+C,EAAQG,OAErD/M,KAAK+K,KAAK9G,UACV,MAAM2J,EAAa5N,KAAKqK,YACxB,OAAOwD,kBAAkBlB,EAAM,CAAEmB,YAAapC,EAAGqC,aAAc3P,IAC5DiD,KAAK2M,GACAJ,IAAe5N,KAAKqK,aACtB2D,EAAGC,SACI,IAETjO,KAAKmK,SAASuD,SAASM,IAChB,IAERE,MAAMpG,IACLvK,QAAQC,KAAK,uBAAuBoP,EAAQG,QAAQH,EAAQ1M,SAAS0M,EAAQ5I,SAAU8D,IAChF,GAEb,CAEQ,OAAAmF,CAAQvB,EAAWtN,eACzB,MAAM+P,GAA8B,QAAzBhC,EAAAnM,KAAKkK,UAAU0B,kBAAU,IAAAO,OAAA,EAAAA,EAAEN,IAAIuC,KAAKlO,QAASoJ,EAAAqC,kBAAkBzL,MACpEmO,GAA8B,QAAzBd,EAAAvN,KAAKkK,UAAU0B,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIuC,KAAKpK,SAAUsF,EAAAqC,kBAAkB3H,OACrE9D,GAAiC,QAAzBgM,EAAAlM,KAAKkK,UAAU0B,kBAAU,IAAAM,OAAA,EAAAA,EAAEL,IAAIC,OAAO5L,QAASiO,EAAKnO,KAAKoK,cAAc2B,KAC/E/H,GAAkC,QAAzBsK,EAAAtO,KAAKkK,UAAU0B,kBAAU,IAAA0C,OAAA,EAAAA,EAAEzC,IAAIC,OAAO9H,SAAUqK,EAAKrO,KAAKoK,cAAc4B,KAEjFuC,EAAKvO,KAAKwO,KAAKxO,KAAKyK,QAAQvK,MAAQA,EAAOiO,GAC3CM,EAAKzO,KAAKwO,KAAKxO,KAAKyK,QAAQzG,OAASA,EAAQqK,GACnD,IAAKE,IAAOE,EAAI,CACd,MAAMC,EAAKxO,EAAQwL,EACbiD,GAAM3K,EAASqK,GAAMjQ,EACrBwQ,EAAI7S,KAAKE,IAAIyS,EAAIC,GACvB,OAAOC,EAAI,EAAI,CAAClD,EAAIkD,EAAGxQ,EAAIwQ,GAAK,CAAClD,EAAGtN,EACtC,CACA,OAAQmQ,GAEJvO,KAAKyK,QAAQT,qBAAwBuE,GAAOE,EACvB,CAACF,EAAIE,GAAxB,CAACF,EAAInQ,EAAImQ,EAAK7C,GAFhB,CAACA,EAAI+C,EAAKrQ,EAAGqQ,EAGnB,CAEQ,IAAAD,CAAKlQ,EAAWuQ,EAAeC,GACrC,MAAU,SAANxQ,EAAqB,EACrBA,EAAEyQ,SAAS,KAAaC,SAAS1Q,EAAE2I,MAAM,GAAI,GAAI,IAAM4H,EAAQ,IAC/DvQ,EAAEyQ,SAAS,MAAcC,SAAS1Q,EAAE2I,MAAM,GAAI,GAAI,IAC/C+H,SAAS1Q,EAAG,IAAMwQ,CAC3B,aC/LF,SAASG,EAAM7J,GACb,IAAI9G,EAAI,GACR,IAAK,IAAIR,EAAI,EAAGA,EAAIsH,EAAKrH,SAAUD,EACjCQ,GAAK4Q,OAAOC,aAAa/J,EAAKtH,IAEhC,OAAOQ,CACT,CAGA,SAAS8Q,EAAMhK,GACb,IAAI7G,EAAI,EACR,IAAK,IAAIT,EAAI,EAAGA,EAAIsH,EAAKrH,SAAUD,EAAG,CACpC,GAAIsH,EAAKtH,GAAK,IAAMsH,EAAKtH,GAAK,GAC5B,MAAM,IAAIsE,MAAM,gBAElB7D,EAAQ,GAAJA,EAAS6G,EAAKtH,GAAK,EACzB,CACA,OAAOS,CACT,CAGA,SAAS8Q,EAAOjK,GACd,MAAM7G,EAAI0Q,EAAM7J,GAChB,IAAK7G,EAAE+Q,MAAM,oCACX,MAAM,IAAIlN,MAAM,gBAElB,OAAO7D,CACT,wEAeA,MAAMgR,EAAiE,CACrEtF,OAAQmF,EACRrF,KAAMqF,EACNtF,KAfF,SAAgB1E,GACd,GAAsB,oBAAXjG,OACT,OAAOA,OAAOC,KAAK6P,EAAM7J,GAAO,UAAUoK,WAE5C,MAAMC,EAAKnQ,KAAK2P,EAAM7J,IAChB3J,EAAI,IAAI2B,WAAWqS,EAAG1R,QAC5B,IAAK,IAAID,EAAI,EAAGA,EAAIrC,EAAEsC,SAAUD,EAC9BrC,EAAEqC,GAAK2R,EAAGjQ,WAAW1B,GAEvB,OAAO,IAAI4R,aAAc9Q,OAAOnD,EAClC,EAMEyE,MAAOmP,EACPrL,OAAQqL,EACRrF,oBAAqBoF,GAMjBO,EAAc,CAAC,GAAI,IAAK,IAAK,KAE7BC,EAAuB,CAAC,GAAI,IAAK,IAAK,IAAK,IAAK,IAAK,GAAI,IAAK,IAAK,GAAI,IAAK,IAAK,KAEjFC,EAAkB,CAAC,GAAI,IAAK,IAAK,IAAK,GAAI,GAAI,IAAK,KAEnDC,EAAiB,CAAC,GAAI,IAAK,IAAK,IAAK,GAAI,IAAK,KAE9CC,EAAwB,CAAC,GAAI,IAAK,IAAK,IAAK,IAAK,IAAK,GAAI,IAAK,IAAK,IAAK,GAAI,IAAK,IAAK,KAGvFC,EAAiB,oBAGvB,iBAAAjQ,GACSC,KAAAoL,MAAK,EACJpL,KAAAiQ,QAAU,IAAI5S,YAAY2S,GAC1BhQ,KAAAkQ,UAAY,EACZlQ,KAAAmQ,KAAO,GACRnQ,KAAAuL,OAA4E,EAwIrF,CAtIS,KAAAL,GACLlL,KAAKiQ,QAAQtK,KAAK,GAClB3F,KAAKoL,MAAK,EACVpL,KAAKkQ,UAAY,EACjBlQ,KAAKuL,OAAS,GACdvL,KAAKmQ,KAAO,EACd,CAEO,GAAA7K,GACL,GAAc,IAAVtF,KAAKoL,MAA6B,CACpC,GAAIpL,KAAKkQ,YAAcJ,EAAe/R,OAAQ,CAC5C,IAAK,IAAIqS,EAAI,EAAGA,EAAIN,EAAe/R,SAAUqS,EAC3C,GAAIpQ,KAAKiQ,QAAQG,KAAON,EAAeM,GAAI,OAAOpQ,KAAKmM,KAIzD,OAFAnM,KAAKuL,OAAa,KAAC,EACnBvL,KAAKoL,MAAK,EACH,CACT,CACA,GAAIpL,KAAKkQ,YAAcH,EAAsBhS,OAAQ,CACnD,IAAK,IAAIqS,EAAI,EAAGA,EAAIL,EAAsBhS,SAAUqS,EAClD,GAAIpQ,KAAKiQ,QAAQG,KAAOL,EAAsBK,GAAI,OAAOpQ,KAAKmM,KAIhE,OAFAnM,KAAKuL,OAAa,KAAC,EACnBvL,KAAKoL,MAAK,EACH,CACT,CACA,OAAOpL,KAAKmM,IACd,CACA,OAAc,IAAVnM,KAAKoL,MAAkC,EAC7B,IAAVpL,KAAKoL,OACY,IAAhBpL,KAAKuL,OAAO1B,MAEV7J,KAAKqQ,YAAYrQ,KAAKkQ,YAC3BlQ,KAAKoL,MAAK,EACH,GAEFpL,KAAKmM,IACd,CAEO,KAAAb,CAAMlG,EAAmBC,EAAeC,GAC7C,IAAI8F,EAAQpL,KAAKoL,MACbkF,EAAMtQ,KAAKkQ,UACf,MAAM5S,EAAS0C,KAAKiQ,QACpB,GAAS,IAAL7E,GAAoC,IAALA,EAA2B,OAAQ,EACtE,GAAS,IAALA,GAA+BkF,EAAM,GAAI,OAAQ,EACrD,IAAK,IAAIxS,EAAIuH,EAAOvH,EAAIwH,IAAOxH,EAAG,CAChC,MAAMzB,EAAI+I,EAAKtH,GACf,OAAQzB,GACN,KAAK,GACH,IAAK2D,KAAKqQ,YAAYC,GAAM,OAAOtQ,KAAKmM,KACxCf,EAAK,EACLkF,EAAM,EACN,MACF,KAAK,GACH,GAAS,IAALlF,EAA6B,CAC/B,GAAkB,KAAd9N,EAAO,GAAW,CAEpB,IAAI8S,EAAI,EACR,KAAOA,EAAIT,EAAY5R,SAAUqS,EAC/B,GAAI9S,EAAO8S,KAAOT,EAAYS,GAAI,OAAOpQ,KAAKmM,KAGhD,GADAnM,KAAKuL,OAAa,KAAC,EACf+E,IAAQT,EAAgB9R,OAAQ,CAClC,KAAOqS,EAAIP,EAAgB9R,SAAUqS,EACnC,GAAI9S,EAAO8S,KAAOP,EAAgBO,GAAI,OAAOpQ,KAAKmM,KAIpD,OAFAnM,KAAKuL,OAAa,KAAC,EACnBvL,KAAKoL,MAAK,EACHtN,EAAI,CACb,CACF,KAAO,IAAkB,KAAdR,EAAO,GAOhB,OAAO0C,KAAKmM,KALZ,IAAK,IAAIiE,EAAI,EAAGA,EAAIR,EAAqB7R,SAAUqS,EACjD,GAAI9S,EAAO8S,KAAOR,EAAqBQ,GAAI,OAAOpQ,KAAKmM,KAEzDnM,KAAKuL,OAAa,KAAC,CAGrB,CACAH,EAAK,EACLkF,EAAM,CACR,MAAO,GAAS,IAALlF,EAA2B,CACpC,IAAKpL,KAAKuQ,UAAUD,GAAM,OAAOtQ,KAAKmM,KACtCf,EAAK,EACLkF,EAAM,CACR,MAAO,GAAS,IAALlF,EAA6B,CACtC,GAAIkF,GAAON,EAAgB,OAAOhQ,KAAKmM,KACvC7O,EAAOgT,KAASjU,CAClB,CACA,MACF,KAAK,GACH,OAAS,IAAL+O,GACGpL,KAAKqQ,YAAYC,IAExBtQ,KAAKoL,MAAK,EACHtN,EAAI,GAH0BkC,KAAKmM,KAI5C,QACE,GAAImE,GAAON,EAAgB,OAAOhQ,KAAKmM,KACvC7O,EAAOgT,KAASjU,EAEtB,CAGA,OAFA2D,KAAKoL,MAAQA,EACbpL,KAAKkQ,UAAYI,GACT,CACV,CAEQ,EAAAnE,GAGN,OAFAnM,KAAKuL,OAAO1B,KAAI,EAChB7J,KAAKoL,MAAK,GACF,CACV,CAEQ,SAAAmF,CAAUD,GAChB,MAAMF,EAAInB,EAAMjP,KAAKiQ,QAAQxL,SAAS,EAAG6L,IACzC,QAAIF,IACFpQ,KAAKmQ,KAAOC,EACZpQ,KAAKuL,OAAO6E,GAAK,MACV,EAGX,CAEQ,WAAAC,CAAYC,GAClB,GAAItQ,KAAKmQ,KAAM,CACb,IACE,MAAM5R,EAAIyB,KAAKiQ,QAAQhJ,MAAM,EAAGqJ,GAChCtQ,KAAKuL,OAAOvL,KAAKmQ,MAAQZ,EAASvP,KAAKmQ,MAAQZ,EAASvP,KAAKmQ,MAAM5R,GAAKA,CAC1E,UACE,OAAO,CACT,CACA,OAAO,CACT,CACA,OAAO,CACT,yGCtPF,MAEE,WAAAwB,CACmBoK,GAAAnK,KAAAmK,SAAAA,EAFXnK,KAAAwQ,cAA+B,CAAEC,WAAW,EAAMC,MAAO,MAAOC,OAAQ,EAAGC,UAAW,MAG3F,CAMI,QAAAlD,CAASmD,GACd7Q,KAAKmK,SAASuD,SAASmD,EAAK7Q,KAAKwQ,cACnC,oGCNF,SAA0BrS,GACxB,GAAIA,EAAEJ,OAAS,GACb,OAAOlD,EAAAgS,iBAET,MAAMiE,EAAM,IAAIzT,YAAYc,EAAEb,OAAQa,EAAEiP,WAAY,GAGpD,GAAe,aAAX0D,EAAI,IAAgC,YAAXA,EAAI,IAAgC,aAAXA,EAAI,GACxD,MAAO,CACL/D,KAAM,YACN7M,MAAQ/B,EAAE,KAAO,GAAKA,EAAE,KAAO,GAAKA,EAAE,KAAO,EAAIA,EAAE,IACnD6F,OAAQ7F,EAAE,KAAO,GAAKA,EAAE,KAAO,GAAKA,EAAE,KAAO,EAAIA,EAAE,KAIvD,GAAa,MAATA,EAAE,IAAwB,MAATA,EAAE,IAAwB,MAATA,EAAE,GAAa,CACnD,MAAO+B,EAAO8D,GAgFlB,SAAiB7F,GACf,MAAMuJ,EAAMvJ,EAAEJ,OACd,IAAID,EAAI,EACJiT,EAAc5S,EAAEL,IAAM,EAAIK,EAAEL,EAAI,GACpC,OAAa,CAEX,GADAA,GAAKiT,EACDjT,GAAK4J,EAEP,MAAO,CAAC,EAAG,GAEb,GAAa,MAATvJ,EAAEL,GACJ,MAAO,CAAC,EAAG,GAEb,GAAiB,MAAbK,EAAEL,EAAI,IAA4B,MAAbK,EAAEL,EAAI,GAC7B,OAAIA,EAAI,EAAI4J,EACH,CACLvJ,EAAEL,EAAI,IAAM,EAAIK,EAAEL,EAAI,GACtBK,EAAEL,EAAI,IAAM,EAAIK,EAAEL,EAAI,IAGnB,CAAC,EAAG,GAEbA,GAAK,EACLiT,EAAc5S,EAAEL,IAAM,EAAIK,EAAEL,EAAI,EAClC,CACF,CAzG4BkT,CAAQ7S,GAChC,MAAO,CAAE4O,KAAM,aAAc7M,QAAO8D,SACtC,CAEA,GAAe,YAAX8M,EAAI,KAA+B,KAAT3S,EAAE,IAAwB,KAATA,EAAE,KAAyB,KAATA,EAAE,GACjE,MAAO,CACL4O,KAAM,YACN7M,MAAQ/B,EAAE,IAAM,EAAIA,EAAE,GACtB6F,OAAQ7F,EAAE,IAAM,EAAIA,EAAE,IAI1B,GAAe,aAAX2S,EAAI,GACN,MAAO,CACL/D,KAAM,YACN7M,MAAQ/B,EAAE,IAAM,GAAKA,EAAE,IAAM,GAAKA,EAAE,IAAM,EAAIA,EAAE,GAChD6F,OAAQ7F,EAAE,IAAM,GAAKA,EAAE,IAAM,GAAKA,EAAE,KAAO,EAAIA,EAAE,KAIrD,GAAe,aAAX2S,EAAI,IAAgC,aAAXA,EAAI,IAA6C,UAAd,SAATA,EAAI,IAA6B,CACtF,OAAQ3S,EAAE,KACR,KAAK,GACH,MAAO,CACL4O,KAAM,aACN7M,MAA6C,GAApC/B,EAAE,IAAMA,EAAE,KAAO,EAAIA,EAAE,KAAO,IACvC6F,OAA6C,GAApC7F,EAAE,IAAMA,EAAE,KAAO,EAAIA,EAAE,KAAO,KAE3C,KAAK,GACH,GAAc,KAAVA,EAAE,IAAc,OAAOtD,EAAAgS,iBAC3B,MAAMoE,EAAM9S,EAAE,IAAMA,EAAE,KAAO,EAAIA,EAAE,KAAO,GAAKA,EAAE,KAAO,GACxD,MAAO,CACL4O,KAAM,aACN7M,MAAgC,GAAV,MAAb+Q,GACTjN,OAAgC,GAAvBiN,IAAQ,GAAK,QAE1B,KAAK,GACH,OAAc,MAAV9S,EAAE,KAA0B,IAAVA,EAAE,KAA0B,KAAVA,EAAE,IAAqBtD,EAAAgS,iBACxD,CACLE,KAAM,aACN7M,MAA+B,OAAtB/B,EAAE,IAAMA,EAAE,KAAO,GAC1B6F,OAA+B,OAAtB7F,EAAE,IAAMA,EAAE,KAAO,IAGhC,OAAOtD,EAAAgS,gBACT,CAEA,GAAe,aAAXiE,EAAI,KAAiC,aAAXA,EAAI,IAAgC,aAAXA,EAAI,IAAoB,CAC7E,IAAIR,GAAO,EAEX,MAAMY,EAAQnV,KAAKE,IAAIkC,EAAEJ,OAAS,GAAI,MACtC,IAAK,IAAID,EAAI,EAAGA,EAAIoT,EAAOpT,IAEzB,GAAa,MAATK,EAAEL,IAA4B,MAAbK,EAAEL,EAAI,IAA4B,MAAbK,EAAEL,EAAI,IAA4B,MAAbK,EAAEL,EAAI,GAAa,CAChFwS,EAAMxS,EACN,KACF,CAEF,IAAa,IAATwS,EAAY,CAEd,MAAMpQ,EACJ/B,EAAEmS,EAAO,IAAM,GACfnS,EAAEmS,EAAO,IAAM,GACfnS,EAAEmS,EAAM,KAAQ,EAChBnS,EAAEmS,EAAM,IACJtM,EACJ7F,EAAEmS,EAAM,KAAO,GACfnS,EAAEmS,EAAM,KAAO,GACfnS,EAAEmS,EAAM,KAAQ,EAChBnS,EAAEmS,EAAM,IACV,GAAIpQ,EAAQ,GAAK8D,EAAS,EACxB,MAAO,CAAE+I,KAAM,aAAc7M,QAAO8D,SAExC,CACA,OAAOnJ,EAAAgS,gBACT,CACA,OAAOhS,EAAAgS,gBACT,EAnGahS,EAAAgS,iBAA6B,CACxCE,KAAM,cACN7M,MAAO,EACP8D,OAAQ,uFCZV,MAAAjF,EAAAC,EAAA,KAGAqH,EAAArH,EAAA,KAaA,MAAAqO,UAAmChH,EAAA0C,WAEjC,UAAW+C,GAAM,IAAAK,EAAoC,OAA8B,QAAvBA,EAAAnM,KAAKmR,QAAQC,IAAI,cAAM,IAAAjF,OAAA,EAAAA,EAAEL,MAAQ,CAUtF,mBAAOwB,CAAa+D,EAAqCnR,EAAe8D,GAU7E,MAAM8H,GAAUuF,QAAAA,EAAiBC,UAAUC,cAAc,UAGzD,OAFAzF,EAAO5L,MAAgB,EAARA,EACf4L,EAAO9H,OAAkB,EAATA,EACT8H,CACT,CAGO,sBAAO0F,CAAgBC,EAA+BvR,EAAe8D,EAAgB1G,GAC1F,GAAyB,mBAAd6P,UAA0B,CACnC,MAAMuE,EAAUD,EAAID,gBAAgBtR,EAAO8D,GAI3C,OAHI1G,GACFoU,EAAQtM,KAAKlC,IAAI,IAAIgD,kBAAkB5I,EAAQ,EAAG4C,EAAQ8D,EAAS,IAE9D0N,CACT,CACA,OAAOpU,EACH,IAAI6P,UAAU,IAAIjH,kBAAkB5I,EAAQ,EAAG4C,EAAQ8D,EAAS,GAAI9D,EAAO8D,GAC3E,IAAImJ,UAAUjN,EAAO8D,EAC3B,CAGO,wBAAO6J,CAAkBgD,GAC9B,MAAiC,mBAAtBhD,kBACF8D,QAAQC,aAAQ5J,GAElB6F,kBAAkBgD,EAC3B,CAGA,WAAA9Q,CAAoB8R,GAClBC,QADkB9R,KAAA6R,UAAAA,EAhDZ7R,KAAAmR,QAAU,IAAIY,IAGd/R,KAAAgS,gBAAkBhS,KAAKiJ,UAAU,IAAI5C,EAAA4L,mBA+C3CjS,KAAKkS,SAAWlS,KAAK6R,UAAUzF,MAAM+F,KACrCnS,KAAK6R,UAAUzF,MAAM+F,KAAQC,UACd,QAAbjG,EAAAnM,KAAKkS,gBAAQ,IAAA/F,GAAAA,EAAE3E,KAAKxH,KAAK6R,UAAUzF,MAAOgG,GAC1CpS,KAAKqS,SAEHrS,KAAK6R,UAAUzF,MAAMkG,eACvBtS,KAAKqS,QAGPrS,KAAKgS,gBAAgBlW,MAAQkE,KAAK6R,UAAUzF,MAAMmG,eAAeC,eAAeC,UAC/D,aAAXA,IACFzS,KAAK0S,gBACc,QAAnBvG,EAAAnM,KAAK2S,sBAAc,IAAAxG,GAAAA,EAAEyG,YAAY,EAAG5S,KAAK6R,UAAU7F,SAGvDhM,KAAKiJ,WAAU,EAAA5C,EAAAS,cAAa,WAC1B9G,KAAK6S,qBACL7S,KAAK6S,mBAAmB,UACpB7S,KAAK6R,UAAUzF,OAASpM,KAAKkS,WAC/BlS,KAAK6R,UAAUzF,MAAM+F,KAAOnS,KAAKkS,SACjClS,KAAKkS,cAAWlK,GAEdhI,KAAK2S,gBAAkB3S,KAAK8S,kBAC9B9S,KAAK2S,eAAeI,YAAc/S,KAAK8S,gBACvC9S,KAAK8S,qBAAkB9K,GAEzBhI,KAAK2S,oBAAiB3K,EACtBhI,KAAKmR,QAAQrI,QACU,QAAvBqD,EAAAnM,KAAKgT,0BAAkB,IAAA7G,GAAAA,EAAE8B,QACzBjO,KAAKgT,wBAAqBhL,EAC1BhI,KAAKiT,kBAAejL,IAExB,CAKO,eAAAkL,CAAgBpX,WACjBA,EACGkE,KAAKiT,eAA0C,IAA1BjT,KAAKmT,SAASnP,QACtChE,KAAKoT,mBAAmBrX,KAAKC,IAAIgE,KAAKmT,SAASnP,OAAS,EAAC,MAGpC,QAAvBmI,EAAAnM,KAAKgT,0BAAkB,IAAA7G,GAAAA,EAAE8B,QACzBjO,KAAKgT,wBAAqBhL,EAC1BhI,KAAKiT,kBAAejL,GAEH,QAAnBuF,EAAAvN,KAAK2S,sBAAc,IAAApF,GAAAA,EAAEqF,YAAY,EAAG5S,KAAK6R,UAAU7F,KACrD,CAMA,cAAWJ,GACT,OAAO5L,KAAK6R,UAAUjG,UACxB,CAKA,YAAWuH,WACT,MAAO,CACLjT,OAAsB,QAAfiM,EAAAnM,KAAK4L,kBAAU,IAAAO,OAAA,EAAAA,EAAEN,IAAIuC,KAAKlO,SAAU,EAC3C8D,QAAuB,QAAfuJ,EAAAvN,KAAK4L,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIuC,KAAKpK,UAAW,EAEjD,CAKO,UAAAqP,CAAWhO,EAAeC,EAAaoL,iBAC5C,MAAM4C,EAAIjO,IAAwB,QAAf8G,EAAAnM,KAAK4L,kBAAU,IAAAO,OAAA,EAAAA,EAAEN,IAAIuC,KAAKpK,SAAU,GACjD0H,GAAmB,QAAf6B,EAAAvN,KAAK4L,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIC,OAAO5L,QAAS,EACzC9B,GAAKkH,EAAM,EAAID,KAAyB,QAAf6G,EAAAlM,KAAK4L,kBAAU,IAAAM,OAAA,EAAAA,EAAEL,IAAIuC,KAAKpK,SAAU,GAC9D0M,GAAmB,QAAVA,GACW,QAAvBpC,EAAAtO,KAAKmR,QAAQC,IAAI,cAAM,IAAA9C,GAAAA,EAAEiF,UAAU,EAAGD,EAAG5H,EAAGtN,GAEzCsS,GAAmB,WAAVA,GACc,QAA1B8C,EAAAxT,KAAKmR,QAAQC,IAAI,iBAAS,IAAAoC,GAAAA,EAAED,UAAU,EAAGD,EAAG5H,EAAGtN,EAEnD,CAKO,QAAAqV,CAAS/C,GACd,IAAKA,GAAmB,QAAVA,EAAiB,CAC7B,MAAMe,EAAMzR,KAAKmR,QAAQC,IAAI,OAC7BK,SAAAA,EAAK8B,UAAU,EAAG,EAAG9B,EAAI3F,OAAO5L,MAAOuR,EAAI3F,OAAO9H,OACpD,CACA,IAAK0M,GAAmB,WAAVA,EAAoB,CAChC,MAAMe,EAAMzR,KAAKmR,QAAQC,IAAI,UAC7BK,SAAAA,EAAK8B,UAAU,EAAG,EAAG9B,EAAI3F,OAAO5L,MAAOuR,EAAI3F,OAAO9H,OACpD,CACF,CAKO,IAAA0P,CAAKC,EAAqBC,EAAgBC,EAAaC,EAAaC,EAAgB,GACzF,MAAMtC,EAAMzR,KAAKmR,QAAQC,IAAIuC,EAAQjD,OACrC,IAAKe,EACH,OAEF,MAAMvR,MAAEA,EAAK8D,OAAEA,GAAWhE,KAAKmT,SAG/B,IAAe,IAAXjT,IAA4B,IAAZ8D,EAClB,OAGFhE,KAAKgU,cAAcL,EAASzT,EAAO8D,GACnC,MAAM6M,EAAM8C,EAAQM,QACZ/T,MAAOgU,EAAalQ,OAAQmQ,GAAiBR,EAAQS,eACvDrI,EAAOhQ,KAAKuI,KAAKuM,EAAI3Q,MAAQgU,GAE7BG,EAAMT,EAAS7H,EAAQmI,EACvBI,EAAKvY,KAAKmR,MAAM0G,EAAS7H,GAAQoI,EACjCI,EAAKV,EAAM3T,EACXsU,EAAKV,EAAM9P,EAGXyQ,EAAaV,EAAQG,EAAcG,EAAKxD,EAAI3Q,MAAQ2Q,EAAI3Q,MAAQmU,EAAKN,EAAQG,EAC7EQ,EAAcJ,EAAKH,EAAetD,EAAI7M,OAAS6M,EAAI7M,OAASsQ,EAAKH,EAMvE1C,EAAIkD,UACF9D,EACA9U,KAAKmR,MAAMmH,GAAKtY,KAAKmR,MAAMoH,GAAKvY,KAAKuI,KAAKmQ,GAAa1Y,KAAKuI,KAAKoQ,GACjE3Y,KAAKmR,MAAMqH,GAAKxY,KAAKmR,MAAMsH,GAAKzY,KAAKuI,KAAKmQ,EAAavU,EAAQgU,GAAcnY,KAAKuI,KAAKoQ,EAAc1Q,EAASmQ,GAElH,CAKO,WAAAS,CAAYjB,EAAqBC,GACtC,MAAM1T,MAAEA,EAAK8D,OAAEA,GAAWhE,KAAKmT,SAE/B,IAAe,IAAXjT,IAA4B,IAAZ8D,EAClB,OAEFhE,KAAKgU,cAAcL,EAASzT,EAAO8D,GACnC,MAAM6M,EAAM8C,EAAQM,QACZ/T,MAAOgU,EAAalQ,OAAQmQ,GAAiBR,EAAQS,eACvDrI,EAAOhQ,KAAKuI,KAAKuM,EAAI3Q,MAAQgU,GAC7BG,EAAMT,EAAS7H,EAAQmI,EACvBI,EAAKvY,KAAKmR,MAAM0G,EAAS7H,GAAQoI,EACjCM,EAAaP,EAAcG,EAAKxD,EAAI3Q,MAAQ2Q,EAAI3Q,MAAQmU,EAAKH,EAC7DQ,EAAcJ,EAAKH,EAAetD,EAAI7M,OAAS6M,EAAI7M,OAASsQ,EAAKH,EAEjErI,EAASuB,EAAcC,aAAatN,KAAKsR,SAAUvV,KAAKuI,KAAKmQ,EAAavU,EAAQgU,GAAcnY,KAAKuI,KAAKoQ,EAAc1Q,EAASmQ,IACjI1C,EAAM3F,EAAO0B,WAAW,MAC9B,OAAIiE,GACFA,EAAIkD,UACF9D,EACA9U,KAAKmR,MAAMmH,GAAKtY,KAAKmR,MAAMoH,GAAKvY,KAAKmR,MAAMuH,GAAa1Y,KAAKmR,MAAMwH,GACnE,EAAG,EAAG5I,EAAO5L,MAAO4L,EAAO9H,QAEtB8H,QANT,CAQF,CAKO,eAAA+I,CAAgBhB,EAAaC,EAAaC,EAAgB,SAC/D,MAAMtC,EAAMzR,KAAKmR,QAAQC,IAAI,OAC7B,GAAIK,EAAK,CACP,MAAMvR,MAAEA,EAAK8D,OAAEA,GAAWhE,KAAKmT,SAG/B,IAAe,IAAXjT,IAA4B,IAAZ8D,EAClB,OAQF,GALKhE,KAAKiT,aAECjP,GAAUhE,KAAKiT,aAAcjP,QACtChE,KAAKoT,mBAAmBpP,EAAS,GAFjChE,KAAKoT,mBAAmBrX,KAAKC,IAAIgI,EAAS,EAAC,MAIxChE,KAAKiT,aAAc,OACxBxB,EAAIkD,UACqB,QADZxI,EACXnM,KAAKgT,0BAAkB,IAAA7G,EAAAA,EAAInM,KAAKiT,aAChCY,EAAM3T,EACL4T,EAAM9P,EAAU,EAAI,EAAI,EACzB9D,EAAQ6T,EACR/P,EACA6P,EAAM3T,EACN4T,EAAM9P,EACN9D,EAAQ6T,EACR/P,EAEJ,CACF,CAMO,aAAA0O,WACL,MAAMhH,GAAmB,QAAfS,EAAAnM,KAAK4L,kBAAU,IAAAO,OAAA,EAAAA,EAAEN,IAAIC,OAAO5L,QAAS,EACzC9B,GAAmB,QAAfmP,EAAAvN,KAAK4L,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIC,OAAO9H,SAAU,EAChD,IAAK,MAAMyN,KAAOzR,KAAKmR,QAAQ2D,SACzBrD,EAAI3F,OAAO5L,QAAUwL,GAAK+F,EAAI3F,OAAO9H,SAAW5F,IAClDqT,EAAI3F,OAAO5L,MAAQwL,EACnB+F,EAAI3F,OAAO9H,OAAS5F,EAG1B,CAKQ,aAAA4V,CAAce,EAAkBrP,EAAsBM,GAC5D,GAAIN,IAAiBqP,EAAKX,eAAelU,OAAS8F,IAAkB+O,EAAKX,eAAepQ,OACtF,OAEF,MAAQ9D,MAAO8U,EAAehR,OAAQiR,GAAmBF,EAAKG,aAC9D,GAAIxP,IAAiBsP,GAAiBhP,IAAkBiP,EAItD,OAHAF,EAAKd,OAASc,EAAKI,KACnBJ,EAAKX,eAAelU,MAAQ8U,OAC5BD,EAAKX,eAAepQ,OAASiR,GAG/B,MAAMG,EAAcrZ,KAAKuI,KAAKyQ,EAAKI,KAAMjV,MAAQwF,EAAesP,GAC1DK,EAAetZ,KAAKuI,KAAKyQ,EAAKI,KAAMnR,OAASgC,EAAgBiP,GAEnE,GAAIG,EAAcC,EAAeN,EAAKI,KAAMjV,MAAQ6U,EAAKI,KAAMnR,OAI7D,OAHA+Q,EAAKd,OAASc,EAAKI,KACnBJ,EAAKX,eAAelU,MAAQ8U,OAC5BD,EAAKX,eAAepQ,OAASiR,GAG/B,MAAMnJ,EAASuB,EAAcC,aAAatN,KAAKsR,SAAU8D,EAAaC,GAChE5D,EAAM3F,EAAO0B,WAAW,MAC1BiE,IACFA,EAAIkD,UAAUI,EAAKI,KAAO,EAAG,EAAGrJ,EAAO5L,MAAO4L,EAAO9H,QACrD+Q,EAAKd,OAASnI,EACdiJ,EAAKX,eAAelU,MAAQwF,EAC5BqP,EAAKX,eAAepQ,OAASgC,EAEjC,CAKQ,KAAAqM,GACNrS,KAAK2S,eAAiB3S,KAAK6R,UAAUzF,MAAMuG,eAC3C3S,KAAK8S,gBAAkB9S,KAAK2S,eAAeI,YAAY7R,KAAKlB,KAAK2S,gBACjE3S,KAAK2S,eAAeI,YAAeuC,UACjC,IAAK,MAAMC,IAAO,IAAIvV,KAAKmR,QAAQqE,QACjCxV,KAAK6S,mBAAmB0C,GAEN,QAApBpJ,EAAAnM,KAAK8S,uBAAe,IAAA3G,GAAAA,EAAE3E,KAAKxH,KAAK2S,eAAgB2C,GAEpD,CAEO,gBAAAG,CAAiB/E,EAAoB,eAE1C,IAAK1Q,KAAKsR,WAAatR,KAAK6R,UAAUzF,MAAMkG,cAE1C,YADA/U,QAAQC,KAAK,sFAGf,GAAIwC,KAAKmR,QAAQuE,IAAIhF,GACnB,OAEF,MAAM5E,EAASuB,EAAcC,aAC3BtN,KAAKsR,UAAyB,QAAfnF,EAAAnM,KAAK4L,kBAAU,IAAAO,OAAA,EAAAA,EAAEN,IAAIC,OAAO5L,QAAS,GACrC,QAAfqN,EAAAvN,KAAK4L,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIC,OAAO9H,SAAU,GAExC8H,EAAO6J,UAAUrO,IAAI,qBAAqBoJ,KAC1C,MAAM4B,EAAgBtS,KAAK6R,UAAUzF,MAAMkG,cAI3CA,EAAcsD,MAAMC,UAAY,UAClB,WAAVnF,GAKF5E,EAAO8J,MAAMjF,OAAS,KACtB2B,EAAcwD,aAAahK,EAAQwG,EAAcyD,cAKjDjK,EAAO8J,MAAMjF,OAAS,IACtB2B,EAAc0D,YAAYlK,IAE5B,MAAM2F,EAAM3F,EAAO0B,WAAW,KAAM,CAAEtQ,OAAO,IACxCuU,GAILzR,KAAKmR,QAAQjO,IAAIwN,EAAOe,GACxBzR,KAAKyT,SAAS/C,IAJZ5E,EAAOmK,QAKX,CAEO,kBAAApD,CAAmBnC,EAAoB,OAC5C,MAAMe,EAAMzR,KAAKmR,QAAQC,IAAIV,GACzBe,IACFA,EAAI3F,OAAOmK,SACXjW,KAAKmR,QAAQ+E,OAAOxF,GAExB,CAEO,QAAAyF,CAASzF,GACd,OAAO1Q,KAAKmR,QAAQuE,IAAIhF,EAC1B,CAEQ,kBAAA0C,CAAmBpP,EAAM,UACR,QAAvBmI,EAAAnM,KAAKgT,0BAAkB,IAAA7G,GAAAA,EAAE8B,QACzBjO,KAAKgT,wBAAqBhL,EAG1B,MAAMoO,EAAS,GACTC,EAAYhJ,EAAcC,aAAatN,KAAKsR,SAAU8E,EAAQpS,GAC9DyN,EAAM4E,EAAU7I,WAAW,KAAM,CAAEtQ,OAAO,IAChD,IAAKuU,EAAK,OACV,MAAMC,EAAUrE,EAAcmE,gBAAgBC,EAAK2E,EAAQpS,GACrD8M,EAAM,IAAIzT,YAAYqU,EAAQtM,KAAK9H,QACnCgZ,GAAQ,EAAAvX,EAAAzD,YAAW,EAAG,EAAG,GACzBib,GAAQ,EAAAxX,EAAAzD,YAAW,IAAK,IAAK,KACnCwV,EAAInL,KAAK2Q,GACT,IAAK,IAAIhD,EAAI,EAAGA,EAAItP,IAAUsP,EAAG,CAC/B,MAAMkD,EAAQlD,EAAI,EACZnP,EAASmP,EAAI8C,EACnB,IAAK,IAAIK,EAAI,EAAGA,EAAIL,EAAQK,GAAK,EAC/B3F,EAAI3M,EAASsS,EAAID,GAASD,CAE9B,CACA9E,EAAIhE,aAAaiE,EAAS,EAAG,GAG7B,MAAMxR,EAASwW,OAAOxW,MAAQkW,EAAS,GAAK,IAAa,KACzDpW,KAAKiT,aAAe5F,EAAcC,aAAatN,KAAKsR,SAAUpR,EAAO8D,GACrE,MAAM2S,EAAO3W,KAAKiT,aAAazF,WAAW,KAAM,CAAEtQ,OAAO,IACzD,IAAKyZ,EAEH,YADA3W,KAAKiT,kBAAejL,GAGtB,IAAK,IAAIlK,EAAI,EAAGA,EAAIoC,EAAOpC,GAAKsY,EAC9BO,EAAKhC,UAAU0B,EAAWvY,EAAG,GAE/B,MAAM8Y,EAAc5W,KAAKiT,aACzB5F,EAAcQ,kBAAkB+I,GAAavV,KAAKwV,IAC5C7W,KAAKiT,eAAiB2D,EAAaC,SAAAA,EAAQ5I,QAC1CjO,KAAKgT,mBAAqB6D,IAC9B3I,MAAM,OACX,CAEA,YAAWoD,SACT,OAA+C,QAAxCnF,EAAAnM,KAAK6R,UAAUzF,MAAMC,2BAAmB,IAAAF,OAAA,EAAAA,EAAE2K,OAAOxF,QAC1D,2HC3aF,MAAAjI,EAAArK,EAAA,KASanE,EAAA8Q,kBAA+B,CAC1CzL,MAAO,EACP8D,OAAQ,IASV,MAAM+S,EAEJ,OAAWC,GACT,OAAIhX,KAAKiX,QAEQ,UAAZjX,KAAKkX,KACLlX,KAAKmX,gBAAkB,GAGrBnX,KAAKkX,IACd,CACA,OAAWF,CAAIlb,GAAiBkE,KAAKkX,KAAOpb,CAAO,CAEnD,kBAAWqb,GAET,OAAInX,KAAKiX,OACP,GAEe,UAATjX,KAAKkX,OAAoC,EACnD,CACA,kBAAWC,CAAerb,GACxBkE,KAAKkX,OAAQ,UACblX,KAAKkX,MAASpb,GAAS,GAAG,SAC5B,CAEA,kBAAWsb,GACT,OAAmB,SAAZpX,KAAKkX,IACd,CACA,kBAAWE,CAAetb,GACxBkE,KAAKkX,OAAQ,SACblX,KAAKkX,MAAgB,SAARpb,CACf,CAEA,0BAAWub,GACT,MAAMC,GAAgB,WAATtX,KAAKkX,OAAmC,GACrD,OAAII,EAAM,EACK,WAANA,EAEFA,CACT,CACA,0BAAWD,CAAuBvb,GAChCkE,KAAKkX,MAAQ,UACblX,KAAKkX,MAASpb,GAAS,GAAG,UAC5B,CAGA,SAAWyb,GACT,OAAOvX,KAAKiX,MACd,CACA,SAAWM,CAAMzb,GACfkE,KAAKiX,OAASnb,CAChB,CAEA,WAAAiE,CACEiX,EAAc,EACdO,EAAgB,EACTC,GAAU,EACV5D,GAAS,GADT5T,KAAAwX,QAAAA,EACAxX,KAAA4T,OAAAA,EAxDD5T,KAAAkX,KAAe,EA4CflX,KAAAiX,OAAiB,EAcvBjX,KAAKkX,KAAOF,EACZhX,KAAKiX,OAASM,CAChB,CAEO,KAAAE,GASL,OAAO,IAAIV,EAAmB/W,KAAKkX,KAAMlX,KAAKiX,OAAQjX,KAAKwX,QAASxX,KAAK4T,OAC3E,CAEO,OAAA8D,GACL,OAA0B,IAAnB1X,KAAKmX,gBAA0D,IAAhBnX,KAAKiX,SAAkC,IAAlBjX,KAAKwX,OAClF,EAEF,MAAMG,EAAc,IAAIZ,iBAUxB,MAkBE,WAAAhX,CACU8R,EACA3H,EACAhI,GAFAlC,KAAA6R,UAAAA,EACA7R,KAAAkK,UAAAA,EACAlK,KAAAkC,MAAAA,EAnBFlC,KAAA4X,QAAmC,IAAI7F,IAEvC/R,KAAA6X,QAAU,EAEV7X,KAAA8X,UAAY,EAEZ9X,KAAA+X,eAAgB,EAEhB/X,KAAAgY,iBAAkB,EAElBhY,KAAAiY,YAAsB,KAW5B,IACEjY,KAAKkY,SAASlY,KAAKkC,MAAMiW,aAC3B,CAAE,MAAOrQ,GACHA,aAAa1F,OACf7E,QAAQ6a,MAAMtQ,EAAEuQ,SAElB9a,QAAQC,KAAK,0BAA0BwC,KAAKsY,gBAC9C,CACAtY,KAAKuY,iBAAmB,CACtBxM,KAAM/L,KAAK6R,UAAU9F,KACrBC,KAAMhM,KAAK6R,UAAU7F,KAEzB,CAEO,OAAArE,GACL3H,KAAKkL,OACP,CAEO,KAAAA,SACL,IAAK,MAAM6J,KAAQ/U,KAAK4X,QAAQ9C,SACnB,QAAX3I,EAAA4I,EAAKyD,cAAM,IAAArM,GAAAA,EAAExE,UAIf3H,KAAK4X,QAAQ9O,QACb9I,KAAKkK,UAAUuJ,UACjB,CAEO,QAAA6E,GACL,OAA0B,EAAnBtY,KAAKiY,YAAkB,GAChC,CAEO,QAAAC,CAASpc,GACd,GAAIA,EAAQ,IAAOA,EAAQ,IACzB,MAAM2c,WAAW,qEAEnBzY,KAAKiY,YAAenc,EAAQ,EAAI,MAAa,EAC7CkE,KAAK0Y,aAAa,EACpB,CAEO,QAAAC,GACL,OAAiC,EAA1B3Y,KAAK4Y,mBAAyB,GACvC,CAEQ,gBAAAA,GACN,IAAIC,EAAe,EACnB,IAAK,MAAM9D,KAAQ/U,KAAK4X,QAAQ9C,SAC1BC,EAAKI,OACP0D,GAAgB9D,EAAKI,KAAKjV,MAAQ6U,EAAKI,KAAKnR,OACxC+Q,EAAKd,QAAUc,EAAKd,SAAWc,EAAKI,OACtC0D,GAAgB9D,EAAKd,OAAO/T,MAAQ6U,EAAKd,OAAOjQ,SAItD,OAAO6U,CACT,CAEQ,OAAAC,CAAQC,SACd,MAAMhE,EAAO/U,KAAK4X,QAAQxG,IAAI2H,GACzBhE,IACL/U,KAAK4X,QAAQ1B,OAAO6C,GAEhBjC,OAAOkC,aAAejE,EAAKI,gBAAgB6D,aAC7CjE,EAAKI,KAAKlH,QAEO,QAAnB9B,EAAAnM,KAAKiZ,sBAAc,IAAA9M,GAAAA,EAAA3E,KAAnBxH,KAAsB+Y,GACxB,CAKO,aAAAG,SAEL,MAAMC,EAAO,GACb,IAAK,MAAOJ,EAAIhE,KAAS/U,KAAK4X,QAAQwB,UACZ,cAApBrE,EAAKsE,aACI,QAAXlN,EAAA4I,EAAKyD,cAAM,IAAArM,GAAAA,EAAExE,UACbwR,EAAKza,KAAKqa,IAGd,IAAK,MAAMA,KAAMI,EACfnZ,KAAK8Y,QAAQC,GAGf/Y,KAAKgY,iBAAkB,EACvBhY,KAAK+X,eAAgB,CACvB,CAMO,WAAAuB,CAAYP,SACjB,MAAMhE,EAAO/U,KAAK4X,QAAQxG,IAAI2H,GAC1BhE,IACS,QAAX5I,EAAA4I,EAAKyD,cAAM,IAAArM,GAAAA,EAAExE,UACb3H,KAAK8Y,QAAQC,GAEjB,CAaO,QAAArL,CAASmD,EAAsC/P,WAEpDd,KAAK0Y,aAAa7H,EAAI3Q,MAAQ2Q,EAAI7M,QAGlC,IAAImP,EAAWnT,KAAKkK,UAAUiJ,UACN,IAApBA,EAASjT,QAAqC,IAArBiT,EAASnP,SACpCmP,EAAWtY,EAAA8Q,mBAEb,MAAMI,EAAOhQ,KAAKuI,KAAKuM,EAAI3Q,MAAQiT,EAASjT,OACtC8L,EAAOjQ,KAAKuI,KAAKuM,EAAI7M,OAASmP,EAASnP,QAEvCwT,IAAYxX,KAAK6X,QAEjBva,EAAS0C,KAAK6R,UAAUzF,MAAM9O,OAC9Bic,EAAWvZ,KAAK6R,UAAU9F,KAC1ByN,EAAWxZ,KAAK6R,UAAU7F,KAC1ByN,EAAUnc,EAAOmZ,EACjBiD,EAAUpc,EAAOgW,EACvB,IAAInP,EAASsV,EACTE,EAAY,EAEX7Y,EAAK2P,YACRnT,EAAOmZ,EAAI,EACXnZ,EAAOgW,EAAI,EACXnP,EAAS,GAGXnE,KAAK6R,UAAUzF,MAAMwN,cAAcC,iBAAiBC,UAAUxc,EAAOgW,GACrE,IAAK,IAAIQ,EAAM,EAAGA,EAAM9H,IAAQ8H,EAAK,CACnC,MAAMiG,EAAOzc,EAAO0c,MAAM5I,IAAI9T,EAAOgW,EAAIhW,EAAO2c,OAChD,IAAK,IAAIpG,EAAM,EAAGA,EAAM9H,KAClB5H,EAAS0P,GAAO0F,KADU1F,EAE9B7T,KAAKka,aAAaH,EAAwB5V,EAAS0P,EAAK2D,EAAS1D,EAAM/H,EAAO8H,GAC9E8F,IAEF,GAAI7Y,EAAK2P,UACHqD,EAAM9H,EAAO,GAAGhM,KAAK6R,UAAUzF,MAAMwN,cAAcO,gBAEvD,KAAM7c,EAAOgW,GAAKkG,EAAU,MAE9Blc,EAAOmZ,EAAItS,CACb,CACAnE,KAAK6R,UAAUzF,MAAMwN,cAAcC,iBAAiBC,UAAUxc,EAAOgW,GAGjExS,EAAK2P,UACgB,QAAnB3P,EAAK8P,UACPtT,EAAOmZ,EAAI1a,KAAKE,IAAIkI,EAAS4H,EAAMwN,GAEnCjc,EAAOmZ,EAAItS,GAGb7G,EAAOmZ,EAAIgD,EACXnc,EAAOgW,EAAIoG,GAIb,MAAMP,EAAO,GACb,IAAK,MAAOJ,EAAIhE,KAAS/U,KAAK4X,QAAQwB,UAChCrE,EAAK4E,UAAY,IACR,QAAXxN,EAAA4I,EAAKyD,cAAM,IAAArM,GAAAA,EAAExE,UACbwR,EAAKza,KAAKqa,IAGd,IAAK,MAAMA,KAAMI,EACfnZ,KAAK8Y,QAAQC,GAKf,MAAMqB,EAAYpa,KAAK6R,UAAUwI,eAAe,GAChDD,SAAAA,EAAWE,UAAU,KACNta,KAAK4X,QAAQxG,IAAIoG,IAE5BxX,KAAK8Y,QAAQtB,KAMyB,cAAtCxX,KAAK6R,UAAUvU,OAAOid,OAAO1Q,MAC/B7J,KAAKwa,oBAIP,MAAM7G,EAAsB,CAC1BwB,KAAMtE,EACNqE,aAAc/B,EACdc,OAAQpD,EACRuD,eAAc5X,OAAA2F,OAAA,GAAOgR,GACrBqF,OAAQ4B,QAAapS,EACrB2R,YACAN,WAAYrZ,KAAK6R,UAAUvU,OAAOid,OAAO1Q,KACzC6G,MAAO5P,EAAK4P,MACZC,OAAQ7P,EAAK6P,QAMf,OAFA3Q,KAAK4X,QAAQ1U,IAAIsU,EAAS7D,GACT,QAAjBpG,EAAAvN,KAAKya,oBAAY,IAAAlN,GAAAA,EAAA/F,KAAjBxH,MACOwX,CACT,CAQO,MAAAkD,CAAOC,WAEZ,IAAIC,GAAe,EACfC,GAAkB,EACtB,IAAK,MAAM9F,KAAQ/U,KAAK4X,QAAQ9C,SAM9B,GALmB,WAAfC,EAAKrE,MACPmK,GAAkB,EAElBD,GAAe,EAEbA,GAAgBC,EAAiB,MAIvC,GAAID,IAAiB5a,KAAKkK,UAAUiM,SAAS,SAC3CnW,KAAKkK,UAAUuL,iBAAiB,QAC3BzV,KAAKkK,UAAUiM,SAAS,QAAQ,OAUvC,GARI0E,IAAoB7a,KAAKkK,UAAUiM,SAAS,WAC9CnW,KAAKkK,UAAUuL,iBAAiB,UAIlCzV,KAAKkK,UAAUwI,iBAGV1S,KAAK4X,QAAQ7N,KAYhB,OAXK/J,KAAK+X,gBACR/X,KAAKkK,UAAUuJ,WACfzT,KAAK+X,eAAgB,EACrB/X,KAAKgY,iBAAkB,GAErBhY,KAAKkK,UAAUiM,SAAS,QAC1BnW,KAAKkK,UAAU2I,mBAAmB,YAEhC7S,KAAKkK,UAAUiM,SAAS,WAC1BnW,KAAKkK,UAAU2I,mBAAmB,YAMjC+H,GAAgB5a,KAAKkK,UAAUiM,SAAS,SAC3CnW,KAAKkK,UAAUuJ,SAAS,OACxBzT,KAAKkK,UAAU2I,mBAAmB,SAE/BgI,GAAmB7a,KAAKkK,UAAUiM,SAAS,YAC9CnW,KAAKkK,UAAUuJ,SAAS,UACxBzT,KAAKkK,UAAU2I,mBAAmB,WAIhC7S,KAAKgY,kBACPhY,KAAKkK,UAAUuJ,WACfzT,KAAK+X,eAAgB,EACrB/X,KAAKgY,iBAAkB,GAGzB,MAAM3S,MAAEA,EAAKC,IAAEA,GAAQqV,EACjBrd,EAAS0C,KAAK6R,UAAUzF,MAAM9O,OAC9ByO,EAAO/L,KAAK6R,UAAUzF,MAAML,KAGlC/L,KAAKkK,UAAUmJ,WAAWhO,EAAOC,GAGjC,MAAMwV,EAAgG,GAChGC,EAAkE,GAGxE,IAAK,IAAIjH,EAAMzO,EAAOyO,GAAOxO,IAAOwO,EAAK,CACvC,MAAMiG,EAAOzc,EAAO0c,MAAM5I,IAAI0C,EAAMxW,EAAO0d,OAC3C,IAAKjB,EAAM,OACX,IAAK,IAAIlG,EAAM,EAAGA,EAAM9H,IAAQ8H,EAC9B,GAAmB,UAAfkG,EAAKkB,MAAMpH,GAA6B,CAC1C,IAAI/L,EAAiD,QAAhDqE,EAAwB4N,EAAKmB,eAAerH,UAAI,IAAA1H,EAAAA,EAAIwL,EACzD,MAAMH,EAAU1P,EAAE0P,QAClB,QAAgBxP,IAAZwP,IAAsC,IAAbA,EAC3B,SAEF,MAAM7D,EAAU3T,KAAK4X,QAAQxG,IAAIoG,GACjC,IAAkB,IAAd1P,EAAE8L,OAAe,CACnB,MAAMuH,EAAYrT,EAAE8L,OACdwH,EAAWvH,EACjB,IAAIE,EAAQ,EAOZ,OACIF,EAAM9H,GACW,UAAfgO,EAAKkB,MAAMpH,KACX/L,EAA4B,QAA3ByF,EAAGwM,EAAKmB,eAAerH,UAAI,IAAAtG,EAAAA,EAAIoK,IAChC7P,EAAE0P,UAAYA,GACd1P,EAAE8L,SAAWuH,EAAYpH,GAE7BA,IAEFF,IACIF,EACEA,EAAQM,QACV6G,EAAUpc,KAAK,CAAEiV,UAASC,OAAQuH,EAAWtH,IAAKuH,EAAUtH,MAAKC,UAE1D/T,KAAKkC,MAAMgR,iBACpB6H,EAAiBrc,KAAK,CAAEmV,IAAKuH,EAAUtH,MAAKC,UAE9C/T,KAAK+X,eAAgB,CACvB,CACF,CAEJ,CAGA+C,EAAUO,KAAK,CAAC3f,EAAGD,IAAMC,EAAEiY,QAAQhD,OAASlV,EAAEkY,QAAQhD,QAGtD,IAAK,MAAMnJ,KAAQuT,EACjB/a,KAAKkK,UAAU2K,gBAAgBrN,EAAKqM,IAAKrM,EAAKsM,IAAKtM,EAAKuM,OAI1D,IAAK,MAAMvM,KAAQsT,EACjB9a,KAAKkK,UAAUwJ,KAAKlM,EAAKmM,QAASnM,EAAKoM,OAAQpM,EAAKqM,IAAKrM,EAAKsM,IAAKtM,EAAKuM,MAE5E,CAEO,cAAAuH,CAAe1O,WAEpB,IAAK5M,KAAK4X,QAAQ7N,KAEhB,YADA/J,KAAKuY,iBAAmB3L,GAM1B,GAAI5M,KAAKuY,iBAAiBxM,MAAQa,EAAQb,KAExC,YADA/L,KAAKuY,iBAAmB3L,GAK1B,MAAMtP,EAAS0C,KAAK6R,UAAUzF,MAAM9O,OAC9B0O,EAAO1O,EAAO0c,MAAMjc,OACpBwd,EAASvb,KAAKuY,iBAAiBxM,KAAO,EAC5C,IAAK,IAAI+H,EAAM,EAAGA,EAAM9H,IAAQ8H,EAAK,CACnC,MAAMiG,EAAOzc,EAAO0c,MAAM5I,IAAI0C,GAC9B,GAAsB,UAAlBiG,EAAKkB,MAAMM,GAAgC,CAC7C,MAAMzT,EAAoD,QAAnDyF,EAAwBwM,EAAKmB,eAAeK,UAAO,IAAAhO,EAAAA,EAAIoK,EACxDH,EAAU1P,EAAE0P,QAClB,QAAgBxP,IAAZwP,IAAsC,IAAbA,EAC3B,SAEF,MAAM7D,EAAU3T,KAAK4X,QAAQxG,IAAIoG,GACjC,IAAK7D,EACH,SAGF,MAAM6H,EAAczf,KAAKuI,OAAoB,QAAd6H,EAAAwH,EAAQM,cAAM,IAAA9H,OAAA,EAAAA,EAAEjM,QAAS,GAAKyT,EAAQS,eAAelU,OACpF,GAAK4H,EAAE8L,OAAS4H,EAAe,GAAKA,EAClC,SAGF,IAAIC,GAAU,EACd,IAAK,IAAIC,EAAWH,EAAS,EAAGG,EAAW9O,EAAQb,OAAQ2P,EACzD,GAAmD,QAA/C3B,EAAK4B,MAAc,EAARD,EAAoB,GAA6C,CAC9ED,GAAU,EACV,KACF,CAEF,GAAIA,EACF,SAGF,MAAMnW,EAAMvJ,KAAKE,IAAI2Q,EAAQb,KAAMyP,EAAe1T,EAAE8L,OAAS4H,EAAeD,GAC5E,IAAIK,EAAW9T,EAAE8L,OACjB,IAAK,IAAIiI,EAAYN,EAAS,EAAGM,EAAYvW,IAAOuW,EAClD7b,KAAKka,aAAaH,EAAwB8B,EAAWrE,IAAWoE,GAChEjI,EAAQgG,WAEZ,CACF,CAEA3Z,KAAKuY,iBAAmB3L,CAC1B,CAKO,oBAAAkP,CAAqBrF,EAAWnD,aACrC,MACMyG,EADS/Z,KAAK6R,UAAUzF,MAAM9O,OAChB0c,MAAM5I,IAAIkC,GAC9B,GAAIyG,GAAqB,UAAbA,EAAKkB,MAAMxE,GAA2B,CAChD,MAAM3O,EAA+C,QAA9CoE,EAAwB6N,EAAKmB,eAAezE,UAAE,IAAAvK,EAAAA,EAAIyL,EACzD,GAAI7P,EAAE0P,UAA0B,IAAf1P,EAAE0P,QAAgB,CACjC,MAAMrC,EAAkC,QAA3BhJ,EAAAnM,KAAK4X,QAAQxG,IAAItJ,EAAE0P,gBAAQ,IAAArL,OAAA,EAAAA,EAAEgJ,KAC1C,GAAI2B,OAAOkC,aAAe7D,aAAgB6D,YAAa,CACrD,MAAMlN,EAASzC,EAAAgE,cAAcC,aAAawJ,OAAOxF,SAAU6D,EAAKjV,MAAOiV,EAAKnR,QAE5E,OADuB,QAAvBuJ,EAAAzB,EAAO0B,WAAW,aAAK,IAAAD,GAAAA,EAAEoH,UAAUQ,EAAM,EAAG,EAAGA,EAAKjV,MAAOiV,EAAKnR,QACzD8H,CACT,CACA,OAAOqJ,CACT,CACF,CACF,CAKO,uBAAA4G,CAAwBtF,EAAWnD,SACxC,MACMyG,EADS/Z,KAAK6R,UAAUzF,MAAM9O,OAChB0c,MAAM5I,IAAIkC,GAC9B,GAAIyG,GAAqB,UAAbA,EAAKkB,MAAMxE,GAA2B,CAChD,MAAM3O,EAA+C,QAA9CqE,EAAwB4N,EAAKmB,eAAezE,UAAE,IAAAtK,EAAAA,EAAIwL,EACzD,GAAI7P,EAAE0P,UAA0B,IAAf1P,EAAE0P,UAAgC,IAAd1P,EAAE8L,OAAe,CACpD,MAAMmB,EAAO/U,KAAK4X,QAAQxG,IAAItJ,EAAE0P,SAChC,GAAIzC,EACF,OAAO/U,KAAKkK,UAAU0K,YAAYG,EAAMjN,EAAE8L,OAE9C,CACF,CACF,CAIQ,YAAA8E,CAAasD,SACnB,MAAMC,EAAOjc,KAAK4Y,mBAClB,IAAIsD,EAAUD,EACd,KAAOjc,KAAKiY,YAAciE,EAAUF,GAAQhc,KAAK4X,QAAQ7N,MAAM,CAC7D,MAAMgL,EAAO/U,KAAK4X,QAAQxG,MAAMpR,KAAK8X,WACjC/C,GAAQA,EAAKI,OACf+G,GAAWnH,EAAKI,KAAKjV,MAAQ6U,EAAKI,KAAKnR,OACnC+Q,EAAKd,QAAUc,EAAKI,OAASJ,EAAKd,SACpCiI,GAAWnH,EAAKd,OAAO/T,MAAQ6U,EAAKd,OAAOjQ,QAElC,QAAXmI,EAAA4I,EAAKyD,cAAM,IAAArM,GAAAA,EAAExE,UACb3H,KAAK8Y,QAAQ9Y,KAAK8X,WAEtB,CACA,OAAOmE,EAAOC,CAChB,CAEQ,YAAAhC,CAAaH,EAAsBtD,EAAWe,EAAiB5D,GACrE,GAAuC,UAAnCmG,EAAK4B,MAAO,EAADlF,EAAa,GAAoC,CAC9D,MAAM0F,EAAMpC,EAAKmB,eAAezE,GAChC,GAAI0F,EAAK,CACP,QAAoBnU,IAAhBmU,EAAI3E,QAAuB,CAI7B,MAAM4E,EAAUpc,KAAK4X,QAAQxG,IAAI+K,EAAI3E,SAOrC,OANI4E,GAEFA,EAAQzC,YAEVwC,EAAI3E,QAAUA,OACd2E,EAAIvI,OAASA,EAEf,CAGA,YADAmG,EAAKmB,eAAezE,GAAK,IAAIM,EAAmBoF,EAAInF,IAAKmF,EAAI5E,MAAOC,EAAS5D,GAE/E,CACF,CAEAmG,EAAK4B,MAAO,EAADlF,EAAa,IAAW,UACnCsD,EAAKmB,eAAezE,GAAK,IAAIM,EAAmB,EAAG,EAAGS,EAAS5D,EACjE,CAEQ,iBAAA4G,WAEN,IAAK,MAAMzF,KAAQ/U,KAAK4X,QAAQ9C,SACN,cAApBC,EAAKsE,aACPtE,EAAK4E,UAAY,GAIrB,MAAMrc,EAAS0C,KAAK6R,UAAUzF,MAAM9O,OACpC,IAAK,IAAIgW,EAAI,EAAGA,EAAItT,KAAK6R,UAAU7F,OAAQsH,EAAG,CAC5C,MAAMyG,EAAOzc,EAAO0c,MAAM5I,IAAIkC,GAC9B,GAAKyG,EAGL,IAAK,IAAItD,EAAI,EAAGA,EAAIzW,KAAK6R,UAAU9F,OAAQ0K,EACzC,GAAuC,UAAnCsD,EAAK4B,MAAO,EAADlF,EAAa,GAAoC,CAC9D,MAAM4F,EAA8B,QAAtBlQ,EAAA4N,EAAKmB,eAAezE,UAAE,IAAAtK,OAAA,EAAAA,EAAEqL,QACtC,GAAI6E,EAAO,CACT,MAAMtH,EAAO/U,KAAK4X,QAAQxG,IAAIiL,GAC1BtH,GACFA,EAAK4E,WAET,CACF,CAEJ,CAEA,MAAMR,EAAO,GACb,IAAK,MAAOJ,EAAIhE,KAAS/U,KAAK4X,QAAQwB,UACZ,cAApBrE,EAAKsE,YAA+BtE,EAAK4E,YAChC,QAAXpM,EAAAwH,EAAKyD,cAAM,IAAAjL,GAAAA,EAAE5F,UACbwR,EAAKza,KAAKqa,IAGd,IAAK,MAAMA,KAAMI,EACfnZ,KAAK8Y,QAAQC,EAEjB,sFCnpBF,MAAAha,EAAAC,EAAA,KAEAqK,EAAArK,EAAA,KAEAsd,EAAAtd,EAAA,KAMMud,EAAkBxd,EAAAnC,iBAkIxB,SAAS4f,EAAU/e,GACjB,OAAIsB,EAAA5B,WAAmBM,GACP,IAARA,IAAiB,IAAMA,IAAU,EAAI,MAAS,IAAMA,IAAU,GAAK,MAAS,EAAIA,IAAU,GAAK,GACzG,CApIA8e,EAAgBrZ,IAAInE,EAAAjC,oCAGpB,MAKE,WAAAiD,CACmBmC,EACAiI,EACAC,GAFApK,KAAAkC,MAAAA,EACAlC,KAAAmK,SAAAA,EACAnK,KAAAoK,cAAAA,EAPXpK,KAAAyc,MAAQ,EACRzc,KAAAsK,UAAW,GAQjB,EAAAgS,EAAAxd,cAAa,CACX0B,YAAqC,EAAxBR,KAAKkC,MAAM8K,WACxBtP,QAAS6e,EACT5b,aAAcX,KAAKkC,MAAMwa,oBACxBrb,KAAKlD,GAAK6B,KAAK+K,KAAO5M,EAC3B,CAEO,KAAA+M,GAODlL,KAAK+K,OACP/K,KAAK+K,KAAK9G,UAETjE,KAAK+K,KAAa/H,SAAS2C,KAAK,GACjC3F,KAAK+K,KAAK1H,KAAK,EAAGkZ,EAAiBvc,KAAKkC,MAAMwa,mBAElD,CAEO,IAAAC,CAAKC,SAGV,GAFA5c,KAAKyc,MAAQ,EACbzc,KAAKsK,UAAW,EACZtK,KAAK+K,KAAM,CACb,MAAMrK,EAAiC,IAArBkc,EAAOA,OAAO,GAAW,EA4DjD,SAAyBC,EAAqBC,GAC5C,IAAIC,EAAK,EACT,IAAKD,EAGH,OAAOC,EAET,GAAIF,EAAKG,YACP,GAAIH,EAAKI,cACPF,EAAKP,EAAUM,EAAOI,WAAWC,WAC5B,GAAIN,EAAKO,UAAW,CACzB,MAAMC,EAAKR,EAAK9c,YAAqCud,WAAWT,EAAKU,cACrER,GAAK,EAAAhe,EAAAzD,eAAc+hB,EACrB,MACEN,EAAKP,EAAUM,EAAOU,KAAKX,EAAKU,cAAcJ,WAGhD,GAAIN,EAAKY,cACPV,EAAKP,EAAUM,EAAOY,WAAWP,WAC5B,GAAIN,EAAKc,UAAW,CACzB,MAAMN,EAAKR,EAAK9c,YAAqCud,WAAWT,EAAKe,cACrEb,GAAK,EAAAhe,EAAAzD,eAAc+hB,EACrB,MACEN,EAAKP,EAAUM,EAAOU,KAAKX,EAAKe,cAAcT,MAGlD,OAAOJ,CACT,CAvFqDc,CAC7C7d,KAAKoK,cAAcgC,MAAMwN,cAAckE,aACD,QAAtC3R,EAAAnM,KAAKoK,cAAcgC,MAAM2R,qBAAa,IAAA5R,OAAA,EAAAA,EAAE2Q,QAC1C9c,KAAK+K,KAAK1H,KAAK3C,EAAW,KAAMV,KAAKkC,MAAMwa,kBAC7C,CACF,CAEO,GAAAvR,CAAI/F,EAAmBC,EAAeC,GAC3C,IAAItF,KAAKsK,UAAatK,KAAK+K,KAA3B,CAIA,GADA/K,KAAKyc,OAASnX,EAAMD,EAChBrF,KAAKyc,MAAQzc,KAAKkC,MAAM8b,eAI1B,OAHAzgB,QAAQC,KAAK,kCACbwC,KAAKsK,UAAW,OAChBtK,KAAK+K,KAAK9G,UAGZ,IACEjE,KAAK+K,KAAKnM,OAAOwG,EAAMC,EAAOC,EAChC,CAAE,MAAOwC,GACPvK,QAAQC,KAAK,uCAAuCsK,KACpD9H,KAAKsK,UAAW,EAChBtK,KAAK+K,KAAK9G,SACZ,CAdA,CAeF,CAEO,MAAAga,CAAOzS,SACZ,GAAIxL,KAAKsK,WAAakB,IAAYxL,KAAK+K,KACrC,OAAO,EAGT,MAAM7K,EAAQF,KAAK+K,KAAK7K,MAClB8D,EAAShE,KAAK+K,KAAK/G,OAGzB,IAAK9D,IAAU8D,EAIb,OAHIA,GACFhE,KAAKmK,SAAS+T,cAAcla,IAEvB,EAGT,MAAM8H,EAASzC,EAAAgE,cAAcC,kBAAatF,EAAW9H,EAAO8D,GAM5D,OALuB,QAAvBmI,EAAAL,EAAO0B,WAAW,aAAK,IAAArB,GAAAA,EAAEsB,aAAa,IAAIN,UAAUnN,KAAK+K,KAAK9E,MAAyC/F,EAAO8D,GAAS,EAAG,GACtHhE,KAAK+K,KAAKnG,YAxFM,SAyFlB5E,KAAK+K,KAAK9G,UAEZjE,KAAKmK,SAASuD,SAAS5B,IAChB,CACT,2FCtGF,MAAAxC,EAAAtK,EAAA,yBAWA,MAEE,WAAAe,CACmBoK,EACAjI,EACAgI,EACA2H,GAHA7R,KAAAmK,SAAAA,EACAnK,KAAAkC,MAAAA,EACAlC,KAAAkK,UAAAA,EACAlK,KAAA6R,UAAAA,EALX7R,KAAAwQ,cAA+B,CAAEC,WAAW,EAAMC,MAAO,MAAOC,OAAQ,EAAGC,UAAW,QAM3F,CAMI,QAAAlD,CAASmD,GACd7Q,KAAKwQ,cAAcC,UAAYzQ,KAAKkC,MAAMic,eAC1Cne,KAAKmK,SAASuD,SAASmD,EAAK7Q,KAAKwQ,cACnC,CAOO,aAAA0N,CAAcla,GACnB,GAAIhE,KAAKkC,MAAMic,eAAgB,CAC7B,IAAIhL,EAAWnT,KAAKkK,UAAUiJ,UACN,IAApBA,EAASjT,QAAqC,IAArBiT,EAASnP,SACpCmP,EAAW7J,EAAAqC,mBAEb,MAAMK,EAAOjQ,KAAKuI,KAAKN,EAASmP,EAASnP,QACzC,IAAK,IAAIlG,EAAI,EAAGA,EAAIkO,IAAQlO,EAC1BkC,KAAK6R,UAAUzF,MAAMwN,cAAcO,UAEvC,CACF,iLC3CF,MAAA9Q,EAAArK,EAAA,KACAsK,EAAAtK,EAAA,KACA2K,EAAA3K,EAAA,KAEAuK,EAAAC,EAAAxK,EAAA,MACAof,EAAApf,EAAA,4BA0BA,MAiCE,WAAAe,CACmBmC,EACAgI,EACAmU,EACAjU,GAHApK,KAAAkC,MAAAA,EACAlC,KAAAkK,UAAAA,EACAlK,KAAAqe,cAAAA,EACAre,KAAAoK,cAAAA,EApCXpK,KAAAsK,UAAW,EACXtK,KAAAqK,YAAc,EACdrK,KAAAse,cAAe,EAEfte,KAAAue,eAAuC,KAOvCve,KAAAwe,gBAAiB,EAGjBxe,KAAAye,aAAe,IAAIphB,YAAW,KAC9B2C,KAAA0e,eAAiB,EAGjB1e,KAAA2e,kBAAoB,EACpB3e,KAAA4e,kBAAoB,EAGpB5e,KAAA6e,eAAuC,KAIvC7e,KAAA8e,sBAA2D,IAAI/M,IAarE/R,KAAK+e,iBAAmBhjB,KAAKuI,KAAiC,EAA5BtE,KAAKkC,MAAM8c,eAAqB,GAElEhf,KAAKif,qBAAuBljB,KAAKE,IAAG,QAAiC+D,KAAK+e,iBAC5E,CAEO,KAAA7T,GACLlL,KAAKqK,cACLrK,KAAKkf,qBACDlf,KAAKue,iBACPve,KAAKue,eAAeta,UACpBjE,KAAKue,eAAiB,MAExBve,KAAKqe,cAAcnT,OACrB,CAEO,OAAAvD,GACL3H,KAAKkL,OACP,CAEQ,mBAAAiU,CAAoB5J,GAC1BvV,KAAK8e,sBAAsB5I,OAAOX,GAC9BvV,KAAKof,kBAAoB7J,IAC3BvV,KAAKof,qBAAkBpX,EAE3B,CAEQ,kBAAAkX,GACN,IAAK,MAAMG,KAAWrf,KAAK8e,sBAAsBhK,SAC/CuK,EAAQC,QAAQrb,UAElBjE,KAAK8e,sBAAsBhW,QAC3B9I,KAAKof,qBAAkBpX,CACzB,CAEO,KAAA3C,GACLrF,KAAKsK,UAAW,EAChBtK,KAAKse,cAAe,EACpBte,KAAKwe,gBAAiB,EACtBxe,KAAK0e,eAAiB,EACtB1e,KAAK6e,eAAiB,KAEtB7e,KAAK2e,kBAAoB3e,KAAK+e,iBAC9B/e,KAAK4e,kBAAoB,EACzB5e,KAAKue,eAAiB,IACxB,CAEO,GAAApT,CAAI/F,EAAmBC,EAAeC,SAC3C,IAAItF,KAAKsK,SAET,GAAKtK,KAAKwe,eAEH,CAEL,IAAIe,EAAaja,EACjB,IAAK,IAAIxH,EAAIuH,EAAOvH,EAAIwH,EAAKxH,IAC3B,GAAW,KAAPsH,EAAKtH,GAA4B,CACnCkC,KAAKwe,gBAAiB,EACtBe,EAAazhB,EACb,KACF,CAIF,MAAM0hB,EAAaD,EAAala,EAChC,GAAIrF,KAAK0e,eAAiBc,EAAU,IAElC,YADAxf,KAAKsK,UAAW,GAMlB,GAHAtK,KAAKye,aAAavb,IAAIkC,EAAKX,SAASY,EAAOka,GAAavf,KAAK0e,gBAC7D1e,KAAK0e,gBAAkBc,GAElBxf,KAAKwe,eAAgB,CAKxB,GAHAxe,KAAK6e,gBAAiB,EAAAT,EAAAqB,mBAAkBzf,KAAK0f,gCAGd1X,IAA3BhI,KAAK6e,eAAe9F,SAAwD/Q,IAApChI,KAAK6e,eAAec,YAG9D,OAFA3f,KAAK4f,cAAc5f,KAAK6e,eAAe9F,GAAI,0CAAoE,QAA3B5M,EAAEnM,KAAK6e,eAAegB,aAAK,IAAA1T,EAAAA,EAAI,QACnHnM,KAAKsK,UAAW,GAKlB,GAA8B,MAA1BtK,KAAK6e,eAAeiB,OACtB,OAIF,MAAMC,EAAeR,EAAa,EAC9BQ,EAAeza,GACjBtF,KAAKggB,eAAe5a,EAAM2a,EAAcza,EAE5C,CACF,MA3CEtF,KAAKggB,eAAe5a,EAAMC,EAAOC,EA4CrC,CAGQ,cAAA0a,CAAe5a,EAAmBC,EAAeC,uBACvD,GAAItF,KAAKsK,SAAU,OAKnB,MAAM2V,EAA4D,QAAlD3R,EAA0B,QAA1BpC,EAAsB,QAAnBC,EAAAnM,KAAK6e,sBAAc,IAAA1S,OAAA,EAAAA,EAAE4M,UAAE,IAAA7M,EAAAA,EAAIlM,KAAKof,uBAAe,IAAA9Q,EAAAA,EAAI,EAChE+Q,EAAUrf,KAAK8e,sBAAsB1N,IAAI6O,GACzCC,EAA+C,QAA5B1M,EAAG6L,aAAO,EAAPA,EAASc,wBAAgB,IAAA3M,EAAAA,EAAI,EAGzD,GAFAxT,KAAK4e,mBAAqBtZ,EAAMD,EACF6a,EAAsBlgB,KAAK4e,kBAC7B5e,KAAK2e,kBAAmB,CAClD,MAAMyB,EAAsC,QAAtBC,EAAGrgB,KAAKue,sBAAc,IAAA8B,EAAAA,EAAIhB,aAAO,EAAPA,EAASC,QASzD,OARIc,GACFA,EAAiBnc,UAEnBjE,KAAKue,eAAiB,KAClBc,GACFrf,KAAKmf,oBAAoBc,QAE3BjgB,KAAKsK,UAAW,EAElB,CAEA,IAAItK,KAAKse,aAAT,CAKA,IAHIe,aAAO,EAAPA,EAASC,WAAYtf,KAAKue,iBAC5Bve,KAAKue,eAAiBc,EAAQC,UAE3Btf,KAAKue,eAAgB,CAExB,MAAM+B,EAAkBtgB,KAAK+e,iBAAmB,OAChD,GAAIuB,EAA4C,IAA1BtgB,KAAKkC,MAAMiW,aAK/B,OAJAnY,KAAKsK,UAAW,YACgBtC,KAAT,QAAnBuF,EAAAvN,KAAK6e,sBAAc,IAAAtR,OAAA,EAAAA,EAAEwL,KACvB/Y,KAAK4f,cAAc5f,KAAK6e,eAAe9F,GAAI,uCAAiE,QAA3BwH,EAAEvgB,KAAK6e,eAAegB,aAAK,IAAAU,EAAAA,EAAI,IAIpH,MAAMC,EAAazkB,KAAKC,IAAI,EAAGD,KAAKmR,MAAgC,IAA1BlN,KAAKkC,MAAMiW,aAAyBmI,IAC9E,KAAOtgB,KAAK8e,sBAAsB/U,MAAQyW,GAAY,CACpD,MAAMC,EAASzgB,KAAK8e,sBAAsB1F,UAAUsH,OAAO5kB,MAC3D,IAAK2kB,EAAQ,MACbA,EAAO,GAAGnB,QAAQrb,UAClBjE,KAAKmf,oBAAoBsB,EAAO,SACPzY,IAArByY,EAAO,GAAGE,IAAI5H,IAChB/Y,KAAK4f,cAAca,EAAO,GAAGE,IAAI5H,GAAI,uCAA2D,QAArB6H,EAAEH,EAAO,GAAGE,IAAId,aAAK,IAAAe,EAAAA,EAAI,EAExG,CACA5gB,KAAKue,eAAiB,IAAIhV,EAAAyB,QAAa,QAA8BhL,KAAK+e,iBAAkB/e,KAAKif,sBACjGjf,KAAKue,eAAelb,MACtB,CA/Le,IAiMXrD,KAAKue,eAAepT,IAAI/F,EAAKX,SAASY,EAAOC,MAC/CtF,KAAKue,eAAeta,UACpBjE,KAAKue,eAAiB,KACtBve,KAAKse,cAAe,EAChBe,GACFrf,KAAKmf,oBAAoBc,GAlCN,CAqCzB,CAEO,GAAA3a,CAAIkG,WACT,GAAIxL,KAAKsK,WAAakB,EAKpB,OAJIxL,KAAKue,iBACPve,KAAKue,eAAeta,UACpBjE,KAAKue,eAAiB,OAEjB,EAIT,GAAIve,KAAKwe,eACP,OAAOxe,KAAK6gB,0BAId,MAAMF,EAAM3gB,KAAK6e,eAGjB,GAAc,MAAV8B,EAAIb,OACN,OAAO9f,KAAK8gB,cAAcH,GAI5B,MAAMV,EAA2C,QAAjC1S,EAAS,QAATpB,EAAGwU,EAAI5H,UAAE,IAAA5M,EAAAA,EAAInM,KAAKof,uBAAe,IAAA7R,EAAAA,EAAI,EAC/CwT,EAA4B,IAAbJ,EAAIK,KACnB3B,EAAUrf,KAAK8e,sBAAsB1N,IAAI6O,GAE/C,GAAIc,EAgBF,OAfI/gB,KAAKue,iBACHc,GACFA,EAAQc,kBAAoBngB,KAAK4e,kBACjCS,EAAQ4B,YAAc5B,EAAQ4B,aAAejhB,KAAKse,cAElDte,KAAK8e,sBAAsB5b,IAAI+c,EAAY,CACzCU,IAAGnkB,OAAA2F,OAAA,GAAOwe,GACVrB,QAAStf,KAAKue,eACd4B,iBAAkBngB,KAAK4e,kBACvBqC,YAAajhB,KAAKse,eAGtBte,KAAKof,gBAAkBa,EACvBjgB,KAAKue,eAAiB,OAEjB,EAILc,IACFrf,KAAKof,qBAAkBpX,GAGzB,IAAIiZ,EAAcjhB,KAAKse,aACnB4C,EAAWP,EACXrB,EAAUtf,KAAKue,eAEfc,IACF6B,EAAW7B,EAAQsB,IACnBrB,EAAUD,EAAQC,QAClB2B,EAAcA,GAAe5B,EAAQ4B,YACrCjhB,KAAK8e,sBAAsB5I,OAAO+J,IAGpC,IAAIkB,EAAa,IAAI/jB,WAAW,GAC5BkiB,IA1QW,IA2QTA,EAAQha,QACV2b,GAAc,GAEhBE,EAAa7B,EAAQrZ,OAEvBjG,KAAKue,eAAiB,KAKtB,MAAMhf,EAASS,KAAKohB,8BAA8BF,EAAUC,EAAYF,GAIxE,OAHI3B,GACFA,EAAQrb,UAEH1E,CACT,CAIQ,uBAAAmgB,GACN,IAAI2B,EAAM,GACV,IAAK,IAAIvjB,EAAI,EAAGA,EAAIkC,KAAK0e,eAAgB5gB,IACvCujB,GAAOnS,OAAOoS,cAActhB,KAAKye,aAAa3gB,IAEhD,OAAOujB,CACT,CAEQ,uBAAAR,iBACN,MAAMF,GAAM,EAAAvC,EAAAqB,mBAAkBzf,KAAK0f,2BAGnC,QAAe1X,IAAX2Y,EAAI5H,SAAwC/Q,IAApB2Y,EAAIhB,YAE9B,OADA3f,KAAK4f,cAAce,EAAI5H,GAAI,0CAAoD,QAAX5M,EAAEwU,EAAId,aAAK,IAAA1T,EAAAA,EAAI,IAC5E,EAKT,OAFyB,QAAboB,EAAGoT,EAAIb,cAAM,IAAAvS,EAAAA,EAAI,KAG3B,QACE,OAAOvN,KAAK8gB,cAAcH,GAC5B,QAEE,OADA3gB,KAAK4f,cAAoB,QAAP1T,EAACyU,EAAI5H,UAAE,IAAA7M,EAAAA,EAAI,EAAG,KAAe,QAAXoC,EAAEqS,EAAId,aAAK,IAAAvR,EAAAA,EAAI,IAC5C,EACT,QACE,OAAOtO,KAAKuhB,iBAAiBZ,GAC/B,QAQE,YAHe3Y,IAAX2Y,EAAI5H,IACN/Y,KAAK4f,cAAce,EAAI5H,GAAI,4BAAsC,QAAXvF,EAAEmN,EAAId,aAAK,IAAArM,EAAAA,EAAI,IAEhE,EAEb,CAEQ,6BAAA4N,CAA8BT,EAAoBa,EAAmBP,iBAG3E,OAFyB,QAAb9U,EAAGwU,EAAIb,cAAM,IAAA3T,EAAAA,EAAI,KAG3B,QAA2B,CACzB,MAAM5M,EAASS,KAAKyhB,gBAAgBd,EAAKa,EAAOP,GAUhD,MAPkC,OAAb,QAAjB1T,EAACoT,EAAIe,oBAAY,IAAAnU,EAAAA,EAAI,WAA2BvF,IAAX2Y,EAAI5H,KACvCkI,EACFjhB,KAAK4f,cAAce,EAAI5H,GAAI,6BAAuC,QAAX7M,EAAEyU,EAAId,aAAK,IAAA3T,EAAAA,EAAI,GAC7DsV,EAAMzjB,OAAS,GACxBiC,KAAK4f,cAAce,EAAI5H,GAAI,KAAe,QAAXzK,EAAEqS,EAAId,aAAK,IAAAvR,EAAAA,EAAI,IAG3C/O,CACT,CACA,QACE,OAAOS,KAAK2hB,uBAAuBhB,EAAKa,EAAOP,GACjD,QACE,OAAOjhB,KAAK4hB,aAAajB,EAAKa,EAAOP,GACvC,QAEE,OAAOjhB,KAAKuhB,iBAAiBZ,GAC/B,QAQE,YAHe3Y,IAAX2Y,EAAI5H,IACN/Y,KAAK4f,cAAce,EAAI5H,GAAI,4BAAsC,QAAXvF,EAAEmN,EAAId,aAAK,IAAArM,EAAAA,EAAI,IAEhE,EAEb,CAEQ,gBAAA+N,CAAiBZ,SACvB,QAAe3Y,IAAX2Y,EAAI5H,GACN,OAAO,EAET,MAAMA,EAAK4H,EAAI5H,GACT8I,EAAQ7hB,KAAKqe,cAAcyD,SAAS/I,GAC1C,OAAK8I,EAIU7hB,KAAK+hB,cAAcF,EAAOlB,GAC3Btf,KAAKmK,UAEjB,OADAxL,KAAK4f,cAAc7G,EAAIvN,EAAU,KAAO,gCAA0C,QAAXW,EAAEwU,EAAId,aAAK,IAAA1T,EAAAA,EAAI,EAAGwU,EAAIqB,cACtF,KANPhiB,KAAK4f,cAAc7G,EAAI,yBAAmC,QAAX5M,EAAEwU,EAAId,aAAK,IAAA1T,EAAAA,EAAI,EAAGwU,EAAIqB,cAC9D,EAOX,CAEQ,eAAAP,CAAgBd,EAAoBa,EAAmBP,mBAY7D,MAAqB,OADgB,QAAnB9U,EAAGwU,EAAIe,oBAAY,IAAAvV,EAAAA,EAAI,WAExBnE,IAAX2Y,EAAI5H,IACN/Y,KAAK4f,cAAce,EAAI5H,GAAI,yCAAmD,QAAXxL,EAAEoT,EAAId,aAAK,IAAAtS,EAAAA,EAAI,IAE7E,IAGL0T,GAAgC,IAAjBO,EAAMzjB,QAEzBiC,KAAKqe,cAAc4D,WAAWtB,EAAI5H,GAAI,CACpC3T,KAAM,IAAIuI,KAAK,CAAC6T,IAChBthB,MAAgB,QAAXgM,EAAEyU,EAAIzgB,aAAK,IAAAgM,EAAAA,EAAI,EACpBlI,OAAkB,QAAZsK,EAAEqS,EAAI3c,cAAM,IAAAsK,EAAAA,EAAI,EACtB4T,OAAmB,QAAX1O,EAACmN,EAAIuB,cAAM,IAAA1O,EAAAA,EAAA,GACnB2O,YAA4B,QAAjB9B,EAAEM,EAAIwB,mBAAW,IAAA9B,EAAAA,EAAI,MAPY,EAUhD,CAEQ,sBAAAsB,CAAuBhB,EAAoBa,EAAmBP,WACpE,GAAIA,EAIF,YAHejZ,IAAX2Y,EAAI5H,IACN/Y,KAAK4f,cAAce,EAAI5H,GAAI,6BAAuC,QAAX5M,EAAEwU,EAAId,aAAK,IAAA1T,EAAAA,EAAI,IAEjE,EAGTnM,KAAKyhB,gBAAgBd,EAAKa,EAAOP,GAEjC,MAAMlI,EAAW,QAATxL,EAAGoT,EAAI5H,UAAE,IAAAxL,EAAAA,EAAIvN,KAAKqe,cAAc+D,YAClCP,EAAQ7hB,KAAKqe,cAAcyD,SAAS/I,GAC1C,GAAI8I,EAAO,CACT,MAAMtiB,EAASS,KAAK+hB,cAAcF,EAAOlB,GACzC,YAAe3Y,IAAX2Y,EAAI5H,GACCxZ,EAAO8B,KAAKmK,UAEjB,OADAxL,KAAK4f,cAAc7G,EAAIvN,EAAU,KAAO,gCAA0C,QAAXW,EAAEwU,EAAId,aAAK,IAAA1T,EAAAA,EAAI,IAC/E,IAGJ5M,EAAO8B,KAAK,KAAM,EAC3B,CACA,OAAO,CACT,CAEQ,YAAAugB,CAAajB,EAAoBa,EAAmBP,mBAC1D,MAAMlI,EAAW,QAAT5M,EAAGwU,EAAI5H,UAAE,IAAA5M,EAAAA,EAAI,EACf0T,EAAiB,QAAZtS,EAAGoT,EAAId,aAAK,IAAAtS,EAAAA,EAAI,EAM3B,GAAqB,OADgB,QAAnBrB,EAAGyU,EAAIe,oBAAY,IAAAxV,EAAAA,EAAI,KAGvC,OADAlM,KAAK4f,cAAc7G,EAAI,yCAA0C8G,IAC1D,EAIT,GAAIoB,EAEF,OADAjhB,KAAK4f,cAAc7G,EAAI,6BAA8B8G,IAC9C,EAIT,GAAqB,IAAjB2B,EAAMzjB,OAER,OADAiC,KAAK4f,cAAc7G,EAAI,KAAM8G,IACtB,EAGT,MAAMqC,EAAmB,QAAb5T,EAAGqS,EAAIuB,cAAM,IAAA5T,EAAAA,EAAA,GAEzB,GAAU,MAAN4T,EACFliB,KAAK4f,cAAc7G,EAAI,KAAM8G,OACxB,CACL,MAAM3f,EAAiB,QAAZsT,EAAGmN,EAAIzgB,aAAK,IAAAsT,EAAAA,EAAI,EACrBxP,EAAmB,QAAbqc,EAAGM,EAAI3c,cAAM,IAAAqc,EAAAA,EAAI,EAE7B,IAAKngB,IAAU8D,EAEb,OADAhE,KAAK4f,cAAc7G,EAAI,sDAAuD8G,IACvE,EAGT,MACMwC,EAAgBniB,EAAQ8D,GADF,KAANke,EAA6B,EAA2C,GAG9F,GAAIV,EAAMzjB,OAASskB,EAEjB,OADAriB,KAAK4f,cAAc7G,EAAI,iCAAkC8G,IAClD,EAGT7f,KAAK4f,cAAc7G,EAAI,KAAM8G,EAC/B,CACA,OAAO,CACT,CAEQ,aAAAiB,CAAcH,SAOpB,OALmC,QAArBxU,EAAGwU,EAAI2B,sBAAc,IAAAnW,EAAAA,EAAI,KAMrC,IAAK,IACL,IAAK,IACHnM,KAAKkf,qBACLlf,KAAKqe,cAAckE,YACnB,MACF,IAAK,IACL,IAAK,IAKH,QAAeva,IAAX2Y,EAAI5H,GAAkB,CACxB,MAAMsG,EAAUrf,KAAK8e,sBAAsB1N,IAAIuP,EAAI5H,IAC/CsG,GACFA,EAAQC,QAAQrb,UAElBjE,KAAKmf,oBAAoBwB,EAAI5H,IAC7B/Y,KAAKqe,cAAcmE,WAAW7B,EAAI5H,GACpC,EAMJ,OAAO,CACT,CAEQ,aAAA6G,CAAc7G,EAAYV,EAAiBwH,EAAemC,GAChE,MAAMS,EAAmB,OAAZpK,EACb,GAAIoK,GAAQ5C,GAAS,EAAG,OACxB,IAAK4C,GAAQ5C,GAAS,EAAG,OAEzB,MACM6C,EAAW,QAAW3J,IADdiJ,EAAc,MAAMA,IAAgB,MACR3J,OAC1CrY,KAAKoK,cAAcgC,MAAMuW,YAAYC,iBAAiBF,EACxD,CAIQ,aAAAX,CAAcF,EAAwBlB,GAC5C,OAAO3gB,KAAK6iB,kBAAkBhB,EAAOlB,GAClCtf,KAAK,KAAM,GACX6M,MAAM,KAAM,EACjB,CAEQ,uBAAM2U,CAAkBhB,EAAwBlB,qBACtD,MAAM/S,EAAa5N,KAAKqK,YACxB,IAAIwM,QAAwC7W,KAAK8iB,cAAcjB,GAE/D,IACE,GAAIjU,IAAe5N,KAAKqK,YAAa,MAAM,IAAIjI,MAAM,yBACrD,MAAM2gB,EAAQhnB,KAAKC,IAAI,EAAQ,QAAPkQ,EAAEyU,EAAIlK,SAAC,IAAAvK,EAAAA,EAAI,GAC7B8W,EAAQjnB,KAAKC,IAAI,EAAQ,QAAPsS,EAAEqS,EAAIrN,SAAC,IAAAhF,EAAAA,EAAI,GAC7B2U,EAAQtC,EAAIzM,aAAgB2C,EAAO3W,MAAQ6iB,EAC3CG,EAAQvC,EAAIxM,cAAiB0C,EAAO7S,OAASgf,EAE7CG,EAAWpnB,KAAKC,IAAI,EAAG6a,EAAO3W,MAAQ6iB,GACtCK,EAAWrnB,KAAKC,IAAI,EAAG6a,EAAO7S,OAASgf,GACvCK,EAAatnB,KAAKC,IAAI,EAAGD,KAAKE,IAAIgnB,EAAOE,IACzCG,EAAavnB,KAAKC,IAAI,EAAGD,KAAKE,IAAIinB,EAAOE,IAE/C,GAAmB,IAAfC,GAAmC,IAAfC,EACtB,MAAM,IAAIlhB,MAAM,4BAGlB,GAAc,IAAV2gB,GAAyB,IAAVC,GAAeK,IAAexM,EAAO3W,OAASojB,IAAezM,EAAO7S,OAAQ,CAC7F,MAAMuf,QAAgB1V,kBAAkBgJ,EAAQkM,EAAOC,EAAOK,EAAYC,GAC1EzM,EAAO5I,QACP4I,EAAS0M,CACX,CAEA,MAAMpV,GAA8B,QAAzBhC,EAAAnM,KAAKkK,UAAU0B,kBAAU,IAAAO,OAAA,EAAAA,EAAEN,IAAIuC,KAAKlO,QAASoJ,EAAAqC,kBAAkBzL,MACpEmO,GAA8B,QAAzBd,EAAAvN,KAAKkK,UAAU0B,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIuC,KAAKpK,SAAUsF,EAAAqC,kBAAkB3H,OAI3E,IAAIwf,EACAC,OACgBzb,IAAhB2Y,EAAI+C,cAAsC1b,IAAb2Y,EAAI3U,MACnCwX,EAAU7C,EAAI+C,QACdD,EAAU9C,EAAI3U,WACWhE,IAAhB2Y,EAAI+C,SACbF,EAAU7C,EAAI+C,QACdD,EAAU1nB,KAAKC,IAAI,EAAGD,KAAKuI,KAAMuS,EAAO7S,OAAS6S,EAAO3W,OAAUsjB,EAAUrV,GAAME,UAC5DrG,IAAb2Y,EAAI3U,MACbyX,EAAU9C,EAAI3U,KACdwX,EAAUznB,KAAKC,IAAI,EAAGD,KAAKuI,KAAMuS,EAAO3W,MAAQ2W,EAAO7S,QAAWyf,EAAUpV,GAAMF,MAElFqV,EAAUznB,KAAKuI,KAAKuS,EAAO3W,MAAQiO,GACnCsV,EAAU1nB,KAAKuI,KAAKuS,EAAO7S,OAASqK,IAGtC,IAAI3C,EAAImL,EAAO3W,MACX9B,EAAIyY,EAAO7S,OAQf,QALoBgE,IAAhB2Y,EAAI+C,cAAsC1b,IAAb2Y,EAAI3U,OACnCN,EAAI3P,KAAKQ,MAAMinB,EAAUrV,GACzB/P,EAAIrC,KAAKQ,MAAMknB,EAAUpV,IAGvB3C,EAAItN,EAAI4B,KAAKkC,MAAM8K,WACrB,MAAM,IAAI5K,MAAM,6BAIlB,MAAM9E,EAAS0C,KAAKoK,cAAcgC,MAAM9O,OAClCqmB,EAASrmB,EAAOmZ,EAChBmN,EAAStmB,EAAOgW,EAChBuQ,EAAavmB,EAAO2c,MAOpBvJ,OAD6B1I,IAAf2Y,EAAIhQ,QAAwBgQ,EAAIhQ,OAAS,EACrB,SAAW,MAEnD,GAAIjF,IAAMmL,EAAO3W,OAAS9B,IAAMyY,EAAO7S,OAAQ,CAC7C,MAAM8f,QAAejW,kBAAkBgJ,EAAQ,CAAE/I,YAAapC,EAAGqC,aAAc3P,IAC/EyY,EAAO5I,QACP4I,EAASiN,CACX,CAGA,MAAMC,EAAUhoB,KAAKE,IAAIF,KAAKC,IAAI,EAAc,QAAbwX,EAAEmN,EAAIoD,eAAO,IAAAvQ,EAAAA,EAAI,GAAIrF,EAAK,GACvD6V,EAAUjoB,KAAKE,IAAIF,KAAKC,IAAI,EAAc,QAAbqkB,EAAEM,EAAIqD,eAAO,IAAA3D,EAAAA,EAAI,GAAIhS,EAAK,GAC7D,GAAgB,IAAZ0V,GAA6B,IAAZC,EAAe,CAKlC,MAAMC,OAA2Bjc,IAAhB2Y,EAAI+C,QAAyB3nB,KAAKQ,MAAMinB,EAAUrV,GAAM0I,EAAO3W,MAAQ6jB,EAClFG,OAAwBlc,IAAb2Y,EAAI3U,KAAsBjQ,KAAKQ,MAAMknB,EAAUpV,GAAMwI,EAAO7S,OAASggB,EAChFG,EAAe9a,EAAAgE,cAAcC,aAAawJ,OAAOxF,SAAU2S,EAASC,GACpEE,EAAYD,EAAa3W,WAAW,MAC1C,IAAK4W,EACH,MAAM,IAAIhiB,MAAM,0CAElBgiB,EAAUzP,UAAUkC,EAAQkN,EAASC,GAErC,MAAMK,QAAqBxW,kBAAkBsW,GAM7C,GALAA,EAAajkB,MAAQikB,EAAangB,OAAS,EAC3C6S,EAAO5I,QACP4I,EAASwN,EACT3Y,EAAImL,EAAO3W,MACX9B,EAAIyY,EAAO7S,OACP0H,EAAItN,EAAI4B,KAAKkC,MAAM8K,WACrB,MAAM,IAAI5K,MAAM,kCAEE4F,IAAhB2Y,EAAI+C,UACNF,EAAUznB,KAAKuI,KAAKuS,EAAO3W,MAAQiO,SAEpBnG,IAAb2Y,EAAI3U,OACNyX,EAAU1nB,KAAKuI,KAAKuS,EAAO7S,OAASqK,GAExC,CAEA,GAAIT,IAAe5N,KAAKqK,YAAa,MAAM,IAAIjI,MAAM,yBACrD,MAAMuO,EAAmB,QAAb4P,EAAGI,EAAIhQ,cAAM,IAAA4P,EAAAA,EAAI,EAO7B,GANAvgB,KAAKqe,cAAc3Q,SAASmU,EAAM9I,GAAIlC,GAAQ,EAAMnG,EAAOC,GAC3DkG,OAAS7O,EAKkB,IAAvB2Y,EAAI2D,eAAsB,CAE5B,MAAMC,EAAWjnB,EAAO2c,MAAQ4J,EAChCvmB,EAAOmZ,EAAIkN,EAEXrmB,EAAOgW,EAAIvX,KAAKC,IAAI4nB,EAASW,EAAU,EACzC,MAGEjnB,EAAOmZ,EAAI1a,KAAKE,IAAI0nB,EAASH,EAASxjB,KAAKoK,cAAc2B,KAE7D,CAAE,MAAOjE,GAEP,MADA+O,SAAAA,EAAQ5I,QACFnG,CACR,CACF,CAGQ,mBAAMgb,CAAcjB,GAC1B,IAAIL,EAAoB,IAAIpkB,iBAAiBykB,EAAMzc,KAAKof,eAMxD,GAJqB,MAAjB3C,EAAMM,cACRX,QAAcxhB,KAAKykB,gBAAgBjD,IAGrB,MAAZK,EAAMK,OAA4B,CACpC,MAAMtV,GAAU,EAAAjD,EAAAmD,WAAU0U,GAG1B,GAAqB,cAAjB5U,EAAQG,QAA0BH,EAAQ1M,MAAQ,MAAQ0M,EAAQ5I,OAAS,IAAM4I,EAAQ1M,MAAQ0M,EAAQ5I,OAAShE,KAAKkC,MAAM8K,WAC/H,MAAM,IAAIyL,WAAW,qDAEvB,MAAM9L,EAAO,IAAIgB,KAAK,CAAC6T,GAAoB,CAAE3X,KAAM,cACnD,IAAKiN,OAAOjJ,kBAAmB,CAC7B,MAAM6W,EAAMC,IAAIC,gBAAgBjY,GAC1BkE,EAAM,IAAIgU,MAChB,OAAO,IAAIlT,QAAqB,CAACC,EAASkT,KACxCjU,EAAIkU,iBAAiB,OAAQ,WAC3BJ,IAAIK,gBAAgBN,GACpB,MAAM5Y,EAASzC,EAAAgE,cAAcC,aAAawJ,OAAOxF,SAAUT,EAAI3Q,MAAO2Q,EAAI7M,QACnD,QAAvBmI,EAAAL,EAAO0B,WAAW,aAAK,IAAArB,GAAAA,EAAEwI,UAAU9D,EAAK,EAAG,GAC3ChD,kBAAkB/B,GAAQzK,KAAKuQ,GAAS1D,MAAM4W,KAEhDjU,EAAIkU,iBAAiB,QAAS,KAC5BJ,IAAIK,gBAAgBN,GACpBI,EAAO,IAAI1iB,MAAM,2BAEnByO,EAAIoU,IAAMP,GAEd,CACA,OAAO7W,kBAAkBlB,EAC3B,CAGA,MAAMzM,EAAQ2hB,EAAM3hB,MACd8D,EAAS6d,EAAM7d,OAErB,IAAK9D,IAAU8D,EACb,MAAM,IAAI5B,MAAM,gDAGlB,MACMigB,EAAgBniB,EAAQ8D,GADI,KAAZ6d,EAAMK,OAA6B,EAA2C,GAGpG,GAAIV,EAAMzjB,OAASskB,EACjB,MAAM,IAAIjgB,MAAM,2BAGlB,MAAM8iB,EAAahlB,EAAQ8D,EAE3B,GAAgB,KAAZ6d,EAAMK,OAER,OAAOrU,kBAAkB,IAAIV,UAAU,IAAIjH,kBAAkBsb,EAAMlkB,OAAuBkkB,EAAMpU,WAAsB,EAAV8X,GAAwDhlB,EAAO8D,IAM7K,MAAMoB,EAAO,IAAIc,kBAA4B,EAAVgf,GAC7BC,EAAQ,IAAI9nB,YAAYmkB,EAAMlkB,OAAQkkB,EAAMpU,WAAYrR,KAAKmR,MAAMsU,EAAM3c,WAAa,IACtFugB,EAAQ,IAAI/nB,YAAY+H,EAAK9H,QAC7B+nB,GAA6B,EAAbH,EAEtB,IAAII,EAAY,EACZC,EAAY,EAChB,IAAK,IAAIznB,EAAI,EAAGA,EAAIunB,EAAevnB,GAAK,EAAG,CACzC,MAAM0nB,EAAKL,EAAMG,KACXG,EAAKN,EAAMG,KACXI,EAAKP,EAAMG,KAEjBF,EAAMG,KAAe,WAAaC,EAClCJ,EAAMG,KAAe,WAAcC,IAAO,GAAOC,GAAM,EACvDL,EAAMG,KAAe,WAAcE,IAAO,GAAOC,GAAM,GACvDN,EAAMG,KAAe,WAAcG,IAAO,CAC5C,CAGA,IAAIC,EAAuB,EAAbN,EACVO,EAAuB,EAAbP,EACd,IAAK,IAAIvnB,EAAIunB,EAAevnB,EAAIonB,EAAYpnB,IAC1CsH,EAAKwgB,GAAepE,EAAMmE,GAC1BvgB,EAAKwgB,EAAU,GAAKpE,EAAMmE,EAAU,GACpCvgB,EAAKwgB,EAAU,GAAKpE,EAAMmE,EAAU,GACpCvgB,EAAKwgB,EAAU,GAAE,IACjBD,GAAO,EACPC,GAAO,EAGT,OAAO/X,kBAAkB,IAAIV,UAAU/H,EAAMlF,EAAO8D,GACtD,CAEQ,qBAAMygB,CAAgBoB,GAC5B,IACE,aAAa7lB,KAAK8lB,YAAYD,EAAY,UAC5C,CAAE,MAAOzN,GACP,GAAIA,aAAiBK,WAAY,MAAML,EACvC,aAAapY,KAAK8lB,YAAYD,EAAY,cAC5C,CACF,CAEQ,iBAAMC,CAAYD,EAAwB3D,GAChD,MAAMhR,EAAQnV,KAAKE,IAAI+D,KAAKkC,MAAM8c,eAAwC,EAAxBhf,KAAKkC,MAAM8K,WAA0C,IAA1BhN,KAAKkC,MAAMiW,cACxF,IAAI4N,EAAW,EAEf,MAWMC,EAXS,IAAIC,eAA6B,CAC9C,IAAAC,CAAKC,GACH,GAAIJ,GAAYF,EAAW9nB,OAEzB,YADAooB,EAAWlY,QAGb,MAAM3I,EAAMvJ,KAAKE,IAAI8pB,EAAW,KAAMF,EAAW9nB,QACjDooB,EAAWC,QAAQ,IAAIhpB,WAAWyoB,EAAWphB,SAASshB,EAAUzgB,KAChEygB,EAAWzgB,CACb,IAEoB+gB,YAAY,IAAIC,oBAAoBpE,IAASqE,YAC7DC,EAAuB,GAC7B,IAAIC,EAAc,EAClB,IACE,OAAa,CACX,MAAMC,KAAEA,EAAI5qB,MAAEA,SAAgBkqB,EAAOW,OACrC,GAAID,EAAM,MAEV,GADAD,GAAe3qB,EAAM+I,WACjB4hB,EAAcvV,EAEhB,YADM8U,EAAOY,SAAS1Y,MAAM,QACtB,IAAIuK,WAAW,yCAEvB+N,EAAO9nB,KAAK5C,EACd,CACF,SACEkqB,EAAOa,aACT,CAEA,MAAMtnB,EAAS,IAAInC,WAAWqpB,GAC9B,IAAItiB,EAAS,EACb,IAAK,MAAM2iB,KAASN,EAClBjnB,EAAO2D,IAAI4jB,EAAO3iB,GAClBA,GAAU2iB,EAAM/oB,OAElB,OAAOwB,CACT,CAEA,UAAWwnB,GACT,OAAO/mB,KAAKqe,cAAc0I,MAC5B,CAEA,uBAAWC,GACT,OAAOhnB,KAAKqe,cAAc4I,kBAC5B,CAEA,wBAAWC,GACT,OAAOlnB,KAAK8e,qBACd,kFCptBF,SAAkC1Z,GAChC,MAAMub,EAAqB,GACrBwG,EAAQ/hB,EAAKgiB,MAAM,KAEzB,IAAK,MAAMC,KAAQF,EAAO,CACxB,MAAMG,EAAQD,EAAKngB,QAAQ,KAC3B,IAAe,IAAXogB,EAAc,SAElB,MAAM/R,EAAM8R,EAAKE,UAAU,EAAGD,GACxBxrB,EAAQurB,EAAKE,UAAUD,EAAQ,GAGrC,GAAO,MAAH/R,EAAyB,CAC3BoL,EAAIb,OAAShkB,EACb,QACF,CACA,GAAO,MAAHyZ,EAA8B,CAChCoL,EAAIwB,YAAcrmB,EAClB,QACF,CACA,GAAO,MAAHyZ,EAA+B,CACjCoL,EAAIe,aAAe5lB,EACnB,QACF,CACA,GAAO,MAAHyZ,EAAkC,CACpCoL,EAAI2B,eAAiBxmB,EACrB,QACF,CACA,MAAM0rB,EAAWxY,SAASlT,EAAO,IACjC,OAAQyZ,GACN,QAAsBoL,EAAIuB,OAASsF,EAAU,MAC7C,QAAkB7G,EAAI5H,GAAKyO,EAAU,MACrC,QAA4B7G,EAAIhB,YAAc6H,EAAU,MACxD,QAAqB7G,EAAIzgB,MAAQsnB,EAAU,MAC3C,QAAsB7G,EAAI3c,OAASwjB,EAAU,MAC7C,QAAwB7G,EAAIlK,EAAI+Q,EAAU,MAC1C,QAAwB7G,EAAIrN,EAAIkU,EAAU,MAC1C,QAA4B7G,EAAIzM,YAAcsT,EAAU,MACxD,QAA6B7G,EAAIxM,aAAeqT,EAAU,MAC1D,QAAkC7G,EAAIoD,QAAUyD,EAAU,MAC1D,QAAkC7G,EAAIqD,QAAUwD,EAAU,MAC1D,QAAuB7G,EAAI+C,QAAU8D,EAAU,MAC/C,QAAoB7G,EAAI3U,KAAOwb,EAAU,MACzC,QAAoB7G,EAAIK,KAAOwG,EAAU,MACzC,QAAqB7G,EAAId,MAAQ2H,EAAU,MAC3C,QAA+B7G,EAAI2D,eAAiBkD,EAAU,MAC9D,QAAuB7G,EAAIhQ,OAAS6W,EAAU,MAC9C,QAA4B7G,EAAIqB,YAAcwF,EAElD,CAEA,OAAO7G,CACT,wFCjLA,MAAA8G,EA6BE,WAAA1nB,CACmBoK,GAAAnK,KAAAmK,SAAAA,EA3BXnK,KAAA0nB,aAAe,EACN1nB,KAAA4X,QAAwC,IAAI7F,IAU5C/R,KAAAgnB,oBAA2C,IAAIjV,IAC/C/R,KAAA2nB,oBAA2C,IAAI5V,IAI/C/R,KAAA4nB,2BAA8BC,IAC7C,MAAMC,EAAU9nB,KAAK2nB,oBAAoBvW,IAAIyW,QAC7B7f,IAAZ8f,IACF9nB,KAAKgnB,oBAAoB9Q,OAAO4R,GAChC9nB,KAAK2nB,oBAAoBzR,OAAO2R,GAChC7nB,KAAK4X,QAAQ1B,OAAO4R,KAGhB9nB,KAAAwQ,cAA+B,CAAEC,WAAW,EAAMC,MAAO,MAAOC,OAAQ,EAAGC,UAAW,OAK5F5Q,KAAK+nB,wBAA0B/nB,KAAKmK,SAAS8O,eAC7CjZ,KAAKgoB,uBAA0BH,UACD,QAA5B1b,EAAAnM,KAAK+nB,+BAAuB,IAAA5b,GAAAA,EAAA3E,KAA5BxH,KAA+B6nB,GAC/B7nB,KAAK4nB,2BAA2BC,IAElC7nB,KAAKmK,SAAS8O,eAAiBjZ,KAAKgoB,sBACtC,CAEO,KAAA9c,GACLlL,KAAK0nB,aAAe,EACpB1nB,KAAK4X,QAAQ9O,QACb9I,KAAKgnB,oBAAoBle,QACzB9I,KAAK2nB,oBAAoB7e,OAC3B,CAEO,OAAAnB,GACL3H,KAAKkL,QACDlL,KAAKmK,SAAS8O,iBAAmBjZ,KAAKgoB,yBACxChoB,KAAKmK,SAAS8O,eAAiBjZ,KAAK+nB,wBAExC,CAEO,UAAA9F,CAAWlJ,EAAwBkP,GACxC,MAAMzQ,EAAUuB,QAAAA,EAAM/Y,KAAK0nB,eAErBQ,EAAeloB,KAAKgnB,oBAAoB5V,IAAIoG,QAC7BxP,IAAjBkgB,IACFloB,KAAKmK,SAASmP,YAAY4O,GAC1BloB,KAAKgnB,oBAAoB9Q,OAAOsB,GAChCxX,KAAK2nB,oBAAoBzR,OAAOgS,KAG7BloB,KAAK4X,QAAQlC,IAAI8B,IAAYxX,KAAK4X,QAAQ7N,MAAQ0d,EAAkBU,kBACvEnoB,KAAKooB,0BASP,MAAMC,EAAuC,IAA3BroB,KAAKmK,SAASmO,WAChCtY,KAAK4X,QAAQ1B,OAAOsB,GACpB,IAAI8Q,EAAgB,EACpB,IAAK,MAAMzG,KAAS7hB,KAAK4X,QAAQ9C,SAAUwT,GAAiBzG,EAAMzc,KAAK2E,KACvE,IAAK,MAAMwe,IAAe,EAAC,GAAO,GAChC,IAAK,MAAOC,EAAU3G,KAAU7hB,KAAK4X,QAAS,CAC5C,GAAI0Q,EAAgBL,EAAU7iB,KAAK2E,MAAQse,EAAW,MAClDroB,KAAKgnB,oBAAoBtR,IAAI8S,KAAcD,IAC/CD,GAAiBzG,EAAMzc,KAAK2E,KAC5B/J,KAAKwiB,WAAWgG,GAClB,CAOF,OAJAxoB,KAAK4X,QAAQ1U,IAAIsU,EAAOhb,OAAA2F,OAAA3F,OAAA2F,OAAA,GACnB8lB,GAAS,CACZlP,GAAIvB,KAECA,CACT,CAEO,QAAA9J,CAASoa,EAAiBjG,EAAwCpR,EAAoBC,EAAmBC,GAK9G,MAAMuX,EAAeloB,KAAKgnB,oBAAoB5V,IAAI0W,QAC7B9f,IAAjBkgB,GACFloB,KAAK2nB,oBAAoBzR,OAAOgS,GAElCloB,KAAKwQ,cAAcC,UAAYA,EAC/BzQ,KAAKwQ,cAAcE,MAAQA,EAC3B1Q,KAAKwQ,cAAcG,OAASA,EAC5B,MAAMkX,EAAY7nB,KAAKmK,SAASuD,SAASmU,EAAO7hB,KAAKwQ,eACrDxQ,KAAKgnB,oBAAoB9jB,IAAI4kB,EAASD,GACtC7nB,KAAK2nB,oBAAoBzkB,IAAI2kB,EAAWC,EAC1C,CAEO,QAAAhG,CAASgG,GACd,OAAO9nB,KAAK4X,QAAQxG,IAAI0W,EAC1B,CAEO,UAAAtF,CAAWsF,GAChB9nB,KAAK4X,QAAQ1B,OAAO4R,GACpB,MAAMD,EAAY7nB,KAAKgnB,oBAAoB5V,IAAI0W,QAC7B9f,IAAd6f,IACF7nB,KAAKmK,SAASmP,YAAYuO,GAC1B7nB,KAAKgnB,oBAAoB9Q,OAAO4R,GAChC9nB,KAAK2nB,oBAAoBzR,OAAO2R,GAEpC,CAEO,SAAAtF,GACLviB,KAAK4X,QAAQ9O,QACb,IAAK,MAAM+e,KAAa7nB,KAAKgnB,oBAAoBlS,SAC/C9U,KAAKmK,SAASmP,YAAYuO,GAE5B7nB,KAAKgnB,oBAAoBle,QACzB9I,KAAK2nB,oBAAoB7e,OAC3B,CAEA,UAAWie,GACT,OAAO/mB,KAAK4X,OACd,CAEA,sBAAWqP,GACT,OAAOjnB,KAAKgnB,mBACd,CAEA,eAAW5E,GACT,OAAOpiB,KAAK0nB,aAAe,CAC7B,CAEQ,uBAAAU,GACN,IAAK,MAAON,KAAY9nB,KAAK4X,QAAS,CACpC,GAAI5X,KAAK4X,QAAQ7N,MAAQ0d,EAAkBU,iBAAmB,EAC5D,MAEGnoB,KAAKgnB,oBAAoBtR,IAAIoS,IAChC9nB,KAAK4X,QAAQ1B,OAAO4R,EAExB,CACF,wBA1JwBL,EAAAU,iBAAmB,gBCjB7C3rB,OAAAC,eAAA5B,EAAA,cAA+CiB,OAAA,IAK/C,MAIA2sB,GAAA,EAJyBzpB,EAAQ,KAIjC0pB,QAAA,CAAgGpqB,EAAA,EAAA+e,EAAA,EAAAlf,EAAA,6lCAuJhGwqB,EAAA,IAAAvrB,WAAA,mEACAgqB,MAAA,IACArf,IAAA6gB,GAAAA,EAAAppB,WAAA,KAEAqpB,EAAA,IAAAxrB,YAAA,MACAwrB,EAAAljB,KAAA,YACA,QAAA7H,EAAA,EAAgBA,EAAA6qB,EAAA5qB,SAAgBD,EAChC+qB,EAAAF,EAAA7qB,IAAAA,GAAA,EACA,QAAAA,EAAA,EAAgBA,EAAA6qB,EAAA5qB,SAAgBD,EAChC+qB,EAAA,IAAAF,EAAA7qB,IAAAA,GAAA,GAAAA,GAAA,UACA,QAAAA,EAAA,EAAgBA,EAAA6qB,EAAA5qB,SAAgBD,EAChC+qB,EAAA,IAAAF,EAAA7qB,IAAAA,GAAA,MAAAA,GAAA,WACA,QAAAA,EAAA,EAAgBA,EAAA6qB,EAAA5qB,SAAgBD,EAChC+qB,EAAA,IAAAF,EAAA7qB,IAAAA,GAAA,GACA,MAAAgrB,EAAA,IAAA1rB,WAAA,GAkKAvC,EAAA,QAvJA,MAMA,WAAAkF,CAAAgpB,EAAAC,EAAAle,GAOA,GANA9K,KAAAipB,MAAA,KACAjpB,KAAAkpB,QAAA,EACAlpB,KAAAmpB,OAAA,EACAnpB,KAAA+oB,SAAAA,QAAAA,EAAA,QACA/oB,KAAAgpB,SAAAA,QAAAA,EAAA,WACAhpB,KAAAmpB,OAAAre,QAAAA,EAAA,MACA9K,KAAAmpB,OAAAnpB,KAAAgpB,UAAAhpB,KAAAgpB,SAAA,WACA,UAAA5mB,MAAA,wBAEA,CAKA,SAAA6D,GACA,OAAAjG,KAAAipB,MAAAjpB,KAAAsO,GAAA7J,SAAA,EAAAzE,KAAAopB,KAAA,OAAAN,CACA,CAMA,OAAA7kB,GACAjE,KAAAipB,QAEAjpB,KAAAmpB,OAAAnpB,KAAA+oB,SACA/oB,KAAAipB,MAAAjpB,KAAAopB,KAAAppB,KAAAsO,GAAAtO,KAAAqpB,KAAA,MAGArpB,KAAAopB,KAAA,QACAppB,KAAAopB,KAAA,QACAppB,KAAAopB,KAAA,SAEA,CASA,IAAA/lB,CAAA2lB,EAAAle,GAGA,GAFA9K,KAAAgpB,SAAAA,QAAAA,EAAAhpB,KAAAgpB,SACAhpB,KAAAmpB,OAAAre,QAAAA,EAAA/O,KAAAE,IAAA+D,KAAAmpB,OAAAnpB,KAAAgpB,UACAhpB,KAAAmpB,OAAAnpB,KAAAgpB,UAAAhpB,KAAAgpB,SAAA,WACA,MAAA5mB,MAAA,yBAEA,IAAAknB,EAAAtpB,KAAAopB,KACA,MAAA5H,EAAAxhB,KAAAmpB,OAAA,KACAnpB,KAAAipB,MAOAjpB,KAAAqpB,KAAA/rB,OAAAuH,WAAA2c,IACAxhB,KAAAqpB,KAAAE,KAAAxtB,KAAAuI,MAAAkd,EAAAxhB,KAAAqpB,KAAA/rB,OAAAuH,YAAA,QACAykB,EAAA,IAAAjsB,YAAA2C,KAAAqpB,KAAA/rB,OAAA,GACA0C,KAAAsO,GAAA,IAAAlR,WAAA4C,KAAAqpB,KAAA/rB,OAAA,QATA0C,KAAAqpB,KAAA,IAAAloB,YAAAqoB,OAAA,CAAiDjhB,QAAAxM,KAAAuI,KAAAkd,EAAA,SACjDxhB,KAAAipB,MAAAR,EAAA,CAAsCxnB,IAAA,CAAO0B,OAAA3C,KAAAqpB,QAC7CC,EAAA,IAAAjsB,YAAA2C,KAAAqpB,KAAA/rB,OAAA,GACAgsB,EAAApmB,IAAA2lB,EAAA,KACA7oB,KAAAsO,GAAA,IAAAlR,WAAA4C,KAAAqpB,KAAA/rB,OAAA,OAOAgsB,EAAA,QACAA,EAAA,QACAA,EAAA,QACAtpB,KAAAopB,KAAAE,EACAtpB,KAAAkpB,QAAA,CACA,CAOA,QAAAhlB,CAAAulB,GACA,MAAAC,EAAA1pB,KAAAopB,KAAA,MAAAK,EACA,GAAAzpB,KAAAmpB,OAAAO,EAAA,CACA,GAAAA,EAAA1pB,KAAAgpB,SACA,SAEA,IAAAW,EAAA3pB,KAAAmpB,OACA,MAAAQ,GAAA,GAAAD,IAEA,GADAC,EAAA5tB,KAAAE,IAAA0tB,EAAA3pB,KAAAgpB,UACAW,EAAAD,EACA,SAEA,GAAAC,EAAA,KAAA3pB,KAAAqpB,KAAA/rB,OAAAuH,WAAA,CACA,MAAA+kB,EAAA7tB,KAAAuI,MAAAqlB,EAAA,KAAA3pB,KAAAqpB,KAAA/rB,OAAAuH,YAAA,OACA7E,KAAAqpB,KAAAE,KAAAK,GACA5pB,KAAAopB,KAAA,IAAA/rB,YAAA2C,KAAAqpB,KAAA/rB,OAAA,GACA0C,KAAAsO,GAAA,IAAAlR,WAAA4C,KAAAqpB,KAAA/rB,OAAA,KACA,CACA0C,KAAAmpB,OAAAQ,CACA,CACA,QACA,CAOA,GAAAxe,CAAA/F,GACA,IAAApF,KAAAipB,OAAAjpB,KAAAkpB,OACA,SAEA,GAAAlpB,KAAAkE,SAAAkB,EAAArH,QACA,SAEA,MAAAurB,EAAAtpB,KAAAopB,KAIA,OAHAppB,KAAAsO,GAAApL,IAAAkC,EAAAkkB,EAAA,OACAA,EAAA,OAAAlkB,EAAArH,OAEAurB,EAAA,MAAAA,EAAA,cACAtpB,KAAAipB,MAAApuB,QAAAsL,MACA,CACA,CAKA,GAAAb,GAEA,OADAtF,KAAAkpB,QAAA,EACAlpB,KAAAipB,MACAjpB,KAAAipB,MAAApuB,QAAAyK,OACA,CACA,CAIA,eAAAukB,GACA,OAAA7pB,KAAAipB,MACAjpB,KAAAopB,KAAA,MACA,CACA,CAIA,aAAAU,GACA,OAAA9pB,KAAAipB,MACAjpB,KAAAgpB,SAAAhpB,KAAAopB,KAAA,MACA,CACA,cC9UA5sB,OAAAC,eAAA5B,EAAA,cAA+CiB,OAAA,IAK/C,MACAiuB,GAAA,EADyB/qB,EAAQ,KACjC0pB,QAAA,CAAuGpqB,EAAA,EAAA+e,EAAA,EAAAlf,EAAA,i5BA8DvGtD,EAAA,QA7DA,MACA,WAAAkF,CAAAgpB,GACA/oB,KAAA+oB,SAAAA,EACA/oB,KAAAE,MAAA,EACAF,KAAAgE,OAAA,CACA,CACA,MAAApF,CAAAT,GACA6B,KAAAE,MAAA/B,EAAA,OAAAA,EAAA,OAAAA,EAAA,MAAAA,EAAA,GACA6B,KAAAgE,OAAA7F,EAAA,OAAAA,EAAA,OAAAA,EAAA,OAAAA,EAAA,IACA,MAAA4F,EAAA/D,KAAAE,MAAAF,KAAAgE,OACAgmB,EAAA,EAAAjmB,EACAkmB,EAAA9rB,EAAAJ,OAwBAyjB,EAAAzlB,KAAAC,IAAAguB,EAAAC,IAAAluB,KAAAE,IAAA+tB,EAAAC,IAAA,QACAjqB,KAAAipB,MAIAjpB,KAAAqpB,KAAA/rB,OAAAuH,WAAA2c,IACAxhB,KAAAqpB,KAAAE,KAAAxtB,KAAAuI,MAAAkd,EAAAxhB,KAAAqpB,KAAA/rB,OAAAuH,YAAA,QACA7E,KAAAsO,GAAA,OALAtO,KAAAqpB,KAAA,IAAAloB,YAAAqoB,OAAA,CAAiDjhB,QAAAxM,KAAAuI,KAAAkd,EAAA,SACjDxhB,KAAAipB,MAAAc,EAAA,CAAyC9oB,IAAA,CAAO0B,OAAA3C,KAAAqpB,SAMhDrpB,KAAAsO,KACAtO,KAAAsO,GAAA,IAAAlR,WAAA4C,KAAAqpB,KAAA/rB,SAGA,MAAA4sB,EAAAlqB,KAAAqpB,KAAA/rB,OAAAuH,WAAAolB,GAAA,IAGA,OAFAjqB,KAAAsO,GAAApL,IAAA/E,EAAA+rB,GACAlqB,KAAAipB,MAAApuB,QAAAsL,IAAA+jB,EAAAD,EAAAlmB,GACA/D,KAAAsO,GAAA7J,SAAA,UAAAulB,EACA,CACA,OAAA/lB,GACAjE,KAAAipB,OAEAjpB,KAAAqpB,KAAA/rB,OAAAuH,WAAA7E,KAAA+oB,WACA/oB,KAAAipB,MAAAjpB,KAAAsO,GAAAtO,KAAAqpB,KAAA,KAEA,aC9DA7sB,OAAAC,eAAA5B,EAAA,cAA+CiB,OAAA,IAC/CjB,EAAA6tB,OAYA,SAAAyB,GACA,GAAAA,EAAAhsB,EAAA,CACA,MAAAkf,EAAgB/e,EAAAA,EAAAH,EAAAA,GAAUgsB,EAC1B,IAAA1uB,EACA6tB,EACA,MAAAc,EAAAjpB,YACA,WAAAkc,EACA/e,EACAwJ,GAAA,IAAAsiB,EAAA5nB,SAAA8mB,IAAAA,EAAA,IAAAc,EAAA7nB,OAAA9G,IAAAA,EAAA4uB,EAAAlsB,MAAA2J,GACAA,GAAAwhB,EACAc,EAAAhpB,YAAAkoB,EAAAxhB,GACAsiB,EAAAhpB,YAAA3F,IAAAA,EAAA4uB,EAAAlsB,IAAA2J,GAAAzG,KAAA9F,IAAA+tB,EAAA/tB,EAAAT,SAAAS,EAAAgG,UAEA,IAAA8b,EACA/e,EACA,IAAAgrB,IAAAA,EAAA,IAAAc,EAAA7nB,OAAA9G,IAAAA,EAAA4uB,EAAAlsB,MACA,IAAAmrB,EACA3X,QAAAC,QAAA0X,GACAc,EAAAE,QAAA7uB,IAAAA,EAAA4uB,EAAAlsB,KAAAkD,KAAA9F,GAAA+tB,EAAA/tB,GAEA+C,EACA,IAAA7C,IAAAA,EAAA4uB,EAAAlsB,IACA,IAAAwT,QAAAC,QAAAnW,IAAAA,EAAA4uB,EAAAlsB,IACA,CACA,uBAAAosB,SACA,UAAAnoB,MAAA,qBACAmoB,SAAAjjB,IAAA6iB,EACA,EAtCA,IAAAE,EAAA/rB,IACA,GAAAlB,WAAAotB,WACA,OAAAptB,WAAAotB,WAAAlsB,GACA,uBAAAa,OACA,OAAAA,OAAAC,KAAAd,EAAA,UACA,MAAA7C,EAAA6D,KAAAhB,GACA/C,EAAA,IAAA6B,WAAA3B,EAAAsC,QACA,QAAAD,EAAA,EAAoBA,EAAAvC,EAAAwC,SAAcD,EAClCvC,EAAAuC,GAAArC,EAAA+D,WAAA1B,GACA,OAAAvC,KCfAkvB,EAAA,GAGA,SAAAzrB,EAAA0rB,GAEA,IAAAC,EAAAF,EAAAC,GACA,QAAA1iB,IAAA2iB,EACA,OAAAA,EAAA9vB,QAGA,IAAAC,EAAA2vB,EAAAC,GAAA,CAGA7vB,QAAA,IAOA,OAHA+vB,EAAAF,GAAAljB,KAAA1M,EAAAD,QAAAC,EAAAA,EAAAD,QAAAmE,GAGAlE,EAAAD,OACA,mGCfA,MAAAgwB,EAAA7rB,EAAA,KACA8rB,EAAA9rB,EAAA,KACAqK,EAAArK,EAAA,KACAsK,EAAAtK,EAAA,KACA+rB,EAAA/rB,EAAA,IACAgsB,EAAAhsB,EAAA,KACAisB,EAAAjsB,EAAA,KACAksB,EAAAlsB,EAAA,KACAmsB,EAAAnsB,EAAA,KA6CMuB,EAAsC,CAC1C6qB,mBAAmB,EACnBpe,WAAY,SACZqe,cAAc,EACdlN,gBAAgB,EAChBzB,kBAAmB,KACnBsB,eAAgB,SAChB7F,aAAc,IACdjF,iBAAiB,EACjBoY,YAAY,EACZzgB,aAAc,SACd0gB,cAAc,EACdvM,eAAgB,uBA0BlB,MAWE,WAAAjf,CAAYe,GANJd,KAAAyI,aAA8B,GAE9BzI,KAAAwrB,UAAwC,IAAIzZ,IACnC/R,KAAAyrB,cAAgB,IAAIZ,EAAAa,QACrB1rB,KAAAya,aAA6Bza,KAAKyrB,cAAchlB,MAG9DzG,KAAKkC,MAAQ1F,OAAO2F,OAAO,GAAI5B,EAAiBO,GAChDd,KAAK2rB,aAAenvB,OAAO2F,OAAO,GAAI5B,EAAiBO,EACzD,CAEO,OAAA6G,GACL,IAAK,MAAMW,KAAWtI,KAAKwrB,UAAU1W,SAAUxM,EAAQ4C,QACvD,IAAK,MAAM0gB,KAAO5rB,KAAKyI,aACrBmjB,EAAIjkB,UAEN3H,KAAKyI,aAAa1K,OAAS,EAC3BiC,KAAKwrB,UAAU1iB,QACf9I,KAAKyrB,cAAc9jB,SACrB,CAEQ,aAAAkkB,IAAiBC,GACvB,IAAK,MAAMF,KAAOE,EAChB9rB,KAAKyI,aAAa/J,KAAKktB,EAE3B,CAEO,QAAAG,CAASC,SASd,GARAhsB,KAAK6R,UAAYma,EAGjBhsB,KAAKkK,UAAY,IAAIb,EAAAgE,cAAc2e,GACnChsB,KAAKmK,SAAW,IAAIb,EAAA2iB,aAAaD,EAAUhsB,KAAKkK,UAAWlK,KAAKkC,OAChElC,KAAKmK,SAASsQ,aAAe,IAAMza,KAAKyrB,cAAclkB,OAGlDvH,KAAKkC,MAAMkpB,kBAAmB,CAChC,MAAMc,EAA0C,QAAjC/f,EAAG6f,EAASG,QAAQC,qBAAa,IAAAjgB,EAAAA,EAAI,GACpD+f,EAAUG,kBAAmB,EAC7BH,EAAUI,mBAAoB,EAC9BJ,EAAUK,iBAAkB,EAC5BP,EAASG,QAAQC,cAAgBF,CACnC,CAiCA,GA/BAlsB,KAAK6rB,cACH7rB,KAAKkK,UACLlK,KAAKmK,SAGL6hB,EAASQ,OAAOC,mBAAmB,CAAEC,OAAQ,IAAK7mB,MAAO,KAAO+W,GAAU5c,KAAK2sB,QAAQ/P,IACvFoP,EAASQ,OAAOC,mBAAmB,CAAEC,OAAQ,IAAK7mB,MAAO,KAAO+W,GAAU5c,KAAK4sB,QAAQhQ,IACvFoP,EAASQ,OAAOC,mBAAmB,CAAE5mB,MAAO,KAAO+W,GAAU5c,KAAK6sB,KAAKjQ,IACvEoP,EAASQ,OAAOC,mBAAmB,CAAEC,OAAQ,IAAK7mB,MAAO,KAAO+W,GAAU5c,KAAK8sB,yBAAyBlQ,IAGxGoP,EAASe,SAASpS,IAAQ,IAAAxO,EAAA,OAAc,QAAbA,EAAAnM,KAAKmK,gBAAQ,IAAAgC,OAAA,EAAAA,EAAEuO,OAAOC,KAQjDqR,EAASQ,OAAOC,mBAAmB,CAAEO,cAAe,IAAKnnB,MAAO,KAAO,IAAM7F,KAAKkL,SAClF8gB,EAASQ,OAAOS,mBAAmB,CAAEpnB,MAAO,KAAO,IAAM7F,KAAKkL,SAC9D8gB,EAAS5f,MAAMwN,cAAcsT,eAAe,IAAMltB,KAAKkL,SAGvD8gB,EAAS1uB,OAAO6vB,eAAe,KAAK,IAAAhhB,EAAA,OAAc,QAAbA,EAAAnM,KAAKmK,gBAAQ,IAAAgC,OAAA,EAAAA,EAAE+M,kBAGpD8S,EAASoB,SAASxgB,IAAU,IAAAT,EAAA,OAAc,QAAbA,EAAAnM,KAAKmK,gBAAQ,IAAAgC,OAAA,EAAAA,EAAEmP,eAAe1O,MAIzD5M,KAAKkC,MAAMmpB,aAAc,CAC3B,MAAMgC,EAAe,IAAInC,EAAAoC,kBAAkBttB,KAAKmK,SAAWnK,KAAKkC,MAAOlC,KAAKkK,UAAY8hB,GAClFuB,EAAe,IAAItC,EAAAuC,aAAaxtB,KAAKkC,MAAOmrB,EAAcrB,GAChEhsB,KAAKwrB,UAAUtoB,IAAI,QAASqqB,GAC5BvtB,KAAK6rB,cACHG,EAAS5f,MAAMwN,cAAc6T,QAAQC,mBAAmB,CAAE7nB,MAAO,KAAO0nB,GAE5E,CAGA,GAAIvtB,KAAKkC,MAAMopB,WAAY,CACzB,MAAMqC,EAAa,IAAIxC,EAAAyC,gBAAgB5tB,KAAKmK,UACtC0jB,EAAa,IAAI/C,EAAAgD,WAAW9tB,KAAKkC,MAAOlC,KAAKkK,UAAYyjB,EAAY3B,GAC3EhsB,KAAKwrB,UAAUtoB,IAAI,MAAO2qB,GAC1B7tB,KAAK6rB,cACHG,EAAS5f,MAAMwN,cAAc6T,QAAQM,mBAAmB,KAAMF,GAElE,CAGA,GAAI7tB,KAAKkC,MAAMqpB,aAAc,CAC3B,MAAMyC,EAAe,IAAIhD,EAAAvD,kBAAkBznB,KAAKmK,UAC1C8jB,EAAe,IAAIlD,EAAAmD,qBAAqBluB,KAAKkC,MAAOlC,KAAKkK,UAAY8jB,EAAchC,GACzFhsB,KAAKwrB,UAAUtoB,IAAI,QAAS+qB,GAC5BjuB,KAAK6rB,cACHmC,EACAC,EACAjC,EAAS5f,MAAMwN,cAAc6T,QAAQU,mBAAmB,CAAEtoB,MAAO,KAAOooB,GAE5E,CACF,CAGO,KAAA/iB,SAELlL,KAAKkC,MAAMic,eAAiBne,KAAK2rB,aAAaxN,eAC9Cne,KAAKkC,MAAMwa,kBAAoB1c,KAAK2rB,aAAajP,kBAEpC,QAAbvQ,EAAAnM,KAAKmK,gBAAQ,IAAAgC,GAAAA,EAAEjB,QAEf,IAAK,MAAM5C,KAAWtI,KAAKwrB,UAAU1W,SACnCxM,EAAQ4C,QAEV,OAAO,CACT,CAEA,gBAAWiN,SACT,OAAoB,QAAbhM,EAAAnM,KAAKmK,gBAAQ,IAAAgC,OAAA,EAAAA,EAAEmM,cAAe,CACvC,CAEA,gBAAWH,CAAajH,SACT,QAAb/E,EAAAnM,KAAKmK,gBAAQ,IAAAgC,GAAAA,EAAE+L,SAAShH,GACxBlR,KAAKkC,MAAMiW,aAAejH,CAC5B,CAEA,gBAAWkd,GACT,OAAIpuB,KAAKmK,SACAnK,KAAKmK,SAASwO,YAEf,CACV,CAEA,mBAAWzF,GACT,OAAOlT,KAAKkC,MAAMgR,eACpB,CAEA,mBAAWA,CAAgBpX,SACzBkE,KAAKkC,MAAMgR,gBAAkBpX,EACf,QAAdqQ,EAAAnM,KAAKkK,iBAAS,IAAAiC,GAAAA,EAAE+G,gBAAgBpX,EAClC,CAEO,oBAAAggB,CAAqBrF,EAAWnD,SACrC,OAAoB,QAAbnH,EAAAnM,KAAKmK,gBAAQ,IAAAgC,OAAA,EAAAA,EAAE2P,qBAAqBrF,EAAGnD,EAChD,CAEO,uBAAAyI,CAAwBtF,EAAWnD,SACxC,OAAoB,QAAbnH,EAAAnM,KAAKmK,gBAAQ,IAAAgC,OAAA,EAAAA,EAAE4P,wBAAwBtF,EAAGnD,EACnD,CAEQ,OAAA+a,CAAQ/vB,SACA,QAAd6N,EAAAnM,KAAK6R,iBAAS,IAAA1F,GAAAA,EAAEC,MAAMK,MAAMnO,GAAG,EACjC,CAEQ,OAAAquB,CAAQ/P,GACd,IAAK,IAAI9e,EAAI,EAAGA,EAAI8e,EAAO7e,SAAUD,EAE5B,KADC8e,EAAO9e,KAEXkC,KAAKkC,MAAMic,gBAAiB,GAIlC,OAAO,CACT,CAEQ,OAAAyO,CAAQhQ,GACd,IAAK,IAAI9e,EAAI,EAAGA,EAAI8e,EAAO7e,SAAUD,EAE5B,KADC8e,EAAO9e,KAEXkC,KAAKkC,MAAMic,gBAAiB,GAIlC,OAAO,CACT,CAGQ,IAAA0O,CAAKjQ,GACX,QAAIA,EAAO,MAQP5c,KAAKkC,MAAMmpB,eACbrrB,KAAKquB,QAAQ,kBACN,EAGX,CAYQ,wBAAAvB,CAAyBlQ,mBAC/B,GAAIA,EAAO7e,OAAS,EAClB,OAAO,EAET,GAAa,IAAT6e,EAAO,GACT,OAAQA,EAAO,IACb,OAEE,OADA5c,KAAKquB,QAAQ,MAASzR,EAAO,QAA0B5c,KAAKkC,MAAMwa,uBAC3D,EACT,OACE1c,KAAKkC,MAAMwa,kBAAoB1c,KAAK2rB,aAAajP,kBACjD1c,KAAKquB,QAAQ,MAASzR,EAAO,QAA0B5c,KAAKkC,MAAMwa,sBAElE,IAAK,MAAMpU,KAAWtI,KAAKwrB,UAAU1W,SACnCxM,EAAQ4C,QAEV,OAAO,EACT,OAOE,OANI0R,EAAO7e,OAAS,KAAO6e,EAAO,aAAcxV,QAAUwV,EAAO,IA5P5C,MA6PnB5c,KAAKkC,MAAMwa,kBAAoBE,EAAO,GACtC5c,KAAKquB,QAAQ,MAASzR,EAAO,QAA0B5c,KAAKkC,MAAMwa,uBAElE1c,KAAKquB,QAAQ,MAASzR,EAAO,UAExB,EACT,OAEE,OADA5c,KAAKquB,QAAQ,MAASzR,EAAO,eACtB,EACT,QAEE,OADA5c,KAAKquB,QAAQ,MAASzR,EAAO,UACtB,EAGb,GAAa,IAATA,EAAO,GACT,OAAQA,EAAO,IAEb,OACE,IAAI1c,EAAkC,QAA1BqN,EAAc,QAAdpB,EAAAnM,KAAKkK,iBAAS,IAAAiC,OAAA,EAAAA,EAAEP,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIC,OAAO5L,MAC/C8D,EAAmC,QAA1BsK,EAAc,QAAdpC,EAAAlM,KAAKkK,iBAAS,IAAAgC,OAAA,EAAAA,EAAEN,kBAAU,IAAA0C,OAAA,EAAAA,EAAEzC,IAAIC,OAAO9H,OACpD,IAAK9D,IAAU8D,EAAQ,CAGrB,MAAMmP,EAAW7J,EAAAqC,kBACjBzL,IAAuB,QAAdsT,EAAAxT,KAAK6R,iBAAS,IAAA2B,OAAA,EAAAA,EAAEzH,OAAQ,IAAMoH,EAASjT,MAChD8D,IAAwB,QAAdqc,EAAArgB,KAAK6R,iBAAS,IAAAwO,OAAA,EAAAA,EAAErU,OAAQ,IAAMmH,EAASnP,MACnD,CACA,GAAI9D,EAAQ8D,EAAShE,KAAKkC,MAAM8K,WAC9BhN,KAAKquB,QAAQ,MAASzR,EAAO,QAA0B1c,EAAMsM,QAAQ,MAAMxI,EAAOwI,QAAQ,WACrF,CAEL,MAAMiK,EAAI1a,KAAKmR,MAAMnR,KAAKuyB,KAAKtuB,KAAKkC,MAAM8K,aAC1ChN,KAAKquB,QAAQ,MAASzR,EAAO,QAA0BnG,KAAKA,KAC9D,CACA,OAAO,EACT,OAEE,MAAMA,EAAI1a,KAAKmR,MAAMnR,KAAKuyB,KAAKtuB,KAAKkC,MAAM8K,aAE1C,OADAhN,KAAKquB,QAAQ,MAASzR,EAAO,QAA0BnG,KAAKA,OACrD,EACT,QAEE,OADAzW,KAAKquB,QAAQ,MAASzR,EAAO,UACtB,EAKb,OADA5c,KAAKquB,QAAQ,MAASzR,EAAO,UACtB,CACT","sources":["webpack://ImageAddon/webpack/universalModuleDefinition","webpack://ImageAddon/../node_modules/sixel/lib/Colors.js","webpack://ImageAddon/../node_modules/sixel/lib/Decoder.js","webpack://ImageAddon/../node_modules/sixel/lib/wasm.js","webpack://ImageAddon/../src/common/Event.ts","webpack://ImageAddon/../src/common/Lifecycle.ts","webpack://ImageAddon/./src/IIPHandler.ts","webpack://ImageAddon/./src/IIPHeaderParser.ts","webpack://ImageAddon/./src/IIPImageStorage.ts","webpack://ImageAddon/./src/IIPMetrics.ts","webpack://ImageAddon/./src/ImageRenderer.ts","webpack://ImageAddon/./src/ImageStorage.ts","webpack://ImageAddon/./src/SixelHandler.ts","webpack://ImageAddon/./src/SixelImageStorage.ts","webpack://ImageAddon/./src/kitty/KittyGraphicsHandler.ts","webpack://ImageAddon/./src/kitty/KittyGraphicsTypes.ts","webpack://ImageAddon/./src/kitty/KittyImageStorage.ts","webpack://ImageAddon/../node_modules/xterm-wasm-parts/lib/base64/Base64Decoder.wasm.js","webpack://ImageAddon/../node_modules/xterm-wasm-parts/lib/qoi/QoiDecoder.wasm.js","webpack://ImageAddon/javascript/node_modules/inwasm-runtime/lib/index.cjs","webpack://ImageAddon/webpack/bootstrap","webpack://ImageAddon/./src/ImageAddon.ts"],"sourcesContent":["(function webpackUniversalModuleDefinition(root, factory) {\n\tif(typeof exports === 'object' && typeof module === 'object')\n\t\tmodule.exports = factory();\n\telse if(typeof define === 'function' && define.amd)\n\t\tdefine([], factory);\n\telse if(typeof exports === 'object')\n\t\texports[\"ImageAddon\"] = factory();\n\telse\n\t\troot[\"ImageAddon\"] = factory();\n})(globalThis, () => {\nreturn ","\"use strict\";\n/**\n * Copyright (c) 2019 Joerg Breitbart.\n * @license MIT\n */\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.DEFAULT_FOREGROUND = exports.DEFAULT_BACKGROUND = exports.PALETTE_ANSI_256 = exports.PALETTE_VT340_GREY = exports.PALETTE_VT340_COLOR = exports.normalizeHLS = exports.normalizeRGB = exports.nearestColorIndex = exports.fromRGBA8888 = exports.toRGBA8888 = exports.alpha = exports.blue = exports.green = exports.red = exports.BIG_ENDIAN = void 0;\n// FIXME: cleanup this mess, move things either to decoder/encoder, keep only shared things\n// system endianess\nexports.BIG_ENDIAN = new Uint8Array(new Uint32Array([0xFF000000]).buffer)[0] === 0xFF;\nif (exports.BIG_ENDIAN) {\n    console.warn('BE platform detected. This version of node-sixel works only on LE properly.');\n}\n// channel values\nfunction red(n) {\n    return n & 0xFF;\n}\nexports.red = red;\nfunction green(n) {\n    return (n >>> 8) & 0xFF;\n}\nexports.green = green;\nfunction blue(n) {\n    return (n >>> 16) & 0xFF;\n}\nexports.blue = blue;\nfunction alpha(n) {\n    return (n >>> 24) & 0xFF;\n}\nexports.alpha = alpha;\n/**\n * Convert RGB channels to native color RGBA8888.\n */\nfunction toRGBA8888(r, g, b, a = 255) {\n    return ((a & 0xFF) << 24 | (b & 0xFF) << 16 | (g & 0xFF) << 8 | (r & 0xFF)) >>> 0; // ABGR32\n}\nexports.toRGBA8888 = toRGBA8888;\n/**\n * Convert native color to [r, g, b, a].\n */\nfunction fromRGBA8888(color) {\n    return [color & 0xFF, (color >> 8) & 0xFF, (color >> 16) & 0xFF, color >>> 24];\n}\nexports.fromRGBA8888 = fromRGBA8888;\n/**\n * Get index of nearest color in `palette` for `color`.\n * Uses euclidean distance without any luminescence correction.\n */\nfunction nearestColorIndex(color, palette) {\n    const r = red(color);\n    const g = green(color);\n    const b = blue(color);\n    let min = Number.MAX_SAFE_INTEGER;\n    let idx = -1;\n    // use euclidean distance (manhattan gives very poor results)\n    for (let i = 0; i < palette.length; ++i) {\n        const dr = r - palette[i][0];\n        const dg = g - palette[i][1];\n        const db = b - palette[i][2];\n        const d = dr * dr + dg * dg + db * db;\n        if (!d)\n            return i;\n        if (d < min) {\n            min = d;\n            idx = i;\n        }\n    }\n    return idx;\n}\nexports.nearestColorIndex = nearestColorIndex;\n// color conversions\n// HLS taken from: http://www.niwa.nu/2013/05/math-behind-colorspace-conversions-rgb-hsl\nfunction clamp(low, high, value) {\n    return Math.max(low, Math.min(value, high));\n}\nfunction h2c(t1, t2, c) {\n    if (c < 0)\n        c += 1;\n    if (c > 1)\n        c -= 1;\n    return c * 6 < 1\n        ? t2 + (t1 - t2) * 6 * c\n        : c * 2 < 1\n            ? t1\n            : c * 3 < 2\n                ? t2 + (t1 - t2) * (4 - c * 6)\n                : t2;\n}\nfunction HLStoRGB(h, l, s) {\n    if (!s) {\n        const v = Math.round(l * 255);\n        return toRGBA8888(v, v, v);\n    }\n    const t1 = l < 0.5 ? l * (1 + s) : l + s - l * s;\n    const t2 = 2 * l - t1;\n    return toRGBA8888(clamp(0, 255, Math.round(h2c(t1, t2, h + 1 / 3) * 255)), clamp(0, 255, Math.round(h2c(t1, t2, h) * 255)), clamp(0, 255, Math.round(h2c(t1, t2, h - 1 / 3) * 255)));\n}\n/**\n * Normalize SIXEL RGB values (percent based, 0-100) to RGBA8888.\n */\nfunction normalizeRGB(r, g, b) {\n    return (0xFF000000 | Math.round(b / 100 * 255) << 16 | Math.round(g / 100 * 255) << 8 | Math.round(r / 100 * 255)) >>> 0; // ABGR32\n}\nexports.normalizeRGB = normalizeRGB;\n/**\n * Normalize SIXEL HLS values to RGBA8888. Applies hue correction of +240°.\n */\nfunction normalizeHLS(h, l, s) {\n    // Note: hue value is turned by 240° in VT340, all values given as fractions\n    return HLStoRGB((h + 240 % 360) / 360, l / 100, s / 100);\n}\nexports.normalizeHLS = normalizeHLS;\n/**\n * default palettes\n */\n// FIXME: move palettes to Decoder.ts\n/**\n * 16 predefined color registers of VT340 (values in %):\n * ```\n *                R   G   B\n * 0  Black       0   0   0\n * 1  Blue        20  20  80\n * 2  Red         80  13  13\n * 3  Green       20  80  20\n * 4  Magenta     80  20  80\n * 5  Cyan        20  80  80\n * 6  Yellow      80  80  20\n * 7  Gray 50%    53  53  53\n * 8  Gray 25%    26  26  26\n * 9  Blue*       33  33  60\n * 10 Red*        60  26  26\n * 11 Green*      33  60  33\n * 12 Magenta*    60  33  60\n * 13 Cyan*       33  60  60\n * 14 Yellow*     60  60  33\n * 15 Gray 75%    80  80  80\n * ```\n * (*) less saturated\n *\n * @see https://vt100.net/docs/vt3xx-gp/chapter2.html#S2.4\n*/\nexports.PALETTE_VT340_COLOR = new Uint32Array([\n    normalizeRGB(0, 0, 0),\n    normalizeRGB(20, 20, 80),\n    normalizeRGB(80, 13, 13),\n    normalizeRGB(20, 80, 20),\n    normalizeRGB(80, 20, 80),\n    normalizeRGB(20, 80, 80),\n    normalizeRGB(80, 80, 20),\n    normalizeRGB(53, 53, 53),\n    normalizeRGB(26, 26, 26),\n    normalizeRGB(33, 33, 60),\n    normalizeRGB(60, 26, 26),\n    normalizeRGB(33, 60, 33),\n    normalizeRGB(60, 33, 60),\n    normalizeRGB(33, 60, 60),\n    normalizeRGB(60, 60, 33),\n    normalizeRGB(80, 80, 80)\n]);\n/**\n * 16 predefined monochrome registers of VT340 (values in %):\n * ```\n *              R   G   B\n * 0  Black     0   0   0\n * 1  Gray-2    13  13  13\n * 2  Gray-4    26  26  26\n * 3  Gray-6    40  40  40\n * 4  Gray-1    6   6   6\n * 5  Gray-3    20  20  20\n * 6  Gray-5    33  33  33\n * 7  White 7   46  46  46\n * 8  Black 0   0   0   0\n * 9  Gray-2    13  13  13\n * 10 Gray-4    26  26  26\n * 11 Gray-6    40  40  40\n * 12 Gray-1    6   6   6\n * 13 Gray-3    20  20  20\n * 14 Gray-5    33  33  33\n * 15 White 7   46  46  46\n * ```\n *\n * @see https://vt100.net/docs/vt3xx-gp/chapter2.html#S2.4\n */\nexports.PALETTE_VT340_GREY = new Uint32Array([\n    normalizeRGB(0, 0, 0),\n    normalizeRGB(13, 13, 13),\n    normalizeRGB(26, 26, 26),\n    normalizeRGB(40, 40, 40),\n    normalizeRGB(6, 6, 6),\n    normalizeRGB(20, 20, 20),\n    normalizeRGB(33, 33, 33),\n    normalizeRGB(46, 46, 46),\n    normalizeRGB(0, 0, 0),\n    normalizeRGB(13, 13, 13),\n    normalizeRGB(26, 26, 26),\n    normalizeRGB(40, 40, 40),\n    normalizeRGB(6, 6, 6),\n    normalizeRGB(20, 20, 20),\n    normalizeRGB(33, 33, 33),\n    normalizeRGB(46, 46, 46)\n]);\n/**\n * 256 predefined ANSI colors.\n *\n * @see https://en.wikipedia.org/wiki/ANSI_escape_code#8-bit\n */\nexports.PALETTE_ANSI_256 = (() => {\n    // 16 lower colors (taken from xterm)\n    const p = [\n        toRGBA8888(0, 0, 0),\n        toRGBA8888(205, 0, 0),\n        toRGBA8888(0, 205, 0),\n        toRGBA8888(205, 205, 0),\n        toRGBA8888(0, 0, 238),\n        toRGBA8888(205, 0, 205),\n        toRGBA8888(0, 250, 205),\n        toRGBA8888(229, 229, 229),\n        toRGBA8888(127, 127, 127),\n        toRGBA8888(255, 0, 0),\n        toRGBA8888(0, 255, 0),\n        toRGBA8888(255, 255, 0),\n        toRGBA8888(92, 92, 255),\n        toRGBA8888(255, 0, 255),\n        toRGBA8888(0, 255, 255),\n        toRGBA8888(255, 255, 255),\n    ];\n    // colors up to 232\n    const d = [0, 95, 135, 175, 215, 255];\n    for (let r = 0; r < 6; ++r) {\n        for (let g = 0; g < 6; ++g) {\n            for (let b = 0; b < 6; ++b) {\n                p.push(toRGBA8888(d[r], d[g], d[b]));\n            }\n        }\n    }\n    // grey scale to up 255\n    for (let v = 8; v <= 238; v += 10) {\n        p.push(toRGBA8888(v, v, v));\n    }\n    return new Uint32Array(p);\n})();\n/**\n * Background: Black by default.\n * Foreground: White by default.\n *\n * Background color is used whenever a fill color is needed and not explicitly set.\n * Foreground color is used as default initial sixel color.\n */\nexports.DEFAULT_BACKGROUND = toRGBA8888(0, 0, 0, 255);\nexports.DEFAULT_FOREGROUND = toRGBA8888(255, 255, 255, 255);\n//# sourceMappingURL=Colors.js.map","\"use strict\";\n/**\n * Copyright (c) 2021 Joerg Breitbart.\n * @license MIT\n */\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.decodeAsync = exports.decode = exports.Decoder = exports.DecoderAsync = void 0;\nconst Colors_1 = require(\"./Colors\");\nconst wasm_1 = require(\"./wasm\");\n/* istanbul ignore next */\nfunction decodeBase64(s) {\n    if (typeof Buffer !== 'undefined') {\n        return Buffer.from(s, 'base64');\n    }\n    const bytestring = atob(s);\n    const result = new Uint8Array(bytestring.length);\n    for (let i = 0; i < result.length; ++i) {\n        result[i] = bytestring.charCodeAt(i);\n    }\n    return result;\n}\nconst WASM_BYTES = decodeBase64(wasm_1.LIMITS.BYTES);\nlet WASM_MODULE;\n// empty canvas\nconst NULL_CANVAS = new Uint32Array();\n// proxy for lazy binding of decoder methods to wasm env callbacks\nclass CallbackProxy {\n    constructor() {\n        this.bandHandler = (width) => 1;\n        this.modeHandler = (mode) => 1;\n    }\n    handle_band(width) {\n        return this.bandHandler(width);\n    }\n    mode_parsed(mode) {\n        return this.modeHandler(mode);\n    }\n}\n// default decoder options\nconst DEFAULT_OPTIONS = {\n    memoryLimit: 2048 * 65536,\n    sixelColor: Colors_1.DEFAULT_FOREGROUND,\n    fillColor: Colors_1.DEFAULT_BACKGROUND,\n    palette: Colors_1.PALETTE_VT340_COLOR,\n    paletteLimit: wasm_1.LIMITS.PALETTE_SIZE,\n    truncate: true\n};\n/**\n * Create a decoder instance asynchronously.\n * To be used in the browser main thread.\n */\nfunction DecoderAsync(opts) {\n    const cbProxy = new CallbackProxy();\n    const importObj = {\n        env: {\n            handle_band: cbProxy.handle_band.bind(cbProxy),\n            mode_parsed: cbProxy.mode_parsed.bind(cbProxy)\n        }\n    };\n    return WebAssembly.instantiate(WASM_MODULE || WASM_BYTES, importObj)\n        .then((inst) => {\n        WASM_MODULE = WASM_MODULE || inst.module;\n        return new Decoder(opts, inst.instance || inst, cbProxy);\n    });\n}\nexports.DecoderAsync = DecoderAsync;\n/**\n * Decoder - web assembly based sixel stream decoder.\n *\n * Usage pattern:\n *  - call `init` to initialize decoder for new image\n *  - feed data chunks to `decode` or `decodeString`\n *  - grab pixels from `data32`\n *  - optional: call `release` to free memory (e.g. after big images)\n *  - start over with next image by calling `init`\n *\n * Properties:\n *  - max width of 2^14 - 4 pixels (compile time setting in wasm)\n *  - no explicit height limit (only limited by memory)\n *  - max 4096 colors palette (compile time setting in wasm)\n *\n * Explanation operation modes:\n * - M1   Mode chosen for level 1 images (no raster attributes),\n *        or for level 2 images with `truncate=false`.\n * - M2   Mode chosen for level 2 images with `truncate=true` (default).\n *        While this mode is not fully spec conform (decoder not expected to truncate),\n *        it is what spec conform encoders should create (should not excess raster).\n *        This mode has several advantages:\n *        - ~15% faster decoding speed\n *        - image dimensions can be evaluated early without processing the whole data\n *        - faster pixel access in `data32` (precalulated)\n *        - image height is not reported as multiple of 6 pixels\n * - M0   Undecided mode state after `init`.\n * The level of an image is determined during early decoding based on the fact,\n * whether the data contains valid raster attributes before any sixel data.\n * Until then the mode of an image is marked as M0, meaning the real operation mode\n * could not be decided yet.\n */\nclass Decoder {\n    /**\n     * Synchonous ctor. Can be called from nodejs or a webworker context.\n     * For instantiation in the browser main thread use `WasmDecoderAsync` instead.\n     */\n    constructor(opts, _instance, _cbProxy) {\n        this._PIXEL_OFFSET = wasm_1.LIMITS.MAX_WIDTH + 4;\n        this._canvas = NULL_CANVAS;\n        this._bandWidths = [];\n        this._maxWidth = 0;\n        this._minWidth = wasm_1.LIMITS.MAX_WIDTH;\n        this._lastOffset = 0;\n        this._currentHeight = 0;\n        this._opts = Object.assign({}, DEFAULT_OPTIONS, opts);\n        if (this._opts.paletteLimit > wasm_1.LIMITS.PALETTE_SIZE) {\n            throw new Error(`DecoderOptions.paletteLimit must not exceed ${wasm_1.LIMITS.PALETTE_SIZE}`);\n        }\n        if (!_instance) {\n            const module = WASM_MODULE || (WASM_MODULE = new WebAssembly.Module(WASM_BYTES));\n            _instance = new WebAssembly.Instance(module, {\n                env: {\n                    handle_band: this._handle_band.bind(this),\n                    mode_parsed: this._initCanvas.bind(this)\n                }\n            });\n        }\n        else {\n            _cbProxy.bandHandler = this._handle_band.bind(this);\n            _cbProxy.modeHandler = this._initCanvas.bind(this);\n        }\n        this._instance = _instance;\n        this._wasm = this._instance.exports;\n        this._chunk = new Uint8Array(this._wasm.memory.buffer, this._wasm.get_chunk_address(), wasm_1.LIMITS.CHUNK_SIZE);\n        this._states = new Uint32Array(this._wasm.memory.buffer, this._wasm.get_state_address(), 12);\n        this._palette = new Uint32Array(this._wasm.memory.buffer, this._wasm.get_palette_address(), wasm_1.LIMITS.PALETTE_SIZE);\n        this._palette.set(this._opts.palette);\n        this._pSrc = new Uint32Array(this._wasm.memory.buffer, this._wasm.get_p0_address());\n        this._wasm.init(Colors_1.DEFAULT_FOREGROUND, 0, this._opts.paletteLimit, 0);\n    }\n    // some readonly parser states for internal usage\n    get _fillColor() { return this._states[0]; }\n    get _truncate() { return this._states[8]; }\n    get _rasterWidth() { return this._states[6]; }\n    get _rasterHeight() { return this._states[7]; }\n    get _width() { return this._states[2] ? this._states[2] - 4 : 0; }\n    get _height() { return this._states[3]; }\n    get _level() { return this._states[9]; }\n    get _mode() { return this._states[10]; }\n    get _paletteLimit() { return this._states[11]; }\n    _initCanvas(mode) {\n        if (mode === 2 /* M2 */) {\n            const pixels = this.width * this.height;\n            if (pixels > this._canvas.length) {\n                if (this._opts.memoryLimit && pixels * 4 > this._opts.memoryLimit) {\n                    this.release();\n                    throw new Error('image exceeds memory limit');\n                }\n                this._canvas = new Uint32Array(pixels);\n            }\n            this._maxWidth = this._width;\n        }\n        else if (mode === 1 /* M1 */) {\n            if (this._level === 2) {\n                // got raster attributes, use them as initial size hint\n                const pixels = Math.min(this._rasterWidth, wasm_1.LIMITS.MAX_WIDTH) * this._rasterHeight;\n                if (pixels > this._canvas.length) {\n                    if (this._opts.memoryLimit && pixels * 4 > this._opts.memoryLimit) {\n                        this.release();\n                        throw new Error('image exceeds memory limit');\n                    }\n                    this._canvas = new Uint32Array(pixels);\n                }\n            }\n            else {\n                // else fallback to generic resizing, starting with 256*256 pixels\n                if (this._canvas.length < 65536) {\n                    this._canvas = new Uint32Array(65536);\n                }\n            }\n        }\n        return 0; // 0 - continue, 1 - abort right away\n    }\n    _realloc(offset, additionalPixels) {\n        const pixels = offset + additionalPixels;\n        if (pixels > this._canvas.length) {\n            if (this._opts.memoryLimit && pixels * 4 > this._opts.memoryLimit) {\n                this.release();\n                throw new Error('image exceeds memory limit');\n            }\n            // extend in 65536 pixel blocks\n            const newCanvas = new Uint32Array(Math.ceil(pixels / 65536) * 65536);\n            newCanvas.set(this._canvas);\n            this._canvas = newCanvas;\n        }\n    }\n    _handle_band(width) {\n        const adv = this._PIXEL_OFFSET;\n        let offset = this._lastOffset;\n        if (this._mode === 2 /* M2 */) {\n            let remaining = this.height - this._currentHeight;\n            let c = 0;\n            while (c < 6 && remaining > 0) {\n                this._canvas.set(this._pSrc.subarray(adv * c, adv * c + width), offset + width * c);\n                c++;\n                remaining--;\n            }\n            this._lastOffset += width * c;\n            this._currentHeight += c;\n        }\n        else if (this._mode === 1 /* M1 */) {\n            this._realloc(offset, width * 6);\n            this._maxWidth = Math.max(this._maxWidth, width);\n            this._minWidth = Math.min(this._minWidth, width);\n            for (let i = 0; i < 6; ++i) {\n                this._canvas.set(this._pSrc.subarray(adv * i, adv * i + width), offset + width * i);\n            }\n            this._bandWidths.push(width);\n            this._lastOffset += width * 6;\n            this._currentHeight += 6;\n        }\n        return 0; // 0 - continue, 1 - abort right away\n    }\n    /**\n     * Width of the image data.\n     * Returns the rasterWidth in level2/truncating mode,\n     * otherwise the max width, that has been seen so far.\n     */\n    get width() {\n        return this._mode !== 1 /* M1 */\n            ? this._width\n            : Math.max(this._maxWidth, this._wasm.current_width());\n    }\n    /**\n     * Height of the image data.\n     * Returns the rasterHeight in level2/truncating mode,\n     * otherwise height touched by sixels.\n     */\n    get height() {\n        return this._mode !== 1 /* M1 */\n            ? this._height\n            : this._wasm.current_width()\n                ? this._bandWidths.length * 6 + this._wasm.current_height()\n                : this._bandWidths.length * 6;\n    }\n    /**\n     * Get active palette colors as RGBA8888[] (borrowed).\n     */\n    get palette() {\n        return this._palette.subarray(0, this._paletteLimit);\n    }\n    /**\n     * Get the memory used by the decoder.\n     *\n     * This is a rough estimate accounting the wasm instance memory\n     * and pixel buffers held on JS side (real value will be slightly\n     * higher due to JS book-keeping).\n     * Note that the decoder does not free ressources on its own,\n     * call `release` to free excess memory.\n     */\n    get memoryUsage() {\n        return this._canvas.byteLength + this._wasm.memory.buffer.byteLength + 8 * this._bandWidths.length;\n    }\n    /**\n     * Get various properties of the decoder and the current image.\n     */\n    get properties() {\n        return {\n            width: this.width,\n            height: this.height,\n            mode: this._mode,\n            level: this._level,\n            truncate: !!this._truncate,\n            paletteLimit: this._paletteLimit,\n            fillColor: this._fillColor,\n            memUsage: this.memoryUsage,\n            rasterAttributes: {\n                numerator: this._states[4],\n                denominator: this._states[5],\n                width: this._rasterWidth,\n                height: this._rasterHeight,\n            }\n        };\n    }\n    /**\n     * Initialize decoder for next image. Must be called before\n     * any calls to `decode` or `decodeString`.\n     */\n    // FIXME: reorder arguments, better palette handling\n    init(fillColor = this._opts.fillColor, palette = this._opts.palette, paletteLimit = this._opts.paletteLimit, truncate = this._opts.truncate) {\n        this._wasm.init(this._opts.sixelColor, fillColor, paletteLimit, truncate ? 1 : 0);\n        if (palette) {\n            this._palette.set(palette.subarray(0, wasm_1.LIMITS.PALETTE_SIZE));\n        }\n        this._bandWidths.length = 0;\n        this._maxWidth = 0;\n        this._minWidth = wasm_1.LIMITS.MAX_WIDTH;\n        this._lastOffset = 0;\n        this._currentHeight = 0;\n    }\n    /**\n     * Decode next chunk of data from start to end index (exclusive).\n     * @throws Will throw if the image exceeds the memory limit.\n     */\n    decode(data, start = 0, end = data.length) {\n        let p = start;\n        while (p < end) {\n            const length = Math.min(end - p, wasm_1.LIMITS.CHUNK_SIZE);\n            this._chunk.set(data.subarray(p, p += length));\n            this._wasm.decode(0, length);\n        }\n    }\n    /**\n     * Decode next chunk of string data from start to end index (exclusive).\n     * Note: Decoding from string data is rather slow, use `decode` with byte data instead.\n     * @throws Will throw if the image exceeds the memory limit.\n     */\n    decodeString(data, start = 0, end = data.length) {\n        let p = start;\n        while (p < end) {\n            const length = Math.min(end - p, wasm_1.LIMITS.CHUNK_SIZE);\n            for (let i = 0, j = p; i < length; ++i, ++j) {\n                this._chunk[i] = data.charCodeAt(j);\n            }\n            p += length;\n            this._wasm.decode(0, length);\n        }\n    }\n    /**\n     * Get current pixel data as 32-bit typed array (RGBA8888).\n     * Also peeks into pixel data of the current band, that got not pushed yet.\n     */\n    get data32() {\n        if (this._mode === 0 /* M0 */ || !this.width || !this.height) {\n            return NULL_CANVAS;\n        }\n        // get width of pending band to peek into left-over data\n        const currentWidth = this._wasm.current_width();\n        if (this._mode === 2 /* M2 */) {\n            let remaining = this.height - this._currentHeight;\n            if (remaining > 0) {\n                const adv = this._PIXEL_OFFSET;\n                let offset = this._lastOffset;\n                let c = 0;\n                while (c < 6 && remaining > 0) {\n                    this._canvas.set(this._pSrc.subarray(adv * c, adv * c + currentWidth), offset + currentWidth * c);\n                    c++;\n                    remaining--;\n                }\n                if (remaining) {\n                    this._canvas.fill(this._fillColor, offset + currentWidth * c);\n                }\n            }\n            return this._canvas.subarray(0, this.width * this.height);\n        }\n        if (this._mode === 1 /* M1 */) {\n            if (this._minWidth === this._maxWidth) {\n                let escape = false;\n                if (currentWidth) {\n                    if (currentWidth !== this._minWidth) {\n                        escape = true;\n                    }\n                    else {\n                        const adv = this._PIXEL_OFFSET;\n                        let offset = this._lastOffset;\n                        this._realloc(offset, currentWidth * 6);\n                        for (let i = 0; i < 6; ++i) {\n                            this._canvas.set(this._pSrc.subarray(adv * i, adv * i + currentWidth), offset + currentWidth * i);\n                        }\n                    }\n                }\n                if (!escape) {\n                    return this._canvas.subarray(0, this.width * this.height);\n                }\n            }\n            // worst case: re-align pixels if we have bands with different width\n            // This is somewhat allocation intensive, any way to do that in-place, and just once?\n            const final = new Uint32Array(this.width * this.height);\n            final.fill(this._fillColor);\n            let finalOffset = 0;\n            let start = 0;\n            for (let i = 0; i < this._bandWidths.length; ++i) {\n                const bw = this._bandWidths[i];\n                for (let p = 0; p < 6; ++p) {\n                    final.set(this._canvas.subarray(start, start += bw), finalOffset);\n                    finalOffset += this.width;\n                }\n            }\n            // also handle left-over pixels of the current band\n            if (currentWidth) {\n                const adv = this._PIXEL_OFFSET;\n                // other than finished bands, this runs only up to currentHeight\n                const currentHeight = this._wasm.current_height();\n                for (let i = 0; i < currentHeight; ++i) {\n                    final.set(this._pSrc.subarray(adv * i, adv * i + currentWidth), finalOffset + this.width * i);\n                }\n            }\n            return final;\n        }\n        // fallthrough for all not handled cases\n        return NULL_CANVAS;\n    }\n    /**\n     * Same as `data32`, but returning pixel data as Uint8ClampedArray suitable\n     * for direct usage with `ImageData`.\n     */\n    get data8() {\n        return new Uint8ClampedArray(this.data32.buffer, 0, this.width * this.height * 4);\n    }\n    /**\n     * Release image ressources on JS side held by the decoder.\n     *\n     * The decoder tries to re-use memory ressources of a previous image\n     * to lower allocation and GC pressure. Decoding a single big image\n     * will grow the memory usage of the decoder permanently.\n     * Call `release` to reset the internal buffers and free the memory.\n     * Note that this destroys the image data, call it when done processing\n     * a rather big image, otherwise it is not needed. Use `memoryUsage`\n     * to decide, whether the held memory is still within your limits.\n     * This does not affect the wasm module (operates on static memory).\n     */\n    release() {\n        this._canvas = NULL_CANVAS;\n        this._bandWidths.length = 0;\n        this._maxWidth = 0;\n        this._minWidth = wasm_1.LIMITS.MAX_WIDTH;\n        // also nullify parser states in wasm to avoid\n        // width/height reporting potential out-of-bound values\n        this._wasm.init(Colors_1.DEFAULT_FOREGROUND, 0, this._opts.paletteLimit, 0);\n    }\n}\nexports.Decoder = Decoder;\n/**\n * Convenient decoding functions for easier usage.\n *\n * These can be used for casual decoding of sixel images,\n * that dont come in as stream chunks.\n * Note that the functions instantiate a stream decoder for every call,\n * which comes with a performance penalty of ~25%.\n */\n/**\n * Decode function with synchronous wasm loading.\n * Can be used in a web worker or in nodejs. Does not work reliable in normal browser context.\n * @throws Will throw if the image exceeds the memory limit.\n */\nfunction decode(data, opts) {\n    const dec = new Decoder(opts);\n    dec.init();\n    typeof data === 'string' ? dec.decodeString(data) : dec.decode(data);\n    return {\n        width: dec.width,\n        height: dec.height,\n        data32: dec.data32,\n        data8: dec.data8\n    };\n}\nexports.decode = decode;\n/**\n * Decode function with asynchronous wasm loading.\n * Use this version in normal browser context.\n * @throws Will throw if the image exceeds the memory limit.\n */\nasync function decodeAsync(data, opts) {\n    const dec = await DecoderAsync(opts);\n    dec.init();\n    typeof data === 'string' ? dec.decodeString(data) : dec.decode(data);\n    return {\n        width: dec.width,\n        height: dec.height,\n        data32: dec.data32,\n        data8: dec.data8\n    };\n}\nexports.decodeAsync = decodeAsync;\n//# sourceMappingURL=Decoder.js.map","\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.LIMITS = void 0;\nexports.LIMITS = {\n    CHUNK_SIZE: 16384,\n    PALETTE_SIZE: 4096,\n    MAX_WIDTH: 16384,\n    BYTES: 'AGFzbQEAAAABJAdgAAF/YAJ/fwBgA39/fwF/YAF/AX9gAABgBH9/f38AYAF/AAIlAgNlbnYLaGFuZGxlX2JhbmQAAwNlbnYLbW9kZV9wYXJzZWQAAwMTEgQAAAAAAQQBAQUBAAACAgAGAwQFAXABBwcFBAEBBwcGCAF/AUGAihoLB9wBDgZtZW1vcnkCABFnZXRfc3RhdGVfYWRkcmVzcwADEWdldF9jaHVua19hZGRyZXNzAAQOZ2V0X3AwX2FkZHJlc3MABRNnZXRfcGFsZXR0ZV9hZGRyZXNzAAYEaW5pdAALBmRlY29kZQAMDWN1cnJlbnRfd2lkdGgADQ5jdXJyZW50X2hlaWdodAAOGV9faW5kaXJlY3RfZnVuY3Rpb25fdGFibGUBAAtfaW5pdGlhbGl6ZQACCXN0YWNrU2F2ZQARDHN0YWNrUmVzdG9yZQASCnN0YWNrQWxsb2MAEwkMAQBBAQsGCgcJDxACDAEBCq5UEgMAAQsFAEGgCAsGAEGQiQELBgBBsIkCCwUAQZAJC+okAQh/QeQIKAIAIQVB4AgoAgAhA0HoCCgCACEIIAFBkIkBaiIJQf8BOgAAIAAgAUgEQCAAQZCJAWohBgNAIAMhBCAGQQFqIQECQCAGLQAAQf8AcSIDQTBrQQlLBEAgASEGDAELQewIKAIAQQJ0QewIaiICKAIAIQADQCACIAMgAEEKbGpBMGsiADYCACABLQAAIQMgAUEBaiIGIQEgA0H/AHEiA0Ewa0EKSQ0ACwsCQAJAAkACQAJAAkACQAJ/AkACQCADQT9rIgBBP00EQCAERQ0BIARBIUYEQAJAQfAIKAIAIgFBASABGyIHIAhqIgFB1AgoAgAiA0gNACADQf//AEoNAANAIANBAnQiAkGgiQJqIgRBoAgpAwA3AwAgAkGoiQJqQaAIKQMANwMAIAJBsIkCakGgCCkDADcDACACQbiJAmpBoAgpAwA3AwAgAkHAiQJqQaAIKQMANwMAIAJByIkCakGgCCkDADcDACACQdCJAmpBoAgpAwA3AwAgAkHYiQJqQaAIKQMANwMAIAJB4IkCakGgCCkDADcDACACQeiJAmpBoAgpAwA3AwAgAkHwiQJqQaAIKQMANwMAIAJB+IkCakGgCCkDADcDACACQYCKAmpBoAgpAwA3AwAgAkGIigJqQaAIKQMANwMAIAJBkIoCakGgCCkDADcDACACQZiKAmpBoAgpAwA3AwAgAkGgigJqQaAIKQMANwMAIAJBqIoCakGgCCkDADcDACACQbCKAmpBoAgpAwA3AwAgAkG4igJqQaAIKQMANwMAIAJBwIoCakGgCCkDADcDACACQciKAmpBoAgpAwA3AwAgAkHQigJqQaAIKQMANwMAIAJB2IoCakGgCCkDADcDACACQeCKAmpBoAgpAwA3AwAgAkHoigJqQaAIKQMANwMAIAJB8IoCakGgCCkDADcDACACQfiKAmpBoAgpAwA3AwAgAkGAiwJqQaAIKQMANwMAIAJBiIsCakGgCCkDADcDACACQZCLAmpBoAgpAwA3AwAgAkGYiwJqQaAIKQMANwMAIAJBoIsCakGgCCkDADcDACACQaiLAmpBoAgpAwA3AwAgAkGwiwJqQaAIKQMANwMAIAJBuIsCakGgCCkDADcDACACQcCLAmpBoAgpAwA3AwAgAkHIiwJqQaAIKQMANwMAIAJB0IsCakGgCCkDADcDACACQdiLAmpBoAgpAwA3AwAgAkHgiwJqQaAIKQMANwMAIAJB6IsCakGgCCkDADcDACACQfCLAmpBoAgpAwA3AwAgAkH4iwJqQaAIKQMANwMAIAJBgIwCakGgCCkDADcDACACQYiMAmpBoAgpAwA3AwAgAkGQjAJqQaAIKQMANwMAIAJBmIwCakGgCCkDADcDACACQaCMAmpBoAgpAwA3AwAgAkGojAJqQaAIKQMANwMAIAJBsIwCakGgCCkDADcDACACQbiMAmpBoAgpAwA3AwAgAkHAjAJqQaAIKQMANwMAIAJByIwCakGgCCkDADcDACACQdCMAmpBoAgpAwA3AwAgAkHYjAJqQaAIKQMANwMAIAJB4IwCakGgCCkDADcDACACQeiMAmpBoAgpAwA3AwAgAkHwjAJqQaAIKQMANwMAIAJB+IwCakGgCCkDADcDACACQYCNAmpBoAgpAwA3AwAgAkGIjQJqQaAIKQMANwMAIAJBkI0CakGgCCkDADcDACACQZiNAmpBoAgpAwA3AwAgAkGwiQZqIARBgAT8CgAAQdQIKAIAQQJ0QcCJCmogBEGABPwKAABB1AgoAgBBAnRB0IkOaiAEQYAE/AoAAEHUCCgCAEECdEHgiRJqIARBgAT8CgAAQdQIKAIAQQJ0QfCJFmogBEGABPwKAABB1AhB1AgoAgAiAkGAAWoiAzYCACABIANIDQEgAkGA/wBIDQALCwJAIABFDQAgCEH//wBLDQBBgIABIAhrIAcgAUH//wBLGyECAkAgAEEBcUUNACACRQ0AIAhBAnRBoIkCaiEDIAIhBCACQQdxIgcEQANAIAMgBTYCACADQQRqIQMgBEEBayEEIAdBAWsiBw0ACwsgAkEBa0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgBEEIayIEDQALCwJAIABBAnFFDQAgAkUNACAIQQJ0QbCJBmohAyACIQQgAkEHcSIHBEADQCADIAU2AgAgA0EEaiEDIARBAWshBCAHQQFrIgcNAAsLIAJBAWtBB0kNAANAIAMgBTYCHCADIAU2AhggAyAFNgIUIAMgBTYCECADIAU2AgwgAyAFNgIIIAMgBTYCBCADIAU2AgAgA0EgaiEDIARBCGsiBA0ACwsCQCAAQQRxRQ0AIAJFDQAgCEECdEHAiQpqIQMgAiEEIAJBB3EiBwRAA0AgAyAFNgIAIANBBGohAyAEQQFrIQQgB0EBayIHDQALCyACQQFrQQdJDQADQCADIAU2AhwgAyAFNgIYIAMgBTYCFCADIAU2AhAgAyAFNgIMIAMgBTYCCCADIAU2AgQgAyAFNgIAIANBIGohAyAEQQhrIgQNAAsLAkAgAEEIcUUNACACRQ0AIAhBAnRB0IkOaiEDIAIhBCACQQdxIgcEQANAIAMgBTYCACADQQRqIQMgBEEBayEEIAdBAWsiBw0ACwsgAkEBa0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgBEEIayIEDQALCwJAIABBEHFFDQAgAkUNACAIQQJ0QeCJEmohAyACIQQgAkEHcSIHBEADQCADIAU2AgAgA0EEaiEDIARBAWshBCAHQQFrIgcNAAsLIAJBAWtBB0kNAANAIAMgBTYCHCADIAU2AhggAyAFNgIUIAMgBTYCECADIAU2AgwgAyAFNgIIIAMgBTYCBCADIAU2AgAgA0EgaiEDIARBCGsiBA0ACwsgAEEgcUUNACACRQ0AIAJBAWshByAIQQJ0QfCJFmohAyACQQdxIgQEQANAIAMgBTYCACADQQRqIQMgAkEBayECIARBAWsiBA0ACwsgB0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgAkEIayICDQALC0HcCEHcCCgCACAAcjYCACAGQQFqIgIgBi0AAEH/AHEiA0E/ayIAQT9LDQQaDAMLAkBB7AgoAgAiBEEBRgRAQfAIKAIAIgNBzAgoAgAiAUkNASADIAFwIQMMAQtB+AgoAgAhAkH0CCgCACEBAkACQCAEQQVHDQAgAUEBRw0AIAJB6QJODQQMAQsgAkHkAEoNA0H8CCgCAEHkAEoNA0GACSgCAEHkAEoNAwsCQCABRQ0AIAFBAkoNACACQfwIKAIAQYAJKAIAIAFBAnRBiAhqKAIAEQIAIQFB8AgoAgAiA0HMCCgCACICTwR/IAMgAnAFIAMLQQJ0QZAJaiABNgIAC0HwCCgCACIDQcwIKAIAIgFJDQAgAyABcCEDCyADQQJ0QZAJaigCACEFDAELIANB/QBxQSFHBEAgCCEBIAYhAgwECyAEQSNHDQQCQEHsCCgCACICQQFGBEBB8AgoAgAiAUHMCCgCACIASQ0BIAEgAHAhAQwBC0H4CCgCACEBQfQIKAIAIQACQAJAIAJBBUcNACAAQQFHDQAgAUHpAkgNAQwHCyABQeQASg0GQfwIKAIAQeQASg0GQYAJKAIAQeQASg0GCwJAIABFDQAgAEECSg0AIAFB/AgoAgBBgAkoAgAgAEECdEGICGooAgARAgAhAEHwCCgCACIBQcwIKAIAIgJPBH8gASACcAUgAQtBAnRBkAlqIAA2AgALQfAIKAIAIgFBzAgoAgAiAEkNACABIABwIQELIAFBAnRBkAlqKAIAIQUMBAsgCCEBIAYhAgtB1AgoAgAhBgNAAkAgASAGSA0AIAZB//8ASg0AIAZBAnQiBEGgiQJqIgZBoAgpAwA3AwAgBEGoiQJqQaAIKQMANwMAIARBsIkCakGgCCkDADcDACAEQbiJAmpBoAgpAwA3AwAgBEHAiQJqQaAIKQMANwMAIARByIkCakGgCCkDADcDACAEQdCJAmpBoAgpAwA3AwAgBEHYiQJqQaAIKQMANwMAIARB4IkCakGgCCkDADcDACAEQeiJAmpBoAgpAwA3AwAgBEHwiQJqQaAIKQMANwMAIARB+IkCakGgCCkDADcDACAEQYCKAmpBoAgpAwA3AwAgBEGIigJqQaAIKQMANwMAIARBkIoCakGgCCkDADcDACAEQZiKAmpBoAgpAwA3AwAgBEGgigJqQaAIKQMANwMAIARBqIoCakGgCCkDADcDACAEQbCKAmpBoAgpAwA3AwAgBEG4igJqQaAIKQMANwMAIARBwIoCakGgCCkDADcDACAEQciKAmpBoAgpAwA3AwAgBEHQigJqQaAIKQMANwMAIARB2IoCakGgCCkDADcDACAEQeCKAmpBoAgpAwA3AwAgBEHoigJqQaAIKQMANwMAIARB8IoCakGgCCkDADcDACAEQfiKAmpBoAgpAwA3AwAgBEGAiwJqQaAIKQMANwMAIARBiIsCakGgCCkDADcDACAEQZCLAmpBoAgpAwA3AwAgBEGYiwJqQaAIKQMANwMAIARBoIsCakGgCCkDADcDACAEQaiLAmpBoAgpAwA3AwAgBEGwiwJqQaAIKQMANwMAIARBuIsCakGgCCkDADcDACAEQcCLAmpBoAgpAwA3AwAgBEHIiwJqQaAIKQMANwMAIARB0IsCakGgCCkDADcDACAEQdiLAmpBoAgpAwA3AwAgBEHgiwJqQaAIKQMANwMAIARB6IsCakGgCCkDADcDACAEQfCLAmpBoAgpAwA3AwAgBEH4iwJqQaAIKQMANwMAIARBgIwCakGgCCkDADcDACAEQYiMAmpBoAgpAwA3AwAgBEGQjAJqQaAIKQMANwMAIARBmIwCakGgCCkDADcDACAEQaCMAmpBoAgpAwA3AwAgBEGojAJqQaAIKQMANwMAIARBsIwCakGgCCkDADcDACAEQbiMAmpBoAgpAwA3AwAgBEHAjAJqQaAIKQMANwMAIARByIwCakGgCCkDADcDACAEQdCMAmpBoAgpAwA3AwAgBEHYjAJqQaAIKQMANwMAIARB4IwCakGgCCkDADcDACAEQeiMAmpBoAgpAwA3AwAgBEHwjAJqQaAIKQMANwMAIARB+IwCakGgCCkDADcDACAEQYCNAmpBoAgpAwA3AwAgBEGIjQJqQaAIKQMANwMAIARBkI0CakGgCCkDADcDACAEQZiNAmpBoAgpAwA3AwAgBEGwiQZqIAZBgAT8CgAAQdQIKAIAQQJ0QcCJCmogBkGABPwKAABB1AgoAgBBAnRB0IkOaiAGQYAE/AoAAEHUCCgCAEECdEHgiRJqIAZBgAT8CgAAQdQIKAIAQQJ0QfCJFmogBkGABPwKAABB1AhB1AgoAgBBgAFqIgY2AgALIAFB//8ATQRAIABBAXEgAWxBAnRBoIkCaiAFNgIAIABBAXZBAXEgAWxBAnRBsIkGaiAFNgIAIABBAnZBAXEgAWxBAnRBwIkKaiAFNgIAIABBA3ZBAXEgAWxBAnRB0IkOaiAFNgIAIABBBHZBAXEgAWxBAnRB4IkSaiAFNgIAIABBBXYgAWxBAnRB8IkWaiAFNgIAQdQIKAIAIQYLIAFBAWohAUHcCEHcCCgCACAAcjYCACACLQAAIQAgAkEBaiIEIQIgAEH/AHEiA0E/ayIAQcAASQ0ACyAECyECQQAhBCACIQYgASEIIANB/QBxQSFGDQELIANBJGsOCgEDAwMDAwMDAwIDC0HsCEIBNwIADAQLQdgIIAFB2AgoAgAiACAAIAFIGyIAQYCAASAAQYCAAUgbNgIADAILQegIIAFB2AgoAgAiACAAIAFIGyIAQYCAASAAQYCAAUgbIgA2AgBB2AggADYCACAAQQRrEAAEQEHoCEEENgIAQdgIQQQ2AgBB0AhBATYCAA8LEAgMAQsCQCADQTtHDQBB7AgoAgAiAEEHSg0AQewIIABBAWo2AgAgAEECdEHwCGpBADYCAAsgAiEGIAQhAyABIQgMAQtBBCEIIAIhBiAEIQMLIAYgCUkNAAsLQeQIIAU2AgBB4AggAzYCAEHoCCAINgIAC9ELAgF+CH9B2AhCBDcDAEGojQJBoAgpAwAiADcDAEGgjQIgADcDAEGYjQIgADcDAEGQjQIgADcDAEGIjQIgADcDAEGAjQIgADcDAEH4jAIgADcDAEHwjAIgADcDAEHojAIgADcDAEHgjAIgADcDAEHYjAIgADcDAEHQjAIgADcDAEHIjAIgADcDAEHAjAIgADcDAEG4jAIgADcDAEGwjAIgADcDAEGojAIgADcDAEGgjAIgADcDAEGYjAIgADcDAEGQjAIgADcDAEGIjAIgADcDAEGAjAIgADcDAEH4iwIgADcDAEHwiwIgADcDAEHoiwIgADcDAEHgiwIgADcDAEHYiwIgADcDAEHQiwIgADcDAEHIiwIgADcDAEHAiwIgADcDAEG4iwIgADcDAEGwiwIgADcDAEGoiwIgADcDAEGgiwIgADcDAEGYiwIgADcDAEGQiwIgADcDAEGIiwIgADcDAEGAiwIgADcDAEH4igIgADcDAEHwigIgADcDAEHoigIgADcDAEHgigIgADcDAEHYigIgADcDAEHQigIgADcDAEHIigIgADcDAEHAigIgADcDAEG4igIgADcDAEGwigIgADcDAEGoigIgADcDAEGgigIgADcDAEGYigIgADcDAEGQigIgADcDAEGIigIgADcDAEGAigIgADcDAEH4iQIgADcDAEHwiQIgADcDAEHoiQIgADcDAEHgiQIgADcDAEHYiQIgADcDAEHQiQIgADcDAEHIiQIgADcDAEHAiQIgADcDAEG4iQIgADcDAEGwiQIgADcDAEGoCCgCACIEQf8AakGAAW0hCAJAIARBgQFIDQBBASEBIAhBAiAIQQJKG0EBayICQQFxIQMgBEGBAk4EQCACQX5xIQIDQCABQQl0IgdBEHJBoIkCakGwiQJBgAT8CgAAIAdBsI0CakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsLIANFDQAgAUEJdEEQckGgiQJqQbCJAkGABPwKAAALAkAgBEEBSA0AIAhBASAIQQFKGyIDQQFxIQUCQCADQQFrIgdFBEBBACEBDAELIANB/v///wdxIQJBACEBA0AgAUEJdCIGQRByQbCJBmpBsIkCQYAE/AoAACAGQZAEckGwiQZqQbCJAkGABPwKAAAgAUECaiEBIAJBAmsiAg0ACwsgBQRAIAFBCXRBEHJBsIkGakGwiQJBgAT8CgAACyAEQQFIDQAgA0EBcSEFIAcEfyADQf7///8HcSECQQAhAQNAIAFBCXQiBkEQckHAiQpqQbCJAkGABPwKAAAgBkGQBHJBwIkKakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsgAUEHdEEEcgVBBAshASAFBEAgAUECdEHAiQpqQbCJAkGABPwKAAALIARBAUgNACADQQFxIQUgBwR/IANB/v///wdxIQJBACEBA0AgAUEJdCIGQRByQdCJDmpBsIkCQYAE/AoAACAGQZAEckHQiQ5qQbCJAkGABPwKAAAgAUECaiEBIAJBAmsiAg0ACyABQQd0QQRyBUEECyEBIAUEQCABQQJ0QdCJDmpBsIkCQYAE/AoAAAsgBEEBSA0AIANBAXEhBSAHBH8gA0H+////B3EhAkEAIQEDQCABQQl0IgZBEHJB4IkSakGwiQJBgAT8CgAAIAZBkARyQeCJEmpBsIkCQYAE/AoAACABQQJqIQEgAkECayICDQALIAFBB3RBBHIFQQQLIQEgBQRAIAFBAnRB4IkSakGwiQJBgAT8CgAACyAEQQFIDQAgA0EBcSEEIAcEfyADQf7///8HcSECQQAhAQNAIAFBCXQiA0EQckHwiRZqQbCJAkGABPwKAAAgA0GQBHJB8IkWakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsgAUEHdEEEcgVBBAshASAERQ0AIAFBAnRB8IkWakGwiQJBgAT8CgAAC0HUCCAIQQd0QQRyNgIAC58TAgh/AX5B5AgoAgAhA0HgCCgCACECQegIKAIAIQcgAUGQiQFqIglB/wE6AAAgACABSARAIABBkIkBaiEIA0AgAiEEIAhBAWohAQJAIAgtAABB/wBxIgJBMGtBCUsEQCABIQgMAQtB7AgoAgBBAnRB7AhqIgUoAgAhAANAIAUgAiAAQQpsakEwayIANgIAIAEtAAAhAiABQQFqIgghASACQf8AcSICQTBrQQpJDQALCwJAAkACQAJAAkACQAJ/AkAgAkE/ayIAQT9NBEAgBEUNASAEQSFGBEBB8AgoAgAiAUEBIAEbIgQgB2ohAQJAIABFDQAgB0H//wBLDQBBgIABIAdrIAQgAUH//wBLGyEFAkAgAEEBcUUNACAHQQJ0QaCJAmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEECcUUNACAHQQJ0QbCJBmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEEcUUNACAHQQJ0QcCJCmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEIcUUNACAHQQJ0QdCJDmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEQcUUNACAHQQJ0QeCJEmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLIABBIHFFDQAgBUEBayEEIAdBAnRB8IkWaiEAIAVBB3EiAgRAA0AgACADNgIAIABBBGohACAFQQFrIQUgAkEBayICDQALCyAEQQdJDQADQCAAIAM2AhwgACADNgIYIAAgAzYCFCAAIAM2AhAgACADNgIMIAAgAzYCCCAAIAM2AgQgACADNgIAIABBIGohACAFQQhrIgUNAAsLIAhBAWoiBSAILQAAQf8AcSICQT9rIgBBP00NAxoMBAsCQEHsCCgCACIFQQFGBEBB8AgoAgAiAUHMCCgCACIESQ0BIAEgBHAhAQwBC0H4CCgCACEEQfQIKAIAIQECQAJAIAVBBUcNACABQQFHDQAgBEHpAk4NBAwBCyAEQeQASg0DQfwIKAIAQeQASg0DQYAJKAIAQeQASg0DCwJAIAFFDQAgAUECSg0AIARB/AgoAgBBgAkoAgAgAUECdEGICGooAgARAgAhBEHwCCgCACIBQcwIKAIAIgVPBH8gASAFcAUgAQtBAnRBkAlqIAQ2AgALQfAIKAIAIgFBzAgoAgAiBEkNACABIARwIQELIAFBAnRBkAlqKAIAIQMMAQsgAkH9AHFBIUcEQCAHIQEgAiEADAQLIARBI0cNBAJAQewIKAIAIgRBAUYEQEHwCCgCACIBQcwIKAIAIgBJDQEgASAAcCEBDAELQfgIKAIAIQFB9AgoAgAhAAJAAkAgBEEFRw0AIABBAUcNACABQekCSA0BDAcLIAFB5ABKDQZB/AgoAgBB5ABKDQZBgAkoAgBB5ABKDQYLAkAgAEUNACAAQQJKDQAgAUH8CCgCAEGACSgCACAAQQJ0QYgIaigCABECACEAQfAIKAIAIgFBzAgoAgAiBE8EfyABIARwBSABC0ECdEGQCWogADYCAAtB8AgoAgAiAUHMCCgCACIASQ0AIAEgAHAhAQsgAUECdEGQCWooAgAhAwwECyAHIQEgCAshBQNAIAFB//8ATQRAIABBAXEgAWxBAnRBoIkCaiADNgIAIABBAXZBAXEgAWxBAnRBsIkGaiADNgIAIABBAnZBAXEgAWxBAnRBwIkKaiADNgIAIABBA3ZBAXEgAWxBAnRB0IkOaiADNgIAIABBBHZBAXEgAWxBAnRB4IkSaiADNgIAIABBBXYgAWxBAnRB8IkWaiADNgIACyABQQFqIQEgBS0AACEAIAVBAWoiBCEFIABB/wBxIgJBP2siAEHAAEkNAAsgBCEFC0EAIQQgBSEIIAEhByACIQAgAkH9AHFBIUYNAQtBBCEHIAQhAiAAQSRrDgoDAgICAgICAgIBAgtB7AhCATcCAAwCC0GoCCgCAEEEaxAABEBB0AhBATYCAA8LAkBBqAgoAgAiBkEFSA0AQaAIKQMAIQogBkEDa0EBdiIBQQdxIQJBACEAIAFBAWtBB08EQCABQfj///8HcSEFA0AgAEEDdCIBQbCJAmogCjcDACABQQhyQbCJAmogCjcDACABQRByQbCJAmogCjcDACABQRhyQbCJAmogCjcDACABQSByQbCJAmogCjcDACABQShyQbCJAmogCjcDACABQTByQbCJAmogCjcDACABQThyQbCJAmogCjcDACAAQQhqIQAgBUEIayIFDQALCyACRQ0AA0AgAEEDdEGwiQJqIAo3AwAgAEEBaiEAIAJBAWsiAg0ACwtBwIkGQbCJAiAGQQJ0IgD8CgAAQdCJCkGwiQIgAPwKAABB4IkOQbCJAiAA/AoAAEHwiRJBsIkCIAD8CgAAQYCKFkGwiQIgAPwKAAAgBCECDAELAkAgAEE7Rw0AQewIKAIAIgBBB0oNAEHsCCAAQQFqNgIAIABBAnRB8AhqQQA2AgALIAEhBwsgCCAJSQ0ACwtB5AggAzYCAEHgCCACNgIAQegIIAc2AgAL4gcCBX8BfgJAQdAIAn8CQAJAIAAgAU4NACABQZCJAWohBiAAQZCJAWohBQNAIAUtAAAiA0H/AHEhAgJAAkACQAJAAkACQAJAQeAIKAIAIgRBIkcEQCAEDQcgAkEiRgRAQewIQgE3AgBB4AhBIjYCAAwICyACQT9rQcAASQ0GIANBIWsiAkEMTQ0BDAULAkAgAkEwayIEQQlNBEBB7AgoAgBBAnRB7AhqIgIgBCACKAIAQQpsajYCAAwBC0HsCCgCACEEIAJBO0YEQCAEQQdKDQFB7AggBEEBajYCACAEQQJ0QfAIakEANgIADAELIARBBEYEQEHECEECNgIAQbAIQfAIKQMANwMAQbgIQfgIKAIAIgI2AgBBvAhB/AgoAgAiBDYCAEHICEECQQFBwAgoAgAiAxs2AgBBrAggBEEAIAMbNgIAQagIIAJBgIABIAJBgIABSBtBBGpBACADGzYCAEHgCEEANgIADAoLIAJBP2tBwABJDQQLIANBIWsiAkEMTQ0BDAILQQEgAnRBjSBxRQ0DDAQLQQEgAnRBjSBxDQELIANBoQFrIgJBDEsNA0EBIAJ0QY0gcUUNAwtBxAhCgYCAgBA3AgBBsAhB8AgoAgBBAEHsCCgCACICQQBKGzYCAEG0CEH0CCgCAEEAIAJBAUobNgIAQbgIQfgIKAIAQQAgAkECShs2AgBB4AhBADYCAEG8CEEANgIADAQLIANBoQFrIgJBDEsNAUEBIAJ0QY0gcUUNAQtBxAhCgYCAgBA3AgBBsAhCADcDAEG4CEIANwMADAMLIAVBAWoiBSAGSQ0ACwsCQEHICCgCAA4DAwEAAQsCQEGoCCgCACIFQQVIDQBBoAgpAwAhByAFQQNrQQF2IgNBB3EhBEEAIQIgA0EBa0EHTwRAIANB+P///wdxIQYDQCACQQN0IgNBsIkCaiAHNwMAIANBCHJBsIkCaiAHNwMAIANBEHJBsIkCaiAHNwMAIANBGHJBsIkCaiAHNwMAIANBIHJBsIkCaiAHNwMAIANBKHJBsIkCaiAHNwMAIANBMHJBsIkCaiAHNwMAIANBOHJBsIkCaiAHNwMAIAJBCGohAiAGQQhrIgYNAAsLIARFDQADQCACQQN0QbCJAmogBzcDACACQQFqIQIgBEEBayIEDQALC0HAiQZBsIkCIAVBAnQiA/wKAABB0IkKQbCJAiAD/AoAAEHgiQ5BsIkCIAP8CgAAQfCJEkGwiQIgA/wKAABBgIoWQbCJAiAD/AoAAEECDAELEAhByAgoAgALEAEiAjYCACACDQAgACABQcgIKAIAQQJ0QYAIaigCABEBAAsLdABB6AhBBDYCAEHkCCAANgIAQewIQgE3AgBBxAhCADcCAEHACCADNgIAQdwIQgA3AgBBqAhCADcDAEGwCEIANwMAQbgIQgA3AwBBzAggAkGAICACQYAgSRs2AgBBoAggAa1CgYCAgBB+NwMAQdAIQQA2AgALIwBB0AgoAgBFBEAgACABQcgIKAIAQQJ0QYAIaigCABEBAAsLWgECfwJAAkACQEHICCgCAEEBaw4CAAECC0HYCEHoCCgCACIAQdgIKAIAIgEgACABShsiAEGAgAEgAEGAgAFIGyIANgIAIABBBGsPC0GoCCgCAEEEayEACyAAC0IBAX8Cf0EGQdwIKAIAIgBBIHENABpBBSAAQRBxDQAaQQQgAEEIcQ0AGkEDIABBBHENABpBAiAAQQFxIABBAnEbCwu9BQEFfQJ/IAJFBEAgAUH/AWxBMmpB5ABtIgBBCHQgAHIgAEEQdHIMAQsgArJDAADIQpUhBiAAQfABarJDAAC0Q5UhBQJ9IAGyQwAAyEKVIgNDAAAAP10EQCADIAZDAACAP5KUDAELIAYgA0MAAIA/IAaTlJILIQcgAyADkiEGAkAgBUOrqqo+kiIEQwAAAABdBEAgBEMAAIA/kiEEDAELIARDAACAP15FDQAgBEMAAIC/kiEECyAGIAeTIQMgBUMAAAAAXSEAAn8CfSADIAcgA5NDAADAQJQgBJSSIARDq6oqPl0NABogByAEQwAAAD9dDQAaIAMgBEOrqio/XUUNABogAyAHIAOTIARDAADAwJRDAACAQJKUkgtDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALIQECQCAABEAgBUMAAIA/kiEEDAELIAUiBEMAAIA/XkUNACAFQwAAgL+SIQQLIAVDq6qqvpIiBUMAAAAAXSECAn8CfSADIAcgA5NDAADAQJQgBJSSIARDq6oqPl0NABogByAEQwAAAD9dDQAaIAMgBEOrqio/XUUNABogAyAHIAOTIARDAADAwJRDAACAQJKUkgtDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALIQACQCACBEAgBUMAAIA/kiEFDAELIAVDAACAP15FDQAgBUMAAIC/kiEFCwJAIAVDq6oqPl0EQCADIAcgA5NDAADAQJQgBZSSIQcMAQsgBUMAAAA/XQ0AIAVDq6oqP11FBEAgAyEHDAELIAMgByADkyAFQwAAwMCUQwAAgECSlJIhBwsgAEEIdAJ/IAdDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALQRB0ciABcgtBgICAeHILNwAgAEH/AWxBMmpB5ABtIAFB/wFsQTJqQeQAbUEIdHIgAkH/AWxBMmpB5ABtQRB0ckGAgIB4cgsEACMACwYAIAAkAAsQACMAIABrQXBxIgAkACAACwsYAQBBgAgLEQEAAAACAAAAAwAAAAQAAAAF'\n};\n//# sourceMappingURL=wasm.js.map","/**\n * Copyright (c) 2024-2026 The xterm.js authors. All rights reserved.\n * @license MIT\n *\n * Minimal event utilities for xterm.js core.\n * Simplified from VS Code's event.ts - no leak detection/profiling.\n */\n\nimport { IDisposable, DisposableStore, toDisposable } from './Lifecycle';\n\nexport interface IEvent<T> {\n  (listener: (e: T) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore): IDisposable;\n}\n\nexport class Emitter<T> {\n  private _listeners: { fn: (e: T) => any, thisArgs: any }[] = [];\n  private _disposed = false;\n  private _event: IEvent<T> | undefined;\n\n  public get event(): IEvent<T> {\n    if (this._event) {\n      return this._event;\n    }\n    this._event = (listener: (e: T) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore) => {\n      if (this._disposed) {\n        return toDisposable(() => {});\n      }\n\n      const entry = { fn: listener, thisArgs };\n      this._listeners = this._listeners.slice();\n      this._listeners.push(entry);\n\n      const result = toDisposable(() => {\n        const idx = this._listeners.indexOf(entry);\n        if (idx !== -1) {\n          this._listeners = this._listeners.slice();\n          this._listeners.splice(idx, 1);\n        }\n      });\n\n      if (disposables) {\n        if (Array.isArray(disposables)) {\n          disposables.push(result);\n        } else {\n          disposables.add(result);\n        }\n      }\n\n      return result;\n    };\n    return this._event;\n  }\n\n  public fire(event: T): void {\n    if (this._disposed || !this._listeners.length) {\n      return;\n    }\n    if (this._listeners.length === 1) {\n      this._listeners[0].fn.call(this._listeners[0].thisArgs, event);\n      return;\n    }\n    const listeners = this._listeners;\n    for (let i = 0, len = listeners.length; i < len; ++i) {\n      listeners[i].fn.call(listeners[i].thisArgs, event);\n    }\n  }\n\n  public dispose(): void {\n    if (this._disposed) {\n      return;\n    }\n    this._disposed = true;\n    this._listeners.length = 0;\n  }\n}\n\nexport namespace EventUtils {\n  export function forward<T>(from: IEvent<T>, to: Emitter<T>): IDisposable {\n    return from(e => to.fire(e));\n  }\n\n  export function map<I, O>(event: IEvent<I>, map: (i: I) => O): IEvent<O> {\n    return (listener: (e: O) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore) => {\n      return event(i => listener.call(thisArgs, map(i)), undefined, disposables);\n    };\n  }\n\n  export function any<T>(...events: IEvent<T>[]): IEvent<T>;\n  export function any(...events: IEvent<any>[]): IEvent<void>;\n  export function any<T>(...events: IEvent<T>[]): IEvent<T> {\n    return (listener: (e: T) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore) => {\n      const store = new DisposableStore();\n      for (const event of events) {\n        store.add(event(e => listener.call(thisArgs, e)));\n      }\n      if (disposables) {\n        if (Array.isArray(disposables)) {\n          disposables.push(store);\n        } else {\n          disposables.add(store);\n        }\n      }\n      return store;\n    };\n  }\n\n  export function runAndSubscribe<T>(event: IEvent<T>, handler: (e: T) => void, initial: T): IDisposable;\n  export function runAndSubscribe<T>(event: IEvent<T>, handler: (e: T | undefined) => void): IDisposable;\n  export function runAndSubscribe<T>(event: IEvent<T>, handler: (e: T | undefined) => void, initial?: T): IDisposable {\n    handler(initial);\n    return event(e => handler(e));\n  }\n}\n","/**\n * Copyright (c) 2024-2026 The xterm.js authors. All rights reserved.\n * @license MIT\n *\n * Minimal lifecycle utilities for xterm.js core.\n * Simplified from VS Code's lifecycle.ts - no tracking/leak detection.\n */\n\nexport interface IDisposable {\n  dispose(): void;\n}\n\nexport function toDisposable(fn: () => void): IDisposable {\n  return { dispose: fn };\n}\n\nexport function dispose<T extends IDisposable>(disposable: T): T;\nexport function dispose<T extends IDisposable>(disposable: T | undefined): T | undefined;\nexport function dispose<T extends IDisposable>(disposables: T[]): T[];\nexport function dispose<T extends IDisposable>(arg: T | T[] | undefined): T | T[] | undefined {\n  if (!arg) {\n    return arg;\n  }\n  if (Array.isArray(arg)) {\n    for (const d of arg) {\n      d.dispose();\n    }\n    return [];\n  }\n  arg.dispose();\n  return arg;\n}\n\nexport function combinedDisposable(...disposables: IDisposable[]): IDisposable {\n  return toDisposable(() => dispose(disposables));\n}\n\nexport class DisposableStore implements IDisposable {\n  private readonly _disposables = new Set<IDisposable>();\n  private _isDisposed = false;\n\n  public get isDisposed(): boolean {\n    return this._isDisposed;\n  }\n\n  public add<T extends IDisposable>(o: T): T {\n    if (this._isDisposed) {\n      o.dispose();\n    } else {\n      this._disposables.add(o);\n    }\n    return o;\n  }\n\n  public dispose(): void {\n    if (this._isDisposed) {\n      return;\n    }\n    this._isDisposed = true;\n    for (const d of this._disposables) {\n      d.dispose();\n    }\n    this._disposables.clear();\n  }\n\n  public clear(): void {\n    for (const d of this._disposables) {\n      d.dispose();\n    }\n    this._disposables.clear();\n  }\n}\n\nexport abstract class Disposable implements IDisposable {\n  public static readonly None: IDisposable = Object.freeze({ dispose() { } });\n\n  protected readonly _store = new DisposableStore();\n\n  public dispose(): void {\n    this._store.dispose();\n  }\n\n  protected _register<T extends IDisposable>(o: T): T {\n    return this._store.add(o);\n  }\n}\n\nexport class MutableDisposable<T extends IDisposable> implements IDisposable {\n  private _value: T | undefined;\n  private _isDisposed = false;\n\n  public get value(): T | undefined {\n    return this._isDisposed ? undefined : this._value;\n  }\n\n  public set value(value: T | undefined) {\n    if (this._isDisposed || value === this._value) {\n      return;\n    }\n    this._value?.dispose();\n    this._value = value;\n  }\n\n  public clear(): void {\n    this.value = undefined;\n  }\n\n  public dispose(): void {\n    this._isDisposed = true;\n    this._value?.dispose();\n    this._value = undefined;\n  }\n}\n","/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\nimport { IImageAddonOptions, IOscHandler, IResetHandler, ITerminalExt } from './Types';\nimport { ImageRenderer } from './ImageRenderer';\nimport { IIPImageStorage } from './IIPImageStorage';\nimport { CELL_SIZE_DEFAULT } from './ImageStorage';\nimport Base64Decoder from 'xterm-wasm-parts/lib/base64/Base64Decoder.wasm';\nimport QoiDecoder from 'xterm-wasm-parts/lib/qoi/QoiDecoder.wasm';\nimport { HeaderParser, IHeaderFields, HeaderState, SequenceType } from './IIPHeaderParser';\nimport { imageType, UNSUPPORTED_TYPE } from './IIPMetrics';\n\n// Local const enum mirror - esbuild can't inline const enums from external packages\nconst enum DecoderConst {\n  // Limit held memory in base64 decoder (encoded bytes).\n  KEEP_DATA = 4194304,\n  // Initial buffer allocation for the decoder.\n  INITIAL_DATA = 1048576,\n  // Local mirror of const enum (esbuild can't inline const enums from external packages)\n  OK = 0\n}\n\n// default IIP header values\nconst DEFAULT_HEADER: IHeaderFields = {\n  type: SequenceType.INVALID,\n  name: 'Unnamed file',\n  size: 0,\n  width: 'auto',\n  height: 'auto',\n  preserveAspectRatio: 1,\n  inline: 0\n};\n\n\nexport class IIPHandler implements IOscHandler, IResetHandler {\n  private _generation = 0;\n  private _aborted = false;\n  private _hp = new HeaderParser();\n  private _header: IHeaderFields = DEFAULT_HEADER;\n  private _dec: Base64Decoder;\n  private _qoiDec: QoiDecoder;\n  private _isMultipart = false;\n  private _abortMulti = false;\n\n  constructor(\n    private readonly _opts: IImageAddonOptions,\n    private readonly _renderer: ImageRenderer,\n    private readonly _storage: IIPImageStorage,\n    private readonly _coreTerminal: ITerminalExt\n  ) {\n    const maxEncodedBytes = Math.ceil(this._opts.iipSizeLimit * 4 / 3);\n    const initialBytes = Math.min(DecoderConst.INITIAL_DATA, maxEncodedBytes);\n    this._dec = new Base64Decoder(DecoderConst.KEEP_DATA, maxEncodedBytes, initialBytes);\n    this._qoiDec = new QoiDecoder(DecoderConst.KEEP_DATA);\n  }\n\n  public reset(): void {\n    this._generation++;\n    this._hp.reset();\n    this._dec.release();\n    this._qoiDec.release();\n  }\n\n  public start(): void {\n    this._aborted = false;\n    this._hp.reset();\n  }\n\n  public put(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted) return;\n\n    if (this._hp.state === HeaderState.END) {\n      if ((this._dec.put(data.subarray(start, end)) as number) !== DecoderConst.OK) {\n        this._dec.release();\n        this._aborted = true;\n      }\n    } else {\n      const dataPos = this._hp.parse(data, start, end);\n      if (dataPos === -1) {\n        this._aborted = true;\n        return;\n      }\n      if (dataPos > 0) {\n        const seqType = this._hp.fields.type;\n        if (seqType === SequenceType.FILE) {\n          if (this._isMultipart) {\n            this._isMultipart = false;\n            this._abortMulti = false;\n            this._dec.release();\n          }\n          this._header = Object.assign({}, DEFAULT_HEADER, this._hp.fields);\n          if (!this._header.inline) {\n            this._aborted = true;\n            return;\n          }\n          this._dec.init();\n        } else if (this._abortMulti) {\n          this._aborted = true;\n          return;\n        }\n        if ((this._dec.put(data.subarray(dataPos, end)) as number) !== DecoderConst.OK) {\n          this._dec.release();\n          this._aborted = true;\n          if (this._isMultipart) this._abortMulti = true;\n        }\n      }\n    }\n  }\n\n  public end(success: boolean): boolean | Promise<boolean> {\n    if (this._aborted) return true;\n\n    if (this._hp.state !== HeaderState.END) {\n      if (this._hp.end()) return true;\n    }\n    const seqType = this._hp.fields.type;\n\n    if (seqType === SequenceType.FILEPART) return true;\n\n    if (seqType === SequenceType.REPORTCELLSIZE) {\n      // OSC 1337 ; ReportCellSize=[height];[width];[scale] ST\n      let w = CELL_SIZE_DEFAULT.width;\n      let h = CELL_SIZE_DEFAULT.height;\n      if (this._renderer.dimensions) {\n        w = this._renderer.dimensions.css.canvas.width / this._coreTerminal.cols;\n        h = this._renderer.dimensions.css.canvas.height / this._coreTerminal.rows;\n      }\n      const scale = this._coreTerminal._core._coreBrowserService?.dpr ?? 1;\n      const report = `\\x1b]1337;ReportCellSize=${h.toFixed(3)};${w.toFixed(3)};${scale.toFixed(3)}\\x1b\\\\`;\n      this._coreTerminal.input(report, false);\n      return true;\n    }\n\n    if (seqType === SequenceType.MULTIPARTFILE) {\n      this._header = Object.assign({}, DEFAULT_HEADER, this._hp.fields);\n      this._isMultipart = true;\n      this._abortMulti = false;\n      this._dec.release();\n      this._dec.init();\n      return true;\n    }\n\n    if (seqType === SequenceType.FILEEND) {\n      if (!this._isMultipart) return true;\n      this._isMultipart = false;\n      if (this._abortMulti || this._header.type !== SequenceType.MULTIPARTFILE) return true;\n    }\n\n    // fallthrough for SequenceType.FILE & SequenceType.FILEEND\n\n    let w = 0;\n    let h = 0;\n\n    // early exit condition chain\n    let cond: number | boolean;\n    let metrics = UNSUPPORTED_TYPE;\n    if (cond = success) {\n      if (cond = !this._dec.end()) {\n        metrics = imageType(this._dec.data8);\n        if (cond = metrics.mime !== 'unsupported') {\n          w = metrics.width;\n          h = metrics.height;\n          if (cond = w && h && w * h < this._opts.pixelLimit) {\n            [w, h] = this._resize(w, h).map(Math.floor);\n            cond = w && h && w * h < this._opts.pixelLimit;\n          } else {\n            console.warn(`IIP: image dimension issue ${metrics.width}x${metrics.height}`);\n          }\n        } else {\n          console.warn('IIP: unsupported image type');\n        }\n      } else {\n        console.warn('IIP: error during BASE64 decoding');\n      }\n    }\n    if (!cond) {\n      this._dec.release();\n      return true;\n    }\n\n    let blob: Blob | ImageData;\n    if (metrics.mime === 'image/qoi') {\n      const data = this._qoiDec.decode(this._dec.data8);\n      blob = new ImageData(\n        new Uint8ClampedArray(data.buffer, data.byteOffset, data.byteLength),\n        this._qoiDec.width,\n        this._qoiDec.height\n      );\n      this._qoiDec.release();\n      if (w === this._qoiDec.width && h === this._qoiDec.height) {\n        // use fast-path if we don't need to rescale\n        this._dec.release();\n        const canvas = ImageRenderer.createCanvas(undefined, this._qoiDec.width, this._qoiDec.height);\n        canvas.getContext('2d')?.putImageData(blob, 0, 0);\n        this._storage.addImage(canvas);\n        return true;\n      }\n    } else {\n      blob = new Blob([this._dec.data8], { type: metrics.mime });\n    }\n    this._dec.release();\n    const generation = this._generation;\n    return createImageBitmap(blob, { resizeWidth: w, resizeHeight: h })\n      .then(bm => {\n        if (generation !== this._generation) {\n          bm.close();\n          return true;\n        }\n        this._storage.addImage(bm);\n        return true;\n      })\n      .catch(e => {\n        console.warn(`IIP: decoding error ${metrics.mime} ${metrics.width}x${metrics.height}`, e);\n        return true;\n      });\n  }\n\n  private _resize(w: number, h: number): [number, number] {\n    const cw = this._renderer.dimensions?.css.cell.width || CELL_SIZE_DEFAULT.width;\n    const ch = this._renderer.dimensions?.css.cell.height || CELL_SIZE_DEFAULT.height;\n    const width = this._renderer.dimensions?.css.canvas.width || cw * this._coreTerminal.cols;\n    const height = this._renderer.dimensions?.css.canvas.height || ch * this._coreTerminal.rows;\n\n    const rw = this._dim(this._header.width!, width, cw);\n    const rh = this._dim(this._header.height!, height, ch);\n    if (!rw && !rh) {\n      const wf = width / w;         // TODO: should this respect initial cursor offset?\n      const hf = (height - ch) / h; // TODO: fix offset issues from float cell height\n      const f = Math.min(wf, hf);\n      return f < 1 ? [w * f, h * f] : [w, h];\n    }\n    return !rw\n      ? [w * rh / h, rh]\n      : this._header.preserveAspectRatio || !rw || !rh\n        ? [rw, h * rw / w] : [rw, rh];\n  }\n\n  private _dim(s: string, total: number, cdim: number): number {\n    if (s === 'auto') return 0;\n    if (s.endsWith('%')) return parseInt(s.slice(0, -1), 10) * total / 100;\n    if (s.endsWith('px')) return parseInt(s.slice(0, -2), 10);\n    return parseInt(s, 10) * cdim;\n  }\n}\n","/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\n// eslint-disable-next-line\ndeclare const Buffer: any;\n\nexport const enum HeaderState {\n  START = 0,\n  ABORT = 1,\n  KEY = 2,\n  VALUE = 3,\n  END = 4\n}\n\nexport const enum SequenceType {\n  INVALID = 0,\n  FILE = 1,\n  MULTIPARTFILE = 2,\n  FILEPART = 3,\n  FILEEND = 4,\n  REPORTCELLSIZE = 5\n}\n\nexport interface IHeaderFields {\n  [key: string]: number | string | Uint32Array | null | undefined;\n  // sequence type\n  type: SequenceType;\n  // base-64 encoded filename. Defaults to \"Unnamed file\".\n  name: string;\n  // File size in bytes. The file transfer will be canceled if this size is exceeded.\n  size: number;\n  /**\n   * Optional width and height to render:\n   * - N: N character cells.\n   * - Npx: N pixels.\n   * - N%: N percent of the session's width or height.\n   * - auto: The image's inherent size will be used to determine an appropriate dimension.\n   */\n  width?: string;\n  height?: string;\n  // Optional, defaults to 1 respecting aspect ratio (width takes precedence).\n  preserveAspectRatio?: number;\n  // Optional, defaults to 0. If set to 1, the file will be displayed inline, else downloaded\n  // (download not supported).\n  inline?: number;\n}\n\n// field value decoders\n\n// ASCII bytes to string\nfunction toStr(data: Uint32Array): string {\n  let s = '';\n  for (let i = 0; i < data.length; ++i) {\n    s += String.fromCharCode(data[i]);\n  }\n  return s;\n}\n\n// digits to integer\nfunction toInt(data: Uint32Array): number {\n  let v = 0;\n  for (let i = 0; i < data.length; ++i) {\n    if (data[i] < 48 || data[i] > 57) {\n      throw new Error('illegal char');\n    }\n    v = v * 10 + data[i] - 48;\n  }\n  return v;\n}\n\n// check for correct size entry\nfunction toSize(data: Uint32Array): string {\n  const v = toStr(data);\n  if (!v.match(/^((auto)|(\\d+?((px)|(%)){0,1}))$/)) {\n    throw new Error('illegal size');\n  }\n  return v;\n}\n\n// name is base64 encoded utf-8\nfunction toName(data: Uint32Array): string {\n  if (typeof Buffer !== 'undefined') {\n    return Buffer.from(toStr(data), 'base64').toString();\n  }\n  const bs = atob(toStr(data));\n  const b = new Uint8Array(bs.length);\n  for (let i = 0; i < b.length; ++i) {\n    b[i] = bs.charCodeAt(i);\n  }\n  return new TextDecoder().decode(b);\n}\n\nconst DECODERS: {[key: string]: (v: Uint32Array) => number | string} = {\n  inline: toInt,\n  size: toInt,\n  name: toName,\n  width: toSize,\n  height: toSize,\n  preserveAspectRatio: toInt\n};\n\n\n// sequence type markers\n// File\nconst FILE_MARKER = [70, 105, 108, 101];\n// MultipartFile\nconst MULTIPARTFILE_MARKER = [77, 117, 108, 116, 105, 112, 97, 114, 116, 70, 105, 108, 101];\n// FilePart\nconst FILEPART_MARKER = [70, 105, 108, 101, 80, 97, 114, 116];\n// FileEnd\nconst FILEEND_MARKER = [70, 105, 108, 101, 69, 110, 100];\n// ReportCellSize\nconst REPORTCELLSIZE_MARKER = [82, 101, 112, 111, 114, 116, 67, 101, 108, 108, 83, 105, 122, 101];\n\n// max allowed chars for sequence header\nconst MAX_FIELDCHARS = 1024;\n\n\nexport class HeaderParser {\n  public state: HeaderState = HeaderState.START;\n  private _buffer = new Uint32Array(MAX_FIELDCHARS);\n  private _position = 0;\n  private _key = '';\n  public fields: {[key: string]: number | string | Uint32Array | null | undefined} = {};\n\n  public reset(): void {\n    this._buffer.fill(0);\n    this.state = HeaderState.START;\n    this._position = 0;\n    this.fields = {};\n    this._key = '';\n  }\n\n  public end(): number {\n    if (this.state === HeaderState.START) {\n      if (this._position === FILEEND_MARKER.length) {\n        for (let k = 0; k < FILEEND_MARKER.length; ++k) {\n          if (this._buffer[k] !== FILEEND_MARKER[k]) return this._a();\n        }\n        this.fields['type'] = SequenceType.FILEEND;\n        this.state = HeaderState.END;\n        return 0;\n      }\n      if (this._position === REPORTCELLSIZE_MARKER.length) {\n        for (let k = 0; k < REPORTCELLSIZE_MARKER.length; ++k) {\n          if (this._buffer[k] !== REPORTCELLSIZE_MARKER[k]) return this._a();\n        }\n        this.fields['type'] = SequenceType.REPORTCELLSIZE;\n        this.state = HeaderState.END;\n        return 0;\n      }\n      return this._a();\n    }\n    if (this.state === HeaderState.END) return 0;\n    if (this.state === HeaderState.VALUE\n      && this.fields.type === SequenceType.MULTIPARTFILE\n    ) {\n      if (!this._storeValue(this._position)) return this._a();\n      this.state = HeaderState.END;\n      return 0;\n    }\n    return this._a();\n  }\n\n  public parse(data: Uint32Array, start: number, end: number): number {\n    let state = this.state;\n    let pos = this._position;\n    const buffer = this._buffer;\n    if (state === HeaderState.ABORT || state === HeaderState.END) return -1;\n    if (state === HeaderState.START && pos > 14) return -1;\n    for (let i = start; i < end; ++i) {\n      const c = data[i];\n      switch (c) {\n        case 59: // ;\n          if (!this._storeValue(pos)) return this._a();\n          state = HeaderState.KEY;\n          pos = 0;\n          break;\n        case 61: // =\n          if (state === HeaderState.START) {\n            if (buffer[0] === 70) {\n              // 'File' or 'FilePart'\n              let k = 0;\n              for (; k < FILE_MARKER.length; ++k) {\n                if (buffer[k] !== FILE_MARKER[k]) return this._a();\n              }\n              this.fields['type'] = SequenceType.FILE;\n              if (pos === FILEPART_MARKER.length) {\n                for (; k < FILEPART_MARKER.length; ++k) {\n                  if (buffer[k] !== FILEPART_MARKER[k]) return this._a();\n                }\n                this.fields['type'] = SequenceType.FILEPART;\n                this.state = HeaderState.END;\n                return i + 1;\n              }\n            } else if (buffer[0] === 77) {\n              // 'MultipartFile'\n              for (let k = 0; k < MULTIPARTFILE_MARKER.length; ++k) {\n                if (buffer[k] !== MULTIPARTFILE_MARKER[k]) return this._a();\n              }\n              this.fields['type'] = SequenceType.MULTIPARTFILE;\n            } else {\n              return this._a();\n            }\n            state = HeaderState.KEY;\n            pos = 0;\n          } else if (state === HeaderState.KEY) {\n            if (!this._storeKey(pos)) return this._a();\n            state = HeaderState.VALUE;\n            pos = 0;\n          } else if (state === HeaderState.VALUE) {\n            if (pos >= MAX_FIELDCHARS) return this._a();\n            buffer[pos++] = c;\n          }\n          break;\n        case 58: // :\n          if (state === HeaderState.VALUE) {\n            if (!this._storeValue(pos)) return this._a();\n          }\n          this.state = HeaderState.END;\n          return i + 1;\n        default:\n          if (pos >= MAX_FIELDCHARS) return this._a();\n          buffer[pos++] = c;\n      }\n    }\n    this.state = state;\n    this._position = pos;\n    return -2;\n  }\n\n  private _a(): number {\n    this.fields.type = SequenceType.INVALID;\n    this.state = HeaderState.ABORT;\n    return -1;\n  }\n\n  private _storeKey(pos: number): boolean {\n    const k = toStr(this._buffer.subarray(0, pos));\n    if (k) {\n      this._key = k;\n      this.fields[k] = null;\n      return true;\n    }\n    return false;\n  }\n\n  private _storeValue(pos: number): boolean {\n    if (this._key) {\n      try {\n        const v = this._buffer.slice(0, pos);\n        this.fields[this._key] = DECODERS[this._key] ? DECODERS[this._key](v) : v;\n      } catch {\n        return false;\n      }\n      return true;\n    }\n    return false;\n  }\n}\n","/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IAddImageOpts } from './Types';\nimport { ImageStorage } from './ImageStorage';\n\n/**\n * IIP (iTerm Image Protocol) specific image storage controller.\n *\n * Wraps the shared ImageStorage with IIP protocol semantics:\n * - Always uses scrolling mode (cursor advances with image)\n */\nexport class IIPImageStorage {\n  private _addImageOpts: IAddImageOpts = { scrolling: true, layer: 'top', zIndex: 0, cursorPos: 'iip' };\n  constructor(\n    private readonly _storage: ImageStorage\n  ) {}\n\n  /**\n   * Add an IIP image to storage.\n   * Always uses scrolling mode — cursor advances past the image.\n   */\n  public addImage(img: HTMLCanvasElement | ImageBitmap): void {\n    this._storage.addImage(img, this._addImageOpts);\n  }\n}\n","/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\n\nexport type ImageType = 'image/png' | 'image/jpeg' | 'image/gif' | 'image/qoi' | 'image/webp' | 'image/avif' | 'unsupported' | '';\n\nexport interface IMetrics {\n  mime: ImageType;\n  width: number;\n  height: number;\n}\n\nexport const UNSUPPORTED_TYPE: IMetrics = {\n  mime: 'unsupported',\n  width: 0,\n  height: 0\n};\n\nexport function imageType(d: Uint8Array): IMetrics {\n  if (d.length < 32) {\n    return UNSUPPORTED_TYPE;\n  }\n  const d32 = new Uint32Array(d.buffer, d.byteOffset, 8);\n  // PNG: 89 50 4E 47 0D 0A 1A 0A (8 first bytes == magic number for PNG)\n  // + first chunk must be IHDR\n  if (d32[0] === 0x474E5089 && d32[1] === 0x0A1A0A0D && d32[3] === 0x52444849) {\n    return {\n      mime: 'image/png',\n      width:  d[16] << 24 | d[17] << 16 | d[18] << 8 | d[19],\n      height: d[20] << 24 | d[21] << 16 | d[22] << 8 | d[23]\n    };\n  }\n  // JPEG: FF D8 FF\n  if (d[0] === 0xFF && d[1] === 0xD8 && d[2] === 0xFF) {\n    const [width, height] = jpgSize(d);\n    return { mime: 'image/jpeg', width, height };\n  }\n  // GIF: GIF87a or GIF89a\n  if (d32[0] === 0x38464947 && (d[4] === 0x37 || d[4] === 0x39) && d[5] === 0x61) {\n    return {\n      mime: 'image/gif',\n      width:  d[7] << 8 | d[6],\n      height: d[9] << 8 | d[8]\n    };\n  }\n  // QOI: qoif\n  if (d32[0] === 0x66696F71) {\n    return {\n      mime: 'image/qoi',\n      width:  d[4] << 24 | d[5] << 16 | d[6] << 8 | d[7],\n      height: d[8] << 24 | d[9] << 16 | d[10] << 8 | d[11]\n    };\n  }\n  // WEBP: RIFF | xxxx | WEBP | VP8x\n  if (d32[0] === 0x46464952 && d32[2] === 0x50424557 && (d32[3] & 0xFFFFFF) === 0x385056) {\n    switch (d[15]) {\n      case 0x58:  // Extended WebP VP8X --> \"X\"\n        return {\n          mime: 'image/webp',\n          width:  (d[24] | d[25] << 8 | d[26] << 16) + 1,\n          height: (d[27] | d[28] << 8 | d[29] << 16) + 1\n        };\n      case 0x4C:  // Lossless WebP VP8L --> \"L\"\n        if (d[20] !== 0x2f) return UNSUPPORTED_TYPE;\n        const dim = d[21] | d[22] << 8 | d[23] << 16 | d[24] << 24;\n        return {\n          mime: 'image/webp',\n          width:  (dim        & 0x3FFF) + 1,\n          height: (dim >>> 14 & 0x3FFF) + 1\n        };\n      case 0x20:  // Lossy WebP VP8  --> \" \"\n        if (d[23] !== 0x9d || d[24] !== 0x01 || d[25] !== 0x2a) return UNSUPPORTED_TYPE;\n        return {\n          mime: 'image/webp',\n          width:  (d[26] | d[27] << 8) & 0x3FFF,\n          height: (d[28] | d[29] << 8) & 0x3FFF\n        };\n    }\n    return UNSUPPORTED_TYPE;\n  }\n  // AVIF: Box size | ftyp | avif/avis\n  if (d32[1] === 0x70797466 && (d32[2] === 0x66697661 || d32[2] === 0x73697661)) {\n    let pos = -1;\n    // search for ispe box within first 1024 bytes\n    const limit = Math.min(d.length - 16, 1024);\n    for (let i = 8; i < limit; i++) {\n      // scan for ispe\n      if (d[i] === 0x69 && d[i + 1] === 0x73 && d[i + 2] === 0x70 && d[i + 3] === 0x65) {\n        pos = i;\n        break;\n      }\n    }\n    if (pos !== -1) {\n      // dimensions are in BE at +8 (width) at +12 (height)\n      const width =\n        d[pos +  8] << 24 |\n        d[pos +  9] << 16 |\n        d[pos + 10] <<  8 |\n        d[pos + 11];\n      const height =\n        d[pos + 12] << 24 |\n        d[pos + 13] << 16 |\n        d[pos + 14] <<  8 |\n        d[pos + 15];\n      if (width > 0 && height > 0) {\n        return { mime: 'image/avif', width, height };\n      }\n    }\n    return UNSUPPORTED_TYPE;\n  }\n  return UNSUPPORTED_TYPE;\n}\n\n\nfunction jpgSize(d: Uint8Array): [number, number] {\n  const len = d.length;\n  let i = 4;\n  let blockLength = d[i] << 8 | d[i + 1];\n  while (true) {\n    i += blockLength;\n    if (i >= len) {\n      // exhausted without size info\n      return [0, 0];\n    }\n    if (d[i] !== 0xFF) {\n      return [0, 0];\n    }\n    if (d[i + 1] === 0xC0 || d[i + 1] === 0xC2) {\n      if (i + 8 < len) {\n        return [\n          d[i + 7] << 8 | d[i + 8],\n          d[i + 5] << 8 | d[i + 6]\n        ];\n      }\n      return [0, 0];\n    }\n    i += 2;\n    blockLength = d[i] << 8 | d[i + 1];\n  }\n}\n","/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { toRGBA8888 } from 'sixel/lib/Colors';\nimport { IDisposable } from '@xterm/xterm';\nimport { ICellSize, ImageLayer, ITerminalExt, IImageSpec, IRenderDimensions, IRenderService } from './Types';\nimport { Disposable, MutableDisposable, toDisposable } from 'common/Lifecycle';\n\nconst enum Constants {\n  PLACEHOLDER_LENGTH = 4096,\n  PLACEHOLDER_HEIGHT = 24\n}\n\n/**\n * ImageRenderer - terminal frontend extension:\n * - provide primitives for canvas, ImageData, Bitmap (static)\n * - add canvas layer to DOM (browser only for now)\n * - draw image tiles onRender\n */\nexport class ImageRenderer extends Disposable implements IDisposable {\n  /** @deprecated Kept for backward compat — points to top layer canvas. */\n  public get canvas(): HTMLCanvasElement | undefined { return this._layers.get('top')?.canvas; }\n  private _layers = new Map<ImageLayer, CanvasRenderingContext2D>();\n  private _placeholder: HTMLCanvasElement | undefined;\n  private _placeholderBitmap: ImageBitmap | undefined;\n  private _optionsRefresh = this._register(new MutableDisposable());\n  private _oldOpen: ((parent: HTMLElement) => void) | undefined;\n  private _renderService: IRenderService | undefined;\n  private _oldSetRenderer: ((renderer: any) => void) | undefined;\n\n  // drawing primitive - canvas\n  public static createCanvas(localDocument: Document | undefined, width: number, height: number): HTMLCanvasElement {\n    /**\n     * NOTE: We normally dont care, from which document the canvas\n     * gets created, so we can fall back to global document,\n     * if the terminal has no document associated yet.\n     * This way early image loads before calling .open keep working\n     * (still discouraged though, as the metrics will be screwed up).\n     * Only the DOM output canvas should be on the terminal's document,\n     * which gets explicitly checked in `insertLayerToDom`.\n     */\n    const canvas = (localDocument ?? document).createElement('canvas');\n    canvas.width = width | 0;\n    canvas.height = height | 0;\n    return canvas;\n  }\n\n  // drawing primitive - ImageData with optional buffer\n  public static createImageData(ctx: CanvasRenderingContext2D, width: number, height: number, buffer?: ArrayBuffer): ImageData {\n    if (typeof ImageData !== 'function') {\n      const imgData = ctx.createImageData(width, height);\n      if (buffer) {\n        imgData.data.set(new Uint8ClampedArray(buffer, 0, width * height * 4));\n      }\n      return imgData;\n    }\n    return buffer\n      ? new ImageData(new Uint8ClampedArray(buffer, 0, width * height * 4), width, height)\n      : new ImageData(width, height);\n  }\n\n  // drawing primitive - ImageBitmap\n  public static createImageBitmap(img: ImageBitmapSource): Promise<ImageBitmap | undefined> {\n    if (typeof createImageBitmap !== 'function') {\n      return Promise.resolve(undefined);\n    }\n    return createImageBitmap(img);\n  }\n\n\n  constructor(private _terminal: ITerminalExt) {\n    super();\n    this._oldOpen = this._terminal._core.open;\n    this._terminal._core.open = (parent: HTMLElement): void => {\n      this._oldOpen?.call(this._terminal._core, parent);\n      this._open();\n    };\n    if (this._terminal._core.screenElement) {\n      this._open();\n    }\n    // hack to spot fontSize changes\n    this._optionsRefresh.value = this._terminal._core.optionsService.onOptionChange(option => {\n      if (option === 'fontSize') {\n        this.rescaleCanvas();\n        this._renderService?.refreshRows(0, this._terminal.rows);\n      }\n    });\n    this._register(toDisposable(() => {\n      this.removeLayerFromDom();\n      this.removeLayerFromDom('bottom');\n      if (this._terminal._core && this._oldOpen) {\n        this._terminal._core.open = this._oldOpen;\n        this._oldOpen = undefined;\n      }\n      if (this._renderService && this._oldSetRenderer) {\n        this._renderService.setRenderer = this._oldSetRenderer;\n        this._oldSetRenderer = undefined;\n      }\n      this._renderService = undefined;\n      this._layers.clear();\n      this._placeholderBitmap?.close();\n      this._placeholderBitmap = undefined;\n      this._placeholder = undefined;\n    }));\n  }\n\n  /**\n   * Enable the placeholder.\n   */\n  public showPlaceholder(value: boolean): void {\n    if (value) {\n      if (!this._placeholder && this.cellSize.height !== -1) {\n        this._createPlaceHolder(Math.max(this.cellSize.height + 1, Constants.PLACEHOLDER_HEIGHT));\n      }\n    } else {\n      this._placeholderBitmap?.close();\n      this._placeholderBitmap = undefined;\n      this._placeholder = undefined;\n    }\n    this._renderService?.refreshRows(0, this._terminal.rows);\n  }\n\n  /**\n   * Dimensions of the terminal.\n   * Forwarded from internal render service.\n   */\n  public get dimensions(): IRenderDimensions | undefined {\n    return this._terminal.dimensions;\n  }\n\n  /**\n   * Current cell size (float).\n   */\n  public get cellSize(): ICellSize {\n    return {\n      width: this.dimensions?.css.cell.width || -1,\n      height: this.dimensions?.css.cell.height || -1\n    };\n  }\n\n  /**\n   * Clear a region of the image layer canvas.\n   */\n  public clearLines(start: number, end: number, layer?: ImageLayer): void {\n    const y = start * (this.dimensions?.css.cell.height || 0);\n    const w = this.dimensions?.css.canvas.width || 0;\n    const h = (end + 1 - start) * (this.dimensions?.css.cell.height || 0);\n    if (!layer || layer === 'top') {\n      this._layers.get('top')?.clearRect(0, y, w, h);\n    }\n    if (!layer || layer === 'bottom') {\n      this._layers.get('bottom')?.clearRect(0, y, w, h);\n    }\n  }\n\n  /**\n   * Clear whole image canvas.\n   */\n  public clearAll(layer?: ImageLayer): void {\n    if (!layer || layer === 'top') {\n      const ctx = this._layers.get('top');\n      ctx?.clearRect(0, 0, ctx.canvas.width, ctx.canvas.height);\n    }\n    if (!layer || layer === 'bottom') {\n      const ctx = this._layers.get('bottom');\n      ctx?.clearRect(0, 0, ctx.canvas.width, ctx.canvas.height);\n    }\n  }\n\n  /**\n   * Draw neighboring tiles on the image layer canvas.\n   */\n  public draw(imgSpec: IImageSpec, tileId: number, col: number, row: number, count: number = 1): void {\n    const ctx = this._layers.get(imgSpec.layer);\n    if (!ctx) {\n      return;\n    }\n    const { width, height } = this.cellSize;\n\n    // Don't try to draw anything, if we cannot get valid renderer metrics.\n    if (width === -1 || height === -1) {\n      return;\n    }\n\n    this._rescaleImage(imgSpec, width, height);\n    const img = imgSpec.actual!;\n    const { width: sourceWidth, height: sourceHeight } = imgSpec.actualCellSize;\n    const cols = Math.ceil(img.width / sourceWidth);\n\n    const sx = (tileId % cols) * sourceWidth;\n    const sy = Math.floor(tileId / cols) * sourceHeight;\n    const dx = col * width;\n    const dy = row * height;\n\n    // safari bug: never access image source out of bounds\n    const finalWidth = count * sourceWidth + sx > img.width ? img.width - sx : count * sourceWidth;\n    const finalHeight = sy + sourceHeight > img.height ? img.height - sy : sourceHeight;\n\n    // Floor all pixel offsets to get stable tile mapping without any overflows.\n    // Note: For not pixel perfect aligned cells like in the DOM renderer\n    // this will move a tile slightly to the top/left (subpixel range, thus ignore it).\n    // FIX #34: avoid striping on displays with pixelDeviceRatio != 1 by ceiling height and width\n    ctx.drawImage(\n      img,\n      Math.floor(sx), Math.floor(sy), Math.ceil(finalWidth), Math.ceil(finalHeight),\n      Math.floor(dx), Math.floor(dy), Math.ceil(finalWidth * width / sourceWidth), Math.ceil(finalHeight * height / sourceHeight)\n    );\n  }\n\n  /**\n   * Extract a single tile from an image.\n   */\n  public extractTile(imgSpec: IImageSpec, tileId: number): HTMLCanvasElement | undefined {\n    const { width, height } = this.cellSize;\n    // Don't try to draw anything, if we cannot get valid renderer metrics.\n    if (width === -1 || height === -1) {\n      return;\n    }\n    this._rescaleImage(imgSpec, width, height);\n    const img = imgSpec.actual!;\n    const { width: sourceWidth, height: sourceHeight } = imgSpec.actualCellSize;\n    const cols = Math.ceil(img.width / sourceWidth);\n    const sx = (tileId % cols) * sourceWidth;\n    const sy = Math.floor(tileId / cols) * sourceHeight;\n    const finalWidth = sourceWidth + sx > img.width ? img.width - sx : sourceWidth;\n    const finalHeight = sy + sourceHeight > img.height ? img.height - sy : sourceHeight;\n\n    const canvas = ImageRenderer.createCanvas(this.document, Math.ceil(finalWidth * width / sourceWidth), Math.ceil(finalHeight * height / sourceHeight));\n    const ctx = canvas.getContext('2d');\n    if (ctx) {\n      ctx.drawImage(\n        img,\n        Math.floor(sx), Math.floor(sy), Math.floor(finalWidth), Math.floor(finalHeight),\n        0, 0, canvas.width, canvas.height\n      );\n      return canvas;\n    }\n  }\n\n  /**\n   * Draw a line with placeholder on the image layer canvas.\n   */\n  public drawPlaceholder(col: number, row: number, count: number = 1): void {\n    const ctx = this._layers.get('top');\n    if (ctx) {\n      const { width, height } = this.cellSize;\n\n      // Don't try to draw anything, if we cannot get valid renderer metrics.\n      if (width === -1 || height === -1) {\n        return;\n      }\n\n      if (!this._placeholder) {\n        this._createPlaceHolder(Math.max(height + 1, Constants.PLACEHOLDER_HEIGHT));\n      } else if (height >= this._placeholder!.height) {\n        this._createPlaceHolder(height + 1);\n      }\n      if (!this._placeholder) return;\n      ctx.drawImage(\n        this._placeholderBitmap ?? this._placeholder!,\n        col * width,\n        (row * height) % 2 ? 0 : 1,  // needs %2 offset correction\n        width * count,\n        height,\n        col * width,\n        row * height,\n        width * count,\n        height\n      );\n    }\n  }\n\n  /**\n   * Rescale image layer canvas if needed.\n   * Checked once from `ImageStorage.render`.\n   */\n  public rescaleCanvas(): void {\n    const w = this.dimensions?.css.canvas.width || 0;\n    const h = this.dimensions?.css.canvas.height || 0;\n    for (const ctx of this._layers.values()) {\n      if (ctx.canvas.width !== w || ctx.canvas.height !== h) {\n        ctx.canvas.width = w;\n        ctx.canvas.height = h;\n      }\n    }\n  }\n\n  /**\n   * Rescale image in storage if needed.\n   */\n  private _rescaleImage(spec: IImageSpec, currentWidth: number, currentHeight: number): void {\n    if (currentWidth === spec.actualCellSize.width && currentHeight === spec.actualCellSize.height) {\n      return;\n    }\n    const { width: originalWidth, height: originalHeight } = spec.origCellSize;\n    if (currentWidth === originalWidth && currentHeight === originalHeight) {\n      spec.actual = spec.orig;\n      spec.actualCellSize.width = originalWidth;\n      spec.actualCellSize.height = originalHeight;\n      return;\n    }\n    const scaledWidth = Math.ceil(spec.orig!.width * currentWidth / originalWidth);\n    const scaledHeight = Math.ceil(spec.orig!.height * currentHeight / originalHeight);\n    // Upscale visible tiles directly; a full zoomed copy can dwarf the image budget.\n    if (scaledWidth * scaledHeight > spec.orig!.width * spec.orig!.height) {\n      spec.actual = spec.orig;\n      spec.actualCellSize.width = originalWidth;\n      spec.actualCellSize.height = originalHeight;\n      return;\n    }\n    const canvas = ImageRenderer.createCanvas(this.document, scaledWidth, scaledHeight);\n    const ctx = canvas.getContext('2d');\n    if (ctx) {\n      ctx.drawImage(spec.orig!, 0, 0, canvas.width, canvas.height);\n      spec.actual = canvas;\n      spec.actualCellSize.width = currentWidth;\n      spec.actualCellSize.height = currentHeight;\n    }\n  }\n\n  /**\n   * Lazy init for the renderer.\n   */\n  private _open(): void {\n    this._renderService = this._terminal._core._renderService;\n    this._oldSetRenderer = this._renderService.setRenderer.bind(this._renderService);\n    this._renderService.setRenderer = (renderer: any) => {\n      for (const key of [...this._layers.keys()]) {\n        this.removeLayerFromDom(key);\n      }\n      this._oldSetRenderer?.call(this._renderService, renderer);\n    };\n  }\n\n  public insertLayerToDom(layer: ImageLayer = 'top'): void {\n    // make sure that the terminal is attached to a document and to DOM\n    if (!this.document || !this._terminal._core.screenElement) {\n      console.warn('image addon: cannot insert output canvas to DOM, missing document or screenElement');\n      return;\n    }\n    if (this._layers.has(layer)) {\n      return;\n    }\n    const canvas = ImageRenderer.createCanvas(\n      this.document, this.dimensions?.css.canvas.width || 0,\n      this.dimensions?.css.canvas.height || 0\n    );\n    canvas.classList.add(`xterm-image-layer-${layer}`);\n    const screenElement = this._terminal._core.screenElement;\n    // Use isolation to create a stacking context without overriding z-index,\n    // which would conflict with integrators (e.g. VS Code) that set their\n    // own z-index on the screen element.\n    screenElement.style.isolation = 'isolate';\n    if (layer === 'bottom') {\n      // Use z-index:-1 so it paints behind non-positioned text elements.\n      // The screen element needs to be a stacking context (via isolation)\n      // to contain the negative z-index, otherwise it would go behind the\n      // entire terminal.\n      canvas.style.zIndex = '-1';\n      screenElement.insertBefore(canvas, screenElement.firstChild);\n    } else {\n      // Explicit z-index ensures the image canvas reliably stacks above\n      // the text layer (DOM renderer rows). z-index: 0 is below the\n      // selection overlay (z-index: 1).\n      canvas.style.zIndex = '0';\n      screenElement.appendChild(canvas);\n    }\n    const ctx = canvas.getContext('2d', { alpha: true });\n    if (!ctx) {\n      canvas.remove();\n      return;\n    }\n    this._layers.set(layer, ctx);\n    this.clearAll(layer);\n  }\n\n  public removeLayerFromDom(layer: ImageLayer = 'top'): void {\n    const ctx = this._layers.get(layer);\n    if (ctx) {\n      ctx.canvas.remove();\n      this._layers.delete(layer);\n    }\n  }\n\n  public hasLayer(layer: ImageLayer): boolean {\n    return this._layers.has(layer);\n  }\n\n  private _createPlaceHolder(height: number = Constants.PLACEHOLDER_HEIGHT): void {\n    this._placeholderBitmap?.close();\n    this._placeholderBitmap = undefined;\n\n    // create blueprint to fill placeholder with\n    const bWidth = 32;  // must be 2^n\n    const blueprint = ImageRenderer.createCanvas(this.document, bWidth, height);\n    const ctx = blueprint.getContext('2d', { alpha: false });\n    if (!ctx) return;\n    const imgData = ImageRenderer.createImageData(ctx, bWidth, height);\n    const d32 = new Uint32Array(imgData.data.buffer);\n    const black = toRGBA8888(0, 0, 0);\n    const white = toRGBA8888(255, 255, 255);\n    d32.fill(black);\n    for (let y = 0; y < height; ++y) {\n      const shift = y % 2;\n      const offset = y * bWidth;\n      for (let x = 0; x < bWidth; x += 2) {\n        d32[offset + x + shift] = white;\n      }\n    }\n    ctx.putImageData(imgData, 0, 0);\n\n    // create placeholder line, width aligned to blueprint width\n    const width = (screen.width + bWidth - 1) & ~(bWidth - 1) || Constants.PLACEHOLDER_LENGTH;\n    this._placeholder = ImageRenderer.createCanvas(this.document, width, height);\n    const ctx2 = this._placeholder.getContext('2d', { alpha: false });\n    if (!ctx2) {\n      this._placeholder = undefined;\n      return;\n    }\n    for (let i = 0; i < width; i += bWidth) {\n      ctx2.drawImage(blueprint, i, 0);\n    }\n    const placeholder = this._placeholder;\n    ImageRenderer.createImageBitmap(placeholder).then(bitmap => {\n      if (this._placeholder !== placeholder) bitmap?.close();\n      else this._placeholderBitmap = bitmap;\n    }).catch(() => {});\n  }\n\n  public get document(): Document | undefined {\n    return this._terminal._core._coreBrowserService?.window.document;\n  }\n}\n","/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IDisposable } from '@xterm/xterm';\nimport { ImageRenderer } from './ImageRenderer';\nimport {\n  ITerminalExt, IExtendedAttrsImage, IImageAddonOptions, IImageSpec,\n  IBufferLineExt, BgFlags, Cell, Content, ICellSize, ExtFlags, Attributes,\n  UnderlineStyle, IAddImageOpts\n} from './Types';\n\n\n// fallback default cell size\nexport const CELL_SIZE_DEFAULT: ICellSize = {\n  width: 7,\n  height: 14\n};\n\n/**\n * Extend extended attribute to also hold image tile information.\n *\n * Object definition is copied from base repo to fully mimick its behavior.\n * Image data is added as additional public properties `imageId` and `tileId`.\n */\nclass ExtendedAttrsImage implements IExtendedAttrsImage {\n  private _ext: number = 0;\n  public get ext(): number {\n    if (this._urlId) {\n      return (\n        (this._ext & ~ExtFlags.UNDERLINE_STYLE) |\n        (this.underlineStyle << 26)\n      );\n    }\n    return this._ext;\n  }\n  public set ext(value: number) { this._ext = value; }\n\n  public get underlineStyle(): UnderlineStyle {\n    // Always return the URL style if it has one\n    if (this._urlId) {\n      return UnderlineStyle.DASHED;\n    }\n    return (this._ext & ExtFlags.UNDERLINE_STYLE) >> 26;\n  }\n  public set underlineStyle(value: UnderlineStyle) {\n    this._ext &= ~ExtFlags.UNDERLINE_STYLE;\n    this._ext |= (value << 26) & ExtFlags.UNDERLINE_STYLE;\n  }\n\n  public get underlineColor(): number {\n    return this._ext & (Attributes.CM_MASK | Attributes.RGB_MASK);\n  }\n  public set underlineColor(value: number) {\n    this._ext &= ~(Attributes.CM_MASK | Attributes.RGB_MASK);\n    this._ext |= value & (Attributes.CM_MASK | Attributes.RGB_MASK);\n  }\n\n  public get underlineVariantOffset(): number {\n    const val = (this._ext & ExtFlags.VARIANT_OFFSET) >> 29;\n    if (val < 0) {\n      return val ^ 0xFFFFFFF8;\n    }\n    return val;\n  }\n  public set underlineVariantOffset(value: number) {\n    this._ext &= ~ExtFlags.VARIANT_OFFSET;\n    this._ext |= (value << 29) & ExtFlags.VARIANT_OFFSET;\n  }\n\n  private _urlId: number = 0;\n  public get urlId(): number {\n    return this._urlId;\n  }\n  public set urlId(value: number) {\n    this._urlId = value;\n  }\n\n  constructor(\n    ext: number = 0,\n    urlId: number = 0,\n    public imageId = -1,\n    public tileId = -1\n  ) {\n    this._ext = ext;\n    this._urlId = urlId;\n  }\n\n  public clone(): IExtendedAttrsImage {\n    /**\n     * Technically we dont need a clone variant of ExtendedAttrsImage,\n     * as we never clone a cell holding image data.\n     * Note: Clone is only meant to be used by the InputHandler for\n     * sticky attributes, which is never the case for image data.\n     * We still provide a proper clone method to reflect the full ext attr\n     * state in case there are future use cases for clone.\n     */\n    return new ExtendedAttrsImage(this._ext, this._urlId, this.imageId, this.tileId);\n  }\n\n  public isEmpty(): boolean {\n    return this.underlineStyle === UnderlineStyle.NONE && this._urlId === 0 && this.imageId === -1;\n  }\n}\nconst EMPTY_ATTRS = new ExtendedAttrsImage();\n\n\n/**\n * ImageStorage - extension of CoreTerminal:\n * - hold image data\n * - write/read image data to/from buffer\n *\n * TODO: image composition for overwrites\n */\nexport class ImageStorage implements IDisposable {\n  // storage\n  private _images: Map<number, IImageSpec> = new Map();\n  // last used id\n  private _lastId = 0;\n  // last evicted id\n  private _lowestId = 0;\n  // whether a full clear happened before\n  private _fullyCleared = false;\n  // whether render should do a full clear\n  private _needsFullClear = false;\n  // hard limit of stored pixels (fallback limit of 10 MB)\n  private _pixelLimit: number = 2500000;\n\n  private _viewportMetrics: { cols: number, rows: number };\n  public onImageAdded: (() => void) | undefined;\n  public onImageDeleted: ((storageId: number) => void) | undefined;\n\n  constructor(\n    private _terminal: ITerminalExt,\n    private _renderer: ImageRenderer,\n    private _opts: IImageAddonOptions\n  ) {\n    try {\n      this.setLimit(this._opts.storageLimit);\n    } catch (e: unknown) {\n      if (e instanceof Error) {\n        console.error(e.message);\n      }\n      console.warn(`storageLimit is set to ${this.getLimit()} MB`);\n    }\n    this._viewportMetrics = {\n      cols: this._terminal.cols,\n      rows: this._terminal.rows\n    };\n  }\n\n  public dispose(): void {\n    this.reset();\n  }\n\n  public reset(): void {\n    for (const spec of this._images.values()) {\n      spec.marker?.dispose();\n    }\n    // NOTE: marker.dispose above already calls ImageBitmap.close\n    // therefore we can just wipe the map here\n    this._images.clear();\n    this._renderer.clearAll();\n  }\n\n  public getLimit(): number {\n    return this._pixelLimit * 4 / 1000000;\n  }\n\n  public setLimit(value: number): void {\n    if (value < 0.5 || value > 1000) {\n      throw RangeError('invalid storageLimit, should be at least 0.5 MB and not exceed 1G');\n    }\n    this._pixelLimit = (value / 4 * 1000000) >>> 0;\n    this._evictOldest(0);\n  }\n\n  public getUsage(): number {\n    return this._getStoredPixels() * 4 / 1000000;\n  }\n\n  private _getStoredPixels(): number {\n    let storedPixels = 0;\n    for (const spec of this._images.values()) {\n      if (spec.orig) {\n        storedPixels += spec.orig.width * spec.orig.height;\n        if (spec.actual && spec.actual !== spec.orig) {\n          storedPixels += spec.actual.width * spec.actual.height;\n        }\n      }\n    }\n    return storedPixels;\n  }\n\n  private _delImg(id: number): void {\n    const spec = this._images.get(id);\n    if (!spec) return;\n    this._images.delete(id);\n    // FIXME: really ugly workaround to get bitmaps deallocated :(\n    if (window.ImageBitmap && spec.orig instanceof ImageBitmap) {\n      spec.orig.close();\n    }\n    this.onImageDeleted?.(id);\n  }\n\n  /**\n   * Wipe canvas and images on alternate buffer.\n   */\n  public wipeAlternate(): void {\n    // remove all alternate tagged images\n    const zero = [];\n    for (const [id, spec] of this._images.entries()) {\n      if (spec.bufferType === 'alternate') {\n        spec.marker?.dispose();\n        zero.push(id);\n      }\n    }\n    for (const id of zero) {\n      this._delImg(id);\n    }\n    // mark canvas to be wiped on next render\n    this._needsFullClear = true;\n    this._fullyCleared = false;\n  }\n\n  /**\n   * Delete an image by its internal storage ID.\n   * Used by protocols that support explicit deletion (e.g. Kitty a=d).\n   */\n  public deleteImage(id: number): void {\n    const spec = this._images.get(id);\n    if (spec) {\n      spec.marker?.dispose();\n      this._delImg(id);\n    }\n  }\n\n  /**\n   * Method to add an image to the storage.\n   * @param img - The image to add (canvas or bitmap).\n   * @param opts - Options for addImage:\n   *   - scrolling:  When true, cursor advances with the image.\n   *                 When false, image is placed at ORIGIN and cursor does not move.\n   *   - layer:      Which canvas layer to render on ('top' or 'bottom').\n   *   - zIndex:     Z-index for image layering within the same layer.\n   *   - cursorPos:  'vt340' for bottom-left, 'iip' for bottom.right.\n   * @returns The internal image ID assigned to the stored image.\n   */\n  public addImage(img: HTMLCanvasElement | ImageBitmap, opts: IAddImageOpts): number {\n    // never allow storage to exceed memory limit\n    this._evictOldest(img.width * img.height);\n\n    // calc rows x cols needed to display the image\n    let cellSize = this._renderer.cellSize;\n    if (cellSize.width === -1 || cellSize.height === -1) {\n      cellSize = CELL_SIZE_DEFAULT;\n    }\n    const cols = Math.ceil(img.width / cellSize.width);\n    const rows = Math.ceil(img.height / cellSize.height);\n\n    const imageId = ++this._lastId;\n\n    const buffer = this._terminal._core.buffer;\n    const termCols = this._terminal.cols;\n    const termRows = this._terminal.rows;\n    const originX = buffer.x;\n    const originY = buffer.y;\n    let offset = originX;\n    let tileCount = 0;\n\n    if (!opts.scrolling) {\n      buffer.x = 0;\n      buffer.y = 0;\n      offset = 0;\n    }\n\n    this._terminal._core._inputHandler._dirtyRowTracker.markDirty(buffer.y);\n    for (let row = 0; row < rows; ++row) {\n      const line = buffer.lines.get(buffer.y + buffer.ybase);\n      for (let col = 0; col < cols; ++col) {\n        if (offset + col >= termCols) break;\n        this._writeToCell(line as IBufferLineExt, offset + col, imageId, row * cols + col);\n        tileCount++;\n      }\n      if (opts.scrolling) {\n        if (row < rows - 1) this._terminal._core._inputHandler.lineFeed();\n      } else {\n        if (++buffer.y >= termRows) break;\n      }\n      buffer.x = offset;\n    }\n    this._terminal._core._inputHandler._dirtyRowTracker.markDirty(buffer.y);\n\n    // cursor positioning modes\n    if (opts.scrolling) {\n      if (opts.cursorPos === 'iip') {\n        buffer.x = Math.min(offset + cols, termCols);\n      } else {\n        buffer.x = offset;\n      }\n    } else {\n      buffer.x = originX;\n      buffer.y = originY;\n    }\n\n    // deleted images with zero tile count\n    const zero = [];\n    for (const [id, spec] of this._images.entries()) {\n      if (spec.tileCount < 1) {\n        spec.marker?.dispose();\n        zero.push(id);\n      }\n    }\n    for (const id of zero) {\n      this._delImg(id);\n    }\n\n    // eviction marker:\n    // delete the image when the marker gets disposed\n    const endMarker = this._terminal.registerMarker(0);\n    endMarker?.onDispose(() => {\n      const spec = this._images.get(imageId);\n      if (spec) {\n        this._delImg(imageId);\n      }\n    });\n\n    // since markers do not work on alternate for some reason,\n    // we evict images here manually\n    if (this._terminal.buffer.active.type === 'alternate') {\n      this._evictOnAlternate();\n    }\n\n    // create storage entry\n    const imgSpec: IImageSpec = {\n      orig: img,\n      origCellSize: cellSize,\n      actual: img,\n      actualCellSize: { ...cellSize },  // clone needed, since later modified\n      marker: endMarker || undefined,\n      tileCount,\n      bufferType: this._terminal.buffer.active.type,\n      layer: opts.layer,\n      zIndex: opts.zIndex\n    };\n\n    // finally add the image\n    this._images.set(imageId, imgSpec);\n    this.onImageAdded?.();\n    return imageId;\n  }\n\n\n  /**\n   * Render method. Collects buffer information and triggers\n   * canvas updates.\n   */\n  // TODO: Should we move this to the ImageRenderer?\n  public render(range: { start: number, end: number }): void {\n    // Determine which layers have images\n    let hasTopImages = false;\n    let hasBottomImages = false;\n    for (const spec of this._images.values()) {\n      if (spec.layer === 'bottom') {\n        hasBottomImages = true;\n      } else {\n        hasTopImages = true;\n      }\n      if (hasTopImages && hasBottomImages) break;\n    }\n\n    // Lazily insert layers that are needed\n    if (hasTopImages && !this._renderer.hasLayer('top')) {\n      this._renderer.insertLayerToDom('top');\n      if (!this._renderer.hasLayer('top')) return;\n    }\n    if (hasBottomImages && !this._renderer.hasLayer('bottom')) {\n      this._renderer.insertLayerToDom('bottom');\n    }\n\n    // rescale if needed\n    this._renderer.rescaleCanvas();\n\n    // exit early if we dont have any images to test for\n    if (!this._images.size) {\n      if (!this._fullyCleared) {\n        this._renderer.clearAll();\n        this._fullyCleared = true;\n        this._needsFullClear = false;\n      }\n      if (this._renderer.hasLayer('top')) {\n        this._renderer.removeLayerFromDom('top');\n      }\n      if (this._renderer.hasLayer('bottom')) {\n        this._renderer.removeLayerFromDom('bottom');\n      }\n      return;\n    }\n\n    // Remove layers no longer needed\n    if (!hasTopImages && this._renderer.hasLayer('top')) {\n      this._renderer.clearAll('top');\n      this._renderer.removeLayerFromDom('top');\n    }\n    if (!hasBottomImages && this._renderer.hasLayer('bottom')) {\n      this._renderer.clearAll('bottom');\n      this._renderer.removeLayerFromDom('bottom');\n    }\n\n    // buffer switches force a full clear\n    if (this._needsFullClear) {\n      this._renderer.clearAll();\n      this._fullyCleared = true;\n      this._needsFullClear = false;\n    }\n\n    const { start, end } = range;\n    const buffer = this._terminal._core.buffer;\n    const cols = this._terminal._core.cols;\n\n    // clear drawing area\n    this._renderer.clearLines(start, end);\n\n    // Collect draw calls so we can sort by z-index (lower z drawn first).\n    const drawCalls: { imgSpec: IImageSpec, tileId: number, col: number, row: number, count: number }[] = [];\n    const placeholderCalls: { col: number, row: number, count: number }[] = [];\n\n    // walk all cells in viewport and collect tiles found\n    for (let row = start; row <= end; ++row) {\n      const line = buffer.lines.get(row + buffer.ydisp) as IBufferLineExt;\n      if (!line) return;\n      for (let col = 0; col < cols; ++col) {\n        if (line.getBg(col) & BgFlags.HAS_EXTENDED) {\n          let e: IExtendedAttrsImage = line._extendedAttrs[col] ?? EMPTY_ATTRS;\n          const imageId = e.imageId;\n          if (imageId === undefined || imageId === -1) {\n            continue;\n          }\n          const imgSpec = this._images.get(imageId);\n          if (e.tileId !== -1) {\n            const startTile = e.tileId;\n            const startCol = col;\n            let count = 1;\n            /**\n             * merge tiles to the right into a single draw call, if:\n             * - not at end of line\n             * - cell has same image id\n             * - cell has consecutive tile id\n             */\n            while (\n              ++col < cols\n              && (line.getBg(col) & BgFlags.HAS_EXTENDED)\n              && (e = line._extendedAttrs[col] ?? EMPTY_ATTRS)\n              && (e.imageId === imageId)\n              && (e.tileId === startTile + count)\n            ) {\n              count++;\n            }\n            col--;\n            if (imgSpec) {\n              if (imgSpec.actual) {\n                drawCalls.push({ imgSpec, tileId: startTile, col: startCol, row, count });\n              }\n            } else if (this._opts.showPlaceholder) {\n              placeholderCalls.push({ col: startCol, row, count });\n            }\n            this._fullyCleared = false;\n          }\n        }\n      }\n    }\n\n    // Sort by z-index so lower z draws first (higher z renders on top)\n    drawCalls.sort((a, b) => a.imgSpec.zIndex - b.imgSpec.zIndex);\n\n    // Draw placeholders first (lowest priority)\n    for (const call of placeholderCalls) {\n      this._renderer.drawPlaceholder(call.col, call.row, call.count);\n    }\n\n    // Draw images in z-index order\n    for (const call of drawCalls) {\n      this._renderer.draw(call.imgSpec, call.tileId, call.col, call.row, call.count);\n    }\n  }\n\n  public viewportResize(metrics: { cols: number, rows: number }): void {\n    // exit early if we have nothing in storage\n    if (!this._images.size) {\n      this._viewportMetrics = metrics;\n      return;\n    }\n\n    // handle only viewport width enlargements, exit all other cases\n    // TODO: needs patch for tile counter\n    if (this._viewportMetrics.cols >= metrics.cols) {\n      this._viewportMetrics = metrics;\n      return;\n    }\n\n    // walk scrollbuffer at old col width to find all possible expansion matches\n    const buffer = this._terminal._core.buffer;\n    const rows = buffer.lines.length;\n    const oldCol = this._viewportMetrics.cols - 1;\n    for (let row = 0; row < rows; ++row) {\n      const line = buffer.lines.get(row) as IBufferLineExt;\n      if (line.getBg(oldCol) & BgFlags.HAS_EXTENDED) {\n        const e: IExtendedAttrsImage = line._extendedAttrs[oldCol] ?? EMPTY_ATTRS;\n        const imageId = e.imageId;\n        if (imageId === undefined || imageId === -1) {\n          continue;\n        }\n        const imgSpec = this._images.get(imageId);\n        if (!imgSpec) {\n          continue;\n        }\n        // found an image tile at oldCol, check if it qualifies for right exapansion\n        const tilesPerRow = Math.ceil((imgSpec.actual?.width || 0) / imgSpec.actualCellSize.width);\n        if ((e.tileId % tilesPerRow) + 1 >= tilesPerRow) {\n          continue;\n        }\n        // expand only if right side is empty (nothing got wrapped from below)\n        let hasData = false;\n        for (let rightCol = oldCol + 1; rightCol > metrics.cols; ++rightCol) {\n          if (line._data[rightCol * Cell.SIZE + Cell.CONTENT] & Content.HAS_CONTENT_MASK) {\n            hasData = true;\n            break;\n          }\n        }\n        if (hasData) {\n          continue;\n        }\n        // do right expansion on terminal buffer\n        const end = Math.min(metrics.cols, tilesPerRow - (e.tileId % tilesPerRow) + oldCol);\n        let lastTile = e.tileId;\n        for (let expandCol = oldCol + 1; expandCol < end; ++expandCol) {\n          this._writeToCell(line as IBufferLineExt, expandCol, imageId, ++lastTile);\n          imgSpec.tileCount++;\n        }\n      }\n    }\n    // store new viewport metrics\n    this._viewportMetrics = metrics;\n  }\n\n  /**\n   * Retrieve original canvas at buffer position.\n   */\n  public getImageAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    const buffer = this._terminal._core.buffer;\n    const line = buffer.lines.get(y) as IBufferLineExt;\n    if (line && line.getBg(x) & BgFlags.HAS_EXTENDED) {\n      const e: IExtendedAttrsImage = line._extendedAttrs[x] ?? EMPTY_ATTRS;\n      if (e.imageId && e.imageId !== -1) {\n        const orig = this._images.get(e.imageId)?.orig;\n        if (window.ImageBitmap && orig instanceof ImageBitmap) {\n          const canvas = ImageRenderer.createCanvas(window.document, orig.width, orig.height);\n          canvas.getContext('2d')?.drawImage(orig, 0, 0, orig.width, orig.height);\n          return canvas;\n        }\n        return orig as HTMLCanvasElement;\n      }\n    }\n  }\n\n  /**\n   * Extract active single tile at buffer position.\n   */\n  public extractTileAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    const buffer = this._terminal._core.buffer;\n    const line = buffer.lines.get(y) as IBufferLineExt;\n    if (line && line.getBg(x) & BgFlags.HAS_EXTENDED) {\n      const e: IExtendedAttrsImage = line._extendedAttrs[x] ?? EMPTY_ATTRS;\n      if (e.imageId && e.imageId !== -1 && e.tileId !== -1) {\n        const spec = this._images.get(e.imageId);\n        if (spec) {\n          return this._renderer.extractTile(spec, e.tileId);\n        }\n      }\n    }\n  }\n\n  // TODO: Do we need some blob offloading tricks here to avoid early eviction?\n  // also see https://stackoverflow.com/questions/28307789/is-there-any-limitation-on-javascript-max-blob-size\n  private _evictOldest(room: number): number {\n    const used = this._getStoredPixels();\n    let current = used;\n    while (this._pixelLimit < current + room && this._images.size) {\n      const spec = this._images.get(++this._lowestId);\n      if (spec && spec.orig) {\n        current -= spec.orig.width * spec.orig.height;\n        if (spec.actual && spec.orig !== spec.actual) {\n          current -= spec.actual.width * spec.actual.height;\n        }\n        spec.marker?.dispose();\n        this._delImg(this._lowestId);\n      }\n    }\n    return used - current;\n  }\n\n  private _writeToCell(line: IBufferLineExt, x: number, imageId: number, tileId: number): void {\n    if (line._data[x * Cell.SIZE + Cell.BG] & BgFlags.HAS_EXTENDED) {\n      const old = line._extendedAttrs[x];\n      if (old) {\n        if (old.imageId !== undefined) {\n          // found an old ExtendedAttrsImage, since we know that\n          // they are always isolated instances (single cell usage),\n          // we can re-use it and just update their id entries\n          const oldSpec = this._images.get(old.imageId);\n          if (oldSpec) {\n            // early eviction for in-viewport overwrites\n            oldSpec.tileCount--;\n          }\n          old.imageId = imageId;\n          old.tileId = tileId;\n          return;\n        }\n        // found a plain ExtendedAttrs instance, clone it to new entry\n        line._extendedAttrs[x] = new ExtendedAttrsImage(old.ext, old.urlId, imageId, tileId);\n        return;\n      }\n    }\n    // fall-through: always create new ExtendedAttrsImage entry\n    line._data[x * Cell.SIZE + Cell.BG] |= BgFlags.HAS_EXTENDED;\n    line._extendedAttrs[x] = new ExtendedAttrsImage(0, 0, imageId, tileId);\n  }\n\n  private _evictOnAlternate(): void {\n    // nullify tile count of all images on alternate buffer\n    for (const spec of this._images.values()) {\n      if (spec.bufferType === 'alternate') {\n        spec.tileCount = 0;\n      }\n    }\n    // re-count tiles on whole buffer\n    const buffer = this._terminal._core.buffer;\n    for (let y = 0; y < this._terminal.rows; ++y) {\n      const line = buffer.lines.get(y) as IBufferLineExt;\n      if (!line) {\n        continue;\n      }\n      for (let x = 0; x < this._terminal.cols; ++x) {\n        if (line._data[x * Cell.SIZE + Cell.BG] & BgFlags.HAS_EXTENDED) {\n          const imgId = line._extendedAttrs[x]?.imageId;\n          if (imgId) {\n            const spec = this._images.get(imgId);\n            if (spec) {\n              spec.tileCount++;\n            }\n          }\n        }\n      }\n    }\n    // deleted images with zero tile count\n    const zero = [];\n    for (const [id, spec] of this._images.entries()) {\n      if (spec.bufferType === 'alternate' && !spec.tileCount) {\n        spec.marker?.dispose();\n        zero.push(id);\n      }\n    }\n    for (const id of zero) {\n      this._delImg(id);\n    }\n  }\n}\n","/**\n * Copyright (c) 2020, 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { SixelImageStorage } from './SixelImageStorage';\nimport { IDcsHandler, IParams, IImageAddonOptions, ITerminalExt, AttributeData, IResetHandler, ReadonlyColorSet } from './Types';\nimport { toRGBA8888, BIG_ENDIAN, PALETTE_ANSI_256, PALETTE_VT340_COLOR } from 'sixel/lib/Colors';\nimport { RGBA8888 } from 'sixel/lib/Types';\nimport { ImageRenderer } from './ImageRenderer';\n\nimport { DecoderAsync, Decoder } from 'sixel/lib/Decoder';\n\n// always free decoder ressources after decoding if it exceeds this limit\nconst MEM_PERMA_LIMIT = 4194304; // 1024 pixels * 1024 pixels * 4 channels = 4MB\n\n// custom default palette: VT340 (lower 16 colors) + ANSI256 (up to 256) + zeroed (up to 4096)\nconst DEFAULT_PALETTE = PALETTE_ANSI_256;\nDEFAULT_PALETTE.set(PALETTE_VT340_COLOR);\n\n\nexport class SixelHandler implements IDcsHandler, IResetHandler {\n  private _size = 0;\n  private _aborted = false;\n  private _dec: Decoder | undefined;\n\n  constructor(\n    private readonly _opts: IImageAddonOptions,\n    private readonly _storage: SixelImageStorage,\n    private readonly _coreTerminal: ITerminalExt\n  ) {\n    DecoderAsync({\n      memoryLimit: this._opts.pixelLimit * 4,\n      palette: DEFAULT_PALETTE,\n      paletteLimit: this._opts.sixelPaletteLimit\n    }).then(d => this._dec = d);\n  }\n\n  public reset(): void {\n    /**\n     * reset sixel decoder to defaults:\n     * - release all memory\n     * - nullify palette (4096)\n     * - apply default palette (256)\n     */\n    if (this._dec) {\n      this._dec.release();\n      // FIXME: missing interface on decoder to nullify full palette\n      (this._dec as any)._palette.fill(0);\n      this._dec.init(0, DEFAULT_PALETTE, this._opts.sixelPaletteLimit);\n    }\n  }\n\n  public hook(params: IParams): void {\n    this._size = 0;\n    this._aborted = false;\n    if (this._dec) {\n      const fillColor = params.params[1] === 1 ? 0 : extractActiveBg(\n        this._coreTerminal._core._inputHandler._curAttrData,\n        this._coreTerminal._core._themeService?.colors);\n      this._dec.init(fillColor, null, this._opts.sixelPaletteLimit);\n    }\n  }\n\n  public put(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted || !this._dec) {\n      return;\n    }\n    this._size += end - start;\n    if (this._size > this._opts.sixelSizeLimit) {\n      console.warn(`SIXEL: too much data, aborting`);\n      this._aborted = true;\n      this._dec.release();\n      return;\n    }\n    try {\n      this._dec.decode(data, start, end);\n    } catch (e) {\n      console.warn(`SIXEL: error while decoding image - ${e}`);\n      this._aborted = true;\n      this._dec.release();\n    }\n  }\n\n  public unhook(success: boolean): boolean | Promise<boolean> {\n    if (this._aborted || !success || !this._dec) {\n      return true;\n    }\n\n    const width = this._dec.width;\n    const height = this._dec.height;\n\n    // partial fix for https://github.com/jerch/xterm-addon-image/issues/37\n    if (!width || !height) {\n      if (height) {\n        this._storage.advanceCursor(height);\n      }\n      return true;\n    }\n\n    const canvas = ImageRenderer.createCanvas(undefined, width, height);\n    canvas.getContext('2d')?.putImageData(new ImageData(this._dec.data8 as Uint8ClampedArray<ArrayBuffer>, width, height), 0, 0);\n    if (this._dec.memoryUsage > MEM_PERMA_LIMIT) {\n      this._dec.release();\n    }\n    this._storage.addImage(canvas);\n    return true;\n  }\n}\n\n\n/**\n * Some helpers to extract current terminal colors.\n */\n\n// get currently active background color from terminal\n// also respect INVERSE setting\nfunction extractActiveBg(attr: AttributeData, colors: ReadonlyColorSet | undefined): RGBA8888 {\n  let bg = 0;\n  if (!colors) {\n    // FIXME: theme service is prolly not available yet,\n    // happens if .open() was not called yet (bug in core?)\n    return bg;\n  }\n  if (attr.isInverse()) {\n    if (attr.isFgDefault()) {\n      bg = convertLe(colors.foreground.rgba);\n    } else if (attr.isFgRGB()) {\n      const t = (attr.constructor as typeof AttributeData).toColorRGB(attr.getFgColor());\n      bg = toRGBA8888(...t);\n    } else {\n      bg = convertLe(colors.ansi[attr.getFgColor()].rgba);\n    }\n  } else {\n    if (attr.isBgDefault()) {\n      bg = convertLe(colors.background.rgba);\n    } else if (attr.isBgRGB()) {\n      const t = (attr.constructor as typeof AttributeData).toColorRGB(attr.getBgColor());\n      bg = toRGBA8888(...t);\n    } else {\n      bg = convertLe(colors.ansi[attr.getBgColor()].rgba);\n    }\n  }\n  return bg;\n}\n\n// rgba values on the color managers are always in BE, thus convert to LE\nfunction convertLe(color: number): RGBA8888 {\n  if (BIG_ENDIAN) return color;\n  return (color & 0xFF) << 24 | (color >>> 8 & 0xFF) << 16 | (color >>> 16 & 0xFF) << 8 | color >>> 24 & 0xFF;\n}\n","/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { ImageStorage, CELL_SIZE_DEFAULT } from './ImageStorage';\nimport { IImageAddonOptions, ITerminalExt, IAddImageOpts } from './Types';\nimport { ImageRenderer } from './ImageRenderer';\n\n/**\n * Sixel-specific image storage controller.\n *\n * Wraps the shared ImageStorage with sixel protocol semantics:\n * - Cursor behavior governed by DECSET 80 (sixelScrolling option)\n * - advanceCursor for empty sixels carrying only height\n */\nexport class SixelImageStorage {\n  private _addImageOpts: IAddImageOpts = { scrolling: true, layer: 'top', zIndex: 0, cursorPos: 'vt340' };\n  constructor(\n    private readonly _storage: ImageStorage,\n    private readonly _opts: IImageAddonOptions,\n    private readonly _renderer: ImageRenderer,\n    private readonly _terminal: ITerminalExt\n  ) {}\n\n  /**\n   * Add a sixel image to storage.\n   * Cursor behavior depends on the sixelScrolling option (DECSET 80).\n   */\n  public addImage(img: HTMLCanvasElement | ImageBitmap): void {\n    this._addImageOpts.scrolling = this._opts.sixelScrolling;\n    this._storage.addImage(img, this._addImageOpts);\n  }\n\n  /**\n   * Only advance text cursor.\n   * This is an edge case from empty sixels carrying only a height but no pixels.\n   * Partially fixes https://github.com/jerch/xterm-addon-image/issues/37.\n   */\n  public advanceCursor(height: number): void {\n    if (this._opts.sixelScrolling) {\n      let cellSize = this._renderer.cellSize;\n      if (cellSize.width === -1 || cellSize.height === -1) {\n        cellSize = CELL_SIZE_DEFAULT;\n      }\n      const rows = Math.ceil(height / cellSize.height);\n      for (let i = 1; i < rows; ++i) {\n        this._terminal._core._inputHandler.lineFeed();\n      }\n    }\n  }\n}\n","/**\n * Copyright (c) 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IDisposable } from '@xterm/xterm';\nimport { IApcHandler, IImageAddonOptions, IResetHandler, ITerminalExt, ImageLayer } from '../Types';\nimport { ImageRenderer } from '../ImageRenderer';\nimport { CELL_SIZE_DEFAULT } from '../ImageStorage';\nimport { imageType } from '../IIPMetrics';\nimport { KittyImageStorage } from './KittyImageStorage';\nimport Base64Decoder, { type DecodeStatus } from 'xterm-wasm-parts/lib/base64/Base64Decoder.wasm';\nimport {\n  KittyAction,\n  KittyFormat,\n  KittyCompression,\n  IKittyCommand,\n  IPendingTransmission,\n  IKittyImageData,\n  KittyPixelConstants,\n  parseKittyCommand\n} from './KittyGraphicsTypes';\n\nconst enum Constants {\n  // Memory limit for base64 decoder (4MB, same as IIPHandler)\n  DECODER_KEEP_DATA = 4194304,\n  DECODER_INITIAL_DATA = 4194304, // 4MB\n  // Local mirror of const enum (esbuild can't inline const enums from external packages)\n  DECODER_OK = 0,\n  // Maximum control data size\n  MAX_CONTROL_DATA_SIZE = 512,\n  // Semicolon codepoint\n  SEMICOLON = 0x3B\n}\n\nconst DECODER_OK = Constants.DECODER_OK as unknown as DecodeStatus.OK;\n\n// Kitty graphics protocol handler with streaming base64 decoding.\nexport class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDisposable {\n  private _aborted = false;\n  private _generation = 0;\n  private _decodeError = false;\n\n  private _activeDecoder: Base64Decoder | null = null;\n  private readonly _maxEncodedBytes: number;\n  private readonly _initialEncodedBytes: number;\n\n  // Streaming related states\n\n  // True while receiving control data (before semicolon).\n  private _inControlData = true;\n\n  // Buffer for control data.\n  private _controlData = new Uint32Array(Constants.MAX_CONTROL_DATA_SIZE);\n  private _controlLength = 0;\n\n  // Pre-calculated encoded size limit\n  private _encodedSizeLimit = 0;\n  private _totalEncodedSize = 0;\n\n  // Parsed command. These are the control data before semicolon.\n  private _parsedCommand: IKittyCommand | null = null;\n\n  // Storage related states\n\n  private _pendingTransmissions: Map<number, IPendingTransmission> = new Map();\n  // Tracks the pending key of the most recently started chunked upload.\n  // Per spec, subsequent chunks only need m= (and optionally q=), without i=.\n  // When a chunk arrives with no i=, this key is used to find the pending upload.\n  private _lastPendingKey: number | undefined;\n\n  constructor(\n    private readonly _opts: IImageAddonOptions,\n    private readonly _renderer: ImageRenderer,\n    private readonly _kittyStorage: KittyImageStorage,\n    private readonly _coreTerminal: ITerminalExt\n  ) {\n    // Convert decoded size limit -> max encoded bytes.\n    this._maxEncodedBytes = Math.ceil(this._opts.kittySizeLimit * 4 / 3);\n    // ensure we preallocate more than configured limit while using 4mb initial size.\n    this._initialEncodedBytes = Math.min(Constants.DECODER_INITIAL_DATA, this._maxEncodedBytes);\n  }\n\n  public reset(): void {\n    this._generation++;\n    this._cleanupAllPending();\n    if (this._activeDecoder) {\n      this._activeDecoder.release();\n      this._activeDecoder = null;\n    }\n    this._kittyStorage.reset();\n  }\n\n  public dispose(): void {\n    this.reset();\n  }\n\n  private _removePendingEntry(key: number): void {\n    this._pendingTransmissions.delete(key);\n    if (this._lastPendingKey === key) {\n      this._lastPendingKey = undefined;\n    }\n  }\n\n  private _cleanupAllPending(): void {\n    for (const pending of this._pendingTransmissions.values()) {\n      pending.decoder.release();\n    }\n    this._pendingTransmissions.clear();\n    this._lastPendingKey = undefined;\n  }\n\n  public start(): void {\n    this._aborted = false;\n    this._decodeError = false;\n    this._inControlData = true;\n    this._controlLength = 0;\n    this._parsedCommand = null;\n    // Pre-calculate encoded limit once: base64 is 4 bytes encoded → 3 bytes decoded\n    this._encodedSizeLimit = this._maxEncodedBytes;\n    this._totalEncodedSize = 0;\n    this._activeDecoder = null;\n  }\n\n  public put(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted) return;\n\n    if (!this._inControlData) {\n      this._streamPayload(data, start, end);\n    } else {\n      // Scan for semicolon\n      let controlEnd = end;\n      for (let i = start; i < end; i++) {\n        if (data[i] === Constants.SEMICOLON) {\n          this._inControlData = false;\n          controlEnd = i;\n          break;\n        }\n      }\n\n      // Copy control data\n      const copyLength = controlEnd - start;\n      if (this._controlLength + copyLength > Constants.MAX_CONTROL_DATA_SIZE) {\n        this._aborted = true;\n        return;\n      }\n      this._controlData.set(data.subarray(start, controlEnd), this._controlLength);\n      this._controlLength += copyLength;\n\n      if (!this._inControlData) {\n        // Found semicolon - parse control data early for validation\n        this._parsedCommand = parseKittyCommand(this._parseControlDataString());\n\n        // Early validation: i+I conflict\n        if (this._parsedCommand.id !== undefined && this._parsedCommand.imageNumber !== undefined) {\n          this._sendResponse(this._parsedCommand.id, 'EINVAL:cannot specify both i and I keys', this._parsedCommand.quiet ?? 0);\n          this._aborted = true;\n          return;\n        }\n\n        // Delete action doesn't need payload - skip streaming\n        if (this._parsedCommand.action === KittyAction.DELETE) {\n          return;\n        }\n\n        // Stream remaining as payload\n        const payloadStart = controlEnd + 1;\n        if (payloadStart < end) {\n          this._streamPayload(data, payloadStart, end);\n        }\n      }\n    }\n  }\n\n  // Stream payload bytes into the base64 decoder.\n  private _streamPayload(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted) return;\n\n    // Check size limit (compare encoded bytes against pre-calculated limit)\n    // Include cumulative size from pending transmission for multi-chunk images.\n    // Per spec, subsequent chunks may omit i=, so fall back to _lastPendingKey.\n    const pendingKey = this._parsedCommand?.id ?? this._lastPendingKey ?? 0;\n    const pending = this._pendingTransmissions.get(pendingKey);\n    const previousEncodedSize = pending?.totalEncodedSize ?? 0;\n    this._totalEncodedSize += end - start;\n    const cumulativeEncodedSize = previousEncodedSize + this._totalEncodedSize;\n    if (cumulativeEncodedSize > this._encodedSizeLimit) {\n      const decoderToRelease = this._activeDecoder ?? pending?.decoder;\n      if (decoderToRelease) {\n        decoderToRelease.release();\n      }\n      this._activeDecoder = null;\n      if (pending) {\n        this._removePendingEntry(pendingKey);\n      }\n      this._aborted = true;\n      return;\n    }\n\n    if (this._decodeError) return;\n\n    if (pending?.decoder && !this._activeDecoder) {\n      this._activeDecoder = pending.decoder;\n    }\n    if (!this._activeDecoder) {\n      // Budget WASM capacity, including one page of decoder state and rounding.\n      const decoderCapacity = this._maxEncodedBytes + 131072;\n      if (decoderCapacity > this._opts.storageLimit * 1000000) {\n        this._aborted = true;\n        if (this._parsedCommand?.id !== undefined) {\n          this._sendResponse(this._parsedCommand.id, 'ENOMEM:pending image budget exceeded', this._parsedCommand.quiet ?? 0);\n        }\n        return;\n      }\n      const maxPending = Math.max(1, Math.floor(this._opts.storageLimit * 1000000 / decoderCapacity));\n      while (this._pendingTransmissions.size >= maxPending) {\n        const oldest = this._pendingTransmissions.entries().next().value;\n        if (!oldest) break;\n        oldest[1].decoder.release();\n        this._removePendingEntry(oldest[0]);\n        if (oldest[1].cmd.id !== undefined) {\n          this._sendResponse(oldest[1].cmd.id, 'ENOMEM:pending image budget exceeded', oldest[1].cmd.quiet ?? 0);\n        }\n      }\n      this._activeDecoder = new Base64Decoder(Constants.DECODER_KEEP_DATA, this._maxEncodedBytes, this._initialEncodedBytes);\n      this._activeDecoder.init();\n    }\n\n    if (this._activeDecoder.put(data.subarray(start, end)) !== DECODER_OK) {\n      this._activeDecoder.release();\n      this._activeDecoder = null;\n      this._decodeError = true;\n      if (pending) {\n        this._removePendingEntry(pendingKey);\n      }\n    }\n  }\n\n  public end(success: boolean): boolean | Promise<boolean> {\n    if (this._aborted || !success) {\n      if (this._activeDecoder) {\n        this._activeDecoder.release();\n        this._activeDecoder = null;\n      }\n      return true;\n    }\n\n    // No semicolon = no payload (delete, capability query)\n    if (this._inControlData) {\n      return this._handleNoPayloadCommand();\n    }\n\n    // Use command parsed early in put() - i+I already validated there\n    const cmd = this._parsedCommand!;\n\n    // Delete action was handled by skipping payload - just execute\n    if (cmd.action === KittyAction.DELETE) {\n      return this._handleDelete(cmd);\n    }\n\n    // Per spec, subsequent chunks may omit i=, so fall back to _lastPendingKey.\n    const pendingKey = cmd.id ?? this._lastPendingKey ?? 0;\n    const isMoreComing = cmd.more === 1;\n    const pending = this._pendingTransmissions.get(pendingKey);\n\n    if (isMoreComing) {\n      if (this._activeDecoder) {\n        if (pending) {\n          pending.totalEncodedSize += this._totalEncodedSize;\n          pending.decodeError = pending.decodeError || this._decodeError;\n        } else {\n          this._pendingTransmissions.set(pendingKey, {\n            cmd: { ...cmd },\n            decoder: this._activeDecoder,\n            totalEncodedSize: this._totalEncodedSize,\n            decodeError: this._decodeError\n          });\n        }\n        this._lastPendingKey = pendingKey;\n        this._activeDecoder = null;\n      }\n      return true;\n    }\n\n    // Final chunk received — clear the last pending key\n    if (pending) {\n      this._lastPendingKey = undefined;\n    }\n\n    let decodeError = this._decodeError;\n    let finalCmd = cmd;\n    let decoder = this._activeDecoder;\n\n    if (pending) {\n      finalCmd = pending.cmd;\n      decoder = pending.decoder;\n      decodeError = decodeError || pending.decodeError;\n      this._pendingTransmissions.delete(pendingKey);\n    }\n\n    let imageBytes = new Uint8Array(0);\n    if (decoder) {\n      if (decoder.end() !== DECODER_OK) {\n        decodeError = true;\n      }\n      imageBytes = decoder.data8;\n    }\n    this._activeDecoder = null;\n\n    // Handle command first — handlers create Blob/ImageData from imageBytes,\n    // which copies the data. Only then is it safe to release the decoder's\n    // wasm memory that imageBytes points into.\n    const result = this._handleCommandWithBytesAndCmd(finalCmd, imageBytes, decodeError);\n    if (decoder) {\n      decoder.release();\n    }\n    return result;\n  }\n\n  // Command handling\n\n  private _parseControlDataString(): string {\n    let str = '';\n    for (let i = 0; i < this._controlLength; i++) {\n      str += String.fromCodePoint(this._controlData[i]);\n    }\n    return str;\n  }\n\n  private _handleNoPayloadCommand(): boolean | Promise<boolean> {\n    const cmd = parseKittyCommand(this._parseControlDataString());\n\n    // Per spec: specifying both i and I is an error\n    if (cmd.id !== undefined && cmd.imageNumber !== undefined) {\n      this._sendResponse(cmd.id, 'EINVAL:cannot specify both i and I keys', cmd.quiet ?? 0);\n      return true;\n    }\n\n    const action = cmd.action ?? 't';\n\n    switch (action) {\n      case KittyAction.DELETE:\n        return this._handleDelete(cmd);\n      case KittyAction.QUERY:\n        this._sendResponse(cmd.id ?? 0, 'OK', cmd.quiet ?? 0);\n        return true;\n      case KittyAction.PLACEMENT:\n        return this._handlePlacement(cmd);\n      default:\n        // TODO: Implement remaining actions when needed:\n        // - a=f (frame): animation frame operations\n        // - a=a (animation): animation control\n        // - a=c (compose): compose images\n        if (cmd.id !== undefined) {\n          this._sendResponse(cmd.id, 'EINVAL:unsupported action', cmd.quiet ?? 0);\n        }\n        return true;\n    }\n  }\n\n  private _handleCommandWithBytesAndCmd(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean | Promise<boolean> {\n    const action = cmd.action ?? 't';\n\n    switch (action) {\n      case KittyAction.TRANSMIT: {\n        const result = this._handleTransmit(cmd, bytes, decodeError);\n        // Only send response when _handleTransmit didn't already respond\n        // (it handles unsupported transmission medium responses internally)\n        if ((cmd.transmission ?? 'd') === 'd' && cmd.id !== undefined) {\n          if (decodeError) {\n            this._sendResponse(cmd.id, 'EINVAL:invalid base64 data', cmd.quiet ?? 0);\n          } else if (bytes.length > 0) {\n            this._sendResponse(cmd.id, 'OK', cmd.quiet ?? 0);\n          }\n        }\n        return result;\n      }\n      case KittyAction.TRANSMIT_DISPLAY:\n        return this._handleTransmitDisplay(cmd, bytes, decodeError);\n      case KittyAction.QUERY:\n        return this._handleQuery(cmd, bytes, decodeError);\n      case KittyAction.PLACEMENT:\n        // a=p ignores any payload — image data was already transmitted\n        return this._handlePlacement(cmd);\n      default:\n        // TODO: Implement remaining actions when needed:\n        // - a=f (frame): animation frame operations\n        // - a=a (animation): animation control\n        // - a=c (compose): compose images\n        if (cmd.id !== undefined) {\n          this._sendResponse(cmd.id, 'EINVAL:unsupported action', cmd.quiet ?? 0);\n        }\n        return true;\n    }\n  }\n\n  private _handlePlacement(cmd: IKittyCommand): boolean | Promise<boolean> {\n    if (cmd.id === undefined) {\n      return true;\n    }\n    const id = cmd.id;\n    const image = this._kittyStorage.getImage(id);\n    if (!image) {\n      this._sendResponse(id, 'ENOENT:image not found', cmd.quiet ?? 0, cmd.placementId);\n      return true;\n    }\n    const result = this._displayImage(image, cmd);\n    return result.then(success => {\n      this._sendResponse(id, success ? 'OK' : 'EINVAL:image rendering failed', cmd.quiet ?? 0, cmd.placementId);\n      return true;\n    });\n  }\n\n  private _handleTransmit(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean {\n    // TODO: Support file-based transmission modes (t=f, t=t, t=s)\n    // Currently only supports direct transmission (t=d, the default).\n    // - t=f (file): Payload is base64-encoded file path. Terminal reads image from that path.\n    // - t=t (temp file): Payload is base64-encoded path in temp directory. Terminal reads, deletes.\n    // - t=s: Payload is base64-encoded POSIX shm name. Terminal reads from shared memory.\n    // These modes require filesystem/IPC access not available in browsers. For Node.js/Electron:\n    // 1. Check cmd.transmission (t key) before treating bytes as image data\n    // 2. For t=f/t/s: decode bytes as UTF-8 string (the path/name), then read file contents\n    // 3. For t=d: treat bytes as image data (current behavior)\n    // When implementing, also update _handleQuery to accept these transmission mediums.\n    const transmission = cmd.transmission ?? 'd';\n    if (transmission !== 'd') {\n      if (cmd.id !== undefined) {\n        this._sendResponse(cmd.id, 'EINVAL:unsupported transmission medium', cmd.quiet ?? 0);\n      }\n      return true;\n    }\n\n    if (decodeError || bytes.length === 0) return true;\n\n    this._kittyStorage.storeImage(cmd.id, {\n      data: new Blob([bytes as BlobPart]),\n      width: cmd.width ?? 0,\n      height: cmd.height ?? 0,\n      format: (cmd.format ?? KittyFormat.RGBA) as 24 | 32 | 100,\n      compression: cmd.compression ?? ''\n    });\n    return true;\n  }\n\n  private _handleTransmitDisplay(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean | Promise<boolean> {\n    if (decodeError) {\n      if (cmd.id !== undefined) {\n        this._sendResponse(cmd.id, 'EINVAL:invalid base64 data', cmd.quiet ?? 0);\n      }\n      return true;\n    }\n\n    this._handleTransmit(cmd, bytes, decodeError);\n\n    const id = cmd.id ?? this._kittyStorage.lastImageId;\n    const image = this._kittyStorage.getImage(id);\n    if (image) {\n      const result = this._displayImage(image, cmd);\n      if (cmd.id !== undefined) {\n        return result.then(success => {\n          this._sendResponse(id, success ? 'OK' : 'EINVAL:image rendering failed', cmd.quiet ?? 0);\n          return true;\n        });\n      }\n      return result.then(() => true);\n    }\n    return true;\n  }\n\n  private _handleQuery(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean {\n    const id = cmd.id ?? 0;\n    const quiet = cmd.quiet ?? 0;\n\n    // Per spec: reject unsupported transmission mediums (only t=d is supported atm)\n    // TODO: When filesystem support is added (Node.js/Electron), update this to accept\n    // t=f (file), t=t (temp file), and t=s (shared memory) and respond OK for queries.\n    const transmission = cmd.transmission ?? 'd';\n    if (transmission !== 'd') {\n      this._sendResponse(id, 'EINVAL:unsupported transmission medium', quiet);\n      return true;\n    }\n\n    // Check decode error first (invalid base64)\n    if (decodeError) {\n      this._sendResponse(id, 'EINVAL:invalid base64 data', quiet);\n      return true;\n    }\n\n    // Capability query (no payload) - just respond OK\n    if (bytes.length === 0) {\n      this._sendResponse(id, 'OK', quiet);\n      return true;\n    }\n\n    const format = cmd.format ?? KittyFormat.RGBA;\n\n    if (format === KittyFormat.PNG) {\n      this._sendResponse(id, 'OK', quiet);\n    } else {\n      const width = cmd.width ?? 0;\n      const height = cmd.height ?? 0;\n\n      if (!width || !height) {\n        this._sendResponse(id, 'EINVAL:width and height required for raw pixel data', quiet);\n        return true;\n      }\n\n      const bytesPerPixel = format === KittyFormat.RGBA ? KittyPixelConstants.BYTES_PER_PIXEL_RGBA : KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n      const expectedBytes = width * height * bytesPerPixel;\n\n      if (bytes.length < expectedBytes) {\n        this._sendResponse(id, `EINVAL:insufficient pixel data`, quiet);\n        return true;\n      }\n\n      this._sendResponse(id, 'OK', quiet);\n    }\n    return true;\n  }\n\n  private _handleDelete(cmd: IKittyCommand): boolean {\n    // Per spec: default delete selector is 'a' (delete all visible placements)\n    const selector = cmd.deleteSelector ?? 'a';\n\n    // TODO: Distinguish lowercase (delete placements only) from uppercase\n    // (delete placements + free stored image data). Currently both variants\n    // free everything since we don't separate stored data from placements.\n    switch (selector) {\n      case 'a':\n      case 'A':\n        this._cleanupAllPending();\n        this._kittyStorage.deleteAll();\n        break;\n      case 'i':\n      case 'I':\n        // TODO: When placement id tracking is implemented (see TODO in\n        // KittyImageStorage), d=i with p=<pid> should delete only that\n        // specific placement, while d=i without p should delete all\n        // placements for the image.\n        if (cmd.id !== undefined) {\n          const pending = this._pendingTransmissions.get(cmd.id);\n          if (pending) {\n            pending.decoder.release();\n          }\n          this._removePendingEntry(cmd.id);\n          this._kittyStorage.deleteById(cmd.id);\n        }\n        break;\n      default:\n        // Unsupported selectors (c, n, p, q, r, x, y, z, f) — ignore for now\n        break;\n    }\n    return true;\n  }\n\n  private _sendResponse(id: number, message: string, quiet: number, placementId?: number): void {\n    const isOk = message === 'OK';\n    if (isOk && quiet >= 1) return;\n    if (!isOk && quiet >= 2) return;\n\n    const pPart = placementId ? `,p=${placementId}` : '';\n    const response = `\\x1b_Gi=${id}${pPart};${message}\\x1b\\\\`;\n    this._coreTerminal._core.coreService.triggerDataEvent(response);\n  }\n\n  // Image display\n\n  private _displayImage(image: IKittyImageData, cmd: IKittyCommand): Promise<boolean> {\n    return this._decodeAndDisplay(image, cmd)\n      .then(() => true)\n      .catch(() => false);\n  }\n\n  private async _decodeAndDisplay(image: IKittyImageData, cmd: IKittyCommand): Promise<void> {\n    const generation = this._generation;\n    let bitmap: ImageBitmap | undefined = await this._createBitmap(image);\n\n    try {\n      if (generation !== this._generation) throw new Error('image decode canceled');\n      const cropX = Math.max(0, cmd.x ?? 0);\n      const cropY = Math.max(0, cmd.y ?? 0);\n      const cropW = cmd.sourceWidth || (bitmap.width - cropX);\n      const cropH = cmd.sourceHeight || (bitmap.height - cropY);\n\n      const maxCropW = Math.max(0, bitmap.width - cropX);\n      const maxCropH = Math.max(0, bitmap.height - cropY);\n      const finalCropW = Math.max(0, Math.min(cropW, maxCropW));\n      const finalCropH = Math.max(0, Math.min(cropH, maxCropH));\n\n      if (finalCropW === 0 || finalCropH === 0) {\n        throw new Error('invalid source rectangle');\n      }\n\n      if (cropX !== 0 || cropY !== 0 || finalCropW !== bitmap.width || finalCropH !== bitmap.height) {\n        const cropped = await createImageBitmap(bitmap, cropX, cropY, finalCropW, finalCropH);\n        bitmap.close();\n        bitmap = cropped;\n      }\n\n      const cw = this._renderer.dimensions?.css.cell.width || CELL_SIZE_DEFAULT.width;\n      const ch = this._renderer.dimensions?.css.cell.height || CELL_SIZE_DEFAULT.height;\n\n      // Per spec: c/r default to image's natural cell dimensions.\n      // If only one of c/r is specified, compute the other from image aspect ratio.\n      let imgCols: number;\n      let imgRows: number;\n      if (cmd.columns !== undefined && cmd.rows !== undefined) {\n        imgCols = cmd.columns;\n        imgRows = cmd.rows;\n      } else if (cmd.columns !== undefined) {\n        imgCols = cmd.columns;\n        imgRows = Math.max(1, Math.ceil((bitmap.height / bitmap.width) * (imgCols * cw) / ch));\n      } else if (cmd.rows !== undefined) {\n        imgRows = cmd.rows;\n        imgCols = Math.max(1, Math.ceil((bitmap.width / bitmap.height) * (imgRows * ch) / cw));\n      } else {\n        imgCols = Math.ceil(bitmap.width / cw);\n        imgRows = Math.ceil(bitmap.height / ch);\n      }\n\n      let w = bitmap.width;\n      let h = bitmap.height;\n\n      // Scale bitmap to fit placement rectangle when c/r are specified\n      if (cmd.columns !== undefined || cmd.rows !== undefined) {\n        w = Math.round(imgCols * cw);\n        h = Math.round(imgRows * ch);\n      }\n\n      if (w * h > this._opts.pixelLimit) {\n        throw new Error('image exceeds pixel limit');\n      }\n\n      // Save cursor position before addImage modifies it\n      const buffer = this._coreTerminal._core.buffer;\n      const savedX = buffer.x;\n      const savedY = buffer.y;\n      const savedYbase = buffer.ybase;\n\n      // Determine layer based on z-index: negative = behind text, 0+ = on top.\n      // When z<0 we always use the bottom layer even without allowTransparency —\n      // the image will simply be hidden behind the opaque text background, which\n      // is the correct behavior (client asked for \"behind text\").\n      const wantsBottom = cmd.zIndex !== undefined && cmd.zIndex < 0;\n      const layer: ImageLayer = wantsBottom ? 'bottom' : 'top';\n\n      if (w !== bitmap.width || h !== bitmap.height) {\n        const scaled = await createImageBitmap(bitmap, { resizeWidth: w, resizeHeight: h });\n        bitmap.close();\n        bitmap = scaled;\n      }\n\n      // Per spec: X/Y are pixel offsets within the first cell, so clamp to cell dimensions\n      const xOffset = Math.min(Math.max(0, cmd.xOffset ?? 0), cw - 1);\n      const yOffset = Math.min(Math.max(0, cmd.yOffset ?? 0), ch - 1);\n      if (xOffset !== 0 || yOffset !== 0) {\n        // Per spec: X/Y is not added to c/r area. When c/r are explicit, the\n        // total placement area remains c*cw × r*ch pixels and the offset image\n        // is clipped to fit. When c/r are unset, the padded canvas determines\n        // the natural cell dimensions.\n        const canvasW = (cmd.columns !== undefined) ? Math.round(imgCols * cw) : bitmap.width + xOffset;\n        const canvasH = (cmd.rows !== undefined) ? Math.round(imgRows * ch) : bitmap.height + yOffset;\n        const offsetCanvas = ImageRenderer.createCanvas(window.document, canvasW, canvasH);\n        const offsetCtx = offsetCanvas.getContext('2d');\n        if (!offsetCtx) {\n          throw new Error('Failed to create offset canvas context');\n        }\n        offsetCtx.drawImage(bitmap, xOffset, yOffset);\n\n        const offsetBitmap = await createImageBitmap(offsetCanvas);\n        offsetCanvas.width = offsetCanvas.height = 0;\n        bitmap.close();\n        bitmap = offsetBitmap;\n        w = bitmap.width;\n        h = bitmap.height;\n        if (w * h > this._opts.pixelLimit) {\n          throw new Error('image exceeds pixel limit');\n        }\n        if (cmd.columns === undefined) {\n          imgCols = Math.ceil(bitmap.width / cw);\n        }\n        if (cmd.rows === undefined) {\n          imgRows = Math.ceil(bitmap.height / ch);\n        }\n      }\n\n      if (generation !== this._generation) throw new Error('image decode canceled');\n      const zIndex = cmd.zIndex ?? 0;\n      this._kittyStorage.addImage(image.id, bitmap, true, layer, zIndex);\n      bitmap = undefined;  // ownership transferred to storage\n\n      // Kitty cursor movement\n      // Per spec: cursor placed at first column after last image column,\n      // on the last row of the image. C=1 means don't move cursor.\n      if (cmd.cursorMovement === 1) {\n        // C=1: restore cursor to position before image was placed\n        const scrolled = buffer.ybase - savedYbase;\n        buffer.x = savedX;\n        // Can't restore cursor to scrollback?\n        buffer.y = Math.max(savedY - scrolled, 0);\n      } else {\n        // Default (C=0): advance cursor horizontally past the image\n        // addImage already positioned cursor on the last row via lineFeeds\n        buffer.x = Math.min(savedX + imgCols, this._coreTerminal.cols);\n      }\n    } catch (e) {\n      bitmap?.close();\n      throw e;\n    }\n  }\n\n  // Create ImageBitmap from already-decoded image data.\n  private async _createBitmap(image: IKittyImageData): Promise<ImageBitmap> {\n    let bytes: Uint8Array = new Uint8Array(await image.data.arrayBuffer());\n\n    if (image.compression === KittyCompression.ZLIB) {\n      bytes = await this._decompressZlib(bytes);\n    }\n\n    if (image.format === KittyFormat.PNG) {\n      const metrics = imageType(bytes);\n      // IHDR dimensions are parsed with signed shifts, so a value >= 0x80000000 comes\n      // back negative and a bare `>` pixel-limit test passes it; require positive.\n      if (metrics.mime !== 'image/png' || !(metrics.width > 0) || !(metrics.height > 0) || metrics.width * metrics.height > this._opts.pixelLimit) {\n        throw new RangeError('PNG exceeds pixel limit or has invalid dimensions');\n      }\n      const blob = new Blob([bytes as BlobPart], { type: 'image/png' });\n      if (!window.createImageBitmap) {\n        const url = URL.createObjectURL(blob);\n        const img = new Image();\n        return new Promise<ImageBitmap>((resolve, reject) => {\n          img.addEventListener('load', () => {\n            URL.revokeObjectURL(url);\n            const canvas = ImageRenderer.createCanvas(window.document, img.width, img.height);\n            canvas.getContext('2d')?.drawImage(img, 0, 0);\n            createImageBitmap(canvas).then(resolve).catch(reject);\n          });\n          img.addEventListener('error', () => {\n            URL.revokeObjectURL(url);\n            reject(new Error('Failed to load image'));\n          });\n          img.src = url;\n        });\n      }\n      return createImageBitmap(blob);\n    }\n\n    // Raw pixel data\n    const width = image.width;\n    const height = image.height;\n\n    if (!width || !height) {\n      throw new Error('Width and height required for raw pixel data');\n    }\n\n    const bytesPerPixel = image.format === KittyFormat.RGBA ? KittyPixelConstants.BYTES_PER_PIXEL_RGBA : KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n    const expectedBytes = width * height * bytesPerPixel;\n\n    if (bytes.length < expectedBytes) {\n      throw new Error('Insufficient pixel data');\n    }\n\n    const pixelCount = width * height;\n\n    if (image.format === KittyFormat.RGBA) {\n      // RGBA: use bytes directly — no copy needed\n      return createImageBitmap(new ImageData(new Uint8ClampedArray(bytes.buffer as ArrayBuffer, bytes.byteOffset, pixelCount * KittyPixelConstants.BYTES_PER_PIXEL_RGBA), width, height));\n    }\n\n    // RGB→RGBA: interleave alpha using uint32 block processing (4 pixels per iteration).\n    // 3 uint32 reads + 4 uint32 writes per 4 pixels vs 28 byte reads/writes — ~6x faster.\n    // Assumes little-endian (all modern browsers/Node.js).\n    const data = new Uint8ClampedArray(pixelCount * KittyPixelConstants.BYTES_PER_PIXEL_RGBA);\n    const src32 = new Uint32Array(bytes.buffer, bytes.byteOffset, Math.floor(bytes.byteLength / 4));\n    const dst32 = new Uint32Array(data.buffer);\n    const alignedPixels = pixelCount & ~3;  // round down to multiple of 4\n\n    let srcOffset = 0;\n    let dstOffset = 0;\n    for (let i = 0; i < alignedPixels; i += 4) {\n      const b0 = src32[srcOffset++];\n      const b1 = src32[srcOffset++];\n      const b2 = src32[srcOffset++];\n      // Little-endian: pixel bytes are [R,G,B] → uint32 ABGR layout\n      dst32[dstOffset++] = 0xFF000000 | b0;\n      dst32[dstOffset++] = 0xFF000000 | (b0 >>> 24) | (b1 << 8);\n      dst32[dstOffset++] = 0xFF000000 | (b1 >>> 16) | (b2 << 16);\n      dst32[dstOffset++] = 0xFF000000 | (b2 >>> 8);\n    }\n\n    // Handle remaining 1–3 pixels\n    let srcByte = alignedPixels * KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n    let dstByte = alignedPixels * KittyPixelConstants.BYTES_PER_PIXEL_RGBA;\n    for (let i = alignedPixels; i < pixelCount; i++) {\n      data[dstByte]     = bytes[srcByte];\n      data[dstByte + 1] = bytes[srcByte + 1];\n      data[dstByte + 2] = bytes[srcByte + 2];\n      data[dstByte + 3] = KittyPixelConstants.ALPHA_OPAQUE;\n      srcByte += KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n      dstByte += KittyPixelConstants.BYTES_PER_PIXEL_RGBA;\n    }\n\n    return createImageBitmap(new ImageData(data, width, height));\n  }\n\n  private async _decompressZlib(compressed: Uint8Array): Promise<Uint8Array> {\n    try {\n      return await this._decompress(compressed, 'deflate');\n    } catch (error) {\n      if (error instanceof RangeError) throw error;\n      return await this._decompress(compressed, 'deflate-raw');\n    }\n  }\n\n  private async _decompress(compressed: Uint8Array, format: 'deflate' | 'deflate-raw'): Promise<Uint8Array> {\n    const limit = Math.min(this._opts.kittySizeLimit, this._opts.pixelLimit * 4, this._opts.storageLimit * 1000000);\n    let offsetIn = 0;\n    // Bound inflation within one native transform before its output is budgeted.\n    const source = new ReadableStream<BufferSource>({\n      pull(controller) {\n        if (offsetIn >= compressed.length) {\n          controller.close();\n          return;\n        }\n        const end = Math.min(offsetIn + 4096, compressed.length);\n        controller.enqueue(new Uint8Array(compressed.subarray(offsetIn, end)));\n        offsetIn = end;\n      }\n    });\n    const reader = source.pipeThrough(new DecompressionStream(format)).getReader();\n    const chunks: Uint8Array[] = [];\n    let totalLength = 0;\n    try {\n      while (true) {\n        const { done, value } = await reader.read();\n        if (done) break;\n        totalLength += value.byteLength;\n        if (totalLength > limit) {\n          await reader.cancel().catch(() => {});\n          throw new RangeError('decompressed image exceeds byte limit');\n        }\n        chunks.push(value);\n      }\n    } finally {\n      reader.releaseLock();\n    }\n\n    const result = new Uint8Array(totalLength);\n    let offset = 0;\n    for (const chunk of chunks) {\n      result.set(chunk, offset);\n      offset += chunk.length;\n    }\n    return result;\n  }\n\n  public get images(): ReadonlyMap<number, IKittyImageData> {\n    return this._kittyStorage.images;\n  }\n\n  public get _kittyIdToStorageId(): ReadonlyMap<number, number> {\n    return this._kittyStorage.kittyIdToStorageId;\n  }\n\n  public get pendingTransmissions(): ReadonlyMap<number, IPendingTransmission> {\n    return this._pendingTransmissions;\n  }\n}\n","/**\n * Copyright (c) 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n *\n * Kitty graphics protocol types, constants, and parsing utilities.\n */\n\nimport type Base64Decoder from 'xterm-wasm-parts/lib/base64/Base64Decoder.wasm';\n\n// Kitty graphics protocol action types.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference under key 'a'.\nexport const enum KittyAction {\n  TRANSMIT = 't',\n  TRANSMIT_DISPLAY = 'T',\n  QUERY = 'q',\n  PLACEMENT = 'p',\n  DELETE = 'd'\n}\n\n// Kitty graphics protocol format types.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference\nexport const enum KittyFormat {\n  RGB = 24,\n  RGBA = 32,\n  PNG = 100\n}\n\n// Kitty graphics protocol compression types.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference under key 'o'.\nexport const enum KittyCompression {\n  NONE = '',\n  ZLIB = 'z'\n}\n\n// Kitty graphics protocol control data keys.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference\nexport const enum KittyKey {\n  // Action to perform (t=transmit, T=transmit+display, q=query, p=placement, d=delete)\n  ACTION = 'a',\n  // Image format (24=RGB, 32=RGBA, 100=PNG)\n  FORMAT = 'f',\n  // Image ID for referencing stored images\n  ID = 'i',\n  // Image number (alternative to ID, terminal assigns ID)\n  IMAGE_NUMBER = 'I',\n  // Source image width in pixels\n  WIDTH = 's',\n  // Source image height in pixels\n  HEIGHT = 'v',\n  // The left edge (in pixels) of the image area to display\n  X_OFFSET = 'x',\n  // The top edge (in pixels) of the image area to display\n  Y_OFFSET = 'y',\n  // Width (in pixels) of the source rectangle to display\n  SOURCE_WIDTH = 'w',\n  // Height (in pixels) of the source rectangle to display\n  SOURCE_HEIGHT = 'h',\n  // Horizontal offset (in pixels) within the first cell\n  X_PLACEMENT_OFFSET = 'X',\n  // Vertical offset (in pixels) within the first cell\n  Y_PLACEMENT_OFFSET = 'Y',\n  // Number of terminal columns to display the image over\n  COLUMNS = 'c',\n  // Number of terminal rows to display the image over\n  ROWS = 'r',\n  // More data flag (1=more chunks coming, 0=final chunk)\n  MORE = 'm',\n  // Compression type (z=zlib). This is essential for chunking larger images.\n  COMPRESSION = 'o',\n  // Quiet mode (1=suppress OK responses, 2=suppress error responses)\n  QUIET = 'q',\n  // Cursor movement policy (0=move cursor after image, 1=don't move cursor)\n  CURSOR_MOVEMENT = 'C',\n  // Z-index for image layering (negative = behind text, 0+ = on top)\n  Z_INDEX = 'z',\n  // Transmission medium (d=direct, f=file, t=temp file, s=shared memory)\n  TRANSMISSION = 't',\n  // Delete selector (a/A=all, i/I=by id, c/C=at cursor, etc.) — only used when a=d\n  DELETE_SELECTOR = 'd',\n  // Placement ID for targeting specific placements\n  PLACEMENT_ID = 'p'\n}\n\n// Pixel format constants\nexport const enum KittyPixelConstants {\n  BYTES_PER_PIXEL_RGB = 3,\n  BYTES_PER_PIXEL_RGBA = 4,\n  ALPHA_OPAQUE = 255\n}\n\n// Parsed Kitty graphics command.\nexport interface IKittyCommand {\n  action?: string;\n  format?: number;\n  id?: number;\n  imageNumber?: number;\n  width?: number;\n  height?: number;\n  x?: number;\n  y?: number;\n  sourceWidth?: number;\n  sourceHeight?: number;\n  xOffset?: number;\n  yOffset?: number;\n  columns?: number;\n  rows?: number;\n  more?: number;\n  quiet?: number;\n  cursorMovement?: number;\n  zIndex?: number;\n  transmission?: string;\n  deleteSelector?: string;\n  placementId?: number;\n  compression?: string;\n  payload?: string;\n}\n\n// Pending chunked transmission state.\n// Stores metadata from the first chunk while accumulating decoded payload data.\nexport interface IPendingTransmission {\n  // The parsed command from the first chunk (contains action, format, dimensions, etc.)\n  cmd: IKittyCommand;\n  // Decoder used across chunked payloads\n  decoder: Base64Decoder;\n  // Total encoded (base64) bytes received across all chunks - for size limit enforcement\n  totalEncodedSize: number;\n  // Whether any chunk has failed to decode\n  decodeError: boolean;\n}\n\n// Stored Kitty image data.\nexport interface IKittyImageData {\n  id: number;\n  // Decoded image data stored as Blob (off JS heap) to avoid 2GB heap limit\n  data: Blob;\n  width: number;\n  height: number;\n  format: 24 | 32 | 100;\n  compression?: string;\n}\n\n// Parses Kitty graphics control data into a command object.\nexport function parseKittyCommand(data: string): IKittyCommand {\n  const cmd: IKittyCommand = {};\n  const parts = data.split(',');\n\n  for (const part of parts) {\n    const eqIdx = part.indexOf('=');\n    if (eqIdx === -1) continue;\n\n    const key = part.substring(0, eqIdx);\n    const value = part.substring(eqIdx + 1);\n\n    // Handle string keys first\n    if (key === KittyKey.ACTION) {\n      cmd.action = value;\n      continue;\n    }\n    if (key === KittyKey.COMPRESSION) {\n      cmd.compression = value;\n      continue;\n    }\n    if (key === KittyKey.TRANSMISSION) {\n      cmd.transmission = value;\n      continue;\n    }\n    if (key === KittyKey.DELETE_SELECTOR) {\n      cmd.deleteSelector = value;\n      continue;\n    }\n    const numValue = parseInt(value, 10);\n    switch (key) {\n      case KittyKey.FORMAT: cmd.format = numValue; break;\n      case KittyKey.ID: cmd.id = numValue; break;\n      case KittyKey.IMAGE_NUMBER: cmd.imageNumber = numValue; break;\n      case KittyKey.WIDTH: cmd.width = numValue; break;\n      case KittyKey.HEIGHT: cmd.height = numValue; break;\n      case KittyKey.X_OFFSET: cmd.x = numValue; break;\n      case KittyKey.Y_OFFSET: cmd.y = numValue; break;\n      case KittyKey.SOURCE_WIDTH: cmd.sourceWidth = numValue; break;\n      case KittyKey.SOURCE_HEIGHT: cmd.sourceHeight = numValue; break;\n      case KittyKey.X_PLACEMENT_OFFSET: cmd.xOffset = numValue; break;\n      case KittyKey.Y_PLACEMENT_OFFSET: cmd.yOffset = numValue; break;\n      case KittyKey.COLUMNS: cmd.columns = numValue; break;\n      case KittyKey.ROWS: cmd.rows = numValue; break;\n      case KittyKey.MORE: cmd.more = numValue; break;\n      case KittyKey.QUIET: cmd.quiet = numValue; break;\n      case KittyKey.CURSOR_MOVEMENT: cmd.cursorMovement = numValue; break;\n      case KittyKey.Z_INDEX: cmd.zIndex = numValue; break;\n      case KittyKey.PLACEMENT_ID: cmd.placementId = numValue; break;\n    }\n  }\n\n  return cmd;\n}\n","/**\n * Copyright (c) 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IDisposable } from '@xterm/xterm';\nimport { ImageStorage } from '../ImageStorage';\nimport { ImageLayer, IAddImageOpts } from '../Types';\nimport { IKittyImageData } from './KittyGraphicsTypes';\n\n// Kitty-specific image storage controller.\n//\n// Wraps shared ImageStorage with kitty protocol semantics:\n// - tracks transmitted image payloads by kitty image id\n// - tracks kitty image id -> shared ImageStorage id mapping for displayed images\n// - mirrors shared-storage evictions into kitty maps\n// - applies protocol-level undisplayed-image eviction policy\nexport class KittyImageStorage implements IDisposable {\n  private static readonly _maxStoredImages = 256;\n\n  private _nextImageId = 1;\n  private readonly _images: Map<number, IKittyImageData> = new Map();\n  // TODO: Support multiple placements per image. The kitty spec identifies\n  // placements by an (image id, placement id) pair — same i + different p\n  // values should coexist, and same i + same p should replace the prior\n  // placement. Currently we track only one storage entry per kitty image id,\n  // so multiple placements of the same image overwrite each other. Fixing\n  // this requires changing these maps to Map<number, Map<number, number>>\n  // (kittyId → placementId → storageId) and updating addImage/deleteById\n  // accordingly. The underlying shared ImageStorage would also need to\n  // support multiple entries per logical image.\n  private readonly _kittyIdToStorageId: Map<number, number> = new Map();\n  private readonly _storageIdToKittyId: Map<number, number> = new Map();\n\n  private readonly _previousOnImageDeleted: ((storageId: number) => void) | undefined;\n  private readonly _wrappedOnImageDeleted: (storageId: number) => void;\n  private readonly _handleStorageImageDeleted = (storageId: number): void => {\n    const kittyId = this._storageIdToKittyId.get(storageId);\n    if (kittyId !== undefined) {\n      this._kittyIdToStorageId.delete(kittyId);\n      this._storageIdToKittyId.delete(storageId);\n      this._images.delete(kittyId);\n    }\n  };\n  private _addImageOpts: IAddImageOpts = { scrolling: true, layer: 'top', zIndex: 0, cursorPos: 'iip' };\n\n  constructor(\n    private readonly _storage: ImageStorage\n  ) {\n    this._previousOnImageDeleted = this._storage.onImageDeleted;\n    this._wrappedOnImageDeleted = (storageId: number) => {\n      this._previousOnImageDeleted?.(storageId);\n      this._handleStorageImageDeleted(storageId);\n    };\n    this._storage.onImageDeleted = this._wrappedOnImageDeleted;\n  }\n\n  public reset(): void {\n    this._nextImageId = 1;\n    this._images.clear();\n    this._kittyIdToStorageId.clear();\n    this._storageIdToKittyId.clear();\n  }\n\n  public dispose(): void {\n    this.reset();\n    if (this._storage.onImageDeleted === this._wrappedOnImageDeleted) {\n      this._storage.onImageDeleted = this._previousOnImageDeleted;\n    }\n  }\n\n  public storeImage(id: number | undefined, imageData: Omit<IKittyImageData, 'id'>): number {\n    const imageId = id ?? this._nextImageId++;\n\n    const oldStorageId = this._kittyIdToStorageId.get(imageId);\n    if (oldStorageId !== undefined) {\n      this._storage.deleteImage(oldStorageId);\n      this._kittyIdToStorageId.delete(imageId);\n      this._storageIdToKittyId.delete(oldStorageId);\n    }\n\n    if (!this._images.has(imageId) && this._images.size >= KittyImageStorage._maxStoredImages) {\n      this._evictUndisplayedImages();\n    }\n\n    // Encoded images awaiting placement are outside ImageStorage's pixel budget.\n    // Unplaced payloads are evicted first so a new upload cannot erase a visible\n    // image while abandoned blobs still hold budget; placed ones go only when\n    // that is not enough, because the byte cap is a hard bound. The new image is\n    // always stored, so an oversized one overshoots by at most one payload\n    // (itself bounded by kittySizeLimit) rather than being dropped after an OK ack.\n    const byteLimit = this._storage.getLimit() * 1000000;\n    this._images.delete(imageId);\n    let retainedBytes = 0;\n    for (const image of this._images.values()) retainedBytes += image.data.size;\n    for (const evictPlaced of [false, true]) {\n      for (const [oldestId, image] of this._images) {\n        if (retainedBytes + imageData.data.size <= byteLimit) break;\n        if (this._kittyIdToStorageId.has(oldestId) !== evictPlaced) continue;\n        retainedBytes -= image.data.size;\n        this.deleteById(oldestId);\n      }\n    }\n\n    this._images.set(imageId, {\n      ...imageData,\n      id: imageId\n    });\n    return imageId;\n  }\n\n  public addImage(kittyId: number, image: HTMLCanvasElement | ImageBitmap, scrolling: boolean, layer: ImageLayer, zIndex: number): void {\n    // Clean up stale reverse-mapping from a previous placement of the same\n    // kitty image.  The old shared-storage entry is kept (it may still be\n    // visible on screen) but its reverse mapping is removed so that eviction\n    // of the old entry won't incorrectly delete the kitty image data.\n    const oldStorageId = this._kittyIdToStorageId.get(kittyId);\n    if (oldStorageId !== undefined) {\n      this._storageIdToKittyId.delete(oldStorageId);\n    }\n    this._addImageOpts.scrolling = scrolling;\n    this._addImageOpts.layer = layer;\n    this._addImageOpts.zIndex = zIndex;\n    const storageId = this._storage.addImage(image, this._addImageOpts);\n    this._kittyIdToStorageId.set(kittyId, storageId);\n    this._storageIdToKittyId.set(storageId, kittyId);\n  }\n\n  public getImage(kittyId: number): IKittyImageData | undefined {\n    return this._images.get(kittyId);\n  }\n\n  public deleteById(kittyId: number): void {\n    this._images.delete(kittyId);\n    const storageId = this._kittyIdToStorageId.get(kittyId);\n    if (storageId !== undefined) {\n      this._storage.deleteImage(storageId);\n      this._kittyIdToStorageId.delete(kittyId);\n      this._storageIdToKittyId.delete(storageId);\n    }\n  }\n\n  public deleteAll(): void {\n    this._images.clear();\n    for (const storageId of this._kittyIdToStorageId.values()) {\n      this._storage.deleteImage(storageId);\n    }\n    this._kittyIdToStorageId.clear();\n    this._storageIdToKittyId.clear();\n  }\n\n  public get images(): ReadonlyMap<number, IKittyImageData> {\n    return this._images;\n  }\n\n  public get kittyIdToStorageId(): ReadonlyMap<number, number> {\n    return this._kittyIdToStorageId;\n  }\n\n  public get lastImageId(): number {\n    return this._nextImageId - 1;\n  }\n\n  private _evictUndisplayedImages(): void {\n    for (const [kittyId] of this._images) {\n      if (this._images.size <= KittyImageStorage._maxStoredImages / 2) {\n        break;\n      }\n      if (!this._kittyIdToStorageId.has(kittyId)) {\n        this._images.delete(kittyId);\n      }\n    }\n  }\n}\n","\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\n/**\n * Copyright (c) 2023, 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n */\nconst inwasm_runtime_1 = require(\"inwasm-runtime\");\n/**\n * wasm base64 decoder.\n */\nconst wasmDecode = (0, inwasm_runtime_1.InWasm)(/*inwasm#828e69684093b2c6:rdef-start:\"decode\"*/{s:1,t:0,d:'AGFzbQEAAAABBQFgAAF/Ag8BA2VudgZtZW1vcnkCAAEDAwIAAAcNAgNkZWMAAANlbmQAAQqLBgKZBAEKf0GIKCgCAEGgKGohAUGEKCgCACIDQaAoaiEAQYAoKAIAQQFrQXxxIgRBoChqIQUgBEEQayADSgRAIARBkChqIQMDQCABIABBA2otAABBAnQoAoAgIABBAmotAABBAnQoAoAYIABBAWotAABBAnQoAoAQIAAtAABBAnQoAoAIcnJyIgY2AgAgAUEDaiAAQQdqLQAAQQJ0KAKAICAAQQZqLQAAQQJ0KAKAGCAAQQVqLQAAQQJ0KAKAECAAQQRqLQAAQQJ0KAKACHJyciIHNgIAIAFBBmogAEELai0AAEECdCgCgCAgAEEKai0AAEECdCgCgBggAEEJai0AAEECdCgCgBAgAEEIai0AAEECdCgCgAhycnIiCDYCACABQQlqIABBD2otAABBAnQoAoAgIABBDmotAABBAnQoAoAYIABBDWotAABBAnQoAoAQIABBDGotAABBAnQoAoAIcnJyIgk2AgAgAiAGciAHciAIciAJciECIAFBDGohASAAQRBqIgAgA0kNAAsLIAAgBUkEQANAIAEgAEEDai0AAEECdCgCgCAgAEECai0AAEECdCgCgBggAEEBai0AAEECdCgCgBAgAC0AAEECdCgCgAhycnIiAzYCACACIANyIQIgAUEDaiEBIABBBGoiACAFSQ0ACwtBfyEAIAJB////B00Ef0GEKCAENgIAQYgoIAFBoChrNgIAQQAFQX8LC+0BAQR/AkBBgCgoAgAiAUGEKCgCACIAa0EFTgRAQX8hAxAADQFBgCgoAgAhAUGEKCgCACEAC0F/IQMgASAAayIBQQJIDQAgAC0AoShBAnQoAoAQIAAtAKAoQQJ0KAKACHIhAgJ/IAFBBEYEQEEDQQQgAC0AoyhBPUYbIAAtAKIoQT1GayEBC0EBIAFBA0kNABogAC0AoihBAnQoAoAYIAJyIQJBAiABQQRHDQAaIAAtAKMoQQJ0KAKAICACciECQQMLIQEgAkH///8HSw0AQQAhA0GIKCgCACIAIAI2AKAoQYgoIAAgAWo2AgALIAML'}/*inwasm#828e69684093b2c6:rdef-end:\"decode\"*/);\n// SIMD version (speedup ~1.4x, not covered by tests yet)\n/*\nconst wasmDecode = InWasm({\n  name: 'decode',\n  type: OutputType.INSTANCE,\n  mode: OutputMode.SYNC,\n  srctype: 'Clang-C',\n  imports: {\n    env: { memory: new WebAssembly.Memory({ initial: 1 }) }\n  },\n  exports: {\n    dec: () => 0,\n    end: () => 0\n  },\n  compile: {\n    switches: ['-msimd128', '-Wl,-z,stack-size=0', '-Wl,--stack-first']\n  },\n  code: `\n    #include <wasm_simd128.h>\n    typedef struct {\n      unsigned int wp;\n      unsigned int sp;\n      unsigned int dp;\n      unsigned int e_size;\n      unsigned int dummy[4];\n      unsigned char data[0];\n    } State;\n\n    unsigned int *D0 = (unsigned int *) ${P32.D0 * 4};\n    unsigned int *D1 = (unsigned int *) ${P32.D1 * 4};\n    unsigned int *D2 = (unsigned int *) ${P32.D2 * 4};\n    unsigned int *D3 = (unsigned int *) ${P32.D3 * 4};\n    State *state = (State *) ${P32.STATE * 4};\n\n    #define packed_byte(x) wasm_i8x16_splat((char) x)\n    #define packed_dword(x) wasm_i32x4_splat(x)\n    #define masked(x, mask) wasm_v128_and(x, wasm_i32x4_splat(mask))\n\n    __attribute__((noinline)) int dec() {\n      unsigned int nsp = (state->wp - 1) & ~3;\n      unsigned char *src = state->data + state->sp;\n      unsigned char *end = state->data + nsp;\n      unsigned char *dst = state->data + state->dp;\n      unsigned int error = 0;\n\n      v128_t err = wasm_i8x16_splat(0);\n      unsigned char *end16 = state->data + (nsp & ~15);\n      while (src < end16) {\n        v128_t data = wasm_v128_load((v128_t *) src);\n\n        // wasm-simd rewrite of http://0x80.pl/notesen/2016-01-17-sse-base64-decoding.html#vector-lookup-pshufb\n        const v128_t higher_nibble = wasm_u32x4_shr(data, 4) & packed_byte(0x0f);\n        const char linv = 1;\n        const char hinv = 0;\n\n        const v128_t lower_bound_LUT = wasm_i8x16_const(\n          // order: 0 1 2 3 4 5 6 7 8 9 a b c d e f\n          linv, linv, 0x2b, 0x30,\n          0x41, 0x50, 0x61, 0x70,\n          linv, linv, linv, linv,\n          linv, linv, linv, linv\n        );\n        const v128_t upper_bound_LUT = wasm_i8x16_const(\n          // order: 0 1 2 3 4 5 6 7 8 9 a b c d e f\n          hinv, hinv, 0x2b, 0x39,\n          0x4f, 0x5a, 0x6f, 0x7a,\n          hinv, hinv, hinv, hinv,\n          hinv, hinv, hinv, hinv\n        );\n        // the difference between the shift and lower bound\n        const v128_t shift_LUT = wasm_i8x16_const(\n          // order: 0 1 2 3 4 5 6 7 8 9 a b c d e f\n          0x00,        0x00,        0x3e - 0x2b, 0x34 - 0x30,\n          0x00 - 0x41, 0x0f - 0x50, 0x1a - 0x61, 0x29 - 0x70,\n          0x00,        0x00,        0x00,        0x00,\n          0x00,        0x00,        0x00,        0x00\n        );\n\n        const v128_t upper_bound = wasm_i8x16_swizzle(upper_bound_LUT, higher_nibble);\n        const v128_t lower_bound = wasm_i8x16_swizzle(lower_bound_LUT, higher_nibble);\n\n        const v128_t below = wasm_i8x16_lt(data, lower_bound);\n        const v128_t above = wasm_i8x16_gt(data, upper_bound);\n        const v128_t eq_2f = wasm_i8x16_eq(data, packed_byte(0x2f));\n\n        // in_range = not (below or above) or eq_2f\n        // outside  = not in_range = below or above and not eq_2f (from deMorgan law)\n        const v128_t outside = wasm_v128_andnot(eq_2f, above | below);\n        err = wasm_v128_or(err, outside);\n\n        const v128_t shift  = wasm_i8x16_swizzle(shift_LUT, higher_nibble);\n        const v128_t t0     = wasm_i8x16_add(data, shift);\n        v128_t v = wasm_i8x16_add(t0, wasm_v128_and(eq_2f, packed_byte(-3)));\n\n        // pack bytes\n        const v128_t ca = masked(v, 0x003f003f);\n        const v128_t db = masked(v, 0x3f003f00);\n        const v128_t t00 = wasm_v128_or(wasm_u32x4_shr(db, 8), wasm_i32x4_shl(ca, 6));\n        v128_t res = wasm_v128_or(wasm_u32x4_shr(t00, 16), wasm_i32x4_shl(t00, 12));\n        res = wasm_i8x16_swizzle(res, wasm_i8x16_const(2, 1, 0, 6, 5, 4, 10, 9, 8, 14, 13, 12, 16, 16, 16, 16));\n\n        wasm_v128_store((v128_t *) dst, res);\n        dst += 12;\n        src += 16;\n      }\n      //if (wasm_i8x16_bitmask(err) != 0) return -1;\n      if (wasm_v128_any_true(err)) return -1;\n\n      // operate on 4-byte blocks\n      while (src < end) {\n        error |= *((unsigned int *) dst) = D0[src[0]] | D1[src[1]] | D2[src[2]] | D3[src[3]];\n        dst += 3;\n        src += 4;\n      }\n      if (error >> 24) return -1;\n      state->sp = nsp;\n      state->dp = dst - state->data;\n      return 0;\n    }\n\n    int end() {\n      int rem = state->wp - state->sp;\n      if (rem > 4 && dec()) return -1;\n      rem = state->wp - state->sp;\n      if (rem < 2) return -1;\n\n      unsigned char *src = state->data + state->sp;\n      if (rem == 4) {\n        if (src[3] == 61) rem--;\n        if (src[2] == 61) rem--;\n      }\n      unsigned int accu = D0[src[0]] | D1[src[1]];\n      int dp = 1;\n      if (rem > 2) {\n        accu |= D2[src[2]];\n        dp++;\n        if (rem == 4) {\n          accu |= D3[src[3]];\n          dp++;\n        }\n      }\n      if (accu >> 24) return -1;\n      *((unsigned int *) (state->data + state->dp)) = accu;\n      state->dp += dp;\n      return 0;\n    }\n    `\n});\n*/\n// base64 map\nconst MAP = new Uint8Array('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'\n    .split('')\n    .map(el => el.charCodeAt(0)));\n// init decoder maps in LE order\nconst D = new Uint32Array(1024);\nD.fill(0xFF000000);\nfor (let i = 0; i < MAP.length; ++i)\n    D[MAP[i]] = i << 2;\nfor (let i = 0; i < MAP.length; ++i)\n    D[256 + MAP[i]] = i >> 4 | ((i << 4) & 0xFF) << 8;\nfor (let i = 0; i < MAP.length; ++i)\n    D[512 + MAP[i]] = (i >> 2) << 8 | ((i << 6) & 0xFF) << 16;\nfor (let i = 0; i < MAP.length; ++i)\n    D[768 + MAP[i]] = i << 16;\nconst EMPTY = new Uint8Array(0);\n/**\n * base64 stream decoder.\n *\n * Features / assumptions:\n * - lazy chunkwise decoding\n * - errors out on any non base64 chars (no support for NL formatted base64)\n * - decodes in wasm\n * - inplace decoding to save memory\n * - supports a keepSize for lazy memory release\n */\nclass Base64Decoder {\n    /**\n     * @param keepSize Keep the wasm instance below this limit when calling `release()`.\n     * @param maxBytes Max allowed bytes to allocate.\n     * @param initialBytes Initial bytes to allocate.\n     */\n    constructor(keepSize, maxBytes, initialBytes) {\n        this._inst = null;\n        this._ended = true;\n        this._bytes = 0;\n        this.keepSize = keepSize !== null && keepSize !== void 0 ? keepSize : 1048576 /* Bytes.KEEP */;\n        this.maxBytes = maxBytes !== null && maxBytes !== void 0 ? maxBytes : 4294901760 /* Bytes.MAX */;\n        this._bytes = initialBytes !== null && initialBytes !== void 0 ? initialBytes : 32768 /* Bytes.INITIAL */;\n        if (this._bytes > this.maxBytes || this.maxBytes > 4294901760 /* Bytes.MAX */) {\n            throw new Error('invalid byte settings');\n        }\n    }\n    /**\n     * Currently decoded bytes (borrowed).\n     * Must be accessed before calling `release` or `init`.\n     */\n    get data8() {\n        return this._inst ? this._d.subarray(0, this._m32[1282 /* P32.STATE_DP */]) : EMPTY;\n    }\n    /**\n     * Release memory conditionally based on `keepSize`.\n     * If memory gets released, also the wasm instance will be freed and recreated on next `init`,\n     * otherwise the instance will be reused.\n     */\n    release() {\n        if (!this._inst)\n            return;\n        if (this._bytes > this.keepSize) {\n            this._inst = this._m32 = this._d = this._mem = null;\n        }\n        else {\n            this._m32[1280 /* P32.STATE_WP */] = 0;\n            this._m32[1281 /* P32.STATE_SP */] = 0;\n            this._m32[1282 /* P32.STATE_DP */] = 0;\n        }\n    }\n    /**\n     * Initializes the decoder for new base64 data.\n     * Must be called before doing any decoding attempts.\n     * The method will either spawn a new wasm instance or grow\n     * the needed memory of an existing instance.\n     * @param maxBytes Max allowed bytes to allocate (overwrites ctor value).\n     * @param initialBytes Initial bytes to allocate (overwrites ctor value).\n     */\n    init(maxBytes, initialBytes) {\n        this.maxBytes = maxBytes !== null && maxBytes !== void 0 ? maxBytes : this.maxBytes;\n        this._bytes = initialBytes !== null && initialBytes !== void 0 ? initialBytes : Math.min(this._bytes, this.maxBytes);\n        if (this._bytes > this.maxBytes || this.maxBytes > 4294901760 /* Bytes.MAX */) {\n            throw Error('invalid byte settings');\n        }\n        let m = this._m32;\n        const bytes = this._bytes + 5152 /* Bytes._DATA_OFFSET */;\n        if (!this._inst) {\n            this._mem = new WebAssembly.Memory({ initial: Math.ceil(bytes / 65536) });\n            this._inst = wasmDecode({ env: { memory: this._mem } });\n            m = new Uint32Array(this._mem.buffer, 0);\n            m.set(D, 256 /* P32.D0 */);\n            this._d = new Uint8Array(this._mem.buffer, 5152 /* Bytes._DATA_OFFSET */);\n        }\n        else if (this._mem.buffer.byteLength < bytes) {\n            this._mem.grow(Math.ceil((bytes - this._mem.buffer.byteLength) / 65536));\n            m = new Uint32Array(this._mem.buffer, 0);\n            this._d = new Uint8Array(this._mem.buffer, 5152 /* Bytes._DATA_OFFSET */);\n        }\n        m[1280 /* P32.STATE_WP */] = 0;\n        m[1281 /* P32.STATE_SP */] = 0;\n        m[1282 /* P32.STATE_DP */] = 0;\n        this._m32 = m;\n        this._ended = false;\n    }\n    /**\n     * Realloc memory. Realloc only happens, if the requested\n     * size doesn't fit in the current memory.\n     * The new size will be capped by `maxBytes`.\n     * @param requested Bytes to be stored.\n     */\n    _realloc(requested) {\n        const needed = this._m32[1280 /* P32.STATE_WP */] + requested;\n        if (this._bytes < needed) {\n            if (needed > this.maxBytes) {\n                return -3 /* DecodeStatus.SIZE_EXCEEDED */;\n            }\n            let newSize = this._bytes;\n            while ((newSize *= 2) < needed) { }\n            newSize = Math.min(newSize, this.maxBytes);\n            if (newSize < needed) {\n                return -3 /* DecodeStatus.SIZE_EXCEEDED */;\n            }\n            if (newSize + 5152 /* Bytes._DATA_OFFSET */ > this._mem.buffer.byteLength) {\n                const addPages = Math.ceil((newSize + 5152 /* Bytes._DATA_OFFSET */ - this._mem.buffer.byteLength) / 65536);\n                this._mem.grow(addPages);\n                this._m32 = new Uint32Array(this._mem.buffer, 0);\n                this._d = new Uint8Array(this._mem.buffer, 5152 /* Bytes._DATA_OFFSET */);\n            }\n            this._bytes = newSize;\n        }\n        return 0 /* DecodeStatus.OK */;\n    }\n    /**\n     * Put bytes in `data` into the decoder.\n     * Additionally decodes the payload, if it reached 2^17 bytes.\n     * The return value indicates the type of issue.\n     * @param data Bytes to be loaded.\n     */\n    put(data) {\n        if (!this._inst || this._ended) {\n            return -2 /* DecodeStatus.NOT_INITIALIZED */;\n        }\n        if (this._realloc(data.length)) {\n            return -3 /* DecodeStatus.SIZE_EXCEEDED */;\n        }\n        const m = this._m32;\n        this._d.set(data, m[1280 /* P32.STATE_WP */]);\n        m[1280 /* P32.STATE_WP */] += data.length;\n        // max chunk in input handler is 2^17, try to run in \"tandem mode\"\n        return m[1280 /* P32.STATE_WP */] - m[1281 /* P32.STATE_SP */] >= 131072\n            ? this._inst.exports.dec()\n            : 0 /* DecodeStatus.OK */;\n    }\n    /**\n     * End the current decoding.\n     * Also decodes leftover payload from previous put calls.\n     */\n    end() {\n        this._ended = true;\n        return this._inst\n            ? this._inst.exports.end()\n            : -2 /* DecodeStatus.NOT_INITIALIZED */;\n    }\n    /**\n     * Bytes loaded into the decoder.\n     */\n    get loadedBytes() {\n        return this._inst\n            ? this._m32[1280 /* P32.STATE_WP */]\n            : 0;\n    }\n    /**\n     * Free bytes to feed to the decoder.\n     */\n    get freeBytes() {\n        return this._inst\n            ? this.maxBytes - this._m32[1280 /* P32.STATE_WP */]\n            : 0;\n    }\n}\nexports.default = Base64Decoder;\n//# sourceMappingURL=Base64Decoder.wasm.js.map","\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\n/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\nconst inwasm_runtime_1 = require(\"inwasm-runtime\");\nconst wasmQoiDecode = (0, inwasm_runtime_1.InWasm)(/*inwasm#459f9e1bfb80b1a8:rdef-start:\"qoi_decode\"*/{s:1,t:0,d:'AGFzbQEAAAABCgJgAABgA39/fwACDwEDZW52Bm1lbW9yeQIAAQMDAgABBwcBA2RlYwABCAEACu4EAgwAQQBBAEGAAvwLAAveBAEJf0EAQQBBgAL8CwAgAUEXTgRAIAAgAWpBCGshCkGACCEBIAJBAnRBgAhqIQsgAEEOaiEDQf8BIQZBACECA0AgA0EBaiEHIAMtAAAiCEE/cSEAAkACQCAIQcABcSIJRQRAIABBAnQiAC0AAyEGIAAtAAIhBCAALQABIQUgAC0AACECIAchAwwBCwJAIAhB/QFLDQAgCUHAAUcNACAFQQVsIAJBA2xqIARBB2xqIAZBC2xqQT9xQQJ0IgMgBDoAAiADIAU6AAEgAyACOgAAIANBA2ogBjoAAANAIAEgAjoAACABQQNqIAY6AAAgAUECaiAEOgAAIAFBAWogBToAACABQQRqIQEgAEUEQCAHIQMMBAsgAEEBayEAIAEgC0kNAAsgByEDDAILAn8CQAJAAkAgCEH+AWsOAgABAgsgAy0AAyEEIAMtAAIhBSADLQABIQIgA0EEagwCCyADKAIBIgJBGHYhBiACQRB2IQQgAkEIdiEFIANBBWoMAQsgCUGAAUcEQCAHIAlBwABHDQEaIAQgCEEDcWpBAmshBCACIABBBHZqQQJrIQIgBSAIQQJ2QQNxakECayEFIAcMAQsgBCAAQShrIgkgAy0AASIHQQ9xamohBCACIAdBBHYgCWpqIQIgACAFakEgayEFIANBAmoLIQMgBUEFbCACQQNsaiAEQQdsaiAGQQtsakE/cUECdCIAIAQ6AAIgACAFOgABIAAgAjoAACAAQQNqIAY6AAALIAEgBjoAAyABIAQ6AAIgASAFOgABIAEgAjoAACABQQRqIQELIAMgCkkNAAsLCw=='}/*inwasm#459f9e1bfb80b1a8:rdef-end:\"qoi_decode\"*/);\nclass QoiDecoder {\n    constructor(keepSize) {\n        this.keepSize = keepSize;\n        this.width = 0;\n        this.height = 0;\n    }\n    decode(d) {\n        this.width = d[4] << 24 | d[5] << 16 | d[6] << 8 | d[7];\n        this.height = d[8] << 24 | d[9] << 16 | d[10] << 8 | d[11];\n        const pixels = this.width * this.height;\n        const ib = pixels * 4;\n        const dl = d.length;\n        /**\n         * byte/offset calculation:\n         * To save some memory we dont reserve full memory for decoded + encoded,\n         * but place encoded at the end of decoded plus 50% security distance\n         * to avoid reads before writes positions:\n         *\n         * encoded < decoded (good compression)\n         *    enc                                              ####################\n         *    dec                 #######################################\n         *                        ^                            ^\n         *                        DST_P                        CHUNK_P\n         *\n         * encoded > decoded (degenerated compression, should not happen)\n         *    enc                           ##############################\n         *    dec                 ####################\n         *                        ^         ^\n         *                        DST_P     CHUNK_P\n         *\n         * There is still a chance for overlapping r/w positions in case the compressed\n         * data has very different pixel progression, yet the 50% security distance\n         * should deal with that, as QOI will bloat data by 25% at max (RGB -> OP byte + RGB).\n         * Since we always assume RGBA at decoding stage, the possible bloat reduces to 20% at max.\n         */\n        const bytes = Math.max(ib, dl) + (Math.min(ib, dl) >> 1) + 4096;\n        if (!this._inst) {\n            this._mem = new WebAssembly.Memory({ initial: Math.ceil(bytes / 65536) });\n            this._inst = wasmQoiDecode({ env: { memory: this._mem } });\n        }\n        else if (this._mem.buffer.byteLength < bytes) {\n            this._mem.grow(Math.ceil((bytes - this._mem.buffer.byteLength) / 65536));\n            this._d = null;\n        }\n        if (!this._d) {\n            this._d = new Uint8Array(this._mem.buffer);\n        }\n        // put src data at the end of memory, also align to 256\n        const chunkP = (this._mem.buffer.byteLength - dl) & ~0xFF;\n        this._d.set(d, chunkP);\n        this._inst.exports.dec(chunkP, dl, pixels);\n        return this._d.subarray(1024 /* P8.DST_P */, 1024 /* P8.DST_P */ + ib);\n    }\n    release() {\n        if (!this._inst)\n            return;\n        if (this._mem.buffer.byteLength > this.keepSize) {\n            this._inst = this._d = this._mem = null;\n        }\n    }\n}\nexports.default = QoiDecoder;\n//# sourceMappingURL=QoiDecoder.wasm.js.map","\"use strict\";\n/**\n * Copyright (c) 2022, 2026 Joerg Breitbart\n * @license MIT\n */\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.InWasm = InWasm;\nlet z = (s) => {\n    if (Uint8Array.fromBase64)\n        return Uint8Array.fromBase64(s);\n    if (typeof Buffer !== 'undefined')\n        return Buffer.from(s, 'base64');\n    const b = atob(s);\n    const r = new Uint8Array(b.length);\n    for (let i = 0; i < r.length; ++i)\n        r[i] = b.charCodeAt(i);\n    return r;\n};\nfunction InWasm(def) {\n    if (def.d) {\n        const { t, s, d } = def;\n        let b;\n        let m;\n        const W = WebAssembly;\n        if (t === 0 /* OutputType.INSTANCE */) {\n            if (s)\n                return (e) => new W.Instance(m || (m = new W.Module(b || (b = z(d)))), e);\n            return (e) => m\n                ? W.instantiate(m, e)\n                : W.instantiate(b || (b = z(d)), e).then(r => (m = r.module) && r.instance);\n        }\n        if (t === 1 /* OutputType.MODULE */) {\n            if (s)\n                return () => m || (m = new W.Module(b || (b = z(d))));\n            return () => m\n                ? Promise.resolve(m)\n                : W.compile(b || (b = z(d))).then(r => m = r);\n        }\n        if (s)\n            return () => b || (b = z(d));\n        return () => Promise.resolve(b || (b = z(d)));\n    }\n    if (typeof _wasmCtx === 'undefined')\n        throw new Error('must run \"inwasm\"');\n    _wasmCtx.add(def);\n}\n//# sourceMappingURL=index.js.map","// The module cache\nvar __webpack_module_cache__ = {};\n\n// The require function\nfunction __webpack_require__(moduleId) {\n\t// Check if module is in cache\n\tvar cachedModule = __webpack_module_cache__[moduleId];\n\tif (cachedModule !== undefined) {\n\t\treturn cachedModule.exports;\n\t}\n\t// Create a new module (and put it into the cache)\n\tvar module = __webpack_module_cache__[moduleId] = {\n\t\t// no module.id needed\n\t\t// no module.loaded needed\n\t\texports: {}\n\t};\n\n\t// Execute the module function\n\t__webpack_modules__[moduleId].call(module.exports, module, module.exports, __webpack_require__);\n\n\t// Return the exports of the module\n\treturn module.exports;\n}\n\n","/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport type { ITerminalAddon, IDisposable } from '@xterm/xterm';\nimport type { ImageAddon as IImageApi } from '@xterm/addon-image';\nimport { Emitter, type IEvent } from 'common/Event';\nimport { IIPHandler } from './IIPHandler';\nimport { ImageRenderer } from './ImageRenderer';\nimport { ImageStorage, CELL_SIZE_DEFAULT } from './ImageStorage';\nimport { KittyGraphicsHandler } from './kitty/KittyGraphicsHandler';\nimport { KittyImageStorage } from './kitty/KittyImageStorage';\nimport { SixelHandler } from './SixelHandler';\nimport { SixelImageStorage } from './SixelImageStorage';\nimport { IIPImageStorage } from './IIPImageStorage';\nimport { ITerminalExt, IImageAddonOptions, IResetHandler } from './Types';\n\n\n/**\n * Document VT features provided by this addon.\n *\n * @vt: #E[Supported via @xterm/addon-image.] DCS SIXEL \"SIXEL Graphics\"  \"DCS Ps ; Ps ; Ps ; q Pt ST\"  \"Draw SIXEL image.\"\n *\n * Sixel support is provided by the addon @xterm/addon-image with these limitations:\n * - immediate coloring (no shared palette, allows high color settings of `img2sixel`)\n * - max. palette size of 4096 colors\n * - max. pixel width of 16K\n * - max. 25 MB per sixel sequence\n * - VT340 cursor positioning (begin of last sixel data row)\n *\n * See [addon readme](https://github.com/xtermjs/xterm.js/tree/master/addons/addon-image) for more details.\n *\n *\n * @vt: #E[Supported via @xterm/addon-image.] OSC 1337  \"iTerm2 Commands\"   \"OSC 1337 ; Pt BEL\"  \"Custom iTerm2 commands.\"\n *\n * Only the inline image protocol (IIP) is supported by the addon @xterm/addon-image with\n * the following limitations:\n * - sequence:\n *   - format: `OSC 1337 ; File=inline=1 ; size=<unencoded size> ; ... : <base64 payload> BEL`\n *   - size param must be set and payload may not exceed CEIL(size * 4 / 3)\n *   - strict base64 handling as of RFC4648 §4 (standard alphabet, optional padding,\n *     no separator bytes allowed)\n *   - supported params: size, name, width, height, preserveAspectRatio\n * - image formats: PNG, JPEG and GIF\n * - no animation support (renders first image of a GIF)\n * - no multipart support\n * - VT340 cursor positioning (begin of last sixel data row)\n *\n * See [addon readme](https://github.com/xtermjs/xterm.js/tree/master/addons/addon-image)\n * and [iTerm2 IIP docs](https://iterm2.com/documentation-images.html) for more details.\n *\n *\n * @vt: #E[Supported via @xterm/addon-image.] APC KITTY_GRAPHICS \"Kitty Graphics\"  \"APC G Pt ST\"  \"Kitty Graphics Protocol.\"\n *\n * Kitty graphics support is provided by the addon @xterm/addon-image.\n * Note that while basic image output already works, this is still work in progress.\n */\n\n// default values of addon ctor options\nconst DEFAULT_OPTIONS: IImageAddonOptions = {\n  enableSizeReports: true,\n  pixelLimit: 16777216, // limit to 4096 * 4096 pixels\n  sixelSupport: true,\n  sixelScrolling: true,\n  sixelPaletteLimit: 4096,\n  sixelSizeLimit: 33554432,\n  storageLimit: 128,\n  showPlaceholder: true,\n  iipSupport: true,\n  iipSizeLimit: 33554432,\n  kittySupport: true,\n  kittySizeLimit: 33554432\n};\n\n// max palette size supported by the sixel lib (compile time setting)\nconst MAX_SIXEL_PALETTE_SIZE = 4096;\n\n// definitions for _xtermGraphicsAttributes sequence\nconst enum GaItem {\n  COLORS = 1,\n  SIXEL_GEO = 2,\n  REGIS_GEO = 3\n}\nconst enum GaAction {\n  READ = 1,\n  SET_DEFAULT = 2,\n  SET = 3,\n  READ_MAX = 4\n}\nconst enum GaStatus {\n  SUCCESS = 0,\n  ITEM_ERROR = 1,\n  ACTION_ERROR = 2,\n  FAILURE = 3\n}\n\n\nexport class ImageAddon implements ITerminalAddon, IImageApi {\n  private _opts: IImageAddonOptions;\n  private _defaultOpts: IImageAddonOptions;\n  private _storage: ImageStorage | undefined;\n  private _renderer: ImageRenderer | undefined;\n  private _disposables: IDisposable[] = [];\n  private _terminal: ITerminalExt | undefined;\n  private _handlers: Map<String, IResetHandler> = new Map();\n  private readonly _onImageAdded = new Emitter<void>();\n  public readonly onImageAdded: IEvent<void> = this._onImageAdded.event;\n\n  constructor(opts?: Partial<IImageAddonOptions>) {\n    this._opts = Object.assign({}, DEFAULT_OPTIONS, opts);\n    this._defaultOpts = Object.assign({}, DEFAULT_OPTIONS, opts);\n  }\n\n  public dispose(): void {\n    for (const handler of this._handlers.values()) handler.reset();\n    for (const obj of this._disposables) {\n      obj.dispose();\n    }\n    this._disposables.length = 0;\n    this._handlers.clear();\n    this._onImageAdded.dispose();\n  }\n\n  private _disposeLater(...args: IDisposable[]): void {\n    for (const obj of args) {\n      this._disposables.push(obj);\n    }\n  }\n\n  public activate(terminal: ITerminalExt): void {\n    this._terminal = terminal;\n\n    // internal data structures\n    this._renderer = new ImageRenderer(terminal);\n    this._storage = new ImageStorage(terminal, this._renderer, this._opts);\n    this._storage.onImageAdded = () => this._onImageAdded.fire();\n\n    // enable size reports\n    if (this._opts.enableSizeReports) {\n      const windowOps = terminal.options.windowOptions ?? {};\n      windowOps.getWinSizePixels = true;\n      windowOps.getCellSizePixels = true;\n      windowOps.getWinSizeChars = true;\n      terminal.options.windowOptions = windowOps;\n    }\n\n    this._disposeLater(\n      this._renderer,\n      this._storage,\n\n      // DECSET/DECRST/DA1/XTSMGRAPHICS handlers\n      terminal.parser.registerCsiHandler({ prefix: '?', final: 'h' }, params => this._decset(params)),\n      terminal.parser.registerCsiHandler({ prefix: '?', final: 'l' }, params => this._decrst(params)),\n      terminal.parser.registerCsiHandler({ final: 'c' }, params => this._da1(params)),\n      terminal.parser.registerCsiHandler({ prefix: '?', final: 'S' }, params => this._xtermGraphicsAttributes(params)),\n\n      // render hook\n      terminal.onRender(range => this._storage?.render(range)),\n\n      /**\n       * reset handlers covered:\n       * - DECSTR\n       * - RIS\n       * - Terminal.reset()\n       */\n      terminal.parser.registerCsiHandler({ intermediates: '!', final: 'p' }, () => this.reset()),\n      terminal.parser.registerEscHandler({ final: 'c' }, () => this.reset()),\n      terminal._core._inputHandler.onRequestReset(() => this.reset()),\n\n      // wipe canvas and delete alternate images on buffer switch\n      terminal.buffer.onBufferChange(() => this._storage?.wipeAlternate()),\n\n      // extend images to the right on resize\n      terminal.onResize(metrics => this._storage?.viewportResize(metrics))\n    );\n\n    // SIXEL handler\n    if (this._opts.sixelSupport) {\n      const sixelStorage = new SixelImageStorage(this._storage!, this._opts, this._renderer!, terminal);\n      const sixelHandler = new SixelHandler(this._opts, sixelStorage, terminal);\n      this._handlers.set('sixel', sixelHandler);\n      this._disposeLater(\n        terminal._core._inputHandler._parser.registerDcsHandler({ final: 'q' }, sixelHandler)\n      );\n    }\n\n    // iTerm IIP handler\n    if (this._opts.iipSupport) {\n      const iipStorage = new IIPImageStorage(this._storage!);\n      const iipHandler = new IIPHandler(this._opts, this._renderer!, iipStorage, terminal);\n      this._handlers.set('iip', iipHandler);\n      this._disposeLater(\n        terminal._core._inputHandler._parser.registerOscHandler(1337, iipHandler)\n      );\n    }\n\n    // Kitty graphics handler\n    if (this._opts.kittySupport) {\n      const kittyStorage = new KittyImageStorage(this._storage!);\n      const kittyHandler = new KittyGraphicsHandler(this._opts, this._renderer!, kittyStorage, terminal);\n      this._handlers.set('kitty', kittyHandler);\n      this._disposeLater(\n        kittyStorage,\n        kittyHandler,\n        terminal._core._inputHandler._parser.registerApcHandler({ final: 'G' }, kittyHandler)\n      );\n    }\n  }\n\n  // Note: storageLimit is skipped here to not intoduce a surprising side effect.\n  public reset(): boolean {\n    // reset options customizable by sequences to defaults\n    this._opts.sixelScrolling = this._defaultOpts.sixelScrolling;\n    this._opts.sixelPaletteLimit = this._defaultOpts.sixelPaletteLimit;\n    // also clear image storage\n    this._storage?.reset();\n    // reset protocol handlers\n    for (const handler of this._handlers.values()) {\n      handler.reset();\n    }\n    return false;\n  }\n\n  public get storageLimit(): number {\n    return this._storage?.getLimit() || -1;\n  }\n\n  public set storageLimit(limit: number) {\n    this._storage?.setLimit(limit);\n    this._opts.storageLimit = limit;\n  }\n\n  public get storageUsage(): number {\n    if (this._storage) {\n      return this._storage.getUsage();\n    }\n    return -1;\n  }\n\n  public get showPlaceholder(): boolean {\n    return this._opts.showPlaceholder;\n  }\n\n  public set showPlaceholder(value: boolean) {\n    this._opts.showPlaceholder = value;\n    this._renderer?.showPlaceholder(value);\n  }\n\n  public getImageAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    return this._storage?.getImageAtBufferCell(x, y);\n  }\n\n  public extractTileAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    return this._storage?.extractTileAtBufferCell(x, y);\n  }\n\n  private _report(s: string): void {\n    this._terminal?._core.input(s, false);\n  }\n\n  private _decset(params: (number | number[])[]): boolean {\n    for (let i = 0; i < params.length; ++i) {\n      switch (params[i]) {\n        case 80:\n          this._opts.sixelScrolling = false;\n          break;\n      }\n    }\n    return false;\n  }\n\n  private _decrst(params: (number | number[])[]): boolean {\n    for (let i = 0; i < params.length; ++i) {\n      switch (params[i]) {\n        case 80:\n          this._opts.sixelScrolling = true;\n          break;\n      }\n    }\n    return false;\n  }\n\n  // overload DA to return something more appropriate\n  private _da1(params: (number | number[])[]): boolean {\n    if (params[0]) {\n      return true;\n    }\n    // reported features:\n    // 62 - VT220\n    // 4 - SIXEL support\n    // 9 - charsets\n    // 22 - ANSI colors\n    if (this._opts.sixelSupport) {\n      this._report(`\\x1b[?62;4;9;22c`);\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * Implementation of xterm's graphics attribute sequence.\n   *\n   * Supported features:\n   * - read/change palette limits (max 4096 by sixel lib)\n   * - read SIXEL canvas geometry (reports current window canvas or\n   *   squared pixelLimit if canvas > pixel limit)\n   *\n   * Everything else is deactivated.\n   */\n  private _xtermGraphicsAttributes(params: (number | number[])[]): boolean {\n    if (params.length < 2) {\n      return true;\n    }\n    if (params[0] === GaItem.COLORS) {\n      switch (params[1]) {\n        case GaAction.READ:\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${this._opts.sixelPaletteLimit}S`);\n          return true;\n        case GaAction.SET_DEFAULT:\n          this._opts.sixelPaletteLimit = this._defaultOpts.sixelPaletteLimit;\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${this._opts.sixelPaletteLimit}S`);\n          // also reset protocol handlers for now\n          for (const handler of this._handlers.values()) {\n            handler.reset();\n          }\n          return true;\n        case GaAction.SET:\n          if (params.length > 2 && !(params[2] instanceof Array) && params[2] <= MAX_SIXEL_PALETTE_SIZE) {\n            this._opts.sixelPaletteLimit = params[2];\n            this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${this._opts.sixelPaletteLimit}S`);\n          } else {\n            this._report(`\\x1b[?${params[0]};${GaStatus.ACTION_ERROR}S`);\n          }\n          return true;\n        case GaAction.READ_MAX:\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${MAX_SIXEL_PALETTE_SIZE}S`);\n          return true;\n        default:\n          this._report(`\\x1b[?${params[0]};${GaStatus.ACTION_ERROR}S`);\n          return true;\n      }\n    }\n    if (params[0] === GaItem.SIXEL_GEO) {\n      switch (params[1]) {\n        // we only implement read and read_max here\n        case GaAction.READ:\n          let width = this._renderer?.dimensions?.css.canvas.width;\n          let height = this._renderer?.dimensions?.css.canvas.height;\n          if (!width || !height) {\n            // for some reason we have no working image renderer\n            // --> fallback to default cell size\n            const cellSize = CELL_SIZE_DEFAULT;\n            width = (this._terminal?.cols || 80) * cellSize.width;\n            height = (this._terminal?.rows || 24) * cellSize.height;\n          }\n          if (width * height < this._opts.pixelLimit) {\n            this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${width.toFixed(0)};${height.toFixed(0)}S`);\n          } else {\n            // if we overflow pixelLimit report that squared instead\n            const x = Math.floor(Math.sqrt(this._opts.pixelLimit));\n            this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${x};${x}S`);\n          }\n          return true;\n        case GaAction.READ_MAX:\n          // read_max returns pixelLimit as square area\n          const x = Math.floor(Math.sqrt(this._opts.pixelLimit));\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${x};${x}S`);\n          return true;\n        default:\n          this._report(`\\x1b[?${params[0]};${GaStatus.ACTION_ERROR}S`);\n          return true;\n      }\n    }\n    // exit with error on ReGIS or any other requests\n    this._report(`\\x1b[?${params[0]};${GaStatus.ITEM_ERROR}S`);\n    return true;\n  }\n}\n"],"names":["root","factory","exports","module","define","amd","globalThis","red","n","green","blue","toRGBA8888","r","g","b","a","clamp","low","high","value","Math","max","min","h2c","t1","t2","c","normalizeRGB","round","Object","defineProperty","DEFAULT_FOREGROUND","DEFAULT_BACKGROUND","PALETTE_ANSI_256","PALETTE_VT340_GREY","PALETTE_VT340_COLOR","normalizeHLS","nearestColorIndex","fromRGBA8888","alpha","BIG_ENDIAN","Uint8Array","Uint32Array","buffer","console","warn","color","palette","Number","MAX_SAFE_INTEGER","idx","i","length","dr","dg","db","d","h","l","s","v","HLStoRGB","p","push","decodeAsync","decode","Decoder","DecoderAsync","Colors_1","__webpack_require__","wasm_1","WASM_BYTES","Buffer","from","bytestring","atob","result","charCodeAt","decodeBase64","LIMITS","BYTES","WASM_MODULE","NULL_CANVAS","CallbackProxy","constructor","this","bandHandler","width","modeHandler","mode","handle_band","mode_parsed","DEFAULT_OPTIONS","memoryLimit","sixelColor","fillColor","paletteLimit","PALETTE_SIZE","truncate","opts","cbProxy","importObj","env","bind","WebAssembly","instantiate","then","inst","instance","_instance","_cbProxy","_PIXEL_OFFSET","MAX_WIDTH","_canvas","_bandWidths","_maxWidth","_minWidth","_lastOffset","_currentHeight","_opts","assign","Error","_handle_band","_initCanvas","Module","Instance","_wasm","_chunk","memory","get_chunk_address","CHUNK_SIZE","_states","get_state_address","_palette","get_palette_address","set","_pSrc","get_p0_address","init","_fillColor","_truncate","_rasterWidth","_rasterHeight","_width","_height","_level","_mode","_paletteLimit","pixels","height","release","_realloc","offset","additionalPixels","newCanvas","ceil","adv","remaining","subarray","current_width","current_height","memoryUsage","byteLength","properties","level","memUsage","rasterAttributes","numerator","denominator","data","start","end","decodeString","j","data32","currentWidth","fill","escape","final","finalOffset","bw","currentHeight","data8","Uint8ClampedArray","dec","async","Lifecycle_1","EventUtils","_listeners","_disposed","event","_event","listener","thisArgs","disposables","toDisposable","entry","fn","slice","indexOf","splice","Array","isArray","add","fire","call","listeners","len","dispose","forward","to","e","map","undefined","any","events","store","DisposableStore","runAndSubscribe","handler","initial","arg","_disposables","Set","_isDisposed","isDisposed","o","clear","Disposable","_store","_register","None","freeze","_value","ImageRenderer_1","ImageStorage_1","Base64Decoder_wasm_1","__importDefault","QoiDecoder_wasm_1","IIPHeaderParser_1","IIPMetrics_1","DEFAULT_HEADER","type","name","size","preserveAspectRatio","inline","_renderer","_storage","_coreTerminal","_generation","_aborted","_hp","HeaderParser","_header","_isMultipart","_abortMulti","maxEncodedBytes","iipSizeLimit","initialBytes","_dec","default","_qoiDec","reset","put","state","dataPos","parse","fields","success","seqType","w","CELL_SIZE_DEFAULT","dimensions","css","canvas","cols","rows","scale","_c","_a","_core","_coreBrowserService","dpr","report","toFixed","input","cond","blob","metrics","UNSUPPORTED_TYPE","imageType","mime","pixelLimit","_resize","floor","ImageData","byteOffset","ImageRenderer","createCanvas","_b","getContext","putImageData","addImage","Blob","generation","createImageBitmap","resizeWidth","resizeHeight","bm","close","catch","cw","cell","ch","_d","rw","_dim","rh","wf","hf","f","total","cdim","endsWith","parseInt","toStr","String","fromCharCode","toInt","toSize","match","DECODERS","toString","bs","TextDecoder","FILE_MARKER","MULTIPARTFILE_MARKER","FILEPART_MARKER","FILEEND_MARKER","REPORTCELLSIZE_MARKER","MAX_FIELDCHARS","_buffer","_position","_key","k","_storeValue","pos","_storeKey","_addImageOpts","scrolling","layer","zIndex","cursorPos","img","d32","blockLength","jpgSize","dim","limit","_layers","get","localDocument","document","createElement","createImageData","ctx","imgData","Promise","resolve","_terminal","super","Map","_optionsRefresh","MutableDisposable","_oldOpen","open","parent","_open","screenElement","optionsService","onOptionChange","option","rescaleCanvas","_renderService","refreshRows","removeLayerFromDom","_oldSetRenderer","setRenderer","_placeholderBitmap","_placeholder","showPlaceholder","cellSize","_createPlaceHolder","clearLines","y","clearRect","_e","clearAll","draw","imgSpec","tileId","col","row","count","_rescaleImage","actual","sourceWidth","sourceHeight","actualCellSize","sx","sy","dx","dy","finalWidth","finalHeight","drawImage","extractTile","drawPlaceholder","values","spec","originalWidth","originalHeight","origCellSize","orig","scaledWidth","scaledHeight","renderer","key","keys","insertLayerToDom","has","classList","style","isolation","insertBefore","firstChild","appendChild","remove","delete","hasLayer","bWidth","blueprint","black","white","shift","x","screen","ctx2","placeholder","bitmap","window","ExtendedAttrsImage","ext","_urlId","_ext","underlineStyle","underlineColor","underlineVariantOffset","val","urlId","imageId","clone","isEmpty","EMPTY_ATTRS","_images","_lastId","_lowestId","_fullyCleared","_needsFullClear","_pixelLimit","setLimit","storageLimit","error","message","getLimit","_viewportMetrics","marker","RangeError","_evictOldest","getUsage","_getStoredPixels","storedPixels","_delImg","id","ImageBitmap","onImageDeleted","wipeAlternate","zero","entries","bufferType","deleteImage","termCols","termRows","originX","originY","tileCount","_inputHandler","_dirtyRowTracker","markDirty","line","lines","ybase","_writeToCell","lineFeed","endMarker","registerMarker","onDispose","active","_evictOnAlternate","onImageAdded","render","range","hasTopImages","hasBottomImages","drawCalls","placeholderCalls","ydisp","getBg","_extendedAttrs","startTile","startCol","sort","viewportResize","oldCol","tilesPerRow","hasData","rightCol","_data","lastTile","expandCol","getImageAtBufferCell","extractTileAtBufferCell","room","used","current","old","oldSpec","imgId","Decoder_1","DEFAULT_PALETTE","convertLe","_size","sixelPaletteLimit","hook","params","attr","colors","bg","isInverse","isFgDefault","foreground","rgba","isFgRGB","t","toColorRGB","getFgColor","ansi","isBgDefault","background","isBgRGB","getBgColor","extractActiveBg","_curAttrData","_themeService","sixelSizeLimit","unhook","advanceCursor","sixelScrolling","KittyGraphicsTypes_1","_kittyStorage","_decodeError","_activeDecoder","_inControlData","_controlData","_controlLength","_encodedSizeLimit","_totalEncodedSize","_parsedCommand","_pendingTransmissions","_maxEncodedBytes","kittySizeLimit","_initialEncodedBytes","_cleanupAllPending","_removePendingEntry","_lastPendingKey","pending","decoder","controlEnd","copyLength","parseKittyCommand","_parseControlDataString","imageNumber","_sendResponse","quiet","action","payloadStart","_streamPayload","pendingKey","previousEncodedSize","totalEncodedSize","decoderToRelease","_f","decoderCapacity","_g","maxPending","oldest","next","cmd","_h","_handleNoPayloadCommand","_handleDelete","isMoreComing","more","decodeError","finalCmd","imageBytes","_handleCommandWithBytesAndCmd","str","fromCodePoint","_handlePlacement","bytes","_handleTransmit","transmission","_handleTransmitDisplay","_handleQuery","image","getImage","_displayImage","placementId","storeImage","format","compression","lastImageId","expectedBytes","deleteSelector","deleteAll","deleteById","isOk","response","coreService","triggerDataEvent","_decodeAndDisplay","_createBitmap","cropX","cropY","cropW","cropH","maxCropW","maxCropH","finalCropW","finalCropH","cropped","imgCols","imgRows","columns","savedX","savedY","savedYbase","scaled","xOffset","yOffset","canvasW","canvasH","offsetCanvas","offsetCtx","offsetBitmap","cursorMovement","scrolled","arrayBuffer","_decompressZlib","url","URL","createObjectURL","Image","reject","addEventListener","revokeObjectURL","src","pixelCount","src32","dst32","alignedPixels","srcOffset","dstOffset","b0","b1","b2","srcByte","dstByte","compressed","_decompress","offsetIn","reader","ReadableStream","pull","controller","enqueue","pipeThrough","DecompressionStream","getReader","chunks","totalLength","done","read","cancel","releaseLock","chunk","images","_kittyIdToStorageId","kittyIdToStorageId","pendingTransmissions","parts","split","part","eqIdx","substring","numValue","KittyImageStorage","_nextImageId","_storageIdToKittyId","_handleStorageImageDeleted","storageId","kittyId","_previousOnImageDeleted","_wrappedOnImageDeleted","imageData","oldStorageId","_maxStoredImages","_evictUndisplayedImages","byteLimit","retainedBytes","evictPlaced","oldestId","wasmDecode","InWasm","MAP","el","D","EMPTY","keepSize","maxBytes","_inst","_ended","_bytes","_m32","_mem","m","grow","Memory","requested","needed","newSize","addPages","loadedBytes","freeBytes","wasmQoiDecode","ib","dl","chunkP","def","W","z","compile","_wasmCtx","fromBase64","__webpack_module_cache__","moduleId","cachedModule","__webpack_modules__","Event_1","IIPHandler_1","KittyGraphicsHandler_1","KittyImageStorage_1","SixelHandler_1","SixelImageStorage_1","IIPImageStorage_1","enableSizeReports","sixelSupport","iipSupport","kittySupport","_handlers","_onImageAdded","Emitter","_defaultOpts","obj","_disposeLater","args","activate","terminal","ImageStorage","windowOps","options","windowOptions","getWinSizePixels","getCellSizePixels","getWinSizeChars","parser","registerCsiHandler","prefix","_decset","_decrst","_da1","_xtermGraphicsAttributes","onRender","intermediates","registerEscHandler","onRequestReset","onBufferChange","onResize","sixelStorage","SixelImageStorage","sixelHandler","SixelHandler","_parser","registerDcsHandler","iipStorage","IIPImageStorage","iipHandler","IIPHandler","registerOscHandler","kittyStorage","kittyHandler","KittyGraphicsHandler","registerApcHandler","storageUsage","_report","sqrt"],"sourceRoot":""}
++{"version":3,"file":"addon-image.js","mappings":";CAAA,SAAAA,EAAAC,GACA,iBAAAC,SAAA,iBAAAC,OACAA,OAAAD,QAAAD,IACA,mBAAAG,QAAAA,OAAAC,IACAD,OAAA,GAAAH,GACA,iBAAAC,QACAA,QAAA,WAAAD,IAEAD,EAAA,WAAAC,GACC,CATD,CASCK,WAAA,uCCKD,SAAAC,EAAAC,GACA,WAAAA,CACA,CAEA,SAAAC,EAAAD,GACA,OAAAA,IAAA,KACA,CAEA,SAAAE,EAAAF,GACA,OAAAA,IAAA,MACA,CASA,SAAAG,EAAAC,EAAAC,EAAAC,EAAAC,EAAA,KACA,YAAAA,IAAA,QAAAD,IAAA,QAAAD,IAAA,MAAAD,KAAA,CACA,CAqCA,SAAAI,EAAAC,EAAAC,EAAAC,GACA,OAAAC,KAAAC,IAAAJ,EAAAG,KAAAE,IAAAH,EAAAD,GACA,CACA,SAAAK,EAAAC,EAAAC,EAAAC,GAKA,OAJAA,EAAA,IACAA,GAAA,GACAA,EAAA,IACAA,GAAA,GACA,EAAAA,EAAA,EACAD,EAAA,GAAAD,EAAAC,GAAAC,EACA,EAAAA,EAAA,EACAF,EACA,EAAAE,EAAA,EACAD,GAAAD,EAAAC,IAAA,IAAAC,GACAD,CACA,CAaA,SAAAE,EAAAf,EAAAC,EAAAC,GACA,kBAAAM,KAAAQ,MAAAd,EAAA,aAAAM,KAAAQ,MAAAf,EAAA,YAAAO,KAAAQ,MAAAhB,EAAA,aACA,CAjGAiB,OAAAC,eAAA5B,EAAA,cAA+CiB,OAAA,IAC/CjB,EAAA6B,mBAA6B7B,EAAA8B,mBAA6B9B,EAAA+B,iBAA2B/B,EAAAgC,mBAA6BhC,EAAAiC,oBAA8BjC,EAAAkC,aAAuBlC,EAAAyB,aAAuBzB,EAAAmC,kBAA4BnC,EAAAoC,aAAuBpC,EAAAS,WAAqBT,EAAAqC,MAAgBrC,EAAAQ,KAAeR,EAAAO,MAAgBP,EAAAK,IAAcL,EAAAsC,gBAAkB,EAGrVtC,EAAAsC,WAAkB,UAAAC,WAAA,IAAAC,YAAA,cAAAC,QAAA,GAClBzC,EAAAsC,YACAI,QAAAC,KAAA,+EAMA3C,EAAAK,IAAWA,EAIXL,EAAAO,MAAaA,EAIbP,EAAAQ,KAAYA,EAIZR,EAAAqC,MAHA,SAAA/B,GACA,OAAAA,IAAA,MACA,EAQAN,EAAAS,WAAkBA,EAOlBT,EAAAoC,aAHA,SAAAQ,GACA,WAAAA,EAAAA,GAAA,MAAAA,GAAA,OAAAA,IAAA,GACA,EA2BA5C,EAAAmC,kBArBA,SAAAS,EAAAC,GACA,MAAAnC,EAAAL,EAAAuC,GACAjC,EAAAJ,EAAAqC,GACAhC,EAAAJ,EAAAoC,GACA,IAAAxB,EAAA0B,OAAAC,iBACAC,GAAA,EAEA,QAAAC,EAAA,EAAoBA,EAAAJ,EAAAK,SAAoBD,EAAA,CACxC,MAAAE,EAAAzC,EAAAmC,EAAAI,GAAA,GACAG,EAAAzC,EAAAkC,EAAAI,GAAA,GACAI,EAAAzC,EAAAiC,EAAAI,GAAA,GACAK,EAAAH,EAAAA,EAAAC,EAAAA,EAAAC,EAAAA,EACA,IAAAC,EACA,OAAAL,EACAK,EAAAlC,IACAA,EAAAkC,EACAN,EAAAC,EAEA,CACA,OAAAD,CACA,EAmCAhD,EAAAyB,aAAoBA,EAQpBzB,EAAAkC,aAJA,SAAAqB,EAAAC,EAAAC,GAEA,OArBA,SAAAF,EAAAC,EAAAC,GACA,IAAAA,EAAA,CACA,MAAAC,EAAAxC,KAAAQ,MAAA,IAAA8B,GACA,OAAA/C,EAAAiD,EAAAA,EAAAA,EACA,CACA,MAAApC,EAAAkC,EAAA,GAAAA,GAAA,EAAAC,GAAAD,EAAAC,EAAAD,EAAAC,EACAlC,EAAA,EAAAiC,EAAAlC,EACA,OAAAb,EAAAK,EAAA,MAAAI,KAAAQ,MAAA,IAAAL,EAAAC,EAAAC,EAAAgC,EAAA,OAAAzC,EAAA,MAAAI,KAAAQ,MAAA,IAAAL,EAAAC,EAAAC,EAAAgC,KAAAzC,EAAA,MAAAI,KAAAQ,MAAA,IAAAL,EAAAC,EAAAC,EAAAgC,EAAA,OACA,CAaAI,EAAAJ,EAAA,SAAAC,EAAA,IAAAC,EAAA,IACA,EA+BAzD,EAAAiC,oBAA2B,IAAAO,YAAA,CAC3Bf,EAAA,OACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,YA0BAzB,EAAAgC,mBAA0B,IAAAQ,YAAA,CAC1Bf,EAAA,OACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,OACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,OACAA,EAAA,UACAA,EAAA,UACAA,EAAA,UACAA,EAAA,OACAA,EAAA,UACAA,EAAA,UACAA,EAAA,YAOAzB,EAAA+B,iBAAwB,MAExB,MAAA6B,EAAA,CACAnD,EAAA,OACAA,EAAA,SACAA,EAAA,SACAA,EAAA,WACAA,EAAA,SACAA,EAAA,WACAA,EAAA,WACAA,EAAA,aACAA,EAAA,aACAA,EAAA,SACAA,EAAA,SACAA,EAAA,WACAA,EAAA,WACAA,EAAA,WACAA,EAAA,WACAA,EAAA,cAGA6C,EAAA,uBACA,QAAA5C,EAAA,EAAoBA,EAAA,IAAOA,EAC3B,QAAAC,EAAA,EAAwBA,EAAA,IAAOA,EAC/B,QAAAC,EAAA,EAA4BA,EAAA,IAAOA,EACnCgD,EAAAC,KAAApD,EAAA6C,EAAA5C,GAAA4C,EAAA3C,GAAA2C,EAAA1C,KAKA,QAAA8C,EAAA,EAAoBA,GAAA,IAAUA,GAAA,GAC9BE,EAAAC,KAAApD,EAAAiD,EAAAA,EAAAA,IAEA,WAAAlB,YAAAoB,EACC,EAlCuB,GA0CxB5D,EAAA8B,mBAA0BrB,EAAA,WAC1BT,EAAA6B,mBAA0BpB,EAAA,6BCpP1BkB,OAAAC,eAAA5B,EAAA,cAA+CiB,OAAA,IAC/CjB,EAAA8D,YAAsB9D,EAAA+D,OAAiB/D,EAAAgE,QAAkBhE,EAAAiE,kBAAoB,EAC7E,MAAAC,EAAiBC,EAAQ,KACzBC,EAAeD,EAAQ,KAavBE,EAXA,SAAAZ,GACA,uBAAAa,OACA,OAAAA,OAAAC,KAAAd,EAAA,UAEA,MAAAe,EAAAC,KAAAhB,GACAiB,EAAA,IAAAnC,WAAAiC,EAAAtB,QACA,QAAAD,EAAA,EAAoBA,EAAAyB,EAAAxB,SAAmBD,EACvCyB,EAAAzB,GAAAuB,EAAAG,WAAA1B,GAEA,OAAAyB,CACA,CACAE,CAAAR,EAAAS,OAAAC,OACA,IAAAC,EAEA,MAAAC,EAAA,IAAAxC,YAEA,MAAAyC,EACA,WAAAC,GACAC,KAAAC,YAAAC,GAAA,EACAF,KAAAG,YAAAC,GAAA,CACA,CACA,WAAAC,CAAAH,GACA,OAAAF,KAAAC,YAAAC,EACA,CACA,WAAAI,CAAAF,GACA,OAAAJ,KAAAG,YAAAC,EACA,EAGA,MAAAG,EAAA,CACAC,YAAA,UACAC,WAAA1B,EAAArC,mBACAgE,UAAA3B,EAAApC,mBACAe,QAAAqB,EAAAjC,oBACA6D,aAAA1B,EAAAS,OAAAkB,aACAC,UAAA,GAMA,SAAA/B,EAAAgC,GACA,MAAAC,EAAA,IAAAjB,EACAkB,EAAA,CACAC,IAAA,CACAZ,YAAAU,EAAAV,YAAAa,KAAAH,GACAT,YAAAS,EAAAT,YAAAY,KAAAH,KAGA,OAAAI,YAAAC,YAAAxB,GAAAV,EAAA8B,GACAK,KAAAC,IACA1B,EAAAA,GAAA0B,EAAAxG,OACA,IAAA+D,EAAAiC,EAAAQ,EAAAC,UAAAD,EAAAP,IAEA,CACAlG,EAAAiE,aAAoBA,EAiCpB,MAAAD,EAKA,WAAAkB,CAAAe,EAAAU,EAAAC,GASA,GARAzB,KAAA0B,cAAAzC,EAAAS,OAAAiC,UAAA,EACA3B,KAAA4B,QAAA/B,EACAG,KAAA6B,YAAA,GACA7B,KAAA8B,UAAA,EACA9B,KAAA+B,UAAA9C,EAAAS,OAAAiC,UACA3B,KAAAgC,YAAA,EACAhC,KAAAiC,eAAA,EACAjC,KAAAkC,MAAA1F,OAAA2F,OAAA,GAAqC5B,EAAAO,GACrCd,KAAAkC,MAAAvB,aAAA1B,EAAAS,OAAAkB,aACA,UAAAwB,MAAA,+CAA2EnD,EAAAS,OAAAkB,gBAE3E,GAAAY,EAUAC,EAAAxB,YAAAD,KAAAqC,aAAAnB,KAAAlB,MACAyB,EAAAtB,YAAAH,KAAAsC,YAAApB,KAAAlB,UAXA,CACA,MAAAlF,EAAA8E,IAAAA,EAAA,IAAAuB,YAAAoB,OAAArD,IACAsC,EAAA,IAAAL,YAAAqB,SAAA1H,EAAA,CACAmG,IAAA,CACAZ,YAAAL,KAAAqC,aAAAnB,KAAAlB,MACAM,YAAAN,KAAAsC,YAAApB,KAAAlB,QAGA,CAKAA,KAAAwB,UAAAA,EACAxB,KAAAyC,MAAAzC,KAAAwB,UAAA3G,QACAmF,KAAA0C,OAAA,IAAAtF,WAAA4C,KAAAyC,MAAAE,OAAArF,OAAA0C,KAAAyC,MAAAG,oBAAA3D,EAAAS,OAAAmD,YACA7C,KAAA8C,QAAA,IAAAzF,YAAA2C,KAAAyC,MAAAE,OAAArF,OAAA0C,KAAAyC,MAAAM,oBAAA,IACA/C,KAAAgD,SAAA,IAAA3F,YAAA2C,KAAAyC,MAAAE,OAAArF,OAAA0C,KAAAyC,MAAAQ,sBAAAhE,EAAAS,OAAAkB,cACAZ,KAAAgD,SAAAE,IAAAlD,KAAAkC,MAAAxE,SACAsC,KAAAmD,MAAA,IAAA9F,YAAA2C,KAAAyC,MAAAE,OAAArF,OAAA0C,KAAAyC,MAAAW,kBACApD,KAAAyC,MAAAY,KAAAtE,EAAArC,mBAAA,EAAAsD,KAAAkC,MAAAvB,aAAA,EACA,CAEA,cAAA2C,GAAuB,OAAAtD,KAAA8C,QAAA,GACvB,aAAAS,GAAsB,OAAAvD,KAAA8C,QAAA,GACtB,gBAAAU,GAAyB,OAAAxD,KAAA8C,QAAA,GACzB,iBAAAW,GAA0B,OAAAzD,KAAA8C,QAAA,GAC1B,UAAAY,GAAmB,OAAA1D,KAAA8C,QAAA,GAAA9C,KAAA8C,QAAA,OACnB,WAAAa,GAAoB,OAAA3D,KAAA8C,QAAA,GACpB,UAAAc,GAAmB,OAAA5D,KAAA8C,QAAA,GACnB,SAAAe,GAAkB,OAAA7D,KAAA8C,QAAA,IAClB,iBAAAgB,GAA0B,OAAA9D,KAAA8C,QAAA,IAC1B,WAAAR,CAAAlC,GACA,OAAAA,EAAA,CACA,MAAA2D,EAAA/D,KAAAE,MAAAF,KAAAgE,OACA,GAAAD,EAAA/D,KAAA4B,QAAA7D,OAAA,CACA,GAAAiC,KAAAkC,MAAA1B,aAAA,EAAAuD,EAAA/D,KAAAkC,MAAA1B,YAEA,MADAR,KAAAiE,UACA,IAAA7B,MAAA,8BAEApC,KAAA4B,QAAA,IAAAvE,YAAA0G,EACA,CACA/D,KAAA8B,UAAA9B,KAAA0D,MACA,MACA,OAAAtD,EACA,OAAAJ,KAAA4D,OAAA,CAEA,MAAAG,EAAAhI,KAAAE,IAAA+D,KAAAwD,aAAAvE,EAAAS,OAAAiC,WAAA3B,KAAAyD,cACA,GAAAM,EAAA/D,KAAA4B,QAAA7D,OAAA,CACA,GAAAiC,KAAAkC,MAAA1B,aAAA,EAAAuD,EAAA/D,KAAAkC,MAAA1B,YAEA,MADAR,KAAAiE,UACA,IAAA7B,MAAA,8BAEApC,KAAA4B,QAAA,IAAAvE,YAAA0G,EACA,CACA,MAGA/D,KAAA4B,QAAA7D,OAAA,QACAiC,KAAA4B,QAAA,IAAAvE,YAAA,QAIA,QACA,CACA,QAAA6G,CAAAC,EAAAC,GACA,MAAAL,EAAAI,EAAAC,EACA,GAAAL,EAAA/D,KAAA4B,QAAA7D,OAAA,CACA,GAAAiC,KAAAkC,MAAA1B,aAAA,EAAAuD,EAAA/D,KAAAkC,MAAA1B,YAEA,MADAR,KAAAiE,UACA,IAAA7B,MAAA,8BAGA,MAAAiC,EAAA,IAAAhH,YAAA,MAAAtB,KAAAuI,KAAAP,EAAA,QACAM,EAAAnB,IAAAlD,KAAA4B,SACA5B,KAAA4B,QAAAyC,CACA,CACA,CACA,YAAAhC,CAAAnC,GACA,MAAAqE,EAAAvE,KAAA0B,cACA,IAAAyC,EAAAnE,KAAAgC,YACA,OAAAhC,KAAA6D,MAAA,CACA,IAAAW,EAAAxE,KAAAgE,OAAAhE,KAAAiC,eACA5F,EAAA,EACA,KAAAA,EAAA,GAAAmI,EAAA,GACAxE,KAAA4B,QAAAsB,IAAAlD,KAAAmD,MAAAsB,SAAAF,EAAAlI,EAAAkI,EAAAlI,EAAA6D,GAAAiE,EAAAjE,EAAA7D,GACAA,IACAmI,IAEAxE,KAAAgC,aAAA9B,EAAA7D,EACA2D,KAAAiC,gBAAA5F,CACA,MACA,OAAA2D,KAAA6D,MAAA,CACA7D,KAAAkE,SAAAC,EAAA,EAAAjE,GACAF,KAAA8B,UAAA/F,KAAAC,IAAAgE,KAAA8B,UAAA5B,GACAF,KAAA+B,UAAAhG,KAAAE,IAAA+D,KAAA+B,UAAA7B,GACA,QAAApC,EAAA,EAA4BA,EAAA,IAAOA,EACnCkC,KAAA4B,QAAAsB,IAAAlD,KAAAmD,MAAAsB,SAAAF,EAAAzG,EAAAyG,EAAAzG,EAAAoC,GAAAiE,EAAAjE,EAAApC,GAEAkC,KAAA6B,YAAAnD,KAAAwB,GACAF,KAAAgC,aAAA,EAAA9B,EACAF,KAAAiC,gBAAA,CACA,CACA,QACA,CAMA,SAAA/B,GACA,WAAAF,KAAA6D,MACA7D,KAAA0D,OACA3H,KAAAC,IAAAgE,KAAA8B,UAAA9B,KAAAyC,MAAAiC,gBACA,CAMA,UAAAV,GACA,WAAAhE,KAAA6D,MACA7D,KAAA2D,QACA3D,KAAAyC,MAAAiC,gBACA,EAAA1E,KAAA6B,YAAA9D,OAAAiC,KAAAyC,MAAAkC,iBACA,EAAA3E,KAAA6B,YAAA9D,MACA,CAIA,WAAAL,GACA,OAAAsC,KAAAgD,SAAAyB,SAAA,EAAAzE,KAAA8D,cACA,CAUA,eAAAc,GACA,OAAA5E,KAAA4B,QAAAiD,WAAA7E,KAAAyC,MAAAE,OAAArF,OAAAuH,WAAA,EAAA7E,KAAA6B,YAAA9D,MACA,CAIA,cAAA+G,GACA,OACA5E,MAAAF,KAAAE,MACA8D,OAAAhE,KAAAgE,OACA5D,KAAAJ,KAAA6D,MACAkB,MAAA/E,KAAA4D,OACA/C,WAAAb,KAAAuD,UACA5C,aAAAX,KAAA8D,cACApD,UAAAV,KAAAsD,WACA0B,SAAAhF,KAAA4E,YACAK,iBAAA,CACAC,UAAAlF,KAAA8C,QAAA,GACAqC,YAAAnF,KAAA8C,QAAA,GACA5C,MAAAF,KAAAwD,aACAQ,OAAAhE,KAAAyD,eAGA,CAMA,IAAAJ,CAAA3C,EAAAV,KAAAkC,MAAAxB,UAAAhD,EAAAsC,KAAAkC,MAAAxE,QAAAiD,EAAAX,KAAAkC,MAAAvB,aAAAE,EAAAb,KAAAkC,MAAArB,UACAb,KAAAyC,MAAAY,KAAArD,KAAAkC,MAAAzB,WAAAC,EAAAC,EAAAE,EAAA,KACAnD,GACAsC,KAAAgD,SAAAE,IAAAxF,EAAA+G,SAAA,EAAAxF,EAAAS,OAAAkB,eAEAZ,KAAA6B,YAAA9D,OAAA,EACAiC,KAAA8B,UAAA,EACA9B,KAAA+B,UAAA9C,EAAAS,OAAAiC,UACA3B,KAAAgC,YAAA,EACAhC,KAAAiC,eAAA,CACA,CAKA,MAAArD,CAAAwG,EAAAC,EAAA,EAAAC,EAAAF,EAAArH,QACA,IAAAU,EAAA4G,EACA,KAAA5G,EAAA6G,GAAA,CACA,MAAAvH,EAAAhC,KAAAE,IAAAqJ,EAAA7G,EAAAQ,EAAAS,OAAAmD,YACA7C,KAAA0C,OAAAQ,IAAAkC,EAAAX,SAAAhG,EAAAA,GAAAV,IACAiC,KAAAyC,MAAA7D,OAAA,EAAAb,EACA,CACA,CAMA,YAAAwH,CAAAH,EAAAC,EAAA,EAAAC,EAAAF,EAAArH,QACA,IAAAU,EAAA4G,EACA,KAAA5G,EAAA6G,GAAA,CACA,MAAAvH,EAAAhC,KAAAE,IAAAqJ,EAAA7G,EAAAQ,EAAAS,OAAAmD,YACA,QAAA/E,EAAA,EAAA0H,EAAA/G,EAAmCX,EAAAC,IAAYD,IAAA0H,EAC/CxF,KAAA0C,OAAA5E,GAAAsH,EAAA5F,WAAAgG,GAEA/G,GAAAV,EACAiC,KAAAyC,MAAA7D,OAAA,EAAAb,EACA,CACA,CAKA,UAAA0H,GACA,OAAAzF,KAAA6D,QAAA7D,KAAAE,QAAAF,KAAAgE,OACA,OAAAnE,EAGA,MAAA6F,EAAA1F,KAAAyC,MAAAiC,gBACA,OAAA1E,KAAA6D,MAAA,CACA,IAAAW,EAAAxE,KAAAgE,OAAAhE,KAAAiC,eACA,GAAAuC,EAAA,GACA,MAAAD,EAAAvE,KAAA0B,cACA,IAAAyC,EAAAnE,KAAAgC,YACA3F,EAAA,EACA,KAAAA,EAAA,GAAAmI,EAAA,GACAxE,KAAA4B,QAAAsB,IAAAlD,KAAAmD,MAAAsB,SAAAF,EAAAlI,EAAAkI,EAAAlI,EAAAqJ,GAAAvB,EAAAuB,EAAArJ,GACAA,IACAmI,IAEAA,GACAxE,KAAA4B,QAAA+D,KAAA3F,KAAAsD,WAAAa,EAAAuB,EAAArJ,EAEA,CACA,OAAA2D,KAAA4B,QAAA6C,SAAA,EAAAzE,KAAAE,MAAAF,KAAAgE,OACA,CACA,OAAAhE,KAAA6D,MAAA,CACA,GAAA7D,KAAA+B,YAAA/B,KAAA8B,UAAA,CACA,IAAA8D,GAAA,EACA,GAAAF,EACA,GAAAA,IAAA1F,KAAA+B,UACA6D,GAAA,MAEA,CACA,MAAArB,EAAAvE,KAAA0B,cACA,IAAAyC,EAAAnE,KAAAgC,YACAhC,KAAAkE,SAAAC,EAAA,EAAAuB,GACA,QAAA5H,EAAA,EAAwCA,EAAA,IAAOA,EAC/CkC,KAAA4B,QAAAsB,IAAAlD,KAAAmD,MAAAsB,SAAAF,EAAAzG,EAAAyG,EAAAzG,EAAA4H,GAAAvB,EAAAuB,EAAA5H,EAEA,CAEA,IAAA8H,EACA,OAAA5F,KAAA4B,QAAA6C,SAAA,EAAAzE,KAAAE,MAAAF,KAAAgE,OAEA,CAGA,MAAA6B,EAAA,IAAAxI,YAAA2C,KAAAE,MAAAF,KAAAgE,QACA6B,EAAAF,KAAA3F,KAAAsD,YACA,IAAAwC,EAAA,EACAT,EAAA,EACA,QAAAvH,EAAA,EAA4BA,EAAAkC,KAAA6B,YAAA9D,SAA6BD,EAAA,CACzD,MAAAiI,EAAA/F,KAAA6B,YAAA/D,GACA,QAAAW,EAAA,EAAgCA,EAAA,IAAOA,EACvCoH,EAAA3C,IAAAlD,KAAA4B,QAAA6C,SAAAY,EAAAA,GAAAU,GAAAD,GACAA,GAAA9F,KAAAE,KAEA,CAEA,GAAAwF,EAAA,CACA,MAAAnB,EAAAvE,KAAA0B,cAEAsE,EAAAhG,KAAAyC,MAAAkC,iBACA,QAAA7G,EAAA,EAAgCA,EAAAkI,IAAmBlI,EACnD+H,EAAA3C,IAAAlD,KAAAmD,MAAAsB,SAAAF,EAAAzG,EAAAyG,EAAAzG,EAAA4H,GAAAI,EAAA9F,KAAAE,MAAApC,EAEA,CACA,OAAA+H,CACA,CAEA,OAAAhG,CACA,CAKA,SAAAoG,GACA,WAAAC,kBAAAlG,KAAAyF,OAAAnI,OAAA,EAAA0C,KAAAE,MAAAF,KAAAgE,OAAA,EACA,CAaA,OAAAC,GACAjE,KAAA4B,QAAA/B,EACAG,KAAA6B,YAAA9D,OAAA,EACAiC,KAAA8B,UAAA,EACA9B,KAAA+B,UAAA9C,EAAAS,OAAAiC,UAGA3B,KAAAyC,MAAAY,KAAAtE,EAAArC,mBAAA,EAAAsD,KAAAkC,MAAAvB,aAAA,EACA,EAEA9F,EAAAgE,QAAeA,EAyBfhE,EAAA+D,OAXA,SAAAwG,EAAAtE,GACA,MAAAqF,EAAA,IAAAtH,EAAAiC,GAGA,OAFAqF,EAAA9C,OACA,iBAAA+B,EAAAe,EAAAZ,aAAAH,GAAAe,EAAAvH,OAAAwG,GACA,CACAlF,MAAAiG,EAAAjG,MACA8D,OAAAmC,EAAAnC,OACAyB,OAAAU,EAAAV,OACAQ,MAAAE,EAAAF,MAEA,EAkBApL,EAAA8D,YAXAyH,eAAAhB,EAAAtE,GACA,MAAAqF,QAAArH,EAAAgC,GAGA,OAFAqF,EAAA9C,OACA,iBAAA+B,EAAAe,EAAAZ,aAAAH,GAAAe,EAAAvH,OAAAwG,GACA,CACAlF,MAAAiG,EAAAjG,MACA8D,OAAAmC,EAAAnC,OACAyB,OAAAU,EAAAV,OACAQ,MAAAE,EAAAF,MAEA,YCpdAzJ,OAAAC,eAAA5B,EAAA,cAA+CiB,OAAA,IAC/CjB,EAAA6E,YAAc,EACd7E,EAAA6E,OAAc,CACdmD,WAAA,MACAjC,aAAA,KACAe,UAAA,MACAhC,MAAA,+qdCCA,MAAA0G,EAAArH,EAAA,KAoEA,IAAiBsH,YA9DjB,iBAAAvG,GACUC,KAAAuG,WAAqD,GACrDvG,KAAAwG,WAAY,CA0DtB,CAvDE,SAAWC,GACT,OAAIzG,KAAK0G,SAGT1G,KAAK0G,OAAS,CAACC,EAAyBC,EAAgBC,KACtD,GAAI7G,KAAKwG,UACP,OAAO,EAAAH,EAAAS,cAAa,QAGtB,MAAMC,EAAQ,CAAEC,GAAIL,EAAUC,YAC9B5G,KAAKuG,WAAavG,KAAKuG,WAAWU,QAClCjH,KAAKuG,WAAW7H,KAAKqI,GAErB,MAAMxH,GAAS,EAAA8G,EAAAS,cAAa,KAC1B,MAAMjJ,EAAMmC,KAAKuG,WAAWW,QAAQH,IACvB,IAATlJ,IACFmC,KAAKuG,WAAavG,KAAKuG,WAAWU,QAClCjH,KAAKuG,WAAWY,OAAOtJ,EAAK,MAYhC,OARIgJ,IACEO,MAAMC,QAAQR,GAChBA,EAAYnI,KAAKa,GAEjBsH,EAAYS,IAAI/H,IAIbA,IA3BAS,KAAK0G,MA8BhB,CAEO,IAAAa,CAAKd,GACV,GAAIzG,KAAKwG,YAAcxG,KAAKuG,WAAWxI,OACrC,OAEF,GAA+B,IAA3BiC,KAAKuG,WAAWxI,OAElB,YADAiC,KAAKuG,WAAW,GAAGS,GAAGQ,KAAKxH,KAAKuG,WAAW,GAAGK,SAAUH,GAG1D,MAAMgB,EAAYzH,KAAKuG,WACvB,IAAK,IAAIzI,EAAI,EAAG4J,EAAMD,EAAU1J,OAAQD,EAAI4J,IAAO5J,EACjD2J,EAAU3J,GAAGkJ,GAAGQ,KAAKC,EAAU3J,GAAG8I,SAAUH,EAEhD,CAEO,OAAAkB,GACD3H,KAAKwG,YAGTxG,KAAKwG,WAAY,EACjBxG,KAAKuG,WAAWxI,OAAS,EAC3B,GAGF,SAAiBuI,GACCA,EAAAsB,QAAhB,SAA2BxI,EAAiByI,GAC1C,OAAOzI,EAAK0I,GAAKD,EAAGN,KAAKO,GAC3B,EAEgBxB,EAAAyB,IAAhB,SAA0BtB,EAAkBsB,GAC1C,MAAO,CAACpB,EAAyBC,EAAgBC,IACxCJ,EAAM3I,GAAK6I,EAASa,KAAKZ,EAAUmB,EAAIjK,SAAKkK,EAAWnB,EAElE,EAIgBP,EAAA2B,IAAhB,YAA0BC,GACxB,MAAO,CAACvB,EAAyBC,EAAgBC,KAC/C,MAAMsB,EAAQ,IAAI9B,EAAA+B,gBAClB,IAAK,MAAM3B,KAASyB,EAClBC,EAAMb,IAAIb,EAAMqB,GAAKnB,EAASa,KAAKZ,EAAUkB,KAS/C,OAPIjB,IACEO,MAAMC,QAAQR,GAChBA,EAAYnI,KAAKyJ,GAEjBtB,EAAYS,IAAIa,IAGbA,EAEX,EAIgB7B,EAAA+B,gBAAhB,SAAmC5B,EAAkB6B,EAAqCC,GAExF,OADAD,EAAQC,GACD9B,EAAMqB,GAAKQ,EAAQR,GAC5B,CACD,CApCD,CAAiBxB,IAAUzL,EAAAyL,WAAVA,EAAU,eChE3B,SAAAQ,EAA6BE,GAC3B,MAAO,CAAEW,QAASX,EACpB,CAKA,SAAAW,EAA+Ca,GAC7C,IAAKA,EACH,OAAOA,EAET,GAAIpB,MAAMC,QAAQmB,GAAM,CACtB,IAAK,MAAMrK,KAAKqK,EACdrK,EAAEwJ,UAEJ,MAAO,EACT,CAEA,OADAa,EAAIb,UACGa,CACT,8JAEA,YAAsC3B,GACpC,OAAOC,EAAa,IAAMa,EAAQd,GACpC,EAEA,MAAAuB,EAAA,WAAArI,GACmBC,KAAAyI,aAAe,IAAIC,IAC5B1I,KAAA2I,aAAc,CAgCxB,CA9BE,cAAWC,GACT,OAAO5I,KAAK2I,WACd,CAEO,GAAArB,CAA2BuB,GAMhC,OALI7I,KAAK2I,YACPE,EAAElB,UAEF3H,KAAKyI,aAAanB,IAAIuB,GAEjBA,CACT,CAEO,OAAAlB,GACL,IAAI3H,KAAK2I,YAAT,CAGA3I,KAAK2I,aAAc,EACnB,IAAK,MAAMxK,KAAK6B,KAAKyI,aACnBtK,EAAEwJ,UAEJ3H,KAAKyI,aAAaK,OALlB,CAMF,CAEO,KAAAA,GACL,IAAK,MAAM3K,KAAK6B,KAAKyI,aACnBtK,EAAEwJ,UAEJ3H,KAAKyI,aAAaK,OACpB,sBAGF,MAAAC,EAAA,WAAAhJ,GAGqBC,KAAAgJ,OAAS,IAAIZ,CASlC,CAPS,OAAAT,GACL3H,KAAKgJ,OAAOrB,SACd,CAEU,SAAAsB,CAAiCJ,GACzC,OAAO7I,KAAKgJ,OAAO1B,IAAIuB,EACzB,iBAVuBE,EAAAG,KAAoB1M,OAAO2M,OAAO,CAAE,OAAAxB,GAAY,wBAazE,iBAAA5H,GAEUC,KAAA2I,aAAc,CAuBxB,CArBE,SAAW7M,GACT,OAAOkE,KAAK2I,iBAAcX,EAAYhI,KAAKoJ,MAC7C,CAEA,SAAWtN,CAAMA,GACXkE,KAAK2I,aAAe7M,IAAUkE,KAAKoJ,SAGvCpJ,KAAKoJ,QAAQzB,UACb3H,KAAKoJ,OAAStN,EAChB,CAEO,KAAAgN,GACL9I,KAAKlE,WAAQkM,CACf,CAEO,OAAAL,GACL3H,KAAK2I,aAAc,EACnB3I,KAAKoJ,QAAQzB,UACb3H,KAAKoJ,YAASpB,CAChB,wKC1GF,MAAAqB,EAAArK,EAAA,KAEAsK,EAAAtK,EAAA,KACAuK,EAAAC,EAAAxK,EAAA,MACAyK,EAAAD,EAAAxK,EAAA,KACA0K,EAAA1K,EAAA,KACA2K,EAAA3K,EAAA,KAeM4K,EAAgC,CACpCC,KAAI,EACJC,KAAM,eACNC,KAAM,EACN7J,MAAO,OACP8D,OAAQ,OACRgG,oBAAqB,EACrBC,OAAQ,gBAIV,MAUE,WAAAlK,CACmBmC,EACAgI,EACAC,EACAC,GAHApK,KAAAkC,MAAAA,EACAlC,KAAAkK,UAAAA,EACAlK,KAAAmK,SAAAA,EACAnK,KAAAoK,cAAAA,EAbXpK,KAAAqK,YAAc,EACdrK,KAAAsK,UAAW,EACXtK,KAAAuK,IAAM,IAAIb,EAAAc,aACVxK,KAAAyK,QAAyBb,EAGzB5J,KAAA0K,cAAe,EACf1K,KAAA2K,aAAc,EAQpB,MAAMC,EAAkB7O,KAAKuI,KAA+B,EAA1BtE,KAAKkC,MAAM2I,aAAmB,GAC1DC,EAAe/O,KAAKE,IAAG,QAA4B2O,GACzD5K,KAAK+K,KAAO,IAAIxB,EAAAyB,QAAa,EAAyBJ,EAAiBE,GACvE9K,KAAKiL,QAAU,IAAIxB,EAAAuB,QAAU,EAC/B,CAEO,KAAAE,GACLlL,KAAKqK,cACLrK,KAAKuK,IAAIW,QACTlL,KAAK+K,KAAK9G,UACVjE,KAAKiL,QAAQhH,SACf,CAEO,KAAAoB,GACLrF,KAAKsK,UAAW,EAChBtK,KAAKuK,IAAIW,OACX,CAEO,GAAAC,CAAI/F,EAAmBC,EAAeC,GAC3C,IAAItF,KAAKsK,SAET,GAAkB,IAAdtK,KAAKuK,IAAIa,MAC6C,IAAnDpL,KAAK+K,KAAKI,IAAI/F,EAAKX,SAASY,EAAOC,MACtCtF,KAAK+K,KAAK9G,UACVjE,KAAKsK,UAAW,OAEb,CACL,MAAMe,EAAUrL,KAAKuK,IAAIe,MAAMlG,EAAMC,EAAOC,GAC5C,IAAiB,IAAb+F,EAEF,YADArL,KAAKsK,UAAW,GAGlB,GAAIe,EAAU,EAAG,CAEf,GAAW,IADKrL,KAAKuK,IAAIgB,OAAO1B,KACG,CAOjC,GANI7J,KAAK0K,eACP1K,KAAK0K,cAAe,EACpB1K,KAAK2K,aAAc,EACnB3K,KAAK+K,KAAK9G,WAEZjE,KAAKyK,QAAUjO,OAAO2F,OAAO,GAAIyH,EAAgB5J,KAAKuK,IAAIgB,SACrDvL,KAAKyK,QAAQR,OAEhB,YADAjK,KAAKsK,UAAW,GAGlB,IAAKtK,KAAKwL,eAER,YADAxL,KAAKsK,UAAW,EAGpB,MAAO,GAAItK,KAAK2K,YAEd,YADA3K,KAAKsK,UAAW,GAGwC,IAArDtK,KAAK+K,KAAKI,IAAI/F,EAAKX,SAAS4G,EAAS/F,MACxCtF,KAAK+K,KAAK9G,UACVjE,KAAKsK,UAAW,EACZtK,KAAK0K,eAAc1K,KAAK2K,aAAc,GAE9C,CACF,CACF,CAEO,GAAArF,CAAImG,aACT,GAAIzL,KAAKsK,SAAU,OAAO,EAE1B,GAAkB,IAAdtK,KAAKuK,IAAIa,OACPpL,KAAKuK,IAAIjF,MAAO,OAAO,EAE7B,MAAMoG,EAAU1L,KAAKuK,IAAIgB,OAAO1B,KAEhC,GAAW,IAAP6B,EAAmC,OAAO,EAE9C,GAAW,IAAPA,EAAyC,CAE3C,IAAIC,EAAIrC,EAAAsC,kBAAkB1L,MACtB9B,EAAIkL,EAAAsC,kBAAkB5H,OACtBhE,KAAKkK,UAAU2B,aACjBF,EAAI3L,KAAKkK,UAAU2B,WAAWC,IAAIC,OAAO7L,MAAQF,KAAKoK,cAAc4B,KACpE5N,EAAI4B,KAAKkK,UAAU2B,WAAWC,IAAIC,OAAO/H,OAAShE,KAAKoK,cAAc6B,MAEvE,MAAMC,EAAyD,QAApDC,EAA+C,QAA5CC,EAAApM,KAAKoK,cAAciC,MAAMC,2BAAmB,IAAAF,OAAA,EAAAA,EAAEG,WAAG,IAAAJ,EAAAA,EAAI,EAC7DK,EAAS,yBAA4BpO,EAAEqO,QAAQ,MAAMd,EAAEc,QAAQ,MAAMP,EAAMO,QAAQ,QAEzF,OADAzM,KAAKoK,cAAcsC,MAAMF,GAAQ,IAC1B,CACT,CAEA,GAAW,IAAPd,EAQF,OAPA1L,KAAKyK,QAAUjO,OAAO2F,OAAO,GAAIyH,EAAgB5J,KAAKuK,IAAIgB,QAC1DvL,KAAK0K,cAAe,EACpB1K,KAAK2K,aAAc,EACnB3K,KAAK+K,KAAK9G,UACLjE,KAAKwL,iBACRxL,KAAK2K,aAAc,IAEd,EAGT,GAAW,IAAPe,EAAkC,CACpC,IAAK1L,KAAK0K,aAAc,OAAO,EAE/B,GADA1K,KAAK0K,cAAe,EAChB1K,KAAK2K,aAAgC,IAAjB3K,KAAKyK,QAAQZ,KAAqC,OAAO,CACnF,CAIA,IAII8C,EA0BAC,EA9BAjB,EAAI,EACJvN,EAAI,EAIJyO,EAAUlD,EAAAmD,iBAoBd,IAnBIH,EAAOlB,MACLkB,GAAQ3M,KAAK+K,KAAKzF,QACpBuH,GAAU,EAAAlD,EAAAoD,WAAU/M,KAAK+K,KAAK9E,QAC1B0G,EAAwB,gBAAjBE,EAAQG,OACjBrB,EAAIkB,EAAQ3M,MACZ9B,EAAIyO,EAAQ7I,QACR2I,EAAOhB,GAAKvN,GAAKuN,EAAIvN,EAAI4B,KAAKkC,MAAM+K,cACrCtB,EAAGvN,GAAK4B,KAAKkN,QAAQvB,EAAGvN,GAAG2J,IAAIhM,KAAKoR,OACrCR,EAAOhB,GAAKvN,GAAKuN,EAAIvN,EAAI4B,KAAKkC,MAAM+K,YAEpC1P,QAAQC,KAAK,8BAA8BqP,EAAQ3M,SAAS2M,EAAQ7I,WAGtEzG,QAAQC,KAAK,gCAGfD,QAAQC,KAAK,uCAGZmP,EAEH,OADA3M,KAAK+K,KAAK9G,WACH,EAIT,GAAqB,cAAjB4I,EAAQG,KAAsB,CAChC,IAAI5H,EACJ,IACEA,EAAOpF,KAAKiL,QAAQrM,OAAOoB,KAAK+K,KAAK9E,MACvC,CAAE,MAAO6B,GAIP,OAHAvK,QAAQC,KAAK,kCAAmCsK,GAChD9H,KAAK+K,KAAK9G,UACVjE,KAAKiL,QAAQhH,WACN,CACT,CAOA,GANA2I,EAAO,IAAIQ,UACT,IAAIlH,kBAAkBd,EAAK9H,OAAQ8H,EAAKiI,WAAYjI,EAAKP,YACzD7E,KAAKiL,QAAQ/K,MACbF,KAAKiL,QAAQjH,QAEfhE,KAAKiL,QAAQhH,UACT0H,IAAM3L,KAAKiL,QAAQ/K,OAAS9B,IAAM4B,KAAKiL,QAAQjH,OAAQ,CAEzDhE,KAAK+K,KAAK9G,UACV,MAAM8H,EAAS1C,EAAAiE,cAAcC,kBAAavF,EAAWhI,KAAKiL,QAAQ/K,MAAOF,KAAKiL,QAAQjH,QAGtF,OAFuB,QAAvBwJ,EAAAzB,EAAO0B,WAAW,aAAK,IAAAD,GAAAA,EAAEE,aAAad,EAAM,EAAG,GAC/C5M,KAAKmK,SAASwD,SAAS5B,IAChB,CACT,CACF,MACEa,EAAO,IAAIgB,KAAK,CAAC5N,KAAK+K,KAAK9E,OAAQ,CAAE4D,KAAMgD,EAAQG,OAErDhN,KAAK+K,KAAK9G,UACV,MAAM4J,EAAa7N,KAAKqK,YACxB,OAAOyD,kBAAkBlB,EAAM,CAAEmB,YAAapC,EAAGqC,aAAc5P,IAC5DiD,KAAK4M,GACAJ,IAAe7N,KAAKqK,aACtB4D,EAAGC,SACI,IAETlO,KAAKmK,SAASwD,SAASM,IAChB,IAERE,MAAMrG,IACLvK,QAAQC,KAAK,uBAAuBqP,EAAQG,QAAQH,EAAQ3M,SAAS2M,EAAQ7I,SAAU8D,IAChF,GAEb,CAGQ,YAAA0D,GACN,IAEE,OADAxL,KAAK+K,KAAK1H,QACH,CACT,CAAE,MAAOyE,GAGP,OAFAvK,QAAQC,KAAK,kCAAmCsK,GAChD9H,KAAK+K,KAAK9G,WACH,CACT,CACF,CAEQ,OAAAiJ,CAAQvB,EAAWvN,eACzB,MAAMgQ,GAA8B,QAAzBhC,EAAApM,KAAKkK,UAAU2B,kBAAU,IAAAO,OAAA,EAAAA,EAAEN,IAAIuC,KAAKnO,QAASoJ,EAAAsC,kBAAkB1L,MACpEoO,GAA8B,QAAzBd,EAAAxN,KAAKkK,UAAU2B,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIuC,KAAKrK,SAAUsF,EAAAsC,kBAAkB5H,OACrE9D,GAAiC,QAAzBiM,EAAAnM,KAAKkK,UAAU2B,kBAAU,IAAAM,OAAA,EAAAA,EAAEL,IAAIC,OAAO7L,QAASkO,EAAKpO,KAAKoK,cAAc4B,KAC/EhI,GAAkC,QAAzBuK,EAAAvO,KAAKkK,UAAU2B,kBAAU,IAAA0C,OAAA,EAAAA,EAAEzC,IAAIC,OAAO/H,SAAUsK,EAAKtO,KAAKoK,cAAc6B,KAEjFuC,EAAKxO,KAAKyO,KAAKzO,KAAKyK,QAAQvK,MAAQA,EAAOkO,GAC3CM,EAAK1O,KAAKyO,KAAKzO,KAAKyK,QAAQzG,OAASA,EAAQsK,GACnD,IAAKE,IAAOE,EAAI,CACd,MAAMC,EAAKzO,EAAQyL,EACbiD,GAAM5K,EAASsK,GAAMlQ,EACrByQ,EAAI9S,KAAKE,IAAI0S,EAAIC,GACvB,OAAOC,EAAI,EAAI,CAAClD,EAAIkD,EAAGzQ,EAAIyQ,GAAK,CAAClD,EAAGvN,EACtC,CACA,OAAQoQ,GAEJxO,KAAKyK,QAAQT,qBAAwBwE,GAAOE,EACvB,CAACF,EAAIE,GAAxB,CAACF,EAAIpQ,EAAIoQ,EAAK7C,GAFhB,CAACA,EAAI+C,EAAKtQ,EAAGsQ,EAGnB,CAEQ,IAAAD,CAAKnQ,EAAWwQ,EAAeC,GACrC,MAAU,SAANzQ,EAAqB,EACrBA,EAAE0Q,SAAS,KAAaC,SAAS3Q,EAAE2I,MAAM,GAAI,GAAI,IAAM6H,EAAQ,IAC/DxQ,EAAE0Q,SAAS,MAAcC,SAAS3Q,EAAE2I,MAAM,GAAI,GAAI,IAC/CgI,SAAS3Q,EAAG,IAAMyQ,CAC3B,aC1NF,SAASG,EAAM9J,GACb,IAAI9G,EAAI,GACR,IAAK,IAAIR,EAAI,EAAGA,EAAIsH,EAAKrH,SAAUD,EACjCQ,GAAK6Q,OAAOC,aAAahK,EAAKtH,IAEhC,OAAOQ,CACT,CAGA,SAAS+Q,EAAMjK,GACb,IAAI7G,EAAI,EACR,IAAK,IAAIT,EAAI,EAAGA,EAAIsH,EAAKrH,SAAUD,EAAG,CACpC,GAAIsH,EAAKtH,GAAK,IAAMsH,EAAKtH,GAAK,GAC5B,MAAM,IAAIsE,MAAM,gBAElB7D,EAAQ,GAAJA,EAAS6G,EAAKtH,GAAK,EACzB,CACA,OAAOS,CACT,CAGA,SAAS+Q,EAAOlK,GACd,MAAM7G,EAAI2Q,EAAM9J,GAChB,IAAK7G,EAAEgR,MAAM,oCACX,MAAM,IAAInN,MAAM,gBAElB,OAAO7D,CACT,wEAeA,MAAMiR,EAAiE,CACrEvF,OAAQoF,EACRtF,KAAMsF,EACNvF,KAfF,SAAgB1E,GACd,GAAsB,oBAAXjG,OACT,OAAOA,OAAOC,KAAK8P,EAAM9J,GAAO,UAAUqK,WAE5C,MAAMC,EAAKpQ,KAAK4P,EAAM9J,IAChB3J,EAAI,IAAI2B,WAAWsS,EAAG3R,QAC5B,IAAK,IAAID,EAAI,EAAGA,EAAIrC,EAAEsC,SAAUD,EAC9BrC,EAAEqC,GAAK4R,EAAGlQ,WAAW1B,GAEvB,OAAO,IAAI6R,aAAc/Q,OAAOnD,EAClC,EAMEyE,MAAOoP,EACPtL,OAAQsL,EACRtF,oBAAqBqF,GAMjBO,EAAc,CAAC,GAAI,IAAK,IAAK,KAE7BC,EAAuB,CAAC,GAAI,IAAK,IAAK,IAAK,IAAK,IAAK,GAAI,IAAK,IAAK,GAAI,IAAK,IAAK,KAEjFC,EAAkB,CAAC,GAAI,IAAK,IAAK,IAAK,GAAI,GAAI,IAAK,KAEnDC,EAAiB,CAAC,GAAI,IAAK,IAAK,IAAK,GAAI,IAAK,KAE9CC,EAAwB,CAAC,GAAI,IAAK,IAAK,IAAK,IAAK,IAAK,GAAI,IAAK,IAAK,IAAK,GAAI,IAAK,IAAK,KAGvFC,EAAiB,oBAGvB,iBAAAlQ,GACSC,KAAAoL,MAAK,EACJpL,KAAAkQ,QAAU,IAAI7S,YAAY4S,GAC1BjQ,KAAAmQ,UAAY,EACZnQ,KAAAoQ,KAAO,GACRpQ,KAAAuL,OAA4E,EAwIrF,CAtIS,KAAAL,GACLlL,KAAKkQ,QAAQvK,KAAK,GAClB3F,KAAKoL,MAAK,EACVpL,KAAKmQ,UAAY,EACjBnQ,KAAKuL,OAAS,GACdvL,KAAKoQ,KAAO,EACd,CAEO,GAAA9K,GACL,GAAc,IAAVtF,KAAKoL,MAA6B,CACpC,GAAIpL,KAAKmQ,YAAcJ,EAAehS,OAAQ,CAC5C,IAAK,IAAIsS,EAAI,EAAGA,EAAIN,EAAehS,SAAUsS,EAC3C,GAAIrQ,KAAKkQ,QAAQG,KAAON,EAAeM,GAAI,OAAOrQ,KAAKoM,KAIzD,OAFApM,KAAKuL,OAAa,KAAC,EACnBvL,KAAKoL,MAAK,EACH,CACT,CACA,GAAIpL,KAAKmQ,YAAcH,EAAsBjS,OAAQ,CACnD,IAAK,IAAIsS,EAAI,EAAGA,EAAIL,EAAsBjS,SAAUsS,EAClD,GAAIrQ,KAAKkQ,QAAQG,KAAOL,EAAsBK,GAAI,OAAOrQ,KAAKoM,KAIhE,OAFApM,KAAKuL,OAAa,KAAC,EACnBvL,KAAKoL,MAAK,EACH,CACT,CACA,OAAOpL,KAAKoM,IACd,CACA,OAAc,IAAVpM,KAAKoL,MAAkC,EAC7B,IAAVpL,KAAKoL,OACY,IAAhBpL,KAAKuL,OAAO1B,MAEV7J,KAAKsQ,YAAYtQ,KAAKmQ,YAC3BnQ,KAAKoL,MAAK,EACH,GAEFpL,KAAKoM,IACd,CAEO,KAAAd,CAAMlG,EAAmBC,EAAeC,GAC7C,IAAI8F,EAAQpL,KAAKoL,MACbmF,EAAMvQ,KAAKmQ,UACf,MAAM7S,EAAS0C,KAAKkQ,QACpB,GAAS,IAAL9E,GAAoC,IAALA,EAA2B,OAAQ,EACtE,GAAS,IAALA,GAA+BmF,EAAM,GAAI,OAAQ,EACrD,IAAK,IAAIzS,EAAIuH,EAAOvH,EAAIwH,IAAOxH,EAAG,CAChC,MAAMzB,EAAI+I,EAAKtH,GACf,OAAQzB,GACN,KAAK,GACH,IAAK2D,KAAKsQ,YAAYC,GAAM,OAAOvQ,KAAKoM,KACxChB,EAAK,EACLmF,EAAM,EACN,MACF,KAAK,GACH,GAAS,IAALnF,EAA6B,CAC/B,GAAkB,KAAd9N,EAAO,GAAW,CAEpB,IAAI+S,EAAI,EACR,KAAOA,EAAIT,EAAY7R,SAAUsS,EAC/B,GAAI/S,EAAO+S,KAAOT,EAAYS,GAAI,OAAOrQ,KAAKoM,KAGhD,GADApM,KAAKuL,OAAa,KAAC,EACfgF,IAAQT,EAAgB/R,OAAQ,CAClC,KAAOsS,EAAIP,EAAgB/R,SAAUsS,EACnC,GAAI/S,EAAO+S,KAAOP,EAAgBO,GAAI,OAAOrQ,KAAKoM,KAIpD,OAFApM,KAAKuL,OAAa,KAAC,EACnBvL,KAAKoL,MAAK,EACHtN,EAAI,CACb,CACF,KAAO,IAAkB,KAAdR,EAAO,GAOhB,OAAO0C,KAAKoM,KALZ,IAAK,IAAIiE,EAAI,EAAGA,EAAIR,EAAqB9R,SAAUsS,EACjD,GAAI/S,EAAO+S,KAAOR,EAAqBQ,GAAI,OAAOrQ,KAAKoM,KAEzDpM,KAAKuL,OAAa,KAAC,CAGrB,CACAH,EAAK,EACLmF,EAAM,CACR,MAAO,GAAS,IAALnF,EAA2B,CACpC,IAAKpL,KAAKwQ,UAAUD,GAAM,OAAOvQ,KAAKoM,KACtChB,EAAK,EACLmF,EAAM,CACR,MAAO,GAAS,IAALnF,EAA6B,CACtC,GAAImF,GAAON,EAAgB,OAAOjQ,KAAKoM,KACvC9O,EAAOiT,KAASlU,CAClB,CACA,MACF,KAAK,GACH,OAAS,IAAL+O,GACGpL,KAAKsQ,YAAYC,IAExBvQ,KAAKoL,MAAK,EACHtN,EAAI,GAH0BkC,KAAKoM,KAI5C,QACE,GAAImE,GAAON,EAAgB,OAAOjQ,KAAKoM,KACvC9O,EAAOiT,KAASlU,EAEtB,CAGA,OAFA2D,KAAKoL,MAAQA,EACbpL,KAAKmQ,UAAYI,GACT,CACV,CAEQ,EAAAnE,GAGN,OAFApM,KAAKuL,OAAO1B,KAAI,EAChB7J,KAAKoL,MAAK,GACF,CACV,CAEQ,SAAAoF,CAAUD,GAChB,MAAMF,EAAInB,EAAMlP,KAAKkQ,QAAQzL,SAAS,EAAG8L,IACzC,QAAIF,IACFrQ,KAAKoQ,KAAOC,EACZrQ,KAAKuL,OAAO8E,GAAK,MACV,EAGX,CAEQ,WAAAC,CAAYC,GAClB,GAAIvQ,KAAKoQ,KAAM,CACb,IACE,MAAM7R,EAAIyB,KAAKkQ,QAAQjJ,MAAM,EAAGsJ,GAChCvQ,KAAKuL,OAAOvL,KAAKoQ,MAAQZ,EAASxP,KAAKoQ,MAAQZ,EAASxP,KAAKoQ,MAAM7R,GAAKA,CAC1E,UACE,OAAO,CACT,CACA,OAAO,CACT,CACA,OAAO,CACT,yGCtPF,MAEE,WAAAwB,CACmBoK,GAAAnK,KAAAmK,SAAAA,EAFXnK,KAAAyQ,cAA+B,CAAEC,WAAW,EAAMC,MAAO,MAAOC,OAAQ,EAAGC,UAAW,MAG3F,CAMI,QAAAlD,CAASmD,GACd9Q,KAAKmK,SAASwD,SAASmD,EAAK9Q,KAAKyQ,cACnC,oGCNF,SAA0BtS,GACxB,GAAIA,EAAEJ,OAAS,GACb,OAAOlD,EAAAiS,iBAET,MAAMiE,EAAM,IAAI1T,YAAYc,EAAEb,OAAQa,EAAEkP,WAAY,GAGpD,GAAe,aAAX0D,EAAI,IAAgC,YAAXA,EAAI,IAAgC,aAAXA,EAAI,GACxD,MAAO,CACL/D,KAAM,YACN9M,MAAQ/B,EAAE,KAAO,GAAKA,EAAE,KAAO,GAAKA,EAAE,KAAO,EAAIA,EAAE,IACnD6F,OAAQ7F,EAAE,KAAO,GAAKA,EAAE,KAAO,GAAKA,EAAE,KAAO,EAAIA,EAAE,KAIvD,GAAa,MAATA,EAAE,IAAwB,MAATA,EAAE,IAAwB,MAATA,EAAE,GAAa,CACnD,MAAO+B,EAAO8D,GAgFlB,SAAiB7F,GACf,MAAMuJ,EAAMvJ,EAAEJ,OACd,IAAID,EAAI,EACJkT,EAAc7S,EAAEL,IAAM,EAAIK,EAAEL,EAAI,GACpC,OAAa,CAEX,GADAA,GAAKkT,EACDlT,GAAK4J,EAEP,MAAO,CAAC,EAAG,GAEb,GAAa,MAATvJ,EAAEL,GACJ,MAAO,CAAC,EAAG,GAEb,GAAiB,MAAbK,EAAEL,EAAI,IAA4B,MAAbK,EAAEL,EAAI,GAC7B,OAAIA,EAAI,EAAI4J,EACH,CACLvJ,EAAEL,EAAI,IAAM,EAAIK,EAAEL,EAAI,GACtBK,EAAEL,EAAI,IAAM,EAAIK,EAAEL,EAAI,IAGnB,CAAC,EAAG,GAEbA,GAAK,EACLkT,EAAc7S,EAAEL,IAAM,EAAIK,EAAEL,EAAI,EAClC,CACF,CAzG4BmT,CAAQ9S,GAChC,MAAO,CAAE6O,KAAM,aAAc9M,QAAO8D,SACtC,CAEA,GAAe,YAAX+M,EAAI,KAA+B,KAAT5S,EAAE,IAAwB,KAATA,EAAE,KAAyB,KAATA,EAAE,GACjE,MAAO,CACL6O,KAAM,YACN9M,MAAQ/B,EAAE,IAAM,EAAIA,EAAE,GACtB6F,OAAQ7F,EAAE,IAAM,EAAIA,EAAE,IAI1B,GAAe,aAAX4S,EAAI,GACN,MAAO,CACL/D,KAAM,YACN9M,MAAQ/B,EAAE,IAAM,GAAKA,EAAE,IAAM,GAAKA,EAAE,IAAM,EAAIA,EAAE,GAChD6F,OAAQ7F,EAAE,IAAM,GAAKA,EAAE,IAAM,GAAKA,EAAE,KAAO,EAAIA,EAAE,KAIrD,GAAe,aAAX4S,EAAI,IAAgC,aAAXA,EAAI,IAA6C,UAAd,SAATA,EAAI,IAA6B,CACtF,OAAQ5S,EAAE,KACR,KAAK,GACH,MAAO,CACL6O,KAAM,aACN9M,MAA6C,GAApC/B,EAAE,IAAMA,EAAE,KAAO,EAAIA,EAAE,KAAO,IACvC6F,OAA6C,GAApC7F,EAAE,IAAMA,EAAE,KAAO,EAAIA,EAAE,KAAO,KAE3C,KAAK,GACH,GAAc,KAAVA,EAAE,IAAc,OAAOtD,EAAAiS,iBAC3B,MAAMoE,EAAM/S,EAAE,IAAMA,EAAE,KAAO,EAAIA,EAAE,KAAO,GAAKA,EAAE,KAAO,GACxD,MAAO,CACL6O,KAAM,aACN9M,MAAgC,GAAV,MAAbgR,GACTlN,OAAgC,GAAvBkN,IAAQ,GAAK,QAE1B,KAAK,GACH,OAAc,MAAV/S,EAAE,KAA0B,IAAVA,EAAE,KAA0B,KAAVA,EAAE,IAAqBtD,EAAAiS,iBACxD,CACLE,KAAM,aACN9M,MAA+B,OAAtB/B,EAAE,IAAMA,EAAE,KAAO,GAC1B6F,OAA+B,OAAtB7F,EAAE,IAAMA,EAAE,KAAO,IAGhC,OAAOtD,EAAAiS,gBACT,CAEA,GAAe,aAAXiE,EAAI,KAAiC,aAAXA,EAAI,IAAgC,aAAXA,EAAI,IAAoB,CAC7E,IAAIR,GAAO,EAEX,MAAMY,EAAQpV,KAAKE,IAAIkC,EAAEJ,OAAS,GAAI,MACtC,IAAK,IAAID,EAAI,EAAGA,EAAIqT,EAAOrT,IAEzB,GAAa,MAATK,EAAEL,IAA4B,MAAbK,EAAEL,EAAI,IAA4B,MAAbK,EAAEL,EAAI,IAA4B,MAAbK,EAAEL,EAAI,GAAa,CAChFyS,EAAMzS,EACN,KACF,CAEF,IAAa,IAATyS,EAAY,CAEd,MAAMrQ,EACJ/B,EAAEoS,EAAO,IAAM,GACfpS,EAAEoS,EAAO,IAAM,GACfpS,EAAEoS,EAAM,KAAQ,EAChBpS,EAAEoS,EAAM,IACJvM,EACJ7F,EAAEoS,EAAM,KAAO,GACfpS,EAAEoS,EAAM,KAAO,GACfpS,EAAEoS,EAAM,KAAQ,EAChBpS,EAAEoS,EAAM,IACV,GAAIrQ,EAAQ,GAAK8D,EAAS,EACxB,MAAO,CAAEgJ,KAAM,aAAc9M,QAAO8D,SAExC,CACA,OAAOnJ,EAAAiS,gBACT,CACA,OAAOjS,EAAAiS,gBACT,EAnGajS,EAAAiS,iBAA6B,CACxCE,KAAM,cACN9M,MAAO,EACP8D,OAAQ,uFCZV,MAAAjF,EAAAC,EAAA,KAGAqH,EAAArH,EAAA,KAaA,MAAAsO,UAAmCjH,EAAA0C,WAEjC,UAAWgD,GAAM,IAAAK,EAAoC,OAA8B,QAAvBA,EAAApM,KAAKoR,QAAQC,IAAI,cAAM,IAAAjF,OAAA,EAAAA,EAAEL,MAAQ,CAUtF,mBAAOwB,CAAa+D,EAAqCpR,EAAe8D,GAU7E,MAAM+H,GAAUuF,QAAAA,EAAiBC,UAAUC,cAAc,UAGzD,OAFAzF,EAAO7L,MAAgB,EAARA,EACf6L,EAAO/H,OAAkB,EAATA,EACT+H,CACT,CAGO,sBAAO0F,CAAgBC,EAA+BxR,EAAe8D,EAAgB1G,GAC1F,GAAyB,mBAAd8P,UAA0B,CACnC,MAAMuE,EAAUD,EAAID,gBAAgBvR,EAAO8D,GAI3C,OAHI1G,GACFqU,EAAQvM,KAAKlC,IAAI,IAAIgD,kBAAkB5I,EAAQ,EAAG4C,EAAQ8D,EAAS,IAE9D2N,CACT,CACA,OAAOrU,EACH,IAAI8P,UAAU,IAAIlH,kBAAkB5I,EAAQ,EAAG4C,EAAQ8D,EAAS,GAAI9D,EAAO8D,GAC3E,IAAIoJ,UAAUlN,EAAO8D,EAC3B,CAGO,wBAAO8J,CAAkBgD,GAC9B,MAAiC,mBAAtBhD,kBACF8D,QAAQC,aAAQ7J,GAElB8F,kBAAkBgD,EAC3B,CAGA,WAAA/Q,CAAoB+R,GAClBC,QADkB/R,KAAA8R,UAAAA,EAhDZ9R,KAAAoR,QAAU,IAAIY,IAGdhS,KAAAiS,gBAAkBjS,KAAKiJ,UAAU,IAAI5C,EAAA6L,mBA+C3ClS,KAAKmS,SAAWnS,KAAK8R,UAAUzF,MAAM+F,KACrCpS,KAAK8R,UAAUzF,MAAM+F,KAAQC,UACd,QAAbjG,EAAApM,KAAKmS,gBAAQ,IAAA/F,GAAAA,EAAE5E,KAAKxH,KAAK8R,UAAUzF,MAAOgG,GAC1CrS,KAAKsS,SAEHtS,KAAK8R,UAAUzF,MAAMkG,eACvBvS,KAAKsS,QAGPtS,KAAKiS,gBAAgBnW,MAAQkE,KAAK8R,UAAUzF,MAAMmG,eAAeC,eAAeC,UAC/D,aAAXA,IACF1S,KAAK2S,gBACc,QAAnBvG,EAAApM,KAAK4S,sBAAc,IAAAxG,GAAAA,EAAEyG,YAAY,EAAG7S,KAAK8R,UAAU7F,SAGvDjM,KAAKiJ,WAAU,EAAA5C,EAAAS,cAAa,WAC1B9G,KAAK8S,qBACL9S,KAAK8S,mBAAmB,UACpB9S,KAAK8R,UAAUzF,OAASrM,KAAKmS,WAC/BnS,KAAK8R,UAAUzF,MAAM+F,KAAOpS,KAAKmS,SACjCnS,KAAKmS,cAAWnK,GAEdhI,KAAK4S,gBAAkB5S,KAAK+S,kBAC9B/S,KAAK4S,eAAeI,YAAchT,KAAK+S,gBACvC/S,KAAK+S,qBAAkB/K,GAEzBhI,KAAK4S,oBAAiB5K,EACtBhI,KAAKoR,QAAQtI,QACU,QAAvBsD,EAAApM,KAAKiT,0BAAkB,IAAA7G,GAAAA,EAAE8B,QACzBlO,KAAKiT,wBAAqBjL,EAC1BhI,KAAKkT,kBAAelL,IAExB,CAKO,eAAAmL,CAAgBrX,WACjBA,EACGkE,KAAKkT,eAA0C,IAA1BlT,KAAKoT,SAASpP,QACtChE,KAAKqT,mBAAmBtX,KAAKC,IAAIgE,KAAKoT,SAASpP,OAAS,EAAC,MAGpC,QAAvBoI,EAAApM,KAAKiT,0BAAkB,IAAA7G,GAAAA,EAAE8B,QACzBlO,KAAKiT,wBAAqBjL,EAC1BhI,KAAKkT,kBAAelL,GAEH,QAAnBwF,EAAAxN,KAAK4S,sBAAc,IAAApF,GAAAA,EAAEqF,YAAY,EAAG7S,KAAK8R,UAAU7F,KACrD,CAMA,cAAWJ,GACT,OAAO7L,KAAK8R,UAAUjG,UACxB,CAKA,YAAWuH,WACT,MAAO,CACLlT,OAAsB,QAAfkM,EAAApM,KAAK6L,kBAAU,IAAAO,OAAA,EAAAA,EAAEN,IAAIuC,KAAKnO,SAAU,EAC3C8D,QAAuB,QAAfwJ,EAAAxN,KAAK6L,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIuC,KAAKrK,UAAW,EAEjD,CAKO,UAAAsP,CAAWjO,EAAeC,EAAaqL,iBAC5C,MAAM4C,EAAIlO,IAAwB,QAAf+G,EAAApM,KAAK6L,kBAAU,IAAAO,OAAA,EAAAA,EAAEN,IAAIuC,KAAKrK,SAAU,GACjD2H,GAAmB,QAAf6B,EAAAxN,KAAK6L,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIC,OAAO7L,QAAS,EACzC9B,GAAKkH,EAAM,EAAID,KAAyB,QAAf8G,EAAAnM,KAAK6L,kBAAU,IAAAM,OAAA,EAAAA,EAAEL,IAAIuC,KAAKrK,SAAU,GAC9D2M,GAAmB,QAAVA,GACW,QAAvBpC,EAAAvO,KAAKoR,QAAQC,IAAI,cAAM,IAAA9C,GAAAA,EAAEiF,UAAU,EAAGD,EAAG5H,EAAGvN,GAEzCuS,GAAmB,WAAVA,GACc,QAA1B8C,EAAAzT,KAAKoR,QAAQC,IAAI,iBAAS,IAAAoC,GAAAA,EAAED,UAAU,EAAGD,EAAG5H,EAAGvN,EAEnD,CAKO,QAAAsV,CAAS/C,GACd,IAAKA,GAAmB,QAAVA,EAAiB,CAC7B,MAAMe,EAAM1R,KAAKoR,QAAQC,IAAI,OAC7BK,SAAAA,EAAK8B,UAAU,EAAG,EAAG9B,EAAI3F,OAAO7L,MAAOwR,EAAI3F,OAAO/H,OACpD,CACA,IAAK2M,GAAmB,WAAVA,EAAoB,CAChC,MAAMe,EAAM1R,KAAKoR,QAAQC,IAAI,UAC7BK,SAAAA,EAAK8B,UAAU,EAAG,EAAG9B,EAAI3F,OAAO7L,MAAOwR,EAAI3F,OAAO/H,OACpD,CACF,CAKO,IAAA2P,CAAKC,EAAqBC,EAAgBC,EAAaC,EAAaC,EAAgB,GACzF,MAAMtC,EAAM1R,KAAKoR,QAAQC,IAAIuC,EAAQjD,OACrC,IAAKe,EACH,OAEF,MAAMxR,MAAEA,EAAK8D,OAAEA,GAAWhE,KAAKoT,SAG/B,IAAe,IAAXlT,IAA4B,IAAZ8D,EAClB,OAGFhE,KAAKiU,cAAcL,EAAS1T,EAAO8D,GACnC,MAAM8M,EAAM8C,EAAQM,QACZhU,MAAOiU,EAAanQ,OAAQoQ,GAAiBR,EAAQS,eACvDrI,EAAOjQ,KAAKuI,KAAKwM,EAAI5Q,MAAQiU,GAE7BG,EAAMT,EAAS7H,EAAQmI,EACvBI,EAAKxY,KAAKoR,MAAM0G,EAAS7H,GAAQoI,EACjCI,EAAKV,EAAM5T,EACXuU,EAAKV,EAAM/P,EAGX0Q,EAAaV,EAAQG,EAAcG,EAAKxD,EAAI5Q,MAAQ4Q,EAAI5Q,MAAQoU,EAAKN,EAAQG,EAC7EQ,EAAcJ,EAAKH,EAAetD,EAAI9M,OAAS8M,EAAI9M,OAASuQ,EAAKH,EAMvE1C,EAAIkD,UACF9D,EACA/U,KAAKoR,MAAMmH,GAAKvY,KAAKoR,MAAMoH,GAAKxY,KAAKuI,KAAKoQ,GAAa3Y,KAAKuI,KAAKqQ,GACjE5Y,KAAKoR,MAAMqH,GAAKzY,KAAKoR,MAAMsH,GAAK1Y,KAAKuI,KAAKoQ,EAAaxU,EAAQiU,GAAcpY,KAAKuI,KAAKqQ,EAAc3Q,EAASoQ,GAElH,CAKO,WAAAS,CAAYjB,EAAqBC,GACtC,MAAM3T,MAAEA,EAAK8D,OAAEA,GAAWhE,KAAKoT,SAE/B,IAAe,IAAXlT,IAA4B,IAAZ8D,EAClB,OAEFhE,KAAKiU,cAAcL,EAAS1T,EAAO8D,GACnC,MAAM8M,EAAM8C,EAAQM,QACZhU,MAAOiU,EAAanQ,OAAQoQ,GAAiBR,EAAQS,eACvDrI,EAAOjQ,KAAKuI,KAAKwM,EAAI5Q,MAAQiU,GAC7BG,EAAMT,EAAS7H,EAAQmI,EACvBI,EAAKxY,KAAKoR,MAAM0G,EAAS7H,GAAQoI,EACjCM,EAAaP,EAAcG,EAAKxD,EAAI5Q,MAAQ4Q,EAAI5Q,MAAQoU,EAAKH,EAC7DQ,EAAcJ,EAAKH,EAAetD,EAAI9M,OAAS8M,EAAI9M,OAASuQ,EAAKH,EAEjErI,EAASuB,EAAcC,aAAavN,KAAKuR,SAAUxV,KAAKuI,KAAKoQ,EAAaxU,EAAQiU,GAAcpY,KAAKuI,KAAKqQ,EAAc3Q,EAASoQ,IACjI1C,EAAM3F,EAAO0B,WAAW,MAC9B,OAAIiE,GACFA,EAAIkD,UACF9D,EACA/U,KAAKoR,MAAMmH,GAAKvY,KAAKoR,MAAMoH,GAAKxY,KAAKoR,MAAMuH,GAAa3Y,KAAKoR,MAAMwH,GACnE,EAAG,EAAG5I,EAAO7L,MAAO6L,EAAO/H,QAEtB+H,QANT,CAQF,CAKO,eAAA+I,CAAgBhB,EAAaC,EAAaC,EAAgB,SAC/D,MAAMtC,EAAM1R,KAAKoR,QAAQC,IAAI,OAC7B,GAAIK,EAAK,CACP,MAAMxR,MAAEA,EAAK8D,OAAEA,GAAWhE,KAAKoT,SAG/B,IAAe,IAAXlT,IAA4B,IAAZ8D,EAClB,OAQF,GALKhE,KAAKkT,aAEClP,GAAUhE,KAAKkT,aAAclP,QACtChE,KAAKqT,mBAAmBrP,EAAS,GAFjChE,KAAKqT,mBAAmBtX,KAAKC,IAAIgI,EAAS,EAAC,MAIxChE,KAAKkT,aAAc,OACxBxB,EAAIkD,UACqB,QADZxI,EACXpM,KAAKiT,0BAAkB,IAAA7G,EAAAA,EAAIpM,KAAKkT,aAChCY,EAAM5T,EACL6T,EAAM/P,EAAU,EAAI,EAAI,EACzB9D,EAAQ8T,EACRhQ,EACA8P,EAAM5T,EACN6T,EAAM/P,EACN9D,EAAQ8T,EACRhQ,EAEJ,CACF,CAMO,aAAA2O,WACL,MAAMhH,GAAmB,QAAfS,EAAApM,KAAK6L,kBAAU,IAAAO,OAAA,EAAAA,EAAEN,IAAIC,OAAO7L,QAAS,EACzC9B,GAAmB,QAAfoP,EAAAxN,KAAK6L,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIC,OAAO/H,SAAU,EAChD,IAAK,MAAM0N,KAAO1R,KAAKoR,QAAQ2D,SACzBrD,EAAI3F,OAAO7L,QAAUyL,GAAK+F,EAAI3F,OAAO/H,SAAW5F,IAClDsT,EAAI3F,OAAO7L,MAAQyL,EACnB+F,EAAI3F,OAAO/H,OAAS5F,EAG1B,CAKQ,aAAA6V,CAAce,EAAkBtP,EAAsBM,GAC5D,GAAIN,IAAiBsP,EAAKX,eAAenU,OAAS8F,IAAkBgP,EAAKX,eAAerQ,OACtF,OAEF,MAAQ9D,MAAO+U,EAAejR,OAAQkR,GAAmBF,EAAKG,aAC9D,GAAIzP,IAAiBuP,GAAiBjP,IAAkBkP,EAItD,OAHAF,EAAKd,OAASc,EAAKI,KACnBJ,EAAKX,eAAenU,MAAQ+U,OAC5BD,EAAKX,eAAerQ,OAASkR,GAG/B,MAAMG,EAActZ,KAAKuI,KAAK0Q,EAAKI,KAAMlV,MAAQwF,EAAeuP,GAC1DK,EAAevZ,KAAKuI,KAAK0Q,EAAKI,KAAMpR,OAASgC,EAAgBkP,GAEnE,GAAIG,EAAcC,EAAeN,EAAKI,KAAMlV,MAAQ8U,EAAKI,KAAMpR,OAI7D,OAHAgR,EAAKd,OAASc,EAAKI,KACnBJ,EAAKX,eAAenU,MAAQ+U,OAC5BD,EAAKX,eAAerQ,OAASkR,GAG/B,MAAMnJ,EAASuB,EAAcC,aAAavN,KAAKuR,SAAU8D,EAAaC,GAChE5D,EAAM3F,EAAO0B,WAAW,MAC1BiE,IACFA,EAAIkD,UAAUI,EAAKI,KAAO,EAAG,EAAGrJ,EAAO7L,MAAO6L,EAAO/H,QACrDgR,EAAKd,OAASnI,EACdiJ,EAAKX,eAAenU,MAAQwF,EAC5BsP,EAAKX,eAAerQ,OAASgC,EAEjC,CAKQ,KAAAsM,GACNtS,KAAK4S,eAAiB5S,KAAK8R,UAAUzF,MAAMuG,eAC3C5S,KAAK+S,gBAAkB/S,KAAK4S,eAAeI,YAAY9R,KAAKlB,KAAK4S,gBACjE5S,KAAK4S,eAAeI,YAAeuC,UACjC,IAAK,MAAMC,IAAO,IAAIxV,KAAKoR,QAAQqE,QACjCzV,KAAK8S,mBAAmB0C,GAEN,QAApBpJ,EAAApM,KAAK+S,uBAAe,IAAA3G,GAAAA,EAAE5E,KAAKxH,KAAK4S,eAAgB2C,GAEpD,CAEO,gBAAAG,CAAiB/E,EAAoB,eAE1C,IAAK3Q,KAAKuR,WAAavR,KAAK8R,UAAUzF,MAAMkG,cAE1C,YADAhV,QAAQC,KAAK,sFAGf,GAAIwC,KAAKoR,QAAQuE,IAAIhF,GACnB,OAEF,MAAM5E,EAASuB,EAAcC,aAC3BvN,KAAKuR,UAAyB,QAAfnF,EAAApM,KAAK6L,kBAAU,IAAAO,OAAA,EAAAA,EAAEN,IAAIC,OAAO7L,QAAS,GACrC,QAAfsN,EAAAxN,KAAK6L,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIC,OAAO/H,SAAU,GAExC+H,EAAO6J,UAAUtO,IAAI,qBAAqBqJ,KAC1C,MAAM4B,EAAgBvS,KAAK8R,UAAUzF,MAAMkG,cAI3CA,EAAcsD,MAAMC,UAAY,UAClB,WAAVnF,GAKF5E,EAAO8J,MAAMjF,OAAS,KACtB2B,EAAcwD,aAAahK,EAAQwG,EAAcyD,cAKjDjK,EAAO8J,MAAMjF,OAAS,IACtB2B,EAAc0D,YAAYlK,IAE5B,MAAM2F,EAAM3F,EAAO0B,WAAW,KAAM,CAAEvQ,OAAO,IACxCwU,GAIL1R,KAAKoR,QAAQlO,IAAIyN,EAAOe,GACxB1R,KAAK0T,SAAS/C,IAJZ5E,EAAOmK,QAKX,CAEO,kBAAApD,CAAmBnC,EAAoB,OAC5C,MAAMe,EAAM1R,KAAKoR,QAAQC,IAAIV,GACzBe,IACFA,EAAI3F,OAAOmK,SACXlW,KAAKoR,QAAQ+E,OAAOxF,GAExB,CAEO,QAAAyF,CAASzF,GACd,OAAO3Q,KAAKoR,QAAQuE,IAAIhF,EAC1B,CAEQ,kBAAA0C,CAAmBrP,EAAM,UACR,QAAvBoI,EAAApM,KAAKiT,0BAAkB,IAAA7G,GAAAA,EAAE8B,QACzBlO,KAAKiT,wBAAqBjL,EAG1B,MAAMqO,EAAS,GACTC,EAAYhJ,EAAcC,aAAavN,KAAKuR,SAAU8E,EAAQrS,GAC9D0N,EAAM4E,EAAU7I,WAAW,KAAM,CAAEvQ,OAAO,IAChD,IAAKwU,EAAK,OACV,MAAMC,EAAUrE,EAAcmE,gBAAgBC,EAAK2E,EAAQrS,GACrD+M,EAAM,IAAI1T,YAAYsU,EAAQvM,KAAK9H,QACnCiZ,GAAQ,EAAAxX,EAAAzD,YAAW,EAAG,EAAG,GACzBkb,GAAQ,EAAAzX,EAAAzD,YAAW,IAAK,IAAK,KACnCyV,EAAIpL,KAAK4Q,GACT,IAAK,IAAIhD,EAAI,EAAGA,EAAIvP,IAAUuP,EAAG,CAC/B,MAAMkD,EAAQlD,EAAI,EACZpP,EAASoP,EAAI8C,EACnB,IAAK,IAAIK,EAAI,EAAGA,EAAIL,EAAQK,GAAK,EAC/B3F,EAAI5M,EAASuS,EAAID,GAASD,CAE9B,CACA9E,EAAIhE,aAAaiE,EAAS,EAAG,GAG7B,MAAMzR,EAASyW,OAAOzW,MAAQmW,EAAS,GAAK,IAAa,KACzDrW,KAAKkT,aAAe5F,EAAcC,aAAavN,KAAKuR,SAAUrR,EAAO8D,GACrE,MAAM4S,EAAO5W,KAAKkT,aAAazF,WAAW,KAAM,CAAEvQ,OAAO,IACzD,IAAK0Z,EAEH,YADA5W,KAAKkT,kBAAelL,GAGtB,IAAK,IAAIlK,EAAI,EAAGA,EAAIoC,EAAOpC,GAAKuY,EAC9BO,EAAKhC,UAAU0B,EAAWxY,EAAG,GAE/B,MAAM+Y,EAAc7W,KAAKkT,aACzB5F,EAAcQ,kBAAkB+I,GAAaxV,KAAKyV,IAC5C9W,KAAKkT,eAAiB2D,EAAaC,SAAAA,EAAQ5I,QAC1ClO,KAAKiT,mBAAqB6D,IAC9B3I,MAAM,OACX,CAEA,YAAWoD,SACT,OAA+C,QAAxCnF,EAAApM,KAAK8R,UAAUzF,MAAMC,2BAAmB,IAAAF,OAAA,EAAAA,EAAE2K,OAAOxF,QAC1D,2HC3aF,MAAAlI,EAAArK,EAAA,KASanE,EAAA+Q,kBAA+B,CAC1C1L,MAAO,EACP8D,OAAQ,IASV,MAAMgT,EAEJ,OAAWC,GACT,OAAIjX,KAAKkX,QAEQ,UAAZlX,KAAKmX,KACLnX,KAAKoX,gBAAkB,GAGrBpX,KAAKmX,IACd,CACA,OAAWF,CAAInb,GAAiBkE,KAAKmX,KAAOrb,CAAO,CAEnD,kBAAWsb,GAET,OAAIpX,KAAKkX,OACP,GAEe,UAATlX,KAAKmX,OAAoC,EACnD,CACA,kBAAWC,CAAetb,GACxBkE,KAAKmX,OAAQ,UACbnX,KAAKmX,MAASrb,GAAS,GAAG,SAC5B,CAEA,kBAAWub,GACT,OAAmB,SAAZrX,KAAKmX,IACd,CACA,kBAAWE,CAAevb,GACxBkE,KAAKmX,OAAQ,SACbnX,KAAKmX,MAAgB,SAARrb,CACf,CAEA,0BAAWwb,GACT,MAAMC,GAAgB,WAATvX,KAAKmX,OAAmC,GACrD,OAAII,EAAM,EACK,WAANA,EAEFA,CACT,CACA,0BAAWD,CAAuBxb,GAChCkE,KAAKmX,MAAQ,UACbnX,KAAKmX,MAASrb,GAAS,GAAG,UAC5B,CAGA,SAAW0b,GACT,OAAOxX,KAAKkX,MACd,CACA,SAAWM,CAAM1b,GACfkE,KAAKkX,OAASpb,CAChB,CAEA,WAAAiE,CACEkX,EAAc,EACdO,EAAgB,EACTC,GAAU,EACV5D,GAAS,GADT7T,KAAAyX,QAAAA,EACAzX,KAAA6T,OAAAA,EAxDD7T,KAAAmX,KAAe,EA4CfnX,KAAAkX,OAAiB,EAcvBlX,KAAKmX,KAAOF,EACZjX,KAAKkX,OAASM,CAChB,CAEO,KAAAE,GASL,OAAO,IAAIV,EAAmBhX,KAAKmX,KAAMnX,KAAKkX,OAAQlX,KAAKyX,QAASzX,KAAK6T,OAC3E,CAEO,OAAA8D,GACL,OAA0B,IAAnB3X,KAAKoX,gBAA0D,IAAhBpX,KAAKkX,SAAkC,IAAlBlX,KAAKyX,OAClF,EAEF,MAAMG,EAAc,IAAIZ,iBAUxB,MAkBE,WAAAjX,CACU+R,EACA5H,EACAhI,GAFAlC,KAAA8R,UAAAA,EACA9R,KAAAkK,UAAAA,EACAlK,KAAAkC,MAAAA,EAnBFlC,KAAA6X,QAAmC,IAAI7F,IAEvChS,KAAA8X,QAAU,EAEV9X,KAAA+X,UAAY,EAEZ/X,KAAAgY,eAAgB,EAEhBhY,KAAAiY,iBAAkB,EAElBjY,KAAAkY,YAAsB,KAW5B,IACElY,KAAKmY,SAASnY,KAAKkC,MAAMkW,aAC3B,CAAE,MAAOtQ,GACHA,aAAa1F,OACf7E,QAAQ8a,MAAMvQ,EAAEwQ,SAElB/a,QAAQC,KAAK,0BAA0BwC,KAAKuY,gBAC9C,CACAvY,KAAKwY,iBAAmB,CACtBxM,KAAMhM,KAAK8R,UAAU9F,KACrBC,KAAMjM,KAAK8R,UAAU7F,KAEzB,CAEO,OAAAtE,GACL3H,KAAKkL,OACP,CAEO,KAAAA,SACL,IAAK,MAAM8J,KAAQhV,KAAK6X,QAAQ9C,SACnB,QAAX3I,EAAA4I,EAAKyD,cAAM,IAAArM,GAAAA,EAAEzE,UAIf3H,KAAK6X,QAAQ/O,QACb9I,KAAKkK,UAAUwJ,UACjB,CAEO,QAAA6E,GACL,OAA0B,EAAnBvY,KAAKkY,YAAkB,GAChC,CAEO,QAAAC,CAASrc,GACd,GAAIA,EAAQ,IAAOA,EAAQ,IACzB,MAAM4c,WAAW,qEAEnB1Y,KAAKkY,YAAepc,EAAQ,EAAI,MAAa,EAC7CkE,KAAK2Y,aAAa,EACpB,CAEO,QAAAC,GACL,OAAiC,EAA1B5Y,KAAK6Y,mBAAyB,GACvC,CAEQ,gBAAAA,GACN,IAAIC,EAAe,EACnB,IAAK,MAAM9D,KAAQhV,KAAK6X,QAAQ9C,SAC1BC,EAAKI,OACP0D,GAAgB9D,EAAKI,KAAKlV,MAAQ8U,EAAKI,KAAKpR,OACxCgR,EAAKd,QAAUc,EAAKd,SAAWc,EAAKI,OACtC0D,GAAgB9D,EAAKd,OAAOhU,MAAQ8U,EAAKd,OAAOlQ,SAItD,OAAO8U,CACT,CAEQ,OAAAC,CAAQC,SACd,MAAMhE,EAAOhV,KAAK6X,QAAQxG,IAAI2H,GACzBhE,IACLhV,KAAK6X,QAAQ1B,OAAO6C,GAEhBjC,OAAOkC,aAAejE,EAAKI,gBAAgB6D,aAC7CjE,EAAKI,KAAKlH,QAEO,QAAnB9B,EAAApM,KAAKkZ,sBAAc,IAAA9M,GAAAA,EAAA5E,KAAnBxH,KAAsBgZ,GACxB,CAKO,aAAAG,SAEL,MAAMC,EAAO,GACb,IAAK,MAAOJ,EAAIhE,KAAShV,KAAK6X,QAAQwB,UACZ,cAApBrE,EAAKsE,aACI,QAAXlN,EAAA4I,EAAKyD,cAAM,IAAArM,GAAAA,EAAEzE,UACbyR,EAAK1a,KAAKsa,IAGd,IAAK,MAAMA,KAAMI,EACfpZ,KAAK+Y,QAAQC,GAGfhZ,KAAKiY,iBAAkB,EACvBjY,KAAKgY,eAAgB,CACvB,CAMO,WAAAuB,CAAYP,SACjB,MAAMhE,EAAOhV,KAAK6X,QAAQxG,IAAI2H,GAC1BhE,IACS,QAAX5I,EAAA4I,EAAKyD,cAAM,IAAArM,GAAAA,EAAEzE,UACb3H,KAAK+Y,QAAQC,GAEjB,CAaO,QAAArL,CAASmD,EAAsChQ,WAEpDd,KAAK2Y,aAAa7H,EAAI5Q,MAAQ4Q,EAAI9M,QAGlC,IAAIoP,EAAWpT,KAAKkK,UAAUkJ,UACN,IAApBA,EAASlT,QAAqC,IAArBkT,EAASpP,SACpCoP,EAAWvY,EAAA+Q,mBAEb,MAAMI,EAAOjQ,KAAKuI,KAAKwM,EAAI5Q,MAAQkT,EAASlT,OACtC+L,EAAOlQ,KAAKuI,KAAKwM,EAAI9M,OAASoP,EAASpP,QAEvCyT,IAAYzX,KAAK8X,QAEjBxa,EAAS0C,KAAK8R,UAAUzF,MAAM/O,OAC9Bkc,EAAWxZ,KAAK8R,UAAU9F,KAC1ByN,EAAWzZ,KAAK8R,UAAU7F,KAC1ByN,EAAUpc,EAAOoZ,EACjBiD,EAAUrc,EAAOiW,EACvB,IAAIpP,EAASuV,EACTE,EAAY,EAEX9Y,EAAK4P,YACRpT,EAAOoZ,EAAI,EACXpZ,EAAOiW,EAAI,EACXpP,EAAS,GAGXnE,KAAK8R,UAAUzF,MAAMwN,cAAcC,iBAAiBC,UAAUzc,EAAOiW,GACrE,IAAK,IAAIQ,EAAM,EAAGA,EAAM9H,IAAQ8H,EAAK,CACnC,MAAMiG,EAAO1c,EAAO2c,MAAM5I,IAAI/T,EAAOiW,EAAIjW,EAAO4c,OAChD,IAAK,IAAIpG,EAAM,EAAGA,EAAM9H,KAClB7H,EAAS2P,GAAO0F,KADU1F,EAE9B9T,KAAKma,aAAaH,EAAwB7V,EAAS2P,EAAK2D,EAAS1D,EAAM/H,EAAO8H,GAC9E8F,IAEF,GAAI9Y,EAAK4P,UACHqD,EAAM9H,EAAO,GAAGjM,KAAK8R,UAAUzF,MAAMwN,cAAcO,gBAEvD,KAAM9c,EAAOiW,GAAKkG,EAAU,MAE9Bnc,EAAOoZ,EAAIvS,CACb,CACAnE,KAAK8R,UAAUzF,MAAMwN,cAAcC,iBAAiBC,UAAUzc,EAAOiW,GAGjEzS,EAAK4P,UACgB,QAAnB5P,EAAK+P,UACPvT,EAAOoZ,EAAI3a,KAAKE,IAAIkI,EAAS6H,EAAMwN,GAEnClc,EAAOoZ,EAAIvS,GAGb7G,EAAOoZ,EAAIgD,EACXpc,EAAOiW,EAAIoG,GAIb,MAAMP,EAAO,GACb,IAAK,MAAOJ,EAAIhE,KAAShV,KAAK6X,QAAQwB,UAChCrE,EAAK4E,UAAY,IACR,QAAXxN,EAAA4I,EAAKyD,cAAM,IAAArM,GAAAA,EAAEzE,UACbyR,EAAK1a,KAAKsa,IAGd,IAAK,MAAMA,KAAMI,EACfpZ,KAAK+Y,QAAQC,GAKf,MAAMqB,EAAYra,KAAK8R,UAAUwI,eAAe,GAChDD,SAAAA,EAAWE,UAAU,KACNva,KAAK6X,QAAQxG,IAAIoG,IAE5BzX,KAAK+Y,QAAQtB,KAMyB,cAAtCzX,KAAK8R,UAAUxU,OAAOkd,OAAO3Q,MAC/B7J,KAAKya,oBAIP,MAAM7G,EAAsB,CAC1BwB,KAAMtE,EACNqE,aAAc/B,EACdc,OAAQpD,EACRuD,eAAc7X,OAAA2F,OAAA,GAAOiR,GACrBqF,OAAQ4B,QAAarS,EACrB4R,YACAN,WAAYtZ,KAAK8R,UAAUxU,OAAOkd,OAAO3Q,KACzC8G,MAAO7P,EAAK6P,MACZC,OAAQ9P,EAAK8P,QAMf,OAFA5Q,KAAK6X,QAAQ3U,IAAIuU,EAAS7D,GACT,QAAjBpG,EAAAxN,KAAK0a,oBAAY,IAAAlN,GAAAA,EAAAhG,KAAjBxH,MACOyX,CACT,CAQO,MAAAkD,CAAOC,WAEZ,IAAIC,GAAe,EACfC,GAAkB,EACtB,IAAK,MAAM9F,KAAQhV,KAAK6X,QAAQ9C,SAM9B,GALmB,WAAfC,EAAKrE,MACPmK,GAAkB,EAElBD,GAAe,EAEbA,GAAgBC,EAAiB,MAIvC,GAAID,IAAiB7a,KAAKkK,UAAUkM,SAAS,SAC3CpW,KAAKkK,UAAUwL,iBAAiB,QAC3B1V,KAAKkK,UAAUkM,SAAS,QAAQ,OAUvC,GARI0E,IAAoB9a,KAAKkK,UAAUkM,SAAS,WAC9CpW,KAAKkK,UAAUwL,iBAAiB,UAIlC1V,KAAKkK,UAAUyI,iBAGV3S,KAAK6X,QAAQ9N,KAYhB,OAXK/J,KAAKgY,gBACRhY,KAAKkK,UAAUwJ,WACf1T,KAAKgY,eAAgB,EACrBhY,KAAKiY,iBAAkB,GAErBjY,KAAKkK,UAAUkM,SAAS,QAC1BpW,KAAKkK,UAAU4I,mBAAmB,YAEhC9S,KAAKkK,UAAUkM,SAAS,WAC1BpW,KAAKkK,UAAU4I,mBAAmB,YAMjC+H,GAAgB7a,KAAKkK,UAAUkM,SAAS,SAC3CpW,KAAKkK,UAAUwJ,SAAS,OACxB1T,KAAKkK,UAAU4I,mBAAmB,SAE/BgI,GAAmB9a,KAAKkK,UAAUkM,SAAS,YAC9CpW,KAAKkK,UAAUwJ,SAAS,UACxB1T,KAAKkK,UAAU4I,mBAAmB,WAIhC9S,KAAKiY,kBACPjY,KAAKkK,UAAUwJ,WACf1T,KAAKgY,eAAgB,EACrBhY,KAAKiY,iBAAkB,GAGzB,MAAM5S,MAAEA,EAAKC,IAAEA,GAAQsV,EACjBtd,EAAS0C,KAAK8R,UAAUzF,MAAM/O,OAC9B0O,EAAOhM,KAAK8R,UAAUzF,MAAML,KAGlChM,KAAKkK,UAAUoJ,WAAWjO,EAAOC,GAGjC,MAAMyV,EAAgG,GAChGC,EAAkE,GAGxE,IAAK,IAAIjH,EAAM1O,EAAO0O,GAAOzO,IAAOyO,EAAK,CACvC,MAAMiG,EAAO1c,EAAO2c,MAAM5I,IAAI0C,EAAMzW,EAAO2d,OAC3C,IAAKjB,EAAM,OACX,IAAK,IAAIlG,EAAM,EAAGA,EAAM9H,IAAQ8H,EAC9B,GAAmB,UAAfkG,EAAKkB,MAAMpH,GAA6B,CAC1C,IAAIhM,EAAiD,QAAhDsE,EAAwB4N,EAAKmB,eAAerH,UAAI,IAAA1H,EAAAA,EAAIwL,EACzD,MAAMH,EAAU3P,EAAE2P,QAClB,QAAgBzP,IAAZyP,IAAsC,IAAbA,EAC3B,SAEF,MAAM7D,EAAU5T,KAAK6X,QAAQxG,IAAIoG,GACjC,IAAkB,IAAd3P,EAAE+L,OAAe,CACnB,MAAMuH,EAAYtT,EAAE+L,OACdwH,EAAWvH,EACjB,IAAIE,EAAQ,EAOZ,OACIF,EAAM9H,GACW,UAAfgO,EAAKkB,MAAMpH,KACXhM,EAA4B,QAA3B0F,EAAGwM,EAAKmB,eAAerH,UAAI,IAAAtG,EAAAA,EAAIoK,IAChC9P,EAAE2P,UAAYA,GACd3P,EAAE+L,SAAWuH,EAAYpH,GAE7BA,IAEFF,IACIF,EACEA,EAAQM,QACV6G,EAAUrc,KAAK,CAAEkV,UAASC,OAAQuH,EAAWtH,IAAKuH,EAAUtH,MAAKC,UAE1DhU,KAAKkC,MAAMiR,iBACpB6H,EAAiBtc,KAAK,CAAEoV,IAAKuH,EAAUtH,MAAKC,UAE9ChU,KAAKgY,eAAgB,CACvB,CACF,CAEJ,CAGA+C,EAAUO,KAAK,CAAC5f,EAAGD,IAAMC,EAAEkY,QAAQhD,OAASnV,EAAEmY,QAAQhD,QAGtD,IAAK,MAAMpJ,KAAQwT,EACjBhb,KAAKkK,UAAU4K,gBAAgBtN,EAAKsM,IAAKtM,EAAKuM,IAAKvM,EAAKwM,OAI1D,IAAK,MAAMxM,KAAQuT,EACjB/a,KAAKkK,UAAUyJ,KAAKnM,EAAKoM,QAASpM,EAAKqM,OAAQrM,EAAKsM,IAAKtM,EAAKuM,IAAKvM,EAAKwM,MAE5E,CAEO,cAAAuH,CAAe1O,WAEpB,IAAK7M,KAAK6X,QAAQ9N,KAEhB,YADA/J,KAAKwY,iBAAmB3L,GAM1B,GAAI7M,KAAKwY,iBAAiBxM,MAAQa,EAAQb,KAExC,YADAhM,KAAKwY,iBAAmB3L,GAK1B,MAAMvP,EAAS0C,KAAK8R,UAAUzF,MAAM/O,OAC9B2O,EAAO3O,EAAO2c,MAAMlc,OACpByd,EAASxb,KAAKwY,iBAAiBxM,KAAO,EAC5C,IAAK,IAAI+H,EAAM,EAAGA,EAAM9H,IAAQ8H,EAAK,CACnC,MAAMiG,EAAO1c,EAAO2c,MAAM5I,IAAI0C,GAC9B,GAAsB,UAAlBiG,EAAKkB,MAAMM,GAAgC,CAC7C,MAAM1T,EAAoD,QAAnD0F,EAAwBwM,EAAKmB,eAAeK,UAAO,IAAAhO,EAAAA,EAAIoK,EACxDH,EAAU3P,EAAE2P,QAClB,QAAgBzP,IAAZyP,IAAsC,IAAbA,EAC3B,SAEF,MAAM7D,EAAU5T,KAAK6X,QAAQxG,IAAIoG,GACjC,IAAK7D,EACH,SAGF,MAAM6H,EAAc1f,KAAKuI,OAAoB,QAAd8H,EAAAwH,EAAQM,cAAM,IAAA9H,OAAA,EAAAA,EAAElM,QAAS,GAAK0T,EAAQS,eAAenU,OACpF,GAAK4H,EAAE+L,OAAS4H,EAAe,GAAKA,EAClC,SAGF,IAAIC,GAAU,EACd,IAAK,IAAIC,EAAWH,EAAS,EAAGG,EAAW9O,EAAQb,OAAQ2P,EACzD,GAAmD,QAA/C3B,EAAK4B,MAAc,EAARD,EAAoB,GAA6C,CAC9ED,GAAU,EACV,KACF,CAEF,GAAIA,EACF,SAGF,MAAMpW,EAAMvJ,KAAKE,IAAI4Q,EAAQb,KAAMyP,EAAe3T,EAAE+L,OAAS4H,EAAeD,GAC5E,IAAIK,EAAW/T,EAAE+L,OACjB,IAAK,IAAIiI,EAAYN,EAAS,EAAGM,EAAYxW,IAAOwW,EAClD9b,KAAKma,aAAaH,EAAwB8B,EAAWrE,IAAWoE,GAChEjI,EAAQgG,WAEZ,CACF,CAEA5Z,KAAKwY,iBAAmB3L,CAC1B,CAKO,oBAAAkP,CAAqBrF,EAAWnD,aACrC,MACMyG,EADSha,KAAK8R,UAAUzF,MAAM/O,OAChB2c,MAAM5I,IAAIkC,GAC9B,GAAIyG,GAAqB,UAAbA,EAAKkB,MAAMxE,GAA2B,CAChD,MAAM5O,EAA+C,QAA9CqE,EAAwB6N,EAAKmB,eAAezE,UAAE,IAAAvK,EAAAA,EAAIyL,EACzD,GAAI9P,EAAE2P,UAA0B,IAAf3P,EAAE2P,QAAgB,CACjC,MAAMrC,EAAkC,QAA3BhJ,EAAApM,KAAK6X,QAAQxG,IAAIvJ,EAAE2P,gBAAQ,IAAArL,OAAA,EAAAA,EAAEgJ,KAC1C,GAAI2B,OAAOkC,aAAe7D,aAAgB6D,YAAa,CACrD,MAAMlN,EAAS1C,EAAAiE,cAAcC,aAAawJ,OAAOxF,SAAU6D,EAAKlV,MAAOkV,EAAKpR,QAE5E,OADuB,QAAvBwJ,EAAAzB,EAAO0B,WAAW,aAAK,IAAAD,GAAAA,EAAEoH,UAAUQ,EAAM,EAAG,EAAGA,EAAKlV,MAAOkV,EAAKpR,QACzD+H,CACT,CACA,OAAOqJ,CACT,CACF,CACF,CAKO,uBAAA4G,CAAwBtF,EAAWnD,SACxC,MACMyG,EADSha,KAAK8R,UAAUzF,MAAM/O,OAChB2c,MAAM5I,IAAIkC,GAC9B,GAAIyG,GAAqB,UAAbA,EAAKkB,MAAMxE,GAA2B,CAChD,MAAM5O,EAA+C,QAA9CsE,EAAwB4N,EAAKmB,eAAezE,UAAE,IAAAtK,EAAAA,EAAIwL,EACzD,GAAI9P,EAAE2P,UAA0B,IAAf3P,EAAE2P,UAAgC,IAAd3P,EAAE+L,OAAe,CACpD,MAAMmB,EAAOhV,KAAK6X,QAAQxG,IAAIvJ,EAAE2P,SAChC,GAAIzC,EACF,OAAOhV,KAAKkK,UAAU2K,YAAYG,EAAMlN,EAAE+L,OAE9C,CACF,CACF,CAIQ,YAAA8E,CAAasD,SACnB,MAAMC,EAAOlc,KAAK6Y,mBAClB,IAAIsD,EAAUD,EACd,KAAOlc,KAAKkY,YAAciE,EAAUF,GAAQjc,KAAK6X,QAAQ9N,MAAM,CAC7D,MAAMiL,EAAOhV,KAAK6X,QAAQxG,MAAMrR,KAAK+X,WACjC/C,GAAQA,EAAKI,OACf+G,GAAWnH,EAAKI,KAAKlV,MAAQ8U,EAAKI,KAAKpR,OACnCgR,EAAKd,QAAUc,EAAKI,OAASJ,EAAKd,SACpCiI,GAAWnH,EAAKd,OAAOhU,MAAQ8U,EAAKd,OAAOlQ,QAElC,QAAXoI,EAAA4I,EAAKyD,cAAM,IAAArM,GAAAA,EAAEzE,UACb3H,KAAK+Y,QAAQ/Y,KAAK+X,WAEtB,CACA,OAAOmE,EAAOC,CAChB,CAEQ,YAAAhC,CAAaH,EAAsBtD,EAAWe,EAAiB5D,GACrE,GAAuC,UAAnCmG,EAAK4B,MAAO,EAADlF,EAAa,GAAoC,CAC9D,MAAM0F,EAAMpC,EAAKmB,eAAezE,GAChC,GAAI0F,EAAK,CACP,QAAoBpU,IAAhBoU,EAAI3E,QAAuB,CAI7B,MAAM4E,EAAUrc,KAAK6X,QAAQxG,IAAI+K,EAAI3E,SAOrC,OANI4E,GAEFA,EAAQzC,YAEVwC,EAAI3E,QAAUA,OACd2E,EAAIvI,OAASA,EAEf,CAGA,YADAmG,EAAKmB,eAAezE,GAAK,IAAIM,EAAmBoF,EAAInF,IAAKmF,EAAI5E,MAAOC,EAAS5D,GAE/E,CACF,CAEAmG,EAAK4B,MAAO,EAADlF,EAAa,IAAW,UACnCsD,EAAKmB,eAAezE,GAAK,IAAIM,EAAmB,EAAG,EAAGS,EAAS5D,EACjE,CAEQ,iBAAA4G,WAEN,IAAK,MAAMzF,KAAQhV,KAAK6X,QAAQ9C,SACN,cAApBC,EAAKsE,aACPtE,EAAK4E,UAAY,GAIrB,MAAMtc,EAAS0C,KAAK8R,UAAUzF,MAAM/O,OACpC,IAAK,IAAIiW,EAAI,EAAGA,EAAIvT,KAAK8R,UAAU7F,OAAQsH,EAAG,CAC5C,MAAMyG,EAAO1c,EAAO2c,MAAM5I,IAAIkC,GAC9B,GAAKyG,EAGL,IAAK,IAAItD,EAAI,EAAGA,EAAI1W,KAAK8R,UAAU9F,OAAQ0K,EACzC,GAAuC,UAAnCsD,EAAK4B,MAAO,EAADlF,EAAa,GAAoC,CAC9D,MAAM4F,EAA8B,QAAtBlQ,EAAA4N,EAAKmB,eAAezE,UAAE,IAAAtK,OAAA,EAAAA,EAAEqL,QACtC,GAAI6E,EAAO,CACT,MAAMtH,EAAOhV,KAAK6X,QAAQxG,IAAIiL,GAC1BtH,GACFA,EAAK4E,WAET,CACF,CAEJ,CAEA,MAAMR,EAAO,GACb,IAAK,MAAOJ,EAAIhE,KAAShV,KAAK6X,QAAQwB,UACZ,cAApBrE,EAAKsE,YAA+BtE,EAAK4E,YAChC,QAAXpM,EAAAwH,EAAKyD,cAAM,IAAAjL,GAAAA,EAAE7F,UACbyR,EAAK1a,KAAKsa,IAGd,IAAK,MAAMA,KAAMI,EACfpZ,KAAK+Y,QAAQC,EAEjB,sFCnpBF,MAAAja,EAAAC,EAAA,KAEAqK,EAAArK,EAAA,KAEAud,EAAAvd,EAAA,KACAC,EAAAD,EAAA,KAMMwd,EAAkBzd,EAAAnC,iBACxB4f,EAAgBtZ,IAAInE,EAAAjC,qBAKpB,MACM2f,EAAe,IAAIzK,IACzB,IAAI0K,GAAa,EAgBjB,SAASC,EAAexW,EAAc3F,SAChC2F,EAAIvB,YA5Bc,SA6BpBuB,EAAIlC,UAEN,MAAM2Y,EAAoC,QAAhCxQ,EAAGqQ,EAAapL,IAAI7Q,UAAY,IAAA4L,EAAAA,EAAI,GAC1CwQ,EAAK7e,OAvBe,IAwBtB6e,EAAKle,KAAKyH,GACVsW,EAAavZ,IAAI1C,EAAaoc,GAElC,CA8IA,SAASC,EAAUpf,GACjB,OAAIsB,EAAA5B,WAAmBM,GACP,IAARA,IAAiB,IAAMA,IAAU,EAAI,MAAS,IAAMA,IAAU,GAAK,MAAS,EAAIA,IAAU,GAAK,GACzG,gBA9IA,MAQE,WAAAsC,CACmBmC,EACAiI,EACAC,GArCrB,IAA0B5J,EAmCLR,KAAAkC,MAAAA,EACAlC,KAAAmK,SAAAA,EACAnK,KAAAoK,cAAAA,EAVXpK,KAAA8c,MAAQ,EACR9c,KAAAsK,UAAW,EAEXtK,KAAA+c,gBAAkB,EAET/c,KAAAgD,SAAW,IAAI3F,YAAY4B,EAAAS,OAAOkB,cAOjDZ,KAAKgD,SAASE,IAAIsZ,GAvCIhc,EAwCmB,EAAxBR,KAAKkC,MAAM+K,WAvC1ByP,IACJA,GAAa,GAEb,EAAAH,EAAAzd,cAAa,CAAE0B,cAAa9C,QAAS8e,IAAmBnb,KACtDlD,GAAKwe,EAAexe,EAAGqC,GACvB,KAAQkc,GAAa,IAmCvB,CAEO,KAAAxR,GACLlL,KAAKgd,iBACLhd,KAAKgD,SAAS2C,KAAK,GACnB3F,KAAKgD,SAASE,IAAIsZ,EACpB,CAEO,IAAAS,CAAKC,SACVld,KAAK8c,MAAQ,EACb9c,KAAKsK,UAAW,EAChBtK,KAAKgd,iBACL,MAAMxc,EAAsC,EAAxBR,KAAKkC,MAAM+K,WAC/B,IACEjN,KAAK+K,KA7CX,SAAwBvK,WACtB,OAA2C,QAA3CgN,EAAoC,QAA7BpB,EAAAqQ,EAAapL,IAAI7Q,UAAY,IAAA4L,OAAA,EAAAA,EAAE+Q,aAAK,IAAA3P,EAAAA,EAAI,IAAI+O,EAAA1d,QAAQ,CAAE2B,cAAa9C,QAAS8e,GACrF,CA2CkBY,CAAe5c,EAC7B,CAAE,MAAOsH,GAIP,OAFAvK,QAAQC,KAAK,uCAAuCsK,UACpD9H,KAAKsK,UAAW,EAElB,CACAtK,KAAK+c,gBAAkBvc,EACvB,MAAME,EAAiC,IAArBwc,EAAOA,OAAO,GAAW,EAwE/C,SAAyBG,EAAqBC,GAC5C,IAAIC,EAAK,EACT,IAAKD,EAGH,OAAOC,EAET,GAAIF,EAAKG,YACP,GAAIH,EAAKI,cACPF,EAAKV,EAAUS,EAAOI,WAAWC,WAC5B,GAAIN,EAAKO,UAAW,CACzB,MAAMC,EAAKR,EAAKtd,YAAqC+d,WAAWT,EAAKU,cACrER,GAAK,EAAAxe,EAAAzD,eAAcuiB,EACrB,MACEN,EAAKV,EAAUS,EAAOU,KAAKX,EAAKU,cAAcJ,WAGhD,GAAIN,EAAKY,cACPV,EAAKV,EAAUS,EAAOY,WAAWP,WAC5B,GAAIN,EAAKc,UAAW,CACzB,MAAMN,EAAKR,EAAKtd,YAAqC+d,WAAWT,EAAKe,cACrEb,GAAK,EAAAxe,EAAAzD,eAAcuiB,EACrB,MACEN,EAAKV,EAAUS,EAAOU,KAAKX,EAAKe,cAAcT,MAGlD,OAAOJ,CACT,CAnGmDc,CAC7Cre,KAAKoK,cAAciC,MAAMwN,cAAcyE,aACD,QAAtClS,EAAApM,KAAKoK,cAAciC,MAAMkS,qBAAa,IAAAnS,OAAA,EAAAA,EAAEkR,QAC1Ctd,KAAK+K,KAAK1H,KAAK3C,EAAWV,KAAKgD,SAAUhD,KAAKkC,MAAMsc,kBACtD,CAEQ,cAAAxB,GACN,MAAM7W,EAAMnG,KAAK+K,KACZ5E,IACLnG,KAAK+K,UAAO/C,EACZhI,KAAKgD,SAASE,IAAIiD,EAAIzI,SACtBif,EAAexW,EAAKnG,KAAK+c,iBAC3B,CAEO,GAAA5R,CAAI/F,EAAmBC,EAAeC,GAC3C,IAAItF,KAAKsK,UAAatK,KAAK+K,KAA3B,CAIA,GADA/K,KAAK8c,OAASxX,EAAMD,EAChBrF,KAAK8c,MAAQ9c,KAAKkC,MAAMuc,eAI1B,OAHAlhB,QAAQC,KAAK,kCACbwC,KAAKsK,UAAW,OAChBtK,KAAK+K,KAAK9G,UAGZ,IACEjE,KAAK+K,KAAKnM,OAAOwG,EAAMC,EAAOC,EAChC,CAAE,MAAOwC,GACPvK,QAAQC,KAAK,uCAAuCsK,KACpD9H,KAAKsK,UAAW,EAChBtK,KAAK+K,KAAK9G,SACZ,CAdA,CAeF,CAEO,MAAAya,CAAOjT,GACZ,IACE,OAAOzL,KAAK2e,QAAQlT,EACtB,SACEzL,KAAKgd,gBACP,CACF,CAEQ,OAAA2B,CAAQlT,SACd,GAAIzL,KAAKsK,WAAamB,IAAYzL,KAAK+K,KACrC,OAAO,EAGT,MAAM7K,EAAQF,KAAK+K,KAAK7K,MAClB8D,EAAShE,KAAK+K,KAAK/G,OAGzB,IAAK9D,IAAU8D,EAIb,OAHIA,GACFhE,KAAKmK,SAASyU,cAAc5a,IAEvB,EAGT,MAAM+H,EAAS1C,EAAAiE,cAAcC,kBAAavF,EAAW9H,EAAO8D,GAG5D,OAFuB,QAAvBoI,EAAAL,EAAO0B,WAAW,aAAK,IAAArB,GAAAA,EAAEsB,aAAa,IAAIN,UAAUpN,KAAK+K,KAAK9E,MAAyC/F,EAAO8D,GAAS,EAAG,GAC1HhE,KAAKmK,SAASwD,SAAS5B,IAChB,CACT,2FCpJF,MAAAzC,EAAAtK,EAAA,yBAWA,MAEE,WAAAe,CACmBoK,EACAjI,EACAgI,EACA4H,GAHA9R,KAAAmK,SAAAA,EACAnK,KAAAkC,MAAAA,EACAlC,KAAAkK,UAAAA,EACAlK,KAAA8R,UAAAA,EALX9R,KAAAyQ,cAA+B,CAAEC,WAAW,EAAMC,MAAO,MAAOC,OAAQ,EAAGC,UAAW,QAM3F,CAMI,QAAAlD,CAASmD,GACd9Q,KAAKyQ,cAAcC,UAAY1Q,KAAKkC,MAAM2c,eAC1C7e,KAAKmK,SAASwD,SAASmD,EAAK9Q,KAAKyQ,cACnC,CAOO,aAAAmO,CAAc5a,GACnB,GAAIhE,KAAKkC,MAAM2c,eAAgB,CAC7B,IAAIzL,EAAWpT,KAAKkK,UAAUkJ,UACN,IAApBA,EAASlT,QAAqC,IAArBkT,EAASpP,SACpCoP,EAAW9J,EAAAsC,mBAEb,MAAMK,EAAOlQ,KAAKuI,KAAKN,EAASoP,EAASpP,QACzC,IAAK,IAAIlG,EAAI,EAAGA,EAAImO,IAAQnO,EAC1BkC,KAAK8R,UAAUzF,MAAMwN,cAAcO,UAEvC,CACF,iLC3CF,MAAA/Q,EAAArK,EAAA,KACAsK,EAAAtK,EAAA,KACA2K,EAAA3K,EAAA,KAEAuK,EAAAC,EAAAxK,EAAA,MACA8f,EAAA9f,EAAA,4BA0BA,MAiCE,WAAAe,CACmBmC,EACAgI,EACA6U,EACA3U,GAHApK,KAAAkC,MAAAA,EACAlC,KAAAkK,UAAAA,EACAlK,KAAA+e,cAAAA,EACA/e,KAAAoK,cAAAA,EApCXpK,KAAAsK,UAAW,EACXtK,KAAAqK,YAAc,EACdrK,KAAAgf,cAAe,EAEfhf,KAAAif,eAAuC,KAOvCjf,KAAAkf,gBAAiB,EAGjBlf,KAAAmf,aAAe,IAAI9hB,YAAW,KAC9B2C,KAAAof,eAAiB,EAGjBpf,KAAAqf,kBAAoB,EACpBrf,KAAAsf,kBAAoB,EAGpBtf,KAAAuf,eAAuC,KAIvCvf,KAAAwf,sBAA2D,IAAIxN,IAarEhS,KAAKyf,iBAAmB1jB,KAAKuI,KAAiC,EAA5BtE,KAAKkC,MAAMwd,eAAqB,GAElE1f,KAAK2f,qBAAuB5jB,KAAKE,IAAG,QAAiC+D,KAAKyf,iBAC5E,CAEO,KAAAvU,GACLlL,KAAKqK,cACLrK,KAAK4f,qBACD5f,KAAKif,iBACPjf,KAAKif,eAAehb,UACpBjE,KAAKif,eAAiB,MAExBjf,KAAK+e,cAAc7T,OACrB,CAEO,OAAAvD,GACL3H,KAAKkL,OACP,CAEQ,mBAAA2U,CAAoBrK,GAC1BxV,KAAKwf,sBAAsBrJ,OAAOX,GAC9BxV,KAAK8f,kBAAoBtK,IAC3BxV,KAAK8f,qBAAkB9X,EAE3B,CAEQ,kBAAA4X,GACN,IAAK,MAAMG,KAAW/f,KAAKwf,sBAAsBzK,SAC/CgL,EAAQC,QAAQ/b,UAElBjE,KAAKwf,sBAAsB1W,QAC3B9I,KAAK8f,qBAAkB9X,CACzB,CAEO,KAAA3C,GACLrF,KAAKsK,UAAW,EAChBtK,KAAKgf,cAAe,EACpBhf,KAAKkf,gBAAiB,EACtBlf,KAAKof,eAAiB,EACtBpf,KAAKuf,eAAiB,KAEtBvf,KAAKqf,kBAAoBrf,KAAKyf,iBAC9Bzf,KAAKsf,kBAAoB,EACzBtf,KAAKif,eAAiB,IACxB,CAEO,GAAA9T,CAAI/F,EAAmBC,EAAeC,SAC3C,IAAItF,KAAKsK,SAET,GAAKtK,KAAKkf,eAEH,CAEL,IAAIe,EAAa3a,EACjB,IAAK,IAAIxH,EAAIuH,EAAOvH,EAAIwH,EAAKxH,IAC3B,GAAW,KAAPsH,EAAKtH,GAA4B,CACnCkC,KAAKkf,gBAAiB,EACtBe,EAAaniB,EACb,KACF,CAIF,MAAMoiB,EAAaD,EAAa5a,EAChC,GAAIrF,KAAKof,eAAiBc,EAAU,IAElC,YADAlgB,KAAKsK,UAAW,GAMlB,GAHAtK,KAAKmf,aAAajc,IAAIkC,EAAKX,SAASY,EAAO4a,GAAajgB,KAAKof,gBAC7Dpf,KAAKof,gBAAkBc,GAElBlgB,KAAKkf,eAAgB,CAKxB,GAHAlf,KAAKuf,gBAAiB,EAAAT,EAAAqB,mBAAkBngB,KAAKogB,gCAGdpY,IAA3BhI,KAAKuf,eAAevG,SAAwDhR,IAApChI,KAAKuf,eAAec,YAG9D,OAFArgB,KAAKsgB,cAActgB,KAAKuf,eAAevG,GAAI,0CAAoE,QAA3B5M,EAAEpM,KAAKuf,eAAegB,aAAK,IAAAnU,EAAAA,EAAI,QACnHpM,KAAKsK,UAAW,GAKlB,GAA8B,MAA1BtK,KAAKuf,eAAeiB,OACtB,OAIF,MAAMC,EAAeR,EAAa,EAC9BQ,EAAenb,GACjBtF,KAAK0gB,eAAetb,EAAMqb,EAAcnb,EAE5C,CACF,MA3CEtF,KAAK0gB,eAAetb,EAAMC,EAAOC,EA4CrC,CAGQ,cAAAob,CAAetb,EAAmBC,EAAeC,2BACvD,GAAItF,KAAKsK,SAAU,OAKnB,MAAMqW,EAA4D,QAAlDlN,EAA0B,QAA1BlF,EAAsB,QAAnBnC,EAAApM,KAAKuf,sBAAc,IAAAnT,OAAA,EAAAA,EAAE4M,UAAE,IAAAzK,EAAAA,EAAIvO,KAAK8f,uBAAe,IAAArM,EAAAA,EAAI,EAChEsM,EAAU/f,KAAKwf,sBAAsBnO,IAAIsP,GACzCC,EAA+C,QAA5BC,EAAGd,aAAO,EAAPA,EAASe,wBAAgB,IAAAD,EAAAA,EAAI,EAGzD,GAFA7gB,KAAKsf,mBAAqBha,EAAMD,EACFub,EAAsB5gB,KAAKsf,kBAC7Btf,KAAKqf,kBAAmB,CAClD,MAAM0B,EAAsC,QAAtBC,EAAGhhB,KAAKif,sBAAc,IAAA+B,EAAAA,EAAIjB,aAAO,EAAPA,EAASC,QASzD,OARIe,GACFA,EAAiB9c,UAEnBjE,KAAKif,eAAiB,KAClBc,GACF/f,KAAK6f,oBAAoBc,QAE3B3gB,KAAKsK,UAAW,EAElB,CAEA,IAAItK,KAAKgf,aAAT,CAKA,IAHIe,aAAO,EAAPA,EAASC,WAAYhgB,KAAKif,iBAC5Bjf,KAAKif,eAAiBc,EAAQC,UAE3BhgB,KAAKif,eAAgB,CAExB,MAAMgC,EAAkBjhB,KAAKyf,iBAAmB,OAChD,GAAIwB,EAA4C,IAA1BjhB,KAAKkC,MAAMkW,aAK/B,OAJApY,KAAKsK,UAAW,YACgBtC,KAAT,QAAnBwF,EAAAxN,KAAKuf,sBAAc,IAAA/R,OAAA,EAAAA,EAAEwL,KACvBhZ,KAAKsgB,cAActgB,KAAKuf,eAAevG,GAAI,uCAAiE,QAA3BkI,EAAElhB,KAAKuf,eAAegB,aAAK,IAAAW,EAAAA,EAAI,IAIpH,MAAMC,EAAaplB,KAAKC,IAAI,EAAGD,KAAKoR,MAAgC,IAA1BnN,KAAKkC,MAAMkW,aAAyB6I,IAC9E,KAAOjhB,KAAKwf,sBAAsBzV,MAAQoX,GAAY,CACpD,MAAMC,EAASphB,KAAKwf,sBAAsBnG,UAAUgI,OAAOvlB,MAC3D,IAAKslB,EAAQ,MACbA,EAAO,GAAGpB,QAAQ/b,UAClBjE,KAAK6f,oBAAoBuB,EAAO,SACPpZ,IAArBoZ,EAAO,GAAGE,IAAItI,IAChBhZ,KAAKsgB,cAAcc,EAAO,GAAGE,IAAItI,GAAI,uCAA2D,QAArBuI,EAAEH,EAAO,GAAGE,IAAIf,aAAK,IAAAgB,EAAAA,EAAI,EAExG,CACA,MAAMvB,EAAU,IAAIzW,EAAAyB,QAAa,QAA8BhL,KAAKyf,iBAAkBzf,KAAK2f,sBAC3F,IACEK,EAAQ3c,MACV,CAAE,MAAOyE,GAOP,OALAvK,QAAQC,KAAK,oCAAqCsK,GAClD9H,KAAKsK,UAAW,YACgBtC,KAAT,QAAnBmE,EAAAnM,KAAKuf,sBAAc,IAAApT,OAAA,EAAAA,EAAE6M,KACvBhZ,KAAKsgB,cAActgB,KAAKuf,eAAevG,GAAI,oCAA8D,QAA3BwI,EAAExhB,KAAKuf,eAAegB,aAAK,IAAAiB,EAAAA,EAAI,GAGjH,CACAxhB,KAAKif,eAAiBe,CACxB,CA1Me,IA4MXhgB,KAAKif,eAAe9T,IAAI/F,EAAKX,SAASY,EAAOC,MAC/CtF,KAAKif,eAAehb,UACpBjE,KAAKif,eAAiB,KACtBjf,KAAKgf,cAAe,EAChBe,GACF/f,KAAK6f,oBAAoBc,GA7CN,CAgDzB,CAEO,GAAArb,CAAImG,WACT,GAAIzL,KAAKsK,WAAamB,EAKpB,OAJIzL,KAAKif,iBACPjf,KAAKif,eAAehb,UACpBjE,KAAKif,eAAiB,OAEjB,EAIT,GAAIjf,KAAKkf,eACP,OAAOlf,KAAKyhB,0BAId,MAAMH,EAAMthB,KAAKuf,eAGjB,GAAc,MAAV+B,EAAId,OACN,OAAOxgB,KAAK0hB,cAAcJ,GAI5B,MAAMX,EAA2C,QAAjCnT,EAAS,QAATpB,EAAGkV,EAAItI,UAAE,IAAA5M,EAAAA,EAAIpM,KAAK8f,uBAAe,IAAAtS,EAAAA,EAAI,EAC/CmU,EAA4B,IAAbL,EAAIM,KACnB7B,EAAU/f,KAAKwf,sBAAsBnO,IAAIsP,GAE/C,GAAIgB,EAgBF,OAfI3hB,KAAKif,iBACHc,GACFA,EAAQe,kBAAoB9gB,KAAKsf,kBACjCS,EAAQ8B,YAAc9B,EAAQ8B,aAAe7hB,KAAKgf,cAElDhf,KAAKwf,sBAAsBtc,IAAIyd,EAAY,CACzCW,IAAG9kB,OAAA2F,OAAA,GAAOmf,GACVtB,QAAShgB,KAAKif,eACd6B,iBAAkB9gB,KAAKsf,kBACvBuC,YAAa7hB,KAAKgf,eAGtBhf,KAAK8f,gBAAkBa,EACvB3gB,KAAKif,eAAiB,OAEjB,EAILc,IACF/f,KAAK8f,qBAAkB9X,GAGzB,IAAI6Z,EAAc7hB,KAAKgf,aACnB8C,EAAWR,EACXtB,EAAUhgB,KAAKif,eAEfc,IACF+B,EAAW/B,EAAQuB,IACnBtB,EAAUD,EAAQC,QAClB6B,EAAcA,GAAe9B,EAAQ8B,YACrC7hB,KAAKwf,sBAAsBrJ,OAAOwK,IAGpC,IAAIoB,EAAa,IAAI3kB,WAAW,GAC5B4iB,IArRW,IAsRTA,EAAQ1a,QACVuc,GAAc,GAEhBE,EAAa/B,EAAQ/Z,OAEvBjG,KAAKif,eAAiB,KAKtB,MAAM1f,EAASS,KAAKgiB,8BAA8BF,EAAUC,EAAYF,GAIxE,OAHI7B,GACFA,EAAQ/b,UAEH1E,CACT,CAIQ,uBAAA6gB,GACN,IAAI6B,EAAM,GACV,IAAK,IAAInkB,EAAI,EAAGA,EAAIkC,KAAKof,eAAgBthB,IACvCmkB,GAAO9S,OAAO+S,cAAcliB,KAAKmf,aAAarhB,IAEhD,OAAOmkB,CACT,CAEQ,uBAAAR,iBACN,MAAMH,GAAM,EAAAxC,EAAAqB,mBAAkBngB,KAAKogB,2BAGnC,QAAepY,IAAXsZ,EAAItI,SAAwChR,IAApBsZ,EAAIjB,YAE9B,OADArgB,KAAKsgB,cAAcgB,EAAItI,GAAI,0CAAoD,QAAX5M,EAAEkV,EAAIf,aAAK,IAAAnU,EAAAA,EAAI,IAC5E,EAKT,OAFyB,QAAboB,EAAG8T,EAAId,cAAM,IAAAhT,EAAAA,EAAI,KAG3B,QACE,OAAOxN,KAAK0hB,cAAcJ,GAC5B,QAEE,OADAthB,KAAKsgB,cAAoB,QAAPnU,EAACmV,EAAItI,UAAE,IAAA7M,EAAAA,EAAI,EAAG,KAAe,QAAXoC,EAAE+S,EAAIf,aAAK,IAAAhS,EAAAA,EAAI,IAC5C,EACT,QACE,OAAOvO,KAAKmiB,iBAAiBb,GAC/B,QAQE,YAHetZ,IAAXsZ,EAAItI,IACNhZ,KAAKsgB,cAAcgB,EAAItI,GAAI,4BAAsC,QAAXvF,EAAE6N,EAAIf,aAAK,IAAA9M,EAAAA,EAAI,IAEhE,EAEb,CAEQ,6BAAAuO,CAA8BV,EAAoBc,EAAmBP,iBAG3E,OAFyB,QAAbzV,EAAGkV,EAAId,cAAM,IAAApU,EAAAA,EAAI,KAG3B,QAA2B,CACzB,MAAM7M,EAASS,KAAKqiB,gBAAgBf,EAAKc,EAAOP,GAUhD,MAPkC,OAAb,QAAjBrU,EAAC8T,EAAIgB,oBAAY,IAAA9U,EAAAA,EAAI,WAA2BxF,IAAXsZ,EAAItI,KACvC6I,EACF7hB,KAAKsgB,cAAcgB,EAAItI,GAAI,6BAAuC,QAAX7M,EAAEmV,EAAIf,aAAK,IAAApU,EAAAA,EAAI,GAC7DiW,EAAMrkB,OAAS,GACxBiC,KAAKsgB,cAAcgB,EAAItI,GAAI,KAAe,QAAXzK,EAAE+S,EAAIf,aAAK,IAAAhS,EAAAA,EAAI,IAG3ChP,CACT,CACA,QACE,OAAOS,KAAKuiB,uBAAuBjB,EAAKc,EAAOP,GACjD,QACE,OAAO7hB,KAAKwiB,aAAalB,EAAKc,EAAOP,GACvC,QAEE,OAAO7hB,KAAKmiB,iBAAiBb,GAC/B,QAQE,YAHetZ,IAAXsZ,EAAItI,IACNhZ,KAAKsgB,cAAcgB,EAAItI,GAAI,4BAAsC,QAAXvF,EAAE6N,EAAIf,aAAK,IAAA9M,EAAAA,EAAI,IAEhE,EAEb,CAEQ,gBAAA0O,CAAiBb,SACvB,QAAetZ,IAAXsZ,EAAItI,GACN,OAAO,EAET,MAAMA,EAAKsI,EAAItI,GACTyJ,EAAQziB,KAAK+e,cAAc2D,SAAS1J,GAC1C,OAAKyJ,EAIUziB,KAAK2iB,cAAcF,EAAOnB,GAC3BjgB,KAAKoK,UAEjB,OADAzL,KAAKsgB,cAActH,EAAIvN,EAAU,KAAO,gCAA0C,QAAXW,EAAEkV,EAAIf,aAAK,IAAAnU,EAAAA,EAAI,EAAGkV,EAAIsB,cACtF,KANP5iB,KAAKsgB,cAActH,EAAI,yBAAmC,QAAX5M,EAAEkV,EAAIf,aAAK,IAAAnU,EAAAA,EAAI,EAAGkV,EAAIsB,cAC9D,EAOX,CAEQ,eAAAP,CAAgBf,EAAoBc,EAAmBP,mBAY7D,MAAqB,OADgB,QAAnBzV,EAAGkV,EAAIgB,oBAAY,IAAAlW,EAAAA,EAAI,WAExBpE,IAAXsZ,EAAItI,IACNhZ,KAAKsgB,cAAcgB,EAAItI,GAAI,yCAAmD,QAAXxL,EAAE8T,EAAIf,aAAK,IAAA/S,EAAAA,EAAI,IAE7E,IAGLqU,GAAgC,IAAjBO,EAAMrkB,QAEzBiC,KAAK+e,cAAc8D,WAAWvB,EAAItI,GAAI,CACpC5T,KAAM,IAAIwI,KAAK,CAACwU,IAChBliB,MAAgB,QAAXiM,EAAEmV,EAAIphB,aAAK,IAAAiM,EAAAA,EAAI,EACpBnI,OAAkB,QAAZuK,EAAE+S,EAAItd,cAAM,IAAAuK,EAAAA,EAAI,EACtBuU,OAAmB,QAAXrP,EAAC6N,EAAIwB,cAAM,IAAArP,EAAAA,EAAA,GACnBsP,YAA4B,QAAjBlC,EAAES,EAAIyB,mBAAW,IAAAlC,EAAAA,EAAI,MAPY,EAUhD,CAEQ,sBAAA0B,CAAuBjB,EAAoBc,EAAmBP,WACpE,GAAIA,EAIF,YAHe7Z,IAAXsZ,EAAItI,IACNhZ,KAAKsgB,cAAcgB,EAAItI,GAAI,6BAAuC,QAAX5M,EAAEkV,EAAIf,aAAK,IAAAnU,EAAAA,EAAI,IAEjE,EAGTpM,KAAKqiB,gBAAgBf,EAAKc,EAAOP,GAEjC,MAAM7I,EAAW,QAATxL,EAAG8T,EAAItI,UAAE,IAAAxL,EAAAA,EAAIxN,KAAK+e,cAAciE,YAClCP,EAAQziB,KAAK+e,cAAc2D,SAAS1J,GAC1C,GAAIyJ,EAAO,CACT,MAAMljB,EAASS,KAAK2iB,cAAcF,EAAOnB,GACzC,YAAetZ,IAAXsZ,EAAItI,GACCzZ,EAAO8B,KAAKoK,UAEjB,OADAzL,KAAKsgB,cAActH,EAAIvN,EAAU,KAAO,gCAA0C,QAAXW,EAAEkV,EAAIf,aAAK,IAAAnU,EAAAA,EAAI,IAC/E,IAGJ7M,EAAO8B,KAAK,KAAM,EAC3B,CACA,OAAO,CACT,CAEQ,YAAAmhB,CAAalB,EAAoBc,EAAmBP,mBAC1D,MAAM7I,EAAW,QAAT5M,EAAGkV,EAAItI,UAAE,IAAA5M,EAAAA,EAAI,EACfmU,EAAiB,QAAZ/S,EAAG8T,EAAIf,aAAK,IAAA/S,EAAAA,EAAI,EAM3B,GAAqB,OADgB,QAAnBrB,EAAGmV,EAAIgB,oBAAY,IAAAnW,EAAAA,EAAI,KAGvC,OADAnM,KAAKsgB,cAActH,EAAI,yCAA0CuH,IAC1D,EAIT,GAAIsB,EAEF,OADA7hB,KAAKsgB,cAActH,EAAI,6BAA8BuH,IAC9C,EAIT,GAAqB,IAAjB6B,EAAMrkB,OAER,OADAiC,KAAKsgB,cAActH,EAAI,KAAMuH,IACtB,EAGT,MAAMuC,EAAmB,QAAbvU,EAAG+S,EAAIwB,cAAM,IAAAvU,EAAAA,EAAA,GAEzB,GAAU,MAANuU,EACF9iB,KAAKsgB,cAActH,EAAI,KAAMuH,OACxB,CACL,MAAMrgB,EAAiB,QAAZuT,EAAG6N,EAAIphB,aAAK,IAAAuT,EAAAA,EAAI,EACrBzP,EAAmB,QAAb6c,EAAGS,EAAItd,cAAM,IAAA6c,EAAAA,EAAI,EAE7B,IAAK3gB,IAAU8D,EAEb,OADAhE,KAAKsgB,cAActH,EAAI,sDAAuDuH,IACvE,EAGT,MACM0C,EAAgB/iB,EAAQ8D,GADF,KAAN8e,EAA6B,EAA2C,GAG9F,GAAIV,EAAMrkB,OAASklB,EAEjB,OADAjjB,KAAKsgB,cAActH,EAAI,iCAAkCuH,IAClD,EAGTvgB,KAAKsgB,cAActH,EAAI,KAAMuH,EAC/B,CACA,OAAO,CACT,CAEQ,aAAAmB,CAAcJ,SAOpB,OALmC,QAArBlV,EAAGkV,EAAI4B,sBAAc,IAAA9W,EAAAA,EAAI,KAMrC,IAAK,IACL,IAAK,IACHpM,KAAK4f,qBACL5f,KAAK+e,cAAcoE,YACnB,MACF,IAAK,IACL,IAAK,IAKH,QAAenb,IAAXsZ,EAAItI,GAAkB,CACxB,MAAM+G,EAAU/f,KAAKwf,sBAAsBnO,IAAIiQ,EAAItI,IAC/C+G,GACFA,EAAQC,QAAQ/b,UAElBjE,KAAK6f,oBAAoByB,EAAItI,IAC7BhZ,KAAK+e,cAAcqE,WAAW9B,EAAItI,GACpC,EAMJ,OAAO,CACT,CAEQ,aAAAsH,CAActH,EAAYV,EAAiBiI,EAAeqC,GAChE,MAAMS,EAAmB,OAAZ/K,EACb,GAAI+K,GAAQ9C,GAAS,EAAG,OACxB,IAAK8C,GAAQ9C,GAAS,EAAG,OAEzB,MACM+C,EAAW,QAAWtK,IADd4J,EAAc,MAAMA,IAAgB,MACRtK,OAC1CtY,KAAKoK,cAAciC,MAAMkX,YAAYC,iBAAiBF,EACxD,CAIQ,aAAAX,CAAcF,EAAwBnB,GAC5C,OAAOthB,KAAKyjB,kBAAkBhB,EAAOnB,GAClCjgB,KAAK,KAAM,GACX8M,MAAM,KAAM,EACjB,CAEQ,uBAAMsV,CAAkBhB,EAAwBnB,qBACtD,MAAMzT,EAAa7N,KAAKqK,YACxB,IAAIyM,QAAwC9W,KAAK0jB,cAAcjB,GAE/D,IACE,GAAI5U,IAAe7N,KAAKqK,YAAa,MAAM,IAAIjI,MAAM,yBACrD,MAAMuhB,EAAQ5nB,KAAKC,IAAI,EAAQ,QAAPmQ,EAAEmV,EAAI5K,SAAC,IAAAvK,EAAAA,EAAI,GAC7ByX,EAAQ7nB,KAAKC,IAAI,EAAQ,QAAPuS,EAAE+S,EAAI/N,SAAC,IAAAhF,EAAAA,EAAI,GAC7BsV,EAAQvC,EAAInN,aAAgB2C,EAAO5W,MAAQyjB,EAC3CG,EAAQxC,EAAIlN,cAAiB0C,EAAO9S,OAAS4f,EAE7CG,EAAWhoB,KAAKC,IAAI,EAAG8a,EAAO5W,MAAQyjB,GACtCK,EAAWjoB,KAAKC,IAAI,EAAG8a,EAAO9S,OAAS4f,GACvCK,EAAaloB,KAAKC,IAAI,EAAGD,KAAKE,IAAI4nB,EAAOE,IACzCG,EAAanoB,KAAKC,IAAI,EAAGD,KAAKE,IAAI6nB,EAAOE,IAE/C,GAAmB,IAAfC,GAAmC,IAAfC,EACtB,MAAM,IAAI9hB,MAAM,4BAGlB,GAAc,IAAVuhB,GAAyB,IAAVC,GAAeK,IAAenN,EAAO5W,OAASgkB,IAAepN,EAAO9S,OAAQ,CAC7F,MAAMmgB,QAAgBrW,kBAAkBgJ,EAAQ6M,EAAOC,EAAOK,EAAYC,GAC1EpN,EAAO5I,QACP4I,EAASqN,CACX,CAEA,MAAM/V,GAA8B,QAAzBhC,EAAApM,KAAKkK,UAAU2B,kBAAU,IAAAO,OAAA,EAAAA,EAAEN,IAAIuC,KAAKnO,QAASoJ,EAAAsC,kBAAkB1L,MACpEoO,GAA8B,QAAzBd,EAAAxN,KAAKkK,UAAU2B,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIuC,KAAKrK,SAAUsF,EAAAsC,kBAAkB5H,OAI3E,IAAIogB,EACAC,OACgBrc,IAAhBsZ,EAAIgD,cAAsCtc,IAAbsZ,EAAIrV,MACnCmY,EAAU9C,EAAIgD,QACdD,EAAU/C,EAAIrV,WACWjE,IAAhBsZ,EAAIgD,SACbF,EAAU9C,EAAIgD,QACdD,EAAUtoB,KAAKC,IAAI,EAAGD,KAAKuI,KAAMwS,EAAO9S,OAAS8S,EAAO5W,OAAUkkB,EAAUhW,GAAME,UAC5DtG,IAAbsZ,EAAIrV,MACboY,EAAU/C,EAAIrV,KACdmY,EAAUroB,KAAKC,IAAI,EAAGD,KAAKuI,KAAMwS,EAAO5W,MAAQ4W,EAAO9S,QAAWqgB,EAAU/V,GAAMF,MAElFgW,EAAUroB,KAAKuI,KAAKwS,EAAO5W,MAAQkO,GACnCiW,EAAUtoB,KAAKuI,KAAKwS,EAAO9S,OAASsK,IAGtC,IAAI3C,EAAImL,EAAO5W,MACX9B,EAAI0Y,EAAO9S,OAQf,QALoBgE,IAAhBsZ,EAAIgD,cAAsCtc,IAAbsZ,EAAIrV,OACnCN,EAAI5P,KAAKQ,MAAM6nB,EAAUhW,GACzBhQ,EAAIrC,KAAKQ,MAAM8nB,EAAU/V,IAGvB3C,EAAIvN,EAAI4B,KAAKkC,MAAM+K,WACrB,MAAM,IAAI7K,MAAM,6BAIlB,MAAM9E,EAAS0C,KAAKoK,cAAciC,MAAM/O,OAClCinB,EAASjnB,EAAOoZ,EAChB8N,EAASlnB,EAAOiW,EAChBkR,EAAannB,EAAO4c,MAOpBvJ,OAD6B3I,IAAfsZ,EAAI1Q,QAAwB0Q,EAAI1Q,OAAS,EACrB,SAAW,MAEnD,GAAIjF,IAAMmL,EAAO5W,OAAS9B,IAAM0Y,EAAO9S,OAAQ,CAC7C,MAAM0gB,QAAe5W,kBAAkBgJ,EAAQ,CAAE/I,YAAapC,EAAGqC,aAAc5P,IAC/E0Y,EAAO5I,QACP4I,EAAS4N,CACX,CAGA,MAAMC,EAAU5oB,KAAKE,IAAIF,KAAKC,IAAI,EAAc,QAAbyX,EAAE6N,EAAIqD,eAAO,IAAAlR,EAAAA,EAAI,GAAIrF,EAAK,GACvDwW,EAAU7oB,KAAKE,IAAIF,KAAKC,IAAI,EAAc,QAAb6kB,EAAES,EAAIsD,eAAO,IAAA/D,EAAAA,EAAI,GAAIvS,EAAK,GAC7D,GAAgB,IAAZqW,GAA6B,IAAZC,EAAe,CAKlC,MAAMC,OAA2B7c,IAAhBsZ,EAAIgD,QAAyBvoB,KAAKQ,MAAM6nB,EAAUhW,GAAM0I,EAAO5W,MAAQykB,EAClFG,OAAwB9c,IAAbsZ,EAAIrV,KAAsBlQ,KAAKQ,MAAM8nB,EAAU/V,GAAMwI,EAAO9S,OAAS4gB,EAChFG,EAAe1b,EAAAiE,cAAcC,aAAawJ,OAAOxF,SAAUsT,EAASC,GACpEE,EAAYD,EAAatX,WAAW,MAC1C,IAAKuX,EACH,MAAM,IAAI5iB,MAAM,0CAElB4iB,EAAUpQ,UAAUkC,EAAQ6N,EAASC,GAErC,MAAMK,QAAqBnX,kBAAkBiX,GAM7C,GALAA,EAAa7kB,MAAQ6kB,EAAa/gB,OAAS,EAC3C8S,EAAO5I,QACP4I,EAASmO,EACTtZ,EAAImL,EAAO5W,MACX9B,EAAI0Y,EAAO9S,OACP2H,EAAIvN,EAAI4B,KAAKkC,MAAM+K,WACrB,MAAM,IAAI7K,MAAM,kCAEE4F,IAAhBsZ,EAAIgD,UACNF,EAAUroB,KAAKuI,KAAKwS,EAAO5W,MAAQkO,SAEpBpG,IAAbsZ,EAAIrV,OACNoY,EAAUtoB,KAAKuI,KAAKwS,EAAO9S,OAASsK,GAExC,CAEA,GAAIT,IAAe7N,KAAKqK,YAAa,MAAM,IAAIjI,MAAM,yBACrD,MAAMwO,EAAmB,QAAboQ,EAAGM,EAAI1Q,cAAM,IAAAoQ,EAAAA,EAAI,EAO7B,GANAhhB,KAAK+e,cAAcpR,SAAS8U,EAAMzJ,GAAIlC,GAAQ,EAAMnG,EAAOC,GAC3DkG,OAAS9O,EAKkB,IAAvBsZ,EAAI4D,eAAsB,CAE5B,MAAMC,EAAW7nB,EAAO4c,MAAQuK,EAChCnnB,EAAOoZ,EAAI6N,EAEXjnB,EAAOiW,EAAIxX,KAAKC,IAAIwoB,EAASW,EAAU,EACzC,MAGE7nB,EAAOoZ,EAAI3a,KAAKE,IAAIsoB,EAASH,EAASpkB,KAAKoK,cAAc4B,KAE7D,CAAE,MAAOlE,GAEP,MADAgP,SAAAA,EAAQ5I,QACFpG,CACR,CACF,CAGQ,mBAAM4b,CAAcjB,GAC1B,IAAIL,EAAoB,IAAIhlB,iBAAiBqlB,EAAMrd,KAAKggB,eAMxD,GAJqB,MAAjB3C,EAAMM,cACRX,QAAcpiB,KAAKqlB,gBAAgBjD,IAGrB,MAAZK,EAAMK,OAA4B,CACpC,MAAMjW,GAAU,EAAAlD,EAAAoD,WAAUqV,GAG1B,GAAqB,cAAjBvV,EAAQG,QAA0BH,EAAQ3M,MAAQ,MAAQ2M,EAAQ7I,OAAS,IAAM6I,EAAQ3M,MAAQ2M,EAAQ7I,OAAShE,KAAKkC,MAAM+K,WAC/H,MAAM,IAAIyL,WAAW,qDAEvB,MAAM9L,EAAO,IAAIgB,KAAK,CAACwU,GAAoB,CAAEvY,KAAM,cACnD,IAAKkN,OAAOjJ,kBAAmB,CAC7B,MAAMwX,EAAMC,IAAIC,gBAAgB5Y,GAC1BkE,EAAM,IAAI2U,MAChB,OAAO,IAAI7T,QAAqB,CAACC,EAAS6T,KACxC5U,EAAI6U,iBAAiB,OAAQ,WAC3BJ,IAAIK,gBAAgBN,GACpB,MAAMvZ,EAAS1C,EAAAiE,cAAcC,aAAawJ,OAAOxF,SAAUT,EAAI5Q,MAAO4Q,EAAI9M,QACnD,QAAvBoI,EAAAL,EAAO0B,WAAW,aAAK,IAAArB,GAAAA,EAAEwI,UAAU9D,EAAK,EAAG,GAC3ChD,kBAAkB/B,GAAQ1K,KAAKwQ,GAAS1D,MAAMuX,KAEhD5U,EAAI6U,iBAAiB,QAAS,KAC5BJ,IAAIK,gBAAgBN,GACpBI,EAAO,IAAItjB,MAAM,2BAEnB0O,EAAI+U,IAAMP,GAEd,CACA,OAAOxX,kBAAkBlB,EAC3B,CAGA,MAAM1M,EAAQuiB,EAAMviB,MACd8D,EAASye,EAAMze,OAErB,IAAK9D,IAAU8D,EACb,MAAM,IAAI5B,MAAM,gDAGlB,MACM6gB,EAAgB/iB,EAAQ8D,GADI,KAAZye,EAAMK,OAA6B,EAA2C,GAGpG,GAAIV,EAAMrkB,OAASklB,EACjB,MAAM,IAAI7gB,MAAM,2BAGlB,MAAM0jB,EAAa5lB,EAAQ8D,EAE3B,GAAgB,KAAZye,EAAMK,OAER,OAAOhV,kBAAkB,IAAIV,UAAU,IAAIlH,kBAAkBkc,EAAM9kB,OAAuB8kB,EAAM/U,WAAsB,EAAVyY,GAAwD5lB,EAAO8D,IAM7K,MAAMoB,EAAO,IAAIc,kBAA4B,EAAV4f,GAC7BC,EAAQ,IAAI1oB,YAAY+kB,EAAM9kB,OAAQ8kB,EAAM/U,WAAYtR,KAAKoR,MAAMiV,EAAMvd,WAAa,IACtFmhB,EAAQ,IAAI3oB,YAAY+H,EAAK9H,QAC7B2oB,GAA6B,EAAbH,EAEtB,IAAII,EAAY,EACZC,EAAY,EAChB,IAAK,IAAIroB,EAAI,EAAGA,EAAImoB,EAAenoB,GAAK,EAAG,CACzC,MAAMsoB,EAAKL,EAAMG,KACXG,EAAKN,EAAMG,KACXI,EAAKP,EAAMG,KAEjBF,EAAMG,KAAe,WAAaC,EAClCJ,EAAMG,KAAe,WAAcC,IAAO,GAAOC,GAAM,EACvDL,EAAMG,KAAe,WAAcE,IAAO,GAAOC,GAAM,GACvDN,EAAMG,KAAe,WAAcG,IAAO,CAC5C,CAGA,IAAIC,EAAuB,EAAbN,EACVO,EAAuB,EAAbP,EACd,IAAK,IAAInoB,EAAImoB,EAAenoB,EAAIgoB,EAAYhoB,IAC1CsH,EAAKohB,GAAepE,EAAMmE,GAC1BnhB,EAAKohB,EAAU,GAAKpE,EAAMmE,EAAU,GACpCnhB,EAAKohB,EAAU,GAAKpE,EAAMmE,EAAU,GACpCnhB,EAAKohB,EAAU,GAAE,IACjBD,GAAO,EACPC,GAAO,EAGT,OAAO1Y,kBAAkB,IAAIV,UAAUhI,EAAMlF,EAAO8D,GACtD,CAEQ,qBAAMqhB,CAAgBoB,GAC5B,IACE,aAAazmB,KAAK0mB,YAAYD,EAAY,UAC5C,CAAE,MAAOpO,GACP,GAAIA,aAAiBK,WAAY,MAAML,EACvC,aAAarY,KAAK0mB,YAAYD,EAAY,cAC5C,CACF,CAEQ,iBAAMC,CAAYD,EAAwB3D,GAChD,MAAM3R,EAAQpV,KAAKE,IAAI+D,KAAKkC,MAAMwd,eAAwC,EAAxB1f,KAAKkC,MAAM+K,WAA0C,IAA1BjN,KAAKkC,MAAMkW,cACxF,IAAIuO,EAAW,EAEf,MAWMC,EAXS,IAAIC,eAA6B,CAC9C,IAAAC,CAAKC,GACH,GAAIJ,GAAYF,EAAW1oB,OAEzB,YADAgpB,EAAW7Y,QAGb,MAAM5I,EAAMvJ,KAAKE,IAAI0qB,EAAW,KAAMF,EAAW1oB,QACjDgpB,EAAWC,QAAQ,IAAI5pB,WAAWqpB,EAAWhiB,SAASkiB,EAAUrhB,KAChEqhB,EAAWrhB,CACb,IAEoB2hB,YAAY,IAAIC,oBAAoBpE,IAASqE,YAC7DC,EAAuB,GAC7B,IAAIC,EAAc,EAClB,IACE,OAAa,CACX,MAAMC,KAAEA,EAAIxrB,MAAEA,SAAgB8qB,EAAOW,OACrC,GAAID,EAAM,MAEV,GADAD,GAAevrB,EAAM+I,WACjBwiB,EAAclW,EAEhB,YADMyV,EAAOY,SAASrZ,MAAM,QACtB,IAAIuK,WAAW,yCAEvB0O,EAAO1oB,KAAK5C,EACd,CACF,SACE8qB,EAAOa,aACT,CAEA,MAAMloB,EAAS,IAAInC,WAAWiqB,GAC9B,IAAIljB,EAAS,EACb,IAAK,MAAMujB,KAASN,EAClB7nB,EAAO2D,IAAIwkB,EAAOvjB,GAClBA,GAAUujB,EAAM3pB,OAElB,OAAOwB,CACT,CAEA,UAAWooB,GACT,OAAO3nB,KAAK+e,cAAc4I,MAC5B,CAEA,uBAAWC,GACT,OAAO5nB,KAAK+e,cAAc8I,kBAC5B,CAEA,wBAAWC,GACT,OAAO9nB,KAAKwf,qBACd,kFC/tBF,SAAkCpa,GAChC,MAAMkc,EAAqB,GACrByG,EAAQ3iB,EAAK4iB,MAAM,KAEzB,IAAK,MAAMC,KAAQF,EAAO,CACxB,MAAMG,EAAQD,EAAK/gB,QAAQ,KAC3B,IAAe,IAAXghB,EAAc,SAElB,MAAM1S,EAAMyS,EAAKE,UAAU,EAAGD,GACxBpsB,EAAQmsB,EAAKE,UAAUD,EAAQ,GAGrC,GAAO,MAAH1S,EAAyB,CAC3B8L,EAAId,OAAS1kB,EACb,QACF,CACA,GAAO,MAAH0Z,EAA8B,CAChC8L,EAAIyB,YAAcjnB,EAClB,QACF,CACA,GAAO,MAAH0Z,EAA+B,CACjC8L,EAAIgB,aAAexmB,EACnB,QACF,CACA,GAAO,MAAH0Z,EAAkC,CACpC8L,EAAI4B,eAAiBpnB,EACrB,QACF,CACA,MAAMssB,EAAWnZ,SAASnT,EAAO,IACjC,OAAQ0Z,GACN,QAAsB8L,EAAIwB,OAASsF,EAAU,MAC7C,QAAkB9G,EAAItI,GAAKoP,EAAU,MACrC,QAA4B9G,EAAIjB,YAAc+H,EAAU,MACxD,QAAqB9G,EAAIphB,MAAQkoB,EAAU,MAC3C,QAAsB9G,EAAItd,OAASokB,EAAU,MAC7C,QAAwB9G,EAAI5K,EAAI0R,EAAU,MAC1C,QAAwB9G,EAAI/N,EAAI6U,EAAU,MAC1C,QAA4B9G,EAAInN,YAAciU,EAAU,MACxD,QAA6B9G,EAAIlN,aAAegU,EAAU,MAC1D,QAAkC9G,EAAIqD,QAAUyD,EAAU,MAC1D,QAAkC9G,EAAIsD,QAAUwD,EAAU,MAC1D,QAAuB9G,EAAIgD,QAAU8D,EAAU,MAC/C,QAAoB9G,EAAIrV,KAAOmc,EAAU,MACzC,QAAoB9G,EAAIM,KAAOwG,EAAU,MACzC,QAAqB9G,EAAIf,MAAQ6H,EAAU,MAC3C,QAA+B9G,EAAI4D,eAAiBkD,EAAU,MAC9D,QAAuB9G,EAAI1Q,OAASwX,EAAU,MAC9C,QAA4B9G,EAAIsB,YAAcwF,EAElD,CAEA,OAAO9G,CACT,wFCjLA,MAAA+G,EA6BE,WAAAtoB,CACmBoK,GAAAnK,KAAAmK,SAAAA,EA3BXnK,KAAAsoB,aAAe,EACNtoB,KAAA6X,QAAwC,IAAI7F,IAU5ChS,KAAA4nB,oBAA2C,IAAI5V,IAC/ChS,KAAAuoB,oBAA2C,IAAIvW,IAI/ChS,KAAAwoB,2BAA8BC,IAC7C,MAAMC,EAAU1oB,KAAKuoB,oBAAoBlX,IAAIoX,QAC7BzgB,IAAZ0gB,IACF1oB,KAAK4nB,oBAAoBzR,OAAOuS,GAChC1oB,KAAKuoB,oBAAoBpS,OAAOsS,GAChCzoB,KAAK6X,QAAQ1B,OAAOuS,KAGhB1oB,KAAAyQ,cAA+B,CAAEC,WAAW,EAAMC,MAAO,MAAOC,OAAQ,EAAGC,UAAW,OAK5F7Q,KAAK2oB,wBAA0B3oB,KAAKmK,SAAS+O,eAC7ClZ,KAAK4oB,uBAA0BH,UACD,QAA5Brc,EAAApM,KAAK2oB,+BAAuB,IAAAvc,GAAAA,EAAA5E,KAA5BxH,KAA+ByoB,GAC/BzoB,KAAKwoB,2BAA2BC,IAElCzoB,KAAKmK,SAAS+O,eAAiBlZ,KAAK4oB,sBACtC,CAEO,KAAA1d,GACLlL,KAAKsoB,aAAe,EACpBtoB,KAAK6X,QAAQ/O,QACb9I,KAAK4nB,oBAAoB9e,QACzB9I,KAAKuoB,oBAAoBzf,OAC3B,CAEO,OAAAnB,GACL3H,KAAKkL,QACDlL,KAAKmK,SAAS+O,iBAAmBlZ,KAAK4oB,yBACxC5oB,KAAKmK,SAAS+O,eAAiBlZ,KAAK2oB,wBAExC,CAEO,UAAA9F,CAAW7J,EAAwB6P,GACxC,MAAMpR,EAAUuB,QAAAA,EAAMhZ,KAAKsoB,eAErBQ,EAAe9oB,KAAK4nB,oBAAoBvW,IAAIoG,QAC7BzP,IAAjB8gB,IACF9oB,KAAKmK,SAASoP,YAAYuP,GAC1B9oB,KAAK4nB,oBAAoBzR,OAAOsB,GAChCzX,KAAKuoB,oBAAoBpS,OAAO2S,KAG7B9oB,KAAK6X,QAAQlC,IAAI8B,IAAYzX,KAAK6X,QAAQ9N,MAAQse,EAAkBU,kBACvE/oB,KAAKgpB,0BASP,MAAMC,EAAuC,IAA3BjpB,KAAKmK,SAASoO,WAChCvY,KAAK6X,QAAQ1B,OAAOsB,GACpB,IAAIyR,EAAgB,EACpB,IAAK,MAAMzG,KAASziB,KAAK6X,QAAQ9C,SAAUmU,GAAiBzG,EAAMrd,KAAK2E,KACvE,IAAK,MAAMof,IAAe,EAAC,GAAO,GAChC,IAAK,MAAOC,EAAU3G,KAAUziB,KAAK6X,QAAS,CAC5C,GAAIqR,EAAgBL,EAAUzjB,KAAK2E,MAAQkf,EAAW,MAClDjpB,KAAK4nB,oBAAoBjS,IAAIyT,KAAcD,IAC/CD,GAAiBzG,EAAMrd,KAAK2E,KAC5B/J,KAAKojB,WAAWgG,GAClB,CAOF,OAJAppB,KAAK6X,QAAQ3U,IAAIuU,EAAOjb,OAAA2F,OAAA3F,OAAA2F,OAAA,GACnB0mB,GAAS,CACZ7P,GAAIvB,KAECA,CACT,CAEO,QAAA9J,CAAS+a,EAAiBjG,EAAwC/R,EAAoBC,EAAmBC,GAK9G,MAAMkY,EAAe9oB,KAAK4nB,oBAAoBvW,IAAIqX,QAC7B1gB,IAAjB8gB,GACF9oB,KAAKuoB,oBAAoBpS,OAAO2S,GAElC9oB,KAAKyQ,cAAcC,UAAYA,EAC/B1Q,KAAKyQ,cAAcE,MAAQA,EAC3B3Q,KAAKyQ,cAAcG,OAASA,EAC5B,MAAM6X,EAAYzoB,KAAKmK,SAASwD,SAAS8U,EAAOziB,KAAKyQ,eACrDzQ,KAAK4nB,oBAAoB1kB,IAAIwlB,EAASD,GACtCzoB,KAAKuoB,oBAAoBrlB,IAAIulB,EAAWC,EAC1C,CAEO,QAAAhG,CAASgG,GACd,OAAO1oB,KAAK6X,QAAQxG,IAAIqX,EAC1B,CAEO,UAAAtF,CAAWsF,GAChB1oB,KAAK6X,QAAQ1B,OAAOuS,GACpB,MAAMD,EAAYzoB,KAAK4nB,oBAAoBvW,IAAIqX,QAC7B1gB,IAAdygB,IACFzoB,KAAKmK,SAASoP,YAAYkP,GAC1BzoB,KAAK4nB,oBAAoBzR,OAAOuS,GAChC1oB,KAAKuoB,oBAAoBpS,OAAOsS,GAEpC,CAEO,SAAAtF,GACLnjB,KAAK6X,QAAQ/O,QACb,IAAK,MAAM2f,KAAazoB,KAAK4nB,oBAAoB7S,SAC/C/U,KAAKmK,SAASoP,YAAYkP,GAE5BzoB,KAAK4nB,oBAAoB9e,QACzB9I,KAAKuoB,oBAAoBzf,OAC3B,CAEA,UAAW6e,GACT,OAAO3nB,KAAK6X,OACd,CAEA,sBAAWgQ,GACT,OAAO7nB,KAAK4nB,mBACd,CAEA,eAAW5E,GACT,OAAOhjB,KAAKsoB,aAAe,CAC7B,CAEQ,uBAAAU,GACN,IAAK,MAAON,KAAY1oB,KAAK6X,QAAS,CACpC,GAAI7X,KAAK6X,QAAQ9N,MAAQse,EAAkBU,iBAAmB,EAC5D,MAEG/oB,KAAK4nB,oBAAoBjS,IAAI+S,IAChC1oB,KAAK6X,QAAQ1B,OAAOuS,EAExB,CACF,wBA1JwBL,EAAAU,iBAAmB,gBCjB7CvsB,OAAAC,eAAA5B,EAAA,cAA+CiB,OAAA,IAK/C,MAIAutB,GAAA,EAJyBrqB,EAAQ,KAIjCsqB,QAAA,CAAgGhrB,EAAA,EAAAuf,EAAA,EAAA1f,EAAA,6lCAuJhGorB,EAAA,IAAAnsB,WAAA,mEACA4qB,MAAA,IACAjgB,IAAAyhB,GAAAA,EAAAhqB,WAAA,KAEAiqB,EAAA,IAAApsB,YAAA,MACAosB,EAAA9jB,KAAA,YACA,QAAA7H,EAAA,EAAgBA,EAAAyrB,EAAAxrB,SAAgBD,EAChC2rB,EAAAF,EAAAzrB,IAAAA,GAAA,EACA,QAAAA,EAAA,EAAgBA,EAAAyrB,EAAAxrB,SAAgBD,EAChC2rB,EAAA,IAAAF,EAAAzrB,IAAAA,GAAA,GAAAA,GAAA,UACA,QAAAA,EAAA,EAAgBA,EAAAyrB,EAAAxrB,SAAgBD,EAChC2rB,EAAA,IAAAF,EAAAzrB,IAAAA,GAAA,MAAAA,GAAA,WACA,QAAAA,EAAA,EAAgBA,EAAAyrB,EAAAxrB,SAAgBD,EAChC2rB,EAAA,IAAAF,EAAAzrB,IAAAA,GAAA,GACA,MAAA4rB,EAAA,IAAAtsB,WAAA,GAkKAvC,EAAA,QAvJA,MAMA,WAAAkF,CAAA4pB,EAAAC,EAAA9e,GAOA,GANA9K,KAAA6pB,MAAA,KACA7pB,KAAA8pB,QAAA,EACA9pB,KAAA+pB,OAAA,EACA/pB,KAAA2pB,SAAAA,QAAAA,EAAA,QACA3pB,KAAA4pB,SAAAA,QAAAA,EAAA,WACA5pB,KAAA+pB,OAAAjf,QAAAA,EAAA,MACA9K,KAAA+pB,OAAA/pB,KAAA4pB,UAAA5pB,KAAA4pB,SAAA,WACA,UAAAxnB,MAAA,wBAEA,CAKA,SAAA6D,GACA,OAAAjG,KAAA6pB,MAAA7pB,KAAAuO,GAAA9J,SAAA,EAAAzE,KAAAgqB,KAAA,OAAAN,CACA,CAMA,OAAAzlB,GACAjE,KAAA6pB,QAEA7pB,KAAA+pB,OAAA/pB,KAAA2pB,SACA3pB,KAAA6pB,MAAA7pB,KAAAgqB,KAAAhqB,KAAAuO,GAAAvO,KAAAiqB,KAAA,MAGAjqB,KAAAgqB,KAAA,QACAhqB,KAAAgqB,KAAA,QACAhqB,KAAAgqB,KAAA,SAEA,CASA,IAAA3mB,CAAAumB,EAAA9e,GAGA,GAFA9K,KAAA4pB,SAAAA,QAAAA,EAAA5pB,KAAA4pB,SACA5pB,KAAA+pB,OAAAjf,QAAAA,EAAA/O,KAAAE,IAAA+D,KAAA+pB,OAAA/pB,KAAA4pB,UACA5pB,KAAA+pB,OAAA/pB,KAAA4pB,UAAA5pB,KAAA4pB,SAAA,WACA,MAAAxnB,MAAA,yBAEA,IAAA8nB,EAAAlqB,KAAAgqB,KACA,MAAA5H,EAAApiB,KAAA+pB,OAAA,KACA/pB,KAAA6pB,MAOA7pB,KAAAiqB,KAAA3sB,OAAAuH,WAAAud,IACApiB,KAAAiqB,KAAAE,KAAApuB,KAAAuI,MAAA8d,EAAApiB,KAAAiqB,KAAA3sB,OAAAuH,YAAA,QACAqlB,EAAA,IAAA7sB,YAAA2C,KAAAiqB,KAAA3sB,OAAA,GACA0C,KAAAuO,GAAA,IAAAnR,WAAA4C,KAAAiqB,KAAA3sB,OAAA,QATA0C,KAAAiqB,KAAA,IAAA9oB,YAAAipB,OAAA,CAAiD7hB,QAAAxM,KAAAuI,KAAA8d,EAAA,SACjDpiB,KAAA6pB,MAAAR,EAAA,CAAsCpoB,IAAA,CAAO0B,OAAA3C,KAAAiqB,QAC7CC,EAAA,IAAA7sB,YAAA2C,KAAAiqB,KAAA3sB,OAAA,GACA4sB,EAAAhnB,IAAAumB,EAAA,KACAzpB,KAAAuO,GAAA,IAAAnR,WAAA4C,KAAAiqB,KAAA3sB,OAAA,OAOA4sB,EAAA,QACAA,EAAA,QACAA,EAAA,QACAlqB,KAAAgqB,KAAAE,EACAlqB,KAAA8pB,QAAA,CACA,CAOA,QAAA5lB,CAAAmmB,GACA,MAAAC,EAAAtqB,KAAAgqB,KAAA,MAAAK,EACA,GAAArqB,KAAA+pB,OAAAO,EAAA,CACA,GAAAA,EAAAtqB,KAAA4pB,SACA,SAEA,IAAAW,EAAAvqB,KAAA+pB,OACA,MAAAQ,GAAA,GAAAD,IAEA,GADAC,EAAAxuB,KAAAE,IAAAsuB,EAAAvqB,KAAA4pB,UACAW,EAAAD,EACA,SAEA,GAAAC,EAAA,KAAAvqB,KAAAiqB,KAAA3sB,OAAAuH,WAAA,CACA,MAAA2lB,EAAAzuB,KAAAuI,MAAAimB,EAAA,KAAAvqB,KAAAiqB,KAAA3sB,OAAAuH,YAAA,OACA7E,KAAAiqB,KAAAE,KAAAK,GACAxqB,KAAAgqB,KAAA,IAAA3sB,YAAA2C,KAAAiqB,KAAA3sB,OAAA,GACA0C,KAAAuO,GAAA,IAAAnR,WAAA4C,KAAAiqB,KAAA3sB,OAAA,KACA,CACA0C,KAAA+pB,OAAAQ,CACA,CACA,QACA,CAOA,GAAApf,CAAA/F,GACA,IAAApF,KAAA6pB,OAAA7pB,KAAA8pB,OACA,SAEA,GAAA9pB,KAAAkE,SAAAkB,EAAArH,QACA,SAEA,MAAAmsB,EAAAlqB,KAAAgqB,KAIA,OAHAhqB,KAAAuO,GAAArL,IAAAkC,EAAA8kB,EAAA,OACAA,EAAA,OAAA9kB,EAAArH,OAEAmsB,EAAA,MAAAA,EAAA,cACAlqB,KAAA6pB,MAAAhvB,QAAAsL,MACA,CACA,CAKA,GAAAb,GAEA,OADAtF,KAAA8pB,QAAA,EACA9pB,KAAA6pB,MACA7pB,KAAA6pB,MAAAhvB,QAAAyK,OACA,CACA,CAIA,eAAAmlB,GACA,OAAAzqB,KAAA6pB,MACA7pB,KAAAgqB,KAAA,MACA,CACA,CAIA,aAAAU,GACA,OAAA1qB,KAAA6pB,MACA7pB,KAAA4pB,SAAA5pB,KAAAgqB,KAAA,MACA,CACA,cC9UAxtB,OAAAC,eAAA5B,EAAA,cAA+CiB,OAAA,IAK/C,MACA6uB,GAAA,EADyB3rB,EAAQ,KACjCsqB,QAAA,CAAuGhrB,EAAA,EAAAuf,EAAA,EAAA1f,EAAA,i5BA8DvGtD,EAAA,QA7DA,MACA,WAAAkF,CAAA4pB,GACA3pB,KAAA2pB,SAAAA,EACA3pB,KAAAE,MAAA,EACAF,KAAAgE,OAAA,CACA,CACA,MAAApF,CAAAT,GACA6B,KAAAE,MAAA/B,EAAA,OAAAA,EAAA,OAAAA,EAAA,MAAAA,EAAA,GACA6B,KAAAgE,OAAA7F,EAAA,OAAAA,EAAA,OAAAA,EAAA,OAAAA,EAAA,IACA,MAAA4F,EAAA/D,KAAAE,MAAAF,KAAAgE,OACA4mB,EAAA,EAAA7mB,EACA8mB,EAAA1sB,EAAAJ,OAwBAqkB,EAAArmB,KAAAC,IAAA4uB,EAAAC,IAAA9uB,KAAAE,IAAA2uB,EAAAC,IAAA,QACA7qB,KAAA6pB,MAIA7pB,KAAAiqB,KAAA3sB,OAAAuH,WAAAud,IACApiB,KAAAiqB,KAAAE,KAAApuB,KAAAuI,MAAA8d,EAAApiB,KAAAiqB,KAAA3sB,OAAAuH,YAAA,QACA7E,KAAAuO,GAAA,OALAvO,KAAAiqB,KAAA,IAAA9oB,YAAAipB,OAAA,CAAiD7hB,QAAAxM,KAAAuI,KAAA8d,EAAA,SACjDpiB,KAAA6pB,MAAAc,EAAA,CAAyC1pB,IAAA,CAAO0B,OAAA3C,KAAAiqB,SAMhDjqB,KAAAuO,KACAvO,KAAAuO,GAAA,IAAAnR,WAAA4C,KAAAiqB,KAAA3sB,SAGA,MAAAwtB,EAAA9qB,KAAAiqB,KAAA3sB,OAAAuH,WAAAgmB,GAAA,IAGA,OAFA7qB,KAAAuO,GAAArL,IAAA/E,EAAA2sB,GACA9qB,KAAA6pB,MAAAhvB,QAAAsL,IAAA2kB,EAAAD,EAAA9mB,GACA/D,KAAAuO,GAAA9J,SAAA,UAAAmmB,EACA,CACA,OAAA3mB,GACAjE,KAAA6pB,OAEA7pB,KAAAiqB,KAAA3sB,OAAAuH,WAAA7E,KAAA2pB,WACA3pB,KAAA6pB,MAAA7pB,KAAAuO,GAAAvO,KAAAiqB,KAAA,KAEA,aC9DAztB,OAAAC,eAAA5B,EAAA,cAA+CiB,OAAA,IAC/CjB,EAAAyuB,OAYA,SAAAyB,GACA,GAAAA,EAAA5sB,EAAA,CACA,MAAA0f,EAAgBvf,EAAAA,EAAAH,EAAAA,GAAU4sB,EAC1B,IAAAtvB,EACAyuB,EACA,MAAAc,EAAA7pB,YACA,WAAA0c,EACAvf,EACAwJ,GAAA,IAAAkjB,EAAAxoB,SAAA0nB,IAAAA,EAAA,IAAAc,EAAAzoB,OAAA9G,IAAAA,EAAAwvB,EAAA9sB,MAAA2J,GACAA,GAAAoiB,EACAc,EAAA5pB,YAAA8oB,EAAApiB,GACAkjB,EAAA5pB,YAAA3F,IAAAA,EAAAwvB,EAAA9sB,IAAA2J,GAAAzG,KAAA9F,IAAA2uB,EAAA3uB,EAAAT,SAAAS,EAAAgG,UAEA,IAAAsc,EACAvf,EACA,IAAA4rB,IAAAA,EAAA,IAAAc,EAAAzoB,OAAA9G,IAAAA,EAAAwvB,EAAA9sB,MACA,IAAA+rB,EACAtY,QAAAC,QAAAqY,GACAc,EAAAE,QAAAzvB,IAAAA,EAAAwvB,EAAA9sB,KAAAkD,KAAA9F,GAAA2uB,EAAA3uB,GAEA+C,EACA,IAAA7C,IAAAA,EAAAwvB,EAAA9sB,IACA,IAAAyT,QAAAC,QAAApW,IAAAA,EAAAwvB,EAAA9sB,IACA,CACA,uBAAAgtB,SACA,UAAA/oB,MAAA,qBACA+oB,SAAA7jB,IAAAyjB,EACA,EAtCA,IAAAE,EAAA3sB,IACA,GAAAlB,WAAAguB,WACA,OAAAhuB,WAAAguB,WAAA9sB,GACA,uBAAAa,OACA,OAAAA,OAAAC,KAAAd,EAAA,UACA,MAAA7C,EAAA6D,KAAAhB,GACA/C,EAAA,IAAA6B,WAAA3B,EAAAsC,QACA,QAAAD,EAAA,EAAoBA,EAAAvC,EAAAwC,SAAcD,EAClCvC,EAAAuC,GAAArC,EAAA+D,WAAA1B,GACA,OAAAvC,KCfA8vB,EAAA,GAGA,SAAArsB,EAAAssB,GAEA,IAAAC,EAAAF,EAAAC,GACA,QAAAtjB,IAAAujB,EACA,OAAAA,EAAA1wB,QAGA,IAAAC,EAAAuwB,EAAAC,GAAA,CAGAzwB,QAAA,IAOA,OAHA2wB,EAAAF,GAAA9jB,KAAA1M,EAAAD,QAAAC,EAAAA,EAAAD,QAAAmE,GAGAlE,EAAAD,OACA,mGCfA,MAAA4wB,EAAAzsB,EAAA,KACA0sB,EAAA1sB,EAAA,KACAqK,EAAArK,EAAA,KACAsK,EAAAtK,EAAA,KACA2sB,EAAA3sB,EAAA,IACA4sB,EAAA5sB,EAAA,KACA6sB,EAAA7sB,EAAA,KACA8sB,EAAA9sB,EAAA,KACA+sB,EAAA/sB,EAAA,KA6CMuB,EAAsC,CAC1CyrB,mBAAmB,EACnB/e,WAAY,SACZgf,cAAc,EACdpN,gBAAgB,EAChBL,kBAAmB,KACnBC,eAAgB,SAChBrG,aAAc,IACdjF,iBAAiB,EACjB+Y,YAAY,EACZrhB,aAAc,SACdshB,cAAc,EACdzM,eAAgB,uBA0BlB,MAWE,WAAA3f,CAAYe,GANJd,KAAAyI,aAA8B,GAE9BzI,KAAAosB,UAAwC,IAAIpa,IACnChS,KAAAqsB,cAAgB,IAAIZ,EAAAa,QACrBtsB,KAAA0a,aAA6B1a,KAAKqsB,cAAc5lB,MAG9DzG,KAAKkC,MAAQ1F,OAAO2F,OAAO,GAAI5B,EAAiBO,GAChDd,KAAKusB,aAAe/vB,OAAO2F,OAAO,GAAI5B,EAAiBO,EACzD,CAEO,OAAA6G,GACL,IAAK,MAAMW,KAAWtI,KAAKosB,UAAUrX,SAAUzM,EAAQ4C,QACvD,IAAK,MAAMshB,KAAOxsB,KAAKyI,aACrB+jB,EAAI7kB,UAEN3H,KAAKyI,aAAa1K,OAAS,EAC3BiC,KAAKosB,UAAUtjB,QACf9I,KAAKqsB,cAAc1kB,SACrB,CAEQ,aAAA8kB,IAAiBC,GACvB,IAAK,MAAMF,KAAOE,EAChB1sB,KAAKyI,aAAa/J,KAAK8tB,EAE3B,CAEO,QAAAG,CAASC,SASd,GARA5sB,KAAK8R,UAAY8a,EAGjB5sB,KAAKkK,UAAY,IAAIb,EAAAiE,cAAcsf,GACnC5sB,KAAKmK,SAAW,IAAIb,EAAAujB,aAAaD,EAAU5sB,KAAKkK,UAAWlK,KAAKkC,OAChElC,KAAKmK,SAASuQ,aAAe,IAAM1a,KAAKqsB,cAAc9kB,OAGlDvH,KAAKkC,MAAM8pB,kBAAmB,CAChC,MAAMc,EAA0C,QAAjC1gB,EAAGwgB,EAASG,QAAQC,qBAAa,IAAA5gB,EAAAA,EAAI,GACpD0gB,EAAUG,kBAAmB,EAC7BH,EAAUI,mBAAoB,EAC9BJ,EAAUK,iBAAkB,EAC5BP,EAASG,QAAQC,cAAgBF,CACnC,CAiCA,GA/BA9sB,KAAKysB,cACHzsB,KAAKkK,UACLlK,KAAKmK,SAGLyiB,EAASQ,OAAOC,mBAAmB,CAAEC,OAAQ,IAAKznB,MAAO,KAAOqX,GAAUld,KAAKutB,QAAQrQ,IACvF0P,EAASQ,OAAOC,mBAAmB,CAAEC,OAAQ,IAAKznB,MAAO,KAAOqX,GAAUld,KAAKwtB,QAAQtQ,IACvF0P,EAASQ,OAAOC,mBAAmB,CAAExnB,MAAO,KAAOqX,GAAUld,KAAKytB,KAAKvQ,IACvE0P,EAASQ,OAAOC,mBAAmB,CAAEC,OAAQ,IAAKznB,MAAO,KAAOqX,GAAUld,KAAK0tB,yBAAyBxQ,IAGxG0P,EAASe,SAAS/S,IAAQ,IAAAxO,EAAA,OAAc,QAAbA,EAAApM,KAAKmK,gBAAQ,IAAAiC,OAAA,EAAAA,EAAEuO,OAAOC,KAQjDgS,EAASQ,OAAOC,mBAAmB,CAAEO,cAAe,IAAK/nB,MAAO,KAAO,IAAM7F,KAAKkL,SAClF0hB,EAASQ,OAAOS,mBAAmB,CAAEhoB,MAAO,KAAO,IAAM7F,KAAKkL,SAC9D0hB,EAASvgB,MAAMwN,cAAciU,eAAe,IAAM9tB,KAAKkL,SAGvD0hB,EAAStvB,OAAOywB,eAAe,KAAK,IAAA3hB,EAAA,OAAc,QAAbA,EAAApM,KAAKmK,gBAAQ,IAAAiC,OAAA,EAAAA,EAAE+M,kBAGpDyT,EAASoB,SAASnhB,IAAU,IAAAT,EAAA,OAAc,QAAbA,EAAApM,KAAKmK,gBAAQ,IAAAiC,OAAA,EAAAA,EAAEmP,eAAe1O,MAIzD7M,KAAKkC,MAAM+pB,aAAc,CAC3B,MAAMgC,EAAe,IAAInC,EAAAoC,kBAAkBluB,KAAKmK,SAAWnK,KAAKkC,MAAOlC,KAAKkK,UAAY0iB,GAClFuB,EAAe,IAAItC,EAAAuC,aAAapuB,KAAKkC,MAAO+rB,EAAcrB,GAChE5sB,KAAKosB,UAAUlpB,IAAI,QAASirB,GAC5BnuB,KAAKysB,cACHG,EAASvgB,MAAMwN,cAAcwU,QAAQC,mBAAmB,CAAEzoB,MAAO,KAAOsoB,GAE5E,CAGA,GAAInuB,KAAKkC,MAAMgqB,WAAY,CACzB,MAAMqC,EAAa,IAAIxC,EAAAyC,gBAAgBxuB,KAAKmK,UACtCskB,EAAa,IAAI/C,EAAAgD,WAAW1uB,KAAKkC,MAAOlC,KAAKkK,UAAYqkB,EAAY3B,GAC3E5sB,KAAKosB,UAAUlpB,IAAI,MAAOurB,GAC1BzuB,KAAKysB,cACHG,EAASvgB,MAAMwN,cAAcwU,QAAQM,mBAAmB,KAAMF,GAElE,CAGA,GAAIzuB,KAAKkC,MAAMiqB,aAAc,CAC3B,MAAMyC,EAAe,IAAIhD,EAAAvD,kBAAkBroB,KAAKmK,UAC1C0kB,EAAe,IAAIlD,EAAAmD,qBAAqB9uB,KAAKkC,MAAOlC,KAAKkK,UAAY0kB,EAAchC,GACzF5sB,KAAKosB,UAAUlpB,IAAI,QAAS2rB,GAC5B7uB,KAAKysB,cACHmC,EACAC,EACAjC,EAASvgB,MAAMwN,cAAcwU,QAAQU,mBAAmB,CAAElpB,MAAO,KAAOgpB,GAE5E,CACF,CAGO,KAAA3jB,SAELlL,KAAKkC,MAAM2c,eAAiB7e,KAAKusB,aAAa1N,eAC9C7e,KAAKkC,MAAMsc,kBAAoBxe,KAAKusB,aAAa/N,kBAEpC,QAAbpS,EAAApM,KAAKmK,gBAAQ,IAAAiC,GAAAA,EAAElB,QAEf,IAAK,MAAM5C,KAAWtI,KAAKosB,UAAUrX,SACnCzM,EAAQ4C,QAEV,OAAO,CACT,CAEA,gBAAWkN,SACT,OAAoB,QAAbhM,EAAApM,KAAKmK,gBAAQ,IAAAiC,OAAA,EAAAA,EAAEmM,cAAe,CACvC,CAEA,gBAAWH,CAAajH,SACT,QAAb/E,EAAApM,KAAKmK,gBAAQ,IAAAiC,GAAAA,EAAE+L,SAAShH,GACxBnR,KAAKkC,MAAMkW,aAAejH,CAC5B,CAEA,gBAAW6d,GACT,OAAIhvB,KAAKmK,SACAnK,KAAKmK,SAASyO,YAEf,CACV,CAEA,mBAAWzF,GACT,OAAOnT,KAAKkC,MAAMiR,eACpB,CAEA,mBAAWA,CAAgBrX,SACzBkE,KAAKkC,MAAMiR,gBAAkBrX,EACf,QAAdsQ,EAAApM,KAAKkK,iBAAS,IAAAkC,GAAAA,EAAE+G,gBAAgBrX,EAClC,CAEO,oBAAAigB,CAAqBrF,EAAWnD,SACrC,OAAoB,QAAbnH,EAAApM,KAAKmK,gBAAQ,IAAAiC,OAAA,EAAAA,EAAE2P,qBAAqBrF,EAAGnD,EAChD,CAEO,uBAAAyI,CAAwBtF,EAAWnD,SACxC,OAAoB,QAAbnH,EAAApM,KAAKmK,gBAAQ,IAAAiC,OAAA,EAAAA,EAAE4P,wBAAwBtF,EAAGnD,EACnD,CAEQ,OAAA0b,CAAQ3wB,SACA,QAAd8N,EAAApM,KAAK8R,iBAAS,IAAA1F,GAAAA,EAAEC,MAAMK,MAAMpO,GAAG,EACjC,CAEQ,OAAAivB,CAAQrQ,GACd,IAAK,IAAIpf,EAAI,EAAGA,EAAIof,EAAOnf,SAAUD,EAE5B,KADCof,EAAOpf,KAEXkC,KAAKkC,MAAM2c,gBAAiB,GAIlC,OAAO,CACT,CAEQ,OAAA2O,CAAQtQ,GACd,IAAK,IAAIpf,EAAI,EAAGA,EAAIof,EAAOnf,SAAUD,EAE5B,KADCof,EAAOpf,KAEXkC,KAAKkC,MAAM2c,gBAAiB,GAIlC,OAAO,CACT,CAGQ,IAAA4O,CAAKvQ,GACX,QAAIA,EAAO,MAQPld,KAAKkC,MAAM+pB,eACbjsB,KAAKivB,QAAQ,kBACN,EAGX,CAYQ,wBAAAvB,CAAyBxQ,mBAC/B,GAAIA,EAAOnf,OAAS,EAClB,OAAO,EAET,GAAa,IAATmf,EAAO,GACT,OAAQA,EAAO,IACb,OAEE,OADAld,KAAKivB,QAAQ,MAAS/R,EAAO,QAA0Bld,KAAKkC,MAAMsc,uBAC3D,EACT,OACExe,KAAKkC,MAAMsc,kBAAoBxe,KAAKusB,aAAa/N,kBACjDxe,KAAKivB,QAAQ,MAAS/R,EAAO,QAA0Bld,KAAKkC,MAAMsc,sBAElE,IAAK,MAAMlW,KAAWtI,KAAKosB,UAAUrX,SACnCzM,EAAQ4C,QAEV,OAAO,EACT,OAOE,OANIgS,EAAOnf,OAAS,KAAOmf,EAAO,aAAc9V,QAAU8V,EAAO,IA5P5C,MA6PnBld,KAAKkC,MAAMsc,kBAAoBtB,EAAO,GACtCld,KAAKivB,QAAQ,MAAS/R,EAAO,QAA0Bld,KAAKkC,MAAMsc,uBAElExe,KAAKivB,QAAQ,MAAS/R,EAAO,UAExB,EACT,OAEE,OADAld,KAAKivB,QAAQ,MAAS/R,EAAO,eACtB,EACT,QAEE,OADAld,KAAKivB,QAAQ,MAAS/R,EAAO,UACtB,EAGb,GAAa,IAATA,EAAO,GACT,OAAQA,EAAO,IAEb,OACE,IAAIhd,EAAkC,QAA1BsN,EAAc,QAAdpB,EAAApM,KAAKkK,iBAAS,IAAAkC,OAAA,EAAAA,EAAEP,kBAAU,IAAA2B,OAAA,EAAAA,EAAE1B,IAAIC,OAAO7L,MAC/C8D,EAAmC,QAA1BuK,EAAc,QAAdpC,EAAAnM,KAAKkK,iBAAS,IAAAiC,OAAA,EAAAA,EAAEN,kBAAU,IAAA0C,OAAA,EAAAA,EAAEzC,IAAIC,OAAO/H,OACpD,IAAK9D,IAAU8D,EAAQ,CAGrB,MAAMoP,EAAW9J,EAAAsC,kBACjB1L,IAAuB,QAAduT,EAAAzT,KAAK8R,iBAAS,IAAA2B,OAAA,EAAAA,EAAEzH,OAAQ,IAAMoH,EAASlT,MAChD8D,IAAwB,QAAd6c,EAAA7gB,KAAK8R,iBAAS,IAAA+O,OAAA,EAAAA,EAAE5U,OAAQ,IAAMmH,EAASpP,MACnD,CACA,GAAI9D,EAAQ8D,EAAShE,KAAKkC,MAAM+K,WAC9BjN,KAAKivB,QAAQ,MAAS/R,EAAO,QAA0Bhd,EAAMuM,QAAQ,MAAMzI,EAAOyI,QAAQ,WACrF,CAEL,MAAMiK,EAAI3a,KAAKoR,MAAMpR,KAAKmzB,KAAKlvB,KAAKkC,MAAM+K,aAC1CjN,KAAKivB,QAAQ,MAAS/R,EAAO,QAA0BxG,KAAKA,KAC9D,CACA,OAAO,EACT,OAEE,MAAMA,EAAI3a,KAAKoR,MAAMpR,KAAKmzB,KAAKlvB,KAAKkC,MAAM+K,aAE1C,OADAjN,KAAKivB,QAAQ,MAAS/R,EAAO,QAA0BxG,KAAKA,OACrD,EACT,QAEE,OADA1W,KAAKivB,QAAQ,MAAS/R,EAAO,UACtB,EAKb,OADAld,KAAKivB,QAAQ,MAAS/R,EAAO,UACtB,CACT","sources":["webpack://ImageAddon/webpack/universalModuleDefinition","webpack://ImageAddon/../node_modules/sixel/lib/Colors.js","webpack://ImageAddon/../node_modules/sixel/lib/Decoder.js","webpack://ImageAddon/../node_modules/sixel/lib/wasm.js","webpack://ImageAddon/../src/common/Event.ts","webpack://ImageAddon/../src/common/Lifecycle.ts","webpack://ImageAddon/./src/IIPHandler.ts","webpack://ImageAddon/./src/IIPHeaderParser.ts","webpack://ImageAddon/./src/IIPImageStorage.ts","webpack://ImageAddon/./src/IIPMetrics.ts","webpack://ImageAddon/./src/ImageRenderer.ts","webpack://ImageAddon/./src/ImageStorage.ts","webpack://ImageAddon/./src/SixelHandler.ts","webpack://ImageAddon/./src/SixelImageStorage.ts","webpack://ImageAddon/./src/kitty/KittyGraphicsHandler.ts","webpack://ImageAddon/./src/kitty/KittyGraphicsTypes.ts","webpack://ImageAddon/./src/kitty/KittyImageStorage.ts","webpack://ImageAddon/../node_modules/xterm-wasm-parts/lib/base64/Base64Decoder.wasm.js","webpack://ImageAddon/../node_modules/xterm-wasm-parts/lib/qoi/QoiDecoder.wasm.js","webpack://ImageAddon/javascript/node_modules/inwasm-runtime/lib/index.cjs","webpack://ImageAddon/webpack/bootstrap","webpack://ImageAddon/./src/ImageAddon.ts"],"sourcesContent":["(function webpackUniversalModuleDefinition(root, factory) {\n\tif(typeof exports === 'object' && typeof module === 'object')\n\t\tmodule.exports = factory();\n\telse if(typeof define === 'function' && define.amd)\n\t\tdefine([], factory);\n\telse if(typeof exports === 'object')\n\t\texports[\"ImageAddon\"] = factory();\n\telse\n\t\troot[\"ImageAddon\"] = factory();\n})(globalThis, () => {\nreturn ","\"use strict\";\n/**\n * Copyright (c) 2019 Joerg Breitbart.\n * @license MIT\n */\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.DEFAULT_FOREGROUND = exports.DEFAULT_BACKGROUND = exports.PALETTE_ANSI_256 = exports.PALETTE_VT340_GREY = exports.PALETTE_VT340_COLOR = exports.normalizeHLS = exports.normalizeRGB = exports.nearestColorIndex = exports.fromRGBA8888 = exports.toRGBA8888 = exports.alpha = exports.blue = exports.green = exports.red = exports.BIG_ENDIAN = void 0;\n// FIXME: cleanup this mess, move things either to decoder/encoder, keep only shared things\n// system endianess\nexports.BIG_ENDIAN = new Uint8Array(new Uint32Array([0xFF000000]).buffer)[0] === 0xFF;\nif (exports.BIG_ENDIAN) {\n    console.warn('BE platform detected. This version of node-sixel works only on LE properly.');\n}\n// channel values\nfunction red(n) {\n    return n & 0xFF;\n}\nexports.red = red;\nfunction green(n) {\n    return (n >>> 8) & 0xFF;\n}\nexports.green = green;\nfunction blue(n) {\n    return (n >>> 16) & 0xFF;\n}\nexports.blue = blue;\nfunction alpha(n) {\n    return (n >>> 24) & 0xFF;\n}\nexports.alpha = alpha;\n/**\n * Convert RGB channels to native color RGBA8888.\n */\nfunction toRGBA8888(r, g, b, a = 255) {\n    return ((a & 0xFF) << 24 | (b & 0xFF) << 16 | (g & 0xFF) << 8 | (r & 0xFF)) >>> 0; // ABGR32\n}\nexports.toRGBA8888 = toRGBA8888;\n/**\n * Convert native color to [r, g, b, a].\n */\nfunction fromRGBA8888(color) {\n    return [color & 0xFF, (color >> 8) & 0xFF, (color >> 16) & 0xFF, color >>> 24];\n}\nexports.fromRGBA8888 = fromRGBA8888;\n/**\n * Get index of nearest color in `palette` for `color`.\n * Uses euclidean distance without any luminescence correction.\n */\nfunction nearestColorIndex(color, palette) {\n    const r = red(color);\n    const g = green(color);\n    const b = blue(color);\n    let min = Number.MAX_SAFE_INTEGER;\n    let idx = -1;\n    // use euclidean distance (manhattan gives very poor results)\n    for (let i = 0; i < palette.length; ++i) {\n        const dr = r - palette[i][0];\n        const dg = g - palette[i][1];\n        const db = b - palette[i][2];\n        const d = dr * dr + dg * dg + db * db;\n        if (!d)\n            return i;\n        if (d < min) {\n            min = d;\n            idx = i;\n        }\n    }\n    return idx;\n}\nexports.nearestColorIndex = nearestColorIndex;\n// color conversions\n// HLS taken from: http://www.niwa.nu/2013/05/math-behind-colorspace-conversions-rgb-hsl\nfunction clamp(low, high, value) {\n    return Math.max(low, Math.min(value, high));\n}\nfunction h2c(t1, t2, c) {\n    if (c < 0)\n        c += 1;\n    if (c > 1)\n        c -= 1;\n    return c * 6 < 1\n        ? t2 + (t1 - t2) * 6 * c\n        : c * 2 < 1\n            ? t1\n            : c * 3 < 2\n                ? t2 + (t1 - t2) * (4 - c * 6)\n                : t2;\n}\nfunction HLStoRGB(h, l, s) {\n    if (!s) {\n        const v = Math.round(l * 255);\n        return toRGBA8888(v, v, v);\n    }\n    const t1 = l < 0.5 ? l * (1 + s) : l + s - l * s;\n    const t2 = 2 * l - t1;\n    return toRGBA8888(clamp(0, 255, Math.round(h2c(t1, t2, h + 1 / 3) * 255)), clamp(0, 255, Math.round(h2c(t1, t2, h) * 255)), clamp(0, 255, Math.round(h2c(t1, t2, h - 1 / 3) * 255)));\n}\n/**\n * Normalize SIXEL RGB values (percent based, 0-100) to RGBA8888.\n */\nfunction normalizeRGB(r, g, b) {\n    return (0xFF000000 | Math.round(b / 100 * 255) << 16 | Math.round(g / 100 * 255) << 8 | Math.round(r / 100 * 255)) >>> 0; // ABGR32\n}\nexports.normalizeRGB = normalizeRGB;\n/**\n * Normalize SIXEL HLS values to RGBA8888. Applies hue correction of +240°.\n */\nfunction normalizeHLS(h, l, s) {\n    // Note: hue value is turned by 240° in VT340, all values given as fractions\n    return HLStoRGB((h + 240 % 360) / 360, l / 100, s / 100);\n}\nexports.normalizeHLS = normalizeHLS;\n/**\n * default palettes\n */\n// FIXME: move palettes to Decoder.ts\n/**\n * 16 predefined color registers of VT340 (values in %):\n * ```\n *                R   G   B\n * 0  Black       0   0   0\n * 1  Blue        20  20  80\n * 2  Red         80  13  13\n * 3  Green       20  80  20\n * 4  Magenta     80  20  80\n * 5  Cyan        20  80  80\n * 6  Yellow      80  80  20\n * 7  Gray 50%    53  53  53\n * 8  Gray 25%    26  26  26\n * 9  Blue*       33  33  60\n * 10 Red*        60  26  26\n * 11 Green*      33  60  33\n * 12 Magenta*    60  33  60\n * 13 Cyan*       33  60  60\n * 14 Yellow*     60  60  33\n * 15 Gray 75%    80  80  80\n * ```\n * (*) less saturated\n *\n * @see https://vt100.net/docs/vt3xx-gp/chapter2.html#S2.4\n*/\nexports.PALETTE_VT340_COLOR = new Uint32Array([\n    normalizeRGB(0, 0, 0),\n    normalizeRGB(20, 20, 80),\n    normalizeRGB(80, 13, 13),\n    normalizeRGB(20, 80, 20),\n    normalizeRGB(80, 20, 80),\n    normalizeRGB(20, 80, 80),\n    normalizeRGB(80, 80, 20),\n    normalizeRGB(53, 53, 53),\n    normalizeRGB(26, 26, 26),\n    normalizeRGB(33, 33, 60),\n    normalizeRGB(60, 26, 26),\n    normalizeRGB(33, 60, 33),\n    normalizeRGB(60, 33, 60),\n    normalizeRGB(33, 60, 60),\n    normalizeRGB(60, 60, 33),\n    normalizeRGB(80, 80, 80)\n]);\n/**\n * 16 predefined monochrome registers of VT340 (values in %):\n * ```\n *              R   G   B\n * 0  Black     0   0   0\n * 1  Gray-2    13  13  13\n * 2  Gray-4    26  26  26\n * 3  Gray-6    40  40  40\n * 4  Gray-1    6   6   6\n * 5  Gray-3    20  20  20\n * 6  Gray-5    33  33  33\n * 7  White 7   46  46  46\n * 8  Black 0   0   0   0\n * 9  Gray-2    13  13  13\n * 10 Gray-4    26  26  26\n * 11 Gray-6    40  40  40\n * 12 Gray-1    6   6   6\n * 13 Gray-3    20  20  20\n * 14 Gray-5    33  33  33\n * 15 White 7   46  46  46\n * ```\n *\n * @see https://vt100.net/docs/vt3xx-gp/chapter2.html#S2.4\n */\nexports.PALETTE_VT340_GREY = new Uint32Array([\n    normalizeRGB(0, 0, 0),\n    normalizeRGB(13, 13, 13),\n    normalizeRGB(26, 26, 26),\n    normalizeRGB(40, 40, 40),\n    normalizeRGB(6, 6, 6),\n    normalizeRGB(20, 20, 20),\n    normalizeRGB(33, 33, 33),\n    normalizeRGB(46, 46, 46),\n    normalizeRGB(0, 0, 0),\n    normalizeRGB(13, 13, 13),\n    normalizeRGB(26, 26, 26),\n    normalizeRGB(40, 40, 40),\n    normalizeRGB(6, 6, 6),\n    normalizeRGB(20, 20, 20),\n    normalizeRGB(33, 33, 33),\n    normalizeRGB(46, 46, 46)\n]);\n/**\n * 256 predefined ANSI colors.\n *\n * @see https://en.wikipedia.org/wiki/ANSI_escape_code#8-bit\n */\nexports.PALETTE_ANSI_256 = (() => {\n    // 16 lower colors (taken from xterm)\n    const p = [\n        toRGBA8888(0, 0, 0),\n        toRGBA8888(205, 0, 0),\n        toRGBA8888(0, 205, 0),\n        toRGBA8888(205, 205, 0),\n        toRGBA8888(0, 0, 238),\n        toRGBA8888(205, 0, 205),\n        toRGBA8888(0, 250, 205),\n        toRGBA8888(229, 229, 229),\n        toRGBA8888(127, 127, 127),\n        toRGBA8888(255, 0, 0),\n        toRGBA8888(0, 255, 0),\n        toRGBA8888(255, 255, 0),\n        toRGBA8888(92, 92, 255),\n        toRGBA8888(255, 0, 255),\n        toRGBA8888(0, 255, 255),\n        toRGBA8888(255, 255, 255),\n    ];\n    // colors up to 232\n    const d = [0, 95, 135, 175, 215, 255];\n    for (let r = 0; r < 6; ++r) {\n        for (let g = 0; g < 6; ++g) {\n            for (let b = 0; b < 6; ++b) {\n                p.push(toRGBA8888(d[r], d[g], d[b]));\n            }\n        }\n    }\n    // grey scale to up 255\n    for (let v = 8; v <= 238; v += 10) {\n        p.push(toRGBA8888(v, v, v));\n    }\n    return new Uint32Array(p);\n})();\n/**\n * Background: Black by default.\n * Foreground: White by default.\n *\n * Background color is used whenever a fill color is needed and not explicitly set.\n * Foreground color is used as default initial sixel color.\n */\nexports.DEFAULT_BACKGROUND = toRGBA8888(0, 0, 0, 255);\nexports.DEFAULT_FOREGROUND = toRGBA8888(255, 255, 255, 255);\n//# sourceMappingURL=Colors.js.map","\"use strict\";\n/**\n * Copyright (c) 2021 Joerg Breitbart.\n * @license MIT\n */\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.decodeAsync = exports.decode = exports.Decoder = exports.DecoderAsync = void 0;\nconst Colors_1 = require(\"./Colors\");\nconst wasm_1 = require(\"./wasm\");\n/* istanbul ignore next */\nfunction decodeBase64(s) {\n    if (typeof Buffer !== 'undefined') {\n        return Buffer.from(s, 'base64');\n    }\n    const bytestring = atob(s);\n    const result = new Uint8Array(bytestring.length);\n    for (let i = 0; i < result.length; ++i) {\n        result[i] = bytestring.charCodeAt(i);\n    }\n    return result;\n}\nconst WASM_BYTES = decodeBase64(wasm_1.LIMITS.BYTES);\nlet WASM_MODULE;\n// empty canvas\nconst NULL_CANVAS = new Uint32Array();\n// proxy for lazy binding of decoder methods to wasm env callbacks\nclass CallbackProxy {\n    constructor() {\n        this.bandHandler = (width) => 1;\n        this.modeHandler = (mode) => 1;\n    }\n    handle_band(width) {\n        return this.bandHandler(width);\n    }\n    mode_parsed(mode) {\n        return this.modeHandler(mode);\n    }\n}\n// default decoder options\nconst DEFAULT_OPTIONS = {\n    memoryLimit: 2048 * 65536,\n    sixelColor: Colors_1.DEFAULT_FOREGROUND,\n    fillColor: Colors_1.DEFAULT_BACKGROUND,\n    palette: Colors_1.PALETTE_VT340_COLOR,\n    paletteLimit: wasm_1.LIMITS.PALETTE_SIZE,\n    truncate: true\n};\n/**\n * Create a decoder instance asynchronously.\n * To be used in the browser main thread.\n */\nfunction DecoderAsync(opts) {\n    const cbProxy = new CallbackProxy();\n    const importObj = {\n        env: {\n            handle_band: cbProxy.handle_band.bind(cbProxy),\n            mode_parsed: cbProxy.mode_parsed.bind(cbProxy)\n        }\n    };\n    return WebAssembly.instantiate(WASM_MODULE || WASM_BYTES, importObj)\n        .then((inst) => {\n        WASM_MODULE = WASM_MODULE || inst.module;\n        return new Decoder(opts, inst.instance || inst, cbProxy);\n    });\n}\nexports.DecoderAsync = DecoderAsync;\n/**\n * Decoder - web assembly based sixel stream decoder.\n *\n * Usage pattern:\n *  - call `init` to initialize decoder for new image\n *  - feed data chunks to `decode` or `decodeString`\n *  - grab pixels from `data32`\n *  - optional: call `release` to free memory (e.g. after big images)\n *  - start over with next image by calling `init`\n *\n * Properties:\n *  - max width of 2^14 - 4 pixels (compile time setting in wasm)\n *  - no explicit height limit (only limited by memory)\n *  - max 4096 colors palette (compile time setting in wasm)\n *\n * Explanation operation modes:\n * - M1   Mode chosen for level 1 images (no raster attributes),\n *        or for level 2 images with `truncate=false`.\n * - M2   Mode chosen for level 2 images with `truncate=true` (default).\n *        While this mode is not fully spec conform (decoder not expected to truncate),\n *        it is what spec conform encoders should create (should not excess raster).\n *        This mode has several advantages:\n *        - ~15% faster decoding speed\n *        - image dimensions can be evaluated early without processing the whole data\n *        - faster pixel access in `data32` (precalulated)\n *        - image height is not reported as multiple of 6 pixels\n * - M0   Undecided mode state after `init`.\n * The level of an image is determined during early decoding based on the fact,\n * whether the data contains valid raster attributes before any sixel data.\n * Until then the mode of an image is marked as M0, meaning the real operation mode\n * could not be decided yet.\n */\nclass Decoder {\n    /**\n     * Synchonous ctor. Can be called from nodejs or a webworker context.\n     * For instantiation in the browser main thread use `WasmDecoderAsync` instead.\n     */\n    constructor(opts, _instance, _cbProxy) {\n        this._PIXEL_OFFSET = wasm_1.LIMITS.MAX_WIDTH + 4;\n        this._canvas = NULL_CANVAS;\n        this._bandWidths = [];\n        this._maxWidth = 0;\n        this._minWidth = wasm_1.LIMITS.MAX_WIDTH;\n        this._lastOffset = 0;\n        this._currentHeight = 0;\n        this._opts = Object.assign({}, DEFAULT_OPTIONS, opts);\n        if (this._opts.paletteLimit > wasm_1.LIMITS.PALETTE_SIZE) {\n            throw new Error(`DecoderOptions.paletteLimit must not exceed ${wasm_1.LIMITS.PALETTE_SIZE}`);\n        }\n        if (!_instance) {\n            const module = WASM_MODULE || (WASM_MODULE = new WebAssembly.Module(WASM_BYTES));\n            _instance = new WebAssembly.Instance(module, {\n                env: {\n                    handle_band: this._handle_band.bind(this),\n                    mode_parsed: this._initCanvas.bind(this)\n                }\n            });\n        }\n        else {\n            _cbProxy.bandHandler = this._handle_band.bind(this);\n            _cbProxy.modeHandler = this._initCanvas.bind(this);\n        }\n        this._instance = _instance;\n        this._wasm = this._instance.exports;\n        this._chunk = new Uint8Array(this._wasm.memory.buffer, this._wasm.get_chunk_address(), wasm_1.LIMITS.CHUNK_SIZE);\n        this._states = new Uint32Array(this._wasm.memory.buffer, this._wasm.get_state_address(), 12);\n        this._palette = new Uint32Array(this._wasm.memory.buffer, this._wasm.get_palette_address(), wasm_1.LIMITS.PALETTE_SIZE);\n        this._palette.set(this._opts.palette);\n        this._pSrc = new Uint32Array(this._wasm.memory.buffer, this._wasm.get_p0_address());\n        this._wasm.init(Colors_1.DEFAULT_FOREGROUND, 0, this._opts.paletteLimit, 0);\n    }\n    // some readonly parser states for internal usage\n    get _fillColor() { return this._states[0]; }\n    get _truncate() { return this._states[8]; }\n    get _rasterWidth() { return this._states[6]; }\n    get _rasterHeight() { return this._states[7]; }\n    get _width() { return this._states[2] ? this._states[2] - 4 : 0; }\n    get _height() { return this._states[3]; }\n    get _level() { return this._states[9]; }\n    get _mode() { return this._states[10]; }\n    get _paletteLimit() { return this._states[11]; }\n    _initCanvas(mode) {\n        if (mode === 2 /* M2 */) {\n            const pixels = this.width * this.height;\n            if (pixels > this._canvas.length) {\n                if (this._opts.memoryLimit && pixels * 4 > this._opts.memoryLimit) {\n                    this.release();\n                    throw new Error('image exceeds memory limit');\n                }\n                this._canvas = new Uint32Array(pixels);\n            }\n            this._maxWidth = this._width;\n        }\n        else if (mode === 1 /* M1 */) {\n            if (this._level === 2) {\n                // got raster attributes, use them as initial size hint\n                const pixels = Math.min(this._rasterWidth, wasm_1.LIMITS.MAX_WIDTH) * this._rasterHeight;\n                if (pixels > this._canvas.length) {\n                    if (this._opts.memoryLimit && pixels * 4 > this._opts.memoryLimit) {\n                        this.release();\n                        throw new Error('image exceeds memory limit');\n                    }\n                    this._canvas = new Uint32Array(pixels);\n                }\n            }\n            else {\n                // else fallback to generic resizing, starting with 256*256 pixels\n                if (this._canvas.length < 65536) {\n                    this._canvas = new Uint32Array(65536);\n                }\n            }\n        }\n        return 0; // 0 - continue, 1 - abort right away\n    }\n    _realloc(offset, additionalPixels) {\n        const pixels = offset + additionalPixels;\n        if (pixels > this._canvas.length) {\n            if (this._opts.memoryLimit && pixels * 4 > this._opts.memoryLimit) {\n                this.release();\n                throw new Error('image exceeds memory limit');\n            }\n            // extend in 65536 pixel blocks\n            const newCanvas = new Uint32Array(Math.ceil(pixels / 65536) * 65536);\n            newCanvas.set(this._canvas);\n            this._canvas = newCanvas;\n        }\n    }\n    _handle_band(width) {\n        const adv = this._PIXEL_OFFSET;\n        let offset = this._lastOffset;\n        if (this._mode === 2 /* M2 */) {\n            let remaining = this.height - this._currentHeight;\n            let c = 0;\n            while (c < 6 && remaining > 0) {\n                this._canvas.set(this._pSrc.subarray(adv * c, adv * c + width), offset + width * c);\n                c++;\n                remaining--;\n            }\n            this._lastOffset += width * c;\n            this._currentHeight += c;\n        }\n        else if (this._mode === 1 /* M1 */) {\n            this._realloc(offset, width * 6);\n            this._maxWidth = Math.max(this._maxWidth, width);\n            this._minWidth = Math.min(this._minWidth, width);\n            for (let i = 0; i < 6; ++i) {\n                this._canvas.set(this._pSrc.subarray(adv * i, adv * i + width), offset + width * i);\n            }\n            this._bandWidths.push(width);\n            this._lastOffset += width * 6;\n            this._currentHeight += 6;\n        }\n        return 0; // 0 - continue, 1 - abort right away\n    }\n    /**\n     * Width of the image data.\n     * Returns the rasterWidth in level2/truncating mode,\n     * otherwise the max width, that has been seen so far.\n     */\n    get width() {\n        return this._mode !== 1 /* M1 */\n            ? this._width\n            : Math.max(this._maxWidth, this._wasm.current_width());\n    }\n    /**\n     * Height of the image data.\n     * Returns the rasterHeight in level2/truncating mode,\n     * otherwise height touched by sixels.\n     */\n    get height() {\n        return this._mode !== 1 /* M1 */\n            ? this._height\n            : this._wasm.current_width()\n                ? this._bandWidths.length * 6 + this._wasm.current_height()\n                : this._bandWidths.length * 6;\n    }\n    /**\n     * Get active palette colors as RGBA8888[] (borrowed).\n     */\n    get palette() {\n        return this._palette.subarray(0, this._paletteLimit);\n    }\n    /**\n     * Get the memory used by the decoder.\n     *\n     * This is a rough estimate accounting the wasm instance memory\n     * and pixel buffers held on JS side (real value will be slightly\n     * higher due to JS book-keeping).\n     * Note that the decoder does not free ressources on its own,\n     * call `release` to free excess memory.\n     */\n    get memoryUsage() {\n        return this._canvas.byteLength + this._wasm.memory.buffer.byteLength + 8 * this._bandWidths.length;\n    }\n    /**\n     * Get various properties of the decoder and the current image.\n     */\n    get properties() {\n        return {\n            width: this.width,\n            height: this.height,\n            mode: this._mode,\n            level: this._level,\n            truncate: !!this._truncate,\n            paletteLimit: this._paletteLimit,\n            fillColor: this._fillColor,\n            memUsage: this.memoryUsage,\n            rasterAttributes: {\n                numerator: this._states[4],\n                denominator: this._states[5],\n                width: this._rasterWidth,\n                height: this._rasterHeight,\n            }\n        };\n    }\n    /**\n     * Initialize decoder for next image. Must be called before\n     * any calls to `decode` or `decodeString`.\n     */\n    // FIXME: reorder arguments, better palette handling\n    init(fillColor = this._opts.fillColor, palette = this._opts.palette, paletteLimit = this._opts.paletteLimit, truncate = this._opts.truncate) {\n        this._wasm.init(this._opts.sixelColor, fillColor, paletteLimit, truncate ? 1 : 0);\n        if (palette) {\n            this._palette.set(palette.subarray(0, wasm_1.LIMITS.PALETTE_SIZE));\n        }\n        this._bandWidths.length = 0;\n        this._maxWidth = 0;\n        this._minWidth = wasm_1.LIMITS.MAX_WIDTH;\n        this._lastOffset = 0;\n        this._currentHeight = 0;\n    }\n    /**\n     * Decode next chunk of data from start to end index (exclusive).\n     * @throws Will throw if the image exceeds the memory limit.\n     */\n    decode(data, start = 0, end = data.length) {\n        let p = start;\n        while (p < end) {\n            const length = Math.min(end - p, wasm_1.LIMITS.CHUNK_SIZE);\n            this._chunk.set(data.subarray(p, p += length));\n            this._wasm.decode(0, length);\n        }\n    }\n    /**\n     * Decode next chunk of string data from start to end index (exclusive).\n     * Note: Decoding from string data is rather slow, use `decode` with byte data instead.\n     * @throws Will throw if the image exceeds the memory limit.\n     */\n    decodeString(data, start = 0, end = data.length) {\n        let p = start;\n        while (p < end) {\n            const length = Math.min(end - p, wasm_1.LIMITS.CHUNK_SIZE);\n            for (let i = 0, j = p; i < length; ++i, ++j) {\n                this._chunk[i] = data.charCodeAt(j);\n            }\n            p += length;\n            this._wasm.decode(0, length);\n        }\n    }\n    /**\n     * Get current pixel data as 32-bit typed array (RGBA8888).\n     * Also peeks into pixel data of the current band, that got not pushed yet.\n     */\n    get data32() {\n        if (this._mode === 0 /* M0 */ || !this.width || !this.height) {\n            return NULL_CANVAS;\n        }\n        // get width of pending band to peek into left-over data\n        const currentWidth = this._wasm.current_width();\n        if (this._mode === 2 /* M2 */) {\n            let remaining = this.height - this._currentHeight;\n            if (remaining > 0) {\n                const adv = this._PIXEL_OFFSET;\n                let offset = this._lastOffset;\n                let c = 0;\n                while (c < 6 && remaining > 0) {\n                    this._canvas.set(this._pSrc.subarray(adv * c, adv * c + currentWidth), offset + currentWidth * c);\n                    c++;\n                    remaining--;\n                }\n                if (remaining) {\n                    this._canvas.fill(this._fillColor, offset + currentWidth * c);\n                }\n            }\n            return this._canvas.subarray(0, this.width * this.height);\n        }\n        if (this._mode === 1 /* M1 */) {\n            if (this._minWidth === this._maxWidth) {\n                let escape = false;\n                if (currentWidth) {\n                    if (currentWidth !== this._minWidth) {\n                        escape = true;\n                    }\n                    else {\n                        const adv = this._PIXEL_OFFSET;\n                        let offset = this._lastOffset;\n                        this._realloc(offset, currentWidth * 6);\n                        for (let i = 0; i < 6; ++i) {\n                            this._canvas.set(this._pSrc.subarray(adv * i, adv * i + currentWidth), offset + currentWidth * i);\n                        }\n                    }\n                }\n                if (!escape) {\n                    return this._canvas.subarray(0, this.width * this.height);\n                }\n            }\n            // worst case: re-align pixels if we have bands with different width\n            // This is somewhat allocation intensive, any way to do that in-place, and just once?\n            const final = new Uint32Array(this.width * this.height);\n            final.fill(this._fillColor);\n            let finalOffset = 0;\n            let start = 0;\n            for (let i = 0; i < this._bandWidths.length; ++i) {\n                const bw = this._bandWidths[i];\n                for (let p = 0; p < 6; ++p) {\n                    final.set(this._canvas.subarray(start, start += bw), finalOffset);\n                    finalOffset += this.width;\n                }\n            }\n            // also handle left-over pixels of the current band\n            if (currentWidth) {\n                const adv = this._PIXEL_OFFSET;\n                // other than finished bands, this runs only up to currentHeight\n                const currentHeight = this._wasm.current_height();\n                for (let i = 0; i < currentHeight; ++i) {\n                    final.set(this._pSrc.subarray(adv * i, adv * i + currentWidth), finalOffset + this.width * i);\n                }\n            }\n            return final;\n        }\n        // fallthrough for all not handled cases\n        return NULL_CANVAS;\n    }\n    /**\n     * Same as `data32`, but returning pixel data as Uint8ClampedArray suitable\n     * for direct usage with `ImageData`.\n     */\n    get data8() {\n        return new Uint8ClampedArray(this.data32.buffer, 0, this.width * this.height * 4);\n    }\n    /**\n     * Release image ressources on JS side held by the decoder.\n     *\n     * The decoder tries to re-use memory ressources of a previous image\n     * to lower allocation and GC pressure. Decoding a single big image\n     * will grow the memory usage of the decoder permanently.\n     * Call `release` to reset the internal buffers and free the memory.\n     * Note that this destroys the image data, call it when done processing\n     * a rather big image, otherwise it is not needed. Use `memoryUsage`\n     * to decide, whether the held memory is still within your limits.\n     * This does not affect the wasm module (operates on static memory).\n     */\n    release() {\n        this._canvas = NULL_CANVAS;\n        this._bandWidths.length = 0;\n        this._maxWidth = 0;\n        this._minWidth = wasm_1.LIMITS.MAX_WIDTH;\n        // also nullify parser states in wasm to avoid\n        // width/height reporting potential out-of-bound values\n        this._wasm.init(Colors_1.DEFAULT_FOREGROUND, 0, this._opts.paletteLimit, 0);\n    }\n}\nexports.Decoder = Decoder;\n/**\n * Convenient decoding functions for easier usage.\n *\n * These can be used for casual decoding of sixel images,\n * that dont come in as stream chunks.\n * Note that the functions instantiate a stream decoder for every call,\n * which comes with a performance penalty of ~25%.\n */\n/**\n * Decode function with synchronous wasm loading.\n * Can be used in a web worker or in nodejs. Does not work reliable in normal browser context.\n * @throws Will throw if the image exceeds the memory limit.\n */\nfunction decode(data, opts) {\n    const dec = new Decoder(opts);\n    dec.init();\n    typeof data === 'string' ? dec.decodeString(data) : dec.decode(data);\n    return {\n        width: dec.width,\n        height: dec.height,\n        data32: dec.data32,\n        data8: dec.data8\n    };\n}\nexports.decode = decode;\n/**\n * Decode function with asynchronous wasm loading.\n * Use this version in normal browser context.\n * @throws Will throw if the image exceeds the memory limit.\n */\nasync function decodeAsync(data, opts) {\n    const dec = await DecoderAsync(opts);\n    dec.init();\n    typeof data === 'string' ? dec.decodeString(data) : dec.decode(data);\n    return {\n        width: dec.width,\n        height: dec.height,\n        data32: dec.data32,\n        data8: dec.data8\n    };\n}\nexports.decodeAsync = decodeAsync;\n//# sourceMappingURL=Decoder.js.map","\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.LIMITS = void 0;\nexports.LIMITS = {\n    CHUNK_SIZE: 16384,\n    PALETTE_SIZE: 4096,\n    MAX_WIDTH: 16384,\n    BYTES: 'AGFzbQEAAAABJAdgAAF/YAJ/fwBgA39/fwF/YAF/AX9gAABgBH9/f38AYAF/AAIlAgNlbnYLaGFuZGxlX2JhbmQAAwNlbnYLbW9kZV9wYXJzZWQAAwMTEgQAAAAAAQQBAQUBAAACAgAGAwQFAXABBwcFBAEBBwcGCAF/AUGAihoLB9wBDgZtZW1vcnkCABFnZXRfc3RhdGVfYWRkcmVzcwADEWdldF9jaHVua19hZGRyZXNzAAQOZ2V0X3AwX2FkZHJlc3MABRNnZXRfcGFsZXR0ZV9hZGRyZXNzAAYEaW5pdAALBmRlY29kZQAMDWN1cnJlbnRfd2lkdGgADQ5jdXJyZW50X2hlaWdodAAOGV9faW5kaXJlY3RfZnVuY3Rpb25fdGFibGUBAAtfaW5pdGlhbGl6ZQACCXN0YWNrU2F2ZQARDHN0YWNrUmVzdG9yZQASCnN0YWNrQWxsb2MAEwkMAQBBAQsGCgcJDxACDAEBCq5UEgMAAQsFAEGgCAsGAEGQiQELBgBBsIkCCwUAQZAJC+okAQh/QeQIKAIAIQVB4AgoAgAhA0HoCCgCACEIIAFBkIkBaiIJQf8BOgAAIAAgAUgEQCAAQZCJAWohBgNAIAMhBCAGQQFqIQECQCAGLQAAQf8AcSIDQTBrQQlLBEAgASEGDAELQewIKAIAQQJ0QewIaiICKAIAIQADQCACIAMgAEEKbGpBMGsiADYCACABLQAAIQMgAUEBaiIGIQEgA0H/AHEiA0Ewa0EKSQ0ACwsCQAJAAkACQAJAAkACQAJ/AkACQCADQT9rIgBBP00EQCAERQ0BIARBIUYEQAJAQfAIKAIAIgFBASABGyIHIAhqIgFB1AgoAgAiA0gNACADQf//AEoNAANAIANBAnQiAkGgiQJqIgRBoAgpAwA3AwAgAkGoiQJqQaAIKQMANwMAIAJBsIkCakGgCCkDADcDACACQbiJAmpBoAgpAwA3AwAgAkHAiQJqQaAIKQMANwMAIAJByIkCakGgCCkDADcDACACQdCJAmpBoAgpAwA3AwAgAkHYiQJqQaAIKQMANwMAIAJB4IkCakGgCCkDADcDACACQeiJAmpBoAgpAwA3AwAgAkHwiQJqQaAIKQMANwMAIAJB+IkCakGgCCkDADcDACACQYCKAmpBoAgpAwA3AwAgAkGIigJqQaAIKQMANwMAIAJBkIoCakGgCCkDADcDACACQZiKAmpBoAgpAwA3AwAgAkGgigJqQaAIKQMANwMAIAJBqIoCakGgCCkDADcDACACQbCKAmpBoAgpAwA3AwAgAkG4igJqQaAIKQMANwMAIAJBwIoCakGgCCkDADcDACACQciKAmpBoAgpAwA3AwAgAkHQigJqQaAIKQMANwMAIAJB2IoCakGgCCkDADcDACACQeCKAmpBoAgpAwA3AwAgAkHoigJqQaAIKQMANwMAIAJB8IoCakGgCCkDADcDACACQfiKAmpBoAgpAwA3AwAgAkGAiwJqQaAIKQMANwMAIAJBiIsCakGgCCkDADcDACACQZCLAmpBoAgpAwA3AwAgAkGYiwJqQaAIKQMANwMAIAJBoIsCakGgCCkDADcDACACQaiLAmpBoAgpAwA3AwAgAkGwiwJqQaAIKQMANwMAIAJBuIsCakGgCCkDADcDACACQcCLAmpBoAgpAwA3AwAgAkHIiwJqQaAIKQMANwMAIAJB0IsCakGgCCkDADcDACACQdiLAmpBoAgpAwA3AwAgAkHgiwJqQaAIKQMANwMAIAJB6IsCakGgCCkDADcDACACQfCLAmpBoAgpAwA3AwAgAkH4iwJqQaAIKQMANwMAIAJBgIwCakGgCCkDADcDACACQYiMAmpBoAgpAwA3AwAgAkGQjAJqQaAIKQMANwMAIAJBmIwCakGgCCkDADcDACACQaCMAmpBoAgpAwA3AwAgAkGojAJqQaAIKQMANwMAIAJBsIwCakGgCCkDADcDACACQbiMAmpBoAgpAwA3AwAgAkHAjAJqQaAIKQMANwMAIAJByIwCakGgCCkDADcDACACQdCMAmpBoAgpAwA3AwAgAkHYjAJqQaAIKQMANwMAIAJB4IwCakGgCCkDADcDACACQeiMAmpBoAgpAwA3AwAgAkHwjAJqQaAIKQMANwMAIAJB+IwCakGgCCkDADcDACACQYCNAmpBoAgpAwA3AwAgAkGIjQJqQaAIKQMANwMAIAJBkI0CakGgCCkDADcDACACQZiNAmpBoAgpAwA3AwAgAkGwiQZqIARBgAT8CgAAQdQIKAIAQQJ0QcCJCmogBEGABPwKAABB1AgoAgBBAnRB0IkOaiAEQYAE/AoAAEHUCCgCAEECdEHgiRJqIARBgAT8CgAAQdQIKAIAQQJ0QfCJFmogBEGABPwKAABB1AhB1AgoAgAiAkGAAWoiAzYCACABIANIDQEgAkGA/wBIDQALCwJAIABFDQAgCEH//wBLDQBBgIABIAhrIAcgAUH//wBLGyECAkAgAEEBcUUNACACRQ0AIAhBAnRBoIkCaiEDIAIhBCACQQdxIgcEQANAIAMgBTYCACADQQRqIQMgBEEBayEEIAdBAWsiBw0ACwsgAkEBa0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgBEEIayIEDQALCwJAIABBAnFFDQAgAkUNACAIQQJ0QbCJBmohAyACIQQgAkEHcSIHBEADQCADIAU2AgAgA0EEaiEDIARBAWshBCAHQQFrIgcNAAsLIAJBAWtBB0kNAANAIAMgBTYCHCADIAU2AhggAyAFNgIUIAMgBTYCECADIAU2AgwgAyAFNgIIIAMgBTYCBCADIAU2AgAgA0EgaiEDIARBCGsiBA0ACwsCQCAAQQRxRQ0AIAJFDQAgCEECdEHAiQpqIQMgAiEEIAJBB3EiBwRAA0AgAyAFNgIAIANBBGohAyAEQQFrIQQgB0EBayIHDQALCyACQQFrQQdJDQADQCADIAU2AhwgAyAFNgIYIAMgBTYCFCADIAU2AhAgAyAFNgIMIAMgBTYCCCADIAU2AgQgAyAFNgIAIANBIGohAyAEQQhrIgQNAAsLAkAgAEEIcUUNACACRQ0AIAhBAnRB0IkOaiEDIAIhBCACQQdxIgcEQANAIAMgBTYCACADQQRqIQMgBEEBayEEIAdBAWsiBw0ACwsgAkEBa0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgBEEIayIEDQALCwJAIABBEHFFDQAgAkUNACAIQQJ0QeCJEmohAyACIQQgAkEHcSIHBEADQCADIAU2AgAgA0EEaiEDIARBAWshBCAHQQFrIgcNAAsLIAJBAWtBB0kNAANAIAMgBTYCHCADIAU2AhggAyAFNgIUIAMgBTYCECADIAU2AgwgAyAFNgIIIAMgBTYCBCADIAU2AgAgA0EgaiEDIARBCGsiBA0ACwsgAEEgcUUNACACRQ0AIAJBAWshByAIQQJ0QfCJFmohAyACQQdxIgQEQANAIAMgBTYCACADQQRqIQMgAkEBayECIARBAWsiBA0ACwsgB0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgAkEIayICDQALC0HcCEHcCCgCACAAcjYCACAGQQFqIgIgBi0AAEH/AHEiA0E/ayIAQT9LDQQaDAMLAkBB7AgoAgAiBEEBRgRAQfAIKAIAIgNBzAgoAgAiAUkNASADIAFwIQMMAQtB+AgoAgAhAkH0CCgCACEBAkACQCAEQQVHDQAgAUEBRw0AIAJB6QJODQQMAQsgAkHkAEoNA0H8CCgCAEHkAEoNA0GACSgCAEHkAEoNAwsCQCABRQ0AIAFBAkoNACACQfwIKAIAQYAJKAIAIAFBAnRBiAhqKAIAEQIAIQFB8AgoAgAiA0HMCCgCACICTwR/IAMgAnAFIAMLQQJ0QZAJaiABNgIAC0HwCCgCACIDQcwIKAIAIgFJDQAgAyABcCEDCyADQQJ0QZAJaigCACEFDAELIANB/QBxQSFHBEAgCCEBIAYhAgwECyAEQSNHDQQCQEHsCCgCACICQQFGBEBB8AgoAgAiAUHMCCgCACIASQ0BIAEgAHAhAQwBC0H4CCgCACEBQfQIKAIAIQACQAJAIAJBBUcNACAAQQFHDQAgAUHpAkgNAQwHCyABQeQASg0GQfwIKAIAQeQASg0GQYAJKAIAQeQASg0GCwJAIABFDQAgAEECSg0AIAFB/AgoAgBBgAkoAgAgAEECdEGICGooAgARAgAhAEHwCCgCACIBQcwIKAIAIgJPBH8gASACcAUgAQtBAnRBkAlqIAA2AgALQfAIKAIAIgFBzAgoAgAiAEkNACABIABwIQELIAFBAnRBkAlqKAIAIQUMBAsgCCEBIAYhAgtB1AgoAgAhBgNAAkAgASAGSA0AIAZB//8ASg0AIAZBAnQiBEGgiQJqIgZBoAgpAwA3AwAgBEGoiQJqQaAIKQMANwMAIARBsIkCakGgCCkDADcDACAEQbiJAmpBoAgpAwA3AwAgBEHAiQJqQaAIKQMANwMAIARByIkCakGgCCkDADcDACAEQdCJAmpBoAgpAwA3AwAgBEHYiQJqQaAIKQMANwMAIARB4IkCakGgCCkDADcDACAEQeiJAmpBoAgpAwA3AwAgBEHwiQJqQaAIKQMANwMAIARB+IkCakGgCCkDADcDACAEQYCKAmpBoAgpAwA3AwAgBEGIigJqQaAIKQMANwMAIARBkIoCakGgCCkDADcDACAEQZiKAmpBoAgpAwA3AwAgBEGgigJqQaAIKQMANwMAIARBqIoCakGgCCkDADcDACAEQbCKAmpBoAgpAwA3AwAgBEG4igJqQaAIKQMANwMAIARBwIoCakGgCCkDADcDACAEQciKAmpBoAgpAwA3AwAgBEHQigJqQaAIKQMANwMAIARB2IoCakGgCCkDADcDACAEQeCKAmpBoAgpAwA3AwAgBEHoigJqQaAIKQMANwMAIARB8IoCakGgCCkDADcDACAEQfiKAmpBoAgpAwA3AwAgBEGAiwJqQaAIKQMANwMAIARBiIsCakGgCCkDADcDACAEQZCLAmpBoAgpAwA3AwAgBEGYiwJqQaAIKQMANwMAIARBoIsCakGgCCkDADcDACAEQaiLAmpBoAgpAwA3AwAgBEGwiwJqQaAIKQMANwMAIARBuIsCakGgCCkDADcDACAEQcCLAmpBoAgpAwA3AwAgBEHIiwJqQaAIKQMANwMAIARB0IsCakGgCCkDADcDACAEQdiLAmpBoAgpAwA3AwAgBEHgiwJqQaAIKQMANwMAIARB6IsCakGgCCkDADcDACAEQfCLAmpBoAgpAwA3AwAgBEH4iwJqQaAIKQMANwMAIARBgIwCakGgCCkDADcDACAEQYiMAmpBoAgpAwA3AwAgBEGQjAJqQaAIKQMANwMAIARBmIwCakGgCCkDADcDACAEQaCMAmpBoAgpAwA3AwAgBEGojAJqQaAIKQMANwMAIARBsIwCakGgCCkDADcDACAEQbiMAmpBoAgpAwA3AwAgBEHAjAJqQaAIKQMANwMAIARByIwCakGgCCkDADcDACAEQdCMAmpBoAgpAwA3AwAgBEHYjAJqQaAIKQMANwMAIARB4IwCakGgCCkDADcDACAEQeiMAmpBoAgpAwA3AwAgBEHwjAJqQaAIKQMANwMAIARB+IwCakGgCCkDADcDACAEQYCNAmpBoAgpAwA3AwAgBEGIjQJqQaAIKQMANwMAIARBkI0CakGgCCkDADcDACAEQZiNAmpBoAgpAwA3AwAgBEGwiQZqIAZBgAT8CgAAQdQIKAIAQQJ0QcCJCmogBkGABPwKAABB1AgoAgBBAnRB0IkOaiAGQYAE/AoAAEHUCCgCAEECdEHgiRJqIAZBgAT8CgAAQdQIKAIAQQJ0QfCJFmogBkGABPwKAABB1AhB1AgoAgBBgAFqIgY2AgALIAFB//8ATQRAIABBAXEgAWxBAnRBoIkCaiAFNgIAIABBAXZBAXEgAWxBAnRBsIkGaiAFNgIAIABBAnZBAXEgAWxBAnRBwIkKaiAFNgIAIABBA3ZBAXEgAWxBAnRB0IkOaiAFNgIAIABBBHZBAXEgAWxBAnRB4IkSaiAFNgIAIABBBXYgAWxBAnRB8IkWaiAFNgIAQdQIKAIAIQYLIAFBAWohAUHcCEHcCCgCACAAcjYCACACLQAAIQAgAkEBaiIEIQIgAEH/AHEiA0E/ayIAQcAASQ0ACyAECyECQQAhBCACIQYgASEIIANB/QBxQSFGDQELIANBJGsOCgEDAwMDAwMDAwIDC0HsCEIBNwIADAQLQdgIIAFB2AgoAgAiACAAIAFIGyIAQYCAASAAQYCAAUgbNgIADAILQegIIAFB2AgoAgAiACAAIAFIGyIAQYCAASAAQYCAAUgbIgA2AgBB2AggADYCACAAQQRrEAAEQEHoCEEENgIAQdgIQQQ2AgBB0AhBATYCAA8LEAgMAQsCQCADQTtHDQBB7AgoAgAiAEEHSg0AQewIIABBAWo2AgAgAEECdEHwCGpBADYCAAsgAiEGIAQhAyABIQgMAQtBBCEIIAIhBiAEIQMLIAYgCUkNAAsLQeQIIAU2AgBB4AggAzYCAEHoCCAINgIAC9ELAgF+CH9B2AhCBDcDAEGojQJBoAgpAwAiADcDAEGgjQIgADcDAEGYjQIgADcDAEGQjQIgADcDAEGIjQIgADcDAEGAjQIgADcDAEH4jAIgADcDAEHwjAIgADcDAEHojAIgADcDAEHgjAIgADcDAEHYjAIgADcDAEHQjAIgADcDAEHIjAIgADcDAEHAjAIgADcDAEG4jAIgADcDAEGwjAIgADcDAEGojAIgADcDAEGgjAIgADcDAEGYjAIgADcDAEGQjAIgADcDAEGIjAIgADcDAEGAjAIgADcDAEH4iwIgADcDAEHwiwIgADcDAEHoiwIgADcDAEHgiwIgADcDAEHYiwIgADcDAEHQiwIgADcDAEHIiwIgADcDAEHAiwIgADcDAEG4iwIgADcDAEGwiwIgADcDAEGoiwIgADcDAEGgiwIgADcDAEGYiwIgADcDAEGQiwIgADcDAEGIiwIgADcDAEGAiwIgADcDAEH4igIgADcDAEHwigIgADcDAEHoigIgADcDAEHgigIgADcDAEHYigIgADcDAEHQigIgADcDAEHIigIgADcDAEHAigIgADcDAEG4igIgADcDAEGwigIgADcDAEGoigIgADcDAEGgigIgADcDAEGYigIgADcDAEGQigIgADcDAEGIigIgADcDAEGAigIgADcDAEH4iQIgADcDAEHwiQIgADcDAEHoiQIgADcDAEHgiQIgADcDAEHYiQIgADcDAEHQiQIgADcDAEHIiQIgADcDAEHAiQIgADcDAEG4iQIgADcDAEGwiQIgADcDAEGoCCgCACIEQf8AakGAAW0hCAJAIARBgQFIDQBBASEBIAhBAiAIQQJKG0EBayICQQFxIQMgBEGBAk4EQCACQX5xIQIDQCABQQl0IgdBEHJBoIkCakGwiQJBgAT8CgAAIAdBsI0CakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsLIANFDQAgAUEJdEEQckGgiQJqQbCJAkGABPwKAAALAkAgBEEBSA0AIAhBASAIQQFKGyIDQQFxIQUCQCADQQFrIgdFBEBBACEBDAELIANB/v///wdxIQJBACEBA0AgAUEJdCIGQRByQbCJBmpBsIkCQYAE/AoAACAGQZAEckGwiQZqQbCJAkGABPwKAAAgAUECaiEBIAJBAmsiAg0ACwsgBQRAIAFBCXRBEHJBsIkGakGwiQJBgAT8CgAACyAEQQFIDQAgA0EBcSEFIAcEfyADQf7///8HcSECQQAhAQNAIAFBCXQiBkEQckHAiQpqQbCJAkGABPwKAAAgBkGQBHJBwIkKakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsgAUEHdEEEcgVBBAshASAFBEAgAUECdEHAiQpqQbCJAkGABPwKAAALIARBAUgNACADQQFxIQUgBwR/IANB/v///wdxIQJBACEBA0AgAUEJdCIGQRByQdCJDmpBsIkCQYAE/AoAACAGQZAEckHQiQ5qQbCJAkGABPwKAAAgAUECaiEBIAJBAmsiAg0ACyABQQd0QQRyBUEECyEBIAUEQCABQQJ0QdCJDmpBsIkCQYAE/AoAAAsgBEEBSA0AIANBAXEhBSAHBH8gA0H+////B3EhAkEAIQEDQCABQQl0IgZBEHJB4IkSakGwiQJBgAT8CgAAIAZBkARyQeCJEmpBsIkCQYAE/AoAACABQQJqIQEgAkECayICDQALIAFBB3RBBHIFQQQLIQEgBQRAIAFBAnRB4IkSakGwiQJBgAT8CgAACyAEQQFIDQAgA0EBcSEEIAcEfyADQf7///8HcSECQQAhAQNAIAFBCXQiA0EQckHwiRZqQbCJAkGABPwKAAAgA0GQBHJB8IkWakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsgAUEHdEEEcgVBBAshASAERQ0AIAFBAnRB8IkWakGwiQJBgAT8CgAAC0HUCCAIQQd0QQRyNgIAC58TAgh/AX5B5AgoAgAhA0HgCCgCACECQegIKAIAIQcgAUGQiQFqIglB/wE6AAAgACABSARAIABBkIkBaiEIA0AgAiEEIAhBAWohAQJAIAgtAABB/wBxIgJBMGtBCUsEQCABIQgMAQtB7AgoAgBBAnRB7AhqIgUoAgAhAANAIAUgAiAAQQpsakEwayIANgIAIAEtAAAhAiABQQFqIgghASACQf8AcSICQTBrQQpJDQALCwJAAkACQAJAAkACQAJ/AkAgAkE/ayIAQT9NBEAgBEUNASAEQSFGBEBB8AgoAgAiAUEBIAEbIgQgB2ohAQJAIABFDQAgB0H//wBLDQBBgIABIAdrIAQgAUH//wBLGyEFAkAgAEEBcUUNACAHQQJ0QaCJAmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEECcUUNACAHQQJ0QbCJBmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEEcUUNACAHQQJ0QcCJCmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEIcUUNACAHQQJ0QdCJDmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEQcUUNACAHQQJ0QeCJEmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLIABBIHFFDQAgBUEBayEEIAdBAnRB8IkWaiEAIAVBB3EiAgRAA0AgACADNgIAIABBBGohACAFQQFrIQUgAkEBayICDQALCyAEQQdJDQADQCAAIAM2AhwgACADNgIYIAAgAzYCFCAAIAM2AhAgACADNgIMIAAgAzYCCCAAIAM2AgQgACADNgIAIABBIGohACAFQQhrIgUNAAsLIAhBAWoiBSAILQAAQf8AcSICQT9rIgBBP00NAxoMBAsCQEHsCCgCACIFQQFGBEBB8AgoAgAiAUHMCCgCACIESQ0BIAEgBHAhAQwBC0H4CCgCACEEQfQIKAIAIQECQAJAIAVBBUcNACABQQFHDQAgBEHpAk4NBAwBCyAEQeQASg0DQfwIKAIAQeQASg0DQYAJKAIAQeQASg0DCwJAIAFFDQAgAUECSg0AIARB/AgoAgBBgAkoAgAgAUECdEGICGooAgARAgAhBEHwCCgCACIBQcwIKAIAIgVPBH8gASAFcAUgAQtBAnRBkAlqIAQ2AgALQfAIKAIAIgFBzAgoAgAiBEkNACABIARwIQELIAFBAnRBkAlqKAIAIQMMAQsgAkH9AHFBIUcEQCAHIQEgAiEADAQLIARBI0cNBAJAQewIKAIAIgRBAUYEQEHwCCgCACIBQcwIKAIAIgBJDQEgASAAcCEBDAELQfgIKAIAIQFB9AgoAgAhAAJAAkAgBEEFRw0AIABBAUcNACABQekCSA0BDAcLIAFB5ABKDQZB/AgoAgBB5ABKDQZBgAkoAgBB5ABKDQYLAkAgAEUNACAAQQJKDQAgAUH8CCgCAEGACSgCACAAQQJ0QYgIaigCABECACEAQfAIKAIAIgFBzAgoAgAiBE8EfyABIARwBSABC0ECdEGQCWogADYCAAtB8AgoAgAiAUHMCCgCACIASQ0AIAEgAHAhAQsgAUECdEGQCWooAgAhAwwECyAHIQEgCAshBQNAIAFB//8ATQRAIABBAXEgAWxBAnRBoIkCaiADNgIAIABBAXZBAXEgAWxBAnRBsIkGaiADNgIAIABBAnZBAXEgAWxBAnRBwIkKaiADNgIAIABBA3ZBAXEgAWxBAnRB0IkOaiADNgIAIABBBHZBAXEgAWxBAnRB4IkSaiADNgIAIABBBXYgAWxBAnRB8IkWaiADNgIACyABQQFqIQEgBS0AACEAIAVBAWoiBCEFIABB/wBxIgJBP2siAEHAAEkNAAsgBCEFC0EAIQQgBSEIIAEhByACIQAgAkH9AHFBIUYNAQtBBCEHIAQhAiAAQSRrDgoDAgICAgICAgIBAgtB7AhCATcCAAwCC0GoCCgCAEEEaxAABEBB0AhBATYCAA8LAkBBqAgoAgAiBkEFSA0AQaAIKQMAIQogBkEDa0EBdiIBQQdxIQJBACEAIAFBAWtBB08EQCABQfj///8HcSEFA0AgAEEDdCIBQbCJAmogCjcDACABQQhyQbCJAmogCjcDACABQRByQbCJAmogCjcDACABQRhyQbCJAmogCjcDACABQSByQbCJAmogCjcDACABQShyQbCJAmogCjcDACABQTByQbCJAmogCjcDACABQThyQbCJAmogCjcDACAAQQhqIQAgBUEIayIFDQALCyACRQ0AA0AgAEEDdEGwiQJqIAo3AwAgAEEBaiEAIAJBAWsiAg0ACwtBwIkGQbCJAiAGQQJ0IgD8CgAAQdCJCkGwiQIgAPwKAABB4IkOQbCJAiAA/AoAAEHwiRJBsIkCIAD8CgAAQYCKFkGwiQIgAPwKAAAgBCECDAELAkAgAEE7Rw0AQewIKAIAIgBBB0oNAEHsCCAAQQFqNgIAIABBAnRB8AhqQQA2AgALIAEhBwsgCCAJSQ0ACwtB5AggAzYCAEHgCCACNgIAQegIIAc2AgAL4gcCBX8BfgJAQdAIAn8CQAJAIAAgAU4NACABQZCJAWohBiAAQZCJAWohBQNAIAUtAAAiA0H/AHEhAgJAAkACQAJAAkACQAJAQeAIKAIAIgRBIkcEQCAEDQcgAkEiRgRAQewIQgE3AgBB4AhBIjYCAAwICyACQT9rQcAASQ0GIANBIWsiAkEMTQ0BDAULAkAgAkEwayIEQQlNBEBB7AgoAgBBAnRB7AhqIgIgBCACKAIAQQpsajYCAAwBC0HsCCgCACEEIAJBO0YEQCAEQQdKDQFB7AggBEEBajYCACAEQQJ0QfAIakEANgIADAELIARBBEYEQEHECEECNgIAQbAIQfAIKQMANwMAQbgIQfgIKAIAIgI2AgBBvAhB/AgoAgAiBDYCAEHICEECQQFBwAgoAgAiAxs2AgBBrAggBEEAIAMbNgIAQagIIAJBgIABIAJBgIABSBtBBGpBACADGzYCAEHgCEEANgIADAoLIAJBP2tBwABJDQQLIANBIWsiAkEMTQ0BDAILQQEgAnRBjSBxRQ0DDAQLQQEgAnRBjSBxDQELIANBoQFrIgJBDEsNA0EBIAJ0QY0gcUUNAwtBxAhCgYCAgBA3AgBBsAhB8AgoAgBBAEHsCCgCACICQQBKGzYCAEG0CEH0CCgCAEEAIAJBAUobNgIAQbgIQfgIKAIAQQAgAkECShs2AgBB4AhBADYCAEG8CEEANgIADAQLIANBoQFrIgJBDEsNAUEBIAJ0QY0gcUUNAQtBxAhCgYCAgBA3AgBBsAhCADcDAEG4CEIANwMADAMLIAVBAWoiBSAGSQ0ACwsCQEHICCgCAA4DAwEAAQsCQEGoCCgCACIFQQVIDQBBoAgpAwAhByAFQQNrQQF2IgNBB3EhBEEAIQIgA0EBa0EHTwRAIANB+P///wdxIQYDQCACQQN0IgNBsIkCaiAHNwMAIANBCHJBsIkCaiAHNwMAIANBEHJBsIkCaiAHNwMAIANBGHJBsIkCaiAHNwMAIANBIHJBsIkCaiAHNwMAIANBKHJBsIkCaiAHNwMAIANBMHJBsIkCaiAHNwMAIANBOHJBsIkCaiAHNwMAIAJBCGohAiAGQQhrIgYNAAsLIARFDQADQCACQQN0QbCJAmogBzcDACACQQFqIQIgBEEBayIEDQALC0HAiQZBsIkCIAVBAnQiA/wKAABB0IkKQbCJAiAD/AoAAEHgiQ5BsIkCIAP8CgAAQfCJEkGwiQIgA/wKAABBgIoWQbCJAiAD/AoAAEECDAELEAhByAgoAgALEAEiAjYCACACDQAgACABQcgIKAIAQQJ0QYAIaigCABEBAAsLdABB6AhBBDYCAEHkCCAANgIAQewIQgE3AgBBxAhCADcCAEHACCADNgIAQdwIQgA3AgBBqAhCADcDAEGwCEIANwMAQbgIQgA3AwBBzAggAkGAICACQYAgSRs2AgBBoAggAa1CgYCAgBB+NwMAQdAIQQA2AgALIwBB0AgoAgBFBEAgACABQcgIKAIAQQJ0QYAIaigCABEBAAsLWgECfwJAAkACQEHICCgCAEEBaw4CAAECC0HYCEHoCCgCACIAQdgIKAIAIgEgACABShsiAEGAgAEgAEGAgAFIGyIANgIAIABBBGsPC0GoCCgCAEEEayEACyAAC0IBAX8Cf0EGQdwIKAIAIgBBIHENABpBBSAAQRBxDQAaQQQgAEEIcQ0AGkEDIABBBHENABpBAiAAQQFxIABBAnEbCwu9BQEFfQJ/IAJFBEAgAUH/AWxBMmpB5ABtIgBBCHQgAHIgAEEQdHIMAQsgArJDAADIQpUhBiAAQfABarJDAAC0Q5UhBQJ9IAGyQwAAyEKVIgNDAAAAP10EQCADIAZDAACAP5KUDAELIAYgA0MAAIA/IAaTlJILIQcgAyADkiEGAkAgBUOrqqo+kiIEQwAAAABdBEAgBEMAAIA/kiEEDAELIARDAACAP15FDQAgBEMAAIC/kiEECyAGIAeTIQMgBUMAAAAAXSEAAn8CfSADIAcgA5NDAADAQJQgBJSSIARDq6oqPl0NABogByAEQwAAAD9dDQAaIAMgBEOrqio/XUUNABogAyAHIAOTIARDAADAwJRDAACAQJKUkgtDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALIQECQCAABEAgBUMAAIA/kiEEDAELIAUiBEMAAIA/XkUNACAFQwAAgL+SIQQLIAVDq6qqvpIiBUMAAAAAXSECAn8CfSADIAcgA5NDAADAQJQgBJSSIARDq6oqPl0NABogByAEQwAAAD9dDQAaIAMgBEOrqio/XUUNABogAyAHIAOTIARDAADAwJRDAACAQJKUkgtDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALIQACQCACBEAgBUMAAIA/kiEFDAELIAVDAACAP15FDQAgBUMAAIC/kiEFCwJAIAVDq6oqPl0EQCADIAcgA5NDAADAQJQgBZSSIQcMAQsgBUMAAAA/XQ0AIAVDq6oqP11FBEAgAyEHDAELIAMgByADkyAFQwAAwMCUQwAAgECSlJIhBwsgAEEIdAJ/IAdDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALQRB0ciABcgtBgICAeHILNwAgAEH/AWxBMmpB5ABtIAFB/wFsQTJqQeQAbUEIdHIgAkH/AWxBMmpB5ABtQRB0ckGAgIB4cgsEACMACwYAIAAkAAsQACMAIABrQXBxIgAkACAACwsYAQBBgAgLEQEAAAACAAAAAwAAAAQAAAAF'\n};\n//# sourceMappingURL=wasm.js.map","/**\n * Copyright (c) 2024-2026 The xterm.js authors. All rights reserved.\n * @license MIT\n *\n * Minimal event utilities for xterm.js core.\n * Simplified from VS Code's event.ts - no leak detection/profiling.\n */\n\nimport { IDisposable, DisposableStore, toDisposable } from './Lifecycle';\n\nexport interface IEvent<T> {\n  (listener: (e: T) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore): IDisposable;\n}\n\nexport class Emitter<T> {\n  private _listeners: { fn: (e: T) => any, thisArgs: any }[] = [];\n  private _disposed = false;\n  private _event: IEvent<T> | undefined;\n\n  public get event(): IEvent<T> {\n    if (this._event) {\n      return this._event;\n    }\n    this._event = (listener: (e: T) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore) => {\n      if (this._disposed) {\n        return toDisposable(() => {});\n      }\n\n      const entry = { fn: listener, thisArgs };\n      this._listeners = this._listeners.slice();\n      this._listeners.push(entry);\n\n      const result = toDisposable(() => {\n        const idx = this._listeners.indexOf(entry);\n        if (idx !== -1) {\n          this._listeners = this._listeners.slice();\n          this._listeners.splice(idx, 1);\n        }\n      });\n\n      if (disposables) {\n        if (Array.isArray(disposables)) {\n          disposables.push(result);\n        } else {\n          disposables.add(result);\n        }\n      }\n\n      return result;\n    };\n    return this._event;\n  }\n\n  public fire(event: T): void {\n    if (this._disposed || !this._listeners.length) {\n      return;\n    }\n    if (this._listeners.length === 1) {\n      this._listeners[0].fn.call(this._listeners[0].thisArgs, event);\n      return;\n    }\n    const listeners = this._listeners;\n    for (let i = 0, len = listeners.length; i < len; ++i) {\n      listeners[i].fn.call(listeners[i].thisArgs, event);\n    }\n  }\n\n  public dispose(): void {\n    if (this._disposed) {\n      return;\n    }\n    this._disposed = true;\n    this._listeners.length = 0;\n  }\n}\n\nexport namespace EventUtils {\n  export function forward<T>(from: IEvent<T>, to: Emitter<T>): IDisposable {\n    return from(e => to.fire(e));\n  }\n\n  export function map<I, O>(event: IEvent<I>, map: (i: I) => O): IEvent<O> {\n    return (listener: (e: O) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore) => {\n      return event(i => listener.call(thisArgs, map(i)), undefined, disposables);\n    };\n  }\n\n  export function any<T>(...events: IEvent<T>[]): IEvent<T>;\n  export function any(...events: IEvent<any>[]): IEvent<void>;\n  export function any<T>(...events: IEvent<T>[]): IEvent<T> {\n    return (listener: (e: T) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore) => {\n      const store = new DisposableStore();\n      for (const event of events) {\n        store.add(event(e => listener.call(thisArgs, e)));\n      }\n      if (disposables) {\n        if (Array.isArray(disposables)) {\n          disposables.push(store);\n        } else {\n          disposables.add(store);\n        }\n      }\n      return store;\n    };\n  }\n\n  export function runAndSubscribe<T>(event: IEvent<T>, handler: (e: T) => void, initial: T): IDisposable;\n  export function runAndSubscribe<T>(event: IEvent<T>, handler: (e: T | undefined) => void): IDisposable;\n  export function runAndSubscribe<T>(event: IEvent<T>, handler: (e: T | undefined) => void, initial?: T): IDisposable {\n    handler(initial);\n    return event(e => handler(e));\n  }\n}\n","/**\n * Copyright (c) 2024-2026 The xterm.js authors. All rights reserved.\n * @license MIT\n *\n * Minimal lifecycle utilities for xterm.js core.\n * Simplified from VS Code's lifecycle.ts - no tracking/leak detection.\n */\n\nexport interface IDisposable {\n  dispose(): void;\n}\n\nexport function toDisposable(fn: () => void): IDisposable {\n  return { dispose: fn };\n}\n\nexport function dispose<T extends IDisposable>(disposable: T): T;\nexport function dispose<T extends IDisposable>(disposable: T | undefined): T | undefined;\nexport function dispose<T extends IDisposable>(disposables: T[]): T[];\nexport function dispose<T extends IDisposable>(arg: T | T[] | undefined): T | T[] | undefined {\n  if (!arg) {\n    return arg;\n  }\n  if (Array.isArray(arg)) {\n    for (const d of arg) {\n      d.dispose();\n    }\n    return [];\n  }\n  arg.dispose();\n  return arg;\n}\n\nexport function combinedDisposable(...disposables: IDisposable[]): IDisposable {\n  return toDisposable(() => dispose(disposables));\n}\n\nexport class DisposableStore implements IDisposable {\n  private readonly _disposables = new Set<IDisposable>();\n  private _isDisposed = false;\n\n  public get isDisposed(): boolean {\n    return this._isDisposed;\n  }\n\n  public add<T extends IDisposable>(o: T): T {\n    if (this._isDisposed) {\n      o.dispose();\n    } else {\n      this._disposables.add(o);\n    }\n    return o;\n  }\n\n  public dispose(): void {\n    if (this._isDisposed) {\n      return;\n    }\n    this._isDisposed = true;\n    for (const d of this._disposables) {\n      d.dispose();\n    }\n    this._disposables.clear();\n  }\n\n  public clear(): void {\n    for (const d of this._disposables) {\n      d.dispose();\n    }\n    this._disposables.clear();\n  }\n}\n\nexport abstract class Disposable implements IDisposable {\n  public static readonly None: IDisposable = Object.freeze({ dispose() { } });\n\n  protected readonly _store = new DisposableStore();\n\n  public dispose(): void {\n    this._store.dispose();\n  }\n\n  protected _register<T extends IDisposable>(o: T): T {\n    return this._store.add(o);\n  }\n}\n\nexport class MutableDisposable<T extends IDisposable> implements IDisposable {\n  private _value: T | undefined;\n  private _isDisposed = false;\n\n  public get value(): T | undefined {\n    return this._isDisposed ? undefined : this._value;\n  }\n\n  public set value(value: T | undefined) {\n    if (this._isDisposed || value === this._value) {\n      return;\n    }\n    this._value?.dispose();\n    this._value = value;\n  }\n\n  public clear(): void {\n    this.value = undefined;\n  }\n\n  public dispose(): void {\n    this._isDisposed = true;\n    this._value?.dispose();\n    this._value = undefined;\n  }\n}\n","/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\nimport { IImageAddonOptions, IOscHandler, IResetHandler, ITerminalExt } from './Types';\nimport { ImageRenderer } from './ImageRenderer';\nimport { IIPImageStorage } from './IIPImageStorage';\nimport { CELL_SIZE_DEFAULT } from './ImageStorage';\nimport Base64Decoder from 'xterm-wasm-parts/lib/base64/Base64Decoder.wasm';\nimport QoiDecoder from 'xterm-wasm-parts/lib/qoi/QoiDecoder.wasm';\nimport { HeaderParser, IHeaderFields, HeaderState, SequenceType } from './IIPHeaderParser';\nimport { imageType, UNSUPPORTED_TYPE } from './IIPMetrics';\n\n// Local const enum mirror - esbuild can't inline const enums from external packages\nconst enum DecoderConst {\n  // Held memory in base64/QOI decoders between images. Zero because each kept\n  // decoder pins a wasm memory, and V8 caps those per process (~124 in a\n  // sandboxed renderer), so idle terminals must not hold one.\n  KEEP_DATA = 0,\n  // Initial buffer allocation for the decoder.\n  INITIAL_DATA = 1048576,\n  // Local mirror of const enum (esbuild can't inline const enums from external packages)\n  OK = 0\n}\n\n// default IIP header values\nconst DEFAULT_HEADER: IHeaderFields = {\n  type: SequenceType.INVALID,\n  name: 'Unnamed file',\n  size: 0,\n  width: 'auto',\n  height: 'auto',\n  preserveAspectRatio: 1,\n  inline: 0\n};\n\n\nexport class IIPHandler implements IOscHandler, IResetHandler {\n  private _generation = 0;\n  private _aborted = false;\n  private _hp = new HeaderParser();\n  private _header: IHeaderFields = DEFAULT_HEADER;\n  private _dec: Base64Decoder;\n  private _qoiDec: QoiDecoder;\n  private _isMultipart = false;\n  private _abortMulti = false;\n\n  constructor(\n    private readonly _opts: IImageAddonOptions,\n    private readonly _renderer: ImageRenderer,\n    private readonly _storage: IIPImageStorage,\n    private readonly _coreTerminal: ITerminalExt\n  ) {\n    const maxEncodedBytes = Math.ceil(this._opts.iipSizeLimit * 4 / 3);\n    const initialBytes = Math.min(DecoderConst.INITIAL_DATA, maxEncodedBytes);\n    this._dec = new Base64Decoder(DecoderConst.KEEP_DATA, maxEncodedBytes, initialBytes);\n    this._qoiDec = new QoiDecoder(DecoderConst.KEEP_DATA);\n  }\n\n  public reset(): void {\n    this._generation++;\n    this._hp.reset();\n    this._dec.release();\n    this._qoiDec.release();\n  }\n\n  public start(): void {\n    this._aborted = false;\n    this._hp.reset();\n  }\n\n  public put(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted) return;\n\n    if (this._hp.state === HeaderState.END) {\n      if ((this._dec.put(data.subarray(start, end)) as number) !== DecoderConst.OK) {\n        this._dec.release();\n        this._aborted = true;\n      }\n    } else {\n      const dataPos = this._hp.parse(data, start, end);\n      if (dataPos === -1) {\n        this._aborted = true;\n        return;\n      }\n      if (dataPos > 0) {\n        const seqType = this._hp.fields.type;\n        if (seqType === SequenceType.FILE) {\n          if (this._isMultipart) {\n            this._isMultipart = false;\n            this._abortMulti = false;\n            this._dec.release();\n          }\n          this._header = Object.assign({}, DEFAULT_HEADER, this._hp.fields);\n          if (!this._header.inline) {\n            this._aborted = true;\n            return;\n          }\n          if (!this._initDecoder()) {\n            this._aborted = true;\n            return;\n          }\n        } else if (this._abortMulti) {\n          this._aborted = true;\n          return;\n        }\n        if ((this._dec.put(data.subarray(dataPos, end)) as number) !== DecoderConst.OK) {\n          this._dec.release();\n          this._aborted = true;\n          if (this._isMultipart) this._abortMulti = true;\n        }\n      }\n    }\n  }\n\n  public end(success: boolean): boolean | Promise<boolean> {\n    if (this._aborted) return true;\n\n    if (this._hp.state !== HeaderState.END) {\n      if (this._hp.end()) return true;\n    }\n    const seqType = this._hp.fields.type;\n\n    if (seqType === SequenceType.FILEPART) return true;\n\n    if (seqType === SequenceType.REPORTCELLSIZE) {\n      // OSC 1337 ; ReportCellSize=[height];[width];[scale] ST\n      let w = CELL_SIZE_DEFAULT.width;\n      let h = CELL_SIZE_DEFAULT.height;\n      if (this._renderer.dimensions) {\n        w = this._renderer.dimensions.css.canvas.width / this._coreTerminal.cols;\n        h = this._renderer.dimensions.css.canvas.height / this._coreTerminal.rows;\n      }\n      const scale = this._coreTerminal._core._coreBrowserService?.dpr ?? 1;\n      const report = `\\x1b]1337;ReportCellSize=${h.toFixed(3)};${w.toFixed(3)};${scale.toFixed(3)}\\x1b\\\\`;\n      this._coreTerminal.input(report, false);\n      return true;\n    }\n\n    if (seqType === SequenceType.MULTIPARTFILE) {\n      this._header = Object.assign({}, DEFAULT_HEADER, this._hp.fields);\n      this._isMultipart = true;\n      this._abortMulti = false;\n      this._dec.release();\n      if (!this._initDecoder()) {\n        this._abortMulti = true;\n      }\n      return true;\n    }\n\n    if (seqType === SequenceType.FILEEND) {\n      if (!this._isMultipart) return true;\n      this._isMultipart = false;\n      if (this._abortMulti || this._header.type !== SequenceType.MULTIPARTFILE) return true;\n    }\n\n    // fallthrough for SequenceType.FILE & SequenceType.FILEEND\n\n    let w = 0;\n    let h = 0;\n\n    // early exit condition chain\n    let cond: number | boolean;\n    let metrics = UNSUPPORTED_TYPE;\n    if (cond = success) {\n      if (cond = !this._dec.end()) {\n        metrics = imageType(this._dec.data8);\n        if (cond = metrics.mime !== 'unsupported') {\n          w = metrics.width;\n          h = metrics.height;\n          if (cond = w && h && w * h < this._opts.pixelLimit) {\n            [w, h] = this._resize(w, h).map(Math.floor);\n            cond = w && h && w * h < this._opts.pixelLimit;\n          } else {\n            console.warn(`IIP: image dimension issue ${metrics.width}x${metrics.height}`);\n          }\n        } else {\n          console.warn('IIP: unsupported image type');\n        }\n      } else {\n        console.warn('IIP: error during BASE64 decoding');\n      }\n    }\n    if (!cond) {\n      this._dec.release();\n      return true;\n    }\n\n    let blob: Blob | ImageData;\n    if (metrics.mime === 'image/qoi') {\n      let data: Uint8Array<ArrayBuffer>;\n      try {\n        data = this._qoiDec.decode(this._dec.data8);\n      } catch (e) {\n        console.warn('IIP: could not decode QOI image', e);\n        this._dec.release();\n        this._qoiDec.release();\n        return true;\n      }\n      blob = new ImageData(\n        new Uint8ClampedArray(data.buffer, data.byteOffset, data.byteLength),\n        this._qoiDec.width,\n        this._qoiDec.height\n      );\n      this._qoiDec.release();\n      if (w === this._qoiDec.width && h === this._qoiDec.height) {\n        // use fast-path if we don't need to rescale\n        this._dec.release();\n        const canvas = ImageRenderer.createCanvas(undefined, this._qoiDec.width, this._qoiDec.height);\n        canvas.getContext('2d')?.putImageData(blob, 0, 0);\n        this._storage.addImage(canvas);\n        return true;\n      }\n    } else {\n      blob = new Blob([this._dec.data8], { type: metrics.mime });\n    }\n    this._dec.release();\n    const generation = this._generation;\n    return createImageBitmap(blob, { resizeWidth: w, resizeHeight: h })\n      .then(bm => {\n        if (generation !== this._generation) {\n          bm.close();\n          return true;\n        }\n        this._storage.addImage(bm);\n        return true;\n      })\n      .catch(e => {\n        console.warn(`IIP: decoding error ${metrics.mime} ${metrics.width}x${metrics.height}`, e);\n        return true;\n      });\n  }\n\n  // Why: wasm memory exhaustion must drop this image, not throw out of the parser and wedge the write queue.\n  private _initDecoder(): boolean {\n    try {\n      this._dec.init();\n      return true;\n    } catch (e) {\n      console.warn('IIP: could not allocate decoder', e);\n      this._dec.release();\n      return false;\n    }\n  }\n\n  private _resize(w: number, h: number): [number, number] {\n    const cw = this._renderer.dimensions?.css.cell.width || CELL_SIZE_DEFAULT.width;\n    const ch = this._renderer.dimensions?.css.cell.height || CELL_SIZE_DEFAULT.height;\n    const width = this._renderer.dimensions?.css.canvas.width || cw * this._coreTerminal.cols;\n    const height = this._renderer.dimensions?.css.canvas.height || ch * this._coreTerminal.rows;\n\n    const rw = this._dim(this._header.width!, width, cw);\n    const rh = this._dim(this._header.height!, height, ch);\n    if (!rw && !rh) {\n      const wf = width / w;         // TODO: should this respect initial cursor offset?\n      const hf = (height - ch) / h; // TODO: fix offset issues from float cell height\n      const f = Math.min(wf, hf);\n      return f < 1 ? [w * f, h * f] : [w, h];\n    }\n    return !rw\n      ? [w * rh / h, rh]\n      : this._header.preserveAspectRatio || !rw || !rh\n        ? [rw, h * rw / w] : [rw, rh];\n  }\n\n  private _dim(s: string, total: number, cdim: number): number {\n    if (s === 'auto') return 0;\n    if (s.endsWith('%')) return parseInt(s.slice(0, -1), 10) * total / 100;\n    if (s.endsWith('px')) return parseInt(s.slice(0, -2), 10);\n    return parseInt(s, 10) * cdim;\n  }\n}\n","/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\n// eslint-disable-next-line\ndeclare const Buffer: any;\n\nexport const enum HeaderState {\n  START = 0,\n  ABORT = 1,\n  KEY = 2,\n  VALUE = 3,\n  END = 4\n}\n\nexport const enum SequenceType {\n  INVALID = 0,\n  FILE = 1,\n  MULTIPARTFILE = 2,\n  FILEPART = 3,\n  FILEEND = 4,\n  REPORTCELLSIZE = 5\n}\n\nexport interface IHeaderFields {\n  [key: string]: number | string | Uint32Array | null | undefined;\n  // sequence type\n  type: SequenceType;\n  // base-64 encoded filename. Defaults to \"Unnamed file\".\n  name: string;\n  // File size in bytes. The file transfer will be canceled if this size is exceeded.\n  size: number;\n  /**\n   * Optional width and height to render:\n   * - N: N character cells.\n   * - Npx: N pixels.\n   * - N%: N percent of the session's width or height.\n   * - auto: The image's inherent size will be used to determine an appropriate dimension.\n   */\n  width?: string;\n  height?: string;\n  // Optional, defaults to 1 respecting aspect ratio (width takes precedence).\n  preserveAspectRatio?: number;\n  // Optional, defaults to 0. If set to 1, the file will be displayed inline, else downloaded\n  // (download not supported).\n  inline?: number;\n}\n\n// field value decoders\n\n// ASCII bytes to string\nfunction toStr(data: Uint32Array): string {\n  let s = '';\n  for (let i = 0; i < data.length; ++i) {\n    s += String.fromCharCode(data[i]);\n  }\n  return s;\n}\n\n// digits to integer\nfunction toInt(data: Uint32Array): number {\n  let v = 0;\n  for (let i = 0; i < data.length; ++i) {\n    if (data[i] < 48 || data[i] > 57) {\n      throw new Error('illegal char');\n    }\n    v = v * 10 + data[i] - 48;\n  }\n  return v;\n}\n\n// check for correct size entry\nfunction toSize(data: Uint32Array): string {\n  const v = toStr(data);\n  if (!v.match(/^((auto)|(\\d+?((px)|(%)){0,1}))$/)) {\n    throw new Error('illegal size');\n  }\n  return v;\n}\n\n// name is base64 encoded utf-8\nfunction toName(data: Uint32Array): string {\n  if (typeof Buffer !== 'undefined') {\n    return Buffer.from(toStr(data), 'base64').toString();\n  }\n  const bs = atob(toStr(data));\n  const b = new Uint8Array(bs.length);\n  for (let i = 0; i < b.length; ++i) {\n    b[i] = bs.charCodeAt(i);\n  }\n  return new TextDecoder().decode(b);\n}\n\nconst DECODERS: {[key: string]: (v: Uint32Array) => number | string} = {\n  inline: toInt,\n  size: toInt,\n  name: toName,\n  width: toSize,\n  height: toSize,\n  preserveAspectRatio: toInt\n};\n\n\n// sequence type markers\n// File\nconst FILE_MARKER = [70, 105, 108, 101];\n// MultipartFile\nconst MULTIPARTFILE_MARKER = [77, 117, 108, 116, 105, 112, 97, 114, 116, 70, 105, 108, 101];\n// FilePart\nconst FILEPART_MARKER = [70, 105, 108, 101, 80, 97, 114, 116];\n// FileEnd\nconst FILEEND_MARKER = [70, 105, 108, 101, 69, 110, 100];\n// ReportCellSize\nconst REPORTCELLSIZE_MARKER = [82, 101, 112, 111, 114, 116, 67, 101, 108, 108, 83, 105, 122, 101];\n\n// max allowed chars for sequence header\nconst MAX_FIELDCHARS = 1024;\n\n\nexport class HeaderParser {\n  public state: HeaderState = HeaderState.START;\n  private _buffer = new Uint32Array(MAX_FIELDCHARS);\n  private _position = 0;\n  private _key = '';\n  public fields: {[key: string]: number | string | Uint32Array | null | undefined} = {};\n\n  public reset(): void {\n    this._buffer.fill(0);\n    this.state = HeaderState.START;\n    this._position = 0;\n    this.fields = {};\n    this._key = '';\n  }\n\n  public end(): number {\n    if (this.state === HeaderState.START) {\n      if (this._position === FILEEND_MARKER.length) {\n        for (let k = 0; k < FILEEND_MARKER.length; ++k) {\n          if (this._buffer[k] !== FILEEND_MARKER[k]) return this._a();\n        }\n        this.fields['type'] = SequenceType.FILEEND;\n        this.state = HeaderState.END;\n        return 0;\n      }\n      if (this._position === REPORTCELLSIZE_MARKER.length) {\n        for (let k = 0; k < REPORTCELLSIZE_MARKER.length; ++k) {\n          if (this._buffer[k] !== REPORTCELLSIZE_MARKER[k]) return this._a();\n        }\n        this.fields['type'] = SequenceType.REPORTCELLSIZE;\n        this.state = HeaderState.END;\n        return 0;\n      }\n      return this._a();\n    }\n    if (this.state === HeaderState.END) return 0;\n    if (this.state === HeaderState.VALUE\n      && this.fields.type === SequenceType.MULTIPARTFILE\n    ) {\n      if (!this._storeValue(this._position)) return this._a();\n      this.state = HeaderState.END;\n      return 0;\n    }\n    return this._a();\n  }\n\n  public parse(data: Uint32Array, start: number, end: number): number {\n    let state = this.state;\n    let pos = this._position;\n    const buffer = this._buffer;\n    if (state === HeaderState.ABORT || state === HeaderState.END) return -1;\n    if (state === HeaderState.START && pos > 14) return -1;\n    for (let i = start; i < end; ++i) {\n      const c = data[i];\n      switch (c) {\n        case 59: // ;\n          if (!this._storeValue(pos)) return this._a();\n          state = HeaderState.KEY;\n          pos = 0;\n          break;\n        case 61: // =\n          if (state === HeaderState.START) {\n            if (buffer[0] === 70) {\n              // 'File' or 'FilePart'\n              let k = 0;\n              for (; k < FILE_MARKER.length; ++k) {\n                if (buffer[k] !== FILE_MARKER[k]) return this._a();\n              }\n              this.fields['type'] = SequenceType.FILE;\n              if (pos === FILEPART_MARKER.length) {\n                for (; k < FILEPART_MARKER.length; ++k) {\n                  if (buffer[k] !== FILEPART_MARKER[k]) return this._a();\n                }\n                this.fields['type'] = SequenceType.FILEPART;\n                this.state = HeaderState.END;\n                return i + 1;\n              }\n            } else if (buffer[0] === 77) {\n              // 'MultipartFile'\n              for (let k = 0; k < MULTIPARTFILE_MARKER.length; ++k) {\n                if (buffer[k] !== MULTIPARTFILE_MARKER[k]) return this._a();\n              }\n              this.fields['type'] = SequenceType.MULTIPARTFILE;\n            } else {\n              return this._a();\n            }\n            state = HeaderState.KEY;\n            pos = 0;\n          } else if (state === HeaderState.KEY) {\n            if (!this._storeKey(pos)) return this._a();\n            state = HeaderState.VALUE;\n            pos = 0;\n          } else if (state === HeaderState.VALUE) {\n            if (pos >= MAX_FIELDCHARS) return this._a();\n            buffer[pos++] = c;\n          }\n          break;\n        case 58: // :\n          if (state === HeaderState.VALUE) {\n            if (!this._storeValue(pos)) return this._a();\n          }\n          this.state = HeaderState.END;\n          return i + 1;\n        default:\n          if (pos >= MAX_FIELDCHARS) return this._a();\n          buffer[pos++] = c;\n      }\n    }\n    this.state = state;\n    this._position = pos;\n    return -2;\n  }\n\n  private _a(): number {\n    this.fields.type = SequenceType.INVALID;\n    this.state = HeaderState.ABORT;\n    return -1;\n  }\n\n  private _storeKey(pos: number): boolean {\n    const k = toStr(this._buffer.subarray(0, pos));\n    if (k) {\n      this._key = k;\n      this.fields[k] = null;\n      return true;\n    }\n    return false;\n  }\n\n  private _storeValue(pos: number): boolean {\n    if (this._key) {\n      try {\n        const v = this._buffer.slice(0, pos);\n        this.fields[this._key] = DECODERS[this._key] ? DECODERS[this._key](v) : v;\n      } catch {\n        return false;\n      }\n      return true;\n    }\n    return false;\n  }\n}\n","/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IAddImageOpts } from './Types';\nimport { ImageStorage } from './ImageStorage';\n\n/**\n * IIP (iTerm Image Protocol) specific image storage controller.\n *\n * Wraps the shared ImageStorage with IIP protocol semantics:\n * - Always uses scrolling mode (cursor advances with image)\n */\nexport class IIPImageStorage {\n  private _addImageOpts: IAddImageOpts = { scrolling: true, layer: 'top', zIndex: 0, cursorPos: 'iip' };\n  constructor(\n    private readonly _storage: ImageStorage\n  ) {}\n\n  /**\n   * Add an IIP image to storage.\n   * Always uses scrolling mode — cursor advances past the image.\n   */\n  public addImage(img: HTMLCanvasElement | ImageBitmap): void {\n    this._storage.addImage(img, this._addImageOpts);\n  }\n}\n","/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\n\nexport type ImageType = 'image/png' | 'image/jpeg' | 'image/gif' | 'image/qoi' | 'image/webp' | 'image/avif' | 'unsupported' | '';\n\nexport interface IMetrics {\n  mime: ImageType;\n  width: number;\n  height: number;\n}\n\nexport const UNSUPPORTED_TYPE: IMetrics = {\n  mime: 'unsupported',\n  width: 0,\n  height: 0\n};\n\nexport function imageType(d: Uint8Array): IMetrics {\n  if (d.length < 32) {\n    return UNSUPPORTED_TYPE;\n  }\n  const d32 = new Uint32Array(d.buffer, d.byteOffset, 8);\n  // PNG: 89 50 4E 47 0D 0A 1A 0A (8 first bytes == magic number for PNG)\n  // + first chunk must be IHDR\n  if (d32[0] === 0x474E5089 && d32[1] === 0x0A1A0A0D && d32[3] === 0x52444849) {\n    return {\n      mime: 'image/png',\n      width:  d[16] << 24 | d[17] << 16 | d[18] << 8 | d[19],\n      height: d[20] << 24 | d[21] << 16 | d[22] << 8 | d[23]\n    };\n  }\n  // JPEG: FF D8 FF\n  if (d[0] === 0xFF && d[1] === 0xD8 && d[2] === 0xFF) {\n    const [width, height] = jpgSize(d);\n    return { mime: 'image/jpeg', width, height };\n  }\n  // GIF: GIF87a or GIF89a\n  if (d32[0] === 0x38464947 && (d[4] === 0x37 || d[4] === 0x39) && d[5] === 0x61) {\n    return {\n      mime: 'image/gif',\n      width:  d[7] << 8 | d[6],\n      height: d[9] << 8 | d[8]\n    };\n  }\n  // QOI: qoif\n  if (d32[0] === 0x66696F71) {\n    return {\n      mime: 'image/qoi',\n      width:  d[4] << 24 | d[5] << 16 | d[6] << 8 | d[7],\n      height: d[8] << 24 | d[9] << 16 | d[10] << 8 | d[11]\n    };\n  }\n  // WEBP: RIFF | xxxx | WEBP | VP8x\n  if (d32[0] === 0x46464952 && d32[2] === 0x50424557 && (d32[3] & 0xFFFFFF) === 0x385056) {\n    switch (d[15]) {\n      case 0x58:  // Extended WebP VP8X --> \"X\"\n        return {\n          mime: 'image/webp',\n          width:  (d[24] | d[25] << 8 | d[26] << 16) + 1,\n          height: (d[27] | d[28] << 8 | d[29] << 16) + 1\n        };\n      case 0x4C:  // Lossless WebP VP8L --> \"L\"\n        if (d[20] !== 0x2f) return UNSUPPORTED_TYPE;\n        const dim = d[21] | d[22] << 8 | d[23] << 16 | d[24] << 24;\n        return {\n          mime: 'image/webp',\n          width:  (dim        & 0x3FFF) + 1,\n          height: (dim >>> 14 & 0x3FFF) + 1\n        };\n      case 0x20:  // Lossy WebP VP8  --> \" \"\n        if (d[23] !== 0x9d || d[24] !== 0x01 || d[25] !== 0x2a) return UNSUPPORTED_TYPE;\n        return {\n          mime: 'image/webp',\n          width:  (d[26] | d[27] << 8) & 0x3FFF,\n          height: (d[28] | d[29] << 8) & 0x3FFF\n        };\n    }\n    return UNSUPPORTED_TYPE;\n  }\n  // AVIF: Box size | ftyp | avif/avis\n  if (d32[1] === 0x70797466 && (d32[2] === 0x66697661 || d32[2] === 0x73697661)) {\n    let pos = -1;\n    // search for ispe box within first 1024 bytes\n    const limit = Math.min(d.length - 16, 1024);\n    for (let i = 8; i < limit; i++) {\n      // scan for ispe\n      if (d[i] === 0x69 && d[i + 1] === 0x73 && d[i + 2] === 0x70 && d[i + 3] === 0x65) {\n        pos = i;\n        break;\n      }\n    }\n    if (pos !== -1) {\n      // dimensions are in BE at +8 (width) at +12 (height)\n      const width =\n        d[pos +  8] << 24 |\n        d[pos +  9] << 16 |\n        d[pos + 10] <<  8 |\n        d[pos + 11];\n      const height =\n        d[pos + 12] << 24 |\n        d[pos + 13] << 16 |\n        d[pos + 14] <<  8 |\n        d[pos + 15];\n      if (width > 0 && height > 0) {\n        return { mime: 'image/avif', width, height };\n      }\n    }\n    return UNSUPPORTED_TYPE;\n  }\n  return UNSUPPORTED_TYPE;\n}\n\n\nfunction jpgSize(d: Uint8Array): [number, number] {\n  const len = d.length;\n  let i = 4;\n  let blockLength = d[i] << 8 | d[i + 1];\n  while (true) {\n    i += blockLength;\n    if (i >= len) {\n      // exhausted without size info\n      return [0, 0];\n    }\n    if (d[i] !== 0xFF) {\n      return [0, 0];\n    }\n    if (d[i + 1] === 0xC0 || d[i + 1] === 0xC2) {\n      if (i + 8 < len) {\n        return [\n          d[i + 7] << 8 | d[i + 8],\n          d[i + 5] << 8 | d[i + 6]\n        ];\n      }\n      return [0, 0];\n    }\n    i += 2;\n    blockLength = d[i] << 8 | d[i + 1];\n  }\n}\n","/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { toRGBA8888 } from 'sixel/lib/Colors';\nimport { IDisposable } from '@xterm/xterm';\nimport { ICellSize, ImageLayer, ITerminalExt, IImageSpec, IRenderDimensions, IRenderService } from './Types';\nimport { Disposable, MutableDisposable, toDisposable } from 'common/Lifecycle';\n\nconst enum Constants {\n  PLACEHOLDER_LENGTH = 4096,\n  PLACEHOLDER_HEIGHT = 24\n}\n\n/**\n * ImageRenderer - terminal frontend extension:\n * - provide primitives for canvas, ImageData, Bitmap (static)\n * - add canvas layer to DOM (browser only for now)\n * - draw image tiles onRender\n */\nexport class ImageRenderer extends Disposable implements IDisposable {\n  /** @deprecated Kept for backward compat — points to top layer canvas. */\n  public get canvas(): HTMLCanvasElement | undefined { return this._layers.get('top')?.canvas; }\n  private _layers = new Map<ImageLayer, CanvasRenderingContext2D>();\n  private _placeholder: HTMLCanvasElement | undefined;\n  private _placeholderBitmap: ImageBitmap | undefined;\n  private _optionsRefresh = this._register(new MutableDisposable());\n  private _oldOpen: ((parent: HTMLElement) => void) | undefined;\n  private _renderService: IRenderService | undefined;\n  private _oldSetRenderer: ((renderer: any) => void) | undefined;\n\n  // drawing primitive - canvas\n  public static createCanvas(localDocument: Document | undefined, width: number, height: number): HTMLCanvasElement {\n    /**\n     * NOTE: We normally dont care, from which document the canvas\n     * gets created, so we can fall back to global document,\n     * if the terminal has no document associated yet.\n     * This way early image loads before calling .open keep working\n     * (still discouraged though, as the metrics will be screwed up).\n     * Only the DOM output canvas should be on the terminal's document,\n     * which gets explicitly checked in `insertLayerToDom`.\n     */\n    const canvas = (localDocument ?? document).createElement('canvas');\n    canvas.width = width | 0;\n    canvas.height = height | 0;\n    return canvas;\n  }\n\n  // drawing primitive - ImageData with optional buffer\n  public static createImageData(ctx: CanvasRenderingContext2D, width: number, height: number, buffer?: ArrayBuffer): ImageData {\n    if (typeof ImageData !== 'function') {\n      const imgData = ctx.createImageData(width, height);\n      if (buffer) {\n        imgData.data.set(new Uint8ClampedArray(buffer, 0, width * height * 4));\n      }\n      return imgData;\n    }\n    return buffer\n      ? new ImageData(new Uint8ClampedArray(buffer, 0, width * height * 4), width, height)\n      : new ImageData(width, height);\n  }\n\n  // drawing primitive - ImageBitmap\n  public static createImageBitmap(img: ImageBitmapSource): Promise<ImageBitmap | undefined> {\n    if (typeof createImageBitmap !== 'function') {\n      return Promise.resolve(undefined);\n    }\n    return createImageBitmap(img);\n  }\n\n\n  constructor(private _terminal: ITerminalExt) {\n    super();\n    this._oldOpen = this._terminal._core.open;\n    this._terminal._core.open = (parent: HTMLElement): void => {\n      this._oldOpen?.call(this._terminal._core, parent);\n      this._open();\n    };\n    if (this._terminal._core.screenElement) {\n      this._open();\n    }\n    // hack to spot fontSize changes\n    this._optionsRefresh.value = this._terminal._core.optionsService.onOptionChange(option => {\n      if (option === 'fontSize') {\n        this.rescaleCanvas();\n        this._renderService?.refreshRows(0, this._terminal.rows);\n      }\n    });\n    this._register(toDisposable(() => {\n      this.removeLayerFromDom();\n      this.removeLayerFromDom('bottom');\n      if (this._terminal._core && this._oldOpen) {\n        this._terminal._core.open = this._oldOpen;\n        this._oldOpen = undefined;\n      }\n      if (this._renderService && this._oldSetRenderer) {\n        this._renderService.setRenderer = this._oldSetRenderer;\n        this._oldSetRenderer = undefined;\n      }\n      this._renderService = undefined;\n      this._layers.clear();\n      this._placeholderBitmap?.close();\n      this._placeholderBitmap = undefined;\n      this._placeholder = undefined;\n    }));\n  }\n\n  /**\n   * Enable the placeholder.\n   */\n  public showPlaceholder(value: boolean): void {\n    if (value) {\n      if (!this._placeholder && this.cellSize.height !== -1) {\n        this._createPlaceHolder(Math.max(this.cellSize.height + 1, Constants.PLACEHOLDER_HEIGHT));\n      }\n    } else {\n      this._placeholderBitmap?.close();\n      this._placeholderBitmap = undefined;\n      this._placeholder = undefined;\n    }\n    this._renderService?.refreshRows(0, this._terminal.rows);\n  }\n\n  /**\n   * Dimensions of the terminal.\n   * Forwarded from internal render service.\n   */\n  public get dimensions(): IRenderDimensions | undefined {\n    return this._terminal.dimensions;\n  }\n\n  /**\n   * Current cell size (float).\n   */\n  public get cellSize(): ICellSize {\n    return {\n      width: this.dimensions?.css.cell.width || -1,\n      height: this.dimensions?.css.cell.height || -1\n    };\n  }\n\n  /**\n   * Clear a region of the image layer canvas.\n   */\n  public clearLines(start: number, end: number, layer?: ImageLayer): void {\n    const y = start * (this.dimensions?.css.cell.height || 0);\n    const w = this.dimensions?.css.canvas.width || 0;\n    const h = (end + 1 - start) * (this.dimensions?.css.cell.height || 0);\n    if (!layer || layer === 'top') {\n      this._layers.get('top')?.clearRect(0, y, w, h);\n    }\n    if (!layer || layer === 'bottom') {\n      this._layers.get('bottom')?.clearRect(0, y, w, h);\n    }\n  }\n\n  /**\n   * Clear whole image canvas.\n   */\n  public clearAll(layer?: ImageLayer): void {\n    if (!layer || layer === 'top') {\n      const ctx = this._layers.get('top');\n      ctx?.clearRect(0, 0, ctx.canvas.width, ctx.canvas.height);\n    }\n    if (!layer || layer === 'bottom') {\n      const ctx = this._layers.get('bottom');\n      ctx?.clearRect(0, 0, ctx.canvas.width, ctx.canvas.height);\n    }\n  }\n\n  /**\n   * Draw neighboring tiles on the image layer canvas.\n   */\n  public draw(imgSpec: IImageSpec, tileId: number, col: number, row: number, count: number = 1): void {\n    const ctx = this._layers.get(imgSpec.layer);\n    if (!ctx) {\n      return;\n    }\n    const { width, height } = this.cellSize;\n\n    // Don't try to draw anything, if we cannot get valid renderer metrics.\n    if (width === -1 || height === -1) {\n      return;\n    }\n\n    this._rescaleImage(imgSpec, width, height);\n    const img = imgSpec.actual!;\n    const { width: sourceWidth, height: sourceHeight } = imgSpec.actualCellSize;\n    const cols = Math.ceil(img.width / sourceWidth);\n\n    const sx = (tileId % cols) * sourceWidth;\n    const sy = Math.floor(tileId / cols) * sourceHeight;\n    const dx = col * width;\n    const dy = row * height;\n\n    // safari bug: never access image source out of bounds\n    const finalWidth = count * sourceWidth + sx > img.width ? img.width - sx : count * sourceWidth;\n    const finalHeight = sy + sourceHeight > img.height ? img.height - sy : sourceHeight;\n\n    // Floor all pixel offsets to get stable tile mapping without any overflows.\n    // Note: For not pixel perfect aligned cells like in the DOM renderer\n    // this will move a tile slightly to the top/left (subpixel range, thus ignore it).\n    // FIX #34: avoid striping on displays with pixelDeviceRatio != 1 by ceiling height and width\n    ctx.drawImage(\n      img,\n      Math.floor(sx), Math.floor(sy), Math.ceil(finalWidth), Math.ceil(finalHeight),\n      Math.floor(dx), Math.floor(dy), Math.ceil(finalWidth * width / sourceWidth), Math.ceil(finalHeight * height / sourceHeight)\n    );\n  }\n\n  /**\n   * Extract a single tile from an image.\n   */\n  public extractTile(imgSpec: IImageSpec, tileId: number): HTMLCanvasElement | undefined {\n    const { width, height } = this.cellSize;\n    // Don't try to draw anything, if we cannot get valid renderer metrics.\n    if (width === -1 || height === -1) {\n      return;\n    }\n    this._rescaleImage(imgSpec, width, height);\n    const img = imgSpec.actual!;\n    const { width: sourceWidth, height: sourceHeight } = imgSpec.actualCellSize;\n    const cols = Math.ceil(img.width / sourceWidth);\n    const sx = (tileId % cols) * sourceWidth;\n    const sy = Math.floor(tileId / cols) * sourceHeight;\n    const finalWidth = sourceWidth + sx > img.width ? img.width - sx : sourceWidth;\n    const finalHeight = sy + sourceHeight > img.height ? img.height - sy : sourceHeight;\n\n    const canvas = ImageRenderer.createCanvas(this.document, Math.ceil(finalWidth * width / sourceWidth), Math.ceil(finalHeight * height / sourceHeight));\n    const ctx = canvas.getContext('2d');\n    if (ctx) {\n      ctx.drawImage(\n        img,\n        Math.floor(sx), Math.floor(sy), Math.floor(finalWidth), Math.floor(finalHeight),\n        0, 0, canvas.width, canvas.height\n      );\n      return canvas;\n    }\n  }\n\n  /**\n   * Draw a line with placeholder on the image layer canvas.\n   */\n  public drawPlaceholder(col: number, row: number, count: number = 1): void {\n    const ctx = this._layers.get('top');\n    if (ctx) {\n      const { width, height } = this.cellSize;\n\n      // Don't try to draw anything, if we cannot get valid renderer metrics.\n      if (width === -1 || height === -1) {\n        return;\n      }\n\n      if (!this._placeholder) {\n        this._createPlaceHolder(Math.max(height + 1, Constants.PLACEHOLDER_HEIGHT));\n      } else if (height >= this._placeholder!.height) {\n        this._createPlaceHolder(height + 1);\n      }\n      if (!this._placeholder) return;\n      ctx.drawImage(\n        this._placeholderBitmap ?? this._placeholder!,\n        col * width,\n        (row * height) % 2 ? 0 : 1,  // needs %2 offset correction\n        width * count,\n        height,\n        col * width,\n        row * height,\n        width * count,\n        height\n      );\n    }\n  }\n\n  /**\n   * Rescale image layer canvas if needed.\n   * Checked once from `ImageStorage.render`.\n   */\n  public rescaleCanvas(): void {\n    const w = this.dimensions?.css.canvas.width || 0;\n    const h = this.dimensions?.css.canvas.height || 0;\n    for (const ctx of this._layers.values()) {\n      if (ctx.canvas.width !== w || ctx.canvas.height !== h) {\n        ctx.canvas.width = w;\n        ctx.canvas.height = h;\n      }\n    }\n  }\n\n  /**\n   * Rescale image in storage if needed.\n   */\n  private _rescaleImage(spec: IImageSpec, currentWidth: number, currentHeight: number): void {\n    if (currentWidth === spec.actualCellSize.width && currentHeight === spec.actualCellSize.height) {\n      return;\n    }\n    const { width: originalWidth, height: originalHeight } = spec.origCellSize;\n    if (currentWidth === originalWidth && currentHeight === originalHeight) {\n      spec.actual = spec.orig;\n      spec.actualCellSize.width = originalWidth;\n      spec.actualCellSize.height = originalHeight;\n      return;\n    }\n    const scaledWidth = Math.ceil(spec.orig!.width * currentWidth / originalWidth);\n    const scaledHeight = Math.ceil(spec.orig!.height * currentHeight / originalHeight);\n    // Upscale visible tiles directly; a full zoomed copy can dwarf the image budget.\n    if (scaledWidth * scaledHeight > spec.orig!.width * spec.orig!.height) {\n      spec.actual = spec.orig;\n      spec.actualCellSize.width = originalWidth;\n      spec.actualCellSize.height = originalHeight;\n      return;\n    }\n    const canvas = ImageRenderer.createCanvas(this.document, scaledWidth, scaledHeight);\n    const ctx = canvas.getContext('2d');\n    if (ctx) {\n      ctx.drawImage(spec.orig!, 0, 0, canvas.width, canvas.height);\n      spec.actual = canvas;\n      spec.actualCellSize.width = currentWidth;\n      spec.actualCellSize.height = currentHeight;\n    }\n  }\n\n  /**\n   * Lazy init for the renderer.\n   */\n  private _open(): void {\n    this._renderService = this._terminal._core._renderService;\n    this._oldSetRenderer = this._renderService.setRenderer.bind(this._renderService);\n    this._renderService.setRenderer = (renderer: any) => {\n      for (const key of [...this._layers.keys()]) {\n        this.removeLayerFromDom(key);\n      }\n      this._oldSetRenderer?.call(this._renderService, renderer);\n    };\n  }\n\n  public insertLayerToDom(layer: ImageLayer = 'top'): void {\n    // make sure that the terminal is attached to a document and to DOM\n    if (!this.document || !this._terminal._core.screenElement) {\n      console.warn('image addon: cannot insert output canvas to DOM, missing document or screenElement');\n      return;\n    }\n    if (this._layers.has(layer)) {\n      return;\n    }\n    const canvas = ImageRenderer.createCanvas(\n      this.document, this.dimensions?.css.canvas.width || 0,\n      this.dimensions?.css.canvas.height || 0\n    );\n    canvas.classList.add(`xterm-image-layer-${layer}`);\n    const screenElement = this._terminal._core.screenElement;\n    // Use isolation to create a stacking context without overriding z-index,\n    // which would conflict with integrators (e.g. VS Code) that set their\n    // own z-index on the screen element.\n    screenElement.style.isolation = 'isolate';\n    if (layer === 'bottom') {\n      // Use z-index:-1 so it paints behind non-positioned text elements.\n      // The screen element needs to be a stacking context (via isolation)\n      // to contain the negative z-index, otherwise it would go behind the\n      // entire terminal.\n      canvas.style.zIndex = '-1';\n      screenElement.insertBefore(canvas, screenElement.firstChild);\n    } else {\n      // Explicit z-index ensures the image canvas reliably stacks above\n      // the text layer (DOM renderer rows). z-index: 0 is below the\n      // selection overlay (z-index: 1).\n      canvas.style.zIndex = '0';\n      screenElement.appendChild(canvas);\n    }\n    const ctx = canvas.getContext('2d', { alpha: true });\n    if (!ctx) {\n      canvas.remove();\n      return;\n    }\n    this._layers.set(layer, ctx);\n    this.clearAll(layer);\n  }\n\n  public removeLayerFromDom(layer: ImageLayer = 'top'): void {\n    const ctx = this._layers.get(layer);\n    if (ctx) {\n      ctx.canvas.remove();\n      this._layers.delete(layer);\n    }\n  }\n\n  public hasLayer(layer: ImageLayer): boolean {\n    return this._layers.has(layer);\n  }\n\n  private _createPlaceHolder(height: number = Constants.PLACEHOLDER_HEIGHT): void {\n    this._placeholderBitmap?.close();\n    this._placeholderBitmap = undefined;\n\n    // create blueprint to fill placeholder with\n    const bWidth = 32;  // must be 2^n\n    const blueprint = ImageRenderer.createCanvas(this.document, bWidth, height);\n    const ctx = blueprint.getContext('2d', { alpha: false });\n    if (!ctx) return;\n    const imgData = ImageRenderer.createImageData(ctx, bWidth, height);\n    const d32 = new Uint32Array(imgData.data.buffer);\n    const black = toRGBA8888(0, 0, 0);\n    const white = toRGBA8888(255, 255, 255);\n    d32.fill(black);\n    for (let y = 0; y < height; ++y) {\n      const shift = y % 2;\n      const offset = y * bWidth;\n      for (let x = 0; x < bWidth; x += 2) {\n        d32[offset + x + shift] = white;\n      }\n    }\n    ctx.putImageData(imgData, 0, 0);\n\n    // create placeholder line, width aligned to blueprint width\n    const width = (screen.width + bWidth - 1) & ~(bWidth - 1) || Constants.PLACEHOLDER_LENGTH;\n    this._placeholder = ImageRenderer.createCanvas(this.document, width, height);\n    const ctx2 = this._placeholder.getContext('2d', { alpha: false });\n    if (!ctx2) {\n      this._placeholder = undefined;\n      return;\n    }\n    for (let i = 0; i < width; i += bWidth) {\n      ctx2.drawImage(blueprint, i, 0);\n    }\n    const placeholder = this._placeholder;\n    ImageRenderer.createImageBitmap(placeholder).then(bitmap => {\n      if (this._placeholder !== placeholder) bitmap?.close();\n      else this._placeholderBitmap = bitmap;\n    }).catch(() => {});\n  }\n\n  public get document(): Document | undefined {\n    return this._terminal._core._coreBrowserService?.window.document;\n  }\n}\n","/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IDisposable } from '@xterm/xterm';\nimport { ImageRenderer } from './ImageRenderer';\nimport {\n  ITerminalExt, IExtendedAttrsImage, IImageAddonOptions, IImageSpec,\n  IBufferLineExt, BgFlags, Cell, Content, ICellSize, ExtFlags, Attributes,\n  UnderlineStyle, IAddImageOpts\n} from './Types';\n\n\n// fallback default cell size\nexport const CELL_SIZE_DEFAULT: ICellSize = {\n  width: 7,\n  height: 14\n};\n\n/**\n * Extend extended attribute to also hold image tile information.\n *\n * Object definition is copied from base repo to fully mimick its behavior.\n * Image data is added as additional public properties `imageId` and `tileId`.\n */\nclass ExtendedAttrsImage implements IExtendedAttrsImage {\n  private _ext: number = 0;\n  public get ext(): number {\n    if (this._urlId) {\n      return (\n        (this._ext & ~ExtFlags.UNDERLINE_STYLE) |\n        (this.underlineStyle << 26)\n      );\n    }\n    return this._ext;\n  }\n  public set ext(value: number) { this._ext = value; }\n\n  public get underlineStyle(): UnderlineStyle {\n    // Always return the URL style if it has one\n    if (this._urlId) {\n      return UnderlineStyle.DASHED;\n    }\n    return (this._ext & ExtFlags.UNDERLINE_STYLE) >> 26;\n  }\n  public set underlineStyle(value: UnderlineStyle) {\n    this._ext &= ~ExtFlags.UNDERLINE_STYLE;\n    this._ext |= (value << 26) & ExtFlags.UNDERLINE_STYLE;\n  }\n\n  public get underlineColor(): number {\n    return this._ext & (Attributes.CM_MASK | Attributes.RGB_MASK);\n  }\n  public set underlineColor(value: number) {\n    this._ext &= ~(Attributes.CM_MASK | Attributes.RGB_MASK);\n    this._ext |= value & (Attributes.CM_MASK | Attributes.RGB_MASK);\n  }\n\n  public get underlineVariantOffset(): number {\n    const val = (this._ext & ExtFlags.VARIANT_OFFSET) >> 29;\n    if (val < 0) {\n      return val ^ 0xFFFFFFF8;\n    }\n    return val;\n  }\n  public set underlineVariantOffset(value: number) {\n    this._ext &= ~ExtFlags.VARIANT_OFFSET;\n    this._ext |= (value << 29) & ExtFlags.VARIANT_OFFSET;\n  }\n\n  private _urlId: number = 0;\n  public get urlId(): number {\n    return this._urlId;\n  }\n  public set urlId(value: number) {\n    this._urlId = value;\n  }\n\n  constructor(\n    ext: number = 0,\n    urlId: number = 0,\n    public imageId = -1,\n    public tileId = -1\n  ) {\n    this._ext = ext;\n    this._urlId = urlId;\n  }\n\n  public clone(): IExtendedAttrsImage {\n    /**\n     * Technically we dont need a clone variant of ExtendedAttrsImage,\n     * as we never clone a cell holding image data.\n     * Note: Clone is only meant to be used by the InputHandler for\n     * sticky attributes, which is never the case for image data.\n     * We still provide a proper clone method to reflect the full ext attr\n     * state in case there are future use cases for clone.\n     */\n    return new ExtendedAttrsImage(this._ext, this._urlId, this.imageId, this.tileId);\n  }\n\n  public isEmpty(): boolean {\n    return this.underlineStyle === UnderlineStyle.NONE && this._urlId === 0 && this.imageId === -1;\n  }\n}\nconst EMPTY_ATTRS = new ExtendedAttrsImage();\n\n\n/**\n * ImageStorage - extension of CoreTerminal:\n * - hold image data\n * - write/read image data to/from buffer\n *\n * TODO: image composition for overwrites\n */\nexport class ImageStorage implements IDisposable {\n  // storage\n  private _images: Map<number, IImageSpec> = new Map();\n  // last used id\n  private _lastId = 0;\n  // last evicted id\n  private _lowestId = 0;\n  // whether a full clear happened before\n  private _fullyCleared = false;\n  // whether render should do a full clear\n  private _needsFullClear = false;\n  // hard limit of stored pixels (fallback limit of 10 MB)\n  private _pixelLimit: number = 2500000;\n\n  private _viewportMetrics: { cols: number, rows: number };\n  public onImageAdded: (() => void) | undefined;\n  public onImageDeleted: ((storageId: number) => void) | undefined;\n\n  constructor(\n    private _terminal: ITerminalExt,\n    private _renderer: ImageRenderer,\n    private _opts: IImageAddonOptions\n  ) {\n    try {\n      this.setLimit(this._opts.storageLimit);\n    } catch (e: unknown) {\n      if (e instanceof Error) {\n        console.error(e.message);\n      }\n      console.warn(`storageLimit is set to ${this.getLimit()} MB`);\n    }\n    this._viewportMetrics = {\n      cols: this._terminal.cols,\n      rows: this._terminal.rows\n    };\n  }\n\n  public dispose(): void {\n    this.reset();\n  }\n\n  public reset(): void {\n    for (const spec of this._images.values()) {\n      spec.marker?.dispose();\n    }\n    // NOTE: marker.dispose above already calls ImageBitmap.close\n    // therefore we can just wipe the map here\n    this._images.clear();\n    this._renderer.clearAll();\n  }\n\n  public getLimit(): number {\n    return this._pixelLimit * 4 / 1000000;\n  }\n\n  public setLimit(value: number): void {\n    if (value < 0.5 || value > 1000) {\n      throw RangeError('invalid storageLimit, should be at least 0.5 MB and not exceed 1G');\n    }\n    this._pixelLimit = (value / 4 * 1000000) >>> 0;\n    this._evictOldest(0);\n  }\n\n  public getUsage(): number {\n    return this._getStoredPixels() * 4 / 1000000;\n  }\n\n  private _getStoredPixels(): number {\n    let storedPixels = 0;\n    for (const spec of this._images.values()) {\n      if (spec.orig) {\n        storedPixels += spec.orig.width * spec.orig.height;\n        if (spec.actual && spec.actual !== spec.orig) {\n          storedPixels += spec.actual.width * spec.actual.height;\n        }\n      }\n    }\n    return storedPixels;\n  }\n\n  private _delImg(id: number): void {\n    const spec = this._images.get(id);\n    if (!spec) return;\n    this._images.delete(id);\n    // FIXME: really ugly workaround to get bitmaps deallocated :(\n    if (window.ImageBitmap && spec.orig instanceof ImageBitmap) {\n      spec.orig.close();\n    }\n    this.onImageDeleted?.(id);\n  }\n\n  /**\n   * Wipe canvas and images on alternate buffer.\n   */\n  public wipeAlternate(): void {\n    // remove all alternate tagged images\n    const zero = [];\n    for (const [id, spec] of this._images.entries()) {\n      if (spec.bufferType === 'alternate') {\n        spec.marker?.dispose();\n        zero.push(id);\n      }\n    }\n    for (const id of zero) {\n      this._delImg(id);\n    }\n    // mark canvas to be wiped on next render\n    this._needsFullClear = true;\n    this._fullyCleared = false;\n  }\n\n  /**\n   * Delete an image by its internal storage ID.\n   * Used by protocols that support explicit deletion (e.g. Kitty a=d).\n   */\n  public deleteImage(id: number): void {\n    const spec = this._images.get(id);\n    if (spec) {\n      spec.marker?.dispose();\n      this._delImg(id);\n    }\n  }\n\n  /**\n   * Method to add an image to the storage.\n   * @param img - The image to add (canvas or bitmap).\n   * @param opts - Options for addImage:\n   *   - scrolling:  When true, cursor advances with the image.\n   *                 When false, image is placed at ORIGIN and cursor does not move.\n   *   - layer:      Which canvas layer to render on ('top' or 'bottom').\n   *   - zIndex:     Z-index for image layering within the same layer.\n   *   - cursorPos:  'vt340' for bottom-left, 'iip' for bottom.right.\n   * @returns The internal image ID assigned to the stored image.\n   */\n  public addImage(img: HTMLCanvasElement | ImageBitmap, opts: IAddImageOpts): number {\n    // never allow storage to exceed memory limit\n    this._evictOldest(img.width * img.height);\n\n    // calc rows x cols needed to display the image\n    let cellSize = this._renderer.cellSize;\n    if (cellSize.width === -1 || cellSize.height === -1) {\n      cellSize = CELL_SIZE_DEFAULT;\n    }\n    const cols = Math.ceil(img.width / cellSize.width);\n    const rows = Math.ceil(img.height / cellSize.height);\n\n    const imageId = ++this._lastId;\n\n    const buffer = this._terminal._core.buffer;\n    const termCols = this._terminal.cols;\n    const termRows = this._terminal.rows;\n    const originX = buffer.x;\n    const originY = buffer.y;\n    let offset = originX;\n    let tileCount = 0;\n\n    if (!opts.scrolling) {\n      buffer.x = 0;\n      buffer.y = 0;\n      offset = 0;\n    }\n\n    this._terminal._core._inputHandler._dirtyRowTracker.markDirty(buffer.y);\n    for (let row = 0; row < rows; ++row) {\n      const line = buffer.lines.get(buffer.y + buffer.ybase);\n      for (let col = 0; col < cols; ++col) {\n        if (offset + col >= termCols) break;\n        this._writeToCell(line as IBufferLineExt, offset + col, imageId, row * cols + col);\n        tileCount++;\n      }\n      if (opts.scrolling) {\n        if (row < rows - 1) this._terminal._core._inputHandler.lineFeed();\n      } else {\n        if (++buffer.y >= termRows) break;\n      }\n      buffer.x = offset;\n    }\n    this._terminal._core._inputHandler._dirtyRowTracker.markDirty(buffer.y);\n\n    // cursor positioning modes\n    if (opts.scrolling) {\n      if (opts.cursorPos === 'iip') {\n        buffer.x = Math.min(offset + cols, termCols);\n      } else {\n        buffer.x = offset;\n      }\n    } else {\n      buffer.x = originX;\n      buffer.y = originY;\n    }\n\n    // deleted images with zero tile count\n    const zero = [];\n    for (const [id, spec] of this._images.entries()) {\n      if (spec.tileCount < 1) {\n        spec.marker?.dispose();\n        zero.push(id);\n      }\n    }\n    for (const id of zero) {\n      this._delImg(id);\n    }\n\n    // eviction marker:\n    // delete the image when the marker gets disposed\n    const endMarker = this._terminal.registerMarker(0);\n    endMarker?.onDispose(() => {\n      const spec = this._images.get(imageId);\n      if (spec) {\n        this._delImg(imageId);\n      }\n    });\n\n    // since markers do not work on alternate for some reason,\n    // we evict images here manually\n    if (this._terminal.buffer.active.type === 'alternate') {\n      this._evictOnAlternate();\n    }\n\n    // create storage entry\n    const imgSpec: IImageSpec = {\n      orig: img,\n      origCellSize: cellSize,\n      actual: img,\n      actualCellSize: { ...cellSize },  // clone needed, since later modified\n      marker: endMarker || undefined,\n      tileCount,\n      bufferType: this._terminal.buffer.active.type,\n      layer: opts.layer,\n      zIndex: opts.zIndex\n    };\n\n    // finally add the image\n    this._images.set(imageId, imgSpec);\n    this.onImageAdded?.();\n    return imageId;\n  }\n\n\n  /**\n   * Render method. Collects buffer information and triggers\n   * canvas updates.\n   */\n  // TODO: Should we move this to the ImageRenderer?\n  public render(range: { start: number, end: number }): void {\n    // Determine which layers have images\n    let hasTopImages = false;\n    let hasBottomImages = false;\n    for (const spec of this._images.values()) {\n      if (spec.layer === 'bottom') {\n        hasBottomImages = true;\n      } else {\n        hasTopImages = true;\n      }\n      if (hasTopImages && hasBottomImages) break;\n    }\n\n    // Lazily insert layers that are needed\n    if (hasTopImages && !this._renderer.hasLayer('top')) {\n      this._renderer.insertLayerToDom('top');\n      if (!this._renderer.hasLayer('top')) return;\n    }\n    if (hasBottomImages && !this._renderer.hasLayer('bottom')) {\n      this._renderer.insertLayerToDom('bottom');\n    }\n\n    // rescale if needed\n    this._renderer.rescaleCanvas();\n\n    // exit early if we dont have any images to test for\n    if (!this._images.size) {\n      if (!this._fullyCleared) {\n        this._renderer.clearAll();\n        this._fullyCleared = true;\n        this._needsFullClear = false;\n      }\n      if (this._renderer.hasLayer('top')) {\n        this._renderer.removeLayerFromDom('top');\n      }\n      if (this._renderer.hasLayer('bottom')) {\n        this._renderer.removeLayerFromDom('bottom');\n      }\n      return;\n    }\n\n    // Remove layers no longer needed\n    if (!hasTopImages && this._renderer.hasLayer('top')) {\n      this._renderer.clearAll('top');\n      this._renderer.removeLayerFromDom('top');\n    }\n    if (!hasBottomImages && this._renderer.hasLayer('bottom')) {\n      this._renderer.clearAll('bottom');\n      this._renderer.removeLayerFromDom('bottom');\n    }\n\n    // buffer switches force a full clear\n    if (this._needsFullClear) {\n      this._renderer.clearAll();\n      this._fullyCleared = true;\n      this._needsFullClear = false;\n    }\n\n    const { start, end } = range;\n    const buffer = this._terminal._core.buffer;\n    const cols = this._terminal._core.cols;\n\n    // clear drawing area\n    this._renderer.clearLines(start, end);\n\n    // Collect draw calls so we can sort by z-index (lower z drawn first).\n    const drawCalls: { imgSpec: IImageSpec, tileId: number, col: number, row: number, count: number }[] = [];\n    const placeholderCalls: { col: number, row: number, count: number }[] = [];\n\n    // walk all cells in viewport and collect tiles found\n    for (let row = start; row <= end; ++row) {\n      const line = buffer.lines.get(row + buffer.ydisp) as IBufferLineExt;\n      if (!line) return;\n      for (let col = 0; col < cols; ++col) {\n        if (line.getBg(col) & BgFlags.HAS_EXTENDED) {\n          let e: IExtendedAttrsImage = line._extendedAttrs[col] ?? EMPTY_ATTRS;\n          const imageId = e.imageId;\n          if (imageId === undefined || imageId === -1) {\n            continue;\n          }\n          const imgSpec = this._images.get(imageId);\n          if (e.tileId !== -1) {\n            const startTile = e.tileId;\n            const startCol = col;\n            let count = 1;\n            /**\n             * merge tiles to the right into a single draw call, if:\n             * - not at end of line\n             * - cell has same image id\n             * - cell has consecutive tile id\n             */\n            while (\n              ++col < cols\n              && (line.getBg(col) & BgFlags.HAS_EXTENDED)\n              && (e = line._extendedAttrs[col] ?? EMPTY_ATTRS)\n              && (e.imageId === imageId)\n              && (e.tileId === startTile + count)\n            ) {\n              count++;\n            }\n            col--;\n            if (imgSpec) {\n              if (imgSpec.actual) {\n                drawCalls.push({ imgSpec, tileId: startTile, col: startCol, row, count });\n              }\n            } else if (this._opts.showPlaceholder) {\n              placeholderCalls.push({ col: startCol, row, count });\n            }\n            this._fullyCleared = false;\n          }\n        }\n      }\n    }\n\n    // Sort by z-index so lower z draws first (higher z renders on top)\n    drawCalls.sort((a, b) => a.imgSpec.zIndex - b.imgSpec.zIndex);\n\n    // Draw placeholders first (lowest priority)\n    for (const call of placeholderCalls) {\n      this._renderer.drawPlaceholder(call.col, call.row, call.count);\n    }\n\n    // Draw images in z-index order\n    for (const call of drawCalls) {\n      this._renderer.draw(call.imgSpec, call.tileId, call.col, call.row, call.count);\n    }\n  }\n\n  public viewportResize(metrics: { cols: number, rows: number }): void {\n    // exit early if we have nothing in storage\n    if (!this._images.size) {\n      this._viewportMetrics = metrics;\n      return;\n    }\n\n    // handle only viewport width enlargements, exit all other cases\n    // TODO: needs patch for tile counter\n    if (this._viewportMetrics.cols >= metrics.cols) {\n      this._viewportMetrics = metrics;\n      return;\n    }\n\n    // walk scrollbuffer at old col width to find all possible expansion matches\n    const buffer = this._terminal._core.buffer;\n    const rows = buffer.lines.length;\n    const oldCol = this._viewportMetrics.cols - 1;\n    for (let row = 0; row < rows; ++row) {\n      const line = buffer.lines.get(row) as IBufferLineExt;\n      if (line.getBg(oldCol) & BgFlags.HAS_EXTENDED) {\n        const e: IExtendedAttrsImage = line._extendedAttrs[oldCol] ?? EMPTY_ATTRS;\n        const imageId = e.imageId;\n        if (imageId === undefined || imageId === -1) {\n          continue;\n        }\n        const imgSpec = this._images.get(imageId);\n        if (!imgSpec) {\n          continue;\n        }\n        // found an image tile at oldCol, check if it qualifies for right exapansion\n        const tilesPerRow = Math.ceil((imgSpec.actual?.width || 0) / imgSpec.actualCellSize.width);\n        if ((e.tileId % tilesPerRow) + 1 >= tilesPerRow) {\n          continue;\n        }\n        // expand only if right side is empty (nothing got wrapped from below)\n        let hasData = false;\n        for (let rightCol = oldCol + 1; rightCol > metrics.cols; ++rightCol) {\n          if (line._data[rightCol * Cell.SIZE + Cell.CONTENT] & Content.HAS_CONTENT_MASK) {\n            hasData = true;\n            break;\n          }\n        }\n        if (hasData) {\n          continue;\n        }\n        // do right expansion on terminal buffer\n        const end = Math.min(metrics.cols, tilesPerRow - (e.tileId % tilesPerRow) + oldCol);\n        let lastTile = e.tileId;\n        for (let expandCol = oldCol + 1; expandCol < end; ++expandCol) {\n          this._writeToCell(line as IBufferLineExt, expandCol, imageId, ++lastTile);\n          imgSpec.tileCount++;\n        }\n      }\n    }\n    // store new viewport metrics\n    this._viewportMetrics = metrics;\n  }\n\n  /**\n   * Retrieve original canvas at buffer position.\n   */\n  public getImageAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    const buffer = this._terminal._core.buffer;\n    const line = buffer.lines.get(y) as IBufferLineExt;\n    if (line && line.getBg(x) & BgFlags.HAS_EXTENDED) {\n      const e: IExtendedAttrsImage = line._extendedAttrs[x] ?? EMPTY_ATTRS;\n      if (e.imageId && e.imageId !== -1) {\n        const orig = this._images.get(e.imageId)?.orig;\n        if (window.ImageBitmap && orig instanceof ImageBitmap) {\n          const canvas = ImageRenderer.createCanvas(window.document, orig.width, orig.height);\n          canvas.getContext('2d')?.drawImage(orig, 0, 0, orig.width, orig.height);\n          return canvas;\n        }\n        return orig as HTMLCanvasElement;\n      }\n    }\n  }\n\n  /**\n   * Extract active single tile at buffer position.\n   */\n  public extractTileAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    const buffer = this._terminal._core.buffer;\n    const line = buffer.lines.get(y) as IBufferLineExt;\n    if (line && line.getBg(x) & BgFlags.HAS_EXTENDED) {\n      const e: IExtendedAttrsImage = line._extendedAttrs[x] ?? EMPTY_ATTRS;\n      if (e.imageId && e.imageId !== -1 && e.tileId !== -1) {\n        const spec = this._images.get(e.imageId);\n        if (spec) {\n          return this._renderer.extractTile(spec, e.tileId);\n        }\n      }\n    }\n  }\n\n  // TODO: Do we need some blob offloading tricks here to avoid early eviction?\n  // also see https://stackoverflow.com/questions/28307789/is-there-any-limitation-on-javascript-max-blob-size\n  private _evictOldest(room: number): number {\n    const used = this._getStoredPixels();\n    let current = used;\n    while (this._pixelLimit < current + room && this._images.size) {\n      const spec = this._images.get(++this._lowestId);\n      if (spec && spec.orig) {\n        current -= spec.orig.width * spec.orig.height;\n        if (spec.actual && spec.orig !== spec.actual) {\n          current -= spec.actual.width * spec.actual.height;\n        }\n        spec.marker?.dispose();\n        this._delImg(this._lowestId);\n      }\n    }\n    return used - current;\n  }\n\n  private _writeToCell(line: IBufferLineExt, x: number, imageId: number, tileId: number): void {\n    if (line._data[x * Cell.SIZE + Cell.BG] & BgFlags.HAS_EXTENDED) {\n      const old = line._extendedAttrs[x];\n      if (old) {\n        if (old.imageId !== undefined) {\n          // found an old ExtendedAttrsImage, since we know that\n          // they are always isolated instances (single cell usage),\n          // we can re-use it and just update their id entries\n          const oldSpec = this._images.get(old.imageId);\n          if (oldSpec) {\n            // early eviction for in-viewport overwrites\n            oldSpec.tileCount--;\n          }\n          old.imageId = imageId;\n          old.tileId = tileId;\n          return;\n        }\n        // found a plain ExtendedAttrs instance, clone it to new entry\n        line._extendedAttrs[x] = new ExtendedAttrsImage(old.ext, old.urlId, imageId, tileId);\n        return;\n      }\n    }\n    // fall-through: always create new ExtendedAttrsImage entry\n    line._data[x * Cell.SIZE + Cell.BG] |= BgFlags.HAS_EXTENDED;\n    line._extendedAttrs[x] = new ExtendedAttrsImage(0, 0, imageId, tileId);\n  }\n\n  private _evictOnAlternate(): void {\n    // nullify tile count of all images on alternate buffer\n    for (const spec of this._images.values()) {\n      if (spec.bufferType === 'alternate') {\n        spec.tileCount = 0;\n      }\n    }\n    // re-count tiles on whole buffer\n    const buffer = this._terminal._core.buffer;\n    for (let y = 0; y < this._terminal.rows; ++y) {\n      const line = buffer.lines.get(y) as IBufferLineExt;\n      if (!line) {\n        continue;\n      }\n      for (let x = 0; x < this._terminal.cols; ++x) {\n        if (line._data[x * Cell.SIZE + Cell.BG] & BgFlags.HAS_EXTENDED) {\n          const imgId = line._extendedAttrs[x]?.imageId;\n          if (imgId) {\n            const spec = this._images.get(imgId);\n            if (spec) {\n              spec.tileCount++;\n            }\n          }\n        }\n      }\n    }\n    // deleted images with zero tile count\n    const zero = [];\n    for (const [id, spec] of this._images.entries()) {\n      if (spec.bufferType === 'alternate' && !spec.tileCount) {\n        spec.marker?.dispose();\n        zero.push(id);\n      }\n    }\n    for (const id of zero) {\n      this._delImg(id);\n    }\n  }\n}\n","/**\n * Copyright (c) 2020, 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { SixelImageStorage } from './SixelImageStorage';\nimport { IDcsHandler, IParams, IImageAddonOptions, ITerminalExt, AttributeData, IResetHandler, ReadonlyColorSet } from './Types';\nimport { toRGBA8888, BIG_ENDIAN, PALETTE_ANSI_256, PALETTE_VT340_COLOR } from 'sixel/lib/Colors';\nimport { RGBA8888 } from 'sixel/lib/Types';\nimport { ImageRenderer } from './ImageRenderer';\n\nimport { DecoderAsync, Decoder } from 'sixel/lib/Decoder';\nimport { LIMITS } from 'sixel/lib/wasm';\n\n// always free decoder ressources after decoding if it exceeds this limit\nconst MEM_PERMA_LIMIT = 4194304; // 1024 pixels * 1024 pixels * 4 channels = 4MB\n\n// custom default palette: VT340 (lower 16 colors) + ANSI256 (up to 256) + zeroed (up to 4096)\nconst DEFAULT_PALETTE = PALETTE_ANSI_256;\nDEFAULT_PALETTE.set(PALETTE_VT340_COLOR);\n\n// Why pooled: every decoder owns a wasm memory, and V8 caps live wasm memories\n// per process (~124 in a sandboxed renderer). Terminals borrow a decoder only\n// while a SIXEL sequence is open, so idle terminals hold none.\nconst MAX_IDLE_DECODERS = 2;\nconst idleDecoders = new Map<number, Decoder[]>();\nlet poolPrimed = false;\n\nfunction primeDecoderPool(memoryLimit: number): void {\n  if (poolPrimed) return;\n  poolPrimed = true;\n  // Async compile once, off the parser's hot path; later decoders reuse the cached module.\n  DecoderAsync({ memoryLimit, palette: DEFAULT_PALETTE }).then(\n    d => releaseDecoder(d, memoryLimit),\n    () => { poolPrimed = false; }\n  );\n}\n\nfunction acquireDecoder(memoryLimit: number): Decoder {\n  return idleDecoders.get(memoryLimit)?.pop() ?? new Decoder({ memoryLimit, palette: DEFAULT_PALETTE });\n}\n\nfunction releaseDecoder(dec: Decoder, memoryLimit: number): void {\n  if (dec.memoryUsage > MEM_PERMA_LIMIT) {\n    dec.release();\n  }\n  const idle = idleDecoders.get(memoryLimit) ?? [];\n  if (idle.length < MAX_IDLE_DECODERS) {\n    idle.push(dec);\n    idleDecoders.set(memoryLimit, idle);\n  }\n}\n\n\nexport class SixelHandler implements IDcsHandler, IResetHandler {\n  private _size = 0;\n  private _aborted = false;\n  private _dec: Decoder | undefined;\n  private _decMemoryLimit = 0;\n  // Color registers outlive a single image, so they live here rather than in a pooled decoder.\n  private readonly _palette = new Uint32Array(LIMITS.PALETTE_SIZE);\n\n  constructor(\n    private readonly _opts: IImageAddonOptions,\n    private readonly _storage: SixelImageStorage,\n    private readonly _coreTerminal: ITerminalExt\n  ) {\n    this._palette.set(DEFAULT_PALETTE);\n    primeDecoderPool(this._opts.pixelLimit * 4);\n  }\n\n  public reset(): void {\n    this._returnDecoder();\n    this._palette.fill(0);\n    this._palette.set(DEFAULT_PALETTE);\n  }\n\n  public hook(params: IParams): void {\n    this._size = 0;\n    this._aborted = false;\n    this._returnDecoder();\n    const memoryLimit = this._opts.pixelLimit * 4;\n    try {\n      this._dec = acquireDecoder(memoryLimit);\n    } catch (e) {\n      // Why: exhausting wasm memory must drop this image, not throw out of the parser and wedge the write queue.\n      console.warn(`SIXEL: could not allocate decoder - ${e}`);\n      this._aborted = true;\n      return;\n    }\n    this._decMemoryLimit = memoryLimit;\n    const fillColor = params.params[1] === 1 ? 0 : extractActiveBg(\n      this._coreTerminal._core._inputHandler._curAttrData,\n      this._coreTerminal._core._themeService?.colors);\n    this._dec.init(fillColor, this._palette, this._opts.sixelPaletteLimit);\n  }\n\n  private _returnDecoder(): void {\n    const dec = this._dec;\n    if (!dec) return;\n    this._dec = undefined;\n    this._palette.set(dec.palette);\n    releaseDecoder(dec, this._decMemoryLimit);\n  }\n\n  public put(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted || !this._dec) {\n      return;\n    }\n    this._size += end - start;\n    if (this._size > this._opts.sixelSizeLimit) {\n      console.warn(`SIXEL: too much data, aborting`);\n      this._aborted = true;\n      this._dec.release();\n      return;\n    }\n    try {\n      this._dec.decode(data, start, end);\n    } catch (e) {\n      console.warn(`SIXEL: error while decoding image - ${e}`);\n      this._aborted = true;\n      this._dec.release();\n    }\n  }\n\n  public unhook(success: boolean): boolean | Promise<boolean> {\n    try {\n      return this._unhook(success);\n    } finally {\n      this._returnDecoder();\n    }\n  }\n\n  private _unhook(success: boolean): boolean {\n    if (this._aborted || !success || !this._dec) {\n      return true;\n    }\n\n    const width = this._dec.width;\n    const height = this._dec.height;\n\n    // partial fix for https://github.com/jerch/xterm-addon-image/issues/37\n    if (!width || !height) {\n      if (height) {\n        this._storage.advanceCursor(height);\n      }\n      return true;\n    }\n\n    const canvas = ImageRenderer.createCanvas(undefined, width, height);\n    canvas.getContext('2d')?.putImageData(new ImageData(this._dec.data8 as Uint8ClampedArray<ArrayBuffer>, width, height), 0, 0);\n    this._storage.addImage(canvas);\n    return true;\n  }\n}\n\n\n/**\n * Some helpers to extract current terminal colors.\n */\n\n// get currently active background color from terminal\n// also respect INVERSE setting\nfunction extractActiveBg(attr: AttributeData, colors: ReadonlyColorSet | undefined): RGBA8888 {\n  let bg = 0;\n  if (!colors) {\n    // FIXME: theme service is prolly not available yet,\n    // happens if .open() was not called yet (bug in core?)\n    return bg;\n  }\n  if (attr.isInverse()) {\n    if (attr.isFgDefault()) {\n      bg = convertLe(colors.foreground.rgba);\n    } else if (attr.isFgRGB()) {\n      const t = (attr.constructor as typeof AttributeData).toColorRGB(attr.getFgColor());\n      bg = toRGBA8888(...t);\n    } else {\n      bg = convertLe(colors.ansi[attr.getFgColor()].rgba);\n    }\n  } else {\n    if (attr.isBgDefault()) {\n      bg = convertLe(colors.background.rgba);\n    } else if (attr.isBgRGB()) {\n      const t = (attr.constructor as typeof AttributeData).toColorRGB(attr.getBgColor());\n      bg = toRGBA8888(...t);\n    } else {\n      bg = convertLe(colors.ansi[attr.getBgColor()].rgba);\n    }\n  }\n  return bg;\n}\n\n// rgba values on the color managers are always in BE, thus convert to LE\nfunction convertLe(color: number): RGBA8888 {\n  if (BIG_ENDIAN) return color;\n  return (color & 0xFF) << 24 | (color >>> 8 & 0xFF) << 16 | (color >>> 16 & 0xFF) << 8 | color >>> 24 & 0xFF;\n}\n","/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { ImageStorage, CELL_SIZE_DEFAULT } from './ImageStorage';\nimport { IImageAddonOptions, ITerminalExt, IAddImageOpts } from './Types';\nimport { ImageRenderer } from './ImageRenderer';\n\n/**\n * Sixel-specific image storage controller.\n *\n * Wraps the shared ImageStorage with sixel protocol semantics:\n * - Cursor behavior governed by DECSET 80 (sixelScrolling option)\n * - advanceCursor for empty sixels carrying only height\n */\nexport class SixelImageStorage {\n  private _addImageOpts: IAddImageOpts = { scrolling: true, layer: 'top', zIndex: 0, cursorPos: 'vt340' };\n  constructor(\n    private readonly _storage: ImageStorage,\n    private readonly _opts: IImageAddonOptions,\n    private readonly _renderer: ImageRenderer,\n    private readonly _terminal: ITerminalExt\n  ) {}\n\n  /**\n   * Add a sixel image to storage.\n   * Cursor behavior depends on the sixelScrolling option (DECSET 80).\n   */\n  public addImage(img: HTMLCanvasElement | ImageBitmap): void {\n    this._addImageOpts.scrolling = this._opts.sixelScrolling;\n    this._storage.addImage(img, this._addImageOpts);\n  }\n\n  /**\n   * Only advance text cursor.\n   * This is an edge case from empty sixels carrying only a height but no pixels.\n   * Partially fixes https://github.com/jerch/xterm-addon-image/issues/37.\n   */\n  public advanceCursor(height: number): void {\n    if (this._opts.sixelScrolling) {\n      let cellSize = this._renderer.cellSize;\n      if (cellSize.width === -1 || cellSize.height === -1) {\n        cellSize = CELL_SIZE_DEFAULT;\n      }\n      const rows = Math.ceil(height / cellSize.height);\n      for (let i = 1; i < rows; ++i) {\n        this._terminal._core._inputHandler.lineFeed();\n      }\n    }\n  }\n}\n","/**\n * Copyright (c) 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IDisposable } from '@xterm/xterm';\nimport { IApcHandler, IImageAddonOptions, IResetHandler, ITerminalExt, ImageLayer } from '../Types';\nimport { ImageRenderer } from '../ImageRenderer';\nimport { CELL_SIZE_DEFAULT } from '../ImageStorage';\nimport { imageType } from '../IIPMetrics';\nimport { KittyImageStorage } from './KittyImageStorage';\nimport Base64Decoder, { type DecodeStatus } from 'xterm-wasm-parts/lib/base64/Base64Decoder.wasm';\nimport {\n  KittyAction,\n  KittyFormat,\n  KittyCompression,\n  IKittyCommand,\n  IPendingTransmission,\n  IKittyImageData,\n  KittyPixelConstants,\n  parseKittyCommand\n} from './KittyGraphicsTypes';\n\nconst enum Constants {\n  // Memory limit for base64 decoder (4MB, same as IIPHandler)\n  DECODER_KEEP_DATA = 4194304,\n  DECODER_INITIAL_DATA = 4194304, // 4MB\n  // Local mirror of const enum (esbuild can't inline const enums from external packages)\n  DECODER_OK = 0,\n  // Maximum control data size\n  MAX_CONTROL_DATA_SIZE = 512,\n  // Semicolon codepoint\n  SEMICOLON = 0x3B\n}\n\nconst DECODER_OK = Constants.DECODER_OK as unknown as DecodeStatus.OK;\n\n// Kitty graphics protocol handler with streaming base64 decoding.\nexport class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDisposable {\n  private _aborted = false;\n  private _generation = 0;\n  private _decodeError = false;\n\n  private _activeDecoder: Base64Decoder | null = null;\n  private readonly _maxEncodedBytes: number;\n  private readonly _initialEncodedBytes: number;\n\n  // Streaming related states\n\n  // True while receiving control data (before semicolon).\n  private _inControlData = true;\n\n  // Buffer for control data.\n  private _controlData = new Uint32Array(Constants.MAX_CONTROL_DATA_SIZE);\n  private _controlLength = 0;\n\n  // Pre-calculated encoded size limit\n  private _encodedSizeLimit = 0;\n  private _totalEncodedSize = 0;\n\n  // Parsed command. These are the control data before semicolon.\n  private _parsedCommand: IKittyCommand | null = null;\n\n  // Storage related states\n\n  private _pendingTransmissions: Map<number, IPendingTransmission> = new Map();\n  // Tracks the pending key of the most recently started chunked upload.\n  // Per spec, subsequent chunks only need m= (and optionally q=), without i=.\n  // When a chunk arrives with no i=, this key is used to find the pending upload.\n  private _lastPendingKey: number | undefined;\n\n  constructor(\n    private readonly _opts: IImageAddonOptions,\n    private readonly _renderer: ImageRenderer,\n    private readonly _kittyStorage: KittyImageStorage,\n    private readonly _coreTerminal: ITerminalExt\n  ) {\n    // Convert decoded size limit -> max encoded bytes.\n    this._maxEncodedBytes = Math.ceil(this._opts.kittySizeLimit * 4 / 3);\n    // ensure we preallocate more than configured limit while using 4mb initial size.\n    this._initialEncodedBytes = Math.min(Constants.DECODER_INITIAL_DATA, this._maxEncodedBytes);\n  }\n\n  public reset(): void {\n    this._generation++;\n    this._cleanupAllPending();\n    if (this._activeDecoder) {\n      this._activeDecoder.release();\n      this._activeDecoder = null;\n    }\n    this._kittyStorage.reset();\n  }\n\n  public dispose(): void {\n    this.reset();\n  }\n\n  private _removePendingEntry(key: number): void {\n    this._pendingTransmissions.delete(key);\n    if (this._lastPendingKey === key) {\n      this._lastPendingKey = undefined;\n    }\n  }\n\n  private _cleanupAllPending(): void {\n    for (const pending of this._pendingTransmissions.values()) {\n      pending.decoder.release();\n    }\n    this._pendingTransmissions.clear();\n    this._lastPendingKey = undefined;\n  }\n\n  public start(): void {\n    this._aborted = false;\n    this._decodeError = false;\n    this._inControlData = true;\n    this._controlLength = 0;\n    this._parsedCommand = null;\n    // Pre-calculate encoded limit once: base64 is 4 bytes encoded → 3 bytes decoded\n    this._encodedSizeLimit = this._maxEncodedBytes;\n    this._totalEncodedSize = 0;\n    this._activeDecoder = null;\n  }\n\n  public put(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted) return;\n\n    if (!this._inControlData) {\n      this._streamPayload(data, start, end);\n    } else {\n      // Scan for semicolon\n      let controlEnd = end;\n      for (let i = start; i < end; i++) {\n        if (data[i] === Constants.SEMICOLON) {\n          this._inControlData = false;\n          controlEnd = i;\n          break;\n        }\n      }\n\n      // Copy control data\n      const copyLength = controlEnd - start;\n      if (this._controlLength + copyLength > Constants.MAX_CONTROL_DATA_SIZE) {\n        this._aborted = true;\n        return;\n      }\n      this._controlData.set(data.subarray(start, controlEnd), this._controlLength);\n      this._controlLength += copyLength;\n\n      if (!this._inControlData) {\n        // Found semicolon - parse control data early for validation\n        this._parsedCommand = parseKittyCommand(this._parseControlDataString());\n\n        // Early validation: i+I conflict\n        if (this._parsedCommand.id !== undefined && this._parsedCommand.imageNumber !== undefined) {\n          this._sendResponse(this._parsedCommand.id, 'EINVAL:cannot specify both i and I keys', this._parsedCommand.quiet ?? 0);\n          this._aborted = true;\n          return;\n        }\n\n        // Delete action doesn't need payload - skip streaming\n        if (this._parsedCommand.action === KittyAction.DELETE) {\n          return;\n        }\n\n        // Stream remaining as payload\n        const payloadStart = controlEnd + 1;\n        if (payloadStart < end) {\n          this._streamPayload(data, payloadStart, end);\n        }\n      }\n    }\n  }\n\n  // Stream payload bytes into the base64 decoder.\n  private _streamPayload(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted) return;\n\n    // Check size limit (compare encoded bytes against pre-calculated limit)\n    // Include cumulative size from pending transmission for multi-chunk images.\n    // Per spec, subsequent chunks may omit i=, so fall back to _lastPendingKey.\n    const pendingKey = this._parsedCommand?.id ?? this._lastPendingKey ?? 0;\n    const pending = this._pendingTransmissions.get(pendingKey);\n    const previousEncodedSize = pending?.totalEncodedSize ?? 0;\n    this._totalEncodedSize += end - start;\n    const cumulativeEncodedSize = previousEncodedSize + this._totalEncodedSize;\n    if (cumulativeEncodedSize > this._encodedSizeLimit) {\n      const decoderToRelease = this._activeDecoder ?? pending?.decoder;\n      if (decoderToRelease) {\n        decoderToRelease.release();\n      }\n      this._activeDecoder = null;\n      if (pending) {\n        this._removePendingEntry(pendingKey);\n      }\n      this._aborted = true;\n      return;\n    }\n\n    if (this._decodeError) return;\n\n    if (pending?.decoder && !this._activeDecoder) {\n      this._activeDecoder = pending.decoder;\n    }\n    if (!this._activeDecoder) {\n      // Budget WASM capacity, including one page of decoder state and rounding.\n      const decoderCapacity = this._maxEncodedBytes + 131072;\n      if (decoderCapacity > this._opts.storageLimit * 1000000) {\n        this._aborted = true;\n        if (this._parsedCommand?.id !== undefined) {\n          this._sendResponse(this._parsedCommand.id, 'ENOMEM:pending image budget exceeded', this._parsedCommand.quiet ?? 0);\n        }\n        return;\n      }\n      const maxPending = Math.max(1, Math.floor(this._opts.storageLimit * 1000000 / decoderCapacity));\n      while (this._pendingTransmissions.size >= maxPending) {\n        const oldest = this._pendingTransmissions.entries().next().value;\n        if (!oldest) break;\n        oldest[1].decoder.release();\n        this._removePendingEntry(oldest[0]);\n        if (oldest[1].cmd.id !== undefined) {\n          this._sendResponse(oldest[1].cmd.id, 'ENOMEM:pending image budget exceeded', oldest[1].cmd.quiet ?? 0);\n        }\n      }\n      const decoder = new Base64Decoder(Constants.DECODER_KEEP_DATA, this._maxEncodedBytes, this._initialEncodedBytes);\n      try {\n        decoder.init();\n      } catch (e) {\n        // Why: wasm memory exhaustion must drop this image, not throw out of the parser and wedge the write queue.\n        console.warn('KITTY: could not allocate decoder', e);\n        this._aborted = true;\n        if (this._parsedCommand?.id !== undefined) {\n          this._sendResponse(this._parsedCommand.id, 'ENOMEM:could not allocate decoder', this._parsedCommand.quiet ?? 0);\n        }\n        return;\n      }\n      this._activeDecoder = decoder;\n    }\n\n    if (this._activeDecoder.put(data.subarray(start, end)) !== DECODER_OK) {\n      this._activeDecoder.release();\n      this._activeDecoder = null;\n      this._decodeError = true;\n      if (pending) {\n        this._removePendingEntry(pendingKey);\n      }\n    }\n  }\n\n  public end(success: boolean): boolean | Promise<boolean> {\n    if (this._aborted || !success) {\n      if (this._activeDecoder) {\n        this._activeDecoder.release();\n        this._activeDecoder = null;\n      }\n      return true;\n    }\n\n    // No semicolon = no payload (delete, capability query)\n    if (this._inControlData) {\n      return this._handleNoPayloadCommand();\n    }\n\n    // Use command parsed early in put() - i+I already validated there\n    const cmd = this._parsedCommand!;\n\n    // Delete action was handled by skipping payload - just execute\n    if (cmd.action === KittyAction.DELETE) {\n      return this._handleDelete(cmd);\n    }\n\n    // Per spec, subsequent chunks may omit i=, so fall back to _lastPendingKey.\n    const pendingKey = cmd.id ?? this._lastPendingKey ?? 0;\n    const isMoreComing = cmd.more === 1;\n    const pending = this._pendingTransmissions.get(pendingKey);\n\n    if (isMoreComing) {\n      if (this._activeDecoder) {\n        if (pending) {\n          pending.totalEncodedSize += this._totalEncodedSize;\n          pending.decodeError = pending.decodeError || this._decodeError;\n        } else {\n          this._pendingTransmissions.set(pendingKey, {\n            cmd: { ...cmd },\n            decoder: this._activeDecoder,\n            totalEncodedSize: this._totalEncodedSize,\n            decodeError: this._decodeError\n          });\n        }\n        this._lastPendingKey = pendingKey;\n        this._activeDecoder = null;\n      }\n      return true;\n    }\n\n    // Final chunk received — clear the last pending key\n    if (pending) {\n      this._lastPendingKey = undefined;\n    }\n\n    let decodeError = this._decodeError;\n    let finalCmd = cmd;\n    let decoder = this._activeDecoder;\n\n    if (pending) {\n      finalCmd = pending.cmd;\n      decoder = pending.decoder;\n      decodeError = decodeError || pending.decodeError;\n      this._pendingTransmissions.delete(pendingKey);\n    }\n\n    let imageBytes = new Uint8Array(0);\n    if (decoder) {\n      if (decoder.end() !== DECODER_OK) {\n        decodeError = true;\n      }\n      imageBytes = decoder.data8;\n    }\n    this._activeDecoder = null;\n\n    // Handle command first — handlers create Blob/ImageData from imageBytes,\n    // which copies the data. Only then is it safe to release the decoder's\n    // wasm memory that imageBytes points into.\n    const result = this._handleCommandWithBytesAndCmd(finalCmd, imageBytes, decodeError);\n    if (decoder) {\n      decoder.release();\n    }\n    return result;\n  }\n\n  // Command handling\n\n  private _parseControlDataString(): string {\n    let str = '';\n    for (let i = 0; i < this._controlLength; i++) {\n      str += String.fromCodePoint(this._controlData[i]);\n    }\n    return str;\n  }\n\n  private _handleNoPayloadCommand(): boolean | Promise<boolean> {\n    const cmd = parseKittyCommand(this._parseControlDataString());\n\n    // Per spec: specifying both i and I is an error\n    if (cmd.id !== undefined && cmd.imageNumber !== undefined) {\n      this._sendResponse(cmd.id, 'EINVAL:cannot specify both i and I keys', cmd.quiet ?? 0);\n      return true;\n    }\n\n    const action = cmd.action ?? 't';\n\n    switch (action) {\n      case KittyAction.DELETE:\n        return this._handleDelete(cmd);\n      case KittyAction.QUERY:\n        this._sendResponse(cmd.id ?? 0, 'OK', cmd.quiet ?? 0);\n        return true;\n      case KittyAction.PLACEMENT:\n        return this._handlePlacement(cmd);\n      default:\n        // TODO: Implement remaining actions when needed:\n        // - a=f (frame): animation frame operations\n        // - a=a (animation): animation control\n        // - a=c (compose): compose images\n        if (cmd.id !== undefined) {\n          this._sendResponse(cmd.id, 'EINVAL:unsupported action', cmd.quiet ?? 0);\n        }\n        return true;\n    }\n  }\n\n  private _handleCommandWithBytesAndCmd(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean | Promise<boolean> {\n    const action = cmd.action ?? 't';\n\n    switch (action) {\n      case KittyAction.TRANSMIT: {\n        const result = this._handleTransmit(cmd, bytes, decodeError);\n        // Only send response when _handleTransmit didn't already respond\n        // (it handles unsupported transmission medium responses internally)\n        if ((cmd.transmission ?? 'd') === 'd' && cmd.id !== undefined) {\n          if (decodeError) {\n            this._sendResponse(cmd.id, 'EINVAL:invalid base64 data', cmd.quiet ?? 0);\n          } else if (bytes.length > 0) {\n            this._sendResponse(cmd.id, 'OK', cmd.quiet ?? 0);\n          }\n        }\n        return result;\n      }\n      case KittyAction.TRANSMIT_DISPLAY:\n        return this._handleTransmitDisplay(cmd, bytes, decodeError);\n      case KittyAction.QUERY:\n        return this._handleQuery(cmd, bytes, decodeError);\n      case KittyAction.PLACEMENT:\n        // a=p ignores any payload — image data was already transmitted\n        return this._handlePlacement(cmd);\n      default:\n        // TODO: Implement remaining actions when needed:\n        // - a=f (frame): animation frame operations\n        // - a=a (animation): animation control\n        // - a=c (compose): compose images\n        if (cmd.id !== undefined) {\n          this._sendResponse(cmd.id, 'EINVAL:unsupported action', cmd.quiet ?? 0);\n        }\n        return true;\n    }\n  }\n\n  private _handlePlacement(cmd: IKittyCommand): boolean | Promise<boolean> {\n    if (cmd.id === undefined) {\n      return true;\n    }\n    const id = cmd.id;\n    const image = this._kittyStorage.getImage(id);\n    if (!image) {\n      this._sendResponse(id, 'ENOENT:image not found', cmd.quiet ?? 0, cmd.placementId);\n      return true;\n    }\n    const result = this._displayImage(image, cmd);\n    return result.then(success => {\n      this._sendResponse(id, success ? 'OK' : 'EINVAL:image rendering failed', cmd.quiet ?? 0, cmd.placementId);\n      return true;\n    });\n  }\n\n  private _handleTransmit(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean {\n    // TODO: Support file-based transmission modes (t=f, t=t, t=s)\n    // Currently only supports direct transmission (t=d, the default).\n    // - t=f (file): Payload is base64-encoded file path. Terminal reads image from that path.\n    // - t=t (temp file): Payload is base64-encoded path in temp directory. Terminal reads, deletes.\n    // - t=s: Payload is base64-encoded POSIX shm name. Terminal reads from shared memory.\n    // These modes require filesystem/IPC access not available in browsers. For Node.js/Electron:\n    // 1. Check cmd.transmission (t key) before treating bytes as image data\n    // 2. For t=f/t/s: decode bytes as UTF-8 string (the path/name), then read file contents\n    // 3. For t=d: treat bytes as image data (current behavior)\n    // When implementing, also update _handleQuery to accept these transmission mediums.\n    const transmission = cmd.transmission ?? 'd';\n    if (transmission !== 'd') {\n      if (cmd.id !== undefined) {\n        this._sendResponse(cmd.id, 'EINVAL:unsupported transmission medium', cmd.quiet ?? 0);\n      }\n      return true;\n    }\n\n    if (decodeError || bytes.length === 0) return true;\n\n    this._kittyStorage.storeImage(cmd.id, {\n      data: new Blob([bytes as BlobPart]),\n      width: cmd.width ?? 0,\n      height: cmd.height ?? 0,\n      format: (cmd.format ?? KittyFormat.RGBA) as 24 | 32 | 100,\n      compression: cmd.compression ?? ''\n    });\n    return true;\n  }\n\n  private _handleTransmitDisplay(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean | Promise<boolean> {\n    if (decodeError) {\n      if (cmd.id !== undefined) {\n        this._sendResponse(cmd.id, 'EINVAL:invalid base64 data', cmd.quiet ?? 0);\n      }\n      return true;\n    }\n\n    this._handleTransmit(cmd, bytes, decodeError);\n\n    const id = cmd.id ?? this._kittyStorage.lastImageId;\n    const image = this._kittyStorage.getImage(id);\n    if (image) {\n      const result = this._displayImage(image, cmd);\n      if (cmd.id !== undefined) {\n        return result.then(success => {\n          this._sendResponse(id, success ? 'OK' : 'EINVAL:image rendering failed', cmd.quiet ?? 0);\n          return true;\n        });\n      }\n      return result.then(() => true);\n    }\n    return true;\n  }\n\n  private _handleQuery(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean {\n    const id = cmd.id ?? 0;\n    const quiet = cmd.quiet ?? 0;\n\n    // Per spec: reject unsupported transmission mediums (only t=d is supported atm)\n    // TODO: When filesystem support is added (Node.js/Electron), update this to accept\n    // t=f (file), t=t (temp file), and t=s (shared memory) and respond OK for queries.\n    const transmission = cmd.transmission ?? 'd';\n    if (transmission !== 'd') {\n      this._sendResponse(id, 'EINVAL:unsupported transmission medium', quiet);\n      return true;\n    }\n\n    // Check decode error first (invalid base64)\n    if (decodeError) {\n      this._sendResponse(id, 'EINVAL:invalid base64 data', quiet);\n      return true;\n    }\n\n    // Capability query (no payload) - just respond OK\n    if (bytes.length === 0) {\n      this._sendResponse(id, 'OK', quiet);\n      return true;\n    }\n\n    const format = cmd.format ?? KittyFormat.RGBA;\n\n    if (format === KittyFormat.PNG) {\n      this._sendResponse(id, 'OK', quiet);\n    } else {\n      const width = cmd.width ?? 0;\n      const height = cmd.height ?? 0;\n\n      if (!width || !height) {\n        this._sendResponse(id, 'EINVAL:width and height required for raw pixel data', quiet);\n        return true;\n      }\n\n      const bytesPerPixel = format === KittyFormat.RGBA ? KittyPixelConstants.BYTES_PER_PIXEL_RGBA : KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n      const expectedBytes = width * height * bytesPerPixel;\n\n      if (bytes.length < expectedBytes) {\n        this._sendResponse(id, `EINVAL:insufficient pixel data`, quiet);\n        return true;\n      }\n\n      this._sendResponse(id, 'OK', quiet);\n    }\n    return true;\n  }\n\n  private _handleDelete(cmd: IKittyCommand): boolean {\n    // Per spec: default delete selector is 'a' (delete all visible placements)\n    const selector = cmd.deleteSelector ?? 'a';\n\n    // TODO: Distinguish lowercase (delete placements only) from uppercase\n    // (delete placements + free stored image data). Currently both variants\n    // free everything since we don't separate stored data from placements.\n    switch (selector) {\n      case 'a':\n      case 'A':\n        this._cleanupAllPending();\n        this._kittyStorage.deleteAll();\n        break;\n      case 'i':\n      case 'I':\n        // TODO: When placement id tracking is implemented (see TODO in\n        // KittyImageStorage), d=i with p=<pid> should delete only that\n        // specific placement, while d=i without p should delete all\n        // placements for the image.\n        if (cmd.id !== undefined) {\n          const pending = this._pendingTransmissions.get(cmd.id);\n          if (pending) {\n            pending.decoder.release();\n          }\n          this._removePendingEntry(cmd.id);\n          this._kittyStorage.deleteById(cmd.id);\n        }\n        break;\n      default:\n        // Unsupported selectors (c, n, p, q, r, x, y, z, f) — ignore for now\n        break;\n    }\n    return true;\n  }\n\n  private _sendResponse(id: number, message: string, quiet: number, placementId?: number): void {\n    const isOk = message === 'OK';\n    if (isOk && quiet >= 1) return;\n    if (!isOk && quiet >= 2) return;\n\n    const pPart = placementId ? `,p=${placementId}` : '';\n    const response = `\\x1b_Gi=${id}${pPart};${message}\\x1b\\\\`;\n    this._coreTerminal._core.coreService.triggerDataEvent(response);\n  }\n\n  // Image display\n\n  private _displayImage(image: IKittyImageData, cmd: IKittyCommand): Promise<boolean> {\n    return this._decodeAndDisplay(image, cmd)\n      .then(() => true)\n      .catch(() => false);\n  }\n\n  private async _decodeAndDisplay(image: IKittyImageData, cmd: IKittyCommand): Promise<void> {\n    const generation = this._generation;\n    let bitmap: ImageBitmap | undefined = await this._createBitmap(image);\n\n    try {\n      if (generation !== this._generation) throw new Error('image decode canceled');\n      const cropX = Math.max(0, cmd.x ?? 0);\n      const cropY = Math.max(0, cmd.y ?? 0);\n      const cropW = cmd.sourceWidth || (bitmap.width - cropX);\n      const cropH = cmd.sourceHeight || (bitmap.height - cropY);\n\n      const maxCropW = Math.max(0, bitmap.width - cropX);\n      const maxCropH = Math.max(0, bitmap.height - cropY);\n      const finalCropW = Math.max(0, Math.min(cropW, maxCropW));\n      const finalCropH = Math.max(0, Math.min(cropH, maxCropH));\n\n      if (finalCropW === 0 || finalCropH === 0) {\n        throw new Error('invalid source rectangle');\n      }\n\n      if (cropX !== 0 || cropY !== 0 || finalCropW !== bitmap.width || finalCropH !== bitmap.height) {\n        const cropped = await createImageBitmap(bitmap, cropX, cropY, finalCropW, finalCropH);\n        bitmap.close();\n        bitmap = cropped;\n      }\n\n      const cw = this._renderer.dimensions?.css.cell.width || CELL_SIZE_DEFAULT.width;\n      const ch = this._renderer.dimensions?.css.cell.height || CELL_SIZE_DEFAULT.height;\n\n      // Per spec: c/r default to image's natural cell dimensions.\n      // If only one of c/r is specified, compute the other from image aspect ratio.\n      let imgCols: number;\n      let imgRows: number;\n      if (cmd.columns !== undefined && cmd.rows !== undefined) {\n        imgCols = cmd.columns;\n        imgRows = cmd.rows;\n      } else if (cmd.columns !== undefined) {\n        imgCols = cmd.columns;\n        imgRows = Math.max(1, Math.ceil((bitmap.height / bitmap.width) * (imgCols * cw) / ch));\n      } else if (cmd.rows !== undefined) {\n        imgRows = cmd.rows;\n        imgCols = Math.max(1, Math.ceil((bitmap.width / bitmap.height) * (imgRows * ch) / cw));\n      } else {\n        imgCols = Math.ceil(bitmap.width / cw);\n        imgRows = Math.ceil(bitmap.height / ch);\n      }\n\n      let w = bitmap.width;\n      let h = bitmap.height;\n\n      // Scale bitmap to fit placement rectangle when c/r are specified\n      if (cmd.columns !== undefined || cmd.rows !== undefined) {\n        w = Math.round(imgCols * cw);\n        h = Math.round(imgRows * ch);\n      }\n\n      if (w * h > this._opts.pixelLimit) {\n        throw new Error('image exceeds pixel limit');\n      }\n\n      // Save cursor position before addImage modifies it\n      const buffer = this._coreTerminal._core.buffer;\n      const savedX = buffer.x;\n      const savedY = buffer.y;\n      const savedYbase = buffer.ybase;\n\n      // Determine layer based on z-index: negative = behind text, 0+ = on top.\n      // When z<0 we always use the bottom layer even without allowTransparency —\n      // the image will simply be hidden behind the opaque text background, which\n      // is the correct behavior (client asked for \"behind text\").\n      const wantsBottom = cmd.zIndex !== undefined && cmd.zIndex < 0;\n      const layer: ImageLayer = wantsBottom ? 'bottom' : 'top';\n\n      if (w !== bitmap.width || h !== bitmap.height) {\n        const scaled = await createImageBitmap(bitmap, { resizeWidth: w, resizeHeight: h });\n        bitmap.close();\n        bitmap = scaled;\n      }\n\n      // Per spec: X/Y are pixel offsets within the first cell, so clamp to cell dimensions\n      const xOffset = Math.min(Math.max(0, cmd.xOffset ?? 0), cw - 1);\n      const yOffset = Math.min(Math.max(0, cmd.yOffset ?? 0), ch - 1);\n      if (xOffset !== 0 || yOffset !== 0) {\n        // Per spec: X/Y is not added to c/r area. When c/r are explicit, the\n        // total placement area remains c*cw × r*ch pixels and the offset image\n        // is clipped to fit. When c/r are unset, the padded canvas determines\n        // the natural cell dimensions.\n        const canvasW = (cmd.columns !== undefined) ? Math.round(imgCols * cw) : bitmap.width + xOffset;\n        const canvasH = (cmd.rows !== undefined) ? Math.round(imgRows * ch) : bitmap.height + yOffset;\n        const offsetCanvas = ImageRenderer.createCanvas(window.document, canvasW, canvasH);\n        const offsetCtx = offsetCanvas.getContext('2d');\n        if (!offsetCtx) {\n          throw new Error('Failed to create offset canvas context');\n        }\n        offsetCtx.drawImage(bitmap, xOffset, yOffset);\n\n        const offsetBitmap = await createImageBitmap(offsetCanvas);\n        offsetCanvas.width = offsetCanvas.height = 0;\n        bitmap.close();\n        bitmap = offsetBitmap;\n        w = bitmap.width;\n        h = bitmap.height;\n        if (w * h > this._opts.pixelLimit) {\n          throw new Error('image exceeds pixel limit');\n        }\n        if (cmd.columns === undefined) {\n          imgCols = Math.ceil(bitmap.width / cw);\n        }\n        if (cmd.rows === undefined) {\n          imgRows = Math.ceil(bitmap.height / ch);\n        }\n      }\n\n      if (generation !== this._generation) throw new Error('image decode canceled');\n      const zIndex = cmd.zIndex ?? 0;\n      this._kittyStorage.addImage(image.id, bitmap, true, layer, zIndex);\n      bitmap = undefined;  // ownership transferred to storage\n\n      // Kitty cursor movement\n      // Per spec: cursor placed at first column after last image column,\n      // on the last row of the image. C=1 means don't move cursor.\n      if (cmd.cursorMovement === 1) {\n        // C=1: restore cursor to position before image was placed\n        const scrolled = buffer.ybase - savedYbase;\n        buffer.x = savedX;\n        // Can't restore cursor to scrollback?\n        buffer.y = Math.max(savedY - scrolled, 0);\n      } else {\n        // Default (C=0): advance cursor horizontally past the image\n        // addImage already positioned cursor on the last row via lineFeeds\n        buffer.x = Math.min(savedX + imgCols, this._coreTerminal.cols);\n      }\n    } catch (e) {\n      bitmap?.close();\n      throw e;\n    }\n  }\n\n  // Create ImageBitmap from already-decoded image data.\n  private async _createBitmap(image: IKittyImageData): Promise<ImageBitmap> {\n    let bytes: Uint8Array = new Uint8Array(await image.data.arrayBuffer());\n\n    if (image.compression === KittyCompression.ZLIB) {\n      bytes = await this._decompressZlib(bytes);\n    }\n\n    if (image.format === KittyFormat.PNG) {\n      const metrics = imageType(bytes);\n      // IHDR dimensions are parsed with signed shifts, so a value >= 0x80000000 comes\n      // back negative and a bare `>` pixel-limit test passes it; require positive.\n      if (metrics.mime !== 'image/png' || !(metrics.width > 0) || !(metrics.height > 0) || metrics.width * metrics.height > this._opts.pixelLimit) {\n        throw new RangeError('PNG exceeds pixel limit or has invalid dimensions');\n      }\n      const blob = new Blob([bytes as BlobPart], { type: 'image/png' });\n      if (!window.createImageBitmap) {\n        const url = URL.createObjectURL(blob);\n        const img = new Image();\n        return new Promise<ImageBitmap>((resolve, reject) => {\n          img.addEventListener('load', () => {\n            URL.revokeObjectURL(url);\n            const canvas = ImageRenderer.createCanvas(window.document, img.width, img.height);\n            canvas.getContext('2d')?.drawImage(img, 0, 0);\n            createImageBitmap(canvas).then(resolve).catch(reject);\n          });\n          img.addEventListener('error', () => {\n            URL.revokeObjectURL(url);\n            reject(new Error('Failed to load image'));\n          });\n          img.src = url;\n        });\n      }\n      return createImageBitmap(blob);\n    }\n\n    // Raw pixel data\n    const width = image.width;\n    const height = image.height;\n\n    if (!width || !height) {\n      throw new Error('Width and height required for raw pixel data');\n    }\n\n    const bytesPerPixel = image.format === KittyFormat.RGBA ? KittyPixelConstants.BYTES_PER_PIXEL_RGBA : KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n    const expectedBytes = width * height * bytesPerPixel;\n\n    if (bytes.length < expectedBytes) {\n      throw new Error('Insufficient pixel data');\n    }\n\n    const pixelCount = width * height;\n\n    if (image.format === KittyFormat.RGBA) {\n      // RGBA: use bytes directly — no copy needed\n      return createImageBitmap(new ImageData(new Uint8ClampedArray(bytes.buffer as ArrayBuffer, bytes.byteOffset, pixelCount * KittyPixelConstants.BYTES_PER_PIXEL_RGBA), width, height));\n    }\n\n    // RGB→RGBA: interleave alpha using uint32 block processing (4 pixels per iteration).\n    // 3 uint32 reads + 4 uint32 writes per 4 pixels vs 28 byte reads/writes — ~6x faster.\n    // Assumes little-endian (all modern browsers/Node.js).\n    const data = new Uint8ClampedArray(pixelCount * KittyPixelConstants.BYTES_PER_PIXEL_RGBA);\n    const src32 = new Uint32Array(bytes.buffer, bytes.byteOffset, Math.floor(bytes.byteLength / 4));\n    const dst32 = new Uint32Array(data.buffer);\n    const alignedPixels = pixelCount & ~3;  // round down to multiple of 4\n\n    let srcOffset = 0;\n    let dstOffset = 0;\n    for (let i = 0; i < alignedPixels; i += 4) {\n      const b0 = src32[srcOffset++];\n      const b1 = src32[srcOffset++];\n      const b2 = src32[srcOffset++];\n      // Little-endian: pixel bytes are [R,G,B] → uint32 ABGR layout\n      dst32[dstOffset++] = 0xFF000000 | b0;\n      dst32[dstOffset++] = 0xFF000000 | (b0 >>> 24) | (b1 << 8);\n      dst32[dstOffset++] = 0xFF000000 | (b1 >>> 16) | (b2 << 16);\n      dst32[dstOffset++] = 0xFF000000 | (b2 >>> 8);\n    }\n\n    // Handle remaining 1–3 pixels\n    let srcByte = alignedPixels * KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n    let dstByte = alignedPixels * KittyPixelConstants.BYTES_PER_PIXEL_RGBA;\n    for (let i = alignedPixels; i < pixelCount; i++) {\n      data[dstByte]     = bytes[srcByte];\n      data[dstByte + 1] = bytes[srcByte + 1];\n      data[dstByte + 2] = bytes[srcByte + 2];\n      data[dstByte + 3] = KittyPixelConstants.ALPHA_OPAQUE;\n      srcByte += KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n      dstByte += KittyPixelConstants.BYTES_PER_PIXEL_RGBA;\n    }\n\n    return createImageBitmap(new ImageData(data, width, height));\n  }\n\n  private async _decompressZlib(compressed: Uint8Array): Promise<Uint8Array> {\n    try {\n      return await this._decompress(compressed, 'deflate');\n    } catch (error) {\n      if (error instanceof RangeError) throw error;\n      return await this._decompress(compressed, 'deflate-raw');\n    }\n  }\n\n  private async _decompress(compressed: Uint8Array, format: 'deflate' | 'deflate-raw'): Promise<Uint8Array> {\n    const limit = Math.min(this._opts.kittySizeLimit, this._opts.pixelLimit * 4, this._opts.storageLimit * 1000000);\n    let offsetIn = 0;\n    // Bound inflation within one native transform before its output is budgeted.\n    const source = new ReadableStream<BufferSource>({\n      pull(controller) {\n        if (offsetIn >= compressed.length) {\n          controller.close();\n          return;\n        }\n        const end = Math.min(offsetIn + 4096, compressed.length);\n        controller.enqueue(new Uint8Array(compressed.subarray(offsetIn, end)));\n        offsetIn = end;\n      }\n    });\n    const reader = source.pipeThrough(new DecompressionStream(format)).getReader();\n    const chunks: Uint8Array[] = [];\n    let totalLength = 0;\n    try {\n      while (true) {\n        const { done, value } = await reader.read();\n        if (done) break;\n        totalLength += value.byteLength;\n        if (totalLength > limit) {\n          await reader.cancel().catch(() => {});\n          throw new RangeError('decompressed image exceeds byte limit');\n        }\n        chunks.push(value);\n      }\n    } finally {\n      reader.releaseLock();\n    }\n\n    const result = new Uint8Array(totalLength);\n    let offset = 0;\n    for (const chunk of chunks) {\n      result.set(chunk, offset);\n      offset += chunk.length;\n    }\n    return result;\n  }\n\n  public get images(): ReadonlyMap<number, IKittyImageData> {\n    return this._kittyStorage.images;\n  }\n\n  public get _kittyIdToStorageId(): ReadonlyMap<number, number> {\n    return this._kittyStorage.kittyIdToStorageId;\n  }\n\n  public get pendingTransmissions(): ReadonlyMap<number, IPendingTransmission> {\n    return this._pendingTransmissions;\n  }\n}\n","/**\n * Copyright (c) 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n *\n * Kitty graphics protocol types, constants, and parsing utilities.\n */\n\nimport type Base64Decoder from 'xterm-wasm-parts/lib/base64/Base64Decoder.wasm';\n\n// Kitty graphics protocol action types.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference under key 'a'.\nexport const enum KittyAction {\n  TRANSMIT = 't',\n  TRANSMIT_DISPLAY = 'T',\n  QUERY = 'q',\n  PLACEMENT = 'p',\n  DELETE = 'd'\n}\n\n// Kitty graphics protocol format types.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference\nexport const enum KittyFormat {\n  RGB = 24,\n  RGBA = 32,\n  PNG = 100\n}\n\n// Kitty graphics protocol compression types.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference under key 'o'.\nexport const enum KittyCompression {\n  NONE = '',\n  ZLIB = 'z'\n}\n\n// Kitty graphics protocol control data keys.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference\nexport const enum KittyKey {\n  // Action to perform (t=transmit, T=transmit+display, q=query, p=placement, d=delete)\n  ACTION = 'a',\n  // Image format (24=RGB, 32=RGBA, 100=PNG)\n  FORMAT = 'f',\n  // Image ID for referencing stored images\n  ID = 'i',\n  // Image number (alternative to ID, terminal assigns ID)\n  IMAGE_NUMBER = 'I',\n  // Source image width in pixels\n  WIDTH = 's',\n  // Source image height in pixels\n  HEIGHT = 'v',\n  // The left edge (in pixels) of the image area to display\n  X_OFFSET = 'x',\n  // The top edge (in pixels) of the image area to display\n  Y_OFFSET = 'y',\n  // Width (in pixels) of the source rectangle to display\n  SOURCE_WIDTH = 'w',\n  // Height (in pixels) of the source rectangle to display\n  SOURCE_HEIGHT = 'h',\n  // Horizontal offset (in pixels) within the first cell\n  X_PLACEMENT_OFFSET = 'X',\n  // Vertical offset (in pixels) within the first cell\n  Y_PLACEMENT_OFFSET = 'Y',\n  // Number of terminal columns to display the image over\n  COLUMNS = 'c',\n  // Number of terminal rows to display the image over\n  ROWS = 'r',\n  // More data flag (1=more chunks coming, 0=final chunk)\n  MORE = 'm',\n  // Compression type (z=zlib). This is essential for chunking larger images.\n  COMPRESSION = 'o',\n  // Quiet mode (1=suppress OK responses, 2=suppress error responses)\n  QUIET = 'q',\n  // Cursor movement policy (0=move cursor after image, 1=don't move cursor)\n  CURSOR_MOVEMENT = 'C',\n  // Z-index for image layering (negative = behind text, 0+ = on top)\n  Z_INDEX = 'z',\n  // Transmission medium (d=direct, f=file, t=temp file, s=shared memory)\n  TRANSMISSION = 't',\n  // Delete selector (a/A=all, i/I=by id, c/C=at cursor, etc.) — only used when a=d\n  DELETE_SELECTOR = 'd',\n  // Placement ID for targeting specific placements\n  PLACEMENT_ID = 'p'\n}\n\n// Pixel format constants\nexport const enum KittyPixelConstants {\n  BYTES_PER_PIXEL_RGB = 3,\n  BYTES_PER_PIXEL_RGBA = 4,\n  ALPHA_OPAQUE = 255\n}\n\n// Parsed Kitty graphics command.\nexport interface IKittyCommand {\n  action?: string;\n  format?: number;\n  id?: number;\n  imageNumber?: number;\n  width?: number;\n  height?: number;\n  x?: number;\n  y?: number;\n  sourceWidth?: number;\n  sourceHeight?: number;\n  xOffset?: number;\n  yOffset?: number;\n  columns?: number;\n  rows?: number;\n  more?: number;\n  quiet?: number;\n  cursorMovement?: number;\n  zIndex?: number;\n  transmission?: string;\n  deleteSelector?: string;\n  placementId?: number;\n  compression?: string;\n  payload?: string;\n}\n\n// Pending chunked transmission state.\n// Stores metadata from the first chunk while accumulating decoded payload data.\nexport interface IPendingTransmission {\n  // The parsed command from the first chunk (contains action, format, dimensions, etc.)\n  cmd: IKittyCommand;\n  // Decoder used across chunked payloads\n  decoder: Base64Decoder;\n  // Total encoded (base64) bytes received across all chunks - for size limit enforcement\n  totalEncodedSize: number;\n  // Whether any chunk has failed to decode\n  decodeError: boolean;\n}\n\n// Stored Kitty image data.\nexport interface IKittyImageData {\n  id: number;\n  // Decoded image data stored as Blob (off JS heap) to avoid 2GB heap limit\n  data: Blob;\n  width: number;\n  height: number;\n  format: 24 | 32 | 100;\n  compression?: string;\n}\n\n// Parses Kitty graphics control data into a command object.\nexport function parseKittyCommand(data: string): IKittyCommand {\n  const cmd: IKittyCommand = {};\n  const parts = data.split(',');\n\n  for (const part of parts) {\n    const eqIdx = part.indexOf('=');\n    if (eqIdx === -1) continue;\n\n    const key = part.substring(0, eqIdx);\n    const value = part.substring(eqIdx + 1);\n\n    // Handle string keys first\n    if (key === KittyKey.ACTION) {\n      cmd.action = value;\n      continue;\n    }\n    if (key === KittyKey.COMPRESSION) {\n      cmd.compression = value;\n      continue;\n    }\n    if (key === KittyKey.TRANSMISSION) {\n      cmd.transmission = value;\n      continue;\n    }\n    if (key === KittyKey.DELETE_SELECTOR) {\n      cmd.deleteSelector = value;\n      continue;\n    }\n    const numValue = parseInt(value, 10);\n    switch (key) {\n      case KittyKey.FORMAT: cmd.format = numValue; break;\n      case KittyKey.ID: cmd.id = numValue; break;\n      case KittyKey.IMAGE_NUMBER: cmd.imageNumber = numValue; break;\n      case KittyKey.WIDTH: cmd.width = numValue; break;\n      case KittyKey.HEIGHT: cmd.height = numValue; break;\n      case KittyKey.X_OFFSET: cmd.x = numValue; break;\n      case KittyKey.Y_OFFSET: cmd.y = numValue; break;\n      case KittyKey.SOURCE_WIDTH: cmd.sourceWidth = numValue; break;\n      case KittyKey.SOURCE_HEIGHT: cmd.sourceHeight = numValue; break;\n      case KittyKey.X_PLACEMENT_OFFSET: cmd.xOffset = numValue; break;\n      case KittyKey.Y_PLACEMENT_OFFSET: cmd.yOffset = numValue; break;\n      case KittyKey.COLUMNS: cmd.columns = numValue; break;\n      case KittyKey.ROWS: cmd.rows = numValue; break;\n      case KittyKey.MORE: cmd.more = numValue; break;\n      case KittyKey.QUIET: cmd.quiet = numValue; break;\n      case KittyKey.CURSOR_MOVEMENT: cmd.cursorMovement = numValue; break;\n      case KittyKey.Z_INDEX: cmd.zIndex = numValue; break;\n      case KittyKey.PLACEMENT_ID: cmd.placementId = numValue; break;\n    }\n  }\n\n  return cmd;\n}\n","/**\n * Copyright (c) 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IDisposable } from '@xterm/xterm';\nimport { ImageStorage } from '../ImageStorage';\nimport { ImageLayer, IAddImageOpts } from '../Types';\nimport { IKittyImageData } from './KittyGraphicsTypes';\n\n// Kitty-specific image storage controller.\n//\n// Wraps shared ImageStorage with kitty protocol semantics:\n// - tracks transmitted image payloads by kitty image id\n// - tracks kitty image id -> shared ImageStorage id mapping for displayed images\n// - mirrors shared-storage evictions into kitty maps\n// - applies protocol-level undisplayed-image eviction policy\nexport class KittyImageStorage implements IDisposable {\n  private static readonly _maxStoredImages = 256;\n\n  private _nextImageId = 1;\n  private readonly _images: Map<number, IKittyImageData> = new Map();\n  // TODO: Support multiple placements per image. The kitty spec identifies\n  // placements by an (image id, placement id) pair — same i + different p\n  // values should coexist, and same i + same p should replace the prior\n  // placement. Currently we track only one storage entry per kitty image id,\n  // so multiple placements of the same image overwrite each other. Fixing\n  // this requires changing these maps to Map<number, Map<number, number>>\n  // (kittyId → placementId → storageId) and updating addImage/deleteById\n  // accordingly. The underlying shared ImageStorage would also need to\n  // support multiple entries per logical image.\n  private readonly _kittyIdToStorageId: Map<number, number> = new Map();\n  private readonly _storageIdToKittyId: Map<number, number> = new Map();\n\n  private readonly _previousOnImageDeleted: ((storageId: number) => void) | undefined;\n  private readonly _wrappedOnImageDeleted: (storageId: number) => void;\n  private readonly _handleStorageImageDeleted = (storageId: number): void => {\n    const kittyId = this._storageIdToKittyId.get(storageId);\n    if (kittyId !== undefined) {\n      this._kittyIdToStorageId.delete(kittyId);\n      this._storageIdToKittyId.delete(storageId);\n      this._images.delete(kittyId);\n    }\n  };\n  private _addImageOpts: IAddImageOpts = { scrolling: true, layer: 'top', zIndex: 0, cursorPos: 'iip' };\n\n  constructor(\n    private readonly _storage: ImageStorage\n  ) {\n    this._previousOnImageDeleted = this._storage.onImageDeleted;\n    this._wrappedOnImageDeleted = (storageId: number) => {\n      this._previousOnImageDeleted?.(storageId);\n      this._handleStorageImageDeleted(storageId);\n    };\n    this._storage.onImageDeleted = this._wrappedOnImageDeleted;\n  }\n\n  public reset(): void {\n    this._nextImageId = 1;\n    this._images.clear();\n    this._kittyIdToStorageId.clear();\n    this._storageIdToKittyId.clear();\n  }\n\n  public dispose(): void {\n    this.reset();\n    if (this._storage.onImageDeleted === this._wrappedOnImageDeleted) {\n      this._storage.onImageDeleted = this._previousOnImageDeleted;\n    }\n  }\n\n  public storeImage(id: number | undefined, imageData: Omit<IKittyImageData, 'id'>): number {\n    const imageId = id ?? this._nextImageId++;\n\n    const oldStorageId = this._kittyIdToStorageId.get(imageId);\n    if (oldStorageId !== undefined) {\n      this._storage.deleteImage(oldStorageId);\n      this._kittyIdToStorageId.delete(imageId);\n      this._storageIdToKittyId.delete(oldStorageId);\n    }\n\n    if (!this._images.has(imageId) && this._images.size >= KittyImageStorage._maxStoredImages) {\n      this._evictUndisplayedImages();\n    }\n\n    // Encoded images awaiting placement are outside ImageStorage's pixel budget.\n    // Unplaced payloads are evicted first so a new upload cannot erase a visible\n    // image while abandoned blobs still hold budget; placed ones go only when\n    // that is not enough, because the byte cap is a hard bound. The new image is\n    // always stored, so an oversized one overshoots by at most one payload\n    // (itself bounded by kittySizeLimit) rather than being dropped after an OK ack.\n    const byteLimit = this._storage.getLimit() * 1000000;\n    this._images.delete(imageId);\n    let retainedBytes = 0;\n    for (const image of this._images.values()) retainedBytes += image.data.size;\n    for (const evictPlaced of [false, true]) {\n      for (const [oldestId, image] of this._images) {\n        if (retainedBytes + imageData.data.size <= byteLimit) break;\n        if (this._kittyIdToStorageId.has(oldestId) !== evictPlaced) continue;\n        retainedBytes -= image.data.size;\n        this.deleteById(oldestId);\n      }\n    }\n\n    this._images.set(imageId, {\n      ...imageData,\n      id: imageId\n    });\n    return imageId;\n  }\n\n  public addImage(kittyId: number, image: HTMLCanvasElement | ImageBitmap, scrolling: boolean, layer: ImageLayer, zIndex: number): void {\n    // Clean up stale reverse-mapping from a previous placement of the same\n    // kitty image.  The old shared-storage entry is kept (it may still be\n    // visible on screen) but its reverse mapping is removed so that eviction\n    // of the old entry won't incorrectly delete the kitty image data.\n    const oldStorageId = this._kittyIdToStorageId.get(kittyId);\n    if (oldStorageId !== undefined) {\n      this._storageIdToKittyId.delete(oldStorageId);\n    }\n    this._addImageOpts.scrolling = scrolling;\n    this._addImageOpts.layer = layer;\n    this._addImageOpts.zIndex = zIndex;\n    const storageId = this._storage.addImage(image, this._addImageOpts);\n    this._kittyIdToStorageId.set(kittyId, storageId);\n    this._storageIdToKittyId.set(storageId, kittyId);\n  }\n\n  public getImage(kittyId: number): IKittyImageData | undefined {\n    return this._images.get(kittyId);\n  }\n\n  public deleteById(kittyId: number): void {\n    this._images.delete(kittyId);\n    const storageId = this._kittyIdToStorageId.get(kittyId);\n    if (storageId !== undefined) {\n      this._storage.deleteImage(storageId);\n      this._kittyIdToStorageId.delete(kittyId);\n      this._storageIdToKittyId.delete(storageId);\n    }\n  }\n\n  public deleteAll(): void {\n    this._images.clear();\n    for (const storageId of this._kittyIdToStorageId.values()) {\n      this._storage.deleteImage(storageId);\n    }\n    this._kittyIdToStorageId.clear();\n    this._storageIdToKittyId.clear();\n  }\n\n  public get images(): ReadonlyMap<number, IKittyImageData> {\n    return this._images;\n  }\n\n  public get kittyIdToStorageId(): ReadonlyMap<number, number> {\n    return this._kittyIdToStorageId;\n  }\n\n  public get lastImageId(): number {\n    return this._nextImageId - 1;\n  }\n\n  private _evictUndisplayedImages(): void {\n    for (const [kittyId] of this._images) {\n      if (this._images.size <= KittyImageStorage._maxStoredImages / 2) {\n        break;\n      }\n      if (!this._kittyIdToStorageId.has(kittyId)) {\n        this._images.delete(kittyId);\n      }\n    }\n  }\n}\n","\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\n/**\n * Copyright (c) 2023, 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n */\nconst inwasm_runtime_1 = require(\"inwasm-runtime\");\n/**\n * wasm base64 decoder.\n */\nconst wasmDecode = (0, inwasm_runtime_1.InWasm)(/*inwasm#828e69684093b2c6:rdef-start:\"decode\"*/{s:1,t:0,d:'AGFzbQEAAAABBQFgAAF/Ag8BA2VudgZtZW1vcnkCAAEDAwIAAAcNAgNkZWMAAANlbmQAAQqLBgKZBAEKf0GIKCgCAEGgKGohAUGEKCgCACIDQaAoaiEAQYAoKAIAQQFrQXxxIgRBoChqIQUgBEEQayADSgRAIARBkChqIQMDQCABIABBA2otAABBAnQoAoAgIABBAmotAABBAnQoAoAYIABBAWotAABBAnQoAoAQIAAtAABBAnQoAoAIcnJyIgY2AgAgAUEDaiAAQQdqLQAAQQJ0KAKAICAAQQZqLQAAQQJ0KAKAGCAAQQVqLQAAQQJ0KAKAECAAQQRqLQAAQQJ0KAKACHJyciIHNgIAIAFBBmogAEELai0AAEECdCgCgCAgAEEKai0AAEECdCgCgBggAEEJai0AAEECdCgCgBAgAEEIai0AAEECdCgCgAhycnIiCDYCACABQQlqIABBD2otAABBAnQoAoAgIABBDmotAABBAnQoAoAYIABBDWotAABBAnQoAoAQIABBDGotAABBAnQoAoAIcnJyIgk2AgAgAiAGciAHciAIciAJciECIAFBDGohASAAQRBqIgAgA0kNAAsLIAAgBUkEQANAIAEgAEEDai0AAEECdCgCgCAgAEECai0AAEECdCgCgBggAEEBai0AAEECdCgCgBAgAC0AAEECdCgCgAhycnIiAzYCACACIANyIQIgAUEDaiEBIABBBGoiACAFSQ0ACwtBfyEAIAJB////B00Ef0GEKCAENgIAQYgoIAFBoChrNgIAQQAFQX8LC+0BAQR/AkBBgCgoAgAiAUGEKCgCACIAa0EFTgRAQX8hAxAADQFBgCgoAgAhAUGEKCgCACEAC0F/IQMgASAAayIBQQJIDQAgAC0AoShBAnQoAoAQIAAtAKAoQQJ0KAKACHIhAgJ/IAFBBEYEQEEDQQQgAC0AoyhBPUYbIAAtAKIoQT1GayEBC0EBIAFBA0kNABogAC0AoihBAnQoAoAYIAJyIQJBAiABQQRHDQAaIAAtAKMoQQJ0KAKAICACciECQQMLIQEgAkH///8HSw0AQQAhA0GIKCgCACIAIAI2AKAoQYgoIAAgAWo2AgALIAML'}/*inwasm#828e69684093b2c6:rdef-end:\"decode\"*/);\n// SIMD version (speedup ~1.4x, not covered by tests yet)\n/*\nconst wasmDecode = InWasm({\n  name: 'decode',\n  type: OutputType.INSTANCE,\n  mode: OutputMode.SYNC,\n  srctype: 'Clang-C',\n  imports: {\n    env: { memory: new WebAssembly.Memory({ initial: 1 }) }\n  },\n  exports: {\n    dec: () => 0,\n    end: () => 0\n  },\n  compile: {\n    switches: ['-msimd128', '-Wl,-z,stack-size=0', '-Wl,--stack-first']\n  },\n  code: `\n    #include <wasm_simd128.h>\n    typedef struct {\n      unsigned int wp;\n      unsigned int sp;\n      unsigned int dp;\n      unsigned int e_size;\n      unsigned int dummy[4];\n      unsigned char data[0];\n    } State;\n\n    unsigned int *D0 = (unsigned int *) ${P32.D0 * 4};\n    unsigned int *D1 = (unsigned int *) ${P32.D1 * 4};\n    unsigned int *D2 = (unsigned int *) ${P32.D2 * 4};\n    unsigned int *D3 = (unsigned int *) ${P32.D3 * 4};\n    State *state = (State *) ${P32.STATE * 4};\n\n    #define packed_byte(x) wasm_i8x16_splat((char) x)\n    #define packed_dword(x) wasm_i32x4_splat(x)\n    #define masked(x, mask) wasm_v128_and(x, wasm_i32x4_splat(mask))\n\n    __attribute__((noinline)) int dec() {\n      unsigned int nsp = (state->wp - 1) & ~3;\n      unsigned char *src = state->data + state->sp;\n      unsigned char *end = state->data + nsp;\n      unsigned char *dst = state->data + state->dp;\n      unsigned int error = 0;\n\n      v128_t err = wasm_i8x16_splat(0);\n      unsigned char *end16 = state->data + (nsp & ~15);\n      while (src < end16) {\n        v128_t data = wasm_v128_load((v128_t *) src);\n\n        // wasm-simd rewrite of http://0x80.pl/notesen/2016-01-17-sse-base64-decoding.html#vector-lookup-pshufb\n        const v128_t higher_nibble = wasm_u32x4_shr(data, 4) & packed_byte(0x0f);\n        const char linv = 1;\n        const char hinv = 0;\n\n        const v128_t lower_bound_LUT = wasm_i8x16_const(\n          // order: 0 1 2 3 4 5 6 7 8 9 a b c d e f\n          linv, linv, 0x2b, 0x30,\n          0x41, 0x50, 0x61, 0x70,\n          linv, linv, linv, linv,\n          linv, linv, linv, linv\n        );\n        const v128_t upper_bound_LUT = wasm_i8x16_const(\n          // order: 0 1 2 3 4 5 6 7 8 9 a b c d e f\n          hinv, hinv, 0x2b, 0x39,\n          0x4f, 0x5a, 0x6f, 0x7a,\n          hinv, hinv, hinv, hinv,\n          hinv, hinv, hinv, hinv\n        );\n        // the difference between the shift and lower bound\n        const v128_t shift_LUT = wasm_i8x16_const(\n          // order: 0 1 2 3 4 5 6 7 8 9 a b c d e f\n          0x00,        0x00,        0x3e - 0x2b, 0x34 - 0x30,\n          0x00 - 0x41, 0x0f - 0x50, 0x1a - 0x61, 0x29 - 0x70,\n          0x00,        0x00,        0x00,        0x00,\n          0x00,        0x00,        0x00,        0x00\n        );\n\n        const v128_t upper_bound = wasm_i8x16_swizzle(upper_bound_LUT, higher_nibble);\n        const v128_t lower_bound = wasm_i8x16_swizzle(lower_bound_LUT, higher_nibble);\n\n        const v128_t below = wasm_i8x16_lt(data, lower_bound);\n        const v128_t above = wasm_i8x16_gt(data, upper_bound);\n        const v128_t eq_2f = wasm_i8x16_eq(data, packed_byte(0x2f));\n\n        // in_range = not (below or above) or eq_2f\n        // outside  = not in_range = below or above and not eq_2f (from deMorgan law)\n        const v128_t outside = wasm_v128_andnot(eq_2f, above | below);\n        err = wasm_v128_or(err, outside);\n\n        const v128_t shift  = wasm_i8x16_swizzle(shift_LUT, higher_nibble);\n        const v128_t t0     = wasm_i8x16_add(data, shift);\n        v128_t v = wasm_i8x16_add(t0, wasm_v128_and(eq_2f, packed_byte(-3)));\n\n        // pack bytes\n        const v128_t ca = masked(v, 0x003f003f);\n        const v128_t db = masked(v, 0x3f003f00);\n        const v128_t t00 = wasm_v128_or(wasm_u32x4_shr(db, 8), wasm_i32x4_shl(ca, 6));\n        v128_t res = wasm_v128_or(wasm_u32x4_shr(t00, 16), wasm_i32x4_shl(t00, 12));\n        res = wasm_i8x16_swizzle(res, wasm_i8x16_const(2, 1, 0, 6, 5, 4, 10, 9, 8, 14, 13, 12, 16, 16, 16, 16));\n\n        wasm_v128_store((v128_t *) dst, res);\n        dst += 12;\n        src += 16;\n      }\n      //if (wasm_i8x16_bitmask(err) != 0) return -1;\n      if (wasm_v128_any_true(err)) return -1;\n\n      // operate on 4-byte blocks\n      while (src < end) {\n        error |= *((unsigned int *) dst) = D0[src[0]] | D1[src[1]] | D2[src[2]] | D3[src[3]];\n        dst += 3;\n        src += 4;\n      }\n      if (error >> 24) return -1;\n      state->sp = nsp;\n      state->dp = dst - state->data;\n      return 0;\n    }\n\n    int end() {\n      int rem = state->wp - state->sp;\n      if (rem > 4 && dec()) return -1;\n      rem = state->wp - state->sp;\n      if (rem < 2) return -1;\n\n      unsigned char *src = state->data + state->sp;\n      if (rem == 4) {\n        if (src[3] == 61) rem--;\n        if (src[2] == 61) rem--;\n      }\n      unsigned int accu = D0[src[0]] | D1[src[1]];\n      int dp = 1;\n      if (rem > 2) {\n        accu |= D2[src[2]];\n        dp++;\n        if (rem == 4) {\n          accu |= D3[src[3]];\n          dp++;\n        }\n      }\n      if (accu >> 24) return -1;\n      *((unsigned int *) (state->data + state->dp)) = accu;\n      state->dp += dp;\n      return 0;\n    }\n    `\n});\n*/\n// base64 map\nconst MAP = new Uint8Array('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'\n    .split('')\n    .map(el => el.charCodeAt(0)));\n// init decoder maps in LE order\nconst D = new Uint32Array(1024);\nD.fill(0xFF000000);\nfor (let i = 0; i < MAP.length; ++i)\n    D[MAP[i]] = i << 2;\nfor (let i = 0; i < MAP.length; ++i)\n    D[256 + MAP[i]] = i >> 4 | ((i << 4) & 0xFF) << 8;\nfor (let i = 0; i < MAP.length; ++i)\n    D[512 + MAP[i]] = (i >> 2) << 8 | ((i << 6) & 0xFF) << 16;\nfor (let i = 0; i < MAP.length; ++i)\n    D[768 + MAP[i]] = i << 16;\nconst EMPTY = new Uint8Array(0);\n/**\n * base64 stream decoder.\n *\n * Features / assumptions:\n * - lazy chunkwise decoding\n * - errors out on any non base64 chars (no support for NL formatted base64)\n * - decodes in wasm\n * - inplace decoding to save memory\n * - supports a keepSize for lazy memory release\n */\nclass Base64Decoder {\n    /**\n     * @param keepSize Keep the wasm instance below this limit when calling `release()`.\n     * @param maxBytes Max allowed bytes to allocate.\n     * @param initialBytes Initial bytes to allocate.\n     */\n    constructor(keepSize, maxBytes, initialBytes) {\n        this._inst = null;\n        this._ended = true;\n        this._bytes = 0;\n        this.keepSize = keepSize !== null && keepSize !== void 0 ? keepSize : 1048576 /* Bytes.KEEP */;\n        this.maxBytes = maxBytes !== null && maxBytes !== void 0 ? maxBytes : 4294901760 /* Bytes.MAX */;\n        this._bytes = initialBytes !== null && initialBytes !== void 0 ? initialBytes : 32768 /* Bytes.INITIAL */;\n        if (this._bytes > this.maxBytes || this.maxBytes > 4294901760 /* Bytes.MAX */) {\n            throw new Error('invalid byte settings');\n        }\n    }\n    /**\n     * Currently decoded bytes (borrowed).\n     * Must be accessed before calling `release` or `init`.\n     */\n    get data8() {\n        return this._inst ? this._d.subarray(0, this._m32[1282 /* P32.STATE_DP */]) : EMPTY;\n    }\n    /**\n     * Release memory conditionally based on `keepSize`.\n     * If memory gets released, also the wasm instance will be freed and recreated on next `init`,\n     * otherwise the instance will be reused.\n     */\n    release() {\n        if (!this._inst)\n            return;\n        if (this._bytes > this.keepSize) {\n            this._inst = this._m32 = this._d = this._mem = null;\n        }\n        else {\n            this._m32[1280 /* P32.STATE_WP */] = 0;\n            this._m32[1281 /* P32.STATE_SP */] = 0;\n            this._m32[1282 /* P32.STATE_DP */] = 0;\n        }\n    }\n    /**\n     * Initializes the decoder for new base64 data.\n     * Must be called before doing any decoding attempts.\n     * The method will either spawn a new wasm instance or grow\n     * the needed memory of an existing instance.\n     * @param maxBytes Max allowed bytes to allocate (overwrites ctor value).\n     * @param initialBytes Initial bytes to allocate (overwrites ctor value).\n     */\n    init(maxBytes, initialBytes) {\n        this.maxBytes = maxBytes !== null && maxBytes !== void 0 ? maxBytes : this.maxBytes;\n        this._bytes = initialBytes !== null && initialBytes !== void 0 ? initialBytes : Math.min(this._bytes, this.maxBytes);\n        if (this._bytes > this.maxBytes || this.maxBytes > 4294901760 /* Bytes.MAX */) {\n            throw Error('invalid byte settings');\n        }\n        let m = this._m32;\n        const bytes = this._bytes + 5152 /* Bytes._DATA_OFFSET */;\n        if (!this._inst) {\n            this._mem = new WebAssembly.Memory({ initial: Math.ceil(bytes / 65536) });\n            this._inst = wasmDecode({ env: { memory: this._mem } });\n            m = new Uint32Array(this._mem.buffer, 0);\n            m.set(D, 256 /* P32.D0 */);\n            this._d = new Uint8Array(this._mem.buffer, 5152 /* Bytes._DATA_OFFSET */);\n        }\n        else if (this._mem.buffer.byteLength < bytes) {\n            this._mem.grow(Math.ceil((bytes - this._mem.buffer.byteLength) / 65536));\n            m = new Uint32Array(this._mem.buffer, 0);\n            this._d = new Uint8Array(this._mem.buffer, 5152 /* Bytes._DATA_OFFSET */);\n        }\n        m[1280 /* P32.STATE_WP */] = 0;\n        m[1281 /* P32.STATE_SP */] = 0;\n        m[1282 /* P32.STATE_DP */] = 0;\n        this._m32 = m;\n        this._ended = false;\n    }\n    /**\n     * Realloc memory. Realloc only happens, if the requested\n     * size doesn't fit in the current memory.\n     * The new size will be capped by `maxBytes`.\n     * @param requested Bytes to be stored.\n     */\n    _realloc(requested) {\n        const needed = this._m32[1280 /* P32.STATE_WP */] + requested;\n        if (this._bytes < needed) {\n            if (needed > this.maxBytes) {\n                return -3 /* DecodeStatus.SIZE_EXCEEDED */;\n            }\n            let newSize = this._bytes;\n            while ((newSize *= 2) < needed) { }\n            newSize = Math.min(newSize, this.maxBytes);\n            if (newSize < needed) {\n                return -3 /* DecodeStatus.SIZE_EXCEEDED */;\n            }\n            if (newSize + 5152 /* Bytes._DATA_OFFSET */ > this._mem.buffer.byteLength) {\n                const addPages = Math.ceil((newSize + 5152 /* Bytes._DATA_OFFSET */ - this._mem.buffer.byteLength) / 65536);\n                this._mem.grow(addPages);\n                this._m32 = new Uint32Array(this._mem.buffer, 0);\n                this._d = new Uint8Array(this._mem.buffer, 5152 /* Bytes._DATA_OFFSET */);\n            }\n            this._bytes = newSize;\n        }\n        return 0 /* DecodeStatus.OK */;\n    }\n    /**\n     * Put bytes in `data` into the decoder.\n     * Additionally decodes the payload, if it reached 2^17 bytes.\n     * The return value indicates the type of issue.\n     * @param data Bytes to be loaded.\n     */\n    put(data) {\n        if (!this._inst || this._ended) {\n            return -2 /* DecodeStatus.NOT_INITIALIZED */;\n        }\n        if (this._realloc(data.length)) {\n            return -3 /* DecodeStatus.SIZE_EXCEEDED */;\n        }\n        const m = this._m32;\n        this._d.set(data, m[1280 /* P32.STATE_WP */]);\n        m[1280 /* P32.STATE_WP */] += data.length;\n        // max chunk in input handler is 2^17, try to run in \"tandem mode\"\n        return m[1280 /* P32.STATE_WP */] - m[1281 /* P32.STATE_SP */] >= 131072\n            ? this._inst.exports.dec()\n            : 0 /* DecodeStatus.OK */;\n    }\n    /**\n     * End the current decoding.\n     * Also decodes leftover payload from previous put calls.\n     */\n    end() {\n        this._ended = true;\n        return this._inst\n            ? this._inst.exports.end()\n            : -2 /* DecodeStatus.NOT_INITIALIZED */;\n    }\n    /**\n     * Bytes loaded into the decoder.\n     */\n    get loadedBytes() {\n        return this._inst\n            ? this._m32[1280 /* P32.STATE_WP */]\n            : 0;\n    }\n    /**\n     * Free bytes to feed to the decoder.\n     */\n    get freeBytes() {\n        return this._inst\n            ? this.maxBytes - this._m32[1280 /* P32.STATE_WP */]\n            : 0;\n    }\n}\nexports.default = Base64Decoder;\n//# sourceMappingURL=Base64Decoder.wasm.js.map","\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\n/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\nconst inwasm_runtime_1 = require(\"inwasm-runtime\");\nconst wasmQoiDecode = (0, inwasm_runtime_1.InWasm)(/*inwasm#459f9e1bfb80b1a8:rdef-start:\"qoi_decode\"*/{s:1,t:0,d:'AGFzbQEAAAABCgJgAABgA39/fwACDwEDZW52Bm1lbW9yeQIAAQMDAgABBwcBA2RlYwABCAEACu4EAgwAQQBBAEGAAvwLAAveBAEJf0EAQQBBgAL8CwAgAUEXTgRAIAAgAWpBCGshCkGACCEBIAJBAnRBgAhqIQsgAEEOaiEDQf8BIQZBACECA0AgA0EBaiEHIAMtAAAiCEE/cSEAAkACQCAIQcABcSIJRQRAIABBAnQiAC0AAyEGIAAtAAIhBCAALQABIQUgAC0AACECIAchAwwBCwJAIAhB/QFLDQAgCUHAAUcNACAFQQVsIAJBA2xqIARBB2xqIAZBC2xqQT9xQQJ0IgMgBDoAAiADIAU6AAEgAyACOgAAIANBA2ogBjoAAANAIAEgAjoAACABQQNqIAY6AAAgAUECaiAEOgAAIAFBAWogBToAACABQQRqIQEgAEUEQCAHIQMMBAsgAEEBayEAIAEgC0kNAAsgByEDDAILAn8CQAJAAkAgCEH+AWsOAgABAgsgAy0AAyEEIAMtAAIhBSADLQABIQIgA0EEagwCCyADKAIBIgJBGHYhBiACQRB2IQQgAkEIdiEFIANBBWoMAQsgCUGAAUcEQCAHIAlBwABHDQEaIAQgCEEDcWpBAmshBCACIABBBHZqQQJrIQIgBSAIQQJ2QQNxakECayEFIAcMAQsgBCAAQShrIgkgAy0AASIHQQ9xamohBCACIAdBBHYgCWpqIQIgACAFakEgayEFIANBAmoLIQMgBUEFbCACQQNsaiAEQQdsaiAGQQtsakE/cUECdCIAIAQ6AAIgACAFOgABIAAgAjoAACAAQQNqIAY6AAALIAEgBjoAAyABIAQ6AAIgASAFOgABIAEgAjoAACABQQRqIQELIAMgCkkNAAsLCw=='}/*inwasm#459f9e1bfb80b1a8:rdef-end:\"qoi_decode\"*/);\nclass QoiDecoder {\n    constructor(keepSize) {\n        this.keepSize = keepSize;\n        this.width = 0;\n        this.height = 0;\n    }\n    decode(d) {\n        this.width = d[4] << 24 | d[5] << 16 | d[6] << 8 | d[7];\n        this.height = d[8] << 24 | d[9] << 16 | d[10] << 8 | d[11];\n        const pixels = this.width * this.height;\n        const ib = pixels * 4;\n        const dl = d.length;\n        /**\n         * byte/offset calculation:\n         * To save some memory we dont reserve full memory for decoded + encoded,\n         * but place encoded at the end of decoded plus 50% security distance\n         * to avoid reads before writes positions:\n         *\n         * encoded < decoded (good compression)\n         *    enc                                              ####################\n         *    dec                 #######################################\n         *                        ^                            ^\n         *                        DST_P                        CHUNK_P\n         *\n         * encoded > decoded (degenerated compression, should not happen)\n         *    enc                           ##############################\n         *    dec                 ####################\n         *                        ^         ^\n         *                        DST_P     CHUNK_P\n         *\n         * There is still a chance for overlapping r/w positions in case the compressed\n         * data has very different pixel progression, yet the 50% security distance\n         * should deal with that, as QOI will bloat data by 25% at max (RGB -> OP byte + RGB).\n         * Since we always assume RGBA at decoding stage, the possible bloat reduces to 20% at max.\n         */\n        const bytes = Math.max(ib, dl) + (Math.min(ib, dl) >> 1) + 4096;\n        if (!this._inst) {\n            this._mem = new WebAssembly.Memory({ initial: Math.ceil(bytes / 65536) });\n            this._inst = wasmQoiDecode({ env: { memory: this._mem } });\n        }\n        else if (this._mem.buffer.byteLength < bytes) {\n            this._mem.grow(Math.ceil((bytes - this._mem.buffer.byteLength) / 65536));\n            this._d = null;\n        }\n        if (!this._d) {\n            this._d = new Uint8Array(this._mem.buffer);\n        }\n        // put src data at the end of memory, also align to 256\n        const chunkP = (this._mem.buffer.byteLength - dl) & ~0xFF;\n        this._d.set(d, chunkP);\n        this._inst.exports.dec(chunkP, dl, pixels);\n        return this._d.subarray(1024 /* P8.DST_P */, 1024 /* P8.DST_P */ + ib);\n    }\n    release() {\n        if (!this._inst)\n            return;\n        if (this._mem.buffer.byteLength > this.keepSize) {\n            this._inst = this._d = this._mem = null;\n        }\n    }\n}\nexports.default = QoiDecoder;\n//# sourceMappingURL=QoiDecoder.wasm.js.map","\"use strict\";\n/**\n * Copyright (c) 2022, 2026 Joerg Breitbart\n * @license MIT\n */\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.InWasm = InWasm;\nlet z = (s) => {\n    if (Uint8Array.fromBase64)\n        return Uint8Array.fromBase64(s);\n    if (typeof Buffer !== 'undefined')\n        return Buffer.from(s, 'base64');\n    const b = atob(s);\n    const r = new Uint8Array(b.length);\n    for (let i = 0; i < r.length; ++i)\n        r[i] = b.charCodeAt(i);\n    return r;\n};\nfunction InWasm(def) {\n    if (def.d) {\n        const { t, s, d } = def;\n        let b;\n        let m;\n        const W = WebAssembly;\n        if (t === 0 /* OutputType.INSTANCE */) {\n            if (s)\n                return (e) => new W.Instance(m || (m = new W.Module(b || (b = z(d)))), e);\n            return (e) => m\n                ? W.instantiate(m, e)\n                : W.instantiate(b || (b = z(d)), e).then(r => (m = r.module) && r.instance);\n        }\n        if (t === 1 /* OutputType.MODULE */) {\n            if (s)\n                return () => m || (m = new W.Module(b || (b = z(d))));\n            return () => m\n                ? Promise.resolve(m)\n                : W.compile(b || (b = z(d))).then(r => m = r);\n        }\n        if (s)\n            return () => b || (b = z(d));\n        return () => Promise.resolve(b || (b = z(d)));\n    }\n    if (typeof _wasmCtx === 'undefined')\n        throw new Error('must run \"inwasm\"');\n    _wasmCtx.add(def);\n}\n//# sourceMappingURL=index.js.map","// The module cache\nvar __webpack_module_cache__ = {};\n\n// The require function\nfunction __webpack_require__(moduleId) {\n\t// Check if module is in cache\n\tvar cachedModule = __webpack_module_cache__[moduleId];\n\tif (cachedModule !== undefined) {\n\t\treturn cachedModule.exports;\n\t}\n\t// Create a new module (and put it into the cache)\n\tvar module = __webpack_module_cache__[moduleId] = {\n\t\t// no module.id needed\n\t\t// no module.loaded needed\n\t\texports: {}\n\t};\n\n\t// Execute the module function\n\t__webpack_modules__[moduleId].call(module.exports, module, module.exports, __webpack_require__);\n\n\t// Return the exports of the module\n\treturn module.exports;\n}\n\n","/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport type { ITerminalAddon, IDisposable } from '@xterm/xterm';\nimport type { ImageAddon as IImageApi } from '@xterm/addon-image';\nimport { Emitter, type IEvent } from 'common/Event';\nimport { IIPHandler } from './IIPHandler';\nimport { ImageRenderer } from './ImageRenderer';\nimport { ImageStorage, CELL_SIZE_DEFAULT } from './ImageStorage';\nimport { KittyGraphicsHandler } from './kitty/KittyGraphicsHandler';\nimport { KittyImageStorage } from './kitty/KittyImageStorage';\nimport { SixelHandler } from './SixelHandler';\nimport { SixelImageStorage } from './SixelImageStorage';\nimport { IIPImageStorage } from './IIPImageStorage';\nimport { ITerminalExt, IImageAddonOptions, IResetHandler } from './Types';\n\n\n/**\n * Document VT features provided by this addon.\n *\n * @vt: #E[Supported via @xterm/addon-image.] DCS SIXEL \"SIXEL Graphics\"  \"DCS Ps ; Ps ; Ps ; q Pt ST\"  \"Draw SIXEL image.\"\n *\n * Sixel support is provided by the addon @xterm/addon-image with these limitations:\n * - immediate coloring (no shared palette, allows high color settings of `img2sixel`)\n * - max. palette size of 4096 colors\n * - max. pixel width of 16K\n * - max. 25 MB per sixel sequence\n * - VT340 cursor positioning (begin of last sixel data row)\n *\n * See [addon readme](https://github.com/xtermjs/xterm.js/tree/master/addons/addon-image) for more details.\n *\n *\n * @vt: #E[Supported via @xterm/addon-image.] OSC 1337  \"iTerm2 Commands\"   \"OSC 1337 ; Pt BEL\"  \"Custom iTerm2 commands.\"\n *\n * Only the inline image protocol (IIP) is supported by the addon @xterm/addon-image with\n * the following limitations:\n * - sequence:\n *   - format: `OSC 1337 ; File=inline=1 ; size=<unencoded size> ; ... : <base64 payload> BEL`\n *   - size param must be set and payload may not exceed CEIL(size * 4 / 3)\n *   - strict base64 handling as of RFC4648 §4 (standard alphabet, optional padding,\n *     no separator bytes allowed)\n *   - supported params: size, name, width, height, preserveAspectRatio\n * - image formats: PNG, JPEG and GIF\n * - no animation support (renders first image of a GIF)\n * - no multipart support\n * - VT340 cursor positioning (begin of last sixel data row)\n *\n * See [addon readme](https://github.com/xtermjs/xterm.js/tree/master/addons/addon-image)\n * and [iTerm2 IIP docs](https://iterm2.com/documentation-images.html) for more details.\n *\n *\n * @vt: #E[Supported via @xterm/addon-image.] APC KITTY_GRAPHICS \"Kitty Graphics\"  \"APC G Pt ST\"  \"Kitty Graphics Protocol.\"\n *\n * Kitty graphics support is provided by the addon @xterm/addon-image.\n * Note that while basic image output already works, this is still work in progress.\n */\n\n// default values of addon ctor options\nconst DEFAULT_OPTIONS: IImageAddonOptions = {\n  enableSizeReports: true,\n  pixelLimit: 16777216, // limit to 4096 * 4096 pixels\n  sixelSupport: true,\n  sixelScrolling: true,\n  sixelPaletteLimit: 4096,\n  sixelSizeLimit: 33554432,\n  storageLimit: 128,\n  showPlaceholder: true,\n  iipSupport: true,\n  iipSizeLimit: 33554432,\n  kittySupport: true,\n  kittySizeLimit: 33554432\n};\n\n// max palette size supported by the sixel lib (compile time setting)\nconst MAX_SIXEL_PALETTE_SIZE = 4096;\n\n// definitions for _xtermGraphicsAttributes sequence\nconst enum GaItem {\n  COLORS = 1,\n  SIXEL_GEO = 2,\n  REGIS_GEO = 3\n}\nconst enum GaAction {\n  READ = 1,\n  SET_DEFAULT = 2,\n  SET = 3,\n  READ_MAX = 4\n}\nconst enum GaStatus {\n  SUCCESS = 0,\n  ITEM_ERROR = 1,\n  ACTION_ERROR = 2,\n  FAILURE = 3\n}\n\n\nexport class ImageAddon implements ITerminalAddon, IImageApi {\n  private _opts: IImageAddonOptions;\n  private _defaultOpts: IImageAddonOptions;\n  private _storage: ImageStorage | undefined;\n  private _renderer: ImageRenderer | undefined;\n  private _disposables: IDisposable[] = [];\n  private _terminal: ITerminalExt | undefined;\n  private _handlers: Map<String, IResetHandler> = new Map();\n  private readonly _onImageAdded = new Emitter<void>();\n  public readonly onImageAdded: IEvent<void> = this._onImageAdded.event;\n\n  constructor(opts?: Partial<IImageAddonOptions>) {\n    this._opts = Object.assign({}, DEFAULT_OPTIONS, opts);\n    this._defaultOpts = Object.assign({}, DEFAULT_OPTIONS, opts);\n  }\n\n  public dispose(): void {\n    for (const handler of this._handlers.values()) handler.reset();\n    for (const obj of this._disposables) {\n      obj.dispose();\n    }\n    this._disposables.length = 0;\n    this._handlers.clear();\n    this._onImageAdded.dispose();\n  }\n\n  private _disposeLater(...args: IDisposable[]): void {\n    for (const obj of args) {\n      this._disposables.push(obj);\n    }\n  }\n\n  public activate(terminal: ITerminalExt): void {\n    this._terminal = terminal;\n\n    // internal data structures\n    this._renderer = new ImageRenderer(terminal);\n    this._storage = new ImageStorage(terminal, this._renderer, this._opts);\n    this._storage.onImageAdded = () => this._onImageAdded.fire();\n\n    // enable size reports\n    if (this._opts.enableSizeReports) {\n      const windowOps = terminal.options.windowOptions ?? {};\n      windowOps.getWinSizePixels = true;\n      windowOps.getCellSizePixels = true;\n      windowOps.getWinSizeChars = true;\n      terminal.options.windowOptions = windowOps;\n    }\n\n    this._disposeLater(\n      this._renderer,\n      this._storage,\n\n      // DECSET/DECRST/DA1/XTSMGRAPHICS handlers\n      terminal.parser.registerCsiHandler({ prefix: '?', final: 'h' }, params => this._decset(params)),\n      terminal.parser.registerCsiHandler({ prefix: '?', final: 'l' }, params => this._decrst(params)),\n      terminal.parser.registerCsiHandler({ final: 'c' }, params => this._da1(params)),\n      terminal.parser.registerCsiHandler({ prefix: '?', final: 'S' }, params => this._xtermGraphicsAttributes(params)),\n\n      // render hook\n      terminal.onRender(range => this._storage?.render(range)),\n\n      /**\n       * reset handlers covered:\n       * - DECSTR\n       * - RIS\n       * - Terminal.reset()\n       */\n      terminal.parser.registerCsiHandler({ intermediates: '!', final: 'p' }, () => this.reset()),\n      terminal.parser.registerEscHandler({ final: 'c' }, () => this.reset()),\n      terminal._core._inputHandler.onRequestReset(() => this.reset()),\n\n      // wipe canvas and delete alternate images on buffer switch\n      terminal.buffer.onBufferChange(() => this._storage?.wipeAlternate()),\n\n      // extend images to the right on resize\n      terminal.onResize(metrics => this._storage?.viewportResize(metrics))\n    );\n\n    // SIXEL handler\n    if (this._opts.sixelSupport) {\n      const sixelStorage = new SixelImageStorage(this._storage!, this._opts, this._renderer!, terminal);\n      const sixelHandler = new SixelHandler(this._opts, sixelStorage, terminal);\n      this._handlers.set('sixel', sixelHandler);\n      this._disposeLater(\n        terminal._core._inputHandler._parser.registerDcsHandler({ final: 'q' }, sixelHandler)\n      );\n    }\n\n    // iTerm IIP handler\n    if (this._opts.iipSupport) {\n      const iipStorage = new IIPImageStorage(this._storage!);\n      const iipHandler = new IIPHandler(this._opts, this._renderer!, iipStorage, terminal);\n      this._handlers.set('iip', iipHandler);\n      this._disposeLater(\n        terminal._core._inputHandler._parser.registerOscHandler(1337, iipHandler)\n      );\n    }\n\n    // Kitty graphics handler\n    if (this._opts.kittySupport) {\n      const kittyStorage = new KittyImageStorage(this._storage!);\n      const kittyHandler = new KittyGraphicsHandler(this._opts, this._renderer!, kittyStorage, terminal);\n      this._handlers.set('kitty', kittyHandler);\n      this._disposeLater(\n        kittyStorage,\n        kittyHandler,\n        terminal._core._inputHandler._parser.registerApcHandler({ final: 'G' }, kittyHandler)\n      );\n    }\n  }\n\n  // Note: storageLimit is skipped here to not intoduce a surprising side effect.\n  public reset(): boolean {\n    // reset options customizable by sequences to defaults\n    this._opts.sixelScrolling = this._defaultOpts.sixelScrolling;\n    this._opts.sixelPaletteLimit = this._defaultOpts.sixelPaletteLimit;\n    // also clear image storage\n    this._storage?.reset();\n    // reset protocol handlers\n    for (const handler of this._handlers.values()) {\n      handler.reset();\n    }\n    return false;\n  }\n\n  public get storageLimit(): number {\n    return this._storage?.getLimit() || -1;\n  }\n\n  public set storageLimit(limit: number) {\n    this._storage?.setLimit(limit);\n    this._opts.storageLimit = limit;\n  }\n\n  public get storageUsage(): number {\n    if (this._storage) {\n      return this._storage.getUsage();\n    }\n    return -1;\n  }\n\n  public get showPlaceholder(): boolean {\n    return this._opts.showPlaceholder;\n  }\n\n  public set showPlaceholder(value: boolean) {\n    this._opts.showPlaceholder = value;\n    this._renderer?.showPlaceholder(value);\n  }\n\n  public getImageAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    return this._storage?.getImageAtBufferCell(x, y);\n  }\n\n  public extractTileAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    return this._storage?.extractTileAtBufferCell(x, y);\n  }\n\n  private _report(s: string): void {\n    this._terminal?._core.input(s, false);\n  }\n\n  private _decset(params: (number | number[])[]): boolean {\n    for (let i = 0; i < params.length; ++i) {\n      switch (params[i]) {\n        case 80:\n          this._opts.sixelScrolling = false;\n          break;\n      }\n    }\n    return false;\n  }\n\n  private _decrst(params: (number | number[])[]): boolean {\n    for (let i = 0; i < params.length; ++i) {\n      switch (params[i]) {\n        case 80:\n          this._opts.sixelScrolling = true;\n          break;\n      }\n    }\n    return false;\n  }\n\n  // overload DA to return something more appropriate\n  private _da1(params: (number | number[])[]): boolean {\n    if (params[0]) {\n      return true;\n    }\n    // reported features:\n    // 62 - VT220\n    // 4 - SIXEL support\n    // 9 - charsets\n    // 22 - ANSI colors\n    if (this._opts.sixelSupport) {\n      this._report(`\\x1b[?62;4;9;22c`);\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * Implementation of xterm's graphics attribute sequence.\n   *\n   * Supported features:\n   * - read/change palette limits (max 4096 by sixel lib)\n   * - read SIXEL canvas geometry (reports current window canvas or\n   *   squared pixelLimit if canvas > pixel limit)\n   *\n   * Everything else is deactivated.\n   */\n  private _xtermGraphicsAttributes(params: (number | number[])[]): boolean {\n    if (params.length < 2) {\n      return true;\n    }\n    if (params[0] === GaItem.COLORS) {\n      switch (params[1]) {\n        case GaAction.READ:\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${this._opts.sixelPaletteLimit}S`);\n          return true;\n        case GaAction.SET_DEFAULT:\n          this._opts.sixelPaletteLimit = this._defaultOpts.sixelPaletteLimit;\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${this._opts.sixelPaletteLimit}S`);\n          // also reset protocol handlers for now\n          for (const handler of this._handlers.values()) {\n            handler.reset();\n          }\n          return true;\n        case GaAction.SET:\n          if (params.length > 2 && !(params[2] instanceof Array) && params[2] <= MAX_SIXEL_PALETTE_SIZE) {\n            this._opts.sixelPaletteLimit = params[2];\n            this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${this._opts.sixelPaletteLimit}S`);\n          } else {\n            this._report(`\\x1b[?${params[0]};${GaStatus.ACTION_ERROR}S`);\n          }\n          return true;\n        case GaAction.READ_MAX:\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${MAX_SIXEL_PALETTE_SIZE}S`);\n          return true;\n        default:\n          this._report(`\\x1b[?${params[0]};${GaStatus.ACTION_ERROR}S`);\n          return true;\n      }\n    }\n    if (params[0] === GaItem.SIXEL_GEO) {\n      switch (params[1]) {\n        // we only implement read and read_max here\n        case GaAction.READ:\n          let width = this._renderer?.dimensions?.css.canvas.width;\n          let height = this._renderer?.dimensions?.css.canvas.height;\n          if (!width || !height) {\n            // for some reason we have no working image renderer\n            // --> fallback to default cell size\n            const cellSize = CELL_SIZE_DEFAULT;\n            width = (this._terminal?.cols || 80) * cellSize.width;\n            height = (this._terminal?.rows || 24) * cellSize.height;\n          }\n          if (width * height < this._opts.pixelLimit) {\n            this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${width.toFixed(0)};${height.toFixed(0)}S`);\n          } else {\n            // if we overflow pixelLimit report that squared instead\n            const x = Math.floor(Math.sqrt(this._opts.pixelLimit));\n            this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${x};${x}S`);\n          }\n          return true;\n        case GaAction.READ_MAX:\n          // read_max returns pixelLimit as square area\n          const x = Math.floor(Math.sqrt(this._opts.pixelLimit));\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${x};${x}S`);\n          return true;\n        default:\n          this._report(`\\x1b[?${params[0]};${GaStatus.ACTION_ERROR}S`);\n          return true;\n      }\n    }\n    // exit with error on ReGIS or any other requests\n    this._report(`\\x1b[?${params[0]};${GaStatus.ITEM_ERROR}S`);\n    return true;\n  }\n}\n"],"names":["root","factory","exports","module","define","amd","globalThis","red","n","green","blue","toRGBA8888","r","g","b","a","clamp","low","high","value","Math","max","min","h2c","t1","t2","c","normalizeRGB","round","Object","defineProperty","DEFAULT_FOREGROUND","DEFAULT_BACKGROUND","PALETTE_ANSI_256","PALETTE_VT340_GREY","PALETTE_VT340_COLOR","normalizeHLS","nearestColorIndex","fromRGBA8888","alpha","BIG_ENDIAN","Uint8Array","Uint32Array","buffer","console","warn","color","palette","Number","MAX_SAFE_INTEGER","idx","i","length","dr","dg","db","d","h","l","s","v","HLStoRGB","p","push","decodeAsync","decode","Decoder","DecoderAsync","Colors_1","__webpack_require__","wasm_1","WASM_BYTES","Buffer","from","bytestring","atob","result","charCodeAt","decodeBase64","LIMITS","BYTES","WASM_MODULE","NULL_CANVAS","CallbackProxy","constructor","this","bandHandler","width","modeHandler","mode","handle_band","mode_parsed","DEFAULT_OPTIONS","memoryLimit","sixelColor","fillColor","paletteLimit","PALETTE_SIZE","truncate","opts","cbProxy","importObj","env","bind","WebAssembly","instantiate","then","inst","instance","_instance","_cbProxy","_PIXEL_OFFSET","MAX_WIDTH","_canvas","_bandWidths","_maxWidth","_minWidth","_lastOffset","_currentHeight","_opts","assign","Error","_handle_band","_initCanvas","Module","Instance","_wasm","_chunk","memory","get_chunk_address","CHUNK_SIZE","_states","get_state_address","_palette","get_palette_address","set","_pSrc","get_p0_address","init","_fillColor","_truncate","_rasterWidth","_rasterHeight","_width","_height","_level","_mode","_paletteLimit","pixels","height","release","_realloc","offset","additionalPixels","newCanvas","ceil","adv","remaining","subarray","current_width","current_height","memoryUsage","byteLength","properties","level","memUsage","rasterAttributes","numerator","denominator","data","start","end","decodeString","j","data32","currentWidth","fill","escape","final","finalOffset","bw","currentHeight","data8","Uint8ClampedArray","dec","async","Lifecycle_1","EventUtils","_listeners","_disposed","event","_event","listener","thisArgs","disposables","toDisposable","entry","fn","slice","indexOf","splice","Array","isArray","add","fire","call","listeners","len","dispose","forward","to","e","map","undefined","any","events","store","DisposableStore","runAndSubscribe","handler","initial","arg","_disposables","Set","_isDisposed","isDisposed","o","clear","Disposable","_store","_register","None","freeze","_value","ImageRenderer_1","ImageStorage_1","Base64Decoder_wasm_1","__importDefault","QoiDecoder_wasm_1","IIPHeaderParser_1","IIPMetrics_1","DEFAULT_HEADER","type","name","size","preserveAspectRatio","inline","_renderer","_storage","_coreTerminal","_generation","_aborted","_hp","HeaderParser","_header","_isMultipart","_abortMulti","maxEncodedBytes","iipSizeLimit","initialBytes","_dec","default","_qoiDec","reset","put","state","dataPos","parse","fields","_initDecoder","success","seqType","w","CELL_SIZE_DEFAULT","dimensions","css","canvas","cols","rows","scale","_c","_a","_core","_coreBrowserService","dpr","report","toFixed","input","cond","blob","metrics","UNSUPPORTED_TYPE","imageType","mime","pixelLimit","_resize","floor","ImageData","byteOffset","ImageRenderer","createCanvas","_b","getContext","putImageData","addImage","Blob","generation","createImageBitmap","resizeWidth","resizeHeight","bm","close","catch","cw","cell","ch","_d","rw","_dim","rh","wf","hf","f","total","cdim","endsWith","parseInt","toStr","String","fromCharCode","toInt","toSize","match","DECODERS","toString","bs","TextDecoder","FILE_MARKER","MULTIPARTFILE_MARKER","FILEPART_MARKER","FILEEND_MARKER","REPORTCELLSIZE_MARKER","MAX_FIELDCHARS","_buffer","_position","_key","k","_storeValue","pos","_storeKey","_addImageOpts","scrolling","layer","zIndex","cursorPos","img","d32","blockLength","jpgSize","dim","limit","_layers","get","localDocument","document","createElement","createImageData","ctx","imgData","Promise","resolve","_terminal","super","Map","_optionsRefresh","MutableDisposable","_oldOpen","open","parent","_open","screenElement","optionsService","onOptionChange","option","rescaleCanvas","_renderService","refreshRows","removeLayerFromDom","_oldSetRenderer","setRenderer","_placeholderBitmap","_placeholder","showPlaceholder","cellSize","_createPlaceHolder","clearLines","y","clearRect","_e","clearAll","draw","imgSpec","tileId","col","row","count","_rescaleImage","actual","sourceWidth","sourceHeight","actualCellSize","sx","sy","dx","dy","finalWidth","finalHeight","drawImage","extractTile","drawPlaceholder","values","spec","originalWidth","originalHeight","origCellSize","orig","scaledWidth","scaledHeight","renderer","key","keys","insertLayerToDom","has","classList","style","isolation","insertBefore","firstChild","appendChild","remove","delete","hasLayer","bWidth","blueprint","black","white","shift","x","screen","ctx2","placeholder","bitmap","window","ExtendedAttrsImage","ext","_urlId","_ext","underlineStyle","underlineColor","underlineVariantOffset","val","urlId","imageId","clone","isEmpty","EMPTY_ATTRS","_images","_lastId","_lowestId","_fullyCleared","_needsFullClear","_pixelLimit","setLimit","storageLimit","error","message","getLimit","_viewportMetrics","marker","RangeError","_evictOldest","getUsage","_getStoredPixels","storedPixels","_delImg","id","ImageBitmap","onImageDeleted","wipeAlternate","zero","entries","bufferType","deleteImage","termCols","termRows","originX","originY","tileCount","_inputHandler","_dirtyRowTracker","markDirty","line","lines","ybase","_writeToCell","lineFeed","endMarker","registerMarker","onDispose","active","_evictOnAlternate","onImageAdded","render","range","hasTopImages","hasBottomImages","drawCalls","placeholderCalls","ydisp","getBg","_extendedAttrs","startTile","startCol","sort","viewportResize","oldCol","tilesPerRow","hasData","rightCol","_data","lastTile","expandCol","getImageAtBufferCell","extractTileAtBufferCell","room","used","current","old","oldSpec","imgId","Decoder_1","DEFAULT_PALETTE","idleDecoders","poolPrimed","releaseDecoder","idle","convertLe","_size","_decMemoryLimit","_returnDecoder","hook","params","pop","acquireDecoder","attr","colors","bg","isInverse","isFgDefault","foreground","rgba","isFgRGB","t","toColorRGB","getFgColor","ansi","isBgDefault","background","isBgRGB","getBgColor","extractActiveBg","_curAttrData","_themeService","sixelPaletteLimit","sixelSizeLimit","unhook","_unhook","advanceCursor","sixelScrolling","KittyGraphicsTypes_1","_kittyStorage","_decodeError","_activeDecoder","_inControlData","_controlData","_controlLength","_encodedSizeLimit","_totalEncodedSize","_parsedCommand","_pendingTransmissions","_maxEncodedBytes","kittySizeLimit","_initialEncodedBytes","_cleanupAllPending","_removePendingEntry","_lastPendingKey","pending","decoder","controlEnd","copyLength","parseKittyCommand","_parseControlDataString","imageNumber","_sendResponse","quiet","action","payloadStart","_streamPayload","pendingKey","previousEncodedSize","_f","totalEncodedSize","decoderToRelease","_g","decoderCapacity","_h","maxPending","oldest","next","cmd","_j","_k","_handleNoPayloadCommand","_handleDelete","isMoreComing","more","decodeError","finalCmd","imageBytes","_handleCommandWithBytesAndCmd","str","fromCodePoint","_handlePlacement","bytes","_handleTransmit","transmission","_handleTransmitDisplay","_handleQuery","image","getImage","_displayImage","placementId","storeImage","format","compression","lastImageId","expectedBytes","deleteSelector","deleteAll","deleteById","isOk","response","coreService","triggerDataEvent","_decodeAndDisplay","_createBitmap","cropX","cropY","cropW","cropH","maxCropW","maxCropH","finalCropW","finalCropH","cropped","imgCols","imgRows","columns","savedX","savedY","savedYbase","scaled","xOffset","yOffset","canvasW","canvasH","offsetCanvas","offsetCtx","offsetBitmap","cursorMovement","scrolled","arrayBuffer","_decompressZlib","url","URL","createObjectURL","Image","reject","addEventListener","revokeObjectURL","src","pixelCount","src32","dst32","alignedPixels","srcOffset","dstOffset","b0","b1","b2","srcByte","dstByte","compressed","_decompress","offsetIn","reader","ReadableStream","pull","controller","enqueue","pipeThrough","DecompressionStream","getReader","chunks","totalLength","done","read","cancel","releaseLock","chunk","images","_kittyIdToStorageId","kittyIdToStorageId","pendingTransmissions","parts","split","part","eqIdx","substring","numValue","KittyImageStorage","_nextImageId","_storageIdToKittyId","_handleStorageImageDeleted","storageId","kittyId","_previousOnImageDeleted","_wrappedOnImageDeleted","imageData","oldStorageId","_maxStoredImages","_evictUndisplayedImages","byteLimit","retainedBytes","evictPlaced","oldestId","wasmDecode","InWasm","MAP","el","D","EMPTY","keepSize","maxBytes","_inst","_ended","_bytes","_m32","_mem","m","grow","Memory","requested","needed","newSize","addPages","loadedBytes","freeBytes","wasmQoiDecode","ib","dl","chunkP","def","W","z","compile","_wasmCtx","fromBase64","__webpack_module_cache__","moduleId","cachedModule","__webpack_modules__","Event_1","IIPHandler_1","KittyGraphicsHandler_1","KittyImageStorage_1","SixelHandler_1","SixelImageStorage_1","IIPImageStorage_1","enableSizeReports","sixelSupport","iipSupport","kittySupport","_handlers","_onImageAdded","Emitter","_defaultOpts","obj","_disposeLater","args","activate","terminal","ImageStorage","windowOps","options","windowOptions","getWinSizePixels","getCellSizePixels","getWinSizeChars","parser","registerCsiHandler","prefix","_decset","_decrst","_da1","_xtermGraphicsAttributes","onRender","intermediates","registerEscHandler","onRequestReset","onBufferChange","onResize","sixelStorage","SixelImageStorage","sixelHandler","SixelHandler","_parser","registerDcsHandler","iipStorage","IIPImageStorage","iipHandler","IIPHandler","registerOscHandler","kittyStorage","kittyHandler","KittyGraphicsHandler","registerApcHandler","storageUsage","_report","sqrt"],"sourceRoot":""}
 \ No newline at end of file
 diff --git a/lib/addon-image.mjs b/lib/addon-image.mjs
-index 753a4f833c038a3f45802377dcb16a93695f2161..29c3984db57b888a058165c8aa02ccbcf8efcd2f 100644
+index 753a4f833c038a3f45802377dcb16a93695f2161..aca74ad0c769e8525bc5e4ab8cc6dda03959f760 100644
 --- a/lib/addon-image.mjs
 +++ b/lib/addon-image.mjs
 @@ -14,5 +14,5 @@
@@ -26,10 +26,10 @@ index 753a4f833c038a3f45802377dcb16a93695f2161..29c3984db57b888a058165c8aa02ccbc
   *  Licensed under the MIT License. See License.txt in the project root for license information.
   *--------------------------------------------------------------------------------------------*/
 -var it=Object.create;var Te=Object.defineProperty;var At=Object.getOwnPropertyDescriptor;var rt=Object.getOwnPropertyNames;var st=Object.getPrototypeOf,nt=Object.prototype.hasOwnProperty;var x=(r,e)=>()=>{try{return e||r((e={exports:{}}).exports,e),e.exports}catch(t){throw e=0,t}};var at=(r,e,t,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let A of rt(e))!nt.call(r,A)&&A!==t&&Te(r,A,{get:()=>e[A],enumerable:!(i=At(e,A))||i.enumerable});return r};var M=(r,e,t)=>(t=r!=null?it(st(r)):{},at(e||!r||!r.__esModule?Te(t,"default",{value:r,enumerable:!0}):t,r));var X=x(_=>{"use strict";Object.defineProperty(_,"__esModule",{value:!0});_.DEFAULT_FOREGROUND=_.DEFAULT_BACKGROUND=_.PALETTE_ANSI_256=_.PALETTE_VT340_GREY=_.PALETTE_VT340_COLOR=_.normalizeHLS=_.normalizeRGB=_.nearestColorIndex=_.fromRGBA8888=_.toRGBA8888=_.alpha=_.blue=_.green=_.red=_.BIG_ENDIAN=void 0;_.BIG_ENDIAN=new Uint8Array(new Uint32Array([4278190080]).buffer)[0]===255;_.BIG_ENDIAN&&console.warn("BE platform detected. This version of node-sixel works only on LE properly.");function xe(r){return r&255}_.red=xe;function Me(r){return r>>>8&255}_.green=Me;function ve(r){return r>>>16&255}_.blue=ve;function ht(r){return r>>>24&255}_.alpha=ht;function B(r,e,t,i=255){return((i&255)<<24|(t&255)<<16|(e&255)<<8|r&255)>>>0}_.toRGBA8888=B;function gt(r){return[r&255,r>>8&255,r>>16&255,r>>>24]}_.fromRGBA8888=gt;function It(r,e){let t=xe(r),i=Me(r),A=ve(r),s=Number.MAX_SAFE_INTEGER,n=-1;for(let a=0;a<e.length;++a){let o=t-e[a][0],g=i-e[a][1],h=A-e[a][2],I=o*o+g*g+h*h;if(!I)return a;I<s&&(s=I,n=a)}return n}_.nearestColorIndex=It;function ge(r,e,t){return Math.max(r,Math.min(t,e))}function Ie(r,e,t){return t<0&&(t+=1),t>1&&(t-=1),t*6<1?e+(r-e)*6*t:t*2<1?r:t*3<2?e+(r-e)*(4-t*6):e}function dt(r,e,t){if(!t){let s=Math.round(e*255);return B(s,s,s)}let i=e<.5?e*(1+t):e+t-e*t,A=2*e-i;return B(ge(0,255,Math.round(Ie(i,A,r+1/3)*255)),ge(0,255,Math.round(Ie(i,A,r)*255)),ge(0,255,Math.round(Ie(i,A,r-1/3)*255)))}function m(r,e,t){return(4278190080|Math.round(t/100*255)<<16|Math.round(e/100*255)<<8|Math.round(r/100*255))>>>0}_.normalizeRGB=m;function lt(r,e,t){return dt((r+240%360)/360,e/100,t/100)}_.normalizeHLS=lt;_.PALETTE_VT340_COLOR=new Uint32Array([m(0,0,0),m(20,20,80),m(80,13,13),m(20,80,20),m(80,20,80),m(20,80,80),m(80,80,20),m(53,53,53),m(26,26,26),m(33,33,60),m(60,26,26),m(33,60,33),m(60,33,60),m(33,60,60),m(60,60,33),m(80,80,80)]);_.PALETTE_VT340_GREY=new Uint32Array([m(0,0,0),m(13,13,13),m(26,26,26),m(40,40,40),m(6,6,6),m(20,20,20),m(33,33,33),m(46,46,46),m(0,0,0),m(13,13,13),m(26,26,26),m(40,40,40),m(6,6,6),m(20,20,20),m(33,33,33),m(46,46,46)]);_.PALETTE_ANSI_256=(()=>{let r=[B(0,0,0),B(205,0,0),B(0,205,0),B(205,205,0),B(0,0,238),B(205,0,205),B(0,250,205),B(229,229,229),B(127,127,127),B(255,0,0),B(0,255,0),B(255,255,0),B(92,92,255),B(255,0,255),B(0,255,255),B(255,255,255)],e=[0,95,135,175,215,255];for(let t=0;t<6;++t)for(let i=0;i<6;++i)for(let A=0;A<6;++A)r.push(B(e[t],e[i],e[A]));for(let t=8;t<=238;t+=10)r.push(B(t,t,t));return new Uint32Array(r)})();_.DEFAULT_BACKGROUND=B(0,0,0,255);_.DEFAULT_FOREGROUND=B(255,255,255,255)});var ce=x(le=>{"use strict";Object.defineProperty(le,"__esModule",{value:!0});le.InWasm=Ct;var v=r=>{if(Uint8Array.fromBase64)return Uint8Array.fromBase64(r);if(typeof Buffer<"u")return Buffer.from(r,"base64");let e=atob(r),t=new Uint8Array(e.length);for(let i=0;i<t.length;++i)t[i]=e.charCodeAt(i);return t};function Ct(r){if(r.d){let{t:e,s:t,d:i}=r,A,s,n=WebAssembly;return e===0?t?a=>new n.Instance(s||(s=new n.Module(A||(A=v(i)))),a):a=>s?n.instantiate(s,a):n.instantiate(A||(A=v(i)),a).then(o=>(s=o.module)&&o.instance):e===1?t?()=>s||(s=new n.Module(A||(A=v(i)))):()=>s?Promise.resolve(s):n.compile(A||(A=v(i))).then(a=>s=a):t?()=>A||(A=v(i)):()=>Promise.resolve(A||(A=v(i)))}if(typeof _wasmCtx>"u")throw new Error('must run "inwasm"');_wasmCtx.add(r)}});var ue=x(_e=>{"use strict";Object.defineProperty(_e,"__esModule",{value:!0});var pt=ce(),Bt=(0,pt.InWasm)({s:1,t:0,d:"AGFzbQEAAAABBQFgAAF/Ag8BA2VudgZtZW1vcnkCAAEDAwIAAAcNAgNkZWMAAANlbmQAAQqLBgKZBAEKf0GIKCgCAEGgKGohAUGEKCgCACIDQaAoaiEAQYAoKAIAQQFrQXxxIgRBoChqIQUgBEEQayADSgRAIARBkChqIQMDQCABIABBA2otAABBAnQoAoAgIABBAmotAABBAnQoAoAYIABBAWotAABBAnQoAoAQIAAtAABBAnQoAoAIcnJyIgY2AgAgAUEDaiAAQQdqLQAAQQJ0KAKAICAAQQZqLQAAQQJ0KAKAGCAAQQVqLQAAQQJ0KAKAECAAQQRqLQAAQQJ0KAKACHJyciIHNgIAIAFBBmogAEELai0AAEECdCgCgCAgAEEKai0AAEECdCgCgBggAEEJai0AAEECdCgCgBAgAEEIai0AAEECdCgCgAhycnIiCDYCACABQQlqIABBD2otAABBAnQoAoAgIABBDmotAABBAnQoAoAYIABBDWotAABBAnQoAoAQIABBDGotAABBAnQoAoAIcnJyIgk2AgAgAiAGciAHciAIciAJciECIAFBDGohASAAQRBqIgAgA0kNAAsLIAAgBUkEQANAIAEgAEEDai0AAEECdCgCgCAgAEECai0AAEECdCgCgBggAEEBai0AAEECdCgCgBAgAC0AAEECdCgCgAhycnIiAzYCACACIANyIQIgAUEDaiEBIABBBGoiACAFSQ0ACwtBfyEAIAJB////B00Ef0GEKCAENgIAQYgoIAFBoChrNgIAQQAFQX8LC+0BAQR/AkBBgCgoAgAiAUGEKCgCACIAa0EFTgRAQX8hAxAADQFBgCgoAgAhAUGEKCgCACEAC0F/IQMgASAAayIBQQJIDQAgAC0AoShBAnQoAoAQIAAtAKAoQQJ0KAKACHIhAgJ/IAFBBEYEQEEDQQQgAC0AoyhBPUYbIAAtAKIoQT1GayEBC0EBIAFBA0kNABogAC0AoihBAnQoAoAYIAJyIQJBAiABQQRHDQAaIAAtAKMoQQJ0KAKAICACciECQQMLIQEgAkH///8HSw0AQQAhA0GIKCgCACIAIAI2AKAoQYgoIAAgAWo2AgALIAML"}),S=new Uint8Array("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".split("").map(r=>r.charCodeAt(0))),R=new Uint32Array(1024);R.fill(4278190080);for(let r=0;r<S.length;++r)R[S[r]]=r<<2;for(let r=0;r<S.length;++r)R[256+S[r]]=r>>4|(r<<4&255)<<8;for(let r=0;r<S.length;++r)R[512+S[r]]=r>>2<<8|(r<<6&255)<<16;for(let r=0;r<S.length;++r)R[768+S[r]]=r<<16;var ft=new Uint8Array(0),me=class{constructor(e,t,i){if(this._inst=null,this._ended=!0,this._bytes=0,this.keepSize=e??1048576,this.maxBytes=t??4294901760,this._bytes=i??32768,this._bytes>this.maxBytes||this.maxBytes>4294901760)throw new Error("invalid byte settings")}get data8(){return this._inst?this._d.subarray(0,this._m32[1282]):ft}release(){this._inst&&(this._bytes>this.keepSize?this._inst=this._m32=this._d=this._mem=null:(this._m32[1280]=0,this._m32[1281]=0,this._m32[1282]=0))}init(e,t){if(this.maxBytes=e??this.maxBytes,this._bytes=t??Math.min(this._bytes,this.maxBytes),this._bytes>this.maxBytes||this.maxBytes>4294901760)throw Error("invalid byte settings");let i=this._m32,A=this._bytes+5152;this._inst?this._mem.buffer.byteLength<A&&(this._mem.grow(Math.ceil((A-this._mem.buffer.byteLength)/65536)),i=new Uint32Array(this._mem.buffer,0),this._d=new Uint8Array(this._mem.buffer,5152)):(this._mem=new WebAssembly.Memory({initial:Math.ceil(A/65536)}),this._inst=Bt({env:{memory:this._mem}}),i=new Uint32Array(this._mem.buffer,0),i.set(R,256),this._d=new Uint8Array(this._mem.buffer,5152)),i[1280]=0,i[1281]=0,i[1282]=0,this._m32=i,this._ended=!1}_realloc(e){let t=this._m32[1280]+e;if(this._bytes<t){if(t>this.maxBytes)return-3;let i=this._bytes;for(;(i*=2)<t;);if(i=Math.min(i,this.maxBytes),i<t)return-3;if(i+5152>this._mem.buffer.byteLength){let A=Math.ceil((i+5152-this._mem.buffer.byteLength)/65536);this._mem.grow(A),this._m32=new Uint32Array(this._mem.buffer,0),this._d=new Uint8Array(this._mem.buffer,5152)}this._bytes=i}return 0}put(e){if(!this._inst||this._ended)return-2;if(this._realloc(e.length))return-3;let t=this._m32;return this._d.set(e,t[1280]),t[1280]+=e.length,t[1280]-t[1281]>=131072?this._inst.exports.dec():0}end(){return this._ended=!0,this._inst?this._inst.exports.end():-2}get loadedBytes(){return this._inst?this._m32[1280]:0}get freeBytes(){return this._inst?this.maxBytes-this._m32[1280]:0}};_e.default=me});var Re=x(Ce=>{"use strict";Object.defineProperty(Ce,"__esModule",{value:!0});var Qt=ce(),Dt=(0,Qt.InWasm)({s:1,t:0,d:"AGFzbQEAAAABCgJgAABgA39/fwACDwEDZW52Bm1lbW9yeQIAAQMDAgABBwcBA2RlYwABCAEACu4EAgwAQQBBAEGAAvwLAAveBAEJf0EAQQBBgAL8CwAgAUEXTgRAIAAgAWpBCGshCkGACCEBIAJBAnRBgAhqIQsgAEEOaiEDQf8BIQZBACECA0AgA0EBaiEHIAMtAAAiCEE/cSEAAkACQCAIQcABcSIJRQRAIABBAnQiAC0AAyEGIAAtAAIhBCAALQABIQUgAC0AACECIAchAwwBCwJAIAhB/QFLDQAgCUHAAUcNACAFQQVsIAJBA2xqIARBB2xqIAZBC2xqQT9xQQJ0IgMgBDoAAiADIAU6AAEgAyACOgAAIANBA2ogBjoAAANAIAEgAjoAACABQQNqIAY6AAAgAUECaiAEOgAAIAFBAWogBToAACABQQRqIQEgAEUEQCAHIQMMBAsgAEEBayEAIAEgC0kNAAsgByEDDAILAn8CQAJAAkAgCEH+AWsOAgABAgsgAy0AAyEEIAMtAAIhBSADLQABIQIgA0EEagwCCyADKAIBIgJBGHYhBiACQRB2IQQgAkEIdiEFIANBBWoMAQsgCUGAAUcEQCAHIAlBwABHDQEaIAQgCEEDcWpBAmshBCACIABBBHZqQQJrIQIgBSAIQQJ2QQNxakECayEFIAcMAQsgBCAAQShrIgkgAy0AASIHQQ9xamohBCACIAdBBHYgCWpqIQIgACAFakEgayEFIANBAmoLIQMgBUEFbCACQQNsaiAEQQdsaiAGQQtsakE/cUECdCIAIAQ6AAIgACAFOgABIAAgAjoAACAAQQNqIAY6AAALIAEgBjoAAyABIAQ6AAIgASAFOgABIAEgAjoAACABQQRqIQELIAMgCkkNAAsLCw=="}),Ee=class{constructor(e){this.keepSize=e,this.width=0,this.height=0}decode(e){this.width=e[4]<<24|e[5]<<16|e[6]<<8|e[7],this.height=e[8]<<24|e[9]<<16|e[10]<<8|e[11];let t=this.width*this.height,i=t*4,A=e.length,s=Math.max(i,A)+(Math.min(i,A)>>1)+4096;this._inst?this._mem.buffer.byteLength<s&&(this._mem.grow(Math.ceil((s-this._mem.buffer.byteLength)/65536)),this._d=null):(this._mem=new WebAssembly.Memory({initial:Math.ceil(s/65536)}),this._inst=Dt({env:{memory:this._mem}})),this._d||(this._d=new Uint8Array(this._mem.buffer));let n=this._mem.buffer.byteLength-A&-256;return this._d.set(e,n),this._inst.exports.dec(n,A,t),this._d.subarray(1024,1024+i)}release(){this._inst&&this._mem.buffer.byteLength>this.keepSize&&(this._inst=this._d=this._mem=null)}};Ce.default=Ee});var Ke=x(ie=>{"use strict";Object.defineProperty(ie,"__esModule",{value:!0});ie.LIMITS=void 0;ie.LIMITS={CHUNK_SIZE:16384,PALETTE_SIZE:4096,MAX_WIDTH:16384,BYTES:"AGFzbQEAAAABJAdgAAF/YAJ/fwBgA39/fwF/YAF/AX9gAABgBH9/f38AYAF/AAIlAgNlbnYLaGFuZGxlX2JhbmQAAwNlbnYLbW9kZV9wYXJzZWQAAwMTEgQAAAAAAQQBAQUBAAACAgAGAwQFAXABBwcFBAEBBwcGCAF/AUGAihoLB9wBDgZtZW1vcnkCABFnZXRfc3RhdGVfYWRkcmVzcwADEWdldF9jaHVua19hZGRyZXNzAAQOZ2V0X3AwX2FkZHJlc3MABRNnZXRfcGFsZXR0ZV9hZGRyZXNzAAYEaW5pdAALBmRlY29kZQAMDWN1cnJlbnRfd2lkdGgADQ5jdXJyZW50X2hlaWdodAAOGV9faW5kaXJlY3RfZnVuY3Rpb25fdGFibGUBAAtfaW5pdGlhbGl6ZQACCXN0YWNrU2F2ZQARDHN0YWNrUmVzdG9yZQASCnN0YWNrQWxsb2MAEwkMAQBBAQsGCgcJDxACDAEBCq5UEgMAAQsFAEGgCAsGAEGQiQELBgBBsIkCCwUAQZAJC+okAQh/QeQIKAIAIQVB4AgoAgAhA0HoCCgCACEIIAFBkIkBaiIJQf8BOgAAIAAgAUgEQCAAQZCJAWohBgNAIAMhBCAGQQFqIQECQCAGLQAAQf8AcSIDQTBrQQlLBEAgASEGDAELQewIKAIAQQJ0QewIaiICKAIAIQADQCACIAMgAEEKbGpBMGsiADYCACABLQAAIQMgAUEBaiIGIQEgA0H/AHEiA0Ewa0EKSQ0ACwsCQAJAAkACQAJAAkACQAJ/AkACQCADQT9rIgBBP00EQCAERQ0BIARBIUYEQAJAQfAIKAIAIgFBASABGyIHIAhqIgFB1AgoAgAiA0gNACADQf//AEoNAANAIANBAnQiAkGgiQJqIgRBoAgpAwA3AwAgAkGoiQJqQaAIKQMANwMAIAJBsIkCakGgCCkDADcDACACQbiJAmpBoAgpAwA3AwAgAkHAiQJqQaAIKQMANwMAIAJByIkCakGgCCkDADcDACACQdCJAmpBoAgpAwA3AwAgAkHYiQJqQaAIKQMANwMAIAJB4IkCakGgCCkDADcDACACQeiJAmpBoAgpAwA3AwAgAkHwiQJqQaAIKQMANwMAIAJB+IkCakGgCCkDADcDACACQYCKAmpBoAgpAwA3AwAgAkGIigJqQaAIKQMANwMAIAJBkIoCakGgCCkDADcDACACQZiKAmpBoAgpAwA3AwAgAkGgigJqQaAIKQMANwMAIAJBqIoCakGgCCkDADcDACACQbCKAmpBoAgpAwA3AwAgAkG4igJqQaAIKQMANwMAIAJBwIoCakGgCCkDADcDACACQciKAmpBoAgpAwA3AwAgAkHQigJqQaAIKQMANwMAIAJB2IoCakGgCCkDADcDACACQeCKAmpBoAgpAwA3AwAgAkHoigJqQaAIKQMANwMAIAJB8IoCakGgCCkDADcDACACQfiKAmpBoAgpAwA3AwAgAkGAiwJqQaAIKQMANwMAIAJBiIsCakGgCCkDADcDACACQZCLAmpBoAgpAwA3AwAgAkGYiwJqQaAIKQMANwMAIAJBoIsCakGgCCkDADcDACACQaiLAmpBoAgpAwA3AwAgAkGwiwJqQaAIKQMANwMAIAJBuIsCakGgCCkDADcDACACQcCLAmpBoAgpAwA3AwAgAkHIiwJqQaAIKQMANwMAIAJB0IsCakGgCCkDADcDACACQdiLAmpBoAgpAwA3AwAgAkHgiwJqQaAIKQMANwMAIAJB6IsCakGgCCkDADcDACACQfCLAmpBoAgpAwA3AwAgAkH4iwJqQaAIKQMANwMAIAJBgIwCakGgCCkDADcDACACQYiMAmpBoAgpAwA3AwAgAkGQjAJqQaAIKQMANwMAIAJBmIwCakGgCCkDADcDACACQaCMAmpBoAgpAwA3AwAgAkGojAJqQaAIKQMANwMAIAJBsIwCakGgCCkDADcDACACQbiMAmpBoAgpAwA3AwAgAkHAjAJqQaAIKQMANwMAIAJByIwCakGgCCkDADcDACACQdCMAmpBoAgpAwA3AwAgAkHYjAJqQaAIKQMANwMAIAJB4IwCakGgCCkDADcDACACQeiMAmpBoAgpAwA3AwAgAkHwjAJqQaAIKQMANwMAIAJB+IwCakGgCCkDADcDACACQYCNAmpBoAgpAwA3AwAgAkGIjQJqQaAIKQMANwMAIAJBkI0CakGgCCkDADcDACACQZiNAmpBoAgpAwA3AwAgAkGwiQZqIARBgAT8CgAAQdQIKAIAQQJ0QcCJCmogBEGABPwKAABB1AgoAgBBAnRB0IkOaiAEQYAE/AoAAEHUCCgCAEECdEHgiRJqIARBgAT8CgAAQdQIKAIAQQJ0QfCJFmogBEGABPwKAABB1AhB1AgoAgAiAkGAAWoiAzYCACABIANIDQEgAkGA/wBIDQALCwJAIABFDQAgCEH//wBLDQBBgIABIAhrIAcgAUH//wBLGyECAkAgAEEBcUUNACACRQ0AIAhBAnRBoIkCaiEDIAIhBCACQQdxIgcEQANAIAMgBTYCACADQQRqIQMgBEEBayEEIAdBAWsiBw0ACwsgAkEBa0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgBEEIayIEDQALCwJAIABBAnFFDQAgAkUNACAIQQJ0QbCJBmohAyACIQQgAkEHcSIHBEADQCADIAU2AgAgA0EEaiEDIARBAWshBCAHQQFrIgcNAAsLIAJBAWtBB0kNAANAIAMgBTYCHCADIAU2AhggAyAFNgIUIAMgBTYCECADIAU2AgwgAyAFNgIIIAMgBTYCBCADIAU2AgAgA0EgaiEDIARBCGsiBA0ACwsCQCAAQQRxRQ0AIAJFDQAgCEECdEHAiQpqIQMgAiEEIAJBB3EiBwRAA0AgAyAFNgIAIANBBGohAyAEQQFrIQQgB0EBayIHDQALCyACQQFrQQdJDQADQCADIAU2AhwgAyAFNgIYIAMgBTYCFCADIAU2AhAgAyAFNgIMIAMgBTYCCCADIAU2AgQgAyAFNgIAIANBIGohAyAEQQhrIgQNAAsLAkAgAEEIcUUNACACRQ0AIAhBAnRB0IkOaiEDIAIhBCACQQdxIgcEQANAIAMgBTYCACADQQRqIQMgBEEBayEEIAdBAWsiBw0ACwsgAkEBa0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgBEEIayIEDQALCwJAIABBEHFFDQAgAkUNACAIQQJ0QeCJEmohAyACIQQgAkEHcSIHBEADQCADIAU2AgAgA0EEaiEDIARBAWshBCAHQQFrIgcNAAsLIAJBAWtBB0kNAANAIAMgBTYCHCADIAU2AhggAyAFNgIUIAMgBTYCECADIAU2AgwgAyAFNgIIIAMgBTYCBCADIAU2AgAgA0EgaiEDIARBCGsiBA0ACwsgAEEgcUUNACACRQ0AIAJBAWshByAIQQJ0QfCJFmohAyACQQdxIgQEQANAIAMgBTYCACADQQRqIQMgAkEBayECIARBAWsiBA0ACwsgB0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgAkEIayICDQALC0HcCEHcCCgCACAAcjYCACAGQQFqIgIgBi0AAEH/AHEiA0E/ayIAQT9LDQQaDAMLAkBB7AgoAgAiBEEBRgRAQfAIKAIAIgNBzAgoAgAiAUkNASADIAFwIQMMAQtB+AgoAgAhAkH0CCgCACEBAkACQCAEQQVHDQAgAUEBRw0AIAJB6QJODQQMAQsgAkHkAEoNA0H8CCgCAEHkAEoNA0GACSgCAEHkAEoNAwsCQCABRQ0AIAFBAkoNACACQfwIKAIAQYAJKAIAIAFBAnRBiAhqKAIAEQIAIQFB8AgoAgAiA0HMCCgCACICTwR/IAMgAnAFIAMLQQJ0QZAJaiABNgIAC0HwCCgCACIDQcwIKAIAIgFJDQAgAyABcCEDCyADQQJ0QZAJaigCACEFDAELIANB/QBxQSFHBEAgCCEBIAYhAgwECyAEQSNHDQQCQEHsCCgCACICQQFGBEBB8AgoAgAiAUHMCCgCACIASQ0BIAEgAHAhAQwBC0H4CCgCACEBQfQIKAIAIQACQAJAIAJBBUcNACAAQQFHDQAgAUHpAkgNAQwHCyABQeQASg0GQfwIKAIAQeQASg0GQYAJKAIAQeQASg0GCwJAIABFDQAgAEECSg0AIAFB/AgoAgBBgAkoAgAgAEECdEGICGooAgARAgAhAEHwCCgCACIBQcwIKAIAIgJPBH8gASACcAUgAQtBAnRBkAlqIAA2AgALQfAIKAIAIgFBzAgoAgAiAEkNACABIABwIQELIAFBAnRBkAlqKAIAIQUMBAsgCCEBIAYhAgtB1AgoAgAhBgNAAkAgASAGSA0AIAZB//8ASg0AIAZBAnQiBEGgiQJqIgZBoAgpAwA3AwAgBEGoiQJqQaAIKQMANwMAIARBsIkCakGgCCkDADcDACAEQbiJAmpBoAgpAwA3AwAgBEHAiQJqQaAIKQMANwMAIARByIkCakGgCCkDADcDACAEQdCJAmpBoAgpAwA3AwAgBEHYiQJqQaAIKQMANwMAIARB4IkCakGgCCkDADcDACAEQeiJAmpBoAgpAwA3AwAgBEHwiQJqQaAIKQMANwMAIARB+IkCakGgCCkDADcDACAEQYCKAmpBoAgpAwA3AwAgBEGIigJqQaAIKQMANwMAIARBkIoCakGgCCkDADcDACAEQZiKAmpBoAgpAwA3AwAgBEGgigJqQaAIKQMANwMAIARBqIoCakGgCCkDADcDACAEQbCKAmpBoAgpAwA3AwAgBEG4igJqQaAIKQMANwMAIARBwIoCakGgCCkDADcDACAEQciKAmpBoAgpAwA3AwAgBEHQigJqQaAIKQMANwMAIARB2IoCakGgCCkDADcDACAEQeCKAmpBoAgpAwA3AwAgBEHoigJqQaAIKQMANwMAIARB8IoCakGgCCkDADcDACAEQfiKAmpBoAgpAwA3AwAgBEGAiwJqQaAIKQMANwMAIARBiIsCakGgCCkDADcDACAEQZCLAmpBoAgpAwA3AwAgBEGYiwJqQaAIKQMANwMAIARBoIsCakGgCCkDADcDACAEQaiLAmpBoAgpAwA3AwAgBEGwiwJqQaAIKQMANwMAIARBuIsCakGgCCkDADcDACAEQcCLAmpBoAgpAwA3AwAgBEHIiwJqQaAIKQMANwMAIARB0IsCakGgCCkDADcDACAEQdiLAmpBoAgpAwA3AwAgBEHgiwJqQaAIKQMANwMAIARB6IsCakGgCCkDADcDACAEQfCLAmpBoAgpAwA3AwAgBEH4iwJqQaAIKQMANwMAIARBgIwCakGgCCkDADcDACAEQYiMAmpBoAgpAwA3AwAgBEGQjAJqQaAIKQMANwMAIARBmIwCakGgCCkDADcDACAEQaCMAmpBoAgpAwA3AwAgBEGojAJqQaAIKQMANwMAIARBsIwCakGgCCkDADcDACAEQbiMAmpBoAgpAwA3AwAgBEHAjAJqQaAIKQMANwMAIARByIwCakGgCCkDADcDACAEQdCMAmpBoAgpAwA3AwAgBEHYjAJqQaAIKQMANwMAIARB4IwCakGgCCkDADcDACAEQeiMAmpBoAgpAwA3AwAgBEHwjAJqQaAIKQMANwMAIARB+IwCakGgCCkDADcDACAEQYCNAmpBoAgpAwA3AwAgBEGIjQJqQaAIKQMANwMAIARBkI0CakGgCCkDADcDACAEQZiNAmpBoAgpAwA3AwAgBEGwiQZqIAZBgAT8CgAAQdQIKAIAQQJ0QcCJCmogBkGABPwKAABB1AgoAgBBAnRB0IkOaiAGQYAE/AoAAEHUCCgCAEECdEHgiRJqIAZBgAT8CgAAQdQIKAIAQQJ0QfCJFmogBkGABPwKAABB1AhB1AgoAgBBgAFqIgY2AgALIAFB//8ATQRAIABBAXEgAWxBAnRBoIkCaiAFNgIAIABBAXZBAXEgAWxBAnRBsIkGaiAFNgIAIABBAnZBAXEgAWxBAnRBwIkKaiAFNgIAIABBA3ZBAXEgAWxBAnRB0IkOaiAFNgIAIABBBHZBAXEgAWxBAnRB4IkSaiAFNgIAIABBBXYgAWxBAnRB8IkWaiAFNgIAQdQIKAIAIQYLIAFBAWohAUHcCEHcCCgCACAAcjYCACACLQAAIQAgAkEBaiIEIQIgAEH/AHEiA0E/ayIAQcAASQ0ACyAECyECQQAhBCACIQYgASEIIANB/QBxQSFGDQELIANBJGsOCgEDAwMDAwMDAwIDC0HsCEIBNwIADAQLQdgIIAFB2AgoAgAiACAAIAFIGyIAQYCAASAAQYCAAUgbNgIADAILQegIIAFB2AgoAgAiACAAIAFIGyIAQYCAASAAQYCAAUgbIgA2AgBB2AggADYCACAAQQRrEAAEQEHoCEEENgIAQdgIQQQ2AgBB0AhBATYCAA8LEAgMAQsCQCADQTtHDQBB7AgoAgAiAEEHSg0AQewIIABBAWo2AgAgAEECdEHwCGpBADYCAAsgAiEGIAQhAyABIQgMAQtBBCEIIAIhBiAEIQMLIAYgCUkNAAsLQeQIIAU2AgBB4AggAzYCAEHoCCAINgIAC9ELAgF+CH9B2AhCBDcDAEGojQJBoAgpAwAiADcDAEGgjQIgADcDAEGYjQIgADcDAEGQjQIgADcDAEGIjQIgADcDAEGAjQIgADcDAEH4jAIgADcDAEHwjAIgADcDAEHojAIgADcDAEHgjAIgADcDAEHYjAIgADcDAEHQjAIgADcDAEHIjAIgADcDAEHAjAIgADcDAEG4jAIgADcDAEGwjAIgADcDAEGojAIgADcDAEGgjAIgADcDAEGYjAIgADcDAEGQjAIgADcDAEGIjAIgADcDAEGAjAIgADcDAEH4iwIgADcDAEHwiwIgADcDAEHoiwIgADcDAEHgiwIgADcDAEHYiwIgADcDAEHQiwIgADcDAEHIiwIgADcDAEHAiwIgADcDAEG4iwIgADcDAEGwiwIgADcDAEGoiwIgADcDAEGgiwIgADcDAEGYiwIgADcDAEGQiwIgADcDAEGIiwIgADcDAEGAiwIgADcDAEH4igIgADcDAEHwigIgADcDAEHoigIgADcDAEHgigIgADcDAEHYigIgADcDAEHQigIgADcDAEHIigIgADcDAEHAigIgADcDAEG4igIgADcDAEGwigIgADcDAEGoigIgADcDAEGgigIgADcDAEGYigIgADcDAEGQigIgADcDAEGIigIgADcDAEGAigIgADcDAEH4iQIgADcDAEHwiQIgADcDAEHoiQIgADcDAEHgiQIgADcDAEHYiQIgADcDAEHQiQIgADcDAEHIiQIgADcDAEHAiQIgADcDAEG4iQIgADcDAEGwiQIgADcDAEGoCCgCACIEQf8AakGAAW0hCAJAIARBgQFIDQBBASEBIAhBAiAIQQJKG0EBayICQQFxIQMgBEGBAk4EQCACQX5xIQIDQCABQQl0IgdBEHJBoIkCakGwiQJBgAT8CgAAIAdBsI0CakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsLIANFDQAgAUEJdEEQckGgiQJqQbCJAkGABPwKAAALAkAgBEEBSA0AIAhBASAIQQFKGyIDQQFxIQUCQCADQQFrIgdFBEBBACEBDAELIANB/v///wdxIQJBACEBA0AgAUEJdCIGQRByQbCJBmpBsIkCQYAE/AoAACAGQZAEckGwiQZqQbCJAkGABPwKAAAgAUECaiEBIAJBAmsiAg0ACwsgBQRAIAFBCXRBEHJBsIkGakGwiQJBgAT8CgAACyAEQQFIDQAgA0EBcSEFIAcEfyADQf7///8HcSECQQAhAQNAIAFBCXQiBkEQckHAiQpqQbCJAkGABPwKAAAgBkGQBHJBwIkKakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsgAUEHdEEEcgVBBAshASAFBEAgAUECdEHAiQpqQbCJAkGABPwKAAALIARBAUgNACADQQFxIQUgBwR/IANB/v///wdxIQJBACEBA0AgAUEJdCIGQRByQdCJDmpBsIkCQYAE/AoAACAGQZAEckHQiQ5qQbCJAkGABPwKAAAgAUECaiEBIAJBAmsiAg0ACyABQQd0QQRyBUEECyEBIAUEQCABQQJ0QdCJDmpBsIkCQYAE/AoAAAsgBEEBSA0AIANBAXEhBSAHBH8gA0H+////B3EhAkEAIQEDQCABQQl0IgZBEHJB4IkSakGwiQJBgAT8CgAAIAZBkARyQeCJEmpBsIkCQYAE/AoAACABQQJqIQEgAkECayICDQALIAFBB3RBBHIFQQQLIQEgBQRAIAFBAnRB4IkSakGwiQJBgAT8CgAACyAEQQFIDQAgA0EBcSEEIAcEfyADQf7///8HcSECQQAhAQNAIAFBCXQiA0EQckHwiRZqQbCJAkGABPwKAAAgA0GQBHJB8IkWakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsgAUEHdEEEcgVBBAshASAERQ0AIAFBAnRB8IkWakGwiQJBgAT8CgAAC0HUCCAIQQd0QQRyNgIAC58TAgh/AX5B5AgoAgAhA0HgCCgCACECQegIKAIAIQcgAUGQiQFqIglB/wE6AAAgACABSARAIABBkIkBaiEIA0AgAiEEIAhBAWohAQJAIAgtAABB/wBxIgJBMGtBCUsEQCABIQgMAQtB7AgoAgBBAnRB7AhqIgUoAgAhAANAIAUgAiAAQQpsakEwayIANgIAIAEtAAAhAiABQQFqIgghASACQf8AcSICQTBrQQpJDQALCwJAAkACQAJAAkACQAJ/AkAgAkE/ayIAQT9NBEAgBEUNASAEQSFGBEBB8AgoAgAiAUEBIAEbIgQgB2ohAQJAIABFDQAgB0H//wBLDQBBgIABIAdrIAQgAUH//wBLGyEFAkAgAEEBcUUNACAHQQJ0QaCJAmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEECcUUNACAHQQJ0QbCJBmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEEcUUNACAHQQJ0QcCJCmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEIcUUNACAHQQJ0QdCJDmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEQcUUNACAHQQJ0QeCJEmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLIABBIHFFDQAgBUEBayEEIAdBAnRB8IkWaiEAIAVBB3EiAgRAA0AgACADNgIAIABBBGohACAFQQFrIQUgAkEBayICDQALCyAEQQdJDQADQCAAIAM2AhwgACADNgIYIAAgAzYCFCAAIAM2AhAgACADNgIMIAAgAzYCCCAAIAM2AgQgACADNgIAIABBIGohACAFQQhrIgUNAAsLIAhBAWoiBSAILQAAQf8AcSICQT9rIgBBP00NAxoMBAsCQEHsCCgCACIFQQFGBEBB8AgoAgAiAUHMCCgCACIESQ0BIAEgBHAhAQwBC0H4CCgCACEEQfQIKAIAIQECQAJAIAVBBUcNACABQQFHDQAgBEHpAk4NBAwBCyAEQeQASg0DQfwIKAIAQeQASg0DQYAJKAIAQeQASg0DCwJAIAFFDQAgAUECSg0AIARB/AgoAgBBgAkoAgAgAUECdEGICGooAgARAgAhBEHwCCgCACIBQcwIKAIAIgVPBH8gASAFcAUgAQtBAnRBkAlqIAQ2AgALQfAIKAIAIgFBzAgoAgAiBEkNACABIARwIQELIAFBAnRBkAlqKAIAIQMMAQsgAkH9AHFBIUcEQCAHIQEgAiEADAQLIARBI0cNBAJAQewIKAIAIgRBAUYEQEHwCCgCACIBQcwIKAIAIgBJDQEgASAAcCEBDAELQfgIKAIAIQFB9AgoAgAhAAJAAkAgBEEFRw0AIABBAUcNACABQekCSA0BDAcLIAFB5ABKDQZB/AgoAgBB5ABKDQZBgAkoAgBB5ABKDQYLAkAgAEUNACAAQQJKDQAgAUH8CCgCAEGACSgCACAAQQJ0QYgIaigCABECACEAQfAIKAIAIgFBzAgoAgAiBE8EfyABIARwBSABC0ECdEGQCWogADYCAAtB8AgoAgAiAUHMCCgCACIASQ0AIAEgAHAhAQsgAUECdEGQCWooAgAhAwwECyAHIQEgCAshBQNAIAFB//8ATQRAIABBAXEgAWxBAnRBoIkCaiADNgIAIABBAXZBAXEgAWxBAnRBsIkGaiADNgIAIABBAnZBAXEgAWxBAnRBwIkKaiADNgIAIABBA3ZBAXEgAWxBAnRB0IkOaiADNgIAIABBBHZBAXEgAWxBAnRB4IkSaiADNgIAIABBBXYgAWxBAnRB8IkWaiADNgIACyABQQFqIQEgBS0AACEAIAVBAWoiBCEFIABB/wBxIgJBP2siAEHAAEkNAAsgBCEFC0EAIQQgBSEIIAEhByACIQAgAkH9AHFBIUYNAQtBBCEHIAQhAiAAQSRrDgoDAgICAgICAgIBAgtB7AhCATcCAAwCC0GoCCgCAEEEaxAABEBB0AhBATYCAA8LAkBBqAgoAgAiBkEFSA0AQaAIKQMAIQogBkEDa0EBdiIBQQdxIQJBACEAIAFBAWtBB08EQCABQfj///8HcSEFA0AgAEEDdCIBQbCJAmogCjcDACABQQhyQbCJAmogCjcDACABQRByQbCJAmogCjcDACABQRhyQbCJAmogCjcDACABQSByQbCJAmogCjcDACABQShyQbCJAmogCjcDACABQTByQbCJAmogCjcDACABQThyQbCJAmogCjcDACAAQQhqIQAgBUEIayIFDQALCyACRQ0AA0AgAEEDdEGwiQJqIAo3AwAgAEEBaiEAIAJBAWsiAg0ACwtBwIkGQbCJAiAGQQJ0IgD8CgAAQdCJCkGwiQIgAPwKAABB4IkOQbCJAiAA/AoAAEHwiRJBsIkCIAD8CgAAQYCKFkGwiQIgAPwKAAAgBCECDAELAkAgAEE7Rw0AQewIKAIAIgBBB0oNAEHsCCAAQQFqNgIAIABBAnRB8AhqQQA2AgALIAEhBwsgCCAJSQ0ACwtB5AggAzYCAEHgCCACNgIAQegIIAc2AgAL4gcCBX8BfgJAQdAIAn8CQAJAIAAgAU4NACABQZCJAWohBiAAQZCJAWohBQNAIAUtAAAiA0H/AHEhAgJAAkACQAJAAkACQAJAQeAIKAIAIgRBIkcEQCAEDQcgAkEiRgRAQewIQgE3AgBB4AhBIjYCAAwICyACQT9rQcAASQ0GIANBIWsiAkEMTQ0BDAULAkAgAkEwayIEQQlNBEBB7AgoAgBBAnRB7AhqIgIgBCACKAIAQQpsajYCAAwBC0HsCCgCACEEIAJBO0YEQCAEQQdKDQFB7AggBEEBajYCACAEQQJ0QfAIakEANgIADAELIARBBEYEQEHECEECNgIAQbAIQfAIKQMANwMAQbgIQfgIKAIAIgI2AgBBvAhB/AgoAgAiBDYCAEHICEECQQFBwAgoAgAiAxs2AgBBrAggBEEAIAMbNgIAQagIIAJBgIABIAJBgIABSBtBBGpBACADGzYCAEHgCEEANgIADAoLIAJBP2tBwABJDQQLIANBIWsiAkEMTQ0BDAILQQEgAnRBjSBxRQ0DDAQLQQEgAnRBjSBxDQELIANBoQFrIgJBDEsNA0EBIAJ0QY0gcUUNAwtBxAhCgYCAgBA3AgBBsAhB8AgoAgBBAEHsCCgCACICQQBKGzYCAEG0CEH0CCgCAEEAIAJBAUobNgIAQbgIQfgIKAIAQQAgAkECShs2AgBB4AhBADYCAEG8CEEANgIADAQLIANBoQFrIgJBDEsNAUEBIAJ0QY0gcUUNAQtBxAhCgYCAgBA3AgBBsAhCADcDAEG4CEIANwMADAMLIAVBAWoiBSAGSQ0ACwsCQEHICCgCAA4DAwEAAQsCQEGoCCgCACIFQQVIDQBBoAgpAwAhByAFQQNrQQF2IgNBB3EhBEEAIQIgA0EBa0EHTwRAIANB+P///wdxIQYDQCACQQN0IgNBsIkCaiAHNwMAIANBCHJBsIkCaiAHNwMAIANBEHJBsIkCaiAHNwMAIANBGHJBsIkCaiAHNwMAIANBIHJBsIkCaiAHNwMAIANBKHJBsIkCaiAHNwMAIANBMHJBsIkCaiAHNwMAIANBOHJBsIkCaiAHNwMAIAJBCGohAiAGQQhrIgYNAAsLIARFDQADQCACQQN0QbCJAmogBzcDACACQQFqIQIgBEEBayIEDQALC0HAiQZBsIkCIAVBAnQiA/wKAABB0IkKQbCJAiAD/AoAAEHgiQ5BsIkCIAP8CgAAQfCJEkGwiQIgA/wKAABBgIoWQbCJAiAD/AoAAEECDAELEAhByAgoAgALEAEiAjYCACACDQAgACABQcgIKAIAQQJ0QYAIaigCABEBAAsLdABB6AhBBDYCAEHkCCAANgIAQewIQgE3AgBBxAhCADcCAEHACCADNgIAQdwIQgA3AgBBqAhCADcDAEGwCEIANwMAQbgIQgA3AwBBzAggAkGAICACQYAgSRs2AgBBoAggAa1CgYCAgBB+NwMAQdAIQQA2AgALIwBB0AgoAgBFBEAgACABQcgIKAIAQQJ0QYAIaigCABEBAAsLWgECfwJAAkACQEHICCgCAEEBaw4CAAECC0HYCEHoCCgCACIAQdgIKAIAIgEgACABShsiAEGAgAEgAEGAgAFIGyIANgIAIABBBGsPC0GoCCgCAEEEayEACyAAC0IBAX8Cf0EGQdwIKAIAIgBBIHENABpBBSAAQRBxDQAaQQQgAEEIcQ0AGkEDIABBBHENABpBAiAAQQFxIABBAnEbCwu9BQEFfQJ/IAJFBEAgAUH/AWxBMmpB5ABtIgBBCHQgAHIgAEEQdHIMAQsgArJDAADIQpUhBiAAQfABarJDAAC0Q5UhBQJ9IAGyQwAAyEKVIgNDAAAAP10EQCADIAZDAACAP5KUDAELIAYgA0MAAIA/IAaTlJILIQcgAyADkiEGAkAgBUOrqqo+kiIEQwAAAABdBEAgBEMAAIA/kiEEDAELIARDAACAP15FDQAgBEMAAIC/kiEECyAGIAeTIQMgBUMAAAAAXSEAAn8CfSADIAcgA5NDAADAQJQgBJSSIARDq6oqPl0NABogByAEQwAAAD9dDQAaIAMgBEOrqio/XUUNABogAyAHIAOTIARDAADAwJRDAACAQJKUkgtDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALIQECQCAABEAgBUMAAIA/kiEEDAELIAUiBEMAAIA/XkUNACAFQwAAgL+SIQQLIAVDq6qqvpIiBUMAAAAAXSECAn8CfSADIAcgA5NDAADAQJQgBJSSIARDq6oqPl0NABogByAEQwAAAD9dDQAaIAMgBEOrqio/XUUNABogAyAHIAOTIARDAADAwJRDAACAQJKUkgtDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALIQACQCACBEAgBUMAAIA/kiEFDAELIAVDAACAP15FDQAgBUMAAIC/kiEFCwJAIAVDq6oqPl0EQCADIAcgA5NDAADAQJQgBZSSIQcMAQsgBUMAAAA/XQ0AIAVDq6oqP11FBEAgAyEHDAELIAMgByADkyAFQwAAwMCUQwAAgECSlJIhBwsgAEEIdAJ/IAdDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALQRB0ciABcgtBgICAeHILNwAgAEH/AWxBMmpB5ABtIAFB/wFsQTJqQeQAbUEIdHIgAkH/AWxBMmpB5ABtQRB0ckGAgIB4cgsEACMACwYAIAAkAAsQACMAIABrQXBxIgAkACAACwsYAQBBgAgLEQEAAAACAAAAAwAAAAQAAAAF"}});var We=x(b=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0});b.decodeAsync=b.decode=b.Decoder=b.DecoderAsync=void 0;var O=X(),f=Ke();function yt(r){if(typeof Buffer<"u")return Buffer.from(r,"base64");let e=atob(r),t=new Uint8Array(e.length);for(let i=0;i<t.length;++i)t[i]=e.charCodeAt(i);return t}var Ye=yt(f.LIMITS.BYTES),J,Ae=new Uint32Array,ye=class{constructor(){this.bandHandler=e=>1,this.modeHandler=e=>1}handle_band(e){return this.bandHandler(e)}mode_parsed(e){return this.modeHandler(e)}},St={memoryLimit:2048*65536,sixelColor:O.DEFAULT_FOREGROUND,fillColor:O.DEFAULT_BACKGROUND,palette:O.PALETTE_VT340_COLOR,paletteLimit:f.LIMITS.PALETTE_SIZE,truncate:!0};function qe(r){let e=new ye,t={env:{handle_band:e.handle_band.bind(e),mode_parsed:e.mode_parsed.bind(e)}};return WebAssembly.instantiate(J||Ye,t).then(i=>(J=J||i.module,new P(r,i.instance||i,e)))}b.DecoderAsync=qe;var P=class{constructor(e,t,i){if(this._PIXEL_OFFSET=f.LIMITS.MAX_WIDTH+4,this._canvas=Ae,this._bandWidths=[],this._maxWidth=0,this._minWidth=f.LIMITS.MAX_WIDTH,this._lastOffset=0,this._currentHeight=0,this._opts=Object.assign({},St,e),this._opts.paletteLimit>f.LIMITS.PALETTE_SIZE)throw new Error(`DecoderOptions.paletteLimit must not exceed ${f.LIMITS.PALETTE_SIZE}`);if(t)i.bandHandler=this._handle_band.bind(this),i.modeHandler=this._initCanvas.bind(this);else{let A=J||(J=new WebAssembly.Module(Ye));t=new WebAssembly.Instance(A,{env:{handle_band:this._handle_band.bind(this),mode_parsed:this._initCanvas.bind(this)}})}this._instance=t,this._wasm=this._instance.exports,this._chunk=new Uint8Array(this._wasm.memory.buffer,this._wasm.get_chunk_address(),f.LIMITS.CHUNK_SIZE),this._states=new Uint32Array(this._wasm.memory.buffer,this._wasm.get_state_address(),12),this._palette=new Uint32Array(this._wasm.memory.buffer,this._wasm.get_palette_address(),f.LIMITS.PALETTE_SIZE),this._palette.set(this._opts.palette),this._pSrc=new Uint32Array(this._wasm.memory.buffer,this._wasm.get_p0_address()),this._wasm.init(O.DEFAULT_FOREGROUND,0,this._opts.paletteLimit,0)}get _fillColor(){return this._states[0]}get _truncate(){return this._states[8]}get _rasterWidth(){return this._states[6]}get _rasterHeight(){return this._states[7]}get _width(){return this._states[2]?this._states[2]-4:0}get _height(){return this._states[3]}get _level(){return this._states[9]}get _mode(){return this._states[10]}get _paletteLimit(){return this._states[11]}_initCanvas(e){if(e===2){let t=this.width*this.height;if(t>this._canvas.length){if(this._opts.memoryLimit&&t*4>this._opts.memoryLimit)throw this.release(),new Error("image exceeds memory limit");this._canvas=new Uint32Array(t)}this._maxWidth=this._width}else if(e===1)if(this._level===2){let t=Math.min(this._rasterWidth,f.LIMITS.MAX_WIDTH)*this._rasterHeight;if(t>this._canvas.length){if(this._opts.memoryLimit&&t*4>this._opts.memoryLimit)throw this.release(),new Error("image exceeds memory limit");this._canvas=new Uint32Array(t)}}else this._canvas.length<65536&&(this._canvas=new Uint32Array(65536));return 0}_realloc(e,t){let i=e+t;if(i>this._canvas.length){if(this._opts.memoryLimit&&i*4>this._opts.memoryLimit)throw this.release(),new Error("image exceeds memory limit");let A=new Uint32Array(Math.ceil(i/65536)*65536);A.set(this._canvas),this._canvas=A}}_handle_band(e){let t=this._PIXEL_OFFSET,i=this._lastOffset;if(this._mode===2){let A=this.height-this._currentHeight,s=0;for(;s<6&&A>0;)this._canvas.set(this._pSrc.subarray(t*s,t*s+e),i+e*s),s++,A--;this._lastOffset+=e*s,this._currentHeight+=s}else if(this._mode===1){this._realloc(i,e*6),this._maxWidth=Math.max(this._maxWidth,e),this._minWidth=Math.min(this._minWidth,e);for(let A=0;A<6;++A)this._canvas.set(this._pSrc.subarray(t*A,t*A+e),i+e*A);this._bandWidths.push(e),this._lastOffset+=e*6,this._currentHeight+=6}return 0}get width(){return this._mode!==1?this._width:Math.max(this._maxWidth,this._wasm.current_width())}get height(){return this._mode!==1?this._height:this._wasm.current_width()?this._bandWidths.length*6+this._wasm.current_height():this._bandWidths.length*6}get palette(){return this._palette.subarray(0,this._paletteLimit)}get memoryUsage(){return this._canvas.byteLength+this._wasm.memory.buffer.byteLength+8*this._bandWidths.length}get properties(){return{width:this.width,height:this.height,mode:this._mode,level:this._level,truncate:!!this._truncate,paletteLimit:this._paletteLimit,fillColor:this._fillColor,memUsage:this.memoryUsage,rasterAttributes:{numerator:this._states[4],denominator:this._states[5],width:this._rasterWidth,height:this._rasterHeight}}}init(e=this._opts.fillColor,t=this._opts.palette,i=this._opts.paletteLimit,A=this._opts.truncate){this._wasm.init(this._opts.sixelColor,e,i,A?1:0),t&&this._palette.set(t.subarray(0,f.LIMITS.PALETTE_SIZE)),this._bandWidths.length=0,this._maxWidth=0,this._minWidth=f.LIMITS.MAX_WIDTH,this._lastOffset=0,this._currentHeight=0}decode(e,t=0,i=e.length){let A=t;for(;A<i;){let s=Math.min(i-A,f.LIMITS.CHUNK_SIZE);this._chunk.set(e.subarray(A,A+=s)),this._wasm.decode(0,s)}}decodeString(e,t=0,i=e.length){let A=t;for(;A<i;){let s=Math.min(i-A,f.LIMITS.CHUNK_SIZE);for(let n=0,a=A;n<s;++n,++a)this._chunk[n]=e.charCodeAt(a);A+=s,this._wasm.decode(0,s)}}get data32(){if(this._mode===0||!this.width||!this.height)return Ae;let e=this._wasm.current_width();if(this._mode===2){let t=this.height-this._currentHeight;if(t>0){let i=this._PIXEL_OFFSET,A=this._lastOffset,s=0;for(;s<6&&t>0;)this._canvas.set(this._pSrc.subarray(i*s,i*s+e),A+e*s),s++,t--;t&&this._canvas.fill(this._fillColor,A+e*s)}return this._canvas.subarray(0,this.width*this.height)}if(this._mode===1){if(this._minWidth===this._maxWidth){let s=!1;if(e)if(e!==this._minWidth)s=!0;else{let n=this._PIXEL_OFFSET,a=this._lastOffset;this._realloc(a,e*6);for(let o=0;o<6;++o)this._canvas.set(this._pSrc.subarray(n*o,n*o+e),a+e*o)}if(!s)return this._canvas.subarray(0,this.width*this.height)}let t=new Uint32Array(this.width*this.height);t.fill(this._fillColor);let i=0,A=0;for(let s=0;s<this._bandWidths.length;++s){let n=this._bandWidths[s];for(let a=0;a<6;++a)t.set(this._canvas.subarray(A,A+=n),i),i+=this.width}if(e){let s=this._PIXEL_OFFSET,n=this._wasm.current_height();for(let a=0;a<n;++a)t.set(this._pSrc.subarray(s*a,s*a+e),i+this.width*a)}return t}return Ae}get data8(){return new Uint8ClampedArray(this.data32.buffer,0,this.width*this.height*4)}release(){this._canvas=Ae,this._bandWidths.length=0,this._maxWidth=0,this._minWidth=f.LIMITS.MAX_WIDTH,this._wasm.init(O.DEFAULT_FOREGROUND,0,this._opts.paletteLimit,0)}};b.Decoder=P;function Lt(r,e){let t=new P(e);return t.init(),typeof r=="string"?t.decodeString(r):t.decode(r),{width:t.width,height:t.height,data32:t.data32,data8:t.data8}}b.decode=Lt;async function Tt(r,e){let t=await qe(e);return t.init(),typeof r=="string"?t.decodeString(r):t.decode(r),{width:t.width,height:t.height,data32:t.data32,data8:t.data8}}b.decodeAsync=Tt});function H(r){return{dispose:r}}var N=class{constructor(){this._disposables=new Set;this._isDisposed=!1}get isDisposed(){return this._isDisposed}add(e){return this._isDisposed?e.dispose():this._disposables.add(e),e}dispose(){if(!this._isDisposed){this._isDisposed=!0;for(let e of this._disposables)e.dispose();this._disposables.clear()}}clear(){for(let e of this._disposables)e.dispose();this._disposables.clear()}},k=class{constructor(){this._store=new N}dispose(){this._store.dispose()}_register(e){return this._store.add(e)}};k.None=Object.freeze({dispose(){}});var W=class{constructor(){this._isDisposed=!1}get value(){return this._isDisposed?void 0:this._value}set value(e){this._isDisposed||e===this._value||(this._value?.dispose(),this._value=e)}clear(){this.value=void 0}dispose(){this._isDisposed=!0,this._value?.dispose(),this._value=void 0}};var z=class{constructor(){this._listeners=[];this._disposed=!1}get event(){return this._event?this._event:(this._event=(e,t,i)=>{if(this._disposed)return H(()=>{});let A={fn:e,thisArgs:t};this._listeners=this._listeners.slice(),this._listeners.push(A);let s=H(()=>{let n=this._listeners.indexOf(A);n!==-1&&(this._listeners=this._listeners.slice(),this._listeners.splice(n,1))});return i&&(Array.isArray(i)?i.push(s):i.add(s)),s},this._event)}fire(e){if(this._disposed||!this._listeners.length)return;if(this._listeners.length===1){this._listeners[0].fn.call(this._listeners[0].thisArgs,e);return}let t=this._listeners;for(let i=0,A=t.length;i<A;++i)t[i].fn.call(t[i].thisArgs,e)}dispose(){this._disposed||(this._disposed=!0,this._listeners.length=0)}},ot;(A=>{function r(s,n){return s(a=>n.fire(a))}A.forward=r;function e(s,n){return(a,o,g)=>s(h=>a.call(o,n(h)),void 0,g)}A.map=e;function t(...s){return(n,a,o)=>{let g=new N;for(let h of s)g.add(h(I=>n.call(a,I)));return o&&(Array.isArray(o)?o.push(g):o.add(g)),g}}A.any=t;function i(s,n,a){return n(a),s(o=>n(o))}A.runAndSubscribe=i})(ot||={});var de=M(X());var D=class r extends k{constructor(t){super();this._terminal=t;this._layers=new Map;this._optionsRefresh=this._register(new W);this._oldOpen=this._terminal._core.open,this._terminal._core.open=i=>{this._oldOpen?.call(this._terminal._core,i),this._open()},this._terminal._core.screenElement&&this._open(),this._optionsRefresh.value=this._terminal._core.optionsService.onOptionChange(i=>{i==="fontSize"&&(this.rescaleCanvas(),this._renderService?.refreshRows(0,this._terminal.rows))}),this._register(H(()=>{this.removeLayerFromDom(),this.removeLayerFromDom("bottom"),this._terminal._core&&this._oldOpen&&(this._terminal._core.open=this._oldOpen,this._oldOpen=void 0),this._renderService&&this._oldSetRenderer&&(this._renderService.setRenderer=this._oldSetRenderer,this._oldSetRenderer=void 0),this._renderService=void 0,this._layers.clear(),this._placeholderBitmap?.close(),this._placeholderBitmap=void 0,this._placeholder=void 0}))}get canvas(){return this._layers.get("top")?.canvas}static createCanvas(t,i,A){let s=(t??document).createElement("canvas");return s.width=i|0,s.height=A|0,s}static createImageData(t,i,A,s){if(typeof ImageData!="function"){let n=t.createImageData(i,A);return s&&n.data.set(new Uint8ClampedArray(s,0,i*A*4)),n}return s?new ImageData(new Uint8ClampedArray(s,0,i*A*4),i,A):new ImageData(i,A)}static createImageBitmap(t){return typeof createImageBitmap!="function"?Promise.resolve(void 0):createImageBitmap(t)}showPlaceholder(t){t?!this._placeholder&&this.cellSize.height!==-1&&this._createPlaceHolder(Math.max(this.cellSize.height+1,24)):(this._placeholderBitmap?.close(),this._placeholderBitmap=void 0,this._placeholder=void 0),this._renderService?.refreshRows(0,this._terminal.rows)}get dimensions(){return this._terminal.dimensions}get cellSize(){return{width:this.dimensions?.css.cell.width||-1,height:this.dimensions?.css.cell.height||-1}}clearLines(t,i,A){let s=t*(this.dimensions?.css.cell.height||0),n=this.dimensions?.css.canvas.width||0,a=(i+1-t)*(this.dimensions?.css.cell.height||0);(!A||A==="top")&&this._layers.get("top")?.clearRect(0,s,n,a),(!A||A==="bottom")&&this._layers.get("bottom")?.clearRect(0,s,n,a)}clearAll(t){if(!t||t==="top"){let i=this._layers.get("top");i?.clearRect(0,0,i.canvas.width,i.canvas.height)}if(!t||t==="bottom"){let i=this._layers.get("bottom");i?.clearRect(0,0,i.canvas.width,i.canvas.height)}}draw(t,i,A,s,n=1){let a=this._layers.get(t.layer);if(!a)return;let{width:o,height:g}=this.cellSize;if(o===-1||g===-1)return;this._rescaleImage(t,o,g);let h=t.actual,I=Math.ceil(h.width/o),d=i%I*o,c=Math.floor(i/I)*g,l=A*o,E=s*g,p=n*o+d>h.width?h.width-d:n*o,u=c+g>h.height?h.height-c:g;a.drawImage(h,Math.floor(d),Math.floor(c),Math.ceil(p),Math.ceil(u),Math.floor(l),Math.floor(E),Math.ceil(p),Math.ceil(u))}extractTile(t,i){let{width:A,height:s}=this.cellSize;if(A===-1||s===-1)return;this._rescaleImage(t,A,s);let n=t.actual,a=Math.ceil(n.width/A),o=i%a*A,g=Math.floor(i/a)*s,h=A+o>n.width?n.width-o:A,I=g+s>n.height?n.height-g:s,d=r.createCanvas(this.document,h,I),c=d.getContext("2d");if(c)return c.drawImage(n,Math.floor(o),Math.floor(g),Math.floor(h),Math.floor(I),0,0,Math.floor(h),Math.floor(I)),d}drawPlaceholder(t,i,A=1){let s=this._layers.get("top");if(s){let{width:n,height:a}=this.cellSize;if(n===-1||a===-1||(this._placeholder?a>=this._placeholder.height&&this._createPlaceHolder(a+1):this._createPlaceHolder(Math.max(a+1,24)),!this._placeholder))return;s.drawImage(this._placeholderBitmap??this._placeholder,t*n,i*a%2?0:1,n*A,a,t*n,i*a,n*A,a)}}rescaleCanvas(){let t=this.dimensions?.css.canvas.width||0,i=this.dimensions?.css.canvas.height||0;for(let A of this._layers.values())(A.canvas.width!==t||A.canvas.height!==i)&&(A.canvas.width=t,A.canvas.height=i)}_rescaleImage(t,i,A){if(i===t.actualCellSize.width&&A===t.actualCellSize.height)return;let{width:s,height:n}=t.origCellSize;if(i===s&&A===n){t.actual=t.orig,t.actualCellSize.width=s,t.actualCellSize.height=n;return}let a=r.createCanvas(this.document,Math.ceil(t.orig.width*i/s),Math.ceil(t.orig.height*A/n)),o=a.getContext("2d");o&&(o.drawImage(t.orig,0,0,a.width,a.height),t.actual=a,t.actualCellSize.width=i,t.actualCellSize.height=A)}_open(){this._renderService=this._terminal._core._renderService,this._oldSetRenderer=this._renderService.setRenderer.bind(this._renderService),this._renderService.setRenderer=t=>{for(let i of[...this._layers.keys()])this.removeLayerFromDom(i);this._oldSetRenderer?.call(this._renderService,t)}}insertLayerToDom(t="top"){if(!this.document||!this._terminal._core.screenElement){console.warn("image addon: cannot insert output canvas to DOM, missing document or screenElement");return}if(this._layers.has(t))return;let i=r.createCanvas(this.document,this.dimensions?.css.canvas.width||0,this.dimensions?.css.canvas.height||0);i.classList.add(`xterm-image-layer-${t}`);let A=this._terminal._core.screenElement;A.style.isolation="isolate",t==="bottom"?(i.style.zIndex="-1",A.insertBefore(i,A.firstChild)):(i.style.zIndex="0",A.appendChild(i));let s=i.getContext("2d",{alpha:!0});if(!s){i.remove();return}this._layers.set(t,s),this.clearAll(t)}removeLayerFromDom(t="top"){let i=this._layers.get(t);i&&(i.canvas.remove(),this._layers.delete(t))}hasLayer(t){return this._layers.has(t)}_createPlaceHolder(t=24){this._placeholderBitmap?.close(),this._placeholderBitmap=void 0;let i=32,A=r.createCanvas(this.document,i,t),s=A.getContext("2d",{alpha:!1});if(!s)return;let n=r.createImageData(s,i,t),a=new Uint32Array(n.data.buffer),o=(0,de.toRGBA8888)(0,0,0),g=(0,de.toRGBA8888)(255,255,255);a.fill(o);for(let d=0;d<t;++d){let c=d%2,l=d*i;for(let E=0;E<i;E+=2)a[l+E+c]=g}s.putImageData(n,0,0);let h=screen.width+i-1&~(i-1)||4096;this._placeholder=r.createCanvas(this.document,h,t);let I=this._placeholder.getContext("2d",{alpha:!1});if(!I){this._placeholder=void 0;return}for(let d=0;d<h;d+=i)I.drawImage(A,d,0);r.createImageBitmap(this._placeholder).then(d=>this._placeholderBitmap=d)}get document(){return this._terminal._core._coreBrowserService?.window.document}};var w={width:7,height:14},G=class r{constructor(e=0,t=0,i=-1,A=-1){this.imageId=i;this.tileId=A;this._ext=0;this._urlId=0;this._ext=e,this._urlId=t}get ext(){return this._urlId?this._ext&-469762049|this.underlineStyle<<26:this._ext}set ext(e){this._ext=e}get underlineStyle(){return this._urlId?5:(this._ext&469762048)>>26}set underlineStyle(e){this._ext&=-469762049,this._ext|=e<<26&469762048}get underlineColor(){return this._ext&67108863}set underlineColor(e){this._ext&=-67108864,this._ext|=e&67108863}get underlineVariantOffset(){let e=(this._ext&3758096384)>>29;return e<0?e^4294967288:e}set underlineVariantOffset(e){this._ext&=536870911,this._ext|=e<<29&3758096384}get urlId(){return this._urlId}set urlId(e){this._urlId=e}clone(){return new r(this._ext,this._urlId,this.imageId,this.tileId)}isEmpty(){return this.underlineStyle===0&&this._urlId===0&&this.imageId===-1}},F=new G,Z=class{constructor(e,t,i){this._terminal=e;this._renderer=t;this._opts=i;this._images=new Map;this._lastId=0;this._lowestId=0;this._fullyCleared=!1;this._needsFullClear=!1;this._pixelLimit=25e5;try{this.setLimit(this._opts.storageLimit)}catch(A){A instanceof Error&&console.error(A.message),console.warn(`storageLimit is set to ${this.getLimit()} MB`)}this._viewportMetrics={cols:this._terminal.cols,rows:this._terminal.rows}}dispose(){this.reset()}reset(){for(let e of this._images.values())e.marker?.dispose();this._images.clear(),this._renderer.clearAll()}getLimit(){return this._pixelLimit*4/1e6}setLimit(e){if(e<.5||e>1e3)throw RangeError("invalid storageLimit, should be at least 0.5 MB and not exceed 1G");this._pixelLimit=e/4*1e6>>>0,this._evictOldest(0)}getUsage(){return this._getStoredPixels()*4/1e6}_getStoredPixels(){let e=0;for(let t of this._images.values())t.orig&&(e+=t.orig.width*t.orig.height,t.actual&&t.actual!==t.orig&&(e+=t.actual.width*t.actual.height));return e}_delImg(e){let t=this._images.get(e);t&&(this._images.delete(e),window.ImageBitmap&&t.orig instanceof ImageBitmap&&t.orig.close(),this.onImageDeleted?.(e))}wipeAlternate(){let e=[];for(let[t,i]of this._images.entries())i.bufferType==="alternate"&&(i.marker?.dispose(),e.push(t));for(let t of e)this._delImg(t);this._needsFullClear=!0,this._fullyCleared=!1}deleteImage(e){let t=this._images.get(e);t&&(t.marker?.dispose(),this._delImg(e))}addImage(e,t){this._evictOldest(e.width*e.height);let i=this._renderer.cellSize;(i.width===-1||i.height===-1)&&(i=w);let A=Math.ceil(e.width/i.width),s=Math.ceil(e.height/i.height),n=++this._lastId,a=this._terminal._core.buffer,o=this._terminal.cols,g=this._terminal.rows,h=a.x,I=a.y,d=h,c=0;t.scrolling||(a.x=0,a.y=0,d=0),this._terminal._core._inputHandler._dirtyRowTracker.markDirty(a.y);for(let u=0;u<s;++u){let C=a.lines.get(a.y+a.ybase);for(let Q=0;Q<A&&!(d+Q>=o);++Q)this._writeToCell(C,d+Q,n,u*A+Q),c++;if(t.scrolling)u<s-1&&this._terminal._core._inputHandler.lineFeed();else if(++a.y>=g)break;a.x=d}this._terminal._core._inputHandler._dirtyRowTracker.markDirty(a.y),t.scrolling?t.cursorPos==="iip"?a.x=Math.min(d+A,o):a.x=d:(a.x=h,a.y=I);let l=[];for(let[u,C]of this._images.entries())C.tileCount<1&&(C.marker?.dispose(),l.push(u));for(let u of l)this._delImg(u);let E=this._terminal.registerMarker(0);E?.onDispose(()=>{this._images.get(n)&&this._delImg(n)}),this._terminal.buffer.active.type==="alternate"&&this._evictOnAlternate();let p={orig:e,origCellSize:i,actual:e,actualCellSize:{...i},marker:E||void 0,tileCount:c,bufferType:this._terminal.buffer.active.type,layer:t.layer,zIndex:t.zIndex};return this._images.set(n,p),this.onImageAdded?.(),n}render(e){let t=!1,i=!1;for(let h of this._images.values())if(h.layer==="bottom"?i=!0:t=!0,t&&i)break;if(t&&!this._renderer.hasLayer("top")&&(this._renderer.insertLayerToDom("top"),!this._renderer.hasLayer("top")))return;if(i&&!this._renderer.hasLayer("bottom")&&this._renderer.insertLayerToDom("bottom"),this._renderer.rescaleCanvas(),!this._images.size){this._fullyCleared||(this._renderer.clearAll(),this._fullyCleared=!0,this._needsFullClear=!1),this._renderer.hasLayer("top")&&this._renderer.removeLayerFromDom("top"),this._renderer.hasLayer("bottom")&&this._renderer.removeLayerFromDom("bottom");return}!t&&this._renderer.hasLayer("top")&&(this._renderer.clearAll("top"),this._renderer.removeLayerFromDom("top")),!i&&this._renderer.hasLayer("bottom")&&(this._renderer.clearAll("bottom"),this._renderer.removeLayerFromDom("bottom")),this._needsFullClear&&(this._renderer.clearAll(),this._fullyCleared=!0,this._needsFullClear=!1);let{start:A,end:s}=e,n=this._terminal._core.buffer,a=this._terminal._core.cols;this._renderer.clearLines(A,s);let o=[],g=[];for(let h=A;h<=s;++h){let I=n.lines.get(h+n.ydisp);if(!I)return;for(let d=0;d<a;++d)if(I.getBg(d)&268435456){let c=I._extendedAttrs[d]??F,l=c.imageId;if(l===void 0||l===-1)continue;let E=this._images.get(l);if(c.tileId!==-1){let p=c.tileId,u=d,C=1;for(;++d<a&&I.getBg(d)&268435456&&(c=I._extendedAttrs[d]??F)&&c.imageId===l&&c.tileId===p+C;)C++;d--,E?E.actual&&o.push({imgSpec:E,tileId:p,col:u,row:h,count:C}):this._opts.showPlaceholder&&g.push({col:u,row:h,count:C}),this._fullyCleared=!1}}}o.sort((h,I)=>h.imgSpec.zIndex-I.imgSpec.zIndex);for(let h of g)this._renderer.drawPlaceholder(h.col,h.row,h.count);for(let h of o)this._renderer.draw(h.imgSpec,h.tileId,h.col,h.row,h.count)}viewportResize(e){if(!this._images.size){this._viewportMetrics=e;return}if(this._viewportMetrics.cols>=e.cols){this._viewportMetrics=e;return}let t=this._terminal._core.buffer,i=t.lines.length,A=this._viewportMetrics.cols-1;for(let s=0;s<i;++s){let n=t.lines.get(s);if(n.getBg(A)&268435456){let a=n._extendedAttrs[A]??F,o=a.imageId;if(o===void 0||o===-1)continue;let g=this._images.get(o);if(!g)continue;let h=Math.ceil((g.actual?.width||0)/g.actualCellSize.width);if(a.tileId%h+1>=h)continue;let I=!1;for(let l=A+1;l>e.cols;++l)if(n._data[l*3+0]&4194303){I=!0;break}if(I)continue;let d=Math.min(e.cols,h-a.tileId%h+A),c=a.tileId;for(let l=A+1;l<d;++l)this._writeToCell(n,l,o,++c),g.tileCount++}}this._viewportMetrics=e}getImageAtBufferCell(e,t){let A=this._terminal._core.buffer.lines.get(t);if(A&&A.getBg(e)&268435456){let s=A._extendedAttrs[e]??F;if(s.imageId&&s.imageId!==-1){let n=this._images.get(s.imageId)?.orig;if(window.ImageBitmap&&n instanceof ImageBitmap){let a=D.createCanvas(window.document,n.width,n.height);return a.getContext("2d")?.drawImage(n,0,0,n.width,n.height),a}return n}}}extractTileAtBufferCell(e,t){let A=this._terminal._core.buffer.lines.get(t);if(A&&A.getBg(e)&268435456){let s=A._extendedAttrs[e]??F;if(s.imageId&&s.imageId!==-1&&s.tileId!==-1){let n=this._images.get(s.imageId);if(n)return this._renderer.extractTile(n,s.tileId)}}}_evictOldest(e){let t=this._getStoredPixels(),i=t;for(;this._pixelLimit<i+e&&this._images.size;){let A=this._images.get(++this._lowestId);A&&A.orig&&(i-=A.orig.width*A.orig.height,A.actual&&A.orig!==A.actual&&(i-=A.actual.width*A.actual.height),A.marker?.dispose(),this._delImg(this._lowestId))}return t-i}_writeToCell(e,t,i,A){if(e._data[t*3+2]&268435456){let s=e._extendedAttrs[t];if(s){if(s.imageId!==void 0){let n=this._images.get(s.imageId);n&&n.tileCount--,s.imageId=i,s.tileId=A;return}e._extendedAttrs[t]=new G(s.ext,s.urlId,i,A);return}}e._data[t*3+2]|=268435456,e._extendedAttrs[t]=new G(0,0,i,A)}_evictOnAlternate(){for(let i of this._images.values())i.bufferType==="alternate"&&(i.tileCount=0);let e=this._terminal._core.buffer;for(let i=0;i<this._terminal.rows;++i){let A=e.lines.get(i);if(A){for(let s=0;s<this._terminal.cols;++s)if(A._data[s*3+2]&268435456){let n=A._extendedAttrs[s]?.imageId;if(n){let a=this._images.get(n);a&&a.tileCount++}}}}let t=[];for(let[i,A]of this._images.entries())A.bufferType==="alternate"&&!A.tileCount&&(A.marker?.dispose(),t.push(i));for(let i of t)this._delImg(i)}};var Ue=M(ue()),Oe=M(Re());function j(r){let e="";for(let t=0;t<r.length;++t)e+=String.fromCharCode(r[t]);return e}function pe(r){let e=0;for(let t=0;t<r.length;++t){if(r[t]<48||r[t]>57)throw new Error("illegal char");e=e*10+r[t]-48}return e}function ke(r){let e=j(r);if(!e.match(/^((auto)|(\d+?((px)|(%)){0,1}))$/))throw new Error("illegal size");return e}function wt(r){if(typeof Buffer<"u")return Buffer.from(j(r),"base64").toString();let e=atob(j(r)),t=new Uint8Array(e.length);for(let i=0;i<t.length;++i)t[i]=e.charCodeAt(i);return new TextDecoder().decode(t)}var Ne={inline:pe,size:pe,name:wt,width:ke,height:ke,preserveAspectRatio:pe},He=[70,105,108,101],Fe=[77,117,108,116,105,112,97,114,116,70,105,108,101],Be=[70,105,108,101,80,97,114,116],fe=[70,105,108,101,69,110,100],Qe=[82,101,112,111,114,116,67,101,108,108,83,105,122,101],De=1024,V=class{constructor(){this.state=0;this._buffer=new Uint32Array(De);this._position=0;this._key="";this.fields={}}reset(){this._buffer.fill(0),this.state=0,this._position=0,this.fields={},this._key=""}end(){if(this.state===0){if(this._position===fe.length){for(let e=0;e<fe.length;++e)if(this._buffer[e]!==fe[e])return this._a();return this.fields.type=4,this.state=4,0}if(this._position===Qe.length){for(let e=0;e<Qe.length;++e)if(this._buffer[e]!==Qe[e])return this._a();return this.fields.type=5,this.state=4,0}return this._a()}return this.state===4?0:this.state===3&&this.fields.type===2?this._storeValue(this._position)?(this.state=4,0):this._a():this._a()}parse(e,t,i){let A=this.state,s=this._position,n=this._buffer;if(A===1||A===4||A===0&&s>14)return-1;for(let a=t;a<i;++a){let o=e[a];switch(o){case 59:if(!this._storeValue(s))return this._a();A=2,s=0;break;case 61:if(A===0){if(n[0]===70){let g=0;for(;g<He.length;++g)if(n[g]!==He[g])return this._a();if(this.fields.type=1,s===Be.length){for(;g<Be.length;++g)if(n[g]!==Be[g])return this._a();return this.fields.type=3,this.state=4,a+1}}else if(n[0]===77){for(let g=0;g<Fe.length;++g)if(n[g]!==Fe[g])return this._a();this.fields.type=2}else return this._a();A=2,s=0}else if(A===2){if(!this._storeKey(s))return this._a();A=3,s=0}else if(A===3){if(s>=De)return this._a();n[s++]=o}break;case 58:return A===3&&!this._storeValue(s)?this._a():(this.state=4,a+1);default:if(s>=De)return this._a();n[s++]=o}}return this.state=A,this._position=s,-2}_a(){return this.fields.type=0,this.state=1,-1}_storeKey(e){let t=j(this._buffer.subarray(0,e));return t?(this._key=t,this.fields[t]=null,!0):!1}_storeValue(e){if(this._key){try{let t=this._buffer.slice(0,e);this.fields[this._key]=Ne[this._key]?Ne[this._key](t):t}catch{return!1}return!0}return!1}};var L={mime:"unsupported",width:0,height:0};function Ge(r){if(r.length<32)return L;let e=new Uint32Array(r.buffer,r.byteOffset,8);if(e[0]===1196314761&&e[1]===169478669&&e[3]===1380206665)return{mime:"image/png",width:r[16]<<24|r[17]<<16|r[18]<<8|r[19],height:r[20]<<24|r[21]<<16|r[22]<<8|r[23]};if(r[0]===255&&r[1]===216&&r[2]===255){let[t,i]=bt(r);return{mime:"image/jpeg",width:t,height:i}}if(e[0]===944130375&&(r[4]===55||r[4]===57)&&r[5]===97)return{mime:"image/gif",width:r[7]<<8|r[6],height:r[9]<<8|r[8]};if(e[0]===1718185841)return{mime:"image/qoi",width:r[4]<<24|r[5]<<16|r[6]<<8|r[7],height:r[8]<<24|r[9]<<16|r[10]<<8|r[11]};if(e[0]===1179011410&&e[2]===1346520407&&(e[3]&16777215)===3690582){switch(r[15]){case 88:return{mime:"image/webp",width:(r[24]|r[25]<<8|r[26]<<16)+1,height:(r[27]|r[28]<<8|r[29]<<16)+1};case 76:if(r[20]!==47)return L;let t=r[21]|r[22]<<8|r[23]<<16|r[24]<<24;return{mime:"image/webp",width:(t&16383)+1,height:(t>>>14&16383)+1};case 32:return r[23]!==157||r[24]!==1||r[25]!==42?L:{mime:"image/webp",width:(r[26]|r[27]<<8)&16383,height:(r[28]|r[29]<<8)&16383}}return L}if(e[1]===1887007846&&(e[2]===1718187617||e[2]===1936291425)){let t=-1,i=Math.min(r.length-16,1024);for(let A=8;A<i;A++)if(r[A]===105&&r[A+1]===115&&r[A+2]===112&&r[A+3]===101){t=A;break}if(t!==-1){let A=r[t+8]<<24|r[t+9]<<16|r[t+10]<<8|r[t+11],s=r[t+12]<<24|r[t+13]<<16|r[t+14]<<8|r[t+15];if(A>0&&s>0)return{mime:"image/avif",width:A,height:s}}return L}return L}function bt(r){let e=r.length,t=4,i=r[t]<<8|r[t+1];for(;;){if(t+=i,t>=e)return[0,0];if(r[t]!==255)return[0,0];if(r[t+1]===192||r[t+1]===194)return t+8<e?[r[t+7]<<8|r[t+8],r[t+5]<<8|r[t+6]]:[0,0];t+=2,i=r[t]<<8|r[t+1]}}var we={type:0,name:"Unnamed file",size:0,width:"auto",height:"auto",preserveAspectRatio:1,inline:0},$=class{constructor(e,t,i,A){this._opts=e;this._renderer=t;this._storage=i;this._coreTerminal=A;this._aborted=!1;this._hp=new V;this._header=we;this._isMultipart=!1;this._abortMulti=!1;let s=Math.ceil(this._opts.iipSizeLimit*4/3),n=Math.min(1048576,s);this._dec=new Ue.default(4194304,s,n),this._qoiDec=new Oe.default(4194304)}reset(){this._hp.reset(),this._dec.release(),this._qoiDec.release()}start(){this._aborted=!1,this._hp.reset()}put(e,t,i){if(!this._aborted)if(this._hp.state===4)this._dec.put(e.subarray(t,i))!==0&&(this._dec.release(),this._aborted=!0);else{let A=this._hp.parse(e,t,i);if(A===-1){this._aborted=!0;return}if(A>0){if(this._hp.fields.type===1){if(this._isMultipart&&(this._isMultipart=!1,this._abortMulti=!1,this._dec.release()),this._header=Object.assign({},we,this._hp.fields),!this._header.inline){this._aborted=!0;return}this._dec.init()}else if(this._abortMulti){this._aborted=!0;return}this._dec.put(e.subarray(A,i))!==0&&(this._dec.release(),this._aborted=!0,this._isMultipart&&(this._abortMulti=!0))}}}end(e){if(this._aborted||this._hp.state!==4&&this._hp.end())return!0;let t=this._hp.fields.type;if(t===3)return!0;if(t===5){let o=w.width,g=w.height;this._renderer.dimensions&&(o=this._renderer.dimensions.css.canvas.width/this._coreTerminal.cols,g=this._renderer.dimensions.css.canvas.height/this._coreTerminal.rows);let h=this._coreTerminal._core._coreBrowserService?.dpr??1,I=`\x1B]1337;ReportCellSize=${g.toFixed(3)};${o.toFixed(3)};${h.toFixed(3)}\x1B\\`;return this._coreTerminal.input(I,!1),!0}if(t===2)return this._header=Object.assign({},we,this._hp.fields),this._isMultipart=!0,this._abortMulti=!1,this._dec.release(),this._dec.init(),!0;if(t===4&&(!this._isMultipart||(this._isMultipart=!1,this._abortMulti||this._header.type!==2)))return!0;let i=0,A=0,s,n=L;if((s=e)&&((s=!this._dec.end())?(n=Ge(this._dec.data8),(s=n.mime!=="unsupported")?(i=n.width,A=n.height,(s=i&&A&&i*A<this._opts.pixelLimit)?([i,A]=this._resize(i,A).map(Math.floor),s=i&&A&&i*A<this._opts.pixelLimit):console.warn(`IIP: image dimension issue ${n.width}x${n.height}`)):console.warn("IIP: unsupported image type")):console.warn("IIP: error during BASE64 decoding")),!s)return this._dec.release(),!0;let a;if(n.mime==="image/qoi"){let o=this._qoiDec.decode(this._dec.data8);if(a=new ImageData(new Uint8ClampedArray(o.buffer,o.byteOffset,o.byteLength),this._qoiDec.width,this._qoiDec.height),this._qoiDec.release(),i===this._qoiDec.width&&A===this._qoiDec.height){this._dec.release();let g=D.createCanvas(void 0,this._qoiDec.width,this._qoiDec.height);return g.getContext("2d")?.putImageData(a,0,0),this._storage.addImage(g),!0}}else a=new Blob([this._dec.data8],{type:n.mime});return this._dec.release(),createImageBitmap(a,{resizeWidth:i,resizeHeight:A}).then(o=>(this._storage.addImage(o),!0)).catch(o=>(console.warn(`IIP: decoding error ${n.mime} ${n.width}x${n.height}`,o),!0))}_resize(e,t){let i=this._renderer.dimensions?.css.cell.width||w.width,A=this._renderer.dimensions?.css.cell.height||w.height,s=this._renderer.dimensions?.css.canvas.width||i*this._coreTerminal.cols,n=this._renderer.dimensions?.css.canvas.height||A*this._coreTerminal.rows,a=this._dim(this._header.width,s,i),o=this._dim(this._header.height,n,A);if(!a&&!o){let g=s/e,h=(n-A)/t,I=Math.min(g,h);return I<1?[e*I,t*I]:[e,t]}return a?this._header.preserveAspectRatio||!a||!o?[a,t*a/e]:[a,o]:[e*o/t,o]}_dim(e,t,i){return e==="auto"?0:e.endsWith("%")?parseInt(e.slice(0,-1),10)*t/100:e.endsWith("px")?parseInt(e.slice(0,-2),10):parseInt(e,10)*i}};var Pe=M(ue());function be(r){let e={},t=r.split(",");for(let i of t){let A=i.indexOf("=");if(A===-1)continue;let s=i.substring(0,A),n=i.substring(A+1);if(s==="a"){e.action=n;continue}if(s==="o"){e.compression=n;continue}if(s==="t"){e.transmission=n;continue}if(s==="d"){e.deleteSelector=n;continue}let a=parseInt(n,10);switch(s){case"f":e.format=a;break;case"i":e.id=a;break;case"I":e.imageNumber=a;break;case"s":e.width=a;break;case"v":e.height=a;break;case"x":e.x=a;break;case"y":e.y=a;break;case"w":e.sourceWidth=a;break;case"h":e.sourceHeight=a;break;case"X":e.xOffset=a;break;case"Y":e.yOffset=a;break;case"c":e.columns=a;break;case"r":e.rows=a;break;case"m":e.more=a;break;case"q":e.quiet=a;break;case"C":e.cursorMovement=a;break;case"z":e.zIndex=a;break;case"p":e.placementId=a;break}}return e}var Je=0,ee=class{constructor(e,t,i,A){this._opts=e;this._renderer=t;this._kittyStorage=i;this._coreTerminal=A;this._aborted=!1;this._decodeError=!1;this._activeDecoder=null;this._inControlData=!0;this._controlData=new Uint32Array(512);this._controlLength=0;this._encodedSizeLimit=0;this._totalEncodedSize=0;this._parsedCommand=null;this._pendingTransmissions=new Map;this._maxEncodedBytes=Math.ceil(this._opts.kittySizeLimit*4/3),this._initialEncodedBytes=Math.min(4194304,this._maxEncodedBytes)}reset(){this._cleanupAllPending(),this._activeDecoder&&(this._activeDecoder.release(),this._activeDecoder=null),this._kittyStorage.reset()}dispose(){this.reset()}_removePendingEntry(e){this._pendingTransmissions.delete(e),this._lastPendingKey===e&&(this._lastPendingKey=void 0)}_cleanupAllPending(){for(let e of this._pendingTransmissions.values())e.decoder.release();this._pendingTransmissions.clear(),this._lastPendingKey=void 0}start(){this._aborted=!1,this._decodeError=!1,this._inControlData=!0,this._controlLength=0,this._parsedCommand=null,this._encodedSizeLimit=this._maxEncodedBytes,this._totalEncodedSize=0,this._activeDecoder=null}put(e,t,i){if(!this._aborted)if(!this._inControlData)this._streamPayload(e,t,i);else{let A=i;for(let n=t;n<i;n++)if(e[n]===59){this._inControlData=!1,A=n;break}let s=A-t;if(this._controlLength+s>512){this._aborted=!0;return}if(this._controlData.set(e.subarray(t,A),this._controlLength),this._controlLength+=s,!this._inControlData){if(this._parsedCommand=be(this._parseControlDataString()),this._parsedCommand.id!==void 0&&this._parsedCommand.imageNumber!==void 0){this._sendResponse(this._parsedCommand.id,"EINVAL:cannot specify both i and I keys",this._parsedCommand.quiet??0),this._aborted=!0;return}if(this._parsedCommand.action==="d")return;let n=A+1;n<i&&this._streamPayload(e,n,i)}}}_streamPayload(e,t,i){if(this._aborted)return;let A=this._parsedCommand?.id??this._lastPendingKey??0,s=this._pendingTransmissions.get(A),n=s?.totalEncodedSize??0;if(this._totalEncodedSize+=i-t,n+this._totalEncodedSize>this._encodedSizeLimit){let o=this._activeDecoder??s?.decoder;o&&o.release(),this._activeDecoder=null,s&&this._removePendingEntry(A),this._aborted=!0;return}this._decodeError||(s?.decoder&&!this._activeDecoder&&(this._activeDecoder=s.decoder),this._activeDecoder||(this._activeDecoder=new Pe.default(4194304,this._maxEncodedBytes,this._initialEncodedBytes),this._activeDecoder.init()),this._activeDecoder.put(e.subarray(t,i))!==Je&&(this._activeDecoder.release(),this._activeDecoder=null,this._decodeError=!0,s&&this._removePendingEntry(A)))}end(e){if(this._aborted||!e)return this._activeDecoder&&(this._activeDecoder.release(),this._activeDecoder=null),!0;if(this._inControlData)return this._handleNoPayloadCommand();let t=this._parsedCommand;if(t.action==="d")return this._handleDelete(t);let i=t.id??this._lastPendingKey??0,A=t.more===1,s=this._pendingTransmissions.get(i);if(A)return this._activeDecoder&&(s?(s.totalEncodedSize+=this._totalEncodedSize,s.decodeError=s.decodeError||this._decodeError):this._pendingTransmissions.set(i,{cmd:{...t},decoder:this._activeDecoder,totalEncodedSize:this._totalEncodedSize,decodeError:this._decodeError}),this._lastPendingKey=i,this._activeDecoder=null),!0;s&&(this._lastPendingKey=void 0);let n=this._decodeError,a=t,o=this._activeDecoder;s&&(a=s.cmd,o=s.decoder,n=n||s.decodeError,this._pendingTransmissions.delete(i));let g=new Uint8Array(0);o&&(o.end()!==Je&&(n=!0),g=o.data8),this._activeDecoder=null;let h=this._handleCommandWithBytesAndCmd(a,g,n);return o&&o.release(),h}_parseControlDataString(){let e="";for(let t=0;t<this._controlLength;t++)e+=String.fromCodePoint(this._controlData[t]);return e}_handleNoPayloadCommand(){let e=be(this._parseControlDataString());if(e.id!==void 0&&e.imageNumber!==void 0)return this._sendResponse(e.id,"EINVAL:cannot specify both i and I keys",e.quiet??0),!0;switch(e.action??"t"){case"d":return this._handleDelete(e);case"q":return this._sendResponse(e.id??0,"OK",e.quiet??0),!0;case"p":return this._handlePlacement(e);default:return e.id!==void 0&&this._sendResponse(e.id,"EINVAL:unsupported action",e.quiet??0),!0}}_handleCommandWithBytesAndCmd(e,t,i){switch(e.action??"t"){case"t":{let s=this._handleTransmit(e,t,i);return(e.transmission??"d")==="d"&&e.id!==void 0&&(i?this._sendResponse(e.id,"EINVAL:invalid base64 data",e.quiet??0):t.length>0&&this._sendResponse(e.id,"OK",e.quiet??0)),s}case"T":return this._handleTransmitDisplay(e,t,i);case"q":return this._handleQuery(e,t,i);case"p":return this._handlePlacement(e);default:return e.id!==void 0&&this._sendResponse(e.id,"EINVAL:unsupported action",e.quiet??0),!0}}_handlePlacement(e){if(e.id===void 0)return!0;let t=e.id,i=this._kittyStorage.getImage(t);return i?this._displayImage(i,e).then(s=>(this._sendResponse(t,s?"OK":"EINVAL:image rendering failed",e.quiet??0,e.placementId),!0)):(this._sendResponse(t,"ENOENT:image not found",e.quiet??0,e.placementId),!0)}_handleTransmit(e,t,i){return(e.transmission??"d")!=="d"?(e.id!==void 0&&this._sendResponse(e.id,"EINVAL:unsupported transmission medium",e.quiet??0),!0):(i||t.length===0||this._kittyStorage.storeImage(e.id,{data:new Blob([t]),width:e.width??0,height:e.height??0,format:e.format??32,compression:e.compression??""}),!0)}_handleTransmitDisplay(e,t,i){if(i)return e.id!==void 0&&this._sendResponse(e.id,"EINVAL:invalid base64 data",e.quiet??0),!0;this._handleTransmit(e,t,i);let A=e.id??this._kittyStorage.lastImageId,s=this._kittyStorage.getImage(A);if(s){let n=this._displayImage(s,e);return e.id!==void 0?n.then(a=>(this._sendResponse(A,a?"OK":"EINVAL:image rendering failed",e.quiet??0),!0)):n.then(()=>!0)}return!0}_handleQuery(e,t,i){let A=e.id??0,s=e.quiet??0;if((e.transmission??"d")!=="d")return this._sendResponse(A,"EINVAL:unsupported transmission medium",s),!0;if(i)return this._sendResponse(A,"EINVAL:invalid base64 data",s),!0;if(t.length===0)return this._sendResponse(A,"OK",s),!0;let a=e.format??32;if(a===100)this._sendResponse(A,"OK",s);else{let o=e.width??0,g=e.height??0;if(!o||!g)return this._sendResponse(A,"EINVAL:width and height required for raw pixel data",s),!0;let h=a===32?4:3,I=o*g*h;if(t.length<I)return this._sendResponse(A,"EINVAL:insufficient pixel data",s),!0;this._sendResponse(A,"OK",s)}return!0}_handleDelete(e){switch(e.deleteSelector??"a"){case"a":case"A":this._cleanupAllPending(),this._kittyStorage.deleteAll();break;case"i":case"I":if(e.id!==void 0){let i=this._pendingTransmissions.get(e.id);i&&i.decoder.release(),this._removePendingEntry(e.id),this._kittyStorage.deleteById(e.id)}break;default:break}return!0}_sendResponse(e,t,i,A){let s=t==="OK";if(s&&i>=1||!s&&i>=2)return;let n=A?`,p=${A}`:"",a=`\x1B_Gi=${e}${n};${t}\x1B\\`;this._coreTerminal._core.coreService.triggerDataEvent(a)}_displayImage(e,t){return this._decodeAndDisplay(e,t).then(()=>!0).catch(()=>!1)}async _decodeAndDisplay(e,t){let i=await this._createBitmap(e);try{let A=Math.max(0,t.x??0),s=Math.max(0,t.y??0),n=t.sourceWidth||i.width-A,a=t.sourceHeight||i.height-s,o=Math.max(0,i.width-A),g=Math.max(0,i.height-s),h=Math.max(0,Math.min(n,o)),I=Math.max(0,Math.min(a,g));if(h===0||I===0)throw new Error("invalid source rectangle");if(A!==0||s!==0||h!==i.width||I!==i.height){let T=await createImageBitmap(i,A,s,h,I);i.close(),i=T}let d=this._renderer.dimensions?.css.cell.width||w.width,c=this._renderer.dimensions?.css.cell.height||w.height,l,E;t.columns!==void 0&&t.rows!==void 0?(l=t.columns,E=t.rows):t.columns!==void 0?(l=t.columns,E=Math.max(1,Math.ceil(i.height/i.width*(l*d)/c))):t.rows!==void 0?(E=t.rows,l=Math.max(1,Math.ceil(i.width/i.height*(E*c)/d))):(l=Math.ceil(i.width/d),E=Math.ceil(i.height/c));let p=i.width,u=i.height;if((t.columns!==void 0||t.rows!==void 0)&&(p=Math.round(l*d),u=Math.round(E*c)),p*u>this._opts.pixelLimit)throw new Error("image exceeds pixel limit");let C=this._coreTerminal._core.buffer,Q=C.x,K=C.y,Y=C.ybase,Ve=t.zIndex!==void 0&&t.zIndex<0?"bottom":"top";if(p!==i.width||u!==i.height){let T=await createImageBitmap(i,{resizeWidth:p,resizeHeight:u});i.close(),i=T}let oe=Math.min(Math.max(0,t.xOffset??0),d-1),he=Math.min(Math.max(0,t.yOffset??0),c-1);if(oe!==0||he!==0){let T=t.columns!==void 0?Math.round(l*d):i.width+oe,et=t.rows!==void 0?Math.round(E*c):i.height+he,q=D.createCanvas(window.document,T,et),Le=q.getContext("2d");if(!Le)throw new Error("Failed to create offset canvas context");Le.drawImage(i,oe,he);let tt=await createImageBitmap(q);if(q.width=q.height=0,i.close(),i=tt,p=i.width,u=i.height,p*u>this._opts.pixelLimit)throw new Error("image exceeds pixel limit");t.columns===void 0&&(l=Math.ceil(i.width/d)),t.rows===void 0&&(E=Math.ceil(i.height/c))}let $e=t.zIndex??0;if(this._kittyStorage.addImage(e.id,i,!0,Ve,$e),i=void 0,t.cursorMovement===1){let T=C.ybase-Y;C.x=Q,C.y=Math.max(K-T,0)}else C.x=Math.min(Q+l,this._coreTerminal.cols)}catch(A){throw i?.close(),A}}async _createBitmap(e){let t=new Uint8Array(await e.data.arrayBuffer());if(e.compression==="z"&&(t=await this._decompressZlib(t)),e.format===100){let p=new Blob([t],{type:"image/png"});if(!window.createImageBitmap){let u=URL.createObjectURL(p),C=new Image;return new Promise((Q,K)=>{C.addEventListener("load",()=>{URL.revokeObjectURL(u);let Y=D.createCanvas(window.document,C.width,C.height);Y.getContext("2d")?.drawImage(C,0,0),createImageBitmap(Y).then(Q).catch(K)}),C.addEventListener("error",()=>{URL.revokeObjectURL(u),K(new Error("Failed to load image"))}),C.src=u})}return createImageBitmap(p)}let i=e.width,A=e.height;if(!i||!A)throw new Error("Width and height required for raw pixel data");let s=e.format===32?4:3,n=i*A*s;if(t.length<n)throw new Error("Insufficient pixel data");let a=i*A;if(e.format===32)return createImageBitmap(new ImageData(new Uint8ClampedArray(t.buffer,t.byteOffset,a*4),i,A));let o=new Uint8ClampedArray(a*4),g=new Uint32Array(t.buffer,t.byteOffset,Math.floor(t.byteLength/4)),h=new Uint32Array(o.buffer),I=a&-4,d=0,c=0;for(let p=0;p<I;p+=4){let u=g[d++],C=g[d++],Q=g[d++];h[c++]=4278190080|u,h[c++]=4278190080|u>>>24|C<<8,h[c++]=4278190080|C>>>16|Q<<16,h[c++]=4278190080|Q>>>8}let l=I*3,E=I*4;for(let p=I;p<a;p++)o[E]=t[l],o[E+1]=t[l+1],o[E+2]=t[l+2],o[E+3]=255,l+=3,E+=4;return createImageBitmap(new ImageData(o,i,A))}async _decompressZlib(e){try{return await this._decompress(e,"deflate")}catch{return await this._decompress(e,"deflate-raw")}}async _decompress(e,t){let i=new DecompressionStream(t),A=i.writable.getWriter();A.write(e),A.close();let s=[],n=i.readable.getReader();for(;;){let{done:h,value:I}=await n.read();if(h)break;s.push(I)}let a=s.reduce((h,I)=>h+I.length,0),o=new Uint8Array(a),g=0;for(let h of s)o.set(h,g),g+=h.length;return o}get images(){return this._kittyStorage.images}get _kittyIdToStorageId(){return this._kittyStorage.kittyIdToStorageId}get pendingTransmissions(){return this._pendingTransmissions}};var U=class U{constructor(e){this._storage=e;this._nextImageId=1;this._images=new Map;this._kittyIdToStorageId=new Map;this._storageIdToKittyId=new Map;this._handleStorageImageDeleted=e=>{let t=this._storageIdToKittyId.get(e);t!==void 0&&(this._kittyIdToStorageId.delete(t),this._storageIdToKittyId.delete(e),this._images.delete(t))};this._addImageOpts={scrolling:!0,layer:"top",zIndex:0,cursorPos:"iip"};this._previousOnImageDeleted=this._storage.onImageDeleted,this._wrappedOnImageDeleted=t=>{this._previousOnImageDeleted?.(t),this._handleStorageImageDeleted(t)},this._storage.onImageDeleted=this._wrappedOnImageDeleted}reset(){this._nextImageId=1,this._images.clear(),this._kittyIdToStorageId.clear(),this._storageIdToKittyId.clear()}dispose(){this.reset(),this._storage.onImageDeleted===this._wrappedOnImageDeleted&&(this._storage.onImageDeleted=this._previousOnImageDeleted)}storeImage(e,t){let i=e??this._nextImageId++,A=this._kittyIdToStorageId.get(i);return A!==void 0&&(this._storage.deleteImage(A),this._kittyIdToStorageId.delete(i),this._storageIdToKittyId.delete(A)),!this._images.has(i)&&this._images.size>=U._maxStoredImages&&this._evictUndisplayedImages(),this._images.set(i,{...t,id:i}),i}addImage(e,t,i,A,s){let n=this._kittyIdToStorageId.get(e);n!==void 0&&this._storageIdToKittyId.delete(n),this._addImageOpts.scrolling=i,this._addImageOpts.layer=A,this._addImageOpts.zIndex=s;let a=this._storage.addImage(t,this._addImageOpts);this._kittyIdToStorageId.set(e,a),this._storageIdToKittyId.set(a,e)}getImage(e){return this._images.get(e)}deleteById(e){this._images.delete(e);let t=this._kittyIdToStorageId.get(e);t!==void 0&&(this._storage.deleteImage(t),this._kittyIdToStorageId.delete(e),this._storageIdToKittyId.delete(t))}deleteAll(){this._images.clear();for(let e of this._kittyIdToStorageId.values())this._storage.deleteImage(e);this._kittyIdToStorageId.clear(),this._storageIdToKittyId.clear()}get images(){return this._images}get kittyIdToStorageId(){return this._kittyIdToStorageId}get lastImageId(){return this._nextImageId-1}_evictUndisplayedImages(){for(let[e]of this._images){if(this._images.size<=U._maxStoredImages/2)break;this._kittyIdToStorageId.has(e)||this._images.delete(e)}}};U._maxStoredImages=256;var te=U;var y=M(X());var ze=M(We());var xt=4194304,Se=y.PALETTE_ANSI_256;Se.set(y.PALETTE_VT340_COLOR);var se=class{constructor(e,t,i){this._opts=e;this._storage=t;this._coreTerminal=i;this._size=0;this._aborted=!1;(0,ze.DecoderAsync)({memoryLimit:this._opts.pixelLimit*4,palette:Se,paletteLimit:this._opts.sixelPaletteLimit}).then(A=>this._dec=A)}reset(){this._dec&&(this._dec.release(),this._dec._palette.fill(0),this._dec.init(0,Se,this._opts.sixelPaletteLimit))}hook(e){if(this._size=0,this._aborted=!1,this._dec){let t=e.params[1]===1?0:Mt(this._coreTerminal._core._inputHandler._curAttrData,this._coreTerminal._core._themeService?.colors);this._dec.init(t,null,this._opts.sixelPaletteLimit)}}put(e,t,i){if(!(this._aborted||!this._dec)){if(this._size+=i-t,this._size>this._opts.sixelSizeLimit){console.warn("SIXEL: too much data, aborting"),this._aborted=!0,this._dec.release();return}try{this._dec.decode(e,t,i)}catch(A){console.warn(`SIXEL: error while decoding image - ${A}`),this._aborted=!0,this._dec.release()}}}unhook(e){if(this._aborted||!e||!this._dec)return!0;let t=this._dec.width,i=this._dec.height;if(!t||!i)return i&&this._storage.advanceCursor(i),!0;let A=D.createCanvas(void 0,t,i);return A.getContext("2d")?.putImageData(new ImageData(this._dec.data8,t,i),0,0),this._dec.memoryUsage>xt&&this._dec.release(),this._storage.addImage(A),!0}};function Mt(r,e){let t=0;if(!e)return t;if(r.isInverse())if(r.isFgDefault())t=re(e.foreground.rgba);else if(r.isFgRGB()){let i=r.constructor.toColorRGB(r.getFgColor());t=(0,y.toRGBA8888)(...i)}else t=re(e.ansi[r.getFgColor()].rgba);else if(r.isBgDefault())t=re(e.background.rgba);else if(r.isBgRGB()){let i=r.constructor.toColorRGB(r.getBgColor());t=(0,y.toRGBA8888)(...i)}else t=re(e.ansi[r.getBgColor()].rgba);return t}function re(r){return y.BIG_ENDIAN?r:(r&255)<<24|(r>>>8&255)<<16|(r>>>16&255)<<8|r>>>24&255}var ne=class{constructor(e,t,i,A){this._storage=e;this._opts=t;this._renderer=i;this._terminal=A;this._addImageOpts={scrolling:!0,layer:"top",zIndex:0,cursorPos:"vt340"}}addImage(e){this._addImageOpts.scrolling=this._opts.sixelScrolling,this._storage.addImage(e,this._addImageOpts)}advanceCursor(e){if(this._opts.sixelScrolling){let t=this._renderer.cellSize;(t.width===-1||t.height===-1)&&(t=w);let i=Math.ceil(e/t.height);for(let A=1;A<i;++A)this._terminal._core._inputHandler.lineFeed()}}};var ae=class{constructor(e){this._storage=e;this._addImageOpts={scrolling:!0,layer:"top",zIndex:0,cursorPos:"iip"}}addImage(e){this._storage.addImage(e,this._addImageOpts)}};var Xe={enableSizeReports:!0,pixelLimit:16777216,sixelSupport:!0,sixelScrolling:!0,sixelPaletteLimit:4096,sixelSizeLimit:33554432,storageLimit:128,showPlaceholder:!0,iipSupport:!0,iipSizeLimit:33554432,kittySupport:!0,kittySizeLimit:33554432},Ze=4096;var je=class{constructor(e){this._disposables=[];this._handlers=new Map;this._onImageAdded=new z;this.onImageAdded=this._onImageAdded.event;this._opts=Object.assign({},Xe,e),this._defaultOpts=Object.assign({},Xe,e)}dispose(){for(let e of this._disposables)e.dispose();this._disposables.length=0,this._handlers.clear(),this._onImageAdded.dispose()}_disposeLater(...e){for(let t of e)this._disposables.push(t)}activate(e){if(this._terminal=e,this._renderer=new D(e),this._storage=new Z(e,this._renderer,this._opts),this._storage.onImageAdded=()=>this._onImageAdded.fire(),this._opts.enableSizeReports){let t=e.options.windowOptions??{};t.getWinSizePixels=!0,t.getCellSizePixels=!0,t.getWinSizeChars=!0,e.options.windowOptions=t}if(this._disposeLater(this._renderer,this._storage,e.parser.registerCsiHandler({prefix:"?",final:"h"},t=>this._decset(t)),e.parser.registerCsiHandler({prefix:"?",final:"l"},t=>this._decrst(t)),e.parser.registerCsiHandler({final:"c"},t=>this._da1(t)),e.parser.registerCsiHandler({prefix:"?",final:"S"},t=>this._xtermGraphicsAttributes(t)),e.onRender(t=>this._storage?.render(t)),e.parser.registerCsiHandler({intermediates:"!",final:"p"},()=>this.reset()),e.parser.registerEscHandler({final:"c"},()=>this.reset()),e._core._inputHandler.onRequestReset(()=>this.reset()),e.buffer.onBufferChange(()=>this._storage?.wipeAlternate()),e.onResize(t=>this._storage?.viewportResize(t))),this._opts.sixelSupport){let t=new ne(this._storage,this._opts,this._renderer,e),i=new se(this._opts,t,e);this._handlers.set("sixel",i),this._disposeLater(e._core._inputHandler._parser.registerDcsHandler({final:"q"},i))}if(this._opts.iipSupport){let t=new ae(this._storage),i=new $(this._opts,this._renderer,t,e);this._handlers.set("iip",i),this._disposeLater(e._core._inputHandler._parser.registerOscHandler(1337,i))}if(this._opts.kittySupport){let t=new te(this._storage),i=new ee(this._opts,this._renderer,t,e);this._handlers.set("kitty",i),this._disposeLater(t,i,e._core._inputHandler._parser.registerApcHandler({final:"G"},i))}}reset(){this._opts.sixelScrolling=this._defaultOpts.sixelScrolling,this._opts.sixelPaletteLimit=this._defaultOpts.sixelPaletteLimit,this._storage?.reset();for(let e of this._handlers.values())e.reset();return!1}get storageLimit(){return this._storage?.getLimit()||-1}set storageLimit(e){this._storage?.setLimit(e),this._opts.storageLimit=e}get storageUsage(){return this._storage?this._storage.getUsage():-1}get showPlaceholder(){return this._opts.showPlaceholder}set showPlaceholder(e){this._opts.showPlaceholder=e,this._renderer?.showPlaceholder(e)}getImageAtBufferCell(e,t){return this._storage?.getImageAtBufferCell(e,t)}extractTileAtBufferCell(e,t){return this._storage?.extractTileAtBufferCell(e,t)}_report(e){this._terminal?._core.input(e,!1)}_decset(e){for(let t=0;t<e.length;++t)e[t]===80&&(this._opts.sixelScrolling=!1);return!1}_decrst(e){for(let t=0;t<e.length;++t)e[t]===80&&(this._opts.sixelScrolling=!0);return!1}_da1(e){return e[0]?!0:this._opts.sixelSupport?(this._report("\x1B[?62;4;9;22c"),!0):!1}_xtermGraphicsAttributes(e){if(e.length<2)return!0;if(e[0]===1)switch(e[1]){case 1:return this._report(`\x1B[?${e[0]};0;${this._opts.sixelPaletteLimit}S`),!0;case 2:this._opts.sixelPaletteLimit=this._defaultOpts.sixelPaletteLimit,this._report(`\x1B[?${e[0]};0;${this._opts.sixelPaletteLimit}S`);for(let t of this._handlers.values())t.reset();return!0;case 3:return e.length>2&&!(e[2]instanceof Array)&&e[2]<=Ze?(this._opts.sixelPaletteLimit=e[2],this._report(`\x1B[?${e[0]};0;${this._opts.sixelPaletteLimit}S`)):this._report(`\x1B[?${e[0]};2S`),!0;case 4:return this._report(`\x1B[?${e[0]};0;${Ze}S`),!0;default:return this._report(`\x1B[?${e[0]};2S`),!0}if(e[0]===2)switch(e[1]){case 1:let t=this._renderer?.dimensions?.css.canvas.width,i=this._renderer?.dimensions?.css.canvas.height;if(!t||!i){let s=w;t=(this._terminal?.cols||80)*s.width,i=(this._terminal?.rows||24)*s.height}if(t*i<this._opts.pixelLimit)this._report(`\x1B[?${e[0]};0;${t.toFixed(0)};${i.toFixed(0)}S`);else{let s=Math.floor(Math.sqrt(this._opts.pixelLimit));this._report(`\x1B[?${e[0]};0;${s};${s}S`)}return!0;case 4:let A=Math.floor(Math.sqrt(this._opts.pixelLimit));return this._report(`\x1B[?${e[0]};0;${A};${A}S`),!0;default:return this._report(`\x1B[?${e[0]};2S`),!0}return this._report(`\x1B[?${e[0]};1S`),!0}};export{je as ImageAddon};
-+var At=Object.create;var Me=Object.defineProperty;var st=Object.getOwnPropertyDescriptor;var rt=Object.getOwnPropertyNames;var nt=Object.getPrototypeOf,at=Object.prototype.hasOwnProperty;var x=(s,e)=>()=>{try{return e||s((e={exports:{}}).exports,e),e.exports}catch(t){throw e=0,t}};var ot=(s,e,t,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let A of rt(e))!at.call(s,A)&&A!==t&&Me(s,A,{get:()=>e[A],enumerable:!(i=st(e,A))||i.enumerable});return s};var M=(s,e,t)=>(t=s!=null?At(nt(s)):{},ot(e||!s||!s.__esModule?Me(t,"default",{value:s,enumerable:!0}):t,s));var Z=x(_=>{"use strict";Object.defineProperty(_,"__esModule",{value:!0});_.DEFAULT_FOREGROUND=_.DEFAULT_BACKGROUND=_.PALETTE_ANSI_256=_.PALETTE_VT340_GREY=_.PALETTE_VT340_COLOR=_.normalizeHLS=_.normalizeRGB=_.nearestColorIndex=_.fromRGBA8888=_.toRGBA8888=_.alpha=_.blue=_.green=_.red=_.BIG_ENDIAN=void 0;_.BIG_ENDIAN=new Uint8Array(new Uint32Array([4278190080]).buffer)[0]===255;_.BIG_ENDIAN&&console.warn("BE platform detected. This version of node-sixel works only on LE properly.");function ve(s){return s&255}_.red=ve;function Re(s){return s>>>8&255}_.green=Re;function ke(s){return s>>>16&255}_.blue=ke;function gt(s){return s>>>24&255}_.alpha=gt;function f(s,e,t,i=255){return((i&255)<<24|(t&255)<<16|(e&255)<<8|s&255)>>>0}_.toRGBA8888=f;function dt(s){return[s&255,s>>8&255,s>>16&255,s>>>24]}_.fromRGBA8888=dt;function It(s,e){let t=ve(s),i=Re(s),A=ke(s),r=Number.MAX_SAFE_INTEGER,n=-1;for(let a=0;a<e.length;++a){let o=t-e[a][0],h=i-e[a][1],g=A-e[a][2],d=o*o+h*h+g*g;if(!d)return a;d<r&&(r=d,n=a)}return n}_.nearestColorIndex=It;function Ie(s,e,t){return Math.max(s,Math.min(t,e))}function le(s,e,t){return t<0&&(t+=1),t>1&&(t-=1),t*6<1?e+(s-e)*6*t:t*2<1?s:t*3<2?e+(s-e)*(4-t*6):e}function lt(s,e,t){if(!t){let r=Math.round(e*255);return f(r,r,r)}let i=e<.5?e*(1+t):e+t-e*t,A=2*e-i;return f(Ie(0,255,Math.round(le(i,A,s+1/3)*255)),Ie(0,255,Math.round(le(i,A,s)*255)),Ie(0,255,Math.round(le(i,A,s-1/3)*255)))}function m(s,e,t){return(4278190080|Math.round(t/100*255)<<16|Math.round(e/100*255)<<8|Math.round(s/100*255))>>>0}_.normalizeRGB=m;function ct(s,e,t){return lt((s+240%360)/360,e/100,t/100)}_.normalizeHLS=ct;_.PALETTE_VT340_COLOR=new Uint32Array([m(0,0,0),m(20,20,80),m(80,13,13),m(20,80,20),m(80,20,80),m(20,80,80),m(80,80,20),m(53,53,53),m(26,26,26),m(33,33,60),m(60,26,26),m(33,60,33),m(60,33,60),m(33,60,60),m(60,60,33),m(80,80,80)]);_.PALETTE_VT340_GREY=new Uint32Array([m(0,0,0),m(13,13,13),m(26,26,26),m(40,40,40),m(6,6,6),m(20,20,20),m(33,33,33),m(46,46,46),m(0,0,0),m(13,13,13),m(26,26,26),m(40,40,40),m(6,6,6),m(20,20,20),m(33,33,33),m(46,46,46)]);_.PALETTE_ANSI_256=(()=>{let s=[f(0,0,0),f(205,0,0),f(0,205,0),f(205,205,0),f(0,0,238),f(205,0,205),f(0,250,205),f(229,229,229),f(127,127,127),f(255,0,0),f(0,255,0),f(255,255,0),f(92,92,255),f(255,0,255),f(0,255,255),f(255,255,255)],e=[0,95,135,175,215,255];for(let t=0;t<6;++t)for(let i=0;i<6;++i)for(let A=0;A<6;++A)s.push(f(e[t],e[i],e[A]));for(let t=8;t<=238;t+=10)s.push(f(t,t,t));return new Uint32Array(s)})();_.DEFAULT_BACKGROUND=f(0,0,0,255);_.DEFAULT_FOREGROUND=f(255,255,255,255)});var _e=x(me=>{"use strict";Object.defineProperty(me,"__esModule",{value:!0});me.InWasm=pt;var v=s=>{if(Uint8Array.fromBase64)return Uint8Array.fromBase64(s);if(typeof Buffer<"u")return Buffer.from(s,"base64");let e=atob(s),t=new Uint8Array(e.length);for(let i=0;i<t.length;++i)t[i]=e.charCodeAt(i);return t};function pt(s){if(s.d){let{t:e,s:t,d:i}=s,A,r,n=WebAssembly;return e===0?t?a=>new n.Instance(r||(r=new n.Module(A||(A=v(i)))),a):a=>r?n.instantiate(r,a):n.instantiate(A||(A=v(i)),a).then(o=>(r=o.module)&&o.instance):e===1?t?()=>r||(r=new n.Module(A||(A=v(i)))):()=>r?Promise.resolve(r):n.compile(A||(A=v(i))).then(a=>r=a):t?()=>A||(A=v(i)):()=>Promise.resolve(A||(A=v(i)))}if(typeof _wasmCtx>"u")throw new Error('must run "inwasm"');_wasmCtx.add(s)}});var Ce=x(Ee=>{"use strict";Object.defineProperty(Ee,"__esModule",{value:!0});var Bt=_e(),ft=(0,Bt.InWasm)({s:1,t:0,d:"AGFzbQEAAAABBQFgAAF/Ag8BA2VudgZtZW1vcnkCAAEDAwIAAAcNAgNkZWMAAANlbmQAAQqLBgKZBAEKf0GIKCgCAEGgKGohAUGEKCgCACIDQaAoaiEAQYAoKAIAQQFrQXxxIgRBoChqIQUgBEEQayADSgRAIARBkChqIQMDQCABIABBA2otAABBAnQoAoAgIABBAmotAABBAnQoAoAYIABBAWotAABBAnQoAoAQIAAtAABBAnQoAoAIcnJyIgY2AgAgAUEDaiAAQQdqLQAAQQJ0KAKAICAAQQZqLQAAQQJ0KAKAGCAAQQVqLQAAQQJ0KAKAECAAQQRqLQAAQQJ0KAKACHJyciIHNgIAIAFBBmogAEELai0AAEECdCgCgCAgAEEKai0AAEECdCgCgBggAEEJai0AAEECdCgCgBAgAEEIai0AAEECdCgCgAhycnIiCDYCACABQQlqIABBD2otAABBAnQoAoAgIABBDmotAABBAnQoAoAYIABBDWotAABBAnQoAoAQIABBDGotAABBAnQoAoAIcnJyIgk2AgAgAiAGciAHciAIciAJciECIAFBDGohASAAQRBqIgAgA0kNAAsLIAAgBUkEQANAIAEgAEEDai0AAEECdCgCgCAgAEECai0AAEECdCgCgBggAEEBai0AAEECdCgCgBAgAC0AAEECdCgCgAhycnIiAzYCACACIANyIQIgAUEDaiEBIABBBGoiACAFSQ0ACwtBfyEAIAJB////B00Ef0GEKCAENgIAQYgoIAFBoChrNgIAQQAFQX8LC+0BAQR/AkBBgCgoAgAiAUGEKCgCACIAa0EFTgRAQX8hAxAADQFBgCgoAgAhAUGEKCgCACEAC0F/IQMgASAAayIBQQJIDQAgAC0AoShBAnQoAoAQIAAtAKAoQQJ0KAKACHIhAgJ/IAFBBEYEQEEDQQQgAC0AoyhBPUYbIAAtAKIoQT1GayEBC0EBIAFBA0kNABogAC0AoihBAnQoAoAYIAJyIQJBAiABQQRHDQAaIAAtAKMoQQJ0KAKAICACciECQQMLIQEgAkH///8HSw0AQQAhA0GIKCgCACIAIAI2AKAoQYgoIAAgAWo2AgALIAML"}),S=new Uint8Array("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".split("").map(s=>s.charCodeAt(0))),R=new Uint32Array(1024);R.fill(4278190080);for(let s=0;s<S.length;++s)R[S[s]]=s<<2;for(let s=0;s<S.length;++s)R[256+S[s]]=s>>4|(s<<4&255)<<8;for(let s=0;s<S.length;++s)R[512+S[s]]=s>>2<<8|(s<<6&255)<<16;for(let s=0;s<S.length;++s)R[768+S[s]]=s<<16;var Qt=new Uint8Array(0),ue=class{constructor(e,t,i){if(this._inst=null,this._ended=!0,this._bytes=0,this.keepSize=e??1048576,this.maxBytes=t??4294901760,this._bytes=i??32768,this._bytes>this.maxBytes||this.maxBytes>4294901760)throw new Error("invalid byte settings")}get data8(){return this._inst?this._d.subarray(0,this._m32[1282]):Qt}release(){this._inst&&(this._bytes>this.keepSize?this._inst=this._m32=this._d=this._mem=null:(this._m32[1280]=0,this._m32[1281]=0,this._m32[1282]=0))}init(e,t){if(this.maxBytes=e??this.maxBytes,this._bytes=t??Math.min(this._bytes,this.maxBytes),this._bytes>this.maxBytes||this.maxBytes>4294901760)throw Error("invalid byte settings");let i=this._m32,A=this._bytes+5152;this._inst?this._mem.buffer.byteLength<A&&(this._mem.grow(Math.ceil((A-this._mem.buffer.byteLength)/65536)),i=new Uint32Array(this._mem.buffer,0),this._d=new Uint8Array(this._mem.buffer,5152)):(this._mem=new WebAssembly.Memory({initial:Math.ceil(A/65536)}),this._inst=ft({env:{memory:this._mem}}),i=new Uint32Array(this._mem.buffer,0),i.set(R,256),this._d=new Uint8Array(this._mem.buffer,5152)),i[1280]=0,i[1281]=0,i[1282]=0,this._m32=i,this._ended=!1}_realloc(e){let t=this._m32[1280]+e;if(this._bytes<t){if(t>this.maxBytes)return-3;let i=this._bytes;for(;(i*=2)<t;);if(i=Math.min(i,this.maxBytes),i<t)return-3;if(i+5152>this._mem.buffer.byteLength){let A=Math.ceil((i+5152-this._mem.buffer.byteLength)/65536);this._mem.grow(A),this._m32=new Uint32Array(this._mem.buffer,0),this._d=new Uint8Array(this._mem.buffer,5152)}this._bytes=i}return 0}put(e){if(!this._inst||this._ended)return-2;if(this._realloc(e.length))return-3;let t=this._m32;return this._d.set(e,t[1280]),t[1280]+=e.length,t[1280]-t[1281]>=131072?this._inst.exports.dec():0}end(){return this._ended=!0,this._inst?this._inst.exports.end():-2}get loadedBytes(){return this._inst?this._m32[1280]:0}get freeBytes(){return this._inst?this.maxBytes-this._m32[1280]:0}};Ee.default=ue});var Ne=x(Be=>{"use strict";Object.defineProperty(Be,"__esModule",{value:!0});var Dt=_e(),wt=(0,Dt.InWasm)({s:1,t:0,d:"AGFzbQEAAAABCgJgAABgA39/fwACDwEDZW52Bm1lbW9yeQIAAQMDAgABBwcBA2RlYwABCAEACu4EAgwAQQBBAEGAAvwLAAveBAEJf0EAQQBBgAL8CwAgAUEXTgRAIAAgAWpBCGshCkGACCEBIAJBAnRBgAhqIQsgAEEOaiEDQf8BIQZBACECA0AgA0EBaiEHIAMtAAAiCEE/cSEAAkACQCAIQcABcSIJRQRAIABBAnQiAC0AAyEGIAAtAAIhBCAALQABIQUgAC0AACECIAchAwwBCwJAIAhB/QFLDQAgCUHAAUcNACAFQQVsIAJBA2xqIARBB2xqIAZBC2xqQT9xQQJ0IgMgBDoAAiADIAU6AAEgAyACOgAAIANBA2ogBjoAAANAIAEgAjoAACABQQNqIAY6AAAgAUECaiAEOgAAIAFBAWogBToAACABQQRqIQEgAEUEQCAHIQMMBAsgAEEBayEAIAEgC0kNAAsgByEDDAILAn8CQAJAAkAgCEH+AWsOAgABAgsgAy0AAyEEIAMtAAIhBSADLQABIQIgA0EEagwCCyADKAIBIgJBGHYhBiACQRB2IQQgAkEIdiEFIANBBWoMAQsgCUGAAUcEQCAHIAlBwABHDQEaIAQgCEEDcWpBAmshBCACIABBBHZqQQJrIQIgBSAIQQJ2QQNxakECayEFIAcMAQsgBCAAQShrIgkgAy0AASIHQQ9xamohBCACIAdBBHYgCWpqIQIgACAFakEgayEFIANBAmoLIQMgBUEFbCACQQNsaiAEQQdsaiAGQQtsakE/cUECdCIAIAQ6AAIgACAFOgABIAAgAjoAACAAQQNqIAY6AAALIAEgBjoAAyABIAQ6AAIgASAFOgABIAEgAjoAACABQQRqIQELIAMgCkkNAAsLCw=="}),pe=class{constructor(e){this.keepSize=e,this.width=0,this.height=0}decode(e){this.width=e[4]<<24|e[5]<<16|e[6]<<8|e[7],this.height=e[8]<<24|e[9]<<16|e[10]<<8|e[11];let t=this.width*this.height,i=t*4,A=e.length,r=Math.max(i,A)+(Math.min(i,A)>>1)+4096;this._inst?this._mem.buffer.byteLength<r&&(this._mem.grow(Math.ceil((r-this._mem.buffer.byteLength)/65536)),this._d=null):(this._mem=new WebAssembly.Memory({initial:Math.ceil(r/65536)}),this._inst=wt({env:{memory:this._mem}})),this._d||(this._d=new Uint8Array(this._mem.buffer));let n=this._mem.buffer.byteLength-A&-256;return this._d.set(e,n),this._inst.exports.dec(n,A,t),this._d.subarray(1024,1024+i)}release(){this._inst&&this._mem.buffer.byteLength>this.keepSize&&(this._inst=this._d=this._mem=null)}};Be.default=pe});var Ye=x(se=>{"use strict";Object.defineProperty(se,"__esModule",{value:!0});se.LIMITS=void 0;se.LIMITS={CHUNK_SIZE:16384,PALETTE_SIZE:4096,MAX_WIDTH:16384,BYTES:"AGFzbQEAAAABJAdgAAF/YAJ/fwBgA39/fwF/YAF/AX9gAABgBH9/f38AYAF/AAIlAgNlbnYLaGFuZGxlX2JhbmQAAwNlbnYLbW9kZV9wYXJzZWQAAwMTEgQAAAAAAQQBAQUBAAACAgAGAwQFAXABBwcFBAEBBwcGCAF/AUGAihoLB9wBDgZtZW1vcnkCABFnZXRfc3RhdGVfYWRkcmVzcwADEWdldF9jaHVua19hZGRyZXNzAAQOZ2V0X3AwX2FkZHJlc3MABRNnZXRfcGFsZXR0ZV9hZGRyZXNzAAYEaW5pdAALBmRlY29kZQAMDWN1cnJlbnRfd2lkdGgADQ5jdXJyZW50X2hlaWdodAAOGV9faW5kaXJlY3RfZnVuY3Rpb25fdGFibGUBAAtfaW5pdGlhbGl6ZQACCXN0YWNrU2F2ZQARDHN0YWNrUmVzdG9yZQASCnN0YWNrQWxsb2MAEwkMAQBBAQsGCgcJDxACDAEBCq5UEgMAAQsFAEGgCAsGAEGQiQELBgBBsIkCCwUAQZAJC+okAQh/QeQIKAIAIQVB4AgoAgAhA0HoCCgCACEIIAFBkIkBaiIJQf8BOgAAIAAgAUgEQCAAQZCJAWohBgNAIAMhBCAGQQFqIQECQCAGLQAAQf8AcSIDQTBrQQlLBEAgASEGDAELQewIKAIAQQJ0QewIaiICKAIAIQADQCACIAMgAEEKbGpBMGsiADYCACABLQAAIQMgAUEBaiIGIQEgA0H/AHEiA0Ewa0EKSQ0ACwsCQAJAAkACQAJAAkACQAJ/AkACQCADQT9rIgBBP00EQCAERQ0BIARBIUYEQAJAQfAIKAIAIgFBASABGyIHIAhqIgFB1AgoAgAiA0gNACADQf//AEoNAANAIANBAnQiAkGgiQJqIgRBoAgpAwA3AwAgAkGoiQJqQaAIKQMANwMAIAJBsIkCakGgCCkDADcDACACQbiJAmpBoAgpAwA3AwAgAkHAiQJqQaAIKQMANwMAIAJByIkCakGgCCkDADcDACACQdCJAmpBoAgpAwA3AwAgAkHYiQJqQaAIKQMANwMAIAJB4IkCakGgCCkDADcDACACQeiJAmpBoAgpAwA3AwAgAkHwiQJqQaAIKQMANwMAIAJB+IkCakGgCCkDADcDACACQYCKAmpBoAgpAwA3AwAgAkGIigJqQaAIKQMANwMAIAJBkIoCakGgCCkDADcDACACQZiKAmpBoAgpAwA3AwAgAkGgigJqQaAIKQMANwMAIAJBqIoCakGgCCkDADcDACACQbCKAmpBoAgpAwA3AwAgAkG4igJqQaAIKQMANwMAIAJBwIoCakGgCCkDADcDACACQciKAmpBoAgpAwA3AwAgAkHQigJqQaAIKQMANwMAIAJB2IoCakGgCCkDADcDACACQeCKAmpBoAgpAwA3AwAgAkHoigJqQaAIKQMANwMAIAJB8IoCakGgCCkDADcDACACQfiKAmpBoAgpAwA3AwAgAkGAiwJqQaAIKQMANwMAIAJBiIsCakGgCCkDADcDACACQZCLAmpBoAgpAwA3AwAgAkGYiwJqQaAIKQMANwMAIAJBoIsCakGgCCkDADcDACACQaiLAmpBoAgpAwA3AwAgAkGwiwJqQaAIKQMANwMAIAJBuIsCakGgCCkDADcDACACQcCLAmpBoAgpAwA3AwAgAkHIiwJqQaAIKQMANwMAIAJB0IsCakGgCCkDADcDACACQdiLAmpBoAgpAwA3AwAgAkHgiwJqQaAIKQMANwMAIAJB6IsCakGgCCkDADcDACACQfCLAmpBoAgpAwA3AwAgAkH4iwJqQaAIKQMANwMAIAJBgIwCakGgCCkDADcDACACQYiMAmpBoAgpAwA3AwAgAkGQjAJqQaAIKQMANwMAIAJBmIwCakGgCCkDADcDACACQaCMAmpBoAgpAwA3AwAgAkGojAJqQaAIKQMANwMAIAJBsIwCakGgCCkDADcDACACQbiMAmpBoAgpAwA3AwAgAkHAjAJqQaAIKQMANwMAIAJByIwCakGgCCkDADcDACACQdCMAmpBoAgpAwA3AwAgAkHYjAJqQaAIKQMANwMAIAJB4IwCakGgCCkDADcDACACQeiMAmpBoAgpAwA3AwAgAkHwjAJqQaAIKQMANwMAIAJB+IwCakGgCCkDADcDACACQYCNAmpBoAgpAwA3AwAgAkGIjQJqQaAIKQMANwMAIAJBkI0CakGgCCkDADcDACACQZiNAmpBoAgpAwA3AwAgAkGwiQZqIARBgAT8CgAAQdQIKAIAQQJ0QcCJCmogBEGABPwKAABB1AgoAgBBAnRB0IkOaiAEQYAE/AoAAEHUCCgCAEECdEHgiRJqIARBgAT8CgAAQdQIKAIAQQJ0QfCJFmogBEGABPwKAABB1AhB1AgoAgAiAkGAAWoiAzYCACABIANIDQEgAkGA/wBIDQALCwJAIABFDQAgCEH//wBLDQBBgIABIAhrIAcgAUH//wBLGyECAkAgAEEBcUUNACACRQ0AIAhBAnRBoIkCaiEDIAIhBCACQQdxIgcEQANAIAMgBTYCACADQQRqIQMgBEEBayEEIAdBAWsiBw0ACwsgAkEBa0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgBEEIayIEDQALCwJAIABBAnFFDQAgAkUNACAIQQJ0QbCJBmohAyACIQQgAkEHcSIHBEADQCADIAU2AgAgA0EEaiEDIARBAWshBCAHQQFrIgcNAAsLIAJBAWtBB0kNAANAIAMgBTYCHCADIAU2AhggAyAFNgIUIAMgBTYCECADIAU2AgwgAyAFNgIIIAMgBTYCBCADIAU2AgAgA0EgaiEDIARBCGsiBA0ACwsCQCAAQQRxRQ0AIAJFDQAgCEECdEHAiQpqIQMgAiEEIAJBB3EiBwRAA0AgAyAFNgIAIANBBGohAyAEQQFrIQQgB0EBayIHDQALCyACQQFrQQdJDQADQCADIAU2AhwgAyAFNgIYIAMgBTYCFCADIAU2AhAgAyAFNgIMIAMgBTYCCCADIAU2AgQgAyAFNgIAIANBIGohAyAEQQhrIgQNAAsLAkAgAEEIcUUNACACRQ0AIAhBAnRB0IkOaiEDIAIhBCACQQdxIgcEQANAIAMgBTYCACADQQRqIQMgBEEBayEEIAdBAWsiBw0ACwsgAkEBa0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgBEEIayIEDQALCwJAIABBEHFFDQAgAkUNACAIQQJ0QeCJEmohAyACIQQgAkEHcSIHBEADQCADIAU2AgAgA0EEaiEDIARBAWshBCAHQQFrIgcNAAsLIAJBAWtBB0kNAANAIAMgBTYCHCADIAU2AhggAyAFNgIUIAMgBTYCECADIAU2AgwgAyAFNgIIIAMgBTYCBCADIAU2AgAgA0EgaiEDIARBCGsiBA0ACwsgAEEgcUUNACACRQ0AIAJBAWshByAIQQJ0QfCJFmohAyACQQdxIgQEQANAIAMgBTYCACADQQRqIQMgAkEBayECIARBAWsiBA0ACwsgB0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgAkEIayICDQALC0HcCEHcCCgCACAAcjYCACAGQQFqIgIgBi0AAEH/AHEiA0E/ayIAQT9LDQQaDAMLAkBB7AgoAgAiBEEBRgRAQfAIKAIAIgNBzAgoAgAiAUkNASADIAFwIQMMAQtB+AgoAgAhAkH0CCgCACEBAkACQCAEQQVHDQAgAUEBRw0AIAJB6QJODQQMAQsgAkHkAEoNA0H8CCgCAEHkAEoNA0GACSgCAEHkAEoNAwsCQCABRQ0AIAFBAkoNACACQfwIKAIAQYAJKAIAIAFBAnRBiAhqKAIAEQIAIQFB8AgoAgAiA0HMCCgCACICTwR/IAMgAnAFIAMLQQJ0QZAJaiABNgIAC0HwCCgCACIDQcwIKAIAIgFJDQAgAyABcCEDCyADQQJ0QZAJaigCACEFDAELIANB/QBxQSFHBEAgCCEBIAYhAgwECyAEQSNHDQQCQEHsCCgCACICQQFGBEBB8AgoAgAiAUHMCCgCACIASQ0BIAEgAHAhAQwBC0H4CCgCACEBQfQIKAIAIQACQAJAIAJBBUcNACAAQQFHDQAgAUHpAkgNAQwHCyABQeQASg0GQfwIKAIAQeQASg0GQYAJKAIAQeQASg0GCwJAIABFDQAgAEECSg0AIAFB/AgoAgBBgAkoAgAgAEECdEGICGooAgARAgAhAEHwCCgCACIBQcwIKAIAIgJPBH8gASACcAUgAQtBAnRBkAlqIAA2AgALQfAIKAIAIgFBzAgoAgAiAEkNACABIABwIQELIAFBAnRBkAlqKAIAIQUMBAsgCCEBIAYhAgtB1AgoAgAhBgNAAkAgASAGSA0AIAZB//8ASg0AIAZBAnQiBEGgiQJqIgZBoAgpAwA3AwAgBEGoiQJqQaAIKQMANwMAIARBsIkCakGgCCkDADcDACAEQbiJAmpBoAgpAwA3AwAgBEHAiQJqQaAIKQMANwMAIARByIkCakGgCCkDADcDACAEQdCJAmpBoAgpAwA3AwAgBEHYiQJqQaAIKQMANwMAIARB4IkCakGgCCkDADcDACAEQeiJAmpBoAgpAwA3AwAgBEHwiQJqQaAIKQMANwMAIARB+IkCakGgCCkDADcDACAEQYCKAmpBoAgpAwA3AwAgBEGIigJqQaAIKQMANwMAIARBkIoCakGgCCkDADcDACAEQZiKAmpBoAgpAwA3AwAgBEGgigJqQaAIKQMANwMAIARBqIoCakGgCCkDADcDACAEQbCKAmpBoAgpAwA3AwAgBEG4igJqQaAIKQMANwMAIARBwIoCakGgCCkDADcDACAEQciKAmpBoAgpAwA3AwAgBEHQigJqQaAIKQMANwMAIARB2IoCakGgCCkDADcDACAEQeCKAmpBoAgpAwA3AwAgBEHoigJqQaAIKQMANwMAIARB8IoCakGgCCkDADcDACAEQfiKAmpBoAgpAwA3AwAgBEGAiwJqQaAIKQMANwMAIARBiIsCakGgCCkDADcDACAEQZCLAmpBoAgpAwA3AwAgBEGYiwJqQaAIKQMANwMAIARBoIsCakGgCCkDADcDACAEQaiLAmpBoAgpAwA3AwAgBEGwiwJqQaAIKQMANwMAIARBuIsCakGgCCkDADcDACAEQcCLAmpBoAgpAwA3AwAgBEHIiwJqQaAIKQMANwMAIARB0IsCakGgCCkDADcDACAEQdiLAmpBoAgpAwA3AwAgBEHgiwJqQaAIKQMANwMAIARB6IsCakGgCCkDADcDACAEQfCLAmpBoAgpAwA3AwAgBEH4iwJqQaAIKQMANwMAIARBgIwCakGgCCkDADcDACAEQYiMAmpBoAgpAwA3AwAgBEGQjAJqQaAIKQMANwMAIARBmIwCakGgCCkDADcDACAEQaCMAmpBoAgpAwA3AwAgBEGojAJqQaAIKQMANwMAIARBsIwCakGgCCkDADcDACAEQbiMAmpBoAgpAwA3AwAgBEHAjAJqQaAIKQMANwMAIARByIwCakGgCCkDADcDACAEQdCMAmpBoAgpAwA3AwAgBEHYjAJqQaAIKQMANwMAIARB4IwCakGgCCkDADcDACAEQeiMAmpBoAgpAwA3AwAgBEHwjAJqQaAIKQMANwMAIARB+IwCakGgCCkDADcDACAEQYCNAmpBoAgpAwA3AwAgBEGIjQJqQaAIKQMANwMAIARBkI0CakGgCCkDADcDACAEQZiNAmpBoAgpAwA3AwAgBEGwiQZqIAZBgAT8CgAAQdQIKAIAQQJ0QcCJCmogBkGABPwKAABB1AgoAgBBAnRB0IkOaiAGQYAE/AoAAEHUCCgCAEECdEHgiRJqIAZBgAT8CgAAQdQIKAIAQQJ0QfCJFmogBkGABPwKAABB1AhB1AgoAgBBgAFqIgY2AgALIAFB//8ATQRAIABBAXEgAWxBAnRBoIkCaiAFNgIAIABBAXZBAXEgAWxBAnRBsIkGaiAFNgIAIABBAnZBAXEgAWxBAnRBwIkKaiAFNgIAIABBA3ZBAXEgAWxBAnRB0IkOaiAFNgIAIABBBHZBAXEgAWxBAnRB4IkSaiAFNgIAIABBBXYgAWxBAnRB8IkWaiAFNgIAQdQIKAIAIQYLIAFBAWohAUHcCEHcCCgCACAAcjYCACACLQAAIQAgAkEBaiIEIQIgAEH/AHEiA0E/ayIAQcAASQ0ACyAECyECQQAhBCACIQYgASEIIANB/QBxQSFGDQELIANBJGsOCgEDAwMDAwMDAwIDC0HsCEIBNwIADAQLQdgIIAFB2AgoAgAiACAAIAFIGyIAQYCAASAAQYCAAUgbNgIADAILQegIIAFB2AgoAgAiACAAIAFIGyIAQYCAASAAQYCAAUgbIgA2AgBB2AggADYCACAAQQRrEAAEQEHoCEEENgIAQdgIQQQ2AgBB0AhBATYCAA8LEAgMAQsCQCADQTtHDQBB7AgoAgAiAEEHSg0AQewIIABBAWo2AgAgAEECdEHwCGpBADYCAAsgAiEGIAQhAyABIQgMAQtBBCEIIAIhBiAEIQMLIAYgCUkNAAsLQeQIIAU2AgBB4AggAzYCAEHoCCAINgIAC9ELAgF+CH9B2AhCBDcDAEGojQJBoAgpAwAiADcDAEGgjQIgADcDAEGYjQIgADcDAEGQjQIgADcDAEGIjQIgADcDAEGAjQIgADcDAEH4jAIgADcDAEHwjAIgADcDAEHojAIgADcDAEHgjAIgADcDAEHYjAIgADcDAEHQjAIgADcDAEHIjAIgADcDAEHAjAIgADcDAEG4jAIgADcDAEGwjAIgADcDAEGojAIgADcDAEGgjAIgADcDAEGYjAIgADcDAEGQjAIgADcDAEGIjAIgADcDAEGAjAIgADcDAEH4iwIgADcDAEHwiwIgADcDAEHoiwIgADcDAEHgiwIgADcDAEHYiwIgADcDAEHQiwIgADcDAEHIiwIgADcDAEHAiwIgADcDAEG4iwIgADcDAEGwiwIgADcDAEGoiwIgADcDAEGgiwIgADcDAEGYiwIgADcDAEGQiwIgADcDAEGIiwIgADcDAEGAiwIgADcDAEH4igIgADcDAEHwigIgADcDAEHoigIgADcDAEHgigIgADcDAEHYigIgADcDAEHQigIgADcDAEHIigIgADcDAEHAigIgADcDAEG4igIgADcDAEGwigIgADcDAEGoigIgADcDAEGgigIgADcDAEGYigIgADcDAEGQigIgADcDAEGIigIgADcDAEGAigIgADcDAEH4iQIgADcDAEHwiQIgADcDAEHoiQIgADcDAEHgiQIgADcDAEHYiQIgADcDAEHQiQIgADcDAEHIiQIgADcDAEHAiQIgADcDAEG4iQIgADcDAEGwiQIgADcDAEGoCCgCACIEQf8AakGAAW0hCAJAIARBgQFIDQBBASEBIAhBAiAIQQJKG0EBayICQQFxIQMgBEGBAk4EQCACQX5xIQIDQCABQQl0IgdBEHJBoIkCakGwiQJBgAT8CgAAIAdBsI0CakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsLIANFDQAgAUEJdEEQckGgiQJqQbCJAkGABPwKAAALAkAgBEEBSA0AIAhBASAIQQFKGyIDQQFxIQUCQCADQQFrIgdFBEBBACEBDAELIANB/v///wdxIQJBACEBA0AgAUEJdCIGQRByQbCJBmpBsIkCQYAE/AoAACAGQZAEckGwiQZqQbCJAkGABPwKAAAgAUECaiEBIAJBAmsiAg0ACwsgBQRAIAFBCXRBEHJBsIkGakGwiQJBgAT8CgAACyAEQQFIDQAgA0EBcSEFIAcEfyADQf7///8HcSECQQAhAQNAIAFBCXQiBkEQckHAiQpqQbCJAkGABPwKAAAgBkGQBHJBwIkKakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsgAUEHdEEEcgVBBAshASAFBEAgAUECdEHAiQpqQbCJAkGABPwKAAALIARBAUgNACADQQFxIQUgBwR/IANB/v///wdxIQJBACEBA0AgAUEJdCIGQRByQdCJDmpBsIkCQYAE/AoAACAGQZAEckHQiQ5qQbCJAkGABPwKAAAgAUECaiEBIAJBAmsiAg0ACyABQQd0QQRyBUEECyEBIAUEQCABQQJ0QdCJDmpBsIkCQYAE/AoAAAsgBEEBSA0AIANBAXEhBSAHBH8gA0H+////B3EhAkEAIQEDQCABQQl0IgZBEHJB4IkSakGwiQJBgAT8CgAAIAZBkARyQeCJEmpBsIkCQYAE/AoAACABQQJqIQEgAkECayICDQALIAFBB3RBBHIFQQQLIQEgBQRAIAFBAnRB4IkSakGwiQJBgAT8CgAACyAEQQFIDQAgA0EBcSEEIAcEfyADQf7///8HcSECQQAhAQNAIAFBCXQiA0EQckHwiRZqQbCJAkGABPwKAAAgA0GQBHJB8IkWakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsgAUEHdEEEcgVBBAshASAERQ0AIAFBAnRB8IkWakGwiQJBgAT8CgAAC0HUCCAIQQd0QQRyNgIAC58TAgh/AX5B5AgoAgAhA0HgCCgCACECQegIKAIAIQcgAUGQiQFqIglB/wE6AAAgACABSARAIABBkIkBaiEIA0AgAiEEIAhBAWohAQJAIAgtAABB/wBxIgJBMGtBCUsEQCABIQgMAQtB7AgoAgBBAnRB7AhqIgUoAgAhAANAIAUgAiAAQQpsakEwayIANgIAIAEtAAAhAiABQQFqIgghASACQf8AcSICQTBrQQpJDQALCwJAAkACQAJAAkACQAJ/AkAgAkE/ayIAQT9NBEAgBEUNASAEQSFGBEBB8AgoAgAiAUEBIAEbIgQgB2ohAQJAIABFDQAgB0H//wBLDQBBgIABIAdrIAQgAUH//wBLGyEFAkAgAEEBcUUNACAHQQJ0QaCJAmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEECcUUNACAHQQJ0QbCJBmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEEcUUNACAHQQJ0QcCJCmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEIcUUNACAHQQJ0QdCJDmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEQcUUNACAHQQJ0QeCJEmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLIABBIHFFDQAgBUEBayEEIAdBAnRB8IkWaiEAIAVBB3EiAgRAA0AgACADNgIAIABBBGohACAFQQFrIQUgAkEBayICDQALCyAEQQdJDQADQCAAIAM2AhwgACADNgIYIAAgAzYCFCAAIAM2AhAgACADNgIMIAAgAzYCCCAAIAM2AgQgACADNgIAIABBIGohACAFQQhrIgUNAAsLIAhBAWoiBSAILQAAQf8AcSICQT9rIgBBP00NAxoMBAsCQEHsCCgCACIFQQFGBEBB8AgoAgAiAUHMCCgCACIESQ0BIAEgBHAhAQwBC0H4CCgCACEEQfQIKAIAIQECQAJAIAVBBUcNACABQQFHDQAgBEHpAk4NBAwBCyAEQeQASg0DQfwIKAIAQeQASg0DQYAJKAIAQeQASg0DCwJAIAFFDQAgAUECSg0AIARB/AgoAgBBgAkoAgAgAUECdEGICGooAgARAgAhBEHwCCgCACIBQcwIKAIAIgVPBH8gASAFcAUgAQtBAnRBkAlqIAQ2AgALQfAIKAIAIgFBzAgoAgAiBEkNACABIARwIQELIAFBAnRBkAlqKAIAIQMMAQsgAkH9AHFBIUcEQCAHIQEgAiEADAQLIARBI0cNBAJAQewIKAIAIgRBAUYEQEHwCCgCACIBQcwIKAIAIgBJDQEgASAAcCEBDAELQfgIKAIAIQFB9AgoAgAhAAJAAkAgBEEFRw0AIABBAUcNACABQekCSA0BDAcLIAFB5ABKDQZB/AgoAgBB5ABKDQZBgAkoAgBB5ABKDQYLAkAgAEUNACAAQQJKDQAgAUH8CCgCAEGACSgCACAAQQJ0QYgIaigCABECACEAQfAIKAIAIgFBzAgoAgAiBE8EfyABIARwBSABC0ECdEGQCWogADYCAAtB8AgoAgAiAUHMCCgCACIASQ0AIAEgAHAhAQsgAUECdEGQCWooAgAhAwwECyAHIQEgCAshBQNAIAFB//8ATQRAIABBAXEgAWxBAnRBoIkCaiADNgIAIABBAXZBAXEgAWxBAnRBsIkGaiADNgIAIABBAnZBAXEgAWxBAnRBwIkKaiADNgIAIABBA3ZBAXEgAWxBAnRB0IkOaiADNgIAIABBBHZBAXEgAWxBAnRB4IkSaiADNgIAIABBBXYgAWxBAnRB8IkWaiADNgIACyABQQFqIQEgBS0AACEAIAVBAWoiBCEFIABB/wBxIgJBP2siAEHAAEkNAAsgBCEFC0EAIQQgBSEIIAEhByACIQAgAkH9AHFBIUYNAQtBBCEHIAQhAiAAQSRrDgoDAgICAgICAgIBAgtB7AhCATcCAAwCC0GoCCgCAEEEaxAABEBB0AhBATYCAA8LAkBBqAgoAgAiBkEFSA0AQaAIKQMAIQogBkEDa0EBdiIBQQdxIQJBACEAIAFBAWtBB08EQCABQfj///8HcSEFA0AgAEEDdCIBQbCJAmogCjcDACABQQhyQbCJAmogCjcDACABQRByQbCJAmogCjcDACABQRhyQbCJAmogCjcDACABQSByQbCJAmogCjcDACABQShyQbCJAmogCjcDACABQTByQbCJAmogCjcDACABQThyQbCJAmogCjcDACAAQQhqIQAgBUEIayIFDQALCyACRQ0AA0AgAEEDdEGwiQJqIAo3AwAgAEEBaiEAIAJBAWsiAg0ACwtBwIkGQbCJAiAGQQJ0IgD8CgAAQdCJCkGwiQIgAPwKAABB4IkOQbCJAiAA/AoAAEHwiRJBsIkCIAD8CgAAQYCKFkGwiQIgAPwKAAAgBCECDAELAkAgAEE7Rw0AQewIKAIAIgBBB0oNAEHsCCAAQQFqNgIAIABBAnRB8AhqQQA2AgALIAEhBwsgCCAJSQ0ACwtB5AggAzYCAEHgCCACNgIAQegIIAc2AgAL4gcCBX8BfgJAQdAIAn8CQAJAIAAgAU4NACABQZCJAWohBiAAQZCJAWohBQNAIAUtAAAiA0H/AHEhAgJAAkACQAJAAkACQAJAQeAIKAIAIgRBIkcEQCAEDQcgAkEiRgRAQewIQgE3AgBB4AhBIjYCAAwICyACQT9rQcAASQ0GIANBIWsiAkEMTQ0BDAULAkAgAkEwayIEQQlNBEBB7AgoAgBBAnRB7AhqIgIgBCACKAIAQQpsajYCAAwBC0HsCCgCACEEIAJBO0YEQCAEQQdKDQFB7AggBEEBajYCACAEQQJ0QfAIakEANgIADAELIARBBEYEQEHECEECNgIAQbAIQfAIKQMANwMAQbgIQfgIKAIAIgI2AgBBvAhB/AgoAgAiBDYCAEHICEECQQFBwAgoAgAiAxs2AgBBrAggBEEAIAMbNgIAQagIIAJBgIABIAJBgIABSBtBBGpBACADGzYCAEHgCEEANgIADAoLIAJBP2tBwABJDQQLIANBIWsiAkEMTQ0BDAILQQEgAnRBjSBxRQ0DDAQLQQEgAnRBjSBxDQELIANBoQFrIgJBDEsNA0EBIAJ0QY0gcUUNAwtBxAhCgYCAgBA3AgBBsAhB8AgoAgBBAEHsCCgCACICQQBKGzYCAEG0CEH0CCgCAEEAIAJBAUobNgIAQbgIQfgIKAIAQQAgAkECShs2AgBB4AhBADYCAEG8CEEANgIADAQLIANBoQFrIgJBDEsNAUEBIAJ0QY0gcUUNAQtBxAhCgYCAgBA3AgBBsAhCADcDAEG4CEIANwMADAMLIAVBAWoiBSAGSQ0ACwsCQEHICCgCAA4DAwEAAQsCQEGoCCgCACIFQQVIDQBBoAgpAwAhByAFQQNrQQF2IgNBB3EhBEEAIQIgA0EBa0EHTwRAIANB+P///wdxIQYDQCACQQN0IgNBsIkCaiAHNwMAIANBCHJBsIkCaiAHNwMAIANBEHJBsIkCaiAHNwMAIANBGHJBsIkCaiAHNwMAIANBIHJBsIkCaiAHNwMAIANBKHJBsIkCaiAHNwMAIANBMHJBsIkCaiAHNwMAIANBOHJBsIkCaiAHNwMAIAJBCGohAiAGQQhrIgYNAAsLIARFDQADQCACQQN0QbCJAmogBzcDACACQQFqIQIgBEEBayIEDQALC0HAiQZBsIkCIAVBAnQiA/wKAABB0IkKQbCJAiAD/AoAAEHgiQ5BsIkCIAP8CgAAQfCJEkGwiQIgA/wKAABBgIoWQbCJAiAD/AoAAEECDAELEAhByAgoAgALEAEiAjYCACACDQAgACABQcgIKAIAQQJ0QYAIaigCABEBAAsLdABB6AhBBDYCAEHkCCAANgIAQewIQgE3AgBBxAhCADcCAEHACCADNgIAQdwIQgA3AgBBqAhCADcDAEGwCEIANwMAQbgIQgA3AwBBzAggAkGAICACQYAgSRs2AgBBoAggAa1CgYCAgBB+NwMAQdAIQQA2AgALIwBB0AgoAgBFBEAgACABQcgIKAIAQQJ0QYAIaigCABEBAAsLWgECfwJAAkACQEHICCgCAEEBaw4CAAECC0HYCEHoCCgCACIAQdgIKAIAIgEgACABShsiAEGAgAEgAEGAgAFIGyIANgIAIABBBGsPC0GoCCgCAEEEayEACyAAC0IBAX8Cf0EGQdwIKAIAIgBBIHENABpBBSAAQRBxDQAaQQQgAEEIcQ0AGkEDIABBBHENABpBAiAAQQFxIABBAnEbCwu9BQEFfQJ/IAJFBEAgAUH/AWxBMmpB5ABtIgBBCHQgAHIgAEEQdHIMAQsgArJDAADIQpUhBiAAQfABarJDAAC0Q5UhBQJ9IAGyQwAAyEKVIgNDAAAAP10EQCADIAZDAACAP5KUDAELIAYgA0MAAIA/IAaTlJILIQcgAyADkiEGAkAgBUOrqqo+kiIEQwAAAABdBEAgBEMAAIA/kiEEDAELIARDAACAP15FDQAgBEMAAIC/kiEECyAGIAeTIQMgBUMAAAAAXSEAAn8CfSADIAcgA5NDAADAQJQgBJSSIARDq6oqPl0NABogByAEQwAAAD9dDQAaIAMgBEOrqio/XUUNABogAyAHIAOTIARDAADAwJRDAACAQJKUkgtDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALIQECQCAABEAgBUMAAIA/kiEEDAELIAUiBEMAAIA/XkUNACAFQwAAgL+SIQQLIAVDq6qqvpIiBUMAAAAAXSECAn8CfSADIAcgA5NDAADAQJQgBJSSIARDq6oqPl0NABogByAEQwAAAD9dDQAaIAMgBEOrqio/XUUNABogAyAHIAOTIARDAADAwJRDAACAQJKUkgtDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALIQACQCACBEAgBUMAAIA/kiEFDAELIAVDAACAP15FDQAgBUMAAIC/kiEFCwJAIAVDq6oqPl0EQCADIAcgA5NDAADAQJQgBZSSIQcMAQsgBUMAAAA/XQ0AIAVDq6oqP11FBEAgAyEHDAELIAMgByADkyAFQwAAwMCUQwAAgECSlJIhBwsgAEEIdAJ/IAdDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALQRB0ciABcgtBgICAeHILNwAgAEH/AWxBMmpB5ABtIAFB/wFsQTJqQeQAbUEIdHIgAkH/AWxBMmpB5ABtQRB0ckGAgIB4cgsEACMACwYAIAAkAAsQACMAIABrQXBxIgAkACAACwsYAQBBgAgLEQEAAAACAAAAAwAAAAQAAAAF"}});var We=x(b=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0});b.decodeAsync=b.decode=b.Decoder=b.DecoderAsync=void 0;var O=Z(),Q=Ye();function St(s){if(typeof Buffer<"u")return Buffer.from(s,"base64");let e=atob(s),t=new Uint8Array(e.length);for(let i=0;i<t.length;++i)t[i]=e.charCodeAt(i);return t}var qe=St(Q.LIMITS.BYTES),J,re=new Uint32Array,Le=class{constructor(){this.bandHandler=e=>1,this.modeHandler=e=>1}handle_band(e){return this.bandHandler(e)}mode_parsed(e){return this.modeHandler(e)}},Lt={memoryLimit:2048*65536,sixelColor:O.DEFAULT_FOREGROUND,fillColor:O.DEFAULT_BACKGROUND,palette:O.PALETTE_VT340_COLOR,paletteLimit:Q.LIMITS.PALETTE_SIZE,truncate:!0};function ze(s){let e=new Le,t={env:{handle_band:e.handle_band.bind(e),mode_parsed:e.mode_parsed.bind(e)}};return WebAssembly.instantiate(J||qe,t).then(i=>(J=J||i.module,new P(s,i.instance||i,e)))}b.DecoderAsync=ze;var P=class{constructor(e,t,i){if(this._PIXEL_OFFSET=Q.LIMITS.MAX_WIDTH+4,this._canvas=re,this._bandWidths=[],this._maxWidth=0,this._minWidth=Q.LIMITS.MAX_WIDTH,this._lastOffset=0,this._currentHeight=0,this._opts=Object.assign({},Lt,e),this._opts.paletteLimit>Q.LIMITS.PALETTE_SIZE)throw new Error(`DecoderOptions.paletteLimit must not exceed ${Q.LIMITS.PALETTE_SIZE}`);if(t)i.bandHandler=this._handle_band.bind(this),i.modeHandler=this._initCanvas.bind(this);else{let A=J||(J=new WebAssembly.Module(qe));t=new WebAssembly.Instance(A,{env:{handle_band:this._handle_band.bind(this),mode_parsed:this._initCanvas.bind(this)}})}this._instance=t,this._wasm=this._instance.exports,this._chunk=new Uint8Array(this._wasm.memory.buffer,this._wasm.get_chunk_address(),Q.LIMITS.CHUNK_SIZE),this._states=new Uint32Array(this._wasm.memory.buffer,this._wasm.get_state_address(),12),this._palette=new Uint32Array(this._wasm.memory.buffer,this._wasm.get_palette_address(),Q.LIMITS.PALETTE_SIZE),this._palette.set(this._opts.palette),this._pSrc=new Uint32Array(this._wasm.memory.buffer,this._wasm.get_p0_address()),this._wasm.init(O.DEFAULT_FOREGROUND,0,this._opts.paletteLimit,0)}get _fillColor(){return this._states[0]}get _truncate(){return this._states[8]}get _rasterWidth(){return this._states[6]}get _rasterHeight(){return this._states[7]}get _width(){return this._states[2]?this._states[2]-4:0}get _height(){return this._states[3]}get _level(){return this._states[9]}get _mode(){return this._states[10]}get _paletteLimit(){return this._states[11]}_initCanvas(e){if(e===2){let t=this.width*this.height;if(t>this._canvas.length){if(this._opts.memoryLimit&&t*4>this._opts.memoryLimit)throw this.release(),new Error("image exceeds memory limit");this._canvas=new Uint32Array(t)}this._maxWidth=this._width}else if(e===1)if(this._level===2){let t=Math.min(this._rasterWidth,Q.LIMITS.MAX_WIDTH)*this._rasterHeight;if(t>this._canvas.length){if(this._opts.memoryLimit&&t*4>this._opts.memoryLimit)throw this.release(),new Error("image exceeds memory limit");this._canvas=new Uint32Array(t)}}else this._canvas.length<65536&&(this._canvas=new Uint32Array(65536));return 0}_realloc(e,t){let i=e+t;if(i>this._canvas.length){if(this._opts.memoryLimit&&i*4>this._opts.memoryLimit)throw this.release(),new Error("image exceeds memory limit");let A=new Uint32Array(Math.ceil(i/65536)*65536);A.set(this._canvas),this._canvas=A}}_handle_band(e){let t=this._PIXEL_OFFSET,i=this._lastOffset;if(this._mode===2){let A=this.height-this._currentHeight,r=0;for(;r<6&&A>0;)this._canvas.set(this._pSrc.subarray(t*r,t*r+e),i+e*r),r++,A--;this._lastOffset+=e*r,this._currentHeight+=r}else if(this._mode===1){this._realloc(i,e*6),this._maxWidth=Math.max(this._maxWidth,e),this._minWidth=Math.min(this._minWidth,e);for(let A=0;A<6;++A)this._canvas.set(this._pSrc.subarray(t*A,t*A+e),i+e*A);this._bandWidths.push(e),this._lastOffset+=e*6,this._currentHeight+=6}return 0}get width(){return this._mode!==1?this._width:Math.max(this._maxWidth,this._wasm.current_width())}get height(){return this._mode!==1?this._height:this._wasm.current_width()?this._bandWidths.length*6+this._wasm.current_height():this._bandWidths.length*6}get palette(){return this._palette.subarray(0,this._paletteLimit)}get memoryUsage(){return this._canvas.byteLength+this._wasm.memory.buffer.byteLength+8*this._bandWidths.length}get properties(){return{width:this.width,height:this.height,mode:this._mode,level:this._level,truncate:!!this._truncate,paletteLimit:this._paletteLimit,fillColor:this._fillColor,memUsage:this.memoryUsage,rasterAttributes:{numerator:this._states[4],denominator:this._states[5],width:this._rasterWidth,height:this._rasterHeight}}}init(e=this._opts.fillColor,t=this._opts.palette,i=this._opts.paletteLimit,A=this._opts.truncate){this._wasm.init(this._opts.sixelColor,e,i,A?1:0),t&&this._palette.set(t.subarray(0,Q.LIMITS.PALETTE_SIZE)),this._bandWidths.length=0,this._maxWidth=0,this._minWidth=Q.LIMITS.MAX_WIDTH,this._lastOffset=0,this._currentHeight=0}decode(e,t=0,i=e.length){let A=t;for(;A<i;){let r=Math.min(i-A,Q.LIMITS.CHUNK_SIZE);this._chunk.set(e.subarray(A,A+=r)),this._wasm.decode(0,r)}}decodeString(e,t=0,i=e.length){let A=t;for(;A<i;){let r=Math.min(i-A,Q.LIMITS.CHUNK_SIZE);for(let n=0,a=A;n<r;++n,++a)this._chunk[n]=e.charCodeAt(a);A+=r,this._wasm.decode(0,r)}}get data32(){if(this._mode===0||!this.width||!this.height)return re;let e=this._wasm.current_width();if(this._mode===2){let t=this.height-this._currentHeight;if(t>0){let i=this._PIXEL_OFFSET,A=this._lastOffset,r=0;for(;r<6&&t>0;)this._canvas.set(this._pSrc.subarray(i*r,i*r+e),A+e*r),r++,t--;t&&this._canvas.fill(this._fillColor,A+e*r)}return this._canvas.subarray(0,this.width*this.height)}if(this._mode===1){if(this._minWidth===this._maxWidth){let r=!1;if(e)if(e!==this._minWidth)r=!0;else{let n=this._PIXEL_OFFSET,a=this._lastOffset;this._realloc(a,e*6);for(let o=0;o<6;++o)this._canvas.set(this._pSrc.subarray(n*o,n*o+e),a+e*o)}if(!r)return this._canvas.subarray(0,this.width*this.height)}let t=new Uint32Array(this.width*this.height);t.fill(this._fillColor);let i=0,A=0;for(let r=0;r<this._bandWidths.length;++r){let n=this._bandWidths[r];for(let a=0;a<6;++a)t.set(this._canvas.subarray(A,A+=n),i),i+=this.width}if(e){let r=this._PIXEL_OFFSET,n=this._wasm.current_height();for(let a=0;a<n;++a)t.set(this._pSrc.subarray(r*a,r*a+e),i+this.width*a)}return t}return re}get data8(){return new Uint8ClampedArray(this.data32.buffer,0,this.width*this.height*4)}release(){this._canvas=re,this._bandWidths.length=0,this._maxWidth=0,this._minWidth=Q.LIMITS.MAX_WIDTH,this._wasm.init(O.DEFAULT_FOREGROUND,0,this._opts.paletteLimit,0)}};b.Decoder=P;function Tt(s,e){let t=new P(e);return t.init(),typeof s=="string"?t.decodeString(s):t.decode(s),{width:t.width,height:t.height,data32:t.data32,data8:t.data8}}b.decode=Tt;async function xt(s,e){let t=await ze(e);return t.init(),typeof s=="string"?t.decodeString(s):t.decode(s),{width:t.width,height:t.height,data32:t.data32,data8:t.data8}}b.decodeAsync=xt});function H(s){return{dispose:s}}var N=class{constructor(){this._disposables=new Set;this._isDisposed=!1}get isDisposed(){return this._isDisposed}add(e){return this._isDisposed?e.dispose():this._disposables.add(e),e}dispose(){if(!this._isDisposed){this._isDisposed=!0;for(let e of this._disposables)e.dispose();this._disposables.clear()}}clear(){for(let e of this._disposables)e.dispose();this._disposables.clear()}},k=class{constructor(){this._store=new N}dispose(){this._store.dispose()}_register(e){return this._store.add(e)}};k.None=Object.freeze({dispose(){}});var W=class{constructor(){this._isDisposed=!1}get value(){return this._isDisposed?void 0:this._value}set value(e){this._isDisposed||e===this._value||(this._value?.dispose(),this._value=e)}clear(){this.value=void 0}dispose(){this._isDisposed=!0,this._value?.dispose(),this._value=void 0}};var X=class{constructor(){this._listeners=[];this._disposed=!1}get event(){return this._event?this._event:(this._event=(e,t,i)=>{if(this._disposed)return H(()=>{});let A={fn:e,thisArgs:t};this._listeners=this._listeners.slice(),this._listeners.push(A);let r=H(()=>{let n=this._listeners.indexOf(A);n!==-1&&(this._listeners=this._listeners.slice(),this._listeners.splice(n,1))});return i&&(Array.isArray(i)?i.push(r):i.add(r)),r},this._event)}fire(e){if(this._disposed||!this._listeners.length)return;if(this._listeners.length===1){this._listeners[0].fn.call(this._listeners[0].thisArgs,e);return}let t=this._listeners;for(let i=0,A=t.length;i<A;++i)t[i].fn.call(t[i].thisArgs,e)}dispose(){this._disposed||(this._disposed=!0,this._listeners.length=0)}},ht;(A=>{function s(r,n){return r(a=>n.fire(a))}A.forward=s;function e(r,n){return(a,o,h)=>r(g=>a.call(o,n(g)),void 0,h)}A.map=e;function t(...r){return(n,a,o)=>{let h=new N;for(let g of r)h.add(g(d=>n.call(a,d)));return o&&(Array.isArray(o)?o.push(h):o.add(h)),h}}A.any=t;function i(r,n,a){return n(a),r(o=>n(o))}A.runAndSubscribe=i})(ht||={});var ce=M(Z());var D=class s extends k{constructor(t){super();this._terminal=t;this._layers=new Map;this._optionsRefresh=this._register(new W);this._oldOpen=this._terminal._core.open,this._terminal._core.open=i=>{this._oldOpen?.call(this._terminal._core,i),this._open()},this._terminal._core.screenElement&&this._open(),this._optionsRefresh.value=this._terminal._core.optionsService.onOptionChange(i=>{i==="fontSize"&&(this.rescaleCanvas(),this._renderService?.refreshRows(0,this._terminal.rows))}),this._register(H(()=>{this.removeLayerFromDom(),this.removeLayerFromDom("bottom"),this._terminal._core&&this._oldOpen&&(this._terminal._core.open=this._oldOpen,this._oldOpen=void 0),this._renderService&&this._oldSetRenderer&&(this._renderService.setRenderer=this._oldSetRenderer,this._oldSetRenderer=void 0),this._renderService=void 0,this._layers.clear(),this._placeholderBitmap?.close(),this._placeholderBitmap=void 0,this._placeholder=void 0}))}get canvas(){return this._layers.get("top")?.canvas}static createCanvas(t,i,A){let r=(t??document).createElement("canvas");return r.width=i|0,r.height=A|0,r}static createImageData(t,i,A,r){if(typeof ImageData!="function"){let n=t.createImageData(i,A);return r&&n.data.set(new Uint8ClampedArray(r,0,i*A*4)),n}return r?new ImageData(new Uint8ClampedArray(r,0,i*A*4),i,A):new ImageData(i,A)}static createImageBitmap(t){return typeof createImageBitmap!="function"?Promise.resolve(void 0):createImageBitmap(t)}showPlaceholder(t){t?!this._placeholder&&this.cellSize.height!==-1&&this._createPlaceHolder(Math.max(this.cellSize.height+1,24)):(this._placeholderBitmap?.close(),this._placeholderBitmap=void 0,this._placeholder=void 0),this._renderService?.refreshRows(0,this._terminal.rows)}get dimensions(){return this._terminal.dimensions}get cellSize(){return{width:this.dimensions?.css.cell.width||-1,height:this.dimensions?.css.cell.height||-1}}clearLines(t,i,A){let r=t*(this.dimensions?.css.cell.height||0),n=this.dimensions?.css.canvas.width||0,a=(i+1-t)*(this.dimensions?.css.cell.height||0);(!A||A==="top")&&this._layers.get("top")?.clearRect(0,r,n,a),(!A||A==="bottom")&&this._layers.get("bottom")?.clearRect(0,r,n,a)}clearAll(t){if(!t||t==="top"){let i=this._layers.get("top");i?.clearRect(0,0,i.canvas.width,i.canvas.height)}if(!t||t==="bottom"){let i=this._layers.get("bottom");i?.clearRect(0,0,i.canvas.width,i.canvas.height)}}draw(t,i,A,r,n=1){let a=this._layers.get(t.layer);if(!a)return;let{width:o,height:h}=this.cellSize;if(o===-1||h===-1)return;this._rescaleImage(t,o,h);let g=t.actual,{width:d,height:I}=t.actualCellSize,l=Math.ceil(g.width/d),c=i%l*d,u=Math.floor(i/l)*I,E=A*o,C=r*h,p=n*d+c>g.width?g.width-c:n*d,B=u+I>g.height?g.height-u:I;a.drawImage(g,Math.floor(c),Math.floor(u),Math.ceil(p),Math.ceil(B),Math.floor(E),Math.floor(C),Math.ceil(p*o/d),Math.ceil(B*h/I))}extractTile(t,i){let{width:A,height:r}=this.cellSize;if(A===-1||r===-1)return;this._rescaleImage(t,A,r);let n=t.actual,{width:a,height:o}=t.actualCellSize,h=Math.ceil(n.width/a),g=i%h*a,d=Math.floor(i/h)*o,I=a+g>n.width?n.width-g:a,l=d+o>n.height?n.height-d:o,c=s.createCanvas(this.document,Math.ceil(I*A/a),Math.ceil(l*r/o)),u=c.getContext("2d");if(u)return u.drawImage(n,Math.floor(g),Math.floor(d),Math.floor(I),Math.floor(l),0,0,c.width,c.height),c}drawPlaceholder(t,i,A=1){let r=this._layers.get("top");if(r){let{width:n,height:a}=this.cellSize;if(n===-1||a===-1||(this._placeholder?a>=this._placeholder.height&&this._createPlaceHolder(a+1):this._createPlaceHolder(Math.max(a+1,24)),!this._placeholder))return;r.drawImage(this._placeholderBitmap??this._placeholder,t*n,i*a%2?0:1,n*A,a,t*n,i*a,n*A,a)}}rescaleCanvas(){let t=this.dimensions?.css.canvas.width||0,i=this.dimensions?.css.canvas.height||0;for(let A of this._layers.values())(A.canvas.width!==t||A.canvas.height!==i)&&(A.canvas.width=t,A.canvas.height=i)}_rescaleImage(t,i,A){if(i===t.actualCellSize.width&&A===t.actualCellSize.height)return;let{width:r,height:n}=t.origCellSize;if(i===r&&A===n){t.actual=t.orig,t.actualCellSize.width=r,t.actualCellSize.height=n;return}let a=Math.ceil(t.orig.width*i/r),o=Math.ceil(t.orig.height*A/n);if(a*o>t.orig.width*t.orig.height){t.actual=t.orig,t.actualCellSize.width=r,t.actualCellSize.height=n;return}let h=s.createCanvas(this.document,a,o),g=h.getContext("2d");g&&(g.drawImage(t.orig,0,0,h.width,h.height),t.actual=h,t.actualCellSize.width=i,t.actualCellSize.height=A)}_open(){this._renderService=this._terminal._core._renderService,this._oldSetRenderer=this._renderService.setRenderer.bind(this._renderService),this._renderService.setRenderer=t=>{for(let i of[...this._layers.keys()])this.removeLayerFromDom(i);this._oldSetRenderer?.call(this._renderService,t)}}insertLayerToDom(t="top"){if(!this.document||!this._terminal._core.screenElement){console.warn("image addon: cannot insert output canvas to DOM, missing document or screenElement");return}if(this._layers.has(t))return;let i=s.createCanvas(this.document,this.dimensions?.css.canvas.width||0,this.dimensions?.css.canvas.height||0);i.classList.add(`xterm-image-layer-${t}`);let A=this._terminal._core.screenElement;A.style.isolation="isolate",t==="bottom"?(i.style.zIndex="-1",A.insertBefore(i,A.firstChild)):(i.style.zIndex="0",A.appendChild(i));let r=i.getContext("2d",{alpha:!0});if(!r){i.remove();return}this._layers.set(t,r),this.clearAll(t)}removeLayerFromDom(t="top"){let i=this._layers.get(t);i&&(i.canvas.remove(),this._layers.delete(t))}hasLayer(t){return this._layers.has(t)}_createPlaceHolder(t=24){this._placeholderBitmap?.close(),this._placeholderBitmap=void 0;let i=32,A=s.createCanvas(this.document,i,t),r=A.getContext("2d",{alpha:!1});if(!r)return;let n=s.createImageData(r,i,t),a=new Uint32Array(n.data.buffer),o=(0,ce.toRGBA8888)(0,0,0),h=(0,ce.toRGBA8888)(255,255,255);a.fill(o);for(let l=0;l<t;++l){let c=l%2,u=l*i;for(let E=0;E<i;E+=2)a[u+E+c]=h}r.putImageData(n,0,0);let g=screen.width+i-1&~(i-1)||4096;this._placeholder=s.createCanvas(this.document,g,t);let d=this._placeholder.getContext("2d",{alpha:!1});if(!d){this._placeholder=void 0;return}for(let l=0;l<g;l+=i)d.drawImage(A,l,0);let I=this._placeholder;s.createImageBitmap(I).then(l=>{this._placeholder!==I?l?.close():this._placeholderBitmap=l}).catch(()=>{})}get document(){return this._terminal._core._coreBrowserService?.window.document}};var w={width:7,height:14},G=class s{constructor(e=0,t=0,i=-1,A=-1){this.imageId=i;this.tileId=A;this._ext=0;this._urlId=0;this._ext=e,this._urlId=t}get ext(){return this._urlId?this._ext&-469762049|this.underlineStyle<<26:this._ext}set ext(e){this._ext=e}get underlineStyle(){return this._urlId?5:(this._ext&469762048)>>26}set underlineStyle(e){this._ext&=-469762049,this._ext|=e<<26&469762048}get underlineColor(){return this._ext&67108863}set underlineColor(e){this._ext&=-67108864,this._ext|=e&67108863}get underlineVariantOffset(){let e=(this._ext&3758096384)>>29;return e<0?e^4294967288:e}set underlineVariantOffset(e){this._ext&=536870911,this._ext|=e<<29&3758096384}get urlId(){return this._urlId}set urlId(e){this._urlId=e}clone(){return new s(this._ext,this._urlId,this.imageId,this.tileId)}isEmpty(){return this.underlineStyle===0&&this._urlId===0&&this.imageId===-1}},F=new G,j=class{constructor(e,t,i){this._terminal=e;this._renderer=t;this._opts=i;this._images=new Map;this._lastId=0;this._lowestId=0;this._fullyCleared=!1;this._needsFullClear=!1;this._pixelLimit=25e5;try{this.setLimit(this._opts.storageLimit)}catch(A){A instanceof Error&&console.error(A.message),console.warn(`storageLimit is set to ${this.getLimit()} MB`)}this._viewportMetrics={cols:this._terminal.cols,rows:this._terminal.rows}}dispose(){this.reset()}reset(){for(let e of this._images.values())e.marker?.dispose();this._images.clear(),this._renderer.clearAll()}getLimit(){return this._pixelLimit*4/1e6}setLimit(e){if(e<.5||e>1e3)throw RangeError("invalid storageLimit, should be at least 0.5 MB and not exceed 1G");this._pixelLimit=e/4*1e6>>>0,this._evictOldest(0)}getUsage(){return this._getStoredPixels()*4/1e6}_getStoredPixels(){let e=0;for(let t of this._images.values())t.orig&&(e+=t.orig.width*t.orig.height,t.actual&&t.actual!==t.orig&&(e+=t.actual.width*t.actual.height));return e}_delImg(e){let t=this._images.get(e);t&&(this._images.delete(e),window.ImageBitmap&&t.orig instanceof ImageBitmap&&t.orig.close(),this.onImageDeleted?.(e))}wipeAlternate(){let e=[];for(let[t,i]of this._images.entries())i.bufferType==="alternate"&&(i.marker?.dispose(),e.push(t));for(let t of e)this._delImg(t);this._needsFullClear=!0,this._fullyCleared=!1}deleteImage(e){let t=this._images.get(e);t&&(t.marker?.dispose(),this._delImg(e))}addImage(e,t){this._evictOldest(e.width*e.height);let i=this._renderer.cellSize;(i.width===-1||i.height===-1)&&(i=w);let A=Math.ceil(e.width/i.width),r=Math.ceil(e.height/i.height),n=++this._lastId,a=this._terminal._core.buffer,o=this._terminal.cols,h=this._terminal.rows,g=a.x,d=a.y,I=g,l=0;t.scrolling||(a.x=0,a.y=0,I=0),this._terminal._core._inputHandler._dirtyRowTracker.markDirty(a.y);for(let C=0;C<r;++C){let p=a.lines.get(a.y+a.ybase);for(let B=0;B<A&&!(I+B>=o);++B)this._writeToCell(p,I+B,n,C*A+B),l++;if(t.scrolling)C<r-1&&this._terminal._core._inputHandler.lineFeed();else if(++a.y>=h)break;a.x=I}this._terminal._core._inputHandler._dirtyRowTracker.markDirty(a.y),t.scrolling?t.cursorPos==="iip"?a.x=Math.min(I+A,o):a.x=I:(a.x=g,a.y=d);let c=[];for(let[C,p]of this._images.entries())p.tileCount<1&&(p.marker?.dispose(),c.push(C));for(let C of c)this._delImg(C);let u=this._terminal.registerMarker(0);u?.onDispose(()=>{this._images.get(n)&&this._delImg(n)}),this._terminal.buffer.active.type==="alternate"&&this._evictOnAlternate();let E={orig:e,origCellSize:i,actual:e,actualCellSize:{...i},marker:u||void 0,tileCount:l,bufferType:this._terminal.buffer.active.type,layer:t.layer,zIndex:t.zIndex};return this._images.set(n,E),this.onImageAdded?.(),n}render(e){let t=!1,i=!1;for(let g of this._images.values())if(g.layer==="bottom"?i=!0:t=!0,t&&i)break;if(t&&!this._renderer.hasLayer("top")&&(this._renderer.insertLayerToDom("top"),!this._renderer.hasLayer("top")))return;if(i&&!this._renderer.hasLayer("bottom")&&this._renderer.insertLayerToDom("bottom"),this._renderer.rescaleCanvas(),!this._images.size){this._fullyCleared||(this._renderer.clearAll(),this._fullyCleared=!0,this._needsFullClear=!1),this._renderer.hasLayer("top")&&this._renderer.removeLayerFromDom("top"),this._renderer.hasLayer("bottom")&&this._renderer.removeLayerFromDom("bottom");return}!t&&this._renderer.hasLayer("top")&&(this._renderer.clearAll("top"),this._renderer.removeLayerFromDom("top")),!i&&this._renderer.hasLayer("bottom")&&(this._renderer.clearAll("bottom"),this._renderer.removeLayerFromDom("bottom")),this._needsFullClear&&(this._renderer.clearAll(),this._fullyCleared=!0,this._needsFullClear=!1);let{start:A,end:r}=e,n=this._terminal._core.buffer,a=this._terminal._core.cols;this._renderer.clearLines(A,r);let o=[],h=[];for(let g=A;g<=r;++g){let d=n.lines.get(g+n.ydisp);if(!d)return;for(let I=0;I<a;++I)if(d.getBg(I)&268435456){let l=d._extendedAttrs[I]??F,c=l.imageId;if(c===void 0||c===-1)continue;let u=this._images.get(c);if(l.tileId!==-1){let E=l.tileId,C=I,p=1;for(;++I<a&&d.getBg(I)&268435456&&(l=d._extendedAttrs[I]??F)&&l.imageId===c&&l.tileId===E+p;)p++;I--,u?u.actual&&o.push({imgSpec:u,tileId:E,col:C,row:g,count:p}):this._opts.showPlaceholder&&h.push({col:C,row:g,count:p}),this._fullyCleared=!1}}}o.sort((g,d)=>g.imgSpec.zIndex-d.imgSpec.zIndex);for(let g of h)this._renderer.drawPlaceholder(g.col,g.row,g.count);for(let g of o)this._renderer.draw(g.imgSpec,g.tileId,g.col,g.row,g.count)}viewportResize(e){if(!this._images.size){this._viewportMetrics=e;return}if(this._viewportMetrics.cols>=e.cols){this._viewportMetrics=e;return}let t=this._terminal._core.buffer,i=t.lines.length,A=this._viewportMetrics.cols-1;for(let r=0;r<i;++r){let n=t.lines.get(r);if(n.getBg(A)&268435456){let a=n._extendedAttrs[A]??F,o=a.imageId;if(o===void 0||o===-1)continue;let h=this._images.get(o);if(!h)continue;let g=Math.ceil((h.actual?.width||0)/h.actualCellSize.width);if(a.tileId%g+1>=g)continue;let d=!1;for(let c=A+1;c>e.cols;++c)if(n._data[c*3+0]&4194303){d=!0;break}if(d)continue;let I=Math.min(e.cols,g-a.tileId%g+A),l=a.tileId;for(let c=A+1;c<I;++c)this._writeToCell(n,c,o,++l),h.tileCount++}}this._viewportMetrics=e}getImageAtBufferCell(e,t){let A=this._terminal._core.buffer.lines.get(t);if(A&&A.getBg(e)&268435456){let r=A._extendedAttrs[e]??F;if(r.imageId&&r.imageId!==-1){let n=this._images.get(r.imageId)?.orig;if(window.ImageBitmap&&n instanceof ImageBitmap){let a=D.createCanvas(window.document,n.width,n.height);return a.getContext("2d")?.drawImage(n,0,0,n.width,n.height),a}return n}}}extractTileAtBufferCell(e,t){let A=this._terminal._core.buffer.lines.get(t);if(A&&A.getBg(e)&268435456){let r=A._extendedAttrs[e]??F;if(r.imageId&&r.imageId!==-1&&r.tileId!==-1){let n=this._images.get(r.imageId);if(n)return this._renderer.extractTile(n,r.tileId)}}}_evictOldest(e){let t=this._getStoredPixels(),i=t;for(;this._pixelLimit<i+e&&this._images.size;){let A=this._images.get(++this._lowestId);A&&A.orig&&(i-=A.orig.width*A.orig.height,A.actual&&A.orig!==A.actual&&(i-=A.actual.width*A.actual.height),A.marker?.dispose(),this._delImg(this._lowestId))}return t-i}_writeToCell(e,t,i,A){if(e._data[t*3+2]&268435456){let r=e._extendedAttrs[t];if(r){if(r.imageId!==void 0){let n=this._images.get(r.imageId);n&&n.tileCount--,r.imageId=i,r.tileId=A;return}e._extendedAttrs[t]=new G(r.ext,r.urlId,i,A);return}}e._data[t*3+2]|=268435456,e._extendedAttrs[t]=new G(0,0,i,A)}_evictOnAlternate(){for(let i of this._images.values())i.bufferType==="alternate"&&(i.tileCount=0);let e=this._terminal._core.buffer;for(let i=0;i<this._terminal.rows;++i){let A=e.lines.get(i);if(A){for(let r=0;r<this._terminal.cols;++r)if(A._data[r*3+2]&268435456){let n=A._extendedAttrs[r]?.imageId;if(n){let a=this._images.get(n);a&&a.tileCount++}}}}let t=[];for(let[i,A]of this._images.entries())A.bufferType==="alternate"&&!A.tileCount&&(A.marker?.dispose(),t.push(i));for(let i of t)this._delImg(i)}};var Oe=M(Ce()),Je=M(Ne());function V(s){let e="";for(let t=0;t<s.length;++t)e+=String.fromCharCode(s[t]);return e}function fe(s){let e=0;for(let t=0;t<s.length;++t){if(s[t]<48||s[t]>57)throw new Error("illegal char");e=e*10+s[t]-48}return e}function He(s){let e=V(s);if(!e.match(/^((auto)|(\d+?((px)|(%)){0,1}))$/))throw new Error("illegal size");return e}function bt(s){if(typeof Buffer<"u")return Buffer.from(V(s),"base64").toString();let e=atob(V(s)),t=new Uint8Array(e.length);for(let i=0;i<t.length;++i)t[i]=e.charCodeAt(i);return new TextDecoder().decode(t)}var Fe={inline:fe,size:fe,name:bt,width:He,height:He,preserveAspectRatio:fe},Ge=[70,105,108,101],Ue=[77,117,108,116,105,112,97,114,116,70,105,108,101],Qe=[70,105,108,101,80,97,114,116],De=[70,105,108,101,69,110,100],we=[82,101,112,111,114,116,67,101,108,108,83,105,122,101],be=1024,$=class{constructor(){this.state=0;this._buffer=new Uint32Array(be);this._position=0;this._key="";this.fields={}}reset(){this._buffer.fill(0),this.state=0,this._position=0,this.fields={},this._key=""}end(){if(this.state===0){if(this._position===De.length){for(let e=0;e<De.length;++e)if(this._buffer[e]!==De[e])return this._a();return this.fields.type=4,this.state=4,0}if(this._position===we.length){for(let e=0;e<we.length;++e)if(this._buffer[e]!==we[e])return this._a();return this.fields.type=5,this.state=4,0}return this._a()}return this.state===4?0:this.state===3&&this.fields.type===2?this._storeValue(this._position)?(this.state=4,0):this._a():this._a()}parse(e,t,i){let A=this.state,r=this._position,n=this._buffer;if(A===1||A===4||A===0&&r>14)return-1;for(let a=t;a<i;++a){let o=e[a];switch(o){case 59:if(!this._storeValue(r))return this._a();A=2,r=0;break;case 61:if(A===0){if(n[0]===70){let h=0;for(;h<Ge.length;++h)if(n[h]!==Ge[h])return this._a();if(this.fields.type=1,r===Qe.length){for(;h<Qe.length;++h)if(n[h]!==Qe[h])return this._a();return this.fields.type=3,this.state=4,a+1}}else if(n[0]===77){for(let h=0;h<Ue.length;++h)if(n[h]!==Ue[h])return this._a();this.fields.type=2}else return this._a();A=2,r=0}else if(A===2){if(!this._storeKey(r))return this._a();A=3,r=0}else if(A===3){if(r>=be)return this._a();n[r++]=o}break;case 58:return A===3&&!this._storeValue(r)?this._a():(this.state=4,a+1);default:if(r>=be)return this._a();n[r++]=o}}return this.state=A,this._position=r,-2}_a(){return this.fields.type=0,this.state=1,-1}_storeKey(e){let t=V(this._buffer.subarray(0,e));return t?(this._key=t,this.fields[t]=null,!0):!1}_storeValue(e){if(this._key){try{let t=this._buffer.slice(0,e);this.fields[this._key]=Fe[this._key]?Fe[this._key](t):t}catch{return!1}return!0}return!1}};var L={mime:"unsupported",width:0,height:0};function ee(s){if(s.length<32)return L;let e=new Uint32Array(s.buffer,s.byteOffset,8);if(e[0]===1196314761&&e[1]===169478669&&e[3]===1380206665)return{mime:"image/png",width:s[16]<<24|s[17]<<16|s[18]<<8|s[19],height:s[20]<<24|s[21]<<16|s[22]<<8|s[23]};if(s[0]===255&&s[1]===216&&s[2]===255){let[t,i]=yt(s);return{mime:"image/jpeg",width:t,height:i}}if(e[0]===944130375&&(s[4]===55||s[4]===57)&&s[5]===97)return{mime:"image/gif",width:s[7]<<8|s[6],height:s[9]<<8|s[8]};if(e[0]===1718185841)return{mime:"image/qoi",width:s[4]<<24|s[5]<<16|s[6]<<8|s[7],height:s[8]<<24|s[9]<<16|s[10]<<8|s[11]};if(e[0]===1179011410&&e[2]===1346520407&&(e[3]&16777215)===3690582){switch(s[15]){case 88:return{mime:"image/webp",width:(s[24]|s[25]<<8|s[26]<<16)+1,height:(s[27]|s[28]<<8|s[29]<<16)+1};case 76:if(s[20]!==47)return L;let t=s[21]|s[22]<<8|s[23]<<16|s[24]<<24;return{mime:"image/webp",width:(t&16383)+1,height:(t>>>14&16383)+1};case 32:return s[23]!==157||s[24]!==1||s[25]!==42?L:{mime:"image/webp",width:(s[26]|s[27]<<8)&16383,height:(s[28]|s[29]<<8)&16383}}return L}if(e[1]===1887007846&&(e[2]===1718187617||e[2]===1936291425)){let t=-1,i=Math.min(s.length-16,1024);for(let A=8;A<i;A++)if(s[A]===105&&s[A+1]===115&&s[A+2]===112&&s[A+3]===101){t=A;break}if(t!==-1){let A=s[t+8]<<24|s[t+9]<<16|s[t+10]<<8|s[t+11],r=s[t+12]<<24|s[t+13]<<16|s[t+14]<<8|s[t+15];if(A>0&&r>0)return{mime:"image/avif",width:A,height:r}}return L}return L}function yt(s){let e=s.length,t=4,i=s[t]<<8|s[t+1];for(;;){if(t+=i,t>=e)return[0,0];if(s[t]!==255)return[0,0];if(s[t+1]===192||s[t+1]===194)return t+8<e?[s[t+7]<<8|s[t+8],s[t+5]<<8|s[t+6]]:[0,0];t+=2,i=s[t]<<8|s[t+1]}}var ye={type:0,name:"Unnamed file",size:0,width:"auto",height:"auto",preserveAspectRatio:1,inline:0},te=class{constructor(e,t,i,A){this._opts=e;this._renderer=t;this._storage=i;this._coreTerminal=A;this._generation=0;this._aborted=!1;this._hp=new $;this._header=ye;this._isMultipart=!1;this._abortMulti=!1;let r=Math.ceil(this._opts.iipSizeLimit*4/3),n=Math.min(1048576,r);this._dec=new Oe.default(4194304,r,n),this._qoiDec=new Je.default(4194304)}reset(){this._generation++,this._hp.reset(),this._dec.release(),this._qoiDec.release()}start(){this._aborted=!1,this._hp.reset()}put(e,t,i){if(!this._aborted)if(this._hp.state===4)this._dec.put(e.subarray(t,i))!==0&&(this._dec.release(),this._aborted=!0);else{let A=this._hp.parse(e,t,i);if(A===-1){this._aborted=!0;return}if(A>0){if(this._hp.fields.type===1){if(this._isMultipart&&(this._isMultipart=!1,this._abortMulti=!1,this._dec.release()),this._header=Object.assign({},ye,this._hp.fields),!this._header.inline){this._aborted=!0;return}this._dec.init()}else if(this._abortMulti){this._aborted=!0;return}this._dec.put(e.subarray(A,i))!==0&&(this._dec.release(),this._aborted=!0,this._isMultipart&&(this._abortMulti=!0))}}}end(e){if(this._aborted||this._hp.state!==4&&this._hp.end())return!0;let t=this._hp.fields.type;if(t===3)return!0;if(t===5){let h=w.width,g=w.height;this._renderer.dimensions&&(h=this._renderer.dimensions.css.canvas.width/this._coreTerminal.cols,g=this._renderer.dimensions.css.canvas.height/this._coreTerminal.rows);let d=this._coreTerminal._core._coreBrowserService?.dpr??1,I=`\x1B]1337;ReportCellSize=${g.toFixed(3)};${h.toFixed(3)};${d.toFixed(3)}\x1B\\`;return this._coreTerminal.input(I,!1),!0}if(t===2)return this._header=Object.assign({},ye,this._hp.fields),this._isMultipart=!0,this._abortMulti=!1,this._dec.release(),this._dec.init(),!0;if(t===4&&(!this._isMultipart||(this._isMultipart=!1,this._abortMulti||this._header.type!==2)))return!0;let i=0,A=0,r,n=L;if((r=e)&&((r=!this._dec.end())?(n=ee(this._dec.data8),(r=n.mime!=="unsupported")?(i=n.width,A=n.height,(r=i&&A&&i*A<this._opts.pixelLimit)?([i,A]=this._resize(i,A).map(Math.floor),r=i&&A&&i*A<this._opts.pixelLimit):console.warn(`IIP: image dimension issue ${n.width}x${n.height}`)):console.warn("IIP: unsupported image type")):console.warn("IIP: error during BASE64 decoding")),!r)return this._dec.release(),!0;let a;if(n.mime==="image/qoi"){let h=this._qoiDec.decode(this._dec.data8);if(a=new ImageData(new Uint8ClampedArray(h.buffer,h.byteOffset,h.byteLength),this._qoiDec.width,this._qoiDec.height),this._qoiDec.release(),i===this._qoiDec.width&&A===this._qoiDec.height){this._dec.release();let g=D.createCanvas(void 0,this._qoiDec.width,this._qoiDec.height);return g.getContext("2d")?.putImageData(a,0,0),this._storage.addImage(g),!0}}else a=new Blob([this._dec.data8],{type:n.mime});this._dec.release();let o=this._generation;return createImageBitmap(a,{resizeWidth:i,resizeHeight:A}).then(h=>o!==this._generation?(h.close(),!0):(this._storage.addImage(h),!0)).catch(h=>(console.warn(`IIP: decoding error ${n.mime} ${n.width}x${n.height}`,h),!0))}_resize(e,t){let i=this._renderer.dimensions?.css.cell.width||w.width,A=this._renderer.dimensions?.css.cell.height||w.height,r=this._renderer.dimensions?.css.canvas.width||i*this._coreTerminal.cols,n=this._renderer.dimensions?.css.canvas.height||A*this._coreTerminal.rows,a=this._dim(this._header.width,r,i),o=this._dim(this._header.height,n,A);if(!a&&!o){let h=r/e,g=(n-A)/t,d=Math.min(h,g);return d<1?[e*d,t*d]:[e,t]}return a?this._header.preserveAspectRatio||!a||!o?[a,t*a/e]:[a,o]:[e*o/t,o]}_dim(e,t,i){return e==="auto"?0:e.endsWith("%")?parseInt(e.slice(0,-1),10)*t/100:e.endsWith("px")?parseInt(e.slice(0,-2),10):parseInt(e,10)*i}};var Ke=M(Ce());function Se(s){let e={},t=s.split(",");for(let i of t){let A=i.indexOf("=");if(A===-1)continue;let r=i.substring(0,A),n=i.substring(A+1);if(r==="a"){e.action=n;continue}if(r==="o"){e.compression=n;continue}if(r==="t"){e.transmission=n;continue}if(r==="d"){e.deleteSelector=n;continue}let a=parseInt(n,10);switch(r){case"f":e.format=a;break;case"i":e.id=a;break;case"I":e.imageNumber=a;break;case"s":e.width=a;break;case"v":e.height=a;break;case"x":e.x=a;break;case"y":e.y=a;break;case"w":e.sourceWidth=a;break;case"h":e.sourceHeight=a;break;case"X":e.xOffset=a;break;case"Y":e.yOffset=a;break;case"c":e.columns=a;break;case"r":e.rows=a;break;case"m":e.more=a;break;case"q":e.quiet=a;break;case"C":e.cursorMovement=a;break;case"z":e.zIndex=a;break;case"p":e.placementId=a;break}}return e}var Pe=0,ie=class{constructor(e,t,i,A){this._opts=e;this._renderer=t;this._kittyStorage=i;this._coreTerminal=A;this._aborted=!1;this._generation=0;this._decodeError=!1;this._activeDecoder=null;this._inControlData=!0;this._controlData=new Uint32Array(512);this._controlLength=0;this._encodedSizeLimit=0;this._totalEncodedSize=0;this._parsedCommand=null;this._pendingTransmissions=new Map;this._maxEncodedBytes=Math.ceil(this._opts.kittySizeLimit*4/3),this._initialEncodedBytes=Math.min(4194304,this._maxEncodedBytes)}reset(){this._generation++,this._cleanupAllPending(),this._activeDecoder&&(this._activeDecoder.release(),this._activeDecoder=null),this._kittyStorage.reset()}dispose(){this.reset()}_removePendingEntry(e){this._pendingTransmissions.delete(e),this._lastPendingKey===e&&(this._lastPendingKey=void 0)}_cleanupAllPending(){for(let e of this._pendingTransmissions.values())e.decoder.release();this._pendingTransmissions.clear(),this._lastPendingKey=void 0}start(){this._aborted=!1,this._decodeError=!1,this._inControlData=!0,this._controlLength=0,this._parsedCommand=null,this._encodedSizeLimit=this._maxEncodedBytes,this._totalEncodedSize=0,this._activeDecoder=null}put(e,t,i){if(!this._aborted)if(!this._inControlData)this._streamPayload(e,t,i);else{let A=i;for(let n=t;n<i;n++)if(e[n]===59){this._inControlData=!1,A=n;break}let r=A-t;if(this._controlLength+r>512){this._aborted=!0;return}if(this._controlData.set(e.subarray(t,A),this._controlLength),this._controlLength+=r,!this._inControlData){if(this._parsedCommand=Se(this._parseControlDataString()),this._parsedCommand.id!==void 0&&this._parsedCommand.imageNumber!==void 0){this._sendResponse(this._parsedCommand.id,"EINVAL:cannot specify both i and I keys",this._parsedCommand.quiet??0),this._aborted=!0;return}if(this._parsedCommand.action==="d")return;let n=A+1;n<i&&this._streamPayload(e,n,i)}}}_streamPayload(e,t,i){if(this._aborted)return;let A=this._parsedCommand?.id??this._lastPendingKey??0,r=this._pendingTransmissions.get(A),n=r?.totalEncodedSize??0;if(this._totalEncodedSize+=i-t,n+this._totalEncodedSize>this._encodedSizeLimit){let o=this._activeDecoder??r?.decoder;o&&o.release(),this._activeDecoder=null,r&&this._removePendingEntry(A),this._aborted=!0;return}if(!this._decodeError){if(r?.decoder&&!this._activeDecoder&&(this._activeDecoder=r.decoder),!this._activeDecoder){let o=this._maxEncodedBytes+131072;if(o>this._opts.storageLimit*1e6){this._aborted=!0,this._parsedCommand?.id!==void 0&&this._sendResponse(this._parsedCommand.id,"ENOMEM:pending image budget exceeded",this._parsedCommand.quiet??0);return}let h=Math.max(1,Math.floor(this._opts.storageLimit*1e6/o));for(;this._pendingTransmissions.size>=h;){let g=this._pendingTransmissions.entries().next().value;if(!g)break;g[1].decoder.release(),this._removePendingEntry(g[0]),g[1].cmd.id!==void 0&&this._sendResponse(g[1].cmd.id,"ENOMEM:pending image budget exceeded",g[1].cmd.quiet??0)}this._activeDecoder=new Ke.default(4194304,this._maxEncodedBytes,this._initialEncodedBytes),this._activeDecoder.init()}this._activeDecoder.put(e.subarray(t,i))!==Pe&&(this._activeDecoder.release(),this._activeDecoder=null,this._decodeError=!0,r&&this._removePendingEntry(A))}}end(e){if(this._aborted||!e)return this._activeDecoder&&(this._activeDecoder.release(),this._activeDecoder=null),!0;if(this._inControlData)return this._handleNoPayloadCommand();let t=this._parsedCommand;if(t.action==="d")return this._handleDelete(t);let i=t.id??this._lastPendingKey??0,A=t.more===1,r=this._pendingTransmissions.get(i);if(A)return this._activeDecoder&&(r?(r.totalEncodedSize+=this._totalEncodedSize,r.decodeError=r.decodeError||this._decodeError):this._pendingTransmissions.set(i,{cmd:{...t},decoder:this._activeDecoder,totalEncodedSize:this._totalEncodedSize,decodeError:this._decodeError}),this._lastPendingKey=i,this._activeDecoder=null),!0;r&&(this._lastPendingKey=void 0);let n=this._decodeError,a=t,o=this._activeDecoder;r&&(a=r.cmd,o=r.decoder,n=n||r.decodeError,this._pendingTransmissions.delete(i));let h=new Uint8Array(0);o&&(o.end()!==Pe&&(n=!0),h=o.data8),this._activeDecoder=null;let g=this._handleCommandWithBytesAndCmd(a,h,n);return o&&o.release(),g}_parseControlDataString(){let e="";for(let t=0;t<this._controlLength;t++)e+=String.fromCodePoint(this._controlData[t]);return e}_handleNoPayloadCommand(){let e=Se(this._parseControlDataString());if(e.id!==void 0&&e.imageNumber!==void 0)return this._sendResponse(e.id,"EINVAL:cannot specify both i and I keys",e.quiet??0),!0;switch(e.action??"t"){case"d":return this._handleDelete(e);case"q":return this._sendResponse(e.id??0,"OK",e.quiet??0),!0;case"p":return this._handlePlacement(e);default:return e.id!==void 0&&this._sendResponse(e.id,"EINVAL:unsupported action",e.quiet??0),!0}}_handleCommandWithBytesAndCmd(e,t,i){switch(e.action??"t"){case"t":{let r=this._handleTransmit(e,t,i);return(e.transmission??"d")==="d"&&e.id!==void 0&&(i?this._sendResponse(e.id,"EINVAL:invalid base64 data",e.quiet??0):t.length>0&&this._sendResponse(e.id,"OK",e.quiet??0)),r}case"T":return this._handleTransmitDisplay(e,t,i);case"q":return this._handleQuery(e,t,i);case"p":return this._handlePlacement(e);default:return e.id!==void 0&&this._sendResponse(e.id,"EINVAL:unsupported action",e.quiet??0),!0}}_handlePlacement(e){if(e.id===void 0)return!0;let t=e.id,i=this._kittyStorage.getImage(t);return i?this._displayImage(i,e).then(r=>(this._sendResponse(t,r?"OK":"EINVAL:image rendering failed",e.quiet??0,e.placementId),!0)):(this._sendResponse(t,"ENOENT:image not found",e.quiet??0,e.placementId),!0)}_handleTransmit(e,t,i){return(e.transmission??"d")!=="d"?(e.id!==void 0&&this._sendResponse(e.id,"EINVAL:unsupported transmission medium",e.quiet??0),!0):(i||t.length===0||this._kittyStorage.storeImage(e.id,{data:new Blob([t]),width:e.width??0,height:e.height??0,format:e.format??32,compression:e.compression??""}),!0)}_handleTransmitDisplay(e,t,i){if(i)return e.id!==void 0&&this._sendResponse(e.id,"EINVAL:invalid base64 data",e.quiet??0),!0;this._handleTransmit(e,t,i);let A=e.id??this._kittyStorage.lastImageId,r=this._kittyStorage.getImage(A);if(r){let n=this._displayImage(r,e);return e.id!==void 0?n.then(a=>(this._sendResponse(A,a?"OK":"EINVAL:image rendering failed",e.quiet??0),!0)):n.then(()=>!0)}return!0}_handleQuery(e,t,i){let A=e.id??0,r=e.quiet??0;if((e.transmission??"d")!=="d")return this._sendResponse(A,"EINVAL:unsupported transmission medium",r),!0;if(i)return this._sendResponse(A,"EINVAL:invalid base64 data",r),!0;if(t.length===0)return this._sendResponse(A,"OK",r),!0;let a=e.format??32;if(a===100)this._sendResponse(A,"OK",r);else{let o=e.width??0,h=e.height??0;if(!o||!h)return this._sendResponse(A,"EINVAL:width and height required for raw pixel data",r),!0;let g=a===32?4:3,d=o*h*g;if(t.length<d)return this._sendResponse(A,"EINVAL:insufficient pixel data",r),!0;this._sendResponse(A,"OK",r)}return!0}_handleDelete(e){switch(e.deleteSelector??"a"){case"a":case"A":this._cleanupAllPending(),this._kittyStorage.deleteAll();break;case"i":case"I":if(e.id!==void 0){let i=this._pendingTransmissions.get(e.id);i&&i.decoder.release(),this._removePendingEntry(e.id),this._kittyStorage.deleteById(e.id)}break;default:break}return!0}_sendResponse(e,t,i,A){let r=t==="OK";if(r&&i>=1||!r&&i>=2)return;let n=A?`,p=${A}`:"",a=`\x1B_Gi=${e}${n};${t}\x1B\\`;this._coreTerminal._core.coreService.triggerDataEvent(a)}_displayImage(e,t){return this._decodeAndDisplay(e,t).then(()=>!0).catch(()=>!1)}async _decodeAndDisplay(e,t){let i=this._generation,A=await this._createBitmap(e);try{if(i!==this._generation)throw new Error("image decode canceled");let r=Math.max(0,t.x??0),n=Math.max(0,t.y??0),a=t.sourceWidth||A.width-r,o=t.sourceHeight||A.height-n,h=Math.max(0,A.width-r),g=Math.max(0,A.height-n),d=Math.max(0,Math.min(a,h)),I=Math.max(0,Math.min(o,g));if(d===0||I===0)throw new Error("invalid source rectangle");if(r!==0||n!==0||d!==A.width||I!==A.height){let T=await createImageBitmap(A,r,n,d,I);A.close(),A=T}let l=this._renderer.dimensions?.css.cell.width||w.width,c=this._renderer.dimensions?.css.cell.height||w.height,u,E;t.columns!==void 0&&t.rows!==void 0?(u=t.columns,E=t.rows):t.columns!==void 0?(u=t.columns,E=Math.max(1,Math.ceil(A.height/A.width*(u*l)/c))):t.rows!==void 0?(E=t.rows,u=Math.max(1,Math.ceil(A.width/A.height*(E*c)/l))):(u=Math.ceil(A.width/l),E=Math.ceil(A.height/c));let C=A.width,p=A.height;if((t.columns!==void 0||t.rows!==void 0)&&(C=Math.round(u*l),p=Math.round(E*c)),C*p>this._opts.pixelLimit)throw new Error("image exceeds pixel limit");let B=this._coreTerminal._core.buffer,K=B.x,Y=B.y,q=B.ybase,$e=t.zIndex!==void 0&&t.zIndex<0?"bottom":"top";if(C!==A.width||p!==A.height){let T=await createImageBitmap(A,{resizeWidth:C,resizeHeight:p});A.close(),A=T}let ge=Math.min(Math.max(0,t.xOffset??0),l-1),de=Math.min(Math.max(0,t.yOffset??0),c-1);if(ge!==0||de!==0){let T=t.columns!==void 0?Math.round(u*l):A.width+ge,tt=t.rows!==void 0?Math.round(E*c):A.height+de,z=D.createCanvas(window.document,T,tt),xe=z.getContext("2d");if(!xe)throw new Error("Failed to create offset canvas context");xe.drawImage(A,ge,de);let it=await createImageBitmap(z);if(z.width=z.height=0,A.close(),A=it,C=A.width,p=A.height,C*p>this._opts.pixelLimit)throw new Error("image exceeds pixel limit");t.columns===void 0&&(u=Math.ceil(A.width/l)),t.rows===void 0&&(E=Math.ceil(A.height/c))}if(i!==this._generation)throw new Error("image decode canceled");let et=t.zIndex??0;if(this._kittyStorage.addImage(e.id,A,!0,$e,et),A=void 0,t.cursorMovement===1){let T=B.ybase-q;B.x=K,B.y=Math.max(Y-T,0)}else B.x=Math.min(K+u,this._coreTerminal.cols)}catch(r){throw A?.close(),r}}async _createBitmap(e){let t=new Uint8Array(await e.data.arrayBuffer());if(e.compression==="z"&&(t=await this._decompressZlib(t)),e.format===100){let E=ee(t);if(E.mime!=="image/png"||!(E.width>0)||!(E.height>0)||E.width*E.height>this._opts.pixelLimit)throw new RangeError("PNG exceeds pixel limit or has invalid dimensions");let C=new Blob([t],{type:"image/png"});if(!window.createImageBitmap){let p=URL.createObjectURL(C),B=new Image;return new Promise((K,Y)=>{B.addEventListener("load",()=>{URL.revokeObjectURL(p);let q=D.createCanvas(window.document,B.width,B.height);q.getContext("2d")?.drawImage(B,0,0),createImageBitmap(q).then(K).catch(Y)}),B.addEventListener("error",()=>{URL.revokeObjectURL(p),Y(new Error("Failed to load image"))}),B.src=p})}return createImageBitmap(C)}let i=e.width,A=e.height;if(!i||!A)throw new Error("Width and height required for raw pixel data");let r=e.format===32?4:3,n=i*A*r;if(t.length<n)throw new Error("Insufficient pixel data");let a=i*A;if(e.format===32)return createImageBitmap(new ImageData(new Uint8ClampedArray(t.buffer,t.byteOffset,a*4),i,A));let o=new Uint8ClampedArray(a*4),h=new Uint32Array(t.buffer,t.byteOffset,Math.floor(t.byteLength/4)),g=new Uint32Array(o.buffer),d=a&-4,I=0,l=0;for(let E=0;E<d;E+=4){let C=h[I++],p=h[I++],B=h[I++];g[l++]=4278190080|C,g[l++]=4278190080|C>>>24|p<<8,g[l++]=4278190080|p>>>16|B<<16,g[l++]=4278190080|B>>>8}let c=d*3,u=d*4;for(let E=d;E<a;E++)o[u]=t[c],o[u+1]=t[c+1],o[u+2]=t[c+2],o[u+3]=255,c+=3,u+=4;return createImageBitmap(new ImageData(o,i,A))}async _decompressZlib(e){try{return await this._decompress(e,"deflate")}catch(t){if(t instanceof RangeError)throw t;return await this._decompress(e,"deflate-raw")}}async _decompress(e,t){let i=Math.min(this._opts.kittySizeLimit,this._opts.pixelLimit*4,this._opts.storageLimit*1e6),A=0,n=new ReadableStream({pull(d){if(A>=e.length){d.close();return}let I=Math.min(A+4096,e.length);d.enqueue(new Uint8Array(e.subarray(A,I))),A=I}}).pipeThrough(new DecompressionStream(t)).getReader(),a=[],o=0;try{for(;;){let{done:d,value:I}=await n.read();if(d)break;if(o+=I.byteLength,o>i)throw await n.cancel().catch(()=>{}),new RangeError("decompressed image exceeds byte limit");a.push(I)}}finally{n.releaseLock()}let h=new Uint8Array(o),g=0;for(let d of a)h.set(d,g),g+=d.length;return h}get images(){return this._kittyStorage.images}get _kittyIdToStorageId(){return this._kittyStorage.kittyIdToStorageId}get pendingTransmissions(){return this._pendingTransmissions}};var U=class U{constructor(e){this._storage=e;this._nextImageId=1;this._images=new Map;this._kittyIdToStorageId=new Map;this._storageIdToKittyId=new Map;this._handleStorageImageDeleted=e=>{let t=this._storageIdToKittyId.get(e);t!==void 0&&(this._kittyIdToStorageId.delete(t),this._storageIdToKittyId.delete(e),this._images.delete(t))};this._addImageOpts={scrolling:!0,layer:"top",zIndex:0,cursorPos:"iip"};this._previousOnImageDeleted=this._storage.onImageDeleted,this._wrappedOnImageDeleted=t=>{this._previousOnImageDeleted?.(t),this._handleStorageImageDeleted(t)},this._storage.onImageDeleted=this._wrappedOnImageDeleted}reset(){this._nextImageId=1,this._images.clear(),this._kittyIdToStorageId.clear(),this._storageIdToKittyId.clear()}dispose(){this.reset(),this._storage.onImageDeleted===this._wrappedOnImageDeleted&&(this._storage.onImageDeleted=this._previousOnImageDeleted)}storeImage(e,t){let i=e??this._nextImageId++,A=this._kittyIdToStorageId.get(i);A!==void 0&&(this._storage.deleteImage(A),this._kittyIdToStorageId.delete(i),this._storageIdToKittyId.delete(A)),!this._images.has(i)&&this._images.size>=U._maxStoredImages&&this._evictUndisplayedImages();let r=this._storage.getLimit()*1e6;this._images.delete(i);let n=0;for(let a of this._images.values())n+=a.data.size;for(let a of[!1,!0])for(let[o,h]of this._images){if(n+t.data.size<=r)break;this._kittyIdToStorageId.has(o)===a&&(n-=h.data.size,this.deleteById(o))}return this._images.set(i,{...t,id:i}),i}addImage(e,t,i,A,r){let n=this._kittyIdToStorageId.get(e);n!==void 0&&this._storageIdToKittyId.delete(n),this._addImageOpts.scrolling=i,this._addImageOpts.layer=A,this._addImageOpts.zIndex=r;let a=this._storage.addImage(t,this._addImageOpts);this._kittyIdToStorageId.set(e,a),this._storageIdToKittyId.set(a,e)}getImage(e){return this._images.get(e)}deleteById(e){this._images.delete(e);let t=this._kittyIdToStorageId.get(e);t!==void 0&&(this._storage.deleteImage(t),this._kittyIdToStorageId.delete(e),this._storageIdToKittyId.delete(t))}deleteAll(){this._images.clear();for(let e of this._kittyIdToStorageId.values())this._storage.deleteImage(e);this._kittyIdToStorageId.clear(),this._storageIdToKittyId.clear()}get images(){return this._images}get kittyIdToStorageId(){return this._kittyIdToStorageId}get lastImageId(){return this._nextImageId-1}_evictUndisplayedImages(){for(let[e]of this._images){if(this._images.size<=U._maxStoredImages/2)break;this._kittyIdToStorageId.has(e)||this._images.delete(e)}}};U._maxStoredImages=256;var Ae=U;var y=M(Z());var Xe=M(We());var Mt=4194304,Te=y.PALETTE_ANSI_256;Te.set(y.PALETTE_VT340_COLOR);var ae=class{constructor(e,t,i){this._opts=e;this._storage=t;this._coreTerminal=i;this._size=0;this._aborted=!1;(0,Xe.DecoderAsync)({memoryLimit:this._opts.pixelLimit*4,palette:Te,paletteLimit:this._opts.sixelPaletteLimit}).then(A=>this._dec=A)}reset(){this._dec&&(this._dec.release(),this._dec._palette.fill(0),this._dec.init(0,Te,this._opts.sixelPaletteLimit))}hook(e){if(this._size=0,this._aborted=!1,this._dec){let t=e.params[1]===1?0:vt(this._coreTerminal._core._inputHandler._curAttrData,this._coreTerminal._core._themeService?.colors);this._dec.init(t,null,this._opts.sixelPaletteLimit)}}put(e,t,i){if(!(this._aborted||!this._dec)){if(this._size+=i-t,this._size>this._opts.sixelSizeLimit){console.warn("SIXEL: too much data, aborting"),this._aborted=!0,this._dec.release();return}try{this._dec.decode(e,t,i)}catch(A){console.warn(`SIXEL: error while decoding image - ${A}`),this._aborted=!0,this._dec.release()}}}unhook(e){if(this._aborted||!e||!this._dec)return!0;let t=this._dec.width,i=this._dec.height;if(!t||!i)return i&&this._storage.advanceCursor(i),!0;let A=D.createCanvas(void 0,t,i);return A.getContext("2d")?.putImageData(new ImageData(this._dec.data8,t,i),0,0),this._dec.memoryUsage>Mt&&this._dec.release(),this._storage.addImage(A),!0}};function vt(s,e){let t=0;if(!e)return t;if(s.isInverse())if(s.isFgDefault())t=ne(e.foreground.rgba);else if(s.isFgRGB()){let i=s.constructor.toColorRGB(s.getFgColor());t=(0,y.toRGBA8888)(...i)}else t=ne(e.ansi[s.getFgColor()].rgba);else if(s.isBgDefault())t=ne(e.background.rgba);else if(s.isBgRGB()){let i=s.constructor.toColorRGB(s.getBgColor());t=(0,y.toRGBA8888)(...i)}else t=ne(e.ansi[s.getBgColor()].rgba);return t}function ne(s){return y.BIG_ENDIAN?s:(s&255)<<24|(s>>>8&255)<<16|(s>>>16&255)<<8|s>>>24&255}var oe=class{constructor(e,t,i,A){this._storage=e;this._opts=t;this._renderer=i;this._terminal=A;this._addImageOpts={scrolling:!0,layer:"top",zIndex:0,cursorPos:"vt340"}}addImage(e){this._addImageOpts.scrolling=this._opts.sixelScrolling,this._storage.addImage(e,this._addImageOpts)}advanceCursor(e){if(this._opts.sixelScrolling){let t=this._renderer.cellSize;(t.width===-1||t.height===-1)&&(t=w);let i=Math.ceil(e/t.height);for(let A=1;A<i;++A)this._terminal._core._inputHandler.lineFeed()}}};var he=class{constructor(e){this._storage=e;this._addImageOpts={scrolling:!0,layer:"top",zIndex:0,cursorPos:"iip"}}addImage(e){this._storage.addImage(e,this._addImageOpts)}};var Ze={enableSizeReports:!0,pixelLimit:16777216,sixelSupport:!0,sixelScrolling:!0,sixelPaletteLimit:4096,sixelSizeLimit:33554432,storageLimit:128,showPlaceholder:!0,iipSupport:!0,iipSizeLimit:33554432,kittySupport:!0,kittySizeLimit:33554432},je=4096;var Ve=class{constructor(e){this._disposables=[];this._handlers=new Map;this._onImageAdded=new X;this.onImageAdded=this._onImageAdded.event;this._opts=Object.assign({},Ze,e),this._defaultOpts=Object.assign({},Ze,e)}dispose(){for(let e of this._handlers.values())e.reset();for(let e of this._disposables)e.dispose();this._disposables.length=0,this._handlers.clear(),this._onImageAdded.dispose()}_disposeLater(...e){for(let t of e)this._disposables.push(t)}activate(e){if(this._terminal=e,this._renderer=new D(e),this._storage=new j(e,this._renderer,this._opts),this._storage.onImageAdded=()=>this._onImageAdded.fire(),this._opts.enableSizeReports){let t=e.options.windowOptions??{};t.getWinSizePixels=!0,t.getCellSizePixels=!0,t.getWinSizeChars=!0,e.options.windowOptions=t}if(this._disposeLater(this._renderer,this._storage,e.parser.registerCsiHandler({prefix:"?",final:"h"},t=>this._decset(t)),e.parser.registerCsiHandler({prefix:"?",final:"l"},t=>this._decrst(t)),e.parser.registerCsiHandler({final:"c"},t=>this._da1(t)),e.parser.registerCsiHandler({prefix:"?",final:"S"},t=>this._xtermGraphicsAttributes(t)),e.onRender(t=>this._storage?.render(t)),e.parser.registerCsiHandler({intermediates:"!",final:"p"},()=>this.reset()),e.parser.registerEscHandler({final:"c"},()=>this.reset()),e._core._inputHandler.onRequestReset(()=>this.reset()),e.buffer.onBufferChange(()=>this._storage?.wipeAlternate()),e.onResize(t=>this._storage?.viewportResize(t))),this._opts.sixelSupport){let t=new oe(this._storage,this._opts,this._renderer,e),i=new ae(this._opts,t,e);this._handlers.set("sixel",i),this._disposeLater(e._core._inputHandler._parser.registerDcsHandler({final:"q"},i))}if(this._opts.iipSupport){let t=new he(this._storage),i=new te(this._opts,this._renderer,t,e);this._handlers.set("iip",i),this._disposeLater(e._core._inputHandler._parser.registerOscHandler(1337,i))}if(this._opts.kittySupport){let t=new Ae(this._storage),i=new ie(this._opts,this._renderer,t,e);this._handlers.set("kitty",i),this._disposeLater(t,i,e._core._inputHandler._parser.registerApcHandler({final:"G"},i))}}reset(){this._opts.sixelScrolling=this._defaultOpts.sixelScrolling,this._opts.sixelPaletteLimit=this._defaultOpts.sixelPaletteLimit,this._storage?.reset();for(let e of this._handlers.values())e.reset();return!1}get storageLimit(){return this._storage?.getLimit()||-1}set storageLimit(e){this._storage?.setLimit(e),this._opts.storageLimit=e}get storageUsage(){return this._storage?this._storage.getUsage():-1}get showPlaceholder(){return this._opts.showPlaceholder}set showPlaceholder(e){this._opts.showPlaceholder=e,this._renderer?.showPlaceholder(e)}getImageAtBufferCell(e,t){return this._storage?.getImageAtBufferCell(e,t)}extractTileAtBufferCell(e,t){return this._storage?.extractTileAtBufferCell(e,t)}_report(e){this._terminal?._core.input(e,!1)}_decset(e){for(let t=0;t<e.length;++t)e[t]===80&&(this._opts.sixelScrolling=!1);return!1}_decrst(e){for(let t=0;t<e.length;++t)e[t]===80&&(this._opts.sixelScrolling=!0);return!1}_da1(e){return e[0]?!0:this._opts.sixelSupport?(this._report("\x1B[?62;4;9;22c"),!0):!1}_xtermGraphicsAttributes(e){if(e.length<2)return!0;if(e[0]===1)switch(e[1]){case 1:return this._report(`\x1B[?${e[0]};0;${this._opts.sixelPaletteLimit}S`),!0;case 2:this._opts.sixelPaletteLimit=this._defaultOpts.sixelPaletteLimit,this._report(`\x1B[?${e[0]};0;${this._opts.sixelPaletteLimit}S`);for(let t of this._handlers.values())t.reset();return!0;case 3:return e.length>2&&!(e[2]instanceof Array)&&e[2]<=je?(this._opts.sixelPaletteLimit=e[2],this._report(`\x1B[?${e[0]};0;${this._opts.sixelPaletteLimit}S`)):this._report(`\x1B[?${e[0]};2S`),!0;case 4:return this._report(`\x1B[?${e[0]};0;${je}S`),!0;default:return this._report(`\x1B[?${e[0]};2S`),!0}if(e[0]===2)switch(e[1]){case 1:let t=this._renderer?.dimensions?.css.canvas.width,i=this._renderer?.dimensions?.css.canvas.height;if(!t||!i){let r=w;t=(this._terminal?.cols||80)*r.width,i=(this._terminal?.rows||24)*r.height}if(t*i<this._opts.pixelLimit)this._report(`\x1B[?${e[0]};0;${t.toFixed(0)};${i.toFixed(0)}S`);else{let r=Math.floor(Math.sqrt(this._opts.pixelLimit));this._report(`\x1B[?${e[0]};0;${r};${r}S`)}return!0;case 4:let A=Math.floor(Math.sqrt(this._opts.pixelLimit));return this._report(`\x1B[?${e[0]};0;${A};${A}S`),!0;default:return this._report(`\x1B[?${e[0]};2S`),!0}return this._report(`\x1B[?${e[0]};1S`),!0}};export{Ve as ImageAddon};
++var at=Object.create;var Ne=Object.defineProperty;var ot=Object.getOwnPropertyDescriptor;var ht=Object.getOwnPropertyNames;var dt=Object.getPrototypeOf,gt=Object.prototype.hasOwnProperty;var M=(r,e)=>()=>{try{return e||r((e={exports:{}}).exports,e),e.exports}catch(t){throw e=0,t}};var It=(r,e,t,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let A of ht(e))!gt.call(r,A)&&A!==t&&Ne(r,A,{get:()=>e[A],enumerable:!(i=ot(e,A))||i.enumerable});return r};var x=(r,e,t)=>(t=r!=null?at(dt(r)):{},It(e||!r||!r.__esModule?Ne(t,"default",{value:r,enumerable:!0}):t,r));var j=M(_=>{"use strict";Object.defineProperty(_,"__esModule",{value:!0});_.DEFAULT_FOREGROUND=_.DEFAULT_BACKGROUND=_.PALETTE_ANSI_256=_.PALETTE_VT340_GREY=_.PALETTE_VT340_COLOR=_.normalizeHLS=_.normalizeRGB=_.nearestColorIndex=_.fromRGBA8888=_.toRGBA8888=_.alpha=_.blue=_.green=_.red=_.BIG_ENDIAN=void 0;_.BIG_ENDIAN=new Uint8Array(new Uint32Array([4278190080]).buffer)[0]===255;_.BIG_ENDIAN&&console.warn("BE platform detected. This version of node-sixel works only on LE properly.");function He(r){return r&255}_.red=He;function Fe(r){return r>>>8&255}_.green=Fe;function Ge(r){return r>>>16&255}_.blue=Ge;function ct(r){return r>>>24&255}_.alpha=ct;function f(r,e,t,i=255){return((i&255)<<24|(t&255)<<16|(e&255)<<8|r&255)>>>0}_.toRGBA8888=f;function mt(r){return[r&255,r>>8&255,r>>16&255,r>>>24]}_.fromRGBA8888=mt;function _t(r,e){let t=He(r),i=Fe(r),A=Ge(r),s=Number.MAX_SAFE_INTEGER,n=-1;for(let a=0;a<e.length;++a){let o=t-e[a][0],h=i-e[a][1],d=A-e[a][2],g=o*o+h*h+d*d;if(!g)return a;g<s&&(s=g,n=a)}return n}_.nearestColorIndex=_t;function ce(r,e,t){return Math.max(r,Math.min(t,e))}function me(r,e,t){return t<0&&(t+=1),t>1&&(t-=1),t*6<1?e+(r-e)*6*t:t*2<1?r:t*3<2?e+(r-e)*(4-t*6):e}function ut(r,e,t){if(!t){let s=Math.round(e*255);return f(s,s,s)}let i=e<.5?e*(1+t):e+t-e*t,A=2*e-i;return f(ce(0,255,Math.round(me(i,A,r+1/3)*255)),ce(0,255,Math.round(me(i,A,r)*255)),ce(0,255,Math.round(me(i,A,r-1/3)*255)))}function m(r,e,t){return(4278190080|Math.round(t/100*255)<<16|Math.round(e/100*255)<<8|Math.round(r/100*255))>>>0}_.normalizeRGB=m;function Et(r,e,t){return ut((r+240%360)/360,e/100,t/100)}_.normalizeHLS=Et;_.PALETTE_VT340_COLOR=new Uint32Array([m(0,0,0),m(20,20,80),m(80,13,13),m(20,80,20),m(80,20,80),m(20,80,80),m(80,80,20),m(53,53,53),m(26,26,26),m(33,33,60),m(60,26,26),m(33,60,33),m(60,33,60),m(33,60,60),m(60,60,33),m(80,80,80)]);_.PALETTE_VT340_GREY=new Uint32Array([m(0,0,0),m(13,13,13),m(26,26,26),m(40,40,40),m(6,6,6),m(20,20,20),m(33,33,33),m(46,46,46),m(0,0,0),m(13,13,13),m(26,26,26),m(40,40,40),m(6,6,6),m(20,20,20),m(33,33,33),m(46,46,46)]);_.PALETTE_ANSI_256=(()=>{let r=[f(0,0,0),f(205,0,0),f(0,205,0),f(205,205,0),f(0,0,238),f(205,0,205),f(0,250,205),f(229,229,229),f(127,127,127),f(255,0,0),f(0,255,0),f(255,255,0),f(92,92,255),f(255,0,255),f(0,255,255),f(255,255,255)],e=[0,95,135,175,215,255];for(let t=0;t<6;++t)for(let i=0;i<6;++i)for(let A=0;A<6;++A)r.push(f(e[t],e[i],e[A]));for(let t=8;t<=238;t+=10)r.push(f(t,t,t));return new Uint32Array(r)})();_.DEFAULT_BACKGROUND=f(0,0,0,255);_.DEFAULT_FOREGROUND=f(255,255,255,255)});var Ee=M(ue=>{"use strict";Object.defineProperty(ue,"__esModule",{value:!0});ue.InWasm=Dt;var v=r=>{if(Uint8Array.fromBase64)return Uint8Array.fromBase64(r);if(typeof Buffer<"u")return Buffer.from(r,"base64");let e=atob(r),t=new Uint8Array(e.length);for(let i=0;i<t.length;++i)t[i]=e.charCodeAt(i);return t};function Dt(r){if(r.d){let{t:e,s:t,d:i}=r,A,s,n=WebAssembly;return e===0?t?a=>new n.Instance(s||(s=new n.Module(A||(A=v(i)))),a):a=>s?n.instantiate(s,a):n.instantiate(A||(A=v(i)),a).then(o=>(s=o.module)&&o.instance):e===1?t?()=>s||(s=new n.Module(A||(A=v(i)))):()=>s?Promise.resolve(s):n.compile(A||(A=v(i))).then(a=>s=a):t?()=>A||(A=v(i)):()=>Promise.resolve(A||(A=v(i)))}if(typeof _wasmCtx>"u")throw new Error('must run "inwasm"');_wasmCtx.add(r)}});var Be=M(pe=>{"use strict";Object.defineProperty(pe,"__esModule",{value:!0});var wt=Ee(),bt=(0,wt.InWasm)({s:1,t:0,d:"AGFzbQEAAAABBQFgAAF/Ag8BA2VudgZtZW1vcnkCAAEDAwIAAAcNAgNkZWMAAANlbmQAAQqLBgKZBAEKf0GIKCgCAEGgKGohAUGEKCgCACIDQaAoaiEAQYAoKAIAQQFrQXxxIgRBoChqIQUgBEEQayADSgRAIARBkChqIQMDQCABIABBA2otAABBAnQoAoAgIABBAmotAABBAnQoAoAYIABBAWotAABBAnQoAoAQIAAtAABBAnQoAoAIcnJyIgY2AgAgAUEDaiAAQQdqLQAAQQJ0KAKAICAAQQZqLQAAQQJ0KAKAGCAAQQVqLQAAQQJ0KAKAECAAQQRqLQAAQQJ0KAKACHJyciIHNgIAIAFBBmogAEELai0AAEECdCgCgCAgAEEKai0AAEECdCgCgBggAEEJai0AAEECdCgCgBAgAEEIai0AAEECdCgCgAhycnIiCDYCACABQQlqIABBD2otAABBAnQoAoAgIABBDmotAABBAnQoAoAYIABBDWotAABBAnQoAoAQIABBDGotAABBAnQoAoAIcnJyIgk2AgAgAiAGciAHciAIciAJciECIAFBDGohASAAQRBqIgAgA0kNAAsLIAAgBUkEQANAIAEgAEEDai0AAEECdCgCgCAgAEECai0AAEECdCgCgBggAEEBai0AAEECdCgCgBAgAC0AAEECdCgCgAhycnIiAzYCACACIANyIQIgAUEDaiEBIABBBGoiACAFSQ0ACwtBfyEAIAJB////B00Ef0GEKCAENgIAQYgoIAFBoChrNgIAQQAFQX8LC+0BAQR/AkBBgCgoAgAiAUGEKCgCACIAa0EFTgRAQX8hAxAADQFBgCgoAgAhAUGEKCgCACEAC0F/IQMgASAAayIBQQJIDQAgAC0AoShBAnQoAoAQIAAtAKAoQQJ0KAKACHIhAgJ/IAFBBEYEQEEDQQQgAC0AoyhBPUYbIAAtAKIoQT1GayEBC0EBIAFBA0kNABogAC0AoihBAnQoAoAYIAJyIQJBAiABQQRHDQAaIAAtAKMoQQJ0KAKAICACciECQQMLIQEgAkH///8HSw0AQQAhA0GIKCgCACIAIAI2AKAoQYgoIAAgAWo2AgALIAML"}),S=new Uint8Array("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".split("").map(r=>r.charCodeAt(0))),R=new Uint32Array(1024);R.fill(4278190080);for(let r=0;r<S.length;++r)R[S[r]]=r<<2;for(let r=0;r<S.length;++r)R[256+S[r]]=r>>4|(r<<4&255)<<8;for(let r=0;r<S.length;++r)R[512+S[r]]=r>>2<<8|(r<<6&255)<<16;for(let r=0;r<S.length;++r)R[768+S[r]]=r<<16;var yt=new Uint8Array(0),Ce=class{constructor(e,t,i){if(this._inst=null,this._ended=!0,this._bytes=0,this.keepSize=e??1048576,this.maxBytes=t??4294901760,this._bytes=i??32768,this._bytes>this.maxBytes||this.maxBytes>4294901760)throw new Error("invalid byte settings")}get data8(){return this._inst?this._d.subarray(0,this._m32[1282]):yt}release(){this._inst&&(this._bytes>this.keepSize?this._inst=this._m32=this._d=this._mem=null:(this._m32[1280]=0,this._m32[1281]=0,this._m32[1282]=0))}init(e,t){if(this.maxBytes=e??this.maxBytes,this._bytes=t??Math.min(this._bytes,this.maxBytes),this._bytes>this.maxBytes||this.maxBytes>4294901760)throw Error("invalid byte settings");let i=this._m32,A=this._bytes+5152;this._inst?this._mem.buffer.byteLength<A&&(this._mem.grow(Math.ceil((A-this._mem.buffer.byteLength)/65536)),i=new Uint32Array(this._mem.buffer,0),this._d=new Uint8Array(this._mem.buffer,5152)):(this._mem=new WebAssembly.Memory({initial:Math.ceil(A/65536)}),this._inst=bt({env:{memory:this._mem}}),i=new Uint32Array(this._mem.buffer,0),i.set(R,256),this._d=new Uint8Array(this._mem.buffer,5152)),i[1280]=0,i[1281]=0,i[1282]=0,this._m32=i,this._ended=!1}_realloc(e){let t=this._m32[1280]+e;if(this._bytes<t){if(t>this.maxBytes)return-3;let i=this._bytes;for(;(i*=2)<t;);if(i=Math.min(i,this.maxBytes),i<t)return-3;if(i+5152>this._mem.buffer.byteLength){let A=Math.ceil((i+5152-this._mem.buffer.byteLength)/65536);this._mem.grow(A),this._m32=new Uint32Array(this._mem.buffer,0),this._d=new Uint8Array(this._mem.buffer,5152)}this._bytes=i}return 0}put(e){if(!this._inst||this._ended)return-2;if(this._realloc(e.length))return-3;let t=this._m32;return this._d.set(e,t[1280]),t[1280]+=e.length,t[1280]-t[1281]>=131072?this._inst.exports.dec():0}end(){return this._ended=!0,this._inst?this._inst.exports.end():-2}get loadedBytes(){return this._inst?this._m32[1280]:0}get freeBytes(){return this._inst?this.maxBytes-this._m32[1280]:0}};pe.default=Ce});var Ue=M(Qe=>{"use strict";Object.defineProperty(Qe,"__esModule",{value:!0});var St=Ee(),Lt=(0,St.InWasm)({s:1,t:0,d:"AGFzbQEAAAABCgJgAABgA39/fwACDwEDZW52Bm1lbW9yeQIAAQMDAgABBwcBA2RlYwABCAEACu4EAgwAQQBBAEGAAvwLAAveBAEJf0EAQQBBgAL8CwAgAUEXTgRAIAAgAWpBCGshCkGACCEBIAJBAnRBgAhqIQsgAEEOaiEDQf8BIQZBACECA0AgA0EBaiEHIAMtAAAiCEE/cSEAAkACQCAIQcABcSIJRQRAIABBAnQiAC0AAyEGIAAtAAIhBCAALQABIQUgAC0AACECIAchAwwBCwJAIAhB/QFLDQAgCUHAAUcNACAFQQVsIAJBA2xqIARBB2xqIAZBC2xqQT9xQQJ0IgMgBDoAAiADIAU6AAEgAyACOgAAIANBA2ogBjoAAANAIAEgAjoAACABQQNqIAY6AAAgAUECaiAEOgAAIAFBAWogBToAACABQQRqIQEgAEUEQCAHIQMMBAsgAEEBayEAIAEgC0kNAAsgByEDDAILAn8CQAJAAkAgCEH+AWsOAgABAgsgAy0AAyEEIAMtAAIhBSADLQABIQIgA0EEagwCCyADKAIBIgJBGHYhBiACQRB2IQQgAkEIdiEFIANBBWoMAQsgCUGAAUcEQCAHIAlBwABHDQEaIAQgCEEDcWpBAmshBCACIABBBHZqQQJrIQIgBSAIQQJ2QQNxakECayEFIAcMAQsgBCAAQShrIgkgAy0AASIHQQ9xamohBCACIAdBBHYgCWpqIQIgACAFakEgayEFIANBAmoLIQMgBUEFbCACQQNsaiAEQQdsaiAGQQtsakE/cUECdCIAIAQ6AAIgACAFOgABIAAgAjoAACAAQQNqIAY6AAALIAEgBjoAAyABIAQ6AAIgASAFOgABIAEgAjoAACABQQRqIQELIAMgCkkNAAsLCw=="}),fe=class{constructor(e){this.keepSize=e,this.width=0,this.height=0}decode(e){this.width=e[4]<<24|e[5]<<16|e[6]<<8|e[7],this.height=e[8]<<24|e[9]<<16|e[10]<<8|e[11];let t=this.width*this.height,i=t*4,A=e.length,s=Math.max(i,A)+(Math.min(i,A)>>1)+4096;this._inst?this._mem.buffer.byteLength<s&&(this._mem.grow(Math.ceil((s-this._mem.buffer.byteLength)/65536)),this._d=null):(this._mem=new WebAssembly.Memory({initial:Math.ceil(s/65536)}),this._inst=Lt({env:{memory:this._mem}})),this._d||(this._d=new Uint8Array(this._mem.buffer));let n=this._mem.buffer.byteLength-A&-256;return this._d.set(e,n),this._inst.exports.dec(n,A,t),this._d.subarray(1024,1024+i)}release(){this._inst&&this._mem.buffer.byteLength>this.keepSize&&(this._inst=this._d=this._mem=null)}};Qe.default=fe});var xe=M(se=>{"use strict";Object.defineProperty(se,"__esModule",{value:!0});se.LIMITS=void 0;se.LIMITS={CHUNK_SIZE:16384,PALETTE_SIZE:4096,MAX_WIDTH:16384,BYTES:"AGFzbQEAAAABJAdgAAF/YAJ/fwBgA39/fwF/YAF/AX9gAABgBH9/f38AYAF/AAIlAgNlbnYLaGFuZGxlX2JhbmQAAwNlbnYLbW9kZV9wYXJzZWQAAwMTEgQAAAAAAQQBAQUBAAACAgAGAwQFAXABBwcFBAEBBwcGCAF/AUGAihoLB9wBDgZtZW1vcnkCABFnZXRfc3RhdGVfYWRkcmVzcwADEWdldF9jaHVua19hZGRyZXNzAAQOZ2V0X3AwX2FkZHJlc3MABRNnZXRfcGFsZXR0ZV9hZGRyZXNzAAYEaW5pdAALBmRlY29kZQAMDWN1cnJlbnRfd2lkdGgADQ5jdXJyZW50X2hlaWdodAAOGV9faW5kaXJlY3RfZnVuY3Rpb25fdGFibGUBAAtfaW5pdGlhbGl6ZQACCXN0YWNrU2F2ZQARDHN0YWNrUmVzdG9yZQASCnN0YWNrQWxsb2MAEwkMAQBBAQsGCgcJDxACDAEBCq5UEgMAAQsFAEGgCAsGAEGQiQELBgBBsIkCCwUAQZAJC+okAQh/QeQIKAIAIQVB4AgoAgAhA0HoCCgCACEIIAFBkIkBaiIJQf8BOgAAIAAgAUgEQCAAQZCJAWohBgNAIAMhBCAGQQFqIQECQCAGLQAAQf8AcSIDQTBrQQlLBEAgASEGDAELQewIKAIAQQJ0QewIaiICKAIAIQADQCACIAMgAEEKbGpBMGsiADYCACABLQAAIQMgAUEBaiIGIQEgA0H/AHEiA0Ewa0EKSQ0ACwsCQAJAAkACQAJAAkACQAJ/AkACQCADQT9rIgBBP00EQCAERQ0BIARBIUYEQAJAQfAIKAIAIgFBASABGyIHIAhqIgFB1AgoAgAiA0gNACADQf//AEoNAANAIANBAnQiAkGgiQJqIgRBoAgpAwA3AwAgAkGoiQJqQaAIKQMANwMAIAJBsIkCakGgCCkDADcDACACQbiJAmpBoAgpAwA3AwAgAkHAiQJqQaAIKQMANwMAIAJByIkCakGgCCkDADcDACACQdCJAmpBoAgpAwA3AwAgAkHYiQJqQaAIKQMANwMAIAJB4IkCakGgCCkDADcDACACQeiJAmpBoAgpAwA3AwAgAkHwiQJqQaAIKQMANwMAIAJB+IkCakGgCCkDADcDACACQYCKAmpBoAgpAwA3AwAgAkGIigJqQaAIKQMANwMAIAJBkIoCakGgCCkDADcDACACQZiKAmpBoAgpAwA3AwAgAkGgigJqQaAIKQMANwMAIAJBqIoCakGgCCkDADcDACACQbCKAmpBoAgpAwA3AwAgAkG4igJqQaAIKQMANwMAIAJBwIoCakGgCCkDADcDACACQciKAmpBoAgpAwA3AwAgAkHQigJqQaAIKQMANwMAIAJB2IoCakGgCCkDADcDACACQeCKAmpBoAgpAwA3AwAgAkHoigJqQaAIKQMANwMAIAJB8IoCakGgCCkDADcDACACQfiKAmpBoAgpAwA3AwAgAkGAiwJqQaAIKQMANwMAIAJBiIsCakGgCCkDADcDACACQZCLAmpBoAgpAwA3AwAgAkGYiwJqQaAIKQMANwMAIAJBoIsCakGgCCkDADcDACACQaiLAmpBoAgpAwA3AwAgAkGwiwJqQaAIKQMANwMAIAJBuIsCakGgCCkDADcDACACQcCLAmpBoAgpAwA3AwAgAkHIiwJqQaAIKQMANwMAIAJB0IsCakGgCCkDADcDACACQdiLAmpBoAgpAwA3AwAgAkHgiwJqQaAIKQMANwMAIAJB6IsCakGgCCkDADcDACACQfCLAmpBoAgpAwA3AwAgAkH4iwJqQaAIKQMANwMAIAJBgIwCakGgCCkDADcDACACQYiMAmpBoAgpAwA3AwAgAkGQjAJqQaAIKQMANwMAIAJBmIwCakGgCCkDADcDACACQaCMAmpBoAgpAwA3AwAgAkGojAJqQaAIKQMANwMAIAJBsIwCakGgCCkDADcDACACQbiMAmpBoAgpAwA3AwAgAkHAjAJqQaAIKQMANwMAIAJByIwCakGgCCkDADcDACACQdCMAmpBoAgpAwA3AwAgAkHYjAJqQaAIKQMANwMAIAJB4IwCakGgCCkDADcDACACQeiMAmpBoAgpAwA3AwAgAkHwjAJqQaAIKQMANwMAIAJB+IwCakGgCCkDADcDACACQYCNAmpBoAgpAwA3AwAgAkGIjQJqQaAIKQMANwMAIAJBkI0CakGgCCkDADcDACACQZiNAmpBoAgpAwA3AwAgAkGwiQZqIARBgAT8CgAAQdQIKAIAQQJ0QcCJCmogBEGABPwKAABB1AgoAgBBAnRB0IkOaiAEQYAE/AoAAEHUCCgCAEECdEHgiRJqIARBgAT8CgAAQdQIKAIAQQJ0QfCJFmogBEGABPwKAABB1AhB1AgoAgAiAkGAAWoiAzYCACABIANIDQEgAkGA/wBIDQALCwJAIABFDQAgCEH//wBLDQBBgIABIAhrIAcgAUH//wBLGyECAkAgAEEBcUUNACACRQ0AIAhBAnRBoIkCaiEDIAIhBCACQQdxIgcEQANAIAMgBTYCACADQQRqIQMgBEEBayEEIAdBAWsiBw0ACwsgAkEBa0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgBEEIayIEDQALCwJAIABBAnFFDQAgAkUNACAIQQJ0QbCJBmohAyACIQQgAkEHcSIHBEADQCADIAU2AgAgA0EEaiEDIARBAWshBCAHQQFrIgcNAAsLIAJBAWtBB0kNAANAIAMgBTYCHCADIAU2AhggAyAFNgIUIAMgBTYCECADIAU2AgwgAyAFNgIIIAMgBTYCBCADIAU2AgAgA0EgaiEDIARBCGsiBA0ACwsCQCAAQQRxRQ0AIAJFDQAgCEECdEHAiQpqIQMgAiEEIAJBB3EiBwRAA0AgAyAFNgIAIANBBGohAyAEQQFrIQQgB0EBayIHDQALCyACQQFrQQdJDQADQCADIAU2AhwgAyAFNgIYIAMgBTYCFCADIAU2AhAgAyAFNgIMIAMgBTYCCCADIAU2AgQgAyAFNgIAIANBIGohAyAEQQhrIgQNAAsLAkAgAEEIcUUNACACRQ0AIAhBAnRB0IkOaiEDIAIhBCACQQdxIgcEQANAIAMgBTYCACADQQRqIQMgBEEBayEEIAdBAWsiBw0ACwsgAkEBa0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgBEEIayIEDQALCwJAIABBEHFFDQAgAkUNACAIQQJ0QeCJEmohAyACIQQgAkEHcSIHBEADQCADIAU2AgAgA0EEaiEDIARBAWshBCAHQQFrIgcNAAsLIAJBAWtBB0kNAANAIAMgBTYCHCADIAU2AhggAyAFNgIUIAMgBTYCECADIAU2AgwgAyAFNgIIIAMgBTYCBCADIAU2AgAgA0EgaiEDIARBCGsiBA0ACwsgAEEgcUUNACACRQ0AIAJBAWshByAIQQJ0QfCJFmohAyACQQdxIgQEQANAIAMgBTYCACADQQRqIQMgAkEBayECIARBAWsiBA0ACwsgB0EHSQ0AA0AgAyAFNgIcIAMgBTYCGCADIAU2AhQgAyAFNgIQIAMgBTYCDCADIAU2AgggAyAFNgIEIAMgBTYCACADQSBqIQMgAkEIayICDQALC0HcCEHcCCgCACAAcjYCACAGQQFqIgIgBi0AAEH/AHEiA0E/ayIAQT9LDQQaDAMLAkBB7AgoAgAiBEEBRgRAQfAIKAIAIgNBzAgoAgAiAUkNASADIAFwIQMMAQtB+AgoAgAhAkH0CCgCACEBAkACQCAEQQVHDQAgAUEBRw0AIAJB6QJODQQMAQsgAkHkAEoNA0H8CCgCAEHkAEoNA0GACSgCAEHkAEoNAwsCQCABRQ0AIAFBAkoNACACQfwIKAIAQYAJKAIAIAFBAnRBiAhqKAIAEQIAIQFB8AgoAgAiA0HMCCgCACICTwR/IAMgAnAFIAMLQQJ0QZAJaiABNgIAC0HwCCgCACIDQcwIKAIAIgFJDQAgAyABcCEDCyADQQJ0QZAJaigCACEFDAELIANB/QBxQSFHBEAgCCEBIAYhAgwECyAEQSNHDQQCQEHsCCgCACICQQFGBEBB8AgoAgAiAUHMCCgCACIASQ0BIAEgAHAhAQwBC0H4CCgCACEBQfQIKAIAIQACQAJAIAJBBUcNACAAQQFHDQAgAUHpAkgNAQwHCyABQeQASg0GQfwIKAIAQeQASg0GQYAJKAIAQeQASg0GCwJAIABFDQAgAEECSg0AIAFB/AgoAgBBgAkoAgAgAEECdEGICGooAgARAgAhAEHwCCgCACIBQcwIKAIAIgJPBH8gASACcAUgAQtBAnRBkAlqIAA2AgALQfAIKAIAIgFBzAgoAgAiAEkNACABIABwIQELIAFBAnRBkAlqKAIAIQUMBAsgCCEBIAYhAgtB1AgoAgAhBgNAAkAgASAGSA0AIAZB//8ASg0AIAZBAnQiBEGgiQJqIgZBoAgpAwA3AwAgBEGoiQJqQaAIKQMANwMAIARBsIkCakGgCCkDADcDACAEQbiJAmpBoAgpAwA3AwAgBEHAiQJqQaAIKQMANwMAIARByIkCakGgCCkDADcDACAEQdCJAmpBoAgpAwA3AwAgBEHYiQJqQaAIKQMANwMAIARB4IkCakGgCCkDADcDACAEQeiJAmpBoAgpAwA3AwAgBEHwiQJqQaAIKQMANwMAIARB+IkCakGgCCkDADcDACAEQYCKAmpBoAgpAwA3AwAgBEGIigJqQaAIKQMANwMAIARBkIoCakGgCCkDADcDACAEQZiKAmpBoAgpAwA3AwAgBEGgigJqQaAIKQMANwMAIARBqIoCakGgCCkDADcDACAEQbCKAmpBoAgpAwA3AwAgBEG4igJqQaAIKQMANwMAIARBwIoCakGgCCkDADcDACAEQciKAmpBoAgpAwA3AwAgBEHQigJqQaAIKQMANwMAIARB2IoCakGgCCkDADcDACAEQeCKAmpBoAgpAwA3AwAgBEHoigJqQaAIKQMANwMAIARB8IoCakGgCCkDADcDACAEQfiKAmpBoAgpAwA3AwAgBEGAiwJqQaAIKQMANwMAIARBiIsCakGgCCkDADcDACAEQZCLAmpBoAgpAwA3AwAgBEGYiwJqQaAIKQMANwMAIARBoIsCakGgCCkDADcDACAEQaiLAmpBoAgpAwA3AwAgBEGwiwJqQaAIKQMANwMAIARBuIsCakGgCCkDADcDACAEQcCLAmpBoAgpAwA3AwAgBEHIiwJqQaAIKQMANwMAIARB0IsCakGgCCkDADcDACAEQdiLAmpBoAgpAwA3AwAgBEHgiwJqQaAIKQMANwMAIARB6IsCakGgCCkDADcDACAEQfCLAmpBoAgpAwA3AwAgBEH4iwJqQaAIKQMANwMAIARBgIwCakGgCCkDADcDACAEQYiMAmpBoAgpAwA3AwAgBEGQjAJqQaAIKQMANwMAIARBmIwCakGgCCkDADcDACAEQaCMAmpBoAgpAwA3AwAgBEGojAJqQaAIKQMANwMAIARBsIwCakGgCCkDADcDACAEQbiMAmpBoAgpAwA3AwAgBEHAjAJqQaAIKQMANwMAIARByIwCakGgCCkDADcDACAEQdCMAmpBoAgpAwA3AwAgBEHYjAJqQaAIKQMANwMAIARB4IwCakGgCCkDADcDACAEQeiMAmpBoAgpAwA3AwAgBEHwjAJqQaAIKQMANwMAIARB+IwCakGgCCkDADcDACAEQYCNAmpBoAgpAwA3AwAgBEGIjQJqQaAIKQMANwMAIARBkI0CakGgCCkDADcDACAEQZiNAmpBoAgpAwA3AwAgBEGwiQZqIAZBgAT8CgAAQdQIKAIAQQJ0QcCJCmogBkGABPwKAABB1AgoAgBBAnRB0IkOaiAGQYAE/AoAAEHUCCgCAEECdEHgiRJqIAZBgAT8CgAAQdQIKAIAQQJ0QfCJFmogBkGABPwKAABB1AhB1AgoAgBBgAFqIgY2AgALIAFB//8ATQRAIABBAXEgAWxBAnRBoIkCaiAFNgIAIABBAXZBAXEgAWxBAnRBsIkGaiAFNgIAIABBAnZBAXEgAWxBAnRBwIkKaiAFNgIAIABBA3ZBAXEgAWxBAnRB0IkOaiAFNgIAIABBBHZBAXEgAWxBAnRB4IkSaiAFNgIAIABBBXYgAWxBAnRB8IkWaiAFNgIAQdQIKAIAIQYLIAFBAWohAUHcCEHcCCgCACAAcjYCACACLQAAIQAgAkEBaiIEIQIgAEH/AHEiA0E/ayIAQcAASQ0ACyAECyECQQAhBCACIQYgASEIIANB/QBxQSFGDQELIANBJGsOCgEDAwMDAwMDAwIDC0HsCEIBNwIADAQLQdgIIAFB2AgoAgAiACAAIAFIGyIAQYCAASAAQYCAAUgbNgIADAILQegIIAFB2AgoAgAiACAAIAFIGyIAQYCAASAAQYCAAUgbIgA2AgBB2AggADYCACAAQQRrEAAEQEHoCEEENgIAQdgIQQQ2AgBB0AhBATYCAA8LEAgMAQsCQCADQTtHDQBB7AgoAgAiAEEHSg0AQewIIABBAWo2AgAgAEECdEHwCGpBADYCAAsgAiEGIAQhAyABIQgMAQtBBCEIIAIhBiAEIQMLIAYgCUkNAAsLQeQIIAU2AgBB4AggAzYCAEHoCCAINgIAC9ELAgF+CH9B2AhCBDcDAEGojQJBoAgpAwAiADcDAEGgjQIgADcDAEGYjQIgADcDAEGQjQIgADcDAEGIjQIgADcDAEGAjQIgADcDAEH4jAIgADcDAEHwjAIgADcDAEHojAIgADcDAEHgjAIgADcDAEHYjAIgADcDAEHQjAIgADcDAEHIjAIgADcDAEHAjAIgADcDAEG4jAIgADcDAEGwjAIgADcDAEGojAIgADcDAEGgjAIgADcDAEGYjAIgADcDAEGQjAIgADcDAEGIjAIgADcDAEGAjAIgADcDAEH4iwIgADcDAEHwiwIgADcDAEHoiwIgADcDAEHgiwIgADcDAEHYiwIgADcDAEHQiwIgADcDAEHIiwIgADcDAEHAiwIgADcDAEG4iwIgADcDAEGwiwIgADcDAEGoiwIgADcDAEGgiwIgADcDAEGYiwIgADcDAEGQiwIgADcDAEGIiwIgADcDAEGAiwIgADcDAEH4igIgADcDAEHwigIgADcDAEHoigIgADcDAEHgigIgADcDAEHYigIgADcDAEHQigIgADcDAEHIigIgADcDAEHAigIgADcDAEG4igIgADcDAEGwigIgADcDAEGoigIgADcDAEGgigIgADcDAEGYigIgADcDAEGQigIgADcDAEGIigIgADcDAEGAigIgADcDAEH4iQIgADcDAEHwiQIgADcDAEHoiQIgADcDAEHgiQIgADcDAEHYiQIgADcDAEHQiQIgADcDAEHIiQIgADcDAEHAiQIgADcDAEG4iQIgADcDAEGwiQIgADcDAEGoCCgCACIEQf8AakGAAW0hCAJAIARBgQFIDQBBASEBIAhBAiAIQQJKG0EBayICQQFxIQMgBEGBAk4EQCACQX5xIQIDQCABQQl0IgdBEHJBoIkCakGwiQJBgAT8CgAAIAdBsI0CakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsLIANFDQAgAUEJdEEQckGgiQJqQbCJAkGABPwKAAALAkAgBEEBSA0AIAhBASAIQQFKGyIDQQFxIQUCQCADQQFrIgdFBEBBACEBDAELIANB/v///wdxIQJBACEBA0AgAUEJdCIGQRByQbCJBmpBsIkCQYAE/AoAACAGQZAEckGwiQZqQbCJAkGABPwKAAAgAUECaiEBIAJBAmsiAg0ACwsgBQRAIAFBCXRBEHJBsIkGakGwiQJBgAT8CgAACyAEQQFIDQAgA0EBcSEFIAcEfyADQf7///8HcSECQQAhAQNAIAFBCXQiBkEQckHAiQpqQbCJAkGABPwKAAAgBkGQBHJBwIkKakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsgAUEHdEEEcgVBBAshASAFBEAgAUECdEHAiQpqQbCJAkGABPwKAAALIARBAUgNACADQQFxIQUgBwR/IANB/v///wdxIQJBACEBA0AgAUEJdCIGQRByQdCJDmpBsIkCQYAE/AoAACAGQZAEckHQiQ5qQbCJAkGABPwKAAAgAUECaiEBIAJBAmsiAg0ACyABQQd0QQRyBUEECyEBIAUEQCABQQJ0QdCJDmpBsIkCQYAE/AoAAAsgBEEBSA0AIANBAXEhBSAHBH8gA0H+////B3EhAkEAIQEDQCABQQl0IgZBEHJB4IkSakGwiQJBgAT8CgAAIAZBkARyQeCJEmpBsIkCQYAE/AoAACABQQJqIQEgAkECayICDQALIAFBB3RBBHIFQQQLIQEgBQRAIAFBAnRB4IkSakGwiQJBgAT8CgAACyAEQQFIDQAgA0EBcSEEIAcEfyADQf7///8HcSECQQAhAQNAIAFBCXQiA0EQckHwiRZqQbCJAkGABPwKAAAgA0GQBHJB8IkWakGwiQJBgAT8CgAAIAFBAmohASACQQJrIgINAAsgAUEHdEEEcgVBBAshASAERQ0AIAFBAnRB8IkWakGwiQJBgAT8CgAAC0HUCCAIQQd0QQRyNgIAC58TAgh/AX5B5AgoAgAhA0HgCCgCACECQegIKAIAIQcgAUGQiQFqIglB/wE6AAAgACABSARAIABBkIkBaiEIA0AgAiEEIAhBAWohAQJAIAgtAABB/wBxIgJBMGtBCUsEQCABIQgMAQtB7AgoAgBBAnRB7AhqIgUoAgAhAANAIAUgAiAAQQpsakEwayIANgIAIAEtAAAhAiABQQFqIgghASACQf8AcSICQTBrQQpJDQALCwJAAkACQAJAAkACQAJ/AkAgAkE/ayIAQT9NBEAgBEUNASAEQSFGBEBB8AgoAgAiAUEBIAEbIgQgB2ohAQJAIABFDQAgB0H//wBLDQBBgIABIAdrIAQgAUH//wBLGyEFAkAgAEEBcUUNACAHQQJ0QaCJAmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEECcUUNACAHQQJ0QbCJBmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEEcUUNACAHQQJ0QcCJCmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEIcUUNACAHQQJ0QdCJDmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLAkAgAEEQcUUNACAHQQJ0QeCJEmohAiAFIgRBB3EiBgRAA0AgAiADNgIAIAJBBGohAiAEQQFrIQQgBkEBayIGDQALCyAFQQFrQQdJDQADQCACIAM2AhwgAiADNgIYIAIgAzYCFCACIAM2AhAgAiADNgIMIAIgAzYCCCACIAM2AgQgAiADNgIAIAJBIGohAiAEQQhrIgQNAAsLIABBIHFFDQAgBUEBayEEIAdBAnRB8IkWaiEAIAVBB3EiAgRAA0AgACADNgIAIABBBGohACAFQQFrIQUgAkEBayICDQALCyAEQQdJDQADQCAAIAM2AhwgACADNgIYIAAgAzYCFCAAIAM2AhAgACADNgIMIAAgAzYCCCAAIAM2AgQgACADNgIAIABBIGohACAFQQhrIgUNAAsLIAhBAWoiBSAILQAAQf8AcSICQT9rIgBBP00NAxoMBAsCQEHsCCgCACIFQQFGBEBB8AgoAgAiAUHMCCgCACIESQ0BIAEgBHAhAQwBC0H4CCgCACEEQfQIKAIAIQECQAJAIAVBBUcNACABQQFHDQAgBEHpAk4NBAwBCyAEQeQASg0DQfwIKAIAQeQASg0DQYAJKAIAQeQASg0DCwJAIAFFDQAgAUECSg0AIARB/AgoAgBBgAkoAgAgAUECdEGICGooAgARAgAhBEHwCCgCACIBQcwIKAIAIgVPBH8gASAFcAUgAQtBAnRBkAlqIAQ2AgALQfAIKAIAIgFBzAgoAgAiBEkNACABIARwIQELIAFBAnRBkAlqKAIAIQMMAQsgAkH9AHFBIUcEQCAHIQEgAiEADAQLIARBI0cNBAJAQewIKAIAIgRBAUYEQEHwCCgCACIBQcwIKAIAIgBJDQEgASAAcCEBDAELQfgIKAIAIQFB9AgoAgAhAAJAAkAgBEEFRw0AIABBAUcNACABQekCSA0BDAcLIAFB5ABKDQZB/AgoAgBB5ABKDQZBgAkoAgBB5ABKDQYLAkAgAEUNACAAQQJKDQAgAUH8CCgCAEGACSgCACAAQQJ0QYgIaigCABECACEAQfAIKAIAIgFBzAgoAgAiBE8EfyABIARwBSABC0ECdEGQCWogADYCAAtB8AgoAgAiAUHMCCgCACIASQ0AIAEgAHAhAQsgAUECdEGQCWooAgAhAwwECyAHIQEgCAshBQNAIAFB//8ATQRAIABBAXEgAWxBAnRBoIkCaiADNgIAIABBAXZBAXEgAWxBAnRBsIkGaiADNgIAIABBAnZBAXEgAWxBAnRBwIkKaiADNgIAIABBA3ZBAXEgAWxBAnRB0IkOaiADNgIAIABBBHZBAXEgAWxBAnRB4IkSaiADNgIAIABBBXYgAWxBAnRB8IkWaiADNgIACyABQQFqIQEgBS0AACEAIAVBAWoiBCEFIABB/wBxIgJBP2siAEHAAEkNAAsgBCEFC0EAIQQgBSEIIAEhByACIQAgAkH9AHFBIUYNAQtBBCEHIAQhAiAAQSRrDgoDAgICAgICAgIBAgtB7AhCATcCAAwCC0GoCCgCAEEEaxAABEBB0AhBATYCAA8LAkBBqAgoAgAiBkEFSA0AQaAIKQMAIQogBkEDa0EBdiIBQQdxIQJBACEAIAFBAWtBB08EQCABQfj///8HcSEFA0AgAEEDdCIBQbCJAmogCjcDACABQQhyQbCJAmogCjcDACABQRByQbCJAmogCjcDACABQRhyQbCJAmogCjcDACABQSByQbCJAmogCjcDACABQShyQbCJAmogCjcDACABQTByQbCJAmogCjcDACABQThyQbCJAmogCjcDACAAQQhqIQAgBUEIayIFDQALCyACRQ0AA0AgAEEDdEGwiQJqIAo3AwAgAEEBaiEAIAJBAWsiAg0ACwtBwIkGQbCJAiAGQQJ0IgD8CgAAQdCJCkGwiQIgAPwKAABB4IkOQbCJAiAA/AoAAEHwiRJBsIkCIAD8CgAAQYCKFkGwiQIgAPwKAAAgBCECDAELAkAgAEE7Rw0AQewIKAIAIgBBB0oNAEHsCCAAQQFqNgIAIABBAnRB8AhqQQA2AgALIAEhBwsgCCAJSQ0ACwtB5AggAzYCAEHgCCACNgIAQegIIAc2AgAL4gcCBX8BfgJAQdAIAn8CQAJAIAAgAU4NACABQZCJAWohBiAAQZCJAWohBQNAIAUtAAAiA0H/AHEhAgJAAkACQAJAAkACQAJAQeAIKAIAIgRBIkcEQCAEDQcgAkEiRgRAQewIQgE3AgBB4AhBIjYCAAwICyACQT9rQcAASQ0GIANBIWsiAkEMTQ0BDAULAkAgAkEwayIEQQlNBEBB7AgoAgBBAnRB7AhqIgIgBCACKAIAQQpsajYCAAwBC0HsCCgCACEEIAJBO0YEQCAEQQdKDQFB7AggBEEBajYCACAEQQJ0QfAIakEANgIADAELIARBBEYEQEHECEECNgIAQbAIQfAIKQMANwMAQbgIQfgIKAIAIgI2AgBBvAhB/AgoAgAiBDYCAEHICEECQQFBwAgoAgAiAxs2AgBBrAggBEEAIAMbNgIAQagIIAJBgIABIAJBgIABSBtBBGpBACADGzYCAEHgCEEANgIADAoLIAJBP2tBwABJDQQLIANBIWsiAkEMTQ0BDAILQQEgAnRBjSBxRQ0DDAQLQQEgAnRBjSBxDQELIANBoQFrIgJBDEsNA0EBIAJ0QY0gcUUNAwtBxAhCgYCAgBA3AgBBsAhB8AgoAgBBAEHsCCgCACICQQBKGzYCAEG0CEH0CCgCAEEAIAJBAUobNgIAQbgIQfgIKAIAQQAgAkECShs2AgBB4AhBADYCAEG8CEEANgIADAQLIANBoQFrIgJBDEsNAUEBIAJ0QY0gcUUNAQtBxAhCgYCAgBA3AgBBsAhCADcDAEG4CEIANwMADAMLIAVBAWoiBSAGSQ0ACwsCQEHICCgCAA4DAwEAAQsCQEGoCCgCACIFQQVIDQBBoAgpAwAhByAFQQNrQQF2IgNBB3EhBEEAIQIgA0EBa0EHTwRAIANB+P///wdxIQYDQCACQQN0IgNBsIkCaiAHNwMAIANBCHJBsIkCaiAHNwMAIANBEHJBsIkCaiAHNwMAIANBGHJBsIkCaiAHNwMAIANBIHJBsIkCaiAHNwMAIANBKHJBsIkCaiAHNwMAIANBMHJBsIkCaiAHNwMAIANBOHJBsIkCaiAHNwMAIAJBCGohAiAGQQhrIgYNAAsLIARFDQADQCACQQN0QbCJAmogBzcDACACQQFqIQIgBEEBayIEDQALC0HAiQZBsIkCIAVBAnQiA/wKAABB0IkKQbCJAiAD/AoAAEHgiQ5BsIkCIAP8CgAAQfCJEkGwiQIgA/wKAABBgIoWQbCJAiAD/AoAAEECDAELEAhByAgoAgALEAEiAjYCACACDQAgACABQcgIKAIAQQJ0QYAIaigCABEBAAsLdABB6AhBBDYCAEHkCCAANgIAQewIQgE3AgBBxAhCADcCAEHACCADNgIAQdwIQgA3AgBBqAhCADcDAEGwCEIANwMAQbgIQgA3AwBBzAggAkGAICACQYAgSRs2AgBBoAggAa1CgYCAgBB+NwMAQdAIQQA2AgALIwBB0AgoAgBFBEAgACABQcgIKAIAQQJ0QYAIaigCABEBAAsLWgECfwJAAkACQEHICCgCAEEBaw4CAAECC0HYCEHoCCgCACIAQdgIKAIAIgEgACABShsiAEGAgAEgAEGAgAFIGyIANgIAIABBBGsPC0GoCCgCAEEEayEACyAAC0IBAX8Cf0EGQdwIKAIAIgBBIHENABpBBSAAQRBxDQAaQQQgAEEIcQ0AGkEDIABBBHENABpBAiAAQQFxIABBAnEbCwu9BQEFfQJ/IAJFBEAgAUH/AWxBMmpB5ABtIgBBCHQgAHIgAEEQdHIMAQsgArJDAADIQpUhBiAAQfABarJDAAC0Q5UhBQJ9IAGyQwAAyEKVIgNDAAAAP10EQCADIAZDAACAP5KUDAELIAYgA0MAAIA/IAaTlJILIQcgAyADkiEGAkAgBUOrqqo+kiIEQwAAAABdBEAgBEMAAIA/kiEEDAELIARDAACAP15FDQAgBEMAAIC/kiEECyAGIAeTIQMgBUMAAAAAXSEAAn8CfSADIAcgA5NDAADAQJQgBJSSIARDq6oqPl0NABogByAEQwAAAD9dDQAaIAMgBEOrqio/XUUNABogAyAHIAOTIARDAADAwJRDAACAQJKUkgtDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALIQECQCAABEAgBUMAAIA/kiEEDAELIAUiBEMAAIA/XkUNACAFQwAAgL+SIQQLIAVDq6qqvpIiBUMAAAAAXSECAn8CfSADIAcgA5NDAADAQJQgBJSSIARDq6oqPl0NABogByAEQwAAAD9dDQAaIAMgBEOrqio/XUUNABogAyAHIAOTIARDAADAwJRDAACAQJKUkgtDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALIQACQCACBEAgBUMAAIA/kiEFDAELIAVDAACAP15FDQAgBUMAAIC/kiEFCwJAIAVDq6oqPl0EQCADIAcgA5NDAADAQJQgBZSSIQcMAQsgBUMAAAA/XQ0AIAVDq6oqP11FBEAgAyEHDAELIAMgByADkyAFQwAAwMCUQwAAgECSlJIhBwsgAEEIdAJ/IAdDAAB/Q5RDAAAAP5IiBkMAAIBPXSAGQwAAAABgcQRAIAapDAELQQALQRB0ciABcgtBgICAeHILNwAgAEH/AWxBMmpB5ABtIAFB/wFsQTJqQeQAbUEIdHIgAkH/AWxBMmpB5ABtQRB0ckGAgIB4cgsEACMACwYAIAAkAAsQACMAIABrQXBxIgAkACAACwsYAQBBgAgLEQEAAAACAAAAAwAAAAQAAAAF"}});var je=M(b=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0});b.decodeAsync=b.decode=b.Decoder=b.DecoderAsync=void 0;var O=j(),Q=xe();function Mt(r){if(typeof Buffer<"u")return Buffer.from(r,"base64");let e=atob(r),t=new Uint8Array(e.length);for(let i=0;i<t.length;++i)t[i]=e.charCodeAt(i);return t}var Xe=Mt(Q.LIMITS.BYTES),J,ne=new Uint32Array,Me=class{constructor(){this.bandHandler=e=>1,this.modeHandler=e=>1}handle_band(e){return this.bandHandler(e)}mode_parsed(e){return this.modeHandler(e)}},vt={memoryLimit:2048*65536,sixelColor:O.DEFAULT_FOREGROUND,fillColor:O.DEFAULT_BACKGROUND,palette:O.PALETTE_VT340_COLOR,paletteLimit:Q.LIMITS.PALETTE_SIZE,truncate:!0};function Ze(r){let e=new Me,t={env:{handle_band:e.handle_band.bind(e),mode_parsed:e.mode_parsed.bind(e)}};return WebAssembly.instantiate(J||Xe,t).then(i=>(J=J||i.module,new P(r,i.instance||i,e)))}b.DecoderAsync=Ze;var P=class{constructor(e,t,i){if(this._PIXEL_OFFSET=Q.LIMITS.MAX_WIDTH+4,this._canvas=ne,this._bandWidths=[],this._maxWidth=0,this._minWidth=Q.LIMITS.MAX_WIDTH,this._lastOffset=0,this._currentHeight=0,this._opts=Object.assign({},vt,e),this._opts.paletteLimit>Q.LIMITS.PALETTE_SIZE)throw new Error(`DecoderOptions.paletteLimit must not exceed ${Q.LIMITS.PALETTE_SIZE}`);if(t)i.bandHandler=this._handle_band.bind(this),i.modeHandler=this._initCanvas.bind(this);else{let A=J||(J=new WebAssembly.Module(Xe));t=new WebAssembly.Instance(A,{env:{handle_band:this._handle_band.bind(this),mode_parsed:this._initCanvas.bind(this)}})}this._instance=t,this._wasm=this._instance.exports,this._chunk=new Uint8Array(this._wasm.memory.buffer,this._wasm.get_chunk_address(),Q.LIMITS.CHUNK_SIZE),this._states=new Uint32Array(this._wasm.memory.buffer,this._wasm.get_state_address(),12),this._palette=new Uint32Array(this._wasm.memory.buffer,this._wasm.get_palette_address(),Q.LIMITS.PALETTE_SIZE),this._palette.set(this._opts.palette),this._pSrc=new Uint32Array(this._wasm.memory.buffer,this._wasm.get_p0_address()),this._wasm.init(O.DEFAULT_FOREGROUND,0,this._opts.paletteLimit,0)}get _fillColor(){return this._states[0]}get _truncate(){return this._states[8]}get _rasterWidth(){return this._states[6]}get _rasterHeight(){return this._states[7]}get _width(){return this._states[2]?this._states[2]-4:0}get _height(){return this._states[3]}get _level(){return this._states[9]}get _mode(){return this._states[10]}get _paletteLimit(){return this._states[11]}_initCanvas(e){if(e===2){let t=this.width*this.height;if(t>this._canvas.length){if(this._opts.memoryLimit&&t*4>this._opts.memoryLimit)throw this.release(),new Error("image exceeds memory limit");this._canvas=new Uint32Array(t)}this._maxWidth=this._width}else if(e===1)if(this._level===2){let t=Math.min(this._rasterWidth,Q.LIMITS.MAX_WIDTH)*this._rasterHeight;if(t>this._canvas.length){if(this._opts.memoryLimit&&t*4>this._opts.memoryLimit)throw this.release(),new Error("image exceeds memory limit");this._canvas=new Uint32Array(t)}}else this._canvas.length<65536&&(this._canvas=new Uint32Array(65536));return 0}_realloc(e,t){let i=e+t;if(i>this._canvas.length){if(this._opts.memoryLimit&&i*4>this._opts.memoryLimit)throw this.release(),new Error("image exceeds memory limit");let A=new Uint32Array(Math.ceil(i/65536)*65536);A.set(this._canvas),this._canvas=A}}_handle_band(e){let t=this._PIXEL_OFFSET,i=this._lastOffset;if(this._mode===2){let A=this.height-this._currentHeight,s=0;for(;s<6&&A>0;)this._canvas.set(this._pSrc.subarray(t*s,t*s+e),i+e*s),s++,A--;this._lastOffset+=e*s,this._currentHeight+=s}else if(this._mode===1){this._realloc(i,e*6),this._maxWidth=Math.max(this._maxWidth,e),this._minWidth=Math.min(this._minWidth,e);for(let A=0;A<6;++A)this._canvas.set(this._pSrc.subarray(t*A,t*A+e),i+e*A);this._bandWidths.push(e),this._lastOffset+=e*6,this._currentHeight+=6}return 0}get width(){return this._mode!==1?this._width:Math.max(this._maxWidth,this._wasm.current_width())}get height(){return this._mode!==1?this._height:this._wasm.current_width()?this._bandWidths.length*6+this._wasm.current_height():this._bandWidths.length*6}get palette(){return this._palette.subarray(0,this._paletteLimit)}get memoryUsage(){return this._canvas.byteLength+this._wasm.memory.buffer.byteLength+8*this._bandWidths.length}get properties(){return{width:this.width,height:this.height,mode:this._mode,level:this._level,truncate:!!this._truncate,paletteLimit:this._paletteLimit,fillColor:this._fillColor,memUsage:this.memoryUsage,rasterAttributes:{numerator:this._states[4],denominator:this._states[5],width:this._rasterWidth,height:this._rasterHeight}}}init(e=this._opts.fillColor,t=this._opts.palette,i=this._opts.paletteLimit,A=this._opts.truncate){this._wasm.init(this._opts.sixelColor,e,i,A?1:0),t&&this._palette.set(t.subarray(0,Q.LIMITS.PALETTE_SIZE)),this._bandWidths.length=0,this._maxWidth=0,this._minWidth=Q.LIMITS.MAX_WIDTH,this._lastOffset=0,this._currentHeight=0}decode(e,t=0,i=e.length){let A=t;for(;A<i;){let s=Math.min(i-A,Q.LIMITS.CHUNK_SIZE);this._chunk.set(e.subarray(A,A+=s)),this._wasm.decode(0,s)}}decodeString(e,t=0,i=e.length){let A=t;for(;A<i;){let s=Math.min(i-A,Q.LIMITS.CHUNK_SIZE);for(let n=0,a=A;n<s;++n,++a)this._chunk[n]=e.charCodeAt(a);A+=s,this._wasm.decode(0,s)}}get data32(){if(this._mode===0||!this.width||!this.height)return ne;let e=this._wasm.current_width();if(this._mode===2){let t=this.height-this._currentHeight;if(t>0){let i=this._PIXEL_OFFSET,A=this._lastOffset,s=0;for(;s<6&&t>0;)this._canvas.set(this._pSrc.subarray(i*s,i*s+e),A+e*s),s++,t--;t&&this._canvas.fill(this._fillColor,A+e*s)}return this._canvas.subarray(0,this.width*this.height)}if(this._mode===1){if(this._minWidth===this._maxWidth){let s=!1;if(e)if(e!==this._minWidth)s=!0;else{let n=this._PIXEL_OFFSET,a=this._lastOffset;this._realloc(a,e*6);for(let o=0;o<6;++o)this._canvas.set(this._pSrc.subarray(n*o,n*o+e),a+e*o)}if(!s)return this._canvas.subarray(0,this.width*this.height)}let t=new Uint32Array(this.width*this.height);t.fill(this._fillColor);let i=0,A=0;for(let s=0;s<this._bandWidths.length;++s){let n=this._bandWidths[s];for(let a=0;a<6;++a)t.set(this._canvas.subarray(A,A+=n),i),i+=this.width}if(e){let s=this._PIXEL_OFFSET,n=this._wasm.current_height();for(let a=0;a<n;++a)t.set(this._pSrc.subarray(s*a,s*a+e),i+this.width*a)}return t}return ne}get data8(){return new Uint8ClampedArray(this.data32.buffer,0,this.width*this.height*4)}release(){this._canvas=ne,this._bandWidths.length=0,this._maxWidth=0,this._minWidth=Q.LIMITS.MAX_WIDTH,this._wasm.init(O.DEFAULT_FOREGROUND,0,this._opts.paletteLimit,0)}};b.Decoder=P;function Rt(r,e){let t=new P(e);return t.init(),typeof r=="string"?t.decodeString(r):t.decode(r),{width:t.width,height:t.height,data32:t.data32,data8:t.data8}}b.decode=Rt;async function kt(r,e){let t=await Ze(e);return t.init(),typeof r=="string"?t.decodeString(r):t.decode(r),{width:t.width,height:t.height,data32:t.data32,data8:t.data8}}b.decodeAsync=kt});function H(r){return{dispose:r}}var N=class{constructor(){this._disposables=new Set;this._isDisposed=!1}get isDisposed(){return this._isDisposed}add(e){return this._isDisposed?e.dispose():this._disposables.add(e),e}dispose(){if(!this._isDisposed){this._isDisposed=!0;for(let e of this._disposables)e.dispose();this._disposables.clear()}}clear(){for(let e of this._disposables)e.dispose();this._disposables.clear()}},k=class{constructor(){this._store=new N}dispose(){this._store.dispose()}_register(e){return this._store.add(e)}};k.None=Object.freeze({dispose(){}});var X=class{constructor(){this._isDisposed=!1}get value(){return this._isDisposed?void 0:this._value}set value(e){this._isDisposed||e===this._value||(this._value?.dispose(),this._value=e)}clear(){this.value=void 0}dispose(){this._isDisposed=!0,this._value?.dispose(),this._value=void 0}};var Z=class{constructor(){this._listeners=[];this._disposed=!1}get event(){return this._event?this._event:(this._event=(e,t,i)=>{if(this._disposed)return H(()=>{});let A={fn:e,thisArgs:t};this._listeners=this._listeners.slice(),this._listeners.push(A);let s=H(()=>{let n=this._listeners.indexOf(A);n!==-1&&(this._listeners=this._listeners.slice(),this._listeners.splice(n,1))});return i&&(Array.isArray(i)?i.push(s):i.add(s)),s},this._event)}fire(e){if(this._disposed||!this._listeners.length)return;if(this._listeners.length===1){this._listeners[0].fn.call(this._listeners[0].thisArgs,e);return}let t=this._listeners;for(let i=0,A=t.length;i<A;++i)t[i].fn.call(t[i].thisArgs,e)}dispose(){this._disposed||(this._disposed=!0,this._listeners.length=0)}},lt;(A=>{function r(s,n){return s(a=>n.fire(a))}A.forward=r;function e(s,n){return(a,o,h)=>s(d=>a.call(o,n(d)),void 0,h)}A.map=e;function t(...s){return(n,a,o)=>{let h=new N;for(let d of s)h.add(d(g=>n.call(a,g)));return o&&(Array.isArray(o)?o.push(h):o.add(h)),h}}A.any=t;function i(s,n,a){return n(a),s(o=>n(o))}A.runAndSubscribe=i})(lt||={});var _e=x(j());var D=class r extends k{constructor(t){super();this._terminal=t;this._layers=new Map;this._optionsRefresh=this._register(new X);this._oldOpen=this._terminal._core.open,this._terminal._core.open=i=>{this._oldOpen?.call(this._terminal._core,i),this._open()},this._terminal._core.screenElement&&this._open(),this._optionsRefresh.value=this._terminal._core.optionsService.onOptionChange(i=>{i==="fontSize"&&(this.rescaleCanvas(),this._renderService?.refreshRows(0,this._terminal.rows))}),this._register(H(()=>{this.removeLayerFromDom(),this.removeLayerFromDom("bottom"),this._terminal._core&&this._oldOpen&&(this._terminal._core.open=this._oldOpen,this._oldOpen=void 0),this._renderService&&this._oldSetRenderer&&(this._renderService.setRenderer=this._oldSetRenderer,this._oldSetRenderer=void 0),this._renderService=void 0,this._layers.clear(),this._placeholderBitmap?.close(),this._placeholderBitmap=void 0,this._placeholder=void 0}))}get canvas(){return this._layers.get("top")?.canvas}static createCanvas(t,i,A){let s=(t??document).createElement("canvas");return s.width=i|0,s.height=A|0,s}static createImageData(t,i,A,s){if(typeof ImageData!="function"){let n=t.createImageData(i,A);return s&&n.data.set(new Uint8ClampedArray(s,0,i*A*4)),n}return s?new ImageData(new Uint8ClampedArray(s,0,i*A*4),i,A):new ImageData(i,A)}static createImageBitmap(t){return typeof createImageBitmap!="function"?Promise.resolve(void 0):createImageBitmap(t)}showPlaceholder(t){t?!this._placeholder&&this.cellSize.height!==-1&&this._createPlaceHolder(Math.max(this.cellSize.height+1,24)):(this._placeholderBitmap?.close(),this._placeholderBitmap=void 0,this._placeholder=void 0),this._renderService?.refreshRows(0,this._terminal.rows)}get dimensions(){return this._terminal.dimensions}get cellSize(){return{width:this.dimensions?.css.cell.width||-1,height:this.dimensions?.css.cell.height||-1}}clearLines(t,i,A){let s=t*(this.dimensions?.css.cell.height||0),n=this.dimensions?.css.canvas.width||0,a=(i+1-t)*(this.dimensions?.css.cell.height||0);(!A||A==="top")&&this._layers.get("top")?.clearRect(0,s,n,a),(!A||A==="bottom")&&this._layers.get("bottom")?.clearRect(0,s,n,a)}clearAll(t){if(!t||t==="top"){let i=this._layers.get("top");i?.clearRect(0,0,i.canvas.width,i.canvas.height)}if(!t||t==="bottom"){let i=this._layers.get("bottom");i?.clearRect(0,0,i.canvas.width,i.canvas.height)}}draw(t,i,A,s,n=1){let a=this._layers.get(t.layer);if(!a)return;let{width:o,height:h}=this.cellSize;if(o===-1||h===-1)return;this._rescaleImage(t,o,h);let d=t.actual,{width:g,height:I}=t.actualCellSize,l=Math.ceil(d.width/g),c=i%l*g,u=Math.floor(i/l)*I,E=A*o,C=s*h,p=n*g+c>d.width?d.width-c:n*g,B=u+I>d.height?d.height-u:I;a.drawImage(d,Math.floor(c),Math.floor(u),Math.ceil(p),Math.ceil(B),Math.floor(E),Math.floor(C),Math.ceil(p*o/g),Math.ceil(B*h/I))}extractTile(t,i){let{width:A,height:s}=this.cellSize;if(A===-1||s===-1)return;this._rescaleImage(t,A,s);let n=t.actual,{width:a,height:o}=t.actualCellSize,h=Math.ceil(n.width/a),d=i%h*a,g=Math.floor(i/h)*o,I=a+d>n.width?n.width-d:a,l=g+o>n.height?n.height-g:o,c=r.createCanvas(this.document,Math.ceil(I*A/a),Math.ceil(l*s/o)),u=c.getContext("2d");if(u)return u.drawImage(n,Math.floor(d),Math.floor(g),Math.floor(I),Math.floor(l),0,0,c.width,c.height),c}drawPlaceholder(t,i,A=1){let s=this._layers.get("top");if(s){let{width:n,height:a}=this.cellSize;if(n===-1||a===-1||(this._placeholder?a>=this._placeholder.height&&this._createPlaceHolder(a+1):this._createPlaceHolder(Math.max(a+1,24)),!this._placeholder))return;s.drawImage(this._placeholderBitmap??this._placeholder,t*n,i*a%2?0:1,n*A,a,t*n,i*a,n*A,a)}}rescaleCanvas(){let t=this.dimensions?.css.canvas.width||0,i=this.dimensions?.css.canvas.height||0;for(let A of this._layers.values())(A.canvas.width!==t||A.canvas.height!==i)&&(A.canvas.width=t,A.canvas.height=i)}_rescaleImage(t,i,A){if(i===t.actualCellSize.width&&A===t.actualCellSize.height)return;let{width:s,height:n}=t.origCellSize;if(i===s&&A===n){t.actual=t.orig,t.actualCellSize.width=s,t.actualCellSize.height=n;return}let a=Math.ceil(t.orig.width*i/s),o=Math.ceil(t.orig.height*A/n);if(a*o>t.orig.width*t.orig.height){t.actual=t.orig,t.actualCellSize.width=s,t.actualCellSize.height=n;return}let h=r.createCanvas(this.document,a,o),d=h.getContext("2d");d&&(d.drawImage(t.orig,0,0,h.width,h.height),t.actual=h,t.actualCellSize.width=i,t.actualCellSize.height=A)}_open(){this._renderService=this._terminal._core._renderService,this._oldSetRenderer=this._renderService.setRenderer.bind(this._renderService),this._renderService.setRenderer=t=>{for(let i of[...this._layers.keys()])this.removeLayerFromDom(i);this._oldSetRenderer?.call(this._renderService,t)}}insertLayerToDom(t="top"){if(!this.document||!this._terminal._core.screenElement){console.warn("image addon: cannot insert output canvas to DOM, missing document or screenElement");return}if(this._layers.has(t))return;let i=r.createCanvas(this.document,this.dimensions?.css.canvas.width||0,this.dimensions?.css.canvas.height||0);i.classList.add(`xterm-image-layer-${t}`);let A=this._terminal._core.screenElement;A.style.isolation="isolate",t==="bottom"?(i.style.zIndex="-1",A.insertBefore(i,A.firstChild)):(i.style.zIndex="0",A.appendChild(i));let s=i.getContext("2d",{alpha:!0});if(!s){i.remove();return}this._layers.set(t,s),this.clearAll(t)}removeLayerFromDom(t="top"){let i=this._layers.get(t);i&&(i.canvas.remove(),this._layers.delete(t))}hasLayer(t){return this._layers.has(t)}_createPlaceHolder(t=24){this._placeholderBitmap?.close(),this._placeholderBitmap=void 0;let i=32,A=r.createCanvas(this.document,i,t),s=A.getContext("2d",{alpha:!1});if(!s)return;let n=r.createImageData(s,i,t),a=new Uint32Array(n.data.buffer),o=(0,_e.toRGBA8888)(0,0,0),h=(0,_e.toRGBA8888)(255,255,255);a.fill(o);for(let l=0;l<t;++l){let c=l%2,u=l*i;for(let E=0;E<i;E+=2)a[u+E+c]=h}s.putImageData(n,0,0);let d=screen.width+i-1&~(i-1)||4096;this._placeholder=r.createCanvas(this.document,d,t);let g=this._placeholder.getContext("2d",{alpha:!1});if(!g){this._placeholder=void 0;return}for(let l=0;l<d;l+=i)g.drawImage(A,l,0);let I=this._placeholder;r.createImageBitmap(I).then(l=>{this._placeholder!==I?l?.close():this._placeholderBitmap=l}).catch(()=>{})}get document(){return this._terminal._core._coreBrowserService?.window.document}};var w={width:7,height:14},G=class r{constructor(e=0,t=0,i=-1,A=-1){this.imageId=i;this.tileId=A;this._ext=0;this._urlId=0;this._ext=e,this._urlId=t}get ext(){return this._urlId?this._ext&-469762049|this.underlineStyle<<26:this._ext}set ext(e){this._ext=e}get underlineStyle(){return this._urlId?5:(this._ext&469762048)>>26}set underlineStyle(e){this._ext&=-469762049,this._ext|=e<<26&469762048}get underlineColor(){return this._ext&67108863}set underlineColor(e){this._ext&=-67108864,this._ext|=e&67108863}get underlineVariantOffset(){let e=(this._ext&3758096384)>>29;return e<0?e^4294967288:e}set underlineVariantOffset(e){this._ext&=536870911,this._ext|=e<<29&3758096384}get urlId(){return this._urlId}set urlId(e){this._urlId=e}clone(){return new r(this._ext,this._urlId,this.imageId,this.tileId)}isEmpty(){return this.underlineStyle===0&&this._urlId===0&&this.imageId===-1}},F=new G,V=class{constructor(e,t,i){this._terminal=e;this._renderer=t;this._opts=i;this._images=new Map;this._lastId=0;this._lowestId=0;this._fullyCleared=!1;this._needsFullClear=!1;this._pixelLimit=25e5;try{this.setLimit(this._opts.storageLimit)}catch(A){A instanceof Error&&console.error(A.message),console.warn(`storageLimit is set to ${this.getLimit()} MB`)}this._viewportMetrics={cols:this._terminal.cols,rows:this._terminal.rows}}dispose(){this.reset()}reset(){for(let e of this._images.values())e.marker?.dispose();this._images.clear(),this._renderer.clearAll()}getLimit(){return this._pixelLimit*4/1e6}setLimit(e){if(e<.5||e>1e3)throw RangeError("invalid storageLimit, should be at least 0.5 MB and not exceed 1G");this._pixelLimit=e/4*1e6>>>0,this._evictOldest(0)}getUsage(){return this._getStoredPixels()*4/1e6}_getStoredPixels(){let e=0;for(let t of this._images.values())t.orig&&(e+=t.orig.width*t.orig.height,t.actual&&t.actual!==t.orig&&(e+=t.actual.width*t.actual.height));return e}_delImg(e){let t=this._images.get(e);t&&(this._images.delete(e),window.ImageBitmap&&t.orig instanceof ImageBitmap&&t.orig.close(),this.onImageDeleted?.(e))}wipeAlternate(){let e=[];for(let[t,i]of this._images.entries())i.bufferType==="alternate"&&(i.marker?.dispose(),e.push(t));for(let t of e)this._delImg(t);this._needsFullClear=!0,this._fullyCleared=!1}deleteImage(e){let t=this._images.get(e);t&&(t.marker?.dispose(),this._delImg(e))}addImage(e,t){this._evictOldest(e.width*e.height);let i=this._renderer.cellSize;(i.width===-1||i.height===-1)&&(i=w);let A=Math.ceil(e.width/i.width),s=Math.ceil(e.height/i.height),n=++this._lastId,a=this._terminal._core.buffer,o=this._terminal.cols,h=this._terminal.rows,d=a.x,g=a.y,I=d,l=0;t.scrolling||(a.x=0,a.y=0,I=0),this._terminal._core._inputHandler._dirtyRowTracker.markDirty(a.y);for(let C=0;C<s;++C){let p=a.lines.get(a.y+a.ybase);for(let B=0;B<A&&!(I+B>=o);++B)this._writeToCell(p,I+B,n,C*A+B),l++;if(t.scrolling)C<s-1&&this._terminal._core._inputHandler.lineFeed();else if(++a.y>=h)break;a.x=I}this._terminal._core._inputHandler._dirtyRowTracker.markDirty(a.y),t.scrolling?t.cursorPos==="iip"?a.x=Math.min(I+A,o):a.x=I:(a.x=d,a.y=g);let c=[];for(let[C,p]of this._images.entries())p.tileCount<1&&(p.marker?.dispose(),c.push(C));for(let C of c)this._delImg(C);let u=this._terminal.registerMarker(0);u?.onDispose(()=>{this._images.get(n)&&this._delImg(n)}),this._terminal.buffer.active.type==="alternate"&&this._evictOnAlternate();let E={orig:e,origCellSize:i,actual:e,actualCellSize:{...i},marker:u||void 0,tileCount:l,bufferType:this._terminal.buffer.active.type,layer:t.layer,zIndex:t.zIndex};return this._images.set(n,E),this.onImageAdded?.(),n}render(e){let t=!1,i=!1;for(let d of this._images.values())if(d.layer==="bottom"?i=!0:t=!0,t&&i)break;if(t&&!this._renderer.hasLayer("top")&&(this._renderer.insertLayerToDom("top"),!this._renderer.hasLayer("top")))return;if(i&&!this._renderer.hasLayer("bottom")&&this._renderer.insertLayerToDom("bottom"),this._renderer.rescaleCanvas(),!this._images.size){this._fullyCleared||(this._renderer.clearAll(),this._fullyCleared=!0,this._needsFullClear=!1),this._renderer.hasLayer("top")&&this._renderer.removeLayerFromDom("top"),this._renderer.hasLayer("bottom")&&this._renderer.removeLayerFromDom("bottom");return}!t&&this._renderer.hasLayer("top")&&(this._renderer.clearAll("top"),this._renderer.removeLayerFromDom("top")),!i&&this._renderer.hasLayer("bottom")&&(this._renderer.clearAll("bottom"),this._renderer.removeLayerFromDom("bottom")),this._needsFullClear&&(this._renderer.clearAll(),this._fullyCleared=!0,this._needsFullClear=!1);let{start:A,end:s}=e,n=this._terminal._core.buffer,a=this._terminal._core.cols;this._renderer.clearLines(A,s);let o=[],h=[];for(let d=A;d<=s;++d){let g=n.lines.get(d+n.ydisp);if(!g)return;for(let I=0;I<a;++I)if(g.getBg(I)&268435456){let l=g._extendedAttrs[I]??F,c=l.imageId;if(c===void 0||c===-1)continue;let u=this._images.get(c);if(l.tileId!==-1){let E=l.tileId,C=I,p=1;for(;++I<a&&g.getBg(I)&268435456&&(l=g._extendedAttrs[I]??F)&&l.imageId===c&&l.tileId===E+p;)p++;I--,u?u.actual&&o.push({imgSpec:u,tileId:E,col:C,row:d,count:p}):this._opts.showPlaceholder&&h.push({col:C,row:d,count:p}),this._fullyCleared=!1}}}o.sort((d,g)=>d.imgSpec.zIndex-g.imgSpec.zIndex);for(let d of h)this._renderer.drawPlaceholder(d.col,d.row,d.count);for(let d of o)this._renderer.draw(d.imgSpec,d.tileId,d.col,d.row,d.count)}viewportResize(e){if(!this._images.size){this._viewportMetrics=e;return}if(this._viewportMetrics.cols>=e.cols){this._viewportMetrics=e;return}let t=this._terminal._core.buffer,i=t.lines.length,A=this._viewportMetrics.cols-1;for(let s=0;s<i;++s){let n=t.lines.get(s);if(n.getBg(A)&268435456){let a=n._extendedAttrs[A]??F,o=a.imageId;if(o===void 0||o===-1)continue;let h=this._images.get(o);if(!h)continue;let d=Math.ceil((h.actual?.width||0)/h.actualCellSize.width);if(a.tileId%d+1>=d)continue;let g=!1;for(let c=A+1;c>e.cols;++c)if(n._data[c*3+0]&4194303){g=!0;break}if(g)continue;let I=Math.min(e.cols,d-a.tileId%d+A),l=a.tileId;for(let c=A+1;c<I;++c)this._writeToCell(n,c,o,++l),h.tileCount++}}this._viewportMetrics=e}getImageAtBufferCell(e,t){let A=this._terminal._core.buffer.lines.get(t);if(A&&A.getBg(e)&268435456){let s=A._extendedAttrs[e]??F;if(s.imageId&&s.imageId!==-1){let n=this._images.get(s.imageId)?.orig;if(window.ImageBitmap&&n instanceof ImageBitmap){let a=D.createCanvas(window.document,n.width,n.height);return a.getContext("2d")?.drawImage(n,0,0,n.width,n.height),a}return n}}}extractTileAtBufferCell(e,t){let A=this._terminal._core.buffer.lines.get(t);if(A&&A.getBg(e)&268435456){let s=A._extendedAttrs[e]??F;if(s.imageId&&s.imageId!==-1&&s.tileId!==-1){let n=this._images.get(s.imageId);if(n)return this._renderer.extractTile(n,s.tileId)}}}_evictOldest(e){let t=this._getStoredPixels(),i=t;for(;this._pixelLimit<i+e&&this._images.size;){let A=this._images.get(++this._lowestId);A&&A.orig&&(i-=A.orig.width*A.orig.height,A.actual&&A.orig!==A.actual&&(i-=A.actual.width*A.actual.height),A.marker?.dispose(),this._delImg(this._lowestId))}return t-i}_writeToCell(e,t,i,A){if(e._data[t*3+2]&268435456){let s=e._extendedAttrs[t];if(s){if(s.imageId!==void 0){let n=this._images.get(s.imageId);n&&n.tileCount--,s.imageId=i,s.tileId=A;return}e._extendedAttrs[t]=new G(s.ext,s.urlId,i,A);return}}e._data[t*3+2]|=268435456,e._extendedAttrs[t]=new G(0,0,i,A)}_evictOnAlternate(){for(let i of this._images.values())i.bufferType==="alternate"&&(i.tileCount=0);let e=this._terminal._core.buffer;for(let i=0;i<this._terminal.rows;++i){let A=e.lines.get(i);if(A){for(let s=0;s<this._terminal.cols;++s)if(A._data[s*3+2]&268435456){let n=A._extendedAttrs[s]?.imageId;if(n){let a=this._images.get(n);a&&a.tileCount++}}}}let t=[];for(let[i,A]of this._images.entries())A.bufferType==="alternate"&&!A.tileCount&&(A.marker?.dispose(),t.push(i));for(let i of t)this._delImg(i)}};var Ye=x(Be()),qe=x(Ue());function $(r){let e="";for(let t=0;t<r.length;++t)e+=String.fromCharCode(r[t]);return e}function De(r){let e=0;for(let t=0;t<r.length;++t){if(r[t]<48||r[t]>57)throw new Error("illegal char");e=e*10+r[t]-48}return e}function Oe(r){let e=$(r);if(!e.match(/^((auto)|(\d+?((px)|(%)){0,1}))$/))throw new Error("illegal size");return e}function Tt(r){if(typeof Buffer<"u")return Buffer.from($(r),"base64").toString();let e=atob($(r)),t=new Uint8Array(e.length);for(let i=0;i<t.length;++i)t[i]=e.charCodeAt(i);return new TextDecoder().decode(t)}var Je={inline:De,size:De,name:Tt,width:Oe,height:Oe,preserveAspectRatio:De},Pe=[70,105,108,101],Ke=[77,117,108,116,105,112,97,114,116,70,105,108,101],we=[70,105,108,101,80,97,114,116],be=[70,105,108,101,69,110,100],ye=[82,101,112,111,114,116,67,101,108,108,83,105,122,101],Se=1024,ee=class{constructor(){this.state=0;this._buffer=new Uint32Array(Se);this._position=0;this._key="";this.fields={}}reset(){this._buffer.fill(0),this.state=0,this._position=0,this.fields={},this._key=""}end(){if(this.state===0){if(this._position===be.length){for(let e=0;e<be.length;++e)if(this._buffer[e]!==be[e])return this._a();return this.fields.type=4,this.state=4,0}if(this._position===ye.length){for(let e=0;e<ye.length;++e)if(this._buffer[e]!==ye[e])return this._a();return this.fields.type=5,this.state=4,0}return this._a()}return this.state===4?0:this.state===3&&this.fields.type===2?this._storeValue(this._position)?(this.state=4,0):this._a():this._a()}parse(e,t,i){let A=this.state,s=this._position,n=this._buffer;if(A===1||A===4||A===0&&s>14)return-1;for(let a=t;a<i;++a){let o=e[a];switch(o){case 59:if(!this._storeValue(s))return this._a();A=2,s=0;break;case 61:if(A===0){if(n[0]===70){let h=0;for(;h<Pe.length;++h)if(n[h]!==Pe[h])return this._a();if(this.fields.type=1,s===we.length){for(;h<we.length;++h)if(n[h]!==we[h])return this._a();return this.fields.type=3,this.state=4,a+1}}else if(n[0]===77){for(let h=0;h<Ke.length;++h)if(n[h]!==Ke[h])return this._a();this.fields.type=2}else return this._a();A=2,s=0}else if(A===2){if(!this._storeKey(s))return this._a();A=3,s=0}else if(A===3){if(s>=Se)return this._a();n[s++]=o}break;case 58:return A===3&&!this._storeValue(s)?this._a():(this.state=4,a+1);default:if(s>=Se)return this._a();n[s++]=o}}return this.state=A,this._position=s,-2}_a(){return this.fields.type=0,this.state=1,-1}_storeKey(e){let t=$(this._buffer.subarray(0,e));return t?(this._key=t,this.fields[t]=null,!0):!1}_storeValue(e){if(this._key){try{let t=this._buffer.slice(0,e);this.fields[this._key]=Je[this._key]?Je[this._key](t):t}catch{return!1}return!0}return!1}};var L={mime:"unsupported",width:0,height:0};function te(r){if(r.length<32)return L;let e=new Uint32Array(r.buffer,r.byteOffset,8);if(e[0]===1196314761&&e[1]===169478669&&e[3]===1380206665)return{mime:"image/png",width:r[16]<<24|r[17]<<16|r[18]<<8|r[19],height:r[20]<<24|r[21]<<16|r[22]<<8|r[23]};if(r[0]===255&&r[1]===216&&r[2]===255){let[t,i]=xt(r);return{mime:"image/jpeg",width:t,height:i}}if(e[0]===944130375&&(r[4]===55||r[4]===57)&&r[5]===97)return{mime:"image/gif",width:r[7]<<8|r[6],height:r[9]<<8|r[8]};if(e[0]===1718185841)return{mime:"image/qoi",width:r[4]<<24|r[5]<<16|r[6]<<8|r[7],height:r[8]<<24|r[9]<<16|r[10]<<8|r[11]};if(e[0]===1179011410&&e[2]===1346520407&&(e[3]&16777215)===3690582){switch(r[15]){case 88:return{mime:"image/webp",width:(r[24]|r[25]<<8|r[26]<<16)+1,height:(r[27]|r[28]<<8|r[29]<<16)+1};case 76:if(r[20]!==47)return L;let t=r[21]|r[22]<<8|r[23]<<16|r[24]<<24;return{mime:"image/webp",width:(t&16383)+1,height:(t>>>14&16383)+1};case 32:return r[23]!==157||r[24]!==1||r[25]!==42?L:{mime:"image/webp",width:(r[26]|r[27]<<8)&16383,height:(r[28]|r[29]<<8)&16383}}return L}if(e[1]===1887007846&&(e[2]===1718187617||e[2]===1936291425)){let t=-1,i=Math.min(r.length-16,1024);for(let A=8;A<i;A++)if(r[A]===105&&r[A+1]===115&&r[A+2]===112&&r[A+3]===101){t=A;break}if(t!==-1){let A=r[t+8]<<24|r[t+9]<<16|r[t+10]<<8|r[t+11],s=r[t+12]<<24|r[t+13]<<16|r[t+14]<<8|r[t+15];if(A>0&&s>0)return{mime:"image/avif",width:A,height:s}}return L}return L}function xt(r){let e=r.length,t=4,i=r[t]<<8|r[t+1];for(;;){if(t+=i,t>=e)return[0,0];if(r[t]!==255)return[0,0];if(r[t+1]===192||r[t+1]===194)return t+8<e?[r[t+7]<<8|r[t+8],r[t+5]<<8|r[t+6]]:[0,0];t+=2,i=r[t]<<8|r[t+1]}}var Le={type:0,name:"Unnamed file",size:0,width:"auto",height:"auto",preserveAspectRatio:1,inline:0},ie=class{constructor(e,t,i,A){this._opts=e;this._renderer=t;this._storage=i;this._coreTerminal=A;this._generation=0;this._aborted=!1;this._hp=new ee;this._header=Le;this._isMultipart=!1;this._abortMulti=!1;let s=Math.ceil(this._opts.iipSizeLimit*4/3),n=Math.min(1048576,s);this._dec=new Ye.default(0,s,n),this._qoiDec=new qe.default(0)}reset(){this._generation++,this._hp.reset(),this._dec.release(),this._qoiDec.release()}start(){this._aborted=!1,this._hp.reset()}put(e,t,i){if(!this._aborted)if(this._hp.state===4)this._dec.put(e.subarray(t,i))!==0&&(this._dec.release(),this._aborted=!0);else{let A=this._hp.parse(e,t,i);if(A===-1){this._aborted=!0;return}if(A>0){if(this._hp.fields.type===1){if(this._isMultipart&&(this._isMultipart=!1,this._abortMulti=!1,this._dec.release()),this._header=Object.assign({},Le,this._hp.fields),!this._header.inline){this._aborted=!0;return}if(!this._initDecoder()){this._aborted=!0;return}}else if(this._abortMulti){this._aborted=!0;return}this._dec.put(e.subarray(A,i))!==0&&(this._dec.release(),this._aborted=!0,this._isMultipart&&(this._abortMulti=!0))}}}end(e){if(this._aborted||this._hp.state!==4&&this._hp.end())return!0;let t=this._hp.fields.type;if(t===3)return!0;if(t===5){let h=w.width,d=w.height;this._renderer.dimensions&&(h=this._renderer.dimensions.css.canvas.width/this._coreTerminal.cols,d=this._renderer.dimensions.css.canvas.height/this._coreTerminal.rows);let g=this._coreTerminal._core._coreBrowserService?.dpr??1,I=`\x1B]1337;ReportCellSize=${d.toFixed(3)};${h.toFixed(3)};${g.toFixed(3)}\x1B\\`;return this._coreTerminal.input(I,!1),!0}if(t===2)return this._header=Object.assign({},Le,this._hp.fields),this._isMultipart=!0,this._abortMulti=!1,this._dec.release(),this._initDecoder()||(this._abortMulti=!0),!0;if(t===4&&(!this._isMultipart||(this._isMultipart=!1,this._abortMulti||this._header.type!==2)))return!0;let i=0,A=0,s,n=L;if((s=e)&&((s=!this._dec.end())?(n=te(this._dec.data8),(s=n.mime!=="unsupported")?(i=n.width,A=n.height,(s=i&&A&&i*A<this._opts.pixelLimit)?([i,A]=this._resize(i,A).map(Math.floor),s=i&&A&&i*A<this._opts.pixelLimit):console.warn(`IIP: image dimension issue ${n.width}x${n.height}`)):console.warn("IIP: unsupported image type")):console.warn("IIP: error during BASE64 decoding")),!s)return this._dec.release(),!0;let a;if(n.mime==="image/qoi"){let h;try{h=this._qoiDec.decode(this._dec.data8)}catch(d){return console.warn("IIP: could not decode QOI image",d),this._dec.release(),this._qoiDec.release(),!0}if(a=new ImageData(new Uint8ClampedArray(h.buffer,h.byteOffset,h.byteLength),this._qoiDec.width,this._qoiDec.height),this._qoiDec.release(),i===this._qoiDec.width&&A===this._qoiDec.height){this._dec.release();let d=D.createCanvas(void 0,this._qoiDec.width,this._qoiDec.height);return d.getContext("2d")?.putImageData(a,0,0),this._storage.addImage(d),!0}}else a=new Blob([this._dec.data8],{type:n.mime});this._dec.release();let o=this._generation;return createImageBitmap(a,{resizeWidth:i,resizeHeight:A}).then(h=>o!==this._generation?(h.close(),!0):(this._storage.addImage(h),!0)).catch(h=>(console.warn(`IIP: decoding error ${n.mime} ${n.width}x${n.height}`,h),!0))}_initDecoder(){try{return this._dec.init(),!0}catch(e){return console.warn("IIP: could not allocate decoder",e),this._dec.release(),!1}}_resize(e,t){let i=this._renderer.dimensions?.css.cell.width||w.width,A=this._renderer.dimensions?.css.cell.height||w.height,s=this._renderer.dimensions?.css.canvas.width||i*this._coreTerminal.cols,n=this._renderer.dimensions?.css.canvas.height||A*this._coreTerminal.rows,a=this._dim(this._header.width,s,i),o=this._dim(this._header.height,n,A);if(!a&&!o){let h=s/e,d=(n-A)/t,g=Math.min(h,d);return g<1?[e*g,t*g]:[e,t]}return a?this._header.preserveAspectRatio||!a||!o?[a,t*a/e]:[a,o]:[e*o/t,o]}_dim(e,t,i){return e==="auto"?0:e.endsWith("%")?parseInt(e.slice(0,-1),10)*t/100:e.endsWith("px")?parseInt(e.slice(0,-2),10):parseInt(e,10)*i}};var We=x(Be());function Te(r){let e={},t=r.split(",");for(let i of t){let A=i.indexOf("=");if(A===-1)continue;let s=i.substring(0,A),n=i.substring(A+1);if(s==="a"){e.action=n;continue}if(s==="o"){e.compression=n;continue}if(s==="t"){e.transmission=n;continue}if(s==="d"){e.deleteSelector=n;continue}let a=parseInt(n,10);switch(s){case"f":e.format=a;break;case"i":e.id=a;break;case"I":e.imageNumber=a;break;case"s":e.width=a;break;case"v":e.height=a;break;case"x":e.x=a;break;case"y":e.y=a;break;case"w":e.sourceWidth=a;break;case"h":e.sourceHeight=a;break;case"X":e.xOffset=a;break;case"Y":e.yOffset=a;break;case"c":e.columns=a;break;case"r":e.rows=a;break;case"m":e.more=a;break;case"q":e.quiet=a;break;case"C":e.cursorMovement=a;break;case"z":e.zIndex=a;break;case"p":e.placementId=a;break}}return e}var ze=0,Ae=class{constructor(e,t,i,A){this._opts=e;this._renderer=t;this._kittyStorage=i;this._coreTerminal=A;this._aborted=!1;this._generation=0;this._decodeError=!1;this._activeDecoder=null;this._inControlData=!0;this._controlData=new Uint32Array(512);this._controlLength=0;this._encodedSizeLimit=0;this._totalEncodedSize=0;this._parsedCommand=null;this._pendingTransmissions=new Map;this._maxEncodedBytes=Math.ceil(this._opts.kittySizeLimit*4/3),this._initialEncodedBytes=Math.min(4194304,this._maxEncodedBytes)}reset(){this._generation++,this._cleanupAllPending(),this._activeDecoder&&(this._activeDecoder.release(),this._activeDecoder=null),this._kittyStorage.reset()}dispose(){this.reset()}_removePendingEntry(e){this._pendingTransmissions.delete(e),this._lastPendingKey===e&&(this._lastPendingKey=void 0)}_cleanupAllPending(){for(let e of this._pendingTransmissions.values())e.decoder.release();this._pendingTransmissions.clear(),this._lastPendingKey=void 0}start(){this._aborted=!1,this._decodeError=!1,this._inControlData=!0,this._controlLength=0,this._parsedCommand=null,this._encodedSizeLimit=this._maxEncodedBytes,this._totalEncodedSize=0,this._activeDecoder=null}put(e,t,i){if(!this._aborted)if(!this._inControlData)this._streamPayload(e,t,i);else{let A=i;for(let n=t;n<i;n++)if(e[n]===59){this._inControlData=!1,A=n;break}let s=A-t;if(this._controlLength+s>512){this._aborted=!0;return}if(this._controlData.set(e.subarray(t,A),this._controlLength),this._controlLength+=s,!this._inControlData){if(this._parsedCommand=Te(this._parseControlDataString()),this._parsedCommand.id!==void 0&&this._parsedCommand.imageNumber!==void 0){this._sendResponse(this._parsedCommand.id,"EINVAL:cannot specify both i and I keys",this._parsedCommand.quiet??0),this._aborted=!0;return}if(this._parsedCommand.action==="d")return;let n=A+1;n<i&&this._streamPayload(e,n,i)}}}_streamPayload(e,t,i){if(this._aborted)return;let A=this._parsedCommand?.id??this._lastPendingKey??0,s=this._pendingTransmissions.get(A),n=s?.totalEncodedSize??0;if(this._totalEncodedSize+=i-t,n+this._totalEncodedSize>this._encodedSizeLimit){let o=this._activeDecoder??s?.decoder;o&&o.release(),this._activeDecoder=null,s&&this._removePendingEntry(A),this._aborted=!0;return}if(!this._decodeError){if(s?.decoder&&!this._activeDecoder&&(this._activeDecoder=s.decoder),!this._activeDecoder){let o=this._maxEncodedBytes+131072;if(o>this._opts.storageLimit*1e6){this._aborted=!0,this._parsedCommand?.id!==void 0&&this._sendResponse(this._parsedCommand.id,"ENOMEM:pending image budget exceeded",this._parsedCommand.quiet??0);return}let h=Math.max(1,Math.floor(this._opts.storageLimit*1e6/o));for(;this._pendingTransmissions.size>=h;){let g=this._pendingTransmissions.entries().next().value;if(!g)break;g[1].decoder.release(),this._removePendingEntry(g[0]),g[1].cmd.id!==void 0&&this._sendResponse(g[1].cmd.id,"ENOMEM:pending image budget exceeded",g[1].cmd.quiet??0)}let d=new We.default(4194304,this._maxEncodedBytes,this._initialEncodedBytes);try{d.init()}catch(g){console.warn("KITTY: could not allocate decoder",g),this._aborted=!0,this._parsedCommand?.id!==void 0&&this._sendResponse(this._parsedCommand.id,"ENOMEM:could not allocate decoder",this._parsedCommand.quiet??0);return}this._activeDecoder=d}this._activeDecoder.put(e.subarray(t,i))!==ze&&(this._activeDecoder.release(),this._activeDecoder=null,this._decodeError=!0,s&&this._removePendingEntry(A))}}end(e){if(this._aborted||!e)return this._activeDecoder&&(this._activeDecoder.release(),this._activeDecoder=null),!0;if(this._inControlData)return this._handleNoPayloadCommand();let t=this._parsedCommand;if(t.action==="d")return this._handleDelete(t);let i=t.id??this._lastPendingKey??0,A=t.more===1,s=this._pendingTransmissions.get(i);if(A)return this._activeDecoder&&(s?(s.totalEncodedSize+=this._totalEncodedSize,s.decodeError=s.decodeError||this._decodeError):this._pendingTransmissions.set(i,{cmd:{...t},decoder:this._activeDecoder,totalEncodedSize:this._totalEncodedSize,decodeError:this._decodeError}),this._lastPendingKey=i,this._activeDecoder=null),!0;s&&(this._lastPendingKey=void 0);let n=this._decodeError,a=t,o=this._activeDecoder;s&&(a=s.cmd,o=s.decoder,n=n||s.decodeError,this._pendingTransmissions.delete(i));let h=new Uint8Array(0);o&&(o.end()!==ze&&(n=!0),h=o.data8),this._activeDecoder=null;let d=this._handleCommandWithBytesAndCmd(a,h,n);return o&&o.release(),d}_parseControlDataString(){let e="";for(let t=0;t<this._controlLength;t++)e+=String.fromCodePoint(this._controlData[t]);return e}_handleNoPayloadCommand(){let e=Te(this._parseControlDataString());if(e.id!==void 0&&e.imageNumber!==void 0)return this._sendResponse(e.id,"EINVAL:cannot specify both i and I keys",e.quiet??0),!0;switch(e.action??"t"){case"d":return this._handleDelete(e);case"q":return this._sendResponse(e.id??0,"OK",e.quiet??0),!0;case"p":return this._handlePlacement(e);default:return e.id!==void 0&&this._sendResponse(e.id,"EINVAL:unsupported action",e.quiet??0),!0}}_handleCommandWithBytesAndCmd(e,t,i){switch(e.action??"t"){case"t":{let s=this._handleTransmit(e,t,i);return(e.transmission??"d")==="d"&&e.id!==void 0&&(i?this._sendResponse(e.id,"EINVAL:invalid base64 data",e.quiet??0):t.length>0&&this._sendResponse(e.id,"OK",e.quiet??0)),s}case"T":return this._handleTransmitDisplay(e,t,i);case"q":return this._handleQuery(e,t,i);case"p":return this._handlePlacement(e);default:return e.id!==void 0&&this._sendResponse(e.id,"EINVAL:unsupported action",e.quiet??0),!0}}_handlePlacement(e){if(e.id===void 0)return!0;let t=e.id,i=this._kittyStorage.getImage(t);return i?this._displayImage(i,e).then(s=>(this._sendResponse(t,s?"OK":"EINVAL:image rendering failed",e.quiet??0,e.placementId),!0)):(this._sendResponse(t,"ENOENT:image not found",e.quiet??0,e.placementId),!0)}_handleTransmit(e,t,i){return(e.transmission??"d")!=="d"?(e.id!==void 0&&this._sendResponse(e.id,"EINVAL:unsupported transmission medium",e.quiet??0),!0):(i||t.length===0||this._kittyStorage.storeImage(e.id,{data:new Blob([t]),width:e.width??0,height:e.height??0,format:e.format??32,compression:e.compression??""}),!0)}_handleTransmitDisplay(e,t,i){if(i)return e.id!==void 0&&this._sendResponse(e.id,"EINVAL:invalid base64 data",e.quiet??0),!0;this._handleTransmit(e,t,i);let A=e.id??this._kittyStorage.lastImageId,s=this._kittyStorage.getImage(A);if(s){let n=this._displayImage(s,e);return e.id!==void 0?n.then(a=>(this._sendResponse(A,a?"OK":"EINVAL:image rendering failed",e.quiet??0),!0)):n.then(()=>!0)}return!0}_handleQuery(e,t,i){let A=e.id??0,s=e.quiet??0;if((e.transmission??"d")!=="d")return this._sendResponse(A,"EINVAL:unsupported transmission medium",s),!0;if(i)return this._sendResponse(A,"EINVAL:invalid base64 data",s),!0;if(t.length===0)return this._sendResponse(A,"OK",s),!0;let a=e.format??32;if(a===100)this._sendResponse(A,"OK",s);else{let o=e.width??0,h=e.height??0;if(!o||!h)return this._sendResponse(A,"EINVAL:width and height required for raw pixel data",s),!0;let d=a===32?4:3,g=o*h*d;if(t.length<g)return this._sendResponse(A,"EINVAL:insufficient pixel data",s),!0;this._sendResponse(A,"OK",s)}return!0}_handleDelete(e){switch(e.deleteSelector??"a"){case"a":case"A":this._cleanupAllPending(),this._kittyStorage.deleteAll();break;case"i":case"I":if(e.id!==void 0){let i=this._pendingTransmissions.get(e.id);i&&i.decoder.release(),this._removePendingEntry(e.id),this._kittyStorage.deleteById(e.id)}break;default:break}return!0}_sendResponse(e,t,i,A){let s=t==="OK";if(s&&i>=1||!s&&i>=2)return;let n=A?`,p=${A}`:"",a=`\x1B_Gi=${e}${n};${t}\x1B\\`;this._coreTerminal._core.coreService.triggerDataEvent(a)}_displayImage(e,t){return this._decodeAndDisplay(e,t).then(()=>!0).catch(()=>!1)}async _decodeAndDisplay(e,t){let i=this._generation,A=await this._createBitmap(e);try{if(i!==this._generation)throw new Error("image decode canceled");let s=Math.max(0,t.x??0),n=Math.max(0,t.y??0),a=t.sourceWidth||A.width-s,o=t.sourceHeight||A.height-n,h=Math.max(0,A.width-s),d=Math.max(0,A.height-n),g=Math.max(0,Math.min(a,h)),I=Math.max(0,Math.min(o,d));if(g===0||I===0)throw new Error("invalid source rectangle");if(s!==0||n!==0||g!==A.width||I!==A.height){let T=await createImageBitmap(A,s,n,g,I);A.close(),A=T}let l=this._renderer.dimensions?.css.cell.width||w.width,c=this._renderer.dimensions?.css.cell.height||w.height,u,E;t.columns!==void 0&&t.rows!==void 0?(u=t.columns,E=t.rows):t.columns!==void 0?(u=t.columns,E=Math.max(1,Math.ceil(A.height/A.width*(u*l)/c))):t.rows!==void 0?(E=t.rows,u=Math.max(1,Math.ceil(A.width/A.height*(E*c)/l))):(u=Math.ceil(A.width/l),E=Math.ceil(A.height/c));let C=A.width,p=A.height;if((t.columns!==void 0||t.rows!==void 0)&&(C=Math.round(u*l),p=Math.round(E*c)),C*p>this._opts.pixelLimit)throw new Error("image exceeds pixel limit");let B=this._coreTerminal._core.buffer,Y=B.x,q=B.y,z=B.ybase,At=t.zIndex!==void 0&&t.zIndex<0?"bottom":"top";if(C!==A.width||p!==A.height){let T=await createImageBitmap(A,{resizeWidth:C,resizeHeight:p});A.close(),A=T}let Ie=Math.min(Math.max(0,t.xOffset??0),l-1),le=Math.min(Math.max(0,t.yOffset??0),c-1);if(Ie!==0||le!==0){let T=t.columns!==void 0?Math.round(u*l):A.width+Ie,st=t.rows!==void 0?Math.round(E*c):A.height+le,W=D.createCanvas(window.document,T,st),ke=W.getContext("2d");if(!ke)throw new Error("Failed to create offset canvas context");ke.drawImage(A,Ie,le);let nt=await createImageBitmap(W);if(W.width=W.height=0,A.close(),A=nt,C=A.width,p=A.height,C*p>this._opts.pixelLimit)throw new Error("image exceeds pixel limit");t.columns===void 0&&(u=Math.ceil(A.width/l)),t.rows===void 0&&(E=Math.ceil(A.height/c))}if(i!==this._generation)throw new Error("image decode canceled");let rt=t.zIndex??0;if(this._kittyStorage.addImage(e.id,A,!0,At,rt),A=void 0,t.cursorMovement===1){let T=B.ybase-z;B.x=Y,B.y=Math.max(q-T,0)}else B.x=Math.min(Y+u,this._coreTerminal.cols)}catch(s){throw A?.close(),s}}async _createBitmap(e){let t=new Uint8Array(await e.data.arrayBuffer());if(e.compression==="z"&&(t=await this._decompressZlib(t)),e.format===100){let E=te(t);if(E.mime!=="image/png"||!(E.width>0)||!(E.height>0)||E.width*E.height>this._opts.pixelLimit)throw new RangeError("PNG exceeds pixel limit or has invalid dimensions");let C=new Blob([t],{type:"image/png"});if(!window.createImageBitmap){let p=URL.createObjectURL(C),B=new Image;return new Promise((Y,q)=>{B.addEventListener("load",()=>{URL.revokeObjectURL(p);let z=D.createCanvas(window.document,B.width,B.height);z.getContext("2d")?.drawImage(B,0,0),createImageBitmap(z).then(Y).catch(q)}),B.addEventListener("error",()=>{URL.revokeObjectURL(p),q(new Error("Failed to load image"))}),B.src=p})}return createImageBitmap(C)}let i=e.width,A=e.height;if(!i||!A)throw new Error("Width and height required for raw pixel data");let s=e.format===32?4:3,n=i*A*s;if(t.length<n)throw new Error("Insufficient pixel data");let a=i*A;if(e.format===32)return createImageBitmap(new ImageData(new Uint8ClampedArray(t.buffer,t.byteOffset,a*4),i,A));let o=new Uint8ClampedArray(a*4),h=new Uint32Array(t.buffer,t.byteOffset,Math.floor(t.byteLength/4)),d=new Uint32Array(o.buffer),g=a&-4,I=0,l=0;for(let E=0;E<g;E+=4){let C=h[I++],p=h[I++],B=h[I++];d[l++]=4278190080|C,d[l++]=4278190080|C>>>24|p<<8,d[l++]=4278190080|p>>>16|B<<16,d[l++]=4278190080|B>>>8}let c=g*3,u=g*4;for(let E=g;E<a;E++)o[u]=t[c],o[u+1]=t[c+1],o[u+2]=t[c+2],o[u+3]=255,c+=3,u+=4;return createImageBitmap(new ImageData(o,i,A))}async _decompressZlib(e){try{return await this._decompress(e,"deflate")}catch(t){if(t instanceof RangeError)throw t;return await this._decompress(e,"deflate-raw")}}async _decompress(e,t){let i=Math.min(this._opts.kittySizeLimit,this._opts.pixelLimit*4,this._opts.storageLimit*1e6),A=0,n=new ReadableStream({pull(g){if(A>=e.length){g.close();return}let I=Math.min(A+4096,e.length);g.enqueue(new Uint8Array(e.subarray(A,I))),A=I}}).pipeThrough(new DecompressionStream(t)).getReader(),a=[],o=0;try{for(;;){let{done:g,value:I}=await n.read();if(g)break;if(o+=I.byteLength,o>i)throw await n.cancel().catch(()=>{}),new RangeError("decompressed image exceeds byte limit");a.push(I)}}finally{n.releaseLock()}let h=new Uint8Array(o),d=0;for(let g of a)h.set(g,d),d+=g.length;return h}get images(){return this._kittyStorage.images}get _kittyIdToStorageId(){return this._kittyStorage.kittyIdToStorageId}get pendingTransmissions(){return this._pendingTransmissions}};var U=class U{constructor(e){this._storage=e;this._nextImageId=1;this._images=new Map;this._kittyIdToStorageId=new Map;this._storageIdToKittyId=new Map;this._handleStorageImageDeleted=e=>{let t=this._storageIdToKittyId.get(e);t!==void 0&&(this._kittyIdToStorageId.delete(t),this._storageIdToKittyId.delete(e),this._images.delete(t))};this._addImageOpts={scrolling:!0,layer:"top",zIndex:0,cursorPos:"iip"};this._previousOnImageDeleted=this._storage.onImageDeleted,this._wrappedOnImageDeleted=t=>{this._previousOnImageDeleted?.(t),this._handleStorageImageDeleted(t)},this._storage.onImageDeleted=this._wrappedOnImageDeleted}reset(){this._nextImageId=1,this._images.clear(),this._kittyIdToStorageId.clear(),this._storageIdToKittyId.clear()}dispose(){this.reset(),this._storage.onImageDeleted===this._wrappedOnImageDeleted&&(this._storage.onImageDeleted=this._previousOnImageDeleted)}storeImage(e,t){let i=e??this._nextImageId++,A=this._kittyIdToStorageId.get(i);A!==void 0&&(this._storage.deleteImage(A),this._kittyIdToStorageId.delete(i),this._storageIdToKittyId.delete(A)),!this._images.has(i)&&this._images.size>=U._maxStoredImages&&this._evictUndisplayedImages();let s=this._storage.getLimit()*1e6;this._images.delete(i);let n=0;for(let a of this._images.values())n+=a.data.size;for(let a of[!1,!0])for(let[o,h]of this._images){if(n+t.data.size<=s)break;this._kittyIdToStorageId.has(o)===a&&(n-=h.data.size,this.deleteById(o))}return this._images.set(i,{...t,id:i}),i}addImage(e,t,i,A,s){let n=this._kittyIdToStorageId.get(e);n!==void 0&&this._storageIdToKittyId.delete(n),this._addImageOpts.scrolling=i,this._addImageOpts.layer=A,this._addImageOpts.zIndex=s;let a=this._storage.addImage(t,this._addImageOpts);this._kittyIdToStorageId.set(e,a),this._storageIdToKittyId.set(a,e)}getImage(e){return this._images.get(e)}deleteById(e){this._images.delete(e);let t=this._kittyIdToStorageId.get(e);t!==void 0&&(this._storage.deleteImage(t),this._kittyIdToStorageId.delete(e),this._storageIdToKittyId.delete(t))}deleteAll(){this._images.clear();for(let e of this._kittyIdToStorageId.values())this._storage.deleteImage(e);this._kittyIdToStorageId.clear(),this._storageIdToKittyId.clear()}get images(){return this._images}get kittyIdToStorageId(){return this._kittyIdToStorageId}get lastImageId(){return this._nextImageId-1}_evictUndisplayedImages(){for(let[e]of this._images){if(this._images.size<=U._maxStoredImages/2)break;this._kittyIdToStorageId.has(e)||this._images.delete(e)}}};U._maxStoredImages=256;var re=U;var y=x(j());var he=x(je()),Ve=x(xe());var Nt=4194304,K=y.PALETTE_ANSI_256;K.set(y.PALETTE_VT340_COLOR);var Ht=2,Re=new Map,ve=!1;function Ft(r){ve||(ve=!0,(0,he.DecoderAsync)({memoryLimit:r,palette:K}).then(e=>$e(e,r),()=>{ve=!1}))}function Gt(r){return Re.get(r)?.pop()??new he.Decoder({memoryLimit:r,palette:K})}function $e(r,e){r.memoryUsage>Nt&&r.release();let t=Re.get(e)??[];t.length<Ht&&(t.push(r),Re.set(e,t))}var oe=class{constructor(e,t,i){this._opts=e;this._storage=t;this._coreTerminal=i;this._size=0;this._aborted=!1;this._decMemoryLimit=0;this._palette=new Uint32Array(Ve.LIMITS.PALETTE_SIZE);this._palette.set(K),Ft(this._opts.pixelLimit*4)}reset(){this._returnDecoder(),this._palette.fill(0),this._palette.set(K)}hook(e){this._size=0,this._aborted=!1,this._returnDecoder();let t=this._opts.pixelLimit*4;try{this._dec=Gt(t)}catch(A){console.warn(`SIXEL: could not allocate decoder - ${A}`),this._aborted=!0;return}this._decMemoryLimit=t;let i=e.params[1]===1?0:Ut(this._coreTerminal._core._inputHandler._curAttrData,this._coreTerminal._core._themeService?.colors);this._dec.init(i,this._palette,this._opts.sixelPaletteLimit)}_returnDecoder(){let e=this._dec;e&&(this._dec=void 0,this._palette.set(e.palette),$e(e,this._decMemoryLimit))}put(e,t,i){if(!(this._aborted||!this._dec)){if(this._size+=i-t,this._size>this._opts.sixelSizeLimit){console.warn("SIXEL: too much data, aborting"),this._aborted=!0,this._dec.release();return}try{this._dec.decode(e,t,i)}catch(A){console.warn(`SIXEL: error while decoding image - ${A}`),this._aborted=!0,this._dec.release()}}}unhook(e){try{return this._unhook(e)}finally{this._returnDecoder()}}_unhook(e){if(this._aborted||!e||!this._dec)return!0;let t=this._dec.width,i=this._dec.height;if(!t||!i)return i&&this._storage.advanceCursor(i),!0;let A=D.createCanvas(void 0,t,i);return A.getContext("2d")?.putImageData(new ImageData(this._dec.data8,t,i),0,0),this._storage.addImage(A),!0}};function Ut(r,e){let t=0;if(!e)return t;if(r.isInverse())if(r.isFgDefault())t=ae(e.foreground.rgba);else if(r.isFgRGB()){let i=r.constructor.toColorRGB(r.getFgColor());t=(0,y.toRGBA8888)(...i)}else t=ae(e.ansi[r.getFgColor()].rgba);else if(r.isBgDefault())t=ae(e.background.rgba);else if(r.isBgRGB()){let i=r.constructor.toColorRGB(r.getBgColor());t=(0,y.toRGBA8888)(...i)}else t=ae(e.ansi[r.getBgColor()].rgba);return t}function ae(r){return y.BIG_ENDIAN?r:(r&255)<<24|(r>>>8&255)<<16|(r>>>16&255)<<8|r>>>24&255}var de=class{constructor(e,t,i,A){this._storage=e;this._opts=t;this._renderer=i;this._terminal=A;this._addImageOpts={scrolling:!0,layer:"top",zIndex:0,cursorPos:"vt340"}}addImage(e){this._addImageOpts.scrolling=this._opts.sixelScrolling,this._storage.addImage(e,this._addImageOpts)}advanceCursor(e){if(this._opts.sixelScrolling){let t=this._renderer.cellSize;(t.width===-1||t.height===-1)&&(t=w);let i=Math.ceil(e/t.height);for(let A=1;A<i;++A)this._terminal._core._inputHandler.lineFeed()}}};var ge=class{constructor(e){this._storage=e;this._addImageOpts={scrolling:!0,layer:"top",zIndex:0,cursorPos:"iip"}}addImage(e){this._storage.addImage(e,this._addImageOpts)}};var et={enableSizeReports:!0,pixelLimit:16777216,sixelSupport:!0,sixelScrolling:!0,sixelPaletteLimit:4096,sixelSizeLimit:33554432,storageLimit:128,showPlaceholder:!0,iipSupport:!0,iipSizeLimit:33554432,kittySupport:!0,kittySizeLimit:33554432},tt=4096;var it=class{constructor(e){this._disposables=[];this._handlers=new Map;this._onImageAdded=new Z;this.onImageAdded=this._onImageAdded.event;this._opts=Object.assign({},et,e),this._defaultOpts=Object.assign({},et,e)}dispose(){for(let e of this._handlers.values())e.reset();for(let e of this._disposables)e.dispose();this._disposables.length=0,this._handlers.clear(),this._onImageAdded.dispose()}_disposeLater(...e){for(let t of e)this._disposables.push(t)}activate(e){if(this._terminal=e,this._renderer=new D(e),this._storage=new V(e,this._renderer,this._opts),this._storage.onImageAdded=()=>this._onImageAdded.fire(),this._opts.enableSizeReports){let t=e.options.windowOptions??{};t.getWinSizePixels=!0,t.getCellSizePixels=!0,t.getWinSizeChars=!0,e.options.windowOptions=t}if(this._disposeLater(this._renderer,this._storage,e.parser.registerCsiHandler({prefix:"?",final:"h"},t=>this._decset(t)),e.parser.registerCsiHandler({prefix:"?",final:"l"},t=>this._decrst(t)),e.parser.registerCsiHandler({final:"c"},t=>this._da1(t)),e.parser.registerCsiHandler({prefix:"?",final:"S"},t=>this._xtermGraphicsAttributes(t)),e.onRender(t=>this._storage?.render(t)),e.parser.registerCsiHandler({intermediates:"!",final:"p"},()=>this.reset()),e.parser.registerEscHandler({final:"c"},()=>this.reset()),e._core._inputHandler.onRequestReset(()=>this.reset()),e.buffer.onBufferChange(()=>this._storage?.wipeAlternate()),e.onResize(t=>this._storage?.viewportResize(t))),this._opts.sixelSupport){let t=new de(this._storage,this._opts,this._renderer,e),i=new oe(this._opts,t,e);this._handlers.set("sixel",i),this._disposeLater(e._core._inputHandler._parser.registerDcsHandler({final:"q"},i))}if(this._opts.iipSupport){let t=new ge(this._storage),i=new ie(this._opts,this._renderer,t,e);this._handlers.set("iip",i),this._disposeLater(e._core._inputHandler._parser.registerOscHandler(1337,i))}if(this._opts.kittySupport){let t=new re(this._storage),i=new Ae(this._opts,this._renderer,t,e);this._handlers.set("kitty",i),this._disposeLater(t,i,e._core._inputHandler._parser.registerApcHandler({final:"G"},i))}}reset(){this._opts.sixelScrolling=this._defaultOpts.sixelScrolling,this._opts.sixelPaletteLimit=this._defaultOpts.sixelPaletteLimit,this._storage?.reset();for(let e of this._handlers.values())e.reset();return!1}get storageLimit(){return this._storage?.getLimit()||-1}set storageLimit(e){this._storage?.setLimit(e),this._opts.storageLimit=e}get storageUsage(){return this._storage?this._storage.getUsage():-1}get showPlaceholder(){return this._opts.showPlaceholder}set showPlaceholder(e){this._opts.showPlaceholder=e,this._renderer?.showPlaceholder(e)}getImageAtBufferCell(e,t){return this._storage?.getImageAtBufferCell(e,t)}extractTileAtBufferCell(e,t){return this._storage?.extractTileAtBufferCell(e,t)}_report(e){this._terminal?._core.input(e,!1)}_decset(e){for(let t=0;t<e.length;++t)e[t]===80&&(this._opts.sixelScrolling=!1);return!1}_decrst(e){for(let t=0;t<e.length;++t)e[t]===80&&(this._opts.sixelScrolling=!0);return!1}_da1(e){return e[0]?!0:this._opts.sixelSupport?(this._report("\x1B[?62;4;9;22c"),!0):!1}_xtermGraphicsAttributes(e){if(e.length<2)return!0;if(e[0]===1)switch(e[1]){case 1:return this._report(`\x1B[?${e[0]};0;${this._opts.sixelPaletteLimit}S`),!0;case 2:this._opts.sixelPaletteLimit=this._defaultOpts.sixelPaletteLimit,this._report(`\x1B[?${e[0]};0;${this._opts.sixelPaletteLimit}S`);for(let t of this._handlers.values())t.reset();return!0;case 3:return e.length>2&&!(e[2]instanceof Array)&&e[2]<=tt?(this._opts.sixelPaletteLimit=e[2],this._report(`\x1B[?${e[0]};0;${this._opts.sixelPaletteLimit}S`)):this._report(`\x1B[?${e[0]};2S`),!0;case 4:return this._report(`\x1B[?${e[0]};0;${tt}S`),!0;default:return this._report(`\x1B[?${e[0]};2S`),!0}if(e[0]===2)switch(e[1]){case 1:let t=this._renderer?.dimensions?.css.canvas.width,i=this._renderer?.dimensions?.css.canvas.height;if(!t||!i){let s=w;t=(this._terminal?.cols||80)*s.width,i=(this._terminal?.rows||24)*s.height}if(t*i<this._opts.pixelLimit)this._report(`\x1B[?${e[0]};0;${t.toFixed(0)};${i.toFixed(0)}S`);else{let s=Math.floor(Math.sqrt(this._opts.pixelLimit));this._report(`\x1B[?${e[0]};0;${s};${s}S`)}return!0;case 4:let A=Math.floor(Math.sqrt(this._opts.pixelLimit));return this._report(`\x1B[?${e[0]};0;${A};${A}S`),!0;default:return this._report(`\x1B[?${e[0]};2S`),!0}return this._report(`\x1B[?${e[0]};1S`),!0}};export{it as ImageAddon};
  //# sourceMappingURL=addon-image.mjs.map
 diff --git a/lib/addon-image.mjs.map b/lib/addon-image.mjs.map
-index d376d495d729b9d6ed3b2ea1f7a5eeb3960d2697..1b68019e5d41d34664cd151b2c7d47ef4feff4dd 100644
+index d376d495d729b9d6ed3b2ea1f7a5eeb3960d2697..0092ce32d3298f4416915a9255ddcb777e30b873 100644
 --- a/lib/addon-image.mjs.map
 +++ b/lib/addon-image.mjs.map
 @@ -1,7 +1,7 @@
@@ -39,15 +39,28 @@ index d376d495d729b9d6ed3b2ea1f7a5eeb3960d2697..1b68019e5d41d34664cd151b2c7d47ef
 -  "sourcesContent": [null, "\"use strict\";\n/**\n * Copyright (c) 2022, 2026 Joerg Breitbart\n * @license MIT\n */\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.InWasm = InWasm;\nlet z = (s) => {\n    if (Uint8Array.fromBase64)\n        return Uint8Array.fromBase64(s);\n    if (typeof Buffer !== 'undefined')\n        return Buffer.from(s, 'base64');\n    const b = atob(s);\n    const r = new Uint8Array(b.length);\n    for (let i = 0; i < r.length; ++i)\n        r[i] = b.charCodeAt(i);\n    return r;\n};\nfunction InWasm(def) {\n    if (def.d) {\n        const { t, s, d } = def;\n        let b;\n        let m;\n        const W = WebAssembly;\n        if (t === 0 /* OutputType.INSTANCE */) {\n            if (s)\n                return (e) => new W.Instance(m || (m = new W.Module(b || (b = z(d)))), e);\n            return (e) => m\n                ? W.instantiate(m, e)\n                : W.instantiate(b || (b = z(d)), e).then(r => (m = r.module) && r.instance);\n        }\n        if (t === 1 /* OutputType.MODULE */) {\n            if (s)\n                return () => m || (m = new W.Module(b || (b = z(d))));\n            return () => m\n                ? Promise.resolve(m)\n                : W.compile(b || (b = z(d))).then(r => m = r);\n        }\n        if (s)\n            return () => b || (b = z(d));\n        return () => Promise.resolve(b || (b = z(d)));\n    }\n    if (typeof _wasmCtx === 'undefined')\n        throw new Error('must run \"inwasm\"');\n    _wasmCtx.add(def);\n}\n//# sourceMappingURL=index.js.map", "\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\n/**\n * Copyright (c) 2023, 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n */\nconst inwasm_runtime_1 = require(\"inwasm-runtime\");\n/**\n * wasm base64 decoder.\n */\nconst wasmDecode = (0, inwasm_runtime_1.InWasm)(/*inwasm#828e69684093b2c6:rdef-start:\"decode\"*/{s:1,t:0,d:'AGFzbQEAAAABBQFgAAF/Ag8BA2VudgZtZW1vcnkCAAEDAwIAAAcNAgNkZWMAAANlbmQAAQqLBgKZBAEKf0GIKCgCAEGgKGohAUGEKCgCACIDQaAoaiEAQYAoKAIAQQFrQXxxIgRBoChqIQUgBEEQayADSgRAIARBkChqIQMDQCABIABBA2otAABBAnQoAoAgIABBAmotAABBAnQoAoAYIABBAWotAABBAnQoAoAQIAAtAABBAnQoAoAIcnJyIgY2AgAgAUEDaiAAQQdqLQAAQQJ0KAKAICAAQQZqLQAAQQJ0KAKAGCAAQQVqLQAAQQJ0KAKAECAAQQRqLQAAQQJ0KAKACHJyciIHNgIAIAFBBmogAEELai0AAEECdCgCgCAgAEEKai0AAEECdCgCgBggAEEJai0AAEECdCgCgBAgAEEIai0AAEECdCgCgAhycnIiCDYCACABQQlqIABBD2otAABBAnQoAoAgIABBDmotAABBAnQoAoAYIABBDWotAABBAnQoAoAQIABBDGotAABBAnQoAoAIcnJyIgk2AgAgAiAGciAHciAIciAJciECIAFBDGohASAAQRBqIgAgA0kNAAsLIAAgBUkEQANAIAEgAEEDai0AAEECdCgCgCAgAEECai0AAEECdCgCgBggAEEBai0AAEECdCgCgBAgAC0AAEECdCgCgAhycnIiAzYCACACIANyIQIgAUEDaiEBIABBBGoiACAFSQ0ACwtBfyEAIAJB////B00Ef0GEKCAENgIAQYgoIAFBoChrNgIAQQAFQX8LC+0BAQR/AkBBgCgoAgAiAUGEKCgCACIAa0EFTgRAQX8hAxAADQFBgCgoAgAhAUGEKCgCACEAC0F/IQMgASAAayIBQQJIDQAgAC0AoShBAnQoAoAQIAAtAKAoQQJ0KAKACHIhAgJ/IAFBBEYEQEEDQQQgAC0AoyhBPUYbIAAtAKIoQT1GayEBC0EBIAFBA0kNABogAC0AoihBAnQoAoAYIAJyIQJBAiABQQRHDQAaIAAtAKMoQQJ0KAKAICACciECQQMLIQEgAkH///8HSw0AQQAhA0GIKCgCACIAIAI2AKAoQYgoIAAgAWo2AgALIAML'}/*inwasm#828e69684093b2c6:rdef-end:\"decode\"*/);\n// SIMD version (speedup ~1.4x, not covered by tests yet)\n/*\nconst wasmDecode = InWasm({\n  name: 'decode',\n  type: OutputType.INSTANCE,\n  mode: OutputMode.SYNC,\n  srctype: 'Clang-C',\n  imports: {\n    env: { memory: new WebAssembly.Memory({ initial: 1 }) }\n  },\n  exports: {\n    dec: () => 0,\n    end: () => 0\n  },\n  compile: {\n    switches: ['-msimd128', '-Wl,-z,stack-size=0', '-Wl,--stack-first']\n  },\n  code: `\n    #include <wasm_simd128.h>\n    typedef struct {\n      unsigned int wp;\n      unsigned int sp;\n      unsigned int dp;\n      unsigned int e_size;\n      unsigned int dummy[4];\n      unsigned char data[0];\n    } State;\n\n    unsigned int *D0 = (unsigned int *) ${P32.D0 * 4};\n    unsigned int *D1 = (unsigned int *) ${P32.D1 * 4};\n    unsigned int *D2 = (unsigned int *) ${P32.D2 * 4};\n    unsigned int *D3 = (unsigned int *) ${P32.D3 * 4};\n    State *state = (State *) ${P32.STATE * 4};\n\n    #define packed_byte(x) wasm_i8x16_splat((char) x)\n    #define packed_dword(x) wasm_i32x4_splat(x)\n    #define masked(x, mask) wasm_v128_and(x, wasm_i32x4_splat(mask))\n\n    __attribute__((noinline)) int dec() {\n      unsigned int nsp = (state->wp - 1) & ~3;\n      unsigned char *src = state->data + state->sp;\n      unsigned char *end = state->data + nsp;\n      unsigned char *dst = state->data + state->dp;\n      unsigned int error = 0;\n\n      v128_t err = wasm_i8x16_splat(0);\n      unsigned char *end16 = state->data + (nsp & ~15);\n      while (src < end16) {\n        v128_t data = wasm_v128_load((v128_t *) src);\n\n        // wasm-simd rewrite of http://0x80.pl/notesen/2016-01-17-sse-base64-decoding.html#vector-lookup-pshufb\n        const v128_t higher_nibble = wasm_u32x4_shr(data, 4) & packed_byte(0x0f);\n        const char linv = 1;\n        const char hinv = 0;\n\n        const v128_t lower_bound_LUT = wasm_i8x16_const(\n          // order: 0 1 2 3 4 5 6 7 8 9 a b c d e f\n          linv, linv, 0x2b, 0x30,\n          0x41, 0x50, 0x61, 0x70,\n          linv, linv, linv, linv,\n          linv, linv, linv, linv\n        );\n        const v128_t upper_bound_LUT = wasm_i8x16_const(\n          // order: 0 1 2 3 4 5 6 7 8 9 a b c d e f\n          hinv, hinv, 0x2b, 0x39,\n          0x4f, 0x5a, 0x6f, 0x7a,\n          hinv, hinv, hinv, hinv,\n          hinv, hinv, hinv, hinv\n        );\n        // the difference between the shift and lower bound\n        const v128_t shift_LUT = wasm_i8x16_const(\n          // order: 0 1 2 3 4 5 6 7 8 9 a b c d e f\n          0x00,        0x00,        0x3e - 0x2b, 0x34 - 0x30,\n          0x00 - 0x41, 0x0f - 0x50, 0x1a - 0x61, 0x29 - 0x70,\n          0x00,        0x00,        0x00,        0x00,\n          0x00,        0x00,        0x00,        0x00\n        );\n\n        const v128_t upper_bound = wasm_i8x16_swizzle(upper_bound_LUT, higher_nibble);\n        const v128_t lower_bound = wasm_i8x16_swizzle(lower_bound_LUT, higher_nibble);\n\n        const v128_t below = wasm_i8x16_lt(data, lower_bound);\n        const v128_t above = wasm_i8x16_gt(data, upper_bound);\n        const v128_t eq_2f = wasm_i8x16_eq(data, packed_byte(0x2f));\n\n        // in_range = not (below or above) or eq_2f\n        // outside  = not in_range = below or above and not eq_2f (from deMorgan law)\n        const v128_t outside = wasm_v128_andnot(eq_2f, above | below);\n        err = wasm_v128_or(err, outside);\n\n        const v128_t shift  = wasm_i8x16_swizzle(shift_LUT, higher_nibble);\n        const v128_t t0     = wasm_i8x16_add(data, shift);\n        v128_t v = wasm_i8x16_add(t0, wasm_v128_and(eq_2f, packed_byte(-3)));\n\n        // pack bytes\n        const v128_t ca = masked(v, 0x003f003f);\n        const v128_t db = masked(v, 0x3f003f00);\n        const v128_t t00 = wasm_v128_or(wasm_u32x4_shr(db, 8), wasm_i32x4_shl(ca, 6));\n        v128_t res = wasm_v128_or(wasm_u32x4_shr(t00, 16), wasm_i32x4_shl(t00, 12));\n        res = wasm_i8x16_swizzle(res, wasm_i8x16_const(2, 1, 0, 6, 5, 4, 10, 9, 8, 14, 13, 12, 16, 16, 16, 16));\n\n        wasm_v128_store((v128_t *) dst, res);\n        dst += 12;\n        src += 16;\n      }\n      //if (wasm_i8x16_bitmask(err) != 0) return -1;\n      if (wasm_v128_any_true(err)) return -1;\n\n      // operate on 4-byte blocks\n      while (src < end) {\n        error |= *((unsigned int *) dst) = D0[src[0]] | D1[src[1]] | D2[src[2]] | D3[src[3]];\n        dst += 3;\n        src += 4;\n      }\n      if (error >> 24) return -1;\n      state->sp = nsp;\n      state->dp = dst - state->data;\n      return 0;\n    }\n\n    int end() {\n      int rem = state->wp - state->sp;\n      if (rem > 4 && dec()) return -1;\n      rem = state->wp - state->sp;\n      if (rem < 2) return -1;\n\n      unsigned char *src = state->data + state->sp;\n      if (rem == 4) {\n        if (src[3] == 61) rem--;\n        if (src[2] == 61) rem--;\n      }\n      unsigned int accu = D0[src[0]] | D1[src[1]];\n      int dp = 1;\n      if (rem > 2) {\n        accu |= D2[src[2]];\n        dp++;\n        if (rem == 4) {\n          accu |= D3[src[3]];\n          dp++;\n        }\n      }\n      if (accu >> 24) return -1;\n      *((unsigned int *) (state->data + state->dp)) = accu;\n      state->dp += dp;\n      return 0;\n    }\n    `\n});\n*/\n// base64 map\nconst MAP = new Uint8Array('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'\n    .split('')\n    .map(el => el.charCodeAt(0)));\n// init decoder maps in LE order\nconst D = new Uint32Array(1024);\nD.fill(0xFF000000);\nfor (let i = 0; i < MAP.length; ++i)\n    D[MAP[i]] = i << 2;\nfor (let i = 0; i < MAP.length; ++i)\n    D[256 + MAP[i]] = i >> 4 | ((i << 4) & 0xFF) << 8;\nfor (let i = 0; i < MAP.length; ++i)\n    D[512 + MAP[i]] = (i >> 2) << 8 | ((i << 6) & 0xFF) << 16;\nfor (let i = 0; i < MAP.length; ++i)\n    D[768 + MAP[i]] = i << 16;\nconst EMPTY = new Uint8Array(0);\n/**\n * base64 stream decoder.\n *\n * Features / assumptions:\n * - lazy chunkwise decoding\n * - errors out on any non base64 chars (no support for NL formatted base64)\n * - decodes in wasm\n * - inplace decoding to save memory\n * - supports a keepSize for lazy memory release\n */\nclass Base64Decoder {\n    /**\n     * @param keepSize Keep the wasm instance below this limit when calling `release()`.\n     * @param maxBytes Max allowed bytes to allocate.\n     * @param initialBytes Initial bytes to allocate.\n     */\n    constructor(keepSize, maxBytes, initialBytes) {\n        this._inst = null;\n        this._ended = true;\n        this._bytes = 0;\n        this.keepSize = keepSize !== null && keepSize !== void 0 ? keepSize : 1048576 /* Bytes.KEEP */;\n        this.maxBytes = maxBytes !== null && maxBytes !== void 0 ? maxBytes : 4294901760 /* Bytes.MAX */;\n        this._bytes = initialBytes !== null && initialBytes !== void 0 ? initialBytes : 32768 /* Bytes.INITIAL */;\n        if (this._bytes > this.maxBytes || this.maxBytes > 4294901760 /* Bytes.MAX */) {\n            throw new Error('invalid byte settings');\n        }\n    }\n    /**\n     * Currently decoded bytes (borrowed).\n     * Must be accessed before calling `release` or `init`.\n     */\n    get data8() {\n        return this._inst ? this._d.subarray(0, this._m32[1282 /* P32.STATE_DP */]) : EMPTY;\n    }\n    /**\n     * Release memory conditionally based on `keepSize`.\n     * If memory gets released, also the wasm instance will be freed and recreated on next `init`,\n     * otherwise the instance will be reused.\n     */\n    release() {\n        if (!this._inst)\n            return;\n        if (this._bytes > this.keepSize) {\n            this._inst = this._m32 = this._d = this._mem = null;\n        }\n        else {\n            this._m32[1280 /* P32.STATE_WP */] = 0;\n            this._m32[1281 /* P32.STATE_SP */] = 0;\n            this._m32[1282 /* P32.STATE_DP */] = 0;\n        }\n    }\n    /**\n     * Initializes the decoder for new base64 data.\n     * Must be called before doing any decoding attempts.\n     * The method will either spawn a new wasm instance or grow\n     * the needed memory of an existing instance.\n     * @param maxBytes Max allowed bytes to allocate (overwrites ctor value).\n     * @param initialBytes Initial bytes to allocate (overwrites ctor value).\n     */\n    init(maxBytes, initialBytes) {\n        this.maxBytes = maxBytes !== null && maxBytes !== void 0 ? maxBytes : this.maxBytes;\n        this._bytes = initialBytes !== null && initialBytes !== void 0 ? initialBytes : Math.min(this._bytes, this.maxBytes);\n        if (this._bytes > this.maxBytes || this.maxBytes > 4294901760 /* Bytes.MAX */) {\n            throw Error('invalid byte settings');\n        }\n        let m = this._m32;\n        const bytes = this._bytes + 5152 /* Bytes._DATA_OFFSET */;\n        if (!this._inst) {\n            this._mem = new WebAssembly.Memory({ initial: Math.ceil(bytes / 65536) });\n            this._inst = wasmDecode({ env: { memory: this._mem } });\n            m = new Uint32Array(this._mem.buffer, 0);\n            m.set(D, 256 /* P32.D0 */);\n            this._d = new Uint8Array(this._mem.buffer, 5152 /* Bytes._DATA_OFFSET */);\n        }\n        else if (this._mem.buffer.byteLength < bytes) {\n            this._mem.grow(Math.ceil((bytes - this._mem.buffer.byteLength) / 65536));\n            m = new Uint32Array(this._mem.buffer, 0);\n            this._d = new Uint8Array(this._mem.buffer, 5152 /* Bytes._DATA_OFFSET */);\n        }\n        m[1280 /* P32.STATE_WP */] = 0;\n        m[1281 /* P32.STATE_SP */] = 0;\n        m[1282 /* P32.STATE_DP */] = 0;\n        this._m32 = m;\n        this._ended = false;\n    }\n    /**\n     * Realloc memory. Realloc only happens, if the requested\n     * size doesn't fit in the current memory.\n     * The new size will be capped by `maxBytes`.\n     * @param requested Bytes to be stored.\n     */\n    _realloc(requested) {\n        const needed = this._m32[1280 /* P32.STATE_WP */] + requested;\n        if (this._bytes < needed) {\n            if (needed > this.maxBytes) {\n                return -3 /* DecodeStatus.SIZE_EXCEEDED */;\n            }\n            let newSize = this._bytes;\n            while ((newSize *= 2) < needed) { }\n            newSize = Math.min(newSize, this.maxBytes);\n            if (newSize < needed) {\n                return -3 /* DecodeStatus.SIZE_EXCEEDED */;\n            }\n            if (newSize + 5152 /* Bytes._DATA_OFFSET */ > this._mem.buffer.byteLength) {\n                const addPages = Math.ceil((newSize + 5152 /* Bytes._DATA_OFFSET */ - this._mem.buffer.byteLength) / 65536);\n                this._mem.grow(addPages);\n                this._m32 = new Uint32Array(this._mem.buffer, 0);\n                this._d = new Uint8Array(this._mem.buffer, 5152 /* Bytes._DATA_OFFSET */);\n            }\n            this._bytes = newSize;\n        }\n        return 0 /* DecodeStatus.OK */;\n    }\n    /**\n     * Put bytes in `data` into the decoder.\n     * Additionally decodes the payload, if it reached 2^17 bytes.\n     * The return value indicates the type of issue.\n     * @param data Bytes to be loaded.\n     */\n    put(data) {\n        if (!this._inst || this._ended) {\n            return -2 /* DecodeStatus.NOT_INITIALIZED */;\n        }\n        if (this._realloc(data.length)) {\n            return -3 /* DecodeStatus.SIZE_EXCEEDED */;\n        }\n        const m = this._m32;\n        this._d.set(data, m[1280 /* P32.STATE_WP */]);\n        m[1280 /* P32.STATE_WP */] += data.length;\n        // max chunk in input handler is 2^17, try to run in \"tandem mode\"\n        return m[1280 /* P32.STATE_WP */] - m[1281 /* P32.STATE_SP */] >= 131072\n            ? this._inst.exports.dec()\n            : 0 /* DecodeStatus.OK */;\n    }\n    /**\n     * End the current decoding.\n     * Also decodes leftover payload from previous put calls.\n     */\n    end() {\n        this._ended = true;\n        return this._inst\n            ? this._inst.exports.end()\n            : -2 /* DecodeStatus.NOT_INITIALIZED */;\n    }\n    /**\n     * Bytes loaded into the decoder.\n     */\n    get loadedBytes() {\n        return this._inst\n            ? this._m32[1280 /* P32.STATE_WP */]\n            : 0;\n    }\n    /**\n     * Free bytes to feed to the decoder.\n     */\n    get freeBytes() {\n        return this._inst\n            ? this.maxBytes - this._m32[1280 /* P32.STATE_WP */]\n            : 0;\n    }\n}\nexports.default = Base64Decoder;\n//# sourceMappingURL=Base64Decoder.wasm.js.map", "\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\n/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\nconst inwasm_runtime_1 = require(\"inwasm-runtime\");\nconst wasmQoiDecode = (0, inwasm_runtime_1.InWasm)(/*inwasm#459f9e1bfb80b1a8:rdef-start:\"qoi_decode\"*/{s:1,t:0,d:'AGFzbQEAAAABCgJgAABgA39/fwACDwEDZW52Bm1lbW9yeQIAAQMDAgABBwcBA2RlYwABCAEACu4EAgwAQQBBAEGAAvwLAAveBAEJf0EAQQBBgAL8CwAgAUEXTgRAIAAgAWpBCGshCkGACCEBIAJBAnRBgAhqIQsgAEEOaiEDQf8BIQZBACECA0AgA0EBaiEHIAMtAAAiCEE/cSEAAkACQCAIQcABcSIJRQRAIABBAnQiAC0AAyEGIAAtAAIhBCAALQABIQUgAC0AACECIAchAwwBCwJAIAhB/QFLDQAgCUHAAUcNACAFQQVsIAJBA2xqIARBB2xqIAZBC2xqQT9xQQJ0IgMgBDoAAiADIAU6AAEgAyACOgAAIANBA2ogBjoAAANAIAEgAjoAACABQQNqIAY6AAAgAUECaiAEOgAAIAFBAWogBToAACABQQRqIQEgAEUEQCAHIQMMBAsgAEEBayEAIAEgC0kNAAsgByEDDAILAn8CQAJAAkAgCEH+AWsOAgABAgsgAy0AAyEEIAMtAAIhBSADLQABIQIgA0EEagwCCyADKAIBIgJBGHYhBiACQRB2IQQgAkEIdiEFIANBBWoMAQsgCUGAAUcEQCAHIAlBwABHDQEaIAQgCEEDcWpBAmshBCACIABBBHZqQQJrIQIgBSAIQQJ2QQNxakECayEFIAcMAQsgBCAAQShrIgkgAy0AASIHQQ9xamohBCACIAdBBHYgCWpqIQIgACAFakEgayEFIANBAmoLIQMgBUEFbCACQQNsaiAEQQdsaiAGQQtsakE/cUECdCIAIAQ6AAIgACAFOgABIAAgAjoAACAAQQNqIAY6AAALIAEgBjoAAyABIAQ6AAIgASAFOgABIAEgAjoAACABQQRqIQELIAMgCkkNAAsLCw=='}/*inwasm#459f9e1bfb80b1a8:rdef-end:\"qoi_decode\"*/);\nclass QoiDecoder {\n    constructor(keepSize) {\n        this.keepSize = keepSize;\n        this.width = 0;\n        this.height = 0;\n    }\n    decode(d) {\n        this.width = d[4] << 24 | d[5] << 16 | d[6] << 8 | d[7];\n        this.height = d[8] << 24 | d[9] << 16 | d[10] << 8 | d[11];\n        const pixels = this.width * this.height;\n        const ib = pixels * 4;\n        const dl = d.length;\n        /**\n         * byte/offset calculation:\n         * To save some memory we dont reserve full memory for decoded + encoded,\n         * but place encoded at the end of decoded plus 50% security distance\n         * to avoid reads before writes positions:\n         *\n         * encoded < decoded (good compression)\n         *    enc                                              ####################\n         *    dec                 #######################################\n         *                        ^                            ^\n         *                        DST_P                        CHUNK_P\n         *\n         * encoded > decoded (degenerated compression, should not happen)\n         *    enc                           ##############################\n         *    dec                 ####################\n         *                        ^         ^\n         *                        DST_P     CHUNK_P\n         *\n         * There is still a chance for overlapping r/w positions in case the compressed\n         * data has very different pixel progression, yet the 50% security distance\n         * should deal with that, as QOI will bloat data by 25% at max (RGB -> OP byte + RGB).\n         * Since we always assume RGBA at decoding stage, the possible bloat reduces to 20% at max.\n         */\n        const bytes = Math.max(ib, dl) + (Math.min(ib, dl) >> 1) + 4096;\n        if (!this._inst) {\n            this._mem = new WebAssembly.Memory({ initial: Math.ceil(bytes / 65536) });\n            this._inst = wasmQoiDecode({ env: { memory: this._mem } });\n        }\n        else if (this._mem.buffer.byteLength < bytes) {\n            this._mem.grow(Math.ceil((bytes - this._mem.buffer.byteLength) / 65536));\n            this._d = null;\n        }\n        if (!this._d) {\n            this._d = new Uint8Array(this._mem.buffer);\n        }\n        // put src data at the end of memory, also align to 256\n        const chunkP = (this._mem.buffer.byteLength - dl) & ~0xFF;\n        this._d.set(d, chunkP);\n        this._inst.exports.dec(chunkP, dl, pixels);\n        return this._d.subarray(1024 /* P8.DST_P */, 1024 /* P8.DST_P */ + ib);\n    }\n    release() {\n        if (!this._inst)\n            return;\n        if (this._mem.buffer.byteLength > this.keepSize) {\n            this._inst = this._d = this._mem = null;\n        }\n    }\n}\nexports.default = QoiDecoder;\n//# sourceMappingURL=QoiDecoder.wasm.js.map", null, null, "/**\n * Copyright (c) 2024-2026 The xterm.js authors. All rights reserved.\n * @license MIT\n *\n * Minimal lifecycle utilities for xterm.js core.\n * Simplified from VS Code's lifecycle.ts - no tracking/leak detection.\n */\n\nexport interface IDisposable {\n  dispose(): void;\n}\n\nexport function toDisposable(fn: () => void): IDisposable {\n  return { dispose: fn };\n}\n\nexport function dispose<T extends IDisposable>(disposable: T): T;\nexport function dispose<T extends IDisposable>(disposable: T | undefined): T | undefined;\nexport function dispose<T extends IDisposable>(disposables: T[]): T[];\nexport function dispose<T extends IDisposable>(arg: T | T[] | undefined): T | T[] | undefined {\n  if (!arg) {\n    return arg;\n  }\n  if (Array.isArray(arg)) {\n    for (const d of arg) {\n      d.dispose();\n    }\n    return [];\n  }\n  arg.dispose();\n  return arg;\n}\n\nexport function combinedDisposable(...disposables: IDisposable[]): IDisposable {\n  return toDisposable(() => dispose(disposables));\n}\n\nexport class DisposableStore implements IDisposable {\n  private readonly _disposables = new Set<IDisposable>();\n  private _isDisposed = false;\n\n  public get isDisposed(): boolean {\n    return this._isDisposed;\n  }\n\n  public add<T extends IDisposable>(o: T): T {\n    if (this._isDisposed) {\n      o.dispose();\n    } else {\n      this._disposables.add(o);\n    }\n    return o;\n  }\n\n  public dispose(): void {\n    if (this._isDisposed) {\n      return;\n    }\n    this._isDisposed = true;\n    for (const d of this._disposables) {\n      d.dispose();\n    }\n    this._disposables.clear();\n  }\n\n  public clear(): void {\n    for (const d of this._disposables) {\n      d.dispose();\n    }\n    this._disposables.clear();\n  }\n}\n\nexport abstract class Disposable implements IDisposable {\n  public static readonly None: IDisposable = Object.freeze({ dispose() { } });\n\n  protected readonly _store = new DisposableStore();\n\n  public dispose(): void {\n    this._store.dispose();\n  }\n\n  protected _register<T extends IDisposable>(o: T): T {\n    return this._store.add(o);\n  }\n}\n\nexport class MutableDisposable<T extends IDisposable> implements IDisposable {\n  private _value: T | undefined;\n  private _isDisposed = false;\n\n  public get value(): T | undefined {\n    return this._isDisposed ? undefined : this._value;\n  }\n\n  public set value(value: T | undefined) {\n    if (this._isDisposed || value === this._value) {\n      return;\n    }\n    this._value?.dispose();\n    this._value = value;\n  }\n\n  public clear(): void {\n    this.value = undefined;\n  }\n\n  public dispose(): void {\n    this._isDisposed = true;\n    this._value?.dispose();\n    this._value = undefined;\n  }\n}\n", "/**\n * Copyright (c) 2024-2026 The xterm.js authors. All rights reserved.\n * @license MIT\n *\n * Minimal event utilities for xterm.js core.\n * Simplified from VS Code's event.ts - no leak detection/profiling.\n */\n\nimport { IDisposable, DisposableStore, toDisposable } from './Lifecycle';\n\nexport interface IEvent<T> {\n  (listener: (e: T) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore): IDisposable;\n}\n\nexport class Emitter<T> {\n  private _listeners: { fn: (e: T) => any, thisArgs: any }[] = [];\n  private _disposed = false;\n  private _event: IEvent<T> | undefined;\n\n  public get event(): IEvent<T> {\n    if (this._event) {\n      return this._event;\n    }\n    this._event = (listener: (e: T) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore) => {\n      if (this._disposed) {\n        return toDisposable(() => {});\n      }\n\n      const entry = { fn: listener, thisArgs };\n      this._listeners = this._listeners.slice();\n      this._listeners.push(entry);\n\n      const result = toDisposable(() => {\n        const idx = this._listeners.indexOf(entry);\n        if (idx !== -1) {\n          this._listeners = this._listeners.slice();\n          this._listeners.splice(idx, 1);\n        }\n      });\n\n      if (disposables) {\n        if (Array.isArray(disposables)) {\n          disposables.push(result);\n        } else {\n          disposables.add(result);\n        }\n      }\n\n      return result;\n    };\n    return this._event;\n  }\n\n  public fire(event: T): void {\n    if (this._disposed || !this._listeners.length) {\n      return;\n    }\n    if (this._listeners.length === 1) {\n      this._listeners[0].fn.call(this._listeners[0].thisArgs, event);\n      return;\n    }\n    const listeners = this._listeners;\n    for (let i = 0, len = listeners.length; i < len; ++i) {\n      listeners[i].fn.call(listeners[i].thisArgs, event);\n    }\n  }\n\n  public dispose(): void {\n    if (this._disposed) {\n      return;\n    }\n    this._disposed = true;\n    this._listeners.length = 0;\n  }\n}\n\nexport namespace EventUtils {\n  export function forward<T>(from: IEvent<T>, to: Emitter<T>): IDisposable {\n    return from(e => to.fire(e));\n  }\n\n  export function map<I, O>(event: IEvent<I>, map: (i: I) => O): IEvent<O> {\n    return (listener: (e: O) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore) => {\n      return event(i => listener.call(thisArgs, map(i)), undefined, disposables);\n    };\n  }\n\n  export function any<T>(...events: IEvent<T>[]): IEvent<T>;\n  export function any(...events: IEvent<any>[]): IEvent<void>;\n  export function any<T>(...events: IEvent<T>[]): IEvent<T> {\n    return (listener: (e: T) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore) => {\n      const store = new DisposableStore();\n      for (const event of events) {\n        store.add(event(e => listener.call(thisArgs, e)));\n      }\n      if (disposables) {\n        if (Array.isArray(disposables)) {\n          disposables.push(store);\n        } else {\n          disposables.add(store);\n        }\n      }\n      return store;\n    };\n  }\n\n  export function runAndSubscribe<T>(event: IEvent<T>, handler: (e: T) => void, initial: T): IDisposable;\n  export function runAndSubscribe<T>(event: IEvent<T>, handler: (e: T | undefined) => void): IDisposable;\n  export function runAndSubscribe<T>(event: IEvent<T>, handler: (e: T | undefined) => void, initial?: T): IDisposable {\n    handler(initial);\n    return event(e => handler(e));\n  }\n}\n", "/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { toRGBA8888 } from 'sixel/lib/Colors';\nimport { IDisposable } from '@xterm/xterm';\nimport { ICellSize, ImageLayer, ITerminalExt, IImageSpec, IRenderDimensions, IRenderService } from './Types';\nimport { Disposable, MutableDisposable, toDisposable } from 'common/Lifecycle';\n\nconst enum Constants {\n  PLACEHOLDER_LENGTH = 4096,\n  PLACEHOLDER_HEIGHT = 24\n}\n\n/**\n * ImageRenderer - terminal frontend extension:\n * - provide primitives for canvas, ImageData, Bitmap (static)\n * - add canvas layer to DOM (browser only for now)\n * - draw image tiles onRender\n */\nexport class ImageRenderer extends Disposable implements IDisposable {\n  /** @deprecated Kept for backward compat \u2014 points to top layer canvas. */\n  public get canvas(): HTMLCanvasElement | undefined { return this._layers.get('top')?.canvas; }\n  private _layers = new Map<ImageLayer, CanvasRenderingContext2D>();\n  private _placeholder: HTMLCanvasElement | undefined;\n  private _placeholderBitmap: ImageBitmap | undefined;\n  private _optionsRefresh = this._register(new MutableDisposable());\n  private _oldOpen: ((parent: HTMLElement) => void) | undefined;\n  private _renderService: IRenderService | undefined;\n  private _oldSetRenderer: ((renderer: any) => void) | undefined;\n\n  // drawing primitive - canvas\n  public static createCanvas(localDocument: Document | undefined, width: number, height: number): HTMLCanvasElement {\n    /**\n     * NOTE: We normally dont care, from which document the canvas\n     * gets created, so we can fall back to global document,\n     * if the terminal has no document associated yet.\n     * This way early image loads before calling .open keep working\n     * (still discouraged though, as the metrics will be screwed up).\n     * Only the DOM output canvas should be on the terminal's document,\n     * which gets explicitly checked in `insertLayerToDom`.\n     */\n    const canvas = (localDocument ?? document).createElement('canvas');\n    canvas.width = width | 0;\n    canvas.height = height | 0;\n    return canvas;\n  }\n\n  // drawing primitive - ImageData with optional buffer\n  public static createImageData(ctx: CanvasRenderingContext2D, width: number, height: number, buffer?: ArrayBuffer): ImageData {\n    if (typeof ImageData !== 'function') {\n      const imgData = ctx.createImageData(width, height);\n      if (buffer) {\n        imgData.data.set(new Uint8ClampedArray(buffer, 0, width * height * 4));\n      }\n      return imgData;\n    }\n    return buffer\n      ? new ImageData(new Uint8ClampedArray(buffer, 0, width * height * 4), width, height)\n      : new ImageData(width, height);\n  }\n\n  // drawing primitive - ImageBitmap\n  public static createImageBitmap(img: ImageBitmapSource): Promise<ImageBitmap | undefined> {\n    if (typeof createImageBitmap !== 'function') {\n      return Promise.resolve(undefined);\n    }\n    return createImageBitmap(img);\n  }\n\n\n  constructor(private _terminal: ITerminalExt) {\n    super();\n    this._oldOpen = this._terminal._core.open;\n    this._terminal._core.open = (parent: HTMLElement): void => {\n      this._oldOpen?.call(this._terminal._core, parent);\n      this._open();\n    };\n    if (this._terminal._core.screenElement) {\n      this._open();\n    }\n    // hack to spot fontSize changes\n    this._optionsRefresh.value = this._terminal._core.optionsService.onOptionChange(option => {\n      if (option === 'fontSize') {\n        this.rescaleCanvas();\n        this._renderService?.refreshRows(0, this._terminal.rows);\n      }\n    });\n    this._register(toDisposable(() => {\n      this.removeLayerFromDom();\n      this.removeLayerFromDom('bottom');\n      if (this._terminal._core && this._oldOpen) {\n        this._terminal._core.open = this._oldOpen;\n        this._oldOpen = undefined;\n      }\n      if (this._renderService && this._oldSetRenderer) {\n        this._renderService.setRenderer = this._oldSetRenderer;\n        this._oldSetRenderer = undefined;\n      }\n      this._renderService = undefined;\n      this._layers.clear();\n      this._placeholderBitmap?.close();\n      this._placeholderBitmap = undefined;\n      this._placeholder = undefined;\n    }));\n  }\n\n  /**\n   * Enable the placeholder.\n   */\n  public showPlaceholder(value: boolean): void {\n    if (value) {\n      if (!this._placeholder && this.cellSize.height !== -1) {\n        this._createPlaceHolder(Math.max(this.cellSize.height + 1, Constants.PLACEHOLDER_HEIGHT));\n      }\n    } else {\n      this._placeholderBitmap?.close();\n      this._placeholderBitmap = undefined;\n      this._placeholder = undefined;\n    }\n    this._renderService?.refreshRows(0, this._terminal.rows);\n  }\n\n  /**\n   * Dimensions of the terminal.\n   * Forwarded from internal render service.\n   */\n  public get dimensions(): IRenderDimensions | undefined {\n    return this._terminal.dimensions;\n  }\n\n  /**\n   * Current cell size (float).\n   */\n  public get cellSize(): ICellSize {\n    return {\n      width: this.dimensions?.css.cell.width || -1,\n      height: this.dimensions?.css.cell.height || -1\n    };\n  }\n\n  /**\n   * Clear a region of the image layer canvas.\n   */\n  public clearLines(start: number, end: number, layer?: ImageLayer): void {\n    const y = start * (this.dimensions?.css.cell.height || 0);\n    const w = this.dimensions?.css.canvas.width || 0;\n    const h = (end + 1 - start) * (this.dimensions?.css.cell.height || 0);\n    if (!layer || layer === 'top') {\n      this._layers.get('top')?.clearRect(0, y, w, h);\n    }\n    if (!layer || layer === 'bottom') {\n      this._layers.get('bottom')?.clearRect(0, y, w, h);\n    }\n  }\n\n  /**\n   * Clear whole image canvas.\n   */\n  public clearAll(layer?: ImageLayer): void {\n    if (!layer || layer === 'top') {\n      const ctx = this._layers.get('top');\n      ctx?.clearRect(0, 0, ctx.canvas.width, ctx.canvas.height);\n    }\n    if (!layer || layer === 'bottom') {\n      const ctx = this._layers.get('bottom');\n      ctx?.clearRect(0, 0, ctx.canvas.width, ctx.canvas.height);\n    }\n  }\n\n  /**\n   * Draw neighboring tiles on the image layer canvas.\n   */\n  public draw(imgSpec: IImageSpec, tileId: number, col: number, row: number, count: number = 1): void {\n    const ctx = this._layers.get(imgSpec.layer);\n    if (!ctx) {\n      return;\n    }\n    const { width, height } = this.cellSize;\n\n    // Don't try to draw anything, if we cannot get valid renderer metrics.\n    if (width === -1 || height === -1) {\n      return;\n    }\n\n    this._rescaleImage(imgSpec, width, height);\n    const img = imgSpec.actual!;\n    const cols = Math.ceil(img.width / width);\n\n    const sx = (tileId % cols) * width;\n    const sy = Math.floor(tileId / cols) * height;\n    const dx = col * width;\n    const dy = row * height;\n\n    // safari bug: never access image source out of bounds\n    const finalWidth = count * width + sx > img.width ? img.width - sx : count * width;\n    const finalHeight = sy + height > img.height ? img.height - sy : height;\n\n    // Floor all pixel offsets to get stable tile mapping without any overflows.\n    // Note: For not pixel perfect aligned cells like in the DOM renderer\n    // this will move a tile slightly to the top/left (subpixel range, thus ignore it).\n    // FIX #34: avoid striping on displays with pixelDeviceRatio != 1 by ceiling height and width\n    ctx.drawImage(\n      img,\n      Math.floor(sx), Math.floor(sy), Math.ceil(finalWidth), Math.ceil(finalHeight),\n      Math.floor(dx), Math.floor(dy), Math.ceil(finalWidth), Math.ceil(finalHeight)\n    );\n  }\n\n  /**\n   * Extract a single tile from an image.\n   */\n  public extractTile(imgSpec: IImageSpec, tileId: number): HTMLCanvasElement | undefined {\n    const { width, height } = this.cellSize;\n    // Don't try to draw anything, if we cannot get valid renderer metrics.\n    if (width === -1 || height === -1) {\n      return;\n    }\n    this._rescaleImage(imgSpec, width, height);\n    const img = imgSpec.actual!;\n    const cols = Math.ceil(img.width / width);\n    const sx = (tileId % cols) * width;\n    const sy = Math.floor(tileId / cols) * height;\n    const finalWidth = width + sx > img.width ? img.width - sx : width;\n    const finalHeight = sy + height > img.height ? img.height - sy : height;\n\n    const canvas = ImageRenderer.createCanvas(this.document, finalWidth, finalHeight);\n    const ctx = canvas.getContext('2d');\n    if (ctx) {\n      ctx.drawImage(\n        img,\n        Math.floor(sx), Math.floor(sy), Math.floor(finalWidth), Math.floor(finalHeight),\n        0, 0, Math.floor(finalWidth), Math.floor(finalHeight)\n      );\n      return canvas;\n    }\n  }\n\n  /**\n   * Draw a line with placeholder on the image layer canvas.\n   */\n  public drawPlaceholder(col: number, row: number, count: number = 1): void {\n    const ctx = this._layers.get('top');\n    if (ctx) {\n      const { width, height } = this.cellSize;\n\n      // Don't try to draw anything, if we cannot get valid renderer metrics.\n      if (width === -1 || height === -1) {\n        return;\n      }\n\n      if (!this._placeholder) {\n        this._createPlaceHolder(Math.max(height + 1, Constants.PLACEHOLDER_HEIGHT));\n      } else if (height >= this._placeholder!.height) {\n        this._createPlaceHolder(height + 1);\n      }\n      if (!this._placeholder) return;\n      ctx.drawImage(\n        this._placeholderBitmap ?? this._placeholder!,\n        col * width,\n        (row * height) % 2 ? 0 : 1,  // needs %2 offset correction\n        width * count,\n        height,\n        col * width,\n        row * height,\n        width * count,\n        height\n      );\n    }\n  }\n\n  /**\n   * Rescale image layer canvas if needed.\n   * Checked once from `ImageStorage.render`.\n   */\n  public rescaleCanvas(): void {\n    const w = this.dimensions?.css.canvas.width || 0;\n    const h = this.dimensions?.css.canvas.height || 0;\n    for (const ctx of this._layers.values()) {\n      if (ctx.canvas.width !== w || ctx.canvas.height !== h) {\n        ctx.canvas.width = w;\n        ctx.canvas.height = h;\n      }\n    }\n  }\n\n  /**\n   * Rescale image in storage if needed.\n   */\n  private _rescaleImage(spec: IImageSpec, currentWidth: number, currentHeight: number): void {\n    if (currentWidth === spec.actualCellSize.width && currentHeight === spec.actualCellSize.height) {\n      return;\n    }\n    const { width: originalWidth, height: originalHeight } = spec.origCellSize;\n    if (currentWidth === originalWidth && currentHeight === originalHeight) {\n      spec.actual = spec.orig;\n      spec.actualCellSize.width = originalWidth;\n      spec.actualCellSize.height = originalHeight;\n      return;\n    }\n    const canvas = ImageRenderer.createCanvas(\n      this.document,\n      Math.ceil(spec.orig!.width * currentWidth / originalWidth),\n      Math.ceil(spec.orig!.height * currentHeight / originalHeight)\n    );\n    const ctx = canvas.getContext('2d');\n    if (ctx) {\n      ctx.drawImage(spec.orig!, 0, 0, canvas.width, canvas.height);\n      spec.actual = canvas;\n      spec.actualCellSize.width = currentWidth;\n      spec.actualCellSize.height = currentHeight;\n    }\n  }\n\n  /**\n   * Lazy init for the renderer.\n   */\n  private _open(): void {\n    this._renderService = this._terminal._core._renderService;\n    this._oldSetRenderer = this._renderService.setRenderer.bind(this._renderService);\n    this._renderService.setRenderer = (renderer: any) => {\n      for (const key of [...this._layers.keys()]) {\n        this.removeLayerFromDom(key);\n      }\n      this._oldSetRenderer?.call(this._renderService, renderer);\n    };\n  }\n\n  public insertLayerToDom(layer: ImageLayer = 'top'): void {\n    // make sure that the terminal is attached to a document and to DOM\n    if (!this.document || !this._terminal._core.screenElement) {\n      console.warn('image addon: cannot insert output canvas to DOM, missing document or screenElement');\n      return;\n    }\n    if (this._layers.has(layer)) {\n      return;\n    }\n    const canvas = ImageRenderer.createCanvas(\n      this.document, this.dimensions?.css.canvas.width || 0,\n      this.dimensions?.css.canvas.height || 0\n    );\n    canvas.classList.add(`xterm-image-layer-${layer}`);\n    const screenElement = this._terminal._core.screenElement;\n    // Use isolation to create a stacking context without overriding z-index,\n    // which would conflict with integrators (e.g. VS Code) that set their\n    // own z-index on the screen element.\n    screenElement.style.isolation = 'isolate';\n    if (layer === 'bottom') {\n      // Use z-index:-1 so it paints behind non-positioned text elements.\n      // The screen element needs to be a stacking context (via isolation)\n      // to contain the negative z-index, otherwise it would go behind the\n      // entire terminal.\n      canvas.style.zIndex = '-1';\n      screenElement.insertBefore(canvas, screenElement.firstChild);\n    } else {\n      // Explicit z-index ensures the image canvas reliably stacks above\n      // the text layer (DOM renderer rows). z-index: 0 is below the\n      // selection overlay (z-index: 1).\n      canvas.style.zIndex = '0';\n      screenElement.appendChild(canvas);\n    }\n    const ctx = canvas.getContext('2d', { alpha: true });\n    if (!ctx) {\n      canvas.remove();\n      return;\n    }\n    this._layers.set(layer, ctx);\n    this.clearAll(layer);\n  }\n\n  public removeLayerFromDom(layer: ImageLayer = 'top'): void {\n    const ctx = this._layers.get(layer);\n    if (ctx) {\n      ctx.canvas.remove();\n      this._layers.delete(layer);\n    }\n  }\n\n  public hasLayer(layer: ImageLayer): boolean {\n    return this._layers.has(layer);\n  }\n\n  private _createPlaceHolder(height: number = Constants.PLACEHOLDER_HEIGHT): void {\n    this._placeholderBitmap?.close();\n    this._placeholderBitmap = undefined;\n\n    // create blueprint to fill placeholder with\n    const bWidth = 32;  // must be 2^n\n    const blueprint = ImageRenderer.createCanvas(this.document, bWidth, height);\n    const ctx = blueprint.getContext('2d', { alpha: false });\n    if (!ctx) return;\n    const imgData = ImageRenderer.createImageData(ctx, bWidth, height);\n    const d32 = new Uint32Array(imgData.data.buffer);\n    const black = toRGBA8888(0, 0, 0);\n    const white = toRGBA8888(255, 255, 255);\n    d32.fill(black);\n    for (let y = 0; y < height; ++y) {\n      const shift = y % 2;\n      const offset = y * bWidth;\n      for (let x = 0; x < bWidth; x += 2) {\n        d32[offset + x + shift] = white;\n      }\n    }\n    ctx.putImageData(imgData, 0, 0);\n\n    // create placeholder line, width aligned to blueprint width\n    const width = (screen.width + bWidth - 1) & ~(bWidth - 1) || Constants.PLACEHOLDER_LENGTH;\n    this._placeholder = ImageRenderer.createCanvas(this.document, width, height);\n    const ctx2 = this._placeholder.getContext('2d', { alpha: false });\n    if (!ctx2) {\n      this._placeholder = undefined;\n      return;\n    }\n    for (let i = 0; i < width; i += bWidth) {\n      ctx2.drawImage(blueprint, i, 0);\n    }\n    ImageRenderer.createImageBitmap(this._placeholder).then(bitmap => this._placeholderBitmap = bitmap);\n  }\n\n  public get document(): Document | undefined {\n    return this._terminal._core._coreBrowserService?.window.document;\n  }\n}\n", "/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IDisposable } from '@xterm/xterm';\nimport { ImageRenderer } from './ImageRenderer';\nimport {\n  ITerminalExt, IExtendedAttrsImage, IImageAddonOptions, IImageSpec,\n  IBufferLineExt, BgFlags, Cell, Content, ICellSize, ExtFlags, Attributes,\n  UnderlineStyle, IAddImageOpts\n} from './Types';\n\n\n// fallback default cell size\nexport const CELL_SIZE_DEFAULT: ICellSize = {\n  width: 7,\n  height: 14\n};\n\n/**\n * Extend extended attribute to also hold image tile information.\n *\n * Object definition is copied from base repo to fully mimick its behavior.\n * Image data is added as additional public properties `imageId` and `tileId`.\n */\nclass ExtendedAttrsImage implements IExtendedAttrsImage {\n  private _ext: number = 0;\n  public get ext(): number {\n    if (this._urlId) {\n      return (\n        (this._ext & ~ExtFlags.UNDERLINE_STYLE) |\n        (this.underlineStyle << 26)\n      );\n    }\n    return this._ext;\n  }\n  public set ext(value: number) { this._ext = value; }\n\n  public get underlineStyle(): UnderlineStyle {\n    // Always return the URL style if it has one\n    if (this._urlId) {\n      return UnderlineStyle.DASHED;\n    }\n    return (this._ext & ExtFlags.UNDERLINE_STYLE) >> 26;\n  }\n  public set underlineStyle(value: UnderlineStyle) {\n    this._ext &= ~ExtFlags.UNDERLINE_STYLE;\n    this._ext |= (value << 26) & ExtFlags.UNDERLINE_STYLE;\n  }\n\n  public get underlineColor(): number {\n    return this._ext & (Attributes.CM_MASK | Attributes.RGB_MASK);\n  }\n  public set underlineColor(value: number) {\n    this._ext &= ~(Attributes.CM_MASK | Attributes.RGB_MASK);\n    this._ext |= value & (Attributes.CM_MASK | Attributes.RGB_MASK);\n  }\n\n  public get underlineVariantOffset(): number {\n    const val = (this._ext & ExtFlags.VARIANT_OFFSET) >> 29;\n    if (val < 0) {\n      return val ^ 0xFFFFFFF8;\n    }\n    return val;\n  }\n  public set underlineVariantOffset(value: number) {\n    this._ext &= ~ExtFlags.VARIANT_OFFSET;\n    this._ext |= (value << 29) & ExtFlags.VARIANT_OFFSET;\n  }\n\n  private _urlId: number = 0;\n  public get urlId(): number {\n    return this._urlId;\n  }\n  public set urlId(value: number) {\n    this._urlId = value;\n  }\n\n  constructor(\n    ext: number = 0,\n    urlId: number = 0,\n    public imageId = -1,\n    public tileId = -1\n  ) {\n    this._ext = ext;\n    this._urlId = urlId;\n  }\n\n  public clone(): IExtendedAttrsImage {\n    /**\n     * Technically we dont need a clone variant of ExtendedAttrsImage,\n     * as we never clone a cell holding image data.\n     * Note: Clone is only meant to be used by the InputHandler for\n     * sticky attributes, which is never the case for image data.\n     * We still provide a proper clone method to reflect the full ext attr\n     * state in case there are future use cases for clone.\n     */\n    return new ExtendedAttrsImage(this._ext, this._urlId, this.imageId, this.tileId);\n  }\n\n  public isEmpty(): boolean {\n    return this.underlineStyle === UnderlineStyle.NONE && this._urlId === 0 && this.imageId === -1;\n  }\n}\nconst EMPTY_ATTRS = new ExtendedAttrsImage();\n\n\n/**\n * ImageStorage - extension of CoreTerminal:\n * - hold image data\n * - write/read image data to/from buffer\n *\n * TODO: image composition for overwrites\n */\nexport class ImageStorage implements IDisposable {\n  // storage\n  private _images: Map<number, IImageSpec> = new Map();\n  // last used id\n  private _lastId = 0;\n  // last evicted id\n  private _lowestId = 0;\n  // whether a full clear happened before\n  private _fullyCleared = false;\n  // whether render should do a full clear\n  private _needsFullClear = false;\n  // hard limit of stored pixels (fallback limit of 10 MB)\n  private _pixelLimit: number = 2500000;\n\n  private _viewportMetrics: { cols: number, rows: number };\n  public onImageAdded: (() => void) | undefined;\n  public onImageDeleted: ((storageId: number) => void) | undefined;\n\n  constructor(\n    private _terminal: ITerminalExt,\n    private _renderer: ImageRenderer,\n    private _opts: IImageAddonOptions\n  ) {\n    try {\n      this.setLimit(this._opts.storageLimit);\n    } catch (e: unknown) {\n      if (e instanceof Error) {\n        console.error(e.message);\n      }\n      console.warn(`storageLimit is set to ${this.getLimit()} MB`);\n    }\n    this._viewportMetrics = {\n      cols: this._terminal.cols,\n      rows: this._terminal.rows\n    };\n  }\n\n  public dispose(): void {\n    this.reset();\n  }\n\n  public reset(): void {\n    for (const spec of this._images.values()) {\n      spec.marker?.dispose();\n    }\n    // NOTE: marker.dispose above already calls ImageBitmap.close\n    // therefore we can just wipe the map here\n    this._images.clear();\n    this._renderer.clearAll();\n  }\n\n  public getLimit(): number {\n    return this._pixelLimit * 4 / 1000000;\n  }\n\n  public setLimit(value: number): void {\n    if (value < 0.5 || value > 1000) {\n      throw RangeError('invalid storageLimit, should be at least 0.5 MB and not exceed 1G');\n    }\n    this._pixelLimit = (value / 4 * 1000000) >>> 0;\n    this._evictOldest(0);\n  }\n\n  public getUsage(): number {\n    return this._getStoredPixels() * 4 / 1000000;\n  }\n\n  private _getStoredPixels(): number {\n    let storedPixels = 0;\n    for (const spec of this._images.values()) {\n      if (spec.orig) {\n        storedPixels += spec.orig.width * spec.orig.height;\n        if (spec.actual && spec.actual !== spec.orig) {\n          storedPixels += spec.actual.width * spec.actual.height;\n        }\n      }\n    }\n    return storedPixels;\n  }\n\n  private _delImg(id: number): void {\n    const spec = this._images.get(id);\n    if (!spec) return;\n    this._images.delete(id);\n    // FIXME: really ugly workaround to get bitmaps deallocated :(\n    if (window.ImageBitmap && spec.orig instanceof ImageBitmap) {\n      spec.orig.close();\n    }\n    this.onImageDeleted?.(id);\n  }\n\n  /**\n   * Wipe canvas and images on alternate buffer.\n   */\n  public wipeAlternate(): void {\n    // remove all alternate tagged images\n    const zero = [];\n    for (const [id, spec] of this._images.entries()) {\n      if (spec.bufferType === 'alternate') {\n        spec.marker?.dispose();\n        zero.push(id);\n      }\n    }\n    for (const id of zero) {\n      this._delImg(id);\n    }\n    // mark canvas to be wiped on next render\n    this._needsFullClear = true;\n    this._fullyCleared = false;\n  }\n\n  /**\n   * Delete an image by its internal storage ID.\n   * Used by protocols that support explicit deletion (e.g. Kitty a=d).\n   */\n  public deleteImage(id: number): void {\n    const spec = this._images.get(id);\n    if (spec) {\n      spec.marker?.dispose();\n      this._delImg(id);\n    }\n  }\n\n  /**\n   * Method to add an image to the storage.\n   * @param img - The image to add (canvas or bitmap).\n   * @param opts - Options for addImage:\n   *   - scrolling:  When true, cursor advances with the image.\n   *                 When false, image is placed at ORIGIN and cursor does not move.\n   *   - layer:      Which canvas layer to render on ('top' or 'bottom').\n   *   - zIndex:     Z-index for image layering within the same layer.\n   *   - cursorPos:  'vt340' for bottom-left, 'iip' for bottom.right.\n   * @returns The internal image ID assigned to the stored image.\n   */\n  public addImage(img: HTMLCanvasElement | ImageBitmap, opts: IAddImageOpts): number {\n    // never allow storage to exceed memory limit\n    this._evictOldest(img.width * img.height);\n\n    // calc rows x cols needed to display the image\n    let cellSize = this._renderer.cellSize;\n    if (cellSize.width === -1 || cellSize.height === -1) {\n      cellSize = CELL_SIZE_DEFAULT;\n    }\n    const cols = Math.ceil(img.width / cellSize.width);\n    const rows = Math.ceil(img.height / cellSize.height);\n\n    const imageId = ++this._lastId;\n\n    const buffer = this._terminal._core.buffer;\n    const termCols = this._terminal.cols;\n    const termRows = this._terminal.rows;\n    const originX = buffer.x;\n    const originY = buffer.y;\n    let offset = originX;\n    let tileCount = 0;\n\n    if (!opts.scrolling) {\n      buffer.x = 0;\n      buffer.y = 0;\n      offset = 0;\n    }\n\n    this._terminal._core._inputHandler._dirtyRowTracker.markDirty(buffer.y);\n    for (let row = 0; row < rows; ++row) {\n      const line = buffer.lines.get(buffer.y + buffer.ybase);\n      for (let col = 0; col < cols; ++col) {\n        if (offset + col >= termCols) break;\n        this._writeToCell(line as IBufferLineExt, offset + col, imageId, row * cols + col);\n        tileCount++;\n      }\n      if (opts.scrolling) {\n        if (row < rows - 1) this._terminal._core._inputHandler.lineFeed();\n      } else {\n        if (++buffer.y >= termRows) break;\n      }\n      buffer.x = offset;\n    }\n    this._terminal._core._inputHandler._dirtyRowTracker.markDirty(buffer.y);\n\n    // cursor positioning modes\n    if (opts.scrolling) {\n      if (opts.cursorPos === 'iip') {\n        buffer.x = Math.min(offset + cols, termCols);\n      } else {\n        buffer.x = offset;\n      }\n    } else {\n      buffer.x = originX;\n      buffer.y = originY;\n    }\n\n    // deleted images with zero tile count\n    const zero = [];\n    for (const [id, spec] of this._images.entries()) {\n      if (spec.tileCount < 1) {\n        spec.marker?.dispose();\n        zero.push(id);\n      }\n    }\n    for (const id of zero) {\n      this._delImg(id);\n    }\n\n    // eviction marker:\n    // delete the image when the marker gets disposed\n    const endMarker = this._terminal.registerMarker(0);\n    endMarker?.onDispose(() => {\n      const spec = this._images.get(imageId);\n      if (spec) {\n        this._delImg(imageId);\n      }\n    });\n\n    // since markers do not work on alternate for some reason,\n    // we evict images here manually\n    if (this._terminal.buffer.active.type === 'alternate') {\n      this._evictOnAlternate();\n    }\n\n    // create storage entry\n    const imgSpec: IImageSpec = {\n      orig: img,\n      origCellSize: cellSize,\n      actual: img,\n      actualCellSize: { ...cellSize },  // clone needed, since later modified\n      marker: endMarker || undefined,\n      tileCount,\n      bufferType: this._terminal.buffer.active.type,\n      layer: opts.layer,\n      zIndex: opts.zIndex\n    };\n\n    // finally add the image\n    this._images.set(imageId, imgSpec);\n    this.onImageAdded?.();\n    return imageId;\n  }\n\n\n  /**\n   * Render method. Collects buffer information and triggers\n   * canvas updates.\n   */\n  // TODO: Should we move this to the ImageRenderer?\n  public render(range: { start: number, end: number }): void {\n    // Determine which layers have images\n    let hasTopImages = false;\n    let hasBottomImages = false;\n    for (const spec of this._images.values()) {\n      if (spec.layer === 'bottom') {\n        hasBottomImages = true;\n      } else {\n        hasTopImages = true;\n      }\n      if (hasTopImages && hasBottomImages) break;\n    }\n\n    // Lazily insert layers that are needed\n    if (hasTopImages && !this._renderer.hasLayer('top')) {\n      this._renderer.insertLayerToDom('top');\n      if (!this._renderer.hasLayer('top')) return;\n    }\n    if (hasBottomImages && !this._renderer.hasLayer('bottom')) {\n      this._renderer.insertLayerToDom('bottom');\n    }\n\n    // rescale if needed\n    this._renderer.rescaleCanvas();\n\n    // exit early if we dont have any images to test for\n    if (!this._images.size) {\n      if (!this._fullyCleared) {\n        this._renderer.clearAll();\n        this._fullyCleared = true;\n        this._needsFullClear = false;\n      }\n      if (this._renderer.hasLayer('top')) {\n        this._renderer.removeLayerFromDom('top');\n      }\n      if (this._renderer.hasLayer('bottom')) {\n        this._renderer.removeLayerFromDom('bottom');\n      }\n      return;\n    }\n\n    // Remove layers no longer needed\n    if (!hasTopImages && this._renderer.hasLayer('top')) {\n      this._renderer.clearAll('top');\n      this._renderer.removeLayerFromDom('top');\n    }\n    if (!hasBottomImages && this._renderer.hasLayer('bottom')) {\n      this._renderer.clearAll('bottom');\n      this._renderer.removeLayerFromDom('bottom');\n    }\n\n    // buffer switches force a full clear\n    if (this._needsFullClear) {\n      this._renderer.clearAll();\n      this._fullyCleared = true;\n      this._needsFullClear = false;\n    }\n\n    const { start, end } = range;\n    const buffer = this._terminal._core.buffer;\n    const cols = this._terminal._core.cols;\n\n    // clear drawing area\n    this._renderer.clearLines(start, end);\n\n    // Collect draw calls so we can sort by z-index (lower z drawn first).\n    const drawCalls: { imgSpec: IImageSpec, tileId: number, col: number, row: number, count: number }[] = [];\n    const placeholderCalls: { col: number, row: number, count: number }[] = [];\n\n    // walk all cells in viewport and collect tiles found\n    for (let row = start; row <= end; ++row) {\n      const line = buffer.lines.get(row + buffer.ydisp) as IBufferLineExt;\n      if (!line) return;\n      for (let col = 0; col < cols; ++col) {\n        if (line.getBg(col) & BgFlags.HAS_EXTENDED) {\n          let e: IExtendedAttrsImage = line._extendedAttrs[col] ?? EMPTY_ATTRS;\n          const imageId = e.imageId;\n          if (imageId === undefined || imageId === -1) {\n            continue;\n          }\n          const imgSpec = this._images.get(imageId);\n          if (e.tileId !== -1) {\n            const startTile = e.tileId;\n            const startCol = col;\n            let count = 1;\n            /**\n             * merge tiles to the right into a single draw call, if:\n             * - not at end of line\n             * - cell has same image id\n             * - cell has consecutive tile id\n             */\n            while (\n              ++col < cols\n              && (line.getBg(col) & BgFlags.HAS_EXTENDED)\n              && (e = line._extendedAttrs[col] ?? EMPTY_ATTRS)\n              && (e.imageId === imageId)\n              && (e.tileId === startTile + count)\n            ) {\n              count++;\n            }\n            col--;\n            if (imgSpec) {\n              if (imgSpec.actual) {\n                drawCalls.push({ imgSpec, tileId: startTile, col: startCol, row, count });\n              }\n            } else if (this._opts.showPlaceholder) {\n              placeholderCalls.push({ col: startCol, row, count });\n            }\n            this._fullyCleared = false;\n          }\n        }\n      }\n    }\n\n    // Sort by z-index so lower z draws first (higher z renders on top)\n    drawCalls.sort((a, b) => a.imgSpec.zIndex - b.imgSpec.zIndex);\n\n    // Draw placeholders first (lowest priority)\n    for (const call of placeholderCalls) {\n      this._renderer.drawPlaceholder(call.col, call.row, call.count);\n    }\n\n    // Draw images in z-index order\n    for (const call of drawCalls) {\n      this._renderer.draw(call.imgSpec, call.tileId, call.col, call.row, call.count);\n    }\n  }\n\n  public viewportResize(metrics: { cols: number, rows: number }): void {\n    // exit early if we have nothing in storage\n    if (!this._images.size) {\n      this._viewportMetrics = metrics;\n      return;\n    }\n\n    // handle only viewport width enlargements, exit all other cases\n    // TODO: needs patch for tile counter\n    if (this._viewportMetrics.cols >= metrics.cols) {\n      this._viewportMetrics = metrics;\n      return;\n    }\n\n    // walk scrollbuffer at old col width to find all possible expansion matches\n    const buffer = this._terminal._core.buffer;\n    const rows = buffer.lines.length;\n    const oldCol = this._viewportMetrics.cols - 1;\n    for (let row = 0; row < rows; ++row) {\n      const line = buffer.lines.get(row) as IBufferLineExt;\n      if (line.getBg(oldCol) & BgFlags.HAS_EXTENDED) {\n        const e: IExtendedAttrsImage = line._extendedAttrs[oldCol] ?? EMPTY_ATTRS;\n        const imageId = e.imageId;\n        if (imageId === undefined || imageId === -1) {\n          continue;\n        }\n        const imgSpec = this._images.get(imageId);\n        if (!imgSpec) {\n          continue;\n        }\n        // found an image tile at oldCol, check if it qualifies for right exapansion\n        const tilesPerRow = Math.ceil((imgSpec.actual?.width || 0) / imgSpec.actualCellSize.width);\n        if ((e.tileId % tilesPerRow) + 1 >= tilesPerRow) {\n          continue;\n        }\n        // expand only if right side is empty (nothing got wrapped from below)\n        let hasData = false;\n        for (let rightCol = oldCol + 1; rightCol > metrics.cols; ++rightCol) {\n          if (line._data[rightCol * Cell.SIZE + Cell.CONTENT] & Content.HAS_CONTENT_MASK) {\n            hasData = true;\n            break;\n          }\n        }\n        if (hasData) {\n          continue;\n        }\n        // do right expansion on terminal buffer\n        const end = Math.min(metrics.cols, tilesPerRow - (e.tileId % tilesPerRow) + oldCol);\n        let lastTile = e.tileId;\n        for (let expandCol = oldCol + 1; expandCol < end; ++expandCol) {\n          this._writeToCell(line as IBufferLineExt, expandCol, imageId, ++lastTile);\n          imgSpec.tileCount++;\n        }\n      }\n    }\n    // store new viewport metrics\n    this._viewportMetrics = metrics;\n  }\n\n  /**\n   * Retrieve original canvas at buffer position.\n   */\n  public getImageAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    const buffer = this._terminal._core.buffer;\n    const line = buffer.lines.get(y) as IBufferLineExt;\n    if (line && line.getBg(x) & BgFlags.HAS_EXTENDED) {\n      const e: IExtendedAttrsImage = line._extendedAttrs[x] ?? EMPTY_ATTRS;\n      if (e.imageId && e.imageId !== -1) {\n        const orig = this._images.get(e.imageId)?.orig;\n        if (window.ImageBitmap && orig instanceof ImageBitmap) {\n          const canvas = ImageRenderer.createCanvas(window.document, orig.width, orig.height);\n          canvas.getContext('2d')?.drawImage(orig, 0, 0, orig.width, orig.height);\n          return canvas;\n        }\n        return orig as HTMLCanvasElement;\n      }\n    }\n  }\n\n  /**\n   * Extract active single tile at buffer position.\n   */\n  public extractTileAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    const buffer = this._terminal._core.buffer;\n    const line = buffer.lines.get(y) as IBufferLineExt;\n    if (line && line.getBg(x) & BgFlags.HAS_EXTENDED) {\n      const e: IExtendedAttrsImage = line._extendedAttrs[x] ?? EMPTY_ATTRS;\n      if (e.imageId && e.imageId !== -1 && e.tileId !== -1) {\n        const spec = this._images.get(e.imageId);\n        if (spec) {\n          return this._renderer.extractTile(spec, e.tileId);\n        }\n      }\n    }\n  }\n\n  // TODO: Do we need some blob offloading tricks here to avoid early eviction?\n  // also see https://stackoverflow.com/questions/28307789/is-there-any-limitation-on-javascript-max-blob-size\n  private _evictOldest(room: number): number {\n    const used = this._getStoredPixels();\n    let current = used;\n    while (this._pixelLimit < current + room && this._images.size) {\n      const spec = this._images.get(++this._lowestId);\n      if (spec && spec.orig) {\n        current -= spec.orig.width * spec.orig.height;\n        if (spec.actual && spec.orig !== spec.actual) {\n          current -= spec.actual.width * spec.actual.height;\n        }\n        spec.marker?.dispose();\n        this._delImg(this._lowestId);\n      }\n    }\n    return used - current;\n  }\n\n  private _writeToCell(line: IBufferLineExt, x: number, imageId: number, tileId: number): void {\n    if (line._data[x * Cell.SIZE + Cell.BG] & BgFlags.HAS_EXTENDED) {\n      const old = line._extendedAttrs[x];\n      if (old) {\n        if (old.imageId !== undefined) {\n          // found an old ExtendedAttrsImage, since we know that\n          // they are always isolated instances (single cell usage),\n          // we can re-use it and just update their id entries\n          const oldSpec = this._images.get(old.imageId);\n          if (oldSpec) {\n            // early eviction for in-viewport overwrites\n            oldSpec.tileCount--;\n          }\n          old.imageId = imageId;\n          old.tileId = tileId;\n          return;\n        }\n        // found a plain ExtendedAttrs instance, clone it to new entry\n        line._extendedAttrs[x] = new ExtendedAttrsImage(old.ext, old.urlId, imageId, tileId);\n        return;\n      }\n    }\n    // fall-through: always create new ExtendedAttrsImage entry\n    line._data[x * Cell.SIZE + Cell.BG] |= BgFlags.HAS_EXTENDED;\n    line._extendedAttrs[x] = new ExtendedAttrsImage(0, 0, imageId, tileId);\n  }\n\n  private _evictOnAlternate(): void {\n    // nullify tile count of all images on alternate buffer\n    for (const spec of this._images.values()) {\n      if (spec.bufferType === 'alternate') {\n        spec.tileCount = 0;\n      }\n    }\n    // re-count tiles on whole buffer\n    const buffer = this._terminal._core.buffer;\n    for (let y = 0; y < this._terminal.rows; ++y) {\n      const line = buffer.lines.get(y) as IBufferLineExt;\n      if (!line) {\n        continue;\n      }\n      for (let x = 0; x < this._terminal.cols; ++x) {\n        if (line._data[x * Cell.SIZE + Cell.BG] & BgFlags.HAS_EXTENDED) {\n          const imgId = line._extendedAttrs[x]?.imageId;\n          if (imgId) {\n            const spec = this._images.get(imgId);\n            if (spec) {\n              spec.tileCount++;\n            }\n          }\n        }\n      }\n    }\n    // deleted images with zero tile count\n    const zero = [];\n    for (const [id, spec] of this._images.entries()) {\n      if (spec.bufferType === 'alternate' && !spec.tileCount) {\n        spec.marker?.dispose();\n        zero.push(id);\n      }\n    }\n    for (const id of zero) {\n      this._delImg(id);\n    }\n  }\n}\n", "/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\nimport { IImageAddonOptions, IOscHandler, IResetHandler, ITerminalExt } from './Types';\nimport { ImageRenderer } from './ImageRenderer';\nimport { IIPImageStorage } from './IIPImageStorage';\nimport { CELL_SIZE_DEFAULT } from './ImageStorage';\nimport Base64Decoder from 'xterm-wasm-parts/lib/base64/Base64Decoder.wasm';\nimport QoiDecoder from 'xterm-wasm-parts/lib/qoi/QoiDecoder.wasm';\nimport { HeaderParser, IHeaderFields, HeaderState, SequenceType } from './IIPHeaderParser';\nimport { imageType, UNSUPPORTED_TYPE } from './IIPMetrics';\n\n// Local const enum mirror - esbuild can't inline const enums from external packages\nconst enum DecoderConst {\n  // Limit held memory in base64 decoder (encoded bytes).\n  KEEP_DATA = 4194304,\n  // Initial buffer allocation for the decoder.\n  INITIAL_DATA = 1048576,\n  // Local mirror of const enum (esbuild can't inline const enums from external packages)\n  OK = 0\n}\n\n// default IIP header values\nconst DEFAULT_HEADER: IHeaderFields = {\n  type: SequenceType.INVALID,\n  name: 'Unnamed file',\n  size: 0,\n  width: 'auto',\n  height: 'auto',\n  preserveAspectRatio: 1,\n  inline: 0\n};\n\n\nexport class IIPHandler implements IOscHandler, IResetHandler {\n  private _aborted = false;\n  private _hp = new HeaderParser();\n  private _header: IHeaderFields = DEFAULT_HEADER;\n  private _dec: Base64Decoder;\n  private _qoiDec: QoiDecoder;\n  private _isMultipart = false;\n  private _abortMulti = false;\n\n  constructor(\n    private readonly _opts: IImageAddonOptions,\n    private readonly _renderer: ImageRenderer,\n    private readonly _storage: IIPImageStorage,\n    private readonly _coreTerminal: ITerminalExt\n  ) {\n    const maxEncodedBytes = Math.ceil(this._opts.iipSizeLimit * 4 / 3);\n    const initialBytes = Math.min(DecoderConst.INITIAL_DATA, maxEncodedBytes);\n    this._dec = new Base64Decoder(DecoderConst.KEEP_DATA, maxEncodedBytes, initialBytes);\n    this._qoiDec = new QoiDecoder(DecoderConst.KEEP_DATA);\n  }\n\n  public reset(): void {\n    this._hp.reset();\n    this._dec.release();\n    this._qoiDec.release();\n  }\n\n  public start(): void {\n    this._aborted = false;\n    this._hp.reset();\n  }\n\n  public put(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted) return;\n\n    if (this._hp.state === HeaderState.END) {\n      if ((this._dec.put(data.subarray(start, end)) as number) !== DecoderConst.OK) {\n        this._dec.release();\n        this._aborted = true;\n      }\n    } else {\n      const dataPos = this._hp.parse(data, start, end);\n      if (dataPos === -1) {\n        this._aborted = true;\n        return;\n      }\n      if (dataPos > 0) {\n        const seqType = this._hp.fields.type;\n        if (seqType === SequenceType.FILE) {\n          if (this._isMultipart) {\n            this._isMultipart = false;\n            this._abortMulti = false;\n            this._dec.release();\n          }\n          this._header = Object.assign({}, DEFAULT_HEADER, this._hp.fields);\n          if (!this._header.inline) {\n            this._aborted = true;\n            return;\n          }\n          this._dec.init();\n        } else if (this._abortMulti) {\n          this._aborted = true;\n          return;\n        }\n        if ((this._dec.put(data.subarray(dataPos, end)) as number) !== DecoderConst.OK) {\n          this._dec.release();\n          this._aborted = true;\n          if (this._isMultipart) this._abortMulti = true;\n        }\n      }\n    }\n  }\n\n  public end(success: boolean): boolean | Promise<boolean> {\n    if (this._aborted) return true;\n\n    if (this._hp.state !== HeaderState.END) {\n      if (this._hp.end()) return true;\n    }\n    const seqType = this._hp.fields.type;\n\n    if (seqType === SequenceType.FILEPART) return true;\n\n    if (seqType === SequenceType.REPORTCELLSIZE) {\n      // OSC 1337 ; ReportCellSize=[height];[width];[scale] ST\n      let w = CELL_SIZE_DEFAULT.width;\n      let h = CELL_SIZE_DEFAULT.height;\n      if (this._renderer.dimensions) {\n        w = this._renderer.dimensions.css.canvas.width / this._coreTerminal.cols;\n        h = this._renderer.dimensions.css.canvas.height / this._coreTerminal.rows;\n      }\n      const scale = this._coreTerminal._core._coreBrowserService?.dpr ?? 1;\n      const report = `\\x1b]1337;ReportCellSize=${h.toFixed(3)};${w.toFixed(3)};${scale.toFixed(3)}\\x1b\\\\`;\n      this._coreTerminal.input(report, false);\n      return true;\n    }\n\n    if (seqType === SequenceType.MULTIPARTFILE) {\n      this._header = Object.assign({}, DEFAULT_HEADER, this._hp.fields);\n      this._isMultipart = true;\n      this._abortMulti = false;\n      this._dec.release();\n      this._dec.init();\n      return true;\n    }\n\n    if (seqType === SequenceType.FILEEND) {\n      if (!this._isMultipart) return true;\n      this._isMultipart = false;\n      if (this._abortMulti || this._header.type !== SequenceType.MULTIPARTFILE) return true;\n    }\n\n    // fallthrough for SequenceType.FILE & SequenceType.FILEEND\n\n    let w = 0;\n    let h = 0;\n\n    // early exit condition chain\n    let cond: number | boolean;\n    let metrics = UNSUPPORTED_TYPE;\n    if (cond = success) {\n      if (cond = !this._dec.end()) {\n        metrics = imageType(this._dec.data8);\n        if (cond = metrics.mime !== 'unsupported') {\n          w = metrics.width;\n          h = metrics.height;\n          if (cond = w && h && w * h < this._opts.pixelLimit) {\n            [w, h] = this._resize(w, h).map(Math.floor);\n            cond = w && h && w * h < this._opts.pixelLimit;\n          } else {\n            console.warn(`IIP: image dimension issue ${metrics.width}x${metrics.height}`);\n          }\n        } else {\n          console.warn('IIP: unsupported image type');\n        }\n      } else {\n        console.warn('IIP: error during BASE64 decoding');\n      }\n    }\n    if (!cond) {\n      this._dec.release();\n      return true;\n    }\n\n    let blob: Blob | ImageData;\n    if (metrics.mime === 'image/qoi') {\n      const data = this._qoiDec.decode(this._dec.data8);\n      blob = new ImageData(\n        new Uint8ClampedArray(data.buffer, data.byteOffset, data.byteLength),\n        this._qoiDec.width,\n        this._qoiDec.height\n      );\n      this._qoiDec.release();\n      if (w === this._qoiDec.width && h === this._qoiDec.height) {\n        // use fast-path if we don't need to rescale\n        this._dec.release();\n        const canvas = ImageRenderer.createCanvas(undefined, this._qoiDec.width, this._qoiDec.height);\n        canvas.getContext('2d')?.putImageData(blob, 0, 0);\n        this._storage.addImage(canvas);\n        return true;\n      }\n    } else {\n      blob = new Blob([this._dec.data8], { type: metrics.mime });\n    }\n    this._dec.release();\n    return createImageBitmap(blob, { resizeWidth: w, resizeHeight: h })\n      .then(bm => {\n        this._storage.addImage(bm);\n        return true;\n      })\n      .catch(e => {\n        console.warn(`IIP: decoding error ${metrics.mime} ${metrics.width}x${metrics.height}`, e);\n        return true;\n      });\n  }\n\n  private _resize(w: number, h: number): [number, number] {\n    const cw = this._renderer.dimensions?.css.cell.width || CELL_SIZE_DEFAULT.width;\n    const ch = this._renderer.dimensions?.css.cell.height || CELL_SIZE_DEFAULT.height;\n    const width = this._renderer.dimensions?.css.canvas.width || cw * this._coreTerminal.cols;\n    const height = this._renderer.dimensions?.css.canvas.height || ch * this._coreTerminal.rows;\n\n    const rw = this._dim(this._header.width!, width, cw);\n    const rh = this._dim(this._header.height!, height, ch);\n    if (!rw && !rh) {\n      const wf = width / w;         // TODO: should this respect initial cursor offset?\n      const hf = (height - ch) / h; // TODO: fix offset issues from float cell height\n      const f = Math.min(wf, hf);\n      return f < 1 ? [w * f, h * f] : [w, h];\n    }\n    return !rw\n      ? [w * rh / h, rh]\n      : this._header.preserveAspectRatio || !rw || !rh\n        ? [rw, h * rw / w] : [rw, rh];\n  }\n\n  private _dim(s: string, total: number, cdim: number): number {\n    if (s === 'auto') return 0;\n    if (s.endsWith('%')) return parseInt(s.slice(0, -1), 10) * total / 100;\n    if (s.endsWith('px')) return parseInt(s.slice(0, -2), 10);\n    return parseInt(s, 10) * cdim;\n  }\n}\n", "/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\n// eslint-disable-next-line\ndeclare const Buffer: any;\n\nexport const enum HeaderState {\n  START = 0,\n  ABORT = 1,\n  KEY = 2,\n  VALUE = 3,\n  END = 4\n}\n\nexport const enum SequenceType {\n  INVALID = 0,\n  FILE = 1,\n  MULTIPARTFILE = 2,\n  FILEPART = 3,\n  FILEEND = 4,\n  REPORTCELLSIZE = 5\n}\n\nexport interface IHeaderFields {\n  [key: string]: number | string | Uint32Array | null | undefined;\n  // sequence type\n  type: SequenceType;\n  // base-64 encoded filename. Defaults to \"Unnamed file\".\n  name: string;\n  // File size in bytes. The file transfer will be canceled if this size is exceeded.\n  size: number;\n  /**\n   * Optional width and height to render:\n   * - N: N character cells.\n   * - Npx: N pixels.\n   * - N%: N percent of the session's width or height.\n   * - auto: The image's inherent size will be used to determine an appropriate dimension.\n   */\n  width?: string;\n  height?: string;\n  // Optional, defaults to 1 respecting aspect ratio (width takes precedence).\n  preserveAspectRatio?: number;\n  // Optional, defaults to 0. If set to 1, the file will be displayed inline, else downloaded\n  // (download not supported).\n  inline?: number;\n}\n\n// field value decoders\n\n// ASCII bytes to string\nfunction toStr(data: Uint32Array): string {\n  let s = '';\n  for (let i = 0; i < data.length; ++i) {\n    s += String.fromCharCode(data[i]);\n  }\n  return s;\n}\n\n// digits to integer\nfunction toInt(data: Uint32Array): number {\n  let v = 0;\n  for (let i = 0; i < data.length; ++i) {\n    if (data[i] < 48 || data[i] > 57) {\n      throw new Error('illegal char');\n    }\n    v = v * 10 + data[i] - 48;\n  }\n  return v;\n}\n\n// check for correct size entry\nfunction toSize(data: Uint32Array): string {\n  const v = toStr(data);\n  if (!v.match(/^((auto)|(\\d+?((px)|(%)){0,1}))$/)) {\n    throw new Error('illegal size');\n  }\n  return v;\n}\n\n// name is base64 encoded utf-8\nfunction toName(data: Uint32Array): string {\n  if (typeof Buffer !== 'undefined') {\n    return Buffer.from(toStr(data), 'base64').toString();\n  }\n  const bs = atob(toStr(data));\n  const b = new Uint8Array(bs.length);\n  for (let i = 0; i < b.length; ++i) {\n    b[i] = bs.charCodeAt(i);\n  }\n  return new TextDecoder().decode(b);\n}\n\nconst DECODERS: {[key: string]: (v: Uint32Array) => number | string} = {\n  inline: toInt,\n  size: toInt,\n  name: toName,\n  width: toSize,\n  height: toSize,\n  preserveAspectRatio: toInt\n};\n\n\n// sequence type markers\n// File\nconst FILE_MARKER = [70, 105, 108, 101];\n// MultipartFile\nconst MULTIPARTFILE_MARKER = [77, 117, 108, 116, 105, 112, 97, 114, 116, 70, 105, 108, 101];\n// FilePart\nconst FILEPART_MARKER = [70, 105, 108, 101, 80, 97, 114, 116];\n// FileEnd\nconst FILEEND_MARKER = [70, 105, 108, 101, 69, 110, 100];\n// ReportCellSize\nconst REPORTCELLSIZE_MARKER = [82, 101, 112, 111, 114, 116, 67, 101, 108, 108, 83, 105, 122, 101];\n\n// max allowed chars for sequence header\nconst MAX_FIELDCHARS = 1024;\n\n\nexport class HeaderParser {\n  public state: HeaderState = HeaderState.START;\n  private _buffer = new Uint32Array(MAX_FIELDCHARS);\n  private _position = 0;\n  private _key = '';\n  public fields: {[key: string]: number | string | Uint32Array | null | undefined} = {};\n\n  public reset(): void {\n    this._buffer.fill(0);\n    this.state = HeaderState.START;\n    this._position = 0;\n    this.fields = {};\n    this._key = '';\n  }\n\n  public end(): number {\n    if (this.state === HeaderState.START) {\n      if (this._position === FILEEND_MARKER.length) {\n        for (let k = 0; k < FILEEND_MARKER.length; ++k) {\n          if (this._buffer[k] !== FILEEND_MARKER[k]) return this._a();\n        }\n        this.fields['type'] = SequenceType.FILEEND;\n        this.state = HeaderState.END;\n        return 0;\n      }\n      if (this._position === REPORTCELLSIZE_MARKER.length) {\n        for (let k = 0; k < REPORTCELLSIZE_MARKER.length; ++k) {\n          if (this._buffer[k] !== REPORTCELLSIZE_MARKER[k]) return this._a();\n        }\n        this.fields['type'] = SequenceType.REPORTCELLSIZE;\n        this.state = HeaderState.END;\n        return 0;\n      }\n      return this._a();\n    }\n    if (this.state === HeaderState.END) return 0;\n    if (this.state === HeaderState.VALUE\n      && this.fields.type === SequenceType.MULTIPARTFILE\n    ) {\n      if (!this._storeValue(this._position)) return this._a();\n      this.state = HeaderState.END;\n      return 0;\n    }\n    return this._a();\n  }\n\n  public parse(data: Uint32Array, start: number, end: number): number {\n    let state = this.state;\n    let pos = this._position;\n    const buffer = this._buffer;\n    if (state === HeaderState.ABORT || state === HeaderState.END) return -1;\n    if (state === HeaderState.START && pos > 14) return -1;\n    for (let i = start; i < end; ++i) {\n      const c = data[i];\n      switch (c) {\n        case 59: // ;\n          if (!this._storeValue(pos)) return this._a();\n          state = HeaderState.KEY;\n          pos = 0;\n          break;\n        case 61: // =\n          if (state === HeaderState.START) {\n            if (buffer[0] === 70) {\n              // 'File' or 'FilePart'\n              let k = 0;\n              for (; k < FILE_MARKER.length; ++k) {\n                if (buffer[k] !== FILE_MARKER[k]) return this._a();\n              }\n              this.fields['type'] = SequenceType.FILE;\n              if (pos === FILEPART_MARKER.length) {\n                for (; k < FILEPART_MARKER.length; ++k) {\n                  if (buffer[k] !== FILEPART_MARKER[k]) return this._a();\n                }\n                this.fields['type'] = SequenceType.FILEPART;\n                this.state = HeaderState.END;\n                return i + 1;\n              }\n            } else if (buffer[0] === 77) {\n              // 'MultipartFile'\n              for (let k = 0; k < MULTIPARTFILE_MARKER.length; ++k) {\n                if (buffer[k] !== MULTIPARTFILE_MARKER[k]) return this._a();\n              }\n              this.fields['type'] = SequenceType.MULTIPARTFILE;\n            } else {\n              return this._a();\n            }\n            state = HeaderState.KEY;\n            pos = 0;\n          } else if (state === HeaderState.KEY) {\n            if (!this._storeKey(pos)) return this._a();\n            state = HeaderState.VALUE;\n            pos = 0;\n          } else if (state === HeaderState.VALUE) {\n            if (pos >= MAX_FIELDCHARS) return this._a();\n            buffer[pos++] = c;\n          }\n          break;\n        case 58: // :\n          if (state === HeaderState.VALUE) {\n            if (!this._storeValue(pos)) return this._a();\n          }\n          this.state = HeaderState.END;\n          return i + 1;\n        default:\n          if (pos >= MAX_FIELDCHARS) return this._a();\n          buffer[pos++] = c;\n      }\n    }\n    this.state = state;\n    this._position = pos;\n    return -2;\n  }\n\n  private _a(): number {\n    this.fields.type = SequenceType.INVALID;\n    this.state = HeaderState.ABORT;\n    return -1;\n  }\n\n  private _storeKey(pos: number): boolean {\n    const k = toStr(this._buffer.subarray(0, pos));\n    if (k) {\n      this._key = k;\n      this.fields[k] = null;\n      return true;\n    }\n    return false;\n  }\n\n  private _storeValue(pos: number): boolean {\n    if (this._key) {\n      try {\n        const v = this._buffer.slice(0, pos);\n        this.fields[this._key] = DECODERS[this._key] ? DECODERS[this._key](v) : v;\n      } catch {\n        return false;\n      }\n      return true;\n    }\n    return false;\n  }\n}\n", "/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\n\nexport type ImageType = 'image/png' | 'image/jpeg' | 'image/gif' | 'image/qoi' | 'image/webp' | 'image/avif' | 'unsupported' | '';\n\nexport interface IMetrics {\n  mime: ImageType;\n  width: number;\n  height: number;\n}\n\nexport const UNSUPPORTED_TYPE: IMetrics = {\n  mime: 'unsupported',\n  width: 0,\n  height: 0\n};\n\nexport function imageType(d: Uint8Array): IMetrics {\n  if (d.length < 32) {\n    return UNSUPPORTED_TYPE;\n  }\n  const d32 = new Uint32Array(d.buffer, d.byteOffset, 8);\n  // PNG: 89 50 4E 47 0D 0A 1A 0A (8 first bytes == magic number for PNG)\n  // + first chunk must be IHDR\n  if (d32[0] === 0x474E5089 && d32[1] === 0x0A1A0A0D && d32[3] === 0x52444849) {\n    return {\n      mime: 'image/png',\n      width:  d[16] << 24 | d[17] << 16 | d[18] << 8 | d[19],\n      height: d[20] << 24 | d[21] << 16 | d[22] << 8 | d[23]\n    };\n  }\n  // JPEG: FF D8 FF\n  if (d[0] === 0xFF && d[1] === 0xD8 && d[2] === 0xFF) {\n    const [width, height] = jpgSize(d);\n    return { mime: 'image/jpeg', width, height };\n  }\n  // GIF: GIF87a or GIF89a\n  if (d32[0] === 0x38464947 && (d[4] === 0x37 || d[4] === 0x39) && d[5] === 0x61) {\n    return {\n      mime: 'image/gif',\n      width:  d[7] << 8 | d[6],\n      height: d[9] << 8 | d[8]\n    };\n  }\n  // QOI: qoif\n  if (d32[0] === 0x66696F71) {\n    return {\n      mime: 'image/qoi',\n      width:  d[4] << 24 | d[5] << 16 | d[6] << 8 | d[7],\n      height: d[8] << 24 | d[9] << 16 | d[10] << 8 | d[11]\n    };\n  }\n  // WEBP: RIFF | xxxx | WEBP | VP8x\n  if (d32[0] === 0x46464952 && d32[2] === 0x50424557 && (d32[3] & 0xFFFFFF) === 0x385056) {\n    switch (d[15]) {\n      case 0x58:  // Extended WebP VP8X --> \"X\"\n        return {\n          mime: 'image/webp',\n          width:  (d[24] | d[25] << 8 | d[26] << 16) + 1,\n          height: (d[27] | d[28] << 8 | d[29] << 16) + 1\n        };\n      case 0x4C:  // Lossless WebP VP8L --> \"L\"\n        if (d[20] !== 0x2f) return UNSUPPORTED_TYPE;\n        const dim = d[21] | d[22] << 8 | d[23] << 16 | d[24] << 24;\n        return {\n          mime: 'image/webp',\n          width:  (dim        & 0x3FFF) + 1,\n          height: (dim >>> 14 & 0x3FFF) + 1\n        };\n      case 0x20:  // Lossy WebP VP8  --> \" \"\n        if (d[23] !== 0x9d || d[24] !== 0x01 || d[25] !== 0x2a) return UNSUPPORTED_TYPE;\n        return {\n          mime: 'image/webp',\n          width:  (d[26] | d[27] << 8) & 0x3FFF,\n          height: (d[28] | d[29] << 8) & 0x3FFF\n        };\n    }\n    return UNSUPPORTED_TYPE;\n  }\n  // AVIF: Box size | ftyp | avif/avis\n  if (d32[1] === 0x70797466 && (d32[2] === 0x66697661 || d32[2] === 0x73697661)) {\n    let pos = -1;\n    // search for ispe box within first 1024 bytes\n    const limit = Math.min(d.length - 16, 1024);\n    for (let i = 8; i < limit; i++) {\n      // scan for ispe\n      if (d[i] === 0x69 && d[i + 1] === 0x73 && d[i + 2] === 0x70 && d[i + 3] === 0x65) {\n        pos = i;\n        break;\n      }\n    }\n    if (pos !== -1) {\n      // dimensions are in BE at +8 (width) at +12 (height)\n      const width =\n        d[pos +  8] << 24 |\n        d[pos +  9] << 16 |\n        d[pos + 10] <<  8 |\n        d[pos + 11];\n      const height =\n        d[pos + 12] << 24 |\n        d[pos + 13] << 16 |\n        d[pos + 14] <<  8 |\n        d[pos + 15];\n      if (width > 0 && height > 0) {\n        return { mime: 'image/avif', width, height };\n      }\n    }\n    return UNSUPPORTED_TYPE;\n  }\n  return UNSUPPORTED_TYPE;\n}\n\n\nfunction jpgSize(d: Uint8Array): [number, number] {\n  const len = d.length;\n  let i = 4;\n  let blockLength = d[i] << 8 | d[i + 1];\n  while (true) {\n    i += blockLength;\n    if (i >= len) {\n      // exhausted without size info\n      return [0, 0];\n    }\n    if (d[i] !== 0xFF) {\n      return [0, 0];\n    }\n    if (d[i + 1] === 0xC0 || d[i + 1] === 0xC2) {\n      if (i + 8 < len) {\n        return [\n          d[i + 7] << 8 | d[i + 8],\n          d[i + 5] << 8 | d[i + 6]\n        ];\n      }\n      return [0, 0];\n    }\n    i += 2;\n    blockLength = d[i] << 8 | d[i + 1];\n  }\n}\n", "/**\n * Copyright (c) 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IDisposable } from '@xterm/xterm';\nimport { IApcHandler, IImageAddonOptions, IResetHandler, ITerminalExt, ImageLayer } from '../Types';\nimport { ImageRenderer } from '../ImageRenderer';\nimport { CELL_SIZE_DEFAULT } from '../ImageStorage';\nimport { KittyImageStorage } from './KittyImageStorage';\nimport Base64Decoder, { type DecodeStatus } from 'xterm-wasm-parts/lib/base64/Base64Decoder.wasm';\nimport {\n  KittyAction,\n  KittyFormat,\n  KittyCompression,\n  IKittyCommand,\n  IPendingTransmission,\n  IKittyImageData,\n  KittyPixelConstants,\n  parseKittyCommand\n} from './KittyGraphicsTypes';\n\nconst enum Constants {\n  // Memory limit for base64 decoder (4MB, same as IIPHandler)\n  DECODER_KEEP_DATA = 4194304,\n  DECODER_INITIAL_DATA = 4194304, // 4MB\n  // Local mirror of const enum (esbuild can't inline const enums from external packages)\n  DECODER_OK = 0,\n  // Maximum control data size\n  MAX_CONTROL_DATA_SIZE = 512,\n  // Semicolon codepoint\n  SEMICOLON = 0x3B\n}\n\nconst DECODER_OK = Constants.DECODER_OK as unknown as DecodeStatus.OK;\n\n// Kitty graphics protocol handler with streaming base64 decoding.\nexport class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDisposable {\n  private _aborted = false;\n  private _decodeError = false;\n\n  private _activeDecoder: Base64Decoder | null = null;\n  private readonly _maxEncodedBytes: number;\n  private readonly _initialEncodedBytes: number;\n\n  // Streaming related states\n\n  // True while receiving control data (before semicolon).\n  private _inControlData = true;\n\n  // Buffer for control data.\n  private _controlData = new Uint32Array(Constants.MAX_CONTROL_DATA_SIZE);\n  private _controlLength = 0;\n\n  // Pre-calculated encoded size limit\n  private _encodedSizeLimit = 0;\n  private _totalEncodedSize = 0;\n\n  // Parsed command. These are the control data before semicolon.\n  private _parsedCommand: IKittyCommand | null = null;\n\n  // Storage related states\n\n  private _pendingTransmissions: Map<number, IPendingTransmission> = new Map();\n  // Tracks the pending key of the most recently started chunked upload.\n  // Per spec, subsequent chunks only need m= (and optionally q=), without i=.\n  // When a chunk arrives with no i=, this key is used to find the pending upload.\n  private _lastPendingKey: number | undefined;\n\n  constructor(\n    private readonly _opts: IImageAddonOptions,\n    private readonly _renderer: ImageRenderer,\n    private readonly _kittyStorage: KittyImageStorage,\n    private readonly _coreTerminal: ITerminalExt\n  ) {\n    // Convert decoded size limit -> max encoded bytes.\n    this._maxEncodedBytes = Math.ceil(this._opts.kittySizeLimit * 4 / 3);\n    // ensure we preallocate more than configured limit while using 4mb initial size.\n    this._initialEncodedBytes = Math.min(Constants.DECODER_INITIAL_DATA, this._maxEncodedBytes);\n  }\n\n  public reset(): void {\n    this._cleanupAllPending();\n    if (this._activeDecoder) {\n      this._activeDecoder.release();\n      this._activeDecoder = null;\n    }\n    this._kittyStorage.reset();\n  }\n\n  public dispose(): void {\n    this.reset();\n  }\n\n  private _removePendingEntry(key: number): void {\n    this._pendingTransmissions.delete(key);\n    if (this._lastPendingKey === key) {\n      this._lastPendingKey = undefined;\n    }\n  }\n\n  private _cleanupAllPending(): void {\n    for (const pending of this._pendingTransmissions.values()) {\n      pending.decoder.release();\n    }\n    this._pendingTransmissions.clear();\n    this._lastPendingKey = undefined;\n  }\n\n  public start(): void {\n    this._aborted = false;\n    this._decodeError = false;\n    this._inControlData = true;\n    this._controlLength = 0;\n    this._parsedCommand = null;\n    // Pre-calculate encoded limit once: base64 is 4 bytes encoded \u2192 3 bytes decoded\n    this._encodedSizeLimit = this._maxEncodedBytes;\n    this._totalEncodedSize = 0;\n    this._activeDecoder = null;\n  }\n\n  public put(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted) return;\n\n    if (!this._inControlData) {\n      this._streamPayload(data, start, end);\n    } else {\n      // Scan for semicolon\n      let controlEnd = end;\n      for (let i = start; i < end; i++) {\n        if (data[i] === Constants.SEMICOLON) {\n          this._inControlData = false;\n          controlEnd = i;\n          break;\n        }\n      }\n\n      // Copy control data\n      const copyLength = controlEnd - start;\n      if (this._controlLength + copyLength > Constants.MAX_CONTROL_DATA_SIZE) {\n        this._aborted = true;\n        return;\n      }\n      this._controlData.set(data.subarray(start, controlEnd), this._controlLength);\n      this._controlLength += copyLength;\n\n      if (!this._inControlData) {\n        // Found semicolon - parse control data early for validation\n        this._parsedCommand = parseKittyCommand(this._parseControlDataString());\n\n        // Early validation: i+I conflict\n        if (this._parsedCommand.id !== undefined && this._parsedCommand.imageNumber !== undefined) {\n          this._sendResponse(this._parsedCommand.id, 'EINVAL:cannot specify both i and I keys', this._parsedCommand.quiet ?? 0);\n          this._aborted = true;\n          return;\n        }\n\n        // Delete action doesn't need payload - skip streaming\n        if (this._parsedCommand.action === KittyAction.DELETE) {\n          return;\n        }\n\n        // Stream remaining as payload\n        const payloadStart = controlEnd + 1;\n        if (payloadStart < end) {\n          this._streamPayload(data, payloadStart, end);\n        }\n      }\n    }\n  }\n\n  // Stream payload bytes into the base64 decoder.\n  private _streamPayload(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted) return;\n\n    // Check size limit (compare encoded bytes against pre-calculated limit)\n    // Include cumulative size from pending transmission for multi-chunk images.\n    // Per spec, subsequent chunks may omit i=, so fall back to _lastPendingKey.\n    const pendingKey = this._parsedCommand?.id ?? this._lastPendingKey ?? 0;\n    const pending = this._pendingTransmissions.get(pendingKey);\n    const previousEncodedSize = pending?.totalEncodedSize ?? 0;\n    this._totalEncodedSize += end - start;\n    const cumulativeEncodedSize = previousEncodedSize + this._totalEncodedSize;\n    if (cumulativeEncodedSize > this._encodedSizeLimit) {\n      const decoderToRelease = this._activeDecoder ?? pending?.decoder;\n      if (decoderToRelease) {\n        decoderToRelease.release();\n      }\n      this._activeDecoder = null;\n      if (pending) {\n        this._removePendingEntry(pendingKey);\n      }\n      this._aborted = true;\n      return;\n    }\n\n    if (this._decodeError) return;\n\n    if (pending?.decoder && !this._activeDecoder) {\n      this._activeDecoder = pending.decoder;\n    }\n    if (!this._activeDecoder) {\n      this._activeDecoder = new Base64Decoder(Constants.DECODER_KEEP_DATA, this._maxEncodedBytes, this._initialEncodedBytes);\n      this._activeDecoder.init();\n    }\n\n    if (this._activeDecoder.put(data.subarray(start, end)) !== DECODER_OK) {\n      this._activeDecoder.release();\n      this._activeDecoder = null;\n      this._decodeError = true;\n      if (pending) {\n        this._removePendingEntry(pendingKey);\n      }\n    }\n  }\n\n  public end(success: boolean): boolean | Promise<boolean> {\n    if (this._aborted || !success) {\n      if (this._activeDecoder) {\n        this._activeDecoder.release();\n        this._activeDecoder = null;\n      }\n      return true;\n    }\n\n    // No semicolon = no payload (delete, capability query)\n    if (this._inControlData) {\n      return this._handleNoPayloadCommand();\n    }\n\n    // Use command parsed early in put() - i+I already validated there\n    const cmd = this._parsedCommand!;\n\n    // Delete action was handled by skipping payload - just execute\n    if (cmd.action === KittyAction.DELETE) {\n      return this._handleDelete(cmd);\n    }\n\n    // Per spec, subsequent chunks may omit i=, so fall back to _lastPendingKey.\n    const pendingKey = cmd.id ?? this._lastPendingKey ?? 0;\n    const isMoreComing = cmd.more === 1;\n    const pending = this._pendingTransmissions.get(pendingKey);\n\n    if (isMoreComing) {\n      if (this._activeDecoder) {\n        if (pending) {\n          pending.totalEncodedSize += this._totalEncodedSize;\n          pending.decodeError = pending.decodeError || this._decodeError;\n        } else {\n          this._pendingTransmissions.set(pendingKey, {\n            cmd: { ...cmd },\n            decoder: this._activeDecoder,\n            totalEncodedSize: this._totalEncodedSize,\n            decodeError: this._decodeError\n          });\n        }\n        this._lastPendingKey = pendingKey;\n        this._activeDecoder = null;\n      }\n      return true;\n    }\n\n    // Final chunk received \u2014 clear the last pending key\n    if (pending) {\n      this._lastPendingKey = undefined;\n    }\n\n    let decodeError = this._decodeError;\n    let finalCmd = cmd;\n    let decoder = this._activeDecoder;\n\n    if (pending) {\n      finalCmd = pending.cmd;\n      decoder = pending.decoder;\n      decodeError = decodeError || pending.decodeError;\n      this._pendingTransmissions.delete(pendingKey);\n    }\n\n    let imageBytes = new Uint8Array(0);\n    if (decoder) {\n      if (decoder.end() !== DECODER_OK) {\n        decodeError = true;\n      }\n      imageBytes = decoder.data8;\n    }\n    this._activeDecoder = null;\n\n    // Handle command first \u2014 handlers create Blob/ImageData from imageBytes,\n    // which copies the data. Only then is it safe to release the decoder's\n    // wasm memory that imageBytes points into.\n    const result = this._handleCommandWithBytesAndCmd(finalCmd, imageBytes, decodeError);\n    if (decoder) {\n      decoder.release();\n    }\n    return result;\n  }\n\n  // Command handling\n\n  private _parseControlDataString(): string {\n    let str = '';\n    for (let i = 0; i < this._controlLength; i++) {\n      str += String.fromCodePoint(this._controlData[i]);\n    }\n    return str;\n  }\n\n  private _handleNoPayloadCommand(): boolean | Promise<boolean> {\n    const cmd = parseKittyCommand(this._parseControlDataString());\n\n    // Per spec: specifying both i and I is an error\n    if (cmd.id !== undefined && cmd.imageNumber !== undefined) {\n      this._sendResponse(cmd.id, 'EINVAL:cannot specify both i and I keys', cmd.quiet ?? 0);\n      return true;\n    }\n\n    const action = cmd.action ?? 't';\n\n    switch (action) {\n      case KittyAction.DELETE:\n        return this._handleDelete(cmd);\n      case KittyAction.QUERY:\n        this._sendResponse(cmd.id ?? 0, 'OK', cmd.quiet ?? 0);\n        return true;\n      case KittyAction.PLACEMENT:\n        return this._handlePlacement(cmd);\n      default:\n        // TODO: Implement remaining actions when needed:\n        // - a=f (frame): animation frame operations\n        // - a=a (animation): animation control\n        // - a=c (compose): compose images\n        if (cmd.id !== undefined) {\n          this._sendResponse(cmd.id, 'EINVAL:unsupported action', cmd.quiet ?? 0);\n        }\n        return true;\n    }\n  }\n\n  private _handleCommandWithBytesAndCmd(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean | Promise<boolean> {\n    const action = cmd.action ?? 't';\n\n    switch (action) {\n      case KittyAction.TRANSMIT: {\n        const result = this._handleTransmit(cmd, bytes, decodeError);\n        // Only send response when _handleTransmit didn't already respond\n        // (it handles unsupported transmission medium responses internally)\n        if ((cmd.transmission ?? 'd') === 'd' && cmd.id !== undefined) {\n          if (decodeError) {\n            this._sendResponse(cmd.id, 'EINVAL:invalid base64 data', cmd.quiet ?? 0);\n          } else if (bytes.length > 0) {\n            this._sendResponse(cmd.id, 'OK', cmd.quiet ?? 0);\n          }\n        }\n        return result;\n      }\n      case KittyAction.TRANSMIT_DISPLAY:\n        return this._handleTransmitDisplay(cmd, bytes, decodeError);\n      case KittyAction.QUERY:\n        return this._handleQuery(cmd, bytes, decodeError);\n      case KittyAction.PLACEMENT:\n        // a=p ignores any payload \u2014 image data was already transmitted\n        return this._handlePlacement(cmd);\n      default:\n        // TODO: Implement remaining actions when needed:\n        // - a=f (frame): animation frame operations\n        // - a=a (animation): animation control\n        // - a=c (compose): compose images\n        if (cmd.id !== undefined) {\n          this._sendResponse(cmd.id, 'EINVAL:unsupported action', cmd.quiet ?? 0);\n        }\n        return true;\n    }\n  }\n\n  private _handlePlacement(cmd: IKittyCommand): boolean | Promise<boolean> {\n    if (cmd.id === undefined) {\n      return true;\n    }\n    const id = cmd.id;\n    const image = this._kittyStorage.getImage(id);\n    if (!image) {\n      this._sendResponse(id, 'ENOENT:image not found', cmd.quiet ?? 0, cmd.placementId);\n      return true;\n    }\n    const result = this._displayImage(image, cmd);\n    return result.then(success => {\n      this._sendResponse(id, success ? 'OK' : 'EINVAL:image rendering failed', cmd.quiet ?? 0, cmd.placementId);\n      return true;\n    });\n  }\n\n  private _handleTransmit(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean {\n    // TODO: Support file-based transmission modes (t=f, t=t, t=s)\n    // Currently only supports direct transmission (t=d, the default).\n    // - t=f (file): Payload is base64-encoded file path. Terminal reads image from that path.\n    // - t=t (temp file): Payload is base64-encoded path in temp directory. Terminal reads, deletes.\n    // - t=s: Payload is base64-encoded POSIX shm name. Terminal reads from shared memory.\n    // These modes require filesystem/IPC access not available in browsers. For Node.js/Electron:\n    // 1. Check cmd.transmission (t key) before treating bytes as image data\n    // 2. For t=f/t/s: decode bytes as UTF-8 string (the path/name), then read file contents\n    // 3. For t=d: treat bytes as image data (current behavior)\n    // When implementing, also update _handleQuery to accept these transmission mediums.\n    const transmission = cmd.transmission ?? 'd';\n    if (transmission !== 'd') {\n      if (cmd.id !== undefined) {\n        this._sendResponse(cmd.id, 'EINVAL:unsupported transmission medium', cmd.quiet ?? 0);\n      }\n      return true;\n    }\n\n    if (decodeError || bytes.length === 0) return true;\n\n    this._kittyStorage.storeImage(cmd.id, {\n      data: new Blob([bytes as BlobPart]),\n      width: cmd.width ?? 0,\n      height: cmd.height ?? 0,\n      format: (cmd.format ?? KittyFormat.RGBA) as 24 | 32 | 100,\n      compression: cmd.compression ?? ''\n    });\n    return true;\n  }\n\n  private _handleTransmitDisplay(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean | Promise<boolean> {\n    if (decodeError) {\n      if (cmd.id !== undefined) {\n        this._sendResponse(cmd.id, 'EINVAL:invalid base64 data', cmd.quiet ?? 0);\n      }\n      return true;\n    }\n\n    this._handleTransmit(cmd, bytes, decodeError);\n\n    const id = cmd.id ?? this._kittyStorage.lastImageId;\n    const image = this._kittyStorage.getImage(id);\n    if (image) {\n      const result = this._displayImage(image, cmd);\n      if (cmd.id !== undefined) {\n        return result.then(success => {\n          this._sendResponse(id, success ? 'OK' : 'EINVAL:image rendering failed', cmd.quiet ?? 0);\n          return true;\n        });\n      }\n      return result.then(() => true);\n    }\n    return true;\n  }\n\n  private _handleQuery(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean {\n    const id = cmd.id ?? 0;\n    const quiet = cmd.quiet ?? 0;\n\n    // Per spec: reject unsupported transmission mediums (only t=d is supported atm)\n    // TODO: When filesystem support is added (Node.js/Electron), update this to accept\n    // t=f (file), t=t (temp file), and t=s (shared memory) and respond OK for queries.\n    const transmission = cmd.transmission ?? 'd';\n    if (transmission !== 'd') {\n      this._sendResponse(id, 'EINVAL:unsupported transmission medium', quiet);\n      return true;\n    }\n\n    // Check decode error first (invalid base64)\n    if (decodeError) {\n      this._sendResponse(id, 'EINVAL:invalid base64 data', quiet);\n      return true;\n    }\n\n    // Capability query (no payload) - just respond OK\n    if (bytes.length === 0) {\n      this._sendResponse(id, 'OK', quiet);\n      return true;\n    }\n\n    const format = cmd.format ?? KittyFormat.RGBA;\n\n    if (format === KittyFormat.PNG) {\n      this._sendResponse(id, 'OK', quiet);\n    } else {\n      const width = cmd.width ?? 0;\n      const height = cmd.height ?? 0;\n\n      if (!width || !height) {\n        this._sendResponse(id, 'EINVAL:width and height required for raw pixel data', quiet);\n        return true;\n      }\n\n      const bytesPerPixel = format === KittyFormat.RGBA ? KittyPixelConstants.BYTES_PER_PIXEL_RGBA : KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n      const expectedBytes = width * height * bytesPerPixel;\n\n      if (bytes.length < expectedBytes) {\n        this._sendResponse(id, `EINVAL:insufficient pixel data`, quiet);\n        return true;\n      }\n\n      this._sendResponse(id, 'OK', quiet);\n    }\n    return true;\n  }\n\n  private _handleDelete(cmd: IKittyCommand): boolean {\n    // Per spec: default delete selector is 'a' (delete all visible placements)\n    const selector = cmd.deleteSelector ?? 'a';\n\n    // TODO: Distinguish lowercase (delete placements only) from uppercase\n    // (delete placements + free stored image data). Currently both variants\n    // free everything since we don't separate stored data from placements.\n    switch (selector) {\n      case 'a':\n      case 'A':\n        this._cleanupAllPending();\n        this._kittyStorage.deleteAll();\n        break;\n      case 'i':\n      case 'I':\n        // TODO: When placement id tracking is implemented (see TODO in\n        // KittyImageStorage), d=i with p=<pid> should delete only that\n        // specific placement, while d=i without p should delete all\n        // placements for the image.\n        if (cmd.id !== undefined) {\n          const pending = this._pendingTransmissions.get(cmd.id);\n          if (pending) {\n            pending.decoder.release();\n          }\n          this._removePendingEntry(cmd.id);\n          this._kittyStorage.deleteById(cmd.id);\n        }\n        break;\n      default:\n        // Unsupported selectors (c, n, p, q, r, x, y, z, f) \u2014 ignore for now\n        break;\n    }\n    return true;\n  }\n\n  private _sendResponse(id: number, message: string, quiet: number, placementId?: number): void {\n    const isOk = message === 'OK';\n    if (isOk && quiet >= 1) return;\n    if (!isOk && quiet >= 2) return;\n\n    const pPart = placementId ? `,p=${placementId}` : '';\n    const response = `\\x1b_Gi=${id}${pPart};${message}\\x1b\\\\`;\n    this._coreTerminal._core.coreService.triggerDataEvent(response);\n  }\n\n  // Image display\n\n  private _displayImage(image: IKittyImageData, cmd: IKittyCommand): Promise<boolean> {\n    return this._decodeAndDisplay(image, cmd)\n      .then(() => true)\n      .catch(() => false);\n  }\n\n  private async _decodeAndDisplay(image: IKittyImageData, cmd: IKittyCommand): Promise<void> {\n    let bitmap: ImageBitmap | undefined = await this._createBitmap(image);\n\n    try {\n      const cropX = Math.max(0, cmd.x ?? 0);\n      const cropY = Math.max(0, cmd.y ?? 0);\n      const cropW = cmd.sourceWidth || (bitmap.width - cropX);\n      const cropH = cmd.sourceHeight || (bitmap.height - cropY);\n\n      const maxCropW = Math.max(0, bitmap.width - cropX);\n      const maxCropH = Math.max(0, bitmap.height - cropY);\n      const finalCropW = Math.max(0, Math.min(cropW, maxCropW));\n      const finalCropH = Math.max(0, Math.min(cropH, maxCropH));\n\n      if (finalCropW === 0 || finalCropH === 0) {\n        throw new Error('invalid source rectangle');\n      }\n\n      if (cropX !== 0 || cropY !== 0 || finalCropW !== bitmap.width || finalCropH !== bitmap.height) {\n        const cropped = await createImageBitmap(bitmap, cropX, cropY, finalCropW, finalCropH);\n        bitmap.close();\n        bitmap = cropped;\n      }\n\n      const cw = this._renderer.dimensions?.css.cell.width || CELL_SIZE_DEFAULT.width;\n      const ch = this._renderer.dimensions?.css.cell.height || CELL_SIZE_DEFAULT.height;\n\n      // Per spec: c/r default to image's natural cell dimensions.\n      // If only one of c/r is specified, compute the other from image aspect ratio.\n      let imgCols: number;\n      let imgRows: number;\n      if (cmd.columns !== undefined && cmd.rows !== undefined) {\n        imgCols = cmd.columns;\n        imgRows = cmd.rows;\n      } else if (cmd.columns !== undefined) {\n        imgCols = cmd.columns;\n        imgRows = Math.max(1, Math.ceil((bitmap.height / bitmap.width) * (imgCols * cw) / ch));\n      } else if (cmd.rows !== undefined) {\n        imgRows = cmd.rows;\n        imgCols = Math.max(1, Math.ceil((bitmap.width / bitmap.height) * (imgRows * ch) / cw));\n      } else {\n        imgCols = Math.ceil(bitmap.width / cw);\n        imgRows = Math.ceil(bitmap.height / ch);\n      }\n\n      let w = bitmap.width;\n      let h = bitmap.height;\n\n      // Scale bitmap to fit placement rectangle when c/r are specified\n      if (cmd.columns !== undefined || cmd.rows !== undefined) {\n        w = Math.round(imgCols * cw);\n        h = Math.round(imgRows * ch);\n      }\n\n      if (w * h > this._opts.pixelLimit) {\n        throw new Error('image exceeds pixel limit');\n      }\n\n      // Save cursor position before addImage modifies it\n      const buffer = this._coreTerminal._core.buffer;\n      const savedX = buffer.x;\n      const savedY = buffer.y;\n      const savedYbase = buffer.ybase;\n\n      // Determine layer based on z-index: negative = behind text, 0+ = on top.\n      // When z<0 we always use the bottom layer even without allowTransparency \u2014\n      // the image will simply be hidden behind the opaque text background, which\n      // is the correct behavior (client asked for \"behind text\").\n      const wantsBottom = cmd.zIndex !== undefined && cmd.zIndex < 0;\n      const layer: ImageLayer = wantsBottom ? 'bottom' : 'top';\n\n      if (w !== bitmap.width || h !== bitmap.height) {\n        const scaled = await createImageBitmap(bitmap, { resizeWidth: w, resizeHeight: h });\n        bitmap.close();\n        bitmap = scaled;\n      }\n\n      // Per spec: X/Y are pixel offsets within the first cell, so clamp to cell dimensions\n      const xOffset = Math.min(Math.max(0, cmd.xOffset ?? 0), cw - 1);\n      const yOffset = Math.min(Math.max(0, cmd.yOffset ?? 0), ch - 1);\n      if (xOffset !== 0 || yOffset !== 0) {\n        // Per spec: X/Y is not added to c/r area. When c/r are explicit, the\n        // total placement area remains c*cw \u00D7 r*ch pixels and the offset image\n        // is clipped to fit. When c/r are unset, the padded canvas determines\n        // the natural cell dimensions.\n        const canvasW = (cmd.columns !== undefined) ? Math.round(imgCols * cw) : bitmap.width + xOffset;\n        const canvasH = (cmd.rows !== undefined) ? Math.round(imgRows * ch) : bitmap.height + yOffset;\n        const offsetCanvas = ImageRenderer.createCanvas(window.document, canvasW, canvasH);\n        const offsetCtx = offsetCanvas.getContext('2d');\n        if (!offsetCtx) {\n          throw new Error('Failed to create offset canvas context');\n        }\n        offsetCtx.drawImage(bitmap, xOffset, yOffset);\n\n        const offsetBitmap = await createImageBitmap(offsetCanvas);\n        offsetCanvas.width = offsetCanvas.height = 0;\n        bitmap.close();\n        bitmap = offsetBitmap;\n        w = bitmap.width;\n        h = bitmap.height;\n        if (w * h > this._opts.pixelLimit) {\n          throw new Error('image exceeds pixel limit');\n        }\n        if (cmd.columns === undefined) {\n          imgCols = Math.ceil(bitmap.width / cw);\n        }\n        if (cmd.rows === undefined) {\n          imgRows = Math.ceil(bitmap.height / ch);\n        }\n      }\n\n      const zIndex = cmd.zIndex ?? 0;\n      this._kittyStorage.addImage(image.id, bitmap, true, layer, zIndex);\n      bitmap = undefined;  // ownership transferred to storage\n\n      // Kitty cursor movement\n      // Per spec: cursor placed at first column after last image column,\n      // on the last row of the image. C=1 means don't move cursor.\n      if (cmd.cursorMovement === 1) {\n        // C=1: restore cursor to position before image was placed\n        const scrolled = buffer.ybase - savedYbase;\n        buffer.x = savedX;\n        // Can't restore cursor to scrollback?\n        buffer.y = Math.max(savedY - scrolled, 0);\n      } else {\n        // Default (C=0): advance cursor horizontally past the image\n        // addImage already positioned cursor on the last row via lineFeeds\n        buffer.x = Math.min(savedX + imgCols, this._coreTerminal.cols);\n      }\n    } catch (e) {\n      bitmap?.close();\n      throw e;\n    }\n  }\n\n  // Create ImageBitmap from already-decoded image data.\n  private async _createBitmap(image: IKittyImageData): Promise<ImageBitmap> {\n    let bytes: Uint8Array = new Uint8Array(await image.data.arrayBuffer());\n\n    if (image.compression === KittyCompression.ZLIB) {\n      bytes = await this._decompressZlib(bytes);\n    }\n\n    if (image.format === KittyFormat.PNG) {\n      const blob = new Blob([bytes as BlobPart], { type: 'image/png' });\n      if (!window.createImageBitmap) {\n        const url = URL.createObjectURL(blob);\n        const img = new Image();\n        return new Promise<ImageBitmap>((resolve, reject) => {\n          img.addEventListener('load', () => {\n            URL.revokeObjectURL(url);\n            const canvas = ImageRenderer.createCanvas(window.document, img.width, img.height);\n            canvas.getContext('2d')?.drawImage(img, 0, 0);\n            createImageBitmap(canvas).then(resolve).catch(reject);\n          });\n          img.addEventListener('error', () => {\n            URL.revokeObjectURL(url);\n            reject(new Error('Failed to load image'));\n          });\n          img.src = url;\n        });\n      }\n      return createImageBitmap(blob);\n    }\n\n    // Raw pixel data\n    const width = image.width;\n    const height = image.height;\n\n    if (!width || !height) {\n      throw new Error('Width and height required for raw pixel data');\n    }\n\n    const bytesPerPixel = image.format === KittyFormat.RGBA ? KittyPixelConstants.BYTES_PER_PIXEL_RGBA : KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n    const expectedBytes = width * height * bytesPerPixel;\n\n    if (bytes.length < expectedBytes) {\n      throw new Error('Insufficient pixel data');\n    }\n\n    const pixelCount = width * height;\n\n    if (image.format === KittyFormat.RGBA) {\n      // RGBA: use bytes directly \u2014 no copy needed\n      return createImageBitmap(new ImageData(new Uint8ClampedArray(bytes.buffer as ArrayBuffer, bytes.byteOffset, pixelCount * KittyPixelConstants.BYTES_PER_PIXEL_RGBA), width, height));\n    }\n\n    // RGB\u2192RGBA: interleave alpha using uint32 block processing (4 pixels per iteration).\n    // 3 uint32 reads + 4 uint32 writes per 4 pixels vs 28 byte reads/writes \u2014 ~6x faster.\n    // Assumes little-endian (all modern browsers/Node.js).\n    const data = new Uint8ClampedArray(pixelCount * KittyPixelConstants.BYTES_PER_PIXEL_RGBA);\n    const src32 = new Uint32Array(bytes.buffer, bytes.byteOffset, Math.floor(bytes.byteLength / 4));\n    const dst32 = new Uint32Array(data.buffer);\n    const alignedPixels = pixelCount & ~3;  // round down to multiple of 4\n\n    let srcOffset = 0;\n    let dstOffset = 0;\n    for (let i = 0; i < alignedPixels; i += 4) {\n      const b0 = src32[srcOffset++];\n      const b1 = src32[srcOffset++];\n      const b2 = src32[srcOffset++];\n      // Little-endian: pixel bytes are [R,G,B] \u2192 uint32 ABGR layout\n      dst32[dstOffset++] = 0xFF000000 | b0;\n      dst32[dstOffset++] = 0xFF000000 | (b0 >>> 24) | (b1 << 8);\n      dst32[dstOffset++] = 0xFF000000 | (b1 >>> 16) | (b2 << 16);\n      dst32[dstOffset++] = 0xFF000000 | (b2 >>> 8);\n    }\n\n    // Handle remaining 1\u20133 pixels\n    let srcByte = alignedPixels * KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n    let dstByte = alignedPixels * KittyPixelConstants.BYTES_PER_PIXEL_RGBA;\n    for (let i = alignedPixels; i < pixelCount; i++) {\n      data[dstByte]     = bytes[srcByte];\n      data[dstByte + 1] = bytes[srcByte + 1];\n      data[dstByte + 2] = bytes[srcByte + 2];\n      data[dstByte + 3] = KittyPixelConstants.ALPHA_OPAQUE;\n      srcByte += KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n      dstByte += KittyPixelConstants.BYTES_PER_PIXEL_RGBA;\n    }\n\n    return createImageBitmap(new ImageData(data, width, height));\n  }\n\n  private async _decompressZlib(compressed: Uint8Array): Promise<Uint8Array> {\n    try {\n      return await this._decompress(compressed, 'deflate');\n    } catch {\n      return await this._decompress(compressed, 'deflate-raw');\n    }\n  }\n\n  private async _decompress(compressed: Uint8Array, format: 'deflate' | 'deflate-raw'): Promise<Uint8Array> {\n    const ds = new DecompressionStream(format);\n    const writer = ds.writable.getWriter();\n    writer.write(compressed as BufferSource);\n    writer.close();\n\n    const chunks: Uint8Array[] = [];\n    const reader = ds.readable.getReader();\n\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) break;\n      chunks.push(value);\n    }\n\n    const totalLength = chunks.reduce((sum, chunk) => sum + chunk.length, 0);\n    const result = new Uint8Array(totalLength);\n    let offset = 0;\n    for (const chunk of chunks) {\n      result.set(chunk, offset);\n      offset += chunk.length;\n    }\n    return result;\n  }\n\n  public get images(): ReadonlyMap<number, IKittyImageData> {\n    return this._kittyStorage.images;\n  }\n\n  public get _kittyIdToStorageId(): ReadonlyMap<number, number> {\n    return this._kittyStorage.kittyIdToStorageId;\n  }\n\n  public get pendingTransmissions(): ReadonlyMap<number, IPendingTransmission> {\n    return this._pendingTransmissions;\n  }\n}\n", "/**\n * Copyright (c) 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n *\n * Kitty graphics protocol types, constants, and parsing utilities.\n */\n\nimport type Base64Decoder from 'xterm-wasm-parts/lib/base64/Base64Decoder.wasm';\n\n// Kitty graphics protocol action types.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference under key 'a'.\nexport const enum KittyAction {\n  TRANSMIT = 't',\n  TRANSMIT_DISPLAY = 'T',\n  QUERY = 'q',\n  PLACEMENT = 'p',\n  DELETE = 'd'\n}\n\n// Kitty graphics protocol format types.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference\nexport const enum KittyFormat {\n  RGB = 24,\n  RGBA = 32,\n  PNG = 100\n}\n\n// Kitty graphics protocol compression types.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference under key 'o'.\nexport const enum KittyCompression {\n  NONE = '',\n  ZLIB = 'z'\n}\n\n// Kitty graphics protocol control data keys.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference\nexport const enum KittyKey {\n  // Action to perform (t=transmit, T=transmit+display, q=query, p=placement, d=delete)\n  ACTION = 'a',\n  // Image format (24=RGB, 32=RGBA, 100=PNG)\n  FORMAT = 'f',\n  // Image ID for referencing stored images\n  ID = 'i',\n  // Image number (alternative to ID, terminal assigns ID)\n  IMAGE_NUMBER = 'I',\n  // Source image width in pixels\n  WIDTH = 's',\n  // Source image height in pixels\n  HEIGHT = 'v',\n  // The left edge (in pixels) of the image area to display\n  X_OFFSET = 'x',\n  // The top edge (in pixels) of the image area to display\n  Y_OFFSET = 'y',\n  // Width (in pixels) of the source rectangle to display\n  SOURCE_WIDTH = 'w',\n  // Height (in pixels) of the source rectangle to display\n  SOURCE_HEIGHT = 'h',\n  // Horizontal offset (in pixels) within the first cell\n  X_PLACEMENT_OFFSET = 'X',\n  // Vertical offset (in pixels) within the first cell\n  Y_PLACEMENT_OFFSET = 'Y',\n  // Number of terminal columns to display the image over\n  COLUMNS = 'c',\n  // Number of terminal rows to display the image over\n  ROWS = 'r',\n  // More data flag (1=more chunks coming, 0=final chunk)\n  MORE = 'm',\n  // Compression type (z=zlib). This is essential for chunking larger images.\n  COMPRESSION = 'o',\n  // Quiet mode (1=suppress OK responses, 2=suppress error responses)\n  QUIET = 'q',\n  // Cursor movement policy (0=move cursor after image, 1=don't move cursor)\n  CURSOR_MOVEMENT = 'C',\n  // Z-index for image layering (negative = behind text, 0+ = on top)\n  Z_INDEX = 'z',\n  // Transmission medium (d=direct, f=file, t=temp file, s=shared memory)\n  TRANSMISSION = 't',\n  // Delete selector (a/A=all, i/I=by id, c/C=at cursor, etc.) \u2014 only used when a=d\n  DELETE_SELECTOR = 'd',\n  // Placement ID for targeting specific placements\n  PLACEMENT_ID = 'p'\n}\n\n// Pixel format constants\nexport const enum KittyPixelConstants {\n  BYTES_PER_PIXEL_RGB = 3,\n  BYTES_PER_PIXEL_RGBA = 4,\n  ALPHA_OPAQUE = 255\n}\n\n// Parsed Kitty graphics command.\nexport interface IKittyCommand {\n  action?: string;\n  format?: number;\n  id?: number;\n  imageNumber?: number;\n  width?: number;\n  height?: number;\n  x?: number;\n  y?: number;\n  sourceWidth?: number;\n  sourceHeight?: number;\n  xOffset?: number;\n  yOffset?: number;\n  columns?: number;\n  rows?: number;\n  more?: number;\n  quiet?: number;\n  cursorMovement?: number;\n  zIndex?: number;\n  transmission?: string;\n  deleteSelector?: string;\n  placementId?: number;\n  compression?: string;\n  payload?: string;\n}\n\n// Pending chunked transmission state.\n// Stores metadata from the first chunk while accumulating decoded payload data.\nexport interface IPendingTransmission {\n  // The parsed command from the first chunk (contains action, format, dimensions, etc.)\n  cmd: IKittyCommand;\n  // Decoder used across chunked payloads\n  decoder: Base64Decoder;\n  // Total encoded (base64) bytes received across all chunks - for size limit enforcement\n  totalEncodedSize: number;\n  // Whether any chunk has failed to decode\n  decodeError: boolean;\n}\n\n// Stored Kitty image data.\nexport interface IKittyImageData {\n  id: number;\n  // Decoded image data stored as Blob (off JS heap) to avoid 2GB heap limit\n  data: Blob;\n  width: number;\n  height: number;\n  format: 24 | 32 | 100;\n  compression?: string;\n}\n\n// Parses Kitty graphics control data into a command object.\nexport function parseKittyCommand(data: string): IKittyCommand {\n  const cmd: IKittyCommand = {};\n  const parts = data.split(',');\n\n  for (const part of parts) {\n    const eqIdx = part.indexOf('=');\n    if (eqIdx === -1) continue;\n\n    const key = part.substring(0, eqIdx);\n    const value = part.substring(eqIdx + 1);\n\n    // Handle string keys first\n    if (key === KittyKey.ACTION) {\n      cmd.action = value;\n      continue;\n    }\n    if (key === KittyKey.COMPRESSION) {\n      cmd.compression = value;\n      continue;\n    }\n    if (key === KittyKey.TRANSMISSION) {\n      cmd.transmission = value;\n      continue;\n    }\n    if (key === KittyKey.DELETE_SELECTOR) {\n      cmd.deleteSelector = value;\n      continue;\n    }\n    const numValue = parseInt(value, 10);\n    switch (key) {\n      case KittyKey.FORMAT: cmd.format = numValue; break;\n      case KittyKey.ID: cmd.id = numValue; break;\n      case KittyKey.IMAGE_NUMBER: cmd.imageNumber = numValue; break;\n      case KittyKey.WIDTH: cmd.width = numValue; break;\n      case KittyKey.HEIGHT: cmd.height = numValue; break;\n      case KittyKey.X_OFFSET: cmd.x = numValue; break;\n      case KittyKey.Y_OFFSET: cmd.y = numValue; break;\n      case KittyKey.SOURCE_WIDTH: cmd.sourceWidth = numValue; break;\n      case KittyKey.SOURCE_HEIGHT: cmd.sourceHeight = numValue; break;\n      case KittyKey.X_PLACEMENT_OFFSET: cmd.xOffset = numValue; break;\n      case KittyKey.Y_PLACEMENT_OFFSET: cmd.yOffset = numValue; break;\n      case KittyKey.COLUMNS: cmd.columns = numValue; break;\n      case KittyKey.ROWS: cmd.rows = numValue; break;\n      case KittyKey.MORE: cmd.more = numValue; break;\n      case KittyKey.QUIET: cmd.quiet = numValue; break;\n      case KittyKey.CURSOR_MOVEMENT: cmd.cursorMovement = numValue; break;\n      case KittyKey.Z_INDEX: cmd.zIndex = numValue; break;\n      case KittyKey.PLACEMENT_ID: cmd.placementId = numValue; break;\n    }\n  }\n\n  return cmd;\n}\n", "/**\n * Copyright (c) 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IDisposable } from '@xterm/xterm';\nimport { ImageStorage } from '../ImageStorage';\nimport { ImageLayer, IAddImageOpts } from '../Types';\nimport { IKittyImageData } from './KittyGraphicsTypes';\n\n// Kitty-specific image storage controller.\n//\n// Wraps shared ImageStorage with kitty protocol semantics:\n// - tracks transmitted image payloads by kitty image id\n// - tracks kitty image id -> shared ImageStorage id mapping for displayed images\n// - mirrors shared-storage evictions into kitty maps\n// - applies protocol-level undisplayed-image eviction policy\nexport class KittyImageStorage implements IDisposable {\n  private static readonly _maxStoredImages = 256;\n\n  private _nextImageId = 1;\n  private readonly _images: Map<number, IKittyImageData> = new Map();\n  // TODO: Support multiple placements per image. The kitty spec identifies\n  // placements by an (image id, placement id) pair \u2014 same i + different p\n  // values should coexist, and same i + same p should replace the prior\n  // placement. Currently we track only one storage entry per kitty image id,\n  // so multiple placements of the same image overwrite each other. Fixing\n  // this requires changing these maps to Map<number, Map<number, number>>\n  // (kittyId \u2192 placementId \u2192 storageId) and updating addImage/deleteById\n  // accordingly. The underlying shared ImageStorage would also need to\n  // support multiple entries per logical image.\n  private readonly _kittyIdToStorageId: Map<number, number> = new Map();\n  private readonly _storageIdToKittyId: Map<number, number> = new Map();\n\n  private readonly _previousOnImageDeleted: ((storageId: number) => void) | undefined;\n  private readonly _wrappedOnImageDeleted: (storageId: number) => void;\n  private readonly _handleStorageImageDeleted = (storageId: number): void => {\n    const kittyId = this._storageIdToKittyId.get(storageId);\n    if (kittyId !== undefined) {\n      this._kittyIdToStorageId.delete(kittyId);\n      this._storageIdToKittyId.delete(storageId);\n      this._images.delete(kittyId);\n    }\n  };\n  private _addImageOpts: IAddImageOpts = { scrolling: true, layer: 'top', zIndex: 0, cursorPos: 'iip' };\n\n  constructor(\n    private readonly _storage: ImageStorage\n  ) {\n    this._previousOnImageDeleted = this._storage.onImageDeleted;\n    this._wrappedOnImageDeleted = (storageId: number) => {\n      this._previousOnImageDeleted?.(storageId);\n      this._handleStorageImageDeleted(storageId);\n    };\n    this._storage.onImageDeleted = this._wrappedOnImageDeleted;\n  }\n\n  public reset(): void {\n    this._nextImageId = 1;\n    this._images.clear();\n    this._kittyIdToStorageId.clear();\n    this._storageIdToKittyId.clear();\n  }\n\n  public dispose(): void {\n    this.reset();\n    if (this._storage.onImageDeleted === this._wrappedOnImageDeleted) {\n      this._storage.onImageDeleted = this._previousOnImageDeleted;\n    }\n  }\n\n  public storeImage(id: number | undefined, imageData: Omit<IKittyImageData, 'id'>): number {\n    const imageId = id ?? this._nextImageId++;\n\n    const oldStorageId = this._kittyIdToStorageId.get(imageId);\n    if (oldStorageId !== undefined) {\n      this._storage.deleteImage(oldStorageId);\n      this._kittyIdToStorageId.delete(imageId);\n      this._storageIdToKittyId.delete(oldStorageId);\n    }\n\n    if (!this._images.has(imageId) && this._images.size >= KittyImageStorage._maxStoredImages) {\n      this._evictUndisplayedImages();\n    }\n\n    this._images.set(imageId, {\n      ...imageData,\n      id: imageId\n    });\n    return imageId;\n  }\n\n  public addImage(kittyId: number, image: HTMLCanvasElement | ImageBitmap, scrolling: boolean, layer: ImageLayer, zIndex: number): void {\n    // Clean up stale reverse-mapping from a previous placement of the same\n    // kitty image.  The old shared-storage entry is kept (it may still be\n    // visible on screen) but its reverse mapping is removed so that eviction\n    // of the old entry won't incorrectly delete the kitty image data.\n    const oldStorageId = this._kittyIdToStorageId.get(kittyId);\n    if (oldStorageId !== undefined) {\n      this._storageIdToKittyId.delete(oldStorageId);\n    }\n    this._addImageOpts.scrolling = scrolling;\n    this._addImageOpts.layer = layer;\n    this._addImageOpts.zIndex = zIndex;\n    const storageId = this._storage.addImage(image, this._addImageOpts);\n    this._kittyIdToStorageId.set(kittyId, storageId);\n    this._storageIdToKittyId.set(storageId, kittyId);\n  }\n\n  public getImage(kittyId: number): IKittyImageData | undefined {\n    return this._images.get(kittyId);\n  }\n\n  public deleteById(kittyId: number): void {\n    this._images.delete(kittyId);\n    const storageId = this._kittyIdToStorageId.get(kittyId);\n    if (storageId !== undefined) {\n      this._storage.deleteImage(storageId);\n      this._kittyIdToStorageId.delete(kittyId);\n      this._storageIdToKittyId.delete(storageId);\n    }\n  }\n\n  public deleteAll(): void {\n    this._images.clear();\n    for (const storageId of this._kittyIdToStorageId.values()) {\n      this._storage.deleteImage(storageId);\n    }\n    this._kittyIdToStorageId.clear();\n    this._storageIdToKittyId.clear();\n  }\n\n  public get images(): ReadonlyMap<number, IKittyImageData> {\n    return this._images;\n  }\n\n  public get kittyIdToStorageId(): ReadonlyMap<number, number> {\n    return this._kittyIdToStorageId;\n  }\n\n  public get lastImageId(): number {\n    return this._nextImageId - 1;\n  }\n\n  private _evictUndisplayedImages(): void {\n    for (const [kittyId] of this._images) {\n      if (this._images.size <= KittyImageStorage._maxStoredImages / 2) {\n        break;\n      }\n      if (!this._kittyIdToStorageId.has(kittyId)) {\n        this._images.delete(kittyId);\n      }\n    }\n  }\n}\n", "/**\n * Copyright (c) 2020, 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { SixelImageStorage } from './SixelImageStorage';\nimport { IDcsHandler, IParams, IImageAddonOptions, ITerminalExt, AttributeData, IResetHandler, ReadonlyColorSet } from './Types';\nimport { toRGBA8888, BIG_ENDIAN, PALETTE_ANSI_256, PALETTE_VT340_COLOR } from 'sixel/lib/Colors';\nimport { RGBA8888 } from 'sixel/lib/Types';\nimport { ImageRenderer } from './ImageRenderer';\n\nimport { DecoderAsync, Decoder } from 'sixel/lib/Decoder';\n\n// always free decoder ressources after decoding if it exceeds this limit\nconst MEM_PERMA_LIMIT = 4194304; // 1024 pixels * 1024 pixels * 4 channels = 4MB\n\n// custom default palette: VT340 (lower 16 colors) + ANSI256 (up to 256) + zeroed (up to 4096)\nconst DEFAULT_PALETTE = PALETTE_ANSI_256;\nDEFAULT_PALETTE.set(PALETTE_VT340_COLOR);\n\n\nexport class SixelHandler implements IDcsHandler, IResetHandler {\n  private _size = 0;\n  private _aborted = false;\n  private _dec: Decoder | undefined;\n\n  constructor(\n    private readonly _opts: IImageAddonOptions,\n    private readonly _storage: SixelImageStorage,\n    private readonly _coreTerminal: ITerminalExt\n  ) {\n    DecoderAsync({\n      memoryLimit: this._opts.pixelLimit * 4,\n      palette: DEFAULT_PALETTE,\n      paletteLimit: this._opts.sixelPaletteLimit\n    }).then(d => this._dec = d);\n  }\n\n  public reset(): void {\n    /**\n     * reset sixel decoder to defaults:\n     * - release all memory\n     * - nullify palette (4096)\n     * - apply default palette (256)\n     */\n    if (this._dec) {\n      this._dec.release();\n      // FIXME: missing interface on decoder to nullify full palette\n      (this._dec as any)._palette.fill(0);\n      this._dec.init(0, DEFAULT_PALETTE, this._opts.sixelPaletteLimit);\n    }\n  }\n\n  public hook(params: IParams): void {\n    this._size = 0;\n    this._aborted = false;\n    if (this._dec) {\n      const fillColor = params.params[1] === 1 ? 0 : extractActiveBg(\n        this._coreTerminal._core._inputHandler._curAttrData,\n        this._coreTerminal._core._themeService?.colors);\n      this._dec.init(fillColor, null, this._opts.sixelPaletteLimit);\n    }\n  }\n\n  public put(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted || !this._dec) {\n      return;\n    }\n    this._size += end - start;\n    if (this._size > this._opts.sixelSizeLimit) {\n      console.warn(`SIXEL: too much data, aborting`);\n      this._aborted = true;\n      this._dec.release();\n      return;\n    }\n    try {\n      this._dec.decode(data, start, end);\n    } catch (e) {\n      console.warn(`SIXEL: error while decoding image - ${e}`);\n      this._aborted = true;\n      this._dec.release();\n    }\n  }\n\n  public unhook(success: boolean): boolean | Promise<boolean> {\n    if (this._aborted || !success || !this._dec) {\n      return true;\n    }\n\n    const width = this._dec.width;\n    const height = this._dec.height;\n\n    // partial fix for https://github.com/jerch/xterm-addon-image/issues/37\n    if (!width || !height) {\n      if (height) {\n        this._storage.advanceCursor(height);\n      }\n      return true;\n    }\n\n    const canvas = ImageRenderer.createCanvas(undefined, width, height);\n    canvas.getContext('2d')?.putImageData(new ImageData(this._dec.data8 as Uint8ClampedArray<ArrayBuffer>, width, height), 0, 0);\n    if (this._dec.memoryUsage > MEM_PERMA_LIMIT) {\n      this._dec.release();\n    }\n    this._storage.addImage(canvas);\n    return true;\n  }\n}\n\n\n/**\n * Some helpers to extract current terminal colors.\n */\n\n// get currently active background color from terminal\n// also respect INVERSE setting\nfunction extractActiveBg(attr: AttributeData, colors: ReadonlyColorSet | undefined): RGBA8888 {\n  let bg = 0;\n  if (!colors) {\n    // FIXME: theme service is prolly not available yet,\n    // happens if .open() was not called yet (bug in core?)\n    return bg;\n  }\n  if (attr.isInverse()) {\n    if (attr.isFgDefault()) {\n      bg = convertLe(colors.foreground.rgba);\n    } else if (attr.isFgRGB()) {\n      const t = (attr.constructor as typeof AttributeData).toColorRGB(attr.getFgColor());\n      bg = toRGBA8888(...t);\n    } else {\n      bg = convertLe(colors.ansi[attr.getFgColor()].rgba);\n    }\n  } else {\n    if (attr.isBgDefault()) {\n      bg = convertLe(colors.background.rgba);\n    } else if (attr.isBgRGB()) {\n      const t = (attr.constructor as typeof AttributeData).toColorRGB(attr.getBgColor());\n      bg = toRGBA8888(...t);\n    } else {\n      bg = convertLe(colors.ansi[attr.getBgColor()].rgba);\n    }\n  }\n  return bg;\n}\n\n// rgba values on the color managers are always in BE, thus convert to LE\nfunction convertLe(color: number): RGBA8888 {\n  if (BIG_ENDIAN) return color;\n  return (color & 0xFF) << 24 | (color >>> 8 & 0xFF) << 16 | (color >>> 16 & 0xFF) << 8 | color >>> 24 & 0xFF;\n}\n", "/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { ImageStorage, CELL_SIZE_DEFAULT } from './ImageStorage';\nimport { IImageAddonOptions, ITerminalExt, IAddImageOpts } from './Types';\nimport { ImageRenderer } from './ImageRenderer';\n\n/**\n * Sixel-specific image storage controller.\n *\n * Wraps the shared ImageStorage with sixel protocol semantics:\n * - Cursor behavior governed by DECSET 80 (sixelScrolling option)\n * - advanceCursor for empty sixels carrying only height\n */\nexport class SixelImageStorage {\n  private _addImageOpts: IAddImageOpts = { scrolling: true, layer: 'top', zIndex: 0, cursorPos: 'vt340' };\n  constructor(\n    private readonly _storage: ImageStorage,\n    private readonly _opts: IImageAddonOptions,\n    private readonly _renderer: ImageRenderer,\n    private readonly _terminal: ITerminalExt\n  ) {}\n\n  /**\n   * Add a sixel image to storage.\n   * Cursor behavior depends on the sixelScrolling option (DECSET 80).\n   */\n  public addImage(img: HTMLCanvasElement | ImageBitmap): void {\n    this._addImageOpts.scrolling = this._opts.sixelScrolling;\n    this._storage.addImage(img, this._addImageOpts);\n  }\n\n  /**\n   * Only advance text cursor.\n   * This is an edge case from empty sixels carrying only a height but no pixels.\n   * Partially fixes https://github.com/jerch/xterm-addon-image/issues/37.\n   */\n  public advanceCursor(height: number): void {\n    if (this._opts.sixelScrolling) {\n      let cellSize = this._renderer.cellSize;\n      if (cellSize.width === -1 || cellSize.height === -1) {\n        cellSize = CELL_SIZE_DEFAULT;\n      }\n      const rows = Math.ceil(height / cellSize.height);\n      for (let i = 1; i < rows; ++i) {\n        this._terminal._core._inputHandler.lineFeed();\n      }\n    }\n  }\n}\n", "/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IAddImageOpts } from './Types';\nimport { ImageStorage } from './ImageStorage';\n\n/**\n * IIP (iTerm Image Protocol) specific image storage controller.\n *\n * Wraps the shared ImageStorage with IIP protocol semantics:\n * - Always uses scrolling mode (cursor advances with image)\n */\nexport class IIPImageStorage {\n  private _addImageOpts: IAddImageOpts = { scrolling: true, layer: 'top', zIndex: 0, cursorPos: 'iip' };\n  constructor(\n    private readonly _storage: ImageStorage\n  ) {}\n\n  /**\n   * Add an IIP image to storage.\n   * Always uses scrolling mode \u2014 cursor advances past the image.\n   */\n  public addImage(img: HTMLCanvasElement | ImageBitmap): void {\n    this._storage.addImage(img, this._addImageOpts);\n  }\n}\n", "/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport type { ITerminalAddon, IDisposable } from '@xterm/xterm';\nimport type { ImageAddon as IImageApi } from '@xterm/addon-image';\nimport { Emitter, type IEvent } from 'common/Event';\nimport { IIPHandler } from './IIPHandler';\nimport { ImageRenderer } from './ImageRenderer';\nimport { ImageStorage, CELL_SIZE_DEFAULT } from './ImageStorage';\nimport { KittyGraphicsHandler } from './kitty/KittyGraphicsHandler';\nimport { KittyImageStorage } from './kitty/KittyImageStorage';\nimport { SixelHandler } from './SixelHandler';\nimport { SixelImageStorage } from './SixelImageStorage';\nimport { IIPImageStorage } from './IIPImageStorage';\nimport { ITerminalExt, IImageAddonOptions, IResetHandler } from './Types';\n\n\n/**\n * Document VT features provided by this addon.\n *\n * @vt: #E[Supported via @xterm/addon-image.] DCS SIXEL \"SIXEL Graphics\"  \"DCS Ps ; Ps ; Ps ; q Pt ST\"  \"Draw SIXEL image.\"\n *\n * Sixel support is provided by the addon @xterm/addon-image with these limitations:\n * - immediate coloring (no shared palette, allows high color settings of `img2sixel`)\n * - max. palette size of 4096 colors\n * - max. pixel width of 16K\n * - max. 25 MB per sixel sequence\n * - VT340 cursor positioning (begin of last sixel data row)\n *\n * See [addon readme](https://github.com/xtermjs/xterm.js/tree/master/addons/addon-image) for more details.\n *\n *\n * @vt: #E[Supported via @xterm/addon-image.] OSC 1337  \"iTerm2 Commands\"   \"OSC 1337 ; Pt BEL\"  \"Custom iTerm2 commands.\"\n *\n * Only the inline image protocol (IIP) is supported by the addon @xterm/addon-image with\n * the following limitations:\n * - sequence:\n *   - format: `OSC 1337 ; File=inline=1 ; size=<unencoded size> ; ... : <base64 payload> BEL`\n *   - size param must be set and payload may not exceed CEIL(size * 4 / 3)\n *   - strict base64 handling as of RFC4648 \u00A74 (standard alphabet, optional padding,\n *     no separator bytes allowed)\n *   - supported params: size, name, width, height, preserveAspectRatio\n * - image formats: PNG, JPEG and GIF\n * - no animation support (renders first image of a GIF)\n * - no multipart support\n * - VT340 cursor positioning (begin of last sixel data row)\n *\n * See [addon readme](https://github.com/xtermjs/xterm.js/tree/master/addons/addon-image)\n * and [iTerm2 IIP docs](https://iterm2.com/documentation-images.html) for more details.\n *\n *\n * @vt: #E[Supported via @xterm/addon-image.] APC KITTY_GRAPHICS \"Kitty Graphics\"  \"APC G Pt ST\"  \"Kitty Graphics Protocol.\"\n *\n * Kitty graphics support is provided by the addon @xterm/addon-image.\n * Note that while basic image output already works, this is still work in progress.\n */\n\n// default values of addon ctor options\nconst DEFAULT_OPTIONS: IImageAddonOptions = {\n  enableSizeReports: true,\n  pixelLimit: 16777216, // limit to 4096 * 4096 pixels\n  sixelSupport: true,\n  sixelScrolling: true,\n  sixelPaletteLimit: 4096,\n  sixelSizeLimit: 33554432,\n  storageLimit: 128,\n  showPlaceholder: true,\n  iipSupport: true,\n  iipSizeLimit: 33554432,\n  kittySupport: true,\n  kittySizeLimit: 33554432\n};\n\n// max palette size supported by the sixel lib (compile time setting)\nconst MAX_SIXEL_PALETTE_SIZE = 4096;\n\n// definitions for _xtermGraphicsAttributes sequence\nconst enum GaItem {\n  COLORS = 1,\n  SIXEL_GEO = 2,\n  REGIS_GEO = 3\n}\nconst enum GaAction {\n  READ = 1,\n  SET_DEFAULT = 2,\n  SET = 3,\n  READ_MAX = 4\n}\nconst enum GaStatus {\n  SUCCESS = 0,\n  ITEM_ERROR = 1,\n  ACTION_ERROR = 2,\n  FAILURE = 3\n}\n\n\nexport class ImageAddon implements ITerminalAddon, IImageApi {\n  private _opts: IImageAddonOptions;\n  private _defaultOpts: IImageAddonOptions;\n  private _storage: ImageStorage | undefined;\n  private _renderer: ImageRenderer | undefined;\n  private _disposables: IDisposable[] = [];\n  private _terminal: ITerminalExt | undefined;\n  private _handlers: Map<String, IResetHandler> = new Map();\n  private readonly _onImageAdded = new Emitter<void>();\n  public readonly onImageAdded: IEvent<void> = this._onImageAdded.event;\n\n  constructor(opts?: Partial<IImageAddonOptions>) {\n    this._opts = Object.assign({}, DEFAULT_OPTIONS, opts);\n    this._defaultOpts = Object.assign({}, DEFAULT_OPTIONS, opts);\n  }\n\n  public dispose(): void {\n    for (const obj of this._disposables) {\n      obj.dispose();\n    }\n    this._disposables.length = 0;\n    this._handlers.clear();\n    this._onImageAdded.dispose();\n  }\n\n  private _disposeLater(...args: IDisposable[]): void {\n    for (const obj of args) {\n      this._disposables.push(obj);\n    }\n  }\n\n  public activate(terminal: ITerminalExt): void {\n    this._terminal = terminal;\n\n    // internal data structures\n    this._renderer = new ImageRenderer(terminal);\n    this._storage = new ImageStorage(terminal, this._renderer, this._opts);\n    this._storage.onImageAdded = () => this._onImageAdded.fire();\n\n    // enable size reports\n    if (this._opts.enableSizeReports) {\n      const windowOps = terminal.options.windowOptions ?? {};\n      windowOps.getWinSizePixels = true;\n      windowOps.getCellSizePixels = true;\n      windowOps.getWinSizeChars = true;\n      terminal.options.windowOptions = windowOps;\n    }\n\n    this._disposeLater(\n      this._renderer,\n      this._storage,\n\n      // DECSET/DECRST/DA1/XTSMGRAPHICS handlers\n      terminal.parser.registerCsiHandler({ prefix: '?', final: 'h' }, params => this._decset(params)),\n      terminal.parser.registerCsiHandler({ prefix: '?', final: 'l' }, params => this._decrst(params)),\n      terminal.parser.registerCsiHandler({ final: 'c' }, params => this._da1(params)),\n      terminal.parser.registerCsiHandler({ prefix: '?', final: 'S' }, params => this._xtermGraphicsAttributes(params)),\n\n      // render hook\n      terminal.onRender(range => this._storage?.render(range)),\n\n      /**\n       * reset handlers covered:\n       * - DECSTR\n       * - RIS\n       * - Terminal.reset()\n       */\n      terminal.parser.registerCsiHandler({ intermediates: '!', final: 'p' }, () => this.reset()),\n      terminal.parser.registerEscHandler({ final: 'c' }, () => this.reset()),\n      terminal._core._inputHandler.onRequestReset(() => this.reset()),\n\n      // wipe canvas and delete alternate images on buffer switch\n      terminal.buffer.onBufferChange(() => this._storage?.wipeAlternate()),\n\n      // extend images to the right on resize\n      terminal.onResize(metrics => this._storage?.viewportResize(metrics))\n    );\n\n    // SIXEL handler\n    if (this._opts.sixelSupport) {\n      const sixelStorage = new SixelImageStorage(this._storage!, this._opts, this._renderer!, terminal);\n      const sixelHandler = new SixelHandler(this._opts, sixelStorage, terminal);\n      this._handlers.set('sixel', sixelHandler);\n      this._disposeLater(\n        terminal._core._inputHandler._parser.registerDcsHandler({ final: 'q' }, sixelHandler)\n      );\n    }\n\n    // iTerm IIP handler\n    if (this._opts.iipSupport) {\n      const iipStorage = new IIPImageStorage(this._storage!);\n      const iipHandler = new IIPHandler(this._opts, this._renderer!, iipStorage, terminal);\n      this._handlers.set('iip', iipHandler);\n      this._disposeLater(\n        terminal._core._inputHandler._parser.registerOscHandler(1337, iipHandler)\n      );\n    }\n\n    // Kitty graphics handler\n    if (this._opts.kittySupport) {\n      const kittyStorage = new KittyImageStorage(this._storage!);\n      const kittyHandler = new KittyGraphicsHandler(this._opts, this._renderer!, kittyStorage, terminal);\n      this._handlers.set('kitty', kittyHandler);\n      this._disposeLater(\n        kittyStorage,\n        kittyHandler,\n        terminal._core._inputHandler._parser.registerApcHandler({ final: 'G' }, kittyHandler)\n      );\n    }\n  }\n\n  // Note: storageLimit is skipped here to not intoduce a surprising side effect.\n  public reset(): boolean {\n    // reset options customizable by sequences to defaults\n    this._opts.sixelScrolling = this._defaultOpts.sixelScrolling;\n    this._opts.sixelPaletteLimit = this._defaultOpts.sixelPaletteLimit;\n    // also clear image storage\n    this._storage?.reset();\n    // reset protocol handlers\n    for (const handler of this._handlers.values()) {\n      handler.reset();\n    }\n    return false;\n  }\n\n  public get storageLimit(): number {\n    return this._storage?.getLimit() || -1;\n  }\n\n  public set storageLimit(limit: number) {\n    this._storage?.setLimit(limit);\n    this._opts.storageLimit = limit;\n  }\n\n  public get storageUsage(): number {\n    if (this._storage) {\n      return this._storage.getUsage();\n    }\n    return -1;\n  }\n\n  public get showPlaceholder(): boolean {\n    return this._opts.showPlaceholder;\n  }\n\n  public set showPlaceholder(value: boolean) {\n    this._opts.showPlaceholder = value;\n    this._renderer?.showPlaceholder(value);\n  }\n\n  public getImageAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    return this._storage?.getImageAtBufferCell(x, y);\n  }\n\n  public extractTileAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    return this._storage?.extractTileAtBufferCell(x, y);\n  }\n\n  private _report(s: string): void {\n    this._terminal?._core.input(s, false);\n  }\n\n  private _decset(params: (number | number[])[]): boolean {\n    for (let i = 0; i < params.length; ++i) {\n      switch (params[i]) {\n        case 80:\n          this._opts.sixelScrolling = false;\n          break;\n      }\n    }\n    return false;\n  }\n\n  private _decrst(params: (number | number[])[]): boolean {\n    for (let i = 0; i < params.length; ++i) {\n      switch (params[i]) {\n        case 80:\n          this._opts.sixelScrolling = true;\n          break;\n      }\n    }\n    return false;\n  }\n\n  // overload DA to return something more appropriate\n  private _da1(params: (number | number[])[]): boolean {\n    if (params[0]) {\n      return true;\n    }\n    // reported features:\n    // 62 - VT220\n    // 4 - SIXEL support\n    // 9 - charsets\n    // 22 - ANSI colors\n    if (this._opts.sixelSupport) {\n      this._report(`\\x1b[?62;4;9;22c`);\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * Implementation of xterm's graphics attribute sequence.\n   *\n   * Supported features:\n   * - read/change palette limits (max 4096 by sixel lib)\n   * - read SIXEL canvas geometry (reports current window canvas or\n   *   squared pixelLimit if canvas > pixel limit)\n   *\n   * Everything else is deactivated.\n   */\n  private _xtermGraphicsAttributes(params: (number | number[])[]): boolean {\n    if (params.length < 2) {\n      return true;\n    }\n    if (params[0] === GaItem.COLORS) {\n      switch (params[1]) {\n        case GaAction.READ:\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${this._opts.sixelPaletteLimit}S`);\n          return true;\n        case GaAction.SET_DEFAULT:\n          this._opts.sixelPaletteLimit = this._defaultOpts.sixelPaletteLimit;\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${this._opts.sixelPaletteLimit}S`);\n          // also reset protocol handlers for now\n          for (const handler of this._handlers.values()) {\n            handler.reset();\n          }\n          return true;\n        case GaAction.SET:\n          if (params.length > 2 && !(params[2] instanceof Array) && params[2] <= MAX_SIXEL_PALETTE_SIZE) {\n            this._opts.sixelPaletteLimit = params[2];\n            this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${this._opts.sixelPaletteLimit}S`);\n          } else {\n            this._report(`\\x1b[?${params[0]};${GaStatus.ACTION_ERROR}S`);\n          }\n          return true;\n        case GaAction.READ_MAX:\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${MAX_SIXEL_PALETTE_SIZE}S`);\n          return true;\n        default:\n          this._report(`\\x1b[?${params[0]};${GaStatus.ACTION_ERROR}S`);\n          return true;\n      }\n    }\n    if (params[0] === GaItem.SIXEL_GEO) {\n      switch (params[1]) {\n        // we only implement read and read_max here\n        case GaAction.READ:\n          let width = this._renderer?.dimensions?.css.canvas.width;\n          let height = this._renderer?.dimensions?.css.canvas.height;\n          if (!width || !height) {\n            // for some reason we have no working image renderer\n            // --> fallback to default cell size\n            const cellSize = CELL_SIZE_DEFAULT;\n            width = (this._terminal?.cols || 80) * cellSize.width;\n            height = (this._terminal?.rows || 24) * cellSize.height;\n          }\n          if (width * height < this._opts.pixelLimit) {\n            this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${width.toFixed(0)};${height.toFixed(0)}S`);\n          } else {\n            // if we overflow pixelLimit report that squared instead\n            const x = Math.floor(Math.sqrt(this._opts.pixelLimit));\n            this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${x};${x}S`);\n          }\n          return true;\n        case GaAction.READ_MAX:\n          // read_max returns pixelLimit as square area\n          const x = Math.floor(Math.sqrt(this._opts.pixelLimit));\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${x};${x}S`);\n          return true;\n        default:\n          this._report(`\\x1b[?${params[0]};${GaStatus.ACTION_ERROR}S`);\n          return true;\n      }\n    }\n    // exit with error on ReGIS or any other requests\n    this._report(`\\x1b[?${params[0]};${GaStatus.ITEM_ERROR}S`);\n    return true;\n  }\n}\n"],
 -  "mappings": ";;;;;;;;;;;;;;;;02BAYaA,EAAA,WAAa,IAAI,WAAW,IAAI,YAAY,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,IAAM,IAClFA,EAAA,YACF,QAAQ,KAAK,6EAA6E,EAI5F,SAAgBC,GAAIC,EAAW,CAC7B,OAAOA,EAAI,GACb,CAFAF,EAAA,IAAAC,GAIA,SAAgBE,GAAMD,EAAW,CAC/B,OAAQA,IAAM,EAAK,GACrB,CAFAF,EAAA,MAAAG,GAIA,SAAgBC,GAAKF,EAAW,CAC9B,OAAQA,IAAM,GAAM,GACtB,CAFAF,EAAA,KAAAI,GAIA,SAAgBC,GAAMH,EAAW,CAC/B,OAAQA,IAAM,GAAM,GACtB,CAFAF,EAAA,MAAAK,GAQA,SAAgBC,EAAW,EAAWC,EAAWC,EAAWC,EAAY,IAAG,CACzE,QAASA,EAAI,MAAS,IAAMD,EAAI,MAAS,IAAMD,EAAI,MAAS,EAAK,EAAI,OAAW,CAClF,CAFAP,EAAA,WAAAM,EAQA,SAAgBI,GAAaC,EAAe,CAC1C,MAAO,CAACA,EAAQ,IAAOA,GAAS,EAAK,IAAOA,GAAS,GAAM,IAAMA,IAAU,EAAE,CAC/E,CAFAX,EAAA,aAAAU,GASA,SAAgBE,GAAkBD,EAAiBE,EAAmB,CACpE,IAAMC,EAAIb,GAAIU,CAAK,EACbJ,EAAIJ,GAAMQ,CAAK,EACfH,EAAIJ,GAAKO,CAAK,EAEhBI,EAAM,OAAO,iBACbC,EAAM,GAGV,QAASC,EAAI,EAAGA,EAAIJ,EAAQ,OAAQ,EAAEI,EAAG,CACvC,IAAMC,EAAKJ,EAAID,EAAQI,CAAC,EAAE,CAAC,EACrBE,EAAKZ,EAAIM,EAAQI,CAAC,EAAE,CAAC,EACrBG,EAAKZ,EAAIK,EAAQI,CAAC,EAAE,CAAC,EACrBI,EAAIH,EAAKA,EAAKC,EAAKA,EAAKC,EAAKA,EACnC,GAAI,CAACC,EAAG,OAAOJ,EACXI,EAAIN,IACNA,EAAMM,EACNL,EAAMC,GAIV,OAAOD,CACT,CAtBAhB,EAAA,kBAAAY,GA4BA,SAASU,GAAMC,EAAaC,EAAcC,EAAa,CACrD,OAAO,KAAK,IAAIF,EAAK,KAAK,IAAIE,EAAOD,CAAI,CAAC,CAC5C,CAEA,SAASE,GAAIC,EAAYC,EAAYC,EAAS,CAC5C,OAAIA,EAAI,IAAGA,GAAK,GACZA,EAAI,IAAGA,GAAK,GACTA,EAAI,EAAI,EACXD,GAAMD,EAAKC,GAAM,EAAIC,EACrBA,EAAI,EAAI,EACNF,EACAE,EAAI,EAAI,EACND,GAAMD,EAAKC,IAAO,EAAIC,EAAI,GAC1BD,CACV,CAEA,SAASE,GAASC,EAAWC,EAAWC,EAAS,CAC/C,GAAI,CAACA,EAAG,CACN,IAAMC,EAAI,KAAK,MAAMF,EAAI,GAAG,EAC5B,OAAO1B,EAAW4B,EAAGA,EAAGA,CAAC,EAE3B,IAAMP,EAAKK,EAAI,GAAMA,GAAK,EAAIC,GAAKD,EAAIC,EAAID,EAAIC,EACzCL,EAAK,EAAII,EAAIL,EACnB,OAAOrB,EACLgB,GAAM,EAAG,IAAK,KAAK,MAAMI,GAAIC,EAAIC,EAAIG,EAAI,EAAI,CAAC,EAAI,GAAG,CAAC,EACtDT,GAAM,EAAG,IAAK,KAAK,MAAMI,GAAIC,EAAIC,EAAIG,CAAC,EAAI,GAAG,CAAC,EAC9CT,GAAM,EAAG,IAAK,KAAK,MAAMI,GAAIC,EAAIC,EAAIG,EAAI,EAAI,CAAC,EAAI,GAAG,CAAC,CAAC,CAE3D,CAKA,SAAgBI,EAAa,EAAW5B,EAAWC,EAAS,CAC1D,OAAQ,WAAa,KAAK,MAAMA,EAAI,IAAM,GAAG,GAAK,GAAK,KAAK,MAAMD,EAAI,IAAM,GAAG,GAAK,EAAI,KAAK,MAAM,EAAI,IAAM,GAAG,KAAO,CACzH,CAFAP,EAAA,aAAAmC,EAQA,SAAgBC,GAAaL,EAAWC,EAAWC,EAAS,CAE1D,OAAOH,IAAUC,EAAI,IAAM,KAAO,IAAKC,EAAI,IAAKC,EAAI,GAAG,CACzD,CAHAjC,EAAA,aAAAoC,GAqCapC,EAAA,oBAAsB,IAAI,YAAY,CACjDmC,EAAc,EAAI,EAAI,CAAC,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACxB,EA0BYnC,EAAA,mBAAqB,IAAI,YAAY,CAChDmC,EAAc,EAAI,EAAI,CAAC,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAc,EAAI,EAAI,CAAC,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAc,EAAI,EAAI,CAAC,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAc,EAAI,EAAI,CAAC,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACxB,EAOYnC,EAAA,kBAAoB,IAAK,CAEpC,IAAMqC,EAAgB,CACpB/B,EAAW,EAAG,EAAG,CAAC,EAClBA,EAAW,IAAK,EAAG,CAAC,EACpBA,EAAW,EAAG,IAAK,CAAC,EACpBA,EAAW,IAAK,IAAK,CAAC,EACtBA,EAAW,EAAG,EAAG,GAAG,EACpBA,EAAW,IAAK,EAAG,GAAG,EACtBA,EAAW,EAAG,IAAK,GAAG,EACtBA,EAAW,IAAK,IAAK,GAAG,EACxBA,EAAW,IAAK,IAAK,GAAG,EACxBA,EAAW,IAAK,EAAG,CAAC,EACpBA,EAAW,EAAG,IAAK,CAAC,EACpBA,EAAW,IAAK,IAAK,CAAC,EACtBA,EAAW,GAAI,GAAI,GAAG,EACtBA,EAAW,IAAK,EAAG,GAAG,EACtBA,EAAW,EAAG,IAAK,GAAG,EACtBA,EAAW,IAAK,IAAK,GAAG,GAGpBe,EAAI,CAAC,EAAG,GAAI,IAAK,IAAK,IAAK,GAAG,EACpC,QAASP,EAAI,EAAGA,EAAI,EAAG,EAAEA,EACvB,QAASP,EAAI,EAAGA,EAAI,EAAG,EAAEA,EACvB,QAASC,EAAI,EAAGA,EAAI,EAAG,EAAEA,EACvB6B,EAAE,KAAK/B,EAAWe,EAAEP,CAAC,EAAGO,EAAEd,CAAC,EAAGc,EAAEb,CAAC,CAAC,CAAC,EAKzC,QAAS0B,EAAI,EAAGA,GAAK,IAAKA,GAAK,GAC7BG,EAAE,KAAK/B,EAAW4B,EAAGA,EAAGA,CAAC,CAAC,EAE5B,OAAO,IAAI,YAAYG,CAAC,CAC1B,GAAE,EASWrC,EAAA,mBAA+BM,EAAW,EAAG,EAAG,EAAG,GAAG,EACtDN,EAAA,mBAA+BM,EAAW,IAAK,IAAK,IAAK,GAAG,IChRzE,IAAAgC,GAAAC,EAAAC,IAAA,cAKA,OAAO,eAAeA,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EAC5DA,GAAQ,OAASC,GACjB,IAAIC,EAAKC,GAAM,CACX,GAAI,WAAW,WACX,OAAO,WAAW,WAAWA,CAAC,EAClC,GAAI,OAAO,OAAW,IAClB,OAAO,OAAO,KAAKA,EAAG,QAAQ,EAClC,IAAMC,EAAI,KAAKD,CAAC,EACVE,EAAI,IAAI,WAAWD,EAAE,MAAM,EACjC,QAAS,EAAI,EAAG,EAAIC,EAAE,OAAQ,EAAE,EAC5BA,EAAE,CAAC,EAAID,EAAE,WAAW,CAAC,EACzB,OAAOC,CACX,EACA,SAASJ,GAAOK,EAAK,CACjB,GAAIA,EAAI,EAAG,CACP,GAAM,CAAE,EAAAC,EAAG,EAAAJ,EAAG,EAAAK,CAAE,EAAIF,EAChBF,EACAK,EACEC,EAAI,YACV,OAAIH,IAAM,EACFJ,EACQQ,GAAM,IAAID,EAAE,SAASD,IAAMA,EAAI,IAAIC,EAAE,OAAON,IAAMA,EAAIF,EAAEM,CAAC,EAAE,GAAIG,CAAC,EACpEA,GAAMF,EACRC,EAAE,YAAYD,EAAGE,CAAC,EAClBD,EAAE,YAAYN,IAAMA,EAAIF,EAAEM,CAAC,GAAIG,CAAC,EAAE,KAAKN,IAAMI,EAAIJ,EAAE,SAAWA,EAAE,QAAQ,EAE9EE,IAAM,EACFJ,EACO,IAAMM,IAAMA,EAAI,IAAIC,EAAE,OAAON,IAAMA,EAAIF,EAAEM,CAAC,EAAE,GAChD,IAAMC,EACP,QAAQ,QAAQA,CAAC,EACjBC,EAAE,QAAQN,IAAMA,EAAIF,EAAEM,CAAC,EAAE,EAAE,KAAKH,GAAKI,EAAIJ,CAAC,EAEhDF,EACO,IAAMC,IAAMA,EAAIF,EAAEM,CAAC,GACvB,IAAM,QAAQ,QAAQJ,IAAMA,EAAIF,EAAEM,CAAC,EAAE,CAChD,CACA,GAAI,OAAO,SAAa,IACpB,MAAM,IAAI,MAAM,mBAAmB,EACvC,SAAS,IAAIF,CAAG,CACpB,IC7CA,IAAAM,GAAAC,EAAAC,IAAA,cACA,OAAO,eAAeA,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EAK5D,IAAMC,GAAmB,KAInBC,MAAiBD,GAAiB,QAAuD,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,0lCAA0lC,CAA8C,EAuJ5uCE,EAAM,IAAI,WAAW,mEACtB,MAAM,EAAE,EACR,IAAIC,GAAMA,EAAG,WAAW,CAAC,CAAC,CAAC,EAE1BC,EAAI,IAAI,YAAY,IAAI,EAC9BA,EAAE,KAAK,UAAU,EACjB,QAASC,EAAI,EAAGA,EAAIH,EAAI,OAAQ,EAAEG,EAC9BD,EAAEF,EAAIG,CAAC,CAAC,EAAIA,GAAK,EACrB,QAASA,EAAI,EAAGA,EAAIH,EAAI,OAAQ,EAAEG,EAC9BD,EAAE,IAAMF,EAAIG,CAAC,CAAC,EAAIA,GAAK,GAAMA,GAAK,EAAK,MAAS,EACpD,QAASA,EAAI,EAAGA,EAAIH,EAAI,OAAQ,EAAEG,EAC9BD,EAAE,IAAMF,EAAIG,CAAC,CAAC,EAAKA,GAAK,GAAM,GAAMA,GAAK,EAAK,MAAS,GAC3D,QAASA,EAAI,EAAGA,EAAIH,EAAI,OAAQ,EAAEG,EAC9BD,EAAE,IAAMF,EAAIG,CAAC,CAAC,EAAIA,GAAK,GAC3B,IAAMC,GAAQ,IAAI,WAAW,CAAC,EAWxBC,GAAN,KAAoB,CAMhB,YAAYC,EAAUC,EAAUC,EAAc,CAO1C,GANA,KAAK,MAAQ,KACb,KAAK,OAAS,GACd,KAAK,OAAS,EACd,KAAK,SAAWF,GAAsD,QACtE,KAAK,SAAWC,GAAsD,WACtE,KAAK,OAASC,GAAkE,MAC5E,KAAK,OAAS,KAAK,UAAY,KAAK,SAAW,WAC/C,MAAM,IAAI,MAAM,uBAAuB,CAE/C,CAKA,IAAI,OAAQ,CACR,OAAO,KAAK,MAAQ,KAAK,GAAG,SAAS,EAAG,KAAK,KAAK,IAAuB,CAAC,EAAIJ,EAClF,CAMA,SAAU,CACD,KAAK,QAEN,KAAK,OAAS,KAAK,SACnB,KAAK,MAAQ,KAAK,KAAO,KAAK,GAAK,KAAK,KAAO,MAG/C,KAAK,KAAK,IAAuB,EAAI,EACrC,KAAK,KAAK,IAAuB,EAAI,EACrC,KAAK,KAAK,IAAuB,EAAI,GAE7C,CASA,KAAKG,EAAUC,EAAc,CAGzB,GAFA,KAAK,SAAWD,GAAsD,KAAK,SAC3E,KAAK,OAASC,GAAkE,KAAK,IAAI,KAAK,OAAQ,KAAK,QAAQ,EAC/G,KAAK,OAAS,KAAK,UAAY,KAAK,SAAW,WAC/C,MAAM,MAAM,uBAAuB,EAEvC,IAAIC,EAAI,KAAK,KACPC,EAAQ,KAAK,OAAS,KACvB,KAAK,MAOD,KAAK,KAAK,OAAO,WAAaA,IACnC,KAAK,KAAK,KAAK,KAAK,MAAMA,EAAQ,KAAK,KAAK,OAAO,YAAc,KAAK,CAAC,EACvED,EAAI,IAAI,YAAY,KAAK,KAAK,OAAQ,CAAC,EACvC,KAAK,GAAK,IAAI,WAAW,KAAK,KAAK,OAAQ,IAA6B,IATxE,KAAK,KAAO,IAAI,YAAY,OAAO,CAAE,QAAS,KAAK,KAAKC,EAAQ,KAAK,CAAE,CAAC,EACxE,KAAK,MAAQX,GAAW,CAAE,IAAK,CAAE,OAAQ,KAAK,IAAK,CAAE,CAAC,EACtDU,EAAI,IAAI,YAAY,KAAK,KAAK,OAAQ,CAAC,EACvCA,EAAE,IAAIP,EAAG,GAAgB,EACzB,KAAK,GAAK,IAAI,WAAW,KAAK,KAAK,OAAQ,IAA6B,GAO5EO,EAAE,IAAuB,EAAI,EAC7BA,EAAE,IAAuB,EAAI,EAC7BA,EAAE,IAAuB,EAAI,EAC7B,KAAK,KAAOA,EACZ,KAAK,OAAS,EAClB,CAOA,SAASE,EAAW,CAChB,IAAMC,EAAS,KAAK,KAAK,IAAuB,EAAID,EACpD,GAAI,KAAK,OAASC,EAAQ,CACtB,GAAIA,EAAS,KAAK,SACd,MAAO,GAEX,IAAIC,EAAU,KAAK,OACnB,MAAQA,GAAW,GAAKD,GAAQ,CAEhC,GADAC,EAAU,KAAK,IAAIA,EAAS,KAAK,QAAQ,EACrCA,EAAUD,EACV,MAAO,GAEX,GAAIC,EAAU,KAAgC,KAAK,KAAK,OAAO,WAAY,CACvE,IAAMC,EAAW,KAAK,MAAMD,EAAU,KAAgC,KAAK,KAAK,OAAO,YAAc,KAAK,EAC1G,KAAK,KAAK,KAAKC,CAAQ,EACvB,KAAK,KAAO,IAAI,YAAY,KAAK,KAAK,OAAQ,CAAC,EAC/C,KAAK,GAAK,IAAI,WAAW,KAAK,KAAK,OAAQ,IAA6B,CAC5E,CACA,KAAK,OAASD,CAClB,CACA,MAAO,EACX,CAOA,IAAIE,EAAM,CACN,GAAI,CAAC,KAAK,OAAS,KAAK,OACpB,MAAO,GAEX,GAAI,KAAK,SAASA,EAAK,MAAM,EACzB,MAAO,GAEX,IAAMN,EAAI,KAAK,KACf,YAAK,GAAG,IAAIM,EAAMN,EAAE,IAAuB,CAAC,EAC5CA,EAAE,IAAuB,GAAKM,EAAK,OAE5BN,EAAE,IAAuB,EAAIA,EAAE,IAAuB,GAAK,OAC5D,KAAK,MAAM,QAAQ,IAAI,EACvB,CACV,CAKA,KAAM,CACF,YAAK,OAAS,GACP,KAAK,MACN,KAAK,MAAM,QAAQ,IAAI,EACvB,EACV,CAIA,IAAI,aAAc,CACd,OAAO,KAAK,MACN,KAAK,KAAK,IAAuB,EACjC,CACV,CAIA,IAAI,WAAY,CACZ,OAAO,KAAK,MACN,KAAK,SAAW,KAAK,KAAK,IAAuB,EACjD,CACV,CACJ,EACAZ,GAAQ,QAAUQ,KCjVlB,IAAAW,GAAAC,EAAAC,IAAA,cACA,OAAO,eAAeA,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EAK5D,IAAMC,GAAmB,KACnBC,MAAoBD,GAAiB,QAA2D,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,84BAA84B,CAAkD,EAC3iCE,GAAN,KAAiB,CACb,YAAYC,EAAU,CAClB,KAAK,SAAWA,EAChB,KAAK,MAAQ,EACb,KAAK,OAAS,CAClB,CACA,OAAOC,EAAG,CACN,KAAK,MAAQA,EAAE,CAAC,GAAK,GAAKA,EAAE,CAAC,GAAK,GAAKA,EAAE,CAAC,GAAK,EAAIA,EAAE,CAAC,EACtD,KAAK,OAASA,EAAE,CAAC,GAAK,GAAKA,EAAE,CAAC,GAAK,GAAKA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,EACzD,IAAMC,EAAS,KAAK,MAAQ,KAAK,OAC3BC,EAAKD,EAAS,EACdE,EAAKH,EAAE,OAwBPI,EAAQ,KAAK,IAAIF,EAAIC,CAAE,GAAK,KAAK,IAAID,EAAIC,CAAE,GAAK,GAAK,KACtD,KAAK,MAID,KAAK,KAAK,OAAO,WAAaC,IACnC,KAAK,KAAK,KAAK,KAAK,MAAMA,EAAQ,KAAK,KAAK,OAAO,YAAc,KAAK,CAAC,EACvE,KAAK,GAAK,OALV,KAAK,KAAO,IAAI,YAAY,OAAO,CAAE,QAAS,KAAK,KAAKA,EAAQ,KAAK,CAAE,CAAC,EACxE,KAAK,MAAQP,GAAc,CAAE,IAAK,CAAE,OAAQ,KAAK,IAAK,CAAE,CAAC,GAMxD,KAAK,KACN,KAAK,GAAK,IAAI,WAAW,KAAK,KAAK,MAAM,GAG7C,IAAMQ,EAAU,KAAK,KAAK,OAAO,WAAaF,EAAM,KACpD,YAAK,GAAG,IAAIH,EAAGK,CAAM,EACrB,KAAK,MAAM,QAAQ,IAAIA,EAAQF,EAAIF,CAAM,EAClC,KAAK,GAAG,SAAS,KAAqB,KAAsBC,CAAE,CACzE,CACA,SAAU,CACD,KAAK,OAEN,KAAK,KAAK,OAAO,WAAa,KAAK,WACnC,KAAK,MAAQ,KAAK,GAAK,KAAK,KAAO,KAE3C,CACJ,EACAP,GAAQ,QAAUG,mGCpELQ,GAAA,OAAS,CACpB,WAAY,MACZ,aAAc,KACd,UAAW,MACX,MAAO,wtdCCT,IAAAC,EAAA,IACAC,EAAA,KAIA,SAASC,GAAaC,EAAS,CAC7B,GAAI,OAAO,OAAW,IACpB,OAAO,OAAO,KAAKA,EAAG,QAAQ,EAEhC,IAAMC,EAAa,KAAKD,CAAC,EACnBE,EAAS,IAAI,WAAWD,EAAW,MAAM,EAC/C,QAAS,EAAI,EAAG,EAAIC,EAAO,OAAQ,EAAE,EACnCA,EAAO,CAAC,EAAID,EAAW,WAAW,CAAC,EAErC,OAAOC,CACT,CAEA,IAAMC,GAAaJ,GAAaD,EAAA,OAAO,KAAK,EACxCM,EAGEC,GAAc,IAAI,YAIlBC,GAAN,KAAmB,CAAnB,aAAA,CACS,KAAA,YAAeC,GAAkB,EACjC,KAAA,YAAeC,GAAoB,CAO5C,CANS,YAAYD,EAAa,CAC9B,OAAO,KAAK,YAAYA,CAAK,CAC/B,CACO,YAAYC,EAAY,CAC7B,OAAO,KAAK,YAAYA,CAAI,CAC9B,GAKIC,GAA2C,CAC/C,YAAa,KAAO,MACpB,WAAYZ,EAAA,mBACZ,UAAWA,EAAA,mBACX,QAASA,EAAA,oBACT,aAAcC,EAAA,OAAO,aACrB,SAAU,IAQZ,SAAgBY,GAAaC,EAAsB,CACjD,IAAMC,EAAU,IAAIN,GACdO,EAAY,CAChB,IAAK,CACH,YAAaD,EAAQ,YAAY,KAAKA,CAAO,EAC7C,YAAaA,EAAQ,YAAY,KAAKA,CAAO,IAGjD,OAAO,YAAY,YAAYR,GAAeD,GAAYU,CAAS,EAChE,KAAMC,IACLV,EAAcA,GAAeU,EAAK,OAC3B,IAAIC,EAAQJ,EAAMG,EAAK,UAAYA,EAAMF,CAAO,EACxD,CACL,CAbAI,EAAA,aAAAN,GAgDA,IAAaK,EAAb,KAAoB,CAwGlB,YACEJ,EACAM,EACAC,EAAwB,CAGxB,GAvGM,KAAA,cAAgBpB,EAAA,OAAO,UAAY,EAEnC,KAAA,QAAuBO,GACvB,KAAA,YAAwB,CAAA,EACxB,KAAA,UAAY,EACZ,KAAA,UAAYP,EAAA,OAAO,UACnB,KAAA,YAAc,EACd,KAAA,eAAiB,EA+FvB,KAAK,MAAQ,OAAO,OAAO,CAAA,EAAIW,GAAiBE,CAAI,EAChD,KAAK,MAAM,aAAeb,EAAA,OAAO,aACnC,MAAM,IAAI,MAAM,+CAA+CA,EAAA,OAAO,YAAY,EAAE,EAEtF,GAAKmB,EASHC,EAAU,YAAc,KAAK,aAAa,KAAK,IAAI,EACnDA,EAAU,YAAc,KAAK,YAAY,KAAK,IAAI,MAVpC,CACd,IAAMC,EAASf,IAAgBA,EAAc,IAAI,YAAY,OAAOD,EAAU,GAC9Ec,EAAY,IAAI,YAAY,SAASE,EAAQ,CAC3C,IAAK,CACH,YAAa,KAAK,aAAa,KAAK,IAAI,EACxC,YAAa,KAAK,YAAY,KAAK,IAAI,GAE1C,EAKH,KAAK,UAAYF,EACjB,KAAK,MAAQ,KAAK,UAAU,QAC5B,KAAK,OAAS,IAAI,WAAW,KAAK,MAAM,OAAO,OAAQ,KAAK,MAAM,kBAAiB,EAAInB,EAAA,OAAO,UAAU,EACxG,KAAK,QAAU,IAAI,YAAY,KAAK,MAAM,OAAO,OAAQ,KAAK,MAAM,kBAAiB,EAAI,EAAE,EAC3F,KAAK,SAAW,IAAI,YAAY,KAAK,MAAM,OAAO,OAAQ,KAAK,MAAM,oBAAmB,EAAIA,EAAA,OAAO,YAAY,EAC/G,KAAK,SAAS,IAAI,KAAK,MAAM,OAAO,EACpC,KAAK,MAAQ,IAAI,YAAY,KAAK,MAAM,OAAO,OAAQ,KAAK,MAAM,eAAc,CAAE,EAClF,KAAK,MAAM,KAAKD,EAAA,mBAAoB,EAAG,KAAK,MAAM,aAAc,CAAC,CACnE,CApHA,IAAY,YAAU,CAAe,OAAO,KAAK,QAAQ,CAAC,CAAG,CAC7D,IAAY,WAAS,CAAa,OAAO,KAAK,QAAQ,CAAC,CAAG,CAC1D,IAAY,cAAY,CAAa,OAAO,KAAK,QAAQ,CAAC,CAAG,CAC7D,IAAY,eAAa,CAAa,OAAO,KAAK,QAAQ,CAAC,CAAG,CAC9D,IAAY,QAAM,CAAa,OAAO,KAAK,QAAQ,CAAC,EAAI,KAAK,QAAQ,CAAC,EAAI,EAAI,CAAG,CACjF,IAAY,SAAO,CAAa,OAAO,KAAK,QAAQ,CAAC,CAAG,CACxD,IAAY,QAAM,CAAa,OAAO,KAAK,QAAQ,CAAC,CAAG,CACvD,IAAY,OAAK,CAAgB,OAAO,KAAK,QAAQ,EAAE,CAAG,CAC1D,IAAY,eAAa,CAAa,OAAO,KAAK,QAAQ,EAAE,CAAG,CAEvD,YAAYW,EAAe,CACjC,GAAIA,IAAI,EAAmB,CACzB,IAAMY,EAAS,KAAK,MAAQ,KAAK,OACjC,GAAIA,EAAS,KAAK,QAAQ,OAAQ,CAChC,GAAI,KAAK,MAAM,aAAeA,EAAS,EAAI,KAAK,MAAM,YACpD,WAAK,QAAO,EACN,IAAI,MAAM,4BAA4B,EAE9C,KAAK,QAAU,IAAI,YAAYA,CAAM,EAEvC,KAAK,UAAY,KAAK,eACbZ,IAAI,EACb,GAAI,KAAK,SAAW,EAAG,CAErB,IAAMY,EAAS,KAAK,IAAI,KAAK,aAActB,EAAA,OAAO,SAAS,EAAI,KAAK,cACpE,GAAIsB,EAAS,KAAK,QAAQ,OAAQ,CAChC,GAAI,KAAK,MAAM,aAAeA,EAAS,EAAI,KAAK,MAAM,YACpD,WAAK,QAAO,EACN,IAAI,MAAM,4BAA4B,EAE9C,KAAK,QAAU,IAAI,YAAYA,CAAM,QAInC,KAAK,QAAQ,OAAS,QACxB,KAAK,QAAU,IAAI,YAAY,KAAK,GAI1C,MAAO,EACT,CAEQ,SAASC,EAAgBC,EAAwB,CACvD,IAAMF,EAASC,EAASC,EACxB,GAAIF,EAAS,KAAK,QAAQ,OAAQ,CAChC,GAAI,KAAK,MAAM,aAAeA,EAAS,EAAI,KAAK,MAAM,YACpD,WAAK,QAAO,EACN,IAAI,MAAM,4BAA4B,EAG9C,IAAMG,EAAY,IAAI,YAAY,KAAK,KAAKH,EAAS,KAAK,EAAI,KAAK,EACnEG,EAAU,IAAI,KAAK,OAAO,EAC1B,KAAK,QAAUA,EAEnB,CAEQ,aAAahB,EAAa,CAChC,IAAMiB,EAAM,KAAK,cACbH,EAAS,KAAK,YAClB,GAAI,KAAK,QAAK,EAAmB,CAC/B,IAAII,EAAY,KAAK,OAAS,KAAK,eAC/BC,EAAI,EACR,KAAOA,EAAI,GAAKD,EAAY,GAC1B,KAAK,QAAQ,IAAI,KAAK,MAAM,SAASD,EAAME,EAAGF,EAAME,EAAInB,CAAK,EAAGc,EAASd,EAAQmB,CAAC,EAClFA,IACAD,IAEF,KAAK,aAAelB,EAAQmB,EAC5B,KAAK,gBAAkBA,UACd,KAAK,QAAK,EAAmB,CACtC,KAAK,SAASL,EAAQd,EAAQ,CAAC,EAC/B,KAAK,UAAY,KAAK,IAAI,KAAK,UAAWA,CAAK,EAC/C,KAAK,UAAY,KAAK,IAAI,KAAK,UAAWA,CAAK,EAC/C,QAASoB,EAAI,EAAGA,EAAI,EAAG,EAAEA,EACvB,KAAK,QAAQ,IAAI,KAAK,MAAM,SAASH,EAAMG,EAAGH,EAAMG,EAAIpB,CAAK,EAAGc,EAASd,EAAQoB,CAAC,EAEpF,KAAK,YAAY,KAAKpB,CAAK,EAC3B,KAAK,aAAeA,EAAQ,EAC5B,KAAK,gBAAkB,EAEzB,MAAO,EACT,CA0CA,IAAW,OAAK,CACd,OAAO,KAAK,QAAK,EACb,KAAK,OACL,KAAK,IAAI,KAAK,UAAW,KAAK,MAAM,cAAa,CAAE,CACzD,CAOA,IAAW,QAAM,CACf,OAAO,KAAK,QAAK,EACb,KAAK,QACL,KAAK,MAAM,cAAa,EACtB,KAAK,YAAY,OAAS,EAAI,KAAK,MAAM,eAAc,EACvD,KAAK,YAAY,OAAS,CAClC,CAKA,IAAW,SAAO,CAChB,OAAO,KAAK,SAAS,SAAS,EAAG,KAAK,aAAa,CACrD,CAWA,IAAW,aAAW,CACpB,OAAO,KAAK,QAAQ,WAAa,KAAK,MAAM,OAAO,OAAO,WAAa,EAAI,KAAK,YAAY,MAC9F,CAKA,IAAW,YAAU,CACnB,MAAO,CACL,MAAO,KAAK,MACZ,OAAQ,KAAK,OACb,KAAM,KAAK,MACX,MAAO,KAAK,OACZ,SAAU,CAAC,CAAC,KAAK,UACjB,aAAc,KAAK,cACnB,UAAW,KAAK,WAChB,SAAU,KAAK,YACf,iBAAkB,CAChB,UAAW,KAAK,QAAQ,CAAC,EACzB,YAAa,KAAK,QAAQ,CAAC,EAC3B,MAAO,KAAK,aACZ,OAAQ,KAAK,eAGnB,CAOO,KACLqB,EAAsB,KAAK,MAAM,UACjCC,EAA8B,KAAK,MAAM,QACzCC,EAAuB,KAAK,MAAM,aAClCC,EAAoB,KAAK,MAAM,SAAQ,CAEvC,KAAK,MAAM,KAAK,KAAK,MAAM,WAAYH,EAAWE,EAAcC,EAAW,EAAI,CAAC,EAC5EF,GACF,KAAK,SAAS,IAAIA,EAAQ,SAAS,EAAG/B,EAAA,OAAO,YAAY,CAAC,EAE5D,KAAK,YAAY,OAAS,EAC1B,KAAK,UAAY,EACjB,KAAK,UAAYA,EAAA,OAAO,UACxB,KAAK,YAAc,EACnB,KAAK,eAAiB,CACxB,CAMO,OAAOkC,EAAsBC,EAAgB,EAAGC,EAAcF,EAAK,OAAM,CAC9E,IAAIG,EAAIF,EACR,KAAOE,EAAID,GAAK,CACd,IAAME,EAAS,KAAK,IAAIF,EAAMC,EAAGrC,EAAA,OAAO,UAAU,EAClD,KAAK,OAAO,IAAIkC,EAAK,SAASG,EAAGA,GAAKC,CAAM,CAAC,EAC7C,KAAK,MAAM,OAAO,EAAGA,CAAM,EAE/B,CAOO,aAAaJ,EAAcC,EAAgB,EAAGC,EAAcF,EAAK,OAAM,CAC5E,IAAIG,EAAIF,EACR,KAAOE,EAAID,GAAK,CACd,IAAME,EAAS,KAAK,IAAIF,EAAMC,EAAGrC,EAAA,OAAO,UAAU,EAClD,QAAS6B,EAAI,EAAGU,EAAIF,EAAGR,EAAIS,EAAQ,EAAET,EAAG,EAAEU,EACxC,KAAK,OAAOV,CAAC,EAAIK,EAAK,WAAWK,CAAC,EAEpCF,GAAKC,EACL,KAAK,MAAM,OAAO,EAAGA,CAAM,EAE/B,CAMA,IAAW,QAAM,CACf,GAAI,KAAK,QAAK,GAAqB,CAAC,KAAK,OAAS,CAAC,KAAK,OACtD,OAAO/B,GAIT,IAAMiC,EAAe,KAAK,MAAM,cAAa,EAE7C,GAAI,KAAK,QAAK,EAAmB,CAC/B,IAAIb,EAAY,KAAK,OAAS,KAAK,eACnC,GAAIA,EAAY,EAAG,CACjB,IAAMD,EAAM,KAAK,cACbH,EAAS,KAAK,YACdK,EAAI,EACR,KAAOA,EAAI,GAAKD,EAAY,GAC1B,KAAK,QAAQ,IAAI,KAAK,MAAM,SAASD,EAAME,EAAGF,EAAME,EAAIY,CAAY,EAAGjB,EAASiB,EAAeZ,CAAC,EAChGA,IACAD,IAEEA,GACF,KAAK,QAAQ,KAAK,KAAK,WAAYJ,EAASiB,EAAeZ,CAAC,EAGhE,OAAO,KAAK,QAAQ,SAAS,EAAG,KAAK,MAAQ,KAAK,MAAM,EAG1D,GAAI,KAAK,QAAK,EAAmB,CAC/B,GAAI,KAAK,YAAc,KAAK,UAAW,CACrC,IAAIa,EAAS,GACb,GAAID,EACF,GAAIA,IAAiB,KAAK,UACxBC,EAAS,OACJ,CACL,IAAMf,EAAM,KAAK,cACbH,EAAS,KAAK,YAClB,KAAK,SAASA,EAAQiB,EAAe,CAAC,EACtC,QAASX,EAAI,EAAGA,EAAI,EAAG,EAAEA,EACvB,KAAK,QAAQ,IAAI,KAAK,MAAM,SAASH,EAAMG,EAAGH,EAAMG,EAAIW,CAAY,EAAGjB,EAASiB,EAAeX,CAAC,EAItG,GAAI,CAACY,EACH,OAAO,KAAK,QAAQ,SAAS,EAAG,KAAK,MAAQ,KAAK,MAAM,EAM5D,IAAMC,EAAQ,IAAI,YAAY,KAAK,MAAQ,KAAK,MAAM,EACtDA,EAAM,KAAK,KAAK,UAAU,EAC1B,IAAIC,EAAc,EACdR,EAAQ,EACZ,QAASN,EAAI,EAAGA,EAAI,KAAK,YAAY,OAAQ,EAAEA,EAAG,CAChD,IAAMe,EAAK,KAAK,YAAYf,CAAC,EAC7B,QAASQ,EAAI,EAAGA,EAAI,EAAG,EAAEA,EACvBK,EAAM,IAAI,KAAK,QAAQ,SAASP,EAAOA,GAASS,CAAE,EAAGD,CAAW,EAChEA,GAAe,KAAK,MAIxB,GAAIH,EAAc,CAChB,IAAMd,EAAM,KAAK,cAEXmB,EAAgB,KAAK,MAAM,eAAc,EAC/C,QAAShB,EAAI,EAAGA,EAAIgB,EAAe,EAAEhB,EACnCa,EAAM,IAAI,KAAK,MAAM,SAAShB,EAAMG,EAAGH,EAAMG,EAAIW,CAAY,EAAGG,EAAc,KAAK,MAAQd,CAAC,EAGhG,OAAOa,EAIT,OAAOnC,EACT,CAMA,IAAW,OAAK,CACd,OAAO,IAAI,kBAAkB,KAAK,OAAO,OAAQ,EAAG,KAAK,MAAQ,KAAK,OAAS,CAAC,CAClF,CAcO,SAAO,CACZ,KAAK,QAAUA,GACf,KAAK,YAAY,OAAS,EAC1B,KAAK,UAAY,EACjB,KAAK,UAAYP,EAAA,OAAO,UAGxB,KAAK,MAAM,KAAKD,EAAA,mBAAoB,EAAG,KAAK,MAAM,aAAc,CAAC,CACnE,GAxWFmB,EAAA,QAAAD,EA2XC,SAAgB6B,GACfZ,EACArB,EAAsB,CAEtB,IAAMkC,EAAM,IAAI9B,EAAQJ,CAAI,EAC5B,OAAAkC,EAAI,KAAI,EACR,OAAOb,GAAS,SAAWa,EAAI,aAAab,CAAI,EAAIa,EAAI,OAAOb,CAAI,EAC5D,CACL,MAAOa,EAAI,MACX,OAAQA,EAAI,OACZ,OAAQA,EAAI,OACZ,MAAOA,EAAI,MAEf,CAbC7B,EAAA,OAAA4B,GAoBM,eAAeE,GACpBd,EACArB,EAAsB,CAEtB,IAAMkC,EAAM,MAAMnC,GAAaC,CAAI,EACnC,OAAAkC,EAAI,KAAI,EACR,OAAOb,GAAS,SAAWa,EAAI,aAAab,CAAI,EAAIa,EAAI,OAAOb,CAAI,EAC5D,CACL,MAAOa,EAAI,MACX,OAAQA,EAAI,OACZ,OAAQA,EAAI,OACZ,MAAOA,EAAI,MAEf,CAbA7B,EAAA,YAAA8B,KC7eO,SAASC,EAAaC,EAA6B,CACxD,MAAO,CAAE,QAASA,CAAG,CACvB,CAuBO,IAAMC,EAAN,KAA6C,CAA7C,cACL,KAAiB,aAAe,IAAI,IACpC,KAAQ,YAAc,GAEtB,IAAW,YAAsB,CAC/B,OAAO,KAAK,WACd,CAEO,IAA2BC,EAAS,CACzC,OAAI,KAAK,YACPA,EAAE,QAAQ,EAEV,KAAK,aAAa,IAAIA,CAAC,EAElBA,CACT,CAEO,SAAgB,CACrB,GAAI,MAAK,YAGT,MAAK,YAAc,GACnB,QAAWC,KAAK,KAAK,aACnBA,EAAE,QAAQ,EAEZ,KAAK,aAAa,MAAM,EAC1B,CAEO,OAAc,CACnB,QAAWA,KAAK,KAAK,aACnBA,EAAE,QAAQ,EAEZ,KAAK,aAAa,MAAM,CAC1B,CACF,EAEsBC,EAAf,KAAiD,CAAjD,cAGL,KAAmB,OAAS,IAAIH,EAEzB,SAAgB,CACrB,KAAK,OAAO,QAAQ,CACtB,CAEU,UAAiCC,EAAS,CAClD,OAAO,KAAK,OAAO,IAAIA,CAAC,CAC1B,CACF,EAZsBE,EACG,KAAoB,OAAO,OAAO,CAAE,SAAU,CAAE,CAAE,CAAC,EAarE,IAAMC,EAAN,KAAsE,CAAtE,cAEL,KAAQ,YAAc,GAEtB,IAAW,OAAuB,CAChC,OAAO,KAAK,YAAc,OAAY,KAAK,MAC7C,CAEA,IAAW,MAAMC,EAAsB,CACjC,KAAK,aAAeA,IAAU,KAAK,SAGvC,KAAK,QAAQ,QAAQ,EACrB,KAAK,OAASA,EAChB,CAEO,OAAc,CACnB,KAAK,MAAQ,MACf,CAEO,SAAgB,CACrB,KAAK,YAAc,GACnB,KAAK,QAAQ,QAAQ,EACrB,KAAK,OAAS,MAChB,CACF,EClGO,IAAMC,EAAN,KAAiB,CAAjB,cACL,KAAQ,WAAqD,CAAC,EAC9D,KAAQ,UAAY,GAGpB,IAAW,OAAmB,CAC5B,OAAI,KAAK,OACA,KAAK,QAEd,KAAK,OAAS,CAACC,EAAyBC,EAAgBC,IAAkD,CACxG,GAAI,KAAK,UACP,OAAOC,EAAa,IAAM,CAAC,CAAC,EAG9B,IAAMC,EAAQ,CAAE,GAAIJ,EAAU,SAAAC,CAAS,EACvC,KAAK,WAAa,KAAK,WAAW,MAAM,EACxC,KAAK,WAAW,KAAKG,CAAK,EAE1B,IAAMC,EAASF,EAAa,IAAM,CAChC,IAAMG,EAAM,KAAK,WAAW,QAAQF,CAAK,EACrCE,IAAQ,KACV,KAAK,WAAa,KAAK,WAAW,MAAM,EACxC,KAAK,WAAW,OAAOA,EAAK,CAAC,EAEjC,CAAC,EAED,OAAIJ,IACE,MAAM,QAAQA,CAAW,EAC3BA,EAAY,KAAKG,CAAM,EAEvBH,EAAY,IAAIG,CAAM,GAInBA,CACT,EACO,KAAK,OACd,CAEO,KAAKE,EAAgB,CAC1B,GAAI,KAAK,WAAa,CAAC,KAAK,WAAW,OACrC,OAEF,GAAI,KAAK,WAAW,SAAW,EAAG,CAChC,KAAK,WAAW,CAAC,EAAE,GAAG,KAAK,KAAK,WAAW,CAAC,EAAE,SAAUA,CAAK,EAC7D,MACF,CACA,IAAMC,EAAY,KAAK,WACvB,QAAS,EAAI,EAAGC,EAAMD,EAAU,OAAQ,EAAIC,EAAK,EAAE,EACjDD,EAAU,CAAC,EAAE,GAAG,KAAKA,EAAU,CAAC,EAAE,SAAUD,CAAK,CAErD,CAEO,SAAgB,CACjB,KAAK,YAGT,KAAK,UAAY,GACjB,KAAK,WAAW,OAAS,EAC3B,CACF,EAEiBG,OAAV,CACE,SAASC,EAAWC,EAAiBC,EAA6B,CACvE,OAAOD,EAAKE,GAAKD,EAAG,KAAKC,CAAC,CAAC,CAC7B,CAFOJ,EAAS,QAAAC,EAIT,SAASI,EAAUR,EAAkBQ,EAA6B,CACvE,MAAO,CAACf,EAAyBC,EAAgBC,IACxCK,EAAMS,GAAKhB,EAAS,KAAKC,EAAUc,EAAIC,CAAC,CAAC,EAAG,OAAWd,CAAW,CAE7E,CAJOQ,EAAS,IAAAK,EAQT,SAASE,KAAUC,EAAgC,CACxD,MAAO,CAAClB,EAAyBC,EAAgBC,IAAkD,CACjG,IAAMiB,EAAQ,IAAIC,EAClB,QAAWb,KAASW,EAClBC,EAAM,IAAIZ,EAAMO,GAAKd,EAAS,KAAKC,EAAUa,CAAC,CAAC,CAAC,EAElD,OAAIZ,IACE,MAAM,QAAQA,CAAW,EAC3BA,EAAY,KAAKiB,CAAK,EAEtBjB,EAAY,IAAIiB,CAAK,GAGlBA,CACT,CACF,CAfOT,EAAS,IAAAO,EAmBT,SAASI,EAAmBd,EAAkBe,EAAqCC,EAA0B,CAClH,OAAAD,EAAQC,CAAO,EACRhB,EAAMO,GAAKQ,EAAQR,CAAC,CAAC,CAC9B,CAHOJ,EAAS,gBAAAW,IAhCDX,KAAA,ICvEjB,IAAAc,GAA2B,OAgBpB,IAAMC,EAAN,MAAMC,UAAsBC,CAAkC,CAmDnE,YAAoBC,EAAyB,CAC3C,MAAM,EADY,eAAAA,EAhDpB,KAAQ,QAAU,IAAI,IAGtB,KAAQ,gBAAkB,KAAK,UAAU,IAAIC,CAAmB,EA+C9D,KAAK,SAAW,KAAK,UAAU,MAAM,KACrC,KAAK,UAAU,MAAM,KAAQC,GAA8B,CACzD,KAAK,UAAU,KAAK,KAAK,UAAU,MAAOA,CAAM,EAChD,KAAK,MAAM,CACb,EACI,KAAK,UAAU,MAAM,eACvB,KAAK,MAAM,EAGb,KAAK,gBAAgB,MAAQ,KAAK,UAAU,MAAM,eAAe,eAAeC,GAAU,CACpFA,IAAW,aACb,KAAK,cAAc,EACnB,KAAK,gBAAgB,YAAY,EAAG,KAAK,UAAU,IAAI,EAE3D,CAAC,EACD,KAAK,UAAUC,EAAa,IAAM,CAChC,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,QAAQ,EAC5B,KAAK,UAAU,OAAS,KAAK,WAC/B,KAAK,UAAU,MAAM,KAAO,KAAK,SACjC,KAAK,SAAW,QAEd,KAAK,gBAAkB,KAAK,kBAC9B,KAAK,eAAe,YAAc,KAAK,gBACvC,KAAK,gBAAkB,QAEzB,KAAK,eAAiB,OACtB,KAAK,QAAQ,MAAM,EACnB,KAAK,oBAAoB,MAAM,EAC/B,KAAK,mBAAqB,OAC1B,KAAK,aAAe,MACtB,CAAC,CAAC,CACJ,CAnFA,IAAW,QAAwC,CAAE,OAAO,KAAK,QAAQ,IAAI,KAAK,GAAG,MAAQ,CAU7F,OAAc,aAAaC,EAAqCC,EAAeC,EAAmC,CAUhH,IAAMC,GAAUH,GAAiB,UAAU,cAAc,QAAQ,EACjE,OAAAG,EAAO,MAAQF,EAAQ,EACvBE,EAAO,OAASD,EAAS,EAClBC,CACT,CAGA,OAAc,gBAAgBC,EAA+BH,EAAeC,EAAgBG,EAAiC,CAC3H,GAAI,OAAO,WAAc,WAAY,CACnC,IAAMC,EAAUF,EAAI,gBAAgBH,EAAOC,CAAM,EACjD,OAAIG,GACFC,EAAQ,KAAK,IAAI,IAAI,kBAAkBD,EAAQ,EAAGJ,EAAQC,EAAS,CAAC,CAAC,EAEhEI,CACT,CACA,OAAOD,EACH,IAAI,UAAU,IAAI,kBAAkBA,EAAQ,EAAGJ,EAAQC,EAAS,CAAC,EAAGD,EAAOC,CAAM,EACjF,IAAI,UAAUD,EAAOC,CAAM,CACjC,CAGA,OAAc,kBAAkBK,EAA0D,CACxF,OAAI,OAAO,mBAAsB,WACxB,QAAQ,QAAQ,MAAS,EAE3B,kBAAkBA,CAAG,CAC9B,CA0CO,gBAAgBC,EAAsB,CACvCA,EACE,CAAC,KAAK,cAAgB,KAAK,SAAS,SAAW,IACjD,KAAK,mBAAmB,KAAK,IAAI,KAAK,SAAS,OAAS,EAAG,EAA4B,CAAC,GAG1F,KAAK,oBAAoB,MAAM,EAC/B,KAAK,mBAAqB,OAC1B,KAAK,aAAe,QAEtB,KAAK,gBAAgB,YAAY,EAAG,KAAK,UAAU,IAAI,CACzD,CAMA,IAAW,YAA4C,CACrD,OAAO,KAAK,UAAU,UACxB,CAKA,IAAW,UAAsB,CAC/B,MAAO,CACL,MAAO,KAAK,YAAY,IAAI,KAAK,OAAS,GAC1C,OAAQ,KAAK,YAAY,IAAI,KAAK,QAAU,EAC9C,CACF,CAKO,WAAWC,EAAeC,EAAaC,EAA0B,CACtE,IAAMC,EAAIH,GAAS,KAAK,YAAY,IAAI,KAAK,QAAU,GACjDI,EAAI,KAAK,YAAY,IAAI,OAAO,OAAS,EACzCC,GAAKJ,EAAM,EAAID,IAAU,KAAK,YAAY,IAAI,KAAK,QAAU,IAC/D,CAACE,GAASA,IAAU,QACtB,KAAK,QAAQ,IAAI,KAAK,GAAG,UAAU,EAAGC,EAAGC,EAAGC,CAAC,GAE3C,CAACH,GAASA,IAAU,WACtB,KAAK,QAAQ,IAAI,QAAQ,GAAG,UAAU,EAAGC,EAAGC,EAAGC,CAAC,CAEpD,CAKO,SAASH,EAA0B,CACxC,GAAI,CAACA,GAASA,IAAU,MAAO,CAC7B,IAAMP,EAAM,KAAK,QAAQ,IAAI,KAAK,EAClCA,GAAK,UAAU,EAAG,EAAGA,EAAI,OAAO,MAAOA,EAAI,OAAO,MAAM,CAC1D,CACA,GAAI,CAACO,GAASA,IAAU,SAAU,CAChC,IAAMP,EAAM,KAAK,QAAQ,IAAI,QAAQ,EACrCA,GAAK,UAAU,EAAG,EAAGA,EAAI,OAAO,MAAOA,EAAI,OAAO,MAAM,CAC1D,CACF,CAKO,KAAKW,EAAqBC,EAAgBC,EAAaC,EAAaC,EAAgB,EAAS,CAClG,IAAMf,EAAM,KAAK,QAAQ,IAAIW,EAAQ,KAAK,EAC1C,GAAI,CAACX,EACH,OAEF,GAAM,CAAE,MAAAH,EAAO,OAAAC,CAAO,EAAI,KAAK,SAG/B,GAAID,IAAU,IAAMC,IAAW,GAC7B,OAGF,KAAK,cAAca,EAASd,EAAOC,CAAM,EACzC,IAAMK,EAAMQ,EAAQ,OACdK,EAAO,KAAK,KAAKb,EAAI,MAAQN,CAAK,EAElCoB,EAAML,EAASI,EAAQnB,EACvBqB,EAAK,KAAK,MAAMN,EAASI,CAAI,EAAIlB,EACjCqB,EAAKN,EAAMhB,EACXuB,EAAKN,EAAMhB,EAGXuB,EAAaN,EAAQlB,EAAQoB,EAAKd,EAAI,MAAQA,EAAI,MAAQc,EAAKF,EAAQlB,EACvEyB,EAAcJ,EAAKpB,EAASK,EAAI,OAASA,EAAI,OAASe,EAAKpB,EAMjEE,EAAI,UACFG,EACA,KAAK,MAAMc,CAAE,EAAG,KAAK,MAAMC,CAAE,EAAG,KAAK,KAAKG,CAAU,EAAG,KAAK,KAAKC,CAAW,EAC5E,KAAK,MAAMH,CAAE,EAAG,KAAK,MAAMC,CAAE,EAAG,KAAK,KAAKC,CAAU,EAAG,KAAK,KAAKC,CAAW,CAC9E,CACF,CAKO,YAAYX,EAAqBC,EAA+C,CACrF,GAAM,CAAE,MAAAf,EAAO,OAAAC,CAAO,EAAI,KAAK,SAE/B,GAAID,IAAU,IAAMC,IAAW,GAC7B,OAEF,KAAK,cAAca,EAASd,EAAOC,CAAM,EACzC,IAAMK,EAAMQ,EAAQ,OACdK,EAAO,KAAK,KAAKb,EAAI,MAAQN,CAAK,EAClCoB,EAAML,EAASI,EAAQnB,EACvBqB,EAAK,KAAK,MAAMN,EAASI,CAAI,EAAIlB,EACjCuB,EAAaxB,EAAQoB,EAAKd,EAAI,MAAQA,EAAI,MAAQc,EAAKpB,EACvDyB,EAAcJ,EAAKpB,EAASK,EAAI,OAASA,EAAI,OAASe,EAAKpB,EAE3DC,EAASV,EAAc,aAAa,KAAK,SAAUgC,EAAYC,CAAW,EAC1EtB,EAAMD,EAAO,WAAW,IAAI,EAClC,GAAIC,EACF,OAAAA,EAAI,UACFG,EACA,KAAK,MAAMc,CAAE,EAAG,KAAK,MAAMC,CAAE,EAAG,KAAK,MAAMG,CAAU,EAAG,KAAK,MAAMC,CAAW,EAC9E,EAAG,EAAG,KAAK,MAAMD,CAAU,EAAG,KAAK,MAAMC,CAAW,CACtD,EACOvB,CAEX,CAKO,gBAAgBc,EAAaC,EAAaC,EAAgB,EAAS,CACxE,IAAMf,EAAM,KAAK,QAAQ,IAAI,KAAK,EAClC,GAAIA,EAAK,CACP,GAAM,CAAE,MAAAH,EAAO,OAAAC,CAAO,EAAI,KAAK,SAY/B,GATID,IAAU,IAAMC,IAAW,KAI1B,KAAK,aAECA,GAAU,KAAK,aAAc,QACtC,KAAK,mBAAmBA,EAAS,CAAC,EAFlC,KAAK,mBAAmB,KAAK,IAAIA,EAAS,EAAG,EAA4B,CAAC,EAIxE,CAAC,KAAK,cAAc,OACxBE,EAAI,UACF,KAAK,oBAAsB,KAAK,aAChCa,EAAMhB,EACLiB,EAAMhB,EAAU,EAAI,EAAI,EACzBD,EAAQkB,EACRjB,EACAe,EAAMhB,EACNiB,EAAMhB,EACND,EAAQkB,EACRjB,CACF,CACF,CACF,CAMO,eAAsB,CAC3B,IAAMW,EAAI,KAAK,YAAY,IAAI,OAAO,OAAS,EACzCC,EAAI,KAAK,YAAY,IAAI,OAAO,QAAU,EAChD,QAAWV,KAAO,KAAK,QAAQ,OAAO,GAChCA,EAAI,OAAO,QAAUS,GAAKT,EAAI,OAAO,SAAWU,KAClDV,EAAI,OAAO,MAAQS,EACnBT,EAAI,OAAO,OAASU,EAG1B,CAKQ,cAAca,EAAkBC,EAAsBC,EAA6B,CACzF,GAAID,IAAiBD,EAAK,eAAe,OAASE,IAAkBF,EAAK,eAAe,OACtF,OAEF,GAAM,CAAE,MAAOG,EAAe,OAAQC,CAAe,EAAIJ,EAAK,aAC9D,GAAIC,IAAiBE,GAAiBD,IAAkBE,EAAgB,CACtEJ,EAAK,OAASA,EAAK,KACnBA,EAAK,eAAe,MAAQG,EAC5BH,EAAK,eAAe,OAASI,EAC7B,MACF,CACA,IAAM5B,EAASV,EAAc,aAC3B,KAAK,SACL,KAAK,KAAKkC,EAAK,KAAM,MAAQC,EAAeE,CAAa,EACzD,KAAK,KAAKH,EAAK,KAAM,OAASE,EAAgBE,CAAc,CAC9D,EACM3B,EAAMD,EAAO,WAAW,IAAI,EAC9BC,IACFA,EAAI,UAAUuB,EAAK,KAAO,EAAG,EAAGxB,EAAO,MAAOA,EAAO,MAAM,EAC3DwB,EAAK,OAASxB,EACdwB,EAAK,eAAe,MAAQC,EAC5BD,EAAK,eAAe,OAASE,EAEjC,CAKQ,OAAc,CACpB,KAAK,eAAiB,KAAK,UAAU,MAAM,eAC3C,KAAK,gBAAkB,KAAK,eAAe,YAAY,KAAK,KAAK,cAAc,EAC/E,KAAK,eAAe,YAAeG,GAAkB,CACnD,QAAWC,IAAO,CAAC,GAAG,KAAK,QAAQ,KAAK,CAAC,EACvC,KAAK,mBAAmBA,CAAG,EAE7B,KAAK,iBAAiB,KAAK,KAAK,eAAgBD,CAAQ,CAC1D,CACF,CAEO,iBAAiBrB,EAAoB,MAAa,CAEvD,GAAI,CAAC,KAAK,UAAY,CAAC,KAAK,UAAU,MAAM,cAAe,CACzD,QAAQ,KAAK,oFAAoF,EACjG,MACF,CACA,GAAI,KAAK,QAAQ,IAAIA,CAAK,EACxB,OAEF,IAAMR,EAASV,EAAc,aAC3B,KAAK,SAAU,KAAK,YAAY,IAAI,OAAO,OAAS,EACpD,KAAK,YAAY,IAAI,OAAO,QAAU,CACxC,EACAU,EAAO,UAAU,IAAI,qBAAqBQ,CAAK,EAAE,EACjD,IAAMuB,EAAgB,KAAK,UAAU,MAAM,cAI3CA,EAAc,MAAM,UAAY,UAC5BvB,IAAU,UAKZR,EAAO,MAAM,OAAS,KACtB+B,EAAc,aAAa/B,EAAQ+B,EAAc,UAAU,IAK3D/B,EAAO,MAAM,OAAS,IACtB+B,EAAc,YAAY/B,CAAM,GAElC,IAAMC,EAAMD,EAAO,WAAW,KAAM,CAAE,MAAO,EAAK,CAAC,EACnD,GAAI,CAACC,EAAK,CACRD,EAAO,OAAO,EACd,MACF,CACA,KAAK,QAAQ,IAAIQ,EAAOP,CAAG,EAC3B,KAAK,SAASO,CAAK,CACrB,CAEO,mBAAmBA,EAAoB,MAAa,CACzD,IAAMP,EAAM,KAAK,QAAQ,IAAIO,CAAK,EAC9BP,IACFA,EAAI,OAAO,OAAO,EAClB,KAAK,QAAQ,OAAOO,CAAK,EAE7B,CAEO,SAASA,EAA4B,CAC1C,OAAO,KAAK,QAAQ,IAAIA,CAAK,CAC/B,CAEQ,mBAAmBT,EAAiB,GAAoC,CAC9E,KAAK,oBAAoB,MAAM,EAC/B,KAAK,mBAAqB,OAG1B,IAAMiC,EAAS,GACTC,EAAY3C,EAAc,aAAa,KAAK,SAAU0C,EAAQjC,CAAM,EACpEE,EAAMgC,EAAU,WAAW,KAAM,CAAE,MAAO,EAAM,CAAC,EACvD,GAAI,CAAChC,EAAK,OACV,IAAME,EAAUb,EAAc,gBAAgBW,EAAK+B,EAAQjC,CAAM,EAC3DmC,EAAM,IAAI,YAAY/B,EAAQ,KAAK,MAAM,EACzCgC,KAAQ,eAAW,EAAG,EAAG,CAAC,EAC1BC,KAAQ,eAAW,IAAK,IAAK,GAAG,EACtCF,EAAI,KAAKC,CAAK,EACd,QAAS1B,EAAI,EAAGA,EAAIV,EAAQ,EAAEU,EAAG,CAC/B,IAAM4B,EAAQ5B,EAAI,EACZ6B,EAAS7B,EAAIuB,EACnB,QAASO,EAAI,EAAGA,EAAIP,EAAQO,GAAK,EAC/BL,EAAII,EAASC,EAAIF,CAAK,EAAID,CAE9B,CACAnC,EAAI,aAAaE,EAAS,EAAG,CAAC,EAG9B,IAAML,EAAS,OAAO,MAAQkC,EAAS,EAAK,EAAEA,EAAS,IAAM,KAC7D,KAAK,aAAe1C,EAAc,aAAa,KAAK,SAAUQ,EAAOC,CAAM,EAC3E,IAAMyC,EAAO,KAAK,aAAa,WAAW,KAAM,CAAE,MAAO,EAAM,CAAC,EAChE,GAAI,CAACA,EAAM,CACT,KAAK,aAAe,OACpB,MACF,CACA,QAASC,EAAI,EAAGA,EAAI3C,EAAO2C,GAAKT,EAC9BQ,EAAK,UAAUP,EAAWQ,EAAG,CAAC,EAEhCnD,EAAc,kBAAkB,KAAK,YAAY,EAAE,KAAKoD,GAAU,KAAK,mBAAqBA,CAAM,CACpG,CAEA,IAAW,UAAiC,CAC1C,OAAO,KAAK,UAAU,MAAM,qBAAqB,OAAO,QAC1D,CACF,ECxZO,IAAMC,EAA+B,CAC1C,MAAO,EACP,OAAQ,EACV,EAQMC,EAAN,MAAMC,CAAkD,CAqDtD,YACEC,EAAc,EACdC,EAAgB,EACTC,EAAU,GACVC,EAAS,GAChB,CAFO,aAAAD,EACA,YAAAC,EAxDT,KAAQ,KAAe,EA4CvB,KAAQ,OAAiB,EAcvB,KAAK,KAAOH,EACZ,KAAK,OAASC,CAChB,CA3DA,IAAW,KAAc,CACvB,OAAI,KAAK,OAEJ,KAAK,KAAO,WACZ,KAAK,gBAAkB,GAGrB,KAAK,IACd,CACA,IAAW,IAAIG,EAAe,CAAE,KAAK,KAAOA,CAAO,CAEnD,IAAW,gBAAiC,CAE1C,OAAI,KAAK,UAGD,KAAK,KAAO,YAA6B,EACnD,CACA,IAAW,eAAeA,EAAuB,CAC/C,KAAK,MAAQ,WACb,KAAK,MAASA,GAAS,GAAM,SAC/B,CAEA,IAAW,gBAAyB,CAClC,OAAO,KAAK,KAAQ,QACtB,CACA,IAAW,eAAeA,EAAe,CACvC,KAAK,MAAQ,UACb,KAAK,MAAQA,EAAS,QACxB,CAEA,IAAW,wBAAiC,CAC1C,IAAMC,GAAO,KAAK,KAAO,aAA4B,GACrD,OAAIA,EAAM,EACDA,EAAM,WAERA,CACT,CACA,IAAW,uBAAuBD,EAAe,CAC/C,KAAK,MAAQ,UACb,KAAK,MAASA,GAAS,GAAM,UAC/B,CAGA,IAAW,OAAgB,CACzB,OAAO,KAAK,MACd,CACA,IAAW,MAAMA,EAAe,CAC9B,KAAK,OAASA,CAChB,CAYO,OAA6B,CASlC,OAAO,IAAIL,EAAmB,KAAK,KAAM,KAAK,OAAQ,KAAK,QAAS,KAAK,MAAM,CACjF,CAEO,SAAmB,CACxB,OAAO,KAAK,iBAAmB,GAAuB,KAAK,SAAW,GAAK,KAAK,UAAY,EAC9F,CACF,EACMO,EAAc,IAAIR,EAUXS,EAAN,KAA0C,CAkB/C,YACUC,EACAC,EACAC,EACR,CAHQ,eAAAF,EACA,eAAAC,EACA,WAAAC,EAnBV,KAAQ,QAAmC,IAAI,IAE/C,KAAQ,QAAU,EAElB,KAAQ,UAAY,EAEpB,KAAQ,cAAgB,GAExB,KAAQ,gBAAkB,GAE1B,KAAQ,YAAsB,KAW5B,GAAI,CACF,KAAK,SAAS,KAAK,MAAM,YAAY,CACvC,OAASC,EAAY,CACfA,aAAa,OACf,QAAQ,MAAMA,EAAE,OAAO,EAEzB,QAAQ,KAAK,0BAA0B,KAAK,SAAS,CAAC,KAAK,CAC7D,CACA,KAAK,iBAAmB,CACtB,KAAM,KAAK,UAAU,KACrB,KAAM,KAAK,UAAU,IACvB,CACF,CAEO,SAAgB,CACrB,KAAK,MAAM,CACb,CAEO,OAAc,CACnB,QAAWC,KAAQ,KAAK,QAAQ,OAAO,EACrCA,EAAK,QAAQ,QAAQ,EAIvB,KAAK,QAAQ,MAAM,EACnB,KAAK,UAAU,SAAS,CAC1B,CAEO,UAAmB,CACxB,OAAO,KAAK,YAAc,EAAI,GAChC,CAEO,SAASR,EAAqB,CACnC,GAAIA,EAAQ,IAAOA,EAAQ,IACzB,MAAM,WAAW,mEAAmE,EAEtF,KAAK,YAAeA,EAAQ,EAAI,MAAa,EAC7C,KAAK,aAAa,CAAC,CACrB,CAEO,UAAmB,CACxB,OAAO,KAAK,iBAAiB,EAAI,EAAI,GACvC,CAEQ,kBAA2B,CACjC,IAAIS,EAAe,EACnB,QAAWD,KAAQ,KAAK,QAAQ,OAAO,EACjCA,EAAK,OACPC,GAAgBD,EAAK,KAAK,MAAQA,EAAK,KAAK,OACxCA,EAAK,QAAUA,EAAK,SAAWA,EAAK,OACtCC,GAAgBD,EAAK,OAAO,MAAQA,EAAK,OAAO,SAItD,OAAOC,CACT,CAEQ,QAAQC,EAAkB,CAChC,IAAMF,EAAO,KAAK,QAAQ,IAAIE,CAAE,EAC3BF,IACL,KAAK,QAAQ,OAAOE,CAAE,EAElB,OAAO,aAAeF,EAAK,gBAAgB,aAC7CA,EAAK,KAAK,MAAM,EAElB,KAAK,iBAAiBE,CAAE,EAC1B,CAKO,eAAsB,CAE3B,IAAMC,EAAO,CAAC,EACd,OAAW,CAACD,EAAIF,CAAI,IAAK,KAAK,QAAQ,QAAQ,EACxCA,EAAK,aAAe,cACtBA,EAAK,QAAQ,QAAQ,EACrBG,EAAK,KAAKD,CAAE,GAGhB,QAAWA,KAAMC,EACf,KAAK,QAAQD,CAAE,EAGjB,KAAK,gBAAkB,GACvB,KAAK,cAAgB,EACvB,CAMO,YAAYA,EAAkB,CACnC,IAAMF,EAAO,KAAK,QAAQ,IAAIE,CAAE,EAC5BF,IACFA,EAAK,QAAQ,QAAQ,EACrB,KAAK,QAAQE,CAAE,EAEnB,CAaO,SAASE,EAAsCC,EAA6B,CAEjF,KAAK,aAAaD,EAAI,MAAQA,EAAI,MAAM,EAGxC,IAAIE,EAAW,KAAK,UAAU,UAC1BA,EAAS,QAAU,IAAMA,EAAS,SAAW,MAC/CA,EAAWrB,GAEb,IAAMsB,EAAO,KAAK,KAAKH,EAAI,MAAQE,EAAS,KAAK,EAC3CE,EAAO,KAAK,KAAKJ,EAAI,OAASE,EAAS,MAAM,EAE7ChB,EAAU,EAAE,KAAK,QAEjBmB,EAAS,KAAK,UAAU,MAAM,OAC9BC,EAAW,KAAK,UAAU,KAC1BC,EAAW,KAAK,UAAU,KAC1BC,EAAUH,EAAO,EACjBI,EAAUJ,EAAO,EACnBK,EAASF,EACTG,EAAY,EAEXV,EAAK,YACRI,EAAO,EAAI,EACXA,EAAO,EAAI,EACXK,EAAS,GAGX,KAAK,UAAU,MAAM,cAAc,iBAAiB,UAAUL,EAAO,CAAC,EACtE,QAASO,EAAM,EAAGA,EAAMR,EAAM,EAAEQ,EAAK,CACnC,IAAMC,EAAOR,EAAO,MAAM,IAAIA,EAAO,EAAIA,EAAO,KAAK,EACrD,QAASS,EAAM,EAAGA,EAAMX,GAClB,EAAAO,EAASI,GAAOR,GADQ,EAAEQ,EAE9B,KAAK,aAAaD,EAAwBH,EAASI,EAAK5B,EAAS0B,EAAMT,EAAOW,CAAG,EACjFH,IAEF,GAAIV,EAAK,UACHW,EAAMR,EAAO,GAAG,KAAK,UAAU,MAAM,cAAc,SAAS,UAE5D,EAAEC,EAAO,GAAKE,EAAU,MAE9BF,EAAO,EAAIK,CACb,CACA,KAAK,UAAU,MAAM,cAAc,iBAAiB,UAAUL,EAAO,CAAC,EAGlEJ,EAAK,UACHA,EAAK,YAAc,MACrBI,EAAO,EAAI,KAAK,IAAIK,EAASP,EAAMG,CAAQ,EAE3CD,EAAO,EAAIK,GAGbL,EAAO,EAAIG,EACXH,EAAO,EAAII,GAIb,IAAMV,EAAO,CAAC,EACd,OAAW,CAACD,EAAIF,CAAI,IAAK,KAAK,QAAQ,QAAQ,EACxCA,EAAK,UAAY,IACnBA,EAAK,QAAQ,QAAQ,EACrBG,EAAK,KAAKD,CAAE,GAGhB,QAAWA,KAAMC,EACf,KAAK,QAAQD,CAAE,EAKjB,IAAMiB,EAAY,KAAK,UAAU,eAAe,CAAC,EACjDA,GAAW,UAAU,IAAM,CACZ,KAAK,QAAQ,IAAI7B,CAAO,GAEnC,KAAK,QAAQA,CAAO,CAExB,CAAC,EAIG,KAAK,UAAU,OAAO,OAAO,OAAS,aACxC,KAAK,kBAAkB,EAIzB,IAAM8B,EAAsB,CAC1B,KAAMhB,EACN,aAAcE,EACd,OAAQF,EACR,eAAgB,CAAE,GAAGE,CAAS,EAC9B,OAAQa,GAAa,OACrB,UAAAJ,EACA,WAAY,KAAK,UAAU,OAAO,OAAO,KACzC,MAAOV,EAAK,MACZ,OAAQA,EAAK,MACf,EAGA,YAAK,QAAQ,IAAIf,EAAS8B,CAAO,EACjC,KAAK,eAAe,EACb9B,CACT,CAQO,OAAO+B,EAA6C,CAEzD,IAAIC,EAAe,GACfC,EAAkB,GACtB,QAAWvB,KAAQ,KAAK,QAAQ,OAAO,EAMrC,GALIA,EAAK,QAAU,SACjBuB,EAAkB,GAElBD,EAAe,GAEbA,GAAgBC,EAAiB,MAIvC,GAAID,GAAgB,CAAC,KAAK,UAAU,SAAS,KAAK,IAChD,KAAK,UAAU,iBAAiB,KAAK,EACjC,CAAC,KAAK,UAAU,SAAS,KAAK,GAAG,OAUvC,GARIC,GAAmB,CAAC,KAAK,UAAU,SAAS,QAAQ,GACtD,KAAK,UAAU,iBAAiB,QAAQ,EAI1C,KAAK,UAAU,cAAc,EAGzB,CAAC,KAAK,QAAQ,KAAM,CACjB,KAAK,gBACR,KAAK,UAAU,SAAS,EACxB,KAAK,cAAgB,GACrB,KAAK,gBAAkB,IAErB,KAAK,UAAU,SAAS,KAAK,GAC/B,KAAK,UAAU,mBAAmB,KAAK,EAErC,KAAK,UAAU,SAAS,QAAQ,GAClC,KAAK,UAAU,mBAAmB,QAAQ,EAE5C,MACF,CAGI,CAACD,GAAgB,KAAK,UAAU,SAAS,KAAK,IAChD,KAAK,UAAU,SAAS,KAAK,EAC7B,KAAK,UAAU,mBAAmB,KAAK,GAErC,CAACC,GAAmB,KAAK,UAAU,SAAS,QAAQ,IACtD,KAAK,UAAU,SAAS,QAAQ,EAChC,KAAK,UAAU,mBAAmB,QAAQ,GAIxC,KAAK,kBACP,KAAK,UAAU,SAAS,EACxB,KAAK,cAAgB,GACrB,KAAK,gBAAkB,IAGzB,GAAM,CAAE,MAAAC,EAAO,IAAAC,CAAI,EAAIJ,EACjBZ,EAAS,KAAK,UAAU,MAAM,OAC9BF,EAAO,KAAK,UAAU,MAAM,KAGlC,KAAK,UAAU,WAAWiB,EAAOC,CAAG,EAGpC,IAAMC,EAAgG,CAAC,EACjGC,EAAkE,CAAC,EAGzE,QAASX,EAAMQ,EAAOR,GAAOS,EAAK,EAAET,EAAK,CACvC,IAAMC,EAAOR,EAAO,MAAM,IAAIO,EAAMP,EAAO,KAAK,EAChD,GAAI,CAACQ,EAAM,OACX,QAASC,EAAM,EAAGA,EAAMX,EAAM,EAAEW,EAC9B,GAAID,EAAK,MAAMC,CAAG,EAAI,UAAsB,CAC1C,IAAInB,EAAyBkB,EAAK,eAAeC,CAAG,GAAKxB,EACnDJ,EAAUS,EAAE,QAClB,GAAIT,IAAY,QAAaA,IAAY,GACvC,SAEF,IAAM8B,EAAU,KAAK,QAAQ,IAAI9B,CAAO,EACxC,GAAIS,EAAE,SAAW,GAAI,CACnB,IAAM6B,EAAY7B,EAAE,OACd8B,EAAWX,EACbY,EAAQ,EAOZ,KACE,EAAEZ,EAAMX,GACJU,EAAK,MAAMC,CAAG,EAAI,YAClBnB,EAAIkB,EAAK,eAAeC,CAAG,GAAKxB,IAChCK,EAAE,UAAYT,GACdS,EAAE,SAAW6B,EAAYE,GAE7BA,IAEFZ,IACIE,EACEA,EAAQ,QACVM,EAAU,KAAK,CAAE,QAAAN,EAAS,OAAQQ,EAAW,IAAKC,EAAU,IAAAb,EAAK,MAAAc,CAAM,CAAC,EAEjE,KAAK,MAAM,iBACpBH,EAAiB,KAAK,CAAE,IAAKE,EAAU,IAAAb,EAAK,MAAAc,CAAM,CAAC,EAErD,KAAK,cAAgB,EACvB,CACF,CAEJ,CAGAJ,EAAU,KAAK,CAACK,EAAGC,IAAMD,EAAE,QAAQ,OAASC,EAAE,QAAQ,MAAM,EAG5D,QAAWC,KAAQN,EACjB,KAAK,UAAU,gBAAgBM,EAAK,IAAKA,EAAK,IAAKA,EAAK,KAAK,EAI/D,QAAWA,KAAQP,EACjB,KAAK,UAAU,KAAKO,EAAK,QAASA,EAAK,OAAQA,EAAK,IAAKA,EAAK,IAAKA,EAAK,KAAK,CAEjF,CAEO,eAAeC,EAA+C,CAEnE,GAAI,CAAC,KAAK,QAAQ,KAAM,CACtB,KAAK,iBAAmBA,EACxB,MACF,CAIA,GAAI,KAAK,iBAAiB,MAAQA,EAAQ,KAAM,CAC9C,KAAK,iBAAmBA,EACxB,MACF,CAGA,IAAMzB,EAAS,KAAK,UAAU,MAAM,OAC9BD,EAAOC,EAAO,MAAM,OACpB0B,EAAS,KAAK,iBAAiB,KAAO,EAC5C,QAASnB,EAAM,EAAGA,EAAMR,EAAM,EAAEQ,EAAK,CACnC,IAAMC,EAAOR,EAAO,MAAM,IAAIO,CAAG,EACjC,GAAIC,EAAK,MAAMkB,CAAM,EAAI,UAAsB,CAC7C,IAAMpC,EAAyBkB,EAAK,eAAekB,CAAM,GAAKzC,EACxDJ,EAAUS,EAAE,QAClB,GAAIT,IAAY,QAAaA,IAAY,GACvC,SAEF,IAAM8B,EAAU,KAAK,QAAQ,IAAI9B,CAAO,EACxC,GAAI,CAAC8B,EACH,SAGF,IAAMgB,EAAc,KAAK,MAAMhB,EAAQ,QAAQ,OAAS,GAAKA,EAAQ,eAAe,KAAK,EACzF,GAAKrB,EAAE,OAASqC,EAAe,GAAKA,EAClC,SAGF,IAAIC,EAAU,GACd,QAASC,EAAWH,EAAS,EAAGG,EAAWJ,EAAQ,KAAM,EAAEI,EACzD,GAAIrB,EAAK,MAAMqB,EAAW,EAAY,CAAY,EAAI,QAA0B,CAC9ED,EAAU,GACV,KACF,CAEF,GAAIA,EACF,SAGF,IAAMZ,EAAM,KAAK,IAAIS,EAAQ,KAAME,EAAerC,EAAE,OAASqC,EAAeD,CAAM,EAC9EI,EAAWxC,EAAE,OACjB,QAASyC,EAAYL,EAAS,EAAGK,EAAYf,EAAK,EAAEe,EAClD,KAAK,aAAavB,EAAwBuB,EAAWlD,EAAS,EAAEiD,CAAQ,EACxEnB,EAAQ,WAEZ,CACF,CAEA,KAAK,iBAAmBc,CAC1B,CAKO,qBAAqBO,EAAWC,EAA0C,CAE/E,IAAMzB,EADS,KAAK,UAAU,MAAM,OAChB,MAAM,IAAIyB,CAAC,EAC/B,GAAIzB,GAAQA,EAAK,MAAMwB,CAAC,EAAI,UAAsB,CAChD,IAAM1C,EAAyBkB,EAAK,eAAewB,CAAC,GAAK/C,EACzD,GAAIK,EAAE,SAAWA,EAAE,UAAY,GAAI,CACjC,IAAM4C,EAAO,KAAK,QAAQ,IAAI5C,EAAE,OAAO,GAAG,KAC1C,GAAI,OAAO,aAAe4C,aAAgB,YAAa,CACrD,IAAMC,EAASC,EAAc,aAAa,OAAO,SAAUF,EAAK,MAAOA,EAAK,MAAM,EAClF,OAAAC,EAAO,WAAW,IAAI,GAAG,UAAUD,EAAM,EAAG,EAAGA,EAAK,MAAOA,EAAK,MAAM,EAC/DC,CACT,CACA,OAAOD,CACT,CACF,CACF,CAKO,wBAAwBF,EAAWC,EAA0C,CAElF,IAAMzB,EADS,KAAK,UAAU,MAAM,OAChB,MAAM,IAAIyB,CAAC,EAC/B,GAAIzB,GAAQA,EAAK,MAAMwB,CAAC,EAAI,UAAsB,CAChD,IAAM1C,EAAyBkB,EAAK,eAAewB,CAAC,GAAK/C,EACzD,GAAIK,EAAE,SAAWA,EAAE,UAAY,IAAMA,EAAE,SAAW,GAAI,CACpD,IAAMC,EAAO,KAAK,QAAQ,IAAID,EAAE,OAAO,EACvC,GAAIC,EACF,OAAO,KAAK,UAAU,YAAYA,EAAMD,EAAE,MAAM,CAEpD,CACF,CACF,CAIQ,aAAa+C,EAAsB,CACzC,IAAMC,EAAO,KAAK,iBAAiB,EAC/BC,EAAUD,EACd,KAAO,KAAK,YAAcC,EAAUF,GAAQ,KAAK,QAAQ,MAAM,CAC7D,IAAM9C,EAAO,KAAK,QAAQ,IAAI,EAAE,KAAK,SAAS,EAC1CA,GAAQA,EAAK,OACfgD,GAAWhD,EAAK,KAAK,MAAQA,EAAK,KAAK,OACnCA,EAAK,QAAUA,EAAK,OAASA,EAAK,SACpCgD,GAAWhD,EAAK,OAAO,MAAQA,EAAK,OAAO,QAE7CA,EAAK,QAAQ,QAAQ,EACrB,KAAK,QAAQ,KAAK,SAAS,EAE/B,CACA,OAAO+C,EAAOC,CAChB,CAEQ,aAAa/B,EAAsBwB,EAAWnD,EAAiBC,EAAsB,CAC3F,GAAI0B,EAAK,MAAMwB,EAAI,EAAY,CAAO,EAAI,UAAsB,CAC9D,IAAMQ,EAAMhC,EAAK,eAAewB,CAAC,EACjC,GAAIQ,EAAK,CACP,GAAIA,EAAI,UAAY,OAAW,CAI7B,IAAMC,EAAU,KAAK,QAAQ,IAAID,EAAI,OAAO,EACxCC,GAEFA,EAAQ,YAEVD,EAAI,QAAU3D,EACd2D,EAAI,OAAS1D,EACb,MACF,CAEA0B,EAAK,eAAewB,CAAC,EAAI,IAAIvD,EAAmB+D,EAAI,IAAKA,EAAI,MAAO3D,EAASC,CAAM,EACnF,MACF,CACF,CAEA0B,EAAK,MAAMwB,EAAI,EAAY,CAAO,GAAK,UACvCxB,EAAK,eAAewB,CAAC,EAAI,IAAIvD,EAAmB,EAAG,EAAGI,EAASC,CAAM,CACvE,CAEQ,mBAA0B,CAEhC,QAAWS,KAAQ,KAAK,QAAQ,OAAO,EACjCA,EAAK,aAAe,cACtBA,EAAK,UAAY,GAIrB,IAAMS,EAAS,KAAK,UAAU,MAAM,OACpC,QAASiC,EAAI,EAAGA,EAAI,KAAK,UAAU,KAAM,EAAEA,EAAG,CAC5C,IAAMzB,EAAOR,EAAO,MAAM,IAAIiC,CAAC,EAC/B,GAAKzB,GAGL,QAASwB,EAAI,EAAGA,EAAI,KAAK,UAAU,KAAM,EAAEA,EACzC,GAAIxB,EAAK,MAAMwB,EAAI,EAAY,CAAO,EAAI,UAAsB,CAC9D,IAAMU,EAAQlC,EAAK,eAAewB,CAAC,GAAG,QACtC,GAAIU,EAAO,CACT,IAAMnD,EAAO,KAAK,QAAQ,IAAImD,CAAK,EAC/BnD,GACFA,EAAK,WAET,CACF,EAEJ,CAEA,IAAMG,EAAO,CAAC,EACd,OAAW,CAACD,EAAIF,CAAI,IAAK,KAAK,QAAQ,QAAQ,EACxCA,EAAK,aAAe,aAAe,CAACA,EAAK,YAC3CA,EAAK,QAAQ,QAAQ,EACrBG,EAAK,KAAKD,CAAE,GAGhB,QAAWA,KAAMC,EACf,KAAK,QAAQD,CAAE,CAEnB,CACF,ECnpBA,IAAAkD,GAA0B,QAC1BC,GAAuB,QC2CvB,SAASC,EAAMC,EAA2B,CACxC,IAAIC,EAAI,GACR,QAASC,EAAI,EAAGA,EAAIF,EAAK,OAAQ,EAAEE,EACjCD,GAAK,OAAO,aAAaD,EAAKE,CAAC,CAAC,EAElC,OAAOD,CACT,CAGA,SAASE,GAAMH,EAA2B,CACxC,IAAII,EAAI,EACR,QAASF,EAAI,EAAGA,EAAIF,EAAK,OAAQ,EAAEE,EAAG,CACpC,GAAIF,EAAKE,CAAC,EAAI,IAAMF,EAAKE,CAAC,EAAI,GAC5B,MAAM,IAAI,MAAM,cAAc,EAEhCE,EAAIA,EAAI,GAAKJ,EAAKE,CAAC,EAAI,EACzB,CACA,OAAOE,CACT,CAGA,SAASC,GAAOL,EAA2B,CACzC,IAAMI,EAAIL,EAAMC,CAAI,EACpB,GAAI,CAACI,EAAE,MAAM,kCAAkC,EAC7C,MAAM,IAAI,MAAM,cAAc,EAEhC,OAAOA,CACT,CAGA,SAASE,GAAON,EAA2B,CACzC,GAAI,OAAO,OAAW,IACpB,OAAO,OAAO,KAAKD,EAAMC,CAAI,EAAG,QAAQ,EAAE,SAAS,EAErD,IAAMO,EAAK,KAAKR,EAAMC,CAAI,CAAC,EACrBQ,EAAI,IAAI,WAAWD,EAAG,MAAM,EAClC,QAAS,EAAI,EAAG,EAAIC,EAAE,OAAQ,EAAE,EAC9BA,EAAE,CAAC,EAAID,EAAG,WAAW,CAAC,EAExB,OAAO,IAAI,YAAY,EAAE,OAAOC,CAAC,CACnC,CAEA,IAAMC,GAAiE,CACrE,OAAQN,GACR,KAAMA,GACN,KAAMG,GACN,MAAOD,GACP,OAAQA,GACR,oBAAqBF,EACvB,EAKMO,GAAc,CAAC,GAAI,IAAK,IAAK,GAAG,EAEhCC,GAAuB,CAAC,GAAI,IAAK,IAAK,IAAK,IAAK,IAAK,GAAI,IAAK,IAAK,GAAI,IAAK,IAAK,GAAG,EAEpFC,GAAkB,CAAC,GAAI,IAAK,IAAK,IAAK,GAAI,GAAI,IAAK,GAAG,EAEtDC,GAAiB,CAAC,GAAI,IAAK,IAAK,IAAK,GAAI,IAAK,GAAG,EAEjDC,GAAwB,CAAC,GAAI,IAAK,IAAK,IAAK,IAAK,IAAK,GAAI,IAAK,IAAK,IAAK,GAAI,IAAK,IAAK,GAAG,EAG1FC,GAAiB,KAGVC,EAAN,KAAmB,CAAnB,cACL,KAAO,MAAqB,EAC5B,KAAQ,QAAU,IAAI,YAAYD,EAAc,EAChD,KAAQ,UAAY,EACpB,KAAQ,KAAO,GACf,KAAO,OAA4E,CAAC,EAE7E,OAAc,CACnB,KAAK,QAAQ,KAAK,CAAC,EACnB,KAAK,MAAQ,EACb,KAAK,UAAY,EACjB,KAAK,OAAS,CAAC,EACf,KAAK,KAAO,EACd,CAEO,KAAc,CACnB,GAAI,KAAK,QAAU,EAAmB,CACpC,GAAI,KAAK,YAAcF,GAAe,OAAQ,CAC5C,QAASI,EAAI,EAAGA,EAAIJ,GAAe,OAAQ,EAAEI,EAC3C,GAAI,KAAK,QAAQA,CAAC,IAAMJ,GAAeI,CAAC,EAAG,OAAO,KAAK,GAAG,EAE5D,YAAK,OAAO,KAAU,EACtB,KAAK,MAAQ,EACN,CACT,CACA,GAAI,KAAK,YAAcH,GAAsB,OAAQ,CACnD,QAASG,EAAI,EAAGA,EAAIH,GAAsB,OAAQ,EAAEG,EAClD,GAAI,KAAK,QAAQA,CAAC,IAAMH,GAAsBG,CAAC,EAAG,OAAO,KAAK,GAAG,EAEnE,YAAK,OAAO,KAAU,EACtB,KAAK,MAAQ,EACN,CACT,CACA,OAAO,KAAK,GAAG,CACjB,CACA,OAAI,KAAK,QAAU,EAAwB,EACvC,KAAK,QAAU,GACd,KAAK,OAAO,OAAS,EAEnB,KAAK,YAAY,KAAK,SAAS,GACpC,KAAK,MAAQ,EACN,GAFuC,KAAK,GAAG,EAIjD,KAAK,GAAG,CACjB,CAEO,MAAMjB,EAAmBkB,EAAeC,EAAqB,CAClE,IAAIC,EAAQ,KAAK,MACbC,EAAM,KAAK,UACTC,EAAS,KAAK,QAEpB,GADIF,IAAU,GAAqBA,IAAU,GACzCA,IAAU,GAAqBC,EAAM,GAAI,MAAO,GACpD,QAASnB,EAAIgB,EAAOhB,EAAIiB,EAAK,EAAEjB,EAAG,CAChC,IAAMqB,EAAIvB,EAAKE,CAAC,EAChB,OAAQqB,EAAG,CACT,IAAK,IACH,GAAI,CAAC,KAAK,YAAYF,CAAG,EAAG,OAAO,KAAK,GAAG,EAC3CD,EAAQ,EACRC,EAAM,EACN,MACF,IAAK,IACH,GAAID,IAAU,EAAmB,CAC/B,GAAIE,EAAO,CAAC,IAAM,GAAI,CAEpB,IAAIL,EAAI,EACR,KAAOA,EAAIP,GAAY,OAAQ,EAAEO,EAC/B,GAAIK,EAAOL,CAAC,IAAMP,GAAYO,CAAC,EAAG,OAAO,KAAK,GAAG,EAGnD,GADA,KAAK,OAAO,KAAU,EAClBI,IAAQT,GAAgB,OAAQ,CAClC,KAAOK,EAAIL,GAAgB,OAAQ,EAAEK,EACnC,GAAIK,EAAOL,CAAC,IAAML,GAAgBK,CAAC,EAAG,OAAO,KAAK,GAAG,EAEvD,YAAK,OAAO,KAAU,EACtB,KAAK,MAAQ,EACNf,EAAI,CACb,CACF,SAAWoB,EAAO,CAAC,IAAM,GAAI,CAE3B,QAASL,EAAI,EAAGA,EAAIN,GAAqB,OAAQ,EAAEM,EACjD,GAAIK,EAAOL,CAAC,IAAMN,GAAqBM,CAAC,EAAG,OAAO,KAAK,GAAG,EAE5D,KAAK,OAAO,KAAU,CACxB,KACE,QAAO,KAAK,GAAG,EAEjBG,EAAQ,EACRC,EAAM,CACR,SAAWD,IAAU,EAAiB,CACpC,GAAI,CAAC,KAAK,UAAUC,CAAG,EAAG,OAAO,KAAK,GAAG,EACzCD,EAAQ,EACRC,EAAM,CACR,SAAWD,IAAU,EAAmB,CACtC,GAAIC,GAAON,GAAgB,OAAO,KAAK,GAAG,EAC1CO,EAAOD,GAAK,EAAIE,CAClB,CACA,MACF,IAAK,IACH,OAAIH,IAAU,GACR,CAAC,KAAK,YAAYC,CAAG,EAAU,KAAK,GAAG,GAE7C,KAAK,MAAQ,EACNnB,EAAI,GACb,QACE,GAAImB,GAAON,GAAgB,OAAO,KAAK,GAAG,EAC1CO,EAAOD,GAAK,EAAIE,CACpB,CACF,CACA,YAAK,MAAQH,EACb,KAAK,UAAYC,EACV,EACT,CAEQ,IAAa,CACnB,YAAK,OAAO,KAAO,EACnB,KAAK,MAAQ,EACN,EACT,CAEQ,UAAUA,EAAsB,CACtC,IAAMJ,EAAIlB,EAAM,KAAK,QAAQ,SAAS,EAAGsB,CAAG,CAAC,EAC7C,OAAIJ,GACF,KAAK,KAAOA,EACZ,KAAK,OAAOA,CAAC,EAAI,KACV,IAEF,EACT,CAEQ,YAAYI,EAAsB,CACxC,GAAI,KAAK,KAAM,CACb,GAAI,CACF,IAAMjB,EAAI,KAAK,QAAQ,MAAM,EAAGiB,CAAG,EACnC,KAAK,OAAO,KAAK,IAAI,EAAIZ,GAAS,KAAK,IAAI,EAAIA,GAAS,KAAK,IAAI,EAAEL,CAAC,EAAIA,CAC1E,MAAQ,CACN,MAAO,EACT,CACA,MAAO,EACT,CACA,MAAO,EACT,CACF,ECvPO,IAAMoB,EAA6B,CACxC,KAAM,cACN,MAAO,EACP,OAAQ,CACV,EAEO,SAASC,GAAUC,EAAyB,CACjD,GAAIA,EAAE,OAAS,GACb,OAAOF,EAET,IAAMG,EAAM,IAAI,YAAYD,EAAE,OAAQA,EAAE,WAAY,CAAC,EAGrD,GAAIC,EAAI,CAAC,IAAM,YAAcA,EAAI,CAAC,IAAM,WAAcA,EAAI,CAAC,IAAM,WAC/D,MAAO,CACL,KAAM,YACN,MAAQD,EAAE,EAAE,GAAK,GAAKA,EAAE,EAAE,GAAK,GAAKA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,EACrD,OAAQA,EAAE,EAAE,GAAK,GAAKA,EAAE,EAAE,GAAK,GAAKA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,CACvD,EAGF,GAAIA,EAAE,CAAC,IAAM,KAAQA,EAAE,CAAC,IAAM,KAAQA,EAAE,CAAC,IAAM,IAAM,CACnD,GAAM,CAACE,EAAOC,CAAM,EAAIC,GAAQJ,CAAC,EACjC,MAAO,CAAE,KAAM,aAAc,MAAAE,EAAO,OAAAC,CAAO,CAC7C,CAEA,GAAIF,EAAI,CAAC,IAAM,YAAeD,EAAE,CAAC,IAAM,IAAQA,EAAE,CAAC,IAAM,KAASA,EAAE,CAAC,IAAM,GACxE,MAAO,CACL,KAAM,YACN,MAAQA,EAAE,CAAC,GAAK,EAAIA,EAAE,CAAC,EACvB,OAAQA,EAAE,CAAC,GAAK,EAAIA,EAAE,CAAC,CACzB,EAGF,GAAIC,EAAI,CAAC,IAAM,WACb,MAAO,CACL,KAAM,YACN,MAAQD,EAAE,CAAC,GAAK,GAAKA,EAAE,CAAC,GAAK,GAAKA,EAAE,CAAC,GAAK,EAAIA,EAAE,CAAC,EACjD,OAAQA,EAAE,CAAC,GAAK,GAAKA,EAAE,CAAC,GAAK,GAAKA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,CACrD,EAGF,GAAIC,EAAI,CAAC,IAAM,YAAcA,EAAI,CAAC,IAAM,aAAeA,EAAI,CAAC,EAAI,YAAc,QAAU,CACtF,OAAQD,EAAE,EAAE,EAAG,CACb,IAAK,IACH,MAAO,CACL,KAAM,aACN,OAASA,EAAE,EAAE,EAAIA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,GAAK,IAAM,EAC7C,QAASA,EAAE,EAAE,EAAIA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,GAAK,IAAM,CAC/C,EACF,IAAK,IACH,GAAIA,EAAE,EAAE,IAAM,GAAM,OAAOF,EAC3B,IAAMO,EAAML,EAAE,EAAE,EAAIA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,GAAK,GAAKA,EAAE,EAAE,GAAK,GACxD,MAAO,CACL,KAAM,aACN,OAASK,EAAa,OAAU,EAChC,QAASA,IAAQ,GAAK,OAAU,CAClC,EACF,IAAK,IACH,OAAIL,EAAE,EAAE,IAAM,KAAQA,EAAE,EAAE,IAAM,GAAQA,EAAE,EAAE,IAAM,GAAaF,EACxD,CACL,KAAM,aACN,OAASE,EAAE,EAAE,EAAIA,EAAE,EAAE,GAAK,GAAK,MAC/B,QAASA,EAAE,EAAE,EAAIA,EAAE,EAAE,GAAK,GAAK,KACjC,CACJ,CACA,OAAOF,CACT,CAEA,GAAIG,EAAI,CAAC,IAAM,aAAeA,EAAI,CAAC,IAAM,YAAcA,EAAI,CAAC,IAAM,YAAa,CAC7E,IAAIK,EAAM,GAEJC,EAAQ,KAAK,IAAIP,EAAE,OAAS,GAAI,IAAI,EAC1C,QAASQ,EAAI,EAAGA,EAAID,EAAOC,IAEzB,GAAIR,EAAEQ,CAAC,IAAM,KAAQR,EAAEQ,EAAI,CAAC,IAAM,KAAQR,EAAEQ,EAAI,CAAC,IAAM,KAAQR,EAAEQ,EAAI,CAAC,IAAM,IAAM,CAChFF,EAAME,EACN,KACF,CAEF,GAAIF,IAAQ,GAAI,CAEd,IAAMJ,EACJF,EAAEM,EAAO,CAAC,GAAK,GACfN,EAAEM,EAAO,CAAC,GAAK,GACfN,EAAEM,EAAM,EAAE,GAAM,EAChBN,EAAEM,EAAM,EAAE,EACNH,EACJH,EAAEM,EAAM,EAAE,GAAK,GACfN,EAAEM,EAAM,EAAE,GAAK,GACfN,EAAEM,EAAM,EAAE,GAAM,EAChBN,EAAEM,EAAM,EAAE,EACZ,GAAIJ,EAAQ,GAAKC,EAAS,EACxB,MAAO,CAAE,KAAM,aAAc,MAAAD,EAAO,OAAAC,CAAO,CAE/C,CACA,OAAOL,CACT,CACA,OAAOA,CACT,CAGA,SAASM,GAAQJ,EAAiC,CAChD,IAAMS,EAAMT,EAAE,OACVQ,EAAI,EACJE,EAAcV,EAAEQ,CAAC,GAAK,EAAIR,EAAEQ,EAAI,CAAC,EACrC,OAAa,CAEX,GADAA,GAAKE,EACDF,GAAKC,EAEP,MAAO,CAAC,EAAG,CAAC,EAEd,GAAIT,EAAEQ,CAAC,IAAM,IACX,MAAO,CAAC,EAAG,CAAC,EAEd,GAAIR,EAAEQ,EAAI,CAAC,IAAM,KAAQR,EAAEQ,EAAI,CAAC,IAAM,IACpC,OAAIA,EAAI,EAAIC,EACH,CACLT,EAAEQ,EAAI,CAAC,GAAK,EAAIR,EAAEQ,EAAI,CAAC,EACvBR,EAAEQ,EAAI,CAAC,GAAK,EAAIR,EAAEQ,EAAI,CAAC,CACzB,EAEK,CAAC,EAAG,CAAC,EAEdA,GAAK,EACLE,EAAcV,EAAEQ,CAAC,GAAK,EAAIR,EAAEQ,EAAI,CAAC,CACnC,CACF,CFrHA,IAAMG,GAAgC,CACpC,OACA,KAAM,eACN,KAAM,EACN,MAAO,OACP,OAAQ,OACR,oBAAqB,EACrB,OAAQ,CACV,EAGaC,EAAN,KAAuD,CAS5D,YACmBC,EACAC,EACAC,EACAC,EACjB,CAJiB,WAAAH,EACA,eAAAC,EACA,cAAAC,EACA,mBAAAC,EAZnB,KAAQ,SAAW,GACnB,KAAQ,IAAM,IAAIC,EAClB,KAAQ,QAAyBN,GAGjC,KAAQ,aAAe,GACvB,KAAQ,YAAc,GAQpB,IAAMO,EAAkB,KAAK,KAAK,KAAK,MAAM,aAAe,EAAI,CAAC,EAC3DC,EAAe,KAAK,IAAI,QAA2BD,CAAe,EACxE,KAAK,KAAO,IAAI,GAAAE,QAAc,QAAwBF,EAAiBC,CAAY,EACnF,KAAK,QAAU,IAAI,GAAAE,QAAW,OAAsB,CACtD,CAEO,OAAc,CACnB,KAAK,IAAI,MAAM,EACf,KAAK,KAAK,QAAQ,EAClB,KAAK,QAAQ,QAAQ,CACvB,CAEO,OAAc,CACnB,KAAK,SAAW,GAChB,KAAK,IAAI,MAAM,CACjB,CAEO,IAAIC,EAAmBC,EAAeC,EAAmB,CAC9D,GAAI,MAAK,SAET,GAAI,KAAK,IAAI,QAAU,EAChB,KAAK,KAAK,IAAIF,EAAK,SAASC,EAAOC,CAAG,CAAC,IAAiB,IAC3D,KAAK,KAAK,QAAQ,EAClB,KAAK,SAAW,QAEb,CACL,IAAMC,EAAU,KAAK,IAAI,MAAMH,EAAMC,EAAOC,CAAG,EAC/C,GAAIC,IAAY,GAAI,CAClB,KAAK,SAAW,GAChB,MACF,CACA,GAAIA,EAAU,EAAG,CAEf,GADgB,KAAK,IAAI,OAAO,OAChB,EAAmB,CAOjC,GANI,KAAK,eACP,KAAK,aAAe,GACpB,KAAK,YAAc,GACnB,KAAK,KAAK,QAAQ,GAEpB,KAAK,QAAU,OAAO,OAAO,CAAC,EAAGd,GAAgB,KAAK,IAAI,MAAM,EAC5D,CAAC,KAAK,QAAQ,OAAQ,CACxB,KAAK,SAAW,GAChB,MACF,CACA,KAAK,KAAK,KAAK,CACjB,SAAW,KAAK,YAAa,CAC3B,KAAK,SAAW,GAChB,MACF,CACK,KAAK,KAAK,IAAIW,EAAK,SAASG,EAASD,CAAG,CAAC,IAAiB,IAC7D,KAAK,KAAK,QAAQ,EAClB,KAAK,SAAW,GACZ,KAAK,eAAc,KAAK,YAAc,IAE9C,CACF,CACF,CAEO,IAAIE,EAA8C,CAGvD,GAFI,KAAK,UAEL,KAAK,IAAI,QAAU,GACjB,KAAK,IAAI,IAAI,EAAG,MAAO,GAE7B,IAAMC,EAAU,KAAK,IAAI,OAAO,KAEhC,GAAIA,IAAY,EAAuB,MAAO,GAE9C,GAAIA,IAAY,EAA6B,CAE3C,IAAIC,EAAIC,EAAkB,MACtBC,EAAID,EAAkB,OACtB,KAAK,UAAU,aACjBD,EAAI,KAAK,UAAU,WAAW,IAAI,OAAO,MAAQ,KAAK,cAAc,KACpEE,EAAI,KAAK,UAAU,WAAW,IAAI,OAAO,OAAS,KAAK,cAAc,MAEvE,IAAMC,EAAQ,KAAK,cAAc,MAAM,qBAAqB,KAAO,EAC7DC,EAAS,4BAA4BF,EAAE,QAAQ,CAAC,CAAC,IAAIF,EAAE,QAAQ,CAAC,CAAC,IAAIG,EAAM,QAAQ,CAAC,CAAC,SAC3F,YAAK,cAAc,MAAMC,EAAQ,EAAK,EAC/B,EACT,CAEA,GAAIL,IAAY,EACd,YAAK,QAAU,OAAO,OAAO,CAAC,EAAGhB,GAAgB,KAAK,IAAI,MAAM,EAChE,KAAK,aAAe,GACpB,KAAK,YAAc,GACnB,KAAK,KAAK,QAAQ,EAClB,KAAK,KAAK,KAAK,EACR,GAGT,GAAIgB,IAAY,IACV,CAAC,KAAK,eACV,KAAK,aAAe,GAChB,KAAK,aAAe,KAAK,QAAQ,OAAS,IAA4B,MAAO,GAKnF,IAAIC,EAAI,EACJE,EAAI,EAGJG,EACAC,EAAUC,EAoBd,IAnBIF,EAAOP,MACLO,EAAO,CAAC,KAAK,KAAK,IAAI,IACxBC,EAAUE,GAAU,KAAK,KAAK,KAAK,GAC/BH,EAAOC,EAAQ,OAAS,gBAC1BN,EAAIM,EAAQ,MACZJ,EAAII,EAAQ,QACRD,EAAOL,GAAKE,GAAKF,EAAIE,EAAI,KAAK,MAAM,aACtC,CAACF,EAAGE,CAAC,EAAI,KAAK,QAAQF,EAAGE,CAAC,EAAE,IAAI,KAAK,KAAK,EAC1CG,EAAOL,GAAKE,GAAKF,EAAIE,EAAI,KAAK,MAAM,YAEpC,QAAQ,KAAK,8BAA8BI,EAAQ,KAAK,IAAIA,EAAQ,MAAM,EAAE,GAG9E,QAAQ,KAAK,6BAA6B,GAG5C,QAAQ,KAAK,mCAAmC,GAGhD,CAACD,EACH,YAAK,KAAK,QAAQ,EACX,GAGT,IAAII,EACJ,GAAIH,EAAQ,OAAS,YAAa,CAChC,IAAMZ,EAAO,KAAK,QAAQ,OAAO,KAAK,KAAK,KAAK,EAOhD,GANAe,EAAO,IAAI,UACT,IAAI,kBAAkBf,EAAK,OAAQA,EAAK,WAAYA,EAAK,UAAU,EACnE,KAAK,QAAQ,MACb,KAAK,QAAQ,MACf,EACA,KAAK,QAAQ,QAAQ,EACjBM,IAAM,KAAK,QAAQ,OAASE,IAAM,KAAK,QAAQ,OAAQ,CAEzD,KAAK,KAAK,QAAQ,EAClB,IAAMQ,EAASC,EAAc,aAAa,OAAW,KAAK,QAAQ,MAAO,KAAK,QAAQ,MAAM,EAC5F,OAAAD,EAAO,WAAW,IAAI,GAAG,aAAaD,EAAM,EAAG,CAAC,EAChD,KAAK,SAAS,SAASC,CAAM,EACtB,EACT,CACF,MACED,EAAO,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAG,CAAE,KAAMH,EAAQ,IAAK,CAAC,EAE3D,YAAK,KAAK,QAAQ,EACX,kBAAkBG,EAAM,CAAE,YAAaT,EAAG,aAAcE,CAAE,CAAC,EAC/D,KAAKU,IACJ,KAAK,SAAS,SAASA,CAAE,EAClB,GACR,EACA,MAAMC,IACL,QAAQ,KAAK,uBAAuBP,EAAQ,IAAI,IAAIA,EAAQ,KAAK,IAAIA,EAAQ,MAAM,GAAIO,CAAC,EACjF,GACR,CACL,CAEQ,QAAQb,EAAWE,EAA6B,CACtD,IAAMY,EAAK,KAAK,UAAU,YAAY,IAAI,KAAK,OAASb,EAAkB,MACpEc,EAAK,KAAK,UAAU,YAAY,IAAI,KAAK,QAAUd,EAAkB,OACrEe,EAAQ,KAAK,UAAU,YAAY,IAAI,OAAO,OAASF,EAAK,KAAK,cAAc,KAC/EG,EAAS,KAAK,UAAU,YAAY,IAAI,OAAO,QAAUF,EAAK,KAAK,cAAc,KAEjFG,EAAK,KAAK,KAAK,KAAK,QAAQ,MAAQF,EAAOF,CAAE,EAC7CK,EAAK,KAAK,KAAK,KAAK,QAAQ,OAASF,EAAQF,CAAE,EACrD,GAAI,CAACG,GAAM,CAACC,EAAI,CACd,IAAMC,EAAKJ,EAAQhB,EACbqB,GAAMJ,EAASF,GAAMb,EACrBoB,EAAI,KAAK,IAAIF,EAAIC,CAAE,EACzB,OAAOC,EAAI,EAAI,CAACtB,EAAIsB,EAAGpB,EAAIoB,CAAC,EAAI,CAACtB,EAAGE,CAAC,CACvC,CACA,OAAQgB,EAEJ,KAAK,QAAQ,qBAAuB,CAACA,GAAM,CAACC,EAC1C,CAACD,EAAIhB,EAAIgB,EAAKlB,CAAC,EAAI,CAACkB,EAAIC,CAAE,EAF5B,CAACnB,EAAImB,EAAKjB,EAAGiB,CAAE,CAGrB,CAEQ,KAAKI,EAAWC,EAAeC,EAAsB,CAC3D,OAAIF,IAAM,OAAe,EACrBA,EAAE,SAAS,GAAG,EAAU,SAASA,EAAE,MAAM,EAAG,EAAE,EAAG,EAAE,EAAIC,EAAQ,IAC/DD,EAAE,SAAS,IAAI,EAAU,SAASA,EAAE,MAAM,EAAG,EAAE,EAAG,EAAE,EACjD,SAASA,EAAG,EAAE,EAAIE,CAC3B,CACF,EGnOA,IAAAC,GAAiD,QCoI1C,SAASC,GAAkBC,EAA6B,CAC7D,IAAMC,EAAqB,CAAC,EACtBC,EAAQF,EAAK,MAAM,GAAG,EAE5B,QAAWG,KAAQD,EAAO,CACxB,IAAME,EAAQD,EAAK,QAAQ,GAAG,EAC9B,GAAIC,IAAU,GAAI,SAElB,IAAMC,EAAMF,EAAK,UAAU,EAAGC,CAAK,EAC7BE,EAAQH,EAAK,UAAUC,EAAQ,CAAC,EAGtC,GAAIC,IAAQ,IAAiB,CAC3BJ,EAAI,OAASK,EACb,QACF,CACA,GAAID,IAAQ,IAAsB,CAChCJ,EAAI,YAAcK,EAClB,QACF,CACA,GAAID,IAAQ,IAAuB,CACjCJ,EAAI,aAAeK,EACnB,QACF,CACA,GAAID,IAAQ,IAA0B,CACpCJ,EAAI,eAAiBK,EACrB,QACF,CACA,IAAMC,EAAW,SAASD,EAAO,EAAE,EACnC,OAAQD,EAAK,CACX,IAAK,IAAiBJ,EAAI,OAASM,EAAU,MAC7C,IAAK,IAAaN,EAAI,GAAKM,EAAU,MACrC,IAAK,IAAuBN,EAAI,YAAcM,EAAU,MACxD,IAAK,IAAgBN,EAAI,MAAQM,EAAU,MAC3C,IAAK,IAAiBN,EAAI,OAASM,EAAU,MAC7C,IAAK,IAAmBN,EAAI,EAAIM,EAAU,MAC1C,IAAK,IAAmBN,EAAI,EAAIM,EAAU,MAC1C,IAAK,IAAuBN,EAAI,YAAcM,EAAU,MACxD,IAAK,IAAwBN,EAAI,aAAeM,EAAU,MAC1D,IAAK,IAA6BN,EAAI,QAAUM,EAAU,MAC1D,IAAK,IAA6BN,EAAI,QAAUM,EAAU,MAC1D,IAAK,IAAkBN,EAAI,QAAUM,EAAU,MAC/C,IAAK,IAAeN,EAAI,KAAOM,EAAU,MACzC,IAAK,IAAeN,EAAI,KAAOM,EAAU,MACzC,IAAK,IAAgBN,EAAI,MAAQM,EAAU,MAC3C,IAAK,IAA0BN,EAAI,eAAiBM,EAAU,MAC9D,IAAK,IAAkBN,EAAI,OAASM,EAAU,MAC9C,IAAK,IAAuBN,EAAI,YAAcM,EAAU,KAC1D,CACF,CAEA,OAAON,CACT,CDhKA,IAAMO,GAAa,EAGNC,GAAN,KAA8E,CAgCnF,YACmBC,EACAC,EACAC,EACAC,EACjB,CAJiB,WAAAH,EACA,eAAAC,EACA,mBAAAC,EACA,mBAAAC,EAnCnB,KAAQ,SAAW,GACnB,KAAQ,aAAe,GAEvB,KAAQ,eAAuC,KAO/C,KAAQ,eAAiB,GAGzB,KAAQ,aAAe,IAAI,YAAY,GAA+B,EACtE,KAAQ,eAAiB,EAGzB,KAAQ,kBAAoB,EAC5B,KAAQ,kBAAoB,EAG5B,KAAQ,eAAuC,KAI/C,KAAQ,sBAA2D,IAAI,IAarE,KAAK,iBAAmB,KAAK,KAAK,KAAK,MAAM,eAAiB,EAAI,CAAC,EAEnE,KAAK,qBAAuB,KAAK,IAAI,QAAgC,KAAK,gBAAgB,CAC5F,CAEO,OAAc,CACnB,KAAK,mBAAmB,EACpB,KAAK,iBACP,KAAK,eAAe,QAAQ,EAC5B,KAAK,eAAiB,MAExB,KAAK,cAAc,MAAM,CAC3B,CAEO,SAAgB,CACrB,KAAK,MAAM,CACb,CAEQ,oBAAoBC,EAAmB,CAC7C,KAAK,sBAAsB,OAAOA,CAAG,EACjC,KAAK,kBAAoBA,IAC3B,KAAK,gBAAkB,OAE3B,CAEQ,oBAA2B,CACjC,QAAWC,KAAW,KAAK,sBAAsB,OAAO,EACtDA,EAAQ,QAAQ,QAAQ,EAE1B,KAAK,sBAAsB,MAAM,EACjC,KAAK,gBAAkB,MACzB,CAEO,OAAc,CACnB,KAAK,SAAW,GAChB,KAAK,aAAe,GACpB,KAAK,eAAiB,GACtB,KAAK,eAAiB,EACtB,KAAK,eAAiB,KAEtB,KAAK,kBAAoB,KAAK,iBAC9B,KAAK,kBAAoB,EACzB,KAAK,eAAiB,IACxB,CAEO,IAAIC,EAAmBC,EAAeC,EAAmB,CAC9D,GAAI,MAAK,SAET,GAAI,CAAC,KAAK,eACR,KAAK,eAAeF,EAAMC,EAAOC,CAAG,MAC/B,CAEL,IAAIC,EAAaD,EACjB,QAASE,EAAIH,EAAOG,EAAIF,EAAKE,IAC3B,GAAIJ,EAAKI,CAAC,IAAM,GAAqB,CACnC,KAAK,eAAiB,GACtBD,EAAaC,EACb,KACF,CAIF,IAAMC,EAAaF,EAAaF,EAChC,GAAI,KAAK,eAAiBI,EAAa,IAAiC,CACtE,KAAK,SAAW,GAChB,MACF,CAIA,GAHA,KAAK,aAAa,IAAIL,EAAK,SAASC,EAAOE,CAAU,EAAG,KAAK,cAAc,EAC3E,KAAK,gBAAkBE,EAEnB,CAAC,KAAK,eAAgB,CAKxB,GAHA,KAAK,eAAiBC,GAAkB,KAAK,wBAAwB,CAAC,EAGlE,KAAK,eAAe,KAAO,QAAa,KAAK,eAAe,cAAgB,OAAW,CACzF,KAAK,cAAc,KAAK,eAAe,GAAI,0CAA2C,KAAK,eAAe,OAAS,CAAC,EACpH,KAAK,SAAW,GAChB,MACF,CAGA,GAAI,KAAK,eAAe,SAAW,IACjC,OAIF,IAAMC,EAAeJ,EAAa,EAC9BI,EAAeL,GACjB,KAAK,eAAeF,EAAMO,EAAcL,CAAG,CAE/C,CACF,CACF,CAGQ,eAAeF,EAAmBC,EAAeC,EAAmB,CAC1E,GAAI,KAAK,SAAU,OAKnB,IAAMM,EAAa,KAAK,gBAAgB,IAAM,KAAK,iBAAmB,EAChET,EAAU,KAAK,sBAAsB,IAAIS,CAAU,EACnDC,EAAsBV,GAAS,kBAAoB,EAGzD,GAFA,KAAK,mBAAqBG,EAAMD,EACFQ,EAAsB,KAAK,kBAC7B,KAAK,kBAAmB,CAClD,IAAMC,EAAmB,KAAK,gBAAkBX,GAAS,QACrDW,GACFA,EAAiB,QAAQ,EAE3B,KAAK,eAAiB,KAClBX,GACF,KAAK,oBAAoBS,CAAU,EAErC,KAAK,SAAW,GAChB,MACF,CAEI,KAAK,eAELT,GAAS,SAAW,CAAC,KAAK,iBAC5B,KAAK,eAAiBA,EAAQ,SAE3B,KAAK,iBACR,KAAK,eAAiB,IAAI,GAAAY,QAAc,QAA6B,KAAK,iBAAkB,KAAK,oBAAoB,EACrH,KAAK,eAAe,KAAK,GAGvB,KAAK,eAAe,IAAIX,EAAK,SAASC,EAAOC,CAAG,CAAC,IAAMV,KACzD,KAAK,eAAe,QAAQ,EAC5B,KAAK,eAAiB,KACtB,KAAK,aAAe,GAChBO,GACF,KAAK,oBAAoBS,CAAU,GAGzC,CAEO,IAAII,EAA8C,CACvD,GAAI,KAAK,UAAY,CAACA,EACpB,OAAI,KAAK,iBACP,KAAK,eAAe,QAAQ,EAC5B,KAAK,eAAiB,MAEjB,GAIT,GAAI,KAAK,eACP,OAAO,KAAK,wBAAwB,EAItC,IAAMC,EAAM,KAAK,eAGjB,GAAIA,EAAI,SAAW,IACjB,OAAO,KAAK,cAAcA,CAAG,EAI/B,IAAML,EAAaK,EAAI,IAAM,KAAK,iBAAmB,EAC/CC,EAAeD,EAAI,OAAS,EAC5Bd,EAAU,KAAK,sBAAsB,IAAIS,CAAU,EAEzD,GAAIM,EACF,OAAI,KAAK,iBACHf,GACFA,EAAQ,kBAAoB,KAAK,kBACjCA,EAAQ,YAAcA,EAAQ,aAAe,KAAK,cAElD,KAAK,sBAAsB,IAAIS,EAAY,CACzC,IAAK,CAAE,GAAGK,CAAI,EACd,QAAS,KAAK,eACd,iBAAkB,KAAK,kBACvB,YAAa,KAAK,YACpB,CAAC,EAEH,KAAK,gBAAkBL,EACvB,KAAK,eAAiB,MAEjB,GAILT,IACF,KAAK,gBAAkB,QAGzB,IAAIgB,EAAc,KAAK,aACnBC,EAAWH,EACXI,EAAU,KAAK,eAEflB,IACFiB,EAAWjB,EAAQ,IACnBkB,EAAUlB,EAAQ,QAClBgB,EAAcA,GAAehB,EAAQ,YACrC,KAAK,sBAAsB,OAAOS,CAAU,GAG9C,IAAIU,EAAa,IAAI,WAAW,CAAC,EAC7BD,IACEA,EAAQ,IAAI,IAAMzB,KACpBuB,EAAc,IAEhBG,EAAaD,EAAQ,OAEvB,KAAK,eAAiB,KAKtB,IAAME,EAAS,KAAK,8BAA8BH,EAAUE,EAAYH,CAAW,EACnF,OAAIE,GACFA,EAAQ,QAAQ,EAEXE,CACT,CAIQ,yBAAkC,CACxC,IAAIC,EAAM,GACV,QAAShB,EAAI,EAAGA,EAAI,KAAK,eAAgBA,IACvCgB,GAAO,OAAO,cAAc,KAAK,aAAahB,CAAC,CAAC,EAElD,OAAOgB,CACT,CAEQ,yBAAsD,CAC5D,IAAMP,EAAMP,GAAkB,KAAK,wBAAwB,CAAC,EAG5D,GAAIO,EAAI,KAAO,QAAaA,EAAI,cAAgB,OAC9C,YAAK,cAAcA,EAAI,GAAI,0CAA2CA,EAAI,OAAS,CAAC,EAC7E,GAKT,OAFeA,EAAI,QAAU,IAEb,CACd,QACE,OAAO,KAAK,cAAcA,CAAG,EAC/B,QACE,YAAK,cAAcA,EAAI,IAAM,EAAG,KAAMA,EAAI,OAAS,CAAC,EAC7C,GACT,QACE,OAAO,KAAK,iBAAiBA,CAAG,EAClC,QAKE,OAAIA,EAAI,KAAO,QACb,KAAK,cAAcA,EAAI,GAAI,4BAA6BA,EAAI,OAAS,CAAC,EAEjE,EACX,CACF,CAEQ,8BAA8BA,EAAoBQ,EAAmBN,EAAkD,CAG7H,OAFeF,EAAI,QAAU,IAEb,CACd,QAA2B,CACzB,IAAMM,EAAS,KAAK,gBAAgBN,EAAKQ,EAAON,CAAW,EAG3D,OAAKF,EAAI,cAAgB,OAAS,KAAOA,EAAI,KAAO,SAC9CE,EACF,KAAK,cAAcF,EAAI,GAAI,6BAA8BA,EAAI,OAAS,CAAC,EAC9DQ,EAAM,OAAS,GACxB,KAAK,cAAcR,EAAI,GAAI,KAAMA,EAAI,OAAS,CAAC,GAG5CM,CACT,CACA,QACE,OAAO,KAAK,uBAAuBN,EAAKQ,EAAON,CAAW,EAC5D,QACE,OAAO,KAAK,aAAaF,EAAKQ,EAAON,CAAW,EAClD,QAEE,OAAO,KAAK,iBAAiBF,CAAG,EAClC,QAKE,OAAIA,EAAI,KAAO,QACb,KAAK,cAAcA,EAAI,GAAI,4BAA6BA,EAAI,OAAS,CAAC,EAEjE,EACX,CACF,CAEQ,iBAAiBA,EAAgD,CACvE,GAAIA,EAAI,KAAO,OACb,MAAO,GAET,IAAMS,EAAKT,EAAI,GACTU,EAAQ,KAAK,cAAc,SAASD,CAAE,EAC5C,OAAKC,EAIU,KAAK,cAAcA,EAAOV,CAAG,EAC9B,KAAKD,IACjB,KAAK,cAAcU,EAAIV,EAAU,KAAO,gCAAiCC,EAAI,OAAS,EAAGA,EAAI,WAAW,EACjG,GACR,GAPC,KAAK,cAAcS,EAAI,yBAA0BT,EAAI,OAAS,EAAGA,EAAI,WAAW,EACzE,GAOX,CAEQ,gBAAgBA,EAAoBQ,EAAmBN,EAA+B,CAY5F,OADqBF,EAAI,cAAgB,OACpB,KACfA,EAAI,KAAO,QACb,KAAK,cAAcA,EAAI,GAAI,yCAA0CA,EAAI,OAAS,CAAC,EAE9E,KAGLE,GAAeM,EAAM,SAAW,GAEpC,KAAK,cAAc,WAAWR,EAAI,GAAI,CACpC,KAAM,IAAI,KAAK,CAACQ,CAAiB,CAAC,EAClC,MAAOR,EAAI,OAAS,EACpB,OAAQA,EAAI,QAAU,EACtB,OAASA,EAAI,QAAU,GACvB,YAAaA,EAAI,aAAe,EAClC,CAAC,EACM,GACT,CAEQ,uBAAuBA,EAAoBQ,EAAmBN,EAAkD,CACtH,GAAIA,EACF,OAAIF,EAAI,KAAO,QACb,KAAK,cAAcA,EAAI,GAAI,6BAA8BA,EAAI,OAAS,CAAC,EAElE,GAGT,KAAK,gBAAgBA,EAAKQ,EAAON,CAAW,EAE5C,IAAMO,EAAKT,EAAI,IAAM,KAAK,cAAc,YAClCU,EAAQ,KAAK,cAAc,SAASD,CAAE,EAC5C,GAAIC,EAAO,CACT,IAAMJ,EAAS,KAAK,cAAcI,EAAOV,CAAG,EAC5C,OAAIA,EAAI,KAAO,OACNM,EAAO,KAAKP,IACjB,KAAK,cAAcU,EAAIV,EAAU,KAAO,gCAAiCC,EAAI,OAAS,CAAC,EAChF,GACR,EAEIM,EAAO,KAAK,IAAM,EAAI,CAC/B,CACA,MAAO,EACT,CAEQ,aAAaN,EAAoBQ,EAAmBN,EAA+B,CACzF,IAAMO,EAAKT,EAAI,IAAM,EACfW,EAAQX,EAAI,OAAS,EAM3B,IADqBA,EAAI,cAAgB,OACpB,IACnB,YAAK,cAAcS,EAAI,yCAA0CE,CAAK,EAC/D,GAIT,GAAIT,EACF,YAAK,cAAcO,EAAI,6BAA8BE,CAAK,EACnD,GAIT,GAAIH,EAAM,SAAW,EACnB,YAAK,cAAcC,EAAI,KAAME,CAAK,EAC3B,GAGT,IAAMC,EAASZ,EAAI,QAAU,GAE7B,GAAIY,IAAW,IACb,KAAK,cAAcH,EAAI,KAAME,CAAK,MAC7B,CACL,IAAME,EAAQb,EAAI,OAAS,EACrBc,EAASd,EAAI,QAAU,EAE7B,GAAI,CAACa,GAAS,CAACC,EACb,YAAK,cAAcL,EAAI,sDAAuDE,CAAK,EAC5E,GAGT,IAAMI,EAAgBH,IAAW,OAC3BI,EAAgBH,EAAQC,EAASC,EAEvC,GAAIP,EAAM,OAASQ,EACjB,YAAK,cAAcP,EAAI,iCAAkCE,CAAK,EACvD,GAGT,KAAK,cAAcF,EAAI,KAAME,CAAK,CACpC,CACA,MAAO,EACT,CAEQ,cAAcX,EAA6B,CAOjD,OALiBA,EAAI,gBAAkB,IAKrB,CAChB,IAAK,IACL,IAAK,IACH,KAAK,mBAAmB,EACxB,KAAK,cAAc,UAAU,EAC7B,MACF,IAAK,IACL,IAAK,IAKH,GAAIA,EAAI,KAAO,OAAW,CACxB,IAAMd,EAAU,KAAK,sBAAsB,IAAIc,EAAI,EAAE,EACjDd,GACFA,EAAQ,QAAQ,QAAQ,EAE1B,KAAK,oBAAoBc,EAAI,EAAE,EAC/B,KAAK,cAAc,WAAWA,EAAI,EAAE,CACtC,CACA,MACF,QAEE,KACJ,CACA,MAAO,EACT,CAEQ,cAAcS,EAAYQ,EAAiBN,EAAeO,EAA4B,CAC5F,IAAMC,EAAOF,IAAY,KAEzB,GADIE,GAAQR,GAAS,GACjB,CAACQ,GAAQR,GAAS,EAAG,OAEzB,IAAMS,EAAQF,EAAc,MAAMA,CAAW,GAAK,GAC5CG,EAAW,WAAWZ,CAAE,GAAGW,CAAK,IAAIH,CAAO,SACjD,KAAK,cAAc,MAAM,YAAY,iBAAiBI,CAAQ,CAChE,CAIQ,cAAcX,EAAwBV,EAAsC,CAClF,OAAO,KAAK,kBAAkBU,EAAOV,CAAG,EACrC,KAAK,IAAM,EAAI,EACf,MAAM,IAAM,EAAK,CACtB,CAEA,MAAc,kBAAkBU,EAAwBV,EAAmC,CACzF,IAAIsB,EAAkC,MAAM,KAAK,cAAcZ,CAAK,EAEpE,GAAI,CACF,IAAMa,EAAQ,KAAK,IAAI,EAAGvB,EAAI,GAAK,CAAC,EAC9BwB,EAAQ,KAAK,IAAI,EAAGxB,EAAI,GAAK,CAAC,EAC9ByB,EAAQzB,EAAI,aAAgBsB,EAAO,MAAQC,EAC3CG,EAAQ1B,EAAI,cAAiBsB,EAAO,OAASE,EAE7CG,EAAW,KAAK,IAAI,EAAGL,EAAO,MAAQC,CAAK,EAC3CK,EAAW,KAAK,IAAI,EAAGN,EAAO,OAASE,CAAK,EAC5CK,EAAa,KAAK,IAAI,EAAG,KAAK,IAAIJ,EAAOE,CAAQ,CAAC,EAClDG,EAAa,KAAK,IAAI,EAAG,KAAK,IAAIJ,EAAOE,CAAQ,CAAC,EAExD,GAAIC,IAAe,GAAKC,IAAe,EACrC,MAAM,IAAI,MAAM,0BAA0B,EAG5C,GAAIP,IAAU,GAAKC,IAAU,GAAKK,IAAeP,EAAO,OAASQ,IAAeR,EAAO,OAAQ,CAC7F,IAAMS,EAAU,MAAM,kBAAkBT,EAAQC,EAAOC,EAAOK,EAAYC,CAAU,EACpFR,EAAO,MAAM,EACbA,EAASS,CACX,CAEA,IAAMC,EAAK,KAAK,UAAU,YAAY,IAAI,KAAK,OAASC,EAAkB,MACpEC,EAAK,KAAK,UAAU,YAAY,IAAI,KAAK,QAAUD,EAAkB,OAIvEE,EACAC,EACApC,EAAI,UAAY,QAAaA,EAAI,OAAS,QAC5CmC,EAAUnC,EAAI,QACdoC,EAAUpC,EAAI,MACLA,EAAI,UAAY,QACzBmC,EAAUnC,EAAI,QACdoC,EAAU,KAAK,IAAI,EAAG,KAAK,KAAMd,EAAO,OAASA,EAAO,OAAUa,EAAUH,GAAME,CAAE,CAAC,GAC5ElC,EAAI,OAAS,QACtBoC,EAAUpC,EAAI,KACdmC,EAAU,KAAK,IAAI,EAAG,KAAK,KAAMb,EAAO,MAAQA,EAAO,QAAWc,EAAUF,GAAMF,CAAE,CAAC,IAErFG,EAAU,KAAK,KAAKb,EAAO,MAAQU,CAAE,EACrCI,EAAU,KAAK,KAAKd,EAAO,OAASY,CAAE,GAGxC,IAAIG,EAAIf,EAAO,MACXgB,EAAIhB,EAAO,OAQf,IALItB,EAAI,UAAY,QAAaA,EAAI,OAAS,UAC5CqC,EAAI,KAAK,MAAMF,EAAUH,CAAE,EAC3BM,EAAI,KAAK,MAAMF,EAAUF,CAAE,GAGzBG,EAAIC,EAAI,KAAK,MAAM,WACrB,MAAM,IAAI,MAAM,2BAA2B,EAI7C,IAAMC,EAAS,KAAK,cAAc,MAAM,OAClCC,EAASD,EAAO,EAChBE,EAASF,EAAO,EAChBG,EAAaH,EAAO,MAOpBI,GADc3C,EAAI,SAAW,QAAaA,EAAI,OAAS,EACrB,SAAW,MAEnD,GAAIqC,IAAMf,EAAO,OAASgB,IAAMhB,EAAO,OAAQ,CAC7C,IAAMsB,EAAS,MAAM,kBAAkBtB,EAAQ,CAAE,YAAae,EAAG,aAAcC,CAAE,CAAC,EAClFhB,EAAO,MAAM,EACbA,EAASsB,CACX,CAGA,IAAMC,GAAU,KAAK,IAAI,KAAK,IAAI,EAAG7C,EAAI,SAAW,CAAC,EAAGgC,EAAK,CAAC,EACxDc,GAAU,KAAK,IAAI,KAAK,IAAI,EAAG9C,EAAI,SAAW,CAAC,EAAGkC,EAAK,CAAC,EAC9D,GAAIW,KAAY,GAAKC,KAAY,EAAG,CAKlC,IAAMC,EAAW/C,EAAI,UAAY,OAAa,KAAK,MAAMmC,EAAUH,CAAE,EAAIV,EAAO,MAAQuB,GAClFG,GAAWhD,EAAI,OAAS,OAAa,KAAK,MAAMoC,EAAUF,CAAE,EAAIZ,EAAO,OAASwB,GAChFG,EAAeC,EAAc,aAAa,OAAO,SAAUH,EAASC,EAAO,EAC3EG,GAAYF,EAAa,WAAW,IAAI,EAC9C,GAAI,CAACE,GACH,MAAM,IAAI,MAAM,wCAAwC,EAE1DA,GAAU,UAAU7B,EAAQuB,GAASC,EAAO,EAE5C,IAAMM,GAAe,MAAM,kBAAkBH,CAAY,EAMzD,GALAA,EAAa,MAAQA,EAAa,OAAS,EAC3C3B,EAAO,MAAM,EACbA,EAAS8B,GACTf,EAAIf,EAAO,MACXgB,EAAIhB,EAAO,OACPe,EAAIC,EAAI,KAAK,MAAM,WACrB,MAAM,IAAI,MAAM,2BAA2B,EAEzCtC,EAAI,UAAY,SAClBmC,EAAU,KAAK,KAAKb,EAAO,MAAQU,CAAE,GAEnChC,EAAI,OAAS,SACfoC,EAAU,KAAK,KAAKd,EAAO,OAASY,CAAE,EAE1C,CAEA,IAAMmB,GAASrD,EAAI,QAAU,EAO7B,GANA,KAAK,cAAc,SAASU,EAAM,GAAIY,EAAQ,GAAMqB,GAAOU,EAAM,EACjE/B,EAAS,OAKLtB,EAAI,iBAAmB,EAAG,CAE5B,IAAMsD,EAAWf,EAAO,MAAQG,EAChCH,EAAO,EAAIC,EAEXD,EAAO,EAAI,KAAK,IAAIE,EAASa,EAAU,CAAC,CAC1C,MAGEf,EAAO,EAAI,KAAK,IAAIC,EAASL,EAAS,KAAK,cAAc,IAAI,CAEjE,OAASoB,EAAG,CACV,MAAAjC,GAAQ,MAAM,EACRiC,CACR,CACF,CAGA,MAAc,cAAc7C,EAA8C,CACxE,IAAIF,EAAoB,IAAI,WAAW,MAAME,EAAM,KAAK,YAAY,CAAC,EAMrE,GAJIA,EAAM,cAAgB,MACxBF,EAAQ,MAAM,KAAK,gBAAgBA,CAAK,GAGtCE,EAAM,SAAW,IAAiB,CACpC,IAAM8C,EAAO,IAAI,KAAK,CAAChD,CAAiB,EAAG,CAAE,KAAM,WAAY,CAAC,EAChE,GAAI,CAAC,OAAO,kBAAmB,CAC7B,IAAMiD,EAAM,IAAI,gBAAgBD,CAAI,EAC9BE,EAAM,IAAI,MAChB,OAAO,IAAI,QAAqB,CAACC,EAASC,IAAW,CACnDF,EAAI,iBAAiB,OAAQ,IAAM,CACjC,IAAI,gBAAgBD,CAAG,EACvB,IAAMI,EAASX,EAAc,aAAa,OAAO,SAAUQ,EAAI,MAAOA,EAAI,MAAM,EAChFG,EAAO,WAAW,IAAI,GAAG,UAAUH,EAAK,EAAG,CAAC,EAC5C,kBAAkBG,CAAM,EAAE,KAAKF,CAAO,EAAE,MAAMC,CAAM,CACtD,CAAC,EACDF,EAAI,iBAAiB,QAAS,IAAM,CAClC,IAAI,gBAAgBD,CAAG,EACvBG,EAAO,IAAI,MAAM,sBAAsB,CAAC,CAC1C,CAAC,EACDF,EAAI,IAAMD,CACZ,CAAC,CACH,CACA,OAAO,kBAAkBD,CAAI,CAC/B,CAGA,IAAM3C,EAAQH,EAAM,MACdI,EAASJ,EAAM,OAErB,GAAI,CAACG,GAAS,CAACC,EACb,MAAM,IAAI,MAAM,8CAA8C,EAGhE,IAAMC,EAAgBL,EAAM,SAAW,OACjCM,EAAgBH,EAAQC,EAASC,EAEvC,GAAIP,EAAM,OAASQ,EACjB,MAAM,IAAI,MAAM,yBAAyB,EAG3C,IAAM8C,EAAajD,EAAQC,EAE3B,GAAIJ,EAAM,SAAW,GAEnB,OAAO,kBAAkB,IAAI,UAAU,IAAI,kBAAkBF,EAAM,OAAuBA,EAAM,WAAYsD,EAAa,CAAwC,EAAGjD,EAAOC,CAAM,CAAC,EAMpL,IAAM3B,EAAO,IAAI,kBAAkB2E,EAAa,CAAwC,EAClFC,EAAQ,IAAI,YAAYvD,EAAM,OAAQA,EAAM,WAAY,KAAK,MAAMA,EAAM,WAAa,CAAC,CAAC,EACxFwD,EAAQ,IAAI,YAAY7E,EAAK,MAAM,EACnC8E,EAAgBH,EAAa,GAE/BI,EAAY,EACZC,EAAY,EAChB,QAAS5E,EAAI,EAAGA,EAAI0E,EAAe1E,GAAK,EAAG,CACzC,IAAM6E,EAAKL,EAAMG,GAAW,EACtBG,EAAKN,EAAMG,GAAW,EACtBI,EAAKP,EAAMG,GAAW,EAE5BF,EAAMG,GAAW,EAAI,WAAaC,EAClCJ,EAAMG,GAAW,EAAI,WAAcC,IAAO,GAAOC,GAAM,EACvDL,EAAMG,GAAW,EAAI,WAAcE,IAAO,GAAOC,GAAM,GACvDN,EAAMG,GAAW,EAAI,WAAcG,IAAO,CAC5C,CAGA,IAAIC,EAAUN,EAAgB,EAC1BO,EAAUP,EAAgB,EAC9B,QAAS1E,EAAI0E,EAAe1E,EAAIuE,EAAYvE,IAC1CJ,EAAKqF,CAAO,EAAQhE,EAAM+D,CAAO,EACjCpF,EAAKqF,EAAU,CAAC,EAAIhE,EAAM+D,EAAU,CAAC,EACrCpF,EAAKqF,EAAU,CAAC,EAAIhE,EAAM+D,EAAU,CAAC,EACrCpF,EAAKqF,EAAU,CAAC,EAAI,IACpBD,GAAW,EACXC,GAAW,EAGb,OAAO,kBAAkB,IAAI,UAAUrF,EAAM0B,EAAOC,CAAM,CAAC,CAC7D,CAEA,MAAc,gBAAgB2D,EAA6C,CACzE,GAAI,CACF,OAAO,MAAM,KAAK,YAAYA,EAAY,SAAS,CACrD,MAAQ,CACN,OAAO,MAAM,KAAK,YAAYA,EAAY,aAAa,CACzD,CACF,CAEA,MAAc,YAAYA,EAAwB7D,EAAwD,CACxG,IAAM8D,EAAK,IAAI,oBAAoB9D,CAAM,EACnC+D,EAASD,EAAG,SAAS,UAAU,EACrCC,EAAO,MAAMF,CAA0B,EACvCE,EAAO,MAAM,EAEb,IAAMC,EAAuB,CAAC,EACxBC,EAASH,EAAG,SAAS,UAAU,EAErC,OAAa,CACX,GAAM,CAAE,KAAAI,EAAM,MAAAC,CAAM,EAAI,MAAMF,EAAO,KAAK,EAC1C,GAAIC,EAAM,MACVF,EAAO,KAAKG,CAAK,CACnB,CAEA,IAAMC,EAAcJ,EAAO,OAAO,CAACK,EAAKC,IAAUD,EAAMC,EAAM,OAAQ,CAAC,EACjE5E,EAAS,IAAI,WAAW0E,CAAW,EACrCG,EAAS,EACb,QAAWD,KAASN,EAClBtE,EAAO,IAAI4E,EAAOC,CAAM,EACxBA,GAAUD,EAAM,OAElB,OAAO5E,CACT,CAEA,IAAW,QAA+C,CACxD,OAAO,KAAK,cAAc,MAC5B,CAEA,IAAW,qBAAmD,CAC5D,OAAO,KAAK,cAAc,kBAC5B,CAEA,IAAW,sBAAkE,CAC3E,OAAO,KAAK,qBACd,CACF,EEjyBO,IAAM8E,EAAN,MAAMA,CAAyC,CA6BpD,YACmBC,EACjB,CADiB,cAAAA,EA3BnB,KAAQ,aAAe,EACvB,KAAiB,QAAwC,IAAI,IAU7D,KAAiB,oBAA2C,IAAI,IAChE,KAAiB,oBAA2C,IAAI,IAIhE,KAAiB,2BAA8BC,GAA4B,CACzE,IAAMC,EAAU,KAAK,oBAAoB,IAAID,CAAS,EAClDC,IAAY,SACd,KAAK,oBAAoB,OAAOA,CAAO,EACvC,KAAK,oBAAoB,OAAOD,CAAS,EACzC,KAAK,QAAQ,OAAOC,CAAO,EAE/B,EACA,KAAQ,cAA+B,CAAE,UAAW,GAAM,MAAO,MAAO,OAAQ,EAAG,UAAW,KAAM,EAKlG,KAAK,wBAA0B,KAAK,SAAS,eAC7C,KAAK,uBAA0BD,GAAsB,CACnD,KAAK,0BAA0BA,CAAS,EACxC,KAAK,2BAA2BA,CAAS,CAC3C,EACA,KAAK,SAAS,eAAiB,KAAK,sBACtC,CAEO,OAAc,CACnB,KAAK,aAAe,EACpB,KAAK,QAAQ,MAAM,EACnB,KAAK,oBAAoB,MAAM,EAC/B,KAAK,oBAAoB,MAAM,CACjC,CAEO,SAAgB,CACrB,KAAK,MAAM,EACP,KAAK,SAAS,iBAAmB,KAAK,yBACxC,KAAK,SAAS,eAAiB,KAAK,wBAExC,CAEO,WAAWE,EAAwBC,EAAgD,CACxF,IAAMC,EAAUF,GAAM,KAAK,eAErBG,EAAe,KAAK,oBAAoB,IAAID,CAAO,EACzD,OAAIC,IAAiB,SACnB,KAAK,SAAS,YAAYA,CAAY,EACtC,KAAK,oBAAoB,OAAOD,CAAO,EACvC,KAAK,oBAAoB,OAAOC,CAAY,GAG1C,CAAC,KAAK,QAAQ,IAAID,CAAO,GAAK,KAAK,QAAQ,MAAQN,EAAkB,kBACvE,KAAK,wBAAwB,EAG/B,KAAK,QAAQ,IAAIM,EAAS,CACxB,GAAGD,EACH,GAAIC,CACN,CAAC,EACMA,CACT,CAEO,SAASH,EAAiBK,EAAwCC,EAAoBC,EAAmBC,EAAsB,CAKpI,IAAMJ,EAAe,KAAK,oBAAoB,IAAIJ,CAAO,EACrDI,IAAiB,QACnB,KAAK,oBAAoB,OAAOA,CAAY,EAE9C,KAAK,cAAc,UAAYE,EAC/B,KAAK,cAAc,MAAQC,EAC3B,KAAK,cAAc,OAASC,EAC5B,IAAMT,EAAY,KAAK,SAAS,SAASM,EAAO,KAAK,aAAa,EAClE,KAAK,oBAAoB,IAAIL,EAASD,CAAS,EAC/C,KAAK,oBAAoB,IAAIA,EAAWC,CAAO,CACjD,CAEO,SAASA,EAA8C,CAC5D,OAAO,KAAK,QAAQ,IAAIA,CAAO,CACjC,CAEO,WAAWA,EAAuB,CACvC,KAAK,QAAQ,OAAOA,CAAO,EAC3B,IAAMD,EAAY,KAAK,oBAAoB,IAAIC,CAAO,EAClDD,IAAc,SAChB,KAAK,SAAS,YAAYA,CAAS,EACnC,KAAK,oBAAoB,OAAOC,CAAO,EACvC,KAAK,oBAAoB,OAAOD,CAAS,EAE7C,CAEO,WAAkB,CACvB,KAAK,QAAQ,MAAM,EACnB,QAAWA,KAAa,KAAK,oBAAoB,OAAO,EACtD,KAAK,SAAS,YAAYA,CAAS,EAErC,KAAK,oBAAoB,MAAM,EAC/B,KAAK,oBAAoB,MAAM,CACjC,CAEA,IAAW,QAA+C,CACxD,OAAO,KAAK,OACd,CAEA,IAAW,oBAAkD,CAC3D,OAAO,KAAK,mBACd,CAEA,IAAW,aAAsB,CAC/B,OAAO,KAAK,aAAe,CAC7B,CAEQ,yBAAgC,CACtC,OAAW,CAACC,CAAO,IAAK,KAAK,QAAS,CACpC,GAAI,KAAK,QAAQ,MAAQH,EAAkB,iBAAmB,EAC5D,MAEG,KAAK,oBAAoB,IAAIG,CAAO,GACvC,KAAK,QAAQ,OAAOA,CAAO,CAE/B,CACF,CACF,EAzIaH,EACa,iBAAmB,IADtC,IAAMY,GAANZ,ECVP,IAAAa,EAA8E,OAI9E,IAAAC,GAAsC,QAGtC,IAAMC,GAAkB,QAGlBC,GAAkB,mBACxBA,GAAgB,IAAI,qBAAmB,EAGhC,IAAMC,GAAN,KAAyD,CAK9D,YACmBC,EACAC,EACAC,EACjB,CAHiB,WAAAF,EACA,cAAAC,EACA,mBAAAC,EAPnB,KAAQ,MAAQ,EAChB,KAAQ,SAAW,MAQjB,iBAAa,CACX,YAAa,KAAK,MAAM,WAAa,EACrC,QAASJ,GACT,aAAc,KAAK,MAAM,iBAC3B,CAAC,EAAE,KAAKK,GAAK,KAAK,KAAOA,CAAC,CAC5B,CAEO,OAAc,CAOf,KAAK,OACP,KAAK,KAAK,QAAQ,EAEjB,KAAK,KAAa,SAAS,KAAK,CAAC,EAClC,KAAK,KAAK,KAAK,EAAGL,GAAiB,KAAK,MAAM,iBAAiB,EAEnE,CAEO,KAAKM,EAAuB,CAGjC,GAFA,KAAK,MAAQ,EACb,KAAK,SAAW,GACZ,KAAK,KAAM,CACb,IAAMC,EAAYD,EAAO,OAAO,CAAC,IAAM,EAAI,EAAIE,GAC7C,KAAK,cAAc,MAAM,cAAc,aACvC,KAAK,cAAc,MAAM,eAAe,MAAM,EAChD,KAAK,KAAK,KAAKD,EAAW,KAAM,KAAK,MAAM,iBAAiB,CAC9D,CACF,CAEO,IAAIE,EAAmBC,EAAeC,EAAmB,CAC9D,GAAI,OAAK,UAAY,CAAC,KAAK,MAI3B,IADA,KAAK,OAASA,EAAMD,EAChB,KAAK,MAAQ,KAAK,MAAM,eAAgB,CAC1C,QAAQ,KAAK,gCAAgC,EAC7C,KAAK,SAAW,GAChB,KAAK,KAAK,QAAQ,EAClB,MACF,CACA,GAAI,CACF,KAAK,KAAK,OAAOD,EAAMC,EAAOC,CAAG,CACnC,OAASC,EAAG,CACV,QAAQ,KAAK,uCAAuCA,CAAC,EAAE,EACvD,KAAK,SAAW,GAChB,KAAK,KAAK,QAAQ,CACpB,EACF,CAEO,OAAOC,EAA8C,CAC1D,GAAI,KAAK,UAAY,CAACA,GAAW,CAAC,KAAK,KACrC,MAAO,GAGT,IAAMC,EAAQ,KAAK,KAAK,MAClBC,EAAS,KAAK,KAAK,OAGzB,GAAI,CAACD,GAAS,CAACC,EACb,OAAIA,GACF,KAAK,SAAS,cAAcA,CAAM,EAE7B,GAGT,IAAMC,EAASC,EAAc,aAAa,OAAWH,EAAOC,CAAM,EAClE,OAAAC,EAAO,WAAW,IAAI,GAAG,aAAa,IAAI,UAAU,KAAK,KAAK,MAAyCF,EAAOC,CAAM,EAAG,EAAG,CAAC,EACvH,KAAK,KAAK,YAAchB,IAC1B,KAAK,KAAK,QAAQ,EAEpB,KAAK,SAAS,SAASiB,CAAM,EACtB,EACT,CACF,EASA,SAASR,GAAgBU,EAAqBC,EAAgD,CAC5F,IAAIC,EAAK,EACT,GAAI,CAACD,EAGH,OAAOC,EAET,GAAIF,EAAK,UAAU,EACjB,GAAIA,EAAK,YAAY,EACnBE,EAAKC,GAAUF,EAAO,WAAW,IAAI,UAC5BD,EAAK,QAAQ,EAAG,CACzB,IAAMI,EAAKJ,EAAK,YAAqC,WAAWA,EAAK,WAAW,CAAC,EACjFE,KAAK,cAAW,GAAGE,CAAC,CACtB,MACEF,EAAKC,GAAUF,EAAO,KAAKD,EAAK,WAAW,CAAC,EAAE,IAAI,UAGhDA,EAAK,YAAY,EACnBE,EAAKC,GAAUF,EAAO,WAAW,IAAI,UAC5BD,EAAK,QAAQ,EAAG,CACzB,IAAMI,EAAKJ,EAAK,YAAqC,WAAWA,EAAK,WAAW,CAAC,EACjFE,KAAK,cAAW,GAAGE,CAAC,CACtB,MACEF,EAAKC,GAAUF,EAAO,KAAKD,EAAK,WAAW,CAAC,EAAE,IAAI,EAGtD,OAAOE,CACT,CAGA,SAASC,GAAUE,EAAyB,CAC1C,OAAI,aAAmBA,GACfA,EAAQ,MAAS,IAAMA,IAAU,EAAI,MAAS,IAAMA,IAAU,GAAK,MAAS,EAAIA,IAAU,GAAK,GACzG,CCtIO,IAAMC,GAAN,KAAwB,CAE7B,YACmBC,EACAC,EACAC,EACAC,EACjB,CAJiB,cAAAH,EACA,WAAAC,EACA,eAAAC,EACA,eAAAC,EALnB,KAAQ,cAA+B,CAAE,UAAW,GAAM,MAAO,MAAO,OAAQ,EAAG,UAAW,OAAQ,CAMnG,CAMI,SAASC,EAA4C,CAC1D,KAAK,cAAc,UAAY,KAAK,MAAM,eAC1C,KAAK,SAAS,SAASA,EAAK,KAAK,aAAa,CAChD,CAOO,cAAcC,EAAsB,CACzC,GAAI,KAAK,MAAM,eAAgB,CAC7B,IAAIC,EAAW,KAAK,UAAU,UAC1BA,EAAS,QAAU,IAAMA,EAAS,SAAW,MAC/CA,EAAWC,GAEb,IAAMC,EAAO,KAAK,KAAKH,EAASC,EAAS,MAAM,EAC/C,QAASG,EAAI,EAAGA,EAAID,EAAM,EAAEC,EAC1B,KAAK,UAAU,MAAM,cAAc,SAAS,CAEhD,CACF,CACF,ECrCO,IAAMC,GAAN,KAAsB,CAE3B,YACmBC,EACjB,CADiB,cAAAA,EAFnB,KAAQ,cAA+B,CAAE,UAAW,GAAM,MAAO,MAAO,OAAQ,EAAG,UAAW,KAAM,CAGjG,CAMI,SAASC,EAA4C,CAC1D,KAAK,SAAS,SAASA,EAAK,KAAK,aAAa,CAChD,CACF,ECiCA,IAAMC,GAAsC,CAC1C,kBAAmB,GACnB,WAAY,SACZ,aAAc,GACd,eAAgB,GAChB,kBAAmB,KACnB,eAAgB,SAChB,aAAc,IACd,gBAAiB,GACjB,WAAY,GACZ,aAAc,SACd,aAAc,GACd,eAAgB,QAClB,EAGMC,GAAyB,KAsBxB,IAAMC,GAAN,KAAsD,CAW3D,YAAYC,EAAoC,CANhD,KAAQ,aAA8B,CAAC,EAEvC,KAAQ,UAAwC,IAAI,IACpD,KAAiB,cAAgB,IAAIC,EACrC,KAAgB,aAA6B,KAAK,cAAc,MAG9D,KAAK,MAAQ,OAAO,OAAO,CAAC,EAAGC,GAAiBF,CAAI,EACpD,KAAK,aAAe,OAAO,OAAO,CAAC,EAAGE,GAAiBF,CAAI,CAC7D,CAEO,SAAgB,CACrB,QAAWG,KAAO,KAAK,aACrBA,EAAI,QAAQ,EAEd,KAAK,aAAa,OAAS,EAC3B,KAAK,UAAU,MAAM,EACrB,KAAK,cAAc,QAAQ,CAC7B,CAEQ,iBAAiBC,EAA2B,CAClD,QAAWD,KAAOC,EAChB,KAAK,aAAa,KAAKD,CAAG,CAE9B,CAEO,SAASE,EAA8B,CAS5C,GARA,KAAK,UAAYA,EAGjB,KAAK,UAAY,IAAIC,EAAcD,CAAQ,EAC3C,KAAK,SAAW,IAAIE,EAAaF,EAAU,KAAK,UAAW,KAAK,KAAK,EACrE,KAAK,SAAS,aAAe,IAAM,KAAK,cAAc,KAAK,EAGvD,KAAK,MAAM,kBAAmB,CAChC,IAAMG,EAAYH,EAAS,QAAQ,eAAiB,CAAC,EACrDG,EAAU,iBAAmB,GAC7BA,EAAU,kBAAoB,GAC9BA,EAAU,gBAAkB,GAC5BH,EAAS,QAAQ,cAAgBG,CACnC,CAiCA,GA/BA,KAAK,cACH,KAAK,UACL,KAAK,SAGLH,EAAS,OAAO,mBAAmB,CAAE,OAAQ,IAAK,MAAO,GAAI,EAAGI,GAAU,KAAK,QAAQA,CAAM,CAAC,EAC9FJ,EAAS,OAAO,mBAAmB,CAAE,OAAQ,IAAK,MAAO,GAAI,EAAGI,GAAU,KAAK,QAAQA,CAAM,CAAC,EAC9FJ,EAAS,OAAO,mBAAmB,CAAE,MAAO,GAAI,EAAGI,GAAU,KAAK,KAAKA,CAAM,CAAC,EAC9EJ,EAAS,OAAO,mBAAmB,CAAE,OAAQ,IAAK,MAAO,GAAI,EAAGI,GAAU,KAAK,yBAAyBA,CAAM,CAAC,EAG/GJ,EAAS,SAASK,GAAS,KAAK,UAAU,OAAOA,CAAK,CAAC,EAQvDL,EAAS,OAAO,mBAAmB,CAAE,cAAe,IAAK,MAAO,GAAI,EAAG,IAAM,KAAK,MAAM,CAAC,EACzFA,EAAS,OAAO,mBAAmB,CAAE,MAAO,GAAI,EAAG,IAAM,KAAK,MAAM,CAAC,EACrEA,EAAS,MAAM,cAAc,eAAe,IAAM,KAAK,MAAM,CAAC,EAG9DA,EAAS,OAAO,eAAe,IAAM,KAAK,UAAU,cAAc,CAAC,EAGnEA,EAAS,SAASM,GAAW,KAAK,UAAU,eAAeA,CAAO,CAAC,CACrE,EAGI,KAAK,MAAM,aAAc,CAC3B,IAAMC,EAAe,IAAIC,GAAkB,KAAK,SAAW,KAAK,MAAO,KAAK,UAAYR,CAAQ,EAC1FS,EAAe,IAAIC,GAAa,KAAK,MAAOH,EAAcP,CAAQ,EACxE,KAAK,UAAU,IAAI,QAASS,CAAY,EACxC,KAAK,cACHT,EAAS,MAAM,cAAc,QAAQ,mBAAmB,CAAE,MAAO,GAAI,EAAGS,CAAY,CACtF,CACF,CAGA,GAAI,KAAK,MAAM,WAAY,CACzB,IAAME,EAAa,IAAIC,GAAgB,KAAK,QAAS,EAC/CC,EAAa,IAAIC,EAAW,KAAK,MAAO,KAAK,UAAYH,EAAYX,CAAQ,EACnF,KAAK,UAAU,IAAI,MAAOa,CAAU,EACpC,KAAK,cACHb,EAAS,MAAM,cAAc,QAAQ,mBAAmB,KAAMa,CAAU,CAC1E,CACF,CAGA,GAAI,KAAK,MAAM,aAAc,CAC3B,IAAME,EAAe,IAAIC,GAAkB,KAAK,QAAS,EACnDC,EAAe,IAAIC,GAAqB,KAAK,MAAO,KAAK,UAAYH,EAAcf,CAAQ,EACjG,KAAK,UAAU,IAAI,QAASiB,CAAY,EACxC,KAAK,cACHF,EACAE,EACAjB,EAAS,MAAM,cAAc,QAAQ,mBAAmB,CAAE,MAAO,GAAI,EAAGiB,CAAY,CACtF,CACF,CACF,CAGO,OAAiB,CAEtB,KAAK,MAAM,eAAiB,KAAK,aAAa,eAC9C,KAAK,MAAM,kBAAoB,KAAK,aAAa,kBAEjD,KAAK,UAAU,MAAM,EAErB,QAAWE,KAAW,KAAK,UAAU,OAAO,EAC1CA,EAAQ,MAAM,EAEhB,MAAO,EACT,CAEA,IAAW,cAAuB,CAChC,OAAO,KAAK,UAAU,SAAS,GAAK,EACtC,CAEA,IAAW,aAAaC,EAAe,CACrC,KAAK,UAAU,SAASA,CAAK,EAC7B,KAAK,MAAM,aAAeA,CAC5B,CAEA,IAAW,cAAuB,CAChC,OAAI,KAAK,SACA,KAAK,SAAS,SAAS,EAEzB,EACT,CAEA,IAAW,iBAA2B,CACpC,OAAO,KAAK,MAAM,eACpB,CAEA,IAAW,gBAAgBC,EAAgB,CACzC,KAAK,MAAM,gBAAkBA,EAC7B,KAAK,WAAW,gBAAgBA,CAAK,CACvC,CAEO,qBAAqBC,EAAWC,EAA0C,CAC/E,OAAO,KAAK,UAAU,qBAAqBD,EAAGC,CAAC,CACjD,CAEO,wBAAwBD,EAAWC,EAA0C,CAClF,OAAO,KAAK,UAAU,wBAAwBD,EAAGC,CAAC,CACpD,CAEQ,QAAQC,EAAiB,CAC/B,KAAK,WAAW,MAAM,MAAMA,EAAG,EAAK,CACtC,CAEQ,QAAQpB,EAAwC,CACtD,QAASqB,EAAI,EAAGA,EAAIrB,EAAO,OAAQ,EAAEqB,EAC3BrB,EAAOqB,CAAC,IACT,KACH,KAAK,MAAM,eAAiB,IAIlC,MAAO,EACT,CAEQ,QAAQrB,EAAwC,CACtD,QAASqB,EAAI,EAAGA,EAAIrB,EAAO,OAAQ,EAAEqB,EAC3BrB,EAAOqB,CAAC,IACT,KACH,KAAK,MAAM,eAAiB,IAIlC,MAAO,EACT,CAGQ,KAAKrB,EAAwC,CACnD,OAAIA,EAAO,CAAC,EACH,GAOL,KAAK,MAAM,cACb,KAAK,QAAQ,kBAAkB,EACxB,IAEF,EACT,CAYQ,yBAAyBA,EAAwC,CACvE,GAAIA,EAAO,OAAS,EAClB,MAAO,GAET,GAAIA,EAAO,CAAC,IAAM,EAChB,OAAQA,EAAO,CAAC,EAAG,CACjB,IAAK,GACH,YAAK,QAAQ,SAASA,EAAO,CAAC,CAAC,MAAwB,KAAK,MAAM,iBAAiB,GAAG,EAC/E,GACT,IAAK,GACH,KAAK,MAAM,kBAAoB,KAAK,aAAa,kBACjD,KAAK,QAAQ,SAASA,EAAO,CAAC,CAAC,MAAwB,KAAK,MAAM,iBAAiB,GAAG,EAEtF,QAAWe,KAAW,KAAK,UAAU,OAAO,EAC1CA,EAAQ,MAAM,EAEhB,MAAO,GACT,IAAK,GACH,OAAIf,EAAO,OAAS,GAAK,EAAEA,EAAO,CAAC,YAAa,QAAUA,EAAO,CAAC,GAAKsB,IACrE,KAAK,MAAM,kBAAoBtB,EAAO,CAAC,EACvC,KAAK,QAAQ,SAASA,EAAO,CAAC,CAAC,MAAwB,KAAK,MAAM,iBAAiB,GAAG,GAEtF,KAAK,QAAQ,SAASA,EAAO,CAAC,CAAC,KAA4B,EAEtD,GACT,IAAK,GACH,YAAK,QAAQ,SAASA,EAAO,CAAC,CAAC,MAAwBsB,EAAsB,GAAG,EACzE,GACT,QACE,YAAK,QAAQ,SAAStB,EAAO,CAAC,CAAC,KAA4B,EACpD,EACX,CAEF,GAAIA,EAAO,CAAC,IAAM,EAChB,OAAQA,EAAO,CAAC,EAAG,CAEjB,IAAK,GACH,IAAIuB,EAAQ,KAAK,WAAW,YAAY,IAAI,OAAO,MAC/CC,EAAS,KAAK,WAAW,YAAY,IAAI,OAAO,OACpD,GAAI,CAACD,GAAS,CAACC,EAAQ,CAGrB,IAAMC,EAAWC,EACjBH,GAAS,KAAK,WAAW,MAAQ,IAAME,EAAS,MAChDD,GAAU,KAAK,WAAW,MAAQ,IAAMC,EAAS,MACnD,CACA,GAAIF,EAAQC,EAAS,KAAK,MAAM,WAC9B,KAAK,QAAQ,SAASxB,EAAO,CAAC,CAAC,MAAwBuB,EAAM,QAAQ,CAAC,CAAC,IAAIC,EAAO,QAAQ,CAAC,CAAC,GAAG,MAC1F,CAEL,IAAMN,EAAI,KAAK,MAAM,KAAK,KAAK,KAAK,MAAM,UAAU,CAAC,EACrD,KAAK,QAAQ,SAASlB,EAAO,CAAC,CAAC,MAAwBkB,CAAC,IAAIA,CAAC,GAAG,CAClE,CACA,MAAO,GACT,IAAK,GAEH,IAAMA,EAAI,KAAK,MAAM,KAAK,KAAK,KAAK,MAAM,UAAU,CAAC,EACrD,YAAK,QAAQ,SAASlB,EAAO,CAAC,CAAC,MAAwBkB,CAAC,IAAIA,CAAC,GAAG,EACzD,GACT,QACE,YAAK,QAAQ,SAASlB,EAAO,CAAC,CAAC,KAA4B,EACpD,EACX,CAGF,YAAK,QAAQ,SAASA,EAAO,CAAC,CAAC,KAA0B,EAClD,EACT,CACF",
 -  "names": ["exports", "red", "n", "green", "blue", "alpha", "toRGBA8888", "g", "b", "a", "fromRGBA8888", "color", "nearestColorIndex", "palette", "r", "min", "idx", "i", "dr", "dg", "db", "d", "clamp", "low", "high", "value", "h2c", "t1", "t2", "c", "HLStoRGB", "h", "l", "s", "v", "normalizeRGB", "normalizeHLS", "p", "require_lib", "__commonJSMin", "exports", "InWasm", "z", "s", "b", "r", "def", "t", "d", "m", "W", "e", "require_Base64Decoder_wasm", "__commonJSMin", "exports", "inwasm_runtime_1", "wasmDecode", "MAP", "el", "D", "i", "EMPTY", "Base64Decoder", "keepSize", "maxBytes", "initialBytes", "m", "bytes", "requested", "needed", "newSize", "addPages", "data", "require_QoiDecoder_wasm", "__commonJSMin", "exports", "inwasm_runtime_1", "wasmQoiDecode", "QoiDecoder", "keepSize", "d", "pixels", "ib", "dl", "bytes", "chunkP", "exports", "Colors_1", "wasm_1", "decodeBase64", "s", "bytestring", "result", "WASM_BYTES", "WASM_MODULE", "NULL_CANVAS", "CallbackProxy", "width", "mode", "DEFAULT_OPTIONS", "DecoderAsync", "opts", "cbProxy", "importObj", "inst", "Decoder", "exports", "_instance", "_cbProxy", "module", "pixels", "offset", "additionalPixels", "newCanvas", "adv", "remaining", "c", "i", "fillColor", "palette", "paletteLimit", "truncate", "data", "start", "end", "p", "length", "j", "currentWidth", "escape", "final", "finalOffset", "bw", "currentHeight", "decode", "dec", "decodeAsync", "toDisposable", "fn", "DisposableStore", "o", "d", "Disposable", "MutableDisposable", "value", "Emitter", "listener", "thisArgs", "disposables", "toDisposable", "entry", "result", "idx", "event", "listeners", "len", "EventUtils", "forward", "from", "to", "e", "map", "i", "any", "events", "store", "DisposableStore", "runAndSubscribe", "handler", "initial", "import_Colors", "ImageRenderer", "_ImageRenderer", "Disposable", "_terminal", "MutableDisposable", "parent", "option", "toDisposable", "localDocument", "width", "height", "canvas", "ctx", "buffer", "imgData", "img", "value", "start", "end", "layer", "y", "w", "h", "imgSpec", "tileId", "col", "row", "count", "cols", "sx", "sy", "dx", "dy", "finalWidth", "finalHeight", "spec", "currentWidth", "currentHeight", "originalWidth", "originalHeight", "renderer", "key", "screenElement", "bWidth", "blueprint", "d32", "black", "white", "shift", "offset", "x", "ctx2", "i", "bitmap", "CELL_SIZE_DEFAULT", "ExtendedAttrsImage", "_ExtendedAttrsImage", "ext", "urlId", "imageId", "tileId", "value", "val", "EMPTY_ATTRS", "ImageStorage", "_terminal", "_renderer", "_opts", "e", "spec", "storedPixels", "id", "zero", "img", "opts", "cellSize", "cols", "rows", "buffer", "termCols", "termRows", "originX", "originY", "offset", "tileCount", "row", "line", "col", "endMarker", "imgSpec", "range", "hasTopImages", "hasBottomImages", "start", "end", "drawCalls", "placeholderCalls", "startTile", "startCol", "count", "a", "b", "call", "metrics", "oldCol", "tilesPerRow", "hasData", "rightCol", "lastTile", "expandCol", "x", "y", "orig", "canvas", "ImageRenderer", "room", "used", "current", "old", "oldSpec", "imgId", "import_Base64Decoder", "import_QoiDecoder", "toStr", "data", "s", "i", "toInt", "v", "toSize", "toName", "bs", "b", "DECODERS", "FILE_MARKER", "MULTIPARTFILE_MARKER", "FILEPART_MARKER", "FILEEND_MARKER", "REPORTCELLSIZE_MARKER", "MAX_FIELDCHARS", "HeaderParser", "k", "start", "end", "state", "pos", "buffer", "c", "UNSUPPORTED_TYPE", "imageType", "d", "d32", "width", "height", "jpgSize", "dim", "pos", "limit", "i", "len", "blockLength", "DEFAULT_HEADER", "IIPHandler", "_opts", "_renderer", "_storage", "_coreTerminal", "HeaderParser", "maxEncodedBytes", "initialBytes", "Base64Decoder", "QoiDecoder", "data", "start", "end", "dataPos", "success", "seqType", "w", "CELL_SIZE_DEFAULT", "h", "scale", "report", "cond", "metrics", "UNSUPPORTED_TYPE", "imageType", "blob", "canvas", "ImageRenderer", "bm", "e", "cw", "ch", "width", "height", "rw", "rh", "wf", "hf", "f", "s", "total", "cdim", "import_Base64Decoder", "parseKittyCommand", "data", "cmd", "parts", "part", "eqIdx", "key", "value", "numValue", "DECODER_OK", "KittyGraphicsHandler", "_opts", "_renderer", "_kittyStorage", "_coreTerminal", "key", "pending", "data", "start", "end", "controlEnd", "i", "copyLength", "parseKittyCommand", "payloadStart", "pendingKey", "previousEncodedSize", "decoderToRelease", "Base64Decoder", "success", "cmd", "isMoreComing", "decodeError", "finalCmd", "decoder", "imageBytes", "result", "str", "bytes", "id", "image", "quiet", "format", "width", "height", "bytesPerPixel", "expectedBytes", "message", "placementId", "isOk", "pPart", "response", "bitmap", "cropX", "cropY", "cropW", "cropH", "maxCropW", "maxCropH", "finalCropW", "finalCropH", "cropped", "cw", "CELL_SIZE_DEFAULT", "ch", "imgCols", "imgRows", "w", "h", "buffer", "savedX", "savedY", "savedYbase", "layer", "scaled", "xOffset", "yOffset", "canvasW", "canvasH", "offsetCanvas", "ImageRenderer", "offsetCtx", "offsetBitmap", "zIndex", "scrolled", "e", "blob", "url", "img", "resolve", "reject", "canvas", "pixelCount", "src32", "dst32", "alignedPixels", "srcOffset", "dstOffset", "b0", "b1", "b2", "srcByte", "dstByte", "compressed", "ds", "writer", "chunks", "reader", "done", "value", "totalLength", "sum", "chunk", "offset", "_KittyImageStorage", "_storage", "storageId", "kittyId", "id", "imageData", "imageId", "oldStorageId", "image", "scrolling", "layer", "zIndex", "KittyImageStorage", "import_Colors", "import_Decoder", "MEM_PERMA_LIMIT", "DEFAULT_PALETTE", "SixelHandler", "_opts", "_storage", "_coreTerminal", "d", "params", "fillColor", "extractActiveBg", "data", "start", "end", "e", "success", "width", "height", "canvas", "ImageRenderer", "attr", "colors", "bg", "convertLe", "t", "color", "SixelImageStorage", "_storage", "_opts", "_renderer", "_terminal", "img", "height", "cellSize", "CELL_SIZE_DEFAULT", "rows", "i", "IIPImageStorage", "_storage", "img", "DEFAULT_OPTIONS", "MAX_SIXEL_PALETTE_SIZE", "ImageAddon", "opts", "Emitter", "DEFAULT_OPTIONS", "obj", "args", "terminal", "ImageRenderer", "ImageStorage", "windowOps", "params", "range", "metrics", "sixelStorage", "SixelImageStorage", "sixelHandler", "SixelHandler", "iipStorage", "IIPImageStorage", "iipHandler", "IIPHandler", "kittyStorage", "KittyImageStorage", "kittyHandler", "KittyGraphicsHandler", "handler", "limit", "value", "x", "y", "s", "i", "MAX_SIXEL_PALETTE_SIZE", "width", "height", "cellSize", "CELL_SIZE_DEFAULT"]
-+  "sourcesContent": [null, "\"use strict\";\n/**\n * Copyright (c) 2022, 2026 Joerg Breitbart\n * @license MIT\n */\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.InWasm = InWasm;\nlet z = (s) => {\n    if (Uint8Array.fromBase64)\n        return Uint8Array.fromBase64(s);\n    if (typeof Buffer !== 'undefined')\n        return Buffer.from(s, 'base64');\n    const b = atob(s);\n    const r = new Uint8Array(b.length);\n    for (let i = 0; i < r.length; ++i)\n        r[i] = b.charCodeAt(i);\n    return r;\n};\nfunction InWasm(def) {\n    if (def.d) {\n        const { t, s, d } = def;\n        let b;\n        let m;\n        const W = WebAssembly;\n        if (t === 0 /* OutputType.INSTANCE */) {\n            if (s)\n                return (e) => new W.Instance(m || (m = new W.Module(b || (b = z(d)))), e);\n            return (e) => m\n                ? W.instantiate(m, e)\n                : W.instantiate(b || (b = z(d)), e).then(r => (m = r.module) && r.instance);\n        }\n        if (t === 1 /* OutputType.MODULE */) {\n            if (s)\n                return () => m || (m = new W.Module(b || (b = z(d))));\n            return () => m\n                ? Promise.resolve(m)\n                : W.compile(b || (b = z(d))).then(r => m = r);\n        }\n        if (s)\n            return () => b || (b = z(d));\n        return () => Promise.resolve(b || (b = z(d)));\n    }\n    if (typeof _wasmCtx === 'undefined')\n        throw new Error('must run \"inwasm\"');\n    _wasmCtx.add(def);\n}\n//# sourceMappingURL=index.js.map", "\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\n/**\n * Copyright (c) 2023, 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n */\nconst inwasm_runtime_1 = require(\"inwasm-runtime\");\n/**\n * wasm base64 decoder.\n */\nconst wasmDecode = (0, inwasm_runtime_1.InWasm)(/*inwasm#828e69684093b2c6:rdef-start:\"decode\"*/{s:1,t:0,d:'AGFzbQEAAAABBQFgAAF/Ag8BA2VudgZtZW1vcnkCAAEDAwIAAAcNAgNkZWMAAANlbmQAAQqLBgKZBAEKf0GIKCgCAEGgKGohAUGEKCgCACIDQaAoaiEAQYAoKAIAQQFrQXxxIgRBoChqIQUgBEEQayADSgRAIARBkChqIQMDQCABIABBA2otAABBAnQoAoAgIABBAmotAABBAnQoAoAYIABBAWotAABBAnQoAoAQIAAtAABBAnQoAoAIcnJyIgY2AgAgAUEDaiAAQQdqLQAAQQJ0KAKAICAAQQZqLQAAQQJ0KAKAGCAAQQVqLQAAQQJ0KAKAECAAQQRqLQAAQQJ0KAKACHJyciIHNgIAIAFBBmogAEELai0AAEECdCgCgCAgAEEKai0AAEECdCgCgBggAEEJai0AAEECdCgCgBAgAEEIai0AAEECdCgCgAhycnIiCDYCACABQQlqIABBD2otAABBAnQoAoAgIABBDmotAABBAnQoAoAYIABBDWotAABBAnQoAoAQIABBDGotAABBAnQoAoAIcnJyIgk2AgAgAiAGciAHciAIciAJciECIAFBDGohASAAQRBqIgAgA0kNAAsLIAAgBUkEQANAIAEgAEEDai0AAEECdCgCgCAgAEECai0AAEECdCgCgBggAEEBai0AAEECdCgCgBAgAC0AAEECdCgCgAhycnIiAzYCACACIANyIQIgAUEDaiEBIABBBGoiACAFSQ0ACwtBfyEAIAJB////B00Ef0GEKCAENgIAQYgoIAFBoChrNgIAQQAFQX8LC+0BAQR/AkBBgCgoAgAiAUGEKCgCACIAa0EFTgRAQX8hAxAADQFBgCgoAgAhAUGEKCgCACEAC0F/IQMgASAAayIBQQJIDQAgAC0AoShBAnQoAoAQIAAtAKAoQQJ0KAKACHIhAgJ/IAFBBEYEQEEDQQQgAC0AoyhBPUYbIAAtAKIoQT1GayEBC0EBIAFBA0kNABogAC0AoihBAnQoAoAYIAJyIQJBAiABQQRHDQAaIAAtAKMoQQJ0KAKAICACciECQQMLIQEgAkH///8HSw0AQQAhA0GIKCgCACIAIAI2AKAoQYgoIAAgAWo2AgALIAML'}/*inwasm#828e69684093b2c6:rdef-end:\"decode\"*/);\n// SIMD version (speedup ~1.4x, not covered by tests yet)\n/*\nconst wasmDecode = InWasm({\n  name: 'decode',\n  type: OutputType.INSTANCE,\n  mode: OutputMode.SYNC,\n  srctype: 'Clang-C',\n  imports: {\n    env: { memory: new WebAssembly.Memory({ initial: 1 }) }\n  },\n  exports: {\n    dec: () => 0,\n    end: () => 0\n  },\n  compile: {\n    switches: ['-msimd128', '-Wl,-z,stack-size=0', '-Wl,--stack-first']\n  },\n  code: `\n    #include <wasm_simd128.h>\n    typedef struct {\n      unsigned int wp;\n      unsigned int sp;\n      unsigned int dp;\n      unsigned int e_size;\n      unsigned int dummy[4];\n      unsigned char data[0];\n    } State;\n\n    unsigned int *D0 = (unsigned int *) ${P32.D0 * 4};\n    unsigned int *D1 = (unsigned int *) ${P32.D1 * 4};\n    unsigned int *D2 = (unsigned int *) ${P32.D2 * 4};\n    unsigned int *D3 = (unsigned int *) ${P32.D3 * 4};\n    State *state = (State *) ${P32.STATE * 4};\n\n    #define packed_byte(x) wasm_i8x16_splat((char) x)\n    #define packed_dword(x) wasm_i32x4_splat(x)\n    #define masked(x, mask) wasm_v128_and(x, wasm_i32x4_splat(mask))\n\n    __attribute__((noinline)) int dec() {\n      unsigned int nsp = (state->wp - 1) & ~3;\n      unsigned char *src = state->data + state->sp;\n      unsigned char *end = state->data + nsp;\n      unsigned char *dst = state->data + state->dp;\n      unsigned int error = 0;\n\n      v128_t err = wasm_i8x16_splat(0);\n      unsigned char *end16 = state->data + (nsp & ~15);\n      while (src < end16) {\n        v128_t data = wasm_v128_load((v128_t *) src);\n\n        // wasm-simd rewrite of http://0x80.pl/notesen/2016-01-17-sse-base64-decoding.html#vector-lookup-pshufb\n        const v128_t higher_nibble = wasm_u32x4_shr(data, 4) & packed_byte(0x0f);\n        const char linv = 1;\n        const char hinv = 0;\n\n        const v128_t lower_bound_LUT = wasm_i8x16_const(\n          // order: 0 1 2 3 4 5 6 7 8 9 a b c d e f\n          linv, linv, 0x2b, 0x30,\n          0x41, 0x50, 0x61, 0x70,\n          linv, linv, linv, linv,\n          linv, linv, linv, linv\n        );\n        const v128_t upper_bound_LUT = wasm_i8x16_const(\n          // order: 0 1 2 3 4 5 6 7 8 9 a b c d e f\n          hinv, hinv, 0x2b, 0x39,\n          0x4f, 0x5a, 0x6f, 0x7a,\n          hinv, hinv, hinv, hinv,\n          hinv, hinv, hinv, hinv\n        );\n        // the difference between the shift and lower bound\n        const v128_t shift_LUT = wasm_i8x16_const(\n          // order: 0 1 2 3 4 5 6 7 8 9 a b c d e f\n          0x00,        0x00,        0x3e - 0x2b, 0x34 - 0x30,\n          0x00 - 0x41, 0x0f - 0x50, 0x1a - 0x61, 0x29 - 0x70,\n          0x00,        0x00,        0x00,        0x00,\n          0x00,        0x00,        0x00,        0x00\n        );\n\n        const v128_t upper_bound = wasm_i8x16_swizzle(upper_bound_LUT, higher_nibble);\n        const v128_t lower_bound = wasm_i8x16_swizzle(lower_bound_LUT, higher_nibble);\n\n        const v128_t below = wasm_i8x16_lt(data, lower_bound);\n        const v128_t above = wasm_i8x16_gt(data, upper_bound);\n        const v128_t eq_2f = wasm_i8x16_eq(data, packed_byte(0x2f));\n\n        // in_range = not (below or above) or eq_2f\n        // outside  = not in_range = below or above and not eq_2f (from deMorgan law)\n        const v128_t outside = wasm_v128_andnot(eq_2f, above | below);\n        err = wasm_v128_or(err, outside);\n\n        const v128_t shift  = wasm_i8x16_swizzle(shift_LUT, higher_nibble);\n        const v128_t t0     = wasm_i8x16_add(data, shift);\n        v128_t v = wasm_i8x16_add(t0, wasm_v128_and(eq_2f, packed_byte(-3)));\n\n        // pack bytes\n        const v128_t ca = masked(v, 0x003f003f);\n        const v128_t db = masked(v, 0x3f003f00);\n        const v128_t t00 = wasm_v128_or(wasm_u32x4_shr(db, 8), wasm_i32x4_shl(ca, 6));\n        v128_t res = wasm_v128_or(wasm_u32x4_shr(t00, 16), wasm_i32x4_shl(t00, 12));\n        res = wasm_i8x16_swizzle(res, wasm_i8x16_const(2, 1, 0, 6, 5, 4, 10, 9, 8, 14, 13, 12, 16, 16, 16, 16));\n\n        wasm_v128_store((v128_t *) dst, res);\n        dst += 12;\n        src += 16;\n      }\n      //if (wasm_i8x16_bitmask(err) != 0) return -1;\n      if (wasm_v128_any_true(err)) return -1;\n\n      // operate on 4-byte blocks\n      while (src < end) {\n        error |= *((unsigned int *) dst) = D0[src[0]] | D1[src[1]] | D2[src[2]] | D3[src[3]];\n        dst += 3;\n        src += 4;\n      }\n      if (error >> 24) return -1;\n      state->sp = nsp;\n      state->dp = dst - state->data;\n      return 0;\n    }\n\n    int end() {\n      int rem = state->wp - state->sp;\n      if (rem > 4 && dec()) return -1;\n      rem = state->wp - state->sp;\n      if (rem < 2) return -1;\n\n      unsigned char *src = state->data + state->sp;\n      if (rem == 4) {\n        if (src[3] == 61) rem--;\n        if (src[2] == 61) rem--;\n      }\n      unsigned int accu = D0[src[0]] | D1[src[1]];\n      int dp = 1;\n      if (rem > 2) {\n        accu |= D2[src[2]];\n        dp++;\n        if (rem == 4) {\n          accu |= D3[src[3]];\n          dp++;\n        }\n      }\n      if (accu >> 24) return -1;\n      *((unsigned int *) (state->data + state->dp)) = accu;\n      state->dp += dp;\n      return 0;\n    }\n    `\n});\n*/\n// base64 map\nconst MAP = new Uint8Array('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'\n    .split('')\n    .map(el => el.charCodeAt(0)));\n// init decoder maps in LE order\nconst D = new Uint32Array(1024);\nD.fill(0xFF000000);\nfor (let i = 0; i < MAP.length; ++i)\n    D[MAP[i]] = i << 2;\nfor (let i = 0; i < MAP.length; ++i)\n    D[256 + MAP[i]] = i >> 4 | ((i << 4) & 0xFF) << 8;\nfor (let i = 0; i < MAP.length; ++i)\n    D[512 + MAP[i]] = (i >> 2) << 8 | ((i << 6) & 0xFF) << 16;\nfor (let i = 0; i < MAP.length; ++i)\n    D[768 + MAP[i]] = i << 16;\nconst EMPTY = new Uint8Array(0);\n/**\n * base64 stream decoder.\n *\n * Features / assumptions:\n * - lazy chunkwise decoding\n * - errors out on any non base64 chars (no support for NL formatted base64)\n * - decodes in wasm\n * - inplace decoding to save memory\n * - supports a keepSize for lazy memory release\n */\nclass Base64Decoder {\n    /**\n     * @param keepSize Keep the wasm instance below this limit when calling `release()`.\n     * @param maxBytes Max allowed bytes to allocate.\n     * @param initialBytes Initial bytes to allocate.\n     */\n    constructor(keepSize, maxBytes, initialBytes) {\n        this._inst = null;\n        this._ended = true;\n        this._bytes = 0;\n        this.keepSize = keepSize !== null && keepSize !== void 0 ? keepSize : 1048576 /* Bytes.KEEP */;\n        this.maxBytes = maxBytes !== null && maxBytes !== void 0 ? maxBytes : 4294901760 /* Bytes.MAX */;\n        this._bytes = initialBytes !== null && initialBytes !== void 0 ? initialBytes : 32768 /* Bytes.INITIAL */;\n        if (this._bytes > this.maxBytes || this.maxBytes > 4294901760 /* Bytes.MAX */) {\n            throw new Error('invalid byte settings');\n        }\n    }\n    /**\n     * Currently decoded bytes (borrowed).\n     * Must be accessed before calling `release` or `init`.\n     */\n    get data8() {\n        return this._inst ? this._d.subarray(0, this._m32[1282 /* P32.STATE_DP */]) : EMPTY;\n    }\n    /**\n     * Release memory conditionally based on `keepSize`.\n     * If memory gets released, also the wasm instance will be freed and recreated on next `init`,\n     * otherwise the instance will be reused.\n     */\n    release() {\n        if (!this._inst)\n            return;\n        if (this._bytes > this.keepSize) {\n            this._inst = this._m32 = this._d = this._mem = null;\n        }\n        else {\n            this._m32[1280 /* P32.STATE_WP */] = 0;\n            this._m32[1281 /* P32.STATE_SP */] = 0;\n            this._m32[1282 /* P32.STATE_DP */] = 0;\n        }\n    }\n    /**\n     * Initializes the decoder for new base64 data.\n     * Must be called before doing any decoding attempts.\n     * The method will either spawn a new wasm instance or grow\n     * the needed memory of an existing instance.\n     * @param maxBytes Max allowed bytes to allocate (overwrites ctor value).\n     * @param initialBytes Initial bytes to allocate (overwrites ctor value).\n     */\n    init(maxBytes, initialBytes) {\n        this.maxBytes = maxBytes !== null && maxBytes !== void 0 ? maxBytes : this.maxBytes;\n        this._bytes = initialBytes !== null && initialBytes !== void 0 ? initialBytes : Math.min(this._bytes, this.maxBytes);\n        if (this._bytes > this.maxBytes || this.maxBytes > 4294901760 /* Bytes.MAX */) {\n            throw Error('invalid byte settings');\n        }\n        let m = this._m32;\n        const bytes = this._bytes + 5152 /* Bytes._DATA_OFFSET */;\n        if (!this._inst) {\n            this._mem = new WebAssembly.Memory({ initial: Math.ceil(bytes / 65536) });\n            this._inst = wasmDecode({ env: { memory: this._mem } });\n            m = new Uint32Array(this._mem.buffer, 0);\n            m.set(D, 256 /* P32.D0 */);\n            this._d = new Uint8Array(this._mem.buffer, 5152 /* Bytes._DATA_OFFSET */);\n        }\n        else if (this._mem.buffer.byteLength < bytes) {\n            this._mem.grow(Math.ceil((bytes - this._mem.buffer.byteLength) / 65536));\n            m = new Uint32Array(this._mem.buffer, 0);\n            this._d = new Uint8Array(this._mem.buffer, 5152 /* Bytes._DATA_OFFSET */);\n        }\n        m[1280 /* P32.STATE_WP */] = 0;\n        m[1281 /* P32.STATE_SP */] = 0;\n        m[1282 /* P32.STATE_DP */] = 0;\n        this._m32 = m;\n        this._ended = false;\n    }\n    /**\n     * Realloc memory. Realloc only happens, if the requested\n     * size doesn't fit in the current memory.\n     * The new size will be capped by `maxBytes`.\n     * @param requested Bytes to be stored.\n     */\n    _realloc(requested) {\n        const needed = this._m32[1280 /* P32.STATE_WP */] + requested;\n        if (this._bytes < needed) {\n            if (needed > this.maxBytes) {\n                return -3 /* DecodeStatus.SIZE_EXCEEDED */;\n            }\n            let newSize = this._bytes;\n            while ((newSize *= 2) < needed) { }\n            newSize = Math.min(newSize, this.maxBytes);\n            if (newSize < needed) {\n                return -3 /* DecodeStatus.SIZE_EXCEEDED */;\n            }\n            if (newSize + 5152 /* Bytes._DATA_OFFSET */ > this._mem.buffer.byteLength) {\n                const addPages = Math.ceil((newSize + 5152 /* Bytes._DATA_OFFSET */ - this._mem.buffer.byteLength) / 65536);\n                this._mem.grow(addPages);\n                this._m32 = new Uint32Array(this._mem.buffer, 0);\n                this._d = new Uint8Array(this._mem.buffer, 5152 /* Bytes._DATA_OFFSET */);\n            }\n            this._bytes = newSize;\n        }\n        return 0 /* DecodeStatus.OK */;\n    }\n    /**\n     * Put bytes in `data` into the decoder.\n     * Additionally decodes the payload, if it reached 2^17 bytes.\n     * The return value indicates the type of issue.\n     * @param data Bytes to be loaded.\n     */\n    put(data) {\n        if (!this._inst || this._ended) {\n            return -2 /* DecodeStatus.NOT_INITIALIZED */;\n        }\n        if (this._realloc(data.length)) {\n            return -3 /* DecodeStatus.SIZE_EXCEEDED */;\n        }\n        const m = this._m32;\n        this._d.set(data, m[1280 /* P32.STATE_WP */]);\n        m[1280 /* P32.STATE_WP */] += data.length;\n        // max chunk in input handler is 2^17, try to run in \"tandem mode\"\n        return m[1280 /* P32.STATE_WP */] - m[1281 /* P32.STATE_SP */] >= 131072\n            ? this._inst.exports.dec()\n            : 0 /* DecodeStatus.OK */;\n    }\n    /**\n     * End the current decoding.\n     * Also decodes leftover payload from previous put calls.\n     */\n    end() {\n        this._ended = true;\n        return this._inst\n            ? this._inst.exports.end()\n            : -2 /* DecodeStatus.NOT_INITIALIZED */;\n    }\n    /**\n     * Bytes loaded into the decoder.\n     */\n    get loadedBytes() {\n        return this._inst\n            ? this._m32[1280 /* P32.STATE_WP */]\n            : 0;\n    }\n    /**\n     * Free bytes to feed to the decoder.\n     */\n    get freeBytes() {\n        return this._inst\n            ? this.maxBytes - this._m32[1280 /* P32.STATE_WP */]\n            : 0;\n    }\n}\nexports.default = Base64Decoder;\n//# sourceMappingURL=Base64Decoder.wasm.js.map", "\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\n/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\nconst inwasm_runtime_1 = require(\"inwasm-runtime\");\nconst wasmQoiDecode = (0, inwasm_runtime_1.InWasm)(/*inwasm#459f9e1bfb80b1a8:rdef-start:\"qoi_decode\"*/{s:1,t:0,d:'AGFzbQEAAAABCgJgAABgA39/fwACDwEDZW52Bm1lbW9yeQIAAQMDAgABBwcBA2RlYwABCAEACu4EAgwAQQBBAEGAAvwLAAveBAEJf0EAQQBBgAL8CwAgAUEXTgRAIAAgAWpBCGshCkGACCEBIAJBAnRBgAhqIQsgAEEOaiEDQf8BIQZBACECA0AgA0EBaiEHIAMtAAAiCEE/cSEAAkACQCAIQcABcSIJRQRAIABBAnQiAC0AAyEGIAAtAAIhBCAALQABIQUgAC0AACECIAchAwwBCwJAIAhB/QFLDQAgCUHAAUcNACAFQQVsIAJBA2xqIARBB2xqIAZBC2xqQT9xQQJ0IgMgBDoAAiADIAU6AAEgAyACOgAAIANBA2ogBjoAAANAIAEgAjoAACABQQNqIAY6AAAgAUECaiAEOgAAIAFBAWogBToAACABQQRqIQEgAEUEQCAHIQMMBAsgAEEBayEAIAEgC0kNAAsgByEDDAILAn8CQAJAAkAgCEH+AWsOAgABAgsgAy0AAyEEIAMtAAIhBSADLQABIQIgA0EEagwCCyADKAIBIgJBGHYhBiACQRB2IQQgAkEIdiEFIANBBWoMAQsgCUGAAUcEQCAHIAlBwABHDQEaIAQgCEEDcWpBAmshBCACIABBBHZqQQJrIQIgBSAIQQJ2QQNxakECayEFIAcMAQsgBCAAQShrIgkgAy0AASIHQQ9xamohBCACIAdBBHYgCWpqIQIgACAFakEgayEFIANBAmoLIQMgBUEFbCACQQNsaiAEQQdsaiAGQQtsakE/cUECdCIAIAQ6AAIgACAFOgABIAAgAjoAACAAQQNqIAY6AAALIAEgBjoAAyABIAQ6AAIgASAFOgABIAEgAjoAACABQQRqIQELIAMgCkkNAAsLCw=='}/*inwasm#459f9e1bfb80b1a8:rdef-end:\"qoi_decode\"*/);\nclass QoiDecoder {\n    constructor(keepSize) {\n        this.keepSize = keepSize;\n        this.width = 0;\n        this.height = 0;\n    }\n    decode(d) {\n        this.width = d[4] << 24 | d[5] << 16 | d[6] << 8 | d[7];\n        this.height = d[8] << 24 | d[9] << 16 | d[10] << 8 | d[11];\n        const pixels = this.width * this.height;\n        const ib = pixels * 4;\n        const dl = d.length;\n        /**\n         * byte/offset calculation:\n         * To save some memory we dont reserve full memory for decoded + encoded,\n         * but place encoded at the end of decoded plus 50% security distance\n         * to avoid reads before writes positions:\n         *\n         * encoded < decoded (good compression)\n         *    enc                                              ####################\n         *    dec                 #######################################\n         *                        ^                            ^\n         *                        DST_P                        CHUNK_P\n         *\n         * encoded > decoded (degenerated compression, should not happen)\n         *    enc                           ##############################\n         *    dec                 ####################\n         *                        ^         ^\n         *                        DST_P     CHUNK_P\n         *\n         * There is still a chance for overlapping r/w positions in case the compressed\n         * data has very different pixel progression, yet the 50% security distance\n         * should deal with that, as QOI will bloat data by 25% at max (RGB -> OP byte + RGB).\n         * Since we always assume RGBA at decoding stage, the possible bloat reduces to 20% at max.\n         */\n        const bytes = Math.max(ib, dl) + (Math.min(ib, dl) >> 1) + 4096;\n        if (!this._inst) {\n            this._mem = new WebAssembly.Memory({ initial: Math.ceil(bytes / 65536) });\n            this._inst = wasmQoiDecode({ env: { memory: this._mem } });\n        }\n        else if (this._mem.buffer.byteLength < bytes) {\n            this._mem.grow(Math.ceil((bytes - this._mem.buffer.byteLength) / 65536));\n            this._d = null;\n        }\n        if (!this._d) {\n            this._d = new Uint8Array(this._mem.buffer);\n        }\n        // put src data at the end of memory, also align to 256\n        const chunkP = (this._mem.buffer.byteLength - dl) & ~0xFF;\n        this._d.set(d, chunkP);\n        this._inst.exports.dec(chunkP, dl, pixels);\n        return this._d.subarray(1024 /* P8.DST_P */, 1024 /* P8.DST_P */ + ib);\n    }\n    release() {\n        if (!this._inst)\n            return;\n        if (this._mem.buffer.byteLength > this.keepSize) {\n            this._inst = this._d = this._mem = null;\n        }\n    }\n}\nexports.default = QoiDecoder;\n//# sourceMappingURL=QoiDecoder.wasm.js.map", null, null, "/**\n * Copyright (c) 2024-2026 The xterm.js authors. All rights reserved.\n * @license MIT\n *\n * Minimal lifecycle utilities for xterm.js core.\n * Simplified from VS Code's lifecycle.ts - no tracking/leak detection.\n */\n\nexport interface IDisposable {\n  dispose(): void;\n}\n\nexport function toDisposable(fn: () => void): IDisposable {\n  return { dispose: fn };\n}\n\nexport function dispose<T extends IDisposable>(disposable: T): T;\nexport function dispose<T extends IDisposable>(disposable: T | undefined): T | undefined;\nexport function dispose<T extends IDisposable>(disposables: T[]): T[];\nexport function dispose<T extends IDisposable>(arg: T | T[] | undefined): T | T[] | undefined {\n  if (!arg) {\n    return arg;\n  }\n  if (Array.isArray(arg)) {\n    for (const d of arg) {\n      d.dispose();\n    }\n    return [];\n  }\n  arg.dispose();\n  return arg;\n}\n\nexport function combinedDisposable(...disposables: IDisposable[]): IDisposable {\n  return toDisposable(() => dispose(disposables));\n}\n\nexport class DisposableStore implements IDisposable {\n  private readonly _disposables = new Set<IDisposable>();\n  private _isDisposed = false;\n\n  public get isDisposed(): boolean {\n    return this._isDisposed;\n  }\n\n  public add<T extends IDisposable>(o: T): T {\n    if (this._isDisposed) {\n      o.dispose();\n    } else {\n      this._disposables.add(o);\n    }\n    return o;\n  }\n\n  public dispose(): void {\n    if (this._isDisposed) {\n      return;\n    }\n    this._isDisposed = true;\n    for (const d of this._disposables) {\n      d.dispose();\n    }\n    this._disposables.clear();\n  }\n\n  public clear(): void {\n    for (const d of this._disposables) {\n      d.dispose();\n    }\n    this._disposables.clear();\n  }\n}\n\nexport abstract class Disposable implements IDisposable {\n  public static readonly None: IDisposable = Object.freeze({ dispose() { } });\n\n  protected readonly _store = new DisposableStore();\n\n  public dispose(): void {\n    this._store.dispose();\n  }\n\n  protected _register<T extends IDisposable>(o: T): T {\n    return this._store.add(o);\n  }\n}\n\nexport class MutableDisposable<T extends IDisposable> implements IDisposable {\n  private _value: T | undefined;\n  private _isDisposed = false;\n\n  public get value(): T | undefined {\n    return this._isDisposed ? undefined : this._value;\n  }\n\n  public set value(value: T | undefined) {\n    if (this._isDisposed || value === this._value) {\n      return;\n    }\n    this._value?.dispose();\n    this._value = value;\n  }\n\n  public clear(): void {\n    this.value = undefined;\n  }\n\n  public dispose(): void {\n    this._isDisposed = true;\n    this._value?.dispose();\n    this._value = undefined;\n  }\n}\n", "/**\n * Copyright (c) 2024-2026 The xterm.js authors. All rights reserved.\n * @license MIT\n *\n * Minimal event utilities for xterm.js core.\n * Simplified from VS Code's event.ts - no leak detection/profiling.\n */\n\nimport { IDisposable, DisposableStore, toDisposable } from './Lifecycle';\n\nexport interface IEvent<T> {\n  (listener: (e: T) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore): IDisposable;\n}\n\nexport class Emitter<T> {\n  private _listeners: { fn: (e: T) => any, thisArgs: any }[] = [];\n  private _disposed = false;\n  private _event: IEvent<T> | undefined;\n\n  public get event(): IEvent<T> {\n    if (this._event) {\n      return this._event;\n    }\n    this._event = (listener: (e: T) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore) => {\n      if (this._disposed) {\n        return toDisposable(() => {});\n      }\n\n      const entry = { fn: listener, thisArgs };\n      this._listeners = this._listeners.slice();\n      this._listeners.push(entry);\n\n      const result = toDisposable(() => {\n        const idx = this._listeners.indexOf(entry);\n        if (idx !== -1) {\n          this._listeners = this._listeners.slice();\n          this._listeners.splice(idx, 1);\n        }\n      });\n\n      if (disposables) {\n        if (Array.isArray(disposables)) {\n          disposables.push(result);\n        } else {\n          disposables.add(result);\n        }\n      }\n\n      return result;\n    };\n    return this._event;\n  }\n\n  public fire(event: T): void {\n    if (this._disposed || !this._listeners.length) {\n      return;\n    }\n    if (this._listeners.length === 1) {\n      this._listeners[0].fn.call(this._listeners[0].thisArgs, event);\n      return;\n    }\n    const listeners = this._listeners;\n    for (let i = 0, len = listeners.length; i < len; ++i) {\n      listeners[i].fn.call(listeners[i].thisArgs, event);\n    }\n  }\n\n  public dispose(): void {\n    if (this._disposed) {\n      return;\n    }\n    this._disposed = true;\n    this._listeners.length = 0;\n  }\n}\n\nexport namespace EventUtils {\n  export function forward<T>(from: IEvent<T>, to: Emitter<T>): IDisposable {\n    return from(e => to.fire(e));\n  }\n\n  export function map<I, O>(event: IEvent<I>, map: (i: I) => O): IEvent<O> {\n    return (listener: (e: O) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore) => {\n      return event(i => listener.call(thisArgs, map(i)), undefined, disposables);\n    };\n  }\n\n  export function any<T>(...events: IEvent<T>[]): IEvent<T>;\n  export function any(...events: IEvent<any>[]): IEvent<void>;\n  export function any<T>(...events: IEvent<T>[]): IEvent<T> {\n    return (listener: (e: T) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore) => {\n      const store = new DisposableStore();\n      for (const event of events) {\n        store.add(event(e => listener.call(thisArgs, e)));\n      }\n      if (disposables) {\n        if (Array.isArray(disposables)) {\n          disposables.push(store);\n        } else {\n          disposables.add(store);\n        }\n      }\n      return store;\n    };\n  }\n\n  export function runAndSubscribe<T>(event: IEvent<T>, handler: (e: T) => void, initial: T): IDisposable;\n  export function runAndSubscribe<T>(event: IEvent<T>, handler: (e: T | undefined) => void): IDisposable;\n  export function runAndSubscribe<T>(event: IEvent<T>, handler: (e: T | undefined) => void, initial?: T): IDisposable {\n    handler(initial);\n    return event(e => handler(e));\n  }\n}\n", "/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { toRGBA8888 } from 'sixel/lib/Colors';\nimport { IDisposable } from '@xterm/xterm';\nimport { ICellSize, ImageLayer, ITerminalExt, IImageSpec, IRenderDimensions, IRenderService } from './Types';\nimport { Disposable, MutableDisposable, toDisposable } from 'common/Lifecycle';\n\nconst enum Constants {\n  PLACEHOLDER_LENGTH = 4096,\n  PLACEHOLDER_HEIGHT = 24\n}\n\n/**\n * ImageRenderer - terminal frontend extension:\n * - provide primitives for canvas, ImageData, Bitmap (static)\n * - add canvas layer to DOM (browser only for now)\n * - draw image tiles onRender\n */\nexport class ImageRenderer extends Disposable implements IDisposable {\n  /** @deprecated Kept for backward compat \u2014 points to top layer canvas. */\n  public get canvas(): HTMLCanvasElement | undefined { return this._layers.get('top')?.canvas; }\n  private _layers = new Map<ImageLayer, CanvasRenderingContext2D>();\n  private _placeholder: HTMLCanvasElement | undefined;\n  private _placeholderBitmap: ImageBitmap | undefined;\n  private _optionsRefresh = this._register(new MutableDisposable());\n  private _oldOpen: ((parent: HTMLElement) => void) | undefined;\n  private _renderService: IRenderService | undefined;\n  private _oldSetRenderer: ((renderer: any) => void) | undefined;\n\n  // drawing primitive - canvas\n  public static createCanvas(localDocument: Document | undefined, width: number, height: number): HTMLCanvasElement {\n    /**\n     * NOTE: We normally dont care, from which document the canvas\n     * gets created, so we can fall back to global document,\n     * if the terminal has no document associated yet.\n     * This way early image loads before calling .open keep working\n     * (still discouraged though, as the metrics will be screwed up).\n     * Only the DOM output canvas should be on the terminal's document,\n     * which gets explicitly checked in `insertLayerToDom`.\n     */\n    const canvas = (localDocument ?? document).createElement('canvas');\n    canvas.width = width | 0;\n    canvas.height = height | 0;\n    return canvas;\n  }\n\n  // drawing primitive - ImageData with optional buffer\n  public static createImageData(ctx: CanvasRenderingContext2D, width: number, height: number, buffer?: ArrayBuffer): ImageData {\n    if (typeof ImageData !== 'function') {\n      const imgData = ctx.createImageData(width, height);\n      if (buffer) {\n        imgData.data.set(new Uint8ClampedArray(buffer, 0, width * height * 4));\n      }\n      return imgData;\n    }\n    return buffer\n      ? new ImageData(new Uint8ClampedArray(buffer, 0, width * height * 4), width, height)\n      : new ImageData(width, height);\n  }\n\n  // drawing primitive - ImageBitmap\n  public static createImageBitmap(img: ImageBitmapSource): Promise<ImageBitmap | undefined> {\n    if (typeof createImageBitmap !== 'function') {\n      return Promise.resolve(undefined);\n    }\n    return createImageBitmap(img);\n  }\n\n\n  constructor(private _terminal: ITerminalExt) {\n    super();\n    this._oldOpen = this._terminal._core.open;\n    this._terminal._core.open = (parent: HTMLElement): void => {\n      this._oldOpen?.call(this._terminal._core, parent);\n      this._open();\n    };\n    if (this._terminal._core.screenElement) {\n      this._open();\n    }\n    // hack to spot fontSize changes\n    this._optionsRefresh.value = this._terminal._core.optionsService.onOptionChange(option => {\n      if (option === 'fontSize') {\n        this.rescaleCanvas();\n        this._renderService?.refreshRows(0, this._terminal.rows);\n      }\n    });\n    this._register(toDisposable(() => {\n      this.removeLayerFromDom();\n      this.removeLayerFromDom('bottom');\n      if (this._terminal._core && this._oldOpen) {\n        this._terminal._core.open = this._oldOpen;\n        this._oldOpen = undefined;\n      }\n      if (this._renderService && this._oldSetRenderer) {\n        this._renderService.setRenderer = this._oldSetRenderer;\n        this._oldSetRenderer = undefined;\n      }\n      this._renderService = undefined;\n      this._layers.clear();\n      this._placeholderBitmap?.close();\n      this._placeholderBitmap = undefined;\n      this._placeholder = undefined;\n    }));\n  }\n\n  /**\n   * Enable the placeholder.\n   */\n  public showPlaceholder(value: boolean): void {\n    if (value) {\n      if (!this._placeholder && this.cellSize.height !== -1) {\n        this._createPlaceHolder(Math.max(this.cellSize.height + 1, Constants.PLACEHOLDER_HEIGHT));\n      }\n    } else {\n      this._placeholderBitmap?.close();\n      this._placeholderBitmap = undefined;\n      this._placeholder = undefined;\n    }\n    this._renderService?.refreshRows(0, this._terminal.rows);\n  }\n\n  /**\n   * Dimensions of the terminal.\n   * Forwarded from internal render service.\n   */\n  public get dimensions(): IRenderDimensions | undefined {\n    return this._terminal.dimensions;\n  }\n\n  /**\n   * Current cell size (float).\n   */\n  public get cellSize(): ICellSize {\n    return {\n      width: this.dimensions?.css.cell.width || -1,\n      height: this.dimensions?.css.cell.height || -1\n    };\n  }\n\n  /**\n   * Clear a region of the image layer canvas.\n   */\n  public clearLines(start: number, end: number, layer?: ImageLayer): void {\n    const y = start * (this.dimensions?.css.cell.height || 0);\n    const w = this.dimensions?.css.canvas.width || 0;\n    const h = (end + 1 - start) * (this.dimensions?.css.cell.height || 0);\n    if (!layer || layer === 'top') {\n      this._layers.get('top')?.clearRect(0, y, w, h);\n    }\n    if (!layer || layer === 'bottom') {\n      this._layers.get('bottom')?.clearRect(0, y, w, h);\n    }\n  }\n\n  /**\n   * Clear whole image canvas.\n   */\n  public clearAll(layer?: ImageLayer): void {\n    if (!layer || layer === 'top') {\n      const ctx = this._layers.get('top');\n      ctx?.clearRect(0, 0, ctx.canvas.width, ctx.canvas.height);\n    }\n    if (!layer || layer === 'bottom') {\n      const ctx = this._layers.get('bottom');\n      ctx?.clearRect(0, 0, ctx.canvas.width, ctx.canvas.height);\n    }\n  }\n\n  /**\n   * Draw neighboring tiles on the image layer canvas.\n   */\n  public draw(imgSpec: IImageSpec, tileId: number, col: number, row: number, count: number = 1): void {\n    const ctx = this._layers.get(imgSpec.layer);\n    if (!ctx) {\n      return;\n    }\n    const { width, height } = this.cellSize;\n\n    // Don't try to draw anything, if we cannot get valid renderer metrics.\n    if (width === -1 || height === -1) {\n      return;\n    }\n\n    this._rescaleImage(imgSpec, width, height);\n    const img = imgSpec.actual!;\n    const { width: sourceWidth, height: sourceHeight } = imgSpec.actualCellSize;\n    const cols = Math.ceil(img.width / sourceWidth);\n\n    const sx = (tileId % cols) * sourceWidth;\n    const sy = Math.floor(tileId / cols) * sourceHeight;\n    const dx = col * width;\n    const dy = row * height;\n\n    // safari bug: never access image source out of bounds\n    const finalWidth = count * sourceWidth + sx > img.width ? img.width - sx : count * sourceWidth;\n    const finalHeight = sy + sourceHeight > img.height ? img.height - sy : sourceHeight;\n\n    // Floor all pixel offsets to get stable tile mapping without any overflows.\n    // Note: For not pixel perfect aligned cells like in the DOM renderer\n    // this will move a tile slightly to the top/left (subpixel range, thus ignore it).\n    // FIX #34: avoid striping on displays with pixelDeviceRatio != 1 by ceiling height and width\n    ctx.drawImage(\n      img,\n      Math.floor(sx), Math.floor(sy), Math.ceil(finalWidth), Math.ceil(finalHeight),\n      Math.floor(dx), Math.floor(dy), Math.ceil(finalWidth * width / sourceWidth), Math.ceil(finalHeight * height / sourceHeight)\n    );\n  }\n\n  /**\n   * Extract a single tile from an image.\n   */\n  public extractTile(imgSpec: IImageSpec, tileId: number): HTMLCanvasElement | undefined {\n    const { width, height } = this.cellSize;\n    // Don't try to draw anything, if we cannot get valid renderer metrics.\n    if (width === -1 || height === -1) {\n      return;\n    }\n    this._rescaleImage(imgSpec, width, height);\n    const img = imgSpec.actual!;\n    const { width: sourceWidth, height: sourceHeight } = imgSpec.actualCellSize;\n    const cols = Math.ceil(img.width / sourceWidth);\n    const sx = (tileId % cols) * sourceWidth;\n    const sy = Math.floor(tileId / cols) * sourceHeight;\n    const finalWidth = sourceWidth + sx > img.width ? img.width - sx : sourceWidth;\n    const finalHeight = sy + sourceHeight > img.height ? img.height - sy : sourceHeight;\n\n    const canvas = ImageRenderer.createCanvas(this.document, Math.ceil(finalWidth * width / sourceWidth), Math.ceil(finalHeight * height / sourceHeight));\n    const ctx = canvas.getContext('2d');\n    if (ctx) {\n      ctx.drawImage(\n        img,\n        Math.floor(sx), Math.floor(sy), Math.floor(finalWidth), Math.floor(finalHeight),\n        0, 0, canvas.width, canvas.height\n      );\n      return canvas;\n    }\n  }\n\n  /**\n   * Draw a line with placeholder on the image layer canvas.\n   */\n  public drawPlaceholder(col: number, row: number, count: number = 1): void {\n    const ctx = this._layers.get('top');\n    if (ctx) {\n      const { width, height } = this.cellSize;\n\n      // Don't try to draw anything, if we cannot get valid renderer metrics.\n      if (width === -1 || height === -1) {\n        return;\n      }\n\n      if (!this._placeholder) {\n        this._createPlaceHolder(Math.max(height + 1, Constants.PLACEHOLDER_HEIGHT));\n      } else if (height >= this._placeholder!.height) {\n        this._createPlaceHolder(height + 1);\n      }\n      if (!this._placeholder) return;\n      ctx.drawImage(\n        this._placeholderBitmap ?? this._placeholder!,\n        col * width,\n        (row * height) % 2 ? 0 : 1,  // needs %2 offset correction\n        width * count,\n        height,\n        col * width,\n        row * height,\n        width * count,\n        height\n      );\n    }\n  }\n\n  /**\n   * Rescale image layer canvas if needed.\n   * Checked once from `ImageStorage.render`.\n   */\n  public rescaleCanvas(): void {\n    const w = this.dimensions?.css.canvas.width || 0;\n    const h = this.dimensions?.css.canvas.height || 0;\n    for (const ctx of this._layers.values()) {\n      if (ctx.canvas.width !== w || ctx.canvas.height !== h) {\n        ctx.canvas.width = w;\n        ctx.canvas.height = h;\n      }\n    }\n  }\n\n  /**\n   * Rescale image in storage if needed.\n   */\n  private _rescaleImage(spec: IImageSpec, currentWidth: number, currentHeight: number): void {\n    if (currentWidth === spec.actualCellSize.width && currentHeight === spec.actualCellSize.height) {\n      return;\n    }\n    const { width: originalWidth, height: originalHeight } = spec.origCellSize;\n    if (currentWidth === originalWidth && currentHeight === originalHeight) {\n      spec.actual = spec.orig;\n      spec.actualCellSize.width = originalWidth;\n      spec.actualCellSize.height = originalHeight;\n      return;\n    }\n    const scaledWidth = Math.ceil(spec.orig!.width * currentWidth / originalWidth);\n    const scaledHeight = Math.ceil(spec.orig!.height * currentHeight / originalHeight);\n    // Upscale visible tiles directly; a full zoomed copy can dwarf the image budget.\n    if (scaledWidth * scaledHeight > spec.orig!.width * spec.orig!.height) {\n      spec.actual = spec.orig;\n      spec.actualCellSize.width = originalWidth;\n      spec.actualCellSize.height = originalHeight;\n      return;\n    }\n    const canvas = ImageRenderer.createCanvas(this.document, scaledWidth, scaledHeight);\n    const ctx = canvas.getContext('2d');\n    if (ctx) {\n      ctx.drawImage(spec.orig!, 0, 0, canvas.width, canvas.height);\n      spec.actual = canvas;\n      spec.actualCellSize.width = currentWidth;\n      spec.actualCellSize.height = currentHeight;\n    }\n  }\n\n  /**\n   * Lazy init for the renderer.\n   */\n  private _open(): void {\n    this._renderService = this._terminal._core._renderService;\n    this._oldSetRenderer = this._renderService.setRenderer.bind(this._renderService);\n    this._renderService.setRenderer = (renderer: any) => {\n      for (const key of [...this._layers.keys()]) {\n        this.removeLayerFromDom(key);\n      }\n      this._oldSetRenderer?.call(this._renderService, renderer);\n    };\n  }\n\n  public insertLayerToDom(layer: ImageLayer = 'top'): void {\n    // make sure that the terminal is attached to a document and to DOM\n    if (!this.document || !this._terminal._core.screenElement) {\n      console.warn('image addon: cannot insert output canvas to DOM, missing document or screenElement');\n      return;\n    }\n    if (this._layers.has(layer)) {\n      return;\n    }\n    const canvas = ImageRenderer.createCanvas(\n      this.document, this.dimensions?.css.canvas.width || 0,\n      this.dimensions?.css.canvas.height || 0\n    );\n    canvas.classList.add(`xterm-image-layer-${layer}`);\n    const screenElement = this._terminal._core.screenElement;\n    // Use isolation to create a stacking context without overriding z-index,\n    // which would conflict with integrators (e.g. VS Code) that set their\n    // own z-index on the screen element.\n    screenElement.style.isolation = 'isolate';\n    if (layer === 'bottom') {\n      // Use z-index:-1 so it paints behind non-positioned text elements.\n      // The screen element needs to be a stacking context (via isolation)\n      // to contain the negative z-index, otherwise it would go behind the\n      // entire terminal.\n      canvas.style.zIndex = '-1';\n      screenElement.insertBefore(canvas, screenElement.firstChild);\n    } else {\n      // Explicit z-index ensures the image canvas reliably stacks above\n      // the text layer (DOM renderer rows). z-index: 0 is below the\n      // selection overlay (z-index: 1).\n      canvas.style.zIndex = '0';\n      screenElement.appendChild(canvas);\n    }\n    const ctx = canvas.getContext('2d', { alpha: true });\n    if (!ctx) {\n      canvas.remove();\n      return;\n    }\n    this._layers.set(layer, ctx);\n    this.clearAll(layer);\n  }\n\n  public removeLayerFromDom(layer: ImageLayer = 'top'): void {\n    const ctx = this._layers.get(layer);\n    if (ctx) {\n      ctx.canvas.remove();\n      this._layers.delete(layer);\n    }\n  }\n\n  public hasLayer(layer: ImageLayer): boolean {\n    return this._layers.has(layer);\n  }\n\n  private _createPlaceHolder(height: number = Constants.PLACEHOLDER_HEIGHT): void {\n    this._placeholderBitmap?.close();\n    this._placeholderBitmap = undefined;\n\n    // create blueprint to fill placeholder with\n    const bWidth = 32;  // must be 2^n\n    const blueprint = ImageRenderer.createCanvas(this.document, bWidth, height);\n    const ctx = blueprint.getContext('2d', { alpha: false });\n    if (!ctx) return;\n    const imgData = ImageRenderer.createImageData(ctx, bWidth, height);\n    const d32 = new Uint32Array(imgData.data.buffer);\n    const black = toRGBA8888(0, 0, 0);\n    const white = toRGBA8888(255, 255, 255);\n    d32.fill(black);\n    for (let y = 0; y < height; ++y) {\n      const shift = y % 2;\n      const offset = y * bWidth;\n      for (let x = 0; x < bWidth; x += 2) {\n        d32[offset + x + shift] = white;\n      }\n    }\n    ctx.putImageData(imgData, 0, 0);\n\n    // create placeholder line, width aligned to blueprint width\n    const width = (screen.width + bWidth - 1) & ~(bWidth - 1) || Constants.PLACEHOLDER_LENGTH;\n    this._placeholder = ImageRenderer.createCanvas(this.document, width, height);\n    const ctx2 = this._placeholder.getContext('2d', { alpha: false });\n    if (!ctx2) {\n      this._placeholder = undefined;\n      return;\n    }\n    for (let i = 0; i < width; i += bWidth) {\n      ctx2.drawImage(blueprint, i, 0);\n    }\n    const placeholder = this._placeholder;\n    ImageRenderer.createImageBitmap(placeholder).then(bitmap => {\n      if (this._placeholder !== placeholder) bitmap?.close();\n      else this._placeholderBitmap = bitmap;\n    }).catch(() => {});\n  }\n\n  public get document(): Document | undefined {\n    return this._terminal._core._coreBrowserService?.window.document;\n  }\n}\n", "/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IDisposable } from '@xterm/xterm';\nimport { ImageRenderer } from './ImageRenderer';\nimport {\n  ITerminalExt, IExtendedAttrsImage, IImageAddonOptions, IImageSpec,\n  IBufferLineExt, BgFlags, Cell, Content, ICellSize, ExtFlags, Attributes,\n  UnderlineStyle, IAddImageOpts\n} from './Types';\n\n\n// fallback default cell size\nexport const CELL_SIZE_DEFAULT: ICellSize = {\n  width: 7,\n  height: 14\n};\n\n/**\n * Extend extended attribute to also hold image tile information.\n *\n * Object definition is copied from base repo to fully mimick its behavior.\n * Image data is added as additional public properties `imageId` and `tileId`.\n */\nclass ExtendedAttrsImage implements IExtendedAttrsImage {\n  private _ext: number = 0;\n  public get ext(): number {\n    if (this._urlId) {\n      return (\n        (this._ext & ~ExtFlags.UNDERLINE_STYLE) |\n        (this.underlineStyle << 26)\n      );\n    }\n    return this._ext;\n  }\n  public set ext(value: number) { this._ext = value; }\n\n  public get underlineStyle(): UnderlineStyle {\n    // Always return the URL style if it has one\n    if (this._urlId) {\n      return UnderlineStyle.DASHED;\n    }\n    return (this._ext & ExtFlags.UNDERLINE_STYLE) >> 26;\n  }\n  public set underlineStyle(value: UnderlineStyle) {\n    this._ext &= ~ExtFlags.UNDERLINE_STYLE;\n    this._ext |= (value << 26) & ExtFlags.UNDERLINE_STYLE;\n  }\n\n  public get underlineColor(): number {\n    return this._ext & (Attributes.CM_MASK | Attributes.RGB_MASK);\n  }\n  public set underlineColor(value: number) {\n    this._ext &= ~(Attributes.CM_MASK | Attributes.RGB_MASK);\n    this._ext |= value & (Attributes.CM_MASK | Attributes.RGB_MASK);\n  }\n\n  public get underlineVariantOffset(): number {\n    const val = (this._ext & ExtFlags.VARIANT_OFFSET) >> 29;\n    if (val < 0) {\n      return val ^ 0xFFFFFFF8;\n    }\n    return val;\n  }\n  public set underlineVariantOffset(value: number) {\n    this._ext &= ~ExtFlags.VARIANT_OFFSET;\n    this._ext |= (value << 29) & ExtFlags.VARIANT_OFFSET;\n  }\n\n  private _urlId: number = 0;\n  public get urlId(): number {\n    return this._urlId;\n  }\n  public set urlId(value: number) {\n    this._urlId = value;\n  }\n\n  constructor(\n    ext: number = 0,\n    urlId: number = 0,\n    public imageId = -1,\n    public tileId = -1\n  ) {\n    this._ext = ext;\n    this._urlId = urlId;\n  }\n\n  public clone(): IExtendedAttrsImage {\n    /**\n     * Technically we dont need a clone variant of ExtendedAttrsImage,\n     * as we never clone a cell holding image data.\n     * Note: Clone is only meant to be used by the InputHandler for\n     * sticky attributes, which is never the case for image data.\n     * We still provide a proper clone method to reflect the full ext attr\n     * state in case there are future use cases for clone.\n     */\n    return new ExtendedAttrsImage(this._ext, this._urlId, this.imageId, this.tileId);\n  }\n\n  public isEmpty(): boolean {\n    return this.underlineStyle === UnderlineStyle.NONE && this._urlId === 0 && this.imageId === -1;\n  }\n}\nconst EMPTY_ATTRS = new ExtendedAttrsImage();\n\n\n/**\n * ImageStorage - extension of CoreTerminal:\n * - hold image data\n * - write/read image data to/from buffer\n *\n * TODO: image composition for overwrites\n */\nexport class ImageStorage implements IDisposable {\n  // storage\n  private _images: Map<number, IImageSpec> = new Map();\n  // last used id\n  private _lastId = 0;\n  // last evicted id\n  private _lowestId = 0;\n  // whether a full clear happened before\n  private _fullyCleared = false;\n  // whether render should do a full clear\n  private _needsFullClear = false;\n  // hard limit of stored pixels (fallback limit of 10 MB)\n  private _pixelLimit: number = 2500000;\n\n  private _viewportMetrics: { cols: number, rows: number };\n  public onImageAdded: (() => void) | undefined;\n  public onImageDeleted: ((storageId: number) => void) | undefined;\n\n  constructor(\n    private _terminal: ITerminalExt,\n    private _renderer: ImageRenderer,\n    private _opts: IImageAddonOptions\n  ) {\n    try {\n      this.setLimit(this._opts.storageLimit);\n    } catch (e: unknown) {\n      if (e instanceof Error) {\n        console.error(e.message);\n      }\n      console.warn(`storageLimit is set to ${this.getLimit()} MB`);\n    }\n    this._viewportMetrics = {\n      cols: this._terminal.cols,\n      rows: this._terminal.rows\n    };\n  }\n\n  public dispose(): void {\n    this.reset();\n  }\n\n  public reset(): void {\n    for (const spec of this._images.values()) {\n      spec.marker?.dispose();\n    }\n    // NOTE: marker.dispose above already calls ImageBitmap.close\n    // therefore we can just wipe the map here\n    this._images.clear();\n    this._renderer.clearAll();\n  }\n\n  public getLimit(): number {\n    return this._pixelLimit * 4 / 1000000;\n  }\n\n  public setLimit(value: number): void {\n    if (value < 0.5 || value > 1000) {\n      throw RangeError('invalid storageLimit, should be at least 0.5 MB and not exceed 1G');\n    }\n    this._pixelLimit = (value / 4 * 1000000) >>> 0;\n    this._evictOldest(0);\n  }\n\n  public getUsage(): number {\n    return this._getStoredPixels() * 4 / 1000000;\n  }\n\n  private _getStoredPixels(): number {\n    let storedPixels = 0;\n    for (const spec of this._images.values()) {\n      if (spec.orig) {\n        storedPixels += spec.orig.width * spec.orig.height;\n        if (spec.actual && spec.actual !== spec.orig) {\n          storedPixels += spec.actual.width * spec.actual.height;\n        }\n      }\n    }\n    return storedPixels;\n  }\n\n  private _delImg(id: number): void {\n    const spec = this._images.get(id);\n    if (!spec) return;\n    this._images.delete(id);\n    // FIXME: really ugly workaround to get bitmaps deallocated :(\n    if (window.ImageBitmap && spec.orig instanceof ImageBitmap) {\n      spec.orig.close();\n    }\n    this.onImageDeleted?.(id);\n  }\n\n  /**\n   * Wipe canvas and images on alternate buffer.\n   */\n  public wipeAlternate(): void {\n    // remove all alternate tagged images\n    const zero = [];\n    for (const [id, spec] of this._images.entries()) {\n      if (spec.bufferType === 'alternate') {\n        spec.marker?.dispose();\n        zero.push(id);\n      }\n    }\n    for (const id of zero) {\n      this._delImg(id);\n    }\n    // mark canvas to be wiped on next render\n    this._needsFullClear = true;\n    this._fullyCleared = false;\n  }\n\n  /**\n   * Delete an image by its internal storage ID.\n   * Used by protocols that support explicit deletion (e.g. Kitty a=d).\n   */\n  public deleteImage(id: number): void {\n    const spec = this._images.get(id);\n    if (spec) {\n      spec.marker?.dispose();\n      this._delImg(id);\n    }\n  }\n\n  /**\n   * Method to add an image to the storage.\n   * @param img - The image to add (canvas or bitmap).\n   * @param opts - Options for addImage:\n   *   - scrolling:  When true, cursor advances with the image.\n   *                 When false, image is placed at ORIGIN and cursor does not move.\n   *   - layer:      Which canvas layer to render on ('top' or 'bottom').\n   *   - zIndex:     Z-index for image layering within the same layer.\n   *   - cursorPos:  'vt340' for bottom-left, 'iip' for bottom.right.\n   * @returns The internal image ID assigned to the stored image.\n   */\n  public addImage(img: HTMLCanvasElement | ImageBitmap, opts: IAddImageOpts): number {\n    // never allow storage to exceed memory limit\n    this._evictOldest(img.width * img.height);\n\n    // calc rows x cols needed to display the image\n    let cellSize = this._renderer.cellSize;\n    if (cellSize.width === -1 || cellSize.height === -1) {\n      cellSize = CELL_SIZE_DEFAULT;\n    }\n    const cols = Math.ceil(img.width / cellSize.width);\n    const rows = Math.ceil(img.height / cellSize.height);\n\n    const imageId = ++this._lastId;\n\n    const buffer = this._terminal._core.buffer;\n    const termCols = this._terminal.cols;\n    const termRows = this._terminal.rows;\n    const originX = buffer.x;\n    const originY = buffer.y;\n    let offset = originX;\n    let tileCount = 0;\n\n    if (!opts.scrolling) {\n      buffer.x = 0;\n      buffer.y = 0;\n      offset = 0;\n    }\n\n    this._terminal._core._inputHandler._dirtyRowTracker.markDirty(buffer.y);\n    for (let row = 0; row < rows; ++row) {\n      const line = buffer.lines.get(buffer.y + buffer.ybase);\n      for (let col = 0; col < cols; ++col) {\n        if (offset + col >= termCols) break;\n        this._writeToCell(line as IBufferLineExt, offset + col, imageId, row * cols + col);\n        tileCount++;\n      }\n      if (opts.scrolling) {\n        if (row < rows - 1) this._terminal._core._inputHandler.lineFeed();\n      } else {\n        if (++buffer.y >= termRows) break;\n      }\n      buffer.x = offset;\n    }\n    this._terminal._core._inputHandler._dirtyRowTracker.markDirty(buffer.y);\n\n    // cursor positioning modes\n    if (opts.scrolling) {\n      if (opts.cursorPos === 'iip') {\n        buffer.x = Math.min(offset + cols, termCols);\n      } else {\n        buffer.x = offset;\n      }\n    } else {\n      buffer.x = originX;\n      buffer.y = originY;\n    }\n\n    // deleted images with zero tile count\n    const zero = [];\n    for (const [id, spec] of this._images.entries()) {\n      if (spec.tileCount < 1) {\n        spec.marker?.dispose();\n        zero.push(id);\n      }\n    }\n    for (const id of zero) {\n      this._delImg(id);\n    }\n\n    // eviction marker:\n    // delete the image when the marker gets disposed\n    const endMarker = this._terminal.registerMarker(0);\n    endMarker?.onDispose(() => {\n      const spec = this._images.get(imageId);\n      if (spec) {\n        this._delImg(imageId);\n      }\n    });\n\n    // since markers do not work on alternate for some reason,\n    // we evict images here manually\n    if (this._terminal.buffer.active.type === 'alternate') {\n      this._evictOnAlternate();\n    }\n\n    // create storage entry\n    const imgSpec: IImageSpec = {\n      orig: img,\n      origCellSize: cellSize,\n      actual: img,\n      actualCellSize: { ...cellSize },  // clone needed, since later modified\n      marker: endMarker || undefined,\n      tileCount,\n      bufferType: this._terminal.buffer.active.type,\n      layer: opts.layer,\n      zIndex: opts.zIndex\n    };\n\n    // finally add the image\n    this._images.set(imageId, imgSpec);\n    this.onImageAdded?.();\n    return imageId;\n  }\n\n\n  /**\n   * Render method. Collects buffer information and triggers\n   * canvas updates.\n   */\n  // TODO: Should we move this to the ImageRenderer?\n  public render(range: { start: number, end: number }): void {\n    // Determine which layers have images\n    let hasTopImages = false;\n    let hasBottomImages = false;\n    for (const spec of this._images.values()) {\n      if (spec.layer === 'bottom') {\n        hasBottomImages = true;\n      } else {\n        hasTopImages = true;\n      }\n      if (hasTopImages && hasBottomImages) break;\n    }\n\n    // Lazily insert layers that are needed\n    if (hasTopImages && !this._renderer.hasLayer('top')) {\n      this._renderer.insertLayerToDom('top');\n      if (!this._renderer.hasLayer('top')) return;\n    }\n    if (hasBottomImages && !this._renderer.hasLayer('bottom')) {\n      this._renderer.insertLayerToDom('bottom');\n    }\n\n    // rescale if needed\n    this._renderer.rescaleCanvas();\n\n    // exit early if we dont have any images to test for\n    if (!this._images.size) {\n      if (!this._fullyCleared) {\n        this._renderer.clearAll();\n        this._fullyCleared = true;\n        this._needsFullClear = false;\n      }\n      if (this._renderer.hasLayer('top')) {\n        this._renderer.removeLayerFromDom('top');\n      }\n      if (this._renderer.hasLayer('bottom')) {\n        this._renderer.removeLayerFromDom('bottom');\n      }\n      return;\n    }\n\n    // Remove layers no longer needed\n    if (!hasTopImages && this._renderer.hasLayer('top')) {\n      this._renderer.clearAll('top');\n      this._renderer.removeLayerFromDom('top');\n    }\n    if (!hasBottomImages && this._renderer.hasLayer('bottom')) {\n      this._renderer.clearAll('bottom');\n      this._renderer.removeLayerFromDom('bottom');\n    }\n\n    // buffer switches force a full clear\n    if (this._needsFullClear) {\n      this._renderer.clearAll();\n      this._fullyCleared = true;\n      this._needsFullClear = false;\n    }\n\n    const { start, end } = range;\n    const buffer = this._terminal._core.buffer;\n    const cols = this._terminal._core.cols;\n\n    // clear drawing area\n    this._renderer.clearLines(start, end);\n\n    // Collect draw calls so we can sort by z-index (lower z drawn first).\n    const drawCalls: { imgSpec: IImageSpec, tileId: number, col: number, row: number, count: number }[] = [];\n    const placeholderCalls: { col: number, row: number, count: number }[] = [];\n\n    // walk all cells in viewport and collect tiles found\n    for (let row = start; row <= end; ++row) {\n      const line = buffer.lines.get(row + buffer.ydisp) as IBufferLineExt;\n      if (!line) return;\n      for (let col = 0; col < cols; ++col) {\n        if (line.getBg(col) & BgFlags.HAS_EXTENDED) {\n          let e: IExtendedAttrsImage = line._extendedAttrs[col] ?? EMPTY_ATTRS;\n          const imageId = e.imageId;\n          if (imageId === undefined || imageId === -1) {\n            continue;\n          }\n          const imgSpec = this._images.get(imageId);\n          if (e.tileId !== -1) {\n            const startTile = e.tileId;\n            const startCol = col;\n            let count = 1;\n            /**\n             * merge tiles to the right into a single draw call, if:\n             * - not at end of line\n             * - cell has same image id\n             * - cell has consecutive tile id\n             */\n            while (\n              ++col < cols\n              && (line.getBg(col) & BgFlags.HAS_EXTENDED)\n              && (e = line._extendedAttrs[col] ?? EMPTY_ATTRS)\n              && (e.imageId === imageId)\n              && (e.tileId === startTile + count)\n            ) {\n              count++;\n            }\n            col--;\n            if (imgSpec) {\n              if (imgSpec.actual) {\n                drawCalls.push({ imgSpec, tileId: startTile, col: startCol, row, count });\n              }\n            } else if (this._opts.showPlaceholder) {\n              placeholderCalls.push({ col: startCol, row, count });\n            }\n            this._fullyCleared = false;\n          }\n        }\n      }\n    }\n\n    // Sort by z-index so lower z draws first (higher z renders on top)\n    drawCalls.sort((a, b) => a.imgSpec.zIndex - b.imgSpec.zIndex);\n\n    // Draw placeholders first (lowest priority)\n    for (const call of placeholderCalls) {\n      this._renderer.drawPlaceholder(call.col, call.row, call.count);\n    }\n\n    // Draw images in z-index order\n    for (const call of drawCalls) {\n      this._renderer.draw(call.imgSpec, call.tileId, call.col, call.row, call.count);\n    }\n  }\n\n  public viewportResize(metrics: { cols: number, rows: number }): void {\n    // exit early if we have nothing in storage\n    if (!this._images.size) {\n      this._viewportMetrics = metrics;\n      return;\n    }\n\n    // handle only viewport width enlargements, exit all other cases\n    // TODO: needs patch for tile counter\n    if (this._viewportMetrics.cols >= metrics.cols) {\n      this._viewportMetrics = metrics;\n      return;\n    }\n\n    // walk scrollbuffer at old col width to find all possible expansion matches\n    const buffer = this._terminal._core.buffer;\n    const rows = buffer.lines.length;\n    const oldCol = this._viewportMetrics.cols - 1;\n    for (let row = 0; row < rows; ++row) {\n      const line = buffer.lines.get(row) as IBufferLineExt;\n      if (line.getBg(oldCol) & BgFlags.HAS_EXTENDED) {\n        const e: IExtendedAttrsImage = line._extendedAttrs[oldCol] ?? EMPTY_ATTRS;\n        const imageId = e.imageId;\n        if (imageId === undefined || imageId === -1) {\n          continue;\n        }\n        const imgSpec = this._images.get(imageId);\n        if (!imgSpec) {\n          continue;\n        }\n        // found an image tile at oldCol, check if it qualifies for right exapansion\n        const tilesPerRow = Math.ceil((imgSpec.actual?.width || 0) / imgSpec.actualCellSize.width);\n        if ((e.tileId % tilesPerRow) + 1 >= tilesPerRow) {\n          continue;\n        }\n        // expand only if right side is empty (nothing got wrapped from below)\n        let hasData = false;\n        for (let rightCol = oldCol + 1; rightCol > metrics.cols; ++rightCol) {\n          if (line._data[rightCol * Cell.SIZE + Cell.CONTENT] & Content.HAS_CONTENT_MASK) {\n            hasData = true;\n            break;\n          }\n        }\n        if (hasData) {\n          continue;\n        }\n        // do right expansion on terminal buffer\n        const end = Math.min(metrics.cols, tilesPerRow - (e.tileId % tilesPerRow) + oldCol);\n        let lastTile = e.tileId;\n        for (let expandCol = oldCol + 1; expandCol < end; ++expandCol) {\n          this._writeToCell(line as IBufferLineExt, expandCol, imageId, ++lastTile);\n          imgSpec.tileCount++;\n        }\n      }\n    }\n    // store new viewport metrics\n    this._viewportMetrics = metrics;\n  }\n\n  /**\n   * Retrieve original canvas at buffer position.\n   */\n  public getImageAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    const buffer = this._terminal._core.buffer;\n    const line = buffer.lines.get(y) as IBufferLineExt;\n    if (line && line.getBg(x) & BgFlags.HAS_EXTENDED) {\n      const e: IExtendedAttrsImage = line._extendedAttrs[x] ?? EMPTY_ATTRS;\n      if (e.imageId && e.imageId !== -1) {\n        const orig = this._images.get(e.imageId)?.orig;\n        if (window.ImageBitmap && orig instanceof ImageBitmap) {\n          const canvas = ImageRenderer.createCanvas(window.document, orig.width, orig.height);\n          canvas.getContext('2d')?.drawImage(orig, 0, 0, orig.width, orig.height);\n          return canvas;\n        }\n        return orig as HTMLCanvasElement;\n      }\n    }\n  }\n\n  /**\n   * Extract active single tile at buffer position.\n   */\n  public extractTileAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    const buffer = this._terminal._core.buffer;\n    const line = buffer.lines.get(y) as IBufferLineExt;\n    if (line && line.getBg(x) & BgFlags.HAS_EXTENDED) {\n      const e: IExtendedAttrsImage = line._extendedAttrs[x] ?? EMPTY_ATTRS;\n      if (e.imageId && e.imageId !== -1 && e.tileId !== -1) {\n        const spec = this._images.get(e.imageId);\n        if (spec) {\n          return this._renderer.extractTile(spec, e.tileId);\n        }\n      }\n    }\n  }\n\n  // TODO: Do we need some blob offloading tricks here to avoid early eviction?\n  // also see https://stackoverflow.com/questions/28307789/is-there-any-limitation-on-javascript-max-blob-size\n  private _evictOldest(room: number): number {\n    const used = this._getStoredPixels();\n    let current = used;\n    while (this._pixelLimit < current + room && this._images.size) {\n      const spec = this._images.get(++this._lowestId);\n      if (spec && spec.orig) {\n        current -= spec.orig.width * spec.orig.height;\n        if (spec.actual && spec.orig !== spec.actual) {\n          current -= spec.actual.width * spec.actual.height;\n        }\n        spec.marker?.dispose();\n        this._delImg(this._lowestId);\n      }\n    }\n    return used - current;\n  }\n\n  private _writeToCell(line: IBufferLineExt, x: number, imageId: number, tileId: number): void {\n    if (line._data[x * Cell.SIZE + Cell.BG] & BgFlags.HAS_EXTENDED) {\n      const old = line._extendedAttrs[x];\n      if (old) {\n        if (old.imageId !== undefined) {\n          // found an old ExtendedAttrsImage, since we know that\n          // they are always isolated instances (single cell usage),\n          // we can re-use it and just update their id entries\n          const oldSpec = this._images.get(old.imageId);\n          if (oldSpec) {\n            // early eviction for in-viewport overwrites\n            oldSpec.tileCount--;\n          }\n          old.imageId = imageId;\n          old.tileId = tileId;\n          return;\n        }\n        // found a plain ExtendedAttrs instance, clone it to new entry\n        line._extendedAttrs[x] = new ExtendedAttrsImage(old.ext, old.urlId, imageId, tileId);\n        return;\n      }\n    }\n    // fall-through: always create new ExtendedAttrsImage entry\n    line._data[x * Cell.SIZE + Cell.BG] |= BgFlags.HAS_EXTENDED;\n    line._extendedAttrs[x] = new ExtendedAttrsImage(0, 0, imageId, tileId);\n  }\n\n  private _evictOnAlternate(): void {\n    // nullify tile count of all images on alternate buffer\n    for (const spec of this._images.values()) {\n      if (spec.bufferType === 'alternate') {\n        spec.tileCount = 0;\n      }\n    }\n    // re-count tiles on whole buffer\n    const buffer = this._terminal._core.buffer;\n    for (let y = 0; y < this._terminal.rows; ++y) {\n      const line = buffer.lines.get(y) as IBufferLineExt;\n      if (!line) {\n        continue;\n      }\n      for (let x = 0; x < this._terminal.cols; ++x) {\n        if (line._data[x * Cell.SIZE + Cell.BG] & BgFlags.HAS_EXTENDED) {\n          const imgId = line._extendedAttrs[x]?.imageId;\n          if (imgId) {\n            const spec = this._images.get(imgId);\n            if (spec) {\n              spec.tileCount++;\n            }\n          }\n        }\n      }\n    }\n    // deleted images with zero tile count\n    const zero = [];\n    for (const [id, spec] of this._images.entries()) {\n      if (spec.bufferType === 'alternate' && !spec.tileCount) {\n        spec.marker?.dispose();\n        zero.push(id);\n      }\n    }\n    for (const id of zero) {\n      this._delImg(id);\n    }\n  }\n}\n", "/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\nimport { IImageAddonOptions, IOscHandler, IResetHandler, ITerminalExt } from './Types';\nimport { ImageRenderer } from './ImageRenderer';\nimport { IIPImageStorage } from './IIPImageStorage';\nimport { CELL_SIZE_DEFAULT } from './ImageStorage';\nimport Base64Decoder from 'xterm-wasm-parts/lib/base64/Base64Decoder.wasm';\nimport QoiDecoder from 'xterm-wasm-parts/lib/qoi/QoiDecoder.wasm';\nimport { HeaderParser, IHeaderFields, HeaderState, SequenceType } from './IIPHeaderParser';\nimport { imageType, UNSUPPORTED_TYPE } from './IIPMetrics';\n\n// Local const enum mirror - esbuild can't inline const enums from external packages\nconst enum DecoderConst {\n  // Limit held memory in base64 decoder (encoded bytes).\n  KEEP_DATA = 4194304,\n  // Initial buffer allocation for the decoder.\n  INITIAL_DATA = 1048576,\n  // Local mirror of const enum (esbuild can't inline const enums from external packages)\n  OK = 0\n}\n\n// default IIP header values\nconst DEFAULT_HEADER: IHeaderFields = {\n  type: SequenceType.INVALID,\n  name: 'Unnamed file',\n  size: 0,\n  width: 'auto',\n  height: 'auto',\n  preserveAspectRatio: 1,\n  inline: 0\n};\n\n\nexport class IIPHandler implements IOscHandler, IResetHandler {\n  private _generation = 0;\n  private _aborted = false;\n  private _hp = new HeaderParser();\n  private _header: IHeaderFields = DEFAULT_HEADER;\n  private _dec: Base64Decoder;\n  private _qoiDec: QoiDecoder;\n  private _isMultipart = false;\n  private _abortMulti = false;\n\n  constructor(\n    private readonly _opts: IImageAddonOptions,\n    private readonly _renderer: ImageRenderer,\n    private readonly _storage: IIPImageStorage,\n    private readonly _coreTerminal: ITerminalExt\n  ) {\n    const maxEncodedBytes = Math.ceil(this._opts.iipSizeLimit * 4 / 3);\n    const initialBytes = Math.min(DecoderConst.INITIAL_DATA, maxEncodedBytes);\n    this._dec = new Base64Decoder(DecoderConst.KEEP_DATA, maxEncodedBytes, initialBytes);\n    this._qoiDec = new QoiDecoder(DecoderConst.KEEP_DATA);\n  }\n\n  public reset(): void {\n    this._generation++;\n    this._hp.reset();\n    this._dec.release();\n    this._qoiDec.release();\n  }\n\n  public start(): void {\n    this._aborted = false;\n    this._hp.reset();\n  }\n\n  public put(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted) return;\n\n    if (this._hp.state === HeaderState.END) {\n      if ((this._dec.put(data.subarray(start, end)) as number) !== DecoderConst.OK) {\n        this._dec.release();\n        this._aborted = true;\n      }\n    } else {\n      const dataPos = this._hp.parse(data, start, end);\n      if (dataPos === -1) {\n        this._aborted = true;\n        return;\n      }\n      if (dataPos > 0) {\n        const seqType = this._hp.fields.type;\n        if (seqType === SequenceType.FILE) {\n          if (this._isMultipart) {\n            this._isMultipart = false;\n            this._abortMulti = false;\n            this._dec.release();\n          }\n          this._header = Object.assign({}, DEFAULT_HEADER, this._hp.fields);\n          if (!this._header.inline) {\n            this._aborted = true;\n            return;\n          }\n          this._dec.init();\n        } else if (this._abortMulti) {\n          this._aborted = true;\n          return;\n        }\n        if ((this._dec.put(data.subarray(dataPos, end)) as number) !== DecoderConst.OK) {\n          this._dec.release();\n          this._aborted = true;\n          if (this._isMultipart) this._abortMulti = true;\n        }\n      }\n    }\n  }\n\n  public end(success: boolean): boolean | Promise<boolean> {\n    if (this._aborted) return true;\n\n    if (this._hp.state !== HeaderState.END) {\n      if (this._hp.end()) return true;\n    }\n    const seqType = this._hp.fields.type;\n\n    if (seqType === SequenceType.FILEPART) return true;\n\n    if (seqType === SequenceType.REPORTCELLSIZE) {\n      // OSC 1337 ; ReportCellSize=[height];[width];[scale] ST\n      let w = CELL_SIZE_DEFAULT.width;\n      let h = CELL_SIZE_DEFAULT.height;\n      if (this._renderer.dimensions) {\n        w = this._renderer.dimensions.css.canvas.width / this._coreTerminal.cols;\n        h = this._renderer.dimensions.css.canvas.height / this._coreTerminal.rows;\n      }\n      const scale = this._coreTerminal._core._coreBrowserService?.dpr ?? 1;\n      const report = `\\x1b]1337;ReportCellSize=${h.toFixed(3)};${w.toFixed(3)};${scale.toFixed(3)}\\x1b\\\\`;\n      this._coreTerminal.input(report, false);\n      return true;\n    }\n\n    if (seqType === SequenceType.MULTIPARTFILE) {\n      this._header = Object.assign({}, DEFAULT_HEADER, this._hp.fields);\n      this._isMultipart = true;\n      this._abortMulti = false;\n      this._dec.release();\n      this._dec.init();\n      return true;\n    }\n\n    if (seqType === SequenceType.FILEEND) {\n      if (!this._isMultipart) return true;\n      this._isMultipart = false;\n      if (this._abortMulti || this._header.type !== SequenceType.MULTIPARTFILE) return true;\n    }\n\n    // fallthrough for SequenceType.FILE & SequenceType.FILEEND\n\n    let w = 0;\n    let h = 0;\n\n    // early exit condition chain\n    let cond: number | boolean;\n    let metrics = UNSUPPORTED_TYPE;\n    if (cond = success) {\n      if (cond = !this._dec.end()) {\n        metrics = imageType(this._dec.data8);\n        if (cond = metrics.mime !== 'unsupported') {\n          w = metrics.width;\n          h = metrics.height;\n          if (cond = w && h && w * h < this._opts.pixelLimit) {\n            [w, h] = this._resize(w, h).map(Math.floor);\n            cond = w && h && w * h < this._opts.pixelLimit;\n          } else {\n            console.warn(`IIP: image dimension issue ${metrics.width}x${metrics.height}`);\n          }\n        } else {\n          console.warn('IIP: unsupported image type');\n        }\n      } else {\n        console.warn('IIP: error during BASE64 decoding');\n      }\n    }\n    if (!cond) {\n      this._dec.release();\n      return true;\n    }\n\n    let blob: Blob | ImageData;\n    if (metrics.mime === 'image/qoi') {\n      const data = this._qoiDec.decode(this._dec.data8);\n      blob = new ImageData(\n        new Uint8ClampedArray(data.buffer, data.byteOffset, data.byteLength),\n        this._qoiDec.width,\n        this._qoiDec.height\n      );\n      this._qoiDec.release();\n      if (w === this._qoiDec.width && h === this._qoiDec.height) {\n        // use fast-path if we don't need to rescale\n        this._dec.release();\n        const canvas = ImageRenderer.createCanvas(undefined, this._qoiDec.width, this._qoiDec.height);\n        canvas.getContext('2d')?.putImageData(blob, 0, 0);\n        this._storage.addImage(canvas);\n        return true;\n      }\n    } else {\n      blob = new Blob([this._dec.data8], { type: metrics.mime });\n    }\n    this._dec.release();\n    const generation = this._generation;\n    return createImageBitmap(blob, { resizeWidth: w, resizeHeight: h })\n      .then(bm => {\n        if (generation !== this._generation) {\n          bm.close();\n          return true;\n        }\n        this._storage.addImage(bm);\n        return true;\n      })\n      .catch(e => {\n        console.warn(`IIP: decoding error ${metrics.mime} ${metrics.width}x${metrics.height}`, e);\n        return true;\n      });\n  }\n\n  private _resize(w: number, h: number): [number, number] {\n    const cw = this._renderer.dimensions?.css.cell.width || CELL_SIZE_DEFAULT.width;\n    const ch = this._renderer.dimensions?.css.cell.height || CELL_SIZE_DEFAULT.height;\n    const width = this._renderer.dimensions?.css.canvas.width || cw * this._coreTerminal.cols;\n    const height = this._renderer.dimensions?.css.canvas.height || ch * this._coreTerminal.rows;\n\n    const rw = this._dim(this._header.width!, width, cw);\n    const rh = this._dim(this._header.height!, height, ch);\n    if (!rw && !rh) {\n      const wf = width / w;         // TODO: should this respect initial cursor offset?\n      const hf = (height - ch) / h; // TODO: fix offset issues from float cell height\n      const f = Math.min(wf, hf);\n      return f < 1 ? [w * f, h * f] : [w, h];\n    }\n    return !rw\n      ? [w * rh / h, rh]\n      : this._header.preserveAspectRatio || !rw || !rh\n        ? [rw, h * rw / w] : [rw, rh];\n  }\n\n  private _dim(s: string, total: number, cdim: number): number {\n    if (s === 'auto') return 0;\n    if (s.endsWith('%')) return parseInt(s.slice(0, -1), 10) * total / 100;\n    if (s.endsWith('px')) return parseInt(s.slice(0, -2), 10);\n    return parseInt(s, 10) * cdim;\n  }\n}\n", "/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\n// eslint-disable-next-line\ndeclare const Buffer: any;\n\nexport const enum HeaderState {\n  START = 0,\n  ABORT = 1,\n  KEY = 2,\n  VALUE = 3,\n  END = 4\n}\n\nexport const enum SequenceType {\n  INVALID = 0,\n  FILE = 1,\n  MULTIPARTFILE = 2,\n  FILEPART = 3,\n  FILEEND = 4,\n  REPORTCELLSIZE = 5\n}\n\nexport interface IHeaderFields {\n  [key: string]: number | string | Uint32Array | null | undefined;\n  // sequence type\n  type: SequenceType;\n  // base-64 encoded filename. Defaults to \"Unnamed file\".\n  name: string;\n  // File size in bytes. The file transfer will be canceled if this size is exceeded.\n  size: number;\n  /**\n   * Optional width and height to render:\n   * - N: N character cells.\n   * - Npx: N pixels.\n   * - N%: N percent of the session's width or height.\n   * - auto: The image's inherent size will be used to determine an appropriate dimension.\n   */\n  width?: string;\n  height?: string;\n  // Optional, defaults to 1 respecting aspect ratio (width takes precedence).\n  preserveAspectRatio?: number;\n  // Optional, defaults to 0. If set to 1, the file will be displayed inline, else downloaded\n  // (download not supported).\n  inline?: number;\n}\n\n// field value decoders\n\n// ASCII bytes to string\nfunction toStr(data: Uint32Array): string {\n  let s = '';\n  for (let i = 0; i < data.length; ++i) {\n    s += String.fromCharCode(data[i]);\n  }\n  return s;\n}\n\n// digits to integer\nfunction toInt(data: Uint32Array): number {\n  let v = 0;\n  for (let i = 0; i < data.length; ++i) {\n    if (data[i] < 48 || data[i] > 57) {\n      throw new Error('illegal char');\n    }\n    v = v * 10 + data[i] - 48;\n  }\n  return v;\n}\n\n// check for correct size entry\nfunction toSize(data: Uint32Array): string {\n  const v = toStr(data);\n  if (!v.match(/^((auto)|(\\d+?((px)|(%)){0,1}))$/)) {\n    throw new Error('illegal size');\n  }\n  return v;\n}\n\n// name is base64 encoded utf-8\nfunction toName(data: Uint32Array): string {\n  if (typeof Buffer !== 'undefined') {\n    return Buffer.from(toStr(data), 'base64').toString();\n  }\n  const bs = atob(toStr(data));\n  const b = new Uint8Array(bs.length);\n  for (let i = 0; i < b.length; ++i) {\n    b[i] = bs.charCodeAt(i);\n  }\n  return new TextDecoder().decode(b);\n}\n\nconst DECODERS: {[key: string]: (v: Uint32Array) => number | string} = {\n  inline: toInt,\n  size: toInt,\n  name: toName,\n  width: toSize,\n  height: toSize,\n  preserveAspectRatio: toInt\n};\n\n\n// sequence type markers\n// File\nconst FILE_MARKER = [70, 105, 108, 101];\n// MultipartFile\nconst MULTIPARTFILE_MARKER = [77, 117, 108, 116, 105, 112, 97, 114, 116, 70, 105, 108, 101];\n// FilePart\nconst FILEPART_MARKER = [70, 105, 108, 101, 80, 97, 114, 116];\n// FileEnd\nconst FILEEND_MARKER = [70, 105, 108, 101, 69, 110, 100];\n// ReportCellSize\nconst REPORTCELLSIZE_MARKER = [82, 101, 112, 111, 114, 116, 67, 101, 108, 108, 83, 105, 122, 101];\n\n// max allowed chars for sequence header\nconst MAX_FIELDCHARS = 1024;\n\n\nexport class HeaderParser {\n  public state: HeaderState = HeaderState.START;\n  private _buffer = new Uint32Array(MAX_FIELDCHARS);\n  private _position = 0;\n  private _key = '';\n  public fields: {[key: string]: number | string | Uint32Array | null | undefined} = {};\n\n  public reset(): void {\n    this._buffer.fill(0);\n    this.state = HeaderState.START;\n    this._position = 0;\n    this.fields = {};\n    this._key = '';\n  }\n\n  public end(): number {\n    if (this.state === HeaderState.START) {\n      if (this._position === FILEEND_MARKER.length) {\n        for (let k = 0; k < FILEEND_MARKER.length; ++k) {\n          if (this._buffer[k] !== FILEEND_MARKER[k]) return this._a();\n        }\n        this.fields['type'] = SequenceType.FILEEND;\n        this.state = HeaderState.END;\n        return 0;\n      }\n      if (this._position === REPORTCELLSIZE_MARKER.length) {\n        for (let k = 0; k < REPORTCELLSIZE_MARKER.length; ++k) {\n          if (this._buffer[k] !== REPORTCELLSIZE_MARKER[k]) return this._a();\n        }\n        this.fields['type'] = SequenceType.REPORTCELLSIZE;\n        this.state = HeaderState.END;\n        return 0;\n      }\n      return this._a();\n    }\n    if (this.state === HeaderState.END) return 0;\n    if (this.state === HeaderState.VALUE\n      && this.fields.type === SequenceType.MULTIPARTFILE\n    ) {\n      if (!this._storeValue(this._position)) return this._a();\n      this.state = HeaderState.END;\n      return 0;\n    }\n    return this._a();\n  }\n\n  public parse(data: Uint32Array, start: number, end: number): number {\n    let state = this.state;\n    let pos = this._position;\n    const buffer = this._buffer;\n    if (state === HeaderState.ABORT || state === HeaderState.END) return -1;\n    if (state === HeaderState.START && pos > 14) return -1;\n    for (let i = start; i < end; ++i) {\n      const c = data[i];\n      switch (c) {\n        case 59: // ;\n          if (!this._storeValue(pos)) return this._a();\n          state = HeaderState.KEY;\n          pos = 0;\n          break;\n        case 61: // =\n          if (state === HeaderState.START) {\n            if (buffer[0] === 70) {\n              // 'File' or 'FilePart'\n              let k = 0;\n              for (; k < FILE_MARKER.length; ++k) {\n                if (buffer[k] !== FILE_MARKER[k]) return this._a();\n              }\n              this.fields['type'] = SequenceType.FILE;\n              if (pos === FILEPART_MARKER.length) {\n                for (; k < FILEPART_MARKER.length; ++k) {\n                  if (buffer[k] !== FILEPART_MARKER[k]) return this._a();\n                }\n                this.fields['type'] = SequenceType.FILEPART;\n                this.state = HeaderState.END;\n                return i + 1;\n              }\n            } else if (buffer[0] === 77) {\n              // 'MultipartFile'\n              for (let k = 0; k < MULTIPARTFILE_MARKER.length; ++k) {\n                if (buffer[k] !== MULTIPARTFILE_MARKER[k]) return this._a();\n              }\n              this.fields['type'] = SequenceType.MULTIPARTFILE;\n            } else {\n              return this._a();\n            }\n            state = HeaderState.KEY;\n            pos = 0;\n          } else if (state === HeaderState.KEY) {\n            if (!this._storeKey(pos)) return this._a();\n            state = HeaderState.VALUE;\n            pos = 0;\n          } else if (state === HeaderState.VALUE) {\n            if (pos >= MAX_FIELDCHARS) return this._a();\n            buffer[pos++] = c;\n          }\n          break;\n        case 58: // :\n          if (state === HeaderState.VALUE) {\n            if (!this._storeValue(pos)) return this._a();\n          }\n          this.state = HeaderState.END;\n          return i + 1;\n        default:\n          if (pos >= MAX_FIELDCHARS) return this._a();\n          buffer[pos++] = c;\n      }\n    }\n    this.state = state;\n    this._position = pos;\n    return -2;\n  }\n\n  private _a(): number {\n    this.fields.type = SequenceType.INVALID;\n    this.state = HeaderState.ABORT;\n    return -1;\n  }\n\n  private _storeKey(pos: number): boolean {\n    const k = toStr(this._buffer.subarray(0, pos));\n    if (k) {\n      this._key = k;\n      this.fields[k] = null;\n      return true;\n    }\n    return false;\n  }\n\n  private _storeValue(pos: number): boolean {\n    if (this._key) {\n      try {\n        const v = this._buffer.slice(0, pos);\n        this.fields[this._key] = DECODERS[this._key] ? DECODERS[this._key](v) : v;\n      } catch {\n        return false;\n      }\n      return true;\n    }\n    return false;\n  }\n}\n", "/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\n\nexport type ImageType = 'image/png' | 'image/jpeg' | 'image/gif' | 'image/qoi' | 'image/webp' | 'image/avif' | 'unsupported' | '';\n\nexport interface IMetrics {\n  mime: ImageType;\n  width: number;\n  height: number;\n}\n\nexport const UNSUPPORTED_TYPE: IMetrics = {\n  mime: 'unsupported',\n  width: 0,\n  height: 0\n};\n\nexport function imageType(d: Uint8Array): IMetrics {\n  if (d.length < 32) {\n    return UNSUPPORTED_TYPE;\n  }\n  const d32 = new Uint32Array(d.buffer, d.byteOffset, 8);\n  // PNG: 89 50 4E 47 0D 0A 1A 0A (8 first bytes == magic number for PNG)\n  // + first chunk must be IHDR\n  if (d32[0] === 0x474E5089 && d32[1] === 0x0A1A0A0D && d32[3] === 0x52444849) {\n    return {\n      mime: 'image/png',\n      width:  d[16] << 24 | d[17] << 16 | d[18] << 8 | d[19],\n      height: d[20] << 24 | d[21] << 16 | d[22] << 8 | d[23]\n    };\n  }\n  // JPEG: FF D8 FF\n  if (d[0] === 0xFF && d[1] === 0xD8 && d[2] === 0xFF) {\n    const [width, height] = jpgSize(d);\n    return { mime: 'image/jpeg', width, height };\n  }\n  // GIF: GIF87a or GIF89a\n  if (d32[0] === 0x38464947 && (d[4] === 0x37 || d[4] === 0x39) && d[5] === 0x61) {\n    return {\n      mime: 'image/gif',\n      width:  d[7] << 8 | d[6],\n      height: d[9] << 8 | d[8]\n    };\n  }\n  // QOI: qoif\n  if (d32[0] === 0x66696F71) {\n    return {\n      mime: 'image/qoi',\n      width:  d[4] << 24 | d[5] << 16 | d[6] << 8 | d[7],\n      height: d[8] << 24 | d[9] << 16 | d[10] << 8 | d[11]\n    };\n  }\n  // WEBP: RIFF | xxxx | WEBP | VP8x\n  if (d32[0] === 0x46464952 && d32[2] === 0x50424557 && (d32[3] & 0xFFFFFF) === 0x385056) {\n    switch (d[15]) {\n      case 0x58:  // Extended WebP VP8X --> \"X\"\n        return {\n          mime: 'image/webp',\n          width:  (d[24] | d[25] << 8 | d[26] << 16) + 1,\n          height: (d[27] | d[28] << 8 | d[29] << 16) + 1\n        };\n      case 0x4C:  // Lossless WebP VP8L --> \"L\"\n        if (d[20] !== 0x2f) return UNSUPPORTED_TYPE;\n        const dim = d[21] | d[22] << 8 | d[23] << 16 | d[24] << 24;\n        return {\n          mime: 'image/webp',\n          width:  (dim        & 0x3FFF) + 1,\n          height: (dim >>> 14 & 0x3FFF) + 1\n        };\n      case 0x20:  // Lossy WebP VP8  --> \" \"\n        if (d[23] !== 0x9d || d[24] !== 0x01 || d[25] !== 0x2a) return UNSUPPORTED_TYPE;\n        return {\n          mime: 'image/webp',\n          width:  (d[26] | d[27] << 8) & 0x3FFF,\n          height: (d[28] | d[29] << 8) & 0x3FFF\n        };\n    }\n    return UNSUPPORTED_TYPE;\n  }\n  // AVIF: Box size | ftyp | avif/avis\n  if (d32[1] === 0x70797466 && (d32[2] === 0x66697661 || d32[2] === 0x73697661)) {\n    let pos = -1;\n    // search for ispe box within first 1024 bytes\n    const limit = Math.min(d.length - 16, 1024);\n    for (let i = 8; i < limit; i++) {\n      // scan for ispe\n      if (d[i] === 0x69 && d[i + 1] === 0x73 && d[i + 2] === 0x70 && d[i + 3] === 0x65) {\n        pos = i;\n        break;\n      }\n    }\n    if (pos !== -1) {\n      // dimensions are in BE at +8 (width) at +12 (height)\n      const width =\n        d[pos +  8] << 24 |\n        d[pos +  9] << 16 |\n        d[pos + 10] <<  8 |\n        d[pos + 11];\n      const height =\n        d[pos + 12] << 24 |\n        d[pos + 13] << 16 |\n        d[pos + 14] <<  8 |\n        d[pos + 15];\n      if (width > 0 && height > 0) {\n        return { mime: 'image/avif', width, height };\n      }\n    }\n    return UNSUPPORTED_TYPE;\n  }\n  return UNSUPPORTED_TYPE;\n}\n\n\nfunction jpgSize(d: Uint8Array): [number, number] {\n  const len = d.length;\n  let i = 4;\n  let blockLength = d[i] << 8 | d[i + 1];\n  while (true) {\n    i += blockLength;\n    if (i >= len) {\n      // exhausted without size info\n      return [0, 0];\n    }\n    if (d[i] !== 0xFF) {\n      return [0, 0];\n    }\n    if (d[i + 1] === 0xC0 || d[i + 1] === 0xC2) {\n      if (i + 8 < len) {\n        return [\n          d[i + 7] << 8 | d[i + 8],\n          d[i + 5] << 8 | d[i + 6]\n        ];\n      }\n      return [0, 0];\n    }\n    i += 2;\n    blockLength = d[i] << 8 | d[i + 1];\n  }\n}\n", "/**\n * Copyright (c) 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IDisposable } from '@xterm/xterm';\nimport { IApcHandler, IImageAddonOptions, IResetHandler, ITerminalExt, ImageLayer } from '../Types';\nimport { ImageRenderer } from '../ImageRenderer';\nimport { CELL_SIZE_DEFAULT } from '../ImageStorage';\nimport { imageType } from '../IIPMetrics';\nimport { KittyImageStorage } from './KittyImageStorage';\nimport Base64Decoder, { type DecodeStatus } from 'xterm-wasm-parts/lib/base64/Base64Decoder.wasm';\nimport {\n  KittyAction,\n  KittyFormat,\n  KittyCompression,\n  IKittyCommand,\n  IPendingTransmission,\n  IKittyImageData,\n  KittyPixelConstants,\n  parseKittyCommand\n} from './KittyGraphicsTypes';\n\nconst enum Constants {\n  // Memory limit for base64 decoder (4MB, same as IIPHandler)\n  DECODER_KEEP_DATA = 4194304,\n  DECODER_INITIAL_DATA = 4194304, // 4MB\n  // Local mirror of const enum (esbuild can't inline const enums from external packages)\n  DECODER_OK = 0,\n  // Maximum control data size\n  MAX_CONTROL_DATA_SIZE = 512,\n  // Semicolon codepoint\n  SEMICOLON = 0x3B\n}\n\nconst DECODER_OK = Constants.DECODER_OK as unknown as DecodeStatus.OK;\n\n// Kitty graphics protocol handler with streaming base64 decoding.\nexport class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDisposable {\n  private _aborted = false;\n  private _generation = 0;\n  private _decodeError = false;\n\n  private _activeDecoder: Base64Decoder | null = null;\n  private readonly _maxEncodedBytes: number;\n  private readonly _initialEncodedBytes: number;\n\n  // Streaming related states\n\n  // True while receiving control data (before semicolon).\n  private _inControlData = true;\n\n  // Buffer for control data.\n  private _controlData = new Uint32Array(Constants.MAX_CONTROL_DATA_SIZE);\n  private _controlLength = 0;\n\n  // Pre-calculated encoded size limit\n  private _encodedSizeLimit = 0;\n  private _totalEncodedSize = 0;\n\n  // Parsed command. These are the control data before semicolon.\n  private _parsedCommand: IKittyCommand | null = null;\n\n  // Storage related states\n\n  private _pendingTransmissions: Map<number, IPendingTransmission> = new Map();\n  // Tracks the pending key of the most recently started chunked upload.\n  // Per spec, subsequent chunks only need m= (and optionally q=), without i=.\n  // When a chunk arrives with no i=, this key is used to find the pending upload.\n  private _lastPendingKey: number | undefined;\n\n  constructor(\n    private readonly _opts: IImageAddonOptions,\n    private readonly _renderer: ImageRenderer,\n    private readonly _kittyStorage: KittyImageStorage,\n    private readonly _coreTerminal: ITerminalExt\n  ) {\n    // Convert decoded size limit -> max encoded bytes.\n    this._maxEncodedBytes = Math.ceil(this._opts.kittySizeLimit * 4 / 3);\n    // ensure we preallocate more than configured limit while using 4mb initial size.\n    this._initialEncodedBytes = Math.min(Constants.DECODER_INITIAL_DATA, this._maxEncodedBytes);\n  }\n\n  public reset(): void {\n    this._generation++;\n    this._cleanupAllPending();\n    if (this._activeDecoder) {\n      this._activeDecoder.release();\n      this._activeDecoder = null;\n    }\n    this._kittyStorage.reset();\n  }\n\n  public dispose(): void {\n    this.reset();\n  }\n\n  private _removePendingEntry(key: number): void {\n    this._pendingTransmissions.delete(key);\n    if (this._lastPendingKey === key) {\n      this._lastPendingKey = undefined;\n    }\n  }\n\n  private _cleanupAllPending(): void {\n    for (const pending of this._pendingTransmissions.values()) {\n      pending.decoder.release();\n    }\n    this._pendingTransmissions.clear();\n    this._lastPendingKey = undefined;\n  }\n\n  public start(): void {\n    this._aborted = false;\n    this._decodeError = false;\n    this._inControlData = true;\n    this._controlLength = 0;\n    this._parsedCommand = null;\n    // Pre-calculate encoded limit once: base64 is 4 bytes encoded \u2192 3 bytes decoded\n    this._encodedSizeLimit = this._maxEncodedBytes;\n    this._totalEncodedSize = 0;\n    this._activeDecoder = null;\n  }\n\n  public put(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted) return;\n\n    if (!this._inControlData) {\n      this._streamPayload(data, start, end);\n    } else {\n      // Scan for semicolon\n      let controlEnd = end;\n      for (let i = start; i < end; i++) {\n        if (data[i] === Constants.SEMICOLON) {\n          this._inControlData = false;\n          controlEnd = i;\n          break;\n        }\n      }\n\n      // Copy control data\n      const copyLength = controlEnd - start;\n      if (this._controlLength + copyLength > Constants.MAX_CONTROL_DATA_SIZE) {\n        this._aborted = true;\n        return;\n      }\n      this._controlData.set(data.subarray(start, controlEnd), this._controlLength);\n      this._controlLength += copyLength;\n\n      if (!this._inControlData) {\n        // Found semicolon - parse control data early for validation\n        this._parsedCommand = parseKittyCommand(this._parseControlDataString());\n\n        // Early validation: i+I conflict\n        if (this._parsedCommand.id !== undefined && this._parsedCommand.imageNumber !== undefined) {\n          this._sendResponse(this._parsedCommand.id, 'EINVAL:cannot specify both i and I keys', this._parsedCommand.quiet ?? 0);\n          this._aborted = true;\n          return;\n        }\n\n        // Delete action doesn't need payload - skip streaming\n        if (this._parsedCommand.action === KittyAction.DELETE) {\n          return;\n        }\n\n        // Stream remaining as payload\n        const payloadStart = controlEnd + 1;\n        if (payloadStart < end) {\n          this._streamPayload(data, payloadStart, end);\n        }\n      }\n    }\n  }\n\n  // Stream payload bytes into the base64 decoder.\n  private _streamPayload(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted) return;\n\n    // Check size limit (compare encoded bytes against pre-calculated limit)\n    // Include cumulative size from pending transmission for multi-chunk images.\n    // Per spec, subsequent chunks may omit i=, so fall back to _lastPendingKey.\n    const pendingKey = this._parsedCommand?.id ?? this._lastPendingKey ?? 0;\n    const pending = this._pendingTransmissions.get(pendingKey);\n    const previousEncodedSize = pending?.totalEncodedSize ?? 0;\n    this._totalEncodedSize += end - start;\n    const cumulativeEncodedSize = previousEncodedSize + this._totalEncodedSize;\n    if (cumulativeEncodedSize > this._encodedSizeLimit) {\n      const decoderToRelease = this._activeDecoder ?? pending?.decoder;\n      if (decoderToRelease) {\n        decoderToRelease.release();\n      }\n      this._activeDecoder = null;\n      if (pending) {\n        this._removePendingEntry(pendingKey);\n      }\n      this._aborted = true;\n      return;\n    }\n\n    if (this._decodeError) return;\n\n    if (pending?.decoder && !this._activeDecoder) {\n      this._activeDecoder = pending.decoder;\n    }\n    if (!this._activeDecoder) {\n      // Budget WASM capacity, including one page of decoder state and rounding.\n      const decoderCapacity = this._maxEncodedBytes + 131072;\n      if (decoderCapacity > this._opts.storageLimit * 1000000) {\n        this._aborted = true;\n        if (this._parsedCommand?.id !== undefined) {\n          this._sendResponse(this._parsedCommand.id, 'ENOMEM:pending image budget exceeded', this._parsedCommand.quiet ?? 0);\n        }\n        return;\n      }\n      const maxPending = Math.max(1, Math.floor(this._opts.storageLimit * 1000000 / decoderCapacity));\n      while (this._pendingTransmissions.size >= maxPending) {\n        const oldest = this._pendingTransmissions.entries().next().value;\n        if (!oldest) break;\n        oldest[1].decoder.release();\n        this._removePendingEntry(oldest[0]);\n        if (oldest[1].cmd.id !== undefined) {\n          this._sendResponse(oldest[1].cmd.id, 'ENOMEM:pending image budget exceeded', oldest[1].cmd.quiet ?? 0);\n        }\n      }\n      this._activeDecoder = new Base64Decoder(Constants.DECODER_KEEP_DATA, this._maxEncodedBytes, this._initialEncodedBytes);\n      this._activeDecoder.init();\n    }\n\n    if (this._activeDecoder.put(data.subarray(start, end)) !== DECODER_OK) {\n      this._activeDecoder.release();\n      this._activeDecoder = null;\n      this._decodeError = true;\n      if (pending) {\n        this._removePendingEntry(pendingKey);\n      }\n    }\n  }\n\n  public end(success: boolean): boolean | Promise<boolean> {\n    if (this._aborted || !success) {\n      if (this._activeDecoder) {\n        this._activeDecoder.release();\n        this._activeDecoder = null;\n      }\n      return true;\n    }\n\n    // No semicolon = no payload (delete, capability query)\n    if (this._inControlData) {\n      return this._handleNoPayloadCommand();\n    }\n\n    // Use command parsed early in put() - i+I already validated there\n    const cmd = this._parsedCommand!;\n\n    // Delete action was handled by skipping payload - just execute\n    if (cmd.action === KittyAction.DELETE) {\n      return this._handleDelete(cmd);\n    }\n\n    // Per spec, subsequent chunks may omit i=, so fall back to _lastPendingKey.\n    const pendingKey = cmd.id ?? this._lastPendingKey ?? 0;\n    const isMoreComing = cmd.more === 1;\n    const pending = this._pendingTransmissions.get(pendingKey);\n\n    if (isMoreComing) {\n      if (this._activeDecoder) {\n        if (pending) {\n          pending.totalEncodedSize += this._totalEncodedSize;\n          pending.decodeError = pending.decodeError || this._decodeError;\n        } else {\n          this._pendingTransmissions.set(pendingKey, {\n            cmd: { ...cmd },\n            decoder: this._activeDecoder,\n            totalEncodedSize: this._totalEncodedSize,\n            decodeError: this._decodeError\n          });\n        }\n        this._lastPendingKey = pendingKey;\n        this._activeDecoder = null;\n      }\n      return true;\n    }\n\n    // Final chunk received \u2014 clear the last pending key\n    if (pending) {\n      this._lastPendingKey = undefined;\n    }\n\n    let decodeError = this._decodeError;\n    let finalCmd = cmd;\n    let decoder = this._activeDecoder;\n\n    if (pending) {\n      finalCmd = pending.cmd;\n      decoder = pending.decoder;\n      decodeError = decodeError || pending.decodeError;\n      this._pendingTransmissions.delete(pendingKey);\n    }\n\n    let imageBytes = new Uint8Array(0);\n    if (decoder) {\n      if (decoder.end() !== DECODER_OK) {\n        decodeError = true;\n      }\n      imageBytes = decoder.data8;\n    }\n    this._activeDecoder = null;\n\n    // Handle command first \u2014 handlers create Blob/ImageData from imageBytes,\n    // which copies the data. Only then is it safe to release the decoder's\n    // wasm memory that imageBytes points into.\n    const result = this._handleCommandWithBytesAndCmd(finalCmd, imageBytes, decodeError);\n    if (decoder) {\n      decoder.release();\n    }\n    return result;\n  }\n\n  // Command handling\n\n  private _parseControlDataString(): string {\n    let str = '';\n    for (let i = 0; i < this._controlLength; i++) {\n      str += String.fromCodePoint(this._controlData[i]);\n    }\n    return str;\n  }\n\n  private _handleNoPayloadCommand(): boolean | Promise<boolean> {\n    const cmd = parseKittyCommand(this._parseControlDataString());\n\n    // Per spec: specifying both i and I is an error\n    if (cmd.id !== undefined && cmd.imageNumber !== undefined) {\n      this._sendResponse(cmd.id, 'EINVAL:cannot specify both i and I keys', cmd.quiet ?? 0);\n      return true;\n    }\n\n    const action = cmd.action ?? 't';\n\n    switch (action) {\n      case KittyAction.DELETE:\n        return this._handleDelete(cmd);\n      case KittyAction.QUERY:\n        this._sendResponse(cmd.id ?? 0, 'OK', cmd.quiet ?? 0);\n        return true;\n      case KittyAction.PLACEMENT:\n        return this._handlePlacement(cmd);\n      default:\n        // TODO: Implement remaining actions when needed:\n        // - a=f (frame): animation frame operations\n        // - a=a (animation): animation control\n        // - a=c (compose): compose images\n        if (cmd.id !== undefined) {\n          this._sendResponse(cmd.id, 'EINVAL:unsupported action', cmd.quiet ?? 0);\n        }\n        return true;\n    }\n  }\n\n  private _handleCommandWithBytesAndCmd(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean | Promise<boolean> {\n    const action = cmd.action ?? 't';\n\n    switch (action) {\n      case KittyAction.TRANSMIT: {\n        const result = this._handleTransmit(cmd, bytes, decodeError);\n        // Only send response when _handleTransmit didn't already respond\n        // (it handles unsupported transmission medium responses internally)\n        if ((cmd.transmission ?? 'd') === 'd' && cmd.id !== undefined) {\n          if (decodeError) {\n            this._sendResponse(cmd.id, 'EINVAL:invalid base64 data', cmd.quiet ?? 0);\n          } else if (bytes.length > 0) {\n            this._sendResponse(cmd.id, 'OK', cmd.quiet ?? 0);\n          }\n        }\n        return result;\n      }\n      case KittyAction.TRANSMIT_DISPLAY:\n        return this._handleTransmitDisplay(cmd, bytes, decodeError);\n      case KittyAction.QUERY:\n        return this._handleQuery(cmd, bytes, decodeError);\n      case KittyAction.PLACEMENT:\n        // a=p ignores any payload \u2014 image data was already transmitted\n        return this._handlePlacement(cmd);\n      default:\n        // TODO: Implement remaining actions when needed:\n        // - a=f (frame): animation frame operations\n        // - a=a (animation): animation control\n        // - a=c (compose): compose images\n        if (cmd.id !== undefined) {\n          this._sendResponse(cmd.id, 'EINVAL:unsupported action', cmd.quiet ?? 0);\n        }\n        return true;\n    }\n  }\n\n  private _handlePlacement(cmd: IKittyCommand): boolean | Promise<boolean> {\n    if (cmd.id === undefined) {\n      return true;\n    }\n    const id = cmd.id;\n    const image = this._kittyStorage.getImage(id);\n    if (!image) {\n      this._sendResponse(id, 'ENOENT:image not found', cmd.quiet ?? 0, cmd.placementId);\n      return true;\n    }\n    const result = this._displayImage(image, cmd);\n    return result.then(success => {\n      this._sendResponse(id, success ? 'OK' : 'EINVAL:image rendering failed', cmd.quiet ?? 0, cmd.placementId);\n      return true;\n    });\n  }\n\n  private _handleTransmit(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean {\n    // TODO: Support file-based transmission modes (t=f, t=t, t=s)\n    // Currently only supports direct transmission (t=d, the default).\n    // - t=f (file): Payload is base64-encoded file path. Terminal reads image from that path.\n    // - t=t (temp file): Payload is base64-encoded path in temp directory. Terminal reads, deletes.\n    // - t=s: Payload is base64-encoded POSIX shm name. Terminal reads from shared memory.\n    // These modes require filesystem/IPC access not available in browsers. For Node.js/Electron:\n    // 1. Check cmd.transmission (t key) before treating bytes as image data\n    // 2. For t=f/t/s: decode bytes as UTF-8 string (the path/name), then read file contents\n    // 3. For t=d: treat bytes as image data (current behavior)\n    // When implementing, also update _handleQuery to accept these transmission mediums.\n    const transmission = cmd.transmission ?? 'd';\n    if (transmission !== 'd') {\n      if (cmd.id !== undefined) {\n        this._sendResponse(cmd.id, 'EINVAL:unsupported transmission medium', cmd.quiet ?? 0);\n      }\n      return true;\n    }\n\n    if (decodeError || bytes.length === 0) return true;\n\n    this._kittyStorage.storeImage(cmd.id, {\n      data: new Blob([bytes as BlobPart]),\n      width: cmd.width ?? 0,\n      height: cmd.height ?? 0,\n      format: (cmd.format ?? KittyFormat.RGBA) as 24 | 32 | 100,\n      compression: cmd.compression ?? ''\n    });\n    return true;\n  }\n\n  private _handleTransmitDisplay(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean | Promise<boolean> {\n    if (decodeError) {\n      if (cmd.id !== undefined) {\n        this._sendResponse(cmd.id, 'EINVAL:invalid base64 data', cmd.quiet ?? 0);\n      }\n      return true;\n    }\n\n    this._handleTransmit(cmd, bytes, decodeError);\n\n    const id = cmd.id ?? this._kittyStorage.lastImageId;\n    const image = this._kittyStorage.getImage(id);\n    if (image) {\n      const result = this._displayImage(image, cmd);\n      if (cmd.id !== undefined) {\n        return result.then(success => {\n          this._sendResponse(id, success ? 'OK' : 'EINVAL:image rendering failed', cmd.quiet ?? 0);\n          return true;\n        });\n      }\n      return result.then(() => true);\n    }\n    return true;\n  }\n\n  private _handleQuery(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean {\n    const id = cmd.id ?? 0;\n    const quiet = cmd.quiet ?? 0;\n\n    // Per spec: reject unsupported transmission mediums (only t=d is supported atm)\n    // TODO: When filesystem support is added (Node.js/Electron), update this to accept\n    // t=f (file), t=t (temp file), and t=s (shared memory) and respond OK for queries.\n    const transmission = cmd.transmission ?? 'd';\n    if (transmission !== 'd') {\n      this._sendResponse(id, 'EINVAL:unsupported transmission medium', quiet);\n      return true;\n    }\n\n    // Check decode error first (invalid base64)\n    if (decodeError) {\n      this._sendResponse(id, 'EINVAL:invalid base64 data', quiet);\n      return true;\n    }\n\n    // Capability query (no payload) - just respond OK\n    if (bytes.length === 0) {\n      this._sendResponse(id, 'OK', quiet);\n      return true;\n    }\n\n    const format = cmd.format ?? KittyFormat.RGBA;\n\n    if (format === KittyFormat.PNG) {\n      this._sendResponse(id, 'OK', quiet);\n    } else {\n      const width = cmd.width ?? 0;\n      const height = cmd.height ?? 0;\n\n      if (!width || !height) {\n        this._sendResponse(id, 'EINVAL:width and height required for raw pixel data', quiet);\n        return true;\n      }\n\n      const bytesPerPixel = format === KittyFormat.RGBA ? KittyPixelConstants.BYTES_PER_PIXEL_RGBA : KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n      const expectedBytes = width * height * bytesPerPixel;\n\n      if (bytes.length < expectedBytes) {\n        this._sendResponse(id, `EINVAL:insufficient pixel data`, quiet);\n        return true;\n      }\n\n      this._sendResponse(id, 'OK', quiet);\n    }\n    return true;\n  }\n\n  private _handleDelete(cmd: IKittyCommand): boolean {\n    // Per spec: default delete selector is 'a' (delete all visible placements)\n    const selector = cmd.deleteSelector ?? 'a';\n\n    // TODO: Distinguish lowercase (delete placements only) from uppercase\n    // (delete placements + free stored image data). Currently both variants\n    // free everything since we don't separate stored data from placements.\n    switch (selector) {\n      case 'a':\n      case 'A':\n        this._cleanupAllPending();\n        this._kittyStorage.deleteAll();\n        break;\n      case 'i':\n      case 'I':\n        // TODO: When placement id tracking is implemented (see TODO in\n        // KittyImageStorage), d=i with p=<pid> should delete only that\n        // specific placement, while d=i without p should delete all\n        // placements for the image.\n        if (cmd.id !== undefined) {\n          const pending = this._pendingTransmissions.get(cmd.id);\n          if (pending) {\n            pending.decoder.release();\n          }\n          this._removePendingEntry(cmd.id);\n          this._kittyStorage.deleteById(cmd.id);\n        }\n        break;\n      default:\n        // Unsupported selectors (c, n, p, q, r, x, y, z, f) \u2014 ignore for now\n        break;\n    }\n    return true;\n  }\n\n  private _sendResponse(id: number, message: string, quiet: number, placementId?: number): void {\n    const isOk = message === 'OK';\n    if (isOk && quiet >= 1) return;\n    if (!isOk && quiet >= 2) return;\n\n    const pPart = placementId ? `,p=${placementId}` : '';\n    const response = `\\x1b_Gi=${id}${pPart};${message}\\x1b\\\\`;\n    this._coreTerminal._core.coreService.triggerDataEvent(response);\n  }\n\n  // Image display\n\n  private _displayImage(image: IKittyImageData, cmd: IKittyCommand): Promise<boolean> {\n    return this._decodeAndDisplay(image, cmd)\n      .then(() => true)\n      .catch(() => false);\n  }\n\n  private async _decodeAndDisplay(image: IKittyImageData, cmd: IKittyCommand): Promise<void> {\n    const generation = this._generation;\n    let bitmap: ImageBitmap | undefined = await this._createBitmap(image);\n\n    try {\n      if (generation !== this._generation) throw new Error('image decode canceled');\n      const cropX = Math.max(0, cmd.x ?? 0);\n      const cropY = Math.max(0, cmd.y ?? 0);\n      const cropW = cmd.sourceWidth || (bitmap.width - cropX);\n      const cropH = cmd.sourceHeight || (bitmap.height - cropY);\n\n      const maxCropW = Math.max(0, bitmap.width - cropX);\n      const maxCropH = Math.max(0, bitmap.height - cropY);\n      const finalCropW = Math.max(0, Math.min(cropW, maxCropW));\n      const finalCropH = Math.max(0, Math.min(cropH, maxCropH));\n\n      if (finalCropW === 0 || finalCropH === 0) {\n        throw new Error('invalid source rectangle');\n      }\n\n      if (cropX !== 0 || cropY !== 0 || finalCropW !== bitmap.width || finalCropH !== bitmap.height) {\n        const cropped = await createImageBitmap(bitmap, cropX, cropY, finalCropW, finalCropH);\n        bitmap.close();\n        bitmap = cropped;\n      }\n\n      const cw = this._renderer.dimensions?.css.cell.width || CELL_SIZE_DEFAULT.width;\n      const ch = this._renderer.dimensions?.css.cell.height || CELL_SIZE_DEFAULT.height;\n\n      // Per spec: c/r default to image's natural cell dimensions.\n      // If only one of c/r is specified, compute the other from image aspect ratio.\n      let imgCols: number;\n      let imgRows: number;\n      if (cmd.columns !== undefined && cmd.rows !== undefined) {\n        imgCols = cmd.columns;\n        imgRows = cmd.rows;\n      } else if (cmd.columns !== undefined) {\n        imgCols = cmd.columns;\n        imgRows = Math.max(1, Math.ceil((bitmap.height / bitmap.width) * (imgCols * cw) / ch));\n      } else if (cmd.rows !== undefined) {\n        imgRows = cmd.rows;\n        imgCols = Math.max(1, Math.ceil((bitmap.width / bitmap.height) * (imgRows * ch) / cw));\n      } else {\n        imgCols = Math.ceil(bitmap.width / cw);\n        imgRows = Math.ceil(bitmap.height / ch);\n      }\n\n      let w = bitmap.width;\n      let h = bitmap.height;\n\n      // Scale bitmap to fit placement rectangle when c/r are specified\n      if (cmd.columns !== undefined || cmd.rows !== undefined) {\n        w = Math.round(imgCols * cw);\n        h = Math.round(imgRows * ch);\n      }\n\n      if (w * h > this._opts.pixelLimit) {\n        throw new Error('image exceeds pixel limit');\n      }\n\n      // Save cursor position before addImage modifies it\n      const buffer = this._coreTerminal._core.buffer;\n      const savedX = buffer.x;\n      const savedY = buffer.y;\n      const savedYbase = buffer.ybase;\n\n      // Determine layer based on z-index: negative = behind text, 0+ = on top.\n      // When z<0 we always use the bottom layer even without allowTransparency \u2014\n      // the image will simply be hidden behind the opaque text background, which\n      // is the correct behavior (client asked for \"behind text\").\n      const wantsBottom = cmd.zIndex !== undefined && cmd.zIndex < 0;\n      const layer: ImageLayer = wantsBottom ? 'bottom' : 'top';\n\n      if (w !== bitmap.width || h !== bitmap.height) {\n        const scaled = await createImageBitmap(bitmap, { resizeWidth: w, resizeHeight: h });\n        bitmap.close();\n        bitmap = scaled;\n      }\n\n      // Per spec: X/Y are pixel offsets within the first cell, so clamp to cell dimensions\n      const xOffset = Math.min(Math.max(0, cmd.xOffset ?? 0), cw - 1);\n      const yOffset = Math.min(Math.max(0, cmd.yOffset ?? 0), ch - 1);\n      if (xOffset !== 0 || yOffset !== 0) {\n        // Per spec: X/Y is not added to c/r area. When c/r are explicit, the\n        // total placement area remains c*cw \u00D7 r*ch pixels and the offset image\n        // is clipped to fit. When c/r are unset, the padded canvas determines\n        // the natural cell dimensions.\n        const canvasW = (cmd.columns !== undefined) ? Math.round(imgCols * cw) : bitmap.width + xOffset;\n        const canvasH = (cmd.rows !== undefined) ? Math.round(imgRows * ch) : bitmap.height + yOffset;\n        const offsetCanvas = ImageRenderer.createCanvas(window.document, canvasW, canvasH);\n        const offsetCtx = offsetCanvas.getContext('2d');\n        if (!offsetCtx) {\n          throw new Error('Failed to create offset canvas context');\n        }\n        offsetCtx.drawImage(bitmap, xOffset, yOffset);\n\n        const offsetBitmap = await createImageBitmap(offsetCanvas);\n        offsetCanvas.width = offsetCanvas.height = 0;\n        bitmap.close();\n        bitmap = offsetBitmap;\n        w = bitmap.width;\n        h = bitmap.height;\n        if (w * h > this._opts.pixelLimit) {\n          throw new Error('image exceeds pixel limit');\n        }\n        if (cmd.columns === undefined) {\n          imgCols = Math.ceil(bitmap.width / cw);\n        }\n        if (cmd.rows === undefined) {\n          imgRows = Math.ceil(bitmap.height / ch);\n        }\n      }\n\n      if (generation !== this._generation) throw new Error('image decode canceled');\n      const zIndex = cmd.zIndex ?? 0;\n      this._kittyStorage.addImage(image.id, bitmap, true, layer, zIndex);\n      bitmap = undefined;  // ownership transferred to storage\n\n      // Kitty cursor movement\n      // Per spec: cursor placed at first column after last image column,\n      // on the last row of the image. C=1 means don't move cursor.\n      if (cmd.cursorMovement === 1) {\n        // C=1: restore cursor to position before image was placed\n        const scrolled = buffer.ybase - savedYbase;\n        buffer.x = savedX;\n        // Can't restore cursor to scrollback?\n        buffer.y = Math.max(savedY - scrolled, 0);\n      } else {\n        // Default (C=0): advance cursor horizontally past the image\n        // addImage already positioned cursor on the last row via lineFeeds\n        buffer.x = Math.min(savedX + imgCols, this._coreTerminal.cols);\n      }\n    } catch (e) {\n      bitmap?.close();\n      throw e;\n    }\n  }\n\n  // Create ImageBitmap from already-decoded image data.\n  private async _createBitmap(image: IKittyImageData): Promise<ImageBitmap> {\n    let bytes: Uint8Array = new Uint8Array(await image.data.arrayBuffer());\n\n    if (image.compression === KittyCompression.ZLIB) {\n      bytes = await this._decompressZlib(bytes);\n    }\n\n    if (image.format === KittyFormat.PNG) {\n      const metrics = imageType(bytes);\n      // IHDR dimensions are parsed with signed shifts, so a value >= 0x80000000 comes\n      // back negative and a bare `>` pixel-limit test passes it; require positive.\n      if (metrics.mime !== 'image/png' || !(metrics.width > 0) || !(metrics.height > 0) || metrics.width * metrics.height > this._opts.pixelLimit) {\n        throw new RangeError('PNG exceeds pixel limit or has invalid dimensions');\n      }\n      const blob = new Blob([bytes as BlobPart], { type: 'image/png' });\n      if (!window.createImageBitmap) {\n        const url = URL.createObjectURL(blob);\n        const img = new Image();\n        return new Promise<ImageBitmap>((resolve, reject) => {\n          img.addEventListener('load', () => {\n            URL.revokeObjectURL(url);\n            const canvas = ImageRenderer.createCanvas(window.document, img.width, img.height);\n            canvas.getContext('2d')?.drawImage(img, 0, 0);\n            createImageBitmap(canvas).then(resolve).catch(reject);\n          });\n          img.addEventListener('error', () => {\n            URL.revokeObjectURL(url);\n            reject(new Error('Failed to load image'));\n          });\n          img.src = url;\n        });\n      }\n      return createImageBitmap(blob);\n    }\n\n    // Raw pixel data\n    const width = image.width;\n    const height = image.height;\n\n    if (!width || !height) {\n      throw new Error('Width and height required for raw pixel data');\n    }\n\n    const bytesPerPixel = image.format === KittyFormat.RGBA ? KittyPixelConstants.BYTES_PER_PIXEL_RGBA : KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n    const expectedBytes = width * height * bytesPerPixel;\n\n    if (bytes.length < expectedBytes) {\n      throw new Error('Insufficient pixel data');\n    }\n\n    const pixelCount = width * height;\n\n    if (image.format === KittyFormat.RGBA) {\n      // RGBA: use bytes directly \u2014 no copy needed\n      return createImageBitmap(new ImageData(new Uint8ClampedArray(bytes.buffer as ArrayBuffer, bytes.byteOffset, pixelCount * KittyPixelConstants.BYTES_PER_PIXEL_RGBA), width, height));\n    }\n\n    // RGB\u2192RGBA: interleave alpha using uint32 block processing (4 pixels per iteration).\n    // 3 uint32 reads + 4 uint32 writes per 4 pixels vs 28 byte reads/writes \u2014 ~6x faster.\n    // Assumes little-endian (all modern browsers/Node.js).\n    const data = new Uint8ClampedArray(pixelCount * KittyPixelConstants.BYTES_PER_PIXEL_RGBA);\n    const src32 = new Uint32Array(bytes.buffer, bytes.byteOffset, Math.floor(bytes.byteLength / 4));\n    const dst32 = new Uint32Array(data.buffer);\n    const alignedPixels = pixelCount & ~3;  // round down to multiple of 4\n\n    let srcOffset = 0;\n    let dstOffset = 0;\n    for (let i = 0; i < alignedPixels; i += 4) {\n      const b0 = src32[srcOffset++];\n      const b1 = src32[srcOffset++];\n      const b2 = src32[srcOffset++];\n      // Little-endian: pixel bytes are [R,G,B] \u2192 uint32 ABGR layout\n      dst32[dstOffset++] = 0xFF000000 | b0;\n      dst32[dstOffset++] = 0xFF000000 | (b0 >>> 24) | (b1 << 8);\n      dst32[dstOffset++] = 0xFF000000 | (b1 >>> 16) | (b2 << 16);\n      dst32[dstOffset++] = 0xFF000000 | (b2 >>> 8);\n    }\n\n    // Handle remaining 1\u20133 pixels\n    let srcByte = alignedPixels * KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n    let dstByte = alignedPixels * KittyPixelConstants.BYTES_PER_PIXEL_RGBA;\n    for (let i = alignedPixels; i < pixelCount; i++) {\n      data[dstByte]     = bytes[srcByte];\n      data[dstByte + 1] = bytes[srcByte + 1];\n      data[dstByte + 2] = bytes[srcByte + 2];\n      data[dstByte + 3] = KittyPixelConstants.ALPHA_OPAQUE;\n      srcByte += KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n      dstByte += KittyPixelConstants.BYTES_PER_PIXEL_RGBA;\n    }\n\n    return createImageBitmap(new ImageData(data, width, height));\n  }\n\n  private async _decompressZlib(compressed: Uint8Array): Promise<Uint8Array> {\n    try {\n      return await this._decompress(compressed, 'deflate');\n    } catch (error) {\n      if (error instanceof RangeError) throw error;\n      return await this._decompress(compressed, 'deflate-raw');\n    }\n  }\n\n  private async _decompress(compressed: Uint8Array, format: 'deflate' | 'deflate-raw'): Promise<Uint8Array> {\n    const limit = Math.min(this._opts.kittySizeLimit, this._opts.pixelLimit * 4, this._opts.storageLimit * 1000000);\n    let offsetIn = 0;\n    // Bound inflation within one native transform before its output is budgeted.\n    const source = new ReadableStream<BufferSource>({\n      pull(controller) {\n        if (offsetIn >= compressed.length) {\n          controller.close();\n          return;\n        }\n        const end = Math.min(offsetIn + 4096, compressed.length);\n        controller.enqueue(new Uint8Array(compressed.subarray(offsetIn, end)));\n        offsetIn = end;\n      }\n    });\n    const reader = source.pipeThrough(new DecompressionStream(format)).getReader();\n    const chunks: Uint8Array[] = [];\n    let totalLength = 0;\n    try {\n      while (true) {\n        const { done, value } = await reader.read();\n        if (done) break;\n        totalLength += value.byteLength;\n        if (totalLength > limit) {\n          await reader.cancel().catch(() => {});\n          throw new RangeError('decompressed image exceeds byte limit');\n        }\n        chunks.push(value);\n      }\n    } finally {\n      reader.releaseLock();\n    }\n\n    const result = new Uint8Array(totalLength);\n    let offset = 0;\n    for (const chunk of chunks) {\n      result.set(chunk, offset);\n      offset += chunk.length;\n    }\n    return result;\n  }\n\n  public get images(): ReadonlyMap<number, IKittyImageData> {\n    return this._kittyStorage.images;\n  }\n\n  public get _kittyIdToStorageId(): ReadonlyMap<number, number> {\n    return this._kittyStorage.kittyIdToStorageId;\n  }\n\n  public get pendingTransmissions(): ReadonlyMap<number, IPendingTransmission> {\n    return this._pendingTransmissions;\n  }\n}\n", "/**\n * Copyright (c) 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n *\n * Kitty graphics protocol types, constants, and parsing utilities.\n */\n\nimport type Base64Decoder from 'xterm-wasm-parts/lib/base64/Base64Decoder.wasm';\n\n// Kitty graphics protocol action types.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference under key 'a'.\nexport const enum KittyAction {\n  TRANSMIT = 't',\n  TRANSMIT_DISPLAY = 'T',\n  QUERY = 'q',\n  PLACEMENT = 'p',\n  DELETE = 'd'\n}\n\n// Kitty graphics protocol format types.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference\nexport const enum KittyFormat {\n  RGB = 24,\n  RGBA = 32,\n  PNG = 100\n}\n\n// Kitty graphics protocol compression types.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference under key 'o'.\nexport const enum KittyCompression {\n  NONE = '',\n  ZLIB = 'z'\n}\n\n// Kitty graphics protocol control data keys.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference\nexport const enum KittyKey {\n  // Action to perform (t=transmit, T=transmit+display, q=query, p=placement, d=delete)\n  ACTION = 'a',\n  // Image format (24=RGB, 32=RGBA, 100=PNG)\n  FORMAT = 'f',\n  // Image ID for referencing stored images\n  ID = 'i',\n  // Image number (alternative to ID, terminal assigns ID)\n  IMAGE_NUMBER = 'I',\n  // Source image width in pixels\n  WIDTH = 's',\n  // Source image height in pixels\n  HEIGHT = 'v',\n  // The left edge (in pixels) of the image area to display\n  X_OFFSET = 'x',\n  // The top edge (in pixels) of the image area to display\n  Y_OFFSET = 'y',\n  // Width (in pixels) of the source rectangle to display\n  SOURCE_WIDTH = 'w',\n  // Height (in pixels) of the source rectangle to display\n  SOURCE_HEIGHT = 'h',\n  // Horizontal offset (in pixels) within the first cell\n  X_PLACEMENT_OFFSET = 'X',\n  // Vertical offset (in pixels) within the first cell\n  Y_PLACEMENT_OFFSET = 'Y',\n  // Number of terminal columns to display the image over\n  COLUMNS = 'c',\n  // Number of terminal rows to display the image over\n  ROWS = 'r',\n  // More data flag (1=more chunks coming, 0=final chunk)\n  MORE = 'm',\n  // Compression type (z=zlib). This is essential for chunking larger images.\n  COMPRESSION = 'o',\n  // Quiet mode (1=suppress OK responses, 2=suppress error responses)\n  QUIET = 'q',\n  // Cursor movement policy (0=move cursor after image, 1=don't move cursor)\n  CURSOR_MOVEMENT = 'C',\n  // Z-index for image layering (negative = behind text, 0+ = on top)\n  Z_INDEX = 'z',\n  // Transmission medium (d=direct, f=file, t=temp file, s=shared memory)\n  TRANSMISSION = 't',\n  // Delete selector (a/A=all, i/I=by id, c/C=at cursor, etc.) \u2014 only used when a=d\n  DELETE_SELECTOR = 'd',\n  // Placement ID for targeting specific placements\n  PLACEMENT_ID = 'p'\n}\n\n// Pixel format constants\nexport const enum KittyPixelConstants {\n  BYTES_PER_PIXEL_RGB = 3,\n  BYTES_PER_PIXEL_RGBA = 4,\n  ALPHA_OPAQUE = 255\n}\n\n// Parsed Kitty graphics command.\nexport interface IKittyCommand {\n  action?: string;\n  format?: number;\n  id?: number;\n  imageNumber?: number;\n  width?: number;\n  height?: number;\n  x?: number;\n  y?: number;\n  sourceWidth?: number;\n  sourceHeight?: number;\n  xOffset?: number;\n  yOffset?: number;\n  columns?: number;\n  rows?: number;\n  more?: number;\n  quiet?: number;\n  cursorMovement?: number;\n  zIndex?: number;\n  transmission?: string;\n  deleteSelector?: string;\n  placementId?: number;\n  compression?: string;\n  payload?: string;\n}\n\n// Pending chunked transmission state.\n// Stores metadata from the first chunk while accumulating decoded payload data.\nexport interface IPendingTransmission {\n  // The parsed command from the first chunk (contains action, format, dimensions, etc.)\n  cmd: IKittyCommand;\n  // Decoder used across chunked payloads\n  decoder: Base64Decoder;\n  // Total encoded (base64) bytes received across all chunks - for size limit enforcement\n  totalEncodedSize: number;\n  // Whether any chunk has failed to decode\n  decodeError: boolean;\n}\n\n// Stored Kitty image data.\nexport interface IKittyImageData {\n  id: number;\n  // Decoded image data stored as Blob (off JS heap) to avoid 2GB heap limit\n  data: Blob;\n  width: number;\n  height: number;\n  format: 24 | 32 | 100;\n  compression?: string;\n}\n\n// Parses Kitty graphics control data into a command object.\nexport function parseKittyCommand(data: string): IKittyCommand {\n  const cmd: IKittyCommand = {};\n  const parts = data.split(',');\n\n  for (const part of parts) {\n    const eqIdx = part.indexOf('=');\n    if (eqIdx === -1) continue;\n\n    const key = part.substring(0, eqIdx);\n    const value = part.substring(eqIdx + 1);\n\n    // Handle string keys first\n    if (key === KittyKey.ACTION) {\n      cmd.action = value;\n      continue;\n    }\n    if (key === KittyKey.COMPRESSION) {\n      cmd.compression = value;\n      continue;\n    }\n    if (key === KittyKey.TRANSMISSION) {\n      cmd.transmission = value;\n      continue;\n    }\n    if (key === KittyKey.DELETE_SELECTOR) {\n      cmd.deleteSelector = value;\n      continue;\n    }\n    const numValue = parseInt(value, 10);\n    switch (key) {\n      case KittyKey.FORMAT: cmd.format = numValue; break;\n      case KittyKey.ID: cmd.id = numValue; break;\n      case KittyKey.IMAGE_NUMBER: cmd.imageNumber = numValue; break;\n      case KittyKey.WIDTH: cmd.width = numValue; break;\n      case KittyKey.HEIGHT: cmd.height = numValue; break;\n      case KittyKey.X_OFFSET: cmd.x = numValue; break;\n      case KittyKey.Y_OFFSET: cmd.y = numValue; break;\n      case KittyKey.SOURCE_WIDTH: cmd.sourceWidth = numValue; break;\n      case KittyKey.SOURCE_HEIGHT: cmd.sourceHeight = numValue; break;\n      case KittyKey.X_PLACEMENT_OFFSET: cmd.xOffset = numValue; break;\n      case KittyKey.Y_PLACEMENT_OFFSET: cmd.yOffset = numValue; break;\n      case KittyKey.COLUMNS: cmd.columns = numValue; break;\n      case KittyKey.ROWS: cmd.rows = numValue; break;\n      case KittyKey.MORE: cmd.more = numValue; break;\n      case KittyKey.QUIET: cmd.quiet = numValue; break;\n      case KittyKey.CURSOR_MOVEMENT: cmd.cursorMovement = numValue; break;\n      case KittyKey.Z_INDEX: cmd.zIndex = numValue; break;\n      case KittyKey.PLACEMENT_ID: cmd.placementId = numValue; break;\n    }\n  }\n\n  return cmd;\n}\n", "/**\n * Copyright (c) 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IDisposable } from '@xterm/xterm';\nimport { ImageStorage } from '../ImageStorage';\nimport { ImageLayer, IAddImageOpts } from '../Types';\nimport { IKittyImageData } from './KittyGraphicsTypes';\n\n// Kitty-specific image storage controller.\n//\n// Wraps shared ImageStorage with kitty protocol semantics:\n// - tracks transmitted image payloads by kitty image id\n// - tracks kitty image id -> shared ImageStorage id mapping for displayed images\n// - mirrors shared-storage evictions into kitty maps\n// - applies protocol-level undisplayed-image eviction policy\nexport class KittyImageStorage implements IDisposable {\n  private static readonly _maxStoredImages = 256;\n\n  private _nextImageId = 1;\n  private readonly _images: Map<number, IKittyImageData> = new Map();\n  // TODO: Support multiple placements per image. The kitty spec identifies\n  // placements by an (image id, placement id) pair \u2014 same i + different p\n  // values should coexist, and same i + same p should replace the prior\n  // placement. Currently we track only one storage entry per kitty image id,\n  // so multiple placements of the same image overwrite each other. Fixing\n  // this requires changing these maps to Map<number, Map<number, number>>\n  // (kittyId \u2192 placementId \u2192 storageId) and updating addImage/deleteById\n  // accordingly. The underlying shared ImageStorage would also need to\n  // support multiple entries per logical image.\n  private readonly _kittyIdToStorageId: Map<number, number> = new Map();\n  private readonly _storageIdToKittyId: Map<number, number> = new Map();\n\n  private readonly _previousOnImageDeleted: ((storageId: number) => void) | undefined;\n  private readonly _wrappedOnImageDeleted: (storageId: number) => void;\n  private readonly _handleStorageImageDeleted = (storageId: number): void => {\n    const kittyId = this._storageIdToKittyId.get(storageId);\n    if (kittyId !== undefined) {\n      this._kittyIdToStorageId.delete(kittyId);\n      this._storageIdToKittyId.delete(storageId);\n      this._images.delete(kittyId);\n    }\n  };\n  private _addImageOpts: IAddImageOpts = { scrolling: true, layer: 'top', zIndex: 0, cursorPos: 'iip' };\n\n  constructor(\n    private readonly _storage: ImageStorage\n  ) {\n    this._previousOnImageDeleted = this._storage.onImageDeleted;\n    this._wrappedOnImageDeleted = (storageId: number) => {\n      this._previousOnImageDeleted?.(storageId);\n      this._handleStorageImageDeleted(storageId);\n    };\n    this._storage.onImageDeleted = this._wrappedOnImageDeleted;\n  }\n\n  public reset(): void {\n    this._nextImageId = 1;\n    this._images.clear();\n    this._kittyIdToStorageId.clear();\n    this._storageIdToKittyId.clear();\n  }\n\n  public dispose(): void {\n    this.reset();\n    if (this._storage.onImageDeleted === this._wrappedOnImageDeleted) {\n      this._storage.onImageDeleted = this._previousOnImageDeleted;\n    }\n  }\n\n  public storeImage(id: number | undefined, imageData: Omit<IKittyImageData, 'id'>): number {\n    const imageId = id ?? this._nextImageId++;\n\n    const oldStorageId = this._kittyIdToStorageId.get(imageId);\n    if (oldStorageId !== undefined) {\n      this._storage.deleteImage(oldStorageId);\n      this._kittyIdToStorageId.delete(imageId);\n      this._storageIdToKittyId.delete(oldStorageId);\n    }\n\n    if (!this._images.has(imageId) && this._images.size >= KittyImageStorage._maxStoredImages) {\n      this._evictUndisplayedImages();\n    }\n\n    // Encoded images awaiting placement are outside ImageStorage's pixel budget.\n    // Unplaced payloads are evicted first so a new upload cannot erase a visible\n    // image while abandoned blobs still hold budget; placed ones go only when\n    // that is not enough, because the byte cap is a hard bound. The new image is\n    // always stored, so an oversized one overshoots by at most one payload\n    // (itself bounded by kittySizeLimit) rather than being dropped after an OK ack.\n    const byteLimit = this._storage.getLimit() * 1000000;\n    this._images.delete(imageId);\n    let retainedBytes = 0;\n    for (const image of this._images.values()) retainedBytes += image.data.size;\n    for (const evictPlaced of [false, true]) {\n      for (const [oldestId, image] of this._images) {\n        if (retainedBytes + imageData.data.size <= byteLimit) break;\n        if (this._kittyIdToStorageId.has(oldestId) !== evictPlaced) continue;\n        retainedBytes -= image.data.size;\n        this.deleteById(oldestId);\n      }\n    }\n\n    this._images.set(imageId, {\n      ...imageData,\n      id: imageId\n    });\n    return imageId;\n  }\n\n  public addImage(kittyId: number, image: HTMLCanvasElement | ImageBitmap, scrolling: boolean, layer: ImageLayer, zIndex: number): void {\n    // Clean up stale reverse-mapping from a previous placement of the same\n    // kitty image.  The old shared-storage entry is kept (it may still be\n    // visible on screen) but its reverse mapping is removed so that eviction\n    // of the old entry won't incorrectly delete the kitty image data.\n    const oldStorageId = this._kittyIdToStorageId.get(kittyId);\n    if (oldStorageId !== undefined) {\n      this._storageIdToKittyId.delete(oldStorageId);\n    }\n    this._addImageOpts.scrolling = scrolling;\n    this._addImageOpts.layer = layer;\n    this._addImageOpts.zIndex = zIndex;\n    const storageId = this._storage.addImage(image, this._addImageOpts);\n    this._kittyIdToStorageId.set(kittyId, storageId);\n    this._storageIdToKittyId.set(storageId, kittyId);\n  }\n\n  public getImage(kittyId: number): IKittyImageData | undefined {\n    return this._images.get(kittyId);\n  }\n\n  public deleteById(kittyId: number): void {\n    this._images.delete(kittyId);\n    const storageId = this._kittyIdToStorageId.get(kittyId);\n    if (storageId !== undefined) {\n      this._storage.deleteImage(storageId);\n      this._kittyIdToStorageId.delete(kittyId);\n      this._storageIdToKittyId.delete(storageId);\n    }\n  }\n\n  public deleteAll(): void {\n    this._images.clear();\n    for (const storageId of this._kittyIdToStorageId.values()) {\n      this._storage.deleteImage(storageId);\n    }\n    this._kittyIdToStorageId.clear();\n    this._storageIdToKittyId.clear();\n  }\n\n  public get images(): ReadonlyMap<number, IKittyImageData> {\n    return this._images;\n  }\n\n  public get kittyIdToStorageId(): ReadonlyMap<number, number> {\n    return this._kittyIdToStorageId;\n  }\n\n  public get lastImageId(): number {\n    return this._nextImageId - 1;\n  }\n\n  private _evictUndisplayedImages(): void {\n    for (const [kittyId] of this._images) {\n      if (this._images.size <= KittyImageStorage._maxStoredImages / 2) {\n        break;\n      }\n      if (!this._kittyIdToStorageId.has(kittyId)) {\n        this._images.delete(kittyId);\n      }\n    }\n  }\n}\n", "/**\n * Copyright (c) 2020, 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { SixelImageStorage } from './SixelImageStorage';\nimport { IDcsHandler, IParams, IImageAddonOptions, ITerminalExt, AttributeData, IResetHandler, ReadonlyColorSet } from './Types';\nimport { toRGBA8888, BIG_ENDIAN, PALETTE_ANSI_256, PALETTE_VT340_COLOR } from 'sixel/lib/Colors';\nimport { RGBA8888 } from 'sixel/lib/Types';\nimport { ImageRenderer } from './ImageRenderer';\n\nimport { DecoderAsync, Decoder } from 'sixel/lib/Decoder';\n\n// always free decoder ressources after decoding if it exceeds this limit\nconst MEM_PERMA_LIMIT = 4194304; // 1024 pixels * 1024 pixels * 4 channels = 4MB\n\n// custom default palette: VT340 (lower 16 colors) + ANSI256 (up to 256) + zeroed (up to 4096)\nconst DEFAULT_PALETTE = PALETTE_ANSI_256;\nDEFAULT_PALETTE.set(PALETTE_VT340_COLOR);\n\n\nexport class SixelHandler implements IDcsHandler, IResetHandler {\n  private _size = 0;\n  private _aborted = false;\n  private _dec: Decoder | undefined;\n\n  constructor(\n    private readonly _opts: IImageAddonOptions,\n    private readonly _storage: SixelImageStorage,\n    private readonly _coreTerminal: ITerminalExt\n  ) {\n    DecoderAsync({\n      memoryLimit: this._opts.pixelLimit * 4,\n      palette: DEFAULT_PALETTE,\n      paletteLimit: this._opts.sixelPaletteLimit\n    }).then(d => this._dec = d);\n  }\n\n  public reset(): void {\n    /**\n     * reset sixel decoder to defaults:\n     * - release all memory\n     * - nullify palette (4096)\n     * - apply default palette (256)\n     */\n    if (this._dec) {\n      this._dec.release();\n      // FIXME: missing interface on decoder to nullify full palette\n      (this._dec as any)._palette.fill(0);\n      this._dec.init(0, DEFAULT_PALETTE, this._opts.sixelPaletteLimit);\n    }\n  }\n\n  public hook(params: IParams): void {\n    this._size = 0;\n    this._aborted = false;\n    if (this._dec) {\n      const fillColor = params.params[1] === 1 ? 0 : extractActiveBg(\n        this._coreTerminal._core._inputHandler._curAttrData,\n        this._coreTerminal._core._themeService?.colors);\n      this._dec.init(fillColor, null, this._opts.sixelPaletteLimit);\n    }\n  }\n\n  public put(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted || !this._dec) {\n      return;\n    }\n    this._size += end - start;\n    if (this._size > this._opts.sixelSizeLimit) {\n      console.warn(`SIXEL: too much data, aborting`);\n      this._aborted = true;\n      this._dec.release();\n      return;\n    }\n    try {\n      this._dec.decode(data, start, end);\n    } catch (e) {\n      console.warn(`SIXEL: error while decoding image - ${e}`);\n      this._aborted = true;\n      this._dec.release();\n    }\n  }\n\n  public unhook(success: boolean): boolean | Promise<boolean> {\n    if (this._aborted || !success || !this._dec) {\n      return true;\n    }\n\n    const width = this._dec.width;\n    const height = this._dec.height;\n\n    // partial fix for https://github.com/jerch/xterm-addon-image/issues/37\n    if (!width || !height) {\n      if (height) {\n        this._storage.advanceCursor(height);\n      }\n      return true;\n    }\n\n    const canvas = ImageRenderer.createCanvas(undefined, width, height);\n    canvas.getContext('2d')?.putImageData(new ImageData(this._dec.data8 as Uint8ClampedArray<ArrayBuffer>, width, height), 0, 0);\n    if (this._dec.memoryUsage > MEM_PERMA_LIMIT) {\n      this._dec.release();\n    }\n    this._storage.addImage(canvas);\n    return true;\n  }\n}\n\n\n/**\n * Some helpers to extract current terminal colors.\n */\n\n// get currently active background color from terminal\n// also respect INVERSE setting\nfunction extractActiveBg(attr: AttributeData, colors: ReadonlyColorSet | undefined): RGBA8888 {\n  let bg = 0;\n  if (!colors) {\n    // FIXME: theme service is prolly not available yet,\n    // happens if .open() was not called yet (bug in core?)\n    return bg;\n  }\n  if (attr.isInverse()) {\n    if (attr.isFgDefault()) {\n      bg = convertLe(colors.foreground.rgba);\n    } else if (attr.isFgRGB()) {\n      const t = (attr.constructor as typeof AttributeData).toColorRGB(attr.getFgColor());\n      bg = toRGBA8888(...t);\n    } else {\n      bg = convertLe(colors.ansi[attr.getFgColor()].rgba);\n    }\n  } else {\n    if (attr.isBgDefault()) {\n      bg = convertLe(colors.background.rgba);\n    } else if (attr.isBgRGB()) {\n      const t = (attr.constructor as typeof AttributeData).toColorRGB(attr.getBgColor());\n      bg = toRGBA8888(...t);\n    } else {\n      bg = convertLe(colors.ansi[attr.getBgColor()].rgba);\n    }\n  }\n  return bg;\n}\n\n// rgba values on the color managers are always in BE, thus convert to LE\nfunction convertLe(color: number): RGBA8888 {\n  if (BIG_ENDIAN) return color;\n  return (color & 0xFF) << 24 | (color >>> 8 & 0xFF) << 16 | (color >>> 16 & 0xFF) << 8 | color >>> 24 & 0xFF;\n}\n", "/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { ImageStorage, CELL_SIZE_DEFAULT } from './ImageStorage';\nimport { IImageAddonOptions, ITerminalExt, IAddImageOpts } from './Types';\nimport { ImageRenderer } from './ImageRenderer';\n\n/**\n * Sixel-specific image storage controller.\n *\n * Wraps the shared ImageStorage with sixel protocol semantics:\n * - Cursor behavior governed by DECSET 80 (sixelScrolling option)\n * - advanceCursor for empty sixels carrying only height\n */\nexport class SixelImageStorage {\n  private _addImageOpts: IAddImageOpts = { scrolling: true, layer: 'top', zIndex: 0, cursorPos: 'vt340' };\n  constructor(\n    private readonly _storage: ImageStorage,\n    private readonly _opts: IImageAddonOptions,\n    private readonly _renderer: ImageRenderer,\n    private readonly _terminal: ITerminalExt\n  ) {}\n\n  /**\n   * Add a sixel image to storage.\n   * Cursor behavior depends on the sixelScrolling option (DECSET 80).\n   */\n  public addImage(img: HTMLCanvasElement | ImageBitmap): void {\n    this._addImageOpts.scrolling = this._opts.sixelScrolling;\n    this._storage.addImage(img, this._addImageOpts);\n  }\n\n  /**\n   * Only advance text cursor.\n   * This is an edge case from empty sixels carrying only a height but no pixels.\n   * Partially fixes https://github.com/jerch/xterm-addon-image/issues/37.\n   */\n  public advanceCursor(height: number): void {\n    if (this._opts.sixelScrolling) {\n      let cellSize = this._renderer.cellSize;\n      if (cellSize.width === -1 || cellSize.height === -1) {\n        cellSize = CELL_SIZE_DEFAULT;\n      }\n      const rows = Math.ceil(height / cellSize.height);\n      for (let i = 1; i < rows; ++i) {\n        this._terminal._core._inputHandler.lineFeed();\n      }\n    }\n  }\n}\n", "/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IAddImageOpts } from './Types';\nimport { ImageStorage } from './ImageStorage';\n\n/**\n * IIP (iTerm Image Protocol) specific image storage controller.\n *\n * Wraps the shared ImageStorage with IIP protocol semantics:\n * - Always uses scrolling mode (cursor advances with image)\n */\nexport class IIPImageStorage {\n  private _addImageOpts: IAddImageOpts = { scrolling: true, layer: 'top', zIndex: 0, cursorPos: 'iip' };\n  constructor(\n    private readonly _storage: ImageStorage\n  ) {}\n\n  /**\n   * Add an IIP image to storage.\n   * Always uses scrolling mode \u2014 cursor advances past the image.\n   */\n  public addImage(img: HTMLCanvasElement | ImageBitmap): void {\n    this._storage.addImage(img, this._addImageOpts);\n  }\n}\n", "/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport type { ITerminalAddon, IDisposable } from '@xterm/xterm';\nimport type { ImageAddon as IImageApi } from '@xterm/addon-image';\nimport { Emitter, type IEvent } from 'common/Event';\nimport { IIPHandler } from './IIPHandler';\nimport { ImageRenderer } from './ImageRenderer';\nimport { ImageStorage, CELL_SIZE_DEFAULT } from './ImageStorage';\nimport { KittyGraphicsHandler } from './kitty/KittyGraphicsHandler';\nimport { KittyImageStorage } from './kitty/KittyImageStorage';\nimport { SixelHandler } from './SixelHandler';\nimport { SixelImageStorage } from './SixelImageStorage';\nimport { IIPImageStorage } from './IIPImageStorage';\nimport { ITerminalExt, IImageAddonOptions, IResetHandler } from './Types';\n\n\n/**\n * Document VT features provided by this addon.\n *\n * @vt: #E[Supported via @xterm/addon-image.] DCS SIXEL \"SIXEL Graphics\"  \"DCS Ps ; Ps ; Ps ; q Pt ST\"  \"Draw SIXEL image.\"\n *\n * Sixel support is provided by the addon @xterm/addon-image with these limitations:\n * - immediate coloring (no shared palette, allows high color settings of `img2sixel`)\n * - max. palette size of 4096 colors\n * - max. pixel width of 16K\n * - max. 25 MB per sixel sequence\n * - VT340 cursor positioning (begin of last sixel data row)\n *\n * See [addon readme](https://github.com/xtermjs/xterm.js/tree/master/addons/addon-image) for more details.\n *\n *\n * @vt: #E[Supported via @xterm/addon-image.] OSC 1337  \"iTerm2 Commands\"   \"OSC 1337 ; Pt BEL\"  \"Custom iTerm2 commands.\"\n *\n * Only the inline image protocol (IIP) is supported by the addon @xterm/addon-image with\n * the following limitations:\n * - sequence:\n *   - format: `OSC 1337 ; File=inline=1 ; size=<unencoded size> ; ... : <base64 payload> BEL`\n *   - size param must be set and payload may not exceed CEIL(size * 4 / 3)\n *   - strict base64 handling as of RFC4648 \u00A74 (standard alphabet, optional padding,\n *     no separator bytes allowed)\n *   - supported params: size, name, width, height, preserveAspectRatio\n * - image formats: PNG, JPEG and GIF\n * - no animation support (renders first image of a GIF)\n * - no multipart support\n * - VT340 cursor positioning (begin of last sixel data row)\n *\n * See [addon readme](https://github.com/xtermjs/xterm.js/tree/master/addons/addon-image)\n * and [iTerm2 IIP docs](https://iterm2.com/documentation-images.html) for more details.\n *\n *\n * @vt: #E[Supported via @xterm/addon-image.] APC KITTY_GRAPHICS \"Kitty Graphics\"  \"APC G Pt ST\"  \"Kitty Graphics Protocol.\"\n *\n * Kitty graphics support is provided by the addon @xterm/addon-image.\n * Note that while basic image output already works, this is still work in progress.\n */\n\n// default values of addon ctor options\nconst DEFAULT_OPTIONS: IImageAddonOptions = {\n  enableSizeReports: true,\n  pixelLimit: 16777216, // limit to 4096 * 4096 pixels\n  sixelSupport: true,\n  sixelScrolling: true,\n  sixelPaletteLimit: 4096,\n  sixelSizeLimit: 33554432,\n  storageLimit: 128,\n  showPlaceholder: true,\n  iipSupport: true,\n  iipSizeLimit: 33554432,\n  kittySupport: true,\n  kittySizeLimit: 33554432\n};\n\n// max palette size supported by the sixel lib (compile time setting)\nconst MAX_SIXEL_PALETTE_SIZE = 4096;\n\n// definitions for _xtermGraphicsAttributes sequence\nconst enum GaItem {\n  COLORS = 1,\n  SIXEL_GEO = 2,\n  REGIS_GEO = 3\n}\nconst enum GaAction {\n  READ = 1,\n  SET_DEFAULT = 2,\n  SET = 3,\n  READ_MAX = 4\n}\nconst enum GaStatus {\n  SUCCESS = 0,\n  ITEM_ERROR = 1,\n  ACTION_ERROR = 2,\n  FAILURE = 3\n}\n\n\nexport class ImageAddon implements ITerminalAddon, IImageApi {\n  private _opts: IImageAddonOptions;\n  private _defaultOpts: IImageAddonOptions;\n  private _storage: ImageStorage | undefined;\n  private _renderer: ImageRenderer | undefined;\n  private _disposables: IDisposable[] = [];\n  private _terminal: ITerminalExt | undefined;\n  private _handlers: Map<String, IResetHandler> = new Map();\n  private readonly _onImageAdded = new Emitter<void>();\n  public readonly onImageAdded: IEvent<void> = this._onImageAdded.event;\n\n  constructor(opts?: Partial<IImageAddonOptions>) {\n    this._opts = Object.assign({}, DEFAULT_OPTIONS, opts);\n    this._defaultOpts = Object.assign({}, DEFAULT_OPTIONS, opts);\n  }\n\n  public dispose(): void {\n    for (const handler of this._handlers.values()) handler.reset();\n    for (const obj of this._disposables) {\n      obj.dispose();\n    }\n    this._disposables.length = 0;\n    this._handlers.clear();\n    this._onImageAdded.dispose();\n  }\n\n  private _disposeLater(...args: IDisposable[]): void {\n    for (const obj of args) {\n      this._disposables.push(obj);\n    }\n  }\n\n  public activate(terminal: ITerminalExt): void {\n    this._terminal = terminal;\n\n    // internal data structures\n    this._renderer = new ImageRenderer(terminal);\n    this._storage = new ImageStorage(terminal, this._renderer, this._opts);\n    this._storage.onImageAdded = () => this._onImageAdded.fire();\n\n    // enable size reports\n    if (this._opts.enableSizeReports) {\n      const windowOps = terminal.options.windowOptions ?? {};\n      windowOps.getWinSizePixels = true;\n      windowOps.getCellSizePixels = true;\n      windowOps.getWinSizeChars = true;\n      terminal.options.windowOptions = windowOps;\n    }\n\n    this._disposeLater(\n      this._renderer,\n      this._storage,\n\n      // DECSET/DECRST/DA1/XTSMGRAPHICS handlers\n      terminal.parser.registerCsiHandler({ prefix: '?', final: 'h' }, params => this._decset(params)),\n      terminal.parser.registerCsiHandler({ prefix: '?', final: 'l' }, params => this._decrst(params)),\n      terminal.parser.registerCsiHandler({ final: 'c' }, params => this._da1(params)),\n      terminal.parser.registerCsiHandler({ prefix: '?', final: 'S' }, params => this._xtermGraphicsAttributes(params)),\n\n      // render hook\n      terminal.onRender(range => this._storage?.render(range)),\n\n      /**\n       * reset handlers covered:\n       * - DECSTR\n       * - RIS\n       * - Terminal.reset()\n       */\n      terminal.parser.registerCsiHandler({ intermediates: '!', final: 'p' }, () => this.reset()),\n      terminal.parser.registerEscHandler({ final: 'c' }, () => this.reset()),\n      terminal._core._inputHandler.onRequestReset(() => this.reset()),\n\n      // wipe canvas and delete alternate images on buffer switch\n      terminal.buffer.onBufferChange(() => this._storage?.wipeAlternate()),\n\n      // extend images to the right on resize\n      terminal.onResize(metrics => this._storage?.viewportResize(metrics))\n    );\n\n    // SIXEL handler\n    if (this._opts.sixelSupport) {\n      const sixelStorage = new SixelImageStorage(this._storage!, this._opts, this._renderer!, terminal);\n      const sixelHandler = new SixelHandler(this._opts, sixelStorage, terminal);\n      this._handlers.set('sixel', sixelHandler);\n      this._disposeLater(\n        terminal._core._inputHandler._parser.registerDcsHandler({ final: 'q' }, sixelHandler)\n      );\n    }\n\n    // iTerm IIP handler\n    if (this._opts.iipSupport) {\n      const iipStorage = new IIPImageStorage(this._storage!);\n      const iipHandler = new IIPHandler(this._opts, this._renderer!, iipStorage, terminal);\n      this._handlers.set('iip', iipHandler);\n      this._disposeLater(\n        terminal._core._inputHandler._parser.registerOscHandler(1337, iipHandler)\n      );\n    }\n\n    // Kitty graphics handler\n    if (this._opts.kittySupport) {\n      const kittyStorage = new KittyImageStorage(this._storage!);\n      const kittyHandler = new KittyGraphicsHandler(this._opts, this._renderer!, kittyStorage, terminal);\n      this._handlers.set('kitty', kittyHandler);\n      this._disposeLater(\n        kittyStorage,\n        kittyHandler,\n        terminal._core._inputHandler._parser.registerApcHandler({ final: 'G' }, kittyHandler)\n      );\n    }\n  }\n\n  // Note: storageLimit is skipped here to not intoduce a surprising side effect.\n  public reset(): boolean {\n    // reset options customizable by sequences to defaults\n    this._opts.sixelScrolling = this._defaultOpts.sixelScrolling;\n    this._opts.sixelPaletteLimit = this._defaultOpts.sixelPaletteLimit;\n    // also clear image storage\n    this._storage?.reset();\n    // reset protocol handlers\n    for (const handler of this._handlers.values()) {\n      handler.reset();\n    }\n    return false;\n  }\n\n  public get storageLimit(): number {\n    return this._storage?.getLimit() || -1;\n  }\n\n  public set storageLimit(limit: number) {\n    this._storage?.setLimit(limit);\n    this._opts.storageLimit = limit;\n  }\n\n  public get storageUsage(): number {\n    if (this._storage) {\n      return this._storage.getUsage();\n    }\n    return -1;\n  }\n\n  public get showPlaceholder(): boolean {\n    return this._opts.showPlaceholder;\n  }\n\n  public set showPlaceholder(value: boolean) {\n    this._opts.showPlaceholder = value;\n    this._renderer?.showPlaceholder(value);\n  }\n\n  public getImageAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    return this._storage?.getImageAtBufferCell(x, y);\n  }\n\n  public extractTileAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    return this._storage?.extractTileAtBufferCell(x, y);\n  }\n\n  private _report(s: string): void {\n    this._terminal?._core.input(s, false);\n  }\n\n  private _decset(params: (number | number[])[]): boolean {\n    for (let i = 0; i < params.length; ++i) {\n      switch (params[i]) {\n        case 80:\n          this._opts.sixelScrolling = false;\n          break;\n      }\n    }\n    return false;\n  }\n\n  private _decrst(params: (number | number[])[]): boolean {\n    for (let i = 0; i < params.length; ++i) {\n      switch (params[i]) {\n        case 80:\n          this._opts.sixelScrolling = true;\n          break;\n      }\n    }\n    return false;\n  }\n\n  // overload DA to return something more appropriate\n  private _da1(params: (number | number[])[]): boolean {\n    if (params[0]) {\n      return true;\n    }\n    // reported features:\n    // 62 - VT220\n    // 4 - SIXEL support\n    // 9 - charsets\n    // 22 - ANSI colors\n    if (this._opts.sixelSupport) {\n      this._report(`\\x1b[?62;4;9;22c`);\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * Implementation of xterm's graphics attribute sequence.\n   *\n   * Supported features:\n   * - read/change palette limits (max 4096 by sixel lib)\n   * - read SIXEL canvas geometry (reports current window canvas or\n   *   squared pixelLimit if canvas > pixel limit)\n   *\n   * Everything else is deactivated.\n   */\n  private _xtermGraphicsAttributes(params: (number | number[])[]): boolean {\n    if (params.length < 2) {\n      return true;\n    }\n    if (params[0] === GaItem.COLORS) {\n      switch (params[1]) {\n        case GaAction.READ:\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${this._opts.sixelPaletteLimit}S`);\n          return true;\n        case GaAction.SET_DEFAULT:\n          this._opts.sixelPaletteLimit = this._defaultOpts.sixelPaletteLimit;\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${this._opts.sixelPaletteLimit}S`);\n          // also reset protocol handlers for now\n          for (const handler of this._handlers.values()) {\n            handler.reset();\n          }\n          return true;\n        case GaAction.SET:\n          if (params.length > 2 && !(params[2] instanceof Array) && params[2] <= MAX_SIXEL_PALETTE_SIZE) {\n            this._opts.sixelPaletteLimit = params[2];\n            this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${this._opts.sixelPaletteLimit}S`);\n          } else {\n            this._report(`\\x1b[?${params[0]};${GaStatus.ACTION_ERROR}S`);\n          }\n          return true;\n        case GaAction.READ_MAX:\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${MAX_SIXEL_PALETTE_SIZE}S`);\n          return true;\n        default:\n          this._report(`\\x1b[?${params[0]};${GaStatus.ACTION_ERROR}S`);\n          return true;\n      }\n    }\n    if (params[0] === GaItem.SIXEL_GEO) {\n      switch (params[1]) {\n        // we only implement read and read_max here\n        case GaAction.READ:\n          let width = this._renderer?.dimensions?.css.canvas.width;\n          let height = this._renderer?.dimensions?.css.canvas.height;\n          if (!width || !height) {\n            // for some reason we have no working image renderer\n            // --> fallback to default cell size\n            const cellSize = CELL_SIZE_DEFAULT;\n            width = (this._terminal?.cols || 80) * cellSize.width;\n            height = (this._terminal?.rows || 24) * cellSize.height;\n          }\n          if (width * height < this._opts.pixelLimit) {\n            this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${width.toFixed(0)};${height.toFixed(0)}S`);\n          } else {\n            // if we overflow pixelLimit report that squared instead\n            const x = Math.floor(Math.sqrt(this._opts.pixelLimit));\n            this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${x};${x}S`);\n          }\n          return true;\n        case GaAction.READ_MAX:\n          // read_max returns pixelLimit as square area\n          const x = Math.floor(Math.sqrt(this._opts.pixelLimit));\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${x};${x}S`);\n          return true;\n        default:\n          this._report(`\\x1b[?${params[0]};${GaStatus.ACTION_ERROR}S`);\n          return true;\n      }\n    }\n    // exit with error on ReGIS or any other requests\n    this._report(`\\x1b[?${params[0]};${GaStatus.ITEM_ERROR}S`);\n    return true;\n  }\n}\n"],
-+  "mappings": ";;;;;;;;;;;;;;;;02BAYaA,EAAA,WAAa,IAAI,WAAW,IAAI,YAAY,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,IAAM,IAClFA,EAAA,YACF,QAAQ,KAAK,6EAA6E,EAI5F,SAAgBC,GAAIC,EAAW,CAC7B,OAAOA,EAAI,GACb,CAFAF,EAAA,IAAAC,GAIA,SAAgBE,GAAMD,EAAW,CAC/B,OAAQA,IAAM,EAAK,GACrB,CAFAF,EAAA,MAAAG,GAIA,SAAgBC,GAAKF,EAAW,CAC9B,OAAQA,IAAM,GAAM,GACtB,CAFAF,EAAA,KAAAI,GAIA,SAAgBC,GAAMH,EAAW,CAC/B,OAAQA,IAAM,GAAM,GACtB,CAFAF,EAAA,MAAAK,GAQA,SAAgBC,EAAWC,EAAWC,EAAWC,EAAWC,EAAY,IAAG,CACzE,QAASA,EAAI,MAAS,IAAMD,EAAI,MAAS,IAAMD,EAAI,MAAS,EAAKD,EAAI,OAAW,CAClF,CAFAP,EAAA,WAAAM,EAQA,SAAgBK,GAAaC,EAAe,CAC1C,MAAO,CAACA,EAAQ,IAAOA,GAAS,EAAK,IAAOA,GAAS,GAAM,IAAMA,IAAU,EAAE,CAC/E,CAFAZ,EAAA,aAAAW,GASA,SAAgBE,GAAkBD,EAAiBE,EAAmB,CACpE,IAAMP,EAAIN,GAAIW,CAAK,EACbJ,EAAIL,GAAMS,CAAK,EACfH,EAAIL,GAAKQ,CAAK,EAEhBG,EAAM,OAAO,iBACbC,EAAM,GAGV,QAASC,EAAI,EAAGA,EAAIH,EAAQ,OAAQ,EAAEG,EAAG,CACvC,IAAMC,EAAKX,EAAIO,EAAQG,CAAC,EAAE,CAAC,EACrBE,EAAKX,EAAIM,EAAQG,CAAC,EAAE,CAAC,EACrBG,EAAKX,EAAIK,EAAQG,CAAC,EAAE,CAAC,EACrB,EAAIC,EAAKA,EAAKC,EAAKA,EAAKC,EAAKA,EACnC,GAAI,CAAC,EAAG,OAAOH,EACX,EAAIF,IACNA,EAAM,EACNC,EAAMC,GAIV,OAAOD,CACT,CAtBAhB,EAAA,kBAAAa,GA4BA,SAASQ,GAAMC,EAAaC,EAAcC,EAAa,CACrD,OAAO,KAAK,IAAIF,EAAK,KAAK,IAAIE,EAAOD,CAAI,CAAC,CAC5C,CAEA,SAASE,GAAIC,EAAYC,EAAYC,EAAS,CAC5C,OAAIA,EAAI,IAAGA,GAAK,GACZA,EAAI,IAAGA,GAAK,GACTA,EAAI,EAAI,EACXD,GAAMD,EAAKC,GAAM,EAAIC,EACrBA,EAAI,EAAI,EACNF,EACAE,EAAI,EAAI,EACND,GAAMD,EAAKC,IAAO,EAAIC,EAAI,GAC1BD,CACV,CAEA,SAASE,GAASC,EAAWC,EAAWC,EAAS,CAC/C,GAAI,CAACA,EAAG,CACN,IAAMC,EAAI,KAAK,MAAMF,EAAI,GAAG,EAC5B,OAAOzB,EAAW2B,EAAGA,EAAGA,CAAC,EAE3B,IAAMP,EAAKK,EAAI,GAAMA,GAAK,EAAIC,GAAKD,EAAIC,EAAID,EAAIC,EACzCL,EAAK,EAAII,EAAIL,EACnB,OAAOpB,EACLe,GAAM,EAAG,IAAK,KAAK,MAAMI,GAAIC,EAAIC,EAAIG,EAAI,EAAI,CAAC,EAAI,GAAG,CAAC,EACtDT,GAAM,EAAG,IAAK,KAAK,MAAMI,GAAIC,EAAIC,EAAIG,CAAC,EAAI,GAAG,CAAC,EAC9CT,GAAM,EAAG,IAAK,KAAK,MAAMI,GAAIC,EAAIC,EAAIG,EAAI,EAAI,CAAC,EAAI,GAAG,CAAC,CAAC,CAE3D,CAKA,SAAgBI,EAAa3B,EAAWC,EAAWC,EAAS,CAC1D,OAAQ,WAAa,KAAK,MAAMA,EAAI,IAAM,GAAG,GAAK,GAAK,KAAK,MAAMD,EAAI,IAAM,GAAG,GAAK,EAAI,KAAK,MAAMD,EAAI,IAAM,GAAG,KAAO,CACzH,CAFAP,EAAA,aAAAkC,EAQA,SAAgBC,GAAaL,EAAWC,EAAWC,EAAS,CAE1D,OAAOH,IAAUC,EAAI,IAAM,KAAO,IAAKC,EAAI,IAAKC,EAAI,GAAG,CACzD,CAHAhC,EAAA,aAAAmC,GAqCanC,EAAA,oBAAsB,IAAI,YAAY,CACjDkC,EAAc,EAAI,EAAI,CAAC,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACxB,EA0BYlC,EAAA,mBAAqB,IAAI,YAAY,CAChDkC,EAAc,EAAI,EAAI,CAAC,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAc,EAAI,EAAI,CAAC,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAc,EAAI,EAAI,CAAC,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAc,EAAI,EAAI,CAAC,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACxB,EAOYlC,EAAA,kBAAoB,IAAK,CAEpC,IAAMoC,EAAgB,CACpB9B,EAAW,EAAG,EAAG,CAAC,EAClBA,EAAW,IAAK,EAAG,CAAC,EACpBA,EAAW,EAAG,IAAK,CAAC,EACpBA,EAAW,IAAK,IAAK,CAAC,EACtBA,EAAW,EAAG,EAAG,GAAG,EACpBA,EAAW,IAAK,EAAG,GAAG,EACtBA,EAAW,EAAG,IAAK,GAAG,EACtBA,EAAW,IAAK,IAAK,GAAG,EACxBA,EAAW,IAAK,IAAK,GAAG,EACxBA,EAAW,IAAK,EAAG,CAAC,EACpBA,EAAW,EAAG,IAAK,CAAC,EACpBA,EAAW,IAAK,IAAK,CAAC,EACtBA,EAAW,GAAI,GAAI,GAAG,EACtBA,EAAW,IAAK,EAAG,GAAG,EACtBA,EAAW,EAAG,IAAK,GAAG,EACtBA,EAAW,IAAK,IAAK,GAAG,GAGpB+B,EAAI,CAAC,EAAG,GAAI,IAAK,IAAK,IAAK,GAAG,EACpC,QAAS9B,EAAI,EAAGA,EAAI,EAAG,EAAEA,EACvB,QAASC,EAAI,EAAGA,EAAI,EAAG,EAAEA,EACvB,QAASC,EAAI,EAAGA,EAAI,EAAG,EAAEA,EACvB2B,EAAE,KAAK9B,EAAW+B,EAAE9B,CAAC,EAAG8B,EAAE7B,CAAC,EAAG6B,EAAE5B,CAAC,CAAC,CAAC,EAKzC,QAASwB,EAAI,EAAGA,GAAK,IAAKA,GAAK,GAC7BG,EAAE,KAAK9B,EAAW2B,EAAGA,EAAGA,CAAC,CAAC,EAE5B,OAAO,IAAI,YAAYG,CAAC,CAC1B,GAAE,EASWpC,EAAA,mBAA+BM,EAAW,EAAG,EAAG,EAAG,GAAG,EACtDN,EAAA,mBAA+BM,EAAW,IAAK,IAAK,IAAK,GAAG,IChRzE,IAAAgC,GAAAC,EAAAC,IAAA,cAKA,OAAO,eAAeA,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EAC5DA,GAAQ,OAASC,GACjB,IAAIC,EAAK,GAAM,CACX,GAAI,WAAW,WACX,OAAO,WAAW,WAAW,CAAC,EAClC,GAAI,OAAO,OAAW,IAClB,OAAO,OAAO,KAAK,EAAG,QAAQ,EAClC,IAAMC,EAAI,KAAK,CAAC,EACVC,EAAI,IAAI,WAAWD,EAAE,MAAM,EACjC,QAAS,EAAI,EAAG,EAAIC,EAAE,OAAQ,EAAE,EAC5BA,EAAE,CAAC,EAAID,EAAE,WAAW,CAAC,EACzB,OAAOC,CACX,EACA,SAASH,GAAOI,EAAK,CACjB,GAAIA,EAAI,EAAG,CACP,GAAM,CAAE,EAAAC,EAAG,EAAAC,EAAG,EAAAC,CAAE,EAAIH,EAChBF,EACAM,EACEC,EAAI,YACV,OAAIJ,IAAM,EACFC,EACQI,GAAM,IAAID,EAAE,SAASD,IAAMA,EAAI,IAAIC,EAAE,OAAOP,IAAMA,EAAID,EAAEM,CAAC,EAAE,GAAIG,CAAC,EACpEA,GAAMF,EACRC,EAAE,YAAYD,EAAGE,CAAC,EAClBD,EAAE,YAAYP,IAAMA,EAAID,EAAEM,CAAC,GAAIG,CAAC,EAAE,KAAKP,IAAMK,EAAIL,EAAE,SAAWA,EAAE,QAAQ,EAE9EE,IAAM,EACFC,EACO,IAAME,IAAMA,EAAI,IAAIC,EAAE,OAAOP,IAAMA,EAAID,EAAEM,CAAC,EAAE,GAChD,IAAMC,EACP,QAAQ,QAAQA,CAAC,EACjBC,EAAE,QAAQP,IAAMA,EAAID,EAAEM,CAAC,EAAE,EAAE,KAAKJ,GAAKK,EAAIL,CAAC,EAEhDG,EACO,IAAMJ,IAAMA,EAAID,EAAEM,CAAC,GACvB,IAAM,QAAQ,QAAQL,IAAMA,EAAID,EAAEM,CAAC,EAAE,CAChD,CACA,GAAI,OAAO,SAAa,IACpB,MAAM,IAAI,MAAM,mBAAmB,EACvC,SAAS,IAAIH,CAAG,CACpB,IC7CA,IAAAO,GAAAC,EAAAC,IAAA,cACA,OAAO,eAAeA,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EAK5D,IAAMC,GAAmB,KAInBC,MAAiBD,GAAiB,QAAuD,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,0lCAA0lC,CAA8C,EAuJ5uCE,EAAM,IAAI,WAAW,mEACtB,MAAM,EAAE,EACR,IAAIC,GAAMA,EAAG,WAAW,CAAC,CAAC,CAAC,EAE1BC,EAAI,IAAI,YAAY,IAAI,EAC9BA,EAAE,KAAK,UAAU,EACjB,QAASC,EAAI,EAAGA,EAAIH,EAAI,OAAQ,EAAEG,EAC9BD,EAAEF,EAAIG,CAAC,CAAC,EAAIA,GAAK,EACrB,QAASA,EAAI,EAAGA,EAAIH,EAAI,OAAQ,EAAEG,EAC9BD,EAAE,IAAMF,EAAIG,CAAC,CAAC,EAAIA,GAAK,GAAMA,GAAK,EAAK,MAAS,EACpD,QAASA,EAAI,EAAGA,EAAIH,EAAI,OAAQ,EAAEG,EAC9BD,EAAE,IAAMF,EAAIG,CAAC,CAAC,EAAKA,GAAK,GAAM,GAAMA,GAAK,EAAK,MAAS,GAC3D,QAASA,EAAI,EAAGA,EAAIH,EAAI,OAAQ,EAAEG,EAC9BD,EAAE,IAAMF,EAAIG,CAAC,CAAC,EAAIA,GAAK,GAC3B,IAAMC,GAAQ,IAAI,WAAW,CAAC,EAWxBC,GAAN,KAAoB,CAMhB,YAAYC,EAAUC,EAAUC,EAAc,CAO1C,GANA,KAAK,MAAQ,KACb,KAAK,OAAS,GACd,KAAK,OAAS,EACd,KAAK,SAAWF,GAAsD,QACtE,KAAK,SAAWC,GAAsD,WACtE,KAAK,OAASC,GAAkE,MAC5E,KAAK,OAAS,KAAK,UAAY,KAAK,SAAW,WAC/C,MAAM,IAAI,MAAM,uBAAuB,CAE/C,CAKA,IAAI,OAAQ,CACR,OAAO,KAAK,MAAQ,KAAK,GAAG,SAAS,EAAG,KAAK,KAAK,IAAuB,CAAC,EAAIJ,EAClF,CAMA,SAAU,CACD,KAAK,QAEN,KAAK,OAAS,KAAK,SACnB,KAAK,MAAQ,KAAK,KAAO,KAAK,GAAK,KAAK,KAAO,MAG/C,KAAK,KAAK,IAAuB,EAAI,EACrC,KAAK,KAAK,IAAuB,EAAI,EACrC,KAAK,KAAK,IAAuB,EAAI,GAE7C,CASA,KAAKG,EAAUC,EAAc,CAGzB,GAFA,KAAK,SAAWD,GAAsD,KAAK,SAC3E,KAAK,OAASC,GAAkE,KAAK,IAAI,KAAK,OAAQ,KAAK,QAAQ,EAC/G,KAAK,OAAS,KAAK,UAAY,KAAK,SAAW,WAC/C,MAAM,MAAM,uBAAuB,EAEvC,IAAIC,EAAI,KAAK,KACPC,EAAQ,KAAK,OAAS,KACvB,KAAK,MAOD,KAAK,KAAK,OAAO,WAAaA,IACnC,KAAK,KAAK,KAAK,KAAK,MAAMA,EAAQ,KAAK,KAAK,OAAO,YAAc,KAAK,CAAC,EACvED,EAAI,IAAI,YAAY,KAAK,KAAK,OAAQ,CAAC,EACvC,KAAK,GAAK,IAAI,WAAW,KAAK,KAAK,OAAQ,IAA6B,IATxE,KAAK,KAAO,IAAI,YAAY,OAAO,CAAE,QAAS,KAAK,KAAKC,EAAQ,KAAK,CAAE,CAAC,EACxE,KAAK,MAAQX,GAAW,CAAE,IAAK,CAAE,OAAQ,KAAK,IAAK,CAAE,CAAC,EACtDU,EAAI,IAAI,YAAY,KAAK,KAAK,OAAQ,CAAC,EACvCA,EAAE,IAAIP,EAAG,GAAgB,EACzB,KAAK,GAAK,IAAI,WAAW,KAAK,KAAK,OAAQ,IAA6B,GAO5EO,EAAE,IAAuB,EAAI,EAC7BA,EAAE,IAAuB,EAAI,EAC7BA,EAAE,IAAuB,EAAI,EAC7B,KAAK,KAAOA,EACZ,KAAK,OAAS,EAClB,CAOA,SAASE,EAAW,CAChB,IAAMC,EAAS,KAAK,KAAK,IAAuB,EAAID,EACpD,GAAI,KAAK,OAASC,EAAQ,CACtB,GAAIA,EAAS,KAAK,SACd,MAAO,GAEX,IAAIC,EAAU,KAAK,OACnB,MAAQA,GAAW,GAAKD,GAAQ,CAEhC,GADAC,EAAU,KAAK,IAAIA,EAAS,KAAK,QAAQ,EACrCA,EAAUD,EACV,MAAO,GAEX,GAAIC,EAAU,KAAgC,KAAK,KAAK,OAAO,WAAY,CACvE,IAAMC,EAAW,KAAK,MAAMD,EAAU,KAAgC,KAAK,KAAK,OAAO,YAAc,KAAK,EAC1G,KAAK,KAAK,KAAKC,CAAQ,EACvB,KAAK,KAAO,IAAI,YAAY,KAAK,KAAK,OAAQ,CAAC,EAC/C,KAAK,GAAK,IAAI,WAAW,KAAK,KAAK,OAAQ,IAA6B,CAC5E,CACA,KAAK,OAASD,CAClB,CACA,MAAO,EACX,CAOA,IAAIE,EAAM,CACN,GAAI,CAAC,KAAK,OAAS,KAAK,OACpB,MAAO,GAEX,GAAI,KAAK,SAASA,EAAK,MAAM,EACzB,MAAO,GAEX,IAAMN,EAAI,KAAK,KACf,YAAK,GAAG,IAAIM,EAAMN,EAAE,IAAuB,CAAC,EAC5CA,EAAE,IAAuB,GAAKM,EAAK,OAE5BN,EAAE,IAAuB,EAAIA,EAAE,IAAuB,GAAK,OAC5D,KAAK,MAAM,QAAQ,IAAI,EACvB,CACV,CAKA,KAAM,CACF,YAAK,OAAS,GACP,KAAK,MACN,KAAK,MAAM,QAAQ,IAAI,EACvB,EACV,CAIA,IAAI,aAAc,CACd,OAAO,KAAK,MACN,KAAK,KAAK,IAAuB,EACjC,CACV,CAIA,IAAI,WAAY,CACZ,OAAO,KAAK,MACN,KAAK,SAAW,KAAK,KAAK,IAAuB,EACjD,CACV,CACJ,EACAZ,GAAQ,QAAUQ,KCjVlB,IAAAW,GAAAC,EAAAC,IAAA,cACA,OAAO,eAAeA,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EAK5D,IAAMC,GAAmB,KACnBC,MAAoBD,GAAiB,QAA2D,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,84BAA84B,CAAkD,EAC3iCE,GAAN,KAAiB,CACb,YAAYC,EAAU,CAClB,KAAK,SAAWA,EAChB,KAAK,MAAQ,EACb,KAAK,OAAS,CAClB,CACA,OAAOC,EAAG,CACN,KAAK,MAAQA,EAAE,CAAC,GAAK,GAAKA,EAAE,CAAC,GAAK,GAAKA,EAAE,CAAC,GAAK,EAAIA,EAAE,CAAC,EACtD,KAAK,OAASA,EAAE,CAAC,GAAK,GAAKA,EAAE,CAAC,GAAK,GAAKA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,EACzD,IAAMC,EAAS,KAAK,MAAQ,KAAK,OAC3BC,EAAKD,EAAS,EACdE,EAAKH,EAAE,OAwBPI,EAAQ,KAAK,IAAIF,EAAIC,CAAE,GAAK,KAAK,IAAID,EAAIC,CAAE,GAAK,GAAK,KACtD,KAAK,MAID,KAAK,KAAK,OAAO,WAAaC,IACnC,KAAK,KAAK,KAAK,KAAK,MAAMA,EAAQ,KAAK,KAAK,OAAO,YAAc,KAAK,CAAC,EACvE,KAAK,GAAK,OALV,KAAK,KAAO,IAAI,YAAY,OAAO,CAAE,QAAS,KAAK,KAAKA,EAAQ,KAAK,CAAE,CAAC,EACxE,KAAK,MAAQP,GAAc,CAAE,IAAK,CAAE,OAAQ,KAAK,IAAK,CAAE,CAAC,GAMxD,KAAK,KACN,KAAK,GAAK,IAAI,WAAW,KAAK,KAAK,MAAM,GAG7C,IAAMQ,EAAU,KAAK,KAAK,OAAO,WAAaF,EAAM,KACpD,YAAK,GAAG,IAAIH,EAAGK,CAAM,EACrB,KAAK,MAAM,QAAQ,IAAIA,EAAQF,EAAIF,CAAM,EAClC,KAAK,GAAG,SAAS,KAAqB,KAAsBC,CAAE,CACzE,CACA,SAAU,CACD,KAAK,OAEN,KAAK,KAAK,OAAO,WAAa,KAAK,WACnC,KAAK,MAAQ,KAAK,GAAK,KAAK,KAAO,KAE3C,CACJ,EACAP,GAAQ,QAAUG,mGCpELQ,GAAA,OAAS,CACpB,WAAY,MACZ,aAAc,KACd,UAAW,MACX,MAAO,wtdCCT,IAAAC,EAAA,IACAC,EAAA,KAIA,SAASC,GAAa,EAAS,CAC7B,GAAI,OAAO,OAAW,IACpB,OAAO,OAAO,KAAK,EAAG,QAAQ,EAEhC,IAAMC,EAAa,KAAK,CAAC,EACnBC,EAAS,IAAI,WAAWD,EAAW,MAAM,EAC/C,QAAS,EAAI,EAAG,EAAIC,EAAO,OAAQ,EAAE,EACnCA,EAAO,CAAC,EAAID,EAAW,WAAW,CAAC,EAErC,OAAOC,CACT,CAEA,IAAMC,GAAaH,GAAaD,EAAA,OAAO,KAAK,EACxCK,EAGEC,GAAc,IAAI,YAIlBC,GAAN,KAAmB,CAAnB,aAAA,CACS,KAAA,YAAeC,GAAkB,EACjC,KAAA,YAAeC,GAAoB,CAO5C,CANS,YAAYD,EAAa,CAC9B,OAAO,KAAK,YAAYA,CAAK,CAC/B,CACO,YAAYC,EAAY,CAC7B,OAAO,KAAK,YAAYA,CAAI,CAC9B,GAKIC,GAA2C,CAC/C,YAAa,KAAO,MACpB,WAAYX,EAAA,mBACZ,UAAWA,EAAA,mBACX,QAASA,EAAA,oBACT,aAAcC,EAAA,OAAO,aACrB,SAAU,IAQZ,SAAgBW,GAAaC,EAAsB,CACjD,IAAMC,EAAU,IAAIN,GACdO,EAAY,CAChB,IAAK,CACH,YAAaD,EAAQ,YAAY,KAAKA,CAAO,EAC7C,YAAaA,EAAQ,YAAY,KAAKA,CAAO,IAGjD,OAAO,YAAY,YAAYR,GAAeD,GAAYU,CAAS,EAChE,KAAMC,IACLV,EAAcA,GAAeU,EAAK,OAC3B,IAAIC,EAAQJ,EAAMG,EAAK,UAAYA,EAAMF,CAAO,EACxD,CACL,CAbAI,EAAA,aAAAN,GAgDA,IAAaK,EAAb,KAAoB,CAwGlB,YACEJ,EACAM,EACAC,EAAwB,CAGxB,GAvGM,KAAA,cAAgBnB,EAAA,OAAO,UAAY,EAEnC,KAAA,QAAuBM,GACvB,KAAA,YAAwB,CAAA,EACxB,KAAA,UAAY,EACZ,KAAA,UAAYN,EAAA,OAAO,UACnB,KAAA,YAAc,EACd,KAAA,eAAiB,EA+FvB,KAAK,MAAQ,OAAO,OAAO,CAAA,EAAIU,GAAiBE,CAAI,EAChD,KAAK,MAAM,aAAeZ,EAAA,OAAO,aACnC,MAAM,IAAI,MAAM,+CAA+CA,EAAA,OAAO,YAAY,EAAE,EAEtF,GAAKkB,EASHC,EAAU,YAAc,KAAK,aAAa,KAAK,IAAI,EACnDA,EAAU,YAAc,KAAK,YAAY,KAAK,IAAI,MAVpC,CACd,IAAMC,EAASf,IAAgBA,EAAc,IAAI,YAAY,OAAOD,EAAU,GAC9Ec,EAAY,IAAI,YAAY,SAASE,EAAQ,CAC3C,IAAK,CACH,YAAa,KAAK,aAAa,KAAK,IAAI,EACxC,YAAa,KAAK,YAAY,KAAK,IAAI,GAE1C,EAKH,KAAK,UAAYF,EACjB,KAAK,MAAQ,KAAK,UAAU,QAC5B,KAAK,OAAS,IAAI,WAAW,KAAK,MAAM,OAAO,OAAQ,KAAK,MAAM,kBAAiB,EAAIlB,EAAA,OAAO,UAAU,EACxG,KAAK,QAAU,IAAI,YAAY,KAAK,MAAM,OAAO,OAAQ,KAAK,MAAM,kBAAiB,EAAI,EAAE,EAC3F,KAAK,SAAW,IAAI,YAAY,KAAK,MAAM,OAAO,OAAQ,KAAK,MAAM,oBAAmB,EAAIA,EAAA,OAAO,YAAY,EAC/G,KAAK,SAAS,IAAI,KAAK,MAAM,OAAO,EACpC,KAAK,MAAQ,IAAI,YAAY,KAAK,MAAM,OAAO,OAAQ,KAAK,MAAM,eAAc,CAAE,EAClF,KAAK,MAAM,KAAKD,EAAA,mBAAoB,EAAG,KAAK,MAAM,aAAc,CAAC,CACnE,CApHA,IAAY,YAAU,CAAe,OAAO,KAAK,QAAQ,CAAC,CAAG,CAC7D,IAAY,WAAS,CAAa,OAAO,KAAK,QAAQ,CAAC,CAAG,CAC1D,IAAY,cAAY,CAAa,OAAO,KAAK,QAAQ,CAAC,CAAG,CAC7D,IAAY,eAAa,CAAa,OAAO,KAAK,QAAQ,CAAC,CAAG,CAC9D,IAAY,QAAM,CAAa,OAAO,KAAK,QAAQ,CAAC,EAAI,KAAK,QAAQ,CAAC,EAAI,EAAI,CAAG,CACjF,IAAY,SAAO,CAAa,OAAO,KAAK,QAAQ,CAAC,CAAG,CACxD,IAAY,QAAM,CAAa,OAAO,KAAK,QAAQ,CAAC,CAAG,CACvD,IAAY,OAAK,CAAgB,OAAO,KAAK,QAAQ,EAAE,CAAG,CAC1D,IAAY,eAAa,CAAa,OAAO,KAAK,QAAQ,EAAE,CAAG,CAEvD,YAAYU,EAAe,CACjC,GAAIA,IAAI,EAAmB,CACzB,IAAMY,EAAS,KAAK,MAAQ,KAAK,OACjC,GAAIA,EAAS,KAAK,QAAQ,OAAQ,CAChC,GAAI,KAAK,MAAM,aAAeA,EAAS,EAAI,KAAK,MAAM,YACpD,WAAK,QAAO,EACN,IAAI,MAAM,4BAA4B,EAE9C,KAAK,QAAU,IAAI,YAAYA,CAAM,EAEvC,KAAK,UAAY,KAAK,eACbZ,IAAI,EACb,GAAI,KAAK,SAAW,EAAG,CAErB,IAAMY,EAAS,KAAK,IAAI,KAAK,aAAcrB,EAAA,OAAO,SAAS,EAAI,KAAK,cACpE,GAAIqB,EAAS,KAAK,QAAQ,OAAQ,CAChC,GAAI,KAAK,MAAM,aAAeA,EAAS,EAAI,KAAK,MAAM,YACpD,WAAK,QAAO,EACN,IAAI,MAAM,4BAA4B,EAE9C,KAAK,QAAU,IAAI,YAAYA,CAAM,QAInC,KAAK,QAAQ,OAAS,QACxB,KAAK,QAAU,IAAI,YAAY,KAAK,GAI1C,MAAO,EACT,CAEQ,SAASC,EAAgBC,EAAwB,CACvD,IAAMF,EAASC,EAASC,EACxB,GAAIF,EAAS,KAAK,QAAQ,OAAQ,CAChC,GAAI,KAAK,MAAM,aAAeA,EAAS,EAAI,KAAK,MAAM,YACpD,WAAK,QAAO,EACN,IAAI,MAAM,4BAA4B,EAG9C,IAAMG,EAAY,IAAI,YAAY,KAAK,KAAKH,EAAS,KAAK,EAAI,KAAK,EACnEG,EAAU,IAAI,KAAK,OAAO,EAC1B,KAAK,QAAUA,EAEnB,CAEQ,aAAahB,EAAa,CAChC,IAAMiB,EAAM,KAAK,cACbH,EAAS,KAAK,YAClB,GAAI,KAAK,QAAK,EAAmB,CAC/B,IAAII,EAAY,KAAK,OAAS,KAAK,eAC/BC,EAAI,EACR,KAAOA,EAAI,GAAKD,EAAY,GAC1B,KAAK,QAAQ,IAAI,KAAK,MAAM,SAASD,EAAME,EAAGF,EAAME,EAAInB,CAAK,EAAGc,EAASd,EAAQmB,CAAC,EAClFA,IACAD,IAEF,KAAK,aAAelB,EAAQmB,EAC5B,KAAK,gBAAkBA,UACd,KAAK,QAAK,EAAmB,CACtC,KAAK,SAASL,EAAQd,EAAQ,CAAC,EAC/B,KAAK,UAAY,KAAK,IAAI,KAAK,UAAWA,CAAK,EAC/C,KAAK,UAAY,KAAK,IAAI,KAAK,UAAWA,CAAK,EAC/C,QAASoB,EAAI,EAAGA,EAAI,EAAG,EAAEA,EACvB,KAAK,QAAQ,IAAI,KAAK,MAAM,SAASH,EAAMG,EAAGH,EAAMG,EAAIpB,CAAK,EAAGc,EAASd,EAAQoB,CAAC,EAEpF,KAAK,YAAY,KAAKpB,CAAK,EAC3B,KAAK,aAAeA,EAAQ,EAC5B,KAAK,gBAAkB,EAEzB,MAAO,EACT,CA0CA,IAAW,OAAK,CACd,OAAO,KAAK,QAAK,EACb,KAAK,OACL,KAAK,IAAI,KAAK,UAAW,KAAK,MAAM,cAAa,CAAE,CACzD,CAOA,IAAW,QAAM,CACf,OAAO,KAAK,QAAK,EACb,KAAK,QACL,KAAK,MAAM,cAAa,EACtB,KAAK,YAAY,OAAS,EAAI,KAAK,MAAM,eAAc,EACvD,KAAK,YAAY,OAAS,CAClC,CAKA,IAAW,SAAO,CAChB,OAAO,KAAK,SAAS,SAAS,EAAG,KAAK,aAAa,CACrD,CAWA,IAAW,aAAW,CACpB,OAAO,KAAK,QAAQ,WAAa,KAAK,MAAM,OAAO,OAAO,WAAa,EAAI,KAAK,YAAY,MAC9F,CAKA,IAAW,YAAU,CACnB,MAAO,CACL,MAAO,KAAK,MACZ,OAAQ,KAAK,OACb,KAAM,KAAK,MACX,MAAO,KAAK,OACZ,SAAU,CAAC,CAAC,KAAK,UACjB,aAAc,KAAK,cACnB,UAAW,KAAK,WAChB,SAAU,KAAK,YACf,iBAAkB,CAChB,UAAW,KAAK,QAAQ,CAAC,EACzB,YAAa,KAAK,QAAQ,CAAC,EAC3B,MAAO,KAAK,aACZ,OAAQ,KAAK,eAGnB,CAOO,KACLqB,EAAsB,KAAK,MAAM,UACjCC,EAA8B,KAAK,MAAM,QACzCC,EAAuB,KAAK,MAAM,aAClCC,EAAoB,KAAK,MAAM,SAAQ,CAEvC,KAAK,MAAM,KAAK,KAAK,MAAM,WAAYH,EAAWE,EAAcC,EAAW,EAAI,CAAC,EAC5EF,GACF,KAAK,SAAS,IAAIA,EAAQ,SAAS,EAAG9B,EAAA,OAAO,YAAY,CAAC,EAE5D,KAAK,YAAY,OAAS,EAC1B,KAAK,UAAY,EACjB,KAAK,UAAYA,EAAA,OAAO,UACxB,KAAK,YAAc,EACnB,KAAK,eAAiB,CACxB,CAMO,OAAOiC,EAAsBC,EAAgB,EAAGC,EAAcF,EAAK,OAAM,CAC9E,IAAIG,EAAIF,EACR,KAAOE,EAAID,GAAK,CACd,IAAME,EAAS,KAAK,IAAIF,EAAMC,EAAGpC,EAAA,OAAO,UAAU,EAClD,KAAK,OAAO,IAAIiC,EAAK,SAASG,EAAGA,GAAKC,CAAM,CAAC,EAC7C,KAAK,MAAM,OAAO,EAAGA,CAAM,EAE/B,CAOO,aAAaJ,EAAcC,EAAgB,EAAGC,EAAcF,EAAK,OAAM,CAC5E,IAAIG,EAAIF,EACR,KAAOE,EAAID,GAAK,CACd,IAAME,EAAS,KAAK,IAAIF,EAAMC,EAAGpC,EAAA,OAAO,UAAU,EAClD,QAAS4B,EAAI,EAAGU,EAAIF,EAAGR,EAAIS,EAAQ,EAAET,EAAG,EAAEU,EACxC,KAAK,OAAOV,CAAC,EAAIK,EAAK,WAAWK,CAAC,EAEpCF,GAAKC,EACL,KAAK,MAAM,OAAO,EAAGA,CAAM,EAE/B,CAMA,IAAW,QAAM,CACf,GAAI,KAAK,QAAK,GAAqB,CAAC,KAAK,OAAS,CAAC,KAAK,OACtD,OAAO/B,GAIT,IAAMiC,EAAe,KAAK,MAAM,cAAa,EAE7C,GAAI,KAAK,QAAK,EAAmB,CAC/B,IAAIb,EAAY,KAAK,OAAS,KAAK,eACnC,GAAIA,EAAY,EAAG,CACjB,IAAMD,EAAM,KAAK,cACbH,EAAS,KAAK,YACdK,EAAI,EACR,KAAOA,EAAI,GAAKD,EAAY,GAC1B,KAAK,QAAQ,IAAI,KAAK,MAAM,SAASD,EAAME,EAAGF,EAAME,EAAIY,CAAY,EAAGjB,EAASiB,EAAeZ,CAAC,EAChGA,IACAD,IAEEA,GACF,KAAK,QAAQ,KAAK,KAAK,WAAYJ,EAASiB,EAAeZ,CAAC,EAGhE,OAAO,KAAK,QAAQ,SAAS,EAAG,KAAK,MAAQ,KAAK,MAAM,EAG1D,GAAI,KAAK,QAAK,EAAmB,CAC/B,GAAI,KAAK,YAAc,KAAK,UAAW,CACrC,IAAIa,EAAS,GACb,GAAID,EACF,GAAIA,IAAiB,KAAK,UACxBC,EAAS,OACJ,CACL,IAAMf,EAAM,KAAK,cACbH,EAAS,KAAK,YAClB,KAAK,SAASA,EAAQiB,EAAe,CAAC,EACtC,QAASX,EAAI,EAAGA,EAAI,EAAG,EAAEA,EACvB,KAAK,QAAQ,IAAI,KAAK,MAAM,SAASH,EAAMG,EAAGH,EAAMG,EAAIW,CAAY,EAAGjB,EAASiB,EAAeX,CAAC,EAItG,GAAI,CAACY,EACH,OAAO,KAAK,QAAQ,SAAS,EAAG,KAAK,MAAQ,KAAK,MAAM,EAM5D,IAAMC,EAAQ,IAAI,YAAY,KAAK,MAAQ,KAAK,MAAM,EACtDA,EAAM,KAAK,KAAK,UAAU,EAC1B,IAAIC,EAAc,EACdR,EAAQ,EACZ,QAASN,EAAI,EAAGA,EAAI,KAAK,YAAY,OAAQ,EAAEA,EAAG,CAChD,IAAMe,EAAK,KAAK,YAAYf,CAAC,EAC7B,QAASQ,EAAI,EAAGA,EAAI,EAAG,EAAEA,EACvBK,EAAM,IAAI,KAAK,QAAQ,SAASP,EAAOA,GAASS,CAAE,EAAGD,CAAW,EAChEA,GAAe,KAAK,MAIxB,GAAIH,EAAc,CAChB,IAAMd,EAAM,KAAK,cAEXmB,EAAgB,KAAK,MAAM,eAAc,EAC/C,QAAShB,EAAI,EAAGA,EAAIgB,EAAe,EAAEhB,EACnCa,EAAM,IAAI,KAAK,MAAM,SAAShB,EAAMG,EAAGH,EAAMG,EAAIW,CAAY,EAAGG,EAAc,KAAK,MAAQd,CAAC,EAGhG,OAAOa,EAIT,OAAOnC,EACT,CAMA,IAAW,OAAK,CACd,OAAO,IAAI,kBAAkB,KAAK,OAAO,OAAQ,EAAG,KAAK,MAAQ,KAAK,OAAS,CAAC,CAClF,CAcO,SAAO,CACZ,KAAK,QAAUA,GACf,KAAK,YAAY,OAAS,EAC1B,KAAK,UAAY,EACjB,KAAK,UAAYN,EAAA,OAAO,UAGxB,KAAK,MAAM,KAAKD,EAAA,mBAAoB,EAAG,KAAK,MAAM,aAAc,CAAC,CACnE,GAxWFkB,EAAA,QAAAD,EA2XC,SAAgB6B,GACfZ,EACArB,EAAsB,CAEtB,IAAMkC,EAAM,IAAI9B,EAAQJ,CAAI,EAC5B,OAAAkC,EAAI,KAAI,EACR,OAAOb,GAAS,SAAWa,EAAI,aAAab,CAAI,EAAIa,EAAI,OAAOb,CAAI,EAC5D,CACL,MAAOa,EAAI,MACX,OAAQA,EAAI,OACZ,OAAQA,EAAI,OACZ,MAAOA,EAAI,MAEf,CAbC7B,EAAA,OAAA4B,GAoBM,eAAeE,GACpBd,EACArB,EAAsB,CAEtB,IAAMkC,EAAM,MAAMnC,GAAaC,CAAI,EACnC,OAAAkC,EAAI,KAAI,EACR,OAAOb,GAAS,SAAWa,EAAI,aAAab,CAAI,EAAIa,EAAI,OAAOb,CAAI,EAC5D,CACL,MAAOa,EAAI,MACX,OAAQA,EAAI,OACZ,OAAQA,EAAI,OACZ,MAAOA,EAAI,MAEf,CAbA7B,EAAA,YAAA8B,KC7eO,SAASC,EAAaC,EAA6B,CACxD,MAAO,CAAE,QAASA,CAAG,CACvB,CAuBO,IAAMC,EAAN,KAA6C,CAA7C,cACL,KAAiB,aAAe,IAAI,IACpC,KAAQ,YAAc,GAEtB,IAAW,YAAsB,CAC/B,OAAO,KAAK,WACd,CAEO,IAA2BC,EAAS,CACzC,OAAI,KAAK,YACPA,EAAE,QAAQ,EAEV,KAAK,aAAa,IAAIA,CAAC,EAElBA,CACT,CAEO,SAAgB,CACrB,GAAI,MAAK,YAGT,MAAK,YAAc,GACnB,QAAWC,KAAK,KAAK,aACnBA,EAAE,QAAQ,EAEZ,KAAK,aAAa,MAAM,EAC1B,CAEO,OAAc,CACnB,QAAWA,KAAK,KAAK,aACnBA,EAAE,QAAQ,EAEZ,KAAK,aAAa,MAAM,CAC1B,CACF,EAEsBC,EAAf,KAAiD,CAAjD,cAGL,KAAmB,OAAS,IAAIH,EAEzB,SAAgB,CACrB,KAAK,OAAO,QAAQ,CACtB,CAEU,UAAiCC,EAAS,CAClD,OAAO,KAAK,OAAO,IAAIA,CAAC,CAC1B,CACF,EAZsBE,EACG,KAAoB,OAAO,OAAO,CAAE,SAAU,CAAE,CAAE,CAAC,EAarE,IAAMC,EAAN,KAAsE,CAAtE,cAEL,KAAQ,YAAc,GAEtB,IAAW,OAAuB,CAChC,OAAO,KAAK,YAAc,OAAY,KAAK,MAC7C,CAEA,IAAW,MAAMC,EAAsB,CACjC,KAAK,aAAeA,IAAU,KAAK,SAGvC,KAAK,QAAQ,QAAQ,EACrB,KAAK,OAASA,EAChB,CAEO,OAAc,CACnB,KAAK,MAAQ,MACf,CAEO,SAAgB,CACrB,KAAK,YAAc,GACnB,KAAK,QAAQ,QAAQ,EACrB,KAAK,OAAS,MAChB,CACF,EClGO,IAAMC,EAAN,KAAiB,CAAjB,cACL,KAAQ,WAAqD,CAAC,EAC9D,KAAQ,UAAY,GAGpB,IAAW,OAAmB,CAC5B,OAAI,KAAK,OACA,KAAK,QAEd,KAAK,OAAS,CAACC,EAAyBC,EAAgBC,IAAkD,CACxG,GAAI,KAAK,UACP,OAAOC,EAAa,IAAM,CAAC,CAAC,EAG9B,IAAMC,EAAQ,CAAE,GAAIJ,EAAU,SAAAC,CAAS,EACvC,KAAK,WAAa,KAAK,WAAW,MAAM,EACxC,KAAK,WAAW,KAAKG,CAAK,EAE1B,IAAMC,EAASF,EAAa,IAAM,CAChC,IAAMG,EAAM,KAAK,WAAW,QAAQF,CAAK,EACrCE,IAAQ,KACV,KAAK,WAAa,KAAK,WAAW,MAAM,EACxC,KAAK,WAAW,OAAOA,EAAK,CAAC,EAEjC,CAAC,EAED,OAAIJ,IACE,MAAM,QAAQA,CAAW,EAC3BA,EAAY,KAAKG,CAAM,EAEvBH,EAAY,IAAIG,CAAM,GAInBA,CACT,EACO,KAAK,OACd,CAEO,KAAKE,EAAgB,CAC1B,GAAI,KAAK,WAAa,CAAC,KAAK,WAAW,OACrC,OAEF,GAAI,KAAK,WAAW,SAAW,EAAG,CAChC,KAAK,WAAW,CAAC,EAAE,GAAG,KAAK,KAAK,WAAW,CAAC,EAAE,SAAUA,CAAK,EAC7D,MACF,CACA,IAAMC,EAAY,KAAK,WACvB,QAAS,EAAI,EAAGC,EAAMD,EAAU,OAAQ,EAAIC,EAAK,EAAE,EACjDD,EAAU,CAAC,EAAE,GAAG,KAAKA,EAAU,CAAC,EAAE,SAAUD,CAAK,CAErD,CAEO,SAAgB,CACjB,KAAK,YAGT,KAAK,UAAY,GACjB,KAAK,WAAW,OAAS,EAC3B,CACF,EAEiBG,OAAV,CACE,SAASC,EAAWC,EAAiBC,EAA6B,CACvE,OAAOD,EAAKE,GAAKD,EAAG,KAAKC,CAAC,CAAC,CAC7B,CAFOJ,EAAS,QAAAC,EAIT,SAASI,EAAUR,EAAkBQ,EAA6B,CACvE,MAAO,CAACf,EAAyBC,EAAgBC,IACxCK,EAAMS,GAAKhB,EAAS,KAAKC,EAAUc,EAAIC,CAAC,CAAC,EAAG,OAAWd,CAAW,CAE7E,CAJOQ,EAAS,IAAAK,EAQT,SAASE,KAAUC,EAAgC,CACxD,MAAO,CAAClB,EAAyBC,EAAgBC,IAAkD,CACjG,IAAMiB,EAAQ,IAAIC,EAClB,QAAWb,KAASW,EAClBC,EAAM,IAAIZ,EAAMO,GAAKd,EAAS,KAAKC,EAAUa,CAAC,CAAC,CAAC,EAElD,OAAIZ,IACE,MAAM,QAAQA,CAAW,EAC3BA,EAAY,KAAKiB,CAAK,EAEtBjB,EAAY,IAAIiB,CAAK,GAGlBA,CACT,CACF,CAfOT,EAAS,IAAAO,EAmBT,SAASI,EAAmBd,EAAkBe,EAAqCC,EAA0B,CAClH,OAAAD,EAAQC,CAAO,EACRhB,EAAMO,GAAKQ,EAAQR,CAAC,CAAC,CAC9B,CAHOJ,EAAS,gBAAAW,IAhCDX,KAAA,ICvEjB,IAAAc,GAA2B,OAgBpB,IAAMC,EAAN,MAAMC,UAAsBC,CAAkC,CAmDnE,YAAoBC,EAAyB,CAC3C,MAAM,EADY,eAAAA,EAhDpB,KAAQ,QAAU,IAAI,IAGtB,KAAQ,gBAAkB,KAAK,UAAU,IAAIC,CAAmB,EA+C9D,KAAK,SAAW,KAAK,UAAU,MAAM,KACrC,KAAK,UAAU,MAAM,KAAQC,GAA8B,CACzD,KAAK,UAAU,KAAK,KAAK,UAAU,MAAOA,CAAM,EAChD,KAAK,MAAM,CACb,EACI,KAAK,UAAU,MAAM,eACvB,KAAK,MAAM,EAGb,KAAK,gBAAgB,MAAQ,KAAK,UAAU,MAAM,eAAe,eAAeC,GAAU,CACpFA,IAAW,aACb,KAAK,cAAc,EACnB,KAAK,gBAAgB,YAAY,EAAG,KAAK,UAAU,IAAI,EAE3D,CAAC,EACD,KAAK,UAAUC,EAAa,IAAM,CAChC,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,QAAQ,EAC5B,KAAK,UAAU,OAAS,KAAK,WAC/B,KAAK,UAAU,MAAM,KAAO,KAAK,SACjC,KAAK,SAAW,QAEd,KAAK,gBAAkB,KAAK,kBAC9B,KAAK,eAAe,YAAc,KAAK,gBACvC,KAAK,gBAAkB,QAEzB,KAAK,eAAiB,OACtB,KAAK,QAAQ,MAAM,EACnB,KAAK,oBAAoB,MAAM,EAC/B,KAAK,mBAAqB,OAC1B,KAAK,aAAe,MACtB,CAAC,CAAC,CACJ,CAnFA,IAAW,QAAwC,CAAE,OAAO,KAAK,QAAQ,IAAI,KAAK,GAAG,MAAQ,CAU7F,OAAc,aAAaC,EAAqCC,EAAeC,EAAmC,CAUhH,IAAMC,GAAUH,GAAiB,UAAU,cAAc,QAAQ,EACjE,OAAAG,EAAO,MAAQF,EAAQ,EACvBE,EAAO,OAASD,EAAS,EAClBC,CACT,CAGA,OAAc,gBAAgBC,EAA+BH,EAAeC,EAAgBG,EAAiC,CAC3H,GAAI,OAAO,WAAc,WAAY,CACnC,IAAMC,EAAUF,EAAI,gBAAgBH,EAAOC,CAAM,EACjD,OAAIG,GACFC,EAAQ,KAAK,IAAI,IAAI,kBAAkBD,EAAQ,EAAGJ,EAAQC,EAAS,CAAC,CAAC,EAEhEI,CACT,CACA,OAAOD,EACH,IAAI,UAAU,IAAI,kBAAkBA,EAAQ,EAAGJ,EAAQC,EAAS,CAAC,EAAGD,EAAOC,CAAM,EACjF,IAAI,UAAUD,EAAOC,CAAM,CACjC,CAGA,OAAc,kBAAkBK,EAA0D,CACxF,OAAI,OAAO,mBAAsB,WACxB,QAAQ,QAAQ,MAAS,EAE3B,kBAAkBA,CAAG,CAC9B,CA0CO,gBAAgBC,EAAsB,CACvCA,EACE,CAAC,KAAK,cAAgB,KAAK,SAAS,SAAW,IACjD,KAAK,mBAAmB,KAAK,IAAI,KAAK,SAAS,OAAS,EAAG,EAA4B,CAAC,GAG1F,KAAK,oBAAoB,MAAM,EAC/B,KAAK,mBAAqB,OAC1B,KAAK,aAAe,QAEtB,KAAK,gBAAgB,YAAY,EAAG,KAAK,UAAU,IAAI,CACzD,CAMA,IAAW,YAA4C,CACrD,OAAO,KAAK,UAAU,UACxB,CAKA,IAAW,UAAsB,CAC/B,MAAO,CACL,MAAO,KAAK,YAAY,IAAI,KAAK,OAAS,GAC1C,OAAQ,KAAK,YAAY,IAAI,KAAK,QAAU,EAC9C,CACF,CAKO,WAAWC,EAAeC,EAAaC,EAA0B,CACtE,IAAMC,EAAIH,GAAS,KAAK,YAAY,IAAI,KAAK,QAAU,GACjDI,EAAI,KAAK,YAAY,IAAI,OAAO,OAAS,EACzCC,GAAKJ,EAAM,EAAID,IAAU,KAAK,YAAY,IAAI,KAAK,QAAU,IAC/D,CAACE,GAASA,IAAU,QACtB,KAAK,QAAQ,IAAI,KAAK,GAAG,UAAU,EAAGC,EAAGC,EAAGC,CAAC,GAE3C,CAACH,GAASA,IAAU,WACtB,KAAK,QAAQ,IAAI,QAAQ,GAAG,UAAU,EAAGC,EAAGC,EAAGC,CAAC,CAEpD,CAKO,SAASH,EAA0B,CACxC,GAAI,CAACA,GAASA,IAAU,MAAO,CAC7B,IAAMP,EAAM,KAAK,QAAQ,IAAI,KAAK,EAClCA,GAAK,UAAU,EAAG,EAAGA,EAAI,OAAO,MAAOA,EAAI,OAAO,MAAM,CAC1D,CACA,GAAI,CAACO,GAASA,IAAU,SAAU,CAChC,IAAMP,EAAM,KAAK,QAAQ,IAAI,QAAQ,EACrCA,GAAK,UAAU,EAAG,EAAGA,EAAI,OAAO,MAAOA,EAAI,OAAO,MAAM,CAC1D,CACF,CAKO,KAAKW,EAAqBC,EAAgBC,EAAaC,EAAaC,EAAgB,EAAS,CAClG,IAAMf,EAAM,KAAK,QAAQ,IAAIW,EAAQ,KAAK,EAC1C,GAAI,CAACX,EACH,OAEF,GAAM,CAAE,MAAAH,EAAO,OAAAC,CAAO,EAAI,KAAK,SAG/B,GAAID,IAAU,IAAMC,IAAW,GAC7B,OAGF,KAAK,cAAca,EAASd,EAAOC,CAAM,EACzC,IAAMK,EAAMQ,EAAQ,OACd,CAAE,MAAOK,EAAa,OAAQC,CAAa,EAAIN,EAAQ,eACvDO,EAAO,KAAK,KAAKf,EAAI,MAAQa,CAAW,EAExCG,EAAMP,EAASM,EAAQF,EACvBI,EAAK,KAAK,MAAMR,EAASM,CAAI,EAAID,EACjCI,EAAKR,EAAMhB,EACXyB,EAAKR,EAAMhB,EAGXyB,EAAaR,EAAQC,EAAcG,EAAKhB,EAAI,MAAQA,EAAI,MAAQgB,EAAKJ,EAAQC,EAC7EQ,EAAcJ,EAAKH,EAAed,EAAI,OAASA,EAAI,OAASiB,EAAKH,EAMvEjB,EAAI,UACFG,EACA,KAAK,MAAMgB,CAAE,EAAG,KAAK,MAAMC,CAAE,EAAG,KAAK,KAAKG,CAAU,EAAG,KAAK,KAAKC,CAAW,EAC5E,KAAK,MAAMH,CAAE,EAAG,KAAK,MAAMC,CAAE,EAAG,KAAK,KAAKC,EAAa1B,EAAQmB,CAAW,EAAG,KAAK,KAAKQ,EAAc1B,EAASmB,CAAY,CAC5H,CACF,CAKO,YAAYN,EAAqBC,EAA+C,CACrF,GAAM,CAAE,MAAAf,EAAO,OAAAC,CAAO,EAAI,KAAK,SAE/B,GAAID,IAAU,IAAMC,IAAW,GAC7B,OAEF,KAAK,cAAca,EAASd,EAAOC,CAAM,EACzC,IAAMK,EAAMQ,EAAQ,OACd,CAAE,MAAOK,EAAa,OAAQC,CAAa,EAAIN,EAAQ,eACvDO,EAAO,KAAK,KAAKf,EAAI,MAAQa,CAAW,EACxCG,EAAMP,EAASM,EAAQF,EACvBI,EAAK,KAAK,MAAMR,EAASM,CAAI,EAAID,EACjCM,EAAaP,EAAcG,EAAKhB,EAAI,MAAQA,EAAI,MAAQgB,EAAKH,EAC7DQ,EAAcJ,EAAKH,EAAed,EAAI,OAASA,EAAI,OAASiB,EAAKH,EAEjElB,EAASV,EAAc,aAAa,KAAK,SAAU,KAAK,KAAKkC,EAAa1B,EAAQmB,CAAW,EAAG,KAAK,KAAKQ,EAAc1B,EAASmB,CAAY,CAAC,EAC9IjB,EAAMD,EAAO,WAAW,IAAI,EAClC,GAAIC,EACF,OAAAA,EAAI,UACFG,EACA,KAAK,MAAMgB,CAAE,EAAG,KAAK,MAAMC,CAAE,EAAG,KAAK,MAAMG,CAAU,EAAG,KAAK,MAAMC,CAAW,EAC9E,EAAG,EAAGzB,EAAO,MAAOA,EAAO,MAC7B,EACOA,CAEX,CAKO,gBAAgBc,EAAaC,EAAaC,EAAgB,EAAS,CACxE,IAAMf,EAAM,KAAK,QAAQ,IAAI,KAAK,EAClC,GAAIA,EAAK,CACP,GAAM,CAAE,MAAAH,EAAO,OAAAC,CAAO,EAAI,KAAK,SAY/B,GATID,IAAU,IAAMC,IAAW,KAI1B,KAAK,aAECA,GAAU,KAAK,aAAc,QACtC,KAAK,mBAAmBA,EAAS,CAAC,EAFlC,KAAK,mBAAmB,KAAK,IAAIA,EAAS,EAAG,EAA4B,CAAC,EAIxE,CAAC,KAAK,cAAc,OACxBE,EAAI,UACF,KAAK,oBAAsB,KAAK,aAChCa,EAAMhB,EACLiB,EAAMhB,EAAU,EAAI,EAAI,EACzBD,EAAQkB,EACRjB,EACAe,EAAMhB,EACNiB,EAAMhB,EACND,EAAQkB,EACRjB,CACF,CACF,CACF,CAMO,eAAsB,CAC3B,IAAMW,EAAI,KAAK,YAAY,IAAI,OAAO,OAAS,EACzCC,EAAI,KAAK,YAAY,IAAI,OAAO,QAAU,EAChD,QAAWV,KAAO,KAAK,QAAQ,OAAO,GAChCA,EAAI,OAAO,QAAUS,GAAKT,EAAI,OAAO,SAAWU,KAClDV,EAAI,OAAO,MAAQS,EACnBT,EAAI,OAAO,OAASU,EAG1B,CAKQ,cAAce,EAAkBC,EAAsBC,EAA6B,CACzF,GAAID,IAAiBD,EAAK,eAAe,OAASE,IAAkBF,EAAK,eAAe,OACtF,OAEF,GAAM,CAAE,MAAOG,EAAe,OAAQC,CAAe,EAAIJ,EAAK,aAC9D,GAAIC,IAAiBE,GAAiBD,IAAkBE,EAAgB,CACtEJ,EAAK,OAASA,EAAK,KACnBA,EAAK,eAAe,MAAQG,EAC5BH,EAAK,eAAe,OAASI,EAC7B,MACF,CACA,IAAMC,EAAc,KAAK,KAAKL,EAAK,KAAM,MAAQC,EAAeE,CAAa,EACvEG,EAAe,KAAK,KAAKN,EAAK,KAAM,OAASE,EAAgBE,CAAc,EAEjF,GAAIC,EAAcC,EAAeN,EAAK,KAAM,MAAQA,EAAK,KAAM,OAAQ,CACrEA,EAAK,OAASA,EAAK,KACnBA,EAAK,eAAe,MAAQG,EAC5BH,EAAK,eAAe,OAASI,EAC7B,MACF,CACA,IAAM9B,EAASV,EAAc,aAAa,KAAK,SAAUyC,EAAaC,CAAY,EAC5E/B,EAAMD,EAAO,WAAW,IAAI,EAC9BC,IACFA,EAAI,UAAUyB,EAAK,KAAO,EAAG,EAAG1B,EAAO,MAAOA,EAAO,MAAM,EAC3D0B,EAAK,OAAS1B,EACd0B,EAAK,eAAe,MAAQC,EAC5BD,EAAK,eAAe,OAASE,EAEjC,CAKQ,OAAc,CACpB,KAAK,eAAiB,KAAK,UAAU,MAAM,eAC3C,KAAK,gBAAkB,KAAK,eAAe,YAAY,KAAK,KAAK,cAAc,EAC/E,KAAK,eAAe,YAAeK,GAAkB,CACnD,QAAWC,IAAO,CAAC,GAAG,KAAK,QAAQ,KAAK,CAAC,EACvC,KAAK,mBAAmBA,CAAG,EAE7B,KAAK,iBAAiB,KAAK,KAAK,eAAgBD,CAAQ,CAC1D,CACF,CAEO,iBAAiBzB,EAAoB,MAAa,CAEvD,GAAI,CAAC,KAAK,UAAY,CAAC,KAAK,UAAU,MAAM,cAAe,CACzD,QAAQ,KAAK,oFAAoF,EACjG,MACF,CACA,GAAI,KAAK,QAAQ,IAAIA,CAAK,EACxB,OAEF,IAAMR,EAASV,EAAc,aAC3B,KAAK,SAAU,KAAK,YAAY,IAAI,OAAO,OAAS,EACpD,KAAK,YAAY,IAAI,OAAO,QAAU,CACxC,EACAU,EAAO,UAAU,IAAI,qBAAqBQ,CAAK,EAAE,EACjD,IAAM2B,EAAgB,KAAK,UAAU,MAAM,cAI3CA,EAAc,MAAM,UAAY,UAC5B3B,IAAU,UAKZR,EAAO,MAAM,OAAS,KACtBmC,EAAc,aAAanC,EAAQmC,EAAc,UAAU,IAK3DnC,EAAO,MAAM,OAAS,IACtBmC,EAAc,YAAYnC,CAAM,GAElC,IAAMC,EAAMD,EAAO,WAAW,KAAM,CAAE,MAAO,EAAK,CAAC,EACnD,GAAI,CAACC,EAAK,CACRD,EAAO,OAAO,EACd,MACF,CACA,KAAK,QAAQ,IAAIQ,EAAOP,CAAG,EAC3B,KAAK,SAASO,CAAK,CACrB,CAEO,mBAAmBA,EAAoB,MAAa,CACzD,IAAMP,EAAM,KAAK,QAAQ,IAAIO,CAAK,EAC9BP,IACFA,EAAI,OAAO,OAAO,EAClB,KAAK,QAAQ,OAAOO,CAAK,EAE7B,CAEO,SAASA,EAA4B,CAC1C,OAAO,KAAK,QAAQ,IAAIA,CAAK,CAC/B,CAEQ,mBAAmBT,EAAiB,GAAoC,CAC9E,KAAK,oBAAoB,MAAM,EAC/B,KAAK,mBAAqB,OAG1B,IAAMqC,EAAS,GACTC,EAAY/C,EAAc,aAAa,KAAK,SAAU8C,EAAQrC,CAAM,EACpEE,EAAMoC,EAAU,WAAW,KAAM,CAAE,MAAO,EAAM,CAAC,EACvD,GAAI,CAACpC,EAAK,OACV,IAAME,EAAUb,EAAc,gBAAgBW,EAAKmC,EAAQrC,CAAM,EAC3DuC,EAAM,IAAI,YAAYnC,EAAQ,KAAK,MAAM,EACzCoC,KAAQ,eAAW,EAAG,EAAG,CAAC,EAC1BC,KAAQ,eAAW,IAAK,IAAK,GAAG,EACtCF,EAAI,KAAKC,CAAK,EACd,QAAS9B,EAAI,EAAGA,EAAIV,EAAQ,EAAEU,EAAG,CAC/B,IAAMgC,EAAQhC,EAAI,EACZiC,EAASjC,EAAI2B,EACnB,QAASO,EAAI,EAAGA,EAAIP,EAAQO,GAAK,EAC/BL,EAAII,EAASC,EAAIF,CAAK,EAAID,CAE9B,CACAvC,EAAI,aAAaE,EAAS,EAAG,CAAC,EAG9B,IAAML,EAAS,OAAO,MAAQsC,EAAS,EAAK,EAAEA,EAAS,IAAM,KAC7D,KAAK,aAAe9C,EAAc,aAAa,KAAK,SAAUQ,EAAOC,CAAM,EAC3E,IAAM6C,EAAO,KAAK,aAAa,WAAW,KAAM,CAAE,MAAO,EAAM,CAAC,EAChE,GAAI,CAACA,EAAM,CACT,KAAK,aAAe,OACpB,MACF,CACA,QAASC,EAAI,EAAGA,EAAI/C,EAAO+C,GAAKT,EAC9BQ,EAAK,UAAUP,EAAWQ,EAAG,CAAC,EAEhC,IAAMC,EAAc,KAAK,aACzBxD,EAAc,kBAAkBwD,CAAW,EAAE,KAAKC,GAAU,CACtD,KAAK,eAAiBD,EAAaC,GAAQ,MAAM,EAChD,KAAK,mBAAqBA,CACjC,CAAC,EAAE,MAAM,IAAM,CAAC,CAAC,CACnB,CAEA,IAAW,UAAiC,CAC1C,OAAO,KAAK,UAAU,MAAM,qBAAqB,OAAO,QAC1D,CACF,ECnaO,IAAMC,EAA+B,CAC1C,MAAO,EACP,OAAQ,EACV,EAQMC,EAAN,MAAMC,CAAkD,CAqDtD,YACEC,EAAc,EACdC,EAAgB,EACTC,EAAU,GACVC,EAAS,GAChB,CAFO,aAAAD,EACA,YAAAC,EAxDT,KAAQ,KAAe,EA4CvB,KAAQ,OAAiB,EAcvB,KAAK,KAAOH,EACZ,KAAK,OAASC,CAChB,CA3DA,IAAW,KAAc,CACvB,OAAI,KAAK,OAEJ,KAAK,KAAO,WACZ,KAAK,gBAAkB,GAGrB,KAAK,IACd,CACA,IAAW,IAAIG,EAAe,CAAE,KAAK,KAAOA,CAAO,CAEnD,IAAW,gBAAiC,CAE1C,OAAI,KAAK,UAGD,KAAK,KAAO,YAA6B,EACnD,CACA,IAAW,eAAeA,EAAuB,CAC/C,KAAK,MAAQ,WACb,KAAK,MAASA,GAAS,GAAM,SAC/B,CAEA,IAAW,gBAAyB,CAClC,OAAO,KAAK,KAAQ,QACtB,CACA,IAAW,eAAeA,EAAe,CACvC,KAAK,MAAQ,UACb,KAAK,MAAQA,EAAS,QACxB,CAEA,IAAW,wBAAiC,CAC1C,IAAMC,GAAO,KAAK,KAAO,aAA4B,GACrD,OAAIA,EAAM,EACDA,EAAM,WAERA,CACT,CACA,IAAW,uBAAuBD,EAAe,CAC/C,KAAK,MAAQ,UACb,KAAK,MAASA,GAAS,GAAM,UAC/B,CAGA,IAAW,OAAgB,CACzB,OAAO,KAAK,MACd,CACA,IAAW,MAAMA,EAAe,CAC9B,KAAK,OAASA,CAChB,CAYO,OAA6B,CASlC,OAAO,IAAIL,EAAmB,KAAK,KAAM,KAAK,OAAQ,KAAK,QAAS,KAAK,MAAM,CACjF,CAEO,SAAmB,CACxB,OAAO,KAAK,iBAAmB,GAAuB,KAAK,SAAW,GAAK,KAAK,UAAY,EAC9F,CACF,EACMO,EAAc,IAAIR,EAUXS,EAAN,KAA0C,CAkB/C,YACUC,EACAC,EACAC,EACR,CAHQ,eAAAF,EACA,eAAAC,EACA,WAAAC,EAnBV,KAAQ,QAAmC,IAAI,IAE/C,KAAQ,QAAU,EAElB,KAAQ,UAAY,EAEpB,KAAQ,cAAgB,GAExB,KAAQ,gBAAkB,GAE1B,KAAQ,YAAsB,KAW5B,GAAI,CACF,KAAK,SAAS,KAAK,MAAM,YAAY,CACvC,OAASC,EAAY,CACfA,aAAa,OACf,QAAQ,MAAMA,EAAE,OAAO,EAEzB,QAAQ,KAAK,0BAA0B,KAAK,SAAS,CAAC,KAAK,CAC7D,CACA,KAAK,iBAAmB,CACtB,KAAM,KAAK,UAAU,KACrB,KAAM,KAAK,UAAU,IACvB,CACF,CAEO,SAAgB,CACrB,KAAK,MAAM,CACb,CAEO,OAAc,CACnB,QAAWC,KAAQ,KAAK,QAAQ,OAAO,EACrCA,EAAK,QAAQ,QAAQ,EAIvB,KAAK,QAAQ,MAAM,EACnB,KAAK,UAAU,SAAS,CAC1B,CAEO,UAAmB,CACxB,OAAO,KAAK,YAAc,EAAI,GAChC,CAEO,SAASR,EAAqB,CACnC,GAAIA,EAAQ,IAAOA,EAAQ,IACzB,MAAM,WAAW,mEAAmE,EAEtF,KAAK,YAAeA,EAAQ,EAAI,MAAa,EAC7C,KAAK,aAAa,CAAC,CACrB,CAEO,UAAmB,CACxB,OAAO,KAAK,iBAAiB,EAAI,EAAI,GACvC,CAEQ,kBAA2B,CACjC,IAAIS,EAAe,EACnB,QAAWD,KAAQ,KAAK,QAAQ,OAAO,EACjCA,EAAK,OACPC,GAAgBD,EAAK,KAAK,MAAQA,EAAK,KAAK,OACxCA,EAAK,QAAUA,EAAK,SAAWA,EAAK,OACtCC,GAAgBD,EAAK,OAAO,MAAQA,EAAK,OAAO,SAItD,OAAOC,CACT,CAEQ,QAAQC,EAAkB,CAChC,IAAMF,EAAO,KAAK,QAAQ,IAAIE,CAAE,EAC3BF,IACL,KAAK,QAAQ,OAAOE,CAAE,EAElB,OAAO,aAAeF,EAAK,gBAAgB,aAC7CA,EAAK,KAAK,MAAM,EAElB,KAAK,iBAAiBE,CAAE,EAC1B,CAKO,eAAsB,CAE3B,IAAMC,EAAO,CAAC,EACd,OAAW,CAACD,EAAIF,CAAI,IAAK,KAAK,QAAQ,QAAQ,EACxCA,EAAK,aAAe,cACtBA,EAAK,QAAQ,QAAQ,EACrBG,EAAK,KAAKD,CAAE,GAGhB,QAAWA,KAAMC,EACf,KAAK,QAAQD,CAAE,EAGjB,KAAK,gBAAkB,GACvB,KAAK,cAAgB,EACvB,CAMO,YAAYA,EAAkB,CACnC,IAAMF,EAAO,KAAK,QAAQ,IAAIE,CAAE,EAC5BF,IACFA,EAAK,QAAQ,QAAQ,EACrB,KAAK,QAAQE,CAAE,EAEnB,CAaO,SAASE,EAAsCC,EAA6B,CAEjF,KAAK,aAAaD,EAAI,MAAQA,EAAI,MAAM,EAGxC,IAAIE,EAAW,KAAK,UAAU,UAC1BA,EAAS,QAAU,IAAMA,EAAS,SAAW,MAC/CA,EAAWrB,GAEb,IAAMsB,EAAO,KAAK,KAAKH,EAAI,MAAQE,EAAS,KAAK,EAC3CE,EAAO,KAAK,KAAKJ,EAAI,OAASE,EAAS,MAAM,EAE7ChB,EAAU,EAAE,KAAK,QAEjBmB,EAAS,KAAK,UAAU,MAAM,OAC9BC,EAAW,KAAK,UAAU,KAC1BC,EAAW,KAAK,UAAU,KAC1BC,EAAUH,EAAO,EACjBI,EAAUJ,EAAO,EACnBK,EAASF,EACTG,EAAY,EAEXV,EAAK,YACRI,EAAO,EAAI,EACXA,EAAO,EAAI,EACXK,EAAS,GAGX,KAAK,UAAU,MAAM,cAAc,iBAAiB,UAAUL,EAAO,CAAC,EACtE,QAASO,EAAM,EAAGA,EAAMR,EAAM,EAAEQ,EAAK,CACnC,IAAMC,EAAOR,EAAO,MAAM,IAAIA,EAAO,EAAIA,EAAO,KAAK,EACrD,QAASS,EAAM,EAAGA,EAAMX,GAClB,EAAAO,EAASI,GAAOR,GADQ,EAAEQ,EAE9B,KAAK,aAAaD,EAAwBH,EAASI,EAAK5B,EAAS0B,EAAMT,EAAOW,CAAG,EACjFH,IAEF,GAAIV,EAAK,UACHW,EAAMR,EAAO,GAAG,KAAK,UAAU,MAAM,cAAc,SAAS,UAE5D,EAAEC,EAAO,GAAKE,EAAU,MAE9BF,EAAO,EAAIK,CACb,CACA,KAAK,UAAU,MAAM,cAAc,iBAAiB,UAAUL,EAAO,CAAC,EAGlEJ,EAAK,UACHA,EAAK,YAAc,MACrBI,EAAO,EAAI,KAAK,IAAIK,EAASP,EAAMG,CAAQ,EAE3CD,EAAO,EAAIK,GAGbL,EAAO,EAAIG,EACXH,EAAO,EAAII,GAIb,IAAMV,EAAO,CAAC,EACd,OAAW,CAACD,EAAIF,CAAI,IAAK,KAAK,QAAQ,QAAQ,EACxCA,EAAK,UAAY,IACnBA,EAAK,QAAQ,QAAQ,EACrBG,EAAK,KAAKD,CAAE,GAGhB,QAAWA,KAAMC,EACf,KAAK,QAAQD,CAAE,EAKjB,IAAMiB,EAAY,KAAK,UAAU,eAAe,CAAC,EACjDA,GAAW,UAAU,IAAM,CACZ,KAAK,QAAQ,IAAI7B,CAAO,GAEnC,KAAK,QAAQA,CAAO,CAExB,CAAC,EAIG,KAAK,UAAU,OAAO,OAAO,OAAS,aACxC,KAAK,kBAAkB,EAIzB,IAAM8B,EAAsB,CAC1B,KAAMhB,EACN,aAAcE,EACd,OAAQF,EACR,eAAgB,CAAE,GAAGE,CAAS,EAC9B,OAAQa,GAAa,OACrB,UAAAJ,EACA,WAAY,KAAK,UAAU,OAAO,OAAO,KACzC,MAAOV,EAAK,MACZ,OAAQA,EAAK,MACf,EAGA,YAAK,QAAQ,IAAIf,EAAS8B,CAAO,EACjC,KAAK,eAAe,EACb9B,CACT,CAQO,OAAO+B,EAA6C,CAEzD,IAAIC,EAAe,GACfC,EAAkB,GACtB,QAAWvB,KAAQ,KAAK,QAAQ,OAAO,EAMrC,GALIA,EAAK,QAAU,SACjBuB,EAAkB,GAElBD,EAAe,GAEbA,GAAgBC,EAAiB,MAIvC,GAAID,GAAgB,CAAC,KAAK,UAAU,SAAS,KAAK,IAChD,KAAK,UAAU,iBAAiB,KAAK,EACjC,CAAC,KAAK,UAAU,SAAS,KAAK,GAAG,OAUvC,GARIC,GAAmB,CAAC,KAAK,UAAU,SAAS,QAAQ,GACtD,KAAK,UAAU,iBAAiB,QAAQ,EAI1C,KAAK,UAAU,cAAc,EAGzB,CAAC,KAAK,QAAQ,KAAM,CACjB,KAAK,gBACR,KAAK,UAAU,SAAS,EACxB,KAAK,cAAgB,GACrB,KAAK,gBAAkB,IAErB,KAAK,UAAU,SAAS,KAAK,GAC/B,KAAK,UAAU,mBAAmB,KAAK,EAErC,KAAK,UAAU,SAAS,QAAQ,GAClC,KAAK,UAAU,mBAAmB,QAAQ,EAE5C,MACF,CAGI,CAACD,GAAgB,KAAK,UAAU,SAAS,KAAK,IAChD,KAAK,UAAU,SAAS,KAAK,EAC7B,KAAK,UAAU,mBAAmB,KAAK,GAErC,CAACC,GAAmB,KAAK,UAAU,SAAS,QAAQ,IACtD,KAAK,UAAU,SAAS,QAAQ,EAChC,KAAK,UAAU,mBAAmB,QAAQ,GAIxC,KAAK,kBACP,KAAK,UAAU,SAAS,EACxB,KAAK,cAAgB,GACrB,KAAK,gBAAkB,IAGzB,GAAM,CAAE,MAAAC,EAAO,IAAAC,CAAI,EAAIJ,EACjBZ,EAAS,KAAK,UAAU,MAAM,OAC9BF,EAAO,KAAK,UAAU,MAAM,KAGlC,KAAK,UAAU,WAAWiB,EAAOC,CAAG,EAGpC,IAAMC,EAAgG,CAAC,EACjGC,EAAkE,CAAC,EAGzE,QAASX,EAAMQ,EAAOR,GAAOS,EAAK,EAAET,EAAK,CACvC,IAAMC,EAAOR,EAAO,MAAM,IAAIO,EAAMP,EAAO,KAAK,EAChD,GAAI,CAACQ,EAAM,OACX,QAASC,EAAM,EAAGA,EAAMX,EAAM,EAAEW,EAC9B,GAAID,EAAK,MAAMC,CAAG,EAAI,UAAsB,CAC1C,IAAInB,EAAyBkB,EAAK,eAAeC,CAAG,GAAKxB,EACnDJ,EAAUS,EAAE,QAClB,GAAIT,IAAY,QAAaA,IAAY,GACvC,SAEF,IAAM8B,EAAU,KAAK,QAAQ,IAAI9B,CAAO,EACxC,GAAIS,EAAE,SAAW,GAAI,CACnB,IAAM6B,EAAY7B,EAAE,OACd8B,EAAWX,EACbY,EAAQ,EAOZ,KACE,EAAEZ,EAAMX,GACJU,EAAK,MAAMC,CAAG,EAAI,YAClBnB,EAAIkB,EAAK,eAAeC,CAAG,GAAKxB,IAChCK,EAAE,UAAYT,GACdS,EAAE,SAAW6B,EAAYE,GAE7BA,IAEFZ,IACIE,EACEA,EAAQ,QACVM,EAAU,KAAK,CAAE,QAAAN,EAAS,OAAQQ,EAAW,IAAKC,EAAU,IAAAb,EAAK,MAAAc,CAAM,CAAC,EAEjE,KAAK,MAAM,iBACpBH,EAAiB,KAAK,CAAE,IAAKE,EAAU,IAAAb,EAAK,MAAAc,CAAM,CAAC,EAErD,KAAK,cAAgB,EACvB,CACF,CAEJ,CAGAJ,EAAU,KAAK,CAACK,EAAGC,IAAMD,EAAE,QAAQ,OAASC,EAAE,QAAQ,MAAM,EAG5D,QAAWC,KAAQN,EACjB,KAAK,UAAU,gBAAgBM,EAAK,IAAKA,EAAK,IAAKA,EAAK,KAAK,EAI/D,QAAWA,KAAQP,EACjB,KAAK,UAAU,KAAKO,EAAK,QAASA,EAAK,OAAQA,EAAK,IAAKA,EAAK,IAAKA,EAAK,KAAK,CAEjF,CAEO,eAAeC,EAA+C,CAEnE,GAAI,CAAC,KAAK,QAAQ,KAAM,CACtB,KAAK,iBAAmBA,EACxB,MACF,CAIA,GAAI,KAAK,iBAAiB,MAAQA,EAAQ,KAAM,CAC9C,KAAK,iBAAmBA,EACxB,MACF,CAGA,IAAMzB,EAAS,KAAK,UAAU,MAAM,OAC9BD,EAAOC,EAAO,MAAM,OACpB0B,EAAS,KAAK,iBAAiB,KAAO,EAC5C,QAASnB,EAAM,EAAGA,EAAMR,EAAM,EAAEQ,EAAK,CACnC,IAAMC,EAAOR,EAAO,MAAM,IAAIO,CAAG,EACjC,GAAIC,EAAK,MAAMkB,CAAM,EAAI,UAAsB,CAC7C,IAAMpC,EAAyBkB,EAAK,eAAekB,CAAM,GAAKzC,EACxDJ,EAAUS,EAAE,QAClB,GAAIT,IAAY,QAAaA,IAAY,GACvC,SAEF,IAAM8B,EAAU,KAAK,QAAQ,IAAI9B,CAAO,EACxC,GAAI,CAAC8B,EACH,SAGF,IAAMgB,EAAc,KAAK,MAAMhB,EAAQ,QAAQ,OAAS,GAAKA,EAAQ,eAAe,KAAK,EACzF,GAAKrB,EAAE,OAASqC,EAAe,GAAKA,EAClC,SAGF,IAAIC,EAAU,GACd,QAASC,EAAWH,EAAS,EAAGG,EAAWJ,EAAQ,KAAM,EAAEI,EACzD,GAAIrB,EAAK,MAAMqB,EAAW,EAAY,CAAY,EAAI,QAA0B,CAC9ED,EAAU,GACV,KACF,CAEF,GAAIA,EACF,SAGF,IAAMZ,EAAM,KAAK,IAAIS,EAAQ,KAAME,EAAerC,EAAE,OAASqC,EAAeD,CAAM,EAC9EI,EAAWxC,EAAE,OACjB,QAASyC,EAAYL,EAAS,EAAGK,EAAYf,EAAK,EAAEe,EAClD,KAAK,aAAavB,EAAwBuB,EAAWlD,EAAS,EAAEiD,CAAQ,EACxEnB,EAAQ,WAEZ,CACF,CAEA,KAAK,iBAAmBc,CAC1B,CAKO,qBAAqBO,EAAWC,EAA0C,CAE/E,IAAMzB,EADS,KAAK,UAAU,MAAM,OAChB,MAAM,IAAIyB,CAAC,EAC/B,GAAIzB,GAAQA,EAAK,MAAMwB,CAAC,EAAI,UAAsB,CAChD,IAAM1C,EAAyBkB,EAAK,eAAewB,CAAC,GAAK/C,EACzD,GAAIK,EAAE,SAAWA,EAAE,UAAY,GAAI,CACjC,IAAM4C,EAAO,KAAK,QAAQ,IAAI5C,EAAE,OAAO,GAAG,KAC1C,GAAI,OAAO,aAAe4C,aAAgB,YAAa,CACrD,IAAMC,EAASC,EAAc,aAAa,OAAO,SAAUF,EAAK,MAAOA,EAAK,MAAM,EAClF,OAAAC,EAAO,WAAW,IAAI,GAAG,UAAUD,EAAM,EAAG,EAAGA,EAAK,MAAOA,EAAK,MAAM,EAC/DC,CACT,CACA,OAAOD,CACT,CACF,CACF,CAKO,wBAAwBF,EAAWC,EAA0C,CAElF,IAAMzB,EADS,KAAK,UAAU,MAAM,OAChB,MAAM,IAAIyB,CAAC,EAC/B,GAAIzB,GAAQA,EAAK,MAAMwB,CAAC,EAAI,UAAsB,CAChD,IAAM1C,EAAyBkB,EAAK,eAAewB,CAAC,GAAK/C,EACzD,GAAIK,EAAE,SAAWA,EAAE,UAAY,IAAMA,EAAE,SAAW,GAAI,CACpD,IAAMC,EAAO,KAAK,QAAQ,IAAID,EAAE,OAAO,EACvC,GAAIC,EACF,OAAO,KAAK,UAAU,YAAYA,EAAMD,EAAE,MAAM,CAEpD,CACF,CACF,CAIQ,aAAa+C,EAAsB,CACzC,IAAMC,EAAO,KAAK,iBAAiB,EAC/BC,EAAUD,EACd,KAAO,KAAK,YAAcC,EAAUF,GAAQ,KAAK,QAAQ,MAAM,CAC7D,IAAM9C,EAAO,KAAK,QAAQ,IAAI,EAAE,KAAK,SAAS,EAC1CA,GAAQA,EAAK,OACfgD,GAAWhD,EAAK,KAAK,MAAQA,EAAK,KAAK,OACnCA,EAAK,QAAUA,EAAK,OAASA,EAAK,SACpCgD,GAAWhD,EAAK,OAAO,MAAQA,EAAK,OAAO,QAE7CA,EAAK,QAAQ,QAAQ,EACrB,KAAK,QAAQ,KAAK,SAAS,EAE/B,CACA,OAAO+C,EAAOC,CAChB,CAEQ,aAAa/B,EAAsBwB,EAAWnD,EAAiBC,EAAsB,CAC3F,GAAI0B,EAAK,MAAMwB,EAAI,EAAY,CAAO,EAAI,UAAsB,CAC9D,IAAMQ,EAAMhC,EAAK,eAAewB,CAAC,EACjC,GAAIQ,EAAK,CACP,GAAIA,EAAI,UAAY,OAAW,CAI7B,IAAMC,EAAU,KAAK,QAAQ,IAAID,EAAI,OAAO,EACxCC,GAEFA,EAAQ,YAEVD,EAAI,QAAU3D,EACd2D,EAAI,OAAS1D,EACb,MACF,CAEA0B,EAAK,eAAewB,CAAC,EAAI,IAAIvD,EAAmB+D,EAAI,IAAKA,EAAI,MAAO3D,EAASC,CAAM,EACnF,MACF,CACF,CAEA0B,EAAK,MAAMwB,EAAI,EAAY,CAAO,GAAK,UACvCxB,EAAK,eAAewB,CAAC,EAAI,IAAIvD,EAAmB,EAAG,EAAGI,EAASC,CAAM,CACvE,CAEQ,mBAA0B,CAEhC,QAAWS,KAAQ,KAAK,QAAQ,OAAO,EACjCA,EAAK,aAAe,cACtBA,EAAK,UAAY,GAIrB,IAAMS,EAAS,KAAK,UAAU,MAAM,OACpC,QAASiC,EAAI,EAAGA,EAAI,KAAK,UAAU,KAAM,EAAEA,EAAG,CAC5C,IAAMzB,EAAOR,EAAO,MAAM,IAAIiC,CAAC,EAC/B,GAAKzB,GAGL,QAASwB,EAAI,EAAGA,EAAI,KAAK,UAAU,KAAM,EAAEA,EACzC,GAAIxB,EAAK,MAAMwB,EAAI,EAAY,CAAO,EAAI,UAAsB,CAC9D,IAAMU,EAAQlC,EAAK,eAAewB,CAAC,GAAG,QACtC,GAAIU,EAAO,CACT,IAAMnD,EAAO,KAAK,QAAQ,IAAImD,CAAK,EAC/BnD,GACFA,EAAK,WAET,CACF,EAEJ,CAEA,IAAMG,EAAO,CAAC,EACd,OAAW,CAACD,EAAIF,CAAI,IAAK,KAAK,QAAQ,QAAQ,EACxCA,EAAK,aAAe,aAAe,CAACA,EAAK,YAC3CA,EAAK,QAAQ,QAAQ,EACrBG,EAAK,KAAKD,CAAE,GAGhB,QAAWA,KAAMC,EACf,KAAK,QAAQD,CAAE,CAEnB,CACF,ECnpBA,IAAAkD,GAA0B,QAC1BC,GAAuB,QC2CvB,SAASC,EAAMC,EAA2B,CACxC,IAAIC,EAAI,GACR,QAASC,EAAI,EAAGA,EAAIF,EAAK,OAAQ,EAAEE,EACjCD,GAAK,OAAO,aAAaD,EAAKE,CAAC,CAAC,EAElC,OAAOD,CACT,CAGA,SAASE,GAAMH,EAA2B,CACxC,IAAII,EAAI,EACR,QAASF,EAAI,EAAGA,EAAIF,EAAK,OAAQ,EAAEE,EAAG,CACpC,GAAIF,EAAKE,CAAC,EAAI,IAAMF,EAAKE,CAAC,EAAI,GAC5B,MAAM,IAAI,MAAM,cAAc,EAEhCE,EAAIA,EAAI,GAAKJ,EAAKE,CAAC,EAAI,EACzB,CACA,OAAOE,CACT,CAGA,SAASC,GAAOL,EAA2B,CACzC,IAAMI,EAAIL,EAAMC,CAAI,EACpB,GAAI,CAACI,EAAE,MAAM,kCAAkC,EAC7C,MAAM,IAAI,MAAM,cAAc,EAEhC,OAAOA,CACT,CAGA,SAASE,GAAON,EAA2B,CACzC,GAAI,OAAO,OAAW,IACpB,OAAO,OAAO,KAAKD,EAAMC,CAAI,EAAG,QAAQ,EAAE,SAAS,EAErD,IAAMO,EAAK,KAAKR,EAAMC,CAAI,CAAC,EACrBQ,EAAI,IAAI,WAAWD,EAAG,MAAM,EAClC,QAAS,EAAI,EAAG,EAAIC,EAAE,OAAQ,EAAE,EAC9BA,EAAE,CAAC,EAAID,EAAG,WAAW,CAAC,EAExB,OAAO,IAAI,YAAY,EAAE,OAAOC,CAAC,CACnC,CAEA,IAAMC,GAAiE,CACrE,OAAQN,GACR,KAAMA,GACN,KAAMG,GACN,MAAOD,GACP,OAAQA,GACR,oBAAqBF,EACvB,EAKMO,GAAc,CAAC,GAAI,IAAK,IAAK,GAAG,EAEhCC,GAAuB,CAAC,GAAI,IAAK,IAAK,IAAK,IAAK,IAAK,GAAI,IAAK,IAAK,GAAI,IAAK,IAAK,GAAG,EAEpFC,GAAkB,CAAC,GAAI,IAAK,IAAK,IAAK,GAAI,GAAI,IAAK,GAAG,EAEtDC,GAAiB,CAAC,GAAI,IAAK,IAAK,IAAK,GAAI,IAAK,GAAG,EAEjDC,GAAwB,CAAC,GAAI,IAAK,IAAK,IAAK,IAAK,IAAK,GAAI,IAAK,IAAK,IAAK,GAAI,IAAK,IAAK,GAAG,EAG1FC,GAAiB,KAGVC,EAAN,KAAmB,CAAnB,cACL,KAAO,MAAqB,EAC5B,KAAQ,QAAU,IAAI,YAAYD,EAAc,EAChD,KAAQ,UAAY,EACpB,KAAQ,KAAO,GACf,KAAO,OAA4E,CAAC,EAE7E,OAAc,CACnB,KAAK,QAAQ,KAAK,CAAC,EACnB,KAAK,MAAQ,EACb,KAAK,UAAY,EACjB,KAAK,OAAS,CAAC,EACf,KAAK,KAAO,EACd,CAEO,KAAc,CACnB,GAAI,KAAK,QAAU,EAAmB,CACpC,GAAI,KAAK,YAAcF,GAAe,OAAQ,CAC5C,QAASI,EAAI,EAAGA,EAAIJ,GAAe,OAAQ,EAAEI,EAC3C,GAAI,KAAK,QAAQA,CAAC,IAAMJ,GAAeI,CAAC,EAAG,OAAO,KAAK,GAAG,EAE5D,YAAK,OAAO,KAAU,EACtB,KAAK,MAAQ,EACN,CACT,CACA,GAAI,KAAK,YAAcH,GAAsB,OAAQ,CACnD,QAASG,EAAI,EAAGA,EAAIH,GAAsB,OAAQ,EAAEG,EAClD,GAAI,KAAK,QAAQA,CAAC,IAAMH,GAAsBG,CAAC,EAAG,OAAO,KAAK,GAAG,EAEnE,YAAK,OAAO,KAAU,EACtB,KAAK,MAAQ,EACN,CACT,CACA,OAAO,KAAK,GAAG,CACjB,CACA,OAAI,KAAK,QAAU,EAAwB,EACvC,KAAK,QAAU,GACd,KAAK,OAAO,OAAS,EAEnB,KAAK,YAAY,KAAK,SAAS,GACpC,KAAK,MAAQ,EACN,GAFuC,KAAK,GAAG,EAIjD,KAAK,GAAG,CACjB,CAEO,MAAMjB,EAAmBkB,EAAeC,EAAqB,CAClE,IAAIC,EAAQ,KAAK,MACbC,EAAM,KAAK,UACTC,EAAS,KAAK,QAEpB,GADIF,IAAU,GAAqBA,IAAU,GACzCA,IAAU,GAAqBC,EAAM,GAAI,MAAO,GACpD,QAASnB,EAAIgB,EAAOhB,EAAIiB,EAAK,EAAEjB,EAAG,CAChC,IAAMqB,EAAIvB,EAAKE,CAAC,EAChB,OAAQqB,EAAG,CACT,IAAK,IACH,GAAI,CAAC,KAAK,YAAYF,CAAG,EAAG,OAAO,KAAK,GAAG,EAC3CD,EAAQ,EACRC,EAAM,EACN,MACF,IAAK,IACH,GAAID,IAAU,EAAmB,CAC/B,GAAIE,EAAO,CAAC,IAAM,GAAI,CAEpB,IAAIL,EAAI,EACR,KAAOA,EAAIP,GAAY,OAAQ,EAAEO,EAC/B,GAAIK,EAAOL,CAAC,IAAMP,GAAYO,CAAC,EAAG,OAAO,KAAK,GAAG,EAGnD,GADA,KAAK,OAAO,KAAU,EAClBI,IAAQT,GAAgB,OAAQ,CAClC,KAAOK,EAAIL,GAAgB,OAAQ,EAAEK,EACnC,GAAIK,EAAOL,CAAC,IAAML,GAAgBK,CAAC,EAAG,OAAO,KAAK,GAAG,EAEvD,YAAK,OAAO,KAAU,EACtB,KAAK,MAAQ,EACNf,EAAI,CACb,CACF,SAAWoB,EAAO,CAAC,IAAM,GAAI,CAE3B,QAASL,EAAI,EAAGA,EAAIN,GAAqB,OAAQ,EAAEM,EACjD,GAAIK,EAAOL,CAAC,IAAMN,GAAqBM,CAAC,EAAG,OAAO,KAAK,GAAG,EAE5D,KAAK,OAAO,KAAU,CACxB,KACE,QAAO,KAAK,GAAG,EAEjBG,EAAQ,EACRC,EAAM,CACR,SAAWD,IAAU,EAAiB,CACpC,GAAI,CAAC,KAAK,UAAUC,CAAG,EAAG,OAAO,KAAK,GAAG,EACzCD,EAAQ,EACRC,EAAM,CACR,SAAWD,IAAU,EAAmB,CACtC,GAAIC,GAAON,GAAgB,OAAO,KAAK,GAAG,EAC1CO,EAAOD,GAAK,EAAIE,CAClB,CACA,MACF,IAAK,IACH,OAAIH,IAAU,GACR,CAAC,KAAK,YAAYC,CAAG,EAAU,KAAK,GAAG,GAE7C,KAAK,MAAQ,EACNnB,EAAI,GACb,QACE,GAAImB,GAAON,GAAgB,OAAO,KAAK,GAAG,EAC1CO,EAAOD,GAAK,EAAIE,CACpB,CACF,CACA,YAAK,MAAQH,EACb,KAAK,UAAYC,EACV,EACT,CAEQ,IAAa,CACnB,YAAK,OAAO,KAAO,EACnB,KAAK,MAAQ,EACN,EACT,CAEQ,UAAUA,EAAsB,CACtC,IAAMJ,EAAIlB,EAAM,KAAK,QAAQ,SAAS,EAAGsB,CAAG,CAAC,EAC7C,OAAIJ,GACF,KAAK,KAAOA,EACZ,KAAK,OAAOA,CAAC,EAAI,KACV,IAEF,EACT,CAEQ,YAAYI,EAAsB,CACxC,GAAI,KAAK,KAAM,CACb,GAAI,CACF,IAAMjB,EAAI,KAAK,QAAQ,MAAM,EAAGiB,CAAG,EACnC,KAAK,OAAO,KAAK,IAAI,EAAIZ,GAAS,KAAK,IAAI,EAAIA,GAAS,KAAK,IAAI,EAAEL,CAAC,EAAIA,CAC1E,MAAQ,CACN,MAAO,EACT,CACA,MAAO,EACT,CACA,MAAO,EACT,CACF,ECvPO,IAAMoB,EAA6B,CACxC,KAAM,cACN,MAAO,EACP,OAAQ,CACV,EAEO,SAASC,GAAUC,EAAyB,CACjD,GAAIA,EAAE,OAAS,GACb,OAAOF,EAET,IAAMG,EAAM,IAAI,YAAYD,EAAE,OAAQA,EAAE,WAAY,CAAC,EAGrD,GAAIC,EAAI,CAAC,IAAM,YAAcA,EAAI,CAAC,IAAM,WAAcA,EAAI,CAAC,IAAM,WAC/D,MAAO,CACL,KAAM,YACN,MAAQD,EAAE,EAAE,GAAK,GAAKA,EAAE,EAAE,GAAK,GAAKA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,EACrD,OAAQA,EAAE,EAAE,GAAK,GAAKA,EAAE,EAAE,GAAK,GAAKA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,CACvD,EAGF,GAAIA,EAAE,CAAC,IAAM,KAAQA,EAAE,CAAC,IAAM,KAAQA,EAAE,CAAC,IAAM,IAAM,CACnD,GAAM,CAACE,EAAOC,CAAM,EAAIC,GAAQJ,CAAC,EACjC,MAAO,CAAE,KAAM,aAAc,MAAAE,EAAO,OAAAC,CAAO,CAC7C,CAEA,GAAIF,EAAI,CAAC,IAAM,YAAeD,EAAE,CAAC,IAAM,IAAQA,EAAE,CAAC,IAAM,KAASA,EAAE,CAAC,IAAM,GACxE,MAAO,CACL,KAAM,YACN,MAAQA,EAAE,CAAC,GAAK,EAAIA,EAAE,CAAC,EACvB,OAAQA,EAAE,CAAC,GAAK,EAAIA,EAAE,CAAC,CACzB,EAGF,GAAIC,EAAI,CAAC,IAAM,WACb,MAAO,CACL,KAAM,YACN,MAAQD,EAAE,CAAC,GAAK,GAAKA,EAAE,CAAC,GAAK,GAAKA,EAAE,CAAC,GAAK,EAAIA,EAAE,CAAC,EACjD,OAAQA,EAAE,CAAC,GAAK,GAAKA,EAAE,CAAC,GAAK,GAAKA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,CACrD,EAGF,GAAIC,EAAI,CAAC,IAAM,YAAcA,EAAI,CAAC,IAAM,aAAeA,EAAI,CAAC,EAAI,YAAc,QAAU,CACtF,OAAQD,EAAE,EAAE,EAAG,CACb,IAAK,IACH,MAAO,CACL,KAAM,aACN,OAASA,EAAE,EAAE,EAAIA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,GAAK,IAAM,EAC7C,QAASA,EAAE,EAAE,EAAIA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,GAAK,IAAM,CAC/C,EACF,IAAK,IACH,GAAIA,EAAE,EAAE,IAAM,GAAM,OAAOF,EAC3B,IAAMO,EAAML,EAAE,EAAE,EAAIA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,GAAK,GAAKA,EAAE,EAAE,GAAK,GACxD,MAAO,CACL,KAAM,aACN,OAASK,EAAa,OAAU,EAChC,QAASA,IAAQ,GAAK,OAAU,CAClC,EACF,IAAK,IACH,OAAIL,EAAE,EAAE,IAAM,KAAQA,EAAE,EAAE,IAAM,GAAQA,EAAE,EAAE,IAAM,GAAaF,EACxD,CACL,KAAM,aACN,OAASE,EAAE,EAAE,EAAIA,EAAE,EAAE,GAAK,GAAK,MAC/B,QAASA,EAAE,EAAE,EAAIA,EAAE,EAAE,GAAK,GAAK,KACjC,CACJ,CACA,OAAOF,CACT,CAEA,GAAIG,EAAI,CAAC,IAAM,aAAeA,EAAI,CAAC,IAAM,YAAcA,EAAI,CAAC,IAAM,YAAa,CAC7E,IAAIK,EAAM,GAEJC,EAAQ,KAAK,IAAIP,EAAE,OAAS,GAAI,IAAI,EAC1C,QAASQ,EAAI,EAAGA,EAAID,EAAOC,IAEzB,GAAIR,EAAEQ,CAAC,IAAM,KAAQR,EAAEQ,EAAI,CAAC,IAAM,KAAQR,EAAEQ,EAAI,CAAC,IAAM,KAAQR,EAAEQ,EAAI,CAAC,IAAM,IAAM,CAChFF,EAAME,EACN,KACF,CAEF,GAAIF,IAAQ,GAAI,CAEd,IAAMJ,EACJF,EAAEM,EAAO,CAAC,GAAK,GACfN,EAAEM,EAAO,CAAC,GAAK,GACfN,EAAEM,EAAM,EAAE,GAAM,EAChBN,EAAEM,EAAM,EAAE,EACNH,EACJH,EAAEM,EAAM,EAAE,GAAK,GACfN,EAAEM,EAAM,EAAE,GAAK,GACfN,EAAEM,EAAM,EAAE,GAAM,EAChBN,EAAEM,EAAM,EAAE,EACZ,GAAIJ,EAAQ,GAAKC,EAAS,EACxB,MAAO,CAAE,KAAM,aAAc,MAAAD,EAAO,OAAAC,CAAO,CAE/C,CACA,OAAOL,CACT,CACA,OAAOA,CACT,CAGA,SAASM,GAAQJ,EAAiC,CAChD,IAAMS,EAAMT,EAAE,OACVQ,EAAI,EACJE,EAAcV,EAAEQ,CAAC,GAAK,EAAIR,EAAEQ,EAAI,CAAC,EACrC,OAAa,CAEX,GADAA,GAAKE,EACDF,GAAKC,EAEP,MAAO,CAAC,EAAG,CAAC,EAEd,GAAIT,EAAEQ,CAAC,IAAM,IACX,MAAO,CAAC,EAAG,CAAC,EAEd,GAAIR,EAAEQ,EAAI,CAAC,IAAM,KAAQR,EAAEQ,EAAI,CAAC,IAAM,IACpC,OAAIA,EAAI,EAAIC,EACH,CACLT,EAAEQ,EAAI,CAAC,GAAK,EAAIR,EAAEQ,EAAI,CAAC,EACvBR,EAAEQ,EAAI,CAAC,GAAK,EAAIR,EAAEQ,EAAI,CAAC,CACzB,EAEK,CAAC,EAAG,CAAC,EAEdA,GAAK,EACLE,EAAcV,EAAEQ,CAAC,GAAK,EAAIR,EAAEQ,EAAI,CAAC,CACnC,CACF,CFrHA,IAAMG,GAAgC,CACpC,OACA,KAAM,eACN,KAAM,EACN,MAAO,OACP,OAAQ,OACR,oBAAqB,EACrB,OAAQ,CACV,EAGaC,GAAN,KAAuD,CAU5D,YACmBC,EACAC,EACAC,EACAC,EACjB,CAJiB,WAAAH,EACA,eAAAC,EACA,cAAAC,EACA,mBAAAC,EAbnB,KAAQ,YAAc,EACtB,KAAQ,SAAW,GACnB,KAAQ,IAAM,IAAIC,EAClB,KAAQ,QAAyBN,GAGjC,KAAQ,aAAe,GACvB,KAAQ,YAAc,GAQpB,IAAMO,EAAkB,KAAK,KAAK,KAAK,MAAM,aAAe,EAAI,CAAC,EAC3DC,EAAe,KAAK,IAAI,QAA2BD,CAAe,EACxE,KAAK,KAAO,IAAI,GAAAE,QAAc,QAAwBF,EAAiBC,CAAY,EACnF,KAAK,QAAU,IAAI,GAAAE,QAAW,OAAsB,CACtD,CAEO,OAAc,CACnB,KAAK,cACL,KAAK,IAAI,MAAM,EACf,KAAK,KAAK,QAAQ,EAClB,KAAK,QAAQ,QAAQ,CACvB,CAEO,OAAc,CACnB,KAAK,SAAW,GAChB,KAAK,IAAI,MAAM,CACjB,CAEO,IAAIC,EAAmBC,EAAeC,EAAmB,CAC9D,GAAI,MAAK,SAET,GAAI,KAAK,IAAI,QAAU,EAChB,KAAK,KAAK,IAAIF,EAAK,SAASC,EAAOC,CAAG,CAAC,IAAiB,IAC3D,KAAK,KAAK,QAAQ,EAClB,KAAK,SAAW,QAEb,CACL,IAAMC,EAAU,KAAK,IAAI,MAAMH,EAAMC,EAAOC,CAAG,EAC/C,GAAIC,IAAY,GAAI,CAClB,KAAK,SAAW,GAChB,MACF,CACA,GAAIA,EAAU,EAAG,CAEf,GADgB,KAAK,IAAI,OAAO,OAChB,EAAmB,CAOjC,GANI,KAAK,eACP,KAAK,aAAe,GACpB,KAAK,YAAc,GACnB,KAAK,KAAK,QAAQ,GAEpB,KAAK,QAAU,OAAO,OAAO,CAAC,EAAGd,GAAgB,KAAK,IAAI,MAAM,EAC5D,CAAC,KAAK,QAAQ,OAAQ,CACxB,KAAK,SAAW,GAChB,MACF,CACA,KAAK,KAAK,KAAK,CACjB,SAAW,KAAK,YAAa,CAC3B,KAAK,SAAW,GAChB,MACF,CACK,KAAK,KAAK,IAAIW,EAAK,SAASG,EAASD,CAAG,CAAC,IAAiB,IAC7D,KAAK,KAAK,QAAQ,EAClB,KAAK,SAAW,GACZ,KAAK,eAAc,KAAK,YAAc,IAE9C,CACF,CACF,CAEO,IAAIE,EAA8C,CAGvD,GAFI,KAAK,UAEL,KAAK,IAAI,QAAU,GACjB,KAAK,IAAI,IAAI,EAAG,MAAO,GAE7B,IAAMC,EAAU,KAAK,IAAI,OAAO,KAEhC,GAAIA,IAAY,EAAuB,MAAO,GAE9C,GAAIA,IAAY,EAA6B,CAE3C,IAAIC,EAAIC,EAAkB,MACtBC,EAAID,EAAkB,OACtB,KAAK,UAAU,aACjBD,EAAI,KAAK,UAAU,WAAW,IAAI,OAAO,MAAQ,KAAK,cAAc,KACpEE,EAAI,KAAK,UAAU,WAAW,IAAI,OAAO,OAAS,KAAK,cAAc,MAEvE,IAAMC,EAAQ,KAAK,cAAc,MAAM,qBAAqB,KAAO,EAC7DC,EAAS,4BAA4BF,EAAE,QAAQ,CAAC,CAAC,IAAIF,EAAE,QAAQ,CAAC,CAAC,IAAIG,EAAM,QAAQ,CAAC,CAAC,SAC3F,YAAK,cAAc,MAAMC,EAAQ,EAAK,EAC/B,EACT,CAEA,GAAIL,IAAY,EACd,YAAK,QAAU,OAAO,OAAO,CAAC,EAAGhB,GAAgB,KAAK,IAAI,MAAM,EAChE,KAAK,aAAe,GACpB,KAAK,YAAc,GACnB,KAAK,KAAK,QAAQ,EAClB,KAAK,KAAK,KAAK,EACR,GAGT,GAAIgB,IAAY,IACV,CAAC,KAAK,eACV,KAAK,aAAe,GAChB,KAAK,aAAe,KAAK,QAAQ,OAAS,IAA4B,MAAO,GAKnF,IAAIC,EAAI,EACJE,EAAI,EAGJG,EACAC,EAAUC,EAoBd,IAnBIF,EAAOP,MACLO,EAAO,CAAC,KAAK,KAAK,IAAI,IACxBC,EAAUE,GAAU,KAAK,KAAK,KAAK,GAC/BH,EAAOC,EAAQ,OAAS,gBAC1BN,EAAIM,EAAQ,MACZJ,EAAII,EAAQ,QACRD,EAAOL,GAAKE,GAAKF,EAAIE,EAAI,KAAK,MAAM,aACtC,CAACF,EAAGE,CAAC,EAAI,KAAK,QAAQF,EAAGE,CAAC,EAAE,IAAI,KAAK,KAAK,EAC1CG,EAAOL,GAAKE,GAAKF,EAAIE,EAAI,KAAK,MAAM,YAEpC,QAAQ,KAAK,8BAA8BI,EAAQ,KAAK,IAAIA,EAAQ,MAAM,EAAE,GAG9E,QAAQ,KAAK,6BAA6B,GAG5C,QAAQ,KAAK,mCAAmC,GAGhD,CAACD,EACH,YAAK,KAAK,QAAQ,EACX,GAGT,IAAII,EACJ,GAAIH,EAAQ,OAAS,YAAa,CAChC,IAAMZ,EAAO,KAAK,QAAQ,OAAO,KAAK,KAAK,KAAK,EAOhD,GANAe,EAAO,IAAI,UACT,IAAI,kBAAkBf,EAAK,OAAQA,EAAK,WAAYA,EAAK,UAAU,EACnE,KAAK,QAAQ,MACb,KAAK,QAAQ,MACf,EACA,KAAK,QAAQ,QAAQ,EACjBM,IAAM,KAAK,QAAQ,OAASE,IAAM,KAAK,QAAQ,OAAQ,CAEzD,KAAK,KAAK,QAAQ,EAClB,IAAMQ,EAASC,EAAc,aAAa,OAAW,KAAK,QAAQ,MAAO,KAAK,QAAQ,MAAM,EAC5F,OAAAD,EAAO,WAAW,IAAI,GAAG,aAAaD,EAAM,EAAG,CAAC,EAChD,KAAK,SAAS,SAASC,CAAM,EACtB,EACT,CACF,MACED,EAAO,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAG,CAAE,KAAMH,EAAQ,IAAK,CAAC,EAE3D,KAAK,KAAK,QAAQ,EAClB,IAAMM,EAAa,KAAK,YACxB,OAAO,kBAAkBH,EAAM,CAAE,YAAaT,EAAG,aAAcE,CAAE,CAAC,EAC/D,KAAKW,GACAD,IAAe,KAAK,aACtBC,EAAG,MAAM,EACF,KAET,KAAK,SAAS,SAASA,CAAE,EAClB,GACR,EACA,MAAMC,IACL,QAAQ,KAAK,uBAAuBR,EAAQ,IAAI,IAAIA,EAAQ,KAAK,IAAIA,EAAQ,MAAM,GAAIQ,CAAC,EACjF,GACR,CACL,CAEQ,QAAQd,EAAWE,EAA6B,CACtD,IAAMa,EAAK,KAAK,UAAU,YAAY,IAAI,KAAK,OAASd,EAAkB,MACpEe,EAAK,KAAK,UAAU,YAAY,IAAI,KAAK,QAAUf,EAAkB,OACrEgB,EAAQ,KAAK,UAAU,YAAY,IAAI,OAAO,OAASF,EAAK,KAAK,cAAc,KAC/EG,EAAS,KAAK,UAAU,YAAY,IAAI,OAAO,QAAUF,EAAK,KAAK,cAAc,KAEjFG,EAAK,KAAK,KAAK,KAAK,QAAQ,MAAQF,EAAOF,CAAE,EAC7CK,EAAK,KAAK,KAAK,KAAK,QAAQ,OAASF,EAAQF,CAAE,EACrD,GAAI,CAACG,GAAM,CAACC,EAAI,CACd,IAAMC,EAAKJ,EAAQjB,EACbsB,GAAMJ,EAASF,GAAMd,EACrBqB,EAAI,KAAK,IAAIF,EAAIC,CAAE,EACzB,OAAOC,EAAI,EAAI,CAACvB,EAAIuB,EAAGrB,EAAIqB,CAAC,EAAI,CAACvB,EAAGE,CAAC,CACvC,CACA,OAAQiB,EAEJ,KAAK,QAAQ,qBAAuB,CAACA,GAAM,CAACC,EAC1C,CAACD,EAAIjB,EAAIiB,EAAKnB,CAAC,EAAI,CAACmB,EAAIC,CAAE,EAF5B,CAACpB,EAAIoB,EAAKlB,EAAGkB,CAAE,CAGrB,CAEQ,KAAKI,EAAWC,EAAeC,EAAsB,CAC3D,OAAIF,IAAM,OAAe,EACrBA,EAAE,SAAS,GAAG,EAAU,SAASA,EAAE,MAAM,EAAG,EAAE,EAAG,EAAE,EAAIC,EAAQ,IAC/DD,EAAE,SAAS,IAAI,EAAU,SAASA,EAAE,MAAM,EAAG,EAAE,EAAG,EAAE,EACjD,SAASA,EAAG,EAAE,EAAIE,CAC3B,CACF,EGzOA,IAAAC,GAAiD,QCmI1C,SAASC,GAAkBC,EAA6B,CAC7D,IAAMC,EAAqB,CAAC,EACtBC,EAAQF,EAAK,MAAM,GAAG,EAE5B,QAAWG,KAAQD,EAAO,CACxB,IAAME,EAAQD,EAAK,QAAQ,GAAG,EAC9B,GAAIC,IAAU,GAAI,SAElB,IAAMC,EAAMF,EAAK,UAAU,EAAGC,CAAK,EAC7BE,EAAQH,EAAK,UAAUC,EAAQ,CAAC,EAGtC,GAAIC,IAAQ,IAAiB,CAC3BJ,EAAI,OAASK,EACb,QACF,CACA,GAAID,IAAQ,IAAsB,CAChCJ,EAAI,YAAcK,EAClB,QACF,CACA,GAAID,IAAQ,IAAuB,CACjCJ,EAAI,aAAeK,EACnB,QACF,CACA,GAAID,IAAQ,IAA0B,CACpCJ,EAAI,eAAiBK,EACrB,QACF,CACA,IAAMC,EAAW,SAASD,EAAO,EAAE,EACnC,OAAQD,EAAK,CACX,IAAK,IAAiBJ,EAAI,OAASM,EAAU,MAC7C,IAAK,IAAaN,EAAI,GAAKM,EAAU,MACrC,IAAK,IAAuBN,EAAI,YAAcM,EAAU,MACxD,IAAK,IAAgBN,EAAI,MAAQM,EAAU,MAC3C,IAAK,IAAiBN,EAAI,OAASM,EAAU,MAC7C,IAAK,IAAmBN,EAAI,EAAIM,EAAU,MAC1C,IAAK,IAAmBN,EAAI,EAAIM,EAAU,MAC1C,IAAK,IAAuBN,EAAI,YAAcM,EAAU,MACxD,IAAK,IAAwBN,EAAI,aAAeM,EAAU,MAC1D,IAAK,IAA6BN,EAAI,QAAUM,EAAU,MAC1D,IAAK,IAA6BN,EAAI,QAAUM,EAAU,MAC1D,IAAK,IAAkBN,EAAI,QAAUM,EAAU,MAC/C,IAAK,IAAeN,EAAI,KAAOM,EAAU,MACzC,IAAK,IAAeN,EAAI,KAAOM,EAAU,MACzC,IAAK,IAAgBN,EAAI,MAAQM,EAAU,MAC3C,IAAK,IAA0BN,EAAI,eAAiBM,EAAU,MAC9D,IAAK,IAAkBN,EAAI,OAASM,EAAU,MAC9C,IAAK,IAAuBN,EAAI,YAAcM,EAAU,KAC1D,CACF,CAEA,OAAON,CACT,CD/JA,IAAMO,GAAa,EAGNC,GAAN,KAA8E,CAiCnF,YACmBC,EACAC,EACAC,EACAC,EACjB,CAJiB,WAAAH,EACA,eAAAC,EACA,mBAAAC,EACA,mBAAAC,EApCnB,KAAQ,SAAW,GACnB,KAAQ,YAAc,EACtB,KAAQ,aAAe,GAEvB,KAAQ,eAAuC,KAO/C,KAAQ,eAAiB,GAGzB,KAAQ,aAAe,IAAI,YAAY,GAA+B,EACtE,KAAQ,eAAiB,EAGzB,KAAQ,kBAAoB,EAC5B,KAAQ,kBAAoB,EAG5B,KAAQ,eAAuC,KAI/C,KAAQ,sBAA2D,IAAI,IAarE,KAAK,iBAAmB,KAAK,KAAK,KAAK,MAAM,eAAiB,EAAI,CAAC,EAEnE,KAAK,qBAAuB,KAAK,IAAI,QAAgC,KAAK,gBAAgB,CAC5F,CAEO,OAAc,CACnB,KAAK,cACL,KAAK,mBAAmB,EACpB,KAAK,iBACP,KAAK,eAAe,QAAQ,EAC5B,KAAK,eAAiB,MAExB,KAAK,cAAc,MAAM,CAC3B,CAEO,SAAgB,CACrB,KAAK,MAAM,CACb,CAEQ,oBAAoBC,EAAmB,CAC7C,KAAK,sBAAsB,OAAOA,CAAG,EACjC,KAAK,kBAAoBA,IAC3B,KAAK,gBAAkB,OAE3B,CAEQ,oBAA2B,CACjC,QAAWC,KAAW,KAAK,sBAAsB,OAAO,EACtDA,EAAQ,QAAQ,QAAQ,EAE1B,KAAK,sBAAsB,MAAM,EACjC,KAAK,gBAAkB,MACzB,CAEO,OAAc,CACnB,KAAK,SAAW,GAChB,KAAK,aAAe,GACpB,KAAK,eAAiB,GACtB,KAAK,eAAiB,EACtB,KAAK,eAAiB,KAEtB,KAAK,kBAAoB,KAAK,iBAC9B,KAAK,kBAAoB,EACzB,KAAK,eAAiB,IACxB,CAEO,IAAIC,EAAmBC,EAAeC,EAAmB,CAC9D,GAAI,MAAK,SAET,GAAI,CAAC,KAAK,eACR,KAAK,eAAeF,EAAMC,EAAOC,CAAG,MAC/B,CAEL,IAAIC,EAAaD,EACjB,QAASE,EAAIH,EAAOG,EAAIF,EAAKE,IAC3B,GAAIJ,EAAKI,CAAC,IAAM,GAAqB,CACnC,KAAK,eAAiB,GACtBD,EAAaC,EACb,KACF,CAIF,IAAMC,EAAaF,EAAaF,EAChC,GAAI,KAAK,eAAiBI,EAAa,IAAiC,CACtE,KAAK,SAAW,GAChB,MACF,CAIA,GAHA,KAAK,aAAa,IAAIL,EAAK,SAASC,EAAOE,CAAU,EAAG,KAAK,cAAc,EAC3E,KAAK,gBAAkBE,EAEnB,CAAC,KAAK,eAAgB,CAKxB,GAHA,KAAK,eAAiBC,GAAkB,KAAK,wBAAwB,CAAC,EAGlE,KAAK,eAAe,KAAO,QAAa,KAAK,eAAe,cAAgB,OAAW,CACzF,KAAK,cAAc,KAAK,eAAe,GAAI,0CAA2C,KAAK,eAAe,OAAS,CAAC,EACpH,KAAK,SAAW,GAChB,MACF,CAGA,GAAI,KAAK,eAAe,SAAW,IACjC,OAIF,IAAMC,EAAeJ,EAAa,EAC9BI,EAAeL,GACjB,KAAK,eAAeF,EAAMO,EAAcL,CAAG,CAE/C,CACF,CACF,CAGQ,eAAeF,EAAmBC,EAAeC,EAAmB,CAC1E,GAAI,KAAK,SAAU,OAKnB,IAAMM,EAAa,KAAK,gBAAgB,IAAM,KAAK,iBAAmB,EAChET,EAAU,KAAK,sBAAsB,IAAIS,CAAU,EACnDC,EAAsBV,GAAS,kBAAoB,EAGzD,GAFA,KAAK,mBAAqBG,EAAMD,EACFQ,EAAsB,KAAK,kBAC7B,KAAK,kBAAmB,CAClD,IAAMC,EAAmB,KAAK,gBAAkBX,GAAS,QACrDW,GACFA,EAAiB,QAAQ,EAE3B,KAAK,eAAiB,KAClBX,GACF,KAAK,oBAAoBS,CAAU,EAErC,KAAK,SAAW,GAChB,MACF,CAEA,GAAI,MAAK,aAKT,IAHIT,GAAS,SAAW,CAAC,KAAK,iBAC5B,KAAK,eAAiBA,EAAQ,SAE5B,CAAC,KAAK,eAAgB,CAExB,IAAMY,EAAkB,KAAK,iBAAmB,OAChD,GAAIA,EAAkB,KAAK,MAAM,aAAe,IAAS,CACvD,KAAK,SAAW,GACZ,KAAK,gBAAgB,KAAO,QAC9B,KAAK,cAAc,KAAK,eAAe,GAAI,uCAAwC,KAAK,eAAe,OAAS,CAAC,EAEnH,MACF,CACA,IAAMC,EAAa,KAAK,IAAI,EAAG,KAAK,MAAM,KAAK,MAAM,aAAe,IAAUD,CAAe,CAAC,EAC9F,KAAO,KAAK,sBAAsB,MAAQC,GAAY,CACpD,IAAMC,EAAS,KAAK,sBAAsB,QAAQ,EAAE,KAAK,EAAE,MAC3D,GAAI,CAACA,EAAQ,MACbA,EAAO,CAAC,EAAE,QAAQ,QAAQ,EAC1B,KAAK,oBAAoBA,EAAO,CAAC,CAAC,EAC9BA,EAAO,CAAC,EAAE,IAAI,KAAO,QACvB,KAAK,cAAcA,EAAO,CAAC,EAAE,IAAI,GAAI,uCAAwCA,EAAO,CAAC,EAAE,IAAI,OAAS,CAAC,CAEzG,CACA,KAAK,eAAiB,IAAI,GAAAC,QAAc,QAA6B,KAAK,iBAAkB,KAAK,oBAAoB,EACrH,KAAK,eAAe,KAAK,CAC3B,CAEI,KAAK,eAAe,IAAId,EAAK,SAASC,EAAOC,CAAG,CAAC,IAAMV,KACzD,KAAK,eAAe,QAAQ,EAC5B,KAAK,eAAiB,KACtB,KAAK,aAAe,GAChBO,GACF,KAAK,oBAAoBS,CAAU,GAGzC,CAEO,IAAIO,EAA8C,CACvD,GAAI,KAAK,UAAY,CAACA,EACpB,OAAI,KAAK,iBACP,KAAK,eAAe,QAAQ,EAC5B,KAAK,eAAiB,MAEjB,GAIT,GAAI,KAAK,eACP,OAAO,KAAK,wBAAwB,EAItC,IAAMC,EAAM,KAAK,eAGjB,GAAIA,EAAI,SAAW,IACjB,OAAO,KAAK,cAAcA,CAAG,EAI/B,IAAMR,EAAaQ,EAAI,IAAM,KAAK,iBAAmB,EAC/CC,EAAeD,EAAI,OAAS,EAC5BjB,EAAU,KAAK,sBAAsB,IAAIS,CAAU,EAEzD,GAAIS,EACF,OAAI,KAAK,iBACHlB,GACFA,EAAQ,kBAAoB,KAAK,kBACjCA,EAAQ,YAAcA,EAAQ,aAAe,KAAK,cAElD,KAAK,sBAAsB,IAAIS,EAAY,CACzC,IAAK,CAAE,GAAGQ,CAAI,EACd,QAAS,KAAK,eACd,iBAAkB,KAAK,kBACvB,YAAa,KAAK,YACpB,CAAC,EAEH,KAAK,gBAAkBR,EACvB,KAAK,eAAiB,MAEjB,GAILT,IACF,KAAK,gBAAkB,QAGzB,IAAImB,EAAc,KAAK,aACnBC,EAAWH,EACXI,EAAU,KAAK,eAEfrB,IACFoB,EAAWpB,EAAQ,IACnBqB,EAAUrB,EAAQ,QAClBmB,EAAcA,GAAenB,EAAQ,YACrC,KAAK,sBAAsB,OAAOS,CAAU,GAG9C,IAAIa,EAAa,IAAI,WAAW,CAAC,EAC7BD,IACEA,EAAQ,IAAI,IAAM5B,KACpB0B,EAAc,IAEhBG,EAAaD,EAAQ,OAEvB,KAAK,eAAiB,KAKtB,IAAME,EAAS,KAAK,8BAA8BH,EAAUE,EAAYH,CAAW,EACnF,OAAIE,GACFA,EAAQ,QAAQ,EAEXE,CACT,CAIQ,yBAAkC,CACxC,IAAIC,EAAM,GACV,QAASnB,EAAI,EAAGA,EAAI,KAAK,eAAgBA,IACvCmB,GAAO,OAAO,cAAc,KAAK,aAAanB,CAAC,CAAC,EAElD,OAAOmB,CACT,CAEQ,yBAAsD,CAC5D,IAAMP,EAAMV,GAAkB,KAAK,wBAAwB,CAAC,EAG5D,GAAIU,EAAI,KAAO,QAAaA,EAAI,cAAgB,OAC9C,YAAK,cAAcA,EAAI,GAAI,0CAA2CA,EAAI,OAAS,CAAC,EAC7E,GAKT,OAFeA,EAAI,QAAU,IAEb,CACd,QACE,OAAO,KAAK,cAAcA,CAAG,EAC/B,QACE,YAAK,cAAcA,EAAI,IAAM,EAAG,KAAMA,EAAI,OAAS,CAAC,EAC7C,GACT,QACE,OAAO,KAAK,iBAAiBA,CAAG,EAClC,QAKE,OAAIA,EAAI,KAAO,QACb,KAAK,cAAcA,EAAI,GAAI,4BAA6BA,EAAI,OAAS,CAAC,EAEjE,EACX,CACF,CAEQ,8BAA8BA,EAAoBQ,EAAmBN,EAAkD,CAG7H,OAFeF,EAAI,QAAU,IAEb,CACd,QAA2B,CACzB,IAAMM,EAAS,KAAK,gBAAgBN,EAAKQ,EAAON,CAAW,EAG3D,OAAKF,EAAI,cAAgB,OAAS,KAAOA,EAAI,KAAO,SAC9CE,EACF,KAAK,cAAcF,EAAI,GAAI,6BAA8BA,EAAI,OAAS,CAAC,EAC9DQ,EAAM,OAAS,GACxB,KAAK,cAAcR,EAAI,GAAI,KAAMA,EAAI,OAAS,CAAC,GAG5CM,CACT,CACA,QACE,OAAO,KAAK,uBAAuBN,EAAKQ,EAAON,CAAW,EAC5D,QACE,OAAO,KAAK,aAAaF,EAAKQ,EAAON,CAAW,EAClD,QAEE,OAAO,KAAK,iBAAiBF,CAAG,EAClC,QAKE,OAAIA,EAAI,KAAO,QACb,KAAK,cAAcA,EAAI,GAAI,4BAA6BA,EAAI,OAAS,CAAC,EAEjE,EACX,CACF,CAEQ,iBAAiBA,EAAgD,CACvE,GAAIA,EAAI,KAAO,OACb,MAAO,GAET,IAAMS,EAAKT,EAAI,GACTU,EAAQ,KAAK,cAAc,SAASD,CAAE,EAC5C,OAAKC,EAIU,KAAK,cAAcA,EAAOV,CAAG,EAC9B,KAAKD,IACjB,KAAK,cAAcU,EAAIV,EAAU,KAAO,gCAAiCC,EAAI,OAAS,EAAGA,EAAI,WAAW,EACjG,GACR,GAPC,KAAK,cAAcS,EAAI,yBAA0BT,EAAI,OAAS,EAAGA,EAAI,WAAW,EACzE,GAOX,CAEQ,gBAAgBA,EAAoBQ,EAAmBN,EAA+B,CAY5F,OADqBF,EAAI,cAAgB,OACpB,KACfA,EAAI,KAAO,QACb,KAAK,cAAcA,EAAI,GAAI,yCAA0CA,EAAI,OAAS,CAAC,EAE9E,KAGLE,GAAeM,EAAM,SAAW,GAEpC,KAAK,cAAc,WAAWR,EAAI,GAAI,CACpC,KAAM,IAAI,KAAK,CAACQ,CAAiB,CAAC,EAClC,MAAOR,EAAI,OAAS,EACpB,OAAQA,EAAI,QAAU,EACtB,OAASA,EAAI,QAAU,GACvB,YAAaA,EAAI,aAAe,EAClC,CAAC,EACM,GACT,CAEQ,uBAAuBA,EAAoBQ,EAAmBN,EAAkD,CACtH,GAAIA,EACF,OAAIF,EAAI,KAAO,QACb,KAAK,cAAcA,EAAI,GAAI,6BAA8BA,EAAI,OAAS,CAAC,EAElE,GAGT,KAAK,gBAAgBA,EAAKQ,EAAON,CAAW,EAE5C,IAAMO,EAAKT,EAAI,IAAM,KAAK,cAAc,YAClCU,EAAQ,KAAK,cAAc,SAASD,CAAE,EAC5C,GAAIC,EAAO,CACT,IAAMJ,EAAS,KAAK,cAAcI,EAAOV,CAAG,EAC5C,OAAIA,EAAI,KAAO,OACNM,EAAO,KAAKP,IACjB,KAAK,cAAcU,EAAIV,EAAU,KAAO,gCAAiCC,EAAI,OAAS,CAAC,EAChF,GACR,EAEIM,EAAO,KAAK,IAAM,EAAI,CAC/B,CACA,MAAO,EACT,CAEQ,aAAaN,EAAoBQ,EAAmBN,EAA+B,CACzF,IAAMO,EAAKT,EAAI,IAAM,EACfW,EAAQX,EAAI,OAAS,EAM3B,IADqBA,EAAI,cAAgB,OACpB,IACnB,YAAK,cAAcS,EAAI,yCAA0CE,CAAK,EAC/D,GAIT,GAAIT,EACF,YAAK,cAAcO,EAAI,6BAA8BE,CAAK,EACnD,GAIT,GAAIH,EAAM,SAAW,EACnB,YAAK,cAAcC,EAAI,KAAME,CAAK,EAC3B,GAGT,IAAMC,EAASZ,EAAI,QAAU,GAE7B,GAAIY,IAAW,IACb,KAAK,cAAcH,EAAI,KAAME,CAAK,MAC7B,CACL,IAAME,EAAQb,EAAI,OAAS,EACrBc,EAASd,EAAI,QAAU,EAE7B,GAAI,CAACa,GAAS,CAACC,EACb,YAAK,cAAcL,EAAI,sDAAuDE,CAAK,EAC5E,GAGT,IAAMI,EAAgBH,IAAW,OAC3BI,EAAgBH,EAAQC,EAASC,EAEvC,GAAIP,EAAM,OAASQ,EACjB,YAAK,cAAcP,EAAI,iCAAkCE,CAAK,EACvD,GAGT,KAAK,cAAcF,EAAI,KAAME,CAAK,CACpC,CACA,MAAO,EACT,CAEQ,cAAcX,EAA6B,CAOjD,OALiBA,EAAI,gBAAkB,IAKrB,CAChB,IAAK,IACL,IAAK,IACH,KAAK,mBAAmB,EACxB,KAAK,cAAc,UAAU,EAC7B,MACF,IAAK,IACL,IAAK,IAKH,GAAIA,EAAI,KAAO,OAAW,CACxB,IAAMjB,EAAU,KAAK,sBAAsB,IAAIiB,EAAI,EAAE,EACjDjB,GACFA,EAAQ,QAAQ,QAAQ,EAE1B,KAAK,oBAAoBiB,EAAI,EAAE,EAC/B,KAAK,cAAc,WAAWA,EAAI,EAAE,CACtC,CACA,MACF,QAEE,KACJ,CACA,MAAO,EACT,CAEQ,cAAcS,EAAYQ,EAAiBN,EAAeO,EAA4B,CAC5F,IAAMC,EAAOF,IAAY,KAEzB,GADIE,GAAQR,GAAS,GACjB,CAACQ,GAAQR,GAAS,EAAG,OAEzB,IAAMS,EAAQF,EAAc,MAAMA,CAAW,GAAK,GAC5CG,EAAW,WAAWZ,CAAE,GAAGW,CAAK,IAAIH,CAAO,SACjD,KAAK,cAAc,MAAM,YAAY,iBAAiBI,CAAQ,CAChE,CAIQ,cAAcX,EAAwBV,EAAsC,CAClF,OAAO,KAAK,kBAAkBU,EAAOV,CAAG,EACrC,KAAK,IAAM,EAAI,EACf,MAAM,IAAM,EAAK,CACtB,CAEA,MAAc,kBAAkBU,EAAwBV,EAAmC,CACzF,IAAMsB,EAAa,KAAK,YACpBC,EAAkC,MAAM,KAAK,cAAcb,CAAK,EAEpE,GAAI,CACF,GAAIY,IAAe,KAAK,YAAa,MAAM,IAAI,MAAM,uBAAuB,EAC5E,IAAME,EAAQ,KAAK,IAAI,EAAGxB,EAAI,GAAK,CAAC,EAC9ByB,EAAQ,KAAK,IAAI,EAAGzB,EAAI,GAAK,CAAC,EAC9B0B,EAAQ1B,EAAI,aAAgBuB,EAAO,MAAQC,EAC3CG,EAAQ3B,EAAI,cAAiBuB,EAAO,OAASE,EAE7CG,EAAW,KAAK,IAAI,EAAGL,EAAO,MAAQC,CAAK,EAC3CK,EAAW,KAAK,IAAI,EAAGN,EAAO,OAASE,CAAK,EAC5CK,EAAa,KAAK,IAAI,EAAG,KAAK,IAAIJ,EAAOE,CAAQ,CAAC,EAClDG,EAAa,KAAK,IAAI,EAAG,KAAK,IAAIJ,EAAOE,CAAQ,CAAC,EAExD,GAAIC,IAAe,GAAKC,IAAe,EACrC,MAAM,IAAI,MAAM,0BAA0B,EAG5C,GAAIP,IAAU,GAAKC,IAAU,GAAKK,IAAeP,EAAO,OAASQ,IAAeR,EAAO,OAAQ,CAC7F,IAAMS,EAAU,MAAM,kBAAkBT,EAAQC,EAAOC,EAAOK,EAAYC,CAAU,EACpFR,EAAO,MAAM,EACbA,EAASS,CACX,CAEA,IAAMC,EAAK,KAAK,UAAU,YAAY,IAAI,KAAK,OAASC,EAAkB,MACpEC,EAAK,KAAK,UAAU,YAAY,IAAI,KAAK,QAAUD,EAAkB,OAIvEE,EACAC,EACArC,EAAI,UAAY,QAAaA,EAAI,OAAS,QAC5CoC,EAAUpC,EAAI,QACdqC,EAAUrC,EAAI,MACLA,EAAI,UAAY,QACzBoC,EAAUpC,EAAI,QACdqC,EAAU,KAAK,IAAI,EAAG,KAAK,KAAMd,EAAO,OAASA,EAAO,OAAUa,EAAUH,GAAME,CAAE,CAAC,GAC5EnC,EAAI,OAAS,QACtBqC,EAAUrC,EAAI,KACdoC,EAAU,KAAK,IAAI,EAAG,KAAK,KAAMb,EAAO,MAAQA,EAAO,QAAWc,EAAUF,GAAMF,CAAE,CAAC,IAErFG,EAAU,KAAK,KAAKb,EAAO,MAAQU,CAAE,EACrCI,EAAU,KAAK,KAAKd,EAAO,OAASY,CAAE,GAGxC,IAAIG,EAAIf,EAAO,MACXgB,EAAIhB,EAAO,OAQf,IALIvB,EAAI,UAAY,QAAaA,EAAI,OAAS,UAC5CsC,EAAI,KAAK,MAAMF,EAAUH,CAAE,EAC3BM,EAAI,KAAK,MAAMF,EAAUF,CAAE,GAGzBG,EAAIC,EAAI,KAAK,MAAM,WACrB,MAAM,IAAI,MAAM,2BAA2B,EAI7C,IAAMC,EAAS,KAAK,cAAc,MAAM,OAClCC,EAASD,EAAO,EAChBE,EAASF,EAAO,EAChBG,EAAaH,EAAO,MAOpBI,GADc5C,EAAI,SAAW,QAAaA,EAAI,OAAS,EACrB,SAAW,MAEnD,GAAIsC,IAAMf,EAAO,OAASgB,IAAMhB,EAAO,OAAQ,CAC7C,IAAMsB,EAAS,MAAM,kBAAkBtB,EAAQ,CAAE,YAAae,EAAG,aAAcC,CAAE,CAAC,EAClFhB,EAAO,MAAM,EACbA,EAASsB,CACX,CAGA,IAAMC,GAAU,KAAK,IAAI,KAAK,IAAI,EAAG9C,EAAI,SAAW,CAAC,EAAGiC,EAAK,CAAC,EACxDc,GAAU,KAAK,IAAI,KAAK,IAAI,EAAG/C,EAAI,SAAW,CAAC,EAAGmC,EAAK,CAAC,EAC9D,GAAIW,KAAY,GAAKC,KAAY,EAAG,CAKlC,IAAMC,EAAWhD,EAAI,UAAY,OAAa,KAAK,MAAMoC,EAAUH,CAAE,EAAIV,EAAO,MAAQuB,GAClFG,GAAWjD,EAAI,OAAS,OAAa,KAAK,MAAMqC,EAAUF,CAAE,EAAIZ,EAAO,OAASwB,GAChFG,EAAeC,EAAc,aAAa,OAAO,SAAUH,EAASC,EAAO,EAC3EG,GAAYF,EAAa,WAAW,IAAI,EAC9C,GAAI,CAACE,GACH,MAAM,IAAI,MAAM,wCAAwC,EAE1DA,GAAU,UAAU7B,EAAQuB,GAASC,EAAO,EAE5C,IAAMM,GAAe,MAAM,kBAAkBH,CAAY,EAMzD,GALAA,EAAa,MAAQA,EAAa,OAAS,EAC3C3B,EAAO,MAAM,EACbA,EAAS8B,GACTf,EAAIf,EAAO,MACXgB,EAAIhB,EAAO,OACPe,EAAIC,EAAI,KAAK,MAAM,WACrB,MAAM,IAAI,MAAM,2BAA2B,EAEzCvC,EAAI,UAAY,SAClBoC,EAAU,KAAK,KAAKb,EAAO,MAAQU,CAAE,GAEnCjC,EAAI,OAAS,SACfqC,EAAU,KAAK,KAAKd,EAAO,OAASY,CAAE,EAE1C,CAEA,GAAIb,IAAe,KAAK,YAAa,MAAM,IAAI,MAAM,uBAAuB,EAC5E,IAAMgC,GAAStD,EAAI,QAAU,EAO7B,GANA,KAAK,cAAc,SAASU,EAAM,GAAIa,EAAQ,GAAMqB,GAAOU,EAAM,EACjE/B,EAAS,OAKLvB,EAAI,iBAAmB,EAAG,CAE5B,IAAMuD,EAAWf,EAAO,MAAQG,EAChCH,EAAO,EAAIC,EAEXD,EAAO,EAAI,KAAK,IAAIE,EAASa,EAAU,CAAC,CAC1C,MAGEf,EAAO,EAAI,KAAK,IAAIC,EAASL,EAAS,KAAK,cAAc,IAAI,CAEjE,OAASoB,EAAG,CACV,MAAAjC,GAAQ,MAAM,EACRiC,CACR,CACF,CAGA,MAAc,cAAc9C,EAA8C,CACxE,IAAIF,EAAoB,IAAI,WAAW,MAAME,EAAM,KAAK,YAAY,CAAC,EAMrE,GAJIA,EAAM,cAAgB,MACxBF,EAAQ,MAAM,KAAK,gBAAgBA,CAAK,GAGtCE,EAAM,SAAW,IAAiB,CACpC,IAAM+C,EAAUC,GAAUlD,CAAK,EAG/B,GAAIiD,EAAQ,OAAS,aAAe,EAAEA,EAAQ,MAAQ,IAAM,EAAEA,EAAQ,OAAS,IAAMA,EAAQ,MAAQA,EAAQ,OAAS,KAAK,MAAM,WAC/H,MAAM,IAAI,WAAW,mDAAmD,EAE1E,IAAME,EAAO,IAAI,KAAK,CAACnD,CAAiB,EAAG,CAAE,KAAM,WAAY,CAAC,EAChE,GAAI,CAAC,OAAO,kBAAmB,CAC7B,IAAMoD,EAAM,IAAI,gBAAgBD,CAAI,EAC9BE,EAAM,IAAI,MAChB,OAAO,IAAI,QAAqB,CAACC,EAASC,IAAW,CACnDF,EAAI,iBAAiB,OAAQ,IAAM,CACjC,IAAI,gBAAgBD,CAAG,EACvB,IAAMI,EAASb,EAAc,aAAa,OAAO,SAAUU,EAAI,MAAOA,EAAI,MAAM,EAChFG,EAAO,WAAW,IAAI,GAAG,UAAUH,EAAK,EAAG,CAAC,EAC5C,kBAAkBG,CAAM,EAAE,KAAKF,CAAO,EAAE,MAAMC,CAAM,CACtD,CAAC,EACDF,EAAI,iBAAiB,QAAS,IAAM,CAClC,IAAI,gBAAgBD,CAAG,EACvBG,EAAO,IAAI,MAAM,sBAAsB,CAAC,CAC1C,CAAC,EACDF,EAAI,IAAMD,CACZ,CAAC,CACH,CACA,OAAO,kBAAkBD,CAAI,CAC/B,CAGA,IAAM9C,EAAQH,EAAM,MACdI,EAASJ,EAAM,OAErB,GAAI,CAACG,GAAS,CAACC,EACb,MAAM,IAAI,MAAM,8CAA8C,EAGhE,IAAMC,EAAgBL,EAAM,SAAW,OACjCM,EAAgBH,EAAQC,EAASC,EAEvC,GAAIP,EAAM,OAASQ,EACjB,MAAM,IAAI,MAAM,yBAAyB,EAG3C,IAAMiD,EAAapD,EAAQC,EAE3B,GAAIJ,EAAM,SAAW,GAEnB,OAAO,kBAAkB,IAAI,UAAU,IAAI,kBAAkBF,EAAM,OAAuBA,EAAM,WAAYyD,EAAa,CAAwC,EAAGpD,EAAOC,CAAM,CAAC,EAMpL,IAAM9B,EAAO,IAAI,kBAAkBiF,EAAa,CAAwC,EAClFC,EAAQ,IAAI,YAAY1D,EAAM,OAAQA,EAAM,WAAY,KAAK,MAAMA,EAAM,WAAa,CAAC,CAAC,EACxF2D,EAAQ,IAAI,YAAYnF,EAAK,MAAM,EACnCoF,EAAgBH,EAAa,GAE/BI,EAAY,EACZC,EAAY,EAChB,QAASlF,EAAI,EAAGA,EAAIgF,EAAehF,GAAK,EAAG,CACzC,IAAMmF,EAAKL,EAAMG,GAAW,EACtBG,EAAKN,EAAMG,GAAW,EACtBI,EAAKP,EAAMG,GAAW,EAE5BF,EAAMG,GAAW,EAAI,WAAaC,EAClCJ,EAAMG,GAAW,EAAI,WAAcC,IAAO,GAAOC,GAAM,EACvDL,EAAMG,GAAW,EAAI,WAAcE,IAAO,GAAOC,GAAM,GACvDN,EAAMG,GAAW,EAAI,WAAcG,IAAO,CAC5C,CAGA,IAAIC,EAAUN,EAAgB,EAC1BO,EAAUP,EAAgB,EAC9B,QAAShF,EAAIgF,EAAehF,EAAI6E,EAAY7E,IAC1CJ,EAAK2F,CAAO,EAAQnE,EAAMkE,CAAO,EACjC1F,EAAK2F,EAAU,CAAC,EAAInE,EAAMkE,EAAU,CAAC,EACrC1F,EAAK2F,EAAU,CAAC,EAAInE,EAAMkE,EAAU,CAAC,EACrC1F,EAAK2F,EAAU,CAAC,EAAI,IACpBD,GAAW,EACXC,GAAW,EAGb,OAAO,kBAAkB,IAAI,UAAU3F,EAAM6B,EAAOC,CAAM,CAAC,CAC7D,CAEA,MAAc,gBAAgB8D,EAA6C,CACzE,GAAI,CACF,OAAO,MAAM,KAAK,YAAYA,EAAY,SAAS,CACrD,OAASC,EAAO,CACd,GAAIA,aAAiB,WAAY,MAAMA,EACvC,OAAO,MAAM,KAAK,YAAYD,EAAY,aAAa,CACzD,CACF,CAEA,MAAc,YAAYA,EAAwBhE,EAAwD,CACxG,IAAMkE,EAAQ,KAAK,IAAI,KAAK,MAAM,eAAgB,KAAK,MAAM,WAAa,EAAG,KAAK,MAAM,aAAe,GAAO,EAC1GC,EAAW,EAaTC,EAXS,IAAI,eAA6B,CAC9C,KAAKC,EAAY,CACf,GAAIF,GAAYH,EAAW,OAAQ,CACjCK,EAAW,MAAM,EACjB,MACF,CACA,IAAM/F,EAAM,KAAK,IAAI6F,EAAW,KAAMH,EAAW,MAAM,EACvDK,EAAW,QAAQ,IAAI,WAAWL,EAAW,SAASG,EAAU7F,CAAG,CAAC,CAAC,EACrE6F,EAAW7F,CACb,CACF,CAAC,EACqB,YAAY,IAAI,oBAAoB0B,CAAM,CAAC,EAAE,UAAU,EACvEsE,EAAuB,CAAC,EAC1BC,EAAc,EAClB,GAAI,CACF,OAAa,CACX,GAAM,CAAE,KAAAC,EAAM,MAAAC,CAAM,EAAI,MAAML,EAAO,KAAK,EAC1C,GAAII,EAAM,MAEV,GADAD,GAAeE,EAAM,WACjBF,EAAcL,EAChB,YAAME,EAAO,OAAO,EAAE,MAAM,IAAM,CAAC,CAAC,EAC9B,IAAI,WAAW,uCAAuC,EAE9DE,EAAO,KAAKG,CAAK,CACnB,CACF,QAAE,CACAL,EAAO,YAAY,CACrB,CAEA,IAAM1E,EAAS,IAAI,WAAW6E,CAAW,EACrCG,EAAS,EACb,QAAWC,KAASL,EAClB5E,EAAO,IAAIiF,EAAOD,CAAM,EACxBA,GAAUC,EAAM,OAElB,OAAOjF,CACT,CAEA,IAAW,QAA+C,CACxD,OAAO,KAAK,cAAc,MAC5B,CAEA,IAAW,qBAAmD,CAC5D,OAAO,KAAK,cAAc,kBAC5B,CAEA,IAAW,sBAAkE,CAC3E,OAAO,KAAK,qBACd,CACF,EEl1BO,IAAMkF,EAAN,MAAMA,CAAyC,CA6BpD,YACmBC,EACjB,CADiB,cAAAA,EA3BnB,KAAQ,aAAe,EACvB,KAAiB,QAAwC,IAAI,IAU7D,KAAiB,oBAA2C,IAAI,IAChE,KAAiB,oBAA2C,IAAI,IAIhE,KAAiB,2BAA8BC,GAA4B,CACzE,IAAMC,EAAU,KAAK,oBAAoB,IAAID,CAAS,EAClDC,IAAY,SACd,KAAK,oBAAoB,OAAOA,CAAO,EACvC,KAAK,oBAAoB,OAAOD,CAAS,EACzC,KAAK,QAAQ,OAAOC,CAAO,EAE/B,EACA,KAAQ,cAA+B,CAAE,UAAW,GAAM,MAAO,MAAO,OAAQ,EAAG,UAAW,KAAM,EAKlG,KAAK,wBAA0B,KAAK,SAAS,eAC7C,KAAK,uBAA0BD,GAAsB,CACnD,KAAK,0BAA0BA,CAAS,EACxC,KAAK,2BAA2BA,CAAS,CAC3C,EACA,KAAK,SAAS,eAAiB,KAAK,sBACtC,CAEO,OAAc,CACnB,KAAK,aAAe,EACpB,KAAK,QAAQ,MAAM,EACnB,KAAK,oBAAoB,MAAM,EAC/B,KAAK,oBAAoB,MAAM,CACjC,CAEO,SAAgB,CACrB,KAAK,MAAM,EACP,KAAK,SAAS,iBAAmB,KAAK,yBACxC,KAAK,SAAS,eAAiB,KAAK,wBAExC,CAEO,WAAWE,EAAwBC,EAAgD,CACxF,IAAMC,EAAUF,GAAM,KAAK,eAErBG,EAAe,KAAK,oBAAoB,IAAID,CAAO,EACrDC,IAAiB,SACnB,KAAK,SAAS,YAAYA,CAAY,EACtC,KAAK,oBAAoB,OAAOD,CAAO,EACvC,KAAK,oBAAoB,OAAOC,CAAY,GAG1C,CAAC,KAAK,QAAQ,IAAID,CAAO,GAAK,KAAK,QAAQ,MAAQN,EAAkB,kBACvE,KAAK,wBAAwB,EAS/B,IAAMQ,EAAY,KAAK,SAAS,SAAS,EAAI,IAC7C,KAAK,QAAQ,OAAOF,CAAO,EAC3B,IAAIG,EAAgB,EACpB,QAAWC,KAAS,KAAK,QAAQ,OAAO,EAAGD,GAAiBC,EAAM,KAAK,KACvE,QAAWC,IAAe,CAAC,GAAO,EAAI,EACpC,OAAW,CAACC,EAAUF,CAAK,IAAK,KAAK,QAAS,CAC5C,GAAID,EAAgBJ,EAAU,KAAK,MAAQG,EAAW,MAClD,KAAK,oBAAoB,IAAII,CAAQ,IAAMD,IAC/CF,GAAiBC,EAAM,KAAK,KAC5B,KAAK,WAAWE,CAAQ,EAC1B,CAGF,YAAK,QAAQ,IAAIN,EAAS,CACxB,GAAGD,EACH,GAAIC,CACN,CAAC,EACMA,CACT,CAEO,SAASH,EAAiBO,EAAwCG,EAAoBC,EAAmBC,EAAsB,CAKpI,IAAMR,EAAe,KAAK,oBAAoB,IAAIJ,CAAO,EACrDI,IAAiB,QACnB,KAAK,oBAAoB,OAAOA,CAAY,EAE9C,KAAK,cAAc,UAAYM,EAC/B,KAAK,cAAc,MAAQC,EAC3B,KAAK,cAAc,OAASC,EAC5B,IAAMb,EAAY,KAAK,SAAS,SAASQ,EAAO,KAAK,aAAa,EAClE,KAAK,oBAAoB,IAAIP,EAASD,CAAS,EAC/C,KAAK,oBAAoB,IAAIA,EAAWC,CAAO,CACjD,CAEO,SAASA,EAA8C,CAC5D,OAAO,KAAK,QAAQ,IAAIA,CAAO,CACjC,CAEO,WAAWA,EAAuB,CACvC,KAAK,QAAQ,OAAOA,CAAO,EAC3B,IAAMD,EAAY,KAAK,oBAAoB,IAAIC,CAAO,EAClDD,IAAc,SAChB,KAAK,SAAS,YAAYA,CAAS,EACnC,KAAK,oBAAoB,OAAOC,CAAO,EACvC,KAAK,oBAAoB,OAAOD,CAAS,EAE7C,CAEO,WAAkB,CACvB,KAAK,QAAQ,MAAM,EACnB,QAAWA,KAAa,KAAK,oBAAoB,OAAO,EACtD,KAAK,SAAS,YAAYA,CAAS,EAErC,KAAK,oBAAoB,MAAM,EAC/B,KAAK,oBAAoB,MAAM,CACjC,CAEA,IAAW,QAA+C,CACxD,OAAO,KAAK,OACd,CAEA,IAAW,oBAAkD,CAC3D,OAAO,KAAK,mBACd,CAEA,IAAW,aAAsB,CAC/B,OAAO,KAAK,aAAe,CAC7B,CAEQ,yBAAgC,CACtC,OAAW,CAACC,CAAO,IAAK,KAAK,QAAS,CACpC,GAAI,KAAK,QAAQ,MAAQH,EAAkB,iBAAmB,EAC5D,MAEG,KAAK,oBAAoB,IAAIG,CAAO,GACvC,KAAK,QAAQ,OAAOA,CAAO,CAE/B,CACF,CACF,EA5JaH,EACa,iBAAmB,IADtC,IAAMgB,GAANhB,ECVP,IAAAiB,EAA8E,OAI9E,IAAAC,GAAsC,QAGtC,IAAMC,GAAkB,QAGlBC,GAAkB,mBACxBA,GAAgB,IAAI,qBAAmB,EAGhC,IAAMC,GAAN,KAAyD,CAK9D,YACmBC,EACAC,EACAC,EACjB,CAHiB,WAAAF,EACA,cAAAC,EACA,mBAAAC,EAPnB,KAAQ,MAAQ,EAChB,KAAQ,SAAW,MAQjB,iBAAa,CACX,YAAa,KAAK,MAAM,WAAa,EACrC,QAASJ,GACT,aAAc,KAAK,MAAM,iBAC3B,CAAC,EAAE,KAAKK,GAAK,KAAK,KAAOA,CAAC,CAC5B,CAEO,OAAc,CAOf,KAAK,OACP,KAAK,KAAK,QAAQ,EAEjB,KAAK,KAAa,SAAS,KAAK,CAAC,EAClC,KAAK,KAAK,KAAK,EAAGL,GAAiB,KAAK,MAAM,iBAAiB,EAEnE,CAEO,KAAKM,EAAuB,CAGjC,GAFA,KAAK,MAAQ,EACb,KAAK,SAAW,GACZ,KAAK,KAAM,CACb,IAAMC,EAAYD,EAAO,OAAO,CAAC,IAAM,EAAI,EAAIE,GAC7C,KAAK,cAAc,MAAM,cAAc,aACvC,KAAK,cAAc,MAAM,eAAe,MAAM,EAChD,KAAK,KAAK,KAAKD,EAAW,KAAM,KAAK,MAAM,iBAAiB,CAC9D,CACF,CAEO,IAAIE,EAAmBC,EAAeC,EAAmB,CAC9D,GAAI,OAAK,UAAY,CAAC,KAAK,MAI3B,IADA,KAAK,OAASA,EAAMD,EAChB,KAAK,MAAQ,KAAK,MAAM,eAAgB,CAC1C,QAAQ,KAAK,gCAAgC,EAC7C,KAAK,SAAW,GAChB,KAAK,KAAK,QAAQ,EAClB,MACF,CACA,GAAI,CACF,KAAK,KAAK,OAAOD,EAAMC,EAAOC,CAAG,CACnC,OAASC,EAAG,CACV,QAAQ,KAAK,uCAAuCA,CAAC,EAAE,EACvD,KAAK,SAAW,GAChB,KAAK,KAAK,QAAQ,CACpB,EACF,CAEO,OAAOC,EAA8C,CAC1D,GAAI,KAAK,UAAY,CAACA,GAAW,CAAC,KAAK,KACrC,MAAO,GAGT,IAAMC,EAAQ,KAAK,KAAK,MAClBC,EAAS,KAAK,KAAK,OAGzB,GAAI,CAACD,GAAS,CAACC,EACb,OAAIA,GACF,KAAK,SAAS,cAAcA,CAAM,EAE7B,GAGT,IAAMC,EAASC,EAAc,aAAa,OAAWH,EAAOC,CAAM,EAClE,OAAAC,EAAO,WAAW,IAAI,GAAG,aAAa,IAAI,UAAU,KAAK,KAAK,MAAyCF,EAAOC,CAAM,EAAG,EAAG,CAAC,EACvH,KAAK,KAAK,YAAchB,IAC1B,KAAK,KAAK,QAAQ,EAEpB,KAAK,SAAS,SAASiB,CAAM,EACtB,EACT,CACF,EASA,SAASR,GAAgBU,EAAqBC,EAAgD,CAC5F,IAAIC,EAAK,EACT,GAAI,CAACD,EAGH,OAAOC,EAET,GAAIF,EAAK,UAAU,EACjB,GAAIA,EAAK,YAAY,EACnBE,EAAKC,GAAUF,EAAO,WAAW,IAAI,UAC5BD,EAAK,QAAQ,EAAG,CACzB,IAAMI,EAAKJ,EAAK,YAAqC,WAAWA,EAAK,WAAW,CAAC,EACjFE,KAAK,cAAW,GAAGE,CAAC,CACtB,MACEF,EAAKC,GAAUF,EAAO,KAAKD,EAAK,WAAW,CAAC,EAAE,IAAI,UAGhDA,EAAK,YAAY,EACnBE,EAAKC,GAAUF,EAAO,WAAW,IAAI,UAC5BD,EAAK,QAAQ,EAAG,CACzB,IAAMI,EAAKJ,EAAK,YAAqC,WAAWA,EAAK,WAAW,CAAC,EACjFE,KAAK,cAAW,GAAGE,CAAC,CACtB,MACEF,EAAKC,GAAUF,EAAO,KAAKD,EAAK,WAAW,CAAC,EAAE,IAAI,EAGtD,OAAOE,CACT,CAGA,SAASC,GAAUE,EAAyB,CAC1C,OAAI,aAAmBA,GACfA,EAAQ,MAAS,IAAMA,IAAU,EAAI,MAAS,IAAMA,IAAU,GAAK,MAAS,EAAIA,IAAU,GAAK,GACzG,CCtIO,IAAMC,GAAN,KAAwB,CAE7B,YACmBC,EACAC,EACAC,EACAC,EACjB,CAJiB,cAAAH,EACA,WAAAC,EACA,eAAAC,EACA,eAAAC,EALnB,KAAQ,cAA+B,CAAE,UAAW,GAAM,MAAO,MAAO,OAAQ,EAAG,UAAW,OAAQ,CAMnG,CAMI,SAASC,EAA4C,CAC1D,KAAK,cAAc,UAAY,KAAK,MAAM,eAC1C,KAAK,SAAS,SAASA,EAAK,KAAK,aAAa,CAChD,CAOO,cAAcC,EAAsB,CACzC,GAAI,KAAK,MAAM,eAAgB,CAC7B,IAAIC,EAAW,KAAK,UAAU,UAC1BA,EAAS,QAAU,IAAMA,EAAS,SAAW,MAC/CA,EAAWC,GAEb,IAAMC,EAAO,KAAK,KAAKH,EAASC,EAAS,MAAM,EAC/C,QAASG,EAAI,EAAGA,EAAID,EAAM,EAAEC,EAC1B,KAAK,UAAU,MAAM,cAAc,SAAS,CAEhD,CACF,CACF,ECrCO,IAAMC,GAAN,KAAsB,CAE3B,YACmBC,EACjB,CADiB,cAAAA,EAFnB,KAAQ,cAA+B,CAAE,UAAW,GAAM,MAAO,MAAO,OAAQ,EAAG,UAAW,KAAM,CAGjG,CAMI,SAASC,EAA4C,CAC1D,KAAK,SAAS,SAASA,EAAK,KAAK,aAAa,CAChD,CACF,ECiCA,IAAMC,GAAsC,CAC1C,kBAAmB,GACnB,WAAY,SACZ,aAAc,GACd,eAAgB,GAChB,kBAAmB,KACnB,eAAgB,SAChB,aAAc,IACd,gBAAiB,GACjB,WAAY,GACZ,aAAc,SACd,aAAc,GACd,eAAgB,QAClB,EAGMC,GAAyB,KAsBxB,IAAMC,GAAN,KAAsD,CAW3D,YAAYC,EAAoC,CANhD,KAAQ,aAA8B,CAAC,EAEvC,KAAQ,UAAwC,IAAI,IACpD,KAAiB,cAAgB,IAAIC,EACrC,KAAgB,aAA6B,KAAK,cAAc,MAG9D,KAAK,MAAQ,OAAO,OAAO,CAAC,EAAGC,GAAiBF,CAAI,EACpD,KAAK,aAAe,OAAO,OAAO,CAAC,EAAGE,GAAiBF,CAAI,CAC7D,CAEO,SAAgB,CACrB,QAAWG,KAAW,KAAK,UAAU,OAAO,EAAGA,EAAQ,MAAM,EAC7D,QAAWC,KAAO,KAAK,aACrBA,EAAI,QAAQ,EAEd,KAAK,aAAa,OAAS,EAC3B,KAAK,UAAU,MAAM,EACrB,KAAK,cAAc,QAAQ,CAC7B,CAEQ,iBAAiBC,EAA2B,CAClD,QAAWD,KAAOC,EAChB,KAAK,aAAa,KAAKD,CAAG,CAE9B,CAEO,SAASE,EAA8B,CAS5C,GARA,KAAK,UAAYA,EAGjB,KAAK,UAAY,IAAIC,EAAcD,CAAQ,EAC3C,KAAK,SAAW,IAAIE,EAAaF,EAAU,KAAK,UAAW,KAAK,KAAK,EACrE,KAAK,SAAS,aAAe,IAAM,KAAK,cAAc,KAAK,EAGvD,KAAK,MAAM,kBAAmB,CAChC,IAAMG,EAAYH,EAAS,QAAQ,eAAiB,CAAC,EACrDG,EAAU,iBAAmB,GAC7BA,EAAU,kBAAoB,GAC9BA,EAAU,gBAAkB,GAC5BH,EAAS,QAAQ,cAAgBG,CACnC,CAiCA,GA/BA,KAAK,cACH,KAAK,UACL,KAAK,SAGLH,EAAS,OAAO,mBAAmB,CAAE,OAAQ,IAAK,MAAO,GAAI,EAAGI,GAAU,KAAK,QAAQA,CAAM,CAAC,EAC9FJ,EAAS,OAAO,mBAAmB,CAAE,OAAQ,IAAK,MAAO,GAAI,EAAGI,GAAU,KAAK,QAAQA,CAAM,CAAC,EAC9FJ,EAAS,OAAO,mBAAmB,CAAE,MAAO,GAAI,EAAGI,GAAU,KAAK,KAAKA,CAAM,CAAC,EAC9EJ,EAAS,OAAO,mBAAmB,CAAE,OAAQ,IAAK,MAAO,GAAI,EAAGI,GAAU,KAAK,yBAAyBA,CAAM,CAAC,EAG/GJ,EAAS,SAASK,GAAS,KAAK,UAAU,OAAOA,CAAK,CAAC,EAQvDL,EAAS,OAAO,mBAAmB,CAAE,cAAe,IAAK,MAAO,GAAI,EAAG,IAAM,KAAK,MAAM,CAAC,EACzFA,EAAS,OAAO,mBAAmB,CAAE,MAAO,GAAI,EAAG,IAAM,KAAK,MAAM,CAAC,EACrEA,EAAS,MAAM,cAAc,eAAe,IAAM,KAAK,MAAM,CAAC,EAG9DA,EAAS,OAAO,eAAe,IAAM,KAAK,UAAU,cAAc,CAAC,EAGnEA,EAAS,SAASM,GAAW,KAAK,UAAU,eAAeA,CAAO,CAAC,CACrE,EAGI,KAAK,MAAM,aAAc,CAC3B,IAAMC,EAAe,IAAIC,GAAkB,KAAK,SAAW,KAAK,MAAO,KAAK,UAAYR,CAAQ,EAC1FS,EAAe,IAAIC,GAAa,KAAK,MAAOH,EAAcP,CAAQ,EACxE,KAAK,UAAU,IAAI,QAASS,CAAY,EACxC,KAAK,cACHT,EAAS,MAAM,cAAc,QAAQ,mBAAmB,CAAE,MAAO,GAAI,EAAGS,CAAY,CACtF,CACF,CAGA,GAAI,KAAK,MAAM,WAAY,CACzB,IAAME,EAAa,IAAIC,GAAgB,KAAK,QAAS,EAC/CC,EAAa,IAAIC,GAAW,KAAK,MAAO,KAAK,UAAYH,EAAYX,CAAQ,EACnF,KAAK,UAAU,IAAI,MAAOa,CAAU,EACpC,KAAK,cACHb,EAAS,MAAM,cAAc,QAAQ,mBAAmB,KAAMa,CAAU,CAC1E,CACF,CAGA,GAAI,KAAK,MAAM,aAAc,CAC3B,IAAME,EAAe,IAAIC,GAAkB,KAAK,QAAS,EACnDC,EAAe,IAAIC,GAAqB,KAAK,MAAO,KAAK,UAAYH,EAAcf,CAAQ,EACjG,KAAK,UAAU,IAAI,QAASiB,CAAY,EACxC,KAAK,cACHF,EACAE,EACAjB,EAAS,MAAM,cAAc,QAAQ,mBAAmB,CAAE,MAAO,GAAI,EAAGiB,CAAY,CACtF,CACF,CACF,CAGO,OAAiB,CAEtB,KAAK,MAAM,eAAiB,KAAK,aAAa,eAC9C,KAAK,MAAM,kBAAoB,KAAK,aAAa,kBAEjD,KAAK,UAAU,MAAM,EAErB,QAAWpB,KAAW,KAAK,UAAU,OAAO,EAC1CA,EAAQ,MAAM,EAEhB,MAAO,EACT,CAEA,IAAW,cAAuB,CAChC,OAAO,KAAK,UAAU,SAAS,GAAK,EACtC,CAEA,IAAW,aAAasB,EAAe,CACrC,KAAK,UAAU,SAASA,CAAK,EAC7B,KAAK,MAAM,aAAeA,CAC5B,CAEA,IAAW,cAAuB,CAChC,OAAI,KAAK,SACA,KAAK,SAAS,SAAS,EAEzB,EACT,CAEA,IAAW,iBAA2B,CACpC,OAAO,KAAK,MAAM,eACpB,CAEA,IAAW,gBAAgBC,EAAgB,CACzC,KAAK,MAAM,gBAAkBA,EAC7B,KAAK,WAAW,gBAAgBA,CAAK,CACvC,CAEO,qBAAqBC,EAAWC,EAA0C,CAC/E,OAAO,KAAK,UAAU,qBAAqBD,EAAGC,CAAC,CACjD,CAEO,wBAAwBD,EAAWC,EAA0C,CAClF,OAAO,KAAK,UAAU,wBAAwBD,EAAGC,CAAC,CACpD,CAEQ,QAAQC,EAAiB,CAC/B,KAAK,WAAW,MAAM,MAAMA,EAAG,EAAK,CACtC,CAEQ,QAAQnB,EAAwC,CACtD,QAASoB,EAAI,EAAGA,EAAIpB,EAAO,OAAQ,EAAEoB,EAC3BpB,EAAOoB,CAAC,IACT,KACH,KAAK,MAAM,eAAiB,IAIlC,MAAO,EACT,CAEQ,QAAQpB,EAAwC,CACtD,QAASoB,EAAI,EAAGA,EAAIpB,EAAO,OAAQ,EAAEoB,EAC3BpB,EAAOoB,CAAC,IACT,KACH,KAAK,MAAM,eAAiB,IAIlC,MAAO,EACT,CAGQ,KAAKpB,EAAwC,CACnD,OAAIA,EAAO,CAAC,EACH,GAOL,KAAK,MAAM,cACb,KAAK,QAAQ,kBAAkB,EACxB,IAEF,EACT,CAYQ,yBAAyBA,EAAwC,CACvE,GAAIA,EAAO,OAAS,EAClB,MAAO,GAET,GAAIA,EAAO,CAAC,IAAM,EAChB,OAAQA,EAAO,CAAC,EAAG,CACjB,IAAK,GACH,YAAK,QAAQ,SAASA,EAAO,CAAC,CAAC,MAAwB,KAAK,MAAM,iBAAiB,GAAG,EAC/E,GACT,IAAK,GACH,KAAK,MAAM,kBAAoB,KAAK,aAAa,kBACjD,KAAK,QAAQ,SAASA,EAAO,CAAC,CAAC,MAAwB,KAAK,MAAM,iBAAiB,GAAG,EAEtF,QAAWP,KAAW,KAAK,UAAU,OAAO,EAC1CA,EAAQ,MAAM,EAEhB,MAAO,GACT,IAAK,GACH,OAAIO,EAAO,OAAS,GAAK,EAAEA,EAAO,CAAC,YAAa,QAAUA,EAAO,CAAC,GAAKqB,IACrE,KAAK,MAAM,kBAAoBrB,EAAO,CAAC,EACvC,KAAK,QAAQ,SAASA,EAAO,CAAC,CAAC,MAAwB,KAAK,MAAM,iBAAiB,GAAG,GAEtF,KAAK,QAAQ,SAASA,EAAO,CAAC,CAAC,KAA4B,EAEtD,GACT,IAAK,GACH,YAAK,QAAQ,SAASA,EAAO,CAAC,CAAC,MAAwBqB,EAAsB,GAAG,EACzE,GACT,QACE,YAAK,QAAQ,SAASrB,EAAO,CAAC,CAAC,KAA4B,EACpD,EACX,CAEF,GAAIA,EAAO,CAAC,IAAM,EAChB,OAAQA,EAAO,CAAC,EAAG,CAEjB,IAAK,GACH,IAAIsB,EAAQ,KAAK,WAAW,YAAY,IAAI,OAAO,MAC/CC,EAAS,KAAK,WAAW,YAAY,IAAI,OAAO,OACpD,GAAI,CAACD,GAAS,CAACC,EAAQ,CAGrB,IAAMC,EAAWC,EACjBH,GAAS,KAAK,WAAW,MAAQ,IAAME,EAAS,MAChDD,GAAU,KAAK,WAAW,MAAQ,IAAMC,EAAS,MACnD,CACA,GAAIF,EAAQC,EAAS,KAAK,MAAM,WAC9B,KAAK,QAAQ,SAASvB,EAAO,CAAC,CAAC,MAAwBsB,EAAM,QAAQ,CAAC,CAAC,IAAIC,EAAO,QAAQ,CAAC,CAAC,GAAG,MAC1F,CAEL,IAAMN,EAAI,KAAK,MAAM,KAAK,KAAK,KAAK,MAAM,UAAU,CAAC,EACrD,KAAK,QAAQ,SAASjB,EAAO,CAAC,CAAC,MAAwBiB,CAAC,IAAIA,CAAC,GAAG,CAClE,CACA,MAAO,GACT,IAAK,GAEH,IAAMA,EAAI,KAAK,MAAM,KAAK,KAAK,KAAK,MAAM,UAAU,CAAC,EACrD,YAAK,QAAQ,SAASjB,EAAO,CAAC,CAAC,MAAwBiB,CAAC,IAAIA,CAAC,GAAG,EACzD,GACT,QACE,YAAK,QAAQ,SAASjB,EAAO,CAAC,CAAC,KAA4B,EACpD,EACX,CAGF,YAAK,QAAQ,SAASA,EAAO,CAAC,CAAC,KAA0B,EAClD,EACT,CACF",
-+  "names": ["exports", "red", "n", "green", "blue", "alpha", "toRGBA8888", "r", "g", "b", "a", "fromRGBA8888", "color", "nearestColorIndex", "palette", "min", "idx", "i", "dr", "dg", "db", "clamp", "low", "high", "value", "h2c", "t1", "t2", "c", "HLStoRGB", "h", "l", "s", "v", "normalizeRGB", "normalizeHLS", "p", "d", "require_lib", "__commonJSMin", "exports", "InWasm", "z", "b", "r", "def", "t", "s", "d", "m", "W", "e", "require_Base64Decoder_wasm", "__commonJSMin", "exports", "inwasm_runtime_1", "wasmDecode", "MAP", "el", "D", "i", "EMPTY", "Base64Decoder", "keepSize", "maxBytes", "initialBytes", "m", "bytes", "requested", "needed", "newSize", "addPages", "data", "require_QoiDecoder_wasm", "__commonJSMin", "exports", "inwasm_runtime_1", "wasmQoiDecode", "QoiDecoder", "keepSize", "d", "pixels", "ib", "dl", "bytes", "chunkP", "exports", "Colors_1", "wasm_1", "decodeBase64", "bytestring", "result", "WASM_BYTES", "WASM_MODULE", "NULL_CANVAS", "CallbackProxy", "width", "mode", "DEFAULT_OPTIONS", "DecoderAsync", "opts", "cbProxy", "importObj", "inst", "Decoder", "exports", "_instance", "_cbProxy", "module", "pixels", "offset", "additionalPixels", "newCanvas", "adv", "remaining", "c", "i", "fillColor", "palette", "paletteLimit", "truncate", "data", "start", "end", "p", "length", "j", "currentWidth", "escape", "final", "finalOffset", "bw", "currentHeight", "decode", "dec", "decodeAsync", "toDisposable", "fn", "DisposableStore", "o", "d", "Disposable", "MutableDisposable", "value", "Emitter", "listener", "thisArgs", "disposables", "toDisposable", "entry", "result", "idx", "event", "listeners", "len", "EventUtils", "forward", "from", "to", "e", "map", "i", "any", "events", "store", "DisposableStore", "runAndSubscribe", "handler", "initial", "import_Colors", "ImageRenderer", "_ImageRenderer", "Disposable", "_terminal", "MutableDisposable", "parent", "option", "toDisposable", "localDocument", "width", "height", "canvas", "ctx", "buffer", "imgData", "img", "value", "start", "end", "layer", "y", "w", "h", "imgSpec", "tileId", "col", "row", "count", "sourceWidth", "sourceHeight", "cols", "sx", "sy", "dx", "dy", "finalWidth", "finalHeight", "spec", "currentWidth", "currentHeight", "originalWidth", "originalHeight", "scaledWidth", "scaledHeight", "renderer", "key", "screenElement", "bWidth", "blueprint", "d32", "black", "white", "shift", "offset", "x", "ctx2", "i", "placeholder", "bitmap", "CELL_SIZE_DEFAULT", "ExtendedAttrsImage", "_ExtendedAttrsImage", "ext", "urlId", "imageId", "tileId", "value", "val", "EMPTY_ATTRS", "ImageStorage", "_terminal", "_renderer", "_opts", "e", "spec", "storedPixels", "id", "zero", "img", "opts", "cellSize", "cols", "rows", "buffer", "termCols", "termRows", "originX", "originY", "offset", "tileCount", "row", "line", "col", "endMarker", "imgSpec", "range", "hasTopImages", "hasBottomImages", "start", "end", "drawCalls", "placeholderCalls", "startTile", "startCol", "count", "a", "b", "call", "metrics", "oldCol", "tilesPerRow", "hasData", "rightCol", "lastTile", "expandCol", "x", "y", "orig", "canvas", "ImageRenderer", "room", "used", "current", "old", "oldSpec", "imgId", "import_Base64Decoder", "import_QoiDecoder", "toStr", "data", "s", "i", "toInt", "v", "toSize", "toName", "bs", "b", "DECODERS", "FILE_MARKER", "MULTIPARTFILE_MARKER", "FILEPART_MARKER", "FILEEND_MARKER", "REPORTCELLSIZE_MARKER", "MAX_FIELDCHARS", "HeaderParser", "k", "start", "end", "state", "pos", "buffer", "c", "UNSUPPORTED_TYPE", "imageType", "d", "d32", "width", "height", "jpgSize", "dim", "pos", "limit", "i", "len", "blockLength", "DEFAULT_HEADER", "IIPHandler", "_opts", "_renderer", "_storage", "_coreTerminal", "HeaderParser", "maxEncodedBytes", "initialBytes", "Base64Decoder", "QoiDecoder", "data", "start", "end", "dataPos", "success", "seqType", "w", "CELL_SIZE_DEFAULT", "h", "scale", "report", "cond", "metrics", "UNSUPPORTED_TYPE", "imageType", "blob", "canvas", "ImageRenderer", "generation", "bm", "e", "cw", "ch", "width", "height", "rw", "rh", "wf", "hf", "f", "s", "total", "cdim", "import_Base64Decoder", "parseKittyCommand", "data", "cmd", "parts", "part", "eqIdx", "key", "value", "numValue", "DECODER_OK", "KittyGraphicsHandler", "_opts", "_renderer", "_kittyStorage", "_coreTerminal", "key", "pending", "data", "start", "end", "controlEnd", "i", "copyLength", "parseKittyCommand", "payloadStart", "pendingKey", "previousEncodedSize", "decoderToRelease", "decoderCapacity", "maxPending", "oldest", "Base64Decoder", "success", "cmd", "isMoreComing", "decodeError", "finalCmd", "decoder", "imageBytes", "result", "str", "bytes", "id", "image", "quiet", "format", "width", "height", "bytesPerPixel", "expectedBytes", "message", "placementId", "isOk", "pPart", "response", "generation", "bitmap", "cropX", "cropY", "cropW", "cropH", "maxCropW", "maxCropH", "finalCropW", "finalCropH", "cropped", "cw", "CELL_SIZE_DEFAULT", "ch", "imgCols", "imgRows", "w", "h", "buffer", "savedX", "savedY", "savedYbase", "layer", "scaled", "xOffset", "yOffset", "canvasW", "canvasH", "offsetCanvas", "ImageRenderer", "offsetCtx", "offsetBitmap", "zIndex", "scrolled", "e", "metrics", "imageType", "blob", "url", "img", "resolve", "reject", "canvas", "pixelCount", "src32", "dst32", "alignedPixels", "srcOffset", "dstOffset", "b0", "b1", "b2", "srcByte", "dstByte", "compressed", "error", "limit", "offsetIn", "reader", "controller", "chunks", "totalLength", "done", "value", "offset", "chunk", "_KittyImageStorage", "_storage", "storageId", "kittyId", "id", "imageData", "imageId", "oldStorageId", "byteLimit", "retainedBytes", "image", "evictPlaced", "oldestId", "scrolling", "layer", "zIndex", "KittyImageStorage", "import_Colors", "import_Decoder", "MEM_PERMA_LIMIT", "DEFAULT_PALETTE", "SixelHandler", "_opts", "_storage", "_coreTerminal", "d", "params", "fillColor", "extractActiveBg", "data", "start", "end", "e", "success", "width", "height", "canvas", "ImageRenderer", "attr", "colors", "bg", "convertLe", "t", "color", "SixelImageStorage", "_storage", "_opts", "_renderer", "_terminal", "img", "height", "cellSize", "CELL_SIZE_DEFAULT", "rows", "i", "IIPImageStorage", "_storage", "img", "DEFAULT_OPTIONS", "MAX_SIXEL_PALETTE_SIZE", "ImageAddon", "opts", "Emitter", "DEFAULT_OPTIONS", "handler", "obj", "args", "terminal", "ImageRenderer", "ImageStorage", "windowOps", "params", "range", "metrics", "sixelStorage", "SixelImageStorage", "sixelHandler", "SixelHandler", "iipStorage", "IIPImageStorage", "iipHandler", "IIPHandler", "kittyStorage", "KittyImageStorage", "kittyHandler", "KittyGraphicsHandler", "limit", "value", "x", "y", "s", "i", "MAX_SIXEL_PALETTE_SIZE", "width", "height", "cellSize", "CELL_SIZE_DEFAULT"]
++  "sourcesContent": [null, "\"use strict\";\n/**\n * Copyright (c) 2022, 2026 Joerg Breitbart\n * @license MIT\n */\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.InWasm = InWasm;\nlet z = (s) => {\n    if (Uint8Array.fromBase64)\n        return Uint8Array.fromBase64(s);\n    if (typeof Buffer !== 'undefined')\n        return Buffer.from(s, 'base64');\n    const b = atob(s);\n    const r = new Uint8Array(b.length);\n    for (let i = 0; i < r.length; ++i)\n        r[i] = b.charCodeAt(i);\n    return r;\n};\nfunction InWasm(def) {\n    if (def.d) {\n        const { t, s, d } = def;\n        let b;\n        let m;\n        const W = WebAssembly;\n        if (t === 0 /* OutputType.INSTANCE */) {\n            if (s)\n                return (e) => new W.Instance(m || (m = new W.Module(b || (b = z(d)))), e);\n            return (e) => m\n                ? W.instantiate(m, e)\n                : W.instantiate(b || (b = z(d)), e).then(r => (m = r.module) && r.instance);\n        }\n        if (t === 1 /* OutputType.MODULE */) {\n            if (s)\n                return () => m || (m = new W.Module(b || (b = z(d))));\n            return () => m\n                ? Promise.resolve(m)\n                : W.compile(b || (b = z(d))).then(r => m = r);\n        }\n        if (s)\n            return () => b || (b = z(d));\n        return () => Promise.resolve(b || (b = z(d)));\n    }\n    if (typeof _wasmCtx === 'undefined')\n        throw new Error('must run \"inwasm\"');\n    _wasmCtx.add(def);\n}\n//# sourceMappingURL=index.js.map", "\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\n/**\n * Copyright (c) 2023, 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n */\nconst inwasm_runtime_1 = require(\"inwasm-runtime\");\n/**\n * wasm base64 decoder.\n */\nconst wasmDecode = (0, inwasm_runtime_1.InWasm)(/*inwasm#828e69684093b2c6:rdef-start:\"decode\"*/{s:1,t:0,d:'AGFzbQEAAAABBQFgAAF/Ag8BA2VudgZtZW1vcnkCAAEDAwIAAAcNAgNkZWMAAANlbmQAAQqLBgKZBAEKf0GIKCgCAEGgKGohAUGEKCgCACIDQaAoaiEAQYAoKAIAQQFrQXxxIgRBoChqIQUgBEEQayADSgRAIARBkChqIQMDQCABIABBA2otAABBAnQoAoAgIABBAmotAABBAnQoAoAYIABBAWotAABBAnQoAoAQIAAtAABBAnQoAoAIcnJyIgY2AgAgAUEDaiAAQQdqLQAAQQJ0KAKAICAAQQZqLQAAQQJ0KAKAGCAAQQVqLQAAQQJ0KAKAECAAQQRqLQAAQQJ0KAKACHJyciIHNgIAIAFBBmogAEELai0AAEECdCgCgCAgAEEKai0AAEECdCgCgBggAEEJai0AAEECdCgCgBAgAEEIai0AAEECdCgCgAhycnIiCDYCACABQQlqIABBD2otAABBAnQoAoAgIABBDmotAABBAnQoAoAYIABBDWotAABBAnQoAoAQIABBDGotAABBAnQoAoAIcnJyIgk2AgAgAiAGciAHciAIciAJciECIAFBDGohASAAQRBqIgAgA0kNAAsLIAAgBUkEQANAIAEgAEEDai0AAEECdCgCgCAgAEECai0AAEECdCgCgBggAEEBai0AAEECdCgCgBAgAC0AAEECdCgCgAhycnIiAzYCACACIANyIQIgAUEDaiEBIABBBGoiACAFSQ0ACwtBfyEAIAJB////B00Ef0GEKCAENgIAQYgoIAFBoChrNgIAQQAFQX8LC+0BAQR/AkBBgCgoAgAiAUGEKCgCACIAa0EFTgRAQX8hAxAADQFBgCgoAgAhAUGEKCgCACEAC0F/IQMgASAAayIBQQJIDQAgAC0AoShBAnQoAoAQIAAtAKAoQQJ0KAKACHIhAgJ/IAFBBEYEQEEDQQQgAC0AoyhBPUYbIAAtAKIoQT1GayEBC0EBIAFBA0kNABogAC0AoihBAnQoAoAYIAJyIQJBAiABQQRHDQAaIAAtAKMoQQJ0KAKAICACciECQQMLIQEgAkH///8HSw0AQQAhA0GIKCgCACIAIAI2AKAoQYgoIAAgAWo2AgALIAML'}/*inwasm#828e69684093b2c6:rdef-end:\"decode\"*/);\n// SIMD version (speedup ~1.4x, not covered by tests yet)\n/*\nconst wasmDecode = InWasm({\n  name: 'decode',\n  type: OutputType.INSTANCE,\n  mode: OutputMode.SYNC,\n  srctype: 'Clang-C',\n  imports: {\n    env: { memory: new WebAssembly.Memory({ initial: 1 }) }\n  },\n  exports: {\n    dec: () => 0,\n    end: () => 0\n  },\n  compile: {\n    switches: ['-msimd128', '-Wl,-z,stack-size=0', '-Wl,--stack-first']\n  },\n  code: `\n    #include <wasm_simd128.h>\n    typedef struct {\n      unsigned int wp;\n      unsigned int sp;\n      unsigned int dp;\n      unsigned int e_size;\n      unsigned int dummy[4];\n      unsigned char data[0];\n    } State;\n\n    unsigned int *D0 = (unsigned int *) ${P32.D0 * 4};\n    unsigned int *D1 = (unsigned int *) ${P32.D1 * 4};\n    unsigned int *D2 = (unsigned int *) ${P32.D2 * 4};\n    unsigned int *D3 = (unsigned int *) ${P32.D3 * 4};\n    State *state = (State *) ${P32.STATE * 4};\n\n    #define packed_byte(x) wasm_i8x16_splat((char) x)\n    #define packed_dword(x) wasm_i32x4_splat(x)\n    #define masked(x, mask) wasm_v128_and(x, wasm_i32x4_splat(mask))\n\n    __attribute__((noinline)) int dec() {\n      unsigned int nsp = (state->wp - 1) & ~3;\n      unsigned char *src = state->data + state->sp;\n      unsigned char *end = state->data + nsp;\n      unsigned char *dst = state->data + state->dp;\n      unsigned int error = 0;\n\n      v128_t err = wasm_i8x16_splat(0);\n      unsigned char *end16 = state->data + (nsp & ~15);\n      while (src < end16) {\n        v128_t data = wasm_v128_load((v128_t *) src);\n\n        // wasm-simd rewrite of http://0x80.pl/notesen/2016-01-17-sse-base64-decoding.html#vector-lookup-pshufb\n        const v128_t higher_nibble = wasm_u32x4_shr(data, 4) & packed_byte(0x0f);\n        const char linv = 1;\n        const char hinv = 0;\n\n        const v128_t lower_bound_LUT = wasm_i8x16_const(\n          // order: 0 1 2 3 4 5 6 7 8 9 a b c d e f\n          linv, linv, 0x2b, 0x30,\n          0x41, 0x50, 0x61, 0x70,\n          linv, linv, linv, linv,\n          linv, linv, linv, linv\n        );\n        const v128_t upper_bound_LUT = wasm_i8x16_const(\n          // order: 0 1 2 3 4 5 6 7 8 9 a b c d e f\n          hinv, hinv, 0x2b, 0x39,\n          0x4f, 0x5a, 0x6f, 0x7a,\n          hinv, hinv, hinv, hinv,\n          hinv, hinv, hinv, hinv\n        );\n        // the difference between the shift and lower bound\n        const v128_t shift_LUT = wasm_i8x16_const(\n          // order: 0 1 2 3 4 5 6 7 8 9 a b c d e f\n          0x00,        0x00,        0x3e - 0x2b, 0x34 - 0x30,\n          0x00 - 0x41, 0x0f - 0x50, 0x1a - 0x61, 0x29 - 0x70,\n          0x00,        0x00,        0x00,        0x00,\n          0x00,        0x00,        0x00,        0x00\n        );\n\n        const v128_t upper_bound = wasm_i8x16_swizzle(upper_bound_LUT, higher_nibble);\n        const v128_t lower_bound = wasm_i8x16_swizzle(lower_bound_LUT, higher_nibble);\n\n        const v128_t below = wasm_i8x16_lt(data, lower_bound);\n        const v128_t above = wasm_i8x16_gt(data, upper_bound);\n        const v128_t eq_2f = wasm_i8x16_eq(data, packed_byte(0x2f));\n\n        // in_range = not (below or above) or eq_2f\n        // outside  = not in_range = below or above and not eq_2f (from deMorgan law)\n        const v128_t outside = wasm_v128_andnot(eq_2f, above | below);\n        err = wasm_v128_or(err, outside);\n\n        const v128_t shift  = wasm_i8x16_swizzle(shift_LUT, higher_nibble);\n        const v128_t t0     = wasm_i8x16_add(data, shift);\n        v128_t v = wasm_i8x16_add(t0, wasm_v128_and(eq_2f, packed_byte(-3)));\n\n        // pack bytes\n        const v128_t ca = masked(v, 0x003f003f);\n        const v128_t db = masked(v, 0x3f003f00);\n        const v128_t t00 = wasm_v128_or(wasm_u32x4_shr(db, 8), wasm_i32x4_shl(ca, 6));\n        v128_t res = wasm_v128_or(wasm_u32x4_shr(t00, 16), wasm_i32x4_shl(t00, 12));\n        res = wasm_i8x16_swizzle(res, wasm_i8x16_const(2, 1, 0, 6, 5, 4, 10, 9, 8, 14, 13, 12, 16, 16, 16, 16));\n\n        wasm_v128_store((v128_t *) dst, res);\n        dst += 12;\n        src += 16;\n      }\n      //if (wasm_i8x16_bitmask(err) != 0) return -1;\n      if (wasm_v128_any_true(err)) return -1;\n\n      // operate on 4-byte blocks\n      while (src < end) {\n        error |= *((unsigned int *) dst) = D0[src[0]] | D1[src[1]] | D2[src[2]] | D3[src[3]];\n        dst += 3;\n        src += 4;\n      }\n      if (error >> 24) return -1;\n      state->sp = nsp;\n      state->dp = dst - state->data;\n      return 0;\n    }\n\n    int end() {\n      int rem = state->wp - state->sp;\n      if (rem > 4 && dec()) return -1;\n      rem = state->wp - state->sp;\n      if (rem < 2) return -1;\n\n      unsigned char *src = state->data + state->sp;\n      if (rem == 4) {\n        if (src[3] == 61) rem--;\n        if (src[2] == 61) rem--;\n      }\n      unsigned int accu = D0[src[0]] | D1[src[1]];\n      int dp = 1;\n      if (rem > 2) {\n        accu |= D2[src[2]];\n        dp++;\n        if (rem == 4) {\n          accu |= D3[src[3]];\n          dp++;\n        }\n      }\n      if (accu >> 24) return -1;\n      *((unsigned int *) (state->data + state->dp)) = accu;\n      state->dp += dp;\n      return 0;\n    }\n    `\n});\n*/\n// base64 map\nconst MAP = new Uint8Array('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'\n    .split('')\n    .map(el => el.charCodeAt(0)));\n// init decoder maps in LE order\nconst D = new Uint32Array(1024);\nD.fill(0xFF000000);\nfor (let i = 0; i < MAP.length; ++i)\n    D[MAP[i]] = i << 2;\nfor (let i = 0; i < MAP.length; ++i)\n    D[256 + MAP[i]] = i >> 4 | ((i << 4) & 0xFF) << 8;\nfor (let i = 0; i < MAP.length; ++i)\n    D[512 + MAP[i]] = (i >> 2) << 8 | ((i << 6) & 0xFF) << 16;\nfor (let i = 0; i < MAP.length; ++i)\n    D[768 + MAP[i]] = i << 16;\nconst EMPTY = new Uint8Array(0);\n/**\n * base64 stream decoder.\n *\n * Features / assumptions:\n * - lazy chunkwise decoding\n * - errors out on any non base64 chars (no support for NL formatted base64)\n * - decodes in wasm\n * - inplace decoding to save memory\n * - supports a keepSize for lazy memory release\n */\nclass Base64Decoder {\n    /**\n     * @param keepSize Keep the wasm instance below this limit when calling `release()`.\n     * @param maxBytes Max allowed bytes to allocate.\n     * @param initialBytes Initial bytes to allocate.\n     */\n    constructor(keepSize, maxBytes, initialBytes) {\n        this._inst = null;\n        this._ended = true;\n        this._bytes = 0;\n        this.keepSize = keepSize !== null && keepSize !== void 0 ? keepSize : 1048576 /* Bytes.KEEP */;\n        this.maxBytes = maxBytes !== null && maxBytes !== void 0 ? maxBytes : 4294901760 /* Bytes.MAX */;\n        this._bytes = initialBytes !== null && initialBytes !== void 0 ? initialBytes : 32768 /* Bytes.INITIAL */;\n        if (this._bytes > this.maxBytes || this.maxBytes > 4294901760 /* Bytes.MAX */) {\n            throw new Error('invalid byte settings');\n        }\n    }\n    /**\n     * Currently decoded bytes (borrowed).\n     * Must be accessed before calling `release` or `init`.\n     */\n    get data8() {\n        return this._inst ? this._d.subarray(0, this._m32[1282 /* P32.STATE_DP */]) : EMPTY;\n    }\n    /**\n     * Release memory conditionally based on `keepSize`.\n     * If memory gets released, also the wasm instance will be freed and recreated on next `init`,\n     * otherwise the instance will be reused.\n     */\n    release() {\n        if (!this._inst)\n            return;\n        if (this._bytes > this.keepSize) {\n            this._inst = this._m32 = this._d = this._mem = null;\n        }\n        else {\n            this._m32[1280 /* P32.STATE_WP */] = 0;\n            this._m32[1281 /* P32.STATE_SP */] = 0;\n            this._m32[1282 /* P32.STATE_DP */] = 0;\n        }\n    }\n    /**\n     * Initializes the decoder for new base64 data.\n     * Must be called before doing any decoding attempts.\n     * The method will either spawn a new wasm instance or grow\n     * the needed memory of an existing instance.\n     * @param maxBytes Max allowed bytes to allocate (overwrites ctor value).\n     * @param initialBytes Initial bytes to allocate (overwrites ctor value).\n     */\n    init(maxBytes, initialBytes) {\n        this.maxBytes = maxBytes !== null && maxBytes !== void 0 ? maxBytes : this.maxBytes;\n        this._bytes = initialBytes !== null && initialBytes !== void 0 ? initialBytes : Math.min(this._bytes, this.maxBytes);\n        if (this._bytes > this.maxBytes || this.maxBytes > 4294901760 /* Bytes.MAX */) {\n            throw Error('invalid byte settings');\n        }\n        let m = this._m32;\n        const bytes = this._bytes + 5152 /* Bytes._DATA_OFFSET */;\n        if (!this._inst) {\n            this._mem = new WebAssembly.Memory({ initial: Math.ceil(bytes / 65536) });\n            this._inst = wasmDecode({ env: { memory: this._mem } });\n            m = new Uint32Array(this._mem.buffer, 0);\n            m.set(D, 256 /* P32.D0 */);\n            this._d = new Uint8Array(this._mem.buffer, 5152 /* Bytes._DATA_OFFSET */);\n        }\n        else if (this._mem.buffer.byteLength < bytes) {\n            this._mem.grow(Math.ceil((bytes - this._mem.buffer.byteLength) / 65536));\n            m = new Uint32Array(this._mem.buffer, 0);\n            this._d = new Uint8Array(this._mem.buffer, 5152 /* Bytes._DATA_OFFSET */);\n        }\n        m[1280 /* P32.STATE_WP */] = 0;\n        m[1281 /* P32.STATE_SP */] = 0;\n        m[1282 /* P32.STATE_DP */] = 0;\n        this._m32 = m;\n        this._ended = false;\n    }\n    /**\n     * Realloc memory. Realloc only happens, if the requested\n     * size doesn't fit in the current memory.\n     * The new size will be capped by `maxBytes`.\n     * @param requested Bytes to be stored.\n     */\n    _realloc(requested) {\n        const needed = this._m32[1280 /* P32.STATE_WP */] + requested;\n        if (this._bytes < needed) {\n            if (needed > this.maxBytes) {\n                return -3 /* DecodeStatus.SIZE_EXCEEDED */;\n            }\n            let newSize = this._bytes;\n            while ((newSize *= 2) < needed) { }\n            newSize = Math.min(newSize, this.maxBytes);\n            if (newSize < needed) {\n                return -3 /* DecodeStatus.SIZE_EXCEEDED */;\n            }\n            if (newSize + 5152 /* Bytes._DATA_OFFSET */ > this._mem.buffer.byteLength) {\n                const addPages = Math.ceil((newSize + 5152 /* Bytes._DATA_OFFSET */ - this._mem.buffer.byteLength) / 65536);\n                this._mem.grow(addPages);\n                this._m32 = new Uint32Array(this._mem.buffer, 0);\n                this._d = new Uint8Array(this._mem.buffer, 5152 /* Bytes._DATA_OFFSET */);\n            }\n            this._bytes = newSize;\n        }\n        return 0 /* DecodeStatus.OK */;\n    }\n    /**\n     * Put bytes in `data` into the decoder.\n     * Additionally decodes the payload, if it reached 2^17 bytes.\n     * The return value indicates the type of issue.\n     * @param data Bytes to be loaded.\n     */\n    put(data) {\n        if (!this._inst || this._ended) {\n            return -2 /* DecodeStatus.NOT_INITIALIZED */;\n        }\n        if (this._realloc(data.length)) {\n            return -3 /* DecodeStatus.SIZE_EXCEEDED */;\n        }\n        const m = this._m32;\n        this._d.set(data, m[1280 /* P32.STATE_WP */]);\n        m[1280 /* P32.STATE_WP */] += data.length;\n        // max chunk in input handler is 2^17, try to run in \"tandem mode\"\n        return m[1280 /* P32.STATE_WP */] - m[1281 /* P32.STATE_SP */] >= 131072\n            ? this._inst.exports.dec()\n            : 0 /* DecodeStatus.OK */;\n    }\n    /**\n     * End the current decoding.\n     * Also decodes leftover payload from previous put calls.\n     */\n    end() {\n        this._ended = true;\n        return this._inst\n            ? this._inst.exports.end()\n            : -2 /* DecodeStatus.NOT_INITIALIZED */;\n    }\n    /**\n     * Bytes loaded into the decoder.\n     */\n    get loadedBytes() {\n        return this._inst\n            ? this._m32[1280 /* P32.STATE_WP */]\n            : 0;\n    }\n    /**\n     * Free bytes to feed to the decoder.\n     */\n    get freeBytes() {\n        return this._inst\n            ? this.maxBytes - this._m32[1280 /* P32.STATE_WP */]\n            : 0;\n    }\n}\nexports.default = Base64Decoder;\n//# sourceMappingURL=Base64Decoder.wasm.js.map", "\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\n/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\nconst inwasm_runtime_1 = require(\"inwasm-runtime\");\nconst wasmQoiDecode = (0, inwasm_runtime_1.InWasm)(/*inwasm#459f9e1bfb80b1a8:rdef-start:\"qoi_decode\"*/{s:1,t:0,d:'AGFzbQEAAAABCgJgAABgA39/fwACDwEDZW52Bm1lbW9yeQIAAQMDAgABBwcBA2RlYwABCAEACu4EAgwAQQBBAEGAAvwLAAveBAEJf0EAQQBBgAL8CwAgAUEXTgRAIAAgAWpBCGshCkGACCEBIAJBAnRBgAhqIQsgAEEOaiEDQf8BIQZBACECA0AgA0EBaiEHIAMtAAAiCEE/cSEAAkACQCAIQcABcSIJRQRAIABBAnQiAC0AAyEGIAAtAAIhBCAALQABIQUgAC0AACECIAchAwwBCwJAIAhB/QFLDQAgCUHAAUcNACAFQQVsIAJBA2xqIARBB2xqIAZBC2xqQT9xQQJ0IgMgBDoAAiADIAU6AAEgAyACOgAAIANBA2ogBjoAAANAIAEgAjoAACABQQNqIAY6AAAgAUECaiAEOgAAIAFBAWogBToAACABQQRqIQEgAEUEQCAHIQMMBAsgAEEBayEAIAEgC0kNAAsgByEDDAILAn8CQAJAAkAgCEH+AWsOAgABAgsgAy0AAyEEIAMtAAIhBSADLQABIQIgA0EEagwCCyADKAIBIgJBGHYhBiACQRB2IQQgAkEIdiEFIANBBWoMAQsgCUGAAUcEQCAHIAlBwABHDQEaIAQgCEEDcWpBAmshBCACIABBBHZqQQJrIQIgBSAIQQJ2QQNxakECayEFIAcMAQsgBCAAQShrIgkgAy0AASIHQQ9xamohBCACIAdBBHYgCWpqIQIgACAFakEgayEFIANBAmoLIQMgBUEFbCACQQNsaiAEQQdsaiAGQQtsakE/cUECdCIAIAQ6AAIgACAFOgABIAAgAjoAACAAQQNqIAY6AAALIAEgBjoAAyABIAQ6AAIgASAFOgABIAEgAjoAACABQQRqIQELIAMgCkkNAAsLCw=='}/*inwasm#459f9e1bfb80b1a8:rdef-end:\"qoi_decode\"*/);\nclass QoiDecoder {\n    constructor(keepSize) {\n        this.keepSize = keepSize;\n        this.width = 0;\n        this.height = 0;\n    }\n    decode(d) {\n        this.width = d[4] << 24 | d[5] << 16 | d[6] << 8 | d[7];\n        this.height = d[8] << 24 | d[9] << 16 | d[10] << 8 | d[11];\n        const pixels = this.width * this.height;\n        const ib = pixels * 4;\n        const dl = d.length;\n        /**\n         * byte/offset calculation:\n         * To save some memory we dont reserve full memory for decoded + encoded,\n         * but place encoded at the end of decoded plus 50% security distance\n         * to avoid reads before writes positions:\n         *\n         * encoded < decoded (good compression)\n         *    enc                                              ####################\n         *    dec                 #######################################\n         *                        ^                            ^\n         *                        DST_P                        CHUNK_P\n         *\n         * encoded > decoded (degenerated compression, should not happen)\n         *    enc                           ##############################\n         *    dec                 ####################\n         *                        ^         ^\n         *                        DST_P     CHUNK_P\n         *\n         * There is still a chance for overlapping r/w positions in case the compressed\n         * data has very different pixel progression, yet the 50% security distance\n         * should deal with that, as QOI will bloat data by 25% at max (RGB -> OP byte + RGB).\n         * Since we always assume RGBA at decoding stage, the possible bloat reduces to 20% at max.\n         */\n        const bytes = Math.max(ib, dl) + (Math.min(ib, dl) >> 1) + 4096;\n        if (!this._inst) {\n            this._mem = new WebAssembly.Memory({ initial: Math.ceil(bytes / 65536) });\n            this._inst = wasmQoiDecode({ env: { memory: this._mem } });\n        }\n        else if (this._mem.buffer.byteLength < bytes) {\n            this._mem.grow(Math.ceil((bytes - this._mem.buffer.byteLength) / 65536));\n            this._d = null;\n        }\n        if (!this._d) {\n            this._d = new Uint8Array(this._mem.buffer);\n        }\n        // put src data at the end of memory, also align to 256\n        const chunkP = (this._mem.buffer.byteLength - dl) & ~0xFF;\n        this._d.set(d, chunkP);\n        this._inst.exports.dec(chunkP, dl, pixels);\n        return this._d.subarray(1024 /* P8.DST_P */, 1024 /* P8.DST_P */ + ib);\n    }\n    release() {\n        if (!this._inst)\n            return;\n        if (this._mem.buffer.byteLength > this.keepSize) {\n            this._inst = this._d = this._mem = null;\n        }\n    }\n}\nexports.default = QoiDecoder;\n//# sourceMappingURL=QoiDecoder.wasm.js.map", null, null, "/**\n * Copyright (c) 2024-2026 The xterm.js authors. All rights reserved.\n * @license MIT\n *\n * Minimal lifecycle utilities for xterm.js core.\n * Simplified from VS Code's lifecycle.ts - no tracking/leak detection.\n */\n\nexport interface IDisposable {\n  dispose(): void;\n}\n\nexport function toDisposable(fn: () => void): IDisposable {\n  return { dispose: fn };\n}\n\nexport function dispose<T extends IDisposable>(disposable: T): T;\nexport function dispose<T extends IDisposable>(disposable: T | undefined): T | undefined;\nexport function dispose<T extends IDisposable>(disposables: T[]): T[];\nexport function dispose<T extends IDisposable>(arg: T | T[] | undefined): T | T[] | undefined {\n  if (!arg) {\n    return arg;\n  }\n  if (Array.isArray(arg)) {\n    for (const d of arg) {\n      d.dispose();\n    }\n    return [];\n  }\n  arg.dispose();\n  return arg;\n}\n\nexport function combinedDisposable(...disposables: IDisposable[]): IDisposable {\n  return toDisposable(() => dispose(disposables));\n}\n\nexport class DisposableStore implements IDisposable {\n  private readonly _disposables = new Set<IDisposable>();\n  private _isDisposed = false;\n\n  public get isDisposed(): boolean {\n    return this._isDisposed;\n  }\n\n  public add<T extends IDisposable>(o: T): T {\n    if (this._isDisposed) {\n      o.dispose();\n    } else {\n      this._disposables.add(o);\n    }\n    return o;\n  }\n\n  public dispose(): void {\n    if (this._isDisposed) {\n      return;\n    }\n    this._isDisposed = true;\n    for (const d of this._disposables) {\n      d.dispose();\n    }\n    this._disposables.clear();\n  }\n\n  public clear(): void {\n    for (const d of this._disposables) {\n      d.dispose();\n    }\n    this._disposables.clear();\n  }\n}\n\nexport abstract class Disposable implements IDisposable {\n  public static readonly None: IDisposable = Object.freeze({ dispose() { } });\n\n  protected readonly _store = new DisposableStore();\n\n  public dispose(): void {\n    this._store.dispose();\n  }\n\n  protected _register<T extends IDisposable>(o: T): T {\n    return this._store.add(o);\n  }\n}\n\nexport class MutableDisposable<T extends IDisposable> implements IDisposable {\n  private _value: T | undefined;\n  private _isDisposed = false;\n\n  public get value(): T | undefined {\n    return this._isDisposed ? undefined : this._value;\n  }\n\n  public set value(value: T | undefined) {\n    if (this._isDisposed || value === this._value) {\n      return;\n    }\n    this._value?.dispose();\n    this._value = value;\n  }\n\n  public clear(): void {\n    this.value = undefined;\n  }\n\n  public dispose(): void {\n    this._isDisposed = true;\n    this._value?.dispose();\n    this._value = undefined;\n  }\n}\n", "/**\n * Copyright (c) 2024-2026 The xterm.js authors. All rights reserved.\n * @license MIT\n *\n * Minimal event utilities for xterm.js core.\n * Simplified from VS Code's event.ts - no leak detection/profiling.\n */\n\nimport { IDisposable, DisposableStore, toDisposable } from './Lifecycle';\n\nexport interface IEvent<T> {\n  (listener: (e: T) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore): IDisposable;\n}\n\nexport class Emitter<T> {\n  private _listeners: { fn: (e: T) => any, thisArgs: any }[] = [];\n  private _disposed = false;\n  private _event: IEvent<T> | undefined;\n\n  public get event(): IEvent<T> {\n    if (this._event) {\n      return this._event;\n    }\n    this._event = (listener: (e: T) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore) => {\n      if (this._disposed) {\n        return toDisposable(() => {});\n      }\n\n      const entry = { fn: listener, thisArgs };\n      this._listeners = this._listeners.slice();\n      this._listeners.push(entry);\n\n      const result = toDisposable(() => {\n        const idx = this._listeners.indexOf(entry);\n        if (idx !== -1) {\n          this._listeners = this._listeners.slice();\n          this._listeners.splice(idx, 1);\n        }\n      });\n\n      if (disposables) {\n        if (Array.isArray(disposables)) {\n          disposables.push(result);\n        } else {\n          disposables.add(result);\n        }\n      }\n\n      return result;\n    };\n    return this._event;\n  }\n\n  public fire(event: T): void {\n    if (this._disposed || !this._listeners.length) {\n      return;\n    }\n    if (this._listeners.length === 1) {\n      this._listeners[0].fn.call(this._listeners[0].thisArgs, event);\n      return;\n    }\n    const listeners = this._listeners;\n    for (let i = 0, len = listeners.length; i < len; ++i) {\n      listeners[i].fn.call(listeners[i].thisArgs, event);\n    }\n  }\n\n  public dispose(): void {\n    if (this._disposed) {\n      return;\n    }\n    this._disposed = true;\n    this._listeners.length = 0;\n  }\n}\n\nexport namespace EventUtils {\n  export function forward<T>(from: IEvent<T>, to: Emitter<T>): IDisposable {\n    return from(e => to.fire(e));\n  }\n\n  export function map<I, O>(event: IEvent<I>, map: (i: I) => O): IEvent<O> {\n    return (listener: (e: O) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore) => {\n      return event(i => listener.call(thisArgs, map(i)), undefined, disposables);\n    };\n  }\n\n  export function any<T>(...events: IEvent<T>[]): IEvent<T>;\n  export function any(...events: IEvent<any>[]): IEvent<void>;\n  export function any<T>(...events: IEvent<T>[]): IEvent<T> {\n    return (listener: (e: T) => any, thisArgs?: any, disposables?: IDisposable[] | DisposableStore) => {\n      const store = new DisposableStore();\n      for (const event of events) {\n        store.add(event(e => listener.call(thisArgs, e)));\n      }\n      if (disposables) {\n        if (Array.isArray(disposables)) {\n          disposables.push(store);\n        } else {\n          disposables.add(store);\n        }\n      }\n      return store;\n    };\n  }\n\n  export function runAndSubscribe<T>(event: IEvent<T>, handler: (e: T) => void, initial: T): IDisposable;\n  export function runAndSubscribe<T>(event: IEvent<T>, handler: (e: T | undefined) => void): IDisposable;\n  export function runAndSubscribe<T>(event: IEvent<T>, handler: (e: T | undefined) => void, initial?: T): IDisposable {\n    handler(initial);\n    return event(e => handler(e));\n  }\n}\n", "/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { toRGBA8888 } from 'sixel/lib/Colors';\nimport { IDisposable } from '@xterm/xterm';\nimport { ICellSize, ImageLayer, ITerminalExt, IImageSpec, IRenderDimensions, IRenderService } from './Types';\nimport { Disposable, MutableDisposable, toDisposable } from 'common/Lifecycle';\n\nconst enum Constants {\n  PLACEHOLDER_LENGTH = 4096,\n  PLACEHOLDER_HEIGHT = 24\n}\n\n/**\n * ImageRenderer - terminal frontend extension:\n * - provide primitives for canvas, ImageData, Bitmap (static)\n * - add canvas layer to DOM (browser only for now)\n * - draw image tiles onRender\n */\nexport class ImageRenderer extends Disposable implements IDisposable {\n  /** @deprecated Kept for backward compat \u2014 points to top layer canvas. */\n  public get canvas(): HTMLCanvasElement | undefined { return this._layers.get('top')?.canvas; }\n  private _layers = new Map<ImageLayer, CanvasRenderingContext2D>();\n  private _placeholder: HTMLCanvasElement | undefined;\n  private _placeholderBitmap: ImageBitmap | undefined;\n  private _optionsRefresh = this._register(new MutableDisposable());\n  private _oldOpen: ((parent: HTMLElement) => void) | undefined;\n  private _renderService: IRenderService | undefined;\n  private _oldSetRenderer: ((renderer: any) => void) | undefined;\n\n  // drawing primitive - canvas\n  public static createCanvas(localDocument: Document | undefined, width: number, height: number): HTMLCanvasElement {\n    /**\n     * NOTE: We normally dont care, from which document the canvas\n     * gets created, so we can fall back to global document,\n     * if the terminal has no document associated yet.\n     * This way early image loads before calling .open keep working\n     * (still discouraged though, as the metrics will be screwed up).\n     * Only the DOM output canvas should be on the terminal's document,\n     * which gets explicitly checked in `insertLayerToDom`.\n     */\n    const canvas = (localDocument ?? document).createElement('canvas');\n    canvas.width = width | 0;\n    canvas.height = height | 0;\n    return canvas;\n  }\n\n  // drawing primitive - ImageData with optional buffer\n  public static createImageData(ctx: CanvasRenderingContext2D, width: number, height: number, buffer?: ArrayBuffer): ImageData {\n    if (typeof ImageData !== 'function') {\n      const imgData = ctx.createImageData(width, height);\n      if (buffer) {\n        imgData.data.set(new Uint8ClampedArray(buffer, 0, width * height * 4));\n      }\n      return imgData;\n    }\n    return buffer\n      ? new ImageData(new Uint8ClampedArray(buffer, 0, width * height * 4), width, height)\n      : new ImageData(width, height);\n  }\n\n  // drawing primitive - ImageBitmap\n  public static createImageBitmap(img: ImageBitmapSource): Promise<ImageBitmap | undefined> {\n    if (typeof createImageBitmap !== 'function') {\n      return Promise.resolve(undefined);\n    }\n    return createImageBitmap(img);\n  }\n\n\n  constructor(private _terminal: ITerminalExt) {\n    super();\n    this._oldOpen = this._terminal._core.open;\n    this._terminal._core.open = (parent: HTMLElement): void => {\n      this._oldOpen?.call(this._terminal._core, parent);\n      this._open();\n    };\n    if (this._terminal._core.screenElement) {\n      this._open();\n    }\n    // hack to spot fontSize changes\n    this._optionsRefresh.value = this._terminal._core.optionsService.onOptionChange(option => {\n      if (option === 'fontSize') {\n        this.rescaleCanvas();\n        this._renderService?.refreshRows(0, this._terminal.rows);\n      }\n    });\n    this._register(toDisposable(() => {\n      this.removeLayerFromDom();\n      this.removeLayerFromDom('bottom');\n      if (this._terminal._core && this._oldOpen) {\n        this._terminal._core.open = this._oldOpen;\n        this._oldOpen = undefined;\n      }\n      if (this._renderService && this._oldSetRenderer) {\n        this._renderService.setRenderer = this._oldSetRenderer;\n        this._oldSetRenderer = undefined;\n      }\n      this._renderService = undefined;\n      this._layers.clear();\n      this._placeholderBitmap?.close();\n      this._placeholderBitmap = undefined;\n      this._placeholder = undefined;\n    }));\n  }\n\n  /**\n   * Enable the placeholder.\n   */\n  public showPlaceholder(value: boolean): void {\n    if (value) {\n      if (!this._placeholder && this.cellSize.height !== -1) {\n        this._createPlaceHolder(Math.max(this.cellSize.height + 1, Constants.PLACEHOLDER_HEIGHT));\n      }\n    } else {\n      this._placeholderBitmap?.close();\n      this._placeholderBitmap = undefined;\n      this._placeholder = undefined;\n    }\n    this._renderService?.refreshRows(0, this._terminal.rows);\n  }\n\n  /**\n   * Dimensions of the terminal.\n   * Forwarded from internal render service.\n   */\n  public get dimensions(): IRenderDimensions | undefined {\n    return this._terminal.dimensions;\n  }\n\n  /**\n   * Current cell size (float).\n   */\n  public get cellSize(): ICellSize {\n    return {\n      width: this.dimensions?.css.cell.width || -1,\n      height: this.dimensions?.css.cell.height || -1\n    };\n  }\n\n  /**\n   * Clear a region of the image layer canvas.\n   */\n  public clearLines(start: number, end: number, layer?: ImageLayer): void {\n    const y = start * (this.dimensions?.css.cell.height || 0);\n    const w = this.dimensions?.css.canvas.width || 0;\n    const h = (end + 1 - start) * (this.dimensions?.css.cell.height || 0);\n    if (!layer || layer === 'top') {\n      this._layers.get('top')?.clearRect(0, y, w, h);\n    }\n    if (!layer || layer === 'bottom') {\n      this._layers.get('bottom')?.clearRect(0, y, w, h);\n    }\n  }\n\n  /**\n   * Clear whole image canvas.\n   */\n  public clearAll(layer?: ImageLayer): void {\n    if (!layer || layer === 'top') {\n      const ctx = this._layers.get('top');\n      ctx?.clearRect(0, 0, ctx.canvas.width, ctx.canvas.height);\n    }\n    if (!layer || layer === 'bottom') {\n      const ctx = this._layers.get('bottom');\n      ctx?.clearRect(0, 0, ctx.canvas.width, ctx.canvas.height);\n    }\n  }\n\n  /**\n   * Draw neighboring tiles on the image layer canvas.\n   */\n  public draw(imgSpec: IImageSpec, tileId: number, col: number, row: number, count: number = 1): void {\n    const ctx = this._layers.get(imgSpec.layer);\n    if (!ctx) {\n      return;\n    }\n    const { width, height } = this.cellSize;\n\n    // Don't try to draw anything, if we cannot get valid renderer metrics.\n    if (width === -1 || height === -1) {\n      return;\n    }\n\n    this._rescaleImage(imgSpec, width, height);\n    const img = imgSpec.actual!;\n    const { width: sourceWidth, height: sourceHeight } = imgSpec.actualCellSize;\n    const cols = Math.ceil(img.width / sourceWidth);\n\n    const sx = (tileId % cols) * sourceWidth;\n    const sy = Math.floor(tileId / cols) * sourceHeight;\n    const dx = col * width;\n    const dy = row * height;\n\n    // safari bug: never access image source out of bounds\n    const finalWidth = count * sourceWidth + sx > img.width ? img.width - sx : count * sourceWidth;\n    const finalHeight = sy + sourceHeight > img.height ? img.height - sy : sourceHeight;\n\n    // Floor all pixel offsets to get stable tile mapping without any overflows.\n    // Note: For not pixel perfect aligned cells like in the DOM renderer\n    // this will move a tile slightly to the top/left (subpixel range, thus ignore it).\n    // FIX #34: avoid striping on displays with pixelDeviceRatio != 1 by ceiling height and width\n    ctx.drawImage(\n      img,\n      Math.floor(sx), Math.floor(sy), Math.ceil(finalWidth), Math.ceil(finalHeight),\n      Math.floor(dx), Math.floor(dy), Math.ceil(finalWidth * width / sourceWidth), Math.ceil(finalHeight * height / sourceHeight)\n    );\n  }\n\n  /**\n   * Extract a single tile from an image.\n   */\n  public extractTile(imgSpec: IImageSpec, tileId: number): HTMLCanvasElement | undefined {\n    const { width, height } = this.cellSize;\n    // Don't try to draw anything, if we cannot get valid renderer metrics.\n    if (width === -1 || height === -1) {\n      return;\n    }\n    this._rescaleImage(imgSpec, width, height);\n    const img = imgSpec.actual!;\n    const { width: sourceWidth, height: sourceHeight } = imgSpec.actualCellSize;\n    const cols = Math.ceil(img.width / sourceWidth);\n    const sx = (tileId % cols) * sourceWidth;\n    const sy = Math.floor(tileId / cols) * sourceHeight;\n    const finalWidth = sourceWidth + sx > img.width ? img.width - sx : sourceWidth;\n    const finalHeight = sy + sourceHeight > img.height ? img.height - sy : sourceHeight;\n\n    const canvas = ImageRenderer.createCanvas(this.document, Math.ceil(finalWidth * width / sourceWidth), Math.ceil(finalHeight * height / sourceHeight));\n    const ctx = canvas.getContext('2d');\n    if (ctx) {\n      ctx.drawImage(\n        img,\n        Math.floor(sx), Math.floor(sy), Math.floor(finalWidth), Math.floor(finalHeight),\n        0, 0, canvas.width, canvas.height\n      );\n      return canvas;\n    }\n  }\n\n  /**\n   * Draw a line with placeholder on the image layer canvas.\n   */\n  public drawPlaceholder(col: number, row: number, count: number = 1): void {\n    const ctx = this._layers.get('top');\n    if (ctx) {\n      const { width, height } = this.cellSize;\n\n      // Don't try to draw anything, if we cannot get valid renderer metrics.\n      if (width === -1 || height === -1) {\n        return;\n      }\n\n      if (!this._placeholder) {\n        this._createPlaceHolder(Math.max(height + 1, Constants.PLACEHOLDER_HEIGHT));\n      } else if (height >= this._placeholder!.height) {\n        this._createPlaceHolder(height + 1);\n      }\n      if (!this._placeholder) return;\n      ctx.drawImage(\n        this._placeholderBitmap ?? this._placeholder!,\n        col * width,\n        (row * height) % 2 ? 0 : 1,  // needs %2 offset correction\n        width * count,\n        height,\n        col * width,\n        row * height,\n        width * count,\n        height\n      );\n    }\n  }\n\n  /**\n   * Rescale image layer canvas if needed.\n   * Checked once from `ImageStorage.render`.\n   */\n  public rescaleCanvas(): void {\n    const w = this.dimensions?.css.canvas.width || 0;\n    const h = this.dimensions?.css.canvas.height || 0;\n    for (const ctx of this._layers.values()) {\n      if (ctx.canvas.width !== w || ctx.canvas.height !== h) {\n        ctx.canvas.width = w;\n        ctx.canvas.height = h;\n      }\n    }\n  }\n\n  /**\n   * Rescale image in storage if needed.\n   */\n  private _rescaleImage(spec: IImageSpec, currentWidth: number, currentHeight: number): void {\n    if (currentWidth === spec.actualCellSize.width && currentHeight === spec.actualCellSize.height) {\n      return;\n    }\n    const { width: originalWidth, height: originalHeight } = spec.origCellSize;\n    if (currentWidth === originalWidth && currentHeight === originalHeight) {\n      spec.actual = spec.orig;\n      spec.actualCellSize.width = originalWidth;\n      spec.actualCellSize.height = originalHeight;\n      return;\n    }\n    const scaledWidth = Math.ceil(spec.orig!.width * currentWidth / originalWidth);\n    const scaledHeight = Math.ceil(spec.orig!.height * currentHeight / originalHeight);\n    // Upscale visible tiles directly; a full zoomed copy can dwarf the image budget.\n    if (scaledWidth * scaledHeight > spec.orig!.width * spec.orig!.height) {\n      spec.actual = spec.orig;\n      spec.actualCellSize.width = originalWidth;\n      spec.actualCellSize.height = originalHeight;\n      return;\n    }\n    const canvas = ImageRenderer.createCanvas(this.document, scaledWidth, scaledHeight);\n    const ctx = canvas.getContext('2d');\n    if (ctx) {\n      ctx.drawImage(spec.orig!, 0, 0, canvas.width, canvas.height);\n      spec.actual = canvas;\n      spec.actualCellSize.width = currentWidth;\n      spec.actualCellSize.height = currentHeight;\n    }\n  }\n\n  /**\n   * Lazy init for the renderer.\n   */\n  private _open(): void {\n    this._renderService = this._terminal._core._renderService;\n    this._oldSetRenderer = this._renderService.setRenderer.bind(this._renderService);\n    this._renderService.setRenderer = (renderer: any) => {\n      for (const key of [...this._layers.keys()]) {\n        this.removeLayerFromDom(key);\n      }\n      this._oldSetRenderer?.call(this._renderService, renderer);\n    };\n  }\n\n  public insertLayerToDom(layer: ImageLayer = 'top'): void {\n    // make sure that the terminal is attached to a document and to DOM\n    if (!this.document || !this._terminal._core.screenElement) {\n      console.warn('image addon: cannot insert output canvas to DOM, missing document or screenElement');\n      return;\n    }\n    if (this._layers.has(layer)) {\n      return;\n    }\n    const canvas = ImageRenderer.createCanvas(\n      this.document, this.dimensions?.css.canvas.width || 0,\n      this.dimensions?.css.canvas.height || 0\n    );\n    canvas.classList.add(`xterm-image-layer-${layer}`);\n    const screenElement = this._terminal._core.screenElement;\n    // Use isolation to create a stacking context without overriding z-index,\n    // which would conflict with integrators (e.g. VS Code) that set their\n    // own z-index on the screen element.\n    screenElement.style.isolation = 'isolate';\n    if (layer === 'bottom') {\n      // Use z-index:-1 so it paints behind non-positioned text elements.\n      // The screen element needs to be a stacking context (via isolation)\n      // to contain the negative z-index, otherwise it would go behind the\n      // entire terminal.\n      canvas.style.zIndex = '-1';\n      screenElement.insertBefore(canvas, screenElement.firstChild);\n    } else {\n      // Explicit z-index ensures the image canvas reliably stacks above\n      // the text layer (DOM renderer rows). z-index: 0 is below the\n      // selection overlay (z-index: 1).\n      canvas.style.zIndex = '0';\n      screenElement.appendChild(canvas);\n    }\n    const ctx = canvas.getContext('2d', { alpha: true });\n    if (!ctx) {\n      canvas.remove();\n      return;\n    }\n    this._layers.set(layer, ctx);\n    this.clearAll(layer);\n  }\n\n  public removeLayerFromDom(layer: ImageLayer = 'top'): void {\n    const ctx = this._layers.get(layer);\n    if (ctx) {\n      ctx.canvas.remove();\n      this._layers.delete(layer);\n    }\n  }\n\n  public hasLayer(layer: ImageLayer): boolean {\n    return this._layers.has(layer);\n  }\n\n  private _createPlaceHolder(height: number = Constants.PLACEHOLDER_HEIGHT): void {\n    this._placeholderBitmap?.close();\n    this._placeholderBitmap = undefined;\n\n    // create blueprint to fill placeholder with\n    const bWidth = 32;  // must be 2^n\n    const blueprint = ImageRenderer.createCanvas(this.document, bWidth, height);\n    const ctx = blueprint.getContext('2d', { alpha: false });\n    if (!ctx) return;\n    const imgData = ImageRenderer.createImageData(ctx, bWidth, height);\n    const d32 = new Uint32Array(imgData.data.buffer);\n    const black = toRGBA8888(0, 0, 0);\n    const white = toRGBA8888(255, 255, 255);\n    d32.fill(black);\n    for (let y = 0; y < height; ++y) {\n      const shift = y % 2;\n      const offset = y * bWidth;\n      for (let x = 0; x < bWidth; x += 2) {\n        d32[offset + x + shift] = white;\n      }\n    }\n    ctx.putImageData(imgData, 0, 0);\n\n    // create placeholder line, width aligned to blueprint width\n    const width = (screen.width + bWidth - 1) & ~(bWidth - 1) || Constants.PLACEHOLDER_LENGTH;\n    this._placeholder = ImageRenderer.createCanvas(this.document, width, height);\n    const ctx2 = this._placeholder.getContext('2d', { alpha: false });\n    if (!ctx2) {\n      this._placeholder = undefined;\n      return;\n    }\n    for (let i = 0; i < width; i += bWidth) {\n      ctx2.drawImage(blueprint, i, 0);\n    }\n    const placeholder = this._placeholder;\n    ImageRenderer.createImageBitmap(placeholder).then(bitmap => {\n      if (this._placeholder !== placeholder) bitmap?.close();\n      else this._placeholderBitmap = bitmap;\n    }).catch(() => {});\n  }\n\n  public get document(): Document | undefined {\n    return this._terminal._core._coreBrowserService?.window.document;\n  }\n}\n", "/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IDisposable } from '@xterm/xterm';\nimport { ImageRenderer } from './ImageRenderer';\nimport {\n  ITerminalExt, IExtendedAttrsImage, IImageAddonOptions, IImageSpec,\n  IBufferLineExt, BgFlags, Cell, Content, ICellSize, ExtFlags, Attributes,\n  UnderlineStyle, IAddImageOpts\n} from './Types';\n\n\n// fallback default cell size\nexport const CELL_SIZE_DEFAULT: ICellSize = {\n  width: 7,\n  height: 14\n};\n\n/**\n * Extend extended attribute to also hold image tile information.\n *\n * Object definition is copied from base repo to fully mimick its behavior.\n * Image data is added as additional public properties `imageId` and `tileId`.\n */\nclass ExtendedAttrsImage implements IExtendedAttrsImage {\n  private _ext: number = 0;\n  public get ext(): number {\n    if (this._urlId) {\n      return (\n        (this._ext & ~ExtFlags.UNDERLINE_STYLE) |\n        (this.underlineStyle << 26)\n      );\n    }\n    return this._ext;\n  }\n  public set ext(value: number) { this._ext = value; }\n\n  public get underlineStyle(): UnderlineStyle {\n    // Always return the URL style if it has one\n    if (this._urlId) {\n      return UnderlineStyle.DASHED;\n    }\n    return (this._ext & ExtFlags.UNDERLINE_STYLE) >> 26;\n  }\n  public set underlineStyle(value: UnderlineStyle) {\n    this._ext &= ~ExtFlags.UNDERLINE_STYLE;\n    this._ext |= (value << 26) & ExtFlags.UNDERLINE_STYLE;\n  }\n\n  public get underlineColor(): number {\n    return this._ext & (Attributes.CM_MASK | Attributes.RGB_MASK);\n  }\n  public set underlineColor(value: number) {\n    this._ext &= ~(Attributes.CM_MASK | Attributes.RGB_MASK);\n    this._ext |= value & (Attributes.CM_MASK | Attributes.RGB_MASK);\n  }\n\n  public get underlineVariantOffset(): number {\n    const val = (this._ext & ExtFlags.VARIANT_OFFSET) >> 29;\n    if (val < 0) {\n      return val ^ 0xFFFFFFF8;\n    }\n    return val;\n  }\n  public set underlineVariantOffset(value: number) {\n    this._ext &= ~ExtFlags.VARIANT_OFFSET;\n    this._ext |= (value << 29) & ExtFlags.VARIANT_OFFSET;\n  }\n\n  private _urlId: number = 0;\n  public get urlId(): number {\n    return this._urlId;\n  }\n  public set urlId(value: number) {\n    this._urlId = value;\n  }\n\n  constructor(\n    ext: number = 0,\n    urlId: number = 0,\n    public imageId = -1,\n    public tileId = -1\n  ) {\n    this._ext = ext;\n    this._urlId = urlId;\n  }\n\n  public clone(): IExtendedAttrsImage {\n    /**\n     * Technically we dont need a clone variant of ExtendedAttrsImage,\n     * as we never clone a cell holding image data.\n     * Note: Clone is only meant to be used by the InputHandler for\n     * sticky attributes, which is never the case for image data.\n     * We still provide a proper clone method to reflect the full ext attr\n     * state in case there are future use cases for clone.\n     */\n    return new ExtendedAttrsImage(this._ext, this._urlId, this.imageId, this.tileId);\n  }\n\n  public isEmpty(): boolean {\n    return this.underlineStyle === UnderlineStyle.NONE && this._urlId === 0 && this.imageId === -1;\n  }\n}\nconst EMPTY_ATTRS = new ExtendedAttrsImage();\n\n\n/**\n * ImageStorage - extension of CoreTerminal:\n * - hold image data\n * - write/read image data to/from buffer\n *\n * TODO: image composition for overwrites\n */\nexport class ImageStorage implements IDisposable {\n  // storage\n  private _images: Map<number, IImageSpec> = new Map();\n  // last used id\n  private _lastId = 0;\n  // last evicted id\n  private _lowestId = 0;\n  // whether a full clear happened before\n  private _fullyCleared = false;\n  // whether render should do a full clear\n  private _needsFullClear = false;\n  // hard limit of stored pixels (fallback limit of 10 MB)\n  private _pixelLimit: number = 2500000;\n\n  private _viewportMetrics: { cols: number, rows: number };\n  public onImageAdded: (() => void) | undefined;\n  public onImageDeleted: ((storageId: number) => void) | undefined;\n\n  constructor(\n    private _terminal: ITerminalExt,\n    private _renderer: ImageRenderer,\n    private _opts: IImageAddonOptions\n  ) {\n    try {\n      this.setLimit(this._opts.storageLimit);\n    } catch (e: unknown) {\n      if (e instanceof Error) {\n        console.error(e.message);\n      }\n      console.warn(`storageLimit is set to ${this.getLimit()} MB`);\n    }\n    this._viewportMetrics = {\n      cols: this._terminal.cols,\n      rows: this._terminal.rows\n    };\n  }\n\n  public dispose(): void {\n    this.reset();\n  }\n\n  public reset(): void {\n    for (const spec of this._images.values()) {\n      spec.marker?.dispose();\n    }\n    // NOTE: marker.dispose above already calls ImageBitmap.close\n    // therefore we can just wipe the map here\n    this._images.clear();\n    this._renderer.clearAll();\n  }\n\n  public getLimit(): number {\n    return this._pixelLimit * 4 / 1000000;\n  }\n\n  public setLimit(value: number): void {\n    if (value < 0.5 || value > 1000) {\n      throw RangeError('invalid storageLimit, should be at least 0.5 MB and not exceed 1G');\n    }\n    this._pixelLimit = (value / 4 * 1000000) >>> 0;\n    this._evictOldest(0);\n  }\n\n  public getUsage(): number {\n    return this._getStoredPixels() * 4 / 1000000;\n  }\n\n  private _getStoredPixels(): number {\n    let storedPixels = 0;\n    for (const spec of this._images.values()) {\n      if (spec.orig) {\n        storedPixels += spec.orig.width * spec.orig.height;\n        if (spec.actual && spec.actual !== spec.orig) {\n          storedPixels += spec.actual.width * spec.actual.height;\n        }\n      }\n    }\n    return storedPixels;\n  }\n\n  private _delImg(id: number): void {\n    const spec = this._images.get(id);\n    if (!spec) return;\n    this._images.delete(id);\n    // FIXME: really ugly workaround to get bitmaps deallocated :(\n    if (window.ImageBitmap && spec.orig instanceof ImageBitmap) {\n      spec.orig.close();\n    }\n    this.onImageDeleted?.(id);\n  }\n\n  /**\n   * Wipe canvas and images on alternate buffer.\n   */\n  public wipeAlternate(): void {\n    // remove all alternate tagged images\n    const zero = [];\n    for (const [id, spec] of this._images.entries()) {\n      if (spec.bufferType === 'alternate') {\n        spec.marker?.dispose();\n        zero.push(id);\n      }\n    }\n    for (const id of zero) {\n      this._delImg(id);\n    }\n    // mark canvas to be wiped on next render\n    this._needsFullClear = true;\n    this._fullyCleared = false;\n  }\n\n  /**\n   * Delete an image by its internal storage ID.\n   * Used by protocols that support explicit deletion (e.g. Kitty a=d).\n   */\n  public deleteImage(id: number): void {\n    const spec = this._images.get(id);\n    if (spec) {\n      spec.marker?.dispose();\n      this._delImg(id);\n    }\n  }\n\n  /**\n   * Method to add an image to the storage.\n   * @param img - The image to add (canvas or bitmap).\n   * @param opts - Options for addImage:\n   *   - scrolling:  When true, cursor advances with the image.\n   *                 When false, image is placed at ORIGIN and cursor does not move.\n   *   - layer:      Which canvas layer to render on ('top' or 'bottom').\n   *   - zIndex:     Z-index for image layering within the same layer.\n   *   - cursorPos:  'vt340' for bottom-left, 'iip' for bottom.right.\n   * @returns The internal image ID assigned to the stored image.\n   */\n  public addImage(img: HTMLCanvasElement | ImageBitmap, opts: IAddImageOpts): number {\n    // never allow storage to exceed memory limit\n    this._evictOldest(img.width * img.height);\n\n    // calc rows x cols needed to display the image\n    let cellSize = this._renderer.cellSize;\n    if (cellSize.width === -1 || cellSize.height === -1) {\n      cellSize = CELL_SIZE_DEFAULT;\n    }\n    const cols = Math.ceil(img.width / cellSize.width);\n    const rows = Math.ceil(img.height / cellSize.height);\n\n    const imageId = ++this._lastId;\n\n    const buffer = this._terminal._core.buffer;\n    const termCols = this._terminal.cols;\n    const termRows = this._terminal.rows;\n    const originX = buffer.x;\n    const originY = buffer.y;\n    let offset = originX;\n    let tileCount = 0;\n\n    if (!opts.scrolling) {\n      buffer.x = 0;\n      buffer.y = 0;\n      offset = 0;\n    }\n\n    this._terminal._core._inputHandler._dirtyRowTracker.markDirty(buffer.y);\n    for (let row = 0; row < rows; ++row) {\n      const line = buffer.lines.get(buffer.y + buffer.ybase);\n      for (let col = 0; col < cols; ++col) {\n        if (offset + col >= termCols) break;\n        this._writeToCell(line as IBufferLineExt, offset + col, imageId, row * cols + col);\n        tileCount++;\n      }\n      if (opts.scrolling) {\n        if (row < rows - 1) this._terminal._core._inputHandler.lineFeed();\n      } else {\n        if (++buffer.y >= termRows) break;\n      }\n      buffer.x = offset;\n    }\n    this._terminal._core._inputHandler._dirtyRowTracker.markDirty(buffer.y);\n\n    // cursor positioning modes\n    if (opts.scrolling) {\n      if (opts.cursorPos === 'iip') {\n        buffer.x = Math.min(offset + cols, termCols);\n      } else {\n        buffer.x = offset;\n      }\n    } else {\n      buffer.x = originX;\n      buffer.y = originY;\n    }\n\n    // deleted images with zero tile count\n    const zero = [];\n    for (const [id, spec] of this._images.entries()) {\n      if (spec.tileCount < 1) {\n        spec.marker?.dispose();\n        zero.push(id);\n      }\n    }\n    for (const id of zero) {\n      this._delImg(id);\n    }\n\n    // eviction marker:\n    // delete the image when the marker gets disposed\n    const endMarker = this._terminal.registerMarker(0);\n    endMarker?.onDispose(() => {\n      const spec = this._images.get(imageId);\n      if (spec) {\n        this._delImg(imageId);\n      }\n    });\n\n    // since markers do not work on alternate for some reason,\n    // we evict images here manually\n    if (this._terminal.buffer.active.type === 'alternate') {\n      this._evictOnAlternate();\n    }\n\n    // create storage entry\n    const imgSpec: IImageSpec = {\n      orig: img,\n      origCellSize: cellSize,\n      actual: img,\n      actualCellSize: { ...cellSize },  // clone needed, since later modified\n      marker: endMarker || undefined,\n      tileCount,\n      bufferType: this._terminal.buffer.active.type,\n      layer: opts.layer,\n      zIndex: opts.zIndex\n    };\n\n    // finally add the image\n    this._images.set(imageId, imgSpec);\n    this.onImageAdded?.();\n    return imageId;\n  }\n\n\n  /**\n   * Render method. Collects buffer information and triggers\n   * canvas updates.\n   */\n  // TODO: Should we move this to the ImageRenderer?\n  public render(range: { start: number, end: number }): void {\n    // Determine which layers have images\n    let hasTopImages = false;\n    let hasBottomImages = false;\n    for (const spec of this._images.values()) {\n      if (spec.layer === 'bottom') {\n        hasBottomImages = true;\n      } else {\n        hasTopImages = true;\n      }\n      if (hasTopImages && hasBottomImages) break;\n    }\n\n    // Lazily insert layers that are needed\n    if (hasTopImages && !this._renderer.hasLayer('top')) {\n      this._renderer.insertLayerToDom('top');\n      if (!this._renderer.hasLayer('top')) return;\n    }\n    if (hasBottomImages && !this._renderer.hasLayer('bottom')) {\n      this._renderer.insertLayerToDom('bottom');\n    }\n\n    // rescale if needed\n    this._renderer.rescaleCanvas();\n\n    // exit early if we dont have any images to test for\n    if (!this._images.size) {\n      if (!this._fullyCleared) {\n        this._renderer.clearAll();\n        this._fullyCleared = true;\n        this._needsFullClear = false;\n      }\n      if (this._renderer.hasLayer('top')) {\n        this._renderer.removeLayerFromDom('top');\n      }\n      if (this._renderer.hasLayer('bottom')) {\n        this._renderer.removeLayerFromDom('bottom');\n      }\n      return;\n    }\n\n    // Remove layers no longer needed\n    if (!hasTopImages && this._renderer.hasLayer('top')) {\n      this._renderer.clearAll('top');\n      this._renderer.removeLayerFromDom('top');\n    }\n    if (!hasBottomImages && this._renderer.hasLayer('bottom')) {\n      this._renderer.clearAll('bottom');\n      this._renderer.removeLayerFromDom('bottom');\n    }\n\n    // buffer switches force a full clear\n    if (this._needsFullClear) {\n      this._renderer.clearAll();\n      this._fullyCleared = true;\n      this._needsFullClear = false;\n    }\n\n    const { start, end } = range;\n    const buffer = this._terminal._core.buffer;\n    const cols = this._terminal._core.cols;\n\n    // clear drawing area\n    this._renderer.clearLines(start, end);\n\n    // Collect draw calls so we can sort by z-index (lower z drawn first).\n    const drawCalls: { imgSpec: IImageSpec, tileId: number, col: number, row: number, count: number }[] = [];\n    const placeholderCalls: { col: number, row: number, count: number }[] = [];\n\n    // walk all cells in viewport and collect tiles found\n    for (let row = start; row <= end; ++row) {\n      const line = buffer.lines.get(row + buffer.ydisp) as IBufferLineExt;\n      if (!line) return;\n      for (let col = 0; col < cols; ++col) {\n        if (line.getBg(col) & BgFlags.HAS_EXTENDED) {\n          let e: IExtendedAttrsImage = line._extendedAttrs[col] ?? EMPTY_ATTRS;\n          const imageId = e.imageId;\n          if (imageId === undefined || imageId === -1) {\n            continue;\n          }\n          const imgSpec = this._images.get(imageId);\n          if (e.tileId !== -1) {\n            const startTile = e.tileId;\n            const startCol = col;\n            let count = 1;\n            /**\n             * merge tiles to the right into a single draw call, if:\n             * - not at end of line\n             * - cell has same image id\n             * - cell has consecutive tile id\n             */\n            while (\n              ++col < cols\n              && (line.getBg(col) & BgFlags.HAS_EXTENDED)\n              && (e = line._extendedAttrs[col] ?? EMPTY_ATTRS)\n              && (e.imageId === imageId)\n              && (e.tileId === startTile + count)\n            ) {\n              count++;\n            }\n            col--;\n            if (imgSpec) {\n              if (imgSpec.actual) {\n                drawCalls.push({ imgSpec, tileId: startTile, col: startCol, row, count });\n              }\n            } else if (this._opts.showPlaceholder) {\n              placeholderCalls.push({ col: startCol, row, count });\n            }\n            this._fullyCleared = false;\n          }\n        }\n      }\n    }\n\n    // Sort by z-index so lower z draws first (higher z renders on top)\n    drawCalls.sort((a, b) => a.imgSpec.zIndex - b.imgSpec.zIndex);\n\n    // Draw placeholders first (lowest priority)\n    for (const call of placeholderCalls) {\n      this._renderer.drawPlaceholder(call.col, call.row, call.count);\n    }\n\n    // Draw images in z-index order\n    for (const call of drawCalls) {\n      this._renderer.draw(call.imgSpec, call.tileId, call.col, call.row, call.count);\n    }\n  }\n\n  public viewportResize(metrics: { cols: number, rows: number }): void {\n    // exit early if we have nothing in storage\n    if (!this._images.size) {\n      this._viewportMetrics = metrics;\n      return;\n    }\n\n    // handle only viewport width enlargements, exit all other cases\n    // TODO: needs patch for tile counter\n    if (this._viewportMetrics.cols >= metrics.cols) {\n      this._viewportMetrics = metrics;\n      return;\n    }\n\n    // walk scrollbuffer at old col width to find all possible expansion matches\n    const buffer = this._terminal._core.buffer;\n    const rows = buffer.lines.length;\n    const oldCol = this._viewportMetrics.cols - 1;\n    for (let row = 0; row < rows; ++row) {\n      const line = buffer.lines.get(row) as IBufferLineExt;\n      if (line.getBg(oldCol) & BgFlags.HAS_EXTENDED) {\n        const e: IExtendedAttrsImage = line._extendedAttrs[oldCol] ?? EMPTY_ATTRS;\n        const imageId = e.imageId;\n        if (imageId === undefined || imageId === -1) {\n          continue;\n        }\n        const imgSpec = this._images.get(imageId);\n        if (!imgSpec) {\n          continue;\n        }\n        // found an image tile at oldCol, check if it qualifies for right exapansion\n        const tilesPerRow = Math.ceil((imgSpec.actual?.width || 0) / imgSpec.actualCellSize.width);\n        if ((e.tileId % tilesPerRow) + 1 >= tilesPerRow) {\n          continue;\n        }\n        // expand only if right side is empty (nothing got wrapped from below)\n        let hasData = false;\n        for (let rightCol = oldCol + 1; rightCol > metrics.cols; ++rightCol) {\n          if (line._data[rightCol * Cell.SIZE + Cell.CONTENT] & Content.HAS_CONTENT_MASK) {\n            hasData = true;\n            break;\n          }\n        }\n        if (hasData) {\n          continue;\n        }\n        // do right expansion on terminal buffer\n        const end = Math.min(metrics.cols, tilesPerRow - (e.tileId % tilesPerRow) + oldCol);\n        let lastTile = e.tileId;\n        for (let expandCol = oldCol + 1; expandCol < end; ++expandCol) {\n          this._writeToCell(line as IBufferLineExt, expandCol, imageId, ++lastTile);\n          imgSpec.tileCount++;\n        }\n      }\n    }\n    // store new viewport metrics\n    this._viewportMetrics = metrics;\n  }\n\n  /**\n   * Retrieve original canvas at buffer position.\n   */\n  public getImageAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    const buffer = this._terminal._core.buffer;\n    const line = buffer.lines.get(y) as IBufferLineExt;\n    if (line && line.getBg(x) & BgFlags.HAS_EXTENDED) {\n      const e: IExtendedAttrsImage = line._extendedAttrs[x] ?? EMPTY_ATTRS;\n      if (e.imageId && e.imageId !== -1) {\n        const orig = this._images.get(e.imageId)?.orig;\n        if (window.ImageBitmap && orig instanceof ImageBitmap) {\n          const canvas = ImageRenderer.createCanvas(window.document, orig.width, orig.height);\n          canvas.getContext('2d')?.drawImage(orig, 0, 0, orig.width, orig.height);\n          return canvas;\n        }\n        return orig as HTMLCanvasElement;\n      }\n    }\n  }\n\n  /**\n   * Extract active single tile at buffer position.\n   */\n  public extractTileAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    const buffer = this._terminal._core.buffer;\n    const line = buffer.lines.get(y) as IBufferLineExt;\n    if (line && line.getBg(x) & BgFlags.HAS_EXTENDED) {\n      const e: IExtendedAttrsImage = line._extendedAttrs[x] ?? EMPTY_ATTRS;\n      if (e.imageId && e.imageId !== -1 && e.tileId !== -1) {\n        const spec = this._images.get(e.imageId);\n        if (spec) {\n          return this._renderer.extractTile(spec, e.tileId);\n        }\n      }\n    }\n  }\n\n  // TODO: Do we need some blob offloading tricks here to avoid early eviction?\n  // also see https://stackoverflow.com/questions/28307789/is-there-any-limitation-on-javascript-max-blob-size\n  private _evictOldest(room: number): number {\n    const used = this._getStoredPixels();\n    let current = used;\n    while (this._pixelLimit < current + room && this._images.size) {\n      const spec = this._images.get(++this._lowestId);\n      if (spec && spec.orig) {\n        current -= spec.orig.width * spec.orig.height;\n        if (spec.actual && spec.orig !== spec.actual) {\n          current -= spec.actual.width * spec.actual.height;\n        }\n        spec.marker?.dispose();\n        this._delImg(this._lowestId);\n      }\n    }\n    return used - current;\n  }\n\n  private _writeToCell(line: IBufferLineExt, x: number, imageId: number, tileId: number): void {\n    if (line._data[x * Cell.SIZE + Cell.BG] & BgFlags.HAS_EXTENDED) {\n      const old = line._extendedAttrs[x];\n      if (old) {\n        if (old.imageId !== undefined) {\n          // found an old ExtendedAttrsImage, since we know that\n          // they are always isolated instances (single cell usage),\n          // we can re-use it and just update their id entries\n          const oldSpec = this._images.get(old.imageId);\n          if (oldSpec) {\n            // early eviction for in-viewport overwrites\n            oldSpec.tileCount--;\n          }\n          old.imageId = imageId;\n          old.tileId = tileId;\n          return;\n        }\n        // found a plain ExtendedAttrs instance, clone it to new entry\n        line._extendedAttrs[x] = new ExtendedAttrsImage(old.ext, old.urlId, imageId, tileId);\n        return;\n      }\n    }\n    // fall-through: always create new ExtendedAttrsImage entry\n    line._data[x * Cell.SIZE + Cell.BG] |= BgFlags.HAS_EXTENDED;\n    line._extendedAttrs[x] = new ExtendedAttrsImage(0, 0, imageId, tileId);\n  }\n\n  private _evictOnAlternate(): void {\n    // nullify tile count of all images on alternate buffer\n    for (const spec of this._images.values()) {\n      if (spec.bufferType === 'alternate') {\n        spec.tileCount = 0;\n      }\n    }\n    // re-count tiles on whole buffer\n    const buffer = this._terminal._core.buffer;\n    for (let y = 0; y < this._terminal.rows; ++y) {\n      const line = buffer.lines.get(y) as IBufferLineExt;\n      if (!line) {\n        continue;\n      }\n      for (let x = 0; x < this._terminal.cols; ++x) {\n        if (line._data[x * Cell.SIZE + Cell.BG] & BgFlags.HAS_EXTENDED) {\n          const imgId = line._extendedAttrs[x]?.imageId;\n          if (imgId) {\n            const spec = this._images.get(imgId);\n            if (spec) {\n              spec.tileCount++;\n            }\n          }\n        }\n      }\n    }\n    // deleted images with zero tile count\n    const zero = [];\n    for (const [id, spec] of this._images.entries()) {\n      if (spec.bufferType === 'alternate' && !spec.tileCount) {\n        spec.marker?.dispose();\n        zero.push(id);\n      }\n    }\n    for (const id of zero) {\n      this._delImg(id);\n    }\n  }\n}\n", "/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\nimport { IImageAddonOptions, IOscHandler, IResetHandler, ITerminalExt } from './Types';\nimport { ImageRenderer } from './ImageRenderer';\nimport { IIPImageStorage } from './IIPImageStorage';\nimport { CELL_SIZE_DEFAULT } from './ImageStorage';\nimport Base64Decoder from 'xterm-wasm-parts/lib/base64/Base64Decoder.wasm';\nimport QoiDecoder from 'xterm-wasm-parts/lib/qoi/QoiDecoder.wasm';\nimport { HeaderParser, IHeaderFields, HeaderState, SequenceType } from './IIPHeaderParser';\nimport { imageType, UNSUPPORTED_TYPE } from './IIPMetrics';\n\n// Local const enum mirror - esbuild can't inline const enums from external packages\nconst enum DecoderConst {\n  // Held memory in base64/QOI decoders between images. Zero because each kept\n  // decoder pins a wasm memory, and V8 caps those per process (~124 in a\n  // sandboxed renderer), so idle terminals must not hold one.\n  KEEP_DATA = 0,\n  // Initial buffer allocation for the decoder.\n  INITIAL_DATA = 1048576,\n  // Local mirror of const enum (esbuild can't inline const enums from external packages)\n  OK = 0\n}\n\n// default IIP header values\nconst DEFAULT_HEADER: IHeaderFields = {\n  type: SequenceType.INVALID,\n  name: 'Unnamed file',\n  size: 0,\n  width: 'auto',\n  height: 'auto',\n  preserveAspectRatio: 1,\n  inline: 0\n};\n\n\nexport class IIPHandler implements IOscHandler, IResetHandler {\n  private _generation = 0;\n  private _aborted = false;\n  private _hp = new HeaderParser();\n  private _header: IHeaderFields = DEFAULT_HEADER;\n  private _dec: Base64Decoder;\n  private _qoiDec: QoiDecoder;\n  private _isMultipart = false;\n  private _abortMulti = false;\n\n  constructor(\n    private readonly _opts: IImageAddonOptions,\n    private readonly _renderer: ImageRenderer,\n    private readonly _storage: IIPImageStorage,\n    private readonly _coreTerminal: ITerminalExt\n  ) {\n    const maxEncodedBytes = Math.ceil(this._opts.iipSizeLimit * 4 / 3);\n    const initialBytes = Math.min(DecoderConst.INITIAL_DATA, maxEncodedBytes);\n    this._dec = new Base64Decoder(DecoderConst.KEEP_DATA, maxEncodedBytes, initialBytes);\n    this._qoiDec = new QoiDecoder(DecoderConst.KEEP_DATA);\n  }\n\n  public reset(): void {\n    this._generation++;\n    this._hp.reset();\n    this._dec.release();\n    this._qoiDec.release();\n  }\n\n  public start(): void {\n    this._aborted = false;\n    this._hp.reset();\n  }\n\n  public put(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted) return;\n\n    if (this._hp.state === HeaderState.END) {\n      if ((this._dec.put(data.subarray(start, end)) as number) !== DecoderConst.OK) {\n        this._dec.release();\n        this._aborted = true;\n      }\n    } else {\n      const dataPos = this._hp.parse(data, start, end);\n      if (dataPos === -1) {\n        this._aborted = true;\n        return;\n      }\n      if (dataPos > 0) {\n        const seqType = this._hp.fields.type;\n        if (seqType === SequenceType.FILE) {\n          if (this._isMultipart) {\n            this._isMultipart = false;\n            this._abortMulti = false;\n            this._dec.release();\n          }\n          this._header = Object.assign({}, DEFAULT_HEADER, this._hp.fields);\n          if (!this._header.inline) {\n            this._aborted = true;\n            return;\n          }\n          if (!this._initDecoder()) {\n            this._aborted = true;\n            return;\n          }\n        } else if (this._abortMulti) {\n          this._aborted = true;\n          return;\n        }\n        if ((this._dec.put(data.subarray(dataPos, end)) as number) !== DecoderConst.OK) {\n          this._dec.release();\n          this._aborted = true;\n          if (this._isMultipart) this._abortMulti = true;\n        }\n      }\n    }\n  }\n\n  public end(success: boolean): boolean | Promise<boolean> {\n    if (this._aborted) return true;\n\n    if (this._hp.state !== HeaderState.END) {\n      if (this._hp.end()) return true;\n    }\n    const seqType = this._hp.fields.type;\n\n    if (seqType === SequenceType.FILEPART) return true;\n\n    if (seqType === SequenceType.REPORTCELLSIZE) {\n      // OSC 1337 ; ReportCellSize=[height];[width];[scale] ST\n      let w = CELL_SIZE_DEFAULT.width;\n      let h = CELL_SIZE_DEFAULT.height;\n      if (this._renderer.dimensions) {\n        w = this._renderer.dimensions.css.canvas.width / this._coreTerminal.cols;\n        h = this._renderer.dimensions.css.canvas.height / this._coreTerminal.rows;\n      }\n      const scale = this._coreTerminal._core._coreBrowserService?.dpr ?? 1;\n      const report = `\\x1b]1337;ReportCellSize=${h.toFixed(3)};${w.toFixed(3)};${scale.toFixed(3)}\\x1b\\\\`;\n      this._coreTerminal.input(report, false);\n      return true;\n    }\n\n    if (seqType === SequenceType.MULTIPARTFILE) {\n      this._header = Object.assign({}, DEFAULT_HEADER, this._hp.fields);\n      this._isMultipart = true;\n      this._abortMulti = false;\n      this._dec.release();\n      if (!this._initDecoder()) {\n        this._abortMulti = true;\n      }\n      return true;\n    }\n\n    if (seqType === SequenceType.FILEEND) {\n      if (!this._isMultipart) return true;\n      this._isMultipart = false;\n      if (this._abortMulti || this._header.type !== SequenceType.MULTIPARTFILE) return true;\n    }\n\n    // fallthrough for SequenceType.FILE & SequenceType.FILEEND\n\n    let w = 0;\n    let h = 0;\n\n    // early exit condition chain\n    let cond: number | boolean;\n    let metrics = UNSUPPORTED_TYPE;\n    if (cond = success) {\n      if (cond = !this._dec.end()) {\n        metrics = imageType(this._dec.data8);\n        if (cond = metrics.mime !== 'unsupported') {\n          w = metrics.width;\n          h = metrics.height;\n          if (cond = w && h && w * h < this._opts.pixelLimit) {\n            [w, h] = this._resize(w, h).map(Math.floor);\n            cond = w && h && w * h < this._opts.pixelLimit;\n          } else {\n            console.warn(`IIP: image dimension issue ${metrics.width}x${metrics.height}`);\n          }\n        } else {\n          console.warn('IIP: unsupported image type');\n        }\n      } else {\n        console.warn('IIP: error during BASE64 decoding');\n      }\n    }\n    if (!cond) {\n      this._dec.release();\n      return true;\n    }\n\n    let blob: Blob | ImageData;\n    if (metrics.mime === 'image/qoi') {\n      let data: Uint8Array<ArrayBuffer>;\n      try {\n        data = this._qoiDec.decode(this._dec.data8);\n      } catch (e) {\n        console.warn('IIP: could not decode QOI image', e);\n        this._dec.release();\n        this._qoiDec.release();\n        return true;\n      }\n      blob = new ImageData(\n        new Uint8ClampedArray(data.buffer, data.byteOffset, data.byteLength),\n        this._qoiDec.width,\n        this._qoiDec.height\n      );\n      this._qoiDec.release();\n      if (w === this._qoiDec.width && h === this._qoiDec.height) {\n        // use fast-path if we don't need to rescale\n        this._dec.release();\n        const canvas = ImageRenderer.createCanvas(undefined, this._qoiDec.width, this._qoiDec.height);\n        canvas.getContext('2d')?.putImageData(blob, 0, 0);\n        this._storage.addImage(canvas);\n        return true;\n      }\n    } else {\n      blob = new Blob([this._dec.data8], { type: metrics.mime });\n    }\n    this._dec.release();\n    const generation = this._generation;\n    return createImageBitmap(blob, { resizeWidth: w, resizeHeight: h })\n      .then(bm => {\n        if (generation !== this._generation) {\n          bm.close();\n          return true;\n        }\n        this._storage.addImage(bm);\n        return true;\n      })\n      .catch(e => {\n        console.warn(`IIP: decoding error ${metrics.mime} ${metrics.width}x${metrics.height}`, e);\n        return true;\n      });\n  }\n\n  // Why: wasm memory exhaustion must drop this image, not throw out of the parser and wedge the write queue.\n  private _initDecoder(): boolean {\n    try {\n      this._dec.init();\n      return true;\n    } catch (e) {\n      console.warn('IIP: could not allocate decoder', e);\n      this._dec.release();\n      return false;\n    }\n  }\n\n  private _resize(w: number, h: number): [number, number] {\n    const cw = this._renderer.dimensions?.css.cell.width || CELL_SIZE_DEFAULT.width;\n    const ch = this._renderer.dimensions?.css.cell.height || CELL_SIZE_DEFAULT.height;\n    const width = this._renderer.dimensions?.css.canvas.width || cw * this._coreTerminal.cols;\n    const height = this._renderer.dimensions?.css.canvas.height || ch * this._coreTerminal.rows;\n\n    const rw = this._dim(this._header.width!, width, cw);\n    const rh = this._dim(this._header.height!, height, ch);\n    if (!rw && !rh) {\n      const wf = width / w;         // TODO: should this respect initial cursor offset?\n      const hf = (height - ch) / h; // TODO: fix offset issues from float cell height\n      const f = Math.min(wf, hf);\n      return f < 1 ? [w * f, h * f] : [w, h];\n    }\n    return !rw\n      ? [w * rh / h, rh]\n      : this._header.preserveAspectRatio || !rw || !rh\n        ? [rw, h * rw / w] : [rw, rh];\n  }\n\n  private _dim(s: string, total: number, cdim: number): number {\n    if (s === 'auto') return 0;\n    if (s.endsWith('%')) return parseInt(s.slice(0, -1), 10) * total / 100;\n    if (s.endsWith('px')) return parseInt(s.slice(0, -2), 10);\n    return parseInt(s, 10) * cdim;\n  }\n}\n", "/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\n// eslint-disable-next-line\ndeclare const Buffer: any;\n\nexport const enum HeaderState {\n  START = 0,\n  ABORT = 1,\n  KEY = 2,\n  VALUE = 3,\n  END = 4\n}\n\nexport const enum SequenceType {\n  INVALID = 0,\n  FILE = 1,\n  MULTIPARTFILE = 2,\n  FILEPART = 3,\n  FILEEND = 4,\n  REPORTCELLSIZE = 5\n}\n\nexport interface IHeaderFields {\n  [key: string]: number | string | Uint32Array | null | undefined;\n  // sequence type\n  type: SequenceType;\n  // base-64 encoded filename. Defaults to \"Unnamed file\".\n  name: string;\n  // File size in bytes. The file transfer will be canceled if this size is exceeded.\n  size: number;\n  /**\n   * Optional width and height to render:\n   * - N: N character cells.\n   * - Npx: N pixels.\n   * - N%: N percent of the session's width or height.\n   * - auto: The image's inherent size will be used to determine an appropriate dimension.\n   */\n  width?: string;\n  height?: string;\n  // Optional, defaults to 1 respecting aspect ratio (width takes precedence).\n  preserveAspectRatio?: number;\n  // Optional, defaults to 0. If set to 1, the file will be displayed inline, else downloaded\n  // (download not supported).\n  inline?: number;\n}\n\n// field value decoders\n\n// ASCII bytes to string\nfunction toStr(data: Uint32Array): string {\n  let s = '';\n  for (let i = 0; i < data.length; ++i) {\n    s += String.fromCharCode(data[i]);\n  }\n  return s;\n}\n\n// digits to integer\nfunction toInt(data: Uint32Array): number {\n  let v = 0;\n  for (let i = 0; i < data.length; ++i) {\n    if (data[i] < 48 || data[i] > 57) {\n      throw new Error('illegal char');\n    }\n    v = v * 10 + data[i] - 48;\n  }\n  return v;\n}\n\n// check for correct size entry\nfunction toSize(data: Uint32Array): string {\n  const v = toStr(data);\n  if (!v.match(/^((auto)|(\\d+?((px)|(%)){0,1}))$/)) {\n    throw new Error('illegal size');\n  }\n  return v;\n}\n\n// name is base64 encoded utf-8\nfunction toName(data: Uint32Array): string {\n  if (typeof Buffer !== 'undefined') {\n    return Buffer.from(toStr(data), 'base64').toString();\n  }\n  const bs = atob(toStr(data));\n  const b = new Uint8Array(bs.length);\n  for (let i = 0; i < b.length; ++i) {\n    b[i] = bs.charCodeAt(i);\n  }\n  return new TextDecoder().decode(b);\n}\n\nconst DECODERS: {[key: string]: (v: Uint32Array) => number | string} = {\n  inline: toInt,\n  size: toInt,\n  name: toName,\n  width: toSize,\n  height: toSize,\n  preserveAspectRatio: toInt\n};\n\n\n// sequence type markers\n// File\nconst FILE_MARKER = [70, 105, 108, 101];\n// MultipartFile\nconst MULTIPARTFILE_MARKER = [77, 117, 108, 116, 105, 112, 97, 114, 116, 70, 105, 108, 101];\n// FilePart\nconst FILEPART_MARKER = [70, 105, 108, 101, 80, 97, 114, 116];\n// FileEnd\nconst FILEEND_MARKER = [70, 105, 108, 101, 69, 110, 100];\n// ReportCellSize\nconst REPORTCELLSIZE_MARKER = [82, 101, 112, 111, 114, 116, 67, 101, 108, 108, 83, 105, 122, 101];\n\n// max allowed chars for sequence header\nconst MAX_FIELDCHARS = 1024;\n\n\nexport class HeaderParser {\n  public state: HeaderState = HeaderState.START;\n  private _buffer = new Uint32Array(MAX_FIELDCHARS);\n  private _position = 0;\n  private _key = '';\n  public fields: {[key: string]: number | string | Uint32Array | null | undefined} = {};\n\n  public reset(): void {\n    this._buffer.fill(0);\n    this.state = HeaderState.START;\n    this._position = 0;\n    this.fields = {};\n    this._key = '';\n  }\n\n  public end(): number {\n    if (this.state === HeaderState.START) {\n      if (this._position === FILEEND_MARKER.length) {\n        for (let k = 0; k < FILEEND_MARKER.length; ++k) {\n          if (this._buffer[k] !== FILEEND_MARKER[k]) return this._a();\n        }\n        this.fields['type'] = SequenceType.FILEEND;\n        this.state = HeaderState.END;\n        return 0;\n      }\n      if (this._position === REPORTCELLSIZE_MARKER.length) {\n        for (let k = 0; k < REPORTCELLSIZE_MARKER.length; ++k) {\n          if (this._buffer[k] !== REPORTCELLSIZE_MARKER[k]) return this._a();\n        }\n        this.fields['type'] = SequenceType.REPORTCELLSIZE;\n        this.state = HeaderState.END;\n        return 0;\n      }\n      return this._a();\n    }\n    if (this.state === HeaderState.END) return 0;\n    if (this.state === HeaderState.VALUE\n      && this.fields.type === SequenceType.MULTIPARTFILE\n    ) {\n      if (!this._storeValue(this._position)) return this._a();\n      this.state = HeaderState.END;\n      return 0;\n    }\n    return this._a();\n  }\n\n  public parse(data: Uint32Array, start: number, end: number): number {\n    let state = this.state;\n    let pos = this._position;\n    const buffer = this._buffer;\n    if (state === HeaderState.ABORT || state === HeaderState.END) return -1;\n    if (state === HeaderState.START && pos > 14) return -1;\n    for (let i = start; i < end; ++i) {\n      const c = data[i];\n      switch (c) {\n        case 59: // ;\n          if (!this._storeValue(pos)) return this._a();\n          state = HeaderState.KEY;\n          pos = 0;\n          break;\n        case 61: // =\n          if (state === HeaderState.START) {\n            if (buffer[0] === 70) {\n              // 'File' or 'FilePart'\n              let k = 0;\n              for (; k < FILE_MARKER.length; ++k) {\n                if (buffer[k] !== FILE_MARKER[k]) return this._a();\n              }\n              this.fields['type'] = SequenceType.FILE;\n              if (pos === FILEPART_MARKER.length) {\n                for (; k < FILEPART_MARKER.length; ++k) {\n                  if (buffer[k] !== FILEPART_MARKER[k]) return this._a();\n                }\n                this.fields['type'] = SequenceType.FILEPART;\n                this.state = HeaderState.END;\n                return i + 1;\n              }\n            } else if (buffer[0] === 77) {\n              // 'MultipartFile'\n              for (let k = 0; k < MULTIPARTFILE_MARKER.length; ++k) {\n                if (buffer[k] !== MULTIPARTFILE_MARKER[k]) return this._a();\n              }\n              this.fields['type'] = SequenceType.MULTIPARTFILE;\n            } else {\n              return this._a();\n            }\n            state = HeaderState.KEY;\n            pos = 0;\n          } else if (state === HeaderState.KEY) {\n            if (!this._storeKey(pos)) return this._a();\n            state = HeaderState.VALUE;\n            pos = 0;\n          } else if (state === HeaderState.VALUE) {\n            if (pos >= MAX_FIELDCHARS) return this._a();\n            buffer[pos++] = c;\n          }\n          break;\n        case 58: // :\n          if (state === HeaderState.VALUE) {\n            if (!this._storeValue(pos)) return this._a();\n          }\n          this.state = HeaderState.END;\n          return i + 1;\n        default:\n          if (pos >= MAX_FIELDCHARS) return this._a();\n          buffer[pos++] = c;\n      }\n    }\n    this.state = state;\n    this._position = pos;\n    return -2;\n  }\n\n  private _a(): number {\n    this.fields.type = SequenceType.INVALID;\n    this.state = HeaderState.ABORT;\n    return -1;\n  }\n\n  private _storeKey(pos: number): boolean {\n    const k = toStr(this._buffer.subarray(0, pos));\n    if (k) {\n      this._key = k;\n      this.fields[k] = null;\n      return true;\n    }\n    return false;\n  }\n\n  private _storeValue(pos: number): boolean {\n    if (this._key) {\n      try {\n        const v = this._buffer.slice(0, pos);\n        this.fields[this._key] = DECODERS[this._key] ? DECODERS[this._key](v) : v;\n      } catch {\n        return false;\n      }\n      return true;\n    }\n    return false;\n  }\n}\n", "/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\n\nexport type ImageType = 'image/png' | 'image/jpeg' | 'image/gif' | 'image/qoi' | 'image/webp' | 'image/avif' | 'unsupported' | '';\n\nexport interface IMetrics {\n  mime: ImageType;\n  width: number;\n  height: number;\n}\n\nexport const UNSUPPORTED_TYPE: IMetrics = {\n  mime: 'unsupported',\n  width: 0,\n  height: 0\n};\n\nexport function imageType(d: Uint8Array): IMetrics {\n  if (d.length < 32) {\n    return UNSUPPORTED_TYPE;\n  }\n  const d32 = new Uint32Array(d.buffer, d.byteOffset, 8);\n  // PNG: 89 50 4E 47 0D 0A 1A 0A (8 first bytes == magic number for PNG)\n  // + first chunk must be IHDR\n  if (d32[0] === 0x474E5089 && d32[1] === 0x0A1A0A0D && d32[3] === 0x52444849) {\n    return {\n      mime: 'image/png',\n      width:  d[16] << 24 | d[17] << 16 | d[18] << 8 | d[19],\n      height: d[20] << 24 | d[21] << 16 | d[22] << 8 | d[23]\n    };\n  }\n  // JPEG: FF D8 FF\n  if (d[0] === 0xFF && d[1] === 0xD8 && d[2] === 0xFF) {\n    const [width, height] = jpgSize(d);\n    return { mime: 'image/jpeg', width, height };\n  }\n  // GIF: GIF87a or GIF89a\n  if (d32[0] === 0x38464947 && (d[4] === 0x37 || d[4] === 0x39) && d[5] === 0x61) {\n    return {\n      mime: 'image/gif',\n      width:  d[7] << 8 | d[6],\n      height: d[9] << 8 | d[8]\n    };\n  }\n  // QOI: qoif\n  if (d32[0] === 0x66696F71) {\n    return {\n      mime: 'image/qoi',\n      width:  d[4] << 24 | d[5] << 16 | d[6] << 8 | d[7],\n      height: d[8] << 24 | d[9] << 16 | d[10] << 8 | d[11]\n    };\n  }\n  // WEBP: RIFF | xxxx | WEBP | VP8x\n  if (d32[0] === 0x46464952 && d32[2] === 0x50424557 && (d32[3] & 0xFFFFFF) === 0x385056) {\n    switch (d[15]) {\n      case 0x58:  // Extended WebP VP8X --> \"X\"\n        return {\n          mime: 'image/webp',\n          width:  (d[24] | d[25] << 8 | d[26] << 16) + 1,\n          height: (d[27] | d[28] << 8 | d[29] << 16) + 1\n        };\n      case 0x4C:  // Lossless WebP VP8L --> \"L\"\n        if (d[20] !== 0x2f) return UNSUPPORTED_TYPE;\n        const dim = d[21] | d[22] << 8 | d[23] << 16 | d[24] << 24;\n        return {\n          mime: 'image/webp',\n          width:  (dim        & 0x3FFF) + 1,\n          height: (dim >>> 14 & 0x3FFF) + 1\n        };\n      case 0x20:  // Lossy WebP VP8  --> \" \"\n        if (d[23] !== 0x9d || d[24] !== 0x01 || d[25] !== 0x2a) return UNSUPPORTED_TYPE;\n        return {\n          mime: 'image/webp',\n          width:  (d[26] | d[27] << 8) & 0x3FFF,\n          height: (d[28] | d[29] << 8) & 0x3FFF\n        };\n    }\n    return UNSUPPORTED_TYPE;\n  }\n  // AVIF: Box size | ftyp | avif/avis\n  if (d32[1] === 0x70797466 && (d32[2] === 0x66697661 || d32[2] === 0x73697661)) {\n    let pos = -1;\n    // search for ispe box within first 1024 bytes\n    const limit = Math.min(d.length - 16, 1024);\n    for (let i = 8; i < limit; i++) {\n      // scan for ispe\n      if (d[i] === 0x69 && d[i + 1] === 0x73 && d[i + 2] === 0x70 && d[i + 3] === 0x65) {\n        pos = i;\n        break;\n      }\n    }\n    if (pos !== -1) {\n      // dimensions are in BE at +8 (width) at +12 (height)\n      const width =\n        d[pos +  8] << 24 |\n        d[pos +  9] << 16 |\n        d[pos + 10] <<  8 |\n        d[pos + 11];\n      const height =\n        d[pos + 12] << 24 |\n        d[pos + 13] << 16 |\n        d[pos + 14] <<  8 |\n        d[pos + 15];\n      if (width > 0 && height > 0) {\n        return { mime: 'image/avif', width, height };\n      }\n    }\n    return UNSUPPORTED_TYPE;\n  }\n  return UNSUPPORTED_TYPE;\n}\n\n\nfunction jpgSize(d: Uint8Array): [number, number] {\n  const len = d.length;\n  let i = 4;\n  let blockLength = d[i] << 8 | d[i + 1];\n  while (true) {\n    i += blockLength;\n    if (i >= len) {\n      // exhausted without size info\n      return [0, 0];\n    }\n    if (d[i] !== 0xFF) {\n      return [0, 0];\n    }\n    if (d[i + 1] === 0xC0 || d[i + 1] === 0xC2) {\n      if (i + 8 < len) {\n        return [\n          d[i + 7] << 8 | d[i + 8],\n          d[i + 5] << 8 | d[i + 6]\n        ];\n      }\n      return [0, 0];\n    }\n    i += 2;\n    blockLength = d[i] << 8 | d[i + 1];\n  }\n}\n", "/**\n * Copyright (c) 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IDisposable } from '@xterm/xterm';\nimport { IApcHandler, IImageAddonOptions, IResetHandler, ITerminalExt, ImageLayer } from '../Types';\nimport { ImageRenderer } from '../ImageRenderer';\nimport { CELL_SIZE_DEFAULT } from '../ImageStorage';\nimport { imageType } from '../IIPMetrics';\nimport { KittyImageStorage } from './KittyImageStorage';\nimport Base64Decoder, { type DecodeStatus } from 'xterm-wasm-parts/lib/base64/Base64Decoder.wasm';\nimport {\n  KittyAction,\n  KittyFormat,\n  KittyCompression,\n  IKittyCommand,\n  IPendingTransmission,\n  IKittyImageData,\n  KittyPixelConstants,\n  parseKittyCommand\n} from './KittyGraphicsTypes';\n\nconst enum Constants {\n  // Memory limit for base64 decoder (4MB, same as IIPHandler)\n  DECODER_KEEP_DATA = 4194304,\n  DECODER_INITIAL_DATA = 4194304, // 4MB\n  // Local mirror of const enum (esbuild can't inline const enums from external packages)\n  DECODER_OK = 0,\n  // Maximum control data size\n  MAX_CONTROL_DATA_SIZE = 512,\n  // Semicolon codepoint\n  SEMICOLON = 0x3B\n}\n\nconst DECODER_OK = Constants.DECODER_OK as unknown as DecodeStatus.OK;\n\n// Kitty graphics protocol handler with streaming base64 decoding.\nexport class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDisposable {\n  private _aborted = false;\n  private _generation = 0;\n  private _decodeError = false;\n\n  private _activeDecoder: Base64Decoder | null = null;\n  private readonly _maxEncodedBytes: number;\n  private readonly _initialEncodedBytes: number;\n\n  // Streaming related states\n\n  // True while receiving control data (before semicolon).\n  private _inControlData = true;\n\n  // Buffer for control data.\n  private _controlData = new Uint32Array(Constants.MAX_CONTROL_DATA_SIZE);\n  private _controlLength = 0;\n\n  // Pre-calculated encoded size limit\n  private _encodedSizeLimit = 0;\n  private _totalEncodedSize = 0;\n\n  // Parsed command. These are the control data before semicolon.\n  private _parsedCommand: IKittyCommand | null = null;\n\n  // Storage related states\n\n  private _pendingTransmissions: Map<number, IPendingTransmission> = new Map();\n  // Tracks the pending key of the most recently started chunked upload.\n  // Per spec, subsequent chunks only need m= (and optionally q=), without i=.\n  // When a chunk arrives with no i=, this key is used to find the pending upload.\n  private _lastPendingKey: number | undefined;\n\n  constructor(\n    private readonly _opts: IImageAddonOptions,\n    private readonly _renderer: ImageRenderer,\n    private readonly _kittyStorage: KittyImageStorage,\n    private readonly _coreTerminal: ITerminalExt\n  ) {\n    // Convert decoded size limit -> max encoded bytes.\n    this._maxEncodedBytes = Math.ceil(this._opts.kittySizeLimit * 4 / 3);\n    // ensure we preallocate more than configured limit while using 4mb initial size.\n    this._initialEncodedBytes = Math.min(Constants.DECODER_INITIAL_DATA, this._maxEncodedBytes);\n  }\n\n  public reset(): void {\n    this._generation++;\n    this._cleanupAllPending();\n    if (this._activeDecoder) {\n      this._activeDecoder.release();\n      this._activeDecoder = null;\n    }\n    this._kittyStorage.reset();\n  }\n\n  public dispose(): void {\n    this.reset();\n  }\n\n  private _removePendingEntry(key: number): void {\n    this._pendingTransmissions.delete(key);\n    if (this._lastPendingKey === key) {\n      this._lastPendingKey = undefined;\n    }\n  }\n\n  private _cleanupAllPending(): void {\n    for (const pending of this._pendingTransmissions.values()) {\n      pending.decoder.release();\n    }\n    this._pendingTransmissions.clear();\n    this._lastPendingKey = undefined;\n  }\n\n  public start(): void {\n    this._aborted = false;\n    this._decodeError = false;\n    this._inControlData = true;\n    this._controlLength = 0;\n    this._parsedCommand = null;\n    // Pre-calculate encoded limit once: base64 is 4 bytes encoded \u2192 3 bytes decoded\n    this._encodedSizeLimit = this._maxEncodedBytes;\n    this._totalEncodedSize = 0;\n    this._activeDecoder = null;\n  }\n\n  public put(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted) return;\n\n    if (!this._inControlData) {\n      this._streamPayload(data, start, end);\n    } else {\n      // Scan for semicolon\n      let controlEnd = end;\n      for (let i = start; i < end; i++) {\n        if (data[i] === Constants.SEMICOLON) {\n          this._inControlData = false;\n          controlEnd = i;\n          break;\n        }\n      }\n\n      // Copy control data\n      const copyLength = controlEnd - start;\n      if (this._controlLength + copyLength > Constants.MAX_CONTROL_DATA_SIZE) {\n        this._aborted = true;\n        return;\n      }\n      this._controlData.set(data.subarray(start, controlEnd), this._controlLength);\n      this._controlLength += copyLength;\n\n      if (!this._inControlData) {\n        // Found semicolon - parse control data early for validation\n        this._parsedCommand = parseKittyCommand(this._parseControlDataString());\n\n        // Early validation: i+I conflict\n        if (this._parsedCommand.id !== undefined && this._parsedCommand.imageNumber !== undefined) {\n          this._sendResponse(this._parsedCommand.id, 'EINVAL:cannot specify both i and I keys', this._parsedCommand.quiet ?? 0);\n          this._aborted = true;\n          return;\n        }\n\n        // Delete action doesn't need payload - skip streaming\n        if (this._parsedCommand.action === KittyAction.DELETE) {\n          return;\n        }\n\n        // Stream remaining as payload\n        const payloadStart = controlEnd + 1;\n        if (payloadStart < end) {\n          this._streamPayload(data, payloadStart, end);\n        }\n      }\n    }\n  }\n\n  // Stream payload bytes into the base64 decoder.\n  private _streamPayload(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted) return;\n\n    // Check size limit (compare encoded bytes against pre-calculated limit)\n    // Include cumulative size from pending transmission for multi-chunk images.\n    // Per spec, subsequent chunks may omit i=, so fall back to _lastPendingKey.\n    const pendingKey = this._parsedCommand?.id ?? this._lastPendingKey ?? 0;\n    const pending = this._pendingTransmissions.get(pendingKey);\n    const previousEncodedSize = pending?.totalEncodedSize ?? 0;\n    this._totalEncodedSize += end - start;\n    const cumulativeEncodedSize = previousEncodedSize + this._totalEncodedSize;\n    if (cumulativeEncodedSize > this._encodedSizeLimit) {\n      const decoderToRelease = this._activeDecoder ?? pending?.decoder;\n      if (decoderToRelease) {\n        decoderToRelease.release();\n      }\n      this._activeDecoder = null;\n      if (pending) {\n        this._removePendingEntry(pendingKey);\n      }\n      this._aborted = true;\n      return;\n    }\n\n    if (this._decodeError) return;\n\n    if (pending?.decoder && !this._activeDecoder) {\n      this._activeDecoder = pending.decoder;\n    }\n    if (!this._activeDecoder) {\n      // Budget WASM capacity, including one page of decoder state and rounding.\n      const decoderCapacity = this._maxEncodedBytes + 131072;\n      if (decoderCapacity > this._opts.storageLimit * 1000000) {\n        this._aborted = true;\n        if (this._parsedCommand?.id !== undefined) {\n          this._sendResponse(this._parsedCommand.id, 'ENOMEM:pending image budget exceeded', this._parsedCommand.quiet ?? 0);\n        }\n        return;\n      }\n      const maxPending = Math.max(1, Math.floor(this._opts.storageLimit * 1000000 / decoderCapacity));\n      while (this._pendingTransmissions.size >= maxPending) {\n        const oldest = this._pendingTransmissions.entries().next().value;\n        if (!oldest) break;\n        oldest[1].decoder.release();\n        this._removePendingEntry(oldest[0]);\n        if (oldest[1].cmd.id !== undefined) {\n          this._sendResponse(oldest[1].cmd.id, 'ENOMEM:pending image budget exceeded', oldest[1].cmd.quiet ?? 0);\n        }\n      }\n      const decoder = new Base64Decoder(Constants.DECODER_KEEP_DATA, this._maxEncodedBytes, this._initialEncodedBytes);\n      try {\n        decoder.init();\n      } catch (e) {\n        // Why: wasm memory exhaustion must drop this image, not throw out of the parser and wedge the write queue.\n        console.warn('KITTY: could not allocate decoder', e);\n        this._aborted = true;\n        if (this._parsedCommand?.id !== undefined) {\n          this._sendResponse(this._parsedCommand.id, 'ENOMEM:could not allocate decoder', this._parsedCommand.quiet ?? 0);\n        }\n        return;\n      }\n      this._activeDecoder = decoder;\n    }\n\n    if (this._activeDecoder.put(data.subarray(start, end)) !== DECODER_OK) {\n      this._activeDecoder.release();\n      this._activeDecoder = null;\n      this._decodeError = true;\n      if (pending) {\n        this._removePendingEntry(pendingKey);\n      }\n    }\n  }\n\n  public end(success: boolean): boolean | Promise<boolean> {\n    if (this._aborted || !success) {\n      if (this._activeDecoder) {\n        this._activeDecoder.release();\n        this._activeDecoder = null;\n      }\n      return true;\n    }\n\n    // No semicolon = no payload (delete, capability query)\n    if (this._inControlData) {\n      return this._handleNoPayloadCommand();\n    }\n\n    // Use command parsed early in put() - i+I already validated there\n    const cmd = this._parsedCommand!;\n\n    // Delete action was handled by skipping payload - just execute\n    if (cmd.action === KittyAction.DELETE) {\n      return this._handleDelete(cmd);\n    }\n\n    // Per spec, subsequent chunks may omit i=, so fall back to _lastPendingKey.\n    const pendingKey = cmd.id ?? this._lastPendingKey ?? 0;\n    const isMoreComing = cmd.more === 1;\n    const pending = this._pendingTransmissions.get(pendingKey);\n\n    if (isMoreComing) {\n      if (this._activeDecoder) {\n        if (pending) {\n          pending.totalEncodedSize += this._totalEncodedSize;\n          pending.decodeError = pending.decodeError || this._decodeError;\n        } else {\n          this._pendingTransmissions.set(pendingKey, {\n            cmd: { ...cmd },\n            decoder: this._activeDecoder,\n            totalEncodedSize: this._totalEncodedSize,\n            decodeError: this._decodeError\n          });\n        }\n        this._lastPendingKey = pendingKey;\n        this._activeDecoder = null;\n      }\n      return true;\n    }\n\n    // Final chunk received \u2014 clear the last pending key\n    if (pending) {\n      this._lastPendingKey = undefined;\n    }\n\n    let decodeError = this._decodeError;\n    let finalCmd = cmd;\n    let decoder = this._activeDecoder;\n\n    if (pending) {\n      finalCmd = pending.cmd;\n      decoder = pending.decoder;\n      decodeError = decodeError || pending.decodeError;\n      this._pendingTransmissions.delete(pendingKey);\n    }\n\n    let imageBytes = new Uint8Array(0);\n    if (decoder) {\n      if (decoder.end() !== DECODER_OK) {\n        decodeError = true;\n      }\n      imageBytes = decoder.data8;\n    }\n    this._activeDecoder = null;\n\n    // Handle command first \u2014 handlers create Blob/ImageData from imageBytes,\n    // which copies the data. Only then is it safe to release the decoder's\n    // wasm memory that imageBytes points into.\n    const result = this._handleCommandWithBytesAndCmd(finalCmd, imageBytes, decodeError);\n    if (decoder) {\n      decoder.release();\n    }\n    return result;\n  }\n\n  // Command handling\n\n  private _parseControlDataString(): string {\n    let str = '';\n    for (let i = 0; i < this._controlLength; i++) {\n      str += String.fromCodePoint(this._controlData[i]);\n    }\n    return str;\n  }\n\n  private _handleNoPayloadCommand(): boolean | Promise<boolean> {\n    const cmd = parseKittyCommand(this._parseControlDataString());\n\n    // Per spec: specifying both i and I is an error\n    if (cmd.id !== undefined && cmd.imageNumber !== undefined) {\n      this._sendResponse(cmd.id, 'EINVAL:cannot specify both i and I keys', cmd.quiet ?? 0);\n      return true;\n    }\n\n    const action = cmd.action ?? 't';\n\n    switch (action) {\n      case KittyAction.DELETE:\n        return this._handleDelete(cmd);\n      case KittyAction.QUERY:\n        this._sendResponse(cmd.id ?? 0, 'OK', cmd.quiet ?? 0);\n        return true;\n      case KittyAction.PLACEMENT:\n        return this._handlePlacement(cmd);\n      default:\n        // TODO: Implement remaining actions when needed:\n        // - a=f (frame): animation frame operations\n        // - a=a (animation): animation control\n        // - a=c (compose): compose images\n        if (cmd.id !== undefined) {\n          this._sendResponse(cmd.id, 'EINVAL:unsupported action', cmd.quiet ?? 0);\n        }\n        return true;\n    }\n  }\n\n  private _handleCommandWithBytesAndCmd(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean | Promise<boolean> {\n    const action = cmd.action ?? 't';\n\n    switch (action) {\n      case KittyAction.TRANSMIT: {\n        const result = this._handleTransmit(cmd, bytes, decodeError);\n        // Only send response when _handleTransmit didn't already respond\n        // (it handles unsupported transmission medium responses internally)\n        if ((cmd.transmission ?? 'd') === 'd' && cmd.id !== undefined) {\n          if (decodeError) {\n            this._sendResponse(cmd.id, 'EINVAL:invalid base64 data', cmd.quiet ?? 0);\n          } else if (bytes.length > 0) {\n            this._sendResponse(cmd.id, 'OK', cmd.quiet ?? 0);\n          }\n        }\n        return result;\n      }\n      case KittyAction.TRANSMIT_DISPLAY:\n        return this._handleTransmitDisplay(cmd, bytes, decodeError);\n      case KittyAction.QUERY:\n        return this._handleQuery(cmd, bytes, decodeError);\n      case KittyAction.PLACEMENT:\n        // a=p ignores any payload \u2014 image data was already transmitted\n        return this._handlePlacement(cmd);\n      default:\n        // TODO: Implement remaining actions when needed:\n        // - a=f (frame): animation frame operations\n        // - a=a (animation): animation control\n        // - a=c (compose): compose images\n        if (cmd.id !== undefined) {\n          this._sendResponse(cmd.id, 'EINVAL:unsupported action', cmd.quiet ?? 0);\n        }\n        return true;\n    }\n  }\n\n  private _handlePlacement(cmd: IKittyCommand): boolean | Promise<boolean> {\n    if (cmd.id === undefined) {\n      return true;\n    }\n    const id = cmd.id;\n    const image = this._kittyStorage.getImage(id);\n    if (!image) {\n      this._sendResponse(id, 'ENOENT:image not found', cmd.quiet ?? 0, cmd.placementId);\n      return true;\n    }\n    const result = this._displayImage(image, cmd);\n    return result.then(success => {\n      this._sendResponse(id, success ? 'OK' : 'EINVAL:image rendering failed', cmd.quiet ?? 0, cmd.placementId);\n      return true;\n    });\n  }\n\n  private _handleTransmit(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean {\n    // TODO: Support file-based transmission modes (t=f, t=t, t=s)\n    // Currently only supports direct transmission (t=d, the default).\n    // - t=f (file): Payload is base64-encoded file path. Terminal reads image from that path.\n    // - t=t (temp file): Payload is base64-encoded path in temp directory. Terminal reads, deletes.\n    // - t=s: Payload is base64-encoded POSIX shm name. Terminal reads from shared memory.\n    // These modes require filesystem/IPC access not available in browsers. For Node.js/Electron:\n    // 1. Check cmd.transmission (t key) before treating bytes as image data\n    // 2. For t=f/t/s: decode bytes as UTF-8 string (the path/name), then read file contents\n    // 3. For t=d: treat bytes as image data (current behavior)\n    // When implementing, also update _handleQuery to accept these transmission mediums.\n    const transmission = cmd.transmission ?? 'd';\n    if (transmission !== 'd') {\n      if (cmd.id !== undefined) {\n        this._sendResponse(cmd.id, 'EINVAL:unsupported transmission medium', cmd.quiet ?? 0);\n      }\n      return true;\n    }\n\n    if (decodeError || bytes.length === 0) return true;\n\n    this._kittyStorage.storeImage(cmd.id, {\n      data: new Blob([bytes as BlobPart]),\n      width: cmd.width ?? 0,\n      height: cmd.height ?? 0,\n      format: (cmd.format ?? KittyFormat.RGBA) as 24 | 32 | 100,\n      compression: cmd.compression ?? ''\n    });\n    return true;\n  }\n\n  private _handleTransmitDisplay(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean | Promise<boolean> {\n    if (decodeError) {\n      if (cmd.id !== undefined) {\n        this._sendResponse(cmd.id, 'EINVAL:invalid base64 data', cmd.quiet ?? 0);\n      }\n      return true;\n    }\n\n    this._handleTransmit(cmd, bytes, decodeError);\n\n    const id = cmd.id ?? this._kittyStorage.lastImageId;\n    const image = this._kittyStorage.getImage(id);\n    if (image) {\n      const result = this._displayImage(image, cmd);\n      if (cmd.id !== undefined) {\n        return result.then(success => {\n          this._sendResponse(id, success ? 'OK' : 'EINVAL:image rendering failed', cmd.quiet ?? 0);\n          return true;\n        });\n      }\n      return result.then(() => true);\n    }\n    return true;\n  }\n\n  private _handleQuery(cmd: IKittyCommand, bytes: Uint8Array, decodeError: boolean): boolean {\n    const id = cmd.id ?? 0;\n    const quiet = cmd.quiet ?? 0;\n\n    // Per spec: reject unsupported transmission mediums (only t=d is supported atm)\n    // TODO: When filesystem support is added (Node.js/Electron), update this to accept\n    // t=f (file), t=t (temp file), and t=s (shared memory) and respond OK for queries.\n    const transmission = cmd.transmission ?? 'd';\n    if (transmission !== 'd') {\n      this._sendResponse(id, 'EINVAL:unsupported transmission medium', quiet);\n      return true;\n    }\n\n    // Check decode error first (invalid base64)\n    if (decodeError) {\n      this._sendResponse(id, 'EINVAL:invalid base64 data', quiet);\n      return true;\n    }\n\n    // Capability query (no payload) - just respond OK\n    if (bytes.length === 0) {\n      this._sendResponse(id, 'OK', quiet);\n      return true;\n    }\n\n    const format = cmd.format ?? KittyFormat.RGBA;\n\n    if (format === KittyFormat.PNG) {\n      this._sendResponse(id, 'OK', quiet);\n    } else {\n      const width = cmd.width ?? 0;\n      const height = cmd.height ?? 0;\n\n      if (!width || !height) {\n        this._sendResponse(id, 'EINVAL:width and height required for raw pixel data', quiet);\n        return true;\n      }\n\n      const bytesPerPixel = format === KittyFormat.RGBA ? KittyPixelConstants.BYTES_PER_PIXEL_RGBA : KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n      const expectedBytes = width * height * bytesPerPixel;\n\n      if (bytes.length < expectedBytes) {\n        this._sendResponse(id, `EINVAL:insufficient pixel data`, quiet);\n        return true;\n      }\n\n      this._sendResponse(id, 'OK', quiet);\n    }\n    return true;\n  }\n\n  private _handleDelete(cmd: IKittyCommand): boolean {\n    // Per spec: default delete selector is 'a' (delete all visible placements)\n    const selector = cmd.deleteSelector ?? 'a';\n\n    // TODO: Distinguish lowercase (delete placements only) from uppercase\n    // (delete placements + free stored image data). Currently both variants\n    // free everything since we don't separate stored data from placements.\n    switch (selector) {\n      case 'a':\n      case 'A':\n        this._cleanupAllPending();\n        this._kittyStorage.deleteAll();\n        break;\n      case 'i':\n      case 'I':\n        // TODO: When placement id tracking is implemented (see TODO in\n        // KittyImageStorage), d=i with p=<pid> should delete only that\n        // specific placement, while d=i without p should delete all\n        // placements for the image.\n        if (cmd.id !== undefined) {\n          const pending = this._pendingTransmissions.get(cmd.id);\n          if (pending) {\n            pending.decoder.release();\n          }\n          this._removePendingEntry(cmd.id);\n          this._kittyStorage.deleteById(cmd.id);\n        }\n        break;\n      default:\n        // Unsupported selectors (c, n, p, q, r, x, y, z, f) \u2014 ignore for now\n        break;\n    }\n    return true;\n  }\n\n  private _sendResponse(id: number, message: string, quiet: number, placementId?: number): void {\n    const isOk = message === 'OK';\n    if (isOk && quiet >= 1) return;\n    if (!isOk && quiet >= 2) return;\n\n    const pPart = placementId ? `,p=${placementId}` : '';\n    const response = `\\x1b_Gi=${id}${pPart};${message}\\x1b\\\\`;\n    this._coreTerminal._core.coreService.triggerDataEvent(response);\n  }\n\n  // Image display\n\n  private _displayImage(image: IKittyImageData, cmd: IKittyCommand): Promise<boolean> {\n    return this._decodeAndDisplay(image, cmd)\n      .then(() => true)\n      .catch(() => false);\n  }\n\n  private async _decodeAndDisplay(image: IKittyImageData, cmd: IKittyCommand): Promise<void> {\n    const generation = this._generation;\n    let bitmap: ImageBitmap | undefined = await this._createBitmap(image);\n\n    try {\n      if (generation !== this._generation) throw new Error('image decode canceled');\n      const cropX = Math.max(0, cmd.x ?? 0);\n      const cropY = Math.max(0, cmd.y ?? 0);\n      const cropW = cmd.sourceWidth || (bitmap.width - cropX);\n      const cropH = cmd.sourceHeight || (bitmap.height - cropY);\n\n      const maxCropW = Math.max(0, bitmap.width - cropX);\n      const maxCropH = Math.max(0, bitmap.height - cropY);\n      const finalCropW = Math.max(0, Math.min(cropW, maxCropW));\n      const finalCropH = Math.max(0, Math.min(cropH, maxCropH));\n\n      if (finalCropW === 0 || finalCropH === 0) {\n        throw new Error('invalid source rectangle');\n      }\n\n      if (cropX !== 0 || cropY !== 0 || finalCropW !== bitmap.width || finalCropH !== bitmap.height) {\n        const cropped = await createImageBitmap(bitmap, cropX, cropY, finalCropW, finalCropH);\n        bitmap.close();\n        bitmap = cropped;\n      }\n\n      const cw = this._renderer.dimensions?.css.cell.width || CELL_SIZE_DEFAULT.width;\n      const ch = this._renderer.dimensions?.css.cell.height || CELL_SIZE_DEFAULT.height;\n\n      // Per spec: c/r default to image's natural cell dimensions.\n      // If only one of c/r is specified, compute the other from image aspect ratio.\n      let imgCols: number;\n      let imgRows: number;\n      if (cmd.columns !== undefined && cmd.rows !== undefined) {\n        imgCols = cmd.columns;\n        imgRows = cmd.rows;\n      } else if (cmd.columns !== undefined) {\n        imgCols = cmd.columns;\n        imgRows = Math.max(1, Math.ceil((bitmap.height / bitmap.width) * (imgCols * cw) / ch));\n      } else if (cmd.rows !== undefined) {\n        imgRows = cmd.rows;\n        imgCols = Math.max(1, Math.ceil((bitmap.width / bitmap.height) * (imgRows * ch) / cw));\n      } else {\n        imgCols = Math.ceil(bitmap.width / cw);\n        imgRows = Math.ceil(bitmap.height / ch);\n      }\n\n      let w = bitmap.width;\n      let h = bitmap.height;\n\n      // Scale bitmap to fit placement rectangle when c/r are specified\n      if (cmd.columns !== undefined || cmd.rows !== undefined) {\n        w = Math.round(imgCols * cw);\n        h = Math.round(imgRows * ch);\n      }\n\n      if (w * h > this._opts.pixelLimit) {\n        throw new Error('image exceeds pixel limit');\n      }\n\n      // Save cursor position before addImage modifies it\n      const buffer = this._coreTerminal._core.buffer;\n      const savedX = buffer.x;\n      const savedY = buffer.y;\n      const savedYbase = buffer.ybase;\n\n      // Determine layer based on z-index: negative = behind text, 0+ = on top.\n      // When z<0 we always use the bottom layer even without allowTransparency \u2014\n      // the image will simply be hidden behind the opaque text background, which\n      // is the correct behavior (client asked for \"behind text\").\n      const wantsBottom = cmd.zIndex !== undefined && cmd.zIndex < 0;\n      const layer: ImageLayer = wantsBottom ? 'bottom' : 'top';\n\n      if (w !== bitmap.width || h !== bitmap.height) {\n        const scaled = await createImageBitmap(bitmap, { resizeWidth: w, resizeHeight: h });\n        bitmap.close();\n        bitmap = scaled;\n      }\n\n      // Per spec: X/Y are pixel offsets within the first cell, so clamp to cell dimensions\n      const xOffset = Math.min(Math.max(0, cmd.xOffset ?? 0), cw - 1);\n      const yOffset = Math.min(Math.max(0, cmd.yOffset ?? 0), ch - 1);\n      if (xOffset !== 0 || yOffset !== 0) {\n        // Per spec: X/Y is not added to c/r area. When c/r are explicit, the\n        // total placement area remains c*cw \u00D7 r*ch pixels and the offset image\n        // is clipped to fit. When c/r are unset, the padded canvas determines\n        // the natural cell dimensions.\n        const canvasW = (cmd.columns !== undefined) ? Math.round(imgCols * cw) : bitmap.width + xOffset;\n        const canvasH = (cmd.rows !== undefined) ? Math.round(imgRows * ch) : bitmap.height + yOffset;\n        const offsetCanvas = ImageRenderer.createCanvas(window.document, canvasW, canvasH);\n        const offsetCtx = offsetCanvas.getContext('2d');\n        if (!offsetCtx) {\n          throw new Error('Failed to create offset canvas context');\n        }\n        offsetCtx.drawImage(bitmap, xOffset, yOffset);\n\n        const offsetBitmap = await createImageBitmap(offsetCanvas);\n        offsetCanvas.width = offsetCanvas.height = 0;\n        bitmap.close();\n        bitmap = offsetBitmap;\n        w = bitmap.width;\n        h = bitmap.height;\n        if (w * h > this._opts.pixelLimit) {\n          throw new Error('image exceeds pixel limit');\n        }\n        if (cmd.columns === undefined) {\n          imgCols = Math.ceil(bitmap.width / cw);\n        }\n        if (cmd.rows === undefined) {\n          imgRows = Math.ceil(bitmap.height / ch);\n        }\n      }\n\n      if (generation !== this._generation) throw new Error('image decode canceled');\n      const zIndex = cmd.zIndex ?? 0;\n      this._kittyStorage.addImage(image.id, bitmap, true, layer, zIndex);\n      bitmap = undefined;  // ownership transferred to storage\n\n      // Kitty cursor movement\n      // Per spec: cursor placed at first column after last image column,\n      // on the last row of the image. C=1 means don't move cursor.\n      if (cmd.cursorMovement === 1) {\n        // C=1: restore cursor to position before image was placed\n        const scrolled = buffer.ybase - savedYbase;\n        buffer.x = savedX;\n        // Can't restore cursor to scrollback?\n        buffer.y = Math.max(savedY - scrolled, 0);\n      } else {\n        // Default (C=0): advance cursor horizontally past the image\n        // addImage already positioned cursor on the last row via lineFeeds\n        buffer.x = Math.min(savedX + imgCols, this._coreTerminal.cols);\n      }\n    } catch (e) {\n      bitmap?.close();\n      throw e;\n    }\n  }\n\n  // Create ImageBitmap from already-decoded image data.\n  private async _createBitmap(image: IKittyImageData): Promise<ImageBitmap> {\n    let bytes: Uint8Array = new Uint8Array(await image.data.arrayBuffer());\n\n    if (image.compression === KittyCompression.ZLIB) {\n      bytes = await this._decompressZlib(bytes);\n    }\n\n    if (image.format === KittyFormat.PNG) {\n      const metrics = imageType(bytes);\n      // IHDR dimensions are parsed with signed shifts, so a value >= 0x80000000 comes\n      // back negative and a bare `>` pixel-limit test passes it; require positive.\n      if (metrics.mime !== 'image/png' || !(metrics.width > 0) || !(metrics.height > 0) || metrics.width * metrics.height > this._opts.pixelLimit) {\n        throw new RangeError('PNG exceeds pixel limit or has invalid dimensions');\n      }\n      const blob = new Blob([bytes as BlobPart], { type: 'image/png' });\n      if (!window.createImageBitmap) {\n        const url = URL.createObjectURL(blob);\n        const img = new Image();\n        return new Promise<ImageBitmap>((resolve, reject) => {\n          img.addEventListener('load', () => {\n            URL.revokeObjectURL(url);\n            const canvas = ImageRenderer.createCanvas(window.document, img.width, img.height);\n            canvas.getContext('2d')?.drawImage(img, 0, 0);\n            createImageBitmap(canvas).then(resolve).catch(reject);\n          });\n          img.addEventListener('error', () => {\n            URL.revokeObjectURL(url);\n            reject(new Error('Failed to load image'));\n          });\n          img.src = url;\n        });\n      }\n      return createImageBitmap(blob);\n    }\n\n    // Raw pixel data\n    const width = image.width;\n    const height = image.height;\n\n    if (!width || !height) {\n      throw new Error('Width and height required for raw pixel data');\n    }\n\n    const bytesPerPixel = image.format === KittyFormat.RGBA ? KittyPixelConstants.BYTES_PER_PIXEL_RGBA : KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n    const expectedBytes = width * height * bytesPerPixel;\n\n    if (bytes.length < expectedBytes) {\n      throw new Error('Insufficient pixel data');\n    }\n\n    const pixelCount = width * height;\n\n    if (image.format === KittyFormat.RGBA) {\n      // RGBA: use bytes directly \u2014 no copy needed\n      return createImageBitmap(new ImageData(new Uint8ClampedArray(bytes.buffer as ArrayBuffer, bytes.byteOffset, pixelCount * KittyPixelConstants.BYTES_PER_PIXEL_RGBA), width, height));\n    }\n\n    // RGB\u2192RGBA: interleave alpha using uint32 block processing (4 pixels per iteration).\n    // 3 uint32 reads + 4 uint32 writes per 4 pixels vs 28 byte reads/writes \u2014 ~6x faster.\n    // Assumes little-endian (all modern browsers/Node.js).\n    const data = new Uint8ClampedArray(pixelCount * KittyPixelConstants.BYTES_PER_PIXEL_RGBA);\n    const src32 = new Uint32Array(bytes.buffer, bytes.byteOffset, Math.floor(bytes.byteLength / 4));\n    const dst32 = new Uint32Array(data.buffer);\n    const alignedPixels = pixelCount & ~3;  // round down to multiple of 4\n\n    let srcOffset = 0;\n    let dstOffset = 0;\n    for (let i = 0; i < alignedPixels; i += 4) {\n      const b0 = src32[srcOffset++];\n      const b1 = src32[srcOffset++];\n      const b2 = src32[srcOffset++];\n      // Little-endian: pixel bytes are [R,G,B] \u2192 uint32 ABGR layout\n      dst32[dstOffset++] = 0xFF000000 | b0;\n      dst32[dstOffset++] = 0xFF000000 | (b0 >>> 24) | (b1 << 8);\n      dst32[dstOffset++] = 0xFF000000 | (b1 >>> 16) | (b2 << 16);\n      dst32[dstOffset++] = 0xFF000000 | (b2 >>> 8);\n    }\n\n    // Handle remaining 1\u20133 pixels\n    let srcByte = alignedPixels * KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n    let dstByte = alignedPixels * KittyPixelConstants.BYTES_PER_PIXEL_RGBA;\n    for (let i = alignedPixels; i < pixelCount; i++) {\n      data[dstByte]     = bytes[srcByte];\n      data[dstByte + 1] = bytes[srcByte + 1];\n      data[dstByte + 2] = bytes[srcByte + 2];\n      data[dstByte + 3] = KittyPixelConstants.ALPHA_OPAQUE;\n      srcByte += KittyPixelConstants.BYTES_PER_PIXEL_RGB;\n      dstByte += KittyPixelConstants.BYTES_PER_PIXEL_RGBA;\n    }\n\n    return createImageBitmap(new ImageData(data, width, height));\n  }\n\n  private async _decompressZlib(compressed: Uint8Array): Promise<Uint8Array> {\n    try {\n      return await this._decompress(compressed, 'deflate');\n    } catch (error) {\n      if (error instanceof RangeError) throw error;\n      return await this._decompress(compressed, 'deflate-raw');\n    }\n  }\n\n  private async _decompress(compressed: Uint8Array, format: 'deflate' | 'deflate-raw'): Promise<Uint8Array> {\n    const limit = Math.min(this._opts.kittySizeLimit, this._opts.pixelLimit * 4, this._opts.storageLimit * 1000000);\n    let offsetIn = 0;\n    // Bound inflation within one native transform before its output is budgeted.\n    const source = new ReadableStream<BufferSource>({\n      pull(controller) {\n        if (offsetIn >= compressed.length) {\n          controller.close();\n          return;\n        }\n        const end = Math.min(offsetIn + 4096, compressed.length);\n        controller.enqueue(new Uint8Array(compressed.subarray(offsetIn, end)));\n        offsetIn = end;\n      }\n    });\n    const reader = source.pipeThrough(new DecompressionStream(format)).getReader();\n    const chunks: Uint8Array[] = [];\n    let totalLength = 0;\n    try {\n      while (true) {\n        const { done, value } = await reader.read();\n        if (done) break;\n        totalLength += value.byteLength;\n        if (totalLength > limit) {\n          await reader.cancel().catch(() => {});\n          throw new RangeError('decompressed image exceeds byte limit');\n        }\n        chunks.push(value);\n      }\n    } finally {\n      reader.releaseLock();\n    }\n\n    const result = new Uint8Array(totalLength);\n    let offset = 0;\n    for (const chunk of chunks) {\n      result.set(chunk, offset);\n      offset += chunk.length;\n    }\n    return result;\n  }\n\n  public get images(): ReadonlyMap<number, IKittyImageData> {\n    return this._kittyStorage.images;\n  }\n\n  public get _kittyIdToStorageId(): ReadonlyMap<number, number> {\n    return this._kittyStorage.kittyIdToStorageId;\n  }\n\n  public get pendingTransmissions(): ReadonlyMap<number, IPendingTransmission> {\n    return this._pendingTransmissions;\n  }\n}\n", "/**\n * Copyright (c) 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n *\n * Kitty graphics protocol types, constants, and parsing utilities.\n */\n\nimport type Base64Decoder from 'xterm-wasm-parts/lib/base64/Base64Decoder.wasm';\n\n// Kitty graphics protocol action types.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference under key 'a'.\nexport const enum KittyAction {\n  TRANSMIT = 't',\n  TRANSMIT_DISPLAY = 'T',\n  QUERY = 'q',\n  PLACEMENT = 'p',\n  DELETE = 'd'\n}\n\n// Kitty graphics protocol format types.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference\nexport const enum KittyFormat {\n  RGB = 24,\n  RGBA = 32,\n  PNG = 100\n}\n\n// Kitty graphics protocol compression types.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference under key 'o'.\nexport const enum KittyCompression {\n  NONE = '',\n  ZLIB = 'z'\n}\n\n// Kitty graphics protocol control data keys.\n// See: https://sw.kovidgoyal.net/kitty/graphics-protocol/#control-data-reference\nexport const enum KittyKey {\n  // Action to perform (t=transmit, T=transmit+display, q=query, p=placement, d=delete)\n  ACTION = 'a',\n  // Image format (24=RGB, 32=RGBA, 100=PNG)\n  FORMAT = 'f',\n  // Image ID for referencing stored images\n  ID = 'i',\n  // Image number (alternative to ID, terminal assigns ID)\n  IMAGE_NUMBER = 'I',\n  // Source image width in pixels\n  WIDTH = 's',\n  // Source image height in pixels\n  HEIGHT = 'v',\n  // The left edge (in pixels) of the image area to display\n  X_OFFSET = 'x',\n  // The top edge (in pixels) of the image area to display\n  Y_OFFSET = 'y',\n  // Width (in pixels) of the source rectangle to display\n  SOURCE_WIDTH = 'w',\n  // Height (in pixels) of the source rectangle to display\n  SOURCE_HEIGHT = 'h',\n  // Horizontal offset (in pixels) within the first cell\n  X_PLACEMENT_OFFSET = 'X',\n  // Vertical offset (in pixels) within the first cell\n  Y_PLACEMENT_OFFSET = 'Y',\n  // Number of terminal columns to display the image over\n  COLUMNS = 'c',\n  // Number of terminal rows to display the image over\n  ROWS = 'r',\n  // More data flag (1=more chunks coming, 0=final chunk)\n  MORE = 'm',\n  // Compression type (z=zlib). This is essential for chunking larger images.\n  COMPRESSION = 'o',\n  // Quiet mode (1=suppress OK responses, 2=suppress error responses)\n  QUIET = 'q',\n  // Cursor movement policy (0=move cursor after image, 1=don't move cursor)\n  CURSOR_MOVEMENT = 'C',\n  // Z-index for image layering (negative = behind text, 0+ = on top)\n  Z_INDEX = 'z',\n  // Transmission medium (d=direct, f=file, t=temp file, s=shared memory)\n  TRANSMISSION = 't',\n  // Delete selector (a/A=all, i/I=by id, c/C=at cursor, etc.) \u2014 only used when a=d\n  DELETE_SELECTOR = 'd',\n  // Placement ID for targeting specific placements\n  PLACEMENT_ID = 'p'\n}\n\n// Pixel format constants\nexport const enum KittyPixelConstants {\n  BYTES_PER_PIXEL_RGB = 3,\n  BYTES_PER_PIXEL_RGBA = 4,\n  ALPHA_OPAQUE = 255\n}\n\n// Parsed Kitty graphics command.\nexport interface IKittyCommand {\n  action?: string;\n  format?: number;\n  id?: number;\n  imageNumber?: number;\n  width?: number;\n  height?: number;\n  x?: number;\n  y?: number;\n  sourceWidth?: number;\n  sourceHeight?: number;\n  xOffset?: number;\n  yOffset?: number;\n  columns?: number;\n  rows?: number;\n  more?: number;\n  quiet?: number;\n  cursorMovement?: number;\n  zIndex?: number;\n  transmission?: string;\n  deleteSelector?: string;\n  placementId?: number;\n  compression?: string;\n  payload?: string;\n}\n\n// Pending chunked transmission state.\n// Stores metadata from the first chunk while accumulating decoded payload data.\nexport interface IPendingTransmission {\n  // The parsed command from the first chunk (contains action, format, dimensions, etc.)\n  cmd: IKittyCommand;\n  // Decoder used across chunked payloads\n  decoder: Base64Decoder;\n  // Total encoded (base64) bytes received across all chunks - for size limit enforcement\n  totalEncodedSize: number;\n  // Whether any chunk has failed to decode\n  decodeError: boolean;\n}\n\n// Stored Kitty image data.\nexport interface IKittyImageData {\n  id: number;\n  // Decoded image data stored as Blob (off JS heap) to avoid 2GB heap limit\n  data: Blob;\n  width: number;\n  height: number;\n  format: 24 | 32 | 100;\n  compression?: string;\n}\n\n// Parses Kitty graphics control data into a command object.\nexport function parseKittyCommand(data: string): IKittyCommand {\n  const cmd: IKittyCommand = {};\n  const parts = data.split(',');\n\n  for (const part of parts) {\n    const eqIdx = part.indexOf('=');\n    if (eqIdx === -1) continue;\n\n    const key = part.substring(0, eqIdx);\n    const value = part.substring(eqIdx + 1);\n\n    // Handle string keys first\n    if (key === KittyKey.ACTION) {\n      cmd.action = value;\n      continue;\n    }\n    if (key === KittyKey.COMPRESSION) {\n      cmd.compression = value;\n      continue;\n    }\n    if (key === KittyKey.TRANSMISSION) {\n      cmd.transmission = value;\n      continue;\n    }\n    if (key === KittyKey.DELETE_SELECTOR) {\n      cmd.deleteSelector = value;\n      continue;\n    }\n    const numValue = parseInt(value, 10);\n    switch (key) {\n      case KittyKey.FORMAT: cmd.format = numValue; break;\n      case KittyKey.ID: cmd.id = numValue; break;\n      case KittyKey.IMAGE_NUMBER: cmd.imageNumber = numValue; break;\n      case KittyKey.WIDTH: cmd.width = numValue; break;\n      case KittyKey.HEIGHT: cmd.height = numValue; break;\n      case KittyKey.X_OFFSET: cmd.x = numValue; break;\n      case KittyKey.Y_OFFSET: cmd.y = numValue; break;\n      case KittyKey.SOURCE_WIDTH: cmd.sourceWidth = numValue; break;\n      case KittyKey.SOURCE_HEIGHT: cmd.sourceHeight = numValue; break;\n      case KittyKey.X_PLACEMENT_OFFSET: cmd.xOffset = numValue; break;\n      case KittyKey.Y_PLACEMENT_OFFSET: cmd.yOffset = numValue; break;\n      case KittyKey.COLUMNS: cmd.columns = numValue; break;\n      case KittyKey.ROWS: cmd.rows = numValue; break;\n      case KittyKey.MORE: cmd.more = numValue; break;\n      case KittyKey.QUIET: cmd.quiet = numValue; break;\n      case KittyKey.CURSOR_MOVEMENT: cmd.cursorMovement = numValue; break;\n      case KittyKey.Z_INDEX: cmd.zIndex = numValue; break;\n      case KittyKey.PLACEMENT_ID: cmd.placementId = numValue; break;\n    }\n  }\n\n  return cmd;\n}\n", "/**\n * Copyright (c) 2026 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IDisposable } from '@xterm/xterm';\nimport { ImageStorage } from '../ImageStorage';\nimport { ImageLayer, IAddImageOpts } from '../Types';\nimport { IKittyImageData } from './KittyGraphicsTypes';\n\n// Kitty-specific image storage controller.\n//\n// Wraps shared ImageStorage with kitty protocol semantics:\n// - tracks transmitted image payloads by kitty image id\n// - tracks kitty image id -> shared ImageStorage id mapping for displayed images\n// - mirrors shared-storage evictions into kitty maps\n// - applies protocol-level undisplayed-image eviction policy\nexport class KittyImageStorage implements IDisposable {\n  private static readonly _maxStoredImages = 256;\n\n  private _nextImageId = 1;\n  private readonly _images: Map<number, IKittyImageData> = new Map();\n  // TODO: Support multiple placements per image. The kitty spec identifies\n  // placements by an (image id, placement id) pair \u2014 same i + different p\n  // values should coexist, and same i + same p should replace the prior\n  // placement. Currently we track only one storage entry per kitty image id,\n  // so multiple placements of the same image overwrite each other. Fixing\n  // this requires changing these maps to Map<number, Map<number, number>>\n  // (kittyId \u2192 placementId \u2192 storageId) and updating addImage/deleteById\n  // accordingly. The underlying shared ImageStorage would also need to\n  // support multiple entries per logical image.\n  private readonly _kittyIdToStorageId: Map<number, number> = new Map();\n  private readonly _storageIdToKittyId: Map<number, number> = new Map();\n\n  private readonly _previousOnImageDeleted: ((storageId: number) => void) | undefined;\n  private readonly _wrappedOnImageDeleted: (storageId: number) => void;\n  private readonly _handleStorageImageDeleted = (storageId: number): void => {\n    const kittyId = this._storageIdToKittyId.get(storageId);\n    if (kittyId !== undefined) {\n      this._kittyIdToStorageId.delete(kittyId);\n      this._storageIdToKittyId.delete(storageId);\n      this._images.delete(kittyId);\n    }\n  };\n  private _addImageOpts: IAddImageOpts = { scrolling: true, layer: 'top', zIndex: 0, cursorPos: 'iip' };\n\n  constructor(\n    private readonly _storage: ImageStorage\n  ) {\n    this._previousOnImageDeleted = this._storage.onImageDeleted;\n    this._wrappedOnImageDeleted = (storageId: number) => {\n      this._previousOnImageDeleted?.(storageId);\n      this._handleStorageImageDeleted(storageId);\n    };\n    this._storage.onImageDeleted = this._wrappedOnImageDeleted;\n  }\n\n  public reset(): void {\n    this._nextImageId = 1;\n    this._images.clear();\n    this._kittyIdToStorageId.clear();\n    this._storageIdToKittyId.clear();\n  }\n\n  public dispose(): void {\n    this.reset();\n    if (this._storage.onImageDeleted === this._wrappedOnImageDeleted) {\n      this._storage.onImageDeleted = this._previousOnImageDeleted;\n    }\n  }\n\n  public storeImage(id: number | undefined, imageData: Omit<IKittyImageData, 'id'>): number {\n    const imageId = id ?? this._nextImageId++;\n\n    const oldStorageId = this._kittyIdToStorageId.get(imageId);\n    if (oldStorageId !== undefined) {\n      this._storage.deleteImage(oldStorageId);\n      this._kittyIdToStorageId.delete(imageId);\n      this._storageIdToKittyId.delete(oldStorageId);\n    }\n\n    if (!this._images.has(imageId) && this._images.size >= KittyImageStorage._maxStoredImages) {\n      this._evictUndisplayedImages();\n    }\n\n    // Encoded images awaiting placement are outside ImageStorage's pixel budget.\n    // Unplaced payloads are evicted first so a new upload cannot erase a visible\n    // image while abandoned blobs still hold budget; placed ones go only when\n    // that is not enough, because the byte cap is a hard bound. The new image is\n    // always stored, so an oversized one overshoots by at most one payload\n    // (itself bounded by kittySizeLimit) rather than being dropped after an OK ack.\n    const byteLimit = this._storage.getLimit() * 1000000;\n    this._images.delete(imageId);\n    let retainedBytes = 0;\n    for (const image of this._images.values()) retainedBytes += image.data.size;\n    for (const evictPlaced of [false, true]) {\n      for (const [oldestId, image] of this._images) {\n        if (retainedBytes + imageData.data.size <= byteLimit) break;\n        if (this._kittyIdToStorageId.has(oldestId) !== evictPlaced) continue;\n        retainedBytes -= image.data.size;\n        this.deleteById(oldestId);\n      }\n    }\n\n    this._images.set(imageId, {\n      ...imageData,\n      id: imageId\n    });\n    return imageId;\n  }\n\n  public addImage(kittyId: number, image: HTMLCanvasElement | ImageBitmap, scrolling: boolean, layer: ImageLayer, zIndex: number): void {\n    // Clean up stale reverse-mapping from a previous placement of the same\n    // kitty image.  The old shared-storage entry is kept (it may still be\n    // visible on screen) but its reverse mapping is removed so that eviction\n    // of the old entry won't incorrectly delete the kitty image data.\n    const oldStorageId = this._kittyIdToStorageId.get(kittyId);\n    if (oldStorageId !== undefined) {\n      this._storageIdToKittyId.delete(oldStorageId);\n    }\n    this._addImageOpts.scrolling = scrolling;\n    this._addImageOpts.layer = layer;\n    this._addImageOpts.zIndex = zIndex;\n    const storageId = this._storage.addImage(image, this._addImageOpts);\n    this._kittyIdToStorageId.set(kittyId, storageId);\n    this._storageIdToKittyId.set(storageId, kittyId);\n  }\n\n  public getImage(kittyId: number): IKittyImageData | undefined {\n    return this._images.get(kittyId);\n  }\n\n  public deleteById(kittyId: number): void {\n    this._images.delete(kittyId);\n    const storageId = this._kittyIdToStorageId.get(kittyId);\n    if (storageId !== undefined) {\n      this._storage.deleteImage(storageId);\n      this._kittyIdToStorageId.delete(kittyId);\n      this._storageIdToKittyId.delete(storageId);\n    }\n  }\n\n  public deleteAll(): void {\n    this._images.clear();\n    for (const storageId of this._kittyIdToStorageId.values()) {\n      this._storage.deleteImage(storageId);\n    }\n    this._kittyIdToStorageId.clear();\n    this._storageIdToKittyId.clear();\n  }\n\n  public get images(): ReadonlyMap<number, IKittyImageData> {\n    return this._images;\n  }\n\n  public get kittyIdToStorageId(): ReadonlyMap<number, number> {\n    return this._kittyIdToStorageId;\n  }\n\n  public get lastImageId(): number {\n    return this._nextImageId - 1;\n  }\n\n  private _evictUndisplayedImages(): void {\n    for (const [kittyId] of this._images) {\n      if (this._images.size <= KittyImageStorage._maxStoredImages / 2) {\n        break;\n      }\n      if (!this._kittyIdToStorageId.has(kittyId)) {\n        this._images.delete(kittyId);\n      }\n    }\n  }\n}\n", "/**\n * Copyright (c) 2020, 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { SixelImageStorage } from './SixelImageStorage';\nimport { IDcsHandler, IParams, IImageAddonOptions, ITerminalExt, AttributeData, IResetHandler, ReadonlyColorSet } from './Types';\nimport { toRGBA8888, BIG_ENDIAN, PALETTE_ANSI_256, PALETTE_VT340_COLOR } from 'sixel/lib/Colors';\nimport { RGBA8888 } from 'sixel/lib/Types';\nimport { ImageRenderer } from './ImageRenderer';\n\nimport { DecoderAsync, Decoder } from 'sixel/lib/Decoder';\nimport { LIMITS } from 'sixel/lib/wasm';\n\n// always free decoder ressources after decoding if it exceeds this limit\nconst MEM_PERMA_LIMIT = 4194304; // 1024 pixels * 1024 pixels * 4 channels = 4MB\n\n// custom default palette: VT340 (lower 16 colors) + ANSI256 (up to 256) + zeroed (up to 4096)\nconst DEFAULT_PALETTE = PALETTE_ANSI_256;\nDEFAULT_PALETTE.set(PALETTE_VT340_COLOR);\n\n// Why pooled: every decoder owns a wasm memory, and V8 caps live wasm memories\n// per process (~124 in a sandboxed renderer). Terminals borrow a decoder only\n// while a SIXEL sequence is open, so idle terminals hold none.\nconst MAX_IDLE_DECODERS = 2;\nconst idleDecoders = new Map<number, Decoder[]>();\nlet poolPrimed = false;\n\nfunction primeDecoderPool(memoryLimit: number): void {\n  if (poolPrimed) return;\n  poolPrimed = true;\n  // Async compile once, off the parser's hot path; later decoders reuse the cached module.\n  DecoderAsync({ memoryLimit, palette: DEFAULT_PALETTE }).then(\n    d => releaseDecoder(d, memoryLimit),\n    () => { poolPrimed = false; }\n  );\n}\n\nfunction acquireDecoder(memoryLimit: number): Decoder {\n  return idleDecoders.get(memoryLimit)?.pop() ?? new Decoder({ memoryLimit, palette: DEFAULT_PALETTE });\n}\n\nfunction releaseDecoder(dec: Decoder, memoryLimit: number): void {\n  if (dec.memoryUsage > MEM_PERMA_LIMIT) {\n    dec.release();\n  }\n  const idle = idleDecoders.get(memoryLimit) ?? [];\n  if (idle.length < MAX_IDLE_DECODERS) {\n    idle.push(dec);\n    idleDecoders.set(memoryLimit, idle);\n  }\n}\n\n\nexport class SixelHandler implements IDcsHandler, IResetHandler {\n  private _size = 0;\n  private _aborted = false;\n  private _dec: Decoder | undefined;\n  private _decMemoryLimit = 0;\n  // Color registers outlive a single image, so they live here rather than in a pooled decoder.\n  private readonly _palette = new Uint32Array(LIMITS.PALETTE_SIZE);\n\n  constructor(\n    private readonly _opts: IImageAddonOptions,\n    private readonly _storage: SixelImageStorage,\n    private readonly _coreTerminal: ITerminalExt\n  ) {\n    this._palette.set(DEFAULT_PALETTE);\n    primeDecoderPool(this._opts.pixelLimit * 4);\n  }\n\n  public reset(): void {\n    this._returnDecoder();\n    this._palette.fill(0);\n    this._palette.set(DEFAULT_PALETTE);\n  }\n\n  public hook(params: IParams): void {\n    this._size = 0;\n    this._aborted = false;\n    this._returnDecoder();\n    const memoryLimit = this._opts.pixelLimit * 4;\n    try {\n      this._dec = acquireDecoder(memoryLimit);\n    } catch (e) {\n      // Why: exhausting wasm memory must drop this image, not throw out of the parser and wedge the write queue.\n      console.warn(`SIXEL: could not allocate decoder - ${e}`);\n      this._aborted = true;\n      return;\n    }\n    this._decMemoryLimit = memoryLimit;\n    const fillColor = params.params[1] === 1 ? 0 : extractActiveBg(\n      this._coreTerminal._core._inputHandler._curAttrData,\n      this._coreTerminal._core._themeService?.colors);\n    this._dec.init(fillColor, this._palette, this._opts.sixelPaletteLimit);\n  }\n\n  private _returnDecoder(): void {\n    const dec = this._dec;\n    if (!dec) return;\n    this._dec = undefined;\n    this._palette.set(dec.palette);\n    releaseDecoder(dec, this._decMemoryLimit);\n  }\n\n  public put(data: Uint32Array, start: number, end: number): void {\n    if (this._aborted || !this._dec) {\n      return;\n    }\n    this._size += end - start;\n    if (this._size > this._opts.sixelSizeLimit) {\n      console.warn(`SIXEL: too much data, aborting`);\n      this._aborted = true;\n      this._dec.release();\n      return;\n    }\n    try {\n      this._dec.decode(data, start, end);\n    } catch (e) {\n      console.warn(`SIXEL: error while decoding image - ${e}`);\n      this._aborted = true;\n      this._dec.release();\n    }\n  }\n\n  public unhook(success: boolean): boolean | Promise<boolean> {\n    try {\n      return this._unhook(success);\n    } finally {\n      this._returnDecoder();\n    }\n  }\n\n  private _unhook(success: boolean): boolean {\n    if (this._aborted || !success || !this._dec) {\n      return true;\n    }\n\n    const width = this._dec.width;\n    const height = this._dec.height;\n\n    // partial fix for https://github.com/jerch/xterm-addon-image/issues/37\n    if (!width || !height) {\n      if (height) {\n        this._storage.advanceCursor(height);\n      }\n      return true;\n    }\n\n    const canvas = ImageRenderer.createCanvas(undefined, width, height);\n    canvas.getContext('2d')?.putImageData(new ImageData(this._dec.data8 as Uint8ClampedArray<ArrayBuffer>, width, height), 0, 0);\n    this._storage.addImage(canvas);\n    return true;\n  }\n}\n\n\n/**\n * Some helpers to extract current terminal colors.\n */\n\n// get currently active background color from terminal\n// also respect INVERSE setting\nfunction extractActiveBg(attr: AttributeData, colors: ReadonlyColorSet | undefined): RGBA8888 {\n  let bg = 0;\n  if (!colors) {\n    // FIXME: theme service is prolly not available yet,\n    // happens if .open() was not called yet (bug in core?)\n    return bg;\n  }\n  if (attr.isInverse()) {\n    if (attr.isFgDefault()) {\n      bg = convertLe(colors.foreground.rgba);\n    } else if (attr.isFgRGB()) {\n      const t = (attr.constructor as typeof AttributeData).toColorRGB(attr.getFgColor());\n      bg = toRGBA8888(...t);\n    } else {\n      bg = convertLe(colors.ansi[attr.getFgColor()].rgba);\n    }\n  } else {\n    if (attr.isBgDefault()) {\n      bg = convertLe(colors.background.rgba);\n    } else if (attr.isBgRGB()) {\n      const t = (attr.constructor as typeof AttributeData).toColorRGB(attr.getBgColor());\n      bg = toRGBA8888(...t);\n    } else {\n      bg = convertLe(colors.ansi[attr.getBgColor()].rgba);\n    }\n  }\n  return bg;\n}\n\n// rgba values on the color managers are always in BE, thus convert to LE\nfunction convertLe(color: number): RGBA8888 {\n  if (BIG_ENDIAN) return color;\n  return (color & 0xFF) << 24 | (color >>> 8 & 0xFF) << 16 | (color >>> 16 & 0xFF) << 8 | color >>> 24 & 0xFF;\n}\n", "/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { ImageStorage, CELL_SIZE_DEFAULT } from './ImageStorage';\nimport { IImageAddonOptions, ITerminalExt, IAddImageOpts } from './Types';\nimport { ImageRenderer } from './ImageRenderer';\n\n/**\n * Sixel-specific image storage controller.\n *\n * Wraps the shared ImageStorage with sixel protocol semantics:\n * - Cursor behavior governed by DECSET 80 (sixelScrolling option)\n * - advanceCursor for empty sixels carrying only height\n */\nexport class SixelImageStorage {\n  private _addImageOpts: IAddImageOpts = { scrolling: true, layer: 'top', zIndex: 0, cursorPos: 'vt340' };\n  constructor(\n    private readonly _storage: ImageStorage,\n    private readonly _opts: IImageAddonOptions,\n    private readonly _renderer: ImageRenderer,\n    private readonly _terminal: ITerminalExt\n  ) {}\n\n  /**\n   * Add a sixel image to storage.\n   * Cursor behavior depends on the sixelScrolling option (DECSET 80).\n   */\n  public addImage(img: HTMLCanvasElement | ImageBitmap): void {\n    this._addImageOpts.scrolling = this._opts.sixelScrolling;\n    this._storage.addImage(img, this._addImageOpts);\n  }\n\n  /**\n   * Only advance text cursor.\n   * This is an edge case from empty sixels carrying only a height but no pixels.\n   * Partially fixes https://github.com/jerch/xterm-addon-image/issues/37.\n   */\n  public advanceCursor(height: number): void {\n    if (this._opts.sixelScrolling) {\n      let cellSize = this._renderer.cellSize;\n      if (cellSize.width === -1 || cellSize.height === -1) {\n        cellSize = CELL_SIZE_DEFAULT;\n      }\n      const rows = Math.ceil(height / cellSize.height);\n      for (let i = 1; i < rows; ++i) {\n        this._terminal._core._inputHandler.lineFeed();\n      }\n    }\n  }\n}\n", "/**\n * Copyright (c) 2023 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport { IAddImageOpts } from './Types';\nimport { ImageStorage } from './ImageStorage';\n\n/**\n * IIP (iTerm Image Protocol) specific image storage controller.\n *\n * Wraps the shared ImageStorage with IIP protocol semantics:\n * - Always uses scrolling mode (cursor advances with image)\n */\nexport class IIPImageStorage {\n  private _addImageOpts: IAddImageOpts = { scrolling: true, layer: 'top', zIndex: 0, cursorPos: 'iip' };\n  constructor(\n    private readonly _storage: ImageStorage\n  ) {}\n\n  /**\n   * Add an IIP image to storage.\n   * Always uses scrolling mode \u2014 cursor advances past the image.\n   */\n  public addImage(img: HTMLCanvasElement | ImageBitmap): void {\n    this._storage.addImage(img, this._addImageOpts);\n  }\n}\n", "/**\n * Copyright (c) 2020 The xterm.js authors. All rights reserved.\n * @license MIT\n */\n\nimport type { ITerminalAddon, IDisposable } from '@xterm/xterm';\nimport type { ImageAddon as IImageApi } from '@xterm/addon-image';\nimport { Emitter, type IEvent } from 'common/Event';\nimport { IIPHandler } from './IIPHandler';\nimport { ImageRenderer } from './ImageRenderer';\nimport { ImageStorage, CELL_SIZE_DEFAULT } from './ImageStorage';\nimport { KittyGraphicsHandler } from './kitty/KittyGraphicsHandler';\nimport { KittyImageStorage } from './kitty/KittyImageStorage';\nimport { SixelHandler } from './SixelHandler';\nimport { SixelImageStorage } from './SixelImageStorage';\nimport { IIPImageStorage } from './IIPImageStorage';\nimport { ITerminalExt, IImageAddonOptions, IResetHandler } from './Types';\n\n\n/**\n * Document VT features provided by this addon.\n *\n * @vt: #E[Supported via @xterm/addon-image.] DCS SIXEL \"SIXEL Graphics\"  \"DCS Ps ; Ps ; Ps ; q Pt ST\"  \"Draw SIXEL image.\"\n *\n * Sixel support is provided by the addon @xterm/addon-image with these limitations:\n * - immediate coloring (no shared palette, allows high color settings of `img2sixel`)\n * - max. palette size of 4096 colors\n * - max. pixel width of 16K\n * - max. 25 MB per sixel sequence\n * - VT340 cursor positioning (begin of last sixel data row)\n *\n * See [addon readme](https://github.com/xtermjs/xterm.js/tree/master/addons/addon-image) for more details.\n *\n *\n * @vt: #E[Supported via @xterm/addon-image.] OSC 1337  \"iTerm2 Commands\"   \"OSC 1337 ; Pt BEL\"  \"Custom iTerm2 commands.\"\n *\n * Only the inline image protocol (IIP) is supported by the addon @xterm/addon-image with\n * the following limitations:\n * - sequence:\n *   - format: `OSC 1337 ; File=inline=1 ; size=<unencoded size> ; ... : <base64 payload> BEL`\n *   - size param must be set and payload may not exceed CEIL(size * 4 / 3)\n *   - strict base64 handling as of RFC4648 \u00A74 (standard alphabet, optional padding,\n *     no separator bytes allowed)\n *   - supported params: size, name, width, height, preserveAspectRatio\n * - image formats: PNG, JPEG and GIF\n * - no animation support (renders first image of a GIF)\n * - no multipart support\n * - VT340 cursor positioning (begin of last sixel data row)\n *\n * See [addon readme](https://github.com/xtermjs/xterm.js/tree/master/addons/addon-image)\n * and [iTerm2 IIP docs](https://iterm2.com/documentation-images.html) for more details.\n *\n *\n * @vt: #E[Supported via @xterm/addon-image.] APC KITTY_GRAPHICS \"Kitty Graphics\"  \"APC G Pt ST\"  \"Kitty Graphics Protocol.\"\n *\n * Kitty graphics support is provided by the addon @xterm/addon-image.\n * Note that while basic image output already works, this is still work in progress.\n */\n\n// default values of addon ctor options\nconst DEFAULT_OPTIONS: IImageAddonOptions = {\n  enableSizeReports: true,\n  pixelLimit: 16777216, // limit to 4096 * 4096 pixels\n  sixelSupport: true,\n  sixelScrolling: true,\n  sixelPaletteLimit: 4096,\n  sixelSizeLimit: 33554432,\n  storageLimit: 128,\n  showPlaceholder: true,\n  iipSupport: true,\n  iipSizeLimit: 33554432,\n  kittySupport: true,\n  kittySizeLimit: 33554432\n};\n\n// max palette size supported by the sixel lib (compile time setting)\nconst MAX_SIXEL_PALETTE_SIZE = 4096;\n\n// definitions for _xtermGraphicsAttributes sequence\nconst enum GaItem {\n  COLORS = 1,\n  SIXEL_GEO = 2,\n  REGIS_GEO = 3\n}\nconst enum GaAction {\n  READ = 1,\n  SET_DEFAULT = 2,\n  SET = 3,\n  READ_MAX = 4\n}\nconst enum GaStatus {\n  SUCCESS = 0,\n  ITEM_ERROR = 1,\n  ACTION_ERROR = 2,\n  FAILURE = 3\n}\n\n\nexport class ImageAddon implements ITerminalAddon, IImageApi {\n  private _opts: IImageAddonOptions;\n  private _defaultOpts: IImageAddonOptions;\n  private _storage: ImageStorage | undefined;\n  private _renderer: ImageRenderer | undefined;\n  private _disposables: IDisposable[] = [];\n  private _terminal: ITerminalExt | undefined;\n  private _handlers: Map<String, IResetHandler> = new Map();\n  private readonly _onImageAdded = new Emitter<void>();\n  public readonly onImageAdded: IEvent<void> = this._onImageAdded.event;\n\n  constructor(opts?: Partial<IImageAddonOptions>) {\n    this._opts = Object.assign({}, DEFAULT_OPTIONS, opts);\n    this._defaultOpts = Object.assign({}, DEFAULT_OPTIONS, opts);\n  }\n\n  public dispose(): void {\n    for (const handler of this._handlers.values()) handler.reset();\n    for (const obj of this._disposables) {\n      obj.dispose();\n    }\n    this._disposables.length = 0;\n    this._handlers.clear();\n    this._onImageAdded.dispose();\n  }\n\n  private _disposeLater(...args: IDisposable[]): void {\n    for (const obj of args) {\n      this._disposables.push(obj);\n    }\n  }\n\n  public activate(terminal: ITerminalExt): void {\n    this._terminal = terminal;\n\n    // internal data structures\n    this._renderer = new ImageRenderer(terminal);\n    this._storage = new ImageStorage(terminal, this._renderer, this._opts);\n    this._storage.onImageAdded = () => this._onImageAdded.fire();\n\n    // enable size reports\n    if (this._opts.enableSizeReports) {\n      const windowOps = terminal.options.windowOptions ?? {};\n      windowOps.getWinSizePixels = true;\n      windowOps.getCellSizePixels = true;\n      windowOps.getWinSizeChars = true;\n      terminal.options.windowOptions = windowOps;\n    }\n\n    this._disposeLater(\n      this._renderer,\n      this._storage,\n\n      // DECSET/DECRST/DA1/XTSMGRAPHICS handlers\n      terminal.parser.registerCsiHandler({ prefix: '?', final: 'h' }, params => this._decset(params)),\n      terminal.parser.registerCsiHandler({ prefix: '?', final: 'l' }, params => this._decrst(params)),\n      terminal.parser.registerCsiHandler({ final: 'c' }, params => this._da1(params)),\n      terminal.parser.registerCsiHandler({ prefix: '?', final: 'S' }, params => this._xtermGraphicsAttributes(params)),\n\n      // render hook\n      terminal.onRender(range => this._storage?.render(range)),\n\n      /**\n       * reset handlers covered:\n       * - DECSTR\n       * - RIS\n       * - Terminal.reset()\n       */\n      terminal.parser.registerCsiHandler({ intermediates: '!', final: 'p' }, () => this.reset()),\n      terminal.parser.registerEscHandler({ final: 'c' }, () => this.reset()),\n      terminal._core._inputHandler.onRequestReset(() => this.reset()),\n\n      // wipe canvas and delete alternate images on buffer switch\n      terminal.buffer.onBufferChange(() => this._storage?.wipeAlternate()),\n\n      // extend images to the right on resize\n      terminal.onResize(metrics => this._storage?.viewportResize(metrics))\n    );\n\n    // SIXEL handler\n    if (this._opts.sixelSupport) {\n      const sixelStorage = new SixelImageStorage(this._storage!, this._opts, this._renderer!, terminal);\n      const sixelHandler = new SixelHandler(this._opts, sixelStorage, terminal);\n      this._handlers.set('sixel', sixelHandler);\n      this._disposeLater(\n        terminal._core._inputHandler._parser.registerDcsHandler({ final: 'q' }, sixelHandler)\n      );\n    }\n\n    // iTerm IIP handler\n    if (this._opts.iipSupport) {\n      const iipStorage = new IIPImageStorage(this._storage!);\n      const iipHandler = new IIPHandler(this._opts, this._renderer!, iipStorage, terminal);\n      this._handlers.set('iip', iipHandler);\n      this._disposeLater(\n        terminal._core._inputHandler._parser.registerOscHandler(1337, iipHandler)\n      );\n    }\n\n    // Kitty graphics handler\n    if (this._opts.kittySupport) {\n      const kittyStorage = new KittyImageStorage(this._storage!);\n      const kittyHandler = new KittyGraphicsHandler(this._opts, this._renderer!, kittyStorage, terminal);\n      this._handlers.set('kitty', kittyHandler);\n      this._disposeLater(\n        kittyStorage,\n        kittyHandler,\n        terminal._core._inputHandler._parser.registerApcHandler({ final: 'G' }, kittyHandler)\n      );\n    }\n  }\n\n  // Note: storageLimit is skipped here to not intoduce a surprising side effect.\n  public reset(): boolean {\n    // reset options customizable by sequences to defaults\n    this._opts.sixelScrolling = this._defaultOpts.sixelScrolling;\n    this._opts.sixelPaletteLimit = this._defaultOpts.sixelPaletteLimit;\n    // also clear image storage\n    this._storage?.reset();\n    // reset protocol handlers\n    for (const handler of this._handlers.values()) {\n      handler.reset();\n    }\n    return false;\n  }\n\n  public get storageLimit(): number {\n    return this._storage?.getLimit() || -1;\n  }\n\n  public set storageLimit(limit: number) {\n    this._storage?.setLimit(limit);\n    this._opts.storageLimit = limit;\n  }\n\n  public get storageUsage(): number {\n    if (this._storage) {\n      return this._storage.getUsage();\n    }\n    return -1;\n  }\n\n  public get showPlaceholder(): boolean {\n    return this._opts.showPlaceholder;\n  }\n\n  public set showPlaceholder(value: boolean) {\n    this._opts.showPlaceholder = value;\n    this._renderer?.showPlaceholder(value);\n  }\n\n  public getImageAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    return this._storage?.getImageAtBufferCell(x, y);\n  }\n\n  public extractTileAtBufferCell(x: number, y: number): HTMLCanvasElement | undefined {\n    return this._storage?.extractTileAtBufferCell(x, y);\n  }\n\n  private _report(s: string): void {\n    this._terminal?._core.input(s, false);\n  }\n\n  private _decset(params: (number | number[])[]): boolean {\n    for (let i = 0; i < params.length; ++i) {\n      switch (params[i]) {\n        case 80:\n          this._opts.sixelScrolling = false;\n          break;\n      }\n    }\n    return false;\n  }\n\n  private _decrst(params: (number | number[])[]): boolean {\n    for (let i = 0; i < params.length; ++i) {\n      switch (params[i]) {\n        case 80:\n          this._opts.sixelScrolling = true;\n          break;\n      }\n    }\n    return false;\n  }\n\n  // overload DA to return something more appropriate\n  private _da1(params: (number | number[])[]): boolean {\n    if (params[0]) {\n      return true;\n    }\n    // reported features:\n    // 62 - VT220\n    // 4 - SIXEL support\n    // 9 - charsets\n    // 22 - ANSI colors\n    if (this._opts.sixelSupport) {\n      this._report(`\\x1b[?62;4;9;22c`);\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * Implementation of xterm's graphics attribute sequence.\n   *\n   * Supported features:\n   * - read/change palette limits (max 4096 by sixel lib)\n   * - read SIXEL canvas geometry (reports current window canvas or\n   *   squared pixelLimit if canvas > pixel limit)\n   *\n   * Everything else is deactivated.\n   */\n  private _xtermGraphicsAttributes(params: (number | number[])[]): boolean {\n    if (params.length < 2) {\n      return true;\n    }\n    if (params[0] === GaItem.COLORS) {\n      switch (params[1]) {\n        case GaAction.READ:\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${this._opts.sixelPaletteLimit}S`);\n          return true;\n        case GaAction.SET_DEFAULT:\n          this._opts.sixelPaletteLimit = this._defaultOpts.sixelPaletteLimit;\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${this._opts.sixelPaletteLimit}S`);\n          // also reset protocol handlers for now\n          for (const handler of this._handlers.values()) {\n            handler.reset();\n          }\n          return true;\n        case GaAction.SET:\n          if (params.length > 2 && !(params[2] instanceof Array) && params[2] <= MAX_SIXEL_PALETTE_SIZE) {\n            this._opts.sixelPaletteLimit = params[2];\n            this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${this._opts.sixelPaletteLimit}S`);\n          } else {\n            this._report(`\\x1b[?${params[0]};${GaStatus.ACTION_ERROR}S`);\n          }\n          return true;\n        case GaAction.READ_MAX:\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${MAX_SIXEL_PALETTE_SIZE}S`);\n          return true;\n        default:\n          this._report(`\\x1b[?${params[0]};${GaStatus.ACTION_ERROR}S`);\n          return true;\n      }\n    }\n    if (params[0] === GaItem.SIXEL_GEO) {\n      switch (params[1]) {\n        // we only implement read and read_max here\n        case GaAction.READ:\n          let width = this._renderer?.dimensions?.css.canvas.width;\n          let height = this._renderer?.dimensions?.css.canvas.height;\n          if (!width || !height) {\n            // for some reason we have no working image renderer\n            // --> fallback to default cell size\n            const cellSize = CELL_SIZE_DEFAULT;\n            width = (this._terminal?.cols || 80) * cellSize.width;\n            height = (this._terminal?.rows || 24) * cellSize.height;\n          }\n          if (width * height < this._opts.pixelLimit) {\n            this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${width.toFixed(0)};${height.toFixed(0)}S`);\n          } else {\n            // if we overflow pixelLimit report that squared instead\n            const x = Math.floor(Math.sqrt(this._opts.pixelLimit));\n            this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${x};${x}S`);\n          }\n          return true;\n        case GaAction.READ_MAX:\n          // read_max returns pixelLimit as square area\n          const x = Math.floor(Math.sqrt(this._opts.pixelLimit));\n          this._report(`\\x1b[?${params[0]};${GaStatus.SUCCESS};${x};${x}S`);\n          return true;\n        default:\n          this._report(`\\x1b[?${params[0]};${GaStatus.ACTION_ERROR}S`);\n          return true;\n      }\n    }\n    // exit with error on ReGIS or any other requests\n    this._report(`\\x1b[?${params[0]};${GaStatus.ITEM_ERROR}S`);\n    return true;\n  }\n}\n"],
++  "mappings": ";;;;;;;;;;;;;;;;02BAYaA,EAAA,WAAa,IAAI,WAAW,IAAI,YAAY,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,IAAM,IAClFA,EAAA,YACF,QAAQ,KAAK,6EAA6E,EAI5F,SAAgBC,GAAIC,EAAW,CAC7B,OAAOA,EAAI,GACb,CAFAF,EAAA,IAAAC,GAIA,SAAgBE,GAAMD,EAAW,CAC/B,OAAQA,IAAM,EAAK,GACrB,CAFAF,EAAA,MAAAG,GAIA,SAAgBC,GAAKF,EAAW,CAC9B,OAAQA,IAAM,GAAM,GACtB,CAFAF,EAAA,KAAAI,GAIA,SAAgBC,GAAMH,EAAW,CAC/B,OAAQA,IAAM,GAAM,GACtB,CAFAF,EAAA,MAAAK,GAQA,SAAgBC,EAAW,EAAWC,EAAWC,EAAWC,EAAY,IAAG,CACzE,QAASA,EAAI,MAAS,IAAMD,EAAI,MAAS,IAAMD,EAAI,MAAS,EAAK,EAAI,OAAW,CAClF,CAFAP,EAAA,WAAAM,EAQA,SAAgBI,GAAaC,EAAe,CAC1C,MAAO,CAACA,EAAQ,IAAOA,GAAS,EAAK,IAAOA,GAAS,GAAM,IAAMA,IAAU,EAAE,CAC/E,CAFAX,EAAA,aAAAU,GASA,SAAgBE,GAAkBD,EAAiBE,EAAmB,CACpE,IAAMC,EAAIb,GAAIU,CAAK,EACbJ,EAAIJ,GAAMQ,CAAK,EACfH,EAAIJ,GAAKO,CAAK,EAEhBI,EAAM,OAAO,iBACbC,EAAM,GAGV,QAASC,EAAI,EAAGA,EAAIJ,EAAQ,OAAQ,EAAEI,EAAG,CACvC,IAAMC,EAAKJ,EAAID,EAAQI,CAAC,EAAE,CAAC,EACrBE,EAAKZ,EAAIM,EAAQI,CAAC,EAAE,CAAC,EACrBG,EAAKZ,EAAIK,EAAQI,CAAC,EAAE,CAAC,EACrBI,EAAIH,EAAKA,EAAKC,EAAKA,EAAKC,EAAKA,EACnC,GAAI,CAACC,EAAG,OAAOJ,EACXI,EAAIN,IACNA,EAAMM,EACNL,EAAMC,GAIV,OAAOD,CACT,CAtBAhB,EAAA,kBAAAY,GA4BA,SAASU,GAAMC,EAAaC,EAAcC,EAAa,CACrD,OAAO,KAAK,IAAIF,EAAK,KAAK,IAAIE,EAAOD,CAAI,CAAC,CAC5C,CAEA,SAASE,GAAIC,EAAYC,EAAYC,EAAS,CAC5C,OAAIA,EAAI,IAAGA,GAAK,GACZA,EAAI,IAAGA,GAAK,GACTA,EAAI,EAAI,EACXD,GAAMD,EAAKC,GAAM,EAAIC,EACrBA,EAAI,EAAI,EACNF,EACAE,EAAI,EAAI,EACND,GAAMD,EAAKC,IAAO,EAAIC,EAAI,GAC1BD,CACV,CAEA,SAASE,GAASC,EAAWC,EAAWC,EAAS,CAC/C,GAAI,CAACA,EAAG,CACN,IAAMC,EAAI,KAAK,MAAMF,EAAI,GAAG,EAC5B,OAAO1B,EAAW4B,EAAGA,EAAGA,CAAC,EAE3B,IAAMP,EAAKK,EAAI,GAAMA,GAAK,EAAIC,GAAKD,EAAIC,EAAID,EAAIC,EACzCL,EAAK,EAAII,EAAIL,EACnB,OAAOrB,EACLgB,GAAM,EAAG,IAAK,KAAK,MAAMI,GAAIC,EAAIC,EAAIG,EAAI,EAAI,CAAC,EAAI,GAAG,CAAC,EACtDT,GAAM,EAAG,IAAK,KAAK,MAAMI,GAAIC,EAAIC,EAAIG,CAAC,EAAI,GAAG,CAAC,EAC9CT,GAAM,EAAG,IAAK,KAAK,MAAMI,GAAIC,EAAIC,EAAIG,EAAI,EAAI,CAAC,EAAI,GAAG,CAAC,CAAC,CAE3D,CAKA,SAAgBI,EAAa,EAAW5B,EAAWC,EAAS,CAC1D,OAAQ,WAAa,KAAK,MAAMA,EAAI,IAAM,GAAG,GAAK,GAAK,KAAK,MAAMD,EAAI,IAAM,GAAG,GAAK,EAAI,KAAK,MAAM,EAAI,IAAM,GAAG,KAAO,CACzH,CAFAP,EAAA,aAAAmC,EAQA,SAAgBC,GAAaL,EAAWC,EAAWC,EAAS,CAE1D,OAAOH,IAAUC,EAAI,IAAM,KAAO,IAAKC,EAAI,IAAKC,EAAI,GAAG,CACzD,CAHAjC,EAAA,aAAAoC,GAqCapC,EAAA,oBAAsB,IAAI,YAAY,CACjDmC,EAAc,EAAI,EAAI,CAAC,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACxB,EA0BYnC,EAAA,mBAAqB,IAAI,YAAY,CAChDmC,EAAc,EAAI,EAAI,CAAC,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAc,EAAI,EAAI,CAAC,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAc,EAAI,EAAI,CAAC,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAc,EAAI,EAAI,CAAC,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACvBA,EAAa,GAAI,GAAI,EAAE,EACxB,EAOYnC,EAAA,kBAAoB,IAAK,CAEpC,IAAMqC,EAAgB,CACpB/B,EAAW,EAAG,EAAG,CAAC,EAClBA,EAAW,IAAK,EAAG,CAAC,EACpBA,EAAW,EAAG,IAAK,CAAC,EACpBA,EAAW,IAAK,IAAK,CAAC,EACtBA,EAAW,EAAG,EAAG,GAAG,EACpBA,EAAW,IAAK,EAAG,GAAG,EACtBA,EAAW,EAAG,IAAK,GAAG,EACtBA,EAAW,IAAK,IAAK,GAAG,EACxBA,EAAW,IAAK,IAAK,GAAG,EACxBA,EAAW,IAAK,EAAG,CAAC,EACpBA,EAAW,EAAG,IAAK,CAAC,EACpBA,EAAW,IAAK,IAAK,CAAC,EACtBA,EAAW,GAAI,GAAI,GAAG,EACtBA,EAAW,IAAK,EAAG,GAAG,EACtBA,EAAW,EAAG,IAAK,GAAG,EACtBA,EAAW,IAAK,IAAK,GAAG,GAGpBe,EAAI,CAAC,EAAG,GAAI,IAAK,IAAK,IAAK,GAAG,EACpC,QAASP,EAAI,EAAGA,EAAI,EAAG,EAAEA,EACvB,QAASP,EAAI,EAAGA,EAAI,EAAG,EAAEA,EACvB,QAASC,EAAI,EAAGA,EAAI,EAAG,EAAEA,EACvB6B,EAAE,KAAK/B,EAAWe,EAAEP,CAAC,EAAGO,EAAEd,CAAC,EAAGc,EAAEb,CAAC,CAAC,CAAC,EAKzC,QAAS0B,EAAI,EAAGA,GAAK,IAAKA,GAAK,GAC7BG,EAAE,KAAK/B,EAAW4B,EAAGA,EAAGA,CAAC,CAAC,EAE5B,OAAO,IAAI,YAAYG,CAAC,CAC1B,GAAE,EASWrC,EAAA,mBAA+BM,EAAW,EAAG,EAAG,EAAG,GAAG,EACtDN,EAAA,mBAA+BM,EAAW,IAAK,IAAK,IAAK,GAAG,IChRzE,IAAAgC,GAAAC,EAAAC,IAAA,cAKA,OAAO,eAAeA,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EAC5DA,GAAQ,OAASC,GACjB,IAAIC,EAAKC,GAAM,CACX,GAAI,WAAW,WACX,OAAO,WAAW,WAAWA,CAAC,EAClC,GAAI,OAAO,OAAW,IAClB,OAAO,OAAO,KAAKA,EAAG,QAAQ,EAClC,IAAMC,EAAI,KAAKD,CAAC,EACVE,EAAI,IAAI,WAAWD,EAAE,MAAM,EACjC,QAAS,EAAI,EAAG,EAAIC,EAAE,OAAQ,EAAE,EAC5BA,EAAE,CAAC,EAAID,EAAE,WAAW,CAAC,EACzB,OAAOC,CACX,EACA,SAASJ,GAAOK,EAAK,CACjB,GAAIA,EAAI,EAAG,CACP,GAAM,CAAE,EAAAC,EAAG,EAAAJ,EAAG,EAAAK,CAAE,EAAIF,EAChBF,EACAK,EACEC,EAAI,YACV,OAAIH,IAAM,EACFJ,EACQQ,GAAM,IAAID,EAAE,SAASD,IAAMA,EAAI,IAAIC,EAAE,OAAON,IAAMA,EAAIF,EAAEM,CAAC,EAAE,GAAIG,CAAC,EACpEA,GAAMF,EACRC,EAAE,YAAYD,EAAGE,CAAC,EAClBD,EAAE,YAAYN,IAAMA,EAAIF,EAAEM,CAAC,GAAIG,CAAC,EAAE,KAAKN,IAAMI,EAAIJ,EAAE,SAAWA,EAAE,QAAQ,EAE9EE,IAAM,EACFJ,EACO,IAAMM,IAAMA,EAAI,IAAIC,EAAE,OAAON,IAAMA,EAAIF,EAAEM,CAAC,EAAE,GAChD,IAAMC,EACP,QAAQ,QAAQA,CAAC,EACjBC,EAAE,QAAQN,IAAMA,EAAIF,EAAEM,CAAC,EAAE,EAAE,KAAKH,GAAKI,EAAIJ,CAAC,EAEhDF,EACO,IAAMC,IAAMA,EAAIF,EAAEM,CAAC,GACvB,IAAM,QAAQ,QAAQJ,IAAMA,EAAIF,EAAEM,CAAC,EAAE,CAChD,CACA,GAAI,OAAO,SAAa,IACpB,MAAM,IAAI,MAAM,mBAAmB,EACvC,SAAS,IAAIF,CAAG,CACpB,IC7CA,IAAAM,GAAAC,EAAAC,IAAA,cACA,OAAO,eAAeA,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EAK5D,IAAMC,GAAmB,KAInBC,MAAiBD,GAAiB,QAAuD,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,0lCAA0lC,CAA8C,EAuJ5uCE,EAAM,IAAI,WAAW,mEACtB,MAAM,EAAE,EACR,IAAIC,GAAMA,EAAG,WAAW,CAAC,CAAC,CAAC,EAE1BC,EAAI,IAAI,YAAY,IAAI,EAC9BA,EAAE,KAAK,UAAU,EACjB,QAASC,EAAI,EAAGA,EAAIH,EAAI,OAAQ,EAAEG,EAC9BD,EAAEF,EAAIG,CAAC,CAAC,EAAIA,GAAK,EACrB,QAASA,EAAI,EAAGA,EAAIH,EAAI,OAAQ,EAAEG,EAC9BD,EAAE,IAAMF,EAAIG,CAAC,CAAC,EAAIA,GAAK,GAAMA,GAAK,EAAK,MAAS,EACpD,QAASA,EAAI,EAAGA,EAAIH,EAAI,OAAQ,EAAEG,EAC9BD,EAAE,IAAMF,EAAIG,CAAC,CAAC,EAAKA,GAAK,GAAM,GAAMA,GAAK,EAAK,MAAS,GAC3D,QAASA,EAAI,EAAGA,EAAIH,EAAI,OAAQ,EAAEG,EAC9BD,EAAE,IAAMF,EAAIG,CAAC,CAAC,EAAIA,GAAK,GAC3B,IAAMC,GAAQ,IAAI,WAAW,CAAC,EAWxBC,GAAN,KAAoB,CAMhB,YAAYC,EAAUC,EAAUC,EAAc,CAO1C,GANA,KAAK,MAAQ,KACb,KAAK,OAAS,GACd,KAAK,OAAS,EACd,KAAK,SAAWF,GAAsD,QACtE,KAAK,SAAWC,GAAsD,WACtE,KAAK,OAASC,GAAkE,MAC5E,KAAK,OAAS,KAAK,UAAY,KAAK,SAAW,WAC/C,MAAM,IAAI,MAAM,uBAAuB,CAE/C,CAKA,IAAI,OAAQ,CACR,OAAO,KAAK,MAAQ,KAAK,GAAG,SAAS,EAAG,KAAK,KAAK,IAAuB,CAAC,EAAIJ,EAClF,CAMA,SAAU,CACD,KAAK,QAEN,KAAK,OAAS,KAAK,SACnB,KAAK,MAAQ,KAAK,KAAO,KAAK,GAAK,KAAK,KAAO,MAG/C,KAAK,KAAK,IAAuB,EAAI,EACrC,KAAK,KAAK,IAAuB,EAAI,EACrC,KAAK,KAAK,IAAuB,EAAI,GAE7C,CASA,KAAKG,EAAUC,EAAc,CAGzB,GAFA,KAAK,SAAWD,GAAsD,KAAK,SAC3E,KAAK,OAASC,GAAkE,KAAK,IAAI,KAAK,OAAQ,KAAK,QAAQ,EAC/G,KAAK,OAAS,KAAK,UAAY,KAAK,SAAW,WAC/C,MAAM,MAAM,uBAAuB,EAEvC,IAAIC,EAAI,KAAK,KACPC,EAAQ,KAAK,OAAS,KACvB,KAAK,MAOD,KAAK,KAAK,OAAO,WAAaA,IACnC,KAAK,KAAK,KAAK,KAAK,MAAMA,EAAQ,KAAK,KAAK,OAAO,YAAc,KAAK,CAAC,EACvED,EAAI,IAAI,YAAY,KAAK,KAAK,OAAQ,CAAC,EACvC,KAAK,GAAK,IAAI,WAAW,KAAK,KAAK,OAAQ,IAA6B,IATxE,KAAK,KAAO,IAAI,YAAY,OAAO,CAAE,QAAS,KAAK,KAAKC,EAAQ,KAAK,CAAE,CAAC,EACxE,KAAK,MAAQX,GAAW,CAAE,IAAK,CAAE,OAAQ,KAAK,IAAK,CAAE,CAAC,EACtDU,EAAI,IAAI,YAAY,KAAK,KAAK,OAAQ,CAAC,EACvCA,EAAE,IAAIP,EAAG,GAAgB,EACzB,KAAK,GAAK,IAAI,WAAW,KAAK,KAAK,OAAQ,IAA6B,GAO5EO,EAAE,IAAuB,EAAI,EAC7BA,EAAE,IAAuB,EAAI,EAC7BA,EAAE,IAAuB,EAAI,EAC7B,KAAK,KAAOA,EACZ,KAAK,OAAS,EAClB,CAOA,SAASE,EAAW,CAChB,IAAMC,EAAS,KAAK,KAAK,IAAuB,EAAID,EACpD,GAAI,KAAK,OAASC,EAAQ,CACtB,GAAIA,EAAS,KAAK,SACd,MAAO,GAEX,IAAIC,EAAU,KAAK,OACnB,MAAQA,GAAW,GAAKD,GAAQ,CAEhC,GADAC,EAAU,KAAK,IAAIA,EAAS,KAAK,QAAQ,EACrCA,EAAUD,EACV,MAAO,GAEX,GAAIC,EAAU,KAAgC,KAAK,KAAK,OAAO,WAAY,CACvE,IAAMC,EAAW,KAAK,MAAMD,EAAU,KAAgC,KAAK,KAAK,OAAO,YAAc,KAAK,EAC1G,KAAK,KAAK,KAAKC,CAAQ,EACvB,KAAK,KAAO,IAAI,YAAY,KAAK,KAAK,OAAQ,CAAC,EAC/C,KAAK,GAAK,IAAI,WAAW,KAAK,KAAK,OAAQ,IAA6B,CAC5E,CACA,KAAK,OAASD,CAClB,CACA,MAAO,EACX,CAOA,IAAIE,EAAM,CACN,GAAI,CAAC,KAAK,OAAS,KAAK,OACpB,MAAO,GAEX,GAAI,KAAK,SAASA,EAAK,MAAM,EACzB,MAAO,GAEX,IAAMN,EAAI,KAAK,KACf,YAAK,GAAG,IAAIM,EAAMN,EAAE,IAAuB,CAAC,EAC5CA,EAAE,IAAuB,GAAKM,EAAK,OAE5BN,EAAE,IAAuB,EAAIA,EAAE,IAAuB,GAAK,OAC5D,KAAK,MAAM,QAAQ,IAAI,EACvB,CACV,CAKA,KAAM,CACF,YAAK,OAAS,GACP,KAAK,MACN,KAAK,MAAM,QAAQ,IAAI,EACvB,EACV,CAIA,IAAI,aAAc,CACd,OAAO,KAAK,MACN,KAAK,KAAK,IAAuB,EACjC,CACV,CAIA,IAAI,WAAY,CACZ,OAAO,KAAK,MACN,KAAK,SAAW,KAAK,KAAK,IAAuB,EACjD,CACV,CACJ,EACAZ,GAAQ,QAAUQ,KCjVlB,IAAAW,GAAAC,EAAAC,IAAA,cACA,OAAO,eAAeA,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EAK5D,IAAMC,GAAmB,KACnBC,MAAoBD,GAAiB,QAA2D,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,84BAA84B,CAAkD,EAC3iCE,GAAN,KAAiB,CACb,YAAYC,EAAU,CAClB,KAAK,SAAWA,EAChB,KAAK,MAAQ,EACb,KAAK,OAAS,CAClB,CACA,OAAOC,EAAG,CACN,KAAK,MAAQA,EAAE,CAAC,GAAK,GAAKA,EAAE,CAAC,GAAK,GAAKA,EAAE,CAAC,GAAK,EAAIA,EAAE,CAAC,EACtD,KAAK,OAASA,EAAE,CAAC,GAAK,GAAKA,EAAE,CAAC,GAAK,GAAKA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,EACzD,IAAMC,EAAS,KAAK,MAAQ,KAAK,OAC3BC,EAAKD,EAAS,EACdE,EAAKH,EAAE,OAwBPI,EAAQ,KAAK,IAAIF,EAAIC,CAAE,GAAK,KAAK,IAAID,EAAIC,CAAE,GAAK,GAAK,KACtD,KAAK,MAID,KAAK,KAAK,OAAO,WAAaC,IACnC,KAAK,KAAK,KAAK,KAAK,MAAMA,EAAQ,KAAK,KAAK,OAAO,YAAc,KAAK,CAAC,EACvE,KAAK,GAAK,OALV,KAAK,KAAO,IAAI,YAAY,OAAO,CAAE,QAAS,KAAK,KAAKA,EAAQ,KAAK,CAAE,CAAC,EACxE,KAAK,MAAQP,GAAc,CAAE,IAAK,CAAE,OAAQ,KAAK,IAAK,CAAE,CAAC,GAMxD,KAAK,KACN,KAAK,GAAK,IAAI,WAAW,KAAK,KAAK,MAAM,GAG7C,IAAMQ,EAAU,KAAK,KAAK,OAAO,WAAaF,EAAM,KACpD,YAAK,GAAG,IAAIH,EAAGK,CAAM,EACrB,KAAK,MAAM,QAAQ,IAAIA,EAAQF,EAAIF,CAAM,EAClC,KAAK,GAAG,SAAS,KAAqB,KAAsBC,CAAE,CACzE,CACA,SAAU,CACD,KAAK,OAEN,KAAK,KAAK,OAAO,WAAa,KAAK,WACnC,KAAK,MAAQ,KAAK,GAAK,KAAK,KAAO,KAE3C,CACJ,EACAP,GAAQ,QAAUG,mGCpELQ,GAAA,OAAS,CACpB,WAAY,MACZ,aAAc,KACd,UAAW,MACX,MAAO,wtdCCT,IAAAC,EAAA,IACAC,EAAA,KAIA,SAASC,GAAaC,EAAS,CAC7B,GAAI,OAAO,OAAW,IACpB,OAAO,OAAO,KAAKA,EAAG,QAAQ,EAEhC,IAAMC,EAAa,KAAKD,CAAC,EACnBE,EAAS,IAAI,WAAWD,EAAW,MAAM,EAC/C,QAAS,EAAI,EAAG,EAAIC,EAAO,OAAQ,EAAE,EACnCA,EAAO,CAAC,EAAID,EAAW,WAAW,CAAC,EAErC,OAAOC,CACT,CAEA,IAAMC,GAAaJ,GAAaD,EAAA,OAAO,KAAK,EACxCM,EAGEC,GAAc,IAAI,YAIlBC,GAAN,KAAmB,CAAnB,aAAA,CACS,KAAA,YAAeC,GAAkB,EACjC,KAAA,YAAeC,GAAoB,CAO5C,CANS,YAAYD,EAAa,CAC9B,OAAO,KAAK,YAAYA,CAAK,CAC/B,CACO,YAAYC,EAAY,CAC7B,OAAO,KAAK,YAAYA,CAAI,CAC9B,GAKIC,GAA2C,CAC/C,YAAa,KAAO,MACpB,WAAYZ,EAAA,mBACZ,UAAWA,EAAA,mBACX,QAASA,EAAA,oBACT,aAAcC,EAAA,OAAO,aACrB,SAAU,IAQZ,SAAgBY,GAAaC,EAAsB,CACjD,IAAMC,EAAU,IAAIN,GACdO,EAAY,CAChB,IAAK,CACH,YAAaD,EAAQ,YAAY,KAAKA,CAAO,EAC7C,YAAaA,EAAQ,YAAY,KAAKA,CAAO,IAGjD,OAAO,YAAY,YAAYR,GAAeD,GAAYU,CAAS,EAChE,KAAMC,IACLV,EAAcA,GAAeU,EAAK,OAC3B,IAAIC,EAAQJ,EAAMG,EAAK,UAAYA,EAAMF,CAAO,EACxD,CACL,CAbAI,EAAA,aAAAN,GAgDA,IAAaK,EAAb,KAAoB,CAwGlB,YACEJ,EACAM,EACAC,EAAwB,CAGxB,GAvGM,KAAA,cAAgBpB,EAAA,OAAO,UAAY,EAEnC,KAAA,QAAuBO,GACvB,KAAA,YAAwB,CAAA,EACxB,KAAA,UAAY,EACZ,KAAA,UAAYP,EAAA,OAAO,UACnB,KAAA,YAAc,EACd,KAAA,eAAiB,EA+FvB,KAAK,MAAQ,OAAO,OAAO,CAAA,EAAIW,GAAiBE,CAAI,EAChD,KAAK,MAAM,aAAeb,EAAA,OAAO,aACnC,MAAM,IAAI,MAAM,+CAA+CA,EAAA,OAAO,YAAY,EAAE,EAEtF,GAAKmB,EASHC,EAAU,YAAc,KAAK,aAAa,KAAK,IAAI,EACnDA,EAAU,YAAc,KAAK,YAAY,KAAK,IAAI,MAVpC,CACd,IAAMC,EAASf,IAAgBA,EAAc,IAAI,YAAY,OAAOD,EAAU,GAC9Ec,EAAY,IAAI,YAAY,SAASE,EAAQ,CAC3C,IAAK,CACH,YAAa,KAAK,aAAa,KAAK,IAAI,EACxC,YAAa,KAAK,YAAY,KAAK,IAAI,GAE1C,EAKH,KAAK,UAAYF,EACjB,KAAK,MAAQ,KAAK,UAAU,QAC5B,KAAK,OAAS,IAAI,WAAW,KAAK,MAAM,OAAO,OAAQ,KAAK,MAAM,kBAAiB,EAAInB,EAAA,OAAO,UAAU,EACxG,KAAK,QAAU,IAAI,YAAY,KAAK,MAAM,OAAO,OAAQ,KAAK,MAAM,kBAAiB,EAAI,EAAE,EAC3F,KAAK,SAAW,IAAI,YAAY,KAAK,MAAM,OAAO,OAAQ,KAAK,MAAM,oBAAmB,EAAIA,EAAA,OAAO,YAAY,EAC/G,KAAK,SAAS,IAAI,KAAK,MAAM,OAAO,EACpC,KAAK,MAAQ,IAAI,YAAY,KAAK,MAAM,OAAO,OAAQ,KAAK,MAAM,eAAc,CAAE,EAClF,KAAK,MAAM,KAAKD,EAAA,mBAAoB,EAAG,KAAK,MAAM,aAAc,CAAC,CACnE,CApHA,IAAY,YAAU,CAAe,OAAO,KAAK,QAAQ,CAAC,CAAG,CAC7D,IAAY,WAAS,CAAa,OAAO,KAAK,QAAQ,CAAC,CAAG,CAC1D,IAAY,cAAY,CAAa,OAAO,KAAK,QAAQ,CAAC,CAAG,CAC7D,IAAY,eAAa,CAAa,OAAO,KAAK,QAAQ,CAAC,CAAG,CAC9D,IAAY,QAAM,CAAa,OAAO,KAAK,QAAQ,CAAC,EAAI,KAAK,QAAQ,CAAC,EAAI,EAAI,CAAG,CACjF,IAAY,SAAO,CAAa,OAAO,KAAK,QAAQ,CAAC,CAAG,CACxD,IAAY,QAAM,CAAa,OAAO,KAAK,QAAQ,CAAC,CAAG,CACvD,IAAY,OAAK,CAAgB,OAAO,KAAK,QAAQ,EAAE,CAAG,CAC1D,IAAY,eAAa,CAAa,OAAO,KAAK,QAAQ,EAAE,CAAG,CAEvD,YAAYW,EAAe,CACjC,GAAIA,IAAI,EAAmB,CACzB,IAAMY,EAAS,KAAK,MAAQ,KAAK,OACjC,GAAIA,EAAS,KAAK,QAAQ,OAAQ,CAChC,GAAI,KAAK,MAAM,aAAeA,EAAS,EAAI,KAAK,MAAM,YACpD,WAAK,QAAO,EACN,IAAI,MAAM,4BAA4B,EAE9C,KAAK,QAAU,IAAI,YAAYA,CAAM,EAEvC,KAAK,UAAY,KAAK,eACbZ,IAAI,EACb,GAAI,KAAK,SAAW,EAAG,CAErB,IAAMY,EAAS,KAAK,IAAI,KAAK,aAActB,EAAA,OAAO,SAAS,EAAI,KAAK,cACpE,GAAIsB,EAAS,KAAK,QAAQ,OAAQ,CAChC,GAAI,KAAK,MAAM,aAAeA,EAAS,EAAI,KAAK,MAAM,YACpD,WAAK,QAAO,EACN,IAAI,MAAM,4BAA4B,EAE9C,KAAK,QAAU,IAAI,YAAYA,CAAM,QAInC,KAAK,QAAQ,OAAS,QACxB,KAAK,QAAU,IAAI,YAAY,KAAK,GAI1C,MAAO,EACT,CAEQ,SAASC,EAAgBC,EAAwB,CACvD,IAAMF,EAASC,EAASC,EACxB,GAAIF,EAAS,KAAK,QAAQ,OAAQ,CAChC,GAAI,KAAK,MAAM,aAAeA,EAAS,EAAI,KAAK,MAAM,YACpD,WAAK,QAAO,EACN,IAAI,MAAM,4BAA4B,EAG9C,IAAMG,EAAY,IAAI,YAAY,KAAK,KAAKH,EAAS,KAAK,EAAI,KAAK,EACnEG,EAAU,IAAI,KAAK,OAAO,EAC1B,KAAK,QAAUA,EAEnB,CAEQ,aAAahB,EAAa,CAChC,IAAMiB,EAAM,KAAK,cACbH,EAAS,KAAK,YAClB,GAAI,KAAK,QAAK,EAAmB,CAC/B,IAAII,EAAY,KAAK,OAAS,KAAK,eAC/BC,EAAI,EACR,KAAOA,EAAI,GAAKD,EAAY,GAC1B,KAAK,QAAQ,IAAI,KAAK,MAAM,SAASD,EAAME,EAAGF,EAAME,EAAInB,CAAK,EAAGc,EAASd,EAAQmB,CAAC,EAClFA,IACAD,IAEF,KAAK,aAAelB,EAAQmB,EAC5B,KAAK,gBAAkBA,UACd,KAAK,QAAK,EAAmB,CACtC,KAAK,SAASL,EAAQd,EAAQ,CAAC,EAC/B,KAAK,UAAY,KAAK,IAAI,KAAK,UAAWA,CAAK,EAC/C,KAAK,UAAY,KAAK,IAAI,KAAK,UAAWA,CAAK,EAC/C,QAASoB,EAAI,EAAGA,EAAI,EAAG,EAAEA,EACvB,KAAK,QAAQ,IAAI,KAAK,MAAM,SAASH,EAAMG,EAAGH,EAAMG,EAAIpB,CAAK,EAAGc,EAASd,EAAQoB,CAAC,EAEpF,KAAK,YAAY,KAAKpB,CAAK,EAC3B,KAAK,aAAeA,EAAQ,EAC5B,KAAK,gBAAkB,EAEzB,MAAO,EACT,CA0CA,IAAW,OAAK,CACd,OAAO,KAAK,QAAK,EACb,KAAK,OACL,KAAK,IAAI,KAAK,UAAW,KAAK,MAAM,cAAa,CAAE,CACzD,CAOA,IAAW,QAAM,CACf,OAAO,KAAK,QAAK,EACb,KAAK,QACL,KAAK,MAAM,cAAa,EACtB,KAAK,YAAY,OAAS,EAAI,KAAK,MAAM,eAAc,EACvD,KAAK,YAAY,OAAS,CAClC,CAKA,IAAW,SAAO,CAChB,OAAO,KAAK,SAAS,SAAS,EAAG,KAAK,aAAa,CACrD,CAWA,IAAW,aAAW,CACpB,OAAO,KAAK,QAAQ,WAAa,KAAK,MAAM,OAAO,OAAO,WAAa,EAAI,KAAK,YAAY,MAC9F,CAKA,IAAW,YAAU,CACnB,MAAO,CACL,MAAO,KAAK,MACZ,OAAQ,KAAK,OACb,KAAM,KAAK,MACX,MAAO,KAAK,OACZ,SAAU,CAAC,CAAC,KAAK,UACjB,aAAc,KAAK,cACnB,UAAW,KAAK,WAChB,SAAU,KAAK,YACf,iBAAkB,CAChB,UAAW,KAAK,QAAQ,CAAC,EACzB,YAAa,KAAK,QAAQ,CAAC,EAC3B,MAAO,KAAK,aACZ,OAAQ,KAAK,eAGnB,CAOO,KACLqB,EAAsB,KAAK,MAAM,UACjCC,EAA8B,KAAK,MAAM,QACzCC,EAAuB,KAAK,MAAM,aAClCC,EAAoB,KAAK,MAAM,SAAQ,CAEvC,KAAK,MAAM,KAAK,KAAK,MAAM,WAAYH,EAAWE,EAAcC,EAAW,EAAI,CAAC,EAC5EF,GACF,KAAK,SAAS,IAAIA,EAAQ,SAAS,EAAG/B,EAAA,OAAO,YAAY,CAAC,EAE5D,KAAK,YAAY,OAAS,EAC1B,KAAK,UAAY,EACjB,KAAK,UAAYA,EAAA,OAAO,UACxB,KAAK,YAAc,EACnB,KAAK,eAAiB,CACxB,CAMO,OAAOkC,EAAsBC,EAAgB,EAAGC,EAAcF,EAAK,OAAM,CAC9E,IAAIG,EAAIF,EACR,KAAOE,EAAID,GAAK,CACd,IAAME,EAAS,KAAK,IAAIF,EAAMC,EAAGrC,EAAA,OAAO,UAAU,EAClD,KAAK,OAAO,IAAIkC,EAAK,SAASG,EAAGA,GAAKC,CAAM,CAAC,EAC7C,KAAK,MAAM,OAAO,EAAGA,CAAM,EAE/B,CAOO,aAAaJ,EAAcC,EAAgB,EAAGC,EAAcF,EAAK,OAAM,CAC5E,IAAIG,EAAIF,EACR,KAAOE,EAAID,GAAK,CACd,IAAME,EAAS,KAAK,IAAIF,EAAMC,EAAGrC,EAAA,OAAO,UAAU,EAClD,QAAS6B,EAAI,EAAGU,EAAIF,EAAGR,EAAIS,EAAQ,EAAET,EAAG,EAAEU,EACxC,KAAK,OAAOV,CAAC,EAAIK,EAAK,WAAWK,CAAC,EAEpCF,GAAKC,EACL,KAAK,MAAM,OAAO,EAAGA,CAAM,EAE/B,CAMA,IAAW,QAAM,CACf,GAAI,KAAK,QAAK,GAAqB,CAAC,KAAK,OAAS,CAAC,KAAK,OACtD,OAAO/B,GAIT,IAAMiC,EAAe,KAAK,MAAM,cAAa,EAE7C,GAAI,KAAK,QAAK,EAAmB,CAC/B,IAAIb,EAAY,KAAK,OAAS,KAAK,eACnC,GAAIA,EAAY,EAAG,CACjB,IAAMD,EAAM,KAAK,cACbH,EAAS,KAAK,YACdK,EAAI,EACR,KAAOA,EAAI,GAAKD,EAAY,GAC1B,KAAK,QAAQ,IAAI,KAAK,MAAM,SAASD,EAAME,EAAGF,EAAME,EAAIY,CAAY,EAAGjB,EAASiB,EAAeZ,CAAC,EAChGA,IACAD,IAEEA,GACF,KAAK,QAAQ,KAAK,KAAK,WAAYJ,EAASiB,EAAeZ,CAAC,EAGhE,OAAO,KAAK,QAAQ,SAAS,EAAG,KAAK,MAAQ,KAAK,MAAM,EAG1D,GAAI,KAAK,QAAK,EAAmB,CAC/B,GAAI,KAAK,YAAc,KAAK,UAAW,CACrC,IAAIa,EAAS,GACb,GAAID,EACF,GAAIA,IAAiB,KAAK,UACxBC,EAAS,OACJ,CACL,IAAMf,EAAM,KAAK,cACbH,EAAS,KAAK,YAClB,KAAK,SAASA,EAAQiB,EAAe,CAAC,EACtC,QAASX,EAAI,EAAGA,EAAI,EAAG,EAAEA,EACvB,KAAK,QAAQ,IAAI,KAAK,MAAM,SAASH,EAAMG,EAAGH,EAAMG,EAAIW,CAAY,EAAGjB,EAASiB,EAAeX,CAAC,EAItG,GAAI,CAACY,EACH,OAAO,KAAK,QAAQ,SAAS,EAAG,KAAK,MAAQ,KAAK,MAAM,EAM5D,IAAMC,EAAQ,IAAI,YAAY,KAAK,MAAQ,KAAK,MAAM,EACtDA,EAAM,KAAK,KAAK,UAAU,EAC1B,IAAIC,EAAc,EACdR,EAAQ,EACZ,QAASN,EAAI,EAAGA,EAAI,KAAK,YAAY,OAAQ,EAAEA,EAAG,CAChD,IAAMe,EAAK,KAAK,YAAYf,CAAC,EAC7B,QAASQ,EAAI,EAAGA,EAAI,EAAG,EAAEA,EACvBK,EAAM,IAAI,KAAK,QAAQ,SAASP,EAAOA,GAASS,CAAE,EAAGD,CAAW,EAChEA,GAAe,KAAK,MAIxB,GAAIH,EAAc,CAChB,IAAMd,EAAM,KAAK,cAEXmB,EAAgB,KAAK,MAAM,eAAc,EAC/C,QAAShB,EAAI,EAAGA,EAAIgB,EAAe,EAAEhB,EACnCa,EAAM,IAAI,KAAK,MAAM,SAAShB,EAAMG,EAAGH,EAAMG,EAAIW,CAAY,EAAGG,EAAc,KAAK,MAAQd,CAAC,EAGhG,OAAOa,EAIT,OAAOnC,EACT,CAMA,IAAW,OAAK,CACd,OAAO,IAAI,kBAAkB,KAAK,OAAO,OAAQ,EAAG,KAAK,MAAQ,KAAK,OAAS,CAAC,CAClF,CAcO,SAAO,CACZ,KAAK,QAAUA,GACf,KAAK,YAAY,OAAS,EAC1B,KAAK,UAAY,EACjB,KAAK,UAAYP,EAAA,OAAO,UAGxB,KAAK,MAAM,KAAKD,EAAA,mBAAoB,EAAG,KAAK,MAAM,aAAc,CAAC,CACnE,GAxWFmB,EAAA,QAAAD,EA2XC,SAAgB6B,GACfZ,EACArB,EAAsB,CAEtB,IAAMkC,EAAM,IAAI9B,EAAQJ,CAAI,EAC5B,OAAAkC,EAAI,KAAI,EACR,OAAOb,GAAS,SAAWa,EAAI,aAAab,CAAI,EAAIa,EAAI,OAAOb,CAAI,EAC5D,CACL,MAAOa,EAAI,MACX,OAAQA,EAAI,OACZ,OAAQA,EAAI,OACZ,MAAOA,EAAI,MAEf,CAbC7B,EAAA,OAAA4B,GAoBM,eAAeE,GACpBd,EACArB,EAAsB,CAEtB,IAAMkC,EAAM,MAAMnC,GAAaC,CAAI,EACnC,OAAAkC,EAAI,KAAI,EACR,OAAOb,GAAS,SAAWa,EAAI,aAAab,CAAI,EAAIa,EAAI,OAAOb,CAAI,EAC5D,CACL,MAAOa,EAAI,MACX,OAAQA,EAAI,OACZ,OAAQA,EAAI,OACZ,MAAOA,EAAI,MAEf,CAbA7B,EAAA,YAAA8B,KC7eO,SAASC,EAAaC,EAA6B,CACxD,MAAO,CAAE,QAASA,CAAG,CACvB,CAuBO,IAAMC,EAAN,KAA6C,CAA7C,cACL,KAAiB,aAAe,IAAI,IACpC,KAAQ,YAAc,GAEtB,IAAW,YAAsB,CAC/B,OAAO,KAAK,WACd,CAEO,IAA2BC,EAAS,CACzC,OAAI,KAAK,YACPA,EAAE,QAAQ,EAEV,KAAK,aAAa,IAAIA,CAAC,EAElBA,CACT,CAEO,SAAgB,CACrB,GAAI,MAAK,YAGT,MAAK,YAAc,GACnB,QAAWC,KAAK,KAAK,aACnBA,EAAE,QAAQ,EAEZ,KAAK,aAAa,MAAM,EAC1B,CAEO,OAAc,CACnB,QAAWA,KAAK,KAAK,aACnBA,EAAE,QAAQ,EAEZ,KAAK,aAAa,MAAM,CAC1B,CACF,EAEsBC,EAAf,KAAiD,CAAjD,cAGL,KAAmB,OAAS,IAAIH,EAEzB,SAAgB,CACrB,KAAK,OAAO,QAAQ,CACtB,CAEU,UAAiCC,EAAS,CAClD,OAAO,KAAK,OAAO,IAAIA,CAAC,CAC1B,CACF,EAZsBE,EACG,KAAoB,OAAO,OAAO,CAAE,SAAU,CAAE,CAAE,CAAC,EAarE,IAAMC,EAAN,KAAsE,CAAtE,cAEL,KAAQ,YAAc,GAEtB,IAAW,OAAuB,CAChC,OAAO,KAAK,YAAc,OAAY,KAAK,MAC7C,CAEA,IAAW,MAAMC,EAAsB,CACjC,KAAK,aAAeA,IAAU,KAAK,SAGvC,KAAK,QAAQ,QAAQ,EACrB,KAAK,OAASA,EAChB,CAEO,OAAc,CACnB,KAAK,MAAQ,MACf,CAEO,SAAgB,CACrB,KAAK,YAAc,GACnB,KAAK,QAAQ,QAAQ,EACrB,KAAK,OAAS,MAChB,CACF,EClGO,IAAMC,EAAN,KAAiB,CAAjB,cACL,KAAQ,WAAqD,CAAC,EAC9D,KAAQ,UAAY,GAGpB,IAAW,OAAmB,CAC5B,OAAI,KAAK,OACA,KAAK,QAEd,KAAK,OAAS,CAACC,EAAyBC,EAAgBC,IAAkD,CACxG,GAAI,KAAK,UACP,OAAOC,EAAa,IAAM,CAAC,CAAC,EAG9B,IAAMC,EAAQ,CAAE,GAAIJ,EAAU,SAAAC,CAAS,EACvC,KAAK,WAAa,KAAK,WAAW,MAAM,EACxC,KAAK,WAAW,KAAKG,CAAK,EAE1B,IAAMC,EAASF,EAAa,IAAM,CAChC,IAAMG,EAAM,KAAK,WAAW,QAAQF,CAAK,EACrCE,IAAQ,KACV,KAAK,WAAa,KAAK,WAAW,MAAM,EACxC,KAAK,WAAW,OAAOA,EAAK,CAAC,EAEjC,CAAC,EAED,OAAIJ,IACE,MAAM,QAAQA,CAAW,EAC3BA,EAAY,KAAKG,CAAM,EAEvBH,EAAY,IAAIG,CAAM,GAInBA,CACT,EACO,KAAK,OACd,CAEO,KAAKE,EAAgB,CAC1B,GAAI,KAAK,WAAa,CAAC,KAAK,WAAW,OACrC,OAEF,GAAI,KAAK,WAAW,SAAW,EAAG,CAChC,KAAK,WAAW,CAAC,EAAE,GAAG,KAAK,KAAK,WAAW,CAAC,EAAE,SAAUA,CAAK,EAC7D,MACF,CACA,IAAMC,EAAY,KAAK,WACvB,QAAS,EAAI,EAAGC,EAAMD,EAAU,OAAQ,EAAIC,EAAK,EAAE,EACjDD,EAAU,CAAC,EAAE,GAAG,KAAKA,EAAU,CAAC,EAAE,SAAUD,CAAK,CAErD,CAEO,SAAgB,CACjB,KAAK,YAGT,KAAK,UAAY,GACjB,KAAK,WAAW,OAAS,EAC3B,CACF,EAEiBG,OAAV,CACE,SAASC,EAAWC,EAAiBC,EAA6B,CACvE,OAAOD,EAAKE,GAAKD,EAAG,KAAKC,CAAC,CAAC,CAC7B,CAFOJ,EAAS,QAAAC,EAIT,SAASI,EAAUR,EAAkBQ,EAA6B,CACvE,MAAO,CAACf,EAAyBC,EAAgBC,IACxCK,EAAMS,GAAKhB,EAAS,KAAKC,EAAUc,EAAIC,CAAC,CAAC,EAAG,OAAWd,CAAW,CAE7E,CAJOQ,EAAS,IAAAK,EAQT,SAASE,KAAUC,EAAgC,CACxD,MAAO,CAAClB,EAAyBC,EAAgBC,IAAkD,CACjG,IAAMiB,EAAQ,IAAIC,EAClB,QAAWb,KAASW,EAClBC,EAAM,IAAIZ,EAAMO,GAAKd,EAAS,KAAKC,EAAUa,CAAC,CAAC,CAAC,EAElD,OAAIZ,IACE,MAAM,QAAQA,CAAW,EAC3BA,EAAY,KAAKiB,CAAK,EAEtBjB,EAAY,IAAIiB,CAAK,GAGlBA,CACT,CACF,CAfOT,EAAS,IAAAO,EAmBT,SAASI,EAAmBd,EAAkBe,EAAqCC,EAA0B,CAClH,OAAAD,EAAQC,CAAO,EACRhB,EAAMO,GAAKQ,EAAQR,CAAC,CAAC,CAC9B,CAHOJ,EAAS,gBAAAW,IAhCDX,KAAA,ICvEjB,IAAAc,GAA2B,OAgBpB,IAAMC,EAAN,MAAMC,UAAsBC,CAAkC,CAmDnE,YAAoBC,EAAyB,CAC3C,MAAM,EADY,eAAAA,EAhDpB,KAAQ,QAAU,IAAI,IAGtB,KAAQ,gBAAkB,KAAK,UAAU,IAAIC,CAAmB,EA+C9D,KAAK,SAAW,KAAK,UAAU,MAAM,KACrC,KAAK,UAAU,MAAM,KAAQC,GAA8B,CACzD,KAAK,UAAU,KAAK,KAAK,UAAU,MAAOA,CAAM,EAChD,KAAK,MAAM,CACb,EACI,KAAK,UAAU,MAAM,eACvB,KAAK,MAAM,EAGb,KAAK,gBAAgB,MAAQ,KAAK,UAAU,MAAM,eAAe,eAAeC,GAAU,CACpFA,IAAW,aACb,KAAK,cAAc,EACnB,KAAK,gBAAgB,YAAY,EAAG,KAAK,UAAU,IAAI,EAE3D,CAAC,EACD,KAAK,UAAUC,EAAa,IAAM,CAChC,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,QAAQ,EAC5B,KAAK,UAAU,OAAS,KAAK,WAC/B,KAAK,UAAU,MAAM,KAAO,KAAK,SACjC,KAAK,SAAW,QAEd,KAAK,gBAAkB,KAAK,kBAC9B,KAAK,eAAe,YAAc,KAAK,gBACvC,KAAK,gBAAkB,QAEzB,KAAK,eAAiB,OACtB,KAAK,QAAQ,MAAM,EACnB,KAAK,oBAAoB,MAAM,EAC/B,KAAK,mBAAqB,OAC1B,KAAK,aAAe,MACtB,CAAC,CAAC,CACJ,CAnFA,IAAW,QAAwC,CAAE,OAAO,KAAK,QAAQ,IAAI,KAAK,GAAG,MAAQ,CAU7F,OAAc,aAAaC,EAAqCC,EAAeC,EAAmC,CAUhH,IAAMC,GAAUH,GAAiB,UAAU,cAAc,QAAQ,EACjE,OAAAG,EAAO,MAAQF,EAAQ,EACvBE,EAAO,OAASD,EAAS,EAClBC,CACT,CAGA,OAAc,gBAAgBC,EAA+BH,EAAeC,EAAgBG,EAAiC,CAC3H,GAAI,OAAO,WAAc,WAAY,CACnC,IAAMC,EAAUF,EAAI,gBAAgBH,EAAOC,CAAM,EACjD,OAAIG,GACFC,EAAQ,KAAK,IAAI,IAAI,kBAAkBD,EAAQ,EAAGJ,EAAQC,EAAS,CAAC,CAAC,EAEhEI,CACT,CACA,OAAOD,EACH,IAAI,UAAU,IAAI,kBAAkBA,EAAQ,EAAGJ,EAAQC,EAAS,CAAC,EAAGD,EAAOC,CAAM,EACjF,IAAI,UAAUD,EAAOC,CAAM,CACjC,CAGA,OAAc,kBAAkBK,EAA0D,CACxF,OAAI,OAAO,mBAAsB,WACxB,QAAQ,QAAQ,MAAS,EAE3B,kBAAkBA,CAAG,CAC9B,CA0CO,gBAAgBC,EAAsB,CACvCA,EACE,CAAC,KAAK,cAAgB,KAAK,SAAS,SAAW,IACjD,KAAK,mBAAmB,KAAK,IAAI,KAAK,SAAS,OAAS,EAAG,EAA4B,CAAC,GAG1F,KAAK,oBAAoB,MAAM,EAC/B,KAAK,mBAAqB,OAC1B,KAAK,aAAe,QAEtB,KAAK,gBAAgB,YAAY,EAAG,KAAK,UAAU,IAAI,CACzD,CAMA,IAAW,YAA4C,CACrD,OAAO,KAAK,UAAU,UACxB,CAKA,IAAW,UAAsB,CAC/B,MAAO,CACL,MAAO,KAAK,YAAY,IAAI,KAAK,OAAS,GAC1C,OAAQ,KAAK,YAAY,IAAI,KAAK,QAAU,EAC9C,CACF,CAKO,WAAWC,EAAeC,EAAaC,EAA0B,CACtE,IAAMC,EAAIH,GAAS,KAAK,YAAY,IAAI,KAAK,QAAU,GACjDI,EAAI,KAAK,YAAY,IAAI,OAAO,OAAS,EACzCC,GAAKJ,EAAM,EAAID,IAAU,KAAK,YAAY,IAAI,KAAK,QAAU,IAC/D,CAACE,GAASA,IAAU,QACtB,KAAK,QAAQ,IAAI,KAAK,GAAG,UAAU,EAAGC,EAAGC,EAAGC,CAAC,GAE3C,CAACH,GAASA,IAAU,WACtB,KAAK,QAAQ,IAAI,QAAQ,GAAG,UAAU,EAAGC,EAAGC,EAAGC,CAAC,CAEpD,CAKO,SAASH,EAA0B,CACxC,GAAI,CAACA,GAASA,IAAU,MAAO,CAC7B,IAAMP,EAAM,KAAK,QAAQ,IAAI,KAAK,EAClCA,GAAK,UAAU,EAAG,EAAGA,EAAI,OAAO,MAAOA,EAAI,OAAO,MAAM,CAC1D,CACA,GAAI,CAACO,GAASA,IAAU,SAAU,CAChC,IAAMP,EAAM,KAAK,QAAQ,IAAI,QAAQ,EACrCA,GAAK,UAAU,EAAG,EAAGA,EAAI,OAAO,MAAOA,EAAI,OAAO,MAAM,CAC1D,CACF,CAKO,KAAKW,EAAqBC,EAAgBC,EAAaC,EAAaC,EAAgB,EAAS,CAClG,IAAMf,EAAM,KAAK,QAAQ,IAAIW,EAAQ,KAAK,EAC1C,GAAI,CAACX,EACH,OAEF,GAAM,CAAE,MAAAH,EAAO,OAAAC,CAAO,EAAI,KAAK,SAG/B,GAAID,IAAU,IAAMC,IAAW,GAC7B,OAGF,KAAK,cAAca,EAASd,EAAOC,CAAM,EACzC,IAAMK,EAAMQ,EAAQ,OACd,CAAE,MAAOK,EAAa,OAAQC,CAAa,EAAIN,EAAQ,eACvDO,EAAO,KAAK,KAAKf,EAAI,MAAQa,CAAW,EAExCG,EAAMP,EAASM,EAAQF,EACvBI,EAAK,KAAK,MAAMR,EAASM,CAAI,EAAID,EACjCI,EAAKR,EAAMhB,EACXyB,EAAKR,EAAMhB,EAGXyB,EAAaR,EAAQC,EAAcG,EAAKhB,EAAI,MAAQA,EAAI,MAAQgB,EAAKJ,EAAQC,EAC7EQ,EAAcJ,EAAKH,EAAed,EAAI,OAASA,EAAI,OAASiB,EAAKH,EAMvEjB,EAAI,UACFG,EACA,KAAK,MAAMgB,CAAE,EAAG,KAAK,MAAMC,CAAE,EAAG,KAAK,KAAKG,CAAU,EAAG,KAAK,KAAKC,CAAW,EAC5E,KAAK,MAAMH,CAAE,EAAG,KAAK,MAAMC,CAAE,EAAG,KAAK,KAAKC,EAAa1B,EAAQmB,CAAW,EAAG,KAAK,KAAKQ,EAAc1B,EAASmB,CAAY,CAC5H,CACF,CAKO,YAAYN,EAAqBC,EAA+C,CACrF,GAAM,CAAE,MAAAf,EAAO,OAAAC,CAAO,EAAI,KAAK,SAE/B,GAAID,IAAU,IAAMC,IAAW,GAC7B,OAEF,KAAK,cAAca,EAASd,EAAOC,CAAM,EACzC,IAAMK,EAAMQ,EAAQ,OACd,CAAE,MAAOK,EAAa,OAAQC,CAAa,EAAIN,EAAQ,eACvDO,EAAO,KAAK,KAAKf,EAAI,MAAQa,CAAW,EACxCG,EAAMP,EAASM,EAAQF,EACvBI,EAAK,KAAK,MAAMR,EAASM,CAAI,EAAID,EACjCM,EAAaP,EAAcG,EAAKhB,EAAI,MAAQA,EAAI,MAAQgB,EAAKH,EAC7DQ,EAAcJ,EAAKH,EAAed,EAAI,OAASA,EAAI,OAASiB,EAAKH,EAEjElB,EAASV,EAAc,aAAa,KAAK,SAAU,KAAK,KAAKkC,EAAa1B,EAAQmB,CAAW,EAAG,KAAK,KAAKQ,EAAc1B,EAASmB,CAAY,CAAC,EAC9IjB,EAAMD,EAAO,WAAW,IAAI,EAClC,GAAIC,EACF,OAAAA,EAAI,UACFG,EACA,KAAK,MAAMgB,CAAE,EAAG,KAAK,MAAMC,CAAE,EAAG,KAAK,MAAMG,CAAU,EAAG,KAAK,MAAMC,CAAW,EAC9E,EAAG,EAAGzB,EAAO,MAAOA,EAAO,MAC7B,EACOA,CAEX,CAKO,gBAAgBc,EAAaC,EAAaC,EAAgB,EAAS,CACxE,IAAMf,EAAM,KAAK,QAAQ,IAAI,KAAK,EAClC,GAAIA,EAAK,CACP,GAAM,CAAE,MAAAH,EAAO,OAAAC,CAAO,EAAI,KAAK,SAY/B,GATID,IAAU,IAAMC,IAAW,KAI1B,KAAK,aAECA,GAAU,KAAK,aAAc,QACtC,KAAK,mBAAmBA,EAAS,CAAC,EAFlC,KAAK,mBAAmB,KAAK,IAAIA,EAAS,EAAG,EAA4B,CAAC,EAIxE,CAAC,KAAK,cAAc,OACxBE,EAAI,UACF,KAAK,oBAAsB,KAAK,aAChCa,EAAMhB,EACLiB,EAAMhB,EAAU,EAAI,EAAI,EACzBD,EAAQkB,EACRjB,EACAe,EAAMhB,EACNiB,EAAMhB,EACND,EAAQkB,EACRjB,CACF,CACF,CACF,CAMO,eAAsB,CAC3B,IAAMW,EAAI,KAAK,YAAY,IAAI,OAAO,OAAS,EACzCC,EAAI,KAAK,YAAY,IAAI,OAAO,QAAU,EAChD,QAAWV,KAAO,KAAK,QAAQ,OAAO,GAChCA,EAAI,OAAO,QAAUS,GAAKT,EAAI,OAAO,SAAWU,KAClDV,EAAI,OAAO,MAAQS,EACnBT,EAAI,OAAO,OAASU,EAG1B,CAKQ,cAAce,EAAkBC,EAAsBC,EAA6B,CACzF,GAAID,IAAiBD,EAAK,eAAe,OAASE,IAAkBF,EAAK,eAAe,OACtF,OAEF,GAAM,CAAE,MAAOG,EAAe,OAAQC,CAAe,EAAIJ,EAAK,aAC9D,GAAIC,IAAiBE,GAAiBD,IAAkBE,EAAgB,CACtEJ,EAAK,OAASA,EAAK,KACnBA,EAAK,eAAe,MAAQG,EAC5BH,EAAK,eAAe,OAASI,EAC7B,MACF,CACA,IAAMC,EAAc,KAAK,KAAKL,EAAK,KAAM,MAAQC,EAAeE,CAAa,EACvEG,EAAe,KAAK,KAAKN,EAAK,KAAM,OAASE,EAAgBE,CAAc,EAEjF,GAAIC,EAAcC,EAAeN,EAAK,KAAM,MAAQA,EAAK,KAAM,OAAQ,CACrEA,EAAK,OAASA,EAAK,KACnBA,EAAK,eAAe,MAAQG,EAC5BH,EAAK,eAAe,OAASI,EAC7B,MACF,CACA,IAAM9B,EAASV,EAAc,aAAa,KAAK,SAAUyC,EAAaC,CAAY,EAC5E/B,EAAMD,EAAO,WAAW,IAAI,EAC9BC,IACFA,EAAI,UAAUyB,EAAK,KAAO,EAAG,EAAG1B,EAAO,MAAOA,EAAO,MAAM,EAC3D0B,EAAK,OAAS1B,EACd0B,EAAK,eAAe,MAAQC,EAC5BD,EAAK,eAAe,OAASE,EAEjC,CAKQ,OAAc,CACpB,KAAK,eAAiB,KAAK,UAAU,MAAM,eAC3C,KAAK,gBAAkB,KAAK,eAAe,YAAY,KAAK,KAAK,cAAc,EAC/E,KAAK,eAAe,YAAeK,GAAkB,CACnD,QAAWC,IAAO,CAAC,GAAG,KAAK,QAAQ,KAAK,CAAC,EACvC,KAAK,mBAAmBA,CAAG,EAE7B,KAAK,iBAAiB,KAAK,KAAK,eAAgBD,CAAQ,CAC1D,CACF,CAEO,iBAAiBzB,EAAoB,MAAa,CAEvD,GAAI,CAAC,KAAK,UAAY,CAAC,KAAK,UAAU,MAAM,cAAe,CACzD,QAAQ,KAAK,oFAAoF,EACjG,MACF,CACA,GAAI,KAAK,QAAQ,IAAIA,CAAK,EACxB,OAEF,IAAMR,EAASV,EAAc,aAC3B,KAAK,SAAU,KAAK,YAAY,IAAI,OAAO,OAAS,EACpD,KAAK,YAAY,IAAI,OAAO,QAAU,CACxC,EACAU,EAAO,UAAU,IAAI,qBAAqBQ,CAAK,EAAE,EACjD,IAAM2B,EAAgB,KAAK,UAAU,MAAM,cAI3CA,EAAc,MAAM,UAAY,UAC5B3B,IAAU,UAKZR,EAAO,MAAM,OAAS,KACtBmC,EAAc,aAAanC,EAAQmC,EAAc,UAAU,IAK3DnC,EAAO,MAAM,OAAS,IACtBmC,EAAc,YAAYnC,CAAM,GAElC,IAAMC,EAAMD,EAAO,WAAW,KAAM,CAAE,MAAO,EAAK,CAAC,EACnD,GAAI,CAACC,EAAK,CACRD,EAAO,OAAO,EACd,MACF,CACA,KAAK,QAAQ,IAAIQ,EAAOP,CAAG,EAC3B,KAAK,SAASO,CAAK,CACrB,CAEO,mBAAmBA,EAAoB,MAAa,CACzD,IAAMP,EAAM,KAAK,QAAQ,IAAIO,CAAK,EAC9BP,IACFA,EAAI,OAAO,OAAO,EAClB,KAAK,QAAQ,OAAOO,CAAK,EAE7B,CAEO,SAASA,EAA4B,CAC1C,OAAO,KAAK,QAAQ,IAAIA,CAAK,CAC/B,CAEQ,mBAAmBT,EAAiB,GAAoC,CAC9E,KAAK,oBAAoB,MAAM,EAC/B,KAAK,mBAAqB,OAG1B,IAAMqC,EAAS,GACTC,EAAY/C,EAAc,aAAa,KAAK,SAAU8C,EAAQrC,CAAM,EACpEE,EAAMoC,EAAU,WAAW,KAAM,CAAE,MAAO,EAAM,CAAC,EACvD,GAAI,CAACpC,EAAK,OACV,IAAME,EAAUb,EAAc,gBAAgBW,EAAKmC,EAAQrC,CAAM,EAC3DuC,EAAM,IAAI,YAAYnC,EAAQ,KAAK,MAAM,EACzCoC,KAAQ,eAAW,EAAG,EAAG,CAAC,EAC1BC,KAAQ,eAAW,IAAK,IAAK,GAAG,EACtCF,EAAI,KAAKC,CAAK,EACd,QAAS9B,EAAI,EAAGA,EAAIV,EAAQ,EAAEU,EAAG,CAC/B,IAAMgC,EAAQhC,EAAI,EACZiC,EAASjC,EAAI2B,EACnB,QAASO,EAAI,EAAGA,EAAIP,EAAQO,GAAK,EAC/BL,EAAII,EAASC,EAAIF,CAAK,EAAID,CAE9B,CACAvC,EAAI,aAAaE,EAAS,EAAG,CAAC,EAG9B,IAAML,EAAS,OAAO,MAAQsC,EAAS,EAAK,EAAEA,EAAS,IAAM,KAC7D,KAAK,aAAe9C,EAAc,aAAa,KAAK,SAAUQ,EAAOC,CAAM,EAC3E,IAAM6C,EAAO,KAAK,aAAa,WAAW,KAAM,CAAE,MAAO,EAAM,CAAC,EAChE,GAAI,CAACA,EAAM,CACT,KAAK,aAAe,OACpB,MACF,CACA,QAASC,EAAI,EAAGA,EAAI/C,EAAO+C,GAAKT,EAC9BQ,EAAK,UAAUP,EAAWQ,EAAG,CAAC,EAEhC,IAAMC,EAAc,KAAK,aACzBxD,EAAc,kBAAkBwD,CAAW,EAAE,KAAKC,GAAU,CACtD,KAAK,eAAiBD,EAAaC,GAAQ,MAAM,EAChD,KAAK,mBAAqBA,CACjC,CAAC,EAAE,MAAM,IAAM,CAAC,CAAC,CACnB,CAEA,IAAW,UAAiC,CAC1C,OAAO,KAAK,UAAU,MAAM,qBAAqB,OAAO,QAC1D,CACF,ECnaO,IAAMC,EAA+B,CAC1C,MAAO,EACP,OAAQ,EACV,EAQMC,EAAN,MAAMC,CAAkD,CAqDtD,YACEC,EAAc,EACdC,EAAgB,EACTC,EAAU,GACVC,EAAS,GAChB,CAFO,aAAAD,EACA,YAAAC,EAxDT,KAAQ,KAAe,EA4CvB,KAAQ,OAAiB,EAcvB,KAAK,KAAOH,EACZ,KAAK,OAASC,CAChB,CA3DA,IAAW,KAAc,CACvB,OAAI,KAAK,OAEJ,KAAK,KAAO,WACZ,KAAK,gBAAkB,GAGrB,KAAK,IACd,CACA,IAAW,IAAIG,EAAe,CAAE,KAAK,KAAOA,CAAO,CAEnD,IAAW,gBAAiC,CAE1C,OAAI,KAAK,UAGD,KAAK,KAAO,YAA6B,EACnD,CACA,IAAW,eAAeA,EAAuB,CAC/C,KAAK,MAAQ,WACb,KAAK,MAASA,GAAS,GAAM,SAC/B,CAEA,IAAW,gBAAyB,CAClC,OAAO,KAAK,KAAQ,QACtB,CACA,IAAW,eAAeA,EAAe,CACvC,KAAK,MAAQ,UACb,KAAK,MAAQA,EAAS,QACxB,CAEA,IAAW,wBAAiC,CAC1C,IAAMC,GAAO,KAAK,KAAO,aAA4B,GACrD,OAAIA,EAAM,EACDA,EAAM,WAERA,CACT,CACA,IAAW,uBAAuBD,EAAe,CAC/C,KAAK,MAAQ,UACb,KAAK,MAASA,GAAS,GAAM,UAC/B,CAGA,IAAW,OAAgB,CACzB,OAAO,KAAK,MACd,CACA,IAAW,MAAMA,EAAe,CAC9B,KAAK,OAASA,CAChB,CAYO,OAA6B,CASlC,OAAO,IAAIL,EAAmB,KAAK,KAAM,KAAK,OAAQ,KAAK,QAAS,KAAK,MAAM,CACjF,CAEO,SAAmB,CACxB,OAAO,KAAK,iBAAmB,GAAuB,KAAK,SAAW,GAAK,KAAK,UAAY,EAC9F,CACF,EACMO,EAAc,IAAIR,EAUXS,EAAN,KAA0C,CAkB/C,YACUC,EACAC,EACAC,EACR,CAHQ,eAAAF,EACA,eAAAC,EACA,WAAAC,EAnBV,KAAQ,QAAmC,IAAI,IAE/C,KAAQ,QAAU,EAElB,KAAQ,UAAY,EAEpB,KAAQ,cAAgB,GAExB,KAAQ,gBAAkB,GAE1B,KAAQ,YAAsB,KAW5B,GAAI,CACF,KAAK,SAAS,KAAK,MAAM,YAAY,CACvC,OAASC,EAAY,CACfA,aAAa,OACf,QAAQ,MAAMA,EAAE,OAAO,EAEzB,QAAQ,KAAK,0BAA0B,KAAK,SAAS,CAAC,KAAK,CAC7D,CACA,KAAK,iBAAmB,CACtB,KAAM,KAAK,UAAU,KACrB,KAAM,KAAK,UAAU,IACvB,CACF,CAEO,SAAgB,CACrB,KAAK,MAAM,CACb,CAEO,OAAc,CACnB,QAAWC,KAAQ,KAAK,QAAQ,OAAO,EACrCA,EAAK,QAAQ,QAAQ,EAIvB,KAAK,QAAQ,MAAM,EACnB,KAAK,UAAU,SAAS,CAC1B,CAEO,UAAmB,CACxB,OAAO,KAAK,YAAc,EAAI,GAChC,CAEO,SAASR,EAAqB,CACnC,GAAIA,EAAQ,IAAOA,EAAQ,IACzB,MAAM,WAAW,mEAAmE,EAEtF,KAAK,YAAeA,EAAQ,EAAI,MAAa,EAC7C,KAAK,aAAa,CAAC,CACrB,CAEO,UAAmB,CACxB,OAAO,KAAK,iBAAiB,EAAI,EAAI,GACvC,CAEQ,kBAA2B,CACjC,IAAIS,EAAe,EACnB,QAAWD,KAAQ,KAAK,QAAQ,OAAO,EACjCA,EAAK,OACPC,GAAgBD,EAAK,KAAK,MAAQA,EAAK,KAAK,OACxCA,EAAK,QAAUA,EAAK,SAAWA,EAAK,OACtCC,GAAgBD,EAAK,OAAO,MAAQA,EAAK,OAAO,SAItD,OAAOC,CACT,CAEQ,QAAQC,EAAkB,CAChC,IAAMF,EAAO,KAAK,QAAQ,IAAIE,CAAE,EAC3BF,IACL,KAAK,QAAQ,OAAOE,CAAE,EAElB,OAAO,aAAeF,EAAK,gBAAgB,aAC7CA,EAAK,KAAK,MAAM,EAElB,KAAK,iBAAiBE,CAAE,EAC1B,CAKO,eAAsB,CAE3B,IAAMC,EAAO,CAAC,EACd,OAAW,CAACD,EAAIF,CAAI,IAAK,KAAK,QAAQ,QAAQ,EACxCA,EAAK,aAAe,cACtBA,EAAK,QAAQ,QAAQ,EACrBG,EAAK,KAAKD,CAAE,GAGhB,QAAWA,KAAMC,EACf,KAAK,QAAQD,CAAE,EAGjB,KAAK,gBAAkB,GACvB,KAAK,cAAgB,EACvB,CAMO,YAAYA,EAAkB,CACnC,IAAMF,EAAO,KAAK,QAAQ,IAAIE,CAAE,EAC5BF,IACFA,EAAK,QAAQ,QAAQ,EACrB,KAAK,QAAQE,CAAE,EAEnB,CAaO,SAASE,EAAsCC,EAA6B,CAEjF,KAAK,aAAaD,EAAI,MAAQA,EAAI,MAAM,EAGxC,IAAIE,EAAW,KAAK,UAAU,UAC1BA,EAAS,QAAU,IAAMA,EAAS,SAAW,MAC/CA,EAAWrB,GAEb,IAAMsB,EAAO,KAAK,KAAKH,EAAI,MAAQE,EAAS,KAAK,EAC3CE,EAAO,KAAK,KAAKJ,EAAI,OAASE,EAAS,MAAM,EAE7ChB,EAAU,EAAE,KAAK,QAEjBmB,EAAS,KAAK,UAAU,MAAM,OAC9BC,EAAW,KAAK,UAAU,KAC1BC,EAAW,KAAK,UAAU,KAC1BC,EAAUH,EAAO,EACjBI,EAAUJ,EAAO,EACnBK,EAASF,EACTG,EAAY,EAEXV,EAAK,YACRI,EAAO,EAAI,EACXA,EAAO,EAAI,EACXK,EAAS,GAGX,KAAK,UAAU,MAAM,cAAc,iBAAiB,UAAUL,EAAO,CAAC,EACtE,QAASO,EAAM,EAAGA,EAAMR,EAAM,EAAEQ,EAAK,CACnC,IAAMC,EAAOR,EAAO,MAAM,IAAIA,EAAO,EAAIA,EAAO,KAAK,EACrD,QAASS,EAAM,EAAGA,EAAMX,GAClB,EAAAO,EAASI,GAAOR,GADQ,EAAEQ,EAE9B,KAAK,aAAaD,EAAwBH,EAASI,EAAK5B,EAAS0B,EAAMT,EAAOW,CAAG,EACjFH,IAEF,GAAIV,EAAK,UACHW,EAAMR,EAAO,GAAG,KAAK,UAAU,MAAM,cAAc,SAAS,UAE5D,EAAEC,EAAO,GAAKE,EAAU,MAE9BF,EAAO,EAAIK,CACb,CACA,KAAK,UAAU,MAAM,cAAc,iBAAiB,UAAUL,EAAO,CAAC,EAGlEJ,EAAK,UACHA,EAAK,YAAc,MACrBI,EAAO,EAAI,KAAK,IAAIK,EAASP,EAAMG,CAAQ,EAE3CD,EAAO,EAAIK,GAGbL,EAAO,EAAIG,EACXH,EAAO,EAAII,GAIb,IAAMV,EAAO,CAAC,EACd,OAAW,CAACD,EAAIF,CAAI,IAAK,KAAK,QAAQ,QAAQ,EACxCA,EAAK,UAAY,IACnBA,EAAK,QAAQ,QAAQ,EACrBG,EAAK,KAAKD,CAAE,GAGhB,QAAWA,KAAMC,EACf,KAAK,QAAQD,CAAE,EAKjB,IAAMiB,EAAY,KAAK,UAAU,eAAe,CAAC,EACjDA,GAAW,UAAU,IAAM,CACZ,KAAK,QAAQ,IAAI7B,CAAO,GAEnC,KAAK,QAAQA,CAAO,CAExB,CAAC,EAIG,KAAK,UAAU,OAAO,OAAO,OAAS,aACxC,KAAK,kBAAkB,EAIzB,IAAM8B,EAAsB,CAC1B,KAAMhB,EACN,aAAcE,EACd,OAAQF,EACR,eAAgB,CAAE,GAAGE,CAAS,EAC9B,OAAQa,GAAa,OACrB,UAAAJ,EACA,WAAY,KAAK,UAAU,OAAO,OAAO,KACzC,MAAOV,EAAK,MACZ,OAAQA,EAAK,MACf,EAGA,YAAK,QAAQ,IAAIf,EAAS8B,CAAO,EACjC,KAAK,eAAe,EACb9B,CACT,CAQO,OAAO+B,EAA6C,CAEzD,IAAIC,EAAe,GACfC,EAAkB,GACtB,QAAWvB,KAAQ,KAAK,QAAQ,OAAO,EAMrC,GALIA,EAAK,QAAU,SACjBuB,EAAkB,GAElBD,EAAe,GAEbA,GAAgBC,EAAiB,MAIvC,GAAID,GAAgB,CAAC,KAAK,UAAU,SAAS,KAAK,IAChD,KAAK,UAAU,iBAAiB,KAAK,EACjC,CAAC,KAAK,UAAU,SAAS,KAAK,GAAG,OAUvC,GARIC,GAAmB,CAAC,KAAK,UAAU,SAAS,QAAQ,GACtD,KAAK,UAAU,iBAAiB,QAAQ,EAI1C,KAAK,UAAU,cAAc,EAGzB,CAAC,KAAK,QAAQ,KAAM,CACjB,KAAK,gBACR,KAAK,UAAU,SAAS,EACxB,KAAK,cAAgB,GACrB,KAAK,gBAAkB,IAErB,KAAK,UAAU,SAAS,KAAK,GAC/B,KAAK,UAAU,mBAAmB,KAAK,EAErC,KAAK,UAAU,SAAS,QAAQ,GAClC,KAAK,UAAU,mBAAmB,QAAQ,EAE5C,MACF,CAGI,CAACD,GAAgB,KAAK,UAAU,SAAS,KAAK,IAChD,KAAK,UAAU,SAAS,KAAK,EAC7B,KAAK,UAAU,mBAAmB,KAAK,GAErC,CAACC,GAAmB,KAAK,UAAU,SAAS,QAAQ,IACtD,KAAK,UAAU,SAAS,QAAQ,EAChC,KAAK,UAAU,mBAAmB,QAAQ,GAIxC,KAAK,kBACP,KAAK,UAAU,SAAS,EACxB,KAAK,cAAgB,GACrB,KAAK,gBAAkB,IAGzB,GAAM,CAAE,MAAAC,EAAO,IAAAC,CAAI,EAAIJ,EACjBZ,EAAS,KAAK,UAAU,MAAM,OAC9BF,EAAO,KAAK,UAAU,MAAM,KAGlC,KAAK,UAAU,WAAWiB,EAAOC,CAAG,EAGpC,IAAMC,EAAgG,CAAC,EACjGC,EAAkE,CAAC,EAGzE,QAASX,EAAMQ,EAAOR,GAAOS,EAAK,EAAET,EAAK,CACvC,IAAMC,EAAOR,EAAO,MAAM,IAAIO,EAAMP,EAAO,KAAK,EAChD,GAAI,CAACQ,EAAM,OACX,QAASC,EAAM,EAAGA,EAAMX,EAAM,EAAEW,EAC9B,GAAID,EAAK,MAAMC,CAAG,EAAI,UAAsB,CAC1C,IAAInB,EAAyBkB,EAAK,eAAeC,CAAG,GAAKxB,EACnDJ,EAAUS,EAAE,QAClB,GAAIT,IAAY,QAAaA,IAAY,GACvC,SAEF,IAAM8B,EAAU,KAAK,QAAQ,IAAI9B,CAAO,EACxC,GAAIS,EAAE,SAAW,GAAI,CACnB,IAAM6B,EAAY7B,EAAE,OACd8B,EAAWX,EACbY,EAAQ,EAOZ,KACE,EAAEZ,EAAMX,GACJU,EAAK,MAAMC,CAAG,EAAI,YAClBnB,EAAIkB,EAAK,eAAeC,CAAG,GAAKxB,IAChCK,EAAE,UAAYT,GACdS,EAAE,SAAW6B,EAAYE,GAE7BA,IAEFZ,IACIE,EACEA,EAAQ,QACVM,EAAU,KAAK,CAAE,QAAAN,EAAS,OAAQQ,EAAW,IAAKC,EAAU,IAAAb,EAAK,MAAAc,CAAM,CAAC,EAEjE,KAAK,MAAM,iBACpBH,EAAiB,KAAK,CAAE,IAAKE,EAAU,IAAAb,EAAK,MAAAc,CAAM,CAAC,EAErD,KAAK,cAAgB,EACvB,CACF,CAEJ,CAGAJ,EAAU,KAAK,CAACK,EAAGC,IAAMD,EAAE,QAAQ,OAASC,EAAE,QAAQ,MAAM,EAG5D,QAAWC,KAAQN,EACjB,KAAK,UAAU,gBAAgBM,EAAK,IAAKA,EAAK,IAAKA,EAAK,KAAK,EAI/D,QAAWA,KAAQP,EACjB,KAAK,UAAU,KAAKO,EAAK,QAASA,EAAK,OAAQA,EAAK,IAAKA,EAAK,IAAKA,EAAK,KAAK,CAEjF,CAEO,eAAeC,EAA+C,CAEnE,GAAI,CAAC,KAAK,QAAQ,KAAM,CACtB,KAAK,iBAAmBA,EACxB,MACF,CAIA,GAAI,KAAK,iBAAiB,MAAQA,EAAQ,KAAM,CAC9C,KAAK,iBAAmBA,EACxB,MACF,CAGA,IAAMzB,EAAS,KAAK,UAAU,MAAM,OAC9BD,EAAOC,EAAO,MAAM,OACpB0B,EAAS,KAAK,iBAAiB,KAAO,EAC5C,QAASnB,EAAM,EAAGA,EAAMR,EAAM,EAAEQ,EAAK,CACnC,IAAMC,EAAOR,EAAO,MAAM,IAAIO,CAAG,EACjC,GAAIC,EAAK,MAAMkB,CAAM,EAAI,UAAsB,CAC7C,IAAMpC,EAAyBkB,EAAK,eAAekB,CAAM,GAAKzC,EACxDJ,EAAUS,EAAE,QAClB,GAAIT,IAAY,QAAaA,IAAY,GACvC,SAEF,IAAM8B,EAAU,KAAK,QAAQ,IAAI9B,CAAO,EACxC,GAAI,CAAC8B,EACH,SAGF,IAAMgB,EAAc,KAAK,MAAMhB,EAAQ,QAAQ,OAAS,GAAKA,EAAQ,eAAe,KAAK,EACzF,GAAKrB,EAAE,OAASqC,EAAe,GAAKA,EAClC,SAGF,IAAIC,EAAU,GACd,QAASC,EAAWH,EAAS,EAAGG,EAAWJ,EAAQ,KAAM,EAAEI,EACzD,GAAIrB,EAAK,MAAMqB,EAAW,EAAY,CAAY,EAAI,QAA0B,CAC9ED,EAAU,GACV,KACF,CAEF,GAAIA,EACF,SAGF,IAAMZ,EAAM,KAAK,IAAIS,EAAQ,KAAME,EAAerC,EAAE,OAASqC,EAAeD,CAAM,EAC9EI,EAAWxC,EAAE,OACjB,QAASyC,EAAYL,EAAS,EAAGK,EAAYf,EAAK,EAAEe,EAClD,KAAK,aAAavB,EAAwBuB,EAAWlD,EAAS,EAAEiD,CAAQ,EACxEnB,EAAQ,WAEZ,CACF,CAEA,KAAK,iBAAmBc,CAC1B,CAKO,qBAAqBO,EAAWC,EAA0C,CAE/E,IAAMzB,EADS,KAAK,UAAU,MAAM,OAChB,MAAM,IAAIyB,CAAC,EAC/B,GAAIzB,GAAQA,EAAK,MAAMwB,CAAC,EAAI,UAAsB,CAChD,IAAM1C,EAAyBkB,EAAK,eAAewB,CAAC,GAAK/C,EACzD,GAAIK,EAAE,SAAWA,EAAE,UAAY,GAAI,CACjC,IAAM4C,EAAO,KAAK,QAAQ,IAAI5C,EAAE,OAAO,GAAG,KAC1C,GAAI,OAAO,aAAe4C,aAAgB,YAAa,CACrD,IAAMC,EAASC,EAAc,aAAa,OAAO,SAAUF,EAAK,MAAOA,EAAK,MAAM,EAClF,OAAAC,EAAO,WAAW,IAAI,GAAG,UAAUD,EAAM,EAAG,EAAGA,EAAK,MAAOA,EAAK,MAAM,EAC/DC,CACT,CACA,OAAOD,CACT,CACF,CACF,CAKO,wBAAwBF,EAAWC,EAA0C,CAElF,IAAMzB,EADS,KAAK,UAAU,MAAM,OAChB,MAAM,IAAIyB,CAAC,EAC/B,GAAIzB,GAAQA,EAAK,MAAMwB,CAAC,EAAI,UAAsB,CAChD,IAAM1C,EAAyBkB,EAAK,eAAewB,CAAC,GAAK/C,EACzD,GAAIK,EAAE,SAAWA,EAAE,UAAY,IAAMA,EAAE,SAAW,GAAI,CACpD,IAAMC,EAAO,KAAK,QAAQ,IAAID,EAAE,OAAO,EACvC,GAAIC,EACF,OAAO,KAAK,UAAU,YAAYA,EAAMD,EAAE,MAAM,CAEpD,CACF,CACF,CAIQ,aAAa+C,EAAsB,CACzC,IAAMC,EAAO,KAAK,iBAAiB,EAC/BC,EAAUD,EACd,KAAO,KAAK,YAAcC,EAAUF,GAAQ,KAAK,QAAQ,MAAM,CAC7D,IAAM9C,EAAO,KAAK,QAAQ,IAAI,EAAE,KAAK,SAAS,EAC1CA,GAAQA,EAAK,OACfgD,GAAWhD,EAAK,KAAK,MAAQA,EAAK,KAAK,OACnCA,EAAK,QAAUA,EAAK,OAASA,EAAK,SACpCgD,GAAWhD,EAAK,OAAO,MAAQA,EAAK,OAAO,QAE7CA,EAAK,QAAQ,QAAQ,EACrB,KAAK,QAAQ,KAAK,SAAS,EAE/B,CACA,OAAO+C,EAAOC,CAChB,CAEQ,aAAa/B,EAAsBwB,EAAWnD,EAAiBC,EAAsB,CAC3F,GAAI0B,EAAK,MAAMwB,EAAI,EAAY,CAAO,EAAI,UAAsB,CAC9D,IAAMQ,EAAMhC,EAAK,eAAewB,CAAC,EACjC,GAAIQ,EAAK,CACP,GAAIA,EAAI,UAAY,OAAW,CAI7B,IAAMC,EAAU,KAAK,QAAQ,IAAID,EAAI,OAAO,EACxCC,GAEFA,EAAQ,YAEVD,EAAI,QAAU3D,EACd2D,EAAI,OAAS1D,EACb,MACF,CAEA0B,EAAK,eAAewB,CAAC,EAAI,IAAIvD,EAAmB+D,EAAI,IAAKA,EAAI,MAAO3D,EAASC,CAAM,EACnF,MACF,CACF,CAEA0B,EAAK,MAAMwB,EAAI,EAAY,CAAO,GAAK,UACvCxB,EAAK,eAAewB,CAAC,EAAI,IAAIvD,EAAmB,EAAG,EAAGI,EAASC,CAAM,CACvE,CAEQ,mBAA0B,CAEhC,QAAWS,KAAQ,KAAK,QAAQ,OAAO,EACjCA,EAAK,aAAe,cACtBA,EAAK,UAAY,GAIrB,IAAMS,EAAS,KAAK,UAAU,MAAM,OACpC,QAASiC,EAAI,EAAGA,EAAI,KAAK,UAAU,KAAM,EAAEA,EAAG,CAC5C,IAAMzB,EAAOR,EAAO,MAAM,IAAIiC,CAAC,EAC/B,GAAKzB,GAGL,QAASwB,EAAI,EAAGA,EAAI,KAAK,UAAU,KAAM,EAAEA,EACzC,GAAIxB,EAAK,MAAMwB,EAAI,EAAY,CAAO,EAAI,UAAsB,CAC9D,IAAMU,EAAQlC,EAAK,eAAewB,CAAC,GAAG,QACtC,GAAIU,EAAO,CACT,IAAMnD,EAAO,KAAK,QAAQ,IAAImD,CAAK,EAC/BnD,GACFA,EAAK,WAET,CACF,EAEJ,CAEA,IAAMG,EAAO,CAAC,EACd,OAAW,CAACD,EAAIF,CAAI,IAAK,KAAK,QAAQ,QAAQ,EACxCA,EAAK,aAAe,aAAe,CAACA,EAAK,YAC3CA,EAAK,QAAQ,QAAQ,EACrBG,EAAK,KAAKD,CAAE,GAGhB,QAAWA,KAAMC,EACf,KAAK,QAAQD,CAAE,CAEnB,CACF,ECnpBA,IAAAkD,GAA0B,QAC1BC,GAAuB,QC2CvB,SAASC,EAAMC,EAA2B,CACxC,IAAIC,EAAI,GACR,QAASC,EAAI,EAAGA,EAAIF,EAAK,OAAQ,EAAEE,EACjCD,GAAK,OAAO,aAAaD,EAAKE,CAAC,CAAC,EAElC,OAAOD,CACT,CAGA,SAASE,GAAMH,EAA2B,CACxC,IAAII,EAAI,EACR,QAASF,EAAI,EAAGA,EAAIF,EAAK,OAAQ,EAAEE,EAAG,CACpC,GAAIF,EAAKE,CAAC,EAAI,IAAMF,EAAKE,CAAC,EAAI,GAC5B,MAAM,IAAI,MAAM,cAAc,EAEhCE,EAAIA,EAAI,GAAKJ,EAAKE,CAAC,EAAI,EACzB,CACA,OAAOE,CACT,CAGA,SAASC,GAAOL,EAA2B,CACzC,IAAMI,EAAIL,EAAMC,CAAI,EACpB,GAAI,CAACI,EAAE,MAAM,kCAAkC,EAC7C,MAAM,IAAI,MAAM,cAAc,EAEhC,OAAOA,CACT,CAGA,SAASE,GAAON,EAA2B,CACzC,GAAI,OAAO,OAAW,IACpB,OAAO,OAAO,KAAKD,EAAMC,CAAI,EAAG,QAAQ,EAAE,SAAS,EAErD,IAAMO,EAAK,KAAKR,EAAMC,CAAI,CAAC,EACrBQ,EAAI,IAAI,WAAWD,EAAG,MAAM,EAClC,QAAS,EAAI,EAAG,EAAIC,EAAE,OAAQ,EAAE,EAC9BA,EAAE,CAAC,EAAID,EAAG,WAAW,CAAC,EAExB,OAAO,IAAI,YAAY,EAAE,OAAOC,CAAC,CACnC,CAEA,IAAMC,GAAiE,CACrE,OAAQN,GACR,KAAMA,GACN,KAAMG,GACN,MAAOD,GACP,OAAQA,GACR,oBAAqBF,EACvB,EAKMO,GAAc,CAAC,GAAI,IAAK,IAAK,GAAG,EAEhCC,GAAuB,CAAC,GAAI,IAAK,IAAK,IAAK,IAAK,IAAK,GAAI,IAAK,IAAK,GAAI,IAAK,IAAK,GAAG,EAEpFC,GAAkB,CAAC,GAAI,IAAK,IAAK,IAAK,GAAI,GAAI,IAAK,GAAG,EAEtDC,GAAiB,CAAC,GAAI,IAAK,IAAK,IAAK,GAAI,IAAK,GAAG,EAEjDC,GAAwB,CAAC,GAAI,IAAK,IAAK,IAAK,IAAK,IAAK,GAAI,IAAK,IAAK,IAAK,GAAI,IAAK,IAAK,GAAG,EAG1FC,GAAiB,KAGVC,GAAN,KAAmB,CAAnB,cACL,KAAO,MAAqB,EAC5B,KAAQ,QAAU,IAAI,YAAYD,EAAc,EAChD,KAAQ,UAAY,EACpB,KAAQ,KAAO,GACf,KAAO,OAA4E,CAAC,EAE7E,OAAc,CACnB,KAAK,QAAQ,KAAK,CAAC,EACnB,KAAK,MAAQ,EACb,KAAK,UAAY,EACjB,KAAK,OAAS,CAAC,EACf,KAAK,KAAO,EACd,CAEO,KAAc,CACnB,GAAI,KAAK,QAAU,EAAmB,CACpC,GAAI,KAAK,YAAcF,GAAe,OAAQ,CAC5C,QAASI,EAAI,EAAGA,EAAIJ,GAAe,OAAQ,EAAEI,EAC3C,GAAI,KAAK,QAAQA,CAAC,IAAMJ,GAAeI,CAAC,EAAG,OAAO,KAAK,GAAG,EAE5D,YAAK,OAAO,KAAU,EACtB,KAAK,MAAQ,EACN,CACT,CACA,GAAI,KAAK,YAAcH,GAAsB,OAAQ,CACnD,QAASG,EAAI,EAAGA,EAAIH,GAAsB,OAAQ,EAAEG,EAClD,GAAI,KAAK,QAAQA,CAAC,IAAMH,GAAsBG,CAAC,EAAG,OAAO,KAAK,GAAG,EAEnE,YAAK,OAAO,KAAU,EACtB,KAAK,MAAQ,EACN,CACT,CACA,OAAO,KAAK,GAAG,CACjB,CACA,OAAI,KAAK,QAAU,EAAwB,EACvC,KAAK,QAAU,GACd,KAAK,OAAO,OAAS,EAEnB,KAAK,YAAY,KAAK,SAAS,GACpC,KAAK,MAAQ,EACN,GAFuC,KAAK,GAAG,EAIjD,KAAK,GAAG,CACjB,CAEO,MAAMjB,EAAmBkB,EAAeC,EAAqB,CAClE,IAAIC,EAAQ,KAAK,MACbC,EAAM,KAAK,UACTC,EAAS,KAAK,QAEpB,GADIF,IAAU,GAAqBA,IAAU,GACzCA,IAAU,GAAqBC,EAAM,GAAI,MAAO,GACpD,QAASnB,EAAIgB,EAAOhB,EAAIiB,EAAK,EAAEjB,EAAG,CAChC,IAAMqB,EAAIvB,EAAKE,CAAC,EAChB,OAAQqB,EAAG,CACT,IAAK,IACH,GAAI,CAAC,KAAK,YAAYF,CAAG,EAAG,OAAO,KAAK,GAAG,EAC3CD,EAAQ,EACRC,EAAM,EACN,MACF,IAAK,IACH,GAAID,IAAU,EAAmB,CAC/B,GAAIE,EAAO,CAAC,IAAM,GAAI,CAEpB,IAAIL,EAAI,EACR,KAAOA,EAAIP,GAAY,OAAQ,EAAEO,EAC/B,GAAIK,EAAOL,CAAC,IAAMP,GAAYO,CAAC,EAAG,OAAO,KAAK,GAAG,EAGnD,GADA,KAAK,OAAO,KAAU,EAClBI,IAAQT,GAAgB,OAAQ,CAClC,KAAOK,EAAIL,GAAgB,OAAQ,EAAEK,EACnC,GAAIK,EAAOL,CAAC,IAAML,GAAgBK,CAAC,EAAG,OAAO,KAAK,GAAG,EAEvD,YAAK,OAAO,KAAU,EACtB,KAAK,MAAQ,EACNf,EAAI,CACb,CACF,SAAWoB,EAAO,CAAC,IAAM,GAAI,CAE3B,QAASL,EAAI,EAAGA,EAAIN,GAAqB,OAAQ,EAAEM,EACjD,GAAIK,EAAOL,CAAC,IAAMN,GAAqBM,CAAC,EAAG,OAAO,KAAK,GAAG,EAE5D,KAAK,OAAO,KAAU,CACxB,KACE,QAAO,KAAK,GAAG,EAEjBG,EAAQ,EACRC,EAAM,CACR,SAAWD,IAAU,EAAiB,CACpC,GAAI,CAAC,KAAK,UAAUC,CAAG,EAAG,OAAO,KAAK,GAAG,EACzCD,EAAQ,EACRC,EAAM,CACR,SAAWD,IAAU,EAAmB,CACtC,GAAIC,GAAON,GAAgB,OAAO,KAAK,GAAG,EAC1CO,EAAOD,GAAK,EAAIE,CAClB,CACA,MACF,IAAK,IACH,OAAIH,IAAU,GACR,CAAC,KAAK,YAAYC,CAAG,EAAU,KAAK,GAAG,GAE7C,KAAK,MAAQ,EACNnB,EAAI,GACb,QACE,GAAImB,GAAON,GAAgB,OAAO,KAAK,GAAG,EAC1CO,EAAOD,GAAK,EAAIE,CACpB,CACF,CACA,YAAK,MAAQH,EACb,KAAK,UAAYC,EACV,EACT,CAEQ,IAAa,CACnB,YAAK,OAAO,KAAO,EACnB,KAAK,MAAQ,EACN,EACT,CAEQ,UAAUA,EAAsB,CACtC,IAAMJ,EAAIlB,EAAM,KAAK,QAAQ,SAAS,EAAGsB,CAAG,CAAC,EAC7C,OAAIJ,GACF,KAAK,KAAOA,EACZ,KAAK,OAAOA,CAAC,EAAI,KACV,IAEF,EACT,CAEQ,YAAYI,EAAsB,CACxC,GAAI,KAAK,KAAM,CACb,GAAI,CACF,IAAMjB,EAAI,KAAK,QAAQ,MAAM,EAAGiB,CAAG,EACnC,KAAK,OAAO,KAAK,IAAI,EAAIZ,GAAS,KAAK,IAAI,EAAIA,GAAS,KAAK,IAAI,EAAEL,CAAC,EAAIA,CAC1E,MAAQ,CACN,MAAO,EACT,CACA,MAAO,EACT,CACA,MAAO,EACT,CACF,ECvPO,IAAMoB,EAA6B,CACxC,KAAM,cACN,MAAO,EACP,OAAQ,CACV,EAEO,SAASC,GAAUC,EAAyB,CACjD,GAAIA,EAAE,OAAS,GACb,OAAOF,EAET,IAAMG,EAAM,IAAI,YAAYD,EAAE,OAAQA,EAAE,WAAY,CAAC,EAGrD,GAAIC,EAAI,CAAC,IAAM,YAAcA,EAAI,CAAC,IAAM,WAAcA,EAAI,CAAC,IAAM,WAC/D,MAAO,CACL,KAAM,YACN,MAAQD,EAAE,EAAE,GAAK,GAAKA,EAAE,EAAE,GAAK,GAAKA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,EACrD,OAAQA,EAAE,EAAE,GAAK,GAAKA,EAAE,EAAE,GAAK,GAAKA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,CACvD,EAGF,GAAIA,EAAE,CAAC,IAAM,KAAQA,EAAE,CAAC,IAAM,KAAQA,EAAE,CAAC,IAAM,IAAM,CACnD,GAAM,CAACE,EAAOC,CAAM,EAAIC,GAAQJ,CAAC,EACjC,MAAO,CAAE,KAAM,aAAc,MAAAE,EAAO,OAAAC,CAAO,CAC7C,CAEA,GAAIF,EAAI,CAAC,IAAM,YAAeD,EAAE,CAAC,IAAM,IAAQA,EAAE,CAAC,IAAM,KAASA,EAAE,CAAC,IAAM,GACxE,MAAO,CACL,KAAM,YACN,MAAQA,EAAE,CAAC,GAAK,EAAIA,EAAE,CAAC,EACvB,OAAQA,EAAE,CAAC,GAAK,EAAIA,EAAE,CAAC,CACzB,EAGF,GAAIC,EAAI,CAAC,IAAM,WACb,MAAO,CACL,KAAM,YACN,MAAQD,EAAE,CAAC,GAAK,GAAKA,EAAE,CAAC,GAAK,GAAKA,EAAE,CAAC,GAAK,EAAIA,EAAE,CAAC,EACjD,OAAQA,EAAE,CAAC,GAAK,GAAKA,EAAE,CAAC,GAAK,GAAKA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,CACrD,EAGF,GAAIC,EAAI,CAAC,IAAM,YAAcA,EAAI,CAAC,IAAM,aAAeA,EAAI,CAAC,EAAI,YAAc,QAAU,CACtF,OAAQD,EAAE,EAAE,EAAG,CACb,IAAK,IACH,MAAO,CACL,KAAM,aACN,OAASA,EAAE,EAAE,EAAIA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,GAAK,IAAM,EAC7C,QAASA,EAAE,EAAE,EAAIA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,GAAK,IAAM,CAC/C,EACF,IAAK,IACH,GAAIA,EAAE,EAAE,IAAM,GAAM,OAAOF,EAC3B,IAAMO,EAAML,EAAE,EAAE,EAAIA,EAAE,EAAE,GAAK,EAAIA,EAAE,EAAE,GAAK,GAAKA,EAAE,EAAE,GAAK,GACxD,MAAO,CACL,KAAM,aACN,OAASK,EAAa,OAAU,EAChC,QAASA,IAAQ,GAAK,OAAU,CAClC,EACF,IAAK,IACH,OAAIL,EAAE,EAAE,IAAM,KAAQA,EAAE,EAAE,IAAM,GAAQA,EAAE,EAAE,IAAM,GAAaF,EACxD,CACL,KAAM,aACN,OAASE,EAAE,EAAE,EAAIA,EAAE,EAAE,GAAK,GAAK,MAC/B,QAASA,EAAE,EAAE,EAAIA,EAAE,EAAE,GAAK,GAAK,KACjC,CACJ,CACA,OAAOF,CACT,CAEA,GAAIG,EAAI,CAAC,IAAM,aAAeA,EAAI,CAAC,IAAM,YAAcA,EAAI,CAAC,IAAM,YAAa,CAC7E,IAAIK,EAAM,GAEJC,EAAQ,KAAK,IAAIP,EAAE,OAAS,GAAI,IAAI,EAC1C,QAASQ,EAAI,EAAGA,EAAID,EAAOC,IAEzB,GAAIR,EAAEQ,CAAC,IAAM,KAAQR,EAAEQ,EAAI,CAAC,IAAM,KAAQR,EAAEQ,EAAI,CAAC,IAAM,KAAQR,EAAEQ,EAAI,CAAC,IAAM,IAAM,CAChFF,EAAME,EACN,KACF,CAEF,GAAIF,IAAQ,GAAI,CAEd,IAAMJ,EACJF,EAAEM,EAAO,CAAC,GAAK,GACfN,EAAEM,EAAO,CAAC,GAAK,GACfN,EAAEM,EAAM,EAAE,GAAM,EAChBN,EAAEM,EAAM,EAAE,EACNH,EACJH,EAAEM,EAAM,EAAE,GAAK,GACfN,EAAEM,EAAM,EAAE,GAAK,GACfN,EAAEM,EAAM,EAAE,GAAM,EAChBN,EAAEM,EAAM,EAAE,EACZ,GAAIJ,EAAQ,GAAKC,EAAS,EACxB,MAAO,CAAE,KAAM,aAAc,MAAAD,EAAO,OAAAC,CAAO,CAE/C,CACA,OAAOL,CACT,CACA,OAAOA,CACT,CAGA,SAASM,GAAQJ,EAAiC,CAChD,IAAMS,EAAMT,EAAE,OACVQ,EAAI,EACJE,EAAcV,EAAEQ,CAAC,GAAK,EAAIR,EAAEQ,EAAI,CAAC,EACrC,OAAa,CAEX,GADAA,GAAKE,EACDF,GAAKC,EAEP,MAAO,CAAC,EAAG,CAAC,EAEd,GAAIT,EAAEQ,CAAC,IAAM,IACX,MAAO,CAAC,EAAG,CAAC,EAEd,GAAIR,EAAEQ,EAAI,CAAC,IAAM,KAAQR,EAAEQ,EAAI,CAAC,IAAM,IACpC,OAAIA,EAAI,EAAIC,EACH,CACLT,EAAEQ,EAAI,CAAC,GAAK,EAAIR,EAAEQ,EAAI,CAAC,EACvBR,EAAEQ,EAAI,CAAC,GAAK,EAAIR,EAAEQ,EAAI,CAAC,CACzB,EAEK,CAAC,EAAG,CAAC,EAEdA,GAAK,EACLE,EAAcV,EAAEQ,CAAC,GAAK,EAAIR,EAAEQ,EAAI,CAAC,CACnC,CACF,CFnHA,IAAMG,GAAgC,CACpC,OACA,KAAM,eACN,KAAM,EACN,MAAO,OACP,OAAQ,OACR,oBAAqB,EACrB,OAAQ,CACV,EAGaC,GAAN,KAAuD,CAU5D,YACmBC,EACAC,EACAC,EACAC,EACjB,CAJiB,WAAAH,EACA,eAAAC,EACA,cAAAC,EACA,mBAAAC,EAbnB,KAAQ,YAAc,EACtB,KAAQ,SAAW,GACnB,KAAQ,IAAM,IAAIC,GAClB,KAAQ,QAAyBN,GAGjC,KAAQ,aAAe,GACvB,KAAQ,YAAc,GAQpB,IAAMO,EAAkB,KAAK,KAAK,KAAK,MAAM,aAAe,EAAI,CAAC,EAC3DC,EAAe,KAAK,IAAI,QAA2BD,CAAe,EACxE,KAAK,KAAO,IAAI,GAAAE,QAAc,EAAwBF,EAAiBC,CAAY,EACnF,KAAK,QAAU,IAAI,GAAAE,QAAW,CAAsB,CACtD,CAEO,OAAc,CACnB,KAAK,cACL,KAAK,IAAI,MAAM,EACf,KAAK,KAAK,QAAQ,EAClB,KAAK,QAAQ,QAAQ,CACvB,CAEO,OAAc,CACnB,KAAK,SAAW,GAChB,KAAK,IAAI,MAAM,CACjB,CAEO,IAAIC,EAAmBC,EAAeC,EAAmB,CAC9D,GAAI,MAAK,SAET,GAAI,KAAK,IAAI,QAAU,EAChB,KAAK,KAAK,IAAIF,EAAK,SAASC,EAAOC,CAAG,CAAC,IAAiB,IAC3D,KAAK,KAAK,QAAQ,EAClB,KAAK,SAAW,QAEb,CACL,IAAMC,EAAU,KAAK,IAAI,MAAMH,EAAMC,EAAOC,CAAG,EAC/C,GAAIC,IAAY,GAAI,CAClB,KAAK,SAAW,GAChB,MACF,CACA,GAAIA,EAAU,EAAG,CAEf,GADgB,KAAK,IAAI,OAAO,OAChB,EAAmB,CAOjC,GANI,KAAK,eACP,KAAK,aAAe,GACpB,KAAK,YAAc,GACnB,KAAK,KAAK,QAAQ,GAEpB,KAAK,QAAU,OAAO,OAAO,CAAC,EAAGd,GAAgB,KAAK,IAAI,MAAM,EAC5D,CAAC,KAAK,QAAQ,OAAQ,CACxB,KAAK,SAAW,GAChB,MACF,CACA,GAAI,CAAC,KAAK,aAAa,EAAG,CACxB,KAAK,SAAW,GAChB,MACF,CACF,SAAW,KAAK,YAAa,CAC3B,KAAK,SAAW,GAChB,MACF,CACK,KAAK,KAAK,IAAIW,EAAK,SAASG,EAASD,CAAG,CAAC,IAAiB,IAC7D,KAAK,KAAK,QAAQ,EAClB,KAAK,SAAW,GACZ,KAAK,eAAc,KAAK,YAAc,IAE9C,CACF,CACF,CAEO,IAAIE,EAA8C,CAGvD,GAFI,KAAK,UAEL,KAAK,IAAI,QAAU,GACjB,KAAK,IAAI,IAAI,EAAG,MAAO,GAE7B,IAAMC,EAAU,KAAK,IAAI,OAAO,KAEhC,GAAIA,IAAY,EAAuB,MAAO,GAE9C,GAAIA,IAAY,EAA6B,CAE3C,IAAIC,EAAIC,EAAkB,MACtBC,EAAID,EAAkB,OACtB,KAAK,UAAU,aACjBD,EAAI,KAAK,UAAU,WAAW,IAAI,OAAO,MAAQ,KAAK,cAAc,KACpEE,EAAI,KAAK,UAAU,WAAW,IAAI,OAAO,OAAS,KAAK,cAAc,MAEvE,IAAMC,EAAQ,KAAK,cAAc,MAAM,qBAAqB,KAAO,EAC7DC,EAAS,4BAA4BF,EAAE,QAAQ,CAAC,CAAC,IAAIF,EAAE,QAAQ,CAAC,CAAC,IAAIG,EAAM,QAAQ,CAAC,CAAC,SAC3F,YAAK,cAAc,MAAMC,EAAQ,EAAK,EAC/B,EACT,CAEA,GAAIL,IAAY,EACd,YAAK,QAAU,OAAO,OAAO,CAAC,EAAGhB,GAAgB,KAAK,IAAI,MAAM,EAChE,KAAK,aAAe,GACpB,KAAK,YAAc,GACnB,KAAK,KAAK,QAAQ,EACb,KAAK,aAAa,IACrB,KAAK,YAAc,IAEd,GAGT,GAAIgB,IAAY,IACV,CAAC,KAAK,eACV,KAAK,aAAe,GAChB,KAAK,aAAe,KAAK,QAAQ,OAAS,IAA4B,MAAO,GAKnF,IAAIC,EAAI,EACJE,EAAI,EAGJG,EACAC,EAAUC,EAoBd,IAnBIF,EAAOP,MACLO,EAAO,CAAC,KAAK,KAAK,IAAI,IACxBC,EAAUE,GAAU,KAAK,KAAK,KAAK,GAC/BH,EAAOC,EAAQ,OAAS,gBAC1BN,EAAIM,EAAQ,MACZJ,EAAII,EAAQ,QACRD,EAAOL,GAAKE,GAAKF,EAAIE,EAAI,KAAK,MAAM,aACtC,CAACF,EAAGE,CAAC,EAAI,KAAK,QAAQF,EAAGE,CAAC,EAAE,IAAI,KAAK,KAAK,EAC1CG,EAAOL,GAAKE,GAAKF,EAAIE,EAAI,KAAK,MAAM,YAEpC,QAAQ,KAAK,8BAA8BI,EAAQ,KAAK,IAAIA,EAAQ,MAAM,EAAE,GAG9E,QAAQ,KAAK,6BAA6B,GAG5C,QAAQ,KAAK,mCAAmC,GAGhD,CAACD,EACH,YAAK,KAAK,QAAQ,EACX,GAGT,IAAII,EACJ,GAAIH,EAAQ,OAAS,YAAa,CAChC,IAAIZ,EACJ,GAAI,CACFA,EAAO,KAAK,QAAQ,OAAO,KAAK,KAAK,KAAK,CAC5C,OAASgB,EAAG,CACV,eAAQ,KAAK,kCAAmCA,CAAC,EACjD,KAAK,KAAK,QAAQ,EAClB,KAAK,QAAQ,QAAQ,EACd,EACT,CAOA,GANAD,EAAO,IAAI,UACT,IAAI,kBAAkBf,EAAK,OAAQA,EAAK,WAAYA,EAAK,UAAU,EACnE,KAAK,QAAQ,MACb,KAAK,QAAQ,MACf,EACA,KAAK,QAAQ,QAAQ,EACjBM,IAAM,KAAK,QAAQ,OAASE,IAAM,KAAK,QAAQ,OAAQ,CAEzD,KAAK,KAAK,QAAQ,EAClB,IAAMS,EAASC,EAAc,aAAa,OAAW,KAAK,QAAQ,MAAO,KAAK,QAAQ,MAAM,EAC5F,OAAAD,EAAO,WAAW,IAAI,GAAG,aAAaF,EAAM,EAAG,CAAC,EAChD,KAAK,SAAS,SAASE,CAAM,EACtB,EACT,CACF,MACEF,EAAO,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAG,CAAE,KAAMH,EAAQ,IAAK,CAAC,EAE3D,KAAK,KAAK,QAAQ,EAClB,IAAMO,EAAa,KAAK,YACxB,OAAO,kBAAkBJ,EAAM,CAAE,YAAaT,EAAG,aAAcE,CAAE,CAAC,EAC/D,KAAKY,GACAD,IAAe,KAAK,aACtBC,EAAG,MAAM,EACF,KAET,KAAK,SAAS,SAASA,CAAE,EAClB,GACR,EACA,MAAMJ,IACL,QAAQ,KAAK,uBAAuBJ,EAAQ,IAAI,IAAIA,EAAQ,KAAK,IAAIA,EAAQ,MAAM,GAAII,CAAC,EACjF,GACR,CACL,CAGQ,cAAwB,CAC9B,GAAI,CACF,YAAK,KAAK,KAAK,EACR,EACT,OAAS,EAAG,CACV,eAAQ,KAAK,kCAAmC,CAAC,EACjD,KAAK,KAAK,QAAQ,EACX,EACT,CACF,CAEQ,QAAQV,EAAWE,EAA6B,CACtD,IAAMa,EAAK,KAAK,UAAU,YAAY,IAAI,KAAK,OAASd,EAAkB,MACpEe,EAAK,KAAK,UAAU,YAAY,IAAI,KAAK,QAAUf,EAAkB,OACrEgB,EAAQ,KAAK,UAAU,YAAY,IAAI,OAAO,OAASF,EAAK,KAAK,cAAc,KAC/EG,EAAS,KAAK,UAAU,YAAY,IAAI,OAAO,QAAUF,EAAK,KAAK,cAAc,KAEjFG,EAAK,KAAK,KAAK,KAAK,QAAQ,MAAQF,EAAOF,CAAE,EAC7CK,EAAK,KAAK,KAAK,KAAK,QAAQ,OAASF,EAAQF,CAAE,EACrD,GAAI,CAACG,GAAM,CAACC,EAAI,CACd,IAAMC,EAAKJ,EAAQjB,EACbsB,GAAMJ,EAASF,GAAMd,EACrBqB,EAAI,KAAK,IAAIF,EAAIC,CAAE,EACzB,OAAOC,EAAI,EAAI,CAACvB,EAAIuB,EAAGrB,EAAIqB,CAAC,EAAI,CAACvB,EAAGE,CAAC,CACvC,CACA,OAAQiB,EAEJ,KAAK,QAAQ,qBAAuB,CAACA,GAAM,CAACC,EAC1C,CAACD,EAAIjB,EAAIiB,EAAKnB,CAAC,EAAI,CAACmB,EAAIC,CAAE,EAF5B,CAACpB,EAAIoB,EAAKlB,EAAGkB,CAAE,CAGrB,CAEQ,KAAKI,EAAWC,EAAeC,EAAsB,CAC3D,OAAIF,IAAM,OAAe,EACrBA,EAAE,SAAS,GAAG,EAAU,SAASA,EAAE,MAAM,EAAG,EAAE,EAAG,EAAE,EAAIC,EAAQ,IAC/DD,EAAE,SAAS,IAAI,EAAU,SAASA,EAAE,MAAM,EAAG,EAAE,EAAG,EAAE,EACjD,SAASA,EAAG,EAAE,EAAIE,CAC3B,CACF,EGpQA,IAAAC,GAAiD,QCmI1C,SAASC,GAAkBC,EAA6B,CAC7D,IAAMC,EAAqB,CAAC,EACtBC,EAAQF,EAAK,MAAM,GAAG,EAE5B,QAAWG,KAAQD,EAAO,CACxB,IAAME,EAAQD,EAAK,QAAQ,GAAG,EAC9B,GAAIC,IAAU,GAAI,SAElB,IAAMC,EAAMF,EAAK,UAAU,EAAGC,CAAK,EAC7BE,EAAQH,EAAK,UAAUC,EAAQ,CAAC,EAGtC,GAAIC,IAAQ,IAAiB,CAC3BJ,EAAI,OAASK,EACb,QACF,CACA,GAAID,IAAQ,IAAsB,CAChCJ,EAAI,YAAcK,EAClB,QACF,CACA,GAAID,IAAQ,IAAuB,CACjCJ,EAAI,aAAeK,EACnB,QACF,CACA,GAAID,IAAQ,IAA0B,CACpCJ,EAAI,eAAiBK,EACrB,QACF,CACA,IAAMC,EAAW,SAASD,EAAO,EAAE,EACnC,OAAQD,EAAK,CACX,IAAK,IAAiBJ,EAAI,OAASM,EAAU,MAC7C,IAAK,IAAaN,EAAI,GAAKM,EAAU,MACrC,IAAK,IAAuBN,EAAI,YAAcM,EAAU,MACxD,IAAK,IAAgBN,EAAI,MAAQM,EAAU,MAC3C,IAAK,IAAiBN,EAAI,OAASM,EAAU,MAC7C,IAAK,IAAmBN,EAAI,EAAIM,EAAU,MAC1C,IAAK,IAAmBN,EAAI,EAAIM,EAAU,MAC1C,IAAK,IAAuBN,EAAI,YAAcM,EAAU,MACxD,IAAK,IAAwBN,EAAI,aAAeM,EAAU,MAC1D,IAAK,IAA6BN,EAAI,QAAUM,EAAU,MAC1D,IAAK,IAA6BN,EAAI,QAAUM,EAAU,MAC1D,IAAK,IAAkBN,EAAI,QAAUM,EAAU,MAC/C,IAAK,IAAeN,EAAI,KAAOM,EAAU,MACzC,IAAK,IAAeN,EAAI,KAAOM,EAAU,MACzC,IAAK,IAAgBN,EAAI,MAAQM,EAAU,MAC3C,IAAK,IAA0BN,EAAI,eAAiBM,EAAU,MAC9D,IAAK,IAAkBN,EAAI,OAASM,EAAU,MAC9C,IAAK,IAAuBN,EAAI,YAAcM,EAAU,KAC1D,CACF,CAEA,OAAON,CACT,CD/JA,IAAMO,GAAa,EAGNC,GAAN,KAA8E,CAiCnF,YACmBC,EACAC,EACAC,EACAC,EACjB,CAJiB,WAAAH,EACA,eAAAC,EACA,mBAAAC,EACA,mBAAAC,EApCnB,KAAQ,SAAW,GACnB,KAAQ,YAAc,EACtB,KAAQ,aAAe,GAEvB,KAAQ,eAAuC,KAO/C,KAAQ,eAAiB,GAGzB,KAAQ,aAAe,IAAI,YAAY,GAA+B,EACtE,KAAQ,eAAiB,EAGzB,KAAQ,kBAAoB,EAC5B,KAAQ,kBAAoB,EAG5B,KAAQ,eAAuC,KAI/C,KAAQ,sBAA2D,IAAI,IAarE,KAAK,iBAAmB,KAAK,KAAK,KAAK,MAAM,eAAiB,EAAI,CAAC,EAEnE,KAAK,qBAAuB,KAAK,IAAI,QAAgC,KAAK,gBAAgB,CAC5F,CAEO,OAAc,CACnB,KAAK,cACL,KAAK,mBAAmB,EACpB,KAAK,iBACP,KAAK,eAAe,QAAQ,EAC5B,KAAK,eAAiB,MAExB,KAAK,cAAc,MAAM,CAC3B,CAEO,SAAgB,CACrB,KAAK,MAAM,CACb,CAEQ,oBAAoBC,EAAmB,CAC7C,KAAK,sBAAsB,OAAOA,CAAG,EACjC,KAAK,kBAAoBA,IAC3B,KAAK,gBAAkB,OAE3B,CAEQ,oBAA2B,CACjC,QAAWC,KAAW,KAAK,sBAAsB,OAAO,EACtDA,EAAQ,QAAQ,QAAQ,EAE1B,KAAK,sBAAsB,MAAM,EACjC,KAAK,gBAAkB,MACzB,CAEO,OAAc,CACnB,KAAK,SAAW,GAChB,KAAK,aAAe,GACpB,KAAK,eAAiB,GACtB,KAAK,eAAiB,EACtB,KAAK,eAAiB,KAEtB,KAAK,kBAAoB,KAAK,iBAC9B,KAAK,kBAAoB,EACzB,KAAK,eAAiB,IACxB,CAEO,IAAIC,EAAmBC,EAAeC,EAAmB,CAC9D,GAAI,MAAK,SAET,GAAI,CAAC,KAAK,eACR,KAAK,eAAeF,EAAMC,EAAOC,CAAG,MAC/B,CAEL,IAAIC,EAAaD,EACjB,QAASE,EAAIH,EAAOG,EAAIF,EAAKE,IAC3B,GAAIJ,EAAKI,CAAC,IAAM,GAAqB,CACnC,KAAK,eAAiB,GACtBD,EAAaC,EACb,KACF,CAIF,IAAMC,EAAaF,EAAaF,EAChC,GAAI,KAAK,eAAiBI,EAAa,IAAiC,CACtE,KAAK,SAAW,GAChB,MACF,CAIA,GAHA,KAAK,aAAa,IAAIL,EAAK,SAASC,EAAOE,CAAU,EAAG,KAAK,cAAc,EAC3E,KAAK,gBAAkBE,EAEnB,CAAC,KAAK,eAAgB,CAKxB,GAHA,KAAK,eAAiBC,GAAkB,KAAK,wBAAwB,CAAC,EAGlE,KAAK,eAAe,KAAO,QAAa,KAAK,eAAe,cAAgB,OAAW,CACzF,KAAK,cAAc,KAAK,eAAe,GAAI,0CAA2C,KAAK,eAAe,OAAS,CAAC,EACpH,KAAK,SAAW,GAChB,MACF,CAGA,GAAI,KAAK,eAAe,SAAW,IACjC,OAIF,IAAMC,EAAeJ,EAAa,EAC9BI,EAAeL,GACjB,KAAK,eAAeF,EAAMO,EAAcL,CAAG,CAE/C,CACF,CACF,CAGQ,eAAeF,EAAmBC,EAAeC,EAAmB,CAC1E,GAAI,KAAK,SAAU,OAKnB,IAAMM,EAAa,KAAK,gBAAgB,IAAM,KAAK,iBAAmB,EAChET,EAAU,KAAK,sBAAsB,IAAIS,CAAU,EACnDC,EAAsBV,GAAS,kBAAoB,EAGzD,GAFA,KAAK,mBAAqBG,EAAMD,EACFQ,EAAsB,KAAK,kBAC7B,KAAK,kBAAmB,CAClD,IAAMC,EAAmB,KAAK,gBAAkBX,GAAS,QACrDW,GACFA,EAAiB,QAAQ,EAE3B,KAAK,eAAiB,KAClBX,GACF,KAAK,oBAAoBS,CAAU,EAErC,KAAK,SAAW,GAChB,MACF,CAEA,GAAI,MAAK,aAKT,IAHIT,GAAS,SAAW,CAAC,KAAK,iBAC5B,KAAK,eAAiBA,EAAQ,SAE5B,CAAC,KAAK,eAAgB,CAExB,IAAMY,EAAkB,KAAK,iBAAmB,OAChD,GAAIA,EAAkB,KAAK,MAAM,aAAe,IAAS,CACvD,KAAK,SAAW,GACZ,KAAK,gBAAgB,KAAO,QAC9B,KAAK,cAAc,KAAK,eAAe,GAAI,uCAAwC,KAAK,eAAe,OAAS,CAAC,EAEnH,MACF,CACA,IAAMC,EAAa,KAAK,IAAI,EAAG,KAAK,MAAM,KAAK,MAAM,aAAe,IAAUD,CAAe,CAAC,EAC9F,KAAO,KAAK,sBAAsB,MAAQC,GAAY,CACpD,IAAMC,EAAS,KAAK,sBAAsB,QAAQ,EAAE,KAAK,EAAE,MAC3D,GAAI,CAACA,EAAQ,MACbA,EAAO,CAAC,EAAE,QAAQ,QAAQ,EAC1B,KAAK,oBAAoBA,EAAO,CAAC,CAAC,EAC9BA,EAAO,CAAC,EAAE,IAAI,KAAO,QACvB,KAAK,cAAcA,EAAO,CAAC,EAAE,IAAI,GAAI,uCAAwCA,EAAO,CAAC,EAAE,IAAI,OAAS,CAAC,CAEzG,CACA,IAAMC,EAAU,IAAI,GAAAC,QAAc,QAA6B,KAAK,iBAAkB,KAAK,oBAAoB,EAC/G,GAAI,CACFD,EAAQ,KAAK,CACf,OAASE,EAAG,CAEV,QAAQ,KAAK,oCAAqCA,CAAC,EACnD,KAAK,SAAW,GACZ,KAAK,gBAAgB,KAAO,QAC9B,KAAK,cAAc,KAAK,eAAe,GAAI,oCAAqC,KAAK,eAAe,OAAS,CAAC,EAEhH,MACF,CACA,KAAK,eAAiBF,CACxB,CAEI,KAAK,eAAe,IAAId,EAAK,SAASC,EAAOC,CAAG,CAAC,IAAMV,KACzD,KAAK,eAAe,QAAQ,EAC5B,KAAK,eAAiB,KACtB,KAAK,aAAe,GAChBO,GACF,KAAK,oBAAoBS,CAAU,GAGzC,CAEO,IAAIS,EAA8C,CACvD,GAAI,KAAK,UAAY,CAACA,EACpB,OAAI,KAAK,iBACP,KAAK,eAAe,QAAQ,EAC5B,KAAK,eAAiB,MAEjB,GAIT,GAAI,KAAK,eACP,OAAO,KAAK,wBAAwB,EAItC,IAAMC,EAAM,KAAK,eAGjB,GAAIA,EAAI,SAAW,IACjB,OAAO,KAAK,cAAcA,CAAG,EAI/B,IAAMV,EAAaU,EAAI,IAAM,KAAK,iBAAmB,EAC/CC,EAAeD,EAAI,OAAS,EAC5BnB,EAAU,KAAK,sBAAsB,IAAIS,CAAU,EAEzD,GAAIW,EACF,OAAI,KAAK,iBACHpB,GACFA,EAAQ,kBAAoB,KAAK,kBACjCA,EAAQ,YAAcA,EAAQ,aAAe,KAAK,cAElD,KAAK,sBAAsB,IAAIS,EAAY,CACzC,IAAK,CAAE,GAAGU,CAAI,EACd,QAAS,KAAK,eACd,iBAAkB,KAAK,kBACvB,YAAa,KAAK,YACpB,CAAC,EAEH,KAAK,gBAAkBV,EACvB,KAAK,eAAiB,MAEjB,GAILT,IACF,KAAK,gBAAkB,QAGzB,IAAIqB,EAAc,KAAK,aACnBC,EAAWH,EACXJ,EAAU,KAAK,eAEff,IACFsB,EAAWtB,EAAQ,IACnBe,EAAUf,EAAQ,QAClBqB,EAAcA,GAAerB,EAAQ,YACrC,KAAK,sBAAsB,OAAOS,CAAU,GAG9C,IAAIc,EAAa,IAAI,WAAW,CAAC,EAC7BR,IACEA,EAAQ,IAAI,IAAMtB,KACpB4B,EAAc,IAEhBE,EAAaR,EAAQ,OAEvB,KAAK,eAAiB,KAKtB,IAAMS,EAAS,KAAK,8BAA8BF,EAAUC,EAAYF,CAAW,EACnF,OAAIN,GACFA,EAAQ,QAAQ,EAEXS,CACT,CAIQ,yBAAkC,CACxC,IAAIC,EAAM,GACV,QAASpB,EAAI,EAAGA,EAAI,KAAK,eAAgBA,IACvCoB,GAAO,OAAO,cAAc,KAAK,aAAapB,CAAC,CAAC,EAElD,OAAOoB,CACT,CAEQ,yBAAsD,CAC5D,IAAMN,EAAMZ,GAAkB,KAAK,wBAAwB,CAAC,EAG5D,GAAIY,EAAI,KAAO,QAAaA,EAAI,cAAgB,OAC9C,YAAK,cAAcA,EAAI,GAAI,0CAA2CA,EAAI,OAAS,CAAC,EAC7E,GAKT,OAFeA,EAAI,QAAU,IAEb,CACd,QACE,OAAO,KAAK,cAAcA,CAAG,EAC/B,QACE,YAAK,cAAcA,EAAI,IAAM,EAAG,KAAMA,EAAI,OAAS,CAAC,EAC7C,GACT,QACE,OAAO,KAAK,iBAAiBA,CAAG,EAClC,QAKE,OAAIA,EAAI,KAAO,QACb,KAAK,cAAcA,EAAI,GAAI,4BAA6BA,EAAI,OAAS,CAAC,EAEjE,EACX,CACF,CAEQ,8BAA8BA,EAAoBO,EAAmBL,EAAkD,CAG7H,OAFeF,EAAI,QAAU,IAEb,CACd,QAA2B,CACzB,IAAMK,EAAS,KAAK,gBAAgBL,EAAKO,EAAOL,CAAW,EAG3D,OAAKF,EAAI,cAAgB,OAAS,KAAOA,EAAI,KAAO,SAC9CE,EACF,KAAK,cAAcF,EAAI,GAAI,6BAA8BA,EAAI,OAAS,CAAC,EAC9DO,EAAM,OAAS,GACxB,KAAK,cAAcP,EAAI,GAAI,KAAMA,EAAI,OAAS,CAAC,GAG5CK,CACT,CACA,QACE,OAAO,KAAK,uBAAuBL,EAAKO,EAAOL,CAAW,EAC5D,QACE,OAAO,KAAK,aAAaF,EAAKO,EAAOL,CAAW,EAClD,QAEE,OAAO,KAAK,iBAAiBF,CAAG,EAClC,QAKE,OAAIA,EAAI,KAAO,QACb,KAAK,cAAcA,EAAI,GAAI,4BAA6BA,EAAI,OAAS,CAAC,EAEjE,EACX,CACF,CAEQ,iBAAiBA,EAAgD,CACvE,GAAIA,EAAI,KAAO,OACb,MAAO,GAET,IAAMQ,EAAKR,EAAI,GACTS,EAAQ,KAAK,cAAc,SAASD,CAAE,EAC5C,OAAKC,EAIU,KAAK,cAAcA,EAAOT,CAAG,EAC9B,KAAKD,IACjB,KAAK,cAAcS,EAAIT,EAAU,KAAO,gCAAiCC,EAAI,OAAS,EAAGA,EAAI,WAAW,EACjG,GACR,GAPC,KAAK,cAAcQ,EAAI,yBAA0BR,EAAI,OAAS,EAAGA,EAAI,WAAW,EACzE,GAOX,CAEQ,gBAAgBA,EAAoBO,EAAmBL,EAA+B,CAY5F,OADqBF,EAAI,cAAgB,OACpB,KACfA,EAAI,KAAO,QACb,KAAK,cAAcA,EAAI,GAAI,yCAA0CA,EAAI,OAAS,CAAC,EAE9E,KAGLE,GAAeK,EAAM,SAAW,GAEpC,KAAK,cAAc,WAAWP,EAAI,GAAI,CACpC,KAAM,IAAI,KAAK,CAACO,CAAiB,CAAC,EAClC,MAAOP,EAAI,OAAS,EACpB,OAAQA,EAAI,QAAU,EACtB,OAASA,EAAI,QAAU,GACvB,YAAaA,EAAI,aAAe,EAClC,CAAC,EACM,GACT,CAEQ,uBAAuBA,EAAoBO,EAAmBL,EAAkD,CACtH,GAAIA,EACF,OAAIF,EAAI,KAAO,QACb,KAAK,cAAcA,EAAI,GAAI,6BAA8BA,EAAI,OAAS,CAAC,EAElE,GAGT,KAAK,gBAAgBA,EAAKO,EAAOL,CAAW,EAE5C,IAAMM,EAAKR,EAAI,IAAM,KAAK,cAAc,YAClCS,EAAQ,KAAK,cAAc,SAASD,CAAE,EAC5C,GAAIC,EAAO,CACT,IAAMJ,EAAS,KAAK,cAAcI,EAAOT,CAAG,EAC5C,OAAIA,EAAI,KAAO,OACNK,EAAO,KAAKN,IACjB,KAAK,cAAcS,EAAIT,EAAU,KAAO,gCAAiCC,EAAI,OAAS,CAAC,EAChF,GACR,EAEIK,EAAO,KAAK,IAAM,EAAI,CAC/B,CACA,MAAO,EACT,CAEQ,aAAaL,EAAoBO,EAAmBL,EAA+B,CACzF,IAAMM,EAAKR,EAAI,IAAM,EACfU,EAAQV,EAAI,OAAS,EAM3B,IADqBA,EAAI,cAAgB,OACpB,IACnB,YAAK,cAAcQ,EAAI,yCAA0CE,CAAK,EAC/D,GAIT,GAAIR,EACF,YAAK,cAAcM,EAAI,6BAA8BE,CAAK,EACnD,GAIT,GAAIH,EAAM,SAAW,EACnB,YAAK,cAAcC,EAAI,KAAME,CAAK,EAC3B,GAGT,IAAMC,EAASX,EAAI,QAAU,GAE7B,GAAIW,IAAW,IACb,KAAK,cAAcH,EAAI,KAAME,CAAK,MAC7B,CACL,IAAME,EAAQZ,EAAI,OAAS,EACrBa,EAASb,EAAI,QAAU,EAE7B,GAAI,CAACY,GAAS,CAACC,EACb,YAAK,cAAcL,EAAI,sDAAuDE,CAAK,EAC5E,GAGT,IAAMI,EAAgBH,IAAW,OAC3BI,EAAgBH,EAAQC,EAASC,EAEvC,GAAIP,EAAM,OAASQ,EACjB,YAAK,cAAcP,EAAI,iCAAkCE,CAAK,EACvD,GAGT,KAAK,cAAcF,EAAI,KAAME,CAAK,CACpC,CACA,MAAO,EACT,CAEQ,cAAcV,EAA6B,CAOjD,OALiBA,EAAI,gBAAkB,IAKrB,CAChB,IAAK,IACL,IAAK,IACH,KAAK,mBAAmB,EACxB,KAAK,cAAc,UAAU,EAC7B,MACF,IAAK,IACL,IAAK,IAKH,GAAIA,EAAI,KAAO,OAAW,CACxB,IAAMnB,EAAU,KAAK,sBAAsB,IAAImB,EAAI,EAAE,EACjDnB,GACFA,EAAQ,QAAQ,QAAQ,EAE1B,KAAK,oBAAoBmB,EAAI,EAAE,EAC/B,KAAK,cAAc,WAAWA,EAAI,EAAE,CACtC,CACA,MACF,QAEE,KACJ,CACA,MAAO,EACT,CAEQ,cAAcQ,EAAYQ,EAAiBN,EAAeO,EAA4B,CAC5F,IAAMC,EAAOF,IAAY,KAEzB,GADIE,GAAQR,GAAS,GACjB,CAACQ,GAAQR,GAAS,EAAG,OAEzB,IAAMS,EAAQF,EAAc,MAAMA,CAAW,GAAK,GAC5CG,EAAW,WAAWZ,CAAE,GAAGW,CAAK,IAAIH,CAAO,SACjD,KAAK,cAAc,MAAM,YAAY,iBAAiBI,CAAQ,CAChE,CAIQ,cAAcX,EAAwBT,EAAsC,CAClF,OAAO,KAAK,kBAAkBS,EAAOT,CAAG,EACrC,KAAK,IAAM,EAAI,EACf,MAAM,IAAM,EAAK,CACtB,CAEA,MAAc,kBAAkBS,EAAwBT,EAAmC,CACzF,IAAMqB,EAAa,KAAK,YACpBC,EAAkC,MAAM,KAAK,cAAcb,CAAK,EAEpE,GAAI,CACF,GAAIY,IAAe,KAAK,YAAa,MAAM,IAAI,MAAM,uBAAuB,EAC5E,IAAME,EAAQ,KAAK,IAAI,EAAGvB,EAAI,GAAK,CAAC,EAC9BwB,EAAQ,KAAK,IAAI,EAAGxB,EAAI,GAAK,CAAC,EAC9ByB,EAAQzB,EAAI,aAAgBsB,EAAO,MAAQC,EAC3CG,EAAQ1B,EAAI,cAAiBsB,EAAO,OAASE,EAE7CG,EAAW,KAAK,IAAI,EAAGL,EAAO,MAAQC,CAAK,EAC3CK,EAAW,KAAK,IAAI,EAAGN,EAAO,OAASE,CAAK,EAC5CK,EAAa,KAAK,IAAI,EAAG,KAAK,IAAIJ,EAAOE,CAAQ,CAAC,EAClDG,EAAa,KAAK,IAAI,EAAG,KAAK,IAAIJ,EAAOE,CAAQ,CAAC,EAExD,GAAIC,IAAe,GAAKC,IAAe,EACrC,MAAM,IAAI,MAAM,0BAA0B,EAG5C,GAAIP,IAAU,GAAKC,IAAU,GAAKK,IAAeP,EAAO,OAASQ,IAAeR,EAAO,OAAQ,CAC7F,IAAMS,EAAU,MAAM,kBAAkBT,EAAQC,EAAOC,EAAOK,EAAYC,CAAU,EACpFR,EAAO,MAAM,EACbA,EAASS,CACX,CAEA,IAAMC,EAAK,KAAK,UAAU,YAAY,IAAI,KAAK,OAASC,EAAkB,MACpEC,EAAK,KAAK,UAAU,YAAY,IAAI,KAAK,QAAUD,EAAkB,OAIvEE,EACAC,EACApC,EAAI,UAAY,QAAaA,EAAI,OAAS,QAC5CmC,EAAUnC,EAAI,QACdoC,EAAUpC,EAAI,MACLA,EAAI,UAAY,QACzBmC,EAAUnC,EAAI,QACdoC,EAAU,KAAK,IAAI,EAAG,KAAK,KAAMd,EAAO,OAASA,EAAO,OAAUa,EAAUH,GAAME,CAAE,CAAC,GAC5ElC,EAAI,OAAS,QACtBoC,EAAUpC,EAAI,KACdmC,EAAU,KAAK,IAAI,EAAG,KAAK,KAAMb,EAAO,MAAQA,EAAO,QAAWc,EAAUF,GAAMF,CAAE,CAAC,IAErFG,EAAU,KAAK,KAAKb,EAAO,MAAQU,CAAE,EACrCI,EAAU,KAAK,KAAKd,EAAO,OAASY,CAAE,GAGxC,IAAIG,EAAIf,EAAO,MACXgB,EAAIhB,EAAO,OAQf,IALItB,EAAI,UAAY,QAAaA,EAAI,OAAS,UAC5CqC,EAAI,KAAK,MAAMF,EAAUH,CAAE,EAC3BM,EAAI,KAAK,MAAMF,EAAUF,CAAE,GAGzBG,EAAIC,EAAI,KAAK,MAAM,WACrB,MAAM,IAAI,MAAM,2BAA2B,EAI7C,IAAMC,EAAS,KAAK,cAAc,MAAM,OAClCC,EAASD,EAAO,EAChBE,EAASF,EAAO,EAChBG,EAAaH,EAAO,MAOpBI,GADc3C,EAAI,SAAW,QAAaA,EAAI,OAAS,EACrB,SAAW,MAEnD,GAAIqC,IAAMf,EAAO,OAASgB,IAAMhB,EAAO,OAAQ,CAC7C,IAAMsB,EAAS,MAAM,kBAAkBtB,EAAQ,CAAE,YAAae,EAAG,aAAcC,CAAE,CAAC,EAClFhB,EAAO,MAAM,EACbA,EAASsB,CACX,CAGA,IAAMC,GAAU,KAAK,IAAI,KAAK,IAAI,EAAG7C,EAAI,SAAW,CAAC,EAAGgC,EAAK,CAAC,EACxDc,GAAU,KAAK,IAAI,KAAK,IAAI,EAAG9C,EAAI,SAAW,CAAC,EAAGkC,EAAK,CAAC,EAC9D,GAAIW,KAAY,GAAKC,KAAY,EAAG,CAKlC,IAAMC,EAAW/C,EAAI,UAAY,OAAa,KAAK,MAAMmC,EAAUH,CAAE,EAAIV,EAAO,MAAQuB,GAClFG,GAAWhD,EAAI,OAAS,OAAa,KAAK,MAAMoC,EAAUF,CAAE,EAAIZ,EAAO,OAASwB,GAChFG,EAAeC,EAAc,aAAa,OAAO,SAAUH,EAASC,EAAO,EAC3EG,GAAYF,EAAa,WAAW,IAAI,EAC9C,GAAI,CAACE,GACH,MAAM,IAAI,MAAM,wCAAwC,EAE1DA,GAAU,UAAU7B,EAAQuB,GAASC,EAAO,EAE5C,IAAMM,GAAe,MAAM,kBAAkBH,CAAY,EAMzD,GALAA,EAAa,MAAQA,EAAa,OAAS,EAC3C3B,EAAO,MAAM,EACbA,EAAS8B,GACTf,EAAIf,EAAO,MACXgB,EAAIhB,EAAO,OACPe,EAAIC,EAAI,KAAK,MAAM,WACrB,MAAM,IAAI,MAAM,2BAA2B,EAEzCtC,EAAI,UAAY,SAClBmC,EAAU,KAAK,KAAKb,EAAO,MAAQU,CAAE,GAEnChC,EAAI,OAAS,SACfoC,EAAU,KAAK,KAAKd,EAAO,OAASY,CAAE,EAE1C,CAEA,GAAIb,IAAe,KAAK,YAAa,MAAM,IAAI,MAAM,uBAAuB,EAC5E,IAAMgC,GAASrD,EAAI,QAAU,EAO7B,GANA,KAAK,cAAc,SAASS,EAAM,GAAIa,EAAQ,GAAMqB,GAAOU,EAAM,EACjE/B,EAAS,OAKLtB,EAAI,iBAAmB,EAAG,CAE5B,IAAMsD,EAAWf,EAAO,MAAQG,EAChCH,EAAO,EAAIC,EAEXD,EAAO,EAAI,KAAK,IAAIE,EAASa,EAAU,CAAC,CAC1C,MAGEf,EAAO,EAAI,KAAK,IAAIC,EAASL,EAAS,KAAK,cAAc,IAAI,CAEjE,OAASrC,EAAG,CACV,MAAAwB,GAAQ,MAAM,EACRxB,CACR,CACF,CAGA,MAAc,cAAcW,EAA8C,CACxE,IAAIF,EAAoB,IAAI,WAAW,MAAME,EAAM,KAAK,YAAY,CAAC,EAMrE,GAJIA,EAAM,cAAgB,MACxBF,EAAQ,MAAM,KAAK,gBAAgBA,CAAK,GAGtCE,EAAM,SAAW,IAAiB,CACpC,IAAM8C,EAAUC,GAAUjD,CAAK,EAG/B,GAAIgD,EAAQ,OAAS,aAAe,EAAEA,EAAQ,MAAQ,IAAM,EAAEA,EAAQ,OAAS,IAAMA,EAAQ,MAAQA,EAAQ,OAAS,KAAK,MAAM,WAC/H,MAAM,IAAI,WAAW,mDAAmD,EAE1E,IAAME,EAAO,IAAI,KAAK,CAAClD,CAAiB,EAAG,CAAE,KAAM,WAAY,CAAC,EAChE,GAAI,CAAC,OAAO,kBAAmB,CAC7B,IAAMmD,EAAM,IAAI,gBAAgBD,CAAI,EAC9BE,EAAM,IAAI,MAChB,OAAO,IAAI,QAAqB,CAACC,EAASC,IAAW,CACnDF,EAAI,iBAAiB,OAAQ,IAAM,CACjC,IAAI,gBAAgBD,CAAG,EACvB,IAAMI,EAASZ,EAAc,aAAa,OAAO,SAAUS,EAAI,MAAOA,EAAI,MAAM,EAChFG,EAAO,WAAW,IAAI,GAAG,UAAUH,EAAK,EAAG,CAAC,EAC5C,kBAAkBG,CAAM,EAAE,KAAKF,CAAO,EAAE,MAAMC,CAAM,CACtD,CAAC,EACDF,EAAI,iBAAiB,QAAS,IAAM,CAClC,IAAI,gBAAgBD,CAAG,EACvBG,EAAO,IAAI,MAAM,sBAAsB,CAAC,CAC1C,CAAC,EACDF,EAAI,IAAMD,CACZ,CAAC,CACH,CACA,OAAO,kBAAkBD,CAAI,CAC/B,CAGA,IAAM7C,EAAQH,EAAM,MACdI,EAASJ,EAAM,OAErB,GAAI,CAACG,GAAS,CAACC,EACb,MAAM,IAAI,MAAM,8CAA8C,EAGhE,IAAMC,EAAgBL,EAAM,SAAW,OACjCM,EAAgBH,EAAQC,EAASC,EAEvC,GAAIP,EAAM,OAASQ,EACjB,MAAM,IAAI,MAAM,yBAAyB,EAG3C,IAAMgD,EAAanD,EAAQC,EAE3B,GAAIJ,EAAM,SAAW,GAEnB,OAAO,kBAAkB,IAAI,UAAU,IAAI,kBAAkBF,EAAM,OAAuBA,EAAM,WAAYwD,EAAa,CAAwC,EAAGnD,EAAOC,CAAM,CAAC,EAMpL,IAAM/B,EAAO,IAAI,kBAAkBiF,EAAa,CAAwC,EAClFC,EAAQ,IAAI,YAAYzD,EAAM,OAAQA,EAAM,WAAY,KAAK,MAAMA,EAAM,WAAa,CAAC,CAAC,EACxF0D,EAAQ,IAAI,YAAYnF,EAAK,MAAM,EACnCoF,EAAgBH,EAAa,GAE/BI,EAAY,EACZC,EAAY,EAChB,QAASlF,EAAI,EAAGA,EAAIgF,EAAehF,GAAK,EAAG,CACzC,IAAMmF,EAAKL,EAAMG,GAAW,EACtBG,EAAKN,EAAMG,GAAW,EACtBI,EAAKP,EAAMG,GAAW,EAE5BF,EAAMG,GAAW,EAAI,WAAaC,EAClCJ,EAAMG,GAAW,EAAI,WAAcC,IAAO,GAAOC,GAAM,EACvDL,EAAMG,GAAW,EAAI,WAAcE,IAAO,GAAOC,GAAM,GACvDN,EAAMG,GAAW,EAAI,WAAcG,IAAO,CAC5C,CAGA,IAAIC,EAAUN,EAAgB,EAC1BO,EAAUP,EAAgB,EAC9B,QAAShF,EAAIgF,EAAehF,EAAI6E,EAAY7E,IAC1CJ,EAAK2F,CAAO,EAAQlE,EAAMiE,CAAO,EACjC1F,EAAK2F,EAAU,CAAC,EAAIlE,EAAMiE,EAAU,CAAC,EACrC1F,EAAK2F,EAAU,CAAC,EAAIlE,EAAMiE,EAAU,CAAC,EACrC1F,EAAK2F,EAAU,CAAC,EAAI,IACpBD,GAAW,EACXC,GAAW,EAGb,OAAO,kBAAkB,IAAI,UAAU3F,EAAM8B,EAAOC,CAAM,CAAC,CAC7D,CAEA,MAAc,gBAAgB6D,EAA6C,CACzE,GAAI,CACF,OAAO,MAAM,KAAK,YAAYA,EAAY,SAAS,CACrD,OAASC,EAAO,CACd,GAAIA,aAAiB,WAAY,MAAMA,EACvC,OAAO,MAAM,KAAK,YAAYD,EAAY,aAAa,CACzD,CACF,CAEA,MAAc,YAAYA,EAAwB/D,EAAwD,CACxG,IAAMiE,EAAQ,KAAK,IAAI,KAAK,MAAM,eAAgB,KAAK,MAAM,WAAa,EAAG,KAAK,MAAM,aAAe,GAAO,EAC1GC,EAAW,EAaTC,EAXS,IAAI,eAA6B,CAC9C,KAAKC,EAAY,CACf,GAAIF,GAAYH,EAAW,OAAQ,CACjCK,EAAW,MAAM,EACjB,MACF,CACA,IAAM/F,EAAM,KAAK,IAAI6F,EAAW,KAAMH,EAAW,MAAM,EACvDK,EAAW,QAAQ,IAAI,WAAWL,EAAW,SAASG,EAAU7F,CAAG,CAAC,CAAC,EACrE6F,EAAW7F,CACb,CACF,CAAC,EACqB,YAAY,IAAI,oBAAoB2B,CAAM,CAAC,EAAE,UAAU,EACvEqE,EAAuB,CAAC,EAC1BC,EAAc,EAClB,GAAI,CACF,OAAa,CACX,GAAM,CAAE,KAAAC,EAAM,MAAAC,CAAM,EAAI,MAAML,EAAO,KAAK,EAC1C,GAAII,EAAM,MAEV,GADAD,GAAeE,EAAM,WACjBF,EAAcL,EAChB,YAAME,EAAO,OAAO,EAAE,MAAM,IAAM,CAAC,CAAC,EAC9B,IAAI,WAAW,uCAAuC,EAE9DE,EAAO,KAAKG,CAAK,CACnB,CACF,QAAE,CACAL,EAAO,YAAY,CACrB,CAEA,IAAMzE,EAAS,IAAI,WAAW4E,CAAW,EACrCG,EAAS,EACb,QAAWC,KAASL,EAClB3E,EAAO,IAAIgF,EAAOD,CAAM,EACxBA,GAAUC,EAAM,OAElB,OAAOhF,CACT,CAEA,IAAW,QAA+C,CACxD,OAAO,KAAK,cAAc,MAC5B,CAEA,IAAW,qBAAmD,CAC5D,OAAO,KAAK,cAAc,kBAC5B,CAEA,IAAW,sBAAkE,CAC3E,OAAO,KAAK,qBACd,CACF,EE71BO,IAAMiF,EAAN,MAAMA,CAAyC,CA6BpD,YACmBC,EACjB,CADiB,cAAAA,EA3BnB,KAAQ,aAAe,EACvB,KAAiB,QAAwC,IAAI,IAU7D,KAAiB,oBAA2C,IAAI,IAChE,KAAiB,oBAA2C,IAAI,IAIhE,KAAiB,2BAA8BC,GAA4B,CACzE,IAAMC,EAAU,KAAK,oBAAoB,IAAID,CAAS,EAClDC,IAAY,SACd,KAAK,oBAAoB,OAAOA,CAAO,EACvC,KAAK,oBAAoB,OAAOD,CAAS,EACzC,KAAK,QAAQ,OAAOC,CAAO,EAE/B,EACA,KAAQ,cAA+B,CAAE,UAAW,GAAM,MAAO,MAAO,OAAQ,EAAG,UAAW,KAAM,EAKlG,KAAK,wBAA0B,KAAK,SAAS,eAC7C,KAAK,uBAA0BD,GAAsB,CACnD,KAAK,0BAA0BA,CAAS,EACxC,KAAK,2BAA2BA,CAAS,CAC3C,EACA,KAAK,SAAS,eAAiB,KAAK,sBACtC,CAEO,OAAc,CACnB,KAAK,aAAe,EACpB,KAAK,QAAQ,MAAM,EACnB,KAAK,oBAAoB,MAAM,EAC/B,KAAK,oBAAoB,MAAM,CACjC,CAEO,SAAgB,CACrB,KAAK,MAAM,EACP,KAAK,SAAS,iBAAmB,KAAK,yBACxC,KAAK,SAAS,eAAiB,KAAK,wBAExC,CAEO,WAAWE,EAAwBC,EAAgD,CACxF,IAAMC,EAAUF,GAAM,KAAK,eAErBG,EAAe,KAAK,oBAAoB,IAAID,CAAO,EACrDC,IAAiB,SACnB,KAAK,SAAS,YAAYA,CAAY,EACtC,KAAK,oBAAoB,OAAOD,CAAO,EACvC,KAAK,oBAAoB,OAAOC,CAAY,GAG1C,CAAC,KAAK,QAAQ,IAAID,CAAO,GAAK,KAAK,QAAQ,MAAQN,EAAkB,kBACvE,KAAK,wBAAwB,EAS/B,IAAMQ,EAAY,KAAK,SAAS,SAAS,EAAI,IAC7C,KAAK,QAAQ,OAAOF,CAAO,EAC3B,IAAIG,EAAgB,EACpB,QAAWC,KAAS,KAAK,QAAQ,OAAO,EAAGD,GAAiBC,EAAM,KAAK,KACvE,QAAWC,IAAe,CAAC,GAAO,EAAI,EACpC,OAAW,CAACC,EAAUF,CAAK,IAAK,KAAK,QAAS,CAC5C,GAAID,EAAgBJ,EAAU,KAAK,MAAQG,EAAW,MAClD,KAAK,oBAAoB,IAAII,CAAQ,IAAMD,IAC/CF,GAAiBC,EAAM,KAAK,KAC5B,KAAK,WAAWE,CAAQ,EAC1B,CAGF,YAAK,QAAQ,IAAIN,EAAS,CACxB,GAAGD,EACH,GAAIC,CACN,CAAC,EACMA,CACT,CAEO,SAASH,EAAiBO,EAAwCG,EAAoBC,EAAmBC,EAAsB,CAKpI,IAAMR,EAAe,KAAK,oBAAoB,IAAIJ,CAAO,EACrDI,IAAiB,QACnB,KAAK,oBAAoB,OAAOA,CAAY,EAE9C,KAAK,cAAc,UAAYM,EAC/B,KAAK,cAAc,MAAQC,EAC3B,KAAK,cAAc,OAASC,EAC5B,IAAMb,EAAY,KAAK,SAAS,SAASQ,EAAO,KAAK,aAAa,EAClE,KAAK,oBAAoB,IAAIP,EAASD,CAAS,EAC/C,KAAK,oBAAoB,IAAIA,EAAWC,CAAO,CACjD,CAEO,SAASA,EAA8C,CAC5D,OAAO,KAAK,QAAQ,IAAIA,CAAO,CACjC,CAEO,WAAWA,EAAuB,CACvC,KAAK,QAAQ,OAAOA,CAAO,EAC3B,IAAMD,EAAY,KAAK,oBAAoB,IAAIC,CAAO,EAClDD,IAAc,SAChB,KAAK,SAAS,YAAYA,CAAS,EACnC,KAAK,oBAAoB,OAAOC,CAAO,EACvC,KAAK,oBAAoB,OAAOD,CAAS,EAE7C,CAEO,WAAkB,CACvB,KAAK,QAAQ,MAAM,EACnB,QAAWA,KAAa,KAAK,oBAAoB,OAAO,EACtD,KAAK,SAAS,YAAYA,CAAS,EAErC,KAAK,oBAAoB,MAAM,EAC/B,KAAK,oBAAoB,MAAM,CACjC,CAEA,IAAW,QAA+C,CACxD,OAAO,KAAK,OACd,CAEA,IAAW,oBAAkD,CAC3D,OAAO,KAAK,mBACd,CAEA,IAAW,aAAsB,CAC/B,OAAO,KAAK,aAAe,CAC7B,CAEQ,yBAAgC,CACtC,OAAW,CAACC,CAAO,IAAK,KAAK,QAAS,CACpC,GAAI,KAAK,QAAQ,MAAQH,EAAkB,iBAAmB,EAC5D,MAEG,KAAK,oBAAoB,IAAIG,CAAO,GACvC,KAAK,QAAQ,OAAOA,CAAO,CAE/B,CACF,CACF,EA5JaH,EACa,iBAAmB,IADtC,IAAMgB,GAANhB,ECVP,IAAAiB,EAA8E,OAI9E,IAAAC,GAAsC,QACtCC,GAAuB,QAGvB,IAAMC,GAAkB,QAGlBC,EAAkB,mBACxBA,EAAgB,IAAI,qBAAmB,EAKvC,IAAMC,GAAoB,EACpBC,GAAe,IAAI,IACrBC,GAAa,GAEjB,SAASC,GAAiBC,EAA2B,CAC/CF,KACJA,GAAa,MAEb,iBAAa,CAAE,YAAAE,EAAa,QAASL,CAAgB,CAAC,EAAE,KACtDM,GAAKC,GAAeD,EAAGD,CAAW,EAClC,IAAM,CAAEF,GAAa,EAAO,CAC9B,EACF,CAEA,SAASK,GAAeH,EAA8B,CACpD,OAAOH,GAAa,IAAIG,CAAW,GAAG,IAAI,GAAK,IAAI,WAAQ,CAAE,YAAAA,EAAa,QAASL,CAAgB,CAAC,CACtG,CAEA,SAASO,GAAeE,EAAcJ,EAA2B,CAC3DI,EAAI,YAAcV,IACpBU,EAAI,QAAQ,EAEd,IAAMC,EAAOR,GAAa,IAAIG,CAAW,GAAK,CAAC,EAC3CK,EAAK,OAAST,KAChBS,EAAK,KAAKD,CAAG,EACbP,GAAa,IAAIG,EAAaK,CAAI,EAEtC,CAGO,IAAMC,GAAN,KAAyD,CAQ9D,YACmBC,EACAC,EACAC,EACjB,CAHiB,WAAAF,EACA,cAAAC,EACA,mBAAAC,EAVnB,KAAQ,MAAQ,EAChB,KAAQ,SAAW,GAEnB,KAAQ,gBAAkB,EAE1B,KAAiB,SAAW,IAAI,YAAY,UAAO,YAAY,EAO7D,KAAK,SAAS,IAAId,CAAe,EACjCI,GAAiB,KAAK,MAAM,WAAa,CAAC,CAC5C,CAEO,OAAc,CACnB,KAAK,eAAe,EACpB,KAAK,SAAS,KAAK,CAAC,EACpB,KAAK,SAAS,IAAIJ,CAAe,CACnC,CAEO,KAAKe,EAAuB,CACjC,KAAK,MAAQ,EACb,KAAK,SAAW,GAChB,KAAK,eAAe,EACpB,IAAMV,EAAc,KAAK,MAAM,WAAa,EAC5C,GAAI,CACF,KAAK,KAAOG,GAAeH,CAAW,CACxC,OAASW,EAAG,CAEV,QAAQ,KAAK,uCAAuCA,CAAC,EAAE,EACvD,KAAK,SAAW,GAChB,MACF,CACA,KAAK,gBAAkBX,EACvB,IAAMY,EAAYF,EAAO,OAAO,CAAC,IAAM,EAAI,EAAIG,GAC7C,KAAK,cAAc,MAAM,cAAc,aACvC,KAAK,cAAc,MAAM,eAAe,MAAM,EAChD,KAAK,KAAK,KAAKD,EAAW,KAAK,SAAU,KAAK,MAAM,iBAAiB,CACvE,CAEQ,gBAAuB,CAC7B,IAAMR,EAAM,KAAK,KACZA,IACL,KAAK,KAAO,OACZ,KAAK,SAAS,IAAIA,EAAI,OAAO,EAC7BF,GAAeE,EAAK,KAAK,eAAe,EAC1C,CAEO,IAAIU,EAAmBC,EAAeC,EAAmB,CAC9D,GAAI,OAAK,UAAY,CAAC,KAAK,MAI3B,IADA,KAAK,OAASA,EAAMD,EAChB,KAAK,MAAQ,KAAK,MAAM,eAAgB,CAC1C,QAAQ,KAAK,gCAAgC,EAC7C,KAAK,SAAW,GAChB,KAAK,KAAK,QAAQ,EAClB,MACF,CACA,GAAI,CACF,KAAK,KAAK,OAAOD,EAAMC,EAAOC,CAAG,CACnC,OAASL,EAAG,CACV,QAAQ,KAAK,uCAAuCA,CAAC,EAAE,EACvD,KAAK,SAAW,GAChB,KAAK,KAAK,QAAQ,CACpB,EACF,CAEO,OAAOM,EAA8C,CAC1D,GAAI,CACF,OAAO,KAAK,QAAQA,CAAO,CAC7B,QAAE,CACA,KAAK,eAAe,CACtB,CACF,CAEQ,QAAQA,EAA2B,CACzC,GAAI,KAAK,UAAY,CAACA,GAAW,CAAC,KAAK,KACrC,MAAO,GAGT,IAAMC,EAAQ,KAAK,KAAK,MAClBC,EAAS,KAAK,KAAK,OAGzB,GAAI,CAACD,GAAS,CAACC,EACb,OAAIA,GACF,KAAK,SAAS,cAAcA,CAAM,EAE7B,GAGT,IAAMC,EAASC,EAAc,aAAa,OAAWH,EAAOC,CAAM,EAClE,OAAAC,EAAO,WAAW,IAAI,GAAG,aAAa,IAAI,UAAU,KAAK,KAAK,MAAyCF,EAAOC,CAAM,EAAG,EAAG,CAAC,EAC3H,KAAK,SAAS,SAASC,CAAM,EACtB,EACT,CACF,EASA,SAASP,GAAgBS,EAAqBC,EAAgD,CAC5F,IAAIC,EAAK,EACT,GAAI,CAACD,EAGH,OAAOC,EAET,GAAIF,EAAK,UAAU,EACjB,GAAIA,EAAK,YAAY,EACnBE,EAAKC,GAAUF,EAAO,WAAW,IAAI,UAC5BD,EAAK,QAAQ,EAAG,CACzB,IAAMI,EAAKJ,EAAK,YAAqC,WAAWA,EAAK,WAAW,CAAC,EACjFE,KAAK,cAAW,GAAGE,CAAC,CACtB,MACEF,EAAKC,GAAUF,EAAO,KAAKD,EAAK,WAAW,CAAC,EAAE,IAAI,UAGhDA,EAAK,YAAY,EACnBE,EAAKC,GAAUF,EAAO,WAAW,IAAI,UAC5BD,EAAK,QAAQ,EAAG,CACzB,IAAMI,EAAKJ,EAAK,YAAqC,WAAWA,EAAK,WAAW,CAAC,EACjFE,KAAK,cAAW,GAAGE,CAAC,CACtB,MACEF,EAAKC,GAAUF,EAAO,KAAKD,EAAK,WAAW,CAAC,EAAE,IAAI,EAGtD,OAAOE,CACT,CAGA,SAASC,GAAUE,EAAyB,CAC1C,OAAI,aAAmBA,GACfA,EAAQ,MAAS,IAAMA,IAAU,EAAI,MAAS,IAAMA,IAAU,GAAK,MAAS,EAAIA,IAAU,GAAK,GACzG,CCpLO,IAAMC,GAAN,KAAwB,CAE7B,YACmBC,EACAC,EACAC,EACAC,EACjB,CAJiB,cAAAH,EACA,WAAAC,EACA,eAAAC,EACA,eAAAC,EALnB,KAAQ,cAA+B,CAAE,UAAW,GAAM,MAAO,MAAO,OAAQ,EAAG,UAAW,OAAQ,CAMnG,CAMI,SAASC,EAA4C,CAC1D,KAAK,cAAc,UAAY,KAAK,MAAM,eAC1C,KAAK,SAAS,SAASA,EAAK,KAAK,aAAa,CAChD,CAOO,cAAcC,EAAsB,CACzC,GAAI,KAAK,MAAM,eAAgB,CAC7B,IAAIC,EAAW,KAAK,UAAU,UAC1BA,EAAS,QAAU,IAAMA,EAAS,SAAW,MAC/CA,EAAWC,GAEb,IAAMC,EAAO,KAAK,KAAKH,EAASC,EAAS,MAAM,EAC/C,QAASG,EAAI,EAAGA,EAAID,EAAM,EAAEC,EAC1B,KAAK,UAAU,MAAM,cAAc,SAAS,CAEhD,CACF,CACF,ECrCO,IAAMC,GAAN,KAAsB,CAE3B,YACmBC,EACjB,CADiB,cAAAA,EAFnB,KAAQ,cAA+B,CAAE,UAAW,GAAM,MAAO,MAAO,OAAQ,EAAG,UAAW,KAAM,CAGjG,CAMI,SAASC,EAA4C,CAC1D,KAAK,SAAS,SAASA,EAAK,KAAK,aAAa,CAChD,CACF,ECiCA,IAAMC,GAAsC,CAC1C,kBAAmB,GACnB,WAAY,SACZ,aAAc,GACd,eAAgB,GAChB,kBAAmB,KACnB,eAAgB,SAChB,aAAc,IACd,gBAAiB,GACjB,WAAY,GACZ,aAAc,SACd,aAAc,GACd,eAAgB,QAClB,EAGMC,GAAyB,KAsBxB,IAAMC,GAAN,KAAsD,CAW3D,YAAYC,EAAoC,CANhD,KAAQ,aAA8B,CAAC,EAEvC,KAAQ,UAAwC,IAAI,IACpD,KAAiB,cAAgB,IAAIC,EACrC,KAAgB,aAA6B,KAAK,cAAc,MAG9D,KAAK,MAAQ,OAAO,OAAO,CAAC,EAAGC,GAAiBF,CAAI,EACpD,KAAK,aAAe,OAAO,OAAO,CAAC,EAAGE,GAAiBF,CAAI,CAC7D,CAEO,SAAgB,CACrB,QAAWG,KAAW,KAAK,UAAU,OAAO,EAAGA,EAAQ,MAAM,EAC7D,QAAWC,KAAO,KAAK,aACrBA,EAAI,QAAQ,EAEd,KAAK,aAAa,OAAS,EAC3B,KAAK,UAAU,MAAM,EACrB,KAAK,cAAc,QAAQ,CAC7B,CAEQ,iBAAiBC,EAA2B,CAClD,QAAWD,KAAOC,EAChB,KAAK,aAAa,KAAKD,CAAG,CAE9B,CAEO,SAASE,EAA8B,CAS5C,GARA,KAAK,UAAYA,EAGjB,KAAK,UAAY,IAAIC,EAAcD,CAAQ,EAC3C,KAAK,SAAW,IAAIE,EAAaF,EAAU,KAAK,UAAW,KAAK,KAAK,EACrE,KAAK,SAAS,aAAe,IAAM,KAAK,cAAc,KAAK,EAGvD,KAAK,MAAM,kBAAmB,CAChC,IAAMG,EAAYH,EAAS,QAAQ,eAAiB,CAAC,EACrDG,EAAU,iBAAmB,GAC7BA,EAAU,kBAAoB,GAC9BA,EAAU,gBAAkB,GAC5BH,EAAS,QAAQ,cAAgBG,CACnC,CAiCA,GA/BA,KAAK,cACH,KAAK,UACL,KAAK,SAGLH,EAAS,OAAO,mBAAmB,CAAE,OAAQ,IAAK,MAAO,GAAI,EAAGI,GAAU,KAAK,QAAQA,CAAM,CAAC,EAC9FJ,EAAS,OAAO,mBAAmB,CAAE,OAAQ,IAAK,MAAO,GAAI,EAAGI,GAAU,KAAK,QAAQA,CAAM,CAAC,EAC9FJ,EAAS,OAAO,mBAAmB,CAAE,MAAO,GAAI,EAAGI,GAAU,KAAK,KAAKA,CAAM,CAAC,EAC9EJ,EAAS,OAAO,mBAAmB,CAAE,OAAQ,IAAK,MAAO,GAAI,EAAGI,GAAU,KAAK,yBAAyBA,CAAM,CAAC,EAG/GJ,EAAS,SAASK,GAAS,KAAK,UAAU,OAAOA,CAAK,CAAC,EAQvDL,EAAS,OAAO,mBAAmB,CAAE,cAAe,IAAK,MAAO,GAAI,EAAG,IAAM,KAAK,MAAM,CAAC,EACzFA,EAAS,OAAO,mBAAmB,CAAE,MAAO,GAAI,EAAG,IAAM,KAAK,MAAM,CAAC,EACrEA,EAAS,MAAM,cAAc,eAAe,IAAM,KAAK,MAAM,CAAC,EAG9DA,EAAS,OAAO,eAAe,IAAM,KAAK,UAAU,cAAc,CAAC,EAGnEA,EAAS,SAASM,GAAW,KAAK,UAAU,eAAeA,CAAO,CAAC,CACrE,EAGI,KAAK,MAAM,aAAc,CAC3B,IAAMC,EAAe,IAAIC,GAAkB,KAAK,SAAW,KAAK,MAAO,KAAK,UAAYR,CAAQ,EAC1FS,EAAe,IAAIC,GAAa,KAAK,MAAOH,EAAcP,CAAQ,EACxE,KAAK,UAAU,IAAI,QAASS,CAAY,EACxC,KAAK,cACHT,EAAS,MAAM,cAAc,QAAQ,mBAAmB,CAAE,MAAO,GAAI,EAAGS,CAAY,CACtF,CACF,CAGA,GAAI,KAAK,MAAM,WAAY,CACzB,IAAME,EAAa,IAAIC,GAAgB,KAAK,QAAS,EAC/CC,EAAa,IAAIC,GAAW,KAAK,MAAO,KAAK,UAAYH,EAAYX,CAAQ,EACnF,KAAK,UAAU,IAAI,MAAOa,CAAU,EACpC,KAAK,cACHb,EAAS,MAAM,cAAc,QAAQ,mBAAmB,KAAMa,CAAU,CAC1E,CACF,CAGA,GAAI,KAAK,MAAM,aAAc,CAC3B,IAAME,EAAe,IAAIC,GAAkB,KAAK,QAAS,EACnDC,EAAe,IAAIC,GAAqB,KAAK,MAAO,KAAK,UAAYH,EAAcf,CAAQ,EACjG,KAAK,UAAU,IAAI,QAASiB,CAAY,EACxC,KAAK,cACHF,EACAE,EACAjB,EAAS,MAAM,cAAc,QAAQ,mBAAmB,CAAE,MAAO,GAAI,EAAGiB,CAAY,CACtF,CACF,CACF,CAGO,OAAiB,CAEtB,KAAK,MAAM,eAAiB,KAAK,aAAa,eAC9C,KAAK,MAAM,kBAAoB,KAAK,aAAa,kBAEjD,KAAK,UAAU,MAAM,EAErB,QAAWpB,KAAW,KAAK,UAAU,OAAO,EAC1CA,EAAQ,MAAM,EAEhB,MAAO,EACT,CAEA,IAAW,cAAuB,CAChC,OAAO,KAAK,UAAU,SAAS,GAAK,EACtC,CAEA,IAAW,aAAasB,EAAe,CACrC,KAAK,UAAU,SAASA,CAAK,EAC7B,KAAK,MAAM,aAAeA,CAC5B,CAEA,IAAW,cAAuB,CAChC,OAAI,KAAK,SACA,KAAK,SAAS,SAAS,EAEzB,EACT,CAEA,IAAW,iBAA2B,CACpC,OAAO,KAAK,MAAM,eACpB,CAEA,IAAW,gBAAgBC,EAAgB,CACzC,KAAK,MAAM,gBAAkBA,EAC7B,KAAK,WAAW,gBAAgBA,CAAK,CACvC,CAEO,qBAAqBC,EAAWC,EAA0C,CAC/E,OAAO,KAAK,UAAU,qBAAqBD,EAAGC,CAAC,CACjD,CAEO,wBAAwBD,EAAWC,EAA0C,CAClF,OAAO,KAAK,UAAU,wBAAwBD,EAAGC,CAAC,CACpD,CAEQ,QAAQC,EAAiB,CAC/B,KAAK,WAAW,MAAM,MAAMA,EAAG,EAAK,CACtC,CAEQ,QAAQnB,EAAwC,CACtD,QAASoB,EAAI,EAAGA,EAAIpB,EAAO,OAAQ,EAAEoB,EAC3BpB,EAAOoB,CAAC,IACT,KACH,KAAK,MAAM,eAAiB,IAIlC,MAAO,EACT,CAEQ,QAAQpB,EAAwC,CACtD,QAASoB,EAAI,EAAGA,EAAIpB,EAAO,OAAQ,EAAEoB,EAC3BpB,EAAOoB,CAAC,IACT,KACH,KAAK,MAAM,eAAiB,IAIlC,MAAO,EACT,CAGQ,KAAKpB,EAAwC,CACnD,OAAIA,EAAO,CAAC,EACH,GAOL,KAAK,MAAM,cACb,KAAK,QAAQ,kBAAkB,EACxB,IAEF,EACT,CAYQ,yBAAyBA,EAAwC,CACvE,GAAIA,EAAO,OAAS,EAClB,MAAO,GAET,GAAIA,EAAO,CAAC,IAAM,EAChB,OAAQA,EAAO,CAAC,EAAG,CACjB,IAAK,GACH,YAAK,QAAQ,SAASA,EAAO,CAAC,CAAC,MAAwB,KAAK,MAAM,iBAAiB,GAAG,EAC/E,GACT,IAAK,GACH,KAAK,MAAM,kBAAoB,KAAK,aAAa,kBACjD,KAAK,QAAQ,SAASA,EAAO,CAAC,CAAC,MAAwB,KAAK,MAAM,iBAAiB,GAAG,EAEtF,QAAWP,KAAW,KAAK,UAAU,OAAO,EAC1CA,EAAQ,MAAM,EAEhB,MAAO,GACT,IAAK,GACH,OAAIO,EAAO,OAAS,GAAK,EAAEA,EAAO,CAAC,YAAa,QAAUA,EAAO,CAAC,GAAKqB,IACrE,KAAK,MAAM,kBAAoBrB,EAAO,CAAC,EACvC,KAAK,QAAQ,SAASA,EAAO,CAAC,CAAC,MAAwB,KAAK,MAAM,iBAAiB,GAAG,GAEtF,KAAK,QAAQ,SAASA,EAAO,CAAC,CAAC,KAA4B,EAEtD,GACT,IAAK,GACH,YAAK,QAAQ,SAASA,EAAO,CAAC,CAAC,MAAwBqB,EAAsB,GAAG,EACzE,GACT,QACE,YAAK,QAAQ,SAASrB,EAAO,CAAC,CAAC,KAA4B,EACpD,EACX,CAEF,GAAIA,EAAO,CAAC,IAAM,EAChB,OAAQA,EAAO,CAAC,EAAG,CAEjB,IAAK,GACH,IAAIsB,EAAQ,KAAK,WAAW,YAAY,IAAI,OAAO,MAC/CC,EAAS,KAAK,WAAW,YAAY,IAAI,OAAO,OACpD,GAAI,CAACD,GAAS,CAACC,EAAQ,CAGrB,IAAMC,EAAWC,EACjBH,GAAS,KAAK,WAAW,MAAQ,IAAME,EAAS,MAChDD,GAAU,KAAK,WAAW,MAAQ,IAAMC,EAAS,MACnD,CACA,GAAIF,EAAQC,EAAS,KAAK,MAAM,WAC9B,KAAK,QAAQ,SAASvB,EAAO,CAAC,CAAC,MAAwBsB,EAAM,QAAQ,CAAC,CAAC,IAAIC,EAAO,QAAQ,CAAC,CAAC,GAAG,MAC1F,CAEL,IAAMN,EAAI,KAAK,MAAM,KAAK,KAAK,KAAK,MAAM,UAAU,CAAC,EACrD,KAAK,QAAQ,SAASjB,EAAO,CAAC,CAAC,MAAwBiB,CAAC,IAAIA,CAAC,GAAG,CAClE,CACA,MAAO,GACT,IAAK,GAEH,IAAMA,EAAI,KAAK,MAAM,KAAK,KAAK,KAAK,MAAM,UAAU,CAAC,EACrD,YAAK,QAAQ,SAASjB,EAAO,CAAC,CAAC,MAAwBiB,CAAC,IAAIA,CAAC,GAAG,EACzD,GACT,QACE,YAAK,QAAQ,SAASjB,EAAO,CAAC,CAAC,KAA4B,EACpD,EACX,CAGF,YAAK,QAAQ,SAASA,EAAO,CAAC,CAAC,KAA0B,EAClD,EACT,CACF",
++  "names": ["exports", "red", "n", "green", "blue", "alpha", "toRGBA8888", "g", "b", "a", "fromRGBA8888", "color", "nearestColorIndex", "palette", "r", "min", "idx", "i", "dr", "dg", "db", "d", "clamp", "low", "high", "value", "h2c", "t1", "t2", "c", "HLStoRGB", "h", "l", "s", "v", "normalizeRGB", "normalizeHLS", "p", "require_lib", "__commonJSMin", "exports", "InWasm", "z", "s", "b", "r", "def", "t", "d", "m", "W", "e", "require_Base64Decoder_wasm", "__commonJSMin", "exports", "inwasm_runtime_1", "wasmDecode", "MAP", "el", "D", "i", "EMPTY", "Base64Decoder", "keepSize", "maxBytes", "initialBytes", "m", "bytes", "requested", "needed", "newSize", "addPages", "data", "require_QoiDecoder_wasm", "__commonJSMin", "exports", "inwasm_runtime_1", "wasmQoiDecode", "QoiDecoder", "keepSize", "d", "pixels", "ib", "dl", "bytes", "chunkP", "exports", "Colors_1", "wasm_1", "decodeBase64", "s", "bytestring", "result", "WASM_BYTES", "WASM_MODULE", "NULL_CANVAS", "CallbackProxy", "width", "mode", "DEFAULT_OPTIONS", "DecoderAsync", "opts", "cbProxy", "importObj", "inst", "Decoder", "exports", "_instance", "_cbProxy", "module", "pixels", "offset", "additionalPixels", "newCanvas", "adv", "remaining", "c", "i", "fillColor", "palette", "paletteLimit", "truncate", "data", "start", "end", "p", "length", "j", "currentWidth", "escape", "final", "finalOffset", "bw", "currentHeight", "decode", "dec", "decodeAsync", "toDisposable", "fn", "DisposableStore", "o", "d", "Disposable", "MutableDisposable", "value", "Emitter", "listener", "thisArgs", "disposables", "toDisposable", "entry", "result", "idx", "event", "listeners", "len", "EventUtils", "forward", "from", "to", "e", "map", "i", "any", "events", "store", "DisposableStore", "runAndSubscribe", "handler", "initial", "import_Colors", "ImageRenderer", "_ImageRenderer", "Disposable", "_terminal", "MutableDisposable", "parent", "option", "toDisposable", "localDocument", "width", "height", "canvas", "ctx", "buffer", "imgData", "img", "value", "start", "end", "layer", "y", "w", "h", "imgSpec", "tileId", "col", "row", "count", "sourceWidth", "sourceHeight", "cols", "sx", "sy", "dx", "dy", "finalWidth", "finalHeight", "spec", "currentWidth", "currentHeight", "originalWidth", "originalHeight", "scaledWidth", "scaledHeight", "renderer", "key", "screenElement", "bWidth", "blueprint", "d32", "black", "white", "shift", "offset", "x", "ctx2", "i", "placeholder", "bitmap", "CELL_SIZE_DEFAULT", "ExtendedAttrsImage", "_ExtendedAttrsImage", "ext", "urlId", "imageId", "tileId", "value", "val", "EMPTY_ATTRS", "ImageStorage", "_terminal", "_renderer", "_opts", "e", "spec", "storedPixels", "id", "zero", "img", "opts", "cellSize", "cols", "rows", "buffer", "termCols", "termRows", "originX", "originY", "offset", "tileCount", "row", "line", "col", "endMarker", "imgSpec", "range", "hasTopImages", "hasBottomImages", "start", "end", "drawCalls", "placeholderCalls", "startTile", "startCol", "count", "a", "b", "call", "metrics", "oldCol", "tilesPerRow", "hasData", "rightCol", "lastTile", "expandCol", "x", "y", "orig", "canvas", "ImageRenderer", "room", "used", "current", "old", "oldSpec", "imgId", "import_Base64Decoder", "import_QoiDecoder", "toStr", "data", "s", "i", "toInt", "v", "toSize", "toName", "bs", "b", "DECODERS", "FILE_MARKER", "MULTIPARTFILE_MARKER", "FILEPART_MARKER", "FILEEND_MARKER", "REPORTCELLSIZE_MARKER", "MAX_FIELDCHARS", "HeaderParser", "k", "start", "end", "state", "pos", "buffer", "c", "UNSUPPORTED_TYPE", "imageType", "d", "d32", "width", "height", "jpgSize", "dim", "pos", "limit", "i", "len", "blockLength", "DEFAULT_HEADER", "IIPHandler", "_opts", "_renderer", "_storage", "_coreTerminal", "HeaderParser", "maxEncodedBytes", "initialBytes", "Base64Decoder", "QoiDecoder", "data", "start", "end", "dataPos", "success", "seqType", "w", "CELL_SIZE_DEFAULT", "h", "scale", "report", "cond", "metrics", "UNSUPPORTED_TYPE", "imageType", "blob", "e", "canvas", "ImageRenderer", "generation", "bm", "cw", "ch", "width", "height", "rw", "rh", "wf", "hf", "f", "s", "total", "cdim", "import_Base64Decoder", "parseKittyCommand", "data", "cmd", "parts", "part", "eqIdx", "key", "value", "numValue", "DECODER_OK", "KittyGraphicsHandler", "_opts", "_renderer", "_kittyStorage", "_coreTerminal", "key", "pending", "data", "start", "end", "controlEnd", "i", "copyLength", "parseKittyCommand", "payloadStart", "pendingKey", "previousEncodedSize", "decoderToRelease", "decoderCapacity", "maxPending", "oldest", "decoder", "Base64Decoder", "e", "success", "cmd", "isMoreComing", "decodeError", "finalCmd", "imageBytes", "result", "str", "bytes", "id", "image", "quiet", "format", "width", "height", "bytesPerPixel", "expectedBytes", "message", "placementId", "isOk", "pPart", "response", "generation", "bitmap", "cropX", "cropY", "cropW", "cropH", "maxCropW", "maxCropH", "finalCropW", "finalCropH", "cropped", "cw", "CELL_SIZE_DEFAULT", "ch", "imgCols", "imgRows", "w", "h", "buffer", "savedX", "savedY", "savedYbase", "layer", "scaled", "xOffset", "yOffset", "canvasW", "canvasH", "offsetCanvas", "ImageRenderer", "offsetCtx", "offsetBitmap", "zIndex", "scrolled", "metrics", "imageType", "blob", "url", "img", "resolve", "reject", "canvas", "pixelCount", "src32", "dst32", "alignedPixels", "srcOffset", "dstOffset", "b0", "b1", "b2", "srcByte", "dstByte", "compressed", "error", "limit", "offsetIn", "reader", "controller", "chunks", "totalLength", "done", "value", "offset", "chunk", "_KittyImageStorage", "_storage", "storageId", "kittyId", "id", "imageData", "imageId", "oldStorageId", "byteLimit", "retainedBytes", "image", "evictPlaced", "oldestId", "scrolling", "layer", "zIndex", "KittyImageStorage", "import_Colors", "import_Decoder", "import_wasm", "MEM_PERMA_LIMIT", "DEFAULT_PALETTE", "MAX_IDLE_DECODERS", "idleDecoders", "poolPrimed", "primeDecoderPool", "memoryLimit", "d", "releaseDecoder", "acquireDecoder", "dec", "idle", "SixelHandler", "_opts", "_storage", "_coreTerminal", "params", "e", "fillColor", "extractActiveBg", "data", "start", "end", "success", "width", "height", "canvas", "ImageRenderer", "attr", "colors", "bg", "convertLe", "t", "color", "SixelImageStorage", "_storage", "_opts", "_renderer", "_terminal", "img", "height", "cellSize", "CELL_SIZE_DEFAULT", "rows", "i", "IIPImageStorage", "_storage", "img", "DEFAULT_OPTIONS", "MAX_SIXEL_PALETTE_SIZE", "ImageAddon", "opts", "Emitter", "DEFAULT_OPTIONS", "handler", "obj", "args", "terminal", "ImageRenderer", "ImageStorage", "windowOps", "params", "range", "metrics", "sixelStorage", "SixelImageStorage", "sixelHandler", "SixelHandler", "iipStorage", "IIPImageStorage", "iipHandler", "IIPHandler", "kittyStorage", "KittyImageStorage", "kittyHandler", "KittyGraphicsHandler", "limit", "value", "x", "y", "s", "i", "MAX_SIXEL_PALETTE_SIZE", "width", "height", "cellSize", "CELL_SIZE_DEFAULT"]
  }
 diff --git a/src/IIPHandler.ts b/src/IIPHandler.ts
-index 559b907416eb38318f439d060d7f89311ed34c7e..8541b4b0ea0d6b451aaae49007d69df64c5bd088 100644
+index 559b907416eb38318f439d060d7f89311ed34c7e..73cedbe99f831bffd202697cc8ba80a46a39cb99 100644
 --- a/src/IIPHandler.ts
 +++ b/src/IIPHandler.ts
-@@ -34,6 +34,7 @@ const DEFAULT_HEADER: IHeaderFields = {
+@@ -13,8 +13,10 @@ import { imageType, UNSUPPORTED_TYPE } from './IIPMetrics';
+ 
+ // Local const enum mirror - esbuild can't inline const enums from external packages
+ const enum DecoderConst {
+-  // Limit held memory in base64 decoder (encoded bytes).
+-  KEEP_DATA = 4194304,
++  // Held memory in base64/QOI decoders between images. Zero because each kept
++  // decoder pins a wasm memory, and V8 caps those per process (~124 in a
++  // sandboxed renderer), so idle terminals must not hold one.
++  KEEP_DATA = 0,
+   // Initial buffer allocation for the decoder.
+   INITIAL_DATA = 1048576,
+   // Local mirror of const enum (esbuild can't inline const enums from external packages)
+@@ -34,6 +36,7 @@ const DEFAULT_HEADER: IHeaderFields = {
  
  
  export class IIPHandler implements IOscHandler, IResetHandler {
@@ -55,7 +68,7 @@ index 559b907416eb38318f439d060d7f89311ed34c7e..8541b4b0ea0d6b451aaae49007d69df6
    private _aborted = false;
    private _hp = new HeaderParser();
    private _header: IHeaderFields = DEFAULT_HEADER;
-@@ -55,6 +56,7 @@ export class IIPHandler implements IOscHandler, IResetHandler {
+@@ -55,6 +58,7 @@ export class IIPHandler implements IOscHandler, IResetHandler {
    }
  
    public reset(): void {
@@ -63,7 +76,47 @@ index 559b907416eb38318f439d060d7f89311ed34c7e..8541b4b0ea0d6b451aaae49007d69df6
      this._hp.reset();
      this._dec.release();
      this._qoiDec.release();
-@@ -198,8 +200,13 @@ export class IIPHandler implements IOscHandler, IResetHandler {
+@@ -92,7 +96,10 @@ export class IIPHandler implements IOscHandler, IResetHandler {
+             this._aborted = true;
+             return;
+           }
+-          this._dec.init();
++          if (!this._initDecoder()) {
++            this._aborted = true;
++            return;
++          }
+         } else if (this._abortMulti) {
+           this._aborted = true;
+           return;
+@@ -135,7 +142,9 @@ export class IIPHandler implements IOscHandler, IResetHandler {
+       this._isMultipart = true;
+       this._abortMulti = false;
+       this._dec.release();
+-      this._dec.init();
++      if (!this._initDecoder()) {
++        this._abortMulti = true;
++      }
+       return true;
+     }
+ 
+@@ -179,7 +188,15 @@ export class IIPHandler implements IOscHandler, IResetHandler {
+ 
+     let blob: Blob | ImageData;
+     if (metrics.mime === 'image/qoi') {
+-      const data = this._qoiDec.decode(this._dec.data8);
++      let data: Uint8Array<ArrayBuffer>;
++      try {
++        data = this._qoiDec.decode(this._dec.data8);
++      } catch (e) {
++        console.warn('IIP: could not decode QOI image', e);
++        this._dec.release();
++        this._qoiDec.release();
++        return true;
++      }
+       blob = new ImageData(
+         new Uint8ClampedArray(data.buffer, data.byteOffset, data.byteLength),
+         this._qoiDec.width,
+@@ -198,8 +215,13 @@ export class IIPHandler implements IOscHandler, IResetHandler {
        blob = new Blob([this._dec.data8], { type: metrics.mime });
      }
      this._dec.release();
@@ -77,6 +130,25 @@ index 559b907416eb38318f439d060d7f89311ed34c7e..8541b4b0ea0d6b451aaae49007d69df6
          this._storage.addImage(bm);
          return true;
        })
+@@ -209,6 +231,18 @@ export class IIPHandler implements IOscHandler, IResetHandler {
+       });
+   }
+ 
++  // Why: wasm memory exhaustion must drop this image, not throw out of the parser and wedge the write queue.
++  private _initDecoder(): boolean {
++    try {
++      this._dec.init();
++      return true;
++    } catch (e) {
++      console.warn('IIP: could not allocate decoder', e);
++      this._dec.release();
++      return false;
++    }
++  }
++
+   private _resize(w: number, h: number): [number, number] {
+     const cw = this._renderer.dimensions?.css.cell.width || CELL_SIZE_DEFAULT.width;
+     const ch = this._renderer.dimensions?.css.cell.height || CELL_SIZE_DEFAULT.height;
 diff --git a/src/ImageAddon.ts b/src/ImageAddon.ts
 index 8fd39543118cd420e36c1614c1af370b6c7bbfbb..0c44d2a81642113417bf8dc10a4faa76d7cc5864 100644
 --- a/src/ImageAddon.ts
@@ -189,8 +261,156 @@ index 5854efaec1fdf9dfcb886023542998a563b6d2f2..3afaf9bd63ffd7a4cdf32bf0ac24cf33
    }
  
    public get document(): Document | undefined {
+diff --git a/src/SixelHandler.ts b/src/SixelHandler.ts
+index 1af2d85bcdd541ed60b1e707f6186a91f1bbf1b2..0711a122ea43d5212a2851add9e744b65550ec85 100644
+--- a/src/SixelHandler.ts
++++ b/src/SixelHandler.ts
+@@ -10,6 +10,7 @@ import { RGBA8888 } from 'sixel/lib/Types';
+ import { ImageRenderer } from './ImageRenderer';
+ 
+ import { DecoderAsync, Decoder } from 'sixel/lib/Decoder';
++import { LIMITS } from 'sixel/lib/wasm';
+ 
+ // always free decoder ressources after decoding if it exceeds this limit
+ const MEM_PERMA_LIMIT = 4194304; // 1024 pixels * 1024 pixels * 4 channels = 4MB
+@@ -18,48 +19,88 @@ const MEM_PERMA_LIMIT = 4194304; // 1024 pixels * 1024 pixels * 4 channels = 4MB
+ const DEFAULT_PALETTE = PALETTE_ANSI_256;
+ DEFAULT_PALETTE.set(PALETTE_VT340_COLOR);
+ 
++// Why pooled: every decoder owns a wasm memory, and V8 caps live wasm memories
++// per process (~124 in a sandboxed renderer). Terminals borrow a decoder only
++// while a SIXEL sequence is open, so idle terminals hold none.
++const MAX_IDLE_DECODERS = 2;
++const idleDecoders = new Map<number, Decoder[]>();
++let poolPrimed = false;
++
++function primeDecoderPool(memoryLimit: number): void {
++  if (poolPrimed) return;
++  poolPrimed = true;
++  // Async compile once, off the parser's hot path; later decoders reuse the cached module.
++  DecoderAsync({ memoryLimit, palette: DEFAULT_PALETTE }).then(
++    d => releaseDecoder(d, memoryLimit),
++    () => { poolPrimed = false; }
++  );
++}
++
++function acquireDecoder(memoryLimit: number): Decoder {
++  return idleDecoders.get(memoryLimit)?.pop() ?? new Decoder({ memoryLimit, palette: DEFAULT_PALETTE });
++}
++
++function releaseDecoder(dec: Decoder, memoryLimit: number): void {
++  if (dec.memoryUsage > MEM_PERMA_LIMIT) {
++    dec.release();
++  }
++  const idle = idleDecoders.get(memoryLimit) ?? [];
++  if (idle.length < MAX_IDLE_DECODERS) {
++    idle.push(dec);
++    idleDecoders.set(memoryLimit, idle);
++  }
++}
++
+ 
+ export class SixelHandler implements IDcsHandler, IResetHandler {
+   private _size = 0;
+   private _aborted = false;
+   private _dec: Decoder | undefined;
++  private _decMemoryLimit = 0;
++  // Color registers outlive a single image, so they live here rather than in a pooled decoder.
++  private readonly _palette = new Uint32Array(LIMITS.PALETTE_SIZE);
+ 
+   constructor(
+     private readonly _opts: IImageAddonOptions,
+     private readonly _storage: SixelImageStorage,
+     private readonly _coreTerminal: ITerminalExt
+   ) {
+-    DecoderAsync({
+-      memoryLimit: this._opts.pixelLimit * 4,
+-      palette: DEFAULT_PALETTE,
+-      paletteLimit: this._opts.sixelPaletteLimit
+-    }).then(d => this._dec = d);
++    this._palette.set(DEFAULT_PALETTE);
++    primeDecoderPool(this._opts.pixelLimit * 4);
+   }
+ 
+   public reset(): void {
+-    /**
+-     * reset sixel decoder to defaults:
+-     * - release all memory
+-     * - nullify palette (4096)
+-     * - apply default palette (256)
+-     */
+-    if (this._dec) {
+-      this._dec.release();
+-      // FIXME: missing interface on decoder to nullify full palette
+-      (this._dec as any)._palette.fill(0);
+-      this._dec.init(0, DEFAULT_PALETTE, this._opts.sixelPaletteLimit);
+-    }
++    this._returnDecoder();
++    this._palette.fill(0);
++    this._palette.set(DEFAULT_PALETTE);
+   }
+ 
+   public hook(params: IParams): void {
+     this._size = 0;
+     this._aborted = false;
+-    if (this._dec) {
+-      const fillColor = params.params[1] === 1 ? 0 : extractActiveBg(
+-        this._coreTerminal._core._inputHandler._curAttrData,
+-        this._coreTerminal._core._themeService?.colors);
+-      this._dec.init(fillColor, null, this._opts.sixelPaletteLimit);
++    this._returnDecoder();
++    const memoryLimit = this._opts.pixelLimit * 4;
++    try {
++      this._dec = acquireDecoder(memoryLimit);
++    } catch (e) {
++      // Why: exhausting wasm memory must drop this image, not throw out of the parser and wedge the write queue.
++      console.warn(`SIXEL: could not allocate decoder - ${e}`);
++      this._aborted = true;
++      return;
+     }
++    this._decMemoryLimit = memoryLimit;
++    const fillColor = params.params[1] === 1 ? 0 : extractActiveBg(
++      this._coreTerminal._core._inputHandler._curAttrData,
++      this._coreTerminal._core._themeService?.colors);
++    this._dec.init(fillColor, this._palette, this._opts.sixelPaletteLimit);
++  }
++
++  private _returnDecoder(): void {
++    const dec = this._dec;
++    if (!dec) return;
++    this._dec = undefined;
++    this._palette.set(dec.palette);
++    releaseDecoder(dec, this._decMemoryLimit);
+   }
+ 
+   public put(data: Uint32Array, start: number, end: number): void {
+@@ -83,6 +124,14 @@ export class SixelHandler implements IDcsHandler, IResetHandler {
+   }
+ 
+   public unhook(success: boolean): boolean | Promise<boolean> {
++    try {
++      return this._unhook(success);
++    } finally {
++      this._returnDecoder();
++    }
++  }
++
++  private _unhook(success: boolean): boolean {
+     if (this._aborted || !success || !this._dec) {
+       return true;
+     }
+@@ -100,9 +149,6 @@ export class SixelHandler implements IDcsHandler, IResetHandler {
+ 
+     const canvas = ImageRenderer.createCanvas(undefined, width, height);
+     canvas.getContext('2d')?.putImageData(new ImageData(this._dec.data8 as Uint8ClampedArray<ArrayBuffer>, width, height), 0, 0);
+-    if (this._dec.memoryUsage > MEM_PERMA_LIMIT) {
+-      this._dec.release();
+-    }
+     this._storage.addImage(canvas);
+     return true;
+   }
 diff --git a/src/kitty/KittyGraphicsHandler.ts b/src/kitty/KittyGraphicsHandler.ts
-index de889dfff75d9ecc8ab47a025e6989ffe75bb202..54ebea9c061e5bb92b187cab7a53bc1fa320c4f8 100644
+index de889dfff75d9ecc8ab47a025e6989ffe75bb202..cf66e5b75c78645b1641e53d1425d88201134f78 100644
 --- a/src/kitty/KittyGraphicsHandler.ts
 +++ b/src/kitty/KittyGraphicsHandler.ts
 @@ -7,6 +7,7 @@ import { IDisposable } from '@xterm/xterm';
@@ -217,10 +437,12 @@ index de889dfff75d9ecc8ab47a025e6989ffe75bb202..54ebea9c061e5bb92b187cab7a53bc1f
      this._cleanupAllPending();
      if (this._activeDecoder) {
        this._activeDecoder.release();
-@@ -200,6 +203,25 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
+@@ -200,8 +203,38 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
        this._activeDecoder = pending.decoder;
      }
      if (!this._activeDecoder) {
+-      this._activeDecoder = new Base64Decoder(Constants.DECODER_KEEP_DATA, this._maxEncodedBytes, this._initialEncodedBytes);
+-      this._activeDecoder.init();
 +      // Budget WASM capacity, including one page of decoder state and rounding.
 +      const decoderCapacity = this._maxEncodedBytes + 131072;
 +      if (decoderCapacity > this._opts.storageLimit * 1000000) {
@@ -240,10 +462,23 @@ index de889dfff75d9ecc8ab47a025e6989ffe75bb202..54ebea9c061e5bb92b187cab7a53bc1f
 +          this._sendResponse(oldest[1].cmd.id, 'ENOMEM:pending image budget exceeded', oldest[1].cmd.quiet ?? 0);
 +        }
 +      }
-       this._activeDecoder = new Base64Decoder(Constants.DECODER_KEEP_DATA, this._maxEncodedBytes, this._initialEncodedBytes);
-       this._activeDecoder.init();
++      const decoder = new Base64Decoder(Constants.DECODER_KEEP_DATA, this._maxEncodedBytes, this._initialEncodedBytes);
++      try {
++        decoder.init();
++      } catch (e) {
++        // Why: wasm memory exhaustion must drop this image, not throw out of the parser and wedge the write queue.
++        console.warn('KITTY: could not allocate decoder', e);
++        this._aborted = true;
++        if (this._parsedCommand?.id !== undefined) {
++          this._sendResponse(this._parsedCommand.id, 'ENOMEM:could not allocate decoder', this._parsedCommand.quiet ?? 0);
++        }
++        return;
++      }
++      this._activeDecoder = decoder;
      }
-@@ -550,9 +572,11 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
+ 
+     if (this._activeDecoder.put(data.subarray(start, end)) !== DECODER_OK) {
+@@ -550,9 +583,11 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
    }
  
    private async _decodeAndDisplay(image: IKittyImageData, cmd: IKittyCommand): Promise<void> {
@@ -255,7 +490,7 @@ index de889dfff75d9ecc8ab47a025e6989ffe75bb202..54ebea9c061e5bb92b187cab7a53bc1f
        const cropX = Math.max(0, cmd.x ?? 0);
        const cropY = Math.max(0, cmd.y ?? 0);
        const cropW = cmd.sourceWidth || (bitmap.width - cropX);
-@@ -660,6 +684,7 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
+@@ -660,6 +695,7 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
          }
        }
  
@@ -263,7 +498,7 @@ index de889dfff75d9ecc8ab47a025e6989ffe75bb202..54ebea9c061e5bb92b187cab7a53bc1f
        const zIndex = cmd.zIndex ?? 0;
        this._kittyStorage.addImage(image.id, bitmap, true, layer, zIndex);
        bitmap = undefined;  // ownership transferred to storage
-@@ -693,6 +718,12 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
+@@ -693,6 +729,12 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
      }
  
      if (image.format === KittyFormat.PNG) {
@@ -276,7 +511,7 @@ index de889dfff75d9ecc8ab47a025e6989ffe75bb202..54ebea9c061e5bb92b187cab7a53bc1f
        const blob = new Blob([bytes as BlobPart], { type: 'image/png' });
        if (!window.createImageBitmap) {
          const url = URL.createObjectURL(blob);
-@@ -775,27 +806,45 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
+@@ -775,27 +817,45 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
    private async _decompressZlib(compressed: Uint8Array): Promise<Uint8Array> {
      try {
        return await this._decompress(compressed, 'deflate');
diff --git a/config/patches/i18next-cli@1.74.2.patch b/config/patches/i18next-cli@1.74.2.patch
new file mode 100644
index 00000000000..e4eb976d1ec
--- /dev/null
+++ b/config/patches/i18next-cli@1.74.2.patch
@@ -0,0 +1,44 @@
+diff --git a/dist/cjs/extractor/core/extractor.js b/dist/cjs/extractor/core/extractor.js
+index 6d61ade2471c20bf1a253e3784bfadcb01440545..c1b001e78a215f89a8d4da1756a87562a5a6e723 100644
+--- a/dist/cjs/extractor/core/extractor.js
++++ b/dist/cjs/extractor/core/extractor.js
+@@ -143,6 +143,8 @@ const extractionSiteRegexes = new WeakMap();
+  * @internal
+  */
+ function mayContainExtractionSite(code, config) {
++    // Escaped identifiers need the parser; comments can separate a name from its call.
++    if (code.includes('\\u')) return true;
+     let re = extractionSiteRegexes.get(config);
+     if (!re) {
+         const calls = new Set(['t']);
+@@ -160,7 +162,7 @@ function mayContainExtractionSite(code, config) {
+         for (const component of config.extract.transComponents || ['Trans'])
+             names.add(component.split('.').pop());
+         const alt = (set) => [...set].map(s => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|');
+-        re = new RegExp(`(?<!\\w)(?:(?:${alt(calls)})\\s*(?:\\?\\.\\s*)?[(<]|(?:${alt(names)})(?![\\w$]))`);
++        re = new RegExp(`(?<![\\w$])(?:${alt(calls)}|${alt(names)})(?![\\w$])`);
+         extractionSiteRegexes.set(config, re);
+     }
+     return re.test(code);
+diff --git a/dist/esm/extractor/core/extractor.js b/dist/esm/extractor/core/extractor.js
+index 910bdb6e25e26c01ea6127191f1a00c7089693c1..00da4a6a7acb6c3da8d4b6fe7be106c409542f8d 100644
+--- a/dist/esm/extractor/core/extractor.js
++++ b/dist/esm/extractor/core/extractor.js
+@@ -141,6 +141,8 @@ const extractionSiteRegexes = new WeakMap();
+  * @internal
+  */
+ function mayContainExtractionSite(code, config) {
++    // Escaped identifiers need the parser; comments can separate a name from its call.
++    if (code.includes('\\u')) return true;
+     let re = extractionSiteRegexes.get(config);
+     if (!re) {
+         const calls = new Set(['t']);
+@@ -158,7 +160,7 @@ function mayContainExtractionSite(code, config) {
+         for (const component of config.extract.transComponents || ['Trans'])
+             names.add(component.split('.').pop());
+         const alt = (set) => [...set].map(s => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|');
+-        re = new RegExp(`(?<!\\w)(?:(?:${alt(calls)})\\s*(?:\\?\\.\\s*)?[(<]|(?:${alt(names)})(?![\\w$]))`);
++        re = new RegExp(`(?<![\\w$])(?:${alt(calls)}|${alt(names)})(?![\\w$])`);
+         extractionSiteRegexes.set(config, re);
+     }
+     return re.test(code);
diff --git a/config/patches/node-pty@1.1.0.patch b/config/patches/node-pty@1.1.0.patch
index d36bf36b63f..40b240f3296 100644
--- a/config/patches/node-pty@1.1.0.patch
+++ b/config/patches/node-pty@1.1.0.patch
@@ -707,7 +707,7 @@ index 98733dc0cd752b554bd94e45904ca341ad141bba..3dd5ad9b3124dbd5ba7f76679b26650d
            // Stop processing immediately on unexpected error and log
            this._writeQueue.length = 0;
 diff --git a/src/win/conpty.cc b/src/win/conpty.cc
-index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c6678cf86 100644
+index 7b286d3d64..5239ba4e40 100644
 --- a/src/win/conpty.cc
 +++ b/src/win/conpty.cc
 @@ -18,6 +18,7 @@
@@ -718,7 +718,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
  #include <vector>
  #include <Windows.h>
  #include <strsafe.h>
-@@ -44,12 +45,40 @@ struct pty_baton {
+@@ -44,15 +45,37 @@ struct pty_baton {
    HANDLE hOut;
    HPCON hpc;
  
@@ -749,18 +749,25 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
  };
  
  static std::vector<std::unique_ptr<pty_baton>> ptyHandles;
-+// Orca: guards the job accessors below, and PtyKill, against the exit watcher
-+// thread. It does NOT make the whole table safe -- PtyResize and PtyClear still
-+// read it unlocked, as they always have -- but it closes the window this patch
-+// opened, where the watcher can close hShell/hJob and free the baton between a
-+// lookup and its use.
-+// Handle VALUES are recycled aggressively, so an unguarded read could pass the
-+// shell-pid check against an unrelated process and terminate the wrong job.
++// Orca: every table access shares the exit watcher's lock; handles can be recycled.
 +static std::mutex ptyJobMutex;
  static volatile LONG ptyCounter;
  
- static pty_baton* get_pty_baton(int id) {
-@@ -102,8 +131,31 @@ void SetupExitCallback(Napi::Env env, Napi::Function cb, pty_baton* baton) {
+-static pty_baton* get_pty_baton(int id) {
++static pty_baton* get_pty_baton_locked(int id) {
+   auto it = std::find_if(ptyHandles.begin(), ptyHandles.end(), [id](const auto& ptyHandle) {
+     return ptyHandle->id == id;
+   });
+@@ -62,7 +85,7 @@ static pty_baton* get_pty_baton(int id) {
+   return nullptr;
+ }
+ 
+-static bool remove_pty_baton(int id) {
++static bool remove_pty_baton_locked(int id) {
+   auto it = std::remove_if(ptyHandles.begin(), ptyHandles.end(), [id](const auto& ptyHandle) {
+     return ptyHandle->id == id;
+   });
+@@ -102,8 +125,31 @@ void SetupExitCallback(Napi::Env env, Napi::Function cb, pty_baton* baton) {
      // Get process exit code.
      GetExitCodeProcess(baton->hShell, (LPDWORD)(&exit_event->exit_code));
      // Clean up handles
@@ -782,7 +789,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
 +      // NDEBUG would compile the call away and leak every baton.
 +      baton->shellExited = true;
 +      if (baton->consoleClosed) {
-+        const bool removed = remove_pty_baton(baton->id);
++        const bool removed = remove_pty_baton_locked(baton->id);
 +        assert(removed);
 +        (void)removed;
 +      }
@@ -794,7 +801,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
  
      auto status = tsfn.BlockingCall(exit_event, callback); // In main thread
      switch (status) {
-@@ -242,6 +294,20 @@
+@@ -242,6 +288,20 @@ HRESULT CreateNamedPipesAndPseudoConsole(const Napi::CallbackInfo& info,
    return HRESULT_FROM_WIN32(GetLastError());
  }
  
@@ -815,15 +822,40 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
  static Napi::Value PtyStartProcess(const Napi::CallbackInfo& info) {
    Napi::Env env(info.Env());
    Napi::HandleScope scope(env);
-@@ -303,6 +369,7 @@
+@@ -301,8 +361,10 @@ static Napi::Value PtyStartProcess(const Napi::CallbackInfo& info) {
+     // We were able to instantiate a conpty
+     const int ptyId = InterlockedIncrement(&ptyCounter);
      marshal.Set("pty", Napi::Number::New(env, ptyId));
-     ptyHandles.emplace_back(
-         std::make_unique<pty_baton>(ptyId, hIn, hOut, hpc));
-+    ptyHandles.back()->allowJobBreakaway = !usesCygwinRuntime(shellpath);
+-    ptyHandles.emplace_back(
+-        std::make_unique<pty_baton>(ptyId, hIn, hOut, hpc));
++    auto baton = std::make_unique<pty_baton>(ptyId, hIn, hOut, hpc);
++    baton->allowJobBreakaway = !usesCygwinRuntime(shellpath);
++    std::lock_guard<std::mutex> guard(ptyJobMutex);
++    ptyHandles.emplace_back(std::move(baton));
    } else {
      throw Napi::Error::New(env, "Cannot launch conpty");
    }
-@@ -409,6 +476,15 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+@@ -350,11 +412,15 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+   const bool useConptyDll = info[4].As<Napi::Boolean>().Value();
+   Napi::Function exitCallback = info[5].As<Napi::Function>();
+ 
+-  // Fetch pty handle from ID and start process
+-  pty_baton* handle = get_pty_baton(id);
+-  if (!handle) {
+-    throw Napi::Error::New(env, "Invalid pty handle");
++  pty_baton* handle;
++  {
++    std::lock_guard<std::mutex> guard(ptyJobMutex);
++    handle = get_pty_baton_locked(id);
++    if (!handle || handle->consoleClosed) {
++      throw Napi::Error::New(env, "Invalid pty handle");
++    }
+   }
++  // No watcher exists for this baton until SetupExitCallback below; pipe waits stay unlocked.
+ 
+   // Prepare command line
+   std::unique_ptr<wchar_t[]> mutableCommandline = std::make_unique<wchar_t[]>(cmdline.length() + 1);
+@@ -409,6 +475,15 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
      throw errorWithCode(info, "UpdateProcThreadAttribute failed");
    }
  
@@ -839,7 +871,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
    PROCESS_INFORMATION piClient{};
    fSuccess = !!CreateProcessW(
        nullptr,
-@@ -416,7 +492,10 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+@@ -416,7 +491,10 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
        nullptr,                      // lpProcessAttributes
        nullptr,                      // lpThreadAttributes
        false,                        // bInheritHandles VERY IMPORTANT that this is false
@@ -851,7 +883,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
        envArg,                       // lpEnvironment
        mutableCwd.get(),             // lpCurrentDirectory
        &siEx.StartupInfo,            // lpStartupInfo
-@@ -426,8 +505,48 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+@@ -426,8 +504,48 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
      throw errorWithCode(info, "Cannot create process");
    }
  
@@ -902,25 +934,52 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
    if (useConptyDll && fLoadedDll)
    {
      PFNRELEASEPSEUDOCONSOLE const pfnReleasePseudoConsole = (PFNRELEASEPSEUDOCONSOLE)GetProcAddress(
-@@ -440,6 +559,8 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+@@ -438,8 +556,12 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+     }
+   }
  
-   // Update handle
-   handle->hShell = piClient.hProcess;
-+  handle->shellPid = piClient.dwProcessId;
-+  handle->hJob = hJob;
+-  // Update handle
+-  handle->hShell = piClient.hProcess;
++  {
++    std::lock_guard<std::mutex> guard(ptyJobMutex);
++    handle->hShell = piClient.hProcess;
++    handle->shellPid = piClient.dwProcessId;
++    handle->hJob = hJob;
++  }
  
    // Close the thread handle to avoid resource leak
    CloseHandle(piClient.hThread);
-@@ -544,27 +665,213 @@ static Napi::Value PtyKill(const Napi::CallbackInfo& info) {
+@@ -472,9 +594,10 @@ static Napi::Value PtyResize(const Napi::CallbackInfo& info) {
+   SHORT rows = static_cast<SHORT>(info[2].As<Napi::Number>().Uint32Value());
+   const bool useConptyDll = info[3].As<Napi::Boolean>().Value();
+ 
+-  const pty_baton* handle = get_pty_baton(id);
++  std::lock_guard<std::mutex> guard(ptyJobMutex);
++  const pty_baton* handle = get_pty_baton_locked(id);
+ 
+-  if (handle != nullptr) {
++  if (handle != nullptr && !handle->consoleClosed) {
+     HANDLE hLibrary = LoadConptyDll(info, useConptyDll);
+     bool fLoadedDll = hLibrary != nullptr;
+     if (fLoadedDll)
+@@ -513,9 +636,10 @@ static Napi::Value PtyClear(const Napi::CallbackInfo& info) {
+     return env.Undefined();
+   }
+ 
+-  const pty_baton* handle = get_pty_baton(id);
++  std::lock_guard<std::mutex> guard(ptyJobMutex);
++  const pty_baton* handle = get_pty_baton_locked(id);
+ 
+-  if (handle != nullptr) {
++  if (handle != nullptr && !handle->consoleClosed) {
+     HANDLE hLibrary = LoadConptyDll(info, useConptyDll);
+     bool fLoadedDll = hLibrary != nullptr;
+     if (fLoadedDll)
+@@ -544,29 +668,215 @@ static Napi::Value PtyKill(const Napi::CallbackInfo& info) {
    int id = info[0].As<Napi::Number>().Int32Value();
    const bool useConptyDll = info[1].As<Napi::Boolean>().Value();
  
 -  const pty_baton* handle = get_pty_baton(id);
--
--  if (handle != nullptr) {
--    HANDLE hLibrary = LoadConptyDll(info, useConptyDll);
--    bool fLoadedDll = hLibrary != nullptr;
--    if (fLoadedDll)
 +  // Orca: resolve the DLL BEFORE touching any baton state, for the same reason
 +  // PtyConnect does it before creating anything. LoadConptyDll throws when
 +  // conpty.dll is missing, and a throw after consoleClosed was set would strand
@@ -934,7 +993,18 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
 +      (HMODULE)hLibrary,
 +      useConptyDll ? "ConptyClosePseudoConsole" : "ClosePseudoConsole");
 +  }
-+
+ 
+-  if (handle != nullptr) {
+-    HANDLE hLibrary = LoadConptyDll(info, useConptyDll);
+-    bool fLoadedDll = hLibrary != nullptr;
+-    if (fLoadedDll)
+-    {
+-      PFNCLOSEPSEUDOCONSOLE const pfnClosePseudoConsole = (PFNCLOSEPSEUDOCONSOLE)GetProcAddress(
+-        (HMODULE)hLibrary,
+-        useConptyDll ? "ConptyClosePseudoConsole" : "ClosePseudoConsole");
+-      if (pfnClosePseudoConsole)
+-      {
+-        pfnClosePseudoConsole(handle->hpc);
 +  // Orca: the baton now outlives the shell, so this runs on a self-exited pty
 +  // too -- that is the whole point. Take what we need under the lock: the
 +  // watcher thread nulls hShell the moment the shell dies, and TerminateProcess
@@ -945,7 +1015,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
 +  bool owed = false;
 +  {
 +    std::lock_guard<std::mutex> guard(ptyJobMutex);
-+    pty_baton* handle = get_pty_baton(id);
++    pty_baton* handle = get_pty_baton_locked(id);
 +    // Why the consoleClosed check: a second kill() would otherwise close the
 +    // same pseudoconsole twice. Upstream relied on the baton being gone.
 +    if (handle != nullptr && !handle->consoleClosed) {
@@ -965,9 +1035,9 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
 +          hShellDup = nullptr;
 +          TerminateProcess(handle->hShell, 1);
 +        }
-+      }
+       }
 +      if (handle->shellExited) {
-+        const bool removed = remove_pty_baton(id);
++        const bool removed = remove_pty_baton_locked(id);
 +        assert(removed);
 +        (void)removed;
 +      }
@@ -979,19 +1049,11 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
 +  // drained, and the watcher must be able to take the lock while it does.
 +  if (owed) {
 +    if (pfnClosePseudoConsole)
-     {
--      PFNCLOSEPSEUDOCONSOLE const pfnClosePseudoConsole = (PFNCLOSEPSEUDOCONSOLE)GetProcAddress(
--        (HMODULE)hLibrary,
--        useConptyDll ? "ConptyClosePseudoConsole" : "ClosePseudoConsole");
--      if (pfnClosePseudoConsole)
--      {
--        pfnClosePseudoConsole(handle->hpc);
--      }
--    }
++    {
++      pfnClosePseudoConsole(hpc);
+     }
 -    if (useConptyDll) {
 -      TerminateProcess(handle->hShell, 1);
-+      pfnClosePseudoConsole(hpc);
-+    }
 +    if (hShellDup != nullptr) {
 +      TerminateProcess(hShellDup, 1);
 +      CloseHandle(hShellDup);
@@ -999,8 +1061,8 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
    }
  
    return env.Undefined();
-+}
-+
+ }
+ 
 +/**
 + * Orca: confirm a baton really is the pty the caller means.
 + *
@@ -1032,7 +1094,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
 +  // Held across the lookup AND the Win32 call: the watcher thread can otherwise
 +  // close these handles and free the baton in between.
 +  std::lock_guard<std::mutex> guard(ptyJobMutex);
-+  const pty_baton* handle = get_pty_baton(info[0].As<Napi::Number>().Int32Value());
++  const pty_baton* handle = get_pty_baton_locked(info[0].As<Napi::Number>().Int32Value());
 +  if (!ownsShell(handle, info[1].As<Napi::Number>().Uint32Value())) {
 +    return Napi::Boolean::New(env, false);
 +  }
@@ -1064,7 +1126,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
 +  // Held across the lookup AND the Win32 call: the watcher thread can otherwise
 +  // close these handles and free the baton in between.
 +  std::lock_guard<std::mutex> guard(ptyJobMutex);
-+  const pty_baton* handle = get_pty_baton(info[0].As<Napi::Number>().Int32Value());
++  const pty_baton* handle = get_pty_baton_locked(info[0].As<Napi::Number>().Int32Value());
 +  if (!ownsShell(handle, info[1].As<Napi::Number>().Uint32Value())) {
 +    return env.Null();
 +  }
@@ -1138,10 +1200,12 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
 +  }
 +  hHostJob = job;
 +  return Napi::Boolean::New(env, true);
- }
- 
++}
++
  /**
-@@ -577,6 +884,9 @@ Napi::Object init(Napi::Env env, Napi::Object exports) {
+ * Init
+ */
+@@ -577,6 +887,9 @@ Napi::Object init(Napi::Env env, Napi::Object exports) {
    exports.Set("resize", Napi::Function::New(env, PtyResize));
    exports.Set("clear", Napi::Function::New(env, PtyClear));
    exports.Set("kill", Napi::Function::New(env, PtyKill));
diff --git a/config/patches/xterm-src/@xterm__addon-image@0.10.0-beta.300.src.patch b/config/patches/xterm-src/@xterm__addon-image@0.10.0-beta.300.src.patch
index 2c5aa15fac1..3b581c30477 100644
--- a/config/patches/xterm-src/@xterm__addon-image@0.10.0-beta.300.src.patch
+++ b/config/patches/xterm-src/@xterm__addon-image@0.10.0-beta.300.src.patch
@@ -1,8 +1,21 @@
 diff --git a/src/IIPHandler.ts b/src/IIPHandler.ts
-index 559b907416eb38318f439d060d7f89311ed34c7e..8541b4b0ea0d6b451aaae49007d69df64c5bd088 100644
+index 559b907416eb38318f439d060d7f89311ed34c7e..73cedbe99f831bffd202697cc8ba80a46a39cb99 100644
 --- a/src/IIPHandler.ts
 +++ b/src/IIPHandler.ts
-@@ -34,6 +34,7 @@ const DEFAULT_HEADER: IHeaderFields = {
+@@ -13,8 +13,10 @@ import { imageType, UNSUPPORTED_TYPE } from './IIPMetrics';
+ 
+ // Local const enum mirror - esbuild can't inline const enums from external packages
+ const enum DecoderConst {
+-  // Limit held memory in base64 decoder (encoded bytes).
+-  KEEP_DATA = 4194304,
++  // Held memory in base64/QOI decoders between images. Zero because each kept
++  // decoder pins a wasm memory, and V8 caps those per process (~124 in a
++  // sandboxed renderer), so idle terminals must not hold one.
++  KEEP_DATA = 0,
+   // Initial buffer allocation for the decoder.
+   INITIAL_DATA = 1048576,
+   // Local mirror of const enum (esbuild can't inline const enums from external packages)
+@@ -34,6 +36,7 @@ const DEFAULT_HEADER: IHeaderFields = {
  
  
  export class IIPHandler implements IOscHandler, IResetHandler {
@@ -10,7 +23,7 @@ index 559b907416eb38318f439d060d7f89311ed34c7e..8541b4b0ea0d6b451aaae49007d69df6
    private _aborted = false;
    private _hp = new HeaderParser();
    private _header: IHeaderFields = DEFAULT_HEADER;
-@@ -55,6 +56,7 @@ export class IIPHandler implements IOscHandler, IResetHandler {
+@@ -55,6 +58,7 @@ export class IIPHandler implements IOscHandler, IResetHandler {
    }
  
    public reset(): void {
@@ -18,7 +31,47 @@ index 559b907416eb38318f439d060d7f89311ed34c7e..8541b4b0ea0d6b451aaae49007d69df6
      this._hp.reset();
      this._dec.release();
      this._qoiDec.release();
-@@ -198,8 +200,13 @@ export class IIPHandler implements IOscHandler, IResetHandler {
+@@ -92,7 +96,10 @@ export class IIPHandler implements IOscHandler, IResetHandler {
+             this._aborted = true;
+             return;
+           }
+-          this._dec.init();
++          if (!this._initDecoder()) {
++            this._aborted = true;
++            return;
++          }
+         } else if (this._abortMulti) {
+           this._aborted = true;
+           return;
+@@ -135,7 +142,9 @@ export class IIPHandler implements IOscHandler, IResetHandler {
+       this._isMultipart = true;
+       this._abortMulti = false;
+       this._dec.release();
+-      this._dec.init();
++      if (!this._initDecoder()) {
++        this._abortMulti = true;
++      }
+       return true;
+     }
+ 
+@@ -179,7 +188,15 @@ export class IIPHandler implements IOscHandler, IResetHandler {
+ 
+     let blob: Blob | ImageData;
+     if (metrics.mime === 'image/qoi') {
+-      const data = this._qoiDec.decode(this._dec.data8);
++      let data: Uint8Array<ArrayBuffer>;
++      try {
++        data = this._qoiDec.decode(this._dec.data8);
++      } catch (e) {
++        console.warn('IIP: could not decode QOI image', e);
++        this._dec.release();
++        this._qoiDec.release();
++        return true;
++      }
+       blob = new ImageData(
+         new Uint8ClampedArray(data.buffer, data.byteOffset, data.byteLength),
+         this._qoiDec.width,
+@@ -198,8 +215,13 @@ export class IIPHandler implements IOscHandler, IResetHandler {
        blob = new Blob([this._dec.data8], { type: metrics.mime });
      }
      this._dec.release();
@@ -32,6 +85,25 @@ index 559b907416eb38318f439d060d7f89311ed34c7e..8541b4b0ea0d6b451aaae49007d69df6
          this._storage.addImage(bm);
          return true;
        })
+@@ -209,6 +231,18 @@ export class IIPHandler implements IOscHandler, IResetHandler {
+       });
+   }
+ 
++  // Why: wasm memory exhaustion must drop this image, not throw out of the parser and wedge the write queue.
++  private _initDecoder(): boolean {
++    try {
++      this._dec.init();
++      return true;
++    } catch (e) {
++      console.warn('IIP: could not allocate decoder', e);
++      this._dec.release();
++      return false;
++    }
++  }
++
+   private _resize(w: number, h: number): [number, number] {
+     const cw = this._renderer.dimensions?.css.cell.width || CELL_SIZE_DEFAULT.width;
+     const ch = this._renderer.dimensions?.css.cell.height || CELL_SIZE_DEFAULT.height;
 diff --git a/src/ImageAddon.ts b/src/ImageAddon.ts
 index 8fd39543118cd420e36c1614c1af370b6c7bbfbb..0c44d2a81642113417bf8dc10a4faa76d7cc5864 100644
 --- a/src/ImageAddon.ts
@@ -144,8 +216,156 @@ index 5854efaec1fdf9dfcb886023542998a563b6d2f2..3afaf9bd63ffd7a4cdf32bf0ac24cf33
    }
  
    public get document(): Document | undefined {
+diff --git a/src/SixelHandler.ts b/src/SixelHandler.ts
+index 1af2d85bcdd541ed60b1e707f6186a91f1bbf1b2..0711a122ea43d5212a2851add9e744b65550ec85 100644
+--- a/src/SixelHandler.ts
++++ b/src/SixelHandler.ts
+@@ -10,6 +10,7 @@ import { RGBA8888 } from 'sixel/lib/Types';
+ import { ImageRenderer } from './ImageRenderer';
+ 
+ import { DecoderAsync, Decoder } from 'sixel/lib/Decoder';
++import { LIMITS } from 'sixel/lib/wasm';
+ 
+ // always free decoder ressources after decoding if it exceeds this limit
+ const MEM_PERMA_LIMIT = 4194304; // 1024 pixels * 1024 pixels * 4 channels = 4MB
+@@ -18,48 +19,88 @@ const MEM_PERMA_LIMIT = 4194304; // 1024 pixels * 1024 pixels * 4 channels = 4MB
+ const DEFAULT_PALETTE = PALETTE_ANSI_256;
+ DEFAULT_PALETTE.set(PALETTE_VT340_COLOR);
+ 
++// Why pooled: every decoder owns a wasm memory, and V8 caps live wasm memories
++// per process (~124 in a sandboxed renderer). Terminals borrow a decoder only
++// while a SIXEL sequence is open, so idle terminals hold none.
++const MAX_IDLE_DECODERS = 2;
++const idleDecoders = new Map<number, Decoder[]>();
++let poolPrimed = false;
++
++function primeDecoderPool(memoryLimit: number): void {
++  if (poolPrimed) return;
++  poolPrimed = true;
++  // Async compile once, off the parser's hot path; later decoders reuse the cached module.
++  DecoderAsync({ memoryLimit, palette: DEFAULT_PALETTE }).then(
++    d => releaseDecoder(d, memoryLimit),
++    () => { poolPrimed = false; }
++  );
++}
++
++function acquireDecoder(memoryLimit: number): Decoder {
++  return idleDecoders.get(memoryLimit)?.pop() ?? new Decoder({ memoryLimit, palette: DEFAULT_PALETTE });
++}
++
++function releaseDecoder(dec: Decoder, memoryLimit: number): void {
++  if (dec.memoryUsage > MEM_PERMA_LIMIT) {
++    dec.release();
++  }
++  const idle = idleDecoders.get(memoryLimit) ?? [];
++  if (idle.length < MAX_IDLE_DECODERS) {
++    idle.push(dec);
++    idleDecoders.set(memoryLimit, idle);
++  }
++}
++
+ 
+ export class SixelHandler implements IDcsHandler, IResetHandler {
+   private _size = 0;
+   private _aborted = false;
+   private _dec: Decoder | undefined;
++  private _decMemoryLimit = 0;
++  // Color registers outlive a single image, so they live here rather than in a pooled decoder.
++  private readonly _palette = new Uint32Array(LIMITS.PALETTE_SIZE);
+ 
+   constructor(
+     private readonly _opts: IImageAddonOptions,
+     private readonly _storage: SixelImageStorage,
+     private readonly _coreTerminal: ITerminalExt
+   ) {
+-    DecoderAsync({
+-      memoryLimit: this._opts.pixelLimit * 4,
+-      palette: DEFAULT_PALETTE,
+-      paletteLimit: this._opts.sixelPaletteLimit
+-    }).then(d => this._dec = d);
++    this._palette.set(DEFAULT_PALETTE);
++    primeDecoderPool(this._opts.pixelLimit * 4);
+   }
+ 
+   public reset(): void {
+-    /**
+-     * reset sixel decoder to defaults:
+-     * - release all memory
+-     * - nullify palette (4096)
+-     * - apply default palette (256)
+-     */
+-    if (this._dec) {
+-      this._dec.release();
+-      // FIXME: missing interface on decoder to nullify full palette
+-      (this._dec as any)._palette.fill(0);
+-      this._dec.init(0, DEFAULT_PALETTE, this._opts.sixelPaletteLimit);
+-    }
++    this._returnDecoder();
++    this._palette.fill(0);
++    this._palette.set(DEFAULT_PALETTE);
+   }
+ 
+   public hook(params: IParams): void {
+     this._size = 0;
+     this._aborted = false;
+-    if (this._dec) {
+-      const fillColor = params.params[1] === 1 ? 0 : extractActiveBg(
+-        this._coreTerminal._core._inputHandler._curAttrData,
+-        this._coreTerminal._core._themeService?.colors);
+-      this._dec.init(fillColor, null, this._opts.sixelPaletteLimit);
++    this._returnDecoder();
++    const memoryLimit = this._opts.pixelLimit * 4;
++    try {
++      this._dec = acquireDecoder(memoryLimit);
++    } catch (e) {
++      // Why: exhausting wasm memory must drop this image, not throw out of the parser and wedge the write queue.
++      console.warn(`SIXEL: could not allocate decoder - ${e}`);
++      this._aborted = true;
++      return;
+     }
++    this._decMemoryLimit = memoryLimit;
++    const fillColor = params.params[1] === 1 ? 0 : extractActiveBg(
++      this._coreTerminal._core._inputHandler._curAttrData,
++      this._coreTerminal._core._themeService?.colors);
++    this._dec.init(fillColor, this._palette, this._opts.sixelPaletteLimit);
++  }
++
++  private _returnDecoder(): void {
++    const dec = this._dec;
++    if (!dec) return;
++    this._dec = undefined;
++    this._palette.set(dec.palette);
++    releaseDecoder(dec, this._decMemoryLimit);
+   }
+ 
+   public put(data: Uint32Array, start: number, end: number): void {
+@@ -83,6 +124,14 @@ export class SixelHandler implements IDcsHandler, IResetHandler {
+   }
+ 
+   public unhook(success: boolean): boolean | Promise<boolean> {
++    try {
++      return this._unhook(success);
++    } finally {
++      this._returnDecoder();
++    }
++  }
++
++  private _unhook(success: boolean): boolean {
+     if (this._aborted || !success || !this._dec) {
+       return true;
+     }
+@@ -100,9 +149,6 @@ export class SixelHandler implements IDcsHandler, IResetHandler {
+ 
+     const canvas = ImageRenderer.createCanvas(undefined, width, height);
+     canvas.getContext('2d')?.putImageData(new ImageData(this._dec.data8 as Uint8ClampedArray<ArrayBuffer>, width, height), 0, 0);
+-    if (this._dec.memoryUsage > MEM_PERMA_LIMIT) {
+-      this._dec.release();
+-    }
+     this._storage.addImage(canvas);
+     return true;
+   }
 diff --git a/src/kitty/KittyGraphicsHandler.ts b/src/kitty/KittyGraphicsHandler.ts
-index de889dfff75d9ecc8ab47a025e6989ffe75bb202..54ebea9c061e5bb92b187cab7a53bc1fa320c4f8 100644
+index de889dfff75d9ecc8ab47a025e6989ffe75bb202..cf66e5b75c78645b1641e53d1425d88201134f78 100644
 --- a/src/kitty/KittyGraphicsHandler.ts
 +++ b/src/kitty/KittyGraphicsHandler.ts
 @@ -7,6 +7,7 @@ import { IDisposable } from '@xterm/xterm';
@@ -172,10 +392,12 @@ index de889dfff75d9ecc8ab47a025e6989ffe75bb202..54ebea9c061e5bb92b187cab7a53bc1f
      this._cleanupAllPending();
      if (this._activeDecoder) {
        this._activeDecoder.release();
-@@ -200,6 +203,25 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
+@@ -200,8 +203,38 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
        this._activeDecoder = pending.decoder;
      }
      if (!this._activeDecoder) {
+-      this._activeDecoder = new Base64Decoder(Constants.DECODER_KEEP_DATA, this._maxEncodedBytes, this._initialEncodedBytes);
+-      this._activeDecoder.init();
 +      // Budget WASM capacity, including one page of decoder state and rounding.
 +      const decoderCapacity = this._maxEncodedBytes + 131072;
 +      if (decoderCapacity > this._opts.storageLimit * 1000000) {
@@ -195,10 +417,23 @@ index de889dfff75d9ecc8ab47a025e6989ffe75bb202..54ebea9c061e5bb92b187cab7a53bc1f
 +          this._sendResponse(oldest[1].cmd.id, 'ENOMEM:pending image budget exceeded', oldest[1].cmd.quiet ?? 0);
 +        }
 +      }
-       this._activeDecoder = new Base64Decoder(Constants.DECODER_KEEP_DATA, this._maxEncodedBytes, this._initialEncodedBytes);
-       this._activeDecoder.init();
++      const decoder = new Base64Decoder(Constants.DECODER_KEEP_DATA, this._maxEncodedBytes, this._initialEncodedBytes);
++      try {
++        decoder.init();
++      } catch (e) {
++        // Why: wasm memory exhaustion must drop this image, not throw out of the parser and wedge the write queue.
++        console.warn('KITTY: could not allocate decoder', e);
++        this._aborted = true;
++        if (this._parsedCommand?.id !== undefined) {
++          this._sendResponse(this._parsedCommand.id, 'ENOMEM:could not allocate decoder', this._parsedCommand.quiet ?? 0);
++        }
++        return;
++      }
++      this._activeDecoder = decoder;
      }
-@@ -550,9 +572,11 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
+ 
+     if (this._activeDecoder.put(data.subarray(start, end)) !== DECODER_OK) {
+@@ -550,9 +583,11 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
    }
  
    private async _decodeAndDisplay(image: IKittyImageData, cmd: IKittyCommand): Promise<void> {
@@ -210,7 +445,7 @@ index de889dfff75d9ecc8ab47a025e6989ffe75bb202..54ebea9c061e5bb92b187cab7a53bc1f
        const cropX = Math.max(0, cmd.x ?? 0);
        const cropY = Math.max(0, cmd.y ?? 0);
        const cropW = cmd.sourceWidth || (bitmap.width - cropX);
-@@ -660,6 +684,7 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
+@@ -660,6 +695,7 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
          }
        }
  
@@ -218,7 +453,7 @@ index de889dfff75d9ecc8ab47a025e6989ffe75bb202..54ebea9c061e5bb92b187cab7a53bc1f
        const zIndex = cmd.zIndex ?? 0;
        this._kittyStorage.addImage(image.id, bitmap, true, layer, zIndex);
        bitmap = undefined;  // ownership transferred to storage
-@@ -693,6 +718,12 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
+@@ -693,6 +729,12 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
      }
  
      if (image.format === KittyFormat.PNG) {
@@ -231,7 +466,7 @@ index de889dfff75d9ecc8ab47a025e6989ffe75bb202..54ebea9c061e5bb92b187cab7a53bc1f
        const blob = new Blob([bytes as BlobPart], { type: 'image/png' });
        if (!window.createImageBitmap) {
          const url = URL.createObjectURL(blob);
-@@ -775,27 +806,45 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
+@@ -775,27 +817,45 @@ export class KittyGraphicsHandler implements IApcHandler, IResetHandler, IDispos
    private async _decompressZlib(compressed: Uint8Array): Promise<Uint8Array> {
      try {
        return await this._decompress(compressed, 'deflate');
diff --git a/config/reliability-gates.jsonc b/config/reliability-gates.jsonc
index a236145dd94..3f210c23823 100644
--- a/config/reliability-gates.jsonc
+++ b/config/reliability-gates.jsonc
@@ -10,6 +10,628 @@
     }
   },
   "gates": [
+    {
+      "id": "terminal-preview.connection-settings-ownership",
+      "title": "Terminal preview connections survive unrelated settings updates",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "terminal-runtime",
+      "layer": "renderer-unit",
+      "surfaces": [
+        "dashboard terminal preview connection",
+        "preview settings updates",
+        "preview box fit and grid claim"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["local", "remote-runtime"],
+      "coverageNotes": "Mounted production component and real settings action with cloned IPC replies, inert xterm/input adapters, and simulated metrics. Local/remote-qualified renderer identities covered; no physical provider, native geometry, focus, IME or rendered app claim. Subsequent hidden/offscreen Electron component proof uses real xterm and synthetic snapshots, preserving the rendered terminal across unrelated updates and measuring equivalent fallback scale/fit requests after a font-size change.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/main/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.tsx",
+        "https://github.com/stablyai/orca/pull/23099"
+      ],
+      "invariant": "Equal composed theme with unchanged PTY, mode, contrast and font/shaping settings keeps the current preview owner. Relevant changes replace it once, preserve explicit fit/grid negotiation, and reject retired pending completions.",
+      "oracle": "Ten unrelated settings replies produce one connect and xterm construction, no pre-unmount teardown, then one final cleanup. Changed colors/mode/contrast/font/shaping replace owners; pending retired connections never construct and obsolete grid claims are canceled.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-lifetime.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-geometry.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.clipboard-routes.test.tsx"
+      ],
+      "testFiles": [
+        "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-lifetime.test.tsx",
+        "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-geometry.test.tsx",
+        "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx",
+        "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx",
+        "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.clipboard-routes.test.tsx"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-lifetime.test.tsx",
+          "assertions": [
+            "keeps one preview connection across ten unrelated settings snapshots",
+            "ignores an old pending connection after a relevant theme change",
+            "does not install a terminal after unmounting a pending connection"
+          ]
+        },
+        {
+          "file": "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-geometry.test.tsx",
+          "assertions": [
+            "ignores a pending connection retired by a metric change",
+            "cancels an obsolete metric owner grid claim before the next change"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-25",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-lifetime.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-geometry.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.clipboard-routes.test.tsx",
+          "result": "passed",
+          "durationSeconds": 2.23,
+          "summary": "63 tests /5 suites pass. Lifetime regressions: original 7 fail/7 pass, candidate14 pass; all8 metric/shaping cases pass both original and corrected candidate."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 15,
+        "scope": "Focused deterministic suites; local elapsed recorded, p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Local checks and independent adverse review only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Original reconnects/reconstructs11 times for10 unrelated updates; candidate1. Seven of14 lifetime cases fail original. Original and corrected candidate both pass all8 geometry preservation cases."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Ten unrelated settings replies: connect/constructor11 to1, pre-unmount unsubscribe/dispose10 to0. One previous-theme ref and shallow comparison added; CPU/heap overhead unmeasured. No timer/polling/subprocess/subscriber added; broad settings render/composition work remains."
+      },
+      "knownGaps": [
+        "No full-dashboard interaction, native focus/input/IME, ligature shaping or physical PTY validation. Hidden Electron component rendering and one font-size transition were checked; fit endpoint was inert.",
+        "No live SSH/WSL/relay or Linux/Windows run. Provider/wire ownership and folder/git workspace paths unchanged.",
+        "Selection/buffer/input state now persists across unrelated and live cursor/scroll updates instead of incidental resets. Small comparison/ref overhead unmeasured.",
+        "No CI soak, heap, main snapshot serialization or frame latency claim."
+      ],
+      "promotionCriteria": [
+        "Retain count, stale-owner and explicit metric fit/grid oracles; add rendered native and provider/platform evidence plus CI soak."
+      ],
+      "demotionRule": "Keep experimental until soak; investigate failures without weakening owner counts, changed-theme behavior, fit/grid claims or late-disposal assertions."
+    },
+    {
+      "id": "workspace-hooks.execution-host-ownership",
+      "title": "Hook reads and writes use the stored repository execution owner",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "workspace-runtime",
+      "layer": "cross-layer-unit",
+      "surfaces": [
+        "desktop worktree hook IPC",
+        "runtime repository hooks",
+        "issue-command read and write",
+        "hosted-review own-store host resolution"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local", "ssh", "wsl", "remote-runtime"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": [],
+      "coverageNotes": "Actual hydration and authoritative desktop owner selection with mocked filesystem, Git, inspection and provider boundaries; synthetic local/SSH/runtime rows. No physical provider or native platform certification.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/main/src/main/ipc/hooks/register-worktree-hook-file-handlers.ts"
+      ],
+      "invariant": "Hook file operations follow the authoritative repository row in this process Store: canonical SSH selects its target, explicit local and self-addressed runtime rows use registered local files, and missing SSH providers never substitute local I/O.",
+      "oracle": "Nine desktop/runtime operations never use local I/O for canonical SSH or dial a stale legacy target; legacy SSH/local/runtime controls retain behavior, folder skips remain, missing providers do not gain local fallback.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/hooks/worktree-hook-execution-host.test.ts"
+      ],
+      "testFiles": ["src/main/ipc/hooks/worktree-hook-execution-host.test.ts"],
+      "assertionRefs": [
+        {
+          "file": "src/main/ipc/hooks/worktree-hook-execution-host.test.ts",
+          "assertions": [
+            "routes %s to the stored owner",
+            "refuses an unreachable canonical SSH write without touching local files"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-26",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/hooks/worktree-hook-execution-host.test.ts",
+          "result": "passed",
+          "durationSeconds": 0.739,
+          "summary": "Independent68pass/original37fail31controls. Eleven additional authority/unavailable-provider/encoded-ID/folder controls pass; author102unique permanent tests across four suites."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 10,
+        "scope": "Focused renderer-unit suites, p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Author and independent local evidence only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Frozen permanent suite68pass; original sources37fail31controls; independently reproduced with eleven extra controls."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Incorrect local/stale-target routes9to0 for each of four changed identity shapes. This is correctness evidence only, no latency/CPU/heap gain. Existing host resolver reused, no polling, cache or inventory/subprocess fanout added."
+      },
+      "knownGaps": [
+        "CI soak pending.",
+        "Physical SSH/WSL/remote-runtime, native Linux/Windows, mobile and mixed-version integration untested. Local/daemon PTY data, identity and liveness unchanged.",
+        "Runtime absent-provider issue-command write still returns ok:true without a write; this preexisting convention is not a completion claim.",
+        "Only own-store rows use the generalized helper; generic runtime dispatch still rejects hosts this process does not execute.",
+        "No actual filesystem writes, provider operations, native UI or packaged app validation in routing fixtures."
+      ],
+      "promotionCriteria": [
+        "Retain exact route, no-local-fallback and authority oracles; obtain CI soak and physical host evidence before promotion."
+      ],
+      "demotionRule": "Keep experimental until soak; investigate authority/routing failures without replacing exact-target or no-local-I/O assertions."
+    },
+    {
+      "id": "runtime-files.renderer-document-watch-ownership",
+      "title": "Filesystem watches stay owned by their renderer document",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "runtime-platform",
+      "layer": "ipc-contract",
+      "surfaces": [
+        "desktop file explorer watchers",
+        "desktop editor file watchers",
+        "direct SSH file watchers"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local", "ssh", "wsl"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["local", "ssh", "wsl"],
+      "coverageNotes": "Actual desktop local/WSL subscription and SSH watcher controller logic under mocked filesystem/provider handles on macOS. Document events use an EventEmitter sender. Live remote/native Windows/Linux/WSL and rendered reload reattachment are unproved; PTY/process liveness and wire formats are unaffected.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/main/src/main/ipc/filesystem-watcher-listener-lifecycle.ts"
+      ],
+      "invariant": "A replaced or crashed renderer document retains no file watches or pending ownership and cannot recreate them from an old asynchronous continuation. Shared roots retain live sibling owners; blocked and same-document navigation retain the current document. Shutdown removes registered lifecycle listeners.",
+      "oracle": "Run repeated reloads/crash, pending local/SSH installation cancellation with late success, aborted-install joiners, reconnect retry snapshots, failed-removal restoration and shutdown/reopen. Require zero obsolete roots/intent/listeners, no stale setup/retry, physical handle disposal and preservation of sibling notifications and same-tick remote handoff.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher-document-lifetime.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-remote-cancellation.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts --reporter=dot"
+      ],
+      "testFiles": [
+        "src/main/ipc/filesystem-watcher-document-lifetime.test.ts",
+        "src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts",
+        "src/main/ipc/filesystem-watcher-remote-cancellation.test.ts",
+        "src/main/ipc/filesystem-watcher-native-capacity.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/main/ipc/filesystem-watcher-document-lifetime.test.ts",
+          "assertions": [
+            "retains zero roots and listeners across 15 reloads and a renderer crash",
+            "does not revive a cancelled %s setup for a joiner whose document reloaded",
+            "does not re-arm an old provider snapshot into the same WebContents after replacement",
+            "does not restore a replaced sibling document after an awaited %s removal recovery",
+            "keeps same-document and blocked navigations alive, and removes lifecycle listeners at shutdown"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-25",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher-document-lifetime.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-remote-cancellation.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts --reporter=dot",
+          "result": "passed",
+          "durationSeconds": 1.08,
+          "summary": "45 tests across four focused suites pass. Broader watcher suite passes 146 plus one existing skipped; isolated publication without sibling #22995 passes 145 plus one existing skipped."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 15,
+        "scope": "Focused deterministic IPC-contract suites; p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Local validation only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Seven permanent regressions fail with HEAD source substituted: cancelled joiner resurrection for local and SSH, restoration into replaced local/SSH documents, stale provider retry, shutdown listener retention, and root retention. All 13 document ownership cases pass after the change."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "15 reloads plus crash: retained local/SSH/desired roots 16→0 each; pending setup aborted; sender lifecycle listeners 1→0. Actual ownership modules with synthetic handles; no native process/heap/latency claim. No new timer, polling, process scan or provider fanout; existing root cleanup runs at document end."
+      },
+      "knownGaps": [
+        "No native Windows/Linux/WSL or live SSH execution.",
+        "No rendered Electron reload-reattachment/paint run or CI soak; broader watcher process isolation is a separate gate."
+      ],
+      "promotionCriteria": [
+        "Retain lifecycle, count and sibling-delivery assertions and add cross-platform and rendered reload evidence before promotion."
+      ],
+      "demotionRule": "Keep experimental until soak evidence; investigate lifecycle failures without suppressing assertions or retrying unexplained failures."
+    },
+    {
+      "id": "ephemeral-vm-recipe.output-tail-parity",
+      "title": "Recipe output capture preserves UTF-8 tails and releases settled storage",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "ephemeral-vm-runtime-store",
+      "layer": "shared-node-process-contract",
+      "surfaces": ["VM recipe stdout and stderr", "recipe cancellation and process errors"],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["local"],
+      "coverageNotes": "Actual recipe capture with synthetic child streams and real forced GC, plus real macOS shell output and descendant cancellation. Linux and Windows native execution, live VM providers and remote lifecycle journeys remain untested. Local/daemon PTY, SSH ownership, WSL launch, mobile and relay wire behavior are unaffected.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/01ce5edf1aeec8a4b5cf06f531434be7d7c0cbcd/src/shared/ephemeral-vm-recipe-process.ts"
+      ],
+      "invariant": "Decoded stdout and stderr callback contents and order remain unchanged, final tails are the last capped run of raw output bytes with any leading partial UTF-8 sequence dropped, and success or failure releases capture storage without recapturing late output.",
+      "oracle": "Compare byte-bounded tails against the old per-chunk model and an independent code-point model across compaction, growth, oversized chunks and mid-character splits. Feed split and malformed UTF-8 through actual stream decoding. Require at most 5 MiB moved through the capture for 4 MiB of output with zero encoding, collectible backing buffers after close and error, zero late capture work with preserved callbacks, one decode per stream, unchanged tails on forced cancellation or synchronous kill-close, and every capture limit clamped to a bounded byte count.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/ephemeral-vm-recipe-process.test.ts src/shared/ephemeral-vm-recipe-output-capture.test.ts src/shared/growing-byte-buffer.test.ts src/main/ephemeral-vm-recipe-runner.test.ts"
+      ],
+      "testFiles": [
+        "src/shared/ephemeral-vm-recipe-process.test.ts",
+        "src/shared/ephemeral-vm-recipe-output-capture.test.ts",
+        "src/shared/growing-byte-buffer.test.ts",
+        "src/main/ephemeral-vm-recipe-runner.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/shared/ephemeral-vm-recipe-output-capture.test.ts",
+          "assertions": [
+            "matches the old per-chunk UTF-8 tail for limit %s across varied chunk boundaries",
+            "retains the same code-point tail for limit %s wherever byte boundaries fall",
+            "preserves stream decoding, callback boundaries and independent tails",
+            "moves at most 5 MiB through the capture for 4 MiB of output",
+            "releases capture storage after %s while preserving late callbacks",
+            "decodes once per stream when force-kill closes synchronously",
+            "clamps a $limit capture limit to a bounded byte count"
+          ]
+        },
+        {
+          "file": "src/shared/growing-byte-buffer.test.ts",
+          "assertions": [
+            "reads and writes correctly after the head offset has advanced",
+            "keeps a bounded suffix stable across many small appends without unbounded growth"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-26",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/ephemeral-vm-recipe-process.test.ts src/shared/ephemeral-vm-recipe-output-capture.test.ts src/shared/growing-byte-buffer.test.ts src/main/ephemeral-vm-recipe-runner.test.ts",
+          "result": "passed",
+          "durationSeconds": 0.48,
+          "summary": "60 tests across four suites passed, including forced-GC lifetime, synchronous SIGKILL-close and the shared byte buffer's head-offset cases."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 15,
+        "scope": "focused Node process and capture contracts with forced GC"
+      },
+      "flakeHistory": {
+        "status": "unknown",
+        "evidence": "Author and independent local runs pass; no CI or soak history collected."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Baseline moves 943,194,112 bytes for 4 MiB output and fails the permanent 5 MiB budget. An earlier ring prototype retained two backing buffers after error and encoded late output after close; both permanent lifetime cases fail there and pass after cleanup correction. Dropping the head offset from GrowingByteBuffer keeps the byte budget but takes 12.36 ms instead of 0.25 ms."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "4 MiB in 4 KiB chunks, seven paired samples, macOS: the old per-chunk re-encode moves 943,194,112 bytes in 265.78 ms median; raw-byte capture into GrowingByteBuffer moves 4,194,304 appended plus 1,048,576 decoded bytes, encodes nothing, and takes 0.25 ms. End to end through runRecipeCommand is 0.26 ms with no output callback and 0.78 ms with one (the callback decoder is the work setEncoding already did). A 64-byte one-shot is 0.075 to 0.206 microseconds; retained storage reserves spare capacity and can exceed a string. No new polling, timers, subprocesses, wire fields or deadline changes."
+      },
+      "promotionCriteria": [
+        "Collect 100 consecutive CI passes or 14 days of soak history.",
+        "Exercise native Windows and Linux recipe output and cancellation."
+      ],
+      "knownGaps": [
+        "Synthetic output timings do not establish typical recipe prevalence, end-to-end provisioning gains or UI latency.",
+        "Retained storage reserves spare capacity and can use more memory than a string; CJK bytes can exceed UTF-16 storage. Tiny output is slower, and an oversized single chunk still copies its capped tail.",
+        "Malformed UTF-8 now yields a different tail than the old policy: replacement characters no longer inflate the byte count, so a malformed tail keeps more real output. No production override of the cap was found, and odd caps are clamped rather than coerced per chunk.",
+        "Live VM providers, SSH lifecycle journeys, and native Windows or Linux termination were not run."
+      ],
+      "demotionRule": "Keep experimental or demote if output differs, discarded bytes return, settled capture remains reachable, cancellation loses its tail, or the deterministic encoding budget regresses. Never weaken the oracle or increase retries to obtain a pass."
+    },
+    {
+      "id": "agent-session.spawn-workspace-trust",
+      "title": "Agent PTY spawns wait for a bounded workspace trust write",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "agent-session-runtime",
+      "layer": "cross-layer-unit",
+      "surfaces": [
+        "renderer PTY spawn builder",
+        "runtime PTY spawn builder",
+        "structured Codex chat create intent",
+        "agent workspace trust dispatcher",
+        "execution-host workspace trust writer (main and SSH relay)",
+        "SSH relay agent workspace trust"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["local", "ssh"],
+      "coverageNotes": "The actual renderer and runtime spawn-option builders with a mocked dispatcher, the spawn hook with a mocked dispatcher, the structured Codex create intent with a mocked dispatcher, the dispatcher with mocked preset writers and the real Claude config writer on a temp file, the execution-host writer and the relay spawn function with every real preset writer under a throwaway home, and the relay pty.spawn handler with a mocked trust function. Proves the builders await trust before returning, the fresh-launch and setting gates, the per-preset deadlines, that SSH launches hand every preset to the relay, and, for the agents that inherit trust from a home (Claude, Copilot, Qoder), the refusal of any stored path that is a root, a home or a folder above one, while Codex, Cursor and Antigravity still trust a home. No native PTY, agent CLI, live SSH host or WSL guest.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/main/src/main/agent-workspace-trust.ts"
+      ],
+      "invariant": "A fresh PTY launch of an agent with a trust preset pre-trusts its workspace root (for Codex, whose lookup keys on its start folder, the folder it starts in, including a floating terminal's) before the provider spawn, in both spawn builders, on the host that runs the agent: main for local and WSL launches, the SSH relay on its own disk for SSH launches. It never waits past the preset's deadline: 20 s for local Codex, the short budget for every other write, local or on the relay. A failed or abandoned write lets the launch proceed untrusted, so the agent asks. Restored or reattached panes, spawns with no launch command and the setting turned off are never trusted; for an agent whose trust on a home covers the folders below it (Claude, Copilot, Qoder), no writer stores a path that is a root, a home or a folder above one, and an unknown home writes nothing; Codex, Cursor and Antigravity, whose trust on a home covers only the home, trust it as they did before; and a WSL launch never writes the Windows home. A structured Codex chat, which has no PTY, pre-trusts its folder the same way when it is created, under the same setting.",
+      "oracle": "A trust write held pending keeps each builder from returning until it settles. A never-settling local Codex write resolves the dispatcher only after the long deadline; a never-settling local Claude write resolves after the short budget with a named warning. Rejected and throwing writes, and a throwing guard, resolve with a warning. Restored panes, spawns without a command and the setting off make no dispatcher call; Codex in a floating terminal or a workspace subfolder is trusted at that folder, and every other preset at the workspace root. Creating a structured Codex chat trusts its folder before launch preparation, and nothing with the setting off. An SSH launch returns the relay field for every preset and calls no writer, and the relay's pty.spawn starts no process until that launch's trust call settles. A home, a folder above one, a root, a symlink to a home and a missing path that climbs back to the home through `..` write no Claude, Copilot or Qoder trust file, on this machine and on the relay, and the home writes Codex, Cursor and Antigravity trust.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty/spawn-options-agent-workspace-trust.test.ts src/main/agent-workspace-trust-spawn.test.ts src/main/agent-workspace-trust.test.ts src/main/execution-host-workspace-trust.test.ts src/relay/agent-workspace-trust-spawn.test.ts src/relay/agent-workspace-trust-spawn-guard-failure.test.ts src/relay/pty-handler-agent-workspace-trust.test.ts src/main/runtime/orca-runtime-structured-agent-session-create-intent.test.ts"
+      ],
+      "testFiles": [
+        "src/main/ipc/pty/spawn-options-agent-workspace-trust.test.ts",
+        "src/main/agent-workspace-trust-spawn.test.ts",
+        "src/main/agent-workspace-trust.test.ts",
+        "src/main/execution-host-workspace-trust.test.ts",
+        "src/relay/agent-workspace-trust-spawn.test.ts",
+        "src/relay/agent-workspace-trust-spawn-guard-failure.test.ts",
+        "src/relay/pty-handler-agent-workspace-trust.test.ts",
+        "src/main/runtime/orca-runtime-structured-agent-session-create-intent.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/main/ipc/pty/spawn-options-agent-workspace-trust.test.ts",
+          "assertions": [
+            "trusts Codex in a floating terminal at the resolved folder it starts in",
+            "holds the spawn until the trust write settles",
+            "never re-runs trust for a restored pane or a spawn with no launch command"
+          ]
+        },
+        {
+          "file": "src/main/agent-workspace-trust-spawn.test.ts",
+          "assertions": [
+            "does nothing with the setting off",
+            "does nothing for a restored or reattached pane",
+            "trusts Codex in a floating terminal at the folder it starts in",
+            "trusts Codex at a subfolder it starts in, which its lookup keys on"
+          ]
+        },
+        {
+          "file": "src/main/agent-workspace-trust.test.ts",
+          "assertions": [
+            "contains a rejected or throwing write so the launch proceeds",
+            "gives only Codex the long deadline its shared config lane needs",
+            "gives a local Claude write a short budget, after which Claude asks",
+            "never pre-trusts %s for an agent that inherits trust from it",
+            "trusts the home folder for Codex, Cursor and Antigravity, whose trust there stays there",
+            "hands an SSH %s launch to the relay instead of writing anything here"
+          ]
+        },
+        {
+          "file": "src/main/execution-host-workspace-trust.test.ts",
+          "assertions": [
+            "writes no %s trust",
+            "guards exactly the agents that inherit trust from a home",
+            "trusts a home folder workspace for %s, whose trust there covers only the home",
+            "writes no %s trust when the host knows no home"
+          ]
+        },
+        {
+          "file": "src/relay/agent-workspace-trust-spawn.test.ts",
+          "assertions": [
+            "writes %s trust on the relay host's own disk",
+            "trusts the relay home for %s, whose trust there covers only the home",
+            "leaves Antigravity to ask, since its writer is unverified on SSH hosts"
+          ]
+        },
+        {
+          "file": "src/relay/agent-workspace-trust-spawn-guard-failure.test.ts",
+          "assertions": ["skips %s trust and never fails the spawn"]
+        },
+        {
+          "file": "src/relay/pty-handler-agent-workspace-trust.test.ts",
+          "assertions": [
+            "writes the launch's trust with its final env before the agent's process starts"
+          ]
+        },
+        {
+          "file": "src/main/runtime/orca-runtime-structured-agent-session-create-intent.test.ts",
+          "assertions": [
+            "pre-trusts the chat folder before launch preparation, as a Codex terminal launch does",
+            "writes nothing with the setting off, and still prepares the launch"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-29",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty/spawn-options-agent-workspace-trust.test.ts src/main/agent-workspace-trust-spawn.test.ts src/main/agent-workspace-trust.test.ts src/main/execution-host-workspace-trust.test.ts src/relay/agent-workspace-trust-spawn.test.ts src/relay/agent-workspace-trust-spawn-guard-failure.test.ts src/relay/pty-handler-agent-workspace-trust.test.ts src/main/runtime/orca-runtime-structured-agent-session-create-intent.test.ts",
+          "result": "passed",
+          "durationSeconds": 4.16,
+          "summary": "201 tests across eight suites pass, run through node_modules/.bin/vitest with a throwaway HOME. No native launch, PTY or live SSH host."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 10,
+        "scope": "Focused spawn-builder, hook, dispatcher, execution-host writer and relay suites; p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Local mocked evidence only; CI soak pending."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Each named case failed with its fix removed and passed restored: the builder's await turned into a fire-and-forget call fails the hold case; guarding every preset fails each Codex, Cursor and Antigravity home case, and guarding none fails each Claude, Copilot and Qoder home, root, symlink and `..` case; dropping the unknown-home rule fails every no-home case; the relay deriving only Claude from launchAgent fails each non-Claude relay case; the dispatcher handing only Claude to the relay fails each SSH preset case; dropping the relay's Antigravity return fails its case; letting the host writer's catch rethrow fails every guard-failure case; dropping resolve() from the guard's forms fails the missing `..` path case for every guarded preset; marking Codex as trusted at the workspace root, or a builder dropping the start folder, fails the Codex floating-terminal and subfolder cases; removing the relay handler's trust call, or not awaiting it, fails the relay handler case; removing the structured Codex create intent's trust call fails its pre-trust case, and dropping its setting check fails its setting-off case."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Plain shells and agents without a preset add no trust I/O; the hook returns after the preset check. A local Codex write is capped at 20 s and every other write, local or on the relay, at the short budget, each by one timer cleared on settlement. An SSH launch adds no round trip: the field rides the existing pty.spawn request. The deadline bounds the wait, not the write: an abandoned write still lands later. The local Claude writer reads and parses Claude's config synchronously on the main thread before its lock."
+      },
+      "knownGaps": [
+        "CI soak pending.",
+        "No live agent CLI, PTY, trust prompt, native Electron app, SSH host or WSL guest was exercised.",
+        "Abandoning a write at the deadline does not cancel it; a slow write can land after the agent already asked.",
+        "The deadline values are reasoned caps, not measured p95s.",
+        "Antigravity over SSH is not written on the relay (its writer is unverified there), so it still asks."
+      ],
+      "promotionCriteria": [
+        "Retain the hold, deadline and home or root red/green evidence; obtain native platform and SSH evidence and a CI soak before promotion."
+      ],
+      "demotionRule": "Remain experimental until repeated independent or CI evidence; investigate ordering or unbounded-wait regressions without weakening the hold or deadline assertions."
+    },
+    {
+      "id": "settings.general-section-lifetime",
+      "title": "General settings search preserves matching section state",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "renderer-settings",
+      "layer": "renderer-unit",
+      "surfaces": [
+        "General settings search",
+        "app version and remote update display",
+        "autosave settings draft"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local", "remote-runtime", "ssh", "wsl"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": [],
+      "coverageNotes": "Actual GeneralPane, update/version and remote-status components with mocked store/API; actual autosave form. Windows runtime on/off simulated. No physical updater, paired host, settings write or native input.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/main/src/renderer/src/components/settings/GeneralPane.tsx"
+      ],
+      "invariant": "A matching General settings section retains its owner and state as preceding search results disappear; an actually removed section releases its owner and reloads when shown again.",
+      "oracle": "Across 14 matching searches the Updates section keeps the same DOM node and the version-read and remote-refresh counts do not grow, instead of six each. Store-published remote update state still reaches the retained section. Explicit refresh and genuine hide/reopen still read; drafts yield to externally changed saved settings; a removed owner cannot publish its late version.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/settings/GeneralPane.section-lifetime.test.tsx"
+      ],
+      "testFiles": ["src/renderer/src/components/settings/GeneralPane.section-lifetime.test.tsx"],
+      "assertionRefs": [
+        {
+          "file": "src/renderer/src/components/settings/GeneralPane.section-lifetime.test.tsx",
+          "assertions": [
+            "keeps showing store-published remote update state without a remount",
+            "keeps explicit remote refresh and true hide/reopen reads",
+            "preserves an autosave draft until external settings change or the section hides",
+            "does not publish a version result from a genuinely unmounted section"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-26",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/settings/GeneralPane.section-lifetime.test.tsx",
+          "result": "passed",
+          "durationSeconds": 1.89,
+          "summary": "7 tests/1 suite pass after the shared SettingsSectionStack adoption. Read-count oracles restated as node identity plus non-growing counts; original main fails both retained-section cases, the draft, the release-picker reveal and the late-version publish."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 10,
+        "scope": "Focused renderer-unit suites, p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Author and independent local evidence only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Candidate permanent6pass versus original4fail2controls. Additional independent pending-version/error-context/store-refresh3pass versus original2fail1control."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Actual version and remote-refresh admissions 6 to 1 across 14 matching queries, which also stops one paired-host update probe per keystroke. Section map now lives in the shared SettingsSectionStack; no added poll, cache, listener or subprocess. No packaged CPU/frame/heap claim."
+      },
+      "knownGaps": [
+        "CI soak pending.",
+        "Physical updater/install, local/daemon PTYs and mobile are unaffected; no execution-host routing, process authority or wire change.",
+        "Native Linux/Windows, SSH/WSL and paired remote-runtime behavior not exercised; synthetic runtime flags cover renderer branches only.",
+        "Matching search no longer incidentally refreshes version/remote-status/CLI discovery; explicit checks and real hide/reopen remain. The installed version cannot change in-process and remote update entries are store-published, so neither goes stale without a signal.",
+        "Retained drafts, release reveal and pending/error context last until a real hide or their own transition; programmatic-query draft test does not reproduce ordinary mouse-search blur/commit.",
+        "Hidden Electron actual-form proof is separate; no packaged latency, heap or native focus evidence."
+      ],
+      "promotionCriteria": [
+        "Retain count, draft, owner cleanup and refresh controls; collect CI soak and relevant full-app/provider evidence before promotion."
+      ],
+      "demotionRule": "Keep experimental until soak; investigate state or cleanup regressions without weakening owner, read-count or draft assertions."
+    },
+    {
+      "id": "settings.accounts-section-lifetime",
+      "title": "Accounts search preserves matching account section owners",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "renderer-settings",
+      "layer": "renderer-unit",
+      "surfaces": [
+        "Accounts settings search",
+        "Grok and Cursor account status",
+        "Codex pending sign-in link"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local", "remote-runtime", "ssh", "wsl"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": [],
+      "coverageNotes": "Actual AccountsPane, Grok, Cursor and Codex login components; synthetic APIs/store with Windows account support enabled/disabled. No real account, keychain or provider action.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/main/src/renderer/src/components/settings/AccountsPane.tsx"
+      ],
+      "invariant": "Matching sections retain their owners as earlier search results disappear; genuine removal releases the Codex subscription and reopens fresh status reads.",
+      "oracle": "Across nine matching Grok, ten matching Cursor and eleven matching Codex queries each matched section keeps the same DOM node and its status-read, watcher and subscription counts do not grow, against four to six reads each before. Explicit refresh, store-published usage updates, pushed login URLs and genuine removal all still reach the retained section.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/settings/AccountsPane.section-lifetime.test.tsx"
+      ],
+      "testFiles": ["src/renderer/src/components/settings/AccountsPane.section-lifetime.test.tsx"],
+      "assertionRefs": [
+        {
+          "file": "src/renderer/src/components/settings/AccountsPane.section-lifetime.test.tsx",
+          "assertions": [
+            "preserves explicit Grok refresh and real hide/reopen status reads",
+            "keeps the login subscription until Codex genuinely hides",
+            "keeps Cursor refresh driven by usage updates and genuine reopen"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-26",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/settings/AccountsPane.section-lifetime.test.tsx",
+          "result": "passed",
+          "durationSeconds": 1.84,
+          "summary": "10 tests/1 suite pass after the shared SettingsSectionStack adoption. Read-count oracles restated as node identity plus non-growing counts; original main fails the three retained-section cases and the retained Codex subscription, and passes the explicit-refresh, usage-driven and genuine-removal controls."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 10,
+        "scope": "Focused renderer-unit suites, p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Author and independent local evidence only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Candidate ten pass; current-main original seven fail and three controls pass."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Actual renderer status-read/subscription admissions counted; the section map now lives in the shared SettingsSectionStack and no cache, poll, listener or process is added. No CPU, latency or heap claim. Matching sections retain local state and lose only the incidental search-driven refresh that duplicated an existing subscription."
+      },
+      "knownGaps": [
+        "CI soak pending.",
+        "No native Linux/Windows or live SSH/WSL/paired provider behavior; platform flags are simulated.",
+        "Hidden Electron Grok proof uses the original audit baseline and synthetic status; current-main Cursor addition has unit evidence only.",
+        "Matching search no longer incidentally refreshes Grok/Cursor status or pending Codex URLs. Every one of those surfaces is store-subscribed or push-subscribed, so the retained section still tracks usage updates, pushed login URLs, explicit refresh and true hide/reopen; there is no bounded automatic freshness deadline and none of them relied on one before.",
+        "Child drafts, errors, copied feedback and timers remain until their own transition or real removal."
+      ],
+      "promotionCriteria": [
+        "Retain read/subscription counts and genuine-removal controls; collect CI soak and relevant full-app provider evidence."
+      ],
+      "demotionRule": "Keep experimental until soak; investigate owner and refresh regressions without weakening assertions or adding retries."
+    },
     {
       "id": "agent-session.journal-streaming-replay",
       "title": "Journal replay bounds obsolete revision memory without changing recovery",
@@ -82,6 +704,81 @@
       "promotionCriteria": ["Retain red/green heap and value assertions and complete CI soak."],
       "demotionRule": "Keep experimental until cross-platform and soak evidence; investigate failures without weakening content or memory assertions."
     },
+    {
+      "id": "relay-performance.ai-vault-ready-ownership",
+      "title": "AI Vault readiness releases canceled request owners",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "desktop-runtime",
+      "layer": "relay-service-client-contract",
+      "surfaces": ["AI Vault sidecar startup", "SSH title lookup cancellation"],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["ssh"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["ssh"],
+      "coverageNotes": "Production relay client with synthetic child events and real forced GC. Native remote process execution and live SSH remain untested. Local/daemon PTY, WSL shell selection and mobile terminal stream are unaffected.",
+      "motivatingLinks": ["https://github.com/stablyai/orca/issues/23024"],
+      "invariant": "Canceled unsent calls release request payloads before sidecar readiness, disposal releases all pending readiness owners, and live calls still start exactly once through cancellation and startup failures.",
+      "oracle": "Hold ready and cancel 1,000 title calls; require zero retained request arrays after GC and one child. Dispose before ready and require uncanceled payload collection and zero timers. Race ready with abort and spawn failure with a second lane; require only live calls delivered and successful results. Preserve existing restart and cancel-ack behavior.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/relay/ai-vault-service-ready-retention.test.ts src/relay/ai-vault-service-client.test.ts src/relay/ai-vault-service-restart-policy.test.ts src/relay/ai-vault-service-spawn.test.ts src/relay/ai-vault-handler.test.ts src/shared/promise-settlement-waiters.test.ts"
+      ],
+      "testFiles": [
+        "src/relay/ai-vault-service-ready-retention.test.ts",
+        "src/relay/ai-vault-service-client.test.ts",
+        "src/relay/ai-vault-service-restart-policy.test.ts",
+        "src/relay/ai-vault-service-spawn.test.ts",
+        "src/relay/ai-vault-handler.test.ts",
+        "src/shared/promise-settlement-waiters.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/relay/ai-vault-service-ready-retention.test.ts",
+          "assertions": [
+            "releases canceled request payloads while readiness remains pending",
+            "releases uncanceled readiness payloads when the client is disposed",
+            "does not send a call canceled in the turn that readiness arrives",
+            "retries an unsent lane after spawn fails while the other lane starts a child"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-25",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/relay/ai-vault-service-ready-retention.test.ts src/relay/ai-vault-service-client.test.ts src/relay/ai-vault-service-restart-policy.test.ts src/relay/ai-vault-service-spawn.test.ts src/relay/ai-vault-handler.test.ts src/shared/promise-settlement-waiters.test.ts",
+          "result": "passed",
+          "durationSeconds": 0.616,
+          "summary": "38 tests across six suites passed, including real forced-GC retention and startup/cancel races."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 10,
+        "scope": "focused Node contract tests with forced GC"
+      },
+      "flakeHistory": {
+        "status": "unknown",
+        "evidence": "Local runs passed; CI/soak history not collected."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Baseline retains all 1,000 canceled arrays and the disposed uncanceled payload; both permanent regressions fail there and pass after the fix. Independent spawn-failure race failed on the initial prototype, passed on baseline and passes after correction."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Synthetic cold-start churn retains 1,000 to zero canceled arrays; incremental heap 34,771,464 to 492,504 bytes. One shared startup reaction, no new polling, timers, process starts, timeout changes or wire fields."
+      },
+      "promotionCriteria": [
+        "Collect 100 consecutive CI passes or 14 days of soak history.",
+        "Exercise real SSH sidecar cancellation and restart on Linux and Windows."
+      ],
+      "knownGaps": [
+        "Synthetic churn does not measure typical user frequency or UI latency.",
+        "Physical sidecar/native Windows/Linux and live SSH paths were not exercised."
+      ],
+      "demotionRule": "Keep experimental or demote if canceled payloads survive GC, disposal retains startup owners, or live lanes stall/duplicate after startup failure."
+    },
     {
       "id": "runtime.connection-owned-host-status",
       "title": "Host status recovers with its owning connection",
@@ -251,7 +948,7 @@
       "invariant": "One structured-send operation id causes at most one provider dispatch. A recorded or transport-ambiguous send reuses that id across retry, caller reconnect, client remount, and journal recovery; only a terminal rejection may rotate to a first delivery.",
       "oracle": "Inject adapter acknowledgement loss, RPC response loss, caller replacement, logical-client close after response, auth recovery with a written request, missing journal submissions, legacy pending rows, stale fences, operation expiry, mobile remount, and durable-journal capacity. Assert one provider dispatch or one operation id for every ambiguous retry, fresh identity only after rejection, and no eviction of ambiguous mobile ids.",
       "commands": [
-        "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session-operation-ledger.test.ts src/shared/structured-agent-session-send-disposition.test.ts src/main/runtime/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/main/runtime/orchestration/structured-pointer-operation-id.test.ts src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/components/native-chat/NativeChatStructuredSession.transport-probe.test.tsx src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts",
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session-operation-ledger.test.ts src/shared/structured-agent-session-send-disposition.test.ts src/main/runtime/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/main/runtime/orchestration/structured-pointer-operation-id.test.ts src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts",
         "ORCA_BACKGROUND_LAUNCH=1 pnpm --dir mobile test ../mobile/src/session/mobile-native-chat-image-attachment.test.ts ../mobile/src/session/use-mobile-native-chat-image-attachments.test.ts ../mobile/src/session/mobile-structured-send-operation-journal.test.ts ../mobile/src/session/mobile-structured-session-operation-retention.test.ts ../mobile/src/session/mobile-structured-send-delivery.test.ts ../mobile/src/session/use-mobile-structured-agent-session-send.test.tsx ../mobile/src/session/use-mobile-structured-agent-session.test.tsx ../mobile/src/transport/mobile-relay-rpc-session.test.ts ../mobile/src/transport/rpc-client-delivery-ambiguity.test.ts ../mobile/src/transport/stable-logical-rpc-client.test.ts"
       ],
       "testFiles": [
@@ -265,7 +962,6 @@
         "src/main/runtime/orchestration/structured-pointer-operation-id.test.ts",
         "src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx",
         "src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx",
-        "src/renderer/src/components/native-chat/NativeChatStructuredSession.transport-probe.test.tsx",
         "src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.test.tsx",
         "src/renderer/src/lib/launch-structured-agent-session.test.ts",
         "mobile/src/session/mobile-native-chat-image-attachment.test.ts",
@@ -341,7 +1037,7 @@
           "date": "2026-09-12",
           "runner": "local",
           "platform": "macos",
-          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session-operation-ledger.test.ts src/shared/structured-agent-session-send-disposition.test.ts src/main/runtime/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/main/runtime/orchestration/structured-pointer-operation-id.test.ts src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/components/native-chat/NativeChatStructuredSession.transport-probe.test.tsx src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session-operation-ledger.test.ts src/shared/structured-agent-session-send-disposition.test.ts src/main/runtime/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/main/runtime/orchestration/structured-pointer-operation-id.test.ts src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts",
           "result": "passed",
           "durationSeconds": 22.1,
           "summary": "Thirteen focused host, shared, renderer, and orchestration files passed 148 tests."
@@ -8164,7 +8860,7 @@
         "Windows ConPTY, SSH-hosted PTYs, app-quit killAll, and daemon dispose retain foreground-tree-only teardown.",
         "A process born in the capture second is SIGTERMed but not SIGKILLed because ps cannot prove its recycled-PID identity.",
         "A descendant orphaned before or during root ownership loss requires the separate crash-orphan sweep and is not recovered from a stale kill-time snapshot.",
-        "recordTerminalSurfaceRetirement advances the INCOMING session's terminal topology revision, so a tombstoned close whose write carries a revision at or below the store's own is rebased away instead of persisting. Pre-existing for every repo already past revision 0 and unchanged by the host-admitted membership fix, which only makes more repos reach that state sooner; the authoritative close path (persistTerminalSurfaceRetirements) computes from the store's session and is unaffected. Known, unaddressed, and deliberately out of scope here: the safe correction is per-tab rather than per-worktree rebase arbitration, because raising the incoming revision wholesale would re-open the host-tab loss whenever a close coincides with a host create.",
+        "recordTerminalSurfaceRetirement advances the INCOMING session's terminal topology revision, so a tombstoned close whose write carries a revision at or below the store's own is rebased away instead of persisting. Pre-existing for every repo already past revision 0 and unchanged by the host-admitted membership fix, which only makes more repos reach that state sooner; the authoritative close path (stageTerminalSurfaceRetirements) computes from the store's session and is unaffected. Known, unaddressed, and deliberately out of scope here: the safe correction is per-tab rather than per-worktree rebase arbitration, because raising the incoming revision wholesale would re-open the host-tab loss whenever a close coincides with a host create.",
         "The SSH relay reattach binding (src/main/ssh/ssh-relay-session.ts persistPtyBinding) is NOT flagged host-admitted, so a lease rebind that has to mint a missing tab raises no fence. It rebinds an existing lease rather than admitting a new surface, so it is believed not to need one, but that was not established either way. Known, unaddressed, and deliberately out of scope here.",
         "The host-created retention journey is macOS-local; the reported incident was on a physical Windows host, which we did not run against."
       ],
@@ -8925,6 +9621,77 @@
       ],
       "demotionRule": "Demote if discovery and launch can resolve different authorities, a scoped Floating probe overwrites the active-project inventory, or local context selection adds recurring scans or retained in-flight entries."
     },
+    {
+      "id": "agent-session.opencode2-hook-cleanup",
+      "title": "OpenCode 2 setup releases acquired hook owners after failure",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "agent-integrations",
+      "layer": "main-unit",
+      "surfaces": ["OpenCode 2 generated plugin setup and unload"],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local", "ssh", "wsl", "remote-runtime"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": [],
+      "coverageNotes": "Actual generated wrapper with synthetic factories, prompt registrations and event iterators. Supporting generated-module tests cover both OpenCode variants; no native provider execution.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/main/src/main/opencode2/status-plugin-setup-source.ts"
+      ],
+      "invariant": "After a hook factory is acquired, prompt registration failure or a throwing/rejecting prompt disposer cannot skip hook disposal. Unload waits for in-flight event delivery before disposing the hook factory and remains fail-open.",
+      "oracle": "Fault-injected setup and unload each call hook disposal once. The ordered control completes delivery and subscription before hook cleanup. Normal unload disposes both owners once.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/opencode2/status-plugin-setup-lifetime.test.ts"
+      ],
+      "testFiles": ["src/main/opencode2/status-plugin-setup-lifetime.test.ts"],
+      "assertionRefs": [
+        {
+          "file": "src/main/opencode2/status-plugin-setup-lifetime.test.ts",
+          "assertions": [
+            "disposes the factory after prompt registration %s",
+            "disposes the factory after prompt cleanup %s",
+            "waits for in-flight delivery before factory cleanup after a prompt cleanup failure"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-26",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/opencode2/status-plugin-setup-lifetime.test.ts",
+          "result": "passed",
+          "durationSeconds": 0.125,
+          "summary": "10 permanent cases pass; baseline seven fail and three controls pass. Fresh-main run including existing setup/lineage suites: 59 pass."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 10,
+        "scope": "Synthetic wrapper unit suite; p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Local deterministic validation only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Baseline seven failures and three controls; candidate ten passed. Hook disposal after prompt registration/cleanup failure changes from zero to one."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "No new polling, scans, subprocesses or successful-startup awaits. Failure paths now await the existing hook disposer; teardown retains event-delivery ordering. No latency or heap improvement claimed."
+      },
+      "knownGaps": [
+        "Native Linux/Windows, SSH/WSL and remote-runtime plugin execution not run.",
+        "Local/daemon PTY and mobile/relay transport behavior is unaffected.",
+        "Pending non-abortable registration, event delivery or disposal promises can still delay cleanup; no timeout or cancellation redesign.",
+        "Malformed form normalization remains a separate defect.",
+        "CI soak pending."
+      ],
+      "promotionCriteria": [
+        "Retain cleanup-count and delivery-order oracles; add provider/platform execution and CI soak."
+      ],
+      "demotionRule": "Keep experimental until soak; investigate failures without weakening cleanup or delivery-order assertions."
+    },
     {
       "id": "agent-session.provider-ownership",
       "title": "Provider sessions are resumed once per workspace ownership claim",
@@ -9937,6 +10704,83 @@
       ],
       "demotionRule": "Cannot promote without deterministic oracle and runtime history."
     },
+    {
+      "id": "worktree-listing.execution-host-ownership",
+      "title": "Worktree listings keep canonical SSH ownership and mutation fencing",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "worktree-listing",
+      "layer": "main-unit",
+      "surfaces": [
+        "detected worktree listing",
+        "known worktree catalog",
+        "worktree list and listAll"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local", "ssh", "wsl", "remote-runtime"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": [],
+      "coverageNotes": "Actual handlers, hydration, ownership, scan cache and provider authority with mocked providers/Git/store/IPC. Independent controls use real lineage pruning and an in-memory map. No physical SSH or native Git.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/main/src/main/ipc/worktrees/listing/register-worktree-catalog-handlers.ts"
+      ],
+      "invariant": "Canonical SSH listings use the owning provider and cannot register remote roots locally or reuse local cache authority. A listing overtaken by a mutation or root revision cannot prune newer lineage.",
+      "oracle": "Both SSH owner spellings reach five read forms without local Git/root registration; disconnection and authority rotation invalidate detected answers. Both catalog channels suppress side effects after mutation/root revision. Two direct canonical scans require two provider listings instead of one cached listing.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/worktrees-canonical-ssh-listing.test.ts"
+      ],
+      "testFiles": ["src/main/ipc/worktrees-canonical-ssh-listing.test.ts"],
+      "assertionRefs": [
+        {
+          "file": "src/main/ipc/worktrees-canonical-ssh-listing.test.ts",
+          "assertions": [
+            "keeps %s on the direct SSH boundary",
+            "reports disconnection without replaying an authoritative local-cache answer",
+            "preserves lineage when %s is overtaken by a %s"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-26",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/worktrees-canonical-ssh-listing.test.ts",
+          "result": "passed",
+          "durationSeconds": 0.884,
+          "summary": "26 permanent cases pass on isolated current main. Separate independent run40pass;8current-main related suites61pass. Author64scoped pass on shared checkout. Original permanent13fail/13controls. Initial candidate lineage regression repaired and revalidated."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 10,
+        "scope": "Focused mocked-provider unit suites; p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Local author/independent/current-main validation only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Original permanent13fail13controls; repaired26pass. Initial candidate lost actual lineage in2independent races; repaired40pass includes these controls."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "No added polling or concurrency; listAll remains bounded at8. Canonical SSH roots avoid local cache/registration. Trade-off:2connected direct scans use2provider listings instead of1cached result. No CPU/latency/heap improvement claim."
+      },
+      "knownGaps": [
+        "CI soak pending.",
+        "Local and daemon PTY, terminal output and mobile wire are unaffected.",
+        "Native Linux/Windows, live SSH/WSL and paired runtime-host integrations not executed. Generic runtime rows retain refusal.",
+        "Catalog list/listAll may still return a superseded plain-array snapshot; this gate prevents stale lineage side effects, not all response staleness.",
+        "Canonical forgetRemovedForExecutionHost remains outside scope; no new destructive authorization.",
+        "Filesystem classifier and registry defects are separate repairs; this gate only prevents listing-induced local-root admission.",
+        "Canonical SSH bypasses the improper5second local cache, increasing provider calls. No replacement cache or physical cancellation claim."
+      ],
+      "promotionCriteria": [
+        "Retain exact-owner, no-local-I/O, cache-admission and overtaken-lineage controls; collect CI soak and real provider coverage."
+      ],
+      "demotionRule": "Keep experimental until soak; investigate host/lineage regressions without weakening ownership assertions or adding blind retries."
+    },
     {
       "id": "xterm-addon.boundary-containment",
       "title": "xterm addon failures stay pane-scoped and input survives",
@@ -11513,7 +12357,7 @@
         "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty-pending-projection-admissions.test.ts src/main/ipc/ssh-pty-legacy-projection.test.ts src/main/ipc/ssh-pty-model-admission.test.ts --reporter=dot",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-path-candidate-history.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/orca-runtime-tail-wait-memo.test.ts",
-        "pnpm exec vitest run --config config/vitest.config.ts src/main/providers/ssh-pty-provider.test.ts src/main/providers/ssh-pty-source-delivery-ledger.test.ts src/main/ssh/ssh-pty-retired-source-deliveries.test.ts src/main/ssh/ssh-relay-session.test.ts src/main/ssh/ssh-relay-session-data-delivery.test.ts src/main/ssh/ssh-relay-session-recovery-races.test.ts src/main/ssh/ssh-relay-session-incarnation.test.ts src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts src/main/ssh/ssh-relay-session-terminal-error.test.ts src/main/ssh/ssh-pty-recovery-retention-budget.test.ts src/main/ssh/relay-protocol-backpressure.test.ts src/relay/protocol-backpressure.test.ts src/relay/pty-source-credit-ledger.test.ts src/relay/pty-source-credit-scheduler.test.ts src/relay/relay-pty-source-publication.test.ts src/relay/ssh-pty-source-credit-adapter.test.ts --reporter=dot",
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/providers/ssh-pty-provider.test.ts src/main/providers/ssh-pty-source-delivery-ledger.test.ts src/main/ssh/ssh-pty-retired-source-deliveries.test.ts src/main/ssh/ssh-relay-session.test.ts src/main/ssh/ssh-relay-session-data-delivery.test.ts src/main/ssh/ssh-relay-session-recovery-races.test.ts src/main/ssh/ssh-relay-session-incarnation.test.ts src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts src/main/ssh/ssh-relay-session-terminal-error.test.ts src/main/ssh/ssh-pty-recovery-retention-budget.test.ts src/relay/protocol-backpressure.test.ts src/relay/pty-source-credit-ledger.test.ts src/relay/pty-source-credit-scheduler.test.ts src/relay/relay-pty-source-publication.test.ts src/relay/ssh-pty-source-credit-adapter.test.ts --reporter=dot",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/ssh-pty-model-admission.test.ts src/main/ipc/ssh-pty-output-model-migration.test.ts src/main/ssh/ssh-relay-session-model-migration.test.ts --reporter=dot",
         "pnpm exec vitest run --config config/vitest.config.ts src/relay/git-response-stream-ownership.test.ts src/relay/pty-handler-output-streaming.test.ts --reporter=dot",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/providers/ssh-pty-notification-routing.test.ts src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts src/main/providers/ssh-pty-provider-exit-race.test.ts src/main/providers/ssh-pty-provider-reattach-incarnation.test.ts --reporter=dot",
@@ -11560,7 +12404,6 @@
         "src/main/ssh/ssh-relay-session-terminal-error.test.ts",
         "src/main/ssh/ssh-pty-recovery-retention-budget.test.ts",
         "src/main/ssh/ssh-pty-retired-source-deliveries.test.ts",
-        "src/main/ssh/relay-protocol-backpressure.test.ts",
         "src/relay/protocol-backpressure.test.ts",
         "src/relay/git-response-stream-ownership.test.ts",
         "src/relay/pty-handler-output-streaming.test.ts",
@@ -11777,13 +12620,6 @@
             "invalid-checkpoint cancellation retains the exact delivery until restore response settlement, then retry mints a fresh activation and emits one live source frame"
           ]
         },
-        {
-          "file": "src/main/ssh/relay-protocol-backpressure.test.ts",
-          "assertions": [
-            "main SSH decoder accepts one maximum frame plus 1 MiB partial input and rejects one extra byte",
-            "a throwing continuation clears retained input, releases one pause epoch, and publishes one typed ownership error"
-          ]
-        },
         {
           "file": "src/relay/protocol-backpressure.test.ts",
           "assertions": [
@@ -11972,7 +12808,7 @@
           "date": "2026-07-29",
           "runner": "local",
           "platform": "macos",
-          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/providers/ssh-pty-provider.test.ts src/main/providers/ssh-pty-source-delivery-ledger.test.ts src/main/ssh/ssh-pty-retired-source-deliveries.test.ts src/main/ssh/ssh-relay-session.test.ts src/main/ssh/ssh-relay-session-data-delivery.test.ts src/main/ssh/ssh-relay-session-recovery-races.test.ts src/main/ssh/ssh-relay-session-incarnation.test.ts src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts src/main/ssh/ssh-relay-session-terminal-error.test.ts src/main/ssh/ssh-pty-recovery-retention-budget.test.ts src/main/ssh/relay-protocol-backpressure.test.ts src/relay/protocol-backpressure.test.ts src/relay/pty-source-credit-ledger.test.ts src/relay/pty-source-credit-scheduler.test.ts src/relay/relay-pty-source-publication.test.ts src/relay/ssh-pty-source-credit-adapter.test.ts --reporter=dot",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/providers/ssh-pty-provider.test.ts src/main/providers/ssh-pty-source-delivery-ledger.test.ts src/main/ssh/ssh-pty-retired-source-deliveries.test.ts src/main/ssh/ssh-relay-session.test.ts src/main/ssh/ssh-relay-session-data-delivery.test.ts src/main/ssh/ssh-relay-session-recovery-races.test.ts src/main/ssh/ssh-relay-session-incarnation.test.ts src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts src/main/ssh/ssh-relay-session-terminal-error.test.ts src/main/ssh/ssh-pty-recovery-retention-budget.test.ts src/relay/protocol-backpressure.test.ts src/relay/pty-source-credit-ledger.test.ts src/relay/pty-source-credit-scheduler.test.ts src/relay/relay-pty-source-publication.test.ts src/relay/ssh-pty-source-credit-adapter.test.ts --reporter=dot",
           "result": "passed",
           "durationSeconds": 2.24,
           "summary": "Sixteen deterministic SSH relay/session/source/decoder files passed 192 tests, including exit-sealed private recovery, retained stale-transfer cancellation authority, exact private-frame proof watermarks, one retirement record across 10,000 same-PTY token rotations, stale-owner fallback, and scheduler rejection isolation; no live topology was exercised."
@@ -14661,7 +15497,7 @@
       "oracle": "Seed status, dispatch, and worker_done rows across direct-handle and canonical Run recipients in an isolated DB. Compare pointer count, RPC and built-CLI check output, direct SQLite rows, unread/peek/all/type filters, concurrent pollers, fixed Delivery IDs, explicit acknowledgment, restart, filtered check --wait, and coordinator remint. Route a 125-row old-handle backlog, inject a commit without notification, and require startup repair. Exercise duplicate Run/Dispatch owners, stale panes, 50-row pages, cancellation, lifecycle fencing, and absent PTYs. Drop a federation ACK, reconnect/restart v1/v2 peers, and require stable import plus no duplicate read-row wake. Hold a healthy SSH write past five seconds but below the 60-second settlement deadline, then distinguish the three settlement outcomes end to end: only a proven refusal releases the reservation and drains a delivery parked behind the watermark; a dropped in-flight settlement must surface as unverifiable with bytes handed to the transport, preserve the durable write-attempted reservation, and emit no duplicate pointer after restart; a settled write that throws mid-pointer is unverifiable, not a refusal; and an Enter whose settlement is lost stays at enter-attempted so restart emits no second Enter. Install the production PTY controller and verify that it routes settled writes through the owning provider and refuses before any byte when the routed provider cannot settle. Census every production PTY provider class and reject a settlement synthesized from the fire-and-forget write.",
       "commands": [
         "pnpm run build:cli && pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-message-delivery-identity.test.ts --reporter=dot --testTimeout=5000",
-        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-mailbox-routing-races.test.ts src/main/runtime/orchestration-mailbox-notification-consistency.test.ts src/main/runtime/orchestration-mailbox-detached-routing.test.ts src/main/runtime/orchestration-mailbox-transport-settlement.test.ts src/main/ipc/pty-controller-ownership-routing.test.ts src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/orchestration/formatter.test.ts src/main/providers/ssh-pty-provider.test.ts src/main/providers/ssh-pty-write.test.ts src/main/providers/settled-pty-writer-census.test.ts src/main/runtime/orchestration/mailbox-pointer-stage.test.ts src/main/daemon/client.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts",
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-mailbox-routing-races.test.ts src/main/runtime/orchestration-mailbox-notification-consistency.test.ts src/main/runtime/orchestration-mailbox-detached-routing.test.ts src/main/runtime/orchestration-mailbox-transport-settlement.test.ts src/main/ipc/pty-controller-ownership-routing.test.ts src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/orchestration/formatter.test.ts src/main/providers/ssh-pty-provider.test.ts src/main/providers/ssh-pty-write.test.ts src/main/runtime/orchestration/mailbox-pointer-stage.test.ts src/main/daemon/client.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/terminal-send-stale-leaf-liveness.test.ts src/main/runtime/rpc/methods/orchestration/runs/runs.test.ts src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/federation-sync.test.ts src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts --reporter=dot"
       ],
@@ -14678,7 +15514,6 @@
         "src/main/runtime/orchestration/formatter.test.ts",
         "src/main/providers/ssh-pty-provider.test.ts",
         "src/main/providers/ssh-pty-write.test.ts",
-        "src/main/providers/settled-pty-writer-census.test.ts",
         "src/main/runtime/orchestration/mailbox-pointer-stage.test.ts",
         "src/main/daemon/client.test.ts",
         "src/main/daemon/daemon-pty-router.test.ts",
@@ -14780,13 +15615,6 @@
           "file": "src/main/runtime/orchestration/mailbox-pointer-stage.test.ts",
           "assertions": ["a refused pointer write drains a delivery parked behind its watermark"]
         },
-        {
-          "file": "src/main/providers/settled-pty-writer-census.test.ts",
-          "assertions": [
-            "every production IPtyProvider class exposes a settled writer",
-            "no settled writer synthesizes its settlement from the fire-and-forget write"
-          ]
-        },
         {
           "file": "src/main/ipc/pty-controller-ownership-routing.test.ts",
           "assertions": [
@@ -14826,7 +15654,7 @@
           "date": "2026-09-05",
           "runner": "local",
           "platform": "macos",
-          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-mailbox-routing-races.test.ts src/main/runtime/orchestration-mailbox-notification-consistency.test.ts src/main/runtime/orchestration-mailbox-detached-routing.test.ts src/main/runtime/orchestration-mailbox-transport-settlement.test.ts src/main/ipc/pty-controller-ownership-routing.test.ts src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/orchestration/formatter.test.ts src/main/providers/ssh-pty-provider.test.ts src/main/providers/ssh-pty-write.test.ts src/main/providers/settled-pty-writer-census.test.ts src/main/runtime/orchestration/mailbox-pointer-stage.test.ts src/main/daemon/client.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-mailbox-routing-races.test.ts src/main/runtime/orchestration-mailbox-notification-consistency.test.ts src/main/runtime/orchestration-mailbox-detached-routing.test.ts src/main/runtime/orchestration-mailbox-transport-settlement.test.ts src/main/ipc/pty-controller-ownership-routing.test.ts src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/orchestration/formatter.test.ts src/main/providers/ssh-pty-provider.test.ts src/main/providers/ssh-pty-write.test.ts src/main/runtime/orchestration/mailbox-pointer-stage.test.ts src/main/daemon/client.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts",
           "result": "passed",
           "durationSeconds": 4.73,
           "summary": "267 tests passed after the pointer-write path moved to the three-valued WriteSettlement union. New coverage: a dropped in-flight SSH settlement reaches the stager as unverifiable with bytes handed to the transport, a settled write that throws mid-pointer preserves the write-attempted reservation, an Enter whose settlement is lost stays at enter-attempted with no second Enter after restart, a refusal releases the reservation and drains a delivery parked behind its watermark, the production controller refuses before any byte when the routed provider cannot settle, and a census pins the five production IPtyProvider classes and rejects a settlement synthesized from the fire-and-forget write. Each new assertion was verified red against the pre-fix shape."
@@ -14835,7 +15663,7 @@
           "date": "2026-08-13",
           "runner": "local",
           "platform": "macos",
-          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-mailbox-routing-races.test.ts src/main/runtime/orchestration-mailbox-notification-consistency.test.ts src/main/runtime/orchestration-mailbox-detached-routing.test.ts src/main/runtime/orchestration-mailbox-transport-settlement.test.ts src/main/ipc/pty-controller-ownership-routing.test.ts src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/orchestration/formatter.test.ts src/main/providers/ssh-pty-provider.test.ts src/main/providers/ssh-pty-write.test.ts src/main/providers/settled-pty-writer-census.test.ts src/main/runtime/orchestration/mailbox-pointer-stage.test.ts src/main/daemon/client.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-mailbox-routing-races.test.ts src/main/runtime/orchestration-mailbox-notification-consistency.test.ts src/main/runtime/orchestration-mailbox-detached-routing.test.ts src/main/runtime/orchestration-mailbox-transport-settlement.test.ts src/main/ipc/pty-controller-ownership-routing.test.ts src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/orchestration/formatter.test.ts src/main/providers/ssh-pty-provider.test.ts src/main/providers/ssh-pty-write.test.ts src/main/runtime/orchestration/mailbox-pointer-stage.test.ts src/main/daemon/client.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts",
           "result": "passed",
           "durationSeconds": 8.22,
           "summary": "245 tests passed across mailbox identity, durable coordinator-handle migration, insertion-time canonicalization, duplicate-free 51-row ownership branch caps, unrestricted reservation merging, direct and Dispatch pointer suppression, persisted reconciliation, 50-row paging and filtered waits, cross-PTY serialization, lifecycle fencing, bounded daemon and SSH transport settlement, outstanding Deliveries, reminted Dispatch ownership, acknowledgment, cancellation, and bounded pane lookup."
@@ -17477,6 +18305,86 @@
       ],
       "demotionRule": "Demote or quarantine if the gate flakes once without a product bug or harness bug filed to the owner."
     },
+    {
+      "id": "runtime-events.renderer-subscription-ownership",
+      "title": "Runtime events stay owned by their renderer subscription",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "runtime-platform",
+      "layer": "ipc-contract",
+      "surfaces": [
+        "renderer runtime events",
+        "remote runtime reconnect replay",
+        "renderer Linear refresh"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["remote-runtime"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["remote-runtime"],
+      "coverageNotes": "Actual renderer manager, bridge, store actions, adapter and preload dispatcher with synthetic IPC boundaries on macOS. No rendered/native lifecycle, live peer or real provider network claim.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/main/src/renderer/src/hooks/runtime-client-events-sync.ts"
+      ],
+      "invariant": "Only the current subscription attempt can cause renderer event work or reconnect recovery. Current early frames and other hosts survive; canceled late setup handles dispose.",
+      "oracle": "Hold setup, clean up the bridge, deliver100 events and a replay, and require zero provider read dispatches/cache publications/recovery/re-subscriptions. Require initial/live delivery, same-ID replacement, rekey, stop during synchronous setup, sibling host survival and late disposal.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/runtime-client-events-sync-ownership.test.ts src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge-ownership.test.ts src/renderer/src/hooks/runtime-client-events-sync.test.ts src/renderer/src/hooks/ipc-events/runtime-reconnect-host-status.test.ts src/renderer/src/runtime/runtime-client-events.test.ts src/preload/runtime-environment-subscriptions.test.ts"
+      ],
+      "testFiles": [
+        "src/renderer/src/hooks/runtime-client-events-sync-ownership.test.ts",
+        "src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge-ownership.test.ts",
+        "src/renderer/src/hooks/runtime-client-events-sync.test.ts",
+        "src/renderer/src/hooks/ipc-events/runtime-reconnect-host-status.test.ts",
+        "src/renderer/src/runtime/runtime-client-events.test.ts",
+        "src/preload/runtime-environment-subscriptions.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge-ownership.test.ts",
+          "assertions": [
+            "does no Linear read dispatch or cache publication after cleanup while setup is pending",
+            "does no replay recovery or resubscription after cleanup",
+            "accepts a fresh bridge early frame while rejecting the previous bridge frame"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-25",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/runtime-client-events-sync-ownership.test.ts src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge-ownership.test.ts src/renderer/src/hooks/runtime-client-events-sync.test.ts src/renderer/src/hooks/ipc-events/runtime-reconnect-host-status.test.ts src/renderer/src/runtime/runtime-client-events.test.ts src/preload/runtime-environment-subscriptions.test.ts",
+          "result": "passed",
+          "durationSeconds": 2.12,
+          "summary": "41 tests /6 suites pass;13 new regressions have12 failures /1 pass against original production source."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 15,
+        "scope": "Focused deterministic renderer/preload suites; p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Local validation only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "12/13 new tests fail original source; candidate41 tests pass.100 stale dispatches/publications become0 each."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "No new timers, scans or IPC. Per-event O(1) owner guard adds paired median0.026ms/10k pending events and0.062ms/10k settled events. Each benchmark delivers2.2million events with no per-event desired/key reads. Synthetic timing, no rendered latency claim."
+      },
+      "knownGaps": [
+        "No native Windows/Linux/WSL, live SSH/remote or rendered app lifecycle test.",
+        "Already-admitted asynchronous handlers are not canceled; physical listener cleanup still waits for setup settlement.",
+        "No CI soak or mounted render/network/heap measurement."
+      ],
+      "promotionCriteria": [
+        "Retain actual composed dispatch/publication and late-disposal oracles; add CI soak and cross-platform lifecycle evidence before promotion."
+      ],
+      "demotionRule": "Keep experimental until soak; investigate failures without suppressing ownership assertions or unexplained retries."
+    },
     {
       "id": "runtime-files.watcher-process-isolation",
       "title": "Runtime and SSH relay watcher faults stay process-isolated without disrupting host services",
@@ -20275,6 +21183,236 @@
         "Default config paths are shared with GNOME on a disposable hosted CI runner; nested mode refuses non-GitHub-Actions execution."
       ],
       "demotionRule": "Keep experimental on unexplained failures; retain exact bytes and participation checks without retries, skips, or longer deadlines."
+    },
+    {
+      "id": "relay.control-activation-ownership",
+      "title": "Closed queued controls leave persistence for the live retry",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "relay",
+      "layer": "registry-unit-and-local-websocket",
+      "surfaces": ["relay host control activation"],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["relay"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["relay"],
+      "coverageNotes": "Actual registry queue with controlled store latency plus local WebSocket proof and connection-capacity suites on macOS. No PostgreSQL or live remote host run. PTY, daemon, SSH process state, WSL execution and folder/git workspace behavior are unaffected.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/main/cloud/apps/relay/src/host-session-registry.ts"
+      ],
+      "invariant": "A closed queued transport starts no durable activation; an already-started activation retains cleanup, and a live successor becomes the indexed control without concurrent same-host activation.",
+      "oracle": "Queue a closed control before a live retry behind stalled persistence. With controlled 4s store calls, require two total activations, one release for the already-started closed control, and live readiness at 4s. Existing tests retain cleanup when closure happens during I/O.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm --dir cloud/apps/relay exec vitest run ../../../cloud/apps/relay/src/host-session-registry.test.ts ../../../cloud/apps/relay/src/host-session-client-accept.test.ts ../../../cloud/apps/relay/src/relay-host-proof-failure.blackbox.test.ts ../../../cloud/apps/relay/src/relay-connection-hard-cap.blackbox.test.ts --silent=false"
+      ],
+      "testFiles": [
+        "cloud/apps/relay/src/host-session-registry.test.ts",
+        "cloud/apps/relay/src/host-session-client-accept.test.ts",
+        "cloud/apps/relay/src/relay-host-proof-failure.blackbox.test.ts",
+        "cloud/apps/relay/src/relay-connection-hard-cap.blackbox.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "cloud/apps/relay/src/host-session-registry.test.ts",
+          "assertions": [
+            "skips a closed queued control so its live retry avoids abandoned database work",
+            "does not publish a control that closes during activation",
+            "does not rebind a control that closes during activation",
+            "fails a control waiting behind a stalled activation without breaking serialization"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-25",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm --dir cloud/apps/relay exec vitest run ../../../cloud/apps/relay/src/host-session-registry.test.ts ../../../cloud/apps/relay/src/host-session-client-accept.test.ts ../../../cloud/apps/relay/src/relay-host-proof-failure.blackbox.test.ts ../../../cloud/apps/relay/src/relay-connection-hard-cap.blackbox.test.ts --silent=false",
+          "result": "passed",
+          "durationSeconds": 0.407,
+          "summary": "88 tests across four files passed; relay typecheck passed separately."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 30,
+        "scope": "Focused unit and local socket suites; p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Local validation only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Baseline regression failed: three activation calls, two releases, live ready at 8s. Guarded registry passed with two calls, one release, live ready at 4s under controlled store latency."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Deletes abandoned persistence before it starts. No new timer, polling, queue, provider call or wire change; existing FIFO and post-I/O cleanup remain."
+      },
+      "knownGaps": [
+        "No real PostgreSQL contention benchmark or live remote host/physical mobile run.",
+        "Windows/Linux execution and CI soak are not recorded; queue cleanup after a never-settling predecessor remains unchanged."
+      ],
+      "promotionCriteria": [
+        "Retain red/green count and latency assertions; collect cross-platform and CI soak evidence."
+      ],
+      "demotionRule": "Keep experimental until soak evidence; investigate lifecycle failures without retries or weakening count, identity or cleanup assertions."
+    },
+    {
+      "id": "relay.assignment-headroom-scope",
+      "title": "Single-cell admission preserves capacity with bounded headroom reads",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "relay",
+      "layer": "sqlite-store-integration",
+      "surfaces": ["relay assignment admission", "relay migration target capacity"],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["relay"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["relay"],
+      "coverageNotes": "Actual assignment store and SQLite tests on macOS. No real PostgreSQL or live remote host/physical phone run. Local/daemon PTY, SSH execution ownership, WSL, folder/git workspace behavior and transport framing are unaffected.",
+      "motivatingLinks": ["https://github.com/stablyai/orca/issues/23035"],
+      "invariant": "A single-cell capacity check reads only that cell while retaining snapshot freshness, incarnation, outstanding reservation and missing-limit policy; new placement retains the full fleet inventory.",
+      "oracle": "With 32 capped cells, an existing active host stays on its pinned cell and reads one headroom row; new placement reads all 32. Missing, expired or prior-incarnation snapshots, capacity exhaustion and outstanding debt still refuse the active pinned host; an uncapped cell remains admissible.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm --dir cloud/apps/relay exec vitest run ../../../cloud/apps/relay/src/assignment-headroom-scope.test.ts ../../../cloud/apps/relay/src/assignment-connection-headroom.test.ts ../../../cloud/apps/relay/src/assignment-store.test.ts ../../../cloud/apps/relay/src/assignment-store-lock-order.test.ts ../../../cloud/apps/relay/src/cell-inventory-lock-contention.test.ts ../../../cloud/apps/relay/src/assignment-isolated-cell-replacement.test.ts ../../../cloud/apps/relay/src/regional-rehome-target-selection.test.ts --silent=false"
+      ],
+      "testFiles": [
+        "cloud/apps/relay/src/assignment-headroom-scope.test.ts",
+        "cloud/apps/relay/src/assignment-connection-headroom.test.ts",
+        "cloud/apps/relay/src/assignment-store.test.ts",
+        "cloud/apps/relay/src/assignment-store-lock-order.test.ts",
+        "cloud/apps/relay/src/cell-inventory-lock-contention.test.ts",
+        "cloud/apps/relay/src/assignment-isolated-cell-replacement.test.ts",
+        "cloud/apps/relay/src/regional-rehome-target-selection.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "cloud/apps/relay/src/assignment-headroom-scope.test.ts",
+          "assertions": [
+            "reads one cell for a sticky assignment even when the capped fleet grows",
+            "still considers the full fleet for a new placement",
+            "rejects the pinned active host with %s",
+            "preserves admission for cells without a connection limit",
+            "counts outstanding reservations at the admission boundary"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-25",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm --dir cloud/apps/relay exec vitest run ../../../cloud/apps/relay/src/assignment-headroom-scope.test.ts ../../../cloud/apps/relay/src/assignment-connection-headroom.test.ts ../../../cloud/apps/relay/src/assignment-store.test.ts ../../../cloud/apps/relay/src/assignment-store-lock-order.test.ts ../../../cloud/apps/relay/src/cell-inventory-lock-contention.test.ts ../../../cloud/apps/relay/src/assignment-isolated-cell-replacement.test.ts ../../../cloud/apps/relay/src/regional-rehome-target-selection.test.ts --silent=false",
+          "result": "passed",
+          "durationSeconds": 0.513,
+          "summary": "189 tests across seven files passed; independent root rerun also passed189 tests. Relay typecheck passed separately."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 30,
+        "scope": "Focused SQLite store/capacity/lock-order suites; p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Local validation only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Baseline two count regressions failed: sticky headroom 32 rows instead of 1 and uncapped target 31 unrelated rows instead of 0. Narrowed query passes all eight regression cases."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Actual sticky path result rows 32 to 1; no new timer, polling, queue, cache or provider call. Supplemental SQLite query benchmark with 32 cells and 400 active reservations each measured median per-query 0.285ms to 0.022ms; not a production PostgreSQL latency claim."
+      },
+      "knownGaps": [
+        "Real PostgreSQL query plan and concurrent admission not rerun for the scoped variant.",
+        "Windows/Linux execution, live remote host/mobile flows and CI soak are not recorded."
+      ],
+      "promotionCriteria": [
+        "Retain red/green row budget and semantic admission cases; collect PostgreSQL, cross-platform and CI soak evidence."
+      ],
+      "demotionRule": "Keep experimental until soak evidence; investigate admission/ownership regressions without weakening row or capacity assertions."
+    },
+    {
+      "id": "terminal-history.tombstone-rescan-ownership",
+      "title": "Shell-history cleanup reuses one directory listing while preserving deletion ownership",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "desktop-runtime",
+      "layer": "main-filesystem-contract",
+      "surfaces": ["shell-history tombstone cleanup", "native and WSL history deletion"],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local", "wsl"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["local", "wsl"],
+      "coverageNotes": "Actual macOS temp-filesystem deletion and fake WSL cleanup ownership. Live Windows, Linux and WSL execution untested; SSH and daemon replay unaffected because every path here is host-local.",
+      "motivatingLinks": ["https://github.com/stablyai/orca/issues/23030"],
+      "invariant": "Only renamed tombstones are recursively removed, active plus retry admissions stay at 64, retries retain their delays and exhaustion behavior, a root displaced at the cap is admitted from another root's freed slot, and no tombstone is handed to removal twice per listing.",
+      "oracle": "Drain 1,024 real directory entries in controlled batches using at most 8 directory listings and 64 active removals. Exercise late arrivals discovered after the listing, both roots draining under one shared cap, a failing listing mid-drain, delayed failure retries, exhausted attempt budgets, and cancellation of an in-flight listing.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/terminal-history-tombstone-scan-cost.test.ts src/main/terminal-history-async-delete.test.ts src/main/terminal-history-tombstone-retry.test.ts src/main/terminal-history-gc-fs-call-count.test.ts src/main/terminal-history-gc.test.ts src/main/terminal-history.test.ts"
+      ],
+      "testFiles": [
+        "src/main/terminal-history-tombstone-scan-cost.test.ts",
+        "src/main/terminal-history-async-delete.test.ts",
+        "src/main/terminal-history-tombstone-retry.test.ts",
+        "src/main/terminal-history-gc-fs-call-count.test.ts",
+        "src/main/terminal-history-gc.test.ts",
+        "src/main/terminal-history.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/main/terminal-history-tombstone-scan-cost.test.ts",
+          "assertions": [
+            "drains 1024 tombstones without re-reading the directory per completion",
+            "picks up a tombstone created after the queued names were read",
+            "drains both roots within the shared admission cap without per-completion reads",
+            "keeps draining after a directory read fails mid-drain",
+            "drops an in-flight refill during fixture cleanup",
+            "preserves delayed failure retries while successful removals replenish the queue",
+            "does not retry a tombstone past its attempt budget when another root frees slots"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-26",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/terminal-history-tombstone-scan-cost.test.ts src/main/terminal-history-async-delete.test.ts src/main/terminal-history-tombstone-retry.test.ts src/main/terminal-history-gc-fs-call-count.test.ts src/main/terminal-history-gc.test.ts src/main/terminal-history.test.ts",
+          "result": "passed",
+          "durationSeconds": 1.95,
+          "summary": "86 tests across six suites passed, repeated three times with no flakes."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 15,
+        "scope": "focused temp-filesystem history tests"
+      },
+      "flakeHistory": {
+        "status": "unknown",
+        "evidence": "Local author and independent runs pass; CI/soak history not collected."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Pre-change main lists the tombstone directory 1,026 times for 1,024 tombstones and fails the bounded-listing oracle. Reusing one listing reduces it to 6 while still removing every entry."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Five real-filesystem samples per version, 1,024 tombstone directories each holding a meta.json, macOS arm64 / Node 24, identical harness. Median directory listings 1,026 to 6, names enumerated 494,348 to 1,077, blocking main-thread time in the rescan path 820 to 7 ms (the listings themselves 266 to 2.7 ms, and now off-thread), total drain 886 to 75 ms. The remaining ~70 ms is the recursive rm itself and is unchanged. Average concurrent removals 62 of 64, restored from the 46 an event-loop-deferred refill left idle. No polling, no new timers, and no work deferred past process exit."
+      },
+      "promotionCriteria": [
+        "Collect 100 consecutive CI passes or 14 days of soak history.",
+        "Run native Windows and WSL history cleanup on real filesystems."
+      ],
+      "knownGaps": [
+        "No rendered UI latency measurement or physical Windows/Linux/WSL run.",
+        "One listing is retained per root while it drains, about 160 KB per 1,024 tombstones, shrinking as names are consumed.",
+        "A small backlog still costs roughly one listing per completion batch, of a directory that is nearly empty by then.",
+        "A tombstone that exhausts its retries stays on disk until the next startup, unchanged from before."
+      ],
+      "demotionRule": "Keep experimental or demote if the reused listing strands a displaced root, crosses the admission cap, rearms an exhausted retry through another root, hands one tombstone to removal twice, or touches a recreated live history path."
     }
   ]
 }
diff --git a/config/scripts/audit-localization-coverage.mjs b/config/scripts/audit-localization-coverage.mjs
index e25a7bc222e..c5f27a66422 100644
--- a/config/scripts/audit-localization-coverage.mjs
+++ b/config/scripts/audit-localization-coverage.mjs
@@ -7,9 +7,9 @@ import process from 'node:process'
 import ts from 'typescript-api'
 
 const SOURCE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.cts'])
-// Why: test-only modules live beside their spec as `*-test-harness.ts` / `*-fixtures.ts` here, not under `__tests__/`.
+// Why: test-only modules live beside their spec as `*-test-harness.ts` / `*-test-rig.ts` / `*-fixtures.ts` here, not under `__tests__/`.
 const TEST_SUPPORT_FILE_PATTERN =
-  /[.-](?:test-harness|test-fixtures?|test-state|test-support|fixtures?)\.[cm]?[jt]sx?$/
+  /[.-](?:test-harness|test-rig|test-fixtures?|test-state|test-support|fixtures?)\.[cm]?[jt]sx?$/
 const SKIP_PATH_PARTS = new Set(['.git', 'dist', 'node_modules', 'out', '__snapshots__', 'assets'])
 const LOCALIZATION_CALL_NAMES = new Set(['t', 'translate'])
 const USER_VISIBLE_JSX_ATTRIBUTES = new Set([
diff --git a/config/scripts/audit-localization-coverage.test.mjs b/config/scripts/audit-localization-coverage.test.mjs
index 477054f2e8f..6460dc9f36d 100644
--- a/config/scripts/audit-localization-coverage.test.mjs
+++ b/config/scripts/audit-localization-coverage.test.mjs
@@ -50,6 +50,7 @@ describe('localization coverage file skipping', () => {
 
   it('skips test-only modules that sit beside their spec', () => {
     expect(skipped('src/renderer/src/components/browser-pane/stream-test-harness.ts')).toBe(true)
+    expect(skipped('src/renderer/src/runtime/browser-tab-creation-test-rig.ts')).toBe(true)
     expect(skipped('src/renderer/src/hooks/ipc-events-test-fixtures.ts')).toBe(true)
     expect(skipped('src/renderer/src/lib/session-test-state.ts')).toBe(true)
     expect(skipped('src/renderer/src/store/slices/routing-fixture.ts')).toBe(true)
diff --git a/config/scripts/build-mobile-web-app-bundle.mjs b/config/scripts/build-mobile-web-app-bundle.mjs
index 51178e9bed5..1bfad89b6e7 100644
--- a/config/scripts/build-mobile-web-app-bundle.mjs
+++ b/config/scripts/build-mobile-web-app-bundle.mjs
@@ -1,4 +1,5 @@
 import { readFile } from 'node:fs/promises'
+import { readRouteSnapshot } from './mobile-web-app-route-snapshot.mjs'
 import { realpathSync } from 'node:fs'
 import { basename, extname, join, resolve } from 'node:path'
 import { createRequire } from 'node:module'
@@ -466,7 +467,10 @@ const isScriptOutput = (path) => path.endsWith('.js')
  * wrap every route, and their imports are part of the page as surely as the route module's.
  */
 export async function mobileWebAppRouteClosure(routeModule) {
-  return await mobileWebAppModuleClosure(['app/_layout', 'app/h/_layout', routeModule])
+  return (
+    readRouteSnapshot(routeModule) ??
+    (await mobileWebAppModuleClosure(['app/_layout', 'app/h/_layout', routeModule]))
+  )
 }
 
 /**
diff --git a/config/scripts/build-mobile-web-app-bundle.test.mjs b/config/scripts/build-mobile-web-app-bundle.test.mjs
index cd56aa98c0a..baa18b6b39d 100644
--- a/config/scripts/build-mobile-web-app-bundle.test.mjs
+++ b/config/scripts/build-mobile-web-app-bundle.test.mjs
@@ -1,8 +1,13 @@
-import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
+import { mkdir, readFile, writeFile } from 'node:fs/promises'
 import { join, relative } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { describe, expect, it } from 'vitest'
+import {
+  withScratch,
+  readAppBundle,
+  readWrittenBundle,
+  copyWrittenBundle
+} from './mobile-web-app-bundle-test-fixture.mjs'
 import {
   MOBILE_WEB_APP_NATIVE_PARITY_STYLE,
   MOBILE_WEB_APP_ROOT_RESET,
@@ -65,15 +70,6 @@ function allScriptSource({ script, chunks }) {
   return [script, ...chunks.map((chunk) => chunk.bytes)].map((bytes) => bytes.toString('utf8'))
 }
 
-async function withScratch(run) {
-  const scratch = await mkdtemp(join(tmpdir(), 'orca-mobile-web-app-test-'))
-  try {
-    return await run(scratch)
-  } finally {
-    await rm(scratch, { recursive: true, force: true })
-  }
-}
-
 describe('the CRLF pin', () => {
   it('exempts the same extensions in .gitattributes as the CRLF scan skips', async () => {
     const attributes = await readFile(join(projectDir, '.gitattributes'), 'utf8')
@@ -91,8 +87,36 @@ describe('the CRLF pin', () => {
 })
 
 describeBundling('the app bundle', () => {
+  it('isolates read-only fixture consumers from mutations in another assertion', async () => {
+    const first = await readAppBundle()
+    const original = first.script[0]
+    first.script[0] ^= 255
+    first.chunks.length = 0
+    first.routeKeys.length = 0
+    const next = await readAppBundle()
+    expect(next.script[0]).toBe(original)
+    expect(next.chunks.length).toBeGreaterThan(0)
+    expect(next.routeKeys.length).toBeGreaterThan(0)
+    const written = await readWrittenBundle()
+    written.manifest.assets.length = 0
+    expect((await readWrittenBundle()).manifest.assets.length).toBeGreaterThan(0)
+    const originalByte = written.files[0].bytes[0]
+    written.files[0].bytes[0] ^= 255
+    expect((await readWrittenBundle()).files[0].bytes[0]).toBe(originalByte)
+    await withScratch(async (scratch) => {
+      const firstDir = join(scratch, 'first')
+      await copyWrittenBundle(firstDir)
+      await writeFile(join(firstDir, 'manifest.json'), 'corrupted')
+      const secondDir = join(scratch, 'second')
+      const second = await copyWrittenBundle(secondDir)
+      for (const { file, bytes } of second.files) {
+        expect((await readFile(join(secondDir, file))).equals(bytes), file).toBe(true)
+      }
+    })
+  }, 120_000)
+
   it('resolves react-native to react-native-web and leaves no require.context', async () => {
-    const sources = allScriptSource(await bundleMobileWebApp())
+    const sources = allScriptSource(await readAppBundle())
     for (const source of sources) {
       expect(source).not.toContain('require.context')
     }
@@ -101,7 +125,7 @@ describeBundling('the app bundle', () => {
   }, 120_000)
 
   it('cuts the routes into chunks the entry does not load', async () => {
-    const { script, chunks, entryStaticBytes } = await bundleMobileWebApp()
+    const { script, chunks, entryStaticBytes } = await readAppBundle()
     expect(chunks.length).toBeGreaterThan(1)
     // The entry's own bytes plus the chunks it imports statically, which is what the browser
     // parses before any route paints. Every route chunk is outside it.
@@ -112,7 +136,7 @@ describeBundling('the app bundle', () => {
   }, 120_000)
 
   it('names the chunk each route lands in', async () => {
-    const { chunks, routeChunks, routeKeys } = await bundleMobileWebApp()
+    const { chunks, routeChunks, routeKeys } = await readAppBundle()
     expect(Object.keys(routeChunks).sort()).toEqual([...routeKeys].sort())
     const emitted = new Set(chunks.map((chunk) => chunk.name))
     for (const [key, name] of Object.entries(routeChunks)) {
@@ -202,7 +226,7 @@ describeBundling('the app bundle', () => {
   )
 
   it('bundles every route module', async () => {
-    const { routeKeys } = await bundleMobileWebApp()
+    const { routeKeys } = await readAppBundle()
     expect(routeKeys).toEqual(await collectMobileWebAppRouteKeys(appDir))
   }, 120_000)
 
@@ -274,7 +298,7 @@ describeBundling('the app bundle', () => {
   }, 240_000)
 
   it("names an output the same way the manifest's own asset hash does", async () => {
-    const { script, chunks } = await bundleMobileWebApp()
+    const { script, chunks } = await readAppBundle()
     // The name is embedded in the importer, so it cannot be recomputed later; this is what says
     // the name inside the bytes and the manifest's sha256 of those bytes are the same string.
     expect(hashedAsset(script, 'js').path).toBe(`assets/${sha256Hex(script)}.js`)
@@ -330,7 +354,7 @@ describeBundling('the app bundle', () => {
     // once per call. The file explorer calls triggerSelection on every row tap, and C1.9 already
     // traced a swallowed long press on the worktree list to that stray click. `haptics.web.ts` is
     // what keeps the whole shim out of the bundle, so this reads the bytes rather than the import.
-    for (const source of allScriptSource(await bundleMobileWebApp())) {
+    for (const source of allScriptSource(await readAppBundle())) {
       // The shim's own fingerprint, not `navigator.vibrate`: react-native-web's Vibration export
       // calls that too, and it touches no DOM until something invokes it.
       expect(source).not.toContain('ariaHidden')
@@ -340,7 +364,7 @@ describeBundling('the app bundle', () => {
   }, 120_000)
 
   it("ships react-native-web's hairline at one device pixel, whichever of its builds resolves", async () => {
-    const sources = allScriptSource(await bundleMobileWebApp())
+    const sources = allScriptSource(await readAppBundle())
     // Minified, so the assignment reads `<name>.hairlineWidth=`; RNW's own value is the literal 1.
     const assignments = sources.flatMap(
       (source) => source.match(/\.hairlineWidth=[^;]{0,120}/g) ?? []
@@ -354,7 +378,7 @@ describeBundling('the app bundle', () => {
   it('embeds no absolute path from this checkout', async () => {
     // Every chunk, not only the entry: the route manifest names each route by absolute path, and
     // the chunk that import resolves to is where such a path would survive.
-    for (const source of allScriptSource(await bundleMobileWebApp())) {
+    for (const source of allScriptSource(await readAppBundle())) {
       expect(source).not.toContain(projectDir)
     }
   }, 120_000)
@@ -370,76 +394,56 @@ describeBundling('the app bundle', () => {
   }, 120_000)
 
   it('loads the entry as a module, so its route imports resolve', async () => {
-    await withScratch(async (scratch) => {
-      const outDir = join(scratch, 'module-tag')
-      const { manifest } = await buildMobileWebAppBundle({ outDir })
-      const html = await readFile(join(outDir, 'index.html'), 'utf8')
-      // import() in a classic script is a syntax error, so the tag and the format are one fact.
-      expect(html).toContain('<script type="module" src="/assets/')
-      const entry = html.match(/src="\/(assets\/[^"]+)"/)?.[1]
-      expect(manifest.assets.map((asset) => asset.path)).toContain(entry)
-    })
+    const { manifest, html } = await readWrittenBundle()
+    // import() in a classic script is a syntax error, so the tag and the format are one fact.
+    expect(html).toContain('<script type="module" src="/assets/')
+    const entry = html.match(/src="\/(assets\/[^"]+)"/)?.[1]
+    expect(manifest.assets.map((asset) => asset.path)).toContain(entry)
   }, 120_000)
 
   it('declares an icon, so no browser asks the shell for one', async () => {
-    await withScratch(async (scratch) => {
-      const outDir = join(scratch, 'icon')
-      const { manifest } = await buildMobileWebAppBundle({ outDir })
-      const html = await readFile(join(outDir, 'index.html'), 'utf8')
-      // Undeclared, a browser asks the origin for /favicon.ico on its own, and the shell's asset
-      // server answers 403 because the path is in no manifest — repeatedly, on the emulator run.
-      expect(html).toContain('<link rel="icon" href="data:," />')
-      // And the empty URI rather than an asset: the bundle carries no icon, so a declaration
-      // naming one would point at a route image whose name changes with its bytes.
-      expect(manifest.assets.map((asset) => asset.path)).not.toContain('favicon.ico')
-    })
+    const { manifest, html } = await readWrittenBundle()
+    // Undeclared, a browser asks the origin for /favicon.ico on its own, and the shell's asset
+    // server answers 403 because the path is in no manifest — repeatedly, on the emulator run.
+    expect(html).toContain('<link rel="icon" href="data:," />')
+    // And the empty URI rather than an asset: the bundle carries no icon, so a declaration
+    // naming one would point at a route image whose name changes with its bytes.
+    expect(manifest.assets.map((asset) => asset.path)).not.toContain('favicon.ico')
   }, 120_000)
 
   it('declares no viewport-fit, because the shell owns the safe area', async () => {
-    await withScratch(async (scratch) => {
-      const outDir = join(scratch, 'viewport')
-      await buildMobileWebAppBundle({ outDir })
-      const html = await readFile(join(outDir, 'index.html'), 'utf8')
-      // The shell pads the WebView out of the system bars, so the page has nothing to extend
-      // under; asking to would invite a second pad from every page-side SafeAreaView.
-      expect(html).toContain(
-        '<meta name="viewport" content="width=device-width, initial-scale=1" />'
-      )
-      expect(html).not.toContain('viewport-fit')
-    })
+    const { html } = await readWrittenBundle()
+    // The shell pads the WebView out of the system bars, so the page has nothing to extend
+    // under; asking to would invite a second pad from every page-side SafeAreaView.
+    expect(html).toContain('<meta name="viewport" content="width=device-width, initial-scale=1" />')
+    expect(html).not.toContain('viewport-fit')
   }, 120_000)
 
   it('carries the root reset, so the mounted tree has a height to be 1 of', async () => {
-    await withScratch(async (scratch) => {
-      const outDir = join(scratch, 'root-reset')
-      await buildMobileWebAppBundle({ outDir })
-      const html = await readFile(join(outDir, 'index.html'), 'utf8')
-      expect(html).toContain(MOBILE_WEB_APP_ROOT_RESET)
-      expect(html).toContain(MOBILE_WEB_APP_NATIVE_PARITY_STYLE)
-      // Literals rather than substrings taken off the constant, which would read it back against
-      // itself and follow any rule dropped from it. Every rule, because the chain is only as
-      // definite as its weakest link: a height on #root alone resolves against a body that has
-      // none, and percent of auto is auto. Named one by one so a failure says which rule went.
-      for (const rule of [
-        'html,body{height:100%}',
-        'body{overflow:hidden}',
-        '#root{display:flex;height:100%;flex:1}'
-      ]) {
-        expect(MOBILE_WEB_APP_ROOT_RESET, rule).toContain(rule)
-      }
-      // The id travels with the rules: it is what marks this block as the template's reset rather
-      // than something the page grew its own copy of.
-      expect(MOBILE_WEB_APP_ROOT_RESET).toContain('<style id="expo-reset">')
-      // In the document itself, not a linked asset: the CSP that allows it is the one already
-      // relaxed for react-native-web's runtime sheet.
-      expect(html).not.toContain('<link rel="stylesheet"')
-    })
+    const { html } = await readWrittenBundle()
+    expect(html).toContain(MOBILE_WEB_APP_ROOT_RESET)
+    expect(html).toContain(MOBILE_WEB_APP_NATIVE_PARITY_STYLE)
+    // Literals rather than substrings taken off the constant, which would read it back against
+    // itself and follow any rule dropped from it. Every rule, because the chain is only as
+    // definite as its weakest link: a height on #root alone resolves against a body that has
+    // none, and percent of auto is auto. Named one by one so a failure says which rule went.
+    for (const rule of [
+      'html,body{height:100%}',
+      'body{overflow:hidden}',
+      '#root{display:flex;height:100%;flex:1}'
+    ]) {
+      expect(MOBILE_WEB_APP_ROOT_RESET, rule).toContain(rule)
+    }
+    // The id travels with the rules: it is what marks this block as the template's reset rather
+    // than something the page grew its own copy of.
+    expect(MOBILE_WEB_APP_ROOT_RESET).toContain('<style id="expo-reset">')
+    // In the document itself, not a linked asset: the CSP that allows it is the one already
+    // relaxed for react-native-web's runtime sheet.
+    expect(html).not.toContain('<link rel="stylesheet"')
   }, 120_000)
 
   it('writes the manifest shape the packaging contract reads', async () => {
-    const { manifest } = await withScratch((scratch) =>
-      buildMobileWebAppBundle({ outDir: join(scratch, 'c') })
-    )
+    const { manifest } = await readWrittenBundle()
     expect(manifest.schemaVersion).toBe(1)
     expect(manifest.entrypoint).toBe('index.html')
     expect(manifest.assets.map((asset) => asset.path)).toContain('index.html')
@@ -457,9 +461,8 @@ describe('the Phase C budget', () => {
   itBundling(
     'is not already exceeded by the current bundle',
     async () => {
-      const { manifest, chunkCount, entryStaticBytes, imageCount, routeKeys } = await withScratch(
-        (scratch) => buildMobileWebAppBundle({ outDir: join(scratch, 'd') })
-      )
+      const { manifest, chunkCount, entryStaticBytes, imageCount, routeKeys } =
+        await readWrittenBundle()
       expect(manifest.totalBytes).toBeLessThanOrEqual(MOBILE_WEB_APP_BUNDLE_MAX_TOTAL_BYTES)
       expect(manifest.assets.length).toBeLessThanOrEqual(
         mobileWebAppBundleMaxAssets(routeKeys.length, imageCount)
@@ -596,9 +599,7 @@ describe('the Phase C budget', () => {
   itBundling(
     'keeps the derived ceiling under the map the phone actually holds',
     async () => {
-      const { manifest, routeKeys, imageCount } = await withScratch((scratch) =>
-        buildMobileWebAppBundle({ outDir: join(scratch, 'e') })
-      )
+      const { manifest, routeKeys, imageCount } = await readWrittenBundle()
       const ceiling = mobileWebAppBundleMaxAssets(routeKeys.length, imageCount)
       expect(manifest.assets.length).toBeLessThanOrEqual(ceiling)
       // The native side refuses a manifest past this, so the derived ceiling has to stay inside it.
@@ -630,7 +631,7 @@ describe('the verifier', () => {
     async () => {
       await withScratch(async (scratch) => {
         const outDir = join(scratch, 'mobile-web')
-        await buildMobileWebAppBundle({ outDir })
+        await copyWrittenBundle(outDir)
         await expect(verifyMobileWebAppBundle({ bundleDir: outDir })).resolves.toBeDefined()
       })
     },
@@ -642,7 +643,7 @@ describe('the verifier', () => {
     async () => {
       await withScratch(async (scratch) => {
         const outDir = join(scratch, 'mobile-web')
-        await buildMobileWebAppBundle({ outDir })
+        await copyWrittenBundle(outDir)
         const manifestPath = join(outDir, 'manifest.json')
         const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
         manifest.buildId = 'f'.repeat(64)
@@ -660,7 +661,7 @@ describe('the verifier', () => {
     async () => {
       await withScratch(async (scratch) => {
         const outDir = join(scratch, 'mobile-web')
-        const { manifest } = await buildMobileWebAppBundle({ outDir })
+        const { manifest } = await copyWrittenBundle(outDir)
         // What a stale out/ actually looks like: every digest agrees with its bytes and the
         // buildId derives from the asset list, but the source has moved on. Only the two fresh
         // builds the verifier runs can tell, which is the check this covers.
diff --git a/config/scripts/build-orcad-bun.mjs b/config/scripts/build-orcad-bun.mjs
new file mode 100644
index 00000000000..cddd766e6cc
--- /dev/null
+++ b/config/scripts/build-orcad-bun.mjs
@@ -0,0 +1,176 @@
+#!/usr/bin/env node
+
+import { createHash } from 'node:crypto'
+import {
+  chmodSync,
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, join, resolve } from 'node:path'
+import { orcadBunRuntimeFilename } from '../../src/shared/orcad-artifacts.ts'
+import {
+  ORCAD_BUN_RELEASE_ASSETS,
+  ORCAD_BUN_VERSION,
+  orcadBunReleaseUrl
+} from '../../src/shared/orcad-bun-runtime.ts'
+import { runProcessSync } from './script-child-process.mjs'
+import { getZipExtractorCommand } from './zip-extractor-command.mjs'
+
+const root = resolve(import.meta.dirname, '../..')
+const cacheRoot = join(root, 'out', '.orcad-bun-runtime', `v${ORCAD_BUN_VERSION}`)
+
+export function currentTarget() {
+  if (process.platform === 'darwin') {
+    return `darwin-${process.arch}`
+  }
+  if (process.platform === 'win32') {
+    return `win32-${process.arch}`
+  }
+  if (process.platform !== 'linux') {
+    throw new Error(`Unsupported Bun platform: ${process.platform}`)
+  }
+  const glibc = process.report?.getReport()?.header?.glibcVersionRuntime
+  return `linux-${process.arch}-${glibc ? 'glibc' : 'musl'}`
+}
+
+function argument(name) {
+  const index = process.argv.indexOf(name)
+  return index === -1 ? null : process.argv[index + 1]
+}
+
+async function download(url, destination) {
+  const response = await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(120_000) })
+  if (!response.ok) {
+    await response.body?.cancel()
+    throw new Error(`Bun download failed: ${response.status} ${response.statusText}`)
+  }
+  writeFileSync(destination, new Uint8Array(await response.arrayBuffer()))
+}
+
+function sha256(path) {
+  return createHash('sha256').update(readFileSync(path)).digest('hex')
+}
+
+export function bunExecutableName(target) {
+  return target.startsWith('win32-') ? 'bun.exe' : 'bun'
+}
+
+export function findBunExecutable(rootDir, target) {
+  const expected = bunExecutableName(target)
+  const entries = readdirSync(rootDir, { recursive: true, withFileTypes: true })
+  const entry = entries.find((candidate) => candidate.isFile() && candidate.name === expected)
+  if (!entry) {
+    throw new Error(`Downloaded archive contained no ${expected}`)
+  }
+  return join(entry.parentPath, entry.name)
+}
+
+function verifyRuntime(path) {
+  const result = runProcessSync({ program: path, args: ['--version'] })
+  if (result.code !== 0 || result.stdout.trim() !== ORCAD_BUN_VERSION) {
+    throw new Error(
+      `Expected Bun ${ORCAD_BUN_VERSION} at ${path}, got ${result.stdout.trim() || result.stderr.trim()}`
+    )
+  }
+}
+
+async function materializeRuntime(target, outputPath) {
+  const asset = ORCAD_BUN_RELEASE_ASSETS[target]
+  if (!asset) {
+    throw new Error(`Unsupported Bun target: ${target}`)
+  }
+  const cached = join(cacheRoot, target, orcadBunRuntimeFilename(target))
+  if (existsSync(cached) && sha256(cached) !== asset.executableSha256) {
+    rmSync(cached, { force: true })
+  }
+  if (!existsSync(cached)) {
+    const temporary = mkdtempSync(join(tmpdir(), 'orca-bun-download-'))
+    try {
+      const zipPath = join(temporary, basename(asset.filename))
+      await download(orcadBunReleaseUrl(asset), zipPath)
+      const actual = sha256(zipPath)
+      if (actual !== asset.sha256) {
+        throw new Error(`Bun checksum mismatch for ${asset.filename}: ${actual}`)
+      }
+      const extracted = join(temporary, 'extracted')
+      mkdirSync(extracted)
+      // Node 24.16 can leave extract-zip's stream promise unsettled with no active handles.
+      const command = getZipExtractorCommand(zipPath, extracted)
+      const result = runProcessSync({
+        program: command.file,
+        args: command.args,
+        timeoutMs: 120_000
+      })
+      if (result.code !== 0) {
+        throw new Error(
+          `Bun archive extraction failed with exit ${result.code}: ${result.stderr || result.stdout}`
+        )
+      }
+      mkdirSync(join(cacheRoot, target), { recursive: true })
+      copyFileSync(findBunExecutable(extracted, target), cached)
+      if (!target.startsWith('win32-')) {
+        chmodSync(cached, 0o755)
+      }
+    } finally {
+      rmSync(temporary, { recursive: true, force: true })
+    }
+  }
+  const executableHash = sha256(cached)
+  if (executableHash !== asset.executableSha256) {
+    throw new Error(`Bun executable checksum mismatch for ${target}: ${executableHash}`)
+  }
+  if (target === currentTarget()) {
+    verifyRuntime(cached)
+  }
+  mkdirSync(resolve(outputPath, '..'), { recursive: true })
+  if (resolve(cached) !== resolve(outputPath)) {
+    copyFileSync(cached, outputPath)
+  }
+  if (!target.startsWith('win32-')) {
+    chmodSync(outputPath, 0o755)
+  }
+}
+
+async function main() {
+  const target = argument('--target') ?? currentTarget()
+  const outputDir = argument('--out-dir')
+  const cachedRuntimePath = join(cacheRoot, target, orcadBunRuntimeFilename(target))
+  const runtimePath =
+    process.argv.includes('--runtime-only') && outputDir
+      ? join(resolve(outputDir), orcadBunRuntimeFilename(target))
+      : cachedRuntimePath
+  await materializeRuntime(target, runtimePath)
+
+  if (process.argv.includes('--runtime-only')) {
+    process.stdout.write(`${runtimePath}\n`)
+    return
+  }
+  const result = runProcessSync({
+    program: process.execPath,
+    args: [join(root, 'config/scripts/build-orcad.mjs')],
+    cwd: root,
+    env: {
+      ...process.env,
+      ORCAD_BUILD_TARGET: target,
+      ORCAD_BUILD_TARGET_IS_CURRENT: target === currentTarget() ? '1' : '0',
+      ORCAD_BUN_RUNTIME_PATH: runtimePath,
+      ...(outputDir ? { ORCAD_OUT_DIR: resolve(outputDir) } : {})
+    },
+    stdio: 'inherit',
+    timeoutMs: null
+  })
+  if (result.code !== 0) {
+    process.exit(result.code ?? 1)
+  }
+}
+
+if (process.argv[1]?.endsWith('build-orcad-bun.mjs')) {
+  await main()
+}
diff --git a/config/scripts/build-orcad-bun.test.mjs b/config/scripts/build-orcad-bun.test.mjs
new file mode 100644
index 00000000000..bb3f06bc079
--- /dev/null
+++ b/config/scripts/build-orcad-bun.test.mjs
@@ -0,0 +1,39 @@
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { afterEach, describe, expect, it } from 'vitest'
+import { bunExecutableName, findBunExecutable } from './build-orcad-bun.mjs'
+
+const temporaryDirs = []
+
+afterEach(() => {
+  for (const dir of temporaryDirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+function archiveTree(filename) {
+  const root = mkdtempSync(join(tmpdir(), 'orcad-bun-archive-'))
+  temporaryDirs.push(root)
+  const nested = join(root, 'bun-release')
+  mkdirSync(nested)
+  writeFileSync(join(nested, filename), '')
+  return root
+}
+
+describe('orcad Bun archive extraction', () => {
+  it('selects bun.exe for a Windows target on a non-Windows builder', () => {
+    const root = archiveTree('bun.exe')
+    expect(findBunExecutable(root, 'win32-x64')).toBe(join(root, 'bun-release', 'bun.exe'))
+  })
+
+  it('selects bun for a POSIX target', () => {
+    const root = archiveTree('bun')
+    expect(findBunExecutable(root, 'linux-x64-glibc')).toBe(join(root, 'bun-release', 'bun'))
+  })
+
+  it('derives executable names from the target rather than the builder host', () => {
+    expect(bunExecutableName('win32-arm64')).toBe('bun.exe')
+    expect(bunExecutableName('darwin-arm64')).toBe('bun')
+  })
+})
diff --git a/config/scripts/build-orcad-template.mjs b/config/scripts/build-orcad-template.mjs
new file mode 100644
index 00000000000..a69a6ee8485
--- /dev/null
+++ b/config/scripts/build-orcad-template.mjs
@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+
+import { createHash } from 'node:crypto'
+import {
+  chmodSync,
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+import {
+  ORCAD_BUILD_TARGET_FILENAME,
+  ORCAD_TEMPLATE_MANIFEST_FILENAME,
+  ORCAD_TEMPLATE_TARGETS_DIR,
+  ORCAD_RIPGREP_ARTIFACTS,
+  orcadTemplateCommonFilenames
+} from '../../src/shared/orcad-artifacts.ts'
+import { orcadAgentBrowserNativeName } from '../../src/shared/orcad-agent-browser-name.ts'
+import { ORCAD_TEMPLATE_TARGETS } from '../../src/shared/orcad-bun-runtime.ts'
+import { runProcessSync } from './script-child-process.mjs'
+import { materializeWatcherPackage } from './orcad-watcher-package.mjs'
+import { verifyPackagedOrcadTemplate } from './verify-packaged-orcad-template.cjs'
+
+const root = resolve(import.meta.dirname, '../..')
+const outputDir = join(root, 'out', 'orcad-template')
+const buildDir = join(root, 'out', '.orcad-template-build')
+const commonArtifacts = orcadTemplateCommonFilenames()
+
+function copy(source, destination, executable = false) {
+  mkdirSync(dirname(destination), { recursive: true })
+  copyFileSync(source, destination)
+  if (executable && process.platform !== 'win32') {
+    chmodSync(destination, 0o755)
+  }
+}
+
+function sha256(path) {
+  return createHash('sha256').update(readFileSync(path)).digest('hex')
+}
+
+function targetPlatform(target) {
+  return target.split('-')[0]
+}
+
+function targetArch(target) {
+  return target.split('-')[1]
+}
+
+function buildCommonArtifacts() {
+  rmSync(buildDir, { recursive: true, force: true })
+  const result = runProcessSync({
+    program: process.execPath,
+    args: [join(root, 'config/scripts/build-orcad-bun.mjs'), '--out-dir', buildDir],
+    cwd: root,
+    stdio: 'inherit',
+    timeoutMs: null
+  })
+  if (result.code !== 0) {
+    throw new Error(`Common orcad artifact build failed with exit ${result.code ?? 'unknown'}`)
+  }
+}
+
+async function stageTarget(target) {
+  const destination = join(outputDir, ORCAD_TEMPLATE_TARGETS_DIR, target)
+  const targetIdentity = join(destination, ORCAD_BUILD_TARGET_FILENAME)
+  mkdirSync(destination, { recursive: true })
+  writeFileSync(targetIdentity, `${target}\n`)
+  const watcherSource = await materializeWatcherPackage(target)
+  const watcherDestination = join(destination, 'watcher.node')
+  copy(watcherSource, watcherDestination)
+
+  const browserName = orcadAgentBrowserNativeName(
+    targetPlatform(target),
+    targetArch(target),
+    target.endsWith('-musl') ? 'musl' : 'glibc'
+  )
+  const browserSource = join(root, 'node_modules', 'agent-browser', 'bin', browserName)
+  const browserDestination = join(destination, browserName)
+  if (existsSync(browserSource)) {
+    copy(browserSource, browserDestination, true)
+  }
+  return {
+    targetSha256: sha256(targetIdentity),
+    watcherSha256: sha256(watcherDestination),
+    ...(existsSync(browserDestination)
+      ? { browserName, browserSha256: sha256(browserDestination) }
+      : {})
+  }
+}
+
+async function main() {
+  buildCommonArtifacts()
+  rmSync(outputDir, { recursive: true, force: true })
+  mkdirSync(outputDir, { recursive: true })
+  for (const filename of commonArtifacts) {
+    copy(
+      join(buildDir, filename),
+      join(outputDir, filename),
+      ORCAD_RIPGREP_ARTIFACTS.some((artifact) => artifact === filename && artifact.endsWith('/rg'))
+    )
+  }
+  const targets = Object.fromEntries(
+    await Promise.all(
+      ORCAD_TEMPLATE_TARGETS.map(async (target) => [target, await stageTarget(target)])
+    )
+  )
+  const commonSha256 = Object.fromEntries(
+    commonArtifacts.map((filename) => [filename, sha256(join(outputDir, filename))])
+  )
+  writeFileSync(
+    join(outputDir, ORCAD_TEMPLATE_MANIFEST_FILENAME),
+    `${JSON.stringify({ schemaVersion: 2, commonSha256, targets }, null, 2)}\n`
+  )
+  verifyPackagedOrcadTemplate(join(root, 'out'))
+  rmSync(buildDir, { recursive: true, force: true })
+  process.stdout.write(`[build-orcad-template] ok — ${ORCAD_TEMPLATE_TARGETS.length} targets\n`)
+}
+
+await main()
diff --git a/config/scripts/build-orcad.mjs b/config/scripts/build-orcad.mjs
index 99a53fa0981..b015f52ea2e 100644
--- a/config/scripts/build-orcad.mjs
+++ b/config/scripts/build-orcad.mjs
@@ -1,85 +1,137 @@
 #!/usr/bin/env node
-/**
- * Bundle `orcad` — the Orca runtime served from plain Node, no Electron.
- *
- * Variant B (see docs/design/node-only-runtime-backend.html): the browser-pane and
- * speech clusters are excluded. That is not a size optimisation — those modules are
- * the only ones that statically import `node:sqlite`, so dropping them is what keeps
- * the host Node floor at 18 instead of 22.5+.
- */
+// Ship Bun with orcad; keep module loading compatible with legacy Node launchers.
 import { fork, spawnSync } from 'node:child_process'
 import { build } from 'esbuild'
+import {
+  buildOrcadEntry,
+  externalNativeAddons,
+  ORCAD_EXTERNAL_MODULES,
+  ORCAD_CHILD_ENTRY_POINTS
+} from './orcad-entry-build.mjs'
+import { createRequire } from 'node:module'
 import {
   chmodSync,
   copyFileSync,
   cpSync,
+  existsSync,
   mkdirSync,
   mkdtempSync,
   rmSync,
   writeFileSync
 } from 'node:fs'
-import { arch, platform, tmpdir } from 'node:os'
-import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
 import process from 'node:process'
+import { smokeProfileStateWorkers } from './profile-state-worker-smoke.mjs'
+import { materializeWatcherPackage } from './orcad-watcher-package.mjs'
+import { stageOrcadWindowsProcessTree } from './orcad-windows-process-tree.mjs'
 import {
+  ORCAD_BUILD_TARGET_FILENAME,
+  ORCAD_EMOJI_SHORTCODE_DATASET,
+  orcadBunRuntimeFilename,
+  ORCAD_PARCEL_WATCHER_ENTRY,
+  ORCAD_PARCEL_WATCHER_NATIVE,
   ORCAD_VERSION_FILENAME,
   ORCAD_RIPGREP_ARTIFACTS
 } from '../../src/shared/orcad-artifacts.ts'
 import { computeOrcadFullVersion } from './orcad-artifact-version.mjs'
+import { ORCAD_BUN_VERSION } from '../../src/shared/orcad-bun-runtime.ts'
+import { orcadAgentBrowserNativeName } from '../../src/shared/orcad-agent-browser-name.ts'
 
 const ROOT = join(import.meta.dirname, '..', '..')
-const OUT_DIR = join(ROOT, 'out', 'orcad')
-const ENTRY = join(ROOT, 'src/main/orcad/main.ts')
+const OUT_DIR = process.env.ORCAD_OUT_DIR
+  ? resolve(process.env.ORCAD_OUT_DIR)
+  : join(ROOT, 'out', 'orcad')
 // Why beside orcad.js: the watcher runs in a forked child so a native @parcel/watcher
 // fault crashes that child instead of the server, and `resolveWatcherProcessEntryPath`
 // looks for it in the app root. A deployment has no desktop out/main to fall back to.
-const WATCHER_ENTRY = join(ROOT, 'src/main/ipc/parcel-watcher-process-entry.ts')
+const WATCHER_ENTRY = join(ROOT, ORCAD_CHILD_ENTRY_POINTS.watcher)
 const WATCHER_OUT_FILE = join(OUT_DIR, 'parcel-watcher-process-entry.js')
 // Why beside orcad.js: orcad forks the terminal daemon so PTYs outlive the runtime process,
 // and `getDaemonEntryPath()` probes the app root for this exact filename. Without it every
 // orcad restart would SIGKILL every running terminal.
-const DAEMON_ENTRY = join(ROOT, 'src/main/daemon/daemon-entry.ts')
+const DAEMON_ENTRY = join(ROOT, ORCAD_CHILD_ENTRY_POINTS.daemon)
 const DAEMON_OUT_FILE = join(OUT_DIR, 'daemon-entry.js')
-const AGENT_BROWSER_NAME = `agent-browser-${platform()}-${arch()}${process.platform === 'win32' ? '.exe' : ''}`
+const PTY_GATE_ENTRY = join(ROOT, ORCAD_CHILD_ENTRY_POINTS.ptyGate)
+const PTY_GATE_OUT_FILE = join(OUT_DIR, 'windows-bun-pty-gate-entry.js')
 const OUT_FILE = join(OUT_DIR, 'orcad.js')
+const BUILD_TARGET = process.env.ORCAD_BUILD_TARGET
+if (!BUILD_TARGET) {
+  throw new Error('ORCAD_BUILD_TARGET is required; run `pnpm build:orcad`')
+}
+const [targetPlatform, targetArch] = BUILD_TARGET.split('-')
+const targetIsWindows = targetPlatform === 'win32'
+const targetIsCurrent = process.env.ORCAD_BUILD_TARGET_IS_CURRENT === '1'
+const AGENT_BROWSER_NAME = orcadAgentBrowserNativeName(
+  targetPlatform,
+  targetArch,
+  BUILD_TARGET.endsWith('-musl') ? 'musl' : 'glibc'
+)
 const AGENT_BROWSER_SOURCE = join(ROOT, 'node_modules', 'agent-browser', 'bin', AGENT_BROWSER_NAME)
 const AGENT_BROWSER_OUTPUT = join(OUT_DIR, AGENT_BROWSER_NAME)
+const WATCHER_MODULE_DIR = join(OUT_DIR, 'node_modules', '@parcel', 'watcher')
 
-// Native addons must exist on the host; they cannot be bundled.
-// `electron` is external so a residual import fails loudly at require() time rather
-// than silently bundling the npm package's installer shim, which is what happened the
-// first time and made the bundle look clean while it was not.
-// Why only these: measured, not guessed. `node-pty` is a hard `require.resolve` — orcad
-// exits at startup without it. `@parcel/watcher` is a guarded dynamic import, so the
-// server boots without it but every watch install fails. `fsevents` is macOS-only and
-// optional upstream. better-sqlite3 / keytar / cpu-features were externalized here
-// defensively and appear nowhere in the graph; listing them implied a shipping burden
-// that does not exist.
-const EXTERNAL = ['electron', 'node-pty', '@parcel/watcher', 'fsevents']
-
-/** Why: the UMD build's relative dynamic requires do not bundle. Same fix build-relay.mjs uses. */
-const jsoncParserEsm = {
-  name: 'jsonc-parser-esm',
-  setup(pluginBuild) {
-    pluginBuild.onResolve({ filter: /^jsonc-parser$/ }, () => ({
-      path: join(ROOT, 'node_modules', 'jsonc-parser', 'lib', 'esm', 'main.js')
-    }))
-  }
-}
-
-/** Why: optional native deps reference prebuilt .node files that may not exist here. */
-const externalNativeAddons = {
-  name: 'external-native-addons',
-  setup(pluginBuild) {
-    pluginBuild.onResolve({ filter: /\.node$/ }, (args) => ({ path: args.path, external: true }))
-  }
+async function stageParcelWatcher(target) {
+  const requireFromWatcher = createRequire(
+    join(ROOT, 'node_modules', '@parcel', 'watcher', 'index.js')
+  )
+  const nativeSource = await materializeWatcherPackage(target)
+  const wrapperSource = requireFromWatcher.resolve('@parcel/watcher/wrapper.js')
+  mkdirSync(WATCHER_MODULE_DIR, { recursive: true })
+  await build({
+    stdin: {
+      contents:
+        `const {createWrapper}=require(${JSON.stringify(wrapperSource)});` +
+        `module.exports=createWrapper(require('./watcher.node'));`,
+      resolveDir: ROOT,
+      sourcefile: 'orcad-parcel-watcher-entry.js'
+    },
+    bundle: true,
+    platform: 'node',
+    target: 'node18',
+    format: 'cjs',
+    outfile: join(OUT_DIR, ORCAD_PARCEL_WATCHER_ENTRY),
+    external: ['./watcher.node'],
+    minify: true,
+    sourcemap: false,
+    logLevel: 'error'
+  })
+  copyFileSync(nativeSource, join(OUT_DIR, ORCAD_PARCEL_WATCHER_NATIVE))
 }
 
 rmSync(OUT_DIR, { recursive: true, force: true })
 mkdirSync(OUT_DIR, { recursive: true })
-copyFileSync(AGENT_BROWSER_SOURCE, AGENT_BROWSER_OUTPUT)
-if (process.platform !== 'win32') {
-  chmodSync(AGENT_BROWSER_OUTPUT, 0o755)
+const bunRuntimeSource = process.env.ORCAD_BUN_RUNTIME_PATH
+if (!bunRuntimeSource) {
+  throw new Error('ORCAD_BUN_RUNTIME_PATH is required; run `pnpm build:orcad`')
+}
+if (targetIsCurrent) {
+  const version = spawnSync(bunRuntimeSource, ['--version'], { encoding: 'utf8' })
+  if (version.status !== 0 || version.stdout.trim() !== ORCAD_BUN_VERSION) {
+    throw new Error(
+      `ORCAD_BUN_RUNTIME_PATH must be Bun ${ORCAD_BUN_VERSION}; got ${version.stdout.trim() || version.stderr.trim()}`
+    )
+  }
+}
+const bunRuntimeOutput = join(OUT_DIR, orcadBunRuntimeFilename(BUILD_TARGET))
+copyFileSync(bunRuntimeSource, bunRuntimeOutput)
+writeFileSync(join(OUT_DIR, ORCAD_BUILD_TARGET_FILENAME), `${BUILD_TARGET}\n`)
+if (!targetIsWindows) {
+  chmodSync(bunRuntimeOutput, 0o755)
+}
+await stageParcelWatcher(BUILD_TARGET)
+stageOrcadWindowsProcessTree(ROOT, OUT_DIR, BUILD_TARGET)
+const emojiDatasetOutput = join(OUT_DIR, ORCAD_EMOJI_SHORTCODE_DATASET)
+mkdirSync(dirname(emojiDatasetOutput), { recursive: true })
+copyFileSync(
+  createRequire(import.meta.url).resolve('emojibase-data/en/shortcodes/emojibase.json'),
+  emojiDatasetOutput
+)
+if (existsSync(AGENT_BROWSER_SOURCE)) {
+  copyFileSync(AGENT_BROWSER_SOURCE, AGENT_BROWSER_OUTPUT)
+  if (!targetIsWindows) {
+    chmodSync(AGENT_BROWSER_OUTPUT, 0o755)
+  }
 }
 // Why every platform: an SSH deployment can target a different host than the build machine.
 for (const artifact of ORCAD_RIPGREP_ARTIFACTS) {
@@ -110,36 +162,31 @@ function buildForkedChild(entryPoint, outfile) {
     target: 'node18',
     format: 'cjs',
     outfile,
-    external: EXTERNAL,
+    external: ORCAD_EXTERNAL_MODULES,
     plugins: [externalNativeAddons],
     metafile: true,
     minify: true,
     sourcemap: false,
-    define: { 'process.env.NODE_ENV': '"production"' },
+    define: {
+      'process.env.NODE_ENV': '"production"'
+    },
     logLevel: 'error'
   })
 }
 
 const childResults = await Promise.all([
   buildForkedChild(WATCHER_ENTRY, WATCHER_OUT_FILE),
-  buildForkedChild(DAEMON_ENTRY, DAEMON_OUT_FILE)
+  buildForkedChild(DAEMON_ENTRY, DAEMON_OUT_FILE),
+  buildForkedChild(PTY_GATE_ENTRY, PTY_GATE_OUT_FILE),
+  ...['writer', 'backup'].map((role) =>
+    buildForkedChild(
+      join(ROOT, ORCAD_CHILD_ENTRY_POINTS[role]),
+      join(OUT_DIR, `profile-state-${role}-worker-entry.js`)
+    )
+  )
 ])
 
-const result = await build({
-  entryPoints: [ENTRY],
-  bundle: true,
-  platform: 'node',
-  target: 'node18',
-  format: 'cjs',
-  outfile: OUT_FILE,
-  external: EXTERNAL,
-  plugins: [jsoncParserEsm, externalNativeAddons],
-  metafile: true,
-  minify: true,
-  sourcemap: false,
-  define: { 'process.env.NODE_ENV': '"production"' },
-  logLevel: 'error'
-})
+const result = await buildOrcadEntry(OUT_FILE)
 
 const output = Object.values(result.metafile.outputs).find(
   (o) => o.entryPoint === 'src/main/orcad/main.ts'
@@ -147,8 +194,8 @@ const output = Object.values(result.metafile.outputs).find(
 // Why check `original` and not just `path`: when electron is bundleable, esbuild
 // rewrites `path` to the resolved file under node_modules and the naive check passes
 // while the package is very much in the bundle.
-// Why both metafiles: the forked children ship in the same deployment and run under the
-// same plain Node. A daemon-entry that reached electron would fail at fork time, on the
+// Why both metafiles: the forked children ship in the same deployment and runtime. A
+// daemon-entry that reached electron would fail at fork time, on the
 // path whose whole point is that terminals survive.
 function collectImporters(metafiles, matches) {
   const importers = new Set()
@@ -196,7 +243,7 @@ if (graphErrors.length > 0) {
   process.exitCode = 1
 } else {
   // Why smoke-load and not just read the metafile: the import scan proves no module
-  // *names* electron, but a graph can still fail to resolve under plain Node — a
+  // *names* electron, but the rollback graph can still fail to resolve under plain Node — a
   // dynamic require, a missing native, a top-level throw. The plain-node-entry-guard
   // smoke-loads its entries for exactly this reason, and orcad cannot join that guard
   // because it is an esbuild artifact rather than a rollup input.
@@ -211,7 +258,7 @@ if (graphErrors.length > 0) {
   const smokeOutput = `${smoke.stdout ?? ''}${smoke.stderr ?? ''}`
   if (smoke.error || smoke.signal || smoke.status !== 0) {
     console.error(
-      `[build-orcad] the bundle did not load under plain Node.\n` +
+      `[build-orcad] the bundle lost Node load compatibility.\n` +
         `Expected a clean load-check exit, got status=${smoke.status ?? 'none'} ` +
         `signal=${smoke.signal ?? 'none'} ` +
         `error=${smoke.error?.message ?? 'none'}\n${smokeOutput.slice(0, 2000)}`
@@ -240,47 +287,57 @@ if (graphErrors.length > 0) {
   const daemonSmokeOutput = `${daemonSmoke.stdout ?? ''}${daemonSmoke.stderr ?? ''}`
   if (daemonSmoke.error || daemonSmoke.signal || daemonSmoke.status !== 0) {
     console.error(
-      `[build-orcad] the daemon child did not load under plain Node.\n` +
+      `[build-orcad] the daemon child lost Node load compatibility.\n` +
         `Expected a clean load check, got status=${daemonSmoke.status ?? 'none'} ` +
         `signal=${daemonSmoke.signal ?? 'none'} ` +
         `error=${daemonSmoke.error?.message ?? 'none'}\n${daemonSmokeOutput.slice(0, 2000)}`
     )
     process.exitCode = 1
   }
-  const watcherFailure = await smokeLoadWatcherChild()
+  const watcherFailure = targetIsCurrent ? await smokeLoadWatcherChild(bunRuntimeOutput) : null
   if (watcherFailure) {
     console.error(
-      `[build-orcad] the watcher child did not run under plain Node.\n${watcherFailure}`
+      `[build-orcad] the watcher child failed under the bundled runtime.\n${watcherFailure}`
     )
     process.exitCode = 1
   }
 }
 
+try {
+  await smokeProfileStateWorkers(OUT_DIR)
+  if (targetIsCurrent) {
+    await smokeProfileStateWorkers(OUT_DIR, { runtimePath: bunRuntimeOutput })
+  }
+} catch (error) {
+  console.error('[build-orcad] profile state worker check failed:', error)
+  process.exitCode = 1
+}
+
 // Why a content hash and not ORCAD_VERSION alone: the remote install directory is keyed on
 // this string, so two different builds carrying one version would share a directory — and an
 // already-`.install-complete` dir is never re-uploaded. The deploy would silently run stale
 // bytes while reporting the new version.
 if (process.exitCode !== 1) {
-  const fullVersion = computeOrcadFullVersion(OUT_DIR)
+  const fullVersion = computeOrcadFullVersion(OUT_DIR, {
+    target: BUILD_TARGET,
+    agentBrowserFilename: AGENT_BROWSER_NAME
+  })
   writeFileSync(join(OUT_DIR, ORCAD_VERSION_FILENAME), fullVersion)
   console.log(
-    `[build-orcad] ok — ${fullVersion}, ${(output.bytes / 1024 / 1024).toFixed(2)} MB, ${Object.keys(output.inputs).length} modules, zero electron and node:sqlite imports.`
+    `[build-orcad] ok — ${fullVersion}, ${(output.bytes / 1024 / 1024).toFixed(2)} MB, ${Object.keys(output.inputs).length} modules, zero electron and node:sqlite imports, Bun ${ORCAD_BUN_VERSION} included.`
   )
 }
 
-/**
- * Fork the shipped watcher child and drive one message through it.
- *
- * Why a real fork and not existsSync: the file being present says nothing about whether
- * its graph resolves under plain Node, and this child is only ever reached through
- * `fork()` at runtime — a broken one degrades silently to in-process watching.
- * `subscribe-started` is acked before the native module is touched, so this passes on a
- * build machine with no compiled @parcel/watcher.
- */
-async function smokeLoadWatcherChild() {
+// Verify the shipped native watcher actually subscribes under the bundled runtime.
+async function smokeLoadWatcherChild(runtimePath) {
   const probeDir = mkdtempSync(join(tmpdir(), 'orcad-watcher-smoke-'))
-  const child = fork(WATCHER_OUT_FILE, [], { stdio: ['ignore', 'ignore', 'pipe', 'ipc'] })
+  const child = fork(WATCHER_OUT_FILE, [], {
+    execPath: runtimePath,
+    stdio: ['ignore', 'ignore', 'pipe', 'ipc'],
+    windowsHide: true
+  })
   let stderr = ''
+  let subscribed = false
   child.stderr?.on('data', (chunk) => {
     stderr += String(chunk)
   })
@@ -288,14 +345,15 @@ async function smokeLoadWatcherChild() {
     return await new Promise((resolve) => {
       const timer = setTimeout(() => {
         child.kill('SIGKILL')
-        resolve(`No 'subscribe-started' ack within 30s.\n${stderr.slice(0, 2000)}`)
+        resolve(`Watcher did not complete its subscription within 30s.\n${stderr.slice(0, 2000)}`)
       }, 30_000)
       const settle = (failure) => {
         clearTimeout(timer)
         resolve(failure)
       }
       child.on('message', (message) => {
-        if (message?.op === 'subscribe-started') {
+        subscribed ||= message?.op === 'subscribed'
+        if (message?.op === 'subscribed' || message?.op === 'subscribe-failed') {
           child.disconnect()
         }
       })
@@ -303,7 +361,11 @@ async function smokeLoadWatcherChild() {
       // Why exit and not disconnect: the child exits 0 on disconnect, so a non-zero code
       // or a signal here is a load failure rather than a clean teardown.
       child.on('exit', (code, signal) =>
-        settle(code === 0 ? null : `exit code=${code} signal=${signal}\n${stderr.slice(0, 2000)}`)
+        settle(
+          code === 0 && subscribed
+            ? null
+            : `subscribed=${subscribed} exit code=${code} signal=${signal}\n${stderr.slice(0, 2000)}`
+        )
       )
       child.send({ op: 'subscribe', id: 1, dir: probeDir, opts: {} })
     })
diff --git a/config/scripts/build-relay.mjs b/config/scripts/build-relay.mjs
index 4d408712f97..a122c661df1 100644
--- a/config/scripts/build-relay.mjs
+++ b/config/scripts/build-relay.mjs
@@ -24,6 +24,7 @@ import {
   RELAY_BUILD_PLATFORMS,
   RELAY_VERSION_FILENAME,
   RELAY_WINDOWS_PROCESS_TREE_FILENAME,
+  RELAY_OPENCODE_SQLITE_READER_FILENAME,
   relayOptionalArtifactFilenames,
   isWindowsRelayPlatform,
   relayArtifactFilenames
@@ -35,6 +36,13 @@ const ROOT = join(__dirname, '..', '..')
 const RELAY_ENTRY = join(ROOT, 'src', 'relay', 'relay.ts')
 const WATCHER_ENTRY = join(ROOT, 'src', 'main', 'ipc', 'parcel-watcher-process-entry.ts')
 const AI_VAULT_SERVICE_ENTRY = join(ROOT, 'src', 'relay', 'ai-vault-service-entry.ts')
+const OPENCODE_SQLITE_READER_ENTRY = join(
+  ROOT,
+  'src',
+  'main',
+  'ai-vault',
+  'session-scanner-opencode-sqlite-process-entry.ts'
+)
 const WSL_TRANSCRIPT_FS_PROCESS_ENTRY = join(
   ROOT,
   'src',
@@ -110,13 +118,7 @@ const OUT_ROOT = process.env.ORCA_RELAY_OUT_ROOT ?? join(ROOT, 'out', 'relay')
 
 const RELAY_VERSION = '0.1.0'
 
-for (const platform of RELAY_BUILD_PLATFORMS) {
-  const outDir = join(OUT_ROOT, platform)
-  // Why: a stale companion left by an earlier build would otherwise satisfy the
-  // manifest check and be hashed into .version, shipping mixed-generation bytes.
-  rmSync(outDir, { recursive: true, force: true })
-  mkdirSync(outDir, { recursive: true })
-
+async function buildRelayBundles(outDir) {
   await build({
     entryPoints: [RELAY_ENTRY],
     bundle: true,
@@ -134,22 +136,6 @@ for (const platform of RELAY_BUILD_PLATFORMS) {
     }
   })
 
-  if (isWindowsRelayPlatform(platform)) {
-    copyFileSync(
-      NODE_PTY_CONSOLE_LIST_PATCH_SOURCE,
-      join(outDir, NODE_PTY_CONSOLE_LIST_PATCH_FILENAME)
-    )
-    copyFileSync(
-      NODE_PTY_WINDOWS_TEARDOWN_PATCH_SOURCE,
-      join(outDir, NODE_PTY_WINDOWS_TEARDOWN_PATCH_FILENAME)
-    )
-  }
-  copyFileSync(
-    NODE_PTY_MASTER_CLOEXEC_PATCH_SOURCE,
-    join(outDir, NODE_PTY_MASTER_CLOEXEC_PATCH_FILENAME)
-  )
-  stageWindowsProcessTreeAddon(platform, outDir)
-
   await build({
     entryPoints: [WATCHER_ENTRY],
     bundle: true,
@@ -180,6 +166,19 @@ for (const platform of RELAY_BUILD_PLATFORMS) {
     }
   })
 
+  await build({
+    entryPoints: [OPENCODE_SQLITE_READER_ENTRY],
+    bundle: true,
+    platform: 'node',
+    target: 'node18',
+    format: 'cjs',
+    outfile: join(outDir, RELAY_OPENCODE_SQLITE_READER_FILENAME),
+    external: ['electron', 'bun:sqlite'],
+    sourcemap: false,
+    minify: true,
+    define: { 'process.env.NODE_ENV': '"production"' }
+  })
+
   // Why beside the service: the spawn resolves this child next to its own
   // bundle, and a relay host has no desktop out/main to fall back to.
   await build({
@@ -213,6 +212,44 @@ for (const platform of RELAY_BUILD_PLATFORMS) {
       'process.env.NODE_ENV': '"production"'
     }
   })
+}
+
+let bundledSourceDir
+let bundledFilenames = []
+
+for (const platform of RELAY_BUILD_PLATFORMS) {
+  const outDir = join(OUT_ROOT, platform)
+  // Why: a stale companion left by an earlier build would otherwise satisfy the
+  // manifest check and be hashed into .version, shipping mixed-generation bytes.
+  rmSync(outDir, { recursive: true, force: true })
+  mkdirSync(outDir, { recursive: true })
+
+  // The JavaScript selects its host at runtime; only native addons and patches vary.
+  if (bundledSourceDir) {
+    for (const filename of bundledFilenames) {
+      copyFileSync(join(bundledSourceDir, filename), join(outDir, filename))
+    }
+  } else {
+    await buildRelayBundles(outDir)
+    bundledSourceDir = outDir
+    bundledFilenames = readdirSync(outDir)
+  }
+
+  if (isWindowsRelayPlatform(platform)) {
+    copyFileSync(
+      NODE_PTY_CONSOLE_LIST_PATCH_SOURCE,
+      join(outDir, NODE_PTY_CONSOLE_LIST_PATCH_FILENAME)
+    )
+    copyFileSync(
+      NODE_PTY_WINDOWS_TEARDOWN_PATCH_SOURCE,
+      join(outDir, NODE_PTY_WINDOWS_TEARDOWN_PATCH_FILENAME)
+    )
+  }
+  copyFileSync(
+    NODE_PTY_MASTER_CLOEXEC_PATCH_SOURCE,
+    join(outDir, NODE_PTY_MASTER_CLOEXEC_PATCH_FILENAME)
+  )
+  stageWindowsProcessTreeAddon(platform, outDir)
 
   // Why: include a content hash so the deploy check detects code changes even
   // when RELAY_VERSION hasn't been bumped. Hashing the whole manifest means a
diff --git a/config/scripts/build-windows-cli-launcher.mjs b/config/scripts/build-windows-cli-launcher.mjs
index 9d3c9020706..cc4e5ad3d0f 100644
--- a/config/scripts/build-windows-cli-launcher.mjs
+++ b/config/scripts/build-windows-cli-launcher.mjs
@@ -1,24 +1,41 @@
 #!/usr/bin/env node
 
 import { spawnSync } from 'node:child_process'
-import { existsSync, mkdirSync, statSync } from 'node:fs'
+import { createHash } from 'node:crypto'
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { dirname, join, resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
 
-export function shouldReuseCompiledWindowsCliLauncher(
-  outputPath,
-  sourcePath,
-  { reuseCached = false } = {}
-) {
-  if (!existsSync(outputPath)) {
-    return false
+export function windowsCliLauncherFingerprint(inputPaths, version) {
+  const hash = createHash('sha256').update(version)
+  for (const inputPath of inputPaths) {
+    hash.update('\0').update(readFileSync(inputPath))
   }
-  // Why reuseCached: Actions cache keys already hash the C# source, but restore
-  // does not preserve mtimes, so a hit would look stale and recompile anyway.
-  if (reuseCached) {
-    return true
+  return hash.digest('hex')
+}
+
+export function shouldReuseCompiledWindowsCliLauncher(outputPath, fingerprint) {
+  const fingerprintPath = `${outputPath}.sha256`
+  return (
+    existsSync(outputPath) &&
+    existsSync(fingerprintPath) &&
+    readFileSync(fingerprintPath, 'utf8') === fingerprint
+  )
+}
+
+export function windowsCliLauncherVersionSource(version) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.exec(version)
+  if (!match || match.slice(1).some((part) => Number(part) > 65534)) {
+    throw new Error(`Invalid Windows CLI launcher version: ${version}`)
   }
-  return statSync(outputPath).mtimeMs >= statSync(sourcePath).mtimeMs
+  const fileVersion = `${match.slice(1).join('.')}.0`
+  return [
+    'using System.Reflection;',
+    `[assembly: AssemblyVersion("${fileVersion}")]`,
+    `[assembly: AssemblyFileVersion("${fileVersion}")]`,
+    `[assembly: AssemblyInformationalVersion("${version}")]`,
+    ''
+  ].join('\n')
 }
 
 function defaultOutputPath(projectRoot) {
@@ -53,6 +70,19 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
 
   const repoRoot = resolve(import.meta.dirname, '../..')
   const sourcePath = join(repoRoot, 'native', 'windows-cli-launcher', 'OrcaCliLauncher.cs')
+  const manifestPath = join(repoRoot, 'native', 'windows-cli-launcher', 'app.manifest')
+  const iconPath = join(repoRoot, 'resources', 'build', 'icon.ico')
+  const { version } = JSON.parse(readFileSync(join(repoRoot, 'package.json'), 'utf8'))
+  const versionSource = windowsCliLauncherVersionSource(version)
+  const fingerprint = windowsCliLauncherFingerprint(
+    [
+      sourcePath,
+      manifestPath,
+      iconPath,
+      join(repoRoot, 'config/scripts/build-windows-cli-launcher.mjs')
+    ],
+    version
+  )
   const outputPath = readArg('--output') ?? defaultOutputPath(repoRoot)
   const compilerPath = findFrameworkCompiler(process.env)
 
@@ -61,17 +91,26 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
   }
 
   mkdirSync(dirname(outputPath), { recursive: true })
-  if (
-    shouldReuseCompiledWindowsCliLauncher(outputPath, sourcePath, {
-      reuseCached: process.env.ORCA_REUSE_WINDOWS_CLI_LAUNCHER === '1'
-    })
-  ) {
+  if (shouldReuseCompiledWindowsCliLauncher(outputPath, fingerprint)) {
     console.log(`[native-build] reusing Windows CLI launcher at ${outputPath}`)
     process.exit(0)
   }
+  const versionPath = join(dirname(outputPath), 'OrcaCliLauncher.Version.cs')
+  writeFileSync(versionPath, versionSource)
+  rmSync(`${outputPath}.sha256`, { force: true })
   const result = spawnSync(
     compilerPath,
-    ['/nologo', '/target:exe', '/optimize+', '/warnaserror+', `/out:${outputPath}`, sourcePath],
+    [
+      '/nologo',
+      '/target:exe',
+      '/optimize+',
+      '/warnaserror+',
+      `/win32manifest:${manifestPath}`,
+      `/win32icon:${iconPath}`,
+      `/out:${outputPath}`,
+      sourcePath,
+      versionPath
+    ],
     { cwd: repoRoot, stdio: 'inherit' }
   )
 
@@ -84,4 +123,5 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
   if (result.status !== 0) {
     process.exit(result.status ?? 1)
   }
+  writeFileSync(`${outputPath}.sha256`, fingerprint)
 }
diff --git a/config/scripts/build-windows-cli-launcher.test.mjs b/config/scripts/build-windows-cli-launcher.test.mjs
index 82332897715..1e0f363acd0 100644
--- a/config/scripts/build-windows-cli-launcher.test.mjs
+++ b/config/scripts/build-windows-cli-launcher.test.mjs
@@ -5,7 +5,6 @@ import {
   mkdtempSync,
   readFileSync,
   rmSync,
-  statSync,
   utimesSync,
   writeFileSync
 } from 'node:fs'
@@ -13,7 +12,11 @@ import { tmpdir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { describe, expect, it } from 'vitest'
-import { shouldReuseCompiledWindowsCliLauncher } from './build-windows-cli-launcher.mjs'
+import {
+  shouldReuseCompiledWindowsCliLauncher,
+  windowsCliLauncherFingerprint,
+  windowsCliLauncherVersionSource
+} from './build-windows-cli-launcher.mjs'
 
 const itCrossHost = process.platform === 'win32' ? it.skip : it
 const projectRoot = resolve(import.meta.dirname, '../..')
@@ -40,33 +43,102 @@ function itWindows(name, test) {
 }
 
 describe('Windows CLI launcher', () => {
-  it('reuses a compiled launcher that is at least as new as the C# source', () => {
+  it('reuses restored builds only while all embedded inputs and the release version match', () => {
     const root = mkdtempSync(join(tmpdir(), 'orca-cli-launcher-reuse-'))
     try {
-      const sourcePath = join(root, 'OrcaCliLauncher.cs')
-      const outputPath = join(root, '.build', 'orca.exe')
-      mkdirSync(join(root, '.build'))
-      writeFileSync(sourcePath, 'source\n')
-      writeFileSync(outputPath, 'binary\n')
-      const later = new Date(statSync(sourcePath).mtimeMs + 1_000)
-      utimesSync(outputPath, later, later)
-
-      expect(shouldReuseCompiledWindowsCliLauncher(outputPath, sourcePath)).toBe(true)
-      writeFileSync(sourcePath, 'changed\n')
-      const sourceLater = new Date(statSync(outputPath).mtimeMs + 1_000)
-      utimesSync(sourcePath, sourceLater, sourceLater)
-      expect(shouldReuseCompiledWindowsCliLauncher(outputPath, sourcePath)).toBe(false)
+      const inputs = ['source.cs', 'app.manifest', 'icon.ico', 'build.mjs'].map((name) => {
+        const path = join(root, name)
+        writeFileSync(path, name)
+        return path
+      })
+      const outputPath = join(root, 'orca.exe')
+      const fingerprint = windowsCliLauncherFingerprint(inputs, '1.4.214')
+      expect(shouldReuseCompiledWindowsCliLauncher(outputPath, fingerprint)).toBe(false)
+      writeFileSync(outputPath, 'binary')
+      expect(shouldReuseCompiledWindowsCliLauncher(outputPath, fingerprint)).toBe(false)
+      writeFileSync(`${outputPath}.sha256`, fingerprint)
+      for (const input of inputs) {
+        utimesSync(input, new Date(), new Date())
+      }
       expect(
-        shouldReuseCompiledWindowsCliLauncher(outputPath, sourcePath, { reuseCached: true })
+        shouldReuseCompiledWindowsCliLauncher(
+          outputPath,
+          windowsCliLauncherFingerprint(inputs, '1.4.214')
+        )
       ).toBe(true)
-      expect(shouldReuseCompiledWindowsCliLauncher(join(root, 'missing.exe'), sourcePath)).toBe(
-        false
-      )
+      expect(
+        shouldReuseCompiledWindowsCliLauncher(
+          outputPath,
+          windowsCliLauncherFingerprint(inputs, '1.4.215')
+        )
+      ).toBe(false)
+      for (const input of inputs) {
+        const original = readFileSync(input)
+        writeFileSync(input, 'changed')
+        expect(
+          shouldReuseCompiledWindowsCliLauncher(
+            outputPath,
+            windowsCliLauncherFingerprint(inputs, '1.4.214')
+          )
+        ).toBe(false)
+        writeFileSync(input, original)
+      }
     } finally {
       removeFixtureTree(root)
     }
   })
 
+  it('keeps prerelease identity while emitting a valid Windows numeric version', () => {
+    const source = windowsCliLauncherVersionSource('1.4.214-daily.202609281300')
+    expect(source).toContain('AssemblyFileVersion("1.4.214.0")')
+    expect(source).toContain('AssemblyInformationalVersion("1.4.214-daily.202609281300")')
+    for (const version of ['1.4.65535', '1.4', '1.4.214"', undefined]) {
+      expect(() => windowsCliLauncherVersionSource(version)).toThrow('Invalid Windows')
+    }
+  })
+
+  itWindows(
+    'embeds publisher, release version, icon and an unelevated application manifest',
+    () => {
+      const root = mkdtempSync(join(tmpdir(), 'orca launcher metadata '))
+      try {
+        const launcherPath = join(root, 'orca.exe')
+        const build = spawnSync(
+          process.execPath,
+          ['config/scripts/build-windows-cli-launcher.mjs', '--output', launcherPath],
+          { cwd: projectRoot, encoding: 'utf8' }
+        )
+        expect(build.status, `${build.stdout}\n${build.stderr}`).toBe(0)
+        const inspect = spawnSync(
+          'powershell.exe',
+          [
+            '-NoProfile',
+            '-NonInteractive',
+            '-Command',
+            '[Diagnostics.FileVersionInfo]::GetVersionInfo($env:ORCA_TEST_LAUNCHER) | ConvertTo-Json -Compress'
+          ],
+          { encoding: 'utf8', env: { ...process.env, ORCA_TEST_LAUNCHER: launcherPath } }
+        )
+        expect(inspect.status, inspect.stderr).toBe(0)
+        const info = JSON.parse(inspect.stdout)
+        const { version } = JSON.parse(readFileSync(join(projectRoot, 'package.json'), 'utf8'))
+        expect(info.CompanyName).toBe('Stably AI')
+        expect(info.ProductName).toBe('Orca')
+        expect(info.FileDescription).toBe('Orca CLI Launcher')
+        expect(info.FileVersion).toBe(`${version.split(/[+-]/)[0]}.0`)
+        expect(info.ProductVersion).toBe(version)
+        const binary = readFileSync(launcherPath)
+        expect(binary.includes(Buffer.from('requestedExecutionLevel level="asInvoker"'))).toBe(true)
+        const icon = readFileSync(join(projectRoot, 'resources', 'build', 'icon.ico'))
+        const imageSize = icon.readUInt32LE(14)
+        const imageOffset = icon.readUInt32LE(18)
+        expect(binary.includes(icon.subarray(imageOffset, imageOffset + imageSize))).toBe(true)
+      } finally {
+        removeFixtureTree(root)
+      }
+    }
+  )
+
   itCrossHost('fails closed when the Windows launcher cannot be compiled on this host', () => {
     const outputRoot = mkdtempSync(join(tmpdir(), 'orca cross-host launcher '))
     try {
diff --git a/config/scripts/build-windows-process-tree-relay-addon.mjs b/config/scripts/build-windows-process-tree-relay-addon.mjs
index 526400be8f2..cc2472587a0 100644
--- a/config/scripts/build-windows-process-tree-relay-addon.mjs
+++ b/config/scripts/build-windows-process-tree-relay-addon.mjs
@@ -100,17 +100,21 @@ function assertPatchApplied() {
     ['src/process.cc', 'GetProcessTimes(hProcess, &creationTime'],
     ['src/process_worker.cc', 'object.Set("creationTimeMs"'],
     ['src/addon.cc', 'exports.Set("supportedProcessDataFlags"'],
+    ['src/addon.cc', 'exports.Set("getProcessCreationTime"'],
     ['lib/index.js', '["CreationTime"] = 4'],
     ['lib/index.js', 'exports.supportedProcessDataFlags'],
+    ['lib/index.js', 'exports.getProcessCreationTime'],
     ['lib/index.js', 'creationTimeMs,'],
     ['lib/index.ts', 'CreationTime = 4'],
     ['lib/index.ts', 'export const supportedProcessDataFlags'],
+    ['lib/index.ts', 'export const getProcessCreationTime'],
     ['lib/index.ts', 'creationTimeMs,'],
     ['typings/windows-process-tree.d.ts', 'creationTimeMs?: number'],
     // A regex because IProcessInfo declares the same field: only the tree node
     // is followed by `children`, and that is the one buildNode fills.
     ['typings/windows-process-tree.d.ts', /creationTimeMs\?: number;\r?\n\s*children:/],
-    ['typings/windows-process-tree.d.ts', 'export const supportedProcessDataFlags']
+    ['typings/windows-process-tree.d.ts', 'export const supportedProcessDataFlags'],
+    ['typings/windows-process-tree.d.ts', 'export const getProcessCreationTime']
   ]
   for (const [relativePath, expected] of requiredCreationTimeSources) {
     const source = readFileSync(join(PACKAGE_DIR, relativePath), 'utf8')
@@ -220,10 +224,41 @@ function repairCreationTimeSources() {
   })
 
   rewrite('src/addon.cc', (source, eol) => {
-    if (source.includes('exports.Set("supportedProcessDataFlags"')) {
-      return source
+    let next = source
+    if (!next.includes('Napi::Value ReadProcessCreationTime(')) {
+      const getter = [
+        'Napi::Value ReadProcessCreationTime(const Napi::CallbackInfo& args) {',
+        '  Napi::Env env(args.Env());',
+        '  if (args.Length() != 1 || !args[0].IsNumber()) {',
+        '    return env.Undefined();',
+        '  }',
+        '  const double pid = args[0].As<Napi::Number>().DoubleValue();',
+        '  if (!(pid >= 1 && pid <= MAXDWORD) || pid != static_cast<DWORD>(pid)) {',
+        '    return env.Undefined();',
+        '  }',
+        '  ProcessInfo pinfo{};',
+        '  pinfo.pid = static_cast<DWORD>(pid);',
+        '  GetProcessCreationTime(pinfo);',
+        '  if (pinfo.creationTimeMs == 0) {',
+        '    return env.Undefined();',
+        '  }',
+        '  return Napi::Number::New(env, static_cast<double>(pinfo.creationTimeMs));',
+        '}',
+        ''
+      ].join(eol)
+      next = next.replace('Napi::Object Init(', `${getter}${eol}Napi::Object Init(`)
     }
-    return source.replace(
+    if (!next.includes('exports.Set("getProcessCreationTime"')) {
+      next = next.replace(
+        '  exports.Set("getProcessList",',
+        `  exports.Set("getProcessCreationTime", Napi::Function::New(env, ReadProcessCreationTime));${eol}` +
+          '  exports.Set("getProcessList",'
+      )
+    }
+    if (next.includes('exports.Set("supportedProcessDataFlags"')) {
+      return next
+    }
+    return next.replace(
       /(  exports\.Set\("getProcessCpuUsage", Napi::Function::New\(env, GetProcessCpuUsage\)\);\r?\n)/,
       `$1  exports.Set("supportedProcessDataFlags",${eol}` +
         `              Napi::Number::New(env, MEMORY | COMMANDLINE | CREATIONTIME));${eol}`
@@ -254,6 +289,12 @@ function repairCreationTimeSources() {
           : 'exports.supportedProcessDataFlags = native === undefined ? undefined : native.supportedProcessDataFlags;'
         next = next.replace(NATIVE_CONST, `${NATIVE_CONST}${eol}${reExport}`)
       }
+      if (!next.includes('getProcessCreationTime')) {
+        const reExport = isTs
+          ? 'export const getProcessCreationTime: ((pid: number) => number | undefined) | undefined = native?.getProcessCreationTime;'
+          : 'exports.getProcessCreationTime = native === undefined ? undefined : native.getProcessCreationTime;'
+        next = next.replace(NATIVE_CONST, `${NATIVE_CONST}${eol}${reExport}`)
+      }
       // buildNode drops any field it does not name, so the destructure and the
       // splat have to move together.
       next = next.replace(/(memory, commandLine)( \}, children \})/, '$1, creationTimeMs$2')
@@ -279,6 +320,13 @@ function repairCreationTimeSources() {
           `  export const supportedProcessDataFlags: number | undefined;${eol}`
       )
     }
+    if (!next.includes('export const getProcessCreationTime')) {
+      next = next.replace(
+        '  export const supportedProcessDataFlags: number | undefined;',
+        '  export const supportedProcessDataFlags: number | undefined;' +
+          `${eol}  export const getProcessCreationTime: ((pid: number) => number | undefined) | undefined;`
+      )
+    }
     if (!next.includes('creationTimeMs?: number')) {
       next = next.replace(
         /    commandLine\?: string;\r?\n/,
diff --git a/config/scripts/bun-profile-change-scope.mjs b/config/scripts/bun-profile-change-scope.mjs
new file mode 100644
index 00000000000..dc464a5dc03
--- /dev/null
+++ b/config/scripts/bun-profile-change-scope.mjs
@@ -0,0 +1,135 @@
+import { build } from 'esbuild'
+import { appendFileSync, globSync, readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import {
+  externalNativeAddons,
+  ORCAD_CHILD_ENTRY_POINTS,
+  ORCAD_ENTRY_POINT
+} from './orcad-entry-build.mjs'
+import { bunProfileTestPaths } from './bun-profile-test-paths.mjs'
+import { bunProfileQualification } from './bun-profile-qualification.mjs'
+
+const ROOT = resolve(import.meta.dirname, '../..')
+const BUILD_SCRIPTS = [
+  'config/scripts/build-orcad-bun.mjs',
+  'config/scripts/build-orcad.mjs',
+  'config/scripts/build-windows-process-tree-relay-addon.mjs',
+  'config/scripts/run-bun-profile-tests.mjs',
+  'config/vitest.config.ts',
+  'config/scripts/happy-dom-offscreen-canvas.ts',
+  'config/scripts/happy-dom-mutation-observer-retention.ts',
+  'config/scripts/vitest-host-ports-setup.ts'
+]
+const ALWAYS_FILES = new Set([
+  'package.json',
+  'pnpm-lock.yaml',
+  'pnpm-workspace.yaml',
+  '.npmrc',
+  '.pnpmfile.cjs',
+  'tsconfig.json',
+  '.github/workflows/bun-profile-tests.yml',
+  'config/scripts/bun-profile-change-scope.mjs',
+  'config/scripts/bun-profile-change-scope.test.mjs',
+  'config/scripts/bun-profile-qualification.mjs',
+  'config/scripts/bun-profile-qualification.test.mjs'
+])
+const ALWAYS_PREFIXES = [
+  '.github/actions/install-node-dependencies/',
+  // These areas also contain worker paths and fixtures opened without an import.
+  'src/main/persistence/',
+  'src/main/sqlite/',
+  'src/main/orcad/',
+  'src/main/daemon/pty-subprocess/',
+  'src/main/providers/',
+  'config/patches/',
+  'config/tsconfig',
+  'native/',
+  'resources/licenses/ripgrep/'
+]
+
+export function discoverBunProfileTests(root = ROOT) {
+  const selectors = bunProfileTestPaths({ artifact: true })
+  return globSync(
+    ['src/**/*.test.{ts,tsx}', 'config/scripts/**/*.test.{ts,mjs}', 'tests/e2e/**/*.unit.test.ts'],
+    { cwd: root }
+  )
+    .map((file) => file.replaceAll('\\', '/'))
+    .filter((file) => selectors.some((selector) => file.includes(selector)))
+    .sort()
+}
+
+export async function collectBunProfileInputs({ root = ROOT, entryPoints } = {}) {
+  const entries = entryPoints ?? [
+    ORCAD_ENTRY_POINT,
+    ...Object.values(ORCAD_CHILD_ENTRY_POINTS),
+    ...BUILD_SCRIPTS,
+    ...discoverBunProfileTests(root)
+  ]
+  const result = await build({
+    absWorkingDir: root,
+    entryPoints: entries,
+    bundle: true,
+    write: false,
+    outdir: resolve(root, '.bun-profile-scope'),
+    platform: 'node',
+    format: 'esm',
+    splitting: true,
+    packages: 'external',
+    loader: { '.svg': 'empty', '.png': 'empty', '.webp': 'empty', '.css': 'empty' },
+    plugins: [externalNativeAddons],
+    metafile: true,
+    logLevel: 'silent'
+  })
+  if (result.warnings.length > 0) {
+    throw new Error(result.warnings.map((warning) => warning.text).join('\n'))
+  }
+  return new Set(
+    Object.keys(result.metafile.inputs).map((file) =>
+      file.replaceAll('\\', '/').replace(/\?.*$/, '')
+    )
+  )
+}
+
+export async function classifyBunProfileChanges(changedFiles, collect = collectBunProfileInputs) {
+  if (changedFiles.length === 0) {
+    return { shouldRun: true, reason: 'No complete changed-file evidence' }
+  }
+  const selectors = bunProfileTestPaths({ artifact: true })
+  const forced = changedFiles.find(
+    (file) =>
+      ALWAYS_FILES.has(file) ||
+      ALWAYS_PREFIXES.some((prefix) => file.startsWith(prefix)) ||
+      selectors.some((selector) => file.includes(selector))
+  )
+  if (forced) {
+    return { shouldRun: true, reason: `Build or CI input changed: ${forced}` }
+  }
+  try {
+    const inputs = await collect()
+    const matched = changedFiles.find((file) => inputs.has(file))
+    return {
+      shouldRun: Boolean(matched),
+      reason: matched ? `Runtime or test dependency changed: ${matched}` : 'No Bun inputs changed'
+    }
+  } catch (error) {
+    return {
+      shouldRun: true,
+      graphUnavailable: true,
+      reason: `Dependency graph unavailable: ${String(error)}`
+    }
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const changedFiles = readFileSync(process.argv[2], 'utf8').split('\0').filter(Boolean)
+  const result = await classifyBunProfileChanges(changedFiles)
+  console.log(result.reason)
+  const policy = bunProfileQualification(changedFiles, result)
+  const output = `should_run=${result.shouldRun}\nqualification=${policy.qualification}\nrunners=${JSON.stringify(policy.runners)}\n`
+  if (process.env.GITHUB_OUTPUT) {
+    appendFileSync(process.env.GITHUB_OUTPUT, output)
+  } else {
+    process.stdout.write(output)
+  }
+}
diff --git a/config/scripts/bun-profile-change-scope.test.mjs b/config/scripts/bun-profile-change-scope.test.mjs
new file mode 100644
index 00000000000..15258cea96d
--- /dev/null
+++ b/config/scripts/bun-profile-change-scope.test.mjs
@@ -0,0 +1,160 @@
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { afterEach, beforeAll, describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+import {
+  classifyBunProfileChanges,
+  collectBunProfileInputs,
+  discoverBunProfileTests
+} from './bun-profile-change-scope.mjs'
+import { bunProfileTestPaths } from './bun-profile-test-paths.mjs'
+import { ORCAD_CHILD_ENTRY_POINTS } from './orcad-entry-build.mjs'
+
+const temporaryDirs = []
+afterEach(() => {
+  for (const root of temporaryDirs.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+function moduleTree(files) {
+  const root = mkdtempSync(join(tmpdir(), 'bun-profile-scope-'))
+  temporaryDirs.push(root)
+  for (const [file, source] of Object.entries(files)) {
+    const path = join(root, file)
+    mkdirSync(join(path, '..'), { recursive: true })
+    writeFileSync(path, source)
+  }
+  return root
+}
+
+it('follows static imports, re-exports, dynamic imports and require without executing source', async () => {
+  const root = moduleTree({
+    'entry.ts': `import './first'; export * from './exports'; import('./dynamic'); require('./required'); throw Error('never execute')`,
+    'first.ts': `import './nested/leaf'`,
+    'exports.ts': 'export const value = 1',
+    'dynamic.ts': 'export const value = 2',
+    'required.ts': 'module.exports = 3',
+    'nested/leaf.ts': 'export const value = 4',
+    'unrelated.ts': 'throw Error("unrelated")'
+  })
+  const inputs = await collectBunProfileInputs({ root, entryPoints: ['entry.ts'] })
+  expect([...inputs].sort()).toEqual([
+    'dynamic.ts',
+    'entry.ts',
+    'exports.ts',
+    'first.ts',
+    'nested/leaf.ts',
+    'required.ts'
+  ])
+})
+
+it('runs the matrix when a dependency is deleted or graph analysis fails', async () => {
+  const root = moduleTree({ 'entry.ts': `import './deleted'` })
+  const result = await classifyBunProfileChanges(['deleted.ts'], () =>
+    collectBunProfileInputs({ root, entryPoints: ['entry.ts'] })
+  )
+  expect(result.shouldRun).toBe(true)
+  expect(result.reason).toContain('Dependency graph unavailable')
+  expect((await classifyBunProfileChanges([])).shouldRun).toBe(true)
+})
+
+it.each([
+  ['tests/e2e/daemon-running-work-probe.unit.test.ts'],
+  ['config/scripts/zip-extractor-command.test.mjs'],
+  ['config/scripts/zip-extractor-command.test.mjs', 'config/scripts/renamed-command.test.mjs']
+])(
+  'runs deleted or renamed selected tests even when absent from the graph: %j',
+  async (...files) => {
+    expect((await classifyBunProfileChanges(files, async () => new Set())).shouldRun).toBe(true)
+  }
+)
+
+it.each([
+  'package.json',
+  'pnpm-lock.yaml',
+  'pnpm-workspace.yaml',
+  '.npmrc',
+  'tsconfig.json',
+  'config/tsconfig.node.json',
+  'config/scripts/bun-profile-qualification.mjs',
+  'config/patches/node-pty@1.1.0.patch',
+  'native/windows-registry/src/addon.cc',
+  '.github/actions/install-node-dependencies/action.yml',
+  '.github/workflows/bun-profile-tests.yml',
+  'src/main/persistence/profile-state/new-worker.ts'
+])('always selects build, native and dynamically opened inputs: %s', async (file) => {
+  expect((await classifyBunProfileChanges([file], async () => new Set())).shouldRun).toBe(true)
+})
+
+describe('the actual Bun build and profile-test dependency graph', () => {
+  let inputs
+  beforeAll(async () => {
+    inputs = await collectBunProfileInputs()
+  }, 60_000)
+
+  it.each([
+    'config/scripts/ci-shard-timings.json',
+    'config/scripts/mobile-web-app-terminal-render.test.mjs',
+    'src/main/ssh/ssh-relay-upload-stage-commands.test.ts',
+    'src/main/menu/register-app-menu.ts'
+  ])('skips unrelated work: %s', async (file) => {
+    expect((await classifyBunProfileChanges([file], async () => inputs)).shouldRun).toBe(false)
+  })
+
+  it.each([
+    ...Object.values(ORCAD_CHILD_ENTRY_POINTS),
+    'src/shared/keybindings/definitions-core-1.ts',
+    'src/main/runtime/orca-runtime.ts',
+    'src/main/windows/windows-process-table.ts',
+    'src/main/worker-thread-entry-path.ts',
+    'config/scripts/zip-extractor-command.mjs',
+    'config/scripts/windows-process-tree-gyp-rebuild.mjs',
+    'config/scripts/profile-state-worker-smoke.mjs',
+    'config/scripts/vitest-host-ports-setup.ts',
+    'tests/e2e/daemon-running-work-probe.unit.test.ts'
+  ])('retains the full matrix for a real runtime, worker or test input: %s', async (file) => {
+    expect(inputs.has(file)).toBe(true)
+    expect((await classifyBunProfileChanges([file], async () => inputs)).shouldRun).toBe(true)
+  })
+
+  it('retains all selected tests and the selectors the Bun runner uses', () => {
+    const tests = discoverBunProfileTests()
+    expect(tests.length).toBeGreaterThan(80)
+    expect(tests.every((file) => inputs.has(file))).toBe(true)
+    expect(
+      bunProfileTestPaths().every((selector) => tests.some((file) => file.includes(selector)))
+    ).toBe(true)
+  })
+})
+
+it('keeps all ten platform jobs and runs them when detection is skipped or fails', () => {
+  const workflow = parse(
+    readFileSync(new URL('../../.github/workflows/bun-profile-tests.yml', import.meta.url), 'utf8')
+  )
+  expect(workflow.on).toHaveProperty('workflow_dispatch')
+  expect(workflow.jobs.changes.if).toBe("github.event_name == 'pull_request'")
+  expect(workflow.jobs.changes.steps[0].with['fetch-depth']).toBe(2)
+  expect(workflow.jobs.changes.steps[0].with['persist-credentials']).toBe(false)
+  const detect = workflow.jobs.changes.steps.find((step) => step.id === 'scope')
+  expect(detect.run).toContain('git diff --name-only --no-renames -z HEAD^1 HEAD')
+  expect(workflow.on.pull_request.types).toContain('ready_for_review')
+  expect(workflow.on.schedule).toHaveLength(1)
+  // A pull request may qualify one platform, so the merged commit must re-qualify all six.
+  expect(workflow.on.push.branches).toEqual(['main'])
+  expect(workflow.on.push.paths).toEqual(workflow.on.pull_request.paths)
+  // The push and schedule paths must not rest on a null property comparison.
+  expect(workflow.jobs.persistence.if).toContain(
+    "github.event_name != 'pull_request' || github.event.pull_request.draft != true"
+  )
+  expect(workflow.jobs.persistence.strategy.matrix.os).toContain('needs.changes.outputs.runners')
+  for (const jobName of ['linux_glibc_floor', 'linux_musl']) {
+    const job = workflow.jobs[jobName]
+    expect(job.needs).toEqual(['changes', 'persistence'])
+    expect(job.if).toContain("needs.persistence.result == 'success'")
+    expect(job.if).toContain("needs.changes.outputs.qualification != 'false'")
+    expect(job.if).toContain("needs.changes.outputs.should_run != 'false'")
+    expect(job.strategy.matrix.os).toEqual(['ubuntu-22.04', 'ubuntu-24.04-arm'])
+  }
+})
diff --git a/config/scripts/bun-profile-qualification.mjs b/config/scripts/bun-profile-qualification.mjs
new file mode 100644
index 00000000000..dafd137f95e
--- /dev/null
+++ b/config/scripts/bun-profile-qualification.mjs
@@ -0,0 +1,43 @@
+export const BUN_PERSISTENCE_RUNNERS = [
+  'ubuntu-22.04',
+  'ubuntu-24.04-arm',
+  'macos-14',
+  'macos-15-intel',
+  'windows-2022',
+  'windows-11-arm'
+]
+
+// Only surfaces whose behaviour actually differs per platform. Escalating on `config/`,
+// `resources/` and `.github/` wholesale took 36.5% of the last 1100 commits through all six
+// platforms where a platform-flavoured predicate takes 19%.
+const PLATFORM_PREFIXES = [
+  'native/',
+  'config/patches/',
+  '.github/actions/install-node-dependencies/',
+  'src/main/persistence/',
+  'src/main/sqlite/',
+  'src/main/orcad/',
+  'src/main/providers/',
+  'src/main/daemon/',
+  'src/main/ssh/',
+  'src/main/wsl/',
+  'src/relay/',
+  'src/shared/child-process/'
+]
+
+export function bunProfileQualification(changedFiles, scope) {
+  const platformSpecific = changedFiles.some(
+    (file) =>
+      // A root manifest can move a native dependency on every platform at once.
+      !file.includes('/') ||
+      PLATFORM_PREFIXES.some((prefix) => file.startsWith(prefix)) ||
+      /(?:^|[/.-])(?:windows|win32|wsl|macos|darwin|linux|posix|bun)(?:[/.-]|$)/i.test(file)
+  )
+  // A pull request qualifies one platform unless the change is platform-flavoured; the push to
+  // main re-qualifies all six, so an unescalated miss surfaces minutes after merge, not a day.
+  const full = changedFiles.length === 0 || scope.graphUnavailable === true || platformSpecific
+  return {
+    qualification: full,
+    runners: full ? BUN_PERSISTENCE_RUNNERS : ['ubuntu-22.04']
+  }
+}
diff --git a/config/scripts/bun-profile-qualification.test.mjs b/config/scripts/bun-profile-qualification.test.mjs
new file mode 100644
index 00000000000..520cd76fb21
--- /dev/null
+++ b/config/scripts/bun-profile-qualification.test.mjs
@@ -0,0 +1,56 @@
+import { expect, it } from 'vitest'
+import { BUN_PERSISTENCE_RUNNERS, bunProfileQualification } from './bun-profile-qualification.mjs'
+
+const scope = { shouldRun: true }
+
+it('qualifies one platform for a change no platform can alter', () => {
+  expect(bunProfileQualification(['src/main/runtime/rpc/methods/example.ts'], scope)).toEqual({
+    qualification: false,
+    runners: ['ubuntu-22.04']
+  })
+})
+
+it.each([
+  'src/renderer/src/components/TabStrip.tsx',
+  'config/vitest.config.ts',
+  'config/scripts/ci-unit-plan.mjs',
+  'resources/icons/tray.png',
+  '.github/workflows/pr.yml',
+  'docs/reference/agent-status-store.md'
+])('keeps one platform for unflavoured input %s', (file) => {
+  expect(bunProfileQualification([file], scope).runners).toEqual(['ubuntu-22.04'])
+})
+
+it.each([
+  'package.json',
+  'pnpm-lock.yaml',
+  'native/windows-registry/src/addon.cc',
+  'config/patches/node-pty.patch',
+  '.github/actions/install-node-dependencies/action.yml',
+  'src/main/ssh/ssh-provider.ts',
+  'src/main/providers/local-pty-provider.ts',
+  'src/shared/child-process/run-process.ts',
+  'src/main/persistence/profile-state/store.ts',
+  'src/main/sqlite/database.ts',
+  'src/main/orcad/entry.ts',
+  'src/main/runtime/windows-terminal.ts',
+  'src/shared/linux-glibc.ts',
+  'src/main/daemon/entry.ts',
+  'src/relay/index.ts',
+  'src/main/wsl/runner.ts'
+])('retains all platforms for platform-flavoured input %s', (file) => {
+  expect(bunProfileQualification([file], scope)).toEqual({
+    qualification: true,
+    runners: BUN_PERSISTENCE_RUNNERS
+  })
+})
+
+it('fails closed to every platform when the evidence is incomplete', () => {
+  expect(bunProfileQualification([], scope).qualification).toBe(true)
+  expect(
+    bunProfileQualification(['src/main/runtime/rpc/methods/example.ts'], {
+      ...scope,
+      graphUnavailable: true
+    }).qualification
+  ).toBe(true)
+})
diff --git a/config/scripts/bun-profile-test-paths.mjs b/config/scripts/bun-profile-test-paths.mjs
new file mode 100644
index 00000000000..23c8f423acd
--- /dev/null
+++ b/config/scripts/bun-profile-test-paths.mjs
@@ -0,0 +1,24 @@
+export function bunProfileTestPaths({ artifact = false } = {}) {
+  return [
+    'src/main/persistence/profile-state',
+    'src/main/persistence/loading-store/profile-state',
+    'src/main/sqlite',
+    'src/main/orcad/orcad-entry.test.ts',
+    'src/main/orcad/orcad-push-startup.test.ts',
+    ...(artifact
+      ? [
+          'src/main/daemon/pty-subprocess/bun-pty-process.integration.test.ts',
+          'src/main/daemon/pty-subprocess/bun-pty-job-control.integration.test.ts',
+          'src/main/daemon/pty-subprocess/bun-pty-process-suspension.test.ts',
+          'src/main/daemon/pty-subprocess-spawn-file-foreground.test.ts',
+          'src/main/daemon/pty-subprocess/spawn-file-foreground-rejected-agents.test.ts',
+          'tests/e2e/daemon-running-work-probe.unit.test.ts',
+          'src/main/daemon/pty-subprocess/windows-bun-pty-gate.integration.test.ts',
+          'src/main/providers/local-pty-bun-artifact.integration.test.ts',
+          'src/main/providers/agent-foreground-process-git-bash.win32.test.ts',
+          'src/main/orcad/orcad-bun-launcher.integration.test.ts',
+          'config/scripts/zip-extractor-command.test.mjs'
+        ]
+      : [])
+  ]
+}
diff --git a/config/scripts/check-changed-code-quality.mjs b/config/scripts/check-changed-code-quality.mjs
index a49ad1ddb51..71a512ad407 100644
--- a/config/scripts/check-changed-code-quality.mjs
+++ b/config/scripts/check-changed-code-quality.mjs
@@ -136,9 +136,14 @@ function resolveBase(root, requestedBase) {
 }
 
 export function collectAddedLineRanges(root, requestedBase) {
-  const base = resolveBase(root, requestedBase)
-  const mergeBase = runGit(root, ['merge-base', base, 'HEAD']).trim()
-  const comparisonBase = resolvePullRequestDiffBase(root, mergeBase)
+  // On a pull_request checkout HEAD is the merge commit, so its first parent is the base side and
+  // no merge base has to be computed. Resolving it first is what lets CI checkout shallowly: the
+  // payload base SHA can lag HEAD^1 by any number of commits and need not be in the graph at all.
+  // Off that ref (local runs) the requested base is an arbitrary branch tip, so the merge base is
+  // still what isolates this branch's own lines.
+  const comparisonBase =
+    resolvePullRequestDiffBase(root, null) ??
+    runGit(root, ['merge-base', resolveBase(root, requestedBase), 'HEAD']).trim()
   const changedFiles = splitNullDelimited(
     runGit(root, ['diff', '--name-only', '-z', '--diff-filter=ACMRTUB', comparisonBase, '--'])
   )
@@ -174,7 +179,7 @@ export function collectAddedLineRanges(root, requestedBase) {
     const lineCount = readFileSync(absolutePath, 'utf8').split(/\r?\n/).length
     rangesByFile.set(file, [{ start: 1, end: lineCount }])
   }
-  return { base, comparisonBase, rangesByFile }
+  return { comparisonBase, rangesByFile }
 }
 
 function parseOxlintOutput(stdout, label) {
@@ -414,10 +419,12 @@ export function main(
   root = process.cwd(),
   requestedBase = process.argv.slice(2).find((argument) => argument !== '--')
 ) {
-  const { base, comparisonBase, rangesByFile } = collectAddedLineRanges(root, requestedBase)
+  const { comparisonBase, rangesByFile } = collectAddedLineRanges(root, requestedBase)
   const files = [...rangesByFile.keys()]
   if (files.length === 0) {
-    console.log(`Changed-code quality gate: no changed JavaScript or TypeScript since ${base}.`)
+    console.log(
+      `Changed-code quality gate: no changed JavaScript or TypeScript since ${comparisonBase.slice(0, 12)}.`
+    )
     return 0
   }
 
diff --git a/config/scripts/check-readme-local-links.test.mjs b/config/scripts/check-readme-local-links.test.mjs
index 2f7cfc76c92..e1d69723ee5 100644
--- a/config/scripts/check-readme-local-links.test.mjs
+++ b/config/scripts/check-readme-local-links.test.mjs
@@ -1,5 +1,5 @@
 import { execFileSync } from 'node:child_process'
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -75,6 +75,25 @@ describe('README local link check', () => {
     expect(findBrokenReadmeLinks(makeFixture(validReadmes))).toEqual([])
   })
 
+  it('checks tracked media outside the detector sparse checkout', () => {
+    const root = makeFixture(validReadmes)
+    const workflow = parse(readFileSync(path.join(projectDir, '.github/workflows/pr.yml'), 'utf8'))
+    const checkout = workflow.jobs.code_paths.steps.find((step) =>
+      step.uses?.startsWith('actions/checkout@')
+    )
+    const patterns = checkout.with['sparse-checkout'].trim().split('\n')
+    expect(checkout.with['sparse-checkout-cone-mode']).toBe(false)
+    git(root, ['sparse-checkout', 'set', '--no-cone', ...patterns])
+
+    expect(existsSync(path.join(root, 'resources/build/icon.png'))).toBe(false)
+    expect(findBrokenReadmeLinks(root)).toEqual([])
+    git(root, ['update-index', '--force-remove', 'resources/build/icon.png'])
+    expect(findBrokenReadmeLinks(root).map((link) => link.resolved)).toEqual([
+      'resources/build/icon.png',
+      'resources/build/icon.png'
+    ])
+  })
+
   it('reports a deleted media file for the root and translated READMEs', () => {
     const { 'docs/site/public/docs/tab-split.gif': _gif, ...files } = validReadmes
     vi.spyOn(console, 'error').mockImplementation(() => {})
@@ -139,14 +158,15 @@ describe('README local link check', () => {
 
   // Why the ungated job: static_analysis is skipped for docs-only diffs, which is
   // exactly the kind of PR that deletes a docs-site GIF the README embeds.
-  it('runs on every PR through the ungated guard job and in the lint script', () => {
+  it('runs on every PR through the ungated detector and in the lint script', () => {
     const { scripts } = JSON.parse(readFileSync(path.join(projectDir, 'package.json'), 'utf8'))
     const workflow = parse(readFileSync(path.join(projectDir, '.github/workflows/pr.yml'), 'utf8'))
-    const guardJob = workflow.jobs.root_directory_guard
+    const guardJob = workflow.jobs.code_paths
     const step = guardJob.steps.find((candidate) => candidate.name === 'Check README local links')
 
     expect(guardJob.if).toBeUndefined()
     expect(guardJob.needs).toBeUndefined()
+    expect(step.if).toBeUndefined()
     expect(step.run).toBe('node config/scripts/check-readme-local-links.mjs')
     expect(scripts['check:readme-local-links']).toBe(
       'node config/scripts/check-readme-local-links.mjs'
diff --git a/config/scripts/check-root-directory-entries.test.mjs b/config/scripts/check-root-directory-entries.test.mjs
index dcc5596771b..6de07a053c7 100644
--- a/config/scripts/check-root-directory-entries.test.mjs
+++ b/config/scripts/check-root-directory-entries.test.mjs
@@ -221,14 +221,21 @@ describe('root directory guard', () => {
 
   it('is wired into the PR verify gate', () => {
     const workflow = parse(readFileSync(join(projectDir, '.github/workflows/pr.yml'), 'utf8'))
-    const guardJob = workflow.jobs.root_directory_guard
+    const guardJob = workflow.jobs.code_paths
     const guardStep = guardJob.steps.find(
       (step) => step.name === 'Reject new root-level files and folders'
     )
 
-    expect(guardJob.name).toBe('root directory guard')
-    expect(guardJob.steps[0].with['fetch-depth']).toBe(0)
+    expect(guardJob.if).toBeUndefined()
+    expect(guardStep.if).toBeUndefined()
+    // Why >= 2 rather than 0: the guard compares the merge commit's first parent against the
+    // merged tree, so it needs both parents present but no history beyond them. Depth 1 would
+    // leave HEAD^1 unreachable and the guard would fail closed on every run.
+    expect(guardJob.steps[0].with['fetch-depth']).toBeGreaterThanOrEqual(2)
     expect(guardStep.run).toContain('node .github/scripts/check-root-directory-entries.mjs')
-    expect(workflow.jobs.verify.needs).toContain('root_directory_guard')
+    // The base side must come from the merge ref, not the event payload, or a shallow checkout
+    // cannot resolve it.
+    expect(guardStep.run).toContain('git-pull-request-diff-base.mjs')
+    expect(workflow.jobs.verify.needs).toContain('code_paths')
   })
 })
diff --git a/config/scripts/ci-background-step-barriers.test.mjs b/config/scripts/ci-background-step-barriers.test.mjs
new file mode 100644
index 00000000000..f731d9d08cb
--- /dev/null
+++ b/config/scripts/ci-background-step-barriers.test.mjs
@@ -0,0 +1,148 @@
+import { readFileSync } from 'node:fs'
+import { parse } from 'yaml'
+import { describe, expect, it } from 'vitest'
+
+const pr = parse(readFileSync('.github/workflows/pr.yml', 'utf8'))
+const mobile = parse(readFileSync('.github/workflows/mobile.yml', 'utf8'))
+const cloud = parse(readFileSync('.github/workflows/cloud-verify.yml', 'utf8'))
+
+function assertJoinedBefore(steps, id, consumer) {
+  const start = steps.findIndex((step) => step.id === id)
+  const join = steps.findIndex((step) => [step.wait].flat().includes(id))
+  const end = steps.findIndex(consumer)
+  expect(start).toBeGreaterThanOrEqual(0)
+  expect(steps[start].background).toBe(true)
+  expect(join).toBeGreaterThan(start)
+  expect(end).toBeGreaterThan(join)
+}
+
+describe('CI background step barriers', () => {
+  it('joins every background check without suppressing failures', () => {
+    for (const job of [
+      pr.jobs.static_analysis,
+      pr.jobs.mobile_web_app,
+      pr.jobs.package,
+      pr.jobs.shell_contracts,
+      mobile.jobs.verify,
+      cloud.jobs.security
+    ]) {
+      const pending = new Set()
+      for (const step of job.steps) {
+        if (step.background) {
+          expect(step.id).toBeTruthy()
+          expect(pending.has(step.id)).toBe(false)
+          expect(step['continue-on-error']).toBeUndefined()
+          pending.add(step.id)
+        }
+        if (step.wait) {
+          expect(step.if).toBeUndefined()
+          expect(step['continue-on-error']).toBeUndefined()
+          for (const id of [step.wait].flat()) {
+            expect(pending.delete(id), `missing background step ${id}`).toBe(true)
+          }
+        }
+        expect(pending.size).toBeLessThanOrEqual(job === pr.jobs.package ? 4 : 3)
+      }
+      expect([...pending]).toEqual([])
+    }
+  })
+
+  it('finishes native import-cycle analysis before mobile installation changes resolution', () => {
+    const steps = pr.jobs.static_analysis.steps
+    assertJoinedBefore(steps, 'native-code-quality', (step) =>
+      step.uses?.endsWith('/install-mobile-dependencies')
+    )
+    const install = steps.findIndex((step) => step.uses?.endsWith('/install-mobile-dependencies'))
+    expect(steps[install].background).toBeUndefined()
+    expect(steps.findIndex((step) => step.id === 'changed-code-quality')).toBeGreaterThan(install)
+  })
+
+  it('finishes both mobile typechecks before allocating test workers', () => {
+    const steps = mobile.jobs.verify.steps
+    assertJoinedBefore(steps, 'production-types', (step) => step.name === 'Test')
+    const ratchet = steps.findIndex((step) => step.name === 'Typecheck tests (ratchet)')
+    const join = steps.findIndex((step) => step.wait === 'production-types')
+    expect(steps[ratchet].background).toBeUndefined()
+    expect(ratchet).toBeLessThan(join)
+  })
+
+  it('waits for WebKit and the bundle before any browser tests', () => {
+    const steps = pr.jobs.mobile_web_app.steps
+    assertJoinedBefore(
+      steps,
+      'webkit',
+      (step) => step.name === 'Builder, override census and render checks'
+    )
+    const build = steps.findIndex((step) => step.name === 'Build and verify the app bundle')
+    expect(steps[build].background).toBeUndefined()
+    expect(build).toBeLessThan(steps.findIndex((step) => [step.wait].flat().includes('webkit')))
+    expect(steps.findIndex((step) => step.id === 'webkit')).toBeLessThan(build)
+  })
+
+  it('joins shell installation before checking fish and running live shell tests', () => {
+    const steps = pr.jobs.shell_contracts.steps
+    assertJoinedBefore(steps, 'shells', (step) => step.name === 'Require fish 4+')
+    assertJoinedBefore(steps, 'shells', (step) => step.name === 'Test real shell contracts')
+    const install = steps.findIndex((step) => step.uses?.endsWith('/install-node-dependencies'))
+    expect(install).toBeGreaterThan(steps.findIndex((step) => step.id === 'shells'))
+    expect(install).toBeLessThan(steps.findIndex((step) => step.wait === 'shells'))
+  })
+
+  it('prepares fresh mobile routes after dependencies and before the browser tests', () => {
+    const steps = pr.jobs.mobile_web_app.steps
+    assertJoinedBefore(
+      steps,
+      'mobile-routes',
+      (step) => step.name === 'Builder, override census and render checks'
+    )
+    const prepare = steps.findIndex((step) => step.id === 'mobile-routes')
+    expect(prepare).toBeGreaterThan(
+      steps.findIndex((step) => step.uses?.endsWith('/install-mobile-dependencies'))
+    )
+    expect(prepare).toBeLessThan(
+      steps.findIndex((step) => step.name === 'Build and verify the app bundle')
+    )
+  })
+
+  it('joins package setup before reading outputs and preserves isolated native probes', () => {
+    const steps = pr.jobs.package.steps
+    // Parallel composites must not race to download their shared cache action on first use.
+    const cacheAction = steps.findIndex((step) => step.uses === 'actions/cache/restore@v5')
+    expect(cacheAction).toBeGreaterThanOrEqual(0)
+    expect(cacheAction).toBeLessThan(
+      steps.findIndex((step) => step.id === 'shutdown-fixture-cache')
+    )
+    for (const [id, consumer] of [
+      ['linux-package-tools', 'Package unpacked app'],
+      ['web-client', 'Package unpacked app'],
+      ['shutdown-fixture-cache', 'Verify headless serve signal shutdown'],
+      ['cli-fixture-cache', 'Verify Linux CLI launch contract']
+    ]) {
+      assertJoinedBefore(steps, id, (step) => step.name === consumer)
+      expect(steps.findIndex((step) => step.id === id)).toBeGreaterThan(
+        steps.findIndex((step) => step.name === 'Test Linux Electron lifecycle boundary')
+      )
+    }
+  })
+
+  it('joins digest-pinned scanner downloads and the history scan without hiding failures', () => {
+    const steps = cloud.jobs.security.steps
+    const history = steps.findIndex((step) => step.name === 'Fetch complete scan history')
+    for (const [id, imageName] of [
+      ['gitleaks-image', 'gitleaks'],
+      ['trufflehog-image', 'trufflehog']
+    ]) {
+      const download = steps.find((step) => step.id === id)
+      const scan = steps.find(
+        (step) => step.run?.includes('docker run') && step.run.includes(imageName)
+      )
+      const digestImage = scan.run.match(/\S+@sha256:[a-f0-9]{64}/)[0]
+      expect(download.run).toBe(`docker pull ${digestImage}`)
+      expect(steps.indexOf(download)).toBeLessThan(history)
+      assertJoinedBefore(steps, id, (step) => step === scan)
+      expect(steps.indexOf(scan)).toBeGreaterThan(history)
+      expect(scan.run).toContain('/repo:ro')
+    }
+    expect(steps.at(-1).wait).toBe('history-scan')
+  })
+})
diff --git a/config/scripts/ci-cache-warmup-workflow.test.mjs b/config/scripts/ci-cache-warmup-workflow.test.mjs
new file mode 100644
index 00000000000..322cf982d82
--- /dev/null
+++ b/config/scripts/ci-cache-warmup-workflow.test.mjs
@@ -0,0 +1,81 @@
+import { readFileSync } from 'node:fs'
+import { expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { BUN_PERSISTENCE_RUNNERS } from './bun-profile-qualification.mjs'
+
+const readWorkflow = (name) =>
+  parse(readFileSync(new URL(`../../.github/workflows/${name}.yml`, import.meta.url), 'utf8'))
+const workflow = readWorkflow('ci-cache-warmup')
+const steps = workflow.jobs.warm.steps
+
+it('warms the same Linux Node runtime the PR shards restore', () => {
+  const arm = workflow.jobs['warm-linux-arm']
+  const install = arm.steps.find(
+    (step) => step.uses === './.github/actions/install-node-dependencies'
+  )
+  const primer = readWorkflow('pr').jobs.test_native_cache
+  expect(arm['runs-on']).toBe(primer['runs-on'])
+  expect(arm.steps.at(-1).run).toBe('node config/scripts/ensure-native-runtime.mjs --check-only')
+  expect(install.with).toMatchObject(primer.steps.find((step) => step.uses === install.uses).with)
+})
+
+it('populates shared Electron archives on both Linux architectures without changing the Node ABI', () => {
+  for (const name of ['warm', 'warm-linux-arm']) {
+    const steps = workflow.jobs[name].steps
+    const install = steps.find(
+      (step) => step.uses === './.github/actions/install-node-dependencies'
+    )
+    expect(install.with['native-runtime']).toBe('node')
+    expect(install.with['cache-electron-package']).toBe('true')
+    const populate = steps.find((step) => step.name === 'Populate shared Electron archive')
+    expect(populate.run).toBe('node config/scripts/install-electron-package-binary.mjs')
+    expect(steps.indexOf(populate)).toBeGreaterThan(steps.indexOf(install))
+  }
+})
+
+it('publishes incremental state under a key and prefix that new PRs restore', () => {
+  const cache = steps.find((step) => step.id === 'typecheck-cache')
+  const prCache = readWorkflow('pr').jobs.typecheck.steps.find((step) => step.name === cache.name)
+  expect(cache.with.path).toBe(prCache.with.path)
+  expect(cache.with['restore-keys']).toBe(prCache.with['restore-keys'])
+  expect(cache.with.key).toBe(
+    prCache.with.key.replace('github.event.pull_request.base.sha', 'github.sha')
+  )
+  const check = steps.find((step) => step.run === 'pnpm run typecheck')
+  expect(check.if).toBe("steps.typecheck-cache.outputs.cache-hit != 'true'")
+  expect(steps.indexOf(check)).toBeGreaterThan(steps.indexOf(cache))
+})
+
+it('bounds warming to the required platforms and validates changes without granting writes', () => {
+  expect(Object.keys(workflow.jobs)).toEqual([
+    'warm',
+    'warm-linux-arm',
+    'warm-windows',
+    'warm-linux-package-fixtures'
+  ])
+  expect(workflow.jobs.warm['timeout-minutes']).toBeLessThanOrEqual(10)
+  expect(workflow.permissions).toEqual({ contents: 'read' })
+  expect(workflow.on.push.branches).toEqual(['main'])
+  expect(workflow.on.schedule).toEqual([{ cron: '41 * * * *' }])
+  expect(workflow.on.pull_request.paths).toContain('.github/workflows/ci-cache-warmup.yml')
+  expect(workflow.concurrency['cancel-in-progress']).toBe(true)
+  expect(workflow.concurrency.group).toContain('github.event.pull_request.number || github.ref')
+  expect(steps[0].with['persist-credentials']).toBe(false)
+})
+
+it('warms and probes both Windows images with the persistence job runtime', () => {
+  const job = workflow.jobs['warm-windows']
+  expect(job.strategy.matrix.os).toEqual(
+    BUN_PERSISTENCE_RUNNERS.filter((os) => os.startsWith('windows-'))
+  )
+  expect(job['runs-on']).toBe('${{ matrix.os }}')
+  expect(job.strategy['fail-fast']).toBe(false)
+  expect(job['timeout-minutes']).toBeLessThanOrEqual(20)
+  expect(job.env.ORCA_BACKGROUND_LAUNCH).toBe('1')
+  expect(job.steps[0].with['persist-credentials']).toBe(false)
+  const install = job.steps.find(
+    (step) => step.uses === './.github/actions/install-node-dependencies'
+  )
+  expect(install.with).toEqual({ 'native-runtime': 'node' })
+  expect(job.steps.at(-1).run).toBe('node config/scripts/ensure-native-runtime.mjs --check-only')
+})
diff --git a/config/scripts/ci-closed-pr-caches.test.mjs b/config/scripts/ci-closed-pr-caches.test.mjs
new file mode 100644
index 00000000000..44edb5e48df
--- /dev/null
+++ b/config/scripts/ci-closed-pr-caches.test.mjs
@@ -0,0 +1,57 @@
+import { readFileSync } from 'node:fs'
+import { runInNewContext } from 'node:vm'
+import { expect, it, vi } from 'vitest'
+import { parse } from 'yaml'
+
+const workflow = parse(readFileSync('.github/workflows/ci-closed-pr-caches.yml', 'utf8'))
+const script = workflow.jobs.clean.steps[0].with.script
+const ref = 'refs/pull/123/merge'
+
+function run(caches, remove = vi.fn().mockResolvedValue(undefined)) {
+  const list = vi.fn()
+  const paginate = vi.fn().mockResolvedValue(caches)
+  const result = runInNewContext(`(async () => { ${script} })()`, {
+    context: { repo: { owner: 'owner', repo: 'repo' }, payload: { pull_request: { number: 123 } } },
+    github: {
+      paginate,
+      rest: { actions: { getActionsCacheList: list, deleteActionsCacheById: remove } }
+    },
+    core: { info: vi.fn() }
+  })
+  return { result, remove, paginate, list }
+}
+
+it('uses default-branch code without checking out a closed PR', () => {
+  expect(workflow.on).toEqual({ pull_request_target: { types: ['closed'] } })
+  expect(workflow.permissions).toEqual({ actions: 'write' })
+  expect(workflow.jobs.clean.steps).toHaveLength(1)
+  expect(workflow.jobs.clean.steps[0].uses).toBe('actions/github-script@v8')
+})
+
+it('lists and deletes only caches scoped to the closed merge ref', async () => {
+  const { result, paginate, list, remove } = run([
+    { id: 12, ref },
+    { id: 13, ref }
+  ])
+  await result
+  expect(paginate).toHaveBeenCalledWith(list, { owner: 'owner', repo: 'repo', ref, per_page: 100 })
+  expect(remove.mock.calls).toEqual([
+    [{ owner: 'owner', repo: 'repo', cache_id: 12 }],
+    [{ owner: 'owner', repo: 'repo', cache_id: 13 }]
+  ])
+})
+
+it('refuses a default-branch cache even if the API returns one', async () => {
+  const { result, remove } = run([{ id: 12, ref: 'refs/heads/main' }])
+  await expect(result).rejects.toThrow('Unexpected cache ref')
+  expect(remove).not.toHaveBeenCalled()
+})
+
+it('tolerates an eviction race but surfaces permission failures', async () => {
+  await expect(
+    run([{ id: 12, ref }], vi.fn().mockRejectedValue({ status: 404 })).result
+  ).resolves.toBeUndefined()
+  await expect(
+    run([{ id: 12, ref }], vi.fn().mockRejectedValue({ status: 403 })).result
+  ).rejects.toEqual({ status: 403 })
+})
diff --git a/config/scripts/ci-dependency-download-cache.test.mjs b/config/scripts/ci-dependency-download-cache.test.mjs
index 0860b53ebca..ce628cc7c45 100644
--- a/config/scripts/ci-dependency-download-cache.test.mjs
+++ b/config/scripts/ci-dependency-download-cache.test.mjs
@@ -10,8 +10,9 @@ describe('CI dependency download caches', () => {
   it('scopes desktop stores to the root lockfile and lets mixed installs opt in', () => {
     expect(action.inputs['cache-dependency-path'].default).toBe('pnpm-lock.yaml')
     for (const step of action.runs.steps.filter((step) => step.uses === 'actions/setup-node@v6')) {
-      expect(step.with.cache).toBe('pnpm')
+      expect(step.with.cache).toBe("${{ github.event_name != 'pull_request' && 'pnpm' || '' }}")
       expect(step.with['cache-dependency-path']).toBe('${{ inputs.cache-dependency-path }}')
+      expect(step.with['package-manager-cache']).toBe(false)
     }
     const install = action.runs.steps.find((step) => step.name === 'Install dependencies')
     expect(install.if).toBeUndefined()
@@ -27,6 +28,103 @@ describe('CI dependency download caches', () => {
       'mobile/pnpm-lock.yaml'
     ])
   })
+
+  it('restores PR stores with setup-node keys without registering a post-job save', () => {
+    const resolve = action.runs.steps.find((step) => step.id === 'pnpm-store')
+    const restore = action.runs.steps.find(
+      (step) => step.name === 'Restore pnpm download store without saving'
+    )
+    expect(resolve.if).toBe("github.event_name == 'pull_request'")
+    expect(restore.if).toBe(resolve.if)
+    expect(restore.uses).toBe('actions/cache/restore@v5')
+    expect(restore.with.path).toBe('${{ steps.pnpm-store.outputs.path }}')
+    expect(restore.with.key).toBe(
+      'node-cache-${{ runner.os }}-${{ steps.pnpm-store.outputs.arch }}-pnpm-${{ hashFiles(inputs.cache-dependency-path) }}'
+    )
+    expect(restore.with['restore-keys']).toBeUndefined()
+    expect(resolve.env.LOCKFILE_HASH).toBe('${{ hashFiles(inputs.cache-dependency-path) }}')
+    expect(action.runs.steps.indexOf(resolve)).toBeLessThan(action.runs.steps.indexOf(restore))
+    expect(action.runs.steps.indexOf(restore)).toBeLessThan(
+      action.runs.steps.findIndex((step) => step.name === 'Install dependencies')
+    )
+    const saves = action.runs.steps.filter((step) => step.uses === 'actions/cache/save@v5')
+    expect(saves).toHaveLength(1)
+    expect(saves[0].name).toBe('Save pnpm verification record on main')
+    expect(saves[0].if).toContain("github.ref == 'refs/heads/main'")
+    expect(saves[0].if).toContain("github.event_name != 'pull_request'")
+    expect(saves[0].with.path).toBe('${{ steps.verification-cache.outputs.path }}')
+  })
+
+  it('restores Windows packaging downloads from the release cache without a PR upload', () => {
+    const packaging = workflow('pr').jobs.package_windows
+    const restore = packaging.steps.find((step) => step.name === 'Cache electron-builder downloads')
+    const release = workflow('release-cut').jobs.build
+    const windows = release.strategy.matrix.include.find((entry) => entry.platform === 'win')
+    const save = release.steps.find((step) => step.name === 'Cache electron-builder downloads')
+
+    expect(packaging['runs-on']).toBe(windows.os)
+    expect(restore.uses).toBe('actions/cache/restore@v5')
+    // Cache versions include the path list, so matching key strings alone cannot prove reuse.
+    expect(restore.with.path).toBe(windows.eb_cache_path)
+    expect(restore.with.key).toBe(save.with.key.replace('${{ matrix.platform }}', 'win'))
+    expect(restore.with['restore-keys']).toBe(
+      save.with['restore-keys'].replace('${{ matrix.platform }}', 'win')
+    )
+    expect(save.uses).toBe('actions/cache@v5')
+    expect(save.with.path).toBe('${{ matrix.eb_cache_path }}')
+    for (const name of ['dev-channel-win-build', 'windows-signing-rehearsal']) {
+      const writer = Object.values(workflow(name).jobs)
+        .flatMap((job) => job.steps ?? [])
+        .find((step) => step.name === 'Cache electron-builder downloads')
+      expect(writer.uses, name).toBe('actions/cache@v5')
+      expect(writer.with.path, name).toBe(restore.with.path)
+      expect(writer.with.key, name).toBe(restore.with.key)
+      expect(writer.with['restore-keys'], name).toBe(restore.with['restore-keys'])
+    }
+  })
+
+  it('seeds the existing Linux PR tool cache from successful main x64 release builds', () => {
+    const packaging = workflow('pr').jobs.package
+    const consumer = packaging.steps.find(
+      (step) => step.name === 'Cache electron-builder downloads'
+    )
+    const release = workflow('release-cut').jobs.build
+    const combined = release.steps.find((step) => step.name === 'Cache electron-builder downloads')
+    const writer = release.steps.find(
+      (step) => step.name === 'Seed shared Linux packaging downloads'
+    )
+    const linux = release.strategy.matrix.include.find((entry) => entry.platform === 'linux-x64')
+
+    expect(packaging['runs-on']).toBe(linux.os)
+    expect(writer.if).toBe("matrix.platform == 'linux-x64' && github.ref == 'refs/heads/main'")
+    expect(writer.uses).toBe('actions/cache@v5')
+    expect(writer.with.path).toBe(consumer.with.path)
+    expect(writer.with.key).toBe(consumer.with.key)
+    expect(writer.with['restore-keys']).toBeUndefined()
+    expect(writer.with['lookup-only']).toBe(true)
+    expect(release.steps.indexOf(writer)).toBeGreaterThan(release.steps.indexOf(combined))
+    expect(consumer.uses).toBe('actions/cache/restore@v5')
+    expect(consumer.with['restore-keys'].trim()).toBe('electron-builder-linux-')
+    expect(combined.uses).toBe('actions/cache@v5')
+    expect(linux.eb_cache_path.trim().split('\n')).toEqual([
+      '~/.cache/electron',
+      '~/.cache/electron-builder'
+    ])
+  })
+})
+
+it('shares Electron archives with PRs without uploading PR-local copies', () => {
+  const save = action.runs.steps.find((step) => step.name === 'Cache Electron package archive')
+  const restore = action.runs.steps.find(
+    (step) => step.name === 'Restore Electron package archive without saving'
+  )
+  expect(save.if).toContain("github.event_name != 'pull_request' || runner.os != 'Linux'")
+  expect(restore.if).toContain("github.event_name == 'pull_request' && runner.os == 'Linux'")
+  expect(save.if).toContain("steps.electron-package-cache.outputs.version != ''")
+  expect(restore.if).toContain("steps.electron-package-cache.outputs.version != ''")
+  expect(save.uses).toBe('actions/cache@v5')
+  expect(restore.uses).toBe('actions/cache/restore@v5')
+  expect(restore.with).toEqual(save.with)
 })
 
 describe('release install targets', () => {
diff --git a/config/scripts/ci-e2e-failure-summary.mjs b/config/scripts/ci-e2e-failure-summary.mjs
new file mode 100644
index 00000000000..f95fed20dac
--- /dev/null
+++ b/config/scripts/ci-e2e-failure-summary.mjs
@@ -0,0 +1,92 @@
+import { appendFileSync, readFileSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
+import { trackE2eFailures } from './ci-e2e-failure-tracking.mjs'
+
+export function e2eFailureSummary(report) {
+  const failures = []
+  let passed = 0
+  let skipped = 0
+  function visit(suite, parents = [], parentFile) {
+    const titles = [...parents, suite.title].filter(Boolean)
+    const file = suite.file ?? parentFile
+    for (const spec of suite.specs ?? []) {
+      for (const test of spec.tests ?? []) {
+        if (test.status === 'expected') {
+          passed++
+          continue
+        }
+        if (test.status === 'skipped') {
+          skipped++
+          continue
+        }
+        const errors = test.results.flatMap((result) => result.errors ?? [])
+        failures.push({
+          file: spec.file ?? file,
+          title: [...titles, spec.title].join(' › '),
+          project: test.projectName,
+          status: test.status,
+          message: errors
+            .map((error) => error.message ?? error.value ?? '')
+            .join('\n')
+            .slice(0, 2000)
+        })
+      }
+    }
+    for (const child of suite.suites ?? []) {
+      visit(child, titles, file)
+    }
+  }
+  for (const suite of report.suites ?? []) {
+    visit(suite)
+  }
+  return { passed, skipped, failures, errors: report.errors ?? [] }
+}
+
+export function renderE2eFailures(summary, records = [], now = new Date()) {
+  const escape = (value) =>
+    String(value ?? '')
+      .replaceAll('&', '&amp;')
+      .replaceAll('<', '&lt;')
+      .replaceAll('>', '&gt;')
+  const tracked = trackE2eFailures(summary.failures, records, now)
+  const details = (failure) =>
+    `<details><summary>${escape(failure.status)}: ${escape(failure.file)} — ${escape(failure.title)}</summary><pre>${escape(failure.message)}</pre></details>`
+  return [
+    '## E2E results',
+    '',
+    `${summary.passed} expected results; ${summary.skipped} skipped; ${summary.failures.length} unexpected/flaky results; ${summary.errors.length} run errors.`,
+    '',
+    `### Untracked failures (${tracked.untracked.length})`,
+    '',
+    ...tracked.untracked.map(details),
+    '',
+    `### Tracked failures (${tracked.known.length})`,
+    '',
+    ...tracked.known.flatMap((failure) => [
+      details(failure),
+      `Owner: ${escape(failure.tracking.owner)}; ${escape(failure.tracking.issue)}; expires ${escape(failure.tracking.expires)}.`
+    ]),
+    ...(tracked.invalid.length
+      ? [`${tracked.invalid.length} invalid/expired tracking entries were not used.`]
+      : []),
+    ...summary.errors.map((error) => `<pre>${escape(error.message ?? error.value)}</pre>`),
+    '',
+    'Failures retain their original verdict. Repeated failures need a tracked owner, reproduction and review date; do not treat a red baseline as passing.',
+    ''
+  ].join('\n')
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    const summary = e2eFailureSummary(JSON.parse(readFileSync(process.argv[2], 'utf8')))
+    const records = JSON.parse(
+      readFileSync(new URL('../e2e-failure-tracking.json', import.meta.url), 'utf8')
+    )
+    appendFileSync(process.env.GITHUB_STEP_SUMMARY, renderE2eFailures(summary, records))
+  } catch (error) {
+    appendFileSync(
+      process.env.GITHUB_STEP_SUMMARY,
+      `E2E report unavailable (${error.code ?? 'invalid report'}); inspect the failing step and traces.\n`
+    )
+  }
+}
diff --git a/config/scripts/ci-e2e-failure-summary.test.mjs b/config/scripts/ci-e2e-failure-summary.test.mjs
new file mode 100644
index 00000000000..5594e4faa56
--- /dev/null
+++ b/config/scripts/ci-e2e-failure-summary.test.mjs
@@ -0,0 +1,79 @@
+import { expect, it } from 'vitest'
+import { e2eFailureSummary, renderE2eFailures } from './ci-e2e-failure-summary.mjs'
+import { trackE2eFailures } from './ci-e2e-failure-tracking.mjs'
+
+it('requires exact failures with an owner, issue and unexpired review date', () => {
+  const failure = {
+    file: 'test.spec.ts',
+    title: 'case',
+    project: 'electron',
+    message: 'expected focus failed'
+  }
+  const record = {
+    ...failure,
+    message: 'expected focus',
+    owner: '@owner',
+    issue: 'https://github.com/stablyai/orca/issues/123',
+    expires: '2026-10-01'
+  }
+  const now = new Date('2026-09-28')
+  expect(trackE2eFailures([failure], [null, record], now)).toMatchObject({
+    known: [{ ...failure, tracking: record }],
+    invalid: [null]
+  })
+  expect(trackE2eFailures([failure], null, now).untracked).toEqual([failure])
+  for (const change of [
+    { expires: '2026-09-27' },
+    { expires: '2026-09-31' },
+    { owner: '' },
+    { issue: '' },
+    { title: 'different' },
+    { message: 'different' },
+    { project: 'other' }
+  ]) {
+    expect(trackE2eFailures([failure], [{ ...record, ...change }], now).untracked).toEqual([
+      failure
+    ])
+  }
+})
+
+it('keeps failure, flaky, skipped and startup-error evidence separate', () => {
+  const report = {
+    errors: [{ message: 'startup failed' }],
+    suites: [
+      {
+        title: 'file',
+        file: 'tests/e2e/test.spec.ts',
+        suites: [
+          {
+            title: 'feature',
+            specs: [
+              {
+                title: 'case',
+                tests: [
+                  { status: 'expected' },
+                  { status: 'skipped' },
+                  {
+                    status: 'unexpected',
+                    projectName: 'electron-headless',
+                    results: [{ errors: [{ message: '<timeout>' }] }]
+                  },
+                  {
+                    status: 'flaky',
+                    results: [{ errors: [{ message: 'first try' }] }, { errors: [] }]
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+  const summary = e2eFailureSummary(report)
+  expect(summary).toMatchObject({ passed: 1, skipped: 1, errors: report.errors })
+  expect(summary.failures).toHaveLength(2)
+  expect(summary.failures[0].title).toBe('file › feature › case')
+  expect(renderE2eFailures(summary)).toContain('&lt;timeout&gt;')
+  expect(renderE2eFailures(summary)).toContain('startup failed')
+})
diff --git a/config/scripts/ci-e2e-failure-tracking.mjs b/config/scripts/ci-e2e-failure-tracking.mjs
new file mode 100644
index 00000000000..3415c023ad5
--- /dev/null
+++ b/config/scripts/ci-e2e-failure-tracking.mjs
@@ -0,0 +1,42 @@
+export function trackE2eFailures(failures, records, now = new Date()) {
+  const known = []
+  const untracked = []
+  const invalid = []
+  const active = (Array.isArray(records) ? records : [records]).filter((record) => {
+    if (!record || typeof record !== 'object' || Array.isArray(record)) {
+      invalid.push(record)
+      return false
+    }
+    const expiry = new Date(`${record.expires}T23:59:59Z`)
+    const valid =
+      typeof record.file === 'string' &&
+      typeof record.title === 'string' &&
+      typeof record.message === 'string' &&
+      record.message.length > 0 &&
+      /^@[\w-]+(?:\/[\w-]+)?$/.test(record.owner ?? '') &&
+      /^https:\/\/github\.com\/stablyai\/orca\/issues\/\d+$/.test(record.issue ?? '') &&
+      /^\d{4}-\d{2}-\d{2}$/.test(record.expires ?? '') &&
+      Number.isFinite(expiry.getTime()) &&
+      expiry.toISOString().slice(0, 10) === record.expires &&
+      expiry.getTime() >= now.getTime()
+    if (!valid) {
+      invalid.push(record)
+    }
+    return valid
+  })
+  for (const failure of failures) {
+    const record = active.find(
+      (entry) =>
+        entry.file === failure.file &&
+        entry.title === failure.title &&
+        entry.project === failure.project &&
+        failure.message.includes(entry.message)
+    )
+    if (record) {
+      known.push({ ...failure, tracking: record })
+    } else {
+      untracked.push(failure)
+    }
+  }
+  return { known, untracked, invalid }
+}
diff --git a/config/scripts/ci-pnpm-store-benchmark.mjs b/config/scripts/ci-pnpm-store-benchmark.mjs
new file mode 100644
index 00000000000..8536eafe1d5
--- /dev/null
+++ b/config/scripts/ci-pnpm-store-benchmark.mjs
@@ -0,0 +1,154 @@
+import assert from 'node:assert/strict'
+import { createHash } from 'node:crypto'
+import {
+  cpSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { performance } from 'node:perf_hooks'
+import { parseArgs } from 'node:util'
+import { resolvePnpmCliInvocation } from './pnpm-cli-invocation.mjs'
+import { runProcessSync } from './script-child-process.mjs'
+
+const { values } = parseArgs({
+  options: { samples: { type: 'string', default: '3' }, output: { type: 'string' } }
+})
+const samples = Number(values.samples)
+assert(Number.isInteger(samples) && samples > 0 && samples <= 10, '--samples must be 1–10')
+const repository = resolve(import.meta.dirname, '../..')
+const temporary = mkdtempSync(join(tmpdir(), 'orca-ci-pnpm-store-'))
+const checkout = join(temporary, 'checkout')
+const store = join(temporary, 'store')
+const archive = join(temporary, 'store.tar.zst')
+const uncompressed = join(temporary, 'store.tar')
+const manifests = ['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml']
+const pnpm = resolvePnpmCliInvocation()
+const results = []
+
+function command(program, args, cwd = checkout) {
+  const start = performance.now()
+  const result = runProcessSync({
+    program,
+    args,
+    cwd,
+    env: { ...process.env, CI: 'true', ORCA_BACKGROUND_LAUNCH: '1' },
+    timeoutMs: 300_000
+  })
+  assert.equal(result.code, 0, `${program}: ${result.stdout}\n${result.stderr}`)
+  return { milliseconds: performance.now() - start, stdout: result.stdout.trim() }
+}
+
+function pnpmCommand(args) {
+  return command(pnpm.command, [...pnpm.prefixArgs, ...args])
+}
+
+function digest() {
+  const hash = createHash('sha256')
+  for (const file of manifests) {
+    hash.update(readFileSync(join(checkout, file)))
+  }
+  return hash.digest('hex')
+}
+
+function install() {
+  return pnpmCommand(['install', '--frozen-lockfile', '--ignore-scripts', '--store-dir', store])
+    .milliseconds
+}
+
+function transferArchive(restore) {
+  const start = performance.now()
+  // Windows BSD tar needs a separate zstd process, as in the Actions cache toolkit.
+  if (process.platform === 'win32') {
+    if (restore) {
+      command('zstd', ['-d', '-f', 'store.tar.zst', '-o', 'store.tar'], temporary)
+      command('tar', ['-xf', 'store.tar', '-C', store], temporary)
+    } else {
+      command('tar', ['--format=posix', '-cf', 'store.tar', '-C', store, '.'], temporary)
+      command('zstd', ['-T0', '-f', 'store.tar', '-o', 'store.tar.zst'], temporary)
+    }
+    rmSync(uncompressed)
+  } else {
+    command(
+      'tar',
+      restore
+        ? ['-xf', archive, '--use-compress-program', 'zstd -d', '-C', store]
+        : ['--format=posix', '-cf', archive, '--use-compress-program', 'zstd -T0', '-C', store, '.']
+    )
+  }
+  return performance.now() - start
+}
+
+try {
+  mkdirSync(checkout)
+  for (const file of [...manifests, 'native/windows-registry/package.json', 'config/patches']) {
+    const target = join(checkout, file)
+    mkdirSync(resolve(target, '..'), { recursive: true })
+    cpSync(join(repository, file), target, { recursive: true })
+  }
+  const sourceDigest = digest()
+  const pnpmVersion = pnpmCommand(['--version']).stdout
+  const zstdVersion = command('zstd', ['--version']).stdout
+  const tarVersion = command('tar', ['--version']).stdout
+
+  for (let sample = 0; sample < samples; sample++) {
+    const policies = sample % 2 === 0 ? ['save', 'restore-only'] : ['restore-only', 'save']
+    for (const policy of policies) {
+      rmSync(join(checkout, 'node_modules'), { recursive: true, force: true })
+      rmSync(store, { recursive: true, force: true })
+      const installMs = install()
+      assert.equal(digest(), sourceDigest, 'frozen install changed a manifest')
+      let archiveMs = 0
+      let archiveBytes = 0
+      if (policy === 'save') {
+        archiveMs = transferArchive(false)
+        archiveBytes = statSync(archive).size
+      }
+      const result = {
+        sample,
+        policy,
+        installMs,
+        archiveMs,
+        archiveBytes,
+        totalMs: installMs + archiveMs
+      }
+      results.push(result)
+      console.error(JSON.stringify(result))
+    }
+  }
+
+  // Both policies restore identical bytes on a hit; measure that common cost separately.
+  rmSync(join(checkout, 'node_modules'), { recursive: true, force: true })
+  rmSync(store, { recursive: true, force: true })
+  mkdirSync(store)
+  const restoreMs = transferArchive(true)
+  const hitInstallMs = install()
+  assert.equal(digest(), sourceDigest)
+  const report = {
+    platform: process.platform,
+    arch: process.arch,
+    node: process.version,
+    pnpm: pnpmVersion,
+    tar: tarVersion,
+    zstd: zstdVersion,
+    sourceDigest,
+    results,
+    hit: { restoreMs, installMs: hitInstallMs, totalMs: restoreMs + hitInstallMs },
+    scope:
+      'Desktop script-free frozen install, fresh isolated store per miss; alternating policy order.',
+    limit:
+      'Measures local install/archive CPU and disk. Excludes GitHub cache transfer and remote service time.'
+  }
+  const json = `${JSON.stringify(report, null, 2)}\n`
+  if (values.output) {
+    writeFileSync(resolve(values.output), json)
+  }
+  console.log(json)
+} finally {
+  rmSync(temporary, { recursive: true, force: true })
+}
diff --git a/config/scripts/ci-runner-demand.mjs b/config/scripts/ci-runner-demand.mjs
new file mode 100644
index 00000000000..7690ea358db
--- /dev/null
+++ b/config/scripts/ci-runner-demand.mjs
@@ -0,0 +1,100 @@
+import { appendFileSync, mkdirSync, writeFileSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
+import { runnerDemand, sampleWorkflowRuns } from './ci-runner-metrics.mjs'
+
+async function api(path, env) {
+  const response = await fetch(
+    `${env.GITHUB_API_URL ?? 'https://api.github.com'}/repos/${env.GITHUB_REPOSITORY}/${path}`,
+    {
+      headers: {
+        Authorization: `Bearer ${env.GH_TOKEN}`,
+        Accept: 'application/vnd.github+json',
+        'X-GitHub-Api-Version': '2022-11-28'
+      },
+      signal: AbortSignal.timeout(30_000)
+    }
+  )
+  if (!response.ok) {
+    throw new Error(`Actions API: ${response.status}`)
+  }
+  return response.json()
+}
+
+export async function collectRunnerDemand(env = process.env, request = (path) => api(path, env)) {
+  const end = new Date(env.CI_METRICS_END ?? Date.now())
+  end.setUTCMinutes(0, 0, 0)
+  if (!Number.isFinite(end.getTime())) {
+    throw new Error('Invalid window end')
+  }
+  const runs = []
+  for (let hour = 0; hour < 24; hour++) {
+    const until = new Date(end.getTime() - hour * 3_600_000 - 1000)
+    const since = new Date(end.getTime() - (hour + 1) * 3_600_000)
+    const range = `${since.toISOString()}..${until.toISOString()}`
+    const path = `actions/runs?per_page=100&created=${encodeURIComponent(range)}`
+    const first = await request(path)
+    if (first.total_count > 1000) {
+      throw new Error('Hourly run inventory exceeds API limit; split the interval')
+    }
+    runs.push(...first.workflow_runs)
+    for (let page = 2; page <= Math.ceil(first.total_count / 100); page++) {
+      runs.push(...(await request(`${path}&page=${page}`)).workflow_runs)
+    }
+  }
+  const samples = sampleWorkflowRuns(runs)
+  // Bound API concurrency and preserve every selected observation, including zero-job runs.
+  for (let index = 0; index < samples.length; index += 4) {
+    await Promise.all(
+      samples.slice(index, index + 4).map(async (sample) => {
+        const path = `actions/runs/${sample.run.id}/jobs?per_page=100`
+        const first = await request(path)
+        sample.jobs = first.jobs
+        for (let page = 2; page <= Math.ceil(first.total_count / 100); page++) {
+          sample.jobs.push(...(await request(`${path}&page=${page}`)).jobs)
+        }
+      })
+    )
+  }
+  const report = {
+    start: new Date(end.getTime() - 86_400_000).toISOString(),
+    end: end.toISOString(),
+    method:
+      'Stratified by workflow/conclusion, six sampled runs per stratum; latest attempts only; incomplete jobs excluded',
+    ...runnerDemand(runs, samples)
+  }
+  return { report, runs, samples }
+}
+
+export function demandMarkdown(report) {
+  return [
+    `## CI demand: ${report.start} to ${report.end}`,
+    '',
+    `Estimated full job duration for runs created in this window (not window-clipped occupancy); ${report.sampledRuns}/${report.populationRuns} runs sampled. ${report.method}.`,
+    '',
+    '| Workflow | Runs | Runner hours | Cancelled-run hours | Minutes/completed PR run |',
+    '| --- | ---: | ---: | ---: | ---: |',
+    ...report.workflows.map(
+      (row) =>
+        `| ${row.workflow} | ${row.runs} | ${(row.runnerMinutes / 60).toFixed(1)} | ${(row.cancelledRunnerMinutes / 60).toFixed(1)} | ${row.runnerMinutesPerCompletedPrRun?.toFixed(1) ?? '—'} |`
+    ),
+    '',
+    '| Runner labels | Hours | Queue/provisioning p95 minutes |',
+    '| --- | ---: | ---: |',
+    ...report.pools.map(
+      (pool) =>
+        `| ${pool.label} | ${(pool.runnerMinutes / 60).toFixed(1)} | ${pool.queueP95Minutes?.toFixed(1) ?? '—'} |`
+    ),
+    ''
+  ].join('\n')
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const evidence = await collectRunnerDemand()
+  mkdirSync('ci-demand', { recursive: true })
+  writeFileSync('ci-demand/evidence.json', JSON.stringify(evidence))
+  const markdown = demandMarkdown(evidence.report)
+  writeFileSync('ci-demand/report.md', markdown)
+  if (process.env.GITHUB_STEP_SUMMARY) {
+    appendFileSync(process.env.GITHUB_STEP_SUMMARY, markdown)
+  }
+}
diff --git a/config/scripts/ci-runner-metrics.mjs b/config/scripts/ci-runner-metrics.mjs
new file mode 100644
index 00000000000..d01ae3d0153
--- /dev/null
+++ b/config/scripts/ci-runner-metrics.mjs
@@ -0,0 +1,110 @@
+const minutesBetween = (start, end) => {
+  const value = (Date.parse(end) - Date.parse(start)) / 60_000
+  return Number.isFinite(value) ? Math.max(0, value) : 0
+}
+
+const workflowPath = (run) => run.path.split('@')[0]
+const workflowKey = (run) => run.workflow_id ?? workflowPath(run)
+
+export function weightedPercentile(values, percentile) {
+  const sorted = [...values].sort((a, b) => a.value - b.value)
+  const target = sorted.reduce((sum, item) => sum + item.weight, 0) * percentile
+  let seen = 0
+  for (const item of sorted) {
+    seen += item.weight
+    if (seen >= target) {
+      return item.value
+    }
+  }
+  return null
+}
+
+export function runnerDemand(runs, samples) {
+  const workflows = new Map()
+  const pools = new Map()
+  for (const run of runs) {
+    if (!workflows.has(workflowKey(run))) {
+      workflows.set(workflowKey(run), {
+        workflow: workflowPath(run),
+        runs: 0,
+        sampledRuns: 0,
+        runnerMinutes: 0,
+        cancelledRunnerMinutes: 0,
+        completedPrRuns: 0,
+        completedPrRunnerMinutes: 0
+      })
+    }
+    workflows.get(workflowKey(run)).runs++
+  }
+  let incompleteJobs = 0
+  for (const { run, jobs, weight } of samples) {
+    const row = workflows.get(workflowKey(run))
+    row.sampledRuns++
+    for (const job of jobs) {
+      if (!job.runner_name || !job.started_at) {
+        continue
+      }
+      if (!job.completed_at) {
+        incompleteJobs++
+        continue
+      }
+      const duration = minutesBetween(job.started_at, job.completed_at)
+      const weighted = duration * weight
+      row.runnerMinutes += weighted
+      if (run.conclusion === 'cancelled') {
+        row.cancelledRunnerMinutes += weighted
+      }
+      if (run.event === 'pull_request' && ['success', 'failure'].includes(run.conclusion)) {
+        row.completedPrRunnerMinutes += weighted
+      }
+      const label = [...job.labels].sort().join(', ') || 'unknown'
+      if (!pools.has(label)) {
+        pools.set(label, { label, runnerMinutes: 0, waits: [] })
+      }
+      const pool = pools.get(label)
+      pool.runnerMinutes += weighted
+      if (job.created_at) {
+        pool.waits.push({ value: minutesBetween(job.created_at, job.started_at), weight })
+      }
+    }
+    if (run.event === 'pull_request' && ['success', 'failure'].includes(run.conclusion)) {
+      row.completedPrRuns += weight
+    }
+  }
+  return {
+    populationRuns: runs.length,
+    sampledRuns: samples.length,
+    incompleteJobs,
+    workflows: [...workflows.values()]
+      .map((row) => ({
+        ...row,
+        runnerMinutesPerCompletedPrRun: row.completedPrRuns
+          ? row.completedPrRunnerMinutes / row.completedPrRuns
+          : null
+      }))
+      .sort((a, b) => b.runnerMinutes - a.runnerMinutes),
+    pools: [...pools.values()]
+      .map(({ waits, ...pool }) => ({ ...pool, queueP95Minutes: weightedPercentile(waits, 0.95) }))
+      .sort((a, b) => b.runnerMinutes - a.runnerMinutes)
+  }
+}
+
+export function sampleWorkflowRuns(runs, perStratum = 6, random = Math.random) {
+  const groups = new Map()
+  for (const run of runs) {
+    const key = `${workflowKey(run)}:${run.conclusion ?? run.status}`
+    if (!groups.has(key)) {
+      groups.set(key, [])
+    }
+    groups.get(key).push(run)
+  }
+  return [...groups.values()].flatMap((group) => {
+    const shuffled = [...group]
+    for (let index = shuffled.length - 1; index > 0; index--) {
+      const target = Math.floor(random() * (index + 1))
+      ;[shuffled[index], shuffled[target]] = [shuffled[target], shuffled[index]]
+    }
+    const selected = shuffled.slice(0, perStratum)
+    return selected.map((run) => ({ run, weight: group.length / selected.length }))
+  })
+}
diff --git a/config/scripts/ci-runner-metrics.test.mjs b/config/scripts/ci-runner-metrics.test.mjs
new file mode 100644
index 00000000000..ebf45cc7c35
--- /dev/null
+++ b/config/scripts/ci-runner-metrics.test.mjs
@@ -0,0 +1,95 @@
+import { expect, it } from 'vitest'
+import { runnerDemand, sampleWorkflowRuns } from './ci-runner-metrics.mjs'
+import { collectRunnerDemand } from './ci-runner-demand.mjs'
+
+const run = {
+  id: 1,
+  path: '.github/workflows/pr.yml',
+  event: 'pull_request',
+  conclusion: 'success'
+}
+const job = {
+  runner_name: 'hosted',
+  labels: ['ubuntu-latest'],
+  created_at: '2026-09-27T00:00:00Z',
+  started_at: '2026-09-27T00:03:00Z',
+  completed_at: '2026-09-27T00:08:00Z'
+}
+
+it('separates occupancy, queueing, cancellations and zero-job observations', () => {
+  const cancelled = { ...run, id: 2, conclusion: 'cancelled' }
+  const report = runnerDemand(
+    [run, cancelled],
+    [
+      { run, weight: 2, jobs: [job, { ...job, runner_name: null }] },
+      { run: cancelled, weight: 3, jobs: [job, { ...job, completed_at: null }] }
+    ]
+  )
+  expect(report.workflows[0]).toMatchObject({
+    runnerMinutes: 25,
+    cancelledRunnerMinutes: 15,
+    runnerMinutesPerCompletedPrRun: 5
+  })
+  expect(report.pools[0].queueP95Minutes).toBe(3)
+  expect(report.incompleteJobs).toBe(1)
+  expect(runnerDemand([run], [{ run, weight: 1, jobs: [] }]).workflows[0].runnerMinutes).toBe(0)
+})
+
+it('weights each workflow/outcome stratum back to the full inventory', () => {
+  const runs = Array.from({ length: 20 }, (_, index) => ({
+    ...run,
+    id: index,
+    conclusion: index < 10 ? 'success' : 'failure'
+  }))
+  const sample = sampleWorkflowRuns(runs, 2, () => 0.5)
+  expect(sample).toHaveLength(4)
+  expect(sample.reduce((sum, row) => sum + row.weight, 0)).toBe(20)
+  expect(new Set(sample.map((row) => row.run.id)).size).toBe(4)
+})
+
+it('paginates jobs and bounds run discovery to 24 complete hours', async () => {
+  const requests = []
+  const result = await collectRunnerDemand(
+    { CI_METRICS_END: '2026-09-28T04:59:00Z' },
+    async (path) => {
+      requests.push(path)
+      if (path.includes('/jobs')) {
+        return {
+          total_count: 101,
+          jobs: path.includes('page=2') ? [job] : Array.from({ length: 100 }, () => job)
+        }
+      }
+      return {
+        total_count: requests.length === 1 ? 1 : 0,
+        workflow_runs: requests.length === 1 ? [run] : []
+      }
+    }
+  )
+  expect(result.report.start).toBe('2026-09-27T04:00:00.000Z')
+  expect(result.report.end).toBe('2026-09-28T04:00:00.000Z')
+  expect(requests.filter((path) => path.startsWith('actions/runs?'))).toHaveLength(24)
+  expect(result.samples[0].jobs).toHaveLength(101)
+  expect(result.report.workflows[0].runnerMinutes).toBe(505)
+})
+
+it('refuses to publish a silently truncated inventory', async () => {
+  await expect(
+    collectRunnerDemand({}, async () => ({ total_count: 1001, workflow_runs: [] }))
+  ).rejects.toThrow('API limit')
+})
+
+it('groups ref-qualified paths under the stable workflow ID', () => {
+  const runs = [
+    { ...run, id: 1, workflow_id: 42, path: '.github/workflows/pr.yml@main' },
+    { ...run, id: 2, workflow_id: 42, path: '.github/workflows/pr.yml@feature' }
+  ]
+  const sample = sampleWorkflowRuns(runs, 1, () => 0.5)
+  expect(sample).toHaveLength(1)
+  expect(sample[0].weight).toBe(2)
+  expect(
+    runnerDemand(
+      runs,
+      sample.map((row) => ({ ...row, jobs: [job] }))
+    ).workflows
+  ).toMatchObject([{ workflow: '.github/workflows/pr.yml', runs: 2, runnerMinutes: 10 }])
+})
diff --git a/config/scripts/ci-shard-timings.json b/config/scripts/ci-shard-timings.json
index 4b4b08f97b2..795f6070baf 100644
--- a/config/scripts/ci-shard-timings.json
+++ b/config/scripts/ci-shard-timings.json
@@ -1,8476 +1,9856 @@
 {
   "unit": {
-    "runId": "34675583768",
-    "jobIds": [
-      "103505449197",
-      "103505449205",
-      "103505449211",
-      "103505449212",
-      "103505449228",
-      "103505449235",
-      "103505449248",
-      "103505449256"
-    ],
-    "overheadMs": 526,
+    "runId": "36294142683",
+    "runAttempt": "1",
+    "sourceSha": "cc35c1b422e9c20197bc59aa27a71019ffc18b5b",
+    "nodeVersion": "24.21.0",
+    "metric": "module-duration-v1",
+    "overheadMs": 0,
     "timings": {
-      "config/scripts/adhoc-build-version.test.mjs": 31,
-      "config/scripts/agent-status-hot-path-benchmark.test.ts": 2277,
-      "config/scripts/app-store-performance-plugin.test.mjs": 912,
-      "config/scripts/audit-localization-coverage.test.mjs": 23,
-      "config/scripts/benchmark-artifact-comparison.test.mjs": 132,
-      "config/scripts/benchmark-sample-summary.test.mjs": 8,
-      "config/scripts/build-linux-local.test.mjs": 15,
-      "config/scripts/build-mac-local.test.mjs": 5,
-      "config/scripts/build-orcad-prebuilds.test.mjs": 27,
-      "config/scripts/build-windows-cli-launcher.test.mjs": 39,
-      "config/scripts/check-changed-code-quality.test.mjs": 7,
-      "config/scripts/check-max-lines-ratchet.test.mjs": 10,
-      "config/scripts/check-react-doctor-changed.test.mjs": 189,
-      "config/scripts/check-reliability-gates.test.mjs": 171,
-      "config/scripts/check-root-directory-entries.test.mjs": 880,
-      "config/scripts/check-runtime-electron-ratchet.test.mjs": 1931,
-      "config/scripts/check-terminal-perf-report-budgets.test.mjs": 398,
-      "config/scripts/check-ts-nocheck-ratchet.test.mjs": 5,
-      "config/scripts/ci-native-toolchain.test.mjs": 38,
-      "config/scripts/client-hosted-browser-package-coverage.test.mjs": 81,
-      "config/scripts/codex-index-heal-contract-workflow.test.mjs": 10,
-      "config/scripts/codex-primary-home-tripwire.test.ts": 421,
-      "config/scripts/computer-e2e-workflow.test.mjs": 132,
-      "config/scripts/computer-use-modifier-safety.test.mjs": 5,
-      "config/scripts/computer-use-mouse-button-routing.test.mjs": 9,
-      "config/scripts/computer-use-skill-guidance.test.mjs": 15,
-      "config/scripts/computer-use-smoke.test.mjs": 471,
-      "config/scripts/computer-use-windows-horizontal-scroll.test.mjs": 3,
-      "config/scripts/counterbalanced-benchmark-schedule.test.mjs": 10,
-      "config/scripts/create-draft-release.test.mjs": 18,
-      "config/scripts/daily-build-version.test.mjs": 36,
-      "config/scripts/daily-e2e-dispatch-contract.test.mjs": 6,
-      "config/scripts/dev-channel-base-version.test.mjs": 8,
-      "config/scripts/dev-channel-windows-workflow-contract.test.mjs": 218,
-      "config/scripts/dev-cli-terminal-wrapper.test.mjs": 9,
-      "config/scripts/dev-electron-bundle-cache.test.ts": 10,
-      "config/scripts/dev-electron-bundle-identity.test.ts": 7,
-      "config/scripts/electron-builder-config.test.mjs": 155,
-      "config/scripts/electron-builder-mac-channel-config.test.mjs": 577,
-      "config/scripts/electron-builder-markdown-associations.test.mjs": 14,
-      "config/scripts/electron-builder-native-rebuild.test.mjs": 11,
-      "config/scripts/electron-builder-runtime-resources.test.mjs": 393,
-      "config/scripts/electron-builder-speech-config.test.mjs": 16,
-      "config/scripts/electron-runtime-floor.test.ts": 5,
-      "config/scripts/electron-vite-output-contract.test.ts": 13,
-      "config/scripts/ensure-native-runtime-job-ownership.test.mjs": 10,
-      "config/scripts/ensure-native-runtime.test.mjs": 422,
-      "config/scripts/generate-bundled-skill-guides.test.mjs": 293,
-      "config/scripts/generate-runtime-required-english-catalog.test.mjs": 8,
-      "config/scripts/generate-skill-bundle-manifest.test.mjs": 448,
-      "config/scripts/generate-terminal-perf-html-report.test.mjs": 19,
-      "config/scripts/git-binary-compatibility-workflow.test.mjs": 98,
-      "config/scripts/git-pull-request-diff-base.test.mjs": 4,
-      "config/scripts/hang-watchdog-process-metrics.test.mjs": 6,
-      "config/scripts/happy-dom-mutation-observer-retention.test.ts": 100,
-      "config/scripts/happy-dom-offscreen-canvas.test.ts": 42,
-      "config/scripts/headless-serve-shutdown-workflow.test.mjs": 15,
-      "config/scripts/hourly-build-version.test.mjs": 27,
-      "config/scripts/hourly-preflight-workflow.test.mjs": 33,
-      "config/scripts/idle-cpu-process-sampling.test.mjs": 5,
-      "config/scripts/install-electron-package-binary.test.mjs": 2145,
-      "config/scripts/install-node-dependencies-action.test.mjs": 140,
-      "config/scripts/latest-stable-release.test.mjs": 10,
-      "config/scripts/lint-staged-worktree-backup.test.mjs": 276,
-      "config/scripts/linux-package-maintainer-scripts.test.mjs": 6,
-      "config/scripts/live-freeze-bounded-history.test.mjs": 6,
-      "config/scripts/live-remote-bulk-open-freeze-metrics.test.mjs": 17,
-      "config/scripts/live-remote-freeze-rpc.test.mjs": 5,
-      "config/scripts/live-remote-status-watchdog.test.mjs": 248,
-      "config/scripts/locale-count-fragment-separator.test.mjs": 17,
-      "config/scripts/locale-generic-ui-terms.test.mjs": 20,
-      "config/scripts/locale-ko-frozen-terminal-search-keywords.test.mjs": 35,
-      "config/scripts/locale-ko-key-overrides.test.mjs": 38,
-      "config/scripts/locale-repair-catalog-missing-leaves.test.mjs": 14,
-      "config/scripts/locale-translation-policy-ko-round5.test.mjs": 12,
-      "config/scripts/locale-translation-policy.es-pr.test.mjs": 13,
-      "config/scripts/locale-translation-policy.es-round5.test.mjs": 9,
-      "config/scripts/locale-translation-policy.ja-relocalization.test.mjs": 17,
-      "config/scripts/locale-translation-policy.ja-round5.test.mjs": 13,
-      "config/scripts/locale-translation-policy.test.mjs": 38,
-      "config/scripts/locale-translation-policy.zh-round5.test.mjs": 14,
-      "config/scripts/locale-translation-policy.zh-status-bar-usage.test.mjs": 24,
-      "config/scripts/localization-package-contract.test.mjs": 8,
-      "config/scripts/mac-build-compatibility.test.mjs": 8,
-      "config/scripts/macos-computer-helper-owner-loss-group-recovery.test.mjs": 10,
-      "config/scripts/macos-tcc-prompt-localization.test.mjs": 75,
-      "config/scripts/mobile-pairing-qrcode-import-plugin.test.mjs": 450,
-      "config/scripts/node-old-space-limit.test.mjs": 6,
-      "config/scripts/node-pty-console-list-agent-patch.test.mjs": 7,
-      "config/scripts/node-pty-master-cloexec-patch.test.mjs": 22,
-      "config/scripts/node-pty-windows-pty-teardown-patch.test.mjs": 59,
-      "config/scripts/orca-cli-skill-guidance.test.mjs": 14,
-      "config/scripts/orca-dev-bin.test.mjs": 68,
-      "config/scripts/orca-linear-skill-guidance.test.mjs": 15,
-      "config/scripts/orcad-operations-restart-safety.test.mjs": 5,
-      "config/scripts/orchestration-guide-command-contract.test.mjs": 11,
-      "config/scripts/orchestration-skill-guidance.test.mjs": 23,
-      "config/scripts/oxc-cli-invocation.test.mjs": 128,
-      "config/scripts/oxlint-cli-invocation.test.mjs": 46,
-      "config/scripts/package-electron-runtime-contract.test.mjs": 360,
-      "config/scripts/packaged-browser-lane-contract.test.mjs": 7,
-      "config/scripts/packaged-hang-watchdog-worker-contract.test.mjs": 55,
-      "config/scripts/packaged-node-pty-prebuild-prune.test.mjs": 25,
-      "config/scripts/packaged-source-map-prune.test.mjs": 53,
-      "config/scripts/patched-dependencies-frozen-install.test.mjs": 451,
-      "config/scripts/plain-node-entry-guard.test.ts": 610,
-      "config/scripts/pnpm-cli-invocation.test.mjs": 6,
-      "config/scripts/pr-code-change-scope.test.mjs": 346,
-      "config/scripts/pr-e2e-gate-contract.test.mjs": 108,
-      "config/scripts/pr-e2e-native-only-routing.test.mjs": 19,
-      "config/scripts/pr-test-loc-summary.test.mjs": 89,
-      "config/scripts/pr-workflow-lint-parity.test.mjs": 53,
-      "config/scripts/pr-workflow-parallelism.test.mjs": 898,
-      "config/scripts/project-renderer-web-client.test.mjs": 213,
-      "config/scripts/pty-transcript-secret-scan.test.mjs": 14,
-      "config/scripts/publish-complete-draft-releases.test.mjs": 168,
-      "config/scripts/quadratic-buffer-concat-plugin.test.mjs": 2010,
-      "config/scripts/rebuild-native-deps-node-pty.test.mjs": 2338,
-      "config/scripts/rebuild-native-deps.test.mjs": 831,
-      "config/scripts/reclaim-dev-electron-bundles.test.ts": 35,
-      "config/scripts/regenerate-xterm-patches.test.mjs": 300,
-      "config/scripts/relay-artifact-manifest.test.mjs": 3554,
-      "config/scripts/relay-asset-line-ending-pin.test.mjs": 74,
-      "config/scripts/release-blocker-fixes.test.mjs": 39,
-      "config/scripts/release-cut-signpath-slack.test.mjs": 72,
-      "config/scripts/release-cut-sourcemap-publish.test.mjs": 11,
-      "config/scripts/release-cut-token-permissions.test.mjs": 19,
-      "config/scripts/release-e2e-dispatch-contract.test.mjs": 8,
-      "config/scripts/release-mac-build-workflow-dispatch.test.mjs": 10,
-      "config/scripts/release-rc-history.test.mjs": 166,
-      "config/scripts/renderer-boot-graph.test.mjs": 54,
-      "config/scripts/renderer-scrollbar-style-plugin.test.mjs": 2888,
-      "config/scripts/replace-cached-nsis-elevate.test.mjs": 1880,
-      "config/scripts/resolve-7za-path.test.mjs": 1412,
-      "config/scripts/run-codex-real-account-validation.test.ts": 3652,
-      "config/scripts/run-internal-dev-setup.test.mjs": 10,
-      "config/scripts/run-linux-packaged-node-pty-floor-smoke.test.mjs": 10,
-      "config/scripts/run-terminal-scale-perf-report-gate.test.mjs": 17,
-      "config/scripts/shared-electron-dist-cache.test.ts": 44,
-      "config/scripts/shebang-script-line-ending-pin.test.mjs": 77,
-      "config/scripts/skill-critical-guidance.test.mjs": 6,
-      "config/scripts/skill-description-length.test.mjs": 26,
-      "config/scripts/skill-recipe-shell.test.mjs": 43,
-      "config/scripts/skill-sharing-release-workflow.test.mjs": 12,
-      "config/scripts/skill-update-roundtrip-workflow.test.mjs": 5,
-      "config/scripts/skills-cli-package-workflow.test.mjs": 8,
-      "config/scripts/sort-comparator-performance-plugin.test.mjs": 269,
-      "config/scripts/space-sharing-copy.test.ts": 40,
-      "config/scripts/ssh-browser-e2e-routing.test.mjs": 23,
-      "config/scripts/ssh-localhost-e2e-routing.test.mjs": 28,
-      "config/scripts/static-appimage-package-contract.test.mjs": 42,
-      "config/scripts/summarize-terminal-perf-report.test.mjs": 52,
-      "config/scripts/telemetry-bundle-constant-patterns.test.mjs": 4,
-      "config/scripts/terminal-ime-e2e-workflow.test.mjs": 9,
-      "config/scripts/terminal-ime-engagement-receipt.test.mjs": 11,
-      "config/scripts/terminal-perf-report-annotations.test.mjs": 4,
-      "config/scripts/trim-windows-icon-source.test.mjs": 121,
-      "config/scripts/verify-cli-bin.test.mjs": 64,
-      "config/scripts/verify-dev-channel-packaging.test.mjs": 666,
-      "config/scripts/verify-linux-glibc-floor.test.mjs": 118,
-      "config/scripts/verify-localization-catalog.test.mjs": 46,
-      "config/scripts/verify-localization-extraction.test.mjs": 5,
-      "config/scripts/verify-packaged-browser-participation.test.mjs": 10,
-      "config/scripts/verify-packaged-daemon-entry.test.mjs": 111,
-      "config/scripts/verify-packaged-node-pty-job-ownership.test.mjs": 10,
-      "config/scripts/verify-packaged-plugin-resources.test.mjs": 67,
-      "config/scripts/verify-release-required-assets.test.mjs": 8,
-      "config/scripts/verify-skills-cli-runtime.test.mjs": 141,
-      "config/scripts/verify-windows-inner-signature.test.mjs": 20,
-      "config/scripts/verify-wsl-e2e-participation.test.mjs": 9,
-      "config/scripts/websocket-server-loopback-bind.test.ts": 5,
-      "config/scripts/win-crash-survival-e2e.test.mjs": 12,
-      "config/scripts/win32-test-lane-registration.test.mjs": 22,
-      "config/scripts/windows-cmd-shim-spawn-boundary.test.mjs": 6,
-      "config/scripts/windows-process-tree-gyp-path.test.mjs": 42,
-      "config/scripts/windows-process-tree-gyp-rebuild.test.mjs": 49,
-      "config/scripts/windows-process-tree-patch-contract.test.mjs": 530,
-      "config/scripts/windows-pty-native-capability-workflow.test.mjs": 7,
-      "config/scripts/windows-signing-gate-toolset.test.mjs": 53,
-      "config/scripts/windows-signing-workflow-contract.test.mjs": 531,
-      "config/scripts/windows-uninstaller-signing.test.mjs": 17,
-      "config/scripts/workflow-ref-mirror-case-safety.test.mjs": 74,
-      "config/scripts/workflow-ref-reachability.test.mjs": 592,
-      "config/scripts/wsl-e2e-lane-contract.test.mjs": 76,
-      "config/scripts/xterm-webgl-runtime-contract.test.mjs": 19,
-      "src/cli/agent-context.test.ts": 16,
-      "src/cli/args.test.ts": 36,
-      "src/cli/automation-format.test.ts": 16,
-      "src/cli/automation-owner-conflict-recovery.test.ts": 12,
-      "src/cli/base64-payload-byte-count.test.ts": 3,
-      "src/cli/browser-cookie-credentials-empty-value.test.ts": 58,
-      "src/cli/browser-storage-empty-value.test.ts": 48,
-      "src/cli/browser.test.ts": 109,
-      "src/cli/cli-command-name-parity.test.ts": 7,
-      "src/cli/cli-version.test.ts": 13,
-      "src/cli/codex-command-classification.test.ts": 11,
-      "src/cli/command-suggestion-budget.test.ts": 25,
-      "src/cli/command-suggestion.test.ts": 20,
-      "src/cli/computer-format.test.ts": 3,
-      "src/cli/emulator-logcat-format.test.ts": 4,
-      "src/cli/execution-host-flag.test.ts": 21,
-      "src/cli/flags.test.ts": 4,
-      "src/cli/format-recovery.test.ts": 10,
-      "src/cli/format.test.ts": 29,
-      "src/cli/handler-group-manifest.test.ts": 638,
-      "src/cli/handlers/account.test.ts": 558,
-      "src/cli/handlers/agent-hooks.test.ts": 83,
-      "src/cli/handlers/artifacts.test.ts": 36,
-      "src/cli/handlers/automation-destination-fencing.test.ts": 17,
-      "src/cli/handlers/automation-owner-fencing.test.ts": 16,
-      "src/cli/handlers/computer-action-routing.test.ts": 69,
-      "src/cli/handlers/computer-action-validation.test.ts": 86,
-      "src/cli/handlers/computer-state-formatting.test.ts": 65,
-      "src/cli/handlers/computer.test.ts": 103,
-      "src/cli/handlers/core.test.ts": 7,
-      "src/cli/handlers/emulator.test.ts": 37,
-      "src/cli/handlers/file-absolute-paths.test.ts": 60,
-      "src/cli/handlers/file.test.ts": 46,
-      "src/cli/handlers/interactive-login-interruption.test.ts": 12,
-      "src/cli/handlers/linear.test.ts": 131,
-      "src/cli/handlers/orchestration-caller-identity-cli.test.ts": 18,
-      "src/cli/handlers/orchestration-check-identity.test.ts": 12,
-      "src/cli/handlers/orchestration-federated-legacy-settlement.test.ts": 8,
-      "src/cli/handlers/orchestration-gate-cli.test.ts": 99,
-      "src/cli/handlers/orchestration-legacy-read-only.test.ts": 9,
-      "src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts": 15,
-      "src/cli/handlers/orchestration-lifecycle-rejection.test.ts": 12,
-      "src/cli/handlers/orchestration-migration.test.ts": 12,
-      "src/cli/handlers/orchestration-module-boundaries.test.ts": 11,
-      "src/cli/handlers/orchestration-request-show-cli.test.ts": 7,
-      "src/cli/handlers/orchestration-run-cli.test.ts": 22,
-      "src/cli/handlers/orchestration-send-receipt-warnings.test.ts": 7,
-      "src/cli/handlers/orchestration-task-create-cli.test.ts": 8,
-      "src/cli/handlers/orchestration-task-list-brief.test.ts": 12,
-      "src/cli/handlers/orchestration-timeout-cli.test.ts": 29,
-      "src/cli/handlers/orchestration-timeout.test.ts": 26,
-      "src/cli/handlers/orchestration-windows-ask-cli.test.ts": 11,
-      "src/cli/handlers/orchestration-worker-cli.test.ts": 32,
-      "src/cli/handlers/orchestration-worker-show-wait-cli.test.ts": 9,
-      "src/cli/handlers/orchestration.test.ts": 31,
-      "src/cli/handlers/orchestration/worker-list-run-scope.test.ts": 13,
-      "src/cli/handlers/orchestration/worker-output.test.ts": 13,
-      "src/cli/handlers/skill-sharing.test.ts": 16,
-      "src/cli/handlers/terminal.test.ts": 29,
-      "src/cli/host-selector-alternatives.test.ts": 14,
-      "src/cli/index-automation-identifiers.test.ts": 42,
-      "src/cli/index-automation-schedule.test.ts": 64,
-      "src/cli/index-automation-session-reuse.test.ts": 54,
-      "src/cli/index-automation-source-context.test.ts": 75,
-      "src/cli/index-automation-target.test.ts": 89,
-      "src/cli/index-device-commands.test.ts": 57,
-      "src/cli/index-environment-commands.test.ts": 103,
-      "src/cli/index-local-command-routing-flags.test.ts": 141,
-      "src/cli/index-memory-diagnostics.test.ts": 54,
-      "src/cli/index-omitted-host-scope-selectors.test.ts": 54,
-      "src/cli/index-orchestration.test.ts": 72,
-      "src/cli/index-project-setup.test.ts": 95,
-      "src/cli/index-serve-command.test.ts": 121,
-      "src/cli/index-terminal-commands.test.ts": 78,
-      "src/cli/index-terminal-list-host-scope.test.ts": 92,
-      "src/cli/index-vm-recipe-doctor.test.ts": 125,
-      "src/cli/index-worktree-create-agent.test.ts": 64,
-      "src/cli/index-worktree-create-linear.test.ts": 44,
-      "src/cli/index-worktree-create-parent.test.ts": 118,
-      "src/cli/index-worktree-create-target.test.ts": 65,
-      "src/cli/index-worktree-selector-resolution.test.ts": 185,
-      "src/cli/index-worktree-set.test.ts": 83,
-      "src/cli/index.test.ts": 263,
-      "src/cli/linear-format.test.ts": 9,
-      "src/cli/main-module-bundle-parity.test.ts": 14,
-      "src/cli/orchestration-dispatch-refusal-format.test.ts": 8,
-      "src/cli/orchestration-mutation-recovery.test.ts": 52,
-      "src/cli/orchestration-structured-sender-identity.test.ts": 93,
-      "src/cli/orchestration-structured-session-no-identity.test.ts": 11,
-      "src/cli/quote-stripped-json-flag.test.ts": 8,
-      "src/cli/registry-parity.test.ts": 7,
-      "src/cli/retry-request-flag.test.ts": 9,
-      "src/cli/runtime-client-deferral.test.ts": 486,
-      "src/cli/runtime-client.test.ts": 110,
-      "src/cli/runtime/client-recovery.test.ts": 250,
-      "src/cli/runtime/client-timeout-policy.test.ts": 13,
-      "src/cli/runtime/envelope-schema.test.ts": 33,
-      "src/cli/runtime/environments.test.ts": 27,
-      "src/cli/runtime/launch.test.ts": 53,
-      "src/cli/runtime/orchestration-recovery-command.test.ts": 5,
-      "src/cli/runtime/serve-signal-exit-diagnostic.test.ts": 28,
-      "src/cli/runtime/status.test.ts": 19,
-      "src/cli/runtime/transport-framing.test.ts": 78,
-      "src/cli/runtime/transport.test.ts": 533,
-      "src/cli/runtime/types.test.ts": 5,
-      "src/cli/runtime/websocket-transport-error.test.ts": 8,
-      "src/cli/runtime/websocket-transport.test.ts": 176,
-      "src/cli/serve-electron-flag-parity.test.ts": 8,
-      "src/cli/shell-command-quote.test.ts": 8,
-      "src/cli/skill-guide-cli-parity.test.ts": 14,
-      "src/cli/skills-reference-selector.test.ts": 28,
-      "src/cli/skills.test.ts": 963,
-      "src/cli/specs/account.test.ts": 6,
-      "src/cli/specs/bundled-guide-flags.test.ts": 40,
-      "src/cli/specs/computer.test.ts": 9,
-      "src/cli/specs/orchestration.test.ts": 16,
-      "src/cli/specs/skills.test.ts": 6,
-      "src/cli/terminal-format-draft.test.ts": 6,
-      "src/cli/terminal-format.test.ts": 12,
-      "src/cli/terminal-list-host-scope-format.test.ts": 8,
-      "src/cli/terminal-read-screen.test.ts": 68,
-      "src/cli/vocabulary-policy.test.ts": 8,
-      "src/cli/worktree-selector-wsl-posix-path.test.ts": 11,
-      "src/main/active-view-persistence-boundary.test.ts": 725,
-      "src/main/active-view-preference-sync-flush-veto.test.ts": 777,
-      "src/main/active-view-preference.test.ts": 20,
-      "src/main/agent-auth-restart-preservation.test.ts": 16,
-      "src/main/agent-awake-service-platform-assertions.test.ts": 10,
-      "src/main/agent-awake-service.test.ts": 29,
-      "src/main/agent-hooks/branch-rename-failure-output.test.ts": 7,
-      "src/main/agent-hooks/ended-process-reconciliation.test.ts": 34,
-      "src/main/agent-hooks/first-work-branch-rename.test.ts": 140,
-      "src/main/agent-hooks/first-work-folder-rename.test.ts": 13,
-      "src/main/agent-hooks/hook-script-outside-orca.test.ts": 32,
-      "src/main/agent-hooks/hook-status-session-tabs-republish.test.ts": 22,
-      "src/main/agent-hooks/install-telemetry.test.ts": 10,
-      "src/main/agent-hooks/installer-utils-remote.test.ts": 14,
-      "src/main/agent-hooks/installer-utils.test.ts": 66,
-      "src/main/agent-hooks/local-agent-cli-presence.test.ts": 11,
-      "src/main/agent-hooks/managed-agent-hook-controls.test.ts": 76,
-      "src/main/agent-hooks/managed-hook-detection-commands.test.ts": 5,
-      "src/main/agent-hooks/managed-hook-install-lock.test.ts": 263,
-      "src/main/agent-hooks/managed-hook-local-filesystem.test.ts": 147,
-      "src/main/agent-hooks/managed-hook-owner-identity.test.ts": 33,
-      "src/main/agent-hooks/managed-hook-runtime.test.ts": 41,
-      "src/main/agent-hooks/managed-hook-script-refresh-main-thread.test.ts": 27,
-      "src/main/agent-hooks/managed-hook-script-refresh.test.ts": 108,
-      "src/main/agent-hooks/managed-hook-stdin-lifecycle.test.ts": 1979,
-      "src/main/agent-hooks/managed-hook-timeout.test.ts": 1585,
-      "src/main/agent-hooks/managed-toml-ownership.test.ts": 12,
-      "src/main/agent-hooks/manual-compact-hook-stream.test.ts": 119,
-      "src/main/agent-hooks/manual-compact-status-cleanup.test.ts": 6,
-      "src/main/agent-hooks/migration-unsupported-pty-state.test.ts": 8,
-      "src/main/agent-hooks/opencode-message-part-flood-bench.test.ts": 1234,
-      "src/main/agent-hooks/remote-hook-service-installers.test.ts": 89,
-      "src/main/agent-hooks/restored-subagent-liveness-sweep.test.ts": 75,
-      "src/main/agent-hooks/server-ai-vault-liveness.test.ts": 34,
-      "src/main/agent-hooks/server-amp-normalization.test.ts": 13,
-      "src/main/agent-hooks/server-authority-evidence.test.ts": 21,
-      "src/main/agent-hooks/server-claude-child-permission-lifecycle.test.ts": 213,
-      "src/main/agent-hooks/server-claude-normalization.test.ts": 36,
-      "src/main/agent-hooks/server-claude-permission-visibility.test.ts": 114,
-      "src/main/agent-hooks/server-claude-statusline.test.ts": 41,
-      "src/main/agent-hooks/server-closed-tab-suppression.test.ts": 167,
-      "src/main/agent-hooks/server-codex-normalization.test.ts": 14,
-      "src/main/agent-hooks/server-codex-subagent-transcript.test.ts": 4092,
-      "src/main/agent-hooks/server-copilot-normalization.test.ts": 416,
-      "src/main/agent-hooks/server-cursor-normalization.test.ts": 13,
-      "src/main/agent-hooks/server-droid-normalization.test.ts": 10,
-      "src/main/agent-hooks/server-endpoint-file-lifecycle.test.ts": 35,
-      "src/main/agent-hooks/server-gemini-normalization.test.ts": 13,
-      "src/main/agent-hooks/server-grok-discovery.test.ts": 513,
-      "src/main/agent-hooks/server-hook-http-ingest.test.ts": 94,
-      "src/main/agent-hooks/server-ingest-remote.test.ts": 45,
-      "src/main/agent-hooks/server-ingest-structured-status.test.ts": 34,
-      "src/main/agent-hooks/server-ingest-terminal-status.test.ts": 18,
-      "src/main/agent-hooks/server-interrupt-inference-guards.test.ts": 76,
-      "src/main/agent-hooks/server-interrupt-inference-resurrection.test.ts": 35,
-      "src/main/agent-hooks/server-interrupt-inference-validation.test.ts": 24,
-      "src/main/agent-hooks/server-last-status-hydrate-confirmation.test.ts": 75,
-      "src/main/agent-hooks/server-last-status-hydrate-validation.test.ts": 83,
-      "src/main/agent-hooks/server-last-status-lead-boundary.test.ts": 172,
-      "src/main/agent-hooks/server-last-status-restored-children.test.ts": 596,
-      "src/main/agent-hooks/server-last-status-write.test.ts": 125,
-      "src/main/agent-hooks/server-observation-provenance.test.ts": 27,
-      "src/main/agent-hooks/server-opencode-lifecycle.test.ts": 228,
-      "src/main/agent-hooks/server-opencode-normalization.test.ts": 15,
-      "src/main/agent-hooks/server-pane-authority.test.ts": 254,
-      "src/main/agent-hooks/server-pi-normalization.test.ts": 14,
-      "src/main/agent-hooks/server-prompt-sent-telemetry.test.ts": 59,
-      "src/main/agent-hooks/server-relay-listener-replay.test.ts": 25,
-      "src/main/agent-hooks/server-reminted-pane-key.test.ts": 112,
-      "src/main/agent-hooks/server-replay-evidence-clock.test.ts": 28,
-      "src/main/agent-hooks/server-retired-pane-new-turn.test.ts": 21,
-      "src/main/agent-hooks/server-start-failure-lifecycle.test.ts": 32,
-      "src/main/agent-hooks/server-status-listener-fanout.test.ts": 84,
-      "src/main/agent-hooks/server-transport-interference.test.ts": 5826,
-      "src/main/agent-hooks/server.claude-interactive-question.test.ts": 21,
-      "src/main/agent-hooks/spool.test.ts": 134,
-      "src/main/agent-hooks/terminal-handle-row-identity.test.ts": 40,
-      "src/main/agent-hooks/windows-direct-cmd-hook-command.test.ts": 8,
-      "src/main/agent-hooks/windows-hook-payload-delivery.test.ts": 8,
-      "src/main/agent-hooks/windows-hook-post-interpreter.test.ts": 83,
-      "src/main/agent-hooks/windows-powershell-hook-launcher.test.ts": 5,
-      "src/main/agent-hooks/wsl-guest-plugin-install.test.ts": 9,
-      "src/main/agent-hooks/wsl-hook-relay-launch.test.ts": 7,
-      "src/main/agent-hooks/wsl-hook-relay-live.integration.test.ts": 2716,
-      "src/main/agent-hooks/wsl-hook-relay-manager.test.ts": 1110,
-      "src/main/agent-hooks/wsl-hook-relay-reattach.test.ts": 6,
-      "src/main/agent-hooks/wsl-hook-relay-recovery.test.ts": 2323,
-      "src/main/agent-hooks/wsl-hook-relay-sentinel.test.ts": 17,
-      "src/main/agent-state-file-reader.test.ts": 39,
-      "src/main/agent-trust-presets.test.ts": 33,
-      "src/main/ai-vault-search/session-search-content-hash.test.ts": 5,
-      "src/main/ai-vault-search/session-search-cwd-key.test.ts": 9,
-      "src/main/ai-vault-search/session-search-deleted-sources.test.ts": 176,
-      "src/main/ai-vault-search/session-search-directory-listings.test.ts": 10,
-      "src/main/ai-vault-search/session-search-engine.test.ts": 1166,
-      "src/main/ai-vault-search/session-search-file-write.test.ts": 423,
-      "src/main/ai-vault-search/session-search-fts5-contract.test.ts": 62,
-      "src/main/ai-vault-search/session-search-hit-ranking.test.ts": 13,
-      "src/main/ai-vault-search/session-search-identifier-split.test.ts": 8,
-      "src/main/ai-vault-search/session-search-index-consumer.test.ts": 172,
-      "src/main/ai-vault-search/session-search-index-generation.test.ts": 111,
-      "src/main/ai-vault-search/session-search-index-pass.test.ts": 134,
-      "src/main/ai-vault-search/session-search-index-writer.test.ts": 114,
-      "src/main/ai-vault-search/session-search-indexer.test.ts": 2283,
-      "src/main/ai-vault-search/session-search-lifecycle-matrix.test.ts": 4538,
-      "src/main/ai-vault-search/session-search-live-transcript.test.ts": 83,
-      "src/main/ai-vault-search/session-search-merged-roots.test.ts": 111,
-      "src/main/ai-vault-search/session-search-message-rows.test.ts": 787,
-      "src/main/ai-vault-search/session-search-native-chat-indexing.test.ts": 211,
-      "src/main/ai-vault-search/session-search-opencode-decline.test.ts": 218,
-      "src/main/ai-vault-search/session-search-orphan-rows.test.ts": 179,
-      "src/main/ai-vault-search/session-search-paging.test.ts": 497,
-      "src/main/ai-vault-search/session-search-query-planner.test.ts": 14,
-      "src/main/ai-vault-search/session-search-read-decision.test.ts": 4,
-      "src/main/ai-vault-search/session-search-retention-delete.test.ts": 108,
-      "src/main/ai-vault-search/session-search-retention-policy.test.ts": 4,
-      "src/main/ai-vault-search/session-search-row-filter.test.ts": 194,
-      "src/main/ai-vault-search/session-search-row-identity.test.ts": 52,
-      "src/main/ai-vault-search/session-search-scan-roots.test.ts": 5,
-      "src/main/ai-vault-search/session-search-schema.test.ts": 322,
-      "src/main/ai-vault-search/session-search-sidebar-parity.test.ts": 213,
-      "src/main/ai-vault-search/session-search-snippet-marks.test.ts": 118,
-      "src/main/ai-vault-search/session-search-store-is-memory.test.ts": 305,
-      "src/main/ai-vault-search/session-search-synthetic-corpus.test.ts": 188,
-      "src/main/ai-vault-search/session-search-typo-policy.test.ts": 556,
-      "src/main/ai-vault-search/session-search-typo-scope.test.ts": 47,
-      "src/main/ai-vault/ai-vault-scan-cancellation.test.ts": 5,
-      "src/main/ai-vault/ai-vault-scan-coordinator.test.ts": 16,
-      "src/main/ai-vault/cached-session-list.test.ts": 10,
-      "src/main/ai-vault/claude-project-dir-encoding.test.ts": 10,
-      "src/main/ai-vault/codex-session-collection.test.ts": 32,
-      "src/main/ai-vault/codex-session-root-dedup.test.ts": 13,
-      "src/main/ai-vault/local-log-tail-reader.test.ts": 25,
-      "src/main/ai-vault/remote-session-parse-cache.test.ts": 26,
-      "src/main/ai-vault/remote-session-scan-batching.test.ts": 6,
-      "src/main/ai-vault/remote-session-scanner-omp-subagents.test.ts": 29,
-      "src/main/ai-vault/remote-session-scanner.test.ts": 37,
-      "src/main/ai-vault/remote-session-sidecar-observation.test.ts": 31,
-      "src/main/ai-vault/runtime-session-scanner.test.ts": 16,
-      "src/main/ai-vault/session-delete-target.test.ts": 20,
-      "src/main/ai-vault/session-delete.test.ts": 22,
-      "src/main/ai-vault/session-first-user-prompt-read.test.ts": 28,
-      "src/main/ai-vault/session-list-result-validation.test.ts": 27,
-      "src/main/ai-vault/session-list-results.test.ts": 12,
-      "src/main/ai-vault/session-newest-files.test.ts": 121,
-      "src/main/ai-vault/session-parse-cache-persistence.test.ts": 73,
-      "src/main/ai-vault/session-scanner-antigravity-parser.test.ts": 9,
-      "src/main/ai-vault/session-scanner-antigravity-source.test.ts": 57,
-      "src/main/ai-vault/session-scanner-background.test.ts": 8,
-      "src/main/ai-vault/session-scanner-claude-cwd-drift.test.ts": 23,
-      "src/main/ai-vault/session-scanner-claude-subagent-prune.test.ts": 21,
-      "src/main/ai-vault/session-scanner-claude-subagents.test.ts": 71,
-      "src/main/ai-vault/session-scanner-claude-title.test.ts": 32,
-      "src/main/ai-vault/session-scanner-claude-unicode-scope.test.ts": 43,
-      "src/main/ai-vault/session-scanner-cline-parser.test.ts": 32,
-      "src/main/ai-vault/session-scanner-codex-dual-root.test.ts": 51,
-      "src/main/ai-vault/session-scanner-codex-fast-path.test.ts": 180,
-      "src/main/ai-vault/session-scanner-codex-parser.test.ts": 47,
-      "src/main/ai-vault/session-scanner-codex-title-index.test.ts": 175,
-      "src/main/ai-vault/session-scanner-codex-tool-records.test.ts": 16,
-      "src/main/ai-vault/session-scanner-codex-workers.test.ts": 36,
-      "src/main/ai-vault/session-scanner-core-parser-wsl-stall.test.ts": 45,
-      "src/main/ai-vault/session-scanner-cursor-chat-meta.test.ts": 154,
-      "src/main/ai-vault/session-scanner-dedup-batches.test.ts": 228,
-      "src/main/ai-vault/session-scanner-devin-parser.test.ts": 13,
-      "src/main/ai-vault/session-scanner-directory-reader.test.ts": 15,
-      "src/main/ai-vault/session-scanner-discovery-wsl-gate.test.ts": 16,
-      "src/main/ai-vault/session-scanner-first-user-prompt.test.ts": 9,
-      "src/main/ai-vault/session-scanner-fs-import-guard.test.ts": 28,
-      "src/main/ai-vault/session-scanner-graph-parsers.test.ts": 6,
-      "src/main/ai-vault/session-scanner-grok-parser.test.ts": 26,
-      "src/main/ai-vault/session-scanner-grok-user-text.test.ts": 6,
-      "src/main/ai-vault/session-scanner-index-cache-wsl-stall.test.ts": 25,
-      "src/main/ai-vault/session-scanner-injected-title.test.ts": 29,
-      "src/main/ai-vault/session-scanner-jsonl-reader.test.ts": 84,
-      "src/main/ai-vault/session-scanner-kimi-index-cache.test.ts": 31,
-      "src/main/ai-vault/session-scanner-kimi-parser.test.ts": 153,
-      "src/main/ai-vault/session-scanner-omp-subagent-listing.test.ts": 24,
-      "src/main/ai-vault/session-scanner-omp-subagent-prune.test.ts": 38,
-      "src/main/ai-vault/session-scanner-omp-subagent-transcripts.test.ts": 15,
-      "src/main/ai-vault/session-scanner-opencode-parser.test.ts": 25,
-      "src/main/ai-vault/session-scanner-opencode-sources-wsl-stall.test.ts": 23,
-      "src/main/ai-vault/session-scanner-opencode-sources.test.ts": 9,
-      "src/main/ai-vault/session-scanner-opencode-sqlite-bounds.test.ts": 539,
-      "src/main/ai-vault/session-scanner-opencode-sqlite-coexistence.test.ts": 58,
-      "src/main/ai-vault/session-scanner-opencode-sqlite-open.test.ts": 4131,
-      "src/main/ai-vault/session-scanner-opencode-sqlite-paths.test.ts": 9,
-      "src/main/ai-vault/session-scanner-opencode-sqlite-worker-client.test.ts": 23,
-      "src/main/ai-vault/session-scanner-opencode-sqlite-worker-spawn.test.ts": 6,
-      "src/main/ai-vault/session-scanner-opencode-sqlite.test.ts": 225,
-      "src/main/ai-vault/session-scanner-parse-cache-agents.test.ts": 198,
-      "src/main/ai-vault/session-scanner-parse-cache.test.ts": 57,
-      "src/main/ai-vault/session-scanner-parse-wsl-stall.test.ts": 31,
-      "src/main/ai-vault/session-scanner-parser-stream-cleanup.test.ts": 21,
-      "src/main/ai-vault/session-scanner-preview-window-truncation.test.ts": 6,
-      "src/main/ai-vault/session-scanner-recoverable-empty.test.ts": 57,
-      "src/main/ai-vault/session-scanner-roots.test.ts": 7,
-      "src/main/ai-vault/session-scanner-scope.test.ts": 82,
-      "src/main/ai-vault/session-scanner-service-client.test.ts": 178,
-      "src/main/ai-vault/session-scanner-service-entry-path.test.ts": 5,
-      "src/main/ai-vault/session-scanner-service-entry.test.ts": 486,
-      "src/main/ai-vault/session-scanner-service-env.test.ts": 8,
-      "src/main/ai-vault/session-scanner-service-restart-policy.test.ts": 6,
-      "src/main/ai-vault/session-scanner-service-spawn.test.ts": 6,
-      "src/main/ai-vault/session-scanner-values.test.ts": 21,
-      "src/main/ai-vault/session-scanner-worker-client.test.ts": 17,
-      "src/main/ai-vault/session-scanner.test.ts": 109,
-      "src/main/ai-vault/session-sidecar-stat.test.ts": 9,
-      "src/main/ai-vault/session-title-file-reader-wsl-stall.test.ts": 22,
-      "src/main/ai-vault/session-title-file-reader.test.ts": 15,
-      "src/main/ai-vault/session-transcript-consumers.test.ts": 107,
-      "src/main/ai-vault/session-transcript-message-content.test.ts": 10,
-      "src/main/ai-vault/ssh-session-list.test.ts": 87,
-      "src/main/ai-vault/structured-session-ownership.test.ts": 18,
-      "src/main/amp/hook-service.test.ts": 13,
-      "src/main/antigravity/hook-service.test.ts": 61,
-      "src/main/antigravity/windows-hook-payload-delivery.test.ts": 10,
-      "src/main/app-icon.test.ts": 24,
-      "src/main/app-relaunch.test.ts": 7,
-      "src/main/appimage-runtime-identity.test.ts": 36,
-      "src/main/appkit-scene-mutation.test.ts": 9,
-      "src/main/artifacts/artifact-cloud-config.test.ts": 6,
-      "src/main/artifacts/artifact-cloud-recovery.test.ts": 132,
-      "src/main/artifacts/artifact-cloud-service-races.test.ts": 219,
-      "src/main/artifacts/artifact-cloud-service.test.ts": 725,
-      "src/main/artifacts/artifact-create-intent-store.test.ts": 339,
-      "src/main/artifacts/artifact-recovery-directory-fsync.test.ts": 14,
-      "src/main/artifacts/artifact-share-record-store.test.ts": 310,
-      "src/main/asar-transparent-fs.test.ts": 9,
-      "src/main/automations/automation-dispatch-host-fence.test.ts": 1300,
-      "src/main/automations/automation-owner-fencing.test.ts": 1874,
-      "src/main/automations/automation-owner-migration.test.ts": 17,
-      "src/main/automations/automation-run-terminal-surface.test.ts": 34,
-      "src/main/automations/automation-run-writer.test.ts": 7,
-      "src/main/automations/automation-skip-coalescing.test.ts": 1783,
-      "src/main/automations/automation-ssh-readoption-migration.test.ts": 9,
-      "src/main/automations/automation-update-host-retarget.test.ts": 1187,
-      "src/main/automations/automation-workspace-host-attribution.test.ts": 757,
-      "src/main/automations/external-automation-manager-cache.test.ts": 12,
-      "src/main/automations/external-automation-owner-guard.test.ts": 8,
-      "src/main/automations/external-automation-probe-scheduler.test.ts": 123,
-      "src/main/automations/external-job-run-sorting.test.ts": 170,
-      "src/main/automations/external-manager-scoped.test.ts": 23,
-      "src/main/automations/external-manager.test.ts": 15,
-      "src/main/automations/headless-workspace-create.test.ts": 9,
-      "src/main/automations/hermes-cron-output.test.ts": 73,
-      "src/main/automations/precheck-runner.test.ts": 1066,
-      "src/main/automations/refused-manual-run.test.ts": 2290,
-      "src/main/automations/retained-run-reconciliation.test.ts": 491,
-      "src/main/automations/run-completion-watcher.test.ts": 1046,
-      "src/main/automations/run-target-resolution.test.ts": 6,
-      "src/main/automations/runtime-terminal-run-observer.test.ts": 54,
-      "src/main/automations/service-precheck.test.ts": 931,
-      "src/main/automations/service.test.ts": 1218,
-      "src/main/azure-devops/azure-devops-api-request.test.ts": 61,
-      "src/main/azure-devops/client.test.ts": 84,
-      "src/main/azure-devops/pull-request-creation.test.ts": 74,
-      "src/main/azure-devops/pull-request-mappers.test.ts": 5,
-      "src/main/azure-devops/repository-ref.test.ts": 33,
-      "src/main/bitbucket/client.test.ts": 102,
-      "src/main/bitbucket/credential-connection.test.ts": 151,
-      "src/main/bitbucket/credential-store.test.ts": 146,
-      "src/main/bitbucket/pull-request-creation.test.ts": 70,
-      "src/main/bitbucket/pull-request-mappers.test.ts": 7,
-      "src/main/bitbucket/repository-ref.test.ts": 24,
-      "src/main/bitbucket/status-no-decrypt.test.ts": 171,
-      "src/main/browser/agent-browser-bridge-capture-paint-hold.test.ts": 91,
-      "src/main/browser/agent-browser-bridge-command-transport.test.ts": 102,
-      "src/main/browser/agent-browser-bridge-mouse-input.test.ts": 24,
-      "src/main/browser/agent-browser-bridge-navigation.test.ts": 156,
-      "src/main/browser/agent-browser-bridge-session-lifecycle.test.ts": 244,
-      "src/main/browser/agent-browser-bridge-tab-routing.test.ts": 89,
-      "src/main/browser/agent-browser-bridge-text-input.test.ts": 104,
-      "src/main/browser/agent-browser-orphan-sweep.test.ts": 14,
-      "src/main/browser/agent-browser-process-environment.test.ts": 9,
-      "src/main/browser/agent-browser-session-reset.test.ts": 9,
-      "src/main/browser/browser-certificate-trust-controller.test.ts": 186,
-      "src/main/browser/browser-clicked-link-routing.test.ts": 111,
-      "src/main/browser/browser-client-download-relay.test.ts": 39,
-      "src/main/browser/browser-client-download-routing.test.ts": 12,
-      "src/main/browser/browser-client-file-channel-negotiation.test.ts": 13,
-      "src/main/browser/browser-client-file-channel-reconnect.test.ts": 317,
-      "src/main/browser/browser-client-host-attach-request.test.ts": 13,
-      "src/main/browser/browser-client-host-authority-replacement.test.ts": 20,
-      "src/main/browser/browser-client-host-command-dispatcher.test.ts": 26,
-      "src/main/browser/browser-client-host-id.test.ts": 37,
-      "src/main/browser/browser-client-host-placement-preparation.test.ts": 17,
-      "src/main/browser/browser-client-host-published-url-wiring.test.ts": 451,
-      "src/main/browser/browser-client-host-reconciliation-command-order.test.ts": 19,
-      "src/main/browser/browser-client-network-route-registry.test.ts": 45,
-      "src/main/browser/browser-client-page-automation-runtime.test.ts": 15,
-      "src/main/browser/browser-client-page-command-executor-fencing.test.ts": 25,
-      "src/main/browser/browser-client-page-command-executor.test.ts": 33,
-      "src/main/browser/browser-client-page-command-integration.test.ts": 21,
-      "src/main/browser/browser-client-page-execution-host-supersession.test.ts": 12,
-      "src/main/browser/browser-client-page-inventory.test.ts": 68,
-      "src/main/browser/browser-client-page-metadata-transport.test.ts": 21,
-      "src/main/browser/browser-client-page-published-url.test.ts": 12,
-      "src/main/browser/browser-client-page-reconciliation-adapters.test.ts": 28,
-      "src/main/browser/browser-client-page-renderer-bridge.test.ts": 35,
-      "src/main/browser/browser-client-page-renderer-lifecycle.electron.test.ts": 1571,
-      "src/main/browser/browser-client-page-renderer-runtime.test.ts": 12,
-      "src/main/browser/browser-client-page-unavailability.test.ts": 13,
-      "src/main/browser/browser-client-page-upload-routing.test.ts": 60,
-      "src/main/browser/browser-client-route-cookie-import-partition-parity.test.ts": 20,
-      "src/main/browser/browser-client-route-cookie-import.test.ts": 14,
-      "src/main/browser/browser-client-upload-command.test.ts": 34,
-      "src/main/browser/browser-client-upload-staging.test.ts": 57,
-      "src/main/browser/browser-client-upload-transfer.test.ts": 3444,
-      "src/main/browser/browser-cookie-clear-preserve.test.ts": 71,
-      "src/main/browser/browser-cookie-clear-store-lifecycle.test.ts": 11,
-      "src/main/browser/browser-cookie-clear-store.test.ts": 25,
-      "src/main/browser/browser-cookie-import-app-bound-prefix.test.ts": 7,
-      "src/main/browser/browser-cookie-import-clear-atomicity.test.ts": 15,
-      "src/main/browser/browser-cookie-import-concurrency.test.ts": 113,
-      "src/main/browser/browser-cookie-import-google-exclusion.test.ts": 135,
-      "src/main/browser/browser-cookie-import-partition-fidelity.test.ts": 502,
-      "src/main/browser/browser-cookie-import-partition-reland.electron.test.ts": 2913,
-      "src/main/browser/browser-cookie-import-partition-rollback.electron.test.ts": 4236,
-      "src/main/browser/browser-cookie-import-partition-success.electron.test.ts": 513,
-      "src/main/browser/browser-cookie-import-partition.electron.test.ts": 606,
-      "src/main/browser/browser-cookie-import-plan-writes.test.ts": 19,
-      "src/main/browser/browser-cookie-import-policy.test.ts": 127,
-      "src/main/browser/browser-cookie-import-replace-partition-rollback.electron.test.ts": 1412,
-      "src/main/browser/browser-cookie-import-replacement.test.ts": 72,
-      "src/main/browser/browser-cookie-import-route-partition-staging.test.ts": 51,
-      "src/main/browser/browser-cookie-import-scope.test.ts": 72,
-      "src/main/browser/browser-cookie-import-undecryptable.test.ts": 285,
-      "src/main/browser/browser-cookie-import-validated-partition.electron.test.ts": 594,
-      "src/main/browser/browser-cookie-import-write.test.ts": 11,
-      "src/main/browser/browser-cookie-import.comet.test.ts": 427,
-      "src/main/browser/browser-cookie-import.helium.test.ts": 358,
-      "src/main/browser/browser-cookie-import.test.ts": 1644,
-      "src/main/browser/browser-cookie-registrable-family.test.ts": 19,
-      "src/main/browser/browser-cookie-samesite.electron.test.ts": 714,
-      "src/main/browser/browser-cookie-source-partition.test.ts": 8,
-      "src/main/browser/browser-cookie-validation.test.ts": 7,
-      "src/main/browser/browser-download-destination.test.ts": 15,
-      "src/main/browser/browser-execution-host-storage-identity.test.ts": 10,
-      "src/main/browser/browser-google-auth-ua.test.ts": 7,
-      "src/main/browser/browser-grab-payload.test.ts": 13,
-      "src/main/browser/browser-guest-shortcut-forwarding.test.ts": 31,
-      "src/main/browser/browser-guest-wheel-zoom-scroll.test.ts": 6,
-      "src/main/browser/browser-host-client-identity.test.ts": 30,
-      "src/main/browser/browser-host-lease-reconnect-delay.test.ts": 6,
-      "src/main/browser/browser-manager-annotation-bridge.test.ts": 16,
-      "src/main/browser/browser-manager-auth-user-agent.test.ts": 19,
-      "src/main/browser/browser-manager-client-hosted-downloads.test.ts": 135,
-      "src/main/browser/browser-manager-downloads.test.ts": 40,
-      "src/main/browser/browser-manager-grab-capture.test.ts": 13,
-      "src/main/browser/browser-manager-grab-mode.test.ts": 16,
-      "src/main/browser/browser-manager-grab-selection.test.ts": 37,
-      "src/main/browser/browser-manager-grab-shortcuts.test.ts": 14,
-      "src/main/browser/browser-manager-guest-lifecycle.test.ts": 33,
-      "src/main/browser/browser-manager-guest-policy-profile.test.ts": 11,
-      "src/main/browser/browser-manager-guest-shortcuts.test.ts": 26,
-      "src/main/browser/browser-manager-guest-visibility.test.ts": 16,
-      "src/main/browser/browser-manager-load-failure-replay.test.ts": 29,
-      "src/main/browser/browser-manager-popup-child.test.ts": 19,
-      "src/main/browser/browser-manager-popup-routing.test.ts": 77,
-      "src/main/browser/browser-manager-viewport-override.test.ts": 45,
-      "src/main/browser/browser-manager-viewport-partial-failure.test.ts": 13,
-      "src/main/browser/browser-network-deferred-socket.test.ts": 6,
-      "src/main/browser/browser-network-execution-route.test.ts": 14,
-      "src/main/browser/browser-network-tunnel-client-memory-budget.test.ts": 13,
-      "src/main/browser/browser-network-tunnel-client.test.ts": 36,
-      "src/main/browser/browser-network-tunnel-conformance.test.ts": 56,
-      "src/main/browser/browser-network-tunnel-outbound-memory-budget.test.ts": 7,
-      "src/main/browser/browser-network-tunnel-session-aggregate-memory.test.ts": 6,
-      "src/main/browser/browser-network-tunnel-session-stream-scoped-failure.test.ts": 26,
-      "src/main/browser/browser-network-tunnel-session.test.ts": 57,
-      "src/main/browser/browser-page-initiated-tab-budget.test.ts": 5,
-      "src/main/browser/browser-route-dns-prefetch.electron.test.ts": 4337,
-      "src/main/browser/browser-route-guest-popups.test.ts": 14,
-      "src/main/browser/browser-route-h3-egress.electron.test.ts": 13849,
-      "src/main/browser/browser-route-identity.test.ts": 8,
-      "src/main/browser/browser-route-partition-binding-capacity.test.ts": 27,
-      "src/main/browser/browser-route-partition-binding-store.test.ts": 42,
-      "src/main/browser/browser-route-partition-migration.test.ts": 261,
-      "src/main/browser/browser-route-partition-stability.test.ts": 30,
-      "src/main/browser/browser-route-partition-storage-lifecycle.test.ts": 33,
-      "src/main/browser/browser-route-partition-storage-retirement.test.ts": 14,
-      "src/main/browser/browser-route-partition-storage-runtime.test.ts": 10,
-      "src/main/browser/browser-route-persisted-worker-egress.electron.test.ts": 1471,
-      "src/main/browser/browser-route-prepared-page-rekey.test.ts": 9,
-      "src/main/browser/browser-route-session-registry.test.ts": 30,
-      "src/main/browser/browser-route-tcp-egress.electron.test.ts": 1082,
-      "src/main/browser/browser-route-webcontents-registry.test.ts": 43,
-      "src/main/browser/browser-route-webrtc-egress.electron.test.ts": 8203,
-      "src/main/browser/browser-screencast-lifecycle.test.ts": 16,
-      "src/main/browser/browser-screencast-snapshot-scaling.test.ts": 116,
-      "src/main/browser/browser-screencast-stream.test.ts": 549,
-      "src/main/browser/browser-session-cookie-staging.scoped.test.ts": 105,
-      "src/main/browser/browser-session-cookie-staging.test.ts": 8,
-      "src/main/browser/browser-session-partition-policies.test.ts": 36,
-      "src/main/browser/browser-session-partition-proxy-install.test.ts": 222,
-      "src/main/browser/browser-session-proxy.test.ts": 171,
-      "src/main/browser/browser-session-registry.persistence.test.ts": 550,
-      "src/main/browser/browser-session-registry.test.ts": 497,
-      "src/main/browser/browser-session-startup.test.ts": 33,
-      "src/main/browser/browser-session-ua-wire-identity.electron.test.ts": 2126,
-      "src/main/browser/browser-text-insertion.test.ts": 19,
-      "src/main/browser/browser-viewport-user-agent.test.ts": 9,
-      "src/main/browser/browser-webauthn-access.test.ts": 7,
-      "src/main/browser/browser-webauthn-account-picker.test.ts": 15,
-      "src/main/browser/browser-webauthn-profile-delete.test.ts": 64,
-      "src/main/browser/cdp-bridge-integration.test.ts": 3216,
-      "src/main/browser/cdp-bridge-state.test.ts": 26,
-      "src/main/browser/cdp-print-to-pdf.test.ts": 22,
-      "src/main/browser/cdp-screenshot.test.ts": 16,
-      "src/main/browser/cdp-ws-proxy-focus-replay.test.ts": 199,
-      "src/main/browser/cdp-ws-proxy.test.ts": 2405,
-      "src/main/browser/chromium-cookie-snapshot.test.ts": 279,
-      "src/main/browser/client-route-cookie-import-source-store.test.ts": 51,
-      "src/main/browser/doc-preview-download-block-notice.test.ts": 15,
-      "src/main/browser/doc-preview-failure-notice.test.ts": 7,
-      "src/main/browser/doc-preview-file-reader.test.ts": 31,
-      "src/main/browser/doc-preview-grant-registry.test.ts": 12,
-      "src/main/browser/doc-preview-guest-policy.test.ts": 46,
-      "src/main/browser/doc-preview-protocol.test.ts": 48,
-      "src/main/browser/electron-debugger-lease.test.ts": 4,
-      "src/main/browser/electron-probe-display-launch.test.ts": 8,
-      "src/main/browser/execution-route-socket-duplex.test.ts": 42,
-      "src/main/browser/grab-guest-script.test.ts": 29,
-      "src/main/browser/local-ssh-browser-partition-identity.test.ts": 11,
-      "src/main/browser/local-ssh-browser-partitions.probe-cache.test.ts": 7,
-      "src/main/browser/local-ssh-browser-route.test.ts": 40,
-      "src/main/browser/offscreen-browser-backend-lifecycle.test.ts": 67,
-      "src/main/browser/offscreen-browser-backend.web-preferences.test.ts": 7,
-      "src/main/browser/paired-runtime-browser-client-host-composition.test.ts": 51,
-      "src/main/browser/paired-runtime-browser-client-host-identity-wiring.test.ts": 732,
-      "src/main/browser/paired-runtime-browser-client-host-reconnect.test.ts": 274,
-      "src/main/browser/paired-runtime-browser-client-host-registry.test.ts": 13,
-      "src/main/browser/paired-runtime-browser-client-host-route-identity.test.ts": 60,
-      "src/main/browser/paired-runtime-browser-client-host-runtime.test.ts": 7,
-      "src/main/browser/paired-runtime-browser-client-host.test.ts": 95,
-      "src/main/browser/paired-runtime-browser-host-command-admission.test.ts": 24,
-      "src/main/browser/paired-runtime-browser-host-lease-reconnect.test.ts": 708,
-      "src/main/browser/paired-runtime-browser-host-lease.test.ts": 692,
-      "src/main/browser/paired-runtime-browser-host-reconciliation-negotiation.test.ts": 66,
-      "src/main/browser/paired-runtime-browser-network-route.test.ts": 1007,
-      "src/main/browser/popup-origin-bar-window.test.ts": 19,
-      "src/main/browser/remote-browser-socks-buffering.test.ts": 1148,
-      "src/main/browser/remote-browser-socks-server.test.ts": 296,
-      "src/main/browser/snapshot-engine.test.ts": 13,
-      "src/main/browser/ssh-browser-network-execution-route.test.ts": 175,
-      "src/main/browser/system-ssh-socks-client-socket.test.ts": 16,
-      "src/main/browser/wsl-browser-network-execution-route.test.ts": 128,
-      "src/main/browser/wsl-browser-network-relay-launch.test.ts": 23,
-      "src/main/claude-accounts/claude-account-service-account-selection.test.ts": 134,
-      "src/main/claude-accounts/claude-account-service-add-account.test.ts": 91,
-      "src/main/claude-accounts/claude-account-service-api-parity.test.ts": 65,
-      "src/main/claude-accounts/claude-account-service-config-dir-capture.test.ts": 157,
-      "src/main/claude-accounts/claude-account-service-credential-capture.test.ts": 94,
-      "src/main/claude-accounts/claude-account-service-login-process.test.ts": 480,
-      "src/main/claude-accounts/claude-account-service-reauth-rollback.test.ts": 193,
-      "src/main/claude-accounts/claude-duplicate-account.test.ts": 4,
-      "src/main/claude-accounts/claude-login-completion.oracle.test.ts": 105,
-      "src/main/claude-accounts/claude-structured-auth-policy.test.ts": 8,
-      "src/main/claude-accounts/claude-windows-interactive-login.test.ts": 75,
-      "src/main/claude-accounts/keychain.test.ts": 13,
-      "src/main/claude-accounts/live-pty-gate.test.ts": 13,
-      "src/main/claude-accounts/oauth-refresh.test.ts": 20,
-      "src/main/claude-accounts/runtime-auth-service-account-switching.test.ts": 147,
-      "src/main/claude-accounts/runtime-auth-service-deselect-restore.test.ts": 284,
-      "src/main/claude-accounts/runtime-auth-service-keychain-snapshots.test.ts": 431,
-      "src/main/claude-accounts/runtime-auth-service-launch-refresh.test.ts": 159,
-      "src/main/claude-accounts/runtime-auth-service-materialization.test.ts": 226,
-      "src/main/claude-accounts/runtime-auth-service-readback-identity.test.ts": 298,
-      "src/main/claude-accounts/runtime-auth-service-snapshot-validation.test.ts": 319,
-      "src/main/claude-accounts/runtime-auth-service-wsl-runtime.test.ts": 197,
-      "src/main/claude-accounts/runtime-selection.test.ts": 4,
-      "src/main/claude-accounts/windows-command-invocation.test.ts": 8,
-      "src/main/claude-usage/claude-model-pricing.test.ts": 12,
-      "src/main/claude-usage/claude-usage-report-aggregation.test.ts": 6,
-      "src/main/claude-usage/scanner-large-directory.test.ts": 530,
-      "src/main/claude-usage/scanner-scan.test.ts": 114,
-      "src/main/claude-usage/scanner.test.ts": 31,
-      "src/main/claude-usage/store.test.ts": 35,
-      "src/main/claude-usage/transcript-record-parser-prefilter.test.ts": 5,
-      "src/main/claude-usage/worktree-attribution-scaling.test.ts": 13,
-      "src/main/claude/claude-agent-sdk-contract-pins.test.ts": 2683,
-      "src/main/claude/claude-agent-sdk-control-requests.test.ts": 10,
-      "src/main/claude/claude-agent-sdk-exit-proof-identity.test.ts": 7,
-      "src/main/claude/claude-agent-sdk-exit-proof.test.ts": 12842,
-      "src/main/claude/claude-agent-sdk-import-boundary.test.ts": 951,
-      "src/main/claude/claude-agent-sdk-process-spawn.test.ts": 13,
-      "src/main/claude/claude-agent-sdk-root-kill-fallback.test.ts": 15,
-      "src/main/claude/claude-agent-sdk-user-message-queue.test.ts": 109,
-      "src/main/claude/claude-background-task-resume.test.ts": 14,
-      "src/main/claude/claude-background-task-tracker.test.ts": 93,
-      "src/main/claude/claude-child-process-environment.test.ts": 4,
-      "src/main/claude/claude-command-lifecycle-frames.test.ts": 7,
-      "src/main/claude/claude-config-dir-pin.test.ts": 6,
-      "src/main/claude/claude-descendant-escalation-boundary.test.ts": 462,
-      "src/main/claude/claude-slash-command-catalog.test.ts": 10,
-      "src/main/claude/claude-stream-json-connection-close.test.ts": 140,
-      "src/main/claude/claude-stream-json-connection.test.ts": 22607,
-      "src/main/claude/claude-streamed-text-checkpoints.test.ts": 9,
-      "src/main/claude/claude-structured-auth-parity.test.ts": 100,
-      "src/main/claude/claude-structured-compaction.test.ts": 10,
-      "src/main/claude/claude-structured-content-parts.test.ts": 18,
-      "src/main/claude/claude-structured-control-actions.test.ts": 12,
-      "src/main/claude/claude-structured-dispatch-admission.test.ts": 15,
-      "src/main/claude/claude-structured-dispatch-content.test.ts": 10,
-      "src/main/claude/claude-structured-dispatch.test.ts": 1411,
-      "src/main/claude/claude-structured-effort-reporting.test.ts": 27,
-      "src/main/claude/claude-structured-inbound-control.test.ts": 15,
-      "src/main/claude/claude-structured-journal-translation-subagents.test.ts": 23,
-      "src/main/claude/claude-structured-journal-translation-turn-timing.test.ts": 22,
-      "src/main/claude/claude-structured-journal-translation.test.ts": 63,
-      "src/main/claude/claude-structured-launch-resolution.test.ts": 28,
-      "src/main/claude/claude-structured-location-support.test.ts": 6,
-      "src/main/claude/claude-structured-model-confirmation.test.ts": 18,
-      "src/main/claude/claude-structured-option-confirmation.test.ts": 16,
-      "src/main/claude/claude-structured-options.test.ts": 8,
-      "src/main/claude/claude-structured-owner-identity.test.ts": 10,
-      "src/main/claude/claude-structured-prompt-items.test.ts": 11,
-      "src/main/claude/claude-structured-provider-fallback.test.ts": 25,
-      "src/main/claude/claude-structured-rewind.test.ts": 25,
-      "src/main/claude/claude-structured-session-acquisition-processless.test.ts": 8,
-      "src/main/claude/claude-structured-session-adapter-turns.test.ts": 25,
-      "src/main/claude/claude-structured-session-adapter.test.ts": 63,
-      "src/main/claude/claude-structured-session-close.test.ts": 26,
-      "src/main/claude/claude-structured-session-commands.test.ts": 10,
-      "src/main/claude/claude-structured-session-recovery.test.ts": 47,
-      "src/main/claude/claude-subagent-group-row.test.ts": 6,
-      "src/main/claude/claude-subagent-id-aliases.test.ts": 7,
-      "src/main/claude/claude-subagent-roster.test.ts": 22,
-      "src/main/claude/claude-subagent-task-frames.test.ts": 12,
-      "src/main/claude/claude-transcript-rewind-proof.test.ts": 10,
-      "src/main/claude/claude-tui-exit.test.ts": 18,
-      "src/main/claude/claude-tui-resume-launch.test.ts": 10,
-      "src/main/claude/claude-tui-resume-proof.test.ts": 9,
-      "src/main/claude/compact-status-registration.test.ts": 27,
-      "src/main/claude/hook-service.test.ts": 58,
-      "src/main/claude/statusline-script.test.ts": 186,
-      "src/main/cli/appimage-extracted-root.test.ts": 148,
-      "src/main/cli/appimage-extraction-pruning.test.ts": 37,
-      "src/main/cli/appimage-payload-removal.reentrancy.test.ts": 12,
-      "src/main/cli/appimage-payload-removal.test.ts": 13,
-      "src/main/cli/appimage-registration-lock.test.ts": 31,
-      "src/main/cli/appimage-stable-launcher.test.ts": 158,
-      "src/main/cli/cli-command-installation-races.test.ts": 78,
-      "src/main/cli/cli-installer-appimage-ownership.test.ts": 104,
-      "src/main/cli/cli-installer-appimage-removal.test.ts": 93,
-      "src/main/cli/cli-installer-command-conflicts.test.ts": 65,
-      "src/main/cli/cli-installer-macos-command-path.test.ts": 84,
-      "src/main/cli/cli-installer-windows-path.test.ts": 59,
-      "src/main/cli/cli-installer.test.ts": 153,
-      "src/main/cli/cli-privileged-processes.test.ts": 10,
-      "src/main/cli/keyed-promise-queue.test.ts": 8,
-      "src/main/cli/legacy-appimage-cli-wrapper.test.ts": 5,
-      "src/main/cli/linux-bare-orca-dispatcher.test.ts": 51,
-      "src/main/cli/linux-terminal-orca-cli-shim.test.ts": 75,
-      "src/main/cli/orca-cli-child-path.test.ts": 14,
-      "src/main/cli/packaged-cli-assets.test.ts": 492,
-      "src/main/cli/windows-launcher-asset.test.ts": 7,
-      "src/main/cli/windows-user-path-registry.test.ts": 10,
-      "src/main/cli/wsl-cli-installer.test.ts": 52,
-      "src/main/cli/wsl-cli-powershell-boundary.test.ts": 6,
-      "src/main/cli/wsl-cli-registration-operation.test.ts": 63,
-      "src/main/cli/wsl-cli-registration-reconciliation.test.ts": 13,
-      "src/main/cli/wsl-cli-registration-registry.test.ts": 84,
-      "src/main/codex-accounts/codex-account-identity-api-key-guard.test.ts": 7,
-      "src/main/codex-accounts/codex-auth-workspace-identity.test.ts": 15,
-      "src/main/codex-accounts/codex-credential-absence-grace.test.ts": 9,
-      "src/main/codex-accounts/codex-windows-interactive-login.test.ts": 234,
-      "src/main/codex-accounts/fs-utils.test.ts": 69,
-      "src/main/codex-accounts/host-codex-managed-home-ownership.test.ts": 12,
-      "src/main/codex-accounts/legacy-shared-auth-migration.test.ts": 62,
-      "src/main/codex-accounts/legacy-shared-config-compatibility.test.ts": 20,
-      "src/main/codex-accounts/legacy-wsl-runtime-auth-drain-apply-script.test.ts": 11759,
-      "src/main/codex-accounts/legacy-wsl-runtime-auth-drain-rollback-script.test.ts": 400,
-      "src/main/codex-accounts/legacy-wsl-runtime-auth-drain.test.ts": 23,
-      "src/main/codex-accounts/managed-codex-auth-readiness.test.ts": 36,
-      "src/main/codex-accounts/runtime-home-legacy-migration.test.ts": 381,
-      "src/main/codex-accounts/runtime-home-managed-auth-recovery.test.ts": 217,
-      "src/main/codex-accounts/runtime-home-mirrored-status-home.test.ts": 163,
-      "src/main/codex-accounts/runtime-home-per-account-homes.test.ts": 440,
-      "src/main/codex-accounts/runtime-home-real-home-lane-routing.test.ts": 278,
-      "src/main/codex-accounts/runtime-home-resume-selection-gate.test.ts": 119,
-      "src/main/codex-accounts/runtime-home-retained-auth-provenance.test.ts": 657,
-      "src/main/codex-accounts/runtime-home-service-per-account-migration.test.ts": 278,
-      "src/main/codex-accounts/runtime-home-session-migration-pass.test.ts": 282,
-      "src/main/codex-accounts/runtime-home-system-default-mirror-readback.test.ts": 709,
-      "src/main/codex-accounts/runtime-home-system-default-snapshot.test.ts": 618,
-      "src/main/codex-accounts/runtime-home-system-resource-materialization.test.ts": 216,
-      "src/main/codex-accounts/runtime-home-windows-profile-ownership.test.ts": 3,
-      "src/main/codex-accounts/runtime-home-wsl-managed-accounts.test.ts": 742,
-      "src/main/codex-accounts/runtime-home-wsl-session-bridge.test.ts": 393,
-      "src/main/codex-accounts/runtime-home-wsl-system-default.test.ts": 408,
-      "src/main/codex-accounts/runtime-selection.test.ts": 6,
-      "src/main/codex-accounts/service-account-add-login.test.ts": 289,
-      "src/main/codex-accounts/service-account-selection-and-removal.test.ts": 614,
-      "src/main/codex-accounts/service-add-account-from-home.test.ts": 177,
-      "src/main/codex-accounts/service-login-process-teardown.test.ts": 166,
-      "src/main/codex-accounts/service-managed-home-removal-retries.test.ts": 165,
-      "src/main/codex-accounts/service-quota-refresh-decoupling.test.ts": 174,
-      "src/main/codex-accounts/service-reauthenticate-activation.test.ts": 129,
-      "src/main/codex-accounts/service-reset-credit-durability.test.ts": 449,
-      "src/main/codex-accounts/service-reset-credit-home-ownership.test.ts": 175,
-      "src/main/codex-accounts/service-reset-credit-target-routing.test.ts": 339,
-      "src/main/codex-accounts/service-system-default-identity.test.ts": 207,
-      "src/main/codex-accounts/service-wsl-accounts.test.ts": 298,
-      "src/main/codex-accounts/service.test.ts": 181,
-      "src/main/codex-accounts/sta-4422-transient-ownership-error.test.ts": 209,
-      "src/main/codex-accounts/sta-4734-login-rollback-deletes-authenticated-home.test.ts": 376,
-      "src/main/codex-accounts/sta-4735-unreadable-host-lane-writes.test.ts": 145,
-      "src/main/codex-accounts/wsl-codex-command.test.ts": 8,
-      "src/main/codex-cli/codex-home-process-lock.test.ts": 15,
-      "src/main/codex-cli/command.test.ts": 39,
-      "src/main/codex-usage/scanner-large-directory.test.ts": 1093,
-      "src/main/codex-usage/scanner-paths.test.ts": 64,
-      "src/main/codex-usage/scanner.test.ts": 10,
-      "src/main/codex-usage/store-automation-usage.test.ts": 12,
-      "src/main/codex-usage/store-model-pricing.test.ts": 17,
-      "src/main/codex-usage/store-orca-scope.test.ts": 17,
-      "src/main/codex-usage/store-persistence.test.ts": 20,
-      "src/main/codex-usage/store-snapshot.benchmark.test.ts": 152,
-      "src/main/codex/codex-account-session-bridge.test.ts": 47,
-      "src/main/codex/codex-ai-vault-session-resume.test.ts": 14,
-      "src/main/codex/codex-app-server-capability-cache.test.ts": 11,
-      "src/main/codex/codex-app-server-client.test.ts": 1418,
-      "src/main/codex/codex-app-server-connection.test.ts": 5017,
-      "src/main/codex/codex-app-server-posix-supervisor.test.ts": 9,
-      "src/main/codex/codex-app-server-process-teardown.test.ts": 26,
-      "src/main/codex/codex-app-server-session.test.ts": 116,
-      "src/main/codex/codex-app-server-teardown.integration.test.ts": 17565,
-      "src/main/codex/codex-background-command-tracker.test.ts": 19,
-      "src/main/codex/codex-background-task-tracker.test.ts": 38,
-      "src/main/codex/codex-config-mirror.test.ts": 96,
-      "src/main/codex/codex-config-settings-removal.test.ts": 5,
-      "src/main/codex/codex-goal-journal-rows.test.ts": 14,
-      "src/main/codex/codex-home-paths.test.ts": 31,
-      "src/main/codex/codex-hook-legacy-profile-block.test.ts": 8,
-      "src/main/codex/codex-hook-trust-grant.test.ts": 241,
-      "src/main/codex/codex-hooks-read-denial-followup.test.ts": 116,
-      "src/main/codex/codex-legacy-session-resume.test.ts": 69,
-      "src/main/codex/codex-model-provider-config.test.ts": 9,
-      "src/main/codex/codex-notice-item-translation.test.ts": 13,
-      "src/main/codex/codex-pane-account-registry-mutations.test.ts": 14,
-      "src/main/codex/codex-pane-launch-account.test.ts": 8,
-      "src/main/codex/codex-persistent-command-retention.test.ts": 226,
-      "src/main/codex/codex-real-home-hook-install.test.ts": 70,
-      "src/main/codex/codex-real-home-path.test.ts": 7,
-      "src/main/codex/codex-requested-close-turn-timing.test.ts": 15,
-      "src/main/codex/codex-resume-process-proof.test.ts": 20,
-      "src/main/codex/codex-rollout-session-meta.test.ts": 21,
-      "src/main/codex/codex-server-request-disposition.test.ts": 21,
-      "src/main/codex/codex-session-backfill-marker.test.ts": 29,
-      "src/main/codex/codex-session-backfill-scan-dates.test.ts": 27,
-      "src/main/codex/codex-session-backfill.test.ts": 408,
-      "src/main/codex/codex-session-bridge.test.ts": 66,
-      "src/main/codex/codex-session-index-heal-state.test.ts": 369,
-      "src/main/codex/codex-session-index-heal.test.ts": 1379,
-      "src/main/codex/codex-session-migration-recent-exits.test.ts": 13,
-      "src/main/codex/codex-session-migration-scheduler.test.ts": 369,
-      "src/main/codex/codex-session-resume-home.test.ts": 22,
-      "src/main/codex/codex-session-resume-preparation.test.ts": 13,
-      "src/main/codex/codex-session-resume-wrong-account.test.ts": 24,
-      "src/main/codex/codex-session-source-home.test.ts": 5,
-      "src/main/codex/codex-stale-pane-accounts.test.ts": 95,
-      "src/main/codex/codex-state-db-backfill-recovery.test.ts": 147,
-      "src/main/codex/codex-state-db.test.ts": 27,
-      "src/main/codex/codex-structured-acquisition-exit-proof.test.ts": 11,
-      "src/main/codex/codex-structured-app-server-args.test.ts": 7,
-      "src/main/codex/codex-structured-child-environment.test.ts": 8,
-      "src/main/codex/codex-structured-item-translation.test.ts": 50,
-      "src/main/codex/codex-structured-journal-compactions.test.ts": 16,
-      "src/main/codex/codex-structured-journal-goal-admission.test.ts": 33,
-      "src/main/codex/codex-structured-journal-goal-resume.test.ts": 125,
-      "src/main/codex/codex-structured-journal-goal-rows.test.ts": 16,
-      "src/main/codex/codex-structured-journal-translation-settlement.test.ts": 843,
-      "src/main/codex/codex-structured-journal-translation-streams.test.ts": 85,
-      "src/main/codex/codex-structured-journal-translation-subagents.test.ts": 26,
-      "src/main/codex/codex-structured-journal-translation-turn-lifecycle.test.ts": 60,
-      "src/main/codex/codex-structured-journal-translation-turn-state.test.ts": 12,
-      "src/main/codex/codex-structured-journal-translation.test.ts": 96,
-      "src/main/codex/codex-structured-launch-resolution.test.ts": 17,
-      "src/main/codex/codex-structured-location-support.test.ts": 3,
-      "src/main/codex/codex-structured-owner-identity.test.ts": 9,
-      "src/main/codex/codex-structured-prompt-items.test.ts": 39,
-      "src/main/codex/codex-structured-prompt-replies.test.ts": 40,
-      "src/main/codex/codex-structured-rewind.test.ts": 34,
-      "src/main/codex/codex-structured-session-adapter-lifecycle.test.ts": 19,
-      "src/main/codex/codex-structured-session-adapter.test.ts": 37,
-      "src/main/codex/codex-structured-session-background-tasks.test.ts": 76,
-      "src/main/codex/codex-structured-session-cancel.test.ts": 164,
-      "src/main/codex/codex-structured-session-close.test.ts": 20,
-      "src/main/codex/codex-structured-session-options.test.ts": 12,
-      "src/main/codex/codex-structured-session-shutdown.test.ts": 62,
-      "src/main/codex/codex-structured-thread-open.test.ts": 19,
-      "src/main/codex/codex-structured-turn-processes.integration.test.ts": 85,
-      "src/main/codex/codex-subagent-execution-projection.test.ts": 16,
-      "src/main/codex/codex-subagent-executions.test.ts": 21,
-      "src/main/codex/codex-subagent-roster.test.ts": 40,
-      "src/main/codex/codex-tool-identity-translation.test.ts": 14,
-      "src/main/codex/codex-trust-config-concurrent-launch.test.ts": 70,
-      "src/main/codex/codex-trust-config-mutation-queue.test.ts": 10,
-      "src/main/codex/codex-trust-config-rollback.test.ts": 16,
-      "src/main/codex/codex-trust-grant-host.test.ts": 12,
-      "src/main/codex/codex-trust-grant-ledger.test.ts": 8,
-      "src/main/codex/codex-trust-grant-main-thread-boundary.test.ts": 15,
-      "src/main/codex/codex-trust-grant-telemetry.test.ts": 8,
-      "src/main/codex/codex-tui-rollout-proof.test.ts": 33,
-      "src/main/codex/codex-turn-ordinals.test.ts": 45,
-      "src/main/codex/codex-user-hook-trust-rebase-client.test.ts": 13,
-      "src/main/codex/codex-user-hook-trust-rebase.test.ts": 17,
-      "src/main/codex/codex-wsl-hook-install-plan.test.ts": 11,
-      "src/main/codex/config-plugin-registration-promotion.test.ts": 193,
-      "src/main/codex/config-settings-baseline-upgrade.test.ts": 61,
-      "src/main/codex/config-settings-promotion.test.ts": 227,
-      "src/main/codex/config-sync-stall.test.ts": 47,
-      "src/main/codex/config-toml-hook-trust-scaling.test.ts": 38,
-      "src/main/codex/config-toml-trust-api-parity.test.ts": 13,
-      "src/main/codex/config-toml-trust-hash.test.ts": 7,
-      "src/main/codex/config-toml-trust-hook-read.test.ts": 16,
-      "src/main/codex/config-toml-trust-hook-removal.test.ts": 26,
-      "src/main/codex/config-toml-trust-hook-upsert.test.ts": 44,
-      "src/main/codex/config-toml-trust-key.test.ts": 10,
-      "src/main/codex/config-toml-trust-paths.test.ts": 10,
-      "src/main/codex/config-toml-trust-project.test.ts": 27,
-      "src/main/codex/hook-service-concurrent-launch-install.test.ts": 618,
-      "src/main/codex/hook-service-legacy-cleanup.test.ts": 601,
-      "src/main/codex/hook-service-managed-install.test.ts": 99,
-      "src/main/codex/hook-service-runtime-trust-repair.test.ts": 117,
-      "src/main/codex/hook-service-trust-grant.test.ts": 123,
-      "src/main/codex/hook-service-user-hook-mirroring.test.ts": 186,
-      "src/main/codex/hook-service-wsl-runtime.test.ts": 113,
-      "src/main/codex/hook-trust-promotion.test.ts": 225,
-      "src/main/codex/managed-home-shell-preflight.test.ts": 28,
-      "src/main/codex/retained-codex-hook-state.test.ts": 8,
-      "src/main/codex/sta-4735-hook-trust-provenance-overwrite.test.ts": 12,
-      "src/main/codex/sta-4737-unreadable-is-not-absent.test.ts": 58,
-      "src/main/codex/sta-4823-shared-state-survives-a-failed-read.test.ts": 94,
-      "src/main/codex/wsl-codex-session-bridge.test.ts": 82,
-      "src/main/command-code/hook-service.test.ts": 239,
-      "src/main/computer/computer-action-verification-normalization.test.ts": 4,
-      "src/main/computer/computer-provider-lifecycle.test.ts": 5,
-      "src/main/computer/computer-provider-unavailable-message.test.ts": 3,
-      "src/main/computer/computer-sidecar-diagnostics.test.ts": 8,
-      "src/main/computer/desktop-script-provider-action-errors.test.ts": 68,
-      "src/main/computer/desktop-script-provider-actions.test.ts": 131,
-      "src/main/computer/desktop-script-provider-bridge.test.ts": 6,
-      "src/main/computer/desktop-script-provider-cache-lifecycle.test.ts": 96,
-      "src/main/computer/desktop-script-provider-cache.test.ts": 115,
-      "src/main/computer/desktop-script-provider-client.test.ts": 154,
-      "src/main/computer/desktop-script-provider-errors.test.ts": 161,
-      "src/main/computer/desktop-script-provider-paste-validation.test.ts": 105,
-      "src/main/computer/desktop-script-provider-runtime-host-routing.test.ts": 44,
-      "src/main/computer/desktop-script-runtime-host.test.ts": 106,
-      "src/main/computer/desktop-script-serve-channel.test.ts": 9,
-      "src/main/computer/macos-computer-use-permission-status.test.ts": 38,
-      "src/main/computer/macos-computer-use-permissions.test.ts": 24,
-      "src/main/computer/macos-native-provider-client.test.ts": 557,
-      "src/main/computer/macos-native-provider-paste-validation.test.ts": 99,
-      "src/main/computer/macos-native-provider-socket.test.ts": 14,
-      "src/main/computer/sidecar-client.test.ts": 28,
-      "src/main/computer/windows-powershell-execution-policy.test.ts": 7,
-      "src/main/copilot/hook-service.test.ts": 83,
-      "src/main/crash-reporting/crash-breadcrumb-renderer-attribution.test.ts": 29,
-      "src/main/crash-reporting/crash-breadcrumb-store-leak.test.ts": 60,
-      "src/main/crash-reporting/crash-breadcrumb-store-orphan-cleanup.test.ts": 45,
-      "src/main/crash-reporting/crash-breadcrumb-store.test.ts": 34,
-      "src/main/crash-reporting/crash-report-copy-text.test.ts": 8,
-      "src/main/crash-reporting/crash-report-store.test.ts": 351,
-      "src/main/crash-reporting/crashpad-capture.test.ts": 60,
-      "src/main/crash-reporting/durable-crash-breadcrumb.test.ts": 11,
-      "src/main/crash-reporting/expected-teardown-state.test.ts": 9,
-      "src/main/crash-reporting/gpu-crash-diagnostics.test.ts": 14,
-      "src/main/crash-reporting/gpu-crash-fallback-decision.test.ts": 13,
-      "src/main/crash-reporting/gpu-crash-fallback-field-sessions.test.ts": 9,
-      "src/main/crash-reporting/gpu-fallback-engagement.test.ts": 14,
-      "src/main/crash-reporting/gpu-fallback-recovered-launch.test.ts": 10,
-      "src/main/crash-reporting/gpu-fallback-restart-prompt.test.ts": 8,
-      "src/main/crash-reporting/main-process-lifecycle-identity.test.ts": 6,
-      "src/main/crash-reporting/minidump-crash-signature.test.ts": 30,
-      "src/main/crash-reporting/pre-gone-host-memory.test.ts": 18,
-      "src/main/crash-reporting/process-gone-classification.test.ts": 12,
-      "src/main/crash-reporting/process-gone-dedupe.test.ts": 6,
-      "src/main/crash-reporting/process-gone-diagnostics.test.ts": 19,
-      "src/main/crash-reporting/process-gone-killed-one-ordering.test.ts": 40,
-      "src/main/crash-reporting/process-gone-recorder.test.ts": 599,
-      "src/main/crash-reporting/process-gone-sibling-correlation.test.ts": 514,
-      "src/main/crash-reporting/renderer-recovery-circuit-breaker.test.ts": 10,
-      "src/main/crash-reporting/self-initiated-tree-kill-log.test.ts": 26,
-      "src/main/crash-reporting/suppressed-process-gone-breadcrumb.test.ts": 5,
-      "src/main/cursor/hook-service.test.ts": 173,
-      "src/main/daemon/agent-startup-prompt-latency.node-pty.test.ts": 1916,
-      "src/main/daemon/bash-prompt-command-composition.test.ts": 3541,
-      "src/main/daemon/client.test.ts": 392,
-      "src/main/daemon/cold-restore-payload-cache.test.ts": 9,
-      "src/main/daemon/daemon-adoption-telemetry-event.test.ts": 18,
-      "src/main/daemon/daemon-audit-eligibility-event.test.ts": 30,
-      "src/main/daemon/daemon-authenticated-client-activity.test.ts": 16,
-      "src/main/daemon/daemon-background-transient-facts.test.ts": 12,
-      "src/main/daemon/daemon-bundle-staleness.test.ts": 347,
-      "src/main/daemon/daemon-checkpoint-session-queue.test.ts": 204,
-      "src/main/daemon/daemon-client-notify-settlement.test.ts": 10,
-      "src/main/daemon/daemon-client-rpc-request.test.ts": 20,
-      "src/main/daemon/daemon-durable-history-ownership-seed.test.ts": 25,
-      "src/main/daemon/daemon-endpoint-ownership.test.ts": 26,
-      "src/main/daemon/daemon-endpoint-publish.test.ts": 92,
-      "src/main/daemon/daemon-endpoint-windows.test.ts": 8,
-      "src/main/daemon/daemon-entry-path-layouts.test.ts": 319,
-      "src/main/daemon/daemon-entry.test.ts": 15,
-      "src/main/daemon/daemon-errors.test.ts": 7,
-      "src/main/daemon/daemon-file-log.test.ts": 25,
-      "src/main/daemon/daemon-foreground-confirmation-protocol.test.ts": 7,
-      "src/main/daemon/daemon-health-endpoint-entry.test.ts": 9,
-      "src/main/daemon/daemon-health-socket-cleanup.test.ts": 16,
-      "src/main/daemon/daemon-health.test.ts": 3195,
-      "src/main/daemon/daemon-host-relocation.test.ts": 140,
-      "src/main/daemon/daemon-idle-shutdown.test.ts": 204,
-      "src/main/daemon/daemon-incarnation-evidence-main-thread.test.ts": 13,
-      "src/main/daemon/daemon-incarnation-evidence.test.ts": 23,
-      "src/main/daemon/daemon-init-child-readiness.test.ts": 406,
-      "src/main/daemon/daemon-init-child-startup-failure.test.ts": 406,
-      "src/main/daemon/daemon-init-endpoint-adoption.test.ts": 868,
-      "src/main/daemon/daemon-init-live-session-preservation.test.ts": 541,
-      "src/main/daemon/daemon-init-packaged-bundle-staleness.test.ts": 353,
-      "src/main/daemon/daemon-init-provider-installation.test.ts": 398,
-      "src/main/daemon/daemon-init-replacement-reporting.test.ts": 247,
-      "src/main/daemon/daemon-init-restart-sequence.test.ts": 576,
-      "src/main/daemon/daemon-init-wedged-daemon-grace.test.ts": 284,
-      "src/main/daemon/daemon-lifecycle-event.test.ts": 8,
-      "src/main/daemon/daemon-main.test.ts": 43,
-      "src/main/daemon/daemon-native-pty-exception.test.ts": 12,
-      "src/main/daemon/daemon-pid-file-parse.test.ts": 9,
-      "src/main/daemon/daemon-preflight-client-replacement.test.ts": 234,
-      "src/main/daemon/daemon-process-inspection.test.ts": 22,
-      "src/main/daemon/daemon-protocol-version.test.ts": 9,
-      "src/main/daemon/daemon-pty-adapter-cold-restore-reanchor.test.ts": 489,
-      "src/main/daemon/daemon-pty-adapter-cold-restore-seed.test.ts": 297,
-      "src/main/daemon/daemon-pty-adapter-concurrent-recovery.test.ts": 142,
-      "src/main/daemon/daemon-pty-adapter-daemon-recovery.test.ts": 505,
-      "src/main/daemon/daemon-pty-adapter-history-checkpoints.test.ts": 775,
-      "src/main/daemon/daemon-pty-adapter-history-recovery.test.ts": 580,
-      "src/main/daemon/daemon-pty-adapter-inventory-respawn.test.ts": 87,
-      "src/main/daemon/daemon-pty-adapter-protocol-compatibility.test.ts": 73,
-      "src/main/daemon/daemon-pty-adapter-replacement-exit-race.test.ts": 53,
-      "src/main/daemon/daemon-pty-adapter-session-adoption.test.ts": 557,
-      "src/main/daemon/daemon-pty-adapter-steady-state-compat.test.ts": 7,
-      "src/main/daemon/daemon-pty-adapter.test.ts": 873,
-      "src/main/daemon/daemon-pty-router-history-handoff.test.ts": 575,
-      "src/main/daemon/daemon-pty-router.test.ts": 445,
-      "src/main/daemon/daemon-pty-startup-delivery.test.ts": 1989,
-      "src/main/daemon/daemon-pty-upgrade-adoption.test.ts": 120,
-      "src/main/daemon/daemon-pty-write-settlement-recovery.test.ts": 11,
-      "src/main/daemon/daemon-ready-identity.test.ts": 8,
-      "src/main/daemon/daemon-reattach-checkpoint-isolation.test.ts": 10265,
-      "src/main/daemon/daemon-respawn-throttle.test.ts": 9,
-      "src/main/daemon/daemon-restore-scrollback-depth.test.ts": 2078,
-      "src/main/daemon/daemon-self-retirement-respawn.test.ts": 148,
-      "src/main/daemon/daemon-server-async-spawn-cancellation.test.ts": 354,
-      "src/main/daemon/daemon-server-attach-only.test.ts": 59,
-      "src/main/daemon/daemon-server-attachment-lifecycle.test.ts": 214,
-      "src/main/daemon/daemon-server-error-handling.test.ts": 179,
-      "src/main/daemon/daemon-server-kill-attribution.test.ts": 20,
-      "src/main/daemon/daemon-server.test.ts": 702,
-      "src/main/daemon/daemon-session-owner-resolution.test.ts": 22,
-      "src/main/daemon/daemon-session-scrollback-window.test.ts": 54,
-      "src/main/daemon/daemon-shutdown-final-checkpoint-caller-deadline.test.ts": 1702,
-      "src/main/daemon/daemon-spawner.test.ts": 74,
-      "src/main/daemon/daemon-stream-data-batcher.test.ts": 108,
-      "src/main/daemon/daemon-stream-droppability-lifecycle.test.ts": 46,
-      "src/main/daemon/daemon-stream-droppable-membership.test.ts": 40,
-      "src/main/daemon/daemon-tcc-attribution-main-thread.test.ts": 14,
-      "src/main/daemon/daemon-tcc-attribution.test.ts": 8,
-      "src/main/daemon/daemon-transport-attachment-release.test.ts": 114,
-      "src/main/daemon/degraded-daemon-pty-provider.test.ts": 58,
-      "src/main/daemon/hangul-cell-width-agreement.test.ts": 37,
-      "src/main/daemon/headless-emulator-fidelity.fuzz.test.ts": 17026,
-      "src/main/daemon/headless-emulator-restored-osc-links.test.ts": 50,
-      "src/main/daemon/headless-emulator-unicode-width.test.ts": 15,
-      "src/main/daemon/headless-emulator-wide-char-repaint.test.ts": 1773,
-      "src/main/daemon/headless-emulator-wide-char-snapshot.test.ts": 186,
-      "src/main/daemon/headless-emulator.test.ts": 114,
-      "src/main/daemon/headless-osc-link-ranges.test.ts": 119,
-      "src/main/daemon/hibernation-cold-restore-repro.test.ts": 73,
-      "src/main/daemon/history-manager-disabled-sessions-leak.test.ts": 58,
-      "src/main/daemon/history-manager.test.ts": 326,
-      "src/main/daemon/history-reader-memory.test.ts": 332,
-      "src/main/daemon/history-reader.test.ts": 85,
-      "src/main/daemon/issue-6814-daemon-failure-classification.test.ts": 6043,
-      "src/main/daemon/macos-login-session-death-watch.test.ts": 13,
-      "src/main/daemon/ndjson.test.ts": 173,
-      "src/main/daemon/node-pty-error-hints.test.ts": 6,
-      "src/main/daemon/osc7-file-uri.test.ts": 8,
-      "src/main/daemon/osc7-uri-extraction.test.ts": 8,
-      "src/main/daemon/post-ready-flush-gate.test.ts": 16,
-      "src/main/daemon/pty-session-id.test.ts": 16,
-      "src/main/daemon/pty-subprocess-cwd-cancel-identity.test.ts": 12,
-      "src/main/daemon/pty-subprocess-env-inheritance.test.ts": 58,
-      "src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts": 64,
-      "src/main/daemon/pty-subprocess-foreground-identity.test.ts": 303,
-      "src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts": 42,
-      "src/main/daemon/pty-subprocess-git-credential-guard.test.ts": 32,
-      "src/main/daemon/pty-subprocess-handle-lifecycle.test.ts": 138,
-      "src/main/daemon/pty-subprocess-io-failure-cleanup.test.ts": 3575,
-      "src/main/daemon/pty-subprocess-io-failure-native.test.ts": 2227,
-      "src/main/daemon/pty-subprocess-managed-agent-env.test.ts": 81,
-      "src/main/daemon/pty-subprocess-windows-shell-launch.test.ts": 66,
-      "src/main/daemon/pty-subprocess-wsl-launch.test.ts": 52,
-      "src/main/daemon/pty-subprocess.test.ts": 58,
-      "src/main/daemon/reattach-snapshot.test.ts": 649,
-      "src/main/daemon/repro-12101-mouse-tracking-survives-agent-death.test.ts": 61,
-      "src/main/daemon/repro-7329-remote-snapshot-corruption.test.ts": 57,
-      "src/main/daemon/session-pending-output.test.ts": 145,
-      "src/main/daemon/session-shell-recovery.test.ts": 122,
-      "src/main/daemon/session-terminal-control.test.ts": 46,
-      "src/main/daemon/session.test.ts": 279,
-      "src/main/daemon/shell-ready-bash-wrapper.test.ts": 338,
-      "src/main/daemon/slow-daemon-session-verification.test.ts": 13535,
-      "src/main/daemon/startup-device-attributes-responder.test.ts": 14,
-      "src/main/daemon/terminal-checkpoint-serializer.test.ts": 37,
-      "src/main/daemon/terminal-checkpoint-writer-bounds.test.ts": 91,
-      "src/main/daemon/terminal-cursor-line-context.test.ts": 26,
-      "src/main/daemon/terminal-history-incremental-restore.test.ts": 316,
-      "src/main/daemon/terminal-history-large-checkpoint-cold-restore.test.ts": 9348,
-      "src/main/daemon/terminal-history-log.test.ts": 13,
-      "src/main/daemon/terminal-history-permissions.test.ts": 87,
-      "src/main/daemon/terminal-history-restorable-retention.test.ts": 7,
-      "src/main/daemon/terminal-history-seed-chunks.test.ts": 7,
-      "src/main/daemon/terminal-history-seed-segments.test.ts": 22,
-      "src/main/daemon/terminal-history-seed-transfer-registry.test.ts": 8,
-      "src/main/daemon/terminal-history-session-tombstone-retry.test.ts": 10,
-      "src/main/daemon/terminal-host-agent-session.test.ts": 36,
-      "src/main/daemon/terminal-host-attach-only.test.ts": 28,
-      "src/main/daemon/terminal-host-cheap-tier-ps-scan-volume.test.ts": 59,
-      "src/main/daemon/terminal-host-concurrent-create.test.ts": 53,
-      "src/main/daemon/terminal-host-cwd-readability.test.ts": 30,
-      "src/main/daemon/terminal-host-non-agent-foreground.test.ts": 17,
-      "src/main/daemon/terminal-host-process-inspection-cheap-tier.test.ts": 29,
-      "src/main/daemon/terminal-host-process-inspection.test.ts": 18,
-      "src/main/daemon/terminal-host-pty-owner-backend.test.ts": 19,
-      "src/main/daemon/terminal-host-readiness-reporting.test.ts": 23,
-      "src/main/daemon/terminal-host-session-reaping-leak.test.ts": 30,
-      "src/main/daemon/terminal-host-startup.test.ts": 45,
-      "src/main/daemon/terminal-host-teardown-recreate.test.ts": 185,
-      "src/main/daemon/terminal-host-wsl-context.test.ts": 45,
-      "src/main/daemon/terminal-host.test.ts": 152,
-      "src/main/daemon/terminal-session-teardown.test.ts": 16,
-      "src/main/daemon/terminal-shell-lifecycle-scanner.test.ts": 21,
-      "src/main/daemon/terminal-shell-recovery-barrier.test.ts": 703,
-      "src/main/daemon/terminal-shell-recovery-clean-exit-retirement.test.ts": 26,
-      "src/main/daemon/terminal-snapshot-color-parity.test.ts": 109,
-      "src/main/daemon/terminal-snapshot-osc8-roundtrip.test.ts": 57,
-      "src/main/daemon/terminal-snapshot-serialize-roundtrip.test.ts": 130,
-      "src/main/daemon/windows-conpty-warmup.test.ts": 12,
-      "src/main/daemon/wsl-cold-restore-cwd.test.ts": 7,
-      "src/main/destination-serialized-local-rename.test.ts": 330,
-      "src/main/devin/hook-config-json.test.ts": 11,
-      "src/main/devin/hook-service.test.ts": 43,
-      "src/main/diagnostics/main-thread-churn-probe.test.ts": 13,
-      "src/main/dock/unread-badge.test.ts": 9,
-      "src/main/droid/hook-service.test.ts": 81,
-      "src/main/durable-file-write-syscall-proof.test.ts": 125,
-      "src/main/durable-file-write.test.ts": 89,
-      "src/main/emulator/android/adb-devices.test.ts": 10,
-      "src/main/emulator/android/android-app-control.test.ts": 7,
-      "src/main/emulator/android/android-capability-operations.test.ts": 10,
-      "src/main/emulator/android/android-device-inventory.test.ts": 12,
-      "src/main/emulator/android/android-input-commands.test.ts": 5,
-      "src/main/emulator/android/android-input-mapping.test.ts": 9,
-      "src/main/emulator/android/android-logcat.test.ts": 5,
-      "src/main/emulator/android/android-permissions.test.ts": 8,
-      "src/main/emulator/android/android-sdk-discovery.test.ts": 7,
-      "src/main/emulator/android/avd-manager.test.ts": 11,
-      "src/main/emulator/android/scrcpy-server-deploy.test.ts": 7,
-      "src/main/emulator/android/scrcpy-video-frame-parser.test.ts": 11,
-      "src/main/emulator/android/uiautomator-tree.test.ts": 12,
-      "src/main/emulator/backends/android-emulator-backend.test.ts": 24,
-      "src/main/emulator/backends/ios-emulator-backend.test.ts": 88,
-      "src/main/emulator/emulator-availability.test.ts": 7,
-      "src/main/emulator/emulator-bridge.test.ts": 122,
-      "src/main/emulator/emulator-gesture-sender.test.ts": 131,
-      "src/main/emulator/emulator-session-registry.test.ts": 5,
-      "src/main/emulator/emulator-start-lease-registry.test.ts": 62,
-      "src/main/emulator/mjpeg-frame-parser.test.ts": 8,
-      "src/main/emulator/mjpeg-frame-stream.test.ts": 34,
-      "src/main/emulator/scrcpy-video-registry.test.ts": 11,
-      "src/main/emulator/serve-sim-accessibility-tree.test.ts": 90,
-      "src/main/emulator/serve-sim-ax-normalization.test.ts": 12,
-      "src/main/emulator/serve-sim-detached-session.test.ts": 11,
-      "src/main/emulator/serve-sim-execution.test.ts": 25,
-      "src/main/emulator/serve-sim-helper-processes.test.ts": 8,
-      "src/main/emulator/serve-sim-runtime-materializer.test.ts": 49,
-      "src/main/emulator/simctl-simulator-devices.test.ts": 11,
-      "src/main/ephemeral-vm-recipe-runner.test.ts": 296,
-      "src/main/ephemeral-vm-resume-integrity.test.ts": 11,
-      "src/main/ephemeral-vm-runtime-service.test.ts": 522,
-      "src/main/ephemeral-vm-runtime-ssh-cleanup.test.ts": 36,
-      "src/main/external-editor-launch.test.ts": 19,
-      "src/main/fish-history-session.test.ts": 22,
-      "src/main/gemini/hook-service.test.ts": 15,
-      "src/main/ghostty/discovery.test.ts": 14,
-      "src/main/ghostty/index.test.ts": 20,
-      "src/main/ghostty/mapper-extended.test.ts": 11,
-      "src/main/ghostty/mapper.test.ts": 11,
-      "src/main/ghostty/parser.test.ts": 8,
-      "src/main/ghostty/theme-import.test.ts": 14,
-      "src/main/ghostty/theme-resolution.test.ts": 10,
-      "src/main/git-bash.test.ts": 13,
-      "src/main/git/add-sparse-worktree.test.ts": 22,
-      "src/main/git/admission-tier-plumbing.test.ts": 10,
-      "src/main/git/branch-rename.test.ts": 8,
-      "src/main/git/canonical-repo-key.test.ts": 6,
-      "src/main/git/check-ignored-paths.test.ts": 15,
-      "src/main/git/coalesced-probe.test.ts": 9,
-      "src/main/git/command-runner/gh-exec-file-deadline.test.ts": 20,
-      "src/main/git/command-runner/gh-spawn-boundary.test.ts": 566,
-      "src/main/git/command-runner/git-admission-output-parity.test.ts": 120,
-      "src/main/git/command-runner/git-admission-span.test.ts": 175,
-      "src/main/git/command-runner/git-admission-storm-measurement.test.ts": 25859,
-      "src/main/git/command-runner/git-command-timeout-behavior.test.ts": 1728,
-      "src/main/git/command-runner/git-command-timeout.test.ts": 8,
-      "src/main/git/command-runner/git-exec-admission-lifetime.test.ts": 375,
-      "src/main/git/command-runner/git-spawn-admission-lifetime.test.ts": 15,
-      "src/main/git/command-runner/git-stream-admission-lifetime.test.ts": 120,
-      "src/main/git/command-runner/git-subprocess-admission.test.ts": 448,
-      "src/main/git/command-runner/hosted-cli-deadline-log.test.ts": 22,
-      "src/main/git/command-runner/wsl-host-failure.test.ts": 17,
-      "src/main/git/commit-object-ref.test.ts": 8,
-      "src/main/git/commit.test.ts": 6,
-      "src/main/git/exact-ref-probe.test.ts": 17,
-      "src/main/git/fetch-error-classification.test.ts": 9,
-      "src/main/git/fork-remote-refspec.test.ts": 14,
-      "src/main/git/fork-remote-stale-branch-refspec.test.ts": 10,
-      "src/main/git/gh-rate-limit-breaker.test.ts": 20,
-      "src/main/git/git-capability-state.test.ts": 14,
-      "src/main/git/git-status-read-lease-owner.test.ts": 15,
-      "src/main/git/git-upstream-status-read-owner.test.ts": 18,
-      "src/main/git/hosted-remote-url.test.ts": 6,
-      "src/main/git/huge-folder-ignore.test.ts": 20,
-      "src/main/git/local-repo-ref-maintenance.test.ts": 98,
-      "src/main/git/pack-refs-lock-ownership.test.ts": 36,
-      "src/main/git/porcelain-v1-records.test.ts": 140,
-      "src/main/git/remote-ref-probe-cache.test.ts": 13,
-      "src/main/git/remote-url-probe.test.ts": 9,
-      "src/main/git/remote.test.ts": 51,
-      "src/main/git/remove-worktree-branch-cleanup.test.ts": 16,
-      "src/main/git/remove-worktree-clean-preflight.test.ts": 14,
-      "src/main/git/remove-worktree.test.ts": 35,
-      "src/main/git/repo-api-parity.test.ts": 6,
-      "src/main/git/repo-branch-conflict-batched-probe.test.ts": 11,
-      "src/main/git/repo-branch-conflict-real-git.test.ts": 157,
-      "src/main/git/repo-branch-conflict.test.ts": 20,
-      "src/main/git/repo-clone-path.test.ts": 6,
-      "src/main/git/repo-default-base-timeout.test.ts": 11,
-      "src/main/git/repo-default-remote.test.ts": 11,
-      "src/main/git/repo-detection.test.ts": 348,
-      "src/main/git/repo-ref-maintenance-real-git.test.ts": 1092,
-      "src/main/git/repo-remote-drift-real.test.ts": 103,
-      "src/main/git/repo-remote-drift.test.ts": 8,
-      "src/main/git/repo-search-ref-compat.test.ts": 10,
-      "src/main/git/repo-username.test.ts": 30,
-      "src/main/git/repo.test.ts": 2330,
-      "src/main/git/runner-command-exec.test.ts": 530,
-      "src/main/git/runner-gh-host-args.test.ts": 8,
-      "src/main/git/runner-gh-rate-limit-breaker.test.ts": 32,
-      "src/main/git/runner-windows-host-environment.test.ts": 88,
-      "src/main/git/runner-wsl-direct-read.test.ts": 1710,
-      "src/main/git/runner-wsl-gh-fallback.test.ts": 857,
-      "src/main/git/runner-wsl-linked-gitdir-timeout.test.ts": 20,
-      "src/main/git/runner-wsl-login-shell-capture.test.ts": 18,
-      "src/main/git/runner-wsl-read-routing.test.ts": 15,
-      "src/main/git/runner.test.ts": 32,
-      "src/main/git/settled-diff-cache-bounds.test.ts": 7,
-      "src/main/git/source-control/bulk-pathspec-command-line-budget.test.ts": 128,
-      "src/main/git/source-control/resolve-git-dir.test.ts": 6,
-      "src/main/git/source-control/wsl-tracked-pathspec-banner.test.ts": 20,
-      "src/main/git/status-branch-compare-real-ref.test.ts": 137,
-      "src/main/git/status-branch-compare.test.ts": 19,
-      "src/main/git/status-branch-line-total-exec-contract.test.ts": 751,
-      "src/main/git/status-branch-line-total-real-git.test.ts": 728,
-      "src/main/git/status-branch-line-total-relay-parity.test.ts": 301,
-      "src/main/git/status-conflict-operations.test.ts": 19,
-      "src/main/git/status-conflict-overlap.bench.test.ts": 25,
-      "src/main/git/status-cquoted-paths.test.ts": 79,
-      "src/main/git/status-diff-settled-cache.test.ts": 152,
-      "src/main/git/status-diff.test.ts": 37,
-      "src/main/git/status-discard-and-bulk-staging.test.ts": 73,
-      "src/main/git/status-discard-symlink.test.ts": 429,
-      "src/main/git/status-line-stats-host-paths.test.ts": 14,
-      "src/main/git/status-pathspec-literals.test.ts": 352,
-      "src/main/git/status-porcelain-parser.test.ts": 7,
-      "src/main/git/status-read-coalescing.test.ts": 37,
-      "src/main/git/status-shared-symlinks.test.ts": 825,
-      "src/main/git/status-submodule-path-cache.test.ts": 894,
-      "src/main/git/status-submodule.test.ts": 45,
-      "src/main/git/status-symlink-probe-budget.test.ts": 44,
-      "src/main/git/status-upstream-negative-cache.test.ts": 990,
-      "src/main/git/status-upstream-probe-churn.test.ts": 42,
-      "src/main/git/status-upstream-ref.test.ts": 13,
-      "src/main/git/status-wsl-pathspecs.test.ts": 14,
-      "src/main/git/status.test.ts": 72,
-      "src/main/git/upstream-deferred-fork-remote-real.test.ts": 49,
-      "src/main/git/upstream.test.ts": 179,
-      "src/main/git/worktree-add-creation-config.test.ts": 38,
-      "src/main/git/worktree-add-local-base-refresh.test.ts": 16,
-      "src/main/git/worktree-add-local-base-suggestion.test.ts": 15,
-      "src/main/git/worktree-add-timeout-override.test.ts": 12,
-      "src/main/git/worktree-base-divergence-real-git.test.ts": 1158,
-      "src/main/git/worktree-base-divergence.test.ts": 39,
-      "src/main/git/worktree-base-ref-probe.test.ts": 16,
-      "src/main/git/worktree-common-dir-comparison.test.ts": 6,
-      "src/main/git/worktree-configured-paths-concurrency.test.ts": 27,
-      "src/main/git/worktree-create-preparation-real-git.test.ts": 1004,
-      "src/main/git/worktree-created-description-real-git.test.ts": 1472,
-      "src/main/git/worktree-deferred-removal-real-git.test.ts": 269,
-      "src/main/git/worktree-diff-stamp-guest-gitdir.test.ts": 6,
-      "src/main/git/worktree-diff-stamp-host-paths.test.ts": 8,
-      "src/main/git/worktree-git-capabilities.test.ts": 13,
-      "src/main/git/worktree-graph-listing.test.ts": 13,
-      "src/main/git/worktree-include-file.test.ts": 83,
-      "src/main/git/worktree-list-paths.test.ts": 228,
-      "src/main/git/worktree-list-porcelain.test.ts": 26,
-      "src/main/git/worktree-listing-created-sparse-distro.test.ts": 9,
-      "src/main/git/worktree-listing-sparse-distro.test.ts": 8,
-      "src/main/git/worktree-move.test.ts": 12,
-      "src/main/git/worktree-mutation-route-invalidation.test.ts": 25,
-      "src/main/git/worktree-porcelain-parsing.test.ts": 14,
-      "src/main/git/worktree-preparation-base-oid.test.ts": 14,
-      "src/main/git/worktree-remove-branch-deletion.test.ts": 17,
-      "src/main/git/worktree-scan-cache-annotation-reuse.test.ts": 8,
-      "src/main/git/worktree-scan-cache-sharing.test.ts": 52,
-      "src/main/git/worktree-separate-git-dir.test.ts": 350,
-      "src/main/git/worktree-shared-directories.test.ts": 726,
-      "src/main/git/worktree-sparse-checkout-cache.test.ts": 31,
-      "src/main/git/worktree-sparse-checkout.test.ts": 276,
-      "src/main/git/worktree-sparse-state-host-paths.test.ts": 5,
-      "src/main/git/worktree-symlink-detection.test.ts": 11,
-      "src/main/git/wsl-direct-git-read-commands.test.ts": 8,
-      "src/main/git/wsl-linked-worktree-git-route-invalidation.test.ts": 9,
-      "src/main/git/wsl-linked-worktree-git-routing.test.ts": 57,
-      "src/main/git/wsl-process-group-termination.test.ts": 8,
-      "src/main/gitea/client.test.ts": 145,
-      "src/main/gitea/pull-request-creation.test.ts": 82,
-      "src/main/gitea/pull-request-mappers.test.ts": 5,
-      "src/main/gitea/repository-ref.test.ts": 19,
-      "src/main/github/auth-diagnose.test.ts": 10,
-      "src/main/github/client-create-pr.test.ts": 39,
-      "src/main/github/client-file-viewed.test.ts": 10,
-      "src/main/github/client-issue-origin-preference.test.ts": 17,
-      "src/main/github/client-issue-source.test.ts": 28,
-      "src/main/github/client-merge-queue-auto-merge.test.ts": 70,
-      "src/main/github/client-merged-pr-visibility.test.ts": 19,
-      "src/main/github/client-pr-branch-discovery.test.ts": 16,
-      "src/main/github/client-pr-check-details.test.ts": 36,
-      "src/main/github/client-pr-checks.test.ts": 42,
-      "src/main/github/client-pr-comment-reactions.test.ts": 13,
-      "src/main/github/client-pr-conflict-summary.test.ts": 26,
-      "src/main/github/client-pr-fallback-number.test.ts": 23,
-      "src/main/github/client-pr-linked-lookup.test.ts": 18,
-      "src/main/github/client-pr-local-runtime.test.ts": 32,
-      "src/main/github/client-pr-push-target.test.ts": 24,
-      "src/main/github/client-pr-state.test.ts": 10,
-      "src/main/github/client-rate-limit-block.test.ts": 12,
-      "src/main/github/client-ssh-provider-execution-boundary.test.ts": 23,
-      "src/main/github/client-stack-merge-guard.test.ts": 32,
-      "src/main/github/client-starred.test.ts": 12,
-      "src/main/github/client-tracked-upstream-fork-owner.test.ts": 21,
-      "src/main/github/client-tracked-upstream-snapshot.test.ts": 232,
-      "src/main/github/client-work-item-check-summary.test.ts": 12,
-      "src/main/github/client-work-items-query-paging.test.ts": 35,
-      "src/main/github/client-work-items.test.ts": 18,
-      "src/main/github/comment-reactions.test.ts": 3,
-      "src/main/github/conflict-summary.test.ts": 33,
-      "src/main/github/default-branch-stale-pr.test.ts": 11,
-      "src/main/github/gh-utils-concurrency.test.ts": 6,
-      "src/main/github/gh-utils.test.ts": 88,
-      "src/main/github/github-api-repository.test.ts": 113,
-      "src/main/github/github-enterprise-repository.test.ts": 36,
-      "src/main/github/github-pr-stack.test.ts": 46,
-      "src/main/github/github-remote-identity-parsing.test.ts": 9,
-      "src/main/github/github-repository-identity.fork-owner-repo.test.ts": 13,
-      "src/main/github/github-repository-identity.signed-cache.test.ts": 9,
-      "src/main/github/github-repository-identity.ssh-host-alias.test.ts": 33,
-      "src/main/github/issues.test.ts": 18,
-      "src/main/github/pr-head-tracking-ref.test.ts": 13,
-      "src/main/github/pr-refresh-coordinator-active-burst-pacing.test.ts": 271,
-      "src/main/github/pr-refresh-coordinator-active-visible-priority.test.ts": 192,
-      "src/main/github/pr-refresh-coordinator-alias-coalescing.test.ts": 175,
-      "src/main/github/pr-refresh-coordinator-rate-limit-budget.test.ts": 223,
-      "src/main/github/pr-refresh-coordinator-refresh-events.test.ts": 185,
-      "src/main/github/pr-refresh-coordinator-visible-follow-up.test.ts": 163,
-      "src/main/github/pr-refresh-error-classification.test.ts": 8,
-      "src/main/github/pr-refresh-queue-growth-bound.test.ts": 439,
-      "src/main/github/pr-refresh-validation-backoff.test.ts": 14,
-      "src/main/github/pr-review-comment-lines.test.ts": 6,
-      "src/main/github/pr-start-point-compare-base.test.ts": 15,
-      "src/main/github/pr-start-point.test.ts": 20,
-      "src/main/github/project-view-host-auth.test.ts": 16,
-      "src/main/github/project-view.test.ts": 22,
-      "src/main/github/project-view/mutations.test.ts": 14,
-      "src/main/github/project-view/project-field-mutations.test.ts": 6,
-      "src/main/github/project-view/project-view-table.test.ts": 11,
-      "src/main/github/project-view/repository-field-options.test.ts": 5,
-      "src/main/github/rate-limit.test.ts": 19,
-      "src/main/github/review-head-remote.test.ts": 11,
-      "src/main/github/stacked-pr-creation.test.ts": 23,
-      "src/main/github/work-item-details-api-parity.test.ts": 7,
-      "src/main/github/work-item-details-concurrency.test.ts": 7,
-      "src/main/github/work-item-details-enterprise-host.test.ts": 20,
-      "src/main/github/work-item-details-file-viewed.test.ts": 18,
-      "src/main/github/work-item-details-pr-files.test.ts": 22,
-      "src/main/github/work-item-details.test.ts": 29,
-      "src/main/gitlab/client-mr-auth-rate-limit.test.ts": 14,
-      "src/main/gitlab/client-mr-branch-lookup.test.ts": 27,
-      "src/main/gitlab/client-mr-job-ci.test.ts": 12,
-      "src/main/gitlab/client-mr-listing.test.ts": 15,
-      "src/main/gitlab/client-mr-review-actions.test.ts": 11,
-      "src/main/gitlab/client-work-items.test.ts": 16,
-      "src/main/gitlab/client.test.ts": 19,
-      "src/main/gitlab/gitlab-known-host-probe-wsl-fallback.test.ts": 15,
-      "src/main/gitlab/gitlab-known-host-probe.test.ts": 23,
-      "src/main/gitlab/gl-utils.test.ts": 41,
-      "src/main/gitlab/issues.test.ts": 23,
-      "src/main/gitlab/mappers-workitem.test.ts": 5,
-      "src/main/gitlab/mappers.test.ts": 23,
-      "src/main/gitlab/merge-request-creation.test.ts": 11,
-      "src/main/gitlab/mr-head-tracking-ref.test.ts": 10,
-      "src/main/gitlab/project-ref-parser.test.ts": 12,
-      "src/main/gitlab/work-item-details.test.ts": 31,
-      "src/main/global-fetch-call-site-audit.test.ts": 135,
-      "src/main/grok-accounts/status.test.ts": 6,
-      "src/main/grok/grok-hook-config-file.test.ts": 99,
-      "src/main/grok/grok-hook-owners.test.ts": 26,
-      "src/main/grok/grok-hook-remnant-removal.test.ts": 15,
-      "src/main/grok/hook-service.test.ts": 38,
-      "src/main/grok/windows-grok-hook-script.test.ts": 9,
-      "src/main/grok/windows-hook-launcher-chain.test.ts": 9,
-      "src/main/hang-watchdog/hang-detection-marker.test.ts": 7,
-      "src/main/hang-watchdog/hang-watchdog-detection-loop.test.ts": 11,
-      "src/main/hang-watchdog/hang-watchdog-worker-path.test.ts": 8,
-      "src/main/hang-watchdog/main-thread-hang-telemetry.test.ts": 6,
-      "src/main/hang-watchdog/main-thread-hang-watchdog-entry.test.ts": 19,
-      "src/main/hang-watchdog/main-thread-hang-watchdog.test.ts": 26,
-      "src/main/headless-automation-dispatcher-source-boundary.test.ts": 4,
-      "src/main/hermes/hook-service.test.ts": 196,
-      "src/main/hooks-effective-hook-resolution.test.ts": 173,
-      "src/main/hooks-issue-command.test.ts": 237,
-      "src/main/hooks-orca-yaml-parsing.test.ts": 37,
-      "src/main/hooks-runner.test.ts": 103,
-      "src/main/hooks-setup-runner-script.test.ts": 171,
-      "src/main/hooks.test.ts": 316,
-      "src/main/host-tree-removal-asar.electron.test.ts": 285,
-      "src/main/host/deferred-secret-protection-report.test.ts": 16,
-      "src/main/host/electron-secret-store.test.ts": 11,
-      "src/main/host/secret-protection-report.test.ts": 13,
-      "src/main/i18n/main-i18n-lazy-locale.test.ts": 270,
-      "src/main/ipc/agent-hooks.test.ts": 472,
-      "src/main/ipc/agent-pane-authority-ownership.test.ts": 4,
-      "src/main/ipc/ai-vault-scan-coalescing.test.ts": 322,
-      "src/main/ipc/ai-vault.test.ts": 159,
-      "src/main/ipc/app.test.ts": 24,
-      "src/main/ipc/automations-external-scope.test.ts": 110,
-      "src/main/ipc/bounded-warning-dedupe.test.ts": 8,
-      "src/main/ipc/browser-client-page-metadata-ipc.test.ts": 19,
-      "src/main/ipc/browser-preview-tool-authorization.test.ts": 81,
-      "src/main/ipc/browser-session-profile-ipc.test.ts": 10,
-      "src/main/ipc/browser-tab-registration-wait.test.ts": 12,
-      "src/main/ipc/browser.test.ts": 83,
-      "src/main/ipc/cli-appimage-stale-registration.test.ts": 214,
-      "src/main/ipc/cli.test.ts": 62,
-      "src/main/ipc/codex-config-sync.test.ts": 13,
-      "src/main/ipc/command-path-resolver.test.ts": 13,
-      "src/main/ipc/computer-use-permissions.test.ts": 9,
-      "src/main/ipc/crash-reporting-renderer-breadcrumbs.test.ts": 39,
-      "src/main/ipc/crash-reporting-renderer-error-report-attribution.test.ts": 12,
-      "src/main/ipc/crash-reporting-replay-guard-wedge-burst.test.ts": 24,
-      "src/main/ipc/crash-reporting.test.ts": 43,
-      "src/main/ipc/created-worktree-reconciliation.test.ts": 72,
-      "src/main/ipc/created-worktree-root-prune.test.ts": 19,
-      "src/main/ipc/dashboard-payload-validation.test.ts": 74,
-      "src/main/ipc/dashboard-popout.test.ts": 13,
-      "src/main/ipc/deferred-emoji-shortcode-dataset.test.ts": 65,
-      "src/main/ipc/developer-permissions.test.ts": 17,
-      "src/main/ipc/diagnostics.test.ts": 20,
-      "src/main/ipc/doc-preview-grant-ipc.test.ts": 10,
-      "src/main/ipc/dropped-path-resolution.test.ts": 19,
-      "src/main/ipc/emulator-stream-listener-cleanup.test.ts": 12,
-      "src/main/ipc/ephemeral-vm-provision-cancel.test.ts": 58,
-      "src/main/ipc/ephemeral-vm-provisioned-root-ref.test.ts": 447,
-      "src/main/ipc/ephemeral-vm-runtime-handler-cleanup.test.ts": 94,
-      "src/main/ipc/ephemeral-vm.test.ts": 595,
-      "src/main/ipc/feedback-image-attachments.test.ts": 67,
-      "src/main/ipc/feedback.test.ts": 132,
-      "src/main/ipc/filesystem-allowed-roots.test.ts": 334,
-      "src/main/ipc/filesystem-auth.test.ts": 678,
-      "src/main/ipc/filesystem-branch-compare-diff.test.ts": 24,
-      "src/main/ipc/filesystem-commit-message-generation.test.ts": 32,
-      "src/main/ipc/filesystem-commit-message-model-discovery.test.ts": 25,
-      "src/main/ipc/filesystem-conflict-operation-routing.test.ts": 14,
-      "src/main/ipc/filesystem-download-transfers.test.ts": 106,
-      "src/main/ipc/filesystem-git-commit-dispatch.test.ts": 18,
-      "src/main/ipc/filesystem-git-status-staging.test.ts": 82,
-      "src/main/ipc/filesystem-import-ssh-ops.test.ts": 23,
-      "src/main/ipc/filesystem-import-ssh-path-safety.test.ts": 18,
-      "src/main/ipc/filesystem-import-ssh.test.ts": 31,
-      "src/main/ipc/filesystem-import.test.ts": 64,
-      "src/main/ipc/filesystem-list-files-git-directory-expansion.test.ts": 325,
-      "src/main/ipc/filesystem-list-files-git-fallback-real.test.ts": 271,
-      "src/main/ipc/filesystem-list-files-install-rg.test.ts": 23,
-      "src/main/ipc/filesystem-list-files.test.ts": 253,
-      "src/main/ipc/filesystem-markdown-document-listing.test.ts": 17,
-      "src/main/ipc/filesystem-mutations.test.ts": 49,
-      "src/main/ipc/filesystem-path-containment-remote-enoent.test.ts": 8,
-      "src/main/ipc/filesystem-pull-request-field-generation.test.ts": 18,
-      "src/main/ipc/filesystem-search-file-paths.test.ts": 257,
-      "src/main/ipc/filesystem-search-git.test.ts": 150,
-      "src/main/ipc/filesystem-search-rg-timeout.test.ts": 50,
-      "src/main/ipc/filesystem-watcher-canonical-root-paths.test.ts": 320,
-      "src/main/ipc/filesystem-watcher-dormant-rearm.test.ts": 170,
-      "src/main/ipc/filesystem-watcher-event-batch.test.ts": 9,
-      "src/main/ipc/filesystem-watcher-ignore.test.ts": 7,
-      "src/main/ipc/filesystem-watcher-large-batch.test.ts": 150,
-      "src/main/ipc/filesystem-watcher-local-events.test.ts": 240,
-      "src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts": 818,
-      "src/main/ipc/filesystem-watcher-native-capacity.test.ts": 67,
-      "src/main/ipc/filesystem-watcher-real.test.ts": 488,
-      "src/main/ipc/filesystem-watcher-remote-batch.test.ts": 27,
-      "src/main/ipc/filesystem-watcher-remote-cancellation.test.ts": 324,
-      "src/main/ipc/filesystem-watcher-remote-capacity.test.ts": 31,
-      "src/main/ipc/filesystem-watcher-remote-rearm.test.ts": 20,
-      "src/main/ipc/filesystem-watcher-removal-deadline.test.ts": 129,
-      "src/main/ipc/filesystem-watcher-terminal-resync.test.ts": 21,
-      "src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts": 24,
-      "src/main/ipc/filesystem-watcher-wsl.test.ts": 35,
-      "src/main/ipc/filesystem-watcher.test.ts": 1789,
-      "src/main/ipc/filesystem.test.ts": 70,
-      "src/main/ipc/floating-workspace-directory.test.ts": 23,
-      "src/main/ipc/folder-repo-git-upgrade.test.ts": 2257,
-      "src/main/ipc/git-status-upstream-ref-watch-request.test.ts": 13,
-      "src/main/ipc/github-ipc-channel-parity.test.ts": 13,
-      "src/main/ipc/github-issue-source-preference.test.ts": 16,
-      "src/main/ipc/github-pr-refresh-routing.test.ts": 31,
-      "src/main/ipc/github-repo-access-guards.test.ts": 24,
-      "src/main/ipc/github-ssh-connection-routing.test.ts": 10,
-      "src/main/ipc/github-star-telemetry.test.ts": 17,
-      "src/main/ipc/github-work-item-args.test.ts": 12,
-      "src/main/ipc/github-wsl-runtime-routing.test.ts": 21,
-      "src/main/ipc/gitlab-repo-access.test.ts": 6,
-      "src/main/ipc/gitlab.test.ts": 27,
-      "src/main/ipc/hosted-review.test.ts": 23,
-      "src/main/ipc/jira-cancellable-requests.test.ts": 12,
-      "src/main/ipc/keybindings.test.ts": 8,
-      "src/main/ipc/linear.test.ts": 9,
-      "src/main/ipc/local-log-tail.test.ts": 9,
-      "src/main/ipc/local-network-connection-test.test.ts": 84,
-      "src/main/ipc/local-worktree-runtime-options.test.ts": 10,
-      "src/main/ipc/macos-keyboard-layout-change-notifications.test.ts": 13,
-      "src/main/ipc/macos-keyboard-layout-snapshot.test.ts": 7,
-      "src/main/ipc/markdown-documents.test.ts": 5,
-      "src/main/ipc/minimax-credentials.test.ts": 17,
-      "src/main/ipc/mobile.test.ts": 66,
-      "src/main/ipc/native-chat-subscribe-lifecycle.test.ts": 18,
-      "src/main/ipc/native-chat.test.ts": 1703,
-      "src/main/ipc/notebook.test.ts": 13,
-      "src/main/ipc/notifications-custom-sound.test.ts": 13,
-      "src/main/ipc/notifications-delivery-gating.test.ts": 19,
-      "src/main/ipc/notifications-message-formatting.test.ts": 32,
-      "src/main/ipc/notifications-mobile-fanout.test.ts": 17,
-      "src/main/ipc/notifications-permission-onboarding.test.ts": 27,
-      "src/main/ipc/notifications-retention-lifecycle.test.ts": 27,
-      "src/main/ipc/orca-profile-auth-handlers.test.ts": 16,
-      "src/main/ipc/orca-profile-org-members-handlers.test.ts": 10,
-      "src/main/ipc/orca-profiles.test.ts": 28,
-      "src/main/ipc/parcel-watcher-child-launch.test.ts": 14,
-      "src/main/ipc/parcel-watcher-child-registry.test.ts": 60,
-      "src/main/ipc/parcel-watcher-crash-fuse.test.ts": 4,
-      "src/main/ipc/parcel-watcher-disconnect-termination.test.ts": 46,
-      "src/main/ipc/parcel-watcher-entry-path.test.ts": 8,
-      "src/main/ipc/parcel-watcher-event-cancellation.test.ts": 12,
-      "src/main/ipc/parcel-watcher-event-delivery.test.ts": 8,
-      "src/main/ipc/parcel-watcher-process-entry.test.ts": 83,
-      "src/main/ipc/parcel-watcher-process.test.ts": 395,
-      "src/main/ipc/parcel-watcher-root-path-rewrite.test.ts": 19,
-      "src/main/ipc/parcel-watcher-shallow-subscription.test.ts": 11,
-      "src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts": 340,
-      "src/main/ipc/parcel-watcher-supervisor-capacity.test.ts": 134,
-      "src/main/ipc/parcel-watcher-unsubscribe-timeout.test.ts": 38,
-      "src/main/ipc/pet-bundle.test.ts": 6,
-      "src/main/ipc/pet.test.ts": 35,
-      "src/main/ipc/plugin-marketplaces.test.ts": 13,
-      "src/main/ipc/plugins.test.ts": 18,
-      "src/main/ipc/preflight-agent-detection-no-subprocess.test.ts": 22,
-      "src/main/ipc/preflight-agent-detection.test.ts": 42,
-      "src/main/ipc/preflight-agent-refresh.test.ts": 21,
-      "src/main/ipc/preflight-command-exec.test.ts": 8,
-      "src/main/ipc/preflight-host-cli-status.test.ts": 27,
-      "src/main/ipc/preflight-remote-ssh.test.ts": 16,
-      "src/main/ipc/preflight-wsl-agent-detection.test.ts": 55,
-      "src/main/ipc/preflight-wsl-command.test.ts": 17,
-      "src/main/ipc/pty-activation-inventory-scope.test.ts": 23,
-      "src/main/ipc/pty-agent-session-write-gate.test.ts": 141,
-      "src/main/ipc/pty-applied-size-reporting.test.ts": 48,
-      "src/main/ipc/pty-buffer-snapshot-dispatch.test.ts": 64,
-      "src/main/ipc/pty-codex-account-attribution.test.ts": 46,
-      "src/main/ipc/pty-controller-owner-recovery.test.ts": 53,
-      "src/main/ipc/pty-controller-ownership-routing.test.ts": 37,
-      "src/main/ipc/pty-controller-process-inventory.test.ts": 17,
-      "src/main/ipc/pty-controller-spawn-admission.test.ts": 49,
-      "src/main/ipc/pty-cumulative-ack-accounting.test.ts": 95,
-      "src/main/ipc/pty-daemon-controller-teardown.test.ts": 44,
-      "src/main/ipc/pty-daemon-spawn-agent-home-env.test.ts": 72,
-      "src/main/ipc/pty-daemon-spawn-codex-auth.test.ts": 82,
-      "src/main/ipc/pty-daemon-spawn-session-identity.test.ts": 60,
-      "src/main/ipc/pty-daemon-spawn-wsl-runtime.test.ts": 67,
-      "src/main/ipc/pty-daemon-ssh-lease-lifecycle.test.ts": 48,
-      "src/main/ipc/pty-dead-owner-respawn.test.ts": 44,
-      "src/main/ipc/pty-delivery-health-heal.test.ts": 117,
-      "src/main/ipc/pty-dispatcher-handshake-osc-answers.test.ts": 83,
-      "src/main/ipc/pty-encoding.test.ts": 7,
-      "src/main/ipc/pty-global-renderer-credit.test.ts": 134,
-      "src/main/ipc/pty-hidden-at-spawn-mark.test.ts": 120,
-      "src/main/ipc/pty-hidden-delivery-gate.test.ts": 8,
-      "src/main/ipc/pty-ipc-hidden-delivery-gate.test.ts": 67,
-      "src/main/ipc/pty-ipc-producer-flow-control.test.ts": 57,
-      "src/main/ipc/pty-listener-teardown-and-orphans.test.ts": 99,
-      "src/main/ipc/pty-login-shell-startup-commands.test.ts": 113,
-      "src/main/ipc/pty-management.test.ts": 46,
-      "src/main/ipc/pty-output-batching-drain.test.ts": 66,
-      "src/main/ipc/pty-output-drain-rounds.test.ts": 110,
-      "src/main/ipc/pty-pane-claim-arbitration.test.ts": 137,
-      "src/main/ipc/pty-pane-materialization-race.test.ts": 501,
-      "src/main/ipc/pty-pane-reservation-settlement.test.ts": 71,
-      "src/main/ipc/pty-pending-data-drain-queue-differential.test.ts": 955,
-      "src/main/ipc/pty-pending-data-drain-queue.test.ts": 19,
-      "src/main/ipc/pty-pending-data-drain-scheduler-differential.test.ts": 19,
-      "src/main/ipc/pty-pending-output-cap.test.ts": 97,
-      "src/main/ipc/pty-pending-projection-admissions.test.ts": 86,
-      "src/main/ipc/pty-persisted-incarnation-repair.test.ts": 38,
-      "src/main/ipc/pty-producer-flow-control.test.ts": 16,
-      "src/main/ipc/pty-renderer-inflight-credit.test.ts": 156,
-      "src/main/ipc/pty-renderer-lifecycle-delivery-reset.test.ts": 77,
-      "src/main/ipc/pty-renderer-liveness-guard.test.ts": 82,
-      "src/main/ipc/pty-renderer-send-failure-recovery.test.ts": 51,
-      "src/main/ipc/pty-restore-record-seeding.test.ts": 156,
-      "src/main/ipc/pty-restored-appimage-cli-shim-refresh.test.ts": 14,
-      "src/main/ipc/pty-runtime-kill-and-exit.test.ts": 105,
-      "src/main/ipc/pty-runtime-ssh-binding-persistence.test.ts": 40,
-      "src/main/ipc/pty-serializer-settlement-mapping.test.ts": 146,
-      "src/main/ipc/pty-session-liveness-and-ownership.test.ts": 42,
-      "src/main/ipc/pty-spawn-codex-home-unavailable.test.ts": 43,
-      "src/main/ipc/pty-spawn-cwd-fallback.test.ts": 69,
-      "src/main/ipc/pty-spawn-env-agent-overlays.test.ts": 116,
-      "src/main/ipc/pty-spawn-env-codex-home-routing.test.ts": 132,
-      "src/main/ipc/pty-spawn-env-codex-resume-provenance.test.ts": 118,
-      "src/main/ipc/pty-spawn-env-terminal-basics.test.ts": 1128,
-      "src/main/ipc/pty-spawn-runtime-handle-binding.test.ts": 135,
-      "src/main/ipc/pty-ssh-stop-verdict.test.ts": 92,
-      "src/main/ipc/pty-ssh-undelivered-kill.test.ts": 149,
-      "src/main/ipc/pty-startup-barrier-and-listing.test.ts": 60,
-      "src/main/ipc/pty-startup-barrier-ordering.test.ts": 3,
-      "src/main/ipc/pty-startup-swap-window-presence.test.ts": 81,
-      "src/main/ipc/pty-windows-shell-selection.test.ts": 131,
-      "src/main/ipc/pty-write-ipc-validation.test.ts": 125,
-      "src/main/ipc/pty-wsl-cwd-validation.test.ts": 75,
-      "src/main/ipc/pty/delivery/attached-pty-size.test.ts": 13,
-      "src/main/ipc/pty/ipc/spawn-commit-ssh-lease-cardinality.test.ts": 111,
-      "src/main/ipc/pty/ipc/spawn-push-target-materialization-real-git.test.ts": 258,
-      "src/main/ipc/pty/ipc/spawn-push-target-materialization.test.ts": 11,
-      "src/main/ipc/pty/ipc/spawn-reattach-size-cache.test.ts": 14,
-      "src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts": 25,
-      "src/main/ipc/pty/pane/launch-authority.test.ts": 9,
-      "src/main/ipc/pty/pane/stable-pane-absence-death-certificate.test.ts": 26,
-      "src/main/ipc/pty/pane/stable-pane-relay-absence-respawn.test.ts": 14,
-      "src/main/ipc/pty/register-headless-runtime.test.ts": 6,
-      "src/main/ipc/pty/runtime/queried-host-kinds.test.ts": 8,
-      "src/main/ipc/pty/runtime/spawn-commit-pty-size.test.ts": 7,
-      "src/main/ipc/rate-limits.test.ts": 7,
-      "src/main/ipc/readdir-error-diagnostics.test.ts": 10,
-      "src/main/ipc/register-core-handlers/register-core-handlers.test.ts": 20,
-      "src/main/ipc/remote-watcher-event-batch.test.ts": 29,
-      "src/main/ipc/remote-workspace-cache.test.ts": 9,
-      "src/main/ipc/remote-workspace-patch-queue.test.ts": 173,
-      "src/main/ipc/remote-workspace-snapshot-normalization.test.ts": 10,
-      "src/main/ipc/remote-workspace-stale-resync.test.ts": 162,
-      "src/main/ipc/remote-workspace.test.ts": 29,
-      "src/main/ipc/renderer-shutdown-checkpoint.test.ts": 18,
-      "src/main/ipc/renderer-terminal-serializer-readiness.test.ts": 11,
-      "src/main/ipc/repos-add-linked-worktree.test.ts": 46,
-      "src/main/ipc/repos-create.test.ts": 34,
-      "src/main/ipc/repos-execution-host-catalog.test.ts": 22,
-      "src/main/ipc/repos-local-add-and-project-setup.test.ts": 54,
-      "src/main/ipc/repos-local-clone-lifecycle.test.ts": 245,
-      "src/main/ipc/repos-nested-import.test.ts": 51,
-      "src/main/ipc/repos-nested-scan.test.ts": 36,
-      "src/main/ipc/repos-picker.test.ts": 8,
-      "src/main/ipc/repos-remote-base-ref-queries.test.ts": 30,
-      "src/main/ipc/repos-remote-client-events.test.ts": 1415,
-      "src/main/ipc/repos-remote-git-username.test.ts": 6,
-      "src/main/ipc/repos-remote.test.ts": 66,
-      "src/main/ipc/repos-sparse-presets.test.ts": 27,
-      "src/main/ipc/repos/remote-repo-registration.test.ts": 7,
-      "src/main/ipc/rg-availability.test.ts": 9,
-      "src/main/ipc/runtime-environment-browser-client-host-handler.test.ts": 14,
-      "src/main/ipc/runtime-environment-capability-evidence.test.ts": 9,
-      "src/main/ipc/runtime-environment-diagnostics-broadcast.test.ts": 4,
-      "src/main/ipc/runtime-environment-federated-read-routing.test.ts": 34,
-      "src/main/ipc/runtime-environment-federated-read-transport.bench.test.ts": 10,
-      "src/main/ipc/runtime-environment-removal-storage.test.ts": 565,
-      "src/main/ipc/runtime-environment-request-connections.test.ts": 1282,
-      "src/main/ipc/runtime-environment-revision-guard.test.ts": 7,
-      "src/main/ipc/runtime-environment-status-connection.test.ts": 441,
-      "src/main/ipc/runtime-environment-status-recovery.test.ts": 23,
-      "src/main/ipc/runtime-environment-support-routing.test.ts": 62,
-      "src/main/ipc/runtime-environment-transport-routing-tailscale-hint.test.ts": 853,
-      "src/main/ipc/runtime-environments-call-routing.test.ts": 187,
-      "src/main/ipc/runtime-environments-capability-cache.test.ts": 129,
-      "src/main/ipc/runtime-environments-pairing.test.ts": 66,
-      "src/main/ipc/runtime-environments-status-diagnostics.test.ts": 37,
-      "src/main/ipc/runtime-environments-subscription-lifecycle.test.ts": 35,
-      "src/main/ipc/runtime-environments-subscription-routing.test.ts": 26,
-      "src/main/ipc/runtime-environments-subscription-teardown.test.ts": 38,
-      "src/main/ipc/runtime-subscribe-lifecycle.test.ts": 10,
-      "src/main/ipc/runtime-watcher-pending-assignment.test.ts": 281,
-      "src/main/ipc/runtime-watcher-process-pool.test.ts": 46,
-      "src/main/ipc/runtime.test.ts": 23,
-      "src/main/ipc/settings.test.ts": 30,
-      "src/main/ipc/shallow-watch-delivery-probe.test.ts": 28,
-      "src/main/ipc/shell.test.ts": 47,
-      "src/main/ipc/skill-cloud-install-ipc-schemas.test.ts": 13,
-      "src/main/ipc/skill-cloud-ipc-handlers.test.ts": 12,
-      "src/main/ipc/skill-install-management-ipc-handlers.test.ts": 19,
-      "src/main/ipc/skill-install-progress-ipc.test.ts": 7,
-      "src/main/ipc/skill-ipc-main-window.test.ts": 9,
-      "src/main/ipc/skills.test.ts": 17,
-      "src/main/ipc/source-control-ai-linked-issue.test.ts": 14,
-      "src/main/ipc/speech.test.ts": 12,
-      "src/main/ipc/ssh-app-shutdown.test.ts": 45,
-      "src/main/ipc/ssh-browse.test.ts": 586,
-      "src/main/ipc/ssh-disconnect-cancellation.test.ts": 1118,
-      "src/main/ipc/ssh-handler-reregistration.test.ts": 49,
-      "src/main/ipc/ssh-passphrase.test.ts": 6,
-      "src/main/ipc/ssh-pty-closed-generation-ranges.test.ts": 46,
-      "src/main/ipc/ssh-pty-consumer-identity.test.ts": 175,
-      "src/main/ipc/ssh-pty-legacy-projection.test.ts": 18,
-      "src/main/ipc/ssh-pty-model-admission-generation-scope.test.ts": 16,
-      "src/main/ipc/ssh-pty-model-admission.test.ts": 15,
-      "src/main/ipc/ssh-pty-output-exit-deadline.test.ts": 23,
-      "src/main/ipc/ssh-pty-output-generation-guard.test.ts": 10,
-      "src/main/ipc/ssh-pty-output-intake.test.ts": 57,
-      "src/main/ipc/ssh-pty-output-model-migration.test.ts": 25,
-      "src/main/ipc/ssh-pty-remote-source-range-consumers.test.ts": 20,
-      "src/main/ipc/ssh-pty-source-ack-coalescer.test.ts": 14,
-      "src/main/ipc/ssh-pty-source-ack-session-contract.test.ts": 13,
-      "src/main/ipc/ssh-pty-source-obligation-coordinator.test.ts": 14,
-      "src/main/ipc/ssh-pty-source-obligation-ledger.test.ts": 82,
-      "src/main/ipc/ssh-relay-reset-resume.test.ts": 908,
-      "src/main/ipc/ssh-state-broadcast-fanout.test.ts": 25,
-      "src/main/ipc/ssh-target-registry.test.ts": 1633,
-      "src/main/ipc/ssh-terminate-sessions.test.ts": 144,
-      "src/main/ipc/ssh.test.ts": 61,
-      "src/main/ipc/telemetry.test.ts": 13,
-      "src/main/ipc/terminal-git-credential-guard.test.ts": 13,
-      "src/main/ipc/terminal-preview-output-stream.test.ts": 9,
-      "src/main/ipc/terminal-preview.test.ts": 155,
-      "src/main/ipc/terminal-render-desync-evidence.test.ts": 35,
-      "src/main/ipc/tui-agent-detection-commands.test.ts": 5,
-      "src/main/ipc/ui.test.ts": 12,
-      "src/main/ipc/usage-provider-handlers.test.ts": 6,
-      "src/main/ipc/watched-worktree-catalog-notification.test.ts": 7,
-      "src/main/ipc/watcher-event-root-path-rewrite.test.ts": 18,
-      "src/main/ipc/watcher-removal-gate.test.ts": 12,
-      "src/main/ipc/workspace-cleanup-activity.test.ts": 33,
-      "src/main/ipc/workspace-cleanup-broad-scan.test.ts": 55,
-      "src/main/ipc/workspace-cleanup-execution-host-routing.test.ts": 28,
-      "src/main/ipc/workspace-cleanup-local-git-routing.test.ts": 9,
-      "src/main/ipc/workspace-cleanup-snapshot-ipc.test.ts": 33,
-      "src/main/ipc/workspace-cleanup.test.ts": 4276,
-      "src/main/ipc/workspace-create-error-classifier.test.ts": 10,
-      "src/main/ipc/workspace-ports.test.ts": 21,
-      "src/main/ipc/workspace-space.test.ts": 18,
-      "src/main/ipc/worktree-base-directory-change-collector.test.ts": 8,
-      "src/main/ipc/worktree-base-directory-event-filter.test.ts": 18,
-      "src/main/ipc/worktree-base-directory-poller-marker-fanout.test.ts": 142,
-      "src/main/ipc/worktree-base-directory-poller.test.ts": 2628,
-      "src/main/ipc/worktree-base-directory-watch-targets.test.ts": 319,
-      "src/main/ipc/worktree-base-directory-watcher.test.ts": 109,
-      "src/main/ipc/worktree-create-lineage.test.ts": 16,
-      "src/main/ipc/worktree-folder-rename-target.test.ts": 8,
-      "src/main/ipc/worktree-git-common-polling.test.ts": 1088,
-      "src/main/ipc/worktree-git-common-watch.test.ts": 2677,
-      "src/main/ipc/worktree-git-status-ref-watch.test.ts": 10,
-      "src/main/ipc/worktree-head-identity-reader-concurrency.test.ts": 29,
-      "src/main/ipc/worktree-head-identity-reader-incremental.test.ts": 104,
-      "src/main/ipc/worktree-head-identity-reader.test.ts": 38,
-      "src/main/ipc/worktree-head-identity-refresh.test.ts": 28,
-      "src/main/ipc/worktree-include-copy-budget.test.ts": 53,
-      "src/main/ipc/worktree-logic-created-agent.test.ts": 5,
-      "src/main/ipc/worktree-logic-wsl.test.ts": 21,
-      "src/main/ipc/worktree-logic.test.ts": 53,
-      "src/main/ipc/worktree-metadata-merge.test.ts": 5,
-      "src/main/ipc/worktree-path-deduplication.test.ts": 34,
-      "src/main/ipc/worktree-push-target-cleanup.test.ts": 20,
-      "src/main/ipc/worktree-push-target-reconciliation-real-git.test.ts": 930,
-      "src/main/ipc/worktree-push-target-reconciliation.test.ts": 19,
-      "src/main/ipc/worktree-push-target-refspec-migration.test.ts": 11,
-      "src/main/ipc/worktree-push-target-refspec-real-git.test.ts": 2112,
-      "src/main/ipc/worktree-push-target-remote-scan.test.ts": 14,
-      "src/main/ipc/worktree-push-target-setup.test.ts": 16,
-      "src/main/ipc/worktree-remote-push-target-materialization.test.ts": 31,
-      "src/main/ipc/worktree-remote-ssh-branch-conflict.test.ts": 11,
-      "src/main/ipc/worktree-symlink-reconciliation.real.test.ts": 49,
-      "src/main/ipc/worktree-symlinks.test.ts": 123,
-      "src/main/ipc/worktree-watcher-removal-binding.test.ts": 78,
-      "src/main/ipc/worktrees-authoritative-local-metadata-pruning.test.ts": 210,
-      "src/main/ipc/worktrees-create-execution-host-routing.test.ts": 45,
-      "src/main/ipc/worktrees-create-metadata-persistence.test.ts": 60,
-      "src/main/ipc/worktrees-delete-pty-teardown.test.ts": 53,
-      "src/main/ipc/worktrees-detected-scan-cache.test.ts": 97,
-      "src/main/ipc/worktrees-discovery-metadata-backfill.test.ts": 51,
-      "src/main/ipc/worktrees-existing-branch-checkout.test.ts": 71,
-      "src/main/ipc/worktrees-forget-local.test.ts": 39,
-      "src/main/ipc/worktrees-issue-command-overrides.test.ts": 25,
-      "src/main/ipc/worktrees-lineage-hydration.test.ts": 33,
-      "src/main/ipc/worktrees-listing-fallback-rows.test.ts": 39,
-      "src/main/ipc/worktrees-local-base-ref-resolution.test.ts": 82,
-      "src/main/ipc/worktrees-local-create-flow.test.ts": 76,
-      "src/main/ipc/worktrees-orphan-directory-cleanup.test.ts": 35,
-      "src/main/ipc/worktrees-preserved-branch-fork-remote.test.ts": 28,
-      "src/main/ipc/worktrees-removal-recovery.test.ts": 75,
-      "src/main/ipc/worktrees-remove-archive-hooks.test.ts": 35,
-      "src/main/ipc/worktrees-remove-host-disambiguation.test.ts": 32,
-      "src/main/ipc/worktrees-remove-preflight.test.ts": 33,
-      "src/main/ipc/worktrees-setup-launch-sparse-checkout.test.ts": 57,
-      "src/main/ipc/worktrees-ssh-base-ref-resolution.test.ts": 61,
-      "src/main/ipc/worktrees-ssh-branch-conflict-suffixing.test.ts": 51,
-      "src/main/ipc/worktrees-ssh-create-base-prefetch.test.ts": 124,
-      "src/main/ipc/worktrees-ssh-fork-push-target-remote.test.ts": 73,
-      "src/main/ipc/worktrees-ssh-local-base-refresh.test.ts": 86,
-      "src/main/ipc/worktrees-ssh-pr-head-fetch.test.ts": 43,
-      "src/main/ipc/worktrees-ssh-provider-authority.test.ts": 35,
-      "src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts": 42,
-      "src/main/ipc/worktrees-ssh-setup-launch.test.ts": 48,
-      "src/main/ipc/worktrees-windows.test.ts": 72,
-      "src/main/ipc/worktrees-wsl-runtime-routing.test.ts": 84,
-      "src/main/ipc/worktrees/listing/detected-provider-listing-meta-index.test.ts": 19,
-      "src/main/ipc/worktrees/listing/detected-scan-failure-authority.test.ts": 29,
-      "src/main/ipc/worktrees/listing/detected-worktree-classification.test.ts": 21,
-      "src/main/ipc/worktrees/listing/detected-worktree-scan-hygiene-gate.test.ts": 13,
-      "src/main/ipc/worktrees/listing/register-sparse-checkout-cache-invalidation.test.ts": 9,
-      "src/main/jira/adf-markdown.test.ts": 10,
-      "src/main/jira/attachment-image-cache-generation.test.ts": 11,
-      "src/main/jira/attachment-image-cache.test.ts": 9,
-      "src/main/jira/attachment-images.test.ts": 31,
-      "src/main/jira/client.test.ts": 302,
-      "src/main/jira/issues.test.ts": 62,
-      "src/main/jira/jira-issue-mutations.test.ts": 29,
-      "src/main/jira/jira-issue-summary-timeout.test.ts": 33,
-      "src/main/jira/jira-search-abort.test.ts": 24,
-      "src/main/keybindings/keybinding-file.test.ts": 53,
-      "src/main/keybindings/keybinding-service.test.ts": 39,
-      "src/main/kimi/hook-service.test.ts": 8,
-      "src/main/kimi/kimi-hook-config-toml.test.ts": 25,
-      "src/main/kimi/kimi-runtime-home.test.ts": 15,
-      "src/main/lib/unread-response-body.test.ts": 51,
-      "src/main/line-editor-ready-output-scanner.test.ts": 7,
-      "src/main/linear/client.test.ts": 97,
-      "src/main/linear/issue-context-client.test.ts": 23,
-      "src/main/linear/issue-context-current.test.ts": 6,
-      "src/main/linear/issue-context-errors.test.ts": 6,
-      "src/main/linear/issue-context-includes.test.ts": 27,
-      "src/main/linear/issue-context-inline-media.test.ts": 6,
-      "src/main/linear/issue-context-relations.test.ts": 10,
-      "src/main/linear/issue-context.test.ts": 16,
-      "src/main/linear/issue-list-filter.test.ts": 8,
-      "src/main/linear/issue-relation-write.test.ts": 19,
-      "src/main/linear/issue-search-summary.test.ts": 6,
-      "src/main/linear/issues.test.ts": 41,
-      "src/main/linear/mappers.test.ts": 8,
-      "src/main/linear/mcp-issue-list-pagination.test.ts": 56,
-      "src/main/linear/mcp-issue-list.test.ts": 93,
-      "src/main/linear/projects.test.ts": 306,
-      "src/main/linear/teams.test.ts": 20,
-      "src/main/linux-lid-sleep-assertion.test.ts": 14,
-      "src/main/linux-package-install-command.test.ts": 36,
-      "src/main/linux-package-install-diagnostic.test.ts": 17,
-      "src/main/linux-package-update-recovery.test.ts": 178,
-      "src/main/linux-update-package-type.test.ts": 86,
-      "src/main/local-builds/local-build-candidate.test.ts": 107,
-      "src/main/local-builds/local-build-compatibility-contract.test.ts": 6,
-      "src/main/local-builds/local-build-feed-server.test.ts": 68,
-      "src/main/local-downloaded-folder-promotion.test.ts": 101,
-      "src/main/local-worktree-filesystem.test.ts": 269,
-      "src/main/local-worktree-metadata-prune-gate.test.ts": 9,
-      "src/main/local-worktree-path-presence.test.ts": 18,
-      "src/main/local-worktree-removal-recovery.test.ts": 22,
-      "src/main/localhost-worktree-label-proxy.test.ts": 72,
-      "src/main/macos-full-disk-access-status.test.ts": 8,
-      "src/main/macos-press-and-hold-default.test.ts": 13,
-      "src/main/macos-system-sleep-assertion.test.ts": 20,
-      "src/main/macos-tcc-prompt-notice.test.ts": 16,
-      "src/main/macos-tcc-prompt-watch.test.ts": 22,
-      "src/main/main-process-tree-kill-gate.test.ts": 7,
-      "src/main/memory/collector-windows-sweep.test.ts": 198,
-      "src/main/memory/collector.test.ts": 239,
-      "src/main/memory/host-memory.test.ts": 21,
-      "src/main/memory/hydrate-local-pty-registry.test.ts": 873,
-      "src/main/memory/process-memory-metric.test.ts": 6,
-      "src/main/memory/windows-process-sample-parsing.test.ts": 86,
-      "src/main/menu/gpu-acceleration-about-panel.test.ts": 9,
-      "src/main/menu/register-app-menu.test.ts": 21,
-      "src/main/mimo/hook-service.test.ts": 11,
-      "src/main/minimax/minimax-api-key-store.test.ts": 30,
-      "src/main/minimax/minimax-cookie-store.test.ts": 38,
-      "src/main/native-chat/agent-session-journal/journal-corruption-repair.test.ts": 293,
-      "src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts": 97,
-      "src/main/native-chat/agent-session-journal/journal-cursor.test.ts": 9,
-      "src/main/native-chat/agent-session-journal/journal-database.test.ts": 95,
-      "src/main/native-chat/agent-session-journal/journal-epoch-replacement.test.ts": 38,
-      "src/main/native-chat/agent-session-journal/journal-file-format-remnant.test.ts": 94,
-      "src/main/native-chat/agent-session-journal/journal-handle-ownership.test.ts": 7709,
-      "src/main/native-chat/agent-session-journal/journal-item-identity.test.ts": 10,
-      "src/main/native-chat/agent-session-journal/journal-legacy-import.test.ts": 181,
-      "src/main/native-chat/agent-session-journal/journal-reducer.test.ts": 45,
-      "src/main/native-chat/agent-session-journal/journal-row-schema-version.test.ts": 28,
-      "src/main/native-chat/agent-session-journal/journal-row-schema.test.ts": 32,
-      "src/main/native-chat/agent-session-journal/journal-row-writer.test.ts": 28,
-      "src/main/native-chat/agent-session-journal/journal-store-close.test.ts": 85,
-      "src/main/native-chat/agent-session-journal/journal-store-schema.test.ts": 85,
-      "src/main/native-chat/agent-session-journal/journal-store.test.ts": 290,
-      "src/main/native-chat/agent-session-journal/journal-subagent-liveness.test.ts": 835,
-      "src/main/native-chat/agent-session-wire/agent-session-delta-coalescer-protected.test.ts": 46,
-      "src/main/native-chat/agent-session-wire/agent-session-delta-coalescer.test.ts": 20,
-      "src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts": 477,
-      "src/main/native-chat/agent-session-wire/agent-session-history-page-grouping-parity.test.ts": 253,
-      "src/main/native-chat/agent-session-wire/agent-session-history-page-scaling.test.ts": 17,
-      "src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts": 1870,
-      "src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts": 178,
-      "src/main/native-chat/agent-session-wire/provider-frame-activity.test.ts": 10,
-      "src/main/native-chat/agent-session-wire/provider-frame-disposition.test.ts": 15,
-      "src/main/native-chat/agent-session-wire/provider-turn-activity-routing.test.ts": 22,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-acquisition-options.test.ts": 564,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-adapter-router.test.ts": 15,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-adapter.test.ts": 14,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.test.ts": 165,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-claude-options-round-trip.test.ts": 248,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-close-retry.test.ts": 52,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-command-publication.test.ts": 45,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.test.ts": 24,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts": 16,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-forget-status.test.ts": 30,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-grouped-prompt.test.ts": 68,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-handoff-flow-runner.test.ts": 99,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-handoff-operation-guard.test.ts": 144,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-handoff-options.test.ts": 587,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-handoff-owner-close.test.ts": 5,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-handoff-reverse.test.ts": 6,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-handoff.test.ts": 207,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-holds.test.ts": 215,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-host-handoff.test.ts": 103,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-host-runtime-state.test.ts": 7,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts": 1194,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-journal-handles.test.ts": 66,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-late-settlement.test.ts": 832,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-launch-env.test.ts": 7,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.test.ts": 156,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-live-tui-restart-survival.test.ts": 431,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-option-settlement.test.ts": 189,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-processless-reservation.test.ts": 115,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-proven-dead-retry.test.ts": 130,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-provider-restore.test.ts": 288,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.test.ts": 290,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.test.ts": 7,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-recovery-exits.test.ts": 361,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.test.ts": 180,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts": 8912,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-reconcile.test.ts": 6,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore-gate.test.ts": 6,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.test.ts": 59,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-status-publication.test.ts": 137,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-reveal.test.ts": 19,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-rewind.test.ts": 1652,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts": 34,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.test.ts": 20,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts": 515,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-settled-attach-retry.test.ts": 304,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.test.ts": 13,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.test.ts": 581,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts": 314,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-surface-lifetime.test.ts": 1169,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-task-queue.test.ts": 64,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-teardown-handoff-drain.test.ts": 251,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-turns.test.ts": 47,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts": 15,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-wedged-profile-migration.test.ts": 985,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-wire-admission.test.ts": 569,
-      "src/main/native-chat/agent-session-wire/structured-conversation-command-admission.test.ts": 6,
-      "src/main/native-chat/agent-session-wire/structured-conversation-command.test.ts": 831,
-      "src/main/native-chat/agent-session-wire/structured-conversation-replacements.test.ts": 8,
-      "src/main/native-chat/agent-session-wire/structured-rewind-claude-proof.test.ts": 9,
-      "src/main/native-chat/agent-session-wire/structured-rewind-journal-body.test.ts": 16,
-      "src/main/native-chat/agent-session-wire/structured-session-compaction.test.ts": 21,
-      "src/main/native-chat/agent-session-wire/structured-tui-transcript-catchup.test.ts": 420,
-      "src/main/native-chat/agent-session-wire/unhandled-provider-frame.test.ts": 21,
-      "src/main/native-chat/claude-structured-managed-account-support.test.ts": 11,
-      "src/main/native-chat/host-readable-transcript-path-fs-gate.test.ts": 213,
-      "src/main/native-chat/host-readable-transcript-path.test.ts": 20,
-      "src/main/native-chat/native-chat-file-provenance.test.ts": 10,
-      "src/main/native-chat/session-file-resolver-claude-roots.test.ts": 6,
-      "src/main/native-chat/session-file-resolver-codex-roots.test.ts": 4,
-      "src/main/native-chat/session-file-resolver-wsl-scan-gate.test.ts": 21,
-      "src/main/native-chat/session-file-resolver-wsl.test.ts": 21,
-      "src/main/native-chat/session-file-resolver.test.ts": 87,
-      "src/main/native-chat/structured-agent-session-create-support.test.ts": 8,
-      "src/main/native-chat/structured-agent-session-history-adoption.test.ts": 9,
-      "src/main/native-chat/subagent-entry-id-bounds.test.ts": 7,
-      "src/main/native-chat/transcript-fallback-id.test.ts": 6,
-      "src/main/native-chat/transcript-interruption-message.test.ts": 7,
-      "src/main/native-chat/transcript-line-decoders-claude-control-bytes.test.ts": 7,
-      "src/main/native-chat/transcript-line-decoders-claude-image-companion.test.ts": 6,
-      "src/main/native-chat/transcript-line-decoders-codex-skill-context.test.ts": 12,
-      "src/main/native-chat/transcript-line-decoders.grok.test.ts": 13,
-      "src/main/native-chat/transcript-line-decoders.omp.test.ts": 21,
-      "src/main/native-chat/transcript-read-cache-refusal-recovery.test.ts": 31,
-      "src/main/native-chat/transcript-read-cache-wsl-stall.test.ts": 14,
-      "src/main/native-chat/transcript-read-cache.test.ts": 55,
-      "src/main/native-chat/transcript-reader-codex-history-mode.test.ts": 21,
-      "src/main/native-chat/transcript-reader-wsl-stall.test.ts": 20,
-      "src/main/native-chat/transcript-reader.test.ts": 31,
-      "src/main/native-chat/transcript-stream-lines.test.ts": 8,
-      "src/main/native-chat/transcript-tail-reader-cancellation.test.ts": 115,
-      "src/main/native-chat/transcript-tail-reader-wsl-gate.test.ts": 17,
-      "src/main/native-chat/transcript-turn-lifecycle.test.ts": 11,
-      "src/main/native-chat/transcript-watch-engine-wsl-lifecycle.test.ts": 71,
-      "src/main/native-chat/transcript-watch-error.test.ts": 2068,
-      "src/main/native-chat/transcript-watch-liveness.test.ts": 639,
-      "src/main/native-chat/transcript-watch-resolve-poll.test.ts": 82,
-      "src/main/native-chat/transcript-watch-unflushed-settle.test.ts": 94,
-      "src/main/native-chat/transcript-watch-unsubscribe-race.test.ts": 26,
-      "src/main/native-chat/transcript-watch-wsl-exact-path.test.ts": 21,
-      "src/main/native-chat/transcript-watch-wsl-stall.test.ts": 21,
-      "src/main/native-chat/transcript-watch.test.ts": 3183,
-      "src/main/native-chat/transcript-window-tool-attribution.test.ts": 13,
-      "src/main/native-chat/wsl-codex-session-path-scan.test.ts": 24,
-      "src/main/native-chat/wsl-transcript-fs-access.test.ts": 29,
-      "src/main/native-chat/wsl-transcript-fs-gate.test.ts": 463,
-      "src/main/native-chat/wsl-transcript-fs-process-client.test.ts": 33,
-      "src/main/native-chat/wsl-transcript-fs-process-operations.test.ts": 5,
-      "src/main/native-chat/wsl-transcript-fs-route-quarantine.test.ts": 22,
-      "src/main/native-chat/wsl-transcript-fs-route.test.ts": 6,
-      "src/main/native-chat/wsl-transcript-running-observer.test.ts": 65,
-      "src/main/network/electron-proxy-request-guard.test.ts": 314,
-      "src/main/network/macos-system-resolver-health.test.ts": 18,
-      "src/main/network/macos-tailscale-dns-diagnostic.test.ts": 8,
-      "src/main/network/proxy-settings-session.test.ts": 779,
-      "src/main/network/proxy-settings.test.ts": 67,
-      "src/main/notifications/desktop-away-state.test.ts": 6,
-      "src/main/observability/architecture.test.ts": 10,
-      "src/main/observability/bundle.test.ts": 294,
-      "src/main/observability/diagnostic-upload-http.test.ts": 8,
-      "src/main/observability/instrumentation.test.ts": 252,
-      "src/main/observability/local-file-sink-memory.test.ts": 126,
-      "src/main/observability/local-file-sink.test.ts": 27,
-      "src/main/observability/redactor-environment-lines.test.ts": 486,
-      "src/main/observability/redactor.test.ts": 27,
-      "src/main/observability/tracer.test.ts": 27,
-      "src/main/opencode-usage/scanner-windows-data-directory.test.ts": 23,
-      "src/main/opencode-usage/scanner-wsl-gate.test.ts": 18,
-      "src/main/opencode-usage/scanner.test.ts": 224,
-      "src/main/opencode-usage/store.test.ts": 28,
-      "src/main/opencode/hook-plugin-background-child-completion.test.ts": 197,
-      "src/main/opencode/hook-plugin-child-attention.test.ts": 421,
-      "src/main/opencode/hook-plugin-fail-open-ownership.test.ts": 460,
-      "src/main/opencode/hook-plugin-lifecycle-delivery.test.ts": 591,
-      "src/main/opencode/hook-plugin-message-part-throttle.test.ts": 137,
-      "src/main/opencode/hook-plugin-module-contract.test.ts": 146,
-      "src/main/opencode/hook-service.test.ts": 50,
-      "src/main/opencode/opencode-data-directory.test.ts": 6,
-      "src/main/orca-profiles/profile-artifact-cloud-cleanup.test.ts": 142,
-      "src/main/orca-profiles/profile-cloud-auth-config.test.ts": 7,
-      "src/main/orca-profiles/profile-cloud-auth-status.test.ts": 7,
-      "src/main/orca-profiles/profile-cloud-client.test.ts": 73,
-      "src/main/orca-profiles/profile-cloud-dev-service.test.ts": 52,
-      "src/main/orca-profiles/profile-cloud-org-members-client.test.ts": 9,
-      "src/main/orca-profiles/profile-cloud-org-members-service.test.ts": 33,
-      "src/main/orca-profiles/profile-cloud-pkce.test.ts": 184,
-      "src/main/orca-profiles/profile-cloud-service-auth-retry.test.ts": 42,
-      "src/main/orca-profiles/profile-cloud-service-refresh.test.ts": 148,
-      "src/main/orca-profiles/profile-cloud-service.test.ts": 45,
-      "src/main/orca-profiles/profile-cloud-session-mutation.test.ts": 14,
-      "src/main/orca-profiles/profile-cloud-session-refresh.test.ts": 12,
-      "src/main/orca-profiles/profile-cloud-session-store.test.ts": 71,
-      "src/main/orca-profiles/profile-index-store.test.ts": 188,
-      "src/main/orca-profiles/profile-project-presence.test.ts": 59,
-      "src/main/orca-profiles/profile-project-session-field-disposition.test.ts": 9,
-      "src/main/orca-profiles/profile-project-session-state.test.ts": 13,
-      "src/main/orca-profiles/profile-project-state-file.test.ts": 7,
-      "src/main/orca-profiles/profile-project-transfer.test.ts": 238,
-      "src/main/orca-profiles/profile-ui-scope.test.ts": 4,
-      "src/main/orcad/electron-serve-browser-process.test.ts": 2342,
-      "src/main/orcad/electron-serve-provider-selection.test.ts": 427,
-      "src/main/orcad/electron-sidecar-method-routing.test.ts": 7,
-      "src/main/orcad/electron-sidecar-tab-registry.test.ts": 12,
-      "src/main/orcad/external-chromium-browser-session.test.ts": 16,
-      "src/main/orcad/main-preflight-order.test.ts": 8,
-      "src/main/orcad/native-host-abi.test.ts": 15,
-      "src/main/orcad/node-pty-prebuilt-slot.test.ts": 12,
-      "src/main/orcad/node-pty-precondition.test.ts": 290,
-      "src/main/orcad/orcad-app-paths.test.ts": 10,
-      "src/main/orcad/orcad-bind-address.test.ts": 11,
-      "src/main/orcad/orcad-browser-provider.test.ts": 53,
-      "src/main/orcad/orcad-bundle-native-load-order.test.ts": 3283,
-      "src/main/orcad/orcad-daemon-supervision.test.ts": 10,
-      "src/main/orcad/orcad-forked-child-paths.test.ts": 8,
-      "src/main/orcad/orcad-health.test.ts": 10,
-      "src/main/orcad/orcad-instance-lock.test.ts": 15,
-      "src/main/orcad/orcad-launch-contract.test.ts": 13,
-      "src/main/orcad/orcad-native-preflight.test.ts": 6,
-      "src/main/orcad/orcad-push-startup.test.ts": 704,
-      "src/main/own-chromium-tree-kill-guard.test.ts": 20,
-      "src/main/persistence-async-write-syscalls.test.ts": 5455,
-      "src/main/persistence-automations.test.ts": 593,
-      "src/main/persistence-clipboard-selection-migration.test.ts": 65,
-      "src/main/persistence-cohort-and-identity-migration.test.ts": 67,
-      "src/main/persistence-cross-host-pane-identity.test.ts": 36,
-      "src/main/persistence-deregistered-repo-residue.test.ts": 132,
-      "src/main/persistence-duplicate-repo-id-host-scope.test.ts": 792,
-      "src/main/persistence-feature-interaction-broadcast.benchmark.test.ts": 126,
-      "src/main/persistence-floating-terminal-trust.test.ts": 91,
-      "src/main/persistence-flush-and-save-scheduling.test.ts": 226,
-      "src/main/persistence-folder-workspace-notes.test.ts": 124,
-      "src/main/persistence-host-admitted-terminal-membership.test.ts": 32,
-      "src/main/persistence-host-partitioned-sessions.test.ts": 173,
-      "src/main/persistence-host-partitioned-ssh-pty-bindings.test.ts": 31,
-      "src/main/persistence-initial-load.test.ts": 171,
-      "src/main/persistence-layout-binding-recovery.test.ts": 46,
-      "src/main/persistence-load-repair-durability.test.ts": 65,
-      "src/main/persistence-loading-store-extraction.test.ts": 93,
-      "src/main/persistence-loading-store-write-risks.test.ts": 34,
-      "src/main/persistence-native-chat-tab-view-mode.test.ts": 17,
-      "src/main/persistence-pane-identity-migration.test.ts": 27776,
-      "src/main/persistence-protected-secret-fail-closed.test.ts": 2755,
-      "src/main/persistence-protected-secret-write-race.test.ts": 698,
-      "src/main/persistence-proxy-secret-recovery.test.ts": 1089,
-      "src/main/persistence-pty-binding-leaf-tab-resolution.test.ts": 33,
-      "src/main/persistence-pty-binding-reconciliation.test.ts": 54,
-      "src/main/persistence-remote-session-startup.test.ts": 58,
-      "src/main/persistence-repo-lifecycle.test.ts": 807,
-      "src/main/persistence-right-sidebar-tab.test.ts": 7,
-      "src/main/persistence-settings-ui-defaults.test.ts": 137,
-      "src/main/persistence-settings-update.test.ts": 124,
-      "src/main/persistence-single-serialize.test.ts": 1727,
-      "src/main/persistence-source-control-ai-migration.test.ts": 108,
-      "src/main/persistence-split-pane-incarnation.test.ts": 65,
-      "src/main/persistence-ssh-lease-reattach-reclaim.test.ts": 46,
-      "src/main/persistence-ssh-lease-tombstone-retention.test.ts": 44,
-      "src/main/persistence-ssh-pending-pty-kill.test.ts": 570,
-      "src/main/persistence-ssh-readoption-automation-migration.test.ts": 1520,
-      "src/main/persistence-ssh-remote-pty-binding-replay.test.ts": 41,
-      "src/main/persistence-ssh-remote-pty-leases.test.ts": 129,
-      "src/main/persistence-ssh-targets-and-pane-keys.test.ts": 72,
-      "src/main/persistence-terminal-option-key-migration.test.ts": 47,
-      "src/main/persistence-ui-state.test.ts": 3109,
-      "src/main/persistence-update-repo.test.ts": 252,
-      "src/main/persistence-workspace-pinned-automation-fence.test.ts": 1660,
-      "src/main/persistence-workspace-repin-automation-owner.test.ts": 1100,
-      "src/main/persistence-workspace-session-scrollback.test.ts": 101,
-      "src/main/persistence-workspace-status-workflow.test.ts": 67,
-      "src/main/persistence-worktree-card-properties.test.ts": 43,
-      "src/main/persistence-worktree-deletion-fencing.test.ts": 88,
-      "src/main/persistence-worktree-lineage-and-backups.test.ts": 499,
-      "src/main/persistence-worktree-meta-and-folder-workspaces.test.ts": 83,
-      "src/main/persistence-worktree-name-retirement.test.ts": 3387,
-      "src/main/persistence-worktree-visibility.test.ts": 100,
-      "src/main/persistence/applying-settings/settings-update-terminal-contrast.test.ts": 8,
-      "src/main/persistence/applying-settings/terminal-settings-migrations.test.ts": 4,
-      "src/main/persistence/leasing-ssh-ptys/ssh-pty-binding-cleanup.test.ts": 22,
-      "src/main/persistence/loading-store/metadata-lineage-batch-pruning.test.ts": 46,
-      "src/main/persistence/loading-store/normalize-loaded-global-settings.test.ts": 17,
-      "src/main/persistence/loading-store/normalize-loaded-project-catalog.test.ts": 12,
-      "src/main/persistence/loading-store/persisted-state-redundancy.test.ts": 461,
-      "src/main/persistence/loading-store/secret-sentinel-substitution.test.ts": 14,
-      "src/main/persistence/loading-store/state-write-round-trip.test.ts": 72,
-      "src/main/persistence/loading-store/store-prune-gate-signals.test.ts": 32,
-      "src/main/persistence/loading-store/store-runtime-authored-session-writes.test.ts": 29,
-      "src/main/persistence/loading-store/workspace-session-partitions.test.ts": 16,
-      "src/main/persistence/loading-store/workspace-session-terminal-binding-replay.test.ts": 13,
-      "src/main/persistence/loading-store/worktree-meta-alias-projection.test.ts": 345,
-      "src/main/persistence/loading-store/worktree-meta-write-normalization.test.ts": 8,
-      "src/main/persistence/restoring-sessions/pane-alias-normalization-scaling.test.ts": 11,
-      "src/main/persistence/restoring-sessions/pane-alias-normalization.test.ts": 6,
-      "src/main/persistence/restoring-sessions/pane-key-remapping.test.ts": 9,
-      "src/main/persistence/restoring-sessions/session-owner-fields.test.ts": 10,
-      "src/main/persistence/restoring-sessions/session-worktree-ownership.test.ts": 21,
-      "src/main/persistence/restoring-sessions/terminal-layout-normalization.test.ts": 6,
-      "src/main/persistence/restoring-sessions/workspace-pane-normalization-index.test.ts": 10,
-      "src/main/persistence/runtime-authored-workspace-session-fields.test.ts": 5,
-      "src/main/persistence/scheduling-automations/automation-run-operations.test.ts": 16,
-      "src/main/persistence/tracking-repos/local-worktree-metadata-scan-expectation.test.ts": 21,
-      "src/main/persistence/tracking-repos/missing-local-worktree-metadata-pruning.test.ts": 107,
-      "src/main/persistence/tracking-repos/probeable-local-worktree-metadata-candidates.test.ts": 13,
-      "src/main/persistence/tracking-repos/project-host-compatibility.test.ts": 11,
-      "src/main/persistence/tracking-repos/worktree-metadata-normalization.test.ts": 9,
-      "src/main/pi/agent-status-extension-omp-lifecycle.test.ts": 839,
-      "src/main/pi/agent-status-extension-source.test.ts": 1483,
-      "src/main/pi/agent-status-omp-approval-forwarding.test.ts": 487,
-      "src/main/pi/agent-status-owner-recovery.test.ts": 432,
-      "src/main/pi/agent-status-ui-prompt.test.ts": 623,
-      "src/main/pi/titlebar-extension-overlay-path.test.ts": 9,
-      "src/main/pi/titlebar-extension-service.test.ts": 147,
-      "src/main/pi/titlebar-extension-source.test.ts": 618,
-      "src/main/plugins/plugin-atomic-file-write.test.ts": 1988,
-      "src/main/plugins/plugin-audit-log-scaling.test.ts": 412,
-      "src/main/plugins/plugin-audit-log.test.ts": 17,
-      "src/main/plugins/plugin-bundled-bootstrap-coordinator.test.ts": 62,
-      "src/main/plugins/plugin-bundled-bootstrap.test.ts": 104,
-      "src/main/plugins/plugin-command-registry.test.ts": 32,
-      "src/main/plugins/plugin-content-pack-registry.test.ts": 30,
-      "src/main/plugins/plugin-content-safety.test.ts": 66,
-      "src/main/plugins/plugin-dev-watcher.test.ts": 106,
-      "src/main/plugins/plugin-discovery.test.ts": 40,
-      "src/main/plugins/plugin-enablement.test.ts": 14,
-      "src/main/plugins/plugin-host-conformance.test.ts": 30,
-      "src/main/plugins/plugin-host-methods.test.ts": 22,
-      "src/main/plugins/plugin-host-process.test.ts": 13,
-      "src/main/plugins/plugin-host-runtime.test.ts": 11,
-      "src/main/plugins/plugin-install-trust.test.ts": 51,
-      "src/main/plugins/plugin-install.test.ts": 334,
-      "src/main/plugins/plugin-kill-list-content-revocation.test.ts": 52,
-      "src/main/plugins/plugin-kill-list-service.test.ts": 68,
-      "src/main/plugins/plugin-language-pack-registry.test.ts": 22,
-      "src/main/plugins/plugin-launch-content.test.ts": 84,
-      "src/main/plugins/plugin-list-projection.test.ts": 15,
-      "src/main/plugins/plugin-marketplace-installer.test.ts": 98,
-      "src/main/plugins/plugin-marketplace-service.test.ts": 136,
-      "src/main/plugins/plugin-marketplace-store.test.ts": 241,
-      "src/main/plugins/plugin-panel-controller.test.ts": 25,
-      "src/main/plugins/plugin-panel-navigation-guard.test.ts": 7,
-      "src/main/plugins/plugin-panel-owner-lifecycle.test.ts": 4,
-      "src/main/plugins/plugin-panel-sessions.test.ts": 7,
-      "src/main/plugins/plugin-private-marketplace.integration.test.ts": 321,
-      "src/main/plugins/plugin-secrets-store.test.ts": 33,
-      "src/main/plugins/plugin-service-integrity.test.ts": 70,
-      "src/main/plugins/plugin-service-reconciliation.test.ts": 314,
-      "src/main/plugins/plugin-startup-budget.test.ts": 373,
-      "src/main/plugins/plugin-storage-store.test.ts": 8,
-      "src/main/plugins/plugin-vm-recipe-registry.test.ts": 40,
-      "src/main/plugins/plugin-worker-controller.test.ts": 77,
-      "src/main/plugins/plugin-worker-env.test.ts": 6,
-      "src/main/plugins/plugin-worker-manager.test.ts": 17,
-      "src/main/plugins/plugin-worker-output-buffer.test.ts": 12,
-      "src/main/plugins/plugin-worker-supervision.integration.test.ts": 8191,
-      "src/main/ports/advertised-url-watcher-pid-validation.test.ts": 10,
-      "src/main/ports/advertised-url-watcher.test.ts": 22,
-      "src/main/ports/local-workspace-port-scanner.test.ts": 44,
-      "src/main/ports/port-scan-command-client.test.ts": 1741,
-      "src/main/ports/port-scan-command-execution.test.ts": 5223,
-      "src/main/ports/port-scan-command-import-boundary.test.ts": 6,
-      "src/main/ports/ssh-advertised-url-enrichment.test.ts": 13,
-      "src/main/ports/workspace-port-ownership.test.ts": 9,
-      "src/main/powershell-osc133-bootstrap.test.ts": 14,
-      "src/main/project-groups/folder-workspace-path-status.test.ts": 19,
-      "src/main/project-groups/nested-repo-discovery.test.ts": 103,
-      "src/main/project-groups/nested-repo-import-target.test.ts": 10,
-      "src/main/project-groups/nested-repo-import.test.ts": 17,
-      "src/main/project-runtime-git-options.test.ts": 15,
-      "src/main/protected-secret-persistence.test.ts": 20,
-      "src/main/providers/agent-foreground-process-batch.test.ts": 15,
-      "src/main/providers/agent-foreground-process-pi.test.ts": 12,
-      "src/main/providers/agent-foreground-process-ps-scan-volume.test.ts": 24,
-      "src/main/providers/agent-foreground-process-real-rows.test.ts": 13,
-      "src/main/providers/agent-foreground-process-remote-evidence.test.ts": 11,
-      "src/main/providers/agent-foreground-process-windows-job-rejection.test.ts": 4,
-      "src/main/providers/agent-foreground-process.test.ts": 30,
-      "src/main/providers/execution-host-provider-dispatch.test.ts": 12,
-      "src/main/providers/local-pty-foreground-inspection-cheap-tier.test.ts": 10,
-      "src/main/providers/local-pty-provider-foreground-process.test.ts": 110,
-      "src/main/providers/local-pty-provider-io-events.test.ts": 31,
-      "src/main/providers/local-pty-provider-session-inventory.test.ts": 29,
-      "src/main/providers/local-pty-provider-shell-readiness.test.ts": 39,
-      "src/main/providers/local-pty-provider-shutdown.test.ts": 351,
-      "src/main/providers/local-pty-provider-spawn-cwd-safety.test.ts": 21,
-      "src/main/providers/local-pty-provider-spawn-env.test.ts": 40,
-      "src/main/providers/local-pty-provider-spawn-session.test.ts": 33,
-      "src/main/providers/local-pty-provider-windows-shell-launch.test.ts": 72,
-      "src/main/providers/local-pty-shell-ready-marker-scan.test.ts": 8,
-      "src/main/providers/local-pty-shell-ready-startup-command.test.ts": 11,
-      "src/main/providers/local-pty-shell-ready-wrapper-generation.test.ts": 411,
-      "src/main/providers/local-pty-shell-startup-command.node-pty.test.ts": 52,
-      "src/main/providers/local-pty-utils-windows-fallback.test.ts": 9,
-      "src/main/providers/local-pty-utils.test.ts": 12,
-      "src/main/providers/macos-login-session-pty-probe.test.ts": 12,
-      "src/main/providers/macos-tcc-login-shell.test.ts": 77,
-      "src/main/providers/posix-pane-foreground-fingerprint.test.ts": 9,
-      "src/main/providers/process-cwd.test.ts": 100,
-      "src/main/providers/provider-dispatch.test.ts": 38,
-      "src/main/providers/pty-default-cwd.test.ts": 9,
-      "src/main/providers/pty-process-inspection.test.ts": 15,
-      "src/main/providers/pty-process-list-admission.test.ts": 76,
-      "src/main/providers/pty-repaint-wide-char-buffer.node-pty.test.ts": 1855,
-      "src/main/providers/settled-pty-writer-census.test.ts": 79,
-      "src/main/providers/ssh-filesystem-dispatch.test.ts": 9,
-      "src/main/providers/ssh-filesystem-doc-preview.test.ts": 7,
-      "src/main/providers/ssh-filesystem-download.test.ts": 145,
-      "src/main/providers/ssh-filesystem-provider-capabilities.test.ts": 15,
-      "src/main/providers/ssh-filesystem-provider-download-folder.test.ts": 22,
-      "src/main/providers/ssh-filesystem-provider-range.test.ts": 13,
-      "src/main/providers/ssh-filesystem-provider-stream.test.ts": 52,
-      "src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts": 437,
-      "src/main/providers/ssh-filesystem-provider.test.ts": 59,
-      "src/main/providers/ssh-filesystem-watch-notifications.test.ts": 11,
-      "src/main/providers/ssh-git-dispatch.test.ts": 4,
-      "src/main/providers/ssh-git-provider-api.test.ts": 8,
-      "src/main/providers/ssh-git-provider-commit-message.test.ts": 18,
-      "src/main/providers/ssh-git-provider-diff.test.ts": 32,
-      "src/main/providers/ssh-git-provider-exec.test.ts": 26,
-      "src/main/providers/ssh-git-provider-merge.test.ts": 9,
-      "src/main/providers/ssh-git-provider-remote-sync.test.ts": 21,
-      "src/main/providers/ssh-git-provider-staging.test.ts": 16,
-      "src/main/providers/ssh-git-provider-status-lease.test.ts": 24,
-      "src/main/providers/ssh-git-provider-status.test.ts": 22,
-      "src/main/providers/ssh-git-provider-upstream-lease.test.ts": 16,
-      "src/main/providers/ssh-git-provider-worktree.test.ts": 29,
-      "src/main/providers/ssh-git-worktree-list-dedupe.test.ts": 32,
-      "src/main/providers/ssh-pty-inspect-observation-identity.test.ts": 6,
-      "src/main/providers/ssh-pty-live-source-restore-respawn.test.ts": 15,
-      "src/main/providers/ssh-pty-notification-rejection-routing.test.ts": 162,
-      "src/main/providers/ssh-pty-notification-routing.test.ts": 22,
-      "src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts": 35,
-      "src/main/providers/ssh-pty-provider-claim-incarnation.test.ts": 7,
-      "src/main/providers/ssh-pty-provider-exit-race.test.ts": 19,
-      "src/main/providers/ssh-pty-provider-process-events.test.ts": 18,
-      "src/main/providers/ssh-pty-provider-reattach-incarnation.test.ts": 9,
-      "src/main/providers/ssh-pty-provider-spawn.test.ts": 33,
-      "src/main/providers/ssh-pty-provider-terminal-repair.test.ts": 36,
-      "src/main/providers/ssh-pty-provider.test.ts": 31,
-      "src/main/providers/ssh-pty-reattach-absence-discrimination.test.ts": 23,
-      "src/main/providers/ssh-pty-relay-absence-verdict.test.ts": 19,
-      "src/main/providers/ssh-pty-source-delivery-ledger.test.ts": 14,
-      "src/main/providers/ssh-pty-write.test.ts": 25,
-      "src/main/providers/ssh-worktree-catalog-authority.test.ts": 29,
-      "src/main/providers/stable-foreground-process.test.ts": 5,
-      "src/main/providers/windows-agent-foreground-process-scan-volume.test.ts": 37,
-      "src/main/providers/windows-cached-agent-revalidation.test.ts": 11,
-      "src/main/providers/windows-conpty-wide-char-duplication.node-pty.test.ts": 7,
-      "src/main/providers/windows-console-attached-processes.test.ts": 16,
-      "src/main/providers/windows-foreground-process-inspection-cost.test.ts": 15,
-      "src/main/providers/windows-foreground-process-rows.test.ts": 13,
-      "src/main/providers/windows-powershell-executable.test.ts": 18,
-      "src/main/providers/windows-powershell.test.ts": 8,
-      "src/main/providers/windows-pty-job-membership.test.ts": 13,
-      "src/main/providers/windows-shell-args.test.ts": 48,
-      "src/main/providers/windows-shell-fallback-chain.test.ts": 10,
-      "src/main/providers/working-directory-validation.test.ts": 45,
-      "src/main/provisioned-root-ssh-adoption.test.ts": 140,
-      "src/main/proxy-guarded-fetch-call-site-audit.test.ts": 76,
-      "src/main/pty-descendant-termination-job-coverage.test.ts": 5,
-      "src/main/pty-descendant-termination.test.ts": 59,
-      "src/main/pty/appimage-terminal-env.test.ts": 6,
-      "src/main/pty/build-mode-env.test.ts": 6,
-      "src/main/pty/codex-home-wsl-env.test.ts": 5,
-      "src/main/pty/codex-preflight-profile-path-rewrite.test.ts": 134,
-      "src/main/pty/codex-shell-launch-preflight.test.ts": 4086,
-      "src/main/pty/conda-activation-env.test.ts": 8,
-      "src/main/pty/legacy-terminal-shim-dir.test.ts": 1197,
-      "src/main/pty/legacy-terminal-windows-tombstone.test.ts": 21,
-      "src/main/pty/node-pty-master-fd-retirement.test.ts": 5158,
-      "src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts": 6,
-      "src/main/pty/omp-shell-wrapper-alias-safety.test.ts": 16,
-      "src/main/pty/omp-sqlite-overlay.test.ts": 5,
-      "src/main/pty/overlay-mirror.test.ts": 17,
-      "src/main/pty/posix-pty-foreground-group.test.ts": 9,
-      "src/main/pty/posix-pty-process-groups.integration.test.ts": 106,
-      "src/main/pty/posix-pty-process-groups.test.ts": 10,
-      "src/main/pty/shell-startup-env.test.ts": 19,
-      "src/main/pty/terminal-color-env.test.ts": 8,
-      "src/main/pty/windows-environment-path-main-loop.test.ts": 367,
-      "src/main/pty/windows-environment-path.test.ts": 17,
-      "src/main/pty/windows-path-registry-change.test.ts": 6,
-      "src/main/pty/windows-path-registry-fallback.test.ts": 7,
-      "src/main/pty/windows-path-registry-reader.test.ts": 9,
-      "src/main/pty/wsl-orca-env.test.ts": 20,
-      "src/main/pwsh.test.ts": 24,
-      "src/main/quit-path-durable-write-blocking.test.ts": 1453,
-      "src/main/quit-teardown-agent-browser-daemons.test.ts": 6,
-      "src/main/quit-teardown-deadline.test.ts": 11,
-      "src/main/quit-teardown-start-gate.test.ts": 8,
-      "src/main/rate-limits/account-runtime-target-sync.test.ts": 12,
-      "src/main/rate-limits/antigravity-usage-mirror.test.ts": 7,
-      "src/main/rate-limits/auth-filesystem-operation.test.ts": 11,
-      "src/main/rate-limits/claude-fetcher-cli-fallback.test.ts": 86,
-      "src/main/rate-limits/claude-fetcher-fable-usage.test.ts": 65,
-      "src/main/rate-limits/claude-fetcher-keychain-credentials.test.ts": 100,
-      "src/main/rate-limits/claude-fetcher-managed-account-usage.test.ts": 50,
-      "src/main/rate-limits/claude-oauth-usage-error.test.ts": 44,
-      "src/main/rate-limits/claude-pty.test.ts": 64,
-      "src/main/rate-limits/claude-usage-error-classification.test.ts": 9,
-      "src/main/rate-limits/claude-usage-refresh-plan.test.ts": 7,
-      "src/main/rate-limits/codex-auth-presence.test.ts": 17,
-      "src/main/rate-limits/codex-fetcher-auth-errors.test.ts": 15,
-      "src/main/rate-limits/codex-fetcher-backend.test.ts": 76,
-      "src/main/rate-limits/codex-fetcher-probe-shutdown.test.ts": 38,
-      "src/main/rate-limits/codex-fetcher-process-contract.test.ts": 43,
-      "src/main/rate-limits/codex-fetcher-pty-settle.test.ts": 38,
-      "src/main/rate-limits/codex-fetcher-rpc-exit-diagnostics.test.ts": 175,
-      "src/main/rate-limits/codex-fetcher-runtime-pairing.test.ts": 17,
-      "src/main/rate-limits/codex-fetcher-session-supplement.test.ts": 20,
-      "src/main/rate-limits/codex-fetcher.test.ts": 86,
-      "src/main/rate-limits/codex-probe-termination.test.ts": 16,
-      "src/main/rate-limits/codex-pty-rate-limit-probe.test.ts": 10,
-      "src/main/rate-limits/codex-pty-status-parser.test.ts": 7,
-      "src/main/rate-limits/codex-rate-limit-window-classification.test.ts": 11,
-      "src/main/rate-limits/codex-rpc-rate-limit-probe.test.ts": 60,
-      "src/main/rate-limits/gemini-bucket-formatting.test.ts": 6,
-      "src/main/rate-limits/gemini-usage-fetcher.fallback.test.ts": 10,
-      "src/main/rate-limits/gemini-usage-fetcher.test.ts": 19,
-      "src/main/rate-limits/grok-auth.test.ts": 41,
-      "src/main/rate-limits/grok-fetcher.test.ts": 27,
-      "src/main/rate-limits/hidden-pty-cleanup.test.ts": 12,
-      "src/main/rate-limits/initial-account-rate-limit-target.test.ts": 14,
-      "src/main/rate-limits/kimi-fetcher-wsl-home.test.ts": 12,
-      "src/main/rate-limits/kimi-fetcher.test.ts": 34,
-      "src/main/rate-limits/minimax/minimax-fetcher.test.ts": 46,
-      "src/main/rate-limits/minimax/minimax-request-context.test.ts": 26,
-      "src/main/rate-limits/opencode-go-usage-fetcher.test.ts": 34,
-      "src/main/rate-limits/service-account-target-selection.test.ts": 142,
-      "src/main/rate-limits/service-antigravity-usage.test.ts": 11,
-      "src/main/rate-limits/service-inactive-account-previews.test.ts": 27,
-      "src/main/rate-limits/service-live-claude-usage.test.ts": 37,
-      "src/main/rate-limits/service-minimax-usage.test.ts": 17,
-      "src/main/rate-limits/service-refresh-orchestration.test.ts": 29,
-      "src/main/rate-limits/service-window-activation.test.ts": 22,
-      "src/main/refused-tree-kill-root-termination.test.ts": 24,
-      "src/main/remote-agent-trust-presets.test.ts": 13,
-      "src/main/remote-worktree-history-cleanup.test.ts": 12,
-      "src/main/repo-git-remote-identity-enrichment.test.ts": 22,
-      "src/main/repo-git-remote-identity.test.ts": 23,
-      "src/main/repo-git-username-enrichment.test.ts": 11,
-      "src/main/repo-icon-autodetect.test.ts": 242,
-      "src/main/repo-icon-file-detection.test.ts": 70,
-      "src/main/repo-icon-source-href.test.ts": 73,
-      "src/main/repo-maintenance-idle-gate.test.ts": 5,
-      "src/main/repo-worktrees.test.ts": 20,
-      "src/main/runtime/agent-prompt-receipt-correlation.test.ts": 65,
-      "src/main/runtime/agent-prompt-request-correlation.test.ts": 9,
-      "src/main/runtime/agent-prompt-submission-runtime.test.ts": 1762,
-      "src/main/runtime/agent-prompt-submission-verification.test.ts": 125,
-      "src/main/runtime/agent-prompt-submission-windows-submit-delay.test.ts": 192,
-      "src/main/runtime/agent-session-backup-recovery.test.ts": 116,
-      "src/main/runtime/agent-session-claim-identity.test.ts": 12,
-      "src/main/runtime/agent-session-conversation-name-store.test.ts": 76,
-      "src/main/runtime/agent-session-eviction-settlement-latch.test.ts": 9,
-      "src/main/runtime/agent-session-handoff-lease-transitions.test.ts": 8,
-      "src/main/runtime/agent-session-launch-env-admission.test.ts": 165,
-      "src/main/runtime/agent-session-launch-env-backfill.test.ts": 40,
-      "src/main/runtime/agent-session-lease-renewal.test.ts": 221,
-      "src/main/runtime/agent-session-orphan-child-reaper.test.ts": 12,
-      "src/main/runtime/agent-session-process-identity-probe-windows-batch.test.ts": 5,
-      "src/main/runtime/agent-session-process-identity-probe.test.ts": 17,
-      "src/main/runtime/agent-session-provider-handle-transition.test.ts": 7,
-      "src/main/runtime/agent-session-pty-write-enforcement.test.ts": 2113,
-      "src/main/runtime/agent-session-pty-write-gate.test.ts": 15,
-      "src/main/runtime/agent-session-record-conversation-name.test.ts": 14,
-      "src/main/runtime/agent-session-record-options.test.ts": 33,
-      "src/main/runtime/agent-session-record-store-security.test.ts": 23,
-      "src/main/runtime/agent-session-record-store.test.ts": 744,
-      "src/main/runtime/agent-session-record-unsupported-schema.test.ts": 26,
-      "src/main/runtime/agent-session-recovery-publish-fault.test.ts": 25,
-      "src/main/runtime/agent-session-reservation-admission.test.ts": 9,
-      "src/main/runtime/agent-session-restart-handoff-adjudication.test.ts": 13,
-      "src/main/runtime/agent-session-resume-args.test.ts": 5,
-      "src/main/runtime/agent-session-spawn-token-process-scan.test.ts": 8,
-      "src/main/runtime/agent-session-spawn-token-readback.test.ts": 9,
-      "src/main/runtime/agent-session-unreadable-record-salvage.test.ts": 68,
-      "src/main/runtime/agent-terminal-launch-trust-host.test.ts": 27,
-      "src/main/runtime/antigravity-readiness-transcripts.test.ts": 9380,
-      "src/main/runtime/automation-change-publication.test.ts": 4436,
-      "src/main/runtime/browser-client-download-transfers.test.ts": 80,
-      "src/main/runtime/browser-execution-host-key-resolution.test.ts": 25,
-      "src/main/runtime/browser-host-capability-selection.test.ts": 12,
-      "src/main/runtime/browser-host-client-page-adoption-grants.test.ts": 9,
-      "src/main/runtime/browser-host-client-page-adoption.test.ts": 9,
-      "src/main/runtime/browser-host-client-page-creation.test.ts": 28,
-      "src/main/runtime/browser-host-command-ledger-capacity.test.ts": 14,
-      "src/main/runtime/browser-host-command-ledger.test.ts": 30,
-      "src/main/runtime/browser-host-file-channel-admission.test.ts": 7,
-      "src/main/runtime/browser-host-lease-download-transfer-cleanup.test.ts": 114,
-      "src/main/runtime/browser-host-lease-fenced-page-release.test.ts": 30,
-      "src/main/runtime/browser-host-lease-placement-retirement.test.ts": 33,
-      "src/main/runtime/browser-host-lease-registry.test.ts": 47,
-      "src/main/runtime/browser-host-page-placement-replacement.test.ts": 11,
-      "src/main/runtime/browser-host-page-placement.test.ts": 16,
-      "src/main/runtime/browser-host-page-reconciliation-executor.test.ts": 44,
-      "src/main/runtime/browser-host-page-reconciliation-orchestration.test.ts": 245,
-      "src/main/runtime/browser-host-page-reconciliation-plan.test.ts": 22,
-      "src/main/runtime/browser-host-page-reconciliation-preconditions.test.ts": 7,
-      "src/main/runtime/browser-host-page-retirement.test.ts": 9,
-      "src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts": 411,
-      "src/main/runtime/browser-screencast-driver-attribution.test.ts": 503,
-      "src/main/runtime/browser-screencast-driver-scope.test.ts": 5,
-      "src/main/runtime/browser-screencast-ghost-subscriber-eviction.test.ts": 14,
-      "src/main/runtime/browser-screencast-remote-viewer-retention.test.ts": 379,
-      "src/main/runtime/browser-session-tab-selection-snapshot.test.ts": 12,
-      "src/main/runtime/browser-tab-create-caller-navigation.test.ts": 641,
-      "src/main/runtime/browser-tab-create-publication.test.ts": 998,
-      "src/main/runtime/claude-agent-teams-pty-exit-leak.test.ts": 23,
-      "src/main/runtime/claude-agent-teams-service.test.ts": 29,
-      "src/main/runtime/claude-agent-teams-shim-env.test.ts": 41,
-      "src/main/runtime/claude-structured-session-integration.test.ts": 943,
-      "src/main/runtime/cli-terminal-create-host-session-binding.test.ts": 22,
-      "src/main/runtime/client-hosted-browser-page-persistence.integration.test.ts": 39,
-      "src/main/runtime/client-hosted-browser-page-persistence.test.ts": 24,
-      "src/main/runtime/client-hosted-browser-row-hydration-census.test.ts": 427,
-      "src/main/runtime/client-hosted-browser-row-projection.test.ts": 9,
-      "src/main/runtime/client-hosted-browser-row-publication.test.ts": 30,
-      "src/main/runtime/client-hosted-browser-row-push.integration.test.ts": 41,
-      "src/main/runtime/client-hosted-page-reconciliation-hold.integration.test.ts": 16,
-      "src/main/runtime/client-hosted-page-reconciliation-window.test.ts": 23,
-      "src/main/runtime/client-session-tab-selection.test.ts": 11,
-      "src/main/runtime/decorative-title-fact-emission.test.ts": 4,
-      "src/main/runtime/exit-provenance-audit.test.ts": 394,
-      "src/main/runtime/expired-ssh-lease-pane-candidacy.test.ts": 22,
-      "src/main/runtime/external-worktree-paired-client-discovery.integration.test.ts": 203,
-      "src/main/runtime/fetch-remote-cache.test.ts": 271,
-      "src/main/runtime/file-watcher-host.test.ts": 600,
-      "src/main/runtime/fit-override-integration.test.ts": 56,
-      "src/main/runtime/folder-workspace-pty-identity.test.ts": 54,
-      "src/main/runtime/graph-sync-deletion-fence.test.ts": 43,
-      "src/main/runtime/graph-sync-live-daemon-pty-tab-preservation.test.ts": 95,
-      "src/main/runtime/graph-sync-mobile-snapshot-gating.test.ts": 94,
-      "src/main/runtime/graph-sync-payload-partition.test.ts": 33,
-      "src/main/runtime/headless-tab-group-split-layout.test.ts": 15,
-      "src/main/runtime/headless-tab-order-stability.test.ts": 29,
-      "src/main/runtime/headless-terminal-dispose-write-ordering.test.ts": 25,
-      "src/main/runtime/headless-terminal-query-reply-policy.test.ts": 4,
-      "src/main/runtime/headless-terminal-split-layout.test.ts": 9,
-      "src/main/runtime/hidden-output-restored-provider-snapshot.test.ts": 74,
-      "src/main/runtime/host-terminal-close-persistence-durability.test.ts": 59,
-      "src/main/runtime/linear-save-issue.test.ts": 34,
-      "src/main/runtime/managed-worktree-create-execution-host.test.ts": 24,
-      "src/main/runtime/missing-worktree-terminal-reconciliation.test.ts": 14,
-      "src/main/runtime/mobile-agent-status-permission-renewal.test.ts": 34,
-      "src/main/runtime/mobile-notification-dismissal-read-failure.test.ts": 4,
-      "src/main/runtime/mobile-notification-dismissal-store.test.ts": 12,
-      "src/main/runtime/mobile-notification-replay.test.ts": 11,
-      "src/main/runtime/mobile-pairing-qr.test.ts": 1086,
-      "src/main/runtime/mobile-pairing-userdata-path.test.ts": 1112,
-      "src/main/runtime/mobile-presence-lock.test.ts": 230,
-      "src/main/runtime/mobile-rpc-allowlist.test.ts": 84,
-      "src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts": 21,
-      "src/main/runtime/mobile-session-tabs-churn-coalescing.test.ts": 26,
-      "src/main/runtime/mobile-session-tabs-notify-coalescer.test.ts": 17,
-      "src/main/runtime/mobile-session-terminal-persistence-retirement.test.ts": 19,
-      "src/main/runtime/mobile-session-terminal-retirement-proof.test.ts": 5,
-      "src/main/runtime/mobile-session-terminal-retirement.test.ts": 12,
-      "src/main/runtime/mobile-subscribe-integration.test.ts": 303,
-      "src/main/runtime/multi-client-navigation-isolation.integration.test.ts": 551,
-      "src/main/runtime/opencode-finished-session-authority.test.ts": 356,
-      "src/main/runtime/orca-runtime-agent-session-operation.test.ts": 84,
-      "src/main/runtime/orca-runtime-agent-skill-share.test.ts": 224,
-      "src/main/runtime/orca-runtime-automations.test.ts": 35,
-      "src/main/runtime/orca-runtime-browser-client-hosted.test.ts": 778,
-      "src/main/runtime/orca-runtime-browser-ghost-session-row-close.test.ts": 416,
-      "src/main/runtime/orca-runtime-browser-headless.test.ts": 450,
-      "src/main/runtime/orca-runtime-browser-screencast-fanout.test.ts": 316,
-      "src/main/runtime/orca-runtime-browser.test.ts": 604,
-      "src/main/runtime/orca-runtime-create-base-prefetch.test.ts": 27,
-      "src/main/runtime/orca-runtime-emulator-folder-workspace.test.ts": 76,
-      "src/main/runtime/orca-runtime-exact-worker-provider-session.test.ts": 8,
-      "src/main/runtime/orca-runtime-files-mobile-explorer-reads.test.ts": 15,
-      "src/main/runtime/orca-runtime-files-preview-budget.test.ts": 104,
-      "src/main/runtime/orca-runtime-files-rename-authority.test.ts": 29,
-      "src/main/runtime/orca-runtime-files-search.test.ts": 25,
-      "src/main/runtime/orca-runtime-files-ssh-chunk-reads.test.ts": 68,
-      "src/main/runtime/orca-runtime-files-ssh-rearm.test.ts": 60,
-      "src/main/runtime/orca-runtime-files-terminal-artifact-grants.test.ts": 62,
-      "src/main/runtime/orca-runtime-files-terminal-artifact-io.test.ts": 99,
-      "src/main/runtime/orca-runtime-files-terminal-link-host-translation.test.ts": 30,
-      "src/main/runtime/orca-runtime-files-terminal-path-resolution.test.ts": 22,
-      "src/main/runtime/orca-runtime-files-watch-host-scope.test.ts": 15,
-      "src/main/runtime/orca-runtime-files-watch.test.ts": 106,
-      "src/main/runtime/orca-runtime-git-branch-diff.test.ts": 9,
-      "src/main/runtime/orca-runtime-git-diff-budget.test.ts": 25,
-      "src/main/runtime/orca-runtime-git.test.ts": 31,
-      "src/main/runtime/orca-runtime-headless-hydration-repo-gate.test.ts": 32,
-      "src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts": 297,
-      "src/main/runtime/orca-runtime-linked-issue-live-meta.integration.test.ts": 17,
-      "src/main/runtime/orca-runtime-mobile-agent-status-title-truthfulness.test.ts": 44,
-      "src/main/runtime/orca-runtime-mobile-close-preserved-resurrection.test.ts": 191,
-      "src/main/runtime/orca-runtime-module-size.test.ts": 20,
-      "src/main/runtime/orca-runtime-path-candidate-history.test.ts": 16,
-      "src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts": 27,
-      "src/main/runtime/orca-runtime-provider-reattach-launch-identity.test.ts": 21,
-      "src/main/runtime/orca-runtime-skill-recovery.test.ts": 20,
-      "src/main/runtime/orca-runtime-structured-agent-session-create-intent.test.ts": 21,
-      "src/main/runtime/orca-runtime-structured-agent-session-launch-args.test.ts": 20,
-      "src/main/runtime/orca-runtime-structured-claude-account-gate.test.ts": 17,
-      "src/main/runtime/orca-runtime-structured-claude-gate-wiring.test.ts": 19,
-      "src/main/runtime/orca-runtime-structured-native-chat-settings.test.ts": 13,
-      "src/main/runtime/orca-runtime-structured-session-restore.test.ts": 59,
-      "src/main/runtime/orca-runtime-structured-status-sink-wiring.test.ts": 26,
-      "src/main/runtime/orca-runtime-structured-tui-tab-binding.test.ts": 302,
-      "src/main/runtime/orca-runtime-tab-id-collision.test.ts": 18,
-      "src/main/runtime/orca-runtime-tail-wait-memo.test.ts": 89,
-      "src/main/runtime/orca-runtime-terminal-close-continuity.test.ts": 231,
-      "src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts": 77,
-      "src/main/runtime/orca-runtime-terminal-cwd.test.ts": 62,
-      "src/main/runtime/orca-runtime-terminal-handle-incarnation.test.ts": 78,
-      "src/main/runtime/orca-runtime-terminal-retirement-host-partition.test.ts": 54,
-      "src/main/runtime/orca-runtime-terminal-retirement.test.ts": 255,
-      "src/main/runtime/orca-runtime-terminal-split-authority.test.ts": 384,
-      "src/main/runtime/orca-runtime-test-fragment-coverage.test.ts": 5,
-      "src/main/runtime/orca-runtime.test.ts": 12320,
-      "src/main/runtime/orchestration-codex-completion-title.test.ts": 664,
-      "src/main/runtime/orchestration-compatibility-authority.test.ts": 42,
-      "src/main/runtime/orchestration-dispatch-mailbox-delivery.test.ts": 190,
-      "src/main/runtime/orchestration-mailbox-cold-park-idle.test.ts": 119,
-      "src/main/runtime/orchestration-mailbox-crash-recovery.test.ts": 155,
-      "src/main/runtime/orchestration-mailbox-detached-routing.test.ts": 534,
-      "src/main/runtime/orchestration-mailbox-filtered-waiters.test.ts": 270,
-      "src/main/runtime/orchestration-mailbox-notification-consistency.test.ts": 1187,
-      "src/main/runtime/orchestration-mailbox-pointer-cli-command.test.ts": 107,
-      "src/main/runtime/orchestration-mailbox-pty-write-gate.test.ts": 162,
-      "src/main/runtime/orchestration-mailbox-routing-races.test.ts": 642,
-      "src/main/runtime/orchestration-mailbox-transport-settlement.test.ts": 224,
-      "src/main/runtime/orchestration-message-delivery-identity.test.ts": 244,
-      "src/main/runtime/orchestration-messages-fake-parity.test.ts": 55,
-      "src/main/runtime/orchestration-structured-chat-lease.test.ts": 8461,
-      "src/main/runtime/orchestration-worker-workspace-resolution.test.ts": 57,
-      "src/main/runtime/orchestration/adopted-structured-pointer-delivery.test.ts": 13,
-      "src/main/runtime/orchestration/cli-command.test.ts": 7,
-      "src/main/runtime/orchestration/coordinator-decision-gates.test.ts": 62,
-      "src/main/runtime/orchestration/coordinator-dispatch-unobserved-prompt.test.ts": 59,
-      "src/main/runtime/orchestration/coordinator-drift-probe-coalescing.test.ts": 186,
-      "src/main/runtime/orchestration/coordinator-escalation-triage.test.ts": 28,
-      "src/main/runtime/orchestration/coordinator-stale-base-flag.test.ts": 9,
-      "src/main/runtime/orchestration/coordinator.test.ts": 3333,
-      "src/main/runtime/orchestration/db-empty-dispatch-shortcircuit.benchmark.test.ts": 64,
-      "src/main/runtime/orchestration/db-heartbeat-straggler-guard.test.ts": 31,
-      "src/main/runtime/orchestration/db-message-timestamp.test.ts": 18,
-      "src/main/runtime/orchestration/db-messages.test.ts": 115,
-      "src/main/runtime/orchestration/db-stopping-worker-task-guard.test.ts": 97,
-      "src/main/runtime/orchestration/db-task-create-readiness.test.ts": 174,
-      "src/main/runtime/orchestration/db-task-dispatch-invariant.test.ts": 521,
-      "src/main/runtime/orchestration/db-task-dispatch-lifecycle-guards.test.ts": 716,
-      "src/main/runtime/orchestration/db-task-dispatch-races.test.ts": 172,
-      "src/main/runtime/orchestration/db-undelivered-mailboxes.test.ts": 44,
-      "src/main/runtime/orchestration/db.test.ts": 836,
-      "src/main/runtime/orchestration/db/attempt-outcome-projection.test.ts": 285,
-      "src/main/runtime/orchestration/db/decision-gate-lifecycle.test.ts": 46,
-      "src/main/runtime/orchestration/db/dispatch-context/dispatch-capability.test.ts": 51,
-      "src/main/runtime/orchestration/db/dispatch-depth.test.ts": 320,
-      "src/main/runtime/orchestration/db/dispatch-mailbox-consumer-fencing.test.ts": 107,
-      "src/main/runtime/orchestration/db/dispatch-row-writer-boundary.test.ts": 587,
-      "src/main/runtime/orchestration/db/federated-worker-report-outcome.test.ts": 8,
-      "src/main/runtime/orchestration/db/federation/federated-dispatch-observation-fence.test.ts": 28,
-      "src/main/runtime/orchestration/db/federation/remote-dispatch-attachment-release.test.ts": 75,
-      "src/main/runtime/orchestration/db/hot-path-statement-compilation.test.ts": 74,
-      "src/main/runtime/orchestration/db/legacy-question-identity.test.ts": 7,
-      "src/main/runtime/orchestration/db/lifecycle-rejection-marker.test.ts": 8,
-      "src/main/runtime/orchestration/db/lifecycle-transition-boundary.test.ts": 6,
-      "src/main/runtime/orchestration/db/lifecycle-transition.test.ts": 76,
-      "src/main/runtime/orchestration/db/pane-key-match.test.ts": 5,
-      "src/main/runtime/orchestration/db/row-column-lists.test.ts": 72,
-      "src/main/runtime/orchestration/db/run-list-cursor.test.ts": 5,
-      "src/main/runtime/orchestration/db/schema/federated-home-run-migration.test.ts": 128,
-      "src/main/runtime/orchestration/db/schema/structured-pointer-schema-migration.test.ts": 60,
-      "src/main/runtime/orchestration/db/writer-run-required.test.ts": 54,
-      "src/main/runtime/orchestration/dispatch-consumer-generation-migration.test.ts": 143,
-      "src/main/runtime/orchestration/dispatch-creator-identity-migration.test.ts": 416,
-      "src/main/runtime/orchestration/dispatch-failure-idempotency.test.ts": 48,
-      "src/main/runtime/orchestration/federation-ack-checkpoints.test.ts": 6,
-      "src/main/runtime/orchestration/federation-acknowledgment-integrity.test.ts": 74,
-      "src/main/runtime/orchestration/federation-acknowledgment-migration.test.ts": 67,
-      "src/main/runtime/orchestration/federation-lifecycle-settlement.test.ts": 4,
-      "src/main/runtime/orchestration/federation-sync.test.ts": 196,
-      "src/main/runtime/orchestration/federation-terminal-recovery.test.ts": 31,
-      "src/main/runtime/orchestration/formatter.test.ts": 10,
-      "src/main/runtime/orchestration/groups.test.ts": 8,
-      "src/main/runtime/orchestration/lifecycle-caller-edges.test.ts": 76,
-      "src/main/runtime/orchestration/lifecycle-reconciliation.test.ts": 237,
-      "src/main/runtime/orchestration/lightweight-run-worker-exit-escalation.test.ts": 182,
-      "src/main/runtime/orchestration/mailbox-pointer-eligibility.test.ts": 67,
-      "src/main/runtime/orchestration/mailbox-pointer-release-query.test.ts": 120,
-      "src/main/runtime/orchestration/mailbox-pointer-stage.test.ts": 129,
-      "src/main/runtime/orchestration/mailbox-pointer-submit.test.ts": 447,
-      "src/main/runtime/orchestration/message-batch-atomicity.test.ts": 107,
-      "src/main/runtime/orchestration/mutation-receipt-capacity.test.ts": 155,
-      "src/main/runtime/orchestration/nested-worker-depth-migration.test.ts": 233,
-      "src/main/runtime/orchestration/orchestration-adopted-run-binding.test.ts": 643,
-      "src/main/runtime/orchestration/orchestration-all-start-versions-migration.test.ts": 1759,
-      "src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts": 517,
-      "src/main/runtime/orchestration/orchestration-db-permissions.test.ts": 37,
-      "src/main/runtime/orchestration/orchestration-db-retention-pagination.test.ts": 408,
-      "src/main/runtime/orchestration/orchestration-federated-legacy-probe.test.ts": 309,
-      "src/main/runtime/orchestration/orchestration-legacy-coordinator-authority-db.test.ts": 371,
-      "src/main/runtime/orchestration/orchestration-legacy-question-migration-db.test.ts": 445,
-      "src/main/runtime/orchestration/orchestration-legacy-storage-db.test.ts": 1251,
-      "src/main/runtime/orchestration/orchestration-legacy-worker-terminal-recovery.test.ts": 6,
-      "src/main/runtime/orchestration/orchestration-mutation-question-db.test.ts": 75,
-      "src/main/runtime/orchestration/orchestration-peer-capability-cache.test.ts": 11,
-      "src/main/runtime/orchestration/orchestration-reset-db.test.ts": 84,
-      "src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts": 184,
-      "src/main/runtime/orchestration/orchestration-run-list-compatibility.test.ts": 32,
-      "src/main/runtime/orchestration/orchestration-version-skew-migration.test.ts": 539,
-      "src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts": 352,
-      "src/main/runtime/orchestration/preamble.test.ts": 75,
-      "src/main/runtime/orchestration/r1-identity-migration.test.ts": 109,
-      "src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts": 148,
-      "src/main/runtime/orchestration/settled-question-threads-migration.test.ts": 51,
-      "src/main/runtime/orchestration/setup-completion-signal.test.ts": 10,
-      "src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts": 44,
-      "src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts": 14,
-      "src/main/runtime/orchestration/structured-pointer-operation-id.test.ts": 13,
-      "src/main/runtime/orchestration/structured-session-pointer-delivery.test.ts": 14,
-      "src/main/runtime/orchestration/structured-worker-direct-mailbox-target.test.ts": 9,
-      "src/main/runtime/orchestration/structured-worker-group-addressing.test.ts": 17,
-      "src/main/runtime/orchestration/structured-worker-journal-archive.test.ts": 32,
-      "src/main/runtime/orchestration/task-deps-flag.test.ts": 15,
-      "src/main/runtime/orchestration/worker-attention-context.test.ts": 10,
-      "src/main/runtime/orchestration/worker-output-archive-bounding.test.ts": 58,
-      "src/main/runtime/orchestration/worker-output-archive.test.ts": 18,
-      "src/main/runtime/orchestration/worker-output-cursor.test.ts": 8,
-      "src/main/runtime/orchestration/worker-provider-session.test.ts": 7,
-      "src/main/runtime/orchestration/worker-start-unobserved-prompt-settlement.test.ts": 63,
-      "src/main/runtime/orchestration/worker-transcript-payload.test.ts": 15,
-      "src/main/runtime/orchestration/worker-transcript-read.test.ts": 58,
-      "src/main/runtime/orchestration/worker-transcript-remote-read.test.ts": 60,
-      "src/main/runtime/pairing-endpoint.test.ts": 24,
-      "src/main/runtime/pty-exit-agent-status-reconciliation.test.ts": 35,
-      "src/main/runtime/pty-exit-per-pty-map-reaper-ratchet.test.ts": 13,
-      "src/main/runtime/pty-inventory-liveness-verdict.test.ts": 58,
-      "src/main/runtime/pty-inventory-partial-relay-liveness.test.ts": 31,
-      "src/main/runtime/pty-shell-ownership-mirror.test.ts": 1507,
-      "src/main/runtime/pty-transcript-prune-wait-cache.test.ts": 24,
-      "src/main/runtime/pty-waiver-source-invariant.test.ts": 9,
-      "src/main/runtime/public-ssh-state.test.ts": 7,
-      "src/main/runtime/push/desktop-push-service-unreadable-outbox.test.ts": 32,
-      "src/main/runtime/push/desktop-push-service.test.ts": 79,
-      "src/main/runtime/push/push-agent-state.test.ts": 9,
-      "src/main/runtime/push/push-cleanup-auth-expiry.test.ts": 50,
-      "src/main/runtime/push/push-delivery-policy.test.ts": 9,
-      "src/main/runtime/push/push-device-registration-persistence.test.ts": 20,
-      "src/main/runtime/push/push-dispatcher.test.ts": 13,
-      "src/main/runtime/push/push-gateway-client.test.ts": 149,
-      "src/main/runtime/push/push-gateway-session.test.ts": 136,
-      "src/main/runtime/push/push-host-proof-vector.test.ts": 19,
-      "src/main/runtime/push/push-host-proof.test.ts": 100,
-      "src/main/runtime/push/push-outcome-counters.test.ts": 6,
-      "src/main/runtime/push/push-policy-pipeline.integration.test.ts": 38,
-      "src/main/runtime/push/push-preferences.test.ts": 10,
-      "src/main/runtime/push/push-registration-races.test.ts": 65,
-      "src/main/runtime/push/push-registration-rpc.test.ts": 45,
-      "src/main/runtime/push/push-unpair-persistence.test.ts": 37,
-      "src/main/runtime/push/push-unregister-outbox.test.ts": 12,
-      "src/main/runtime/quarter-circle-title-send-authorization.test.ts": 16463,
-      "src/main/runtime/recent-pty-output-buffer.test.ts": 63,
-      "src/main/runtime/relay/desktop-relay-service-broker-liveness.test.ts": 10,
-      "src/main/runtime/relay/desktop-relay-service.test.ts": 12,
-      "src/main/runtime/relay/mobile-relay-e2ee.integration.test.ts": 83,
-      "src/main/runtime/relay/relay-auth-coordinator-recovery.test.ts": 18,
-      "src/main/runtime/relay/relay-auth-coordinator.test.ts": 1169,
-      "src/main/runtime/relay/relay-auth-host-close-reason.test.ts": 67,
-      "src/main/runtime/relay/relay-control-client.test.ts": 287,
-      "src/main/runtime/relay/relay-control-close-reason.test.ts": 40,
-      "src/main/runtime/relay/relay-control-origin.test.ts": 22,
-      "src/main/runtime/relay/relay-control-request-retirement.test.ts": 23,
-      "src/main/runtime/relay/relay-demand-ledger.test.ts": 12,
-      "src/main/runtime/relay/relay-host-proof.test.ts": 40,
-      "src/main/runtime/relay/relay-http-client.test.ts": 86,
-      "src/main/runtime/relay/relay-region-correction.test.ts": 89,
-      "src/main/runtime/relay/relay-region-preference.test.ts": 90,
-      "src/main/runtime/relay/relay-region-probe-log.test.ts": 79,
-      "src/main/runtime/relay/relay-region-refresh.test.ts": 17,
-      "src/main/runtime/relay/relay-renewal-jitter.test.ts": 506,
-      "src/main/runtime/relay/relay-revoke-outbox.test.ts": 13,
-      "src/main/runtime/relay/relay-session-broker.test.ts": 405,
-      "src/main/runtime/remote-agent-session-host-authority.integration.test.ts": 138,
-      "src/main/runtime/remote-browser-screencast-frame-admission.test.ts": 47,
-      "src/main/runtime/remote-desktop-driver.test.ts": 99,
-      "src/main/runtime/remote-runtime-close-intent.integration.test.ts": 90,
-      "src/main/runtime/remote-runtime-request-connection.integration.test.ts": 260,
-      "src/main/runtime/remote-server-updater.test.ts": 9,
-      "src/main/runtime/renderer-browser-session-reconciliation.test.ts": 11,
-      "src/main/runtime/repo-icon-fork-backfill.test.ts": 16,
-      "src/main/runtime/repo-worktree-admin-fingerprint.test.ts": 835,
-      "src/main/runtime/repo-worktree-resolution-scan.test.ts": 4,
-      "src/main/runtime/repo-worktree-row-resolution.test.ts": 16,
-      "src/main/runtime/retained-tail-redraw-window.equivalence.test.ts": 329,
-      "src/main/runtime/rpc/core-typed-method-contract.test.ts": 9,
-      "src/main/runtime/rpc/dispatcher-browser-client-automation.test.ts": 23,
-      "src/main/runtime/rpc/dispatcher-computer-errors.test.ts": 20,
-      "src/main/runtime/rpc/dispatcher-feature-interactions.test.ts": 17,
-      "src/main/runtime/rpc/dispatcher-request-parsing.test.ts": 18,
-      "src/main/runtime/rpc/e2ee-channel-text-backpressure.test.ts": 55,
-      "src/main/runtime/rpc/e2ee-channel-v2.test.ts": 81,
-      "src/main/runtime/rpc/e2ee-channel.test.ts": 196,
-      "src/main/runtime/rpc/e2ee-crypto.test.ts": 41,
-      "src/main/runtime/rpc/e2ee-integration.test.ts": 57,
-      "src/main/runtime/rpc/errors.test.ts": 22,
-      "src/main/runtime/rpc/methods/accounts.test.ts": 21,
-      "src/main/runtime/rpc/methods/agent-hooks.test.ts": 12,
-      "src/main/runtime/rpc/methods/agent-session.test.ts": 38,
-      "src/main/runtime/rpc/methods/agent-skill-sharing-capability-grant.test.ts": 25,
-      "src/main/runtime/rpc/methods/ai-vault.test.ts": 156,
-      "src/main/runtime/rpc/methods/artifact-sharing-capability-grant.test.ts": 28,
-      "src/main/runtime/rpc/methods/artifacts.test.ts": 280,
-      "src/main/runtime/rpc/methods/automation-scoped-list-methods.test.ts": 31,
-      "src/main/runtime/rpc/methods/automations.test.ts": 45,
-      "src/main/runtime/rpc/methods/browser-client-host-attach-adoption.test.ts": 236,
-      "src/main/runtime/rpc/methods/browser-client-host-reconciliation.test.ts": 26,
-      "src/main/runtime/rpc/methods/browser-client-host.test.ts": 30,
-      "src/main/runtime/rpc/methods/browser-client-page-metadata.test.ts": 20,
-      "src/main/runtime/rpc/methods/browser-network-tunnel.test.ts": 233,
-      "src/main/runtime/rpc/methods/browser-tab-create-schema.test.ts": 12,
-      "src/main/runtime/rpc/methods/browser.test.ts": 58,
-      "src/main/runtime/rpc/methods/client-events.test.ts": 7,
-      "src/main/runtime/rpc/methods/client-native-chat-settings.test.ts": 22,
-      "src/main/runtime/rpc/methods/client-ui-pairing-local-fields.test.ts": 41,
-      "src/main/runtime/rpc/methods/client-ui-task-resume-state.test.ts": 26,
-      "src/main/runtime/rpc/methods/client-ui.test.ts": 96,
-      "src/main/runtime/rpc/methods/clipboard.test.ts": 44,
-      "src/main/runtime/rpc/methods/computer-actions.test.ts": 15,
-      "src/main/runtime/rpc/methods/computer.test.ts": 33,
-      "src/main/runtime/rpc/methods/diagnostics.test.ts": 8,
-      "src/main/runtime/rpc/methods/file-watch-event-batcher.test.ts": 26,
-      "src/main/runtime/rpc/methods/files-doc-preview.test.ts": 13,
-      "src/main/runtime/rpc/methods/files-list-all-page-size.test.ts": 17,
-      "src/main/runtime/rpc/methods/files-path-search.test.ts": 150,
-      "src/main/runtime/rpc/methods/files-preview-transport-budget.test.ts": 17,
-      "src/main/runtime/rpc/methods/files-terminal-path-resolution.test.ts": 20,
-      "src/main/runtime/rpc/methods/files-watch-cancellation.test.ts": 68,
-      "src/main/runtime/rpc/methods/files-watch-cleanup.test.ts": 64,
-      "src/main/runtime/rpc/methods/files.test.ts": 196,
-      "src/main/runtime/rpc/methods/git-diff-transport-budget.test.ts": 50,
-      "src/main/runtime/rpc/methods/git.test.ts": 72,
-      "src/main/runtime/rpc/methods/github-pr-refresh-reason.test.ts": 14,
-      "src/main/runtime/rpc/methods/github.test.ts": 65,
-      "src/main/runtime/rpc/methods/gitlab.test.ts": 58,
-      "src/main/runtime/rpc/methods/host-capabilities.test.ts": 10,
-      "src/main/runtime/rpc/methods/hosted-review.test.ts": 25,
-      "src/main/runtime/rpc/methods/jira.test.ts": 34,
-      "src/main/runtime/rpc/methods/linear-agent-access.test.ts": 77,
-      "src/main/runtime/rpc/methods/linear-agent-project-access.test.ts": 708,
-      "src/main/runtime/rpc/methods/linear.test.ts": 47,
-      "src/main/runtime/rpc/methods/native-chat-rpc-block-sanitize.test.ts": 6,
-      "src/main/runtime/rpc/methods/native-chat.test.ts": 29,
-      "src/main/runtime/rpc/methods/notification-preferences.test.ts": 6,
-      "src/main/runtime/rpc/methods/notification-reconnect-cooldown.test.ts": 10,
-      "src/main/runtime/rpc/methods/orchestration-dispatch-error-codes.test.ts": 105,
-      "src/main/runtime/rpc/methods/orchestration-structured-worker-abandon.test.ts": 69,
-      "src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.test.ts": 14,
-      "src/main/runtime/rpc/methods/orchestration-structured-worker-redrive.test.ts": 88,
-      "src/main/runtime/rpc/methods/orchestration-structured-worker-session.test.ts": 16,
-      "src/main/runtime/rpc/methods/orchestration-structured-worker-start-failure.test.ts": 13,
-      "src/main/runtime/rpc/methods/orchestration-worker-mode-opacity.test.ts": 89,
-      "src/main/runtime/rpc/methods/orchestration-worker-start-mode-selection.test.ts": 188,
-      "src/main/runtime/rpc/methods/orchestration-worker-start-mode.test.ts": 9,
-      "src/main/runtime/rpc/methods/orchestration-worker-support-unknown.test.ts": 8,
-      "src/main/runtime/rpc/methods/orchestration/cli-runtime-boundary.test.ts": 96,
-      "src/main/runtime/rpc/methods/orchestration/federation/federated-attach-receipt.test.ts": 5,
-      "src/main/runtime/rpc/methods/orchestration/federation/federated-fleet-snapshot.test.ts": 30,
-      "src/main/runtime/rpc/methods/orchestration/federation/federated-message-targeting.test.ts": 68,
-      "src/main/runtime/rpc/methods/orchestration/federation/federated-release-safety.test.ts": 105,
-      "src/main/runtime/rpc/methods/orchestration/federation/federated-transport-safety.test.ts": 31,
-      "src/main/runtime/rpc/methods/orchestration/federation/federated-worker-start-receipt.test.ts": 50,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-agent-launch.test.ts": 60,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-control-mail.test.ts": 281,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-effects.test.ts": 4,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-folder-placement.test.ts": 35,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts": 1435,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-liveness-verdict.test.ts": 279,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-output.test.ts": 755,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-setup.test.ts": 129,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-start-prompt-budget.test.ts": 31,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-start-schema.test.ts": 11,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts": 1549,
-      "src/main/runtime/rpc/methods/orchestration/gates/gate-run-authorization.test.ts": 676,
-      "src/main/runtime/rpc/methods/orchestration/gates/gates.test.ts": 164,
-      "src/main/runtime/rpc/methods/orchestration/messaging/ask.test.ts": 430,
-      "src/main/runtime/rpc/methods/orchestration/messaging/check-superseded-terminal.test.ts": 136,
-      "src/main/runtime/rpc/methods/orchestration/messaging/check-worker-consumer-fencing.test.ts": 242,
-      "src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts": 453,
-      "src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts": 473,
-      "src/main/runtime/rpc/methods/orchestration/messaging/recipient-routing.test.ts": 238,
-      "src/main/runtime/rpc/methods/orchestration/messaging/send-dispatch-authority.test.ts": 138,
-      "src/main/runtime/rpc/methods/orchestration/messaging/send-group.test.ts": 387,
-      "src/main/runtime/rpc/methods/orchestration/messaging/send-invalid-type.test.ts": 55,
-      "src/main/runtime/rpc/methods/orchestration/messaging/send-receipt-plumbing.test.ts": 64,
-      "src/main/runtime/rpc/methods/orchestration/messaging/send-unbound-terminals.test.ts": 49,
-      "src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts": 570,
-      "src/main/runtime/rpc/methods/orchestration/messaging/settled-dispatch-mail.test.ts": 100,
-      "src/main/runtime/rpc/methods/orchestration/runs/migration-behavior.test.ts": 156,
-      "src/main/runtime/rpc/methods/orchestration/runs/run-receipt.test.ts": 7,
-      "src/main/runtime/rpc/methods/orchestration/runs/runs.test.ts": 329,
-      "src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts": 394,
-      "src/main/runtime/rpc/methods/orchestration/worker/agent-status-producer-census.test.ts": 1032,
-      "src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts": 364,
-      "src/main/runtime/rpc/methods/orchestration/worker/context-only-dispatch-retry.test.ts": 84,
-      "src/main/runtime/rpc/methods/orchestration/worker/fleet-status-observed-identity.test.ts": 15,
-      "src/main/runtime/rpc/methods/orchestration/worker/fleet-status-terminal-identity.test.ts": 9,
-      "src/main/runtime/rpc/methods/orchestration/worker/legacy-dispatch-projection.test.ts": 154,
-      "src/main/runtime/rpc/methods/orchestration/worker/manual-dispatch-observation.test.ts": 133,
-      "src/main/runtime/rpc/methods/orchestration/worker/manual-dispatch-release.test.ts": 105,
-      "src/main/runtime/rpc/methods/orchestration/worker/self-dispatch-nesting-depth.test.ts": 55,
-      "src/main/runtime/rpc/methods/orchestration/worker/structured-worker-launch-seed-options.test.ts": 10,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-interactive-wait.test.ts": 111,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-launch-preferences.test.ts": 32,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-list-pagination.test.ts": 215,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-list-run-scope-rpc.test.ts": 81,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-observation.test.ts": 16,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-output.test.ts": 36,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-read-projection.test.ts": 60,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-archive.test.ts": 213,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-inventory.test.ts": 285,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-liveness-verdict.test.ts": 17,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts": 283,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-ownership-guard.test.ts": 151,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts": 390,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts": 651,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-budgets.test.ts": 5,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-outcome-classification.test.ts": 8,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-budget.test.ts": 70,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts": 355,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-terminal-target.test.ts": 106,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-turn-observation.test.ts": 10,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-stop-capability.test.ts": 14,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-stop-exit-race.test.ts": 109,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-stop-liveness-verdict.test.ts": 136,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-terminal-custody-at-creation.test.ts": 505,
-      "src/main/runtime/rpc/methods/orchestration/worker/workers-new-worktree.test.ts": 735,
-      "src/main/runtime/rpc/methods/orchestration/worker/workers-recovery.test.ts": 238,
-      "src/main/runtime/rpc/methods/paired-caller-host-id.test.ts": 8,
-      "src/main/runtime/rpc/methods/pairing.test.ts": 29,
-      "src/main/runtime/rpc/methods/plugins.test.ts": 13,
-      "src/main/runtime/rpc/methods/preflight.test.ts": 14,
-      "src/main/runtime/rpc/methods/project-host-setup-self-host-stamp.test.ts": 16,
-      "src/main/runtime/rpc/methods/repo-badge-color.test.ts": 14,
-      "src/main/runtime/rpc/methods/repo.test.ts": 48,
-      "src/main/runtime/rpc/methods/runtime-client-capabilities.test.ts": 14,
-      "src/main/runtime/rpc/methods/session-tab-agent-capability-mutations.test.ts": 25,
-      "src/main/runtime/rpc/methods/session-tab-agent-status-projection.test.ts": 14,
-      "src/main/runtime/rpc/methods/session-tab-browser-placement-mutations.test.ts": 18,
-      "src/main/runtime/rpc/methods/session-tab-browser-placement-projection.test.ts": 14,
-      "src/main/runtime/rpc/methods/session-tabs-inventory-census-race.test.ts": 239,
-      "src/main/runtime/rpc/methods/session-tabs-inventory-rpc.test.ts": 41,
-      "src/main/runtime/rpc/methods/session-tabs-move-validation.test.ts": 41,
-      "src/main/runtime/rpc/methods/session-tabs-retirement-proof-delta.test.ts": 20,
-      "src/main/runtime/rpc/methods/session-tabs-schemas.test.ts": 18,
-      "src/main/runtime/rpc/methods/session-tabs-structured-restore.test.ts": 13,
-      "src/main/runtime/rpc/methods/session-tabs-unsubscribe.test.ts": 16,
-      "src/main/runtime/rpc/methods/session-tabs.test.ts": 37,
-      "src/main/runtime/rpc/methods/skills.test.ts": 26,
-      "src/main/runtime/rpc/methods/speech.test.ts": 20,
-      "src/main/runtime/rpc/methods/ssh.test.ts": 17,
-      "src/main/runtime/rpc/methods/structured-agent-session-admission.test.ts": 47,
-      "src/main/runtime/rpc/methods/structured-agent-session-adoption-replay.test.ts": 87,
-      "src/main/runtime/rpc/methods/structured-agent-session-background-task-capability.test.ts": 24,
-      "src/main/runtime/rpc/methods/structured-agent-session-hold.test.ts": 954,
-      "src/main/runtime/rpc/methods/structured-agent-session-policy.test.ts": 6,
-      "src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.test.ts": 23,
-      "src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.test.ts": 20,
-      "src/main/runtime/rpc/methods/structured-agent-session.test.ts": 127,
-      "src/main/runtime/rpc/methods/structured-worker-read-cursor.test.ts": 10,
-      "src/main/runtime/rpc/methods/structured-worker-stop-receipt.test.ts": 56,
-      "src/main/runtime/rpc/methods/structured-worker-tab-retirement.test.ts": 37,
-      "src/main/runtime/rpc/methods/terminal-create-idempotency.test.ts": 14,
-      "src/main/runtime/rpc/methods/terminal-legacy-stream-id-characterization.test.ts": 165,
-      "src/main/runtime/rpc/methods/terminal-manifest-characterization.test.ts": 40,
-      "src/main/runtime/rpc/methods/terminal-navigation.test.ts": 15,
-      "src/main/runtime/rpc/methods/terminal-read-screen-cursor.test.ts": 10,
-      "src/main/runtime/rpc/methods/terminal-stream-extraction-characterization.test.ts": 20,
-      "src/main/runtime/rpc/methods/terminal/terminal-inspect-process-params.test.ts": 7,
-      "src/main/runtime/rpc/methods/updater.test.ts": 7,
-      "src/main/runtime/rpc/methods/workspace-cleanup-ui-schema.test.ts": 17,
-      "src/main/runtime/rpc/methods/workspace-ports.test.ts": 19,
-      "src/main/runtime/rpc/methods/worktree-catalog-snapshot-method.test.ts": 17,
-      "src/main/runtime/rpc/methods/worktree-create-args.test.ts": 14,
-      "src/main/runtime/rpc/methods/worktree-create-navigation.test.ts": 26,
-      "src/main/runtime/rpc/methods/worktree-github-pr-suppression.test.ts": 20,
-      "src/main/runtime/rpc/methods/worktree-missing-terminal-teardown.test.ts": 13,
-      "src/main/runtime/rpc/methods/worktree-retired-names.test.ts": 12,
-      "src/main/runtime/rpc/methods/worktree-rm-host-qualification.test.ts": 26,
-      "src/main/runtime/rpc/methods/worktree-rm-pty-waiver.test.ts": 10,
-      "src/main/runtime/rpc/methods/worktree-schemas.test.ts": 16,
-      "src/main/runtime/rpc/methods/worktree.test.ts": 70,
-      "src/main/runtime/rpc/mobile-auth-acl-critical-path.test.ts": 419,
-      "src/main/runtime/rpc/mobile-clipboard-image-provenance.test.ts": 25,
-      "src/main/runtime/rpc/mobile-e2ee-outbound-memory-budget.test.ts": 7,
-      "src/main/runtime/rpc/mobile-e2ee-v2-desktop-session.test.ts": 33,
-      "src/main/runtime/rpc/mobile-e2ee-v2-key-schedule.test.ts": 46,
-      "src/main/runtime/rpc/mobile-socket-wiring.test.ts": 117,
-      "src/main/runtime/rpc/orchestration-11745-regression-verification.test.ts": 1475,
-      "src/main/runtime/rpc/orchestration-commit-notify-characterization.test.ts": 326,
-      "src/main/runtime/rpc/orchestration-contract-fence.test.ts": 121,
-      "src/main/runtime/rpc/orchestration-current-authority-precedence.test.ts": 657,
-      "src/main/runtime/rpc/orchestration-legacy-compatibility-dispatcher.test.ts": 3011,
-      "src/main/runtime/rpc/orchestration-legacy-coordinator-race.test.ts": 963,
-      "src/main/runtime/rpc/orchestration-legacy-fence-jurisdiction.test.ts": 3247,
-      "src/main/runtime/rpc/orchestration-legacy-question-takeover.test.ts": 293,
-      "src/main/runtime/rpc/orchestration-legacy-run-routing.test.ts": 363,
-      "src/main/runtime/rpc/orchestration-legacy-takeover-current-authority.test.ts": 152,
-      "src/main/runtime/rpc/orchestration-legacy-takeover-delivery.test.ts": 199,
-      "src/main/runtime/rpc/orchestration-legacy-takeover-dispatcher.test.ts": 498,
-      "src/main/runtime/rpc/orchestration-mutation-executor.test.ts": 186,
-      "src/main/runtime/rpc/orchestration-mutation-ledger.test.ts": 304,
-      "src/main/runtime/rpc/orchestration-mutation-request-show-legacy.test.ts": 94,
-      "src/main/runtime/rpc/orchestration-mutation-request-show.test.ts": 158,
-      "src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts": 293,
-      "src/main/runtime/rpc/orchestration-task-dispatch-invariant.test.ts": 332,
-      "src/main/runtime/rpc/relay-transport.test.ts": 146,
-      "src/main/runtime/rpc/remote-runtime-server-heartbeat-missed-probe-tolerance.test.ts": 23,
-      "src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts": 9,
-      "src/main/runtime/rpc/runtime-client-capabilities.test.ts": 6,
-      "src/main/runtime/rpc/runtime-close-attribution-topology.test.ts": 33,
-      "src/main/runtime/rpc/runtime-close-attribution.test.ts": 19,
-      "src/main/runtime/rpc/schemas.test.ts": 38,
-      "src/main/runtime/rpc/streaming.test.ts": 16,
-      "src/main/runtime/rpc/terminal-agent-prompt-send.test.ts": 20,
-      "src/main/runtime/rpc/terminal-agent-send-guard.test.ts": 39,
-      "src/main/runtime/rpc/terminal-geometry-stale-handle.test.ts": 22,
-      "src/main/runtime/rpc/terminal-lease-stale-handle-survival.test.ts": 168,
-      "src/main/runtime/rpc/terminal-list-host-scope-transport.test.ts": 11,
-      "src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts": 563,
-      "src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts": 1720,
-      "src/main/runtime/rpc/terminal-multiplex-desktop-resize-routing.test.ts": 695,
-      "src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts": 328,
-      "src/main/runtime/rpc/terminal-multiplex-escape-tail.test.ts": 27,
-      "src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts": 22,
-      "src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts": 294,
-      "src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts": 809,
-      "src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts": 455,
-      "src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts": 446,
-      "src/main/runtime/rpc/terminal-multiplex-resync-replay-trim.test.ts": 16,
-      "src/main/runtime/rpc/terminal-multiplex-round-robin.test.ts": 6,
-      "src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts": 644,
-      "src/main/runtime/rpc/terminal-multiplex-source-range-admission.test.ts": 799,
-      "src/main/runtime/rpc/terminal-multiplex-subscribe-slot-recovery.test.ts": 177,
-      "src/main/runtime/rpc/terminal-opencode-send-guard.integration.test.ts": 42,
-      "src/main/runtime/rpc/terminal-output-batching.test.ts": 366,
-      "src/main/runtime/rpc/terminal-output-frame-chunks-equivalence.test.ts": 14856,
-      "src/main/runtime/rpc/terminal-output-frame-source-ranges.test.ts": 11,
-      "src/main/runtime/rpc/terminal-prompt-delivery-receipt.test.ts": 318,
-      "src/main/runtime/rpc/terminal-provider-snapshot-sequence.test.ts": 220,
-      "src/main/runtime/rpc/terminal-requested-snapshot-unavailability.test.ts": 531,
-      "src/main/runtime/rpc/terminal-send-agent-session-lease.test.ts": 27,
-      "src/main/runtime/rpc/terminal-send-launch-draft-resolution.test.ts": 18,
-      "src/main/runtime/rpc/terminal-send.test.ts": 284,
-      "src/main/runtime/rpc/terminal-source-range-ledger.test.ts": 11,
-      "src/main/runtime/rpc/terminal-stream-byte-length.test.ts": 5718,
-      "src/main/runtime/rpc/terminal-subscribe-blank-mount.test.ts": 66,
-      "src/main/runtime/rpc/terminal-subscribe-buffer.test.ts": 605,
-      "src/main/runtime/rpc/terminal-subscribe-lease-only.test.ts": 66,
-      "src/main/runtime/rpc/terminal-subscribe-mount-replay.test.ts": 226,
-      "src/main/runtime/rpc/terminal-subscribe-ownership.test.ts": 226,
-      "src/main/runtime/rpc/terminal-subscribe-reconnect-rebind.test.ts": 139,
-      "src/main/runtime/rpc/terminal-subscribe-relay-drop-lease-survival.test.ts": 178,
-      "src/main/runtime/rpc/terminal-subscribe-renderer-recovery-output.test.ts": 66,
-      "src/main/runtime/rpc/unix-socket-transport.test.ts": 8,
-      "src/main/runtime/rpc/unpaired-device-auth-throttle.test.ts": 9,
-      "src/main/runtime/rpc/worktree-catalog-snapshot.test.ts": 8,
-      "src/main/runtime/rpc/ws-fallback-port-store.test.ts": 4,
-      "src/main/runtime/rpc/ws-transport-accept-order.test.ts": 17,
-      "src/main/runtime/rpc/ws-transport-static-web.test.ts": 6055,
-      "src/main/runtime/rpc/ws-transport-transient-packet-loss.test.ts": 635,
-      "src/main/runtime/rpc/ws-transport.test.ts": 976,
-      "src/main/runtime/runtime-binary-message-router.test.ts": 4,
-      "src/main/runtime/runtime-browser-client-automation.test.ts": 19,
-      "src/main/runtime/runtime-browser-client-page-adoption.test.ts": 32,
-      "src/main/runtime/runtime-browser-client-page-creation.test.ts": 20,
-      "src/main/runtime/runtime-browser-client-page-recovery.test.ts": 28,
-      "src/main/runtime/runtime-browser-client-page-restored-recovery.test.ts": 14,
-      "src/main/runtime/runtime-browser-network-execution-host.test.ts": 7,
-      "src/main/runtime/runtime-browser-page-registry.test.ts": 13,
-      "src/main/runtime/runtime-client-settings-minimax-projection.test.ts": 7,
-      "src/main/runtime/runtime-extraction-regressions.test.ts": 20,
-      "src/main/runtime/runtime-file-target-connection-field-ratchet.test.ts": 11,
-      "src/main/runtime/runtime-file-target-execution-host.test.ts": 33,
-      "src/main/runtime/runtime-folder-workspace.test.ts": 10,
-      "src/main/runtime/runtime-git-api-contract.test.ts": 7,
-      "src/main/runtime/runtime-git-branch-compare-admission.test.ts": 7,
-      "src/main/runtime/runtime-git-command-target.test.ts": 8,
-      "src/main/runtime/runtime-git-conflict-operation-routing.test.ts": 11,
-      "src/main/runtime/runtime-git-execution-host-ownership.test.ts": 10,
-      "src/main/runtime/runtime-git-generation-admission.test.ts": 11,
-      "src/main/runtime/runtime-git-status-admission.test.ts": 14,
-      "src/main/runtime/runtime-git-sync-commands.test.ts": 10,
-      "src/main/runtime/runtime-git-target-execution-host.test.ts": 33,
-      "src/main/runtime/runtime-graph-reload-lifecycle.test.ts": 10,
-      "src/main/runtime/runtime-hook-agent-row-selection.test.ts": 11,
-      "src/main/runtime/runtime-linear-read-commands.test.ts": 9,
-      "src/main/runtime/runtime-local-worktree-materialization.test.ts": 7,
-      "src/main/runtime/runtime-local-worktree-terminal-startup.test.ts": 6,
-      "src/main/runtime/runtime-managed-worktree-metadata-sweep.test.ts": 29,
-      "src/main/runtime/runtime-managed-worktree-metadata.test.ts": 7,
-      "src/main/runtime/runtime-managed-worktree-queries.test.ts": 22,
-      "src/main/runtime/runtime-metadata-ownership-watch.test.ts": 32,
-      "src/main/runtime/runtime-metadata.test.ts": 38,
-      "src/main/runtime/runtime-mobile-agent-status-builder.test.ts": 5,
-      "src/main/runtime/runtime-mobile-file-path-search.test.ts": 15,
-      "src/main/runtime/runtime-owned-terminal-publication-lineage.test.ts": 28,
-      "src/main/runtime/runtime-project-group-controller-folder-delete.test.ts": 7,
-      "src/main/runtime/runtime-project-host-setup-controller.test.ts": 16,
-      "src/main/runtime/runtime-remote-fetch-ref-maintenance.test.ts": 63,
-      "src/main/runtime/runtime-remove-project-host-scope.test.ts": 23,
-      "src/main/runtime/runtime-resolved-worktree-cache.test.ts": 6,
-      "src/main/runtime/runtime-rpc-browser-host-admission.test.ts": 31,
-      "src/main/runtime/runtime-rpc-device-revocation.test.ts": 99,
-      "src/main/runtime/runtime-rpc-long-poll-transport.test.ts": 1931,
-      "src/main/runtime/runtime-rpc-metadata-lifecycle.test.ts": 29,
-      "src/main/runtime/runtime-rpc-mobile-method-allowlist.test.ts": 53,
-      "src/main/runtime/runtime-rpc-mobile-native-chat-settings.test.ts": 5,
-      "src/main/runtime/runtime-rpc-mobile-terminal-streaming.test.ts": 575,
-      "src/main/runtime/runtime-rpc-orchestration-db-migration.test.ts": 56,
-      "src/main/runtime/runtime-rpc-pairing-mode-persistence.test.ts": 139,
-      "src/main/runtime/runtime-rpc-pairing-offer.test.ts": 71,
-      "src/main/runtime/runtime-rpc-relay-pairing.test.ts": 431,
-      "src/main/runtime/runtime-rpc-request-authorization.test.ts": 83,
-      "src/main/runtime/runtime-rpc-startup-failure.test.ts": 19,
-      "src/main/runtime/runtime-rpc-terminal-list.test.ts": 641,
-      "src/main/runtime/runtime-rpc-websocket-bind-host.test.ts": 104,
-      "src/main/runtime/runtime-rpc-websocket-long-poll-caps.test.ts": 67,
-      "src/main/runtime/runtime-rpc-worktree-queries.test.ts": 73,
-      "src/main/runtime/runtime-search-line-fragments.test.ts": 9,
-      "src/main/runtime/runtime-skill-install-authority.test.ts": 4,
-      "src/main/runtime/runtime-skill-install-commands.test.ts": 8,
-      "src/main/runtime/runtime-skill-install-queries.test.ts": 15,
-      "src/main/runtime/runtime-socket-sweep.test.ts": 8,
-      "src/main/runtime/runtime-terminal-idle-polls.test.ts": 14,
-      "src/main/runtime/runtime-terminal-orphan-topology-validation.test.ts": 17,
-      "src/main/runtime/runtime-terminal-spawn-push-target-materialization.test.ts": 9,
-      "src/main/runtime/runtime-worktree-agent-rows-structured.test.ts": 13,
-      "src/main/runtime/runtime-worktree-agent-sources.test.ts": 8,
-      "src/main/runtime/runtime-worktree-agent-startup.test.ts": 11,
-      "src/main/runtime/runtime-worktree-ps-summaries.test.ts": 7,
-      "src/main/runtime/runtime-worktree-selection.test.ts": 8,
-      "src/main/runtime/runtime-worktree-structured-agent-rows-liveness.test.ts": 87,
-      "src/main/runtime/saved-structured-agent-session-restoration.test.ts": 5,
-      "src/main/runtime/selected-review-branch.test.ts": 11,
-      "src/main/runtime/session-tabs-inventory-publication.test.ts": 47,
-      "src/main/runtime/settled-worker-process-replacement.test.ts": 96,
-      "src/main/runtime/structured-agent-session-close.test.ts": 10,
-      "src/main/runtime/structured-agent-session-integration-replay.test.ts": 400,
-      "src/main/runtime/structured-agent-session-integration.test.ts": 816,
-      "src/main/runtime/structured-agent-session-pty-binding.test.ts": 16,
-      "src/main/runtime/structured-agent-session-rollback-compatibility.test.ts": 39,
-      "src/main/runtime/structured-agent-session-runtime-exit.test.ts": 348,
-      "src/main/runtime/structured-agent-session-runtime.test.ts": 33,
-      "src/main/runtime/structured-agent-session-support-probe.test.ts": 25,
-      "src/main/runtime/structured-claude-auth-policy-wiring.test.ts": 8,
-      "src/main/runtime/structured-conversation-tab-replacement.test.ts": 6,
-      "src/main/runtime/structured-session-worktree-teardown.test.ts": 2436,
-      "src/main/runtime/structured-tui-exit-proof.test.ts": 14,
-      "src/main/runtime/structured-tui-idle-evidence.test.ts": 5,
-      "src/main/runtime/structured-tui-process-identity.test.ts": 26,
-      "src/main/runtime/structured-tui-recovery-claim-match.test.ts": 13,
-      "src/main/runtime/structured-worker-agent-presence.test.ts": 6,
-      "src/main/runtime/structured-worker-authority.test.ts": 7,
-      "src/main/runtime/structured-worker-child-identity-env.test.ts": 6,
-      "src/main/runtime/structured-worker-hook-attestation.test.ts": 7,
-      "src/main/runtime/structured-worker-identity.test.ts": 17,
-      "src/main/runtime/structured-worker-mail-routing.test.ts": 9,
-      "src/main/runtime/structured-worker-takeover-pane-key.test.ts": 6,
-      "src/main/runtime/structured-worker-terminal-read.test.ts": 14,
-      "src/main/runtime/structured-worker-terminal-refusal.test.ts": 8,
-      "src/main/runtime/terminal-ansi-pending-retention.test.ts": 464,
-      "src/main/runtime/terminal-focus-navigation-coalescer.test.ts": 21,
-      "src/main/runtime/terminal-identity-probe.test.ts": 8,
-      "src/main/runtime/terminal-interactive-wait-visibility.test.ts": 6198,
-      "src/main/runtime/terminal-leaf-tab-resolution.test.ts": 6,
-      "src/main/runtime/terminal-list-execution-host-scope.test.ts": 3128,
-      "src/main/runtime/terminal-list-payload-size.test.ts": 172,
-      "src/main/runtime/terminal-list-stale-leaf-liveness.test.ts": 42,
-      "src/main/runtime/terminal-mobile-subscribe-tab-mount.test.ts": 26,
-      "src/main/runtime/terminal-model-query-authority.test.ts": 9,
-      "src/main/runtime/terminal-orphan-owner.test.ts": 7,
-      "src/main/runtime/terminal-orphan-topology.test.ts": 12,
-      "src/main/runtime/terminal-pane-recovery-liveness-gate.test.ts": 46,
-      "src/main/runtime/terminal-projection.test.ts": 6,
-      "src/main/runtime/terminal-pty-exit-waiter.test.ts": 28,
-      "src/main/runtime/terminal-query-responder.test.ts": 178,
-      "src/main/runtime/terminal-restore-record-seed.test.ts": 69,
-      "src/main/runtime/terminal-retirement-proof-emitted-frame.test.ts": 23,
-      "src/main/runtime/terminal-retirement-proof-publication.test.ts": 77,
-      "src/main/runtime/terminal-send-stale-leaf-liveness.test.ts": 180,
-      "src/main/runtime/terminal-subscribe-exit-waiter-leak.test.ts": 24,
-      "src/main/runtime/terminal-subscriber-driven-daemon-attach.test.ts": 870,
-      "src/main/runtime/terminal-tail-buffer.test.ts": 5851,
-      "src/main/runtime/terminal-tail-row-retention.test.ts": 167,
-      "src/main/runtime/terminal-tail-sentinel-index.test.ts": 4042,
-      "src/main/runtime/terminal-tail-whitespace.test.ts": 11,
-      "src/main/runtime/terminal-vertical-control-scan.test.ts": 8,
-      "src/main/runtime/terminal-wait-detection.test.ts": 20,
-      "src/main/runtime/terminal-wait-results.test.ts": 6,
-      "src/main/runtime/wait-blocked-check-state.test.ts": 112,
-      "src/main/runtime/wait-blocked-keyword-carry-retention.test.ts": 12,
-      "src/main/runtime/windows-default-route-interfaces.test.ts": 9,
-      "src/main/runtime/windows-drive-listing.test.ts": 12,
-      "src/main/runtime/windows-firewall-remote-scope.test.ts": 19,
-      "src/main/runtime/windows-mobile-firewall.test.ts": 14,
-      "src/main/runtime/workspace-session-membership-scaling.test.ts": 13,
-      "src/main/runtime/worktree-launch-host-repo.test.ts": 10,
-      "src/main/runtime/worktree-list-host-scope.test.ts": 32,
-      "src/main/runtime/worktree-path-selector-wsl-posix.test.ts": 46,
-      "src/main/runtime/worktree-ps-degraded-repo-scan.test.ts": 94,
-      "src/main/runtime/worktree-ps-host-scope.test.ts": 40,
-      "src/main/runtime/worktree-rm-id-selector-path-spelling.test.ts": 47,
-      "src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts": 531,
-      "src/main/runtime/worktree-scan-execution-host-routing.test.ts": 33,
-      "src/main/runtime/worktree-teardown-unstopped-pty.test.ts": 204,
-      "src/main/runtime/worktree-teardown.test.ts": 235,
-      "src/main/runtime/worktree-terminal-mutation-lock.test.ts": 13,
-      "src/main/serve-update-handoff.app-environment.test.ts": 907,
-      "src/main/serve-update-handoff.test.ts": 8,
-      "src/main/server/serve-readiness.test.ts": 10,
-      "src/main/server/serve-stdout-boundary.test.ts": 8,
-      "src/main/shell-prompt-readiness-probe.test.ts": 28,
-      "src/main/shell-startup-identity-scanner.test.ts": 6,
-      "src/main/shell-startup-output-scanner.test.ts": 24,
-      "src/main/shell-wrapper-content-address.test.ts": 9,
-      "src/main/shell-wrapper-generated-file-snapshot.test.ts": 40,
-      "src/main/skills/agent-skill-selection.test.ts": 22,
-      "src/main/skills/claude-plugin-skill-sources-wsl.test.ts": 6,
-      "src/main/skills/claude-plugin-skill-sources.test.ts": 7,
-      "src/main/skills/discovery.test.ts": 108,
-      "src/main/skills/skill-bundle-artifacts.test.ts": 39,
-      "src/main/skills/skill-bundle-creation.test.ts": 628,
-      "src/main/skills/skill-bundle-install-service.test.ts": 196,
-      "src/main/skills/skill-bundle-observability-summary.test.ts": 4,
-      "src/main/skills/skill-bundle-ssh-relay-service.test.ts": 105,
-      "src/main/skills/skill-candidate-concurrency.test.ts": 29,
-      "src/main/skills/skill-client-mediated-transfer-cancellation.test.ts": 20,
-      "src/main/skills/skill-client-mediated-transfer.test.ts": 29,
-      "src/main/skills/skill-cloud-direct-upload.test.ts": 125,
-      "src/main/skills/skill-cloud-grant-installation.test.ts": 15,
-      "src/main/skills/skill-cloud-install-target.test.ts": 6,
-      "src/main/skills/skill-cloud-request.test.ts": 58,
-      "src/main/skills/skill-cloud-service.test.ts": 73,
-      "src/main/skills/skill-delete/plan.test.ts": 102,
-      "src/main/skills/skill-delete/recovery.test.ts": 86,
-      "src/main/skills/skill-delete/service.test.ts": 618,
-      "src/main/skills/skill-delete/staging-visibility.test.ts": 21,
-      "src/main/skills/skill-delete/wsl-enumeration-protocol.test.ts": 12,
-      "src/main/skills/skill-discovery-concurrency.test.ts": 88,
-      "src/main/skills/skill-discovery-order.test.ts": 286,
-      "src/main/skills/skill-discovery-target.test.ts": 21,
-      "src/main/skills/skill-discovery-wsl-plugins.test.ts": 22,
-      "src/main/skills/skill-discovery-wsl-script-roundtrip.test.ts": 49,
-      "src/main/skills/skill-discovery-wsl.test.ts": 40,
-      "src/main/skills/skill-freshness-eligibility.test.ts": 10,
-      "src/main/skills/skill-freshness-inventory-limits.test.ts": 6,
-      "src/main/skills/skill-freshness-inventory.test.ts": 2182,
-      "src/main/skills/skill-git-tree-identity.test.ts": 40,
-      "src/main/skills/skill-install-destinations.test.ts": 26,
-      "src/main/skills/skill-install-discovery-verification.test.ts": 17,
-      "src/main/skills/skill-install-lock-release.test.ts": 7,
-      "src/main/skills/skill-install-lock.test.ts": 241,
-      "src/main/skills/skill-install-management-service.test.ts": 39,
-      "src/main/skills/skill-install-provenance.test.ts": 19,
-      "src/main/skills/skill-install-recovery.test.ts": 304,
-      "src/main/skills/skill-install-request-service.test.ts": 299,
-      "src/main/skills/skill-install-service.test.ts": 944,
-      "src/main/skills/skill-install-transaction.test.ts": 949,
-      "src/main/skills/skill-operation-observability.test.ts": 92,
-      "src/main/skills/skill-package-creation.test.ts": 312,
-      "src/main/skills/skill-package-deterministic-gzip.test.ts": 527,
-      "src/main/skills/skill-package-download.test.ts": 107,
-      "src/main/skills/skill-package-identity.test.ts": 86,
-      "src/main/skills/skill-package-tar.test.ts": 259,
-      "src/main/skills/skill-placement-alias-repair.test.ts": 43,
-      "src/main/skills/skill-placement-copy-drift.test.ts": 38,
-      "src/main/skills/skill-placement-reconciliation.test.ts": 74,
-      "src/main/skills/skill-placement-transaction.test.ts": 97,
-      "src/main/skills/skill-plugin-cache-scan.test.ts": 599,
-      "src/main/skills/skill-provider-destinations.test.ts": 8,
-      "src/main/skills/skill-provider-runtime-roots.test.ts": 9,
-      "src/main/skills/skill-remote-error-category-parity.test.ts": 15,
-      "src/main/skills/skill-remote-install-cancellation.test.ts": 4,
-      "src/main/skills/skill-remote-install-service.test.ts": 32,
-      "src/main/skills/skill-remove-transaction.test.ts": 577,
-      "src/main/skills/skill-root-file-walk.test.ts": 27,
-      "src/main/skills/skill-runtime-capability.test.ts": 9,
-      "src/main/skills/skill-scan-coalescer.test.ts": 12,
-      "src/main/skills/skill-share-preparation-service.test.ts": 237,
-      "src/main/skills/skill-ssh-relay-service.test.ts": 61,
-      "src/main/skills/skill-transaction-startup-recovery.test.ts": 206,
-      "src/main/skills/skill-update-convergence.test.ts": 32,
-      "src/main/skills/skill-update-outcome.test.ts": 49,
-      "src/main/skills/skill-update-registration.test.ts": 14,
-      "src/main/skills/skill-update-run.test.ts": 28,
-      "src/main/skills/skill-upload-session-admission-regression.test.ts": 24,
-      "src/main/skills/skill-upload-session-service.test.ts": 157,
-      "src/main/skills/skill-wsl-install-filesystem.test.ts": 9,
-      "src/main/skills/skill-wsl-provider-detection.test.ts": 10,
-      "src/main/source-control/forge-provider.test.ts": 52,
-      "src/main/source-control/hosted-review-azure-devops.integration.test.ts": 153,
-      "src/main/source-control/hosted-review-base-ref-suffix.test.ts": 12,
-      "src/main/source-control/hosted-review-bitbucket.integration.test.ts": 368,
-      "src/main/source-control/hosted-review-branch-cache.test.ts": 186,
-      "src/main/source-control/hosted-review-creation-eligibility.test.ts": 26,
-      "src/main/source-control/hosted-review-creation-gitlab-self-hosted.test.ts": 14,
-      "src/main/source-control/hosted-review-creation-shared-symlinks.test.ts": 17,
-      "src/main/source-control/hosted-review-creation.test.ts": 29,
-      "src/main/source-control/hosted-review-dirty-preflight-wsl-paths.test.ts": 5,
-      "src/main/source-control/hosted-review-execution-host-routing.test.ts": 35,
-      "src/main/source-control/hosted-review-gitea.integration.test.ts": 321,
-      "src/main/source-control/hosted-review.test.ts": 14,
-      "src/main/source-control/pull-request-linked-issue.test.ts": 10,
-      "src/main/source-control/repo-default-branch.test.ts": 18,
-      "src/main/source-control/stacked-hosted-review-creation.test.ts": 7,
-      "src/main/speech/model-catalog.test.ts": 5,
-      "src/main/speech/model-manager-download-error.test.ts": 17,
-      "src/main/speech/model-manager-download-resume.test.ts": 3020,
-      "src/main/speech/model-manager-progress-callback.test.ts": 9,
-      "src/main/speech/model-manager-stream-cleanup.test.ts": 30,
-      "src/main/speech/model-manager-windows-path.test.ts": 584,
-      "src/main/speech/model-manager.test.ts": 45,
-      "src/main/speech/openai-api-key-store.test.ts": 18,
-      "src/main/speech/openai-transcription-client.test.ts": 5,
-      "src/main/speech/speech-model-deletion.test.ts": 8,
-      "src/main/speech/speech-model-download-response.test.ts": 7,
-      "src/main/speech/stt-offline-audio-chunker.test.ts": 164,
-      "src/main/speech/stt-service.test.ts": 24,
-      "src/main/speech/stt-worker-model-config.test.ts": 8,
-      "src/main/speech/stt-worker.test.ts": 7,
-      "src/main/sqlite/sqlite-read-failure.test.ts": 16,
-      "src/main/sqlite/sync-database.test.ts": 1184,
-      "src/main/ssh-expired-lease-pane-readoption.test.ts": 58,
-      "src/main/ssh-reattach-pane-cardinality.test.ts": 181,
-      "src/main/ssh/orcad-activation-gate.test.ts": 8,
-      "src/main/ssh/orcad-activation-record.test.ts": 9,
-      "src/main/ssh/orcad-remote-deploy.test.ts": 63,
-      "src/main/ssh/orcad-remote-gc.test.ts": 11,
-      "src/main/ssh/orcad-remote-launch.test.ts": 15,
-      "src/main/ssh/orcad-remote-rollback.test.ts": 61,
-      "src/main/ssh/orcad-remote-shell-commands.integration.test.ts": 1254,
-      "src/main/ssh/orcad-state-snapshot.test.ts": 7,
-      "src/main/ssh/orcad-update-plan.test.ts": 10,
-      "src/main/ssh/relay-native-dependency-coverage.test.ts": 333,
-      "src/main/ssh/relay-protocol-backpressure.test.ts": 31,
-      "src/main/ssh/relay-protocol.test.ts": 79,
-      "src/main/ssh/relay-socket-path-limit-shell.integration.test.ts": 77,
-      "src/main/ssh/relay-socket-path-limit.test.ts": 17,
-      "src/main/ssh/remote-install-coexistence.test.ts": 22,
-      "src/main/ssh/remote-install-model.test.ts": 13,
-      "src/main/ssh/removed-ssh-target-tombstone-retention.test.ts": 7,
-      "src/main/ssh/sftp-namespace-resolution.test.ts": 36,
-      "src/main/ssh/sftp-stream-late-error.test.ts": 27,
-      "src/main/ssh/sftp-upload.test.ts": 139,
-      "src/main/ssh/ssh-agent-identity-filter.test.ts": 14,
-      "src/main/ssh/ssh-channel-multiplexer-backpressure.test.ts": 41,
-      "src/main/ssh/ssh-channel-multiplexer-saturation-wedge.test.ts": 14,
-      "src/main/ssh/ssh-channel-multiplexer-settlement.test.ts": 8,
-      "src/main/ssh/ssh-channel-multiplexer.test.ts": 52,
-      "src/main/ssh/ssh-config-alias-claim.test.ts": 12,
-      "src/main/ssh/ssh-config-host-picker.test.ts": 199,
-      "src/main/ssh/ssh-config-loader-regression.test.ts": 80,
-      "src/main/ssh/ssh-config-loader.test.ts": 77,
-      "src/main/ssh/ssh-config-parser-host-patterns.test.ts": 7,
-      "src/main/ssh/ssh-config-parser.test.ts": 262,
-      "src/main/ssh/ssh-config-resolver.test.ts": 12,
-      "src/main/ssh/ssh-connect-attempt-cancellation.test.ts": 7,
-      "src/main/ssh/ssh-connection-auth-fallback.test.ts": 125,
-      "src/main/ssh/ssh-connection-channel-open.test.ts": 746,
-      "src/main/ssh/ssh-connection-direct-startup.test.ts": 32,
-      "src/main/ssh/ssh-connection-file-transfer.test.ts": 17,
-      "src/main/ssh/ssh-connection-generation.test.ts": 9,
-      "src/main/ssh/ssh-connection-github-probe.test.ts": 16,
-      "src/main/ssh/ssh-connection-gssapi-fallback.test.ts": 127,
-      "src/main/ssh/ssh-connection-host-key-store-wiring.test.ts": 246,
-      "src/main/ssh/ssh-connection-host-key-verification.test.ts": 66,
-      "src/main/ssh/ssh-connection-manager-registry.test.ts": 67,
-      "src/main/ssh/ssh-connection-manager.test.ts": 9,
-      "src/main/ssh/ssh-connection-reconnect-ladder.test.ts": 335,
-      "src/main/ssh/ssh-connection-sftp-namespace.test.ts": 834,
-      "src/main/ssh/ssh-connection-sftp-wire.test.ts": 2413,
-      "src/main/ssh/ssh-connection-store.test.ts": 36,
-      "src/main/ssh/ssh-connection-system-transport.test.ts": 58,
-      "src/main/ssh/ssh-connection-utils.test.ts": 83,
-      "src/main/ssh/ssh-connection.test.ts": 72,
-      "src/main/ssh/ssh-control-socket.test.ts": 15,
-      "src/main/ssh/ssh-file-stream-inactivity-deadline.test.ts": 17,
-      "src/main/ssh/ssh-file-transfer-abort.test.ts": 16,
-      "src/main/ssh/ssh-g-config-resolution.test.ts": 67,
-      "src/main/ssh/ssh-git-response-stream-reader.test.ts": 11,
-      "src/main/ssh/ssh-git-stream-idle-timer.test.ts": 52,
-      "src/main/ssh/ssh-host-key-decision.test.ts": 19,
-      "src/main/ssh/ssh-host-key-store.test.ts": 134,
-      "src/main/ssh/ssh-host-key-verifier.test.ts": 21,
-      "src/main/ssh/ssh-known-hosts-source.test.ts": 57,
-      "src/main/ssh/ssh-known-hosts.test.ts": 23,
-      "src/main/ssh/ssh-multi-factor-authentication.test.ts": 1247,
-      "src/main/ssh/ssh-multi-key-authentication.test.ts": 30,
-      "src/main/ssh/ssh-multiplexer-transport-writer.test.ts": 26,
-      "src/main/ssh/ssh-orphan-relay-pty-sweep.test.ts": 21,
-      "src/main/ssh/ssh-orphan-sweep-pane-state-verdicts.test.ts": 21,
-      "src/main/ssh/ssh-owner-recovery-retry.test.ts": 15,
-      "src/main/ssh/ssh-pending-pty-kill-replay.test.ts": 13,
-      "src/main/ssh/ssh-port-forward.test.ts": 25,
-      "src/main/ssh/ssh-port-scanner.test.ts": 31,
-      "src/main/ssh/ssh-posix-command-wrapper.test.ts": 27,
-      "src/main/ssh/ssh-provider-authority.test.ts": 18,
-      "src/main/ssh/ssh-proxy-command.test.ts": 15,
-      "src/main/ssh/ssh-pty-consumer-recovery.test.ts": 10,
-      "src/main/ssh/ssh-pty-consumer-session.test.ts": 13,
-      "src/main/ssh/ssh-pty-recovery-retention-budget.test.ts": 4,
-      "src/main/ssh/ssh-pty-retired-source-deliveries.test.ts": 11,
-      "src/main/ssh/ssh-reconnect-error-classification.test.ts": 10,
-      "src/main/ssh/ssh-reconnect-ladder.test.ts": 8,
-      "src/main/ssh/ssh-relay-build-toolchain.test.ts": 12,
-      "src/main/ssh/ssh-relay-cross-version-isolation.test.ts": 72,
-      "src/main/ssh/ssh-relay-deploy-helpers.test.ts": 296,
-      "src/main/ssh/ssh-relay-deploy-incumbent-verdict.test.ts": 16,
-      "src/main/ssh/ssh-relay-deploy-staged-upload.test.ts": 166,
-      "src/main/ssh/ssh-relay-deploy.test.ts": 209,
-      "src/main/ssh/ssh-relay-endpoint-incumbent-shell.integration.test.ts": 2169,
-      "src/main/ssh/ssh-relay-endpoint-incumbent.test.ts": 15,
-      "src/main/ssh/ssh-relay-endpoint-takeover.test.ts": 15,
-      "src/main/ssh/ssh-relay-gc-retry.test.ts": 82,
-      "src/main/ssh/ssh-relay-install-lock.test.ts": 4,
-      "src/main/ssh/ssh-relay-install-namespace.test.ts": 16,
-      "src/main/ssh/ssh-relay-native-deps-cache-deploy.test.ts": 1273,
-      "src/main/ssh/ssh-relay-native-deps-cache-shell.test.ts": 323,
-      "src/main/ssh/ssh-relay-native-deps-cache.test.ts": 24,
-      "src/main/ssh/ssh-relay-native-deps-install-staged-upload.test.ts": 659,
-      "src/main/ssh/ssh-relay-native-deps-install.test.ts": 13644,
-      "src/main/ssh/ssh-relay-native-deps-probe-verdict.test.ts": 254,
-      "src/main/ssh/ssh-relay-node-headers.test.ts": 2346,
-      "src/main/ssh/ssh-relay-node-pty-repair.test.ts": 15,
-      "src/main/ssh/ssh-relay-node-pty-spawn-repair.test.ts": 25,
-      "src/main/ssh/ssh-relay-orphan-abandon-paths.test.ts": 117,
-      "src/main/ssh/ssh-relay-pty-master-cloexec-install.test.ts": 1911,
-      "src/main/ssh/ssh-relay-reset.test.ts": 27,
-      "src/main/ssh/ssh-relay-sentinel-copy-budget.test.ts": 21,
-      "src/main/ssh/ssh-relay-session-agent-hooks.integration.test.ts": 596,
-      "src/main/ssh/ssh-relay-session-data-delivery.test.ts": 55,
-      "src/main/ssh/ssh-relay-session-incarnation.test.ts": 19,
-      "src/main/ssh/ssh-relay-session-managed-hooks.test.ts": 14,
-      "src/main/ssh/ssh-relay-session-model-migration.test.ts": 170,
-      "src/main/ssh/ssh-relay-session-orphan-sweep.test.ts": 43,
-      "src/main/ssh/ssh-relay-session-pending-kill-replay.test.ts": 14,
-      "src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts": 120,
-      "src/main/ssh/ssh-relay-session-recovery-durability.test.ts": 1066,
-      "src/main/ssh/ssh-relay-session-recovery-races.test.ts": 325,
-      "src/main/ssh/ssh-relay-session-rejected-delivery.test.ts": 793,
-      "src/main/ssh/ssh-relay-session-relay-loss.test.ts": 37,
-      "src/main/ssh/ssh-relay-session-terminal-error.test.ts": 29,
-      "src/main/ssh/ssh-relay-session.test.ts": 311,
-      "src/main/ssh/ssh-relay-sftp-namespace-install.test.ts": 198,
-      "src/main/ssh/ssh-relay-superseded-endpoints.test.ts": 17,
-      "src/main/ssh/ssh-relay-upload-stage-commands.test.ts": 39445,
-      "src/main/ssh/ssh-relay-versioned-install.test.ts": 85,
-      "src/main/ssh/ssh-remote-cli-dispatch-refusal-passthrough.test.ts": 16,
-      "src/main/ssh/ssh-remote-cli-format.test.ts": 7,
-      "src/main/ssh/ssh-remote-cli-host-passthrough.test.ts": 39,
-      "src/main/ssh/ssh-remote-cli-launcher.test.ts": 10,
-      "src/main/ssh/ssh-remote-cli-terminal-host-scope.test.ts": 20,
-      "src/main/ssh/ssh-remote-commands.test.ts": 11428,
-      "src/main/ssh/ssh-remote-linear-activity-output.test.ts": 4,
-      "src/main/ssh/ssh-remote-linear-cli.test.ts": 53,
-      "src/main/ssh/ssh-remote-linear-list-issues.test.ts": 14,
-      "src/main/ssh/ssh-remote-linear-relation-write.test.ts": 15,
-      "src/main/ssh/ssh-remote-linear-save-issue.test.ts": 24,
-      "src/main/ssh/ssh-remote-linear-truncation-output.test.ts": 7,
-      "src/main/ssh/ssh-remote-node-resolution.test.ts": 118,
-      "src/main/ssh/ssh-remote-node-toolchain-probe.test.ts": 8,
-      "src/main/ssh/ssh-remote-orca-cli.test.ts": 140,
-      "src/main/ssh/ssh-remote-orchestration-compatibility.test.ts": 289,
-      "src/main/ssh/ssh-remote-orchestration-send.test.ts": 8,
-      "src/main/ssh/ssh-remote-platform-detection.test.ts": 27,
-      "src/main/ssh/ssh-remote-platform.test.ts": 16,
-      "src/main/ssh/ssh-remote-powershell.test.ts": 72,
-      "src/main/ssh/ssh-remote-windows-command-line-limit.test.ts": 23,
-      "src/main/ssh/ssh-request-outcome-verdict.test.ts": 5,
-      "src/main/ssh/ssh-security-key-identity.test.ts": 41,
-      "src/main/ssh/ssh-session-limit-error.test.ts": 5,
-      "src/main/ssh/ssh-system-fallback.test.ts": 90,
-      "src/main/ssh/ssh-system-transport.integration.test.ts": 637,
-      "src/main/ssh/ssh-target-id-migration.test.ts": 6,
-      "src/main/ssh/ssh-target-readoption.test.ts": 10,
-      "src/main/ssh/system-ssh-binary.test.ts": 12,
-      "src/main/ssh/system-ssh-dynamic-forward-process.test.ts": 61,
-      "src/main/ssh/system-ssh-forward-process.test.ts": 40,
-      "src/main/ssh/system-ssh-sftp-args.test.ts": 8,
-      "src/main/ssh/system-ssh-sftp-path.test.ts": 11,
-      "src/main/ssh/system-ssh-windows-upload.test.ts": 112,
-      "src/main/ssh/system-ssh-windows-write-capabilities.test.ts": 8,
-      "src/main/ssh/vscode-ssh-authority.test.ts": 8,
-      "src/main/star-nag/service-direct-star.test.ts": 14,
-      "src/main/star-nag/service-force-show-races.test.ts": 17,
-      "src/main/star-nag/service-outcome-telemetry.test.ts": 11,
-      "src/main/star-nag/service-prompt-moments.test.ts": 18,
-      "src/main/star-nag/service-threshold-prompt.test.ts": 15,
-      "src/main/startup/bootstrap-fatal-exit-guard.test.ts": 6,
-      "src/main/startup/branch-rename-hook-structured-session.test.ts": 10,
-      "src/main/startup/cli-launch-redirect.test.ts": 11,
-      "src/main/startup/configure-process-dev-parent-shutdown.test.ts": 65,
-      "src/main/startup/configure-process.test.ts": 123,
-      "src/main/startup/desktop-startup-ordering.test.ts": 14,
-      "src/main/startup/dev-education-suppression.test.ts": 10,
-      "src/main/startup/dev-instance-identity.test.ts": 7,
-      "src/main/startup/ensure-virtual-display.test.ts": 5092,
-      "src/main/startup/first-window-startup-services.test.ts": 16,
-      "src/main/startup/gpu-fallback-marker.test.ts": 7,
-      "src/main/startup/gpu-fallback-switches.test.ts": 6,
-      "src/main/startup/gpu-lifecycle-install-dir-acl-guard.test.ts": 55,
-      "src/main/startup/headless-pty-hydration-ordering.test.ts": 10,
-      "src/main/startup/host-port-bootstrap-wiring.test.ts": 11,
-      "src/main/startup/hydrate-shell-path.test.ts": 228,
-      "src/main/startup/hydrate-shell-path.windows.test.ts": 284,
-      "src/main/startup/legacy-worker-renderer-recovery.test.ts": 16,
-      "src/main/startup/login-shell-environment.test.ts": 67,
-      "src/main/startup/main-process-error-guards.test.ts": 29,
-      "src/main/startup/main-process-ready-phase-ordering.test.ts": 9,
-      "src/main/startup/main-window-structured-status-filter.test.ts": 7,
-      "src/main/startup/os-opened-markdown-delivery.test.ts": 10,
-      "src/main/startup/os-opened-markdown-files.test.ts": 116,
-      "src/main/startup/os-opened-markdown-wiring.test.ts": 5,
-      "src/main/startup/pre-gone-crash-sampling-wiring.test.ts": 5,
-      "src/main/startup/renderer-heap-headroom.test.ts": 10,
-      "src/main/startup/run-electron-vite-dev-web.test.ts": 432,
-      "src/main/startup/run-electron-vite-dev.test.ts": 943,
-      "src/main/startup/secret-protection-report-deferral-wiring.test.ts": 6,
-      "src/main/startup/secure-dns-census.test.ts": 407,
-      "src/main/startup/serve-desktop-activation-wiring.test.ts": 9,
-      "src/main/startup/serve-desktop-activation.test.ts": 5,
-      "src/main/startup/serve-mode-argv-cli-redirect-order.test.ts": 9,
-      "src/main/startup/serve-mode-argv.test.ts": 32,
-      "src/main/startup/serve-options.test.ts": 20,
-      "src/main/startup/serve-signal-handlers.test.ts": 4,
-      "src/main/startup/single-instance-lock-exit.electron.test.ts": 275,
-      "src/main/startup/single-instance-lock-headless-exit.test.ts": 11,
-      "src/main/startup/single-instance-lock.test.ts": 19,
-      "src/main/startup/skill-share-deep-link-state.test.ts": 8,
-      "src/main/startup/startup-diagnostics.test.ts": 7,
-      "src/main/startup/window-all-closed-quit-policy.test.ts": 5,
-      "src/main/startup/windows-desktop-shell-path-startup.test.ts": 8,
-      "src/main/startup/windows-install-dir-acl-probe.test.ts": 20,
-      "src/main/startup/windows-install-dir-acl-recovery.test.ts": 460,
-      "src/main/startup/windows-install-dir-acl-startup-wiring.test.ts": 6,
-      "src/main/startup/windows-install-dir-package-acl-repair.test.ts": 43,
-      "src/main/startup/windows-shell-path-hydration.test.ts": 315,
-      "src/main/startup/windows-shell-path-ownership.test.ts": 10,
-      "src/main/startup/windows-user-data-acl.test.ts": 15,
-      "src/main/startup/wsl-cli-reconciliation-startup-barrier.test.ts": 9,
-      "src/main/stats/agent-session-transition-recorder.test.ts": 23,
-      "src/main/stats/collector-async-save.test.ts": 375,
-      "src/main/stats/stats-title-detection-independence.test.ts": 6,
-      "src/main/synthetic-title-frame-routing.test.ts": 4,
-      "src/main/synthetic-title-spinner.test.ts": 4,
-      "src/main/synthetic-title-visibility.test.ts": 5,
-      "src/main/system-fonts.test.ts": 16,
-      "src/main/system-power-lifecycle.test.ts": 8,
-      "src/main/system-resume-broadcast.test.ts": 24,
-      "src/main/telemetry/burst-cap.test.ts": 27,
-      "src/main/telemetry/classify-error.test.ts": 7,
-      "src/main/telemetry/client-lifecycle.test.ts": 17,
-      "src/main/telemetry/client.test.ts": 42,
-      "src/main/telemetry/cohort-classifier.test.ts": 13,
-      "src/main/telemetry/consent.test.ts": 15,
-      "src/main/telemetry/install-id.test.ts": 7,
-      "src/main/telemetry/onboarding-cohort-classifier.test.ts": 12,
-      "src/main/telemetry/onboarding-feature-setup-validator.test.ts": 18,
-      "src/main/telemetry/validator-warn-cache.test.ts": 30,
-      "src/main/telemetry/validator.test.ts": 20,
-      "src/main/terminal-history-async-delete.test.ts": 289,
-      "src/main/terminal-history-gc-fs-call-count.test.ts": 54,
-      "src/main/terminal-history-gc.test.ts": 877,
-      "src/main/terminal-history-tombstone-retry.test.ts": 4798,
-      "src/main/terminal-history.test.ts": 34,
-      "src/main/text-generation/agent-failure-output.test.ts": 11,
-      "src/main/text-generation/commit-message-agent-environment.test.ts": 31,
-      "src/main/text-generation/commit-message-command-backslash-mode.test.ts": 6,
-      "src/main/text-generation/commit-message-text-generation-branch-name.test.ts": 16,
-      "src/main/text-generation/commit-message-text-generation-cancellation.test.ts": 439,
-      "src/main/text-generation/commit-message-text-generation-failure-sanitization.test.ts": 15,
-      "src/main/text-generation/commit-message-text-generation-generated-output.test.ts": 15,
-      "src/main/text-generation/commit-message-text-generation-linked-issue.test.ts": 14,
-      "src/main/text-generation/commit-message-text-generation-local-subprocess.test.ts": 28,
-      "src/main/text-generation/commit-message-text-generation-model-discovery.test.ts": 48,
-      "src/main/text-generation/commit-message-text-generation-regression.test.ts": 10,
-      "src/main/text-generation/commit-message-text-generation-remote-execution.test.ts": 30,
-      "src/main/text-generation/commit-message-text-generation-settings.test.ts": 19,
-      "src/main/text-generation/pull-request-context-errors.test.ts": 25,
-      "src/main/text-generation/pull-request-context.test.ts": 30,
-      "src/main/tray/system-tray.test.ts": 92,
-      "src/main/tray/tray-attention-icon.test.ts": 13,
-      "src/main/tray/tray-dev-badge.test.ts": 11,
-      "src/main/update-install-exit-watchdog.test.ts": 12,
-      "src/main/updater-changelog.test.ts": 7,
-      "src/main/updater-events.test.ts": 204,
-      "src/main/updater-lifecycle-diagnostics.test.ts": 5,
-      "src/main/updater-linux-package-recovery-actions.test.ts": 2079,
-      "src/main/updater-nudge.test.ts": 12,
-      "src/main/updater-prerelease-feed-readiness.test.ts": 114,
-      "src/main/updater-prerelease-feed.test.ts": 148,
-      "src/main/updater-release-builds.test.ts": 30,
-      "src/main/updater-test-harness.leaked-timers.test.ts": 2596,
-      "src/main/updater-test-module-loader.test.ts": 508,
-      "src/main/updater.build-channel-selection.test.ts": 1674,
-      "src/main/updater.check-failure.test.ts": 1910,
-      "src/main/updater.check-preflight.test.ts": 2719,
-      "src/main/updater.check-settlement.test.ts": 2274,
-      "src/main/updater.fallback.test.ts": 22,
-      "src/main/updater.headless-serve-install.test.ts": 272,
-      "src/main/updater.install-failure-cause.test.ts": 2517,
-      "src/main/updater.linux-externally-managed.test.ts": 1400,
-      "src/main/updater.linux-root-package-install.test.ts": 1772,
-      "src/main/updater.nudge-campaign.test.ts": 1490,
-      "src/main/updater.prerelease-fallback.test.ts": 4396,
-      "src/main/updater.publishing-window-feed.test.ts": 3071,
-      "src/main/updater.quit-and-install.test.ts": 2199,
-      "src/main/updater.startup-scheduling.test.ts": 1573,
-      "src/main/usage-worktree-canonicalizer.test.ts": 10,
-      "src/main/usage-worktree-metadata.test.ts": 9,
-      "src/main/usage/highest-usage-key.test.ts": 14,
-      "src/main/usage/usage-breakdown-scaling.test.ts": 55,
-      "src/main/usage/usage-calendar-range.test.ts": 8,
-      "src/main/usage/usage-provider-store-lifecycle.test.ts": 293,
-      "src/main/usage/usage-worktree-refs.test.ts": 7,
-      "src/main/warp-themes/discovery.test.ts": 30,
-      "src/main/warp-themes/index.test.ts": 447,
-      "src/main/warp-themes/manual-warp-theme-files.test.ts": 36,
-      "src/main/warp-themes/parser-runner.test.ts": 9,
-      "src/main/warp-themes/parser.test.ts": 23,
-      "src/main/warp-themes/theme-file-scanner.test.ts": 22,
-      "src/main/win32-utils-async-acl.test.ts": 16,
-      "src/main/win32-utils.test.ts": 12,
-      "src/main/window/attach-main-window-services.test.ts": 195,
-      "src/main/window/clipboard-dashboard-popout-access.test.ts": 15,
-      "src/main/window/clipboard-file-copy.test.ts": 11,
-      "src/main/window/clipboard-image-temp-file.test.ts": 8,
-      "src/main/window/clipboard-image-thumbnail.test.ts": 8,
-      "src/main/window/clipboard-ipc-handlers.test.ts": 94,
-      "src/main/window/clipboard-remote-file-copy.test.ts": 18,
-      "src/main/window/clipboard-remote-file-staging-fs.test.ts": 23,
-      "src/main/window/clipboard-remote-file-staging.test.ts": 37,
-      "src/main/window/clipboard-runtime-owned-ssh-paste.test.ts": 15,
-      "src/main/window/clipboard-text-write-verify.test.ts": 8,
-      "src/main/window/clipboard-windows-image-file.test.ts": 17,
-      "src/main/window/createMainWindow-close-confirmation.test.ts": 29,
-      "src/main/window/createMainWindow-markdown-editor-focus.test.ts": 21,
-      "src/main/window/createMainWindow-recovery-reload-watchdog.test.ts": 48,
-      "src/main/window/createMainWindow-renderer-crash-recovery.test.ts": 51,
-      "src/main/window/createMainWindow-startup-reveal.test.ts": 35,
-      "src/main/window/createMainWindow-system-resume-relay.test.ts": 11,
-      "src/main/window/createMainWindow-terminal-focus-shortcuts.test.ts": 46,
-      "src/main/window/createMainWindow-tray-minimize-close.test.ts": 31,
-      "src/main/window/createMainWindow-zoom-and-tab-switch-shortcuts.test.ts": 17,
-      "src/main/window/createMainWindow.test.ts": 35,
-      "src/main/window/dashboard-popout-window.test.ts": 26,
-      "src/main/window/editable-context-menu.test.ts": 20,
-      "src/main/window/focus-existing-window.test.ts": 10,
-      "src/main/window/foreground-activation-policy.test.ts": 15,
-      "src/main/window/history-gc-profile-worktree-ids.test.ts": 13,
-      "src/main/window/history-gc-worktree-ids.test.ts": 8,
-      "src/main/window/macos-app-activation.test.ts": 5,
-      "src/main/window/macos-tahoe-release.test.ts": 6,
-      "src/main/window/main-window-visibility.test.ts": 5,
-      "src/main/window/main-window-webview-security.test.ts": 12,
-      "src/main/window/mobile-markdown-request-relay.test.ts": 26,
-      "src/main/window/privileged-window-navigation.test.ts": 14,
-      "src/main/window/renderer-document-navigation.test.ts": 9,
-      "src/main/window/renderer-publication-throttle.test.ts": 5,
-      "src/main/window/renderer-recovery-prompt.test.ts": 21,
-      "src/main/window/renderer-recovery-reload-watchdog.test.ts": 16,
-      "src/main/window/runtime-renderer-notification-sender.test.ts": 9,
-      "src/main/window/session-tab-close-request-relay.test.ts": 40,
-      "src/main/window/terminal-tab-close-request-relay.test.ts": 24,
-      "src/main/window/updater-package-recovery-ipc.test.ts": 14,
-      "src/main/window/window-close-decision.test.ts": 4,
-      "src/main/windows-descendant-exit-verification.test.ts": 17,
-      "src/main/windows-process-tree-kill.test.ts": 7,
-      "src/main/windows-pty-root-identity.test.ts": 13,
-      "src/main/windows/windows-command-line-recovery-health.test.ts": 10,
-      "src/main/windows/windows-process-table-cim-scan.test.ts": 6,
-      "src/main/windows/windows-process-table.test.ts": 64,
-      "src/main/windows/windows-process-tree-command-line-patch.test.ts": 11,
-      "src/main/windows/windows-pty-job.test.ts": 14,
-      "src/main/workspace-cleanup-removal-snapshot-prune.test.ts": 13,
-      "src/main/workspace-cleanup-scan-snapshot.test.ts": 88,
-      "src/main/workspace-space-analysis-capacity.test.ts": 38,
-      "src/main/workspace-space-analysis-du-timeout.test.ts": 236,
-      "src/main/workspace-space-analysis-snapshot.test.ts": 66,
-      "src/main/workspace-space-analysis.test.ts": 227,
-      "src/main/workspace-space-repo-scan.test.ts": 5,
-      "src/main/workspace-space-scan-control.test.ts": 36,
-      "src/main/worktree-create-base-prefetch.test.ts": 225,
-      "src/main/worktree-create-base.test.ts": 5,
-      "src/main/worktree-create-candidates.test.ts": 5,
-      "src/main/worktree-create-execution-host-route.test.ts": 10,
-      "src/main/worktree-create-preparation-cancellation.test.ts": 29,
-      "src/main/worktree-create-preparation-claim.test.ts": 8,
-      "src/main/worktree-create-preparation-wsl-root.test.ts": 13,
-      "src/main/worktree-create-preparation.test.ts": 110,
-      "src/main/worktree-create-timing.test.ts": 7,
-      "src/main/worktree-identity-persistence.test.ts": 207,
-      "src/main/worktree-lineage-pruning.test.ts": 12,
-      "src/main/worktree-metadata-ownership.test.ts": 4,
-      "src/main/worktree-name-retirement.test.ts": 18,
-      "src/main/worktree-removal-authority.test.ts": 10,
-      "src/main/worktree-removal-execution-host-route.test.ts": 6,
-      "src/main/worktree-removal-repo-owner.test.ts": 7,
-      "src/main/worktree-removal-safety.test.ts": 18,
-      "src/main/worktree-removal-session-partition-fencing.test.ts": 1223,
-      "src/main/worktree-retirement-backfill-scan.test.ts": 20,
-      "src/main/worktree-retirement-backfill-stall.test.ts": 15,
-      "src/main/worktree-retirement-discovery-wsl.test.ts": 32,
-      "src/main/worktree-retirement-discovery.test.ts": 37,
-      "src/main/worktree-retirement-namespace.test.ts": 28,
-      "src/main/worktree-root-preparation.test.ts": 11,
-      "src/main/worktree-trash.test.ts": 53,
-      "src/main/wsl-availability-missing-kernel.test.ts": 10,
-      "src/main/wsl-bash-command.test.ts": 4,
-      "src/main/wsl-distro-list-output.test.ts": 8,
-      "src/main/wsl-distro-list-single-flight.test.ts": 14,
-      "src/main/wsl-fish-history-cleanup.test.ts": 15,
-      "src/main/wsl-interop-spawn-directory.test.ts": 10,
-      "src/main/wsl-running-distros.test.ts": 125,
-      "src/main/wsl-unc-delete-symlink-repro.test.ts": 7,
-      "src/main/wsl-unc-delete.test.ts": 12,
-      "src/main/wsl.test.ts": 35,
-      "src/main/wsl/wsl-guest-environment.test.ts": 52,
-      "src/main/wsl/wsl-invocation-boundary.test.ts": 6,
-      "src/main/wsl/wsl-probe-failure-semantics.test.ts": 587,
-      "src/main/wsl/wsl-runner.test.ts": 32,
-      "src/main/wsl/wsl-w1-w3-contract.test.ts": 26,
-      "src/preload/api/platform-bridge.test.ts": 12,
-      "src/preload/app-restart-checkpoint-routing.test.ts": 651,
-      "src/preload/browser-client-page-renderer-requests.test.ts": 22,
-      "src/preload/browser-find-subscriptions.test.ts": 11,
-      "src/preload/browser-window-close.test.ts": 6,
-      "src/preload/close-active-tab-payload-admission.test.ts": 5,
-      "src/preload/doc-preview-link-interception.test.ts": 29,
-      "src/preload/pty-snapshot-capability-ipc.test.ts": 652,
-      "src/preload/renderer-heap-statistics-reader.test.ts": 5,
-      "src/preload/renderer-process-memory-reader.test.ts": 7,
-      "src/preload/renderer-restart-wiring.test.ts": 13,
-      "src/preload/runtime-environment-subscriptions.test.ts": 11,
-      "src/preload/ssh-authority-forwarding.test.ts": 682,
-      "src/preload/updater-package-recovery.test.ts": 273,
-      "src/preload/usage-provider-api.test.ts": 9,
-      "src/relay/agent-exec-handler-windows.test.ts": 11,
-      "src/relay/agent-exec-handler.test.ts": 28,
-      "src/relay/agent-hook-envelope-publication.test.ts": 215,
-      "src/relay/agent-hook-integration.test.ts": 116,
-      "src/relay/agent-hook-retired-pane-suppression.test.ts": 125,
-      "src/relay/agent-hook-server-codex-subagent-transcript.test.ts": 1068,
-      "src/relay/agent-hook-server.test.ts": 1481,
-      "src/relay/ai-vault-handler.test.ts": 208,
-      "src/relay/ai-vault-service-client.test.ts": 28,
-      "src/relay/ai-vault-service-restart-policy.test.ts": 10,
-      "src/relay/ai-vault-service-spawn.test.ts": 9,
-      "src/relay/context.test.ts": 5,
-      "src/relay/dispatcher-capacity-degradation.test.ts": 112,
-      "src/relay/dispatcher-client-close-cause.test.ts": 15,
-      "src/relay/dispatcher-client-writer.test.ts": 13,
-      "src/relay/dispatcher-frame-guard-regressions.test.ts": 7,
-      "src/relay/dispatcher-json-payload.test.ts": 51,
-      "src/relay/dispatcher-notification-ownership.test.ts": 5,
-      "src/relay/dispatcher-silent-client-reaper.test.ts": 19,
-      "src/relay/dispatcher-structured-error.test.ts": 10,
-      "src/relay/dispatcher-timeout.test.ts": 19,
-      "src/relay/dispatcher-writer-admission.test.ts": 94,
-      "src/relay/dispatcher.test.ts": 198,
-      "src/relay/external-automation-provider-catalog.test.ts": 27,
-      "src/relay/external-automations-handler-log-path.test.ts": 24,
-      "src/relay/external-automations-handler.test.ts": 21,
-      "src/relay/fs-handler-doc-preview.test.ts": 16,
-      "src/relay/fs-handler-file-range-dispatch.test.ts": 79,
-      "src/relay/fs-handler-file-range.test.ts": 61,
-      "src/relay/fs-handler-git-search.test.ts": 7,
-      "src/relay/fs-handler-install-rg.test.ts": 9,
-      "src/relay/fs-handler-list-files-cancel.test.ts": 28,
-      "src/relay/fs-handler-list-files-ignored.test.ts": 648,
-      "src/relay/fs-handler-list-files-result-limit.test.ts": 12,
-      "src/relay/fs-handler-readdir-fallback.test.ts": 8,
-      "src/relay/fs-handler-ripgrep-fallback.test.ts": 19,
-      "src/relay/fs-handler-stream.test.ts": 475,
-      "src/relay/fs-handler.test.ts": 172,
-      "src/relay/fs-list-files-cancel.integration.test.ts": 26,
-      "src/relay/fs-list-files-large-response.integration.test.ts": 87,
-      "src/relay/fs-list-files-scan-coordinator.test.ts": 14,
-      "src/relay/fs-path-metadata-requests.test.ts": 10,
-      "src/relay/fs-path-metadata-symlink-concurrency.test.ts": 11,
-      "src/relay/fs-search-line-fragments.test.ts": 84,
-      "src/relay/fs-stream-pty-echo-backpressure.integration.test.ts": 135,
-      "src/relay/git-branch-delete-refusal-parity.test.ts": 10,
-      "src/relay/git-exec-validator.test.ts": 18,
-      "src/relay/git-handler-blob-readers.test.ts": 9,
-      "src/relay/git-handler-branch-cleanup.test.ts": 19,
-      "src/relay/git-handler-branch-compare.test.ts": 58,
-      "src/relay/git-handler-branch-diff-equivalence.test.ts": 908,
-      "src/relay/git-handler-branch-diff.test.ts": 174,
-      "src/relay/git-handler-check-ignore.test.ts": 8,
-      "src/relay/git-handler-diff-read-coalescing.test.ts": 103,
-      "src/relay/git-handler-file-diff.test.ts": 1278,
-      "src/relay/git-handler-fork-remote-exec.test.ts": 75,
-      "src/relay/git-handler-pull-reconciliation.test.ts": 712,
-      "src/relay/git-handler-push-target.test.ts": 16,
-      "src/relay/git-handler-remote-sync.test.ts": 1241,
-      "src/relay/git-handler-staging.test.ts": 402,
-      "src/relay/git-handler-status-ops.test.ts": 63,
-      "src/relay/git-handler-submodule-cache-invalidation.test.ts": 8,
-      "src/relay/git-handler-submodule-ops.test.ts": 47,
-      "src/relay/git-handler-submodule-status-cancellation.test.ts": 11,
-      "src/relay/git-handler-termination.test.ts": 9,
-      "src/relay/git-handler-utils.test.ts": 4,
-      "src/relay/git-handler-working-tree-changes.test.ts": 1001,
-      "src/relay/git-handler-worktree-clean.test.ts": 9,
-      "src/relay/git-handler-worktree-git-capabilities.test.ts": 12,
-      "src/relay/git-handler-worktree-inspection.test.ts": 819,
-      "src/relay/git-handler-worktree-list-authority.test.ts": 12,
-      "src/relay/git-handler-worktree-list.test.ts": 11,
-      "src/relay/git-handler-worktree-ops.test.ts": 27,
-      "src/relay/git-handler-worktree-paths.test.ts": 5,
-      "src/relay/git-handler-worktree-provisioning.test.ts": 723,
-      "src/relay/git-handler.test.ts": 638,
-      "src/relay/git-porcelain-local-parity.test.ts": 21,
-      "src/relay/git-push-target-local-parity.test.ts": 21,
-      "src/relay/git-response-pty-echo-backpressure.integration.test.ts": 751,
-      "src/relay/git-response-stream-ownership.test.ts": 18,
-      "src/relay/git-status-branch-line-total.test.ts": 197,
-      "src/relay/git-status-upstream-negative-cache.test.ts": 260,
-      "src/relay/git-stdout-stream.test.ts": 21,
-      "src/relay/git-working-file-read.test.ts": 27,
-      "src/relay/hermes-run-correlation.test.ts": 8,
-      "src/relay/hermes-run-history.test.ts": 13,
-      "src/relay/integration.test.ts": 1222,
-      "src/relay/legacy-relay-publication-ledger.test.ts": 7,
-      "src/relay/managed-hook-installer.test.ts": 13,
-      "src/relay/node-pty-binding-survey.test.ts": 132,
-      "src/relay/node-pty-unavailable-diagnosis.test.ts": 13,
-      "src/relay/plugin-overlay-env.test.ts": 14,
-      "src/relay/plugin-overlay.test.ts": 24,
-      "src/relay/plugin-source-limit.test.ts": 8,
-      "src/relay/port-scan-handler.test.ts": 70,
-      "src/relay/preflight-handler.test.ts": 18,
-      "src/relay/protocol-backpressure.test.ts": 51,
-      "src/relay/protocol-handshake.test.ts": 7,
-      "src/relay/protocol-json-payload.test.ts": 178,
-      "src/relay/pty-handler-attach-replay.test.ts": 49,
-      "src/relay/pty-handler-dispose-lifecycle.test.ts": 37,
-      "src/relay/pty-handler-grace-timer.test.ts": 19,
-      "src/relay/pty-handler-inventory-process-evidence.test.ts": 30,
-      "src/relay/pty-handler-output-drain-differential.test.ts": 135,
-      "src/relay/pty-handler-output-streaming.test.ts": 420,
-      "src/relay/pty-handler-ownership-attestation.test.ts": 87,
-      "src/relay/pty-handler-resize-stale-pty.test.ts": 30,
-      "src/relay/pty-handler-retired-pane-surface.test.ts": 82,
-      "src/relay/pty-handler-revive.test.ts": 91,
-      "src/relay/pty-handler-shell-resolution.test.ts": 33,
-      "src/relay/pty-handler-shutdown-signals.test.ts": 54,
-      "src/relay/pty-handler-source-publication.test.ts": 260,
-      "src/relay/pty-handler-spawn-admission.test.ts": 127,
-      "src/relay/pty-handler-spawn-cwd.test.ts": 46,
-      "src/relay/pty-handler-spawn-environment.test.ts": 108,
-      "src/relay/pty-handler-startup-command-delivery.test.ts": 111,
-      "src/relay/pty-handler-windows-child-process-evidence.test.ts": 35,
-      "src/relay/pty-replay-buffer-equivalence.test.ts": 77,
-      "src/relay/pty-shell-launch.test.ts": 312,
-      "src/relay/pty-shell-utils.test.ts": 58,
-      "src/relay/pty-source-credit-ledger.test.ts": 122,
-      "src/relay/pty-source-credit-scheduler.test.ts": 12,
-      "src/relay/pty-source-sent-boundaries.test.ts": 88,
-      "src/relay/relay-command-env.test.ts": 14,
-      "src/relay/relay-daemon-fatal-reap.test.ts": 540,
-      "src/relay/relay-diagnostic-log.test.ts": 7,
-      "src/relay/relay-endpoint-credential-publication.test.ts": 2634,
-      "src/relay/relay-filesystem-watch-registry.test.ts": 128,
-      "src/relay/relay-grace-branch.test.ts": 7,
-      "src/relay/relay-handshake-roundtrip.test.ts": 317,
-      "src/relay/relay-launch-options.test.ts": 12,
-      "src/relay/relay-oversized-notification-survival.test.ts": 67,
-      "src/relay/relay-pty-consumer-owner-displacement.test.ts": 19,
-      "src/relay/relay-pty-publication-admission.test.ts": 26,
-      "src/relay/relay-pty-source-cancellation-exit.test.ts": 54,
-      "src/relay/relay-pty-source-exit-publication.test.ts": 27,
-      "src/relay/relay-pty-source-publication.test.ts": 69,
-      "src/relay/relay-pty-source-recovery-completion.test.ts": 9,
-      "src/relay/relay-pty-source-recovery-interleavings.test.ts": 25,
-      "src/relay/relay-pty-source-recovery-window.test.ts": 33,
-      "src/relay/relay-pty-source-restore-retry.test.ts": 15,
-      "src/relay/relay-pty-source-send-scheduler.test.ts": 9,
-      "src/relay/relay-pty-source-superseded-activation.test.ts": 21,
-      "src/relay/relay-reconnect-listener-credential-gate.test.ts": 28,
-      "src/relay/relay-watch-root-capacity.test.ts": 15,
-      "src/relay/relay-watcher-event-emitter.test.ts": 842,
-      "src/relay/relay-watcher-frame-chunking.test.ts": 632,
-      "src/relay/relay-watcher-parent-removal.test.ts": 20,
-      "src/relay/relay-watcher-pending-setup-waiters.test.ts": 233,
-      "src/relay/relay-watcher-setup-wait.test.ts": 320,
-      "src/relay/remote-artifact-cli-input.test.ts": 124,
-      "src/relay/remote-cli-env.test.ts": 5,
-      "src/relay/remote-cli-stdin.test.ts": 7,
-      "src/relay/remote-cli-timeout.test.ts": 9,
-      "src/relay/retired-pane-surfaces.test.ts": 7,
-      "src/relay/rotating-log-writer.test.ts": 33,
-      "src/relay/skill-install-handler.test.ts": 306,
-      "src/relay/skill-upload-multi-relay.integration.test.ts": 549,
-      "src/relay/ssh-pty-consumer-session-adapter.test.ts": 48,
-      "src/relay/ssh-pty-source-credit-adapter.test.ts": 29,
-      "src/relay/subprocess-tree-termination.test.ts": 6,
-      "src/relay/subprocess.test.ts": 22239,
-      "src/relay/terminal-history-wsl.test.ts": 11,
-      "src/relay/terminal-history.test.ts": 14,
-      "src/relay/windows-port-scan.test.ts": 66,
-      "src/relay/workspace-session-handler.test.ts": 12,
-      "src/relay/workspace-snapshot-publication.test.ts": 29,
-      "src/relay/workspace-space-scan-du-capacity.test.ts": 34,
-      "src/relay/workspace-space-scan.test.ts": 37,
-      "src/relay/wsl-agent-hook-relay.test.ts": 45,
-      "src/relay/wsl-hook-fs-bridge.test.ts": 11,
-      "src/relay/wsl-install-plugins-handler.test.ts": 20,
-      "src/renderer/src/app-shell/app-command-handlers-tab-rename.test.ts": 13,
-      "src/renderer/src/app-shell/app-command-handlers-workspace-delete.test.ts": 10,
-      "src/renderer/src/app-shell/app-root-surface-settings.test.tsx": 25,
-      "src/renderer/src/app-shell/reconcile-hydrated-workspace-tab-models.test.ts": 6,
-      "src/renderer/src/app-shell/remote-workspace-unplaced-upload-suppression.test.tsx": 92,
-      "src/renderer/src/app-shell/shutdown-checkpoint-persist.test.ts": 16,
-      "src/renderer/src/app-shell/shutdown-checkpoint-restart-lifecycle.test.ts": 20,
-      "src/renderer/src/app-shell/startup-actions-selector.test.ts": 56,
-      "src/renderer/src/app-shell/use-document-appearance.test.tsx": 33,
-      "src/renderer/src/app-shell/window-visibility-actions-selector.test.ts": 42,
-      "src/renderer/src/app-shell/workspace-view-cross-client-sync.test.tsx": 120,
-      "src/renderer/src/app-startup-routing.test.ts": 13,
-      "src/renderer/src/assets/mobile-page-qr-layout.test.ts": 5,
-      "src/renderer/src/assets/rich-markdown-task-list-style.test.ts": 4,
-      "src/renderer/src/assets/terminal-container-geometry.test.ts": 7,
-      "src/renderer/src/assets/terminal-scrollbar-style.test.ts": 4,
-      "src/renderer/src/assets/worktree-card-active-style.test.ts": 4,
-      "src/renderer/src/components/AgentStateDot.test.ts": 38,
-      "src/renderer/src/components/AgentWorkingSpinner.test.tsx": 43,
-      "src/renderer/src/components/LinuxPackageInstallRecoveryCard.test.tsx": 343,
-      "src/renderer/src/components/NewWorkspaceComposerCard.set-location-warm.test.tsx": 141,
-      "src/renderer/src/components/NewWorkspaceComposerCard.set-location.test.tsx": 229,
-      "src/renderer/src/components/NewWorkspaceComposerCard.test.tsx": 1044,
-      "src/renderer/src/components/QuickOpen.mount-gating.test.tsx": 647,
-      "src/renderer/src/components/SelectedTextCopyMenu.test.tsx": 49,
-      "src/renderer/src/components/StarNagCard.test.tsx": 60,
-      "src/renderer/src/components/StateIndicatorTooltip.test.tsx": 12,
-      "src/renderer/src/components/TerminalSearch.test.tsx": 106,
-      "src/renderer/src/components/TerminalTitlebarTabs.test.tsx": 28,
-      "src/renderer/src/components/TerminalWorkbenchContainer.test.tsx": 40,
-      "src/renderer/src/components/UpdateCard.error-card.test.tsx": 449,
-      "src/renderer/src/components/UpdateCard.test.ts": 60,
-      "src/renderer/src/components/WorktreeBaseFallbackDialog.test.tsx": 146,
-      "src/renderer/src/components/WorktreeJumpPalette.linear-url.test.tsx": 865,
-      "src/renderer/src/components/WorktreeJumpPalette.mount-gating.test.tsx": 489,
-      "src/renderer/src/components/WorktreeJumpPalette.recent-tabs.behavior.test.tsx": 466,
-      "src/renderer/src/components/WorktreeJumpPalette.recent-tabs.test.tsx": 907,
-      "src/renderer/src/components/WorktreeJumpPalette.test.tsx": 423,
-      "src/renderer/src/components/activity/ActivityPrototypePage.filter-focus-shortcut.test.ts": 8,
-      "src/renderer/src/components/activity/ActivityPrototypePage.test.ts": 21,
-      "src/renderer/src/components/activity/ActivityPrototypePage.thread-grouping.test.ts": 31,
-      "src/renderer/src/components/activity/ActivityThreadOptionsMenu.test.tsx": 388,
-      "src/renderer/src/components/activity/activity-auto-mark-read-loop.react185.test.tsx": 950,
-      "src/renderer/src/components/activity/activity-clear-completed.test.ts": 28,
-      "src/renderer/src/components/activity/activity-event-builder-agent-context.test.ts": 13,
-      "src/renderer/src/components/activity/activity-event-builder.bounded-history.test.ts": 12,
-      "src/renderer/src/components/activity/activity-event-builder.host-ownership.test.ts": 17,
-      "src/renderer/src/components/activity/activity-event-builder.identity-reuse.test.ts": 15,
-      "src/renderer/src/components/activity/activity-event-builder.live-cap.test.ts": 14,
-      "src/renderer/src/components/activity/activity-portal-churn-budget.test.ts": 8,
-      "src/renderer/src/components/activity/activity-portal-readiness-decay.react185.test.tsx": 33,
-      "src/renderer/src/components/activity/activity-portal-readiness-loop.react185.test.tsx": 144,
-      "src/renderer/src/components/activity/activity-portal-readiness-oscillation.test.ts": 5,
-      "src/renderer/src/components/activity/activity-portal-readiness-subscription-churn.react185.test.tsx": 131,
-      "src/renderer/src/components/activity/activity-portal-thread-reconciliation.test.ts": 9,
-      "src/renderer/src/components/activity/activity-scope-filter.test.ts": 9,
-      "src/renderer/src/components/activity/activity-terminal-portal-publication-loop.react185.test.tsx": 21,
-      "src/renderer/src/components/activity/activity-terminal-portal.test.tsx": 19,
-      "src/renderer/src/components/activity/activity-thread-actions.test.ts": 17,
-      "src/renderer/src/components/activity/activity-thread-child-agent.test.ts": 7,
-      "src/renderer/src/components/activity/activity-thread-grouping.search-cache.test.ts": 8,
-      "src/renderer/src/components/activity/activity-thread-grouping.status-order.test.ts": 17,
-      "src/renderer/src/components/activity/activity-thread-hover-card.test.tsx": 228,
-      "src/renderer/src/components/activity/activity-thread-list-pane-collapsible.test.tsx": 218,
-      "src/renderer/src/components/activity/activity-thread-list-pane.virtualization.test.tsx": 852,
-      "src/renderer/src/components/activity/activity-thread-presentation.test.ts": 9,
-      "src/renderer/src/components/activity/activity-thread-virtual-items.test.ts": 12,
-      "src/renderer/src/components/activity/dev-activity-fixture.test.ts": 7,
-      "src/renderer/src/components/activity/event-time-clock-refresh.test.tsx": 40,
-      "src/renderer/src/components/activity/use-activity-thread-action-bindings.test.tsx": 22,
-      "src/renderer/src/components/activity/useActivityUnreadCount.freshness.test.tsx": 42,
-      "src/renderer/src/components/activity/useActivityUnreadCount.test.ts": 7,
-      "src/renderer/src/components/agent-session-continuation/AgentSessionContinuationDialog.test.tsx": 42,
-      "src/renderer/src/components/agent-session-continuation/agent-session-continuation-selection.test.ts": 5,
-      "src/renderer/src/components/agent/AgentCombobox.test.tsx": 855,
-      "src/renderer/src/components/agent/AgentSettingsDialog.test.tsx": 68,
-      "src/renderer/src/components/agent/agent-combobox-command-state.test.ts": 6,
-      "src/renderer/src/components/artifacts/ArtifactCollection.test.tsx": 439,
-      "src/renderer/src/components/artifacts/ArtifactPreview.test.tsx": 69,
-      "src/renderer/src/components/artifacts/ArtifactPublishButton.test.tsx": 272,
-      "src/renderer/src/components/artifacts/ArtifactsPage.test.tsx": 1134,
-      "src/renderer/src/components/artifacts/artifact-display-labels.test.ts": 30,
-      "src/renderer/src/components/artifacts/artifact-list-search.test.ts": 11,
-      "src/renderer/src/components/artifacts/artifact-publish-flow.test.ts": 62,
-      "src/renderer/src/components/artifacts/artifact-published-link-client.test.ts": 13,
-      "src/renderer/src/components/automations/AutomationDestinationField.test.tsx": 285,
-      "src/renderer/src/components/automations/AutomationDetail.host.test.tsx": 104,
-      "src/renderer/src/components/automations/AutomationDetail.test.tsx": 81,
-      "src/renderer/src/components/automations/AutomationEditorPromptEditor.test.tsx": 35,
-      "src/renderer/src/components/automations/AutomationHostBadges.test.tsx": 191,
-      "src/renderer/src/components/automations/AutomationHostFilterNotice.test.tsx": 125,
-      "src/renderer/src/components/automations/AutomationListEmptyView.test.tsx": 53,
-      "src/renderer/src/components/automations/AutomationListHostGroups.test.tsx": 71,
-      "src/renderer/src/components/automations/AutomationListLocalRows.test.tsx": 298,
-      "src/renderer/src/components/automations/AutomationListSearchField.test.tsx": 74,
-      "src/renderer/src/components/automations/AutomationListTableHeader.test.tsx": 131,
-      "src/renderer/src/components/automations/AutomationOwnerConflictNotice.test.tsx": 60,
-      "src/renderer/src/components/automations/AutomationPromptDisclosure.test.tsx": 334,
-      "src/renderer/src/components/automations/AutomationRunHistory.test.tsx": 122,
-      "src/renderer/src/components/automations/AutomationRunsDashboardSurface.test.tsx": 23,
-      "src/renderer/src/components/automations/AutomationRunsTable.test.tsx": 60,
-      "src/renderer/src/components/automations/AutomationSchedulePicker.render.test.tsx": 915,
-      "src/renderer/src/components/automations/AutomationSchedulePicker.test.ts": 839,
-      "src/renderer/src/components/automations/AutomationTimeField.test.tsx": 248,
-      "src/renderer/src/components/automations/AutomationsDetailPane.run-count.test.tsx": 115,
-      "src/renderer/src/components/automations/AutomationsDetailPane.test.tsx": 178,
-      "src/renderer/src/components/automations/AutomationsListPanel.test.tsx": 271,
-      "src/renderer/src/components/automations/AutomationsPage.create-destination.test.tsx": 412,
-      "src/renderer/src/components/automations/AutomationsPage.cross-authority-actions.test.tsx": 137,
-      "src/renderer/src/components/automations/AutomationsPage.escape-precedence.test.tsx": 232,
-      "src/renderer/src/components/automations/AutomationsPage.external-scope.test.tsx": 212,
-      "src/renderer/src/components/automations/AutomationsPage.notice-recovery.test.tsx": 198,
-      "src/renderer/src/components/automations/AutomationsPage.refresh-selection.test.tsx": 376,
-      "src/renderer/src/components/automations/AutomationsPage.run-visibility.test.tsx": 133,
-      "src/renderer/src/components/automations/AutomationsPage.save-visibility.test.tsx": 195,
-      "src/renderer/src/components/automations/AutomationsPage.strict-mode-save-visibility.test.tsx": 233,
-      "src/renderer/src/components/automations/AutomationsPage.test.tsx": 644,
-      "src/renderer/src/components/automations/AutomationsPageBreadcrumb.test.tsx": 62,
-      "src/renderer/src/components/automations/CreateFromPicker.test.tsx": 75,
-      "src/renderer/src/components/automations/ExternalAutomationManagers.test.tsx": 247,
-      "src/renderer/src/components/automations/automation-authority-identity.test.ts": 8,
-      "src/renderer/src/components/automations/automation-captured-owner.test.ts": 8,
-      "src/renderer/src/components/automations/automation-create-destination.test.ts": 10,
-      "src/renderer/src/components/automations/automation-create-projects.test.ts": 6,
-      "src/renderer/src/components/automations/automation-detail-tab-navigation.test.ts": 16,
-      "src/renderer/src/components/automations/automation-editor-prompt-options.test.ts": 6,
-      "src/renderer/src/components/automations/automation-external-target-match.test.ts": 8,
-      "src/renderer/src/components/automations/automation-host-cache-controller.test.ts": 21,
-      "src/renderer/src/components/automations/automation-host-cache-health.test.ts": 9,
-      "src/renderer/src/components/automations/automation-host-cache.test.ts": 18,
-      "src/renderer/src/components/automations/automation-host-catalog-generation.test.ts": 14,
-      "src/renderer/src/components/automations/automation-host-catalog-order.test.ts": 19,
-      "src/renderer/src/components/automations/automation-host-catalog-source.test.ts": 11,
-      "src/renderer/src/components/automations/automation-host-catalog.test.ts": 64,
-      "src/renderer/src/components/automations/automation-host-client.test.ts": 7,
-      "src/renderer/src/components/automations/automation-host-detail-display.test.ts": 4,
-      "src/renderer/src/components/automations/automation-host-diagnostics.test.ts": 28,
-      "src/renderer/src/components/automations/automation-host-filter-resolution.test.ts": 28,
-      "src/renderer/src/components/automations/automation-host-health.test.ts": 7,
-      "src/renderer/src/components/automations/automation-host-invalidation-window-events.test.ts": 12,
-      "src/renderer/src/components/automations/automation-host-invalidation.test.ts": 17,
-      "src/renderer/src/components/automations/automation-host-list-rows.test.ts": 8,
-      "src/renderer/src/components/automations/automation-host-orphan-entry.test.ts": 22,
-      "src/renderer/src/components/automations/automation-host-picker-groups.test.ts": 19,
-      "src/renderer/src/components/automations/automation-host-recovery.test.ts": 5,
-      "src/renderer/src/components/automations/automation-host-scale-gates.test.ts": 195,
-      "src/renderer/src/components/automations/automation-host-scheduler.test.ts": 18,
-      "src/renderer/src/components/automations/automation-host-status-descriptors.test.ts": 24,
-      "src/renderer/src/components/automations/automation-list-empty-state.test.ts": 18,
-      "src/renderer/src/components/automations/automation-list-focus-recovery.test.ts": 7,
-      "src/renderer/src/components/automations/automation-list-keyboard-navigation.test.ts": 8,
-      "src/renderer/src/components/automations/automation-list-last-run.test.ts": 26,
-      "src/renderer/src/components/automations/automation-list-row-identity.test.ts": 7,
-      "src/renderer/src/components/automations/automation-list-search-rows.test.ts": 12,
-      "src/renderer/src/components/automations/automation-list-search.test.ts": 12,
-      "src/renderer/src/components/automations/automation-list-view-sort.test.ts": 175,
-      "src/renderer/src/components/automations/automation-list-view.test.ts": 15,
-      "src/renderer/src/components/automations/automation-project-groups.test.ts": 8,
-      "src/renderer/src/components/automations/automation-run-completion-evidence.test.ts": 7,
-      "src/renderer/src/components/automations/automation-run-context.test.ts": 5,
-      "src/renderer/src/components/automations/automation-run-history-keyboard-navigation.test.ts": 14,
-      "src/renderer/src/components/automations/automation-run-open-target.test.ts": 10,
-      "src/renderer/src/components/automations/automation-run-output-snapshot-equivalence.test.ts": 69,
-      "src/renderer/src/components/automations/automation-run-output-snapshot.test.ts": 47,
-      "src/renderer/src/components/automations/automation-run-view-state.test.ts": 11,
-      "src/renderer/src/components/automations/automation-runs-dashboard-model.test.ts": 6,
-      "src/renderer/src/components/automations/automation-scoped-list-client.test.ts": 76,
-      "src/renderer/src/components/automations/automation-setup-decision.test.ts": 8,
-      "src/renderer/src/components/automations/automation-source-display.test.ts": 10,
-      "src/renderer/src/components/automations/automation-target-availability.test.ts": 12,
-      "src/renderer/src/components/automations/automation-usage-model.test.ts": 6,
-      "src/renderer/src/components/automations/automation-write-invalidation.test.ts": 8,
-      "src/renderer/src/components/automations/external-automation-display.test.ts": 6,
-      "src/renderer/src/components/automations/external-automation-list-entries.test.ts": 7,
-      "src/renderer/src/components/automations/external-automation-run-table-state.test.ts": 9,
-      "src/renderer/src/components/automations/external-automation-scope-gating.test.ts": 11,
-      "src/renderer/src/components/automations/external-automation-scope-keys.test.ts": 7,
-      "src/renderer/src/components/automations/external-automation-source-availability.test.ts": 5,
-      "src/renderer/src/components/automations/hermes-cron-output-parse.test.ts": 27,
-      "src/renderer/src/components/automations/use-automation-host-catalog-readoption.test.tsx": 58,
-      "src/renderer/src/components/automations/use-automation-host-catalog.test.tsx": 56,
-      "src/renderer/src/components/automations/use-automation-list-focus-recovery.test.tsx": 26,
-      "src/renderer/src/components/automations/use-automation-list-search.test.tsx": 33,
-      "src/renderer/src/components/automations/use-automation-runs-dashboard.test.tsx": 53,
-      "src/renderer/src/components/automations/use-external-automation-scope-retention.test.tsx": 19,
-      "src/renderer/src/components/automations/use-selected-automation-run-history.test.tsx": 33,
-      "src/renderer/src/components/browser-cookie-import-google-disclosure.test.tsx": 99,
-      "src/renderer/src/components/browser-favicon.test.tsx": 55,
-      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.chrome-parity.test.tsx": 391,
-      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.dead-guest.test.tsx": 346,
-      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.download-notices.test.tsx": 295,
-      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.drag-focus.test.tsx": 551,
-      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.failure-remount.test.tsx": 274,
-      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.popup-notices.test.tsx": 111,
-      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.test.tsx": 370,
-      "src/renderer/src/components/browser-pane/ReopenBrowserPageOnServerButton.test.tsx": 102,
-      "src/renderer/src/components/browser-pane/annotate/BrowserAnnotationSendMenuContent.test.tsx": 10,
-      "src/renderer/src/components/browser-pane/annotate/GrabConfirmationSheet.test.ts": 7,
-      "src/renderer/src/components/browser-pane/annotate/browser-annotation-output.test.ts": 36,
-      "src/renderer/src/components/browser-pane/annotate/browser-page-annotation-tray.test.tsx": 326,
-      "src/renderer/src/components/browser-pane/annotate/markup-drawing-model.test.ts": 15,
-      "src/renderer/src/components/browser-pane/annotate/markup-screenshot-compose.test.ts": 8,
-      "src/renderer/src/components/browser-pane/annotate/markup-shape-render.test.ts": 7,
-      "src/renderer/src/components/browser-pane/annotate/use-markup-draw-hint.test.ts": 17,
-      "src/renderer/src/components/browser-pane/annotate/useGrabMode.test.ts": 369,
-      "src/renderer/src/components/browser-pane/annotate/useMarkupEditor.test.ts": 26,
-      "src/renderer/src/components/browser-pane/annotate/useMarkupPointerHandlers.test.ts": 18,
-      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserAddressBar.test.tsx": 79,
-      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserFind.test.tsx": 152,
-      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.remote-link-routing.test.ts": 6,
-      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.render-ipc.test.ts": 6,
-      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.webview-preferences.test.ts": 20,
-      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserPaneOverlayLayer.test.tsx": 951,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-address-bar-expansion.test.ts": 7,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-address-bar-suggestions.test.ts": 23,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-deferred-lifecycle.test.tsx": 139,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-detected-browsers-summary.test.ts": 4,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-egress-indicator.test.tsx": 234,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-import-hint-visibility.test.ts": 4,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-navigation-control-row.test.tsx": 57,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-pane-page-selection.test.ts": 4,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-workspace-pane.adoption-chrome.test.tsx": 1919,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-workspace-pane.retention-props.test.tsx": 93,
-      "src/renderer/src/components/browser-pane/assemble-chrome/context-menu-positioning.test.ts": 10,
-      "src/renderer/src/components/browser-pane/assemble-chrome/ssh-routed-browser-page-gate.test.tsx": 175,
-      "src/renderer/src/components/browser-pane/assemble-chrome/use-browser-page-chrome-focus.test.tsx": 118,
-      "src/renderer/src/components/browser-pane/browser-client-page-metadata-publisher.test.ts": 262,
-      "src/renderer/src/components/browser-pane/browser-client-page-metadata-route-census.test.ts": 6,
-      "src/renderer/src/components/browser-pane/browser-client-page-position-driver.test.ts": 47,
-      "src/renderer/src/components/browser-pane/browser-client-page-renderer-installation.test.ts": 12,
-      "src/renderer/src/components/browser-pane/browser-client-page-retained-drag-passthrough.test.ts": 57,
-      "src/renderer/src/components/browser-pane/browser-client-page-retained-registry.test.ts": 52,
-      "src/renderer/src/components/browser-pane/browser-download-destination-toast.test.ts": 7,
-      "src/renderer/src/components/browser-pane/browser-reopen-on-server.test.ts": 13,
-      "src/renderer/src/components/browser-pane/describe-page/browser-annotation-geometry.test.ts": 8,
-      "src/renderer/src/components/browser-pane/describe-page/browser-artifact-upload.test.ts": 11,
-      "src/renderer/src/components/browser-pane/describe-page/browser-favicon-url.test.ts": 7,
-      "src/renderer/src/components/browser-pane/describe-page/browser-overlay-shortcut-target.test.ts": 7,
-      "src/renderer/src/components/browser-pane/describe-page/browser-page-url-display.test.ts": 15,
-      "src/renderer/src/components/browser-pane/describe-page/live-browser-url-registry.test.ts": 6,
-      "src/renderer/src/components/browser-pane/host-guest/browser-automation-visibility.test.ts": 16,
-      "src/renderer/src/components/browser-pane/host-guest/browser-focus.test.ts": 9,
-      "src/renderer/src/components/browser-pane/host-guest/browser-guest-eviction-veto.test.ts": 10,
-      "src/renderer/src/components/browser-pane/host-guest/browser-guest-page-id-identity.test.ts": 6,
-      "src/renderer/src/components/browser-pane/host-guest/browser-guest-paint-retention.test.ts": 33,
-      "src/renderer/src/components/browser-pane/host-guest/browser-guest-retention-site-census.test.ts": 592,
-      "src/renderer/src/components/browser-pane/host-guest/browser-guest-worktree-retention.test.ts": 15,
-      "src/renderer/src/components/browser-pane/host-guest/browser-keyboard.test.ts": 20,
-      "src/renderer/src/components/browser-pane/host-guest/browser-page-evicted-guest-recovery.test.ts": 105,
-      "src/renderer/src/components/browser-pane/host-guest/browser-page-favicon-retention.test.ts": 12,
-      "src/renderer/src/components/browser-pane/host-guest/browser-page-guest-recovery.test.ts": 338,
-      "src/renderer/src/components/browser-pane/host-guest/browser-page-paintability.test.ts": 5,
-      "src/renderer/src/components/browser-pane/host-guest/browser-page-viewport.test.ts": 28,
-      "src/renderer/src/components/browser-pane/host-guest/browser-page-webview-surface.test.ts": 21,
-      "src/renderer/src/components/browser-pane/host-guest/browser-page-webview.test.ts": 5,
-      "src/renderer/src/components/browser-pane/host-guest/browser-page-zoom.test.ts": 16,
-      "src/renderer/src/components/browser-pane/host-guest/browser-system-resume.test.ts": 14,
-      "src/renderer/src/components/browser-pane/host-guest/browser-worktree-surface-paintability.test.ts": 6,
-      "src/renderer/src/components/browser-pane/host-guest/use-browser-page-slot-viewport.test.ts": 21,
-      "src/renderer/src/components/browser-pane/host-guest/use-browser-page-viewport-scroll-reporting.test.tsx": 35,
-      "src/renderer/src/components/browser-pane/host-guest/use-webview-drag-passthrough-active.test.tsx": 35,
-      "src/renderer/src/components/browser-pane/host-guest/webview-registry.test.ts": 44,
-      "src/renderer/src/components/browser-pane/navigate/browser-address-bar-navigation.test.ts": 12,
-      "src/renderer/src/components/browser-pane/navigate/browser-download-progress.test.ts": 7,
-      "src/renderer/src/components/browser-pane/navigate/browser-load-failure-overlay.test.tsx": 150,
-      "src/renderer/src/components/browser-pane/navigate/browser-notices.test.ts": 19,
-      "src/renderer/src/components/browser-pane/navigate/browser-page-download-activity.test.ts": 16,
-      "src/renderer/src/components/browser-pane/navigate/browser-reload-action.test.ts": 9,
-      "src/renderer/src/components/browser-pane/navigate/browser-webview-load-failure.test.ts": 11,
-      "src/renderer/src/components/browser-pane/navigate/chromium-error-page-poll-visibility.test.ts": 40,
-      "src/renderer/src/components/browser-pane/navigate/chromium-error-page-polling.test.ts": 5,
-      "src/renderer/src/components/browser-pane/navigate/use-browser-page-reload-actions.test.tsx": 19,
-      "src/renderer/src/components/browser-pane/restored-client-hosted-recovery-window.test.tsx": 308,
-      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-frame-style.test.ts": 7,
-      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-keyboard.test.ts": 4,
-      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-input-model.test.ts": 8,
-      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.address-bar.test.tsx": 293,
-      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.chrome-chords.test.tsx": 434,
-      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-errors.test.ts": 10,
-      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-lifecycle.test.ts": 61,
-      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-restart-scheduler.test.ts": 12,
-      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-status.test.ts": 6,
-      "src/renderer/src/components/browser-pane/stream-remote/use-remote-browser-page-navigation.test.ts": 37,
-      "src/renderer/src/components/browser-pane/stream-remote/use-remote-browser-stream-activation.test.ts": 54,
-      "src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.failure-message.test.tsx": 2857,
-      "src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx": 4032,
-      "src/renderer/src/components/browser-pane/workspace-doc/doc-preview-document-actions.test.ts": 28,
-      "src/renderer/src/components/browser-pane/workspace-doc/doc-preview-document-identity.test.ts": 8,
-      "src/renderer/src/components/browser-pane/workspace-doc/doc-preview-external-link-confirmation.test.ts": 67,
-      "src/renderer/src/components/browser-pane/workspace-doc/doc-preview-webview-attach.test.ts": 14,
-      "src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.lazy-ref.test.tsx": 29,
-      "src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts": 29,
-      "src/renderer/src/components/browser-pane/workspace-doc/workspace-doc-page-pane.test.tsx": 41,
-      "src/renderer/src/components/browser-profile-user-agent-option.test.tsx": 82,
-      "src/renderer/src/components/browser-webauthn-account-dialog.test.tsx": 166,
-      "src/renderer/src/components/cmd-j/palette-activation-focus-routing.test.ts": 7,
-      "src/renderer/src/components/cmd-j/palette-duplicate-key-ghost-rows.test.tsx": 26,
-      "src/renderer/src/components/cmd-j/palette-filter-option-list.test.ts": 15,
-      "src/renderer/src/components/cmd-j/palette-filter-options.test.ts": 23,
-      "src/renderer/src/components/cmd-j/palette-filter.test.ts": 12,
-      "src/renderer/src/components/cmd-j/palette-focus-restore-target.test.ts": 11,
-      "src/renderer/src/components/cmd-j/palette-host-badge.test.ts": 15,
-      "src/renderer/src/components/cmd-j/palette-list-entry-render-keys.test.ts": 6,
-      "src/renderer/src/components/cmd-j/palette-live-status.test.tsx": 183,
-      "src/renderer/src/components/cmd-j/palette-query-tokens.test.ts": 9,
-      "src/renderer/src/components/cmd-j/palette-results.test.ts": 42,
-      "src/renderer/src/components/cmd-j/palette-section-render-cap.test.ts": 12,
-      "src/renderer/src/components/cmd-j/palette-session-age.test.ts": 16,
-      "src/renderer/src/components/cmd-j/plugin-quick-actions.test.ts": 9,
-      "src/renderer/src/components/cmd-j/quick-action-context.test.ts": 20,
-      "src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts": 27,
-      "src/renderer/src/components/cmd-j/worktree-palette-cache-inputs.test.ts": 5,
-      "src/renderer/src/components/codex-restart-chip.test.tsx": 120,
-      "src/renderer/src/components/codex-restart-notice-key.test.ts": 4,
-      "src/renderer/src/components/comment-code-context-state.test.ts": 5,
-      "src/renderer/src/components/comment-reply-target-state.test.ts": 6,
-      "src/renderer/src/components/confirmation-dialog-refresh-boundary.test.ts": 44,
-      "src/renderer/src/components/confirmation-dialog.test.tsx": 445,
-      "src/renderer/src/components/confirmation-skip-preference.test.ts": 109,
-      "src/renderer/src/components/contextual-tours/ContextualTourControl.test.ts": 8,
-      "src/renderer/src/components/contextual-tours/ContextualTourOverlay.remeasure.test.tsx": 313,
-      "src/renderer/src/components/contextual-tours/ContextualTourOverlay.test.tsx": 136,
-      "src/renderer/src/components/contextual-tours/ContextualTourOverlay.visibility.test.tsx": 2421,
-      "src/renderer/src/components/contextual-tours/ContextualTourOverlaySurface.localization.test.tsx": 191,
-      "src/renderer/src/components/contextual-tours/contextual-tour-floating-position.test.ts": 1879,
-      "src/renderer/src/components/contextual-tours/contextual-tour-gate.test.ts": 14,
-      "src/renderer/src/components/contextual-tours/contextual-tour-overlay-measurement.test.ts": 91,
-      "src/renderer/src/components/contextual-tours/contextual-tour-step-actions.test.ts": 6,
-      "src/renderer/src/components/contextual-tours/request-contextual-tour-when-ready.test.ts": 15,
-      "src/renderer/src/components/contextual-tours/use-contextual-tour.test.ts": 8,
-      "src/renderer/src/components/contextual-tours/workspace-creation-tour-handoff.test.ts": 9,
-      "src/renderer/src/components/crash-report/CrashReportDialogSurface.overflow.test.tsx": 109,
-      "src/renderer/src/components/crash-report/crash-report-submit-notice.test.ts": 13,
-      "src/renderer/src/components/crash-report/use-crash-report-copy.test.tsx": 21,
-      "src/renderer/src/components/dashboard-popout/AgentKanbanBoard.test.tsx": 469,
-      "src/renderer/src/components/dashboard-popout/AgentKanbanCard.test.tsx": 393,
-      "src/renderer/src/components/dashboard-popout/AgentTerminalDialog.test.tsx": 234,
-      "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.clipboard-routes.test.tsx": 1314,
-      "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx": 149,
-      "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx": 1273,
-      "src/renderer/src/components/dashboard-popout/DashboardHostBadge.test.tsx": 64,
-      "src/renderer/src/components/dashboard-popout/DashboardPopoutRoot.test.tsx": 26,
-      "src/renderer/src/components/dashboard-popout/agent-board-filtering.test.ts": 8,
-      "src/renderer/src/components/dashboard-popout/dashboard-agent-status-patch.test.ts": 9,
-      "src/renderer/src/components/dashboard-popout/preview-grid-claim.test.ts": 18,
-      "src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts": 228,
-      "src/renderer/src/components/dashboard-popout/preview-terminal-options.test.ts": 11,
-      "src/renderer/src/components/dashboard-popout/preview-terminal-right-click-paste.test.ts": 63,
-      "src/renderer/src/components/dashboard-popout/preview-terminal-shortcuts.test.ts": 13,
-      "src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts": 11,
-      "src/renderer/src/components/dashboard-popout/terminal-preview-unavailable-message.test.ts": 10,
-      "src/renderer/src/components/dashboard-popout/useDashboardSnapshot.test.tsx": 59,
-      "src/renderer/src/components/dashboard/AgentDashboardDrawer.test.tsx": 227,
-      "src/renderer/src/components/dashboard/AgentDashboardSettingsMenu.test.tsx": 68,
-      "src/renderer/src/components/dashboard/DashboardAgentRow.test.tsx": 97,
-      "src/renderer/src/components/dashboard/agent-dashboard-performance-isolation.test.ts": 6,
-      "src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts": 5,
-      "src/renderer/src/components/dashboard/agent-row-lineage-model.test.ts": 6,
-      "src/renderer/src/components/dashboard/agent-row-pane-live-title.test.ts": 7,
-      "src/renderer/src/components/dashboard/build-dashboard-bucket-counts.allocation.test.ts": 97,
-      "src/renderer/src/components/dashboard/build-dashboard-bucket-counts.cache.test.ts": 11,
-      "src/renderer/src/components/dashboard/build-dashboard-bucket-counts.equivalence.test.ts": 40,
-      "src/renderer/src/components/dashboard/build-dashboard-snapshot-folder-workspace.test.ts": 21,
-      "src/renderer/src/components/dashboard/build-dashboard-snapshot-orchestration-routing.test.ts": 15,
-      "src/renderer/src/components/dashboard/build-dashboard-snapshot.rows-cache.test.ts": 30,
-      "src/renderer/src/components/dashboard/build-dashboard-snapshot.test.ts": 34,
-      "src/renderer/src/components/dashboard/dashboard-card-context.test.ts": 14,
-      "src/renderer/src/components/dashboard/dashboard-card-labels.test.ts": 5,
-      "src/renderer/src/components/dashboard/dashboard-card-terminal-input.test.ts": 11,
-      "src/renderer/src/components/dashboard/dashboard-worktree-launch-options.test.ts": 19,
-      "src/renderer/src/components/dashboard/launch-dashboard-agent.test.ts": 7,
-      "src/renderer/src/components/dashboard/use-agent-row-conversation-name.test.ts": 10,
-      "src/renderer/src/components/dashboard/useAgentBucketCounts.gate.test.ts": 46,
-      "src/renderer/src/components/dashboard/useAgentBucketCounts.test.tsx": 35,
-      "src/renderer/src/components/dashboard/useDashboardPopoutBridge.test.tsx": 57,
-      "src/renderer/src/components/dashboard/useLiveDashboardSnapshot.test.ts": 63,
-      "src/renderer/src/components/dashboard/useRetainedAgents.test.ts": 66,
-      "src/renderer/src/components/dashboard/useRetainedAgentsSync.test.ts": 6,
-      "src/renderer/src/components/dictation/DictationIndicator.localization.test.ts": 7,
-      "src/renderer/src/components/dictation/DictationIndicator.test.tsx": 86,
-      "src/renderer/src/components/dictation/dictation-audio-meter.test.ts": 5,
-      "src/renderer/src/components/dictation/dictation-final-segments.test.ts": 5,
-      "src/renderer/src/components/dictation/dictation-insertion-target.test.ts": 288,
-      "src/renderer/src/components/dictation/dictation-meter-store.test.tsx": 15,
-      "src/renderer/src/components/dictation/dictation-stopped-sessions.test.ts": 9,
-      "src/renderer/src/components/dictation/microphone-devices.test.ts": 16,
-      "src/renderer/src/components/dictation/use-hold-dictation-gesture.test.tsx": 43,
-      "src/renderer/src/components/diff-comments/DiffCommentCard.resize.test.tsx": 127,
-      "src/renderer/src/components/diff-comments/diff-comment-popover-outside-click.test.tsx": 59,
-      "src/renderer/src/components/diff-comments/diff-comment-popover-position.test.ts": 8,
-      "src/renderer/src/components/diff-comments/diff-comment-zone-mouse-events.test.ts": 5,
-      "src/renderer/src/components/diff-comments/useDiffCommentDecorator.commentable-lines.test.tsx": 43,
-      "src/renderer/src/components/diff-comments/useDiffCommentDecorator.model-lifecycle.test.tsx": 28,
-      "src/renderer/src/components/editor/ChangesModeView.test.tsx": 27,
-      "src/renderer/src/components/editor/CheckRunCopyButton.test.tsx": 70,
-      "src/renderer/src/components/editor/CheckRunDetailsPanel.copy.test.tsx": 116,
-      "src/renderer/src/components/editor/ConflictComponents.test.tsx": 4,
-      "src/renderer/src/components/editor/EditorContent.markdown-classification.test.tsx": 60,
-      "src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx": 49,
-      "src/renderer/src/components/editor/EditorContent.test.tsx": 37,
-      "src/renderer/src/components/editor/EditorPanel.markdown-classification-memoization.test.tsx": 462,
-      "src/renderer/src/components/editor/EditorPanelHeader.test.tsx": 34,
-      "src/renderer/src/components/editor/EditorPanelMarkdownActionsMenu.test.tsx": 21,
-      "src/renderer/src/components/editor/EditorPanelShell.header.test.tsx": 18,
-      "src/renderer/src/components/editor/ExternalFileChangeBanner.test.tsx": 56,
-      "src/renderer/src/components/editor/ExternalFileChangeCompareDialog.test.tsx": 186,
-      "src/renderer/src/components/editor/ImageViewer.test.tsx": 105,
-      "src/renderer/src/components/editor/LargeDiffLoadPrompt.test.tsx": 42,
-      "src/renderer/src/components/editor/MarkdownPreview.link-routing.interaction.test.tsx": 106,
-      "src/renderer/src/components/editor/MarkdownPreview.test.ts": 9,
-      "src/renderer/src/components/editor/MarkdownPreview.toc-visibility-gate.test.tsx": 107,
-      "src/renderer/src/components/editor/MarkdownTableOfContentsPanel.test.tsx": 23,
-      "src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx": 56,
-      "src/renderer/src/components/editor/MonacoEditor.font-family.test.tsx": 46,
-      "src/renderer/src/components/editor/NotesSendMenu.test.tsx": 34,
-      "src/renderer/src/components/editor/ReviewNotesSendMenuContent.test.tsx": 30,
-      "src/renderer/src/components/editor/RichMarkdownErrorBoundary.lazy-chunk.test.tsx": 104,
-      "src/renderer/src/components/editor/RichMarkdownLinkBubble.render.test.tsx": 106,
-      "src/renderer/src/components/editor/RichMarkdownLinkBubble.test.ts": 3,
-      "src/renderer/src/components/editor/RichMarkdownSearchBar.ime-enter.test.tsx": 187,
-      "src/renderer/src/components/editor/RichMarkdownSlashMenu.test.tsx": 14,
-      "src/renderer/src/components/editor/RichMarkdownTableControls.test.tsx": 272,
-      "src/renderer/src/components/editor/check-annotation-open.test.ts": 9,
-      "src/renderer/src/components/editor/check-annotation-path.test.ts": 10,
-      "src/renderer/src/components/editor/check-job-step-status.test.ts": 5,
-      "src/renderer/src/components/editor/check-run-clipboard-text.test.ts": 8,
-      "src/renderer/src/components/editor/check-run-details-fix-with-ai.test.ts": 16,
-      "src/renderer/src/components/editor/check-run-details-tab.test.ts": 7,
-      "src/renderer/src/components/editor/closed-editor-tab-cache-sweep.test.ts": 10,
-      "src/renderer/src/components/editor/closed-editor-tab-disposal.test.ts": 48,
-      "src/renderer/src/components/editor/combined-diff-on-demand-load.test.ts": 9,
-      "src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-collapsed-work.test.tsx": 96,
-      "src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-render.test.tsx": 241,
-      "src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-windowing.test.tsx": 212,
-      "src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree.test.ts": 13,
-      "src/renderer/src/components/editor/combined-diff/browse-files/use-combined-diff-file-tree-resize.test.tsx": 44,
-      "src/renderer/src/components/editor/combined-diff/browse-files/use-combined-diff-tree-navigation.test.ts": 17,
-      "src/renderer/src/components/editor/combined-diff/load-sections/combined-diff-initial-section-load.test.ts": 5,
-      "src/renderer/src/components/editor/combined-diff/load-sections/combined-diff-load-scheduler.test.ts": 7,
-      "src/renderer/src/components/editor/combined-diff/load-sections/combined-diff-section-connection.test.ts": 11,
-      "src/renderer/src/components/editor/combined-diff/load-sections/combined-diff-section-load-state.test.ts": 10,
-      "src/renderer/src/components/editor/combined-diff/remember-view/use-combined-diff-view-restore.test.tsx": 29,
-      "src/renderer/src/components/editor/combined-diff/resolve-changes/combined-diff-entries.test.ts": 12,
-      "src/renderer/src/components/editor/combined-diff/resolve-changes/combined-diff-section-cache-match.test.ts": 5,
-      "src/renderer/src/components/editor/combined-diff/resolve-changes/combined-diff-section-scaling.test.tsx": 157,
-      "src/renderer/src/components/editor/combined-diff/resolve-changes/use-combined-diff-section-index-map.test.tsx": 23,
-      "src/renderer/src/components/editor/combined-diff/review-controls/combined-diff-commit-message.test.ts": 17,
-      "src/renderer/src/components/editor/combined-diff/scroll-viewport/combined-diff-restore-signal-equivalence.test.tsx": 291,
-      "src/renderer/src/components/editor/combined-diff/scroll-viewport/combined-diff-scrollbar-drag.test.ts": 8,
-      "src/renderer/src/components/editor/csv-parse.test.ts": 38,
-      "src/renderer/src/components/editor/details-markdown-html.test.ts": 24,
-      "src/renderer/src/components/editor/diff-editor-line-number-options.test.ts": 8,
-      "src/renderer/src/components/editor/diff-editor-shift-wheel-scroll.test.ts": 14,
-      "src/renderer/src/components/editor/diff-editor-whitespace-options.test.ts": 6,
-      "src/renderer/src/components/editor/diff-editor-word-wrap-options.test.ts": 4,
-      "src/renderer/src/components/editor/diff-line-stats.test.ts": 10,
-      "src/renderer/src/components/editor/diff-model-swap-view-state.test.ts": 8,
-      "src/renderer/src/components/editor/diff-monaco-model-disposal.test.ts": 12,
-      "src/renderer/src/components/editor/diff-navigation-context.test.tsx": 45,
-      "src/renderer/src/components/editor/diff-section-layout.test.ts": 30,
-      "src/renderer/src/components/editor/diff-section-preview.test.ts": 9,
-      "src/renderer/src/components/editor/diff-viewer-large-diff-save-action.test.ts": 7,
-      "src/renderer/src/components/editor/editor-autosave-conflict-flow.test.ts": 37,
-      "src/renderer/src/components/editor/editor-autosave-controller.test.ts": 40,
-      "src/renderer/src/components/editor/editor-autosave.test.ts": 17,
-      "src/renderer/src/components/editor/editor-cmd-save-target.test.ts": 10,
-      "src/renderer/src/components/editor/editor-content-dirty-state.test.ts": 21,
-      "src/renderer/src/components/editor/editor-external-watch-path-index.test.ts": 9,
-      "src/renderer/src/components/editor/editor-file-save-attempt.test.ts": 11,
-      "src/renderer/src/components/editor/editor-header.test.ts": 8,
-      "src/renderer/src/components/editor/editor-labels.test.ts": 6,
-      "src/renderer/src/components/editor/editor-panel-diff-reload.test.ts": 8,
-      "src/renderer/src/components/editor/editor-panel-draft-selector.test.ts": 20,
-      "src/renderer/src/components/editor/editor-panel-git-entry-selector.test.ts": 24,
-      "src/renderer/src/components/editor/editor-panel-render-model.test.ts": 29,
-      "src/renderer/src/components/editor/editor-path-move-inflight.test.ts": 9,
-      "src/renderer/src/components/editor/editor-restored-tab-conflict-scan.test.ts": 38,
-      "src/renderer/src/components/editor/editor-self-write-registry.test.ts": 20,
-      "src/renderer/src/components/editor/editor-shortcuts.test.ts": 23,
-      "src/renderer/src/components/editor/export-active-markdown.test.ts": 7,
-      "src/renderer/src/components/editor/file-editor-word-wrap-options.test.ts": 4,
-      "src/renderer/src/components/editor/image-viewer-zoom.test.ts": 10,
-      "src/renderer/src/components/editor/ipynb-code-cell-lines.test.ts": 138,
-      "src/renderer/src/components/editor/ipynb-parse.test.ts": 26,
-      "src/renderer/src/components/editor/large-diff-render-limit.test.ts": 103,
-      "src/renderer/src/components/editor/line-copy-path.test.ts": 5,
-      "src/renderer/src/components/editor/local-log-tail-decoder.test.ts": 8,
-      "src/renderer/src/components/editor/markdown-artifact-upload.test.ts": 7,
-      "src/renderer/src/components/editor/markdown-dirty-state.test.ts": 154,
-      "src/renderer/src/components/editor/markdown-doc-completions.test.ts": 11,
-      "src/renderer/src/components/editor/markdown-doc-links.test.ts": 29,
-      "src/renderer/src/components/editor/markdown-document-list-request.test.ts": 14,
-      "src/renderer/src/components/editor/markdown-document-worktree-path-selector.test.ts": 758,
-      "src/renderer/src/components/editor/markdown-export-extract.test.ts": 21,
-      "src/renderer/src/components/editor/markdown-export-html.test.ts": 5,
-      "src/renderer/src/components/editor/markdown-frontmatter.test.ts": 7,
-      "src/renderer/src/components/editor/markdown-heading-slug.test.ts": 6,
-      "src/renderer/src/components/editor/markdown-internal-links.test.ts": 10,
-      "src/renderer/src/components/editor/markdown-preview-annotation-shortcut.test.ts": 25,
-      "src/renderer/src/components/editor/markdown-preview-controls.test.ts": 10,
-      "src/renderer/src/components/editor/markdown-preview-links.test.ts": 8,
-      "src/renderer/src/components/editor/markdown-preview-local-images.test.ts": 67,
-      "src/renderer/src/components/editor/markdown-preview-search-crash.test.tsx": 24,
-      "src/renderer/src/components/editor/markdown-preview-search.test.ts": 16,
-      "src/renderer/src/components/editor/markdown-preview-url-transform.test.ts": 14,
-      "src/renderer/src/components/editor/markdown-reference-link-normalization.test.ts": 25,
-      "src/renderer/src/components/editor/markdown-render-mode.test.ts": 5,
-      "src/renderer/src/components/editor/markdown-rich-mode-eligibility-cache.test.ts": 225,
-      "src/renderer/src/components/editor/markdown-rich-mode.test.ts": 276,
-      "src/renderer/src/components/editor/markdown-rich-size-limit.test.ts": 7,
-      "src/renderer/src/components/editor/markdown-round-trip.test.ts": 388,
-      "src/renderer/src/components/editor/markdown-table-of-contents.test.ts": 57,
-      "src/renderer/src/components/editor/markdown-toc-collapse-state.test.ts": 5,
-      "src/renderer/src/components/editor/markdown-toc-visibility-gate.test.ts": 18,
-      "src/renderer/src/components/editor/mermaid-config.test.ts": 6,
-      "src/renderer/src/components/editor/monaco-auto-height.test.ts": 42,
-      "src/renderer/src/components/editor/monaco-codebase-search.test.ts": 8,
-      "src/renderer/src/components/editor/monaco-conflict-decorations.test.ts": 12,
-      "src/renderer/src/components/editor/monaco-content-sync.test.ts": 14,
-      "src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts": 44,
-      "src/renderer/src/components/editor/monaco-context-menu-paste.test.ts": 59,
-      "src/renderer/src/components/editor/monaco-find-options.test.ts": 5,
-      "src/renderer/src/components/editor/monaco-find-widget.test.ts": 12,
-      "src/renderer/src/components/editor/monaco-large-text-paste.test.ts": 19,
-      "src/renderer/src/components/editor/monaco-markdown-doc-link-decorations.offset-scan.test.ts": 72,
-      "src/renderer/src/components/editor/monaco-markdown-doc-link-decorations.test.ts": 15,
-      "src/renderer/src/components/editor/monaco-markdown-selection-annotation.test.ts": 9,
-      "src/renderer/src/components/editor/monaco-programmatic-sync.test.ts": 5,
-      "src/renderer/src/components/editor/monaco-reveal-range.test.ts": 4,
-      "src/renderer/src/components/editor/monaco-view-state-persistence.test.ts": 5,
-      "src/renderer/src/components/editor/pdf-scale-preference.test.ts": 8,
-      "src/renderer/src/components/editor/pdf-view-position.test.ts": 19,
-      "src/renderer/src/components/editor/pending-editor-focus-request.test.ts": 6,
-      "src/renderer/src/components/editor/position-stable-node-view-update.test.ts": 7,
-      "src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts": 321,
-      "src/renderer/src/components/editor/rich-markdown-auto-focus.test.ts": 12,
-      "src/renderer/src/components/editor/rich-markdown-code-block-languages.test.ts": 8,
-      "src/renderer/src/components/editor/rich-markdown-commands.test.ts": 95,
-      "src/renderer/src/components/editor/rich-markdown-context-command-routing.test.ts": 56,
-      "src/renderer/src/components/editor/rich-markdown-cut.test.ts": 142,
-      "src/renderer/src/components/editor/rich-markdown-details-keyboard.test.ts": 83,
-      "src/renderer/src/components/editor/rich-markdown-doc-link.test.ts": 7,
-      "src/renderer/src/components/editor/rich-markdown-editor-click-routing.test.ts": 13,
-      "src/renderer/src/components/editor/rich-markdown-editor-config.test.ts": 15,
-      "src/renderer/src/components/editor/rich-markdown-empty-paragraph-delete.test.ts": 57,
-      "src/renderer/src/components/editor/rich-markdown-html-superscript-link.test.ts": 581,
-      "src/renderer/src/components/editor/rich-markdown-image-insert-code-block.test.ts": 270,
-      "src/renderer/src/components/editor/rich-markdown-image-insert.test.ts": 54,
-      "src/renderer/src/components/editor/rich-markdown-inline-image-paragraph.test.ts": 90,
-      "src/renderer/src/components/editor/rich-markdown-key-handler.test.ts": 83,
-      "src/renderer/src/components/editor/rich-markdown-large-text-paste.test.ts": 17,
-      "src/renderer/src/components/editor/rich-markdown-link-clipboard.test.ts": 7,
-      "src/renderer/src/components/editor/rich-markdown-link-shortcut.test.ts": 96,
-      "src/renderer/src/components/editor/rich-markdown-list-continuation.test.ts": 35,
-      "src/renderer/src/components/editor/rich-markdown-list-tokenizers.test.ts": 11,
-      "src/renderer/src/components/editor/rich-markdown-local-image.test.ts": 128,
-      "src/renderer/src/components/editor/rich-markdown-lowlight-cache.test.ts": 80,
-      "src/renderer/src/components/editor/rich-markdown-lowlight.test.ts": 2575,
-      "src/renderer/src/components/editor/rich-markdown-normalize.test.ts": 43,
-      "src/renderer/src/components/editor/rich-markdown-paragraph.test.ts": 9,
-      "src/renderer/src/components/editor/rich-markdown-paste-handler.test.ts": 8,
-      "src/renderer/src/components/editor/rich-markdown-paste-image.test.ts": 11,
-      "src/renderer/src/components/editor/rich-markdown-range-bounds.test.ts": 66,
-      "src/renderer/src/components/editor/rich-markdown-review-annotations.test.ts": 15,
-      "src/renderer/src/components/editor/rich-markdown-review-note-layout.test.ts": 6,
-      "src/renderer/src/components/editor/rich-markdown-review-rail-blocks.test.ts": 203,
-      "src/renderer/src/components/editor/rich-markdown-review-text-ranges.test.ts": 26,
-      "src/renderer/src/components/editor/rich-markdown-search-matches-cache.test.ts": 38,
-      "src/renderer/src/components/editor/rich-markdown-search.test.ts": 10,
-      "src/renderer/src/components/editor/rich-markdown-serialization-commit.test.ts": 21,
-      "src/renderer/src/components/editor/rich-markdown-slash-command-filter.test.ts": 7,
-      "src/renderer/src/components/editor/rich-markdown-source-reconcile.test.ts": 332,
-      "src/renderer/src/components/editor/rich-markdown-tab-key-handler.test.ts": 130,
-      "src/renderer/src/components/editor/rich-markdown-table-actions.test.ts": 475,
-      "src/renderer/src/components/editor/rich-markdown-table-control-layout.test.ts": 4,
-      "src/renderer/src/components/editor/rich-markdown-table-keyboard.test.ts": 105,
-      "src/renderer/src/components/editor/rich-markdown-terminal-path-paste.test.ts": 11,
-      "src/renderer/src/components/editor/rich-markdown-toc-heading-target.test.ts": 11,
-      "src/renderer/src/components/editor/selection-copy.test.ts": 8,
-      "src/renderer/src/components/editor/setup-contextual-copy.test.ts": 10,
-      "src/renderer/src/components/editor/untitled-file-rename-path.test.ts": 6,
-      "src/renderer/src/components/editor/use-monaco-editor-decorations.doc-link-refresh.test.tsx": 42,
-      "src/renderer/src/components/editor/use-rich-markdown-table-context-menu.test.tsx": 86,
-      "src/renderer/src/components/editor/use-rich-markdown-table-control-target.test.tsx": 83,
-      "src/renderer/src/components/editor/useDiffViewerLargeDiffLifecycle.test.tsx": 16,
-      "src/renderer/src/components/editor/useEditorCmdSaveRequest.test.tsx": 34,
-      "src/renderer/src/components/editor/useEditorPanelContentState.test.tsx": 823,
-      "src/renderer/src/components/editor/useEditorPanelExternalContentEvents.test.tsx": 32,
-      "src/renderer/src/components/editor/useEditorPanelFileLoadRetry.test.tsx": 53,
-      "src/renderer/src/components/editor/useEditorPanelRemoteSiblingContentState.test.tsx": 25,
-      "src/renderer/src/components/editor/useEditorPanelVisibilityContentState.test.tsx": 151,
-      "src/renderer/src/components/editor/useIpynbCellExecution.test.tsx": 78,
-      "src/renderer/src/components/editor/useIpynbDocumentEditing.test.tsx": 29,
-      "src/renderer/src/components/editor/useLinkBubble.test.tsx": 37,
-      "src/renderer/src/components/editor/useLocalImageSrc.test.ts": 74,
-      "src/renderer/src/components/editor/useLocalLogTail.test.tsx": 234,
-      "src/renderer/src/components/editor/useMarkdownDocuments.test.ts": 9,
-      "src/renderer/src/components/editor/useRichMarkdownEditorInstance.integration.test.tsx": 71,
-      "src/renderer/src/components/editor/useRichMarkdownEditorInstance.test.tsx": 23,
-      "src/renderer/src/components/editor/useRichMarkdownPendingFocus.test.ts": 20,
-      "src/renderer/src/components/editor/useRichMarkdownProgrammaticSync.test.ts": 77,
-      "src/renderer/src/components/editor/useRichMarkdownReviewController.open-guard.test.ts": 17,
-      "src/renderer/src/components/editor/useRichMarkdownSearch.reuse.test.tsx": 55,
-      "src/renderer/src/components/editor/useRichMarkdownSearch.test.tsx": 31,
-      "src/renderer/src/components/emulator-pane/MobileEmulatorTabIntroCallout.test.tsx": 60,
-      "src/renderer/src/components/emulator-pane/emulator-device-frame-layout.test.ts": 10,
-      "src/renderer/src/components/emulator-pane/emulator-device-frame-visibility.test.tsx": 158,
-      "src/renderer/src/components/emulator-pane/emulator-device-frame.input.test.tsx": 188,
-      "src/renderer/src/components/emulator-pane/emulator-device-state.test.ts": 5,
-      "src/renderer/src/components/emulator-pane/emulator-keyboard-paste.test.ts": 16,
-      "src/renderer/src/components/emulator-pane/emulator-screen-gesture.test.ts": 11,
-      "src/renderer/src/components/emulator-pane/emulator-screen-stream-content.test.tsx": 43,
-      "src/renderer/src/components/emulator-pane/mobile-emulator-agent-setup-cli-state.test.ts": 6,
-      "src/renderer/src/components/emulator-pane/mobile-emulator-agent-setup-visibility.test.ts": 4,
-      "src/renderer/src/components/emulator-pane/mobile-emulator-hidden-toast.test.tsx": 10,
-      "src/renderer/src/components/emulator-pane/mobile-emulator-tab-intro-visibility.test.ts": 7,
-      "src/renderer/src/components/emulator-pane/use-emulator-pane-session.test.tsx": 53,
-      "src/renderer/src/components/emulator-pane/use-mobile-emulator-tab-intro-actions.test.tsx": 43,
-      "src/renderer/src/components/error-boundaries/RecoverableRenderErrorBoundary.lazy-chunk.test.tsx": 86,
-      "src/renderer/src/components/error-boundaries/RecoverableRenderErrorBoundary.never-landed-reload.test.tsx": 51,
-      "src/renderer/src/components/error-boundaries/react-185-bystander-attribution.test.tsx": 100,
-      "src/renderer/src/components/feature-interaction-writer-boundaries.test.ts": 16,
-      "src/renderer/src/components/feature-tips/CliSkillSetupTerminal.test.tsx": 33,
-      "src/renderer/src/components/feature-tips/CmdJPaletteFeatureTipVisual.test.tsx": 71,
-      "src/renderer/src/components/feature-tips/CmdJPaletteTipDialog.test.tsx": 35,
-      "src/renderer/src/components/feature-tips/VoiceDictationFeatureTipVisual.test.tsx": 72,
-      "src/renderer/src/components/feature-tips/VoiceDictationTipDialog.test.tsx": 44,
-      "src/renderer/src/components/feature-tips/feature-tip-cli-install-action.test.ts": 9,
-      "src/renderer/src/components/feature-tips/feature-tip-modal-state.test.ts": 10,
-      "src/renderer/src/components/feature-tips/feature-tip-startup-gate.test.ts": 12,
-      "src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts": 8,
-      "src/renderer/src/components/feature-wall/AgentCapabilitiesSetupAction.test.ts": 6,
-      "src/renderer/src/components/feature-wall/ConnectIntegrationsList.test.tsx": 181,
-      "src/renderer/src/components/feature-wall/FeatureWallSetupWorkflowActions.test.tsx": 74,
-      "src/renderer/src/components/feature-wall/FullDiskAccessSetupPrompt.test.ts": 113,
-      "src/renderer/src/components/feature-wall/KeepAwakeCard.test.tsx": 99,
-      "src/renderer/src/components/feature-wall/browser-animated-visual-sequence.test.ts": 6,
-      "src/renderer/src/components/feature-wall/feature-wall-animation-visibility.test.tsx": 163,
-      "src/renderer/src/components/feature-wall/feature-wall-rail-navigation.test.ts": 9,
-      "src/renderer/src/components/feature-wall/feature-wall-setup-checklist-localized-copy.test.ts": 9,
-      "src/renderer/src/components/feature-wall/feature-wall-setup-progress.test.ts": 12,
-      "src/renderer/src/components/feature-wall/feature-wall-shortcut-labels.test.tsx": 72,
-      "src/renderer/src/components/feature-wall/feature-wall-usage-tracking.test.ts": 13,
-      "src/renderer/src/components/feature-wall/use-feature-wall-completion.test.ts": 8,
-      "src/renderer/src/components/feature-wall/use-feature-wall-tour-telemetry.test.ts": 8,
-      "src/renderer/src/components/feature-wall/use-integration-connection-status.test.ts": 15,
-      "src/renderer/src/components/feature-wall/workbench-terminal-storyboard-sequence.test.ts": 9,
-      "src/renderer/src/components/file-path-cursor-tooltip.test.ts": 5,
-      "src/renderer/src/components/floating-terminal/FloatingBrowserSlot.test.tsx": 35,
-      "src/renderer/src/components/floating-terminal/FloatingTerminalOrchestrationDialog.freshness.test.tsx": 163,
-      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.bounds.test.tsx": 365,
-      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.empty-state.test.tsx": 526,
-      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.focus.test.tsx": 615,
-      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.markdown-editor.test.tsx": 782,
-      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.shortcuts.test.tsx": 878,
-      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tab-lifecycle.test.tsx": 693,
-      "src/renderer/src/components/floating-terminal/FloatingTerminalToggleButton.test.tsx": 84,
-      "src/renderer/src/components/floating-terminal/FloatingTerminalWindowControls.test.tsx": 10,
-      "src/renderer/src/components/floating-terminal/floating-terminal-panel-bounds.test.ts": 17,
-      "src/renderer/src/components/floating-terminal/floating-terminal-panel-inputs.test.ts": 6,
-      "src/renderer/src/components/floating-terminal/floating-terminal-panel-view-state.test.ts": 9,
-      "src/renderer/src/components/floating-terminal/floating-terminal-trigger-position.test.ts": 17,
-      "src/renderer/src/components/floating-terminal/floating-workspace-tab-reorder.test.ts": 73,
-      "src/renderer/src/components/floating-terminal/terminal-pane-handle-registry.test.ts": 11,
-      "src/renderer/src/components/github-body-draft-state.test.ts": 5,
-      "src/renderer/src/components/github-checks-tab-state.test.ts": 11,
-      "src/renderer/src/components/github-enterprise-slug-routing-boundary.test.ts": 6,
-      "src/renderer/src/components/github-item-dialog-source-boundary.test.ts": 13,
-      "src/renderer/src/components/github-item-dialog/inspect-pull-request/pr-files-combined-diff-section-index.test.tsx": 49,
-      "src/renderer/src/components/github-link-copy-state.test.ts": 6,
-      "src/renderer/src/components/github-pr-merge-state.test.ts": 25,
-      "src/renderer/src/components/github-pr-reviewer-display.test.ts": 11,
-      "src/renderer/src/components/github-project/GhAuthErrorHelp.test.ts": 57,
-      "src/renderer/src/components/github-project/ProjectRoadmap.test.tsx": 257,
-      "src/renderer/src/components/github-project/github-project-picker-filter.test.ts": 10,
-      "src/renderer/src/components/github-project/group-sort.test.ts": 13,
-      "src/renderer/src/components/github-project/project-dialog-state.test.ts": 10,
-      "src/renderer/src/components/github-project/project-picker-browse-cache.test.ts": 14,
-      "src/renderer/src/components/github-project/project-picker-input.test.ts": 10,
-      "src/renderer/src/components/github-project/project-row-filtering.test.ts": 14,
-      "src/renderer/src/components/github-project/project-view-wrapper-source-context-boundary.test.ts": 11,
-      "src/renderer/src/components/github-project/project-visible-table-cache.test.ts": 6,
-      "src/renderer/src/components/github/PRFilterPickers.test.ts": 6,
-      "src/renderer/src/components/github/github-markdown-image-url.test.ts": 5,
-      "src/renderer/src/components/github/github-mention-option-filter.test.ts": 10,
-      "src/renderer/src/components/github/github-pr-reviewer-candidate-filter.test.ts": 18,
-      "src/renderer/src/components/github/github-user-avatar.test.tsx": 66,
-      "src/renderer/src/components/github/github-work-item-assignee-filter.test.ts": 10,
-      "src/renderer/src/components/github/github-work-item-label-filter.test.ts": 7,
-      "src/renderer/src/components/github/pr-comment-code-context.test.ts": 29,
-      "src/renderer/src/components/github/pr-file-content-size.test.ts": 5,
-      "src/renderer/src/components/github/repro-8784-ghe-avatar-fallback.test.ts": 13,
-      "src/renderer/src/components/github/use-image-input.test.ts": 186,
-      "src/renderer/src/components/hover-reveal-touch-action-visibility.test.ts": 12,
-      "src/renderer/src/components/jira-create-adf.test.ts": 10,
-      "src/renderer/src/components/jira-project-picker-filter.test.ts": 11,
-      "src/renderer/src/components/landing-preflight-dismissal.test.ts": 12,
-      "src/renderer/src/components/landing-preflight-issues.test.ts": 14,
-      "src/renderer/src/components/landing-preflight-runtime-boundary.test.ts": 59,
-      "src/renderer/src/components/linear-api-key-dialog-state.test.ts": 6,
-      "src/renderer/src/components/linear-issue-attribute-filter-coverage-agreement.test.ts": 1157,
-      "src/renderer/src/components/linear-issue-attribute-filter-dropdowns.test.tsx": 1107,
-      "src/renderer/src/components/linear-issue-attribute-filter-primary-team.test.ts": 21,
-      "src/renderer/src/components/linear-issue-attribute-filter-team-ids.test.ts": 22,
-      "src/renderer/src/components/linear-issue-project-selector.test.tsx": 88,
-      "src/renderer/src/components/linear-issue-text-draft-state.test.ts": 4,
-      "src/renderer/src/components/linear-issue-text-save-plan.test.ts": 6,
-      "src/renderer/src/components/linear-issue-view-storage.test.ts": 11,
-      "src/renderer/src/components/linear-issue-workspace-api-parity.test.ts": 9,
-      "src/renderer/src/components/linear-issue-workspace-detail-state.test.tsx": 47,
-      "src/renderer/src/components/linear-issue-workspace-header.test.ts": 5,
-      "src/renderer/src/components/linear-issue-workspace-text.test.ts": 7,
-      "src/renderer/src/components/linear-project-presentation.test.ts": 9,
-      "src/renderer/src/components/linear-project-search-query.test.ts": 5,
-      "src/renderer/src/components/linear-project-view-surfaces.test.tsx": 104,
-      "src/renderer/src/components/linear-scope-selector.test.ts": 8,
-      "src/renderer/src/components/link-actions/LinkActionPopover.test.tsx": 167,
-      "src/renderer/src/components/maintenance/update-card/update-card-error-model.test.ts": 13,
-      "src/renderer/src/components/mobile/MobileHero.test.tsx": 637,
-      "src/renderer/src/components/mobile/MobilePage.test.tsx": 685,
-      "src/renderer/src/components/mobile/MobilePageToolbar.test.tsx": 41,
-      "src/renderer/src/components/mobile/NetworkInterfacePicker.test.tsx": 77,
-      "src/renderer/src/components/mobile/WindowsFirewallNotice.test.tsx": 173,
-      "src/renderer/src/components/mobile/mobile-page-stage.test.ts": 4,
-      "src/renderer/src/components/mobile/paired-mobile-devices.test.ts": 5,
-      "src/renderer/src/components/mobile/use-mobile-page-paired-devices.test.ts": 85,
-      "src/renderer/src/components/mobile/use-mobile-pairing-address-preference.test.tsx": 35,
-      "src/renderer/src/components/native-chat/NativeChatAutocompleteMenus.test.tsx": 69,
-      "src/renderer/src/components/native-chat/NativeChatBackgroundTasksStatus.test.tsx": 142,
-      "src/renderer/src/components/native-chat/NativeChatComposer.test.tsx": 164,
-      "src/renderer/src/components/native-chat/NativeChatComposerActions.test.tsx": 64,
-      "src/renderer/src/components/native-chat/NativeChatImageAttachmentPreview.test.tsx": 72,
-      "src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx": 207,
-      "src/renderer/src/components/native-chat/NativeChatMessageList.provider-frame.test.tsx": 20,
-      "src/renderer/src/components/native-chat/NativeChatMessageList.stream-render.perf.test.tsx": 893,
-      "src/renderer/src/components/native-chat/NativeChatMessageList.task-list-frames.test.tsx": 515,
-      "src/renderer/src/components/native-chat/NativeChatMessageList.test.tsx": 376,
-      "src/renderer/src/components/native-chat/NativeChatMessageList.tool-stream-cost.test.tsx": 2900,
-      "src/renderer/src/components/native-chat/NativeChatMessageList.turn-history.test.tsx": 355,
-      "src/renderer/src/components/native-chat/NativeChatMessageList.turn-indicator.test.tsx": 374,
-      "src/renderer/src/components/native-chat/NativeChatMessageList.turn-timing.test.tsx": 126,
-      "src/renderer/src/components/native-chat/NativeChatMessageList.windowing.test.tsx": 3124,
-      "src/renderer/src/components/native-chat/NativeChatMessageRow.test.tsx": 180,
-      "src/renderer/src/components/native-chat/NativeChatMessageTimestamp.test.tsx": 359,
-      "src/renderer/src/components/native-chat/NativeChatNoticeRow.test.tsx": 192,
-      "src/renderer/src/components/native-chat/NativeChatPromptEditor.test.tsx": 137,
-      "src/renderer/src/components/native-chat/NativeChatQuestionCard.test.tsx": 153,
-      "src/renderer/src/components/native-chat/NativeChatResolutionReceipt.test.tsx": 268,
-      "src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.test.tsx": 155,
-      "src/renderer/src/components/native-chat/NativeChatStructuredSession.test.tsx": 509,
-      "src/renderer/src/components/native-chat/NativeChatStructuredSession.transport-probe.test.tsx": 15241,
-      "src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.test.tsx": 15300,
-      "src/renderer/src/components/native-chat/NativeChatSubagentRun.test.tsx": 187,
-      "src/renderer/src/components/native-chat/NativeChatTaskList.test.tsx": 175,
-      "src/renderer/src/components/native-chat/NativeChatToolRun.identity.test.tsx": 253,
-      "src/renderer/src/components/native-chat/NativeChatToolRun.test.tsx": 438,
-      "src/renderer/src/components/native-chat/NativeChatTranscriptChrome.test.tsx": 107,
-      "src/renderer/src/components/native-chat/NativeChatView.test.tsx": 58,
-      "src/renderer/src/components/native-chat/StructuredAgentSessionHandoffChrome.test.tsx": 65,
-      "src/renderer/src/components/native-chat/StructuredAgentSessionPaneOverlayLayer.test.tsx": 49,
-      "src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.test.tsx": 410,
-      "src/renderer/src/components/native-chat/background-task-roster.test.ts": 21,
-      "src/renderer/src/components/native-chat/claude-model-switch-confirmation.test.ts": 14,
-      "src/renderer/src/components/native-chat/claude-terminal-session-options.test.ts": 13,
-      "src/renderer/src/components/native-chat/native-chat-assembler-merge-parity.test.ts": 8,
-      "src/renderer/src/components/native-chat/native-chat-attachment-upload.test.ts": 12,
-      "src/renderer/src/components/native-chat/native-chat-autoscroll.test.ts": 7,
-      "src/renderer/src/components/native-chat/native-chat-availability.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-composer-autogrow.test.tsx": 178,
-      "src/renderer/src/components/native-chat/native-chat-composer-composition.test.tsx": 469,
-      "src/renderer/src/components/native-chat/native-chat-composer-drop-scope.test.tsx": 153,
-      "src/renderer/src/components/native-chat/native-chat-composer-reveal-focus.test.tsx": 71,
-      "src/renderer/src/components/native-chat/native-chat-composer-scope-cache.test.ts": 5,
-      "src/renderer/src/components/native-chat/native-chat-composer-state.test.ts": 25,
-      "src/renderer/src/components/native-chat/native-chat-diff.test.ts": 13,
-      "src/renderer/src/components/native-chat/native-chat-dismiss-key.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-draft-cache.test.ts": 6,
-      "src/renderer/src/components/native-chat/native-chat-file-link.test.ts": 10,
-      "src/renderer/src/components/native-chat/native-chat-font-scale.test.ts": 11,
-      "src/renderer/src/components/native-chat/native-chat-http-link-source-owner.test.ts": 13,
-      "src/renderer/src/components/native-chat/native-chat-image-paste.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-image-runtime-context.test.ts": 8,
-      "src/renderer/src/components/native-chat/native-chat-incremental-assembler.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts": 17,
-      "src/renderer/src/components/native-chat/native-chat-launch-default-adoption.test.ts": 14,
-      "src/renderer/src/components/native-chat/native-chat-launch-draft-resolution.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-launch-draft-send.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-launch-session-options.test.ts": 5,
-      "src/renderer/src/components/native-chat/native-chat-layout-actions.test.ts": 6,
-      "src/renderer/src/components/native-chat/native-chat-leaf-routing.test.ts": 6,
-      "src/renderer/src/components/native-chat/native-chat-live-status.test.ts": 13,
-      "src/renderer/src/components/native-chat/native-chat-message-grouping.test.ts": 8,
-      "src/renderer/src/components/native-chat/native-chat-message-list-projection.test.ts": 11,
-      "src/renderer/src/components/native-chat/native-chat-noise.test.ts": 8,
-      "src/renderer/src/components/native-chat/native-chat-pagination.test.ts": 5,
-      "src/renderer/src/components/native-chat/native-chat-pane-resolution.test.ts": 15,
-      "src/renderer/src/components/native-chat/native-chat-pending-occurrence.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-pending.test.ts": 36,
-      "src/renderer/src/components/native-chat/native-chat-pinned-rows.test.ts": 6,
-      "src/renderer/src/components/native-chat/native-chat-preassembled-session-parity.test.ts": 267,
-      "src/renderer/src/components/native-chat/native-chat-pty-retired-model.test.ts": 12,
-      "src/renderer/src/components/native-chat/native-chat-pty-session-options.test.ts": 235,
-      "src/renderer/src/components/native-chat/native-chat-retire-persisted-model.test.ts": 88,
-      "src/renderer/src/components/native-chat/native-chat-row-height-estimate.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-runtime-owner.test.ts": 7,
-      "src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts": 1210,
-      "src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts": 187,
-      "src/renderer/src/components/native-chat/native-chat-scrape-fallback.test.ts": 11,
-      "src/renderer/src/components/native-chat/native-chat-send-eligibility.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-send.test.ts": 11,
-      "src/renderer/src/components/native-chat/native-chat-session-assembler.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-session-option-enrichment.test.ts": 325,
-      "src/renderer/src/components/native-chat/native-chat-session-option-labels.test.ts": 6,
-      "src/renderer/src/components/native-chat/native-chat-session-transport.test.ts": 49,
-      "src/renderer/src/components/native-chat/native-chat-shared-copy-matches-catalog.test.ts": 5,
-      "src/renderer/src/components/native-chat/native-chat-shortcut.test.ts": 7,
-      "src/renderer/src/components/native-chat/native-chat-split-shortcut.test.ts": 7,
-      "src/renderer/src/components/native-chat/native-chat-stop-layering.test.ts": 4,
-      "src/renderer/src/components/native-chat/native-chat-structured-send-composition-clear.test.tsx": 271,
-      "src/renderer/src/components/native-chat/native-chat-tab-agent-entry.test.ts": 7,
-      "src/renderer/src/components/native-chat/native-chat-task-list-history.test.ts": 10,
-      "src/renderer/src/components/native-chat/native-chat-task-list-state.test.ts": 13,
-      "src/renderer/src/components/native-chat/native-chat-tool-fold.test.ts": 12,
-      "src/renderer/src/components/native-chat/native-chat-tool-summary.test.ts": 11,
-      "src/renderer/src/components/native-chat/native-chat-transcript-slots.test.ts": 6,
-      "src/renderer/src/components/native-chat/native-chat-turn-diffs.test.ts": 25,
-      "src/renderer/src/components/native-chat/native-chat-typing-indicator.test.ts": 11,
-      "src/renderer/src/components/native-chat/native-chat-typing-redirect.test.ts": 5,
-      "src/renderer/src/components/native-chat/native-chat-view-state.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-web-link-actions.test.ts": 18,
-      "src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx": 55,
-      "src/renderer/src/components/native-chat/native-chat-working-suppression.test.ts": 8,
-      "src/renderer/src/components/native-chat/structured-agent-session-message-projection.test.ts": 8,
-      "src/renderer/src/components/native-chat/structured-agent-session-read-transport.test.ts": 24,
-      "src/renderer/src/components/native-chat/structured-session-takeover-report.test.tsx": 74,
-      "src/renderer/src/components/native-chat/use-native-chat-composer-app-menu-selection.test.tsx": 65,
-      "src/renderer/src/components/native-chat/use-native-chat-composer-attachments.test.tsx": 83,
-      "src/renderer/src/components/native-chat/use-native-chat-composer-catalog.test.tsx": 45,
-      "src/renderer/src/components/native-chat/use-native-chat-composer-keydown.test.tsx": 30,
-      "src/renderer/src/components/native-chat/use-native-chat-composer-paste.test.tsx": 27,
-      "src/renderer/src/components/native-chat/use-native-chat-context-menu.test.tsx": 45,
-      "src/renderer/src/components/native-chat/use-native-chat-external-attachments.test.tsx": 46,
-      "src/renderer/src/components/native-chat/use-native-chat-hook-status.test.ts": 4,
-      "src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx": 34,
-      "src/renderer/src/components/native-chat/use-native-chat-launch-draft-adoption.test.tsx": 51,
-      "src/renderer/src/components/native-chat/use-native-chat-link-actions.test.tsx": 320,
-      "src/renderer/src/components/native-chat/use-native-chat-live-session-pending.test.ts": 63,
-      "src/renderer/src/components/native-chat/use-native-chat-live-session-visibility.test.ts": 75,
-      "src/renderer/src/components/native-chat/use-native-chat-live-session.test.ts": 158,
-      "src/renderer/src/components/native-chat/use-native-chat-picker-command-dispatch.test.tsx": 26,
-      "src/renderer/src/components/native-chat/use-native-chat-retained-session.test.ts": 32,
-      "src/renderer/src/components/native-chat/use-native-chat-send-lifecycle.test.tsx": 17,
-      "src/renderer/src/components/native-chat/use-native-chat-session-option-command.test.tsx": 30,
-      "src/renderer/src/components/native-chat/use-native-chat-session-options.test.ts": 248,
-      "src/renderer/src/components/native-chat/use-native-chat-skills.react.test.tsx": 396,
-      "src/renderer/src/components/native-chat/use-native-chat-skills.test.ts": 8,
-      "src/renderer/src/components/native-chat/use-native-chat-structured-composer-send.test.tsx": 193,
-      "src/renderer/src/components/native-chat/use-native-chat-toggle-shortcut.test.ts": 10,
-      "src/renderer/src/components/native-chat/use-native-chat-transcript-window.options.test.tsx": 88,
-      "src/renderer/src/components/native-chat/use-structured-agent-session-hold.test.tsx": 199,
-      "src/renderer/src/components/native-chat/use-structured-agent-session-messages.test.tsx": 24,
-      "src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx": 870,
-      "src/renderer/src/components/native-chat/use-structured-agent-session-read.test.tsx": 596,
-      "src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx": 605,
-      "src/renderer/src/components/native-chat/use-structured-agent-turn-timing.test.tsx": 23,
-      "src/renderer/src/components/network/CustomAddressDialog.test.tsx": 72,
-      "src/renderer/src/components/new-workspace/ComposerParentWorktreePicker.test.tsx": 175,
-      "src/renderer/src/components/new-workspace/ProjectCombobox.dialog-handoff.test.tsx": 499,
-      "src/renderer/src/components/new-workspace/ProjectCombobox.test.tsx": 245,
-      "src/renderer/src/components/new-workspace/ProjectComboboxRow.test.tsx": 65,
-      "src/renderer/src/components/new-workspace/SetProjectLocationDialog.test.tsx": 999,
-      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField-provider-boundaries.test.ts": 7,
-      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField-repo-slug-routing.test.ts": 14,
-      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField-source-boundaries.test.ts": 5,
-      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField.ime-enter.test.tsx": 253,
-      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField.jira-accessibility.test.tsx": 500,
-      "src/renderer/src/components/new-workspace/project-combobox-matching.test.ts": 29,
-      "src/renderer/src/components/new-workspace/smart-workspace-command-value.test.ts": 7,
-      "src/renderer/src/components/new-workspace/smart-workspace-localized-options.test.ts": 59,
-      "src/renderer/src/components/new-workspace/smart-workspace-source-popover-focus.test.ts": 17,
-      "src/renderer/src/components/new-workspace/smart-workspace-source-results.test.ts": 16,
-      "src/renderer/src/components/new-workspace/use-jira-source-connection.test.tsx": 46,
-      "src/renderer/src/components/new-workspace/use-jira-url-source.test.tsx": 39,
-      "src/renderer/src/components/new-workspace/use-recent-project-ids.test.ts": 6,
-      "src/renderer/src/components/onboarding/AgentStep.test.tsx": 78,
-      "src/renderer/src/components/onboarding/FeatureSetupInlineTerminal.test.tsx": 31,
-      "src/renderer/src/components/onboarding/NotificationStep.test.tsx": 61,
-      "src/renderer/src/components/onboarding/OnboardingFlow.test.tsx": 128,
-      "src/renderer/src/components/onboarding/OnboardingInlineCommandTerminal.command-finished.test.tsx": 47,
-      "src/renderer/src/components/onboarding/OnboardingInlineCommandTerminal.test.ts": 4,
-      "src/renderer/src/components/onboarding/ThemeStep.test.ts": 8,
-      "src/renderer/src/components/onboarding/WindowsTerminalStep.test.tsx": 51,
-      "src/renderer/src/components/onboarding/agent-picked-payload.test.ts": 10,
-      "src/renderer/src/components/onboarding/onboarding-dismiss-target.test.ts": 4,
-      "src/renderer/src/components/onboarding/onboarding-feature-setup.test.ts": 23,
-      "src/renderer/src/components/onboarding/onboarding-folder-agent-startup.test.ts": 10,
-      "src/renderer/src/components/onboarding/onboarding-settings-hydration.test.ts": 5,
-      "src/renderer/src/components/onboarding/use-onboarding-flow-persistence.test.ts": 34,
-      "src/renderer/src/components/onboarding/use-onboarding-flow.test.ts": 21,
-      "src/renderer/src/components/onboarding/windows-terminal-onboarding-telemetry.test.ts": 5,
-      "src/renderer/src/components/orca-profiles/OrcaProfileSignOutConfirmDialog.test.tsx": 21,
-      "src/renderer/src/components/pet/PetOverlay.frame-durations.test.tsx": 50,
-      "src/renderer/src/components/pet/PetOverlay.keyframes.test.tsx": 217,
-      "src/renderer/src/components/pet/PetOverlay.pet-switch.test.tsx": 37,
-      "src/renderer/src/components/pet/PetOverlay.pointer-interaction.test.tsx": 75,
-      "src/renderer/src/components/pet/PetOverlay.test.ts": 5,
-      "src/renderer/src/components/pet/pet-agent-state.test.ts": 14,
-      "src/renderer/src/components/pet/pet-blob-cache.test.ts": 12,
-      "src/renderer/src/components/pet/pet-overlay-hit-area.test.tsx": 49,
-      "src/renderer/src/components/pet/pet-overlay-position.test.ts": 6,
-      "src/renderer/src/components/pet/pet-overlay-visibility.test.ts": 6,
-      "src/renderer/src/components/pet/sprite-animation-css.test.ts": 9,
-      "src/renderer/src/components/pet/usePetPointerInteraction.test.ts": 23,
-      "src/renderer/src/components/pet/usePetUrl.test.tsx": 15,
-      "src/renderer/src/components/ports/WorkspacePortScanner.test.tsx": 215,
-      "src/renderer/src/components/pr-check-counts.test.ts": 11,
-      "src/renderer/src/components/pr-checks-fix-prompt.test.ts": 20,
-      "src/renderer/src/components/pr-comments-resolution-prompt.test.ts": 9,
-      "src/renderer/src/components/provider-check-classification-parity.test.ts": 14,
-      "src/renderer/src/components/pull-request-page-host-boundary.test.ts": 17,
-      "src/renderer/src/components/pull-request-page/cache/file-content.test.ts": 11,
-      "src/renderer/src/components/pull-request-page/files/combined-diff-section-index.test.tsx": 22,
-      "src/renderer/src/components/pull-request-page/mentions/options.test.ts": 4,
-      "src/renderer/src/components/pull-request-page/mentions/query.test.ts": 7,
-      "src/renderer/src/components/pull-request-page/presentation/state-badge.test.ts": 6,
-      "src/renderer/src/components/quick-open-file-list.react.test.tsx": 90,
-      "src/renderer/src/components/quick-open-file-list.test.ts": 9,
-      "src/renderer/src/components/quick-open-install-rg-guidance.render.test.tsx": 57,
-      "src/renderer/src/components/quick-open-install-rg-guidance.test.ts": 9,
-      "src/renderer/src/components/quick-open-search.test.ts": 248,
-      "src/renderer/src/components/repo/NestedRepoChecklist.test.tsx": 17,
-      "src/renderer/src/components/repo/NestedRepoScanLimitNotice.test.ts": 5,
-      "src/renderer/src/components/repo/repo-icon.emoji-centering.test.tsx": 45,
-      "src/renderer/src/components/repo/repo-icon.test.tsx": 61,
-      "src/renderer/src/components/right-sidebar/ActionButton.test.tsx": 17,
-      "src/renderer/src/components/right-sidebar/AiVaultSessionRow.test.tsx": 294,
-      "src/renderer/src/components/right-sidebar/AiVaultSessionSubagents.test.tsx": 67,
-      "src/renderer/src/components/right-sidebar/ChecksPanel.review-header.test.tsx": 28,
-      "src/renderer/src/components/right-sidebar/ChecksPanel.updated-at-metadata.test.tsx": 46,
-      "src/renderer/src/components/right-sidebar/CommitArea.chevron-spinner.test.tsx": 78,
-      "src/renderer/src/components/right-sidebar/CommitArea.generate.test.tsx": 87,
-      "src/renderer/src/components/right-sidebar/CommitArea.primary-icons.test.tsx": 92,
-      "src/renderer/src/components/right-sidebar/CommitArea.test.tsx": 373,
-      "src/renderer/src/components/right-sidebar/FileExplorerNameFilter.test.tsx": 12,
-      "src/renderer/src/components/right-sidebar/FileExplorerRow.actions.test.tsx": 19,
-      "src/renderer/src/components/right-sidebar/FileExplorerToolbar.test.tsx": 45,
-      "src/renderer/src/components/right-sidebar/FileExplorerViewSwitch.test.tsx": 10,
-      "src/renderer/src/components/right-sidebar/FileExplorerVirtualRows.row-handlers.test.tsx": 16,
-      "src/renderer/src/components/right-sidebar/FileExplorerVirtualRowsAddProject.test.tsx": 14,
-      "src/renderer/src/components/right-sidebar/FolderWorkspacePrChecksPanel.test.tsx": 300,
-      "src/renderer/src/components/right-sidebar/FolderWorkspacePrChecksRow.test.tsx": 72,
-      "src/renderer/src/components/right-sidebar/FolderWorkspaceWorktreesPanel.test.tsx": 69,
-      "src/renderer/src/components/right-sidebar/GitHistoryPanel.test.tsx": 60,
-      "src/renderer/src/components/right-sidebar/GitHubPRStackMap.test.tsx": 75,
-      "src/renderer/src/components/right-sidebar/HostedReviewActions.draft.test.tsx": 22,
-      "src/renderer/src/components/right-sidebar/PluginPanel.test.tsx": 220,
-      "src/renderer/src/components/right-sidebar/PortsPanel.test.tsx": 1028,
-      "src/renderer/src/components/right-sidebar/PullRequestComposer.generate-tooltip.test.tsx": 753,
-      "src/renderer/src/components/right-sidebar/SearchResultItems.test.tsx": 18,
-      "src/renderer/src/components/right-sidebar/SessionRowTrailingActions.test.tsx": 54,
-      "src/renderer/src/components/right-sidebar/SourceControl.branch-line-total.test.tsx": 774,
-      "src/renderer/src/components/right-sidebar/SourceControl.commit-drafts.test.ts": 18,
-      "src/renderer/src/components/right-sidebar/SourceControl.commit-failure-recovery.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/SourceControl.commit-generation-records.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/SourceControl.compare-summary.test.ts": 14,
-      "src/renderer/src/components/right-sidebar/SourceControl.host-context-boundary.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/SourceControl.hosted-review-header-link.test.tsx": 19,
-      "src/renderer/src/components/right-sidebar/SourceControl.open-file-highlight.test.tsx": 546,
-      "src/renderer/src/components/right-sidebar/SourceControl.pr-generation-records.test.ts": 15,
-      "src/renderer/src/components/right-sidebar/SourceControl.preview-open.test.tsx": 833,
-      "src/renderer/src/components/right-sidebar/SourceControl.push-failure-recovery.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/SourceControl.remote-action-errors.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/SourceControl.resolve-conflicts-prompt.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/SourceControl.virtual-file-list.test.tsx": 2498,
-      "src/renderer/src/components/right-sidebar/SourceControlAgentActionDialog.test.tsx": 425,
-      "src/renderer/src/components/right-sidebar/SourceControlAgentActionDialogForm.test.tsx": 74,
-      "src/renderer/src/components/right-sidebar/SourceControlTextGenerationDialog.test.ts": 94,
-      "src/renderer/src/components/right-sidebar/active-checks-status.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/activity-bar-buttons.test.tsx": 59,
-      "src/renderer/src/components/right-sidebar/activity-bar-overflow.test.ts": 7,
-      "src/renderer/src/components/right-sidebar/ai-vault-first-prompt-card.test.tsx": 137,
-      "src/renderer/src/components/right-sidebar/ai-vault-host-scope.test.ts": 32,
-      "src/renderer/src/components/right-sidebar/ai-vault-original-pane-index.test.ts": 16,
-      "src/renderer/src/components/right-sidebar/ai-vault-original-pane.test.ts": 7,
-      "src/renderer/src/components/right-sidebar/ai-vault-scan-issue-state.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/ai-vault-scope-paths.test.ts": 12,
-      "src/renderer/src/components/right-sidebar/ai-vault-scope-state.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-continuation.test.ts": 7,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-deletability.test.ts": 10,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-display.test.ts": 13,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-filters.test.ts": 19,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-identity.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-log-open.test.ts": 15,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-path-actions.test.ts": 7,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-projects.test.ts": 22,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-publication-gate.test.ts": 17,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-refresh.test.ts": 193,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-resume-in-chat-launch.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-resume-in-chat.test.ts": 10,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-resume.test.ts": 19,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-worktree-map.test.tsx": 61,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-worktree.test.ts": 19,
-      "src/renderer/src/components/right-sidebar/ai-vault-view-defaults.test.ts": 10,
-      "src/renderer/src/components/right-sidebar/ai-vault-view-options-persistence.test.ts": 13,
-      "src/renderer/src/components/right-sidebar/branch-line-total-request-gate.test.ts": 6,
-      "src/renderer/src/components/right-sidebar/check-details-resize.test.ts": 4,
-      "src/renderer/src/components/right-sidebar/checks-entry-refresh.test.ts": 10,
-      "src/renderer/src/components/right-sidebar/checks-list-expanded-details.test.tsx": 327,
-      "src/renderer/src/components/right-sidebar/checks-panel-async-result-key.test.ts": 4,
-      "src/renderer/src/components/right-sidebar/checks-panel-content.test.tsx": 100,
-      "src/renderer/src/components/right-sidebar/checks-panel-empty-state.test.ts": 28,
-      "src/renderer/src/components/right-sidebar/checks-panel-git-status-snapshot.test.ts": 14,
-      "src/renderer/src/components/right-sidebar/checks-panel-hosted-review-click-routing.test.ts": 10,
-      "src/renderer/src/components/right-sidebar/checks-panel-pr-refresh-breadcrumb.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/checks-panel-pr-refresh-request.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/checks-panel-review-creation.test.ts": 16,
-      "src/renderer/src/components/right-sidebar/checks-panel-review-lookup-authority.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/checks-panel-review.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/checks-panel-terminal-worktree.test.ts": 12,
-      "src/renderer/src/components/right-sidebar/checks-panel/gitlab-review-client.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/checks-panel/panel-content-rendering.test.tsx": 90,
-      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-check-and-review-actions.test.tsx": 33,
-      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-create-review.test.tsx": 22,
-      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-generation.test.tsx": 17,
-      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-git-status-effects.test.tsx": 37,
-      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-manual-refresh.test.tsx": 15,
-      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-polling.test.tsx": 38,
-      "src/renderer/src/components/right-sidebar/coalesced-poll-runner.test.ts": 18,
-      "src/renderer/src/components/right-sidebar/commit-failure-dialog-state.test.ts": 4,
-      "src/renderer/src/components/right-sidebar/commit-failure-summary.test.ts": 21,
-      "src/renderer/src/components/right-sidebar/create-review-draft-title.test.ts": 7,
-      "src/renderer/src/components/right-sidebar/diff-comments-clear-dialog-state.test.ts": 6,
-      "src/renderer/src/components/right-sidebar/discard-all-sequence.test.ts": 19,
-      "src/renderer/src/components/right-sidebar/file-explorer-add-project-action.test.ts": 7,
-      "src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.test.ts": 140,
-      "src/renderer/src/components/right-sidebar/file-explorer-deferred-dir-toggle.test.ts": 42,
-      "src/renderer/src/components/right-sidebar/file-explorer-dir-load-tracker.test.ts": 4,
-      "src/renderer/src/components/right-sidebar/file-explorer-dir-toggle-timing.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/file-explorer-directory-listing.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/file-explorer-drag-scroll-marker.test.tsx": 56,
-      "src/renderer/src/components/right-sidebar/file-explorer-entries.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/file-explorer-expanded-dirs-refresh.test.ts": 23,
-      "src/renderer/src/components/right-sidebar/file-explorer-inline-input-outside-click.test.tsx": 62,
-      "src/renderer/src/components/right-sidebar/file-explorer-inline-rename-flow.test.tsx": 113,
-      "src/renderer/src/components/right-sidebar/file-explorer-keyboard-navigation.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/file-explorer-name-filter-projection.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/file-explorer-operation-generation.test.ts": 35,
-      "src/renderer/src/components/right-sidebar/file-explorer-paths.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/file-explorer-refresh-concurrency.test.ts": 4,
-      "src/renderer/src/components/right-sidebar/file-explorer-reset.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/file-explorer-row-projection.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/file-explorer-runtime-owner-boundary.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/file-explorer-selection.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/file-explorer-stale-dir-cache.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/file-explorer-watch-drive-root.test.ts": 12,
-      "src/renderer/src/components/right-sidebar/file-explorer-watch-reconcile.test.ts": 193,
-      "src/renderer/src/components/right-sidebar/file-explorer-watch-refresh-scheduler.test.ts": 37,
-      "src/renderer/src/components/right-sidebar/file-search-include-pattern.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/folder-workspace-attached-worktrees.test.ts": 16,
-      "src/renderer/src/components/right-sidebar/fork-push-target-label.test.ts": 6,
-      "src/renderer/src/components/right-sidebar/git-status-push-signal-refresh.test.ts": 32,
-      "src/renderer/src/components/right-sidebar/git-status-refresh-branch-line-total.test.ts": 19,
-      "src/renderer/src/components/right-sidebar/git-status-refresh-scheduler.test.ts": 23,
-      "src/renderer/src/components/right-sidebar/git-status-refresh.test.ts": 66,
-      "src/renderer/src/components/right-sidebar/github-pr-link-modal.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/github-pr-stack-merge.test.ts": 12,
-      "src/renderer/src/components/right-sidebar/gitlab-mr-merge-state.test.ts": 10,
-      "src/renderer/src/components/right-sidebar/local-workspace-port-sections.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.test.ts": 77,
-      "src/renderer/src/components/right-sidebar/parent-pr-checks-refresh.test.ts": 32,
-      "src/renderer/src/components/right-sidebar/parent-pr-checks-rows.test.ts": 37,
-      "src/renderer/src/components/right-sidebar/plugin-panel-activity-items.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/plugin-panel-bridge-host.test.ts": 45,
-      "src/renderer/src/components/right-sidebar/plugin-panel-watchdog-visibility.test.ts": 12,
-      "src/renderer/src/components/right-sidebar/plugin-panel-watchdog.test.ts": 12,
-      "src/renderer/src/components/right-sidebar/pr-comment-presentation.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/pr-comment-snapshotted-thread-resolver.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/pr-comment-thread-resolution.test.ts": 4,
-      "src/renderer/src/components/right-sidebar/pr-comments-ai-launch-ack.test.ts": 23,
-      "src/renderer/src/components/right-sidebar/pr-comments-list-selection.test.tsx": 791,
-      "src/renderer/src/components/right-sidebar/push-target-upstream-refresh-cache.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/review-cache-entry-selection.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/right-panel-comment-composer.ime-enter.test.tsx": 103,
-      "src/renderer/src/components/right-sidebar/right-panel-comment-focus-timers.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/right-sidebar-activity-visibility.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/right-sidebar-effective-tab.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/right-sidebar-primary-action-layout.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/right-sidebar-titlebar-drag-regions.render.test.tsx": 126,
-      "src/renderer/src/components/right-sidebar/right-sidebar-titlebar-drag-regions.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/right-sidebar-width.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/runSourceControlAgentActionStart.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/search-match-open.test.ts": 12,
-      "src/renderer/src/components/right-sidebar/search-rows.test.ts": 6,
-      "src/renderer/src/components/right-sidebar/source-control-action-recipe-match.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/source-control-actions.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/source-control-active-open-file-keys.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/source-control-agent-action-dialog-support.test.ts": 4,
-      "src/renderer/src/components/right-sidebar/source-control-branch-context-row.test.tsx": 147,
-      "src/renderer/src/components/right-sidebar/source-control-branch-context-stats.test.ts": 17,
-      "src/renderer/src/components/right-sidebar/source-control-branch-section-heading.test.tsx": 23,
-      "src/renderer/src/components/right-sidebar/source-control-commit-eligibility.test.ts": 7,
+      "config/scripts/adhoc-build-version.test.mjs": 90,
+      "config/scripts/agent-status-hot-path-benchmark.test.ts": 2954,
+      "config/scripts/app-store-performance-plugin.test.mjs": 1255,
+      "config/scripts/assert-github-release-is-draft.test.mjs": 348,
+      "config/scripts/audit-localization-coverage.test.mjs": 412,
+      "config/scripts/benchmark-artifact-comparison.test.mjs": 193,
+      "config/scripts/benchmark-sample-summary.test.mjs": 45,
+      "config/scripts/build-linux-local.test.mjs": 35,
+      "config/scripts/build-mac-local.test.mjs": 52,
+      "config/scripts/build-mobile-web-app-bundle.test.mjs": 213,
+      "config/scripts/build-native-for-platform.test.mjs": 42,
+      "config/scripts/build-orcad-bun.test.mjs": 122,
+      "config/scripts/build-orcad-prebuilds.test.mjs": 85,
+      "config/scripts/build-windows-cli-launcher.test.mjs": 84,
+      "config/scripts/bun-profile-change-scope.test.mjs": 3355,
+      "config/scripts/casting-code-quality.test.mjs": 874,
+      "config/scripts/check-changed-code-quality.test.mjs": 79,
+      "config/scripts/check-max-lines-ratchet.test.mjs": 945,
+      "config/scripts/check-react-doctor-changed.test.mjs": 300,
+      "config/scripts/check-readme-local-links.test.mjs": 520,
+      "config/scripts/check-reliability-gates.test.mjs": 175,
+      "config/scripts/check-root-directory-entries.test.mjs": 1241,
+      "config/scripts/check-runtime-electron-ratchet.test.mjs": 2494,
+      "config/scripts/check-terminal-perf-report-budgets.test.mjs": 2243,
+      "config/scripts/check-ts-nocheck-ratchet.test.mjs": 44,
+      "config/scripts/ci-cache-warmup-workflow.test.mjs": 110,
+      "config/scripts/ci-dependency-download-cache.test.mjs": 401,
+      "config/scripts/ci-e2e-shard-selection.test.mjs": 14257,
+      "config/scripts/ci-native-toolchain.test.mjs": 92,
+      "config/scripts/ci-shard-assignment.test.mjs": 308,
+      "config/scripts/ci-unit-timing-reporter.test.mjs": 62,
+      "config/scripts/cli-main-module-bundle-parity.test.ts": 594,
+      "config/scripts/client-hosted-browser-package-coverage.test.mjs": 124,
+      "config/scripts/cloud-security-history-workflow.test.mjs": 344,
+      "config/scripts/codex-index-heal-contract-workflow.test.mjs": 145,
+      "config/scripts/codex-primary-home-tripwire.test.ts": 344,
+      "config/scripts/computer-e2e-workflow.test.mjs": 159,
+      "config/scripts/computer-use-modifier-safety.test.mjs": 51,
+      "config/scripts/computer-use-mouse-button-routing.test.mjs": 43,
+      "config/scripts/computer-use-skill-guidance.test.mjs": 130,
+      "config/scripts/computer-use-smoke.test.mjs": 580,
+      "config/scripts/computer-use-windows-horizontal-scroll.test.mjs": 42,
+      "config/scripts/counterbalanced-benchmark-schedule.test.mjs": 47,
+      "config/scripts/create-draft-release.test.mjs": 72,
+      "config/scripts/daily-build-version.test.mjs": 87,
+      "config/scripts/daily-e2e-dispatch-contract.test.mjs": 168,
+      "config/scripts/dev-channel-base-version.test.mjs": 60,
+      "config/scripts/dev-channel-windows-workflow-contract.test.mjs": 141,
+      "config/scripts/dev-cli-terminal-wrapper.test.mjs": 34,
+      "config/scripts/dev-electron-bundle-cache.test.ts": 52,
+      "config/scripts/dev-electron-bundle-identity.test.ts": 82,
+      "config/scripts/electron-builder-config.test.mjs": 1072,
+      "config/scripts/electron-builder-mac-channel-config.test.mjs": 1002,
+      "config/scripts/electron-builder-markdown-associations.test.mjs": 269,
+      "config/scripts/electron-builder-native-rebuild.test.mjs": 41,
+      "config/scripts/electron-builder-runtime-resources.test.mjs": 1124,
+      "config/scripts/electron-builder-speech-config.test.mjs": 485,
+      "config/scripts/electron-runtime-floor.test.ts": 37,
+      "config/scripts/electron-vite-output-contract.test.ts": 1042,
+      "config/scripts/ensure-native-runtime-job-ownership.test.mjs": 35,
+      "config/scripts/ensure-native-runtime.test.mjs": 771,
+      "config/scripts/ephemeral-vm-runtime-store-cross-version.test.ts": 42,
+      "config/scripts/generate-bundled-skill-guides.test.mjs": 510,
+      "config/scripts/generate-runtime-required-english-catalog.test.mjs": 452,
+      "config/scripts/generate-skill-bundle-manifest.test.mjs": 721,
+      "config/scripts/generate-terminal-perf-html-report.test.mjs": 71,
+      "config/scripts/git-binary-compatibility-workflow.test.mjs": 153,
+      "config/scripts/git-pull-request-diff-base.test.mjs": 36,
+      "config/scripts/hang-watchdog-process-metrics.test.mjs": 34,
+      "config/scripts/happy-dom-mutation-observer-retention.test.ts": 384,
+      "config/scripts/happy-dom-offscreen-canvas.test.ts": 319,
+      "config/scripts/headless-serve-shutdown-matrix.test.mjs": 112,
+      "config/scripts/headless-serve-shutdown-workflow.test.mjs": 148,
+      "config/scripts/hourly-build-version.test.mjs": 136,
+      "config/scripts/hourly-preflight-workflow.test.mjs": 165,
+      "config/scripts/idle-cpu-process-sampling.test.mjs": 60,
+      "config/scripts/install-electron-package-binary.test.mjs": 3284,
+      "config/scripts/install-node-dependencies-action.test.mjs": 434,
+      "config/scripts/lag-probe-failures.test.mjs": 52,
+      "config/scripts/latest-stable-release.test.mjs": 60,
+      "config/scripts/lint-staged-worktree-backup.test.mjs": 436,
+      "config/scripts/linux-package-fixture-cache.test.mjs": 200,
+      "config/scripts/linux-package-maintainer-scripts.test.mjs": 19,
+      "config/scripts/live-freeze-bounded-history.test.mjs": 49,
+      "config/scripts/live-remote-bulk-open-freeze-metrics.test.mjs": 72,
+      "config/scripts/live-remote-freeze-rpc.test.mjs": 53,
+      "config/scripts/live-remote-status-watchdog.test.mjs": 285,
+      "config/scripts/locale-brand-prefilter.test.mjs": 263,
+      "config/scripts/locale-count-fragment-separator.test.mjs": 200,
+      "config/scripts/locale-generic-ui-terms.test.mjs": 111,
+      "config/scripts/locale-ko-frozen-terminal-search-keywords.test.mjs": 127,
+      "config/scripts/locale-ko-key-overrides.test.mjs": 95,
+      "config/scripts/locale-repair-catalog-missing-leaves.test.mjs": 124,
+      "config/scripts/locale-translation-policy-ko-round5.test.mjs": 249,
+      "config/scripts/locale-translation-policy.es-pr.test.mjs": 132,
+      "config/scripts/locale-translation-policy.es-round5.test.mjs": 118,
+      "config/scripts/locale-translation-policy.ja-relocalization.test.mjs": 207,
+      "config/scripts/locale-translation-policy.ja-round5.test.mjs": 137,
+      "config/scripts/locale-translation-policy.test.mjs": 283,
+      "config/scripts/locale-translation-policy.zh-round5.test.mjs": 290,
+      "config/scripts/locale-translation-policy.zh-status-bar-usage.test.mjs": 138,
+      "config/scripts/localization-extraction-change-scope.test.mjs": 133,
+      "config/scripts/localization-package-contract.test.mjs": 40,
+      "config/scripts/mac-build-compatibility.test.mjs": 41,
+      "config/scripts/macos-computer-helper-owner-loss-group-recovery.test.mjs": 33,
+      "config/scripts/macos-computer-helper-owner-loss-processes.test.mjs": 64,
+      "config/scripts/macos-tcc-prompt-localization.test.mjs": 213,
+      "config/scripts/mobile-launch-contract-workflow.test.mjs": 439,
+      "config/scripts/mobile-mirrored-storage-write-path.test.mjs": 136,
+      "config/scripts/mobile-pairing-qrcode-import-plugin.test.mjs": 421,
+      "config/scripts/mobile-recording-pin-checkout.test.mjs": 309,
+      "config/scripts/mobile-release-check-scope.test.mjs": 610,
+      "config/scripts/mobile-release-shell-switch-workflow.test.mjs": 227,
+      "config/scripts/mobile-set-native-props-web-siblings.test.mjs": 959,
+      "config/scripts/mobile-test-change-scope.test.mjs": 107,
+      "config/scripts/mobile-web-app-agent-history-render.test.mjs": 695,
+      "config/scripts/mobile-web-app-browser-pane-render.test.mjs": 416,
+      "config/scripts/mobile-web-app-browser-pane-text-inputs.test.mjs": 380,
+      "config/scripts/mobile-web-app-clipboard-image-resize-render.test.mjs": 544,
+      "config/scripts/mobile-web-app-drawer-render.test.mjs": 379,
+      "config/scripts/mobile-web-app-editable-host-font-size.test.mjs": 590,
+      "config/scripts/mobile-web-app-external-link-seam.test.mjs": 340,
+      "config/scripts/mobile-web-app-external-navigation-grant.test.mjs": 81,
+      "config/scripts/mobile-web-app-files-external-links.test.mjs": 383,
+      "config/scripts/mobile-web-app-files-render.test.mjs": 315,
+      "config/scripts/mobile-web-app-frame-budget-sweep.test.ts": 545,
+      "config/scripts/mobile-web-app-handoff-grants-render.test.mjs": 476,
+      "config/scripts/mobile-web-app-haptics-seam.test.mjs": 491,
+      "config/scripts/mobile-web-app-html-preview-render.test.mjs": 1035,
+      "config/scripts/mobile-web-app-mermaid-render.test.mjs": 567,
+      "config/scripts/mobile-web-app-native-parity-render.test.mjs": 554,
+      "config/scripts/mobile-web-app-page-closure-families.test.mjs": 75,
+      "config/scripts/mobile-web-app-page-grant-call-sites.test.mjs": 567,
+      "config/scripts/mobile-web-app-push-subsystem-closure.test.mjs": 70,
+      "config/scripts/mobile-web-app-render.test.mjs": 339,
+      "config/scripts/mobile-web-app-rich-markdown-render.test.mjs": 991,
+      "config/scripts/mobile-web-app-route-manifest.test.mjs": 220,
+      "config/scripts/mobile-web-app-route-snapshot.test.mjs": 95,
+      "config/scripts/mobile-web-app-safe-area-render.test.mjs": 503,
+      "config/scripts/mobile-web-app-screencast-lane-grant.test.mjs": 56,
+      "config/scripts/mobile-web-app-session-dictation-capture.test.mjs": 98,
+      "config/scripts/mobile-web-app-session-external-links.test.mjs": 210,
+      "config/scripts/mobile-web-app-session-media-picker.test.mjs": 375,
+      "config/scripts/mobile-web-app-session-render.test.mjs": 495,
+      "config/scripts/mobile-web-app-session-terminal-closure.test.mjs": 444,
+      "config/scripts/mobile-web-app-session-terminal-init.test.mjs": 529,
+      "config/scripts/mobile-web-app-session-text-inputs.test.mjs": 391,
+      "config/scripts/mobile-web-app-session-webview-consumers.test.mjs": 76,
+      "config/scripts/mobile-web-app-source-control-external-links.test.mjs": 317,
+      "config/scripts/mobile-web-app-source-control-keyboard.test.mjs": 59,
+      "config/scripts/mobile-web-app-source-control-render.test.mjs": 432,
+      "config/scripts/mobile-web-app-source-control-text-inputs.test.mjs": 295,
+      "config/scripts/mobile-web-app-tasks-external-links.test.mjs": 349,
+      "config/scripts/mobile-web-app-tasks-render.test.mjs": 356,
+      "config/scripts/mobile-web-app-terminal-live-input-render.test.mjs": 431,
+      "config/scripts/mobile-web-app-terminal-render-fixture.test.mjs": 548,
+      "config/scripts/mobile-web-app-terminal-render.test.mjs": 346,
+      "config/scripts/mobile-web-app-web-overrides.test.mjs": 69,
+      "config/scripts/mobile-web-bundle-manifest.test.mjs": 54,
+      "config/scripts/mobile-web-bundle-packaging-workflow-contract.test.mjs": 1102,
+      "config/scripts/mobile-web-bundle-serializer-parity.test.mjs": 138,
+      "config/scripts/mobile-web-page-route-hop-coverage.test.mjs": 4953,
+      "config/scripts/mobile-web-page-routes.test.mjs": 162,
+      "config/scripts/mobile-web-source-line-endings.test.mjs": 661,
+      "config/scripts/mobile-web-terminal-engine-closure.test.mjs": 79,
+      "config/scripts/node-old-space-limit.test.mjs": 32,
+      "config/scripts/node-pty-console-list-agent-patch.test.mjs": 46,
+      "config/scripts/node-pty-master-cloexec-patch.test.mjs": 114,
+      "config/scripts/node-pty-windows-pty-teardown-patch.test.mjs": 98,
+      "config/scripts/nsis-process-check.test.mjs": 62,
+      "config/scripts/orca-cli-skill-guidance.test.mjs": 62,
+      "config/scripts/orca-dev-bin.test.mjs": 79,
+      "config/scripts/orca-linear-skill-guidance.test.mjs": 50,
+      "config/scripts/orcad-artifact-version.test.mjs": 470,
+      "config/scripts/orcad-operations-restart-safety.test.mjs": 45,
+      "config/scripts/orcad-terminal-smoke-change-scope.test.mjs": 1510,
+      "config/scripts/orcad-watcher-package.test.mjs": 132,
+      "config/scripts/orcad-windows-process-tree.test.mjs": 63,
+      "config/scripts/orchestration-guide-command-contract.test.mjs": 44,
+      "config/scripts/orchestration-skill-guidance.test.mjs": 58,
+      "config/scripts/oxc-cli-invocation.test.mjs": 85,
+      "config/scripts/oxlint-cli-invocation.test.mjs": 106,
+      "config/scripts/package-electron-install-owner.test.mjs": 91,
+      "config/scripts/package-electron-runtime-contract.test.mjs": 447,
+      "config/scripts/package-linux-formats.test.mjs": 208,
+      "config/scripts/packaged-browser-lane-contract.test.mjs": 104,
+      "config/scripts/packaged-node-pty-prebuild-prune.test.mjs": 93,
+      "config/scripts/packaged-source-map-prune.test.mjs": 117,
+      "config/scripts/patched-dependencies-frozen-install.test.mjs": 900,
+      "config/scripts/pdfjs-viewer-assets-stream.test.ts": 246,
+      "config/scripts/plain-node-entry-guard.test.ts": 728,
+      "config/scripts/playwright-focused-workflow-selection.test.mjs": 3690,
+      "config/scripts/pnpm-cli-invocation.test.mjs": 38,
+      "config/scripts/pr-code-change-scope.test.mjs": 638,
+      "config/scripts/pr-e2e-gate-contract.test.mjs": 409,
+      "config/scripts/pr-e2e-native-only-routing.test.mjs": 169,
+      "config/scripts/pr-e2e-pane-close-routing.test.mjs": 55,
+      "config/scripts/pr-ready-check-gate.test.mjs": 303,
+      "config/scripts/pr-ready-check-reuse.test.mjs": 190,
+      "config/scripts/pr-test-loc-summary.test.mjs": 178,
+      "config/scripts/pr-workflow-lint-parity.test.mjs": 81,
+      "config/scripts/pr-workflow-parallelism.test.mjs": 1324,
+      "config/scripts/profile-state-worker-smoke.test.mjs": 2754,
+      "config/scripts/project-renderer-web-client.test.mjs": 251,
+      "config/scripts/pty-transcript-secret-scan.test.mjs": 68,
+      "config/scripts/publish-complete-draft-releases.test.mjs": 230,
+      "config/scripts/quadratic-buffer-concat-plugin.test.mjs": 2182,
+      "config/scripts/rebuild-native-deps-node-pty.test.mjs": 4426,
+      "config/scripts/rebuild-native-deps-windows-process-tree.test.mjs": 40,
+      "config/scripts/rebuild-native-deps.test.mjs": 1467,
+      "config/scripts/reclaim-dev-electron-bundles.test.ts": 57,
+      "config/scripts/regenerate-xterm-patches.test.mjs": 432,
+      "config/scripts/relay-artifact-manifest.test.mjs": 4048,
+      "config/scripts/relay-asset-line-ending-pin.test.mjs": 110,
+      "config/scripts/release-blocker-fixes.test.mjs": 80,
+      "config/scripts/release-cut-signpath-slack.test.mjs": 95,
+      "config/scripts/release-cut-sourcemap-publish.test.mjs": 175,
+      "config/scripts/release-cut-token-permissions.test.mjs": 210,
+      "config/scripts/release-e2e-dispatch-contract.test.mjs": 184,
+      "config/scripts/release-mac-build-workflow-dispatch.test.mjs": 45,
+      "config/scripts/release-rc-history.test.mjs": 244,
+      "config/scripts/renderer-boot-graph.test.mjs": 98,
+      "config/scripts/renderer-scrollbar-style-plugin.test.mjs": 2119,
+      "config/scripts/replace-cached-nsis-elevate.test.mjs": 1919,
+      "config/scripts/resolve-7za-path.test.mjs": 1815,
+      "config/scripts/run-codex-real-account-validation.test.ts": 4165,
+      "config/scripts/run-internal-dev-setup.test.mjs": 54,
+      "config/scripts/run-linux-packaged-node-pty-floor-smoke.test.mjs": 71,
+      "config/scripts/run-terminal-scale-perf-report-gate.test.mjs": 73,
+      "config/scripts/run-typecheck-projects-in-parallel.test.mjs": 47,
+      "config/scripts/script-entry-detection.test.mjs": 72,
+      "config/scripts/script-module-dependencies.test.mjs": 57,
+      "config/scripts/shared-electron-dist-cache.test.ts": 90,
+      "config/scripts/shebang-script-line-ending-pin.test.mjs": 119,
+      "config/scripts/skill-critical-guidance.test.mjs": 37,
+      "config/scripts/skill-description-length.test.mjs": 83,
+      "config/scripts/skill-recipe-shell.test.mjs": 76,
+      "config/scripts/skill-sharing-release-workflow.test.mjs": 130,
+      "config/scripts/skill-update-roundtrip-workflow.test.mjs": 86,
+      "config/scripts/skills-cli-package-workflow.test.mjs": 137,
+      "config/scripts/sort-comparator-performance-plugin.test.mjs": 332,
+      "config/scripts/space-sharing-copy.test.ts": 110,
+      "config/scripts/ssh-browser-e2e-routing.test.mjs": 138,
+      "config/scripts/ssh-docker-ci-sharding.test.mjs": 7004,
+      "config/scripts/ssh-localhost-e2e-routing.test.mjs": 163,
+      "config/scripts/static-appimage-package-contract.test.mjs": 83,
+      "config/scripts/summarize-terminal-perf-report.test.mjs": 74,
+      "config/scripts/telemetry-bundle-constant-patterns.test.mjs": 45,
+      "config/scripts/terminal-ime-e2e-workflow.test.mjs": 79,
+      "config/scripts/terminal-ime-engagement-receipt.test.mjs": 37,
+      "config/scripts/terminal-perf-report-annotations.test.mjs": 60,
+      "config/scripts/trim-windows-icon-source.test.mjs": 289,
+      "config/scripts/verify-cli-bin.test.mjs": 102,
+      "config/scripts/verify-dev-channel-packaging.test.mjs": 655,
+      "config/scripts/verify-linux-glibc-floor.test.mjs": 142,
+      "config/scripts/verify-linux-glibc-payloads.test.mjs": 223,
+      "config/scripts/verify-localization-catalog.test.mjs": 671,
+      "config/scripts/verify-localization-extraction.test.mjs": 36,
+      "config/scripts/verify-packaged-browser-participation.test.mjs": 43,
+      "config/scripts/verify-packaged-daemon-entry.test.mjs": 135,
+      "config/scripts/verify-packaged-mobile-web-bundle.test.mjs": 439,
+      "config/scripts/verify-packaged-node-pty-job-ownership.test.mjs": 61,
+      "config/scripts/verify-packaged-orcad-template.test.mjs": 466,
+      "config/scripts/verify-packaged-plugin-resources.test.mjs": 68,
+      "config/scripts/verify-release-required-assets.test.mjs": 33,
+      "config/scripts/verify-skills-cli-runtime.test.mjs": 381,
+      "config/scripts/verify-windows-inner-signature.test.mjs": 46,
+      "config/scripts/verify-wsl-e2e-participation.test.mjs": 58,
+      "config/scripts/websocket-server-loopback-bind.test.ts": 898,
+      "config/scripts/win-crash-survival-e2e.test.mjs": 775,
+      "config/scripts/win32-test-lane-registration.test.mjs": 2421,
+      "config/scripts/windows-bin-spawn-predicate.test.mjs": 363,
+      "config/scripts/windows-cmd-shim-spawn-boundary.test.mjs": 2079,
+      "config/scripts/windows-pe-machine.test.mjs": 41,
+      "config/scripts/windows-process-tree-creation-time.test.mjs": 43,
+      "config/scripts/windows-process-tree-gyp-path.test.mjs": 47,
+      "config/scripts/windows-process-tree-gyp-rebuild.test.mjs": 104,
+      "config/scripts/windows-process-tree-patch-contract.test.mjs": 711,
+      "config/scripts/windows-pty-native-capability-workflow.test.mjs": 142,
+      "config/scripts/windows-signing-gate-toolset.test.mjs": 148,
+      "config/scripts/windows-signing-workflow-contract.test.mjs": 589,
+      "config/scripts/windows-uninstaller-signing.test.mjs": 65,
+      "config/scripts/workflow-ref-mirror-case-safety.test.mjs": 435,
+      "config/scripts/workflow-ref-reachability.test.mjs": 783,
+      "config/scripts/wsl-e2e-lane-contract.test.mjs": 208,
+      "config/scripts/xterm-image-lifecycle-contract.test.mjs": 458,
+      "config/scripts/xterm-image-memory-contract.test.mjs": 240,
+      "config/scripts/xterm-image-resize-contract.test.mjs": 69,
+      "config/scripts/xterm-webgl-runtime-contract.test.mjs": 51,
+      "config/scripts/zip-extractor-command.test.mjs": 83,
+      "src/cli/agent-context.test.ts": 56,
+      "src/cli/agent-session-search-format.test.ts": 56,
+      "src/cli/args-repeatable-flags.test.ts": 51,
+      "src/cli/args.test.ts": 259,
+      "src/cli/automation-format.test.ts": 48,
+      "src/cli/automation-owner-conflict-recovery.test.ts": 236,
+      "src/cli/base64-payload-byte-count.test.ts": 28,
+      "src/cli/browser-cookie-credentials-empty-value.test.ts": 190,
+      "src/cli/browser-storage-empty-value.test.ts": 97,
+      "src/cli/browser.test.ts": 279,
+      "src/cli/cli-command-name-parity.test.ts": 80,
+      "src/cli/cli-version.test.ts": 60,
+      "src/cli/codex-command-classification.test.ts": 44,
+      "src/cli/command-suggestion-budget.test.ts": 77,
+      "src/cli/command-suggestion.test.ts": 103,
+      "src/cli/computer-format.test.ts": 35,
+      "src/cli/emulator-logcat-format.test.ts": 41,
+      "src/cli/execution-host-flag.test.ts": 83,
+      "src/cli/flags.test.ts": 34,
+      "src/cli/format-recovery.test.ts": 275,
+      "src/cli/format.test.ts": 481,
+      "src/cli/handler-group-manifest.test.ts": 813,
+      "src/cli/handlers/account.test.ts": 957,
+      "src/cli/handlers/agent-hooks-load-boundary.test.ts": 282,
+      "src/cli/handlers/agent-hooks.test.ts": 998,
+      "src/cli/handlers/artifacts.test.ts": 201,
+      "src/cli/handlers/automation-destination-fencing.test.ts": 171,
+      "src/cli/handlers/automation-owner-fencing.test.ts": 306,
+      "src/cli/handlers/computer-action-routing.test.ts": 137,
+      "src/cli/handlers/computer-action-validation.test.ts": 204,
+      "src/cli/handlers/computer-state-formatting.test.ts": 94,
+      "src/cli/handlers/computer.test.ts": 204,
+      "src/cli/handlers/core.test.ts": 182,
+      "src/cli/handlers/emulator.test.ts": 192,
+      "src/cli/handlers/file-absolute-paths.test.ts": 94,
+      "src/cli/handlers/file.test.ts": 398,
+      "src/cli/handlers/interactive-login-interruption.test.ts": 37,
+      "src/cli/handlers/linear.test.ts": 207,
+      "src/cli/handlers/orchestration-caller-identity-cli.test.ts": 283,
+      "src/cli/handlers/orchestration-check-identity.test.ts": 294,
+      "src/cli/handlers/orchestration-federated-legacy-settlement.test.ts": 251,
+      "src/cli/handlers/orchestration-gate-cli.test.ts": 385,
+      "src/cli/handlers/orchestration-legacy-read-only.test.ts": 238,
+      "src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts": 261,
+      "src/cli/handlers/orchestration-lifecycle-rejection.test.ts": 297,
+      "src/cli/handlers/orchestration-migration.test.ts": 312,
+      "src/cli/handlers/orchestration-module-boundaries.test.ts": 358,
+      "src/cli/handlers/orchestration-request-show-cli.test.ts": 293,
+      "src/cli/handlers/orchestration-run-cli.test.ts": 200,
+      "src/cli/handlers/orchestration-send-receipt-warnings.test.ts": 284,
+      "src/cli/handlers/orchestration-task-create-cli.test.ts": 201,
+      "src/cli/handlers/orchestration-task-list-brief.test.ts": 155,
+      "src/cli/handlers/orchestration-timeout-cli.test.ts": 361,
+      "src/cli/handlers/orchestration-timeout.test.ts": 280,
+      "src/cli/handlers/orchestration-windows-ask-cli.test.ts": 160,
+      "src/cli/handlers/orchestration-worker-cli.test.ts": 527,
+      "src/cli/handlers/orchestration-worker-show-wait-cli.test.ts": 214,
+      "src/cli/handlers/orchestration.test.ts": 549,
+      "src/cli/handlers/orchestration/worker-list-run-scope.test.ts": 243,
+      "src/cli/handlers/orchestration/worker-output.test.ts": 56,
+      "src/cli/handlers/profile-state-recovery-admission.test.ts": 1544,
+      "src/cli/handlers/profile-state.test.ts": 783,
+      "src/cli/handlers/search.test.ts": 251,
+      "src/cli/handlers/skill-sharing.test.ts": 232,
+      "src/cli/handlers/terminal.test.ts": 318,
+      "src/cli/host-selector-alternatives.test.ts": 46,
+      "src/cli/index-automation-identifiers.test.ts": 189,
+      "src/cli/index-automation-schedule.test.ts": 151,
+      "src/cli/index-automation-session-reuse.test.ts": 162,
+      "src/cli/index-automation-source-context.test.ts": 103,
+      "src/cli/index-automation-target.test.ts": 197,
+      "src/cli/index-device-commands.test.ts": 170,
+      "src/cli/index-environment-commands.test.ts": 139,
+      "src/cli/index-local-command-routing-flags.test.ts": 430,
+      "src/cli/index-memory-diagnostics.test.ts": 160,
+      "src/cli/index-omitted-host-scope-selectors.test.ts": 230,
+      "src/cli/index-orchestration.test.ts": 201,
+      "src/cli/index-project-setup.test.ts": 143,
+      "src/cli/index-serve-command.test.ts": 193,
+      "src/cli/index-terminal-commands.test.ts": 344,
+      "src/cli/index-terminal-list-host-scope.test.ts": 161,
+      "src/cli/index-vm-recipe-doctor.test.ts": 408,
+      "src/cli/index-worktree-create-agent.test.ts": 143,
+      "src/cli/index-worktree-create-linear.test.ts": 94,
+      "src/cli/index-worktree-create-parent.test.ts": 386,
+      "src/cli/index-worktree-create-target.test.ts": 98,
+      "src/cli/index-worktree-selector-resolution.test.ts": 352,
+      "src/cli/index-worktree-set.test.ts": 184,
+      "src/cli/index.test.ts": 981,
+      "src/cli/linear-format.test.ts": 47,
+      "src/cli/orchestration-dispatch-refusal-format.test.ts": 75,
+      "src/cli/orchestration-mutation-recovery.test.ts": 212,
+      "src/cli/orchestration-structured-sender-identity.test.ts": 137,
+      "src/cli/orchestration-structured-session-no-identity.test.ts": 389,
+      "src/cli/quote-stripped-json-flag.test.ts": 29,
+      "src/cli/registry-parity.test.ts": 78,
+      "src/cli/retry-request-flag.test.ts": 367,
+      "src/cli/runtime-client-deferral.test.ts": 715,
+      "src/cli/runtime-client.test.ts": 424,
+      "src/cli/runtime/client-recovery.test.ts": 463,
+      "src/cli/runtime/client-timeout-policy.test.ts": 250,
+      "src/cli/runtime/envelope-schema.test.ts": 87,
+      "src/cli/runtime/environments.test.ts": 217,
+      "src/cli/runtime/launch.test.ts": 181,
+      "src/cli/runtime/orchestration-recovery-command.test.ts": 60,
+      "src/cli/runtime/profile-state-recovery-launch.test.ts": 185,
+      "src/cli/runtime/runtime-access-denied.test.ts": 122,
+      "src/cli/runtime/serve-signal-exit-diagnostic.test.ts": 66,
+      "src/cli/runtime/status.test.ts": 233,
+      "src/cli/runtime/transport-framing.test.ts": 222,
+      "src/cli/runtime/transport.test.ts": 656,
+      "src/cli/runtime/types.test.ts": 38,
+      "src/cli/runtime/websocket-transport-error.test.ts": 243,
+      "src/cli/runtime/websocket-transport.test.ts": 355,
+      "src/cli/search-command-arguments.test.ts": 275,
+      "src/cli/serve-electron-flag-parity.test.ts": 58,
+      "src/cli/shell-command-quote.test.ts": 38,
+      "src/cli/skill-guide-cli-parity.test.ts": 106,
+      "src/cli/skills-reference-selector.test.ts": 194,
+      "src/cli/skills.test.ts": 1332,
+      "src/cli/specs/account.test.ts": 50,
+      "src/cli/specs/bundled-guide-flags.test.ts": 262,
+      "src/cli/specs/computer.test.ts": 44,
+      "src/cli/specs/orchestration.test.ts": 33,
+      "src/cli/specs/profile-state.test.ts": 43,
+      "src/cli/specs/search.test.ts": 121,
+      "src/cli/specs/skills.test.ts": 50,
+      "src/cli/terminal-format-draft.test.ts": 50,
+      "src/cli/terminal-format.test.ts": 44,
+      "src/cli/terminal-list-host-scope-format.test.ts": 71,
+      "src/cli/terminal-read-screen.test.ts": 126,
+      "src/cli/vocabulary-policy.test.ts": 67,
+      "src/cli/worktree-selector-wsl-posix-path.test.ts": 49,
+      "src/main/active-view-persistence-boundary.test.ts": 783,
+      "src/main/active-view-preference-sync-flush-veto.test.ts": 788,
+      "src/main/active-view-preference.test.ts": 64,
+      "src/main/agent-auth-restart-preservation.test.ts": 71,
+      "src/main/agent-awake-service-platform-assertions.test.ts": 99,
+      "src/main/agent-awake-service.test.ts": 106,
+      "src/main/agent-hooks/branch-rename-failure-output.test.ts": 26,
+      "src/main/agent-hooks/ended-process-reconciliation.test.ts": 510,
+      "src/main/agent-hooks/first-work-branch-rename.test.ts": 365,
+      "src/main/agent-hooks/first-work-folder-rename.test.ts": 87,
+      "src/main/agent-hooks/grok-replay-guard.test.ts": 101,
+      "src/main/agent-hooks/hook-script-outside-orca.test.ts": 210,
+      "src/main/agent-hooks/hook-status-session-tabs-republish.test.ts": 578,
+      "src/main/agent-hooks/install-telemetry.test.ts": 58,
+      "src/main/agent-hooks/installer-utils-remote.test.ts": 66,
+      "src/main/agent-hooks/installer-utils.test.ts": 180,
+      "src/main/agent-hooks/local-agent-cli-presence.test.ts": 76,
+      "src/main/agent-hooks/managed-agent-hook-controls.test.ts": 261,
+      "src/main/agent-hooks/managed-hook-command-contract.test.ts": 309,
+      "src/main/agent-hooks/managed-hook-detection-commands.test.ts": 64,
+      "src/main/agent-hooks/managed-hook-install-lock.test.ts": 388,
+      "src/main/agent-hooks/managed-hook-local-filesystem.test.ts": 327,
+      "src/main/agent-hooks/managed-hook-owner-identity.test.ts": 84,
+      "src/main/agent-hooks/managed-hook-runtime.test.ts": 409,
+      "src/main/agent-hooks/managed-hook-script-refresh-main-thread.test.ts": 330,
+      "src/main/agent-hooks/managed-hook-script-refresh.test.ts": 471,
+      "src/main/agent-hooks/managed-hook-stdin-lifecycle.test.ts": 2177,
+      "src/main/agent-hooks/managed-hook-timeout.test.ts": 1803,
+      "src/main/agent-hooks/managed-toml-ownership.test.ts": 50,
+      "src/main/agent-hooks/manual-compact-hook-stream.test.ts": 582,
+      "src/main/agent-hooks/manual-compact-status-cleanup.test.ts": 553,
+      "src/main/agent-hooks/migration-unsupported-pty-state.test.ts": 31,
+      "src/main/agent-hooks/opencode-message-part-flood-bench.test.ts": 1229,
+      "src/main/agent-hooks/posix-hook-json-stdin-reader.test.ts": 3494,
+      "src/main/agent-hooks/remote-hook-service-installers.test.ts": 367,
+      "src/main/agent-hooks/remote-hook-service-registry-coverage.test.ts": 238,
+      "src/main/agent-hooks/restored-subagent-liveness-sweep.test.ts": 930,
+      "src/main/agent-hooks/server-ai-vault-liveness.test.ts": 606,
+      "src/main/agent-hooks/server-amp-normalization.test.ts": 570,
+      "src/main/agent-hooks/server-authority-evidence.test.ts": 639,
+      "src/main/agent-hooks/server-claude-cancel-captures.test.ts": 856,
+      "src/main/agent-hooks/server-claude-child-permission-lifecycle.test.ts": 508,
+      "src/main/agent-hooks/server-claude-normalization.test.ts": 497,
+      "src/main/agent-hooks/server-claude-permission-visibility.test.ts": 836,
+      "src/main/agent-hooks/server-claude-statusline.test.ts": 592,
+      "src/main/agent-hooks/server-closed-tab-suppression.test.ts": 614,
+      "src/main/agent-hooks/server-codex-normalization.test.ts": 575,
+      "src/main/agent-hooks/server-codex-subagent-transcript.test.ts": 4597,
+      "src/main/agent-hooks/server-copilot-normalization.test.ts": 1055,
+      "src/main/agent-hooks/server-cursor-normalization.test.ts": 550,
+      "src/main/agent-hooks/server-droid-normalization.test.ts": 592,
+      "src/main/agent-hooks/server-endpoint-file-lifecycle.test.ts": 568,
+      "src/main/agent-hooks/server-escape-navigation-inference.test.ts": 739,
+      "src/main/agent-hooks/server-gemini-normalization.test.ts": 565,
+      "src/main/agent-hooks/server-grok-background-status.test.ts": 760,
+      "src/main/agent-hooks/server-grok-cancel.test.ts": 610,
+      "src/main/agent-hooks/server-grok-discovery.test.ts": 1077,
+      "src/main/agent-hooks/server-hook-http-ingest.test.ts": 388,
+      "src/main/agent-hooks/server-ingest-remote.test.ts": 449,
+      "src/main/agent-hooks/server-ingest-structured-children.test.ts": 590,
+      "src/main/agent-hooks/server-ingest-structured-state-clock.test.ts": 630,
+      "src/main/agent-hooks/server-ingest-structured-status.test.ts": 585,
+      "src/main/agent-hooks/server-ingest-terminal-status.test.ts": 382,
+      "src/main/agent-hooks/server-interrupt-inference-guards.test.ts": 693,
+      "src/main/agent-hooks/server-interrupt-inference-resurrection.test.ts": 646,
+      "src/main/agent-hooks/server-interrupt-inference-validation.test.ts": 419,
+      "src/main/agent-hooks/server-last-status-child-held-main-agent.test.ts": 713,
+      "src/main/agent-hooks/server-last-status-hydrate-confirmation.test.ts": 389,
+      "src/main/agent-hooks/server-last-status-hydrate-validation.test.ts": 488,
+      "src/main/agent-hooks/server-last-status-lead-boundary.test.ts": 647,
+      "src/main/agent-hooks/server-last-status-main-agent-fact.test.ts": 584,
+      "src/main/agent-hooks/server-last-status-restored-children.test.ts": 766,
+      "src/main/agent-hooks/server-last-status-write.test.ts": 699,
+      "src/main/agent-hooks/server-main-agent-turn-verdicts.test.ts": 702,
+      "src/main/agent-hooks/server-muse-session-log-poll.test.ts": 2487,
+      "src/main/agent-hooks/server-observation-provenance.test.ts": 625,
+      "src/main/agent-hooks/server-omp-retired-ingress.test.ts": 610,
+      "src/main/agent-hooks/server-omp-retirement-ack.test.ts": 557,
+      "src/main/agent-hooks/server-opencode-binder.test.ts": 652,
+      "src/main/agent-hooks/server-opencode-lifecycle.test.ts": 765,
+      "src/main/agent-hooks/server-opencode-normalization.test.ts": 380,
+      "src/main/agent-hooks/server-pane-authority.test.ts": 655,
+      "src/main/agent-hooks/server-pi-normalization.test.ts": 557,
+      "src/main/agent-hooks/server-prompt-sent-telemetry.test.ts": 643,
+      "src/main/agent-hooks/server-relay-listener-replay.test.ts": 551,
+      "src/main/agent-hooks/server-relayed-claude-cancel.test.ts": 678,
+      "src/main/agent-hooks/server-reminted-pane-key.test.ts": 672,
+      "src/main/agent-hooks/server-replay-evidence-clock.test.ts": 552,
+      "src/main/agent-hooks/server-retired-pane-new-turn.test.ts": 383,
+      "src/main/agent-hooks/server-start-failure-lifecycle.test.ts": 597,
+      "src/main/agent-hooks/server-status-listener-fanout.test.ts": 739,
+      "src/main/agent-hooks/server-structured-canonical-status.test.ts": 408,
+      "src/main/agent-hooks/server-transport-interference.test.ts": 6270,
+      "src/main/agent-hooks/server.claude-interactive-question.test.ts": 396,
+      "src/main/agent-hooks/spool.test.ts": 891,
+      "src/main/agent-hooks/terminal-handle-row-identity.test.ts": 367,
+      "src/main/agent-hooks/windows-direct-cmd-hook-command.test.ts": 69,
+      "src/main/agent-hooks/windows-hook-payload-delivery.test.ts": 151,
+      "src/main/agent-hooks/windows-hook-post-interpreter.test.ts": 330,
+      "src/main/agent-hooks/windows-powershell-hook-launcher.test.ts": 49,
+      "src/main/agent-hooks/wsl-guest-plugin-install.test.ts": 68,
+      "src/main/agent-hooks/wsl-hook-relay-launch.test.ts": 90,
+      "src/main/agent-hooks/wsl-hook-relay-live.integration.test.ts": 4381,
+      "src/main/agent-hooks/wsl-hook-relay-manager.test.ts": 1974,
+      "src/main/agent-hooks/wsl-hook-relay-reattach.test.ts": 713,
+      "src/main/agent-hooks/wsl-hook-relay-recovery.test.ts": 2365,
+      "src/main/agent-hooks/wsl-hook-relay-sentinel.test.ts": 37,
+      "src/main/agent-launch/agent-launch-executor.test.ts": 330,
+      "src/main/agent-state-file-reader.test.ts": 97,
+      "src/main/agent-trust-presets.test.ts": 137,
+      "src/main/ai-vault-search/session-search-child-service.test.ts": 338,
+      "src/main/ai-vault-search/session-search-content-hash.test.ts": 71,
+      "src/main/ai-vault-search/session-search-cwd-key.test.ts": 78,
+      "src/main/ai-vault-search/session-search-deleted-sources.test.ts": 377,
+      "src/main/ai-vault-search/session-search-directory-listings.test.ts": 50,
+      "src/main/ai-vault-search/session-search-engine.test.ts": 3299,
+      "src/main/ai-vault-search/session-search-file-id.test.ts": 211,
+      "src/main/ai-vault-search/session-search-file-write.test.ts": 622,
+      "src/main/ai-vault-search/session-search-fts5-contract.test.ts": 144,
+      "src/main/ai-vault-search/session-search-hit-ranking.test.ts": 90,
+      "src/main/ai-vault-search/session-search-host-registration.test.ts": 993,
+      "src/main/ai-vault-search/session-search-identifier-split.test.ts": 39,
+      "src/main/ai-vault-search/session-search-index-consumer.test.ts": 255,
+      "src/main/ai-vault-search/session-search-index-generation.test.ts": 579,
+      "src/main/ai-vault-search/session-search-index-pass.test.ts": 419,
+      "src/main/ai-vault-search/session-search-index-writer.test.ts": 480,
+      "src/main/ai-vault-search/session-search-indexer.test.ts": 4288,
+      "src/main/ai-vault-search/session-search-instance.test.ts": 869,
+      "src/main/ai-vault-search/session-search-lifecycle-matrix.test.ts": 3013,
+      "src/main/ai-vault-search/session-search-live-transcript.test.ts": 289,
+      "src/main/ai-vault-search/session-search-merged-roots.test.ts": 409,
+      "src/main/ai-vault-search/session-search-message-rows.test.ts": 420,
+      "src/main/ai-vault-search/session-search-native-chat-indexing.test.ts": 332,
+      "src/main/ai-vault-search/session-search-opencode-index.test.ts": 955,
+      "src/main/ai-vault-search/session-search-orphan-rows.test.ts": 302,
+      "src/main/ai-vault-search/session-search-paging.test.ts": 540,
+      "src/main/ai-vault-search/session-search-query-planner.test.ts": 29,
+      "src/main/ai-vault-search/session-search-read-decision.test.ts": 55,
+      "src/main/ai-vault-search/session-search-retention-delete.test.ts": 171,
+      "src/main/ai-vault-search/session-search-retention-policy.test.ts": 76,
+      "src/main/ai-vault-search/session-search-root-refresh.test.ts": 503,
+      "src/main/ai-vault-search/session-search-row-filter.test.ts": 190,
+      "src/main/ai-vault-search/session-search-row-identity.test.ts": 105,
+      "src/main/ai-vault-search/session-search-scan-roots.test.ts": 195,
+      "src/main/ai-vault-search/session-search-schema.test.ts": 458,
+      "src/main/ai-vault-search/session-search-scope-entry-points.test.ts": 3912,
+      "src/main/ai-vault-search/session-search-scope-resolution.test.ts": 121,
+      "src/main/ai-vault-search/session-search-scope-service.test.ts": 179,
+      "src/main/ai-vault-search/session-search-service-registry.test.ts": 217,
+      "src/main/ai-vault-search/session-search-service.test.ts": 197,
+      "src/main/ai-vault-search/session-search-sidebar-parity.test.ts": 288,
+      "src/main/ai-vault-search/session-search-snippet-marks.test.ts": 213,
+      "src/main/ai-vault-search/session-search-store-is-memory.test.ts": 604,
+      "src/main/ai-vault-search/session-search-store-scope-catalog.test.ts": 40,
+      "src/main/ai-vault-search/session-search-synthetic-corpus.test.ts": 252,
+      "src/main/ai-vault-search/session-search-typo-policy.test.ts": 148,
+      "src/main/ai-vault-search/session-search-typo-scope.test.ts": 162,
+      "src/main/ai-vault-search/session-search-write-lifetime.test.ts": 246,
+      "src/main/ai-vault/ai-vault-scan-cancellation.test.ts": 49,
+      "src/main/ai-vault/ai-vault-scan-coordinator.test.ts": 81,
+      "src/main/ai-vault/cached-session-list-wsl-probe.test.ts": 209,
+      "src/main/ai-vault/cached-session-list.test.ts": 447,
+      "src/main/ai-vault/claude-project-dir-encoding.test.ts": 28,
+      "src/main/ai-vault/codex-session-collection.test.ts": 127,
+      "src/main/ai-vault/codex-session-root-dedup.test.ts": 116,
+      "src/main/ai-vault/local-log-tail-reader.test.ts": 35,
+      "src/main/ai-vault/omp-session-root.test.ts": 159,
+      "src/main/ai-vault/opencode-wsl-runtime-preparation.test.ts": 917,
+      "src/main/ai-vault/remote-session-content-lines.test.ts": 74,
+      "src/main/ai-vault/remote-session-large-transcripts.test.ts": 2163,
+      "src/main/ai-vault/remote-session-parse-cache.test.ts": 229,
+      "src/main/ai-vault/remote-session-scan-batching.test.ts": 32,
+      "src/main/ai-vault/remote-session-scanner-muse.test.ts": 167,
+      "src/main/ai-vault/remote-session-scanner-omp-subagents.test.ts": 172,
+      "src/main/ai-vault/remote-session-scanner-opencode.test.ts": 238,
+      "src/main/ai-vault/remote-session-scanner-sources.test.ts": 118,
+      "src/main/ai-vault/remote-session-scanner.test.ts": 289,
+      "src/main/ai-vault/remote-session-sidecar-observation.test.ts": 134,
+      "src/main/ai-vault/remote-session-stream-lifecycle.test.ts": 74,
+      "src/main/ai-vault/runtime-session-scanner.test.ts": 87,
+      "src/main/ai-vault/runtime-session-search-call.test.ts": 57,
+      "src/main/ai-vault/session-cwd-bucket-layouts.test.ts": 26,
+      "src/main/ai-vault/session-delete-target.test.ts": 112,
+      "src/main/ai-vault/session-delete.test.ts": 215,
+      "src/main/ai-vault/session-document-stream-boundaries.test.ts": 140,
+      "src/main/ai-vault/session-document-stream-parity.test.ts": 115,
+      "src/main/ai-vault/session-document-stream-projection.test.ts": 100,
+      "src/main/ai-vault/session-first-user-prompt-opencode.test.ts": 155,
+      "src/main/ai-vault/session-first-user-prompt-read.test.ts": 110,
+      "src/main/ai-vault/session-list-result-validation.test.ts": 155,
+      "src/main/ai-vault/session-list-results.test.ts": 90,
+      "src/main/ai-vault/session-newest-files.test.ts": 126,
+      "src/main/ai-vault/session-parse-cache-devin-upgrade.test.ts": 214,
+      "src/main/ai-vault/session-parse-cache-persistence.test.ts": 568,
+      "src/main/ai-vault/session-scan-cutoff.test.ts": 68,
+      "src/main/ai-vault/session-scanner-agent-root-overrides.test.ts": 1121,
+      "src/main/ai-vault/session-scanner-antigravity-parser.test.ts": 72,
+      "src/main/ai-vault/session-scanner-antigravity-source.test.ts": 330,
+      "src/main/ai-vault/session-scanner-background.test.ts": 354,
+      "src/main/ai-vault/session-scanner-claude-cwd-drift.test.ts": 245,
+      "src/main/ai-vault/session-scanner-claude-subagent-prune.test.ts": 170,
+      "src/main/ai-vault/session-scanner-claude-subagents.test.ts": 137,
+      "src/main/ai-vault/session-scanner-claude-title.test.ts": 235,
+      "src/main/ai-vault/session-scanner-claude-unicode-scope.test.ts": 176,
+      "src/main/ai-vault/session-scanner-cline-parser.test.ts": 247,
+      "src/main/ai-vault/session-scanner-codex-dual-root.test.ts": 317,
+      "src/main/ai-vault/session-scanner-codex-fast-path.test.ts": 404,
+      "src/main/ai-vault/session-scanner-codex-non-user-origin.test.ts": 41,
+      "src/main/ai-vault/session-scanner-codex-parser.test.ts": 127,
+      "src/main/ai-vault/session-scanner-codex-title-index.test.ts": 213,
+      "src/main/ai-vault/session-scanner-codex-tool-records.test.ts": 75,
+      "src/main/ai-vault/session-scanner-codex-workers.test.ts": 273,
+      "src/main/ai-vault/session-scanner-core-parser-wsl-stall.test.ts": 204,
+      "src/main/ai-vault/session-scanner-cursor-chat-meta.test.ts": 493,
+      "src/main/ai-vault/session-scanner-cutoff.test.ts": 340,
+      "src/main/ai-vault/session-scanner-dedup-batches.test.ts": 320,
+      "src/main/ai-vault/session-scanner-devin-contention.test.ts": 265,
+      "src/main/ai-vault/session-scanner-devin-db.test.ts": 385,
+      "src/main/ai-vault/session-scanner-devin-dedup.test.ts": 305,
+      "src/main/ai-vault/session-scanner-devin-parser.test.ts": 115,
+      "src/main/ai-vault/session-scanner-directory-reader.test.ts": 66,
+      "src/main/ai-vault/session-scanner-discovery-wsl-gate.test.ts": 101,
+      "src/main/ai-vault/session-scanner-first-user-prompt.test.ts": 60,
+      "src/main/ai-vault/session-scanner-fs-import-guard.test.ts": 109,
+      "src/main/ai-vault/session-scanner-graph-parsers.test.ts": 223,
+      "src/main/ai-vault/session-scanner-grok-parser.test.ts": 111,
+      "src/main/ai-vault/session-scanner-grok-user-text.test.ts": 47,
+      "src/main/ai-vault/session-scanner-index-cache-wsl-stall.test.ts": 73,
+      "src/main/ai-vault/session-scanner-injected-title.test.ts": 265,
+      "src/main/ai-vault/session-scanner-jsonl-reader.test.ts": 355,
+      "src/main/ai-vault/session-scanner-kimi-index-cache.test.ts": 103,
+      "src/main/ai-vault/session-scanner-kimi-parser.test.ts": 152,
+      "src/main/ai-vault/session-scanner-muse.test.ts": 250,
+      "src/main/ai-vault/session-scanner-omp-subagent-listing.test.ts": 94,
+      "src/main/ai-vault/session-scanner-omp-subagent-prune.test.ts": 234,
+      "src/main/ai-vault/session-scanner-omp-subagent-transcripts.test.ts": 91,
+      "src/main/ai-vault/session-scanner-omp-title.test.ts": 105,
+      "src/main/ai-vault/session-scanner-opencode-cancellation.test.ts": 393,
+      "src/main/ai-vault/session-scanner-opencode-parser.test.ts": 112,
+      "src/main/ai-vault/session-scanner-opencode-process-admission.test.ts": 264,
+      "src/main/ai-vault/session-scanner-opencode-sources-wsl-stall.test.ts": 103,
+      "src/main/ai-vault/session-scanner-opencode-sources.test.ts": 65,
+      "src/main/ai-vault/session-scanner-opencode-sqlite-bounds.test.ts": 656,
+      "src/main/ai-vault/session-scanner-opencode-sqlite-coexistence.test.ts": 373,
+      "src/main/ai-vault/session-scanner-opencode-sqlite-open.test.ts": 3466,
+      "src/main/ai-vault/session-scanner-opencode-sqlite-paths.test.ts": 35,
+      "src/main/ai-vault/session-scanner-opencode-sqlite-process.test.ts": 3607,
+      "src/main/ai-vault/session-scanner-opencode-sqlite-worker-client.test.ts": 87,
+      "src/main/ai-vault/session-scanner-opencode-sqlite-worker-spawn.test.ts": 103,
+      "src/main/ai-vault/session-scanner-opencode-sqlite.test.ts": 207,
+      "src/main/ai-vault/session-scanner-opencode-wsl-client.test.ts": 80,
+      "src/main/ai-vault/session-scanner-opencode-wsl-routing.test.ts": 129,
+      "src/main/ai-vault/session-scanner-opencode2-message.test.ts": 47,
+      "src/main/ai-vault/session-scanner-opencode2-sqlite.test.ts": 139,
+      "src/main/ai-vault/session-scanner-parse-cache-agents.test.ts": 663,
+      "src/main/ai-vault/session-scanner-parse-cache.test.ts": 294,
+      "src/main/ai-vault/session-scanner-parse-wsl-stall.test.ts": 230,
+      "src/main/ai-vault/session-scanner-parser-stream-cleanup.test.ts": 115,
+      "src/main/ai-vault/session-scanner-pi-scope.test.ts": 310,
+      "src/main/ai-vault/session-scanner-preview-window-truncation.test.ts": 55,
+      "src/main/ai-vault/session-scanner-record-budget.test.ts": 443,
+      "src/main/ai-vault/session-scanner-recoverable-empty.test.ts": 316,
+      "src/main/ai-vault/session-scanner-roots.test.ts": 79,
+      "src/main/ai-vault/session-scanner-scope.test.ts": 200,
+      "src/main/ai-vault/session-scanner-service-cancellation.test.ts": 203,
+      "src/main/ai-vault/session-scanner-service-client.test.ts": 502,
+      "src/main/ai-vault/session-scanner-service-entry-path.test.ts": 43,
+      "src/main/ai-vault/session-scanner-service-entry.test.ts": 541,
+      "src/main/ai-vault/session-scanner-service-env.test.ts": 63,
+      "src/main/ai-vault/session-scanner-service-restart-policy.test.ts": 47,
+      "src/main/ai-vault/session-scanner-service-root-request.test.ts": 31,
+      "src/main/ai-vault/session-scanner-service-root-response.test.ts": 228,
+      "src/main/ai-vault/session-scanner-service-search-roots.test.ts": 577,
+      "src/main/ai-vault/session-scanner-service-search.test.ts": 1214,
+      "src/main/ai-vault/session-scanner-service-spawn.test.ts": 435,
+      "src/main/ai-vault/session-scanner-timeline.test.ts": 75,
+      "src/main/ai-vault/session-scanner-unlimited-dedup.test.ts": 3562,
+      "src/main/ai-vault/session-scanner-values.test.ts": 92,
+      "src/main/ai-vault/session-scanner-worker-client.test.ts": 48,
+      "src/main/ai-vault/session-scanner.test.ts": 343,
+      "src/main/ai-vault/session-sidecar-stat.test.ts": 25,
+      "src/main/ai-vault/session-title-file-reader-wsl-stall.test.ts": 173,
+      "src/main/ai-vault/session-title-file-reader.test.ts": 130,
+      "src/main/ai-vault/session-transcript-consumers.test.ts": 384,
+      "src/main/ai-vault/session-transcript-every-agent-capture.test.ts": 551,
+      "src/main/ai-vault/session-transcript-message-content.test.ts": 48,
+      "src/main/ai-vault/session-transcript-record-budget.test.ts": 63,
+      "src/main/ai-vault/ssh-session-list.test.ts": 288,
+      "src/main/ai-vault/structured-session-ownership.test.ts": 106,
+      "src/main/amp/hook-service.test.ts": 83,
+      "src/main/antigravity/hook-service.test.ts": 144,
+      "src/main/antigravity/windows-hook-payload-delivery.test.ts": 84,
+      "src/main/app-icon.test.ts": 79,
+      "src/main/app-relaunch.test.ts": 60,
+      "src/main/appimage-runtime-identity.test.ts": 91,
+      "src/main/appkit-scene-mutation.test.ts": 28,
+      "src/main/artifacts/artifact-cloud-config.test.ts": 54,
+      "src/main/artifacts/artifact-cloud-recovery.test.ts": 477,
+      "src/main/artifacts/artifact-cloud-service-races.test.ts": 642,
+      "src/main/artifacts/artifact-cloud-service.test.ts": 1148,
+      "src/main/artifacts/artifact-create-intent-store.test.ts": 411,
+      "src/main/artifacts/artifact-recovery-directory-fsync.test.ts": 76,
+      "src/main/artifacts/artifact-share-record-allocation.test.ts": 181,
+      "src/main/artifacts/artifact-share-record-store.test.ts": 300,
+      "src/main/asar-transparent-fs.test.ts": 58,
+      "src/main/automations/automation-dispatch-host-fence.test.ts": 5212,
+      "src/main/automations/automation-owner-fencing.test.ts": 3123,
+      "src/main/automations/automation-owner-migration.test.ts": 64,
+      "src/main/automations/automation-run-terminal-surface.test.ts": 3148,
+      "src/main/automations/automation-run-writer.test.ts": 190,
+      "src/main/automations/automation-skip-coalescing.test.ts": 5292,
+      "src/main/automations/automation-ssh-readoption-migration.test.ts": 63,
+      "src/main/automations/automation-update-host-retarget.test.ts": 2563,
+      "src/main/automations/automation-worker-durability.test.ts": 4821,
+      "src/main/automations/automation-workspace-host-attribution.test.ts": 4398,
+      "src/main/automations/automation-zero-grace-tick-latency.test.ts": 4426,
+      "src/main/automations/dispatch-refusal.test.ts": 64,
+      "src/main/automations/dispatch-tokens.test.ts": 62,
+      "src/main/automations/external-automation-manager-cache.test.ts": 111,
+      "src/main/automations/external-automation-owner-guard.test.ts": 73,
+      "src/main/automations/external-automation-probe-scheduler.test.ts": 150,
+      "src/main/automations/external-job-run-sorting.test.ts": 136,
+      "src/main/automations/external-manager-scoped.test.ts": 90,
+      "src/main/automations/external-manager.test.ts": 157,
+      "src/main/automations/headless-dispatch-durability.test.ts": 348,
+      "src/main/automations/headless-workspace-create.test.ts": 55,
+      "src/main/automations/hermes-cron-output.test.ts": 196,
+      "src/main/automations/precheck-runner.test.ts": 1128,
+      "src/main/automations/refused-manual-run.test.ts": 3358,
+      "src/main/automations/retained-run-reconciliation.test.ts": 4350,
+      "src/main/automations/run-completion-watcher.test.ts": 4513,
+      "src/main/automations/run-target-resolution.test.ts": 51,
+      "src/main/automations/runtime-terminal-run-observer.test.ts": 51,
+      "src/main/automations/schedule-drift-report.test.ts": 62,
+      "src/main/automations/service-precheck.test.ts": 1864,
+      "src/main/automations/service.test.ts": 10184,
+      "src/main/azure-devops/azure-devops-api-request.test.ts": 93,
+      "src/main/azure-devops/client.test.ts": 232,
+      "src/main/azure-devops/pull-request-creation.test.ts": 167,
+      "src/main/azure-devops/pull-request-mappers.test.ts": 39,
+      "src/main/azure-devops/repository-ref.test.ts": 57,
+      "src/main/bitbucket/client.test.ts": 248,
+      "src/main/bitbucket/credential-connection.test.ts": 186,
+      "src/main/bitbucket/credential-store.test.ts": 147,
+      "src/main/bitbucket/pull-request-creation.test.ts": 163,
+      "src/main/bitbucket/pull-request-mappers.test.ts": 43,
+      "src/main/bitbucket/repository-ref.test.ts": 47,
+      "src/main/bitbucket/status-no-decrypt.test.ts": 188,
+      "src/main/browser/agent-browser-bridge-capture-paint-hold.test.ts": 263,
+      "src/main/browser/agent-browser-bridge-command-transport.test.ts": 550,
+      "src/main/browser/agent-browser-bridge-keypress-input.test.ts": 246,
+      "src/main/browser/agent-browser-bridge-mouse-input.test.ts": 323,
+      "src/main/browser/agent-browser-bridge-navigation.test.ts": 484,
+      "src/main/browser/agent-browser-bridge-pointer-input.test.ts": 342,
+      "src/main/browser/agent-browser-bridge-session-lifecycle.test.ts": 608,
+      "src/main/browser/agent-browser-bridge-tab-routing.test.ts": 501,
+      "src/main/browser/agent-browser-bridge-text-input.test.ts": 609,
+      "src/main/browser/agent-browser-orphan-sweep.test.ts": 63,
+      "src/main/browser/agent-browser-process-environment.test.ts": 55,
+      "src/main/browser/agent-browser-session-reset.test.ts": 66,
+      "src/main/browser/browser-certificate-trust-controller.test.ts": 382,
+      "src/main/browser/browser-clicked-link-routing.test.ts": 565,
+      "src/main/browser/browser-client-download-relay.test.ts": 168,
+      "src/main/browser/browser-client-download-routing.test.ts": 185,
+      "src/main/browser/browser-client-file-channel-negotiation.test.ts": 185,
+      "src/main/browser/browser-client-file-channel-reconnect.test.ts": 486,
+      "src/main/browser/browser-client-host-attach-request.test.ts": 153,
+      "src/main/browser/browser-client-host-authority-replacement.test.ts": 138,
+      "src/main/browser/browser-client-host-command-dispatcher.test.ts": 154,
+      "src/main/browser/browser-client-host-command-retention.test.ts": 436,
+      "src/main/browser/browser-client-host-id.test.ts": 85,
+      "src/main/browser/browser-client-host-placement-preparation.test.ts": 93,
+      "src/main/browser/browser-client-host-published-url-wiring.test.ts": 592,
+      "src/main/browser/browser-client-host-reconciliation-command-order.test.ts": 214,
+      "src/main/browser/browser-client-network-route-registry.test.ts": 118,
+      "src/main/browser/browser-client-page-automation-runtime.test.ts": 52,
+      "src/main/browser/browser-client-page-command-executor-fencing.test.ts": 284,
+      "src/main/browser/browser-client-page-command-executor.test.ts": 216,
+      "src/main/browser/browser-client-page-command-integration.test.ts": 231,
+      "src/main/browser/browser-client-page-execution-host-supersession.test.ts": 203,
+      "src/main/browser/browser-client-page-inventory.test.ts": 212,
+      "src/main/browser/browser-client-page-metadata-transport.test.ts": 147,
+      "src/main/browser/browser-client-page-published-url.test.ts": 118,
+      "src/main/browser/browser-client-page-reconciliation-adapters.test.ts": 239,
+      "src/main/browser/browser-client-page-renderer-bridge.test.ts": 109,
+      "src/main/browser/browser-client-page-renderer-lifecycle.electron.test.ts": 843,
+      "src/main/browser/browser-client-page-renderer-runtime.test.ts": 161,
+      "src/main/browser/browser-client-page-unavailability.test.ts": 212,
+      "src/main/browser/browser-client-page-upload-routing.test.ts": 273,
+      "src/main/browser/browser-client-route-cookie-import-partition-parity.test.ts": 220,
+      "src/main/browser/browser-client-route-cookie-import.test.ts": 68,
+      "src/main/browser/browser-client-upload-command.test.ts": 139,
+      "src/main/browser/browser-client-upload-staging.test.ts": 346,
+      "src/main/browser/browser-client-upload-transfer.test.ts": 7621,
+      "src/main/browser/browser-cookie-clear-preserve.test.ts": 125,
+      "src/main/browser/browser-cookie-clear-store-lifecycle.test.ts": 89,
+      "src/main/browser/browser-cookie-clear-store.test.ts": 68,
+      "src/main/browser/browser-cookie-decryption.test.ts": 74,
+      "src/main/browser/browser-cookie-import-app-bound-prefix.test.ts": 400,
+      "src/main/browser/browser-cookie-import-clear-atomicity.test.ts": 71,
+      "src/main/browser/browser-cookie-import-concurrency.test.ts": 490,
+      "src/main/browser/browser-cookie-import-google-exclusion.test.ts": 358,
+      "src/main/browser/browser-cookie-import-partition-fidelity.test.ts": 482,
+      "src/main/browser/browser-cookie-import-partition-reland.electron.test.ts": 2260,
+      "src/main/browser/browser-cookie-import-partition-rollback.electron.test.ts": 675,
+      "src/main/browser/browser-cookie-import-partition-success.electron.test.ts": 893,
+      "src/main/browser/browser-cookie-import-partition.electron.test.ts": 814,
+      "src/main/browser/browser-cookie-import-plan-writes.test.ts": 74,
+      "src/main/browser/browser-cookie-import-policy.test.ts": 248,
+      "src/main/browser/browser-cookie-import-replace-partition-rollback.electron.test.ts": 1224,
+      "src/main/browser/browser-cookie-import-replacement.test.ts": 204,
+      "src/main/browser/browser-cookie-import-route-partition-staging.test.ts": 314,
+      "src/main/browser/browser-cookie-import-scope.test.ts": 285,
+      "src/main/browser/browser-cookie-import-undecryptable.test.ts": 443,
+      "src/main/browser/browser-cookie-import-validated-partition.electron.test.ts": 1035,
+      "src/main/browser/browser-cookie-import-write.test.ts": 38,
+      "src/main/browser/browser-cookie-import.comet.test.ts": 737,
+      "src/main/browser/browser-cookie-import.helium.test.ts": 567,
+      "src/main/browser/browser-cookie-import.test.ts": 3476,
+      "src/main/browser/browser-cookie-public-suffix-scope.test.ts": 42,
+      "src/main/browser/browser-cookie-registrable-family.test.ts": 57,
+      "src/main/browser/browser-cookie-samesite.electron.test.ts": 898,
+      "src/main/browser/browser-cookie-source-partition.test.ts": 42,
+      "src/main/browser/browser-cookie-validation.test.ts": 40,
+      "src/main/browser/browser-download-destination.test.ts": 55,
+      "src/main/browser/browser-execution-host-storage-identity.test.ts": 146,
+      "src/main/browser/browser-google-auth-ua.test.ts": 32,
+      "src/main/browser/browser-grab-payload.test.ts": 39,
+      "src/main/browser/browser-guest-shortcut-forwarding.test.ts": 333,
+      "src/main/browser/browser-guest-wheel-zoom-scroll.test.ts": 34,
+      "src/main/browser/browser-host-client-identity.test.ts": 97,
+      "src/main/browser/browser-host-lease-reconnect-delay.test.ts": 34,
+      "src/main/browser/browser-identity-mode-record.test.ts": 82,
+      "src/main/browser/browser-identity-mode-store.test.ts": 100,
+      "src/main/browser/browser-manager-annotation-bridge.test.ts": 214,
+      "src/main/browser/browser-manager-auth-user-agent.test.ts": 263,
+      "src/main/browser/browser-manager-client-hosted-downloads.test.ts": 366,
+      "src/main/browser/browser-manager-destroyed-guest-downloads.test.ts": 165,
+      "src/main/browser/browser-manager-destroyed-guest.test.ts": 445,
+      "src/main/browser/browser-manager-downloads.test.ts": 320,
+      "src/main/browser/browser-manager-grab-capture.test.ts": 216,
+      "src/main/browser/browser-manager-grab-mode.test.ts": 305,
+      "src/main/browser/browser-manager-grab-selection.test.ts": 169,
+      "src/main/browser/browser-manager-grab-shortcuts.test.ts": 249,
+      "src/main/browser/browser-manager-guest-lifecycle.test.ts": 412,
+      "src/main/browser/browser-manager-guest-policy-profile.test.ts": 279,
+      "src/main/browser/browser-manager-guest-shortcuts.test.ts": 329,
+      "src/main/browser/browser-manager-guest-visibility.test.ts": 178,
+      "src/main/browser/browser-manager-load-failure-replay.test.ts": 280,
+      "src/main/browser/browser-manager-popup-child.test.ts": 189,
+      "src/main/browser/browser-manager-popup-routing.test.ts": 552,
+      "src/main/browser/browser-manager-viewport-override.test.ts": 1098,
+      "src/main/browser/browser-manager-viewport-ownership.test.ts": 298,
+      "src/main/browser/browser-manager-viewport-partial-failure.test.ts": 249,
+      "src/main/browser/browser-manager-worker-request-user-agent.test.ts": 208,
+      "src/main/browser/browser-network-deferred-socket.test.ts": 71,
+      "src/main/browser/browser-network-execution-route.test.ts": 102,
+      "src/main/browser/browser-network-tunnel-client-memory-budget.test.ts": 77,
+      "src/main/browser/browser-network-tunnel-client.test.ts": 107,
+      "src/main/browser/browser-network-tunnel-conformance.test.ts": 162,
+      "src/main/browser/browser-network-tunnel-outbound-memory-budget.test.ts": 71,
+      "src/main/browser/browser-network-tunnel-session-aggregate-memory.test.ts": 32,
+      "src/main/browser/browser-network-tunnel-session-stream-scoped-failure.test.ts": 47,
+      "src/main/browser/browser-network-tunnel-session.test.ts": 93,
+      "src/main/browser/browser-page-initiated-tab-budget.test.ts": 44,
+      "src/main/browser/browser-process-user-agent.test.ts": 40,
+      "src/main/browser/browser-route-dns-prefetch.electron.test.ts": 4575,
+      "src/main/browser/browser-route-guest-popups.test.ts": 126,
+      "src/main/browser/browser-route-h3-egress.electron.test.ts": 14983,
+      "src/main/browser/browser-route-identity.test.ts": 57,
+      "src/main/browser/browser-route-partition-binding-capacity.test.ts": 70,
+      "src/main/browser/browser-route-partition-binding-store.test.ts": 93,
+      "src/main/browser/browser-route-partition-migration.test.ts": 112,
+      "src/main/browser/browser-route-partition-stability.test.ts": 188,
+      "src/main/browser/browser-route-partition-storage-lifecycle.test.ts": 80,
+      "src/main/browser/browser-route-partition-storage-retirement.test.ts": 151,
+      "src/main/browser/browser-route-partition-storage-runtime.test.ts": 57,
+      "src/main/browser/browser-route-persisted-worker-egress.electron.test.ts": 3440,
+      "src/main/browser/browser-route-prepared-page-rekey.test.ts": 45,
+      "src/main/browser/browser-route-session-registry.test.ts": 147,
+      "src/main/browser/browser-route-tcp-egress.electron.test.ts": 1248,
+      "src/main/browser/browser-route-webcontents-registry.test.ts": 264,
+      "src/main/browser/browser-route-webrtc-egress.electron.test.ts": 10714,
+      "src/main/browser/browser-screencast-dialog-settlement.test.ts": 116,
+      "src/main/browser/browser-screencast-lifecycle.test.ts": 69,
+      "src/main/browser/browser-screencast-snapshot-scaling.test.ts": 192,
+      "src/main/browser/browser-screencast-stream.test.ts": 729,
+      "src/main/browser/browser-session-cookie-staging.scoped.test.ts": 370,
+      "src/main/browser/browser-session-cookie-staging.test.ts": 204,
+      "src/main/browser/browser-session-partition-policies.test.ts": 102,
+      "src/main/browser/browser-session-partition-proxy-install.test.ts": 327,
+      "src/main/browser/browser-session-proxy.test.ts": 205,
+      "src/main/browser/browser-session-registry-identity.persistence.test.ts": 400,
+      "src/main/browser/browser-session-registry-import-boundary.test.ts": 33,
+      "src/main/browser/browser-session-registry.persistence.test.ts": 353,
+      "src/main/browser/browser-session-registry.test.ts": 745,
+      "src/main/browser/browser-session-startup.test.ts": 77,
+      "src/main/browser/browser-session-ua-cloudflare-live.electron.test.ts": 657,
+      "src/main/browser/browser-session-ua-wire-identity-cross-context.electron.test.ts": 6292,
+      "src/main/browser/browser-session-ua-wire-identity.electron.test.ts": 9753,
+      "src/main/browser/browser-session-user-agent-migration-inspection.test.ts": 131,
+      "src/main/browser/browser-text-insertion.test.ts": 76,
+      "src/main/browser/browser-viewport-user-agent.test.ts": 43,
+      "src/main/browser/browser-webauthn-access.test.ts": 29,
+      "src/main/browser/browser-webauthn-account-picker.test.ts": 74,
+      "src/main/browser/browser-webauthn-profile-delete.test.ts": 305,
+      "src/main/browser/cdp-bridge-integration.test.ts": 7871,
+      "src/main/browser/cdp-bridge-state.test.ts": 86,
+      "src/main/browser/cdp-client-response-writer.test.ts": 856,
+      "src/main/browser/cdp-keyboard-us-layout.test.ts": 64,
+      "src/main/browser/cdp-print-to-pdf.test.ts": 63,
+      "src/main/browser/cdp-screenshot.test.ts": 105,
+      "src/main/browser/cdp-ws-proxy-focus-replay.test.ts": 336,
+      "src/main/browser/cdp-ws-proxy.test.ts": 2626,
+      "src/main/browser/chromium-cookie-snapshot.test.ts": 889,
+      "src/main/browser/client-route-cookie-import-source-store.test.ts": 103,
+      "src/main/browser/doc-preview-download-block-notice.test.ts": 47,
+      "src/main/browser/doc-preview-failure-notice.test.ts": 42,
+      "src/main/browser/doc-preview-file-reader.test.ts": 107,
+      "src/main/browser/doc-preview-grant-registry.test.ts": 101,
+      "src/main/browser/doc-preview-guest-policy.test.ts": 277,
+      "src/main/browser/doc-preview-protocol.test.ts": 171,
+      "src/main/browser/electron-debugger-lease.test.ts": 37,
+      "src/main/browser/electron-probe-display-launch.test.ts": 57,
+      "src/main/browser/execution-route-socket-duplex.test.ts": 103,
+      "src/main/browser/grab-guest-script.test.ts": 107,
+      "src/main/browser/local-ssh-browser-partition-identity.test.ts": 321,
+      "src/main/browser/local-ssh-browser-partitions.probe-cache.test.ts": 60,
+      "src/main/browser/local-ssh-browser-route.test.ts": 104,
+      "src/main/browser/offscreen-browser-backend-lifecycle.test.ts": 259,
+      "src/main/browser/offscreen-browser-backend.web-preferences.test.ts": 45,
+      "src/main/browser/paired-runtime-browser-client-host-composition.test.ts": 143,
+      "src/main/browser/paired-runtime-browser-client-host-identity-wiring.test.ts": 583,
+      "src/main/browser/paired-runtime-browser-client-host-reconnect.test.ts": 482,
+      "src/main/browser/paired-runtime-browser-client-host-registry.test.ts": 33,
+      "src/main/browser/paired-runtime-browser-client-host-route-identity.test.ts": 503,
+      "src/main/browser/paired-runtime-browser-client-host-runtime.test.ts": 766,
+      "src/main/browser/paired-runtime-browser-client-host.test.ts": 294,
+      "src/main/browser/paired-runtime-browser-host-command-admission.test.ts": 260,
+      "src/main/browser/paired-runtime-browser-host-lease-reconnect.test.ts": 880,
+      "src/main/browser/paired-runtime-browser-host-lease.test.ts": 856,
+      "src/main/browser/paired-runtime-browser-host-reconciliation-negotiation.test.ts": 269,
+      "src/main/browser/paired-runtime-browser-network-route.test.ts": 1212,
+      "src/main/browser/popup-origin-bar-window.test.ts": 96,
+      "src/main/browser/remote-browser-socks-buffering.test.ts": 1704,
+      "src/main/browser/remote-browser-socks-server.test.ts": 290,
+      "src/main/browser/snapshot-engine-iframe-sessions.test.ts": 92,
+      "src/main/browser/snapshot-engine.test.ts": 45,
+      "src/main/browser/ssh-browser-network-execution-route.test.ts": 532,
+      "src/main/browser/system-ssh-socks-client-socket.test.ts": 49,
+      "src/main/browser/wsl-browser-network-execution-route.test.ts": 269,
+      "src/main/browser/wsl-browser-network-relay-launch.test.ts": 65,
+      "src/main/claude-accounts/claude-account-service-account-selection.test.ts": 175,
+      "src/main/claude-accounts/claude-account-service-add-account.test.ts": 190,
+      "src/main/claude-accounts/claude-account-service-api-parity.test.ts": 206,
+      "src/main/claude-accounts/claude-account-service-config-dir-capture.test.ts": 235,
+      "src/main/claude-accounts/claude-account-service-credential-capture.test.ts": 214,
+      "src/main/claude-accounts/claude-account-service-login-process.test.ts": 499,
+      "src/main/claude-accounts/claude-account-service-reauth-rollback.test.ts": 165,
+      "src/main/claude-accounts/claude-duplicate-account.test.ts": 27,
+      "src/main/claude-accounts/claude-login-completion.oracle.test.ts": 162,
+      "src/main/claude-accounts/claude-structured-auth-policy.test.ts": 57,
+      "src/main/claude-accounts/claude-windows-interactive-login.test.ts": 238,
+      "src/main/claude-accounts/keychain-config-directory-aliases.test.ts": 98,
+      "src/main/claude-accounts/keychain.test.ts": 108,
+      "src/main/claude-accounts/live-pty-gate.test.ts": 42,
+      "src/main/claude-accounts/oauth-refresh.test.ts": 95,
+      "src/main/claude-accounts/runtime-auth-path-materialization.test.ts": 294,
+      "src/main/claude-accounts/runtime-auth-service-account-switching.test.ts": 447,
+      "src/main/claude-accounts/runtime-auth-service-deselect-restore.test.ts": 472,
+      "src/main/claude-accounts/runtime-auth-service-keychain-snapshots.test.ts": 695,
+      "src/main/claude-accounts/runtime-auth-service-launch-refresh.test.ts": 255,
+      "src/main/claude-accounts/runtime-auth-service-materialization.test.ts": 355,
+      "src/main/claude-accounts/runtime-auth-service-readback-identity.test.ts": 598,
+      "src/main/claude-accounts/runtime-auth-service-snapshot-validation.test.ts": 278,
+      "src/main/claude-accounts/runtime-auth-service-wsl-runtime.test.ts": 427,
+      "src/main/claude-accounts/runtime-paths.test.ts": 48,
+      "src/main/claude-accounts/runtime-selection.test.ts": 39,
+      "src/main/claude-accounts/windows-command-invocation.test.ts": 39,
+      "src/main/claude-usage/claude-model-pricing.test.ts": 47,
+      "src/main/claude-usage/claude-usage-report-aggregation.test.ts": 57,
+      "src/main/claude-usage/scanner-large-directory.test.ts": 480,
+      "src/main/claude-usage/scanner-scan.test.ts": 128,
+      "src/main/claude-usage/scanner.test.ts": 61,
+      "src/main/claude-usage/store.test.ts": 157,
+      "src/main/claude-usage/transcript-record-parser-prefilter.test.ts": 62,
+      "src/main/claude-usage/worktree-attribution-scaling.test.ts": 63,
+      "src/main/claude/claude-agent-sdk-contract-pins.test.ts": 3181,
+      "src/main/claude/claude-agent-sdk-control-requests.test.ts": 28,
+      "src/main/claude/claude-agent-sdk-exit-proof-identity.test.ts": 125,
+      "src/main/claude/claude-agent-sdk-exit-proof.test.ts": 12835,
+      "src/main/claude/claude-agent-sdk-import-boundary.test.ts": 1974,
+      "src/main/claude/claude-agent-sdk-process-spawn.test.ts": 87,
+      "src/main/claude/claude-agent-sdk-root-kill-fallback.test.ts": 137,
+      "src/main/claude/claude-agent-sdk-user-message-queue.test.ts": 133,
+      "src/main/claude/claude-background-task-resume.test.ts": 66,
+      "src/main/claude/claude-background-task-retention.test.ts": 585,
+      "src/main/claude/claude-background-task-row-journal.test.ts": 142,
+      "src/main/claude/claude-background-task-rows.test.ts": 316,
+      "src/main/claude/claude-background-task-terminal-frames.test.ts": 64,
+      "src/main/claude/claude-background-task-tracker.test.ts": 147,
+      "src/main/claude/claude-background-task-turn-resumption.test.ts": 108,
+      "src/main/claude/claude-child-process-environment.test.ts": 41,
+      "src/main/claude/claude-child-work-decoder.test.ts": 46,
+      "src/main/claude/claude-command-lifecycle-frames.test.ts": 109,
+      "src/main/claude/claude-config-dir-pin.test.ts": 40,
+      "src/main/claude/claude-context-model-switch.test.ts": 165,
+      "src/main/claude/claude-context-usage-restart.test.ts": 376,
+      "src/main/claude/claude-context-usage-unloaded-turn.test.ts": 1419,
+      "src/main/claude/claude-context-usage.test.ts": 124,
+      "src/main/claude/claude-context-window-hint.test.ts": 185,
+      "src/main/claude/claude-descendant-escalation-boundary.test.ts": 514,
+      "src/main/claude/claude-history-window-source-budget.test.ts": 610,
+      "src/main/claude/claude-model-catalog-probe.test.ts": 293,
+      "src/main/claude/claude-provisional-row-corrections.test.ts": 39,
+      "src/main/claude/claude-session-end-hook-capability.test.ts": 33,
+      "src/main/claude/claude-session-end-install.test.ts": 73,
+      "src/main/claude/claude-slash-command-catalog.test.ts": 64,
+      "src/main/claude/claude-stream-json-connection-close.test.ts": 462,
+      "src/main/claude/claude-stream-json-connection.test.ts": 24821,
+      "src/main/claude/claude-streamed-text-checkpoints.test.ts": 41,
+      "src/main/claude/claude-structured-applied-options.test.ts": 472,
+      "src/main/claude/claude-structured-auth-parity.test.ts": 638,
+      "src/main/claude/claude-structured-child-work-captures.test.ts": 755,
+      "src/main/claude/claude-structured-child-work-producer.test.ts": 835,
+      "src/main/claude/claude-structured-compaction.test.ts": 382,
+      "src/main/claude/claude-structured-content-parts.test.ts": 124,
+      "src/main/claude/claude-structured-control-actions.test.ts": 443,
+      "src/main/claude/claude-structured-dispatch-admission.test.ts": 405,
+      "src/main/claude/claude-structured-dispatch-boundary.test.ts": 459,
+      "src/main/claude/claude-structured-dispatch-content.test.ts": 46,
+      "src/main/claude/claude-structured-dispatch-queue-boundary.test.ts": 473,
+      "src/main/claude/claude-structured-dispatch.test.ts": 1776,
+      "src/main/claude/claude-structured-effort-reporting.test.ts": 496,
+      "src/main/claude/claude-structured-history-window.test.ts": 211,
+      "src/main/claude/claude-structured-inbound-control.test.ts": 78,
+      "src/main/claude/claude-structured-journal-prompt-retry.test.ts": 157,
+      "src/main/claude/claude-structured-journal-translation-background-tasks.test.ts": 346,
+      "src/main/claude/claude-structured-journal-translation-context-usage.test.ts": 417,
+      "src/main/claude/claude-structured-journal-translation-subagents.test.ts": 589,
+      "src/main/claude/claude-structured-journal-translation-turn-timing.test.ts": 524,
+      "src/main/claude/claude-structured-journal-translation.plan.test.ts": 87,
+      "src/main/claude/claude-structured-journal-translation.test.ts": 369,
+      "src/main/claude/claude-structured-launch-resolution.test.ts": 396,
+      "src/main/claude/claude-structured-location-support.test.ts": 65,
+      "src/main/claude/claude-structured-model-confirmation.test.ts": 332,
+      "src/main/claude/claude-structured-model-preflight.test.ts": 125,
+      "src/main/claude/claude-structured-option-confirmation.test.ts": 379,
+      "src/main/claude/claude-structured-options-context-window.test.ts": 452,
+      "src/main/claude/claude-structured-options.test.ts": 296,
+      "src/main/claude/claude-structured-owner-identity.test.ts": 64,
+      "src/main/claude/claude-structured-permission-mode.test.ts": 57,
+      "src/main/claude/claude-structured-prompt-items.test.ts": 157,
+      "src/main/claude/claude-structured-prompt-ownership.test.ts": 592,
+      "src/main/claude/claude-structured-provider-fallback.test.ts": 338,
+      "src/main/claude/claude-structured-real-cli.test.ts": 257,
+      "src/main/claude/claude-structured-resume-point.test.ts": 426,
+      "src/main/claude/claude-structured-session-acquisition-processless.test.ts": 471,
+      "src/main/claude/claude-structured-session-adapter-turns.test.ts": 333,
+      "src/main/claude/claude-structured-session-adapter.test.ts": 1001,
+      "src/main/claude/claude-structured-session-close.test.ts": 504,
+      "src/main/claude/claude-structured-session-commands.test.ts": 263,
+      "src/main/claude/claude-structured-session-reading-control.test.ts": 446,
+      "src/main/claude/claude-structured-session-recovery.test.ts": 282,
+      "src/main/claude/claude-structured-session-startup.test.ts": 309,
+      "src/main/claude/claude-structured-turn-resume-point.test.ts": 390,
+      "src/main/claude/claude-subagent-group-row.test.ts": 37,
+      "src/main/claude/claude-subagent-id-aliases.test.ts": 45,
+      "src/main/claude/claude-subagent-roster.test.ts": 105,
+      "src/main/claude/claude-subagent-task-frames.test.ts": 55,
+      "src/main/claude/claude-transcript-branch-graph.test.ts": 60,
+      "src/main/claude/claude-transcript-branch-streaming.test.ts": 224,
+      "src/main/claude/claude-transcript-entry-uuid.test.ts": 36,
+      "src/main/claude/claude-transcript-marker-branch-proof.test.ts": 86,
+      "src/main/claude/claude-transcript-rewind-proof.test.ts": 56,
+      "src/main/claude/claude-turn-outcome.test.ts": 121,
+      "src/main/claude/claude-turn-ownership.test.ts": 3385,
+      "src/main/claude/claude-turn-resumption.test.ts": 185,
+      "src/main/claude/compact-status-registration.test.ts": 175,
+      "src/main/claude/hook-service.test.ts": 401,
+      "src/main/claude/statusline-script.test.ts": 207,
+      "src/main/cli/appimage-extracted-root.test.ts": 198,
+      "src/main/cli/appimage-extraction-pruning.test.ts": 90,
+      "src/main/cli/appimage-payload-removal.reentrancy.test.ts": 49,
+      "src/main/cli/appimage-payload-removal.test.ts": 66,
+      "src/main/cli/appimage-registration-lock.test.ts": 57,
+      "src/main/cli/appimage-stable-launcher.test.ts": 231,
+      "src/main/cli/cli-command-installation-races.test.ts": 187,
+      "src/main/cli/cli-command-privileged-transaction.test.ts": 133,
+      "src/main/cli/cli-installer-appimage-ownership.test.ts": 206,
+      "src/main/cli/cli-installer-appimage-removal.test.ts": 281,
+      "src/main/cli/cli-installer-command-conflicts.test.ts": 230,
+      "src/main/cli/cli-installer-macos-command-path.test.ts": 250,
+      "src/main/cli/cli-installer-windows-path.test.ts": 148,
+      "src/main/cli/cli-installer.test.ts": 323,
+      "src/main/cli/cli-privileged-processes.test.ts": 51,
+      "src/main/cli/keyed-promise-queue.test.ts": 33,
+      "src/main/cli/legacy-appimage-cli-wrapper.test.ts": 57,
+      "src/main/cli/linux-bare-orca-dispatcher.test.ts": 173,
+      "src/main/cli/linux-terminal-orca-cli-shim.test.ts": 154,
+      "src/main/cli/native-cli-powershell-argv-boundary.test.ts": 54,
+      "src/main/cli/orca-cli-child-path.test.ts": 71,
+      "src/main/cli/packaged-cli-assets.test.ts": 863,
+      "src/main/cli/windows-launcher-asset.test.ts": 42,
+      "src/main/cli/windows-user-path-registry.test.ts": 63,
+      "src/main/cli/wsl-cli-installer.test.ts": 298,
+      "src/main/cli/wsl-cli-powershell-boundary.test.ts": 104,
+      "src/main/cli/wsl-cli-registration-operation.test.ts": 90,
+      "src/main/cli/wsl-cli-registration-reconciliation.test.ts": 264,
+      "src/main/cli/wsl-cli-registration-registry.test.ts": 174,
+      "src/main/cli/wsl-managed-cli.test.ts": 51,
+      "src/main/cli/wsl-managed-cli.wsl.test.ts": 93,
+      "src/main/codex-accounts/async-file-rename.test.ts": 1055,
+      "src/main/codex-accounts/codex-account-identity-api-key-guard.test.ts": 49,
+      "src/main/codex-accounts/codex-auth-workspace-identity.test.ts": 57,
+      "src/main/codex-accounts/codex-config-mirror.test.ts": 218,
+      "src/main/codex-accounts/codex-credential-absence-grace.test.ts": 138,
+      "src/main/codex-accounts/codex-login-auth-url.test.ts": 49,
+      "src/main/codex-accounts/codex-reset-credit-ledger.test.ts": 274,
+      "src/main/codex-accounts/codex-windows-interactive-login.test.ts": 343,
+      "src/main/codex-accounts/fs-utils.test.ts": 174,
+      "src/main/codex-accounts/host-codex-managed-home-ownership.test.ts": 40,
+      "src/main/codex-accounts/legacy-shared-auth-migration.test.ts": 121,
+      "src/main/codex-accounts/legacy-shared-config-compatibility.test.ts": 124,
+      "src/main/codex-accounts/legacy-wsl-runtime-auth-drain-apply-script.test.ts": 17191,
+      "src/main/codex-accounts/legacy-wsl-runtime-auth-drain-rollback-script.test.ts": 622,
+      "src/main/codex-accounts/legacy-wsl-runtime-auth-drain.test.ts": 77,
+      "src/main/codex-accounts/managed-codex-auth-readiness.test.ts": 76,
+      "src/main/codex-accounts/runtime-home-legacy-migration.test.ts": 608,
+      "src/main/codex-accounts/runtime-home-managed-auth-recovery.test.ts": 326,
+      "src/main/codex-accounts/runtime-home-mirrored-status-home.test.ts": 224,
+      "src/main/codex-accounts/runtime-home-per-account-homes.test.ts": 722,
+      "src/main/codex-accounts/runtime-home-read-only-launch-resolution.test.ts": 848,
+      "src/main/codex-accounts/runtime-home-real-home-lane-routing.test.ts": 445,
+      "src/main/codex-accounts/runtime-home-resume-selection-gate.test.ts": 295,
+      "src/main/codex-accounts/runtime-home-retained-auth-provenance.test.ts": 1201,
+      "src/main/codex-accounts/runtime-home-service-per-account-migration.test.ts": 482,
+      "src/main/codex-accounts/runtime-home-session-migration-pass.test.ts": 408,
+      "src/main/codex-accounts/runtime-home-system-default-mirror-readback.test.ts": 1006,
+      "src/main/codex-accounts/runtime-home-system-default-snapshot.test.ts": 740,
+      "src/main/codex-accounts/runtime-home-system-resource-materialization.test.ts": 490,
+      "src/main/codex-accounts/runtime-home-windows-profile-ownership.test.ts": 136,
+      "src/main/codex-accounts/runtime-home-wsl-managed-accounts.test.ts": 1054,
+      "src/main/codex-accounts/runtime-home-wsl-session-bridge.test.ts": 890,
+      "src/main/codex-accounts/runtime-home-wsl-system-default.test.ts": 503,
+      "src/main/codex-accounts/runtime-selection.test.ts": 73,
+      "src/main/codex-accounts/service-abandoned-login-supersede.test.ts": 861,
+      "src/main/codex-accounts/service-account-add-login.test.ts": 509,
+      "src/main/codex-accounts/service-account-selection-and-removal.test.ts": 846,
+      "src/main/codex-accounts/service-add-account-from-home.test.ts": 444,
+      "src/main/codex-accounts/service-login-process-teardown.test.ts": 426,
+      "src/main/codex-accounts/service-managed-home-removal-retries.test.ts": 186,
+      "src/main/codex-accounts/service-quota-refresh-decoupling.test.ts": 280,
+      "src/main/codex-accounts/service-reauthenticate-activation.test.ts": 268,
+      "src/main/codex-accounts/service-reset-credit-durability.test.ts": 703,
+      "src/main/codex-accounts/service-reset-credit-home-ownership.test.ts": 473,
+      "src/main/codex-accounts/service-reset-credit-target-routing.test.ts": 580,
+      "src/main/codex-accounts/service-system-default-identity.test.ts": 490,
+      "src/main/codex-accounts/service-wsl-accounts.test.ts": 660,
+      "src/main/codex-accounts/service.test.ts": 260,
+      "src/main/codex-accounts/sta-4422-transient-ownership-error.test.ts": 409,
+      "src/main/codex-accounts/sta-4734-login-rollback-deletes-authenticated-home.test.ts": 292,
+      "src/main/codex-accounts/sta-4735-unreadable-host-lane-writes.test.ts": 392,
+      "src/main/codex-accounts/wsl-codex-command.test.ts": 40,
+      "src/main/codex-cli/codex-home-process-lock.test.ts": 54,
+      "src/main/codex-cli/command.test.ts": 88,
+      "src/main/codex-usage/codex-rollout-resume-state.test.ts": 67,
+      "src/main/codex-usage/codex-usage-cost-estimate.test.ts": 46,
+      "src/main/codex-usage/codex-usage-long-context-billing.test.ts": 242,
+      "src/main/codex-usage/scanner-attribution-memo.test.ts": 170,
+      "src/main/codex-usage/scanner-file-identity.test.ts": 211,
+      "src/main/codex-usage/scanner-incremental-append.test.ts": 1002,
+      "src/main/codex-usage/scanner-large-directory.test.ts": 1168,
+      "src/main/codex-usage/scanner-paths.test.ts": 340,
+      "src/main/codex-usage/scanner.test.ts": 158,
+      "src/main/codex-usage/store-automation-usage.test.ts": 117,
+      "src/main/codex-usage/store-model-pricing.test.ts": 215,
+      "src/main/codex-usage/store-orca-scope.test.ts": 185,
+      "src/main/codex-usage/store-persistence.test.ts": 125,
+      "src/main/codex-usage/store-snapshot.benchmark.test.ts": 310,
+      "src/main/codex/codex-account-session-bridge.test.ts": 77,
+      "src/main/codex/codex-ai-vault-session-resume.test.ts": 127,
+      "src/main/codex/codex-app-server-capability-cache.test.ts": 64,
+      "src/main/codex/codex-app-server-client.test.ts": 1502,
+      "src/main/codex/codex-app-server-connection.test.ts": 5199,
+      "src/main/codex/codex-app-server-posix-supervisor.test.ts": 38,
+      "src/main/codex/codex-app-server-process-teardown.test.ts": 71,
+      "src/main/codex/codex-app-server-session.test.ts": 129,
+      "src/main/codex/codex-app-server-teardown.integration.test.ts": 21677,
+      "src/main/codex/codex-background-command-tracker.test.ts": 221,
+      "src/main/codex/codex-background-task-tracker.test.ts": 163,
+      "src/main/codex/codex-config-mirror-mcp-ownership.test.ts": 138,
+      "src/main/codex/codex-config-mirror.test.ts": 181,
+      "src/main/codex/codex-config-settings-removal.test.ts": 49,
+      "src/main/codex/codex-configured-launch-defaults.test.ts": 30,
+      "src/main/codex/codex-daemon-socket-path-guard.test.ts": 153,
+      "src/main/codex/codex-goal-journal-rows.test.ts": 90,
+      "src/main/codex/codex-home-paths.test.ts": 76,
+      "src/main/codex/codex-hook-legacy-profile-block.test.ts": 132,
+      "src/main/codex/codex-hook-trust-grant.test.ts": 1397,
+      "src/main/codex/codex-hooks-read-denial-followup.test.ts": 179,
+      "src/main/codex/codex-index-heal-binary-contract.test.ts": 49,
+      "src/main/codex/codex-legacy-session-resume.test.ts": 208,
+      "src/main/codex/codex-model-catalog-probe.test.ts": 3179,
+      "src/main/codex/codex-model-provider-config.test.ts": 32,
+      "src/main/codex/codex-notice-item-translation.test.ts": 226,
+      "src/main/codex/codex-pane-account-registry-mutations.test.ts": 50,
+      "src/main/codex/codex-pane-launch-account.test.ts": 64,
+      "src/main/codex/codex-persistent-command-retention.test.ts": 276,
+      "src/main/codex/codex-pinned-rollout-proof.test.ts": 53,
+      "src/main/codex/codex-prompt-registry-retention.test.ts": 376,
+      "src/main/codex/codex-real-home-hook-install.test.ts": 339,
+      "src/main/codex/codex-real-home-path.test.ts": 57,
+      "src/main/codex/codex-requested-close-turn-timing.test.ts": 134,
+      "src/main/codex/codex-rollout-session-meta.test.ts": 81,
+      "src/main/codex/codex-server-request-disposition.test.ts": 112,
+      "src/main/codex/codex-session-backfill-marker.test.ts": 89,
+      "src/main/codex/codex-session-backfill-scan-dates.test.ts": 83,
+      "src/main/codex/codex-session-backfill.test.ts": 647,
+      "src/main/codex/codex-session-bridge.test.ts": 112,
+      "src/main/codex/codex-session-index-heal-state.test.ts": 345,
+      "src/main/codex/codex-session-index-heal.test.ts": 1408,
+      "src/main/codex/codex-session-migration-recent-exits.test.ts": 61,
+      "src/main/codex/codex-session-migration-scheduler.test.ts": 401,
+      "src/main/codex/codex-session-resume-home.test.ts": 66,
+      "src/main/codex/codex-session-resume-preparation.test.ts": 65,
+      "src/main/codex/codex-session-resume-windows.test.ts": 59,
+      "src/main/codex/codex-session-resume-wrong-account.test.ts": 60,
+      "src/main/codex/codex-session-source-home.test.ts": 30,
+      "src/main/codex/codex-stale-pane-accounts.test.ts": 130,
+      "src/main/codex/codex-state-db-backfill-recovery.test.ts": 307,
+      "src/main/codex/codex-state-db.test.ts": 70,
+      "src/main/codex/codex-structured-acquisition-exit-proof.test.ts": 417,
+      "src/main/codex/codex-structured-child-environment.test.ts": 134,
+      "src/main/codex/codex-structured-dispatch-admission.test.ts": 507,
+      "src/main/codex/codex-structured-dispatch-boundary.test.ts": 414,
+      "src/main/codex/codex-structured-dispatch-echo.test.ts": 57,
+      "src/main/codex/codex-structured-fast-mode.test.ts": 320,
+      "src/main/codex/codex-structured-item-translation.test.ts": 161,
+      "src/main/codex/codex-structured-journal-compactions.test.ts": 267,
+      "src/main/codex/codex-structured-journal-goal-admission.test.ts": 258,
+      "src/main/codex/codex-structured-journal-goal-resume.test.ts": 327,
+      "src/main/codex/codex-structured-journal-goal-revision.test.ts": 242,
+      "src/main/codex/codex-structured-journal-goal-rows.test.ts": 107,
+      "src/main/codex/codex-structured-journal-subagent-readers.test.ts": 292,
+      "src/main/codex/codex-structured-journal-translation-settlement.test.ts": 1118,
+      "src/main/codex/codex-structured-journal-translation-streams.test.ts": 275,
+      "src/main/codex/codex-structured-journal-translation-subagent-linkage.test.ts": 245,
+      "src/main/codex/codex-structured-journal-translation-subagents.test.ts": 186,
+      "src/main/codex/codex-structured-journal-translation-turn-lifecycle.test.ts": 398,
+      "src/main/codex/codex-structured-journal-translation-turn-state.test.ts": 35,
+      "src/main/codex/codex-structured-journal-translation.test.ts": 282,
+      "src/main/codex/codex-structured-launch-resolution.test.ts": 102,
+      "src/main/codex/codex-structured-location-support.test.ts": 46,
+      "src/main/codex/codex-structured-owner-identity.test.ts": 45,
+      "src/main/codex/codex-structured-permission-policy.test.ts": 63,
+      "src/main/codex/codex-structured-prompt-items.test.ts": 224,
+      "src/main/codex/codex-structured-prompt-ownership.test.ts": 512,
+      "src/main/codex/codex-structured-prompt-replies.test.ts": 165,
+      "src/main/codex/codex-structured-rewind.test.ts": 306,
+      "src/main/codex/codex-structured-session-adapter-lifecycle.test.ts": 367,
+      "src/main/codex/codex-structured-session-adapter.test.ts": 318,
+      "src/main/codex/codex-structured-session-background-tasks.test.ts": 502,
+      "src/main/codex/codex-structured-session-cancel.test.ts": 456,
+      "src/main/codex/codex-structured-session-close.test.ts": 420,
+      "src/main/codex/codex-structured-session-options-catalog.test.ts": 246,
+      "src/main/codex/codex-structured-session-options.test.ts": 356,
+      "src/main/codex/codex-structured-session-shutdown.test.ts": 471,
+      "src/main/codex/codex-structured-thread-goal.test.ts": 73,
+      "src/main/codex/codex-structured-thread-open.test.ts": 300,
+      "src/main/codex/codex-structured-turn-processes.integration.test.ts": 194,
+      "src/main/codex/codex-subagent-execution-projection.test.ts": 202,
+      "src/main/codex/codex-subagent-executions.test.ts": 71,
+      "src/main/codex/codex-subagent-roster.test.ts": 118,
+      "src/main/codex/codex-tool-identity-translation.test.ts": 117,
+      "src/main/codex/codex-trust-config-concurrent-launch.test.ts": 225,
+      "src/main/codex/codex-trust-config-mutation-queue.test.ts": 45,
+      "src/main/codex/codex-trust-config-rollback.test.ts": 76,
+      "src/main/codex/codex-trust-grant-host.test.ts": 94,
+      "src/main/codex/codex-trust-grant-ledger.test.ts": 54,
+      "src/main/codex/codex-trust-grant-main-thread-boundary.test.ts": 43,
+      "src/main/codex/codex-trust-grant-telemetry.test.ts": 70,
+      "src/main/codex/codex-turn-ordinals.test.ts": 96,
+      "src/main/codex/codex-user-hook-trust-rebase-client.test.ts": 104,
+      "src/main/codex/codex-user-hook-trust-rebase.test.ts": 127,
+      "src/main/codex/codex-wsl-hook-install-plan.test.ts": 51,
+      "src/main/codex/config-plugin-registration-promotion.test.ts": 370,
+      "src/main/codex/config-settings-baseline-upgrade.test.ts": 104,
+      "src/main/codex/config-settings-promotion.test.ts": 508,
+      "src/main/codex/config-sync-stall.test.ts": 161,
+      "src/main/codex/config-toml-hook-trust-scaling.test.ts": 126,
+      "src/main/codex/config-toml-mcp-servers.test.ts": 37,
+      "src/main/codex/config-toml-trust-api-parity.test.ts": 91,
+      "src/main/codex/config-toml-trust-hash.test.ts": 44,
+      "src/main/codex/config-toml-trust-hook-read.test.ts": 125,
+      "src/main/codex/config-toml-trust-hook-removal.test.ts": 108,
+      "src/main/codex/config-toml-trust-hook-upsert.test.ts": 163,
+      "src/main/codex/config-toml-trust-key.test.ts": 54,
+      "src/main/codex/config-toml-trust-paths.test.ts": 86,
+      "src/main/codex/config-toml-trust-project.test.ts": 105,
+      "src/main/codex/hook-service-concurrent-launch-install.test.ts": 749,
+      "src/main/codex/hook-service-legacy-cleanup.test.ts": 1004,
+      "src/main/codex/hook-service-managed-install.test.ts": 286,
+      "src/main/codex/hook-service-runtime-trust-repair.test.ts": 330,
+      "src/main/codex/hook-service-trust-grant.test.ts": 355,
+      "src/main/codex/hook-service-user-hook-mirroring.test.ts": 371,
+      "src/main/codex/hook-service-wsl-runtime.test.ts": 389,
+      "src/main/codex/hook-trust-promotion.test.ts": 569,
+      "src/main/codex/managed-home-shell-preflight.test.ts": 161,
+      "src/main/codex/retained-codex-hook-state.test.ts": 41,
+      "src/main/codex/sta-4735-hook-trust-provenance-overwrite.test.ts": 82,
+      "src/main/codex/sta-4737-unreadable-is-not-absent.test.ts": 179,
+      "src/main/codex/sta-4823-shared-state-survives-a-failed-read.test.ts": 226,
+      "src/main/codex/windows-hook-command.test.ts": 161,
+      "src/main/codex/windows-hook-upgrade.test.ts": 122,
+      "src/main/codex/wsl-codex-session-bridge.test.ts": 133,
+      "src/main/command-code/hook-service.test.ts": 407,
+      "src/main/computer/computer-action-verification-normalization.test.ts": 37,
+      "src/main/computer/computer-provider-lifecycle.test.ts": 159,
+      "src/main/computer/computer-provider-unavailable-message.test.ts": 40,
+      "src/main/computer/computer-sidecar-diagnostics.test.ts": 37,
+      "src/main/computer/desktop-script-provider-action-errors.test.ts": 162,
+      "src/main/computer/desktop-script-provider-actions.test.ts": 167,
+      "src/main/computer/desktop-script-provider-bridge.test.ts": 45,
+      "src/main/computer/desktop-script-provider-cache-lifecycle.test.ts": 114,
+      "src/main/computer/desktop-script-provider-cache.test.ts": 191,
+      "src/main/computer/desktop-script-provider-client.test.ts": 205,
+      "src/main/computer/desktop-script-provider-errors.test.ts": 205,
+      "src/main/computer/desktop-script-provider-paste-validation.test.ts": 107,
+      "src/main/computer/desktop-script-provider-runtime-host-routing.test.ts": 204,
+      "src/main/computer/desktop-script-runtime-host.test.ts": 199,
+      "src/main/computer/desktop-script-runtime-host.win32.test.ts": 94,
+      "src/main/computer/desktop-script-serve-channel.test.ts": 170,
+      "src/main/computer/macos-computer-use-permission-status.test.ts": 97,
+      "src/main/computer/macos-computer-use-permissions.test.ts": 90,
+      "src/main/computer/macos-native-provider-client.test.ts": 1206,
+      "src/main/computer/macos-native-provider-line-buffer.test.ts": 62,
+      "src/main/computer/macos-native-provider-paste-validation.test.ts": 192,
+      "src/main/computer/macos-native-provider-process-reaping.test.ts": 94,
+      "src/main/computer/macos-native-provider-reaping.integration.test.ts": 4215,
+      "src/main/computer/macos-native-provider-socket.test.ts": 71,
+      "src/main/computer/macos-native-provider-startup-cleanup.test.ts": 73,
+      "src/main/computer/sidecar-client.test.ts": 96,
+      "src/main/computer/sidecar-provider-reaping.integration.test.ts": 313,
+      "src/main/computer/windows-powershell-execution-policy.test.ts": 62,
+      "src/main/copilot/hook-service.test.ts": 164,
+      "src/main/crash-reporting/crash-breadcrumb-renderer-attribution.test.ts": 34,
+      "src/main/crash-reporting/crash-breadcrumb-store-leak.test.ts": 111,
+      "src/main/crash-reporting/crash-breadcrumb-store-orphan-cleanup.test.ts": 108,
+      "src/main/crash-reporting/crash-breadcrumb-store.test.ts": 166,
+      "src/main/crash-reporting/crash-report-copy-text.test.ts": 56,
+      "src/main/crash-reporting/crash-report-store.test.ts": 453,
+      "src/main/crash-reporting/crashpad-capture-read-limit.test.ts": 267,
+      "src/main/crash-reporting/crashpad-capture.test.ts": 94,
+      "src/main/crash-reporting/durable-crash-breadcrumb.test.ts": 71,
+      "src/main/crash-reporting/expected-teardown-state.test.ts": 38,
+      "src/main/crash-reporting/gpu-crash-diagnostics.test.ts": 49,
+      "src/main/crash-reporting/gpu-crash-fallback-decision.test.ts": 38,
+      "src/main/crash-reporting/gpu-crash-fallback-field-sessions.test.ts": 40,
+      "src/main/crash-reporting/gpu-fallback-engagement.test.ts": 60,
+      "src/main/crash-reporting/gpu-fallback-recovered-launch.test.ts": 69,
+      "src/main/crash-reporting/gpu-fallback-restart-prompt.test.ts": 39,
+      "src/main/crash-reporting/main-process-lifecycle-identity.test.ts": 68,
+      "src/main/crash-reporting/minidump-crash-signature.test.ts": 59,
+      "src/main/crash-reporting/minidump-file-source.test.ts": 200,
+      "src/main/crash-reporting/pre-gone-host-memory.test.ts": 96,
+      "src/main/crash-reporting/process-gone-classification.test.ts": 51,
+      "src/main/crash-reporting/process-gone-dedupe.test.ts": 33,
+      "src/main/crash-reporting/process-gone-diagnostics.test.ts": 114,
+      "src/main/crash-reporting/process-gone-killed-one-ordering.test.ts": 108,
+      "src/main/crash-reporting/process-gone-recorder.test.ts": 967,
+      "src/main/crash-reporting/process-gone-sibling-correlation.test.ts": 686,
+      "src/main/crash-reporting/renderer-recovery-circuit-breaker.test.ts": 48,
+      "src/main/crash-reporting/self-initiated-tree-kill-log.test.ts": 296,
+      "src/main/crash-reporting/suppressed-process-gone-breadcrumb.test.ts": 24,
+      "src/main/cursor/hook-service.test.ts": 281,
+      "src/main/daemon/agent-startup-prompt-latency.node-pty.test.ts": 2349,
+      "src/main/daemon/bash-prompt-command-composition.test.ts": 2955,
+      "src/main/daemon/client.test.ts": 523,
+      "src/main/daemon/cold-restore-payload-cache.test.ts": 34,
+      "src/main/daemon/daemon-adoption-telemetry-event.test.ts": 269,
+      "src/main/daemon/daemon-audit-eligibility-event.test.ts": 807,
+      "src/main/daemon/daemon-authenticated-client-activity.test.ts": 408,
+      "src/main/daemon/daemon-background-transient-facts.test.ts": 89,
+      "src/main/daemon/daemon-bundle-staleness.test.ts": 461,
+      "src/main/daemon/daemon-cgroup-scope.test.ts": 87,
+      "src/main/daemon/daemon-checkpoint-session-queue.test.ts": 243,
+      "src/main/daemon/daemon-client-notify-settlement.test.ts": 66,
+      "src/main/daemon/daemon-client-rpc-request.test.ts": 97,
+      "src/main/daemon/daemon-client-stream-keepalive.test.ts": 43,
+      "src/main/daemon/daemon-durable-checkpoint-live-rebase.test.ts": 1035,
+      "src/main/daemon/daemon-endpoint-ownership.test.ts": 525,
+      "src/main/daemon/daemon-endpoint-publish.test.ts": 114,
+      "src/main/daemon/daemon-endpoint-windows.test.ts": 50,
+      "src/main/daemon/daemon-entry-path-layouts.test.ts": 353,
+      "src/main/daemon/daemon-entry.test.ts": 517,
+      "src/main/daemon/daemon-errors.test.ts": 159,
+      "src/main/daemon/daemon-file-log.test.ts": 63,
+      "src/main/daemon/daemon-folder-access-mismatch.test.ts": 241,
+      "src/main/daemon/daemon-folder-access-probe-script.test.ts": 198,
+      "src/main/daemon/daemon-folder-access-probe.test.ts": 68,
+      "src/main/daemon/daemon-folder-access-reset.test.ts": 215,
+      "src/main/daemon/daemon-foreground-confirmation-protocol.test.ts": 50,
+      "src/main/daemon/daemon-health-endpoint-entry.test.ts": 78,
+      "src/main/daemon/daemon-health-socket-cleanup.test.ts": 83,
+      "src/main/daemon/daemon-health.test.ts": 3556,
+      "src/main/daemon/daemon-host-relocation.test.ts": 486,
+      "src/main/daemon/daemon-idle-shutdown.test.ts": 1312,
+      "src/main/daemon/daemon-incarnation-evidence-main-thread.test.ts": 52,
+      "src/main/daemon/daemon-incarnation-evidence.test.ts": 62,
+      "src/main/daemon/daemon-init-child-readiness.test.ts": 488,
+      "src/main/daemon/daemon-init-child-startup-failure.test.ts": 630,
+      "src/main/daemon/daemon-init-endpoint-adoption.test.ts": 1191,
+      "src/main/daemon/daemon-init-live-session-preservation.test.ts": 667,
+      "src/main/daemon/daemon-init-packaged-bundle-staleness.test.ts": 303,
+      "src/main/daemon/daemon-init-provider-installation.test.ts": 493,
+      "src/main/daemon/daemon-init-replacement-reporting.test.ts": 568,
+      "src/main/daemon/daemon-init-restart-sequence.test.ts": 865,
+      "src/main/daemon/daemon-init-wedged-daemon-grace.test.ts": 452,
+      "src/main/daemon/daemon-launched-child-identity.test.ts": 119,
+      "src/main/daemon/daemon-launched-child-spawn.test.ts": 64,
+      "src/main/daemon/daemon-lifecycle-event.test.ts": 196,
+      "src/main/daemon/daemon-mac-code-identity.test.ts": 76,
+      "src/main/daemon/daemon-main.test.ts": 421,
+      "src/main/daemon/daemon-native-pty-exception.test.ts": 39,
+      "src/main/daemon/daemon-pid-file-parse.test.ts": 41,
+      "src/main/daemon/daemon-preflight-client-replacement.test.ts": 704,
+      "src/main/daemon/daemon-process-identity-time-zone.test.ts": 90,
+      "src/main/daemon/daemon-process-inspection.test.ts": 63,
+      "src/main/daemon/daemon-protocol-version.test.ts": 34,
+      "src/main/daemon/daemon-pty-adapter-cold-restore-reanchor.test.ts": 1246,
+      "src/main/daemon/daemon-pty-adapter-cold-restore-seed.test.ts": 1188,
+      "src/main/daemon/daemon-pty-adapter-concurrent-recovery.test.ts": 887,
+      "src/main/daemon/daemon-pty-adapter-daemon-recovery.test.ts": 1496,
+      "src/main/daemon/daemon-pty-adapter-history-checkpoints.test.ts": 2334,
+      "src/main/daemon/daemon-pty-adapter-history-recovery.test.ts": 1236,
+      "src/main/daemon/daemon-pty-adapter-inventory-respawn.test.ts": 593,
+      "src/main/daemon/daemon-pty-adapter-live-rebased-checkpoint.test.ts": 1713,
+      "src/main/daemon/daemon-pty-adapter-protocol-compatibility.test.ts": 2069,
+      "src/main/daemon/daemon-pty-adapter-replacement-exit-race.test.ts": 767,
+      "src/main/daemon/daemon-pty-adapter-session-adoption.test.ts": 1235,
+      "src/main/daemon/daemon-pty-adapter-steady-state-compat.test.ts": 468,
+      "src/main/daemon/daemon-pty-adapter.test.ts": 4255,
+      "src/main/daemon/daemon-pty-router-history-handoff.test.ts": 1329,
+      "src/main/daemon/daemon-pty-router.test.ts": 658,
+      "src/main/daemon/daemon-pty-startup-delivery.test.ts": 2827,
+      "src/main/daemon/daemon-pty-upgrade-adoption.test.ts": 679,
+      "src/main/daemon/daemon-pty-write-settlement-recovery.test.ts": 410,
+      "src/main/daemon/daemon-ready-identity.test.ts": 55,
+      "src/main/daemon/daemon-reattach-checkpoint-isolation.test.ts": 10993,
+      "src/main/daemon/daemon-respawn-throttle.test.ts": 58,
+      "src/main/daemon/daemon-restore-scrollback-depth.test.ts": 3415,
+      "src/main/daemon/daemon-scope-death-watch.test.ts": 70,
+      "src/main/daemon/daemon-self-retirement-respawn.test.ts": 786,
+      "src/main/daemon/daemon-server-async-spawn-cancellation.test.ts": 1078,
+      "src/main/daemon/daemon-server-attach-only.test.ts": 466,
+      "src/main/daemon/daemon-server-attachment-lifecycle.test.ts": 631,
+      "src/main/daemon/daemon-server-error-handling.test.ts": 457,
+      "src/main/daemon/daemon-server-kill-attribution.test.ts": 256,
+      "src/main/daemon/daemon-server.test.ts": 2072,
+      "src/main/daemon/daemon-session-owner-resolution.test.ts": 60,
+      "src/main/daemon/daemon-session-scrollback-window.test.ts": 408,
+      "src/main/daemon/daemon-shared-owner-incarnation-retention.test.ts": 667,
+      "src/main/daemon/daemon-shutdown-final-checkpoint-caller-deadline.test.ts": 2293,
+      "src/main/daemon/daemon-spawner.test.ts": 472,
+      "src/main/daemon/daemon-stream-backpressure-socket.test.ts": 305,
+      "src/main/daemon/daemon-stream-backpressure.test.ts": 42,
+      "src/main/daemon/daemon-stream-data-batcher.test.ts": 196,
+      "src/main/daemon/daemon-stream-data-split.test.ts": 1339,
+      "src/main/daemon/daemon-stream-droppability-lifecycle.test.ts": 485,
+      "src/main/daemon/daemon-stream-droppable-membership.test.ts": 127,
+      "src/main/daemon/daemon-stream-producer-stall-watchdog.test.ts": 74,
+      "src/main/daemon/daemon-tcc-attribution-main-thread.test.ts": 91,
+      "src/main/daemon/daemon-tcc-attribution.test.ts": 75,
+      "src/main/daemon/daemon-transport-attachment-release.test.ts": 791,
+      "src/main/daemon/degraded-daemon-pty-provider.test.ts": 151,
+      "src/main/daemon/hangul-cell-width-agreement.test.ts": 91,
+      "src/main/daemon/headless-emulator-fidelity.fuzz.test.ts": 18873,
+      "src/main/daemon/headless-emulator-restored-osc-links.test.ts": 124,
+      "src/main/daemon/headless-emulator-shrink-snapshot.test.ts": 177,
+      "src/main/daemon/headless-emulator-snapshot-cost.bench.test.ts": 53,
+      "src/main/daemon/headless-emulator-unicode-width.test.ts": 108,
+      "src/main/daemon/headless-emulator-wide-char-repaint.test.ts": 1505,
+      "src/main/daemon/headless-emulator-wide-char-snapshot.test.ts": 265,
+      "src/main/daemon/headless-emulator.test.ts": 232,
+      "src/main/daemon/headless-osc-link-ranges.test.ts": 141,
+      "src/main/daemon/hibernation-cold-restore-repro.test.ts": 202,
+      "src/main/daemon/history-manager-disabled-sessions-leak.test.ts": 150,
+      "src/main/daemon/history-manager.test.ts": 437,
+      "src/main/daemon/history-reader-memory.test.ts": 366,
+      "src/main/daemon/history-reader.test.ts": 306,
+      "src/main/daemon/issue-6814-daemon-failure-classification.test.ts": 6483,
+      "src/main/daemon/macos-login-session-death-watch.test.ts": 93,
+      "src/main/daemon/ndjson.test.ts": 180,
+      "src/main/daemon/node-pty-error-hints.test.ts": 46,
+      "src/main/daemon/node-pty-windows-input-error.win32.test.ts": 37,
+      "src/main/daemon/osc7-file-uri.test.ts": 48,
+      "src/main/daemon/osc7-uri-extraction.test.ts": 34,
+      "src/main/daemon/post-ready-flush-gate.test.ts": 43,
+      "src/main/daemon/process-boundary-ground.test.ts": 256,
+      "src/main/daemon/process-boundary-host-focus.test.ts": 314,
+      "src/main/daemon/pty-session-id.test.ts": 54,
+      "src/main/daemon/pty-subprocess-cwd-cancel-identity.test.ts": 277,
+      "src/main/daemon/pty-subprocess-env-inheritance.test.ts": 312,
+      "src/main/daemon/pty-subprocess-env-retention.test.ts": 248,
+      "src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts": 235,
+      "src/main/daemon/pty-subprocess-foreground-identity.test.ts": 589,
+      "src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts": 336,
+      "src/main/daemon/pty-subprocess-git-credential-guard.test.ts": 249,
+      "src/main/daemon/pty-subprocess-handle-lifecycle.test.ts": 413,
+      "src/main/daemon/pty-subprocess-io-failure-cleanup.test.ts": 10411,
+      "src/main/daemon/pty-subprocess-io-failure-native.test.ts": 2523,
+      "src/main/daemon/pty-subprocess-managed-agent-env.test.ts": 337,
+      "src/main/daemon/pty-subprocess-spawn-file-foreground.test.ts": 440,
+      "src/main/daemon/pty-subprocess-windows-shell-launch.test.ts": 310,
+      "src/main/daemon/pty-subprocess-wsl-launch.test.ts": 370,
+      "src/main/daemon/pty-subprocess.test.ts": 269,
+      "src/main/daemon/pty-subprocess/bun-pty-job-control.integration.test.ts": 27,
+      "src/main/daemon/pty-subprocess/bun-pty-process-flow-control.test.ts": 111,
+      "src/main/daemon/pty-subprocess/bun-pty-process-pause-retry.test.ts": 80,
+      "src/main/daemon/pty-subprocess/bun-pty-process-suspension.test.ts": 118,
+      "src/main/daemon/pty-subprocess/bun-pty-process.integration.test.ts": 49,
+      "src/main/daemon/pty-subprocess/bun-pty-process.test.ts": 352,
+      "src/main/daemon/pty-subprocess/native-pty-spawn-bun.test.ts": 70,
+      "src/main/daemon/pty-subprocess/native-pty-spawn-windows.test.ts": 83,
+      "src/main/daemon/pty-subprocess/spawn-file-foreground-rejected-agents.test.ts": 102,
+      "src/main/daemon/pty-subprocess/spawn-preflight-bun.test.ts": 91,
+      "src/main/daemon/pty-subprocess/windows-bun-pty-gate.integration.test.ts": 80,
+      "src/main/daemon/pty-subprocess/windows-bun-pty-gate.test.ts": 68,
+      "src/main/daemon/pty-subprocess/windows-bun-pty-job.test.ts": 53,
+      "src/main/daemon/pty-subprocess/windows-bun-pty-launch.test.ts": 70,
+      "src/main/daemon/pty-subprocess/windows-bun-pty-native.test.ts": 30,
+      "src/main/daemon/pty-subprocess/windows-bun-pty-spawn-receipt.test.ts": 70,
+      "src/main/daemon/reattach-snapshot.test.ts": 878,
+      "src/main/daemon/repro-12101-mouse-tracking-survives-agent-death.test.ts": 156,
+      "src/main/daemon/repro-7329-remote-snapshot-corruption.test.ts": 122,
+      "src/main/daemon/serialize-addon-edge-cases.test.ts": 71,
+      "src/main/daemon/serialize-grid-transcript-replay.test.ts": 14365,
+      "src/main/daemon/serialize-grid.differential.fuzz.test.ts": 582,
+      "src/main/daemon/session-ingest-throughput.bench.test.ts": 191,
+      "src/main/daemon/session-pending-output.test.ts": 426,
+      "src/main/daemon/session-producer-pause.test.ts": 33,
+      "src/main/daemon/session-shell-recovery.test.ts": 338,
+      "src/main/daemon/session-terminal-control.test.ts": 245,
+      "src/main/daemon/session.test.ts": 626,
+      "src/main/daemon/shell-ready-bash-wrapper.test.ts": 337,
+      "src/main/daemon/slow-daemon-session-verification.test.ts": 14043,
+      "src/main/daemon/startup-device-attributes-responder.test.ts": 38,
+      "src/main/daemon/terminal-attach-cancellation.test.ts": 24,
+      "src/main/daemon/terminal-checkpoint-serializer.test.ts": 127,
+      "src/main/daemon/terminal-checkpoint-writer-bounds.test.ts": 237,
+      "src/main/daemon/terminal-cursor-line-context.test.ts": 124,
+      "src/main/daemon/terminal-descendant-shutdown.test.ts": 97,
+      "src/main/daemon/terminal-history-incremental-restore.test.ts": 505,
+      "src/main/daemon/terminal-history-large-checkpoint-cold-restore.test.ts": 7048,
+      "src/main/daemon/terminal-history-log-encode-allocation.test.ts": 96,
+      "src/main/daemon/terminal-history-log.test.ts": 54,
+      "src/main/daemon/terminal-history-permissions.test.ts": 202,
+      "src/main/daemon/terminal-history-restorable-retention.test.ts": 34,
+      "src/main/daemon/terminal-history-seed-chunks.test.ts": 64,
+      "src/main/daemon/terminal-history-seed-segments.test.ts": 78,
+      "src/main/daemon/terminal-history-seed-transfer-registry.test.ts": 62,
+      "src/main/daemon/terminal-history-session-tombstone-retry.test.ts": 68,
+      "src/main/daemon/terminal-host-agent-session.test.ts": 227,
+      "src/main/daemon/terminal-host-attach-only.test.ts": 297,
+      "src/main/daemon/terminal-host-cheap-tier-ps-scan-volume.test.ts": 196,
+      "src/main/daemon/terminal-host-concurrent-create.test.ts": 240,
+      "src/main/daemon/terminal-host-cwd-readability.test.ts": 261,
+      "src/main/daemon/terminal-host-non-agent-foreground.test.ts": 189,
+      "src/main/daemon/terminal-host-process-inspection-cheap-tier.test.ts": 163,
+      "src/main/daemon/terminal-host-process-inspection.test.ts": 236,
+      "src/main/daemon/terminal-host-pty-owner-backend.test.ts": 324,
+      "src/main/daemon/terminal-host-readiness-reporting.test.ts": 317,
+      "src/main/daemon/terminal-host-session-reaping-leak.test.ts": 460,
+      "src/main/daemon/terminal-host-spawn-input-retention.test.ts": 543,
+      "src/main/daemon/terminal-host-startup.test.ts": 299,
+      "src/main/daemon/terminal-host-teardown-recreate.test.ts": 484,
+      "src/main/daemon/terminal-host-wsl-context.test.ts": 249,
+      "src/main/daemon/terminal-host.test.ts": 691,
+      "src/main/daemon/terminal-mouse-tail-retention.test.ts": 171,
+      "src/main/daemon/terminal-session-teardown.test.ts": 95,
+      "src/main/daemon/terminal-shell-armed-input-mode-recovery.test.ts": 215,
+      "src/main/daemon/terminal-shell-lifecycle-scanner.test.ts": 56,
+      "src/main/daemon/terminal-shell-recovery-barrier.test.ts": 748,
+      "src/main/daemon/terminal-shell-recovery-clean-exit-retirement.test.ts": 61,
+      "src/main/daemon/terminal-snapshot-color-parity.test.ts": 147,
+      "src/main/daemon/terminal-snapshot-osc8-roundtrip.test.ts": 102,
+      "src/main/daemon/terminal-snapshot-serialize-roundtrip.test.ts": 286,
+      "src/main/daemon/windows-conpty-warmup.test.ts": 113,
+      "src/main/daemon/wsl-cold-restore-cwd.test.ts": 54,
+      "src/main/destination-serialized-local-rename.test.ts": 3857,
+      "src/main/devin/hook-config-json.test.ts": 89,
+      "src/main/devin/hook-service.test.ts": 138,
+      "src/main/diagnostics/main-thread-churn-probe.test.ts": 63,
+      "src/main/dock/unread-badge.test.ts": 59,
+      "src/main/droid/hook-service.test.ts": 53,
+      "src/main/durable-file-write-syscall-proof.test.ts": 72,
+      "src/main/durable-file-write.test.ts": 167,
+      "src/main/emulator/android/adb-devices.test.ts": 54,
+      "src/main/emulator/android/android-app-control.test.ts": 53,
+      "src/main/emulator/android/android-capability-operations.test.ts": 82,
+      "src/main/emulator/android/android-device-inventory.test.ts": 48,
+      "src/main/emulator/android/android-input-commands.test.ts": 47,
+      "src/main/emulator/android/android-input-mapping.test.ts": 63,
+      "src/main/emulator/android/android-logcat.test.ts": 35,
+      "src/main/emulator/android/android-permissions.test.ts": 32,
+      "src/main/emulator/android/android-sdk-discovery.test.ts": 58,
+      "src/main/emulator/android/avd-manager.test.ts": 51,
+      "src/main/emulator/android/scrcpy-server-deploy.test.ts": 31,
+      "src/main/emulator/android/scrcpy-stream-session.test.ts": 2989,
+      "src/main/emulator/android/scrcpy-video-frame-parser.test.ts": 238,
+      "src/main/emulator/android/uiautomator-tree.test.ts": 33,
+      "src/main/emulator/backends/android-emulator-backend.test.ts": 176,
+      "src/main/emulator/backends/ios-emulator-backend.test.ts": 162,
+      "src/main/emulator/emulator-availability.test.ts": 52,
+      "src/main/emulator/emulator-bridge.test.ts": 417,
+      "src/main/emulator/emulator-gesture-sender.test.ts": 194,
+      "src/main/emulator/emulator-session-registry.test.ts": 38,
+      "src/main/emulator/emulator-start-lease-registry.test.ts": 116,
+      "src/main/emulator/mjpeg-frame-parser.test.ts": 50,
+      "src/main/emulator/mjpeg-frame-stream.test.ts": 143,
+      "src/main/emulator/scrcpy-video-registry.test.ts": 43,
+      "src/main/emulator/serve-sim-accessibility-tree.test.ts": 134,
+      "src/main/emulator/serve-sim-ax-normalization.test.ts": 50,
+      "src/main/emulator/serve-sim-detached-session.test.ts": 32,
+      "src/main/emulator/serve-sim-execution.test.ts": 100,
+      "src/main/emulator/serve-sim-helper-processes.test.ts": 64,
+      "src/main/emulator/serve-sim-runtime-materializer.test.ts": 98,
+      "src/main/emulator/simctl-simulator-devices.test.ts": 61,
+      "src/main/ephemeral-vm-recipe-runner.test.ts": 516,
+      "src/main/ephemeral-vm-resume-integrity.test.ts": 163,
+      "src/main/ephemeral-vm-runtime-service.test.ts": 944,
+      "src/main/ephemeral-vm-runtime-ssh-cleanup.test.ts": 133,
+      "src/main/external-editor-launch.test.ts": 58,
+      "src/main/fish-history-session.test.ts": 91,
+      "src/main/folder-upgrade-worktree-path.test.ts": 45,
+      "src/main/gemini/hook-service.test.ts": 59,
+      "src/main/ghostty/discovery.test.ts": 79,
+      "src/main/ghostty/index.test.ts": 89,
+      "src/main/ghostty/mapper-extended.test.ts": 56,
+      "src/main/ghostty/mapper.test.ts": 74,
+      "src/main/ghostty/parser.test.ts": 40,
+      "src/main/ghostty/theme-import.test.ts": 100,
+      "src/main/ghostty/theme-resolution.test.ts": 75,
+      "src/main/git-bash.test.ts": 49,
+      "src/main/git/add-sparse-worktree.test.ts": 166,
+      "src/main/git/admission-tier-plumbing.test.ts": 38,
+      "src/main/git/branch-rename.test.ts": 50,
+      "src/main/git/canonical-repo-key.test.ts": 112,
+      "src/main/git/check-ignored-paths.test.ts": 45,
+      "src/main/git/coalesced-probe.test.ts": 54,
+      "src/main/git/command-runner/gh-exec-file-deadline.test.ts": 135,
+      "src/main/git/command-runner/gh-spawn-boundary.test.ts": 802,
+      "src/main/git/command-runner/git-admission-output-parity.test.ts": 246,
+      "src/main/git/command-runner/git-admission-span.test.ts": 324,
+      "src/main/git/command-runner/git-admission-storm-measurement.test.ts": 26034,
+      "src/main/git/command-runner/git-command-timeout-behavior.test.ts": 1860,
+      "src/main/git/command-runner/git-command-timeout.test.ts": 55,
+      "src/main/git/command-runner/git-exec-admission-lifetime.test.ts": 485,
+      "src/main/git/command-runner/git-operation-executor.test.ts": 86,
+      "src/main/git/command-runner/git-spawn-admission-lifetime.test.ts": 108,
+      "src/main/git/command-runner/git-stream-admission-lifetime.test.ts": 224,
+      "src/main/git/command-runner/git-subprocess-admission.test.ts": 364,
+      "src/main/git/command-runner/hosted-cli-deadline-log.test.ts": 103,
+      "src/main/git/command-runner/spawned-command-tree-kill.test.ts": 43,
+      "src/main/git/command-runner/wsl-command-resolution-windows-binary.test.ts": 95,
+      "src/main/git/command-runner/wsl-host-failure.test.ts": 155,
+      "src/main/git/commit-object-ref.test.ts": 46,
+      "src/main/git/commit.test.ts": 129,
+      "src/main/git/exact-ref-probe.test.ts": 45,
+      "src/main/git/fetch-error-classification.test.ts": 43,
+      "src/main/git/fork-remote-refspec.test.ts": 50,
+      "src/main/git/fork-remote-stale-branch-refspec.test.ts": 54,
+      "src/main/git/gh-rate-limit-breaker.test.ts": 80,
+      "src/main/git/git-capability-state.test.ts": 51,
+      "src/main/git/git-status-read-lease-owner.test.ts": 33,
+      "src/main/git/git-upstream-status-read-owner.test.ts": 40,
+      "src/main/git/git-username.test.ts": 173,
+      "src/main/git/hosted-remote-url.test.ts": 44,
+      "src/main/git/huge-folder-ignore.test.ts": 59,
+      "src/main/git/local-repo-ref-maintenance.test.ts": 298,
+      "src/main/git/pack-refs-lock-ownership.test.ts": 80,
+      "src/main/git/porcelain-v1-records.test.ts": 197,
+      "src/main/git/remote-name-listing.test.ts": 59,
+      "src/main/git/remote-ref-probe-cache.test.ts": 46,
+      "src/main/git/remote-url-probe.test.ts": 73,
+      "src/main/git/remote.test.ts": 564,
+      "src/main/git/remove-worktree-branch-cleanup.test.ts": 163,
+      "src/main/git/remove-worktree-clean-preflight.test.ts": 125,
+      "src/main/git/remove-worktree.test.ts": 159,
+      "src/main/git/repo-branch-conflict-batched-probe.test.ts": 73,
+      "src/main/git/repo-branch-conflict-real-git.test.ts": 351,
+      "src/main/git/repo-branch-conflict.test.ts": 214,
+      "src/main/git/repo-clone-path.test.ts": 50,
+      "src/main/git/repo-default-base-timeout.test.ts": 66,
+      "src/main/git/repo-default-remote.test.ts": 73,
+      "src/main/git/repo-detection.test.ts": 697,
+      "src/main/git/repo-ref-maintenance-real-git.test.ts": 1124,
+      "src/main/git/repo-remote-drift-real.test.ts": 320,
+      "src/main/git/repo-remote-drift.test.ts": 190,
+      "src/main/git/repo-search-ref-compat.test.ts": 93,
+      "src/main/git/repo-username.test.ts": 190,
+      "src/main/git/repo.test.ts": 2242,
+      "src/main/git/runner-command-exec.test.ts": 708,
+      "src/main/git/runner-gh-account-binding.test.ts": 199,
+      "src/main/git/runner-gh-host-args.test.ts": 184,
+      "src/main/git/runner-gh-rate-limit-breaker.test.ts": 204,
+      "src/main/git/runner-windows-host-environment.test.ts": 285,
+      "src/main/git/runner-wsl-direct-read.test.ts": 1893,
+      "src/main/git/runner-wsl-gh-fallback.test.ts": 924,
+      "src/main/git/runner-wsl-linked-gitdir-timeout.test.ts": 175,
+      "src/main/git/runner-wsl-linked-gitdir-windows.test.ts": 292,
+      "src/main/git/runner-wsl-login-shell-capture.test.ts": 125,
+      "src/main/git/runner-wsl-read-routing.test.ts": 169,
+      "src/main/git/runner.test.ts": 120,
+      "src/main/git/settled-diff-cache-bounds.test.ts": 66,
+      "src/main/git/source-control/bulk-pathspec-command-line-budget.test.ts": 218,
+      "src/main/git/source-control/resolve-git-dir.test.ts": 42,
+      "src/main/git/source-control/wsl-tracked-pathspec-banner.test.ts": 171,
+      "src/main/git/status-branch-compare-real-ref.test.ts": 229,
+      "src/main/git/status-branch-compare.test.ts": 157,
+      "src/main/git/status-branch-line-total-exec-contract.test.ts": 1673,
+      "src/main/git/status-branch-line-total-real-git.test.ts": 1107,
+      "src/main/git/status-branch-line-total-relay-parity.test.ts": 590,
+      "src/main/git/status-conflict-operations.test.ts": 216,
+      "src/main/git/status-conflict-overlap.bench.test.ts": 272,
+      "src/main/git/status-cquoted-paths.test.ts": 237,
+      "src/main/git/status-diff-settled-cache.test.ts": 426,
+      "src/main/git/status-diff.test.ts": 235,
+      "src/main/git/status-discard-and-bulk-staging.test.ts": 300,
+      "src/main/git/status-discard-symlink.test.ts": 661,
+      "src/main/git/status-line-stats-host-paths.test.ts": 78,
+      "src/main/git/status-pathspec-literals.test.ts": 464,
+      "src/main/git/status-porcelain-parser.test.ts": 47,
+      "src/main/git/status-read-coalescing.test.ts": 223,
+      "src/main/git/status-shared-symlinks.test.ts": 803,
+      "src/main/git/status-submodule-path-cache.test.ts": 895,
+      "src/main/git/status-submodule.test.ts": 231,
+      "src/main/git/status-symlink-probe-budget.test.ts": 145,
+      "src/main/git/status-upstream-negative-cache.test.ts": 1303,
+      "src/main/git/status-upstream-probe-churn.test.ts": 169,
+      "src/main/git/status-upstream-ref.test.ts": 42,
+      "src/main/git/status-wsl-pathspecs.test.ts": 132,
+      "src/main/git/status.test.ts": 212,
+      "src/main/git/upstream-deferred-fork-remote-real.test.ts": 217,
+      "src/main/git/upstream.test.ts": 388,
+      "src/main/git/worktree-add-creation-config.test.ts": 237,
+      "src/main/git/worktree-add-local-base-refresh.test.ts": 281,
+      "src/main/git/worktree-add-local-base-suggestion.test.ts": 178,
+      "src/main/git/worktree-add-timeout-override.test.ts": 199,
+      "src/main/git/worktree-base-divergence-real-git.test.ts": 1614,
+      "src/main/git/worktree-base-divergence.test.ts": 93,
+      "src/main/git/worktree-base-ref-probe.test.ts": 38,
+      "src/main/git/worktree-common-dir-comparison.test.ts": 177,
+      "src/main/git/worktree-configured-paths-concurrency.test.ts": 86,
+      "src/main/git/worktree-create-admission-tier.test.ts": 245,
+      "src/main/git/worktree-create-git-executor-real-git.test.ts": 356,
+      "src/main/git/worktree-create-preparation-real-git.test.ts": 1406,
+      "src/main/git/worktree-create-preparation-real-wsl.test.ts": 271,
+      "src/main/git/worktree-created-description-real-git.test.ts": 1340,
+      "src/main/git/worktree-created-disk-witness.test.ts": 149,
+      "src/main/git/worktree-deferred-removal-real-git.test.ts": 587,
+      "src/main/git/worktree-diff-stamp-guest-gitdir.test.ts": 40,
+      "src/main/git/worktree-diff-stamp-host-paths.test.ts": 55,
+      "src/main/git/worktree-git-capabilities.test.ts": 248,
+      "src/main/git/worktree-graph-listing.test.ts": 205,
+      "src/main/git/worktree-include-file.test.ts": 104,
+      "src/main/git/worktree-list-paths.test.ts": 571,
+      "src/main/git/worktree-list-porcelain.test.ts": 163,
+      "src/main/git/worktree-listing-created-sparse-distro.test.ts": 291,
+      "src/main/git/worktree-listing-sparse-distro.test.ts": 188,
+      "src/main/git/worktree-move.test.ts": 195,
+      "src/main/git/worktree-mutation-route-invalidation.test.ts": 145,
+      "src/main/git/worktree-porcelain-parsing.test.ts": 210,
+      "src/main/git/worktree-posix-path-case-sensitivity.test.ts": 134,
+      "src/main/git/worktree-preparation-base-oid.test.ts": 99,
+      "src/main/git/worktree-preparation-cancel-latency.bench.test.ts": 248,
+      "src/main/git/worktree-removal-large-tree.bench.test.ts": 291,
+      "src/main/git/worktree-remove-branch-deletion.test.ts": 194,
+      "src/main/git/worktree-scan-cache-annotation-reuse.test.ts": 241,
+      "src/main/git/worktree-scan-cache-sharing.test.ts": 284,
+      "src/main/git/worktree-separate-git-dir.test.ts": 614,
+      "src/main/git/worktree-shared-directories.test.ts": 1301,
+      "src/main/git/worktree-sparse-checkout-cache.test.ts": 234,
+      "src/main/git/worktree-sparse-checkout.test.ts": 675,
+      "src/main/git/worktree-sparse-state-host-paths.test.ts": 252,
+      "src/main/git/worktree-symlink-detection.test.ts": 55,
+      "src/main/git/wsl-direct-git-read-commands.test.ts": 54,
+      "src/main/git/wsl-linked-worktree-git-route-invalidation.test.ts": 81,
+      "src/main/git/wsl-linked-worktree-git-routing.test.ts": 105,
+      "src/main/git/wsl-process-group-termination.test.ts": 44,
+      "src/main/gitea/client-scan-invalidation.test.ts": 181,
+      "src/main/gitea/client.test.ts": 192,
+      "src/main/gitea/pull-request-creation.test.ts": 228,
+      "src/main/gitea/pull-request-mappers.test.ts": 56,
+      "src/main/gitea/repository-ref.test.ts": 71,
+      "src/main/github/auth-diagnose.test.ts": 51,
+      "src/main/github/client-create-pr.test.ts": 356,
+      "src/main/github/client-file-viewed.test.ts": 430,
+      "src/main/github/client-issue-origin-preference.test.ts": 247,
+      "src/main/github/client-issue-source.test.ts": 1603,
+      "src/main/github/client-merge-queue-auto-merge.test.ts": 342,
+      "src/main/github/client-merged-pr-visibility.test.ts": 343,
+      "src/main/github/client-pr-branch-discovery.test.ts": 352,
+      "src/main/github/client-pr-check-details.test.ts": 228,
+      "src/main/github/client-pr-checks.test.ts": 383,
+      "src/main/github/client-pr-comment-reactions.test.ts": 281,
+      "src/main/github/client-pr-conflict-summary.test.ts": 374,
+      "src/main/github/client-pr-fallback-number.test.ts": 347,
+      "src/main/github/client-pr-linked-lookup.test.ts": 310,
+      "src/main/github/client-pr-local-runtime.test.ts": 291,
+      "src/main/github/client-pr-push-target.test.ts": 222,
+      "src/main/github/client-pr-state.test.ts": 355,
+      "src/main/github/client-rate-limit-block.test.ts": 298,
+      "src/main/github/client-ssh-provider-execution-boundary.test.ts": 341,
+      "src/main/github/client-stack-merge-guard.test.ts": 422,
+      "src/main/github/client-starred.test.ts": 335,
+      "src/main/github/client-tracked-upstream-fork-owner.test.ts": 366,
+      "src/main/github/client-tracked-upstream-snapshot.test.ts": 618,
+      "src/main/github/client-work-item-check-summary.test.ts": 193,
+      "src/main/github/client-work-items-query-paging.test.ts": 354,
+      "src/main/github/client-work-items.test.ts": 235,
+      "src/main/github/comment-reactions.test.ts": 28,
+      "src/main/github/conflict-summary.test.ts": 50,
+      "src/main/github/default-branch-stale-pr.test.ts": 295,
+      "src/main/github/gh-account-token.test.ts": 66,
+      "src/main/github/gh-capability-state.test.ts": 37,
+      "src/main/github/gh-utils-concurrency.test.ts": 95,
+      "src/main/github/gh-utils.test.ts": 172,
+      "src/main/github/github-api-repository-validation.test.ts": 33,
+      "src/main/github/github-api-repository.test.ts": 276,
+      "src/main/github/github-enterprise-repository.test.ts": 144,
+      "src/main/github/github-pr-stack.test.ts": 79,
+      "src/main/github/github-remote-identity-parsing.test.ts": 40,
+      "src/main/github/github-repository-identity.fork-owner-repo.test.ts": 404,
+      "src/main/github/github-repository-identity.gh-account.test.ts": 164,
+      "src/main/github/github-repository-identity.signed-cache.test.ts": 171,
+      "src/main/github/github-repository-identity.ssh-host-alias.test.ts": 171,
+      "src/main/github/issues.test.ts": 109,
+      "src/main/github/pr-head-tracking-ref.test.ts": 74,
+      "src/main/github/pr-refresh-coordinator-active-burst-pacing.test.ts": 202,
+      "src/main/github/pr-refresh-coordinator-active-visible-priority.test.ts": 297,
+      "src/main/github/pr-refresh-coordinator-alias-coalescing.test.ts": 329,
+      "src/main/github/pr-refresh-coordinator-rate-limit-budget.test.ts": 302,
+      "src/main/github/pr-refresh-coordinator-refresh-events.test.ts": 331,
+      "src/main/github/pr-refresh-coordinator-visible-follow-up.test.ts": 280,
+      "src/main/github/pr-refresh-error-classification.test.ts": 45,
+      "src/main/github/pr-refresh-queue-growth-bound.test.ts": 623,
+      "src/main/github/pr-refresh-validation-backoff.test.ts": 58,
+      "src/main/github/pr-review-comment-lines.test.ts": 36,
+      "src/main/github/pr-start-point-compare-base.test.ts": 76,
+      "src/main/github/pr-start-point.test.ts": 95,
+      "src/main/github/project-view-host-auth.test.ts": 116,
+      "src/main/github/project-view.test.ts": 113,
+      "src/main/github/project-view/mutations.test.ts": 57,
+      "src/main/github/project-view/project-field-mutations.test.ts": 58,
+      "src/main/github/project-view/project-view-table.test.ts": 175,
+      "src/main/github/project-view/repository-field-options.test.ts": 44,
+      "src/main/github/rate-limit.test.ts": 68,
+      "src/main/github/review-head-remote.test.ts": 54,
+      "src/main/github/stacked-pr-creation.test.ts": 62,
+      "src/main/github/work-item-details-api-parity.test.ts": 295,
+      "src/main/github/work-item-details-concurrency.test.ts": 50,
+      "src/main/github/work-item-details-enterprise-host.test.ts": 203,
+      "src/main/github/work-item-details-file-viewed.test.ts": 236,
+      "src/main/github/work-item-details-pr-files.test.ts": 225,
+      "src/main/github/work-item-details.test.ts": 249,
+      "src/main/github/work-item-search-fallback-environment.test.ts": 208,
+      "src/main/github/work-item-search-freshness.test.ts": 1026,
+      "src/main/github/work-item-search-isolation.test.ts": 434,
+      "src/main/github/work-item-search-pagination.test.ts": 284,
+      "src/main/github/work-item-search-semantics.test.ts": 372,
+      "src/main/gitlab/client-mr-auth-rate-limit.test.ts": 142,
+      "src/main/gitlab/client-mr-branch-lookup.test.ts": 184,
+      "src/main/gitlab/client-mr-job-ci.test.ts": 83,
+      "src/main/gitlab/client-mr-listing.test.ts": 138,
+      "src/main/gitlab/client-mr-review-actions.test.ts": 154,
+      "src/main/gitlab/client-work-items.test.ts": 230,
+      "src/main/gitlab/client.test.ts": 260,
+      "src/main/gitlab/gitlab-known-host-probe-wsl-fallback.test.ts": 180,
+      "src/main/gitlab/gitlab-known-host-probe.test.ts": 71,
+      "src/main/gitlab/gitlab-known-host-retirement.test.ts": 235,
+      "src/main/gitlab/gl-utils.test.ts": 120,
+      "src/main/gitlab/issues.test.ts": 257,
+      "src/main/gitlab/mappers-workitem.test.ts": 62,
+      "src/main/gitlab/mappers.test.ts": 68,
+      "src/main/gitlab/merge-request-creation.test.ts": 70,
+      "src/main/gitlab/mr-head-tracking-ref.test.ts": 75,
+      "src/main/gitlab/project-ref-parser.test.ts": 58,
+      "src/main/gitlab/work-item-details.test.ts": 114,
+      "src/main/global-fetch-call-site-audit.test.ts": 314,
+      "src/main/grok-accounts/status.test.ts": 56,
+      "src/main/grok/grok-hook-config-file.test.ts": 123,
+      "src/main/grok/grok-hook-owners.test.ts": 97,
+      "src/main/grok/grok-hook-remnant-removal.test.ts": 116,
+      "src/main/grok/grok-hook-stdin-no-eof.test.ts": 472,
+      "src/main/grok/hook-service.test.ts": 174,
+      "src/main/grok/windows-grok-hook-script.test.ts": 133,
+      "src/main/grok/windows-hook-launcher-chain.test.ts": 97,
+      "src/main/hang-watchdog/hang-detection-marker.test.ts": 43,
+      "src/main/hang-watchdog/hang-watchdog-detection-loop.test.ts": 61,
+      "src/main/hang-watchdog/hang-watchdog-worker-path.test.ts": 59,
+      "src/main/hang-watchdog/main-thread-hang-telemetry.test.ts": 175,
+      "src/main/hang-watchdog/main-thread-hang-watchdog-entry.test.ts": 58,
+      "src/main/hang-watchdog/main-thread-hang-watchdog.test.ts": 78,
+      "src/main/headless-automation-dispatcher-source-boundary.test.ts": 39,
+      "src/main/hermes/hook-service.test.ts": 434,
+      "src/main/hook-archive-timeout-observation.test.ts": 1092,
+      "src/main/hook-termination-real-process.test.ts": 8201,
+      "src/main/hooks-archive-exit-observation.test.ts": 187,
+      "src/main/hooks-effective-hook-resolution.test.ts": 209,
+      "src/main/hooks-issue-command.test.ts": 340,
+      "src/main/hooks-orca-yaml-parsing.test.ts": 201,
+      "src/main/hooks-runner.test.ts": 197,
+      "src/main/hooks-setup-runner-script.test.ts": 219,
+      "src/main/hooks.test.ts": 344,
+      "src/main/host-tree-removal-asar.electron.test.ts": 359,
+      "src/main/host/deferred-secret-protection-report.test.ts": 51,
+      "src/main/host/electron-secret-store.test.ts": 66,
+      "src/main/host/secret-protection-report.test.ts": 74,
+      "src/main/i18n/main-i18n-lazy-locale.test.ts": 323,
+      "src/main/ipc/agent-hooks.test.ts": 661,
+      "src/main/ipc/agent-pane-authority-ownership.test.ts": 31,
+      "src/main/ipc/agent-pane-retirement-ipc.test.ts": 74,
+      "src/main/ipc/ai-vault-scan-coalescing.test.ts": 824,
+      "src/main/ipc/ai-vault-search-all-hosts-real-index.test.ts": 1337,
+      "src/main/ipc/ai-vault-search-all-hosts.test.ts": 194,
+      "src/main/ipc/ai-vault-search-merged-cursor.test.ts": 135,
+      "src/main/ipc/ai-vault-search.test.ts": 517,
+      "src/main/ipc/ai-vault.test.ts": 1998,
+      "src/main/ipc/app.test.ts": 458,
+      "src/main/ipc/automations-external-scope.test.ts": 184,
+      "src/main/ipc/bounded-warning-dedupe.test.ts": 35,
+      "src/main/ipc/browser-client-page-metadata-ipc.test.ts": 144,
+      "src/main/ipc/browser-preview-tool-authorization.test.ts": 582,
+      "src/main/ipc/browser-session-profile-ipc.test.ts": 227,
+      "src/main/ipc/browser-tab-registration-wait.test.ts": 133,
+      "src/main/ipc/browser.test.ts": 824,
+      "src/main/ipc/cli-appimage-stale-registration.test.ts": 285,
+      "src/main/ipc/cli.test.ts": 162,
+      "src/main/ipc/codex-config-sync.test.ts": 46,
+      "src/main/ipc/command-path-resolver.test.ts": 39,
+      "src/main/ipc/computer-use-permissions.test.ts": 73,
+      "src/main/ipc/crash-reporting-renderer-breadcrumbs.test.ts": 100,
+      "src/main/ipc/crash-reporting-renderer-error-report-attribution.test.ts": 67,
+      "src/main/ipc/crash-reporting-replay-guard-wedge-burst.test.ts": 56,
+      "src/main/ipc/crash-reporting.test.ts": 155,
+      "src/main/ipc/created-worktree-reconciliation.test.ts": 118,
+      "src/main/ipc/created-worktree-root-prune.test.ts": 307,
+      "src/main/ipc/dashboard-payload-validation.test.ts": 241,
+      "src/main/ipc/dashboard-popout.test.ts": 97,
+      "src/main/ipc/deferred-emoji-shortcode-dataset.test.ts": 94,
+      "src/main/ipc/desktop-renderer-runtime-capabilities.test.ts": 597,
+      "src/main/ipc/developer-permissions.test.ts": 132,
+      "src/main/ipc/diagnostics.test.ts": 78,
+      "src/main/ipc/doc-preview-grant-ipc.test.ts": 92,
+      "src/main/ipc/dropped-path-resolution.test.ts": 81,
+      "src/main/ipc/emulator-frame-stream-socket-lifetime.test.ts": 139,
+      "src/main/ipc/emulator-renderer-lifetime.test.ts": 113,
+      "src/main/ipc/emulator-stream-listener-cleanup.test.ts": 52,
+      "src/main/ipc/ephemeral-vm-provision-cancel.test.ts": 2605,
+      "src/main/ipc/ephemeral-vm-provisioned-root-ref.test.ts": 1162,
+      "src/main/ipc/ephemeral-vm-runtime-handler-cleanup.test.ts": 816,
+      "src/main/ipc/ephemeral-vm.test.ts": 1095,
+      "src/main/ipc/feedback-image-attachments.test.ts": 78,
+      "src/main/ipc/feedback.test.ts": 175,
+      "src/main/ipc/filesystem-allowed-roots.test.ts": 437,
+      "src/main/ipc/filesystem-auth.test.ts": 1145,
+      "src/main/ipc/filesystem-branch-compare-diff.test.ts": 2519,
+      "src/main/ipc/filesystem-commit-message-generation.test.ts": 3728,
+      "src/main/ipc/filesystem-commit-message-model-discovery.test.ts": 4612,
+      "src/main/ipc/filesystem-conflict-operation-routing.test.ts": 3748,
+      "src/main/ipc/filesystem-download-lifetime.test.ts": 673,
+      "src/main/ipc/filesystem-download-transfers.test.ts": 4793,
+      "src/main/ipc/filesystem-git-commit-dispatch.test.ts": 2595,
+      "src/main/ipc/filesystem-git-status-staging.test.ts": 3013,
+      "src/main/ipc/filesystem-import-local-rollback.test.ts": 86,
+      "src/main/ipc/filesystem-import-ssh-ops.test.ts": 545,
+      "src/main/ipc/filesystem-import-ssh-path-safety.test.ts": 94,
+      "src/main/ipc/filesystem-import-ssh.test.ts": 490,
+      "src/main/ipc/filesystem-import.test.ts": 6057,
+      "src/main/ipc/filesystem-list-files-handler-name-filter.test.ts": 3031,
+      "src/main/ipc/filesystem-list-files-name-filter.test.ts": 314,
+      "src/main/ipc/filesystem-list-files.test.ts": 320,
+      "src/main/ipc/filesystem-markdown-document-listing.test.ts": 3120,
+      "src/main/ipc/filesystem-mutations-runtime-upload.test.ts": 2064,
+      "src/main/ipc/filesystem-mutations.test.ts": 3581,
+      "src/main/ipc/filesystem-path-containment-remote-enoent.test.ts": 32,
+      "src/main/ipc/filesystem-path-containment-unicode-normalization.test.ts": 218,
+      "src/main/ipc/filesystem-pull-request-field-generation.test.ts": 3228,
+      "src/main/ipc/filesystem-pull-request-linked-issue-lifetime.test.ts": 2896,
+      "src/main/ipc/filesystem-runtime-upload-staging.test.ts": 140,
+      "src/main/ipc/filesystem-search-file-paths.test.ts": 426,
+      "src/main/ipc/filesystem-search-rg-timeout.test.ts": 1022,
+      "src/main/ipc/filesystem-watcher-canonical-root-paths.test.ts": 435,
+      "src/main/ipc/filesystem-watcher-document-lifetime.test.ts": 309,
+      "src/main/ipc/filesystem-watcher-dormant-rearm.test.ts": 188,
+      "src/main/ipc/filesystem-watcher-event-batch.test.ts": 38,
+      "src/main/ipc/filesystem-watcher-ignore.test.ts": 53,
+      "src/main/ipc/filesystem-watcher-large-batch.test.ts": 423,
+      "src/main/ipc/filesystem-watcher-local-events.test.ts": 482,
+      "src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts": 1128,
+      "src/main/ipc/filesystem-watcher-native-capacity.test.ts": 198,
+      "src/main/ipc/filesystem-watcher-real.test.ts": 699,
+      "src/main/ipc/filesystem-watcher-remote-batch.test.ts": 127,
+      "src/main/ipc/filesystem-watcher-remote-cancellation.test.ts": 457,
+      "src/main/ipc/filesystem-watcher-remote-capacity.test.ts": 188,
+      "src/main/ipc/filesystem-watcher-remote-rearm.test.ts": 133,
+      "src/main/ipc/filesystem-watcher-removal-deadline.test.ts": 397,
+      "src/main/ipc/filesystem-watcher-terminal-resync.test.ts": 353,
+      "src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts": 125,
+      "src/main/ipc/filesystem-watcher-wsl.test.ts": 90,
+      "src/main/ipc/filesystem-watcher.test.ts": 2230,
+      "src/main/ipc/filesystem.test.ts": 2871,
+      "src/main/ipc/floating-workspace-directory.test.ts": 82,
+      "src/main/ipc/folder-repo-git-upgrade-lifetime.test.ts": 103,
+      "src/main/ipc/folder-repo-git-upgrade.test.ts": 2578,
+      "src/main/ipc/git-status-upstream-ref-watch-request.test.ts": 58,
+      "src/main/ipc/github-ipc-channel-parity.test.ts": 396,
+      "src/main/ipc/github-issue-source-preference.test.ts": 273,
+      "src/main/ipc/github-pr-refresh-routing.test.ts": 206,
+      "src/main/ipc/github-repo-access-guards.test.ts": 398,
+      "src/main/ipc/github-ssh-connection-routing.test.ts": 340,
+      "src/main/ipc/github-star-telemetry.test.ts": 319,
+      "src/main/ipc/github-work-item-args.test.ts": 36,
+      "src/main/ipc/github-wsl-runtime-routing.test.ts": 360,
+      "src/main/ipc/gitlab-repo-access.test.ts": 84,
+      "src/main/ipc/gitlab.test.ts": 122,
+      "src/main/ipc/hooks/worktree-hook-execution-host.test.ts": 516,
+      "src/main/ipc/hosted-review.test.ts": 419,
+      "src/main/ipc/jira-cancellable-requests.test.ts": 55,
+      "src/main/ipc/keybindings.test.ts": 46,
+      "src/main/ipc/linear.test.ts": 72,
+      "src/main/ipc/local-log-tail-lifetime.test.ts": 78,
+      "src/main/ipc/local-log-tail.test.ts": 63,
+      "src/main/ipc/local-network-connection-test.test.ts": 221,
+      "src/main/ipc/local-worktree-runtime-options.test.ts": 46,
+      "src/main/ipc/macos-keyboard-layout-change-notifications.test.ts": 46,
+      "src/main/ipc/macos-keyboard-layout-snapshot.test.ts": 50,
+      "src/main/ipc/markdown-documents.test.ts": 34,
+      "src/main/ipc/minimax-credentials.test.ts": 94,
+      "src/main/ipc/mobile.test.ts": 15914,
+      "src/main/ipc/native-chat-renderer-lifetime.test.ts": 57,
+      "src/main/ipc/native-chat-renderer-watcher-cleanup.test.ts": 327,
+      "src/main/ipc/native-chat-subscribe-lifecycle.test.ts": 209,
+      "src/main/ipc/native-chat.test.ts": 1810,
+      "src/main/ipc/notebook.test.ts": 102,
+      "src/main/ipc/notifications-custom-sound.test.ts": 167,
+      "src/main/ipc/notifications-delivery-gating.test.ts": 226,
+      "src/main/ipc/notifications-message-formatting.test.ts": 81,
+      "src/main/ipc/notifications-mobile-fanout.test.ts": 141,
+      "src/main/ipc/notifications-permission-onboarding.test.ts": 216,
+      "src/main/ipc/notifications-retention-lifecycle.test.ts": 378,
+      "src/main/ipc/notifications-subject-retirement.test.ts": 56,
+      "src/main/ipc/orca-profile-auth-handlers.test.ts": 461,
+      "src/main/ipc/orca-profile-org-members-handlers.test.ts": 57,
+      "src/main/ipc/orca-profiles-switch-persistence.test.ts": 1121,
+      "src/main/ipc/orca-profiles.test.ts": 419,
+      "src/main/ipc/parcel-watcher-child-launch.test.ts": 73,
+      "src/main/ipc/parcel-watcher-child-registry.test.ts": 91,
+      "src/main/ipc/parcel-watcher-crash-fuse.test.ts": 42,
+      "src/main/ipc/parcel-watcher-disconnect-termination.test.ts": 97,
+      "src/main/ipc/parcel-watcher-entry-path.test.ts": 36,
+      "src/main/ipc/parcel-watcher-event-cancellation.test.ts": 61,
+      "src/main/ipc/parcel-watcher-event-delivery.test.ts": 37,
+      "src/main/ipc/parcel-watcher-module-loader.test.ts": 39,
+      "src/main/ipc/parcel-watcher-process-entry.test.ts": 234,
+      "src/main/ipc/parcel-watcher-process.test.ts": 678,
+      "src/main/ipc/parcel-watcher-root-path-rewrite.test.ts": 88,
+      "src/main/ipc/parcel-watcher-shallow-subscription.test.ts": 54,
+      "src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts": 254,
+      "src/main/ipc/parcel-watcher-supervisor-capacity.test.ts": 244,
+      "src/main/ipc/parcel-watcher-unsubscribe-timeout.test.ts": 113,
+      "src/main/ipc/pet-bundle.test.ts": 60,
+      "src/main/ipc/pet.test.ts": 252,
+      "src/main/ipc/plugin-marketplaces.test.ts": 227,
+      "src/main/ipc/plugins.test.ts": 258,
+      "src/main/ipc/preflight-agent-detection-no-subprocess.test.ts": 249,
+      "src/main/ipc/preflight-agent-detection.test.ts": 212,
+      "src/main/ipc/preflight-agent-refresh.test.ts": 190,
+      "src/main/ipc/preflight-command-exec.test.ts": 59,
+      "src/main/ipc/preflight-host-cli-status.test.ts": 311,
+      "src/main/ipc/preflight-remote-ssh.test.ts": 137,
+      "src/main/ipc/preflight-windows-path-refresh.repro.test.ts": 69,
+      "src/main/ipc/preflight-wsl-agent-detection.test.ts": 151,
+      "src/main/ipc/preflight-wsl-command.test.ts": 43,
+      "src/main/ipc/pty-activation-inventory-scope.test.ts": 1650,
+      "src/main/ipc/pty-applied-size-reporting.test.ts": 1519,
+      "src/main/ipc/pty-buffer-snapshot-dispatch.test.ts": 1738,
+      "src/main/ipc/pty-codex-account-attribution.test.ts": 1477,
+      "src/main/ipc/pty-controller-owner-recovery.test.ts": 1749,
+      "src/main/ipc/pty-controller-ownership-routing.test.ts": 1531,
+      "src/main/ipc/pty-controller-process-inventory.test.ts": 1860,
+      "src/main/ipc/pty-controller-spawn-admission.test.ts": 3580,
+      "src/main/ipc/pty-cumulative-ack-accounting.test.ts": 1219,
+      "src/main/ipc/pty-daemon-controller-teardown.test.ts": 2798,
+      "src/main/ipc/pty-daemon-spawn-agent-home-env.test.ts": 2463,
+      "src/main/ipc/pty-daemon-spawn-codex-auth.test.ts": 1802,
+      "src/main/ipc/pty-daemon-spawn-session-identity.test.ts": 2434,
+      "src/main/ipc/pty-daemon-spawn-wsl-runtime.test.ts": 2656,
+      "src/main/ipc/pty-daemon-ssh-lease-lifecycle.test.ts": 2110,
+      "src/main/ipc/pty-dead-owner-respawn.test.ts": 1289,
+      "src/main/ipc/pty-delivery-health-heal.test.ts": 1942,
+      "src/main/ipc/pty-dispatcher-handshake-osc-answers.test.ts": 1892,
+      "src/main/ipc/pty-encoding.test.ts": 26,
+      "src/main/ipc/pty-global-renderer-credit.test.ts": 1376,
+      "src/main/ipc/pty-hidden-at-spawn-mark.test.ts": 3652,
+      "src/main/ipc/pty-hidden-delivery-gate.test.ts": 57,
+      "src/main/ipc/pty-ipc-hidden-delivery-gate.test.ts": 3043,
+      "src/main/ipc/pty-ipc-producer-flow-control.test.ts": 1520,
+      "src/main/ipc/pty-listener-teardown-and-orphans.test.ts": 3968,
+      "src/main/ipc/pty-login-shell-startup-commands.test.ts": 1723,
+      "src/main/ipc/pty-management.test.ts": 102,
+      "src/main/ipc/pty-output-batching-drain.test.ts": 1696,
+      "src/main/ipc/pty-output-drain-rounds.test.ts": 1804,
+      "src/main/ipc/pty-pane-claim-arbitration.test.ts": 4553,
+      "src/main/ipc/pty-pane-materialization-race.test.ts": 2447,
+      "src/main/ipc/pty-pane-reservation-settlement.test.ts": 1450,
+      "src/main/ipc/pty-pane-restart-replace.test.ts": 1575,
+      "src/main/ipc/pty-pending-data-drain-queue-differential.test.ts": 2040,
+      "src/main/ipc/pty-pending-data-drain-queue.test.ts": 59,
+      "src/main/ipc/pty-pending-data-drain-scheduler-differential.test.ts": 99,
+      "src/main/ipc/pty-pending-output-cap.test.ts": 1823,
+      "src/main/ipc/pty-pending-projection-admissions.test.ts": 95,
+      "src/main/ipc/pty-persisted-incarnation-repair.test.ts": 940,
+      "src/main/ipc/pty-producer-flow-control.test.ts": 44,
+      "src/main/ipc/pty-renderer-inflight-credit.test.ts": 1965,
+      "src/main/ipc/pty-renderer-lifecycle-delivery-reset.test.ts": 1732,
+      "src/main/ipc/pty-renderer-liveness-guard.test.ts": 1889,
+      "src/main/ipc/pty-renderer-send-failure-recovery.test.ts": 1697,
+      "src/main/ipc/pty-restore-record-seeding.test.ts": 4503,
+      "src/main/ipc/pty-restored-appimage-cli-shim-refresh.test.ts": 1001,
+      "src/main/ipc/pty-runtime-hidden-at-spawn-mark.test.ts": 2902,
+      "src/main/ipc/pty-runtime-kill-and-exit.test.ts": 1637,
+      "src/main/ipc/pty-runtime-ssh-binding-persistence.test.ts": 1369,
+      "src/main/ipc/pty-serializer-settlement-mapping.test.ts": 4239,
+      "src/main/ipc/pty-session-liveness-and-ownership.test.ts": 1832,
+      "src/main/ipc/pty-spawn-codex-home-unavailable.test.ts": 880,
+      "src/main/ipc/pty-spawn-cwd-fallback.test.ts": 2294,
+      "src/main/ipc/pty-spawn-env-agent-overlays.test.ts": 1925,
+      "src/main/ipc/pty-spawn-env-codex-home-routing.test.ts": 1578,
+      "src/main/ipc/pty-spawn-env-codex-resume-provenance.test.ts": 1188,
+      "src/main/ipc/pty-spawn-env-terminal-basics.test.ts": 2674,
+      "src/main/ipc/pty-spawn-pi-owner-env.test.ts": 2317,
+      "src/main/ipc/pty-spawn-runtime-handle-binding.test.ts": 2425,
+      "src/main/ipc/pty-spawn-timing.test.ts": 74,
+      "src/main/ipc/pty-ssh-stop-verdict.test.ts": 1688,
+      "src/main/ipc/pty-ssh-undelivered-kill.test.ts": 1930,
+      "src/main/ipc/pty-startup-barrier-and-listing.test.ts": 1269,
+      "src/main/ipc/pty-startup-barrier-ordering.test.ts": 32,
+      "src/main/ipc/pty-startup-swap-window-presence.test.ts": 1724,
+      "src/main/ipc/pty-windows-shell-selection.test.ts": 1559,
+      "src/main/ipc/pty-write-ipc-validation.test.ts": 1475,
+      "src/main/ipc/pty-wsl-cwd-validation.test.ts": 1804,
+      "src/main/ipc/pty/configured-terminal-shell-args.test.ts": 52,
+      "src/main/ipc/pty/daemon-late-exit.test.ts": 3152,
+      "src/main/ipc/pty/delivery/attached-pty-size.test.ts": 36,
+      "src/main/ipc/pty/host-env/omp-launch-environment.test.ts": 84,
+      "src/main/ipc/pty/ipc/spawn-commit-ssh-lease-cardinality.test.ts": 1617,
+      "src/main/ipc/pty/ipc/spawn-options-terminal-shell-args.test.ts": 672,
+      "src/main/ipc/pty/ipc/spawn-push-target-materialization-real-git.test.ts": 811,
+      "src/main/ipc/pty/ipc/spawn-push-target-materialization.test.ts": 67,
+      "src/main/ipc/pty/ipc/spawn-reattach-size-cache.test.ts": 814,
+      "src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts": 66,
+      "src/main/ipc/pty/pane/launch-authority.test.ts": 82,
+      "src/main/ipc/pty/pane/stable-pane-absence-death-certificate.test.ts": 2925,
+      "src/main/ipc/pty/pane/stable-pane-relay-absence-respawn.test.ts": 692,
+      "src/main/ipc/pty/pty-spawn-shell-override-parity.test.ts": 127,
+      "src/main/ipc/pty/register-headless-runtime.test.ts": 43,
+      "src/main/ipc/pty/register-without-renderer.test.ts": 3683,
+      "src/main/ipc/pty/runtime/queried-host-kinds.test.ts": 212,
+      "src/main/ipc/pty/runtime/spawn-commit-pty-size.test.ts": 1027,
+      "src/main/ipc/pty/runtime/spawn-preflight-requested-shell.test.ts": 970,
+      "src/main/ipc/rate-limits.test.ts": 73,
+      "src/main/ipc/readdir-error-diagnostics.test.ts": 27,
+      "src/main/ipc/register-core-handlers/register-core-handlers.test.ts": 1578,
+      "src/main/ipc/registered-worktree-root-ownership.test.ts": 366,
+      "src/main/ipc/registered-worktree-root-refresh.test.ts": 122,
+      "src/main/ipc/remote-watcher-event-batch.test.ts": 49,
+      "src/main/ipc/remote-workspace-cache.test.ts": 2439,
+      "src/main/ipc/remote-workspace-connected-clients.test.ts": 70,
+      "src/main/ipc/remote-workspace-patch-queue.test.ts": 474,
+      "src/main/ipc/remote-workspace-snapshot-normalization.test.ts": 43,
+      "src/main/ipc/remote-workspace-stale-resync.test.ts": 1371,
+      "src/main/ipc/remote-workspace.test.ts": 292,
+      "src/main/ipc/renderer-lifetime-abort.test.ts": 53,
+      "src/main/ipc/renderer-shutdown-checkpoint.test.ts": 62,
+      "src/main/ipc/renderer-terminal-serializer-readiness.test.ts": 59,
+      "src/main/ipc/repos-add-linked-worktree.test.ts": 1070,
+      "src/main/ipc/repos-create.test.ts": 966,
+      "src/main/ipc/repos-execution-host-catalog.test.ts": 943,
+      "src/main/ipc/repos-local-add-and-project-setup.test.ts": 1193,
+      "src/main/ipc/repos-local-clone-lifecycle.test.ts": 1467,
+      "src/main/ipc/repos-nested-import.test.ts": 1374,
+      "src/main/ipc/repos-nested-scan.test.ts": 586,
+      "src/main/ipc/repos-picker.test.ts": 1130,
+      "src/main/ipc/repos-remote-base-ref-queries.test.ts": 1008,
+      "src/main/ipc/repos-remote-client-events.test.ts": 1549,
+      "src/main/ipc/repos-remote-git-username.test.ts": 940,
+      "src/main/ipc/repos-remote.test.ts": 958,
+      "src/main/ipc/repos-sparse-presets.test.ts": 1305,
+      "src/main/ipc/repos/remote-repo-registration.test.ts": 230,
+      "src/main/ipc/repos/repo-creation-git-availability.test.ts": 150,
+      "src/main/ipc/runtime-agent-launch-capability.test.ts": 2099,
+      "src/main/ipc/runtime-environment-browser-client-host-handler.test.ts": 179,
+      "src/main/ipc/runtime-environment-capability-evidence.test.ts": 31,
+      "src/main/ipc/runtime-environment-cli-removal-routing.test.ts": 212,
+      "src/main/ipc/runtime-environment-diagnostics-broadcast.test.ts": 42,
+      "src/main/ipc/runtime-environment-federated-read-routing.test.ts": 233,
+      "src/main/ipc/runtime-environment-federated-read-transport.bench.test.ts": 163,
+      "src/main/ipc/runtime-environment-removal-storage.test.ts": 810,
+      "src/main/ipc/runtime-environment-request-connections.test.ts": 1502,
+      "src/main/ipc/runtime-environment-revision-guard.test.ts": 48,
+      "src/main/ipc/runtime-environment-status-connection.test.ts": 637,
+      "src/main/ipc/runtime-environment-status-recovery.test.ts": 246,
+      "src/main/ipc/runtime-environment-support-routing.test.ts": 361,
+      "src/main/ipc/runtime-environment-transport-generation.test.ts": 45,
+      "src/main/ipc/runtime-environment-transport-routing-tailscale-hint.test.ts": 1055,
+      "src/main/ipc/runtime-environments-call-routing.test.ts": 626,
+      "src/main/ipc/runtime-environments-capability-cache.test.ts": 482,
+      "src/main/ipc/runtime-environments-pairing.test.ts": 1362,
+      "src/main/ipc/runtime-environments-status-diagnostics.test.ts": 637,
+      "src/main/ipc/runtime-environments-subscription-lifecycle.test.ts": 989,
+      "src/main/ipc/runtime-environments-subscription-routing.test.ts": 524,
+      "src/main/ipc/runtime-environments-subscription-teardown.test.ts": 324,
+      "src/main/ipc/runtime-import-limits.test.ts": 46,
+      "src/main/ipc/runtime-subscribe-lifecycle.test.ts": 2028,
+      "src/main/ipc/runtime-upload-file-stream.test.ts": 167,
+      "src/main/ipc/runtime-upload-slice-boundaries.test.ts": 352,
+      "src/main/ipc/runtime-upload-temp-sweep.test.ts": 1063,
+      "src/main/ipc/runtime-watcher-pending-assignment.test.ts": 307,
+      "src/main/ipc/runtime-watcher-process-pool.test.ts": 143,
+      "src/main/ipc/runtime.test.ts": 2155,
+      "src/main/ipc/sender-scoped-request-cancellation.test.ts": 99,
+      "src/main/ipc/settings.test.ts": 4454,
+      "src/main/ipc/shallow-watch-delivery-probe-lifetime.test.ts": 58,
+      "src/main/ipc/shallow-watch-delivery-probe.test.ts": 161,
+      "src/main/ipc/shell.test.ts": 91,
+      "src/main/ipc/skill-cloud-install-ipc-schemas.test.ts": 91,
+      "src/main/ipc/skill-cloud-ipc-handlers.test.ts": 220,
+      "src/main/ipc/skill-install-management-ipc-handlers.test.ts": 178,
+      "src/main/ipc/skill-install-progress-ipc.test.ts": 35,
+      "src/main/ipc/skill-ipc-main-window.test.ts": 61,
+      "src/main/ipc/skills.test.ts": 543,
+      "src/main/ipc/source-control-ai-linked-issue.test.ts": 51,
+      "src/main/ipc/speech-worker-exit-lifetime.test.ts": 337,
+      "src/main/ipc/speech.test.ts": 75,
+      "src/main/ipc/ssh-active-relay-sessions.test.ts": 41,
+      "src/main/ipc/ssh-app-shutdown.test.ts": 1719,
+      "src/main/ipc/ssh-browse.test.ts": 737,
+      "src/main/ipc/ssh-disconnect-cancellation.test.ts": 3816,
+      "src/main/ipc/ssh-handler-reregistration.test.ts": 2634,
+      "src/main/ipc/ssh-host-partition-session-export.test.ts": 1162,
+      "src/main/ipc/ssh-passphrase.test.ts": 137,
+      "src/main/ipc/ssh-pty-closed-generation-ranges.test.ts": 67,
+      "src/main/ipc/ssh-pty-consumer-identity.test.ts": 3105,
+      "src/main/ipc/ssh-pty-legacy-projection.test.ts": 62,
+      "src/main/ipc/ssh-pty-model-admission-generation-scope.test.ts": 58,
+      "src/main/ipc/ssh-pty-model-admission.test.ts": 76,
+      "src/main/ipc/ssh-pty-output-exit-deadline.test.ts": 83,
+      "src/main/ipc/ssh-pty-output-generation-guard.test.ts": 48,
+      "src/main/ipc/ssh-pty-output-intake.test.ts": 165,
+      "src/main/ipc/ssh-pty-output-model-migration.test.ts": 109,
+      "src/main/ipc/ssh-pty-remote-source-range-consumers.test.ts": 85,
+      "src/main/ipc/ssh-pty-source-ack-coalescer.test.ts": 48,
+      "src/main/ipc/ssh-pty-source-ack-session-contract.test.ts": 62,
+      "src/main/ipc/ssh-pty-source-obligation-coordinator.test.ts": 45,
+      "src/main/ipc/ssh-pty-source-obligation-ledger.test.ts": 170,
+      "src/main/ipc/ssh-relay-reset-resume.test.ts": 3804,
+      "src/main/ipc/ssh-state-broadcast-fanout.test.ts": 2574,
+      "src/main/ipc/ssh-target-registry.test.ts": 3704,
+      "src/main/ipc/ssh-terminate-sessions.test.ts": 3008,
+      "src/main/ipc/ssh.test.ts": 2028,
+      "src/main/ipc/telemetry.test.ts": 230,
+      "src/main/ipc/terminal-git-credential-guard.test.ts": 82,
+      "src/main/ipc/terminal-preview-output-stream.test.ts": 28,
+      "src/main/ipc/terminal-preview.test.ts": 242,
+      "src/main/ipc/terminal-render-desync-evidence.test.ts": 63,
+      "src/main/ipc/terminal-startup-color-query-replies.test.ts": 138,
+      "src/main/ipc/tui-agent-detection-commands.test.ts": 44,
+      "src/main/ipc/ui.test.ts": 84,
+      "src/main/ipc/usage-provider-handlers.test.ts": 44,
+      "src/main/ipc/watched-worktree-catalog-notification.test.ts": 71,
+      "src/main/ipc/watcher-event-root-path-rewrite.test.ts": 61,
+      "src/main/ipc/watcher-removal-gate.test.ts": 37,
+      "src/main/ipc/workspace-cleanup-activity.test.ts": 80,
+      "src/main/ipc/workspace-cleanup-broad-scan.test.ts": 531,
+      "src/main/ipc/workspace-cleanup-execution-host-routing.test.ts": 305,
+      "src/main/ipc/workspace-cleanup-local-git-routing.test.ts": 461,
+      "src/main/ipc/workspace-cleanup-snapshot-ipc.test.ts": 114,
+      "src/main/ipc/workspace-cleanup.test.ts": 4644,
+      "src/main/ipc/workspace-create-error-classifier.test.ts": 52,
+      "src/main/ipc/workspace-ports.test.ts": 103,
+      "src/main/ipc/workspace-space.test.ts": 63,
+      "src/main/ipc/worktree-base-directory-change-collector.test.ts": 42,
+      "src/main/ipc/worktree-base-directory-event-filter.test.ts": 61,
+      "src/main/ipc/worktree-base-directory-poller-marker-fanout.test.ts": 219,
+      "src/main/ipc/worktree-base-directory-poller.test.ts": 2702,
+      "src/main/ipc/worktree-base-directory-watch-targets.test.ts": 388,
+      "src/main/ipc/worktree-base-directory-watcher.test.ts": 454,
+      "src/main/ipc/worktree-create-lineage.test.ts": 570,
+      "src/main/ipc/worktree-folder-rename-target.test.ts": 65,
+      "src/main/ipc/worktree-git-common-polling.test.ts": 1240,
+      "src/main/ipc/worktree-git-common-watch.test.ts": 2604,
+      "src/main/ipc/worktree-git-status-ref-watch.test.ts": 40,
+      "src/main/ipc/worktree-head-identity-reader-concurrency.test.ts": 72,
+      "src/main/ipc/worktree-head-identity-reader-incremental.test.ts": 255,
+      "src/main/ipc/worktree-head-identity-reader.test.ts": 99,
+      "src/main/ipc/worktree-head-identity-refresh.test.ts": 84,
+      "src/main/ipc/worktree-head-identity-retirement.test.ts": 80,
+      "src/main/ipc/worktree-include-copy-budget.test.ts": 119,
+      "src/main/ipc/worktree-logic-created-agent.test.ts": 82,
+      "src/main/ipc/worktree-logic-wsl.test.ts": 102,
+      "src/main/ipc/worktree-logic.test.ts": 185,
+      "src/main/ipc/worktree-metadata-merge.test.ts": 60,
+      "src/main/ipc/worktree-path-deduplication.test.ts": 69,
+      "src/main/ipc/worktree-push-target-cleanup.test.ts": 182,
+      "src/main/ipc/worktree-push-target-reconciliation-real-git.test.ts": 862,
+      "src/main/ipc/worktree-push-target-reconciliation.test.ts": 305,
+      "src/main/ipc/worktree-push-target-refspec-migration.test.ts": 178,
+      "src/main/ipc/worktree-push-target-refspec-real-git.test.ts": 2471,
+      "src/main/ipc/worktree-push-target-remote-scan.test.ts": 135,
+      "src/main/ipc/worktree-push-target-setup.test.ts": 223,
+      "src/main/ipc/worktree-remote-push-target-materialization.test.ts": 717,
+      "src/main/ipc/worktree-remote-ssh-branch-conflict.test.ts": 500,
+      "src/main/ipc/worktree-symlink-reconciliation.real.test.ts": 239,
+      "src/main/ipc/worktree-symlinks.test.ts": 136,
+      "src/main/ipc/worktree-watcher-removal-binding.test.ts": 150,
+      "src/main/ipc/worktrees-authoritative-local-metadata-pruning.test.ts": 1279,
+      "src/main/ipc/worktrees-canonical-ssh-listing.test.ts": 577,
+      "src/main/ipc/worktrees-create-execution-host-routing.test.ts": 588,
+      "src/main/ipc/worktrees-create-metadata-persistence.test.ts": 1369,
+      "src/main/ipc/worktrees-delete-pty-teardown.test.ts": 536,
+      "src/main/ipc/worktrees-detected-scan-cache.test.ts": 1356,
+      "src/main/ipc/worktrees-discovery-metadata-backfill.test.ts": 452,
+      "src/main/ipc/worktrees-existing-branch-checkout.test.ts": 1249,
+      "src/main/ipc/worktrees-forget-local.test.ts": 638,
+      "src/main/ipc/worktrees-issue-command-overrides.test.ts": 430,
+      "src/main/ipc/worktrees-lineage-hydration.test.ts": 886,
+      "src/main/ipc/worktrees-listing-fallback-rows.test.ts": 778,
+      "src/main/ipc/worktrees-local-base-ref-resolution.test.ts": 872,
+      "src/main/ipc/worktrees-local-create-flow.test.ts": 922,
+      "src/main/ipc/worktrees-mutation-scan-generation-order.test.ts": 971,
+      "src/main/ipc/worktrees-orphan-directory-cleanup.test.ts": 933,
+      "src/main/ipc/worktrees-preserved-branch-fork-remote.test.ts": 816,
+      "src/main/ipc/worktrees-removal-recovery.test.ts": 1234,
+      "src/main/ipc/worktrees-remove-archive-hooks.test.ts": 1347,
+      "src/main/ipc/worktrees-remove-host-disambiguation.test.ts": 868,
+      "src/main/ipc/worktrees-remove-preflight.test.ts": 840,
+      "src/main/ipc/worktrees-setup-launch-sparse-checkout.test.ts": 664,
+      "src/main/ipc/worktrees-ssh-base-ref-resolution.test.ts": 917,
+      "src/main/ipc/worktrees-ssh-branch-conflict-suffixing.test.ts": 925,
+      "src/main/ipc/worktrees-ssh-create-base-prefetch.test.ts": 717,
+      "src/main/ipc/worktrees-ssh-fork-push-target-remote.test.ts": 914,
+      "src/main/ipc/worktrees-ssh-local-base-refresh.test.ts": 906,
+      "src/main/ipc/worktrees-ssh-pr-head-fetch.test.ts": 768,
+      "src/main/ipc/worktrees-ssh-provider-authority.test.ts": 895,
+      "src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts": 1245,
+      "src/main/ipc/worktrees-ssh-setup-launch.test.ts": 927,
+      "src/main/ipc/worktrees-windows.test.ts": 1052,
+      "src/main/ipc/worktrees-wsl-runtime-routing.test.ts": 812,
+      "src/main/ipc/worktrees/listing/detected-provider-listing-catalog-version.test.ts": 107,
+      "src/main/ipc/worktrees/listing/detected-provider-listing-meta-index.test.ts": 358,
+      "src/main/ipc/worktrees/listing/detected-provider-listing-overtaken-scan.test.ts": 127,
+      "src/main/ipc/worktrees/listing/detected-scan-failure-authority.test.ts": 431,
+      "src/main/ipc/worktrees/listing/detected-worktree-classification.test.ts": 148,
+      "src/main/ipc/worktrees/listing/detected-worktree-scan-hygiene-gate.test.ts": 55,
+      "src/main/ipc/worktrees/listing/detected-worktree-scan-superseded.test.ts": 89,
+      "src/main/ipc/worktrees/listing/register-sparse-checkout-cache-invalidation.test.ts": 168,
+      "src/main/ipc/worktrees/metadata/workspace-lineage-candidate-scan.test.ts": 54,
+      "src/main/ipc/worktrees/removal/remove-unregistered-worktree-host-home.test.ts": 99,
+      "src/main/ipc/worktrees/removal/worktree-archive-hook.test.ts": 211,
+      "src/main/issue-command-ignore.test.ts": 395,
+      "src/main/jira/adf-markdown.test.ts": 58,
+      "src/main/jira/attachment-image-cache-generation.test.ts": 46,
+      "src/main/jira/attachment-image-cache.test.ts": 47,
+      "src/main/jira/attachment-images.test.ts": 82,
+      "src/main/jira/client.test.ts": 304,
+      "src/main/jira/issues.test.ts": 172,
+      "src/main/jira/jira-issue-mutations.test.ts": 56,
+      "src/main/jira/jira-issue-summary-timeout.test.ts": 78,
+      "src/main/jira/jira-search-abort.test.ts": 42,
+      "src/main/keybindings/keybinding-file.test.ts": 119,
+      "src/main/keybindings/keybinding-service.test.ts": 140,
+      "src/main/kimi/hook-service-config-delete-race.test.ts": 124,
+      "src/main/kimi/hook-service-mode-read-failure.test.ts": 86,
+      "src/main/kimi/hook-service.test.ts": 161,
+      "src/main/kimi/kimi-hook-config-toml.test.ts": 94,
+      "src/main/kimi/kimi-runtime-home.test.ts": 62,
+      "src/main/lib/unread-response-body.test.ts": 92,
+      "src/main/line-editor-ready-output-scanner.test.ts": 55,
+      "src/main/linear/client.test.ts": 107,
+      "src/main/linear/issue-context-client.test.ts": 61,
+      "src/main/linear/issue-context-current.test.ts": 63,
+      "src/main/linear/issue-context-errors.test.ts": 52,
+      "src/main/linear/issue-context-includes.test.ts": 66,
+      "src/main/linear/issue-context-inline-media.test.ts": 76,
+      "src/main/linear/issue-context-relations.test.ts": 37,
+      "src/main/linear/issue-context.test.ts": 66,
+      "src/main/linear/issue-list-filter.test.ts": 44,
+      "src/main/linear/issue-relation-write.test.ts": 79,
+      "src/main/linear/issue-search-summary.test.ts": 50,
+      "src/main/linear/issues.test.ts": 114,
+      "src/main/linear/linear-workspace-registry.test.ts": 39,
+      "src/main/linear/mappers.test.ts": 53,
+      "src/main/linear/mcp-issue-list-pagination.test.ts": 93,
+      "src/main/linear/mcp-issue-list.test.ts": 105,
+      "src/main/linear/projects.test.ts": 369,
+      "src/main/linear/teams.test.ts": 84,
+      "src/main/linux-lid-sleep-assertion.test.ts": 93,
+      "src/main/linux-package-install-command.test.ts": 46,
+      "src/main/linux-package-install-diagnostic.test.ts": 79,
+      "src/main/linux-package-update-recovery.test.ts": 361,
+      "src/main/linux-update-package-type.test.ts": 98,
+      "src/main/local-builds/local-build-candidate.test.ts": 265,
+      "src/main/local-builds/local-build-compatibility-contract.test.ts": 162,
+      "src/main/local-builds/local-build-feed-server.test.ts": 191,
+      "src/main/local-downloaded-folder-promotion.test.ts": 185,
+      "src/main/local-worktree-filesystem-wsl-banner.wsl.test.ts": 54,
+      "src/main/local-worktree-filesystem.test.ts": 348,
+      "src/main/local-worktree-metadata-prune-gate.test.ts": 60,
+      "src/main/local-worktree-path-presence.test.ts": 77,
+      "src/main/local-worktree-removal-recovery-live.test.ts": 198,
+      "src/main/local-worktree-removal-recovery.test.ts": 123,
+      "src/main/localhost-worktree-label-proxy.test.ts": 141,
+      "src/main/macos-full-disk-access-status.test.ts": 54,
+      "src/main/macos-keychain/generic-password.test.ts": 61,
+      "src/main/macos-press-and-hold-default.defaults-domain.test.ts": 51,
+      "src/main/macos-press-and-hold-default.test.ts": 95,
+      "src/main/macos-system-sleep-assertion.test.ts": 73,
+      "src/main/macos-tcc-prompt-notice.test.ts": 61,
+      "src/main/macos-tcc-prompt-watch.test.ts": 66,
+      "src/main/macos-tcc-reset.test.ts": 41,
+      "src/main/main-process-tree-kill-gate.test.ts": 378,
+      "src/main/memory/collector-windows-sweep.test.ts": 455,
+      "src/main/memory/collector.test.ts": 333,
+      "src/main/memory/host-memory.test.ts": 78,
+      "src/main/memory/hydrate-local-pty-registry.test.ts": 774,
+      "src/main/memory/memory-snapshot-buckets.test.ts": 56,
+      "src/main/memory/process-memory-metric.test.ts": 49,
+      "src/main/memory/windows-process-sample-parsing.test.ts": 95,
+      "src/main/menu/gpu-acceleration-about-panel.test.ts": 30,
+      "src/main/menu/register-app-menu.test.ts": 65,
+      "src/main/mimo/hook-service.test.ts": 66,
+      "src/main/minimax/minimax-api-key-store.test.ts": 88,
+      "src/main/minimax/minimax-cookie-store.test.ts": 71,
+      "src/main/muse-usage/scanner.test.ts": 162,
+      "src/main/muse-usage/snapshot-rollups.test.ts": 49,
+      "src/main/muse-usage/store-snapshot-filtering.test.ts": 475,
+      "src/main/muse/hook-config-json.test.ts": 85,
+      "src/main/muse/hook-service.test.ts": 134,
+      "src/main/native-chat/agent-model-catalog/agent-model-catalog-service.test.ts": 59,
+      "src/main/native-chat/agent-model-catalog/agent-model-catalog-store.test.ts": 550,
+      "src/main/native-chat/agent-model-catalog/agent-project-model-override.test.ts": 52,
+      "src/main/native-chat/agent-session-journal/journal-corruption-repair.test.ts": 355,
+      "src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts": 346,
+      "src/main/native-chat/agent-session-journal/journal-cursor.test.ts": 54,
+      "src/main/native-chat/agent-session-journal/journal-database.test.ts": 177,
+      "src/main/native-chat/agent-session-journal/journal-dispatch-observation.test.ts": 45,
+      "src/main/native-chat/agent-session-journal/journal-dispatch-reason-bound.test.ts": 246,
+      "src/main/native-chat/agent-session-journal/journal-epoch-replacement.test.ts": 234,
+      "src/main/native-chat/agent-session-journal/journal-file-format-remnant.test.ts": 269,
+      "src/main/native-chat/agent-session-journal/journal-handle-ownership.test.ts": 5325,
+      "src/main/native-chat/agent-session-journal/journal-item-identity.test.ts": 64,
+      "src/main/native-chat/agent-session-journal/journal-legacy-import-source-bound.test.ts": 236,
+      "src/main/native-chat/agent-session-journal/journal-legacy-import.test.ts": 451,
+      "src/main/native-chat/agent-session-journal/journal-producer-inheritance.test.ts": 238,
+      "src/main/native-chat/agent-session-journal/journal-reducer.test.ts": 155,
+      "src/main/native-chat/agent-session-journal/journal-restart-reconciliation.test.ts": 324,
+      "src/main/native-chat/agent-session-journal/journal-row-context-usage.test.ts": 232,
+      "src/main/native-chat/agent-session-journal/journal-row-schema-version.test.ts": 248,
+      "src/main/native-chat/agent-session-journal/journal-row-schema.test.ts": 127,
+      "src/main/native-chat/agent-session-journal/journal-row-writer.test.ts": 187,
+      "src/main/native-chat/agent-session-journal/journal-store-close.test.ts": 249,
+      "src/main/native-chat/agent-session-journal/journal-store-schema.test.ts": 222,
+      "src/main/native-chat/agent-session-journal/journal-store.test.ts": 401,
+      "src/main/native-chat/agent-session-journal/journal-streaming-replay.test.ts": 1019,
+      "src/main/native-chat/agent-session-journal/journal-subagent-liveness.test.ts": 243,
+      "src/main/native-chat/agent-session-wire/agent-session-conversation-outline.test.ts": 200,
+      "src/main/native-chat/agent-session-wire/agent-session-delta-coalescer-protected.test.ts": 40,
+      "src/main/native-chat/agent-session-wire/agent-session-delta-coalescer.test.ts": 41,
+      "src/main/native-chat/agent-session-wire/agent-session-empty-delta-retention.test.ts": 173,
+      "src/main/native-chat/agent-session-wire/agent-session-history-byte-accounting.test.ts": 497,
+      "src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts": 1663,
+      "src/main/native-chat/agent-session-wire/agent-session-history-page-grouping-parity.test.ts": 309,
+      "src/main/native-chat/agent-session-wire/agent-session-history-page-scaling.test.ts": 75,
+      "src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts": 2331,
+      "src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts": 427,
+      "src/main/native-chat/agent-session-wire/agent-session-retired-provider-exit-copy-ratchet.test.ts": 1719,
+      "src/main/native-chat/agent-session-wire/provider-frame-activity.test.ts": 52,
+      "src/main/native-chat/agent-session-wire/provider-frame-disposition.test.ts": 97,
+      "src/main/native-chat/agent-session-wire/provider-turn-activity-routing.test.ts": 210,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-acquisition-options.test.ts": 1113,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-adapter-router.test.ts": 83,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-adapter.test.ts": 47,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.test.ts": 386,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-append-delivery.test.ts": 626,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-attach-reconciliation.test.ts": 393,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-claude-option-queue.test.ts": 687,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-claude-root-exit.test.ts": 674,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-close-retry.test.ts": 404,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-command-publication.test.ts": 556,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-conversations.test.ts": 297,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-crash-mid-start.test.ts": 1198,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.test.ts": 409,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.test.ts": 259,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts": 255,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-owner-verdict.test.ts": 514,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-sink-release.test.ts": 766,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-forget-status.test.ts": 780,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-grouped-prompt.test.ts": 448,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-hold-resume-race.test.ts": 72,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-holds.test.ts": 300,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-host-runtime-state.test.ts": 170,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.test.ts": 369,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts": 1870,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-journal-handles.test.ts": 442,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-late-settlement.test.ts": 736,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-launch-env.test.ts": 301,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-launch-send-after-create.test.ts": 423,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.test.ts": 389,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-legacy-handoff-record.test.ts": 809,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.test.ts": 600,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-option-settlement.test.ts": 718,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-owed-work-release.test.ts": 1713,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-processless-reservation.test.ts": 477,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-prompt-cancel.test.ts": 255,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-provider-restore.test.ts": 558,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.test.ts": 972,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.test.ts": 370,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.test.ts": 51,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-recovered-turn-clock.test.ts": 816,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-recovery-exits.test.ts": 739,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.test.ts": 297,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts": 3078,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-resolved-append.test.ts": 48,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-child-work.test.ts": 785,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.test.ts": 330,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-filing.test.ts": 1273,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-after-reattach.test.ts": 829,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-endings.test.ts": 711,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-ownership.test.ts": 3393,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-reconcile.test.ts": 320,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore-gate.test.ts": 48,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.test.ts": 131,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume.test.ts": 354,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-status-publication.test.ts": 613,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-teardown.test.ts": 900,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-reveal.test.ts": 351,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-rewind.test.ts": 1675,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts": 225,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.test.ts": 2117,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-send-restarts-failed-start.test.ts": 871,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.test.ts": 42,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts": 1405,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-settled-attach-retry.test.ts": 812,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-shown-work.test.ts": 358,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.test.ts": 271,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-startup-failure-exit.test.ts": 168,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-child-work.test.ts": 288,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-clock.test.ts": 311,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.test.ts": 699,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-status-ownership.test.ts": 99,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-status-reentry.test.ts": 791,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-subagent-recency.test.ts": 1004,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts": 551,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-surface-lifetime.test.ts": 2023,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-task-queue.test.ts": 89,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.test.ts": 284,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-turn-completion-feed.test.ts": 67,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-turns.test.ts": 295,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-unanswered-dispatch-release.test.ts": 405,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts": 127,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-wedged-profile-migration.test.ts": 2947,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-wire-admission.test.ts": 643,
+      "src/main/native-chat/agent-session-wire/structured-conversation-command-admission.test.ts": 57,
+      "src/main/native-chat/agent-session-wire/structured-conversation-command.test.ts": 1455,
+      "src/main/native-chat/agent-session-wire/structured-conversation-replacements.test.ts": 330,
+      "src/main/native-chat/agent-session-wire/structured-rewind-journal-body.test.ts": 123,
+      "src/main/native-chat/agent-session-wire/structured-session-compaction.test.ts": 36,
+      "src/main/native-chat/agent-session-wire/unhandled-provider-frame.test.ts": 64,
+      "src/main/native-chat/claude-structured-managed-account-support.test.ts": 37,
+      "src/main/native-chat/host-readable-transcript-path-fs-gate.test.ts": 257,
+      "src/main/native-chat/host-readable-transcript-path.test.ts": 89,
+      "src/main/native-chat/native-chat-file-provenance.test.ts": 134,
+      "src/main/native-chat/session-file-resolver-claude-roots.test.ts": 131,
+      "src/main/native-chat/session-file-resolver-codex-roots.test.ts": 66,
+      "src/main/native-chat/session-file-resolver-wsl-scan-gate.test.ts": 95,
+      "src/main/native-chat/session-file-resolver-wsl.test.ts": 92,
+      "src/main/native-chat/session-file-resolver.test.ts": 108,
+      "src/main/native-chat/structured-agent-session-create-support.test.ts": 39,
+      "src/main/native-chat/structured-agent-session-history-adoption.test.ts": 141,
+      "src/main/native-chat/subagent-entry-id-bounds.test.ts": 37,
+      "src/main/native-chat/transcript-fallback-id.test.ts": 47,
+      "src/main/native-chat/transcript-interruption-message.test.ts": 50,
+      "src/main/native-chat/transcript-line-decoders-claude-control-bytes.test.ts": 51,
+      "src/main/native-chat/transcript-line-decoders-claude-image-companion.test.ts": 81,
+      "src/main/native-chat/transcript-line-decoders-codex-skill-context.test.ts": 48,
+      "src/main/native-chat/transcript-line-decoders.grok.test.ts": 64,
+      "src/main/native-chat/transcript-line-decoders.omp.test.ts": 95,
+      "src/main/native-chat/transcript-read-cache-inflight.test.ts": 512,
+      "src/main/native-chat/transcript-read-cache-refusal-recovery.test.ts": 135,
+      "src/main/native-chat/transcript-read-cache-wsl-stall.test.ts": 58,
+      "src/main/native-chat/transcript-read-cache.test.ts": 193,
+      "src/main/native-chat/transcript-reader-codex-history-mode.test.ts": 132,
+      "src/main/native-chat/transcript-reader-wsl-stall.test.ts": 114,
+      "src/main/native-chat/transcript-reader.test.ts": 176,
+      "src/main/native-chat/transcript-stream-lines.test.ts": 83,
+      "src/main/native-chat/transcript-tail-reader-cancellation.test.ts": 210,
+      "src/main/native-chat/transcript-tail-reader-wsl-gate.test.ts": 91,
+      "src/main/native-chat/transcript-turn-lifecycle.test.ts": 95,
+      "src/main/native-chat/transcript-watch-engine-wsl-lifecycle.test.ts": 217,
+      "src/main/native-chat/transcript-watch-error.test.ts": 2170,
+      "src/main/native-chat/transcript-watch-liveness.test.ts": 762,
+      "src/main/native-chat/transcript-watch-resolve-poll.test.ts": 203,
+      "src/main/native-chat/transcript-watch-unflushed-settle.test.ts": 201,
+      "src/main/native-chat/transcript-watch-unsubscribe-race.test.ts": 133,
+      "src/main/native-chat/transcript-watch-wsl-exact-path.test.ts": 105,
+      "src/main/native-chat/transcript-watch-wsl-stall.test.ts": 170,
+      "src/main/native-chat/transcript-watch.test.ts": 3388,
+      "src/main/native-chat/transcript-window-tool-attribution.test.ts": 146,
+      "src/main/native-chat/wsl-codex-session-path-scan.test.ts": 100,
+      "src/main/native-chat/wsl-transcript-fs-access.test.ts": 147,
+      "src/main/native-chat/wsl-transcript-fs-gate.test.ts": 538,
+      "src/main/native-chat/wsl-transcript-fs-process-client.test.ts": 79,
+      "src/main/native-chat/wsl-transcript-fs-process-operations.test.ts": 38,
+      "src/main/native-chat/wsl-transcript-fs-route-quarantine.test.ts": 76,
+      "src/main/native-chat/wsl-transcript-fs-route.test.ts": 44,
+      "src/main/native-chat/wsl-transcript-running-observer.test.ts": 119,
+      "src/main/network/electron-proxy-request-guard.test.ts": 351,
+      "src/main/network/macos-system-resolver-health.test.ts": 74,
+      "src/main/network/macos-tailscale-dns-diagnostic.test.ts": 47,
+      "src/main/network/proxy-settings-session.test.ts": 837,
+      "src/main/network/proxy-settings.test.ts": 90,
+      "src/main/notebook/notebook-kernel.test.ts": 160,
+      "src/main/notebook/python-environments.test.ts": 82,
+      "src/main/notifications/announced-notification-registry.test.ts": 38,
+      "src/main/notifications/desktop-away-state.test.ts": 54,
+      "src/main/notifications/notification-delivery-service.test.ts": 69,
+      "src/main/observability/architecture.test.ts": 56,
+      "src/main/observability/bundle.test.ts": 471,
+      "src/main/observability/diagnostic-upload-http.test.ts": 50,
+      "src/main/observability/instrumentation.test.ts": 472,
+      "src/main/observability/local-file-sink-memory.test.ts": 149,
+      "src/main/observability/local-file-sink.test.ts": 84,
+      "src/main/observability/redactor-environment-lines.test.ts": 546,
+      "src/main/observability/redactor.test.ts": 74,
+      "src/main/observability/tracer.test.ts": 74,
+      "src/main/opencode-usage/cache-read-reproduction.test.ts": 173,
+      "src/main/opencode-usage/opencode2-session-usage.test.ts": 528,
+      "src/main/opencode-usage/scanner-windows-data-directory.test.ts": 164,
+      "src/main/opencode-usage/scanner-wsl-gate.test.ts": 49,
+      "src/main/opencode-usage/scanner.test.ts": 182,
+      "src/main/opencode-usage/store.test.ts": 141,
+      "src/main/opencode/hook-plugin-background-child-completion.test.ts": 405,
+      "src/main/opencode/hook-plugin-child-attention.test.ts": 698,
+      "src/main/opencode/hook-plugin-fail-open-ownership.test.ts": 519,
+      "src/main/opencode/hook-plugin-lifecycle-delivery.test.ts": 1151,
+      "src/main/opencode/hook-plugin-message-part-throttle.test.ts": 306,
+      "src/main/opencode/hook-plugin-module-contract.test.ts": 601,
+      "src/main/opencode/hook-plugin-opencode2-session-lineage.test.ts": 1056,
+      "src/main/opencode/hook-plugin-opencode2-setup.test.ts": 1712,
+      "src/main/opencode/hook-service.test.ts": 275,
+      "src/main/opencode/opencode-client-sweep.test.ts": 66,
+      "src/main/opencode/opencode-data-directory.test.ts": 51,
+      "src/main/opencode/opencode-session-binder.test.ts": 118,
+      "src/main/opencode2/status-plugin-setup-lifetime.test.ts": 51,
+      "src/main/orca-profiles/profile-active-transfer-worker.test.ts": 2219,
+      "src/main/orca-profiles/profile-active-transfer.test.ts": 1956,
+      "src/main/orca-profiles/profile-artifact-cloud-cleanup.test.ts": 371,
+      "src/main/orca-profiles/profile-cloud-auth-config.test.ts": 57,
+      "src/main/orca-profiles/profile-cloud-auth-status.test.ts": 66,
+      "src/main/orca-profiles/profile-cloud-client.test.ts": 127,
+      "src/main/orca-profiles/profile-cloud-dev-service.test.ts": 328,
+      "src/main/orca-profiles/profile-cloud-org-members-client.test.ts": 68,
+      "src/main/orca-profiles/profile-cloud-org-members-service.test.ts": 197,
+      "src/main/orca-profiles/profile-cloud-pkce.test.ts": 620,
+      "src/main/orca-profiles/profile-cloud-refresh-replay-guard.test.ts": 53,
+      "src/main/orca-profiles/profile-cloud-service-auth-retry.test.ts": 296,
+      "src/main/orca-profiles/profile-cloud-service-connect-overlap.test.ts": 311,
+      "src/main/orca-profiles/profile-cloud-service-refresh.test.ts": 315,
+      "src/main/orca-profiles/profile-cloud-service-sign-out-connect-race.test.ts": 378,
+      "src/main/orca-profiles/profile-cloud-service.test.ts": 445,
+      "src/main/orca-profiles/profile-cloud-session-mutation.test.ts": 95,
+      "src/main/orca-profiles/profile-cloud-session-refresh.test.ts": 97,
+      "src/main/orca-profiles/profile-cloud-session-store.test.ts": 130,
+      "src/main/orca-profiles/profile-index-store.test.ts": 700,
+      "src/main/orca-profiles/profile-persistence-deadline.test.ts": 39,
+      "src/main/orca-profiles/profile-project-domain-transfer.test.ts": 1889,
+      "src/main/orca-profiles/profile-project-presence.test.ts": 408,
+      "src/main/orca-profiles/profile-project-session-field-disposition.test.ts": 190,
+      "src/main/orca-profiles/profile-project-session-state.test.ts": 175,
+      "src/main/orca-profiles/profile-project-state-file.test.ts": 264,
+      "src/main/orca-profiles/profile-project-transfer-migration.test.ts": 1155,
+      "src/main/orca-profiles/profile-project-transfer.test.ts": 1755,
+      "src/main/orca-profiles/profile-telemetry-consent-seed.test.ts": 221,
+      "src/main/orca-profiles/profile-ui-scope.test.ts": 28,
+      "src/main/orcad/electron-serve-browser-process.test.ts": 2507,
+      "src/main/orcad/electron-serve-provider-selection.test.ts": 696,
+      "src/main/orcad/electron-sidecar-method-routing.test.ts": 105,
+      "src/main/orcad/electron-sidecar-tab-registry.test.ts": 78,
+      "src/main/orcad/external-chromium-browser-process.integration.test.ts": 233,
+      "src/main/orcad/external-chromium-browser-session.test.ts": 172,
+      "src/main/orcad/main-preflight-order.test.ts": 106,
+      "src/main/orcad/native-host-abi.test.ts": 58,
+      "src/main/orcad/node-pty-prebuilt-slot.test.ts": 64,
+      "src/main/orcad/node-pty-precondition.test.ts": 310,
+      "src/main/orcad/orcad-app-paths.test.ts": 73,
+      "src/main/orcad/orcad-artifact-preflight.test.ts": 377,
+      "src/main/orcad/orcad-bind-address.test.ts": 57,
+      "src/main/orcad/orcad-browser-provider.test.ts": 336,
+      "src/main/orcad/orcad-bun-launcher.integration.test.ts": 50,
+      "src/main/orcad/orcad-bun-native-preflight.test.ts": 113,
+      "src/main/orcad/orcad-bundle-native-load-order.test.ts": 2639,
+      "src/main/orcad/orcad-bundled-runtime.integration.test.ts": 5450,
+      "src/main/orcad/orcad-bundled-runtime.test.ts": 90,
+      "src/main/orcad/orcad-daemon-supervision.test.ts": 35,
+      "src/main/orcad/orcad-entry.test.ts": 287,
+      "src/main/orcad/orcad-forked-child-paths.test.ts": 352,
+      "src/main/orcad/orcad-health.test.ts": 49,
+      "src/main/orcad/orcad-instance-lock.test.ts": 91,
+      "src/main/orcad/orcad-launch-contract.test.ts": 405,
+      "src/main/orcad/orcad-native-preflight.test.ts": 71,
+      "src/main/orcad/orcad-profile-preflight.test.ts": 246,
+      "src/main/orcad/orcad-profile-state-startup.test.ts": 55,
+      "src/main/orcad/orcad-profile-state-telemetry.test.ts": 36,
+      "src/main/orcad/orcad-push-startup.test.ts": 1287,
+      "src/main/orcad/orcad-sidecar-runtime-client.test.ts": 211,
+      "src/main/own-chromium-tree-kill-guard.test.ts": 99,
+      "src/main/persistence-async-write-syscalls.test.ts": 3167,
+      "src/main/persistence-automations.test.ts": 2205,
+      "src/main/persistence-clipboard-selection-migration.test.ts": 1235,
+      "src/main/persistence-cohort-and-identity-migration.test.ts": 1307,
+      "src/main/persistence-cross-host-pane-identity.test.ts": 1023,
+      "src/main/persistence-deregistered-repo-residue.test.ts": 1319,
+      "src/main/persistence-duplicate-repo-id-host-scope.test.ts": 1500,
+      "src/main/persistence-feature-interaction-broadcast.benchmark.test.ts": 1424,
+      "src/main/persistence-floating-terminal-trust.test.ts": 1342,
+      "src/main/persistence-flush-and-save-scheduling.test.ts": 3251,
+      "src/main/persistence-folder-workspace-notes.test.ts": 1466,
+      "src/main/persistence-host-admitted-terminal-membership.test.ts": 1200,
+      "src/main/persistence-host-partitioned-sessions.test.ts": 1016,
+      "src/main/persistence-host-partitioned-ssh-pty-bindings.test.ts": 1205,
+      "src/main/persistence-initial-load.test.ts": 1188,
+      "src/main/persistence-layout-binding-recovery.test.ts": 1127,
+      "src/main/persistence-load-repair-durability.test.ts": 693,
+      "src/main/persistence-loading-store-extraction.test.ts": 1319,
+      "src/main/persistence-loading-store-write-risks.test.ts": 1386,
+      "src/main/persistence-native-chat-tab-view-mode.test.ts": 1121,
+      "src/main/persistence-pane-identity-migration.test.ts": 28713,
+      "src/main/persistence-protected-secret-fail-closed.test.ts": 5578,
+      "src/main/persistence-protected-secret-write-race.test.ts": 1294,
+      "src/main/persistence-proxy-secret-recovery.test.ts": 1954,
+      "src/main/persistence-pty-binding-leaf-tab-resolution.test.ts": 938,
+      "src/main/persistence-pty-binding-reconciliation.test.ts": 1174,
+      "src/main/persistence-remote-session-startup.test.ts": 1128,
+      "src/main/persistence-repo-lifecycle.test.ts": 3659,
+      "src/main/persistence-right-sidebar-tab.test.ts": 1040,
+      "src/main/persistence-settings-ui-defaults.test.ts": 1660,
+      "src/main/persistence-settings-update.test.ts": 1245,
+      "src/main/persistence-single-serialize.test.ts": 2736,
+      "src/main/persistence-source-control-ai-migration.test.ts": 683,
+      "src/main/persistence-split-pane-incarnation.test.ts": 1213,
+      "src/main/persistence-ssh-lease-reattach-reclaim.test.ts": 1164,
+      "src/main/persistence-ssh-lease-tombstone-retention.test.ts": 1178,
+      "src/main/persistence-ssh-pending-pty-kill.test.ts": 1764,
+      "src/main/persistence-ssh-readoption-automation-migration.test.ts": 1863,
+      "src/main/persistence-ssh-remote-pty-binding-replay.test.ts": 799,
+      "src/main/persistence-ssh-remote-pty-leases.test.ts": 1111,
+      "src/main/persistence-ssh-targets-and-pane-keys.test.ts": 1001,
+      "src/main/persistence-terminal-option-key-migration.test.ts": 1316,
+      "src/main/persistence-ui-state.test.ts": 3909,
+      "src/main/persistence-update-repo.test.ts": 1077,
+      "src/main/persistence-workspace-pinned-automation-fence.test.ts": 1833,
+      "src/main/persistence-workspace-repin-automation-owner.test.ts": 1750,
+      "src/main/persistence-workspace-session-scrollback.test.ts": 1387,
+      "src/main/persistence-workspace-status-workflow.test.ts": 1055,
+      "src/main/persistence-worktree-card-properties.test.ts": 576,
+      "src/main/persistence-worktree-deletion-fencing.test.ts": 1370,
+      "src/main/persistence-worktree-lineage-and-backups.test.ts": 1778,
+      "src/main/persistence-worktree-meta-and-folder-workspaces.test.ts": 818,
+      "src/main/persistence-worktree-name-retirement.test.ts": 6044,
+      "src/main/persistence-worktree-visibility.test.ts": 1446,
+      "src/main/persistence/applying-settings/settings-update-machine-name.test.ts": 235,
+      "src/main/persistence/applying-settings/settings-update-terminal-contrast.test.ts": 177,
+      "src/main/persistence/applying-settings/terminal-settings-migrations.test.ts": 55,
+      "src/main/persistence/leasing-ssh-ptys/ssh-pty-binding-cleanup.test.ts": 221,
+      "src/main/persistence/loading-store/metadata-lineage-batch-pruning.test.ts": 356,
+      "src/main/persistence/loading-store/normalize-loaded-global-settings.test.ts": 261,
+      "src/main/persistence/loading-store/normalize-loaded-project-catalog.test.ts": 228,
+      "src/main/persistence/loading-store/persisted-state-redundancy.test.ts": 1195,
+      "src/main/persistence/loading-store/profile-state-caller-cancellation.test.ts": 1418,
+      "src/main/persistence/loading-store/profile-state-checkpoints.test.ts": 1468,
+      "src/main/persistence/loading-store/profile-state-direct-flush.test.ts": 776,
+      "src/main/persistence/loading-store/profile-state-import-lifetime.test.ts": 882,
+      "src/main/persistence/loading-store/profile-state-maintenance-compatibility.test.ts": 2555,
+      "src/main/persistence/loading-store/profile-state-maintenance-final-failure.test.ts": 1334,
+      "src/main/persistence/loading-store/profile-state-maintenance-recovery.test.ts": 1797,
+      "src/main/persistence/loading-store/profile-state-maintenance.test.ts": 2795,
+      "src/main/persistence/loading-store/profile-state-pty-retirement-finalization.test.ts": 3208,
+      "src/main/persistence/loading-store/profile-state-selective-serialization.test.ts": 216,
+      "src/main/persistence/loading-store/profile-state-settings-writes.test.ts": 1551,
+      "src/main/persistence/loading-store/profile-state-sqlite-authority.test.ts": 8170,
+      "src/main/persistence/loading-store/profile-state-store-backups.test.ts": 3107,
+      "src/main/persistence/loading-store/profile-state-temp-cleanup-lifetime.test.ts": 1081,
+      "src/main/persistence/loading-store/profile-state-update-quit.test.ts": 1347,
+      "src/main/persistence/loading-store/profile-state-worker-coordination.test.ts": 1583,
+      "src/main/persistence/loading-store/profile-state-worker-secret-retention.test.ts": 1293,
+      "src/main/persistence/loading-store/profile-state-write-batching.test.ts": 1364,
+      "src/main/persistence/loading-store/pty-binding-async-durability.test.ts": 1459,
+      "src/main/persistence/loading-store/pty-binding-created-surface-rollback.test.ts": 806,
+      "src/main/persistence/loading-store/pty-binding-fast-lane.test.ts": 168,
+      "src/main/persistence/loading-store/pty-binding-span.test.ts": 104,
+      "src/main/persistence/loading-store/pty-reattach-failure-routing.test.ts": 3450,
+      "src/main/persistence/loading-store/pty-retirement-async-durability.test.ts": 893,
+      "src/main/persistence/loading-store/pty-retirement-publication-during-read.test.ts": 2239,
+      "src/main/persistence/loading-store/pty-spawn-exit-durability.test.ts": 4488,
+      "src/main/persistence/loading-store/pty-spawn-handle-publication.test.ts": 3961,
+      "src/main/persistence/loading-store/pty-spawn-replacement-durability.test.ts": 4045,
+      "src/main/persistence/loading-store/pty-spawn-restore-durability.test.ts": 4185,
+      "src/main/persistence/loading-store/secret-sentinel-substitution.test.ts": 92,
+      "src/main/persistence/loading-store/ssh-lease-async-durability.test.ts": 914,
+      "src/main/persistence/loading-store/state-write-round-trip.test.ts": 1233,
+      "src/main/persistence/loading-store/store-prune-gate-signals.test.ts": 1151,
+      "src/main/persistence/loading-store/store-runtime-authored-session-writes.test.ts": 1062,
+      "src/main/persistence/loading-store/terminal-tab-pty-ownership.test.ts": 35,
+      "src/main/persistence/loading-store/workspace-session-partitions.test.ts": 252,
+      "src/main/persistence/loading-store/workspace-session-terminal-binding-replay.test.ts": 68,
+      "src/main/persistence/loading-store/worktree-meta-alias-projection.test.ts": 1809,
+      "src/main/persistence/loading-store/worktree-meta-write-normalization.test.ts": 68,
+      "src/main/persistence/profile-state-cutover-fixture.test.ts": 1259,
+      "src/main/persistence/profile-state-cutover-soak.test.ts": 1782,
+      "src/main/persistence/profile-state/legacy-json/profile-state-versioned-export.test.ts": 122,
+      "src/main/persistence/profile-state/profile-state-access-identity.test.ts": 125,
+      "src/main/persistence/profile-state/profile-state-access-process.test.ts": 706,
+      "src/main/persistence/profile-state/profile-state-access-windows-native.win32.test.ts": 50,
+      "src/main/persistence/profile-state/profile-state-access-windows.test.ts": 181,
+      "src/main/persistence/profile-state/profile-state-access.test.ts": 218,
+      "src/main/persistence/profile-state/profile-state-authority-bootstrap.test.ts": 2390,
+      "src/main/persistence/profile-state/profile-state-authority-export-fencing.test.ts": 187,
+      "src/main/persistence/profile-state/profile-state-automation-runs-equality.test.ts": 206,
+      "src/main/persistence/profile-state/profile-state-automation-runs-serialization.test.ts": 225,
+      "src/main/persistence/profile-state/profile-state-automation-storage-upgrade.test.ts": 2866,
+      "src/main/persistence/profile-state/profile-state-backup-path.test.ts": 40,
+      "src/main/persistence/profile-state/profile-state-backup-rotation.test.ts": 519,
+      "src/main/persistence/profile-state/profile-state-backup-temporary-files.test.ts": 76,
+      "src/main/persistence/profile-state/profile-state-backup-worker.test.ts": 2514,
+      "src/main/persistence/profile-state/profile-state-bootstrap-publication-race.test.ts": 1143,
+      "src/main/persistence/profile-state/profile-state-complete-domain-writes.test.ts": 324,
+      "src/main/persistence/profile-state/profile-state-crash-recovery.test.ts": 442,
+      "src/main/persistence/profile-state/profile-state-current-json-command.test.ts": 2724,
+      "src/main/persistence/profile-state/profile-state-current-sqlite-command.test.ts": 1546,
+      "src/main/persistence/profile-state/profile-state-database-export-crash.test.ts": 221,
+      "src/main/persistence/profile-state/profile-state-database-recovery.test.ts": 1228,
+      "src/main/persistence/profile-state/profile-state-database-rollback-export.test.ts": 1283,
+      "src/main/persistence/profile-state/profile-state-database-snapshot.test.ts": 1947,
+      "src/main/persistence/profile-state/profile-state-database.test.ts": 1004,
+      "src/main/persistence/profile-state/profile-state-documents.test.ts": 758,
+      "src/main/persistence/profile-state/profile-state-domain-equality.test.ts": 197,
+      "src/main/persistence/profile-state/profile-state-domain-reader.test.ts": 134,
+      "src/main/persistence/profile-state/profile-state-domain-writes.test.ts": 354,
+      "src/main/persistence/profile-state/profile-state-fragment-validation.test.ts": 978,
+      "src/main/persistence/profile-state/profile-state-json-compatibility-recovery.test.ts": 1250,
+      "src/main/persistence/profile-state/profile-state-large-recovery-crash.test.ts": 3070,
+      "src/main/persistence/profile-state/profile-state-live-store-factory.test.ts": 1747,
+      "src/main/persistence/profile-state/profile-state-offline-settings.test.ts": 286,
+      "src/main/persistence/profile-state/profile-state-parsed-snapshot.test.ts": 367,
+      "src/main/persistence/profile-state/profile-state-read-concurrency.test.ts": 112,
+      "src/main/persistence/profile-state/profile-state-recovery-batch.test.ts": 142,
+      "src/main/persistence/profile-state/profile-state-recovery-copy.test.ts": 92,
+      "src/main/persistence/profile-state/profile-state-recovery-crash-boundaries.test.ts": 34081,
+      "src/main/persistence/profile-state/profile-state-runtime-preflight.test.ts": 567,
+      "src/main/persistence/profile-state/profile-state-startup-authority.test.ts": 2198,
+      "src/main/persistence/profile-state/profile-state-startup-failure.test.ts": 1080,
+      "src/main/persistence/profile-state/profile-state-startup-recovery-dialog.test.ts": 95,
+      "src/main/persistence/profile-state/profile-state-startup-secrets.test.ts": 1403,
+      "src/main/persistence/profile-state/profile-state-startup-snapshot.test.ts": 1390,
+      "src/main/persistence/profile-state/profile-state-store-factory.test.ts": 2255,
+      "src/main/persistence/profile-state/profile-state-streaming-validation.test.ts": 246,
+      "src/main/persistence/profile-state/profile-state-worker-authority.test.ts": 1304,
+      "src/main/persistence/profile-state/profile-state-worker-export-failures.test.ts": 905,
+      "src/main/persistence/profile-state/profile-state-write-transaction.test.ts": 42,
+      "src/main/persistence/profile-state/profile-state-writer-protocol-faults.test.ts": 2015,
+      "src/main/persistence/profile-state/profile-state-writer-worker.test.ts": 1074,
+      "src/main/persistence/restoring-sessions/pane-alias-normalization-scaling.test.ts": 70,
+      "src/main/persistence/restoring-sessions/pane-alias-normalization.test.ts": 399,
+      "src/main/persistence/restoring-sessions/pane-key-remapping.test.ts": 26,
+      "src/main/persistence/restoring-sessions/session-owner-fields.test.ts": 141,
+      "src/main/persistence/restoring-sessions/session-worktree-ownership.test.ts": 205,
+      "src/main/persistence/restoring-sessions/terminal-layout-normalization.test.ts": 53,
+      "src/main/persistence/restoring-sessions/workspace-pane-normalization-index.test.ts": 69,
+      "src/main/persistence/runtime-authored-workspace-session-fields.test.ts": 51,
+      "src/main/persistence/scheduling-automations/automation-run-operations.test.ts": 62,
+      "src/main/persistence/tracking-repos/local-worktree-metadata-batch-pruning.bench.test.ts": 248,
+      "src/main/persistence/tracking-repos/local-worktree-metadata-scan-expectation.test.ts": 152,
+      "src/main/persistence/tracking-repos/missing-local-worktree-metadata-pruning.test.ts": 301,
+      "src/main/persistence/tracking-repos/probeable-local-worktree-metadata-candidates.test.ts": 218,
+      "src/main/persistence/tracking-repos/project-host-compatibility.test.ts": 36,
+      "src/main/persistence/tracking-repos/worktree-identity-migration-field-coverage.test.ts": 147,
+      "src/main/persistence/tracking-repos/worktree-metadata-normalization.test.ts": 182,
+      "src/main/pi/agent-status-completion-delivery.test.ts": 899,
+      "src/main/pi/agent-status-extension-async-subagents.test.ts": 1070,
+      "src/main/pi/agent-status-extension-nested-run-settlement.test.ts": 588,
+      "src/main/pi/agent-status-extension-omp-lifecycle.test.ts": 2513,
+      "src/main/pi/agent-status-extension-omp-model.test.ts": 1180,
+      "src/main/pi/agent-status-extension-omp-prefill.test.ts": 615,
+      "src/main/pi/agent-status-extension-source.test.ts": 2899,
+      "src/main/pi/agent-status-input-redaction.test.ts": 1930,
+      "src/main/pi/agent-status-omp-approval-forwarding.test.ts": 1049,
+      "src/main/pi/agent-status-owner-recovery.test.ts": 1135,
+      "src/main/pi/agent-status-ui-prompt.test.ts": 1344,
+      "src/main/pi/omp-model-command-source.test.ts": 619,
+      "src/main/pi/omp-session-status-owner.test.ts": 780,
+      "src/main/pi/omp-transcript-metadata.test.ts": 1593,
+      "src/main/pi/prefill-extension-source.test.ts": 36,
+      "src/main/pi/titlebar-extension-overlay-path.test.ts": 92,
+      "src/main/pi/titlebar-extension-service.test.ts": 524,
+      "src/main/pi/titlebar-extension-source.test.ts": 1416,
+      "src/main/plugins/plugin-agent-status-event.test.ts": 86,
+      "src/main/plugins/plugin-atomic-file-write.test.ts": 2056,
+      "src/main/plugins/plugin-audit-log-scaling.test.ts": 497,
+      "src/main/plugins/plugin-audit-log.test.ts": 73,
+      "src/main/plugins/plugin-bundled-bootstrap-coordinator.test.ts": 364,
+      "src/main/plugins/plugin-bundled-bootstrap.test.ts": 468,
+      "src/main/plugins/plugin-command-registry.test.ts": 271,
+      "src/main/plugins/plugin-content-pack-registry.test.ts": 303,
+      "src/main/plugins/plugin-content-safety.test.ts": 716,
+      "src/main/plugins/plugin-dev-watcher.test.ts": 165,
+      "src/main/plugins/plugin-discovery.test.ts": 193,
+      "src/main/plugins/plugin-enablement.test.ts": 194,
+      "src/main/plugins/plugin-host-conformance.test.ts": 202,
+      "src/main/plugins/plugin-host-methods.test.ts": 173,
+      "src/main/plugins/plugin-host-process.test.ts": 208,
+      "src/main/plugins/plugin-host-runtime.test.ts": 193,
+      "src/main/plugins/plugin-install-trust.test.ts": 378,
+      "src/main/plugins/plugin-install.test.ts": 787,
+      "src/main/plugins/plugin-kill-list-content-revocation.test.ts": 321,
+      "src/main/plugins/plugin-kill-list-service.test.ts": 239,
+      "src/main/plugins/plugin-language-pack-registry.test.ts": 179,
+      "src/main/plugins/plugin-launch-content.test.ts": 470,
+      "src/main/plugins/plugin-list-projection.test.ts": 145,
+      "src/main/plugins/plugin-marketplace-installer.test.ts": 480,
+      "src/main/plugins/plugin-marketplace-service.test.ts": 369,
+      "src/main/plugins/plugin-marketplace-store.test.ts": 135,
+      "src/main/plugins/plugin-panel-controller.test.ts": 210,
+      "src/main/plugins/plugin-panel-navigation-guard.test.ts": 140,
+      "src/main/plugins/plugin-panel-owner-lifecycle.test.ts": 54,
+      "src/main/plugins/plugin-panel-sessions.test.ts": 50,
+      "src/main/plugins/plugin-private-marketplace.integration.test.ts": 685,
+      "src/main/plugins/plugin-secrets-store.test.ts": 219,
+      "src/main/plugins/plugin-service-integrity.test.ts": 408,
+      "src/main/plugins/plugin-service-reconciliation.test.ts": 597,
+      "src/main/plugins/plugin-startup-budget.test.ts": 768,
+      "src/main/plugins/plugin-storage-store.test.ts": 198,
+      "src/main/plugins/plugin-uninstall-lifecycle.test.ts": 740,
+      "src/main/plugins/plugin-uninstall-log-retention.test.ts": 974,
+      "src/main/plugins/plugin-uninstall-ordering.test.ts": 967,
+      "src/main/plugins/plugin-vm-recipe-registry.test.ts": 236,
+      "src/main/plugins/plugin-worker-controller.test.ts": 393,
+      "src/main/plugins/plugin-worker-env.test.ts": 35,
+      "src/main/plugins/plugin-worker-manager.test.ts": 165,
+      "src/main/plugins/plugin-worker-output-buffer.test.ts": 54,
+      "src/main/plugins/plugin-worker-output-retention.test.ts": 229,
+      "src/main/plugins/plugin-worker-supervision.integration.test.ts": 8081,
+      "src/main/ports/advertised-url-retention.test.ts": 163,
+      "src/main/ports/advertised-url-watcher-pid-validation.test.ts": 53,
+      "src/main/ports/advertised-url-watcher.test.ts": 59,
+      "src/main/ports/local-workspace-port-scanner.test.ts": 119,
+      "src/main/ports/port-scan-command-client.test.ts": 1765,
+      "src/main/ports/port-scan-command-execution.test.ts": 5284,
+      "src/main/ports/port-scan-command-import-boundary.test.ts": 39,
+      "src/main/ports/ssh-advertised-url-enrichment.test.ts": 96,
+      "src/main/ports/workspace-port-ownership.test.ts": 36,
+      "src/main/powershell-osc133-bootstrap-windows-clm.test.ts": 84,
+      "src/main/powershell-osc133-bootstrap.test.ts": 81,
+      "src/main/project-groups/folder-workspace-path-status.test.ts": 72,
+      "src/main/project-groups/nested-repo-discovery-queue.test.ts": 201,
+      "src/main/project-groups/nested-repo-discovery.test.ts": 177,
+      "src/main/project-groups/nested-repo-glob-budget.test.ts": 841,
+      "src/main/project-groups/nested-repo-import-target.test.ts": 58,
+      "src/main/project-groups/nested-repo-import.test.ts": 58,
+      "src/main/project-groups/nested-repo-scan-rules.test.ts": 31,
+      "src/main/project-runtime-git-options.test.ts": 73,
+      "src/main/protected-secret-persistence-concurrency.test.ts": 68,
+      "src/main/protected-secret-persistence.test.ts": 50,
+      "src/main/providers/agent-foreground-process-batch.test.ts": 91,
+      "src/main/providers/agent-foreground-process-git-bash-launcher.test.ts": 87,
+      "src/main/providers/agent-foreground-process-git-bash.win32.test.ts": 196,
+      "src/main/providers/agent-foreground-process-pi.test.ts": 82,
+      "src/main/providers/agent-foreground-process-ps-scan-volume.test.ts": 105,
+      "src/main/providers/agent-foreground-process-real-rows.test.ts": 105,
+      "src/main/providers/agent-foreground-process-remote-evidence.test.ts": 81,
+      "src/main/providers/agent-foreground-process-shell-path.test.ts": 76,
+      "src/main/providers/agent-foreground-process-windows-job-rejection.test.ts": 48,
+      "src/main/providers/agent-foreground-process-wsl-shell-proof.test.ts": 108,
+      "src/main/providers/agent-foreground-process.test.ts": 149,
+      "src/main/providers/execution-host-provider-dispatch.test.ts": 33,
+      "src/main/providers/local-pty-bun-artifact.integration.test.ts": 50,
+      "src/main/providers/local-pty-bun-posix-inspection.test.ts": 238,
+      "src/main/providers/local-pty-bun-windows-identity.test.ts": 132,
+      "src/main/providers/local-pty-child-process-verdict.test.ts": 280,
+      "src/main/providers/local-pty-default-shell.test.ts": 124,
+      "src/main/providers/local-pty-foreground-inspection-cheap-tier.test.ts": 140,
+      "src/main/providers/local-pty-pending-native-spawn.test.ts": 281,
+      "src/main/providers/local-pty-pi-owner-env.test.ts": 108,
+      "src/main/providers/local-pty-provider-foreground-process.test.ts": 413,
+      "src/main/providers/local-pty-provider-io-events.test.ts": 295,
+      "src/main/providers/local-pty-provider-session-inventory.test.ts": 323,
+      "src/main/providers/local-pty-provider-shell-readiness.test.ts": 240,
+      "src/main/providers/local-pty-provider-shutdown.test.ts": 652,
+      "src/main/providers/local-pty-provider-spawn-cwd-safety.test.ts": 305,
+      "src/main/providers/local-pty-provider-spawn-env.test.ts": 308,
+      "src/main/providers/local-pty-provider-spawn-session.test.ts": 410,
+      "src/main/providers/local-pty-provider-windows-shell-launch.test.ts": 301,
+      "src/main/providers/local-pty-shell-ready-marker-scan.test.ts": 61,
+      "src/main/providers/local-pty-shell-ready-startup-command.test.ts": 66,
+      "src/main/providers/local-pty-shell-ready-wrapper-generation.test.ts": 544,
+      "src/main/providers/local-pty-shell-startup-command.node-pty.test.ts": 253,
+      "src/main/providers/local-pty-utils-windows-fallback.test.ts": 81,
+      "src/main/providers/local-pty-utils.test.ts": 81,
+      "src/main/providers/macos-login-session-pty-probe.test.ts": 42,
+      "src/main/providers/macos-tcc-login-shell.test.ts": 146,
+      "src/main/providers/posix-pane-foreground-fingerprint.test.ts": 42,
+      "src/main/providers/process-cwd.test.ts": 141,
+      "src/main/providers/provider-dispatch.test.ts": 1559,
+      "src/main/providers/pty-default-cwd.test.ts": 58,
+      "src/main/providers/pty-process-inspection.test.ts": 54,
+      "src/main/providers/pty-process-list-admission.test.ts": 108,
+      "src/main/providers/pty-repaint-wide-char-buffer.node-pty.test.ts": 1943,
+      "src/main/providers/settled-pty-writer-census.test.ts": 646,
+      "src/main/providers/ssh-filesystem-dispatch.test.ts": 41,
+      "src/main/providers/ssh-filesystem-doc-preview.test.ts": 61,
+      "src/main/providers/ssh-filesystem-download.test.ts": 183,
+      "src/main/providers/ssh-filesystem-provider-capabilities.test.ts": 74,
+      "src/main/providers/ssh-filesystem-provider-download-folder.test.ts": 79,
+      "src/main/providers/ssh-filesystem-provider-range.test.ts": 84,
+      "src/main/providers/ssh-filesystem-provider-stream.test.ts": 164,
+      "src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts": 617,
+      "src/main/providers/ssh-filesystem-provider.test.ts": 323,
+      "src/main/providers/ssh-filesystem-watch-notifications.test.ts": 53,
+      "src/main/providers/ssh-git-dispatch.test.ts": 55,
+      "src/main/providers/ssh-git-provider-api.test.ts": 54,
+      "src/main/providers/ssh-git-provider-commit-message.test.ts": 68,
+      "src/main/providers/ssh-git-provider-diff.test.ts": 141,
+      "src/main/providers/ssh-git-provider-exec.test.ts": 104,
+      "src/main/providers/ssh-git-provider-merge.test.ts": 95,
+      "src/main/providers/ssh-git-provider-remote-sync.test.ts": 99,
+      "src/main/providers/ssh-git-provider-staging.test.ts": 112,
+      "src/main/providers/ssh-git-provider-status-lease.test.ts": 79,
+      "src/main/providers/ssh-git-provider-status.test.ts": 106,
+      "src/main/providers/ssh-git-provider-upstream-lease.test.ts": 78,
+      "src/main/providers/ssh-git-provider-worktree.test.ts": 140,
+      "src/main/providers/ssh-git-worktree-list-dedupe.test.ts": 103,
+      "src/main/providers/ssh-pty-inspect-observation-identity.test.ts": 54,
+      "src/main/providers/ssh-pty-live-source-restore-respawn.test.ts": 207,
+      "src/main/providers/ssh-pty-notification-rejection-routing.test.ts": 196,
+      "src/main/providers/ssh-pty-notification-routing.test.ts": 92,
+      "src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts": 123,
+      "src/main/providers/ssh-pty-provider-claim-incarnation.test.ts": 109,
+      "src/main/providers/ssh-pty-provider-exit-race.test.ts": 200,
+      "src/main/providers/ssh-pty-provider-process-events.test.ts": 157,
+      "src/main/providers/ssh-pty-provider-reattach-incarnation.test.ts": 138,
+      "src/main/providers/ssh-pty-provider-spawn.test.ts": 124,
+      "src/main/providers/ssh-pty-provider-terminal-repair.test.ts": 213,
+      "src/main/providers/ssh-pty-provider.test.ts": 232,
+      "src/main/providers/ssh-pty-reattach-absence-discrimination.test.ts": 69,
+      "src/main/providers/ssh-pty-relay-absence-verdict.test.ts": 157,
+      "src/main/providers/ssh-pty-source-delivery-ledger.test.ts": 49,
+      "src/main/providers/ssh-pty-write.test.ts": 182,
+      "src/main/providers/ssh-worktree-catalog-authority.test.ts": 429,
+      "src/main/providers/stable-foreground-process.test.ts": 68,
+      "src/main/providers/terminal-path-existence-batch.integration.test.ts": 171,
+      "src/main/providers/windows-agent-foreground-process-scan-volume.test.ts": 70,
+      "src/main/providers/windows-cached-agent-revalidation.test.ts": 56,
+      "src/main/providers/windows-conpty-wide-char-duplication.node-pty.test.ts": 34,
+      "src/main/providers/windows-console-attached-processes.test.ts": 69,
+      "src/main/providers/windows-foreground-process-inspection-cost.test.ts": 88,
+      "src/main/providers/windows-foreground-process-rows.test.ts": 40,
+      "src/main/providers/windows-powershell-executable.test.ts": 67,
+      "src/main/providers/windows-powershell.test.ts": 53,
+      "src/main/providers/windows-pty-job-membership.test.ts": 95,
+      "src/main/providers/windows-shell-args.test.ts": 131,
+      "src/main/providers/windows-shell-fallback-chain.test.ts": 124,
+      "src/main/providers/windows-shell-preflight-runtime.windows.test.ts": 123,
+      "src/main/providers/working-directory-validation-retention.test.ts": 125,
+      "src/main/providers/working-directory-validation.test.ts": 111,
+      "src/main/provisioned-root-ssh-adoption.test.ts": 285,
+      "src/main/proxy-guarded-fetch-call-site-audit.test.ts": 266,
+      "src/main/pty-descendant-exit-verification.test.ts": 83,
+      "src/main/pty-descendant-termination-job-coverage.test.ts": 303,
+      "src/main/pty-descendant-termination.test.ts": 205,
+      "src/main/pty/appimage-terminal-env.test.ts": 42,
+      "src/main/pty/build-mode-env.test.ts": 42,
+      "src/main/pty/codex-home-wsl-env.test.ts": 33,
+      "src/main/pty/codex-preflight-profile-path-rewrite.test.ts": 168,
+      "src/main/pty/codex-shell-launch-preflight.test.ts": 2210,
+      "src/main/pty/conda-activation-env.test.ts": 36,
+      "src/main/pty/legacy-terminal-shim-dir.test.ts": 444,
+      "src/main/pty/legacy-terminal-windows-tombstone.test.ts": 59,
+      "src/main/pty/node-pty-master-fd-retirement.test.ts": 5222,
+      "src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts": 42,
+      "src/main/pty/omp-sqlite-overlay.test.ts": 43,
+      "src/main/pty/overlay-mirror.test.ts": 41,
+      "src/main/pty/pi-process-owner-env.test.ts": 929,
+      "src/main/pty/posix-pty-foreground-group.test.ts": 60,
+      "src/main/pty/posix-pty-process-groups.integration.test.ts": 123,
+      "src/main/pty/posix-pty-process-groups.test.ts": 78,
+      "src/main/pty/shell-startup-env.test.ts": 116,
+      "src/main/pty/terminal-color-env.test.ts": 49,
+      "src/main/pty/windows-environment-path-main-loop.test.ts": 414,
+      "src/main/pty/windows-environment-path.test.ts": 72,
+      "src/main/pty/windows-path-registry-change.test.ts": 37,
+      "src/main/pty/windows-path-registry-fallback.test.ts": 66,
+      "src/main/pty/windows-path-registry-reader.test.ts": 61,
+      "src/main/pty/wsl-orca-env.test.ts": 85,
+      "src/main/pwsh.test.ts": 74,
+      "src/main/quit-path-durable-write-blocking.test.ts": 2121,
+      "src/main/quit-teardown-agent-browser-daemons.test.ts": 27,
+      "src/main/quit-teardown-deadline.test.ts": 52,
+      "src/main/quit-teardown-start-gate.test.ts": 45,
+      "src/main/rate-limits/account-runtime-target-sync.test.ts": 205,
+      "src/main/rate-limits/antigravity-usage-mirror.test.ts": 38,
+      "src/main/rate-limits/auth-filesystem-operation-retention.test.ts": 132,
+      "src/main/rate-limits/auth-filesystem-operation.test.ts": 56,
+      "src/main/rate-limits/claude-fetcher-cli-fallback.test.ts": 183,
+      "src/main/rate-limits/claude-fetcher-fable-usage.test.ts": 251,
+      "src/main/rate-limits/claude-fetcher-keychain-credentials.test.ts": 273,
+      "src/main/rate-limits/claude-fetcher-managed-account-usage.test.ts": 167,
+      "src/main/rate-limits/claude-oauth-usage-error.test.ts": 102,
+      "src/main/rate-limits/claude-pty.test.ts": 178,
+      "src/main/rate-limits/claude-usage-error-classification.test.ts": 70,
+      "src/main/rate-limits/claude-usage-refresh-plan.test.ts": 33,
+      "src/main/rate-limits/codex-auth-presence.test.ts": 45,
+      "src/main/rate-limits/codex-fetcher-auth-errors.test.ts": 152,
+      "src/main/rate-limits/codex-fetcher-backend.test.ts": 251,
+      "src/main/rate-limits/codex-fetcher-probe-shutdown.test.ts": 223,
+      "src/main/rate-limits/codex-fetcher-process-contract.test.ts": 190,
+      "src/main/rate-limits/codex-fetcher-pty-settle.test.ts": 271,
+      "src/main/rate-limits/codex-fetcher-rpc-exit-diagnostics.test.ts": 465,
+      "src/main/rate-limits/codex-fetcher-runtime-pairing.test.ts": 108,
+      "src/main/rate-limits/codex-fetcher-session-supplement.test.ts": 186,
+      "src/main/rate-limits/codex-fetcher.test.ts": 339,
+      "src/main/rate-limits/codex-probe-termination.test.ts": 63,
+      "src/main/rate-limits/codex-pty-rate-limit-probe.test.ts": 70,
+      "src/main/rate-limits/codex-pty-status-parser.test.ts": 47,
+      "src/main/rate-limits/codex-rate-limit-window-classification.test.ts": 26,
+      "src/main/rate-limits/codex-rpc-rate-limit-probe.test.ts": 109,
+      "src/main/rate-limits/cursor-auth.test.ts": 133,
+      "src/main/rate-limits/cursor-fetcher.test.ts": 173,
+      "src/main/rate-limits/cursor-session-token.test.ts": 71,
+      "src/main/rate-limits/cursor-usage-mapping.test.ts": 97,
+      "src/main/rate-limits/gemini-bucket-formatting.test.ts": 37,
+      "src/main/rate-limits/gemini-usage-fetcher.fallback.test.ts": 113,
+      "src/main/rate-limits/gemini-usage-fetcher.test.ts": 100,
+      "src/main/rate-limits/grok-auth.test.ts": 101,
+      "src/main/rate-limits/grok-fetcher.test.ts": 152,
+      "src/main/rate-limits/hidden-pty-cleanup.test.ts": 53,
+      "src/main/rate-limits/initial-account-rate-limit-target.test.ts": 233,
+      "src/main/rate-limits/kimi-fetcher-wsl-home.test.ts": 92,
+      "src/main/rate-limits/kimi-fetcher.test.ts": 129,
+      "src/main/rate-limits/minimax/minimax-fetcher.test.ts": 109,
+      "src/main/rate-limits/minimax/minimax-request-context.test.ts": 89,
+      "src/main/rate-limits/opencode-go-api-key-source.test.ts": 73,
+      "src/main/rate-limits/opencode-go-status-parsing.test.ts": 63,
+      "src/main/rate-limits/opencode-go-usage-api.test.ts": 109,
+      "src/main/rate-limits/opencode-go-usage-fetcher.test.ts": 79,
+      "src/main/rate-limits/opencode-go-usage-source-selection.test.ts": 104,
+      "src/main/rate-limits/service-account-target-selection.test.ts": 780,
+      "src/main/rate-limits/service-antigravity-usage.test.ts": 123,
+      "src/main/rate-limits/service-cursor-usage.test.ts": 229,
+      "src/main/rate-limits/service-inactive-account-previews.test.ts": 187,
+      "src/main/rate-limits/service-live-claude-usage.test.ts": 173,
+      "src/main/rate-limits/service-minimax-usage.test.ts": 91,
+      "src/main/rate-limits/service-refresh-orchestration.test.ts": 243,
+      "src/main/rate-limits/service-window-activation.test.ts": 321,
+      "src/main/refused-tree-kill-root-termination.test.ts": 2628,
+      "src/main/remote-agent-trust-presets.test.ts": 166,
+      "src/main/remote-worktree-history-cleanup.test.ts": 59,
+      "src/main/repo-git-remote-avatar-refresh.test.ts": 108,
+      "src/main/repo-git-remote-identity-enrichment.test.ts": 91,
+      "src/main/repo-git-remote-identity.test.ts": 71,
+      "src/main/repo-git-username-enrichment.test.ts": 43,
+      "src/main/repo-icon-autodetect.test.ts": 606,
+      "src/main/repo-icon-file-detection.test.ts": 92,
+      "src/main/repo-icon-source-href.test.ts": 109,
+      "src/main/repo-maintenance-idle-gate.test.ts": 53,
+      "src/main/repo-worktrees.test.ts": 104,
+      "src/main/ripgrep/bare-ripgrep-spawn-boundary.test.ts": 1021,
+      "src/main/ripgrep/bundled-ripgrep-path.test.ts": 104,
+      "src/main/ripgrep/bundled-ripgrep-real.test.ts": 150,
+      "src/main/ripgrep/bundled-ripgrep-spawn.test.ts": 67,
+      "src/main/ripgrep/fd-exhausted-spawn.test.ts": 68,
+      "src/main/ripgrep/synchronous-spawn-failure.test.ts": 63,
+      "src/main/ripgrep/wsl-missing-cwd-exit.test.ts": 92,
+      "src/main/runtime/acknowledged-terminal-tab-retirement.test.ts": 3317,
+      "src/main/runtime/agent-prompt-line-settle.test.ts": 2927,
+      "src/main/runtime/agent-prompt-receipt-correlation.test.ts": 3413,
+      "src/main/runtime/agent-prompt-request-correlation.test.ts": 46,
+      "src/main/runtime/agent-prompt-submission-runtime-hook-and-generation.test.ts": 3872,
+      "src/main/runtime/agent-prompt-submission-runtime.test.ts": 4515,
+      "src/main/runtime/agent-prompt-submission-verification.test.ts": 193,
+      "src/main/runtime/agent-prompt-submission-windows-submit-delay.test.ts": 2931,
+      "src/main/runtime/agent-session-backup-recovery.test.ts": 422,
+      "src/main/runtime/agent-session-claim-identity.test.ts": 71,
+      "src/main/runtime/agent-session-conversation-name-store.test.ts": 302,
+      "src/main/runtime/agent-session-launch-env-admission.test.ts": 253,
+      "src/main/runtime/agent-session-launch-env-backfill.test.ts": 264,
+      "src/main/runtime/agent-session-lease-renewal.test.ts": 242,
+      "src/main/runtime/agent-session-operation-admission.test.ts": 165,
+      "src/main/runtime/agent-session-process-identity-probe-windows-batch.test.ts": 47,
+      "src/main/runtime/agent-session-process-identity-probe.test.ts": 78,
+      "src/main/runtime/agent-session-provider-handle-transition.test.ts": 104,
+      "src/main/runtime/agent-session-record-conversation-name.test.ts": 164,
+      "src/main/runtime/agent-session-record-options.test.ts": 203,
+      "src/main/runtime/agent-session-record-store-legacy-handoff-lease.test.ts": 303,
+      "src/main/runtime/agent-session-record-store-security.test.ts": 156,
+      "src/main/runtime/agent-session-record-store-tab-table.test.ts": 420,
+      "src/main/runtime/agent-session-record-store.test.ts": 4639,
+      "src/main/runtime/agent-session-record-unsupported-schema.test.ts": 255,
+      "src/main/runtime/agent-session-recovery-capsule.test.ts": 642,
+      "src/main/runtime/agent-session-recovery-publish-fault.test.ts": 252,
+      "src/main/runtime/agent-session-released-reservation-replay.test.ts": 351,
+      "src/main/runtime/agent-session-reservation-admission.test.ts": 150,
+      "src/main/runtime/agent-session-spawn-token-process-scan.test.ts": 54,
+      "src/main/runtime/agent-session-spawn-token-readback.test.ts": 52,
+      "src/main/runtime/agent-session-surface-release-transition.test.ts": 167,
+      "src/main/runtime/agent-session-unreadable-record-salvage.test.ts": 310,
+      "src/main/runtime/agent-session-unsaved-creation-supersession.test.ts": 363,
+      "src/main/runtime/agent-startup-input-assembly-census.test.ts": 41,
+      "src/main/runtime/agent-terminal-launch-trust-host.test.ts": 3780,
+      "src/main/runtime/agent-terminal-startup-prompt.test.ts": 2169,
+      "src/main/runtime/antigravity-readiness-transcripts.test.ts": 6110,
+      "src/main/runtime/antigravity-terminal-readiness.test.ts": 78,
+      "src/main/runtime/automation-change-publication.test.ts": 8897,
+      "src/main/runtime/browser-client-download-transfers.test.ts": 201,
+      "src/main/runtime/browser-dialog-settlement.test.ts": 359,
+      "src/main/runtime/browser-execution-host-key-resolution.test.ts": 1993,
+      "src/main/runtime/browser-host-capability-selection.test.ts": 172,
+      "src/main/runtime/browser-host-client-page-adoption-grants.test.ts": 46,
+      "src/main/runtime/browser-host-client-page-adoption.test.ts": 36,
+      "src/main/runtime/browser-host-client-page-creation.test.ts": 133,
+      "src/main/runtime/browser-host-command-ledger-capacity.test.ts": 157,
+      "src/main/runtime/browser-host-command-ledger.test.ts": 138,
+      "src/main/runtime/browser-host-file-channel-admission.test.ts": 154,
+      "src/main/runtime/browser-host-lease-download-transfer-cleanup.test.ts": 319,
+      "src/main/runtime/browser-host-lease-fenced-page-release.test.ts": 206,
+      "src/main/runtime/browser-host-lease-placement-retirement.test.ts": 189,
+      "src/main/runtime/browser-host-lease-registry.test.ts": 243,
+      "src/main/runtime/browser-host-page-placement-replacement.test.ts": 169,
+      "src/main/runtime/browser-host-page-placement.test.ts": 156,
+      "src/main/runtime/browser-host-page-reconciliation-executor.test.ts": 64,
+      "src/main/runtime/browser-host-page-reconciliation-orchestration.test.ts": 369,
+      "src/main/runtime/browser-host-page-reconciliation-plan.test.ts": 74,
+      "src/main/runtime/browser-host-page-reconciliation-preconditions.test.ts": 166,
+      "src/main/runtime/browser-host-page-retirement.test.ts": 32,
+      "src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts": 2930,
+      "src/main/runtime/browser-screencast-driver-attribution.test.ts": 4314,
+      "src/main/runtime/browser-screencast-driver-scope.test.ts": 38,
+      "src/main/runtime/browser-screencast-ghost-subscriber-eviction.test.ts": 59,
+      "src/main/runtime/browser-screencast-remote-viewer-retention.test.ts": 3782,
+      "src/main/runtime/browser-session-tab-selection-snapshot.test.ts": 57,
+      "src/main/runtime/browser-tab-create-caller-navigation.test.ts": 3696,
+      "src/main/runtime/browser-tab-create-publication.test.ts": 775,
+      "src/main/runtime/claude-agent-teams-pty-exit-leak.test.ts": 3509,
+      "src/main/runtime/claude-agent-teams-service.test.ts": 86,
+      "src/main/runtime/claude-agent-teams-shim-env.test.ts": 102,
+      "src/main/runtime/claude-structured-failed-start-resume.test.ts": 1167,
+      "src/main/runtime/claude-structured-resumed-start-failure.test.ts": 1250,
+      "src/main/runtime/claude-structured-send-held-for-startup.test.ts": 1153,
+      "src/main/runtime/claude-structured-send-restart-dies-before-dispatch.test.ts": 1691,
+      "src/main/runtime/claude-structured-session-integration.test.ts": 4718,
+      "src/main/runtime/claude-structured-startup-unanswered-control-request.test.ts": 1435,
+      "src/main/runtime/cli-terminal-create-host-session-binding.test.ts": 1988,
+      "src/main/runtime/client-hosted-browser-page-persistence.integration.test.ts": 3289,
+      "src/main/runtime/client-hosted-browser-page-persistence.test.ts": 233,
+      "src/main/runtime/client-hosted-browser-row-hydration-census.test.ts": 485,
+      "src/main/runtime/client-hosted-browser-row-projection.test.ts": 57,
+      "src/main/runtime/client-hosted-browser-row-publication.test.ts": 59,
+      "src/main/runtime/client-hosted-browser-row-push.integration.test.ts": 2544,
+      "src/main/runtime/client-hosted-page-reconciliation-hold.integration.test.ts": 3363,
+      "src/main/runtime/client-hosted-page-reconciliation-window.test.ts": 57,
+      "src/main/runtime/client-session-tab-selection.test.ts": 57,
+      "src/main/runtime/decorative-title-fact-emission.test.ts": 33,
+      "src/main/runtime/exit-provenance-audit.test.ts": 3844,
+      "src/main/runtime/expired-ssh-lease-pane-candidacy.test.ts": 2958,
+      "src/main/runtime/external-worktree-paired-client-discovery.integration.test.ts": 4448,
+      "src/main/runtime/fetch-remote-cache.test.ts": 3566,
+      "src/main/runtime/file-watcher-host.test.ts": 816,
+      "src/main/runtime/fit-override-integration.test.ts": 3341,
+      "src/main/runtime/folder-workspace-pty-identity.test.ts": 2999,
+      "src/main/runtime/graph-sync-deletion-fence.test.ts": 3314,
+      "src/main/runtime/graph-sync-live-daemon-pty-tab-preservation.test.ts": 3308,
+      "src/main/runtime/graph-sync-mobile-snapshot-gating.test.ts": 9743,
+      "src/main/runtime/graph-sync-payload-partition.test.ts": 2285,
+      "src/main/runtime/headless-close-keeps-publication-epoch.test.ts": 2149,
+      "src/main/runtime/headless-hydration-ownership.test.ts": 4098,
+      "src/main/runtime/headless-placeholder-graph-surface-standing.test.ts": 2838,
+      "src/main/runtime/headless-seed-ownership.test.ts": 4790,
+      "src/main/runtime/headless-tab-group-split-layout.test.ts": 55,
+      "src/main/runtime/headless-tab-order-stability.test.ts": 2511,
+      "src/main/runtime/headless-terminal-dispose-write-ordering.test.ts": 3202,
+      "src/main/runtime/headless-terminal-query-reply-policy.test.ts": 49,
+      "src/main/runtime/headless-terminal-split-layout.test.ts": 34,
+      "src/main/runtime/hidden-output-restored-provider-snapshot.test.ts": 3364,
+      "src/main/runtime/host-terminal-close-persistence-durability.test.ts": 838,
+      "src/main/runtime/leaf-pty-verdict-expiry.test.ts": 3418,
+      "src/main/runtime/linear-save-issue.test.ts": 3157,
+      "src/main/runtime/managed-worktree-create-execution-host.test.ts": 2508,
+      "src/main/runtime/missing-worktree-terminal-reconciliation.test.ts": 197,
+      "src/main/runtime/mobile-agent-status-permission-renewal.test.ts": 3290,
+      "src/main/runtime/mobile-notification-dismissal-read-failure.test.ts": 78,
+      "src/main/runtime/mobile-notification-dismissal-store.test.ts": 73,
+      "src/main/runtime/mobile-notification-replay.test.ts": 77,
+      "src/main/runtime/mobile-pairing-qr.test.ts": 973,
+      "src/main/runtime/mobile-pairing-userdata-path.test.ts": 2117,
+      "src/main/runtime/mobile-presence-lock.test.ts": 15604,
+      "src/main/runtime/mobile-rpc-allowlist.test.ts": 1726,
+      "src/main/runtime/mobile-session-tab-close-refusal-message.test.ts": 54,
+      "src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts": 44,
+      "src/main/runtime/mobile-session-tabs-churn-coalescing.test.ts": 2760,
+      "src/main/runtime/mobile-session-tabs-notify-coalescer.test.ts": 35,
+      "src/main/runtime/mobile-session-terminal-persistence-retirement.test.ts": 179,
+      "src/main/runtime/mobile-session-terminal-retirement-proof.test.ts": 37,
+      "src/main/runtime/mobile-session-terminal-retirement.test.ts": 153,
+      "src/main/runtime/mobile-subscribe-integration.test.ts": 18419,
+      "src/main/runtime/multi-client-navigation-isolation.integration.test.ts": 4776,
+      "src/main/runtime/muse-readiness-transcript.test.ts": 6923,
+      "src/main/runtime/opencode-finished-session-authority.test.ts": 3824,
+      "src/main/runtime/orca-runtime-agent-session-operation.test.ts": 2429,
+      "src/main/runtime/orca-runtime-agent-skill-share.test.ts": 2486,
+      "src/main/runtime/orca-runtime-automations.test.ts": 3439,
+      "src/main/runtime/orca-runtime-browser-client-hosted.test.ts": 425,
+      "src/main/runtime/orca-runtime-browser-ghost-session-row-close.test.ts": 373,
+      "src/main/runtime/orca-runtime-browser-headless.test.ts": 784,
+      "src/main/runtime/orca-runtime-browser-screencast-fanout.test.ts": 429,
+      "src/main/runtime/orca-runtime-browser.test.ts": 747,
+      "src/main/runtime/orca-runtime-create-base-prefetch.test.ts": 3300,
+      "src/main/runtime/orca-runtime-emulator-folder-workspace.test.ts": 2993,
+      "src/main/runtime/orca-runtime-exact-worker-provider-session.test.ts": 2563,
+      "src/main/runtime/orca-runtime-files-mobile-explorer-reads.test.ts": 439,
+      "src/main/runtime/orca-runtime-files-preview-budget.test.ts": 346,
+      "src/main/runtime/orca-runtime-files-rename-authority.test.ts": 469,
+      "src/main/runtime/orca-runtime-files-search.test.ts": 325,
+      "src/main/runtime/orca-runtime-files-ssh-chunk-reads.test.ts": 436,
+      "src/main/runtime/orca-runtime-files-ssh-rearm.test.ts": 273,
+      "src/main/runtime/orca-runtime-files-terminal-artifact-grants.test.ts": 400,
+      "src/main/runtime/orca-runtime-files-terminal-artifact-io.test.ts": 554,
+      "src/main/runtime/orca-runtime-files-terminal-artifact-swap-detection.test.ts": 501,
+      "src/main/runtime/orca-runtime-files-terminal-link-host-translation.test.ts": 547,
+      "src/main/runtime/orca-runtime-files-terminal-path-resolution.test.ts": 362,
+      "src/main/runtime/orca-runtime-files-watch-host-scope.test.ts": 484,
+      "src/main/runtime/orca-runtime-files-watch.test.ts": 517,
+      "src/main/runtime/orca-runtime-git-branch-diff.test.ts": 732,
+      "src/main/runtime/orca-runtime-git-diff-budget.test.ts": 871,
+      "src/main/runtime/orca-runtime-git.test.ts": 464,
+      "src/main/runtime/orca-runtime-headless-hydration-repo-gate.test.ts": 3261,
+      "src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts": 2257,
+      "src/main/runtime/orca-runtime-linked-issue-live-meta.integration.test.ts": 2750,
+      "src/main/runtime/orca-runtime-mobile-agent-status-title-truthfulness.test.ts": 3103,
+      "src/main/runtime/orca-runtime-mobile-close-preserved-resurrection.test.ts": 3435,
+      "src/main/runtime/orca-runtime-module-size.test.ts": 31,
+      "src/main/runtime/orca-runtime-path-candidate-history.test.ts": 50,
+      "src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts": 1851,
+      "src/main/runtime/orca-runtime-provider-reattach-launch-identity.test.ts": 3259,
+      "src/main/runtime/orca-runtime-skill-recovery.test.ts": 2176,
+      "src/main/runtime/orca-runtime-structured-agent-session-create-intent.test.ts": 2913,
+      "src/main/runtime/orca-runtime-structured-claude-account-gate.test.ts": 2897,
+      "src/main/runtime/orca-runtime-structured-claude-gate-wiring.test.ts": 2908,
+      "src/main/runtime/orca-runtime-structured-native-chat-settings.test.ts": 2429,
+      "src/main/runtime/orca-runtime-structured-session-restore.test.ts": 3480,
+      "src/main/runtime/orca-runtime-structured-status-sink-wiring.test.ts": 2007,
+      "src/main/runtime/orca-runtime-tab-id-collision.test.ts": 3392,
+      "src/main/runtime/orca-runtime-tail-wait-memo.test.ts": 2831,
+      "src/main/runtime/orca-runtime-terminal-close-continuity.test.ts": 2299,
+      "src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts": 3332,
+      "src/main/runtime/orca-runtime-terminal-cwd.test.ts": 3470,
+      "src/main/runtime/orca-runtime-terminal-handle-incarnation.test.ts": 2155,
+      "src/main/runtime/orca-runtime-terminal-rename-retention.test.ts": 2085,
+      "src/main/runtime/orca-runtime-terminal-retirement-host-partition.test.ts": 3504,
+      "src/main/runtime/orca-runtime-terminal-retirement.test.ts": 3035,
+      "src/main/runtime/orca-runtime-terminal-split-authority.test.ts": 4293,
+      "src/main/runtime/orca-runtime-test-fragment-coverage.test.ts": 54,
+      "src/main/runtime/orca-runtime-worktree-change-invalidation.test.ts": 3002,
+      "src/main/runtime/orca-runtime.test.ts": 20016,
+      "src/main/runtime/orchestration-cli-subprocess.test.ts": 4022,
+      "src/main/runtime/orchestration-codex-completion-title.test.ts": 4864,
+      "src/main/runtime/orchestration-codex-real-pty.integration.test.ts": 3073,
+      "src/main/runtime/orchestration-compatibility-authority.test.ts": 3514,
+      "src/main/runtime/orchestration-dispatch-mailbox-delivery.test.ts": 4228,
+      "src/main/runtime/orchestration-mailbox-cold-park-idle.test.ts": 4102,
+      "src/main/runtime/orchestration-mailbox-crash-recovery.test.ts": 3847,
+      "src/main/runtime/orchestration-mailbox-detached-routing.test.ts": 3792,
+      "src/main/runtime/orchestration-mailbox-filtered-waiters.test.ts": 2765,
+      "src/main/runtime/orchestration-mailbox-notification-consistency.test.ts": 15860,
+      "src/main/runtime/orchestration-mailbox-pointer-cli-command.test.ts": 3401,
+      "src/main/runtime/orchestration-mailbox-routing-races.test.ts": 4303,
+      "src/main/runtime/orchestration-mailbox-transport-settlement.test.ts": 3583,
+      "src/main/runtime/orchestration-message-delivery-identity.test.ts": 4561,
+      "src/main/runtime/orchestration-messages-fake-parity.test.ts": 237,
+      "src/main/runtime/orchestration-worker-workspace-resolution.test.ts": 3441,
+      "src/main/runtime/orchestration/cli-command.test.ts": 45,
+      "src/main/runtime/orchestration/coordinator-decision-gates.test.ts": 435,
+      "src/main/runtime/orchestration/coordinator-dispatch-unobserved-prompt.test.ts": 419,
+      "src/main/runtime/orchestration/coordinator-drift-probe-coalescing.test.ts": 503,
+      "src/main/runtime/orchestration/coordinator-escalation-triage.test.ts": 388,
+      "src/main/runtime/orchestration/coordinator-stale-base-flag.test.ts": 31,
+      "src/main/runtime/orchestration/coordinator-terminal-census-unavailable.test.ts": 245,
+      "src/main/runtime/orchestration/coordinator.test.ts": 3812,
+      "src/main/runtime/orchestration/db-empty-dispatch-shortcircuit.benchmark.test.ts": 355,
+      "src/main/runtime/orchestration/db-heartbeat-straggler-guard.test.ts": 433,
+      "src/main/runtime/orchestration/db-message-timestamp.test.ts": 322,
+      "src/main/runtime/orchestration/db-messages.test.ts": 277,
+      "src/main/runtime/orchestration/db-stopping-worker-task-guard.test.ts": 391,
+      "src/main/runtime/orchestration/db-task-create-readiness.test.ts": 412,
+      "src/main/runtime/orchestration/db-task-dispatch-invariant.test.ts": 954,
+      "src/main/runtime/orchestration/db-task-dispatch-lifecycle-guards.test.ts": 948,
+      "src/main/runtime/orchestration/db-task-dispatch-races.test.ts": 595,
+      "src/main/runtime/orchestration/db-undelivered-mailboxes.test.ts": 291,
+      "src/main/runtime/orchestration/db.test.ts": 1046,
+      "src/main/runtime/orchestration/db/attempt-outcome-projection.test.ts": 489,
+      "src/main/runtime/orchestration/db/decision-gate-lifecycle.test.ts": 216,
+      "src/main/runtime/orchestration/db/dispatch-context/dispatch-capability.test.ts": 405,
+      "src/main/runtime/orchestration/db/dispatch-depth.test.ts": 608,
+      "src/main/runtime/orchestration/db/dispatch-mailbox-consumer-fencing.test.ts": 367,
+      "src/main/runtime/orchestration/db/dispatch-row-writer-boundary.test.ts": 592,
+      "src/main/runtime/orchestration/db/federated-worker-report-outcome.test.ts": 45,
+      "src/main/runtime/orchestration/db/federation/federated-dispatch-observation-fence.test.ts": 275,
+      "src/main/runtime/orchestration/db/federation/remote-dispatch-attachment-release.test.ts": 382,
+      "src/main/runtime/orchestration/db/hot-path-statement-compilation.test.ts": 425,
+      "src/main/runtime/orchestration/db/legacy-question-identity.test.ts": 43,
+      "src/main/runtime/orchestration/db/lifecycle-rejection-marker.test.ts": 27,
+      "src/main/runtime/orchestration/db/lifecycle-transition-boundary.test.ts": 47,
+      "src/main/runtime/orchestration/db/lifecycle-transition.test.ts": 355,
+      "src/main/runtime/orchestration/db/messages/mailbox-consumer-lifecycle-fencing.test.ts": 732,
+      "src/main/runtime/orchestration/db/pane-key-match.test.ts": 33,
+      "src/main/runtime/orchestration/db/row-column-lists.test.ts": 397,
+      "src/main/runtime/orchestration/db/run-list-cursor.test.ts": 30,
+      "src/main/runtime/orchestration/db/runs/run-coordinator-orca-session-binding.test.ts": 408,
+      "src/main/runtime/orchestration/db/schema/derived-delivery-migration.test.ts": 669,
+      "src/main/runtime/orchestration/db/schema/federated-home-run-migration.test.ts": 348,
+      "src/main/runtime/orchestration/db/schema/structured-pointer-schema-migration.test.ts": 440,
+      "src/main/runtime/orchestration/db/schema/structured-worker-orca-session-backfill.test.ts": 361,
+      "src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-assignee-orca-session.test.ts": 261,
+      "src/main/runtime/orchestration/db/writer-run-required.test.ts": 365,
+      "src/main/runtime/orchestration/dispatch-consumer-generation-migration.test.ts": 498,
+      "src/main/runtime/orchestration/dispatch-creator-identity-migration.test.ts": 480,
+      "src/main/runtime/orchestration/dispatch-failure-idempotency.test.ts": 434,
+      "src/main/runtime/orchestration/federation-ack-checkpoints.test.ts": 33,
+      "src/main/runtime/orchestration/federation-acknowledgment-integrity.test.ts": 277,
+      "src/main/runtime/orchestration/federation-acknowledgment-migration.test.ts": 373,
+      "src/main/runtime/orchestration/federation-lifecycle-settlement.test.ts": 23,
+      "src/main/runtime/orchestration/federation-sync.test.ts": 2820,
+      "src/main/runtime/orchestration/federation-terminal-recovery.test.ts": 3474,
+      "src/main/runtime/orchestration/formatter.test.ts": 61,
+      "src/main/runtime/orchestration/groups.test.ts": 42,
+      "src/main/runtime/orchestration/lifecycle-caller-edges.test.ts": 352,
+      "src/main/runtime/orchestration/lifecycle-reconciliation.test.ts": 786,
+      "src/main/runtime/orchestration/lightweight-run-worker-exit-escalation.test.ts": 3611,
+      "src/main/runtime/orchestration/mailbox-pointer-eligibility.test.ts": 343,
+      "src/main/runtime/orchestration/mailbox-pointer-release-query.test.ts": 339,
+      "src/main/runtime/orchestration/mailbox-pointer-stage.test.ts": 504,
+      "src/main/runtime/orchestration/mailbox-pointer-submit.test.ts": 696,
+      "src/main/runtime/orchestration/message-batch-atomicity.test.ts": 395,
+      "src/main/runtime/orchestration/mutation-receipt-capacity.test.ts": 400,
+      "src/main/runtime/orchestration/nested-worker-depth-migration.test.ts": 579,
+      "src/main/runtime/orchestration/orchestration-adopted-run-binding.test.ts": 1024,
+      "src/main/runtime/orchestration/orchestration-all-start-versions-migration.test.ts": 1741,
+      "src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts": 1165,
+      "src/main/runtime/orchestration/orchestration-db-permissions.test.ts": 240,
+      "src/main/runtime/orchestration/orchestration-db-retention-pagination.test.ts": 706,
+      "src/main/runtime/orchestration/orchestration-delivery-consumption.test.ts": 464,
+      "src/main/runtime/orchestration/orchestration-derived-delivery.test.ts": 327,
+      "src/main/runtime/orchestration/orchestration-federated-legacy-probe.test.ts": 500,
+      "src/main/runtime/orchestration/orchestration-legacy-coordinator-authority-db.test.ts": 712,
+      "src/main/runtime/orchestration/orchestration-legacy-question-migration-db.test.ts": 751,
+      "src/main/runtime/orchestration/orchestration-legacy-storage-db.test.ts": 1661,
+      "src/main/runtime/orchestration/orchestration-legacy-worker-terminal-recovery.test.ts": 192,
+      "src/main/runtime/orchestration/orchestration-mutation-question-db.test.ts": 289,
+      "src/main/runtime/orchestration/orchestration-orca-session-column-migration.test.ts": 641,
+      "src/main/runtime/orchestration/orchestration-peer-capability-cache.test.ts": 74,
+      "src/main/runtime/orchestration/orchestration-reset-db.test.ts": 323,
+      "src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts": 532,
+      "src/main/runtime/orchestration/orchestration-run-list-compatibility.test.ts": 364,
+      "src/main/runtime/orchestration/orchestration-version-skew-migration.test.ts": 1040,
+      "src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts": 712,
+      "src/main/runtime/orchestration/preamble.test.ts": 144,
+      "src/main/runtime/orchestration/r1-identity-migration.test.ts": 407,
+      "src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts": 520,
+      "src/main/runtime/orchestration/run-coordinator-orca-session-address.test.ts": 557,
+      "src/main/runtime/orchestration/settled-question-threads-migration.test.ts": 297,
+      "src/main/runtime/orchestration/setup-completion-signal.test.ts": 28,
+      "src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts": 431,
+      "src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts": 224,
+      "src/main/runtime/orchestration/structured-pointer-operation-id.test.ts": 84,
+      "src/main/runtime/orchestration/structured-session-pointer-delivery.test.ts": 73,
+      "src/main/runtime/orchestration/structured-worker-direct-mailbox-target.test.ts": 3260,
+      "src/main/runtime/orchestration/structured-worker-group-addressing.test.ts": 337,
+      "src/main/runtime/orchestration/structured-worker-journal-archive.test.ts": 91,
+      "src/main/runtime/orchestration/task-deps-flag.test.ts": 84,
+      "src/main/runtime/orchestration/worker-attention-context.test.ts": 58,
+      "src/main/runtime/orchestration/worker-output-archive-bounding.test.ts": 460,
+      "src/main/runtime/orchestration/worker-output-archive.test.ts": 386,
+      "src/main/runtime/orchestration/worker-output-cursor.test.ts": 65,
+      "src/main/runtime/orchestration/worker-provider-session.test.ts": 60,
+      "src/main/runtime/orchestration/worker-start-unobserved-prompt-settlement.test.ts": 394,
+      "src/main/runtime/orchestration/worker-transcript-payload.test.ts": 83,
+      "src/main/runtime/orchestration/worker-transcript-read.test.ts": 267,
+      "src/main/runtime/orchestration/worker-transcript-remote-read.test.ts": 201,
+      "src/main/runtime/paired-close-retirement-proof-publication-order.test.ts": 3296,
+      "src/main/runtime/pairing-endpoint.test.ts": 170,
+      "src/main/runtime/proven-absent-leaf-pty-verdicts.test.ts": 34,
+      "src/main/runtime/pty-exit-agent-status-reconciliation.test.ts": 3395,
+      "src/main/runtime/pty-exit-per-pty-map-reaper-ratchet.test.ts": 3330,
+      "src/main/runtime/pty-inventory-lifecycle-admission.test.ts": 2868,
+      "src/main/runtime/pty-inventory-lifecycle-scope.test.ts": 2608,
+      "src/main/runtime/pty-inventory-liveness-verdict.test.ts": 3469,
+      "src/main/runtime/pty-inventory-partial-relay-liveness.test.ts": 3435,
+      "src/main/runtime/pty-recorded-surface-topology.test.ts": 46,
+      "src/main/runtime/pty-shell-ownership-mirror.test.ts": 1555,
+      "src/main/runtime/pty-transcript-prune-wait-cache.test.ts": 3233,
+      "src/main/runtime/pty-waiver-source-invariant.test.ts": 50,
+      "src/main/runtime/public-ssh-state.test.ts": 27,
+      "src/main/runtime/push/desktop-push-service-unreadable-outbox.test.ts": 223,
+      "src/main/runtime/push/desktop-push-service.test.ts": 391,
+      "src/main/runtime/push/push-agent-state.test.ts": 54,
+      "src/main/runtime/push/push-cleanup-auth-expiry.test.ts": 219,
+      "src/main/runtime/push/push-delivery-policy.test.ts": 47,
+      "src/main/runtime/push/push-device-registration-persistence.test.ts": 85,
+      "src/main/runtime/push/push-dispatcher.test.ts": 73,
+      "src/main/runtime/push/push-gateway-client.test.ts": 230,
+      "src/main/runtime/push/push-gateway-session.test.ts": 312,
+      "src/main/runtime/push/push-host-proof-vector.test.ts": 84,
+      "src/main/runtime/push/push-host-proof.test.ts": 142,
+      "src/main/runtime/push/push-outcome-counters.test.ts": 34,
+      "src/main/runtime/push/push-policy-pipeline.integration.test.ts": 226,
+      "src/main/runtime/push/push-preferences.test.ts": 59,
+      "src/main/runtime/push/push-registration-races.test.ts": 320,
+      "src/main/runtime/push/push-registration-rpc.test.ts": 2997,
+      "src/main/runtime/push/push-unpair-persistence.test.ts": 4171,
+      "src/main/runtime/push/push-unregister-outbox.test.ts": 83,
+      "src/main/runtime/quarter-circle-title-send-authorization.test.ts": 19888,
+      "src/main/runtime/queued-terminal-graph-exit.test.ts": 3355,
+      "src/main/runtime/recent-pty-output-buffer.test.ts": 118,
+      "src/main/runtime/recent-pty-output-retention.test.ts": 101,
+      "src/main/runtime/relay/desktop-relay-service-broker-liveness.test.ts": 215,
+      "src/main/runtime/relay/desktop-relay-service.test.ts": 667,
+      "src/main/runtime/relay/mobile-relay-e2ee.integration.test.ts": 281,
+      "src/main/runtime/relay/relay-auth-coordinator-recovery.test.ts": 166,
+      "src/main/runtime/relay/relay-auth-coordinator.test.ts": 1240,
+      "src/main/runtime/relay/relay-auth-host-close-reason.test.ts": 184,
+      "src/main/runtime/relay/relay-control-client.test.ts": 602,
+      "src/main/runtime/relay/relay-control-close-reason.test.ts": 293,
+      "src/main/runtime/relay/relay-control-origin.test.ts": 138,
+      "src/main/runtime/relay/relay-control-request-retirement.test.ts": 160,
+      "src/main/runtime/relay/relay-control-timeout-classification.test.ts": 159,
+      "src/main/runtime/relay/relay-demand-ledger.test.ts": 100,
+      "src/main/runtime/relay/relay-host-proof.test.ts": 131,
+      "src/main/runtime/relay/relay-http-client.test.ts": 341,
+      "src/main/runtime/relay/relay-region-correction.test.ts": 297,
+      "src/main/runtime/relay/relay-region-preference.test.ts": 180,
+      "src/main/runtime/relay/relay-region-probe-log.test.ts": 297,
+      "src/main/runtime/relay/relay-region-refresh.test.ts": 188,
+      "src/main/runtime/relay/relay-renewal-jitter.test.ts": 969,
+      "src/main/runtime/relay/relay-revoke-outbox.test.ts": 79,
+      "src/main/runtime/relay/relay-session-broker.test.ts": 667,
+      "src/main/runtime/remote-agent-session-host-authority.integration.test.ts": 3521,
+      "src/main/runtime/remote-browser-screencast-frame-admission.test.ts": 360,
+      "src/main/runtime/remote-desktop-driver.test.ts": 2835,
+      "src/main/runtime/remote-runtime-close-intent.integration.test.ts": 1447,
+      "src/main/runtime/remote-runtime-request-connection.integration.test.ts": 2224,
+      "src/main/runtime/remote-server-updater.test.ts": 39,
+      "src/main/runtime/renderer-browser-session-reconciliation.test.ts": 2331,
+      "src/main/runtime/repo-icon-fork-backfill.test.ts": 3128,
+      "src/main/runtime/repo-worktree-admin-fingerprint.test.ts": 856,
+      "src/main/runtime/repo-worktree-resolution-scan.test.ts": 54,
+      "src/main/runtime/repo-worktree-row-resolution.test.ts": 221,
+      "src/main/runtime/retained-tail-redraw-window.equivalence.test.ts": 3753,
+      "src/main/runtime/rpc/core-typed-method-contract.test.ts": 107,
+      "src/main/runtime/rpc/dispatcher-browser-client-automation.test.ts": 1502,
+      "src/main/runtime/rpc/dispatcher-computer-errors.test.ts": 2001,
+      "src/main/runtime/rpc/dispatcher-feature-interactions.test.ts": 1855,
+      "src/main/runtime/rpc/dispatcher-request-parsing.test.ts": 143,
+      "src/main/runtime/rpc/e2ee-channel-text-backpressure.test.ts": 183,
+      "src/main/runtime/rpc/e2ee-channel-v2.test.ts": 226,
+      "src/main/runtime/rpc/e2ee-channel.test.ts": 490,
+      "src/main/runtime/rpc/e2ee-crypto.test.ts": 99,
+      "src/main/runtime/rpc/e2ee-integration.test.ts": 267,
+      "src/main/runtime/rpc/errors.test.ts": 190,
+      "src/main/runtime/rpc/methods/accounts.test.ts": 152,
+      "src/main/runtime/rpc/methods/agent-hooks.test.ts": 138,
+      "src/main/runtime/rpc/methods/agent-launch-floating-workspace.test.ts": 2274,
+      "src/main/runtime/rpc/methods/agent-launch-pane-reservation.test.ts": 1814,
+      "src/main/runtime/rpc/methods/agent-launch-replay.test.ts": 2245,
+      "src/main/runtime/rpc/methods/agent-launch-session-reservation.test.ts": 925,
+      "src/main/runtime/rpc/methods/agent-launch-structured-prompt.test.ts": 72,
+      "src/main/runtime/rpc/methods/agent-launch-terminal-identity.test.ts": 349,
+      "src/main/runtime/rpc/methods/agent-launch-terminal-preferences.test.ts": 301,
+      "src/main/runtime/rpc/methods/agent-launch-terminal-prompt.test.ts": 93,
+      "src/main/runtime/rpc/methods/agent-launch.test.ts": 545,
+      "src/main/runtime/rpc/methods/agent-session.test.ts": 1701,
+      "src/main/runtime/rpc/methods/agent-skill-sharing-capability-grant.test.ts": 2731,
+      "src/main/runtime/rpc/methods/ai-vault-search.test.ts": 3943,
+      "src/main/runtime/rpc/methods/ai-vault.test.ts": 3245,
+      "src/main/runtime/rpc/methods/artifact-sharing-capability-grant.test.ts": 2728,
+      "src/main/runtime/rpc/methods/artifacts.test.ts": 419,
+      "src/main/runtime/rpc/methods/automation-scoped-list-methods.test.ts": 2331,
+      "src/main/runtime/rpc/methods/automations.test.ts": 1969,
+      "src/main/runtime/rpc/methods/browser-client-host-attach-adoption.test.ts": 1420,
+      "src/main/runtime/rpc/methods/browser-client-host-reconciliation.test.ts": 1886,
+      "src/main/runtime/rpc/methods/browser-client-host.test.ts": 1978,
+      "src/main/runtime/rpc/methods/browser-client-page-metadata.test.ts": 2040,
+      "src/main/runtime/rpc/methods/browser-identity-rpc.test.ts": 2038,
+      "src/main/runtime/rpc/methods/browser-network-tunnel.test.ts": 2142,
+      "src/main/runtime/rpc/methods/browser-tab-create-schema.test.ts": 75,
+      "src/main/runtime/rpc/methods/browser.test.ts": 2100,
+      "src/main/runtime/rpc/methods/client-events.test.ts": 1168,
+      "src/main/runtime/rpc/methods/client-native-chat-settings.test.ts": 2581,
+      "src/main/runtime/rpc/methods/client-ui-pairing-local-fields.test.ts": 2057,
+      "src/main/runtime/rpc/methods/client-ui-task-resume-state.test.ts": 1201,
+      "src/main/runtime/rpc/methods/client-ui.test.ts": 5509,
+      "src/main/runtime/rpc/methods/clipboard.test.ts": 1919,
+      "src/main/runtime/rpc/methods/computer-actions.test.ts": 203,
+      "src/main/runtime/rpc/methods/computer.test.ts": 185,
+      "src/main/runtime/rpc/methods/diagnostics.test.ts": 2205,
+      "src/main/runtime/rpc/methods/file-watch-event-batcher.test.ts": 78,
+      "src/main/runtime/rpc/methods/files-base64-padding.test.ts": 1950,
+      "src/main/runtime/rpc/methods/files-doc-preview.test.ts": 2034,
+      "src/main/runtime/rpc/methods/files-list-all-page-size.test.ts": 2043,
+      "src/main/runtime/rpc/methods/files-path-search.test.ts": 1362,
+      "src/main/runtime/rpc/methods/files-preview-transport-budget.test.ts": 1828,
+      "src/main/runtime/rpc/methods/files-terminal-path-resolution.test.ts": 2031,
+      "src/main/runtime/rpc/methods/files-watch-cancellation.test.ts": 2085,
+      "src/main/runtime/rpc/methods/files-watch-cleanup.test.ts": 2050,
+      "src/main/runtime/rpc/methods/files.test.ts": 2096,
+      "src/main/runtime/rpc/methods/git-diff-transport-budget.test.ts": 1619,
+      "src/main/runtime/rpc/methods/git.test.ts": 1380,
+      "src/main/runtime/rpc/methods/github-pr-refresh-reason.test.ts": 1972,
+      "src/main/runtime/rpc/methods/github.test.ts": 1972,
+      "src/main/runtime/rpc/methods/gitlab.test.ts": 2078,
+      "src/main/runtime/rpc/methods/host-capabilities.test.ts": 2054,
+      "src/main/runtime/rpc/methods/hosted-review.test.ts": 1980,
+      "src/main/runtime/rpc/methods/jira.test.ts": 1754,
+      "src/main/runtime/rpc/methods/linear-agent-access.test.ts": 3679,
+      "src/main/runtime/rpc/methods/linear-agent-project-access.test.ts": 4428,
+      "src/main/runtime/rpc/methods/linear.test.ts": 2000,
+      "src/main/runtime/rpc/methods/mobile-web-bundle-range.test.ts": 2006,
+      "src/main/runtime/rpc/methods/mobile-web-bundle-read-concurrency.test.ts": 1627,
+      "src/main/runtime/rpc/methods/mobile-web-bundle-window-refusals.test.ts": 1956,
+      "src/main/runtime/rpc/methods/mobile-web-bundle.test.ts": 2278,
+      "src/main/runtime/rpc/methods/native-chat-rpc-block-sanitize.test.ts": 59,
+      "src/main/runtime/rpc/methods/native-chat.test.ts": 205,
+      "src/main/runtime/rpc/methods/notification-preferences.test.ts": 187,
+      "src/main/runtime/rpc/methods/notification-reconnect-cooldown.test.ts": 125,
+      "src/main/runtime/rpc/methods/orchestration-dispatch-error-codes.test.ts": 3127,
+      "src/main/runtime/rpc/methods/orchestration-structured-worker-abandon.test.ts": 3454,
+      "src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.test.ts": 177,
+      "src/main/runtime/rpc/methods/orchestration-structured-worker-redrive.test.ts": 2861,
+      "src/main/runtime/rpc/methods/orchestration-structured-worker-session.test.ts": 202,
+      "src/main/runtime/rpc/methods/orchestration-structured-worker-start-failure.test.ts": 257,
+      "src/main/runtime/rpc/methods/orchestration-worker-mode-opacity.test.ts": 3575,
+      "src/main/runtime/rpc/methods/orchestration-worker-start-mode-selection.test.ts": 3617,
+      "src/main/runtime/rpc/methods/orchestration-worker-start-mode.test.ts": 221,
+      "src/main/runtime/rpc/methods/orchestration-worker-start-receipt-wording.test.ts": 181,
+      "src/main/runtime/rpc/methods/orchestration-worker-support-unknown.test.ts": 146,
+      "src/main/runtime/rpc/methods/orchestration/cli-runtime-boundary.test.ts": 2942,
+      "src/main/runtime/rpc/methods/orchestration/federation/federated-attach-receipt.test.ts": 59,
+      "src/main/runtime/rpc/methods/orchestration/federation/federated-fleet-snapshot.test.ts": 306,
+      "src/main/runtime/rpc/methods/orchestration/federation/federated-message-targeting.test.ts": 3006,
+      "src/main/runtime/rpc/methods/orchestration/federation/federated-release-safety.test.ts": 3590,
+      "src/main/runtime/rpc/methods/orchestration/federation/federated-transport-safety.test.ts": 3305,
+      "src/main/runtime/rpc/methods/orchestration/federation/federated-worker-start-receipt.test.ts": 3044,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-agent-launch.test.ts": 3886,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-control-mail.test.ts": 2200,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-effects.test.ts": 48,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-folder-placement.test.ts": 3459,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts": 8330,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-liveness-verdict.test.ts": 3459,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-output.test.ts": 5069,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-setup.test.ts": 3127,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-start-prompt-budget.test.ts": 3354,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-start-schema.test.ts": 135,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts": 5899,
+      "src/main/runtime/rpc/methods/orchestration/gates/gate-run-authorization.test.ts": 4327,
+      "src/main/runtime/rpc/methods/orchestration/gates/gates.test.ts": 4254,
+      "src/main/runtime/rpc/methods/orchestration/messaging/ask.test.ts": 3642,
+      "src/main/runtime/rpc/methods/orchestration/messaging/check-delivery-history.test.ts": 3832,
+      "src/main/runtime/rpc/methods/orchestration/messaging/check-superseded-terminal.test.ts": 2154,
+      "src/main/runtime/rpc/methods/orchestration/messaging/check-worker-consumer-fencing.test.ts": 3774,
+      "src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts": 2399,
+      "src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts": 4320,
+      "src/main/runtime/rpc/methods/orchestration/messaging/recipient-routing.test.ts": 3153,
+      "src/main/runtime/rpc/methods/orchestration/messaging/send-dispatch-authority.test.ts": 3500,
+      "src/main/runtime/rpc/methods/orchestration/messaging/send-group.test.ts": 1944,
+      "src/main/runtime/rpc/methods/orchestration/messaging/send-invalid-type.test.ts": 3325,
+      "src/main/runtime/rpc/methods/orchestration/messaging/send-receipt-plumbing.test.ts": 3305,
+      "src/main/runtime/rpc/methods/orchestration/messaging/send-unbound-terminals.test.ts": 3760,
+      "src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts": 3572,
+      "src/main/runtime/rpc/methods/orchestration/messaging/settled-dispatch-mail.test.ts": 3495,
+      "src/main/runtime/rpc/methods/orchestration/runs/migration-behavior.test.ts": 3989,
+      "src/main/runtime/rpc/methods/orchestration/runs/run-receipt.test.ts": 170,
+      "src/main/runtime/rpc/methods/orchestration/runs/runs.test.ts": 3653,
+      "src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts": 3767,
+      "src/main/runtime/rpc/methods/orchestration/worker/agent-status-producer-census.test.ts": 5044,
+      "src/main/runtime/rpc/methods/orchestration/worker/antigravity-worker-lifecycle.test.ts": 3631,
+      "src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts": 3335,
+      "src/main/runtime/rpc/methods/orchestration/worker/context-only-dispatch-retry.test.ts": 3459,
+      "src/main/runtime/rpc/methods/orchestration/worker/fleet-status-observed-identity.test.ts": 2831,
+      "src/main/runtime/rpc/methods/orchestration/worker/fleet-status-terminal-identity.test.ts": 2477,
+      "src/main/runtime/rpc/methods/orchestration/worker/legacy-dispatch-projection.test.ts": 3377,
+      "src/main/runtime/rpc/methods/orchestration/worker/manual-dispatch-observation.test.ts": 3653,
+      "src/main/runtime/rpc/methods/orchestration/worker/manual-dispatch-release.test.ts": 2997,
+      "src/main/runtime/rpc/methods/orchestration/worker/self-dispatch-nesting-depth.test.ts": 3581,
+      "src/main/runtime/rpc/methods/orchestration/worker/structured-worker-launch-seed-options.test.ts": 301,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-interactive-wait.test.ts": 2671,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-launch-preferences.test.ts": 185,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-list-pagination.test.ts": 2921,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-list-run-scope-rpc.test.ts": 3483,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-observation.test.ts": 226,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-output.test.ts": 189,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-read-projection.test.ts": 2982,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-archive.test.ts": 2904,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-inventory.test.ts": 3642,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-liveness-verdict.test.ts": 386,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts": 2795,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-ownership-guard.test.ts": 3055,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts": 3085,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts": 3192,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-budgets.test.ts": 37,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-outcome-classification.test.ts": 306,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-budget.test.ts": 103,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts": 3639,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-terminal-target.test.ts": 3746,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-turn-observation.test.ts": 47,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-stop-capability.test.ts": 394,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-stop-exit-race.test.ts": 2902,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-stop-liveness-verdict.test.ts": 2444,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-terminal-custody-at-creation.test.ts": 3618,
+      "src/main/runtime/rpc/methods/orchestration/worker/workers-new-worktree.test.ts": 4522,
+      "src/main/runtime/rpc/methods/orchestration/worker/workers-recovery.test.ts": 2613,
+      "src/main/runtime/rpc/methods/paired-caller-host-id.test.ts": 57,
+      "src/main/runtime/rpc/methods/pairing.test.ts": 4021,
+      "src/main/runtime/rpc/methods/plugins.test.ts": 357,
+      "src/main/runtime/rpc/methods/preflight.test.ts": 1474,
+      "src/main/runtime/rpc/methods/project-host-setup-self-host-stamp.test.ts": 147,
+      "src/main/runtime/rpc/methods/repo-badge-color.test.ts": 1628,
+      "src/main/runtime/rpc/methods/repo.test.ts": 3091,
+      "src/main/runtime/rpc/methods/runtime-client-capabilities.test.ts": 2076,
+      "src/main/runtime/rpc/methods/session-tab-agent-capability-mutations.test.ts": 1544,
+      "src/main/runtime/rpc/methods/session-tab-agent-status-projection.test.ts": 72,
+      "src/main/runtime/rpc/methods/session-tab-browser-placement-mutations.test.ts": 1954,
+      "src/main/runtime/rpc/methods/session-tab-browser-placement-projection.test.ts": 43,
+      "src/main/runtime/rpc/methods/session-tabs-inventory-census-race.test.ts": 7364,
+      "src/main/runtime/rpc/methods/session-tabs-inventory-rpc.test.ts": 3424,
+      "src/main/runtime/rpc/methods/session-tabs-move-validation.test.ts": 3387,
+      "src/main/runtime/rpc/methods/session-tabs-retirement-proof-delta.test.ts": 1812,
+      "src/main/runtime/rpc/methods/session-tabs-schemas.test.ts": 214,
+      "src/main/runtime/rpc/methods/session-tabs-structured-restore.test.ts": 1499,
+      "src/main/runtime/rpc/methods/session-tabs-unsubscribe.test.ts": 1741,
+      "src/main/runtime/rpc/methods/session-tabs.test.ts": 2523,
+      "src/main/runtime/rpc/methods/skills.test.ts": 145,
+      "src/main/runtime/rpc/methods/speech.test.ts": 2115,
+      "src/main/runtime/rpc/methods/ssh.test.ts": 2113,
+      "src/main/runtime/rpc/methods/status-machine-name-publish-budget.test.ts": 4507,
+      "src/main/runtime/rpc/methods/status.test.ts": 3576,
+      "src/main/runtime/rpc/methods/structured-agent-session-admission.test.ts": 1748,
+      "src/main/runtime/rpc/methods/structured-agent-session-adoption-replay.test.ts": 3622,
+      "src/main/runtime/rpc/methods/structured-agent-session-background-task-capability.test.ts": 1976,
+      "src/main/runtime/rpc/methods/structured-agent-session-conversation-outline.test.ts": 2085,
+      "src/main/runtime/rpc/methods/structured-agent-session-hold.test.ts": 5554,
+      "src/main/runtime/rpc/methods/structured-agent-session-options-read.test.ts": 1458,
+      "src/main/runtime/rpc/methods/structured-agent-session-policy.test.ts": 56,
+      "src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.test.ts": 2074,
+      "src/main/runtime/rpc/methods/structured-agent-session-respond-params.test.ts": 2079,
+      "src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.test.ts": 1973,
+      "src/main/runtime/rpc/methods/structured-agent-session.test.ts": 3566,
+      "src/main/runtime/rpc/methods/structured-chat-tab-table.test.ts": 4222,
+      "src/main/runtime/rpc/methods/structured-worker-read-cursor.test.ts": 278,
+      "src/main/runtime/rpc/methods/structured-worker-stop-receipt.test.ts": 3571,
+      "src/main/runtime/rpc/methods/structured-worker-tab-retirement.test.ts": 3424,
+      "src/main/runtime/rpc/methods/task-provider-identity.test.ts": 199,
+      "src/main/runtime/rpc/methods/terminal-create-idempotency.test.ts": 243,
+      "src/main/runtime/rpc/methods/terminal-legacy-stream-id-characterization.test.ts": 1363,
+      "src/main/runtime/rpc/methods/terminal-manifest-characterization.test.ts": 218,
+      "src/main/runtime/rpc/methods/terminal-navigation.test.ts": 1906,
+      "src/main/runtime/rpc/methods/terminal-read-screen-cursor.test.ts": 257,
+      "src/main/runtime/rpc/methods/terminal-stream-extraction-characterization.test.ts": 99,
+      "src/main/runtime/rpc/methods/terminal/terminal-inspect-process-params.test.ts": 171,
+      "src/main/runtime/rpc/methods/terminal/terminal-output-batcher.test.ts": 56,
+      "src/main/runtime/rpc/methods/terminal/terminal-snapshot-json-byte-budget.test.ts": 440,
+      "src/main/runtime/rpc/methods/updater.test.ts": 96,
+      "src/main/runtime/rpc/methods/workspace-cleanup-ui-schema.test.ts": 174,
+      "src/main/runtime/rpc/methods/workspace-ports.test.ts": 1990,
+      "src/main/runtime/rpc/methods/worktree-catalog-snapshot-method.test.ts": 1995,
+      "src/main/runtime/rpc/methods/worktree-catalog-version-stamp.test.ts": 1225,
+      "src/main/runtime/rpc/methods/worktree-create-args.test.ts": 229,
+      "src/main/runtime/rpc/methods/worktree-create-navigation.test.ts": 2179,
+      "src/main/runtime/rpc/methods/worktree-github-pr-suppression.test.ts": 1632,
+      "src/main/runtime/rpc/methods/worktree-missing-terminal-teardown.test.ts": 2053,
+      "src/main/runtime/rpc/methods/worktree-retired-names.test.ts": 2044,
+      "src/main/runtime/rpc/methods/worktree-rm-host-qualification.test.ts": 1170,
+      "src/main/runtime/rpc/methods/worktree-rm-pty-waiver.test.ts": 1653,
+      "src/main/runtime/rpc/methods/worktree-schemas.test.ts": 213,
+      "src/main/runtime/rpc/methods/worktree.test.ts": 1890,
+      "src/main/runtime/rpc/mobile-auth-acl-critical-path.test.ts": 738,
+      "src/main/runtime/rpc/mobile-clipboard-image-provenance.test.ts": 75,
+      "src/main/runtime/rpc/mobile-e2ee-outbound-memory-budget.test.ts": 39,
+      "src/main/runtime/rpc/mobile-e2ee-v2-desktop-session.test.ts": 88,
+      "src/main/runtime/rpc/mobile-e2ee-v2-key-schedule.test.ts": 58,
+      "src/main/runtime/rpc/mobile-socket-wiring.test.ts": 407,
+      "src/main/runtime/rpc/orchestration-11745-regression-verification.test.ts": 6095,
+      "src/main/runtime/rpc/orchestration-commit-notify-characterization.test.ts": 4449,
+      "src/main/runtime/rpc/orchestration-contract-fence.test.ts": 3677,
+      "src/main/runtime/rpc/orchestration-current-authority-precedence.test.ts": 4165,
+      "src/main/runtime/rpc/orchestration-legacy-compatibility-dispatcher.test.ts": 4292,
+      "src/main/runtime/rpc/orchestration-legacy-coordinator-race.test.ts": 5243,
+      "src/main/runtime/rpc/orchestration-legacy-fence-jurisdiction.test.ts": 4116,
+      "src/main/runtime/rpc/orchestration-legacy-question-takeover.test.ts": 4209,
+      "src/main/runtime/rpc/orchestration-legacy-run-routing.test.ts": 4083,
+      "src/main/runtime/rpc/orchestration-legacy-takeover-current-authority.test.ts": 3570,
+      "src/main/runtime/rpc/orchestration-legacy-takeover-delivery.test.ts": 3472,
+      "src/main/runtime/rpc/orchestration-legacy-takeover-dispatcher.test.ts": 3978,
+      "src/main/runtime/rpc/orchestration-mutation-executor.test.ts": 2234,
+      "src/main/runtime/rpc/orchestration-mutation-ledger.test.ts": 4386,
+      "src/main/runtime/rpc/orchestration-mutation-request-show-legacy.test.ts": 3422,
+      "src/main/runtime/rpc/orchestration-mutation-request-show.test.ts": 3415,
+      "src/main/runtime/rpc/orchestration-party-addressing.test.ts": 2984,
+      "src/main/runtime/rpc/orchestration-party-agreement.test.ts": 4332,
+      "src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts": 3707,
+      "src/main/runtime/rpc/orchestration-session-caller.test.ts": 3095,
+      "src/main/runtime/rpc/orchestration-session-coordinator.test.ts": 4617,
+      "src/main/runtime/rpc/orchestration-session-recipient.test.ts": 3497,
+      "src/main/runtime/rpc/orchestration-task-dispatch-invariant.test.ts": 4509,
+      "src/main/runtime/rpc/relay-transport.test.ts": 232,
+      "src/main/runtime/rpc/remote-runtime-server-heartbeat-missed-probe-tolerance.test.ts": 66,
+      "src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts": 66,
+      "src/main/runtime/rpc/runtime-client-capabilities.test.ts": 51,
+      "src/main/runtime/rpc/runtime-close-attribution-topology.test.ts": 1449,
+      "src/main/runtime/rpc/runtime-close-attribution.test.ts": 1499,
+      "src/main/runtime/rpc/schemas.test.ts": 342,
+      "src/main/runtime/rpc/static-web-client-handler-stream.test.ts": 4560,
+      "src/main/runtime/rpc/streaming.test.ts": 2073,
+      "src/main/runtime/rpc/terminal-agent-prompt-send.test.ts": 1690,
+      "src/main/runtime/rpc/terminal-agent-send-guard.test.ts": 2687,
+      "src/main/runtime/rpc/terminal-geometry-stale-handle.test.ts": 1909,
+      "src/main/runtime/rpc/terminal-lease-stale-handle-survival.test.ts": 1995,
+      "src/main/runtime/rpc/terminal-list-host-scope-transport.test.ts": 1877,
+      "src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts": 2532,
+      "src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts": 3965,
+      "src/main/runtime/rpc/terminal-multiplex-desktop-resize-routing.test.ts": 1743,
+      "src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts": 2073,
+      "src/main/runtime/rpc/terminal-multiplex-escape-tail.test.ts": 1942,
+      "src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts": 42,
+      "src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts": 2257,
+      "src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts": 2087,
+      "src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts": 2541,
+      "src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts": 2115,
+      "src/main/runtime/rpc/terminal-multiplex-resync-replay-trim.test.ts": 2070,
+      "src/main/runtime/rpc/terminal-multiplex-round-robin.test.ts": 53,
+      "src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts": 2326,
+      "src/main/runtime/rpc/terminal-multiplex-source-range-admission.test.ts": 2706,
+      "src/main/runtime/rpc/terminal-multiplex-subscribe-slot-recovery.test.ts": 1321,
+      "src/main/runtime/rpc/terminal-opencode-send-guard.integration.test.ts": 4114,
+      "src/main/runtime/rpc/terminal-output-batching.test.ts": 1858,
+      "src/main/runtime/rpc/terminal-output-frame-chunks-equivalence.test.ts": 24855,
+      "src/main/runtime/rpc/terminal-output-frame-source-ranges.test.ts": 48,
+      "src/main/runtime/rpc/terminal-prompt-delivery-receipt.test.ts": 2576,
+      "src/main/runtime/rpc/terminal-provider-snapshot-sequence.test.ts": 2196,
+      "src/main/runtime/rpc/terminal-requested-snapshot-unavailability.test.ts": 2186,
+      "src/main/runtime/rpc/terminal-send-launch-draft-resolution.test.ts": 1892,
+      "src/main/runtime/rpc/terminal-send.test.ts": 2332,
+      "src/main/runtime/rpc/terminal-source-range-ledger.test.ts": 56,
+      "src/main/runtime/rpc/terminal-stream-byte-length.test.ts": 6429,
+      "src/main/runtime/rpc/terminal-subscribe-blank-mount.test.ts": 1622,
+      "src/main/runtime/rpc/terminal-subscribe-buffer.test.ts": 8969,
+      "src/main/runtime/rpc/terminal-subscribe-lease-only.test.ts": 2041,
+      "src/main/runtime/rpc/terminal-subscribe-mount-replay.test.ts": 1193,
+      "src/main/runtime/rpc/terminal-subscribe-ownership.test.ts": 2029,
+      "src/main/runtime/rpc/terminal-subscribe-reconnect-rebind.test.ts": 1967,
+      "src/main/runtime/rpc/terminal-subscribe-relay-drop-lease-survival.test.ts": 3468,
+      "src/main/runtime/rpc/terminal-subscribe-renderer-recovery-output.test.ts": 1930,
+      "src/main/runtime/rpc/unix-socket-transport.test.ts": 88,
+      "src/main/runtime/rpc/unpaired-device-auth-throttle.test.ts": 37,
+      "src/main/runtime/rpc/worktree-catalog-snapshot.test.ts": 65,
+      "src/main/runtime/rpc/ws-fallback-port-store.test.ts": 43,
+      "src/main/runtime/rpc/ws-transport-accept-order.test.ts": 157,
+      "src/main/runtime/rpc/ws-transport-static-web.test.ts": 218,
+      "src/main/runtime/rpc/ws-transport-transient-packet-loss.test.ts": 721,
+      "src/main/runtime/rpc/ws-transport.test.ts": 1076,
+      "src/main/runtime/runtime-agent-row-main-agent-projection.test.ts": 51,
+      "src/main/runtime/runtime-binary-message-router.test.ts": 36,
+      "src/main/runtime/runtime-browser-client-automation.test.ts": 181,
+      "src/main/runtime/runtime-browser-client-page-adoption.test.ts": 210,
+      "src/main/runtime/runtime-browser-client-page-creation.test.ts": 126,
+      "src/main/runtime/runtime-browser-client-page-recovery.test.ts": 250,
+      "src/main/runtime/runtime-browser-client-page-restored-recovery.test.ts": 116,
+      "src/main/runtime/runtime-browser-network-execution-host.test.ts": 43,
+      "src/main/runtime/runtime-browser-page-registry.test.ts": 57,
+      "src/main/runtime/runtime-client-settings-linear-team-projection.test.ts": 453,
+      "src/main/runtime/runtime-client-settings-minimax-projection.test.ts": 289,
+      "src/main/runtime/runtime-client-settings-terminal-copy-projection.test.ts": 429,
+      "src/main/runtime/runtime-extraction-regressions.test.ts": 3371,
+      "src/main/runtime/runtime-file-path-existence.test.ts": 1374,
+      "src/main/runtime/runtime-file-target-connection-field-ratchet.test.ts": 37,
+      "src/main/runtime/runtime-file-target-execution-host.test.ts": 3281,
+      "src/main/runtime/runtime-file-upload-decode.test.ts": 3770,
+      "src/main/runtime/runtime-folder-workspace.test.ts": 50,
+      "src/main/runtime/runtime-folder-worktree-create.test.ts": 71,
+      "src/main/runtime/runtime-git-api-contract.test.ts": 722,
+      "src/main/runtime/runtime-git-branch-compare-admission.test.ts": 66,
+      "src/main/runtime/runtime-git-command-target.test.ts": 34,
+      "src/main/runtime/runtime-git-conflict-operation-routing.test.ts": 501,
+      "src/main/runtime/runtime-git-execution-host-ownership.test.ts": 819,
+      "src/main/runtime/runtime-git-generation-admission.test.ts": 132,
+      "src/main/runtime/runtime-git-status-admission.test.ts": 2074,
+      "src/main/runtime/runtime-git-sync-commands.test.ts": 795,
+      "src/main/runtime/runtime-git-target-execution-host.test.ts": 2543,
+      "src/main/runtime/runtime-graph-reload-lifecycle.test.ts": 39,
+      "src/main/runtime/runtime-hook-agent-row-selection.test.ts": 91,
+      "src/main/runtime/runtime-legacy-worker-terminal-recovery-retry.test.ts": 40,
+      "src/main/runtime/runtime-linear-read-commands.test.ts": 118,
+      "src/main/runtime/runtime-local-create-rearm-ordering.test.ts": 3195,
+      "src/main/runtime/runtime-local-worktree-create.test.ts": 258,
+      "src/main/runtime/runtime-local-worktree-materialization.test.ts": 71,
+      "src/main/runtime/runtime-local-worktree-terminal-startup.test.ts": 46,
+      "src/main/runtime/runtime-machine-name.test.ts": 76,
+      "src/main/runtime/runtime-managed-worktree-metadata-sweep.test.ts": 1074,
+      "src/main/runtime/runtime-managed-worktree-metadata.test.ts": 75,
+      "src/main/runtime/runtime-managed-worktree-queries.test.ts": 275,
+      "src/main/runtime/runtime-metadata-ownership-watch.test.ts": 119,
+      "src/main/runtime/runtime-metadata.test.ts": 168,
+      "src/main/runtime/runtime-mobile-agent-status-builder.test.ts": 62,
+      "src/main/runtime/runtime-mobile-file-path-search.test.ts": 32,
+      "src/main/runtime/runtime-owned-terminal-publication-lineage.test.ts": 3962,
+      "src/main/runtime/runtime-project-group-controller-folder-delete.test.ts": 53,
+      "src/main/runtime/runtime-project-host-setup-controller.test.ts": 328,
+      "src/main/runtime/runtime-remote-fetch-ref-maintenance.test.ts": 292,
+      "src/main/runtime/runtime-remote-managed-worktree-create.test.ts": 42,
+      "src/main/runtime/runtime-remove-project-host-scope.test.ts": 2613,
+      "src/main/runtime/runtime-repository-issue-command.test.ts": 280,
+      "src/main/runtime/runtime-resolved-worktree-cache.test.ts": 54,
+      "src/main/runtime/runtime-rpc-browser-host-admission.test.ts": 4251,
+      "src/main/runtime/runtime-rpc-device-revocation.test.ts": 4197,
+      "src/main/runtime/runtime-rpc-long-poll-transport.test.ts": 6862,
+      "src/main/runtime/runtime-rpc-metadata-lifecycle.test.ts": 3056,
+      "src/main/runtime/runtime-rpc-mobile-method-allowlist.test.ts": 1796,
+      "src/main/runtime/runtime-rpc-mobile-native-chat-settings.test.ts": 29,
+      "src/main/runtime/runtime-rpc-mobile-terminal-streaming.test.ts": 4788,
+      "src/main/runtime/runtime-rpc-mobile-unknown-method-scope-refusal.test.ts": 1513,
+      "src/main/runtime/runtime-rpc-orchestration-db-migration.test.ts": 424,
+      "src/main/runtime/runtime-rpc-pairing-mode-persistence.test.ts": 3549,
+      "src/main/runtime/runtime-rpc-pairing-offer.test.ts": 4433,
+      "src/main/runtime/runtime-rpc-relay-pairing.test.ts": 4084,
+      "src/main/runtime/runtime-rpc-request-authorization.test.ts": 4122,
+      "src/main/runtime/runtime-rpc-startup-failure.test.ts": 66,
+      "src/main/runtime/runtime-rpc-terminal-list.test.ts": 4158,
+      "src/main/runtime/runtime-rpc-websocket-bind-host.test.ts": 4774,
+      "src/main/runtime/runtime-rpc-websocket-long-poll-caps.test.ts": 4036,
+      "src/main/runtime/runtime-rpc-worktree-queries.test.ts": 4031,
+      "src/main/runtime/runtime-search-line-fragments.test.ts": 264,
+      "src/main/runtime/runtime-server-git-availability.test.ts": 60,
+      "src/main/runtime/runtime-session-search-settings.test.ts": 66,
+      "src/main/runtime/runtime-skill-install-authority.test.ts": 64,
+      "src/main/runtime/runtime-skill-install-commands.test.ts": 428,
+      "src/main/runtime/runtime-skill-install-queries.test.ts": 263,
+      "src/main/runtime/runtime-socket-sweep.test.ts": 2436,
+      "src/main/runtime/runtime-subscription-registry.test.ts": 30,
+      "src/main/runtime/runtime-terminal-idle-polls.test.ts": 62,
+      "src/main/runtime/runtime-terminal-orphan-topology-validation.test.ts": 44,
+      "src/main/runtime/runtime-terminal-spawn-push-target-materialization.test.ts": 93,
+      "src/main/runtime/runtime-unregistered-worktree-removal-host-home.test.ts": 617,
+      "src/main/runtime/runtime-worktree-agent-rows-structured.test.ts": 473,
+      "src/main/runtime/runtime-worktree-agent-sources.test.ts": 49,
+      "src/main/runtime/runtime-worktree-agent-startup.test.ts": 166,
+      "src/main/runtime/runtime-worktree-ps-summaries.test.ts": 40,
+      "src/main/runtime/runtime-worktree-selection.test.ts": 53,
+      "src/main/runtime/runtime-worktree-structured-agent-rows-liveness.test.ts": 663,
+      "src/main/runtime/saved-structured-agent-session-restoration.test.ts": 24,
+      "src/main/runtime/selected-review-branch.test.ts": 44,
+      "src/main/runtime/session-tabs-inventory-publication.test.ts": 3283,
+      "src/main/runtime/settled-worker-process-replacement.test.ts": 2400,
+      "src/main/runtime/structured-agent-session-close.test.ts": 115,
+      "src/main/runtime/structured-agent-session-integration-replay.test.ts": 2654,
+      "src/main/runtime/structured-agent-session-integration.test.ts": 11330,
+      "src/main/runtime/structured-agent-session-rollback-compatibility.test.ts": 352,
+      "src/main/runtime/structured-agent-session-runtime-exit.test.ts": 1281,
+      "src/main/runtime/structured-agent-session-runtime-provider-started.test.ts": 1074,
+      "src/main/runtime/structured-agent-session-runtime.test.ts": 861,
+      "src/main/runtime/structured-agent-session-support-probe.test.ts": 3514,
+      "src/main/runtime/structured-agent-shell-environment.test.ts": 57,
+      "src/main/runtime/structured-claude-auth-policy-wiring.test.ts": 777,
+      "src/main/runtime/structured-claude-pending-rewind.test.ts": 1026,
+      "src/main/runtime/structured-conversation-tab-replacement.test.ts": 30,
+      "src/main/runtime/structured-session-worktree-teardown.test.ts": 3171,
+      "src/main/runtime/structured-worker-agent-presence.test.ts": 89,
+      "src/main/runtime/structured-worker-authority.test.ts": 207,
+      "src/main/runtime/structured-worker-child-identity-env.test.ts": 213,
+      "src/main/runtime/structured-worker-hook-attestation.test.ts": 1582,
+      "src/main/runtime/structured-worker-identity.test.ts": 263,
+      "src/main/runtime/structured-worker-mail-routing.test.ts": 1584,
+      "src/main/runtime/structured-worker-takeover-pane-key.test.ts": 3936,
+      "src/main/runtime/structured-worker-terminal-read.test.ts": 1912,
+      "src/main/runtime/structured-worker-terminal-refusal.test.ts": 170,
+      "src/main/runtime/terminal-ansi-pending-retention.test.ts": 524,
+      "src/main/runtime/terminal-chat-owner-persistence.test.ts": 4208,
+      "src/main/runtime/terminal-close-observed-exit.test.ts": 3596,
+      "src/main/runtime/terminal-close-slow-agent-exit.test.ts": 5694,
+      "src/main/runtime/terminal-focus-navigation-coalescer.test.ts": 64,
+      "src/main/runtime/terminal-identity-probe.test.ts": 31,
+      "src/main/runtime/terminal-interactive-wait-visibility.test.ts": 9863,
+      "src/main/runtime/terminal-leaf-tab-resolution.test.ts": 70,
+      "src/main/runtime/terminal-list-execution-host-scope.test.ts": 6496,
+      "src/main/runtime/terminal-list-payload-size.test.ts": 3401,
+      "src/main/runtime/terminal-list-pending-pty-registration.test.ts": 3228,
+      "src/main/runtime/terminal-list-stale-leaf-liveness.test.ts": 3332,
+      "src/main/runtime/terminal-list-surface-lost-orphan.test.ts": 3567,
+      "src/main/runtime/terminal-mobile-subscribe-tab-mount.test.ts": 3510,
+      "src/main/runtime/terminal-model-query-authority.test.ts": 64,
+      "src/main/runtime/terminal-orphan-owner.test.ts": 28,
+      "src/main/runtime/terminal-orphan-topology.test.ts": 52,
+      "src/main/runtime/terminal-pane-recovery-liveness-gate.test.ts": 2841,
+      "src/main/runtime/terminal-projection.test.ts": 3216,
+      "src/main/runtime/terminal-pty-exit-waiter.test.ts": 2056,
+      "src/main/runtime/terminal-query-responder.test.ts": 13500,
+      "src/main/runtime/terminal-restore-record-seed.test.ts": 3311,
+      "src/main/runtime/terminal-retirement-async-durability.test.ts": 3860,
+      "src/main/runtime/terminal-retirement-proof-emitted-frame.test.ts": 3415,
+      "src/main/runtime/terminal-retirement-proof-publication.test.ts": 3354,
+      "src/main/runtime/terminal-send-stale-leaf-liveness.test.ts": 3416,
+      "src/main/runtime/terminal-shell-override-host-support.test.ts": 42,
+      "src/main/runtime/terminal-subscribe-exit-waiter-leak.test.ts": 1849,
+      "src/main/runtime/terminal-subscriber-driven-daemon-attach.test.ts": 4855,
+      "src/main/runtime/terminal-tail-buffer.test.ts": 5683,
+      "src/main/runtime/terminal-tail-row-retention.test.ts": 314,
+      "src/main/runtime/terminal-tail-sentinel-index.test.ts": 2880,
+      "src/main/runtime/terminal-tail-whitespace.test.ts": 80,
+      "src/main/runtime/terminal-vertical-control-scan.test.ts": 74,
+      "src/main/runtime/terminal-wait-detection.test.ts": 84,
+      "src/main/runtime/terminal-wait-name-only-idle.test.ts": 7790,
+      "src/main/runtime/terminal-wait-results.test.ts": 36,
+      "src/main/runtime/terminal-wait-tail-window.test.ts": 173,
+      "src/main/runtime/tui-idle-delivery-and-quiescence.test.ts": 5355,
+      "src/main/runtime/tui-idle-evidence.test.ts": 75,
+      "src/main/runtime/tui-idle-name-only-real-pty.integration.test.ts": 20972,
+      "src/main/runtime/unreadable-secret-store-preservation.win32.test.ts": 38,
+      "src/main/runtime/wait-blocked-check-state.test.ts": 93,
+      "src/main/runtime/wait-blocked-keyword-carry-retention.test.ts": 2640,
+      "src/main/runtime/windows-default-route-interfaces.test.ts": 43,
+      "src/main/runtime/windows-drive-listing.test.ts": 65,
+      "src/main/runtime/windows-firewall-remote-scope.test.ts": 53,
+      "src/main/runtime/windows-mobile-firewall.test.ts": 101,
+      "src/main/runtime/workspace-session-membership-scaling.test.ts": 47,
+      "src/main/runtime/workspace-session-worktree-id.test.ts": 124,
+      "src/main/runtime/worktree-launch-host-repo.test.ts": 42,
+      "src/main/runtime/worktree-list-host-scope.test.ts": 479,
+      "src/main/runtime/worktree-path-selector-wsl-posix.test.ts": 2032,
+      "src/main/runtime/worktree-ps-degraded-repo-scan.test.ts": 2660,
+      "src/main/runtime/worktree-ps-host-scope.test.ts": 3244,
+      "src/main/runtime/worktree-rm-id-selector-path-spelling.test.ts": 3632,
+      "src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts": 2610,
+      "src/main/runtime/worktree-scan-execution-host-routing.test.ts": 2961,
+      "src/main/runtime/worktree-teardown-unstopped-pty.test.ts": 436,
+      "src/main/runtime/worktree-teardown.test.ts": 1806,
+      "src/main/runtime/worktree-terminal-mutation-lock.test.ts": 104,
+      "src/main/runtime/zcode-readiness-transcript.test.ts": 3116,
+      "src/main/serve-update-handoff.app-environment.test.ts": 860,
+      "src/main/serve-update-handoff.test.ts": 42,
+      "src/main/server/serve-readiness.test.ts": 67,
+      "src/main/server/serve-stdout-boundary.test.ts": 39,
+      "src/main/shell-prompt-readiness-probe.test.ts": 55,
+      "src/main/shell-startup-identity-scanner.test.ts": 39,
+      "src/main/shell-startup-output-scanner.test.ts": 67,
+      "src/main/shell-wrapper-content-address.test.ts": 67,
+      "src/main/shell-wrapper-generated-file-snapshot.test.ts": 111,
+      "src/main/sidecar-snapshot-file.test.ts": 52,
+      "src/main/skills/agent-skill-selection.test.ts": 142,
+      "src/main/skills/claude-plugin-skill-sources-wsl.test.ts": 85,
+      "src/main/skills/claude-plugin-skill-sources.test.ts": 42,
+      "src/main/skills/discovery-filter-sharing.test.ts": 275,
+      "src/main/skills/discovery-source-filter-order.test.ts": 127,
+      "src/main/skills/discovery.test.ts": 199,
+      "src/main/skills/skill-bundle-artifacts.test.ts": 114,
+      "src/main/skills/skill-bundle-creation.test.ts": 456,
+      "src/main/skills/skill-bundle-install-service.test.ts": 533,
+      "src/main/skills/skill-bundle-observability-summary.test.ts": 47,
+      "src/main/skills/skill-bundle-process-termination-child.test.ts": 248,
+      "src/main/skills/skill-bundle-process-termination.integration.test.ts": 205,
+      "src/main/skills/skill-bundle-ssh-relay-service.test.ts": 339,
+      "src/main/skills/skill-candidate-concurrency.test.ts": 84,
+      "src/main/skills/skill-client-mediated-transfer-cancellation.test.ts": 105,
+      "src/main/skills/skill-client-mediated-transfer.test.ts": 197,
+      "src/main/skills/skill-cloud-direct-upload.test.ts": 182,
+      "src/main/skills/skill-cloud-grant-installation.test.ts": 172,
+      "src/main/skills/skill-cloud-install-target.test.ts": 28,
+      "src/main/skills/skill-cloud-request.test.ts": 152,
+      "src/main/skills/skill-cloud-service.test.ts": 377,
+      "src/main/skills/skill-delete/plan.test.ts": 272,
+      "src/main/skills/skill-delete/recovery.test.ts": 253,
+      "src/main/skills/skill-delete/roots.test.ts": 71,
+      "src/main/skills/skill-delete/service.test.ts": 549,
+      "src/main/skills/skill-delete/staging-visibility.test.ts": 96,
+      "src/main/skills/skill-delete/wsl-enumeration-protocol.test.ts": 44,
+      "src/main/skills/skill-discovery-concurrency.test.ts": 194,
+      "src/main/skills/skill-discovery-order.test.ts": 565,
+      "src/main/skills/skill-discovery-source-filter.test.ts": 43,
+      "src/main/skills/skill-discovery-target.test.ts": 116,
+      "src/main/skills/skill-discovery-wsl-alias-sharing.test.ts": 108,
+      "src/main/skills/skill-discovery-wsl-bash-filter.test.ts": 3445,
+      "src/main/skills/skill-discovery-wsl-plugins.test.ts": 87,
+      "src/main/skills/skill-discovery-wsl-script-roundtrip.test.ts": 115,
+      "src/main/skills/skill-discovery-wsl.test.ts": 106,
+      "src/main/skills/skill-freshness-eligibility.test.ts": 92,
+      "src/main/skills/skill-freshness-inventory-limits.test.ts": 174,
+      "src/main/skills/skill-freshness-inventory.test.ts": 1854,
+      "src/main/skills/skill-git-tree-identity.test.ts": 122,
+      "src/main/skills/skill-install-destinations.test.ts": 75,
+      "src/main/skills/skill-install-discovery-verification.test.ts": 87,
+      "src/main/skills/skill-install-lock-release.test.ts": 70,
+      "src/main/skills/skill-install-lock.test.ts": 398,
+      "src/main/skills/skill-install-management-service.test.ts": 327,
+      "src/main/skills/skill-install-provenance.test.ts": 61,
+      "src/main/skills/skill-install-recovery.test.ts": 479,
+      "src/main/skills/skill-install-request-service.test.ts": 421,
+      "src/main/skills/skill-install-service.test.ts": 1067,
+      "src/main/skills/skill-install-transaction.test.ts": 2836,
+      "src/main/skills/skill-operation-observability.test.ts": 316,
+      "src/main/skills/skill-package-creation.test.ts": 427,
+      "src/main/skills/skill-package-deterministic-gzip.test.ts": 1123,
+      "src/main/skills/skill-package-download.test.ts": 270,
+      "src/main/skills/skill-package-identity.test.ts": 196,
+      "src/main/skills/skill-package-tar.test.ts": 429,
+      "src/main/skills/skill-placement-alias-repair.test.ts": 192,
+      "src/main/skills/skill-placement-copy-drift.test.ts": 110,
+      "src/main/skills/skill-placement-reconciliation.test.ts": 233,
+      "src/main/skills/skill-placement-transaction.test.ts": 233,
+      "src/main/skills/skill-plugin-cache-scan.test.ts": 766,
+      "src/main/skills/skill-process-contention-child.test.ts": 236,
+      "src/main/skills/skill-process-contention.integration.test.ts": 125,
+      "src/main/skills/skill-process-termination-child.test.ts": 228,
+      "src/main/skills/skill-process-termination.integration.test.ts": 169,
+      "src/main/skills/skill-provider-destinations.test.ts": 39,
+      "src/main/skills/skill-provider-runtime-roots.test.ts": 38,
+      "src/main/skills/skill-remote-error-category-parity.test.ts": 228,
+      "src/main/skills/skill-remote-install-cancellation.test.ts": 28,
+      "src/main/skills/skill-remote-install-service.test.ts": 220,
+      "src/main/skills/skill-remove-transaction.test.ts": 494,
+      "src/main/skills/skill-root-file-walk.test.ts": 87,
+      "src/main/skills/skill-runtime-capability.test.ts": 59,
+      "src/main/skills/skill-scan-coalescer.test.ts": 34,
+      "src/main/skills/skill-share-preparation-service.test.ts": 305,
+      "src/main/skills/skill-ssh-relay-service.test.ts": 312,
+      "src/main/skills/skill-transaction-startup-recovery.test.ts": 332,
+      "src/main/skills/skill-update-convergence.test.ts": 76,
+      "src/main/skills/skill-update-outcome.test.ts": 306,
+      "src/main/skills/skill-update-registration.test.ts": 30,
+      "src/main/skills/skill-update-run.test.ts": 157,
+      "src/main/skills/skill-upload-process-restart-child.test.ts": 158,
+      "src/main/skills/skill-upload-process-restart.integration.test.ts": 155,
+      "src/main/skills/skill-upload-session-admission-regression.test.ts": 199,
+      "src/main/skills/skill-upload-session-service.test.ts": 240,
+      "src/main/skills/skill-windows-rename-contention.integration.test.ts": 43,
+      "src/main/skills/skill-windows-workspace.integration.test.ts": 180,
+      "src/main/skills/skill-wsl-delete.integration.test.ts": 55,
+      "src/main/skills/skill-wsl-install-filesystem.test.ts": 63,
+      "src/main/skills/skill-wsl-install-transaction.integration.test.ts": 256,
+      "src/main/skills/skill-wsl-posix-semantics.integration.test.ts": 225,
+      "src/main/skills/skill-wsl-provider-detection.test.ts": 46,
+      "src/main/source-control/forge-provider.test.ts": 259,
+      "src/main/source-control/hosted-review-azure-devops.integration.test.ts": 548,
+      "src/main/source-control/hosted-review-base-ref-suffix.test.ts": 210,
+      "src/main/source-control/hosted-review-bitbucket.integration.test.ts": 1294,
+      "src/main/source-control/hosted-review-branch-cache.test.ts": 669,
+      "src/main/source-control/hosted-review-creation-eligibility.test.ts": 325,
+      "src/main/source-control/hosted-review-creation-gitlab-self-hosted.test.ts": 194,
+      "src/main/source-control/hosted-review-creation-shared-symlinks.test.ts": 192,
+      "src/main/source-control/hosted-review-creation.test.ts": 230,
+      "src/main/source-control/hosted-review-dirty-preflight-wsl-paths.test.ts": 222,
+      "src/main/source-control/hosted-review-execution-host-routing.test.ts": 101,
+      "src/main/source-control/hosted-review-gitea.integration.test.ts": 850,
+      "src/main/source-control/hosted-review.test.ts": 112,
+      "src/main/source-control/pull-request-linked-issue.test.ts": 54,
+      "src/main/source-control/repo-default-branch.test.ts": 88,
+      "src/main/source-control/stacked-hosted-review-creation.test.ts": 44,
+      "src/main/speech/model-catalog.test.ts": 41,
+      "src/main/speech/model-manager-download-error.test.ts": 83,
+      "src/main/speech/model-manager-download-resume.test.ts": 3099,
+      "src/main/speech/model-manager-progress-callback.test.ts": 64,
+      "src/main/speech/model-manager-stream-cleanup.test.ts": 77,
+      "src/main/speech/model-manager-windows-path.test.ts": 242,
+      "src/main/speech/model-manager.test.ts": 140,
+      "src/main/speech/openai-api-key-store.test.ts": 53,
+      "src/main/speech/openai-transcription-client.test.ts": 51,
+      "src/main/speech/speech-model-deletion.test.ts": 158,
+      "src/main/speech/speech-model-download-response.test.ts": 62,
+      "src/main/speech/stt-offline-audio-chunker.test.ts": 155,
+      "src/main/speech/stt-service.test.ts": 86,
+      "src/main/speech/stt-worker-model-config.test.ts": 48,
+      "src/main/speech/stt-worker.test.ts": 38,
+      "src/main/sqlite/bun-readonly-wal.test.ts": 137,
+      "src/main/sqlite/sqlite-read-failure.test.ts": 60,
+      "src/main/sqlite/sync-database-concurrent-backup.test.ts": 815,
+      "src/main/sqlite/sync-database-portability.test.ts": 108,
+      "src/main/sqlite/sync-database.test.ts": 806,
+      "src/main/ssh-expired-lease-pane-readoption.test.ts": 1542,
+      "src/main/ssh-reattach-pane-cardinality.test.ts": 1109,
+      "src/main/ssh/orcad-activation-gate.test.ts": 56,
+      "src/main/ssh/orcad-activation-record.test.ts": 44,
+      "src/main/ssh/orcad-artifact-materializer.test.ts": 681,
+      "src/main/ssh/orcad-bun-runtime-materializer.test.ts": 357,
+      "src/main/ssh/orcad-deployment-target.test.ts": 195,
+      "src/main/ssh/orcad-remote-deploy.test.ts": 479,
+      "src/main/ssh/orcad-remote-gc.test.ts": 161,
+      "src/main/ssh/orcad-remote-install-termination.test.ts": 201,
+      "src/main/ssh/orcad-remote-launch.test.ts": 169,
+      "src/main/ssh/orcad-remote-rollback.test.ts": 254,
+      "src/main/ssh/orcad-remote-runtime.test.ts": 228,
+      "src/main/ssh/orcad-remote-shell-commands.integration.test.ts": 4806,
+      "src/main/ssh/orcad-state-snapshot.test.ts": 135,
+      "src/main/ssh/orcad-update-plan.test.ts": 62,
+      "src/main/ssh/relay-native-dependency-coverage.test.ts": 504,
+      "src/main/ssh/relay-protocol-backpressure.test.ts": 103,
+      "src/main/ssh/relay-protocol.test.ts": 70,
+      "src/main/ssh/relay-socket-path-limit-shell.integration.test.ts": 95,
+      "src/main/ssh/relay-socket-path-limit.test.ts": 194,
+      "src/main/ssh/remote-install-coexistence.test.ts": 50,
+      "src/main/ssh/remote-install-gc-termination.test.ts": 195,
+      "src/main/ssh/remote-install-model.test.ts": 224,
+      "src/main/ssh/removed-ssh-target-tombstone-retention.test.ts": 59,
+      "src/main/ssh/sftp-namespace-resolution.test.ts": 94,
+      "src/main/ssh/sftp-stream-late-error.test.ts": 177,
+      "src/main/ssh/sftp-upload.test.ts": 175,
+      "src/main/ssh/ssh-agent-identity-filter.test.ts": 47,
+      "src/main/ssh/ssh-channel-multiplexer-backpressure.test.ts": 98,
+      "src/main/ssh/ssh-channel-multiplexer-saturation-wedge.test.ts": 73,
+      "src/main/ssh/ssh-channel-multiplexer-settlement.test.ts": 77,
+      "src/main/ssh/ssh-channel-multiplexer.test.ts": 63,
+      "src/main/ssh/ssh-config-alias-claim.test.ts": 74,
+      "src/main/ssh/ssh-config-host-picker.test.ts": 318,
+      "src/main/ssh/ssh-config-loader-regression.test.ts": 156,
+      "src/main/ssh/ssh-config-loader.test.ts": 95,
+      "src/main/ssh/ssh-config-parser-host-patterns.test.ts": 51,
+      "src/main/ssh/ssh-config-parser.test.ts": 392,
+      "src/main/ssh/ssh-config-resolver.test.ts": 55,
+      "src/main/ssh/ssh-connect-attempt-cancellation.test.ts": 784,
+      "src/main/ssh/ssh-connection-auth-fallback.test.ts": 232,
+      "src/main/ssh/ssh-connection-channel-open.test.ts": 877,
+      "src/main/ssh/ssh-connection-direct-startup.test.ts": 192,
+      "src/main/ssh/ssh-connection-file-transfer.test.ts": 130,
+      "src/main/ssh/ssh-connection-generation.test.ts": 62,
+      "src/main/ssh/ssh-connection-github-probe.test.ts": 123,
+      "src/main/ssh/ssh-connection-gssapi-fallback.test.ts": 259,
+      "src/main/ssh/ssh-connection-host-key-store-wiring.test.ts": 462,
+      "src/main/ssh/ssh-connection-host-key-verification.test.ts": 157,
+      "src/main/ssh/ssh-connection-manager-registry.test.ts": 163,
+      "src/main/ssh/ssh-connection-manager.test.ts": 60,
+      "src/main/ssh/ssh-connection-reconnect-ladder.test.ts": 420,
+      "src/main/ssh/ssh-connection-sftp-namespace.test.ts": 901,
+      "src/main/ssh/ssh-connection-sftp-wire.test.ts": 2538,
+      "src/main/ssh/ssh-connection-store.test.ts": 100,
+      "src/main/ssh/ssh-connection-system-transport.test.ts": 252,
+      "src/main/ssh/ssh-connection-utils.test.ts": 213,
+      "src/main/ssh/ssh-connection.test.ts": 395,
+      "src/main/ssh/ssh-control-socket.test.ts": 47,
+      "src/main/ssh/ssh-file-stream-inactivity-deadline.test.ts": 68,
+      "src/main/ssh/ssh-file-transfer-abort.test.ts": 109,
+      "src/main/ssh/ssh-filesystem-stream-retention.test.ts": 122,
+      "src/main/ssh/ssh-g-config-resolution.test.ts": 82,
+      "src/main/ssh/ssh-git-response-stream-reader.test.ts": 61,
+      "src/main/ssh/ssh-git-stream-idle-timer.test.ts": 63,
+      "src/main/ssh/ssh-host-key-decision.test.ts": 60,
+      "src/main/ssh/ssh-host-key-store.test.ts": 238,
+      "src/main/ssh/ssh-host-key-verifier.test.ts": 70,
+      "src/main/ssh/ssh-known-hosts-source.test.ts": 104,
+      "src/main/ssh/ssh-known-hosts.test.ts": 106,
+      "src/main/ssh/ssh-multi-factor-authentication.test.ts": 1337,
+      "src/main/ssh/ssh-multi-key-authentication.test.ts": 161,
+      "src/main/ssh/ssh-multiplexer-transport-writer.test.ts": 77,
+      "src/main/ssh/ssh-multiplexer-writer-retention.test.ts": 538,
+      "src/main/ssh/ssh-orphan-relay-pty-sweep.test.ts": 72,
+      "src/main/ssh/ssh-orphan-sweep-pane-state-verdicts.test.ts": 95,
+      "src/main/ssh/ssh-owner-recovery-retry.test.ts": 69,
+      "src/main/ssh/ssh-pending-pty-kill-replay.test.ts": 78,
+      "src/main/ssh/ssh-port-forward.test.ts": 221,
+      "src/main/ssh/ssh-port-scanner.test.ts": 80,
+      "src/main/ssh/ssh-posix-command-wrapper.test.ts": 124,
+      "src/main/ssh/ssh-provider-authority.test.ts": 44,
+      "src/main/ssh/ssh-proxy-command.test.ts": 148,
+      "src/main/ssh/ssh-pty-consumer-recovery.test.ts": 61,
+      "src/main/ssh/ssh-pty-consumer-session.test.ts": 70,
+      "src/main/ssh/ssh-pty-recovery-retention-budget.test.ts": 34,
+      "src/main/ssh/ssh-pty-retired-source-deliveries.test.ts": 46,
+      "src/main/ssh/ssh-reconnect-error-classification.test.ts": 86,
+      "src/main/ssh/ssh-reconnect-ladder.test.ts": 153,
+      "src/main/ssh/ssh-relay-build-toolchain.test.ts": 154,
+      "src/main/ssh/ssh-relay-bundled-ripgrep.docker.test.ts": 318,
+      "src/main/ssh/ssh-relay-cross-version-isolation.test.ts": 265,
+      "src/main/ssh/ssh-relay-deploy-helpers.test.ts": 313,
+      "src/main/ssh/ssh-relay-deploy-incumbent-verdict.test.ts": 260,
+      "src/main/ssh/ssh-relay-deploy-staged-upload.test.ts": 502,
+      "src/main/ssh/ssh-relay-deploy-windows-pipe.test.ts": 207,
+      "src/main/ssh/ssh-relay-deploy.test.ts": 690,
+      "src/main/ssh/ssh-relay-endpoint-incumbent-shell.integration.test.ts": 2168,
+      "src/main/ssh/ssh-relay-endpoint-incumbent.test.ts": 99,
+      "src/main/ssh/ssh-relay-endpoint-takeover.test.ts": 116,
+      "src/main/ssh/ssh-relay-gc-claim-termination.test.ts": 174,
+      "src/main/ssh/ssh-relay-gc-retry.test.ts": 332,
+      "src/main/ssh/ssh-relay-incumbent-process.test.ts": 15877,
+      "src/main/ssh/ssh-relay-install-lock-termination.test.ts": 229,
+      "src/main/ssh/ssh-relay-install-lock.test.ts": 203,
+      "src/main/ssh/ssh-relay-install-namespace.test.ts": 186,
+      "src/main/ssh/ssh-relay-live-connect.test.ts": 214,
+      "src/main/ssh/ssh-relay-native-deps-cache-deploy.test.ts": 1792,
+      "src/main/ssh/ssh-relay-native-deps-cache-gc-real.test.ts": 1158,
+      "src/main/ssh/ssh-relay-native-deps-cache-shell.test.ts": 525,
+      "src/main/ssh/ssh-relay-native-deps-cache.test.ts": 236,
+      "src/main/ssh/ssh-relay-native-deps-install-staged-upload.test.ts": 255,
+      "src/main/ssh/ssh-relay-native-deps-install.test.ts": 14222,
+      "src/main/ssh/ssh-relay-native-deps-probe-verdict.test.ts": 418,
+      "src/main/ssh/ssh-relay-node-headers.test.ts": 1899,
+      "src/main/ssh/ssh-relay-node-pty-repair.test.ts": 124,
+      "src/main/ssh/ssh-relay-node-pty-spawn-repair.test.ts": 215,
+      "src/main/ssh/ssh-relay-offline-node-headers.docker.test.ts": 302,
+      "src/main/ssh/ssh-relay-opencode-runtime-commands.test.ts": 588,
+      "src/main/ssh/ssh-relay-opencode-runtime-retry.test.ts": 77,
+      "src/main/ssh/ssh-relay-opencode-runtime.test.ts": 392,
+      "src/main/ssh/ssh-relay-orphan-abandon-paths.test.ts": 2554,
+      "src/main/ssh/ssh-relay-pty-master-cloexec-install.test.ts": 2127,
+      "src/main/ssh/ssh-relay-repair-lock-termination.test.ts": 237,
+      "src/main/ssh/ssh-relay-reset.test.ts": 133,
+      "src/main/ssh/ssh-relay-ripgrep-cache-gc-real.test.ts": 521,
+      "src/main/ssh/ssh-relay-ripgrep-cache-gc.test.ts": 131,
+      "src/main/ssh/ssh-relay-ripgrep-install.test.ts": 389,
+      "src/main/ssh/ssh-relay-sentinel-copy-budget.test.ts": 115,
+      "src/main/ssh/ssh-relay-session-agent-hooks.integration.test.ts": 4019,
+      "src/main/ssh/ssh-relay-session-data-delivery.test.ts": 2680,
+      "src/main/ssh/ssh-relay-session-incarnation.test.ts": 2776,
+      "src/main/ssh/ssh-relay-session-managed-hooks.test.ts": 2737,
+      "src/main/ssh/ssh-relay-session-model-migration.test.ts": 3018,
+      "src/main/ssh/ssh-relay-session-orphan-sweep.test.ts": 2684,
+      "src/main/ssh/ssh-relay-session-pending-kill-replay.test.ts": 2344,
+      "src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts": 3189,
+      "src/main/ssh/ssh-relay-session-recovery-durability.test.ts": 4088,
+      "src/main/ssh/ssh-relay-session-recovery-races.test.ts": 3683,
+      "src/main/ssh/ssh-relay-session-rejected-delivery.test.ts": 3066,
+      "src/main/ssh/ssh-relay-session-relay-loss.test.ts": 2301,
+      "src/main/ssh/ssh-relay-session-terminal-error.test.ts": 2096,
+      "src/main/ssh/ssh-relay-session.test.ts": 10932,
+      "src/main/ssh/ssh-relay-sftp-namespace-install.test.ts": 475,
+      "src/main/ssh/ssh-relay-superseded-endpoints.test.ts": 197,
+      "src/main/ssh/ssh-relay-upload-cancel.docker.test.ts": 357,
+      "src/main/ssh/ssh-relay-upload-stage-commands.test.ts": 27518,
+      "src/main/ssh/ssh-relay-versioned-install-termination.test.ts": 155,
+      "src/main/ssh/ssh-relay-versioned-install.test.ts": 549,
+      "src/main/ssh/ssh-remote-cli-dispatch-refusal-passthrough.test.ts": 4113,
+      "src/main/ssh/ssh-remote-cli-format.test.ts": 54,
+      "src/main/ssh/ssh-remote-cli-host-passthrough.test.ts": 200,
+      "src/main/ssh/ssh-remote-cli-launcher.test.ts": 80,
+      "src/main/ssh/ssh-remote-cli-terminal-host-scope.test.ts": 3331,
+      "src/main/ssh/ssh-remote-commands.test.ts": 15974,
+      "src/main/ssh/ssh-remote-linear-activity-output.test.ts": 36,
+      "src/main/ssh/ssh-remote-linear-cli.test.ts": 4061,
+      "src/main/ssh/ssh-remote-linear-list-issues.test.ts": 61,
+      "src/main/ssh/ssh-remote-linear-relation-write.test.ts": 1192,
+      "src/main/ssh/ssh-remote-linear-save-issue.test.ts": 2067,
+      "src/main/ssh/ssh-remote-linear-truncation-output.test.ts": 39,
+      "src/main/ssh/ssh-remote-node-resolution.test.ts": 273,
+      "src/main/ssh/ssh-remote-node-toolchain-probe.test.ts": 241,
+      "src/main/ssh/ssh-remote-orca-cli.test.ts": 3176,
+      "src/main/ssh/ssh-remote-orchestration-compatibility.test.ts": 3146,
+      "src/main/ssh/ssh-remote-orchestration-send.test.ts": 29,
+      "src/main/ssh/ssh-remote-platform-detection.test.ts": 130,
+      "src/main/ssh/ssh-remote-platform.test.ts": 190,
+      "src/main/ssh/ssh-remote-powershell.test.ts": 238,
+      "src/main/ssh/ssh-remote-windows-command-line-limit.test.ts": 222,
+      "src/main/ssh/ssh-request-outcome-verdict.test.ts": 40,
+      "src/main/ssh/ssh-security-key-identity.test.ts": 179,
+      "src/main/ssh/ssh-session-limit-error.test.ts": 27,
+      "src/main/ssh/ssh-system-fallback.test.ts": 556,
+      "src/main/ssh/ssh-system-transport.integration.test.ts": 878,
+      "src/main/ssh/ssh-target-id-migration.test.ts": 41,
+      "src/main/ssh/ssh-target-readoption.test.ts": 64,
+      "src/main/ssh/system-ssh-binary.test.ts": 59,
+      "src/main/ssh/system-ssh-dynamic-forward-process.test.ts": 237,
+      "src/main/ssh/system-ssh-forward-process.test.ts": 233,
+      "src/main/ssh/system-ssh-sftp-args.test.ts": 38,
+      "src/main/ssh/system-ssh-sftp-path.test.ts": 54,
+      "src/main/ssh/system-ssh-windows-upload.test.ts": 415,
+      "src/main/ssh/system-ssh-windows-write-capabilities.test.ts": 56,
+      "src/main/ssh/vscode-ssh-authority.test.ts": 73,
+      "src/main/star-nag/service-direct-star.test.ts": 171,
+      "src/main/star-nag/service-force-show-races.test.ts": 260,
+      "src/main/star-nag/service-outcome-telemetry.test.ts": 189,
+      "src/main/star-nag/service-prompt-moments.test.ts": 229,
+      "src/main/star-nag/service-threshold-prompt.test.ts": 214,
+      "src/main/startup/bootstrap-fatal-exit-guard.test.ts": 26,
+      "src/main/startup/branch-rename-hook-structured-session.test.ts": 91,
+      "src/main/startup/browser-process-user-agent-ordering.test.ts": 3534,
+      "src/main/startup/cli-launch-redirect.test.ts": 77,
+      "src/main/startup/configure-process-dev-parent-shutdown.test.ts": 138,
+      "src/main/startup/configure-process-profile-state.test.ts": 86,
+      "src/main/startup/configure-process.test.ts": 457,
+      "src/main/startup/desktop-startup-ordering.test.ts": 54,
+      "src/main/startup/dev-education-suppression.test.ts": 195,
+      "src/main/startup/dev-instance-identity.test.ts": 49,
+      "src/main/startup/ensure-virtual-display.test.ts": 5118,
+      "src/main/startup/first-window-startup-services.test.ts": 59,
+      "src/main/startup/gpu-fallback-marker.test.ts": 51,
+      "src/main/startup/gpu-fallback-switches.test.ts": 61,
+      "src/main/startup/gpu-lifecycle-install-dir-acl-guard.test.ts": 549,
+      "src/main/startup/headless-pty-hydration-ordering.test.ts": 42,
+      "src/main/startup/host-port-bootstrap-wiring.test.ts": 37,
+      "src/main/startup/http1-compatibility-profile-state.test.ts": 65,
+      "src/main/startup/hydrate-shell-path.test.ts": 258,
+      "src/main/startup/hydrate-shell-path.windows.test.ts": 319,
+      "src/main/startup/legacy-worker-renderer-recovery.test.ts": 59,
+      "src/main/startup/login-shell-environment-cache.test.ts": 87,
+      "src/main/startup/login-shell-environment.test.ts": 112,
+      "src/main/startup/main-process-error-guards.test.ts": 73,
+      "src/main/startup/main-process-ready-activation-failure.test.ts": 351,
+      "src/main/startup/main-process-ready-identity-write.test.ts": 356,
+      "src/main/startup/main-process-ready-persistence-cleanup.test.ts": 216,
+      "src/main/startup/main-process-ready-phase-ordering.test.ts": 230,
+      "src/main/startup/main-process-runtime-launch-activation.test.ts": 356,
+      "src/main/startup/main-window-core-services.test.ts": 39,
+      "src/main/startup/main-window-structured-status-filter.test.ts": 347,
+      "src/main/startup/os-opened-markdown-delivery.test.ts": 218,
+      "src/main/startup/os-opened-markdown-files.test.ts": 130,
+      "src/main/startup/os-opened-markdown-wiring.test.ts": 48,
+      "src/main/startup/pre-gone-crash-sampling-wiring.test.ts": 36,
+      "src/main/startup/profile-state-recovery-preflight.test.ts": 556,
+      "src/main/startup/profile-state-write-failure.test.ts": 112,
+      "src/main/startup/renderer-heap-headroom.test.ts": 55,
+      "src/main/startup/run-electron-vite-dev-web.test.ts": 588,
+      "src/main/startup/run-electron-vite-dev.test.ts": 968,
+      "src/main/startup/secret-protection-report-deferral-wiring.test.ts": 58,
+      "src/main/startup/secure-dns-census.test.ts": 789,
+      "src/main/startup/serve-desktop-activation-wiring.test.ts": 30,
+      "src/main/startup/serve-desktop-activation.test.ts": 40,
+      "src/main/startup/serve-mode-argv-cli-redirect-order.test.ts": 53,
+      "src/main/startup/serve-mode-argv.test.ts": 85,
+      "src/main/startup/serve-options.test.ts": 67,
+      "src/main/startup/serve-signal-handlers.test.ts": 52,
+      "src/main/startup/single-instance-lock-exit.electron.test.ts": 622,
+      "src/main/startup/single-instance-lock-headless-exit.test.ts": 44,
+      "src/main/startup/single-instance-lock.test.ts": 59,
+      "src/main/startup/skill-share-deep-link-state.test.ts": 44,
+      "src/main/startup/startup-diagnostics.test.ts": 61,
+      "src/main/startup/window-all-closed-quit-policy.test.ts": 32,
+      "src/main/startup/windows-desktop-shell-path-startup.test.ts": 44,
+      "src/main/startup/windows-install-dir-acl-probe.test.ts": 147,
+      "src/main/startup/windows-install-dir-acl-recovery.test.ts": 887,
+      "src/main/startup/windows-install-dir-acl-repair.win32.test.ts": 78,
+      "src/main/startup/windows-install-dir-acl-startup-wiring.test.ts": 42,
+      "src/main/startup/windows-install-dir-package-acl-repair.test.ts": 112,
+      "src/main/startup/windows-shell-path-hydration.test.ts": 383,
+      "src/main/startup/windows-shell-path-ownership.test.ts": 62,
+      "src/main/startup/windows-shell-path-restoration.windows.test.ts": 51,
+      "src/main/startup/windows-user-data-acl.test.ts": 69,
+      "src/main/startup/wsl-cli-reconciliation-startup-barrier.test.ts": 34,
+      "src/main/stats/agent-session-transition-recorder.test.ts": 665,
+      "src/main/stats/collector-async-save.test.ts": 1081,
+      "src/main/stats/stats-title-detection-independence.test.ts": 45,
+      "src/main/synthetic-title-frame-routing.test.ts": 27,
+      "src/main/synthetic-title-spinner.test.ts": 52,
+      "src/main/synthetic-title-visibility.test.ts": 24,
+      "src/main/system-fonts.test.ts": 80,
+      "src/main/system-power-lifecycle.test.ts": 54,
+      "src/main/system-resume-broadcast.test.ts": 84,
+      "src/main/telemetry/burst-cap.test.ts": 206,
+      "src/main/telemetry/classify-error.test.ts": 43,
+      "src/main/telemetry/client-lifecycle.test.ts": 155,
+      "src/main/telemetry/client.test.ts": 258,
+      "src/main/telemetry/cohort-classifier.test.ts": 59,
+      "src/main/telemetry/consent.test.ts": 31,
+      "src/main/telemetry/install-id.test.ts": 65,
+      "src/main/telemetry/onboarding-cohort-classifier.test.ts": 171,
+      "src/main/telemetry/onboarding-feature-setup-validator.test.ts": 172,
+      "src/main/telemetry/validator-warn-cache.test.ts": 168,
+      "src/main/telemetry/validator.test.ts": 128,
+      "src/main/terminal-history-async-delete.test.ts": 569,
+      "src/main/terminal-history-gc-fs-call-count.test.ts": 181,
+      "src/main/terminal-history-gc.test.ts": 951,
+      "src/main/terminal-history-tombstone-retry.test.ts": 982,
+      "src/main/terminal-history-tombstone-scan-cost.test.ts": 428,
+      "src/main/terminal-history.test.ts": 92,
+      "src/main/text-generation/agent-failure-output.test.ts": 31,
+      "src/main/text-generation/command-environment-process.test.ts": 562,
+      "src/main/text-generation/command-environment-wsl.test.ts": 56,
+      "src/main/text-generation/commit-message-agent-environment.test.ts": 50,
+      "src/main/text-generation/commit-message-command-backslash-mode.test.ts": 182,
+      "src/main/text-generation/commit-message-text-generation-branch-name.test.ts": 172,
+      "src/main/text-generation/commit-message-text-generation-cancellation.test.ts": 672,
+      "src/main/text-generation/commit-message-text-generation-failure-sanitization.test.ts": 127,
+      "src/main/text-generation/commit-message-text-generation-generated-output.test.ts": 149,
+      "src/main/text-generation/commit-message-text-generation-linked-issue.test.ts": 216,
+      "src/main/text-generation/commit-message-text-generation-local-subprocess.test.ts": 228,
+      "src/main/text-generation/commit-message-text-generation-model-discovery.test.ts": 214,
+      "src/main/text-generation/commit-message-text-generation-regression.test.ts": 223,
+      "src/main/text-generation/commit-message-text-generation-remote-execution.test.ts": 215,
+      "src/main/text-generation/commit-message-text-generation-settings.test.ts": 299,
+      "src/main/text-generation/omp-model-discovery-policy.test.ts": 112,
+      "src/main/text-generation/pull-request-context-errors.test.ts": 61,
+      "src/main/text-generation/pull-request-context.test.ts": 58,
+      "src/main/tray/system-tray.test.ts": 134,
+      "src/main/tray/tray-attention-icon.test.ts": 58,
+      "src/main/tray/tray-dev-badge.test.ts": 60,
+      "src/main/update-install-exit-watchdog.test.ts": 64,
+      "src/main/updater-changelog.test.ts": 79,
+      "src/main/updater-events.test.ts": 205,
+      "src/main/updater-lifecycle-diagnostics.test.ts": 56,
+      "src/main/updater-linux-package-recovery-actions.test.ts": 2071,
+      "src/main/updater-nudge.test.ts": 74,
+      "src/main/updater-prerelease-feed-readiness.test.ts": 204,
+      "src/main/updater-prerelease-feed.test.ts": 210,
+      "src/main/updater-release-api-token.test.ts": 62,
+      "src/main/updater-release-build-cache.test.ts": 38,
+      "src/main/updater-release-builds.test.ts": 164,
+      "src/main/updater-test-harness.leaked-timers.test.ts": 2646,
+      "src/main/updater-test-module-loader.test.ts": 540,
+      "src/main/updater.build-channel-selection.test.ts": 2969,
+      "src/main/updater.check-failure.test.ts": 2612,
+      "src/main/updater.check-preflight.test.ts": 2566,
+      "src/main/updater.check-settlement.test.ts": 2937,
+      "src/main/updater.fallback.test.ts": 51,
+      "src/main/updater.feed-attempt-lifetime.test.ts": 1577,
+      "src/main/updater.headless-serve-install.test.ts": 315,
+      "src/main/updater.install-failure-cause.test.ts": 3143,
+      "src/main/updater.linux-externally-managed.test.ts": 2828,
+      "src/main/updater.linux-root-package-install.test.ts": 2144,
+      "src/main/updater.mac-install.test.ts": 54,
+      "src/main/updater.nudge-campaign.test.ts": 1952,
+      "src/main/updater.prerelease-fallback.test.ts": 4132,
+      "src/main/updater.publishing-window-feed.test.ts": 2272,
+      "src/main/updater.quit-and-install.test.ts": 2406,
+      "src/main/updater.startup-scheduling.test.ts": 2192,
+      "src/main/usage-worktree-canonicalizer.test.ts": 38,
+      "src/main/usage-worktree-metadata.test.ts": 57,
+      "src/main/usage/highest-usage-key.test.ts": 68,
+      "src/main/usage/jsonl-line-offsets.test.ts": 64,
+      "src/main/usage/usage-breakdown-scaling.test.ts": 109,
+      "src/main/usage/usage-calendar-range.test.ts": 62,
+      "src/main/usage/usage-provider-store-lifecycle.test.ts": 245,
+      "src/main/usage/usage-scan-worker-client.test.ts": 70,
+      "src/main/usage/usage-scan-worker-event-loop.test.ts": 3290,
+      "src/main/usage/usage-worktree-refs.test.ts": 45,
+      "src/main/usage/usage-worktree-resolver.test.ts": 114,
+      "src/main/warp-themes/discovery.test.ts": 98,
+      "src/main/warp-themes/index.test.ts": 679,
+      "src/main/warp-themes/manual-warp-theme-files.test.ts": 106,
+      "src/main/warp-themes/parser-runner.test.ts": 65,
+      "src/main/warp-themes/parser.test.ts": 55,
+      "src/main/warp-themes/theme-file-scanner.test.ts": 66,
+      "src/main/win32-utils-async-acl.test.ts": 49,
+      "src/main/win32-utils.test.ts": 73,
+      "src/main/window/attach-main-window-services.test.ts": 13208,
+      "src/main/window/clipboard-dashboard-popout-access.test.ts": 330,
+      "src/main/window/clipboard-file-copy.test.ts": 38,
+      "src/main/window/clipboard-image-temp-file.test.ts": 46,
+      "src/main/window/clipboard-image-thumbnail.test.ts": 35,
+      "src/main/window/clipboard-ipc-handlers.test.ts": 188,
+      "src/main/window/clipboard-remote-file-cleanup.bench.test.ts": 30,
+      "src/main/window/clipboard-remote-file-copy.test.ts": 70,
+      "src/main/window/clipboard-remote-file-staging-fs.test.ts": 56,
+      "src/main/window/clipboard-remote-file-staging.test.ts": 141,
+      "src/main/window/clipboard-runtime-owned-ssh-paste.test.ts": 99,
+      "src/main/window/clipboard-text-write-verify.test.ts": 37,
+      "src/main/window/clipboard-windows-image-file.test.ts": 57,
+      "src/main/window/createMainWindow-close-confirmation.test.ts": 1201,
+      "src/main/window/createMainWindow-markdown-editor-focus.test.ts": 1169,
+      "src/main/window/createMainWindow-recovery-reload-watchdog.test.ts": 1850,
+      "src/main/window/createMainWindow-renderer-crash-recovery.test.ts": 1634,
+      "src/main/window/createMainWindow-startup-reveal.test.ts": 1360,
+      "src/main/window/createMainWindow-system-resume-relay.test.ts": 1385,
+      "src/main/window/createMainWindow-terminal-focus-shortcuts.test.ts": 1341,
+      "src/main/window/createMainWindow-tray-minimize-close.test.ts": 876,
+      "src/main/window/createMainWindow-zoom-and-tab-switch-shortcuts.test.ts": 1287,
+      "src/main/window/createMainWindow.test.ts": 2476,
+      "src/main/window/dashboard-popout-window.test.ts": 162,
+      "src/main/window/editable-context-menu.test.ts": 89,
+      "src/main/window/focus-existing-window.test.ts": 75,
+      "src/main/window/foreground-activation-policy.test.ts": 36,
+      "src/main/window/history-gc-profile-worktree-ids.test.ts": 246,
+      "src/main/window/history-gc-worktree-ids.test.ts": 319,
+      "src/main/window/macos-app-activation.test.ts": 40,
+      "src/main/window/macos-tahoe-release.test.ts": 39,
+      "src/main/window/main-window-mouse-shortcuts.test.ts": 1533,
+      "src/main/window/main-window-visibility.test.ts": 38,
+      "src/main/window/main-window-webview-security.test.ts": 165,
+      "src/main/window/mobile-markdown-request-relay.test.ts": 57,
+      "src/main/window/privileged-window-navigation.test.ts": 178,
+      "src/main/window/renderer-document-navigation.test.ts": 40,
+      "src/main/window/renderer-publication-throttle.test.ts": 40,
+      "src/main/window/renderer-recovery-prompt.test.ts": 100,
+      "src/main/window/renderer-recovery-reload-watchdog.test.ts": 86,
+      "src/main/window/runtime-renderer-notification-sender.test.ts": 44,
+      "src/main/window/session-tab-close-request-relay.test.ts": 82,
+      "src/main/window/terminal-tab-close-request-relay.test.ts": 55,
+      "src/main/window/updater-package-recovery-ipc.test.ts": 4430,
+      "src/main/window/window-close-decision.test.ts": 41,
+      "src/main/windows-descendant-exit-verification.test.ts": 100,
+      "src/main/windows-live-tree-kill.win32.test.ts": 46,
+      "src/main/windows-process-tree-kill.test.ts": 61,
+      "src/main/windows-pty-root-identity.test.ts": 94,
+      "src/main/windows-registry-addon.test.ts": 33,
+      "src/main/windows/windows-command-line-recovery-health.test.ts": 49,
+      "src/main/windows/windows-host-job.win32.test.ts": 31,
+      "src/main/windows/windows-msys-job.win32.test.ts": 65,
+      "src/main/windows/windows-process-creation-time.test.ts": 51,
+      "src/main/windows/windows-process-table-cim-scan.test.ts": 51,
+      "src/main/windows/windows-process-table-native-addon.win32.test.ts": 37,
+      "src/main/windows/windows-process-table.test.ts": 261,
+      "src/main/windows/windows-process-tree-command-line-patch.test.ts": 37,
+      "src/main/windows/windows-pty-job.test.ts": 46,
+      "src/main/windows/windows-pty-job.win32.test.ts": 57,
+      "src/main/worker-thread-request-queue.test.ts": 75,
+      "src/main/workspace-cleanup-removal-snapshot-prune.test.ts": 70,
+      "src/main/workspace-cleanup-scan-snapshot.test.ts": 174,
+      "src/main/workspace-snapshot-pruning.bench.test.ts": 38,
+      "src/main/workspace-space-analysis-capacity.test.ts": 176,
+      "src/main/workspace-space-analysis-du-timeout.test.ts": 358,
+      "src/main/workspace-space-analysis-snapshot.test.ts": 134,
+      "src/main/workspace-space-analysis.test.ts": 359,
+      "src/main/workspace-space-repo-scan.test.ts": 330,
+      "src/main/workspace-space-scan-control.test.ts": 52,
+      "src/main/worktree-archive-hook-cannot-run.test.ts": 55,
+      "src/main/worktree-create-base-prefetch.test.ts": 287,
+      "src/main/worktree-create-base.test.ts": 37,
+      "src/main/worktree-create-candidates.test.ts": 38,
+      "src/main/worktree-create-execution-host-route.test.ts": 35,
+      "src/main/worktree-create-preparation-cancellation.test.ts": 148,
+      "src/main/worktree-create-preparation-claim.test.ts": 58,
+      "src/main/worktree-create-preparation-contention.test.ts": 95,
+      "src/main/worktree-create-preparation-timing.test.ts": 72,
+      "src/main/worktree-create-preparation-wsl-root.test.ts": 149,
+      "src/main/worktree-create-preparation.test.ts": 545,
+      "src/main/worktree-create-timing.test.ts": 39,
+      "src/main/worktree-identity-persistence.test.ts": 1325,
+      "src/main/worktree-lineage-pruning.test.ts": 81,
+      "src/main/worktree-metadata-ownership.test.ts": 39,
+      "src/main/worktree-name-retirement.test.ts": 115,
+      "src/main/worktree-prunable-git-file.test.ts": 58,
+      "src/main/worktree-removal-authority.test.ts": 64,
+      "src/main/worktree-removal-execution-host-route.test.ts": 52,
+      "src/main/worktree-removal-home-guard.test.ts": 88,
+      "src/main/worktree-removal-repo-owner.test.ts": 64,
+      "src/main/worktree-removal-safety.test.ts": 115,
+      "src/main/worktree-removal-session-partition-fencing.test.ts": 1523,
+      "src/main/worktree-retirement-backfill-scan.test.ts": 44,
+      "src/main/worktree-retirement-backfill-stall.test.ts": 141,
+      "src/main/worktree-retirement-discovery-wsl.test.ts": 148,
+      "src/main/worktree-retirement-discovery.test.ts": 121,
+      "src/main/worktree-retirement-namespace.test.ts": 80,
+      "src/main/worktree-root-preparation.test.ts": 106,
+      "src/main/worktree-trash.test.ts": 203,
+      "src/main/wsl-approved-root-race.wsl.test.ts": 68,
+      "src/main/wsl-availability-missing-kernel.test.ts": 74,
+      "src/main/wsl-bash-command.test.ts": 25,
+      "src/main/wsl-distro-list-output.test.ts": 35,
+      "src/main/wsl-distro-list-single-flight.test.ts": 81,
+      "src/main/wsl-fish-history-cleanup.test.ts": 55,
+      "src/main/wsl-interop-spawn-directory.test.ts": 56,
+      "src/main/wsl-managed-cli-path-restore.test.ts": 57,
+      "src/main/wsl-running-distros.test.ts": 242,
+      "src/main/wsl-running-path-filter.test.ts": 47,
+      "src/main/wsl-unc-delete-symlink-repro.test.ts": 61,
+      "src/main/wsl-unc-delete.test.ts": 111,
+      "src/main/wsl-unc-delete.wsl.test.ts": 88,
+      "src/main/wsl.test.ts": 128,
+      "src/main/wsl/wsl-executable-path.win32.test.ts": 34,
+      "src/main/wsl/wsl-guest-environment.test.ts": 110,
+      "src/main/wsl/wsl-invocation-boundary.test.ts": 10984,
+      "src/main/wsl/wsl-probe-failure-semantics.test.ts": 357,
+      "src/main/wsl/wsl-runner.test.ts": 58,
+      "src/main/wsl/wsl-runner.wsl.test.ts": 64,
+      "src/main/wsl/wsl-w1-w3-contract.test.ts": 42,
+      "src/main/zcode/hook-service.test.ts": 89,
+      "src/main/zcode/interactive-capability.live.test.ts": 45,
+      "src/preload/api/platform-bridge.test.ts": 46,
+      "src/preload/app-restart-checkpoint-routing.test.ts": 934,
+      "src/preload/browser-client-page-renderer-requests.test.ts": 158,
+      "src/preload/browser-find-subscriptions.test.ts": 45,
+      "src/preload/browser-window-close.test.ts": 39,
+      "src/preload/close-active-tab-payload-admission.test.ts": 51,
+      "src/preload/doc-preview-link-interception.test.ts": 446,
+      "src/preload/pty-snapshot-capability-ipc.test.ts": 678,
+      "src/preload/renderer-heap-statistics-reader.test.ts": 30,
+      "src/preload/renderer-process-memory-reader.test.ts": 53,
+      "src/preload/renderer-restart-wiring.test.ts": 44,
+      "src/preload/runtime-environment-subscriptions.test.ts": 66,
+      "src/preload/ssh-authority-forwarding.test.ts": 604,
+      "src/preload/updater-package-recovery.test.ts": 534,
+      "src/preload/usage-provider-api.test.ts": 47,
+      "src/relay/agent-exec-handler-windows.test.ts": 71,
+      "src/relay/agent-exec-handler.test.ts": 157,
+      "src/relay/agent-hook-envelope-publication.test.ts": 351,
+      "src/relay/agent-hook-integration.test.ts": 848,
+      "src/relay/agent-hook-retired-pane-suppression.test.ts": 451,
+      "src/relay/agent-hook-server-codex-subagent-transcript.test.ts": 1327,
+      "src/relay/agent-hook-server.test.ts": 1396,
+      "src/relay/agent-status-store-relay-context.test.ts": 144,
+      "src/relay/ai-vault-handler.test.ts": 689,
+      "src/relay/ai-vault-opencode-reader.test.ts": 405,
+      "src/relay/ai-vault-service-client.test.ts": 89,
+      "src/relay/ai-vault-service-ready-retention.test.ts": 195,
+      "src/relay/ai-vault-service-restart-policy.test.ts": 69,
+      "src/relay/ai-vault-service-spawn.test.ts": 54,
+      "src/relay/context.test.ts": 39,
+      "src/relay/dispatcher-capacity-degradation.test.ts": 194,
+      "src/relay/dispatcher-client-close-cause.test.ts": 194,
+      "src/relay/dispatcher-client-writer.test.ts": 92,
+      "src/relay/dispatcher-frame-guard-regressions.test.ts": 169,
+      "src/relay/dispatcher-json-payload.test.ts": 122,
+      "src/relay/dispatcher-notification-ownership.test.ts": 140,
+      "src/relay/dispatcher-per-connection-state-baseline.test.ts": 146,
+      "src/relay/dispatcher-rpc-cancel-id-coercion.test.ts": 134,
+      "src/relay/dispatcher-silent-client-reaper.test.ts": 213,
+      "src/relay/dispatcher-structured-error.test.ts": 136,
+      "src/relay/dispatcher-timeout.test.ts": 210,
+      "src/relay/dispatcher-writer-admission.test.ts": 161,
+      "src/relay/dispatcher.test.ts": 306,
+      "src/relay/external-automation-provider-catalog.test.ts": 59,
+      "src/relay/external-automations-handler-log-path.test.ts": 46,
+      "src/relay/external-automations-handler.test.ts": 77,
+      "src/relay/fs-handler-doc-preview.test.ts": 302,
+      "src/relay/fs-handler-file-range-dispatch.test.ts": 303,
+      "src/relay/fs-handler-file-range.test.ts": 201,
+      "src/relay/fs-handler-git-search.test.ts": 102,
+      "src/relay/fs-handler-list-files-cancel.test.ts": 83,
+      "src/relay/fs-handler-list-files-ignored.test.ts": 816,
+      "src/relay/fs-handler-list-files-result-limit.test.ts": 334,
+      "src/relay/fs-handler-readdir-fallback.test.ts": 88,
+      "src/relay/fs-handler-ripgrep-fallback.test.ts": 260,
+      "src/relay/fs-handler-stream.test.ts": 660,
+      "src/relay/fs-handler.test.ts": 805,
+      "src/relay/fs-list-files-cancel.integration.test.ts": 320,
+      "src/relay/fs-list-files-large-response.integration.test.ts": 596,
+      "src/relay/fs-list-files-scan-coordinator.test.ts": 42,
+      "src/relay/fs-path-metadata-requests.test.ts": 93,
+      "src/relay/fs-path-metadata-symlink-concurrency.test.ts": 79,
+      "src/relay/fs-search-cancellation.test.ts": 399,
+      "src/relay/fs-search-diagnosis-cancellation.test.ts": 165,
+      "src/relay/fs-search-line-fragments.test.ts": 204,
+      "src/relay/fs-stream-pty-echo-backpressure.integration.test.ts": 547,
+      "src/relay/git-branch-delete-refusal-parity.test.ts": 177,
+      "src/relay/git-exec-validator.test.ts": 41,
+      "src/relay/git-handler-blob-readers.test.ts": 45,
+      "src/relay/git-handler-branch-cleanup.test.ts": 95,
+      "src/relay/git-handler-branch-compare.test.ts": 98,
+      "src/relay/git-handler-branch-diff-equivalence.test.ts": 1189,
+      "src/relay/git-handler-branch-diff.test.ts": 348,
+      "src/relay/git-handler-check-ignore.test.ts": 39,
+      "src/relay/git-handler-diff-read-coalescing.test.ts": 448,
+      "src/relay/git-handler-file-diff.test.ts": 1263,
+      "src/relay/git-handler-fork-remote-exec.test.ts": 222,
+      "src/relay/git-handler-pull-reconciliation.test.ts": 1652,
+      "src/relay/git-handler-push-target.test.ts": 70,
+      "src/relay/git-handler-remote-sync.test.ts": 1894,
+      "src/relay/git-handler-staging.test.ts": 381,
+      "src/relay/git-handler-status-ops.test.ts": 101,
+      "src/relay/git-handler-submodule-cache-invalidation.test.ts": 181,
+      "src/relay/git-handler-submodule-ops.test.ts": 126,
+      "src/relay/git-handler-submodule-status-cancellation.test.ts": 141,
+      "src/relay/git-handler-termination.test.ts": 144,
+      "src/relay/git-handler-utils.test.ts": 25,
+      "src/relay/git-handler-working-tree-changes.test.ts": 1110,
+      "src/relay/git-handler-worktree-clean.test.ts": 41,
+      "src/relay/git-handler-worktree-git-capabilities.test.ts": 118,
+      "src/relay/git-handler-worktree-inspection.test.ts": 429,
+      "src/relay/git-handler-worktree-list-authority.test.ts": 110,
+      "src/relay/git-handler-worktree-list.test.ts": 41,
+      "src/relay/git-handler-worktree-ops.test.ts": 145,
+      "src/relay/git-handler-worktree-paths.test.ts": 63,
+      "src/relay/git-handler-worktree-provisioning.test.ts": 886,
+      "src/relay/git-handler.test.ts": 797,
+      "src/relay/git-porcelain-local-parity.test.ts": 314,
+      "src/relay/git-push-target-local-parity.test.ts": 192,
+      "src/relay/git-response-pty-echo-backpressure.integration.test.ts": 1021,
+      "src/relay/git-response-stream-ownership.test.ts": 61,
+      "src/relay/git-status-branch-line-total.test.ts": 362,
+      "src/relay/git-status-upstream-negative-cache.test.ts": 344,
+      "src/relay/git-stdout-stream.test.ts": 46,
+      "src/relay/git-working-file-read.test.ts": 58,
+      "src/relay/hermes-run-correlation.test.ts": 44,
+      "src/relay/hermes-run-history.test.ts": 85,
+      "src/relay/integration.test.ts": 1877,
+      "src/relay/legacy-relay-publication-ledger.test.ts": 36,
+      "src/relay/managed-hook-installer.test.ts": 117,
+      "src/relay/node-pty-binding-survey.test.ts": 246,
+      "src/relay/node-pty-unavailable-diagnosis.test.ts": 185,
+      "src/relay/omp-config-root.test.ts": 152,
+      "src/relay/omp-fresh-launch-environment.test.ts": 600,
+      "src/relay/plugin-overlay-env.test.ts": 60,
+      "src/relay/plugin-overlay.test.ts": 164,
+      "src/relay/plugin-source-limit.test.ts": 41,
+      "src/relay/port-scan-handler.test.ts": 190,
+      "src/relay/preflight-handler.test.ts": 97,
+      "src/relay/protocol-backpressure.test.ts": 87,
+      "src/relay/protocol-handshake.test.ts": 63,
+      "src/relay/protocol-json-payload.test.ts": 188,
+      "src/relay/pty-handler-attach-replay.test.ts": 414,
+      "src/relay/pty-handler-dispose-lifecycle.test.ts": 481,
+      "src/relay/pty-handler-grace-timer.test.ts": 346,
+      "src/relay/pty-handler-immediate-descendants.test.ts": 353,
+      "src/relay/pty-handler-inventory-process-evidence.test.ts": 324,
+      "src/relay/pty-handler-output-drain-differential.test.ts": 359,
+      "src/relay/pty-handler-output-streaming.test.ts": 1038,
+      "src/relay/pty-handler-ownership-attestation.test.ts": 450,
+      "src/relay/pty-handler-pi-owner-env.test.ts": 243,
+      "src/relay/pty-handler-resize-stale-pty.test.ts": 213,
+      "src/relay/pty-handler-retired-pane-surface.test.ts": 599,
+      "src/relay/pty-handler-revive.test.ts": 526,
+      "src/relay/pty-handler-shell-resolution.test.ts": 378,
+      "src/relay/pty-handler-shutdown-signals.test.ts": 373,
+      "src/relay/pty-handler-source-publication.test.ts": 1048,
+      "src/relay/pty-handler-spawn-admission.test.ts": 560,
+      "src/relay/pty-handler-spawn-cwd.test.ts": 328,
+      "src/relay/pty-handler-spawn-environment.test.ts": 555,
+      "src/relay/pty-handler-startup-command-delivery.test.ts": 381,
+      "src/relay/pty-handler-windows-child-process-evidence.test.ts": 208,
+      "src/relay/pty-replay-buffer-equivalence.test.ts": 356,
+      "src/relay/pty-shell-launch.test.ts": 229,
+      "src/relay/pty-shell-utils-process-cycles.test.ts": 122,
+      "src/relay/pty-shell-utils.test.ts": 195,
+      "src/relay/pty-source-credit-ledger.test.ts": 265,
+      "src/relay/pty-source-credit-scheduler.test.ts": 106,
+      "src/relay/pty-source-sent-boundaries.test.ts": 181,
+      "src/relay/relay-bundled-ripgrep.test.ts": 151,
+      "src/relay/relay-command-env.test.ts": 96,
+      "src/relay/relay-daemon-fatal-reap.test.ts": 1107,
+      "src/relay/relay-diagnostic-log.test.ts": 62,
+      "src/relay/relay-endpoint-credential-publication.test.ts": 2995,
+      "src/relay/relay-filesystem-watch-registry.test.ts": 344,
+      "src/relay/relay-grace-branch.test.ts": 52,
+      "src/relay/relay-handshake-roundtrip.test.ts": 495,
+      "src/relay/relay-hot-path-operation-counts.test.ts": 211,
+      "src/relay/relay-launch-options.test.ts": 48,
+      "src/relay/relay-oversized-notification-survival.test.ts": 335,
+      "src/relay/relay-primary-channel.test.ts": 104,
+      "src/relay/relay-pty-consumer-owner-displacement.test.ts": 199,
+      "src/relay/relay-pty-publication-admission.test.ts": 373,
+      "src/relay/relay-pty-source-cancellation-exit.test.ts": 238,
+      "src/relay/relay-pty-source-exit-publication.test.ts": 70,
+      "src/relay/relay-pty-source-publication.test.ts": 395,
+      "src/relay/relay-pty-source-recovery-completion.test.ts": 30,
+      "src/relay/relay-pty-source-recovery-interleavings.test.ts": 192,
+      "src/relay/relay-pty-source-recovery-window.test.ts": 220,
+      "src/relay/relay-pty-source-restore-retry.test.ts": 226,
+      "src/relay/relay-pty-source-send-scheduler.test.ts": 44,
+      "src/relay/relay-pty-source-superseded-activation.test.ts": 193,
+      "src/relay/relay-reconnect-listener-credential-gate.test.ts": 95,
+      "src/relay/relay-ripgrep-cwd-env.test.ts": 99,
+      "src/relay/relay-watch-root-capacity.test.ts": 208,
+      "src/relay/relay-watcher-event-emitter.test.ts": 673,
+      "src/relay/relay-watcher-frame-chunking.test.ts": 708,
+      "src/relay/relay-watcher-parent-removal.test.ts": 110,
+      "src/relay/relay-watcher-pending-setup-waiters.test.ts": 467,
+      "src/relay/relay-watcher-setup-wait.test.ts": 394,
+      "src/relay/relay-windows-path-ripgrep.test.ts": 68,
+      "src/relay/remote-artifact-cli-input.test.ts": 111,
+      "src/relay/remote-cli-env.test.ts": 31,
+      "src/relay/remote-cli-stdin.test.ts": 30,
+      "src/relay/remote-cli-timeout.test.ts": 61,
+      "src/relay/retired-pane-surfaces.test.ts": 29,
+      "src/relay/rotating-log-writer.test.ts": 68,
+      "src/relay/session-search-transport.test.ts": 172,
+      "src/relay/skill-install-handler.test.ts": 589,
+      "src/relay/skill-upload-multi-relay.integration.test.ts": 667,
+      "src/relay/ssh-pty-consumer-session-adapter.test.ts": 304,
+      "src/relay/ssh-pty-source-credit-adapter.test.ts": 124,
+      "src/relay/subprocess-tree-termination.test.ts": 41,
+      "src/relay/subprocess.test.ts": 26565,
+      "src/relay/terminal-history-wsl.test.ts": 77,
+      "src/relay/terminal-history.test.ts": 63,
+      "src/relay/windows-port-scan.test.ts": 107,
+      "src/relay/windows-port-scan.win32.test.ts": 71,
+      "src/relay/workspace-session-handler.test.ts": 87,
+      "src/relay/workspace-snapshot-publication.test.ts": 126,
+      "src/relay/workspace-space-scan-du-capacity.test.ts": 110,
+      "src/relay/workspace-space-scan.test.ts": 66,
+      "src/relay/wsl-agent-hook-relay.test.ts": 317,
+      "src/relay/wsl-hook-fs-bridge.test.ts": 39,
+      "src/relay/wsl-install-plugins-handler.test.ts": 161,
+      "src/renderer/src/app-shell/app-command-handlers-tab-rename.test.ts": 1093,
+      "src/renderer/src/app-shell/app-command-handlers-workspace-delete.test.ts": 97,
+      "src/renderer/src/app-shell/app-root-surface-settings.test.tsx": 721,
+      "src/renderer/src/app-shell/reconcile-hydrated-workspace-tab-models.test.ts": 35,
+      "src/renderer/src/app-shell/remote-workspace-unplaced-upload-suppression.test.tsx": 2317,
+      "src/renderer/src/app-shell/shutdown-checkpoint-persist.test.ts": 65,
+      "src/renderer/src/app-shell/shutdown-checkpoint-restart-lifecycle.test.ts": 401,
+      "src/renderer/src/app-shell/startup-actions-selector.test.ts": 127,
+      "src/renderer/src/app-shell/use-document-appearance.test.tsx": 2017,
+      "src/renderer/src/app-shell/window-visibility-actions-selector.test.ts": 697,
+      "src/renderer/src/app-shell/workspace-view-cross-client-sync.test.tsx": 1163,
+      "src/renderer/src/app-startup-routing.test.ts": 76,
+      "src/renderer/src/assets/diff-comment-draft-card-shadow-style.test.ts": 54,
+      "src/renderer/src/assets/mobile-page-qr-layout.test.ts": 39,
+      "src/renderer/src/assets/rich-markdown-task-list-style.test.ts": 48,
+      "src/renderer/src/assets/terminal-container-geometry.test.ts": 28,
+      "src/renderer/src/assets/terminal-scrollbar-style.test.ts": 27,
+      "src/renderer/src/assets/theme-utility-generation.test.ts": 45,
+      "src/renderer/src/assets/worktree-card-active-style.test.ts": 37,
+      "src/renderer/src/attention/agent-attention-policy.test.ts": 60,
+      "src/renderer/src/components/AgentStateDot.test.ts": 245,
+      "src/renderer/src/components/AgentWorkingSpinner.test.tsx": 531,
+      "src/renderer/src/components/LinuxPackageInstallRecoveryCard.test.tsx": 1570,
+      "src/renderer/src/components/NativeChatResumeOnRestartModal.test.tsx": 2709,
+      "src/renderer/src/components/NewWorkspaceComposerCard.set-location-warm.test.tsx": 1009,
+      "src/renderer/src/components/NewWorkspaceComposerCard.set-location.test.tsx": 1670,
+      "src/renderer/src/components/NewWorkspaceComposerCard.start-from.test.tsx": 1503,
+      "src/renderer/src/components/NewWorkspaceComposerCard.test.tsx": 3004,
+      "src/renderer/src/components/QuickOpen.mount-gating.test.tsx": 2554,
+      "src/renderer/src/components/SelectedTextCopyMenu.test.tsx": 725,
+      "src/renderer/src/components/StarNagCard.test.tsx": 617,
+      "src/renderer/src/components/StateIndicatorTooltip.test.tsx": 96,
+      "src/renderer/src/components/TerminalSearch.test.tsx": 663,
+      "src/renderer/src/components/TerminalTitlebarTabs.test.tsx": 583,
+      "src/renderer/src/components/TerminalWorkbenchContainer.test.tsx": 640,
+      "src/renderer/src/components/UpdateCard.error-card.test.tsx": 2112,
+      "src/renderer/src/components/UpdateCard.test.ts": 1299,
+      "src/renderer/src/components/WorktreeBaseFallbackDialog.test.tsx": 2306,
+      "src/renderer/src/components/WorktreeJumpPalette.linear-url.test.tsx": 5178,
+      "src/renderer/src/components/WorktreeJumpPalette.mount-gating.test.tsx": 2600,
+      "src/renderer/src/components/WorktreeJumpPalette.recent-tabs.behavior.test.tsx": 2441,
+      "src/renderer/src/components/WorktreeJumpPalette.recent-tabs.test.tsx": 8351,
+      "src/renderer/src/components/WorktreeJumpPalette.test.tsx": 4265,
+      "src/renderer/src/components/activity/ActivityPrototypePage.filter-focus-shortcut.test.ts": 1835,
+      "src/renderer/src/components/activity/ActivityPrototypePage.test.ts": 2064,
+      "src/renderer/src/components/activity/ActivityPrototypePage.thread-grouping.test.ts": 2740,
+      "src/renderer/src/components/activity/ActivityThreadOptionsMenu.test.tsx": 3734,
+      "src/renderer/src/components/activity/activity-answered-ask-timeline.test.tsx": 1929,
+      "src/renderer/src/components/activity/activity-auto-mark-read-loop.react185.test.tsx": 2221,
+      "src/renderer/src/components/activity/activity-clear-completed-hmr.test.ts": 2023,
+      "src/renderer/src/components/activity/activity-clear-completed.test.ts": 1835,
+      "src/renderer/src/components/activity/activity-event-builder-agent-context.test.ts": 1527,
+      "src/renderer/src/components/activity/activity-event-builder.bounded-history.test.ts": 2432,
+      "src/renderer/src/components/activity/activity-event-builder.host-ownership.test.ts": 2802,
+      "src/renderer/src/components/activity/activity-event-builder.identity-reuse.test.ts": 3038,
+      "src/renderer/src/components/activity/activity-event-builder.live-cap.test.ts": 2280,
+      "src/renderer/src/components/activity/activity-portal-churn-budget.test.ts": 53,
+      "src/renderer/src/components/activity/activity-portal-readiness-decay.react185.test.tsx": 2960,
+      "src/renderer/src/components/activity/activity-portal-readiness-loop.react185.test.tsx": 3091,
+      "src/renderer/src/components/activity/activity-portal-readiness-oscillation.test.ts": 47,
+      "src/renderer/src/components/activity/activity-portal-readiness-subscription-churn.react185.test.tsx": 3186,
+      "src/renderer/src/components/activity/activity-portal-thread-reconciliation.test.ts": 45,
+      "src/renderer/src/components/activity/activity-scope-filter.test.ts": 2628,
+      "src/renderer/src/components/activity/activity-terminal-portal-publication-loop.react185.test.tsx": 288,
+      "src/renderer/src/components/activity/activity-terminal-portal.test.tsx": 451,
+      "src/renderer/src/components/activity/activity-thread-actions.test.ts": 1194,
+      "src/renderer/src/components/activity/activity-thread-child-agent.test.ts": 1802,
+      "src/renderer/src/components/activity/activity-thread-grouping.search-cache.test.ts": 1360,
+      "src/renderer/src/components/activity/activity-thread-grouping.status-order.test.ts": 3981,
+      "src/renderer/src/components/activity/activity-thread-hover-card.test.tsx": 2877,
+      "src/renderer/src/components/activity/activity-thread-list-pane-collapsible.test.tsx": 3116,
+      "src/renderer/src/components/activity/activity-thread-list-pane.virtualization.test.tsx": 2331,
+      "src/renderer/src/components/activity/activity-thread-presentation.test.ts": 2334,
+      "src/renderer/src/components/activity/activity-thread-virtual-items.test.ts": 2318,
+      "src/renderer/src/components/activity/dev-activity-fixture.test.ts": 45,
+      "src/renderer/src/components/activity/event-time-clock-refresh.test.tsx": 1277,
+      "src/renderer/src/components/activity/use-activity-thread-action-bindings.test.tsx": 858,
+      "src/renderer/src/components/activity/useActivityUnreadCount.freshness.test.tsx": 1349,
+      "src/renderer/src/components/activity/useActivityUnreadCount.test.ts": 1568,
+      "src/renderer/src/components/agent-session-continuation/AgentSessionContinuationDialog.test.tsx": 567,
+      "src/renderer/src/components/agent-session-continuation/agent-session-continuation-selection.test.ts": 59,
+      "src/renderer/src/components/agent/AgentCombobox.test.tsx": 1607,
+      "src/renderer/src/components/agent/AgentSettingsDialog.test.tsx": 627,
+      "src/renderer/src/components/agent/agent-combobox-command-state.test.ts": 38,
+      "src/renderer/src/components/artifacts/ArtifactCollection.test.tsx": 2261,
+      "src/renderer/src/components/artifacts/ArtifactPreview.test.tsx": 778,
+      "src/renderer/src/components/artifacts/ArtifactPublishButton.test.tsx": 842,
+      "src/renderer/src/components/artifacts/ArtifactsPage.test.tsx": 1366,
+      "src/renderer/src/components/artifacts/artifact-display-labels.test.ts": 106,
+      "src/renderer/src/components/artifacts/artifact-list-search.test.ts": 120,
+      "src/renderer/src/components/artifacts/artifact-list-windowing.test.tsx": 6815,
+      "src/renderer/src/components/artifacts/artifact-publish-flow.test.ts": 77,
+      "src/renderer/src/components/artifacts/artifact-published-link-client.test.ts": 52,
+      "src/renderer/src/components/automations/AutomationDestinationField.test.tsx": 1082,
+      "src/renderer/src/components/automations/AutomationDetail.host.test.tsx": 647,
+      "src/renderer/src/components/automations/AutomationDetail.test.tsx": 780,
+      "src/renderer/src/components/automations/AutomationEditorPromptEditor.test.tsx": 454,
+      "src/renderer/src/components/automations/AutomationHostBadges.test.tsx": 695,
+      "src/renderer/src/components/automations/AutomationHostFilterNotice.test.tsx": 1055,
+      "src/renderer/src/components/automations/AutomationListEmptyView.test.tsx": 798,
+      "src/renderer/src/components/automations/AutomationListHostGroups.test.tsx": 926,
+      "src/renderer/src/components/automations/AutomationListLocalRows.test.tsx": 955,
+      "src/renderer/src/components/automations/AutomationListSearchField.test.tsx": 511,
+      "src/renderer/src/components/automations/AutomationListTableHeader.test.tsx": 928,
+      "src/renderer/src/components/automations/AutomationOwnerConflictNotice.test.tsx": 892,
+      "src/renderer/src/components/automations/AutomationPromptDisclosure.test.tsx": 1140,
+      "src/renderer/src/components/automations/AutomationRunHistory.test.tsx": 1578,
+      "src/renderer/src/components/automations/AutomationRunsDashboardSurface.test.tsx": 623,
+      "src/renderer/src/components/automations/AutomationRunsTable.test.tsx": 1058,
+      "src/renderer/src/components/automations/AutomationSchedulePicker.render.test.tsx": 1285,
+      "src/renderer/src/components/automations/AutomationSchedulePicker.test.ts": 1456,
+      "src/renderer/src/components/automations/AutomationTimeField.test.tsx": 1061,
+      "src/renderer/src/components/automations/AutomationsDetailPane.run-count.test.tsx": 1899,
+      "src/renderer/src/components/automations/AutomationsDetailPane.test.tsx": 2085,
+      "src/renderer/src/components/automations/AutomationsListPanel.test.tsx": 1538,
+      "src/renderer/src/components/automations/AutomationsPage.create-destination.test.tsx": 2720,
+      "src/renderer/src/components/automations/AutomationsPage.cross-authority-actions.test.tsx": 1339,
+      "src/renderer/src/components/automations/AutomationsPage.escape-precedence.test.tsx": 2204,
+      "src/renderer/src/components/automations/AutomationsPage.external-scope.test.tsx": 1221,
+      "src/renderer/src/components/automations/AutomationsPage.notice-recovery.test.tsx": 1235,
+      "src/renderer/src/components/automations/AutomationsPage.refresh-selection.test.tsx": 1796,
+      "src/renderer/src/components/automations/AutomationsPage.run-visibility.test.tsx": 1594,
+      "src/renderer/src/components/automations/AutomationsPage.save-visibility.test.tsx": 1106,
+      "src/renderer/src/components/automations/AutomationsPage.strict-mode-save-visibility.test.tsx": 1789,
+      "src/renderer/src/components/automations/AutomationsPage.test.tsx": 3102,
+      "src/renderer/src/components/automations/AutomationsPageBreadcrumb.test.tsx": 708,
+      "src/renderer/src/components/automations/ExternalAutomationManagers.test.tsx": 922,
+      "src/renderer/src/components/automations/automation-authority-identity.test.ts": 54,
+      "src/renderer/src/components/automations/automation-captured-owner.test.ts": 107,
+      "src/renderer/src/components/automations/automation-create-destination.test.ts": 85,
+      "src/renderer/src/components/automations/automation-create-projects.test.ts": 35,
+      "src/renderer/src/components/automations/automation-detail-tab-navigation.test.ts": 300,
+      "src/renderer/src/components/automations/automation-editor-prompt-options.test.ts": 52,
+      "src/renderer/src/components/automations/automation-external-target-match.test.ts": 58,
+      "src/renderer/src/components/automations/automation-host-cache-controller.test.ts": 139,
+      "src/renderer/src/components/automations/automation-host-cache-health.test.ts": 56,
+      "src/renderer/src/components/automations/automation-host-cache.test.ts": 83,
+      "src/renderer/src/components/automations/automation-host-catalog-generation.test.ts": 84,
+      "src/renderer/src/components/automations/automation-host-catalog-order.test.ts": 51,
+      "src/renderer/src/components/automations/automation-host-catalog-source.test.ts": 64,
+      "src/renderer/src/components/automations/automation-host-catalog.test.ts": 140,
+      "src/renderer/src/components/automations/automation-host-client.test.ts": 70,
+      "src/renderer/src/components/automations/automation-host-detail-display.test.ts": 47,
+      "src/renderer/src/components/automations/automation-host-diagnostics.test.ts": 141,
+      "src/renderer/src/components/automations/automation-host-filter-resolution.test.ts": 84,
+      "src/renderer/src/components/automations/automation-host-health.test.ts": 26,
+      "src/renderer/src/components/automations/automation-host-invalidation-window-events.test.ts": 69,
+      "src/renderer/src/components/automations/automation-host-invalidation.test.ts": 50,
+      "src/renderer/src/components/automations/automation-host-list-rows.test.ts": 140,
+      "src/renderer/src/components/automations/automation-host-orphan-entry.test.ts": 160,
+      "src/renderer/src/components/automations/automation-host-picker-groups.test.ts": 58,
+      "src/renderer/src/components/automations/automation-host-recovery.test.ts": 56,
+      "src/renderer/src/components/automations/automation-host-scale-gates.test.ts": 400,
+      "src/renderer/src/components/automations/automation-host-scheduler.test.ts": 147,
+      "src/renderer/src/components/automations/automation-host-status-descriptors.test.ts": 90,
+      "src/renderer/src/components/automations/automation-legacy-schedule-editing.test.ts": 1751,
+      "src/renderer/src/components/automations/automation-list-empty-state.test.ts": 144,
+      "src/renderer/src/components/automations/automation-list-focus-recovery.test.ts": 43,
+      "src/renderer/src/components/automations/automation-list-keyboard-navigation.test.ts": 38,
+      "src/renderer/src/components/automations/automation-list-last-run.test.ts": 146,
+      "src/renderer/src/components/automations/automation-list-row-identity.test.ts": 377,
+      "src/renderer/src/components/automations/automation-list-search-rows.test.ts": 318,
+      "src/renderer/src/components/automations/automation-list-search.test.ts": 75,
+      "src/renderer/src/components/automations/automation-list-view-sort.test.ts": 458,
+      "src/renderer/src/components/automations/automation-list-view.test.ts": 99,
+      "src/renderer/src/components/automations/automation-project-groups.test.ts": 62,
+      "src/renderer/src/components/automations/automation-run-completion-evidence.test.ts": 58,
+      "src/renderer/src/components/automations/automation-run-context.test.ts": 36,
+      "src/renderer/src/components/automations/automation-run-history-keyboard-navigation.test.ts": 400,
+      "src/renderer/src/components/automations/automation-run-open-target.test.ts": 54,
+      "src/renderer/src/components/automations/automation-run-output-snapshot-equivalence.test.ts": 135,
+      "src/renderer/src/components/automations/automation-run-output-snapshot.test.ts": 78,
+      "src/renderer/src/components/automations/automation-run-view-state.test.ts": 40,
+      "src/renderer/src/components/automations/automation-runs-dashboard-model.test.ts": 38,
+      "src/renderer/src/components/automations/automation-scoped-list-client.test.ts": 127,
+      "src/renderer/src/components/automations/automation-setup-decision.test.ts": 1515,
+      "src/renderer/src/components/automations/automation-source-display.test.ts": 41,
+      "src/renderer/src/components/automations/automation-target-availability.test.ts": 60,
+      "src/renderer/src/components/automations/automation-usage-model.test.ts": 65,
+      "src/renderer/src/components/automations/automation-write-invalidation.test.ts": 53,
+      "src/renderer/src/components/automations/external-automation-display.test.ts": 66,
+      "src/renderer/src/components/automations/external-automation-list-entries.test.ts": 43,
+      "src/renderer/src/components/automations/external-automation-run-table-state.test.ts": 43,
+      "src/renderer/src/components/automations/external-automation-scope-gating.test.ts": 66,
+      "src/renderer/src/components/automations/external-automation-scope-keys.test.ts": 58,
+      "src/renderer/src/components/automations/external-automation-source-availability.test.ts": 55,
+      "src/renderer/src/components/automations/hermes-cron-output-parse.test.ts": 65,
+      "src/renderer/src/components/automations/use-automation-host-catalog-readoption.test.tsx": 810,
+      "src/renderer/src/components/automations/use-automation-host-catalog.test.tsx": 602,
+      "src/renderer/src/components/automations/use-automation-list-focus-recovery.test.tsx": 556,
+      "src/renderer/src/components/automations/use-automation-list-search.test.tsx": 673,
+      "src/renderer/src/components/automations/use-automation-runs-dashboard.test.tsx": 805,
+      "src/renderer/src/components/automations/use-external-automation-scope-retention.test.tsx": 329,
+      "src/renderer/src/components/automations/use-selected-automation-run-history.test.tsx": 747,
+      "src/renderer/src/components/browser-cookie-import-google-disclosure.test.tsx": 1424,
+      "src/renderer/src/components/browser-favicon.test.tsx": 631,
+      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.chrome-parity.test.tsx": 2176,
+      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.dead-guest.test.tsx": 2978,
+      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.download-notices.test.tsx": 2775,
+      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.drag-focus.test.tsx": 2007,
+      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.failure-remount.test.tsx": 2651,
+      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.markup.test.tsx": 2864,
+      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.popup-notices.test.tsx": 1804,
+      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.test.tsx": 1822,
+      "src/renderer/src/components/browser-pane/ReopenBrowserPageOnServerButton.test.tsx": 986,
+      "src/renderer/src/components/browser-pane/annotate/BrowserAnnotationSendMenuContent.test.tsx": 69,
+      "src/renderer/src/components/browser-pane/annotate/GrabConfirmationSheet.test.ts": 400,
+      "src/renderer/src/components/browser-pane/annotate/browser-annotation-output.test.ts": 95,
+      "src/renderer/src/components/browser-pane/annotate/browser-page-annotation-tray.test.tsx": 2934,
+      "src/renderer/src/components/browser-pane/annotate/markup-drawing-model.test.ts": 55,
+      "src/renderer/src/components/browser-pane/annotate/markup-screenshot-compose.test.ts": 70,
+      "src/renderer/src/components/browser-pane/annotate/markup-shape-render.test.ts": 69,
+      "src/renderer/src/components/browser-pane/annotate/use-browser-page-annotation-send.test.tsx": 1194,
+      "src/renderer/src/components/browser-pane/annotate/use-markup-draw-hint.test.ts": 587,
+      "src/renderer/src/components/browser-pane/annotate/useGrabMode.test.ts": 823,
+      "src/renderer/src/components/browser-pane/annotate/useMarkupEditor.test.ts": 590,
+      "src/renderer/src/components/browser-pane/annotate/useMarkupPointerHandlers.test.ts": 455,
+      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserAddressBar.test.tsx": 651,
+      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserFind.test.tsx": 996,
+      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.remote-link-routing.test.ts": 70,
+      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.render-ipc.test.ts": 35,
+      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.webview-preferences.test.ts": 607,
+      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserPaneOverlayLayer.test.tsx": 830,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-address-bar-expansion.test.ts": 39,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-address-bar-suggestions.test.ts": 155,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-folded-tools.test.tsx": 529,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-toolbar.test.tsx": 1087,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-deferred-lifecycle.test.tsx": 2498,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-detected-browsers-summary.test.ts": 30,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-egress-indicator.test.tsx": 1863,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-import-hint-visibility.test.ts": 51,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-navigation-control-row.test.tsx": 1001,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-page-zoom-indicator.test.tsx": 652,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-pane-page-selection.test.ts": 48,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-workspace-pane.adoption-chrome.test.tsx": 11725,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-workspace-pane.retention-props.test.tsx": 2366,
+      "src/renderer/src/components/browser-pane/assemble-chrome/context-menu-positioning.test.ts": 29,
+      "src/renderer/src/components/browser-pane/assemble-chrome/ssh-routed-browser-page-gate.test.tsx": 2237,
+      "src/renderer/src/components/browser-pane/assemble-chrome/use-browser-chrome-tool-fold.test.tsx": 439,
+      "src/renderer/src/components/browser-pane/assemble-chrome/use-browser-page-chrome-focus.test.tsx": 2365,
+      "src/renderer/src/components/browser-pane/assemble-chrome/use-browser-page-find-shortcuts.test.tsx": 1627,
+      "src/renderer/src/components/browser-pane/browser-client-page-metadata-publisher.test.ts": 302,
+      "src/renderer/src/components/browser-pane/browser-client-page-metadata-route-census.test.ts": 39,
+      "src/renderer/src/components/browser-pane/browser-client-page-position-driver.test.ts": 369,
+      "src/renderer/src/components/browser-pane/browser-client-page-renderer-installation.test.ts": 502,
+      "src/renderer/src/components/browser-pane/browser-client-page-retained-drag-passthrough.test.ts": 538,
+      "src/renderer/src/components/browser-pane/browser-client-page-retained-registry.test.ts": 441,
+      "src/renderer/src/components/browser-pane/browser-download-destination-toast.test.ts": 47,
+      "src/renderer/src/components/browser-pane/browser-reopen-on-server.test.ts": 150,
+      "src/renderer/src/components/browser-pane/describe-page/browser-annotation-geometry.test.ts": 197,
+      "src/renderer/src/components/browser-pane/describe-page/browser-artifact-upload.test.ts": 1993,
+      "src/renderer/src/components/browser-pane/describe-page/browser-favicon-url.test.ts": 31,
+      "src/renderer/src/components/browser-pane/describe-page/browser-overlay-shortcut-target.test.ts": 1253,
+      "src/renderer/src/components/browser-pane/describe-page/browser-page-url-display.test.ts": 1564,
+      "src/renderer/src/components/browser-pane/describe-page/live-browser-url-registry.test.ts": 44,
+      "src/renderer/src/components/browser-pane/host-guest/browser-automation-visibility.test.ts": 32,
+      "src/renderer/src/components/browser-pane/host-guest/browser-focus.test.ts": 304,
+      "src/renderer/src/components/browser-pane/host-guest/browser-guest-eviction-veto.test.ts": 1550,
+      "src/renderer/src/components/browser-pane/host-guest/browser-guest-page-id-identity.test.ts": 1555,
+      "src/renderer/src/components/browser-pane/host-guest/browser-guest-paint-retention.test.ts": 1611,
+      "src/renderer/src/components/browser-pane/host-guest/browser-guest-retention-site-census.test.ts": 743,
+      "src/renderer/src/components/browser-pane/host-guest/browser-guest-worktree-retention.test.ts": 1570,
+      "src/renderer/src/components/browser-pane/host-guest/browser-keyboard.test.ts": 483,
+      "src/renderer/src/components/browser-pane/host-guest/browser-page-evicted-guest-recovery.test.ts": 592,
+      "src/renderer/src/components/browser-pane/host-guest/browser-page-favicon-retention.test.ts": 875,
+      "src/renderer/src/components/browser-pane/host-guest/browser-page-guest-recovery.test.ts": 829,
+      "src/renderer/src/components/browser-pane/host-guest/browser-page-paintability.test.ts": 35,
+      "src/renderer/src/components/browser-pane/host-guest/browser-page-registration-ownership.test.ts": 994,
+      "src/renderer/src/components/browser-pane/host-guest/browser-page-viewport.test.ts": 389,
+      "src/renderer/src/components/browser-pane/host-guest/browser-page-webview-surface.test.ts": 554,
+      "src/renderer/src/components/browser-pane/host-guest/browser-page-webview.test.ts": 316,
+      "src/renderer/src/components/browser-pane/host-guest/browser-page-zoom.test.ts": 83,
+      "src/renderer/src/components/browser-pane/host-guest/browser-system-resume.test.ts": 314,
+      "src/renderer/src/components/browser-pane/host-guest/browser-worktree-surface-paintability.test.ts": 45,
+      "src/renderer/src/components/browser-pane/host-guest/use-browser-page-keyboard-shortcuts.split.test.tsx": 2091,
+      "src/renderer/src/components/browser-pane/host-guest/use-browser-page-slot-viewport.test.ts": 517,
+      "src/renderer/src/components/browser-pane/host-guest/use-browser-page-viewport-scroll-reporting.test.tsx": 605,
+      "src/renderer/src/components/browser-pane/host-guest/use-webview-drag-passthrough-active.test.tsx": 365,
+      "src/renderer/src/components/browser-pane/host-guest/webview-registry.test.ts": 73,
+      "src/renderer/src/components/browser-pane/navigate/browser-address-bar-navigation.test.ts": 206,
+      "src/renderer/src/components/browser-pane/navigate/browser-download-progress.test.ts": 59,
+      "src/renderer/src/components/browser-pane/navigate/browser-load-failure-overlay.test.tsx": 670,
+      "src/renderer/src/components/browser-pane/navigate/browser-notices.test.ts": 114,
+      "src/renderer/src/components/browser-pane/navigate/browser-page-download-activity.test.ts": 39,
+      "src/renderer/src/components/browser-pane/navigate/browser-reload-action.test.ts": 60,
+      "src/renderer/src/components/browser-pane/navigate/browser-webview-load-failure.test.ts": 143,
+      "src/renderer/src/components/browser-pane/navigate/chromium-error-page-poll-visibility.test.ts": 1983,
+      "src/renderer/src/components/browser-pane/navigate/chromium-error-page-polling.test.ts": 40,
+      "src/renderer/src/components/browser-pane/navigate/use-browser-page-reload-actions.test.tsx": 2074,
+      "src/renderer/src/components/browser-pane/restored-client-hosted-recovery-window.test.tsx": 2926,
+      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-frame-style.test.ts": 30,
+      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-keyboard.test.ts": 51,
+      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-input-model.test.ts": 32,
+      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.address-bar.test.tsx": 2538,
+      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.chrome-chords.test.tsx": 1822,
+      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-errors.test.ts": 97,
+      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-lifecycle.test.ts": 349,
+      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-restart-scheduler.test.ts": 60,
+      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-status.test.ts": 104,
+      "src/renderer/src/components/browser-pane/stream-remote/use-remote-browser-page-navigation.test.ts": 2231,
+      "src/renderer/src/components/browser-pane/stream-remote/use-remote-browser-stream-activation.test.ts": 542,
+      "src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.failure-message.test.tsx": 3716,
+      "src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx": 3550,
+      "src/renderer/src/components/browser-pane/workspace-doc/doc-preview-document-actions.test.ts": 365,
+      "src/renderer/src/components/browser-pane/workspace-doc/doc-preview-document-identity.test.ts": 52,
+      "src/renderer/src/components/browser-pane/workspace-doc/doc-preview-external-link-confirmation.test.ts": 168,
+      "src/renderer/src/components/browser-pane/workspace-doc/doc-preview-webview-attach.test.ts": 433,
+      "src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.lazy-ref.test.tsx": 513,
+      "src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts": 414,
+      "src/renderer/src/components/browser-pane/workspace-doc/workspace-doc-page-pane.test.tsx": 390,
+      "src/renderer/src/components/browser-webauthn-account-dialog.test.tsx": 813,
+      "src/renderer/src/components/cmd-j/palette-activation-focus-routing.test.ts": 57,
+      "src/renderer/src/components/cmd-j/palette-duplicate-key-ghost-rows.test.tsx": 467,
+      "src/renderer/src/components/cmd-j/palette-filter-option-list.test.ts": 33,
+      "src/renderer/src/components/cmd-j/palette-filter-options.test.ts": 107,
+      "src/renderer/src/components/cmd-j/palette-filter.test.ts": 73,
+      "src/renderer/src/components/cmd-j/palette-focus-restore-target.test.ts": 491,
+      "src/renderer/src/components/cmd-j/palette-host-badge.test.ts": 126,
+      "src/renderer/src/components/cmd-j/palette-list-entry-render-keys.test.ts": 45,
+      "src/renderer/src/components/cmd-j/palette-live-status.test.tsx": 1777,
+      "src/renderer/src/components/cmd-j/palette-query-tokens.test.ts": 65,
+      "src/renderer/src/components/cmd-j/palette-results.test.ts": 271,
+      "src/renderer/src/components/cmd-j/palette-section-render-cap.test.ts": 53,
+      "src/renderer/src/components/cmd-j/palette-session-age.test.ts": 69,
+      "src/renderer/src/components/cmd-j/plugin-quick-actions.test.ts": 150,
+      "src/renderer/src/components/cmd-j/quick-action-context.test.ts": 1653,
+      "src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts": 104,
+      "src/renderer/src/components/cmd-j/worktree-palette-cache-inputs.test.ts": 41,
+      "src/renderer/src/components/codex-restart-chip.test.tsx": 2063,
+      "src/renderer/src/components/codex-restart-notice-key.test.ts": 63,
+      "src/renderer/src/components/comment-code-context-state.test.ts": 34,
+      "src/renderer/src/components/comment-reply-target-state.test.ts": 51,
+      "src/renderer/src/components/confirmation-dialog-refresh-boundary.test.ts": 1586,
+      "src/renderer/src/components/confirmation-dialog.test.tsx": 1122,
+      "src/renderer/src/components/confirmation-skip-preference.test.ts": 157,
+      "src/renderer/src/components/connect-dialog-outside-dismiss.test.tsx": 1677,
+      "src/renderer/src/components/contextual-tours/ContextualTourControl.test.ts": 1553,
+      "src/renderer/src/components/contextual-tours/ContextualTourOverlay.remeasure.test.tsx": 2477,
+      "src/renderer/src/components/contextual-tours/ContextualTourOverlay.test.tsx": 2265,
+      "src/renderer/src/components/contextual-tours/ContextualTourOverlay.visibility.test.tsx": 4465,
+      "src/renderer/src/components/contextual-tours/ContextualTourOverlaySurface.localization.test.tsx": 1925,
+      "src/renderer/src/components/contextual-tours/contextual-tour-floating-position.test.ts": 2237,
+      "src/renderer/src/components/contextual-tours/contextual-tour-gate.test.ts": 52,
+      "src/renderer/src/components/contextual-tours/contextual-tour-overlay-measurement.test.ts": 2147,
+      "src/renderer/src/components/contextual-tours/contextual-tour-step-actions.test.ts": 55,
+      "src/renderer/src/components/contextual-tours/request-contextual-tour-when-ready.test.ts": 1567,
+      "src/renderer/src/components/contextual-tours/use-contextual-tour.test.ts": 1611,
+      "src/renderer/src/components/contextual-tours/workspace-creation-tour-handoff.test.ts": 1626,
+      "src/renderer/src/components/crash-report/CrashReportDialogSurface.overflow.test.tsx": 1063,
+      "src/renderer/src/components/crash-report/crash-report-submit-notice.test.ts": 99,
+      "src/renderer/src/components/crash-report/use-crash-report-copy.test.tsx": 469,
+      "src/renderer/src/components/dashboard-popout/AgentKanbanBoard.test.tsx": 1770,
+      "src/renderer/src/components/dashboard-popout/AgentKanbanCard.test.tsx": 1455,
+      "src/renderer/src/components/dashboard-popout/AgentTerminalDialog.test.tsx": 1261,
+      "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.clipboard-routes.test.tsx": 2804,
+      "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx": 1099,
+      "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-geometry.test.tsx": 2141,
+      "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-lifetime.test.tsx": 1461,
+      "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx": 2518,
+      "src/renderer/src/components/dashboard-popout/DashboardHostBadge.test.tsx": 824,
+      "src/renderer/src/components/dashboard-popout/DashboardPopoutRoot.test.tsx": 406,
+      "src/renderer/src/components/dashboard-popout/agent-board-filtering.test.ts": 45,
+      "src/renderer/src/components/dashboard-popout/dashboard-agent-status-patch.test.ts": 42,
+      "src/renderer/src/components/dashboard-popout/preview-grid-claim.test.ts": 467,
+      "src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts": 611,
+      "src/renderer/src/components/dashboard-popout/preview-terminal-options.test.ts": 450,
+      "src/renderer/src/components/dashboard-popout/preview-terminal-right-click-paste.test.ts": 1921,
+      "src/renderer/src/components/dashboard-popout/preview-terminal-shortcuts.test.ts": 391,
+      "src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts": 54,
+      "src/renderer/src/components/dashboard-popout/terminal-preview-unavailable-message.test.ts": 77,
+      "src/renderer/src/components/dashboard-popout/useDashboardSnapshot.test.tsx": 381,
+      "src/renderer/src/components/dashboard/AgentDashboardDrawer.test.tsx": 2133,
+      "src/renderer/src/components/dashboard/AgentDashboardSettingsMenu.test.tsx": 1129,
+      "src/renderer/src/components/dashboard/DashboardAgentRow.test.tsx": 1861,
+      "src/renderer/src/components/dashboard/agent-dashboard-performance-isolation.test.ts": 46,
+      "src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts": 56,
+      "src/renderer/src/components/dashboard/agent-row-lineage-model.test.ts": 117,
+      "src/renderer/src/components/dashboard/agent-row-pane-live-title.test.ts": 34,
+      "src/renderer/src/components/dashboard/build-dashboard-bucket-counts.allocation.test.ts": 192,
+      "src/renderer/src/components/dashboard/build-dashboard-bucket-counts.cache.test.ts": 213,
+      "src/renderer/src/components/dashboard/build-dashboard-bucket-counts.equivalence.test.ts": 129,
+      "src/renderer/src/components/dashboard/build-dashboard-snapshot-folder-workspace.test.ts": 1728,
+      "src/renderer/src/components/dashboard/build-dashboard-snapshot-orchestration-routing.test.ts": 1618,
+      "src/renderer/src/components/dashboard/build-dashboard-snapshot.rows-cache.test.ts": 907,
+      "src/renderer/src/components/dashboard/build-dashboard-snapshot.test.ts": 1818,
+      "src/renderer/src/components/dashboard/dashboard-card-context.test.ts": 60,
+      "src/renderer/src/components/dashboard/dashboard-card-labels.test.ts": 43,
+      "src/renderer/src/components/dashboard/dashboard-card-terminal-input.test.ts": 1383,
+      "src/renderer/src/components/dashboard/dashboard-worktree-launch-options.test.ts": 75,
+      "src/renderer/src/components/dashboard/launch-dashboard-agent.test.ts": 53,
+      "src/renderer/src/components/dashboard/use-agent-row-conversation-name.test.ts": 90,
+      "src/renderer/src/components/dashboard/useAgentBucketCounts.gate.test.ts": 218,
+      "src/renderer/src/components/dashboard/useAgentBucketCounts.test.tsx": 594,
+      "src/renderer/src/components/dashboard/useDashboardPopoutBridge.test.tsx": 824,
+      "src/renderer/src/components/dashboard/useLiveDashboardSnapshot.test.ts": 2326,
+      "src/renderer/src/components/dashboard/useRetainedAgents.test.ts": 1992,
+      "src/renderer/src/components/dashboard/useRetainedAgentsSync.test.ts": 971,
+      "src/renderer/src/components/dictation/DictationIndicator.localization.test.ts": 394,
+      "src/renderer/src/components/dictation/DictationIndicator.test.tsx": 761,
+      "src/renderer/src/components/dictation/dictation-audio-meter.test.ts": 37,
+      "src/renderer/src/components/dictation/dictation-final-segments.test.ts": 53,
+      "src/renderer/src/components/dictation/dictation-insertion-target.test.ts": 535,
+      "src/renderer/src/components/dictation/dictation-meter-store.test.tsx": 356,
+      "src/renderer/src/components/dictation/dictation-stopped-sessions.test.ts": 39,
+      "src/renderer/src/components/dictation/microphone-devices.test.ts": 225,
+      "src/renderer/src/components/dictation/use-hold-dictation-gesture.test.tsx": 436,
+      "src/renderer/src/components/diff-comments/DiffCommentCard.resize.test.tsx": 833,
+      "src/renderer/src/components/diff-comments/DiffCommentDraftCard.test.tsx": 2221,
+      "src/renderer/src/components/diff-comments/diff-comment-draft-zone.test.tsx": 2636,
+      "src/renderer/src/components/diff-comments/diff-comment-drag-auto-scroll.test.ts": 35,
+      "src/renderer/src/components/diff-comments/diff-comment-line-range.test.ts": 45,
+      "src/renderer/src/components/diff-comments/diff-comment-popover-outside-click.test.tsx": 1653,
+      "src/renderer/src/components/diff-comments/diff-comment-popover-position.test.ts": 51,
+      "src/renderer/src/components/diff-comments/diff-comment-range-drag.test.ts": 4994,
+      "src/renderer/src/components/diff-comments/diff-comment-zone-mouse-events.test.ts": 75,
+      "src/renderer/src/components/diff-comments/useDiffCommentDecorator.commentable-lines.test.tsx": 2302,
+      "src/renderer/src/components/diff-comments/useDiffCommentDecorator.model-lifecycle.test.tsx": 10560,
+      "src/renderer/src/components/diff-comments/useDiffCommentDecorator.range-selection.test.tsx": 9340,
+      "src/renderer/src/components/editor/ChangesModeView.test.tsx": 732,
+      "src/renderer/src/components/editor/CheckRunCopyButton.test.tsx": 913,
+      "src/renderer/src/components/editor/CheckRunDetailsPanel.copy.test.tsx": 2524,
+      "src/renderer/src/components/editor/ConflictComponents.test.tsx": 456,
+      "src/renderer/src/components/editor/EditorContent.markdown-classification.test.tsx": 2582,
+      "src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx": 2668,
+      "src/renderer/src/components/editor/EditorContent.test.tsx": 2479,
+      "src/renderer/src/components/editor/EditorEditFileSurface.monaco-containment.test.tsx": 2094,
+      "src/renderer/src/components/editor/EditorFileLoadErrorView.test.tsx": 931,
+      "src/renderer/src/components/editor/EditorPanel.markdown-classification-memoization.test.tsx": 3127,
+      "src/renderer/src/components/editor/EditorPanelHeader.test.tsx": 1141,
+      "src/renderer/src/components/editor/EditorPanelHeaderPath.test.tsx": 3424,
+      "src/renderer/src/components/editor/EditorPanelMarkdownActionsMenu.test.tsx": 234,
+      "src/renderer/src/components/editor/EditorPanelShell.header.test.tsx": 157,
+      "src/renderer/src/components/editor/ExternalFileChangeBanner.test.tsx": 261,
+      "src/renderer/src/components/editor/ExternalFileChangeCompareDialog.test.tsx": 671,
+      "src/renderer/src/components/editor/ImageViewer.test.tsx": 132,
+      "src/renderer/src/components/editor/IpynbKernelToolbar.test.tsx": 1349,
+      "src/renderer/src/components/editor/IpynbRendering.test.tsx": 2742,
+      "src/renderer/src/components/editor/LargeDiffLoadPrompt.test.tsx": 657,
+      "src/renderer/src/components/editor/MarkdownPreview.link-routing.interaction.test.tsx": 1262,
+      "src/renderer/src/components/editor/MarkdownPreview.test.ts": 2737,
+      "src/renderer/src/components/editor/MarkdownPreview.toc-visibility-gate.test.tsx": 1364,
+      "src/renderer/src/components/editor/MarkdownPreviewBody.test.tsx": 579,
+      "src/renderer/src/components/editor/MarkdownTableOfContentsPanel.test.tsx": 1063,
+      "src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx": 6383,
+      "src/renderer/src/components/editor/MonacoEditor.font-family.test.tsx": 2152,
+      "src/renderer/src/components/editor/NotesSendMenu.test.tsx": 302,
+      "src/renderer/src/components/editor/PdfFind.test.tsx": 881,
+      "src/renderer/src/components/editor/ReviewNotesSendMenuContent.test.tsx": 156,
+      "src/renderer/src/components/editor/RichMarkdownErrorBoundary.lazy-chunk.test.tsx": 640,
+      "src/renderer/src/components/editor/RichMarkdownLinkBubble.render.test.tsx": 1046,
+      "src/renderer/src/components/editor/RichMarkdownLinkBubble.test.ts": 437,
+      "src/renderer/src/components/editor/RichMarkdownSearchBar.ime-enter.test.tsx": 1007,
+      "src/renderer/src/components/editor/RichMarkdownSlashMenu.test.tsx": 326,
+      "src/renderer/src/components/editor/RichMarkdownTableControls.test.tsx": 2235,
+      "src/renderer/src/components/editor/check-annotation-open.test.ts": 84,
+      "src/renderer/src/components/editor/check-annotation-path.test.ts": 39,
+      "src/renderer/src/components/editor/check-job-step-status.test.ts": 34,
+      "src/renderer/src/components/editor/check-run-clipboard-text.test.ts": 42,
+      "src/renderer/src/components/editor/check-run-details-fix-with-ai.test.ts": 542,
+      "src/renderer/src/components/editor/check-run-details-tab.test.ts": 33,
+      "src/renderer/src/components/editor/closed-editor-model-lifetime.test.ts": 2002,
+      "src/renderer/src/components/editor/closed-editor-model-reentrancy.test.ts": 7076,
+      "src/renderer/src/components/editor/closed-editor-model-registry.test.ts": 8037,
+      "src/renderer/src/components/editor/closed-editor-model-shell.test.tsx": 4841,
+      "src/renderer/src/components/editor/closed-editor-tab-cache-sweep.test.ts": 55,
+      "src/renderer/src/components/editor/closed-editor-tab-disposal.test.ts": 219,
+      "src/renderer/src/components/editor/closed-editor-view-state-retention.test.ts": 4770,
+      "src/renderer/src/components/editor/combined-diff-on-demand-load.test.ts": 49,
+      "src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-collapsed-work.test.tsx": 780,
+      "src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-render.test.tsx": 1657,
+      "src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-row-drag.test.tsx": 501,
+      "src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-windowing.test.tsx": 970,
+      "src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree.test.ts": 86,
+      "src/renderer/src/components/editor/combined-diff/browse-files/use-combined-diff-file-tree-resize.test.tsx": 368,
+      "src/renderer/src/components/editor/combined-diff/browse-files/use-combined-diff-tree-navigation.test.ts": 591,
+      "src/renderer/src/components/editor/combined-diff/load-sections/combined-diff-initial-section-load.test.ts": 46,
+      "src/renderer/src/components/editor/combined-diff/load-sections/combined-diff-load-scheduler.test.ts": 53,
+      "src/renderer/src/components/editor/combined-diff/load-sections/combined-diff-section-connection.test.ts": 1433,
+      "src/renderer/src/components/editor/combined-diff/load-sections/combined-diff-section-load-state.test.ts": 38,
+      "src/renderer/src/components/editor/combined-diff/remember-view/use-combined-diff-view-restore.test.tsx": 560,
+      "src/renderer/src/components/editor/combined-diff/resolve-changes/combined-diff-entries.test.ts": 50,
+      "src/renderer/src/components/editor/combined-diff/resolve-changes/combined-diff-section-cache-match.test.ts": 55,
+      "src/renderer/src/components/editor/combined-diff/resolve-changes/combined-diff-section-scaling.test.tsx": 602,
+      "src/renderer/src/components/editor/combined-diff/resolve-changes/use-combined-diff-section-index-map.test.tsx": 664,
+      "src/renderer/src/components/editor/combined-diff/review-controls/combined-diff-commit-message.test.ts": 48,
+      "src/renderer/src/components/editor/combined-diff/scroll-viewport/combined-diff-restore-signal-equivalence.test.tsx": 552,
+      "src/renderer/src/components/editor/combined-diff/scroll-viewport/combined-diff-scrollbar-drag.test.ts": 59,
+      "src/renderer/src/components/editor/conflict-review-file-tree-windowing.test.tsx": 2238,
+      "src/renderer/src/components/editor/csv-parse.test.ts": 122,
+      "src/renderer/src/components/editor/details-markdown-html.test.ts": 99,
+      "src/renderer/src/components/editor/diff-editor-hide-unchanged-options.test.ts": 35,
+      "src/renderer/src/components/editor/diff-editor-line-number-options.test.ts": 48,
+      "src/renderer/src/components/editor/diff-editor-shift-wheel-scroll.test.ts": 484,
+      "src/renderer/src/components/editor/diff-editor-whitespace-options.test.ts": 30,
+      "src/renderer/src/components/editor/diff-editor-word-wrap-options.test.ts": 43,
+      "src/renderer/src/components/editor/diff-line-stats.test.ts": 56,
+      "src/renderer/src/components/editor/diff-model-swap-view-state.test.ts": 524,
+      "src/renderer/src/components/editor/diff-monaco-model-disposal.test.ts": 67,
+      "src/renderer/src/components/editor/diff-navigation-context.test.tsx": 1956,
+      "src/renderer/src/components/editor/diff-section-comment-submit.test.ts": 114,
+      "src/renderer/src/components/editor/diff-section-layout.test.ts": 68,
+      "src/renderer/src/components/editor/diff-section-preview.test.ts": 1595,
+      "src/renderer/src/components/editor/diff-viewer-large-diff-save-action.test.ts": 112,
+      "src/renderer/src/components/editor/editor-autosave-conflict-flow.test.ts": 574,
+      "src/renderer/src/components/editor/editor-autosave-controller.test.ts": 500,
+      "src/renderer/src/components/editor/editor-autosave.test.ts": 152,
+      "src/renderer/src/components/editor/editor-cmd-save-target.test.ts": 225,
+      "src/renderer/src/components/editor/editor-content-dirty-state.test.ts": 62,
+      "src/renderer/src/components/editor/editor-external-watch-path-index.test.ts": 1558,
+      "src/renderer/src/components/editor/editor-file-save-attempt.test.ts": 70,
+      "src/renderer/src/components/editor/editor-header-file-rename.test.ts": 608,
+      "src/renderer/src/components/editor/editor-header.test.ts": 37,
+      "src/renderer/src/components/editor/editor-labels.test.ts": 37,
+      "src/renderer/src/components/editor/editor-model-uri.test.ts": 127,
+      "src/renderer/src/components/editor/editor-panel-diff-reload.test.ts": 26,
+      "src/renderer/src/components/editor/editor-panel-draft-selector.test.ts": 38,
+      "src/renderer/src/components/editor/editor-panel-git-entry-selector.test.ts": 63,
+      "src/renderer/src/components/editor/editor-panel-render-model.test.ts": 2036,
+      "src/renderer/src/components/editor/editor-path-display.test.ts": 38,
+      "src/renderer/src/components/editor/editor-path-move-inflight.test.ts": 60,
+      "src/renderer/src/components/editor/editor-restored-tab-conflict-scan.test.ts": 445,
+      "src/renderer/src/components/editor/editor-self-write-registry.test.ts": 69,
+      "src/renderer/src/components/editor/editor-shortcuts.test.ts": 526,
+      "src/renderer/src/components/editor/export-active-markdown.test.ts": 396,
+      "src/renderer/src/components/editor/file-editor-word-wrap-options.test.ts": 46,
+      "src/renderer/src/components/editor/image-viewer-zoom.test.ts": 55,
+      "src/renderer/src/components/editor/ipynb-ansi.test.ts": 54,
+      "src/renderer/src/components/editor/ipynb-code-cell-lines.test.ts": 121,
+      "src/renderer/src/components/editor/ipynb-kernel-outputs.test.ts": 33,
+      "src/renderer/src/components/editor/ipynb-kernel-session.test.ts": 183,
+      "src/renderer/src/components/editor/ipynb-kernel-setup-commands.test.ts": 54,
+      "src/renderer/src/components/editor/ipynb-parse.test.ts": 77,
+      "src/renderer/src/components/editor/large-diff-render-limit.test.ts": 171,
+      "src/renderer/src/components/editor/line-copy-path.test.ts": 34,
+      "src/renderer/src/components/editor/local-log-tail-decoder.test.ts": 47,
+      "src/renderer/src/components/editor/markdown-artifact-upload.test.ts": 64,
+      "src/renderer/src/components/editor/markdown-dirty-state.test.ts": 317,
+      "src/renderer/src/components/editor/markdown-doc-completions.test.ts": 57,
+      "src/renderer/src/components/editor/markdown-doc-links.test.ts": 173,
+      "src/renderer/src/components/editor/markdown-document-list-request.test.ts": 308,
+      "src/renderer/src/components/editor/markdown-document-worktree-path-selector.test.ts": 1467,
+      "src/renderer/src/components/editor/markdown-export-extract.test.ts": 606,
+      "src/renderer/src/components/editor/markdown-export-html.test.ts": 47,
+      "src/renderer/src/components/editor/markdown-frontmatter.test.ts": 49,
+      "src/renderer/src/components/editor/markdown-heading-slug.test.ts": 48,
+      "src/renderer/src/components/editor/markdown-internal-links.test.ts": 54,
+      "src/renderer/src/components/editor/markdown-preview-annotation-shortcut.test.ts": 458,
+      "src/renderer/src/components/editor/markdown-preview-controls.test.ts": 45,
+      "src/renderer/src/components/editor/markdown-preview-links.test.ts": 74,
+      "src/renderer/src/components/editor/markdown-preview-local-images.test.ts": 458,
+      "src/renderer/src/components/editor/markdown-preview-search-crash.test.tsx": 408,
+      "src/renderer/src/components/editor/markdown-preview-search.test.ts": 87,
+      "src/renderer/src/components/editor/markdown-preview-url-transform.test.ts": 151,
+      "src/renderer/src/components/editor/markdown-reference-link-normalization.test.ts": 64,
+      "src/renderer/src/components/editor/markdown-render-mode.test.ts": 53,
+      "src/renderer/src/components/editor/markdown-rich-comment-scan.test.ts": 191,
+      "src/renderer/src/components/editor/markdown-rich-line-scan.test.ts": 1513,
+      "src/renderer/src/components/editor/markdown-rich-mode-eligibility-cache.test.ts": 1351,
+      "src/renderer/src/components/editor/markdown-rich-mode.test.ts": 2072,
+      "src/renderer/src/components/editor/markdown-rich-size-limit.test.ts": 117,
+      "src/renderer/src/components/editor/markdown-round-trip.test.ts": 2234,
+      "src/renderer/src/components/editor/markdown-scanner-boundaries.test.ts": 121,
+      "src/renderer/src/components/editor/markdown-table-of-contents.test.ts": 275,
+      "src/renderer/src/components/editor/markdown-toc-collapse-state.test.ts": 56,
+      "src/renderer/src/components/editor/markdown-toc-visibility-gate.test.ts": 229,
+      "src/renderer/src/components/editor/markdown-tokenizer-start.test.ts": 80,
+      "src/renderer/src/components/editor/mermaid-config.test.ts": 27,
+      "src/renderer/src/components/editor/monaco-auto-height.test.ts": 97,
+      "src/renderer/src/components/editor/monaco-codebase-search.test.ts": 71,
+      "src/renderer/src/components/editor/monaco-conflict-decorations.test.ts": 83,
+      "src/renderer/src/components/editor/monaco-content-sync.test.ts": 53,
+      "src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts": 1055,
+      "src/renderer/src/components/editor/monaco-context-menu-paste.test.ts": 547,
+      "src/renderer/src/components/editor/monaco-cursor-line-lifetime.test.ts": 552,
+      "src/renderer/src/components/editor/monaco-find-options.test.ts": 36,
+      "src/renderer/src/components/editor/monaco-find-widget.test.ts": 492,
+      "src/renderer/src/components/editor/monaco-large-text-paste.test.ts": 282,
+      "src/renderer/src/components/editor/monaco-markdown-doc-link-decorations.offset-scan.test.ts": 169,
+      "src/renderer/src/components/editor/monaco-markdown-doc-link-decorations.test.ts": 74,
+      "src/renderer/src/components/editor/monaco-markdown-selection-annotation.test.ts": 41,
+      "src/renderer/src/components/editor/monaco-programmatic-sync.test.ts": 35,
+      "src/renderer/src/components/editor/monaco-reveal-range.test.ts": 53,
+      "src/renderer/src/components/editor/monaco-view-state-persistence.test.ts": 31,
+      "src/renderer/src/components/editor/pdf-js-document-options.test.ts": 34,
+      "src/renderer/src/components/editor/pdf-scale-preference-storage.test.ts": 42,
+      "src/renderer/src/components/editor/pdf-scale-preference.test.ts": 67,
+      "src/renderer/src/components/editor/pdf-view-position.test.ts": 51,
+      "src/renderer/src/components/editor/pending-editor-focus-request.test.ts": 23,
+      "src/renderer/src/components/editor/position-stable-node-view-update.test.ts": 49,
+      "src/renderer/src/components/editor/raw-markdown-comment-scan.test.ts": 88,
+      "src/renderer/src/components/editor/raw-markdown-html.blank-run.test.ts": 302,
+      "src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts": 2399,
+      "src/renderer/src/components/editor/rich-markdown-auto-focus.test.ts": 425,
+      "src/renderer/src/components/editor/rich-markdown-block-source-work.test.ts": 2647,
+      "src/renderer/src/components/editor/rich-markdown-code-block-languages.test.ts": 135,
+      "src/renderer/src/components/editor/rich-markdown-commands.test.ts": 1938,
+      "src/renderer/src/components/editor/rich-markdown-context-command-routing.test.ts": 2415,
+      "src/renderer/src/components/editor/rich-markdown-cut.test.ts": 794,
+      "src/renderer/src/components/editor/rich-markdown-details-case.test.ts": 1964,
+      "src/renderer/src/components/editor/rich-markdown-details-keyboard.test.ts": 2040,
+      "src/renderer/src/components/editor/rich-markdown-doc-link.test.ts": 40,
+      "src/renderer/src/components/editor/rich-markdown-document-fidelity.test.ts": 2200,
+      "src/renderer/src/components/editor/rich-markdown-editor-click-routing.test.ts": 145,
+      "src/renderer/src/components/editor/rich-markdown-editor-config.test.ts": 1687,
+      "src/renderer/src/components/editor/rich-markdown-empty-paragraph-delete.test.ts": 277,
+      "src/renderer/src/components/editor/rich-markdown-escape-fidelity.test.ts": 2267,
+      "src/renderer/src/components/editor/rich-markdown-extension.test.ts": 278,
+      "src/renderer/src/components/editor/rich-markdown-html-superscript-link.test.ts": 2950,
+      "src/renderer/src/components/editor/rich-markdown-image-insert-code-block.test.ts": 1229,
+      "src/renderer/src/components/editor/rich-markdown-image-insert.test.ts": 1296,
+      "src/renderer/src/components/editor/rich-markdown-inline-image-paragraph.test.ts": 1666,
+      "src/renderer/src/components/editor/rich-markdown-inline-source-tokenization.test.ts": 1619,
+      "src/renderer/src/components/editor/rich-markdown-key-handler.test.ts": 2540,
+      "src/renderer/src/components/editor/rich-markdown-large-text-paste.test.ts": 435,
+      "src/renderer/src/components/editor/rich-markdown-link-clipboard.test.ts": 346,
+      "src/renderer/src/components/editor/rich-markdown-link-shortcut.test.ts": 2061,
+      "src/renderer/src/components/editor/rich-markdown-list-continuation.test.ts": 337,
+      "src/renderer/src/components/editor/rich-markdown-list-tokenizers.test.ts": 94,
+      "src/renderer/src/components/editor/rich-markdown-literal-serialization.test.ts": 189,
+      "src/renderer/src/components/editor/rich-markdown-local-image.test.ts": 1442,
+      "src/renderer/src/components/editor/rich-markdown-lowlight-cache.test.ts": 173,
+      "src/renderer/src/components/editor/rich-markdown-lowlight.test.ts": 3282,
+      "src/renderer/src/components/editor/rich-markdown-normalize.test.ts": 217,
+      "src/renderer/src/components/editor/rich-markdown-paragraph.test.ts": 72,
+      "src/renderer/src/components/editor/rich-markdown-paste-handler.test.ts": 71,
+      "src/renderer/src/components/editor/rich-markdown-paste-image.test.ts": 290,
+      "src/renderer/src/components/editor/rich-markdown-range-bounds.test.ts": 77,
+      "src/renderer/src/components/editor/rich-markdown-review-annotations.test.ts": 62,
+      "src/renderer/src/components/editor/rich-markdown-review-note-layout.test.ts": 69,
+      "src/renderer/src/components/editor/rich-markdown-review-rail-benchmark.test.ts": 1569,
+      "src/renderer/src/components/editor/rich-markdown-review-rail-blocks.test.ts": 2656,
+      "src/renderer/src/components/editor/rich-markdown-review-text-ranges.test.ts": 70,
+      "src/renderer/src/components/editor/rich-markdown-save-benchmark.test.ts": 1966,
+      "src/renderer/src/components/editor/rich-markdown-search-matches-cache.test.ts": 98,
+      "src/renderer/src/components/editor/rich-markdown-search.test.ts": 84,
+      "src/renderer/src/components/editor/rich-markdown-serialization-commit.test.ts": 1584,
+      "src/renderer/src/components/editor/rich-markdown-slash-command-filter.test.ts": 59,
+      "src/renderer/src/components/editor/rich-markdown-source-reconcile.test.ts": 2386,
+      "src/renderer/src/components/editor/rich-markdown-tab-key-handler.test.ts": 2323,
+      "src/renderer/src/components/editor/rich-markdown-table-actions.test.ts": 2946,
+      "src/renderer/src/components/editor/rich-markdown-table-control-layout.test.ts": 54,
+      "src/renderer/src/components/editor/rich-markdown-table-keyboard.test.ts": 2006,
+      "src/renderer/src/components/editor/rich-markdown-table.test.ts": 108,
+      "src/renderer/src/components/editor/rich-markdown-terminal-path-paste.test.ts": 333,
+      "src/renderer/src/components/editor/rich-markdown-toc-heading-target.test.ts": 261,
+      "src/renderer/src/components/editor/rich-markdown-trailing-paragraph.test.ts": 1766,
+      "src/renderer/src/components/editor/selection-copy.test.ts": 56,
+      "src/renderer/src/components/editor/setup-contextual-copy.test.ts": 93,
+      "src/renderer/src/components/editor/untitled-file-rename-path.test.ts": 49,
+      "src/renderer/src/components/editor/use-monaco-editor-decorations.doc-link-refresh.test.tsx": 398,
+      "src/renderer/src/components/editor/use-monaco-editor-mount.cursor-owner.test.tsx": 1210,
+      "src/renderer/src/components/editor/use-rich-markdown-table-context-menu.test.tsx": 1455,
+      "src/renderer/src/components/editor/use-rich-markdown-table-control-target.test.tsx": 2651,
+      "src/renderer/src/components/editor/useDiffViewerLargeDiffLifecycle.test.tsx": 628,
+      "src/renderer/src/components/editor/useEditorCmdSaveRequest.test.tsx": 494,
+      "src/renderer/src/components/editor/useEditorPanelContentState.test.tsx": 2597,
+      "src/renderer/src/components/editor/useEditorPanelExternalContentEvents.test.tsx": 567,
+      "src/renderer/src/components/editor/useEditorPanelFileLoadRetry.test.tsx": 600,
+      "src/renderer/src/components/editor/useEditorPanelHostUnresolvedContentState.test.tsx": 550,
+      "src/renderer/src/components/editor/useEditorPanelRemoteSiblingContentState.test.tsx": 556,
+      "src/renderer/src/components/editor/useEditorPanelVisibilityContentState.test.tsx": 791,
+      "src/renderer/src/components/editor/useIpynbCellExecution.test.tsx": 768,
+      "src/renderer/src/components/editor/useIpynbDocumentEditing.test.tsx": 359,
+      "src/renderer/src/components/editor/useLinkBubble.test.tsx": 638,
+      "src/renderer/src/components/editor/useLocalImageSrc.test.ts": 819,
+      "src/renderer/src/components/editor/useLocalLogTail.test.tsx": 506,
+      "src/renderer/src/components/editor/useMarkdownDocuments.navigation.test.ts": 674,
+      "src/renderer/src/components/editor/useMarkdownDocuments.test.ts": 964,
+      "src/renderer/src/components/editor/useRichMarkdownEditorInstance.integration.test.tsx": 384,
+      "src/renderer/src/components/editor/useRichMarkdownEditorInstance.test.tsx": 589,
+      "src/renderer/src/components/editor/useRichMarkdownPendingFocus.test.ts": 532,
+      "src/renderer/src/components/editor/useRichMarkdownProgrammaticSync.test.ts": 2348,
+      "src/renderer/src/components/editor/useRichMarkdownReviewController.open-guard.test.ts": 673,
+      "src/renderer/src/components/editor/useRichMarkdownSearch.reuse.test.tsx": 500,
+      "src/renderer/src/components/editor/useRichMarkdownSearch.test.tsx": 1658,
+      "src/renderer/src/components/emulator-pane/MobileEmulatorTabIntroCallout.test.tsx": 939,
+      "src/renderer/src/components/emulator-pane/emulator-device-frame-layout.test.ts": 32,
+      "src/renderer/src/components/emulator-pane/emulator-device-frame-visibility.test.tsx": 951,
+      "src/renderer/src/components/emulator-pane/emulator-device-frame.input.test.tsx": 761,
+      "src/renderer/src/components/emulator-pane/emulator-device-state.test.ts": 29,
+      "src/renderer/src/components/emulator-pane/emulator-keyboard-paste.test.ts": 325,
+      "src/renderer/src/components/emulator-pane/emulator-screen-gesture.test.ts": 66,
+      "src/renderer/src/components/emulator-pane/emulator-screen-stream-content.test.tsx": 754,
+      "src/renderer/src/components/emulator-pane/mobile-emulator-agent-setup-cli-state.test.ts": 60,
+      "src/renderer/src/components/emulator-pane/mobile-emulator-agent-setup-visibility.test.ts": 37,
+      "src/renderer/src/components/emulator-pane/mobile-emulator-hidden-toast.test.tsx": 525,
+      "src/renderer/src/components/emulator-pane/mobile-emulator-tab-intro-visibility.test.ts": 37,
+      "src/renderer/src/components/emulator-pane/use-emulator-pane-session.test.tsx": 2088,
+      "src/renderer/src/components/emulator-pane/use-mobile-emulator-tab-intro-actions.test.tsx": 1609,
+      "src/renderer/src/components/error-boundaries/RecoverableRenderErrorBoundary.lazy-chunk.test.tsx": 1006,
+      "src/renderer/src/components/error-boundaries/RecoverableRenderErrorBoundary.never-landed-reload.test.tsx": 524,
+      "src/renderer/src/components/error-boundaries/react-185-bystander-attribution.test.tsx": 542,
+      "src/renderer/src/components/feature-interaction-writer-boundaries.test.ts": 51,
+      "src/renderer/src/components/feature-tips/CliSkillSetupTerminal.test.tsx": 1232,
+      "src/renderer/src/components/feature-tips/CmdJPaletteFeatureTipVisual.test.tsx": 812,
+      "src/renderer/src/components/feature-tips/CmdJPaletteTipDialog.test.tsx": 264,
+      "src/renderer/src/components/feature-tips/SessionSearchTipDialog.test.tsx": 601,
+      "src/renderer/src/components/feature-tips/VoiceDictationFeatureTipVisual.test.tsx": 557,
+      "src/renderer/src/components/feature-tips/VoiceDictationTipDialog.test.tsx": 875,
+      "src/renderer/src/components/feature-tips/feature-tip-cli-install-action.test.ts": 52,
+      "src/renderer/src/components/feature-tips/feature-tip-modal-state.test.ts": 179,
+      "src/renderer/src/components/feature-tips/feature-tip-startup-gate.test.ts": 218,
+      "src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts": 57,
+      "src/renderer/src/components/feature-tips/use-session-search-tip-setup.test.tsx": 702,
+      "src/renderer/src/components/feature-wall/AgentCapabilitiesSetupAction.test.ts": 1578,
+      "src/renderer/src/components/feature-wall/ConnectIntegrationsList.test.tsx": 658,
+      "src/renderer/src/components/feature-wall/FeatureWallSetupWorkflowActions.test.tsx": 1337,
+      "src/renderer/src/components/feature-wall/FullDiskAccessSetupPrompt.test.ts": 881,
+      "src/renderer/src/components/feature-wall/KeepAwakeCard.test.tsx": 1030,
+      "src/renderer/src/components/feature-wall/agents-orchestration/UsageAccountsCard.test.tsx": 711,
+      "src/renderer/src/components/feature-wall/browser-animated-visual-sequence.test.ts": 62,
+      "src/renderer/src/components/feature-wall/feature-wall-animation-visibility.test.tsx": 729,
+      "src/renderer/src/components/feature-wall/feature-wall-rail-navigation.test.ts": 62,
+      "src/renderer/src/components/feature-wall/feature-wall-setup-checklist-localized-copy.test.ts": 233,
+      "src/renderer/src/components/feature-wall/feature-wall-setup-progress.test.ts": 69,
+      "src/renderer/src/components/feature-wall/feature-wall-shortcut-labels.test.tsx": 2097,
+      "src/renderer/src/components/feature-wall/feature-wall-usage-tracking.test.ts": 104,
+      "src/renderer/src/components/feature-wall/use-feature-wall-completion.test.ts": 44,
+      "src/renderer/src/components/feature-wall/use-feature-wall-tour-telemetry.test.ts": 69,
+      "src/renderer/src/components/feature-wall/use-integration-connection-status.test.ts": 1530,
+      "src/renderer/src/components/feature-wall/workbench-terminal-storyboard-sequence.test.ts": 58,
+      "src/renderer/src/components/file-path-cursor-tooltip.test.ts": 428,
+      "src/renderer/src/components/floating-terminal/FloatingBrowserSlot.test.tsx": 379,
+      "src/renderer/src/components/floating-terminal/FloatingTerminalOrchestrationDialog.freshness.test.tsx": 624,
+      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.bounds.test.tsx": 740,
+      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.empty-state.test.tsx": 576,
+      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.focus.test.tsx": 1034,
+      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.markdown-editor.test.tsx": 428,
+      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.shortcuts.test.tsx": 904,
+      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tab-lifecycle.test.tsx": 1123,
+      "src/renderer/src/components/floating-terminal/FloatingTerminalToggleButton.test.tsx": 152,
+      "src/renderer/src/components/floating-terminal/FloatingTerminalWindowControls.test.tsx": 238,
+      "src/renderer/src/components/floating-terminal/floating-terminal-panel-bounds.test.ts": 44,
+      "src/renderer/src/components/floating-terminal/floating-terminal-panel-inputs.test.ts": 102,
+      "src/renderer/src/components/floating-terminal/floating-terminal-panel-view-state.test.ts": 242,
+      "src/renderer/src/components/floating-terminal/floating-terminal-trigger-position.test.ts": 69,
+      "src/renderer/src/components/floating-terminal/floating-workspace-tab-reorder.test.ts": 1642,
+      "src/renderer/src/components/floating-terminal/terminal-pane-handle-registry.test.ts": 59,
+      "src/renderer/src/components/floating-terminal/use-floating-terminal-create-actions.test.ts": 1592,
+      "src/renderer/src/components/github-body-draft-state.test.ts": 61,
+      "src/renderer/src/components/github-checks-tab-state.test.ts": 51,
+      "src/renderer/src/components/github-enterprise-slug-routing-boundary.test.ts": 50,
+      "src/renderer/src/components/github-item-dialog-source-boundary.test.ts": 47,
+      "src/renderer/src/components/github-item-dialog/inspect-pull-request/pr-files-combined-diff-section-index.test.tsx": 647,
+      "src/renderer/src/components/github-link-copy-state.test.ts": 56,
+      "src/renderer/src/components/github-pr-merge-state.test.ts": 94,
+      "src/renderer/src/components/github-pr-reviewer-display.test.ts": 57,
+      "src/renderer/src/components/github-project/GhAuthErrorHelp.test.ts": 414,
+      "src/renderer/src/components/github-project/ProjectRoadmap.test.tsx": 2001,
+      "src/renderer/src/components/github-project/ProjectViewStates.test.tsx": 757,
+      "src/renderer/src/components/github-project/github-project-picker-filter.test.ts": 62,
+      "src/renderer/src/components/github-project/group-sort.test.ts": 40,
+      "src/renderer/src/components/github-project/project-dialog-state.test.ts": 55,
+      "src/renderer/src/components/github-project/project-picker-browse-cache.test.ts": 51,
+      "src/renderer/src/components/github-project/project-picker-input.test.ts": 918,
+      "src/renderer/src/components/github-project/project-row-filtering.test.ts": 51,
+      "src/renderer/src/components/github-project/project-view-wrapper-source-context-boundary.test.ts": 44,
+      "src/renderer/src/components/github-project/project-visible-table-cache.test.ts": 49,
+      "src/renderer/src/components/github/PRFilterPickers.test.ts": 310,
+      "src/renderer/src/components/github/github-markdown-image-url.test.ts": 33,
+      "src/renderer/src/components/github/github-mention-option-filter.test.ts": 34,
+      "src/renderer/src/components/github/github-pr-reviewer-candidate-filter.test.ts": 74,
+      "src/renderer/src/components/github/github-user-avatar.test.tsx": 560,
+      "src/renderer/src/components/github/github-work-item-assignee-filter.test.ts": 61,
+      "src/renderer/src/components/github/github-work-item-label-filter.test.ts": 42,
+      "src/renderer/src/components/github/pr-comment-code-context.test.ts": 73,
+      "src/renderer/src/components/github/pr-file-content-size.test.ts": 36,
+      "src/renderer/src/components/github/repro-8784-ghe-avatar-fallback.test.ts": 63,
+      "src/renderer/src/components/github/use-image-input.test.ts": 2130,
+      "src/renderer/src/components/hover-reveal-touch-action-visibility.test.ts": 40,
+      "src/renderer/src/components/jira-create-adf.test.ts": 61,
+      "src/renderer/src/components/jira-project-picker-filter.test.ts": 40,
+      "src/renderer/src/components/landing-preflight-dismissal.test.ts": 67,
+      "src/renderer/src/components/landing-preflight-issues.test.ts": 123,
+      "src/renderer/src/components/landing-preflight-runtime-boundary.test.ts": 1359,
+      "src/renderer/src/components/landing-preflight-unverifiable-host.test.tsx": 2022,
+      "src/renderer/src/components/linear-api-key-dialog-state.test.ts": 51,
+      "src/renderer/src/components/linear-issue-attribute-filter-coverage-agreement.test.ts": 1177,
+      "src/renderer/src/components/linear-issue-attribute-filter-dropdowns.test.tsx": 1616,
+      "src/renderer/src/components/linear-issue-attribute-filter-primary-team.test.ts": 64,
+      "src/renderer/src/components/linear-issue-attribute-filter-team-ids.test.ts": 86,
+      "src/renderer/src/components/linear-issue-project-selector.test.tsx": 766,
+      "src/renderer/src/components/linear-issue-text-draft-state.test.ts": 54,
+      "src/renderer/src/components/linear-issue-text-save-plan.test.ts": 32,
+      "src/renderer/src/components/linear-issue-view-storage.test.ts": 528,
+      "src/renderer/src/components/linear-issue-workspace-api-parity.test.ts": 27,
+      "src/renderer/src/components/linear-issue-workspace-detail-state.test.tsx": 393,
+      "src/renderer/src/components/linear-issue-workspace-header.test.ts": 50,
+      "src/renderer/src/components/linear-issue-workspace-text.test.ts": 127,
+      "src/renderer/src/components/linear-project-presentation.test.ts": 44,
+      "src/renderer/src/components/linear-project-search-query.test.ts": 50,
+      "src/renderer/src/components/linear-project-view-surfaces.test.tsx": 1038,
+      "src/renderer/src/components/linear-scope-selector.test.ts": 450,
+      "src/renderer/src/components/link-actions/LinkActionPopover.test.tsx": 804,
+      "src/renderer/src/components/maintenance/update-card/update-card-error-model.test.ts": 116,
+      "src/renderer/src/components/mobile/MobileHero.test.tsx": 2957,
+      "src/renderer/src/components/mobile/MobilePage.test.tsx": 1990,
+      "src/renderer/src/components/mobile/MobilePageToolbar.test.tsx": 606,
+      "src/renderer/src/components/mobile/NetworkInterfacePicker.test.tsx": 1041,
+      "src/renderer/src/components/mobile/WindowsFirewallNotice.test.tsx": 827,
+      "src/renderer/src/components/mobile/mobile-page-stage.test.ts": 45,
+      "src/renderer/src/components/mobile/paired-mobile-devices.test.ts": 481,
+      "src/renderer/src/components/mobile/use-mobile-page-paired-devices.test.ts": 361,
+      "src/renderer/src/components/mobile/use-mobile-pairing-address-preference.test.tsx": 623,
+      "src/renderer/src/components/native-chat-restart-action-notifications.test.ts": 113,
+      "src/renderer/src/components/native-chat-resume-activity-label.test.ts": 108,
+      "src/renderer/src/components/native-chat-resume-failed-chat-watch.test.ts": 1229,
+      "src/renderer/src/components/native-chat-resume-failure-guidance.test.ts": 84,
+      "src/renderer/src/components/native-chat-resume-on-restart-grouping.test.ts": 56,
+      "src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx": 1564,
+      "src/renderer/src/components/native-chat/NativeChatAutocompleteMenus.test.tsx": 872,
+      "src/renderer/src/components/native-chat/NativeChatBackgroundTaskRun.test.tsx": 990,
+      "src/renderer/src/components/native-chat/NativeChatBackgroundTasksStatus.test.tsx": 1274,
+      "src/renderer/src/components/native-chat/NativeChatCodeBlock.test.tsx": 874,
+      "src/renderer/src/components/native-chat/NativeChatComposer.test.tsx": 1457,
+      "src/renderer/src/components/native-chat/NativeChatComposerActions.test.tsx": 565,
+      "src/renderer/src/components/native-chat/NativeChatContextUsageRing.test.tsx": 750,
+      "src/renderer/src/components/native-chat/NativeChatImageAttachmentPreview.test.tsx": 688,
+      "src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx": 986,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.growth-windowing.test.tsx": 3718,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.message-rail-windowing.test.tsx": 4072,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.older-history.test.tsx": 4416,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.provider-frame.test.tsx": 2482,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.rail-history-jump.test.tsx": 11804,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.stream-render.perf.test.tsx": 3611,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.task-list-frames.test.tsx": 3017,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.test.tsx": 3343,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.tool-stream-cost.test.tsx": 4901,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.turn-fold.test.tsx": 2633,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.turn-history.test.tsx": 2349,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.turn-indicator.test.tsx": 3391,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.turn-timing.test.tsx": 1597,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.windowing.test.tsx": 5207,
+      "src/renderer/src/components/native-chat/NativeChatMessageRail.test.tsx": 1294,
+      "src/renderer/src/components/native-chat/NativeChatMessageRow.test.tsx": 2046,
+      "src/renderer/src/components/native-chat/NativeChatMessageTimestamp.test.tsx": 752,
+      "src/renderer/src/components/native-chat/NativeChatNoticeRow.test.tsx": 2656,
+      "src/renderer/src/components/native-chat/NativeChatPromptEditor.test.tsx": 1266,
+      "src/renderer/src/components/native-chat/NativeChatQuestionCard.test.tsx": 947,
+      "src/renderer/src/components/native-chat/NativeChatResolutionReceipt.test.tsx": 1217,
+      "src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.test.tsx": 950,
+      "src/renderer/src/components/native-chat/NativeChatStructuredSession.goal-dock.test.tsx": 2046,
+      "src/renderer/src/components/native-chat/NativeChatStructuredSession.launch-lifecycle.test.tsx": 2769,
+      "src/renderer/src/components/native-chat/NativeChatStructuredSession.test.tsx": 1475,
+      "src/renderer/src/components/native-chat/NativeChatStructuredSession.transport-probe.test.tsx": 16705,
+      "src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.test.tsx": 17563,
+      "src/renderer/src/components/native-chat/NativeChatStructuredSessionStatus.test.tsx": 979,
+      "src/renderer/src/components/native-chat/NativeChatSubagentRun.test.tsx": 1078,
+      "src/renderer/src/components/native-chat/NativeChatTaskList.test.tsx": 1027,
+      "src/renderer/src/components/native-chat/NativeChatThreadGoalBanner.test.tsx": 1215,
+      "src/renderer/src/components/native-chat/NativeChatToolRun.ask-row.test.tsx": 868,
+      "src/renderer/src/components/native-chat/NativeChatToolRun.identity.test.tsx": 898,
+      "src/renderer/src/components/native-chat/NativeChatToolRun.test.tsx": 967,
+      "src/renderer/src/components/native-chat/NativeChatTranscriptChrome.test.tsx": 1191,
+      "src/renderer/src/components/native-chat/NativeChatView.test.tsx": 586,
+      "src/renderer/src/components/native-chat/StructuredAgentSessionAttentionBridge.test.tsx": 1682,
+      "src/renderer/src/components/native-chat/StructuredAgentSessionPaneOverlayLayer.test.tsx": 419,
+      "src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.test.tsx": 5346,
+      "src/renderer/src/components/native-chat/background-task-roster.test.ts": 98,
+      "src/renderer/src/components/native-chat/claude-model-switch-confirmation.test.ts": 1924,
+      "src/renderer/src/components/native-chat/claude-terminal-session-options.test.ts": 124,
+      "src/renderer/src/components/native-chat/native-chat-active-rail-item.test.ts": 45,
+      "src/renderer/src/components/native-chat/native-chat-assembler-merge-parity.test.ts": 95,
+      "src/renderer/src/components/native-chat/native-chat-attachment-upload.test.ts": 1516,
+      "src/renderer/src/components/native-chat/native-chat-autoscroll.test.ts": 33,
+      "src/renderer/src/components/native-chat/native-chat-availability.test.ts": 39,
+      "src/renderer/src/components/native-chat/native-chat-composer-autogrow.test.tsx": 2042,
+      "src/renderer/src/components/native-chat/native-chat-composer-composition.test.tsx": 2490,
+      "src/renderer/src/components/native-chat/native-chat-composer-containment.test.ts": 38,
+      "src/renderer/src/components/native-chat/native-chat-composer-drop-scope.test.tsx": 1320,
+      "src/renderer/src/components/native-chat/native-chat-composer-reveal-focus.test.tsx": 622,
+      "src/renderer/src/components/native-chat/native-chat-composer-scope-cache.test.ts": 47,
+      "src/renderer/src/components/native-chat/native-chat-composer-state.test.ts": 98,
+      "src/renderer/src/components/native-chat/native-chat-composer-workspace-file-drop.test.tsx": 1742,
+      "src/renderer/src/components/native-chat/native-chat-context-usage-summary.test.ts": 54,
+      "src/renderer/src/components/native-chat/native-chat-diff.test.ts": 53,
+      "src/renderer/src/components/native-chat/native-chat-dismiss-key.test.ts": 56,
+      "src/renderer/src/components/native-chat/native-chat-draft-cache.test.ts": 53,
+      "src/renderer/src/components/native-chat/native-chat-file-link.test.ts": 161,
+      "src/renderer/src/components/native-chat/native-chat-font-scale.test.ts": 60,
+      "src/renderer/src/components/native-chat/native-chat-http-link-source-owner.test.ts": 69,
+      "src/renderer/src/components/native-chat/native-chat-image-paste.test.ts": 40,
+      "src/renderer/src/components/native-chat/native-chat-image-runtime-context.test.ts": 1250,
+      "src/renderer/src/components/native-chat/native-chat-incremental-assembler.test.ts": 96,
+      "src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts": 148,
+      "src/renderer/src/components/native-chat/native-chat-launch-default-adoption.test.ts": 117,
+      "src/renderer/src/components/native-chat/native-chat-launch-draft-resolution.test.ts": 52,
+      "src/renderer/src/components/native-chat/native-chat-launch-draft-send.test.ts": 75,
+      "src/renderer/src/components/native-chat/native-chat-launch-session-options.test.ts": 74,
+      "src/renderer/src/components/native-chat/native-chat-layout-actions.test.ts": 1739,
+      "src/renderer/src/components/native-chat/native-chat-leaf-routing.test.ts": 44,
+      "src/renderer/src/components/native-chat/native-chat-live-status.test.ts": 83,
+      "src/renderer/src/components/native-chat/native-chat-message-grouping.test.ts": 73,
+      "src/renderer/src/components/native-chat/native-chat-message-list-projection.test.ts": 83,
+      "src/renderer/src/components/native-chat/native-chat-message-rail-items.test.ts": 102,
+      "src/renderer/src/components/native-chat/native-chat-noise.test.ts": 32,
+      "src/renderer/src/components/native-chat/native-chat-pagination.test.ts": 62,
+      "src/renderer/src/components/native-chat/native-chat-pane-file-drop.test.tsx": 558,
+      "src/renderer/src/components/native-chat/native-chat-pane-resolution.test.ts": 48,
+      "src/renderer/src/components/native-chat/native-chat-pending-occurrence.test.ts": 66,
+      "src/renderer/src/components/native-chat/native-chat-pending.test.ts": 86,
+      "src/renderer/src/components/native-chat/native-chat-pinned-rows.test.ts": 34,
+      "src/renderer/src/components/native-chat/native-chat-preassembled-session-parity.test.ts": 189,
+      "src/renderer/src/components/native-chat/native-chat-pty-retired-model.test.ts": 157,
+      "src/renderer/src/components/native-chat/native-chat-pty-session-options.test.ts": 375,
+      "src/renderer/src/components/native-chat/native-chat-rail-outline-parity.test.ts": 110,
+      "src/renderer/src/components/native-chat/native-chat-resolved-path-ownership.test.ts": 57,
+      "src/renderer/src/components/native-chat/native-chat-retire-persisted-model.test.ts": 455,
+      "src/renderer/src/components/native-chat/native-chat-row-height-estimate.test.ts": 39,
+      "src/renderer/src/components/native-chat/native-chat-runtime-owner.test.ts": 231,
+      "src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts": 1274,
+      "src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts": 306,
+      "src/renderer/src/components/native-chat/native-chat-scrape-fallback.test.ts": 69,
+      "src/renderer/src/components/native-chat/native-chat-send-eligibility.test.ts": 50,
+      "src/renderer/src/components/native-chat/native-chat-send.test.ts": 52,
+      "src/renderer/src/components/native-chat/native-chat-session-assembler.test.ts": 107,
+      "src/renderer/src/components/native-chat/native-chat-session-option-enrichment.test.ts": 1585,
+      "src/renderer/src/components/native-chat/native-chat-session-option-labels.test.ts": 55,
+      "src/renderer/src/components/native-chat/native-chat-session-transport.test.ts": 88,
+      "src/renderer/src/components/native-chat/native-chat-shared-copy-matches-catalog.test.ts": 411,
+      "src/renderer/src/components/native-chat/native-chat-shortcut.test.ts": 44,
+      "src/renderer/src/components/native-chat/native-chat-split-shortcut.test.ts": 68,
+      "src/renderer/src/components/native-chat/native-chat-stop-layering.test.ts": 31,
+      "src/renderer/src/components/native-chat/native-chat-structured-send-composition-clear.test.tsx": 1959,
+      "src/renderer/src/components/native-chat/native-chat-tab-agent-entry.test.ts": 31,
+      "src/renderer/src/components/native-chat/native-chat-task-list-history.test.ts": 57,
+      "src/renderer/src/components/native-chat/native-chat-task-list-state.test.ts": 45,
+      "src/renderer/src/components/native-chat/native-chat-thread-goal-rows.test.ts": 56,
+      "src/renderer/src/components/native-chat/native-chat-tool-fold.test.ts": 69,
+      "src/renderer/src/components/native-chat/native-chat-tool-summary.test.ts": 58,
+      "src/renderer/src/components/native-chat/native-chat-transcript-slots.test.ts": 76,
+      "src/renderer/src/components/native-chat/native-chat-turn-diffs.test.ts": 99,
+      "src/renderer/src/components/native-chat/native-chat-typing-indicator.test.ts": 91,
+      "src/renderer/src/components/native-chat/native-chat-typing-redirect.test.ts": 66,
+      "src/renderer/src/components/native-chat/native-chat-view-file-drop.test.tsx": 806,
+      "src/renderer/src/components/native-chat/native-chat-view-state.test.ts": 57,
+      "src/renderer/src/components/native-chat/native-chat-web-link-actions.test.ts": 135,
+      "src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx": 680,
+      "src/renderer/src/components/native-chat/native-chat-working-suppression.test.ts": 53,
+      "src/renderer/src/components/native-chat/omp-model-switch-capability.test.ts": 84,
+      "src/renderer/src/components/native-chat/serialized-screen-background-rows.test.ts": 134,
+      "src/renderer/src/components/native-chat/structured-agent-question-projection.test.ts": 97,
+      "src/renderer/src/components/native-chat/structured-agent-session-message-projection.test.ts": 77,
+      "src/renderer/src/components/native-chat/structured-agent-session-outbox-storage.test.ts": 437,
+      "src/renderer/src/components/native-chat/structured-agent-session-rail-outline.test.ts": 36,
+      "src/renderer/src/components/native-chat/structured-agent-session-read-transport.test.ts": 246,
+      "src/renderer/src/components/native-chat/structured-agent-session-status-bridge-clock.test.tsx": 2216,
+      "src/renderer/src/components/native-chat/structured-attention-dispatch.test.ts": 1416,
+      "src/renderer/src/components/native-chat/structured-attention-surface.test.ts": 994,
+      "src/renderer/src/components/native-chat/structured-session-takeover-report.test.tsx": 697,
+      "src/renderer/src/components/native-chat/use-native-chat-composer-app-menu-selection.test.tsx": 528,
+      "src/renderer/src/components/native-chat/use-native-chat-composer-attachments.test.tsx": 718,
+      "src/renderer/src/components/native-chat/use-native-chat-composer-catalog.test.tsx": 631,
+      "src/renderer/src/components/native-chat/use-native-chat-composer-keydown.test.tsx": 580,
+      "src/renderer/src/components/native-chat/use-native-chat-composer-paste.test.tsx": 564,
+      "src/renderer/src/components/native-chat/use-native-chat-composer-submit.test.tsx": 708,
+      "src/renderer/src/components/native-chat/use-native-chat-context-menu.test.tsx": 493,
+      "src/renderer/src/components/native-chat/use-native-chat-external-attachments.test.tsx": 578,
+      "src/renderer/src/components/native-chat/use-native-chat-file-link-click.test.tsx": 1460,
+      "src/renderer/src/components/native-chat/use-native-chat-hook-status.test.ts": 1638,
+      "src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx": 620,
+      "src/renderer/src/components/native-chat/use-native-chat-launch-draft-adoption.test.tsx": 567,
+      "src/renderer/src/components/native-chat/use-native-chat-link-actions.test.tsx": 1582,
+      "src/renderer/src/components/native-chat/use-native-chat-live-session-pending.test.ts": 1421,
+      "src/renderer/src/components/native-chat/use-native-chat-live-session-visibility.test.ts": 2357,
+      "src/renderer/src/components/native-chat/use-native-chat-live-session.test.ts": 5417,
+      "src/renderer/src/components/native-chat/use-native-chat-message-rail.test.ts": 790,
+      "src/renderer/src/components/native-chat/use-native-chat-picker-command-dispatch.test.tsx": 2127,
+      "src/renderer/src/components/native-chat/use-native-chat-provisional-launch.test.tsx": 1713,
+      "src/renderer/src/components/native-chat/use-native-chat-rail-history-jump.test.ts": 665,
+      "src/renderer/src/components/native-chat/use-native-chat-retained-session.test.ts": 563,
+      "src/renderer/src/components/native-chat/use-native-chat-send-lifecycle.test.tsx": 346,
+      "src/renderer/src/components/native-chat/use-native-chat-session-option-command.test.tsx": 2103,
+      "src/renderer/src/components/native-chat/use-native-chat-session-options.test.ts": 792,
+      "src/renderer/src/components/native-chat/use-native-chat-skills.react.test.tsx": 862,
+      "src/renderer/src/components/native-chat/use-native-chat-skills.test.ts": 835,
+      "src/renderer/src/components/native-chat/use-native-chat-structured-composer-send.test.tsx": 746,
+      "src/renderer/src/components/native-chat/use-native-chat-toggle-shortcut.test.ts": 1599,
+      "src/renderer/src/components/native-chat/use-native-chat-transcript-scroll.test.tsx": 556,
+      "src/renderer/src/components/native-chat/use-native-chat-transcript-window.options.test.tsx": 660,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-context-usage.test.tsx": 2782,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-hold.test.tsx": 935,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-messages.test.tsx": 448,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-options.test.tsx": 1272,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-outbox-admission.test.tsx": 1393,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-outbox-rejection-cause.test.tsx": 608,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx": 1632,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-prompt-cancel.test.tsx": 2498,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-prompt-state.test.tsx": 2251,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-provisional.test.tsx": 2510,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-question-answers.test.tsx": 2546,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-rail-outline.test.tsx": 707,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-read.test.tsx": 1321,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-thread-goal.test.tsx": 570,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-transport.test.tsx": 605,
+      "src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx": 2591,
+      "src/renderer/src/components/native-chat/use-structured-agent-turn-timing.test.tsx": 481,
+      "src/renderer/src/components/network/CustomAddressDialog.test.tsx": 584,
+      "src/renderer/src/components/new-workspace/ComposerParentWorktreePicker.test.tsx": 1181,
+      "src/renderer/src/components/new-workspace/ProjectCombobox.dialog-handoff.test.tsx": 936,
+      "src/renderer/src/components/new-workspace/ProjectCombobox.test.tsx": 1046,
+      "src/renderer/src/components/new-workspace/ProjectComboboxRow.test.tsx": 407,
+      "src/renderer/src/components/new-workspace/SetProjectLocationDialog.test.tsx": 1539,
+      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField-provider-boundaries.test.ts": 1258,
+      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField-repo-slug-routing.test.ts": 1446,
+      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField-source-boundaries.test.ts": 42,
+      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField.ime-enter.test.tsx": 1142,
+      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField.jira-accessibility.test.tsx": 1292,
+      "src/renderer/src/components/new-workspace/base-ref-picker-visibility.test.ts": 49,
+      "src/renderer/src/components/new-workspace/project-combobox-matching.test.ts": 89,
+      "src/renderer/src/components/new-workspace/smart-workspace-command-value.test.ts": 33,
+      "src/renderer/src/components/new-workspace/smart-workspace-localized-options.test.ts": 247,
+      "src/renderer/src/components/new-workspace/smart-workspace-source-popover-focus.test.ts": 503,
+      "src/renderer/src/components/new-workspace/smart-workspace-source-results.test.ts": 116,
+      "src/renderer/src/components/new-workspace/use-jira-source-connection.test.tsx": 629,
+      "src/renderer/src/components/new-workspace/use-jira-url-source.test.tsx": 454,
+      "src/renderer/src/components/new-workspace/use-recent-project-ids.test.ts": 966,
+      "src/renderer/src/components/onboarding/AgentStep.test.tsx": 408,
+      "src/renderer/src/components/onboarding/FeatureSetupInlineTerminal.test.tsx": 1399,
+      "src/renderer/src/components/onboarding/NotificationStep.test.tsx": 1357,
+      "src/renderer/src/components/onboarding/OnboardingFlow.test.tsx": 5689,
+      "src/renderer/src/components/onboarding/OnboardingInlineCommandTerminal.command-finished.test.tsx": 579,
+      "src/renderer/src/components/onboarding/OnboardingInlineCommandTerminal.test.ts": 2643,
+      "src/renderer/src/components/onboarding/ThemeStep.test.ts": 271,
+      "src/renderer/src/components/onboarding/WindowsTerminalStep.test.tsx": 673,
+      "src/renderer/src/components/onboarding/agent-picked-payload.test.ts": 55,
+      "src/renderer/src/components/onboarding/onboarding-dismiss-target.test.ts": 37,
+      "src/renderer/src/components/onboarding/onboarding-feature-setup.test.ts": 1585,
+      "src/renderer/src/components/onboarding/onboarding-folder-agent-startup.test.ts": 281,
+      "src/renderer/src/components/onboarding/onboarding-settings-hydration.test.ts": 65,
+      "src/renderer/src/components/onboarding/use-onboarding-flow-persistence.test.ts": 1229,
+      "src/renderer/src/components/onboarding/use-onboarding-flow.test.ts": 284,
+      "src/renderer/src/components/onboarding/windows-terminal-onboarding-telemetry.test.ts": 37,
+      "src/renderer/src/components/orca-profiles/OrcaProfileSignOutConfirmDialog.test.tsx": 515,
+      "src/renderer/src/components/pet/PetOverlay.frame-durations.test.tsx": 430,
+      "src/renderer/src/components/pet/PetOverlay.keyframes.test.tsx": 447,
+      "src/renderer/src/components/pet/PetOverlay.pet-switch.test.tsx": 622,
+      "src/renderer/src/components/pet/PetOverlay.pointer-interaction.test.tsx": 654,
+      "src/renderer/src/components/pet/PetOverlay.test.ts": 1580,
+      "src/renderer/src/components/pet/pet-agent-state.test.ts": 55,
+      "src/renderer/src/components/pet/pet-blob-cache.test.ts": 65,
+      "src/renderer/src/components/pet/pet-overlay-hit-area.test.tsx": 743,
+      "src/renderer/src/components/pet/pet-overlay-position.test.ts": 1053,
+      "src/renderer/src/components/pet/pet-overlay-visibility.test.ts": 39,
+      "src/renderer/src/components/pet/sprite-animation-css.test.ts": 38,
+      "src/renderer/src/components/pet/usePetPointerInteraction.test.ts": 328,
+      "src/renderer/src/components/pet/usePetUrl.test.tsx": 651,
+      "src/renderer/src/components/ports/WorkspacePortScanner.test.tsx": 3020,
+      "src/renderer/src/components/pr-check-counts.test.ts": 107,
+      "src/renderer/src/components/pr-checks-fix-prompt.test.ts": 56,
+      "src/renderer/src/components/pr-comments-resolution-prompt.test.ts": 40,
+      "src/renderer/src/components/provider-check-classification-parity.test.ts": 112,
+      "src/renderer/src/components/pull-request-page-host-boundary.test.ts": 60,
+      "src/renderer/src/components/pull-request-page/cache/file-content.test.ts": 61,
+      "src/renderer/src/components/pull-request-page/files/combined-diff-section-index.test.tsx": 898,
+      "src/renderer/src/components/pull-request-page/mentions/options.test.ts": 53,
+      "src/renderer/src/components/pull-request-page/mentions/query.test.ts": 46,
+      "src/renderer/src/components/pull-request-page/presentation/state-badge.test.ts": 241,
+      "src/renderer/src/components/quick-open-file-list-host-name-filter.react.test.tsx": 2090,
+      "src/renderer/src/components/quick-open-file-list.react.test.tsx": 1637,
+      "src/renderer/src/components/quick-open-file-list.test.ts": 1005,
+      "src/renderer/src/components/quick-open-install-rg-guidance.render.test.tsx": 799,
+      "src/renderer/src/components/quick-open-install-rg-guidance.test.ts": 254,
+      "src/renderer/src/components/quick-open-search.test.ts": 259,
+      "src/renderer/src/components/repo/CreateFromPicker.test.tsx": 1041,
+      "src/renderer/src/components/repo/NestedRepoChecklist.test.tsx": 274,
+      "src/renderer/src/components/repo/NestedRepoScanLimitNotice.test.ts": 414,
+      "src/renderer/src/components/repo/repo-icon.emoji-centering.test.tsx": 469,
+      "src/renderer/src/components/repo/repo-icon.test.tsx": 554,
+      "src/renderer/src/components/right-sidebar/ActionButton.test.tsx": 3109,
+      "src/renderer/src/components/right-sidebar/AiVaultPanel.legacy-filter.test.tsx": 3107,
+      "src/renderer/src/components/right-sidebar/AiVaultPanelHeader.focus.test.tsx": 837,
+      "src/renderer/src/components/right-sidebar/AiVaultPanelSearch.test.tsx": 1050,
+      "src/renderer/src/components/right-sidebar/AiVaultSearchEvidence.test.tsx": 2126,
+      "src/renderer/src/components/right-sidebar/AiVaultSessionListBar.test.tsx": 1195,
+      "src/renderer/src/components/right-sidebar/AiVaultSessionRow.test.tsx": 1968,
+      "src/renderer/src/components/right-sidebar/AiVaultSessionSubagents.test.tsx": 2633,
+      "src/renderer/src/components/right-sidebar/AiVaultShowMoreSessionsRow.test.tsx": 851,
+      "src/renderer/src/components/right-sidebar/AiVaultVirtualRow.test.tsx": 2132,
+      "src/renderer/src/components/right-sidebar/ChecksPanel.review-header.test.tsx": 2283,
+      "src/renderer/src/components/right-sidebar/ChecksPanel.updated-at-metadata.test.tsx": 566,
+      "src/renderer/src/components/right-sidebar/CommitArea.chevron-spinner.test.tsx": 2283,
+      "src/renderer/src/components/right-sidebar/CommitArea.generate.test.tsx": 2862,
+      "src/renderer/src/components/right-sidebar/CommitArea.primary-icons.test.tsx": 3772,
+      "src/renderer/src/components/right-sidebar/CommitArea.test.tsx": 9563,
+      "src/renderer/src/components/right-sidebar/FileExplorerNameFilter.test.tsx": 442,
+      "src/renderer/src/components/right-sidebar/FileExplorerRow.actions.test.tsx": 251,
+      "src/renderer/src/components/right-sidebar/FileExplorerToolbar.test.tsx": 1137,
+      "src/renderer/src/components/right-sidebar/FileExplorerViewSwitch.test.tsx": 286,
+      "src/renderer/src/components/right-sidebar/FileExplorerVirtualRows.row-handlers.test.tsx": 1865,
+      "src/renderer/src/components/right-sidebar/FileExplorerVirtualRowsAddProject.test.tsx": 1859,
+      "src/renderer/src/components/right-sidebar/FolderWorkspacePrChecksPanel.test.tsx": 756,
+      "src/renderer/src/components/right-sidebar/FolderWorkspacePrChecksRow.test.tsx": 540,
+      "src/renderer/src/components/right-sidebar/FolderWorkspaceWorktreesPanel.test.tsx": 713,
+      "src/renderer/src/components/right-sidebar/GitHistoryPanel.test.tsx": 1252,
+      "src/renderer/src/components/right-sidebar/GitHubPRStackMap.test.tsx": 916,
+      "src/renderer/src/components/right-sidebar/HostedReviewActions.draft.test.tsx": 922,
+      "src/renderer/src/components/right-sidebar/PluginPanel.test.tsx": 883,
+      "src/renderer/src/components/right-sidebar/PortsPanel.test.tsx": 2949,
+      "src/renderer/src/components/right-sidebar/PullRequestComposer.generate-tooltip.test.tsx": 1959,
+      "src/renderer/src/components/right-sidebar/SearchResultItems.test.tsx": 526,
+      "src/renderer/src/components/right-sidebar/SessionRowTrailingActions.test.tsx": 565,
+      "src/renderer/src/components/right-sidebar/SourceControl.branch-line-total.test.tsx": 1480,
+      "src/renderer/src/components/right-sidebar/SourceControl.commit-drafts.test.ts": 3776,
+      "src/renderer/src/components/right-sidebar/SourceControl.commit-failure-recovery.test.ts": 48,
+      "src/renderer/src/components/right-sidebar/SourceControl.commit-generation-records.test.ts": 47,
+      "src/renderer/src/components/right-sidebar/SourceControl.compare-summary.test.ts": 3689,
+      "src/renderer/src/components/right-sidebar/SourceControl.host-context-boundary.test.ts": 24,
+      "src/renderer/src/components/right-sidebar/SourceControl.hosted-review-header-link.test.tsx": 134,
+      "src/renderer/src/components/right-sidebar/SourceControl.open-file-highlight.test.tsx": 4632,
+      "src/renderer/src/components/right-sidebar/SourceControl.pr-generation-records.test.ts": 56,
+      "src/renderer/src/components/right-sidebar/SourceControl.preview-open.test.tsx": 4125,
+      "src/renderer/src/components/right-sidebar/SourceControl.push-failure-recovery.test.ts": 53,
+      "src/renderer/src/components/right-sidebar/SourceControl.remote-action-errors.test.ts": 2135,
+      "src/renderer/src/components/right-sidebar/SourceControl.resolve-conflicts-prompt.test.ts": 2081,
+      "src/renderer/src/components/right-sidebar/SourceControl.virtual-file-list.test.tsx": 3225,
+      "src/renderer/src/components/right-sidebar/SourceControlAgentActionDialog.test.tsx": 2339,
+      "src/renderer/src/components/right-sidebar/SourceControlAgentActionDialogForm.test.tsx": 361,
+      "src/renderer/src/components/right-sidebar/SourceControlTextGenerationDialog.test.ts": 551,
+      "src/renderer/src/components/right-sidebar/active-checks-status.test.ts": 1236,
+      "src/renderer/src/components/right-sidebar/activity-bar-buttons.test.tsx": 599,
+      "src/renderer/src/components/right-sidebar/activity-bar-overflow.test.ts": 49,
+      "src/renderer/src/components/right-sidebar/ai-vault-first-prompt-card.test.tsx": 997,
+      "src/renderer/src/components/right-sidebar/ai-vault-host-scope.test.ts": 531,
+      "src/renderer/src/components/right-sidebar/ai-vault-original-pane-index.test.ts": 67,
+      "src/renderer/src/components/right-sidebar/ai-vault-original-pane.test.ts": 49,
+      "src/renderer/src/components/right-sidebar/ai-vault-scan-issue-state.test.ts": 29,
+      "src/renderer/src/components/right-sidebar/ai-vault-scope-paths.test.ts": 47,
+      "src/renderer/src/components/right-sidebar/ai-vault-scope-state.test.ts": 43,
+      "src/renderer/src/components/right-sidebar/ai-vault-search-scope-identity.test.tsx": 731,
+      "src/renderer/src/components/right-sidebar/ai-vault-search-session.test.ts": 142,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-continuation.test.ts": 38,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-deletability.test.ts": 127,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-display.test.ts": 58,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-filters.test.ts": 64,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-identity.test.ts": 42,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-log-open.test.ts": 81,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-path-actions.test.ts": 52,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-projects.test.ts": 112,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-publication-gate.test.ts": 531,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-refresh.test.ts": 5506,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-resume-in-chat-launch.test.ts": 575,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-resume-in-chat.test.ts": 66,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-resume.test.ts": 169,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-worktree-map.test.tsx": 705,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-worktree.test.ts": 95,
+      "src/renderer/src/components/right-sidebar/ai-vault-view-defaults.test.ts": 45,
+      "src/renderer/src/components/right-sidebar/ai-vault-view-options-persistence.test.ts": 49,
+      "src/renderer/src/components/right-sidebar/branch-line-total-request-gate.test.ts": 48,
+      "src/renderer/src/components/right-sidebar/check-details-resize.test.ts": 30,
+      "src/renderer/src/components/right-sidebar/checks-entry-refresh.test.ts": 58,
+      "src/renderer/src/components/right-sidebar/checks-list-expanded-details.test.tsx": 1439,
+      "src/renderer/src/components/right-sidebar/checks-panel-async-result-key.test.ts": 46,
+      "src/renderer/src/components/right-sidebar/checks-panel-content.test.tsx": 1497,
+      "src/renderer/src/components/right-sidebar/checks-panel-empty-state.test.ts": 113,
+      "src/renderer/src/components/right-sidebar/checks-panel-git-status-snapshot.test.ts": 59,
+      "src/renderer/src/components/right-sidebar/checks-panel-hosted-review-click-routing.test.ts": 65,
+      "src/renderer/src/components/right-sidebar/checks-panel-pr-refresh-breadcrumb.test.ts": 51,
+      "src/renderer/src/components/right-sidebar/checks-panel-pr-refresh-request.test.ts": 31,
+      "src/renderer/src/components/right-sidebar/checks-panel-review-creation.test.ts": 85,
+      "src/renderer/src/components/right-sidebar/checks-panel-review-lookup-authority.test.ts": 52,
+      "src/renderer/src/components/right-sidebar/checks-panel-review.test.ts": 44,
+      "src/renderer/src/components/right-sidebar/checks-panel-terminal-worktree.test.ts": 79,
+      "src/renderer/src/components/right-sidebar/checks-panel/gitlab-review-client.test.ts": 40,
+      "src/renderer/src/components/right-sidebar/checks-panel/panel-content-rendering.test.tsx": 4868,
+      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-check-and-review-actions.test.tsx": 2604,
+      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-create-review.test.tsx": 597,
+      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-generation.test.tsx": 2098,
+      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-git-status-effects.test.tsx": 471,
+      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-manual-refresh.test.tsx": 2233,
+      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-polling.test.tsx": 678,
+      "src/renderer/src/components/right-sidebar/coalesced-poll-runner.test.ts": 69,
+      "src/renderer/src/components/right-sidebar/commit-failure-dialog-state.test.ts": 40,
+      "src/renderer/src/components/right-sidebar/commit-failure-summary.test.ts": 43,
+      "src/renderer/src/components/right-sidebar/create-review-draft-title.test.ts": 38,
+      "src/renderer/src/components/right-sidebar/diff-comments-clear-dialog-state.test.ts": 37,
+      "src/renderer/src/components/right-sidebar/discard-all-sequence.test.ts": 66,
+      "src/renderer/src/components/right-sidebar/file-explorer-add-project-action.test.ts": 41,
+      "src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.test.ts": 147,
+      "src/renderer/src/components/right-sidebar/file-explorer-dir-load-tracker.test.ts": 40,
+      "src/renderer/src/components/right-sidebar/file-explorer-dir-toggle-timing.test.ts": 239,
+      "src/renderer/src/components/right-sidebar/file-explorer-directory-listing.test.ts": 87,
+      "src/renderer/src/components/right-sidebar/file-explorer-drag-scroll-marker.test.tsx": 2626,
+      "src/renderer/src/components/right-sidebar/file-explorer-entries.test.ts": 29,
+      "src/renderer/src/components/right-sidebar/file-explorer-expanded-dirs-refresh.test.ts": 1574,
+      "src/renderer/src/components/right-sidebar/file-explorer-inline-input-outside-click.test.tsx": 842,
+      "src/renderer/src/components/right-sidebar/file-explorer-inline-rename-flow.test.tsx": 646,
+      "src/renderer/src/components/right-sidebar/file-explorer-instant-dir-toggle.test.ts": 677,
+      "src/renderer/src/components/right-sidebar/file-explorer-keyboard-navigation.test.ts": 66,
+      "src/renderer/src/components/right-sidebar/file-explorer-name-filter-projection.test.ts": 51,
+      "src/renderer/src/components/right-sidebar/file-explorer-operation-generation.test.ts": 1352,
+      "src/renderer/src/components/right-sidebar/file-explorer-paths.test.ts": 58,
+      "src/renderer/src/components/right-sidebar/file-explorer-refresh-concurrency.test.ts": 42,
+      "src/renderer/src/components/right-sidebar/file-explorer-reset.test.ts": 40,
+      "src/renderer/src/components/right-sidebar/file-explorer-row-projection.test.ts": 41,
+      "src/renderer/src/components/right-sidebar/file-explorer-runtime-owner-boundary.test.ts": 28,
+      "src/renderer/src/components/right-sidebar/file-explorer-selection.test.ts": 51,
+      "src/renderer/src/components/right-sidebar/file-explorer-stale-dir-cache.test.ts": 64,
+      "src/renderer/src/components/right-sidebar/file-explorer-watch-drive-root.test.ts": 1568,
+      "src/renderer/src/components/right-sidebar/file-explorer-watch-reconcile.test.ts": 2028,
+      "src/renderer/src/components/right-sidebar/file-explorer-watch-refresh-scheduler.test.ts": 58,
+      "src/renderer/src/components/right-sidebar/file-search-include-pattern.test.ts": 54,
+      "src/renderer/src/components/right-sidebar/folder-workspace-attached-worktrees.test.ts": 67,
+      "src/renderer/src/components/right-sidebar/fork-push-target-label.test.ts": 47,
+      "src/renderer/src/components/right-sidebar/git-status-push-signal-refresh.test.ts": 60,
+      "src/renderer/src/components/right-sidebar/git-status-refresh-branch-line-total.test.ts": 247,
+      "src/renderer/src/components/right-sidebar/git-status-refresh-scheduler.test.ts": 40,
+      "src/renderer/src/components/right-sidebar/git-status-refresh.test.ts": 173,
+      "src/renderer/src/components/right-sidebar/github-pr-link-modal.test.ts": 42,
+      "src/renderer/src/components/right-sidebar/github-pr-stack-merge.test.ts": 58,
+      "src/renderer/src/components/right-sidebar/gitlab-mr-merge-state.test.ts": 91,
+      "src/renderer/src/components/right-sidebar/local-workspace-port-sections.test.ts": 57,
+      "src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.test.ts": 294,
+      "src/renderer/src/components/right-sidebar/parent-pr-checks-refresh.test.ts": 176,
+      "src/renderer/src/components/right-sidebar/parent-pr-checks-rows.test.ts": 172,
+      "src/renderer/src/components/right-sidebar/plugin-panel-activity-items.test.ts": 145,
+      "src/renderer/src/components/right-sidebar/plugin-panel-bridge-host.test.ts": 256,
+      "src/renderer/src/components/right-sidebar/plugin-panel-watchdog-visibility.test.ts": 585,
+      "src/renderer/src/components/right-sidebar/plugin-panel-watchdog.test.ts": 189,
+      "src/renderer/src/components/right-sidebar/pr-comment-ack-summary.test.ts": 40,
+      "src/renderer/src/components/right-sidebar/pr-comment-presentation.test.ts": 516,
+      "src/renderer/src/components/right-sidebar/pr-comment-snapshotted-thread-resolver.test.ts": 46,
+      "src/renderer/src/components/right-sidebar/pr-comment-thread-resolution.test.ts": 73,
+      "src/renderer/src/components/right-sidebar/pr-comments-ai-launch-ack.test.ts": 70,
+      "src/renderer/src/components/right-sidebar/pr-comments-list-selection.test.tsx": 3795,
+      "src/renderer/src/components/right-sidebar/push-target-upstream-refresh-cache.test.ts": 203,
+      "src/renderer/src/components/right-sidebar/review-cache-entry-selection.test.ts": 52,
+      "src/renderer/src/components/right-sidebar/right-panel-comment-composer.ime-enter.test.tsx": 679,
+      "src/renderer/src/components/right-sidebar/right-panel-comment-focus-timers.test.ts": 39,
+      "src/renderer/src/components/right-sidebar/right-sidebar-activity-visibility.test.ts": 143,
+      "src/renderer/src/components/right-sidebar/right-sidebar-effective-tab.test.ts": 30,
+      "src/renderer/src/components/right-sidebar/right-sidebar-primary-action-layout.test.ts": 42,
+      "src/renderer/src/components/right-sidebar/right-sidebar-titlebar-drag-regions.render.test.tsx": 1020,
+      "src/renderer/src/components/right-sidebar/right-sidebar-titlebar-drag-regions.test.ts": 55,
+      "src/renderer/src/components/right-sidebar/right-sidebar-width.test.ts": 44,
+      "src/renderer/src/components/right-sidebar/runSourceControlAgentActionStart.test.ts": 203,
+      "src/renderer/src/components/right-sidebar/search-match-open.test.ts": 51,
+      "src/renderer/src/components/right-sidebar/search-rows.test.ts": 32,
+      "src/renderer/src/components/right-sidebar/source-control-action-recipe-match.test.ts": 154,
+      "src/renderer/src/components/right-sidebar/source-control-actions.test.ts": 51,
+      "src/renderer/src/components/right-sidebar/source-control-active-open-file-keys.test.ts": 33,
+      "src/renderer/src/components/right-sidebar/source-control-agent-action-dialog-support.test.ts": 143,
+      "src/renderer/src/components/right-sidebar/source-control-branch-context-row.test.tsx": 732,
+      "src/renderer/src/components/right-sidebar/source-control-branch-context-stats.test.ts": 120,
+      "src/renderer/src/components/right-sidebar/source-control-branch-section-heading.test.tsx": 1334,
+      "src/renderer/src/components/right-sidebar/source-control-commit-eligibility.test.ts": 49,
       "src/renderer/src/components/right-sidebar/source-control-commit-message-rows.test.ts": 99,
-      "src/renderer/src/components/right-sidebar/source-control-create-pr-intent-flow.test.ts": 18,
-      "src/renderer/src/components/right-sidebar/source-control-create-pr-intent-state.test.ts": 7,
-      "src/renderer/src/components/right-sidebar/source-control-create-review-blocked-action.test.ts": 10,
-      "src/renderer/src/components/right-sidebar/source-control-created-review-link.test.ts": 6,
-      "src/renderer/src/components/right-sidebar/source-control-discard-confirmation.test.ts": 17,
-      "src/renderer/src/components/right-sidebar/source-control-discard-dialog.test.tsx": 168,
-      "src/renderer/src/components/right-sidebar/source-control-dropdown-items.create-pr-intent.test.ts": 24,
-      "src/renderer/src/components/right-sidebar/source-control-dropdown-items.test.ts": 34,
-      "src/renderer/src/components/right-sidebar/source-control-entry-actions.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/source-control-entry-context-menu.test.tsx": 17,
-      "src/renderer/src/components/right-sidebar/source-control-file-filter.test.ts": 6,
-      "src/renderer/src/components/right-sidebar/source-control-header-toolbar-identity.test.tsx": 100,
-      "src/renderer/src/components/right-sidebar/source-control-header-toolbar.test.ts": 6,
-      "src/renderer/src/components/right-sidebar/source-control-hosted-review-creation-eligibility-snapshot.test.ts": 17,
-      "src/renderer/src/components/right-sidebar/source-control-hosted-review-push-target.test.ts": 6,
-      "src/renderer/src/components/right-sidebar/source-control-huge-repo-warning-dismissals.test.ts": 237,
-      "src/renderer/src/components/right-sidebar/source-control-manual-review-url.test.ts": 13,
-      "src/renderer/src/components/right-sidebar/source-control-primary-action.create-pr-intent.test.ts": 29,
-      "src/renderer/src/components/right-sidebar/source-control-primary-action.test.ts": 34,
-      "src/renderer/src/components/right-sidebar/source-control-push-recovery.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/source-control-section-order.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/source-control-split-open.test.ts": 7,
-      "src/renderer/src/components/right-sidebar/source-control-status-sort.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/source-control-submodule-expansion.test.ts": 16,
-      "src/renderer/src/components/right-sidebar/source-control-text-generation-defaults.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/source-control-too-many-changes-banner.test.tsx": 87,
-      "src/renderer/src/components/right-sidebar/source-control-tree.test.ts": 13,
-      "src/renderer/src/components/right-sidebar/source-control-virtual-file-list.test.tsx": 148,
-      "src/renderer/src/components/right-sidebar/source-control/listing/use-file-projection-work.test.tsx": 31,
-      "src/renderer/src/components/right-sidebar/source-control/listing/use-store-actions.store-subscriptions.test.tsx": 50,
-      "src/renderer/src/components/right-sidebar/source-control/review/suppressed-github-pr.test.ts": 10,
-      "src/renderer/src/components/right-sidebar/source-control/review/use-action-model.test.tsx": 20,
-      "src/renderer/src/components/right-sidebar/source-control/review/use-hosted-review-state.test.tsx": 38,
-      "src/renderer/src/components/right-sidebar/status-display.test.ts": 4,
-      "src/renderer/src/components/right-sidebar/use-checks-panel-terminal-worktree.test.ts": 87,
-      "src/renderer/src/components/right-sidebar/use-git-status-upstream-ref-watch.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/use-hosted-review-actions.test.tsx": 47,
-      "src/renderer/src/components/right-sidebar/use-installed-plugin-route-reconciliation.test.tsx": 23,
-      "src/renderer/src/components/right-sidebar/use-persisted-ai-vault-view-options.test.tsx": 34,
-      "src/renderer/src/components/right-sidebar/use-plugin-panel-theme-revision.test.tsx": 47,
-      "src/renderer/src/components/right-sidebar/use-source-control-ai.test.ts": 6,
-      "src/renderer/src/components/right-sidebar/use-source-control-branch-compare.test.tsx": 64,
-      "src/renderer/src/components/right-sidebar/use-source-control-git-history.test.tsx": 45,
-      "src/renderer/src/components/right-sidebar/useCreatePullRequestDialogFields.repo-default.test.ts": 28,
-      "src/renderer/src/components/right-sidebar/useCreatePullRequestDialogFields.test.ts": 48,
-      "src/renderer/src/components/right-sidebar/useFileExplorerDragDrop.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/useFileExplorerHandlers.test.ts": 14,
-      "src/renderer/src/components/right-sidebar/useFileExplorerKeys.test.ts": 4,
-      "src/renderer/src/components/right-sidebar/useFileExplorerRowDrag.test.ts": 20,
-      "src/renderer/src/components/right-sidebar/useFileExplorerTree.refresh-projection-churn.test.tsx": 35,
-      "src/renderer/src/components/right-sidebar/useFileExplorerTree.stale-dirs.test.tsx": 37,
-      "src/renderer/src/components/right-sidebar/useFileExplorerVisibleRowProjection.debounce.test.tsx": 110,
-      "src/renderer/src/components/right-sidebar/useFileExplorerVisibleRowProjection.test.ts": 12,
-      "src/renderer/src/components/right-sidebar/useFileExplorerWatch.pending-refresh.test.tsx": 27,
-      "src/renderer/src/components/right-sidebar/useFileExplorerWatch.test.ts": 12,
-      "src/renderer/src/components/right-sidebar/useFileSearchRunner.test.tsx": 27,
-      "src/renderer/src/components/right-sidebar/useGitStatusPolling.rerender.test.ts": 57,
-      "src/renderer/src/components/right-sidebar/useGitStatusPolling.test.ts": 585,
-      "src/renderer/src/components/right-sidebar/useHostedReviewStackParent.test.tsx": 33,
-      "src/renderer/src/components/right-sidebar/useSourceControlSelection.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/useSourceControlSubmoduleStatus.test.tsx": 39,
-      "src/renderer/src/components/settings/AccountsPane.test.tsx": 508,
-      "src/renderer/src/components/settings/AdvancedNetworkSettingsSection.test.ts": 9,
-      "src/renderer/src/components/settings/AdvancedPane.test.tsx": 37,
-      "src/renderer/src/components/settings/AgentSkillSetupPanel.freshness.test.tsx": 63,
-      "src/renderer/src/components/settings/AgentSkillSetupPanel.test.tsx": 479,
-      "src/renderer/src/components/settings/AgentsPane.test.tsx": 445,
-      "src/renderer/src/components/settings/AppearancePane.test.tsx": 694,
-      "src/renderer/src/components/settings/ArtifactsSettingsPane.test.tsx": 358,
-      "src/renderer/src/components/settings/AutomationsSettingsPane.test.tsx": 117,
-      "src/renderer/src/components/settings/BranchPrefixFeedback.test.tsx": 16,
-      "src/renderer/src/components/settings/BrowserClientHostedRemoteSetting.test.tsx": 116,
-      "src/renderer/src/components/settings/BrowserPane.test.ts": 6,
-      "src/renderer/src/components/settings/BrowserSshWorkspaceRoutingSetting.test.tsx": 111,
-      "src/renderer/src/components/settings/BrowserUseSkillStep.test.tsx": 11,
-      "src/renderer/src/components/settings/CliSection.install-failure.test.tsx": 197,
-      "src/renderer/src/components/settings/CliSection.test.tsx": 87,
-      "src/renderer/src/components/settings/CliSkillRuntimeSetup.test.tsx": 60,
-      "src/renderer/src/components/settings/CloudVmSetupGuide.test.tsx": 28,
-      "src/renderer/src/components/settings/CommitMessageAiPane.test.tsx": 532,
-      "src/renderer/src/components/settings/DefaultWindowsProjectRuntimeSetting.test.tsx": 28,
-      "src/renderer/src/components/settings/DeveloperPermissionsPane.test.tsx": 283,
-      "src/renderer/src/components/settings/DiffShowWhitespaceSetting.test.tsx": 57,
-      "src/renderer/src/components/settings/EditorWordWrapSetting.test.tsx": 74,
-      "src/renderer/src/components/settings/EphemeralVmRuntimesSection.test.tsx": 128,
-      "src/renderer/src/components/settings/EphemeralVmsPane.test.tsx": 103,
-      "src/renderer/src/components/settings/ExperimentalPane.test.tsx": 797,
-      "src/renderer/src/components/settings/FloatingWorkspacePane.test.tsx": 6,
-      "src/renderer/src/components/settings/GeneralPane.test.ts": 11,
-      "src/renderer/src/components/settings/GeneralRemoteServerUpdates.test.tsx": 55,
-      "src/renderer/src/components/settings/GeneralUpdateSettingsSection.test.tsx": 79,
-      "src/renderer/src/components/settings/GeneralWorkspaceSettingsSection.test.tsx": 308,
-      "src/renderer/src/components/settings/GhosttyImportModal.test.ts": 17,
-      "src/renderer/src/components/settings/GitPane.test.ts": 54,
-      "src/renderer/src/components/settings/GitPane.test.tsx": 109,
-      "src/renderer/src/components/settings/GrokAccountsSection.test.tsx": 61,
-      "src/renderer/src/components/settings/HiddenExperimentalGroup.test.tsx": 85,
-      "src/renderer/src/components/settings/KagiSessionLinkForm.test.ts": 5,
-      "src/renderer/src/components/settings/LinearAgentSkillGuide.test.tsx": 49,
-      "src/renderer/src/components/settings/LinearAgentSkillNotes.test.tsx": 27,
-      "src/renderer/src/components/settings/LinearAgentSkillPane.test.tsx": 152,
-      "src/renderer/src/components/settings/LocalNetworkConnectionTest.test.tsx": 227,
-      "src/renderer/src/components/settings/MobileEmulatorAgentControlRow.test.tsx": 40,
-      "src/renderer/src/components/settings/MobilePairingConnectionOptions.test.tsx": 243,
-      "src/renderer/src/components/settings/MobilePairingQrSection.test.tsx": 203,
-      "src/renderer/src/components/settings/MobilePairingSetupSection.test.tsx": 748,
-      "src/renderer/src/components/settings/MobilePane.test.tsx": 885,
-      "src/renderer/src/components/settings/MobilePaneAddressSearch.test.tsx": 31,
-      "src/renderer/src/components/settings/NativeChatSupportedAgents.test.tsx": 114,
-      "src/renderer/src/components/settings/NotificationsPane.test.tsx": 55,
-      "src/renderer/src/components/settings/OpenInMenuSetting.test.ts": 23,
-      "src/renderer/src/components/settings/OrcaAccountSettingsPane.test.tsx": 140,
-      "src/renderer/src/components/settings/OrchestrationPane.test.tsx": 266,
-      "src/renderer/src/components/settings/OrchestrationSkillAgentCoverage.test.tsx": 26,
-      "src/renderer/src/components/settings/PluginConsentDialog.test.tsx": 450,
-      "src/renderer/src/components/settings/PluginInstallDialog.test.tsx": 165,
-      "src/renderer/src/components/settings/PluginKeybindingConsentPreview.test.ts": 7,
-      "src/renderer/src/components/settings/PluginMarketplaceBrowser.test.tsx": 397,
-      "src/renderer/src/components/settings/PluginMarketplaceSourceDialog.test.tsx": 195,
-      "src/renderer/src/components/settings/PluginSettingsRow.test.tsx": 75,
-      "src/renderer/src/components/settings/PluginsSettingsSection.lifecycle.test.tsx": 748,
-      "src/renderer/src/components/settings/PrivacyPane.test.ts": 47,
-      "src/renderer/src/components/settings/ProjectWindowsRuntimeSetting.test.tsx": 159,
-      "src/renderer/src/components/settings/QuickCommandsList.test.tsx": 122,
-      "src/renderer/src/components/settings/QuickCommandsPane.test.ts": 8,
-      "src/renderer/src/components/settings/RemoteServerUpdateDialog.test.tsx": 69,
-      "src/renderer/src/components/settings/RepositoryForkSyncSection.test.tsx": 62,
-      "src/renderer/src/components/settings/RepositoryHooksSection.test.ts": 120,
-      "src/renderer/src/components/settings/RepositoryHostSetupsSection.test.tsx": 354,
-      "src/renderer/src/components/settings/RepositoryHostSetupsSection.workspace-window.test.tsx": 71,
-      "src/renderer/src/components/settings/RepositoryIconEmojiPicker.test.tsx": 37,
-      "src/renderer/src/components/settings/RepositoryIconPicker.github-avatar-refresh.test.tsx": 47,
-      "src/renderer/src/components/settings/RepositoryPane.test.ts": 837,
-      "src/renderer/src/components/settings/RepositoryPaneDraftInput.test.tsx": 74,
-      "src/renderer/src/components/settings/RepositorySourceControlAiSection.test.ts": 73,
-      "src/renderer/src/components/settings/RepositoryWorktreeDefaultsSection.test.tsx": 130,
-      "src/renderer/src/components/settings/RuntimeEnvironmentsPane.test.ts": 17,
-      "src/renderer/src/components/settings/RuntimeHostAccessForm.test.tsx": 75,
-      "src/renderer/src/components/settings/RuntimePairingGeneratorForm.test.tsx": 41,
-      "src/renderer/src/components/settings/RuntimePairingUrlGenerator.test.tsx": 88,
-      "src/renderer/src/components/settings/Settings.load-performance.test.ts": 7,
-      "src/renderer/src/components/settings/SettingsConstants.test.ts": 9,
-      "src/renderer/src/components/settings/SettingsFormControls.font-autocomplete.test.tsx": 359,
-      "src/renderer/src/components/settings/SettingsFormControls.number-field.test.tsx": 66,
-      "src/renderer/src/components/settings/SettingsFormControls.segmented-control.test.tsx": 69,
-      "src/renderer/src/components/settings/SettingsSidebar.test.tsx": 79,
-      "src/renderer/src/components/settings/ShareSkillsSettingsPane.test.tsx": 192,
-      "src/renderer/src/components/settings/ShortcutCommandBlock.test.tsx": 76,
-      "src/renderer/src/components/settings/ShortcutFilterRail.test.ts": 10,
-      "src/renderer/src/components/settings/SourceControlActionRepoOverrideNote.test.tsx": 137,
-      "src/renderer/src/components/settings/SparsePresetSettingsSection.test.tsx": 28,
-      "src/renderer/src/components/settings/SshTargetCard.test.tsx": 89,
-      "src/renderer/src/components/settings/SshTargetForm.test.tsx": 363,
-      "src/renderer/src/components/settings/TaskSourceLinearSetup.test.tsx": 77,
-      "src/renderer/src/components/settings/TaskSourceProviderCard.test.tsx": 72,
-      "src/renderer/src/components/settings/TaskSourceShowInTasksStep.test.tsx": 32,
-      "src/renderer/src/components/settings/TaskSourceSimpleSetup.test.tsx": 40,
-      "src/renderer/src/components/settings/TasksPane.test.tsx": 282,
-      "src/renderer/src/components/settings/TerminalAdvancedSection.test.tsx": 85,
-      "src/renderer/src/components/settings/TerminalAppearanceSection.ghostty.test.ts": 48,
-      "src/renderer/src/components/settings/TerminalContrastSetting.test.tsx": 128,
-      "src/renderer/src/components/settings/TerminalFontSizeSetting.test.tsx": 62,
-      "src/renderer/src/components/settings/TerminalPane.pwsh.test.ts": 38,
-      "src/renderer/src/components/settings/TerminalSettingsPreview.lifecycle.test.tsx": 19,
-      "src/renderer/src/components/settings/TerminalTccAttributionNotice.test.tsx": 89,
-      "src/renderer/src/components/settings/TerminalThemeSections.lifecycle.test.ts": 51,
-      "src/renderer/src/components/settings/VoicePane.test.tsx": 443,
-      "src/renderer/src/components/settings/VoiceSpeechModelSection.test.tsx": 85,
-      "src/renderer/src/components/settings/WorkspaceDirectorySetting.test.tsx": 104,
-      "src/renderer/src/components/settings/accounts-search.test.ts": 7,
-      "src/renderer/src/components/settings/agent-availability-settings.test.ts": 19,
-      "src/renderer/src/components/settings/agent-default-env-draft.test.ts": 9,
-      "src/renderer/src/components/settings/agent-skill-installed-command-callers.test.ts": 103,
-      "src/renderer/src/components/settings/appearance-interface-summary.test.ts": 7,
-      "src/renderer/src/components/settings/appearance-search.test.ts": 315,
-      "src/renderer/src/components/settings/appearance-status-bar-search.test.ts": 8,
-      "src/renderer/src/components/settings/appearance-usage-percentage-search.test.ts": 3,
-      "src/renderer/src/components/settings/browser-cookie-import-label.test.ts": 9,
-      "src/renderer/src/components/settings/browser-link-routing-localization.test.ts": 222,
-      "src/renderer/src/components/settings/browser-search.test.ts": 60,
-      "src/renderer/src/components/settings/browser-session-host-selection.test.ts": 4,
-      "src/renderer/src/components/settings/cli-install-failure.test.ts": 7,
-      "src/renderer/src/components/settings/cli-source-control-integration-cards.test.tsx": 41,
-      "src/renderer/src/components/settings/codex-account-auth-warning.test.ts": 11,
-      "src/renderer/src/components/settings/codex-config-sync-warning.test.ts": 7,
-      "src/renderer/src/components/settings/codex-session-source-home-control.test.tsx": 10,
-      "src/renderer/src/components/settings/developer-permissions-search.test.ts": 280,
-      "src/renderer/src/components/settings/host-scoped-setting-scope.test.ts": 9,
-      "src/renderer/src/components/settings/integrations-pane-status.test.ts": 10,
-      "src/renderer/src/components/settings/jira-integration-card.test.tsx": 71,
-      "src/renderer/src/components/settings/linear-agent-skill-install-cta.test.tsx": 126,
-      "src/renderer/src/components/settings/mobile-network-interface-selection.test.ts": 9,
-      "src/renderer/src/components/settings/mobile-pairing-device-polling.test.ts": 6,
-      "src/renderer/src/components/settings/mobile-pane-search.test.ts": 9,
-      "src/renderer/src/components/settings/native-chat-experimental-search-entry.test.ts": 11,
-      "src/renderer/src/components/settings/osc52-clipboard-copy.test.ts": 7,
-      "src/renderer/src/components/settings/plugin-install-source.test.ts": 9,
-      "src/renderer/src/components/settings/provider-account-scope.test.ts": 12,
-      "src/renderer/src/components/settings/provider-account-visibility.test.ts": 5,
-      "src/renderer/src/components/settings/provider-rate-limit-scope-panels.test.tsx": 31,
-      "src/renderer/src/components/settings/repository-hook-settings-draft.test.ts": 7,
-      "src/renderer/src/components/settings/repository-host-setup-options.test.ts": 6,
-      "src/renderer/src/components/settings/repository-icon-github.test.ts": 8,
-      "src/renderer/src/components/settings/repository-source-control-ai-global-ux.test.ts": 52,
-      "src/renderer/src/components/settings/repository-source-control-ai-persist-queue.test.ts": 10,
-      "src/renderer/src/components/settings/setting-ownership.test.ts": 13,
-      "src/renderer/src/components/settings/settings-deep-link-target-watcher.test.ts": 18,
-      "src/renderer/src/components/settings/settings-form-option-filter.test.ts": 13,
-      "src/renderer/src/components/settings/settings-project-list.test.ts": 21,
-      "src/renderer/src/components/settings/settings-search-keywords.test.ts": 122,
-      "src/renderer/src/components/settings/settings-search.test.ts": 9,
-      "src/renderer/src/components/settings/settings-setup-guide-progress-hook.test.tsx": 12,
-      "src/renderer/src/components/settings/settings-setup-guide-progress.test.ts": 5,
-      "src/renderer/src/components/settings/shortcut-binding-list-mutations.test.ts": 10,
-      "src/renderer/src/components/settings/shortcut-definition-catalog.test.ts": 269,
-      "src/renderer/src/components/settings/shortcut-groups.test.ts": 14,
-      "src/renderer/src/components/settings/shortcut-recording-state.test.ts": 5,
-      "src/renderer/src/components/settings/shortcut-row-visibility.test.ts": 14,
-      "src/renderer/src/components/settings/sparse-preset-date.test.ts": 26,
-      "src/renderer/src/components/settings/sparse-preset-operation-error.test.ts": 3,
-      "src/renderer/src/components/settings/ssh-target-action-state.test.ts": 4,
-      "src/renderer/src/components/settings/ssh-target-draft.test.ts": 17,
-      "src/renderer/src/components/settings/ssh-target-remove.test.ts": 10,
-      "src/renderer/src/components/settings/ssh-target-save-payload.test.ts": 10,
-      "src/renderer/src/components/settings/task-source-setup-state.test.ts": 11,
-      "src/renderer/src/components/settings/task-tracker-integration-cards.test.tsx": 134,
-      "src/renderer/src/components/settings/terminal-preview-content.test.ts": 7,
-      "src/renderer/src/components/settings/terminal-search.test.ts": 56,
-      "src/renderer/src/components/settings/use-debounced-settings-text-draft.test.ts": 35,
-      "src/renderer/src/components/settings/use-mac-captured-digit-chords.test.ts": 393,
-      "src/renderer/src/components/settings/use-repository-hook-settings-draft.test.tsx": 34,
-      "src/renderer/src/components/settings/use-task-source-provider-readiness.test.tsx": 25,
-      "src/renderer/src/components/settings/useGhosttyImport.test.ts": 17,
-      "src/renderer/src/components/settings/useWarpThemeImport.test.ts": 31,
-      "src/renderer/src/components/settings/worktree-symlink-path-filter.test.ts": 11,
-      "src/renderer/src/components/setup-guide/SetupGuideModal.mount-gating.test.tsx": 1073,
-      "src/renderer/src/components/setup-guide/use-setup-guide-progress.test.ts": 10,
-      "src/renderer/src/components/setup-guide/use-setup-guide-telemetry.test.ts": 10,
-      "src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts": 184,
-      "src/renderer/src/components/shared/useDaemonActions.test.tsx": 27,
-      "src/renderer/src/components/sidebar/AddProjectFromFolderDialog.test.tsx": 198,
-      "src/renderer/src/components/sidebar/AddRemoteHostDialog.config-picker.test.tsx": 603,
-      "src/renderer/src/components/sidebar/AddRemoteHostFields.test.tsx": 39,
-      "src/renderer/src/components/sidebar/AddRepoCreateStep.test.tsx": 54,
-      "src/renderer/src/components/sidebar/AddRepoDialog.default-checkout.test.ts": 8,
-      "src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx": 71,
-      "src/renderer/src/components/sidebar/AddRepoHostSelector.test.tsx": 43,
-      "src/renderer/src/components/sidebar/AddRepoNestedImportStep.test.tsx": 146,
-      "src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx": 283,
-      "src/renderer/src/components/sidebar/AddRepoSteps.default-checkout.test.ts": 103,
-      "src/renderer/src/components/sidebar/AgentDashboardSidebarHost.test.tsx": 40,
-      "src/renderer/src/components/sidebar/AutoRenameFailedDialog.test.tsx": 229,
-      "src/renderer/src/components/sidebar/CacheTimer.test.tsx": 15,
-      "src/renderer/src/components/sidebar/CommentMarkdown.github-attachment-image.test.tsx": 68,
-      "src/renderer/src/components/sidebar/CommentMarkdown.link-click.test.tsx": 134,
-      "src/renderer/src/components/sidebar/CommentMarkdown.test.tsx": 309,
-      "src/renderer/src/components/sidebar/DeleteWorktreeDialog.host-context-boundary.test.ts": 7,
-      "src/renderer/src/components/sidebar/DeleteWorktreeDialog.test.tsx": 523,
-      "src/renderer/src/components/sidebar/DeleteWorktreeTargetPreview.test.tsx": 105,
-      "src/renderer/src/components/sidebar/FilterToggleRow.test.tsx": 30,
-      "src/renderer/src/components/sidebar/ImportedWorktreesVisibilityLine.test.tsx": 34,
-      "src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.reminder-toast.test.tsx": 214,
-      "src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.test.tsx": 820,
-      "src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.update-command.test.tsx": 242,
-      "src/renderer/src/components/sidebar/MarkdownImageLightbox.test.tsx": 265,
-      "src/renderer/src/components/sidebar/NewExternalWorktreesInboxLine.test.tsx": 109,
-      "src/renderer/src/components/sidebar/NonGitFolderDialog.test.tsx": 80,
-      "src/renderer/src/components/sidebar/NoticeHostGlyph.test.tsx": 59,
-      "src/renderer/src/components/sidebar/OrcaYamlTrustDialog.test.tsx": 24,
-      "src/renderer/src/components/sidebar/ProjectAddedDialog.test.tsx": 37,
-      "src/renderer/src/components/sidebar/ProjectGroupDeleteDialog.test.tsx": 194,
-      "src/renderer/src/components/sidebar/ProjectHeaderActions.test.tsx": 17,
-      "src/renderer/src/components/sidebar/RemoteFileBrowser.paste.test.tsx": 145,
-      "src/renderer/src/components/sidebar/RemoveFolderDialog.test.tsx": 15,
-      "src/renderer/src/components/sidebar/SetupGuideSidebarEntry.test.tsx": 65,
-      "src/renderer/src/components/sidebar/SetupScriptPromptCard.test.ts": 8,
-      "src/renderer/src/components/sidebar/SetupScriptPromptCardShell.test.tsx": 57,
-      "src/renderer/src/components/sidebar/Sidebar.test.tsx": 80,
-      "src/renderer/src/components/sidebar/SidebarAgentsList.test.tsx": 205,
-      "src/renderer/src/components/sidebar/SidebarFeedbackDialog.test.tsx": 312,
-      "src/renderer/src/components/sidebar/SidebarGroupByToggle.test.tsx": 62,
-      "src/renderer/src/components/sidebar/SidebarHeader.test.tsx": 200,
-      "src/renderer/src/components/sidebar/SidebarNav.test.tsx": 749,
-      "src/renderer/src/components/sidebar/SidebarRepositoryFilterSection.test.tsx": 507,
-      "src/renderer/src/components/sidebar/SidebarSettingsHelpMenu.test.tsx": 280,
-      "src/renderer/src/components/sidebar/SidebarToolbar.test.tsx": 129,
-      "src/renderer/src/components/sidebar/SidebarWorkspaceFilterSection.test.tsx": 123,
-      "src/renderer/src/components/sidebar/StatusIndicator.test.ts": 32,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanCard.host-identity.test.tsx": 30,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.mount-gating.test.tsx": 522,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.search.test.tsx": 179,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.task-status-sync.test.tsx": 128,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanDrawerHeader.test.tsx": 14,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanLaneCardList.test.tsx": 70,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanLaneGrid.test.tsx": 78,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanSearchField.test.tsx": 80,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanSettingsMenu.test.tsx": 211,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanStatusLane.test.tsx": 55,
-      "src/renderer/src/components/sidebar/WorktreeCard.affiliate-list-mode.test.tsx": 80,
-      "src/renderer/src/components/sidebar/WorktreeCard.compact-hover.test.tsx": 3366,
-      "src/renderer/src/components/sidebar/WorktreeCard.compact-ports-hover-independence.test.tsx": 1185,
-      "src/renderer/src/components/sidebar/WorktreeCard.hosted-review-refresh.test.tsx": 1294,
-      "src/renderer/src/components/sidebar/WorktreeCard.lineage.test.tsx": 1219,
-      "src/renderer/src/components/sidebar/WorktreeCard.merged-pr-display.test.tsx": 1041,
-      "src/renderer/src/components/sidebar/WorktreeCard.pinned-repo-icon.test.tsx": 1063,
-      "src/renderer/src/components/sidebar/WorktreeCard.pr-display.test.tsx": 1918,
-      "src/renderer/src/components/sidebar/WorktreeCard.quick-actions.test.tsx": 1401,
-      "src/renderer/src/components/sidebar/WorktreeCard.ssh-reconnect-prompt.test.tsx": 762,
-      "src/renderer/src/components/sidebar/WorktreeCard.test.ts": 9,
-      "src/renderer/src/components/sidebar/WorktreeCardAgents.activation.test.tsx": 523,
-      "src/renderer/src/components/sidebar/WorktreeCardAgents.expansion-remount.test.tsx": 470,
-      "src/renderer/src/components/sidebar/WorktreeCardAgents.send-target.test.tsx": 808,
-      "src/renderer/src/components/sidebar/WorktreeCardAgents.test.tsx": 673,
-      "src/renderer/src/components/sidebar/WorktreeCardAutomationDetailSection.test.tsx": 86,
-      "src/renderer/src/components/sidebar/WorktreeCardDisplayMenuSection.test.tsx": 76,
-      "src/renderer/src/components/sidebar/WorktreeCardMeta.interaction.test.tsx": 305,
-      "src/renderer/src/components/sidebar/WorktreeCardMeta.test.tsx": 99,
-      "src/renderer/src/components/sidebar/WorktreeCardPorts.test.tsx": 1109,
-      "src/renderer/src/components/sidebar/WorktreeCardSshHostControl.test.tsx": 281,
-      "src/renderer/src/components/sidebar/WorktreeCardStatusSlot.test.tsx": 53,
-      "src/renderer/src/components/sidebar/WorktreeContextMenu.delete-shortcut.test.tsx": 70,
-      "src/renderer/src/components/sidebar/WorktreeContextMenu.react185-bystander.test.tsx": 733,
-      "src/renderer/src/components/sidebar/WorktreeContextMenu.test.ts": 31,
-      "src/renderer/src/components/sidebar/WorktreeDeveloperMenu.test.tsx": 23,
-      "src/renderer/src/components/sidebar/WorktreeDeveloperMenuReveal.test.tsx": 73,
-      "src/renderer/src/components/sidebar/WorktreeList.card-memo-stability.test.tsx": 1046,
-      "src/renderer/src/components/sidebar/WorktreeList.empty-project-rows.test.ts": 1389,
-      "src/renderer/src/components/sidebar/WorktreeList.folder-workspace-rows.test.ts": 1843,
-      "src/renderer/src/components/sidebar/WorktreeList.group-headers.test.ts": 1975,
-      "src/renderer/src/components/sidebar/WorktreeList.lineage-agent-expansion-coupling.test.tsx": 2544,
-      "src/renderer/src/components/sidebar/WorktreeList.lineage-child-card.test.ts": 1842,
-      "src/renderer/src/components/sidebar/WorktreeList.lineage-child-real-card.test.tsx": 3279,
-      "src/renderer/src/components/sidebar/WorktreeList.status-lane-lineage-drop.test.tsx": 2529,
-      "src/renderer/src/components/sidebar/WorktreeMetaDialog.test.tsx": 1032,
-      "src/renderer/src/components/sidebar/WorktreeOpenInMenu.test.tsx": 30,
-      "src/renderer/src/components/sidebar/WorktreeParentPickerPopover.test.ts": 21,
-      "src/renderer/src/components/sidebar/WorktreeTitleInlineRename.begin-editing.test.tsx": 78,
-      "src/renderer/src/components/sidebar/WorktreeTitleInlineRename.editor-lifecycle.test.tsx": 147,
-      "src/renderer/src/components/sidebar/WorktreeTitleInlineRename.test.tsx": 24,
-      "src/renderer/src/components/sidebar/WorktreeVisibilityDialog.test.tsx": 2347,
-      "src/renderer/src/components/sidebar/WorktreeVisibilityHelpPopover.test.tsx": 496,
-      "src/renderer/src/components/sidebar/WorktreeVisibilitySourceList.test.tsx": 107,
-      "src/renderer/src/components/sidebar/active-worktree-focus-after-delete.test.ts": 13,
-      "src/renderer/src/components/sidebar/add-remote-host-ssh-actions.test.ts": 18,
-      "src/renderer/src/components/sidebar/add-repo-browse-authority.test.ts": 9,
-      "src/renderer/src/components/sidebar/add-repo-existing-workspaces-telemetry.test.ts": 15,
-      "src/renderer/src/components/sidebar/add-repo-skip-finalization.test.ts": 6,
-      "src/renderer/src/components/sidebar/clone-defaults.test.ts": 6,
-      "src/renderer/src/components/sidebar/create-project-defaults.test.ts": 7,
-      "src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts": 12,
-      "src/renderer/src/components/sidebar/delete-worktree-dirty-change-counts.test.ts": 3,
-      "src/renderer/src/components/sidebar/delete-worktree-failure-toast.test.tsx": 44,
-      "src/renderer/src/components/sidebar/delete-worktree-flow.test.ts": 284,
-      "src/renderer/src/components/sidebar/delete-worktree-parallel-flow.test.ts": 37,
-      "src/renderer/src/components/sidebar/delete-worktree-toast.test.ts": 8,
-      "src/renderer/src/components/sidebar/empty-project-placeholder-repos.test.ts": 10,
-      "src/renderer/src/components/sidebar/focused-agent-row-highlight.test.ts": 10,
-      "src/renderer/src/components/sidebar/folder-workspace-card-pr-display.test.ts": 18,
-      "src/renderer/src/components/sidebar/folder-workspace-composer-helpers.test.ts": 10,
-      "src/renderer/src/components/sidebar/folder-workspace-composer-path-status.test.tsx": 48,
-      "src/renderer/src/components/sidebar/folder-workspace-composer-submit.test.ts": 61,
-      "src/renderer/src/components/sidebar/folder-workspace-linked-startup-plan.test.ts": 6,
-      "src/renderer/src/components/sidebar/host-header-drag.test.tsx": 51,
-      "src/renderer/src/components/sidebar/host-header-menu-items.test.ts": 8,
-      "src/renderer/src/components/sidebar/host-rename-remove.test.ts": 8,
-      "src/renderer/src/components/sidebar/host-section-folder-workspace-counts.test.ts": 7,
-      "src/renderer/src/components/sidebar/host-section-order.test.ts": 5,
-      "src/renderer/src/components/sidebar/host-section-rows.test.ts": 12,
-      "src/renderer/src/components/sidebar/hovered-workspace-delete.test.ts": 115,
-      "src/renderer/src/components/sidebar/imported-worktrees-card-actions.test.ts": 13,
-      "src/renderer/src/components/sidebar/imported-worktrees-card-candidates.test.ts": 8,
-      "src/renderer/src/components/sidebar/linear-agent-skill-runtime.shell-override.test.ts": 5,
-      "src/renderer/src/components/sidebar/linear-agent-skill-setup-reminders.test.ts": 13,
-      "src/renderer/src/components/sidebar/local-base-ref-suggestion-toast.test.tsx": 52,
-      "src/renderer/src/components/sidebar/mobile-sidebar-onboarding-badge.test.ts": 34,
-      "src/renderer/src/components/sidebar/natural-worktree-ids.test.ts": 8,
-      "src/renderer/src/components/sidebar/new-external-worktrees-inbox-actions.test.ts": 10,
-      "src/renderer/src/components/sidebar/new-external-worktrees-inbox-candidates.test.ts": 7,
-      "src/renderer/src/components/sidebar/pinned-section-worktrees.test.ts": 363,
-      "src/renderer/src/components/sidebar/preserved-branch-batch-toast.test.tsx": 129,
-      "src/renderer/src/components/sidebar/preserved-branch-toast.test.tsx": 47,
-      "src/renderer/src/components/sidebar/project-added-default-checkout.test.ts": 22,
-      "src/renderer/src/components/sidebar/project-group-header-dom.test.ts": 6,
-      "src/renderer/src/components/sidebar/project-group-header-drag-commit.test.ts": 12,
-      "src/renderer/src/components/sidebar/project-group-header-drag-start.test.ts": 21,
-      "src/renderer/src/components/sidebar/project-group-header-drag.test.ts": 16,
-      "src/renderer/src/components/sidebar/project-group-header-drop.test.ts": 13,
-      "src/renderer/src/components/sidebar/project-header-action-selector-lockstep.test.ts": 7,
-      "src/renderer/src/components/sidebar/project-header-color.test.ts": 7,
-      "src/renderer/src/components/sidebar/project-header-drag-commit.test.ts": 12,
-      "src/renderer/src/components/sidebar/project-header-drag-start.test.ts": 11,
-      "src/renderer/src/components/sidebar/project-header-drag.test.ts": 14,
-      "src/renderer/src/components/sidebar/project-header-drop.test.ts": 7,
-      "src/renderer/src/components/sidebar/project-order-manual-default-notice-visibility.test.ts": 7,
-      "src/renderer/src/components/sidebar/prompt-cache-countdown-clock.test.ts": 11,
-      "src/renderer/src/components/sidebar/prompt-cache-timer-selection.test.ts": 5,
-      "src/renderer/src/components/sidebar/remote-file-browser-drive-paths.test.ts": 6,
-      "src/renderer/src/components/sidebar/remote-file-browser-helpers.test.ts": 39,
-      "src/renderer/src/components/sidebar/rendered-sidebar-worktree-order.test.ts": 42,
-      "src/renderer/src/components/sidebar/repo-header-create-state.test.ts": 10,
-      "src/renderer/src/components/sidebar/sidebar-empty-state-gate.test.ts": 4,
-      "src/renderer/src/components/sidebar/sidebar-filter-state.test.ts": 9,
-      "src/renderer/src/components/sidebar/sidebar-host-options.test.ts": 15,
-      "src/renderer/src/components/sidebar/sidebar-project-drop.test.ts": 10,
-      "src/renderer/src/components/sidebar/sidebar-resize-handle.test.ts": 8,
-      "src/renderer/src/components/sidebar/sidebar-workspace-option-items.test.ts": 9,
-      "src/renderer/src/components/sidebar/sleep-worktree-activation-race.test.ts": 17,
-      "src/renderer/src/components/sidebar/sleep-worktree-flow.test.ts": 19,
-      "src/renderer/src/components/sidebar/smart-attention.test.ts": 26,
-      "src/renderer/src/components/sidebar/smart-sort.test.ts": 17,
-      "src/renderer/src/components/sidebar/ssh-host-remove-resolution.test.ts": 10,
-      "src/renderer/src/components/sidebar/ssh-target-duplicate.test.ts": 8,
-      "src/renderer/src/components/sidebar/ssh-workspace-forget-resolution.test.ts": 5,
-      "src/renderer/src/components/sidebar/stale-agent-row-unverifiable.test.ts": 13,
-      "src/renderer/src/components/sidebar/truncated-sidebar-label.test.tsx": 63,
-      "src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts": 157,
-      "src/renderer/src/components/sidebar/use-add-repo-hosted-controller.test.ts": 5,
-      "src/renderer/src/components/sidebar/use-feedback-image-drop.test.tsx": 46,
-      "src/renderer/src/components/sidebar/use-visible-workspace-kanban-worktree-ids.test.tsx": 28,
-      "src/renderer/src/components/sidebar/use-workspace-kanban-card-pointer-drag.test.ts": 10,
-      "src/renderer/src/components/sidebar/use-workspace-kanban-drawer-lingering.test.tsx": 28,
-      "src/renderer/src/components/sidebar/use-workspace-kanban-outside-dismiss.test.ts": 7,
-      "src/renderer/src/components/sidebar/use-workspace-kanban-selection.test.tsx": 21,
-      "src/renderer/src/components/sidebar/use-workspace-reveal-body-redirect.test.tsx": 33,
-      "src/renderer/src/components/sidebar/use-workspace-status-drop.test.ts": 7,
-      "src/renderer/src/components/sidebar/use-worktree-activity-status.test.tsx": 23,
-      "src/renderer/src/components/sidebar/use-worktree-activity-statuses.test.ts": 7,
-      "src/renderer/src/components/sidebar/use-worktree-card-secondary-details.store-subscriptions.test.tsx": 30,
-      "src/renderer/src/components/sidebar/useAddRepoCloneFlow.test.ts": 114,
-      "src/renderer/src/components/sidebar/useAddRepoLocalFolderFlow.test.ts": 127,
-      "src/renderer/src/components/sidebar/useAddRepoNestedImportFlow.test.ts": 13,
-      "src/renderer/src/components/sidebar/useAddRepoServerPathFlow.test.ts": 54,
-      "src/renderer/src/components/sidebar/useCreateProjectDefaults.test.ts": 30,
-      "src/renderer/src/components/sidebar/useCreateRepo.default-checkout.test.ts": 105,
-      "src/renderer/src/components/sidebar/useRenderedSetupScriptPromptState.test.ts": 20,
-      "src/renderer/src/components/sidebar/useSetupScriptPromptRevalidation.test.tsx": 63,
-      "src/renderer/src/components/sidebar/useWorkspaceBoardPanel.test.tsx": 68,
-      "src/renderer/src/components/sidebar/useWorktreeAgentRows.test.ts": 21,
-      "src/renderer/src/components/sidebar/visible-worktree-activity-inputs.test.ts": 9,
-      "src/renderer/src/components/sidebar/visible-worktree-indexes.test.ts": 12,
-      "src/renderer/src/components/sidebar/visible-worktrees.test.ts": 22,
-      "src/renderer/src/components/sidebar/workspace-board-task-status-sync.test.ts": 26,
-      "src/renderer/src/components/sidebar/workspace-creator-visibility.test.ts": 6,
-      "src/renderer/src/components/sidebar/workspace-delete-lineage.test.ts": 9,
-      "src/renderer/src/components/sidebar/workspace-kanban-area-selection.test.ts": 13,
-      "src/renderer/src/components/sidebar/workspace-kanban-card-pointer-drag-dom.test.ts": 7,
-      "src/renderer/src/components/sidebar/workspace-kanban-filtered-drop-index.test.ts": 11,
-      "src/renderer/src/components/sidebar/workspace-kanban-search.test.ts": 23,
-      "src/renderer/src/components/sidebar/workspace-kanban-sidebar-drop.test.ts": 21,
-      "src/renderer/src/components/sidebar/workspace-kanban-virtual-lane-layout.test.ts": 13,
-      "src/renderer/src/components/sidebar/workspace-kanban-worktree-groups.test.ts": 16,
-      "src/renderer/src/components/sidebar/workspace-lineage-menu-actions.test.ts": 9,
-      "src/renderer/src/components/sidebar/workspace-status.test.ts": 11,
-      "src/renderer/src/components/sidebar/worktree-agent-activity-summary.test.ts": 25,
-      "src/renderer/src/components/sidebar/worktree-agent-freshness-selector.test.ts": 10,
-      "src/renderer/src/components/sidebar/worktree-agent-orchestration-batch.test.ts": 17,
-      "src/renderer/src/components/sidebar/worktree-agent-orchestration-index.test.ts": 103,
-      "src/renderer/src/components/sidebar/worktree-agent-row-selectors.test.ts": 26,
-      "src/renderer/src/components/sidebar/worktree-card-agent-ack-inputs.test.tsx": 20,
-      "src/renderer/src/components/sidebar/worktree-card-agent-summary.test.ts": 31,
-      "src/renderer/src/components/sidebar/worktree-card-compact-agent-row.stable-message.test.tsx": 84,
-      "src/renderer/src/components/sidebar/worktree-card-details-hover-state.test.tsx": 26,
-      "src/renderer/src/components/sidebar/worktree-card-dom-events.test.ts": 6,
-      "src/renderer/src/components/sidebar/worktree-card-jira-issue-display.test.ts": 6,
-      "src/renderer/src/components/sidebar/worktree-card-markdown-isolation.test.ts": 344,
-      "src/renderer/src/components/sidebar/worktree-card-pr-display.test.ts": 11,
-      "src/renderer/src/components/sidebar/worktree-card-send-target-inputs.test.ts": 7,
-      "src/renderer/src/components/sidebar/worktree-card-status-inputs.test.ts": 8,
-      "src/renderer/src/components/sidebar/worktree-card-title-display.test.ts": 10,
-      "src/renderer/src/components/sidebar/worktree-context-menu-delete-intent.test.ts": 11,
-      "src/renderer/src/components/sidebar/worktree-delete-host-qualification.test.ts": 173,
-      "src/renderer/src/components/sidebar/worktree-delete-position-scaling.test.ts": 35,
-      "src/renderer/src/components/sidebar/worktree-delete-request.test.ts": 9,
-      "src/renderer/src/components/sidebar/worktree-drag-units.test.ts": 10,
-      "src/renderer/src/components/sidebar/worktree-filter-visibility.test.ts": 8,
-      "src/renderer/src/components/sidebar/worktree-header-section-boundaries.test.ts": 6,
-      "src/renderer/src/components/sidebar/worktree-keyboard-cycle.test.ts": 7,
-      "src/renderer/src/components/sidebar/worktree-lineage-drag-drop.test.ts": 15,
-      "src/renderer/src/components/sidebar/worktree-lineage-expansion.performance.test.ts": 159,
-      "src/renderer/src/components/sidebar/worktree-lineage-projection.test.ts": 10,
-      "src/renderer/src/components/sidebar/worktree-lineage-toggle-handler-cache.test.ts": 10,
-      "src/renderer/src/components/sidebar/worktree-list-groups-host-collision.test.ts": 17,
-      "src/renderer/src/components/sidebar/worktree-list-groups-host-labels.test.ts": 23,
-      "src/renderer/src/components/sidebar/worktree-list-groups-imported-worktrees.test.ts": 22,
-      "src/renderer/src/components/sidebar/worktree-list-groups-lineage-nesting.test.ts": 17,
-      "src/renderer/src/components/sidebar/worktree-list-groups-nested-project-groups.test.ts": 16,
-      "src/renderer/src/components/sidebar/worktree-list-groups-notice-host-labels.test.ts": 16,
-      "src/renderer/src/components/sidebar/worktree-list-groups-pending-creations.test.ts": 13,
-      "src/renderer/src/components/sidebar/worktree-list-groups-pinned-host-labels.test.ts": 11,
-      "src/renderer/src/components/sidebar/worktree-list-groups-project-groups.test.ts": 16,
-      "src/renderer/src/components/sidebar/worktree-list-groups-project-host-setups.test.ts": 19,
-      "src/renderer/src/components/sidebar/worktree-list-groups-project-order.test.ts": 1284,
-      "src/renderer/src/components/sidebar/worktree-list-groups-section-label-disambiguation.test.ts": 12,
-      "src/renderer/src/components/sidebar/worktree-list/grouping/build-rows.folder-workspace-lanes.test.ts": 22,
-      "src/renderer/src/components/sidebar/worktree-list/grouping/build-rows.test.ts": 21,
-      "src/renderer/src/components/sidebar/worktree-list/grouping/host-labels.test.ts": 8,
-      "src/renderer/src/components/sidebar/worktree-list/grouping/imported-rows.test.ts": 9,
-      "src/renderer/src/components/sidebar/worktree-list/listing/host-filtering.test.ts": 9,
-      "src/renderer/src/components/sidebar/worktree-list/listing/pending-worktree-creation-keys.test.ts": 5,
-      "src/renderer/src/components/sidebar/worktree-list/listing/review-cache-inputs.test.ts": 6,
-      "src/renderer/src/components/sidebar/worktree-list/listing/use-visible-worktrees.test.tsx": 35,
-      "src/renderer/src/components/sidebar/worktree-list/navigation/active-descendant-option.test.ts": 5,
-      "src/renderer/src/components/sidebar/worktree-list/navigation/folder-reveal.test.ts": 9,
-      "src/renderer/src/components/sidebar/worktree-list/navigation/render-row-lookup.folder-workspace.test.ts": 5,
-      "src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.host-identity.test.tsx": 24,
-      "src/renderer/src/components/sidebar/worktree-list/navigation/use-reveal-requests.test.tsx": 124,
-      "src/renderer/src/components/sidebar/worktree-list/navigation/use-selection-host-collision.test.tsx": 18,
-      "src/renderer/src/components/sidebar/worktree-list/rows/FolderPathStatusIndicator.test.tsx": 38,
-      "src/renderer/src/components/sidebar/worktree-list/rows/RepoScanUnavailableIndicator.test.tsx": 57,
-      "src/renderer/src/components/sidebar/worktree-list/rows/indentation.test.ts": 8,
-      "src/renderer/src/components/sidebar/worktree-list/rows/option-dom-host-collision.test.ts": 11,
-      "src/renderer/src/components/sidebar/worktree-list/rows/use-project-group-dialogs-owner-host.test.tsx": 39,
-      "src/renderer/src/components/sidebar/worktree-list/viewport/hard-scroll-up.test.ts": 14,
-      "src/renderer/src/components/sidebar/worktree-list/viewport/scroll-adjustment.test.ts": 15,
-      "src/renderer/src/components/sidebar/worktree-list/viewport/sticky-headers.test.ts": 26,
-      "src/renderer/src/components/sidebar/worktree-list/viewport/use-row-removal-animation.test.ts": 8,
-      "src/renderer/src/components/sidebar/worktree-list/viewport/use-scroll-to-top.test.ts": 45,
-      "src/renderer/src/components/sidebar/worktree-list/viewport/use-scroll-to-top.test.tsx": 21,
-      "src/renderer/src/components/sidebar/worktree-list/viewport/virtual-rows.test.ts": 8,
-      "src/renderer/src/components/sidebar/worktree-list/viewport/visible-refresh.test.ts": 8,
-      "src/renderer/src/components/sidebar/worktree-manual-order-catalog.test.ts": 16,
-      "src/renderer/src/components/sidebar/worktree-manual-order-store-write.test.ts": 22,
-      "src/renderer/src/components/sidebar/worktree-manual-order.test.ts": 315,
-      "src/renderer/src/components/sidebar/worktree-meta-updates.test.ts": 14,
-      "src/renderer/src/components/sidebar/worktree-multi-selection.test.ts": 8,
-      "src/renderer/src/components/sidebar/worktree-name-suggestions.test.ts": 73,
-      "src/renderer/src/components/sidebar/worktree-parent-eligibility.test.ts": 9,
-      "src/renderer/src/components/sidebar/worktree-review-helpers.test.tsx": 22,
-      "src/renderer/src/components/sidebar/worktree-scroll-to-current-button.test.ts": 4,
-      "src/renderer/src/components/sidebar/worktree-sidebar-drag-autoscroll.test.ts": 15,
-      "src/renderer/src/components/sidebar/worktree-sidebar-drag-geometry.test.ts": 27,
-      "src/renderer/src/components/sidebar/worktree-sidebar-drop-preview.test.ts": 13,
-      "src/renderer/src/components/sidebar/worktree-sidebar-pointer-drag-dom.test.ts": 7,
-      "src/renderer/src/components/sidebar/worktree-sidebar-reveal-scroll-settle.test.ts": 3,
-      "src/renderer/src/components/sidebar/worktree-sidebar-reveal.test.ts": 10,
-      "src/renderer/src/components/sidebar/worktree-sidebar-row-preference.test.ts": 7,
-      "src/renderer/src/components/sidebar/worktree-sort-label-ordering.test.ts": 180,
-      "src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.test.ts": 20,
-      "src/renderer/src/components/sidebar/worktree-unambiguous-id-index.test.ts": 5,
-      "src/renderer/src/components/sidebar/worktree-unnest.test.ts": 19,
-      "src/renderer/src/components/sidebar/worktree-visibility-source-provenance.test.ts": 9,
-      "src/renderer/src/components/skills/SkillFreshnessNudge.test.tsx": 53,
-      "src/renderer/src/components/skills/SkillFreshnessStatusPill.test.tsx": 51,
-      "src/renderer/src/components/skills/SkillFreshnessUpdateDialog.test.tsx": 420,
-      "src/renderer/src/components/skills/SkillInstallAgentPicker.test.tsx": 226,
-      "src/renderer/src/components/skills/SkillInstallDialog.test.tsx": 1326,
-      "src/renderer/src/components/skills/SkillInstallManagementDialog.test.tsx": 1515,
-      "src/renderer/src/components/skills/SkillInstallTargetFields.test.tsx": 169,
-      "src/renderer/src/components/skills/SkillInstallWorkspaceCombobox.test.tsx": 537,
-      "src/renderer/src/components/skills/SkillShareDialog.test.tsx": 649,
-      "src/renderer/src/components/skills/SkillSharedLinkRow.test.tsx": 388,
-      "src/renderer/src/components/skills/SkillsPage.test.tsx": 1126,
-      "src/renderer/src/components/skills/skill-bundle-name.test.ts": 8,
-      "src/renderer/src/components/skills/skill-bundle-retry-selection.test.ts": 6,
-      "src/renderer/src/components/skills/skill-delete-copy.test.ts": 23,
-      "src/renderer/src/components/skills/skill-delete-selection.test.ts": 10,
-      "src/renderer/src/components/skills/skill-description-length.test.ts": 4,
-      "src/renderer/src/components/skills/skill-freshness-grouping.test.ts": 18,
-      "src/renderer/src/components/skills/skill-freshness-skipped-reason.test.ts": 11,
-      "src/renderer/src/components/skills/skill-install-progress-state.test.tsx": 23,
-      "src/renderer/src/components/skills/skill-install-provider-groups.test.ts": 11,
-      "src/renderer/src/components/skills/skill-install-workspace-choices.test.ts": 8,
-      "src/renderer/src/components/skills/skill-package-checklist-items.test.ts": 12,
-      "src/renderer/src/components/skills/skill-package-digest.test.ts": 5,
-      "src/renderer/src/components/skills/skill-package-install-risk.test.ts": 8,
-      "src/renderer/src/components/skills/skill-share-link.test.ts": 4,
-      "src/renderer/src/components/skills/skill-share-package-selection.test.ts": 5,
-      "src/renderer/src/components/skills/skill-share-preview-summary.test.ts": 21,
-      "src/renderer/src/components/skills/skill-share-selection.test.ts": 6,
-      "src/renderer/src/components/skills/skill-source-inventory.test.ts": 8,
-      "src/renderer/src/components/skills/skills-filter.test.ts": 5,
-      "src/renderer/src/components/source-control/SourceControlActionVariableChips.test.tsx": 56,
-      "src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.test.tsx": 86,
-      "src/renderer/src/components/star-nag/StarNagToastHost.test.tsx": 130,
-      "src/renderer/src/components/stats/GrokUsagePane.test.tsx": 106,
-      "src/renderer/src/components/stats/UsageBreakdownSection.test.tsx": 35,
-      "src/renderer/src/components/stats/UsageTrackingPaneShell.test.tsx": 230,
-      "src/renderer/src/components/stats/usage-daily-chart.test.tsx": 300,
-      "src/renderer/src/components/stats/usage-overview-model.test.ts": 202,
-      "src/renderer/src/components/status-bar/CaffeinateStatusSegment.localization.test.tsx": 645,
-      "src/renderer/src/components/status-bar/PetStatusSegment.layout.test.ts": 4,
-      "src/renderer/src/components/status-bar/PortsStatusSegment.host-routing.test.tsx": 100,
-      "src/renderer/src/components/status-bar/PortsStatusSegment.render-stability.test.tsx": 36,
-      "src/renderer/src/components/status-bar/ResourceUsageStatusSegment.rows.test.tsx": 62,
-      "src/renderer/src/components/status-bar/ResourceUsageStatusSegment.session-polling.test.ts": 6,
-      "src/renderer/src/components/status-bar/RuntimeHostStatusRow.test.tsx": 130,
-      "src/renderer/src/components/status-bar/SkillUpdateStatusSegment.test.tsx": 64,
-      "src/renderer/src/components/status-bar/SshStatusSegment.test.ts": 10,
-      "src/renderer/src/components/status-bar/UsagePercentageDisplayChangeNotice.test.tsx": 137,
-      "src/renderer/src/components/status-bar/UsageRosterPanel.test.tsx": 102,
-      "src/renderer/src/components/status-bar/codex-restart-status-summary.test.ts": 6,
-      "src/renderer/src/components/status-bar/codex-status-sign-in.test.tsx": 830,
-      "src/renderer/src/components/status-bar/icons.test.tsx": 16,
-      "src/renderer/src/components/status-bar/inline-usage-bars.test.tsx": 742,
-      "src/renderer/src/components/status-bar/mergeSnapshotAndSessions.test.ts": 29,
-      "src/renderer/src/components/status-bar/ports-status-popover-rows.test.tsx": 50,
-      "src/renderer/src/components/status-bar/provider-account-sync-key.test.ts": 6,
-      "src/renderer/src/components/status-bar/provider-segment-monthly-window.test.tsx": 672,
-      "src/renderer/src/components/status-bar/remote-host-connection-status.test.ts": 10,
-      "src/renderer/src/components/status-bar/resource-manager-terminal-copy.test.ts": 7,
-      "src/renderer/src/components/status-bar/resource-manager-worktree-target.test.ts": 5,
-      "src/renderer/src/components/status-bar/resource-memory-metric-copy.test.ts": 7,
-      "src/renderer/src/components/status-bar/resource-session-bindings.test.ts": 8,
-      "src/renderer/src/components/status-bar/resource-session-classification-parity.test.ts": 3,
-      "src/renderer/src/components/status-bar/resource-session-inventory.test.ts": 9,
-      "src/renderer/src/components/status-bar/resource-session-kill-confirmation.test.ts": 5,
-      "src/renderer/src/components/status-bar/resource-session-navigation.test.ts": 10,
-      "src/renderer/src/components/status-bar/resource-usage-open-slices.test.ts": 10,
-      "src/renderer/src/components/status-bar/resource-usage-space-scan-ready.test.ts": 7,
-      "src/renderer/src/components/status-bar/ssh-status-segment-copy.test.ts": 5,
-      "src/renderer/src/components/status-bar/status-bar-agent-gating.test.ts": 6,
-      "src/renderer/src/components/status-bar/status-bar-context-menu-policy.test.ts": 4,
-      "src/renderer/src/components/status-bar/status-bar-copy-localization.test.tsx": 310,
-      "src/renderer/src/components/status-bar/status-bar-provider-menu-focus.test.tsx": 773,
-      "src/renderer/src/components/status-bar/status-bar-provider-visibility.test.ts": 12,
-      "src/renderer/src/components/status-bar/status-bar-runtime-groups.test.ts": 12,
-      "src/renderer/src/components/status-bar/tooltip.test.ts": 51,
-      "src/renderer/src/components/status-bar/usage-error-copy.test.ts": 5,
-      "src/renderer/src/components/status-bar/usage-percentage-label.test.ts": 4,
-      "src/renderer/src/components/status-bar/usage-provider-settings-target.test.ts": 6,
-      "src/renderer/src/components/status-bar/usage-roster-formatting.test.ts": 6,
-      "src/renderer/src/components/status-bar/usage-roster-row-state.test.ts": 6,
-      "src/renderer/src/components/status-bar/use-resource-session-inventory.test.tsx": 677,
-      "src/renderer/src/components/status-bar/workspace-space-breakdown-list.test.tsx": 69,
-      "src/renderer/src/components/status-bar/workspace-space-delete-host-routing.test.ts": 8,
-      "src/renderer/src/components/status-bar/workspace-space-format.test.ts": 8,
-      "src/renderer/src/components/status-bar/workspace-space-layout.test.ts": 5,
-      "src/renderer/src/components/status-bar/workspace-space-manager-source-boundary.test.ts": 8,
-      "src/renderer/src/components/status-bar/workspace-space-presentation.test.ts": 133,
-      "src/renderer/src/components/tab-bar/BrowserTab.test.tsx": 1412,
-      "src/renderer/src/components/tab-bar/ClientHostedBrowserTabRows.test.tsx": 106,
-      "src/renderer/src/components/tab-bar/EditorFileTab.test.tsx": 840,
-      "src/renderer/src/components/tab-bar/EditorFileTabContextMenu.test.tsx": 505,
-      "src/renderer/src/components/tab-bar/QuickLaunchButton.test.ts": 37,
-      "src/renderer/src/components/tab-bar/RecentTabSwitcher.test.tsx": 46,
-      "src/renderer/src/components/tab-bar/SortableTab.rename-shortcut.test.tsx": 739,
-      "src/renderer/src/components/tab-bar/SortableTab.update-depth-probe.test.tsx": 113,
-      "src/renderer/src/components/tab-bar/SortableTabContextMenu.test.tsx": 121,
-      "src/renderer/src/components/tab-bar/TabBar.client-hosted-row-active-state.test.ts": 1116,
-      "src/renderer/src/components/tab-bar/TabBar.context-menu.test.ts": 2180,
-      "src/renderer/src/components/tab-bar/TabBar.windows-shell-launch.test.ts": 2043,
-      "src/renderer/src/components/tab-bar/TabBar.windows-shell-remote-runtime.test.ts": 1451,
-      "src/renderer/src/components/tab-bar/TabBar.windows-shell-ssh-host.test.ts": 1914,
-      "src/renderer/src/components/tab-bar/TabBar.worktree-write-gate.test.tsx": 1048,
-      "src/renderer/src/components/tab-bar/TabBar.worktree-write-gate.windows.test.tsx": 477,
-      "src/renderer/src/components/tab-bar/TabBarCreateEntry.history.test.tsx": 100,
-      "src/renderer/src/components/tab-bar/TabBarCreateEntry.keyboard.test.tsx": 166,
-      "src/renderer/src/components/tab-bar/TabBarCreateEntry.search.test.tsx": 199,
-      "src/renderer/src/components/tab-bar/TabBarCreateEntry.tab-results.test.tsx": 171,
-      "src/renderer/src/components/tab-bar/TabBarCreateEntryRow.test.tsx": 102,
-      "src/renderer/src/components/tab-bar/TabBarQuickCommandItem.test.tsx": 106,
-      "src/renderer/src/components/tab-bar/TabBarQuickCommandsMenu.keyboard.test.ts": 134,
-      "src/renderer/src/components/tab-bar/TabStripScrollIndicator.test.tsx": 63,
-      "src/renderer/src/components/tab-bar/TerminalTabLeadingIcon.test.tsx": 36,
-      "src/renderer/src/components/tab-bar/client-hosted-browser-row-strip-placement.test.ts": 6,
-      "src/renderer/src/components/tab-bar/drop-indicator.test.ts": 8,
-      "src/renderer/src/components/tab-bar/editor-tab-local-open-guard.test.ts": 5,
-      "src/renderer/src/components/tab-bar/group-tab-order.test.ts": 8,
-      "src/renderer/src/components/tab-bar/middle-button-default-guard.test.ts": 5,
-      "src/renderer/src/components/tab-bar/native-chat-tab-agent-evidence.test.ts": 9,
-      "src/renderer/src/components/tab-bar/open-tab-entry-dedupe.test.ts": 8,
-      "src/renderer/src/components/tab-bar/open-tab-search-retention.test.ts": 20,
-      "src/renderer/src/components/tab-bar/open-tab-search.test.ts": 35,
-      "src/renderer/src/components/tab-bar/open-tab-selection-routing.test.ts": 12,
-      "src/renderer/src/components/tab-bar/query-token-match.test.ts": 7,
-      "src/renderer/src/components/tab-bar/recent-tab-switching.test.ts": 8,
-      "src/renderer/src/components/tab-bar/reconcile-order.test.ts": 6,
-      "src/renderer/src/components/tab-bar/tab-agent-launch-options.test.ts": 15,
-      "src/renderer/src/components/tab-bar/tab-agent-types-by-tab-id.test.ts": 13,
-      "src/renderer/src/components/tab-bar/tab-bar-item-surface.client-hosted-active-state.test.tsx": 14,
-      "src/renderer/src/components/tab-bar/tab-context-menu-consistency.test.tsx": 8,
-      "src/renderer/src/components/tab-bar/tab-create-entry-action.test.ts": 35,
-      "src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts": 50,
-      "src/renderer/src/components/tab-bar/tab-create-entry-file-matches.test.ts": 36,
-      "src/renderer/src/components/tab-bar/tab-create-entry-forced-search.test.ts": 4,
-      "src/renderer/src/components/tab-bar/tab-create-entry-history-placement.test.ts": 6,
-      "src/renderer/src/components/tab-bar/tab-create-entry-local-path.test.ts": 285,
-      "src/renderer/src/components/tab-bar/tab-create-menu-options.test.ts": 16,
-      "src/renderer/src/components/tab-bar/tab-move-to-pane-column.test.ts": 12,
-      "src/renderer/src/components/tab-bar/tab-strip-content-resize-observers.test.ts": 11,
-      "src/renderer/src/components/tab-bar/tab-strip-overflow-navigation.test.ts": 6,
-      "src/renderer/src/components/tab-bar/tab-strip-pointer-activation.test.tsx": 35,
-      "src/renderer/src/components/tab-bar/tab-strip-scroll-metrics.test.ts": 6,
-      "src/renderer/src/components/tab-bar/tab-title-tooltip.test.tsx": 28,
-      "src/renderer/src/components/tab-bar/terminal-tab-activity-status.test.ts": 46,
-      "src/renderer/src/components/tab-bar/terminal-tab-spinner-launch-agent.test.ts": 15,
-      "src/renderer/src/components/tab-bar/use-open-tab-search.test.ts": 221,
-      "src/renderer/src/components/tab-bar/use-tab-bar-quick-command-search-input.test.ts": 29,
-      "src/renderer/src/components/tab-bar/windows-shell-launch.test.ts": 5,
-      "src/renderer/src/components/tab-bar/windows-shell-menu-visibility.test.ts": 7,
-      "src/renderer/src/components/tab-group/RetainedPaneHost.test.tsx": 75,
-      "src/renderer/src/components/tab-group/TabGroupPanel.context-menu.test.ts": 7,
-      "src/renderer/src/components/tab-group/TabGroupSplitLayout.drag.test.tsx": 128,
-      "src/renderer/src/components/tab-group/TabGroupSplitLayout.test.ts": 10,
-      "src/renderer/src/components/tab-group/TabPaneColumnSplitDragOverlay.test.tsx": 7,
-      "src/renderer/src/components/tab-group/tab-drag-pointer.test.ts": 4,
-      "src/renderer/src/components/tab-group/tab-drag-preview-activation.test.ts": 10,
-      "src/renderer/src/components/tab-group/tab-drag-retained-guest-passthrough.test.tsx": 60,
-      "src/renderer/src/components/tab-group/tab-drop-zone.test.ts": 4,
-      "src/renderer/src/components/tab-group/tab-group-body-anchor.test.ts": 4,
-      "src/renderer/src/components/tab-group/tab-group-panel-split-target.test.ts": 18,
-      "src/renderer/src/components/tab-group/tab-insertion.test.ts": 7,
-      "src/renderer/src/components/tab-group/useTabDragSplit.test.ts": 78,
-      "src/renderer/src/components/tab-group/useTabGroupCreationCommands.local-shell.test.ts": 679,
-      "src/renderer/src/components/tab-group/useTabGroupTabCloseCommands.structured-session.test.ts": 269,
-      "src/renderer/src/components/tab-group/useTabGroupTabCloseCommands.test.tsx": 69,
-      "src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.focus.test.ts": 1235,
-      "src/renderer/src/components/task-drawer-source-boundary.test.ts": 8,
-      "src/renderer/src/components/task-page-cache-selectors.test.ts": 11,
-      "src/renderer/src/components/task-page-checks-pill.test.ts": 5,
-      "src/renderer/src/components/task-page-default-repo-selection.test.ts": 18,
-      "src/renderer/src/components/task-page-empty-state.test.ts": 14,
-      "src/renderer/src/components/task-page-github-dialog-state-authority.test.ts": 10,
-      "src/renderer/src/components/task-page-github-issue-creation.test.ts": 5,
-      "src/renderer/src/components/task-page-github-list-scroll-restore.test.ts": 20,
-      "src/renderer/src/components/task-page-github-resume-cache.test.ts": 17,
-      "src/renderer/src/components/task-page-github-reviewer-suggestions.test.ts": 6,
-      "src/renderer/src/components/task-page-github-status-actions.test.ts": 7,
-      "src/renderer/src/components/task-page-github-status-state.test.ts": 7,
-      "src/renderer/src/components/task-page-github-task-kind.test.ts": 15,
-      "src/renderer/src/components/task-page-github-work-item-filter-membership.test.ts": 10,
-      "src/renderer/src/components/task-page-github-work-item-mutation-patches.test.ts": 13,
-      "src/renderer/src/components/task-page-github-work-item-mutation-regressions.test.ts": 22,
-      "src/renderer/src/components/task-page-github-work-item-mutations.test.ts": 24,
-      "src/renderer/src/components/task-page-github-work-item-status.test.ts": 9,
-      "src/renderer/src/components/task-page-gitlab-task-filters.test.ts": 5,
-      "src/renderer/src/components/task-page-initial-selection-scaling.test.tsx": 41,
-      "src/renderer/src/components/task-page-jira-cache-selectors.test.ts": 7,
-      "src/renderer/src/components/task-page-jira-create-fields.test.ts": 9,
-      "src/renderer/src/components/task-page-jira-grouping.test.ts": 194,
-      "src/renderer/src/components/task-page-jira-item-source-context.test.ts": 7,
-      "src/renderer/src/components/task-page-jira-load-state.test.ts": 7,
-      "src/renderer/src/components/task-page-jira-project-selection.test.ts": 8,
-      "src/renderer/src/components/task-page-jira-sort-controls.test.tsx": 186,
-      "src/renderer/src/components/task-page-jira-sorting.test.ts": 151,
-      "src/renderer/src/components/task-page-linear-in-orca-issues.test.ts": 14,
-      "src/renderer/src/components/task-page-linear-issue-dialog-popover-scroll.test.ts": 9,
-      "src/renderer/src/components/task-page-linear-issue-empty-state.test.ts": 6,
-      "src/renderer/src/components/task-page-linear-issue-grouping.test.ts": 11,
-      "src/renderer/src/components/task-page-linear-issue-request.test.ts": 6,
-      "src/renderer/src/components/task-page-linear-team-selection.test.ts": 9,
-      "src/renderer/src/components/task-page-list-chrome-visibility.test.ts": 7,
-      "src/renderer/src/components/task-page-localized-options.test.ts": 79,
-      "src/renderer/src/components/task-page-mutation-page-allocation.test.ts": 8,
-      "src/renderer/src/components/task-page-new-issue-draft.test.ts": 6,
-      "src/renderer/src/components/task-page-pagination-page-numbers.test.ts": 7,
-      "src/renderer/src/components/task-page-pr-check-summary.test.ts": 6,
-      "src/renderer/src/components/task-page-repo-source-context.test.ts": 10,
-      "src/renderer/src/components/task-page-repo-source-divergence.test.ts": 5,
-      "src/renderer/src/components/task-page-source-switch-boundary.test.ts": 9,
-      "src/renderer/src/components/task-page-task-creation-drafts.test.ts": 10,
-      "src/renderer/src/components/task-page-task-source-host-availability.test.ts": 11,
-      "src/renderer/src/components/task-page-work-item-pagination.test.ts": 18,
-      "src/renderer/src/components/task-page-workspace-composer-boundary.test.ts": 223,
-      "src/renderer/src/components/task-source-context-summary.test.ts": 17,
-      "src/renderer/src/components/task-source-provider-availability.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/CloseTerminalDialog.test.tsx": 135,
-      "src/renderer/src/components/terminal-pane/MobileDriverOverlay.test.tsx": 12,
-      "src/renderer/src/components/terminal-pane/PinnedTabCloseDialog.test.tsx": 200,
-      "src/renderer/src/components/terminal-pane/RunningTerminalCloseDialog.test.tsx": 269,
-      "src/renderer/src/components/terminal-pane/SessionRestoredBanner.test.tsx": 33,
-      "src/renderer/src/components/terminal-pane/TerminalAgentSessionForkDialog.test.tsx": 207,
-      "src/renderer/src/components/terminal-pane/TerminalContextMenu.test.tsx": 58,
-      "src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts": 127,
-      "src/renderer/src/components/terminal-pane/TerminalPaneHeaderOverlay.test.tsx": 101,
-      "src/renderer/src/components/terminal-pane/TerminalPaneNativeChatPortal.test.tsx": 24,
-      "src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.react185.test.tsx": 60,
-      "src/renderer/src/components/terminal-pane/TerminalProcessExitOverlay.test.tsx": 76,
-      "src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx": 70,
-      "src/renderer/src/components/terminal-pane/TerminalSshReconnectOverlay.test.tsx": 192,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-attention-dispatch.test.ts": 39,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-completion-replay-guard.test.ts": 20,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-dispose-leak.test.ts": 13,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-hook-done-quiet-window.test.ts": 28,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-hook-title-precedence.test.ts": 34,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-monitoring-turn-end.test.ts": 19,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-pending-title-inspection.test.ts": 18,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-process-cadence.test.ts": 44,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-queued-inspection-disposal.test.ts": 24,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-stamped-turn-boundary.test.ts": 20,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-stamped-turn-replay.test.ts": 23,
-      "src/renderer/src/components/terminal-pane/agent-completion-no-evidence-cadence.test.ts": 47,
-      "src/renderer/src/components/terminal-pane/agent-completion-poll-interval.test.ts": 185,
-      "src/renderer/src/components/terminal-pane/agent-completion-stale-evidence-backoff.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/agent-completion-steady-state-opt-in.test.ts": 11,
-      "src/renderer/src/components/terminal-pane/agent-hook-terminal-lifecycle.test.ts": 11,
-      "src/renderer/src/components/terminal-pane/agent-interrupt-inference.test.ts": 30,
-      "src/renderer/src/components/terminal-pane/agent-process-inspection-queue-rejection-containment.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/agent-process-inspection-round.test.ts": 18,
-      "src/renderer/src/components/terminal-pane/agent-question-answered-inference.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/cache-timer-seeding.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/codex-auto-approval-notification-suppression.test.ts": 112,
-      "src/renderer/src/components/terminal-pane/codex-backfill-error-detector.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/codex-detached-pane-restart.test.ts": 305,
-      "src/renderer/src/components/terminal-pane/command-code-done-settle.test.ts": 18,
-      "src/renderer/src/components/terminal-pane/command-code-output-ownership.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/compose-active-terminal-theme.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/deferred-reattach-live-data-queue.test.ts": 173,
-      "src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.test.ts": 15,
-      "src/renderer/src/components/terminal-pane/desktop-fit-fallback.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/direct-ssh-hidden-output-restore-unavailable-banner.test.ts": 1045,
-      "src/renderer/src/components/terminal-pane/edge-wrapped-terminal-http-links.test.ts": 31,
-      "src/renderer/src/components/terminal-pane/expand-collapse-render-stability.test.ts": 26,
-      "src/renderer/src/components/terminal-pane/expand-collapse.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/focus-terminal-pane-event.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/focused-pane-rim-flash.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/force-park-buffer-capture.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/git-bash-console-capacity.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/hard-wrapped-terminal-http-links.test.ts": 34,
-      "src/renderer/src/components/terminal-pane/hidden-output-restore-scheduler.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/hidden-reveal-reconciliation.fuzz.test.ts": 7500,
-      "src/renderer/src/components/terminal-pane/issue-12112-agent-pane-startup-color-reply-leak.repro.test.ts": 21,
-      "src/renderer/src/components/terminal-pane/issue-4631-terminal-hover-link-provider.repro.test.ts": 177,
-      "src/renderer/src/components/terminal-pane/keyboard-handlers-ime-composing-chord.test.tsx": 48,
-      "src/renderer/src/components/terminal-pane/keyboard-handlers-ime-enter-keyup.test.tsx": 59,
-      "src/renderer/src/components/terminal-pane/keyboard-handlers-ime.test.tsx": 54,
-      "src/renderer/src/components/terminal-pane/keyboard-handlers.test.ts": 17,
-      "src/renderer/src/components/terminal-pane/layout-serialization.test.ts": 19,
-      "src/renderer/src/components/terminal-pane/manual-terminal-worktree-park-eligibility.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/merge-captured-leaf-state.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/mobile-driver-overlay-collapse.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/mobile-driver-overlay-focus.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/mobile-driver-overlay-visibility.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/mouse-hide-while-typing.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/native-chat-leaf-title-agent.test.ts": 13,
-      "src/renderer/src/components/terminal-pane/osc52-clipboard-default-on-notice.test.ts": 58,
-      "src/renderer/src/components/terminal-pane/osc52-clipboard-toast.test.ts": 69,
-      "src/renderer/src/components/terminal-pane/osc52-clipboard.test.ts": 122,
-      "src/renderer/src/components/terminal-pane/override-affected-panes.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/paired-reconnect-multi-pane-materialization.test.ts": 1727,
-      "src/renderer/src/components/terminal-pane/pane-agent-session-id.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts": 59,
-      "src/renderer/src/components/terminal-pane/pane-foreground-inspect-observation-identity.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/pane-helpers.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/pane-title-overlay-rects.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts": 2029,
-      "src/renderer/src/components/terminal-pane/parked-terminal-command-status.test.ts": 56,
-      "src/renderer/src/components/terminal-pane/parse-osc7.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/pty-buffer-serializer.test.ts": 19,
-      "src/renderer/src/components/terminal-pane/pty-connection-agent-session-resume.test.ts": 1727,
-      "src/renderer/src/components/terminal-pane/pty-connection-cold-restore-agent-resume.test.ts": 1162,
-      "src/renderer/src/components/terminal-pane/pty-connection-cold-restore-repaint.test.ts": 699,
-      "src/renderer/src/components/terminal-pane/pty-connection-cold-restore-resume-command.test.ts": 709,
-      "src/renderer/src/components/terminal-pane/pty-connection-command-finished-cleanup.test.ts": 1591,
-      "src/renderer/src/components/terminal-pane/pty-connection-daemon-snapshot-replay.test.ts": 3135,
-      "src/renderer/src/components/terminal-pane/pty-connection-deferred-reattach-live-output.test.ts": 1466,
-      "src/renderer/src/components/terminal-pane/pty-connection-deferred-ssh-passphrase.test.ts": 1225,
-      "src/renderer/src/components/terminal-pane/pty-connection-deliberate-sleep-guard.test.ts": 1131,
-      "src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-reattach-retry.test.ts": 1727,
-      "src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-spawn-retry.test.ts": 1570,
-      "src/renderer/src/components/terminal-pane/pty-connection-foreground-agent-routing.test.ts": 1216,
-      "src/renderer/src/components/terminal-pane/pty-connection-foreground-agent-sampling.test.ts": 1659,
-      "src/renderer/src/components/terminal-pane/pty-connection-foreground-routing-confirmation.test.ts": 624,
-      "src/renderer/src/components/terminal-pane/pty-connection-foreground-write-path.test.ts": 1254,
-      "src/renderer/src/components/terminal-pane/pty-connection-fresh-spawn-guards.test.ts": 1432,
-      "src/renderer/src/components/terminal-pane/pty-connection-hibernation-wake.test.ts": 1373,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-atlas-recovery.test.ts": 1032,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-reconciliation.test.ts": 939,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts": 3190,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-codex-queries.test.ts": 1467,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-delivery-gate.test.ts": 1677,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-output-restore.test.ts": 597,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-query-snapshot-restore.test.ts": 1298,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-restore-fit-overflow.test.ts": 589,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-snapshot-live-overlap.test.ts": 814,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-snapshot-resize-signals.test.ts": 1012,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.test.ts": 835,
-      "src/renderer/src/components/terminal-pane/pty-connection-hook-completion-bell-arbitration.test.ts": 1536,
-      "src/renderer/src/components/terminal-pane/pty-connection-hook-completion-side-effects.test.ts": 1433,
-      "src/renderer/src/components/terminal-pane/pty-connection-hook-idle-arbitration.test.ts": 1039,
-      "src/renderer/src/components/terminal-pane/pty-connection-interrupt-inference.test.ts": 916,
-      "src/renderer/src/components/terminal-pane/pty-connection-main-side-effect-authority.test.ts": 922,
-      "src/renderer/src/components/terminal-pane/pty-connection-mode-2031-subscriptions.test.ts": 1134,
-      "src/renderer/src/components/terminal-pane/pty-connection-notification-settings-gating.test.ts": 869,
-      "src/renderer/src/components/terminal-pane/pty-connection-parked-ssh-snapshot.test.ts": 1744,
-      "src/renderer/src/components/terminal-pane/pty-connection-post-dispose-restore-termination.test.ts": 771,
-      "src/renderer/src/components/terminal-pane/pty-connection-pty-exit-teardown.test.ts": 3670,
-      "src/renderer/src/components/terminal-pane/pty-connection-queued-startup-consume.test.ts": 705,
-      "src/renderer/src/components/terminal-pane/pty-connection-reattach-binding.test.ts": 2385,
-      "src/renderer/src/components/terminal-pane/pty-connection-reattach-mode-reset.test.ts": 1987,
-      "src/renderer/src/components/terminal-pane/pty-connection-remote-runtime-attach.test.ts": 1224,
-      "src/renderer/src/components/terminal-pane/pty-connection-remote-snapshot-source-grid.test.ts": 807,
-      "src/renderer/src/components/terminal-pane/pty-connection-renderer-risk-repaint.test.ts": 1489,
-      "src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts": 1203,
-      "src/renderer/src/components/terminal-pane/pty-connection-restored-baseline-shortfall.test.ts": 835,
-      "src/renderer/src/components/terminal-pane/pty-connection-runtime-owner-spawn-routing.test.ts": 925,
-      "src/renderer/src/components/terminal-pane/pty-connection-session-liveness.test.ts": 1912,
-      "src/renderer/src/components/terminal-pane/pty-connection-setup-split-spawn.test.ts": 1083,
-      "src/renderer/src/components/terminal-pane/pty-connection-sleeping-resume-banner.test.ts": 798,
-      "src/renderer/src/components/terminal-pane/pty-connection-spawn-left-pane-unbound.test.ts": 897,
-      "src/renderer/src/components/terminal-pane/pty-connection-split-cwd-resolution.test.ts": 47,
-      "src/renderer/src/components/terminal-pane/pty-connection-ssh-startup-draft-delivery.test.ts": 698,
-      "src/renderer/src/components/terminal-pane/pty-connection-stalled-hidden-restore.test.ts": 3547,
-      "src/renderer/src/components/terminal-pane/pty-connection-startup-command-delivery.test.ts": 876,
-      "src/renderer/src/components/terminal-pane/pty-connection-task-complete-dispatch.test.ts": 1186,
-      "src/renderer/src/components/terminal-pane/pty-connection-terminal-input-gating.test.ts": 4079,
-      "src/renderer/src/components/terminal-pane/pty-connection-typed-agent-identity.test.ts": 1778,
-      "src/renderer/src/components/terminal-pane/pty-connection-visibility-resume-size.test.ts": 1757,
-      "src/renderer/src/components/terminal-pane/pty-connection-visible-pane-output-pause-latch.test.ts": 860,
-      "src/renderer/src/components/terminal-pane/pty-connection-windows-cjk-repaint.test.ts": 1118,
-      "src/renderer/src/components/terminal-pane/pty-connection-windows-keyboard-reset.test.ts": 1660,
-      "src/renderer/src/components/terminal-pane/pty-connection/direct-ssh-reattach-recovery.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/pty-connection/foreground-output-budgets.test.ts": 4,
-      "src/renderer/src/components/terminal-pane/pty-connection/pane-pty-layout-binding.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-context.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-ssh-reconnect-model-paint.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/pty-connection/reattach-success-settle.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/pty-connection/ssh-session-gone-verdict.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/pty-connection/terminal-tab-id.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/pty-connection/unbound-pane-spawn-recovery.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/pty-dispatcher-delivery-interest.test.ts": 98,
-      "src/renderer/src/components/terminal-pane/pty-dispatcher-delivery-resync.test.ts": 56,
-      "src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts": 317,
-      "src/renderer/src/components/terminal-pane/pty-dispatcher-push-reattach.test.ts": 89,
-      "src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts": 750,
-      "src/renderer/src/components/terminal-pane/pty-model-restore-channel.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/pty-pre-handler-buffer-warn-eviction.test.ts": 17,
-      "src/renderer/src/components/terminal-pane/pty-pre-handler-buffer.test.ts": 47,
-      "src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.test.ts": 50,
-      "src/renderer/src/components/terminal-pane/pty-renderer-delivery-claims.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/pty-shutdown-data-suspension.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/pty-shutdown-exit-deferral.test.ts": 68,
-      "src/renderer/src/components/terminal-pane/pty-shutdown-output-queue.test.ts": 1985,
-      "src/renderer/src/components/terminal-pane/pty-side-effect-pending-census.test.ts": 161,
-      "src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts": 383,
-      "src/renderer/src/components/terminal-pane/pty-transport-detach-attach-handoff.test.ts": 238,
-      "src/renderer/src/components/terminal-pane/pty-transport-eager-buffer-replay.test.ts": 321,
-      "src/renderer/src/components/terminal-pane/pty-transport-handler-suspension.test.ts": 311,
-      "src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts": 759,
-      "src/renderer/src/components/terminal-pane/pty-transport-output-side-effects.test.ts": 310,
-      "src/renderer/src/components/terminal-pane/pty-transport-pi-coalesce.test.ts": 169,
-      "src/renderer/src/components/terminal-pane/pty-transport-pi-spinner.test.ts": 165,
-      "src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts": 298,
-      "src/renderer/src/components/terminal-pane/pty-transport-recycled-pty-incarnation.test.ts": 157,
-      "src/renderer/src/components/terminal-pane/pty-transport-spawn-errors.test.ts": 148,
-      "src/renderer/src/components/terminal-pane/regular-terminal-focus-ownership.test.ts": 22,
-      "src/renderer/src/components/terminal-pane/remote-desktop-viewport-claim.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/remote-execution-host-pty.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/remote-hidden-output-restore-outcomes.test.ts": 1241,
-      "src/renderer/src/components/terminal-pane/remote-hidden-output-restore-unavailable-banner.repro.test.ts": 1012,
-      "src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/remote-runtime-connect-failure-recovery.test.ts": 1731,
-      "src/renderer/src/components/terminal-pane/remote-runtime-error-surface-dismissal.test.ts": 1369,
-      "src/renderer/src/components/terminal-pane/remote-runtime-outage-toast-flood-and-stuck-reconnect.test.ts": 2153,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-batching.test.ts": 72,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-deadline-reattach.test.ts": 2204,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-latched-pane-retention.test.ts": 4200,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-query-reply-immediate.test.ts": 2087,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts": 26,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-snapshot-escape-tail.test.ts": 1389,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-snapshot-source-grid.test.ts": 1605,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-activation-inventory-fallback.test.ts": 2053,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts": 3506,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-handoff.test.ts": 2653,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-outcome-recovery.test.ts": 2166,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-end-verdict.test.ts": 1292,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-expired-pane-recovery.test.ts": 2463,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts": 2411,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts": 5095,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-coalescing.test.ts": 3404,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts": 2595,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-pane-handle-resolution.test.ts": 2613,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-pending-host-surface-attach.test.ts": 1727,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-snapshot-replay.test.ts": 1654,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-split-leaf-activation.test.ts": 2871,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stale-handle-recovery.test.ts": 2313,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-sticky-replacement-policy.test.ts": 2038,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts": 3273,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-web-mirror-recovery.test.ts": 2711,
-      "src/renderer/src/components/terminal-pane/remote-runtime-resubscribe-failure-recovery-routing.test.ts": 1695,
-      "src/renderer/src/components/terminal-pane/renderer-owned-agent-status-registry.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/replay-guard.test.ts": 37,
-      "src/renderer/src/components/terminal-pane/replayed-scrollback-store-release.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/repro-8299-shift-space-input-source.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/repro-8832-url-next-line.test.ts": 19,
-      "src/renderer/src/components/terminal-pane/resolve-split-cwd.test.ts": 13,
-      "src/renderer/src/components/terminal-pane/restored-snapshot-coverage.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/session-restored-banner-pane-state.test.tsx": 64,
-      "src/renderer/src/components/terminal-pane/shell-ready-marker-scan.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/shutdown-buffer-captures.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/ssh-pane-connect-gate.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/ssh-reattach-model-restore.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/ssh-reconnect-model-paint-gate.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/stale-document-visibility.test.ts": 34,
-      "src/renderer/src/components/terminal-pane/terminal-agent-paste-bracketing.test.ts": 15,
-      "src/renderer/src/components/terminal-pane/terminal-agent-session-continuation.test.ts": 13,
-      "src/renderer/src/components/terminal-pane/terminal-agent-session-fork.test.ts": 152,
-      "src/renderer/src/components/terminal-pane/terminal-alternate-screen-parse.test.ts": 30,
-      "src/renderer/src/components/terminal-pane/terminal-appearance.test.ts": 28,
-      "src/renderer/src/components/terminal-pane/terminal-bracketed-paste.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/terminal-capability-replies.test.ts": 66,
-      "src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/terminal-cjk-cursor-cell-placement.test.ts": 68,
-      "src/renderer/src/components/terminal-pane/terminal-clipboard-event-paste.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/terminal-clipboard-paste.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/terminal-cold-park-exempt-flip.react185.test.tsx": 37,
-      "src/renderer/src/components/terminal-pane/terminal-cold-park-pre-gate-loop.react185.test.tsx": 64,
-      "src/renderer/src/components/terminal-pane/terminal-cold-park-recheck-deadlines.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/terminal-cold-park-subscription-narrowing.react185.test.tsx": 28,
-      "src/renderer/src/components/terminal-pane/terminal-cold-park-tab-model-identity.react185.test.tsx": 63,
-      "src/renderer/src/components/terminal-pane/terminal-cold-park-timer-rearm.test.tsx": 69,
-      "src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx": 39,
-      "src/renderer/src/components/terminal-pane/terminal-cold-park-withheld-tabs.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/terminal-command-lifecycle.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-context-menu-dismiss.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/terminal-copy-rejection-handling.test.ts": 11,
-      "src/renderer/src/components/terminal-pane/terminal-ctrl-arrow-conpty.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/terminal-ctrl-enter.test.ts": 15,
-      "src/renderer/src/components/terminal-pane/terminal-cursor-appearance-precedence.test.ts": 88,
-      "src/renderer/src/components/terminal-pane/terminal-cursor-inactive-style.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/terminal-delivery-watchdog.test.ts": 50,
-      "src/renderer/src/components/terminal-pane/terminal-drop-handler.test.ts": 34,
-      "src/renderer/src/components/terminal-pane/terminal-drop-image-path.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/terminal-drop-internal-handler.test.ts": 28,
-      "src/renderer/src/components/terminal-pane/terminal-drop-path-writer.test.ts": 21,
-      "src/renderer/src/components/terminal-pane/terminal-drop-runtime-owner.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/terminal-drop-shell.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/terminal-drop-upload-report.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-drop-write-failure.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/terminal-error-accumulation.test.ts": 15,
-      "src/renderer/src/components/terminal-pane/terminal-error-remote-closed-localization.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/terminal-eviction-exempt-tabs.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/terminal-file-link-actions.test.ts": 17,
-      "src/renderer/src/components/terminal-pane/terminal-fit-restore.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/terminal-freeze-report.test.ts": 27,
-      "src/renderer/src/components/terminal-pane/terminal-handle-copy.test.ts": 11,
-      "src/renderer/src/components/terminal-pane/terminal-handle-links.test.ts": 36,
-      "src/renderer/src/components/terminal-pane/terminal-hidden-restore-scrollback.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/terminal-hidden-worktree-retention.test.ts": 11,
-      "src/renderer/src/components/terminal-pane/terminal-http-link-activation.test.ts": 4,
-      "src/renderer/src/components/terminal-pane/terminal-http-link-source-owner.test.ts": 11,
-      "src/renderer/src/components/terminal-pane/terminal-http-url-extraction.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/terminal-ime-composer-placeholder-mask.test.ts": 687,
-      "src/renderer/src/components/terminal-pane/terminal-ime-composition-route.test.ts": 23,
-      "src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/terminal-ime-composition-transaction-ownership.test.ts": 17,
-      "src/renderer/src/components/terminal-pane/terminal-ime-deferred-chord.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/terminal-ime-deferred-newline.test.ts": 28,
-      "src/renderer/src/components/terminal-pane/terminal-ime-forwarder-space-claim.test.ts": 89,
-      "src/renderer/src/components/terminal-pane/terminal-ime-hangul-syllable-flush.test.ts": 261,
-      "src/renderer/src/components/terminal-pane/terminal-ime-hangul-terminating-digit.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/terminal-ime-input-context-refresh.test.ts": 22,
-      "src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/terminal-ime-macos-keybinding-dict-trace.test.ts": 134,
-      "src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts": 35,
-      "src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts": 160,
-      "src/renderer/src/components/terminal-pane/terminal-ime-won-composition-order.test.ts": 160,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-adversarial.test.ts": 1021,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-cancelled-preedit-visibility.test.ts": 152,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-composition-cancel.test.ts": 133,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-composition-deduplication.test.ts": 446,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-consumed-key-commit.test.ts": 157,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-korean-enter-commit-order.test.ts": 222,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-linux-native-trace-replay.test.ts": 2429,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-midline-preedit-tail.test.ts": 270,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-resumed-preedit-visibility.test.ts": 111,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-trailing-preedit-occlusion.test.ts": 206,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-transaction-events.test.ts": 277,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-windows-resumed-preedit-trace.test.ts": 273,
-      "src/renderer/src/components/terminal-pane/terminal-input-host-platform.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/terminal-input-quarantine.test.ts": 13,
-      "src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit-coexistence.test.ts": 295,
-      "src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit-device-trace.test.ts": 302,
-      "src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit.test.ts": 353,
-      "src/renderer/src/components/terminal-pane/terminal-jis-yen-input.test.ts": 4,
-      "src/renderer/src/components/terminal-pane/terminal-keyboard-event-handlers-focus.test.ts": 17,
-      "src/renderer/src/components/terminal-pane/terminal-keyboard-pane-resolution.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/terminal-keyboard-protocol-pane-agent.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/terminal-kitty-csi-u-encoding.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/terminal-layout-duplicate-pty-replay.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.test.ts": 11,
-      "src/renderer/src/components/terminal-pane/terminal-layout-overlay-focus.test.tsx": 27,
-      "src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership-depth.test.ts": 67,
-      "src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.test.ts": 26,
-      "src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts": 29,
-      "src/renderer/src/components/terminal-pane/terminal-link-activation.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-link-click-fallback.test.ts": 66,
-      "src/renderer/src/components/terminal-pane/terminal-link-file-open-routing.test.ts": 52,
-      "src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-link-osc-file-targets.test.ts": 64,
-      "src/renderer/src/components/terminal-pane/terminal-link-osc-url-routing.test.ts": 27,
-      "src/renderer/src/components/terminal-pane/terminal-link-pointer-gesture.test.ts": 11,
-      "src/renderer/src/components/terminal-pane/terminal-link-provider-link-detection.test.ts": 91,
-      "src/renderer/src/components/terminal-pane/terminal-link-pty-mouse-suppression.test.ts": 35,
-      "src/renderer/src/components/terminal-pane/terminal-link-remote-runtime-ssh-open.test.ts": 32,
-      "src/renderer/src/components/terminal-pane/terminal-link-worktree-root-activation.test.ts": 40,
-      "src/renderer/src/components/terminal-pane/terminal-link-wsl-path-mapping.test.ts": 42,
-      "src/renderer/src/components/terminal-pane/terminal-linkifier-click-priming.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/terminal-live-layout-reconciliation.test.ts": 19,
-      "src/renderer/src/components/terminal-pane/terminal-non-latin-control-chord.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/terminal-option-kitty-release.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/terminal-output-visibility.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/terminal-pane-attention-subscriptions.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/terminal-pane-close-identity.test.ts": 4,
-      "src/renderer/src/components/terminal-pane/terminal-pane-hook-order-parity.test.ts": 111,
-      "src/renderer/src/components/terminal-pane/terminal-pane-host-state-memo.test.ts": 21,
-      "src/renderer/src/components/terminal-pane/terminal-pane-host-state.test.ts": 13,
-      "src/renderer/src/components/terminal-pane/terminal-pane-listener-order-parity.test.ts": 196,
-      "src/renderer/src/components/terminal-pane/terminal-pane-recovery-unsettled-fallback.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/terminal-pane-recovery.test.ts": 44,
-      "src/renderer/src/components/terminal-pane/terminal-pane-split-completion.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/terminal-pane-split-request-routing.test.ts": 20,
-      "src/renderer/src/components/terminal-pane/terminal-pane-split-with-inherited-cwd.test.ts": 17,
-      "src/renderer/src/components/terminal-pane/terminal-pane-split-writer-paths.test.ts": 15,
-      "src/renderer/src/components/terminal-pane/terminal-pane-store-subscription-budget.test.tsx": 128,
-      "src/renderer/src/components/terminal-pane/terminal-pane-surface-ownership.test.ts": 23,
-      "src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts": 25,
-      "src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.test.ts": 19,
-      "src/renderer/src/components/terminal-pane/terminal-park-verdict-worktree-driver-loop.test.tsx": 45,
-      "src/renderer/src/components/terminal-pane/terminal-parked-pane-candidates.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/terminal-parked-tab-eviction-exemption.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers-batch-sync.test.ts": 92,
-      "src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts": 69,
-      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-partial-reconciliation.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-registry.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-sleep-preserved-exit.test.ts": 13,
-      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-sole-newborn-exit.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/terminal-parking-e2e-overrides.test.ts": 2548,
-      "src/renderer/src/components/terminal-pane/terminal-parser-handler-guard.test.ts": 18,
-      "src/renderer/src/components/terminal-pane/terminal-paste-coordinator.test.ts": 39,
-      "src/renderer/src/components/terminal-pane/terminal-paste-executor-default-yield.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/terminal-paste-multiline-policy.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/terminal-paste-operation-order.test.ts": 30,
-      "src/renderer/src/components/terminal-pane/terminal-paste-payload-metadata.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-paste-target-state.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/terminal-process-exit-restart.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/terminal-programmatic-text-paste.test.ts": 84,
-      "src/renderer/src/components/terminal-pane/terminal-pty-ack-gate.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/terminal-render-desync-frame.test.ts": 4,
-      "src/renderer/src/components/terminal-pane/terminal-render-desync-sentinel.test.ts": 395,
-      "src/renderer/src/components/terminal-pane/terminal-render-desync-weight-probe.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/terminal-renderer-policy.test.ts": 11,
-      "src/renderer/src/components/terminal-pane/terminal-replay-application-continuity.test.ts": 266,
-      "src/renderer/src/components/terminal-pane/terminal-replay-cursor-state.test.ts": 70,
-      "src/renderer/src/components/terminal-pane/terminal-restore-sgr-latch.test.ts": 62,
-      "src/renderer/src/components/terminal-pane/terminal-restored-viewport.test.ts": 25,
-      "src/renderer/src/components/terminal-pane/terminal-retention-exempt-growth.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/terminal-selection-copy.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/terminal-shortcut-ctrl-arrow.test.ts": 13,
-      "src/renderer/src/components/terminal-pane/terminal-shortcut-option-compose.test.ts": 29,
-      "src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts": 27,
-      "src/renderer/src/components/terminal-pane/terminal-shortcut-select-all.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.test.ts": 139,
-      "src/renderer/src/components/terminal-pane/terminal-side-effect-facts-handler.test.ts": 17,
-      "src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.test.ts": 287,
-      "src/renderer/src/components/terminal-pane/terminal-startup-command-classifier.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/terminal-startup-grid-settle.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/terminal-tab-agent-type-index.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/terminal-tab-lookup.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-title-evidence.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/terminal-title-tracker-parity.test.ts": 31,
-      "src/renderer/src/components/terminal-pane/terminal-unified-tab-lookup.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/terminal-url-link-click.test.ts": 29,
-      "src/renderer/src/components/terminal-pane/terminal-url-link-hit-testing.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/terminal-user-input-signal.test.ts": 15,
-      "src/renderer/src/components/terminal-pane/terminal-view-attributes-publisher.test.ts": 23,
-      "src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts": 31,
-      "src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-webgl-diagnostics-breadcrumbs.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts": 19,
-      "src/renderer/src/components/terminal-pane/terminal-worktree-path-link.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/title-agent-identity.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/use-manual-terminal-worktree-parking.test.ts": 3,
-      "src/renderer/src/components/terminal-pane/use-mobile-overlay-ticks.perf.test.tsx": 31,
-      "src/renderer/src/components/terminal-pane/use-notification-dispatch.test.ts": 44,
-      "src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.react185.test.tsx": 59,
-      "src/renderer/src/components/terminal-pane/use-system-prefers-dark.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-active-pty-reporting.test.ts": 15,
-      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-file-drop.test.ts": 22,
-      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-paste-events.test.ts": 43,
-      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-sync-fit-registration.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-visibility-resume.test.ts": 22,
-      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-window-focus-recovery.test.ts": 28,
-      "src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts": 19,
-      "src/renderer/src/components/terminal-pane/use-terminal-park-mount-intent.react185.test.tsx": 26,
-      "src/renderer/src/components/terminal-pane/use-terminal-scroll-visibility-memory.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts": 99,
-      "src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts": 55,
-      "src/renderer/src/components/terminal-pane/use-visible-terminal-tab-claim.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/useSessionRestoredBannerDismiss.test.tsx": 29,
-      "src/renderer/src/components/terminal-pane/useTerminalFontZoom.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/wrapped-terminal-link-ranges.test.ts": 25,
-      "src/renderer/src/components/terminal-pane/xterm-bypass-policy-interrupt.test.ts": 13,
-      "src/renderer/src/components/terminal-pane/xterm-bypass-policy-ios.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/xterm-write-buffer-stall.repro.test.ts": 24,
-      "src/renderer/src/components/terminal-parked-watcher-sync-entries.test.tsx": 37,
-      "src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialog.test.tsx": 660,
-      "src/renderer/src/components/terminal-quick-commands/terminal-quick-command-agent-options.test.ts": 10,
-      "src/renderer/src/components/terminal-quick-commands/terminal-quick-command-dialog-draft.test.ts": 11,
-      "src/renderer/src/components/terminal-scrollback-decoration-eviction.test.ts": 414,
-      "src/renderer/src/components/terminal-search-decoration-leak.test.ts": 1942,
-      "src/renderer/src/components/terminal-search-long-wrapped-line.test.ts": 4994,
-      "src/renderer/src/components/terminal-search-safe-find.test.ts": 7,
-      "src/renderer/src/components/terminal-workspace-keydown.test.ts": 246,
-      "src/renderer/src/components/terminal-workspace-surface-ids.test.tsx": 87,
-      "src/renderer/src/components/terminal/activation-deferred-tab-admission.test.ts": 13,
-      "src/renderer/src/components/terminal/active-terminal-repair-loop.react185.test.tsx": 38,
-      "src/renderer/src/components/terminal/active-terminal-repair.test.ts": 6,
-      "src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts": 24,
-      "src/renderer/src/components/terminal/background-terminal-worktree-visibility.test.ts": 14,
-      "src/renderer/src/components/terminal/cold-activation-deferral-stranding.test.ts": 37,
-      "src/renderer/src/components/terminal/initial-terminal-structured-launch.test.tsx": 26,
-      "src/renderer/src/components/terminal/initial-terminal-wiring.test.ts": 4,
-      "src/renderer/src/components/terminal/initial-terminal.test.ts": 4,
-      "src/renderer/src/components/terminal/pty-running-work-probe-child-evidence.test.ts": 9,
-      "src/renderer/src/components/terminal/running-terminal-close-guard.test.ts": 18,
-      "src/renderer/src/components/terminal/split-group-mount.test.ts": 8,
-      "src/renderer/src/components/terminal/tab-type-cycle.test.ts": 9,
-      "src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts": 12,
-      "src/renderer/src/components/terminal/terminal-close-copy-kind.test.ts": 8,
-      "src/renderer/src/components/terminal/terminal-close-incarnation.test.ts": 5,
-      "src/renderer/src/components/terminal/terminal-provider-snapshot-bound-pty-ids.test.ts": 74,
-      "src/renderer/src/components/terminal/terminal-provider-snapshot-capability-resettlement.test.ts": 15,
-      "src/renderer/src/components/terminal/terminal-provider-snapshot-capability.test.ts": 15,
-      "src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts": 15,
-      "src/renderer/src/components/terminal/terminal-tab-actions-structured-session.test.ts": 17,
-      "src/renderer/src/components/terminal/terminal-tab-actions-unified-close.test.ts": 32,
-      "src/renderer/src/components/terminal/terminal-tab-actions.test.ts": 32,
-      "src/renderer/src/components/terminal/terminal-tab-bulk-actions.test.ts": 12,
-      "src/renderer/src/components/terminal/terminal-tab-close-running-confirm.test.ts": 21,
-      "src/renderer/src/components/terminal/unsaved-close-queue.test.ts": 5,
-      "src/renderer/src/components/terminal/use-terminal-provider-snapshot-capability.test.tsx": 50,
-      "src/renderer/src/components/terminal/use-worktree-files.test.tsx": 52,
-      "src/renderer/src/components/terminal/window-close-running-work.test.ts": 23,
-      "src/renderer/src/components/ui/color-picker.test.tsx": 24,
-      "src/renderer/src/components/ui/popover-wheel-scroll.test.tsx": 243,
-      "src/renderer/src/components/ui/repo-multi-combobox.test.ts": 6,
-      "src/renderer/src/components/ui/scroll-area.test.tsx": 39,
-      "src/renderer/src/components/ui/slider.test.tsx": 111,
-      "src/renderer/src/components/ui/switch.test.tsx": 29,
-      "src/renderer/src/components/unexpected-signout/unexpected-signout-card.test.tsx": 206,
-      "src/renderer/src/components/unexpected-signout/unexpected-signout-visibility.test.ts": 9,
-      "src/renderer/src/components/use-github-task-search-commit.test.ts": 35,
-      "src/renderer/src/components/use-task-creation-draft-retention.test.ts": 25,
-      "src/renderer/src/components/use-terminal-create-actions.test.tsx": 22,
-      "src/renderer/src/components/use-terminal-editor-close-foundation.window-close.test.tsx": 28,
-      "src/renderer/src/components/use-terminal-window-lifecycle.lazy-ref.test.tsx": 16,
-      "src/renderer/src/components/use-worktree-jump-palette-browser-ownership.test.ts": 37,
-      "src/renderer/src/components/window-close-request-coordinator.test.ts": 19,
-      "src/renderer/src/components/workspace-cleanup/WorkspaceCleanupDialog.mount-gating.test.tsx": 100,
-      "src/renderer/src/components/workspace-cleanup/WorkspaceCleanupDialog.stale-while-revalidate.test.tsx": 1307,
-      "src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-browse-state.test.tsx": 43,
-      "src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-facet-rows.test.tsx": 58,
-      "src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-git-evidence.test.tsx": 60,
-      "src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-row-order.test.ts": 26,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-active-facets.test.ts": 11,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal-late-settlement.test.ts": 15,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal-snapshot-batch.test.ts": 63,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal.test.ts": 31,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-candidate-list.test.tsx": 47,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-candidate-row-data.test.ts": 6,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-candidate-row.test.tsx": 214,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-confirm-remove.test.tsx": 118,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-deletion-phases.test.ts": 9,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-dialog-notices.test.tsx": 59,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-facet-controls.test.tsx": 357,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-facet-filter.test.ts": 39,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-facet-sort.test.ts": 12,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-filter-bar.test.tsx": 237,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-flat-list.test.tsx": 280,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-git-evidence.test.ts": 16,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-presentation.test.ts": 27,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-removal-candidates.test.ts": 7,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-removal-settlement.test.ts": 9,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-removal-timeout-recovery.test.ts": 26,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-scanned-host-confirmation-removal.test.tsx": 470,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-sort-header.test.tsx": 82,
-      "src/renderer/src/components/workspace-emoji/WorkspaceEmojiSuggestionPopover.test.tsx": 83,
-      "src/renderer/src/components/workspace-emoji/useWorkspaceEmojiShortcodeInput.test.tsx": 122,
-      "src/renderer/src/components/workspace-surface-projection.test.ts": 39,
-      "src/renderer/src/components/worktree-creation/WorktreeCreationPanel.test.tsx": 74,
-      "src/renderer/src/components/worktree-jump-palette-interleaved-sections.test.tsx": 1645,
-      "src/renderer/src/components/worktree-jump-palette-primitives.test.tsx": 131,
-      "src/renderer/src/components/worktree-jump-palette-quick-action-availability.test.tsx": 20,
-      "src/renderer/src/components/worktree-jump-palette-sleeping-filter.test.ts": 9,
-      "src/renderer/src/components/worktree-jump-palette-source-context-boundary.test.ts": 4,
-      "src/renderer/src/components/worktree-jump-palette-status-inputs.test.ts": 6,
-      "src/renderer/src/hooks/agent-hook-completion-background-turn-notifications.test.ts": 134,
-      "src/renderer/src/hooks/agent-hook-completion-fresh-working.test.ts": 109,
-      "src/renderer/src/hooks/agent-hook-completion-notifications-import.test.ts": 92,
-      "src/renderer/src/hooks/agent-hook-completion-notifications.test.ts": 264,
-      "src/renderer/src/hooks/agent-hook-completion-store-sync.test.ts": 18,
-      "src/renderer/src/hooks/automation-agent-status-entry-change.test.ts": 7,
-      "src/renderer/src/hooks/automation-dispatch-unverifiable-loss.test.ts": 137,
-      "src/renderer/src/hooks/automations-changed-event-attribution.test.ts": 1424,
-      "src/renderer/src/hooks/composer-branch-selection.test.ts": 11,
-      "src/renderer/src/hooks/composer-drop-owner.test.ts": 4,
-      "src/renderer/src/hooks/composer-drop-upload-result.test.ts": 8,
-      "src/renderer/src/hooks/composer-native-file-drop.test.ts": 9,
-      "src/renderer/src/hooks/composer-state/composer-drop-listener.test.ts": 26,
-      "src/renderer/src/hooks/composer-state/draft-target-sync.test.ts": 24,
-      "src/renderer/src/hooks/composer-state/full-creation-execution.test.ts": 23,
-      "src/renderer/src/hooks/composer-state/full-creation-structured-launch.test.ts": 7,
-      "src/renderer/src/hooks/composer-state/full-submit-orchestration.test.ts": 22,
-      "src/renderer/src/hooks/composer-state/multiple-create-reset.test.ts": 29,
-      "src/renderer/src/hooks/composer-state/provider-runtime-sync.test.ts": 18,
-      "src/renderer/src/hooks/composer-state/quick-creation-request.test.ts": 10,
-      "src/renderer/src/hooks/direct-ssh-host-hydration.test.ts": 24,
-      "src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts": 30,
-      "src/renderer/src/hooks/direct-ssh-reconnect-rollout.test.ts": 11,
-      "src/renderer/src/hooks/direct-ssh-reconnect-tokens.test.ts": 6,
-      "src/renderer/src/hooks/direct-ssh-runtime-wake-isolation.test.tsx": 43,
-      "src/renderer/src/hooks/direct-ssh-state-routing.test.ts": 16,
-      "src/renderer/src/hooks/direct-ssh-worktree-refresh-scheduler.test.ts": 27,
-      "src/renderer/src/hooks/fork-push-warning.test.ts": 5,
-      "src/renderer/src/hooks/installed-agent-skill-discovery-cache.test.ts": 18,
-      "src/renderer/src/hooks/installed-agent-skill-discovery.test.ts": 9,
-      "src/renderer/src/hooks/ipc-events/agent-status-pane-routing-index.test.ts": 79,
-      "src/renderer/src/hooks/ipc-events/agent-status-pending-retry-gate.test.ts": 272,
-      "src/renderer/src/hooks/ipc-events/agent-status-terminal-title-tab-write.test.ts": 186,
-      "src/renderer/src/hooks/ipc-events/browser-automation-bootstrap-lease.test.ts": 10,
-      "src/renderer/src/hooks/ipc-events/browser-request-ipc-bridge.profile-switch.test.ts": 7,
-      "src/renderer/src/hooks/ipc-events/browser-state-open-link-profile.test.ts": 8,
-      "src/renderer/src/hooks/ipc-events/direct-ssh-hydration-fanout.test.ts": 12,
-      "src/renderer/src/hooks/ipc-events/direct-ssh-hydration-target-metadata.test.ts": 21,
-      "src/renderer/src/hooks/ipc-events/normalize-agent-status-event.test.ts": 6,
-      "src/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.test.ts": 111,
-      "src/renderer/src/hooks/ipc-events/os-markdown-file-open-bridge.test.ts": 16,
-      "src/renderer/src/hooks/ipc-events/runtime-reconnect-host-status.test.ts": 32,
-      "src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge-split.test.ts": 15,
-      "src/renderer/src/hooks/ipc-events/updater-status-ipc-bridge.test.ts": 6,
-      "src/renderer/src/hooks/ipc-tab-switch-group-order-hydration.test.ts": 11,
-      "src/renderer/src/hooks/ipc-tab-switch-structured-tab-cycle.test.ts": 11,
-      "src/renderer/src/hooks/ipc-tab-switch.test.ts": 17,
-      "src/renderer/src/hooks/legacy-worker-terminal-recovery-event.test.ts": 15,
-      "src/renderer/src/hooks/macos-tcc-prompt-notice-subscription.test.ts": 23,
-      "src/renderer/src/hooks/metadata-request-cache.test.ts": 142,
-      "src/renderer/src/hooks/mobile-terminal-reveal-tab-adoption.test.ts": 2166,
-      "src/renderer/src/hooks/modal-return-focus-action.test.ts": 7,
-      "src/renderer/src/hooks/programmatic-scroll-marks.test.ts": 9,
-      "src/renderer/src/hooks/remote-workspace-deferred-placement-retry.test.ts": 14,
-      "src/renderer/src/hooks/remote-workspace-session-merge-close-tombstones.test.ts": 13,
-      "src/renderer/src/hooks/remote-workspace-session-merge-closed-terminal-tombstone.test.ts": 39,
-      "src/renderer/src/hooks/remote-workspace-session-merge-local-survival.test.ts": 12,
-      "src/renderer/src/hooks/remote-workspace-snapshot-apply-deferred-session-write.test.ts": 76,
-      "src/renderer/src/hooks/remote-workspace-snapshot-arrival-coordinator.test.ts": 8,
-      "src/renderer/src/hooks/remote-workspace-snapshot-duplicate-tab-repair.test.ts": 68,
-      "src/renderer/src/hooks/remote-workspace-snapshot-fresh-client-tab-seeding.test.ts": 19,
-      "src/renderer/src/hooks/remote-workspace-snapshot-local-tab-survival.test.ts": 108,
-      "src/renderer/src/hooks/remote-workspace-snapshot-unplaced-tab-adoption.test.ts": 80,
-      "src/renderer/src/hooks/remote-workspace-target-sync.test.ts": 45,
-      "src/renderer/src/hooks/runtime-client-events-sync.test.ts": 66,
-      "src/renderer/src/hooks/runtime-project-refresh-scheduler.test.ts": 51,
-      "src/renderer/src/hooks/shortcut-label-cache.test.tsx": 65,
-      "src/renderer/src/hooks/ssh-reconnect-pane-retry.test.ts": 7,
-      "src/renderer/src/hooks/structured-session-completion-focus.test.ts": 1364,
-      "src/renderer/src/hooks/unpaired-device-auth-notification.test.ts": 6,
-      "src/renderer/src/hooks/use-audio-capture.capture-loss.test.ts": 31,
-      "src/renderer/src/hooks/use-clipboard-text-copy-feedback.test.ts": 28,
-      "src/renderer/src/hooks/use-now.test.ts": 35,
-      "src/renderer/src/hooks/use-palette-search-evaluation-context.test.ts": 29,
-      "src/renderer/src/hooks/use-task-page-github-work-item-mutation-host.test.ts": 7,
-      "src/renderer/src/hooks/use-terminal-quick-command-hosts.test.ts": 59,
-      "src/renderer/src/hooks/use-window-stream-visibility.test.ts": 37,
-      "src/renderer/src/hooks/useActiveProjectSkillRuntime.test.tsx": 57,
-      "src/renderer/src/hooks/useAgentDetectionTarget.test.ts": 11,
-      "src/renderer/src/hooks/useAppMenuPaste.test.tsx": 29,
-      "src/renderer/src/hooks/useAppMenuSelectionActions.test.tsx": 13,
-      "src/renderer/src/hooks/useAutoAckViewedAgent.away.test.ts": 95,
-      "src/renderer/src/hooks/useAutoAckViewedAgent.clock-skew.test.ts": 55,
-      "src/renderer/src/hooks/useAutoAckViewedAgent.floating-panel.test.ts": 38,
-      "src/renderer/src/hooks/useAutoAckViewedAgent.test.ts": 63,
-      "src/renderer/src/hooks/useAutomationDispatchEvents.test.ts": 692,
-      "src/renderer/src/hooks/useComposerState-decisions.test.ts": 9,
-      "src/renderer/src/hooks/useComposerState-host-context-boundaries.test.ts": 21,
-      "src/renderer/src/hooks/useComposerState-host-retarget.test.ts": 7,
-      "src/renderer/src/hooks/useComposerState.integration.test.ts": 39,
-      "src/renderer/src/hooks/useDetectedAgents.test.tsx": 43,
-      "src/renderer/src/hooks/useEditorExternalWatch-complexity.test.ts": 6402,
-      "src/renderer/src/hooks/useEditorExternalWatch-self-move.test.ts": 27,
-      "src/renderer/src/hooks/useEditorExternalWatch-subscriptions.test.tsx": 24,
-      "src/renderer/src/hooks/useEditorExternalWatch-targets.test.ts": 21,
-      "src/renderer/src/hooks/useEditorExternalWatch-wsl-repro.test.ts": 21,
-      "src/renderer/src/hooks/useEditorExternalWatch.test.ts": 54,
-      "src/renderer/src/hooks/useEphemeralVmRecipeOptions.test.tsx": 33,
-      "src/renderer/src/hooks/useGitHubSlugMetadata.test.tsx": 47,
-      "src/renderer/src/hooks/useGlobalFileDrop.test.ts": 15,
-      "src/renderer/src/hooks/useInstalledAgentSkills.react.test.tsx": 90,
-      "src/renderer/src/hooks/useInstalledAgentSkills.test.ts": 17,
-      "src/renderer/src/hooks/useIpcEvents-agent-dashboard-shortcut.test.ts": 9,
-      "src/renderer/src/hooks/useIpcEvents-agent-status-batch-projection.test.ts": 1128,
-      "src/renderer/src/hooks/useIpcEvents-agent-status-connection-attribution.test.ts": 1955,
-      "src/renderer/src/hooks/useIpcEvents-agent-status-hook-titles.test.ts": 1349,
-      "src/renderer/src/hooks/useIpcEvents-agent-status-pane-teardown.test.ts": 2111,
-      "src/renderer/src/hooks/useIpcEvents-agent-status-queue-ordering.test.ts": 1997,
-      "src/renderer/src/hooks/useIpcEvents-agent-status-snapshot-hydration.test.ts": 2101,
-      "src/renderer/src/hooks/useIpcEvents-agent-status-snapshot-replay.test.ts": 1690,
-      "src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts": 3444,
-      "src/renderer/src/hooks/useIpcEvents-agent-status-turn-completion.test.ts": 1433,
-      "src/renderer/src/hooks/useIpcEvents-browser-certificate-failure.test.ts": 1719,
-      "src/renderer/src/hooks/useIpcEvents-browser-navigation.test.ts": 1370,
-      "src/renderer/src/hooks/useIpcEvents-browser-tab-create.test.ts": 1568,
-      "src/renderer/src/hooks/useIpcEvents-cli-worktree-activation.test.ts": 1650,
-      "src/renderer/src/hooks/useIpcEvents-client-hosted-browser-rows.test.ts": 1604,
-      "src/renderer/src/hooks/useIpcEvents-close-routing-active-browser-tab.test.ts": 1787,
-      "src/renderer/src/hooks/useIpcEvents-close-routing-browser-pages.test.ts": 2510,
-      "src/renderer/src/hooks/useIpcEvents-close-routing-floating-guest.test.ts": 1438,
-      "src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts": 2721,
-      "src/renderer/src/hooks/useIpcEvents-cmd-j-digit-chord.test.ts": 1311,
-      "src/renderer/src/hooks/useIpcEvents-lifecycle.test.ts": 1102,
-      "src/renderer/src/hooks/useIpcEvents-new-workspace-shortcut.test.ts": 12,
-      "src/renderer/src/hooks/useIpcEvents-rate-limit-hydration.test.ts": 1455,
-      "src/renderer/src/hooks/useIpcEvents-repos-changed-catalogs.test.ts": 1275,
-      "src/renderer/src/hooks/useIpcEvents-runtime-environment-selectors.test.ts": 17,
-      "src/renderer/src/hooks/useIpcEvents-session-tab-close-request.test.ts": 1943,
-      "src/renderer/src/hooks/useIpcEvents-silent-terminal-adoption.test.ts": 1945,
-      "src/renderer/src/hooks/useIpcEvents-ssh-disconnect-cleanup.test.ts": 1453,
-      "src/renderer/src/hooks/useIpcEvents-terminal-create-surfacing.test.ts": 2086,
-      "src/renderer/src/hooks/useIpcEvents-updater-status.test.ts": 1582,
-      "src/renderer/src/hooks/useIpcEvents-zoom-routing.test.ts": 1559,
-      "src/renderer/src/hooks/useIssueMetadata.test.tsx": 27,
-      "src/renderer/src/hooks/useLinearProviderConnected.test.tsx": 19,
-      "src/renderer/src/hooks/useMacTccAttributionSeveredNotice.test.tsx": 320,
-      "src/renderer/src/hooks/useMacosTccPromptNotice.test.tsx": 207,
-      "src/renderer/src/hooks/useMetadataListRequest.test.tsx": 20,
-      "src/renderer/src/hooks/useModalReturnFocus.test.tsx": 64,
-      "src/renderer/src/hooks/usePrimarySelectionPaste.terminal-native-paste.test.tsx": 32,
-      "src/renderer/src/hooks/usePrimarySelectionPaste.test.tsx": 55,
-      "src/renderer/src/hooks/useResetCountdownClock.test.ts": 23,
-      "src/renderer/src/hooks/useRetiredWorktreeNames.test.ts": 344,
-      "src/renderer/src/hooks/useSettingsNavigationMetadata.capability-owner.test.tsx": 85,
-      "src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx": 235,
-      "src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts": 184,
-      "src/renderer/src/hooks/useSidebarResize.test.ts": 9,
-      "src/renderer/src/hooks/useSkillFreshness.test.tsx": 65,
-      "src/renderer/src/hooks/useUnreadDockBadge.test.ts": 128,
-      "src/renderer/src/hooks/useVirtualizedScrollAnchor.listener-deps.test.ts": 30,
-      "src/renderer/src/hooks/useVirtualizedScrollAnchor.marks-restore-signal.test.ts": 31,
-      "src/renderer/src/hooks/useVirtualizedScrollAnchor.test.ts": 8,
-      "src/renderer/src/hooks/useWindowsTerminalCapabilityOwnerKey.test.tsx": 46,
-      "src/renderer/src/hooks/viewport-size-change-listener.test.ts": 6,
-      "src/renderer/src/hooks/worktree-change-refresh-queue.test.ts": 14,
-      "src/renderer/src/hooks/worktree-head-identity-apply.test.ts": 10,
-      "src/renderer/src/i18n/I18nProvider.test.tsx": 36,
-      "src/renderer/src/i18n/integration-card-status-localization.test.ts": 7,
-      "src/renderer/src/i18n/intl-locale.test.ts": 121,
-      "src/renderer/src/i18n/ja-technical-literal-mistranslations.test.ts": 7,
-      "src/renderer/src/i18n/ko-ui-semantic-mistranslations.test.ts": 9,
-      "src/renderer/src/i18n/lazy-locale.test.ts": 109,
-      "src/renderer/src/i18n/locale-english-regression.test.ts": 22,
-      "src/renderer/src/i18n/native-chat-locales.test.ts": 10,
-      "src/renderer/src/i18n/no-top-level-translate.test.ts": 2294,
-      "src/renderer/src/i18n/plugin-chrome-allowlist.test.ts": 11,
-      "src/renderer/src/i18n/pseudo-localization.test.ts": 8,
-      "src/renderer/src/i18n/relative-time-format.test.ts": 27,
-      "src/renderer/src/i18n/runtime-required-catalog.test.ts": 335,
-      "src/renderer/src/i18n/settings-status-label-localization.test.ts": 9,
-      "src/renderer/src/i18n/smart-workspace-jira-locales.test.ts": 8,
-      "src/renderer/src/i18n/technical-literal-catalog-values.test.ts": 8,
-      "src/renderer/src/i18n/weekday-names.test.ts": 40,
-      "src/renderer/src/i18n/worktree-visibility-locales.test.ts": 8,
-      "src/renderer/src/i18n/zh-technical-literal-mistranslations.test.ts": 45,
-      "src/renderer/src/lazy-modal-mount-state.test.ts": 5,
-      "src/renderer/src/lazy-use-ref-ratchet.test.ts": 165,
-      "src/renderer/src/lib/activate-ai-vault-structured-session-reveal.test.ts": 11,
-      "src/renderer/src/lib/activate-ai-vault-structured-session.test.ts": 17,
-      "src/renderer/src/lib/activate-tab-and-focus-pane.test.ts": 11,
-      "src/renderer/src/lib/active-agent-note-send-explicit-target.test.ts": 385,
-      "src/renderer/src/lib/active-agent-note-send-focused-session.test.ts": 74,
-      "src/renderer/src/lib/active-agent-note-send-runtime-error-codes.test.ts": 6,
-      "src/renderer/src/lib/active-agent-note-send-target-detection.test.ts": 13,
-      "src/renderer/src/lib/active-view-persist.test.ts": 4,
-      "src/renderer/src/lib/activity-thread-display.test.ts": 10,
-      "src/renderer/src/lib/agent-background-session-launch-host.test.ts": 12,
-      "src/renderer/src/lib/agent-catalog-links.test.ts": 5,
-      "src/renderer/src/lib/agent-draft-readiness.test.ts": 8,
-      "src/renderer/src/lib/agent-followup-delivery.test.ts": 18659,
-      "src/renderer/src/lib/agent-hibernation-confirmation.test.ts": 4,
-      "src/renderer/src/lib/agent-hibernation-coordinator.test.ts": 163,
-      "src/renderer/src/lib/agent-hibernation-output-activity.test.ts": 6,
-      "src/renderer/src/lib/agent-hibernation-pane-age.test.ts": 9,
-      "src/renderer/src/lib/agent-hibernation-planner.test.ts": 30,
-      "src/renderer/src/lib/agent-hibernation-runtime-liveness-race.test.ts": 65,
-      "src/renderer/src/lib/agent-hibernation-visibility.test.ts": 5,
-      "src/renderer/src/lib/agent-launch-prompt-delivery.test.ts": 14,
-      "src/renderer/src/lib/agent-launch-route-connection-fallback.test.ts": 6,
-      "src/renderer/src/lib/agent-launch-route-input.test.ts": 16,
-      "src/renderer/src/lib/agent-launch-routing-caller-census.test.ts": 552,
-      "src/renderer/src/lib/agent-launch-routing.test.ts": 11,
-      "src/renderer/src/lib/agent-paste-draft-readiness-budget.test.ts": 13,
-      "src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts": 48,
-      "src/renderer/src/lib/agent-paste-draft.test.ts": 178,
-      "src/renderer/src/lib/agent-picker-search.test.ts": 28,
-      "src/renderer/src/lib/agent-ready-wait.test.ts": 7,
-      "src/renderer/src/lib/agent-resume-launch-target.test.ts": 2472,
-      "src/renderer/src/lib/agent-row-primary-text.test.ts": 8,
-      "src/renderer/src/lib/agent-row-tool-preview.test.ts": 9,
-      "src/renderer/src/lib/agent-send-title-status.test.ts": 14,
-      "src/renderer/src/lib/agent-session-fork-context.test.ts": 47,
-      "src/renderer/src/lib/agent-session-launch-plan.test.ts": 10,
-      "src/renderer/src/lib/agent-skill-cli-prerequisite.test.ts": 68,
-      "src/renderer/src/lib/agent-skill-nav-install-status.test.ts": 5,
-      "src/renderer/src/lib/agent-startup-delayed-delivery-perf.test.ts": 85,
-      "src/renderer/src/lib/agent-status-connection-ownership.test.ts": 7,
-      "src/renderer/src/lib/agent-status-count.test.ts": 14,
-      "src/renderer/src/lib/agent-status-epoch-clock.test.ts": 12,
-      "src/renderer/src/lib/agent-status-evidence-clock.test.ts": 6,
-      "src/renderer/src/lib/agent-status-terminal-title.test.ts": 11,
-      "src/renderer/src/lib/agent-status-worktree-attribution.test.ts": 6,
-      "src/renderer/src/lib/agent-status.test.ts": 31,
-      "src/renderer/src/lib/agent-tab-shortcuts.test.ts": 7,
-      "src/renderer/src/lib/agent-trust-preflight.test.ts": 6,
-      "src/renderer/src/lib/ai-vault-omp-cold-resume.test.ts": 19,
-      "src/renderer/src/lib/ai-vault-resume-command.drop-repin.test.ts": 6,
-      "src/renderer/src/lib/ai-vault-resume-command.resumable-agent.test.ts": 9,
-      "src/renderer/src/lib/ai-vault-resume-command.test.ts": 31,
-      "src/renderer/src/lib/ai-vault-resume-shell.test.ts": 5,
-      "src/renderer/src/lib/ai-vault-resume-target.test.ts": 15,
-      "src/renderer/src/lib/ai-vault-session-drag.test.ts": 15,
-      "src/renderer/src/lib/ai-vault-session-resume-preparation.test.ts": 16,
-      "src/renderer/src/lib/ai-vault-tab-title-sync-inputs.test.ts": 38,
-      "src/renderer/src/lib/ai-vault-tab-title-sync.test.ts": 576,
-      "src/renderer/src/lib/app-command-dispatch.test.ts": 6,
-      "src/renderer/src/lib/app-font-family.test.ts": 4,
-      "src/renderer/src/lib/app-menu-paste.test.ts": 49,
-      "src/renderer/src/lib/app-menu-selection-actions.test.ts": 4,
-      "src/renderer/src/lib/automation-session-observer.test.ts": 58,
-      "src/renderer/src/lib/automation-session-reuse.test.ts": 7,
-      "src/renderer/src/lib/automation-terminal-ownership.test.ts": 9,
-      "src/renderer/src/lib/browser-cookie-import-toast.test.ts": 18,
-      "src/renderer/src/lib/browser-history-match.performance.test.ts": 17,
-      "src/renderer/src/lib/browser-history-match.test.ts": 34,
-      "src/renderer/src/lib/browser-page-conversion-history.test.ts": 8,
-      "src/renderer/src/lib/browser-page-palette-activation.test.ts": 59,
-      "src/renderer/src/lib/browser-palette-page-entries.test.ts": 145,
-      "src/renderer/src/lib/browser-palette-search.test.ts": 28,
-      "src/renderer/src/lib/browser-uuid.test.ts": 5,
-      "src/renderer/src/lib/browser-workspace-tab-activation.test.ts": 9,
-      "src/renderer/src/lib/client-creation-action-policy.test.ts": 12,
-      "src/renderer/src/lib/cmd-j-github-url-lookup.test.ts": 8,
-      "src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts": 30,
-      "src/renderer/src/lib/cmd-j-linear-issue-intent.test.ts": 7,
-      "src/renderer/src/lib/cmd-j-section-leadership.test.ts": 9,
-      "src/renderer/src/lib/codex-account-display-label.test.ts": 6,
-      "src/renderer/src/lib/codex-pane-restart-eligibility.test.ts": 8,
-      "src/renderer/src/lib/codex-pane-selection-lane.test.ts": 21,
-      "src/renderer/src/lib/codex-session-restart-route-recheck.test.ts": 13,
-      "src/renderer/src/lib/codex-session-restart-shell-flap.test.ts": 30,
-      "src/renderer/src/lib/codex-session-restart.test.ts": 93,
-      "src/renderer/src/lib/codex-stale-pane-account-identity.test.ts": 17,
-      "src/renderer/src/lib/codex-stale-pane-sweep.test.ts": 44,
-      "src/renderer/src/lib/comment-body-line-count.test.ts": 40,
-      "src/renderer/src/lib/comment-body-submit-state.test.ts": 31,
-      "src/renderer/src/lib/composer-issue-command.test.ts": 7,
-      "src/renderer/src/lib/composer-submit-cancellation.test.ts": 7,
-      "src/renderer/src/lib/connection-context.test.ts": 56,
-      "src/renderer/src/lib/crash-diagnostics.test.ts": 83,
-      "src/renderer/src/lib/create-untitled-markdown.test.ts": 13,
-      "src/renderer/src/lib/desktop-window-chrome.test.ts": 5,
-      "src/renderer/src/lib/diff-comment-compat.test.ts": 5,
-      "src/renderer/src/lib/diff-comments-format.test.ts": 7,
-      "src/renderer/src/lib/direct-ssh-reconnect-product-telemetry.test.ts": 11,
-      "src/renderer/src/lib/direct-ssh-target-scope.test.ts": 12,
-      "src/renderer/src/lib/doc-preview-grants.test.ts": 118,
-      "src/renderer/src/lib/document-theme.test.ts": 10,
-      "src/renderer/src/lib/editable-target.test.ts": 6,
-      "src/renderer/src/lib/editor-file-operation-owner.test.ts": 29,
-      "src/renderer/src/lib/editor-font-zoom.test.ts": 5,
-      "src/renderer/src/lib/ensure-hooks-confirmed.test.ts": 433,
-      "src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts": 162,
-      "src/renderer/src/lib/ensure-simulator-tab.test.ts": 5,
-      "src/renderer/src/lib/ephemeral-vm-failed-create-cleanup.test.ts": 7,
-      "src/renderer/src/lib/ephemeral-vm-runtime-cleanup.test.ts": 16,
-      "src/renderer/src/lib/ephemeral-vm-workspace-target.integration.test.ts": 8,
-      "src/renderer/src/lib/ephemeral-vm-workspace-target.test.ts": 13,
-      "src/renderer/src/lib/ephemeral-vm-worktree-creation.test.ts": 8,
-      "src/renderer/src/lib/execute-open-editor-path-move.test.ts": 209,
-      "src/renderer/src/lib/external-editor-open-capability.test.ts": 5,
-      "src/renderer/src/lib/feature-education-telemetry.test.ts": 12,
-      "src/renderer/src/lib/feedback-image-attachments.test.ts": 28,
-      "src/renderer/src/lib/file-preview-action-visibility.test.tsx": 22,
-      "src/renderer/src/lib/file-preview.test.ts": 16,
-      "src/renderer/src/lib/file-search-result-owner.test.ts": 6,
-      "src/renderer/src/lib/file-search-selection.test.ts": 8,
-      "src/renderer/src/lib/file-type-icons.test.ts": 9,
-      "src/renderer/src/lib/find-query-bounds.test.ts": 4,
-      "src/renderer/src/lib/finished-agent-resume-resurrection.test.ts": 38,
-      "src/renderer/src/lib/fix-checks-agent-launch.test.ts": 262,
-      "src/renderer/src/lib/flatten-retained-slice.test.ts": 132,
-      "src/renderer/src/lib/floating-terminal.test.ts": 7,
-      "src/renderer/src/lib/floating-workspace-terminal-actions.test.ts": 26,
-      "src/renderer/src/lib/floating-workspace-tour-interaction-snapshot.test.ts": 9,
-      "src/renderer/src/lib/focus-terminal-tab-surface.test.ts": 16,
-      "src/renderer/src/lib/folder-workspace-path-status.test.ts": 8,
-      "src/renderer/src/lib/foreground-terminal-tabs.test.ts": 14,
-      "src/renderer/src/lib/github-links.test.ts": 11,
-      "src/renderer/src/lib/github-pr-start-point.test.ts": 11,
-      "src/renderer/src/lib/github-source-runtime-context.test.ts": 8,
-      "src/renderer/src/lib/github-work-item-source-lookup.test.ts": 8,
-      "src/renderer/src/lib/github-work-item-workspace-attachment.test.ts": 10,
-      "src/renderer/src/lib/gitlab-links.test.ts": 14,
-      "src/renderer/src/lib/gitlab-work-item-source-lookup.test.ts": 8,
-      "src/renderer/src/lib/hook-command-delayed-delivery-perf.test.ts": 121,
-      "src/renderer/src/lib/hook-command-delayed-delivery.test.ts": 11,
-      "src/renderer/src/lib/host-mirrored-pane-resume-replay.test.ts": 20,
-      "src/renderer/src/lib/http-link-destinations.test.ts": 14,
-      "src/renderer/src/lib/http-link-modifier-routing.test.ts": 12,
-      "src/renderer/src/lib/http-link-routing.test.ts": 25,
-      "src/renderer/src/lib/i18n-jsx-spacing-guard.test.ts": 23,
-      "src/renderer/src/lib/ime-composition-keyboard-event.test.ts": 30,
-      "src/renderer/src/lib/ios-web-platform.test.ts": 6,
-      "src/renderer/src/lib/jira-source-host.test.ts": 8,
-      "src/renderer/src/lib/keyboard-layout/detect-option-as-alt.test.ts": 11,
-      "src/renderer/src/lib/keyboard-layout/input-source-id.test.ts": 4,
-      "src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts": 14,
-      "src/renderer/src/lib/keyboard-layout/option-as-alt-probe.test.ts": 20,
-      "src/renderer/src/lib/keyboard-layout/option-key-location-state.test.ts": 7,
-      "src/renderer/src/lib/language-detect.test.ts": 8,
-      "src/renderer/src/lib/large-text-control-paste.test.ts": 23,
-      "src/renderer/src/lib/launch-agent-background-session-remote.test.ts": 498,
-      "src/renderer/src/lib/launch-agent-background-session.test.ts": 360,
-      "src/renderer/src/lib/launch-agent-in-new-tab-cwd.test.ts": 653,
-      "src/renderer/src/lib/launch-agent-in-new-tab-host-resolution.test.ts": 553,
-      "src/renderer/src/lib/launch-agent-in-new-tab-structured.test.ts": 15,
-      "src/renderer/src/lib/launch-agent-in-new-tab-web-runtime.test.ts": 544,
-      "src/renderer/src/lib/launch-agent-in-new-tab-windows-quoting.test.ts": 760,
-      "src/renderer/src/lib/launch-agent-in-new-tab.test.ts": 1687,
-      "src/renderer/src/lib/launch-agent-session-continuation.test.ts": 27,
-      "src/renderer/src/lib/launch-agent-structured-chat-guard.test.ts": 945,
-      "src/renderer/src/lib/launch-ai-vault-session.test.ts": 10,
-      "src/renderer/src/lib/launch-structured-agent-session.test.ts": 726,
-      "src/renderer/src/lib/launch-work-item-direct-agent-routing.test.ts": 12,
-      "src/renderer/src/lib/launch-work-item-direct-agent.test.ts": 15,
-      "src/renderer/src/lib/launch-work-item-direct-messages.test.ts": 6,
-      "src/renderer/src/lib/launch-work-item-direct.test.ts": 51,
-      "src/renderer/src/lib/launch-worktree-background-terminals.test.ts": 305,
-      "src/renderer/src/lib/lazy-chunk-recovery-reload.test.ts": 61,
-      "src/renderer/src/lib/lazy-with-retry.never-landed-reload.test.ts": 10,
-      "src/renderer/src/lib/lazy-with-retry.right-sidebar-syntax-error.test.ts": 10,
-      "src/renderer/src/lib/lazy-with-retry.test.ts": 37,
-      "src/renderer/src/lib/left-sidebar-appearance.test.ts": 13,
-      "src/renderer/src/lib/linear-agent-skill-update-command.test.ts": 4,
-      "src/renderer/src/lib/linear-board-drag-payload.test.ts": 10,
-      "src/renderer/src/lib/linear-issue-context-snapshot.test.ts": 19,
-      "src/renderer/src/lib/linear-issue-url-lookup.test.ts": 10,
-      "src/renderer/src/lib/linear-issue-workspace-attachment.test.ts": 10,
-      "src/renderer/src/lib/linear-issue-workspace-open.test.ts": 10,
-      "src/renderer/src/lib/linear-linked-work-item.test.ts": 12,
-      "src/renderer/src/lib/linked-work-item-context.test.ts": 16,
-      "src/renderer/src/lib/linked-work-item-provider.test.ts": 5,
-      "src/renderer/src/lib/list-row-interaction.test.ts": 11,
-      "src/renderer/src/lib/local-path-open-guard.test.ts": 5,
-      "src/renderer/src/lib/local-preflight-context-cache.test.ts": 31,
-      "src/renderer/src/lib/local-preflight-context.test.ts": 18,
-      "src/renderer/src/lib/locale-text-collators.test.ts": 30,
-      "src/renderer/src/lib/manual-terminal-worktree-parking.test.ts": 7,
-      "src/renderer/src/lib/markdown-comment-blocks.test.ts": 6,
-      "src/renderer/src/lib/markdown-document-templates.test.ts": 9,
-      "src/renderer/src/lib/markdown-review-note-copy.test.ts": 5,
-      "src/renderer/src/lib/markdown-review-notes.test.ts": 26,
-      "src/renderer/src/lib/migration-unsupported-agent-entry.test.ts": 4,
-      "src/renderer/src/lib/mobile-terminal-tab-mount.test.ts": 7,
-      "src/renderer/src/lib/monaco-delayer-cancellation-guard.test.ts": 25,
-      "src/renderer/src/lib/monaco-diff-editor-disposal.test.ts": 13,
-      "src/renderer/src/lib/monaco-languages/monarch-embed-entry-recursion.test.ts": 388,
-      "src/renderer/src/lib/monaco-languages/monarch-upstream-mdx-recursion.test.ts": 61,
-      "src/renderer/src/lib/monaco-languages/register-astro.test.ts": 32,
-      "src/renderer/src/lib/monaco-languages/register-jsonl.test.ts": 27,
-      "src/renderer/src/lib/monaco-languages/register-nim.test.ts": 22,
-      "src/renderer/src/lib/monaco-languages/register-svelte.test.ts": 28,
-      "src/renderer/src/lib/monaco-languages/register-vue.test.ts": 20,
-      "src/renderer/src/lib/monaco-languages/textmate-language-registration.test.ts": 10,
-      "src/renderer/src/lib/monaco-languages/textmate-token-provider.test.ts": 123,
-      "src/renderer/src/lib/monaco-peek-preview-options.test.ts": 12,
-      "src/renderer/src/lib/native-chat-initial-view-mode.test.ts": 13,
-      "src/renderer/src/lib/native-chat-launch-draft-mirrorability.test.ts": 12,
-      "src/renderer/src/lib/native-chat-transcript-readability.test.ts": 4,
-      "src/renderer/src/lib/nested-repo-selected-paths.test.ts": 8,
-      "src/renderer/src/lib/new-workspace-composer-repo.test.ts": 7,
-      "src/renderer/src/lib/new-workspace-create-gates.test.ts": 4,
-      "src/renderer/src/lib/new-workspace-enter-guard.test.ts": 18,
-      "src/renderer/src/lib/new-workspace-project-options.test.ts": 21,
-      "src/renderer/src/lib/new-workspace-ssh-gate.test.ts": 6,
-      "src/renderer/src/lib/new-workspace.test.ts": 4395,
-      "src/renderer/src/lib/non-secure-context-crypto.repro.test.ts": 11,
-      "src/renderer/src/lib/notes-send-agent-targets.test.ts": 30,
-      "src/renderer/src/lib/onboarding-project-checklist.test.ts": 6,
-      "src/renderer/src/lib/open-markdown-in-floating-workspace.test.ts": 7,
-      "src/renderer/src/lib/open-mobile-emulator-tab.test.ts": 17,
-      "src/renderer/src/lib/open-tab-occupant-agent.test.ts": 16,
-      "src/renderer/src/lib/orca-hook-trust.test.ts": 9,
-      "src/renderer/src/lib/orca-yaml-trust-prompt-slot-eviction.test.ts": 278,
-      "src/renderer/src/lib/orchestration-setup-state.test.ts": 9,
-      "src/renderer/src/lib/orchestration-skill-coverage.test.ts": 20,
-      "src/renderer/src/lib/order-empty-query-worktrees.test.ts": 30,
-      "src/renderer/src/lib/palette-match/cmd-j-ranking-contract.test.ts": 15,
-      "src/renderer/src/lib/palette-match/match-field-allocation.test.ts": 49,
-      "src/renderer/src/lib/palette-match/palette-match-core.test.ts": 26,
-      "src/renderer/src/lib/palette-match/palette-match-performance.test.ts": 9461,
-      "src/renderer/src/lib/palette-match/palette-ranking.test.ts": 16,
-      "src/renderer/src/lib/palette-repo-resolution.test.ts": 9,
-      "src/renderer/src/lib/palette-type-alias-match.test.ts": 9,
-      "src/renderer/src/lib/pane-agent-evidence.test.ts": 23,
-      "src/renderer/src/lib/pane-manager/browser-mobile-driver-state.test.ts": 10,
-      "src/renderer/src/lib/pane-manager/browser-remote-viewer-state.test.ts": 5,
-      "src/renderer/src/lib/pane-manager/client-hosted-browser-row-ephemerality.test.ts": 22,
-      "src/renderer/src/lib/pane-manager/client-hosted-browser-row-state.test.ts": 16,
-      "src/renderer/src/lib/pane-manager/focus-follows-mouse.test.ts": 7,
-      "src/renderer/src/lib/pane-manager/mobile-driver-state.test.ts": 10,
-      "src/renderer/src/lib/pane-manager/mobile-fit-overrides-hydration.test.ts": 5,
-      "src/renderer/src/lib/pane-manager/mobile-fit-overrides.test.ts": 23,
-      "src/renderer/src/lib/pane-manager/pane-container-listener-lifecycle.test.ts": 10,
-      "src/renderer/src/lib/pane-manager/pane-cursor-blink-suspension.test.ts": 318,
-      "src/renderer/src/lib/pane-manager/pane-divider-capture-loss.test.ts": 6,
-      "src/renderer/src/lib/pane-manager/pane-divider-stray-touch.test.ts": 23,
-      "src/renderer/src/lib/pane-manager/pane-divider.test.ts": 13,
-      "src/renderer/src/lib/pane-manager/pane-dom-creation.test.ts": 20,
-      "src/renderer/src/lib/pane-manager/pane-drag-reorder.test.ts": 17,
-      "src/renderer/src/lib/pane-manager/pane-drop-no-op.test.ts": 12,
-      "src/renderer/src/lib/pane-manager/pane-fit-resize-observer.test.ts": 16,
-      "src/renderer/src/lib/pane-manager/pane-fit.test.ts": 61,
-      "src/renderer/src/lib/pane-manager/pane-initial-fit-lifecycle.test.ts": 10,
-      "src/renderer/src/lib/pane-manager/pane-key-resolution.test.ts": 9,
-      "src/renderer/src/lib/pane-manager/pane-lifecycle.test.ts": 52,
-      "src/renderer/src/lib/pane-manager/pane-manager-registry.test.ts": 26,
-      "src/renderer/src/lib/pane-manager/pane-metric-options-deferral.test.ts": 14,
-      "src/renderer/src/lib/pane-manager/pane-overlay-focus.test.ts": 44,
-      "src/renderer/src/lib/pane-manager/pane-pointer-focus.test.ts": 5,
-      "src/renderer/src/lib/pane-manager/pane-pty-resize-hold.test.ts": 8,
-      "src/renderer/src/lib/pane-manager/pane-reveal-fit.test.ts": 10,
-      "src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts": 53,
-      "src/renderer/src/lib/pane-manager/pane-scroll.test.ts": 87,
-      "src/renderer/src/lib/pane-manager/pane-split-close.test.ts": 12,
-      "src/renderer/src/lib/pane-manager/pane-split-scroll.test.ts": 12,
-      "src/renderer/src/lib/pane-manager/pane-terminal-foreground-render-settle.test.ts": 8,
-      "src/renderer/src/lib/pane-manager/pane-terminal-gpu-acceleration.test.ts": 12,
-      "src/renderer/src/lib/pane-manager/pane-terminal-mouse-wheel.test.ts": 15,
-      "src/renderer/src/lib/pane-manager/pane-terminal-output-queue-chunks.test.ts": 5,
-      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-ack-credit.test.ts": 69,
-      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-backlog-cap.test.ts": 110,
-      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-disposed-writes.test.ts": 46,
-      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-foreground-refresh.test.ts": 68,
-      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-queue-retention.test.ts": 254,
-      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-synchronized-frames.test.ts": 65,
-      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-throughput.bench.test.ts": 256,
-      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler.test.ts": 146,
-      "src/renderer/src/lib/pane-manager/pane-tree-equalization-parity.test.ts": 1130,
-      "src/renderer/src/lib/pane-manager/pane-tree-equalization-scaling.test.ts": 65,
-      "src/renderer/src/lib/pane-manager/pane-tree-ops.test.ts": 26,
-      "src/renderer/src/lib/pane-manager/pane-tree-reparent-frame.test.ts": 30,
-      "src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts": 50,
-      "src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts": 8,
-      "src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts": 38,
-      "src/renderer/src/lib/pane-manager/terminal-arabic-shaping-joiner.test.ts": 16,
-      "src/renderer/src/lib/pane-manager/terminal-canvas-dpr-repair.test.ts": 11,
-      "src/renderer/src/lib/pane-manager/terminal-complex-script.test.ts": 15,
-      "src/renderer/src/lib/pane-manager/terminal-delivery-credit.test.ts": 12,
-      "src/renderer/src/lib/pane-manager/terminal-foreground-repair-convergence.test.ts": 183,
-      "src/renderer/src/lib/pane-manager/terminal-ime-anchor.test.ts": 11,
-      "src/renderer/src/lib/pane-manager/terminal-ime-candidate-anchor.test.ts": 41,
-      "src/renderer/src/lib/pane-manager/terminal-keyboard-protocol.test.ts": 12,
-      "src/renderer/src/lib/pane-manager/terminal-ligatures-addon.test.ts": 16,
-      "src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts": 12,
-      "src/renderer/src/lib/pane-manager/terminal-linkifier-hover-reset-on-mouseleave.test.ts": 14,
-      "src/renderer/src/lib/pane-manager/terminal-linkifier-hover-reset-on-write.test.ts": 13,
-      "src/renderer/src/lib/pane-manager/terminal-linkifier-hover-reset.test.ts": 5,
-      "src/renderer/src/lib/pane-manager/terminal-render-pause-release-parked-resize.test.ts": 10,
-      "src/renderer/src/lib/pane-manager/terminal-render-pause-release.test.ts": 12,
-      "src/renderer/src/lib/pane-manager/terminal-scroll-intent-input-resync.test.ts": 14,
-      "src/renderer/src/lib/pane-manager/terminal-scroll-intent-key-retention.test.ts": 55,
-      "src/renderer/src/lib/pane-manager/terminal-scroll-intent-structural-transitions.test.ts": 13,
-      "src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts": 22,
-      "src/renderer/src/lib/pane-manager/terminal-structural-replay-coordinator.test.ts": 16,
-      "src/renderer/src/lib/pane-manager/terminal-webgl-auto-policy.test.ts": 13,
-      "src/renderer/src/lib/pane-manager/terminal-webgl-hidden-retention.test.ts": 19,
-      "src/renderer/src/lib/pane-manager/terminal-windows-ctrl-alt-chord-classification.test.ts": 16,
-      "src/renderer/src/lib/pane-manager/terminal-write-pipeline-health.test.ts": 19,
-      "src/renderer/src/lib/pane-manager/windows-pty-compatibility.test.ts": 20,
-      "src/renderer/src/lib/pane-manager/xterm-instance-disposed.test.ts": 10,
-      "src/renderer/src/lib/pane-manager/xterm-user-scrolling-contract.test.ts": 5037,
-      "src/renderer/src/lib/pane-manager/xterm-write-callback-guard.test.ts": 10,
-      "src/renderer/src/lib/parked-terminal-host-hydration.test.ts": 12,
-      "src/renderer/src/lib/passive-macos-app-data-access.test.ts": 6,
-      "src/renderer/src/lib/paste-payload-metadata.test.ts": 11,
-      "src/renderer/src/lib/path-head-elision.test.ts": 5,
-      "src/renderer/src/lib/path.test.ts": 6,
-      "src/renderer/src/lib/pending-worktree-creation.test.ts": 5,
-      "src/renderer/src/lib/pi-live-session-no-duplicate-tab.test.ts": 11,
-      "src/renderer/src/lib/pi-session-resume-wake.test.ts": 12,
-      "src/renderer/src/lib/plugin-command-execution.test.ts": 7,
-      "src/renderer/src/lib/plugin-command-keybindings.test.ts": 19,
-      "src/renderer/src/lib/pr-bot-author-overrides.test.ts": 213,
-      "src/renderer/src/lib/pr-comment-action-state.test.ts": 12,
-      "src/renderer/src/lib/pr-comment-reactions.test.ts": 6,
-      "src/renderer/src/lib/primary-selection-paste.test.ts": 79,
-      "src/renderer/src/lib/primary-selection.test.ts": 9,
-      "src/renderer/src/lib/project-clone-url-prefill.test.ts": 15,
-      "src/renderer/src/lib/project-host-clone-url.test.ts": 8,
-      "src/renderer/src/lib/project-host-setup-options.test.ts": 20,
-      "src/renderer/src/lib/project-host-workspace-target.test.ts": 17,
-      "src/renderer/src/lib/project-skill-runtime.test.ts": 8,
-      "src/renderer/src/lib/provisioned-root-create-options.test.ts": 8,
-      "src/renderer/src/lib/quick-workspace-agent-selection.test.ts": 7,
-      "src/renderer/src/lib/react-commit-cascade-install-order.test.ts": 8,
-      "src/renderer/src/lib/react-commit-cascade-observer.react185.test.tsx": 44,
-      "src/renderer/src/lib/react-commit-cascade-observer.test.ts": 150,
-      "src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts": 12,
-      "src/renderer/src/lib/react-commit-cascade-telemetry.test.ts": 108,
-      "src/renderer/src/lib/react-error-boundary-reporting.test.ts": 15,
-      "src/renderer/src/lib/react-grab-dev-gate.test.ts": 4,
-      "src/renderer/src/lib/react-renderer-root.test.ts": 6,
-      "src/renderer/src/lib/recent-workspace-tab-rows.test.ts": 19,
-      "src/renderer/src/lib/remap-open-editor-tabs-for-path-change.test.ts": 62,
-      "src/renderer/src/lib/renderer-agent-status-observation-ingress.test.ts": 36,
-      "src/renderer/src/lib/renderer-app-platform.test.ts": 34,
-      "src/renderer/src/lib/renderer-memory-profile.test.ts": 26,
-      "src/renderer/src/lib/repo-display-labels.test.ts": 6,
-      "src/renderer/src/lib/repo-runtime-owner.test.ts": 14,
-      "src/renderer/src/lib/repo-search.test.ts": 10,
-      "src/renderer/src/lib/repo-slug-cache.test.ts": 8,
-      "src/renderer/src/lib/repo-slug-index.test.ts": 515,
-      "src/renderer/src/lib/resolved-worktree-execution-host.test.ts": 7,
-      "src/renderer/src/lib/resume-sleeping-agent-session-direct-ssh-hydration-gap.test.ts": 22,
-      "src/renderer/src/lib/resume-sleeping-agent-session-provider-claim.test.ts": 13,
-      "src/renderer/src/lib/resume-sleeping-agent-session-remote-compat.test.ts": 25,
-      "src/renderer/src/lib/resume-sleeping-agent-session-replay.test.ts": 65,
-      "src/renderer/src/lib/resume-sleeping-agent-session-slept-pane-recovery.test.ts": 11,
-      "src/renderer/src/lib/resume-sleeping-agent-session-suppress-navigation.test.ts": 32,
-      "src/renderer/src/lib/resume-sleeping-agent-session.test.ts": 126,
-      "src/renderer/src/lib/resume-stale-structured-agent-session.test.ts": 9,
-      "src/renderer/src/lib/right-sidebar-visibility.test.ts": 8,
-      "src/renderer/src/lib/run-quick-command-in-new-tab.test.ts": 10,
-      "src/renderer/src/lib/running-agent-targets.test.ts": 12,
-      "src/renderer/src/lib/runtime-pane-title-leaf-id.test.ts": 9,
-      "src/renderer/src/lib/runtime-session-mirror-targets.test.ts": 6,
-      "src/renderer/src/lib/runtime-workspace-file-route.test.ts": 14,
-      "src/renderer/src/lib/screen-submit-shortcut.test.ts": 6,
-      "src/renderer/src/lib/script-textarea-rows.test.ts": 52,
-      "src/renderer/src/lib/scroll-cache.test.ts": 9,
-      "src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts": 13,
-      "src/renderer/src/lib/session-write-subscriber-allocation.test.ts": 21,
-      "src/renderer/src/lib/session-write-subscriber-deferred-persist.test.ts": 21,
-      "src/renderer/src/lib/session-write-subscriber.test.ts": 107,
-      "src/renderer/src/lib/settled-worker-wake-policy.test.ts": 25,
-      "src/renderer/src/lib/setup-runner.test.ts": 4,
-      "src/renderer/src/lib/setup-script-prompt.test.ts": 20,
-      "src/renderer/src/lib/sha256.test.ts": 22,
-      "src/renderer/src/lib/shutdown-checkpoint-guard.test.ts": 26,
-      "src/renderer/src/lib/sidebar-worktree-activation.test.ts": 13,
-      "src/renderer/src/lib/simulator-launch-coordination.test.ts": 112,
-      "src/renderer/src/lib/simulator-palette-search.test.ts": 29,
-      "src/renderer/src/lib/simulator-pane-shutdown-scheduler.test.ts": 17,
-      "src/renderer/src/lib/simulator-tab-palette-activation.test.ts": 32,
-      "src/renderer/src/lib/skill-freshness-display-status.test.ts": 16,
-      "src/renderer/src/lib/sleeping-agent-session-launch-windows-quoting.test.ts": 290,
-      "src/renderer/src/lib/smart-github-submit.test.ts": 19,
-      "src/renderer/src/lib/source-control-agent-action-plan.test.ts": 15,
-      "src/renderer/src/lib/source-control-generation-plan.test.ts": 16,
-      "src/renderer/src/lib/source-control-launch-agent-selection.test.ts": 12,
-      "src/renderer/src/lib/source-control-launch-platform.test.ts": 10,
-      "src/renderer/src/lib/source-control-remote-error.test.ts": 27,
-      "src/renderer/src/lib/sparse-preset-draft.test.ts": 21,
-      "src/renderer/src/lib/ssh-background-startup-delivery.test.ts": 17,
-      "src/renderer/src/lib/ssh-mutation-expectation.test.ts": 7,
-      "src/renderer/src/lib/startup-ui-hydration.test.ts": 10,
-      "src/renderer/src/lib/state-collection-byte-estimate.test.ts": 46,
-      "src/renderer/src/lib/structured-agent-launch-settlement-caller-census.test.ts": 361,
-      "src/renderer/src/lib/structured-agent-launch-settlement.test.ts": 67,
-      "src/renderer/src/lib/structured-agent-session-launch-join-delivery.test.ts": 8,
-      "src/renderer/src/lib/structured-agent-session-launch-prompt.test.ts": 12,
-      "src/renderer/src/lib/structured-agent-session-launch-refusal-fallback.test.ts": 25,
-      "src/renderer/src/lib/structured-agent-session-launch-resume-identity.test.ts": 16,
-      "src/renderer/src/lib/structured-agent-session-launch.test.ts": 307,
-      "src/renderer/src/lib/structured-agent-session-tab-activation.test.ts": 7,
-      "src/renderer/src/lib/tab-agent-identity-decision-table.test.ts": 438,
-      "src/renderer/src/lib/tab-agent-status-index.test.ts": 162,
-      "src/renderer/src/lib/tab-agent.test.ts": 10,
-      "src/renderer/src/lib/tab-has-live-pty.test.ts": 7,
-      "src/renderer/src/lib/tab-number-shortcuts.test.ts": 9,
-      "src/renderer/src/lib/terminal-contrast-correction.test.ts": 13,
-      "src/renderer/src/lib/terminal-file-uri-link.test.ts": 8,
-      "src/renderer/src/lib/terminal-input-activity-coalescing.test.ts": 12,
-      "src/renderer/src/lib/terminal-links-redos.test.ts": 12,
-      "src/renderer/src/lib/terminal-links.test.ts": 331,
-      "src/renderer/src/lib/terminal-pane-title-sanitization.test.ts": 7,
-      "src/renderer/src/lib/terminal-quick-command-project-scope.test.ts": 7,
-      "src/renderer/src/lib/terminal-quick-command-search.test.ts": 11,
-      "src/renderer/src/lib/terminal-reveal-identity.test.ts": 10,
-      "src/renderer/src/lib/terminal-shortcut-capture-notification.test.tsx": 16,
-      "src/renderer/src/lib/terminal-tab-for-pty-id.test.ts": 10,
-      "src/renderer/src/lib/terminal-theme.test.ts": 22,
-      "src/renderer/src/lib/terminal-worktree-route.test.ts": 16,
-      "src/renderer/src/lib/text-control-paste-ownership.test.ts": 21,
-      "src/renderer/src/lib/text-control-paste.test.ts": 30,
-      "src/renderer/src/lib/titlebar-left-chrome.test.ts": 6,
-      "src/renderer/src/lib/titlebar-worktree-history-controls.test.ts": 4,
-      "src/renderer/src/lib/tui-agent-startup.test.ts": 18,
-      "src/renderer/src/lib/typing-latency/diagnostic-lifecycle.test.ts": 14,
-      "src/renderer/src/lib/typing-latency/diagnostic-summary.test.ts": 13,
-      "src/renderer/src/lib/typing-latency/echo-instrumentation.test.ts": 28,
-      "src/renderer/src/lib/typing-latency/input-events.test.ts": 7,
-      "src/renderer/src/lib/typing-latency/input-source.test.ts": 8,
-      "src/renderer/src/lib/typing-latency/sample-window.test.ts": 10,
-      "src/renderer/src/lib/unread-badge-count.test.ts": 4,
-      "src/renderer/src/lib/update-check-click-options.test.ts": 5,
-      "src/renderer/src/lib/updater-beforeunload.test.ts": 8,
-      "src/renderer/src/lib/use-tab-agent-observed-signal-dispatch.test.tsx": 63,
-      "src/renderer/src/lib/use-tab-agent-opencode-native-title.test.ts": 40,
-      "src/renderer/src/lib/use-tab-agent-pi-identity.test.ts": 27,
-      "src/renderer/src/lib/use-tab-agent-process-signals.test.ts": 48,
-      "src/renderer/src/lib/use-tab-agent-remote-pty-selector.test.ts": 30,
-      "src/renderer/src/lib/use-tab-agent-retained-identity.test.ts": 36,
-      "src/renderer/src/lib/use-tab-agent-sleeping-session.test.ts": 37,
-      "src/renderer/src/lib/use-tab-agent.test.ts": 112,
-      "src/renderer/src/lib/visible-overlay.test.ts": 15,
-      "src/renderer/src/lib/wake-sleeping-agents-in-background.test.ts": 19,
-      "src/renderer/src/lib/wake-sleeping-agents-live-done.test.ts": 10,
-      "src/renderer/src/lib/web-client-location.test.ts": 6,
-      "src/renderer/src/lib/window-label-formatter.test.ts": 13,
-      "src/renderer/src/lib/window-visibility-interval.test.ts": 15,
-      "src/renderer/src/lib/window-visibility-timeout-poller.test.ts": 10,
-      "src/renderer/src/lib/windows-terminal-capabilities-race.test.ts": 7,
-      "src/renderer/src/lib/windows-terminal-capabilities.test.ts": 64,
-      "src/renderer/src/lib/windows-terminal-capability-reprobe.test.ts": 25,
-      "src/renderer/src/lib/work-item-link-query-bounds.test.ts": 5,
-      "src/renderer/src/lib/work-item-lookup-text.test.ts": 8,
-      "src/renderer/src/lib/worker-terminal-takeover-report.test.ts": 257,
-      "src/renderer/src/lib/workspace-activation-path-gate.test.ts": 23,
-      "src/renderer/src/lib/workspace-activation-terminal-focus.test.ts": 270,
-      "src/renderer/src/lib/workspace-browser-tab-open.test.ts": 37,
-      "src/renderer/src/lib/workspace-composer-initial-focus.test.ts": 16,
-      "src/renderer/src/lib/workspace-create-error-format.test.ts": 9,
-      "src/renderer/src/lib/workspace-doc-address-input.test.ts": 12,
-      "src/renderer/src/lib/workspace-emoji-shortcodes.lazy.test.ts": 60,
-      "src/renderer/src/lib/workspace-emoji-shortcodes.test.ts": 29,
-      "src/renderer/src/lib/workspace-file-drag.test.ts": 7,
-      "src/renderer/src/lib/workspace-port-groups.test.ts": 5,
-      "src/renderer/src/lib/workspace-port-host-availability.test.ts": 12,
-      "src/renderer/src/lib/workspace-port-scan-debounce.test.ts": 12,
-      "src/renderer/src/lib/workspace-port-scan-publish.test.ts": 24,
-      "src/renderer/src/lib/workspace-session-browser-history.test.ts": 12,
-      "src/renderer/src/lib/workspace-session-closed-tab-tombstones.test.ts": 7,
-      "src/renderer/src/lib/workspace-session-editor-drafts.test.ts": 9,
-      "src/renderer/src/lib/workspace-session-host-contention.test.ts": 18,
-      "src/renderer/src/lib/workspace-session-host-persistence.test.ts": 22,
-      "src/renderer/src/lib/workspace-session-host-split.test.ts": 14,
-      "src/renderer/src/lib/workspace-session-hydration-keys.test.ts": 8,
-      "src/renderer/src/lib/workspace-session-liveness.test.ts": 8,
-      "src/renderer/src/lib/workspace-session-patch.test.ts": 12,
-      "src/renderer/src/lib/workspace-session-persistence-gate.test.ts": 8,
-      "src/renderer/src/lib/workspace-session-relevant-fields.test.ts": 6,
-      "src/renderer/src/lib/workspace-session-staged-browser-tabs.test.ts": 5,
-      "src/renderer/src/lib/workspace-session.test.ts": 20,
-      "src/renderer/src/lib/workspace-tab-agent-metadata.test.ts": 11,
-      "src/renderer/src/lib/workspace-tab-palette-activation.store.test.ts": 10,
-      "src/renderer/src/lib/workspace-tab-palette-activation.test.ts": 19,
-      "src/renderer/src/lib/workspace-tab-palette-results.test.ts": 19,
-      "src/renderer/src/lib/workspace-tab-palette-search.test.ts": 37,
-      "src/renderer/src/lib/workspace-terminal-host-authority.test.ts": 38,
-      "src/renderer/src/lib/worktree-activation-agent-startup.test.ts": 42,
-      "src/renderer/src/lib/worktree-activation-automation-filter.test.ts": 19,
-      "src/renderer/src/lib/worktree-activation-created-agent.test.ts": 72,
-      "src/renderer/src/lib/worktree-activation-default-tabs.test.ts": 33,
-      "src/renderer/src/lib/worktree-activation-emptied-workspace-reseed.test.ts": 71,
-      "src/renderer/src/lib/worktree-activation-empty-remote.test.ts": 63,
-      "src/renderer/src/lib/worktree-activation-issue-command.test.ts": 21,
-      "src/renderer/src/lib/worktree-activation-pty-inventory.test.ts": 18,
-      "src/renderer/src/lib/worktree-activation-reveal.test.ts": 18,
-      "src/renderer/src/lib/worktree-activation-setup-script.test.ts": 67,
-      "src/renderer/src/lib/worktree-activation-structured-chat-surface.test.ts": 43,
-      "src/renderer/src/lib/worktree-activation-surface-caller-wiring.test.ts": 366,
-      "src/renderer/src/lib/worktree-activation-web-runtime.test.ts": 198,
-      "src/renderer/src/lib/worktree-activity-state.test.ts": 8,
-      "src/renderer/src/lib/worktree-agent-activation-gate.test.ts": 36,
-      "src/renderer/src/lib/worktree-agent-activation-seam.test.ts": 37,
-      "src/renderer/src/lib/worktree-agent-structured-inventory.test.ts": 8,
-      "src/renderer/src/lib/worktree-attachment-label.test.ts": 6,
-      "src/renderer/src/lib/worktree-creation-agent-seeding.test.ts": 11,
-      "src/renderer/src/lib/worktree-creation-agent-seeds.test.ts": 107,
-      "src/renderer/src/lib/worktree-creation-chat-setup.test.ts": 23,
-      "src/renderer/src/lib/worktree-creation-flow-agent-trust-preflight.test.ts": 3,
-      "src/renderer/src/lib/worktree-creation-flow-dedupe.test.ts": 7,
-      "src/renderer/src/lib/worktree-creation-flow-stranded-surface.test.ts": 123,
-      "src/renderer/src/lib/worktree-creation-flow.test.ts": 879,
-      "src/renderer/src/lib/worktree-creation-structured-session.test.ts": 28,
-      "src/renderer/src/lib/worktree-creation-structured-unknown-outcome.test.ts": 9,
-      "src/renderer/src/lib/worktree-creation-surface.test.ts": 4,
-      "src/renderer/src/lib/worktree-default-display-name.test.ts": 11,
-      "src/renderer/src/lib/worktree-display-name-order.test.ts": 13,
-      "src/renderer/src/lib/worktree-draft-startup-view-mode.test.ts": 12,
-      "src/renderer/src/lib/worktree-git-identity-display.test.ts": 4,
-      "src/renderer/src/lib/worktree-jump-navigation.test.ts": 21,
-      "src/renderer/src/lib/worktree-live-terminal-surface-owners.test.ts": 13,
-      "src/renderer/src/lib/worktree-operation-generation.test.ts": 7,
-      "src/renderer/src/lib/worktree-operation-route.test.ts": 20,
-      "src/renderer/src/lib/worktree-palette-comment-snippet.test.ts": 13,
-      "src/renderer/src/lib/worktree-palette-create-action.test.ts": 7,
-      "src/renderer/src/lib/worktree-palette-multi-keyword.test.ts": 143,
-      "src/renderer/src/lib/worktree-palette-review-match.test.ts": 9,
-      "src/renderer/src/lib/worktree-palette-runtime-owner-identity.test.ts": 14,
-      "src/renderer/src/lib/worktree-palette-search.test.ts": 62,
-      "src/renderer/src/lib/worktree-palette-task-url-match.test.ts": 25,
-      "src/renderer/src/lib/worktree-reactivation-preserved-pane-replacement.test.ts": 53,
-      "src/renderer/src/lib/worktree-reactivation-runtime-owned-resume-deferral.test.ts": 30,
-      "src/renderer/src/lib/worktree-reactivation-tab-forkbomb.test.ts": 30,
-      "src/renderer/src/lib/worktree-runtime-owner-index.detected-perf.test.ts": 411,
-      "src/renderer/src/lib/worktree-runtime-owner-index.detected.test.ts": 80,
-      "src/renderer/src/lib/worktree-runtime-owner-index.test.ts": 7,
-      "src/renderer/src/lib/worktree-runtime-owner.test.ts": 64,
-      "src/renderer/src/lib/worktree-sort-order-host-split.test.ts": 5,
-      "src/renderer/src/lib/worktree-sort-order-persistence.test.ts": 29,
-      "src/renderer/src/lib/worktree-status-spinner-launch-agent.test.ts": 15,
-      "src/renderer/src/lib/worktree-status-terminal-layout-roots.test.ts": 4,
-      "src/renderer/src/lib/worktree-status.interrupted.test.ts": 8,
-      "src/renderer/src/lib/worktree-status.test.ts": 16,
-      "src/renderer/src/lib/worktree-visit-recency.test.ts": 6,
-      "src/renderer/src/renderer-node-builtin-boundary.test.ts": 1808,
-      "src/renderer/src/runtime/agent-resume-host-authority-capability.test.ts": 11,
-      "src/renderer/src/runtime/agent-session-operation-id.test.ts": 6,
-      "src/renderer/src/runtime/browser-client-host-identity.test.ts": 7,
-      "src/renderer/src/runtime/browser-workspace-tab-close-census.test.ts": 221,
-      "src/renderer/src/runtime/browser-workspace-tab-close-plan.test.ts": 11,
-      "src/renderer/src/runtime/browser-workspace-tab-close.test.ts": 21,
-      "src/renderer/src/runtime/client-hosted-browser-close-intent-replay.test.ts": 11,
-      "src/renderer/src/runtime/client-hosted-browser-close-intents.test.ts": 16,
-      "src/renderer/src/runtime/client-hosted-browser-row-close.test.ts": 13,
-      "src/renderer/src/runtime/close-mirrored-editor-tab.test.ts": 61,
-      "src/renderer/src/runtime/file-explorer-delete-owner-provenance.test.ts": 47,
-      "src/renderer/src/runtime/focus-runtime-terminal-surface-chat-view.test.ts": 13,
-      "src/renderer/src/runtime/github-check-details-timeout.test.ts": 14,
-      "src/renderer/src/runtime/gitlab-job-trace-client.test.ts": 25,
-      "src/renderer/src/runtime/host-session-mirror-empty-inventory-settle.test.ts": 37,
-      "src/renderer/src/runtime/host-session-mirror-hydration-frame-ordering.test.tsx": 120,
-      "src/renderer/src/runtime/host-session-mirror-settle-census.test.ts": 76,
-      "src/renderer/src/runtime/host-session-mirror-settle-receipt-frames.test.tsx": 165,
-      "src/renderer/src/runtime/host-session-snapshot-authority-client-hosted.test.ts": 4,
-      "src/renderer/src/runtime/local-runtime-capabilities.test.ts": 10,
-      "src/renderer/src/runtime/local-session-tab-close-owner.test.ts": 9,
-      "src/renderer/src/runtime/local-structured-session-empty-worktree-visibility.test.ts": 17,
-      "src/renderer/src/runtime/local-structured-session-retired-epoch-repair.test.ts": 21,
-      "src/renderer/src/runtime/local-structured-session-reveal-visibility.test.ts": 35,
-      "src/renderer/src/runtime/local-structured-session-tabs-host-isolation.test.ts": 28,
-      "src/renderer/src/runtime/local-structured-session-tabs-sync.test.ts": 210,
-      "src/renderer/src/runtime/local-structured-session-tabs-sync/retired-epoch-repair.test.ts": 16,
-      "src/renderer/src/runtime/mirrored-agent-status-clock-skew.test.ts": 51,
-      "src/renderer/src/runtime/mobile-markdown-bridge-save-guards.test.ts": 58,
-      "src/renderer/src/runtime/mobile-markdown-bridge.test.ts": 31,
-      "src/renderer/src/runtime/native-chat-launch-draft-runtime-resolution.test.ts": 6,
-      "src/renderer/src/runtime/paired-reconnect-sidebar-agent-count.test.ts": 146,
-      "src/renderer/src/runtime/remote-agent-row-last-assistant-message.test.ts": 98,
-      "src/renderer/src/runtime/remote-agent-session-launch.test.ts": 11,
-      "src/renderer/src/runtime/remote-host-file-delete-repro.test.ts": 30,
-      "src/renderer/src/runtime/remote-host-file-open-repro.test.ts": 16,
-      "src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts": 11,
-      "src/renderer/src/runtime/remote-runtime-snapshot-outcome.test.ts": 28,
-      "src/renderer/src/runtime/remote-runtime-terminal-end-verdict.test.ts": 49,
-      "src/renderer/src/runtime/remote-runtime-terminal-frame-drop-resync.test.ts": 47,
-      "src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts": 296,
-      "src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts": 17,
-      "src/renderer/src/runtime/remote-runtime-terminal-stale-stream-frames.test.ts": 9,
-      "src/renderer/src/runtime/remote-runtime-terminal-stall-recovery.test.ts": 145,
-      "src/renderer/src/runtime/remote-server-install-failure-probe.test.ts": 9,
-      "src/renderer/src/runtime/remote-server-parity.test.ts": 28,
-      "src/renderer/src/runtime/remote-server-restart-wait.test.ts": 7,
-      "src/renderer/src/runtime/remote-server-update-coordinator.test.ts": 24,
-      "src/renderer/src/runtime/remote-terminal-layout-resolution.test.ts": 14,
-      "src/renderer/src/runtime/remote-terminal-stream-watchdog.test.ts": 13,
-      "src/renderer/src/runtime/restored-client-hosted-browser-host-attach.test.ts": 16,
-      "src/renderer/src/runtime/restored-client-hosted-browser-host-restart-attach.test.ts": 15,
-      "src/renderer/src/runtime/runtime-client-events.test.ts": 9,
-      "src/renderer/src/runtime/runtime-environment-ssh-state.test.ts": 148,
-      "src/renderer/src/runtime/runtime-file-client-download.test.ts": 21,
-      "src/renderer/src/runtime/runtime-file-client-external-import.test.ts": 20,
-      "src/renderer/src/runtime/runtime-file-client-mutation-ownership.test.ts": 17,
-      "src/renderer/src/runtime/runtime-file-client-search-listing.test.ts": 129,
-      "src/renderer/src/runtime/runtime-file-client-watch.test.ts": 73,
-      "src/renderer/src/runtime/runtime-file-client.test.ts": 18,
-      "src/renderer/src/runtime/runtime-file-import-pairing-revision.test.ts": 22,
-      "src/renderer/src/runtime/runtime-file-search-bounds.test.ts": 7,
-      "src/renderer/src/runtime/runtime-git-client-api-contract.test.ts": 4,
-      "src/renderer/src/runtime/runtime-git-client-branch-line-total.test.ts": 13,
-      "src/renderer/src/runtime/runtime-git-client-merge.test.ts": 11,
-      "src/renderer/src/runtime/runtime-git-client.test.ts": 32,
-      "src/renderer/src/runtime/runtime-hooks-client.test.ts": 9,
-      "src/renderer/src/runtime/runtime-host-connection-state.test.ts": 7,
-      "src/renderer/src/runtime/runtime-jira-client.test.ts": 17,
-      "src/renderer/src/runtime/runtime-jira-payload-stream.test.ts": 10,
-      "src/renderer/src/runtime/runtime-linear-client.test.ts": 25,
-      "src/renderer/src/runtime/runtime-provider-accounts-client.test.ts": 37,
-      "src/renderer/src/runtime/runtime-provider-search-bounds.test.ts": 7,
-      "src/renderer/src/runtime/runtime-repo-client.test.ts": 7,
-      "src/renderer/src/runtime/runtime-repo-search-bounds.test.ts": 7,
-      "src/renderer/src/runtime/runtime-rpc-client-pairing-revision.test.ts": 7,
-      "src/renderer/src/runtime/runtime-rpc-client.test.ts": 22,
-      "src/renderer/src/runtime/runtime-rpc-result.test.ts": 9,
-      "src/renderer/src/runtime/runtime-server-directory-browser.test.ts": 9,
-      "src/renderer/src/runtime/runtime-skills-client.test.ts": 12,
-      "src/renderer/src/runtime/runtime-skills-delete-client.test.ts": 15,
-      "src/renderer/src/runtime/runtime-terminal-inspection.test.ts": 683,
-      "src/renderer/src/runtime/runtime-terminal-stream.test.ts": 286,
-      "src/renderer/src/runtime/runtime-worktree-selector.test.ts": 6,
-      "src/renderer/src/runtime/structured-agent-session-client.test.ts": 14,
-      "src/renderer/src/runtime/structured-agent-session-close.test.ts": 8,
-      "src/renderer/src/runtime/structured-agent-session-status-feed-lifecycle.test.ts": 11,
-      "src/renderer/src/runtime/structured-agent-session-status-feed.test.ts": 18,
-      "src/renderer/src/runtime/structured-conversation-tab-replacement.test.ts": 20,
-      "src/renderer/src/runtime/sync-runtime-graph-agent-status-projection-join.test.ts": 51,
-      "src/renderer/src/runtime/sync-runtime-graph-agent-status-projection.test.ts": 20,
-      "src/renderer/src/runtime/sync-runtime-graph-automation-leaf.test.ts": 16,
-      "src/renderer/src/runtime/sync-runtime-graph-browser.test.ts": 15,
-      "src/renderer/src/runtime/sync-runtime-graph-conversion-publish.test.ts": 83,
-      "src/renderer/src/runtime/sync-runtime-graph-editor-diff-tabs.test.ts": 19,
-      "src/renderer/src/runtime/sync-runtime-graph-key-reuse.test.ts": 19,
-      "src/renderer/src/runtime/sync-runtime-graph-parked-leaf.test.ts": 29,
-      "src/renderer/src/runtime/sync-runtime-graph-payload-partition.test.ts": 32,
-      "src/renderer/src/runtime/sync-runtime-graph-projection-hot-path.test.ts": 128,
-      "src/renderer/src/runtime/sync-runtime-graph-publication-cost.test.ts": 55,
-      "src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts": 24,
-      "src/renderer/src/runtime/sync-runtime-graph-terminal-layout.test.ts": 696,
-      "src/renderer/src/runtime/sync-runtime-graph-terminal-registration-ownership.test.ts": 13,
-      "src/renderer/src/runtime/sync-runtime-graph-terminal-surface-projection.test.ts": 30,
-      "src/renderer/src/runtime/sync-runtime-graph-workspace-publication.test.ts": 19,
-      "src/renderer/src/runtime/sync-runtime-graph.test.ts": 20,
-      "src/renderer/src/runtime/sync-runtime-graph/mobile-terminal-theme.test.ts": 4,
-      "src/renderer/src/runtime/use-remote-runtime-recovery-triggers.test.ts": 22,
-      "src/renderer/src/runtime/use-runtime-session-mirror-environment-key.test.ts": 78,
-      "src/renderer/src/runtime/use-worktree-runtime-target.test.ts": 58,
-      "src/renderer/src/runtime/web-runtime-browser-capability-cleanup.test.ts": 16,
-      "src/renderer/src/runtime/web-runtime-browser-materialization.test.ts": 4,
-      "src/renderer/src/runtime/web-runtime-browser-tab-staging-hosting-intent.test.ts": 9,
-      "src/renderer/src/runtime/web-runtime-session-browser-client-placement.test.ts": 81,
-      "src/renderer/src/runtime/web-runtime-session-browser-create-failure.test.ts": 112,
-      "src/renderer/src/runtime/web-runtime-session-browser-create-focus.test.ts": 283,
-      "src/renderer/src/runtime/web-runtime-session-browser-create-split-placement.test.ts": 231,
-      "src/renderer/src/runtime/web-runtime-session-browser-create-staged-focus.test.ts": 118,
-      "src/renderer/src/runtime/web-runtime-session-browser-create-staged-hosting-intent.test.ts": 32,
-      "src/renderer/src/runtime/web-runtime-session-browser-create-staging.test.ts": 320,
-      "src/renderer/src/runtime/web-runtime-session-browser-placement-staleness.test.ts": 22,
-      "src/renderer/src/runtime/web-runtime-session-tab-activate-close.test.ts": 27,
-      "src/renderer/src/runtime/web-runtime-session-tab-move.test.ts": 11,
-      "src/renderer/src/runtime/web-runtime-session-tab-props.test.ts": 116,
-      "src/renderer/src/runtime/web-runtime-session-terminal-host-authority.test.ts": 38,
-      "src/renderer/src/runtime/web-runtime-session-terminal-legacy-create.test.ts": 35,
-      "src/renderer/src/runtime/web-runtime-session-terminal-pane-delegation.test.ts": 590,
-      "src/renderer/src/runtime/web-runtime-session-terminal-workspace-routing.test.ts": 16,
-      "src/renderer/src/runtime/web-runtime-session.test.ts": 16,
-      "src/renderer/src/runtime/web-runtime-wake-terminal-respawn.test.ts": 4,
-      "src/renderer/src/runtime/web-session-browser-placement.test.ts": 8,
-      "src/renderer/src/runtime/web-session-close-intent.test.ts": 7,
-      "src/renderer/src/runtime/web-session-existing-tab-index.test.ts": 7,
-      "src/renderer/src/runtime/web-session-focus-intent-visible-tab.test.ts": 9,
-      "src/renderer/src/runtime/web-session-intent-owner.test.ts": 7,
-      "src/renderer/src/runtime/web-session-open-files-batch-equivalence.test.ts": 333,
-      "src/renderer/src/runtime/web-session-structured-tab-focus.test.ts": 11,
-      "src/renderer/src/runtime/web-session-tabs-agent-completion-notifications.test.ts": 40,
-      "src/renderer/src/runtime/web-session-tabs-sync-agent-handoff.test.ts": 15,
-      "src/renderer/src/runtime/web-session-tabs-sync-agent-status.test.ts": 19,
-      "src/renderer/src/runtime/web-session-tabs-sync-browser-tabs.test.ts": 29,
-      "src/renderer/src/runtime/web-session-tabs-sync-client-owned-page-content.test.ts": 22,
-      "src/renderer/src/runtime/web-session-tabs-sync-client-owned-placement.test.ts": 36,
-      "src/renderer/src/runtime/web-session-tabs-sync-diff-focus-steal.test.ts": 19,
-      "src/renderer/src/runtime/web-session-tabs-sync-editor-tabs.test.ts": 15,
-      "src/renderer/src/runtime/web-session-tabs-sync-focus-intent.test.ts": 26,
-      "src/renderer/src/runtime/web-session-tabs-sync-host-restart-browser-rows.test.ts": 22,
-      "src/renderer/src/runtime/web-session-tabs-sync-host-tab-retraction-ghost-rows.test.ts": 138,
-      "src/renderer/src/runtime/web-session-tabs-sync-html-preview-focus.test.ts": 21,
-      "src/renderer/src/runtime/web-session-tabs-sync-layout-duplicate-groups.test.ts": 15,
-      "src/renderer/src/runtime/web-session-tabs-sync-layout-groups.test.ts": 22,
-      "src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts": 54,
-      "src/renderer/src/runtime/web-session-tabs-sync-remote-status-title-flap.test.ts": 109,
-      "src/renderer/src/runtime/web-session-tabs-sync-restored-browser-rows.test.ts": 17,
-      "src/renderer/src/runtime/web-session-tabs-sync-snapshot-batch.test.ts": 36,
-      "src/renderer/src/runtime/web-session-tabs-sync-staged-browser-adoption.test.ts": 15,
-      "src/renderer/src/runtime/web-session-tabs-sync-staged-browser-authority.test.ts": 12,
-      "src/renderer/src/runtime/web-session-tabs-sync-terminal-bootstrap.test.ts": 5,
-      "src/renderer/src/runtime/web-session-tabs-sync-terminal-mirroring.test.ts": 30,
-      "src/renderer/src/runtime/web-session-tabs-sync-tracking-teardown.test.ts": 18,
-      "src/renderer/src/runtime/web-session-tabs-sync-visibility-collision.test.tsx": 113,
-      "src/renderer/src/runtime/web-session-tabs-sync-window-visibility.test.tsx": 170,
-      "src/renderer/src/runtime/web-session-tabs-sync.test.ts": 29,
-      "src/renderer/src/runtime/web-session-tabs-sync/mirrored-agent-tab-label.test.ts": 7,
-      "src/renderer/src/runtime/web-session-tabs-sync/mirrored-terminal-recovery-ledger.test.ts": 9,
-      "src/renderer/src/runtime/web-session-terminal-handle-events.test.ts": 6,
-      "src/renderer/src/runtime/web-session-terminal-orphan-absence-across-republication.test.ts": 11,
-      "src/renderer/src/runtime/web-session-terminal-orphan-inventory-retry.test.ts": 43,
-      "src/renderer/src/runtime/web-session-terminal-orphan-mixed-version.test.ts": 49,
-      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-adoption-regressions.test.ts": 179,
-      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-host-scope-gate.test.ts": 10,
-      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-prior-removal.test.ts": 15,
-      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-regressions.test.ts": 295,
-      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-topology-fence.test.ts": 168,
-      "src/renderer/src/runtime/web-session-terminal-orphan-recovery.test.ts": 122,
-      "src/renderer/src/runtime/web-session-terminal-pending-handle-recovery.test.ts": 33,
-      "src/renderer/src/runtime/web-session-terminal-recovery-snapshot-validation.test.ts": 155,
-      "src/renderer/src/runtime/web-session-terminal-retirement-proof-ledger.test.ts": 11,
-      "src/renderer/src/runtime/window-visibility-subscription-parking.test.ts": 26,
-      "src/renderer/src/runtime/worktree-create-base.test.ts": 4,
-      "src/renderer/src/ssh/ssh-connect-in-flight.test.ts": 21,
-      "src/renderer/src/ssh/ssh-connect-ui-timeout.test.ts": 15,
-      "src/renderer/src/ssh/ssh-connect-verb.test.ts": 7,
-      "src/renderer/src/ssh/ssh-connection-recoverability.test.ts": 6,
-      "src/renderer/src/startup/active-workspace-ssh-targets.test.ts": 7,
-      "src/renderer/src/startup/ssh-startup-reconnect.test.ts": 16,
-      "src/renderer/src/startup/startup-ssh-connection-restore.test.ts": 13,
-      "src/renderer/src/store/active-terminal-chrome-selector.test.ts": 17,
-      "src/renderer/src/store/always-mounted-selector-scan-cost.test.ts": 116,
-      "src/renderer/src/store/copy-on-write-record.test.ts": 6,
-      "src/renderer/src/store/folder-workspaces/folder-workspace-catalog.test.ts": 14,
-      "src/renderer/src/store/pinned-tab-close-guard.test.ts": 13,
-      "src/renderer/src/store/plugin-language-packs.test.ts": 21,
-      "src/renderer/src/store/plugin-panels.test.ts": 13,
-      "src/renderer/src/store/project-host-setup-selector.test.ts": 18,
-      "src/renderer/src/store/projects/project-catalog-null-field-ingest.test.ts": 12,
-      "src/renderer/src/store/projects/project-wsl-filesystem-boundary-advisory.test.ts": 13,
-      "src/renderer/src/store/react-commit-cascade-write-probe.test.ts": 5,
-      "src/renderer/src/store/repos/safe-auto-fork-sync.test.ts": 8,
-      "src/renderer/src/store/right-sidebar-route.test.ts": 6,
-      "src/renderer/src/store/running-terminal-close-confirm.test.ts": 7,
-      "src/renderer/src/store/selectors.test.ts": 44,
-      "src/renderer/src/store/slices/active-tab-owner-worktree.test.ts": 12,
-      "src/renderer/src/store/slices/activity-cleared-at.test.ts": 82,
-      "src/renderer/src/store/slices/agent-generated-tab-title.test.ts": 141,
-      "src/renderer/src/store/slices/agent-hibernation-live-anchor-e2e.test.ts": 53,
-      "src/renderer/src/store/slices/agent-pane-authority.test.ts": 110,
-      "src/renderer/src/store/slices/agent-status-ack-cleanup.test.ts": 99,
-      "src/renderer/src/store/slices/agent-status-batch.test.ts": 154,
-      "src/renderer/src/store/slices/agent-status-drop-ipc.test.ts": 705,
-      "src/renderer/src/store/slices/agent-status-drop.test.ts": 88,
-      "src/renderer/src/store/slices/agent-status-freshness-cache.test.ts": 10,
-      "src/renderer/src/store/slices/agent-status-freshness-scheduler.test.ts": 20,
-      "src/renderer/src/store/slices/agent-status-live-freshness-request.test.ts": 7,
-      "src/renderer/src/store/slices/agent-status-live-map-leak.test.ts": 10291,
-      "src/renderer/src/store/slices/agent-status-manual-sleep-capture.test.ts": 90,
-      "src/renderer/src/store/slices/agent-status-observation-neutrality.test.ts": 107,
-      "src/renderer/src/store/slices/agent-status-pane-keyed-records.test.ts": 26,
-      "src/renderer/src/store/slices/agent-status-pr-refresh-handoff.test.ts": 89,
-      "src/renderer/src/store/slices/agent-status-provider-session.test.ts": 117,
-      "src/renderer/src/store/slices/agent-status-quit-capture-resumable-agents.test.ts": 64,
-      "src/renderer/src/store/slices/agent-status-quit-capture.test.ts": 170,
-      "src/renderer/src/store/slices/agent-status-reminted-pane-key.test.ts": 41,
-      "src/renderer/src/store/slices/agent-status-retained-leak.test.ts": 846,
-      "src/renderer/src/store/slices/agent-status-retention-prefix-sweep.test.ts": 85,
-      "src/renderer/src/store/slices/agent-status-runtime-orchestration.test.ts": 96,
-      "src/renderer/src/store/slices/agent-status-session-boundary-done.test.ts": 60,
-      "src/renderer/src/store/slices/agent-status-ssh-connection-clear.test.ts": 64,
-      "src/renderer/src/store/slices/agent-status-tool-assistant-fields.test.ts": 128,
-      "src/renderer/src/store/slices/agent-status-worktree-purge-leak.test.ts": 50,
-      "src/renderer/src/store/slices/agent-status.test.ts": 54,
-      "src/renderer/src/store/slices/ambiguous-owner-warning-worktree-removal-leak.test.ts": 587,
-      "src/renderer/src/store/slices/browser-cleanup-close.test.ts": 151,
-      "src/renderer/src/store/slices/browser-page-close-intent-recording.test.ts": 191,
-      "src/renderer/src/store/slices/browser-page-conversion.test.ts": 125,
-      "src/renderer/src/store/slices/browser-remote-page-lifecycle.test.ts": 221,
-      "src/renderer/src/store/slices/browser-remote-tab-creation.test.ts": 42,
-      "src/renderer/src/store/slices/browser-session-host-selection.test.ts": 225,
-      "src/renderer/src/store/slices/browser-session-profiles.test.ts": 21,
-      "src/renderer/src/store/slices/browser-webview-cleanup.test.ts": 7,
-      "src/renderer/src/store/slices/browser-workspace-doc-location.test.ts": 171,
-      "src/renderer/src/store/slices/browser-workspace-host-ownership.test.ts": 18,
-      "src/renderer/src/store/slices/browser.test.ts": 43,
-      "src/renderer/src/store/slices/bulk-worktree-purge-terminal-maps-leak.test.ts": 89,
-      "src/renderer/src/store/slices/cmd-j-create-actions.test.ts": 90,
-      "src/renderer/src/store/slices/codex-restart-notice-lifecycle.test.ts": 48,
-      "src/renderer/src/store/slices/degraded-repo-hydration.test.ts": 81,
-      "src/renderer/src/store/slices/detected-agents-environment-prune-leak.test.ts": 55,
-      "src/renderer/src/store/slices/detected-agents.test.ts": 138,
-      "src/renderer/src/store/slices/detected-worktree-refresh-leases.test.ts": 11,
-      "src/renderer/src/store/slices/dictation-model-state-stabilisation.test.ts": 9,
-      "src/renderer/src/store/slices/diffComments.test.ts": 122,
-      "src/renderer/src/store/slices/direct-ssh-pane-detach-ledger.test.ts": 62,
-      "src/renderer/src/store/slices/direct-ssh-terminal-recovery.test.ts": 39,
-      "src/renderer/src/store/slices/direct-ssh-terminal-retry.test.ts": 147,
-      "src/renderer/src/store/slices/direct-ssh-terminal-workspace-scope.test.ts": 11,
-      "src/renderer/src/store/slices/editor-branch-diff-snapshots.test.ts": 19,
-      "src/renderer/src/store/slices/editor-branch-line-total.test.ts": 16,
-      "src/renderer/src/store/slices/editor-check-details-tabs.test.ts": 27,
-      "src/renderer/src/store/slices/editor-close-file-cleanup.test.ts": 255,
-      "src/renderer/src/store/slices/editor-git-status-reconciliation.test.ts": 31,
-      "src/renderer/src/store/slices/editor-hydration-scaling.test.ts": 85,
-      "src/renderer/src/store/slices/editor-markdown-link-activation.test.ts": 38,
-      "src/renderer/src/store/slices/editor-markdown-view-state.test.ts": 37,
-      "src/renderer/src/store/slices/editor-open-diff.test.ts": 42,
-      "src/renderer/src/store/slices/editor-read-only-tabs.test.ts": 16,
-      "src/renderer/src/store/slices/editor-recently-closed-tabs.test.ts": 40,
-      "src/renderer/src/store/slices/editor-rekey-open-files.test.ts": 75,
-      "src/renderer/src/store/slices/editor-remote-branch-actions.test.ts": 62,
-      "src/renderer/src/store/slices/editor-rich-markdown-size-override.test.ts": 14,
-      "src/renderer/src/store/slices/editor-right-sidebar-state.test.ts": 24,
-      "src/renderer/src/store/slices/editor-session-duplicate-restore.test.ts": 84,
-      "src/renderer/src/store/slices/editor-state-worktree-purge-leak.test.ts": 59,
-      "src/renderer/src/store/slices/editor-tab-placement.test.ts": 30,
-      "src/renderer/src/store/slices/editor/actions/markdown-preview-actions.test.ts": 9,
-      "src/renderer/src/store/slices/editor/file-ids/hydrated-editor-file-index.test.ts": 512,
-      "src/renderer/src/store/slices/editor/file-ids/hydrated-editor-projections.test.ts": 143,
-      "src/renderer/src/store/slices/editor/git/git-status-reconciliation.perf.test.ts": 36,
-      "src/renderer/src/store/slices/folder-workspace-activation-and-activity.test.ts": 144,
-      "src/renderer/src/store/slices/folder-workspace-diff-comments.test.ts": 388,
-      "src/renderer/src/store/slices/folder-workspace-owner-routed-mutations.test.ts": 188,
-      "src/renderer/src/store/slices/generation-records-worktree-removal-leak.test.ts": 75,
-      "src/renderer/src/store/slices/github-branch-mismatched-linked-pr.test.ts": 5,
-      "src/renderer/src/store/slices/github-cache-eviction-and-bounds.test.ts": 221,
-      "src/renderer/src/store/slices/github-checks-cache.test.ts": 46,
-      "src/renderer/src/store/slices/github-checks.test.ts": 9,
-      "src/renderer/src/store/slices/github-issue-source-indicator-suppression.test.ts": 45,
-      "src/renderer/src/store/slices/github-issue-state-machine.test.ts": 35,
-      "src/renderer/src/store/slices/github-pr-branch-coordinator-events.test.ts": 35,
-      "src/renderer/src/store/slices/github-pr-branch-direct-refresh-scope.test.ts": 20,
-      "src/renderer/src/store/slices/github-pr-branch-fallback-results.test.ts": 26,
-      "src/renderer/src/store/slices/github-pr-branch-hosted-review-cache.test.ts": 27,
-      "src/renderer/src/store/slices/github-pr-branch-linked-pr-divergence.test.ts": 33,
-      "src/renderer/src/store/slices/github-pr-checks-fetch.test.ts": 121,
-      "src/renderer/src/store/slices/github-pr-comments.test.ts": 89,
-      "src/renderer/src/store/slices/github-pr-refresh-host-guard.test.ts": 28,
-      "src/renderer/src/store/slices/github-pr-refresh-hosted-review-cache-leak.test.ts": 802,
-      "src/renderer/src/store/slices/github-pr-refresh-owner-routing.test.ts": 218,
-      "src/renderer/src/store/slices/github-pr-refresh-sequences-leak.test.ts": 16,
-      "src/renderer/src/store/slices/github-pr-refresh-states-leak.test.ts": 4478,
-      "src/renderer/src/store/slices/github-project-request-coordination.test.ts": 20,
-      "src/renderer/src/store/slices/github-project-row-owner.test.ts": 6,
-      "src/renderer/src/store/slices/github-project-view-tables.test.ts": 60,
-      "src/renderer/src/store/slices/github-provider-request-concurrency.test.ts": 19,
-      "src/renderer/src/store/slices/github-refresh-sweep.test.ts": 252,
-      "src/renderer/src/store/slices/github-repo-lookup-index.test.ts": 4,
-      "src/renderer/src/store/slices/github-review-thread-actions.test.ts": 24,
-      "src/renderer/src/store/slices/github-work-item-cache-identity.test.ts": 13,
-      "src/renderer/src/store/slices/github-work-items-error-envelope.test.ts": 43,
-      "src/renderer/src/store/slices/github-work-items-pagination.test.ts": 29,
-      "src/renderer/src/store/slices/github-work-items-query-bounds.test.ts": 10,
-      "src/renderer/src/store/slices/github-work-items-runtime-routing.test.ts": 218,
-      "src/renderer/src/store/slices/github-worktree-refresh-if-stale.test.ts": 85,
-      "src/renderer/src/store/slices/hosted-review-cache-race.test.ts": 15,
-      "src/renderer/src/store/slices/hosted-review-cache.test.ts": 69,
-      "src/renderer/src/store/slices/hosted-review.test.ts": 20,
-      "src/renderer/src/store/slices/jira.test.ts": 41,
-      "src/renderer/src/store/slices/linear-credential-error-recovery.test.ts": 31,
-      "src/renderer/src/store/slices/linear-invalidation.test.ts": 23,
-      "src/renderer/src/store/slices/linear-issue-cache-refresh.test.ts": 17,
-      "src/renderer/src/store/slices/linear-scoped-collection-cache.test.ts": 40,
-      "src/renderer/src/store/slices/linear-source-context-cache-scope.test.ts": 20,
-      "src/renderer/src/store/slices/linear.test.ts": 13,
-      "src/renderer/src/store/slices/local-detected-agent-state.test.ts": 12,
-      "src/renderer/src/store/slices/memory.test.ts": 7,
-      "src/renderer/src/store/slices/native-chat-launch-draft-teardown.test.ts": 84,
-      "src/renderer/src/store/slices/new-issue-draft.test.ts": 7,
-      "src/renderer/src/store/slices/new-markdown.test.ts": 23,
-      "src/renderer/src/store/slices/orca-profiles-auth-actions.test.ts": 80,
-      "src/renderer/src/store/slices/orca-profiles.test.ts": 89,
-      "src/renderer/src/store/slices/pane-column-split-drop-no-op.test.ts": 8,
-      "src/renderer/src/store/slices/pane-foreground-agent.test.ts": 57,
-      "src/renderer/src/store/slices/persisted-ui-write-baseline.test.ts": 9,
-      "src/renderer/src/store/slices/pinned-tab-close-confirm.test.ts": 9,
-      "src/renderer/src/store/slices/preflight.test.ts": 26,
-      "src/renderer/src/store/slices/project-group-removal-targets.test.ts": 8,
-      "src/renderer/src/store/slices/purge-stale-runtime-host-ownership.test.ts": 50,
-      "src/renderer/src/store/slices/purge-stale-runtime-host-state.test.ts": 137,
-      "src/renderer/src/store/slices/rate-limits.test.ts": 7,
-      "src/renderer/src/store/slices/readopted-ssh-worktree-rows.test.ts": 6,
-      "src/renderer/src/store/slices/recently-closed-tabs.test.ts": 211,
-      "src/renderer/src/store/slices/remote-server-updates.integration.test.ts": 15,
-      "src/renderer/src/store/slices/repo-identity-reconcile.test.ts": 12,
-      "src/renderer/src/store/slices/repo-owner-cache-identity.test.ts": 5,
-      "src/renderer/src/store/slices/repo-reorder-host-split.test.ts": 5,
-      "src/renderer/src/store/slices/repos-add-races.test.ts": 56,
-      "src/renderer/src/store/slices/repos-all-hosts-folder-workspaces.test.ts": 76,
-      "src/renderer/src/store/slices/repos-all-hosts-generation.test.ts": 114,
-      "src/renderer/src/store/slices/repos-all-hosts.test.ts": 148,
-      "src/renderer/src/store/slices/repos-catalog-merge-identity.test.ts": 88,
-      "src/renderer/src/store/slices/repos-cross-host-project-collisions.test.ts": 117,
-      "src/renderer/src/store/slices/repos-cross-host-refresh-identity.test.ts": 91,
-      "src/renderer/src/store/slices/repos-ephemeral-vm-cleanup-retention.test.ts": 32,
-      "src/renderer/src/store/slices/repos-host-identity-routing.test.ts": 191,
-      "src/renderer/src/store/slices/repos-manual-order-hydration.test.ts": 172,
-      "src/renderer/src/store/slices/repos-module-lifetime-coordinators.test.ts": 71,
-      "src/renderer/src/store/slices/repos-nested-import-refresh-failures.test.ts": 57,
-      "src/renderer/src/store/slices/repos-nested-ssh-projection.test.ts": 52,
-      "src/renderer/src/store/slices/repos-onboarding-folder-startup.test.ts": 349,
-      "src/renderer/src/store/slices/repos-paired-runtime-add.test.ts": 46,
-      "src/renderer/src/store/slices/repos-project-group-create-race.test.ts": 101,
-      "src/renderer/src/store/slices/repos-project-groups-delete.test.ts": 86,
-      "src/renderer/src/store/slices/repos-project-groups-owner-routing.test.ts": 73,
-      "src/renderer/src/store/slices/repos-project-groups.test.ts": 200,
-      "src/renderer/src/store/slices/repos-project-host-capability.test.ts": 93,
-      "src/renderer/src/store/slices/repos-project-host-lifecycle.test.ts": 50,
-      "src/renderer/src/store/slices/repos-project-runtime.test.ts": 77,
-      "src/renderer/src/store/slices/repos-refresh-identity.test.ts": 128,
-      "src/renderer/src/store/slices/repos-remove-missing-remote-project.test.ts": 57,
-      "src/renderer/src/store/slices/repos-remove-project-purge-leak.test.ts": 87,
-      "src/renderer/src/store/slices/repos-runtime-project-groups.test.ts": 56,
-      "src/renderer/src/store/slices/repos-runtime-visibility-defaults.test.ts": 43,
-      "src/renderer/src/store/slices/repos-selected-owner-routing.test.ts": 194,
-      "src/renderer/src/store/slices/repos-setup-script-dismissals.test.ts": 52,
-      "src/renderer/src/store/slices/repos-shared-project-badge-color.test.ts": 67,
-      "src/renderer/src/store/slices/repos-ssh-host-reconciliation.test.ts": 80,
-      "src/renderer/src/store/slices/repos-stale-fetch.test.ts": 93,
-      "src/renderer/src/store/slices/repos-update-serialization.test.ts": 52,
-      "src/renderer/src/store/slices/repos.runtime-fallback.test.ts": 73,
-      "src/renderer/src/store/slices/repos.test.ts": 185,
-      "src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts": 106,
-      "src/renderer/src/store/slices/runtime-catalog-merge-removed-env-guard.test.ts": 45,
-      "src/renderer/src/store/slices/runtime-environment-ssh.test.ts": 93,
-      "src/renderer/src/store/slices/runtime-host-purge-session-partition-split.test.ts": 50,
-      "src/renderer/src/store/slices/runtime-pane-title-sort-epoch.test.ts": 189,
-      "src/renderer/src/store/slices/runtime-status-catalog-identity.test.ts": 94,
-      "src/renderer/src/store/slices/runtime-status-first-publication.test.ts": 6,
-      "src/renderer/src/store/slices/runtime-status-refresh-diagnostics.test.ts": 7,
-      "src/renderer/src/store/slices/runtime-status-restored-browser-host-attach.test.ts": 9,
-      "src/renderer/src/store/slices/runtime-status-snapshot.test.ts": 8,
-      "src/renderer/src/store/slices/runtime-status.test.ts": 187,
-      "src/renderer/src/store/slices/runtime-switch-settings-persistence.test.ts": 37,
-      "src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts": 13,
-      "src/renderer/src/store/slices/set-runtime-environments-purge-wiring.test.ts": 46,
-      "src/renderer/src/store/slices/settings-owner-hydration-write-fence.test.ts": 211,
-      "src/renderer/src/store/slices/settings-search-state.test.ts": 8,
-      "src/renderer/src/store/slices/settings.test.ts": 338,
-      "src/renderer/src/store/slices/sparse-presets-repo-removal-purge-leak.test.ts": 78,
-      "src/renderer/src/store/slices/sparse-presets.test.ts": 26,
-      "src/renderer/src/store/slices/ssh.test.ts": 89,
-      "src/renderer/src/store/slices/stale-runtime-host-rows.test.ts": 15,
-      "src/renderer/src/store/slices/store-active-worktree-selection.test.ts": 87,
-      "src/renderer/src/store/slices/store-active-worktree-split-groups.test.ts": 94,
-      "src/renderer/src/store/slices/store-active-worktree-tab-close.test.ts": 159,
-      "src/renderer/src/store/slices/store-active-worktree-terminal-creation.test.ts": 88,
-      "src/renderer/src/store/slices/store-create-tab-id-hint.test.ts": 57,
-      "src/renderer/src/store/slices/store-session-browser-hydration.test.ts": 117,
-      "src/renderer/src/store/slices/store-session-cascades.test.ts": 86,
-      "src/renderer/src/store/slices/store-session-editor-hydration.test.ts": 111,
-      "src/renderer/src/store/slices/store-session-terminal-activity.test.ts": 169,
-      "src/renderer/src/store/slices/store-session-terminal-reconnect.test.ts": 78,
-      "src/renderer/src/store/slices/store-session-workspace-hydration.test.ts": 84,
-      "src/renderer/src/store/slices/store-sleep-agent-status-retention.test.ts": 122,
-      "src/renderer/src/store/slices/store-sleep-exact-runtime-stop.test.ts": 147,
-      "src/renderer/src/store/slices/store-sleep-pane-hibernation.test.ts": 96,
-      "src/renderer/src/store/slices/store-sleep-runtime-convergence.test.ts": 448,
-      "src/renderer/src/store/slices/store-sleep-shutdown-order.test.ts": 49,
-      "src/renderer/src/store/slices/store-worktree-removal-cascade.test.ts": 141,
-      "src/renderer/src/store/slices/superseded-ssh-repo-rows.test.ts": 7,
-      "src/renderer/src/store/slices/tab-group-reference-repair.test.ts": 15,
-      "src/renderer/src/store/slices/tab-group-state.test.ts": 19,
-      "src/renderer/src/store/slices/tab-view-mode.test.ts": 86,
-      "src/renderer/src/store/slices/tab-worktree-orphan-map-purge-leak.test.ts": 27,
-      "src/renderer/src/store/slices/tabs-empty-split-activation.test.ts": 29,
-      "src/renderer/src/store/slices/tabs-hydration-generated-title.test.ts": 12,
-      "src/renderer/src/store/slices/tabs-hydration-group-validation.test.ts": 15,
-      "src/renderer/src/store/slices/tabs-hydration.test.ts": 12,
-      "src/renderer/src/store/slices/tabs-label-and-pin-state.test.ts": 68,
-      "src/renderer/src/store/slices/tabs-model-reconciliation.test.ts": 83,
-      "src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts": 185,
-      "src/renderer/src/store/slices/tabs-pane-layout-operations.test.ts": 88,
-      "src/renderer/src/store/slices/tabs-session-hydration.test.ts": 67,
-      "src/renderer/src/store/slices/tabs-unread-and-focus.test.ts": 71,
-      "src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts": 423,
-      "src/renderer/src/store/slices/tabs/tab-selection-contract.test.ts": 12,
-      "src/renderer/src/store/slices/tabs/tabs-reconciliation-batch-identity.test.ts": 49,
-      "src/renderer/src/store/slices/task-creation-drafts.test.ts": 6,
-      "src/renderer/src/store/slices/terminal-helpers.test.ts": 11,
-      "src/renderer/src/store/slices/terminal-input-activity-store-write.test.ts": 51,
-      "src/renderer/src/store/slices/terminal-layout-pty-ownership.test.ts": 63,
-      "src/renderer/src/store/slices/terminal-orphan-helpers.test.ts": 8,
-      "src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts": 33,
-      "src/renderer/src/store/slices/terminal-pane-detach-agent-retention.test.ts": 92,
-      "src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts": 36,
-      "src/renderer/src/store/slices/terminal-quick-command-hosts.test.ts": 132,
-      "src/renderer/src/store/slices/terminal-startup-command-retention.test.ts": 80,
-      "src/renderer/src/store/slices/terminal-tab-id-hydration.test.ts": 38,
-      "src/renderer/src/store/slices/terminal-tab-owner-index.test.ts": 6,
-      "src/renderer/src/store/slices/terminal-tab-recovery-remount.test.ts": 151,
-      "src/renderer/src/store/slices/terminal-tab-retirement-store.test.ts": 172,
-      "src/renderer/src/store/slices/terminal-tab-retirement.test.ts": 15,
-      "src/renderer/src/store/slices/terminal-tab-title-batch.test.ts": 147,
-      "src/renderer/src/store/slices/terminal-write-identity-bailouts.test.ts": 85,
-      "src/renderer/src/store/slices/terminals-explicit-empty-hydration.test.ts": 61,
-      "src/renderer/src/store/slices/terminals-hydration-canonical-pty-overlap.test.ts": 87,
-      "src/renderer/src/store/slices/terminals-hydration-canonical-rows.test.ts": 76,
-      "src/renderer/src/store/slices/terminals-hydration.test.ts": 145,
-      "src/renderer/src/store/slices/ui-acknowledge-agents-clock-skew.test.ts": 17,
-      "src/renderer/src/store/slices/ui-agent-send-target.test.ts": 58,
-      "src/renderer/src/store/slices/ui-contextual-tours.test.ts": 51,
-      "src/renderer/src/store/slices/ui-feature-interactions.test.ts": 31,
-      "src/renderer/src/store/slices/ui-hydration-view-layout.test.ts": 46,
-      "src/renderer/src/store/slices/ui-hydration-workspace-cleanup-browse.test.ts": 11,
-      "src/renderer/src/store/slices/ui-hydration-workspace-preferences.test.ts": 45,
-      "src/renderer/src/store/slices/ui-modal-slot-dismissal.test.ts": 184,
-      "src/renderer/src/store/slices/ui-new-workspace-draft.test.ts": 8,
-      "src/renderer/src/store/slices/ui-notice-dismissals.test.ts": 52,
-      "src/renderer/src/store/slices/ui-page-navigation.test.ts": 51,
-      "src/renderer/src/store/slices/usage-snapshot-refresh.benchmark.test.ts": 6,
-      "src/renderer/src/store/slices/usage-web-client-fallback.test.ts": 12,
-      "src/renderer/src/store/slices/workspace-cleanup-browse.test.ts": 21,
-      "src/renderer/src/store/slices/workspace-cleanup-cache-hydration.test.ts": 174,
-      "src/renderer/src/store/slices/workspace-cleanup-enrichment-performance.test.ts": 285,
-      "src/renderer/src/store/slices/workspace-cleanup-host-qualified-list-state.test.ts": 71,
-      "src/renderer/src/store/slices/workspace-cleanup-local-evidence-invariants.test.ts": 7,
-      "src/renderer/src/store/slices/workspace-cleanup-removal-preflight.test.ts": 62,
-      "src/renderer/src/store/slices/workspace-cleanup-scan-progress-boundary.test.ts": 5,
-      "src/renderer/src/store/slices/workspace-cleanup-scan-progress.test.ts": 584,
-      "src/renderer/src/store/slices/workspace-cleanup-unverified-removal-consent.test.ts": 44,
-      "src/renderer/src/store/slices/workspace-cleanup-wrong-host-removal-guard.test.ts": 99,
-      "src/renderer/src/store/slices/workspace-cleanup-wrong-host-removal.test.ts": 143,
-      "src/renderer/src/store/slices/workspace-document-title-refresh.test.ts": 48,
-      "src/renderer/src/store/slices/workspace-space.test.ts": 11,
-      "src/renderer/src/store/slices/worktree-by-id-index.test.ts": 6,
-      "src/renderer/src/store/slices/worktree-catalog-reconciliation.test.ts": 12,
-      "src/renderer/src/store/slices/worktree-helpers.test.ts": 6,
-      "src/renderer/src/store/slices/worktree-listing-branch-switch.test.ts": 11,
-      "src/renderer/src/store/slices/worktree-meta-update-application.test.ts": 8,
-      "src/renderer/src/store/slices/worktree-nav-history-view-entries.test.ts": 21,
-      "src/renderer/src/store/slices/worktree-nav-history.test.ts": 12,
-      "src/renderer/src/store/slices/worktree-removal-maps-leak.test.ts": 91,
-      "src/renderer/src/store/slices/worktree-sleep-intent-lifecycle.test.ts": 78,
-      "src/renderer/src/store/slices/worktree-terminal-removal-teardown.test.ts": 79,
-      "src/renderer/src/store/slices/worktree-visibility-owner-settings.test.ts": 14,
-      "src/renderer/src/store/slices/worktree-visibility-settings-write.test.ts": 32,
-      "src/renderer/src/store/slices/worktrees-activity-persistence.test.ts": 66,
-      "src/renderer/src/store/slices/worktrees-create-base-status.test.ts": 33,
-      "src/renderer/src/store/slices/worktrees-create-parent-pick.test.ts": 27,
-      "src/renderer/src/store/slices/worktrees-fetch-listing-merge.test.ts": 42,
-      "src/renderer/src/store/slices/worktrees-fetch-owner-routing.test.ts": 173,
-      "src/renderer/src/store/slices/worktrees-fetch-persisted-metadata-fallback.test.ts": 25,
-      "src/renderer/src/store/slices/worktrees-fetch-refresh-coalescing.test.ts": 40,
-      "src/renderer/src/store/slices/worktrees-fetch-remote-lineage.test.ts": 25,
-      "src/renderer/src/store/slices/worktrees-fetch-removal-purge.test.ts": 87,
-      "src/renderer/src/store/slices/worktrees-git-identity-branch-title.test.ts": 17,
-      "src/renderer/src/store/slices/worktrees-git-identity-review-clear-persistence.test.ts": 488,
-      "src/renderer/src/store/slices/worktrees-hydration-purge.test.ts": 59,
-      "src/renderer/src/store/slices/worktrees-identity-migration.test.ts": 292,
-      "src/renderer/src/store/slices/worktrees-lineage-state.test.ts": 41,
-      "src/renderer/src/store/slices/worktrees-linked-review-push-target.test.ts": 69,
-      "src/renderer/src/store/slices/worktrees-metadata-persistence.test.ts": 43,
-      "src/renderer/src/store/slices/worktrees-pending-creation-state.test.ts": 70,
-      "src/renderer/src/store/slices/worktrees-purge-terminal-state.test.ts": 11,
-      "src/renderer/src/store/slices/worktrees-remote-runtime-create.test.ts": 35,
-      "src/renderer/src/store/slices/worktrees-remote-runtime-removal.test.ts": 49,
-      "src/renderer/src/store/slices/worktrees-removal-state-cleanup.test.ts": 60,
-      "src/renderer/src/store/slices/worktrees-runtime-connection-generation-fence.test.ts": 81,
-      "src/renderer/src/store/slices/worktrees-runtime-host-metadata-retirement.test.ts": 25,
-      "src/renderer/src/store/slices/worktrees-terminal-pr-url-linking.test.ts": 15,
-      "src/renderer/src/store/slices/worktrees-unread-state.test.ts": 19,
-      "src/renderer/src/store/slices/worktrees-workspace-selection-state.test.ts": 27,
-      "src/renderer/src/store/slices/worktrees/listing/detected-worktree-meta.test.ts": 8,
-      "src/renderer/src/store/slices/worktrees/listing/detected-worktree-unavailable-reason.test.ts": 7,
-      "src/renderer/src/store/slices/worktrees/metadata/worktree-meta-persist.test.ts": 14,
-      "src/renderer/src/store/slices/worktrees/teardown/host-qualified-removal-refusal.test.ts": 6,
-      "src/renderer/src/store/slices/worktrees/teardown/record-key-omission.test.ts": 7,
-      "src/renderer/src/store/slices/worktrees/teardown/remove-worktree-map-identity.test.ts": 9,
-      "src/renderer/src/store/slices/worktrees/teardown/worktree-teardown-array-identity.test.ts": 9,
-      "src/renderer/src/store/store-identity-churn-probe.test.ts": 19,
-      "src/renderer/src/store/store-listener-census.test.ts": 7,
-      "src/renderer/src/store/terminals/restored-relay-session-identity.test.ts": 88,
-      "src/renderer/src/store/terminals/structured-chat-tab-rename.test.ts": 68,
-      "src/renderer/src/store/terminals/terminal-pane-expansion-write-bailout.test.tsx": 113,
-      "src/renderer/src/store/terminals/terminal-shutdown-guards-identity.test.ts": 5,
-      "src/renderer/src/store/terminals/terminal-shutdown-map-identity.test.ts": 7,
-      "src/renderer/src/store/terminals/terminal-tab-close-map-identity.test.ts": 68,
-      "src/renderer/src/store/terminals/terminal-tab-close-tombstone.test.ts": 86,
-      "src/renderer/src/store/terminals/terminal-workspace-routing.scale.test.ts": 9,
-      "src/renderer/src/store/terminals/workspace-terminal-placeholders.test.ts": 10,
-      "src/renderer/src/store/worktree-diff-comments-selector.test.ts": 53,
-      "src/renderer/src/store/worktree-host-collision-index.test.ts": 7,
-      "src/renderer/src/store/worktree-visibility-defaults-by-host.test.ts": 5,
-      "src/renderer/src/web/preload-api/web-gitlab-api.test.ts": 23,
-      "src/renderer/src/web/web-clipboard-copy-fallback.test.ts": 12,
-      "src/renderer/src/web/web-clipboard-copy-terminal-selection.test.ts": 12,
-      "src/renderer/src/web/web-file-mutation-methods.test.ts": 14,
-      "src/renderer/src/web/web-pairing.test.ts": 11,
-      "src/renderer/src/web/web-preload-api-agent-providers.test.ts": 341,
-      "src/renderer/src/web/web-preload-api-clipboard.test.ts": 1137,
-      "src/renderer/src/web/web-preload-api-composition.test.ts": 443,
-      "src/renderer/src/web/web-preload-api-filesystem.test.ts": 413,
-      "src/renderer/src/web/web-preload-api-git.test.ts": 391,
-      "src/renderer/src/web/web-preload-api-github.test.ts": 312,
-      "src/renderer/src/web/web-preload-api-gitlab.test.ts": 596,
-      "src/renderer/src/web/web-preload-api-keybindings.test.ts": 444,
-      "src/renderer/src/web/web-preload-api-runtime-calls.test.ts": 755,
-      "src/renderer/src/web/web-preload-api-runtime-environment.test.ts": 1195,
-      "src/renderer/src/web/web-preload-api-settings.test.ts": 1562,
-      "src/renderer/src/web/web-preload-api-ssh.test.ts": 640,
-      "src/renderer/src/web/web-preload-api-ui.test.ts": 901,
-      "src/renderer/src/web/web-preload-api-workspace-catalog.test.ts": 903,
-      "src/renderer/src/web/web-preload-updater-package-recovery.test.ts": 370,
-      "src/renderer/src/web/web-runtime-client-export-parity.test.ts": 6,
-      "src/renderer/src/web/web-runtime-client-file-watch-replay.test.ts": 64,
-      "src/renderer/src/web/web-runtime-client-heartbeat.test.ts": 42,
-      "src/renderer/src/web/web-runtime-client-timeout-budget.test.ts": 45,
-      "src/renderer/src/web/web-runtime-client.test.ts": 351,
-      "src/renderer/src/web/web-runtime-connection-frame-router.test.ts": 6,
-      "src/renderer/src/web/web-runtime-connection-heartbeat-unsendable-probe.test.ts": 55,
-      "src/renderer/src/web/web-runtime-status-owner.test.ts": 651,
-      "src/renderer/src/web/web-viewport-shell.test.ts": 8,
-      "src/renderer/src/web/web-workspace-session.test.ts": 8,
-      "src/shared/add-repo-existing-workspaces-telemetry.test.ts": 9,
-      "src/shared/agent-cli-flag-detection.test.ts": 7,
-      "src/shared/agent-cli-install-dir-fallback.test.ts": 26,
-      "src/shared/agent-decorative-title-signature.test.ts": 11,
-      "src/shared/agent-detection.test.ts": 57,
-      "src/shared/agent-feature-install-commands.test.ts": 13,
-      "src/shared/agent-hook-endpoint-file.test.ts": 5,
-      "src/shared/agent-hook-endpoint-temp-cleanup.test.ts": 14,
-      "src/shared/agent-hook-listener-antigravity.test.ts": 17,
-      "src/shared/agent-hook-listener-claude-compatible-vendors.test.ts": 20,
-      "src/shared/agent-hook-listener-claude-subagents.test.ts": 21,
-      "src/shared/agent-hook-listener-claude-turn-state.test.ts": 19,
-      "src/shared/agent-hook-listener-command-code-transcript.test.ts": 114,
-      "src/shared/agent-hook-listener-extraction-characterization.test.ts": 23,
-      "src/shared/agent-hook-listener-grok.test.ts": 32,
-      "src/shared/agent-hook-listener-hermes-codex-droid.test.ts": 13,
-      "src/shared/agent-hook-listener-interactive-prompts.test.ts": 17,
-      "src/shared/agent-hook-listener-pi-compatible.test.ts": 15,
-      "src/shared/agent-hook-listener-relay-dependency.test.ts": 22,
-      "src/shared/agent-hook-listener-roster-retention.test.ts": 54,
-      "src/shared/agent-hook-listener-session-replacement.test.ts": 15,
-      "src/shared/agent-hook-listener-startless-child-lifecycle.test.ts": 22,
-      "src/shared/agent-hook-listener-transport.test.ts": 49,
-      "src/shared/agent-hook-listener/transcript-reader.test.ts": 93,
-      "src/shared/agent-hook-relay.test.ts": 9,
-      "src/shared/agent-hook-request-body-memory.test.ts": 53,
-      "src/shared/agent-hook-spool-read.test.ts": 9,
-      "src/shared/agent-hook-status-cache.test.ts": 5,
-      "src/shared/agent-hook-transport-interference.test.ts": 9,
-      "src/shared/agent-kind.test.ts": 9,
-      "src/shared/agent-launch-remote.test.ts": 7,
-      "src/shared/agent-model-probe-spec.test.ts": 9,
-      "src/shared/agent-notification-id.test.ts": 8,
-      "src/shared/agent-process-recognition.test.ts": 20,
-      "src/shared/agent-prompt-injection.test.ts": 7,
-      "src/shared/agent-resume-argv-drop.test.ts": 11,
-      "src/shared/agent-resume-launch-command.test.ts": 63,
-      "src/shared/agent-row-conversation-name.test.ts": 10,
-      "src/shared/agent-scratch-worktrees.test.ts": 7,
-      "src/shared/agent-session-conversation-name.test.ts": 9,
-      "src/shared/agent-session-definitive-refusal.test.ts": 11,
-      "src/shared/agent-session-journal-schemas.test.ts": 35,
-      "src/shared/agent-session-lease-adjudication.test.ts": 16,
-      "src/shared/agent-session-mutation-envelope.test.ts": 10,
-      "src/shared/agent-session-operation-ledger.test.ts": 9,
-      "src/shared/agent-session-option-catalog-grok.test.ts": 12,
-      "src/shared/agent-session-option-catalog.test.ts": 10,
-      "src/shared/agent-session-provider-handle.test.ts": 21,
-      "src/shared/agent-session-pty-write-admission.test.ts": 8,
-      "src/shared/agent-session-question-answer.test.ts": 9,
-      "src/shared/agent-session-resume.test.ts": 9,
-      "src/shared/agent-session-turn-record.test.ts": 9,
-      "src/shared/agent-skill-sharing-contract.test.ts": 9,
-      "src/shared/agent-skill-sharing-gate.test.ts": 6,
-      "src/shared/agent-status-observation.test.ts": 13,
-      "src/shared/agent-status-osc-pending-retention.test.ts": 73,
-      "src/shared/agent-status-osc-scan-budget.test.ts": 195,
-      "src/shared/agent-status-osc-split-frame-scan-budget.test.ts": 96,
-      "src/shared/agent-status-osc.test.ts": 16,
-      "src/shared/agent-status-types.test.ts": 29,
-      "src/shared/agent-tab-title.test.ts": 14,
-      "src/shared/agent-terminal-status-equivalence.test.ts": 4,
-      "src/shared/agent-title-agy-gemini-collision.test.ts": 23,
-      "src/shared/agent-title-decoration.test.ts": 9,
-      "src/shared/agent-title-evidence.test.ts": 43,
-      "src/shared/agent-title-identity-characterization.test.ts": 11,
-      "src/shared/agent-tui-input-clear.test.ts": 13,
-      "src/shared/ai-vault-resume-command.test.ts": 7,
-      "src/shared/ai-vault-resume-preparation.test.ts": 5,
-      "src/shared/ai-vault-scan-error-message.test.ts": 14,
-      "src/shared/ai-vault-search-query-operators.test.ts": 10,
-      "src/shared/ai-vault-session-depth.test.ts": 17,
+      "src/renderer/src/components/right-sidebar/source-control-create-pr-intent-flow.test.ts": 72,
+      "src/renderer/src/components/right-sidebar/source-control-create-pr-intent-state.test.ts": 38,
+      "src/renderer/src/components/right-sidebar/source-control-create-review-blocked-action.test.ts": 115,
+      "src/renderer/src/components/right-sidebar/source-control-created-review-link.test.ts": 50,
+      "src/renderer/src/components/right-sidebar/source-control-discard-confirmation.test.ts": 109,
+      "src/renderer/src/components/right-sidebar/source-control-discard-dialog.test.tsx": 321,
+      "src/renderer/src/components/right-sidebar/source-control-dropdown-items.create-pr-intent.test.ts": 135,
+      "src/renderer/src/components/right-sidebar/source-control-dropdown-items.test.ts": 222,
+      "src/renderer/src/components/right-sidebar/source-control-entry-actions.test.ts": 27,
+      "src/renderer/src/components/right-sidebar/source-control-entry-context-menu.test.tsx": 179,
+      "src/renderer/src/components/right-sidebar/source-control-file-filter.test.ts": 53,
+      "src/renderer/src/components/right-sidebar/source-control-header-toolbar-identity.test.tsx": 602,
+      "src/renderer/src/components/right-sidebar/source-control-header-toolbar.test.ts": 416,
+      "src/renderer/src/components/right-sidebar/source-control-hosted-review-creation-eligibility-snapshot.test.ts": 99,
+      "src/renderer/src/components/right-sidebar/source-control-hosted-review-push-target.test.ts": 35,
+      "src/renderer/src/components/right-sidebar/source-control-huge-repo-warning-dismissals.test.ts": 153,
+      "src/renderer/src/components/right-sidebar/source-control-launch-agent-args-applicability.test.ts": 195,
+      "src/renderer/src/components/right-sidebar/source-control-manual-review-url.test.ts": 56,
+      "src/renderer/src/components/right-sidebar/source-control-primary-action-tooltip.test.ts": 224,
+      "src/renderer/src/components/right-sidebar/source-control-primary-action.create-pr-intent.test.ts": 97,
+      "src/renderer/src/components/right-sidebar/source-control-primary-action.test.ts": 172,
+      "src/renderer/src/components/right-sidebar/source-control-push-recovery.test.ts": 37,
+      "src/renderer/src/components/right-sidebar/source-control-section-order.test.ts": 44,
+      "src/renderer/src/components/right-sidebar/source-control-split-open.test.ts": 50,
+      "src/renderer/src/components/right-sidebar/source-control-status-sort.test.ts": 83,
+      "src/renderer/src/components/right-sidebar/source-control-submodule-expansion.test.ts": 62,
+      "src/renderer/src/components/right-sidebar/source-control-text-generation-defaults.test.ts": 153,
+      "src/renderer/src/components/right-sidebar/source-control-too-many-changes-banner.test.tsx": 2910,
+      "src/renderer/src/components/right-sidebar/source-control-tree.test.ts": 73,
+      "src/renderer/src/components/right-sidebar/source-control/commit/discard-all-failure-description.test.tsx": 1290,
+      "src/renderer/src/components/right-sidebar/source-control/commit/source-control-entry-failure-toast.test.ts": 238,
+      "src/renderer/src/components/right-sidebar/source-control/commit/source-control-entry-mutation-failures.test.tsx": 513,
+      "src/renderer/src/components/right-sidebar/source-control/listing/section-action-buttons.test.tsx": 1796,
+      "src/renderer/src/components/right-sidebar/source-control/listing/section-header.test.tsx": 559,
+      "src/renderer/src/components/right-sidebar/source-control/listing/use-file-projection-work.test.tsx": 766,
+      "src/renderer/src/components/right-sidebar/source-control/listing/use-store-actions.store-subscriptions.test.tsx": 1386,
+      "src/renderer/src/components/right-sidebar/source-control/notes/use-diff-comment-notes.test.tsx": 351,
+      "src/renderer/src/components/right-sidebar/source-control/review/suppressed-github-pr.test.ts": 35,
+      "src/renderer/src/components/right-sidebar/source-control/review/use-action-model.test.tsx": 369,
+      "src/renderer/src/components/right-sidebar/source-control/review/use-hosted-review-state.test.tsx": 657,
+      "src/renderer/src/components/right-sidebar/status-display.test.ts": 38,
+      "src/renderer/src/components/right-sidebar/use-ai-vault-search-focus-request.test.tsx": 1291,
+      "src/renderer/src/components/right-sidebar/use-ai-vault-search.test.tsx": 737,
+      "src/renderer/src/components/right-sidebar/use-checks-panel-terminal-worktree.test.ts": 1386,
+      "src/renderer/src/components/right-sidebar/use-file-explorer-name-filter.runtime-listing.test.tsx": 1514,
+      "src/renderer/src/components/right-sidebar/use-file-explorer-name-filter.test.ts": 1249,
+      "src/renderer/src/components/right-sidebar/use-git-status-upstream-ref-watch.test.ts": 63,
+      "src/renderer/src/components/right-sidebar/use-hosted-review-actions.test.tsx": 546,
+      "src/renderer/src/components/right-sidebar/use-installed-plugin-route-reconciliation.test.tsx": 487,
+      "src/renderer/src/components/right-sidebar/use-persisted-ai-vault-view-options.test.tsx": 625,
+      "src/renderer/src/components/right-sidebar/use-plugin-panel-theme-revision.test.tsx": 526,
+      "src/renderer/src/components/right-sidebar/use-source-control-ai.test.ts": 1472,
+      "src/renderer/src/components/right-sidebar/use-source-control-branch-compare.test.tsx": 790,
+      "src/renderer/src/components/right-sidebar/use-source-control-git-history.test.tsx": 608,
+      "src/renderer/src/components/right-sidebar/useCreatePullRequestDialogFields.repo-default.test.ts": 2037,
+      "src/renderer/src/components/right-sidebar/useCreatePullRequestDialogFields.test.ts": 1565,
+      "src/renderer/src/components/right-sidebar/useFileExplorerDragDrop.test.ts": 58,
+      "src/renderer/src/components/right-sidebar/useFileExplorerHandlers.test.ts": 1455,
+      "src/renderer/src/components/right-sidebar/useFileExplorerKeys.test.ts": 1591,
+      "src/renderer/src/components/right-sidebar/useFileExplorerRowDrag.test.ts": 52,
+      "src/renderer/src/components/right-sidebar/useFileExplorerTree.refresh-projection-churn.test.tsx": 2884,
+      "src/renderer/src/components/right-sidebar/useFileExplorerTree.stale-dirs.test.tsx": 2223,
+      "src/renderer/src/components/right-sidebar/useFileExplorerVisibleRowProjection.debounce.test.tsx": 2363,
+      "src/renderer/src/components/right-sidebar/useFileExplorerVisibleRowProjection.test.ts": 1640,
+      "src/renderer/src/components/right-sidebar/useFileExplorerWatch.pending-refresh.test.tsx": 745,
+      "src/renderer/src/components/right-sidebar/useFileExplorerWatch.test.ts": 2024,
+      "src/renderer/src/components/right-sidebar/useFileSearchRunner.test.tsx": 594,
+      "src/renderer/src/components/right-sidebar/useGitStatusPolling.rerender.test.ts": 2104,
+      "src/renderer/src/components/right-sidebar/useGitStatusPolling.test.ts": 1852,
+      "src/renderer/src/components/right-sidebar/useHostedReviewStackParent.test.tsx": 650,
+      "src/renderer/src/components/right-sidebar/useSourceControlSelection.test.ts": 64,
+      "src/renderer/src/components/right-sidebar/useSourceControlSubmoduleStatus.test.tsx": 558,
+      "src/renderer/src/components/settings/AccountsPane.test.tsx": 2350,
+      "src/renderer/src/components/settings/AdvancedNetworkSettingsSection.interaction.test.tsx": 2044,
+      "src/renderer/src/components/settings/AdvancedNetworkSettingsSection.test.ts": 1623,
+      "src/renderer/src/components/settings/AdvancedPane.test.tsx": 427,
+      "src/renderer/src/components/settings/AgentSkillSetupPanel.freshness.test.tsx": 2107,
+      "src/renderer/src/components/settings/AgentSkillSetupPanel.test.tsx": 2692,
+      "src/renderer/src/components/settings/AgentsPane.test.tsx": 2430,
+      "src/renderer/src/components/settings/AppearancePane.test.tsx": 2232,
+      "src/renderer/src/components/settings/ArtifactsSettingsPane.test.tsx": 1005,
+      "src/renderer/src/components/settings/AutomationsSettingsPane.test.tsx": 903,
+      "src/renderer/src/components/settings/BranchPrefixFeedback.test.tsx": 155,
+      "src/renderer/src/components/settings/BrowserClientHostedRemoteSetting.test.tsx": 1136,
+      "src/renderer/src/components/settings/BrowserPane.search-catalog.test.tsx": 710,
+      "src/renderer/src/components/settings/BrowserPane.test.ts": 54,
+      "src/renderer/src/components/settings/BrowserSshWorkspaceRoutingSetting.test.tsx": 801,
+      "src/renderer/src/components/settings/BrowserUseSkillStep.test.tsx": 178,
+      "src/renderer/src/components/settings/BrowserUserAgentSetting.test.tsx": 1325,
+      "src/renderer/src/components/settings/CliSection.install-failure.test.tsx": 2294,
+      "src/renderer/src/components/settings/CliSection.test.tsx": 2339,
+      "src/renderer/src/components/settings/CliSkillRuntimeSetup.test.tsx": 977,
+      "src/renderer/src/components/settings/CloudVmSetupGuide.test.tsx": 1314,
+      "src/renderer/src/components/settings/CodexLoginLinkNotice.test.tsx": 764,
+      "src/renderer/src/components/settings/CommitMessageAiPane.test.tsx": 1754,
+      "src/renderer/src/components/settings/DefaultWindowsProjectRuntimeSetting.test.tsx": 658,
+      "src/renderer/src/components/settings/DeveloperPermissionsPane.test.tsx": 1844,
+      "src/renderer/src/components/settings/DiffShowWhitespaceSetting.test.tsx": 1090,
+      "src/renderer/src/components/settings/EditorWordWrapSetting.test.tsx": 1118,
+      "src/renderer/src/components/settings/EphemeralVmRuntimesSection.test.tsx": 1144,
+      "src/renderer/src/components/settings/EphemeralVmsPane.test.tsx": 4524,
+      "src/renderer/src/components/settings/ExperimentalPane.test.tsx": 2064,
+      "src/renderer/src/components/settings/FloatingWorkspacePane.test.tsx": 1671,
+      "src/renderer/src/components/settings/GeneralPane.test.ts": 3742,
+      "src/renderer/src/components/settings/GeneralRemoteServerUpdates.test.tsx": 832,
+      "src/renderer/src/components/settings/GeneralUpdateSettingsSection.test.tsx": 1415,
+      "src/renderer/src/components/settings/GeneralWorkspaceSettingsSection.test.tsx": 1460,
+      "src/renderer/src/components/settings/GhosttyImportModal.test.ts": 268,
+      "src/renderer/src/components/settings/GitPane.test.ts": 1095,
+      "src/renderer/src/components/settings/GitPane.test.tsx": 1415,
+      "src/renderer/src/components/settings/GrokAccountsSection.test.tsx": 954,
+      "src/renderer/src/components/settings/HiddenExperimentalGroup.test.tsx": 513,
+      "src/renderer/src/components/settings/KagiSessionLinkForm.test.ts": 1135,
+      "src/renderer/src/components/settings/LinearAgentSkillGuide.test.tsx": 374,
+      "src/renderer/src/components/settings/LinearAgentSkillNotes.test.tsx": 163,
+      "src/renderer/src/components/settings/LinearAgentSkillPane.test.tsx": 1432,
+      "src/renderer/src/components/settings/LocalNetworkConnectionTest.test.tsx": 585,
+      "src/renderer/src/components/settings/MachineNameField.test.tsx": 561,
+      "src/renderer/src/components/settings/MobileEmulatorAgentControlRow.test.tsx": 1349,
+      "src/renderer/src/components/settings/MobilePairingConnectionOptions.test.tsx": 1228,
+      "src/renderer/src/components/settings/MobilePairingQrSection.test.tsx": 574,
+      "src/renderer/src/components/settings/MobilePairingSetupSection.test.tsx": 1897,
+      "src/renderer/src/components/settings/MobilePane.test.tsx": 1448,
+      "src/renderer/src/components/settings/MobilePaneAddressSearch.test.tsx": 1173,
+      "src/renderer/src/components/settings/NativeChatExperimentalSetting.test.tsx": 2849,
+      "src/renderer/src/components/settings/NativeChatSupportedAgents.test.tsx": 965,
+      "src/renderer/src/components/settings/NotificationsPane.test.tsx": 1611,
+      "src/renderer/src/components/settings/OpenInMenuSetting.test.ts": 483,
+      "src/renderer/src/components/settings/OrcaAccountSettingsPane.test.tsx": 660,
+      "src/renderer/src/components/settings/OrchestrationPane.test.tsx": 2500,
+      "src/renderer/src/components/settings/OrchestrationSkillAgentCoverage.test.tsx": 142,
+      "src/renderer/src/components/settings/PluginConsentDialog.test.tsx": 1603,
+      "src/renderer/src/components/settings/PluginInstallDialog.test.tsx": 1086,
+      "src/renderer/src/components/settings/PluginKeybindingConsentPreview.test.ts": 880,
+      "src/renderer/src/components/settings/PluginMarketplaceBrowser.test.tsx": 857,
+      "src/renderer/src/components/settings/PluginMarketplaceSourceDialog.test.tsx": 587,
+      "src/renderer/src/components/settings/PluginSettingsRow.test.tsx": 1082,
+      "src/renderer/src/components/settings/PluginsSettingsSection.lifecycle.test.tsx": 1906,
+      "src/renderer/src/components/settings/PrivacyPane.test.ts": 1541,
+      "src/renderer/src/components/settings/ProjectWindowsRuntimeSetting.test.tsx": 1249,
+      "src/renderer/src/components/settings/QuickCommandsList.test.tsx": 1098,
+      "src/renderer/src/components/settings/QuickCommandsPane.test.ts": 1711,
+      "src/renderer/src/components/settings/RemoteServerUpdateDialog.test.tsx": 935,
+      "src/renderer/src/components/settings/RepositoryForkSyncSection.test.tsx": 866,
+      "src/renderer/src/components/settings/RepositoryGitHubAccountSection.test.tsx": 989,
+      "src/renderer/src/components/settings/RepositoryHooksSection.test.ts": 838,
+      "src/renderer/src/components/settings/RepositoryHostSetupsSection.test.tsx": 2695,
+      "src/renderer/src/components/settings/RepositoryHostSetupsSection.workspace-window.test.tsx": 2705,
+      "src/renderer/src/components/settings/RepositoryIconEmojiPicker.test.tsx": 555,
+      "src/renderer/src/components/settings/RepositoryIconPicker.github-avatar-refresh.test.tsx": 1099,
+      "src/renderer/src/components/settings/RepositoryPane.test.ts": 3138,
+      "src/renderer/src/components/settings/RepositoryPaneDraftInput.test.tsx": 450,
+      "src/renderer/src/components/settings/RepositorySourceControlAiSection.test.ts": 593,
+      "src/renderer/src/components/settings/RepositoryWorktreeDefaultsSection.test.tsx": 532,
+      "src/renderer/src/components/settings/RuntimeEnvironmentsPane.test.ts": 1724,
+      "src/renderer/src/components/settings/RuntimeHostAccessForm.test.tsx": 589,
+      "src/renderer/src/components/settings/RuntimePairingGeneratorForm.test.tsx": 434,
+      "src/renderer/src/components/settings/RuntimePairingUrlGenerator.test.tsx": 935,
+      "src/renderer/src/components/settings/SessionHistoryComputerRow.test.tsx": 1157,
+      "src/renderer/src/components/settings/SessionHistorySettingsPane.test.tsx": 2196,
+      "src/renderer/src/components/settings/Settings.load-performance.test.ts": 36,
+      "src/renderer/src/components/settings/SettingsConstants.test.ts": 179,
+      "src/renderer/src/components/settings/SettingsFormControls.font-autocomplete.test.tsx": 1401,
+      "src/renderer/src/components/settings/SettingsFormControls.number-field.test.tsx": 816,
+      "src/renderer/src/components/settings/SettingsFormControls.segmented-control.test.tsx": 904,
+      "src/renderer/src/components/settings/SettingsSidebar.test.tsx": 2031,
+      "src/renderer/src/components/settings/ShareSkillsSettingsPane.test.tsx": 791,
+      "src/renderer/src/components/settings/ShortcutCommandBlock.test.tsx": 1722,
+      "src/renderer/src/components/settings/ShortcutFilterRail.test.ts": 463,
+      "src/renderer/src/components/settings/SourceControlActionRepoOverrideNote.test.tsx": 1006,
+      "src/renderer/src/components/settings/SparsePresetSettingsSection.test.tsx": 577,
+      "src/renderer/src/components/settings/SshTargetCard.test.tsx": 776,
+      "src/renderer/src/components/settings/SshTargetForm.test.tsx": 1083,
+      "src/renderer/src/components/settings/TaskSourceLinearSetup.test.tsx": 1195,
+      "src/renderer/src/components/settings/TaskSourceProviderCard.test.tsx": 592,
+      "src/renderer/src/components/settings/TaskSourceShowInTasksStep.test.tsx": 359,
+      "src/renderer/src/components/settings/TaskSourceSimpleSetup.test.tsx": 960,
+      "src/renderer/src/components/settings/TasksPane.test.tsx": 1403,
+      "src/renderer/src/components/settings/TerminalAdvancedSection.test.tsx": 1646,
+      "src/renderer/src/components/settings/TerminalAppearanceSection.ghostty.test.ts": 398,
+      "src/renderer/src/components/settings/TerminalContrastSetting.test.tsx": 1310,
+      "src/renderer/src/components/settings/TerminalFontSizeSetting.test.tsx": 1537,
+      "src/renderer/src/components/settings/TerminalPane.pwsh.test.ts": 765,
+      "src/renderer/src/components/settings/TerminalSettingsPreview.lifecycle.test.tsx": 664,
+      "src/renderer/src/components/settings/TerminalTccAttributionNotice.test.tsx": 885,
+      "src/renderer/src/components/settings/TerminalThemeSections.lifecycle.test.ts": 1380,
+      "src/renderer/src/components/settings/VoiceMicrophoneSetting.test.tsx": 1149,
+      "src/renderer/src/components/settings/VoicePane.test.tsx": 1609,
+      "src/renderer/src/components/settings/VoiceSpeechModelSection.test.tsx": 672,
+      "src/renderer/src/components/settings/WorkspaceDirectorySetting.test.tsx": 2196,
+      "src/renderer/src/components/settings/accounts-search.test.ts": 45,
+      "src/renderer/src/components/settings/agent-availability-settings.test.ts": 209,
+      "src/renderer/src/components/settings/agent-default-env-draft.test.ts": 41,
+      "src/renderer/src/components/settings/agent-skill-installed-command-callers.test.ts": 122,
+      "src/renderer/src/components/settings/appearance-interface-summary.test.ts": 170,
+      "src/renderer/src/components/settings/appearance-search.test.ts": 835,
+      "src/renderer/src/components/settings/appearance-status-bar-search.test.ts": 58,
+      "src/renderer/src/components/settings/appearance-usage-percentage-search.test.ts": 97,
+      "src/renderer/src/components/settings/bitbucket-integration-card.test.tsx": 882,
+      "src/renderer/src/components/settings/browser-cookie-import-label.test.ts": 115,
+      "src/renderer/src/components/settings/browser-link-routing-localization.test.ts": 422,
+      "src/renderer/src/components/settings/browser-search.test.ts": 394,
+      "src/renderer/src/components/settings/browser-session-host-selection.test.ts": 51,
+      "src/renderer/src/components/settings/cli-install-failure.test.ts": 41,
+      "src/renderer/src/components/settings/cli-source-control-integration-cards.test.tsx": 739,
+      "src/renderer/src/components/settings/codex-account-auth-warning.test.ts": 44,
+      "src/renderer/src/components/settings/codex-config-sync-warning.test.ts": 29,
+      "src/renderer/src/components/settings/codex-session-source-home-control.test.tsx": 389,
+      "src/renderer/src/components/settings/developer-permissions-search.test.ts": 410,
+      "src/renderer/src/components/settings/general-editor-search.test.ts": 109,
+      "src/renderer/src/components/settings/general-preview-tab-search.test.ts": 113,
+      "src/renderer/src/components/settings/host-scoped-setting-scope.test.ts": 40,
+      "src/renderer/src/components/settings/integrations-pane-status.test.ts": 56,
+      "src/renderer/src/components/settings/jira-integration-card.test.tsx": 546,
+      "src/renderer/src/components/settings/linear-agent-skill-install-cta.test.tsx": 1244,
+      "src/renderer/src/components/settings/mobile-network-interface-selection.test.ts": 87,
+      "src/renderer/src/components/settings/mobile-pairing-device-polling.test.ts": 48,
+      "src/renderer/src/components/settings/mobile-pane-search.test.ts": 87,
+      "src/renderer/src/components/settings/native-chat-experimental-search-entry.test.ts": 86,
+      "src/renderer/src/components/settings/osc52-clipboard-copy.test.ts": 365,
+      "src/renderer/src/components/settings/plugin-install-source.test.ts": 167,
+      "src/renderer/src/components/settings/provider-account-scope.test.ts": 110,
+      "src/renderer/src/components/settings/provider-account-visibility.test.ts": 53,
+      "src/renderer/src/components/settings/provider-rate-limit-scope-panels.test.tsx": 486,
+      "src/renderer/src/components/settings/repository-hook-settings-draft.test.ts": 201,
+      "src/renderer/src/components/settings/repository-host-setup-options.test.ts": 71,
+      "src/renderer/src/components/settings/repository-icon-github.test.ts": 56,
+      "src/renderer/src/components/settings/repository-source-control-ai-global-ux.test.ts": 689,
+      "src/renderer/src/components/settings/repository-source-control-ai-persist-queue.test.ts": 70,
+      "src/renderer/src/components/settings/runtime-server-row-unverifiable-host.test.tsx": 2289,
+      "src/renderer/src/components/settings/runtime-server-workflow-sections.test.tsx": 936,
+      "src/renderer/src/components/settings/session-history-status-copy.test.ts": 150,
+      "src/renderer/src/components/settings/session-search-computer-rollup.test.ts": 49,
+      "src/renderer/src/components/settings/setting-ownership.test.ts": 66,
+      "src/renderer/src/components/settings/settings-deep-link-target-watcher.test.ts": 479,
+      "src/renderer/src/components/settings/settings-form-option-filter.test.ts": 60,
+      "src/renderer/src/components/settings/settings-project-list.test.ts": 75,
+      "src/renderer/src/components/settings/settings-search-keywords.test.ts": 195,
+      "src/renderer/src/components/settings/settings-search.test.ts": 54,
+      "src/renderer/src/components/settings/settings-setup-guide-progress-hook.test.tsx": 90,
+      "src/renderer/src/components/settings/settings-setup-guide-progress.test.ts": 1590,
+      "src/renderer/src/components/settings/shortcut-binding-list-mutations.test.ts": 44,
+      "src/renderer/src/components/settings/shortcut-definition-catalog.test.ts": 537,
+      "src/renderer/src/components/settings/shortcut-groups.test.ts": 116,
+      "src/renderer/src/components/settings/shortcut-recording-state.test.ts": 39,
+      "src/renderer/src/components/settings/shortcut-row-visibility.test.ts": 485,
+      "src/renderer/src/components/settings/sparse-preset-date.test.ts": 64,
+      "src/renderer/src/components/settings/sparse-preset-operation-error.test.ts": 46,
+      "src/renderer/src/components/settings/ssh-target-action-state.test.ts": 35,
+      "src/renderer/src/components/settings/ssh-target-draft.test.ts": 67,
+      "src/renderer/src/components/settings/ssh-target-remove.test.ts": 110,
+      "src/renderer/src/components/settings/ssh-target-save-payload.test.ts": 118,
+      "src/renderer/src/components/settings/task-source-setup-state.test.ts": 79,
+      "src/renderer/src/components/settings/task-tracker-integration-cards.test.tsx": 892,
+      "src/renderer/src/components/settings/terminal-preview-content.test.ts": 56,
+      "src/renderer/src/components/settings/terminal-search.test.ts": 193,
+      "src/renderer/src/components/settings/use-debounced-settings-text-draft.test.ts": 578,
+      "src/renderer/src/components/settings/use-mac-captured-digit-chords.test.ts": 885,
+      "src/renderer/src/components/settings/use-published-machine-name.test.tsx": 593,
+      "src/renderer/src/components/settings/use-repository-hook-settings-draft.test.tsx": 412,
+      "src/renderer/src/components/settings/use-session-search-status.test.tsx": 462,
+      "src/renderer/src/components/settings/use-task-source-provider-readiness.test.tsx": 464,
+      "src/renderer/src/components/settings/useGhosttyImport.test.ts": 81,
+      "src/renderer/src/components/settings/useWarpThemeImport.test.ts": 96,
+      "src/renderer/src/components/settings/worktree-symlink-path-filter.scan-budget.test.ts": 125,
+      "src/renderer/src/components/settings/worktree-symlink-path-filter.test.ts": 45,
+      "src/renderer/src/components/setup-guide/SetupGuideModal.mount-gating.test.tsx": 1855,
+      "src/renderer/src/components/setup-guide/use-setup-guide-progress.test.ts": 1157,
+      "src/renderer/src/components/setup-guide/use-setup-guide-telemetry.test.ts": 40,
+      "src/renderer/src/components/shared/MacFolderAccessFixDialog.test.tsx": 1694,
+      "src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts": 1721,
+      "src/renderer/src/components/shared/useDaemonActions.test.tsx": 665,
+      "src/renderer/src/components/sidebar/AddProjectFromFolderDialog.test.tsx": 345,
+      "src/renderer/src/components/sidebar/AddRemoteHostDialog.config-picker.test.tsx": 1413,
+      "src/renderer/src/components/sidebar/AddRemoteHostFields.test.tsx": 411,
+      "src/renderer/src/components/sidebar/AddRepoCreateStep.test.tsx": 555,
+      "src/renderer/src/components/sidebar/AddRepoDialog.default-checkout.test.ts": 46,
+      "src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx": 748,
+      "src/renderer/src/components/sidebar/AddRepoHostSelector.test.tsx": 568,
+      "src/renderer/src/components/sidebar/AddRepoNestedImportStep.test.tsx": 891,
+      "src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx": 1413,
+      "src/renderer/src/components/sidebar/AddRepoSteps.default-checkout.test.ts": 158,
+      "src/renderer/src/components/sidebar/AgentDashboardSidebarHost.test.tsx": 2111,
+      "src/renderer/src/components/sidebar/AutoRenameFailedDialog.test.tsx": 534,
+      "src/renderer/src/components/sidebar/CacheTimer.test.tsx": 303,
+      "src/renderer/src/components/sidebar/CommentMarkdown.github-attachment-image.test.tsx": 1751,
+      "src/renderer/src/components/sidebar/CommentMarkdown.link-click.test.tsx": 2429,
+      "src/renderer/src/components/sidebar/CommentMarkdown.test.tsx": 2215,
+      "src/renderer/src/components/sidebar/DeleteWorktreeDialog.host-context-boundary.test.ts": 49,
+      "src/renderer/src/components/sidebar/DeleteWorktreeDialog.test.tsx": 1072,
+      "src/renderer/src/components/sidebar/DeleteWorktreeTargetPreview.test.tsx": 1045,
+      "src/renderer/src/components/sidebar/FilterToggleRow.test.tsx": 792,
+      "src/renderer/src/components/sidebar/ImportedWorktreesVisibilityLine.test.tsx": 1329,
+      "src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.reminder-toast.test.tsx": 1307,
+      "src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.test.tsx": 7136,
+      "src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.update-command.test.tsx": 1428,
+      "src/renderer/src/components/sidebar/LocalGitToolchainScanBanner.test.tsx": 2144,
+      "src/renderer/src/components/sidebar/MarkdownImageLightbox.test.tsx": 1145,
+      "src/renderer/src/components/sidebar/NewExternalWorktreesInboxLine.test.tsx": 2102,
+      "src/renderer/src/components/sidebar/NonGitFolderDialog.test.tsx": 627,
+      "src/renderer/src/components/sidebar/NoticeHostGlyph.test.tsx": 1725,
+      "src/renderer/src/components/sidebar/OrcaYamlTrustDialog.test.tsx": 89,
+      "src/renderer/src/components/sidebar/ProjectAddedDialog.test.tsx": 59,
+      "src/renderer/src/components/sidebar/ProjectGroupDeleteDialog.test.tsx": 946,
+      "src/renderer/src/components/sidebar/ProjectHeaderActions.test.tsx": 455,
+      "src/renderer/src/components/sidebar/RemoteFileBrowser.paste.test.tsx": 1115,
+      "src/renderer/src/components/sidebar/RemoveFolderDialog.test.tsx": 90,
+      "src/renderer/src/components/sidebar/SetupGuideSidebarEntry.test.tsx": 589,
+      "src/renderer/src/components/sidebar/SetupScriptPromptCard.test.ts": 43,
+      "src/renderer/src/components/sidebar/SetupScriptPromptCardShell.test.tsx": 538,
+      "src/renderer/src/components/sidebar/Sidebar.test.tsx": 747,
+      "src/renderer/src/components/sidebar/SidebarAgentsList.test.tsx": 2134,
+      "src/renderer/src/components/sidebar/SidebarFeedbackDialog.test.tsx": 3073,
+      "src/renderer/src/components/sidebar/SidebarGroupByToggle.test.tsx": 522,
+      "src/renderer/src/components/sidebar/SidebarHeader.test.tsx": 1124,
+      "src/renderer/src/components/sidebar/SidebarNav.test.tsx": 1553,
+      "src/renderer/src/components/sidebar/SidebarRepositoryFilterSection.test.tsx": 1398,
+      "src/renderer/src/components/sidebar/SidebarSettingsHelpMenu.test.tsx": 1068,
+      "src/renderer/src/components/sidebar/SidebarToolbar.test.tsx": 1152,
+      "src/renderer/src/components/sidebar/SidebarWorkspaceFilterSection.test.tsx": 765,
+      "src/renderer/src/components/sidebar/StatusIndicator.test.ts": 312,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanCard.host-identity.test.tsx": 1203,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.mount-gating.test.tsx": 2186,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.search.test.tsx": 2422,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.task-status-sync.test.tsx": 2043,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanDrawerHeader.test.tsx": 1839,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanLaneCardList.test.tsx": 1498,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanLaneGrid.test.tsx": 686,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanSearchField.test.tsx": 796,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanSettingsMenu.test.tsx": 1013,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanStatusLane.test.tsx": 969,
+      "src/renderer/src/components/sidebar/WorktreeCard.affiliate-list-mode.test.tsx": 1815,
+      "src/renderer/src/components/sidebar/WorktreeCard.compact-hover.test.tsx": 3499,
+      "src/renderer/src/components/sidebar/WorktreeCard.compact-ports-hover-independence.test.tsx": 1988,
+      "src/renderer/src/components/sidebar/WorktreeCard.hosted-review-refresh.test.tsx": 1492,
+      "src/renderer/src/components/sidebar/WorktreeCard.lineage.test.tsx": 1128,
+      "src/renderer/src/components/sidebar/WorktreeCard.merged-pr-display.test.tsx": 976,
+      "src/renderer/src/components/sidebar/WorktreeCard.pinned-repo-icon.test.tsx": 722,
+      "src/renderer/src/components/sidebar/WorktreeCard.pr-display.test.tsx": 1607,
+      "src/renderer/src/components/sidebar/WorktreeCard.quick-actions.test.tsx": 1815,
+      "src/renderer/src/components/sidebar/WorktreeCard.ssh-reconnect-prompt.test.tsx": 1253,
+      "src/renderer/src/components/sidebar/WorktreeCard.test.ts": 2003,
+      "src/renderer/src/components/sidebar/WorktreeCardAgents.activation.test.tsx": 1121,
+      "src/renderer/src/components/sidebar/WorktreeCardAgents.expansion-remount.test.tsx": 715,
+      "src/renderer/src/components/sidebar/WorktreeCardAgents.send-target.test.tsx": 951,
+      "src/renderer/src/components/sidebar/WorktreeCardAgents.test.tsx": 625,
+      "src/renderer/src/components/sidebar/WorktreeCardAutomationDetailSection.test.tsx": 608,
+      "src/renderer/src/components/sidebar/WorktreeCardDisplayMenuSection.test.tsx": 765,
+      "src/renderer/src/components/sidebar/WorktreeCardMeta.interaction.test.tsx": 3427,
+      "src/renderer/src/components/sidebar/WorktreeCardMeta.test.tsx": 2336,
+      "src/renderer/src/components/sidebar/WorktreeCardPorts.test.tsx": 997,
+      "src/renderer/src/components/sidebar/WorktreeCardSshHostControl.test.tsx": 2296,
+      "src/renderer/src/components/sidebar/WorktreeCardStatusSlot.test.tsx": 306,
+      "src/renderer/src/components/sidebar/WorktreeContextMenu.copy-worktree-name.test.tsx": 1296,
+      "src/renderer/src/components/sidebar/WorktreeContextMenu.delete-shortcut.test.tsx": 1521,
+      "src/renderer/src/components/sidebar/WorktreeContextMenu.react185-bystander.test.tsx": 2442,
+      "src/renderer/src/components/sidebar/WorktreeContextMenu.test.ts": 1831,
+      "src/renderer/src/components/sidebar/WorktreeDeveloperMenu.test.tsx": 156,
+      "src/renderer/src/components/sidebar/WorktreeDeveloperMenuReveal.test.tsx": 837,
+      "src/renderer/src/components/sidebar/WorktreeList.card-memo-stability.test.tsx": 1550,
+      "src/renderer/src/components/sidebar/WorktreeList.empty-project-rows.test.ts": 1867,
+      "src/renderer/src/components/sidebar/WorktreeList.folder-workspace-rows.test.ts": 1777,
+      "src/renderer/src/components/sidebar/WorktreeList.group-headers.test.ts": 2092,
+      "src/renderer/src/components/sidebar/WorktreeList.lineage-agent-expansion-coupling.test.tsx": 5067,
+      "src/renderer/src/components/sidebar/WorktreeList.lineage-child-card.test.ts": 1705,
+      "src/renderer/src/components/sidebar/WorktreeList.lineage-child-real-card.test.tsx": 3618,
+      "src/renderer/src/components/sidebar/WorktreeList.status-lane-lineage-drop.test.tsx": 1918,
+      "src/renderer/src/components/sidebar/WorktreeMetaDialog.test.tsx": 2111,
+      "src/renderer/src/components/sidebar/WorktreeOpenInMenu.test.tsx": 392,
+      "src/renderer/src/components/sidebar/WorktreeParentPickerPopover.test.ts": 1434,
+      "src/renderer/src/components/sidebar/WorktreeTitleInlineRename.begin-editing.test.tsx": 160,
+      "src/renderer/src/components/sidebar/WorktreeTitleInlineRename.editor-lifecycle.test.tsx": 537,
+      "src/renderer/src/components/sidebar/WorktreeTitleInlineRename.test.tsx": 476,
+      "src/renderer/src/components/sidebar/WorktreeVisibilityDialog.test.tsx": 1597,
+      "src/renderer/src/components/sidebar/WorktreeVisibilityHelpPopover.test.tsx": 917,
+      "src/renderer/src/components/sidebar/WorktreeVisibilitySourceList.test.tsx": 957,
+      "src/renderer/src/components/sidebar/active-worktree-focus-after-delete.test.ts": 109,
+      "src/renderer/src/components/sidebar/add-remote-host-ssh-actions.test.ts": 163,
+      "src/renderer/src/components/sidebar/add-repo-browse-authority.test.ts": 56,
+      "src/renderer/src/components/sidebar/add-repo-existing-workspaces-telemetry.test.ts": 60,
+      "src/renderer/src/components/sidebar/add-repo-skip-finalization.test.ts": 33,
+      "src/renderer/src/components/sidebar/clone-defaults.test.ts": 72,
+      "src/renderer/src/components/sidebar/create-project-defaults.test.ts": 33,
+      "src/renderer/src/components/sidebar/default-branch-folder-project-root.test.ts": 924,
+      "src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts": 1322,
+      "src/renderer/src/components/sidebar/delete-worktree-dirty-change-counts.test.ts": 46,
+      "src/renderer/src/components/sidebar/delete-worktree-failure-toast.test.tsx": 634,
+      "src/renderer/src/components/sidebar/delete-worktree-flow.test.ts": 799,
+      "src/renderer/src/components/sidebar/delete-worktree-parallel-flow.test.ts": 320,
+      "src/renderer/src/components/sidebar/delete-worktree-toast.test.ts": 89,
+      "src/renderer/src/components/sidebar/empty-project-placeholder-repos.test.ts": 65,
+      "src/renderer/src/components/sidebar/focused-agent-row-highlight.test.ts": 1580,
+      "src/renderer/src/components/sidebar/folder-workspace-card-pr-display.test.ts": 159,
+      "src/renderer/src/components/sidebar/folder-workspace-composer-expiry.test.tsx": 2105,
+      "src/renderer/src/components/sidebar/folder-workspace-composer-helpers.test.ts": 89,
+      "src/renderer/src/components/sidebar/folder-workspace-composer-path-status.test.tsx": 1905,
+      "src/renderer/src/components/sidebar/folder-workspace-composer-submit.test.ts": 3745,
+      "src/renderer/src/components/sidebar/folder-workspace-linked-startup-plan.test.ts": 1959,
+      "src/renderer/src/components/sidebar/host-header-drag.test.tsx": 386,
+      "src/renderer/src/components/sidebar/host-header-menu-items.test.ts": 49,
+      "src/renderer/src/components/sidebar/host-rename-remove.test.ts": 49,
+      "src/renderer/src/components/sidebar/host-section-folder-workspace-counts.test.ts": 51,
+      "src/renderer/src/components/sidebar/host-section-order.test.ts": 33,
+      "src/renderer/src/components/sidebar/host-section-rows.test.ts": 223,
+      "src/renderer/src/components/sidebar/hovered-workspace-delete.test.ts": 1960,
+      "src/renderer/src/components/sidebar/imported-worktrees-card-actions.test.ts": 54,
+      "src/renderer/src/components/sidebar/imported-worktrees-card-candidates.test.ts": 60,
+      "src/renderer/src/components/sidebar/linear-agent-skill-runtime.shell-override.test.ts": 66,
+      "src/renderer/src/components/sidebar/linear-agent-skill-setup-reminders.test.ts": 51,
+      "src/renderer/src/components/sidebar/local-base-ref-suggestion-toast.test.tsx": 727,
+      "src/renderer/src/components/sidebar/mobile-sidebar-onboarding-badge.test.ts": 447,
+      "src/renderer/src/components/sidebar/natural-worktree-ids.test.ts": 266,
+      "src/renderer/src/components/sidebar/new-external-worktrees-inbox-actions.test.ts": 80,
+      "src/renderer/src/components/sidebar/new-external-worktrees-inbox-candidates.test.ts": 42,
+      "src/renderer/src/components/sidebar/pinned-section-worktrees.test.ts": 535,
+      "src/renderer/src/components/sidebar/preserved-branch-batch-toast.test.tsx": 548,
+      "src/renderer/src/components/sidebar/preserved-branch-toast.test.tsx": 937,
+      "src/renderer/src/components/sidebar/project-added-default-checkout.test.ts": 134,
+      "src/renderer/src/components/sidebar/project-filter-reveal.test.ts": 49,
+      "src/renderer/src/components/sidebar/project-group-header-dom.test.ts": 33,
+      "src/renderer/src/components/sidebar/project-group-header-drag-commit.test.ts": 450,
+      "src/renderer/src/components/sidebar/project-group-header-drag-start.test.ts": 375,
+      "src/renderer/src/components/sidebar/project-group-header-drag.test.ts": 565,
+      "src/renderer/src/components/sidebar/project-group-header-drop.test.ts": 360,
+      "src/renderer/src/components/sidebar/project-header-action-selector-lockstep.test.ts": 394,
+      "src/renderer/src/components/sidebar/project-header-color.test.ts": 200,
+      "src/renderer/src/components/sidebar/project-header-drag-commit.test.ts": 356,
+      "src/renderer/src/components/sidebar/project-header-drag-start.test.ts": 478,
+      "src/renderer/src/components/sidebar/project-header-drag.test.ts": 465,
+      "src/renderer/src/components/sidebar/project-header-drop.test.ts": 226,
+      "src/renderer/src/components/sidebar/project-order-manual-default-notice-visibility.test.ts": 53,
+      "src/renderer/src/components/sidebar/prompt-cache-countdown-clock.test.ts": 65,
+      "src/renderer/src/components/sidebar/prompt-cache-timer-selection.test.ts": 55,
+      "src/renderer/src/components/sidebar/remote-file-browser-drive-paths.test.ts": 58,
+      "src/renderer/src/components/sidebar/remote-file-browser-helpers.test.ts": 155,
+      "src/renderer/src/components/sidebar/rendered-sidebar-worktree-order.test.ts": 1657,
+      "src/renderer/src/components/sidebar/repo-header-create-state.test.ts": 110,
+      "src/renderer/src/components/sidebar/sidebar-empty-state-gate.test.ts": 45,
+      "src/renderer/src/components/sidebar/sidebar-filter-state.test.ts": 1063,
+      "src/renderer/src/components/sidebar/sidebar-host-options.test.ts": 109,
+      "src/renderer/src/components/sidebar/sidebar-project-drop.test.ts": 93,
+      "src/renderer/src/components/sidebar/sidebar-resize-handle.test.ts": 4515,
+      "src/renderer/src/components/sidebar/sidebar-workspace-option-items.test.ts": 205,
+      "src/renderer/src/components/sidebar/sleep-worktree-activation-race.test.ts": 69,
+      "src/renderer/src/components/sidebar/sleep-worktree-flow.test.ts": 101,
+      "src/renderer/src/components/sidebar/smart-attention.test.ts": 142,
+      "src/renderer/src/components/sidebar/smart-sort.test.ts": 85,
+      "src/renderer/src/components/sidebar/ssh-host-remove-resolution.test.ts": 33,
+      "src/renderer/src/components/sidebar/ssh-target-duplicate.test.ts": 39,
+      "src/renderer/src/components/sidebar/ssh-workspace-forget-resolution.test.ts": 60,
+      "src/renderer/src/components/sidebar/stale-agent-row-unverifiable.test.ts": 1707,
+      "src/renderer/src/components/sidebar/truncated-sidebar-label.test.tsx": 396,
+      "src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts": 266,
+      "src/renderer/src/components/sidebar/use-add-repo-hosted-controller.test.ts": 63,
+      "src/renderer/src/components/sidebar/use-feedback-image-drop.test.tsx": 678,
+      "src/renderer/src/components/sidebar/use-sidebar-feedback-images.test.tsx": 560,
+      "src/renderer/src/components/sidebar/use-visible-workspace-kanban-worktree-ids.test.tsx": 2267,
+      "src/renderer/src/components/sidebar/use-workspace-kanban-card-pointer-drag.test.ts": 986,
+      "src/renderer/src/components/sidebar/use-workspace-kanban-drawer-lingering.test.tsx": 606,
+      "src/renderer/src/components/sidebar/use-workspace-kanban-outside-dismiss.test.ts": 34,
+      "src/renderer/src/components/sidebar/use-workspace-kanban-selection.test.tsx": 283,
+      "src/renderer/src/components/sidebar/use-workspace-reveal-body-redirect.test.tsx": 611,
+      "src/renderer/src/components/sidebar/use-workspace-status-drop.test.ts": 256,
+      "src/renderer/src/components/sidebar/use-worktree-activity-status.test.tsx": 140,
+      "src/renderer/src/components/sidebar/use-worktree-activity-statuses.test.ts": 1246,
+      "src/renderer/src/components/sidebar/use-worktree-card-secondary-details.store-subscriptions.test.tsx": 2448,
+      "src/renderer/src/components/sidebar/use-worktree-sleep-state.test.tsx": 79,
+      "src/renderer/src/components/sidebar/useAddRepoCloneFlow.test.ts": 145,
+      "src/renderer/src/components/sidebar/useAddRepoLocalFolderFlow.test.ts": 162,
+      "src/renderer/src/components/sidebar/useAddRepoNestedImportFlow.test.ts": 105,
+      "src/renderer/src/components/sidebar/useAddRepoServerPathFlow.test.ts": 95,
+      "src/renderer/src/components/sidebar/useCreateProjectDefaults.test.ts": 101,
+      "src/renderer/src/components/sidebar/useCreateRepo.default-checkout.test.ts": 147,
+      "src/renderer/src/components/sidebar/useRenderedSetupScriptPromptState.test.ts": 476,
+      "src/renderer/src/components/sidebar/useSetupScriptPromptRevalidation.test.tsx": 1585,
+      "src/renderer/src/components/sidebar/useWorkspaceBoardPanel.test.tsx": 556,
+      "src/renderer/src/components/sidebar/useWorktreeAgentRows.test.ts": 168,
+      "src/renderer/src/components/sidebar/visible-worktree-activity-inputs.test.ts": 32,
+      "src/renderer/src/components/sidebar/visible-worktree-indexes.test.ts": 1479,
+      "src/renderer/src/components/sidebar/visible-worktrees.test.ts": 3541,
+      "src/renderer/src/components/sidebar/workspace-board-task-status-sync.test.ts": 58,
+      "src/renderer/src/components/sidebar/workspace-creator-visibility.test.ts": 29,
+      "src/renderer/src/components/sidebar/workspace-delete-lineage.test.ts": 52,
+      "src/renderer/src/components/sidebar/workspace-kanban-area-selection.test.ts": 343,
+      "src/renderer/src/components/sidebar/workspace-kanban-card-pointer-drag-dom.test.ts": 69,
+      "src/renderer/src/components/sidebar/workspace-kanban-filtered-drop-index.test.ts": 54,
+      "src/renderer/src/components/sidebar/workspace-kanban-search.test.ts": 100,
+      "src/renderer/src/components/sidebar/workspace-kanban-sidebar-drop.test.ts": 253,
+      "src/renderer/src/components/sidebar/workspace-kanban-virtual-lane-layout.test.ts": 48,
+      "src/renderer/src/components/sidebar/workspace-kanban-worktree-groups.test.ts": 142,
+      "src/renderer/src/components/sidebar/workspace-lineage-menu-actions.test.ts": 41,
+      "src/renderer/src/components/sidebar/workspace-status.test.ts": 254,
+      "src/renderer/src/components/sidebar/worktree-agent-activity-summary.test.ts": 113,
+      "src/renderer/src/components/sidebar/worktree-agent-freshness-selector.test.ts": 82,
+      "src/renderer/src/components/sidebar/worktree-agent-host-attribution.test.ts": 36,
+      "src/renderer/src/components/sidebar/worktree-agent-orchestration-batch.test.ts": 75,
+      "src/renderer/src/components/sidebar/worktree-agent-orchestration-index.test.ts": 163,
+      "src/renderer/src/components/sidebar/worktree-agent-remote-attribution.test.ts": 613,
+      "src/renderer/src/components/sidebar/worktree-agent-row-selectors.test.ts": 98,
+      "src/renderer/src/components/sidebar/worktree-card-agent-ack-inputs.test.tsx": 455,
+      "src/renderer/src/components/sidebar/worktree-card-agent-summary.test.ts": 1674,
+      "src/renderer/src/components/sidebar/worktree-card-compact-agent-row.stable-message.test.tsx": 777,
+      "src/renderer/src/components/sidebar/worktree-card-details-hover-state.test.tsx": 292,
+      "src/renderer/src/components/sidebar/worktree-card-dom-events.test.ts": 428,
+      "src/renderer/src/components/sidebar/worktree-card-jira-issue-display.test.ts": 49,
+      "src/renderer/src/components/sidebar/worktree-card-markdown-isolation.test.ts": 555,
+      "src/renderer/src/components/sidebar/worktree-card-pr-display.test.ts": 35,
+      "src/renderer/src/components/sidebar/worktree-card-send-target-inputs.test.ts": 33,
+      "src/renderer/src/components/sidebar/worktree-card-status-inputs.test.ts": 51,
+      "src/renderer/src/components/sidebar/worktree-card-title-display.test.ts": 62,
+      "src/renderer/src/components/sidebar/worktree-context-menu-delete-intent.test.ts": 72,
+      "src/renderer/src/components/sidebar/worktree-delete-host-qualification.test.ts": 1795,
+      "src/renderer/src/components/sidebar/worktree-delete-position-scaling.test.ts": 669,
+      "src/renderer/src/components/sidebar/worktree-delete-request.test.ts": 46,
+      "src/renderer/src/components/sidebar/worktree-drag-units.test.ts": 194,
+      "src/renderer/src/components/sidebar/worktree-filter-visibility.test.ts": 466,
+      "src/renderer/src/components/sidebar/worktree-header-section-boundaries.test.ts": 206,
+      "src/renderer/src/components/sidebar/worktree-keyboard-cycle.test.ts": 286,
+      "src/renderer/src/components/sidebar/worktree-lineage-drag-drop.test.ts": 483,
+      "src/renderer/src/components/sidebar/worktree-lineage-expansion.performance.test.ts": 193,
+      "src/renderer/src/components/sidebar/worktree-lineage-projection.test.ts": 43,
+      "src/renderer/src/components/sidebar/worktree-lineage-toggle-handler-cache.test.ts": 56,
+      "src/renderer/src/components/sidebar/worktree-list-groups-host-collision.test.ts": 200,
+      "src/renderer/src/components/sidebar/worktree-list-groups-host-labels.test.ts": 238,
+      "src/renderer/src/components/sidebar/worktree-list-groups-imported-worktrees.test.ts": 243,
+      "src/renderer/src/components/sidebar/worktree-list-groups-lineage-nesting.test.ts": 173,
+      "src/renderer/src/components/sidebar/worktree-list-groups-nested-project-groups.test.ts": 187,
+      "src/renderer/src/components/sidebar/worktree-list-groups-notice-host-labels.test.ts": 208,
+      "src/renderer/src/components/sidebar/worktree-list-groups-pending-creations.test.ts": 365,
+      "src/renderer/src/components/sidebar/worktree-list-groups-pinned-host-labels.test.ts": 238,
+      "src/renderer/src/components/sidebar/worktree-list-groups-project-groups.test.ts": 226,
+      "src/renderer/src/components/sidebar/worktree-list-groups-project-host-setups.test.ts": 181,
+      "src/renderer/src/components/sidebar/worktree-list-groups-project-order.test.ts": 1153,
+      "src/renderer/src/components/sidebar/worktree-list-groups-section-label-disambiguation.test.ts": 221,
+      "src/renderer/src/components/sidebar/worktree-list/drag/pointer-flush.test.ts": 845,
+      "src/renderer/src/components/sidebar/worktree-list/drag/row-state.test.ts": 57,
+      "src/renderer/src/components/sidebar/worktree-list/grouping/build-rows.folder-workspace-lanes.test.ts": 240,
+      "src/renderer/src/components/sidebar/worktree-list/grouping/build-rows.test.ts": 319,
+      "src/renderer/src/components/sidebar/worktree-list/grouping/host-labels.test.ts": 58,
+      "src/renderer/src/components/sidebar/worktree-list/grouping/imported-rows.test.ts": 1449,
+      "src/renderer/src/components/sidebar/worktree-list/listing/host-filtering.test.ts": 37,
+      "src/renderer/src/components/sidebar/worktree-list/listing/pending-worktree-creation-keys.test.ts": 24,
+      "src/renderer/src/components/sidebar/worktree-list/listing/review-cache-inputs.test.ts": 54,
+      "src/renderer/src/components/sidebar/worktree-list/listing/use-visible-worktrees.test.tsx": 1710,
+      "src/renderer/src/components/sidebar/worktree-list/navigation/active-descendant-option.test.ts": 235,
+      "src/renderer/src/components/sidebar/worktree-list/navigation/folder-reveal.test.ts": 231,
+      "src/renderer/src/components/sidebar/worktree-list/navigation/render-row-lookup.folder-workspace.test.ts": 253,
+      "src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.host-identity.test.tsx": 794,
+      "src/renderer/src/components/sidebar/worktree-list/navigation/use-reveal-requests.test.tsx": 883,
+      "src/renderer/src/components/sidebar/worktree-list/navigation/use-selection-host-collision.test.tsx": 2056,
+      "src/renderer/src/components/sidebar/worktree-list/rows/FolderPathStatusIndicator.test.tsx": 754,
+      "src/renderer/src/components/sidebar/worktree-list/rows/RepoScanUnavailableIndicator.test.tsx": 2106,
+      "src/renderer/src/components/sidebar/worktree-list/rows/indentation.test.ts": 65,
+      "src/renderer/src/components/sidebar/worktree-list/rows/option-dom-host-collision.test.ts": 475,
+      "src/renderer/src/components/sidebar/worktree-list/rows/use-project-group-dialogs-owner-host.test.tsx": 396,
+      "src/renderer/src/components/sidebar/worktree-list/viewport/hard-scroll-up.test.ts": 64,
+      "src/renderer/src/components/sidebar/worktree-list/viewport/scroll-adjustment.test.ts": 2365,
+      "src/renderer/src/components/sidebar/worktree-list/viewport/sticky-headers.test.ts": 303,
+      "src/renderer/src/components/sidebar/worktree-list/viewport/use-row-removal-animation.test.ts": 62,
+      "src/renderer/src/components/sidebar/worktree-list/viewport/use-scroll-to-top.test.ts": 496,
+      "src/renderer/src/components/sidebar/worktree-list/viewport/use-scroll-to-top.test.tsx": 401,
+      "src/renderer/src/components/sidebar/worktree-list/viewport/virtual-rows.test.ts": 254,
+      "src/renderer/src/components/sidebar/worktree-list/viewport/visible-refresh.test.ts": 1519,
+      "src/renderer/src/components/sidebar/worktree-manual-order-catalog.test.ts": 106,
+      "src/renderer/src/components/sidebar/worktree-manual-order-store-write.test.ts": 2148,
+      "src/renderer/src/components/sidebar/worktree-manual-order.test.ts": 386,
+      "src/renderer/src/components/sidebar/worktree-meta-updates.test.ts": 76,
+      "src/renderer/src/components/sidebar/worktree-multi-selection.test.ts": 27,
+      "src/renderer/src/components/sidebar/worktree-name-suggestions.test.ts": 168,
+      "src/renderer/src/components/sidebar/worktree-parent-eligibility.test.ts": 37,
+      "src/renderer/src/components/sidebar/worktree-review-helpers.test.tsx": 266,
+      "src/renderer/src/components/sidebar/worktree-scroll-to-current-button.test.ts": 254,
+      "src/renderer/src/components/sidebar/worktree-sidebar-drag-autoscroll.test.ts": 46,
+      "src/renderer/src/components/sidebar/worktree-sidebar-drag-geometry.test.ts": 77,
+      "src/renderer/src/components/sidebar/worktree-sidebar-drop-preview.test.ts": 56,
+      "src/renderer/src/components/sidebar/worktree-sidebar-pointer-drag-dom.test.ts": 337,
+      "src/renderer/src/components/sidebar/worktree-sidebar-reveal-scroll-settle.test.ts": 28,
+      "src/renderer/src/components/sidebar/worktree-sidebar-reveal.test.ts": 134,
+      "src/renderer/src/components/sidebar/worktree-sidebar-row-preference.test.ts": 152,
+      "src/renderer/src/components/sidebar/worktree-sort-label-ordering.test.ts": 172,
+      "src/renderer/src/components/sidebar/worktree-subagent-child-rows.test.ts": 47,
+      "src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.test.ts": 164,
+      "src/renderer/src/components/sidebar/worktree-unambiguous-id-index.test.ts": 43,
+      "src/renderer/src/components/sidebar/worktree-unnest.test.ts": 103,
+      "src/renderer/src/components/sidebar/worktree-visibility-source-provenance.test.ts": 52,
+      "src/renderer/src/components/skills/SkillFreshnessNudge.test.tsx": 443,
+      "src/renderer/src/components/skills/SkillFreshnessStatusPill.test.tsx": 770,
+      "src/renderer/src/components/skills/SkillFreshnessUpdateDialog.test.tsx": 834,
+      "src/renderer/src/components/skills/SkillInstallAgentPicker.test.tsx": 869,
+      "src/renderer/src/components/skills/SkillInstallDialog.test.tsx": 4156,
+      "src/renderer/src/components/skills/SkillInstallManagementDialog.test.tsx": 3656,
+      "src/renderer/src/components/skills/SkillInstallTargetFields.test.tsx": 1232,
+      "src/renderer/src/components/skills/SkillInstallWorkspaceCombobox.test.tsx": 965,
+      "src/renderer/src/components/skills/SkillShareDialog.test.tsx": 2329,
+      "src/renderer/src/components/skills/SkillSharedLinkRow.test.tsx": 1251,
+      "src/renderer/src/components/skills/SkillsPage.test.tsx": 4219,
+      "src/renderer/src/components/skills/skill-agent-filter.test.ts": 202,
+      "src/renderer/src/components/skills/skill-bundle-name.test.ts": 122,
+      "src/renderer/src/components/skills/skill-bundle-retry-selection.test.ts": 47,
+      "src/renderer/src/components/skills/skill-delete-copy.test.ts": 69,
+      "src/renderer/src/components/skills/skill-delete-selection.test.ts": 229,
+      "src/renderer/src/components/skills/skill-description-length.test.ts": 52,
+      "src/renderer/src/components/skills/skill-freshness-grouping.test.ts": 67,
+      "src/renderer/src/components/skills/skill-freshness-skipped-reason.test.ts": 137,
+      "src/renderer/src/components/skills/skill-install-progress-state.test.tsx": 673,
+      "src/renderer/src/components/skills/skill-install-provider-groups.test.ts": 62,
+      "src/renderer/src/components/skills/skill-install-workspace-choices.test.ts": 25,
+      "src/renderer/src/components/skills/skill-package-checklist-items.test.ts": 81,
+      "src/renderer/src/components/skills/skill-package-digest.test.ts": 46,
+      "src/renderer/src/components/skills/skill-package-install-risk.test.ts": 55,
+      "src/renderer/src/components/skills/skill-share-link.test.ts": 36,
+      "src/renderer/src/components/skills/skill-share-package-selection.test.ts": 45,
+      "src/renderer/src/components/skills/skill-share-preview-summary.test.ts": 80,
+      "src/renderer/src/components/skills/skill-share-selection.test.ts": 91,
+      "src/renderer/src/components/skills/skill-source-inventory.test.ts": 61,
+      "src/renderer/src/components/skills/skills-filter.test.ts": 113,
+      "src/renderer/src/components/source-control/SourceControlActionVariableChips.test.tsx": 386,
+      "src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.test.tsx": 2099,
+      "src/renderer/src/components/star-nag/StarNagToastHost.test.tsx": 984,
+      "src/renderer/src/components/stats/CodexUsagePane.test.tsx": 840,
+      "src/renderer/src/components/stats/GrokUsagePane.test.tsx": 1024,
+      "src/renderer/src/components/stats/UsageBreakdownSection.test.tsx": 622,
+      "src/renderer/src/components/stats/UsageTrackingPaneShell.test.tsx": 858,
+      "src/renderer/src/components/stats/usage-daily-chart.test.tsx": 668,
+      "src/renderer/src/components/stats/usage-overview-model.test.ts": 531,
+      "src/renderer/src/components/status-bar/CaffeinateStatusSegment.localization.test.tsx": 1458,
+      "src/renderer/src/components/status-bar/NativeChatResumeStatusSegment.test.tsx": 2493,
+      "src/renderer/src/components/status-bar/PetStatusSegment.layout.test.ts": 40,
+      "src/renderer/src/components/status-bar/PortsStatusSegment.host-routing.test.tsx": 620,
+      "src/renderer/src/components/status-bar/PortsStatusSegment.render-stability.test.tsx": 1943,
+      "src/renderer/src/components/status-bar/ResourceUsageStatusSegment.rows.test.tsx": 1928,
+      "src/renderer/src/components/status-bar/ResourceUsageStatusSegment.session-polling.test.ts": 50,
+      "src/renderer/src/components/status-bar/RuntimeHostStatusRow.test.tsx": 809,
+      "src/renderer/src/components/status-bar/SkillUpdateStatusSegment.test.tsx": 485,
+      "src/renderer/src/components/status-bar/SshStatusSegment.test.ts": 1996,
+      "src/renderer/src/components/status-bar/UpdateStatusSegment.test.tsx": 2381,
+      "src/renderer/src/components/status-bar/UsagePercentageDisplayChangeNotice.test.tsx": 794,
+      "src/renderer/src/components/status-bar/UsageRosterPanel.test.tsx": 1073,
+      "src/renderer/src/components/status-bar/codex-restart-status-summary.test.ts": 47,
+      "src/renderer/src/components/status-bar/codex-status-sign-in.test.tsx": 1799,
+      "src/renderer/src/components/status-bar/icons.test.tsx": 92,
+      "src/renderer/src/components/status-bar/inline-usage-bars.test.tsx": 754,
+      "src/renderer/src/components/status-bar/mergeSnapshotAndSessions.test.ts": 79,
+      "src/renderer/src/components/status-bar/ports-status-popover-rows.test.tsx": 742,
+      "src/renderer/src/components/status-bar/provider-account-sync-key.test.ts": 53,
+      "src/renderer/src/components/status-bar/provider-segment-monthly-window.test.tsx": 1108,
+      "src/renderer/src/components/status-bar/remote-host-connection-status.test.ts": 71,
+      "src/renderer/src/components/status-bar/resource-manager-terminal-copy.test.ts": 62,
+      "src/renderer/src/components/status-bar/resource-manager-worktree-target.test.ts": 53,
+      "src/renderer/src/components/status-bar/resource-memory-metric-copy.test.ts": 27,
+      "src/renderer/src/components/status-bar/resource-session-bindings.test.ts": 43,
+      "src/renderer/src/components/status-bar/resource-session-classification-parity.test.ts": 42,
+      "src/renderer/src/components/status-bar/resource-session-inventory.test.ts": 33,
+      "src/renderer/src/components/status-bar/resource-session-kill-confirmation.test.ts": 65,
+      "src/renderer/src/components/status-bar/resource-session-navigation.test.ts": 60,
+      "src/renderer/src/components/status-bar/resource-usage-folder-merge.test.ts": 94,
+      "src/renderer/src/components/status-bar/resource-usage-open-slices.test.ts": 1536,
+      "src/renderer/src/components/status-bar/resource-usage-space-scan-ready.test.ts": 61,
+      "src/renderer/src/components/status-bar/ssh-status-segment-copy.test.ts": 40,
+      "src/renderer/src/components/status-bar/status-bar-agent-gating.test.ts": 45,
+      "src/renderer/src/components/status-bar/status-bar-context-menu-policy.test.ts": 35,
+      "src/renderer/src/components/status-bar/status-bar-copy-localization.test.tsx": 1540,
+      "src/renderer/src/components/status-bar/status-bar-cursor-segment.test.tsx": 757,
+      "src/renderer/src/components/status-bar/status-bar-provider-menu-focus.test.tsx": 1039,
+      "src/renderer/src/components/status-bar/status-bar-provider-visibility.test.ts": 35,
+      "src/renderer/src/components/status-bar/status-bar-runtime-groups.test.ts": 1341,
+      "src/renderer/src/components/status-bar/tooltip.test.ts": 139,
+      "src/renderer/src/components/status-bar/usage-error-copy.test.ts": 65,
+      "src/renderer/src/components/status-bar/usage-percentage-label.test.ts": 38,
+      "src/renderer/src/components/status-bar/usage-provider-settings-target.test.ts": 37,
+      "src/renderer/src/components/status-bar/usage-roster-formatting.test.ts": 27,
+      "src/renderer/src/components/status-bar/usage-roster-row-state.test.ts": 53,
+      "src/renderer/src/components/status-bar/use-resource-session-inventory.test.tsx": 1022,
+      "src/renderer/src/components/status-bar/use-resource-usage-actions.test.tsx": 472,
+      "src/renderer/src/components/status-bar/use-resource-usage-derived-model.test.tsx": 823,
+      "src/renderer/src/components/status-bar/workspace-space-breakdown-list.test.tsx": 448,
+      "src/renderer/src/components/status-bar/workspace-space-delete-host-routing.test.ts": 43,
+      "src/renderer/src/components/status-bar/workspace-space-format.test.ts": 97,
+      "src/renderer/src/components/status-bar/workspace-space-layout.test.ts": 51,
+      "src/renderer/src/components/status-bar/workspace-space-manager-source-boundary.test.ts": 64,
+      "src/renderer/src/components/status-bar/workspace-space-presentation.test.ts": 217,
+      "src/renderer/src/components/tab-bar/BrowserTab.test.tsx": 1511,
+      "src/renderer/src/components/tab-bar/ClientHostedBrowserTabRows.test.tsx": 1260,
+      "src/renderer/src/components/tab-bar/EditorFileTab.test.tsx": 1020,
+      "src/renderer/src/components/tab-bar/EditorFileTabContextMenu.test.tsx": 660,
+      "src/renderer/src/components/tab-bar/QuickLaunchButton.test.ts": 667,
+      "src/renderer/src/components/tab-bar/RecentTabSwitcher.test.tsx": 660,
+      "src/renderer/src/components/tab-bar/SortableTab.rename-shortcut.test.tsx": 831,
+      "src/renderer/src/components/tab-bar/SortableTab.update-depth-probe.test.tsx": 1389,
+      "src/renderer/src/components/tab-bar/SortableTabContextMenu.test.tsx": 1143,
+      "src/renderer/src/components/tab-bar/TabBar.client-hosted-row-active-state.test.ts": 1679,
+      "src/renderer/src/components/tab-bar/TabBar.context-menu.test.ts": 2690,
+      "src/renderer/src/components/tab-bar/TabBar.windows-shell-launch.test.ts": 1682,
+      "src/renderer/src/components/tab-bar/TabBar.windows-shell-remote-runtime.test.ts": 1585,
+      "src/renderer/src/components/tab-bar/TabBar.windows-shell-ssh-host.test.ts": 1937,
+      "src/renderer/src/components/tab-bar/TabBar.worktree-write-gate.test.tsx": 1156,
+      "src/renderer/src/components/tab-bar/TabBar.worktree-write-gate.windows.test.tsx": 1568,
+      "src/renderer/src/components/tab-bar/TabBarCreateEntry.history.test.tsx": 1865,
+      "src/renderer/src/components/tab-bar/TabBarCreateEntry.keyboard.test.tsx": 2588,
+      "src/renderer/src/components/tab-bar/TabBarCreateEntry.search.test.tsx": 2749,
+      "src/renderer/src/components/tab-bar/TabBarCreateEntry.tab-results.test.tsx": 1967,
+      "src/renderer/src/components/tab-bar/TabBarCreateEntryRow.test.tsx": 1179,
+      "src/renderer/src/components/tab-bar/TabBarQuickCommandItem.test.tsx": 983,
+      "src/renderer/src/components/tab-bar/TabBarQuickCommandsMenu.keyboard.test.ts": 100,
+      "src/renderer/src/components/tab-bar/TabStripScrollIndicator.test.tsx": 608,
+      "src/renderer/src/components/tab-bar/TerminalTabLeadingIcon.test.tsx": 313,
+      "src/renderer/src/components/tab-bar/client-hosted-browser-row-strip-placement.test.ts": 44,
+      "src/renderer/src/components/tab-bar/drop-indicator.test.ts": 50,
+      "src/renderer/src/components/tab-bar/editor-tab-local-open-guard.test.ts": 68,
+      "src/renderer/src/components/tab-bar/group-tab-order.test.ts": 1929,
+      "src/renderer/src/components/tab-bar/middle-button-default-guard.test.ts": 31,
+      "src/renderer/src/components/tab-bar/native-chat-tab-agent-evidence.test.ts": 52,
+      "src/renderer/src/components/tab-bar/open-tab-entry-dedupe.test.ts": 152,
+      "src/renderer/src/components/tab-bar/open-tab-search-retention.test.ts": 450,
+      "src/renderer/src/components/tab-bar/open-tab-search.test.ts": 353,
+      "src/renderer/src/components/tab-bar/open-tab-selection-routing.test.ts": 625,
+      "src/renderer/src/components/tab-bar/query-token-match.test.ts": 48,
+      "src/renderer/src/components/tab-bar/recent-tab-switching.test.ts": 59,
+      "src/renderer/src/components/tab-bar/reconcile-order.test.ts": 52,
+      "src/renderer/src/components/tab-bar/tab-agent-launch-options.test.ts": 99,
+      "src/renderer/src/components/tab-bar/tab-agent-types-by-tab-id.test.ts": 80,
+      "src/renderer/src/components/tab-bar/tab-bar-item-surface.client-hosted-active-state.test.tsx": 2562,
+      "src/renderer/src/components/tab-bar/tab-context-menu-consistency.test.tsx": 42,
+      "src/renderer/src/components/tab-bar/tab-create-entry-action.test.ts": 1242,
+      "src/renderer/src/components/tab-bar/tab-create-entry-classifier.runtime-listing.test.tsx": 2034,
+      "src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts": 1823,
+      "src/renderer/src/components/tab-bar/tab-create-entry-file-matches.test.ts": 93,
+      "src/renderer/src/components/tab-bar/tab-create-entry-forced-search.test.ts": 33,
+      "src/renderer/src/components/tab-bar/tab-create-entry-history-placement.test.ts": 158,
+      "src/renderer/src/components/tab-bar/tab-create-entry-local-path.test.ts": 1887,
+      "src/renderer/src/components/tab-bar/tab-create-entry-url-classification.test.ts": 194,
+      "src/renderer/src/components/tab-bar/tab-create-menu-options.test.ts": 75,
+      "src/renderer/src/components/tab-bar/tab-move-to-pane-column.test.ts": 1424,
+      "src/renderer/src/components/tab-bar/tab-strip-content-resize-observers.test.ts": 236,
+      "src/renderer/src/components/tab-bar/tab-strip-overflow-navigation.test.ts": 73,
+      "src/renderer/src/components/tab-bar/tab-strip-pointer-activation.test.tsx": 1784,
+      "src/renderer/src/components/tab-bar/tab-strip-scroll-metrics.test.ts": 38,
+      "src/renderer/src/components/tab-bar/tab-title-tooltip.test.tsx": 1090,
+      "src/renderer/src/components/tab-bar/terminal-tab-activity-status.test.ts": 131,
+      "src/renderer/src/components/tab-bar/terminal-tab-spinner-launch-agent.test.ts": 53,
+      "src/renderer/src/components/tab-bar/use-open-tab-search.test.ts": 1977,
+      "src/renderer/src/components/tab-bar/use-tab-bar-quick-command-search-input.test.ts": 425,
+      "src/renderer/src/components/tab-bar/windows-shell-launch.test.ts": 29,
+      "src/renderer/src/components/tab-bar/windows-shell-menu-visibility.test.ts": 53,
+      "src/renderer/src/components/tab-group/RetainedPaneHost.test.tsx": 528,
+      "src/renderer/src/components/tab-group/TabGroupPanel.context-menu.test.ts": 35,
+      "src/renderer/src/components/tab-group/TabGroupSplitLayout.drag.test.tsx": 662,
+      "src/renderer/src/components/tab-group/TabGroupSplitLayout.test.ts": 319,
+      "src/renderer/src/components/tab-group/TabPaneColumnSplitDragOverlay.test.tsx": 110,
+      "src/renderer/src/components/tab-group/tab-drag-pointer-sensor.test.ts": 527,
+      "src/renderer/src/components/tab-group/tab-drag-pointer.test.ts": 41,
+      "src/renderer/src/components/tab-group/tab-drag-preview-activation.test.ts": 1253,
+      "src/renderer/src/components/tab-group/tab-drag-retained-guest-passthrough.test.tsx": 2070,
+      "src/renderer/src/components/tab-group/tab-drop-zone.test.ts": 38,
+      "src/renderer/src/components/tab-group/tab-group-body-anchor.test.ts": 38,
+      "src/renderer/src/components/tab-group/tab-group-panel-split-target.test.ts": 84,
+      "src/renderer/src/components/tab-group/tab-insertion.test.ts": 50,
+      "src/renderer/src/components/tab-group/useTabDragSplit.test.ts": 1851,
+      "src/renderer/src/components/tab-group/useTabGroupCreationCommands.local-shell.test.ts": 734,
+      "src/renderer/src/components/tab-group/useTabGroupTabCloseCommands.structured-session.test.ts": 263,
+      "src/renderer/src/components/tab-group/useTabGroupTabCloseCommands.test.tsx": 2028,
+      "src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.focus.test.ts": 1358,
+      "src/renderer/src/components/task-drawer-source-boundary.test.ts": 40,
+      "src/renderer/src/components/task-page-cache-selectors.test.ts": 102,
+      "src/renderer/src/components/task-page-checks-pill.test.ts": 31,
+      "src/renderer/src/components/task-page-default-repo-selection.test.ts": 55,
+      "src/renderer/src/components/task-page-empty-state.test.ts": 95,
+      "src/renderer/src/components/task-page-github-dialog-state-authority.test.ts": 376,
+      "src/renderer/src/components/task-page-github-issue-creation.test.ts": 401,
+      "src/renderer/src/components/task-page-github-list-scroll-restore.test.ts": 277,
+      "src/renderer/src/components/task-page-github-resume-cache.test.ts": 52,
+      "src/renderer/src/components/task-page-github-reviewer-suggestions.test.ts": 50,
+      "src/renderer/src/components/task-page-github-status-actions.test.ts": 52,
+      "src/renderer/src/components/task-page-github-status-state.test.ts": 56,
+      "src/renderer/src/components/task-page-github-task-kind.test.ts": 56,
+      "src/renderer/src/components/task-page-github-work-item-filter-membership.test.ts": 51,
+      "src/renderer/src/components/task-page-github-work-item-mutation-patches.test.ts": 41,
+      "src/renderer/src/components/task-page-github-work-item-mutation-regressions.test.ts": 92,
+      "src/renderer/src/components/task-page-github-work-item-mutations.test.ts": 123,
+      "src/renderer/src/components/task-page-github-work-item-status.test.ts": 61,
+      "src/renderer/src/components/task-page-gitlab-task-filters.test.ts": 1702,
+      "src/renderer/src/components/task-page-initial-selection-scaling.test.tsx": 1727,
+      "src/renderer/src/components/task-page-jira-cache-selectors.test.ts": 56,
+      "src/renderer/src/components/task-page-jira-create-fields.test.ts": 51,
+      "src/renderer/src/components/task-page-jira-grouping.test.ts": 1262,
+      "src/renderer/src/components/task-page-jira-item-source-context.test.ts": 29,
+      "src/renderer/src/components/task-page-jira-load-state.test.ts": 55,
+      "src/renderer/src/components/task-page-jira-project-selection.test.ts": 57,
+      "src/renderer/src/components/task-page-jira-sort-controls.test.tsx": 932,
+      "src/renderer/src/components/task-page-jira-sorting.test.ts": 236,
+      "src/renderer/src/components/task-page-linear-in-orca-issues.test.ts": 79,
+      "src/renderer/src/components/task-page-linear-issue-dialog-popover-scroll.test.ts": 35,
+      "src/renderer/src/components/task-page-linear-issue-empty-state.test.ts": 45,
+      "src/renderer/src/components/task-page-linear-issue-grouping.test.ts": 966,
+      "src/renderer/src/components/task-page-linear-issue-request.test.ts": 52,
+      "src/renderer/src/components/task-page-linear-team-selection.test.ts": 45,
+      "src/renderer/src/components/task-page-list-chrome-visibility.test.ts": 41,
+      "src/renderer/src/components/task-page-localized-options.test.ts": 264,
+      "src/renderer/src/components/task-page-mutation-page-allocation.test.ts": 50,
+      "src/renderer/src/components/task-page-new-issue-draft.test.ts": 64,
+      "src/renderer/src/components/task-page-pagination-page-numbers.test.ts": 60,
+      "src/renderer/src/components/task-page-pr-check-summary.test.ts": 40,
+      "src/renderer/src/components/task-page-repo-source-context.test.ts": 1554,
+      "src/renderer/src/components/task-page-repo-source-divergence.test.ts": 1245,
+      "src/renderer/src/components/task-page-source-switch-boundary.test.ts": 258,
+      "src/renderer/src/components/task-page-task-creation-drafts.test.ts": 407,
+      "src/renderer/src/components/task-page-task-source-host-availability.test.ts": 1030,
+      "src/renderer/src/components/task-page-work-item-pagination.test.ts": 70,
+      "src/renderer/src/components/task-page-workspace-composer-boundary.test.ts": 463,
+      "src/renderer/src/components/task-source-context-summary.test.ts": 58,
+      "src/renderer/src/components/task-source-provider-availability.test.ts": 60,
+      "src/renderer/src/components/terminal-pane/CloseTerminalDialog.test.tsx": 1022,
+      "src/renderer/src/components/terminal-pane/MobileDriverOverlay.test.tsx": 466,
+      "src/renderer/src/components/terminal-pane/PinnedTabCloseDialog.test.tsx": 2509,
+      "src/renderer/src/components/terminal-pane/RunningTerminalCloseDialog.test.tsx": 1716,
+      "src/renderer/src/components/terminal-pane/SessionRestoredBanner.test.tsx": 306,
+      "src/renderer/src/components/terminal-pane/TerminalAgentSessionForkDialog.test.tsx": 220,
+      "src/renderer/src/components/terminal-pane/TerminalContextMenu.test.tsx": 1724,
+      "src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts": 911,
+      "src/renderer/src/components/terminal-pane/TerminalPaneHeaderOverlay.test.tsx": 1966,
+      "src/renderer/src/components/terminal-pane/TerminalPaneNativeChatPortal.test.tsx": 684,
+      "src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.react185.test.tsx": 1403,
+      "src/renderer/src/components/terminal-pane/TerminalProcessExitOverlay.test.tsx": 513,
+      "src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx": 580,
+      "src/renderer/src/components/terminal-pane/TerminalSshReconnectOverlay.test.tsx": 1805,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-attention-dispatch.test.ts": 217,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-completion-replay-guard.test.ts": 147,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-dispose-leak.test.ts": 170,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-hook-done-quiet-window.test.ts": 104,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-hook-title-precedence.test.ts": 135,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-monitoring-turn-end.test.ts": 186,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-pending-title-inspection.test.ts": 168,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-process-cadence.test.ts": 170,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-queued-inspection-disposal.test.ts": 119,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-stamped-turn-boundary.test.ts": 102,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-stamped-turn-replay.test.ts": 181,
+      "src/renderer/src/components/terminal-pane/agent-completion-no-evidence-cadence.test.ts": 966,
+      "src/renderer/src/components/terminal-pane/agent-completion-poll-interval.test.ts": 217,
+      "src/renderer/src/components/terminal-pane/agent-completion-stale-evidence-backoff.test.ts": 112,
+      "src/renderer/src/components/terminal-pane/agent-completion-steady-state-opt-in.test.ts": 123,
+      "src/renderer/src/components/terminal-pane/agent-hook-terminal-lifecycle.test.ts": 50,
+      "src/renderer/src/components/terminal-pane/agent-interrupt-inference.test.ts": 135,
+      "src/renderer/src/components/terminal-pane/agent-process-inspection-queue-rejection-containment.test.ts": 46,
+      "src/renderer/src/components/terminal-pane/agent-process-inspection-round.test.ts": 48,
+      "src/renderer/src/components/terminal-pane/agent-question-answered-inference.test.ts": 52,
+      "src/renderer/src/components/terminal-pane/cache-timer-seeding.test.ts": 84,
+      "src/renderer/src/components/terminal-pane/codex-backfill-error-detector.test.ts": 24,
+      "src/renderer/src/components/terminal-pane/codex-detached-pane-restart.test.ts": 1008,
+      "src/renderer/src/components/terminal-pane/command-code-done-settle.test.ts": 66,
+      "src/renderer/src/components/terminal-pane/command-code-output-ownership.test.ts": 34,
+      "src/renderer/src/components/terminal-pane/compose-active-terminal-theme.test.ts": 93,
+      "src/renderer/src/components/terminal-pane/deferred-reattach-live-data-queue.test.ts": 144,
+      "src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.test.ts": 50,
+      "src/renderer/src/components/terminal-pane/desktop-fit-fallback.test.ts": 61,
+      "src/renderer/src/components/terminal-pane/direct-ssh-hidden-output-restore-unavailable-banner.test.ts": 921,
+      "src/renderer/src/components/terminal-pane/edge-wrapped-terminal-http-links.test.ts": 1446,
+      "src/renderer/src/components/terminal-pane/expand-collapse-render-stability.test.ts": 2192,
+      "src/renderer/src/components/terminal-pane/expand-collapse.test.ts": 86,
+      "src/renderer/src/components/terminal-pane/focus-terminal-pane-event.test.ts": 43,
+      "src/renderer/src/components/terminal-pane/focused-pane-rim-flash.test.ts": 47,
+      "src/renderer/src/components/terminal-pane/git-bash-console-capacity.test.ts": 40,
+      "src/renderer/src/components/terminal-pane/hard-wrapped-terminal-http-links.test.ts": 69,
+      "src/renderer/src/components/terminal-pane/hidden-output-restore-scheduler.test.ts": 73,
+      "src/renderer/src/components/terminal-pane/hidden-reveal-reconciliation.fuzz.test.ts": 7285,
+      "src/renderer/src/components/terminal-pane/issue-12112-agent-pane-startup-color-reply-leak.repro.test.ts": 220,
+      "src/renderer/src/components/terminal-pane/issue-21762-tracking-mode-middle-click-double-paste.repro.test.ts": 657,
+      "src/renderer/src/components/terminal-pane/issue-4631-terminal-hover-link-provider.repro.test.ts": 769,
+      "src/renderer/src/components/terminal-pane/keyboard-handlers-ime-composing-chord.test.tsx": 2192,
+      "src/renderer/src/components/terminal-pane/keyboard-handlers-ime-enter-keyup.test.tsx": 2539,
+      "src/renderer/src/components/terminal-pane/keyboard-handlers-ime.test.tsx": 2043,
+      "src/renderer/src/components/terminal-pane/keyboard-handlers.test.ts": 1892,
+      "src/renderer/src/components/terminal-pane/layout-serialization.test.ts": 78,
+      "src/renderer/src/components/terminal-pane/leaf-scrollback-resolution.test.ts": 204,
+      "src/renderer/src/components/terminal-pane/manual-terminal-worktree-park-eligibility.test.ts": 1568,
+      "src/renderer/src/components/terminal-pane/merge-captured-leaf-state.test.ts": 39,
+      "src/renderer/src/components/terminal-pane/mobile-driver-overlay-collapse.test.ts": 29,
+      "src/renderer/src/components/terminal-pane/mobile-driver-overlay-focus.test.ts": 50,
+      "src/renderer/src/components/terminal-pane/mobile-driver-overlay-visibility.test.ts": 50,
+      "src/renderer/src/components/terminal-pane/mouse-hide-while-typing.test.ts": 53,
+      "src/renderer/src/components/terminal-pane/native-chat-leaf-title-agent.test.ts": 83,
+      "src/renderer/src/components/terminal-pane/osc52-clipboard-default-on-notice.test.ts": 389,
+      "src/renderer/src/components/terminal-pane/osc52-clipboard-toast.test.ts": 621,
+      "src/renderer/src/components/terminal-pane/osc52-clipboard.test.ts": 130,
+      "src/renderer/src/components/terminal-pane/override-affected-panes.test.ts": 49,
+      "src/renderer/src/components/terminal-pane/paired-parking-unverifiable-host.test.ts": 82,
+      "src/renderer/src/components/terminal-pane/paired-reconnect-multi-pane-materialization.test.ts": 2000,
+      "src/renderer/src/components/terminal-pane/pane-agent-session-id.test.ts": 28,
+      "src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts": 513,
+      "src/renderer/src/components/terminal-pane/pane-foreground-inspect-observation-identity.test.ts": 50,
+      "src/renderer/src/components/terminal-pane/pane-helpers.test.ts": 59,
+      "src/renderer/src/components/terminal-pane/pane-restart-transport-handoff.test.ts": 1459,
+      "src/renderer/src/components/terminal-pane/pane-title-overlay-rects.test.ts": 39,
+      "src/renderer/src/components/terminal-pane/pane-title-update-global-scan-budget.test.tsx": 3714,
+      "src/renderer/src/components/terminal-pane/parked-terminal-buffer-capture.test.ts": 183,
+      "src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts": 1531,
+      "src/renderer/src/components/terminal-pane/parked-terminal-command-status.test.ts": 130,
+      "src/renderer/src/components/terminal-pane/parked-terminal-tab-capture-episodes.test.ts": 150,
+      "src/renderer/src/components/terminal-pane/parse-osc7.test.ts": 56,
+      "src/renderer/src/components/terminal-pane/pending-pane-close-confirmation.test.ts": 1233,
+      "src/renderer/src/components/terminal-pane/pending-runtime-pane-close.test.ts": 1002,
+      "src/renderer/src/components/terminal-pane/pending-split-close.test.ts": 1013,
+      "src/renderer/src/components/terminal-pane/pty-buffer-serializer.test.ts": 32,
+      "src/renderer/src/components/terminal-pane/pty-connection-agent-session-resume.test.ts": 1595,
+      "src/renderer/src/components/terminal-pane/pty-connection-cold-restore-agent-resume.test.ts": 1581,
+      "src/renderer/src/components/terminal-pane/pty-connection-cold-restore-repaint.test.ts": 1145,
+      "src/renderer/src/components/terminal-pane/pty-connection-cold-restore-resume-command.test.ts": 1253,
+      "src/renderer/src/components/terminal-pane/pty-connection-command-finished-cleanup.test.ts": 7780,
+      "src/renderer/src/components/terminal-pane/pty-connection-daemon-snapshot-replay.test.ts": 1637,
+      "src/renderer/src/components/terminal-pane/pty-connection-deferred-reattach-live-output.test.ts": 1762,
+      "src/renderer/src/components/terminal-pane/pty-connection-deferred-ssh-passphrase.test.ts": 642,
+      "src/renderer/src/components/terminal-pane/pty-connection-deliberate-sleep-guard.test.ts": 1014,
+      "src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-reattach-retry.test.ts": 1017,
+      "src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-spawn-retry.test.ts": 1177,
+      "src/renderer/src/components/terminal-pane/pty-connection-foreground-agent-routing.test.ts": 960,
+      "src/renderer/src/components/terminal-pane/pty-connection-foreground-agent-sampling.test.ts": 1709,
+      "src/renderer/src/components/terminal-pane/pty-connection-foreground-routing-confirmation.test.ts": 994,
+      "src/renderer/src/components/terminal-pane/pty-connection-foreground-write-path.test.ts": 1595,
+      "src/renderer/src/components/terminal-pane/pty-connection-fresh-spawn-guards.test.ts": 1457,
+      "src/renderer/src/components/terminal-pane/pty-connection-hibernation-wake.test.ts": 1511,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-atlas-recovery.test.ts": 1949,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-reconciliation.test.ts": 2482,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts": 2106,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-codex-queries.test.ts": 1397,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-delivery-gate.test.ts": 1974,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-output-restore.test.ts": 1212,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-query-snapshot-restore.test.ts": 1575,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-restore-fit-overflow.test.ts": 993,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-snapshot-live-overlap.test.ts": 903,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-snapshot-resize-signals.test.ts": 2255,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.test.ts": 796,
+      "src/renderer/src/components/terminal-pane/pty-connection-hook-completion-bell-arbitration.test.ts": 1097,
+      "src/renderer/src/components/terminal-pane/pty-connection-hook-completion-side-effects.test.ts": 1520,
+      "src/renderer/src/components/terminal-pane/pty-connection-hook-idle-arbitration.test.ts": 1109,
+      "src/renderer/src/components/terminal-pane/pty-connection-interrupt-inference.test.ts": 1194,
+      "src/renderer/src/components/terminal-pane/pty-connection-main-side-effect-authority.test.ts": 1194,
+      "src/renderer/src/components/terminal-pane/pty-connection-mode-2031-subscriptions.test.ts": 1082,
+      "src/renderer/src/components/terminal-pane/pty-connection-notification-settings-gating.test.ts": 1779,
+      "src/renderer/src/components/terminal-pane/pty-connection-parked-ssh-snapshot.test.ts": 1899,
+      "src/renderer/src/components/terminal-pane/pty-connection-pi-synchronized-input.test.ts": 595,
+      "src/renderer/src/components/terminal-pane/pty-connection-post-dispose-restore-termination.test.ts": 829,
+      "src/renderer/src/components/terminal-pane/pty-connection-pty-exit-teardown.test.ts": 6007,
+      "src/renderer/src/components/terminal-pane/pty-connection-queued-startup-consume.test.ts": 1073,
+      "src/renderer/src/components/terminal-pane/pty-connection-reattach-binding.test.ts": 4696,
+      "src/renderer/src/components/terminal-pane/pty-connection-reattach-mode-reset.test.ts": 4241,
+      "src/renderer/src/components/terminal-pane/pty-connection-remote-runtime-attach.test.ts": 2097,
+      "src/renderer/src/components/terminal-pane/pty-connection-remote-snapshot-source-grid.test.ts": 852,
+      "src/renderer/src/components/terminal-pane/pty-connection-renderer-risk-repaint.test.ts": 1509,
+      "src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts": 1105,
+      "src/renderer/src/components/terminal-pane/pty-connection-restored-baseline-shortfall.test.ts": 676,
+      "src/renderer/src/components/terminal-pane/pty-connection-runtime-owner-spawn-routing.test.ts": 889,
+      "src/renderer/src/components/terminal-pane/pty-connection-session-liveness.test.ts": 1647,
+      "src/renderer/src/components/terminal-pane/pty-connection-setup-split-spawn.test.ts": 1562,
+      "src/renderer/src/components/terminal-pane/pty-connection-sleeping-resume-banner.test.ts": 1195,
+      "src/renderer/src/components/terminal-pane/pty-connection-spawn-left-pane-unbound.test.ts": 703,
+      "src/renderer/src/components/terminal-pane/pty-connection-split-cwd-resolution.test.ts": 729,
+      "src/renderer/src/components/terminal-pane/pty-connection-ssh-startup-draft-delivery.test.ts": 1351,
+      "src/renderer/src/components/terminal-pane/pty-connection-stalled-hidden-restore.test.ts": 2466,
+      "src/renderer/src/components/terminal-pane/pty-connection-startup-command-delivery.test.ts": 964,
+      "src/renderer/src/components/terminal-pane/pty-connection-task-complete-dispatch.test.ts": 1078,
+      "src/renderer/src/components/terminal-pane/pty-connection-terminal-input-gating.test.ts": 5951,
+      "src/renderer/src/components/terminal-pane/pty-connection-typed-agent-identity.test.ts": 1837,
+      "src/renderer/src/components/terminal-pane/pty-connection-visibility-resume-size.test.ts": 1270,
+      "src/renderer/src/components/terminal-pane/pty-connection-visible-pane-output-pause-latch.test.ts": 926,
+      "src/renderer/src/components/terminal-pane/pty-connection-windows-cjk-repaint.test.ts": 1272,
+      "src/renderer/src/components/terminal-pane/pty-connection-windows-keyboard-reset.test.ts": 1294,
+      "src/renderer/src/components/terminal-pane/pty-connection/direct-ssh-reattach-recovery.test.ts": 37,
+      "src/renderer/src/components/terminal-pane/pty-connection/disposed-spawn-retention.test.ts": 65,
+      "src/renderer/src/components/terminal-pane/pty-connection/foreground-output-budgets.test.ts": 52,
+      "src/renderer/src/components/terminal-pane/pty-connection/foreground-output-scan.test.ts": 63,
+      "src/renderer/src/components/terminal-pane/pty-connection/foreground-renderer-risk-scan-tail.test.ts": 74,
+      "src/renderer/src/components/terminal-pane/pty-connection/pane-pty-layout-binding.test.ts": 33,
+      "src/renderer/src/components/terminal-pane/pty-connection/park-reveal-snapshot-verdict.test.ts": 993,
+      "src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-context.test.ts": 1537,
+      "src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-ssh-reconnect-model-paint.test.ts": 1308,
+      "src/renderer/src/components/terminal-pane/pty-connection/reattach-result-handler-park-reveal-verdict.test.ts": 167,
+      "src/renderer/src/components/terminal-pane/pty-connection/reattach-success-settle.test.ts": 186,
+      "src/renderer/src/components/terminal-pane/pty-connection/ssh-session-gone-verdict.test.ts": 42,
+      "src/renderer/src/components/terminal-pane/pty-connection/terminal-tab-id.test.ts": 41,
+      "src/renderer/src/components/terminal-pane/pty-connection/unbound-pane-spawn-recovery.test.ts": 51,
+      "src/renderer/src/components/terminal-pane/pty-connection/write-pty-output-to-xterm-startup-callback.test.ts": 69,
+      "src/renderer/src/components/terminal-pane/pty-dispatcher-delivery-interest.test.ts": 196,
+      "src/renderer/src/components/terminal-pane/pty-dispatcher-delivery-resync.test.ts": 71,
+      "src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts": 389,
+      "src/renderer/src/components/terminal-pane/pty-dispatcher-push-reattach.test.ts": 142,
+      "src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts": 877,
+      "src/renderer/src/components/terminal-pane/pty-model-restore-channel.test.ts": 33,
+      "src/renderer/src/components/terminal-pane/pty-pre-handler-buffer-warn-eviction.test.ts": 55,
+      "src/renderer/src/components/terminal-pane/pty-pre-handler-buffer.test.ts": 107,
+      "src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.test.ts": 56,
+      "src/renderer/src/components/terminal-pane/pty-renderer-delivery-claims.test.ts": 61,
+      "src/renderer/src/components/terminal-pane/pty-shutdown-data-suspension.test.ts": 42,
+      "src/renderer/src/components/terminal-pane/pty-shutdown-exit-deferral.test.ts": 133,
+      "src/renderer/src/components/terminal-pane/pty-shutdown-output-queue.test.ts": 2353,
+      "src/renderer/src/components/terminal-pane/pty-side-effect-pending-census.test.ts": 138,
+      "src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts": 49,
+      "src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts": 60,
+      "src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts": 435,
+      "src/renderer/src/components/terminal-pane/pty-transport-detach-attach-handoff.test.ts": 310,
+      "src/renderer/src/components/terminal-pane/pty-transport-eager-buffer-replay.test.ts": 520,
+      "src/renderer/src/components/terminal-pane/pty-transport-handler-suspension.test.ts": 277,
+      "src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts": 1210,
+      "src/renderer/src/components/terminal-pane/pty-transport-output-side-effects.test.ts": 603,
+      "src/renderer/src/components/terminal-pane/pty-transport-pi-coalesce.test.ts": 229,
+      "src/renderer/src/components/terminal-pane/pty-transport-pi-spinner.test.ts": 233,
+      "src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts": 363,
+      "src/renderer/src/components/terminal-pane/pty-transport-recycled-pty-incarnation.test.ts": 258,
+      "src/renderer/src/components/terminal-pane/pty-transport-spawn-errors.test.ts": 189,
+      "src/renderer/src/components/terminal-pane/regular-terminal-focus-ownership.test.ts": 459,
+      "src/renderer/src/components/terminal-pane/remote-desktop-viewport-claim.test.ts": 55,
+      "src/renderer/src/components/terminal-pane/remote-execution-host-pty.test.ts": 1028,
+      "src/renderer/src/components/terminal-pane/remote-hidden-output-restore-outcomes.test.ts": 1239,
+      "src/renderer/src/components/terminal-pane/remote-hidden-output-restore-unavailable-banner.repro.test.ts": 873,
+      "src/renderer/src/components/terminal-pane/remote-layout-scrollback-retention.test.ts": 43,
+      "src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts": 66,
+      "src/renderer/src/components/terminal-pane/remote-park-reveal-unverifiable-retry.test.ts": 567,
+      "src/renderer/src/components/terminal-pane/remote-runtime-connect-failure-recovery.test.ts": 1496,
+      "src/renderer/src/components/terminal-pane/remote-runtime-error-surface-dismissal.test.ts": 1919,
+      "src/renderer/src/components/terminal-pane/remote-runtime-outage-toast-flood-and-stuck-reconnect.test.ts": 1098,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-batching.test.ts": 119,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-deadline-reattach.test.ts": 2442,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-latched-pane-retention.test.ts": 5019,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-query-reply-immediate.test.ts": 2214,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts": 79,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-snapshot-escape-tail.test.ts": 1574,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-snapshot-source-grid.test.ts": 1311,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-activation-inventory-fallback.test.ts": 1933,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts": 3688,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-handoff.test.ts": 2192,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-outcome-recovery.test.ts": 2020,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-end-verdict.test.ts": 1894,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-expired-pane-recovery.test.ts": 2760,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-absence-evidence.test.ts": 1849,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts": 2998,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts": 5439,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-coalescing.test.ts": 5313,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts": 1946,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-pane-handle-resolution.test.ts": 3291,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-pending-host-surface-attach.test.ts": 2620,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-snapshot-replay.test.ts": 2114,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-split-leaf-activation.test.ts": 3201,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stale-handle-recovery.test.ts": 2981,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-sticky-replacement-policy.test.ts": 2126,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts": 4074,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-web-mirror-recovery.test.ts": 2942,
+      "src/renderer/src/components/terminal-pane/remote-runtime-resubscribe-failure-recovery-routing.test.ts": 3115,
+      "src/renderer/src/components/terminal-pane/renderer-owned-agent-status-registry.test.ts": 34,
+      "src/renderer/src/components/terminal-pane/replay-guard.test.ts": 130,
+      "src/renderer/src/components/terminal-pane/replayed-scrollback-store-release.test.ts": 147,
+      "src/renderer/src/components/terminal-pane/repro-8299-shift-space-input-source.test.ts": 167,
+      "src/renderer/src/components/terminal-pane/repro-8832-url-next-line.test.ts": 1961,
+      "src/renderer/src/components/terminal-pane/resolve-split-cwd.test.ts": 1427,
+      "src/renderer/src/components/terminal-pane/restored-snapshot-coverage.test.ts": 91,
+      "src/renderer/src/components/terminal-pane/scan22-ssh-new-tab-disposed-spawn-kill.repro.test.ts": 176,
+      "src/renderer/src/components/terminal-pane/session-restored-banner-pane-state.test.tsx": 409,
+      "src/renderer/src/components/terminal-pane/shell-ready-marker-scan.test.ts": 39,
+      "src/renderer/src/components/terminal-pane/shutdown-buffer-captures.test.ts": 48,
+      "src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.test.ts": 75,
+      "src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts": 36,
+      "src/renderer/src/components/terminal-pane/ssh-pane-connect-gate.test.ts": 48,
+      "src/renderer/src/components/terminal-pane/ssh-reattach-model-restore.test.ts": 67,
+      "src/renderer/src/components/terminal-pane/ssh-reconnect-model-paint-gate.test.ts": 51,
+      "src/renderer/src/components/terminal-pane/stale-document-visibility.test.ts": 43,
+      "src/renderer/src/components/terminal-pane/terminal-agent-paste-bracketing.test.ts": 59,
+      "src/renderer/src/components/terminal-pane/terminal-agent-session-continuation.test.ts": 101,
+      "src/renderer/src/components/terminal-pane/terminal-agent-session-fork.test.ts": 599,
+      "src/renderer/src/components/terminal-pane/terminal-alternate-screen-parse.test.ts": 124,
+      "src/renderer/src/components/terminal-pane/terminal-appearance.test.ts": 303,
+      "src/renderer/src/components/terminal-pane/terminal-attention-surface.test.ts": 1639,
+      "src/renderer/src/components/terminal-pane/terminal-bracketed-paste.test.ts": 33,
+      "src/renderer/src/components/terminal-pane/terminal-capability-replies.test.ts": 144,
+      "src/renderer/src/components/terminal-pane/terminal-capped-buffer-retention.test.ts": 379,
+      "src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.test.ts": 39,
+      "src/renderer/src/components/terminal-pane/terminal-chat-ownership-lifecycle.test.tsx": 1028,
+      "src/renderer/src/components/terminal-pane/terminal-cjk-cursor-cell-placement.test.ts": 562,
+      "src/renderer/src/components/terminal-pane/terminal-clipboard-event-paste.test.ts": 57,
+      "src/renderer/src/components/terminal-pane/terminal-clipboard-paste.test.ts": 97,
+      "src/renderer/src/components/terminal-pane/terminal-clipboard-selection-text.test.ts": 63,
+      "src/renderer/src/components/terminal-pane/terminal-cold-park-exempt-flip.react185.test.tsx": 1585,
+      "src/renderer/src/components/terminal-pane/terminal-cold-park-pre-gate-loop.react185.test.tsx": 581,
+      "src/renderer/src/components/terminal-pane/terminal-cold-park-recheck-deadlines.test.ts": 1522,
+      "src/renderer/src/components/terminal-pane/terminal-cold-park-subscription-narrowing.react185.test.tsx": 729,
+      "src/renderer/src/components/terminal-pane/terminal-cold-park-tab-model-identity.react185.test.tsx": 946,
+      "src/renderer/src/components/terminal-pane/terminal-cold-park-timer-rearm.test.tsx": 704,
+      "src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx": 587,
+      "src/renderer/src/components/terminal-pane/terminal-cold-park-withheld-tabs.test.ts": 54,
+      "src/renderer/src/components/terminal-pane/terminal-command-lifecycle.test.ts": 42,
+      "src/renderer/src/components/terminal-pane/terminal-context-menu-dismiss.test.ts": 31,
+      "src/renderer/src/components/terminal-pane/terminal-copy-rejection-handling.test.ts": 49,
+      "src/renderer/src/components/terminal-pane/terminal-ctrl-arrow-conpty.test.ts": 868,
+      "src/renderer/src/components/terminal-pane/terminal-ctrl-enter.test.ts": 86,
+      "src/renderer/src/components/terminal-pane/terminal-cursor-appearance-precedence.test.ts": 525,
+      "src/renderer/src/components/terminal-pane/terminal-cursor-inactive-style.test.ts": 205,
+      "src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts": 39,
+      "src/renderer/src/components/terminal-pane/terminal-delivery-watchdog.test.ts": 73,
+      "src/renderer/src/components/terminal-pane/terminal-drop-handler.test.ts": 346,
+      "src/renderer/src/components/terminal-pane/terminal-drop-image-path.test.ts": 56,
+      "src/renderer/src/components/terminal-pane/terminal-drop-internal-handler.test.ts": 411,
+      "src/renderer/src/components/terminal-pane/terminal-drop-path-writer.test.ts": 72,
+      "src/renderer/src/components/terminal-pane/terminal-drop-runtime-owner.test.ts": 115,
+      "src/renderer/src/components/terminal-pane/terminal-drop-shell.test.ts": 46,
+      "src/renderer/src/components/terminal-pane/terminal-drop-upload-report.test.ts": 52,
+      "src/renderer/src/components/terminal-pane/terminal-drop-write-failure.test.ts": 52,
+      "src/renderer/src/components/terminal-pane/terminal-error-accumulation.test.ts": 223,
+      "src/renderer/src/components/terminal-pane/terminal-error-remote-closed-localization.test.ts": 289,
+      "src/renderer/src/components/terminal-pane/terminal-eviction-exempt-tabs.test.ts": 809,
+      "src/renderer/src/components/terminal-pane/terminal-file-link-actions.test.ts": 195,
+      "src/renderer/src/components/terminal-pane/terminal-fit-restore.test.ts": 85,
+      "src/renderer/src/components/terminal-pane/terminal-freeze-report.test.ts": 73,
+      "src/renderer/src/components/terminal-pane/terminal-handle-copy.test.ts": 70,
+      "src/renderer/src/components/terminal-pane/terminal-handle-links.test.ts": 354,
+      "src/renderer/src/components/terminal-pane/terminal-hidden-restore-scrollback.test.ts": 23,
+      "src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts": 966,
+      "src/renderer/src/components/terminal-pane/terminal-hidden-worktree-retention.test.ts": 851,
+      "src/renderer/src/components/terminal-pane/terminal-http-link-activation.test.ts": 173,
+      "src/renderer/src/components/terminal-pane/terminal-http-link-source-owner.test.ts": 76,
+      "src/renderer/src/components/terminal-pane/terminal-http-url-extraction.test.ts": 53,
+      "src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts": 57,
+      "src/renderer/src/components/terminal-pane/terminal-ime-composer-placeholder-mask.test.ts": 1182,
+      "src/renderer/src/components/terminal-pane/terminal-ime-composition-route.test.ts": 281,
+      "src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts": 479,
+      "src/renderer/src/components/terminal-pane/terminal-ime-composition-transaction-ownership.test.ts": 249,
+      "src/renderer/src/components/terminal-pane/terminal-ime-deferred-chord.test.ts": 324,
+      "src/renderer/src/components/terminal-pane/terminal-ime-deferred-newline.test.ts": 383,
+      "src/renderer/src/components/terminal-pane/terminal-ime-forwarder-space-claim.test.ts": 356,
+      "src/renderer/src/components/terminal-pane/terminal-ime-hangul-syllable-flush.test.ts": 1285,
+      "src/renderer/src/components/terminal-pane/terminal-ime-hangul-terminating-digit.test.ts": 268,
+      "src/renderer/src/components/terminal-pane/terminal-ime-input-context-refresh.test.ts": 395,
+      "src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts": 72,
+      "src/renderer/src/components/terminal-pane/terminal-ime-linux-claimed-preedit-release.test.ts": 546,
+      "src/renderer/src/components/terminal-pane/terminal-ime-linux-claimed-preedit-selector.test.ts": 104,
+      "src/renderer/src/components/terminal-pane/terminal-ime-macos-keybinding-dict-trace.test.ts": 482,
+      "src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts": 429,
+      "src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts": 703,
+      "src/renderer/src/components/terminal-pane/terminal-ime-won-composition-order.test.ts": 989,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-adversarial.test.ts": 4544,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-cancelled-preedit-visibility.test.ts": 606,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-composition-cancel.test.ts": 885,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-composition-deduplication.test.ts": 2544,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-consumed-key-commit.test.ts": 634,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-korean-enter-commit-order.test.ts": 670,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-linux-native-trace-replay.test.ts": 4862,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-midline-preedit-tail.test.ts": 1276,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-preedit-cell-grid.test.ts": 2107,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-resumed-preedit-visibility.test.ts": 897,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-trailing-preedit-occlusion.test.ts": 965,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-transaction-events.test.ts": 899,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-windows-resumed-preedit-trace.test.ts": 900,
+      "src/renderer/src/components/terminal-pane/terminal-inline-image-da1.test.ts": 118,
+      "src/renderer/src/components/terminal-pane/terminal-input-host-platform.test.ts": 1508,
+      "src/renderer/src/components/terminal-pane/terminal-input-quarantine.test.ts": 46,
+      "src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit-coexistence.test.ts": 869,
+      "src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit-device-trace.test.ts": 656,
+      "src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit.test.ts": 683,
+      "src/renderer/src/components/terminal-pane/terminal-jis-yen-input.test.ts": 40,
+      "src/renderer/src/components/terminal-pane/terminal-keyboard-event-handlers-focus.test.ts": 2134,
+      "src/renderer/src/components/terminal-pane/terminal-keyboard-pane-resolution.test.ts": 355,
+      "src/renderer/src/components/terminal-pane/terminal-keyboard-protocol-pane-agent.test.ts": 38,
+      "src/renderer/src/components/terminal-pane/terminal-keyboard-search-dispatch.test.ts": 1683,
+      "src/renderer/src/components/terminal-pane/terminal-kitty-csi-u-encoding.test.ts": 39,
+      "src/renderer/src/components/terminal-pane/terminal-layout-duplicate-pty-replay.test.ts": 73,
+      "src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.test.ts": 62,
+      "src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.test.ts": 39,
+      "src/renderer/src/components/terminal-pane/terminal-layout-overlay-focus.test.tsx": 328,
+      "src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership-depth.test.ts": 103,
+      "src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.test.ts": 111,
+      "src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts": 1448,
+      "src/renderer/src/components/terminal-pane/terminal-link-activation.test.ts": 226,
+      "src/renderer/src/components/terminal-pane/terminal-link-click-behavior.test.ts": 33,
+      "src/renderer/src/components/terminal-pane/terminal-link-click-fallback.test.ts": 902,
+      "src/renderer/src/components/terminal-pane/terminal-link-file-open-routing.test.ts": 549,
+      "src/renderer/src/components/terminal-pane/terminal-link-missing-file-open.test.ts": 398,
+      "src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts": 263,
+      "src/renderer/src/components/terminal-pane/terminal-link-osc-file-targets.test.ts": 659,
+      "src/renderer/src/components/terminal-pane/terminal-link-osc-url-routing.test.ts": 384,
+      "src/renderer/src/components/terminal-pane/terminal-link-pointer-gesture.test.ts": 642,
+      "src/renderer/src/components/terminal-pane/terminal-link-provider-batching.test.ts": 478,
+      "src/renderer/src/components/terminal-pane/terminal-link-provider-link-detection.test.ts": 687,
+      "src/renderer/src/components/terminal-pane/terminal-link-pty-mouse-suppression.test.ts": 716,
+      "src/renderer/src/components/terminal-pane/terminal-link-remote-runtime-ssh-open.test.ts": 470,
+      "src/renderer/src/components/terminal-pane/terminal-link-worktree-root-activation.test.ts": 412,
+      "src/renderer/src/components/terminal-pane/terminal-link-wsl-path-mapping.test.ts": 497,
+      "src/renderer/src/components/terminal-pane/terminal-linkifier-click-priming.test.ts": 191,
+      "src/renderer/src/components/terminal-pane/terminal-live-layout-reconciliation.test.ts": 1437,
+      "src/renderer/src/components/terminal-pane/terminal-native-copy-gutter.test.ts": 296,
+      "src/renderer/src/components/terminal-pane/terminal-non-latin-control-chord.test.ts": 66,
+      "src/renderer/src/components/terminal-pane/terminal-notification-state.test.ts": 960,
+      "src/renderer/src/components/terminal-pane/terminal-option-kitty-release.test.ts": 47,
+      "src/renderer/src/components/terminal-pane/terminal-output-visibility.test.ts": 32,
+      "src/renderer/src/components/terminal-pane/terminal-pane-attention-subscriptions.test.ts": 64,
+      "src/renderer/src/components/terminal-pane/terminal-pane-close-identity.test.ts": 51,
+      "src/renderer/src/components/terminal-pane/terminal-pane-hook-order-parity.test.ts": 504,
+      "src/renderer/src/components/terminal-pane/terminal-pane-host-state-memo.test.ts": 1306,
+      "src/renderer/src/components/terminal-pane/terminal-pane-host-state.test.ts": 1222,
+      "src/renderer/src/components/terminal-pane/terminal-pane-listener-order-parity.test.ts": 491,
+      "src/renderer/src/components/terminal-pane/terminal-pane-recovery-unsettled-fallback.test.ts": 362,
+      "src/renderer/src/components/terminal-pane/terminal-pane-recovery.test.ts": 289,
+      "src/renderer/src/components/terminal-pane/terminal-pane-split-completion.test.ts": 38,
+      "src/renderer/src/components/terminal-pane/terminal-pane-split-request-routing.test.ts": 401,
+      "src/renderer/src/components/terminal-pane/terminal-pane-split-with-inherited-cwd.test.ts": 89,
+      "src/renderer/src/components/terminal-pane/terminal-pane-split-writer-paths.test.ts": 2320,
+      "src/renderer/src/components/terminal-pane/terminal-pane-store-subscription-budget.test.tsx": 5213,
+      "src/renderer/src/components/terminal-pane/terminal-pane-surface-ownership.test.ts": 254,
+      "src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts": 119,
+      "src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.test.ts": 116,
+      "src/renderer/src/components/terminal-pane/terminal-park-verdict-worktree-driver-loop.test.tsx": 741,
+      "src/renderer/src/components/terminal-pane/terminal-parked-pane-candidates.test.ts": 1367,
+      "src/renderer/src/components/terminal-pane/terminal-parked-tab-eviction-exemption.test.ts": 298,
+      "src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers-batch-sync.test.ts": 253,
+      "src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts": 1059,
+      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-partial-reconciliation.test.ts": 262,
+      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts": 161,
+      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-registry.test.ts": 184,
+      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-sleep-preserved-exit.test.ts": 189,
+      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-sole-newborn-exit.test.ts": 316,
+      "src/renderer/src/components/terminal-pane/terminal-parking-e2e-overrides.test.ts": 2679,
+      "src/renderer/src/components/terminal-pane/terminal-parser-handler-guard.test.ts": 62,
+      "src/renderer/src/components/terminal-pane/terminal-paste-coordinator.test.ts": 105,
+      "src/renderer/src/components/terminal-pane/terminal-paste-executor-default-yield.test.ts": 52,
+      "src/renderer/src/components/terminal-pane/terminal-paste-multiline-policy.test.ts": 72,
+      "src/renderer/src/components/terminal-pane/terminal-paste-operation-order.test.ts": 1530,
+      "src/renderer/src/components/terminal-pane/terminal-paste-payload-metadata.test.ts": 45,
+      "src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts": 39,
+      "src/renderer/src/components/terminal-pane/terminal-paste-target-state.test.ts": 52,
+      "src/renderer/src/components/terminal-pane/terminal-path-existence-batch.test.ts": 40,
+      "src/renderer/src/components/terminal-pane/terminal-process-exit-restart.test.ts": 49,
+      "src/renderer/src/components/terminal-pane/terminal-programmatic-text-paste.test.ts": 1734,
+      "src/renderer/src/components/terminal-pane/terminal-pty-ack-gate.test.ts": 335,
+      "src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.test.ts": 28,
+      "src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.test.ts": 71,
+      "src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts": 42,
+      "src/renderer/src/components/terminal-pane/terminal-render-desync-evidence-persistence.test.ts": 67,
+      "src/renderer/src/components/terminal-pane/terminal-render-desync-frame.test.ts": 67,
+      "src/renderer/src/components/terminal-pane/terminal-render-desync-sentinel.test.ts": 430,
+      "src/renderer/src/components/terminal-pane/terminal-render-desync-weight-probe.test.ts": 52,
+      "src/renderer/src/components/terminal-pane/terminal-renderer-policy.test.ts": 115,
+      "src/renderer/src/components/terminal-pane/terminal-replay-application-continuity.test.ts": 363,
+      "src/renderer/src/components/terminal-pane/terminal-replay-cursor-state.test.ts": 117,
+      "src/renderer/src/components/terminal-pane/terminal-restore-sgr-latch.test.ts": 179,
+      "src/renderer/src/components/terminal-pane/terminal-restored-viewport.test.ts": 42,
+      "src/renderer/src/components/terminal-pane/terminal-retention-churn-pins.test.tsx": 569,
+      "src/renderer/src/components/terminal-pane/terminal-retention-exempt-growth.test.ts": 1509,
+      "src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts": 2008,
+      "src/renderer/src/components/terminal-pane/terminal-selection-copy.test.ts": 980,
+      "src/renderer/src/components/terminal-pane/terminal-selection-fit-guard.test.ts": 37,
+      "src/renderer/src/components/terminal-pane/terminal-shortcut-ctrl-arrow.test.ts": 57,
+      "src/renderer/src/components/terminal-pane/terminal-shortcut-option-compose.test.ts": 120,
+      "src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts": 133,
+      "src/renderer/src/components/terminal-pane/terminal-shortcut-select-all.test.ts": 85,
+      "src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.test.ts": 90,
+      "src/renderer/src/components/terminal-pane/terminal-side-effect-facts-handler.test.ts": 36,
+      "src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.test.ts": 704,
+      "src/renderer/src/components/terminal-pane/terminal-startup-command-classifier.test.ts": 44,
+      "src/renderer/src/components/terminal-pane/terminal-startup-grid-settle.test.ts": 56,
+      "src/renderer/src/components/terminal-pane/terminal-startup-timing-scheduler.test.ts": 114,
+      "src/renderer/src/components/terminal-pane/terminal-startup-timing.test.ts": 62,
+      "src/renderer/src/components/terminal-pane/terminal-tab-agent-type-index.test.ts": 58,
+      "src/renderer/src/components/terminal-pane/terminal-tab-lookup.test.ts": 30,
+      "src/renderer/src/components/terminal-pane/terminal-title-evidence.test.ts": 84,
+      "src/renderer/src/components/terminal-pane/terminal-title-tracker-parity.test.ts": 263,
+      "src/renderer/src/components/terminal-pane/terminal-unified-tab-lookup.test.ts": 42,
+      "src/renderer/src/components/terminal-pane/terminal-url-link-click.test.ts": 1229,
+      "src/renderer/src/components/terminal-pane/terminal-url-link-hit-testing.test.ts": 1570,
+      "src/renderer/src/components/terminal-pane/terminal-user-input-signal.test.ts": 160,
+      "src/renderer/src/components/terminal-pane/terminal-view-attributes-publisher.test.ts": 274,
+      "src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts": 1249,
+      "src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts": 41,
+      "src/renderer/src/components/terminal-pane/terminal-webgl-diagnostics-breadcrumbs.test.ts": 71,
+      "src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts": 65,
+      "src/renderer/src/components/terminal-pane/terminal-worktree-path-link.test.ts": 1613,
+      "src/renderer/src/components/terminal-pane/title-agent-identity.test.ts": 35,
+      "src/renderer/src/components/terminal-pane/use-manual-terminal-worktree-parking.test.ts": 1809,
+      "src/renderer/src/components/terminal-pane/use-mobile-overlay-ticks.perf.test.tsx": 764,
+      "src/renderer/src/components/terminal-pane/use-notification-dispatch.test.ts": 291,
+      "src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.react185.test.tsx": 587,
+      "src/renderer/src/components/terminal-pane/use-system-prefers-dark.test.ts": 45,
+      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-active-pty-reporting.test.ts": 1301,
+      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-file-drop.test.ts": 1219,
+      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-paste-events.test.ts": 1149,
+      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-sync-fit-registration.test.ts": 1211,
+      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-visibility-resume.test.ts": 1904,
+      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-window-focus-recovery.test.ts": 1363,
+      "src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts": 2216,
+      "src/renderer/src/components/terminal-pane/use-terminal-park-mount-intent.react185.test.tsx": 627,
+      "src/renderer/src/components/terminal-pane/use-terminal-scroll-visibility-memory.test.ts": 50,
+      "src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts": 975,
+      "src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts": 611,
+      "src/renderer/src/components/terminal-pane/use-visible-terminal-tab-claim.test.ts": 72,
+      "src/renderer/src/components/terminal-pane/useSessionRestoredBannerDismiss.test.tsx": 511,
+      "src/renderer/src/components/terminal-pane/useTerminalFontZoom.test.ts": 340,
+      "src/renderer/src/components/terminal-pane/wrapped-terminal-link-ranges.test.ts": 74,
+      "src/renderer/src/components/terminal-pane/xterm-bypass-policy-interrupt.test.ts": 77,
+      "src/renderer/src/components/terminal-pane/xterm-bypass-policy-ios.test.ts": 142,
+      "src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts": 52,
+      "src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts": 62,
+      "src/renderer/src/components/terminal-pane/xterm-write-buffer-stall.repro.test.ts": 82,
+      "src/renderer/src/components/terminal-parked-watcher-sync-entries.test.tsx": 994,
+      "src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialog.test.tsx": 1832,
+      "src/renderer/src/components/terminal-quick-commands/terminal-quick-command-agent-options.test.ts": 177,
+      "src/renderer/src/components/terminal-quick-commands/terminal-quick-command-dialog-draft.test.ts": 241,
+      "src/renderer/src/components/terminal-scrollback-decoration-eviction.test.ts": 1037,
+      "src/renderer/src/components/terminal-search-decoration-leak.test.ts": 2437,
+      "src/renderer/src/components/terminal-search-long-wrapped-line.test.ts": 5608,
+      "src/renderer/src/components/terminal-search-safe-find.test.ts": 51,
+      "src/renderer/src/components/terminal-workspace-keydown.test.ts": 822,
+      "src/renderer/src/components/terminal-workspace-surface-ids.test.tsx": 2751,
+      "src/renderer/src/components/terminal/activation-deferred-tab-admission.test.ts": 55,
+      "src/renderer/src/components/terminal/active-terminal-repair-loop.react185.test.tsx": 1990,
+      "src/renderer/src/components/terminal/active-terminal-repair.test.ts": 47,
+      "src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts": 1529,
+      "src/renderer/src/components/terminal/background-terminal-worktree-visibility.test.ts": 43,
+      "src/renderer/src/components/terminal/cold-activation-deferral-stranding.test.ts": 1885,
+      "src/renderer/src/components/terminal/initial-terminal-structured-launch.test.tsx": 556,
+      "src/renderer/src/components/terminal/initial-terminal-wiring.test.ts": 41,
+      "src/renderer/src/components/terminal/initial-terminal.test.ts": 48,
+      "src/renderer/src/components/terminal/pty-running-work-probe-child-evidence.test.ts": 33,
+      "src/renderer/src/components/terminal/running-terminal-close-guard.test.ts": 67,
+      "src/renderer/src/components/terminal/split-group-mount.test.ts": 30,
+      "src/renderer/src/components/terminal/tab-type-cycle.test.ts": 46,
+      "src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts": 226,
+      "src/renderer/src/components/terminal/terminal-close-copy-kind.test.ts": 67,
+      "src/renderer/src/components/terminal/terminal-close-incarnation.test.ts": 70,
+      "src/renderer/src/components/terminal/terminal-provider-snapshot-bound-pty-ids.test.ts": 2039,
+      "src/renderer/src/components/terminal/terminal-provider-snapshot-capability-resettlement.test.ts": 1467,
+      "src/renderer/src/components/terminal/terminal-provider-snapshot-capability.test.ts": 65,
+      "src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts": 294,
+      "src/renderer/src/components/terminal/terminal-tab-actions-unified-close.test.ts": 1627,
+      "src/renderer/src/components/terminal/terminal-tab-actions.test.ts": 322,
+      "src/renderer/src/components/terminal/terminal-tab-close-running-confirm.test.ts": 178,
+      "src/renderer/src/components/terminal/unsaved-close-queue.test.ts": 49,
+      "src/renderer/src/components/terminal/use-terminal-provider-snapshot-capability.test.tsx": 750,
+      "src/renderer/src/components/terminal/use-worktree-files.test.tsx": 359,
+      "src/renderer/src/components/terminal/window-close-running-work.test.ts": 67,
+      "src/renderer/src/components/ui/color-picker.test.tsx": 537,
+      "src/renderer/src/components/ui/popover-wheel-scroll.test.tsx": 931,
+      "src/renderer/src/components/ui/repo-multi-combobox.test.ts": 461,
+      "src/renderer/src/components/ui/scroll-area.test.tsx": 420,
+      "src/renderer/src/components/ui/slider.test.tsx": 848,
+      "src/renderer/src/components/ui/switch.test.tsx": 180,
+      "src/renderer/src/components/unexpected-signout/unexpected-signout-card.test.tsx": 1887,
+      "src/renderer/src/components/unexpected-signout/unexpected-signout-visibility.test.ts": 59,
+      "src/renderer/src/components/use-github-task-search-commit.test.ts": 679,
+      "src/renderer/src/components/use-task-creation-draft-retention.test.ts": 550,
+      "src/renderer/src/components/use-task-page-jira-list-effects.test.ts": 2187,
+      "src/renderer/src/components/use-terminal-create-actions.test.tsx": 444,
+      "src/renderer/src/components/use-terminal-editor-close-foundation.window-close.test.tsx": 1796,
+      "src/renderer/src/components/use-terminal-window-lifecycle.lazy-ref.test.tsx": 381,
+      "src/renderer/src/components/use-worktree-jump-palette-browser-ownership.test.ts": 2178,
+      "src/renderer/src/components/virtualized-list.test.tsx": 788,
+      "src/renderer/src/components/window-close-request-coordinator.test.ts": 436,
+      "src/renderer/src/components/workspace-cleanup/WorkspaceCleanupDialog.mount-gating.test.tsx": 1869,
+      "src/renderer/src/components/workspace-cleanup/WorkspaceCleanupDialog.stale-while-revalidate.test.tsx": 2614,
+      "src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-browse-state.test.tsx": 512,
+      "src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-facet-rows.test.tsx": 758,
+      "src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-git-evidence.test.tsx": 637,
+      "src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-row-order.test.ts": 328,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-active-facets.test.ts": 92,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal-late-settlement.test.ts": 1640,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal-snapshot-batch.test.ts": 1286,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal.test.ts": 126,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-candidate-list.test.tsx": 2448,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-candidate-row-data.test.ts": 175,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-candidate-row.test.tsx": 2561,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-confirm-remove.test.tsx": 818,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-deletion-phases.test.ts": 103,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-dialog-notices.test.tsx": 972,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-facet-controls.test.tsx": 1353,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-facet-filter.test.ts": 115,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-facet-sort.test.ts": 68,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-filter-bar.test.tsx": 1202,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-flat-list.test.tsx": 2644,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-git-evidence.test.ts": 92,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-presentation.test.ts": 106,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-removal-candidates.test.ts": 116,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-removal-settlement.test.ts": 77,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-removal-timeout-recovery.test.ts": 1354,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-scanned-host-confirmation-removal.test.tsx": 1810,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-sort-header.test.tsx": 957,
+      "src/renderer/src/components/workspace-emoji/WorkspaceEmojiSuggestionPopover.test.tsx": 737,
+      "src/renderer/src/components/workspace-emoji/useWorkspaceEmojiShortcodeInput.test.tsx": 786,
+      "src/renderer/src/components/workspace-surface-projection.test.ts": 57,
+      "src/renderer/src/components/worktree-creation/WorktreeCreationPanel.test.tsx": 591,
+      "src/renderer/src/components/worktree-jump-palette-interleaved-sections.test.tsx": 5202,
+      "src/renderer/src/components/worktree-jump-palette-primitives.test.tsx": 836,
+      "src/renderer/src/components/worktree-jump-palette-quick-action-availability.test.tsx": 939,
+      "src/renderer/src/components/worktree-jump-palette-sleeping-filter.test.ts": 2023,
+      "src/renderer/src/components/worktree-jump-palette-source-context-boundary.test.ts": 52,
+      "src/renderer/src/components/worktree-jump-palette-status-inputs.test.ts": 62,
+      "src/renderer/src/hooks/agent-hook-completion-background-turn-notifications.test.ts": 334,
+      "src/renderer/src/hooks/agent-hook-completion-fresh-working.test.ts": 111,
+      "src/renderer/src/hooks/agent-hook-completion-grok-notifications.test.ts": 471,
+      "src/renderer/src/hooks/agent-hook-completion-notifications-import.test.ts": 148,
+      "src/renderer/src/hooks/agent-hook-completion-notifications.test.ts": 371,
+      "src/renderer/src/hooks/agent-hook-completion-store-sync.test.ts": 77,
+      "src/renderer/src/hooks/automation-agent-status-entry-change.test.ts": 45,
+      "src/renderer/src/hooks/automation-dispatch-unverifiable-loss.test.ts": 169,
+      "src/renderer/src/hooks/automations-changed-event-attribution.test.ts": 1405,
+      "src/renderer/src/hooks/composer-branch-selection.test.ts": 54,
+      "src/renderer/src/hooks/composer-drop-failure-toast.test.ts": 83,
+      "src/renderer/src/hooks/composer-drop-owner.test.ts": 32,
+      "src/renderer/src/hooks/composer-drop-result.test.ts": 33,
+      "src/renderer/src/hooks/composer-native-file-drop.test.ts": 57,
+      "src/renderer/src/hooks/composer-state/attachment-drop-failure.test.tsx": 668,
+      "src/renderer/src/hooks/composer-state/attachment-drop-lifetime.test.tsx": 1076,
+      "src/renderer/src/hooks/composer-state/branch-start-point-actions.test.ts": 560,
+      "src/renderer/src/hooks/composer-state/composer-drop-listener.test.ts": 663,
+      "src/renderer/src/hooks/composer-state/composer-name-source-selection.test.ts": 2276,
+      "src/renderer/src/hooks/composer-state/draft-target-sync.test.ts": 571,
+      "src/renderer/src/hooks/composer-state/full-creation-execution.test.ts": 1939,
+      "src/renderer/src/hooks/composer-state/full-creation-structured-launch.test.ts": 1517,
+      "src/renderer/src/hooks/composer-state/full-submit-orchestration.test.ts": 610,
+      "src/renderer/src/hooks/composer-state/multiple-create-reset.test.ts": 1387,
+      "src/renderer/src/hooks/composer-state/provider-runtime-sync.test.ts": 1981,
+      "src/renderer/src/hooks/composer-state/quick-creation-request.test.ts": 113,
+      "src/renderer/src/hooks/direct-ssh-host-hydration.test.ts": 113,
+      "src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts": 108,
+      "src/renderer/src/hooks/direct-ssh-reconnect-rollout.test.ts": 40,
+      "src/renderer/src/hooks/direct-ssh-reconnect-tokens.test.ts": 54,
+      "src/renderer/src/hooks/direct-ssh-runtime-wake-isolation.test.tsx": 1496,
+      "src/renderer/src/hooks/direct-ssh-state-routing.test.ts": 302,
+      "src/renderer/src/hooks/direct-ssh-worktree-refresh-scheduler.test.ts": 63,
+      "src/renderer/src/hooks/fork-push-warning.test.ts": 59,
+      "src/renderer/src/hooks/installed-agent-skill-discovery-cache.test.ts": 67,
+      "src/renderer/src/hooks/installed-agent-skill-discovery.test.ts": 70,
+      "src/renderer/src/hooks/installed-agent-skill-runtime-eviction.test.ts": 50,
+      "src/renderer/src/hooks/installed-agent-skill-verdict.test.ts": 927,
+      "src/renderer/src/hooks/ipc-events/agent-status-pane-routing-index.test.ts": 1777,
+      "src/renderer/src/hooks/ipc-events/agent-status-pending-retry-gate.test.ts": 339,
+      "src/renderer/src/hooks/ipc-events/agent-status-terminal-title-tab-write.test.ts": 1508,
+      "src/renderer/src/hooks/ipc-events/browser-automation-bootstrap-lease.test.ts": 461,
+      "src/renderer/src/hooks/ipc-events/browser-request-ipc-bridge.profile-switch.test.ts": 503,
+      "src/renderer/src/hooks/ipc-events/browser-state-capture-paint-hold.test.ts": 198,
+      "src/renderer/src/hooks/ipc-events/browser-state-open-link-profile.test.ts": 206,
+      "src/renderer/src/hooks/ipc-events/direct-ssh-connect-reply-routing.test.ts": 1662,
+      "src/renderer/src/hooks/ipc-events/direct-ssh-hydration-fanout.test.ts": 945,
+      "src/renderer/src/hooks/ipc-events/direct-ssh-hydration-target-metadata.test.ts": 1392,
+      "src/renderer/src/hooks/ipc-events/normalize-agent-status-event.test.ts": 30,
+      "src/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.test.ts": 1618,
+      "src/renderer/src/hooks/ipc-events/os-markdown-file-open-bridge.test.ts": 207,
+      "src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge-ownership.test.ts": 1063,
+      "src/renderer/src/hooks/ipc-events/runtime-reconnect-host-status.test.ts": 1734,
+      "src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge-split.test.ts": 361,
+      "src/renderer/src/hooks/ipc-events/updater-status-ipc-bridge.test.ts": 57,
+      "src/renderer/src/hooks/ipc-tab-switch-group-order-hydration.test.ts": 69,
+      "src/renderer/src/hooks/ipc-tab-switch-structured-tab-cycle.test.ts": 57,
+      "src/renderer/src/hooks/ipc-tab-switch.test.ts": 98,
+      "src/renderer/src/hooks/legacy-worker-terminal-recovery-event.test.ts": 61,
+      "src/renderer/src/hooks/macos-tcc-prompt-notice-subscription.test.ts": 53,
+      "src/renderer/src/hooks/metadata-request-cache.test.ts": 179,
+      "src/renderer/src/hooks/mobile-terminal-reveal-tab-adoption.test.ts": 2329,
+      "src/renderer/src/hooks/modal-return-focus-action.test.ts": 27,
+      "src/renderer/src/hooks/programmatic-scroll-marks.test.ts": 46,
+      "src/renderer/src/hooks/remote-workspace-deferred-placement-retry.test.ts": 329,
+      "src/renderer/src/hooks/remote-workspace-session-merge-close-tombstones.test.ts": 102,
+      "src/renderer/src/hooks/remote-workspace-session-merge-closed-terminal-tombstone.test.ts": 1845,
+      "src/renderer/src/hooks/remote-workspace-session-merge-local-survival.test.ts": 94,
+      "src/renderer/src/hooks/remote-workspace-session-merge-parked-scrollback.test.ts": 159,
+      "src/renderer/src/hooks/remote-workspace-snapshot-apply-deferred-session-write.test.ts": 1341,
+      "src/renderer/src/hooks/remote-workspace-snapshot-arrival-coordinator.test.ts": 56,
+      "src/renderer/src/hooks/remote-workspace-snapshot-duplicate-tab-repair.test.ts": 1373,
+      "src/renderer/src/hooks/remote-workspace-snapshot-fresh-client-tab-seeding.test.ts": 1712,
+      "src/renderer/src/hooks/remote-workspace-snapshot-local-tab-survival.test.ts": 1572,
+      "src/renderer/src/hooks/remote-workspace-snapshot-unplaced-tab-adoption.test.ts": 1734,
+      "src/renderer/src/hooks/remote-workspace-target-sync.test.ts": 336,
+      "src/renderer/src/hooks/runtime-client-events-sync-ownership.test.ts": 78,
+      "src/renderer/src/hooks/runtime-client-events-sync.test.ts": 100,
+      "src/renderer/src/hooks/runtime-project-refresh-scheduler.test.ts": 93,
+      "src/renderer/src/hooks/shortcut-label-cache.test.tsx": 2047,
+      "src/renderer/src/hooks/ssh-reconnect-pane-retry.test.ts": 71,
+      "src/renderer/src/hooks/structured-session-completion-focus.test.ts": 1246,
+      "src/renderer/src/hooks/unpaired-device-auth-notification.test.ts": 49,
+      "src/renderer/src/hooks/use-audio-capture.capture-loss.test.ts": 393,
+      "src/renderer/src/hooks/use-clipboard-text-copy-feedback.test.ts": 420,
+      "src/renderer/src/hooks/use-now.test.ts": 318,
+      "src/renderer/src/hooks/use-palette-search-evaluation-context.test.ts": 586,
+      "src/renderer/src/hooks/use-task-page-github-work-item-mutation-host.test.ts": 1951,
+      "src/renderer/src/hooks/use-terminal-quick-command-hosts.test.ts": 675,
+      "src/renderer/src/hooks/use-window-stream-visibility.test.ts": 368,
+      "src/renderer/src/hooks/useActiveProjectSkillRuntime.test.tsx": 2208,
+      "src/renderer/src/hooks/useAgentDetectionTarget.test.ts": 1593,
+      "src/renderer/src/hooks/useAppMenuPaste.test.tsx": 525,
+      "src/renderer/src/hooks/useAppMenuSelectionActions.test.tsx": 561,
+      "src/renderer/src/hooks/useAutoAckViewedAgent.away.test.ts": 2063,
+      "src/renderer/src/hooks/useAutoAckViewedAgent.clock-skew.test.ts": 2020,
+      "src/renderer/src/hooks/useAutoAckViewedAgent.floating-panel.test.ts": 1984,
+      "src/renderer/src/hooks/useAutoAckViewedAgent.focus-group.test.ts": 1361,
+      "src/renderer/src/hooks/useAutoAckViewedAgent.mixed-workspace.test.ts": 1339,
+      "src/renderer/src/hooks/useAutoAckViewedAgent.test.ts": 1829,
+      "src/renderer/src/hooks/useAutomationDispatchEvents.test.ts": 716,
+      "src/renderer/src/hooks/useComposerState-decisions.test.ts": 2092,
+      "src/renderer/src/hooks/useComposerState-host-context-boundaries.test.ts": 7756,
+      "src/renderer/src/hooks/useComposerState-host-retarget.test.ts": 2531,
+      "src/renderer/src/hooks/useComposerState.integration.test.ts": 3242,
+      "src/renderer/src/hooks/useDetectedAgents.test.tsx": 1651,
+      "src/renderer/src/hooks/useEditorExternalWatch-complexity.test.ts": 5198,
+      "src/renderer/src/hooks/useEditorExternalWatch-self-move.test.ts": 533,
+      "src/renderer/src/hooks/useEditorExternalWatch-subscriptions.test.tsx": 404,
+      "src/renderer/src/hooks/useEditorExternalWatch-targets.test.ts": 324,
+      "src/renderer/src/hooks/useEditorExternalWatch-wsl-repro.test.ts": 307,
+      "src/renderer/src/hooks/useEditorExternalWatch.test.ts": 492,
+      "src/renderer/src/hooks/useEphemeralVmRecipeOptions.test.tsx": 420,
+      "src/renderer/src/hooks/useGitHubSlugMetadata.test.tsx": 556,
+      "src/renderer/src/hooks/useGlobalFileDrop.test.ts": 1582,
+      "src/renderer/src/hooks/useInstalledAgentSkills.react.test.tsx": 6914,
+      "src/renderer/src/hooks/useInstalledAgentSkills.test.ts": 1496,
+      "src/renderer/src/hooks/useIpcEvents-agent-dashboard-shortcut.test.ts": 50,
+      "src/renderer/src/hooks/useIpcEvents-agent-status-batch-projection.test.ts": 2975,
+      "src/renderer/src/hooks/useIpcEvents-agent-status-connection-attribution.test.ts": 2091,
+      "src/renderer/src/hooks/useIpcEvents-agent-status-hook-titles.test.ts": 3465,
+      "src/renderer/src/hooks/useIpcEvents-agent-status-pane-teardown.test.ts": 1791,
+      "src/renderer/src/hooks/useIpcEvents-agent-status-queue-ordering.test.ts": 1553,
+      "src/renderer/src/hooks/useIpcEvents-agent-status-snapshot-hydration.test.ts": 3794,
+      "src/renderer/src/hooks/useIpcEvents-agent-status-snapshot-replay.test.ts": 1645,
+      "src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts": 2844,
+      "src/renderer/src/hooks/useIpcEvents-agent-status-turn-completion.test.ts": 1232,
+      "src/renderer/src/hooks/useIpcEvents-browser-certificate-failure.test.ts": 1339,
+      "src/renderer/src/hooks/useIpcEvents-browser-navigation.test.ts": 1691,
+      "src/renderer/src/hooks/useIpcEvents-browser-tab-create.test.ts": 1564,
+      "src/renderer/src/hooks/useIpcEvents-cli-worktree-activation.test.ts": 2045,
+      "src/renderer/src/hooks/useIpcEvents-client-hosted-browser-rows.test.ts": 2146,
+      "src/renderer/src/hooks/useIpcEvents-close-routing-active-browser-tab.test.ts": 2721,
+      "src/renderer/src/hooks/useIpcEvents-close-routing-browser-pages.test.ts": 3181,
+      "src/renderer/src/hooks/useIpcEvents-close-routing-floating-guest.test.ts": 1386,
+      "src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts": 3166,
+      "src/renderer/src/hooks/useIpcEvents-cmd-j-digit-chord.test.ts": 1969,
+      "src/renderer/src/hooks/useIpcEvents-lifecycle.test.ts": 1286,
+      "src/renderer/src/hooks/useIpcEvents-new-workspace-shortcut.test.ts": 63,
+      "src/renderer/src/hooks/useIpcEvents-rate-limit-hydration.test.ts": 1530,
+      "src/renderer/src/hooks/useIpcEvents-repos-changed-catalogs.test.ts": 1613,
+      "src/renderer/src/hooks/useIpcEvents-runtime-environment-selectors.test.ts": 344,
+      "src/renderer/src/hooks/useIpcEvents-session-tab-close-request.test.ts": 1973,
+      "src/renderer/src/hooks/useIpcEvents-silent-terminal-adoption.test.ts": 1127,
+      "src/renderer/src/hooks/useIpcEvents-ssh-disconnect-cleanup.test.ts": 1093,
+      "src/renderer/src/hooks/useIpcEvents-terminal-create-surfacing.test.ts": 2062,
+      "src/renderer/src/hooks/useIpcEvents-updater-status.test.ts": 1760,
+      "src/renderer/src/hooks/useIssueMetadata.test.tsx": 329,
+      "src/renderer/src/hooks/useLinearProviderConnected.test.tsx": 1480,
+      "src/renderer/src/hooks/useMacTccAttributionSeveredNotice.test.tsx": 2293,
+      "src/renderer/src/hooks/useMacosTccPromptNotice.test.tsx": 2393,
+      "src/renderer/src/hooks/useMetadataListRequest.test.tsx": 555,
+      "src/renderer/src/hooks/useModalReturnFocus.test.tsx": 1404,
+      "src/renderer/src/hooks/usePrimarySelectionPaste.terminal-native-paste.test.tsx": 342,
+      "src/renderer/src/hooks/usePrimarySelectionPaste.test.tsx": 582,
+      "src/renderer/src/hooks/useResetCountdownClock.test.ts": 380,
+      "src/renderer/src/hooks/useRetiredWorktreeNames.test.ts": 729,
+      "src/renderer/src/hooks/useSettingsNavigationMetadata.capability-owner.test.tsx": 1128,
+      "src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx": 1648,
+      "src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts": 1342,
+      "src/renderer/src/hooks/useSidebarResize.test.ts": 42,
+      "src/renderer/src/hooks/useSkillFreshness.test.tsx": 461,
+      "src/renderer/src/hooks/useUnreadDockBadge.test.ts": 2344,
+      "src/renderer/src/hooks/useVirtualizedScrollAnchor.listener-deps.test.ts": 71,
+      "src/renderer/src/hooks/useVirtualizedScrollAnchor.marks-restore-signal.test.ts": 56,
+      "src/renderer/src/hooks/useVirtualizedScrollAnchor.test.ts": 49,
+      "src/renderer/src/hooks/useWindowsTerminalCapabilityOwnerKey.test.tsx": 613,
+      "src/renderer/src/hooks/viewport-size-change-listener.test.ts": 46,
+      "src/renderer/src/hooks/worktree-change-refresh-queue.test.ts": 81,
+      "src/renderer/src/hooks/worktree-head-identity-apply.test.ts": 41,
+      "src/renderer/src/hooks/zoom-routing.test.ts": 195,
+      "src/renderer/src/i18n/I18nProvider.test.tsx": 2173,
+      "src/renderer/src/i18n/integration-card-status-localization.test.ts": 257,
+      "src/renderer/src/i18n/intl-locale.test.ts": 135,
+      "src/renderer/src/i18n/ja-technical-literal-mistranslations.test.ts": 158,
+      "src/renderer/src/i18n/ko-ui-semantic-mistranslations.test.ts": 214,
+      "src/renderer/src/i18n/lazy-locale.test.ts": 299,
+      "src/renderer/src/i18n/locale-english-regression.test.ts": 1231,
+      "src/renderer/src/i18n/native-chat-locales.test.ts": 461,
+      "src/renderer/src/i18n/no-top-level-translate.test.ts": 3326,
+      "src/renderer/src/i18n/plugin-chrome-allowlist.test.ts": 170,
+      "src/renderer/src/i18n/pseudo-localization.test.ts": 89,
+      "src/renderer/src/i18n/relative-duration-copy-localization.test.ts": 810,
+      "src/renderer/src/i18n/relative-time-format.test.ts": 112,
+      "src/renderer/src/i18n/runtime-required-catalog.test.ts": 544,
+      "src/renderer/src/i18n/settings-status-label-localization.test.ts": 1029,
+      "src/renderer/src/i18n/smart-workspace-jira-locales.test.ts": 598,
+      "src/renderer/src/i18n/technical-literal-catalog-values.test.ts": 829,
+      "src/renderer/src/i18n/weekday-names.test.ts": 94,
+      "src/renderer/src/i18n/worktree-visibility-locales.test.ts": 120,
+      "src/renderer/src/i18n/zh-technical-literal-mistranslations.test.ts": 317,
+      "src/renderer/src/lazy-modal-mount-state.test.ts": 37,
+      "src/renderer/src/lazy-use-ref-ratchet.test.ts": 260,
+      "src/renderer/src/lib/activate-ai-vault-structured-session-reveal.test.ts": 1763,
+      "src/renderer/src/lib/activate-ai-vault-structured-session.test.ts": 1827,
+      "src/renderer/src/lib/activate-tab-and-focus-pane.test.ts": 34,
+      "src/renderer/src/lib/active-agent-note-send-explicit-target.test.ts": 818,
+      "src/renderer/src/lib/active-agent-note-send-focused-session.test.ts": 297,
+      "src/renderer/src/lib/active-agent-note-send-runtime-error-codes.test.ts": 61,
+      "src/renderer/src/lib/active-agent-note-send-target-detection.test.ts": 339,
+      "src/renderer/src/lib/active-view-persist.test.ts": 42,
+      "src/renderer/src/lib/activity-thread-display.test.ts": 84,
+      "src/renderer/src/lib/agent-background-session-launch-host.test.ts": 980,
+      "src/renderer/src/lib/agent-catalog-links.test.ts": 113,
+      "src/renderer/src/lib/agent-draft-readiness.test.ts": 79,
+      "src/renderer/src/lib/agent-followup-delivery.test.ts": 18686,
+      "src/renderer/src/lib/agent-hibernation-confirmation.test.ts": 35,
+      "src/renderer/src/lib/agent-hibernation-coordinator.test.ts": 1424,
+      "src/renderer/src/lib/agent-hibernation-output-activity.test.ts": 53,
+      "src/renderer/src/lib/agent-hibernation-pane-age.test.ts": 43,
+      "src/renderer/src/lib/agent-hibernation-planner.test.ts": 154,
+      "src/renderer/src/lib/agent-hibernation-runtime-liveness-race.test.ts": 1670,
+      "src/renderer/src/lib/agent-hibernation-visibility.test.ts": 1583,
+      "src/renderer/src/lib/agent-launch-caller-permissions.test.ts": 1042,
+      "src/renderer/src/lib/agent-launch-caller-placement.test.ts": 615,
+      "src/renderer/src/lib/agent-launch-caller-profile-census.test.ts": 625,
+      "src/renderer/src/lib/agent-launch-caller-prompt-transport.test.ts": 735,
+      "src/renderer/src/lib/agent-launch-caller-routing.test.ts": 667,
+      "src/renderer/src/lib/agent-launch-prompt-delivery.test.ts": 72,
+      "src/renderer/src/lib/agent-launch-route-connection-fallback.test.ts": 1361,
+      "src/renderer/src/lib/agent-launch-route-input.test.ts": 200,
+      "src/renderer/src/lib/agent-launch-routing-caller-census.test.ts": 1308,
+      "src/renderer/src/lib/agent-launch-routing.test.ts": 64,
+      "src/renderer/src/lib/agent-paste-draft-readiness-budget.test.ts": 177,
+      "src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts": 188,
+      "src/renderer/src/lib/agent-paste-draft.test.ts": 610,
+      "src/renderer/src/lib/agent-picker-search.test.ts": 180,
+      "src/renderer/src/lib/agent-ready-wait.test.ts": 68,
+      "src/renderer/src/lib/agent-resume-launch-target.test.ts": 2569,
+      "src/renderer/src/lib/agent-row-primary-text.test.ts": 65,
+      "src/renderer/src/lib/agent-row-tool-preview.test.ts": 61,
+      "src/renderer/src/lib/agent-send-title-status.test.ts": 70,
+      "src/renderer/src/lib/agent-session-fork-context.test.ts": 49,
+      "src/renderer/src/lib/agent-session-launch-plan.test.ts": 46,
+      "src/renderer/src/lib/agent-skill-cli-prerequisite.test.ts": 135,
+      "src/renderer/src/lib/agent-skill-nav-install-status.test.ts": 1277,
+      "src/renderer/src/lib/agent-startup-delayed-delivery-perf.test.ts": 1657,
+      "src/renderer/src/lib/agent-status-connection-ownership.test.ts": 53,
+      "src/renderer/src/lib/agent-status-count.test.ts": 86,
+      "src/renderer/src/lib/agent-status-epoch-clock.test.ts": 54,
+      "src/renderer/src/lib/agent-status-evidence-clock.test.ts": 68,
+      "src/renderer/src/lib/agent-status-terminal-title.test.ts": 92,
+      "src/renderer/src/lib/agent-status-worktree-attribution.test.ts": 43,
+      "src/renderer/src/lib/agent-status.test.ts": 1192,
+      "src/renderer/src/lib/agent-tab-shortcuts.test.ts": 77,
+      "src/renderer/src/lib/agent-trust-preflight.test.ts": 71,
+      "src/renderer/src/lib/ai-vault-omp-cold-resume.test.ts": 1575,
+      "src/renderer/src/lib/ai-vault-resume-command.drop-repin.test.ts": 226,
+      "src/renderer/src/lib/ai-vault-resume-command.resumable-agent.test.ts": 231,
+      "src/renderer/src/lib/ai-vault-resume-command.test.ts": 229,
+      "src/renderer/src/lib/ai-vault-resume-shell.test.ts": 214,
+      "src/renderer/src/lib/ai-vault-resume-target.test.ts": 59,
+      "src/renderer/src/lib/ai-vault-session-drag.test.ts": 58,
+      "src/renderer/src/lib/ai-vault-session-resume-preparation.test.ts": 58,
+      "src/renderer/src/lib/ai-vault-tab-title-sync-inputs.test.ts": 246,
+      "src/renderer/src/lib/ai-vault-tab-title-sync.test.ts": 763,
+      "src/renderer/src/lib/app-command-dispatch.test.ts": 53,
+      "src/renderer/src/lib/app-font-family.test.ts": 151,
+      "src/renderer/src/lib/app-menu-paste.test.ts": 494,
+      "src/renderer/src/lib/app-menu-selection-actions.test.ts": 465,
+      "src/renderer/src/lib/automation-session-observer.test.ts": 120,
+      "src/renderer/src/lib/automation-session-reuse.test.ts": 59,
+      "src/renderer/src/lib/automation-terminal-ownership.test.ts": 1270,
+      "src/renderer/src/lib/browser-cookie-import-toast.test.ts": 143,
+      "src/renderer/src/lib/browser-history-match.performance.test.ts": 185,
+      "src/renderer/src/lib/browser-history-match.test.ts": 175,
+      "src/renderer/src/lib/browser-page-conversion-history.test.ts": 64,
+      "src/renderer/src/lib/browser-page-palette-activation.test.ts": 1954,
+      "src/renderer/src/lib/browser-palette-page-entries.test.ts": 341,
+      "src/renderer/src/lib/browser-palette-search.test.ts": 193,
+      "src/renderer/src/lib/browser-uuid.test.ts": 48,
+      "src/renderer/src/lib/browser-workspace-tab-activation.test.ts": 2061,
+      "src/renderer/src/lib/client-creation-action-policy.test.ts": 199,
+      "src/renderer/src/lib/cmd-j-github-url-lookup.test.ts": 27,
+      "src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts": 231,
+      "src/renderer/src/lib/cmd-j-linear-issue-intent.test.ts": 38,
+      "src/renderer/src/lib/cmd-j-section-leadership.test.ts": 51,
+      "src/renderer/src/lib/codex-account-display-label.test.ts": 48,
+      "src/renderer/src/lib/codex-pane-restart-eligibility.test.ts": 82,
+      "src/renderer/src/lib/codex-pane-selection-lane.test.ts": 249,
+      "src/renderer/src/lib/codex-session-restart-route-recheck.test.ts": 1547,
+      "src/renderer/src/lib/codex-session-restart-shell-flap.test.ts": 1603,
+      "src/renderer/src/lib/codex-session-restart.test.ts": 6689,
+      "src/renderer/src/lib/codex-stale-pane-account-identity.test.ts": 1587,
+      "src/renderer/src/lib/codex-stale-pane-sweep.test.ts": 1143,
+      "src/renderer/src/lib/comment-body-line-count.test.ts": 78,
+      "src/renderer/src/lib/comment-body-submit-state.test.ts": 77,
+      "src/renderer/src/lib/composer-issue-command.test.ts": 1677,
+      "src/renderer/src/lib/composer-submit-cancellation.test.ts": 36,
+      "src/renderer/src/lib/connection-context.test.ts": 978,
+      "src/renderer/src/lib/crash-diagnostics.test.ts": 117,
+      "src/renderer/src/lib/create-untitled-markdown.test.ts": 332,
+      "src/renderer/src/lib/default-terminal-tabs-applied-persist.test.ts": 1574,
+      "src/renderer/src/lib/desktop-window-chrome.test.ts": 44,
+      "src/renderer/src/lib/diff-comment-compat.test.ts": 44,
+      "src/renderer/src/lib/diff-comments-format.test.ts": 64,
+      "src/renderer/src/lib/direct-ssh-reconnect-product-telemetry.test.ts": 33,
+      "src/renderer/src/lib/direct-ssh-target-scope.test.ts": 38,
+      "src/renderer/src/lib/doc-preview-grants.test.ts": 338,
+      "src/renderer/src/lib/document-theme.test.ts": 53,
+      "src/renderer/src/lib/editable-target.test.ts": 436,
+      "src/renderer/src/lib/editor-file-operation-owner.test.ts": 1407,
+      "src/renderer/src/lib/editor-font-zoom.test.ts": 67,
+      "src/renderer/src/lib/ensure-hooks-confirmed.test.ts": 508,
+      "src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts": 287,
+      "src/renderer/src/lib/ensure-simulator-tab.test.ts": 32,
+      "src/renderer/src/lib/ephemeral-vm-failed-create-cleanup.test.ts": 29,
+      "src/renderer/src/lib/ephemeral-vm-runtime-cleanup.test.ts": 72,
+      "src/renderer/src/lib/ephemeral-vm-workspace-target.integration.test.ts": 238,
+      "src/renderer/src/lib/ephemeral-vm-workspace-target.test.ts": 241,
+      "src/renderer/src/lib/ephemeral-vm-worktree-creation.test.ts": 68,
+      "src/renderer/src/lib/execute-open-editor-path-move.test.ts": 1470,
+      "src/renderer/src/lib/external-editor-open-capability.test.ts": 40,
+      "src/renderer/src/lib/feature-education-telemetry.test.ts": 65,
+      "src/renderer/src/lib/feedback-image-attachments.test.ts": 598,
+      "src/renderer/src/lib/file-preview-action-visibility.test.tsx": 516,
+      "src/renderer/src/lib/file-preview.test.ts": 321,
+      "src/renderer/src/lib/file-search-result-owner.test.ts": 66,
+      "src/renderer/src/lib/file-search-selection.test.ts": 41,
+      "src/renderer/src/lib/file-type-icons.test.ts": 130,
+      "src/renderer/src/lib/find-query-bounds.test.ts": 29,
+      "src/renderer/src/lib/finished-agent-resume-resurrection.test.ts": 1379,
+      "src/renderer/src/lib/fix-checks-agent-launch.test.ts": 325,
+      "src/renderer/src/lib/flatten-retained-slice.test.ts": 163,
+      "src/renderer/src/lib/floating-terminal.test.ts": 43,
+      "src/renderer/src/lib/floating-workspace-terminal-actions.test.ts": 235,
+      "src/renderer/src/lib/floating-workspace-tour-interaction-snapshot.test.ts": 33,
+      "src/renderer/src/lib/focus-terminal-tab-surface.test.ts": 81,
+      "src/renderer/src/lib/folder-workspace-path-status.test.ts": 76,
+      "src/renderer/src/lib/foreground-terminal-tabs.test.ts": 57,
+      "src/renderer/src/lib/github-links.test.ts": 69,
+      "src/renderer/src/lib/github-pr-start-point.test.ts": 78,
+      "src/renderer/src/lib/github-source-runtime-context.test.ts": 63,
+      "src/renderer/src/lib/github-work-item-source-lookup.test.ts": 97,
+      "src/renderer/src/lib/github-work-item-workspace-attachment.test.ts": 31,
+      "src/renderer/src/lib/gitlab-links.test.ts": 71,
+      "src/renderer/src/lib/gitlab-work-item-source-lookup.test.ts": 84,
+      "src/renderer/src/lib/hook-command-delayed-delivery-perf.test.ts": 1720,
+      "src/renderer/src/lib/hook-command-delayed-delivery.test.ts": 1168,
+      "src/renderer/src/lib/host-mirror-handle-gap-drain.test.ts": 1659,
+      "src/renderer/src/lib/host-mirror-handle-gap-landed-handle.test.ts": 1250,
+      "src/renderer/src/lib/host-mirror-handle-gap-resume.test.ts": 4216,
+      "src/renderer/src/lib/host-mirror-handle-gap-subscription-lifetime.test.ts": 1642,
+      "src/renderer/src/lib/host-mirror-handle-gap-teardown.test.ts": 1351,
+      "src/renderer/src/lib/host-mirror-handle-gap-verdict-union.test.ts": 1927,
+      "src/renderer/src/lib/host-mirrored-pane-resume-replay.test.ts": 1687,
+      "src/renderer/src/lib/http-link-destinations.test.ts": 207,
+      "src/renderer/src/lib/http-link-modifier-routing.test.ts": 196,
+      "src/renderer/src/lib/http-link-routing.test.ts": 206,
+      "src/renderer/src/lib/i18n-jsx-spacing-guard.test.ts": 57,
+      "src/renderer/src/lib/ime-composition-keyboard-event.test.ts": 477,
+      "src/renderer/src/lib/ios-web-platform.test.ts": 45,
+      "src/renderer/src/lib/ipc-error.test.ts": 50,
+      "src/renderer/src/lib/jira-source-host.test.ts": 30,
+      "src/renderer/src/lib/keyboard-layout/detect-option-as-alt.test.ts": 62,
+      "src/renderer/src/lib/keyboard-layout/input-source-id.test.ts": 50,
+      "src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts": 36,
+      "src/renderer/src/lib/keyboard-layout/option-as-alt-probe.test.ts": 87,
+      "src/renderer/src/lib/keyboard-layout/option-key-location-state.test.ts": 44,
+      "src/renderer/src/lib/language-detect.test.ts": 84,
+      "src/renderer/src/lib/large-text-control-paste.test.ts": 482,
+      "src/renderer/src/lib/launch-agent-background-session-remote.test.ts": 522,
+      "src/renderer/src/lib/launch-agent-background-session.test.ts": 367,
+      "src/renderer/src/lib/launch-agent-in-new-tab-cwd.test.ts": 596,
+      "src/renderer/src/lib/launch-agent-in-new-tab-host-resolution.test.ts": 777,
+      "src/renderer/src/lib/launch-agent-in-new-tab-main-surface.test.ts": 1850,
+      "src/renderer/src/lib/launch-agent-in-new-tab-placement.test.ts": 568,
+      "src/renderer/src/lib/launch-agent-in-new-tab-structured.test.ts": 1042,
+      "src/renderer/src/lib/launch-agent-in-new-tab-web-runtime.test.ts": 477,
+      "src/renderer/src/lib/launch-agent-in-new-tab-windows-quoting.test.ts": 719,
+      "src/renderer/src/lib/launch-agent-in-new-tab.test.ts": 1384,
+      "src/renderer/src/lib/launch-agent-session-continuation.test.ts": 93,
+      "src/renderer/src/lib/launch-agent-structured-chat-guard.test.ts": 1070,
+      "src/renderer/src/lib/launch-ai-vault-session.test.ts": 77,
+      "src/renderer/src/lib/launch-structured-agent-session.test.ts": 1925,
+      "src/renderer/src/lib/launch-work-item-direct-agent-routing.test.ts": 1859,
+      "src/renderer/src/lib/launch-work-item-direct-agent.test.ts": 102,
+      "src/renderer/src/lib/launch-work-item-direct-messages.test.ts": 67,
+      "src/renderer/src/lib/launch-work-item-direct.test.ts": 760,
+      "src/renderer/src/lib/launch-worktree-background-terminals.test.ts": 529,
+      "src/renderer/src/lib/lazy-chunk-recovery-reload.test.ts": 327,
+      "src/renderer/src/lib/lazy-with-retry.never-landed-reload.test.ts": 487,
+      "src/renderer/src/lib/lazy-with-retry.right-sidebar-syntax-error.test.ts": 400,
+      "src/renderer/src/lib/lazy-with-retry.test.ts": 342,
+      "src/renderer/src/lib/left-sidebar-appearance.test.ts": 135,
+      "src/renderer/src/lib/linear-agent-skill-update-command.test.ts": 949,
+      "src/renderer/src/lib/linear-board-drag-payload.test.ts": 64,
+      "src/renderer/src/lib/linear-issue-context-snapshot.test.ts": 95,
+      "src/renderer/src/lib/linear-issue-url-lookup.test.ts": 54,
+      "src/renderer/src/lib/linear-issue-workspace-attachment.test.ts": 34,
+      "src/renderer/src/lib/linear-issue-workspace-open.test.ts": 73,
+      "src/renderer/src/lib/linear-linked-work-item.test.ts": 58,
+      "src/renderer/src/lib/linked-work-item-context.test.ts": 1261,
+      "src/renderer/src/lib/linked-work-item-provider.test.ts": 1731,
+      "src/renderer/src/lib/list-row-interaction.test.ts": 249,
+      "src/renderer/src/lib/local-path-open-guard.test.ts": 96,
+      "src/renderer/src/lib/local-preflight-context-cache.test.ts": 204,
+      "src/renderer/src/lib/local-preflight-context.test.ts": 270,
+      "src/renderer/src/lib/locale-text-collators.test.ts": 108,
+      "src/renderer/src/lib/manual-terminal-worktree-parking.test.ts": 510,
+      "src/renderer/src/lib/markdown-comment-blocks.test.ts": 34,
+      "src/renderer/src/lib/markdown-document-templates.test.ts": 227,
+      "src/renderer/src/lib/markdown-review-note-copy.test.ts": 45,
+      "src/renderer/src/lib/markdown-review-notes.test.ts": 47,
+      "src/renderer/src/lib/migration-unsupported-agent-entry.test.ts": 44,
+      "src/renderer/src/lib/mobile-terminal-tab-mount.test.ts": 41,
+      "src/renderer/src/lib/monaco-delayer-cancellation-guard.test.ts": 182,
+      "src/renderer/src/lib/monaco-diff-editor-disposal.test.ts": 50,
+      "src/renderer/src/lib/monaco-languages/monarch-embed-entry-recursion.test.ts": 750,
+      "src/renderer/src/lib/monaco-languages/monarch-upstream-mdx-recursion.test.ts": 5097,
+      "src/renderer/src/lib/monaco-languages/register-astro.test.ts": 129,
+      "src/renderer/src/lib/monaco-languages/register-jsonl.test.ts": 248,
+      "src/renderer/src/lib/monaco-languages/register-nim.test.ts": 78,
+      "src/renderer/src/lib/monaco-languages/register-shell-markdown-aliases.test.ts": 42,
+      "src/renderer/src/lib/monaco-languages/register-svelte.test.ts": 285,
+      "src/renderer/src/lib/monaco-languages/register-vue.test.ts": 442,
+      "src/renderer/src/lib/monaco-languages/textmate-language-registration.test.ts": 64,
+      "src/renderer/src/lib/monaco-languages/textmate-token-provider.test.ts": 232,
+      "src/renderer/src/lib/monaco-peek-preview-options.test.ts": 988,
+      "src/renderer/src/lib/monaco-setup-steps.test.ts": 28,
+      "src/renderer/src/lib/monospace-font-family.test.ts": 53,
+      "src/renderer/src/lib/mouse-shortcut-dispatch.test.ts": 366,
+      "src/renderer/src/lib/native-chat-initial-view-mode.test.ts": 51,
+      "src/renderer/src/lib/native-chat-launch-draft-mirrorability.test.ts": 226,
+      "src/renderer/src/lib/native-chat-transcript-readability.test.ts": 49,
+      "src/renderer/src/lib/nested-repo-selected-paths.test.ts": 45,
+      "src/renderer/src/lib/new-workspace-composer-repo.test.ts": 38,
+      "src/renderer/src/lib/new-workspace-create-gates.test.ts": 43,
+      "src/renderer/src/lib/new-workspace-enter-guard.test.ts": 52,
+      "src/renderer/src/lib/new-workspace-project-options.test.ts": 72,
+      "src/renderer/src/lib/new-workspace-ssh-gate.test.ts": 72,
+      "src/renderer/src/lib/new-workspace.test.ts": 4497,
+      "src/renderer/src/lib/non-secure-context-crypto.repro.test.ts": 1038,
+      "src/renderer/src/lib/notes-send-agent-targets.test.ts": 155,
+      "src/renderer/src/lib/onboarding-project-checklist.test.ts": 114,
+      "src/renderer/src/lib/open-markdown-in-floating-workspace.test.ts": 138,
+      "src/renderer/src/lib/open-mobile-emulator-tab.test.ts": 297,
+      "src/renderer/src/lib/open-tab-occupant-agent.test.ts": 102,
+      "src/renderer/src/lib/orca-hook-trust.test.ts": 59,
+      "src/renderer/src/lib/orca-yaml-trust-prompt-slot-eviction.test.ts": 597,
+      "src/renderer/src/lib/orchestration-setup-state.test.ts": 61,
+      "src/renderer/src/lib/orchestration-skill-coverage.test.ts": 80,
+      "src/renderer/src/lib/order-empty-query-worktrees.test.ts": 38,
+      "src/renderer/src/lib/outside-dismiss-guard.test.ts": 61,
+      "src/renderer/src/lib/palette-match/cmd-j-ranking-contract.test.ts": 114,
+      "src/renderer/src/lib/palette-match/match-field-allocation.test.ts": 127,
+      "src/renderer/src/lib/palette-match/palette-match-core.test.ts": 115,
+      "src/renderer/src/lib/palette-match/palette-match-performance.test.ts": 10210,
+      "src/renderer/src/lib/palette-match/palette-phrase-placement.test.ts": 65,
+      "src/renderer/src/lib/palette-match/palette-ranking.test.ts": 39,
+      "src/renderer/src/lib/palette-repo-resolution.test.ts": 40,
+      "src/renderer/src/lib/palette-type-alias-match.test.ts": 29,
+      "src/renderer/src/lib/pane-agent-evidence.test.ts": 74,
+      "src/renderer/src/lib/pane-manager/browser-mobile-driver-state.test.ts": 64,
+      "src/renderer/src/lib/pane-manager/browser-remote-viewer-state.test.ts": 41,
+      "src/renderer/src/lib/pane-manager/client-hosted-browser-row-ephemerality.test.ts": 1735,
+      "src/renderer/src/lib/pane-manager/client-hosted-browser-row-state.test.ts": 69,
+      "src/renderer/src/lib/pane-manager/focus-follows-mouse.test.ts": 40,
+      "src/renderer/src/lib/pane-manager/mobile-driver-state.test.ts": 56,
+      "src/renderer/src/lib/pane-manager/mobile-fit-overrides-hydration.test.ts": 56,
+      "src/renderer/src/lib/pane-manager/mobile-fit-overrides.test.ts": 62,
+      "src/renderer/src/lib/pane-manager/pane-container-listener-lifecycle.test.ts": 230,
+      "src/renderer/src/lib/pane-manager/pane-cursor-blink-suspension.test.ts": 1047,
+      "src/renderer/src/lib/pane-manager/pane-divider-capture-loss.test.ts": 45,
+      "src/renderer/src/lib/pane-manager/pane-divider-stray-touch.test.ts": 60,
+      "src/renderer/src/lib/pane-manager/pane-divider.test.ts": 74,
+      "src/renderer/src/lib/pane-manager/pane-dom-creation.test.ts": 485,
+      "src/renderer/src/lib/pane-manager/pane-drag-reorder.test.ts": 81,
+      "src/renderer/src/lib/pane-manager/pane-drop-no-op.test.ts": 237,
+      "src/renderer/src/lib/pane-manager/pane-fit-resize-observer.test.ts": 79,
+      "src/renderer/src/lib/pane-manager/pane-fit.test.ts": 145,
+      "src/renderer/src/lib/pane-manager/pane-initial-fit-lifecycle.test.ts": 245,
+      "src/renderer/src/lib/pane-manager/pane-inline-image-recovery.test.ts": 67,
+      "src/renderer/src/lib/pane-manager/pane-inline-images.test.ts": 102,
+      "src/renderer/src/lib/pane-manager/pane-key-resolution.test.ts": 42,
+      "src/renderer/src/lib/pane-manager/pane-lifecycle.test.ts": 435,
+      "src/renderer/src/lib/pane-manager/pane-manager-registry.test.ts": 41,
+      "src/renderer/src/lib/pane-manager/pane-metric-options-deferral.test.ts": 60,
+      "src/renderer/src/lib/pane-manager/pane-overlay-focus.test.ts": 722,
+      "src/renderer/src/lib/pane-manager/pane-pointer-focus.test.ts": 45,
+      "src/renderer/src/lib/pane-manager/pane-pty-resize-hold.test.ts": 53,
+      "src/renderer/src/lib/pane-manager/pane-reveal-fit.test.ts": 64,
+      "src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts": 394,
+      "src/renderer/src/lib/pane-manager/pane-scroll.test.ts": 118,
+      "src/renderer/src/lib/pane-manager/pane-split-close.test.ts": 65,
+      "src/renderer/src/lib/pane-manager/pane-split-scroll.test.ts": 62,
+      "src/renderer/src/lib/pane-manager/pane-terminal-foreground-render-settle.test.ts": 57,
+      "src/renderer/src/lib/pane-manager/pane-terminal-gpu-acceleration.test.ts": 107,
+      "src/renderer/src/lib/pane-manager/pane-terminal-mouse-wheel.test.ts": 65,
+      "src/renderer/src/lib/pane-manager/pane-terminal-output-queue-chunks.test.ts": 47,
+      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-ack-credit.test.ts": 95,
+      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-backlog-cap.test.ts": 118,
+      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-disposed-writes.test.ts": 79,
+      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-foreground-refresh.test.ts": 160,
+      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-queue-retention.test.ts": 266,
+      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-synchronized-frames.test.ts": 178,
+      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-throughput.bench.test.ts": 312,
+      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler.test.ts": 181,
+      "src/renderer/src/lib/pane-manager/pane-tree-equalization-parity.test.ts": 1669,
+      "src/renderer/src/lib/pane-manager/pane-tree-equalization-scaling.test.ts": 411,
+      "src/renderer/src/lib/pane-manager/pane-tree-ops.test.ts": 140,
+      "src/renderer/src/lib/pane-manager/pane-tree-reparent-frame.test.ts": 53,
+      "src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts": 173,
+      "src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts": 382,
+      "src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts": 423,
+      "src/renderer/src/lib/pane-manager/terminal-arabic-shaping-joiner.test.ts": 48,
+      "src/renderer/src/lib/pane-manager/terminal-canvas-dpr-repair.test.ts": 62,
+      "src/renderer/src/lib/pane-manager/terminal-complex-script.test.ts": 52,
+      "src/renderer/src/lib/pane-manager/terminal-delivery-credit.test.ts": 40,
+      "src/renderer/src/lib/pane-manager/terminal-foreground-repair-convergence.test.ts": 187,
+      "src/renderer/src/lib/pane-manager/terminal-ime-anchor.test.ts": 39,
+      "src/renderer/src/lib/pane-manager/terminal-ime-candidate-anchor.test.ts": 487,
+      "src/renderer/src/lib/pane-manager/terminal-keyboard-protocol.test.ts": 62,
+      "src/renderer/src/lib/pane-manager/terminal-ligatures-addon.test.ts": 66,
+      "src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts": 38,
+      "src/renderer/src/lib/pane-manager/terminal-linkifier-hover-reset-on-mouseleave.test.ts": 53,
+      "src/renderer/src/lib/pane-manager/terminal-linkifier-hover-reset-on-write.test.ts": 41,
+      "src/renderer/src/lib/pane-manager/terminal-linkifier-hover-reset.test.ts": 58,
+      "src/renderer/src/lib/pane-manager/terminal-render-pause-release-parked-resize.test.ts": 30,
+      "src/renderer/src/lib/pane-manager/terminal-render-pause-release.test.ts": 77,
+      "src/renderer/src/lib/pane-manager/terminal-scroll-intent-input-resync.test.ts": 78,
+      "src/renderer/src/lib/pane-manager/terminal-scroll-intent-key-retention.test.ts": 125,
+      "src/renderer/src/lib/pane-manager/terminal-scroll-intent-structural-transitions.test.ts": 51,
+      "src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts": 117,
+      "src/renderer/src/lib/pane-manager/terminal-structural-replay-coordinator.test.ts": 62,
+      "src/renderer/src/lib/pane-manager/terminal-webgl-auto-policy.test.ts": 61,
+      "src/renderer/src/lib/pane-manager/terminal-webgl-hidden-retention.test.ts": 321,
+      "src/renderer/src/lib/pane-manager/terminal-windows-ctrl-alt-chord-classification.test.ts": 358,
+      "src/renderer/src/lib/pane-manager/terminal-write-pipeline-health.test.ts": 71,
+      "src/renderer/src/lib/pane-manager/windows-pty-compatibility.test.ts": 87,
+      "src/renderer/src/lib/pane-manager/xterm-instance-disposed.test.ts": 131,
+      "src/renderer/src/lib/pane-manager/xterm-user-scrolling-contract.test.ts": 4939,
+      "src/renderer/src/lib/pane-manager/xterm-write-callback-guard.test.ts": 72,
+      "src/renderer/src/lib/parked-terminal-host-hydration.test.ts": 187,
+      "src/renderer/src/lib/passive-macos-app-data-access.test.ts": 26,
+      "src/renderer/src/lib/paste-payload-metadata.test.ts": 51,
+      "src/renderer/src/lib/path-head-elision.test.ts": 45,
+      "src/renderer/src/lib/path.test.ts": 42,
+      "src/renderer/src/lib/pending-worktree-creation.test.ts": 46,
+      "src/renderer/src/lib/pi-live-session-no-duplicate-tab.test.ts": 1695,
+      "src/renderer/src/lib/pi-session-resume-wake.test.ts": 1680,
+      "src/renderer/src/lib/plugin-command-execution.test.ts": 480,
+      "src/renderer/src/lib/plugin-command-keybindings.test.ts": 100,
+      "src/renderer/src/lib/pr-bot-author-overrides.test.ts": 298,
+      "src/renderer/src/lib/pr-comment-action-state.test.ts": 46,
+      "src/renderer/src/lib/pr-comment-reactions.test.ts": 30,
+      "src/renderer/src/lib/primary-selection-paste.test.ts": 551,
+      "src/renderer/src/lib/primary-selection.test.ts": 67,
+      "src/renderer/src/lib/project-clone-url-prefill.test.ts": 63,
+      "src/renderer/src/lib/project-host-clone-url.test.ts": 39,
+      "src/renderer/src/lib/project-host-setup-options.test.ts": 182,
+      "src/renderer/src/lib/project-host-workspace-target.test.ts": 105,
+      "src/renderer/src/lib/project-skill-runtime.test.ts": 87,
+      "src/renderer/src/lib/provisioned-root-create-options.test.ts": 42,
+      "src/renderer/src/lib/quick-workspace-agent-selection.test.ts": 143,
+      "src/renderer/src/lib/react-commit-cascade-install-order.test.ts": 31,
+      "src/renderer/src/lib/react-commit-cascade-observer.react185.test.tsx": 465,
+      "src/renderer/src/lib/react-commit-cascade-observer.test.ts": 187,
+      "src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts": 55,
+      "src/renderer/src/lib/react-commit-cascade-telemetry.test.ts": 223,
+      "src/renderer/src/lib/react-error-boundary-reporting.test.ts": 43,
+      "src/renderer/src/lib/react-grab-dev-gate.test.ts": 39,
+      "src/renderer/src/lib/react-renderer-root.test.ts": 40,
+      "src/renderer/src/lib/recent-workspace-tab-rows.test.ts": 81,
+      "src/renderer/src/lib/remap-open-editor-tabs-for-path-change.test.ts": 1606,
+      "src/renderer/src/lib/renderer-agent-status-observation-ingress.test.ts": 136,
+      "src/renderer/src/lib/renderer-app-platform.test.ts": 338,
+      "src/renderer/src/lib/renderer-memory-profile.test.ts": 40,
+      "src/renderer/src/lib/repo-display-labels.test.ts": 55,
+      "src/renderer/src/lib/repo-runtime-owner.test.ts": 77,
+      "src/renderer/src/lib/repo-search.test.ts": 57,
+      "src/renderer/src/lib/repo-slug-cache.test.ts": 62,
+      "src/renderer/src/lib/repo-slug-index.test.ts": 2511,
+      "src/renderer/src/lib/resolved-worktree-execution-host.test.ts": 127,
+      "src/renderer/src/lib/resume-sleeping-agent-session-direct-ssh-hydration-gap.test.ts": 1502,
+      "src/renderer/src/lib/resume-sleeping-agent-session-execution-host-scope.test.ts": 1425,
+      "src/renderer/src/lib/resume-sleeping-agent-session-provider-claim.test.ts": 1617,
+      "src/renderer/src/lib/resume-sleeping-agent-session-remote-compat.test.ts": 1603,
+      "src/renderer/src/lib/resume-sleeping-agent-session-replay.test.ts": 1351,
+      "src/renderer/src/lib/resume-sleeping-agent-session-slept-pane-recovery.test.ts": 1692,
+      "src/renderer/src/lib/resume-sleeping-agent-session-suppress-navigation.test.ts": 1627,
+      "src/renderer/src/lib/resume-sleeping-agent-session.test.ts": 5799,
+      "src/renderer/src/lib/resume-stale-structured-agent-session.test.ts": 1670,
+      "src/renderer/src/lib/right-sidebar-visibility.test.ts": 30,
+      "src/renderer/src/lib/run-quick-command-in-new-tab.test.ts": 106,
+      "src/renderer/src/lib/running-agent-targets.test.ts": 61,
+      "src/renderer/src/lib/runtime-host-unverifiable-probe-readers.test.ts": 317,
+      "src/renderer/src/lib/runtime-pane-title-leaf-id.test.ts": 67,
+      "src/renderer/src/lib/runtime-session-mirror-targets.test.ts": 67,
+      "src/renderer/src/lib/runtime-session-mirror-unverifiable-host.test.ts": 64,
+      "src/renderer/src/lib/runtime-workspace-file-route.test.ts": 140,
+      "src/renderer/src/lib/screen-submit-shortcut.test.ts": 50,
+      "src/renderer/src/lib/script-textarea-rows.test.ts": 123,
+      "src/renderer/src/lib/scroll-cache.test.ts": 51,
+      "src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts": 1709,
+      "src/renderer/src/lib/session-write-subscriber-allocation.test.ts": 215,
+      "src/renderer/src/lib/session-write-subscriber-deferred-persist.test.ts": 1599,
+      "src/renderer/src/lib/session-write-subscriber.test.ts": 1398,
+      "src/renderer/src/lib/settled-worker-wake-policy.test.ts": 1859,
+      "src/renderer/src/lib/setup-runner.test.ts": 39,
+      "src/renderer/src/lib/setup-script-prompt.test.ts": 215,
+      "src/renderer/src/lib/sha256.test.ts": 46,
+      "src/renderer/src/lib/shutdown-checkpoint-guard.test.ts": 523,
+      "src/renderer/src/lib/sidebar-worktree-activation.test.ts": 91,
+      "src/renderer/src/lib/simulator-launch-coordination.test.ts": 173,
+      "src/renderer/src/lib/simulator-palette-search.test.ts": 101,
+      "src/renderer/src/lib/simulator-pane-shutdown-scheduler.test.ts": 1567,
+      "src/renderer/src/lib/simulator-tab-palette-activation.test.ts": 2039,
+      "src/renderer/src/lib/skill-freshness-display-status.test.ts": 36,
+      "src/renderer/src/lib/sleeping-agent-session-launch-windows-quoting.test.ts": 283,
+      "src/renderer/src/lib/smart-github-submit.test.ts": 80,
+      "src/renderer/src/lib/source-control-agent-action-plan.test.ts": 954,
+      "src/renderer/src/lib/source-control-generation-plan.test.ts": 130,
+      "src/renderer/src/lib/source-control-launch-agent-selection.test.ts": 180,
+      "src/renderer/src/lib/source-control-launch-platform.test.ts": 73,
+      "src/renderer/src/lib/source-control-remote-error.test.ts": 50,
+      "src/renderer/src/lib/sparse-preset-draft.test.ts": 84,
+      "src/renderer/src/lib/ssh-background-startup-delivery.test.ts": 79,
+      "src/renderer/src/lib/ssh-failed-target-sleeping-agent-resume.test.ts": 1878,
+      "src/renderer/src/lib/ssh-mutation-expectation.test.ts": 46,
+      "src/renderer/src/lib/startup-ui-hydration.test.ts": 152,
+      "src/renderer/src/lib/state-collection-byte-estimate.test.ts": 84,
+      "src/renderer/src/lib/structured-agent-launch-no-terminal-fallback.test.ts": 272,
+      "src/renderer/src/lib/structured-agent-launch-settlement.test.ts": 81,
+      "src/renderer/src/lib/structured-agent-session-launch-cancellation.test.ts": 2166,
+      "src/renderer/src/lib/structured-agent-session-launch-exited-owner.test.ts": 948,
+      "src/renderer/src/lib/structured-agent-session-launch-join-delivery.test.ts": 378,
+      "src/renderer/src/lib/structured-agent-session-launch-options.test.ts": 660,
+      "src/renderer/src/lib/structured-agent-session-launch-persistence.test.ts": 449,
+      "src/renderer/src/lib/structured-agent-session-launch-prompt.test.ts": 357,
+      "src/renderer/src/lib/structured-agent-session-launch-reload.test.ts": 576,
+      "src/renderer/src/lib/structured-agent-session-launch-resume-identity.test.ts": 499,
+      "src/renderer/src/lib/structured-agent-session-launch.test.ts": 1259,
+      "src/renderer/src/lib/structured-agent-session-tab-activation.test.ts": 50,
+      "src/renderer/src/lib/structured-agent-startup-label-census.test.ts": 222,
+      "src/renderer/src/lib/tab-agent-identity-decision-table.test.ts": 420,
+      "src/renderer/src/lib/tab-agent-status-index.test.ts": 308,
+      "src/renderer/src/lib/tab-agent.test.ts": 74,
+      "src/renderer/src/lib/tab-has-live-pty.test.ts": 48,
+      "src/renderer/src/lib/tab-number-shortcuts.test.ts": 1493,
+      "src/renderer/src/lib/terminal-contrast-correction.test.ts": 44,
+      "src/renderer/src/lib/terminal-file-uri-link.test.ts": 33,
+      "src/renderer/src/lib/terminal-input-activity-coalescing.test.ts": 61,
+      "src/renderer/src/lib/terminal-links-redos.test.ts": 69,
+      "src/renderer/src/lib/terminal-links.test.ts": 274,
+      "src/renderer/src/lib/terminal-pane-title-sanitization.test.ts": 51,
+      "src/renderer/src/lib/terminal-quick-command-project-scope.test.ts": 76,
+      "src/renderer/src/lib/terminal-quick-command-score-budget.test.ts": 61,
+      "src/renderer/src/lib/terminal-quick-command-search.test.ts": 73,
+      "src/renderer/src/lib/terminal-reveal-identity.test.ts": 41,
+      "src/renderer/src/lib/terminal-shortcut-capture-notification.test.tsx": 1568,
+      "src/renderer/src/lib/terminal-tab-for-pty-id.test.ts": 31,
+      "src/renderer/src/lib/terminal-theme.test.ts": 80,
+      "src/renderer/src/lib/terminal-worktree-route.test.ts": 210,
+      "src/renderer/src/lib/text-control-paste-ownership.test.ts": 475,
+      "src/renderer/src/lib/text-control-paste.test.ts": 490,
+      "src/renderer/src/lib/titlebar-left-chrome.test.ts": 27,
+      "src/renderer/src/lib/titlebar-worktree-history-controls.test.ts": 50,
+      "src/renderer/src/lib/tui-agent-startup.test.ts": 103,
+      "src/renderer/src/lib/typing-latency/diagnostic-lifecycle.test.ts": 562,
+      "src/renderer/src/lib/typing-latency/diagnostic-summary.test.ts": 61,
+      "src/renderer/src/lib/typing-latency/echo-instrumentation.test.ts": 246,
+      "src/renderer/src/lib/typing-latency/input-events.test.ts": 385,
+      "src/renderer/src/lib/typing-latency/input-source.test.ts": 75,
+      "src/renderer/src/lib/typing-latency/sample-window.test.ts": 57,
+      "src/renderer/src/lib/ui-zoom.test.ts": 59,
+      "src/renderer/src/lib/unread-badge-count.test.ts": 51,
+      "src/renderer/src/lib/update-check-click-options.test.ts": 40,
+      "src/renderer/src/lib/updater-beforeunload.test.ts": 60,
+      "src/renderer/src/lib/use-tab-agent-observed-signal-dispatch.test.tsx": 1567,
+      "src/renderer/src/lib/use-tab-agent-opencode-native-title.test.ts": 1480,
+      "src/renderer/src/lib/use-tab-agent-pi-identity.test.ts": 92,
+      "src/renderer/src/lib/use-tab-agent-process-signals.test.ts": 2086,
+      "src/renderer/src/lib/use-tab-agent-remote-pty-selector.test.ts": 118,
+      "src/renderer/src/lib/use-tab-agent-retained-identity.test.ts": 1549,
+      "src/renderer/src/lib/use-tab-agent-sleeping-session.test.ts": 1948,
+      "src/renderer/src/lib/use-tab-agent.test.ts": 1893,
+      "src/renderer/src/lib/visible-overlay.test.ts": 464,
+      "src/renderer/src/lib/wake-sleeping-agents-in-background.test.ts": 276,
+      "src/renderer/src/lib/wake-sleeping-agents-live-done.test.ts": 437,
+      "src/renderer/src/lib/web-client-location.test.ts": 52,
+      "src/renderer/src/lib/window-label-formatter.test.ts": 27,
+      "src/renderer/src/lib/window-visibility-interval.test.ts": 70,
+      "src/renderer/src/lib/window-visibility-timeout-poller.test.ts": 67,
+      "src/renderer/src/lib/windows-terminal-capabilities-race.test.ts": 317,
+      "src/renderer/src/lib/windows-terminal-capabilities.test.ts": 401,
+      "src/renderer/src/lib/windows-terminal-capability-reprobe.test.ts": 432,
+      "src/renderer/src/lib/work-item-link-query-bounds.test.ts": 49,
+      "src/renderer/src/lib/work-item-lookup-text.test.ts": 55,
+      "src/renderer/src/lib/worker-terminal-takeover-report.test.ts": 314,
+      "src/renderer/src/lib/workspace-activation-path-gate.test.ts": 1954,
+      "src/renderer/src/lib/workspace-activation-terminal-focus.test.ts": 345,
+      "src/renderer/src/lib/workspace-browser-tab-open.test.ts": 325,
+      "src/renderer/src/lib/workspace-composer-initial-focus.test.ts": 351,
+      "src/renderer/src/lib/workspace-create-error-format.test.ts": 99,
+      "src/renderer/src/lib/workspace-doc-address-input.test.ts": 208,
+      "src/renderer/src/lib/workspace-emoji-shortcodes.lazy.test.ts": 103,
+      "src/renderer/src/lib/workspace-emoji-shortcodes.test.ts": 79,
+      "src/renderer/src/lib/workspace-file-drag.test.ts": 94,
+      "src/renderer/src/lib/workspace-port-groups.test.ts": 49,
+      "src/renderer/src/lib/workspace-port-host-availability.test.ts": 40,
+      "src/renderer/src/lib/workspace-port-scan-debounce.test.ts": 48,
+      "src/renderer/src/lib/workspace-port-scan-publish.test.ts": 672,
+      "src/renderer/src/lib/workspace-session-browser-history.test.ts": 196,
+      "src/renderer/src/lib/workspace-session-closed-tab-tombstones.test.ts": 146,
+      "src/renderer/src/lib/workspace-session-editor-drafts.test.ts": 156,
+      "src/renderer/src/lib/workspace-session-host-contention.test.ts": 236,
+      "src/renderer/src/lib/workspace-session-host-persistence.test.ts": 301,
+      "src/renderer/src/lib/workspace-session-host-split.test.ts": 128,
+      "src/renderer/src/lib/workspace-session-hydration-keys.test.ts": 36,
+      "src/renderer/src/lib/workspace-session-liveness.test.ts": 133,
+      "src/renderer/src/lib/workspace-session-patch.test.ts": 196,
+      "src/renderer/src/lib/workspace-session-persistence-gate.test.ts": 209,
+      "src/renderer/src/lib/workspace-session-relevant-fields.test.ts": 200,
+      "src/renderer/src/lib/workspace-session-ssh-partition-ownership.test.ts": 210,
+      "src/renderer/src/lib/workspace-session-ssh-partition-round-trip.test.ts": 235,
+      "src/renderer/src/lib/workspace-session-staged-browser-tabs.test.ts": 39,
+      "src/renderer/src/lib/workspace-session.test.ts": 150,
+      "src/renderer/src/lib/workspace-tab-agent-metadata.test.ts": 49,
+      "src/renderer/src/lib/workspace-tab-palette-activation.store.test.ts": 1538,
+      "src/renderer/src/lib/workspace-tab-palette-activation.test.ts": 73,
+      "src/renderer/src/lib/workspace-tab-palette-results.test.ts": 105,
+      "src/renderer/src/lib/workspace-tab-palette-search.test.ts": 216,
+      "src/renderer/src/lib/workspace-terminal-host-authority.test.ts": 1735,
+      "src/renderer/src/lib/worktree-activation-agent-startup.test.ts": 1648,
+      "src/renderer/src/lib/worktree-activation-automation-filter.test.ts": 1897,
+      "src/renderer/src/lib/worktree-activation-created-agent.test.ts": 1592,
+      "src/renderer/src/lib/worktree-activation-default-tabs.test.ts": 1319,
+      "src/renderer/src/lib/worktree-activation-emptied-workspace-reseed.test.ts": 2006,
+      "src/renderer/src/lib/worktree-activation-empty-remote.test.ts": 1783,
+      "src/renderer/src/lib/worktree-activation-issue-command.test.ts": 1036,
+      "src/renderer/src/lib/worktree-activation-pty-inventory.test.ts": 182,
+      "src/renderer/src/lib/worktree-activation-reveal.test.ts": 1804,
+      "src/renderer/src/lib/worktree-activation-setup-script.test.ts": 1979,
+      "src/renderer/src/lib/worktree-activation-structured-chat-surface.test.ts": 1880,
+      "src/renderer/src/lib/worktree-activation-surface-caller-wiring.test.ts": 290,
+      "src/renderer/src/lib/worktree-activation-web-runtime.test.ts": 1340,
+      "src/renderer/src/lib/worktree-activity-state.test.ts": 69,
+      "src/renderer/src/lib/worktree-agent-activation-gate.test.ts": 1546,
+      "src/renderer/src/lib/worktree-agent-activation-seam.test.ts": 1685,
+      "src/renderer/src/lib/worktree-agent-structured-inventory.test.ts": 132,
+      "src/renderer/src/lib/worktree-attachment-label.test.ts": 56,
+      "src/renderer/src/lib/worktree-creation-agent-seeding.test.ts": 622,
+      "src/renderer/src/lib/worktree-creation-agent-seeds.test.ts": 1725,
+      "src/renderer/src/lib/worktree-creation-chat-setup.test.ts": 1752,
+      "src/renderer/src/lib/worktree-creation-flow-agent-trust-preflight.test.ts": 34,
+      "src/renderer/src/lib/worktree-creation-flow-dedupe.test.ts": 887,
+      "src/renderer/src/lib/worktree-creation-flow-stranded-surface.test.ts": 1050,
+      "src/renderer/src/lib/worktree-creation-flow.test.ts": 2555,
+      "src/renderer/src/lib/worktree-creation-structured-session.test.ts": 922,
+      "src/renderer/src/lib/worktree-creation-surface.test.ts": 43,
+      "src/renderer/src/lib/worktree-default-display-name.test.ts": 67,
+      "src/renderer/src/lib/worktree-display-name-order.test.ts": 33,
+      "src/renderer/src/lib/worktree-draft-startup-view-mode.test.ts": 1565,
+      "src/renderer/src/lib/worktree-git-identity-display.test.ts": 78,
+      "src/renderer/src/lib/worktree-jump-navigation.test.ts": 231,
+      "src/renderer/src/lib/worktree-live-terminal-surface-owners.test.ts": 210,
+      "src/renderer/src/lib/worktree-operation-generation.test.ts": 319,
+      "src/renderer/src/lib/worktree-operation-route.test.ts": 63,
+      "src/renderer/src/lib/worktree-palette-comment-snippet.test.ts": 56,
+      "src/renderer/src/lib/worktree-palette-create-action.test.ts": 52,
+      "src/renderer/src/lib/worktree-palette-multi-keyword.test.ts": 216,
+      "src/renderer/src/lib/worktree-palette-review-match.test.ts": 96,
+      "src/renderer/src/lib/worktree-palette-runtime-owner-identity.test.ts": 81,
+      "src/renderer/src/lib/worktree-palette-search.test.ts": 166,
+      "src/renderer/src/lib/worktree-palette-task-url-match.test.ts": 118,
+      "src/renderer/src/lib/worktree-reactivation-preserved-pane-replacement.test.ts": 2149,
+      "src/renderer/src/lib/worktree-reactivation-runtime-owned-resume-deferral.test.ts": 1803,
+      "src/renderer/src/lib/worktree-reactivation-tab-forkbomb.test.ts": 1778,
+      "src/renderer/src/lib/worktree-runtime-owner-index.detected-perf.test.ts": 956,
+      "src/renderer/src/lib/worktree-runtime-owner-index.detected.test.ts": 184,
+      "src/renderer/src/lib/worktree-runtime-owner-index.test.ts": 37,
+      "src/renderer/src/lib/worktree-runtime-owner.test.ts": 233,
+      "src/renderer/src/lib/worktree-sort-order-host-split.test.ts": 150,
+      "src/renderer/src/lib/worktree-sort-order-persistence.test.ts": 179,
+      "src/renderer/src/lib/worktree-status-spinner-launch-agent.test.ts": 59,
+      "src/renderer/src/lib/worktree-status-terminal-layout-roots.test.ts": 58,
+      "src/renderer/src/lib/worktree-status.interrupted.test.ts": 74,
+      "src/renderer/src/lib/worktree-status.test.ts": 98,
+      "src/renderer/src/lib/worktree-visit-recency.test.ts": 37,
+      "src/renderer/src/renderer-node-builtin-boundary.test.ts": 1218,
+      "src/renderer/src/runtime/agent-resume-host-authority-capability.test.ts": 39,
+      "src/renderer/src/runtime/agent-session-keyboard-capability.test.ts": 66,
+      "src/renderer/src/runtime/agent-session-operation-id.test.ts": 64,
+      "src/renderer/src/runtime/antigravity-generation-compatibility.test.ts": 167,
+      "src/renderer/src/runtime/browser-client-host-identity.test.ts": 60,
+      "src/renderer/src/runtime/browser-workspace-tab-close-census.test.ts": 361,
+      "src/renderer/src/runtime/browser-workspace-tab-close-plan.test.ts": 33,
+      "src/renderer/src/runtime/browser-workspace-tab-close.test.ts": 92,
+      "src/renderer/src/runtime/client-hosted-browser-close-intent-replay.test.ts": 172,
+      "src/renderer/src/runtime/client-hosted-browser-close-intents.test.ts": 103,
+      "src/renderer/src/runtime/client-hosted-browser-row-close.test.ts": 216,
+      "src/renderer/src/runtime/close-mirrored-editor-tab.test.ts": 107,
+      "src/renderer/src/runtime/file-explorer-delete-owner-provenance.test.ts": 2077,
+      "src/renderer/src/runtime/focus-runtime-terminal-surface-chat-view.test.ts": 502,
+      "src/renderer/src/runtime/github-check-details-timeout.test.ts": 41,
+      "src/renderer/src/runtime/gitlab-job-trace-client.test.ts": 141,
+      "src/renderer/src/runtime/host-session-mirror-empty-inventory-settle.test.ts": 630,
+      "src/renderer/src/runtime/host-session-mirror-flap-hydration.test.ts": 197,
+      "src/renderer/src/runtime/host-session-mirror-hydration-drain.test.ts": 239,
+      "src/renderer/src/runtime/host-session-mirror-hydration-frame-ordering.test.tsx": 1759,
+      "src/renderer/src/runtime/host-session-mirror-settle-census.test.ts": 505,
+      "src/renderer/src/runtime/host-session-mirror-settle-receipt-frames.test.tsx": 1864,
+      "src/renderer/src/runtime/host-session-snapshot-authority-client-hosted.test.ts": 52,
+      "src/renderer/src/runtime/local-runtime-capabilities.test.ts": 473,
+      "src/renderer/src/runtime/local-session-tab-close-owner.test.ts": 58,
+      "src/renderer/src/runtime/local-structured-session-empty-worktree-visibility.test.ts": 1132,
+      "src/renderer/src/runtime/local-structured-session-retired-epoch-repair.test.ts": 1743,
+      "src/renderer/src/runtime/local-structured-session-reveal-visibility.test.ts": 1580,
+      "src/renderer/src/runtime/local-structured-session-tabs-host-isolation.test.ts": 779,
+      "src/renderer/src/runtime/local-structured-session-tabs-sync.test.ts": 2524,
+      "src/renderer/src/runtime/local-structured-session-tabs-sync/retired-epoch-repair.test.ts": 67,
+      "src/renderer/src/runtime/mirrored-agent-status-clock-skew.test.ts": 1299,
+      "src/renderer/src/runtime/mobile-markdown-bridge-save-guards.test.ts": 1242,
+      "src/renderer/src/runtime/mobile-markdown-bridge.test.ts": 1361,
+      "src/renderer/src/runtime/native-chat-launch-draft-runtime-resolution.test.ts": 38,
+      "src/renderer/src/runtime/paired-reconnect-sidebar-agent-count.test.ts": 1002,
+      "src/renderer/src/runtime/remote-agent-row-last-assistant-message.test.ts": 1196,
+      "src/renderer/src/runtime/remote-agent-session-launch.test.ts": 62,
+      "src/renderer/src/runtime/remote-host-file-delete-repro.test.ts": 2161,
+      "src/renderer/src/runtime/remote-host-file-open-repro.test.ts": 1628,
+      "src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts": 50,
+      "src/renderer/src/runtime/remote-runtime-snapshot-outcome.test.ts": 118,
+      "src/renderer/src/runtime/remote-runtime-terminal-end-verdict.test.ts": 86,
+      "src/renderer/src/runtime/remote-runtime-terminal-frame-drop-resync.test.ts": 109,
+      "src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts": 334,
+      "src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts": 96,
+      "src/renderer/src/runtime/remote-runtime-terminal-stale-stream-frames.test.ts": 87,
+      "src/renderer/src/runtime/remote-runtime-terminal-stall-recovery.test.ts": 263,
+      "src/renderer/src/runtime/remote-server-install-failure-probe.test.ts": 61,
+      "src/renderer/src/runtime/remote-server-parity.test.ts": 1760,
+      "src/renderer/src/runtime/remote-server-restart-wait.test.ts": 43,
+      "src/renderer/src/runtime/remote-server-update-coordinator.test.ts": 95,
+      "src/renderer/src/runtime/remote-terminal-layout-resolution.test.ts": 61,
+      "src/renderer/src/runtime/remote-terminal-stream-watchdog.test.ts": 52,
+      "src/renderer/src/runtime/restored-client-hosted-browser-host-attach.test.ts": 67,
+      "src/renderer/src/runtime/restored-client-hosted-browser-host-restart-attach.test.ts": 286,
+      "src/renderer/src/runtime/runtime-client-events.test.ts": 55,
+      "src/renderer/src/runtime/runtime-environment-ssh-state.test.ts": 1134,
+      "src/renderer/src/runtime/runtime-file-client-download.test.ts": 218,
+      "src/renderer/src/runtime/runtime-file-client-external-import.test.ts": 324,
+      "src/renderer/src/runtime/runtime-file-client-mutation-ownership.test.ts": 208,
+      "src/renderer/src/runtime/runtime-file-client-search-listing.test.ts": 276,
+      "src/renderer/src/runtime/runtime-file-client-watch.test.ts": 388,
+      "src/renderer/src/runtime/runtime-file-client.test.ts": 367,
+      "src/renderer/src/runtime/runtime-file-import-pairing-revision.test.ts": 311,
+      "src/renderer/src/runtime/runtime-file-search-bounds.test.ts": 38,
+      "src/renderer/src/runtime/runtime-git-client-api-contract.test.ts": 156,
+      "src/renderer/src/runtime/runtime-git-client-branch-line-total.test.ts": 182,
+      "src/renderer/src/runtime/runtime-git-client-merge.test.ts": 137,
+      "src/renderer/src/runtime/runtime-git-client.test.ts": 255,
+      "src/renderer/src/runtime/runtime-hooks-client.test.ts": 73,
+      "src/renderer/src/runtime/runtime-host-connection-state.test.ts": 50,
+      "src/renderer/src/runtime/runtime-host-contact-parity.test.ts": 81,
+      "src/renderer/src/runtime/runtime-jira-client.test.ts": 555,
+      "src/renderer/src/runtime/runtime-jira-payload-stream.test.ts": 242,
+      "src/renderer/src/runtime/runtime-linear-client.test.ts": 89,
+      "src/renderer/src/runtime/runtime-path-existence-batch.test.ts": 249,
+      "src/renderer/src/runtime/runtime-path-existence-error-parity.test.ts": 192,
+      "src/renderer/src/runtime/runtime-path-existence-pairing.test.ts": 236,
+      "src/renderer/src/runtime/runtime-path-existence-queue-pairing.test.ts": 252,
+      "src/renderer/src/runtime/runtime-provider-accounts-client.test.ts": 107,
+      "src/renderer/src/runtime/runtime-provider-search-bounds.test.ts": 44,
+      "src/renderer/src/runtime/runtime-repo-client.test.ts": 219,
+      "src/renderer/src/runtime/runtime-repo-search-bounds.test.ts": 38,
+      "src/renderer/src/runtime/runtime-rpc-client-pairing-revision.test.ts": 50,
+      "src/renderer/src/runtime/runtime-rpc-client.test.ts": 102,
+      "src/renderer/src/runtime/runtime-rpc-result.test.ts": 28,
+      "src/renderer/src/runtime/runtime-server-directory-browser.test.ts": 72,
+      "src/renderer/src/runtime/runtime-skills-client.test.ts": 78,
+      "src/renderer/src/runtime/runtime-skills-delete-client.test.ts": 61,
+      "src/renderer/src/runtime/runtime-terminal-inspection.test.ts": 1867,
+      "src/renderer/src/runtime/runtime-terminal-stream.test.ts": 341,
+      "src/renderer/src/runtime/runtime-worktree-selector.test.ts": 123,
+      "src/renderer/src/runtime/structured-agent-session-client.test.ts": 324,
+      "src/renderer/src/runtime/structured-agent-session-close.test.ts": 59,
+      "src/renderer/src/runtime/structured-agent-session-status-feed-lifecycle.test.ts": 37,
+      "src/renderer/src/runtime/structured-agent-session-status-feed.test.ts": 83,
+      "src/renderer/src/runtime/structured-agent-session-tab-retirement.test.ts": 55,
+      "src/renderer/src/runtime/structured-agent-session-turn-completion-feed.test.ts": 89,
+      "src/renderer/src/runtime/structured-conversation-tab-replacement.test.ts": 1641,
+      "src/renderer/src/runtime/sync-runtime-graph-agent-status-projection-join.test.ts": 422,
+      "src/renderer/src/runtime/sync-runtime-graph-agent-status-projection.test.ts": 334,
+      "src/renderer/src/runtime/sync-runtime-graph-automation-leaf.test.ts": 289,
+      "src/renderer/src/runtime/sync-runtime-graph-browser.test.ts": 244,
+      "src/renderer/src/runtime/sync-runtime-graph-conversion-publish.test.ts": 1365,
+      "src/renderer/src/runtime/sync-runtime-graph-editor-diff-tabs.test.ts": 332,
+      "src/renderer/src/runtime/sync-runtime-graph-key-reuse.test.ts": 358,
+      "src/renderer/src/runtime/sync-runtime-graph-parked-leaf.test.ts": 237,
+      "src/renderer/src/runtime/sync-runtime-graph-payload-partition.test.ts": 305,
+      "src/renderer/src/runtime/sync-runtime-graph-projection-hot-path.test.ts": 542,
+      "src/renderer/src/runtime/sync-runtime-graph-publication-cost.test.ts": 270,
+      "src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts": 264,
+      "src/renderer/src/runtime/sync-runtime-graph-terminal-layout.test.ts": 1061,
+      "src/renderer/src/runtime/sync-runtime-graph-terminal-registration-ownership.test.ts": 349,
+      "src/renderer/src/runtime/sync-runtime-graph-terminal-surface-projection.test.ts": 225,
+      "src/renderer/src/runtime/sync-runtime-graph-workspace-publication.test.ts": 369,
+      "src/renderer/src/runtime/sync-runtime-graph.test.ts": 342,
+      "src/renderer/src/runtime/sync-runtime-graph/mobile-terminal-theme.test.ts": 82,
+      "src/renderer/src/runtime/use-remote-runtime-recovery-triggers.test.ts": 555,
+      "src/renderer/src/runtime/use-runtime-session-mirror-environment-key.test.ts": 2476,
+      "src/renderer/src/runtime/use-worktree-runtime-target.test.ts": 2118,
+      "src/renderer/src/runtime/web-runtime-browser-capability-cleanup.test.ts": 230,
+      "src/renderer/src/runtime/web-runtime-browser-materialization.test.ts": 35,
+      "src/renderer/src/runtime/web-runtime-browser-tab-staging-hosting-intent.test.ts": 54,
+      "src/renderer/src/runtime/web-runtime-session-browser-client-placement.test.ts": 508,
+      "src/renderer/src/runtime/web-runtime-session-browser-create-failure.test.ts": 508,
+      "src/renderer/src/runtime/web-runtime-session-browser-create-focus.test.ts": 494,
+      "src/renderer/src/runtime/web-runtime-session-browser-create-split-placement.test.ts": 500,
+      "src/renderer/src/runtime/web-runtime-session-browser-create-staged-focus.test.ts": 530,
+      "src/renderer/src/runtime/web-runtime-session-browser-create-staged-hosting-intent.test.ts": 347,
+      "src/renderer/src/runtime/web-runtime-session-browser-create-staging.test.ts": 876,
+      "src/renderer/src/runtime/web-runtime-session-browser-placement-staleness.test.ts": 390,
+      "src/renderer/src/runtime/web-runtime-session-tab-activate-close.test.ts": 470,
+      "src/renderer/src/runtime/web-runtime-session-tab-move.test.ts": 317,
+      "src/renderer/src/runtime/web-runtime-session-tab-props.test.ts": 512,
+      "src/renderer/src/runtime/web-runtime-session-terminal-host-authority.test.ts": 461,
+      "src/renderer/src/runtime/web-runtime-session-terminal-legacy-create.test.ts": 336,
+      "src/renderer/src/runtime/web-runtime-session-terminal-pane-delegation.test.ts": 1290,
+      "src/renderer/src/runtime/web-runtime-session-terminal-workspace-routing.test.ts": 366,
+      "src/renderer/src/runtime/web-runtime-session.test.ts": 384,
+      "src/renderer/src/runtime/web-runtime-terminal-identity.test.ts": 57,
+      "src/renderer/src/runtime/web-runtime-wake-terminal-respawn.test.ts": 47,
+      "src/renderer/src/runtime/web-session-browser-placement.test.ts": 48,
+      "src/renderer/src/runtime/web-session-close-intent.test.ts": 53,
+      "src/renderer/src/runtime/web-session-existing-tab-index.test.ts": 35,
+      "src/renderer/src/runtime/web-session-focus-intent-visible-tab.test.ts": 1811,
+      "src/renderer/src/runtime/web-session-intent-owner.test.ts": 41,
+      "src/renderer/src/runtime/web-session-open-files-batch-equivalence.test.ts": 1150,
+      "src/renderer/src/runtime/web-session-structured-tab-focus.test.ts": 1370,
+      "src/renderer/src/runtime/web-session-tabs-agent-completion-notifications.test.ts": 1511,
+      "src/renderer/src/runtime/web-session-tabs-late-merged-predecessor-lockout.test.ts": 699,
+      "src/renderer/src/runtime/web-session-tabs-publisher-identity-lineage.test.ts": 472,
+      "src/renderer/src/runtime/web-session-tabs-removed-frame-retires-live-publisher.test.ts": 648,
+      "src/renderer/src/runtime/web-session-tabs-sync-agent-handoff.test.ts": 643,
+      "src/renderer/src/runtime/web-session-tabs-sync-agent-status.test.ts": 732,
+      "src/renderer/src/runtime/web-session-tabs-sync-browser-tabs.test.ts": 699,
+      "src/renderer/src/runtime/web-session-tabs-sync-client-owned-page-content.test.ts": 617,
+      "src/renderer/src/runtime/web-session-tabs-sync-client-owned-placement.test.ts": 727,
+      "src/renderer/src/runtime/web-session-tabs-sync-diff-focus-steal.test.ts": 468,
+      "src/renderer/src/runtime/web-session-tabs-sync-editor-tabs.test.ts": 668,
+      "src/renderer/src/runtime/web-session-tabs-sync-emptied-workspace-tombstone.test.ts": 817,
+      "src/renderer/src/runtime/web-session-tabs-sync-focus-intent.test.ts": 603,
+      "src/renderer/src/runtime/web-session-tabs-sync-host-restart-browser-rows.test.ts": 722,
+      "src/renderer/src/runtime/web-session-tabs-sync-host-tab-retraction-ghost-rows.test.ts": 2099,
+      "src/renderer/src/runtime/web-session-tabs-sync-html-preview-focus.test.ts": 659,
+      "src/renderer/src/runtime/web-session-tabs-sync-initial-terminal-relaunch.test.tsx": 2154,
+      "src/renderer/src/runtime/web-session-tabs-sync-layout-duplicate-groups.test.ts": 763,
+      "src/renderer/src/runtime/web-session-tabs-sync-layout-groups.test.ts": 671,
+      "src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts": 1309,
+      "src/renderer/src/runtime/web-session-tabs-sync-mirrored-draft-close.test.ts": 2175,
+      "src/renderer/src/runtime/web-session-tabs-sync-reconnect-resubscribe.test.tsx": 2266,
+      "src/renderer/src/runtime/web-session-tabs-sync-remote-status-title-flap.test.ts": 1052,
+      "src/renderer/src/runtime/web-session-tabs-sync-restored-browser-rows.test.ts": 735,
+      "src/renderer/src/runtime/web-session-tabs-sync-snapshot-batch.test.ts": 666,
+      "src/renderer/src/runtime/web-session-tabs-sync-staged-browser-adoption.test.ts": 789,
+      "src/renderer/src/runtime/web-session-tabs-sync-staged-browser-authority.test.ts": 732,
+      "src/renderer/src/runtime/web-session-tabs-sync-terminal-bootstrap.test.ts": 603,
+      "src/renderer/src/runtime/web-session-tabs-sync-terminal-mirroring.test.ts": 756,
+      "src/renderer/src/runtime/web-session-tabs-sync-tracking-teardown.test.ts": 700,
+      "src/renderer/src/runtime/web-session-tabs-sync-unverifiable-host.test.tsx": 1481,
+      "src/renderer/src/runtime/web-session-tabs-sync-visibility-collision.test.tsx": 2322,
+      "src/renderer/src/runtime/web-session-tabs-sync-window-visibility.test.tsx": 6067,
+      "src/renderer/src/runtime/web-session-tabs-sync.test.ts": 610,
+      "src/renderer/src/runtime/web-session-tabs-sync/mirrored-agent-tab-label.test.ts": 1260,
+      "src/renderer/src/runtime/web-session-tabs-sync/mirrored-status-tab-retractions.test.ts": 1840,
+      "src/renderer/src/runtime/web-session-tabs-sync/mirrored-terminal-recovery-ledger.test.ts": 1252,
+      "src/renderer/src/runtime/web-session-tabs-sync/retraction-pane-ownership.test.ts": 1429,
+      "src/renderer/src/runtime/web-session-tabs-sync/tracking-lifecycle.test.ts": 1590,
+      "src/renderer/src/runtime/web-session-terminal-handle-events.test.ts": 29,
+      "src/renderer/src/runtime/web-session-terminal-orphan-absence-across-republication.test.ts": 313,
+      "src/renderer/src/runtime/web-session-terminal-orphan-inventory-retry.test.ts": 1303,
+      "src/renderer/src/runtime/web-session-terminal-orphan-mixed-version.test.ts": 607,
+      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-adoption-regressions.test.ts": 754,
+      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-host-scope-gate.test.ts": 306,
+      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-prior-removal.test.ts": 328,
+      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-regressions.test.ts": 607,
+      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-topology-fence.test.ts": 370,
+      "src/renderer/src/runtime/web-session-terminal-orphan-recovery.test.ts": 327,
+      "src/renderer/src/runtime/web-session-terminal-pending-handle-recovery.test.ts": 229,
+      "src/renderer/src/runtime/web-session-terminal-recovery-snapshot-validation.test.ts": 444,
+      "src/renderer/src/runtime/web-session-terminal-retirement-proof-ledger.test.ts": 350,
+      "src/renderer/src/runtime/window-visibility-subscription-parking.test.ts": 524,
+      "src/renderer/src/runtime/worktree-create-base.test.ts": 45,
+      "src/renderer/src/ssh/ssh-connect-in-flight.test.ts": 69,
+      "src/renderer/src/ssh/ssh-connect-ui-timeout.test.ts": 51,
+      "src/renderer/src/ssh/ssh-connect-verb.test.ts": 35,
+      "src/renderer/src/ssh/ssh-connection-recoverability.test.ts": 50,
+      "src/renderer/src/startup/active-workspace-ssh-targets.test.ts": 68,
+      "src/renderer/src/startup/ssh-startup-reconnect.test.ts": 68,
+      "src/renderer/src/startup/startup-ssh-connection-restore.test.ts": 51,
+      "src/renderer/src/store/active-terminal-chrome-selector.test.ts": 44,
+      "src/renderer/src/store/always-mounted-selector-scan-cost.test.ts": 1670,
+      "src/renderer/src/store/copy-on-write-record.test.ts": 31,
+      "src/renderer/src/store/folder-workspaces/folder-workspace-catalog.test.ts": 51,
+      "src/renderer/src/store/github/cache-persistence.test.ts": 1363,
+      "src/renderer/src/store/github/refresh-event-noop-notification.test.ts": 1047,
+      "src/renderer/src/store/pinned-tab-close-guard.test.ts": 44,
+      "src/renderer/src/store/plugin-language-packs.test.ts": 321,
+      "src/renderer/src/store/plugin-panels.test.ts": 372,
+      "src/renderer/src/store/project-host-setup-selector.test.ts": 92,
+      "src/renderer/src/store/projects/project-catalog-null-field-ingest.test.ts": 57,
+      "src/renderer/src/store/projects/project-wsl-filesystem-boundary-advisory.test.ts": 64,
+      "src/renderer/src/store/react-commit-cascade-write-probe.test.ts": 56,
+      "src/renderer/src/store/repos/safe-auto-fork-sync.test.ts": 349,
+      "src/renderer/src/store/right-sidebar-route.test.ts": 48,
+      "src/renderer/src/store/running-terminal-close-confirm.test.ts": 64,
+      "src/renderer/src/store/selectors.test.ts": 855,
+      "src/renderer/src/store/slices/active-tab-owner-worktree.test.ts": 35,
+      "src/renderer/src/store/slices/activity-cleared-at.test.ts": 1576,
+      "src/renderer/src/store/slices/agent-generated-tab-title.test.ts": 1560,
+      "src/renderer/src/store/slices/agent-hibernation-live-anchor-e2e.test.ts": 1193,
+      "src/renderer/src/store/slices/agent-pane-authority.test.ts": 1347,
+      "src/renderer/src/store/slices/agent-status-ack-cleanup.test.ts": 1530,
+      "src/renderer/src/store/slices/agent-status-batch.test.ts": 1745,
+      "src/renderer/src/store/slices/agent-status-drop-ipc.test.ts": 2454,
+      "src/renderer/src/store/slices/agent-status-drop.test.ts": 1626,
+      "src/renderer/src/store/slices/agent-status-freshness-cache.test.ts": 53,
+      "src/renderer/src/store/slices/agent-status-freshness-scheduler.test.ts": 66,
+      "src/renderer/src/store/slices/agent-status-live-freshness-request.test.ts": 105,
+      "src/renderer/src/store/slices/agent-status-live-map-leak.test.ts": 14465,
+      "src/renderer/src/store/slices/agent-status-main-agent-fact.test.ts": 1154,
+      "src/renderer/src/store/slices/agent-status-manual-sleep-capture.test.ts": 1706,
+      "src/renderer/src/store/slices/agent-status-observation-neutrality.test.ts": 1545,
+      "src/renderer/src/store/slices/agent-status-pane-keyed-records.test.ts": 81,
+      "src/renderer/src/store/slices/agent-status-pr-refresh-handoff.test.ts": 1297,
+      "src/renderer/src/store/slices/agent-status-provider-session.test.ts": 1545,
+      "src/renderer/src/store/slices/agent-status-quit-capture-resumable-agents.test.ts": 1507,
+      "src/renderer/src/store/slices/agent-status-quit-capture.test.ts": 1864,
+      "src/renderer/src/store/slices/agent-status-reminted-pane-key.test.ts": 1189,
+      "src/renderer/src/store/slices/agent-status-retained-leak.test.ts": 1428,
+      "src/renderer/src/store/slices/agent-status-retention-prefix-sweep.test.ts": 1493,
+      "src/renderer/src/store/slices/agent-status-runtime-orchestration.test.ts": 1552,
+      "src/renderer/src/store/slices/agent-status-session-boundary-done.test.ts": 1464,
+      "src/renderer/src/store/slices/agent-status-ssh-connection-clear.test.ts": 1418,
+      "src/renderer/src/store/slices/agent-status-tool-assistant-fields.test.ts": 1612,
+      "src/renderer/src/store/slices/agent-status-worktree-purge-leak.test.ts": 1555,
+      "src/renderer/src/store/slices/agent-status.test.ts": 1634,
+      "src/renderer/src/store/slices/ambiguous-owner-warning-worktree-removal-leak.test.ts": 1263,
+      "src/renderer/src/store/slices/browser-cleanup-close.test.ts": 1227,
+      "src/renderer/src/store/slices/browser-page-close-intent-recording.test.ts": 1104,
+      "src/renderer/src/store/slices/browser-page-conversion.test.ts": 1151,
+      "src/renderer/src/store/slices/browser-remote-page-lifecycle.test.ts": 575,
+      "src/renderer/src/store/slices/browser-remote-tab-creation.test.ts": 381,
+      "src/renderer/src/store/slices/browser-session-host-selection.test.ts": 570,
+      "src/renderer/src/store/slices/browser-session-profiles.test.ts": 260,
+      "src/renderer/src/store/slices/browser-webview-cleanup.test.ts": 58,
+      "src/renderer/src/store/slices/browser-workspace-doc-location.test.ts": 1651,
+      "src/renderer/src/store/slices/browser-workspace-host-ownership.test.ts": 331,
+      "src/renderer/src/store/slices/browser.test.ts": 315,
+      "src/renderer/src/store/slices/bulk-worktree-purge-terminal-maps-leak.test.ts": 959,
+      "src/renderer/src/store/slices/cmd-j-create-actions.test.ts": 1073,
+      "src/renderer/src/store/slices/codex-restart-notice-lifecycle.test.ts": 1538,
+      "src/renderer/src/store/slices/degraded-repo-hydration.test.ts": 1492,
+      "src/renderer/src/store/slices/detected-agents-environment-prune-leak.test.ts": 998,
+      "src/renderer/src/store/slices/detected-agents.test.ts": 330,
+      "src/renderer/src/store/slices/detected-worktree-refresh-leases.test.ts": 66,
+      "src/renderer/src/store/slices/dictation-model-state-stabilisation.test.ts": 270,
+      "src/renderer/src/store/slices/diffComments.test.ts": 948,
+      "src/renderer/src/store/slices/direct-ssh-pane-detach-ledger.test.ts": 951,
+      "src/renderer/src/store/slices/direct-ssh-terminal-recovery.test.ts": 1210,
+      "src/renderer/src/store/slices/direct-ssh-terminal-retry.test.ts": 1067,
+      "src/renderer/src/store/slices/direct-ssh-terminal-workspace-scope.test.ts": 75,
+      "src/renderer/src/store/slices/editor-branch-diff-snapshots.test.ts": 600,
+      "src/renderer/src/store/slices/editor-branch-line-total.test.ts": 345,
+      "src/renderer/src/store/slices/editor-check-details-tabs.test.ts": 568,
+      "src/renderer/src/store/slices/editor-close-file-cleanup.test.ts": 563,
+      "src/renderer/src/store/slices/editor-git-status-reconciliation.test.ts": 392,
+      "src/renderer/src/store/slices/editor-hydration-scaling.test.ts": 1744,
+      "src/renderer/src/store/slices/editor-markdown-link-activation.test.ts": 432,
+      "src/renderer/src/store/slices/editor-markdown-view-state.test.ts": 273,
+      "src/renderer/src/store/slices/editor-open-diff.test.ts": 567,
+      "src/renderer/src/store/slices/editor-preview-tab-setting.test.ts": 318,
+      "src/renderer/src/store/slices/editor-read-only-tabs.test.ts": 391,
+      "src/renderer/src/store/slices/editor-recently-closed-tabs.test.ts": 635,
+      "src/renderer/src/store/slices/editor-rekey-open-files.test.ts": 918,
+      "src/renderer/src/store/slices/editor-remote-branch-actions.test.ts": 1644,
+      "src/renderer/src/store/slices/editor-rich-markdown-size-override.test.ts": 519,
+      "src/renderer/src/store/slices/editor-right-sidebar-state.test.ts": 451,
+      "src/renderer/src/store/slices/editor-session-duplicate-restore.test.ts": 1199,
+      "src/renderer/src/store/slices/editor-state-worktree-purge-leak.test.ts": 1615,
+      "src/renderer/src/store/slices/editor-tab-placement.test.ts": 440,
+      "src/renderer/src/store/slices/editor/actions/editor-cursor-line.test.ts": 537,
+      "src/renderer/src/store/slices/editor/actions/editor-draft-state.test.ts": 351,
+      "src/renderer/src/store/slices/editor/actions/markdown-preview-actions.test.ts": 121,
+      "src/renderer/src/store/slices/editor/file-ids/hydrated-editor-file-index.test.ts": 788,
+      "src/renderer/src/store/slices/editor/file-ids/hydrated-editor-projections.test.ts": 367,
+      "src/renderer/src/store/slices/editor/git/git-status-reconciliation.perf.test.ts": 71,
+      "src/renderer/src/store/slices/empty-update-notifications.test.ts": 1193,
+      "src/renderer/src/store/slices/folder-workspace-activation-and-activity.test.ts": 1724,
+      "src/renderer/src/store/slices/folder-workspace-diff-comments.test.ts": 540,
+      "src/renderer/src/store/slices/folder-workspace-owner-routed-mutations.test.ts": 1058,
+      "src/renderer/src/store/slices/generation-records-worktree-removal-leak.test.ts": 1546,
+      "src/renderer/src/store/slices/github-branch-mismatched-linked-pr.test.ts": 232,
+      "src/renderer/src/store/slices/github-cache-eviction-and-bounds.test.ts": 472,
+      "src/renderer/src/store/slices/github-checks-cache.test.ts": 227,
+      "src/renderer/src/store/slices/github-checks.test.ts": 49,
+      "src/renderer/src/store/slices/github-issue-source-indicator-suppression.test.ts": 261,
+      "src/renderer/src/store/slices/github-issue-state-machine.test.ts": 219,
+      "src/renderer/src/store/slices/github-pr-branch-coordinator-events.test.ts": 182,
+      "src/renderer/src/store/slices/github-pr-branch-direct-refresh-scope.test.ts": 183,
+      "src/renderer/src/store/slices/github-pr-branch-fallback-results.test.ts": 224,
+      "src/renderer/src/store/slices/github-pr-branch-hosted-review-cache.test.ts": 218,
+      "src/renderer/src/store/slices/github-pr-branch-linked-pr-divergence.test.ts": 195,
+      "src/renderer/src/store/slices/github-pr-checks-fetch.test.ts": 260,
+      "src/renderer/src/store/slices/github-pr-comments.test.ts": 338,
+      "src/renderer/src/store/slices/github-pr-refresh-host-guard.test.ts": 165,
+      "src/renderer/src/store/slices/github-pr-refresh-hosted-review-cache-leak.test.ts": 878,
+      "src/renderer/src/store/slices/github-pr-refresh-owner-routing.test.ts": 387,
+      "src/renderer/src/store/slices/github-pr-refresh-sequences-leak.test.ts": 132,
+      "src/renderer/src/store/slices/github-pr-refresh-states-leak.test.ts": 4096,
+      "src/renderer/src/store/slices/github-project-request-coordination.test.ts": 199,
+      "src/renderer/src/store/slices/github-project-row-owner.test.ts": 58,
+      "src/renderer/src/store/slices/github-project-view-tables.test.ts": 260,
+      "src/renderer/src/store/slices/github-provider-request-concurrency.test.ts": 214,
+      "src/renderer/src/store/slices/github-refresh-sweep.test.ts": 487,
+      "src/renderer/src/store/slices/github-repo-lookup-index.test.ts": 42,
+      "src/renderer/src/store/slices/github-review-thread-actions.test.ts": 105,
+      "src/renderer/src/store/slices/github-work-item-cache-identity.test.ts": 165,
+      "src/renderer/src/store/slices/github-work-items-error-envelope.test.ts": 211,
+      "src/renderer/src/store/slices/github-work-items-pagination.test.ts": 147,
+      "src/renderer/src/store/slices/github-work-items-query-bounds.test.ts": 43,
+      "src/renderer/src/store/slices/github-work-items-runtime-routing.test.ts": 433,
+      "src/renderer/src/store/slices/github-worktree-refresh-if-stale.test.ts": 251,
+      "src/renderer/src/store/slices/hosted-review-cache-race.test.ts": 63,
+      "src/renderer/src/store/slices/hosted-review-cache.test.ts": 112,
+      "src/renderer/src/store/slices/hosted-review.test.ts": 74,
+      "src/renderer/src/store/slices/jira.test.ts": 234,
+      "src/renderer/src/store/slices/linear-credential-error-recovery.test.ts": 124,
+      "src/renderer/src/store/slices/linear-invalidation.test.ts": 174,
+      "src/renderer/src/store/slices/linear-issue-cache-refresh.test.ts": 190,
+      "src/renderer/src/store/slices/linear-scoped-collection-cache.test.ts": 220,
+      "src/renderer/src/store/slices/linear-source-context-cache-scope.test.ts": 257,
+      "src/renderer/src/store/slices/linear.test.ts": 172,
+      "src/renderer/src/store/slices/local-detected-agent-state.test.ts": 217,
+      "src/renderer/src/store/slices/memory.test.ts": 44,
+      "src/renderer/src/store/slices/native-chat-launch-draft-teardown.test.ts": 1308,
+      "src/renderer/src/store/slices/new-issue-draft.test.ts": 32,
+      "src/renderer/src/store/slices/new-markdown.test.ts": 548,
+      "src/renderer/src/store/slices/orca-profiles-auth-actions-connect-overlap.test.ts": 1110,
+      "src/renderer/src/store/slices/orca-profiles-auth-actions.test.ts": 1336,
+      "src/renderer/src/store/slices/orca-profiles.test.ts": 1591,
+      "src/renderer/src/store/slices/pane-column-split-drop-no-op.test.ts": 36,
+      "src/renderer/src/store/slices/pane-foreground-agent.test.ts": 1584,
+      "src/renderer/src/store/slices/persisted-ui-write-baseline.test.ts": 31,
+      "src/renderer/src/store/slices/pinned-tab-close-confirm.test.ts": 46,
+      "src/renderer/src/store/slices/preflight.test.ts": 198,
+      "src/renderer/src/store/slices/project-group-removal-targets.test.ts": 73,
+      "src/renderer/src/store/slices/purge-stale-runtime-host-ownership.test.ts": 979,
+      "src/renderer/src/store/slices/purge-stale-runtime-host-state.test.ts": 1687,
+      "src/renderer/src/store/slices/rate-limits.test.ts": 40,
+      "src/renderer/src/store/slices/readopted-ssh-worktree-rows.test.ts": 55,
+      "src/renderer/src/store/slices/recently-closed-tabs.test.ts": 1723,
+      "src/renderer/src/store/slices/remote-server-updates.integration.test.ts": 239,
+      "src/renderer/src/store/slices/repo-identity-reconcile.test.ts": 55,
+      "src/renderer/src/store/slices/repo-owner-cache-identity.test.ts": 36,
+      "src/renderer/src/store/slices/repo-reorder-host-split.test.ts": 29,
+      "src/renderer/src/store/slices/repos-add-races.test.ts": 934,
+      "src/renderer/src/store/slices/repos-all-hosts-folder-workspaces.test.ts": 774,
+      "src/renderer/src/store/slices/repos-all-hosts-generation.test.ts": 1525,
+      "src/renderer/src/store/slices/repos-all-hosts.test.ts": 1100,
+      "src/renderer/src/store/slices/repos-catalog-merge-identity.test.ts": 1706,
+      "src/renderer/src/store/slices/repos-cross-host-project-collisions.test.ts": 1577,
+      "src/renderer/src/store/slices/repos-cross-host-refresh-identity.test.ts": 1132,
+      "src/renderer/src/store/slices/repos-ephemeral-vm-cleanup-retention.test.ts": 1217,
+      "src/renderer/src/store/slices/repos-host-identity-routing.test.ts": 1791,
+      "src/renderer/src/store/slices/repos-manual-order-hydration.test.ts": 1316,
+      "src/renderer/src/store/slices/repos-module-lifetime-coordinators.test.ts": 1062,
+      "src/renderer/src/store/slices/repos-nested-import-refresh-failures.test.ts": 1660,
+      "src/renderer/src/store/slices/repos-nested-ssh-projection.test.ts": 1438,
+      "src/renderer/src/store/slices/repos-onboarding-folder-startup.test.ts": 1911,
+      "src/renderer/src/store/slices/repos-paired-runtime-add.test.ts": 1182,
+      "src/renderer/src/store/slices/repos-project-group-create-race.test.ts": 1670,
+      "src/renderer/src/store/slices/repos-project-groups-delete.test.ts": 1213,
+      "src/renderer/src/store/slices/repos-project-groups-owner-routing.test.ts": 1649,
+      "src/renderer/src/store/slices/repos-project-groups.test.ts": 2702,
+      "src/renderer/src/store/slices/repos-project-host-capability.test.ts": 1491,
+      "src/renderer/src/store/slices/repos-project-host-lifecycle.test.ts": 1516,
+      "src/renderer/src/store/slices/repos-project-runtime.test.ts": 1510,
+      "src/renderer/src/store/slices/repos-refresh-identity.test.ts": 1727,
+      "src/renderer/src/store/slices/repos-remove-missing-remote-project.test.ts": 1182,
+      "src/renderer/src/store/slices/repos-remove-project-purge-leak.test.ts": 1574,
+      "src/renderer/src/store/slices/repos-runtime-project-groups.test.ts": 1141,
+      "src/renderer/src/store/slices/repos-runtime-visibility-defaults.test.ts": 1266,
+      "src/renderer/src/store/slices/repos-selected-owner-routing.test.ts": 1652,
+      "src/renderer/src/store/slices/repos-setup-script-dismissals.test.ts": 1196,
+      "src/renderer/src/store/slices/repos-shared-project-badge-color.test.ts": 1489,
+      "src/renderer/src/store/slices/repos-ssh-host-reconciliation.test.ts": 1869,
+      "src/renderer/src/store/slices/repos-stale-fetch.test.ts": 1671,
+      "src/renderer/src/store/slices/repos-update-serialization.test.ts": 1181,
+      "src/renderer/src/store/slices/repos.runtime-fallback.test.ts": 1080,
+      "src/renderer/src/store/slices/repos.test.ts": 1828,
+      "src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts": 2296,
+      "src/renderer/src/store/slices/runtime-catalog-merge-removed-env-guard.test.ts": 964,
+      "src/renderer/src/store/slices/runtime-environment-ssh.test.ts": 1253,
+      "src/renderer/src/store/slices/runtime-host-purge-session-partition-split.test.ts": 1218,
+      "src/renderer/src/store/slices/runtime-host-status-entry-parity.test.ts": 27,
+      "src/renderer/src/store/slices/runtime-pane-title-sort-epoch.test.ts": 1555,
+      "src/renderer/src/store/slices/runtime-status-catalog-identity.test.ts": 1572,
+      "src/renderer/src/store/slices/runtime-status-first-publication.test.ts": 231,
+      "src/renderer/src/store/slices/runtime-status-reconnect-connection-generation.test.ts": 940,
+      "src/renderer/src/store/slices/runtime-status-refresh-diagnostics.test.ts": 43,
+      "src/renderer/src/store/slices/runtime-status-restored-browser-host-attach.test.ts": 85,
+      "src/renderer/src/store/slices/runtime-status-skill-cache-eviction.test.ts": 1361,
+      "src/renderer/src/store/slices/runtime-status-snapshot.test.ts": 159,
+      "src/renderer/src/store/slices/runtime-status.test.ts": 744,
+      "src/renderer/src/store/slices/runtime-switch-settings-persistence.test.ts": 1535,
+      "src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts": 1441,
+      "src/renderer/src/store/slices/set-runtime-environments-purge-wiring.test.ts": 1292,
+      "src/renderer/src/store/slices/settings-owner-hydration-write-fence.test.ts": 1693,
+      "src/renderer/src/store/slices/settings-search-state.test.ts": 28,
+      "src/renderer/src/store/slices/settings.test.ts": 1774,
+      "src/renderer/src/store/slices/sparse-presets-repo-removal-purge-leak.test.ts": 1003,
+      "src/renderer/src/store/slices/sparse-presets.test.ts": 154,
+      "src/renderer/src/store/slices/ssh-target-cleanup.test.ts": 1183,
+      "src/renderer/src/store/slices/ssh.test.ts": 1594,
+      "src/renderer/src/store/slices/stale-runtime-host-rows.test.ts": 66,
+      "src/renderer/src/store/slices/store-active-worktree-selection.test.ts": 1363,
+      "src/renderer/src/store/slices/store-active-worktree-split-groups.test.ts": 936,
+      "src/renderer/src/store/slices/store-active-worktree-tab-close.test.ts": 1825,
+      "src/renderer/src/store/slices/store-active-worktree-terminal-creation.test.ts": 1764,
+      "src/renderer/src/store/slices/store-create-tab-id-hint.test.ts": 1193,
+      "src/renderer/src/store/slices/store-session-browser-hydration.test.ts": 1304,
+      "src/renderer/src/store/slices/store-session-cascades.test.ts": 1595,
+      "src/renderer/src/store/slices/store-session-editor-hydration.test.ts": 1660,
+      "src/renderer/src/store/slices/store-session-terminal-activity.test.ts": 1743,
+      "src/renderer/src/store/slices/store-session-terminal-reconnect.test.ts": 1259,
+      "src/renderer/src/store/slices/store-session-workspace-hydration.test.ts": 1696,
+      "src/renderer/src/store/slices/store-sleep-agent-status-retention.test.ts": 1821,
+      "src/renderer/src/store/slices/store-sleep-exact-runtime-stop.test.ts": 1576,
+      "src/renderer/src/store/slices/store-sleep-pane-hibernation.test.ts": 4925,
+      "src/renderer/src/store/slices/store-sleep-runtime-convergence.test.ts": 2006,
+      "src/renderer/src/store/slices/store-sleep-shutdown-order.test.ts": 1064,
+      "src/renderer/src/store/slices/store-worktree-removal-cascade.test.ts": 1619,
+      "src/renderer/src/store/slices/superseded-ssh-repo-rows.test.ts": 47,
+      "src/renderer/src/store/slices/tab-group-reference-repair.test.ts": 44,
+      "src/renderer/src/store/slices/tab-group-state.test.ts": 48,
+      "src/renderer/src/store/slices/tab-view-mode.test.ts": 1209,
+      "src/renderer/src/store/slices/tab-worktree-orphan-map-purge-leak.test.ts": 1020,
+      "src/renderer/src/store/slices/tabs-empty-split-activation.test.ts": 1261,
+      "src/renderer/src/store/slices/tabs-hydration-generated-title.test.ts": 30,
+      "src/renderer/src/store/slices/tabs-hydration-group-validation.test.ts": 74,
+      "src/renderer/src/store/slices/tabs-hydration.test.ts": 40,
+      "src/renderer/src/store/slices/tabs-label-and-pin-state.test.ts": 963,
+      "src/renderer/src/store/slices/tabs-model-reconciliation.test.ts": 1467,
+      "src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts": 1598,
+      "src/renderer/src/store/slices/tabs-pane-layout-operations.test.ts": 1646,
+      "src/renderer/src/store/slices/tabs-session-hydration.test.ts": 1685,
+      "src/renderer/src/store/slices/tabs-unread-and-focus.test.ts": 931,
+      "src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts": 1267,
+      "src/renderer/src/store/slices/tabs/tab-selection-contract.test.ts": 79,
+      "src/renderer/src/store/slices/tabs/tabs-reconciliation-batch-identity.test.ts": 1578,
+      "src/renderer/src/store/slices/task-creation-drafts.test.ts": 57,
+      "src/renderer/src/store/slices/terminal-helpers.test.ts": 83,
+      "src/renderer/src/store/slices/terminal-input-activity-store-write.test.ts": 1592,
+      "src/renderer/src/store/slices/terminal-layout-pty-ownership.test.ts": 1199,
+      "src/renderer/src/store/slices/terminal-orphan-helpers.test.ts": 157,
+      "src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts": 1531,
+      "src/renderer/src/store/slices/terminal-pane-detach-agent-retention.test.ts": 1305,
+      "src/renderer/src/store/slices/terminal-pane-retirement-ownership.test.ts": 187,
+      "src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts": 1171,
+      "src/renderer/src/store/slices/terminal-quick-command-hosts.test.ts": 1465,
+      "src/renderer/src/store/slices/terminal-startup-command-retention.test.ts": 1601,
+      "src/renderer/src/store/slices/terminal-tab-id-hydration.test.ts": 1215,
+      "src/renderer/src/store/slices/terminal-tab-owner-index.test.ts": 42,
+      "src/renderer/src/store/slices/terminal-tab-recovery-remount.test.ts": 1542,
+      "src/renderer/src/store/slices/terminal-tab-retirement-store.test.ts": 1666,
+      "src/renderer/src/store/slices/terminal-tab-retirement.test.ts": 195,
+      "src/renderer/src/store/slices/terminal-tab-title-batch.test.ts": 1100,
+      "src/renderer/src/store/slices/terminal-write-identity-bailouts.test.ts": 1607,
+      "src/renderer/src/store/slices/terminals-explicit-empty-hydration.test.ts": 1078,
+      "src/renderer/src/store/slices/terminals-hydration-canonical-pty-overlap.test.ts": 1366,
+      "src/renderer/src/store/slices/terminals-hydration-canonical-rows.test.ts": 1490,
+      "src/renderer/src/store/slices/terminals-hydration.test.ts": 2826,
+      "src/renderer/src/store/slices/ui-acknowledge-agents-clock-skew.test.ts": 355,
+      "src/renderer/src/store/slices/ui-agent-send-target.test.ts": 413,
+      "src/renderer/src/store/slices/ui-contextual-tours.test.ts": 211,
+      "src/renderer/src/store/slices/ui-feature-interactions.test.ts": 408,
+      "src/renderer/src/store/slices/ui-hydration-view-layout.test.ts": 224,
+      "src/renderer/src/store/slices/ui-hydration-workspace-cleanup-browse.test.ts": 284,
+      "src/renderer/src/store/slices/ui-hydration-workspace-preferences.test.ts": 462,
+      "src/renderer/src/store/slices/ui-modal-slot-dismissal.test.ts": 580,
+      "src/renderer/src/store/slices/ui-new-workspace-draft.test.ts": 247,
+      "src/renderer/src/store/slices/ui-notice-dismissals.test.ts": 465,
+      "src/renderer/src/store/slices/ui-page-navigation.test.ts": 403,
+      "src/renderer/src/store/slices/ui/ui-slice-surface-actions.test.ts": 1254,
+      "src/renderer/src/store/slices/usage-snapshot-refresh.benchmark.test.ts": 55,
+      "src/renderer/src/store/slices/usage-web-client-fallback.test.ts": 51,
+      "src/renderer/src/store/slices/workspace-cleanup-browse.test.ts": 62,
+      "src/renderer/src/store/slices/workspace-cleanup-cache-hydration.test.ts": 369,
+      "src/renderer/src/store/slices/workspace-cleanup-enrichment-performance.test.ts": 404,
+      "src/renderer/src/store/slices/workspace-cleanup-host-qualified-list-state.test.ts": 1418,
+      "src/renderer/src/store/slices/workspace-cleanup-local-evidence-invariants.test.ts": 196,
+      "src/renderer/src/store/slices/workspace-cleanup-removal-preflight.test.ts": 260,
+      "src/renderer/src/store/slices/workspace-cleanup-scan-progress-boundary.test.ts": 64,
+      "src/renderer/src/store/slices/workspace-cleanup-scan-progress.test.ts": 818,
+      "src/renderer/src/store/slices/workspace-cleanup-unverified-removal-consent.test.ts": 138,
+      "src/renderer/src/store/slices/workspace-cleanup-wrong-host-removal-guard.test.ts": 1879,
+      "src/renderer/src/store/slices/workspace-cleanup-wrong-host-removal.test.ts": 1391,
+      "src/renderer/src/store/slices/workspace-document-title-refresh.test.ts": 1426,
+      "src/renderer/src/store/slices/workspace-space.test.ts": 40,
+      "src/renderer/src/store/slices/worktree-by-id-index.test.ts": 52,
+      "src/renderer/src/store/slices/worktree-catalog-reconciliation.test.ts": 38,
+      "src/renderer/src/store/slices/worktree-helpers.test.ts": 55,
+      "src/renderer/src/store/slices/worktree-listing-branch-switch.test.ts": 52,
+      "src/renderer/src/store/slices/worktree-meta-update-application.test.ts": 71,
+      "src/renderer/src/store/slices/worktree-nav-history-view-entries.test.ts": 68,
+      "src/renderer/src/store/slices/worktree-nav-history.test.ts": 51,
+      "src/renderer/src/store/slices/worktree-removal-maps-leak.test.ts": 1074,
+      "src/renderer/src/store/slices/worktree-sleep-intent-lifecycle.test.ts": 1593,
+      "src/renderer/src/store/slices/worktree-terminal-removal-teardown.test.ts": 1486,
+      "src/renderer/src/store/slices/worktree-visibility-owner-settings.test.ts": 67,
+      "src/renderer/src/store/slices/worktree-visibility-settings-write.test.ts": 1508,
+      "src/renderer/src/store/slices/worktrees-activity-persistence.test.ts": 937,
+      "src/renderer/src/store/slices/worktrees-create-base-status.test.ts": 516,
+      "src/renderer/src/store/slices/worktrees-create-parent-pick.test.ts": 587,
+      "src/renderer/src/store/slices/worktrees-fetch-listing-merge.test.ts": 520,
+      "src/renderer/src/store/slices/worktrees-fetch-owner-routing.test.ts": 1805,
+      "src/renderer/src/store/slices/worktrees-fetch-persisted-metadata-fallback.test.ts": 566,
+      "src/renderer/src/store/slices/worktrees-fetch-refresh-coalescing.test.ts": 689,
+      "src/renderer/src/store/slices/worktrees-fetch-remote-lineage.test.ts": 377,
+      "src/renderer/src/store/slices/worktrees-fetch-removal-purge.test.ts": 920,
+      "src/renderer/src/store/slices/worktrees-fetch-stale-catalog-version.test.ts": 629,
+      "src/renderer/src/store/slices/worktrees-git-identity-branch-title.test.ts": 515,
+      "src/renderer/src/store/slices/worktrees-git-identity-review-clear-persistence.test.ts": 1035,
+      "src/renderer/src/store/slices/worktrees-hydration-purge.test.ts": 604,
+      "src/renderer/src/store/slices/worktrees-identity-migration.test.ts": 1146,
+      "src/renderer/src/store/slices/worktrees-lineage-state.test.ts": 642,
+      "src/renderer/src/store/slices/worktrees-linked-review-push-target.test.ts": 506,
+      "src/renderer/src/store/slices/worktrees-metadata-persistence.test.ts": 853,
+      "src/renderer/src/store/slices/worktrees-pending-creation-state.test.ts": 915,
+      "src/renderer/src/store/slices/worktrees-purge-terminal-state.test.ts": 442,
+      "src/renderer/src/store/slices/worktrees-remote-runtime-create.test.ts": 749,
+      "src/renderer/src/store/slices/worktrees-remote-runtime-removal.test.ts": 909,
+      "src/renderer/src/store/slices/worktrees-removal-state-cleanup.test.ts": 949,
+      "src/renderer/src/store/slices/worktrees-runtime-connection-generation-fence.test.ts": 1207,
+      "src/renderer/src/store/slices/worktrees-runtime-host-metadata-retirement.test.ts": 819,
+      "src/renderer/src/store/slices/worktrees-terminal-pr-url-linking.test.ts": 729,
+      "src/renderer/src/store/slices/worktrees-unread-state.test.ts": 663,
+      "src/renderer/src/store/slices/worktrees-workspace-selection-state.test.ts": 726,
+      "src/renderer/src/store/slices/worktrees/listing/detected-worktree-meta.test.ts": 102,
+      "src/renderer/src/store/slices/worktrees/listing/detected-worktree-unavailable-reason.test.ts": 52,
+      "src/renderer/src/store/slices/worktrees/listing/stale-listing-purges-created-worktree.test.ts": 1634,
+      "src/renderer/src/store/slices/worktrees/metadata/worktree-meta-persist.test.ts": 178,
+      "src/renderer/src/store/slices/worktrees/session/worktree-identity-rename-row-worktree-ids.test.ts": 842,
+      "src/renderer/src/store/slices/worktrees/session/worktree-no-op-notifications.test.ts": 839,
+      "src/renderer/src/store/slices/worktrees/teardown/host-qualified-removal-refusal.test.ts": 673,
+      "src/renderer/src/store/slices/worktrees/teardown/record-key-omission.test.ts": 39,
+      "src/renderer/src/store/slices/worktrees/teardown/remove-worktree-map-identity.test.ts": 340,
+      "src/renderer/src/store/slices/worktrees/teardown/worktree-teardown-array-identity.test.ts": 228,
+      "src/renderer/src/store/store-identity-churn-probe.test.ts": 73,
+      "src/renderer/src/store/store-listener-census.test.ts": 32,
+      "src/renderer/src/store/terminals/restored-relay-session-identity.test.ts": 1454,
+      "src/renderer/src/store/terminals/structured-chat-tab-rename.test.ts": 1252,
+      "src/renderer/src/store/terminals/terminal-no-op-subscriber.test.ts": 1508,
+      "src/renderer/src/store/terminals/terminal-pane-expansion-write-bailout.test.tsx": 1675,
+      "src/renderer/src/store/terminals/terminal-shutdown-guards-identity.test.ts": 39,
+      "src/renderer/src/store/terminals/terminal-shutdown-map-identity.test.ts": 213,
+      "src/renderer/src/store/terminals/terminal-tab-close-map-identity.test.ts": 2043,
+      "src/renderer/src/store/terminals/terminal-tab-close-tombstone.test.ts": 1822,
+      "src/renderer/src/store/terminals/terminal-workspace-routing.scale.test.ts": 182,
+      "src/renderer/src/store/terminals/workspace-terminal-placeholders.test.ts": 102,
+      "src/renderer/src/store/worktree-diff-comments-selector.test.ts": 86,
+      "src/renderer/src/store/worktree-host-collision-index.test.ts": 53,
+      "src/renderer/src/store/worktree-visibility-defaults-by-host.test.ts": 36,
+      "src/renderer/src/web/preload-api/web-ai-vault-search-compat.test.ts": 195,
+      "src/renderer/src/web/preload-api/web-gitlab-api.test.ts": 45,
+      "src/renderer/src/web/web-clipboard-copy-fallback.test.ts": 75,
+      "src/renderer/src/web/web-clipboard-copy-terminal-selection.test.ts": 443,
+      "src/renderer/src/web/web-file-mutation-methods.test.ts": 234,
+      "src/renderer/src/web/web-pairing.test.ts": 54,
+      "src/renderer/src/web/web-preload-api-agent-providers.test.ts": 494,
+      "src/renderer/src/web/web-preload-api-clipboard.test.ts": 940,
+      "src/renderer/src/web/web-preload-api-composition.test.ts": 532,
+      "src/renderer/src/web/web-preload-api-filesystem.test.ts": 519,
+      "src/renderer/src/web/web-preload-api-git.test.ts": 455,
+      "src/renderer/src/web/web-preload-api-github.test.ts": 506,
+      "src/renderer/src/web/web-preload-api-gitlab.test.ts": 962,
+      "src/renderer/src/web/web-preload-api-keybindings.test.ts": 505,
+      "src/renderer/src/web/web-preload-api-runtime-calls.test.ts": 554,
+      "src/renderer/src/web/web-preload-api-runtime-environment.test.ts": 1261,
+      "src/renderer/src/web/web-preload-api-settings.test.ts": 1773,
+      "src/renderer/src/web/web-preload-api-ssh.test.ts": 398,
+      "src/renderer/src/web/web-preload-api-ui.test.ts": 1867,
+      "src/renderer/src/web/web-preload-api-workspace-catalog.test.ts": 1039,
+      "src/renderer/src/web/web-preload-updater-package-recovery.test.ts": 292,
+      "src/renderer/src/web/web-runtime-client-export-parity.test.ts": 214,
+      "src/renderer/src/web/web-runtime-client-file-watch-replay.test.ts": 282,
+      "src/renderer/src/web/web-runtime-client-heartbeat.test.ts": 254,
+      "src/renderer/src/web/web-runtime-client-timeout-budget.test.ts": 217,
+      "src/renderer/src/web/web-runtime-client.test.ts": 593,
+      "src/renderer/src/web/web-runtime-connection-frame-router.test.ts": 140,
+      "src/renderer/src/web/web-runtime-connection-heartbeat-unsendable-probe.test.ts": 76,
+      "src/renderer/src/web/web-runtime-direct-proxy-live.integration.test.ts": 138,
+      "src/renderer/src/web/web-runtime-status-owner.test.ts": 882,
+      "src/renderer/src/web/web-shell-paths-exist.test.ts": 34,
+      "src/renderer/src/web/web-viewport-shell.test.ts": 48,
+      "src/renderer/src/web/web-workspace-session.test.ts": 169,
+      "src/shared/absolute-dir-override.test.ts": 80,
+      "src/shared/add-repo-existing-workspaces-telemetry.test.ts": 104,
+      "src/shared/agent-cli-flag-detection.test.ts": 40,
+      "src/shared/agent-cli-install-dir-fallback.test.ts": 65,
+      "src/shared/agent-decorative-title-signature.test.ts": 54,
+      "src/shared/agent-detection.test.ts": 112,
+      "src/shared/agent-feature-install-commands.test.ts": 48,
+      "src/shared/agent-hook-endpoint-file.test.ts": 36,
+      "src/shared/agent-hook-endpoint-temp-cleanup.test.ts": 53,
+      "src/shared/agent-hook-listener-antigravity.test.ts": 102,
+      "src/shared/agent-hook-listener-claude-compatible-vendors.test.ts": 174,
+      "src/shared/agent-hook-listener-claude-subagents.test.ts": 150,
+      "src/shared/agent-hook-listener-claude-turn-state.test.ts": 112,
+      "src/shared/agent-hook-listener-codex-approval-ownership.test.ts": 174,
+      "src/shared/agent-hook-listener-codex-main-agent.test.ts": 165,
+      "src/shared/agent-hook-listener-command-code-transcript.test.ts": 126,
+      "src/shared/agent-hook-listener-extraction-characterization.test.ts": 89,
+      "src/shared/agent-hook-listener-grok-completion.test.ts": 155,
+      "src/shared/agent-hook-listener-grok.test.ts": 160,
+      "src/shared/agent-hook-listener-hermes-codex-droid.test.ts": 206,
+      "src/shared/agent-hook-listener-interactive-prompts.test.ts": 207,
+      "src/shared/agent-hook-listener-omp-approval-ownership.test.ts": 166,
+      "src/shared/agent-hook-listener-opencode-reattribution.test.ts": 154,
+      "src/shared/agent-hook-listener-opencode-session-correlation.test.ts": 44,
+      "src/shared/agent-hook-listener-opencode-session-registry.test.ts": 38,
+      "src/shared/agent-hook-listener-pi-compatible.test.ts": 89,
+      "src/shared/agent-hook-listener-relay-dependency.test.ts": 33,
+      "src/shared/agent-hook-listener-roster-retention.test.ts": 177,
+      "src/shared/agent-hook-listener-session-replacement.test.ts": 130,
+      "src/shared/agent-hook-listener-startless-child-lifecycle.test.ts": 180,
+      "src/shared/agent-hook-listener-transport.test.ts": 151,
+      "src/shared/agent-hook-listener/providers/muse-events.test.ts": 192,
+      "src/shared/agent-hook-listener/providers/zcode-events.test.ts": 107,
+      "src/shared/agent-hook-listener/transcript-reader.test.ts": 170,
+      "src/shared/agent-hook-relay.test.ts": 34,
+      "src/shared/agent-hook-request-body-memory.test.ts": 63,
+      "src/shared/agent-hook-spool-read.test.ts": 72,
+      "src/shared/agent-hook-status-cache.test.ts": 60,
+      "src/shared/agent-hook-transport-interference.test.ts": 64,
+      "src/shared/agent-image-paste.test.ts": 34,
+      "src/shared/agent-kind.test.ts": 131,
+      "src/shared/agent-launch-operation.test.ts": 43,
+      "src/shared/agent-launch-preferences.test.ts": 47,
+      "src/shared/agent-launch-remote.test.ts": 45,
+      "src/shared/agent-lead-status-fold.test.ts": 93,
+      "src/shared/agent-model-probe-spec.test.ts": 61,
+      "src/shared/agent-notification-id.test.ts": 28,
+      "src/shared/agent-process-recognition.test.ts": 139,
+      "src/shared/agent-prompt-injection.test.ts": 59,
+      "src/shared/agent-resume-argv-drop.test.ts": 87,
+      "src/shared/agent-resume-launch-command.test.ts": 87,
+      "src/shared/agent-row-conversation-name.test.ts": 51,
+      "src/shared/agent-scratch-worktrees.test.ts": 67,
+      "src/shared/agent-session-conversation-name.test.ts": 32,
+      "src/shared/agent-session-definitive-refusal.test.ts": 100,
+      "src/shared/agent-session-fence-mint-boundary.test.ts": 2032,
+      "src/shared/agent-session-journal-producer.test.ts": 36,
+      "src/shared/agent-session-journal-schemas.test.ts": 184,
+      "src/shared/agent-session-lease-adjudication.test.ts": 40,
+      "src/shared/agent-session-legacy-handoff-lease.test.ts": 89,
+      "src/shared/agent-session-mutation-envelope.test.ts": 183,
+      "src/shared/agent-session-operation-ledger.test.ts": 115,
+      "src/shared/agent-session-option-catalog-grok.test.ts": 106,
+      "src/shared/agent-session-option-catalog-omp.test.ts": 86,
+      "src/shared/agent-session-option-catalog.test.ts": 94,
+      "src/shared/agent-session-provider-handle.test.ts": 75,
+      "src/shared/agent-session-question-answer.test.ts": 38,
+      "src/shared/agent-session-restart-continuation.test.ts": 32,
+      "src/shared/agent-session-resume.test.ts": 53,
+      "src/shared/agent-session-thread-goal.test.ts": 60,
+      "src/shared/agent-session-turn-record.test.ts": 58,
+      "src/shared/agent-skill-sharing-contract.test.ts": 67,
+      "src/shared/agent-skill-sharing-gate.test.ts": 138,
+      "src/shared/agent-startup-plan-inputs.test.ts": 84,
+      "src/shared/agent-status-child-work-admission-activity.test.ts": 304,
+      "src/shared/agent-status-child-work-admission-collision.test.ts": 163,
+      "src/shared/agent-status-child-work-admission-parse.test.ts": 418,
+      "src/shared/agent-status-child-work-admission-sparse.test.ts": 228,
+      "src/shared/agent-status-child-work-admission.test.ts": 295,
+      "src/shared/agent-status-child-work-codec-boundary.test.ts": 740,
+      "src/shared/agent-status-child-work-legacy-golden.test.ts": 57,
+      "src/shared/agent-status-child-work-legality.test.ts": 234,
+      "src/shared/agent-status-child-work-lifetime.test.ts": 216,
+      "src/shared/agent-status-child-work-liveness.test.ts": 28,
+      "src/shared/agent-status-child-work-projection.test.ts": 54,
+      "src/shared/agent-status-child-work-reconciliation.test.ts": 439,
+      "src/shared/agent-status-child-work-view.test.ts": 128,
+      "src/shared/agent-status-child-work.test.ts": 192,
+      "src/shared/agent-status-legacy-adapter.test.ts": 38,
+      "src/shared/agent-status-legacy-ingress-ratchet.test.ts": 5709,
+      "src/shared/agent-status-observation.test.ts": 55,
+      "src/shared/agent-status-osc-pending-retention.test.ts": 96,
+      "src/shared/agent-status-osc-scan-budget.test.ts": 340,
+      "src/shared/agent-status-osc-split-frame-scan-budget.test.ts": 170,
+      "src/shared/agent-status-osc.test.ts": 65,
+      "src/shared/agent-status-run-alias-index.test.ts": 245,
+      "src/shared/agent-status-run-capability.test.ts": 42,
+      "src/shared/agent-status-run.test.ts": 64,
+      "src/shared/agent-status-serving-readiness.test.ts": 32,
+      "src/shared/agent-status-store-bounds.test.ts": 2561,
+      "src/shared/agent-status-store-byte-budget.test.ts": 1188,
+      "src/shared/agent-status-store-in-place.test.ts": 40880,
+      "src/shared/agent-status-store-reopen.test.ts": 168,
+      "src/shared/agent-status-store-scaling.test.ts": 904,
+      "src/shared/agent-status-store.test.ts": 361,
+      "src/shared/agent-status-subject.test.ts": 174,
+      "src/shared/agent-status-transport-envelope.test.ts": 295,
+      "src/shared/agent-status-types.test.ts": 130,
+      "src/shared/agent-tab-title.test.ts": 76,
+      "src/shared/agent-terminal-status-equivalence.test.ts": 59,
+      "src/shared/agent-title-agy-gemini-collision.test.ts": 70,
+      "src/shared/agent-title-decoration.test.ts": 48,
+      "src/shared/agent-title-evidence.test.ts": 122,
+      "src/shared/agent-title-identity-characterization.test.ts": 73,
+      "src/shared/agent-tui-input-clear.test.ts": 39,
+      "src/shared/ai-vault-resume-command.test.ts": 68,
+      "src/shared/ai-vault-resume-preparation.test.ts": 49,
+      "src/shared/ai-vault-scan-error-message.test.ts": 26,
+      "src/shared/ai-vault-search-contract.test.ts": 138,
+      "src/shared/ai-vault-search-query-operators.test.ts": 70,
+      "src/shared/ai-vault-search-scope-contract.test.ts": 178,
+      "src/shared/ai-vault-search-settings.test.ts": 115,
+      "src/shared/ai-vault-session-depth.test.ts": 65,
       "src/shared/ai-vault-session-filters.test.ts": 172,
-      "src/shared/ai-vault-types.test.ts": 9,
-      "src/shared/app-version.test.ts": 12,
-      "src/shared/artifact-sharing-gate.test.ts": 9,
-      "src/shared/automation-execution-target.test.ts": 11,
-      "src/shared/automation-host-filter.test.ts": 5,
-      "src/shared/automation-legacy-list-partition.test.ts": 8,
-      "src/shared/automation-list-response.test.ts": 10,
-      "src/shared/automation-list-scope.test.ts": 19,
-      "src/shared/automation-owner-key.test.ts": 10,
-      "src/shared/automation-owner-precondition.test.ts": 11,
-      "src/shared/automation-run-identity.test.ts": 5,
-      "src/shared/automation-run-retention.test.ts": 19,
-      "src/shared/automation-schedules.test.ts": 183,
-      "src/shared/automation-usage-summary.test.ts": 9,
-      "src/shared/base-ref-search-result.test.ts": 6,
-      "src/shared/binary-file-extensions.test.ts": 4,
-      "src/shared/bounded-map.test.ts": 17,
-      "src/shared/branch-name-from-work.test.ts": 11,
-      "src/shared/branch-prefix.test.ts": 12,
-      "src/shared/browser-client-automation-protocol.test.ts": 12,
-      "src/shared/browser-client-host-id-argument.test.ts": 6,
-      "src/shared/browser-client-host-protocol.test.ts": 241,
-      "src/shared/browser-client-host-reconciliation-protocol.test.ts": 22,
-      "src/shared/browser-client-hosting-eligibility.test.ts": 9,
-      "src/shared/browser-cookie-import-sources.test.ts": 5,
-      "src/shared/browser-grab-types.test.ts": 11,
-      "src/shared/browser-network-capabilities.test.ts": 10,
-      "src/shared/browser-network-tunnel-protocol.test.ts": 11,
-      "src/shared/browser-network-tunnel-stream-framing.test.ts": 1908,
-      "src/shared/browser-screencast-protocol.test.ts": 7,
-      "src/shared/browser-url.test.ts": 14,
-      "src/shared/cheap-process-table-snapshot.test.ts": 10,
-      "src/shared/check-job-log-tail-slice.test.ts": 7,
-      "src/shared/child-process/child-process-import-boundary.test.ts": 9,
-      "src/shared/child-process/close-process-registry.test.ts": 8,
-      "src/shared/child-process/process-tree-termination.test.ts": 16,
-      "src/shared/child-process/retryable-process-exit-proof.test.ts": 8,
-      "src/shared/child-process/run-process-termination-failure.test.ts": 12,
-      "src/shared/child-process/run-process.test.ts": 7159,
-      "src/shared/child-process/windows-cmd-shim-resolution.test.ts": 15,
-      "src/shared/child-process/windows-command-line.test.ts": 14,
-      "src/shared/child-process/windows-console-visibility.test.ts": 7,
-      "src/shared/claimed-agent-pty-owner.test.ts": 33,
-      "src/shared/claude-agent-teams-tmux-compat.test.ts": 8,
-      "src/shared/claude-background-task-status.test.ts": 36,
-      "src/shared/claude-model-list-probe.test.ts": 14,
-      "src/shared/claude-statusline-rate-limits.test.ts": 7,
-      "src/shared/claude-subagent-roster.test.ts": 17,
-      "src/shared/claude-subagent-row-lifecycle.test.ts": 14,
-      "src/shared/cli-argument-boundary.test.ts": 5,
-      "src/shared/cli-runtime-pairing-boundary.test.ts": 182,
-      "src/shared/cli-workspace-provenance.test.ts": 6,
-      "src/shared/client-environment-info.test.ts": 10,
-      "src/shared/clipboard-image.test.ts": 9,
-      "src/shared/clipboard-text.test.ts": 29,
-      "src/shared/closed-terminal-tab-tombstones.test.ts": 12,
-      "src/shared/cloud-service-url.test.ts": 4,
-      "src/shared/codex-auth-errors.test.ts": 22,
-      "src/shared/codex-pet-sprite-defaults.test.ts": 12,
-      "src/shared/codex-reset-credit-attempt-ledger.test.ts": 16,
-      "src/shared/codex-reset-credit-scope.test.ts": 8,
-      "src/shared/codex-startup-delivery.test.ts": 8,
-      "src/shared/codex-subagent-poll-scheduler.test.ts": 14,
-      "src/shared/codex-subagent-rollout-lifecycle.test.ts": 18,
-      "src/shared/codex-subagent-roster.test.ts": 6,
-      "src/shared/codex-subagent-transcript.test.ts": 18,
-      "src/shared/combined-diff-file-tree-width.test.ts": 6,
-      "src/shared/command-code-output-status.test.ts": 155,
-      "src/shared/command-code-turn-boundary.test.ts": 6,
-      "src/shared/command-token-scanner.test.ts": 11,
-      "src/shared/commit-message-agent-spec.test.ts": 38,
-      "src/shared/commit-message-generation.test.ts": 12,
-      "src/shared/commit-message-plan.test.ts": 21,
-      "src/shared/commit-message-prompt.test.ts": 28,
-      "src/shared/computer-awake-mode.test.ts": 7,
-      "src/shared/computer-use-error-recovery.test.ts": 6,
-      "src/shared/computer-use-key-spec.test.ts": 7,
-      "src/shared/constants.test.ts": 15,
-      "src/shared/contextual-tours.test.ts": 16,
-      "src/shared/crash-reporting.test.ts": 18,
-      "src/shared/cross-platform-path-guards.test.ts": 1239,
-      "src/shared/cross-platform-path.test.ts": 17,
-      "src/shared/daemon-adoption-telemetry.test.ts": 10,
-      "src/shared/direct-ssh-reconnect-telemetry-schema.test.ts": 17,
-      "src/shared/doc-preview-file-access.test.ts": 36,
-      "src/shared/doc-preview-scheme.test.ts": 8,
-      "src/shared/draft-paste-ready-scanner-grok-trace-replay.test.ts": 7,
-      "src/shared/draft-paste-ready-scanner.test.ts": 19,
-      "src/shared/emoji-shortcode-catalog.lazy.test.ts": 42,
-      "src/shared/emulator-keyboard-frame.test.ts": 7,
-      "src/shared/emulator-touch-frame.test.ts": 5,
-      "src/shared/ephemeral-setup-terminal-worktree-id.test.ts": 6,
-      "src/shared/ephemeral-vm-recipe-checkout-mode.test.ts": 7,
-      "src/shared/ephemeral-vm-recipe-doctor.test.ts": 10,
-      "src/shared/ephemeral-vm-recipe-process.test.ts": 154,
-      "src/shared/ephemeral-vm-recipe-repo-url.test.ts": 7,
-      "src/shared/ephemeral-vm-recipes.test.ts": 23,
-      "src/shared/ephemeral-vm-runtime-feature-sorting.test.ts": 145,
-      "src/shared/ephemeral-vm-runtime-store-rollback.test.ts": 341,
-      "src/shared/ephemeral-vm-runtime-store.test.ts": 41,
-      "src/shared/event-loop-yield.test.ts": 28,
-      "src/shared/execution-host-registry.test.ts": 15,
-      "src/shared/execution-host.test.ts": 14,
-      "src/shared/export-let-function-initializer-ban.test.ts": 2085,
-      "src/shared/external-automation-jobs-file.test.ts": 48,
-      "src/shared/external-worktree-inbox.test.ts": 11,
-      "src/shared/feature-education-telemetry.test.ts": 5,
-      "src/shared/feature-interactions.test.ts": 1489,
-      "src/shared/feature-tips.test.ts": 7,
-      "src/shared/feature-wall-tour-depth.test.ts": 5,
-      "src/shared/file-link-location.test.ts": 7,
-      "src/shared/file-name-sort.test.ts": 6,
-      "src/shared/filesystem-directory-listing-limit.test.ts": 10,
-      "src/shared/fish-binary-requirement.test.ts": 14,
-      "src/shared/folder-workspace-execution-host.test.ts": 17,
-      "src/shared/folder-workspace-worktree.test.ts": 8,
-      "src/shared/folder-workspaces.test.ts": 6,
-      "src/shared/foreground-process-ancestry-parity.test.ts": 286,
-      "src/shared/foreground-process-selection.test.ts": 11,
-      "src/shared/foreground-wrapper-agent.test.ts": 7,
-      "src/shared/generated-code-path.test.ts": 10,
-      "src/shared/git-branch-cleanup.test.ts": 17,
-      "src/shared/git-branch-compare-head.test.ts": 6,
-      "src/shared/git-branch-line-total-soft-deadline.test.ts": 3529,
-      "src/shared/git-branch-line-total.test.ts": 39,
-      "src/shared/git-capability-cache.test.ts": 10,
-      "src/shared/git-check-ignore-stdio.test.ts": 8,
-      "src/shared/git-clone-failure-message.test.ts": 26,
-      "src/shared/git-config-snapshot-runner.test.ts": 13,
-      "src/shared/git-configured-branch-target.test.ts": 11,
-      "src/shared/git-cquoted-path.test.ts": 3,
-      "src/shared/git-diff-transport-budget.test.ts": 1152,
-      "src/shared/git-discard-path-safety.test.ts": 22,
-      "src/shared/git-exec-mutation.test.ts": 10,
-      "src/shared/git-fetch-head-capability.test.ts": 6,
-      "src/shared/git-fetch-head-lock-key-derivation.test.ts": 64,
-      "src/shared/git-fetch-head-lock.test.ts": 108,
-      "src/shared/git-fork-sync.test.ts": 21,
-      "src/shared/git-history-graph.test.ts": 10,
-      "src/shared/git-history-message-allocation.test.ts": 11,
-      "src/shared/git-history-ref-display.test.ts": 9,
-      "src/shared/git-history.test.ts": 18,
-      "src/shared/git-merge-tree-capability.test.ts": 9,
-      "src/shared/git-metadata-path.test.ts": 13,
-      "src/shared/git-push-target-validation.test.ts": 6,
-      "src/shared/git-remote-error.test.ts": 36,
-      "src/shared/git-remote-identity.test.ts": 10,
-      "src/shared/git-remote-url-index.test.ts": 11,
-      "src/shared/git-rev-list-output.test.ts": 8,
-      "src/shared/git-status-branch-line-total-cache.test.ts": 12,
-      "src/shared/git-status-conflict-entries.test.ts": 10,
-      "src/shared/git-status-limit.test.ts": 6,
-      "src/shared/git-status-line-stat-inputs.test.ts": 6,
-      "src/shared/git-status-line-stats-cache.test.ts": 10,
-      "src/shared/git-status-upstream-ref.test.ts": 6,
-      "src/shared/git-uncommitted-line-stats.test.ts": 54,
-      "src/shared/git-upstream-status.test.ts": 16,
-      "src/shared/git-worktree-operation-lock.test.ts": 16,
-      "src/shared/github/api-availability.test.ts": 6,
-      "src/shared/github/project-identity.test.ts": 5,
-      "src/shared/github/project-ref-input.test.ts": 11,
-      "src/shared/github/project-roadmap-timeline.test.ts": 11,
-      "src/shared/github/pull-request-auto-merge-availability.test.ts": 6,
-      "src/shared/github/pull-request-for-branch-outcome.test.ts": 7,
-      "src/shared/github/pull-request-merge-methods.test.ts": 8,
-      "src/shared/github/repository-identity-key.test.ts": 5,
-      "src/shared/github/work-items-query-bounds.test.ts": 9,
-      "src/shared/gitlab-job-log-excerpt.test.ts": 36,
-      "src/shared/gitlab-job-trace-check-details.test.ts": 17,
-      "src/shared/gitlab-pipeline-checks.test.ts": 6,
-      "src/shared/gitlab-projects.test.ts": 10,
-      "src/shared/grok-model-list-probe.test.ts": 14,
-      "src/shared/grok-session-paths.test.ts": 21,
-      "src/shared/growing-byte-buffer.test.ts": 89,
-      "src/shared/handled-wire-discriminant.test.ts": 4,
-      "src/shared/harness-injected-user-turns.test.ts": 8,
-      "src/shared/hermes-run-ref-retention.test.ts": 6,
-      "src/shared/hook-command-source-policy.test.ts": 12,
-      "src/shared/host-balanced-listing-scaling.test.ts": 13,
-      "src/shared/host-setting-overrides.test.ts": 10,
-      "src/shared/hosted-review-creation-providers.test.ts": 4,
-      "src/shared/hosted-review-github.test.ts": 8,
-      "src/shared/hosted-review-ready-capabilities.test.ts": 5,
-      "src/shared/hosted-review-refs.test.ts": 6,
-      "src/shared/image-data-uri.test.ts": 12,
-      "src/shared/image-paste-following-text.test.ts": 5,
-      "src/shared/in-flight-promise-dedupe.test.ts": 19,
-      "src/shared/issue-link-input.test.ts": 9,
-      "src/shared/jira-issue-url.test.ts": 8,
-      "src/shared/json-text-structure-limit.test.ts": 9,
-      "src/shared/keybindings-conflicts.test.ts": 32,
-      "src/shared/keybindings-default-bindings.test.ts": 32,
-      "src/shared/keybindings-digit-index.test.ts": 12,
-      "src/shared/keybindings-double-tap.test.ts": 14,
-      "src/shared/keybindings-keyboard-layout.test.ts": 8,
-      "src/shared/keybindings-parse-cache.test.ts": 43,
-      "src/shared/keybindings-parsing.test.ts": 12,
-      "src/shared/keybindings-terminal-context.test.ts": 7,
-      "src/shared/keybindings-unassigned-actions.test.ts": 12,
-      "src/shared/linear/inline-media.test.ts": 4,
-      "src/shared/linear/issue-attribute-filter.test.ts": 9,
-      "src/shared/linear/issue-view-resume-state.test.ts": 15,
-      "src/shared/linear/links.test.ts": 7,
-      "src/shared/linear/workspace-types.test.ts": 7,
-      "src/shared/linux-proc-port-scan-limits.test.ts": 12,
-      "src/shared/local-account-runtime.test.ts": 7,
-      "src/shared/local-build-compatibility.test.ts": 5,
-      "src/shared/localhost-worktree-labels.test.ts": 8,
-      "src/shared/loose-ref-count.test.ts": 247,
-      "src/shared/macos-symbolic-hotkeys.test.ts": 14,
-      "src/shared/managed-agent-command-token.test.ts": 9,
-      "src/shared/manual-repo-order.test.ts": 12,
-      "src/shared/map-settled-with-concurrency.test.ts": 20,
-      "src/shared/map-with-concurrency.test.ts": 58,
-      "src/shared/markdown-document-listing-limits.test.ts": 5,
-      "src/shared/markdown-toc-panel-width.test.ts": 7,
-      "src/shared/mcp-config.test.ts": 29,
-      "src/shared/mobile-e2ee-v2-contract.test.ts": 15,
-      "src/shared/mobile-e2ee-v2-framing.test.ts": 13,
-      "src/shared/mobile-file-directory-limit.test.ts": 11,
-      "src/shared/mobile-markdown-document.test.ts": 8,
-      "src/shared/mobile-pairing-connection-mode.test.ts": 9,
-      "src/shared/mobile-pairing-custom-address.test.ts": 13,
-      "src/shared/mobile-push-contract.test.ts": 5,
-      "src/shared/mobile-relay-close-codes.test.ts": 4,
-      "src/shared/mobile-relay-mint-failure.test.ts": 5,
-      "src/shared/mobile-relay-pairing-offer.test.ts": 22,
-      "src/shared/mobile-relay-phone-protocol.test.ts": 12,
-      "src/shared/model-id-label.test.ts": 4,
-      "src/shared/modifier-double-tap-detector.test.ts": 10,
-      "src/shared/native-chat-agent-profiles.test.ts": 17,
-      "src/shared/native-chat-agent-support.test.ts": 7,
-      "src/shared/native-chat-ask-fifo.test.ts": 186,
-      "src/shared/native-chat-ask.test.ts": 12,
-      "src/shared/native-chat-command-envelope.test.ts": 9,
-      "src/shared/native-chat-edit-normalize.test.ts": 35,
-      "src/shared/native-chat-href-routing.test.ts": 11,
-      "src/shared/native-chat-image-transcript-markers.test.ts": 19,
-      "src/shared/native-chat-session-option-commands.test.ts": 15,
-      "src/shared/native-chat-session-option-defaults.test.ts": 15,
-      "src/shared/native-chat-session-option-snapshot.test.ts": 15,
-      "src/shared/native-chat-session-option-state.test.ts": 10,
-      "src/shared/native-chat-slash-commands.test.ts": 31,
-      "src/shared/native-chat-stream-unsubscribe.test.ts": 3,
-      "src/shared/native-chat-streaming.test.ts": 9,
-      "src/shared/native-chat-subagent-summary.test.ts": 11,
-      "src/shared/native-chat-task-list.test.ts": 11,
-      "src/shared/native-chat-tool-activity.test.ts": 11,
-      "src/shared/native-chat-tool-attribution-allocation.test.ts": 20,
-      "src/shared/native-chat-tool-icon.test.ts": 19,
-      "src/shared/native-chat-tool-identity.test.ts": 14,
-      "src/shared/native-chat-tool-pair-limit.test.ts": 74,
-      "src/shared/native-chat-tool-summary.test.ts": 13,
-      "src/shared/native-chat-transcript-retention.test.ts": 5,
-      "src/shared/native-chat-turn-activity.test.ts": 9,
-      "src/shared/native-chat-turn-status.test.ts": 13,
-      "src/shared/native-chat-types.test.ts": 4,
-      "src/shared/native-chat-unverifiable-turn-status.test.ts": 8,
-      "src/shared/native-file-drop.test.ts": 28,
-      "src/shared/nested-repo-telemetry-schema.test.ts": 18,
-      "src/shared/nested-repo-telemetry.test.ts": 15,
-      "src/shared/nested-worker-depth.test.ts": 8,
-      "src/shared/network-proxy.test.ts": 9,
-      "src/shared/network/manual-address.test.ts": 13,
-      "src/shared/network/server-share-address.test.ts": 24,
-      "src/shared/new-workspace-dialog-repo.test.ts": 5,
-      "src/shared/new-workspace/smart-workspace-url-source-results.test.ts": 10,
-      "src/shared/new-workspace/work-item-lookup-text.test.ts": 8,
-      "src/shared/new-workspace/workspace-source.test.ts": 8,
-      "src/shared/new-workspace/worktree-create-retry-policy.test.ts": 7,
-      "src/shared/node-bounded-file-reader-sync.test.ts": 4,
-      "src/shared/node-bounded-file-reader.test.ts": 14,
-      "src/shared/node-bounded-json-stringify.test.ts": 24,
-      "src/shared/node-file-content-equality.test.ts": 15,
-      "src/shared/node-markdown-document-discovery.test.ts": 8,
-      "src/shared/node-pty-spawn-helper.test.ts": 7,
-      "src/shared/node-readable-text.test.ts": 14,
-      "src/shared/node-source-copy-content-equality.test.ts": 16,
-      "src/shared/nul-delimited-fields.test.ts": 5,
-      "src/shared/nvm-default-alias.test.ts": 38,
-      "src/shared/omp-pi-semantic-title-preservation.test.ts": 25,
-      "src/shared/onboarding-tour-telemetry-events.test.ts": 12,
-      "src/shared/open-in-applications.test.ts": 8,
-      "src/shared/opencode-permission-status.test.ts": 18,
-      "src/shared/opencode-terminal-title.test.ts": 4,
-      "src/shared/orca-yaml-alias-bounds.test.ts": 27,
-      "src/shared/orca-yaml-bounds.test.ts": 22,
-      "src/shared/orchestration-ask-timeout.test.ts": 5,
-      "src/shared/orchestration-check-output.test.ts": 7,
-      "src/shared/orchestration-compatibility-evidence.test.ts": 8,
-      "src/shared/orchestration-dispatch-refusal-contract.test.ts": 10,
-      "src/shared/orchestration-fleet-attention.test.ts": 6,
-      "src/shared/orchestration-fleet-evidence-clock.test.ts": 8,
-      "src/shared/orchestration-fleet-projection.test.ts": 12,
-      "src/shared/orchestration-rpc-contract.test.ts": 12,
-      "src/shared/orchestration-task-display.test.ts": 9,
-      "src/shared/orchestration-task-summary.test.ts": 9,
-      "src/shared/orchestration-timing-budgets.test.ts": 6,
-      "src/shared/osc-title-scan-tail-retention.test.ts": 34,
-      "src/shared/osc-title-scan-tail.test.ts": 4,
-      "src/shared/osc52-clipboard-settings.test.ts": 7,
-      "src/shared/own-retained-string.test.ts": 77,
-      "src/shared/pairing-address-auto-selection.test.ts": 5,
-      "src/shared/pairing-local-ui-fields.test.ts": 6,
-      "src/shared/pairing.test.ts": 14,
-      "src/shared/pane-agent-identity-adapter.test.ts": 21,
-      "src/shared/pane-agent-identity-inventory.test.ts": 782,
-      "src/shared/pane-agent-identity-resolver.test.ts": 15,
-      "src/shared/pane-agent-identity-surface-inventory.test.ts": 1226,
-      "src/shared/pane-agent-identity-title-corpus.test.ts": 17,
-      "src/shared/pane-agent-owner.test.ts": 8,
-      "src/shared/pane-key-alias.test.ts": 6,
-      "src/shared/physical-exit-tracker.test.ts": 11,
-      "src/shared/pi-agent-kind.test.ts": 4,
-      "src/shared/pi-overlay-ui-settings.test.ts": 7,
-      "src/shared/pi-state-title-marker.test.ts": 11,
-      "src/shared/plugins/plugin-consent-fingerprint.test.ts": 14,
-      "src/shared/plugins/plugin-consent-request.test.ts": 10,
-      "src/shared/plugins/plugin-content-pack-contributions.test.ts": 16,
-      "src/shared/plugins/plugin-demo-fixture.test.ts": 16,
-      "src/shared/plugins/plugin-hostile-fixture.test.ts": 4,
-      "src/shared/plugins/plugin-install-lockfile.test.ts": 10,
-      "src/shared/plugins/plugin-kill-list.test.ts": 47,
-      "src/shared/plugins/plugin-language-pack-artifact.test.ts": 134,
-      "src/shared/plugins/plugin-manifest.test.ts": 24,
-      "src/shared/plugins/plugin-marketplace.test.ts": 64,
-      "src/shared/plugins/plugin-panel-call-admission.test.ts": 6,
-      "src/shared/plugins/plugin-panel-message-budget.test.ts": 6,
-      "src/shared/plugins/plugin-panel-pong-frame.test.ts": 9,
-      "src/shared/plugins/plugin-panel-shell.test.ts": 7,
-      "src/shared/plugins/plugin-path-safety.test.ts": 15,
-      "src/shared/plugins/plugin-vm-recipe-artifact.test.ts": 18,
-      "src/shared/posix-wait-status.test.ts": 7,
-      "src/shared/powershell-native-argument.test.ts": 4,
-      "src/shared/pr-bot-author-overrides.test.ts": 11,
-      "src/shared/pr-check-severity-order.test.ts": 7,
-      "src/shared/pr-check-status.test.ts": 5,
-      "src/shared/pr-comment-audience.test.ts": 5,
-      "src/shared/pr-comment-groups.test.ts": 8,
-      "src/shared/pr-comment-time.test.ts": 7,
-      "src/shared/preferred-git-remote.test.ts": 6,
-      "src/shared/priority-semaphore.test.ts": 19,
-      "src/shared/process-output-field-scanner.test.ts": 6,
-      "src/shared/process-table-snapshot.test.ts": 72,
-      "src/shared/project-catalog-row-normalization.test.ts": 9,
-      "src/shared/project-execution-runtime.test.ts": 15,
-      "src/shared/project-groups.test.ts": 124,
-      "src/shared/project-host-setup-projection.test.ts": 30,
-      "src/shared/project-identity-succession.test.ts": 30,
-      "src/shared/promise-settlement-waiters.test.ts": 337,
-      "src/shared/protocol-compat.test.ts": 13,
-      "src/shared/pty-consumer-session.test.ts": 17,
-      "src/shared/pty-delivery-diagnostics.test.ts": 14,
-      "src/shared/pty-liveness-verdict.test.ts": 6,
-      "src/shared/pty-owner-backend.test.ts": 4,
-      "src/shared/pty-slave-line-discipline-echo.test.ts": 13,
-      "src/shared/pty-startup-ingress-live-query-reply.test.ts": 23,
-      "src/shared/pty-startup-ingress.test.ts": 60,
-      "src/shared/pty-startup-reply-echo-shapes.test.ts": 14,
-      "src/shared/published-pane-agent-identity.test.ts": 20,
-      "src/shared/pull-request-generation.test.ts": 11,
-      "src/shared/quick-open-directory-reader.test.ts": 11,
-      "src/shared/quick-open-expansion-paths.test.ts": 30,
-      "src/shared/quick-open-filter.renderer-safety.test.ts": 6,
-      "src/shared/quick-open-filter.test.ts": 15,
-      "src/shared/quick-open-git-directory-collapse.test.ts": 51,
-      "src/shared/quick-open-listing-limits.test.ts": 14,
-      "src/shared/quick-open-readdir-memory.test.ts": 38,
-      "src/shared/quick-open-readdir-walk.test.ts": 197,
-      "src/shared/quick-open-transport-budget.test.ts": 5,
-      "src/shared/raster-image-base64-preview.test.ts": 322,
-      "src/shared/raster-image-dimensions.test.ts": 17,
-      "src/shared/raster-image-preview-limits.test.ts": 7,
-      "src/shared/rate-limit-reset-format.test.ts": 9,
-      "src/shared/rate-limit-types.test.ts": 6,
-      "src/shared/react-update-depth-attribution.test.ts": 7,
-      "src/shared/reconnect-jitter.test.ts": 5,
-      "src/shared/relay-frame-buffer.test.ts": 393,
-      "src/shared/relay-optional-artifacts.test.ts": 5,
-      "src/shared/relay-version-marker.test.ts": 5,
-      "src/shared/release-channel.test.ts": 26,
-      "src/shared/remote-foreground-evidence.test.ts": 9,
-      "src/shared/remote-pairing-address.test.ts": 18,
-      "src/shared/remote-pairing-verification.test.ts": 7,
-      "src/shared/remote-rpc-content-budget.test.ts": 89,
-      "src/shared/remote-runtime-client-error-classification.test.ts": 8,
-      "src/shared/remote-runtime-client.test.ts": 4792,
-      "src/shared/remote-runtime-memory-limits.test.ts": 110,
-      "src/shared/remote-runtime-outbound-admission.test.ts": 903,
-      "src/shared/remote-runtime-request-connection-stale.test.ts": 141,
-      "src/shared/remote-runtime-request-connection.test.ts": 100,
-      "src/shared/remote-runtime-request-frames.test.ts": 9,
-      "src/shared/remote-runtime-request-response-router.test.ts": 12,
-      "src/shared/remote-runtime-request-websocket.test.ts": 32,
-      "src/shared/remote-runtime-shared-control-boundary.test.ts": 2634,
-      "src/shared/remote-runtime-shared-control-connection.test.ts": 3301,
-      "src/shared/remote-runtime-shared-control-keepalive-refresh.test.ts": 14,
-      "src/shared/remote-runtime-shared-control-reconnect.test.ts": 9,
-      "src/shared/remote-runtime-shared-control-retired-request-ids.test.ts": 8,
-      "src/shared/remote-runtime-shared-control-socket-generation.test.ts": 4,
-      "src/shared/remote-runtime-shared-control-standing-intent.test.ts": 615,
-      "src/shared/remote-runtime-shared-control-subscription-close.test.ts": 5,
-      "src/shared/remote-runtime-shared-control-subscriptions.test.ts": 12,
-      "src/shared/remote-runtime-socket-liveness.test.ts": 9,
-      "src/shared/remote-runtime-subscription-frame-router.test.ts": 7,
-      "src/shared/remote-runtime-subscription-request.test.ts": 295,
-      "src/shared/remote-runtime-tailscale-hint.test.ts": 7,
-      "src/shared/remote-runtime-transport-error-agreement.test.ts": 9,
-      "src/shared/remote-workspace-session-projection.test.ts": 9,
-      "src/shared/renderer-restart-preparation.test.ts": 10,
-      "src/shared/repo-badge-color.test.ts": 5,
-      "src/shared/repo-icon.test.ts": 23,
-      "src/shared/repo-ref-maintenance.test.ts": 316,
-      "src/shared/repo-search-limits.test.ts": 10,
-      "src/shared/repro-13889-claude-quarter-circle-busy-title.test.ts": 16,
-      "src/shared/repro-7732-gitlab-job-id-dropped.test.ts": 5,
-      "src/shared/repro-8478-opencode-native-title-icon.test.ts": 16,
-      "src/shared/require-tui-agent-config.test.ts": 4,
-      "src/shared/resolved-worktree-lineage.test.ts": 10,
-      "src/shared/retired-pty-incarnations.test.ts": 4,
-      "src/shared/review-head-tracking-ref.test.ts": 6,
-      "src/shared/ripgrep-process-availability.test.ts": 11,
-      "src/shared/runtime-client-export-parity.test.ts": 5,
-      "src/shared/runtime-environment-store.test.ts": 32,
-      "src/shared/runtime-host-status-owner.test.ts": 22,
-      "src/shared/runtime-listing-host-scope.test.ts": 10,
-      "src/shared/runtime-navigation.test.ts": 5,
-      "src/shared/runtime-rpc-call-queue.test.ts": 15,
-      "src/shared/runtime-workspace-file-owner.test.ts": 10,
-      "src/shared/runtime-workspace-window-availability.test.ts": 5,
-      "src/shared/search-match-count.test.ts": 7,
-      "src/shared/search-subprocess-lines.test.ts": 87,
-      "src/shared/secret-store.test.ts": 8,
-      "src/shared/secure-file-coarse-ctime.test.ts": 9,
-      "src/shared/secure-file-fsync-flags.test.ts": 13,
-      "src/shared/secure-file.test.ts": 602,
-      "src/shared/secure-path-hardening-cache.test.ts": 9,
-      "src/shared/secure-path-hardening-retry-budget.test.ts": 39,
-      "src/shared/serve-option-validation.test.ts": 12,
-      "src/shared/setup-agent-sequencing.test.ts": 6203,
-      "src/shared/setup-runner-command.test.ts": 16,
-      "src/shared/setup-script-imports.test.ts": 26,
-      "src/shared/setup-script-package-manager-suggestion.test.ts": 14,
-      "src/shared/setup-script-shebang.test.ts": 7,
-      "src/shared/setup-script-telemetry-events.test.ts": 10,
-      "src/shared/setup-script-telemetry.test.ts": 7,
-      "src/shared/shell-foreground-snapshot.test.ts": 118,
-      "src/shared/shell-process-readiness.test.ts": 20,
-      "src/shared/skill-bundle-install-contract.test.ts": 9,
-      "src/shared/skill-bundle-name.test.ts": 3,
-      "src/shared/skill-delete-contract.test.ts": 30,
-      "src/shared/skill-deletion-eligibility.test.ts": 6,
-      "src/shared/skill-install-contract.test.ts": 13,
-      "src/shared/skill-install-failure.test.ts": 11,
-      "src/shared/skill-metadata.test.ts": 6,
-      "src/shared/skill-package-manifest.test.ts": 78,
-      "src/shared/skill-path-containment.test.ts": 8,
-      "src/shared/skills-cli-agent-keys.test.ts": 10,
-      "src/shared/source-control-ai-action-recipes.test.ts": 11,
-      "src/shared/source-control-ai-action-variables.test.ts": 12,
-      "src/shared/source-control-ai-actions.test.ts": 11,
-      "src/shared/source-control-ai-policy-regression.test.ts": 12,
-      "src/shared/source-control-ai-recipe-save.test.ts": 15,
-      "src/shared/source-control-ai.test.ts": 18,
-      "src/shared/source-control-create-review-intent.test.ts": 12,
-      "src/shared/source-control-group-order.test.ts": 4,
-      "src/shared/source-control-primary-action-decision.test.ts": 5,
-      "src/shared/source-control-push-failure.test.ts": 12,
-      "src/shared/source-control-recovery-agent-command.test.ts": 7,
-      "src/shared/source-scan/source-tree-scan.test.ts": 37,
-      "src/shared/ssh-pending-pty-kill.test.ts": 9,
-      "src/shared/ssh-pty-id.test.ts": 8,
-      "src/shared/ssh-relay-pty-ownership-proof.test.ts": 44,
-      "src/shared/ssh-retained-payload-admission.test.ts": 20,
-      "src/shared/ssh-target-generation.test.ts": 11,
-      "src/shared/ssh-types.test.ts": 7,
-      "src/shared/stable-pane-id.test.ts": 13,
-      "src/shared/startup-command-submission.test.ts": 6,
-      "src/shared/status-bar-usage-mode.test.ts": 3,
-      "src/shared/string-chunk-compaction.test.ts": 19,
-      "src/shared/structural-value-equality.test.ts": 10,
-      "src/shared/structured-agent-session-coalescer.test.ts": 7,
-      "src/shared/structured-agent-session-composer.test.ts": 13,
-      "src/shared/structured-agent-session-create.test.ts": 16,
-      "src/shared/structured-agent-session-item-retention.test.ts": 460,
-      "src/shared/structured-agent-session-live-turn.test.ts": 4,
-      "src/shared/structured-agent-session-mutation.test.ts": 6,
-      "src/shared/structured-agent-session-option-picks.test.ts": 8,
-      "src/shared/structured-agent-session-options.test.ts": 12,
-      "src/shared/structured-agent-session-projection.test.ts": 14,
-      "src/shared/structured-agent-session-reducer.test.ts": 43,
-      "src/shared/structured-agent-session-turn-timing-retention.test.ts": 20,
-      "src/shared/structured-agent-session-turn-timing.test.ts": 15,
-      "src/shared/structured-native-chat-launch-route.test.ts": 8,
-      "src/shared/subprocess-stdin-write.test.ts": 4,
-      "src/shared/synthetic-agent-title.test.ts": 9,
-      "src/shared/tab-title-resolution.test.ts": 8,
-      "src/shared/tailnet-address.test.ts": 5,
-      "src/shared/task-providers.test.ts": 12,
-      "src/shared/task-query.test.ts": 24,
-      "src/shared/task-source-context.test.ts": 12,
-      "src/shared/telemetry-common-props.test.ts": 9,
-      "src/shared/telemetry-events-feature-education.test.ts": 12,
-      "src/shared/telemetry-events.test.ts": 37,
-      "src/shared/telemetry-feature-wall-events.test.ts": 11,
-      "src/shared/telemetry-orca-cli-feature-tip.test.ts": 6,
-      "src/shared/terminal-bell-detector.test.ts": 7,
-      "src/shared/terminal-color-scheme-protocol.test.ts": 7,
-      "src/shared/terminal-composer-draft.test.ts": 13,
-      "src/shared/terminal-custom-themes.test.ts": 10,
-      "src/shared/terminal-escape-introducer.test.ts": 16,
-      "src/shared/terminal-exit-cause.test.ts": 8,
-      "src/shared/terminal-file-url-target.test.ts": 3,
-      "src/shared/terminal-fonts.test.ts": 7,
-      "src/shared/terminal-github-pr-link-detector.test.ts": 14,
-      "src/shared/terminal-input.test.ts": 40,
-      "src/shared/terminal-kitty-keyboard-mode-tracker.test.ts": 19,
-      "src/shared/terminal-line-height-settings.test.ts": 4,
-      "src/shared/terminal-mode-2031-final-state.test.ts": 10,
-      "src/shared/terminal-mode-reset-profiles.test.ts": 13,
-      "src/shared/terminal-osc-color-reply.test.ts": 7,
-      "src/shared/terminal-output-side-effects.test.ts": 14,
-      "src/shared/terminal-partial-escape-tail-ground-scan.test.ts": 12,
-      "src/shared/terminal-partial-escape-tail.fuzz.test.ts": 986,
-      "src/shared/terminal-partial-escape-tail.test.ts": 13,
-      "src/shared/terminal-query-reply.test.ts": 23,
-      "src/shared/terminal-quick-commands.test.ts": 10,
-      "src/shared/terminal-reply-query-scan.test.ts": 5,
-      "src/shared/terminal-scrollback-policy.test.ts": 11,
-      "src/shared/terminal-startup-cwd.test.ts": 11,
-      "src/shared/terminal-stream-protocol.test.ts": 10,
-      "src/shared/terminal-title-agent-type.test.ts": 27,
-      "src/shared/terminal-title-classification-corpus.test.ts": 34,
-      "src/shared/terminal-title-classification-memo.test.ts": 20,
-      "src/shared/terminal-view-attributes.test.ts": 15,
-      "src/shared/terminal-wait-blocked-reason-legacy-alias.test.ts": 9,
-      "src/shared/terminal-zero-dimensions-diagnostic.test.ts": 5,
-      "src/shared/test-code-path.test.ts": 10,
-      "src/shared/text-search.test.ts": 53,
-      "src/shared/timer-delay.test.ts": 9,
-      "src/shared/tui-agent-config.test.ts": 9,
-      "src/shared/tui-agent-permissions.test.ts": 10,
-      "src/shared/tui-agent-selection.test.ts": 10,
-      "src/shared/tui-agent-startup-copilot-resume.test.ts": 5,
-      "src/shared/tui-agent-startup-hermes.test.ts": 26,
-      "src/shared/tui-agent-startup-session-options.test.ts": 13,
-      "src/shared/tui-agent-startup-shell.test.ts": 23,
-      "src/shared/tui-agent-startup.test.ts": 29,
-      "src/shared/ui-language.test.ts": 8,
-      "src/shared/ui-locale.test.ts": 14,
-      "src/shared/ui-zoom-level.test.ts": 7,
-      "src/shared/updated-at-order.test.ts": 82,
-      "src/shared/updater-windows-signature-check.test.ts": 6,
-      "src/shared/usage-percentage-display-change-notice.test.ts": 6,
-      "src/shared/usage-percentage-display.test.ts": 8,
-      "src/shared/utf8-byte-limits.test.ts": 70,
-      "src/shared/vscode-remote-ssh-launcher.test.ts": 7,
-      "src/shared/window-shortcut-policy-agent-dashboard.test.ts": 7,
-      "src/shared/window-shortcut-policy.test.ts": 25,
-      "src/shared/windows-cmd-runner-delayed-launch.test.ts": 5,
-      "src/shared/windows-command-line-budget.test.ts": 1102,
-      "src/shared/windows-console-input.test.ts": 12,
-      "src/shared/windows-environment-expansion.test.ts": 48,
-      "src/shared/windows-interactive-login-spawn.test.ts": 13,
-      "src/shared/windows-lane-tree-removal-boundary.test.ts": 19,
-      "src/shared/windows-long-path-git-args.test.ts": 4,
-      "src/shared/windows-security-descriptor.test.ts": 13,
-      "src/shared/windows-terminal-shell.test.ts": 9,
-      "src/shared/windows-transient-lock-removal.test.ts": 1176,
-      "src/shared/worker-terminal-host-scope.test.ts": 15,
-      "src/shared/worker-transcript-text-scaling.test.ts": 7,
-      "src/shared/workspace-cleanup-applied-filters.test.ts": 15,
-      "src/shared/workspace-cleanup-browse-state-persistence.test.ts": 18,
-      "src/shared/workspace-cleanup-ui-state.test.ts": 7,
-      "src/shared/workspace-cleanup.test.ts": 10,
-      "src/shared/workspace-doc-history.test.ts": 34,
-      "src/shared/workspace-linked-item-equality.test.ts": 7,
-      "src/shared/workspace-linked-item-source-context.test.ts": 8,
-      "src/shared/workspace-name.test.ts": 25,
-      "src/shared/workspace-session-browser-history.test.ts": 25,
-      "src/shared/workspace-session-partition-owner.test.ts": 4,
-      "src/shared/workspace-session-salvage-equivalence.test.ts": 95,
-      "src/shared/workspace-session-salvage.test.ts": 1522,
-      "src/shared/workspace-session-schema-field-coverage.test.ts": 15,
-      "src/shared/workspace-session-schema.sleeping-agent.test.ts": 22,
-      "src/shared/workspace-session-schema.test.ts": 23,
-      "src/shared/workspace-session-tab-focus-schema.test.ts": 19,
-      "src/shared/workspace-session-terminal-buffers.test.ts": 28,
-      "src/shared/workspace-session-terminal-schema.test.ts": 12,
-      "src/shared/workspace-session-terminal-tab-close.test.ts": 43,
-      "src/shared/workspace-session-validation-work.test.ts": 108,
-      "src/shared/workspace-space-compaction.test.ts": 15,
-      "src/shared/workspace-space-entry-traversal.test.ts": 1132,
-      "src/shared/workspace-space-scan-budget.test.ts": 32,
-      "src/shared/workspace-statuses.test.ts": 24,
-      "src/shared/worktree-execution-host-resolution.test.ts": 15,
-      "src/shared/worktree-name-suggestion.test.ts": 29,
-      "src/shared/worktree/base-ref.test.ts": 11,
-      "src/shared/worktree/card-properties.test.ts": 6,
-      "src/shared/worktree/create-preparation.test.ts": 6,
-      "src/shared/worktree/github-pr-suppression.test.ts": 8,
-      "src/shared/worktree/host-context-labels.test.ts": 8,
-      "src/shared/worktree/host-qualified-identity.test.ts": 8,
-      "src/shared/worktree/id.test.ts": 13,
-      "src/shared/worktree/identity.test.ts": 7,
-      "src/shared/worktree/ownership-configured-base-visibility.test.ts": 22,
-      "src/shared/worktree/ownership-worktree-base-path.test.ts": 8,
-      "src/shared/worktree/ownership.test.ts": 284,
-      "src/shared/worktree/removal-fence-error.test.ts": 7,
-      "src/shared/worktree/removal-force-classification.test.ts": 5,
-      "src/shared/worktree/retired-name-cache.test.ts": 15,
-      "src/shared/worktree/retired-name-registry.test.ts": 185,
-      "src/shared/worktree/sort-order-update.test.ts": 7,
-      "src/shared/worktree/submodule-removal.test.ts": 7,
-      "src/shared/worktree/visibility-sources.test.ts": 18,
-      "src/shared/ws-outbound-backpressure-queue.test.ts": 31,
-      "src/shared/wsl-exec-mode-separator.test.ts": 2451,
-      "src/shared/wsl-login-shell-command.test.ts": 66,
-      "src/shared/wsl-paths.test.ts": 18,
-      "src/shared/zod-salvage-absence.test.ts": 21,
-      "tests/e2e/alternate-screen-fixture-script.unit.test.ts": 8,
-      "tests/e2e/completed-worker-retirement-resume.unit.test.ts": 128,
-      "tests/e2e/global-teardown.unit.test.ts": 55,
-      "tests/e2e/helpers/alt-screen-frame.unit.test.ts": 40,
-      "tests/e2e/helpers/client-hosted-browser-fixture.unit.test.ts": 13,
-      "tests/e2e/helpers/electron-crashpad-cleanup.unit.test.ts": 11,
-      "tests/e2e/helpers/electron-home-isolation.unit.test.ts": 7,
-      "tests/e2e/helpers/electron-launch-args.unit.test.ts": 9,
-      "tests/e2e/helpers/electron-main-evaluate-retry.unit.test.ts": 1209,
-      "tests/e2e/helpers/electron-process-shutdown.unit.test.ts": 11,
-      "tests/e2e/helpers/fake-agent-command-override.unit.test.ts": 3,
-      "tests/e2e/helpers/fake-agent-paste-end-scanner.unit.test.ts": 16,
-      "tests/e2e/helpers/git-status-retry-barrier.unit.test.ts": 7,
-      "tests/e2e/helpers/golden-source-control.unit.test.ts": 11,
-      "tests/e2e/helpers/headless-paired-runtime-serve-readiness.unit.test.ts": 18,
-      "tests/e2e/helpers/nested-runtime-proxy-jump-fixture.unit.test.ts": 5,
-      "tests/e2e/helpers/paired-client-runtime-environment.unit.test.ts": 12,
-      "tests/e2e/helpers/paired-client-window-reveal.unit.test.ts": 10,
-      "tests/e2e/helpers/remote-skill-cloud-fixture.unit.test.ts": 138,
-      "tests/e2e/helpers/remote-terminal-source-range-contract-fixture.unit.test.ts": 7,
-      "tests/e2e/helpers/ssh-port-forward-snapshot-barrier.unit.test.ts": 57,
-      "tests/e2e/helpers/streaming-terminal-cleanup.unit.test.ts": 10,
-      "tests/e2e/host-cold-park-remote-subscriber.unit.test.ts": 518,
-      "tests/e2e/host-guest-paint-retention-remote-viewer.unit.test.ts": 278,
-      "tests/e2e/orca-restart-navigation.unit.test.ts": 9,
-      "tests/e2e/orchestration-run-pagination.unit.test.ts": 9,
-      "tests/e2e/paired-runtime-rejected-input-remount.unit.test.ts": 935,
-      "tests/e2e/relay-region-compatibility.unit.test.ts": 56,
-      "tests/e2e/relay-region-correction.unit.test.ts": 5935,
-      "tests/e2e/remote-agent-completion-authority.unit.test.ts": 20,
-      "tests/e2e/remote-terminal-tab-retirement.unit.test.ts": 53,
-      "tests/e2e/restored-terminal-input-readiness.unit.test.ts": 17,
-      "tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts": 460,
-      "tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts": 33,
-      "tests/e2e/session-tabs-rich-status-boundaries.unit.test.ts": 82,
-      "tests/e2e/ssh-codex-replay-reply-probe.unit.test.ts": 9,
-      "tests/e2e/structured-native-chat-routing-authority.unit.test.ts": 67,
-      "tests/e2e/terminal-foreground-confirmation.unit.test.ts": 19,
-      "tests/e2e/terminal-probe-input-sequence.unit.test.ts": 9,
-      "tests/e2e/terminal-split-activation-latency-artifact.unit.test.ts": 11,
-      "tests/e2e/terminal-split-activation-latency-report.unit.test.ts": 13,
-      "tests/tools/relay-bench/phone-e2ee-desktop-parity.test.mjs": 48,
-      "tests/tools/relay-bench/region-probe-replay.test.mjs": 26,
-      "tests/tools/relay-bench/relay-bench-invocation.test.mjs": 16,
-      "tests/tools/relay-bench/relay-bench-state-file.test.mjs": 13,
-      "tests/tools/relay-bench/relay-phone-connect-bench.test.mjs": 27,
-      "tests/tools/win-update-e2e/app-driver.test.mjs": 23,
-      "tests/tools/windows-pty-native-capability-smoke/packaged-node-pty-capability-oracle.test.mjs": 8,
-      "tests/tools/windows-pty-native-capability-smoke/packaged-node-pty-capability-probe.test.mjs": 40,
-      "tests/tools/windows-pty-native-capability-smoke/run.test.mjs": 11
+      "src/shared/ai-vault-types.test.ts": 52,
+      "src/shared/antigravity-source-control.test.ts": 165,
+      "src/shared/app-version.test.ts": 44,
+      "src/shared/artifact-sharing-gate.test.ts": 149,
+      "src/shared/automation-cron-dialect.test.ts": 50,
+      "src/shared/automation-cron-input-validation.test.ts": 78,
+      "src/shared/automation-execution-target.test.ts": 54,
+      "src/shared/automation-host-filter.test.ts": 53,
+      "src/shared/automation-legacy-list-partition.test.ts": 33,
+      "src/shared/automation-list-response.test.ts": 44,
+      "src/shared/automation-list-scope.test.ts": 51,
+      "src/shared/automation-owner-key.test.ts": 43,
+      "src/shared/automation-owner-precondition.test.ts": 75,
+      "src/shared/automation-run-identity.test.ts": 47,
+      "src/shared/automation-run-retention.test.ts": 45,
+      "src/shared/automation-schedule-drift.test.ts": 87,
+      "src/shared/automation-schedules.test.ts": 199,
+      "src/shared/automation-usage-summary.test.ts": 64,
+      "src/shared/base-ref-search-result.test.ts": 40,
+      "src/shared/binary-file-extensions.test.ts": 54,
+      "src/shared/bounded-map.test.ts": 68,
+      "src/shared/branch-name-from-work.test.ts": 59,
+      "src/shared/branch-prefix.test.ts": 55,
+      "src/shared/browser-client-automation-protocol.test.ts": 145,
+      "src/shared/browser-client-host-id-argument.test.ts": 51,
+      "src/shared/browser-client-host-protocol.test.ts": 255,
+      "src/shared/browser-client-host-reconciliation-protocol.test.ts": 81,
+      "src/shared/browser-client-hosting-eligibility.test.ts": 39,
+      "src/shared/browser-cookie-import-sources.test.ts": 31,
+      "src/shared/browser-grab-types.test.ts": 49,
+      "src/shared/browser-network-capabilities.test.ts": 28,
+      "src/shared/browser-network-tunnel-protocol.test.ts": 86,
+      "src/shared/browser-network-tunnel-stream-framing.test.ts": 1565,
+      "src/shared/browser-screencast-protocol.test.ts": 48,
+      "src/shared/browser-url.test.ts": 128,
+      "src/shared/bundled-ripgrep.test.ts": 24,
+      "src/shared/cheap-process-table-snapshot.test.ts": 55,
+      "src/shared/check-job-log-byte-cap.test.ts": 77,
+      "src/shared/check-job-log-retention.test.ts": 186,
+      "src/shared/check-job-log-tail-slice.test.ts": 55,
+      "src/shared/child-process/bounded-output-sink.test.ts": 48,
+      "src/shared/child-process/child-process-import-boundary.test.ts": 1004,
+      "src/shared/child-process/close-process-registry.test.ts": 40,
+      "src/shared/child-process/posix-lsof-probe.test.ts": 4289,
+      "src/shared/child-process/process-tree-termination.test.ts": 68,
+      "src/shared/child-process/retryable-process-exit-proof.test.ts": 38,
+      "src/shared/child-process/run-process-termination-failure.test.ts": 49,
+      "src/shared/child-process/run-process.test.ts": 7245,
+      "src/shared/child-process/windows-cmd-shim-resolution.test.ts": 57,
+      "src/shared/child-process/windows-cmd-shim-resolution.win32.test.ts": 42,
+      "src/shared/child-process/windows-command-line.test.ts": 55,
+      "src/shared/child-process/windows-command-line.win32.test.ts": 39,
+      "src/shared/child-process/windows-console-visibility.test.ts": 3436,
+      "src/shared/claimed-agent-pty-owner.test.ts": 94,
+      "src/shared/claude-agent-teams-tmux-compat.test.ts": 57,
+      "src/shared/claude-background-task-kind.test.ts": 26,
+      "src/shared/claude-background-task-status.test.ts": 168,
+      "src/shared/claude-model-list-probe.test.ts": 50,
+      "src/shared/claude-statusline-rate-limits.test.ts": 54,
+      "src/shared/claude-subagent-roster.test.ts": 65,
+      "src/shared/claude-subagent-row-lifecycle.test.ts": 193,
+      "src/shared/cli-argument-boundary.test.ts": 35,
+      "src/shared/cli-runtime-pairing-boundary.test.ts": 201,
+      "src/shared/cli-workspace-provenance.test.ts": 35,
+      "src/shared/client-environment-info.test.ts": 55,
+      "src/shared/clipboard-image.test.ts": 36,
+      "src/shared/clipboard-text.test.ts": 75,
+      "src/shared/closed-terminal-tab-tombstones.test.ts": 125,
+      "src/shared/cloud-service-url.test.ts": 38,
+      "src/shared/codex-auth-errors.test.ts": 51,
+      "src/shared/codex-pet-sprite-defaults.test.ts": 62,
+      "src/shared/codex-reset-credit-attempt-ledger.test.ts": 129,
+      "src/shared/codex-reset-credit-scope.test.ts": 48,
+      "src/shared/codex-startup-delivery.test.ts": 43,
+      "src/shared/codex-subagent-poll-scheduler.test.ts": 54,
+      "src/shared/codex-subagent-rollout-lifecycle.test.ts": 109,
+      "src/shared/codex-subagent-roster.test.ts": 75,
+      "src/shared/codex-subagent-transcript.test.ts": 72,
+      "src/shared/combined-diff-file-tree-width.test.ts": 49,
+      "src/shared/command-code-output-retention.test.ts": 64,
+      "src/shared/command-code-output-status.test.ts": 214,
+      "src/shared/command-code-turn-boundary.test.ts": 48,
+      "src/shared/command-environment.test.ts": 69,
+      "src/shared/command-token-scanner.test.ts": 48,
+      "src/shared/commit-message-agent-spec.test.ts": 122,
+      "src/shared/commit-message-generation.test.ts": 57,
+      "src/shared/commit-message-omp.test.ts": 239,
+      "src/shared/commit-message-plan.test.ts": 51,
+      "src/shared/commit-message-prompt.test.ts": 60,
+      "src/shared/computer-awake-mode.test.ts": 36,
+      "src/shared/computer-use-error-recovery.test.ts": 50,
+      "src/shared/computer-use-key-spec.test.ts": 27,
+      "src/shared/constants.test.ts": 193,
+      "src/shared/contextual-tours.test.ts": 63,
+      "src/shared/crash-reporting.test.ts": 45,
+      "src/shared/cross-platform-path-guards.test.ts": 1653,
+      "src/shared/cross-platform-path.test.ts": 47,
+      "src/shared/daemon-adoption-telemetry.test.ts": 168,
+      "src/shared/direct-ssh-reconnect-telemetry-schema.test.ts": 152,
+      "src/shared/doc-preview-file-access.test.ts": 80,
+      "src/shared/doc-preview-scheme.test.ts": 46,
+      "src/shared/draft-paste-ready-scanner-grok-trace-replay.test.ts": 98,
+      "src/shared/draft-paste-ready-scanner.test.ts": 46,
+      "src/shared/emoji-shortcode-catalog.lazy.test.ts": 116,
+      "src/shared/emulator-keyboard-frame.test.ts": 53,
+      "src/shared/emulator-touch-frame.test.ts": 36,
+      "src/shared/ephemeral-setup-terminal-worktree-id.test.ts": 50,
+      "src/shared/ephemeral-vm-recipe-checkout-mode.test.ts": 130,
+      "src/shared/ephemeral-vm-recipe-doctor.test.ts": 47,
+      "src/shared/ephemeral-vm-recipe-output-capture.test.ts": 223,
+      "src/shared/ephemeral-vm-recipe-process.test.ts": 237,
+      "src/shared/ephemeral-vm-recipe-repo-url.test.ts": 51,
+      "src/shared/ephemeral-vm-recipes.test.ts": 122,
+      "src/shared/ephemeral-vm-runtime-feature-sorting.test.ts": 285,
+      "src/shared/ephemeral-vm-runtime-store-rollback.test.ts": 661,
+      "src/shared/ephemeral-vm-runtime-store.test.ts": 213,
+      "src/shared/event-loop-yield.test.ts": 68,
+      "src/shared/execution-host-registry.test.ts": 70,
+      "src/shared/execution-host.test.ts": 66,
+      "src/shared/export-let-function-initializer-ban.test.ts": 3945,
+      "src/shared/external-automation-jobs-file.test.ts": 95,
+      "src/shared/external-worktree-inbox.test.ts": 35,
+      "src/shared/feature-education-telemetry.test.ts": 38,
+      "src/shared/feature-interactions.test.ts": 2141,
+      "src/shared/feature-tips.test.ts": 68,
+      "src/shared/feature-wall-tour-depth.test.ts": 27,
+      "src/shared/feedback-image-limits.test.ts": 49,
+      "src/shared/file-link-location.test.ts": 51,
+      "src/shared/file-name-sort.test.ts": 48,
+      "src/shared/filesystem-directory-listing-limit.test.ts": 53,
+      "src/shared/fish-binary-requirement.test.ts": 45,
+      "src/shared/folder-workspace-execution-host.test.ts": 79,
+      "src/shared/folder-workspace-worktree.test.ts": 46,
+      "src/shared/folder-workspaces.test.ts": 33,
+      "src/shared/foreground-process-ancestry-parity.test.ts": 379,
+      "src/shared/foreground-process-selection.test.ts": 96,
+      "src/shared/foreground-wrapper-agent.test.ts": 51,
+      "src/shared/generated-code-path.test.ts": 46,
+      "src/shared/git-binary-compatibility.test.ts": 52,
+      "src/shared/git-branch-cleanup.test.ts": 62,
+      "src/shared/git-branch-compare-head.test.ts": 30,
+      "src/shared/git-branch-line-total-soft-deadline.test.ts": 3579,
+      "src/shared/git-branch-line-total.test.ts": 60,
+      "src/shared/git-capability-cache.test.ts": 58,
+      "src/shared/git-check-ignore-stdio.test.ts": 54,
+      "src/shared/git-clone-failure-message.test.ts": 74,
+      "src/shared/git-config-snapshot-runner.test.ts": 67,
+      "src/shared/git-configured-branch-target.test.ts": 60,
+      "src/shared/git-cquoted-path.test.ts": 29,
+      "src/shared/git-diff-transport-budget.test.ts": 2035,
+      "src/shared/git-discard-path-safety.test.ts": 40,
+      "src/shared/git-exec-mutation.test.ts": 53,
+      "src/shared/git-fetch-head-capability.test.ts": 39,
+      "src/shared/git-fetch-head-lock-key-derivation.test.ts": 133,
+      "src/shared/git-fetch-head-lock.test.ts": 169,
+      "src/shared/git-fork-sync.test.ts": 54,
+      "src/shared/git-history-graph.test.ts": 95,
+      "src/shared/git-history-message-allocation.test.ts": 45,
+      "src/shared/git-history-ref-display.test.ts": 65,
+      "src/shared/git-history.test.ts": 68,
+      "src/shared/git-merge-tree-capability.test.ts": 31,
+      "src/shared/git-metadata-path.test.ts": 63,
+      "src/shared/git-push-target-validation.test.ts": 44,
+      "src/shared/git-remote-error.test.ts": 73,
+      "src/shared/git-remote-identity.test.ts": 56,
+      "src/shared/git-remote-url-index.test.ts": 53,
+      "src/shared/git-rev-list-output.test.ts": 43,
+      "src/shared/git-status-branch-line-total-cache.test.ts": 55,
+      "src/shared/git-status-conflict-entries.test.ts": 33,
+      "src/shared/git-status-limit.test.ts": 37,
+      "src/shared/git-status-line-stat-inputs.test.ts": 32,
+      "src/shared/git-status-line-stats-cache.test.ts": 67,
+      "src/shared/git-status-upstream-ref.test.ts": 59,
+      "src/shared/git-tracked-pathspecs.test.ts": 207,
+      "src/shared/git-uncommitted-line-stats.test.ts": 85,
+      "src/shared/git-upstream-status.test.ts": 33,
+      "src/shared/git-worktree-operation-lock.test.ts": 32,
+      "src/shared/github/account-binding.test.ts": 41,
+      "src/shared/github/api-availability.test.ts": 38,
+      "src/shared/github/owner-slug.test.ts": 40,
+      "src/shared/github/project-identity.test.ts": 25,
+      "src/shared/github/project-ref-input.test.ts": 39,
+      "src/shared/github/project-roadmap-timeline.test.ts": 77,
+      "src/shared/github/pull-request-auto-merge-availability.test.ts": 64,
+      "src/shared/github/pull-request-for-branch-outcome.test.ts": 45,
+      "src/shared/github/pull-request-merge-methods.test.ts": 50,
+      "src/shared/github/repository-identity-key.test.ts": 49,
+      "src/shared/github/work-items-query-bounds.test.ts": 58,
+      "src/shared/gitlab-job-log-excerpt.test.ts": 91,
+      "src/shared/gitlab-job-trace-check-details.test.ts": 32,
+      "src/shared/gitlab-pipeline-checks.test.ts": 34,
+      "src/shared/gitlab-projects.test.ts": 40,
+      "src/shared/grok-model-list-probe.test.ts": 49,
+      "src/shared/grok-session-paths.test.ts": 87,
+      "src/shared/growing-byte-buffer.test.ts": 96,
+      "src/shared/handled-wire-discriminant.test.ts": 36,
+      "src/shared/harness-injected-user-turns.test.ts": 42,
+      "src/shared/hermes-run-ref-retention.test.ts": 29,
+      "src/shared/hermes-session-run-index.test.ts": 692,
+      "src/shared/hermes-startup-query.windows.test.ts": 41,
+      "src/shared/hook-command-source-policy.test.ts": 52,
+      "src/shared/host-balanced-listing-scaling.test.ts": 56,
+      "src/shared/host-display-resolution.test.ts": 33,
+      "src/shared/host-setting-overrides.test.ts": 37,
+      "src/shared/hosted-review-creation-providers.test.ts": 52,
+      "src/shared/hosted-review-github.test.ts": 48,
+      "src/shared/hosted-review-ready-capabilities.test.ts": 37,
+      "src/shared/hosted-review-refs.test.ts": 109,
+      "src/shared/image-data-uri.test.ts": 41,
+      "src/shared/image-paste-following-text.test.ts": 68,
+      "src/shared/in-flight-promise-dedupe.test.ts": 61,
+      "src/shared/issue-link-input.test.ts": 60,
+      "src/shared/jira-issue-url.test.ts": 57,
+      "src/shared/json-text-structure-limit.test.ts": 40,
+      "src/shared/keybindings-conflicts.test.ts": 94,
+      "src/shared/keybindings-default-bindings.test.ts": 109,
+      "src/shared/keybindings-digit-index.test.ts": 110,
+      "src/shared/keybindings-double-tap.test.ts": 85,
+      "src/shared/keybindings-keyboard-layout.test.ts": 56,
+      "src/shared/keybindings-mouse.test.ts": 44,
+      "src/shared/keybindings-parse-cache.test.ts": 142,
+      "src/shared/keybindings-parsing.test.ts": 47,
+      "src/shared/keybindings-terminal-context.test.ts": 49,
+      "src/shared/keybindings-unassigned-actions.test.ts": 61,
+      "src/shared/linear/inline-media.test.ts": 36,
+      "src/shared/linear/issue-attribute-filter.test.ts": 58,
+      "src/shared/linear/issue-view-resume-state.test.ts": 67,
+      "src/shared/linear/links.test.ts": 74,
+      "src/shared/linear/workspace-types.test.ts": 25,
+      "src/shared/linux-proc-port-scan-limits.test.ts": 42,
+      "src/shared/local-account-runtime.test.ts": 93,
+      "src/shared/local-build-compatibility.test.ts": 34,
+      "src/shared/localhost-worktree-labels.test.ts": 52,
+      "src/shared/loose-ref-count.test.ts": 358,
+      "src/shared/machine-name.test.ts": 35,
+      "src/shared/macos-symbolic-hotkeys.test.ts": 100,
+      "src/shared/main-agent-status-parity.test.ts": 206,
+      "src/shared/managed-agent-command-token.test.ts": 26,
+      "src/shared/manual-repo-order.test.ts": 36,
+      "src/shared/map-settled-with-concurrency.test.ts": 60,
+      "src/shared/map-with-concurrency.test.ts": 82,
+      "src/shared/markdown-document-listing-limits.test.ts": 47,
+      "src/shared/markdown-toc-panel-width.test.ts": 53,
+      "src/shared/mcp-config.test.ts": 128,
+      "src/shared/mobile-e2ee-v2-contract.test.ts": 41,
+      "src/shared/mobile-e2ee-v2-framing.test.ts": 55,
+      "src/shared/mobile-file-directory-limit.test.ts": 49,
+      "src/shared/mobile-markdown-document.test.ts": 40,
+      "src/shared/mobile-pairing-connection-mode.test.ts": 49,
+      "src/shared/mobile-pairing-custom-address.test.ts": 57,
+      "src/shared/mobile-push-contract.test.ts": 44,
+      "src/shared/mobile-relay-close-codes.test.ts": 49,
+      "src/shared/mobile-relay-mint-failure.test.ts": 33,
+      "src/shared/mobile-relay-pairing-offer.test.ts": 151,
+      "src/shared/mobile-relay-phone-protocol.test.ts": 109,
+      "src/shared/mobile-web-bundle/bundle-range-rpc-contract.test.ts": 108,
+      "src/shared/mobile-web-bundle/bundle-rpc-contract.test.ts": 153,
+      "src/shared/mobile-web-bundle/manifest-contract.test.ts": 204,
+      "src/shared/model-id-label.test.ts": 45,
+      "src/shared/modifier-double-tap-detector.test.ts": 47,
+      "src/shared/mouse-shortcut-input.test.ts": 49,
+      "src/shared/muse-session-log.test.ts": 63,
+      "src/shared/native-chat-activity-tail-line.test.ts": 155,
+      "src/shared/native-chat-agent-profiles.test.ts": 68,
+      "src/shared/native-chat-agent-support.test.ts": 52,
+      "src/shared/native-chat-ask-fifo.test.ts": 386,
+      "src/shared/native-chat-ask-row.test.ts": 41,
+      "src/shared/native-chat-ask.test.ts": 41,
+      "src/shared/native-chat-background-task-row.test.ts": 61,
+      "src/shared/native-chat-command-envelope.test.ts": 45,
+      "src/shared/native-chat-edit-normalize.test.ts": 189,
+      "src/shared/native-chat-href-routing.test.ts": 32,
+      "src/shared/native-chat-image-transcript-markers.test.ts": 45,
+      "src/shared/native-chat-session-option-commands.test.ts": 61,
+      "src/shared/native-chat-session-option-defaults.test.ts": 59,
+      "src/shared/native-chat-session-option-snapshot.test.ts": 107,
+      "src/shared/native-chat-session-option-state.test.ts": 31,
+      "src/shared/native-chat-shell-environment.test.ts": 39,
+      "src/shared/native-chat-slash-commands.omp.test.ts": 152,
+      "src/shared/native-chat-slash-commands.test.ts": 47,
+      "src/shared/native-chat-stream-unsubscribe.test.ts": 52,
+      "src/shared/native-chat-streaming.test.ts": 53,
+      "src/shared/native-chat-subagent-summary.test.ts": 42,
+      "src/shared/native-chat-task-list.test.ts": 40,
+      "src/shared/native-chat-tool-activity.test.ts": 30,
+      "src/shared/native-chat-tool-attribution-allocation.test.ts": 79,
+      "src/shared/native-chat-tool-icon.test.ts": 70,
+      "src/shared/native-chat-tool-identity.test.ts": 150,
+      "src/shared/native-chat-tool-pair-limit.test.ts": 119,
+      "src/shared/native-chat-tool-pairing.test.ts": 56,
+      "src/shared/native-chat-tool-preview-prefix.test.ts": 60,
+      "src/shared/native-chat-tool-preview-scan.test.ts": 40,
+      "src/shared/native-chat-tool-run-outcome.test.ts": 59,
+      "src/shared/native-chat-tool-run-sentence.test.ts": 66,
+      "src/shared/native-chat-tool-summary.test.ts": 55,
+      "src/shared/native-chat-transcript-retention.test.ts": 43,
+      "src/shared/native-chat-turn-activity.test.ts": 74,
+      "src/shared/native-chat-turn-fold.test.ts": 29,
+      "src/shared/native-chat-turn-status.test.ts": 65,
+      "src/shared/native-chat-types.test.ts": 46,
+      "src/shared/native-chat-unverifiable-turn-status.test.ts": 44,
+      "src/shared/native-file-drop.test.ts": 73,
+      "src/shared/nested-repo-telemetry-schema.test.ts": 152,
+      "src/shared/nested-repo-telemetry.test.ts": 50,
+      "src/shared/nested-worker-depth.test.ts": 37,
+      "src/shared/network-proxy.test.ts": 52,
+      "src/shared/network/manual-address.test.ts": 82,
+      "src/shared/network/server-share-address.test.ts": 30,
+      "src/shared/new-workspace-dialog-repo.test.ts": 25,
+      "src/shared/new-workspace/smart-workspace-url-source-results.test.ts": 92,
+      "src/shared/new-workspace/work-item-lookup-text.test.ts": 26,
+      "src/shared/new-workspace/workspace-source.test.ts": 51,
+      "src/shared/new-workspace/worktree-create-retry-policy.test.ts": 38,
+      "src/shared/node-bounded-file-reader-sync.test.ts": 36,
+      "src/shared/node-bounded-file-reader.test.ts": 35,
+      "src/shared/node-bounded-json-stringify.test.ts": 73,
+      "src/shared/node-file-content-equality.test.ts": 55,
+      "src/shared/node-markdown-document-discovery.test.ts": 57,
+      "src/shared/node-pty-spawn-helper.test.ts": 34,
+      "src/shared/node-readable-text.test.ts": 54,
+      "src/shared/node-source-copy-content-equality.test.ts": 69,
+      "src/shared/notebook-venv-location.test.ts": 44,
+      "src/shared/nul-delimited-fields.test.ts": 30,
+      "src/shared/nvm-default-alias.test.ts": 56,
+      "src/shared/omp-draft-launch-shell.test.ts": 173,
+      "src/shared/omp-draft-launch-windows.test.ts": 86,
+      "src/shared/omp-fresh-launch-shell.test.ts": 134,
+      "src/shared/omp-fresh-launch.test.ts": 102,
+      "src/shared/omp-owner-state-title.test.ts": 88,
+      "src/shared/omp-pi-semantic-title-preservation.test.ts": 49,
+      "src/shared/omp-source-control-discovery.test.ts": 150,
+      "src/shared/onboarding-tour-telemetry-events.test.ts": 165,
+      "src/shared/open-in-applications.test.ts": 36,
+      "src/shared/opencode-launch-command.test.ts": 52,
+      "src/shared/opencode-permission-status.test.ts": 154,
+      "src/shared/opencode-terminal-title.test.ts": 41,
+      "src/shared/orca-session-address.test.ts": 189,
+      "src/shared/orca-yaml-alias-bounds.test.ts": 102,
+      "src/shared/orca-yaml-bounds.test.ts": 64,
+      "src/shared/orcad-artifacts.test.ts": 27,
+      "src/shared/orcad-profile-preflight.test.ts": 135,
+      "src/shared/orchestration-ask-timeout.test.ts": 46,
+      "src/shared/orchestration-check-output.test.ts": 50,
+      "src/shared/orchestration-compatibility-evidence.test.ts": 41,
+      "src/shared/orchestration-dispatch-refusal-contract.test.ts": 71,
+      "src/shared/orchestration-fleet-attention.test.ts": 38,
+      "src/shared/orchestration-fleet-evidence-clock.test.ts": 39,
+      "src/shared/orchestration-fleet-projection.test.ts": 64,
+      "src/shared/orchestration-rpc-contract.test.ts": 34,
+      "src/shared/orchestration-task-display.test.ts": 38,
+      "src/shared/orchestration-task-summary.test.ts": 45,
+      "src/shared/orchestration-timing-budgets.test.ts": 38,
+      "src/shared/osc-title-scan-tail-retention.test.ts": 59,
+      "src/shared/osc-title-scan-tail.test.ts": 36,
+      "src/shared/osc52-clipboard-settings.test.ts": 40,
+      "src/shared/own-retained-string.test.ts": 115,
+      "src/shared/pairing-address-auto-selection.test.ts": 58,
+      "src/shared/pairing-local-ui-fields.test.ts": 29,
+      "src/shared/pairing.test.ts": 112,
+      "src/shared/pane-agent-identity-adapter.test.ts": 83,
+      "src/shared/pane-agent-identity-inventory.test.ts": 1015,
+      "src/shared/pane-agent-identity-resolver.test.ts": 90,
+      "src/shared/pane-agent-identity-surface-inventory.test.ts": 2736,
+      "src/shared/pane-agent-identity-title-corpus.test.ts": 95,
+      "src/shared/pane-agent-owner.test.ts": 53,
+      "src/shared/pane-key-alias.test.ts": 69,
+      "src/shared/physical-exit-tracker.test.ts": 45,
+      "src/shared/pi-agent-kind.test.ts": 58,
+      "src/shared/pi-overlay-ui-settings.test.ts": 50,
+      "src/shared/pi-state-title-marker.test.ts": 72,
+      "src/shared/plugins/plugin-consent-fingerprint.test.ts": 159,
+      "src/shared/plugins/plugin-consent-request.test.ts": 84,
+      "src/shared/plugins/plugin-content-pack-contributions.test.ts": 136,
+      "src/shared/plugins/plugin-demo-fixture.test.ts": 177,
+      "src/shared/plugins/plugin-hostile-fixture.test.ts": 53,
+      "src/shared/plugins/plugin-install-lockfile.test.ts": 134,
+      "src/shared/plugins/plugin-kill-list.test.ts": 208,
+      "src/shared/plugins/plugin-language-pack-artifact.test.ts": 176,
+      "src/shared/plugins/plugin-manifest.test.ts": 145,
+      "src/shared/plugins/plugin-marketplace.test.ts": 224,
+      "src/shared/plugins/plugin-panel-call-admission.test.ts": 139,
+      "src/shared/plugins/plugin-panel-message-budget-traversal.test.ts": 196,
+      "src/shared/plugins/plugin-panel-message-budget.test.ts": 140,
+      "src/shared/plugins/plugin-panel-pong-frame.test.ts": 134,
+      "src/shared/plugins/plugin-panel-shell.test.ts": 566,
+      "src/shared/plugins/plugin-path-safety.test.ts": 161,
+      "src/shared/plugins/plugin-vm-recipe-artifact.test.ts": 172,
+      "src/shared/posix-wait-status.test.ts": 61,
+      "src/shared/powershell-native-argument.test.ts": 23,
+      "src/shared/pr-bot-author-overrides.test.ts": 36,
+      "src/shared/pr-check-severity-order.test.ts": 36,
+      "src/shared/pr-check-status.test.ts": 50,
+      "src/shared/pr-comment-audience.test.ts": 52,
+      "src/shared/pr-comment-groups.test.ts": 33,
+      "src/shared/pr-comment-time.test.ts": 49,
+      "src/shared/preferred-git-remote.test.ts": 27,
+      "src/shared/priority-semaphore.test.ts": 38,
+      "src/shared/process-output-field-scanner.test.ts": 49,
+      "src/shared/process-table-index.test.ts": 152,
+      "src/shared/process-table-snapshot.test.ts": 174,
+      "src/shared/profile-state-recovery-command.test.ts": 156,
+      "src/shared/profile-state-telemetry-schema.test.ts": 187,
+      "src/shared/project-catalog-row-normalization.test.ts": 64,
+      "src/shared/project-execution-runtime.test.ts": 47,
+      "src/shared/project-groups.test.ts": 141,
+      "src/shared/project-host-setup-projection.test.ts": 45,
+      "src/shared/project-identity-succession.test.ts": 54,
+      "src/shared/promise-settlement-waiters.test.ts": 305,
+      "src/shared/protocol-compat.test.ts": 43,
+      "src/shared/pty-consumer-session.test.ts": 34,
+      "src/shared/pty-delivery-diagnostics.test.ts": 46,
+      "src/shared/pty-liveness-verdict.test.ts": 27,
+      "src/shared/pty-owner-backend.test.ts": 25,
+      "src/shared/pty-slave-line-discipline-echo.test.ts": 42,
+      "src/shared/pty-startup-ingress-kitty.test.ts": 67,
+      "src/shared/pty-startup-ingress-live-query-reply.test.ts": 54,
+      "src/shared/pty-startup-ingress.test.ts": 148,
+      "src/shared/pty-startup-reply-echo-shapes.test.ts": 67,
+      "src/shared/published-pane-agent-identity.test.ts": 82,
+      "src/shared/pull-request-generation.test.ts": 79,
+      "src/shared/quick-open-directory-reader.test.ts": 64,
+      "src/shared/quick-open-expansion-paths.test.ts": 60,
+      "src/shared/quick-open-filter.renderer-safety.test.ts": 53,
+      "src/shared/quick-open-filter.test.ts": 66,
+      "src/shared/quick-open-fuzzy-scan.test.ts": 1098,
+      "src/shared/quick-open-git-directory-collapse.test.ts": 140,
+      "src/shared/quick-open-install-rg.test.ts": 27,
+      "src/shared/quick-open-listing-limits.test.ts": 45,
+      "src/shared/quick-open-readdir-memory.test.ts": 73,
+      "src/shared/quick-open-readdir-walk.test.ts": 445,
+      "src/shared/quick-open-transport-budget.test.ts": 43,
+      "src/shared/raster-image-base64-preview.test.ts": 501,
+      "src/shared/raster-image-dimensions.test.ts": 53,
+      "src/shared/raster-image-preview-limits.test.ts": 57,
+      "src/shared/rate-limit-reset-format.test.ts": 50,
+      "src/shared/rate-limit-types.test.ts": 32,
+      "src/shared/react-update-depth-attribution.test.ts": 48,
+      "src/shared/reconnect-jitter.test.ts": 34,
+      "src/shared/relay-frame-buffer.test.ts": 517,
+      "src/shared/relay-optional-artifacts.test.ts": 42,
+      "src/shared/relay-version-marker.test.ts": 42,
+      "src/shared/release-channel.test.ts": 36,
+      "src/shared/remote-foreground-evidence.test.ts": 30,
+      "src/shared/remote-pairing-address.test.ts": 143,
+      "src/shared/remote-pairing-verification.test.ts": 52,
+      "src/shared/remote-rpc-content-budget.test.ts": 93,
+      "src/shared/remote-runtime-client-error-classification.test.ts": 70,
+      "src/shared/remote-runtime-client.test.ts": 4934,
+      "src/shared/remote-runtime-connect-bound.test.ts": 387,
+      "src/shared/remote-runtime-memory-limits.test.ts": 159,
+      "src/shared/remote-runtime-outbound-admission.test.ts": 1513,
+      "src/shared/remote-runtime-request-connection-stale.test.ts": 297,
+      "src/shared/remote-runtime-request-connection.test.ts": 349,
+      "src/shared/remote-runtime-request-frames.test.ts": 99,
+      "src/shared/remote-runtime-request-response-router.test.ts": 174,
+      "src/shared/remote-runtime-request-websocket.test.ts": 180,
+      "src/shared/remote-runtime-shared-control-boundary.test.ts": 3236,
+      "src/shared/remote-runtime-shared-control-connection.test.ts": 3372,
+      "src/shared/remote-runtime-shared-control-keepalive-refresh.test.ts": 150,
+      "src/shared/remote-runtime-shared-control-reconnect.test.ts": 176,
+      "src/shared/remote-runtime-shared-control-retired-request-ids.test.ts": 47,
+      "src/shared/remote-runtime-shared-control-socket-generation.test.ts": 111,
+      "src/shared/remote-runtime-shared-control-standing-intent.test.ts": 883,
+      "src/shared/remote-runtime-shared-control-subscription-close.test.ts": 128,
+      "src/shared/remote-runtime-shared-control-subscriptions.test.ts": 161,
+      "src/shared/remote-runtime-socket-liveness.test.ts": 33,
+      "src/shared/remote-runtime-subscription-connect-bound.test.ts": 293,
+      "src/shared/remote-runtime-subscription-frame-router.test.ts": 89,
+      "src/shared/remote-runtime-subscription-request.test.ts": 526,
+      "src/shared/remote-runtime-tailscale-hint.test.ts": 41,
+      "src/shared/remote-runtime-transport-error-agreement.test.ts": 353,
+      "src/shared/remote-workspace-session-projection.test.ts": 156,
+      "src/shared/renderer-restart-preparation.test.ts": 537,
+      "src/shared/repo-badge-color.test.ts": 181,
+      "src/shared/repo-icon.test.ts": 68,
+      "src/shared/repo-ref-maintenance.test.ts": 861,
+      "src/shared/repo-search-limits.test.ts": 41,
+      "src/shared/repro-13889-claude-quarter-circle-busy-title.test.ts": 82,
+      "src/shared/repro-7732-gitlab-job-id-dropped.test.ts": 52,
+      "src/shared/repro-8478-opencode-native-title-icon.test.ts": 69,
+      "src/shared/require-tui-agent-config.test.ts": 51,
+      "src/shared/resolved-worktree-lineage.test.ts": 38,
+      "src/shared/retired-pty-incarnations.test.ts": 44,
+      "src/shared/review-head-tracking-ref.test.ts": 56,
+      "src/shared/ripgrep-process-availability.test.ts": 70,
+      "src/shared/rpc-contract/agent-launch-params.test.ts": 167,
+      "src/shared/rpc-contract/terminal-create-shell-param.test.ts": 156,
+      "src/shared/runtime-client-export-parity.test.ts": 136,
+      "src/shared/runtime-environment-store.test.ts": 259,
+      "src/shared/runtime-host-status-owner.test.ts": 40,
+      "src/shared/runtime-listing-host-scope.test.ts": 38,
+      "src/shared/runtime-navigation.test.ts": 49,
+      "src/shared/runtime-rpc-call-queue-retention.test.ts": 215,
+      "src/shared/runtime-rpc-call-queue.test.ts": 77,
+      "src/shared/runtime-workspace-file-owner.test.ts": 45,
+      "src/shared/runtime-workspace-window-availability.test.ts": 57,
+      "src/shared/search-match-count.test.ts": 48,
+      "src/shared/search-subprocess-lines.test.ts": 117,
+      "src/shared/secret-store.test.ts": 39,
+      "src/shared/secure-file-coarse-ctime.test.ts": 51,
+      "src/shared/secure-file-fsync-flags.test.ts": 93,
+      "src/shared/secure-file.test.ts": 713,
+      "src/shared/secure-path-hardening-cache.test.ts": 37,
+      "src/shared/secure-path-hardening-retry-budget.test.ts": 65,
+      "src/shared/secure-path-windows-acl.win32.test.ts": 84,
+      "src/shared/serve-option-validation.test.ts": 65,
+      "src/shared/session-tab-placement.test.ts": 40,
+      "src/shared/setup-agent-sequencing.test.ts": 4298,
+      "src/shared/setup-agent-sequencing.windows.test.ts": 39,
+      "src/shared/setup-runner-command.test.ts": 58,
+      "src/shared/setup-script-imports.test.ts": 101,
+      "src/shared/setup-script-package-manager-suggestion.test.ts": 37,
+      "src/shared/setup-script-shebang.test.ts": 53,
+      "src/shared/setup-script-telemetry-events.test.ts": 153,
+      "src/shared/setup-script-telemetry.test.ts": 63,
+      "src/shared/sha256.test.ts": 75,
+      "src/shared/shell-foreground-snapshot.test.ts": 157,
+      "src/shared/shell-process-readiness.test.ts": 66,
+      "src/shared/skill-bundle-install-contract.test.ts": 123,
+      "src/shared/skill-bundle-name.test.ts": 37,
+      "src/shared/skill-delete-contract.test.ts": 127,
+      "src/shared/skill-deletion-eligibility.test.ts": 62,
+      "src/shared/skill-install-contract.test.ts": 145,
+      "src/shared/skill-install-failure.test.ts": 88,
+      "src/shared/skill-metadata.test.ts": 40,
+      "src/shared/skill-package-manifest.test.ts": 233,
+      "src/shared/skill-path-containment.test.ts": 35,
+      "src/shared/skills-cli-agent-keys.test.ts": 40,
+      "src/shared/source-control-ai-action-recipes.test.ts": 176,
+      "src/shared/source-control-ai-action-variables.test.ts": 52,
+      "src/shared/source-control-ai-actions.test.ts": 65,
+      "src/shared/source-control-ai-policy-regression.test.ts": 220,
+      "src/shared/source-control-ai-recipe-save.test.ts": 179,
+      "src/shared/source-control-ai.test.ts": 148,
+      "src/shared/source-control-create-review-intent.test.ts": 37,
+      "src/shared/source-control-group-order.test.ts": 52,
+      "src/shared/source-control-primary-action-decision.test.ts": 55,
+      "src/shared/source-control-push-failure.test.ts": 60,
+      "src/shared/source-control-recovery-agent-command.test.ts": 62,
+      "src/shared/source-scan/source-tree-scan.test.ts": 80,
+      "src/shared/source-scan/source-tree-walk.test.ts": 58,
+      "src/shared/ssh-pending-pty-kill.test.ts": 47,
+      "src/shared/ssh-pty-id.test.ts": 56,
+      "src/shared/ssh-relay-pty-ownership-proof.test.ts": 53,
+      "src/shared/ssh-retained-payload-admission.test.ts": 68,
+      "src/shared/ssh-target-generation.test.ts": 50,
+      "src/shared/ssh-types.test.ts": 61,
+      "src/shared/stable-pane-id.test.ts": 37,
+      "src/shared/startup-command-submission.test.ts": 35,
+      "src/shared/status-bar-usage-mode.test.ts": 40,
+      "src/shared/string-chunk-compaction.test.ts": 44,
+      "src/shared/structural-value-equality.test.ts": 47,
+      "src/shared/structured-agent-session-agent-status.test.ts": 67,
+      "src/shared/structured-agent-session-coalescer.test.ts": 49,
+      "src/shared/structured-agent-session-composer.test.ts": 50,
+      "src/shared/structured-agent-session-context-usage.test.ts": 44,
+      "src/shared/structured-agent-session-create.test.ts": 64,
+      "src/shared/structured-agent-session-item-retention.test.ts": 937,
+      "src/shared/structured-agent-session-live-turn.test.ts": 117,
+      "src/shared/structured-agent-session-model-catalog-application.test.ts": 61,
+      "src/shared/structured-agent-session-mutation.test.ts": 49,
+      "src/shared/structured-agent-session-option-codec.test.ts": 25,
+      "src/shared/structured-agent-session-option-picks.test.ts": 79,
+      "src/shared/structured-agent-session-options.test.ts": 81,
+      "src/shared/structured-agent-session-projection.test.ts": 83,
+      "src/shared/structured-agent-session-reducer.test.ts": 146,
+      "src/shared/structured-agent-session-send-disposition.test.ts": 54,
+      "src/shared/structured-agent-session-status-started-at.test.ts": 94,
+      "src/shared/structured-agent-session-status-tool-line.test.ts": 77,
+      "src/shared/structured-agent-session-turn-timing-retention.test.ts": 185,
+      "src/shared/structured-agent-session-turn-timing.test.ts": 95,
+      "src/shared/structured-agent-turn-clock-anchor.test.ts": 36,
+      "src/shared/structured-native-chat-launch-route.test.ts": 38,
+      "src/shared/subprocess-stdin-write.test.ts": 54,
+      "src/shared/synthetic-agent-title.test.ts": 35,
+      "src/shared/tab-title-resolution.test.ts": 32,
+      "src/shared/tailnet-address.test.ts": 44,
+      "src/shared/task-providers.test.ts": 41,
+      "src/shared/task-query.test.ts": 51,
+      "src/shared/task-source-context.test.ts": 93,
+      "src/shared/telemetry-common-props.test.ts": 183,
+      "src/shared/telemetry-events-feature-education.test.ts": 198,
+      "src/shared/telemetry-events.test.ts": 189,
+      "src/shared/telemetry-feature-wall-events.test.ts": 175,
+      "src/shared/telemetry-orca-cli-feature-tip.test.ts": 182,
+      "src/shared/terminal-bell-detector.test.ts": 42,
+      "src/shared/terminal-color-scheme-protocol.test.ts": 50,
+      "src/shared/terminal-composer-draft.test.ts": 49,
+      "src/shared/terminal-custom-themes.test.ts": 42,
+      "src/shared/terminal-escape-introducer.test.ts": 61,
+      "src/shared/terminal-exit-cause.test.ts": 30,
+      "src/shared/terminal-file-url-target.test.ts": 36,
+      "src/shared/terminal-fonts.test.ts": 28,
+      "src/shared/terminal-github-pr-link-detector.test.ts": 73,
+      "src/shared/terminal-input.test.ts": 68,
+      "src/shared/terminal-kitty-keyboard-mode-tracker.test.ts": 61,
+      "src/shared/terminal-kitty-keyboard-tail-retention.test.ts": 180,
+      "src/shared/terminal-line-height-settings.test.ts": 51,
+      "src/shared/terminal-mode-2031-final-state.test.ts": 90,
+      "src/shared/terminal-mode-reset-profiles.test.ts": 95,
+      "src/shared/terminal-osc-color-reply.test.ts": 28,
+      "src/shared/terminal-osc133-carry-retention.test.ts": 266,
+      "src/shared/terminal-output-side-effects.test.ts": 79,
+      "src/shared/terminal-partial-escape-tail-ground-scan.test.ts": 41,
+      "src/shared/terminal-partial-escape-tail.fuzz.test.ts": 1380,
+      "src/shared/terminal-partial-escape-tail.test.ts": 61,
+      "src/shared/terminal-query-reply.test.ts": 86,
+      "src/shared/terminal-quick-commands.test.ts": 33,
+      "src/shared/terminal-reply-query-scan.test.ts": 43,
+      "src/shared/terminal-scrollback-policy.test.ts": 53,
+      "src/shared/terminal-selection-gutter.test.ts": 50,
+      "src/shared/terminal-startup-cwd.test.ts": 220,
+      "src/shared/terminal-stream-json-byte-length.test.ts": 41,
+      "src/shared/terminal-stream-protocol.test.ts": 55,
+      "src/shared/terminal-title-agent-type.test.ts": 62,
+      "src/shared/terminal-title-classification-corpus.test.ts": 94,
+      "src/shared/terminal-title-classification-memo.test.ts": 49,
+      "src/shared/terminal-view-attributes.test.ts": 35,
+      "src/shared/terminal-wait-blocked-reason-legacy-alias.test.ts": 33,
+      "src/shared/terminal-zero-dimensions-diagnostic.test.ts": 45,
+      "src/shared/test-code-path.test.ts": 41,
+      "src/shared/text-search.test.ts": 114,
+      "src/shared/timer-delay.test.ts": 52,
+      "src/shared/tui-agent-config.test.ts": 65,
+      "src/shared/tui-agent-launch-defaults.test.ts": 61,
+      "src/shared/tui-agent-permissions.test.ts": 41,
+      "src/shared/tui-agent-prompt-transport.test.ts": 94,
+      "src/shared/tui-agent-selection.test.ts": 47,
+      "src/shared/tui-agent-startup-copilot-resume.test.ts": 53,
+      "src/shared/tui-agent-startup-hermes.test.ts": 139,
+      "src/shared/tui-agent-startup-session-options.test.ts": 88,
+      "src/shared/tui-agent-startup-shell.test.ts": 108,
+      "src/shared/tui-agent-startup.test.ts": 119,
+      "src/shared/ui-language.test.ts": 36,
+      "src/shared/ui-locale.test.ts": 48,
+      "src/shared/ui-zoom-level.test.ts": 45,
+      "src/shared/updated-at-order.test.ts": 93,
+      "src/shared/updater-windows-signature-check.test.ts": 39,
+      "src/shared/usage-percentage-display-change-notice.test.ts": 94,
+      "src/shared/usage-percentage-display.test.ts": 40,
+      "src/shared/utf8-byte-limits.test.ts": 117,
+      "src/shared/uuid-v4.test.ts": 56,
+      "src/shared/vscode-remote-ssh-launcher.test.ts": 27,
+      "src/shared/window-shortcut-policy-agent-dashboard.test.ts": 48,
+      "src/shared/window-shortcut-policy.test.ts": 78,
+      "src/shared/windows-cmd-runner-delayed-launch.test.ts": 60,
+      "src/shared/windows-command-line-budget.test.ts": 1127,
+      "src/shared/windows-console-input.test.ts": 41,
+      "src/shared/windows-environment-expansion.test.ts": 132,
+      "src/shared/windows-interactive-login-spawn.test.ts": 42,
+      "src/shared/windows-lane-tree-removal-boundary.test.ts": 57,
+      "src/shared/windows-long-path-git-args.test.ts": 41,
+      "src/shared/windows-security-descriptor.test.ts": 33,
+      "src/shared/windows-terminal-shell.test.ts": 60,
+      "src/shared/windows-transient-lock-removal.test.ts": 1028,
+      "src/shared/worker-terminal-host-scope.test.ts": 65,
+      "src/shared/worker-transcript-background-task-text.test.ts": 56,
+      "src/shared/worker-transcript-text-scaling.test.ts": 46,
+      "src/shared/workspace-cleanup-applied-filters.test.ts": 60,
+      "src/shared/workspace-cleanup-browse-state-persistence.test.ts": 65,
+      "src/shared/workspace-cleanup-ui-state.test.ts": 39,
+      "src/shared/workspace-cleanup.test.ts": 40,
+      "src/shared/workspace-doc-history.test.ts": 59,
+      "src/shared/workspace-linked-item-equality.test.ts": 32,
+      "src/shared/workspace-linked-item-source-context.test.ts": 55,
+      "src/shared/workspace-name.test.ts": 55,
+      "src/shared/workspace-session-browser-history.test.ts": 173,
+      "src/shared/workspace-session-partition-owner.test.ts": 38,
+      "src/shared/workspace-session-salvage-equivalence.test.ts": 226,
+      "src/shared/workspace-session-salvage.test.ts": 1142,
+      "src/shared/workspace-session-schema-field-coverage.test.ts": 205,
+      "src/shared/workspace-session-schema.sleeping-agent.test.ts": 247,
+      "src/shared/workspace-session-schema.test.ts": 289,
+      "src/shared/workspace-session-tab-focus-schema.test.ts": 174,
+      "src/shared/workspace-session-terminal-buffers.test.ts": 276,
+      "src/shared/workspace-session-terminal-schema.test.ts": 155,
+      "src/shared/workspace-session-terminal-tab-close.test.ts": 242,
+      "src/shared/workspace-session-validation-work.test.ts": 279,
+      "src/shared/workspace-space-compaction.test.ts": 49,
+      "src/shared/workspace-space-entry-traversal.test.ts": 1467,
+      "src/shared/workspace-space-scan-budget.test.ts": 80,
+      "src/shared/workspace-statuses.test.ts": 70,
+      "src/shared/worktree-execution-host-resolution.test.ts": 48,
+      "src/shared/worktree-name-suggestion.test.ts": 39,
+      "src/shared/worktree-scan-failure.test.ts": 39,
+      "src/shared/worktree/archive-failure-blocking-capability.test.ts": 31,
+      "src/shared/worktree/base-ref.test.ts": 43,
+      "src/shared/worktree/card-properties.test.ts": 56,
+      "src/shared/worktree/catalog-version.test.ts": 29,
+      "src/shared/worktree/create-preparation.test.ts": 35,
+      "src/shared/worktree/github-pr-suppression.test.ts": 57,
+      "src/shared/worktree/host-context-labels.test.ts": 59,
+      "src/shared/worktree/host-qualified-identity.test.ts": 61,
+      "src/shared/worktree/id.test.ts": 58,
+      "src/shared/worktree/identity.test.ts": 38,
+      "src/shared/worktree/ownership-configured-base-visibility.test.ts": 77,
+      "src/shared/worktree/ownership-worktree-base-path.test.ts": 57,
+      "src/shared/worktree/ownership.test.ts": 264,
+      "src/shared/worktree/removal-fence-error.test.ts": 27,
+      "src/shared/worktree/removal-force-classification.test.ts": 30,
+      "src/shared/worktree/retired-name-cache.test.ts": 52,
+      "src/shared/worktree/retired-name-registry.test.ts": 289,
+      "src/shared/worktree/sort-order-update.test.ts": 43,
+      "src/shared/worktree/submodule-removal.test.ts": 48,
+      "src/shared/worktree/visibility-sources.test.ts": 87,
+      "src/shared/ws-outbound-backpressure-queue.test.ts": 67,
+      "src/shared/wsl-exec-mode-separator.test.ts": 1946,
+      "src/shared/wsl-login-shell-command.test.ts": 140,
+      "src/shared/wsl-paths.test.ts": 93,
+      "src/shared/zcode-missing-tui.test.ts": 43,
+      "src/shared/zcode-orchestration-contract.test.ts": 98,
+      "src/shared/zod-salvage-absence.test.ts": 106,
+      "tests/e2e/accumulated-workspace-state-builder.unit.test.ts": 88,
+      "tests/e2e/alternate-screen-fixture-script.unit.test.ts": 55,
+      "tests/e2e/codex-child-approval-activity-row.unit.test.ts": 4306,
+      "tests/e2e/completed-worker-retirement-resume.unit.test.ts": 5834,
+      "tests/e2e/daemon-running-work-probe.unit.test.ts": 311,
+      "tests/e2e/direct-ssh-snapshot-parking.unit.test.ts": 2238,
+      "tests/e2e/e2e-worker-env-isolation.unit.test.ts": 84,
+      "tests/e2e/folder-upgrade-identity-persistence.unit.test.ts": 1410,
+      "tests/e2e/github-work-item-search-burst.unit.test.ts": 1152,
+      "tests/e2e/global-teardown.unit.test.ts": 136,
+      "tests/e2e/helpers/alt-screen-frame.unit.test.ts": 110,
+      "tests/e2e/helpers/client-hosted-browser-fixture.unit.test.ts": 753,
+      "tests/e2e/helpers/electron-crashpad-cleanup.unit.test.ts": 50,
+      "tests/e2e/helpers/electron-home-isolation.unit.test.ts": 37,
+      "tests/e2e/helpers/electron-launch-args.unit.test.ts": 52,
+      "tests/e2e/helpers/electron-main-evaluate-retry.unit.test.ts": 2464,
+      "tests/e2e/helpers/electron-process-shutdown.unit.test.ts": 60,
+      "tests/e2e/helpers/fake-agent-command-override.unit.test.ts": 35,
+      "tests/e2e/helpers/fake-agent-paste-end-scanner.unit.test.ts": 79,
+      "tests/e2e/helpers/git-status-retry-barrier.unit.test.ts": 57,
+      "tests/e2e/helpers/golden-source-control.unit.test.ts": 640,
+      "tests/e2e/helpers/headless-paired-runtime-serve-readiness.unit.test.ts": 59,
+      "tests/e2e/helpers/nested-runtime-proxy-jump-fixture.unit.test.ts": 30,
+      "tests/e2e/helpers/paired-client-runtime-environment.unit.test.ts": 82,
+      "tests/e2e/helpers/paired-client-window-reveal.unit.test.ts": 67,
+      "tests/e2e/helpers/persisted-profile-state.unit.test.ts": 356,
+      "tests/e2e/helpers/remote-skill-cloud-fixture.unit.test.ts": 328,
+      "tests/e2e/helpers/remote-terminal-source-range-contract-fixture.unit.test.ts": 46,
+      "tests/e2e/helpers/ssh-port-forward-snapshot-barrier.unit.test.ts": 107,
+      "tests/e2e/helpers/streaming-terminal-cleanup.unit.test.ts": 51,
+      "tests/e2e/host-cold-park-remote-subscriber.unit.test.ts": 5055,
+      "tests/e2e/host-guest-paint-retention-remote-viewer.unit.test.ts": 3075,
+      "tests/e2e/omp-child-session-recovery.unit.test.ts": 1630,
+      "tests/e2e/omp-retired-host-renderer.unit.test.ts": 2215,
+      "tests/e2e/omp-risk-remote-review.unit.test.ts": 816,
+      "tests/e2e/orca-restart-navigation.unit.test.ts": 622,
+      "tests/e2e/orchestration-run-pagination.unit.test.ts": 52,
+      "tests/e2e/paced-terminal-typing.unit.test.ts": 656,
+      "tests/e2e/paired-runtime-rejected-input-remount.unit.test.ts": 2375,
+      "tests/e2e/remote-agent-completion-authority.unit.test.ts": 1540,
+      "tests/e2e/remote-terminal-tab-retirement.unit.test.ts": 4050,
+      "tests/e2e/restored-terminal-input-readiness.unit.test.ts": 57,
+      "tests/e2e/runtime-graph-publication-probe.unit.test.ts": 40,
+      "tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts": 3808,
+      "tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts": 775,
+      "tests/e2e/session-tabs-rich-status-boundaries.unit.test.ts": 1914,
+      "tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts": 287,
+      "tests/e2e/ssh-codex-replay-reply-probe.unit.test.ts": 53,
+      "tests/e2e/structured-agent-session-read-owner.unit.test.ts": 739,
+      "tests/e2e/structured-chat-owner-status-activation.unit.test.ts": 1707,
+      "tests/e2e/structured-native-chat-routing-authority.unit.test.ts": 214,
+      "tests/e2e/sustained-agent-typing-load-scripts.unit.test.ts": 2194,
+      "tests/e2e/terminal-binding-crash-hydration.unit.test.ts": 920,
+      "tests/e2e/terminal-foreground-confirmation.unit.test.ts": 196,
+      "tests/e2e/terminal-perf-presentation.unit.test.ts": 44,
+      "tests/e2e/terminal-probe-input-sequence.unit.test.ts": 53,
+      "tests/e2e/terminal-split-activation-latency-artifact.unit.test.ts": 53,
+      "tests/e2e/terminal-split-activation-latency-report.unit.test.ts": 68,
+      "tests/tools/omp-close-lifecycle.test.mjs": 255,
+      "tests/tools/omp-config-root-local-shell.test.mjs": 196,
+      "tests/tools/omp-config-root-relay-shell.test.mjs": 169,
+      "tests/tools/omp-relay-close-lifecycle.test.mjs": 329,
+      "tests/tools/relay-bench/phone-e2ee-desktop-parity.test.mjs": 126,
+      "tests/tools/relay-bench/region-probe-replay.test.mjs": 134,
+      "tests/tools/relay-bench/relay-bench-invocation.test.mjs": 94,
+      "tests/tools/relay-bench/relay-bench-state-file.test.mjs": 52,
+      "tests/tools/relay-bench/relay-phone-connect-bench.test.mjs": 134,
+      "tests/tools/win-update-e2e/app-driver.test.mjs": 671,
+      "tests/tools/win-update-e2e/app-shutdown.test.mjs": 656,
+      "tests/tools/windows-pty-native-capability-smoke/packaged-node-pty-capability-oracle.test.mjs": 46,
+      "tests/tools/windows-pty-native-capability-smoke/packaged-node-pty-capability-probe.test.mjs": 89,
+      "tests/tools/windows-pty-native-capability-smoke/run.test.mjs": 32
     }
   },
   "e2e": {
diff --git a/config/scripts/ci-shard-timings.md b/config/scripts/ci-shard-timings.md
index f6e846cfd6d..db79660a183 100644
--- a/config/scripts/ci-shard-timings.md
+++ b/config/scripts/ci-shard-timings.md
@@ -4,8 +4,9 @@ The eight unit shards and fourteen general E2E shards use longest-processing-tim
 assignment of whole files to the currently lightest shard. Ties use file path and
 then shard index, independent of filesystem enumeration and locale. Unknown,
 zero, or invalid durations use the baseline's positive median (1 second when no
-positive evidence exists). Deleted files never enter discovery. Unit weights add
-526ms per file for measured transform/setup/import/environment overhead.
+positive evidence exists). Deleted files never enter discovery. Unit weights
+include measured environment startup, preparation, setup, imports and test execution;
+no uniform overhead is added.
 
 Unit assignment runs inside Vitest's sequencer after discovery and CLI exclusions;
 Vitest's default sort, workers and isolation remain intact. It is enabled only by
@@ -17,9 +18,10 @@ Dedicated SSH, native IME, WSL and first-paint lanes are unchanged.
 
 ## Evidence and limits
 
-`ci-shard-timings.json` records run IDs and every contributing job ID:
+`ci-shard-timings.json` records source runs. Unit report provenance and contributing
+job IDs for the current refresh appear below; E2E job IDs remain in the JSON.
 
-- Unit run **34675583768**, Node 24, all eight successful shards: 8,484 completed
+- Original unit run **34675583768**, Node 24, all eight successful shards: 8,484 completed
   file durations. The summed transform/setup/import/environment durations divided
   by measured file count give a rounded-up **526ms** per-file overhead allowance.
   The original shard weighted loads were **764–849 worker-seconds**, versus
@@ -30,20 +32,88 @@ Dedicated SSH, native IME, WSL and first-paint lanes are unchanged.
   counted. Original completed test loads were **540–1,727 seconds**, versus
   **1,083–1,093** after whole-file balancing on the same measured files. The longest
   measured file is **528 seconds**, below the balanced shard load.
-- Current checkout discovery at validation contained **8,553 unit files** after the
+- Original checkout discovery at validation contained **8,553 unit files** after the
   workflow's exact exclusions and **733 headless E2E tests in 340 files**. New and
   unmeasured files remain selected. Projected current loads were about **797
   worker-seconds** per unit shard (1,068–1,070 files) and **1,190–1,200 seconds** per
   E2E shard (22–25 files).
 
 These are scheduling projections, not measured post-change wall-clock gains.
-Unit durations overlap across workers and the overhead allowance is an average,
-not a per-file import profile. E2E evidence includes failed shards and can omit
+Unit durations overlap across workers. The original average overhead has now been
+replaced by per-file module measurements. E2E evidence includes failed shards and can omit
 unfinished tests; unknowns receive a deterministic estimate. Historical timings
 age as specs change. Full CI runs on the existing runner classes are required to
 measure elapsed-time and occupancy improvements, including discovery overhead.
 No retries, assertions, coverage exclusions, runner classes or shard counts changed.
 
+## Current unit refresh: September 27, 2026
+
+The baseline imports every successful Node 24 shard from
+[run 36294142683, attempt 1](https://github.com/stablyai/orca/actions/runs/36294142683/attempts/1).
+The recorded checkout was `cc35c1b422e9c20197bc59aa27a71019ffc18b5b`, with Node
+24.21.0 and unchanged Linux workers. All 9,847 report entries match their saved
+assignments and current discovery exactly once, with no unhandled errors. The old
+baseline lacked 165 files and retained one deleted path. The E2E weights are unchanged.
+
+Using these measurements for both assignments, the maximum projected load falls
+from 1,043.811 to 919.695 worker-seconds (11.9%); each shard selects 1,230–1,231 files.
+Observed source-run test steps ranged from 282 to 429 seconds. The fastest runner's
+common-file durations were broadly lower than its prior measurements, so runner
+variation may contribute to that spread. The projection does not establish a
+hosted wall-clock improvement. No worker, shard-count, or algorithm change is made.
+
+## Previous unit refresh: September 26, 2026
+
+The previous baseline imported all eight successful unit shards from
+[run 36221874572, attempt 1](https://github.com/stablyai/orca/actions/runs/36221874572/attempts/1).
+They ran Node **24.21.0** on `ubuntu-latest` with Vitest's default Linux worker
+count and isolation. The checked-out merge was
+`f68ecf8c4aeb396795a8f0f9dbd8ef58fd634d43`, whose second parent is the run's PR
+head `5a26cfa83d7542f9f4545b7a7c4c4174ff213b18`. The workflow failed in another
+lane; every contributing unit job and test step succeeded. No failed reports or
+four-worker trial measurements contributed.
+
+| Shard | Job ID       | Completed files | Measured worker-seconds | Test step seconds | Job seconds |
+| ----- | ------------ | --------------- | ----------------------- | ----------------- | ----------- |
+| 1     | 108348885240 | 1,209           | 1,019.941               | 420               | 446         |
+| 2     | 108348885231 | 1,210           | 1,000.547               | 413               | 447         |
+| 3     | 108348885289 | 1,211           | 933.332                 | 386               | 419         |
+| 4     | 108348885241 | 1,211           | 1,022.838               | 418               | 453         |
+| 5     | 108348885283 | 1,211           | 1,016.000               | 417               | 448         |
+| 6     | 108348885237 | 1,211           | 980.988                 | 407               | 440         |
+| 7     | 108348885275 | 1,210           | 810.367                 | 326               | 355         |
+| 8     | 108348885261 | 1,210           | 973.722                 | 407               | 445         |
+
+All reports have `status: passed`, zero unhandled errors and identical source,
+run, attempt, Node version and shard count. Each report's file keys exactly match
+its selected assignment; all eight assignments describe the same plan, with no
+missing or duplicate files across **9,683** measurements. Replaying the old
+baseline reproduces that complete plan. Its SHA-256 is
+`9042d8f1d2420b301ee5d9e56d768ad7d38530897dce0d641f362333aa194ad8`.
+The importer sets overhead to zero; the E2E baseline is unchanged.
+
+Discovery at checkout `80ff6c4e3e66de46e41c75856fd1fb6d77d515de`, using the unit
+workflow's exact exclusions, contains **9,732 files**. All 9,683 measurements
+still apply; the **49** unmeasured files receive the new **230ms** median. Both
+plans select every current file exactly once. To compare assignments fairly,
+the following loads evaluate both plans using the same new measurements and
+fallback, rather than comparing two different timing metrics:
+
+| Current discovery projection | Previous assignment | Refreshed assignment  |
+| ---------------------------- | ------------------- | --------------------- |
+| Files per shard              | 1,216–1,217         | 1,215–1,217           |
+| Worker-seconds per shard     | 816.045–1,049.604   | 971.124–971.126       |
+| Largest load                 | 1,049.604           | 971.126 (7.48% lower) |
+
+The combined projected work is unchanged at **7,769.005 worker-seconds**.
+Reassignment redistributes measured work; it does not itself reduce test work.
+These are projections from one successful unit run, not a measured wall-clock
+improvement. The source test steps took **326–420 seconds**, totaling **3,194
+seconds (53.233 runner-minutes)**. Full unit jobs took **355–453 seconds**, totaling
+**3,453 seconds (57.550 runner-minutes)**. These durations exclude queue time;
+hosted before/after runs are needed to measure the refreshed assignment's elapsed
+time and occupancy.
+
 ## Reproduction and refresh
 
 Every shard uploads an artifact named with its shard, Node version where relevant,
@@ -53,13 +123,38 @@ E2E also retains both discovery reports and `selected.txt`. Artifacts live for
 14 days. A rerun of the same source uses the same checked-in baseline rather than
 mutable timing caches; a GitHub job rerun therefore keeps its assignment.
 
+Unit artifacts also contain `unit-timings.json`, measured through Vitest's reporter
+API. Each file's weight includes environment startup, test harness preparation,
+setup files, imports and test execution. Imports are often more expensive than the
+assertions: run **36212793136**, shard 4, spent **535 worker-seconds importing**
+and **357 running tests**. The refreshed baseline replaces the old uniform import
+allowance with the complete successful measurements described above.
+
 For E2E reproduction, check out the recorded source and pass the saved list to the
 existing command: `pnpm run test:e2e --test-list=/path/to/selected.txt` with the same
 CI environment/build inputs. For unit reproduction, use the unchanged workflow
 command and exclusions with `ORCA_BALANCE_UNIT_SHARDS=1` and the recorded
 `--shard=INDEX/8`. Direct test-file reruns remain supported.
 
-To refresh the baseline, download `log-JOB_ID.txt` files into one directory from
+To refresh unit weights, download all `unit-shard-node-*` artifacts from one
+complete successful unit shard set, run attempt and Node version into a directory,
+preserving their shard subdirectories. An unrelated workflow lane may fail;
+every contributing unit job and report must pass. Check the attempt-specific jobs
+API, source workflow/config, report provenance and exact file coverage against the
+saved assignments, then run:
+
+```sh
+node config/scripts/ci-unit-timing-import.mjs ARTIFACT_DIRECTORY config/scripts/ci-shard-timings.json
+```
+
+The importer rejects missing or duplicate shards, duplicate files, failed unit reports,
+unhandled errors and mixed source revisions, run attempts or Node versions. It
+preserves E2E weights and sets unit overhead to zero because the per-file measurements
+already include it. Timing artifacts remain diagnostic; failed or interrupted unit runs
+are retained for investigation but cannot replace the scheduling baseline.
+
+For older unit runs without reporter artifacts, and E2E refreshes, download
+`log-JOB_ID.txt` files into one directory from
 exactly one eight-shard unit run and one fourteen-shard general E2E run. Use the
 job IDs from the Actions jobs API and fetch each with
 `gh api repos/stablyai/orca/actions/jobs/JOB_ID/logs`. Do not include dedicated
@@ -71,7 +166,7 @@ node config/scripts/ci-shard-timing-import.mjs LOG_DIRECTORY UNIT_RUN_ID E2E_RUN
 
 The initial source logs are in `/tmp/orca-ci-shard-logs`; two were reused from
 `/tmp/orca-ci-audit`, and the remaining twenty were fetched read-only. Reimporting
-those logs reproduced the checked-in JSON byte-for-byte. Review file-count and
+those logs reproduced the original baseline byte-for-byte. Review file-count and
 load projections before adopting a new baseline; no network access is needed to
 plan or run shards.
 
@@ -88,6 +183,11 @@ plan or run shards.
   Vitest shard executed successfully and persisted its manifest.
 - Focused TypeScript checking of `config/vitest.config.ts` and imported modules,
   oxlint, formatting and baseline reimport checks passed.
+- The September 26 refresh matched all eight reports to their saved assignments,
+  checked successful attempt-specific job results and source worker settings,
+  reproduced the old assignment, and preserved the E2E baseline exactly. All 12
+  importer/reporter and shard-assignment tests passed; importing the artifacts
+  reproduced the refreshed JSON byte-for-byte.
 
 All local tests used `ORCA_BACKGROUND_LAUNCH=1` in background tool sessions. No app
 windows or full E2E test bodies were launched.
diff --git a/config/scripts/ci-unit-dependency-graph.mjs b/config/scripts/ci-unit-dependency-graph.mjs
new file mode 100644
index 00000000000..f491c1749de
--- /dev/null
+++ b/config/scripts/ci-unit-dependency-graph.mjs
@@ -0,0 +1,84 @@
+import { globSync, readFileSync } from 'node:fs'
+import { posix, join } from 'node:path'
+import ts from 'typescript-api'
+
+const EXTENSIONS = [
+  '',
+  '.ts',
+  '.tsx',
+  '.mjs',
+  '.js',
+  '.cjs',
+  '.json',
+  '/index.ts',
+  '/index.tsx',
+  '/index.js'
+]
+const INDIRECT_INPUT =
+  /\b(?:readFile\w*|readdir\w*|glob\w*|spawn\w*|execFile\w*|execSync|runProcess\w*|fork|Worker)\b|\bimport\s*\(\s*[^'"\s]|\brequire\s*\(\s*[^'"\s]|\bnew\s+URL\s*\(/
+
+function localPath(file, specifier) {
+  if (specifier.startsWith('.')) {
+    return posix.join(posix.dirname(file), specifier)
+  }
+  if (specifier.startsWith('@renderer/')) {
+    return `src/renderer/src/${specifier.slice(10)}`
+  }
+  if (specifier.startsWith('@/')) {
+    return `src/renderer/src/${specifier.slice(2)}`
+  }
+  return null
+}
+
+export function buildUnitDependencyGraph(sources) {
+  const reverse = new Map()
+  const opaque = new Set()
+  for (const [file, source] of sources) {
+    if (INDIRECT_INPUT.test(source) || file.startsWith('config/') || file.startsWith('tests/')) {
+      opaque.add(file)
+    }
+    for (const imported of ts.preProcessFile(source, true, true).importedFiles) {
+      const path = localPath(file, imported.fileName)
+      if (path === null) {
+        continue
+      }
+      const resolved = EXTENSIONS.map((extension) => path + extension).find((candidate) =>
+        sources.has(candidate)
+      )
+      if (!resolved) {
+        opaque.add(file)
+        continue
+      }
+      if (!reverse.has(resolved)) {
+        reverse.set(resolved, new Set())
+      }
+      reverse.get(resolved).add(file)
+    }
+  }
+  return { reverse, opaque }
+}
+
+export function collectUnitDependencyGraph(root = process.cwd()) {
+  const files = globSync(
+    [
+      'src/**/*.{ts,tsx,js,mjs,cjs,json}',
+      'config/**/*.{ts,tsx,js,mjs,cjs,json}',
+      'tests/**/*.{ts,tsx,js,mjs,cjs,json}'
+    ],
+    { cwd: root }
+  )
+  const sources = new Map(
+    files.map((file) => [file.replaceAll('\\', '/'), readFileSync(join(root, file), 'utf8')])
+  )
+  return { ...buildUnitDependencyGraph(sources), files: new Set(sources.keys()) }
+}
+
+export function unitConsumers(seeds, reverse) {
+  const result = new Set(seeds)
+  for (const file of result) {
+    for (const consumer of reverse.get(file) ?? []) {
+      result.add(consumer)
+    }
+  }
+  return result
+}
diff --git a/config/scripts/ci-unit-files.mjs b/config/scripts/ci-unit-files.mjs
new file mode 100644
index 00000000000..ab8d5038aed
--- /dev/null
+++ b/config/scripts/ci-unit-files.mjs
@@ -0,0 +1,42 @@
+import { globSync } from 'node:fs'
+import { defaultExclude } from 'vitest/config'
+
+export const UNIT_INCLUDE = [
+  'src/**/*.test.ts',
+  'src/**/*.test.tsx',
+  'config/scripts/**/*.test.ts',
+  'config/scripts/**/*.test.mjs',
+  'tests/tools/**/*.test.mjs',
+  'tests/e2e/**/*.unit.test.ts'
+]
+
+export const UNIT_EXCLUDE = [
+  ...defaultExclude,
+  'src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts',
+  'src/main/daemon/shell-ready.test.ts',
+  'src/main/daemon/node-pty-fd-leak.test.ts',
+  'src/main/providers/local-pty-shell-ready-zsh-launch-environment.test.ts',
+  'src/main/providers/__tests__/shell-ready-framework-example.test.ts',
+  'src/main/pty/omp-shell-wrapper-alias-safety.test.ts',
+  'src/main/pty/omp-shell-wrapper.node-pty.test.ts',
+  'src/main/shell-startup-feature-channel.test.ts',
+  'src/main/terminal-history-fish-session.node-pty.test.ts',
+  'src/main/zsh-scoped-histfile.live-shell.test.ts',
+  'src/main/zsh-startup-hook-user-config-equivalence.live-shell.test.ts',
+  'src/main/zsh-wrapper-version-mismatch.live-shell.test.ts',
+  'src/main/runtime/structured-session-cli-login-shell.live-shell.test.ts',
+  'src/renderer/src/components/terminal-pane/fish-color-scheme-child-stdin.node-pty.test.ts',
+  'src/shared/fish-query-reply-child-stdin.node-pty.test.ts',
+  'src/shared/pty-reply-echo-shapes.node-pty.test.ts',
+  'src/shared/startup-shell-portability.live-shell.test.ts',
+  'src/shared/posix-command-path-lookup.test.ts',
+  'tests/e2e/relay-region-compatibility.unit.test.ts',
+  'tests/e2e/relay-region-correction.unit.test.ts',
+  'tests/e2e/cross-version-wire/**'
+]
+
+export function discoverUnitFiles(root = process.cwd()) {
+  return globSync(UNIT_INCLUDE, { cwd: root, exclude: UNIT_EXCLUDE })
+    .map((file) => file.replaceAll('\\', '/'))
+    .sort()
+}
diff --git a/config/scripts/ci-unit-plan.mjs b/config/scripts/ci-unit-plan.mjs
new file mode 100644
index 00000000000..db7a13070d0
--- /dev/null
+++ b/config/scripts/ci-unit-plan.mjs
@@ -0,0 +1,63 @@
+import { appendFileSync, readFileSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
+import { runProcessSync } from './script-child-process.mjs'
+import { collectUnitDependencyGraph } from './ci-unit-dependency-graph.mjs'
+import { discoverUnitFiles } from './ci-unit-files.mjs'
+import { FULL_SHARD_COUNT, planUnitSelection } from './ci-unit-selection.mjs'
+import { readTimingBaseline, writeAssignment } from './ci-shard-assignment.mjs'
+
+export function prepareUnitPlan(env = process.env) {
+  const files = discoverUnitFiles()
+  let plan
+  try {
+    const event = JSON.parse(readFileSync(env.GITHUB_EVENT_PATH, 'utf8'))
+    if (env.GITHUB_EVENT_NAME !== 'pull_request') {
+      throw new Error('Full reference run')
+    }
+    const diff = runProcessSync({
+      program: 'git',
+      args: ['diff', '--name-only', '--no-renames', '-z', 'HEAD^1', 'HEAD'],
+      maxOutputBytes: 16 * 1024 * 1024
+    })
+    if (diff.code !== 0 || diff.timedOut) {
+      throw new Error('Changed paths unavailable')
+    }
+    plan = planUnitSelection({
+      files,
+      changed: diff.stdout.split('\0').filter(Boolean),
+      graph: collectUnitDependencyGraph(),
+      timings: readTimingBaseline('unit').timings,
+      event,
+      mode: env.ORCA_UNIT_SELECTION_MODE
+    })
+  } catch (error) {
+    plan = {
+      version: 1,
+      mode: 'shadow',
+      selectionAvailable: false,
+      reason: String(error),
+      files,
+      candidateFiles: files,
+      executionFiles: files,
+      shards: Array.from({ length: FULL_SHARD_COUNT }, (_, index) => ({
+        index: index + 1,
+        count: FULL_SHARD_COUNT
+      }))
+    }
+  }
+  writeAssignment('ci-shards/unit-selection.json', plan)
+  if (env.GITHUB_OUTPUT) {
+    appendFileSync(env.GITHUB_OUTPUT, `shards=${JSON.stringify(plan.shards)}\n`)
+  }
+  if (env.GITHUB_STEP_SUMMARY) {
+    appendFileSync(
+      env.GITHUB_STEP_SUMMARY,
+      `Unit selection: **${plan.mode}**; ${plan.candidateFiles.length}/${files.length} candidate files; ${plan.shards.length} execution shards. ${plan.reason}\n`
+    )
+  }
+  return plan
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  prepareUnitPlan()
+}
diff --git a/config/scripts/ci-unit-plan.test.mjs b/config/scripts/ci-unit-plan.test.mjs
new file mode 100644
index 00000000000..eda7903ae1d
--- /dev/null
+++ b/config/scripts/ci-unit-plan.test.mjs
@@ -0,0 +1,79 @@
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { expect, it } from 'vitest'
+import { runProcessSync } from './script-child-process.mjs'
+import { FULL_SHARD_COUNT } from './ci-unit-selection.mjs'
+
+it.each([true, false])(
+  'plans from a real Git diff, with parent evidence available: %s',
+  (withParent) => {
+    const root = mkdtempSync(join(tmpdir(), 'orca-unit-plan-'))
+    const git = (args) => {
+      const result = runProcessSync({ program: 'git', args, cwd: root })
+      expect(result.code, result.stderr).toBe(0)
+      return result.stdout.trim()
+    }
+    try {
+      mkdirSync(join(root, 'src'))
+      writeFileSync(join(root, 'src/value.ts'), 'export const value = 1')
+      writeFileSync(join(root, 'src/consumer.test.ts'), "import './value'")
+      writeFileSync(join(root, 'src/unrelated.test.ts'), 'export const unrelated = true')
+      git(['init', '--quiet'])
+      git(['add', 'src'])
+      const commit = [
+        '-c',
+        'user.name=CI Test',
+        '-c',
+        'user.email=ci-test@example.invalid',
+        '-c',
+        'commit.gpgsign=false',
+        'commit',
+        '--quiet',
+        '-m',
+        'fixture'
+      ]
+      git(commit)
+      if (withParent) {
+        writeFileSync(join(root, 'src/value.ts'), 'export const value = 2')
+        git(['add', 'src'])
+        git(commit)
+      }
+      const sourceSha = git(['rev-parse', 'HEAD'])
+      const eventPath = join(root, 'event.json')
+      writeFileSync(eventPath, JSON.stringify({ pull_request: { draft: true } }))
+      const result = runProcessSync({
+        program: process.execPath,
+        args: [fileURLToPath(new URL('./ci-unit-plan.mjs', import.meta.url))],
+        cwd: root,
+        env: {
+          ...process.env,
+          ORCA_BACKGROUND_LAUNCH: '1',
+          ORCA_UNIT_SELECTION_MODE: 'selected',
+          GITHUB_EVENT_NAME: 'pull_request',
+          GITHUB_EVENT_PATH: eventPath,
+          GITHUB_SHA: sourceSha,
+          ORCA_SHARD_SOURCE_SHA: sourceSha,
+          GITHUB_OUTPUT: join(root, 'outputs'),
+          GITHUB_STEP_SUMMARY: join(root, 'summary')
+        }
+      })
+      expect(result.code, result.stderr).toBe(0)
+      const plan = JSON.parse(readFileSync(join(root, 'ci-shards/unit-selection.json'), 'utf8'))
+      expect(plan.sourceSha).toBe(sourceSha)
+      expect(plan.mode).toBe(withParent ? 'selected' : 'shadow')
+      expect(plan.executionFiles).toEqual(
+        withParent ? ['src/consumer.test.ts'] : ['src/consumer.test.ts', 'src/unrelated.test.ts']
+      )
+      expect(plan.reason).toBe(
+        withParent
+          ? 'Transitive imports plus indirect-input consumers'
+          : 'Error: Changed paths unavailable'
+      )
+      expect(plan.shards).toHaveLength(withParent ? 1 : FULL_SHARD_COUNT)
+    } finally {
+      rmSync(root, { recursive: true, force: true })
+    }
+  }
+)
diff --git a/config/scripts/ci-unit-selection-review.mjs b/config/scripts/ci-unit-selection-review.mjs
new file mode 100644
index 00000000000..ae976a06428
--- /dev/null
+++ b/config/scripts/ci-unit-selection-review.mjs
@@ -0,0 +1,113 @@
+import { appendFileSync, globSync, readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+
+export function reviewUnitSelection(records) {
+  const groups = new Map()
+  for (const { plan, timing } of records) {
+    const key = JSON.stringify([
+      timing.sourceSha,
+      timing.runId,
+      timing.runAttempt,
+      timing.nodeVersion
+    ])
+    if (!groups.has(key)) {
+      groups.set(key, [])
+    }
+    groups.get(key).push({ plan, timing })
+  }
+  return [...groups.values()].map((group) => {
+    const { plan, timing: first } = group[0]
+    const selected = new Set(plan.candidateFiles)
+    const files = new Set()
+    const shards = new Set()
+    const missedFailures = []
+    let invalid = false
+    let omittedMs = 0
+    let totalMs = 0
+    for (const { plan: other, timing } of group) {
+      invalid ||=
+        JSON.stringify(other) !== JSON.stringify(plan) ||
+        !first.sourceSha ||
+        plan.sourceSha !== first.sourceSha ||
+        timing.unhandledErrors !== 0 ||
+        !['passed', 'failed'].includes(timing.status) ||
+        timing.shard.count !== first.shard.count ||
+        shards.has(timing.shard.index) ||
+        timing.shard.index < 1 ||
+        timing.shard.index > first.shard.count
+      shards.add(timing.shard.index)
+      for (const [file, duration] of Object.entries(timing.timings)) {
+        invalid ||=
+          files.has(file) ||
+          !Number.isFinite(duration) ||
+          duration <= 0 ||
+          !['passed', 'failed', 'skipped'].includes(timing.results?.[file])
+        files.add(file)
+        totalMs += duration
+        if (!selected.has(file)) {
+          omittedMs += duration
+          if (timing.results?.[file] === 'failed') {
+            missedFailures.push(file)
+          }
+        }
+      }
+    }
+    const complete =
+      !invalid &&
+      shards.size === first.shard.count &&
+      JSON.stringify([...files].sort()) === JSON.stringify([...plan.files].sort())
+    return {
+      sourceSha: first.sourceSha,
+      runId: first.runId,
+      runAttempt: first.runAttempt,
+      nodeVersion: first.nodeVersion,
+      mode: plan.mode,
+      completeFullRun: complete && plan.mode === 'shadow',
+      selectionEvaluated: complete && plan.mode === 'shadow' && plan.selectionAvailable === true,
+      reason: plan.reason,
+      missedFailures,
+      files: files.size,
+      candidateFiles: selected.size,
+      measuredWorkerMs: totalMs,
+      potentiallyOmittedWorkerMs: omittedMs
+    }
+  })
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const directory = process.argv[2]
+  if (!directory) {
+    throw new Error('Usage: ci-unit-selection-review.mjs ARTIFACT_DIRECTORY')
+  }
+  const records = globSync('**/unit-timings.json', { cwd: directory }).map((file) => {
+    const timing = JSON.parse(readFileSync(join(directory, file), 'utf8'))
+    const plan = JSON.parse(
+      readFileSync(
+        join(directory, file.replace('unit-timings.json', 'unit-selection.json')),
+        'utf8'
+      )
+    )
+    return { timing, plan }
+  })
+  if (!records.length) {
+    throw new Error('No unit selection evidence')
+  }
+  const review = reviewUnitSelection(records)
+  writeFileSync(join(directory, 'selection-review.json'), `${JSON.stringify(review, null, 2)}\n`)
+  const summary = [
+    '## Unit selection evidence',
+    '',
+    ...review.map(
+      (row) =>
+        `- Node ${row.nodeVersion}: ${row.completeFullRun ? 'complete full reference' : 'incomplete or selected evidence'}; ${row.selectionEvaluated ? 'selection evaluated' : 'not selection-validation evidence'}; ${row.candidateFiles}/${row.files} candidate files; ${row.missedFailures.length} failures outside selection; ${(row.potentiallyOmittedWorkerMs / 60_000).toFixed(1)} potentially omitted worker-minutes. ${row.reason ?? ''}`
+    ),
+    '',
+    'Worker time overlaps across processes; it is not runner time. Promote only after representative complete references show no missed failures.',
+    ''
+  ].join('\n')
+  if (process.env.GITHUB_STEP_SUMMARY) {
+    appendFileSync(process.env.GITHUB_STEP_SUMMARY, summary)
+  }
+  console.log(summary)
+}
diff --git a/config/scripts/ci-unit-selection-review.test.mjs b/config/scripts/ci-unit-selection-review.test.mjs
new file mode 100644
index 00000000000..ff8f4c38568
--- /dev/null
+++ b/config/scripts/ci-unit-selection-review.test.mjs
@@ -0,0 +1,55 @@
+import { expect, it } from 'vitest'
+import { reviewUnitSelection } from './ci-unit-selection-review.mjs'
+
+const plan = {
+  sourceSha: 'sha',
+  mode: 'shadow',
+  selectionAvailable: true,
+  files: ['a', 'b'],
+  candidateFiles: ['a']
+}
+
+it('does not present full fallback runs as selection-validation evidence', () => {
+  const records = [record(1, 'a', 'passed'), record(2, 'b', 'passed')].map((row) => ({
+    ...row,
+    plan: { ...plan, selectionAvailable: false }
+  }))
+  expect(reviewUnitSelection(records)[0]).toMatchObject({
+    completeFullRun: true,
+    selectionEvaluated: false
+  })
+})
+const record = (index, file, state) => ({
+  plan,
+  timing: {
+    sourceSha: 'sha',
+    runId: '1',
+    runAttempt: '1',
+    nodeVersion: '24',
+    status: state,
+    unhandledErrors: 0,
+    shard: { index, count: 2 },
+    timings: { [file]: 100 },
+    results: { [file]: state }
+  }
+})
+
+it('finds omitted failures in a complete failing reference run', () => {
+  expect(
+    reviewUnitSelection([record(1, 'a', 'passed'), record(2, 'b', 'failed')])[0]
+  ).toMatchObject({ completeFullRun: true, missedFailures: ['b'], potentiallyOmittedWorkerMs: 100 })
+})
+
+it('does not call incomplete, duplicate, interrupted or selected evidence a full reference', () => {
+  const a = record(1, 'a', 'passed'),
+    b = record(2, 'b', 'passed')
+  for (const rows of [
+    [a],
+    [a, a],
+    [a, { ...b, timing: { ...b.timing, unhandledErrors: 1 } }],
+    [a, { ...b, timing: { ...b.timing, status: 'interrupted' } }],
+    [a, b].map((row) => ({ ...row, plan: { ...plan, mode: 'selected' } }))
+  ]) {
+    expect(reviewUnitSelection(rows).every((row) => !row.completeFullRun)).toBe(true)
+  }
+})
diff --git a/config/scripts/ci-unit-selection.mjs b/config/scripts/ci-unit-selection.mjs
new file mode 100644
index 00000000000..841bad422e7
--- /dev/null
+++ b/config/scripts/ci-unit-selection.mjs
@@ -0,0 +1,68 @@
+import { unitConsumers } from './ci-unit-dependency-graph.mjs'
+import { balanceFiles } from './ci-shard-assignment.mjs'
+
+export function selectUnitFiles(files, changed, graph) {
+  const full = (reason) => ({ files, reason, full: true })
+  if (!changed.length) {
+    return full('Missing changed-path evidence')
+  }
+  if (changed.some((file) => !file.startsWith('src/') || !graph.files.has(file))) {
+    return full('Global, deleted, renamed or unknown input')
+  }
+  for (const file of changed) {
+    const consumers = unitConsumers([file], graph.reverse)
+    if (!files.some((test) => consumers.has(test))) {
+      return full('No proven test coverage for changed inputs')
+    }
+  }
+  const affected = unitConsumers([...changed, ...graph.opaque], graph.reverse)
+  const selected = files.filter((file) => affected.has(file))
+  if (!selected.length) {
+    return full('No proven test coverage for changed inputs')
+  }
+  return {
+    files: selected,
+    reason: 'Transitive imports plus indirect-input consumers',
+    full: false
+  }
+}
+
+// A concurrency slot is charged per job, not per core, so eight 6.5-minute shards cost eight of
+// the account's slots and made the unit matrix 68% of daily slot demand. Against the checked-in
+// baseline, five shards each carry 24.7 test-minutes over four workers plus ~2.6 minutes of fixed
+// setup, so ~8.8 minutes -- less than the 10.5-minute p95 queue the oversharding was causing.
+export const FULL_SHARD_COUNT = 5
+
+export function planUnitSelection({ files, changed, graph, timings, event, mode = 'shadow' }) {
+  const candidate = selectUnitFiles(files, changed, graph)
+  const selected = mode === 'selected' && event?.pull_request?.draft === true && !candidate.full
+  const executionFiles = selected ? candidate.files : files
+  const totalMs = balanceFiles(executionFiles, 1, timings).shards[0].durationMs
+  const count = selected
+    ? Math.max(1, Math.min(FULL_SHARD_COUNT, Math.ceil(totalMs / 900_000), executionFiles.length))
+    : FULL_SHARD_COUNT
+  return {
+    version: 1,
+    mode: selected ? 'selected' : 'shadow',
+    selectionAvailable: !candidate.full,
+    reason: candidate.reason,
+    files,
+    candidateFiles: candidate.files,
+    executionFiles,
+    shards: Array.from({ length: count }, (_, index) => ({ index: index + 1, count }))
+  }
+}
+
+export function auditUnitSelection(plan, results) {
+  const candidates = new Set(plan.candidateFiles)
+  const omittedFailures = Object.entries(results)
+    .filter(([file, state]) => state === 'failed' && !candidates.has(file))
+    .map(([file]) => file)
+  return {
+    mode: plan.mode,
+    discovered: plan.files.length,
+    candidate: candidates.size,
+    executed: Object.keys(results).length,
+    omittedFailures
+  }
+}
diff --git a/config/scripts/ci-unit-selection.test.mjs b/config/scripts/ci-unit-selection.test.mjs
new file mode 100644
index 00000000000..69370a675f6
--- /dev/null
+++ b/config/scripts/ci-unit-selection.test.mjs
@@ -0,0 +1,108 @@
+import { describe, expect, it } from 'vitest'
+import { buildUnitDependencyGraph } from './ci-unit-dependency-graph.mjs'
+import {
+  FULL_SHARD_COUNT,
+  auditUnitSelection,
+  planUnitSelection,
+  selectUnitFiles
+} from './ci-unit-selection.mjs'
+
+const sources = new Map(
+  Object.entries({
+    'src/leaf.ts': 'export const value = 1',
+    'src/forward.ts': `export * from './leaf'`,
+    'src/consumer.test.ts': `import './forward'`,
+    'src/dynamic.test.ts': `import('./leaf')`,
+    'src/require.test.ts': `require('./leaf')`,
+    'src/scan.test.ts': `import { readFileSync } from 'node:fs'; readFileSync('src/leaf.ts')`,
+    'src/indirect.ts': `import(pathFromSettings)`,
+    'src/indirect.test.ts': `import './indirect'`,
+    'src/unrelated.test.ts': 'export const test = 1',
+    'src/renderer/src/view.tsx': 'export const value = 1',
+    'src/view.test.ts': `import '@renderer/view'; import '@/view'`
+  })
+)
+const graph = { ...buildUnitDependencyGraph(sources), files: new Set(sources.keys()) }
+const files = [...sources.keys()].filter((file) => file.endsWith('.test.ts')).sort()
+
+describe('conservative unit selection', () => {
+  it('follows re-exports, literal dynamic imports and requires, retaining indirect readers', () => {
+    expect(selectUnitFiles(files, ['src/leaf.ts'], graph).files).toEqual([
+      'src/consumer.test.ts',
+      'src/dynamic.test.ts',
+      'src/indirect.test.ts',
+      'src/require.test.ts',
+      'src/scan.test.ts'
+    ])
+  })
+
+  it('resolves renderer aliases and changed tests without executing their source', () => {
+    expect(selectUnitFiles(files, ['src/renderer/src/view.tsx'], graph).files).toContain(
+      'src/view.test.ts'
+    )
+    expect(selectUnitFiles(files, ['src/unrelated.test.ts'], graph).files).toContain(
+      'src/unrelated.test.ts'
+    )
+  })
+
+  it('does not mistake unrelated opaque readers for coverage of a new entry point', () => {
+    const uncovered = { ...graph, files: new Set([...graph.files, 'src/entry.ts']) }
+    expect(selectUnitFiles(files, ['src/entry.ts'], uncovered)).toMatchObject({ full: true, files })
+  })
+
+  it.each(
+    [
+      [],
+      ['src/deleted.ts'],
+      ['src/deleted.ts', 'src/leaf.ts'],
+      ['pnpm-lock.yaml'],
+      ['config/vitest.config.ts']
+    ].map((changed) => ({ changed }))
+  )('runs everything for incomplete/global evidence: $changed', ({ changed }) => {
+    expect(selectUnitFiles(files, changed, graph)).toMatchObject({ files, full: true })
+  })
+
+  it('keeps full coverage by default and on every non-draft commit', () => {
+    const base = { files, changed: ['src/leaf.ts'], graph, timings: {} }
+    for (const event of [
+      {},
+      { pull_request: { draft: false } },
+      { pull_request: { draft: true } }
+    ]) {
+      expect(planUnitSelection({ ...base, event }).executionFiles).toEqual(files)
+    }
+    expect(
+      planUnitSelection({ ...base, mode: 'selected', event: { pull_request: { draft: false } } })
+        .executionFiles
+    ).toEqual(files)
+    const selected = planUnitSelection({
+      ...base,
+      mode: 'selected',
+      event: { pull_request: { draft: true } }
+    })
+    expect(selected.executionFiles).not.toContain('src/unrelated.test.ts')
+    expect(selected.shards).toEqual([{ index: 1, count: 1 }])
+  })
+
+  it('spends five concurrency slots on a full run', () => {
+    const plan = planUnitSelection({ files, changed: ['src/leaf.ts'], graph, timings: {} })
+    expect(plan.shards).toEqual(
+      Array.from({ length: FULL_SHARD_COUNT }, (_, index) => ({
+        index: index + 1,
+        count: FULL_SHARD_COUNT
+      }))
+    )
+    expect(FULL_SHARD_COUNT).toBe(5)
+  })
+
+  it('records failures that would have been missed while shadow runs remain full', () => {
+    const plan = planUnitSelection({ files, changed: ['src/leaf.ts'], graph, timings: {} })
+    expect(
+      auditUnitSelection(plan, {
+        'src/consumer.test.ts': 'failed',
+        'src/unrelated.test.ts': 'failed',
+        'src/view.test.ts': 'passed'
+      }).omittedFailures
+    ).toEqual(['src/unrelated.test.ts'])
+  })
+})
diff --git a/config/scripts/ci-unit-sequencer.mjs b/config/scripts/ci-unit-sequencer.mjs
index cd55b3343b2..6b580bdb002 100644
--- a/config/scripts/ci-unit-sequencer.mjs
+++ b/config/scripts/ci-unit-sequencer.mjs
@@ -1,4 +1,5 @@
 import { relative } from 'node:path'
+import { readFileSync } from 'node:fs'
 import { BaseSequencer } from 'vitest/node'
 import { balanceFiles, readTimingBaseline, writeAssignment } from './ci-shard-assignment.mjs'
 
@@ -6,12 +7,46 @@ export default class TimingSequencer extends BaseSequencer {
   async shard(specs) {
     const { index, count } = this.ctx.config.shard
     const key = (spec) => relative(this.ctx.config.root, spec.moduleId).replaceAll('\\', '/')
+    let execution = specs
+    let selectionReason = 'Full suite: no verified selection plan'
+    try {
+      const plan = JSON.parse(
+        readFileSync(
+          process.env.ORCA_UNIT_SELECTION_PLAN ?? 'ci-shards/unit-selection.json',
+          'utf8'
+        )
+      )
+      if (
+        plan.version !== 1 ||
+        !plan.sourceSha ||
+        plan.sourceSha !== process.env.ORCA_SHARD_SOURCE_SHA ||
+        JSON.stringify([...plan.files].sort()) !== JSON.stringify(specs.map(key).sort()) ||
+        !Array.isArray(plan.executionFiles) ||
+        plan.executionFiles.some((file) => !plan.files.includes(file))
+      ) {
+        throw new Error('Selection provenance or discovery differs')
+      }
+      const allowed = new Set(plan.executionFiles)
+      if (allowed.size === 0) {
+        throw new Error('Empty execution selection')
+      }
+      execution = specs.filter((spec) => allowed.has(key(spec)))
+      selectionReason = plan.reason
+    } catch (error) {
+      console.log(`Running every discovered unit test: ${error.message}`)
+    }
     const baseline = readTimingBaseline('unit')
-    const assignment = balanceFiles(specs.map(key), count, baseline.timings, baseline.overheadMs)
+    const assignment = balanceFiles(
+      execution.map(key),
+      count,
+      baseline.timings,
+      baseline.overheadMs
+    )
     writeAssignment(process.env.ORCA_SHARD_MANIFEST ?? 'ci-shards/unit-assignment.json', {
       ...assignment,
       baselineSha256: baseline.baselineSha256,
-      selectedShard: index
+      selectedShard: index,
+      selectionReason
     })
     const selected = new Set(assignment.shards[index - 1].files)
     return specs.filter((spec) => selected.has(key(spec)))
diff --git a/config/scripts/ci-unit-sequencer.test.mjs b/config/scripts/ci-unit-sequencer.test.mjs
new file mode 100644
index 00000000000..931a3ccd158
--- /dev/null
+++ b/config/scripts/ci-unit-sequencer.test.mjs
@@ -0,0 +1,44 @@
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, expect, it, vi } from 'vitest'
+import TimingSequencer from './ci-unit-sequencer.mjs'
+
+let root
+afterEach(() => {
+  vi.unstubAllEnvs()
+  if (root) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+it.each(['valid', 'stale', 'missing-file', 'missing-artifact'])(
+  'preserves complete shard coverage with %s planning evidence',
+  async (kind) => {
+    root = mkdtempSync(join(tmpdir(), 'unit-sequencer-'))
+    const files = ['src/a.test.ts', 'src/b.test.ts', 'src/c.test.ts', 'src/d.test.ts']
+    const plan = {
+      version: 1,
+      sourceSha: kind === 'stale' ? 'old' : 'current',
+      files: kind === 'missing-file' ? files.slice(1) : files,
+      executionFiles: files.slice(0, 2)
+    }
+    const planPath = join(root, 'selection.json')
+    if (kind !== 'missing-artifact') {
+      writeFileSync(planPath, JSON.stringify(plan))
+    }
+    vi.stubEnv('ORCA_UNIT_SELECTION_PLAN', planPath)
+    vi.stubEnv('ORCA_SHARD_SOURCE_SHA', 'current')
+    vi.stubEnv('ORCA_SHARD_MANIFEST', join(root, 'assignment.json'))
+    const assigned = []
+    for (const index of [1, 2]) {
+      const sequencer = new TimingSequencer({ config: { root, shard: { index, count: 2 } } })
+      const specs = files.map((file) => ({ moduleId: join(root, file) }))
+      assigned.push(...(await sequencer.shard(specs)).map((spec) => spec.moduleId))
+    }
+    expect(assigned.sort()).toEqual(
+      (kind === 'valid' ? files.slice(0, 2) : files).map((file) => join(root, file)).sort()
+    )
+    expect(new Set(assigned).size).toBe(assigned.length)
+  }
+)
diff --git a/config/scripts/ci-unit-timing-import.mjs b/config/scripts/ci-unit-timing-import.mjs
new file mode 100644
index 00000000000..50a64981670
--- /dev/null
+++ b/config/scripts/ci-unit-timing-import.mjs
@@ -0,0 +1,69 @@
+import { readdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { compareIds } from './ci-shard-assignment.mjs'
+
+export function importUnitTimingReports(reports) {
+  const first = reports[0]
+  if (!first || first.shard.count !== reports.length) {
+    throw new Error('Expected exactly one complete unit shard set')
+  }
+  const provenance = (report) =>
+    JSON.stringify([
+      report.sourceSha,
+      report.runId,
+      report.runAttempt,
+      report.nodeVersion,
+      report.shard.count
+    ])
+  const indices = new Set()
+  const timings = {}
+  for (const report of reports) {
+    if (
+      report.metric !== 'module-duration-v1' ||
+      report.status !== 'passed' ||
+      report.unhandledErrors !== 0 ||
+      !report.sourceSha ||
+      provenance(report) !== provenance(first)
+    ) {
+      throw new Error('Unit timing reports must come from one successful source/run/Node version')
+    }
+    const { index, count } = report.shard
+    if (!Number.isInteger(index) || index < 1 || index > count || indices.has(index)) {
+      throw new Error('Duplicate or invalid unit shard index')
+    }
+    indices.add(index)
+    for (const [file, duration] of Object.entries(report.timings)) {
+      if (file in timings || !Number.isFinite(duration) || duration <= 0) {
+        throw new Error(`Duplicate or invalid unit timing: ${file}`)
+      }
+      timings[file] = duration
+    }
+  }
+  if (!Object.keys(timings).length) {
+    throw new Error('No unit timing evidence')
+  }
+  return {
+    runId: first.runId,
+    runAttempt: first.runAttempt,
+    sourceSha: first.sourceSha,
+    nodeVersion: first.nodeVersion,
+    metric: first.metric,
+    // Per-module measurements already include setup, imports and environment startup.
+    overheadMs: 0,
+    timings: Object.fromEntries(Object.entries(timings).sort(([a], [b]) => compareIds(a, b)))
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const [directory, output] = process.argv.slice(2)
+  if (!directory || !output) {
+    throw new Error('Usage: ci-unit-timing-import.mjs ARTIFACT_DIRECTORY BASELINE_JSON')
+  }
+  const reports = readdirSync(directory, { recursive: true })
+    .filter((file) => file.endsWith('unit-timings.json'))
+    .map((file) => JSON.parse(readFileSync(join(directory, file), 'utf8')))
+  const baseline = JSON.parse(readFileSync(output, 'utf8'))
+  baseline.unit = importUnitTimingReports(reports)
+  writeFileSync(output, `${JSON.stringify(baseline, null, 2)}\n`)
+}
diff --git a/config/scripts/ci-unit-timing-reporter.mjs b/config/scripts/ci-unit-timing-reporter.mjs
new file mode 100644
index 00000000000..fa54aa1072a
--- /dev/null
+++ b/config/scripts/ci-unit-timing-reporter.mjs
@@ -0,0 +1,64 @@
+import { relative } from 'node:path'
+import { appendFileSync, readFileSync } from 'node:fs'
+import { writeAssignment } from './ci-shard-assignment.mjs'
+import { auditUnitSelection } from './ci-unit-selection.mjs'
+
+export function moduleDuration(diagnostic) {
+  return Math.max(
+    1,
+    Math.ceil(
+      diagnostic.environmentSetupDuration +
+        diagnostic.prepareDuration +
+        diagnostic.collectDuration +
+        diagnostic.setupDuration +
+        diagnostic.duration
+    )
+  )
+}
+
+export default class UnitTimingReporter {
+  onInit(ctx) {
+    this.ctx = ctx
+  }
+
+  onTestRunEnd(modules, errors, reason) {
+    const results = Object.fromEntries(
+      modules.map((module) => [
+        relative(this.ctx.config.root, module.moduleId).replaceAll('\\', '/'),
+        module.state?.() ?? 'unknown'
+      ])
+    )
+    writeAssignment(process.env.ORCA_UNIT_TIMING_REPORT ?? 'ci-shards/unit-timings.json', {
+      metric: 'module-duration-v1',
+      nodeVersion: process.versions.node,
+      shard: this.ctx.config.shard ?? { index: 1, count: 1 },
+      status: reason,
+      unhandledErrors: errors.length,
+      results,
+      timings: Object.fromEntries(
+        modules.map((module) => [
+          relative(this.ctx.config.root, module.moduleId).replaceAll('\\', '/'),
+          moduleDuration(module.diagnostic())
+        ])
+      )
+    })
+    try {
+      const plan = JSON.parse(
+        readFileSync(
+          process.env.ORCA_UNIT_SELECTION_PLAN ?? 'ci-shards/unit-selection.json',
+          'utf8'
+        )
+      )
+      const audit = auditUnitSelection(plan, results)
+      writeAssignment('ci-shards/unit-selection-audit.json', audit)
+      if (process.env.GITHUB_STEP_SUMMARY) {
+        appendFileSync(
+          process.env.GITHUB_STEP_SUMMARY,
+          `Unit selection (${audit.mode}): ${audit.candidate}/${audit.discovered} candidate files; ${audit.omittedFailures.length} failures outside selection.\n`
+        )
+      }
+    } catch {
+      // Timing evidence remains useful when selection planning was unavailable.
+    }
+  }
+}
diff --git a/config/scripts/ci-unit-timing-reporter.test.mjs b/config/scripts/ci-unit-timing-reporter.test.mjs
new file mode 100644
index 00000000000..5523b494371
--- /dev/null
+++ b/config/scripts/ci-unit-timing-reporter.test.mjs
@@ -0,0 +1,104 @@
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { importUnitTimingReports } from './ci-unit-timing-import.mjs'
+import UnitTimingReporter, { moduleDuration } from './ci-unit-timing-reporter.mjs'
+
+const report = (index, timings) => ({
+  metric: 'module-duration-v1',
+  nodeVersion: '24.21.0',
+  sourceSha: 'source',
+  runId: 'run',
+  runAttempt: '1',
+  shard: { index, count: 2 },
+  status: 'passed',
+  unhandledErrors: 0,
+  timings
+})
+
+describe('unit worker timing evidence', () => {
+  it('counts each worker phase once, including imports of tests with cheap assertions', () => {
+    expect(
+      moduleDuration({
+        environmentSetupDuration: 11,
+        prepareDuration: 12,
+        collectDuration: 130,
+        setupDuration: 14,
+        duration: 0.2,
+        importDurations: { dependency: 100 }
+      })
+    ).toBe(168)
+  })
+
+  it('writes a real reporter result with source and shard provenance', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-unit-timing-'))
+    const previous = process.env.ORCA_UNIT_TIMING_REPORT
+    process.env.ORCA_UNIT_TIMING_REPORT = join(directory, 'unit-timings.json')
+    try {
+      const reporter = new UnitTimingReporter()
+      reporter.onInit({ config: { root: process.cwd(), shard: { index: 1, count: 8 } } })
+      reporter.onTestRunEnd(
+        [
+          {
+            moduleId: resolve('src/example.test.ts'),
+            diagnostic: () => ({
+              environmentSetupDuration: 0,
+              prepareDuration: 0,
+              collectDuration: 200,
+              setupDuration: 10,
+              duration: 5
+            })
+          }
+        ],
+        [],
+        'passed'
+      )
+      expect(JSON.parse(readFileSync(process.env.ORCA_UNIT_TIMING_REPORT, 'utf8'))).toMatchObject({
+        metric: 'module-duration-v1',
+        shard: { index: 1, count: 8 },
+        status: 'passed',
+        unhandledErrors: 0,
+        timings: { 'src/example.test.ts': 215 }
+      })
+    } finally {
+      if (previous === undefined) {
+        delete process.env.ORCA_UNIT_TIMING_REPORT
+      } else {
+        process.env.ORCA_UNIT_TIMING_REPORT = previous
+      }
+      rmSync(directory, { recursive: true, force: true })
+    }
+  })
+
+  it('imports all shards without adding the old average overhead again', () => {
+    expect(importUnitTimingReports([report(2, { b: 100 }), report(1, { a: 200 })])).toMatchObject({
+      sourceSha: 'source',
+      overheadMs: 0,
+      metric: 'module-duration-v1',
+      timings: { a: 200, b: 100 }
+    })
+  })
+
+  it('rejects incomplete, duplicate, mixed and failed evidence', () => {
+    const first = report(1, { a: 100 })
+    expect(() => importUnitTimingReports([first])).toThrow('complete')
+    expect(() => importUnitTimingReports([first, first])).toThrow('index')
+    expect(() => importUnitTimingReports([first, report(2, { a: 200 })])).toThrow('timing')
+    for (const change of [
+      { sourceSha: 'other' },
+      { runId: 'other' },
+      { runAttempt: '2' },
+      { nodeVersion: '26.6.0' },
+      { metric: 'test-duration' },
+      { status: 'failed' },
+      { status: 'interrupted' },
+      { unhandledErrors: 1 }
+    ]) {
+      expect(() =>
+        importUnitTimingReports([first, { ...report(2, { b: 200 }), ...change }])
+      ).toThrow('successful')
+    }
+    expect(() => importUnitTimingReports([first, report(2, { b: -1 })])).toThrow('timing')
+  })
+})
diff --git a/config/scripts/client-hosted-browser-package-coverage.test.mjs b/config/scripts/client-hosted-browser-package-coverage.test.mjs
index 0520e9d6e4b..204cf162e55 100644
--- a/config/scripts/client-hosted-browser-package-coverage.test.mjs
+++ b/config/scripts/client-hosted-browser-package-coverage.test.mjs
@@ -6,11 +6,17 @@ import { parse } from 'yaml'
 const projectDir = resolve(import.meta.dirname, '../..')
 
 describe('client-hosted browser package coverage', () => {
-  it('bundles the WSL browser-network relay with its version stamp', () => {
-    const relayBuild = readFileSync(join(projectDir, 'config/scripts/build-relay.mjs'), 'utf8')
-
-    expect(relayBuild).toContain("outfile: join(outDir, 'wsl-browser-network-relay.js')")
-    expect(relayBuild).toContain("join(outDir, '.browser-network-version')")
+  it('finishes the installer process probe before concurrent native boundaries', () => {
+    const workflow = parse(readFileSync(join(projectDir, '.github/workflows/pr.yml'), 'utf8'))
+    const steps = workflow.jobs.package_windows.steps
+    const probe = steps.findIndex((step) => step.name === 'Test Windows installer process probe')
+    const boundaries = steps.findIndex((step) => step.name === 'Test Windows-specific boundaries')
+    const file = 'config/scripts/nsis-process-check.test.mjs'
+    expect(probe).toBeGreaterThanOrEqual(0)
+    expect(probe).toBeLessThan(boundaries)
+    expect(steps[probe].background).toBeUndefined()
+    expect(steps[probe].run).toContain(file)
+    expect(steps[boundaries].run).not.toContain(file)
   })
 
   it('runs client-hosted Electron lifecycle coverage on native package hosts', () => {
diff --git a/config/scripts/cloud-security-history-workflow.test.mjs b/config/scripts/cloud-security-history-workflow.test.mjs
new file mode 100644
index 00000000000..fc28e55b996
--- /dev/null
+++ b/config/scripts/cloud-security-history-workflow.test.mjs
@@ -0,0 +1,92 @@
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { runProcessSync } from '../../src/shared/child-process/run-process'
+
+const workflow = parse(
+  readFileSync(new URL('../../.github/workflows/cloud-verify.yml', import.meta.url), 'utf8')
+)
+const steps = workflow.jobs.security.steps
+const history = steps.find((step) => step.name === 'Fetch complete scan history')
+
+it('fetches both merge parents and deleted content without unrelated branches or tags', () => {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-cloud-history-'))
+  const source = join(directory, 'source')
+  const checkout = join(directory, 'checkout')
+  const run = (program, args, cwd, env = process.env) => {
+    const result = runProcessSync({ program, args, cwd, env })
+    expect(result.code, result.stderr).toBe(0)
+    return result.stdout.trim()
+  }
+  const git = (args, cwd = source) => run('git', args, cwd)
+  const commit = (message) => {
+    git(['add', '-A'])
+    git(['-c', 'commit.gpgsign=false', 'commit', '--quiet', '-m', message])
+    return git(['rev-parse', 'HEAD'])
+  }
+
+  try {
+    run('git', ['init', '--quiet', source], directory)
+    git(['checkout', '-b', 'main'])
+    git(['config', 'user.name', 'CI test'])
+    git(['config', 'user.email', 'ci@example.invalid'])
+    mkdirSync(join(source, 'cloud'))
+    writeFileSync(join(source, 'cloud', 'removed.txt'), 'historical-scan-marker\n')
+    const original = commit('historical content')
+    rmSync(join(source, 'cloud', 'removed.txt'))
+    writeFileSync(join(source, 'cloud', 'current.txt'), 'current\n')
+    commit('delete historical content')
+    git(['checkout', '-b', 'feature'])
+    writeFileSync(join(source, 'cloud', 'feature.txt'), 'feature-parent-marker\n')
+    commit('feature parent')
+    git(['checkout', 'main'])
+    writeFileSync(join(source, 'cloud', 'base.txt'), 'base-parent-marker\n')
+    commit('base parent')
+    git(['-c', 'commit.gpgsign=false', 'merge', '--no-ff', 'feature', '-m', 'PR merge'])
+    const sha = git(['rev-parse', 'HEAD'])
+    const expectedHistory = git(['rev-list', 'HEAD']).split('\n').sort()
+    const expectedPatch = git(['log', '--format=%H', '-p', 'HEAD', '--', 'cloud'])
+    git(['checkout', '-b', 'unrelated', original])
+    writeFileSync(join(source, 'unrelated.txt'), 'unrelated-object\n')
+    const unrelated = commit('unrelated branch')
+    git(['tag', 'unrelated-tag'])
+    git(['checkout', 'main'])
+
+    run(
+      'git',
+      ['clone', '--depth=1', '--no-tags', '--branch', 'main', pathToFileURL(source).href, checkout],
+      directory
+    )
+    expect(git(['rev-list', '--count', 'HEAD'], checkout)).toBe('1')
+    run('bash', ['-e', '-c', history.run], checkout, { ...process.env, GITHUB_SHA: sha })
+
+    expect(git(['rev-list', 'HEAD'], checkout).split('\n').sort()).toEqual(expectedHistory)
+    const actualPatch = git(['log', '--format=%H', '-p', 'HEAD', '--', 'cloud'], checkout)
+    expect(actualPatch).toBe(expectedPatch)
+    expect(actualPatch).toContain('historical-scan-marker')
+    expect(actualPatch).toContain('feature-parent-marker')
+    expect(actualPatch).toContain('base-parent-marker')
+    expect(git(['tag', '--list'], checkout)).toBe('')
+    expect(
+      runProcessSync({ program: 'git', args: ['cat-file', '-e', unrelated], cwd: checkout }).code
+    ).not.toBe(0)
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+it('completes history before scanning the same HEAD and Cloud paths', () => {
+  expect(steps[0].with['fetch-depth']).toBe(1)
+  expect(history['working-directory']).toBe('.')
+  const scanIndex = steps.findIndex(
+    (step) => step.run?.includes('docker run') && step.run.includes('gitleaks@')
+  )
+  expect(steps.indexOf(history)).toBeLessThan(scanIndex)
+  expect(steps[scanIndex].run).toContain(
+    '--log-opts="HEAD -- cloud :(glob).github/workflows/cloud-*.yml .github/actions/cloud-sql-rollout-lease"'
+  )
+  expect(steps.some((step) => step.run?.includes('trufflehog@'))).toBe(true)
+})
diff --git a/config/scripts/codex-index-heal-contract-workflow.test.mjs b/config/scripts/codex-index-heal-contract-workflow.test.mjs
index 62c9787a12e..096c4b876a8 100644
--- a/config/scripts/codex-index-heal-contract-workflow.test.mjs
+++ b/config/scripts/codex-index-heal-contract-workflow.test.mjs
@@ -34,4 +34,21 @@ describe('Codex index-heal contract PR gate', () => {
       'set -euo pipefail'
     )
   })
+
+  it('pins the --no-daemon contract to one Codex version and fails when it is missing', () => {
+    const install = job.steps.find((step) => step.name === 'Install pinned no-daemon Codex CLI')
+    const verify = job.steps.find((step) => step.name === 'Verify Codex --no-daemon contract')
+
+    expect(job.env.CODEX_NO_DAEMON_CLI_VERSION).toMatch(/^\d+\.\d+\.\d+$/)
+    expect(install.run).toContain('"@openai/codex@$CODEX_NO_DAEMON_CLI_VERSION"')
+    expect(verify.env.ORCA_CODEX_NO_DAEMON_CONTRACT_VERSION).toBe(
+      '${{ env.CODEX_NO_DAEMON_CLI_VERSION }}'
+    )
+    expect(verify.env.ORCA_CODEX_NO_DAEMON_CONTRACT_REQUIRED).toBe('1')
+    expect(install.run).toContain('--prefix "$RUNNER_TEMP/codex-cli-no-daemon"')
+    expect(verify.run).toContain(
+      'ORCA_CODEX_NO_DAEMON_CONTRACT_BINARY="$RUNNER_TEMP/codex-cli-no-daemon/node_modules/.bin/codex"'
+    )
+    expect(verify.run).toContain('src/main/pty/codex-no-daemon-binary-contract.test.ts')
+  })
 })
diff --git a/config/scripts/computer-e2e-workflow.test.mjs b/config/scripts/computer-e2e-workflow.test.mjs
index fc605bac5bd..3e31ccf5a80 100644
--- a/config/scripts/computer-e2e-workflow.test.mjs
+++ b/config/scripts/computer-e2e-workflow.test.mjs
@@ -6,197 +6,6 @@ import { parse } from 'yaml'
 const projectDir = resolve(import.meta.dirname, '../..')
 
 describe('computer-use e2e workflow', () => {
-  it('cancels superseded pull request runs without cancelling scheduled runs', () => {
-    const workflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/computer-e2e.yml'), 'utf8')
-    )
-
-    expect(workflow.concurrency).toEqual({
-      group: 'computer-e2e-${{ github.event.pull_request.number || github.ref }}',
-      'cancel-in-progress': "${{ github.event_name == 'pull_request' }}"
-    })
-  })
-
-  it('runs computer-use e2e files serially because they share desktop focus', () => {
-    const config = readFileSync(join(projectDir, 'tests/e2e/vitest.config.ts'), 'utf8')
-
-    expect(config).toContain('fileParallelism: false')
-  })
-
-  it('guards e2e source against fragile waits and Windows Calculator drift', () => {
-    const driver = readFileSync(join(projectDir, 'tests/e2e/helpers/computer-driver.ts'), 'utf8')
-    const cliDriver = readFileSync(
-      join(projectDir, 'tests/e2e/helpers/computer-cli-driver.ts'),
-      'utf8'
-    )
-    const windowsStoreE2e = readFileSync(
-      join(projectDir, 'tests/e2e/computer-windows-store.e2e.ts'),
-      'utf8'
-    )
-
-    expect(driver).not.toContain('await delay(3500)')
-    expect(driver).toContain("await waitForComputerWindowTitle('gedit', fileName, 15000)")
-    expect(cliDriver).toContain('ORCA_DEV_USER_DATA_PATH')
-    expect(cliDriver).toContain('orca-computer-runtime-')
-    expect(cliDriver).toContain('retryMissingRuntimeMetadata')
-    expect(cliDriver).toContain('Could not read Orca runtime metadata')
-    expect(cliDriver).toContain("'serve', '--no-pairing', '--json'")
-
-    expect(windowsStoreE2e).toContain("app.bundleId === 'ApplicationFrameHost'")
-    expect(windowsStoreE2e).toContain("app.bundleId === 'win32calc'")
-    expect(windowsStoreE2e).toContain('buttonIndex >= 0')
-    expect(windowsStoreE2e).toContain('pane(?:\\s|$)/m')
-    expect(windowsStoreE2e).toContain('String(clickIndex)')
-    expect(windowsStoreE2e).not.toContain(
-      "for (const buttonName of ['One', 'Plus', 'Two', 'Equals'])"
-    )
-  })
-
-  it('triggers on computer-use shared contracts, scripts, and agent skill changes', () => {
-    const workflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/computer-e2e.yml'), 'utf8')
-    )
-    const triggerPaths = workflow.on.pull_request.paths
-
-    expect(triggerPaths).toEqual(
-      expect.arrayContaining([
-        'config/scripts/computer-e2e-workflow.test.mjs',
-        'config/scripts/macos-computer-helper-owner-loss-group-recovery.test.mjs',
-        'config/scripts/computer-use-modifier-safety.test.mjs',
-        'config/scripts/computer-use-skill-guidance.test.mjs',
-        'config/scripts/computer-use-smoke.mjs',
-        'config/scripts/computer-use-smoke.test.mjs',
-        'skills/computer-use/SKILL.md',
-        'src/main/computer/**',
-        'src/main/runtime/rpc/dispatcher.ts',
-        'src/main/runtime/rpc/errors.ts',
-        'src/main/runtime/rpc/methods/computer*.ts',
-        'src/shared/computer-use-*.ts',
-        'tests/e2e/vitest.config.ts'
-      ])
-    )
-    expect(triggerPaths).not.toContain('src/shared/runtime-types.ts')
-  })
-
-  it('runs focused computer-use regression tests in the PR native-smoke job', () => {
-    const workflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/computer-e2e.yml'), 'utf8')
-    )
-    const nativeSmokeRuns = workflow.jobs['native-smoke'].steps
-      .map((step) => step.run)
-      .filter((run) => typeof run === 'string')
-    const checkout = workflow.jobs['native-smoke'].steps.find(
-      (step) => step.uses === 'actions/checkout@v6'
-    )
-    const regressionRun = nativeSmokeRuns.find((run) => run.includes('pnpm vitest run'))
-    const expectedRegressionFiles = [
-      'config/scripts/macos-computer-helper-owner-loss-group-recovery.test.mjs',
-      'config/scripts/macos-computer-helper-owner-loss-processes.test.mjs',
-      'config/scripts/computer-use-modifier-safety.test.mjs',
-      'config/scripts/computer-use-skill-guidance.test.mjs',
-      'config/scripts/computer-use-smoke.test.mjs',
-      'src/main/computer/computer-provider-lifecycle.test.ts',
-      'src/main/computer/computer-provider-unavailable-message.test.ts',
-      'src/main/computer/sidecar-client.test.ts',
-      'src/main/computer/macos-native-provider-client.test.ts',
-      'src/main/computer/macos-native-provider-socket.test.ts',
-      'src/main/computer/macos-computer-use-permissions.test.ts',
-      'src/main/computer/macos-computer-use-permission-status.test.ts',
-      'src/main/computer/desktop-script-provider-client.test.ts',
-      'src/main/computer/desktop-script-provider-cache.test.ts',
-      'src/main/computer/desktop-script-provider-actions.test.ts',
-      'src/main/computer/desktop-script-provider-cache-lifecycle.test.ts',
-      'src/main/computer/desktop-script-provider-errors.test.ts',
-      'src/main/computer/desktop-script-provider-action-errors.test.ts',
-      'src/shared/computer-use-error-recovery.test.ts',
-      'src/shared/computer-use-key-spec.test.ts',
-      'src/cli/format.test.ts',
-      'src/cli/handlers/computer.test.ts',
-      'src/cli/handlers/computer-action-routing.test.ts',
-      'src/cli/handlers/computer-action-validation.test.ts',
-      'src/cli/handlers/computer-state-formatting.test.ts',
-      'src/cli/specs/computer.test.ts',
-      'src/cli/index.test.ts',
-      'src/main/runtime/rpc/dispatcher-computer-errors.test.ts',
-      'src/main/runtime/rpc/errors.test.ts',
-      'src/main/runtime/rpc/methods/computer.test.ts',
-      'src/main/runtime/rpc/methods/computer-actions.test.ts',
-      'src/cli/runtime/envelope-schema.test.ts',
-      'src/shared/remote-runtime-client.test.ts'
-    ]
-
-    expect(checkout.with['persist-credentials']).toBe(false)
-    expect(regressionRun).toBeTruthy()
-    for (const file of expectedRegressionFiles) {
-      expect(regressionRun).toContain(file)
-    }
-  })
-
-  it('keeps Linux native imports available without installing the GUI-only stack in PR smoke', () => {
-    const workflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/computer-e2e.yml'), 'utf8')
-    )
-    const nativeSmokeInstall = workflow.jobs['native-smoke'].steps.find(
-      (step) => step.if === "runner.os == 'Linux'"
-    )
-    const scheduledLinuxInstall = workflow.jobs.linux.steps.find((step) =>
-      step.run?.includes('apt-get install')
-    )
-
-    expect(nativeSmokeInstall.run).toContain('python3')
-    expect(nativeSmokeInstall.run).toContain('python3-gi')
-    expect(nativeSmokeInstall.run).toContain('gir1.2-atspi-2.0')
-    expect(nativeSmokeInstall.run).toContain('at-spi2-core')
-    expect(nativeSmokeInstall.run).not.toContain('gedit')
-    expect(nativeSmokeInstall.run).not.toContain('xvfb')
-    expect(nativeSmokeInstall.run).not.toContain('xdotool')
-    expect(scheduledLinuxInstall.run).toContain('gedit')
-    expect(scheduledLinuxInstall.run).toContain('xvfb')
-    expect(scheduledLinuxInstall.run).toContain('xdotool')
-  })
-
-  it('builds and tests the macOS helper on every trigger without hosted TCC e2e', () => {
-    const workflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/computer-e2e.yml'), 'utf8')
-    )
-    const job = workflow.jobs['mac-native-owner-smoke']
-    const runs = job.steps.map((step) => step.run).filter((run) => typeof run === 'string')
-    const checkout = job.steps.find((step) => step.uses === 'actions/checkout@v6')
-    const install = job.steps.find(
-      (step) => step.uses === './.github/actions/install-node-dependencies'
-    )
-
-    expect(job.if).toBeUndefined()
-    expect(job['runs-on']).toBe('macos-15')
-    expect(checkout.with['persist-credentials']).toBe(false)
-    expect(install.with['native-runtime']).toBe('electron')
-    expect(runs).toContain('pnpm bench:macos-computer-helper-owner-loss --expect reaped --trials 1')
-    const cleanupRun = runs.find((run) =>
-      run.includes('config/scripts/macos-computer-helper-owner-loss-processes.test.mjs')
-    )
-    expect(cleanupRun).toContain(
-      'config/scripts/macos-computer-helper-owner-loss-group-recovery.test.mjs'
-    )
-    expect(runs).toContain('pnpm verify:computer-native')
-    expect(
-      runs.find((run) => run.includes('config/scripts/build-native-for-platform.test.mjs'))
-    ).toContain('--config config/vitest.config.ts')
-    expect(runs.join('\n')).not.toContain('test:e2e:computer')
-    expect(workflow.jobs.mac).toBeUndefined()
-    expect(workflow.on.pull_request.paths).toEqual(
-      expect.arrayContaining([
-        'config/scripts/build-native-for-platform.mjs',
-        'config/scripts/build-native-for-platform.test.mjs',
-        'config/scripts/macos-computer-helper-owner-loss-benchmark.mjs',
-        'config/scripts/macos-computer-helper-owner-loss-group-recovery.test.mjs',
-        'config/scripts/macos-computer-helper-owner-loss-metrics.mjs',
-        'config/scripts/macos-computer-helper-owner-loss-processes.mjs',
-        'config/scripts/macos-computer-helper-owner-loss-processes.test.mjs',
-        'config/scripts/macos-computer-helper-owner-loss-trial-cleanup.mjs'
-      ])
-    )
-  })
-
   it('uses the cached Electron dependency path for scheduled Linux and Windows e2e', () => {
     const workflow = parse(
       readFileSync(join(projectDir, '.github/workflows/computer-e2e.yml'), 'utf8')
@@ -220,29 +29,6 @@ describe('computer-use e2e workflow', () => {
     }
   })
 
-  it('runs deterministic macOS owner-loss benchmark cleanup coverage', () => {
-    const benchmark = readFileSync(
-      join(projectDir, 'config/scripts/macos-computer-helper-owner-loss-benchmark.mjs'),
-      'utf8'
-    )
-    const cleanup = readFileSync(
-      join(projectDir, 'config/scripts/macos-computer-helper-owner-loss-trial-cleanup.mjs'),
-      'utf8'
-    )
-
-    expect(benchmark).toContain('spawnBenchmarkProcess(executable, [launcherDir]')
-    expect(benchmark).toContain("stdio: ['ignore', stdoutDescriptor, stderrDescriptor]")
-    expect(benchmark).toContain('cleanupOwnerLossTrial({')
-    const parseIndex = benchmark.indexOf('parseBenchmarkTrialResult(serializedResult)')
-    const cleanupIndex = benchmark.indexOf('cleanupOwnerLossTrial({')
-    expect(parseIndex).toBeGreaterThanOrEqual(0)
-    expect(cleanupIndex).toBeGreaterThanOrEqual(0)
-    expect(parseIndex).toBeLessThan(cleanupIndex)
-    expect(benchmark).toContain('trialCleanupSha256: artifactSha256(trialCleanupPath)')
-    expect(cleanup).toContain('killRecordedAndMatchingProcesses(options.recordPath')
-    expect(cleanup).toContain("signalValidatedProcessGroup(options.pid, options.marker, 'SIGKILL'")
-  })
-
   it('boots the built daemon under plain Node in the PR native-smoke job after the main build', () => {
     const workflow = parse(
       readFileSync(join(projectDir, '.github/workflows/computer-e2e.yml'), 'utf8')
@@ -279,34 +65,6 @@ describe('computer-use e2e workflow', () => {
     )
   })
 
-  it('re-runs the native-smoke job when the daemon bundle graph changes', () => {
-    const workflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/computer-e2e.yml'), 'utf8')
-    )
-    const triggerPaths = workflow.on.pull_request.paths
-
-    expect(triggerPaths).toEqual(
-      expect.arrayContaining([
-        'config/scripts/daemon-boot-smoke.mjs',
-        'config/scripts/windows-daemon-workspace-close-repro.mjs',
-        'electron.vite.config.ts',
-        'config/build-plugins/**',
-        'src/main/daemon/**'
-      ])
-    )
-  })
-
-  it('does not run computer-use e2e in PR smoke jobs', () => {
-    const workflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/computer-e2e.yml'), 'utf8')
-    )
-    const nativeSmokeRuns = workflow.jobs['native-smoke'].steps
-      .map((step) => step.run)
-      .filter((run) => typeof run === 'string')
-
-    expect(nativeSmokeRuns.join('\n')).not.toContain('test:e2e:computer')
-  })
-
   it('builds Electron main output before every computer-use e2e run', () => {
     const workflow = parse(
       readFileSync(join(projectDir, '.github/workflows/computer-e2e.yml'), 'utf8')
@@ -352,48 +110,4 @@ describe('computer-use e2e workflow', () => {
     expect(allRuns.join('\n')).toContain('test:e2e:computer')
     expect(allRuns.join('\n')).not.toContain('test:e2e:computer -- --reporter')
   })
-
-  it('runs Linux e2e on schedule without advertising hosted macOS TCC coverage', () => {
-    const workflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/computer-e2e.yml'), 'utf8')
-    )
-    const triggerPaths = workflow.on.pull_request.paths
-    const linuxRuns = workflow.jobs.linux.steps
-      .map((step) => step.run)
-      .filter((run) => typeof run === 'string')
-
-    expect(triggerPaths).toEqual(
-      expect.arrayContaining([
-        'tests/e2e/computer-linux.e2e.ts',
-        'tests/e2e/helpers/computer-cli-driver.ts',
-        'tests/e2e/helpers/computer-driver.ts'
-      ])
-    )
-    expect(triggerPaths).not.toContain('tests/e2e/computer-mac.e2e.ts')
-    expect(triggerPaths).not.toContain('tests/e2e/computer-mac-safari.e2e.ts')
-    expect(workflow.jobs.mac).toBeUndefined()
-    expect(linuxRuns).toContain(
-      'xvfb-run --auto-servernum dbus-run-session -- pnpm test:e2e:computer --reporter=verbose tests/e2e/computer-linux.e2e.ts'
-    )
-  })
-
-  it('runs every Windows computer-use e2e file in the scheduled Windows job', () => {
-    const workflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/computer-e2e.yml'), 'utf8')
-    )
-    const triggerPaths = workflow.on.pull_request.paths
-    const windowsRuns = workflow.jobs.windows.steps
-      .map((step) => step.run)
-      .filter((run) => typeof run === 'string')
-
-    expect(triggerPaths).toEqual(
-      expect.arrayContaining([
-        'tests/e2e/computer-windows.e2e.ts',
-        'tests/e2e/computer-windows-store.e2e.ts'
-      ])
-    )
-    expect(windowsRuns).toContain(
-      'pnpm test:e2e:computer --reporter=verbose tests/e2e/computer-windows.e2e.ts tests/e2e/computer-windows-store.e2e.ts'
-    )
-  })
 })
diff --git a/config/scripts/e2e-cli-artifact-capability.test.mjs b/config/scripts/e2e-cli-artifact-capability.test.mjs
new file mode 100644
index 00000000000..af39b8da753
--- /dev/null
+++ b/config/scripts/e2e-cli-artifact-capability.test.mjs
@@ -0,0 +1,56 @@
+import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { delimiter, join } from 'node:path'
+import { parse } from 'yaml'
+import { describe, expect, it } from 'vitest'
+import { runProcessSync } from '../../src/shared/child-process/run-process'
+
+const workflow = parse(readFileSync('.github/workflows/e2e.yml', 'utf8'))
+const build = workflow.jobs.build.steps.find((step) => step.id === 'e2e-cli')
+const scripts = JSON.parse(readFileSync('package.json', 'utf8')).scripts
+
+describe('shared E2E CLI capability', () => {
+  it('uses the same preparation for locally compiled and downloaded CLI output', () => {
+    expect(scripts['build:cli']).toContain('&& pnpm run prepare:cli-output')
+    expect(scripts['prepare:cli-output']).toBe(
+      'node config/scripts/verify-cli-bin.mjs --fix-executable --fix-package-json && node config/scripts/install-dev-cli.mjs'
+    )
+  })
+
+  it.skipIf(process.platform === 'win32').each([
+    [false, 0, 0],
+    [true, 0, 0],
+    [true, 7, 7]
+  ])('supported=%s build status=%s exits=%s', (supported, buildStatus, exitStatus) => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-e2e-cli-capability-'))
+    const marker = join(directory, 'build-requested')
+    try {
+      writeFileSync(
+        join(directory, 'package.json'),
+        JSON.stringify({ scripts: supported ? { 'prepare:cli-output': 'available' } : {} })
+      )
+      const pnpm = join(directory, 'pnpm')
+      writeFileSync(pnpm, '#!/bin/sh\nprintf "%s" "$*" > "$BUILD_MARKER"\nexit "$BUILD_STATUS"\n')
+      chmodSync(pnpm, 0o755)
+      const result = runProcessSync({
+        program: 'bash',
+        args: ['-e', '-o', 'pipefail', '-c', build.run],
+        cwd: directory,
+        env: {
+          ...process.env,
+          PATH: `${directory}${delimiter}${process.env.PATH}`,
+          BUILD_MARKER: marker,
+          BUILD_STATUS: String(buildStatus)
+        },
+        timeoutMs: 10_000
+      })
+      expect(result.code, JSON.stringify(result)).toBe(exitStatus)
+      expect(existsSync(marker)).toBe(supported)
+      if (supported) {
+        expect(readFileSync(marker, 'utf8')).toBe('run build:cli')
+      }
+    } finally {
+      rmSync(directory, { recursive: true, force: true })
+    }
+  })
+})
diff --git a/config/scripts/electron-builder-config.test.mjs b/config/scripts/electron-builder-config.test.mjs
index 430a5fae4c8..72ffc80ec2c 100644
--- a/config/scripts/electron-builder-config.test.mjs
+++ b/config/scripts/electron-builder-config.test.mjs
@@ -1,8 +1,8 @@
 import { existsSync } from 'node:fs'
-import { chmod, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { chmod, lstat, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import { createRequire } from 'node:module'
 import { tmpdir } from 'node:os'
-import { join } from 'node:path'
+import { dirname, join } from 'node:path'
 import { afterAll, beforeAll, describe, expect, it } from 'vitest'
 import { writeMobileWebBundleFixtureTree } from './mobile-web-bundle-fixture-tree.mjs'
 
@@ -11,7 +11,7 @@ const SRC_MAIN_DIR = join(REPO_ROOT, 'src', 'main')
 
 const require = createRequire(import.meta.url)
 const electronBuilderConfig = require('../electron-builder.config.cjs')
-const { FileMatcher } = require('app-builder-lib/out/fileMatcher')
+const { copyFiles, FileMatcher } = require('app-builder-lib/out/fileMatcher')
 const FpmTarget = require('app-builder-lib/out/targets/FpmTarget').default
 const electronBuilderNativeRebuild = require('./electron-builder-native-rebuild.cjs')
 
@@ -37,6 +37,7 @@ describe('electron-builder config', () => {
         '!tests{,/**/*}',
         '!examples{,/**/*}',
         '!pr-evidence{,/**/*}',
+        '!notes{,/**/*}',
         '!{.claude,.grok,.agents,.codex}{,/**/*}',
         '!Casks{,/**/*}',
         '!{AGENTS.md,CLAUDE.md,DEVELOPING.md,bundle-size-progress.md,ORCHESTRATION_IMPLEMENTATION_CHECKLIST.md,ORCHESTRATION_STRUCTURED_OUTPUT_DESIGN.md}',
@@ -63,6 +64,62 @@ describe('electron-builder config', () => {
     expect(packs('out/main/index.js')).toBe(true)
   })
 
+  it.each(['file', 'directory'])('keeps a root notes %s out of app.asar', async (kind) => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-packaging-notes-'))
+    const source = join(root, 'app')
+    const destination = join(root, 'selected')
+    const runtimePaths = [
+      'package.json',
+      'out/main/index.js',
+      'out/renderer/index.html',
+      'out/cli/index.js',
+      'out/shared/index.js',
+      'out/main/notes/index.js',
+      'out/renderer/assets/notes/help.md',
+      'resources/notes/help.md',
+      'notes.txt'
+    ]
+    const notesPaths =
+      kind === 'file'
+        ? ['notes']
+        : [
+            'notes/build.log',
+            'notes/installed-orca-backup/Orca.exe',
+            'notes/installed-orca-backup/resources/app.asar',
+            'notes/orca-windows-setup.exe',
+            'notes/.recovery/state.json'
+          ]
+    try {
+      for (const fixturePath of [...runtimePaths, ...notesPaths]) {
+        const file = join(source, fixturePath)
+        await mkdir(dirname(file), { recursive: true })
+        await writeFile(file, 'synthetic fixture\n')
+      }
+      if (kind === 'directory') {
+        await mkdir(join(source, 'notes', 'empty'))
+      }
+      const matcher = new FileMatcher(
+        source,
+        destination,
+        (value) => value,
+        electronBuilderConfig.files
+      )
+      // copyFiles adds the default include and prunes excluded directories during traversal.
+      await copyFiles([matcher])
+      for (const runtimePath of runtimePaths) {
+        expect(await readFile(join(destination, runtimePath), 'utf8')).toBe('synthetic fixture\n')
+      }
+      const isPacked = matcher.createFilter()
+      for (const notesPath of new Set(['notes', ...notesPaths])) {
+        const file = join(source, notesPath)
+        expect(isPacked(file, await lstat(file)), notesPath).toBe(false)
+      }
+      expect(existsSync(join(destination, 'notes'))).toBe(false)
+    } finally {
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
   // Why: `files` is an all-negation list, so electron-builder's default `**/*` packs
   // anything without an explicit `!` entry — examples/ landed without one and shipped
   // hostile-panel, the adversarial containment fixture, into 1.4.160-rc.3's app.asar.
diff --git a/config/scripts/electron-builder-runtime-resources.test.mjs b/config/scripts/electron-builder-runtime-resources.test.mjs
index 77f45f62113..f74c1c09e01 100644
--- a/config/scripts/electron-builder-runtime-resources.test.mjs
+++ b/config/scripts/electron-builder-runtime-resources.test.mjs
@@ -527,6 +527,8 @@ describe('packaged runtime resources', () => {
   )
 })
 
+const BUN_RUNTIME_BUILTINS = new Set(['bun:ffi', 'bun:sqlite'])
+
 // Why source-anchored: the bundler renames a createRequire()'d require, so
 // verifyPackagedMainRuntimeDeps' `require("x")` scan cannot see these specifiers — packaging
 // stays green while the packaged app throws MODULE_NOT_FOUND the first time the path runs.
@@ -555,7 +557,7 @@ function collectLazyRequireSpecifiers(directory, found = new Map()) {
       continue
     }
     for (const match of source.matchAll(/\brequire[A-Za-z0-9_]*\(\s*'([^']+)'\s*\)/g)) {
-      if (isPackagedExternalSpecifier(match[1])) {
+      if (!BUN_RUNTIME_BUILTINS.has(match[1]) && isPackagedExternalSpecifier(match[1])) {
         found.set(match[1], relative(projectRoot, entryPath).replaceAll('\\', '/'))
       }
     }
@@ -572,6 +574,26 @@ function packagedResourceDestinations(platform) {
 }
 
 describe('lazily required packages reach Resources/node_modules', () => {
+  it('excludes Bun runtime builtins while retaining ordinary lazy dependencies', async () => {
+    const sourceDir = await mkdtemp(join(tmpdir(), 'orca-lazy-bun-builtins-'))
+    try {
+      await writeFile(
+        join(sourceDir, 'runtime.ts'),
+        [
+          'const requireFromMain = createRequire(import.meta.url)',
+          "requireFromMain('node:fs')",
+          "requireFromMain('bun:ffi')",
+          "requireFromMain('bun:sqlite')",
+          "requireFromMain('zod')",
+          "requireFromMain('bun-sqlite')"
+        ].join('\n')
+      )
+      expect([...collectLazyRequireSpecifiers(sourceDir).keys()]).toEqual(['zod', 'bun-sqlite'])
+    } finally {
+      await removeTree(sourceDir)
+    }
+  })
+
   it('copies every createRequire specifier main uses into the packaged resource plan', () => {
     const specifiers = collectLazyRequireSpecifiers(join(projectRoot, 'src', 'main'))
     expect(specifiers.size).toBeGreaterThan(0)
diff --git a/config/scripts/electron-runtime-floor.test.ts b/config/scripts/electron-runtime-floor.test.ts
index 77a1d4741e0..3506b736398 100644
--- a/config/scripts/electron-runtime-floor.test.ts
+++ b/config/scripts/electron-runtime-floor.test.ts
@@ -7,10 +7,12 @@ import { describe, expect, it } from 'vitest'
  * around `gtk_init()` while FontConfig warmed up on a pool thread, and below
  * glibc 2.41 that frees `environ` under a concurrent `getenv()` — a launch-time
  * use-after-free on every Ubuntu we support (stablyai/orca#20081). 43.7.0 stops
- * freeing the published `environ`. A downgrade past it re-ships that crash, and
- * nothing else in the tree would notice.
+ * freeing the published `environ`. 43.7.0 itself threw `Invalid guestInstanceId` when a
+ * loaded `<webview>` left the DOM, which blanked browser tabs React re-inserted
+ * (electron/electron#53989); 43.7.4 fixes it. A downgrade past either re-ships the bug,
+ * and nothing else in the tree would notice.
  */
-const MINIMUM_ELECTRON_VERSION = '43.7.0'
+const MINIMUM_ELECTRON_VERSION = '43.7.4'
 
 function parseVersion(specifier: string): [number, number, number] {
   const match = /(\d+)\.(\d+)\.(\d+)/.exec(specifier)
@@ -35,15 +37,17 @@ describe('electron runtime floor', () => {
   it.each([
     ['42.9.0', false],
     ['43.6.0', false],
-    ['43.7.0', true],
-    ['43.7.1', true],
+    ['43.7.0', false],
+    ['43.7.3', false],
+    ['43.7.4', true],
+    ['43.7.5', true],
     ['43.8.0', true],
     ['44.0.0', true]
   ])('reads %s as meeting the floor: %s', (specifier, expected) => {
     expect(meetsRuntimeFloor(specifier)).toBe(expected)
   })
 
-  it('pins Electron at or above the glibc environ-race fix', () => {
+  it('pins Electron at or above the glibc environ-race and webview-detach fixes', () => {
     const packageJson = JSON.parse(
       readFileSync(join(__dirname, '../../package.json'), 'utf-8')
     ) as { devDependencies: Record<string, string> }
diff --git a/config/scripts/electron-vite-output-contract.test.ts b/config/scripts/electron-vite-output-contract.test.ts
index 285b58f2ac7..da6d45c8a23 100644
--- a/config/scripts/electron-vite-output-contract.test.ts
+++ b/config/scripts/electron-vite-output-contract.test.ts
@@ -20,9 +20,6 @@ import { createRequire } from 'node:module'
 import { electronViteConfig } from '../../electron.vite.config'
 import { BOOTSTRAP_FATAL_EXIT_GUARD_KEY } from '../../src/main/startup/bootstrap-fatal-exit-guard'
 
-const targetConfig = readFileSync('config/electron-vite-target.config.cts', 'utf8')
-const devRunner = readFileSync('config/scripts/run-electron-vite-dev.mjs', 'utf8')
-
 type BootstrapProcessMock = EventEmitter & {
   env: Record<string, string>
   pid: number
@@ -73,9 +70,7 @@ function failBootstrapWithBanner(options: {
   return processMock
 }
 
-const electronBuilderConfig = createRequire(import.meta.url)('../electron-builder.config.cjs') as {
-  files: string[]
-}
+const electronBuilderConfig = createRequire(import.meta.url)('../electron-builder.config.cjs')
 
 describe('Electron Vite output contract', () => {
   it("minifies main and renderer with rolldown's in-process minifier", () => {
@@ -104,6 +99,37 @@ describe('Electron Vite output contract', () => {
     expect(output.chunkFileNames).toBe('chunks/[name]-[hash].js')
   })
 
+  it('keeps offline profile-state CLI imports unpacked at stable paths', () => {
+    const input = electronViteConfig.main?.build?.rollupOptions?.input
+    if (!input || typeof input !== 'object' || Array.isArray(input)) {
+      throw new Error('Expected named main-process inputs')
+    }
+
+    for (const name of [
+      'orca-profiles/profile-index-store',
+      'persistence/profile-state/profile-state-access',
+      'persistence/profile-state/profile-state-active-location',
+      'persistence/profile-state/profile-state-backup-path',
+      'persistence/profile-state/profile-state-database-recovery',
+      'persistence/profile-state/profile-state-domain-reader',
+      'persistence/profile-state/legacy-json/profile-state-export-path',
+      'persistence/profile-state/profile-state-offline-settings',
+      'persistence/profile-state/legacy-json/profile-state-recovery',
+      'persistence/profile-state/profile-state-recovery-command',
+      'persistence/profile-state/profile-state-storage-classification',
+      'startup/http1-compatibility-marker'
+    ]) {
+      expect(input).toHaveProperty(name)
+    }
+    expect(electronBuilderConfig.asarUnpack).toContain('out/main/persistence/profile-state/**')
+    expect(electronBuilderConfig.asarUnpack).toContain(
+      'out/main/orca-profiles/profile-index-store.js'
+    )
+    expect(electronBuilderConfig.asarUnpack).toContain(
+      'out/main/startup/http1-compatibility-marker.js'
+    )
+  })
+
   it('externalizes packaged dependencies but bundles self-contained main dependencies', () => {
     const external = electronViteConfig.main?.build?.rollupOptions?.external
     if (typeof external !== 'function') {
@@ -224,11 +250,6 @@ describe('Electron Vite output contract', () => {
     )
   })
 
-  it('rejects prototype properties as build targets', () => {
-    // Own-property check only: an inherited key like `constructor` must not select a build target.
-    expect(targetConfig).toContain('Object.hasOwn(configByTarget, target)')
-  })
-
   it('gives the dev terminal daemon helper the TCC identity watched by Orca', () => {
     // Asserted on the values rather than the source text: the ids moved into
     // dev-electron-bundle-identity.mjs so every dev bundle signs to one cdhash.
@@ -236,7 +257,5 @@ describe('Electron Vite output contract', () => {
     expect(getDevHelperPlistPatches()).toEqual([
       { key: 'CFBundleIdentifier', value: DEV_HELPER_BUNDLE_ID }
     ])
-    expect(devRunner).toContain("'Electron Helper.app',")
-    expect(devRunner).toContain('setPlistValue(helperPlistPath, key, value)')
   })
 })
diff --git a/config/scripts/generate-monaco-associations.mjs b/config/scripts/generate-monaco-associations.mjs
new file mode 100644
index 00000000000..b5c2e99c00a
--- /dev/null
+++ b/config/scripts/generate-monaco-associations.mjs
@@ -0,0 +1,79 @@
+import { readFileSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { dirname, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import ts from 'typescript-api'
+
+const require = createRequire(import.meta.url)
+const editorEntry = require.resolve('monaco-editor/esm/vs/editor/editor.main.js')
+export const associationsPath = fileURLToPath(
+  new URL('../../src/renderer/src/lib/monaco-language-associations.json', import.meta.url)
+)
+
+// Read registration metadata without importing Monaco or executing its grammar loaders.
+export function readMonacoAssociations() {
+  const entry = ts.createSourceFile(
+    editorEntry,
+    readFileSync(editorEntry, 'utf8'),
+    ts.ScriptTarget.Latest
+  )
+  const files = entry.statements
+    .filter(ts.isImportDeclaration)
+    .map((node) => node.moduleSpecifier)
+    .filter(ts.isStringLiteral)
+    .map((node) => node.text)
+    .filter((path) => path.endsWith('.contribution.js'))
+  const registrations = []
+  for (const file of files) {
+    const path = resolve(dirname(editorEntry), file)
+    const source = ts.createSourceFile(path, readFileSync(path, 'utf8'), ts.ScriptTarget.Latest)
+    function visit(node) {
+      if (
+        ts.isCallExpression(node) &&
+        ['registerLanguage', 'languages.register'].includes(node.expression.getText(source))
+      ) {
+        const [argument] = node.arguments
+        if (!argument || !ts.isObjectLiteralExpression(argument)) {
+          throw new Error(`Unsupported Monaco registration in ${file}`)
+        }
+        const metadata = { id: '', extensions: [], filenames: [] }
+        for (const property of argument.properties) {
+          if (!ts.isPropertyAssignment(property)) {
+            continue
+          }
+          const key = property.name.getText(source)
+          if (!['id', 'extensions', 'filenames'].includes(key)) {
+            continue
+          }
+          const value = property.initializer
+          if (key === 'id' && ts.isStringLiteral(value)) {
+            metadata.id = value.text
+          } else if (key !== 'id' && ts.isArrayLiteralExpression(value)) {
+            metadata[key] = value.elements.map((element) => {
+              if (!ts.isStringLiteral(element)) {
+                throw new Error(`Nonliteral association in ${file}`)
+              }
+              return element.text
+            })
+          } else {
+            throw new Error(`Unsupported ${key} in ${file}`)
+          }
+        }
+        if (!metadata.id) {
+          throw new Error(`Missing language id in ${file}`)
+        }
+        registrations.push(metadata)
+      }
+      ts.forEachChild(node, visit)
+    }
+    visit(source)
+  }
+  if (registrations.length < 80) {
+    throw new Error('Monaco registration entry point changed')
+  }
+  return registrations
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === import.meta.filename) {
+  writeFileSync(associationsPath, `${JSON.stringify(readMonacoAssociations(), null, 2)}\n`)
+}
diff --git a/config/scripts/generate-monaco-associations.test.mjs b/config/scripts/generate-monaco-associations.test.mjs
new file mode 100644
index 00000000000..0e7563cd49a
--- /dev/null
+++ b/config/scripts/generate-monaco-associations.test.mjs
@@ -0,0 +1,12 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+import { associationsPath, readMonacoAssociations } from './generate-monaco-associations.mjs'
+
+describe('Monaco filename associations', () => {
+  it('matches every registration shipped by the installed editor entry point', () => {
+    expect(
+      JSON.parse(readFileSync(associationsPath, 'utf8')),
+      'Run node config/scripts/generate-monaco-associations.mjs after upgrading Monaco'
+    ).toEqual(readMonacoAssociations())
+  })
+})
diff --git a/config/scripts/generate-runtime-required-english-catalog.mjs b/config/scripts/generate-runtime-required-english-catalog.mjs
index 67fb7cd4d44..93769b02bcc 100644
--- a/config/scripts/generate-runtime-required-english-catalog.mjs
+++ b/config/scripts/generate-runtime-required-english-catalog.mjs
@@ -3,11 +3,7 @@ import path from 'node:path'
 import process from 'node:process'
 import { pathToFileURL } from 'node:url'
 
-import {
-  collectLocalizationKeyReferences,
-  collectSourceFiles,
-  LOCALIZATION_SOURCE_ROOTS
-} from './verify-localization-catalog.mjs'
+import { collectLocalizationReferences } from './verify-localization-catalog.mjs'
 
 export const EN_CATALOG_RELATIVE_PATH = path.join(
   'src',
@@ -103,19 +99,6 @@ export function buildRuntimeRequiredCatalog(catalogEntries, requiredKeys) {
   return catalog
 }
 
-async function collectReferences(root) {
-  const references = []
-  for (const sourceRoot of LOCALIZATION_SOURCE_ROOTS) {
-    const files = await collectSourceFiles(root, path.join(root, sourceRoot))
-    for (const filePath of files) {
-      references.push(
-        ...collectLocalizationKeyReferences(filePath, await fs.readFile(filePath, 'utf8'), root)
-      )
-    }
-  }
-  return references
-}
-
 /**
  * Why not a byte-for-byte comparison: the shipped subset only has to be *safe*,
  * and safety is "every required entry is present, and nothing it ships
@@ -144,12 +127,12 @@ function reportKeys(label, keys) {
   }
 }
 
-export async function main(root = process.cwd(), argv = process.argv.slice(2)) {
+export async function main(root = process.cwd(), argv = process.argv.slice(2), sharedReferences) {
   const fix = argv.includes('--fix')
   const catalogEntries = flattenCatalogEntries(
     JSON.parse(await fs.readFile(path.join(root, EN_CATALOG_RELATIVE_PATH), 'utf8'))
   )
-  const references = await collectReferences(root)
+  const references = sharedReferences ?? (await collectLocalizationReferences(root))
   const requiredKeys = collectRuntimeRequiredKeys(catalogEntries, references)
   const outputPath = path.join(root, RUNTIME_REQUIRED_RELATIVE_PATH)
 
diff --git a/config/scripts/git-binary-compatibility-workflow.test.mjs b/config/scripts/git-binary-compatibility-workflow.test.mjs
index 35d2b5c60dc..c03c7973f6a 100644
--- a/config/scripts/git-binary-compatibility-workflow.test.mjs
+++ b/config/scripts/git-binary-compatibility-workflow.test.mjs
@@ -3,6 +3,8 @@ import { parse } from 'yaml'
 import { describe, expect, it } from 'vitest'
 
 const BASELINE_DIR = '~/.cache/orca-git-compat/git-2.25.5'
+const BASELINE_ACTION = './.github/actions/prepare-git-compatibility'
+const baselineSteps = parse(readFileSync(`${BASELINE_ACTION}/action.yml`, 'utf8')).runs.steps
 
 const gateSteps = () =>
   parse(readFileSync('.github/workflows/pr.yml', 'utf8')).jobs.git_compatibility.steps
@@ -23,7 +25,7 @@ describe('Git binary compatibility PR gate', () => {
   })
 
   it('builds the pinned baseline tarball into the cached directory', () => {
-    const run = stepNamed('Build the baseline Git binary')?.run
+    const run = baselineSteps.find((step) => step.name === 'Build the baseline Git binary')?.run
 
     expect(run).toContain('git-2.25.5.tar.gz')
     // Why asserted: the sha256 check only runs on the build path, so a cached binary
@@ -31,6 +33,9 @@ describe('Git binary compatibility PR gate', () => {
     expect(run).toContain('if [ -x "$source/git" ]; then')
     expect(run).toContain('41662c52fc16fec4963bfc41075e71f8ead6b5e386797eb6f9a1111ff95a8ddf')
     expect(run).toContain('-j"$(nproc)"')
+    expect(run).toContain('NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PYTHON=YesPlease git')
+    expect(run).toContain('sha256sum --check')
+    expect(run).toContain('find "$source" -name \'*.o\' -delete')
     // The cached path and the build path must be the same directory or the guard
     // above would rebuild on every run while still reporting a cache hit.
     expect(run).toContain('source="$HOME/.cache/orca-git-compat/git-2.25.5"')
@@ -38,20 +43,33 @@ describe('Git binary compatibility PR gate', () => {
 
   it('finishes the baseline build before the timed lanes start', () => {
     const steps = gateSteps()
-    const names = steps.map((step) => step.name)
+    const names = baselineSteps.map((step) => step.name)
     const cacheIndex = names.indexOf('Cache baseline Git build')
     const buildIndex = names.indexOf('Build the baseline Git binary')
-    const matrixIndex = names.indexOf('Verify Git binary compatibility matrix')
+    const prepareIndex = steps.findIndex((step) => step.uses === BASELINE_ACTION)
+    const matrixIndex = steps.findIndex(
+      (step) => step.name === 'Verify Git binary compatibility matrix'
+    )
 
     expect(cacheIndex).toBeGreaterThanOrEqual(0)
     expect(cacheIndex).toBeLessThan(buildIndex)
-    expect(buildIndex).toBeLessThan(matrixIndex)
+    expect(prepareIndex).toBeGreaterThanOrEqual(0)
+    expect(prepareIndex).toBeLessThan(matrixIndex)
     // Why asserted: each lane is bounded by Vitest's per-test timeout while it waits on
     // container starts, so a `make -j$(nproc)` sharing the runner shows up as a timeout
     // in whichever boundary case is running rather than as a slow build.
     expect(steps[matrixIndex].run).not.toContain('make -C')
-    expect(steps[cacheIndex].with.path).toBe(BASELINE_DIR)
-    expect(steps[cacheIndex].with.key).toContain('2.25.5')
+    expect(baselineSteps[cacheIndex].with.path).toBe(BASELINE_DIR)
+    expect(baselineSteps[cacheIndex].with.key).toBe(
+      'git-compat-baseline-${{ runner.os }}-${{ runner.arch }}-2.25.5'
+    )
+  })
+
+  it('warms the same baseline on main so newly opened PRs can restore it', () => {
+    const warmer = parse(readFileSync('.github/workflows/ci-cache-warmup.yml', 'utf8'))
+    expect(warmer.jobs.warm.steps.some((step) => step.uses === BASELINE_ACTION)).toBe(true)
+    expect(warmer.on.push.paths).toContain('.github/actions/prepare-git-compatibility/**')
+    expect(warmer.on.pull_request.paths).toContain('.github/actions/prepare-git-compatibility/**')
   })
 
   it('pulls every matrix image before any lane runs', () => {
diff --git a/config/scripts/git-pull-request-diff-base.mjs b/config/scripts/git-pull-request-diff-base.mjs
index 3e2021a1eb1..0dd5b825ef7 100644
--- a/config/scripts/git-pull-request-diff-base.mjs
+++ b/config/scripts/git-pull-request-diff-base.mjs
@@ -1,5 +1,6 @@
 import { execFileSync } from 'node:child_process'
 import process from 'node:process'
+import { pathToFileURL } from 'node:url'
 
 export function selectPullRequestDiffBase(requestedBase, headParents, eventName) {
   if (eventName === 'pull_request' && headParents.length >= 2) {
@@ -21,3 +22,15 @@ export function resolvePullRequestDiffBase(
     .split(/\s+/)
   return selectPullRequestDiffBase(requestedBase, headParents, eventName)
 }
+
+// Why a CLI: the workflow's inline gates used `git diff --merge-base "$BASE_SHA" "$HEAD_SHA"`,
+// which needs the payload base to be reachable and so forced a full-history checkout. Printing
+// the resolved base lets those steps diff against `HEAD^1` with the same logic the Node gates
+// already use, instead of each one open-coding it.
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const resolved = resolvePullRequestDiffBase(process.cwd(), process.argv[2])
+  if (!resolved) {
+    throw new Error('No diff base: pass the pull request base SHA, or run on a merge ref.')
+  }
+  process.stdout.write(`${resolved}\n`)
+}
diff --git a/config/scripts/headless-serve-shutdown-matrix.test.mjs b/config/scripts/headless-serve-shutdown-matrix.test.mjs
index 32878b219f5..fa9a9c6943f 100644
--- a/config/scripts/headless-serve-shutdown-matrix.test.mjs
+++ b/config/scripts/headless-serve-shutdown-matrix.test.mjs
@@ -135,6 +135,23 @@ describe('packaged shutdown matrix', () => {
     ).toBe(true)
   })
 
+  it('uses a restored image only as a build cache and still runs every oracle', async () => {
+    vi.stubEnv('ORCA_SHUTDOWN_FIXTURE_CACHE_IMAGE', 'sha256:restored-fixture')
+    try {
+      await run('--all-entrypoints')
+      const builds = commands().filter((args) => args[0] === 'build')
+      expect(builds).toHaveLength(1)
+      expect(builds[0]).toContain('--cache-from')
+      expect(builds[0]).toContain('sha256:restored-fixture')
+      expect(builds[0]).toContain('--platform')
+      expect(builds[0]).toContain('linux/amd64')
+      expect(signalRuns()).toHaveLength(6)
+      expect(commands().filter((args) => args[0] === 'run')).toHaveLength(8)
+    } finally {
+      vi.unstubAllEnvs()
+    }
+  })
+
   it('rejects ambiguous matrix overrides before invoking Docker', async () => {
     await expect(run('--all-entrypoints', '--entrypoint', 'launcher')).rejects.toThrow(
       'cannot be combined'
diff --git a/config/scripts/headless-serve-shutdown-workflow.test.mjs b/config/scripts/headless-serve-shutdown-workflow.test.mjs
index e9f70ffc6ab..d9de91f28da 100644
--- a/config/scripts/headless-serve-shutdown-workflow.test.mjs
+++ b/config/scripts/headless-serve-shutdown-workflow.test.mjs
@@ -4,53 +4,8 @@ import { parse } from 'yaml'
 import { describe, expect, it } from 'vitest'
 
 const workflow = parse(readFileSync('.github/workflows/pr.yml', 'utf8'))
-const headlessLinuxGuide = readFileSync('docs/reference/headless-linux-server.md', 'utf8')
-const signalCase = readFileSync('config/docker/headless-serve-shutdown/run-signal-case.sh', 'utf8')
-const shutdownDockerRunner = readFileSync(
-  'config/scripts/run-headless-serve-shutdown-docker.mjs',
-  'utf8'
-)
-const shutdownDockerfile = readFileSync('config/docker/headless-serve-shutdown/Dockerfile', 'utf8')
-const desktopStartupOracle = readFileSync(
-  'config/docker/headless-serve-shutdown/run-appimage-desktop-startup-case.sh',
-  'utf8'
-)
-const headlessLinuxProse = headlessLinuxGuide.replace(/\s+/g, ' ')
-
-function readSystemdUnitBlocks(doc, unitName) {
-  const escapedUnitName = unitName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
-  return [...doc.matchAll(new RegExp(`^# /etc/systemd/system/${escapedUnitName}$`, 'gm'))].map(
-    (match) => {
-      const start = match.index + match[0].length
-      const end = doc.indexOf('```', start)
-      const nextUnitHeaderOffset = doc.slice(start).search(/^# \/etc\/systemd\/system\/.+$/m)
-      const nextUnitHeader = nextUnitHeaderOffset === -1 ? -1 : start + nextUnitHeaderOffset
-      if (end === -1 || (nextUnitHeader !== -1 && end > nextUnitHeader)) {
-        throw new Error(`Missing closing code fence for ${unitName}`)
-      }
-      return doc.slice(start, end)
-    }
-  )
-}
 
 describe('headless serve shutdown PR gate', () => {
-  it('reads only exact, closed systemd unit blocks', () => {
-    expect(
-      readSystemdUnitBlocks('# /etc/systemd/system/orca-serveXservice\n```', 'orca-serve.service')
-    ).toEqual([])
-    expect(() =>
-      readSystemdUnitBlocks('# /etc/systemd/system/orca-serve.service\n', 'orca-serve.service')
-    ).toThrow('Missing closing code fence for orca-serve.service')
-    expect(() =>
-      readSystemdUnitBlocks(
-        '# /etc/systemd/system/orca-serve.service\n' +
-          'KillMode=mixed\n' +
-          '# /etc/systemd/system/other.service\n```',
-        'orca-serve.service'
-      )
-    ).toThrow('Missing closing code fence for orca-serve.service')
-  })
-
   it('packages Linux artifacts before running the Docker signal oracle', () => {
     const steps = workflow.jobs.package.steps
     const packageStep = steps.find((step) => step.name === 'Package unpacked app')
@@ -58,7 +13,8 @@ describe('headless serve shutdown PR gate', () => {
     const shutdownStep = steps.find((step) => step.name === 'Verify headless serve signal shutdown')
 
     expect(workflow.jobs.package['timeout-minutes']).toBe(90)
-    expect(packageStep.run).toContain('--linux AppImage deb rpm --x64 --publish never')
+    expect(packageStep.run).toContain('--linux dir --x64 --publish never')
+    expect(packageStep.run).toContain('node config/scripts/package-linux-formats.mjs')
     expect(markerStep.run).toContain('dpkg-deb --fsys-tarfile')
     expect(markerStep.run).toContain('rpm2cpio')
     expect(steps.indexOf(markerStep)).toBeGreaterThan(steps.indexOf(packageStep))
@@ -71,130 +27,4 @@ describe('headless serve shutdown PR gate', () => {
       steps.filter((step) => step.run?.includes('run-headless-serve-shutdown-docker.mjs'))
     ).toHaveLength(1)
   })
-
-  it('keeps readiness polling finite and leak-free', () => {
-    expect(signalCase).toContain('read_ready_line()')
-    expect(signalCase).toContain("sed -u -n 's/^[^{]*//p'")
-    expect(signalCase).toContain('startup_timeout_seconds=${ORCA_STARTUP_TIMEOUT_SECONDS:-180}')
-    expect(signalCase).toContain('startup_deadline=$((SECONDS + startup_timeout_seconds))')
-    expect(signalCase).toContain('while (( SECONDS < startup_deadline )); do')
-    expect(signalCase).toContain('kill -0 "$app_pid" 2>/dev/null || break')
-    expect(signalCase).toContain(
-      "jq's `inputs` waits for EOF even when wrapped in `first`, so a tail -F"
-    )
-    expect(signalCase).not.toContain('tail --pid=')
-  })
-
-  it('gives owned shutdown state a bounded cleanup grace', () => {
-    expect(signalCase).toContain('for shutdown_poll in {0..50}; do')
-    expect(signalCase).toContain('[[ -z "$listener_after" && -z "$owned_residue" ]]')
-    expect(signalCase).toContain('((${#survivors[@]} == 0))')
-    expect(signalCase).toContain('((shutdown_poll < 50)) && sleep 0.1')
-  })
-
-  it('checks that a serving-electron signal target owns the ready socket', () => {
-    const ssRecord =
-      'LISTEN 0 128 127.0.0.1:41235 0.0.0.0:* users:(("orca-ide",pid=23,fd=7),("orca-ide",pid=25,fd=8))'
-    expect([...ssRecord.matchAll(/pid=([0-9]+)/g)].map((match) => match[1])).toEqual(['23', '25'])
-    expect(signalCase).toContain(
-      'listener_before_pids=$(grep -oE \'pid=[0-9]+\' <<<"$listener_before" | cut -d= -f2 || true)'
-    )
-    expect(signalCase).toContain('signal_target_pid=$(head -n1 <<<"$listener_before_pids")')
-    expect(signalCase).toContain('outside the entrypoint process tree')
-  })
-
-  it('runs the original AppImage desktop startup oracle before extraction and signals', () => {
-    expect(shutdownDockerfile).toContain(
-      'COPY run-appimage-desktop-startup-case.sh /usr/local/bin/run-appimage-desktop-startup-case'
-    )
-    const startupCall = shutdownDockerRunner.indexOf(
-      'runDesktopStartupOracle({ image, appImage, platform })'
-    )
-    const extractionCall = shutdownDockerRunner.indexOf(
-      "'timeout --kill-after=10s 120s /input/orca.AppImage --appimage-extract"
-    )
-    const signalLoop = shutdownDockerRunner.indexOf("for (const signal of ['INT', 'TERM'])")
-    expect(startupCall).toBeGreaterThan(-1)
-    expect(extractionCall).toBeGreaterThan(startupCall)
-    expect(signalLoop).toBeGreaterThan(startupCall)
-    expect(shutdownDockerRunner).toContain("'/usr/local/bin/run-appimage-desktop-startup-case'")
-  })
-
-  it('preserves startup logs when the launcher exits before its marker', () => {
-    expect(desktopStartupOracle).toContain('signal_process_group TERM || true')
-    expect(desktopStartupOracle).toContain('signal_process_group KILL || true')
-    expect(desktopStartupOracle).toContain('cat "$stdout_log" >&2 2>/dev/null || true')
-    expect(desktopStartupOracle).toContain('cat "$stderr_log" >&2 2>/dev/null || true')
-    expect(desktopStartupOracle).toContain(
-      'FAIL: desktop launcher exited before ${reason} (status=${observed_status})'
-    )
-    expect(desktopStartupOracle).toContain('ORCA_STARTUP_STATE_DIR_CLEANUP=1')
-    expect(desktopStartupOracle).toContain(
-      '[[ "$state_dir" =~ ^/tmp/orca-appimage-startup\\.[^/]+$ ]] || return 0'
-    )
-  })
-
-  it('requires the bound AppImage to be executable before launch and extraction', () => {
-    expect(desktopStartupOracle).toContain(
-      '[[ -x "$appimage" ]] || { echo "FAIL: AppImage is not executable: $appimage" >&2; exit 1; }'
-    )
-    expect(shutdownDockerRunner).toContain(
-      '\'test -r /input/orca.AppImage && test -x /input/orca.AppImage || { echo "FAIL: AppImage bind must be readable and executable" >&2; exit 1; }\''
-    )
-  })
-
-  it('gives the original AppImage enough bounded extraction space', () => {
-    expect(shutdownDockerRunner).toContain("'/tmp:rw,nosuid,nodev,exec,size=1g'")
-  })
-
-  it('keeps owned Xvfb alive during the documented systemd graceful stop', () => {
-    const serveUnits = readSystemdUnitBlocks(headlessLinuxGuide, 'orca-serve.service')
-    const ownedXvfbUnits = serveUnits.filter((unit) => !/^Environment=DISPLAY=/m.test(unit))
-    const managedXvfbUnits = serveUnits.filter((unit) => /^Environment=DISPLAY=/m.test(unit))
-
-    expect(ownedXvfbUnits).toHaveLength(1)
-    expect(ownedXvfbUnits[0]).toMatch(/^ExecStart=.*orca-linux\.AppImage serve.*$/m)
-    expect(ownedXvfbUnits[0]).toMatch(/^KillMode=mixed$/m)
-    expect(managedXvfbUnits).toHaveLength(1)
-    expect(managedXvfbUnits[0]).toMatch(/^KillMode=mixed$/m)
-  })
-
-  it('distinguishes persisted state from live work during a service restart', () => {
-    expect(headlessLinuxProse).toContain(
-      'The detached terminal daemon is preserved by a different mechanism: it is launched through `systemd-run --user --scope`'
-    )
-    expect(headlessLinuxProse).toContain(
-      'These guarantees preserve live processes only when the daemon is in its own'
-    )
-    expect(headlessLinuxProse).toContain(
-      'The unscoped fallback remains destructive: a service restart kills every terminal'
-    )
-    expect(headlessLinuxProse).toContain(
-      'Treat a stop as destructive unless `health.terminalDaemon.cgroupUnit` names an `orca-daemon-*.scope` on that host'
-    )
-    expect(headlessLinuxProse).toContain(
-      'A separately paired runtime is outside that boundary; local execution and SSH hosts reached through this runtime are not. An affected or unknown omission, missing scope, failed request or lost connection is `unverifiable`'
-    )
-    expect(headlessLinuxGuide).toContain(
-      'sudo -Hu orca /home/orca/.local/bin/orca-ide terminal list --json'
-    )
-    expect(headlessLinuxGuide).not.toContain('sudo -Hu orca orca-ide terminal list --json')
-    expect(headlessLinuxGuide).not.toContain('Two facts make this safe and predictable')
-  })
-
-  it('uses the registered CLI name from ordinary Linux shells', () => {
-    const commandRule =
-      'The registered Linux CLI command is `orca-ide`, not `orca`, to avoid shadowing the GNOME Orca screen reader.'
-    const substitutionRule =
-      "From an ordinary shell outside that service user's managed environment, substitute `orca-ide` for `orca` in commands below."
-    const censusCommand = '`sudo -Hu orca /home/orca/.local/bin/orca-ide terminal list --json`'
-
-    expect(headlessLinuxProse).toContain(commandRule)
-    expect(headlessLinuxProse).toContain(substitutionRule)
-    expect(headlessLinuxProse).toContain(censusCommand)
-    expect(headlessLinuxGuide).toContain('best-effort dispatcher at `$HOME/.local/bin/orca`')
-    expect(headlessLinuxProse.indexOf(substitutionRule)).toBeLessThan(
-      headlessLinuxProse.indexOf(censusCommand)
-    )
-  })
 })
diff --git a/config/scripts/hourly-build-version.mjs b/config/scripts/hourly-build-version.mjs
index 9f6b9000844..2af342065ba 100644
--- a/config/scripts/hourly-build-version.mjs
+++ b/config/scripts/hourly-build-version.mjs
@@ -79,12 +79,16 @@ export function formatHourlyReleaseName(version, buildNumber, commit, date) {
 // base version, and the base is only known once the published tags have been
 // resolved just above. Computing it outside meant numbering against whatever
 // version the caller guessed.
-export function getHourlyBuildIdentity(now = new Date(), { publishedVersions, releaseNames } = {}) {
-  const packageJson = JSON.parse(readFileSync(resolve('package.json'), 'utf8'))
+export function getHourlyBuildIdentity(
+  now = new Date(),
+  { packageVersion, publishedVersions, releaseNames } = {}
+) {
+  const versionFromPackage =
+    packageVersion ?? JSON.parse(readFileSync(resolve('package.json'), 'utf8')).version
   const commit = execFileSync('git', ['rev-parse', '--short=12', 'HEAD'], {
     encoding: 'utf8'
   }).trim()
-  const base = resolveDevChannelBaseVersion(packageJson.version, publishedVersions ?? [])
+  const base = resolveDevChannelBaseVersion(versionFromPackage, publishedVersions ?? [])
   const version = createHourlyBuildVersion(base, now)
   const buildNumber = nextHourlyBuildNumber(base, releaseNames ?? [])
   return {
diff --git a/config/scripts/hourly-build-version.test.mjs b/config/scripts/hourly-build-version.test.mjs
index 7438b16acbd..dfb88c37332 100644
--- a/config/scripts/hourly-build-version.test.mjs
+++ b/config/scripts/hourly-build-version.test.mjs
@@ -129,6 +129,7 @@ describe('getHourlyBuildIdentity', () => {
   // install it.
   it('stays on the already-shipped hourly base after a buggy main release is unpublished', () => {
     const identity = getHourlyBuildIdentity(new Date('2026-09-14T20:00:00Z'), {
+      packageVersion: '1.4.201',
       publishedVersions: [
         'v1.4.201',
         'v1.4.202',
@@ -143,4 +144,14 @@ describe('getHourlyBuildIdentity', () => {
     expect(identity.version).toBe('1.4.203-hourly.202609142000')
     expect(identity.buildNumber).toBe(5)
   })
+
+  it('keeps a newer package version as the hourly base floor', () => {
+    const identity = getHourlyBuildIdentity(new Date('2026-09-14T20:00:00Z'), {
+      packageVersion: '1.4.214',
+      publishedVersions: ['v1.4.202', 'v1.4.203-hourly.202609140417'],
+      releaseNames: ['1.4.203 • 04 • Sep 13, 9:17PM • 2ce252f']
+    })
+    expect(identity.version).toBe('1.4.214-hourly.202609142000')
+    expect(identity.buildNumber).toBe(1)
+  })
 })
diff --git a/config/scripts/install-electron-package-binary.mjs b/config/scripts/install-electron-package-binary.mjs
index 63f575f1d9a..a9d2bd8c000 100644
--- a/config/scripts/install-electron-package-binary.mjs
+++ b/config/scripts/install-electron-package-binary.mjs
@@ -16,6 +16,7 @@ import { createRequire } from 'node:module'
 import { platform as osPlatform, tmpdir } from 'node:os'
 import { join, resolve } from 'node:path'
 import { getElectronPlatformPath } from './electron-platform-path.mjs'
+import { getZipExtractorCommand } from './zip-extractor-command.mjs'
 import {
   shareElectronDistFromCache,
   hasAdoptedSharedElectronDist,
@@ -448,33 +449,7 @@ function getExtractorCommand(zipPath, extractDir) {
     }
   }
 
-  if (osPlatform() === 'win32') {
-    return {
-      file: process.env.ORCA_POWERSHELL_BIN || 'powershell',
-      args: [
-        '-NoProfile',
-        '-NonInteractive',
-        '-ExecutionPolicy',
-        'Bypass',
-        '-Command',
-        [
-          "$ErrorActionPreference = 'Stop'",
-          `Expand-Archive -LiteralPath ${quotePowerShellLiteral(zipPath)} -DestinationPath ${quotePowerShellLiteral(extractDir)} -Force`
-        ].join('; ')
-      ],
-      label: 'powershell Expand-Archive'
-    }
-  }
-
-  return {
-    file: process.env.ORCA_UNZIP_BIN || 'unzip',
-    args: ['-q', zipPath, '-d', extractDir],
-    label: 'unzip'
-  }
-}
-
-function quotePowerShellLiteral(value) {
-  return `'${String(value).replaceAll("'", "''")}'`
+  return getZipExtractorCommand(zipPath, extractDir)
 }
 
 function formatExtractorFailure(command, result) {
diff --git a/config/scripts/install-node-dependencies-action.test.mjs b/config/scripts/install-node-dependencies-action.test.mjs
index 3b20a0eb07e..3006a0063da 100644
--- a/config/scripts/install-node-dependencies-action.test.mjs
+++ b/config/scripts/install-node-dependencies-action.test.mjs
@@ -7,6 +7,7 @@ import { describe, expect, it } from 'vitest'
 
 const action = parse(readFileSync('.github/actions/install-node-dependencies/action.yml', 'utf8'))
 const installScript = action.runs.steps.find((step) => step.name === 'Install dependencies').run
+const storeScript = action.runs.steps.find((step) => step.id === 'pnpm-store').run
 
 function run(command, args, options = {}) {
   return spawnSync(command, args, { encoding: 'utf8', ...options })
@@ -35,7 +36,10 @@ function createFixture() {
   ).toBe(0)
 
   const pnpm = join(bin, 'pnpm')
-  writeFileSync(pnpm, '#!/bin/sh\nexit 0\n')
+  writeFileSync(
+    pnpm,
+    '#!/bin/sh\nif [ "$1" = store ]; then printf "%s\\n" "$PNPM_TEST_STORE_PATH"; fi\nexit 0\n'
+  )
   chmodSync(pnpm, 0o755)
   return { bin, detachedCwd, root, workspace }
 }
@@ -52,6 +56,50 @@ function executeInstallScript(fixture) {
 }
 
 describe('install-node-dependencies action', () => {
+  it.each(['/home/runner/pnpm store/v11', 'C:\\Users\\runner\\pnpm store\\v11'])(
+    'preserves setup-node store path %s and lowercase architecture',
+    (storePath) => {
+      const fixture = createFixture()
+      const output = join(fixture.root, 'github-output')
+      try {
+        const result = run('bash', ['-e', '-o', 'pipefail', '-c', storeScript], {
+          env: {
+            ...process.env,
+            GITHUB_OUTPUT: output,
+            LOCKFILE_HASH: 'lockfile-digest',
+            PNPM_TEST_STORE_PATH: storePath,
+            PATH: `${fixture.bin}${delimiter}${process.env.PATH}`
+          }
+        })
+        expect(result.status, result.stderr || result.stdout).toBe(0)
+        expect(readFileSync(output, 'utf8')).toBe(`path=${storePath}\narch=${process.arch}\n`)
+      } finally {
+        rmSync(fixture.root, { recursive: true, force: true })
+      }
+    }
+  )
+
+  it.each([
+    ['', 'store'],
+    ['lockfile-digest', '']
+  ])('rejects a missing lockfile hash or store path (%s, %s)', (hash, storePath) => {
+    const fixture = createFixture()
+    try {
+      const result = run('bash', ['-e', '-o', 'pipefail', '-c', storeScript], {
+        env: {
+          ...process.env,
+          GITHUB_OUTPUT: join(fixture.root, 'github-output'),
+          LOCKFILE_HASH: hash,
+          PNPM_TEST_STORE_PATH: storePath,
+          PATH: `${fixture.bin}${delimiter}${process.env.PATH}`
+        }
+      })
+      expect(result.status).toBe(1)
+    } finally {
+      rmSync(fixture.root, { recursive: true, force: true })
+    }
+  })
+
   it('skips the lockfile diff when a job container has no Git metadata', () => {
     const fixture = createFixture()
     try {
diff --git a/config/scripts/linux-package-fixture-cache.test.mjs b/config/scripts/linux-package-fixture-cache.test.mjs
new file mode 100644
index 00000000000..1247d70bbca
--- /dev/null
+++ b/config/scripts/linux-package-fixture-cache.test.mjs
@@ -0,0 +1,120 @@
+import { chmodSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { delimiter, join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { runProcessSync } from '../../src/shared/child-process/run-process'
+
+const action = parse(
+  readFileSync('.github/actions/prepare-linux-package-fixture/action.yml', 'utf8')
+)
+const load = action.runs.steps.find((step) => step.id === 'image')
+const workflow = (name) => parse(readFileSync(`.github/workflows/${name}.yml`, 'utf8'))
+let directory
+
+afterEach(() => {
+  if (directory) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function exercise({ hit = false, save = false, loadFails = false, inspectFails = false } = {}) {
+  directory = mkdtempSync(join(tmpdir(), 'orca-package-cache-'))
+  const bin = join(directory, 'bin')
+  mkdirSync(bin)
+  const commandLog = join(directory, 'commands')
+  const output = join(directory, 'output')
+  writeFileSync(commandLog, '')
+  writeFileSync(output, '')
+  const docker = join(bin, 'docker')
+  writeFileSync(
+    docker,
+    '#!/bin/bash\n' +
+      'echo "$*" >> "$COMMAND_LOG"\n' +
+      'if [[ "$1" == load && "$LOAD_FAILS" == true ]]; then exit 1; fi\n' +
+      'if [[ "$1 $2" == "image inspect" ]]; then\n' +
+      '  if [[ "$INSPECT_FAILS" == true ]]; then exit 1; fi\n' +
+      '  echo sha256:fixture-image\n' +
+      'fi\n'
+  )
+  chmodSync(docker, 0o755)
+  const result = runProcessSync({
+    program: 'bash',
+    args: ['-c', load.run],
+    env: {
+      ...process.env,
+      ORCA_BACKGROUND_LAUNCH: '1',
+      PATH: `${bin}${delimiter}${process.env.PATH ?? ''}`,
+      RUNNER_TEMP: directory,
+      GITHUB_OUTPUT: output,
+      COMMAND_LOG: commandLog,
+      FIXTURE: 'cli-launch-contract',
+      CACHE_HIT: String(hit),
+      SAVE_CACHE: String(save),
+      LOAD_FAILS: String(loadFails),
+      INSPECT_FAILS: String(inspectFails)
+    },
+    timeoutMs: 10_000
+  })
+  expect(result.code, result.stderr).toBe(0)
+  return { commands: readFileSync(commandLog, 'utf8'), output: readFileSync(output, 'utf8') }
+}
+
+describe.runIf(process.platform !== 'win32')('fixture cache fallbacks', () => {
+  it('leaves a PR cache miss to the existing runner without building or exporting', () => {
+    expect(exercise()).toEqual({ commands: '', output: '' })
+  })
+
+  it.each([{ loadFails: true }, { inspectFails: true }])(
+    'discards an unusable restored cache: %j',
+    (failure) => {
+      const result = exercise({ hit: true, ...failure })
+      expect(result.output).toBe('')
+      expect(result.commands).toContain('load --input')
+      expect(result.commands).not.toMatch(/(?:build|save) /)
+    }
+  )
+
+  it('returns the local image tag after a successful load', () => {
+    const result = exercise({ hit: true })
+    expect(result.output).toBe('image=orca-package-fixture-cli-launch-contract:cache\n')
+    expect(result.commands).not.toMatch(/(?:build|save) /)
+  })
+
+  it('builds and exports inline cache only when the warmer has no usable image', () => {
+    const result = exercise({ save: true })
+    expect(result.commands).toContain(
+      'build --platform linux/amd64 --build-arg BUILDKIT_INLINE_CACHE=1'
+    )
+    expect(result.commands).toContain(
+      '--file config/docker/cli-launch-contract/Dockerfile config/docker/cli-launch-contract'
+    )
+    expect(result.commands).toContain('save --output')
+    expect(result.output).toBe('image=orca-package-fixture-cli-launch-contract:cache\nbuilt=true\n')
+  })
+})
+
+it('uses exact context/platform keys and the same restore-only action in package checks', () => {
+  const cache = action.runs.steps.find((step) => step.id === 'cache')
+  expect(cache.with.key).toContain('linux-amd64')
+  expect(cache.with.key).toContain("format('config/docker/{0}/**', inputs.fixture)")
+  expect(cache.with.key).toContain('.github/actions/prepare-linux-package-fixture/action.yml')
+  expect(cache.with['restore-keys']).toBeUndefined()
+  expect(action.inputs['save-cache'].default).toBe('false')
+  const prepared = workflow('pr').jobs.package.steps.filter((step) =>
+    step.uses?.endsWith('/prepare-linux-package-fixture')
+  )
+  expect(prepared.map((step) => step.with)).toEqual([
+    { fixture: 'headless-serve-shutdown' },
+    { fixture: 'cli-launch-contract' }
+  ])
+  const warm = workflow('ci-cache-warmup').jobs['warm-linux-package-fixtures']
+  expect(warm.steps.slice(1).map((step) => step.with.fixture)).toEqual(
+    prepared.map((step) => step.with.fixture)
+  )
+  expect(
+    warm.steps
+      .slice(1)
+      .every((step) => step.with['save-cache'] === "${{ github.event_name != 'pull_request' }}")
+  ).toBe(true)
+})
diff --git a/config/scripts/locale-translation-policy.mjs b/config/scripts/locale-translation-policy.mjs
index af88805b8c4..75f50d15ff6 100644
--- a/config/scripts/locale-translation-policy.mjs
+++ b/config/scripts/locale-translation-policy.mjs
@@ -38,6 +38,7 @@ export const NEVER_TRANSLATE_VALUES = new Set([
   'Claude Agent Teams',
   'Cline',
   'Codebuff',
+  'Freebuff',
   'Codex',
   'Command Code',
   'Cursor',
diff --git a/config/scripts/localization-extraction-call-syntax.test.mjs b/config/scripts/localization-extraction-call-syntax.test.mjs
new file mode 100644
index 00000000000..125fe9c4fcb
--- /dev/null
+++ b/config/scripts/localization-extraction-call-syntax.test.mjs
@@ -0,0 +1,56 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { findKeys } from 'i18next-cli'
+import { describe, expect, it } from 'vitest'
+
+const require = createRequire(import.meta.url)
+const commonJsFindKeys = require('i18next-cli').findKeys
+
+const calls = {
+  normal: "translate('probe.normal', 'Normal')",
+  block: "translate /* comment */ ('probe.block', 'Block')",
+  line: "translate\n// comment\n('probe.line', 'Line')",
+  member: "i18n./* member */t /* call */ ('probe.member', 'Member')",
+  optional: "translate?. /* optional */ ('probe.optional', 'Optional')",
+  generic: "translate /* generic */ <string>('probe.generic', 'Generic')",
+  dollar: "$api.t /* member */ ('probe.dollar', 'Dollar')",
+  unicode: "transl\\u0061te('probe.unicode', 'Unicode')"
+}
+
+describe.each([
+  ['ES module', findKeys],
+  ['CommonJS', commonJsFindKeys]
+])('localization extraction through %s', (_name, extractKeys) => {
+  it('keeps keys in calls containing comments or escaped identifiers', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-extraction-syntax-'))
+    try {
+      for (const [name, source] of Object.entries(calls)) {
+        writeFileSync(join(directory, `${name}.ts`), source)
+      }
+      const errors = []
+      const result = await extractKeys(
+        {
+          locales: ['en'],
+          extract: {
+            input: [join(directory, '*.ts').replaceAll('\\', '/')],
+            defaultNS: false,
+            functions: ['t', '*.t', 'translate'],
+            disablePlurals: true
+          }
+        },
+        undefined,
+        errors
+      )
+      expect(errors).toEqual([])
+      expect([...result.allKeys.values()].map((entry) => entry.key).sort()).toEqual(
+        Object.keys(calls)
+          .map((name) => `probe.${name}`)
+          .sort()
+      )
+    } finally {
+      rmSync(directory, { recursive: true, force: true })
+    }
+  })
+})
diff --git a/config/scripts/localization-extraction-change-scope.mjs b/config/scripts/localization-extraction-change-scope.mjs
new file mode 100644
index 00000000000..21fccd98d9b
--- /dev/null
+++ b/config/scripts/localization-extraction-change-scope.mjs
@@ -0,0 +1,32 @@
+import { readFileSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
+
+const TOOLCHAIN_FILES = new Set([
+  'package.json',
+  'pnpm-lock.yaml',
+  'pnpm-workspace.yaml',
+  'tsconfig.json',
+  '.npmrc',
+  '.pnpmfile.cjs',
+  '.github/workflows/pr.yml'
+])
+
+export function affectsLocalizationExtraction(paths) {
+  return paths.some(
+    (path) =>
+      TOOLCHAIN_FILES.has(path) ||
+      // Include all source paths so catalog moves and future extractor inputs stay covered.
+      path.startsWith('src/') ||
+      path.startsWith('config/i18next.') ||
+      path.startsWith('config/tsconfig') ||
+      path.startsWith('config/patches/') ||
+      path.startsWith('config/scripts/localization-') ||
+      path.startsWith('config/scripts/verify-localization-') ||
+      path.startsWith('.github/actions/install-node-dependencies/')
+  )
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const changed = readFileSync(process.argv[2], 'utf8').split('\0').filter(Boolean)
+  process.stdout.write(`${affectsLocalizationExtraction(changed)}\n`)
+}
diff --git a/config/scripts/localization-extraction-change-scope.test.mjs b/config/scripts/localization-extraction-change-scope.test.mjs
new file mode 100644
index 00000000000..8852965ad30
--- /dev/null
+++ b/config/scripts/localization-extraction-change-scope.test.mjs
@@ -0,0 +1,59 @@
+import { readFileSync } from 'node:fs'
+import { expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { affectsLocalizationExtraction } from './localization-extraction-change-scope.mjs'
+
+it.each([
+  'src/renderer/src/components/Example.tsx',
+  'src/main/notifications.ts',
+  'src/renderer/src/i18n/locales/en.json',
+  'config/i18next.config.ts',
+  'config/scripts/verify-localization-extraction.mjs',
+  'config/scripts/localization-extraction-change-scope.mjs',
+  'config/patches/i18next-cli.patch',
+  'package.json',
+  'pnpm-lock.yaml',
+  'pnpm-workspace.yaml',
+  'tsconfig.json',
+  'config/tsconfig.web.json',
+  '.npmrc',
+  '.pnpmfile.cjs',
+  '.github/workflows/pr.yml',
+  '.github/actions/install-node-dependencies/action.yml'
+])('retains extraction when an input changes: %s', (path) => {
+  expect(affectsLocalizationExtraction([path])).toBe(true)
+})
+
+it('avoids extraction for unrelated CI, documentation, and native changes', () => {
+  expect(
+    affectsLocalizationExtraction([
+      '.github/workflows/e2e.yml',
+      'config/scripts/run-ssh-docker-e2e.mjs',
+      'docs/reference/ci-runner-efficiency.md',
+      'native/windows-registry/src/addon.cc'
+    ])
+  ).toBe(false)
+})
+
+it('preserves deleted and renamed inputs and falls back to extraction on detection failure', () => {
+  const workflow = parse(
+    readFileSync(new URL('../../.github/workflows/pr.yml', import.meta.url), 'utf8')
+  )
+  const step = workflow.jobs.static_analysis.steps.find(
+    (candidate) => candidate.name === 'Verify localization extraction'
+  )
+  expect(step.env).toEqual({
+    BASE_SHA: '${{ github.event.pull_request.base.sha }}'
+  })
+  // The base side comes from the merge ref's first parent, so the gate needs no merge base and
+  // works on a shallow checkout. The payload head SHA is no longer read: HEAD is the merged tree
+  // the gate is actually deciding about.
+  expect(step.run).toContain('node config/scripts/git-pull-request-diff-base.mjs "$BASE_SHA"')
+  expect(step.run).toContain('git diff --name-only --no-renames -z "$DIFF_BASE" HEAD')
+  expect(step.run).not.toContain('--diff-filter')
+  expect(step.run).toContain('&& [ "$scope" = false ]; then')
+  expect(step.run).toMatch(/else\s+pnpm run verify:localization-extraction\s+fi/)
+  expect(
+    affectsLocalizationExtraction(['src/old-translations.ts', 'docs/moved-translations.ts'])
+  ).toBe(true)
+})
diff --git a/config/scripts/localization-package-contract.test.mjs b/config/scripts/localization-package-contract.test.mjs
index 9e744939bfc..2ede8365e9e 100644
--- a/config/scripts/localization-package-contract.test.mjs
+++ b/config/scripts/localization-package-contract.test.mjs
@@ -14,7 +14,10 @@ describe('localization package scripts', () => {
   it('keeps the runtime-required English subset generated and checked', () => {
     expect(scripts['verify:localization-runtime-catalog']).toBeDefined()
     expect(scripts['sync:localization-runtime-catalog']).toBeDefined()
-    expect(scripts.lint).toContain('verify:localization-runtime-catalog')
+    expect(scripts['verify:localization-catalogs']).toBe(
+      'node config/scripts/verify-localization-catalogs.mjs'
+    )
+    expect(scripts.lint).toContain('verify:localization-catalogs')
   })
 
   it('does not expose whole-catalog translation and repair commands', () => {
diff --git a/config/scripts/mobile-recording-pin-checkout.test.mjs b/config/scripts/mobile-recording-pin-checkout.test.mjs
new file mode 100644
index 00000000000..7ff6251afd6
--- /dev/null
+++ b/config/scripts/mobile-recording-pin-checkout.test.mjs
@@ -0,0 +1,96 @@
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { runProcessSync } from './script-child-process.mjs'
+
+const workflow = parse(
+  readFileSync(new URL('../../.github/workflows/mobile.yml', import.meta.url), 'utf8')
+)
+
+it('keeps full ancestry and credentials for lazy pinned-tree reads', () => {
+  const job = workflow.jobs['recording-pin']
+  const checkout = job.steps.find((step) => step.uses?.startsWith('actions/checkout@'))
+  expect(checkout.with['fetch-depth']).toBe(0)
+  expect(checkout.with.filter).toBe('blob:none')
+  expect(checkout.with['persist-credentials']).not.toBe(false)
+  expect(job.if).toBeUndefined()
+  expect(workflow.on.push.branches).toEqual(['main'])
+  expect(workflow.concurrency.group).toContain('github.sha')
+  const reachable = job.steps.find((step) => step.name === 'Check the recording pin is reachable')
+  expect(reachable.run).toBe('pnpm exec tsx scripts/rpc-recording-pin-guard.mts reachable')
+  const reproduce = job.steps.find(
+    (step) => step.name === 'Reproduce the corpus from the pinned tree'
+  )
+  // Both steps ask GitHub which pull requests hold a pin main's history lacks.
+  expect(job.permissions).toEqual({ contents: 'read', 'pull-requests': 'read' })
+  expect(reachable.env.GITHUB_TOKEN).toContain('github.token')
+  expect(reproduce.env.GITHUB_TOKEN).toContain('github.token')
+  expect(reproduce.run).toContain('reproduce --if-changed-since "$PIN_GUARD_BASE"')
+  expect(reproduce.run).toContain(
+    'else\n  pnpm exec tsx scripts/rpc-recording-pin-guard.mts reproduce\nfi'
+  )
+})
+
+it('retains ancestry while fetching a missing pinned blob for a detached worktree', () => {
+  const directory = mkdtempSync(join(tmpdir(), 'mobile-pin-checkout-'))
+  const source = join(directory, 'source')
+  const checkout = join(directory, 'checkout')
+  const pinnedTree = join(directory, 'pinned-tree')
+  const git = (cwd, ...args) => {
+    const result = runProcessSync({ program: 'git', args, cwd })
+    expect(result.code, result.stderr).toBe(0)
+    return result.stdout.trim()
+  }
+  try {
+    git(directory, 'init', '--quiet', source)
+    git(source, 'symbolic-ref', 'HEAD', 'refs/heads/main')
+    git(source, 'config', 'user.name', 'Pin checkout fixture')
+    git(source, 'config', 'user.email', 'pin-checkout@example.invalid')
+    git(source, 'config', 'uploadpack.allowFilter', 'true')
+    git(source, 'config', 'uploadpack.allowAnySHA1InWant', 'true')
+    const corpus = 'mobile/rpc-foundation/goldens/fixture.json'
+    mkdirSync(join(source, 'mobile/rpc-foundation/goldens'), { recursive: true })
+    const original = '{"baseline":"original historical recording"}\n'
+    const commit = () => {
+      git(source, 'add', '-A')
+      git(source, '-c', 'commit.gpgsign=false', 'commit', '--quiet', '-m', 'recording')
+      return git(source, 'rev-parse', 'HEAD')
+    }
+    writeFileSync(join(source, corpus), original)
+    const baseline = commit()
+    const oldBlob = git(source, 'rev-parse', `${baseline}:${corpus}`)
+    writeFileSync(join(source, corpus), '{"baseline":"current recording"}\n')
+    commit()
+    git(
+      directory,
+      'clone',
+      '--filter=blob:none',
+      '--no-checkout',
+      '--single-branch',
+      '--no-tags',
+      pathToFileURL(source).href,
+      checkout
+    )
+    git(checkout, 'checkout', '--quiet', '--force', 'main')
+
+    expect(git(checkout, 'rev-parse', '--is-shallow-repository')).toBe('false')
+    expect(git(checkout, 'rev-list', '--count', 'HEAD')).toBe('2')
+    git(checkout, 'merge-base', '--is-ancestor', baseline, 'HEAD')
+    expect(git(checkout, 'rev-list', '--objects', '--missing=print', 'HEAD')).toContain(
+      `?${oldBlob}`
+    )
+
+    git(checkout, 'worktree', 'add', '--detach', pinnedTree, baseline)
+
+    expect(readFileSync(join(pinnedTree, corpus), 'utf8')).toBe(original)
+    expect(git(checkout, 'rev-list', '--objects', '--missing=print', 'HEAD')).not.toContain(
+      `?${oldBlob}`
+    )
+    git(checkout, 'worktree', 'remove', '--force', pinnedTree)
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
diff --git a/config/scripts/mobile-release-check-scope.mjs b/config/scripts/mobile-release-check-scope.mjs
new file mode 100644
index 00000000000..435d3e6fccc
--- /dev/null
+++ b/config/scripts/mobile-release-check-scope.mjs
@@ -0,0 +1,31 @@
+import { appendFileSync, readFileSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
+import { isDocsOnlyPath } from './pr-code-change-scope.mjs'
+
+const APPLICATION_PREFIXES = ['src/', 'mobile/app/', 'mobile/src/']
+
+export function shouldRunMobileReleaseChecks(files) {
+  return (
+    files.length === 0 ||
+    files.some(
+      (file) =>
+        !isDocsOnlyPath(file) &&
+        file !== 'mobile/README.md' &&
+        !file.startsWith('mobile/docs/') &&
+        !(
+          APPLICATION_PREFIXES.some((prefix) => file.startsWith(prefix)) &&
+          /\.(?:[cm]?[jt]sx?|css|md)$/.test(file)
+        )
+    )
+  )
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const input = readFileSync(process.argv[2], 'utf8')
+  const files = input.endsWith('\0') ? input.slice(0, -1).split('\0') : []
+  const shouldRun = shouldRunMobileReleaseChecks(files)
+  console.log(
+    shouldRun ? 'Checking Ruby release inputs.' : 'Only application or documentation changed.'
+  )
+  appendFileSync(process.env.GITHUB_OUTPUT, `should_run=${shouldRun}\n`)
+}
diff --git a/config/scripts/mobile-release-check-scope.test.mjs b/config/scripts/mobile-release-check-scope.test.mjs
new file mode 100644
index 00000000000..cd7c204f817
--- /dev/null
+++ b/config/scripts/mobile-release-check-scope.test.mjs
@@ -0,0 +1,215 @@
+import { copyFileSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join, matchesGlob, resolve } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { runProcessSync } from './script-child-process.mjs'
+import { shouldRunMobileReleaseChecks } from './mobile-release-check-scope.mjs'
+
+const root = resolve(import.meta.dirname, '../..')
+const workflow = parse(readFileSync(join(root, '.github/workflows/mobile.yml'), 'utf8'))
+const steps = workflow.jobs.verify.steps
+const detector = steps.find((step) => step.id === 'ruby-scope')
+const directories = []
+
+afterEach(() => {
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+it.each([
+  'src/main/runtime/rpc/dispatcher.ts',
+  'src/shared/rpc-contract/params.ts',
+  'mobile/src/session/session.test.ts',
+  'mobile/app/index.tsx',
+  'mobile/src/theme.css',
+  'mobile/src/session/README.md',
+  'mobile/docs/release.md',
+  'mobile/README.md',
+  'docs/reference/mobile.md'
+])('skips Ruby checks for application/documentation-only changes: %s', (file) => {
+  expect(shouldRunMobileReleaseChecks([file])).toBe(false)
+})
+
+it.each([
+  'mobile/fastlane/Fastfile',
+  'mobile/fastlane/Appfile',
+  'mobile/fastlane/ios_release_version.rb',
+  'mobile/fastlane/ios_release_version_test.rb',
+  'mobile/Gemfile',
+  'mobile/Gemfile.lock',
+  'mobile/.ruby-version',
+  'mobile/.bundle/config',
+  'mobile/app.json',
+  'mobile/app.config.ts',
+  'mobile/ios/Podfile',
+  'mobile/package.json',
+  'mobile/pnpm-lock.yaml',
+  'mobile/scripts/release.mts',
+  'mobile/src/release.rb',
+  'mobile/src/release.json',
+  'mobile/new-toolchain/input',
+  'package.json',
+  'pnpm-lock.yaml',
+  '.github/workflows/mobile.yml',
+  '.github/workflows/mobile-ios-release.yml',
+  '.github/actions/install-node-dependencies/action.yml',
+  'config/scripts/mobile-release-check-scope.mjs',
+  'config/scripts/mobile-release-check-scope.test.mjs'
+])('retains Ruby release coverage for changed or unknown inputs: %s', (file) => {
+  expect(shouldRunMobileReleaseChecks([file])).toBe(true)
+  expect(shouldRunMobileReleaseChecks(['mobile/src/view.tsx', file])).toBe(true)
+})
+
+it('runs Ruby checks when the changed-file evidence is empty', () => {
+  expect(shouldRunMobileReleaseChecks([])).toBe(true)
+})
+
+it('gates Ruby independently and retains mobile static validation', () => {
+  expect(steps[0].with['fetch-depth']).toBe(2)
+  expect(detector['working-directory']).toBe('.')
+  expect(steps.indexOf(detector)).toBeGreaterThan(
+    steps.findIndex((step) => step.uses === './.github/actions/install-node-dependencies')
+  )
+  const gated = steps.filter((step) => step.if !== undefined && step.name !== 'Test')
+  expect(gated.map((step) => step.name)).toEqual([
+    'Setup Ruby and fastlane',
+    'Test iOS release version resolution',
+    'Test TestFlight lane arguments',
+    'Smoke-check the Fastfile'
+  ])
+  for (const step of gated) {
+    expect(step.if).toBe("steps.ruby-scope.outputs.should_run != 'false'")
+  }
+  for (const name of ['Typecheck', 'Typecheck tests (ratchet)', 'Lint', 'Check formatting']) {
+    expect(steps.find((step) => step.name === name)?.if).toBeUndefined()
+    expect(steps.some((step) => step.name === name)).toBe(true)
+  }
+  for (const file of [
+    'config/scripts/mobile-release-check-scope.mjs',
+    'config/scripts/mobile-release-check-scope.test.mjs',
+    'config/scripts/pr-code-change-scope.mjs'
+  ]) {
+    expect(workflow.on.pull_request.paths.some((pattern) => matchesGlob(file, pattern))).toBe(true)
+  }
+  expect(workflow.jobs.verify.env.BUNDLE_FROZEN).toBe('true')
+  expect(steps.find((step) => step.name === 'Setup Ruby and fastlane').with['bundler-cache']).toBe(
+    true
+  )
+  expect(steps.find((step) => step.name === 'Smoke-check the Fastfile').run).toBe(
+    'bundle exec fastlane lanes'
+  )
+})
+
+function fixture(detectorStep = detector) {
+  const directory = mkdtempSync(join(tmpdir(), 'mobile-release-scope-'))
+  directories.push(directory)
+  const git = (...args) => {
+    const result = runProcessSync({ program: 'git', args, cwd: directory })
+    expect(result.code, result.stderr).toBe(0)
+    return result.stdout.trim()
+  }
+  git('init', '--quiet')
+  git('symbolic-ref', 'HEAD', 'refs/heads/main')
+  git('config', 'user.name', 'Workflow fixture')
+  git('config', 'user.email', 'workflow@example.invalid')
+  const write = (file, content) => {
+    mkdirSync(dirname(join(directory, file)), { recursive: true })
+    writeFileSync(join(directory, file), content)
+  }
+  write('mobile/src/view.tsx', 'export const view = 1\n')
+  write('mobile/fastlane/Fastfile', 'default_platform(:ios)\n')
+  mkdirSync(join(directory, 'config/scripts'), { recursive: true })
+  for (const file of [
+    'package.json',
+    'config/scripts/pr-code-change-scope.mjs',
+    'config/scripts/mobile-release-check-scope.mjs',
+    'config/scripts/mobile-test-change-scope.mjs'
+  ]) {
+    copyFileSync(join(root, file), join(directory, file))
+  }
+  const commit = () => {
+    git('add', '-A')
+    git(
+      '-c',
+      'commit.gpgsign=false',
+      '-c',
+      'core.hooksPath=/dev/null',
+      'commit',
+      '--quiet',
+      '-m',
+      'fixture'
+    )
+  }
+  commit()
+  const detect = () => {
+    const output = join(directory, 'github-output')
+    const result = runProcessSync({
+      program: 'bash',
+      args: ['-e', '-c', detectorStep.run],
+      cwd: directory,
+      env: { ...process.env, GITHUB_OUTPUT: output, RUNNER_TEMP: directory }
+    })
+    expect(result.code, result.stderr).toBe(0)
+    return readFileSync(output, 'utf8')
+  }
+  return { directory, git, write, commit, detect }
+}
+
+describe.skipIf(process.platform === 'win32')('the Linux workflow detector command', () => {
+  it('skips Ruby after a source-only commit', () => {
+    const repo = fixture()
+    repo.write('mobile/src/view.tsx', 'export const view = 2\n')
+    repo.commit()
+    expect(repo.detect()).toBe('should_run=false\n')
+  })
+
+  it('keeps a deleted release input when a rename moves it into an excluded directory', () => {
+    const repo = fixture()
+    repo.git('mv', 'mobile/fastlane/Fastfile', 'mobile/src/old-release.md')
+    repo.commit()
+    expect(repo.detect()).toBe('should_run=true\n')
+  })
+
+  it('runs Ruby when the merge parent is unavailable', () => {
+    expect(fixture().detect()).toBe('should_run=true\n')
+  })
+
+  it('runs Ruby when the classifier cannot execute', () => {
+    const repo = fixture()
+    repo.write('mobile/src/view.tsx', 'export const view = 2\n')
+    repo.commit()
+    rmSync(join(repo.directory, 'config/scripts/mobile-release-check-scope.mjs'))
+    expect(repo.detect()).toBe('should_run=true\n')
+  })
+})
+
+describe.skipIf(process.platform === 'win32')('the mobile test detector command', () => {
+  const testDetector = steps.find((step) => step.id === 'test-scope')
+  it('skips release-only changes while retaining source changes', () => {
+    const repo = fixture(testDetector)
+    repo.write('mobile/fastlane/Fastfile', 'default_platform(:android)\n')
+    repo.commit()
+    expect(repo.detect()).toBe('should_run=false\n')
+    repo.write('mobile/src/view.tsx', 'export const view = 2\n')
+    repo.commit()
+    expect(repo.detect()).toBe('should_run=false\nshould_run=true\n')
+  })
+  it('retains tests after source moves into a documentation directory', () => {
+    const repo = fixture(testDetector)
+    repo.git('mv', 'mobile/src/view.tsx', 'mobile/README.md')
+    repo.commit()
+    expect(repo.detect()).toBe('should_run=true\n')
+  })
+  it('retains tests when the diff is unavailable', () => {
+    expect(fixture(testDetector).detect()).toBe('should_run=true\n')
+  })
+  it('retains tests when the classifier cannot execute', () => {
+    const repo = fixture(testDetector)
+    repo.write('mobile/fastlane/Fastfile', 'default_platform(:android)\n')
+    repo.commit()
+    rmSync(join(repo.directory, 'config/scripts/mobile-test-change-scope.mjs'))
+    expect(repo.detect()).toBe('should_run=true\n')
+  })
+})
diff --git a/config/scripts/mobile-release-shell-switch-workflow.test.mjs b/config/scripts/mobile-release-shell-switch-workflow.test.mjs
index 9e22d799cfb..40cc20a95ba 100644
--- a/config/scripts/mobile-release-shell-switch-workflow.test.mjs
+++ b/config/scripts/mobile-release-shell-switch-workflow.test.mjs
@@ -116,8 +116,14 @@ it('leaves the switch out of every other workflow, so only a release can set it'
 const MOBILE_WORKFLOWS = ['mobile.yml', 'mobile-android-release.yml', 'mobile-ios-release.yml']
 /** Paths under which a Metro or Expo build cache lives, in the spellings a workflow would use. */
 const BUNDLER_CACHE_PATHS = ['metro-cache', '.expo', 'node_modules/.cache']
-/** The one restored path these workflows compute in a script, and so this test cannot read. */
-const REVIEWED_COMPUTED_PATH = '${{ steps.electron-package-cache.outputs.cache-root }}'
+/** Store/archive paths computed by scripts rather than declared in the workflows. */
+const REVIEWED_COMPUTED_PATHS = [
+  '${{ steps.electron-package-cache.outputs.cache-root }}',
+  '${{ steps.pnpm-store.outputs.path }}',
+  // Only pnpm's lockfile-verified.jsonl record, never Metro transforms.
+  '${{ steps.verification-cache.outputs.path }}',
+  "${{ github.event_name != 'pull_request' && 'pnpm' || '' }} store"
+]
 
 /** Every step a workflow runs, descending into the repository's own composite actions. */
 function stepsIncludingComposites(file) {
@@ -175,7 +181,7 @@ describe('what the mobile jobs restore from cache', () => {
   it('reads every restored path, rather than passing one it cannot evaluate', () => {
     const computed = MOBILE_CACHE_RESTORES.filter(({ paths }) => paths.includes('${{'))
 
-    expect(computed.map(({ paths }) => paths)).toEqual(computed.map(() => REVIEWED_COMPUTED_PATH))
+    expect(computed.filter(({ paths }) => !REVIEWED_COMPUTED_PATHS.includes(paths))).toEqual([])
   })
 
   it('restores no Metro or Expo build cache, which would decide the shell before the env does', () => {
diff --git a/config/scripts/mobile-test-change-scope.mjs b/config/scripts/mobile-test-change-scope.mjs
new file mode 100644
index 00000000000..cdd04d6edf5
--- /dev/null
+++ b/config/scripts/mobile-test-change-scope.mjs
@@ -0,0 +1,34 @@
+import { appendFileSync, readFileSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
+import { isDocsOnlyPath } from './pr-code-change-scope.mjs'
+
+const NON_TEST_FILES = new Set([
+  'mobile/Gemfile',
+  'mobile/Gemfile.lock',
+  'mobile/README.md',
+  '.github/workflows/mobile-ios-release.yml',
+  'config/scripts/pr-code-change-scope.mjs',
+  'config/scripts/pr-code-change-scope.test.mjs',
+  'config/scripts/mobile-release-check-scope.mjs',
+  'config/scripts/mobile-release-check-scope.test.mjs'
+])
+
+export function shouldRunMobileTests(files) {
+  return (
+    files.length === 0 ||
+    files.some(
+      (file) =>
+        file.split('/').includes('..') ||
+        (!isDocsOnlyPath(file) &&
+          !NON_TEST_FILES.has(file) &&
+          !file.startsWith('mobile/docs/') &&
+          !file.startsWith('mobile/fastlane/'))
+    )
+  )
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const input = readFileSync(process.argv[2], 'utf8')
+  const files = input.endsWith('\0') ? input.slice(0, -1).split('\0') : []
+  appendFileSync(process.env.GITHUB_OUTPUT, `should_run=${shouldRunMobileTests(files)}\n`)
+}
diff --git a/config/scripts/mobile-test-change-scope.test.mjs b/config/scripts/mobile-test-change-scope.test.mjs
new file mode 100644
index 00000000000..8859daca448
--- /dev/null
+++ b/config/scripts/mobile-test-change-scope.test.mjs
@@ -0,0 +1,60 @@
+import { readFileSync } from 'node:fs'
+import { parse } from 'yaml'
+import { expect, it } from 'vitest'
+import { shouldRunMobileTests } from './mobile-test-change-scope.mjs'
+
+it.each([
+  'docs/ci.md',
+  'mobile/docs/release.md',
+  'mobile/README.md',
+  'mobile/Gemfile.lock',
+  'mobile/fastlane/Fastfile',
+  '.github/workflows/mobile-ios-release.yml',
+  'config/scripts/pr-code-change-scope.mjs',
+  'config/scripts/mobile-release-check-scope.test.mjs'
+])('skips only known non-test inputs: %s', (file) => {
+  expect(shouldRunMobileTests([file])).toBe(false)
+  expect(shouldRunMobileTests([file, 'mobile/src/changed.ts'])).toBe(true)
+})
+
+it.each([
+  'mobile/src/view.tsx',
+  'mobile/app/_layout.tsx',
+  'mobile/scripts/check.ts',
+  'mobile/rpc-foundation/goldens/recording.json',
+  'mobile/vitest.config.ts',
+  'mobile/vitest.setup.ts',
+  'mobile/pnpm-lock.yaml',
+  'pnpm-lock.yaml',
+  'src/main/runtime/runtime-rpc.ts',
+  'src/shared/protocol-version.ts',
+  '.github/workflows/mobile.yml',
+  '.github/actions/install-node-dependencies/action.yml',
+  'config/scripts/mobile-test-change-scope.mjs',
+  'unknown-input',
+  'mobile/docs/../../src/source.ts'
+])('retains source, fixtures, toolchain, selector and unknown changes: %s', (file) => {
+  expect(shouldRunMobileTests([file])).toBe(true)
+})
+
+it('retains tests on missing evidence and a move out of the source tree', () => {
+  expect(shouldRunMobileTests([])).toBe(true)
+  expect(shouldRunMobileTests(['mobile/src/deleted.ts', 'mobile/docs/moved.ts'])).toBe(true)
+})
+
+it('skips only tests, after successful detection, and retains all other mobile gates', () => {
+  const workflow = parse(
+    readFileSync(new URL('../../.github/workflows/mobile.yml', import.meta.url), 'utf8')
+  )
+  const steps = workflow.jobs.verify.steps
+  expect(workflow.on.pull_request.paths).toContain('config/scripts/mobile-test-change-scope*')
+  const detector = steps.find((step) => step.id === 'test-scope')
+  expect(detector.run).toContain('git diff --name-only --no-renames -z HEAD^1 HEAD')
+  expect(detector.run.match(/should_run=true/g)).toHaveLength(2)
+  expect(steps.find((step) => step.name === 'Test').if).toBe(
+    "steps.test-scope.outputs.should_run != 'false'"
+  )
+  for (const name of ['Typecheck', 'Typecheck tests (ratchet)', 'Lint', 'Check formatting']) {
+    expect(steps.find((step) => step.name === name).if).toBeUndefined()
+  }
+})
diff --git a/config/scripts/mobile-web-app-agent-history-render.test.mjs b/config/scripts/mobile-web-app-agent-history-render.test.mjs
index 08ce37ea6c9..b1c69a88062 100644
--- a/config/scripts/mobile-web-app-agent-history-render.test.mjs
+++ b/config/scripts/mobile-web-app-agent-history-render.test.mjs
@@ -9,6 +9,7 @@ import {
   createBundleServer,
   installShellDouble,
   readBridgeFaultGrant,
+  readBridgePagePainted,
   readBridgeProtocolVersion,
   readShellCsp
 } from './mobile-web-app-render-harness.mjs'
@@ -110,6 +111,7 @@ let routeChunks = {}
 let cspHeader = null
 let bridgeVersion = null
 let faultGrant = null
+let paintName = null
 
 beforeAll(async () => {
   if (!bundles) {
@@ -118,6 +120,7 @@ beforeAll(async () => {
   cspHeader = await readShellCsp()
   bridgeVersion = await readBridgeProtocolVersion()
   faultGrant = await readBridgeFaultGrant()
+  paintName = await readBridgePagePainted()
   scratch = await mkdtemp(join(tmpdir(), 'orca-mobile-web-app-agent-history-'))
   const built = await buildMobileWebAppBundle({ outDir: join(scratch, 'bundle') })
   routeChunks = built.routeChunks
@@ -227,9 +230,11 @@ async function openRoute(route, awaitText, options = {}) {
   return opened
 }
 
-/** Every grant-gated notify the page posted, whole and in order, as the shell received them. */
-function readNotifies(page) {
-  return page.evaluate(() => globalThis.__orcaRenderCheckNotifies ?? [])
+/** Every grant-gated notify the page posted, whole and in order, as the shell received them. The
+ *  paint report is not one: every page posts it once its route screen has a frame. */
+async function readNotifies(page) {
+  const notifies = await page.evaluate(() => globalThis.__orcaRenderCheckNotifies ?? [])
+  return notifies.filter((frame) => frame.name !== paintName)
 }
 
 describeRender('the agent-history route in a real browser', () => {
diff --git a/config/scripts/mobile-web-app-bundle-test-fixture.mjs b/config/scripts/mobile-web-app-bundle-test-fixture.mjs
new file mode 100644
index 00000000000..3846cc4a54e
--- /dev/null
+++ b/config/scripts/mobile-web-app-bundle-test-fixture.mjs
@@ -0,0 +1,49 @@
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { deserialize, serialize } from 'node:v8'
+import { bundleMobileWebApp, buildMobileWebAppBundle } from './build-mobile-web-app-bundle.mjs'
+
+export async function withScratch(run) {
+  const scratch = await mkdtemp(join(tmpdir(), 'orca-mobile-web-app-test-'))
+  try {
+    return await run(scratch)
+  } finally {
+    await rm(scratch, { recursive: true, force: true })
+  }
+}
+
+// Snapshots preserve Buffer methods and give each assertion its own mutable copy.
+let appBundleSnapshot
+let writtenBundleSnapshot
+
+export async function readAppBundle() {
+  appBundleSnapshot ??= bundleMobileWebApp().then(serialize)
+  // Deserialized Buffers alias their snapshot, so copy it before exposing them.
+  return deserialize(Buffer.from(await appBundleSnapshot))
+}
+
+export async function readWrittenBundle() {
+  writtenBundleSnapshot ??= withScratch(async (scratch) => {
+    const { outDir, ...result } = await buildMobileWebAppBundle({ outDir: join(scratch, 'bundle') })
+    const html = await readFile(join(outDir, 'index.html'), 'utf8')
+    const files = await Promise.all(
+      ['manifest.json', ...result.manifest.assets.map((asset) => asset.path)].map(async (file) => ({
+        file,
+        bytes: await readFile(join(outDir, file))
+      }))
+    )
+    return serialize({ ...result, html, files })
+  })
+  return deserialize(Buffer.from(await writtenBundleSnapshot))
+}
+
+export async function copyWrittenBundle(outDir) {
+  const snapshot = await readWrittenBundle()
+  for (const { file, bytes } of snapshot.files) {
+    const destination = join(outDir, file)
+    await mkdir(dirname(destination), { recursive: true })
+    await writeFile(destination, bytes)
+  }
+  return { ...snapshot, outDir }
+}
diff --git a/config/scripts/mobile-web-app-drawer-render.test.mjs b/config/scripts/mobile-web-app-drawer-render.test.mjs
index 051072815a4..22d3b14a1d5 100644
--- a/config/scripts/mobile-web-app-drawer-render.test.mjs
+++ b/config/scripts/mobile-web-app-drawer-render.test.mjs
@@ -302,9 +302,6 @@ describeDrawer('the device Back key reaching a sheet on the page', () => {
         host: SHELL_HOST,
         storage: {},
         faultGrant,
-        // What a shell that knows the lane offers, and the frame it would send. Without the first
-        // the page posts no claim at all, which is the older-shell arm the unit suites pin.
-        accepts: [backNames.claim],
         backFrame: backNames.frame
       })
       await page.goto(`${origin}/`, { waitUntil: 'load' })
diff --git a/config/scripts/mobile-web-app-haptics-seam.test.mjs b/config/scripts/mobile-web-app-haptics-seam.test.mjs
index 96c02c4b29b..6f9c6c1afcf 100644
--- a/config/scripts/mobile-web-app-haptics-seam.test.mjs
+++ b/config/scripts/mobile-web-app-haptics-seam.test.mjs
@@ -40,6 +40,14 @@ const read = (file) => readFileSync(join(mobileDir, file), 'utf8')
 /** The route module behind each declared page route, shared with the screencast-lane census. */
 const ROUTE_MODULES = PAGE_ROUTE_MODULES
 
+// These cases read the same source tree; keep each route's real closure once.
+const closures = new Map()
+async function closureOf(module) {
+  const built = closures.get(module) ?? mobileWebAppRouteClosure(module)
+  closures.set(module, built)
+  return structuredClone(await built)
+}
+
 const HAPTICS_GRANT = 'haptics'
 
 /** The shell's mapping from a notify kind to one of the app's own functions. */
@@ -222,7 +230,7 @@ describeClosure(
   'every page route closure and the haptics seam',
   () => {
     it.each([...ROUTE_MODULES])('resolves the seam to the web sibling: %s', async (_route, mod) => {
-      const closure = await mobileWebAppRouteClosure(mod)
+      const closure = await closureOf(mod)
       expect(closure.local).toContain(HAPTICS_SEAM)
       expect(closure.local).not.toContain(HAPTICS_NATIVE)
       // The precondition an assertion about a closure needs: the walk read a page, not nothing.
@@ -232,7 +240,7 @@ describeClosure(
     it.each([...ROUTE_MODULES])(
       'imports the seam from at least one module, so the grant is not idle: %s',
       async (_route, mod) => {
-        const closure = await mobileWebAppRouteClosure(mod)
+        const closure = await closureOf(mod)
         expect(hapticsSeamImporters(mobileDir, closure).length).toBeGreaterThan(0)
       }
     )
@@ -252,7 +260,7 @@ describeClosure(
     it('declares haptics on exactly the routes whose closure reaches the seam', async () => {
       const reaching = []
       for (const [route, mod] of ROUTE_MODULES) {
-        const closure = await mobileWebAppRouteClosure(mod)
+        const closure = await closureOf(mod)
         if (hapticsSeamImporters(mobileDir, closure).length > 0) {
           reaching.push(route)
         }
@@ -283,7 +291,7 @@ describeClosure(
      */
     it('adds one module to a page closure, and only the two haptics modules are in it', async () => {
       for (const mod of ROUTE_MODULES.values()) {
-        const closure = await mobileWebAppRouteClosure(mod)
+        const closure = await closureOf(mod)
         expect(closure.local.filter((file) => file.includes('haptics')).sort(), mod).toEqual([
           HAPTICS_KINDS_MODULE,
           HAPTICS_SEAM
diff --git a/config/scripts/mobile-web-app-page-grant-call-sites.mjs b/config/scripts/mobile-web-app-page-grant-call-sites.mjs
index af41a468363..04e6ffcf6e5 100644
--- a/config/scripts/mobile-web-app-page-grant-call-sites.mjs
+++ b/config/scripts/mobile-web-app-page-grant-call-sites.mjs
@@ -84,6 +84,28 @@ function parse(source, fileName) {
   )
 }
 
+function grantReferences(source, fileName) {
+  const calls = new Set()
+  const imports = new Set()
+  const walk = (node) => {
+    if (ts.isCallExpression(node) && ts.isIdentifier(node.expression)) {
+      calls.add(node.expression.text)
+    }
+    if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier)) {
+      imports.add(node.moduleSpecifier.text)
+    }
+    ts.forEachChild(node, walk)
+  }
+  walk(parse(source, fileName))
+  return { calls, imports }
+}
+
+function referencesReachRow(references, row) {
+  return row.kind === 'call'
+    ? references.calls.has(row.callee)
+    : row.kind === 'import' && references.imports.has(row.specifier)
+}
+
 /**
  * Whether this module reaches the row's seam: calls the function, or imports the substituted module.
  *
@@ -92,44 +114,36 @@ function parse(source, fileName) {
  * can never ask for it, which is the failure a hand-written list already had.
  */
 export function moduleReachesGrantRow(source, fileName, row) {
-  let reached = false
-  const walk = (node) => {
-    if (
-      row.kind === 'call' &&
-      ts.isCallExpression(node) &&
-      ts.isIdentifier(node.expression) &&
-      node.expression.text === row.callee
-    ) {
-      reached = true
+  return referencesReachRow(grantReferences(source, fileName), row)
+}
+
+// One source version per file, scoped to a census; edits invalidate the parsed references.
+export function createGrantCallSiteReader() {
+  const files = new Map()
+  return (source, fileName, row) => {
+    let held = files.get(fileName)
+    if (held?.source !== source) {
+      held = { source, references: grantReferences(source, fileName) }
+      files.set(fileName, held)
     }
-    if (
-      row.kind === 'import' &&
-      ts.isImportDeclaration(node) &&
-      ts.isStringLiteral(node.moduleSpecifier) &&
-      node.moduleSpecifier.text === row.specifier
-    ) {
-      reached = true
-    }
-    ts.forEachChild(node, walk)
+    return referencesReachRow(held.references, row)
   }
-  walk(parse(source, fileName))
-  return reached
 }
 
 /** Every module in the closure that reaches the row, the seam itself never counting as its own use. */
-export function grantCallSites(mobileDir, closure, row) {
+export function grantCallSites(mobileDir, closure, row, readModule = moduleReachesGrantRow) {
   return closure.local.filter((file) => {
     if (!/\.tsx?$/.test(file) || file === row.seam) {
       return false
     }
-    return moduleReachesGrantRow(readFileSync(join(mobileDir, file), 'utf8'), file, row)
+    return readModule(readFileSync(join(mobileDir, file), 'utf8'), file, row)
   })
 }
 
 /** Every grant this closure's own call sites need, in row order. */
-export function grantsNeeded(mobileDir, closure) {
+export function grantsNeeded(mobileDir, closure, readModule) {
   return PAGE_GRANT_CALL_SITES.filter(
-    (row) => grantCallSites(mobileDir, closure, row).length > 0
+    (row) => grantCallSites(mobileDir, closure, row, readModule).length > 0
   ).flatMap((row) => row.grants)
 }
 
@@ -141,11 +155,11 @@ export function grantsNeeded(mobileDir, closure) {
  * grant. A single whole-manifest check would red under every row at once and say only that
  * something was missing.
  */
-export async function grantsMissingForRow(mobileDir, routes, closureOf, row) {
+export async function grantsMissingForRow(mobileDir, routes, closureOf, row, readModule) {
   const missing = []
   for (const route of routes) {
     const closure = await closureOf(route.pathname)
-    if (grantCallSites(mobileDir, closure, row).length === 0) {
+    if (grantCallSites(mobileDir, closure, row, readModule).length === 0) {
       continue
     }
     for (const grant of row.grants) {
diff --git a/config/scripts/mobile-web-app-page-grant-call-sites.test.mjs b/config/scripts/mobile-web-app-page-grant-call-sites.test.mjs
index cbcf86956c7..e70c7d49aad 100644
--- a/config/scripts/mobile-web-app-page-grant-call-sites.test.mjs
+++ b/config/scripts/mobile-web-app-page-grant-call-sites.test.mjs
@@ -6,7 +6,8 @@
  * reddened nothing. Each row below gets its own named case, and each case's control is the same
  * rule driven over the entry that route would have had with the grant struck out.
  */
-import { readFile } from 'node:fs/promises'
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { describe, expect, it } from 'vitest'
@@ -20,6 +21,7 @@ import { MOBILE_WEB_PAGE_ROUTES } from './mobile-web-page-routes.mjs'
 import { spelledCountsAgainstTables } from './spelled-count-census.mjs'
 import {
   PAGE_GRANT_CALL_SITES,
+  createGrantCallSiteReader,
   grantCallSites,
   grantsMissingForRow,
   grantsNeeded,
@@ -33,6 +35,7 @@ const SESSION = '/h/[hostId]/session/[worktreeId]'
 
 /** Memoised: every case below walks all eight, and a closure is a bundle the walk builds. */
 const closures = new Map()
+const readGrantModule = createGrantCallSiteReader()
 
 function closureOf(pathname) {
   const mod = PAGE_ROUTE_MODULES.get(pathname)
@@ -120,6 +123,27 @@ describe('the call-site reader', () => {
     }
   })
 
+  it('reuses parsed references across rows while observing source and row changes', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-grant-reader-'))
+    const file = join(directory, 'route.tsx')
+    const readModule = createGrantCallSiteReader()
+    const closure = { local: ['route.tsx'] }
+    const source = 'export const view = <View />; useRouteHandoff()'
+    try {
+      await writeFile(file, source)
+      expect(grantCallSites(directory, closure, navigate, readModule)).toEqual(['route.tsx'])
+      expect(grantCallSites(directory, closure, storage, readModule)).toEqual([])
+      expect(readModule(source, 'route.tsx', { ...navigate, callee: 'absent' })).toBe(false)
+      await writeFile(file, 'export const view = <View />; // useRouteHandoff()')
+      expect(grantCallSites(directory, closure, navigate, readModule)).toEqual([])
+      await writeFile(file, "import storage from '@react-native-async-storage/async-storage'")
+      expect(grantCallSites(directory, closure, storage, readModule)).toEqual(['route.tsx'])
+      expect(grantCallSites(directory, closure, navigate, readModule)).toEqual([])
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
   it('counts a call and not an import that never calls it', () => {
     expect(
       moduleReachesGrantRow(
@@ -213,7 +237,13 @@ describeClosure(
       'declares %s on every registered route whose own call sites reach it',
       async (_name, row) => {
         expect(
-          await grantsMissingForRow(mobileDir, MOBILE_WEB_PAGE_ROUTES, closureOf, row)
+          await grantsMissingForRow(
+            mobileDir,
+            MOBILE_WEB_PAGE_ROUTES,
+            closureOf,
+            row,
+            readGrantModule
+          )
         ).toEqual([])
       }
     )
@@ -229,17 +259,19 @@ describeClosure(
     it.each(PAGE_GRANT_CALL_SITES.map((row) => [row.grants.join(' + '), row]))(
       'reds the session route when it is registered without %s',
       async (_name, row) => {
-        const needed = grantsNeeded(mobileDir, await closureOf(SESSION))
+        const needed = grantsNeeded(mobileDir, await closureOf(SESSION), readGrantModule)
         expect(needed, 'the session route reaches this row').toEqual(
           expect.arrayContaining(row.grants)
         )
         const entry = (grants) => [{ pathname: SESSION, grants }]
         // Declaring everything it reaches passes, so each case is a rule and not a wall.
-        expect(await grantsMissingForRow(mobileDir, entry(needed), closureOf, row)).toEqual([])
+        expect(
+          await grantsMissingForRow(mobileDir, entry(needed), closureOf, row, readGrantModule)
+        ).toEqual([])
         const without = needed.filter((grant) => !row.grants.includes(grant))
-        expect(await grantsMissingForRow(mobileDir, entry(without), closureOf, row)).toEqual(
-          row.grants.map((grant) => `${SESSION} needs ${grant}`)
-        )
+        expect(
+          await grantsMissingForRow(mobileDir, entry(without), closureOf, row, readGrantModule)
+        ).toEqual(row.grants.map((grant) => `${SESSION} needs ${grant}`))
       }
     )
 
@@ -247,12 +279,12 @@ describeClosure(
       const closure = await closureOf(SESSION)
       // The precondition an assertion about a closure needs: the walk read a page, not nothing.
       expect(closure.local.length).toBeGreaterThan(250)
-      expect(grantsNeeded(mobileDir, closure)).toEqual(
+      expect(grantsNeeded(mobileDir, closure, readGrantModule)).toEqual(
         PAGE_GRANT_CALL_SITES.flatMap((row) => row.grants)
       )
       for (const row of PAGE_GRANT_CALL_SITES) {
         expect(
-          grantCallSites(mobileDir, closure, row).length,
+          grantCallSites(mobileDir, closure, row, readGrantModule).length,
           row.grants.join(' + ')
         ).toBeGreaterThan(0)
       }
@@ -264,10 +296,10 @@ describeClosure(
       const reaching = { reader: [], media: [] }
       for (const pathname of PAGE_ROUTE_MODULES.keys()) {
         const closure = await closureOf(pathname)
-        if (grantCallSites(mobileDir, closure, readerRow).length > 0) {
+        if (grantCallSites(mobileDir, closure, readerRow, readGrantModule).length > 0) {
           reaching.reader.push(pathname)
         }
-        if (grantCallSites(mobileDir, closure, mediaRow).length > 0) {
+        if (grantCallSites(mobileDir, closure, mediaRow, readGrantModule).length > 0) {
           reaching.media.push(pathname)
         }
       }
diff --git a/config/scripts/mobile-web-app-render-harness.mjs b/config/scripts/mobile-web-app-render-harness.mjs
index ae38a2ef471..f07e0c130a1 100644
--- a/config/scripts/mobile-web-app-render-harness.mjs
+++ b/config/scripts/mobile-web-app-render-harness.mjs
@@ -164,9 +164,9 @@ export async function readBrowserFrameQuality() {
 }
 
 /**
- * The page's client-identity placeholder and the `init.accepts` name that unlocks it, read from
- * the module that declares both. A rig carrying its own copy would go on passing after the real
- * pair moved, which is the whole reason every other constant here is read rather than retyped.
+ * The page's client-identity placeholder, read from the module that declares it. A rig carrying its
+ * own copy would go on passing after the real one moved, which is the whole reason every other
+ * constant here is read rather than retyped.
  */
 export async function readBridgePageClientIdentity() {
   const source = await readFile(
@@ -180,10 +180,7 @@ export async function readBridgePageClientIdentity() {
     }
     return match[1]
   }
-  return {
-    placeholder: read('BRIDGE_PAGE_CLIENT_ID'),
-    accept: read('BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT')
-  }
+  return { placeholder: read('BRIDGE_PAGE_CLIENT_ID') }
 }
 
 /** The grant the shell offers every page, read from the same source for the same reason. */
@@ -264,7 +261,6 @@ export function installShellDouble({
   grants,
   pageRoutes = null,
   pageRouteGrants = null,
-  accepts = null,
   backFrame = null,
   replies,
   streams = [],
@@ -323,9 +319,6 @@ export function installShellDouble({
     // Omitted when the caller names none, which is the older-shell case the page falls back
     // on: an absent field is not an empty one, and the page reads the difference.
     ...(pageRouteGrants === null ? {} : { pageRouteGrants }),
-    // Omitted when a check names none, which is the shell that performs no swap and the
-    // state every other rig in this directory runs in.
-    ...(accepts === null ? {} : { accepts }),
     // Omitted for a shell too old to name one, which is the case the page has a panel for.
     ...(route === null ? {} : { route }),
     ...(host === null ? {} : { host }),
@@ -631,8 +624,27 @@ export function installPageErrorSentinel() {
  * say that there was something to leak before it says that nothing did.
  */
 export function installSchedulerRecorder() {
-  globalThis.__orcaScheduler = { watching: false, scheduled: [], leaked: [] }
+  globalThis.__orcaScheduler = { watching: false, scheduled: [], leaked: [], heldFrames: 0 }
   const state = globalThis.__orcaScheduler
+  const requestFrame = globalThis.requestAnimationFrame.bind(globalThis)
+  const cancelFrame = globalThis.cancelAnimationFrame.bind(globalThis)
+  const heldFrames = new Map()
+  let nextHeldFrame = -2
+  globalThis.__orcaReleaseFrames = () => {
+    state.holdFramesFrom = null
+    for (const callback of heldFrames.values()) {
+      requestFrame(callback)
+    }
+    heldFrames.clear()
+    state.heldFrames = 0
+  }
+  globalThis.cancelAnimationFrame = (id) => {
+    if (heldFrames.delete(id)) {
+      state.heldFrames--
+    } else {
+      cancelFrame(id)
+    }
+  }
   const wrap = (schedule, kind) =>
     function (callback, ...rest) {
       if (!state.watching || typeof callback !== 'function') {
@@ -646,21 +658,22 @@ export function installSchedulerRecorder() {
       // it was cancelled or is merely waiting, and cancelling never sets it.
       const entry = { kind, caller, owned: container !== null, fired: false }
       state.scheduled.push(entry)
-      return schedule(
-        (...args) => {
-          entry.fired = true
-          if (container !== null && !container.isConnected) {
-            state.leaked.push(`${kind} from ${caller}`)
-          }
-          return callback(...args)
-        },
-        ...rest
-      )
+      const recorded = (...args) => {
+        entry.fired = true
+        if (container !== null && !container.isConnected) {
+          state.leaked.push(`${kind} from ${caller}`)
+        }
+        return callback(...args)
+      }
+      if (kind === 'frame' && state.holdFramesFrom && caller.includes(state.holdFramesFrom)) {
+        const id = nextHeldFrame--
+        heldFrames.set(id, recorded)
+        state.heldFrames++
+        return id
+      }
+      return schedule(recorded, ...rest)
     }
-  globalThis.requestAnimationFrame = wrap(
-    globalThis.requestAnimationFrame.bind(globalThis),
-    'frame'
-  )
+  globalThis.requestAnimationFrame = wrap(requestFrame, 'frame')
   globalThis.setTimeout = wrap(globalThis.setTimeout.bind(globalThis), 'timer')
   globalThis.setInterval = wrap(globalThis.setInterval.bind(globalThis), 'interval')
 }
diff --git a/config/scripts/mobile-web-app-render.test.mjs b/config/scripts/mobile-web-app-render.test.mjs
index 1cd797d2600..84d3164c7cb 100644
--- a/config/scripts/mobile-web-app-render.test.mjs
+++ b/config/scripts/mobile-web-app-render.test.mjs
@@ -135,8 +135,7 @@ async function openPage({
   shellHost = SHELL_HOST,
   shellStorage = {},
   shellGrants,
-  shellPageRoutes = null,
-  shellAccepts = null
+  shellPageRoutes = null
 } = {}) {
   const page = await browser.newPage({ viewport: { width: 390, height: 844 } })
   if (shellRoute !== undefined) {
@@ -151,8 +150,7 @@ async function openPage({
       storage: shellStorage,
       faultGrant,
       grants: shellGrants ?? [faultGrant],
-      pageRoutes: shellPageRoutes,
-      accepts: shellAccepts
+      pageRoutes: shellPageRoutes
     })
   }
   const errors = []
@@ -587,11 +585,7 @@ describeRender('the Route A page in a real browser', () => {
       })
     )
     try {
-      // The one case that advertises the report, because it is the only one asserting on it.
-      const opened = await openPage({
-        shellRoute: { pathname: HOST_ROUTE },
-        shellAccepts: [paintName]
-      })
+      const opened = await openPage({ shellRoute: { pathname: HOST_ROUTE } })
       await opened.page.goto(`${origin}/`, { waitUntil: 'load' })
       await opened.page.waitForFunction(
         () => document.documentElement.dataset.orcaWebEntry === 'mounted',
@@ -639,7 +633,6 @@ describeRender('the Route A page in a real browser', () => {
       const route = `${HOST_ROUTE}/pr/render-check-tree`
       const opened = await openPage({
         shellRoute: { pathname: route },
-        shellAccepts: [paintName],
         shellPageRoutes: [HOST_ROUTE_PATTERN, '/h/[hostId]/pr/[worktreeId]']
       })
       await opened.page.goto(`${origin}/`, { waitUntil: 'load' })
diff --git a/config/scripts/mobile-web-app-rich-markdown-render.test.mjs b/config/scripts/mobile-web-app-rich-markdown-render.test.mjs
index b9c93dbc5c9..d1133bce143 100644
--- a/config/scripts/mobile-web-app-rich-markdown-render.test.mjs
+++ b/config/scripts/mobile-web-app-rich-markdown-render.test.mjs
@@ -583,13 +583,16 @@ describeEditor(
                 { timeout: 15_000 }
               )
             }
-            // The inserted image painted: `naturalWidth` is 0 for an element the browser refused
-            // or never fetched, which is what a policy that did not admit it would leave.
-            expect(
-              await page.evaluate(
-                () => document.querySelector('#first-surface #editor img')?.naturalWidth ?? 0
+            // Insertion precedes image loading; a refused image must still fail this paint check.
+            await expect
+              .poll(
+                () =>
+                  page.evaluate(
+                    () => document.querySelector('#first-surface #editor img')?.naturalWidth ?? 0
+                  ),
+                { timeout: 15_000 }
               )
-            ).toBeGreaterThan(0)
+              .toBeGreaterThan(0)
             expect(await page.evaluate(() => globalThis.__orcaCspViolations)).toEqual([])
             expect(consoleErrors).toEqual([])
           } finally {
diff --git a/config/scripts/mobile-web-app-route-manifest.test.mjs b/config/scripts/mobile-web-app-route-manifest.test.mjs
index b4c29d8d9d8..1cbf256bd7a 100644
--- a/config/scripts/mobile-web-app-route-manifest.test.mjs
+++ b/config/scripts/mobile-web-app-route-manifest.test.mjs
@@ -1,4 +1,4 @@
-import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -250,23 +250,3 @@ describe('the synthesized RequireContext', () => {
     expect(() => context('constructor')).toThrow('no route module')
   })
 })
-
-describe('the web entry', () => {
-  it('leaves the suspense boundary to expo-router', async () => {
-    const entry = await readFile(join(projectDir, 'mobile', 'web-entry', 'index.tsx'), 'utf8')
-    // A second boundary around the whole tree catches nothing the router has not already caught,
-    // and would only make the fallback ambiguous about which layer suspended.
-    expect(entry).not.toContain('Suspense')
-  })
-
-  itBundling('because the router already wraps every screen in one', async () => {
-    // The premise of the test above, read off the copy that is bundled: getQualifiedRouteComponent
-    // wraps each screen itself, which is what makes the lazy route manifest safe without a
-    // boundary of our own.
-    const useScreens = await readFile(
-      join(projectDir, 'mobile', 'node_modules', 'expo-router', 'build', 'useScreens.js'),
-      'utf8'
-    )
-    expect(useScreens).toContain('<react_1.default.Suspense fallback=')
-  })
-})
diff --git a/config/scripts/mobile-web-app-route-snapshot.mjs b/config/scripts/mobile-web-app-route-snapshot.mjs
new file mode 100644
index 00000000000..248481ee0d4
--- /dev/null
+++ b/config/scripts/mobile-web-app-route-snapshot.mjs
@@ -0,0 +1,25 @@
+import { readFileSync } from 'node:fs'
+
+export function readRouteSnapshot(route, file = process.env.ORCA_MOBILE_WEB_ROUTE_SNAPSHOT) {
+  if (!file) {
+    return undefined
+  }
+  // The test runner creates this file for one immutable checkout and deletes it on exit.
+  const snapshot = JSON.parse(readFileSync(file, 'utf8'))
+  if (snapshot.version !== 1 || !Array.isArray(snapshot.routes)) {
+    throw new Error('Invalid mobile route snapshot')
+  }
+  const entry = snapshot.routes.find((item) => item.route === route)
+  if (!entry) {
+    return undefined
+  }
+  if (
+    !Array.isArray(entry.closure?.modules) ||
+    !Array.isArray(entry.closure?.local) ||
+    !entry.closure.modules.every((item) => typeof item === 'string') ||
+    !entry.closure.local.every((item) => typeof item === 'string')
+  ) {
+    throw new Error(`Invalid mobile route closure: ${route}`)
+  }
+  return entry.closure
+}
diff --git a/config/scripts/mobile-web-app-route-snapshot.test.mjs b/config/scripts/mobile-web-app-route-snapshot.test.mjs
new file mode 100644
index 00000000000..a4dc897271e
--- /dev/null
+++ b/config/scripts/mobile-web-app-route-snapshot.test.mjs
@@ -0,0 +1,112 @@
+import { existsSync, writeFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+import { readRouteSnapshot } from './mobile-web-app-route-snapshot.mjs'
+import {
+  prepareRouteSnapshot,
+  withPreparedRouteSnapshot,
+  withRouteSnapshot
+} from './run-mobile-web-app-checks.mjs'
+import { PAGE_ROUTE_MODULES } from './mobile-web-app-page-route-modules.mjs'
+
+const collect = async (entries) => ({
+  modules: [...entries, 'node_modules/react/index.js'],
+  local: entries
+})
+
+it('collects each real route once and shares isolated results for one invocation', async () => {
+  const collected = []
+  let snapshotFile
+  await withRouteSnapshot(
+    async (file) => {
+      snapshotFile = file
+      for (const route of PAGE_ROUTE_MODULES.values()) {
+        const expected = await collect(['app/_layout', 'app/h/_layout', route])
+        expect(readRouteSnapshot(route, file)).toEqual(expected)
+        readRouteSnapshot(route, file).local.length = 0
+        expect(readRouteSnapshot(route, file)).toEqual(expected)
+      }
+      expect(readRouteSnapshot('new-route', file)).toBeUndefined()
+    },
+    async (entries) => {
+      collected.push(entries[2])
+      return collect(entries)
+    }
+  )
+  expect(collected).toEqual([...new Set(PAGE_ROUTE_MODULES.values())])
+  expect(existsSync(snapshotFile)).toBe(false)
+})
+
+it('removes the snapshot after a failed suite and propagates the failure', async () => {
+  let snapshotFile
+  await expect(
+    withRouteSnapshot(async (file) => {
+      snapshotFile = file
+      throw new Error('failed assertion')
+    }, collect)
+  ).rejects.toThrow('failed assertion')
+  expect(existsSync(snapshotFile)).toBe(false)
+})
+
+it('never launches tests after dependency collection fails', async () => {
+  await expect(
+    withRouteSnapshot(
+      () => {
+        throw new Error('must not launch')
+      },
+      async () => {
+        throw new Error('unresolved import')
+      }
+    )
+  ).rejects.toThrow('unresolved import')
+})
+
+describe('snapshot validation', () => {
+  it('leaves ordinary builds and scratch routes uncached', () => {
+    expect(readRouteSnapshot('any', '')).toBeUndefined()
+  })
+  it.each(['{}', '{', '{"version":1,"routes":[{"route":"bad","closure":{}}]}'])(
+    'rejects damaged snapshots: %s',
+    async (bytes) => {
+      await withRouteSnapshot(async (file) => {
+        writeFileSync(file, bytes)
+        expect(() => readRouteSnapshot('bad', file)).toThrow()
+      }, collect)
+    }
+  )
+})
+
+it('consumes a separately prepared snapshot and removes it after success', async () => {
+  await withRouteSnapshot(async (file) => {
+    const result = await withPreparedRouteSnapshot(file, async (prepared) => {
+      expect(prepared).toBe(file)
+      return 'verified'
+    })
+    expect(result).toBe('verified')
+    expect(existsSync(file)).toBe(false)
+  }, collect)
+})
+
+it('rejects incomplete prepared snapshots before launching tests', async () => {
+  await withRouteSnapshot(async (file) => {
+    writeFileSync(file, JSON.stringify({ version: 1, routes: [] }))
+    let launched = false
+    await expect(
+      withPreparedRouteSnapshot(file, async () => {
+        launched = true
+      })
+    ).rejects.toThrow('missing')
+    expect(launched).toBe(false)
+    expect(existsSync(file)).toBe(false)
+  }, collect)
+})
+
+it('removes previous evidence before a failed preparation', async () => {
+  await withRouteSnapshot(async (file) => {
+    await expect(
+      prepareRouteSnapshot(file, async () => {
+        throw new Error('unresolved import')
+      })
+    ).rejects.toThrow('unresolved import')
+    expect(existsSync(file)).toBe(false)
+  }, collect)
+})
diff --git a/config/scripts/mobile-web-app-session-terminal-init.test.mjs b/config/scripts/mobile-web-app-session-terminal-init.test.mjs
index 199c0f15f79..2d46fdb15c8 100644
--- a/config/scripts/mobile-web-app-session-terminal-init.test.mjs
+++ b/config/scripts/mobile-web-app-session-terminal-init.test.mjs
@@ -148,8 +148,6 @@ async function openSessionWithTerminalTab() {
     faultGrant,
     grants: [faultGrant, ...sessionGrants()],
     pageRoutes: PAGE_ROUTE_PATTERNS,
-    // The page claims an identity only against a shell that says it swaps one in.
-    accepts: [pageClientIdentity.accept],
     streams: ['session.tabs.subscribe', 'terminal.subscribe'],
     replies: {
       'worktree.show': { worktree: { id: WORKTREE, name: WORKTREE, path: `/tmp/${WORKTREE}` } },
@@ -257,8 +255,17 @@ describeRender(
       // `.xterm-screen` does: it is created by `term.open()`, which only ever runs from the
       // document's `init`. The emulator run had the surface with zero children inside a correctly
       // sized container, which is this element missing.
+      // Then the grid readable: xterm sizes its one-cell helper textarea only on a cursor move or
+      // resize, so a read the moment the screen exists can land before the replay has drained.
       await page.waitForFunction(
-        () => document.querySelector('.xterm-screen') !== null,
+        () => {
+          const cell = document.querySelector('#terminal-surface .xterm-helper-textarea')
+          return (
+            document.querySelector('.xterm-screen') !== null &&
+            cell !== null &&
+            cell.getBoundingClientRect().width > 0
+          )
+        },
         undefined,
         {
           timeout: 60_000,
diff --git a/config/scripts/mobile-web-app-terminal-live-input-render.test.mjs b/config/scripts/mobile-web-app-terminal-live-input-render.test.mjs
index 210e828af8f..b1821fd0683 100644
--- a/config/scripts/mobile-web-app-terminal-live-input-render.test.mjs
+++ b/config/scripts/mobile-web-app-terminal-live-input-render.test.mjs
@@ -112,8 +112,11 @@ afterAll(async () => {
  * Settled is "the probe registered" or "the page reported a fault", because those are the two
  * outcomes and waiting only for the first turns the defect into a 60s timeout that names nothing.
  */
-async function openProbe() {
-  const page = await browser.newPage({ viewport: { width: 390, height: 844 } })
+async function openProbe({ userAgent } = {}) {
+  const page = await browser.newPage({
+    viewport: { width: 390, height: 844 },
+    ...(userAgent ? { userAgent } : {})
+  })
   await page.addInitScript(installShellDouble, {
     version: bridgeVersion,
     sessionId: 'live-input-session',
@@ -322,6 +325,104 @@ describeRender(
       await page.close()
     }, 300_000)
 
+    describe('under an Android keyboard, which composes every word it types', () => {
+      // The OTA shell's WebView. Its keyboards hold a composing region over the Latin word being
+      // typed, so every input event mid-word says `isComposing: true`; native Android reports no
+      // range at all, and there each ASCII keystroke reaches the terminal as it is typed.
+      const ANDROID_WEBVIEW_USER_AGENT =
+        'Mozilla/5.0 (Linux; Android 16; Pixel 9 Pro Build/BP2A; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/140.0.0.0 Mobile Safari/537.36'
+      const sent = (page) => page.evaluate(() => globalThis.__orcaLiveInputProbe.sent())
+
+      /** One composition step through the browser's own IME path, which fires the DOM composition events. */
+      async function compose(input, text) {
+        await input.send('Input.imeSetComposition', {
+          text,
+          selectionStart: text.length,
+          selectionEnd: text.length
+        })
+      }
+
+      async function waitForField(page, value) {
+        await page.waitForFunction(
+          ([id, expected]) => document.getElementById(id)?.value === expected,
+          [LIVE_INPUT_FIELD_ID, value],
+          { timeout: 30_000, polling: 50 }
+        )
+      }
+
+      it('sends each letter of a composed word after a slash as it is typed', async () => {
+        // The reported shape: `/tui` in a Codex terminal, where the `/` arrived and `tui` did not
+        // until Enter. The keyboard commits `/` outright and opens a composition for the letters.
+        const { errors, page } = await openProbe({ userAgent: ANDROID_WEBVIEW_USER_AGENT })
+        await page.focus(`#${LIVE_INPUT_FIELD_ID}`)
+        const input = await page.context().newCDPSession(page)
+        await page.keyboard.type('/')
+        await waitForField(page, '/')
+
+        const afterEachStep = []
+        for (const text of ['t', 'tu', 'tui']) {
+          await compose(input, text)
+          await waitForField(page, `/${text}`)
+          afterEachStep.push(await sent(page))
+        }
+        await input.send('Input.insertText', { text: 'tui' })
+        await waitForField(page, '/tui')
+
+        expect(afterEachStep).toEqual([
+          ['/', 't'],
+          ['/', 't', 'u'],
+          ['/', 't', 'u', 'i']
+        ])
+        expect(await sent(page)).toEqual(['/', 't', 'u', 'i'])
+        expect(errors).toEqual([])
+        await page.close()
+      }, 300_000)
+
+      it('erases and retypes a word the keyboard corrects when it commits', async () => {
+        const { errors, page } = await openProbe({ userAgent: ANDROID_WEBVIEW_USER_AGENT })
+        await page.focus(`#${LIVE_INPUT_FIELD_ID}`)
+        const input = await page.context().newCDPSession(page)
+        for (const text of ['t', 'te', 'teh']) {
+          await compose(input, text)
+          await waitForField(page, text)
+        }
+
+        await input.send('Input.insertText', { text: 'the' })
+        await waitForField(page, 'the')
+
+        await page.waitForFunction(
+          () => globalThis.__orcaLiveInputProbe.sent().length === 4,
+          undefined,
+          {
+            timeout: 30_000,
+            polling: 50
+          }
+        )
+        expect(await sent(page)).toEqual(['t', 'e', 'h', '\u007f\u007fhe'])
+        expect(errors).toEqual([])
+        await page.close()
+      }, 300_000)
+
+      it("still holds a composition off Android, where it is the text system's marked text", async () => {
+        // The guard: an iOS WebView composes only what native iOS marks, pinyin before conversion
+        // among it, and that is not text yet on either side of the bridge.
+        const { errors, page } = await openProbe({
+          userAgent:
+            'Mozilla/5.0 (iPhone; CPU iPhone OS 19_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148'
+        })
+        await page.focus(`#${LIVE_INPUT_FIELD_ID}`)
+        const input = await page.context().newCDPSession(page)
+        for (const text of ['n', 'ni']) {
+          await compose(input, text)
+          await waitForField(page, text)
+        }
+
+        expect(await sent(page)).toEqual([])
+        expect(errors).toEqual([])
+        await page.close()
+      }, 300_000)
+    })
+
     describe('in buffered mode, where the field holds the draft until Enter', () => {
       const bufferedValue = (page) =>
         page.evaluate((id) => document.getElementById(id)?.value ?? null, BUFFERED_FIELD_ID)
diff --git a/config/scripts/mobile-web-app-terminal-probe-route.mjs b/config/scripts/mobile-web-app-terminal-probe-route.mjs
index 0e943d8c113..79996974545 100644
--- a/config/scripts/mobile-web-app-terminal-probe-route.mjs
+++ b/config/scripts/mobile-web-app-terminal-probe-route.mjs
@@ -57,6 +57,8 @@ import { TerminalWebView } from ${JSON.stringify(componentPath)}
 
 export default function TerminalProbeRoute() {
   const handleRef = useRef(null)
+  // The terminal frame as React Native laid it out, which is what the session fits.
+  const frameRef = useRef({ width: 0, height: 0 })
   const [mounted, setMounted] = useState(true)
   const onSelectionCopy = useCallback((text) => {
     globalThis.__orcaTerminalCopied = text
@@ -71,10 +73,11 @@ export default function TerminalProbeRoute() {
     globalThis.__orcaTerminalEngineErrors = globalThis.__orcaTerminalEngineErrors ?? []
     globalThis.__orcaTerminalBeforeInput = []
     globalThis.__orcaTerminalProbe = {
-      init: (cols, rows, data) => handleRef.current?.init(cols, rows, data, false, []),
+      init: (cols, rows, initialData) =>
+        handleRef.current?.init({ cols, rows, initialData, oscLinks: [], frame: frameRef.current }),
       write: (data) => handleRef.current?.write(data),
       selectAll: () => handleRef.current?.doSelectAll(),
-      measure: () => handleRef.current?.measureFitDimensions(),
+      fit: () => handleRef.current?.fitDimensions(frameRef.current),
       awaitReady: () => handleRef.current?.awaitReady(),
       setMounted: (next) => setMounted(next)
     }
@@ -90,14 +93,21 @@ export default function TerminalProbeRoute() {
   }, [])
   return (
     <View testID="terminal-probe" style={{ flex: 1 }}>
-      {mounted ? (
-        <TerminalWebView
-          ref={handleRef}
-          onWebReady={onWebReady}
-          onEngineError={onEngineError}
-          onSelectionCopy={onSelectionCopy}
-        />
-      ) : null}
+      <View
+        style={{ flex: 1 }}
+        onLayout={(event) => {
+          frameRef.current = event.nativeEvent.layout
+        }}
+      >
+        {mounted ? (
+          <TerminalWebView
+            ref={handleRef}
+            onWebReady={onWebReady}
+            onEngineError={onEngineError}
+            onSelectionCopy={onSelectionCopy}
+          />
+        ) : null}
+      </View>
       {/* The shape the terminal's live input takes on the page: xterm's own textarea is inert by
           the document's design, so this is where typed text arrives. */}
       <TextInput testID="terminal-live-input" style={{ fontSize: 16 }} />
diff --git a/config/scripts/mobile-web-app-terminal-render.test.mjs b/config/scripts/mobile-web-app-terminal-render.test.mjs
index 682384f6b4f..4a08bcece53 100644
--- a/config/scripts/mobile-web-app-terminal-render.test.mjs
+++ b/config/scripts/mobile-web-app-terminal-render.test.mjs
@@ -452,113 +452,123 @@ describeRender(
       await page.close()
     }, 300_000)
 
-    it('takes back the frames it is owed, not only the timers', async () => {
-      // The timer case above is witnessed by a 550 ms timeout, which every module's own stop
-      // cancels by the handle the scope holds. A frame is the other shape: `applyFitScale` asks
-      // for one through the scope's registry and never holds its id, so `stopFitScale` can only
-      // bump the token it tests itself against — the frame still runs. Nothing but
-      // `cancelDocumentFrames` takes it back.
-      //
-      // Two things have to be pinned down for that to be readable, and the first version of this
-      // case had neither.
-      //
-      // The witness has to be owed whenever the dispose lands. A single refit is not: the retry
-      // loop commits on its first attempt whenever the grid still measures, so one resize buys
-      // one frame and a dispose after it owes nothing — which agrees with an empty leak list for
-      // exactly the reason under test, once in five runs. So the refit is re-armed from a frame
-      // of the test's own, which leaves the document owed a frame at the end of every frame the
-      // browser serves, and dispose cannot land inside one.
-      //
-      // And the leak has to be counted from the moment dispose returned, not from the moment the
-      // host element left the DOM. React unmounts in two steps: the mutation phase detaches the
-      // host, and the passive cleanup that calls `dispose` runs after it — 1 ms apart here, 20 to
-      // 35 ms apart with the CPU throttled 20x, which is the CI runner this failed on. A frame
-      // served in that gap runs with a detached container while the document is still live and
-      // has not been asked to stop, and no registry could take it back. It went through
-      // `scheduleDocumentFrame` like every other; the old oracle called it a leak because it
-      // judged by the container rather than by dispose. Only what runs after the last statement
-      // of `dispose` is the document keeping something it gave up.
-      let documentChunk = null
-      const { page } = await openPage(PROBE_ROUTE, {
-        scheduler: true,
-        beforeNavigate: async (opened) => {
-          await opened.route('**/*.js', async (route) => {
-            const response = await route.fetch()
-            const body = await response.text()
-            if (body.includes('terminal runtime error')) {
-              documentChunk = new URL(route.request().url()).pathname
-            }
-            await route.fulfill({ response, body })
-          })
-        }
-      })
-      await page.waitForFunction(() => globalThis.__orcaTerminalReady === true, {
-        timeout: 60_000,
-        polling: 100
-      })
-      await openProbeTerminal(page)
-      expect(documentChunk, 'the document was served as its own chunk').not.toBe(null)
-
-      await page.evaluate((chunk) => {
-        const state = globalThis.__orcaScheduler
-        state.disposed = null
-        state.watching = true
-        // `dispose` empties the host and drops its class last, after `cancelDocumentFrames`, so
-        // the class going is the moment it returned. Observed on the element rather than on the
-        // tree because React may have detached it already.
-        const host = document.querySelector('.orca-terminal-document-host')
-        const observer = new MutationObserver(() => {
-          if (state.disposed !== null || host.classList.contains('orca-terminal-document-host')) {
-            return
+    it.each([
+      { name: 'takes back the frames it is owed, not only the timers', cancelFrames: true },
+      { name: 'detects leaked frames when disposal cannot cancel them', cancelFrames: false }
+    ])(
+      '$name',
+      async ({ cancelFrames }) => {
+        // Hold a real refit frame across disposal; ResizeObserver delivery cannot race the witness.
+        let documentChunk = null
+        const { page } = await openPage(PROBE_ROUTE, {
+          scheduler: true,
+          beforeNavigate: async (opened) => {
+            await opened.route('**/*.js', async (route) => {
+              const response = await route.fetch()
+              const body = await response.text()
+              if (body.includes('terminal runtime error')) {
+                documentChunk = new URL(route.request().url()).pathname
+              }
+              await route.fulfill({ response, body })
+            })
           }
-          state.disposed = {
-            // A cancelled frame never runs, so it is still owed here. That is the point.
-            owed: state.scheduled.filter(
-              (entry) => entry.kind === 'frame' && !entry.fired && entry.caller.includes(chunk)
-            ).length,
-            leakedBefore: state.leaked.length
-          }
-          observer.disconnect()
         })
-        observer.observe(host, { attributes: true, attributeFilter: ['class'] })
-        // The page's refit follows the host's box, not the window, so the pulse resizes the host.
-        let narrow = false
-        const pulse = () => {
-          if (state.disposed !== null) {
-            return
-          }
-          narrow = !narrow
-          host.style.width = narrow ? '99%' : ''
-          requestAnimationFrame(pulse)
-        }
-        requestAnimationFrame(pulse)
-        globalThis.setTimeout(() => globalThis.__orcaTerminalProbe.setMounted(false), 200)
-      }, documentChunk)
-      await page.locator('#terminal-container').waitFor({ state: 'detached', timeout: 30_000 })
-      await page.evaluate(() => {
-        globalThis.__orcaTerminalReady = false
-        globalThis.__orcaTerminalProbe.setMounted(true)
-      })
-      await page.waitForFunction(() => globalThis.__orcaTerminalReady === true, {
-        timeout: 60_000,
-        polling: 100
-      })
-      await openProbeTerminal(page)
-      await page.evaluate(() => new Promise((resolve) => globalThis.setTimeout(resolve, 3000)))
+        try {
+          await page.waitForFunction(() => globalThis.__orcaTerminalReady === true, {
+            timeout: 60_000,
+            polling: 100
+          })
+          await openProbeTerminal(page)
+          expect(documentChunk, 'the document was served as its own chunk').not.toBe(null)
+          // Ready is notified with the replay's fit still a frame away. Left pending, that fit
+          // commits the resized box below, the resize refit then has nothing to do, and there is no
+          // frame to hold; so the document settles first. Since the terminal is built before
+          // ready, the fixture returns fast enough to land inside that frame.
+          await page.evaluate(
+            () =>
+              new Promise((resolve) => requestAnimationFrame(() => requestAnimationFrame(resolve)))
+          )
 
-      const scheduler = await page.evaluate(() => globalThis.__orcaScheduler)
-      expect(
-        scheduler.disposed?.owed,
-        'the document owed a frame at the moment dispose returned'
-      ).toBeGreaterThan(0)
-      expect(
-        scheduler.leaked
-          .slice(scheduler.disposed.leakedBefore)
-          .filter((entry) => entry.startsWith('frame ') && entry.includes(documentChunk))
-      ).toEqual([])
-      await page.unrouteAll({ behavior: 'ignoreErrors' })
-      await page.close()
-    }, 300_000)
+          await page.evaluate((chunk) => {
+            const state = globalThis.__orcaScheduler
+            state.disposed = null
+            state.watching = true
+            state.holdFramesFrom = chunk
+            const host = document.querySelector('.orca-terminal-document-host')
+            // Dispose drops this class after cancelling frames; DOM detachment precedes cleanup.
+            const observer = new MutationObserver(() => {
+              if (
+                state.disposed !== null ||
+                host.classList.contains('orca-terminal-document-host')
+              ) {
+                return
+              }
+              state.disposed = {
+                owed: state.scheduled.filter(
+                  (entry) => entry.kind === 'frame' && !entry.fired && entry.caller.includes(chunk)
+                ).length,
+                leakedBefore: state.leaked.length
+              }
+              observer.disconnect()
+            })
+            observer.observe(host, { attributes: true, attributeFilter: ['class'] })
+            host.style.width = '80%'
+          }, documentChunk)
+          await page.waitForFunction(() => globalThis.__orcaScheduler.heldFrames > 0, undefined, {
+            timeout: 30_000
+          })
+          await page.evaluate((cancelFrames) => {
+            globalThis.__orcaRestoreFrameCancellation = globalThis.cancelAnimationFrame
+            if (!cancelFrames) {
+              // The negative control must expose held callbacks after the real document disposes.
+              globalThis.cancelAnimationFrame = () => {}
+            }
+            globalThis.__orcaTerminalProbe.setMounted(false)
+          }, cancelFrames)
+          await page.locator('#terminal-container').waitFor({ state: 'detached', timeout: 30_000 })
+          await page.waitForFunction(() => globalThis.__orcaScheduler.disposed !== null)
+          await page.evaluate(() => {
+            globalThis.cancelAnimationFrame = globalThis.__orcaRestoreFrameCancellation
+            globalThis.__orcaScheduler.holdFramesFrom = null
+            globalThis.__orcaTerminalReady = false
+            globalThis.__orcaTerminalProbe.setMounted(true)
+          })
+          await page.waitForFunction(() => globalThis.__orcaTerminalReady === true, {
+            timeout: 60_000,
+            polling: 100
+          })
+          await openProbeTerminal(page)
+          // Uncancelled work must actually run against the replacement, so the hold cannot hide leaks.
+          await page.evaluate(
+            () =>
+              new Promise((resolve) => {
+                globalThis.__orcaReleaseFrames()
+                requestAnimationFrame(() => requestAnimationFrame(resolve))
+              })
+          )
+
+          const scheduler = await page.evaluate(() => globalThis.__orcaScheduler)
+          expect(
+            scheduler.disposed?.owed,
+            'the document owed a frame at the moment dispose returned'
+          ).toBeGreaterThan(0)
+          const leakedFrames = scheduler.leaked
+            .slice(scheduler.disposed.leakedBefore)
+            .filter((entry) => entry.startsWith('frame ') && entry.includes(documentChunk))
+          if (cancelFrames) {
+            expect(leakedFrames).toEqual([])
+          } else {
+            expect(
+              leakedFrames.length,
+              'the recorder must expose uncancelled work'
+            ).toBeGreaterThan(0)
+          }
+        } finally {
+          await page.unrouteAll({ behavior: 'ignoreErrors' }).finally(() => page.close())
+        }
+      },
+      300_000
+    )
 
     it('styles what it owns, and only that', async () => {
       // The document's sheet says `*`, `html` and `body` because inside a WebView it owns the
@@ -625,14 +635,14 @@ describeRender(
       await page.close()
     }, 300_000)
 
-    it('measures a fit through the handle and records what beforeinput reports', async () => {
+    it('fits through the handle from the ready box and records what beforeinput reports', async () => {
       const { page } = await openTerminal()
       await openProbeTerminal(page)
 
-      // The handle's own round trip: a measure is a command in and a notify back, and on the page
-      // both halves are direct calls rather than a bridge. Null would mean the document answered
-      // nothing, or answered a grid too small to fit.
-      const fit = await page.evaluate(() => globalThis.__orcaTerminalProbe.measure())
+      // The fit is the app's own, from the cell box the document put in web-ready, against the
+      // frame React Native laid out, as the session's is. Null would mean the ready carried no box,
+      // or a grid too small to fit.
+      const fit = await page.evaluate(() => globalThis.__orcaTerminalProbe.fit())
       expect(fit).not.toBeNull()
       expect(fit.cols).toBeGreaterThanOrEqual(20)
       expect(fit.rows).toBeGreaterThanOrEqual(8)
diff --git a/config/scripts/mobile-web-bundle-manifest.mjs b/config/scripts/mobile-web-bundle-manifest.mjs
index b7efce25ca0..2e9888f69c7 100644
--- a/config/scripts/mobile-web-bundle-manifest.mjs
+++ b/config/scripts/mobile-web-bundle-manifest.mjs
@@ -68,12 +68,10 @@ export function hashedAsset(bytes, extension) {
   }
 }
 
-function readIntegerConstant(source, name) {
+function readIntegerConstant(source, name, file = 'src/shared/protocol-version.ts') {
   const match = new RegExp(`export const ${name} = (\\d+)`).exec(source)
   if (!match) {
-    throw new Error(
-      `[mobile-web-bundle-manifest] ${name} not found in src/shared/protocol-version.ts`
-    )
+    throw new Error(`[mobile-web-bundle-manifest] ${name} not found in ${file}`)
   }
   return Number.parseInt(match[1], 10)
 }
@@ -94,6 +92,13 @@ export async function readProtocolWindow() {
   }
 }
 
+/** The page's build number, parsed for the same reason the protocol window is. */
+export async function readPageVersion() {
+  const file = join('src', 'shared', 'mobile-web-bundle', 'manifest-contract.ts')
+  const source = await readFile(join(projectDir, file), 'utf8')
+  return readIntegerConstant(source, 'MOBILE_WEB_PAGE_VERSION', file)
+}
+
 export async function readDesktopVersion() {
   const packageJson = JSON.parse(await readFile(join(projectDir, 'package.json'), 'utf8'))
   if (typeof packageJson.version !== 'string' || packageJson.version.length === 0) {
@@ -124,6 +129,7 @@ export async function writeMobileWebBundleTree({
     desktopVersion,
     minCompatibleRuntimeProtocolVersion: protocolWindow.minCompatibleRuntimeProtocolVersion,
     runtimeProtocolVersion: protocolWindow.runtimeProtocolVersion,
+    pageVersion: await readPageVersion(),
     entrypoint: MOBILE_WEB_BUNDLE_ENTRYPOINT,
     totalBytes: assets.reduce((total, asset) => total + asset.byteLength, 0),
     assets,
diff --git a/config/scripts/mobile-web-bundle-manifest.test.mjs b/config/scripts/mobile-web-bundle-manifest.test.mjs
index 3c4d35fd8a7..81c447878a8 100644
--- a/config/scripts/mobile-web-bundle-manifest.test.mjs
+++ b/config/scripts/mobile-web-bundle-manifest.test.mjs
@@ -1,10 +1,16 @@
+import { mkdtemp, readFile, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
 import { describe, expect, it } from 'vitest'
 import {
   computeMobileWebBundleBuildId,
   contentTypeForExtension,
   hashedAsset,
-  serializeMobileWebBundleAssets
+  serializeMobileWebBundleAssets,
+  sha256Hex,
+  writeMobileWebBundleTree
 } from './mobile-web-bundle-manifest.mjs'
+import { MobileWebBundleManifestSchema } from '../../src/shared/mobile-web-bundle/manifest-contract.js'
 
 describe('computeMobileWebBundleBuildId', () => {
   const assets = [
@@ -55,3 +61,30 @@ describe('hashedAsset', () => {
     expect(() => hashedAsset(Buffer.from('body'), 'wasm')).toThrow(/no content type registered/)
   })
 })
+
+describe('writeMobileWebBundleTree', () => {
+  it('stamps the page version the contract names, which the shell floors on', async () => {
+    const outDir = await mkdtemp(join(tmpdir(), 'mobile-web-bundle-manifest-'))
+    try {
+      const bytes = Buffer.from('<!doctype html>\n', 'utf8')
+      const entry = {
+        path: 'index.html',
+        bytes,
+        sha256: sha256Hex(bytes),
+        byteLength: bytes.byteLength,
+        contentType: contentTypeForExtension('html')
+      }
+      await writeMobileWebBundleTree({
+        outDir,
+        written: [entry],
+        desktopVersion: '1.0.0',
+        protocolWindow: { runtimeProtocolVersion: 3, minCompatibleRuntimeProtocolVersion: 3 }
+      })
+      const manifest = JSON.parse(await readFile(join(outDir, 'manifest.json'), 'utf8'))
+      expect(Number.isInteger(manifest.pageVersion)).toBe(true)
+      expect(MobileWebBundleManifestSchema.parse(manifest).pageVersion).toBe(manifest.pageVersion)
+    } finally {
+      await rm(outDir, { recursive: true, force: true })
+    }
+  })
+})
diff --git a/config/scripts/mobile-web-page-routes.test.mjs b/config/scripts/mobile-web-page-routes.test.mjs
index 88dc992d34f..3cc77197c61 100644
--- a/config/scripts/mobile-web-page-routes.test.mjs
+++ b/config/scripts/mobile-web-page-routes.test.mjs
@@ -1,20 +1,7 @@
-import { mkdtemp, readFile, rm } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { fileURLToPath } from 'node:url'
 import { describe, expect, it } from 'vitest'
 import { MobileWebBundleRouteSchema } from '../../src/shared/mobile-web-bundle/manifest-contract.ts'
-import {
-  buildMobileWebAppBundle,
-  resolveMobileWebPageRoutes
-} from './build-mobile-web-app-bundle.mjs'
-import { computeMobileWebBundleBuildId } from './mobile-web-bundle-manifest.mjs'
-import {
-  collectMobileWebAppRouteKeys,
-  routePathnameFromKey
-} from './mobile-web-app-route-manifest.mjs'
-import { mobileWebAppDependenciesPresent } from './mobile-web-app-bundle-dependencies.mjs'
-import { spelledCountsAgainstTables } from './spelled-count-census.mjs'
+import { resolveMobileWebPageRoutes } from './build-mobile-web-app-bundle.mjs'
+import { routePathnameFromKey } from './mobile-web-app-route-manifest.mjs'
 
 /**
  * Which screens this desktop declares as page routes, and whether the bundle can render each.
@@ -25,98 +12,6 @@ import { spelledCountsAgainstTables } from './spelled-count-census.mjs'
  * to register would have had to choose between a lint fence and a split it did not ask for.
  */
 
-const projectDir = fileURLToPath(new URL('../..', import.meta.url))
-const appDir = join(projectDir, 'mobile', 'app')
-
-// The sharded `test` job does not install mobile dependencies, so anything that runs esbuild over
-// the route tree is skipped there and run for real in pr.yml's mobile_web_app job.
-const itBundling = mobileWebAppDependenciesPresent() ? it : it.skip
-
-async function withScratch(run) {
-  const scratch = await mkdtemp(join(tmpdir(), 'orca-mobile-web-page-routes-test-'))
-  try {
-    return await run(scratch)
-  } finally {
-    await rm(scratch, { recursive: true, force: true })
-  }
-}
-
-/**
- * Every page route this bundle declares, written out rather than read from the source that
- * produces it: the point is to pin the list, and comparing the manifest to its own input would
- * pass whatever that input became. Shared by the assertions below, which read it two ways: what
- * the route tree resolves to, and what the built manifest actually carries.
- */
-const EXPECTED_PAGE_ROUTES = [
-  { pathname: '/h/[hostId]', grants: ['navigate', 'storage', 'externalLink', 'haptics'] },
-  {
-    pathname: '/h/[hostId]/agent-history/[worktreeId]',
-    grants: ['navigate', 'storage', 'externalLink', 'haptics']
-  },
-  {
-    pathname: '/h/[hostId]/tasks',
-    grants: ['navigate', 'storage', 'externalLink', 'haptics', 'native.clipboard.write']
-  },
-  {
-    pathname: '/h/[hostId]/files/[worktreeId]',
-    grants: ['navigate', 'storage', 'externalLink', 'haptics']
-  },
-  {
-    pathname: '/h/[hostId]/files/preview/[worktreeId]',
-    grants: ['navigate', 'storage', 'externalLink', 'haptics']
-  },
-  {
-    pathname: '/h/[hostId]/source-control/[worktreeId]',
-    grants: ['navigate', 'storage', 'externalLink', 'haptics', 'native.clipboard.write']
-  },
-  {
-    pathname: '/h/[hostId]/review/[worktreeId]',
-    grants: ['navigate', 'storage', 'externalLink', 'haptics', 'native.clipboard.write']
-  },
-  {
-    pathname: '/h/[hostId]/session/[worktreeId]',
-    grants: [
-      'navigate',
-      'storage',
-      'externalLink',
-      'haptics',
-      'screencastBinary',
-      'native.clipboard.write',
-      'native.clipboard.read',
-      'native.media.pick',
-      'native.media.read',
-      'native.media.release',
-      'native.audio.start',
-      'native.audio.read',
-      'native.audio.stop'
-    ],
-    // The one optional grant in the list (C8.1): the HTML preview's links, hidden rather than dead
-    // against a shell that cannot open one.
-    optionalGrants: ['externalNavigation']
-  }
-]
-
-const sessionGrants = EXPECTED_PAGE_ROUTES.filter(
-  (route) => route.pathname === '/h/[hostId]/session/[worktreeId]'
-).flatMap((route) => route.grants)
-
-const sessionOptionalGrants = EXPECTED_PAGE_ROUTES.filter(
-  (route) => route.pathname === '/h/[hostId]/session/[worktreeId]'
-).flatMap((route) => route.optionalGrants ?? [])
-
-const withPrefix = (prefix) => sessionGrants.filter((grant) => grant.startsWith(prefix))
-
-/** Every count this table's own comments spell out, beside the list each is a count of. */
-const SPELLED_COUNTS = [
-  { precedes: 'grants', counted: sessionGrants.length },
-  { precedes: 'audio verbs', counted: withPrefix('native.audio.').length },
-  { precedes: 'media verbs', counted: withPrefix('native.media.').length },
-  // "All three or none": the audio verbs again, as the rule that they are declared together.
-  { precedes: 'or none', counted: withPrefix('native.audio.').length },
-  // C8.1's, and the count the optional lane will grow first.
-  { precedes: 'optional grant', counted: sessionOptionalGrants.length }
-]
-
 describe('the page routes the manifest declares', () => {
   it('turns a route key into the URL pattern expo-router gives it', () => {
     expect(routePathnameFromKey('./h/[hostId]/index.tsx')).toBe('/h/[hostId]')
@@ -131,24 +26,6 @@ describe('the page routes the manifest declares', () => {
     expect(routePathnameFromKey('./h/[hostId]/_layout.tsx')).toBeNull()
   })
 
-  it("spells the session route's own counts off the table it comments", async () => {
-    const source = await readFile(
-      join(projectDir, 'config', 'scripts', 'mobile-web-page-routes.mjs'),
-      'utf8'
-    )
-    for (const { precedes, spelled, counts } of spelledCountsAgainstTables(
-      source,
-      SPELLED_COUNTS
-    )) {
-      expect(spelled, precedes).toEqual(counts)
-    }
-  })
-
-  it('declares only routes the bundle has a module for', async () => {
-    const keys = await collectMobileWebAppRouteKeys(appDir)
-    expect(resolveMobileWebPageRoutes(keys)).toEqual(EXPECTED_PAGE_ROUTES)
-  })
-
   /**
    * The optional lane through the builder, which drops what it does not name.
    *
@@ -200,18 +77,4 @@ describe('the page routes the manifest declares', () => {
       )
     ).toThrow('has no module in the bundle')
   })
-
-  itBundling(
-    'reaches the built manifest, where the build id does not move for it',
-    async () => {
-      await withScratch(async (scratch) => {
-        const { manifest } = await buildMobileWebAppBundle({ outDir: join(scratch, 'bundle') })
-        expect(manifest.routes).toEqual(EXPECTED_PAGE_ROUTES)
-        // The routes are derived from the same tree the script is built from, so the assets
-        // already decide them and the id has no reason to carry them as well.
-        expect(manifest.buildId).toBe(computeMobileWebBundleBuildId(manifest.assets))
-      })
-    },
-    240_000
-  )
 })
diff --git a/config/scripts/nsis-process-check.test.mjs b/config/scripts/nsis-process-check.test.mjs
new file mode 100644
index 00000000000..c469ffbc529
--- /dev/null
+++ b/config/scripts/nsis-process-check.test.mjs
@@ -0,0 +1,124 @@
+import { readFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { dirname, join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { runProcessSync } from '../../src/shared/child-process/run-process'
+
+const hooks = readFileSync(new URL('../nsis/orca-installer-hooks.nsh', import.meta.url), 'utf8')
+const processCheck = readFileSync(
+  new URL('../nsis/orca-process-check.nsh', import.meta.url),
+  'utf8'
+)
+const require = createRequire(import.meta.url)
+const builderRequire = createRequire(require.resolve('electron-builder/package.json'))
+const upstreamChecks = readFileSync(
+  join(
+    dirname(builderRequire.resolve('app-builder-lib/package.json')),
+    'templates/nsis/include/allowOnlyOneInstallerInstance.nsh'
+  ),
+  'utf8'
+)
+
+function readPowerShellProbe(source = processCheck) {
+  const match = source.match(/nsExec::Exec `"\$PowerShellPath"(.*?) -(?:C|Command) "([^"\n]+)"`/)
+  if (!match) {
+    throw new Error('The NSIS PowerShell invocation was not found')
+  }
+  return { args: match[1].trim().split(/\s+/).filter(Boolean), command: match[2] }
+}
+
+describe('NSIS process-check integration', () => {
+  it('loads the capability hook through the installer and uninstaller include', () => {
+    expect(hooks).toContain('!include "${__FILEDIR__}\\orca-process-check.nsh"')
+    expect(processCheck).toMatch(/!macro customCheckAppRunning\b/)
+    expect(processCheck).toContain('!include "getProcessInfo.nsh"')
+    expect(processCheck).toMatch(/^Var pid$/m)
+    expect(processCheck).toMatch(/^Var \/GLOBAL IsPowerShellAvailable$/m)
+  })
+
+  it('keeps upstream process selection, retries, and installation-mode handling', () => {
+    expect(processCheck).toContain('!insertmacro _CHECK_APP_RUNNING')
+    expect(processCheck).not.toMatch(/!macro (?:FIND_PROCESS|KILL_PROCESS|_CHECK_APP_RUNNING)\b/)
+    expect(processCheck).not.toMatch(/\b(?:Stop-Process|taskkill|Set-ExecutionPolicy)\b/)
+    const findProcess = upstreamChecks.match(/!macro FIND_PROCESS\b[\s\S]*?!macroend/)?.[0]
+    if (!findProcess) {
+      throw new Error('The upstream process finder was not found')
+    }
+    expect(readPowerShellProbe().args).toEqual(readPowerShellProbe(findProcess).args)
+  })
+})
+
+describe.runIf(process.platform === 'win32')(
+  'NSIS capability probe under Restricted policy',
+  () => {
+    const policyReceipt = 'orca-nsis: restricted policy verified'
+    const queryFailureReceipt = 'orca-nsis: injected query failure'
+    const policyCheck = [
+      'function Test-OrcaRestrictedPolicy { param([string]$Scope)',
+      "try { $parameters = @{ ErrorAction = 'Stop' };",
+      'if ($Scope) { $parameters.Scope = $Scope };',
+      "return ((Get-ExecutionPolicy @parameters) -eq 'Restricted')",
+      '} catch { return $false } };',
+      // A failed getter must not fall through to the query's successful exit.
+      "if ((Test-OrcaRestrictedPolicy '__orca_invalid_scope__') -ne $false) { exit 11 };",
+      "if ((Test-OrcaRestrictedPolicy 'Process') -ne $true) { exit 10 };",
+      'if ((Test-OrcaRestrictedPolicy) -ne $true) { exit 10 };',
+      `[Console]::Out.WriteLine('${policyReceipt}');`
+    ].join(' ')
+
+    // A watchdog against a wedged probe, not a latency budget: Windows PowerShell 5.1
+    // cold start under the packaged-CI process load has reached the former 20s cap. Matches
+    // the synchronous-probe ceiling in tests/tools/win-update-e2e/powershell-runner.mjs.
+    const PROBE_TIMEOUT_MS = 60_000
+    // Vitest's 30s default would otherwise cap the blocking spawn ahead of PROBE_TIMEOUT_MS.
+    const PROBE_TEST_TIMEOUT_MS = PROBE_TIMEOUT_MS + 15_000
+
+    function runProbe(arch, prefix = '') {
+      const { args, command } = readPowerShellProbe()
+      if (!process.env.SystemRoot) {
+        throw new Error('SystemRoot is required on Windows')
+      }
+      // The pwsh runner's module path points Windows PowerShell at incompatible PS7 modules.
+      const env = Object.fromEntries(
+        Object.entries(process.env).filter(([key]) => key.toLowerCase() !== 'psmodulepath')
+      )
+      return runProcessSync({
+        program: join(process.env.SystemRoot, arch, 'WindowsPowerShell', 'v1.0', 'powershell.exe'),
+        args: [...args, '-Command', `${policyCheck} ${prefix}${command}`],
+        env: {
+          ...env,
+          ORCA_BACKGROUND_LAUNCH: '1',
+          PSExecutionPolicyPreference: 'Restricted'
+        },
+        timeoutMs: PROBE_TIMEOUT_MS
+      })
+    }
+
+    it.each(['SysWOW64', 'System32'])(
+      '%s permits the real inline process query',
+      { timeout: PROBE_TEST_TIMEOUT_MS },
+      (arch) => {
+        const result = runProbe(arch)
+        expect(result.code, JSON.stringify(result)).toBe(0)
+        expect(result.timedOut).toBe(false)
+        expect(result.stdout).toContain(policyReceipt)
+      }
+    )
+
+    it.each(['SysWOW64', 'System32'])(
+      '%s rejects a failed process query',
+      { timeout: PROBE_TEST_TIMEOUT_MS },
+      (arch) => {
+        const result = runProbe(
+          arch,
+          'function Get-CimInstance { [CmdletBinding()] param([string]$ClassName); ' +
+            `[Console]::Out.WriteLine('${queryFailureReceipt}'); Write-Error 'CIM unavailable' }; `
+        )
+        expect(result.code, JSON.stringify(result)).toBe(1)
+        expect(result.timedOut).toBe(false)
+        expect(result.stdout).toContain(policyReceipt)
+        expect(result.stdout).toContain(queryFailureReceipt)
+      }
+    )
+  }
+)
diff --git a/config/scripts/orcad-artifact-version.mjs b/config/scripts/orcad-artifact-version.mjs
index ef85540bbaa..e7f2284f59f 100644
--- a/config/scripts/orcad-artifact-version.mjs
+++ b/config/scripts/orcad-artifact-version.mjs
@@ -1,11 +1,15 @@
 import { createHash } from 'node:crypto'
 import { existsSync, readFileSync } from 'node:fs'
 import { join } from 'node:path'
-import { ORCAD_VERSION, orcadArtifactFilenames } from '../../src/shared/orcad-artifacts.ts'
+import {
+  ORCAD_VERSION,
+  orcadArtifactFilenames,
+  orcadArtifactHashPrefix
+} from '../../src/shared/orcad-artifacts.ts'
 
-export function computeOrcadFullVersion(artifactDir) {
-  const hash = createHash('sha256')
-  for (const filename of orcadArtifactFilenames()) {
+export function computeOrcadFullVersion(artifactDir, { target = '', agentBrowserFilename } = {}) {
+  const hash = createHash('sha256').update(orcadArtifactHashPrefix(target))
+  for (const filename of orcadArtifactFilenames(target)) {
     const artifactPath = join(artifactDir, filename)
     if (!existsSync(artifactPath)) {
       throw new Error(
@@ -15,5 +19,8 @@ export function computeOrcadFullVersion(artifactDir) {
     }
     hash.update(readFileSync(artifactPath))
   }
+  if (agentBrowserFilename && existsSync(join(artifactDir, agentBrowserFilename))) {
+    hash.update(readFileSync(join(artifactDir, agentBrowserFilename)))
+  }
   return `${ORCAD_VERSION}+${hash.digest('hex').slice(0, 12)}`
 }
diff --git a/config/scripts/orcad-artifact-version.test.mjs b/config/scripts/orcad-artifact-version.test.mjs
index a6d316b7f41..01c1ae3f8ff 100644
--- a/config/scripts/orcad-artifact-version.test.mjs
+++ b/config/scripts/orcad-artifact-version.test.mjs
@@ -1,30 +1,67 @@
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
-import { describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it } from 'vitest'
 import {
+  ORCAD_BUILD_TARGET_FILENAME,
   ORCAD_RIPGREP_ARTIFACTS,
   orcadArtifactFilenames
 } from '../../src/shared/orcad-artifacts.ts'
+import { ORCAD_BUN_TARGETS } from '../../src/shared/orcad-bun-runtime.ts'
+import { orcadAgentBrowserNativeName } from '../../src/shared/orcad-agent-browser-name.ts'
+import { readOrcadArtifactIdentity } from '../../src/main/orcad/orcad-artifact-identity.ts'
 import { computeOrcadFullVersion } from './orcad-artifact-version.mjs'
 
+const directories = []
+afterEach(() => {
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function createArtifactDirectory(target = '') {
+  const directory = mkdtempSync(join(tmpdir(), 'orcad-version-'))
+  directories.push(directory)
+  for (const filename of orcadArtifactFilenames(target)) {
+    const path = join(directory, filename)
+    mkdirSync(dirname(path), { recursive: true })
+    writeFileSync(path, filename)
+  }
+  writeFileSync(join(directory, ORCAD_BUILD_TARGET_FILENAME), `${target}\n`)
+  return directory
+}
+
 describe('standalone runtime version', () => {
   it('changes when a shipped search binary changes and rejects a missing binary', () => {
-    const dir = mkdtempSync(join(tmpdir(), 'orcad-version-'))
-    try {
-      for (const filename of orcadArtifactFilenames()) {
-        const path = join(dir, filename)
-        mkdirSync(dirname(path), { recursive: true })
-        writeFileSync(path, filename)
-      }
-      const before = computeOrcadFullVersion(dir)
-      const binary = join(dir, ORCAD_RIPGREP_ARTIFACTS[0])
-      writeFileSync(binary, 'updated binary')
-      expect(computeOrcadFullVersion(dir)).not.toBe(before)
-      rmSync(binary)
-      expect(() => computeOrcadFullVersion(dir)).toThrow(ORCAD_RIPGREP_ARTIFACTS[0])
-    } finally {
-      rmSync(dir, { recursive: true, force: true })
-    }
+    const dir = createArtifactDirectory()
+    const before = computeOrcadFullVersion(dir)
+    const binary = join(dir, ORCAD_RIPGREP_ARTIFACTS[0])
+    writeFileSync(binary, 'updated binary')
+    expect(computeOrcadFullVersion(dir)).not.toBe(before)
+    rmSync(binary)
+    expect(() => computeOrcadFullVersion(dir)).toThrow(ORCAD_RIPGREP_ARTIFACTS[0])
   })
+
+  it.each(ORCAD_BUN_TARGETS)(
+    'matches the installed %s identity with and without its optional browser',
+    async (target) => {
+      const dir = createArtifactDirectory(target)
+      const [platform, arch] = target.split('-')
+      const agentBrowserFilename = orcadAgentBrowserNativeName(
+        platform,
+        arch,
+        target.endsWith('-musl') ? 'musl' : 'glibc'
+      )
+      const options = { target, agentBrowserFilename }
+      const withoutBrowser = computeOrcadFullVersion(dir, options)
+      expect(withoutBrowser).toBe(await readOrcadArtifactIdentity(dir))
+      writeFileSync(join(dir, agentBrowserFilename), 'browser')
+      const withBrowser = computeOrcadFullVersion(dir, options)
+      expect(withBrowser).not.toBe(withoutBrowser)
+      expect(withBrowser).toBe(await readOrcadArtifactIdentity(dir))
+      writeFileSync(join(dir, agentBrowserFilename), 'updated-browser')
+      expect(computeOrcadFullVersion(dir, options)).not.toBe(withBrowser)
+      expect(computeOrcadFullVersion(dir, options)).toBe(await readOrcadArtifactIdentity(dir))
+    }
+  )
 })
diff --git a/config/scripts/orcad-entry-build.mjs b/config/scripts/orcad-entry-build.mjs
new file mode 100644
index 00000000000..fa2c83050ac
--- /dev/null
+++ b/config/scripts/orcad-entry-build.mjs
@@ -0,0 +1,58 @@
+import { build } from 'esbuild'
+import { join } from 'node:path'
+
+const root = join(import.meta.dirname, '..', '..')
+
+export const ORCAD_ENTRY_POINT = 'src/main/orcad/main.ts'
+export const ORCAD_CHILD_ENTRY_POINTS = {
+  watcher: 'src/main/ipc/parcel-watcher-process-entry.ts',
+  daemon: 'src/main/daemon/daemon-entry.ts',
+  ptyGate: 'src/main/daemon/pty-subprocess/windows-bun-pty-gate-entry.ts',
+  writer: 'src/main/persistence/profile-state/profile-state-writer-worker-entry.ts',
+  backup: 'src/main/persistence/profile-state/profile-state-backup-worker-entry.ts'
+}
+
+export const ORCAD_EXTERNAL_MODULES = [
+  'electron',
+  'node-pty',
+  '@parcel/watcher',
+  'fsevents',
+  'bun:ffi',
+  'bun:sqlite'
+]
+
+// Native binaries are staged separately from every JavaScript entry.
+export const externalNativeAddons = {
+  name: 'external-native-addons',
+  setup(pluginBuild) {
+    pluginBuild.onResolve({ filter: /\.node$/ }, (args) => ({ path: args.path, external: true }))
+  }
+}
+
+// The UMD build's relative dynamic requires cannot be bundled.
+const jsoncParserEsm = {
+  name: 'jsonc-parser-esm',
+  setup(pluginBuild) {
+    pluginBuild.onResolve({ filter: /^jsonc-parser$/ }, () => ({
+      path: join(root, 'node_modules', 'jsonc-parser', 'lib', 'esm', 'main.js')
+    }))
+  }
+}
+
+export function buildOrcadEntry(outfile) {
+  return build({
+    entryPoints: [join(root, ORCAD_ENTRY_POINT)],
+    bundle: true,
+    platform: 'node',
+    target: 'node18',
+    format: 'cjs',
+    outfile,
+    external: ORCAD_EXTERNAL_MODULES,
+    plugins: [jsoncParserEsm, externalNativeAddons],
+    metafile: true,
+    minify: true,
+    sourcemap: false,
+    define: { 'process.env.NODE_ENV': '"production"' },
+    logLevel: 'error'
+  })
+}
diff --git a/config/scripts/orcad-template-test-fixture.mjs b/config/scripts/orcad-template-test-fixture.mjs
new file mode 100644
index 00000000000..2f11a32e83f
--- /dev/null
+++ b/config/scripts/orcad-template-test-fixture.mjs
@@ -0,0 +1,50 @@
+import { createHash } from 'node:crypto'
+import { mkdir, writeFile } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
+import {
+  ORCAD_BUILD_TARGET_FILENAME,
+  ORCAD_TEMPLATE_MANIFEST_FILENAME,
+  ORCAD_TEMPLATE_TARGETS_DIR,
+  orcadTemplateCommonFilenames
+} from '../../src/shared/orcad-artifacts.ts'
+import { ORCAD_TEMPLATE_TARGETS } from '../../src/shared/orcad-bun-runtime.ts'
+
+async function write(path, contents) {
+  await mkdir(dirname(path), { recursive: true })
+  await writeFile(path, contents)
+  return createHash('sha256').update(contents).digest('hex')
+}
+
+export async function writeOrcadTemplateTestFixture(resourcesDir) {
+  const templateDir = join(resourcesDir, 'orcad-template')
+  const commonFilenames = orcadTemplateCommonFilenames()
+  const commonSha256 = {}
+  for (const filename of commonFilenames) {
+    commonSha256[filename] = await write(
+      join(templateDir, ...filename.split('/')),
+      Buffer.from(`common:${filename}`)
+    )
+  }
+  const targets = {}
+  for (const target of ORCAD_TEMPLATE_TARGETS) {
+    const targetDir = join(templateDir, ORCAD_TEMPLATE_TARGETS_DIR, target)
+    targets[target] = {
+      targetSha256: await write(join(targetDir, ORCAD_BUILD_TARGET_FILENAME), `${target}\n`),
+      watcherSha256: await write(join(targetDir, 'watcher.node'), `watcher:${target}`)
+    }
+  }
+  const browserName = 'agent-browser-linux-x64'
+  targets['linux-x64-glibc'] = {
+    ...targets['linux-x64-glibc'],
+    browserName,
+    browserSha256: await write(
+      join(templateDir, ORCAD_TEMPLATE_TARGETS_DIR, 'linux-x64-glibc', browserName),
+      'browser'
+    )
+  }
+  await writeFile(
+    join(templateDir, ORCAD_TEMPLATE_MANIFEST_FILENAME),
+    JSON.stringify({ schemaVersion: 2, commonSha256, targets })
+  )
+  return templateDir
+}
diff --git a/config/scripts/orcad-terminal-smoke-change-scope.mjs b/config/scripts/orcad-terminal-smoke-change-scope.mjs
new file mode 100644
index 00000000000..9dd58dab20c
--- /dev/null
+++ b/config/scripts/orcad-terminal-smoke-change-scope.mjs
@@ -0,0 +1,54 @@
+import { readFileSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
+import { classifyBunProfileChanges, collectBunProfileInputs } from './bun-profile-change-scope.mjs'
+import { ORCAD_CHILD_ENTRY_POINTS, ORCAD_ENTRY_POINT } from './orcad-entry-build.mjs'
+
+const ENTRY_POINTS = [
+  ORCAD_ENTRY_POINT,
+  ...Object.values(ORCAD_CHILD_ENTRY_POINTS),
+  'src/cli/index.ts',
+  'config/scripts/build-orcad-bun.mjs',
+  'config/scripts/build-orcad.mjs',
+  'config/scripts/ensure-native-runtime.mjs',
+  'config/scripts/rebuild-native-deps.mjs',
+  'config/scripts/verify-cli-bin.mjs',
+  'config/scripts/install-dev-cli.mjs',
+  'config/scripts/orca-dev.mjs',
+  'config/scripts/runtime-serve-terminal-smoke.mjs',
+  'config/scripts/orcad-terminal-smoke-change-scope.mjs'
+]
+
+export function collectOrcadTerminalSmokeInputs() {
+  return collectBunProfileInputs({ entryPoints: ENTRY_POINTS })
+}
+
+export async function classifyOrcadTerminalSmokeChanges(
+  changedFiles,
+  collect = collectOrcadTerminalSmokeInputs
+) {
+  const forced = changedFiles.find(
+    (file) =>
+      ENTRY_POINTS.includes(file) ||
+      file === '.github/workflows/pr.yml' ||
+      file.startsWith('config/scripts/orcad-terminal-smoke-') ||
+      file.startsWith('config/scripts/runtime-serve-terminal-smoke') ||
+      // createRequire-loaded native probes are invisible to esbuild's import graph.
+      (file.startsWith('config/scripts/') && file.endsWith('.cjs')) ||
+      // CLI emit and runtime resources include files opened by path, outside the import graph.
+      file.startsWith('src/cli/') ||
+      file.startsWith('src/shared/') ||
+      file.startsWith('resources/')
+  )
+  if (forced) {
+    return { shouldRun: true, reason: `Smoke input changed: ${forced}` }
+  }
+  // Retain the Bun gate's native, worker, toolchain and failed-analysis safeguards.
+  return classifyBunProfileChanges(changedFiles, collect)
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const changedFiles = readFileSync(process.argv[2], 'utf8').split('\0').filter(Boolean)
+  const result = await classifyOrcadTerminalSmokeChanges(changedFiles)
+  console.error(result.reason)
+  process.stdout.write(`${result.shouldRun}\n`)
+}
diff --git a/config/scripts/orcad-terminal-smoke-change-scope.test.mjs b/config/scripts/orcad-terminal-smoke-change-scope.test.mjs
new file mode 100644
index 00000000000..e0e978800fc
--- /dev/null
+++ b/config/scripts/orcad-terminal-smoke-change-scope.test.mjs
@@ -0,0 +1,109 @@
+import { readFileSync } from 'node:fs'
+import { beforeAll, describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+import {
+  classifyOrcadTerminalSmokeChanges,
+  collectOrcadTerminalSmokeInputs
+} from './orcad-terminal-smoke-change-scope.mjs'
+import { ORCAD_CHILD_ENTRY_POINTS } from './orcad-entry-build.mjs'
+
+it.each([
+  'package.json',
+  'pnpm-lock.yaml',
+  'tsconfig.json',
+  'config/tsconfig.cli.json',
+  'config/patches/node-pty@1.1.0.patch',
+  'native/windows-registry/src/addon.cc',
+  'config/scripts/node-pty-job-ownership.cjs',
+  '.github/actions/install-node-dependencies/action.yml',
+  '.github/workflows/pr.yml',
+  'src/cli/deleted-command.ts',
+  'src/shared/deleted-contract.ts',
+  'src/main/persistence/profile-state/new-worker.ts',
+  'resources/licenses/ripgrep/COPYING',
+  'config/scripts/runtime-serve-terminal-smoke.test.mjs',
+  'config/scripts/orcad-terminal-smoke-change-scope.test.mjs'
+])('retains the smoke for build and dynamically opened input changes: %s', async (file) => {
+  expect((await classifyOrcadTerminalSmokeChanges([file], async () => new Set())).shouldRun).toBe(
+    true
+  )
+})
+
+it('retains smoke when changed-file evidence or dependency analysis is unavailable', async () => {
+  expect((await classifyOrcadTerminalSmokeChanges([])).shouldRun).toBe(true)
+  const result = await classifyOrcadTerminalSmokeChanges(['src/main/deleted.ts'], async () => {
+    throw new Error('Could not resolve deleted dependency')
+  })
+  expect(result.shouldRun).toBe(true)
+  expect(result.reason).toContain('Dependency graph unavailable')
+})
+
+describe('the actual terminal smoke dependency graph', () => {
+  let inputs
+  beforeAll(async () => {
+    inputs = await collectOrcadTerminalSmokeInputs()
+  }, 60_000)
+
+  it.each([
+    ...Object.values(ORCAD_CHILD_ENTRY_POINTS),
+    'src/main/runtime/orca-runtime.ts',
+    'src/main/windows/windows-process-table.ts',
+    'src/main/worker-thread-entry-path.ts',
+    'src/cli/index.ts',
+    'config/scripts/runtime-serve-terminal-smoke.mjs',
+    'config/scripts/build-orcad-bun.mjs',
+    'config/scripts/build-orcad.mjs',
+    'config/scripts/profile-state-worker-smoke.mjs',
+    'config/scripts/install-dev-cli.mjs',
+    'config/scripts/verify-cli-bin.mjs',
+    'config/scripts/bun-profile-change-scope.mjs'
+  ])('retains the runtime, CLI, build or smoke dependency: %s', async (file) => {
+    expect(inputs.has(file)).toBe(true)
+    expect((await classifyOrcadTerminalSmokeChanges([file], async () => inputs)).shouldRun).toBe(
+      true
+    )
+  })
+
+  it.each([
+    'src/renderer/src/components/Example.tsx',
+    'src/main/menu/register-app-menu.ts',
+    'config/scripts/ci-shard-timings.json',
+    '.github/workflows/e2e.yml',
+    'docs/reference/ci-runner-efficiency.md'
+  ])('skips unrelated inputs: %s', async (file) => {
+    expect((await classifyOrcadTerminalSmokeChanges([file], async () => inputs)).shouldRun).toBe(
+      false
+    )
+  })
+
+  it('retains a removed source path when a file is renamed outside the CLI tree', async () => {
+    expect(
+      (
+        await classifyOrcadTerminalSmokeChanges(
+          ['src/cli/deleted-command.ts', 'docs/moved-command.ts'],
+          async () => inputs
+        )
+      ).shouldRun
+    ).toBe(true)
+  })
+})
+
+it('only skips the unchanged smoke after a successful diff and dependency analysis', () => {
+  const workflow = parse(
+    readFileSync(new URL('../../.github/workflows/pr.yml', import.meta.url), 'utf8')
+  )
+  const step = workflow.jobs.static_analysis.steps.find(
+    (candidate) => candidate.name === 'Boot orcad and round-trip a terminal'
+  )
+  expect(step.env).toEqual({
+    BASE_SHA: '${{ github.event.pull_request.base.sha }}',
+    ORCA_BACKGROUND_LAUNCH: '1'
+  })
+  // See the localization gate: HEAD^1 removes the merge-base computation, so a shallow checkout
+  // is enough and the payload head SHA is unused.
+  expect(step.run).toContain('node config/scripts/git-pull-request-diff-base.mjs "$BASE_SHA"')
+  expect(step.run).toContain('git diff --name-only --no-renames -z "$DIFF_BASE" HEAD')
+  expect(step.run).not.toContain('--diff-filter')
+  expect(step.run).toContain('&& [ "$scope" = false ]; then')
+  expect(step.run).toMatch(/else\s+pnpm run smoke:orcad-terminal\s+fi/)
+})
diff --git a/config/scripts/orcad-watcher-package.mjs b/config/scripts/orcad-watcher-package.mjs
new file mode 100644
index 00000000000..5107d23fe58
--- /dev/null
+++ b/config/scripts/orcad-watcher-package.mjs
@@ -0,0 +1,86 @@
+import { createHash } from 'node:crypto'
+import { mkdir, readFile, writeFile } from 'node:fs/promises'
+import { createRequire } from 'node:module'
+import { join, resolve } from 'node:path'
+import { x as extractTar } from 'tar'
+import { parseAllDocuments } from 'yaml'
+import { ORCAD_BUN_TARGETS } from '../../src/shared/orcad-bun-runtime.ts'
+
+const root = resolve(import.meta.dirname, '../..')
+const require = createRequire(import.meta.url)
+const archiveLimit = 16 * 1024 * 1024
+
+export function parseWatcherLockfile(contents) {
+  const packages = {}
+  for (const document of parseAllDocuments(contents)) {
+    if (document.errors.length) {
+      throw document.errors[0]
+    }
+    Object.assign(packages, document.toJS()?.packages)
+  }
+  return { packages }
+}
+
+export function watcherPackageIdentity(target, version, lockfile) {
+  if (!ORCAD_BUN_TARGETS.includes(target)) {
+    throw new Error(`Unsupported watcher target: ${target}`)
+  }
+  const name = `@parcel/watcher-${target}`
+  const integrity = lockfile.packages?.[`${name}@${version}`]?.resolution?.integrity
+  if (typeof integrity !== 'string' || !/^sha512-[A-Za-z0-9+/]+=*$/.test(integrity)) {
+    throw new Error(`The lockfile does not pin ${name}@${version}`)
+  }
+  return {
+    integrity,
+    url: `https://registry.npmjs.org/${name}/-/watcher-${target}-${version}.tgz`
+  }
+}
+
+export function verifyWatcherArchive(bytes, integrity) {
+  if (bytes.length > archiveLimit) {
+    throw new Error('Watcher archive exceeds the size limit')
+  }
+  if (`sha512-${createHash('sha512').update(bytes).digest('base64')}` !== integrity) {
+    throw new Error('Watcher archive does not match the lockfile integrity')
+  }
+}
+
+// Fetch only these small release assets; ordinary installs remain host-only.
+export async function materializeWatcherPackage(target) {
+  const { version } = require('@parcel/watcher/package.json')
+  const lockfile = parseWatcherLockfile(await readFile(join(root, 'pnpm-lock.yaml'), 'utf8'))
+  const { integrity, url } = watcherPackageIdentity(target, version, lockfile)
+  const cache = join(root, 'out', '.orcad-watchers', version, target)
+  const archivePath = join(cache, 'package.tgz')
+  await mkdir(cache, { recursive: true })
+  let bytes
+  try {
+    bytes = await readFile(archivePath)
+    verifyWatcherArchive(bytes, integrity)
+  } catch {
+    const response = await fetch(url, { signal: AbortSignal.timeout(60_000) })
+    if (!response.ok || !response.body) {
+      await response.body?.cancel()
+      throw new Error(`Watcher download failed: ${response.status} ${response.statusText}`)
+    }
+    const chunks = []
+    let length = 0
+    for await (const chunk of response.body) {
+      length += chunk.length
+      if (length > archiveLimit) {
+        throw new Error('Watcher archive exceeds the size limit')
+      }
+      chunks.push(chunk)
+    }
+    bytes = Buffer.concat(chunks)
+    verifyWatcherArchive(bytes, integrity)
+    await writeFile(archivePath, bytes)
+  }
+  await extractTar({
+    file: archivePath,
+    cwd: cache,
+    strict: true,
+    filter: (path, entry) => path === 'package/watcher.node' && entry.type === 'File'
+  })
+  return join(cache, 'package', 'watcher.node')
+}
diff --git a/config/scripts/orcad-watcher-package.test.mjs b/config/scripts/orcad-watcher-package.test.mjs
new file mode 100644
index 00000000000..9baaa71dc7e
--- /dev/null
+++ b/config/scripts/orcad-watcher-package.test.mjs
@@ -0,0 +1,40 @@
+import { createHash } from 'node:crypto'
+import { describe, expect, it } from 'vitest'
+import {
+  parseWatcherLockfile,
+  verifyWatcherArchive,
+  watcherPackageIdentity
+} from './orcad-watcher-package.mjs'
+
+describe('locked watcher release assets', () => {
+  const archive = Buffer.from('archive')
+  const integrity = `sha512-${createHash('sha512').update(archive).digest('base64')}`
+
+  it('reads dependency pins after the package-manager document in pnpm 12 lockfiles', () => {
+    const lockfile = parseWatcherLockfile(
+      `---\npackages: {}\n---\npackages:\n  '@parcel/watcher-linux-x64-glibc@2.5.6':\n    resolution:\n      integrity: ${integrity}\n`
+    )
+    expect(watcherPackageIdentity('linux-x64-glibc', '2.5.6', lockfile).integrity).toBe(integrity)
+  })
+
+  it('resolves a target using the exact installed wrapper version and locked integrity', () => {
+    const lockfile = {
+      packages: { '@parcel/watcher-linux-x64-musl@2.5.6': { resolution: { integrity } } }
+    }
+    expect(watcherPackageIdentity('linux-x64-musl', '2.5.6', lockfile)).toEqual({
+      integrity,
+      url: 'https://registry.npmjs.org/@parcel/watcher-linux-x64-musl/-/watcher-linux-x64-musl-2.5.6.tgz'
+    })
+    expect(() => watcherPackageIdentity('linux-x64-glibc', '2.5.6', lockfile)).toThrow('lockfile')
+    expect(() => watcherPackageIdentity('linux-x64-musl', '2.5.7', lockfile)).toThrow('lockfile')
+  })
+
+  it('rejects missing, unknown and corrupted inputs before extraction', () => {
+    expect(() => watcherPackageIdentity('../x64', '2.5.6', {})).toThrow('Unsupported')
+    expect(() => verifyWatcherArchive(archive, integrity)).not.toThrow()
+    expect(() => verifyWatcherArchive(Buffer.from('tampered'), integrity)).toThrow('integrity')
+    expect(() => verifyWatcherArchive(Buffer.alloc(16 * 1024 * 1024 + 1), integrity)).toThrow(
+      'size limit'
+    )
+  })
+})
diff --git a/config/scripts/orcad-windows-process-tree.mjs b/config/scripts/orcad-windows-process-tree.mjs
new file mode 100644
index 00000000000..af1b3ceceec
--- /dev/null
+++ b/config/scripts/orcad-windows-process-tree.mjs
@@ -0,0 +1,48 @@
+import { copyFileSync, lstatSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { join } from 'node:path'
+import { ORCAD_WINDOWS_PROCESS_TREE_FILENAME } from '../../src/shared/orcad-artifacts.ts'
+import {
+  inspectWindowsProcessTreeAddon,
+  windowsProcessTreeAddonPath
+} from './windows-process-tree-gyp-rebuild.mjs'
+
+const { PE_MACHINE, describePeMachine, readPeMachine } = createRequire(import.meta.url)(
+  './windows-pe-machine.cjs'
+)
+
+export function stageOrcadWindowsProcessTree(
+  root,
+  outputDir,
+  target,
+  host = { platform: process.platform, arch: process.arch }
+) {
+  if (!target.startsWith('win32-')) {
+    return
+  }
+  const arch = target.slice('win32-'.length)
+  let source = join(
+    root,
+    '.build',
+    'windows-process-tree',
+    arch,
+    ORCAD_WINDOWS_PROCESS_TREE_FILENAME
+  )
+  // Ordinary Windows installs already compile this N-API addon for the host.
+  if (target === `${host.platform}-${host.arch}` && !lstatSync(source, { throwIfNoEntry: false })) {
+    source = windowsProcessTreeAddonPath(
+      join(root, 'node_modules', '@vscode', 'windows-process-tree')
+    )
+  }
+  if (inspectWindowsProcessTreeAddon(source) !== 'clean') {
+    throw new Error(
+      `Orcad ${target} requires a patched process reader. On Windows, run: ` +
+        `node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=${arch}`
+    )
+  }
+  const machine = readPeMachine(source)
+  if (machine !== PE_MACHINE[arch]) {
+    throw new Error(`Orcad ${target} process reader has ${describePeMachine(machine)}`)
+  }
+  copyFileSync(source, join(outputDir, ORCAD_WINDOWS_PROCESS_TREE_FILENAME))
+}
diff --git a/config/scripts/orcad-windows-process-tree.test.mjs b/config/scripts/orcad-windows-process-tree.test.mjs
new file mode 100644
index 00000000000..acc53f27194
--- /dev/null
+++ b/config/scripts/orcad-windows-process-tree.test.mjs
@@ -0,0 +1,109 @@
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, expect, it } from 'vitest'
+import { stageOrcadWindowsProcessTree } from './orcad-windows-process-tree.mjs'
+import { windowsProcessTreeAddonPath } from './windows-process-tree-gyp-rebuild.mjs'
+
+const windowsHost = { platform: 'win32', arch: 'x64' }
+
+const roots = []
+afterEach(() => roots.splice(0).forEach((root) => rmSync(root, { recursive: true, force: true })))
+
+function fixture(machine = 0x8664, suffix = '') {
+  const root = mkdtempSync(join(tmpdir(), 'orcad-process-reader-'))
+  roots.push(root)
+  const source = join(root, '.build/windows-process-tree/x64')
+  const output = join(root, 'output')
+  mkdirSync(source, { recursive: true })
+  mkdirSync(output)
+  const bytes = Buffer.alloc(0x90)
+  bytes.write('MZ')
+  bytes.writeUInt32LE(0x80, 0x3c)
+  bytes.write('PE\0\0', 0x80)
+  bytes.writeUInt16LE(machine, 0x84)
+  const file = join(source, 'windows-process-tree.node')
+  writeFileSync(file, Buffer.concat([bytes, Buffer.from(suffix)]))
+  return { root, output, file }
+}
+
+function installedFixture(machine = 0x8664, suffix = '') {
+  const prepared = fixture(machine, suffix)
+  const packageDir = join(prepared.root, 'node_modules', '@vscode', 'windows-process-tree')
+  mkdirSync(join(packageDir, 'build', 'Release'), { recursive: true })
+  const installed = windowsProcessTreeAddonPath(packageDir)
+  writeFileSync(installed, readFileSync(prepared.file))
+  rmSync(prepared.file)
+  return { ...prepared, installed }
+}
+
+it('stages only a clean reader for the requested machine', () => {
+  const { root, output, file } = fixture()
+  stageOrcadWindowsProcessTree(root, output, 'win32-x64')
+  expect(readFileSync(join(output, 'windows-process-tree.node'))).toEqual(readFileSync(file))
+})
+
+it('rejects an unpatched reader even when its architecture matches', () => {
+  const { root, output } = fixture(0x8664, 'ReadProcessMemory')
+  expect(() => stageOrcadWindowsProcessTree(root, output, 'win32-x64')).toThrow(
+    'patched process reader'
+  )
+})
+
+it('rejects wrong architecture and absent artifacts', () => {
+  const { root, output } = fixture(0xaa64)
+  expect(() => stageOrcadWindowsProcessTree(root, output, 'win32-x64')).toThrow('machine 0xaa64')
+  expect(() => stageOrcadWindowsProcessTree(root, output, 'win32-arm64')).toThrow(
+    'patched process reader'
+  )
+})
+
+it('keeps POSIX builds independent of Windows build tools', () => {
+  expect(() => stageOrcadWindowsProcessTree('absent', 'absent', 'linux-x64-glibc')).not.toThrow()
+})
+
+it.each([
+  ['x64', 0x8664],
+  ['arm64', 0xaa64]
+])('reuses the checked native addon from a Windows %s host install', (arch, machine) => {
+  const { root, output, installed } = installedFixture(machine)
+  stageOrcadWindowsProcessTree(root, output, `win32-${arch}`, { platform: 'win32', arch })
+  expect(readFileSync(join(output, 'windows-process-tree.node'))).toEqual(readFileSync(installed))
+})
+
+it.each([
+  { platform: 'darwin', arch: 'x64' },
+  { platform: 'win32', arch: 'arm64' }
+])('does not reuse host installation for a different target: %j', (host) => {
+  const { root, output } = installedFixture()
+  expect(() => stageOrcadWindowsProcessTree(root, output, 'win32-x64', host)).toThrow(
+    'patched process reader'
+  )
+})
+
+it('requires the installed fallback to have the matching architecture and patch', () => {
+  const { root, output, installed } = installedFixture(0xaa64)
+  expect(() => stageOrcadWindowsProcessTree(root, output, 'win32-x64', windowsHost)).toThrow(
+    'machine 0xaa64'
+  )
+  writeFileSync(installed, 'ReadProcessMemory')
+  expect(() => stageOrcadWindowsProcessTree(root, output, 'win32-x64', windowsHost)).toThrow(
+    'patched process reader'
+  )
+  rmSync(installed)
+  expect(() => stageOrcadWindowsProcessTree(root, output, 'win32-x64', windowsHost)).toThrow(
+    'patched process reader'
+  )
+})
+
+it('prefers explicit architecture builds and refuses to mask a stale one', () => {
+  const { root, output, file, installed } = installedFixture()
+  const staged = Buffer.concat([readFileSync(installed), Buffer.from('staged')])
+  writeFileSync(file, staged)
+  stageOrcadWindowsProcessTree(root, output, 'win32-x64', windowsHost)
+  expect(readFileSync(join(output, 'windows-process-tree.node'))).toEqual(staged)
+  writeFileSync(file, 'ReadProcessMemory')
+  expect(() => stageOrcadWindowsProcessTree(root, output, 'win32-x64', windowsHost)).toThrow(
+    'patched process reader'
+  )
+})
diff --git a/config/scripts/package-electron-runtime-contract.test.mjs b/config/scripts/package-electron-runtime-contract.test.mjs
index 7ede0fc6208..b93094901a0 100644
--- a/config/scripts/package-electron-runtime-contract.test.mjs
+++ b/config/scripts/package-electron-runtime-contract.test.mjs
@@ -3,7 +3,6 @@ import { createRequire } from 'node:module'
 import { join, resolve } from 'node:path'
 import { describe, expect, it } from 'vitest'
 import { parse } from 'yaml'
-import { relayArtifactFilenames } from '../../src/shared/relay-artifacts.ts'
 
 const projectDir = resolve(import.meta.dirname, '../..')
 const require = createRequire(import.meta.url)
@@ -25,18 +24,10 @@ describe('Electron runtime package contract', () => {
   }
 
   it('keeps the native Windows registry addon optional and platform-gated', () => {
-    const rebuildScript = readProject('config/scripts/rebuild-native-deps.mjs')
-    const ensureScript = readProject('config/scripts/ensure-native-runtime.mjs')
     expect(packageJson.optionalDependencies['@orca/windows-registry']).toBe('workspace:*')
     // Why: allowBuilds stops pnpm running node-gyp at install time -- the root
     // Windows-only rebuild owns this addon so it is built against the right runtime ABI.
     expect(pnpmWorkspace.allowBuilds['@orca/windows-registry']).toBe(false)
-    // Why assert the guard and the member separately: the list now carries more
-    // than one addon, so pinning the whole literal only tested its formatting.
-    expect(rebuildScript).toContain("rebuildPlatform === 'win32'")
-    expect(rebuildScript).toContain("'@orca/windows-registry'")
-    expect(ensureScript).toContain("process.platform === 'win32'")
-    expect(ensureScript).toContain("'@orca/windows-registry'")
     if (windowsAddonsInstalled) {
       expect(packageTargets.win32).toEqual(
         expect.arrayContaining([
@@ -55,20 +46,10 @@ describe('Electron runtime package contract', () => {
   })
 
   it('keeps the native Windows process-table addon optional and platform-gated', () => {
-    const rebuildScript = readFileSync(
-      join(projectDir, 'config/scripts/rebuild-native-deps.mjs'),
-      'utf8'
-    )
-    const ensureScript = readFileSync(
-      join(projectDir, 'config/scripts/ensure-native-runtime.mjs'),
-      'utf8'
-    )
     expect(packageJson.optionalDependencies['@vscode/windows-process-tree']).toBe('0.8.0')
     // Why: same rule as the registry addon -- allowBuilds stops pnpm running node-gyp at
     // install time so the Windows-only rebuild owns it with the right runtime ABI.
     expect(pnpmWorkspace.allowBuilds['@vscode/windows-process-tree']).toBe(false)
-    expect(rebuildScript).toContain("'@vscode/windows-process-tree'")
-    expect(ensureScript).toContain("'@vscode/windows-process-tree'")
     // Why pin the patch: the upstream binding.gyp requires Spectre-mitigated
     // libraries our build agents do not carry, and the enumeration stops after
     // 1024 processes -- on a busy host that silently hides the very descendants
@@ -92,195 +73,6 @@ describe('Electron runtime package contract', () => {
     }
   })
 
-  it('guards package scripts that launch Electron tooling', () => {
-    const scripts = packageJson.scripts
-    const guardedScripts = [
-      'start',
-      'dev',
-      'dev-stable-name',
-      'build:unpack',
-      'build:win',
-      'build:mac',
-      'build:mac:release',
-      'build:linux',
-      'test:e2e',
-      'test:e2e:terminal-rendering-golden',
-      'test:e2e:posix-profile-index-golden',
-      'test:e2e:terminal-rendering-release-evidence',
-      'test:e2e:headful'
-    ]
-
-    for (const scriptName of guardedScripts) {
-      expect(scripts[scriptName], scriptName).toContain('pnpm run ensure:electron-runtime &&')
-    }
-  })
-
-  it('keeps Windows and Linux package builds off macOS native helper builds', () => {
-    const scripts = packageJson.scripts
-
-    expect(scripts['build:desktop']).not.toContain('build:computer-macos')
-    expect(scripts['build:desktop']).not.toContain('build:keyboard-layout-macos')
-    expect(scripts['build:win']).toContain('pnpm run build:desktop')
-    expect(scripts['build:win']).not.toContain('pnpm run build ')
-    expect(scripts['build:win']).not.toContain('build:computer-macos')
-    expect(scripts['build:win']).not.toContain('build:keyboard-layout-macos')
-    expect(scripts['build:linux']).toContain('pnpm run build:desktop')
-    expect(scripts['build:linux']).not.toContain('pnpm run build ')
-    expect(scripts['build:linux']).not.toContain('build:computer-macos')
-    expect(scripts['build:linux']).not.toContain('build:keyboard-layout-macos')
-    expect(scripts['build:mac']).toContain('pnpm run build:computer-macos')
-    expect(scripts['build:mac']).toContain('pnpm run build:keyboard-layout-macos')
-    expect(scripts['build:release']).toContain('pnpm run build:native')
-    expect(scripts['build:release']).not.toContain('build:computer-macos')
-  })
-
-  it('runs the web build through the heap-sized Vite wrapper', () => {
-    expect(packageJson.scripts['build:web']).toContain('node config/scripts/run-vite-web-build.mjs')
-    expect(packageJson.scripts['build:web']).toContain('node config/scripts/verify-web-build.mjs')
-  })
-
-  it('guards release publishing before electron-builder runs', () => {
-    const releaseWorkflow = readFileSync(
-      join(projectDir, '.github/workflows/release-cut.yml'),
-      'utf8'
-    )
-    const parsedWorkflow = parse(releaseWorkflow)
-    const macWorkflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/release-mac-build.yml'), 'utf8')
-    )
-    const releaseCommands = new Map(
-      parsedWorkflow.jobs.build.strategy.matrix.include.map(({ platform, release_command }) => [
-        platform,
-        release_command
-      ])
-    )
-    const macReleaseCommand = macWorkflow.jobs['build-mac'].steps.find(
-      (step) => step.name === 'Publish release artifacts (macOS)'
-    ).with.command
-
-    expect([...releaseCommands.keys()].sort()).toEqual(['linux-arm64', 'linux-x64', 'win'])
-    for (const command of [...releaseCommands.values(), macReleaseCommand]) {
-      expect(command).toContain('node config/scripts/ensure-native-runtime.mjs --runtime=electron')
-      expect(command).toContain('electron-builder')
-      expect(command.indexOf('ensure-native-runtime')).toBeLessThan(
-        command.indexOf('electron-builder')
-      )
-    }
-    expect(macReleaseCommand).toContain(' && ORCA_MAC_RELEASE=1 ')
-    expect(releaseCommands.get('linux-x64')).toContain(' && pnpm exec electron-builder ')
-    expect(releaseCommands.get('linux-x64')).toContain('--linux AppImage deb rpm --x64')
-    expect(releaseCommands.get('linux-arm64')).toContain('ORCA_LINUX_ARM64_RELEASE=1')
-    expect(releaseCommands.get('linux-arm64')).toContain('--linux AppImage deb rpm --arm64')
-    expect(releaseCommands.get('win')).toContain(
-      '; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }; pnpm exec electron-builder '
-    )
-  })
-
-  it('blocks Linux and macOS release packaging on watcher process fault recovery', () => {
-    const releaseWorkflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/release-cut.yml'), 'utf8')
-    )
-    const macWorkflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/release-mac-build.yml'), 'utf8')
-    )
-    const assertFaultGate = (steps, publishStepName, expectedCondition) => {
-      const names = steps.map((step) => step.name)
-      const gate = steps.find((step) => step.name === 'Gate runtime file-watcher process isolation')
-
-      expect(gate.if).toBe(expectedCondition)
-      expect(gate['continue-on-error']).toBeUndefined()
-      expect(gate.run).toContain('node config/scripts/runtime-file-watcher-fault-harness.mjs')
-      expect(gate.run).toContain('ELECTRON_RUN_AS_NODE=1 pnpm exec electron')
-      expect(names.indexOf('Build app')).toBeLessThan(names.indexOf(gate.name))
-      expect(names.indexOf(gate.name)).toBeLessThan(names.indexOf(publishStepName))
-    }
-
-    assertFaultGate(
-      releaseWorkflow.jobs.build.steps,
-      'Publish release artifacts (Linux)',
-      "runner.os == 'Linux'"
-    )
-    assertFaultGate(
-      macWorkflow.jobs['build-mac'].steps,
-      'Publish release artifacts (macOS)',
-      undefined
-    )
-  })
-
-  it('packages and release-gates the SSH relay watcher child', () => {
-    const relayBuild = readFileSync(join(projectDir, 'config/scripts/build-relay.mjs'), 'utf8')
-    const builderConfig = readFileSync(
-      join(projectDir, 'config/electron-builder.config.cjs'),
-      'utf8'
-    )
-    const remoteCommands = readFileSync(
-      join(projectDir, 'src/main/ssh/ssh-remote-commands.ts'),
-      'utf8'
-    )
-    const releaseWorkflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/release-cut.yml'), 'utf8')
-    )
-    const macWorkflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/release-mac-build.yml'), 'utf8')
-    )
-
-    expect(relayBuild).toContain("'parcel-watcher-process-entry.ts'")
-    expect(relayBuild).toContain("outfile: join(outDir, 'relay-watcher.js')")
-    expect(relayBuild).toContain("outfile: join(outDir, 'relay-ai-vault-service.js')")
-    expect(builderConfig).toContain("from: 'out/relay'")
-
-    // Hashing and remote install probing are manifest-driven, so the contract
-    // is that both companions are declared once and that both sites read it.
-    expect(relayArtifactFilenames(true)).toContain('relay-watcher.js')
-    expect(relayArtifactFilenames(true)).toContain('relay-ai-vault-service.js')
-    expect(relayBuild).toContain('relayArtifactFilenames(')
-    expect(remoteCommands).toContain('relayArtifactFilenames(')
-
-    const assertRelayGate = (steps, publishStepName) => {
-      const names = steps.map((step) => step.name)
-      const gate = steps.find((step) => step.name === 'Gate SSH relay watcher process isolation')
-      expect(gate['continue-on-error']).toBeUndefined()
-      expect(gate.run).toContain('node config/scripts/relay-watcher-fault-harness.mjs')
-      expect(names.indexOf('Build app')).toBeLessThan(names.indexOf(gate.name))
-      expect(names.indexOf(gate.name)).toBeLessThan(names.indexOf(publishStepName))
-    }
-
-    assertRelayGate(releaseWorkflow.jobs.build.steps, 'Publish release artifacts (Linux)')
-    assertRelayGate(macWorkflow.jobs['build-mac'].steps, 'Publish release artifacts (macOS)')
-    const releaseNames = releaseWorkflow.jobs.build.steps.map((step) => step.name)
-    expect(releaseNames.indexOf('Gate SSH relay watcher process isolation')).toBeLessThan(
-      releaseNames.indexOf('Build Windows release artifacts')
-    )
-  })
-
-  it('packages and verifies the Windows SSH node-pty console-list fallback', () => {
-    const relayBuild = readFileSync(join(projectDir, 'config/scripts/build-relay.mjs'), 'utf8')
-    const relayDeploy = readFileSync(join(projectDir, 'src/main/ssh/ssh-relay-deploy.ts'), 'utf8')
-    const patchAsset = readFileSync(
-      join(projectDir, 'config/relay-assets/node-pty-1.1.0-console-list-agent-patch.cjs'),
-      'utf8'
-    )
-
-    expect(relayBuild).toContain('copyFileSync(')
-    expect(relayBuild).toContain('hash.update(readFileSync')
-    expect(relayBuild).toContain('node-pty-1.1.0-console-list-agent-patch.cjs')
-    expect(relayDeploy).toContain('assertPatchedNodePtyConsoleListAgent')
-    expect(relayDeploy.match(/\$\{windowsNodePtyPatchCommand\(nodePath\)\}/g)).toHaveLength(2)
-    expect(patchAsset).toContain('consoleProcessList = [shellPid];')
-    expect(patchAsset).toContain('packageJson.version !== EXPECTED_NODE_PTY_VERSION')
-  })
-
-  it('pins the Windows release builder to the VS 2022 runner image', () => {
-    const releaseWorkflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/release-cut.yml'), 'utf8')
-    )
-    const windowsReleaseEntry = releaseWorkflow.jobs.build.strategy.matrix.include.find(
-      ({ platform }) => platform === 'win'
-    )
-
-    expect(windowsReleaseEntry.os).toBe('windows-2022')
-  })
-
   it('keeps release-cut signing provenance on GitHub-hosted runners', () => {
     const releaseWorkflow = parse(
       readFileSync(join(projectDir, '.github/workflows/release-cut.yml'), 'utf8')
@@ -306,360 +98,4 @@ describe('Electron runtime package contract', () => {
     expect(releaseWorkflow.jobs['publish-release'].needs).toContain('build')
     expect(releaseWorkflow.jobs['publish-release'].needs).toContain('build-mac')
   })
-
-  it('runs the macOS release build in an isolated Blacksmith workflow', () => {
-    const releaseMacWorkflowText = readFileSync(
-      join(projectDir, '.github/workflows/release-mac-build.yml'),
-      'utf8'
-    )
-    const releaseMacWorkflow = parse(releaseMacWorkflowText)
-    const buildMacJob = releaseMacWorkflow.jobs['build-mac']
-    const checkoutStep = buildMacJob.steps.find((step) => step.name === 'Checkout')
-    const publishStep = buildMacJob.steps.find(
-      (step) => step.name === 'Publish release artifacts (macOS)'
-    )
-
-    expect(releaseMacWorkflow['run-name']).toBe(
-      'Mac release build ${{ inputs.tag }} (${{ inputs.release_run_id }})'
-    )
-    expect(releaseMacWorkflow.on.workflow_dispatch.inputs.tag.required).toBe(true)
-    expect(releaseMacWorkflow.on.workflow_dispatch.inputs.release_run_id.required).toBe(true)
-    expect(buildMacJob['runs-on']).toBe('blacksmith-6vcpu-macos-15')
-    expect(checkoutStep.with.ref).toBe('refs/tags/${{ inputs.tag }}')
-    expect(publishStep.with.command).toContain('ORCA_MAC_RELEASE=1')
-    expect(publishStep.with.command).toContain('electron-builder')
-    expect(publishStep.with.command).toContain('--mac --publish always')
-    expect(releaseMacWorkflowText).not.toContain('signpath/')
-    expect(releaseMacWorkflowText).not.toContain('SIGNPATH_')
-  })
-
-  it('publishes both Linux release matrix entries', () => {
-    const releaseWorkflow = readFileSync(
-      join(projectDir, '.github/workflows/release-cut.yml'),
-      'utf8'
-    )
-    const parsedWorkflow = parse(releaseWorkflow)
-    const publishLinuxStep = parsedWorkflow.jobs.build.steps.find(
-      (step) => step.name === 'Publish release artifacts (Linux)'
-    )
-
-    expect(publishLinuxStep.if).toContain("matrix.platform == 'linux-x64'")
-    expect(publishLinuxStep.if).toContain("matrix.platform == 'linux-arm64'")
-    expect(publishLinuxStep.with.command).toBe('${{ matrix.release_command }}')
-  })
-
-  it('keeps Linux postinstall repairing Chromium sandbox permissions', () => {
-    const afterInstallScript = readFileSync(
-      join(projectDir, 'resources/linux/packaging/after-install.sh'),
-      'utf8'
-    )
-
-    expect(afterInstallScript).toContain('chrome-sandbox')
-    expect(afterInstallScript).toContain('chmod 4755 "$sandbox"')
-    expect(afterInstallScript).not.toContain('chmod 0755 "$sandbox"')
-    expect(afterInstallScript).toContain('is_owned_link()')
-    expect(afterInstallScript).toContain('readlink -f -- "$link"')
-    expect(afterInstallScript).toContain('[ ! -e "$link" ] && [ ! -L "$link" ]')
-    expect(afterInstallScript).not.toContain('[ ! -e "$link" ] || [ -L "$link" ]')
-  })
-
-  it('advances only the skill release ledger in a taggable release-cut commit', () => {
-    const releaseWorkflow = readFileSync(
-      join(projectDir, '.github/workflows/release-cut.yml'),
-      'utf8'
-    )
-    const parsedWorkflow = parse(releaseWorkflow)
-    const checkoutStep = parsedWorkflow.jobs.cut.steps.find((step) => step.name === 'Checkout ref')
-    const bumpStep = parsedWorkflow.jobs.cut.steps.find(
-      (step) => step.name === 'Bump package.json and tag'
-    )
-
-    const bumpIndex = bumpStep.run.indexOf(
-      'npm version "$VERSION" --no-git-tag-version --allow-same-version'
-    )
-    const generateIndex = bumpStep.run.indexOf(
-      'node config/scripts/generate-skill-bundle-manifest.mjs --release "$VERSION"'
-    )
-    const commands = bumpStep.run.replace(/^\s*#.*$/gm, '')
-    // Unanchored: a `git add` chained after `&&` stages just as effectively.
-    const stagedPaths = [...commands.matchAll(/\bgit add (.+)$/gm)].flatMap((match) =>
-      match[1].trim().split(/\s+/)
-    )
-    // Quotes trimmed and deduped: the index guard names the row a second time.
-    const mentioned = new Set(commands.match(/resources[/\\]skills[^\s'"]*/g))
-    expect(checkoutStep.with['fetch-depth']).toBe(0)
-    expect(bumpIndex).toBeGreaterThanOrEqual(0)
-    // Why: the cut is the only point that advances the release ledger, so this
-    // tag's revision is never rebuilt later — it appends that row, nothing else.
-    expect(generateIndex).toBeGreaterThan(bumpIndex)
-    expect(bumpStep.run.indexOf('git add package.json')).toBeGreaterThan(generateIndex)
-    expect(stagedPaths).toEqual(['package.json', 'resources/skills/release-mapping.json'])
-    // Every distinct mention must be staged, so a copy, a redirect, or a path
-    // held in a variable cannot reach the content-addressed artifacts. Matched
-    // without a trailing slash so `dir="resources/skills"` still counts.
-    expect([...mentioned]).toEqual(stagedPaths.slice(1))
-    // Regeneration is banned job-wide by the generator suite. Here: `-a`, `-am`,
-    // and `--all` sweep unstaged artifacts in; `--allow-empty` below must not.
-    expect(commands).not.toMatch(/\bcommit\b[^\n]*(?:\s-[a-z]*a[a-z]*\b|\s--all\b)/)
-    expect(bumpStep.run).toContain('git diff --cached --quiet')
-    expect(bumpStep.run).toContain('git commit --allow-empty -m "$commit_message"')
-  })
-
-  it('keeps release-cut RC retries monotonic across stale attempts', () => {
-    const releaseWorkflow = readFileSync(
-      join(projectDir, '.github/workflows/release-cut.yml'),
-      'utf8'
-    )
-    const parsedWorkflow = parse(releaseWorkflow)
-    const versionStep = parsedWorkflow.jobs.cut.steps.find(
-      (step) => step.name === 'Compute next version'
-    )
-
-    expect(versionStep.run).toContain('node config/scripts/release-rc-history.mjs "$1"')
-    expect(versionStep.run).toContain('tag_matches_current_ref')
-    expect(versionStep.run).toContain('cutting the next version instead of reusing stale artifacts')
-    expect(versionStep.run).toContain('git rev-parse "$existing_rc_tag"')
-  })
-
-  it('bumps separate Homebrew casks for stable and RC desktop tags', () => {
-    const releaseWorkflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/release-cut.yml'), 'utf8')
-    )
-    const homebrewWorkflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/homebrew-bump.yml'), 'utf8')
-    )
-
-    expect(releaseWorkflow.jobs['homebrew-bump'].if).toContain(
-      "startsWith(needs.cut.outputs.tag, 'v')"
-    )
-    expect(releaseWorkflow.jobs['homebrew-bump'].if).not.toContain('-rc.')
-    expect(releaseWorkflow.jobs['homebrew-bump-published-rc-draft'].with.tag).toBe(
-      '${{ needs.cut.outputs.latest_published_rc_tag }}'
-    )
-
-    const resolveCaskStep = homebrewWorkflow.jobs['bump-cask'].steps.find(
-      (step) => step.name === 'Resolve cask target'
-    )
-    const renderStep = homebrewWorkflow.jobs['bump-cask'].steps.find(
-      (step) => step.name === 'Render updated cask file'
-    )
-    const copyStep = homebrewWorkflow.jobs['bump-cask'].steps.find(
-      (step) => step.name === 'Copy cask into tap and open PR'
-    )
-
-    expect(resolveCaskStep.run).toContain('token="orca@rc"')
-    expect(resolveCaskStep.run).toContain('token="orca"')
-    expect(renderStep.env.CASK_PATH).toBe('${{ steps.cask.outputs.path }}')
-    expect(copyStep.run).toContain('cp "$CASK_PATH" "tap/$CASK_PATH"')
-    expect(copyStep.run).toContain('git add "$CASK_PATH"')
-  })
-
-  it('installs the Electron package binary in the shared unit-test workflow', () => {
-    const unitTestWorkflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/unit-tests.yml'), 'utf8')
-    )
-    const installStep = unitTestWorkflow.jobs.test.steps.find(
-      (step) => step.name === 'Install Electron package binary for tests'
-    )
-
-    expect(installStep.run).toBe('node config/scripts/install-electron-package-binary.mjs')
-  })
-
-  it('smokes the packaged CLI from outside the checkout in PR checks', () => {
-    const prWorkflow = readFileSync(join(projectDir, '.github/workflows/pr.yml'), 'utf8')
-    const parsedWorkflow = parse(prWorkflow)
-    const smokeStep = parsedWorkflow.jobs.package.steps.find(
-      (step) => step.name === 'Smoke packaged CLI'
-    )
-
-    expect(smokeStep.run).toBe(
-      'node config/scripts/smoke-packaged-cli.mjs --app-dir=dist/linux-unpacked'
-    )
-  })
-
-  it('keeps terminal scale perf wired to the report budget gate', () => {
-    const packageScripts = packageJson.scripts
-    const terminalPerfWorkflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/terminal-perf.yml'), 'utf8')
-    )
-    const steps = terminalPerfWorkflow.jobs['terminal-perf'].steps
-    const runStep = steps.find((step) => step.name === 'Run terminal scale perf report gate')
-    const uploadStep = steps.find((step) => step.name === 'Upload terminal perf report')
-
-    expect(packageScripts['test:e2e:terminal-perf:scale:report']).toContain(
-      'run-terminal-scale-perf-report-gate.mjs'
-    )
-    expect(runStep.run).toContain('pnpm run test:e2e:terminal-perf:scale:report')
-    expect(runStep.run).toContain('xvfb-run --auto-servernum')
-    const manualProfileKnobs = [
-      ['ORCA_TERMINAL_PERF_FRAME_COUNT', 'frame_count', 'ORCA_E2E_OPENCODE_FRAME_COUNT'],
-      [
-        'ORCA_TERMINAL_PERF_FRAME_INTERVAL_MS',
-        'frame_interval_ms',
-        'ORCA_E2E_OPENCODE_FRAME_INTERVAL_MS'
-      ],
-      [
-        'ORCA_TERMINAL_PERF_PRESSURE_OUTPUT_CHARS',
-        'pressure_output_chars',
-        'ORCA_E2E_OPENCODE_PRESSURE_OUTPUT_CHARS'
-      ],
-      ['ORCA_TERMINAL_PERF_SCALE_PANES', 'scale_panes', 'ORCA_E2E_OPENCODE_SCALE_PANES'],
-      [
-        'ORCA_TERMINAL_PERF_SCALE_CROSS_WORKSPACE_PANES',
-        'scale_cross_workspace_panes',
-        'ORCA_E2E_OPENCODE_SCALE_CROSS_WORKSPACE_PANES'
-      ],
-      [
-        'ORCA_TERMINAL_PERF_SCALE_PRESSURE_PANES',
-        'scale_pressure_panes',
-        'ORCA_E2E_OPENCODE_SCALE_PRESSURE_PANES'
-      ],
-      [
-        'ORCA_TERMINAL_PERF_SCALE_HIDDEN_PRESSURE_PANES',
-        'scale_hidden_pressure_panes',
-        'ORCA_E2E_OPENCODE_SCALE_HIDDEN_PRESSURE_PANES'
-      ]
-    ]
-    for (const [workflowEnv, inputName, runnerEnv] of manualProfileKnobs) {
-      expect(runStep.env[workflowEnv]).toBe(`\${{ inputs.${inputName} }}`)
-      expect(runStep.run).toContain(runnerEnv)
-    }
-    expect(uploadStep.uses).toBe('actions/upload-artifact@v7')
-    expect(uploadStep.with.path).toBe('${{ env.ORCA_E2E_TERMINAL_PERF_REPORT_PATH }}')
-  })
-
-  it('keeps platform golden regressions in the manual and release workflows', () => {
-    const packageScripts = packageJson.scripts
-    const goldenWorkflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/golden-e2e-experiment.yml'), 'utf8')
-    )
-    const releaseWorkflow = parse(
-      readFileSync(join(projectDir, '.github/workflows/release-cut.yml'), 'utf8')
-    )
-    const steps = goldenWorkflow.jobs['golden-e2e'].steps
-    const goldenPlatformLabels = new Map([
-      ['linux', 'Linux'],
-      ['mac', 'macOS'],
-      ['windows', 'Windows']
-    ])
-    const goldenMatrix = goldenWorkflow.jobs['golden-e2e'].strategy.matrix.include
-    const goldenPlatforms = goldenMatrix.map(({ platform }) => platform).sort()
-    const goldenRunSteps = new Map(
-      goldenPlatforms.map((platform) => {
-        const label = goldenPlatformLabels.get(platform)
-
-        expect(label, platform).toBeDefined()
-
-        return [platform, steps.find((step) => step.name === `Run golden E2E tests on ${label}`)]
-      })
-    )
-    const releaseGoldenJob = releaseWorkflow.jobs['terminal-rendering-golden']
-    const releaseGoldenMatrix = releaseGoldenJob.strategy.matrix.include
-    const releaseEvidenceJob = releaseWorkflow.jobs['terminal-rendering-release-evidence']
-    const releaseBuildNeeds = releaseWorkflow.jobs.build.needs
-    const publishReleaseNeeds = releaseWorkflow.jobs['publish-release'].needs
-    // Why: Windows release evidence is temporarily paused for CI runner PTY readiness.
-    const releaseEvidencePlatforms = ['linux', 'mac']
-
-    expect(packageScripts['test:e2e:terminal-rendering-golden']).toContain(
-      '@terminal-rendering-golden'
-    )
-    expect(packageScripts['test:e2e:terminal-rendering-golden']).toContain(
-      'terminal-raw-emoji-table-scroll-restore.spec.ts'
-    )
-    expect(packageScripts['test:e2e:terminal-rendering-golden']).toContain(
-      'terminal-webgl-atlas-budget.spec.ts'
-    )
-    expect(packageScripts['test:e2e:terminal-rendering-golden']).not.toContain(
-      'terminal-long-table-scroll-restore.spec.ts'
-    )
-    const goldenCommand = packageScripts['test:e2e:terminal-rendering-golden']
-    expect(goldenCommand).toContain('--project electron-headless')
-    expect(goldenCommand).toContain('--project electron-headful')
-    expect(packageScripts['test:e2e:windows-fresh-startup-golden']).toContain(
-      'golden-windows-fresh-startup.spec.ts'
-    )
-    expect(packageScripts['test:e2e:windows-fresh-startup-golden']).toContain(
-      '@windows-fresh-startup-golden'
-    )
-    expect(packageScripts['test:e2e:posix-profile-index-golden']).toContain(
-      'golden-posix-profile-index-fsync.spec.ts'
-    )
-    expect(packageScripts['test:e2e:posix-profile-index-golden']).toContain(
-      'golden-posix-fresh-startup.spec.ts'
-    )
-    expect(packageScripts['test:e2e:posix-profile-index-golden']).toContain(
-      '@posix-profile-index-golden'
-    )
-    expect(packageScripts['test:e2e:terminal-rendering-release-evidence']).toContain(
-      'terminal-opencode-emoji-table-rendering.spec.ts'
-    )
-    expect(packageScripts['test:e2e:terminal-rendering-release-evidence']).toContain(
-      'terminal-long-table-scroll-restore.spec.ts'
-    )
-    expect(goldenMatrix).toEqual([
-      { os: 'ubuntu-latest', platform: 'linux' },
-      { os: 'macos-15', platform: 'mac' },
-      { os: 'windows-2022', platform: 'windows' }
-    ])
-    expect(goldenRunSteps.get('linux')?.run).toContain(
-      'pnpm run test:e2e:terminal-rendering-golden'
-    )
-    expect(goldenRunSteps.get('linux')?.run).toContain(
-      'pnpm run --if-present test:e2e:posix-profile-index-golden'
-    )
-    expect(goldenRunSteps.get('mac')?.run).toContain('pnpm run test:e2e:terminal-rendering-golden')
-    expect(goldenRunSteps.get('mac')?.run).toContain(
-      'pnpm run --if-present test:e2e:posix-profile-index-golden'
-    )
-    expect(goldenRunSteps.get('windows')).toMatchObject({
-      if: "runner.os == 'Windows'",
-      shell: 'pwsh'
-    })
-    expect(goldenRunSteps.get('windows').run).toContain(
-      'pnpm run --if-present test:e2e:windows-fresh-startup-golden'
-    )
-    expect(goldenWorkflow.on.pull_request).toBeUndefined()
-    expect(goldenWorkflow.on.workflow_dispatch).toBeDefined()
-    expect(releaseBuildNeeds).not.toContain('terminal-rendering-golden')
-    expect(releaseBuildNeeds).not.toContain('terminal-rendering-release-evidence')
-    expect(publishReleaseNeeds).toContain('terminal-rendering-golden')
-    expect(publishReleaseNeeds).toContain('build')
-    expect(publishReleaseNeeds).not.toContain('terminal-rendering-release-evidence')
-    expect(releaseGoldenJob['continue-on-error']).toBeUndefined()
-    expect(releaseGoldenMatrix).toEqual(goldenMatrix)
-    const releaseLinuxRunStep = releaseGoldenJob.steps.find(
-      (step) => step.name === 'Run terminal rendering golden on Linux'
-    )
-    expect(releaseLinuxRunStep.run).toContain('pnpm run test:e2e:terminal-rendering-golden')
-    expect(releaseLinuxRunStep.run).toContain(
-      'pnpm run --if-present test:e2e:posix-profile-index-golden'
-    )
-    const releaseMacRunStep = releaseGoldenJob.steps.find(
-      (step) => step.name === 'Run terminal rendering golden on macOS'
-    )
-    expect(releaseMacRunStep.run).toContain('pnpm run test:e2e:terminal-rendering-golden')
-    expect(releaseMacRunStep.run).toContain(
-      'pnpm run --if-present test:e2e:posix-profile-index-golden'
-    )
-    const releaseWindowsRunStep = releaseGoldenJob.steps.find(
-      (step) => step.name === 'Run fresh-startup golden on Windows'
-    )
-    expect(releaseWindowsRunStep).toMatchObject({
-      if: "runner.os == 'Windows'",
-      shell: 'pwsh'
-    })
-    expect(releaseWindowsRunStep.run).toContain(
-      'pnpm run --if-present test:e2e:windows-fresh-startup-golden'
-    )
-    expect(releaseWindowsRunStep.run).not.toContain('test:e2e:workspace-session-golden')
-    expect(releaseWindowsRunStep.run).not.toContain('test:e2e:source-control-golden')
-    expect(releaseEvidenceJob['continue-on-error']).toBe(true)
-    expect(
-      releaseEvidenceJob.strategy.matrix.include.map(({ platform }) => platform).sort()
-    ).toEqual(releaseEvidencePlatforms)
-    expect(releaseEvidenceJob.steps.map((step) => step.run ?? '')).toContain(
-      'xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:terminal-rendering-release-evidence'
-    )
-  })
 })
diff --git a/config/scripts/package-linux-formats.mjs b/config/scripts/package-linux-formats.mjs
new file mode 100644
index 00000000000..56c5ed4562f
--- /dev/null
+++ b/config/scripts/package-linux-formats.mjs
@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  statSync
+} from 'node:fs'
+import { join, resolve } from 'node:path'
+import { copyPrivateTree } from './space-sharing-copy.mjs'
+import { spawnProcess } from './script-child-process.mjs'
+
+const require = createRequire(import.meta.url)
+const formats = ['AppImage', 'deb', 'rpm']
+
+export function linuxFormatArguments({ format, appDirectory, outputDirectory }) {
+  if (!formats.includes(format)) {
+    throw new Error(`Unsupported Linux package format: ${format}`)
+  }
+  return [
+    '--config',
+    'config/electron-builder-pr-linux.config.cjs',
+    '--linux',
+    format,
+    '--x64',
+    '--publish',
+    'never',
+    '--prepackaged',
+    appDirectory,
+    '--config.directories.output',
+    outputDirectory,
+    '--config.deb.compression=gz',
+    '--config.rpm.compression=gzip'
+  ]
+}
+
+function runElectronBuilder(args) {
+  return new Promise((resolveBuild, reject) => {
+    const child = spawnProcess({
+      program: process.execPath,
+      args: [require.resolve('electron-builder/cli.js'), ...args],
+      env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1' },
+      stdio: 'inherit'
+    })
+    child.once('error', reject)
+    child.once('close', (code, signal) => {
+      if (code === 0 && signal === null) {
+        resolveBuild()
+      } else {
+        reject(new Error(`electron-builder failed (code=${code}, signal=${signal})`))
+      }
+    })
+  })
+}
+
+export async function packageLinuxFormats({
+  preparedDirectory = resolve('dist/linux-unpacked'),
+  outputDirectory = resolve('dist'),
+  runBuilder = runElectronBuilder
+} = {}) {
+  const marker = join(preparedDirectory, 'resources/package-type')
+  if (readFileSync(marker, 'utf8') !== 'AppImage') {
+    throw new Error('Expected a fresh Linux directory build with its AppImage package marker')
+  }
+  const startedAt = performance.now()
+  mkdirSync(outputDirectory, { recursive: true })
+  const staging = mkdtempSync(join(outputDirectory, '.linux-package-formats-'))
+  try {
+    const results = await Promise.allSettled(
+      formats.map(async (format) => {
+        const startedFormatAt = performance.now()
+        const appDirectory = join(staging, format, 'app')
+        const formatOutput = join(staging, format, 'artifacts')
+        mkdirSync(join(staging, format))
+        // Preserve packaged modes; only the format metadata may be rewritten by electron-builder.
+        copyPrivateTree(preparedDirectory, appDirectory, { unprotect: () => {} })
+        console.log(
+          `[linux-package] ${format} copied in ${Math.round(performance.now() - startedFormatAt)}ms`
+        )
+        await runBuilder(
+          linuxFormatArguments({ format, appDirectory, outputDirectory: formatOutput })
+        )
+        const artifacts = readdirSync(formatOutput).filter((name) => name.endsWith(`.${format}`))
+        const artifactStats =
+          artifacts.length === 1 ? statSync(join(formatOutput, artifacts[0])) : null
+        if (!artifactStats?.isFile() || artifactStats.size === 0) {
+          throw new Error(`${format} did not produce exactly one nonempty package`)
+        }
+        console.log(
+          `[linux-package] ${format} finished in ${Math.round(performance.now() - startedFormatAt)}ms`
+        )
+        return { format, formatOutput, artifact: artifacts[0] }
+      })
+    )
+    const failures = results.flatMap((result, index) =>
+      result.status === 'rejected'
+        ? [new Error(`${formats[index]} packaging failed`, { cause: result.reason })]
+        : []
+    )
+    if (failures.length > 0) {
+      throw new AggregateError(failures, 'Linux package formats failed')
+    }
+    const completed = results.flatMap((result) =>
+      result.status === 'fulfilled' ? [result.value] : []
+    )
+    const metadataDirectory = join(outputDirectory, 'linux-package-formats')
+    for (const destination of [
+      metadataDirectory,
+      ...completed.map(({ artifact }) => join(outputDirectory, artifact))
+    ]) {
+      if (existsSync(destination)) {
+        throw new Error(`Refusing to replace existing package output: ${destination}`)
+      }
+    }
+    mkdirSync(metadataDirectory)
+    for (const { format, formatOutput, artifact } of completed) {
+      renameSync(join(formatOutput, artifact), join(outputDirectory, artifact))
+      // Update manifests and builder diagnostics have overlapping names across formats.
+      renameSync(formatOutput, join(metadataDirectory, format))
+    }
+    console.log(
+      `[linux-package] all formats finished in ${Math.round(performance.now() - startedAt)}ms`
+    )
+  } finally {
+    rmSync(staging, { recursive: true, force: true })
+  }
+}
+
+if (process.argv[1] && realpathSync(process.argv[1]) === realpathSync(import.meta.filename)) {
+  if (process.platform !== 'linux' || process.arch !== 'x64') {
+    throw new Error('PR Linux packaging requires a Linux x64 host')
+  }
+  await packageLinuxFormats()
+}
diff --git a/config/scripts/package-linux-formats.test.mjs b/config/scripts/package-linux-formats.test.mjs
new file mode 100644
index 00000000000..7d187af658d
--- /dev/null
+++ b/config/scripts/package-linux-formats.test.mjs
@@ -0,0 +1,226 @@
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  readlinkSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  writeFileSync
+} from 'node:fs'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { linuxFormatArguments, packageLinuxFormats } from './package-linux-formats.mjs'
+
+let root
+let preparedDirectory
+let outputDirectory
+const targets = ['AppImage', 'deb', 'rpm']
+const valueAfter = (args, flag) => args[args.indexOf(flag) + 1]
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'orca formats with spaces-'))
+  preparedDirectory = join(root, 'prepared app')
+  outputDirectory = join(root, 'output packages')
+  mkdirSync(join(preparedDirectory, 'resources'), { recursive: true })
+  mkdirSync(outputDirectory)
+  writeFileSync(join(preparedDirectory, 'resources/package-type'), 'AppImage')
+  writeFileSync(join(preparedDirectory, 'resources/app.asar'), 'verified application')
+  writeFileSync(join(preparedDirectory, 'orca-ide'), 'executable')
+  chmodSync(join(preparedDirectory, 'orca-ide'), 0o755)
+})
+
+afterEach(() => rmSync(root, { recursive: true, force: true }))
+
+function emitPackage(args) {
+  const format = valueAfter(args, '--linux')
+  const app = valueAfter(args, '--prepackaged')
+  const output = valueAfter(args, '--config.directories.output')
+  writeFileSync(join(app, 'resources/package-type'), format)
+  mkdirSync(output, { recursive: true })
+  writeFileSync(join(output, `orca.${format}`), format)
+  writeFileSync(join(output, 'latest-linux.yml'), format)
+  return { format, app, output }
+}
+
+it('preserves configured hooks, architecture, names, and PR compression with exact argv', () => {
+  const args = linuxFormatArguments({
+    format: 'deb',
+    appDirectory: '/app with spaces',
+    outputDirectory: '/out with spaces'
+  })
+  expect(args).toEqual([
+    '--config',
+    'config/electron-builder-pr-linux.config.cjs',
+    '--linux',
+    'deb',
+    '--x64',
+    '--publish',
+    'never',
+    '--prepackaged',
+    '/app with spaces',
+    '--config.directories.output',
+    '/out with spaces',
+    '--config.deb.compression=gz',
+    '--config.rpm.compression=gzip'
+  ])
+  expect(() => linuxFormatArguments({ format: 'zip' })).toThrow('Unsupported Linux package format')
+})
+
+describe('independent Linux package formats', () => {
+  it('starts all formats before awaiting completion and isolates metadata writes', async () => {
+    if (process.platform !== 'win32') {
+      symlinkSync('resources/package-type', join(preparedDirectory, 'marker-link'))
+    }
+    let release
+    const gate = new Promise((resolve) => {
+      release = resolve
+    })
+    const copies = []
+    await packageLinuxFormats({
+      preparedDirectory,
+      outputDirectory,
+      runBuilder: async (args) => {
+        const app = valueAfter(args, '--prepackaged')
+        const format = valueAfter(args, '--linux')
+        expect(readFileSync(join(app, 'resources/package-type'), 'utf8')).toBe('AppImage')
+        expect(readFileSync(join(app, 'resources/app.asar'), 'utf8')).toBe('verified application')
+        if (process.platform !== 'win32') {
+          expect(readlinkSync(join(app, 'marker-link'))).toBe('resources/package-type')
+          expect(statSync(join(app, 'orca-ide')).mode & 0o777).toBe(0o755)
+          expect(statSync(join(app, 'resources/package-type')).ino).not.toBe(
+            statSync(join(preparedDirectory, 'resources/package-type')).ino
+          )
+        }
+        copies.push(app)
+        if (copies.length === 3) {
+          release()
+        }
+        await gate
+        expect(readdirSync(outputDirectory)).toHaveLength(1)
+        emitPackage(args)
+        await Promise.resolve()
+        expect(readFileSync(join(app, 'resources/package-type'), 'utf8')).toBe(format)
+      }
+    })
+    expect(new Set(copies).size).toBe(3)
+    expect(readFileSync(join(preparedDirectory, 'resources/package-type'), 'utf8')).toBe('AppImage')
+    expect(readFileSync(join(preparedDirectory, 'resources/app.asar'), 'utf8')).toBe(
+      'verified application'
+    )
+    for (const format of targets) {
+      expect(readFileSync(join(outputDirectory, `orca.${format}`), 'utf8')).toBe(format)
+      expect(
+        readFileSync(
+          join(outputDirectory, 'linux-package-formats', format, 'latest-linux.yml'),
+          'utf8'
+        )
+      ).toBe(format)
+    }
+    expect(
+      readdirSync(outputDirectory).some((name) => name.startsWith('.linux-package-formats-'))
+    ).toBe(false)
+  })
+
+  it('settles every worker before cleanup and exposes no partial artifact on failure', async () => {
+    const finished = []
+    let release
+    const gate = new Promise((resolve) => {
+      release = resolve
+    })
+    await expect(
+      packageLinuxFormats({
+        preparedDirectory,
+        outputDirectory,
+        runBuilder: async (args) => {
+          const format = valueAfter(args, '--linux')
+          if (format === 'AppImage') {
+            throw new Error('compression failed')
+          }
+          if (format === 'rpm') {
+            release()
+          }
+          await gate
+          const { app } = emitPackage(args)
+          expect(existsSync(app)).toBe(true)
+          finished.push(format)
+        }
+      })
+    ).rejects.toMatchObject({
+      message: 'Linux package formats failed',
+      errors: [
+        expect.objectContaining({
+          message: 'AppImage packaging failed',
+          cause: expect.objectContaining({ message: 'compression failed' })
+        })
+      ]
+    })
+    expect(finished.sort()).toEqual(['deb', 'rpm'])
+    expect(readdirSync(outputDirectory)).toEqual([])
+    expect(readFileSync(join(preparedDirectory, 'resources/package-type'), 'utf8')).toBe('AppImage')
+  })
+
+  it('rejects missing artifacts even when the builder reports success', async () => {
+    await expect(
+      packageLinuxFormats({
+        preparedDirectory,
+        outputDirectory,
+        runBuilder: async (args) => {
+          const result = emitPackage(args)
+          if (result.format === 'rpm') {
+            writeFileSync(join(result.output, 'orca.rpm'), '')
+          }
+        }
+      })
+    ).rejects.toThrow('Linux package formats failed')
+    expect(readdirSync(outputDirectory)).toEqual([])
+  })
+
+  it('does not replace existing output packages', async () => {
+    writeFileSync(join(outputDirectory, 'orca.deb'), 'previous package')
+    await expect(
+      packageLinuxFormats({
+        preparedDirectory,
+        outputDirectory,
+        runBuilder: async (args) => {
+          emitPackage(args)
+        }
+      })
+    ).rejects.toThrow('Refusing to replace existing package output')
+    expect(readdirSync(outputDirectory)).toEqual(['orca.deb'])
+    expect(readFileSync(join(outputDirectory, 'orca.deb'), 'utf8')).toBe('previous package')
+  })
+
+  it('rejects a tree already mutated by a previous root-package build', async () => {
+    writeFileSync(join(preparedDirectory, 'resources/package-type'), 'rpm')
+    await expect(
+      packageLinuxFormats({
+        preparedDirectory,
+        outputDirectory,
+        runBuilder: async () => {
+          throw new Error('must not run')
+        }
+      })
+    ).rejects.toThrow('Expected a fresh Linux directory build')
+    expect(readdirSync(outputDirectory)).toEqual([])
+  })
+})
+
+it('changes only CI deb/rpm compression levels without mutating release settings or hooks', () => {
+  const require = createRequire(import.meta.url)
+  const release = require('../electron-builder.config.cjs')
+  const before = { deb: { ...release.deb }, rpm: { ...release.rpm } }
+  const ci = require('../electron-builder-pr-linux.config.cjs')
+  expect(release.deb).toEqual(before.deb)
+  expect(release.rpm).toEqual(before.rpm)
+  expect(ci).toEqual({
+    ...release,
+    deb: { ...release.deb, fpm: [...(release.deb.fpm ?? []), '--deb-compression-level=1'] },
+    rpm: { ...release.rpm, fpm: [...(release.rpm.fpm ?? []), '--rpm-compression-level=1'] }
+  })
+})
diff --git a/config/scripts/packaged-browser-lane-contract.test.mjs b/config/scripts/packaged-browser-lane-contract.test.mjs
index bac077d57d4..3d1932a1035 100644
--- a/config/scripts/packaged-browser-lane-contract.test.mjs
+++ b/config/scripts/packaged-browser-lane-contract.test.mjs
@@ -20,7 +20,8 @@ describe('packaged browser compatibility lane', () => {
   it('verifies the pinned package before selecting the desktop executable', () => {
     const download = steps.find((step) => step.name === 'Download pinned old release').run
     expect(download).toContain('gh release download v1.4.188')
-    expect(download).toContain('hashlib.sha512(package.read_bytes())')
+    expect(download).toContain('hashlib.sha512()')
+    expect(download).not.toContain('package.read_bytes()')
     expect(download).toContain("extracted/'opt'/'Orca'/'orca-ide'")
     expect(download).toContain('assert base64.')
     expect(download).toContain('decode()==expected')
diff --git a/config/scripts/packaged-hang-watchdog-worker-contract.test.mjs b/config/scripts/packaged-hang-watchdog-worker-contract.test.mjs
deleted file mode 100644
index a4998760b67..00000000000
--- a/config/scripts/packaged-hang-watchdog-worker-contract.test.mjs
+++ /dev/null
@@ -1,37 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { parse } from 'yaml'
-import { describe, expect, it } from 'vitest'
-
-describe('packaged hang watchdog worker contract', () => {
-  it('boots the worker from app.asar in PR checks', () => {
-    const workflow = parse(readFileSync('.github/workflows/pr.yml', 'utf8'))
-    const smokeSource = readFileSync(
-      'config/scripts/smoke-packaged-hang-watchdog-worker.mjs',
-      'utf8'
-    )
-    const smokeStep = workflow.jobs.package.steps.find(
-      (step) => step.name === 'Smoke packaged hang watchdog worker'
-    )
-
-    expect(smokeStep.run).toBe(
-      'xvfb-run --auto-servernum node config/scripts/smoke-packaged-hang-watchdog-worker.mjs --app-dir=dist/linux-unpacked'
-    )
-    expect(smokeSource).toContain(
-      "process.platform === 'linux' ? ['--no-sandbox', launcherDir] : [launcherDir]"
-    )
-    expect(smokeSource).toContain('const LAUNCH_TIMEOUT_MS = 30_000')
-    expect(smokeSource).toContain('timeout: LAUNCH_TIMEOUT_MS')
-  })
-
-  // Why: Electron ignores process.exitCode, so the gate needs app.exit plus a stdout assertion.
-  it('fails the smoke when the packaged worker never reports success', () => {
-    const smokeSource = readFileSync(
-      'config/scripts/smoke-packaged-hang-watchdog-worker.mjs',
-      'utf8'
-    )
-
-    expect(smokeSource).toContain('app.exit(1)')
-    expect(smokeSource).not.toContain('app.quit()')
-    expect(smokeSource).toContain('if (!result.stdout.includes(SUCCESS_LINE))')
-  })
-})
diff --git a/config/scripts/pdfjs-viewer-assets-stream.test.ts b/config/scripts/pdfjs-viewer-assets-stream.test.ts
new file mode 100644
index 00000000000..2e8f67efa8f
--- /dev/null
+++ b/config/scripts/pdfjs-viewer-assets-stream.test.ts
@@ -0,0 +1,190 @@
+import { once } from 'node:events'
+import type * as fs from 'node:fs'
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync, type ReadStream } from 'node:fs'
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { PassThrough } from 'node:stream'
+import type { Connect, ViteDevServer } from 'vite'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { createPdfjsViewerAssetsPlugin } from '../build-plugins/pdfjs-viewer-assets'
+
+const observed = vi.hoisted(() => {
+  const streams: ReadStream[] = []
+  return { streams }
+})
+vi.mock('node:fs', async (importOriginal) => {
+  const original = await importOriginal<typeof fs>()
+  return {
+    ...original,
+    createReadStream: (...args: Parameters<typeof original.createReadStream>) => {
+      const stream = original.createReadStream(...args)
+      observed.streams.push(stream)
+      return stream
+    }
+  }
+})
+
+let root: string
+let middleware: Connect.NextHandleFunction
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'orca-pdfjs-stream-'))
+  mkdirSync(join(root, 'wasm'))
+  mkdirSync(join(root, 'cmaps'))
+  writeFileSync(join(root, 'wasm', 'fixture.wasm'), Buffer.alloc(1024 * 1024, 1))
+  writeFileSync(join(root, 'cmaps', 'fixture.bcmap'), 'map bytes')
+  const hook = createPdfjsViewerAssetsPlugin(root).configureServer
+  if (typeof hook !== 'function') {
+    throw new Error('Missing configureServer hook')
+  }
+  const server = {
+    middlewares: {
+      use(handler: Connect.NextHandleFunction) {
+        middleware = handler
+      }
+    }
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This hook only registers middleware through the supplied use method.
+  hook.call({} as never, server as ViteDevServer)
+})
+
+afterEach(async () => {
+  await Promise.all(
+    observed.streams.map(async (stream) => {
+      if (stream.closed) {
+        return
+      }
+      const closed = new Promise<void>((resolve) => stream.once('close', resolve))
+      stream.destroy()
+      await closed
+    })
+  )
+  observed.streams.length = 0
+  rmSync(root, { recursive: true, force: true })
+})
+
+function request(method = 'GET', url = '/wasm/fixture.wasm') {
+  const response = Object.assign(new PassThrough({ highWaterMark: 16 }), {
+    setHeader: vi.fn(),
+    statusCode: 0
+  })
+  const foreign = { close: vi.fn(), error: vi.fn() }
+  response.on('close', foreign.close)
+  response.on('error', foreign.error)
+  const next = vi.fn()
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The middleware reads only method/url and uses the implemented writable response and header fields.
+  middleware({ method, url } as IncomingMessage, response as unknown as ServerResponse, next)
+  return { response, next, source: observed.streams.at(-1), foreign }
+}
+
+it('releases file handles after repeated abandoned responses with backpressure', async () => {
+  const responses: ReturnType<typeof request>[] = []
+  for (let index = 0; index < 25; index += 1) {
+    const current = request()
+    const { response, source } = current
+    responses.push(current)
+    if (!source) {
+      throw new Error('Missing source')
+    }
+    await once(source, 'pause')
+    const closed = once(response, 'close')
+    response.destroy()
+    await closed
+  }
+  await expect.poll(() => observed.streams.filter((stream) => !stream.closed).length).toBe(0)
+  expect(observed.streams.every((stream) => stream.fd === null)).toBe(true)
+  for (const { response, foreign } of responses) {
+    expect(response.listeners('close')).toEqual([foreign.close])
+    expect(response.listeners('error')).toEqual([foreign.error])
+  }
+})
+
+it('preserves successful GET bytes and removes response cleanup listeners', async () => {
+  const { response, source, next, foreign } = request('GET', '/cmaps/fixture.bcmap')
+  const chunks: Buffer[] = []
+  response.on('data', (chunk: Buffer) => chunks.push(chunk))
+  await once(response, 'end')
+  await expect.poll(() => source?.closed).toBe(true)
+  expect(Buffer.concat(chunks).toString()).toBe('map bytes')
+  expect(response.statusCode).toBe(200)
+  expect(response.setHeader.mock.calls).toEqual([
+    ['Content-Length', 9],
+    ['Content-Type', 'application/octet-stream']
+  ])
+  expect(response.listeners('close')).toEqual([foreign.close])
+  expect(response.listeners('error')).toEqual([foreign.error])
+  expect(next).not.toHaveBeenCalled()
+})
+
+it('answers HEAD without opening a file stream', () => {
+  const { response, next } = request('HEAD')
+  expect(observed.streams).toHaveLength(0)
+  expect(response.writableEnded).toBe(true)
+  expect(response.setHeader.mock.calls).toEqual([
+    ['Content-Length', 1024 * 1024],
+    ['Content-Type', 'application/wasm']
+  ])
+  expect(next).not.toHaveBeenCalled()
+  response.destroy()
+})
+
+it('closes the response on source failure without leaving listeners', async () => {
+  const { response, source, foreign } = request()
+  if (!source) {
+    throw new Error('Missing source')
+  }
+  const closed = once(response, 'close')
+  source.destroy(new Error('fixture read failed'))
+  await closed
+  await expect.poll(() => source.closed).toBe(true)
+  expect(response.destroyed).toBe(true)
+  expect(response.listeners('close')).toEqual([foreign.close])
+  expect(response.listeners('error')).toEqual([foreign.error])
+})
+
+it('closes a source when the response fails', async () => {
+  const { response, source, foreign } = request()
+  if (!source) {
+    throw new Error('Missing source')
+  }
+  await once(source, 'pause')
+  response.destroy(new Error('fixture downstream failed'))
+  await expect.poll(() => source.closed).toBe(true)
+  expect(source.fd).toBe(null)
+  expect(response.listeners('close')).toEqual([foreign.close])
+  expect(response.listeners('error')).toEqual([foreign.error])
+})
+
+it.each([
+  ['POST', '/wasm/fixture.wasm'],
+  ['GET', '/wasm/missing.wasm'],
+  ['GET', '/other/fixture.wasm'],
+  ['GET', '/wasm/%00.wasm']
+])('passes through %s %s without a stream', (method, url) => {
+  const { response, next } = request(method, url)
+  expect(observed.streams).toHaveLength(0)
+  expect(next).toHaveBeenCalledOnce()
+  response.destroy()
+})
+
+it('does not open a stream when earlier middleware resumes after response close', async () => {
+  const response = Object.assign(new PassThrough(), {
+    setHeader: vi.fn(() => {
+      throw new Error('ERR_HTTP_HEADERS_SENT')
+    }),
+    statusCode: 0
+  })
+  const closed = once(response, 'close')
+  response.destroy()
+  await closed
+  middleware(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The middleware reads only these method/url fields.
+    { method: 'GET', url: '/wasm/fixture.wasm' } as IncomingMessage,
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture implements the writable response and header fields used by this middleware.
+    response as unknown as ServerResponse,
+    vi.fn()
+  )
+  expect(observed.streams).toHaveLength(0)
+  expect(response.setHeader).not.toHaveBeenCalled()
+})
diff --git a/config/scripts/plain-node-entry-guard.test.ts b/config/scripts/plain-node-entry-guard.test.ts
index 673b796fd43..843d185b101 100644
--- a/config/scripts/plain-node-entry-guard.test.ts
+++ b/config/scripts/plain-node-entry-guard.test.ts
@@ -4,6 +4,7 @@ import { join } from 'node:path'
 import type { Plugin, Rollup } from 'vite'
 import { afterEach, describe, expect, it } from 'vitest'
 import {
+  CLI_MAIN_ENTRY_NAMES,
   createPlainNodeEntryGuardPlugin,
   GUARDED_ENTRY_NAMES
 } from '../build-plugins/plain-node-entry-guard'
@@ -158,8 +159,8 @@ describe('guarded entry names', () => {
 // main-process worker and kills it at startup. The worker entries carried only
 // hand-written "must stay electron-free" comments, and the port-scan worker sits
 // one import away from a client that deliberately does require electron.
-describe('worker thread entry guard', () => {
-  function runWorkerWriteBundle(plugin: Plugin, bundle: Rollup.OutputBundle): void {
+describe('CLI and worker thread entry guard', () => {
+  function runEntryWriteBundle(plugin: Plugin, bundle: Rollup.OutputBundle): void {
     const hook = plugin.writeBundle
     if (typeof hook !== 'function') {
       throw new Error('Expected writeBundle hook')
@@ -171,7 +172,7 @@ describe('worker thread entry guard', () => {
     )
   }
 
-  function workerChunk(name: string, code: string, imports: string[] = []): Rollup.OutputChunk {
+  function entryChunk(name: string, code: string, imports: string[] = []): Rollup.OutputChunk {
     return {
       type: 'chunk',
       code,
@@ -183,33 +184,54 @@ describe('worker thread entry guard', () => {
     } as Rollup.OutputChunk
   }
 
+  it.each(CLI_MAIN_ENTRY_NAMES)('rejects direct and transitive Electron imports in %s', (name) => {
+    const plugin = createPlainNodeEntryGuardPlugin()
+    const entry = entryChunk(name, 'require("electron")')
+    const bundle: Rollup.OutputBundle = { [entry.fileName]: entry }
+    expect(() => runEntryWriteBundle(plugin, bundle)).toThrow('requires electron')
+
+    entry.code = ''
+    const shared = entryChunk('shared', 'require("electron/main")')
+    shared.isEntry = false
+    bundle[shared.fileName] = shared
+    for (const edge of ['imports', 'dynamicImports'] as const) {
+      entry[edge] = [shared.fileName]
+      expect(() => runEntryWriteBundle(plugin, bundle)).toThrow('requires electron')
+      entry[edge] = []
+    }
+
+    shared.code = 'require("node:fs")'
+    entry.imports = [shared.fileName]
+    expect(() => runEntryWriteBundle(plugin, bundle)).not.toThrow()
+  })
+
   it('rejects an Electron require reachable from a worker entry', () => {
     const plugin = createPlainNodeEntryGuardPlugin()
-    const bundle = {
-      'port-scan-command-worker-entry.js': workerChunk(
+    const bundle: Rollup.OutputBundle = {
+      'port-scan-command-worker-entry.js': entryChunk(
         'port-scan-command-worker-entry',
         'require("electron")'
       )
-    } as Rollup.OutputBundle
+    }
 
-    expect(() => runWorkerWriteBundle(plugin, bundle)).toThrow('requires electron')
+    expect(() => runEntryWriteBundle(plugin, bundle)).toThrow('requires electron')
   })
 
   it('names the worker-thread runtime so the failure is actionable', () => {
     const plugin = createPlainNodeEntryGuardPlugin()
-    const bundle = {
-      'stt-worker.js': workerChunk('stt-worker', 'require("electron")')
-    } as Rollup.OutputBundle
+    const bundle: Rollup.OutputBundle = {
+      'stt-worker.js': entryChunk('stt-worker', 'require("electron")')
+    }
 
-    expect(() => runWorkerWriteBundle(plugin, bundle)).toThrow('runs as a worker thread')
+    expect(() => runEntryWriteBundle(plugin, bundle)).toThrow('runs as a worker thread')
   })
 
   // The real risk is transitive: a worker entry importing a shared chunk that
   // reaches the electron-requiring client, not a direct import anyone would spot.
   it('follows shared chunks out of a worker entry', () => {
     const plugin = createPlainNodeEntryGuardPlugin()
-    const bundle = {
-      'session-scanner-opencode-sqlite-worker-entry.js': workerChunk(
+    const bundle: Rollup.OutputBundle = {
+      'session-scanner-opencode-sqlite-worker-entry.js': entryChunk(
         'session-scanner-opencode-sqlite-worker-entry',
         'require("./chunks/shared.js")',
         ['chunks/shared.js']
@@ -223,20 +245,20 @@ describe('worker thread entry guard', () => {
         isEntry: false,
         name: 'shared'
       } as Rollup.OutputChunk
-    } as Rollup.OutputBundle
+    }
 
-    expect(() => runWorkerWriteBundle(plugin, bundle)).toThrow('chunks/shared.js')
+    expect(() => runEntryWriteBundle(plugin, bundle)).toThrow('chunks/shared.js')
   })
 
   it('passes a clean worker entry', () => {
     const plugin = createPlainNodeEntryGuardPlugin()
-    const bundle = {
-      'warp-theme-parser-worker.js': workerChunk(
+    const bundle: Rollup.OutputBundle = {
+      'warp-theme-parser-worker.js': entryChunk(
         'warp-theme-parser-worker',
         'require("node:worker_threads")'
       )
-    } as Rollup.OutputBundle
+    }
 
-    expect(() => runWorkerWriteBundle(plugin, bundle)).not.toThrow()
+    expect(() => runEntryWriteBundle(plugin, bundle)).not.toThrow()
   })
 })
diff --git a/config/scripts/playwright-focused-workflow-selection.test.mjs b/config/scripts/playwright-focused-workflow-selection.test.mjs
new file mode 100644
index 00000000000..b78cbec4480
--- /dev/null
+++ b/config/scripts/playwright-focused-workflow-selection.test.mjs
@@ -0,0 +1,105 @@
+import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
+import { expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { runProcess } from '../../src/shared/child-process/run-process'
+
+const require = createRequire(import.meta.url)
+const projectDir = resolve(import.meta.dirname, '../..')
+
+function assertGoldenPlatformCommands(workflow) {
+  const fresh = [
+    'tests/e2e/golden-fresh-profile-terminal.spec.ts',
+    'tests/e2e/golden-shell-command.spec.ts'
+  ]
+  const core = ['tests/e2e/golden-core-flows.spec.ts']
+  for (const [platform, expected] of Object.entries({
+    Linux: [core, fresh],
+    macOS: [core, fresh],
+    Windows: [fresh]
+  })) {
+    const step = workflow.jobs['golden-e2e'].steps.find(
+      (candidate) => candidate.name === `Run golden E2E tests on ${platform}`
+    )
+    expect(step, platform).toMatchObject({ if: `runner.os == '${platform}'` })
+    const args = [...step.run.matchAll(/\bpnpm run test:e2e\s+([^\n]+)/g)].map((match) =>
+      match[1].trim().split(/\s+/)
+    )
+    expect(args, platform).toEqual(expected)
+  }
+}
+
+function focusedArguments() {
+  const commands = []
+  for (const filename of ['terminal-ime-e2e.yml', 'golden-e2e-experiment.yml']) {
+    const workflow = parse(readFileSync(join(projectDir, '.github/workflows', filename), 'utf8'))
+    if (filename === 'golden-e2e-experiment.yml') {
+      assertGoldenPlatformCommands(workflow)
+    }
+    for (const job of Object.values(workflow.jobs)) {
+      for (const step of job.steps) {
+        for (const match of (step.run ?? '').matchAll(/\bpnpm run test:e2e\s+([^\n]+)/g)) {
+          commands.push(match[1].trim().split(/\s+/))
+        }
+      }
+    }
+  }
+  const runner = readFileSync(
+    join(projectDir, 'config/scripts/run-terminal-ibus-hangul-e2e.mjs'),
+    'utf8'
+  )
+  const native = runner.match(/\[\s*'run',\s*'test:e2e:headful',([\s\S]*?)\]/)
+  expect(native).not.toBeNull()
+  expect(native[1].replace(/'[^']*'|[\s,]/g, '')).toBe('')
+  commands.push([...native[1].matchAll(/'([^']*)'/g)].map((match) => match[1]))
+  return [...new Map(commands.map((args) => [JSON.stringify(args), args])).values()]
+}
+
+it('focused IME and golden commands discover only their requested files with the installed Playwright CLI', async () => {
+  const commands = focusedArguments()
+  expect(commands).toHaveLength(4)
+  const directory = realpathSync(mkdtempSync(join(tmpdir(), 'orca-playwright-focused-')))
+  const config = join(directory, 'playwright.config.cjs')
+  const testPackage = JSON.stringify(require.resolve('@stablyai/playwright-test'))
+  try {
+    mkdirSync(join(directory, 'tests/e2e'), { recursive: true })
+    writeFileSync(config, "module.exports = { testDir: '.', testMatch: '**/*.spec.ts' }")
+    const requestedFiles = commands.flatMap((args) =>
+      args.filter((arg) => arg.endsWith('.spec.ts'))
+    )
+    for (const filename of new Set([...requestedFiles, 'tests/e2e/unrelated.spec.ts'])) {
+      writeFileSync(
+        join(directory, filename),
+        `const { test } = require(${testPackage}); test('selected', () => {});`
+      )
+    }
+    for (const args of commands) {
+      const result = await runProcess({
+        program: process.execPath,
+        cwd: directory,
+        args: [
+          join(dirname(require.resolve('playwright/package.json')), 'cli.js'),
+          'test',
+          '--config',
+          config,
+          '--list',
+          '--reporter=json',
+          ...args
+        ],
+        env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1' },
+        timeoutMs: 20_000
+      })
+      expect(result.code, result.stderr).toBe(0)
+      const report = JSON.parse(result.stdout)
+      const expected = args.filter((arg) => arg.endsWith('.spec.ts')).sort()
+      expect(
+        report.suites.map((suite) => suite.file.replaceAll('\\', '/')).sort(),
+        JSON.stringify(args)
+      ).toEqual(expected)
+    }
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+}, 30_000)
diff --git a/config/scripts/pr-code-change-scope.mjs b/config/scripts/pr-code-change-scope.mjs
index babe8e8c7e0..9fef4ed19a0 100644
--- a/config/scripts/pr-code-change-scope.mjs
+++ b/config/scripts/pr-code-change-scope.mjs
@@ -44,6 +44,7 @@ const GLOBAL_FORCE_PREFIXES = [
 const GLOBAL_FORCE_FILES = new Set(['package.json', 'pnpm-lock.yaml'])
 
 const GIT_COMPAT_PREFIXES = [
+  '.github/actions/prepare-git-compatibility/',
   'src/shared/git-',
   'src/shared/review-head-tracking-ref',
   'src/main/git/',
@@ -52,8 +53,11 @@ const GIT_COMPAT_PREFIXES = [
 ]
 
 // Why narrow: the contract pins Codex's read-repair, so it runs when the heal that
-// depends on it, its app-server transport, or the contract itself changes.
+// depends on it, its app-server transport, or the contract itself changes. The same
+// job pins --no-daemon for Orca's codex shell wrapper.
 const CODEX_INDEX_HEAL_CONTRACT_PREFIXES = [
+  'src/main/pty/codex-no-daemon-binary-contract',
+  'src/main/pty/codex-shell-launch-preflight',
   'src/main/codex/codex-index-heal-binary-contract',
   'src/main/codex/codex-session-index-heal',
   'src/main/codex/codex-app-server-session',
@@ -112,6 +116,9 @@ const ORCAD_BROWSER_PREFIXES = [
 // import, and the shell policy the render check runs the page under.
 const MOBILE_WEB_APP_PREFIXES = [
   'config/scripts/build-mobile-web-app',
+  'config/scripts/run-mobile-web-app-checks',
+  'config/scripts/script-child-process.mjs',
+  'src/shared/child-process/',
   'config/scripts/verify-mobile-web-app-bundle',
   'config/scripts/mobile-web-app-',
   'config/scripts/mobile-web-bundle-',
@@ -142,11 +149,14 @@ const CROSS_VERSION_WIRE_PREFIXES = [
   'src/shared/rpc-contract/agent-launch-params',
   'src/shared/agent-session-wire',
   'src/shared/agent-session-mutation-envelope',
+  'src/shared/agent-session-record',
   'src/shared/agent-session-journal-',
   'src/main/ai-vault/structured-session-ownership.ts',
   'src/main/native-chat/agent-session-journal/',
   'src/main/native-chat/agent-session-wire/',
   'src/main/runtime/agent-session-record-store',
+  'src/main/runtime/agent-session-recovery-capsule',
+  'src/shared/agent-session-resume-marker',
   'src/main/runtime/rpc/dispatcher',
   'src/main/runtime/rpc/methods/agent-launch',
   'src/main/runtime/rpc/methods/ai-vault.ts',
@@ -154,6 +164,9 @@ const CROSS_VERSION_WIRE_PREFIXES = [
   'src/main/runtime/rpc/methods/session-tabs.ts',
   'src/main/runtime/rpc/methods/structured-agent-session',
   'src/main/runtime/rpc/methods/terminal',
+  'src/main/runtime/runtime-worktree-agent-',
+  'src/main/runtime/runtime-worktree-pty-agent-sources',
+  'src/shared/runtime-worktree-contracts',
   'src/renderer/src/runtime/remote-runtime-terminal-multiplexer'
 ]
 
@@ -215,6 +228,10 @@ const SHARED_PACKAGE_PREFIXES = [
 
 const LINUX_PACKAGE_PREFIXES = [
   ...SHARED_PACKAGE_PREFIXES,
+  'config/scripts/package-linux-formats',
+  'config/scripts/script-child-process.mjs',
+  'config/scripts/space-sharing-copy.mjs',
+  '.github/actions/prepare-linux-package-fixture/',
   'config/docker/cli-launch-contract/',
   'config/docker/headless-pairing/',
   'config/docker/headless-serve-shutdown/',
@@ -251,6 +268,7 @@ const WINDOWS_PACKAGE_TESTS = [
   'config/scripts/rebuild-native-deps.test.mjs',
   'config/scripts/rebuild-native-deps-windows-process-tree.test.mjs',
   'config/scripts/rebuild-native-deps-node-pty.test.mjs',
+  'config/scripts/nsis-process-check.test.mjs',
   'config/scripts/ensure-native-runtime-job-ownership.test.mjs',
   'config/scripts/verify-packaged-node-pty-job-ownership.test.mjs',
   'config/scripts/windows-pe-machine.test.mjs',
@@ -271,6 +289,7 @@ const WINDOWS_PACKAGE_TESTS = [
   'src/main/windows/windows-host-job.win32.test.ts',
   'src/main/windows/windows-process-tree-command-line-patch.test.ts',
   'src/main/windows/windows-process-table-native-addon.win32.test.ts',
+  'src/main/persistence/profile-state/profile-state-access-windows-native.win32.test.ts',
   'src/main/windows-live-tree-kill.win32.test.ts',
   'src/main/wsl/wsl-runner.test.ts',
   'src/main/wsl/wsl-guest-environment.test.ts',
diff --git a/config/scripts/pr-code-change-scope.test.mjs b/config/scripts/pr-code-change-scope.test.mjs
index cab82db3e03..1981623d281 100644
--- a/config/scripts/pr-code-change-scope.test.mjs
+++ b/config/scripts/pr-code-change-scope.test.mjs
@@ -129,6 +129,9 @@ describe('per-job path classification', () => {
     expectClassification(['src/shared/git-binary-compatibility.test.ts'], {
       git_compatibility: true
     })
+    expectClassification(['.github/actions/prepare-git-compatibility/action.yml'], {
+      git_compatibility: true
+    })
   })
 
   it('runs the Codex index-heal contract only when the heal or its transport changes', () => {
@@ -195,6 +198,10 @@ describe('per-job path classification', () => {
 
   it('runs Linux packaging when an artifact contract changes', () => {
     for (const file of [
+      'config/scripts/package-linux-formats.mjs',
+      'config/scripts/script-child-process.mjs',
+      'config/scripts/space-sharing-copy.mjs',
+      '.github/actions/prepare-linux-package-fixture/action.yml',
       'config/docker/cli-launch-contract/Dockerfile',
       'config/docker/cli-launch-contract/run-cli-case.sh',
       'config/docker/headless-pairing/Dockerfile',
@@ -204,7 +211,10 @@ describe('per-job path classification', () => {
       'config/scripts/run-headless-linux-pairing-docker.mjs',
       'config/scripts/static-appimage-package-contract.cjs'
     ]) {
-      expectClassification([file], { package: true })
+      expectClassification([file], {
+        package: true,
+        mobile_web_app: file === 'config/scripts/script-child-process.mjs'
+      })
     }
   })
 
@@ -216,7 +226,10 @@ describe('per-job path classification', () => {
       'config/docker/daemon-shutdown-descendants/run-case.sh',
       'config/scripts/run-daemon-shutdown-descendants-docker.mjs'
     ]) {
-      expectClassification([file], { package: true })
+      expectClassification([file], {
+        package: true,
+        mobile_web_app: file === 'config/scripts/script-child-process.mjs'
+      })
     }
     for (const file of [
       'src/main/daemon/terminal-host.ts',
@@ -281,6 +294,9 @@ describe('per-job path classification', () => {
   it('runs the mobile web app job for the builder, the page source and the shell policy', () => {
     for (const file of [
       'config/scripts/build-mobile-web-app-bundle.mjs',
+      'config/scripts/run-mobile-web-app-checks.mjs',
+      'config/scripts/script-child-process.mjs',
+      'src/shared/child-process/run-process.ts',
       'config/scripts/mobile-web-app-route-manifest.mjs',
       'mobile/web-entry/index.tsx',
       'mobile/app/h/[hostId]/index.tsx',
@@ -334,6 +350,9 @@ describe('per-job path classification', () => {
       'src/main/runtime/rpc/methods/structured-agent-session-hold.ts',
       'src/main/runtime/rpc/methods/structured-agent-session-schemas.ts',
       'src/main/runtime/rpc/methods/terminal.ts',
+      'src/main/runtime/runtime-worktree-agent-rows.ts',
+      'src/main/runtime/runtime-worktree-pty-agent-sources.ts',
+      'src/shared/runtime-worktree-contracts.ts',
       'src/renderer/src/runtime/remote-runtime-terminal-multiplexer.ts'
     ]) {
       expectClassification([file], {
@@ -511,12 +530,19 @@ describe('PR Checks skip wiring', () => {
     )
     expect(classify.run).toContain('--diff-filter=ACDMR')
     expect(classify.run).toContain('--no-renames')
-    expect(classify.run).toContain('--merge-base "$BASE_SHA" "$HEAD_SHA"')
+    // HEAD is the merge commit, so HEAD^1 is the base side and no merge base is computed.
+    // That is what lets this job check out shallowly, which every other job waits on.
+    expect(classify.run).toContain('node config/scripts/git-pull-request-diff-base.mjs "$BASE_SHA"')
+    expect(classify.run).toContain('"$DIFF_BASE" HEAD')
+    expect(classify.run).not.toContain('--merge-base "$')
     expect(classify.run).toContain('node config/scripts/pr-code-change-scope.mjs')
     expect(classify.run).toContain('tee -a "$GITHUB_OUTPUT"')
-    for (const jobName of ['should_run', 'native_cache_changed', ...expensiveJobs]) {
+    expect(prWorkflow.jobs.code_paths.outputs.should_run).toBe(
+      '${{ steps.filter.outputs.should_run }}'
+    )
+    for (const jobName of ['native_cache_changed', ...expensiveJobs]) {
       expect(prWorkflow.jobs.code_paths.outputs[jobName], jobName).toBe(
-        `\${{ steps.filter.outputs.${jobName} }}`
+        `\${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.${jobName} }}`
       )
     }
   })
@@ -546,19 +572,42 @@ describe('PR Checks skip wiring', () => {
     expect(installStep.run).toContain('--frozen-lockfile')
   })
 
-  it('keeps the cheap root-directory guard on docs-only PRs', () => {
-    expect(prWorkflow.jobs.root_directory_guard.if).toBeUndefined()
-    expect(prWorkflow.jobs.root_directory_guard.needs).toBeUndefined()
+  it('keeps the root and README guards on docs-only PRs without another runner', () => {
+    const detector = prWorkflow.jobs.code_paths
+    expect(detector.if).toBeUndefined()
+    expect(detector.needs).toBeUndefined()
+    for (const name of ['Reject new root-level files and folders', 'Check README local links']) {
+      const step = detector.steps.find((candidate) => candidate.name === name)
+      expect(step).toBeDefined()
+      expect(step.if).toBeUndefined()
+    }
+    expect(prWorkflow.jobs.root_directory_guard).toBeUndefined()
   })
 
   it('gates each expensive job on its classifier and cache prerequisite', () => {
     for (const jobName of expensiveJobs.filter((jobName) => jobName !== 'test')) {
-      expect(prWorkflow.jobs[jobName].needs, jobName).toEqual(['code_paths'])
+      expect(prWorkflow.jobs[jobName].needs, jobName).toEqual(
+        ['package', 'package_windows'].includes(jobName)
+          ? ['code_paths', 'static_analysis', 'typecheck']
+          : ['code_paths']
+      )
       expect(prWorkflow.jobs[jobName].if, jobName).toBe(
         `needs.code_paths.outputs.${jobName} == 'true'`
       )
     }
-    expect(prWorkflow.jobs.test.needs).toEqual(['code_paths', 'test_native_cache'])
+    expect(prWorkflow.jobs.test.needs).toEqual([
+      'code_paths',
+      'unit_plan',
+      'test_native_cache',
+      'static_analysis',
+      'typecheck'
+    ])
+    // Planning is deliberately NOT behind the static-analysis gate: it consumes nothing those
+    // jobs produce, so gating it only made the shards queue behind it. It still has to succeed
+    // before the shards run, or the matrix would expand from an empty assignment.
+    expect(prWorkflow.jobs.unit_plan.needs).toEqual(['code_paths'])
+    expect(prWorkflow.jobs.unit_plan.if).toBe("needs.code_paths.outputs.test == 'true'")
+    expect(prWorkflow.jobs.test.if).toContain("needs.unit_plan.result == 'success'")
     expect(prWorkflow.jobs.test.if).toContain("needs.code_paths.outputs.test == 'true'")
     expect(prWorkflow.jobs.test.if).toContain("needs.test_native_cache.result == 'success'")
     expect(prWorkflow.jobs.test.if).toContain("needs.test_native_cache.result == 'skipped'")
@@ -587,12 +636,12 @@ describe('PR Checks skip wiring', () => {
     )
     expect(prWorkflow.jobs.verify.needs[0]).toBe('code_paths')
     expect(verifyStep.env.SHOULD_RUN).toBe('${{ needs.code_paths.outputs.should_run }}')
-    expect(verifyStep.run).toContain('"$ROOT_DIRECTORY_GUARD" != "success"')
+    expect(verifyStep.run).toContain('"$CODE_PATHS" != "success"')
     expect(verifyStep.run).toContain('# Require success when the PR has code-relevant changes')
     expect(verifyStep.run).toContain('expected skipped')
     expect(verifyStep.run).toContain('expected success')
     for (const job of prWorkflow.jobs.verify.needs) {
-      if (job === 'code_paths' || job === 'root_directory_guard') {
+      if (job === 'code_paths') {
         continue
       }
       const envVar = `${job.replaceAll('-', '_').toUpperCase()}_SHOULD_RUN`
diff --git a/config/scripts/pr-e2e-gate-contract.test.mjs b/config/scripts/pr-e2e-gate-contract.test.mjs
index d586f27ff1a..4bcb1b4f1af 100644
--- a/config/scripts/pr-e2e-gate-contract.test.mjs
+++ b/config/scripts/pr-e2e-gate-contract.test.mjs
@@ -127,11 +127,10 @@ describe('PR E2E gate contract', () => {
     const successLoop = verifyStep.run.slice(verifyStep.run.indexOf(successMarker))
     expect(successLoop.length).toBeGreaterThan(0)
     expect(verifyStep.run).toContain('"$CODE_PATHS" != "success"')
-    expect(verifyStep.run).toContain('"$ROOT_DIRECTORY_GUARD" != "success"')
     for (const job of prWorkflow.jobs.verify.needs) {
       const envVar = job.replaceAll('-', '_').toUpperCase()
       expect(verifyStep.env[envVar]).toBe(`\${{ needs.${job}.result }}`)
-      if (job === 'code_paths' || job === 'root_directory_guard') {
+      if (job === 'code_paths') {
         continue
       }
       expect(successLoop).toContain(`"$${envVar}"`)
@@ -239,7 +238,7 @@ describe('PR E2E gate contract', () => {
   })
 
   it('scopes detection to the PR range so base drift cannot false-trigger', () => {
-    expect(filterStep.run).toContain('--merge-base "$BASE" "$HEAD"')
+    expect(filterStep.run).toMatch(/diff-base\.mjs "\$BASE"[\s\S]*"\$DIFF_BASE" HEAD/)
     expect(filterStep.run).toContain('set -euo pipefail')
   })
 
@@ -445,7 +444,7 @@ describe('PR E2E gate contract', () => {
   })
 
   it('scopes the VM rollback oracle to the PR range and recipe schema authorities', () => {
-    expect(rollbackStep.run).toContain('--merge-base "$BASE_SHA" "$HEAD_SHA"')
+    expect(rollbackStep.run).toMatch(/diff-base\.mjs "\$BASE_SHA"[\s\S]*"\$DIFF_BASE" HEAD --/)
     expect(rollbackStep.run).toContain('src/shared/ephemeral-vm-recipes.ts')
     expect(rollbackStep.run).toContain('src/shared/orca-yaml-hook-types.ts')
     expect(selectPrE2eSpecs(['src/shared/ephemeral-vm-recipes.ts'])).toEqual([
diff --git a/config/scripts/pr-e2e-source-routing.mjs b/config/scripts/pr-e2e-source-routing.mjs
index 9a8f678860f..f8737ad6ea6 100644
--- a/config/scripts/pr-e2e-source-routing.mjs
+++ b/config/scripts/pr-e2e-source-routing.mjs
@@ -33,6 +33,17 @@ export const PR_E2E_SOURCE_ROUTES = [
           file
         ))
   },
+  {
+    // Why the host-connection phase: the route gate waits on it, so a phase change can strand the
+    // SSH-unavailable card without touching a browser file.
+    id: 'browser.local-ssh-workspace-route',
+    specs: ['tests/e2e/local-ssh-browser-routing.spec.ts'],
+    matches: (file) =>
+      isProductSource(file) &&
+      /^src\/(?:main\/browser\/local-ssh-browser-(?:route|partitions)\.ts|renderer\/src\/(?:components\/browser-pane\/(?:use-ssh-workspace-browser-route\.ts|assemble-chrome\/ssh-routed-browser-page-gate\.tsx)|lib\/worktree-host-connection-phase\.ts))$/.test(
+        file
+      )
+  },
   {
     id: 'terminal.windows-wsl-launch-and-paste',
     specs: [
diff --git a/config/scripts/pr-ready-check-gate.test.mjs b/config/scripts/pr-ready-check-gate.test.mjs
new file mode 100644
index 00000000000..27e5cf99103
--- /dev/null
+++ b/config/scripts/pr-ready-check-gate.test.mjs
@@ -0,0 +1,66 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { runProcess } from '../../src/shared/child-process/run-process'
+import { PR_CHECK_JOBS } from './pr-code-change-scope.mjs'
+
+const workflow = parse(readFileSync('.github/workflows/pr.yml', 'utf8'))
+const gate = workflow.jobs.verify.steps.find((step) => step.name === 'Require successful checks')
+const variable = (job) => job.replaceAll('-', '_').toUpperCase()
+
+function requiredResults(shouldRun) {
+  return Object.fromEntries(
+    PR_CHECK_JOBS.flatMap((job) => [
+      [variable(job), shouldRun ? 'success' : 'skipped'],
+      [`${variable(job)}_SHOULD_RUN`, String(shouldRun)]
+    ])
+  )
+}
+
+async function verify(results) {
+  return runProcess({
+    program: 'bash',
+    args: ['-c', gate.run],
+    env: {
+      ...process.env,
+      ORCA_BACKGROUND_LAUNCH: '1',
+      CODE_PATHS: 'success',
+      SHOULD_RUN: 'true',
+      ...results
+    },
+    timeoutMs: 10_000
+  })
+}
+
+// The aggregate runs as Bash on Linux; Windows has no required Bash installation.
+describe.skipIf(process.platform === 'win32')(
+  'readiness reuse through the real aggregate gate',
+  () => {
+    it('accepts completed required checks or skips authorized by exact-source evidence', async () => {
+      expect((await verify(requiredResults(true))).code).toBe(0)
+      expect((await verify(requiredResults(false))).code).toBe(0)
+    })
+
+    it('rejects every missing, failed or cancelled required result when reuse is unavailable', async () => {
+      for (const job of PR_CHECK_JOBS) {
+        for (const result of ['', 'skipped', 'failure', 'cancelled']) {
+          const verdict = await verify({ ...requiredResults(true), [variable(job)]: result })
+          expect(verdict.code, `${job}: ${result}`).toBe(1)
+        }
+      }
+    })
+
+    it('requires the detector to succeed even when every downstream job is skipped', async () => {
+      for (const result of ['', 'skipped', 'failure', 'cancelled']) {
+        expect((await verify({ ...requiredResults(false), CODE_PATHS: result })).code).toBe(1)
+      }
+    })
+
+    it('rejects unexpected downstream execution when the proven plan requires skips', async () => {
+      for (const job of PR_CHECK_JOBS) {
+        const verdict = await verify({ ...requiredResults(false), [variable(job)]: 'success' })
+        expect(verdict.code, job).toBe(1)
+      }
+    })
+  }
+)
diff --git a/config/scripts/pr-ready-check-reuse.mjs b/config/scripts/pr-ready-check-reuse.mjs
new file mode 100644
index 00000000000..57e00a740c2
--- /dev/null
+++ b/config/scripts/pr-ready-check-reuse.mjs
@@ -0,0 +1,99 @@
+import { appendFileSync, readFileSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
+
+export function prCheckRunTitle({ number, sourceSha, workflowSha, unitMode = 'full' }) {
+  return `PR ${number} | source ${sourceSha} | workflow ${workflowSha} | unit ${unitMode}`
+}
+
+export function reusablePrCheckRun(runs, identity) {
+  if (
+    !Number.isSafeInteger(identity.number) ||
+    identity.number < 1 ||
+    ![identity.sourceSha, identity.workflowSha, identity.headSha].every((sha) =>
+      /^[a-f0-9]{40}$/.test(sha ?? '')
+    )
+  ) {
+    return undefined
+  }
+  return runs.find(
+    (run) =>
+      Number.isSafeInteger(run.id) &&
+      run.id > 0 &&
+      String(run.id) !== identity.runId &&
+      run.path === '.github/workflows/pr.yml' &&
+      run.event === 'pull_request' &&
+      run.status === 'completed' &&
+      run.conclusion === 'success' &&
+      run.head_sha === identity.headSha &&
+      run.display_title === prCheckRunTitle(identity)
+  )
+}
+
+export async function lookupReadyCheckRun(env, event, request = fetch) {
+  if (
+    env.GITHUB_EVENT_NAME !== 'pull_request' ||
+    event.action !== 'ready_for_review' ||
+    event.pull_request?.draft !== false
+  ) {
+    return undefined
+  }
+  const identity = {
+    number: event.pull_request?.number,
+    headSha: event.pull_request?.head?.sha,
+    sourceSha: env.GITHUB_SHA,
+    workflowSha: env.PR_CHECK_WORKFLOW_SHA,
+    runId: env.GITHUB_RUN_ID
+  }
+  const repository = env.GITHUB_REPOSITORY
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repository ?? '') || !env.GH_TOKEN) {
+    return undefined
+  }
+  const url = new URL(
+    `/repos/${repository}/actions/workflows/pr.yml/runs`,
+    env.GITHUB_API_URL ?? 'https://api.github.com'
+  )
+  url.search = new URLSearchParams({
+    event: 'pull_request',
+    head_sha: identity.headSha ?? '',
+    status: 'success',
+    per_page: '20'
+  }).toString()
+  try {
+    const response = await request(url, {
+      headers: {
+        Accept: 'application/vnd.github+json',
+        Authorization: `Bearer ${env.GH_TOKEN}`,
+        'User-Agent': 'orca-pr-ready-check-reuse',
+        'X-GitHub-Api-Version': '2022-11-28'
+      },
+      signal: AbortSignal.timeout(10_000)
+    })
+    if (!response.ok) {
+      throw new Error(`Run lookup returned HTTP ${response.status}`)
+    }
+    const result = await response.json()
+    if (!Array.isArray(result.workflow_runs)) {
+      throw new Error('Run lookup omitted workflow runs')
+    }
+    return reusablePrCheckRun(result.workflow_runs, identity)
+  } catch (error) {
+    console.log(`No reusable result: ${error.message}; running the required checks.`)
+    return undefined
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  let run
+  try {
+    const event = JSON.parse(readFileSync(process.env.GITHUB_EVENT_PATH, 'utf8'))
+    run = await lookupReadyCheckRun(process.env, event)
+  } catch (error) {
+    console.log(`No reusable result: ${error.message}; running the required checks.`)
+  }
+  appendFileSync(process.env.GITHUB_OUTPUT, `reused=${Boolean(run)}\nrun_id=${run?.id ?? ''}\n`)
+  console.log(
+    run
+      ? `Required checks already passed for this source and workflow: ${run.html_url}`
+      : 'No identical successful run found; running the required checks.'
+  )
+}
diff --git a/config/scripts/pr-ready-check-reuse.test.mjs b/config/scripts/pr-ready-check-reuse.test.mjs
new file mode 100644
index 00000000000..1d64542a614
--- /dev/null
+++ b/config/scripts/pr-ready-check-reuse.test.mjs
@@ -0,0 +1,172 @@
+import { readFileSync } from 'node:fs'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { parse } from 'yaml'
+import { PR_CHECK_JOBS } from './pr-code-change-scope.mjs'
+import {
+  lookupReadyCheckRun,
+  prCheckRunTitle,
+  reusablePrCheckRun
+} from './pr-ready-check-reuse.mjs'
+
+const identity = {
+  number: 42,
+  sourceSha: 'a'.repeat(40),
+  workflowSha: 'b'.repeat(40),
+  headSha: 'c'.repeat(40),
+  runId: '456'
+}
+const passed = {
+  id: 123,
+  path: '.github/workflows/pr.yml',
+  event: 'pull_request',
+  status: 'completed',
+  conclusion: 'success',
+  head_sha: identity.headSha,
+  display_title: prCheckRunTitle(identity)
+}
+const event = {
+  action: 'ready_for_review',
+  pull_request: { number: 42, draft: false, head: { sha: identity.headSha } }
+}
+const env = {
+  GITHUB_EVENT_NAME: 'pull_request',
+  GITHUB_SHA: identity.sourceSha,
+  PR_CHECK_WORKFLOW_SHA: identity.workflowSha,
+  GITHUB_RUN_ID: identity.runId,
+  GITHUB_REPOSITORY: 'stablyai/orca',
+  GH_TOKEN: 'read-only-test-token'
+}
+const response = (runs) => ({ ok: true, json: async () => ({ workflow_runs: runs }) })
+const workflow = parse(readFileSync('.github/workflows/pr.yml', 'utf8'))
+
+afterEach(() => vi.restoreAllMocks())
+
+describe('ready-for-review required check reuse', () => {
+  it('reuses a completed success only for the identical PR, merge source and workflow', () => {
+    expect(reusablePrCheckRun([passed], identity)).toBe(passed)
+    expect(reusablePrCheckRun([], identity)).toBeUndefined()
+    expect(
+      reusablePrCheckRun(
+        [{ ...passed, display_title: prCheckRunTitle({ ...identity, unitMode: 'selected' }) }],
+        identity
+      )
+    ).toBeUndefined()
+    for (const key of ['number', 'sourceSha', 'workflowSha', 'headSha', 'runId']) {
+      const changed = key === 'number' ? 43 : key === 'runId' ? '123' : 'd'.repeat(40)
+      expect(reusablePrCheckRun([passed], { ...identity, [key]: changed }), key).toBeUndefined()
+    }
+    for (const key of ['number', 'sourceSha', 'workflowSha', 'headSha']) {
+      expect(reusablePrCheckRun([passed], { ...identity, [key]: undefined }), key).toBeUndefined()
+    }
+  })
+
+  it.each([
+    { status: 'in_progress' },
+    { status: 'queued' },
+    { conclusion: 'failure' },
+    { conclusion: 'cancelled' },
+    { conclusion: 'skipped' },
+    { event: 'push' },
+    { path: '.github/workflows/other.yml' },
+    { display_title: 'Previous workflow without source provenance' },
+    { id: -1 }
+  ])('rejects unusable evidence %j', (change) => {
+    expect(reusablePrCheckRun([{ ...passed, ...change }], identity)).toBeUndefined()
+  })
+
+  it('bounds the read-only lookup to this workflow and PR head', async () => {
+    const request = vi.fn(async () => response([passed]))
+    expect(await lookupReadyCheckRun(env, event, request)).toBe(passed)
+    expect(request).toHaveBeenCalledTimes(1)
+    const [url, options] = request.mock.calls[0]
+    expect(url.origin).toBe('https://api.github.com')
+    expect(url.pathname).toBe('/repos/stablyai/orca/actions/workflows/pr.yml/runs')
+    expect(Object.fromEntries(url.searchParams)).toEqual({
+      event: 'pull_request',
+      head_sha: identity.headSha,
+      status: 'success',
+      per_page: '20'
+    })
+    expect(options.method).toBeUndefined()
+    expect(options.signal).toBeInstanceOf(AbortSignal)
+  })
+
+  it('runs ordinary pushes and draft checks without consulting old results', async () => {
+    const request = vi.fn()
+    for (const action of ['opened', 'synchronize', 'reopened', 'converted_to_draft']) {
+      expect(await lookupReadyCheckRun(env, { ...event, action }, request)).toBeUndefined()
+    }
+    expect(
+      await lookupReadyCheckRun(
+        env,
+        { ...event, pull_request: { ...event.pull_request, draft: true } },
+        request
+      )
+    ).toBeUndefined()
+    expect(await lookupReadyCheckRun({ ...env, GH_TOKEN: '' }, event, request)).toBeUndefined()
+    expect(
+      await lookupReadyCheckRun({ ...env, GITHUB_EVENT_NAME: 'push' }, event, request)
+    ).toBeUndefined()
+    expect(request).not.toHaveBeenCalled()
+  })
+
+  it('falls back to full checks when the API is unavailable or evidence is malformed', async () => {
+    vi.spyOn(console, 'log').mockImplementation(() => {})
+    for (const request of [
+      async () => ({ ok: false, status: 403 }),
+      async () => ({ ok: false, status: 429 }),
+      async () => ({ ok: true, json: async () => ({}) }),
+      async () => {
+        throw new Error('Network unavailable')
+      }
+    ]) {
+      expect(await lookupReadyCheckRun(env, event, request)).toBeUndefined()
+    }
+    expect(await lookupReadyCheckRun(env, event, async () => response([]))).toBeUndefined()
+  })
+
+  it('keeps required skips conditional on proof and leaves advisory routing eligible', () => {
+    expect(workflow['run-name']).toBe(
+      "PR ${{ github.event.pull_request.number }} | source ${{ github.sha }} | workflow ${{ github.workflow_sha }} | unit ${{ github.event.pull_request.draft && vars.ORCA_UNIT_SELECTION_MODE == 'selected' && 'selected' || 'full' }}"
+    )
+    expect(workflow.on.pull_request.types).toContain('ready_for_review')
+    const detector = workflow.jobs.code_paths
+    expect(detector.permissions).toEqual({ contents: 'read', actions: 'read' })
+    const readiness = detector.steps.find((step) => step.id === 'readiness')
+    expect(readiness.if).toBe("github.event.action == 'ready_for_review'")
+    expect(readiness.env.PR_CHECK_WORKFLOW_SHA).toBe('${{ github.workflow_sha }}')
+    expect(readiness.run).toBe('node config/scripts/pr-ready-check-reuse.mjs')
+    expect(detector.steps[0].with['sparse-checkout']).toContain(
+      '/config/scripts/pr-ready-check-reuse.mjs'
+    )
+    for (const job of ['native_cache_changed', ...PR_CHECK_JOBS]) {
+      expect(detector.outputs[job]).toBe(
+        `\${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.${job} }}`
+      )
+    }
+    expect(detector.outputs.should_run).toBe('${{ steps.filter.outputs.should_run }}')
+    for (const name of [
+      'test_files',
+      'ssh_source_changed',
+      'native_ime_source_changed',
+      'wsl_source_changed'
+    ]) {
+      expect(detector.outputs[name]).toBe(`\${{ steps.e2e_filter.outputs.${name} }}`)
+    }
+    expect(detector.steps.find((step) => step.id === 'e2e_filter').if).toBe(
+      "github.event.pull_request.draft != true && steps.filter.outputs.should_run == 'true'"
+    )
+    expect(workflow.jobs.verify.if).toBe('${{ !cancelled() }}')
+    expect(workflow.jobs.verify.needs).toEqual(['code_paths', ...PR_CHECK_JOBS])
+  })
+
+  it.each(['pr-test-loc.yml', 'mobile.yml'])(
+    'does not rerun draft-independent %s on readiness changes',
+    (file) => {
+      const source = readFileSync(`.github/workflows/${file}`, 'utf8')
+      const independent = parse(source)
+      expect(independent.on.pull_request.types).toEqual(['opened', 'synchronize', 'reopened'])
+      expect(source).not.toContain('pull_request.draft')
+    }
+  )
+})
diff --git a/config/scripts/pr-test-loc-summary.test.mjs b/config/scripts/pr-test-loc-summary.test.mjs
index 044b645a29c..d206c3c09a0 100644
--- a/config/scripts/pr-test-loc-summary.test.mjs
+++ b/config/scripts/pr-test-loc-summary.test.mjs
@@ -233,7 +233,7 @@ describe('PR test LoC summary', () => {
   })
 
   it('is a no-checkout GitHub-hosted PR workflow', () => {
-    expect(locJob['runs-on']).toBe('ubuntu-latest')
+    expect(locJob['runs-on']).toBe('ubuntu-slim')
     expect(locJob.steps).toHaveLength(1)
     expect(locStep.run).toContain('gh api')
     expect(locStep.run).toContain('pr-test-loc-table.mjs')
diff --git a/config/scripts/pr-workflow-lint-parity.test.mjs b/config/scripts/pr-workflow-lint-parity.test.mjs
deleted file mode 100644
index 648714f244c..00000000000
--- a/config/scripts/pr-workflow-lint-parity.test.mjs
+++ /dev/null
@@ -1,86 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { parse } from 'yaml'
-import { describe, expect, it } from 'vitest'
-
-// Why: pr.yml re-lists the `lint` chain as individual steps so a single failure
-// does not mask the rest and oxlint keeps its `--format github` annotations.
-// Hand-maintained mirrors drift (#10601: three verifiers never ran on PRs), so
-// this gate fails the moment a `lint` step has no counterpart in pr.yml.
-
-// Flags that only change reporting, so they must not split two otherwise identical commands.
-const REPORTING_FLAGS_WITH_VALUE = new Set(['--format', '--reporter'])
-const REPORTING_FLAGS = new Set(['--quiet'])
-const PACKAGE_RUNNER_TOKENS = new Set(['pnpm', 'npm', 'yarn', 'npx', 'run', 'exec', 'node'])
-
-function splitCommandChain(command) {
-  return command
-    .split(/\n|&&|;/)
-    .map((part) => part.trim())
-    .filter(Boolean)
-}
-
-function canonicalize(command) {
-  const tokens = command.split(/\s+/)
-  const canonical = []
-
-  for (let index = 0; index < tokens.length; index += 1) {
-    const token = tokens[index]
-    if (canonical.length === 0 && PACKAGE_RUNNER_TOKENS.has(token)) {
-      continue
-    }
-    if (REPORTING_FLAGS.has(token)) {
-      continue
-    }
-    if (REPORTING_FLAGS_WITH_VALUE.has(token)) {
-      index += 1
-      continue
-    }
-    canonical.push(token)
-  }
-
-  return canonical.join(' ')
-}
-
-/** Expands `pnpm run x` indirection until every entry is a real binary invocation. */
-function resolveLeafCommands(command, scripts, seen = new Set()) {
-  const leaves = []
-
-  for (const part of splitCommandChain(command)) {
-    const scriptName = part.match(/^(?:pnpm|npm|yarn)(?:\s+run)?\s+([\w:-]+)$/)?.[1]
-    if (scriptName && scripts[scriptName] && !seen.has(scriptName)) {
-      leaves.push(
-        ...resolveLeafCommands(scripts[scriptName], scripts, new Set([...seen, scriptName]))
-      )
-      continue
-    }
-    leaves.push(canonicalize(part))
-  }
-
-  return leaves
-}
-
-describe('PR workflow lint parity', () => {
-  it('runs every `pnpm lint` step on pull requests', () => {
-    const { scripts } = JSON.parse(readFileSync('package.json', 'utf8'))
-    const workflow = parse(readFileSync('.github/workflows/pr.yml', 'utf8'))
-
-    // Scan every job: which one hosts the lint steps is an organizational
-    // detail that has already been renamed once (verify -> static_analysis).
-    const workflowCommands = new Set(
-      Object.values(workflow.jobs)
-        .flatMap((job) => job.steps ?? [])
-        .filter((step) => typeof step.run === 'string')
-        .flatMap((step) => resolveLeafCommands(step.run, scripts))
-    )
-
-    const missing = resolveLeafCommands(scripts.lint, scripts).filter(
-      (leaf) => !workflowCommands.has(leaf)
-    )
-
-    expect(
-      missing,
-      `.github/workflows/pr.yml is missing lint steps: ${missing.join(', ')}. ` +
-        'Add a step for each one so PR CI matches `pnpm lint`.'
-    ).toEqual([])
-  })
-})
diff --git a/config/scripts/pr-workflow-parallelism.test.mjs b/config/scripts/pr-workflow-parallelism.test.mjs
index 0ed60ffb4bb..04bbf5d489a 100644
--- a/config/scripts/pr-workflow-parallelism.test.mjs
+++ b/config/scripts/pr-workflow-parallelism.test.mjs
@@ -1,9 +1,13 @@
 import { existsSync, globSync, readFileSync } from 'node:fs'
 import { parse } from 'yaml'
 import { describe, expect, it } from 'vitest'
+import { UNIT_EXCLUDE } from './ci-unit-files.mjs'
 import { MOBILE_WEB_APP_DEPENDENCIES_REQUIRED_ENV } from './mobile-web-app-bundle-dependencies.mjs'
 
 const workflow = parse(readFileSync('.github/workflows/pr.yml', 'utf8'))
+const prTestLocWorkflow = parse(readFileSync('.github/workflows/pr-test-loc.yml', 'utf8'))
+const releasePolicyWorkflow = parse(readFileSync('.github/workflows/release-policy.yml', 'utf8'))
+const issueLabelWorkflow = parse(readFileSync('.github/workflows/issue-os-labeler.yaml', 'utf8'))
 const unitTestWorkflow = parse(readFileSync('.github/workflows/unit-tests.yml', 'utf8'))
 const nodeNextWorkflow = parse(readFileSync('.github/workflows/node-next-compat.yml', 'utf8'))
 const dependencyAction = parse(
@@ -22,6 +26,7 @@ const shellContractFiles = [
   'src/main/zsh-scoped-histfile.live-shell.test.ts',
   'src/main/zsh-startup-hook-user-config-equivalence.live-shell.test.ts',
   'src/main/zsh-wrapper-version-mismatch.live-shell.test.ts',
+  'src/main/runtime/structured-session-cli-login-shell.live-shell.test.ts',
   'src/shared/posix-command-path-lookup.test.ts'
 ]
 const patchedNodePtyContractFiles = [
@@ -40,19 +45,31 @@ const testFilePatterns = [
 // rather than calling spawnSync('zsh') themselves. Without this branch the rule
 // silently stops noticing the very tests that need the lane's zsh install.
 const realZshUsage =
-  /(?:spawnSync|execFileSync|spawn)\(\s*['"](?:\/(?:usr\/)?bin\/)?zsh['"]|spawnSync\(\s*['"]which['"]\s*,\s*\[\s*['"]zsh['"]|name:\s*['"]zsh['"]\s*,\s*path:\s*executablePath|from '[^']*zsh-startup-hook-pty-harness'/
+  /(?:spawnSync|execFileSync|spawn)\(\s*['"](?:\/(?:usr\/)?bin\/)?zsh['"]|program:\s*['"](?:\/(?:usr\/)?bin\/)?zsh['"]|spawnSync\(\s*['"]which['"]\s*,\s*\[\s*['"]zsh['"]|name:\s*['"]zsh['"]\s*,\s*path:\s*executablePath|from '[^']*zsh-startup-hook-pty-harness'/
 
 describe('PR workflow parallelism', () => {
+  it('keeps lightweight orchestration jobs on the free slim runner', () => {
+    expect(workflow.jobs.code_paths['runs-on']).toBe('ubuntu-slim')
+    expect(workflow.jobs.typecheck['runs-on']).toBe('ubuntu-24.04-arm')
+    expect(workflow.jobs.verify['runs-on']).toBe('ubuntu-slim')
+    expect(prTestLocWorkflow.jobs.loc['runs-on']).toBe('ubuntu-slim')
+    expect(releasePolicyWorkflow.jobs.enforce['runs-on']).toBe('ubuntu-slim')
+    expect(issueLabelWorkflow.jobs['apply-os-label']['runs-on']).toBe('ubuntu-slim')
+  })
+
   it('cancels superseded runs for the same pull request', () => {
     expect(workflow.concurrency.group).toBe('pr-checks-${{ github.event.pull_request.number }}')
     expect(workflow.concurrency['cancel-in-progress']).toBe(true)
+    expect(workflow.jobs.test.if).toContain('!cancelled()')
+    expect(workflow.jobs.test.if).not.toContain('always()')
+    expect(workflow.jobs.verify.if).toBe('${{ !cancelled() }}')
   })
 
   it('grants the PR workflow read-only repository access', () => {
     expect(workflow.permissions).toEqual({ contents: 'read' })
   })
 
-  it('runs Node 24 on PRs and the same eight-shard suite on Node 26 daily', () => {
+  it('runs all eight shards on ARM for PRs and both Node versions on x86 daily', () => {
     const sharedTest = unitTestWorkflow.jobs.test
     const testStep = sharedTest.steps.find((step) => step.name === 'Test shard')
     const installStep = sharedTest.steps.find(
@@ -68,26 +85,43 @@ describe('PR workflow parallelism', () => {
     expect(workflow.jobs.test.uses).toBe('./.github/workflows/unit-tests.yml')
     expect(JSON.parse(workflow.jobs.test.with.node_versions)).toEqual(['24'])
     expect(nodeNextWorkflow.jobs.test.uses).toBe('./.github/workflows/unit-tests.yml')
-    expect(JSON.parse(nodeNextWorkflow.jobs.test.with.node_versions)).toEqual(['26'])
+    expect(JSON.parse(nodeNextWorkflow.jobs.test.with.node_versions)).toEqual(['24', '26'])
+    expect(workflow.jobs.test.with.runner).toBe('ubuntu-24.04-arm')
+    expect(workflow.jobs.test_native_cache['runs-on']).toBe('ubuntu-24.04-arm')
+    expect(sharedTest['runs-on']).toBe('${{ inputs.runner }}')
+    expect(unitTestWorkflow.on.workflow_call.inputs.runner.default).toBe('ubuntu-latest')
+    expect(nodeNextWorkflow.jobs.test.with.runner).toBeUndefined()
+    expect(nodeNextWorkflow.jobs.test_native_cache['runs-on']).toBe('ubuntu-latest')
+    expect(nodeNextWorkflow.jobs.test_native_cache.strategy.matrix.node).toEqual(['24', '26'])
+    const relay = unitTestWorkflow.jobs.relay_integration
+    expect(relay.strategy.matrix.node).toBe('${{ fromJSON(inputs.node_versions) }}')
+    expect(relay['runs-on']).toBe('ubuntu-latest')
+    expect(
+      relay.steps.find((step) => step.uses === './.github/actions/install-node-dependencies').with[
+        'node-version'
+      ]
+    ).toBe('${{ matrix.node }}')
     expect(nodeNextWorkflow.on.schedule).toHaveLength(1)
     expect(nodeNextWorkflow.on.workflow_dispatch).toBeNull()
     expect(sharedTest.strategy.matrix.node).toBe('${{ fromJSON(inputs.node_versions) }}')
-    expect(sharedTest.strategy.matrix.shard).toEqual(
-      Array.from({ length: 8 }, (_, index) => index + 1)
-    )
-    expect(sharedTest.strategy.matrix.shard_total).toEqual([8])
+    expect(sharedTest.strategy.matrix.shard).toBe('${{ fromJSON(inputs.shards) }}')
+    // The shard matrix no longer needs an in-workflow plan job: planning moved to
+    // unit-plan.yml so it can run before the static-analysis gate clears.
+    expect(sharedTest.needs).toBeUndefined()
+    expect(unitTestWorkflow.jobs.plan).toBeUndefined()
+    expect(unitTestWorkflow.on.workflow_call.inputs.shards.required).toBe(true)
     expect(installStep.with['node-version']).toBe('${{ matrix.node }}')
     expect(installStep.with['cache-electron-package']).toBe('true')
-    expect(testStep.run).toContain('--shard=${{ matrix.shard }}/${{ matrix.shard_total }}')
+    expect(testStep.run).toContain('--shard=${{ matrix.shard.index }}/${{ matrix.shard.count }}')
     for (const testFile of nativeShellContractFiles) {
-      expect(testStep.run).toContain(`--exclude=${testFile}`)
+      expect(UNIT_EXCLUDE).toContain(testFile)
     }
     expect(primerInstall.with['native-runtime']).toBe('node')
     expect(primerInstall.with['node-version']).toBe('24')
     expect(workflow.jobs.test.needs).toContain('test_native_cache')
     expect(nodeNextPrimerInstall.with['native-runtime']).toBe('node')
-    expect(nodeNextPrimerInstall.with['node-version']).toBe('26')
-    expect(nodeNextWorkflow.jobs.test.needs).toEqual(['test_native_cache'])
+    expect(nodeNextPrimerInstall.with['node-version']).toBe('${{ matrix.node }}')
+    expect(nodeNextWorkflow.jobs.test.needs).toEqual(['test_native_cache', 'unit_plan'])
   })
 
   it('runs real-shell coverage once outside the general shards', () => {
@@ -252,11 +286,20 @@ describe('PR workflow parallelism', () => {
     expect(steps[pnpmIndex].uses).toBe('pnpm/setup@v2')
     expect(steps[pnpmIndex].with.version).toBeUndefined()
     expect(steps[pnpmIndex].with.install).toBe(false)
-    expect(steps[nodeIndex].with.cache).toBe('pnpm')
+    const saveOutsidePrs = "${{ github.event_name != 'pull_request' && 'pnpm' || '' }}"
+    expect(steps[nodeIndex].with.cache).toBe(saveOutsidePrs)
     expect(steps[nodeIndex].if).toBe("inputs.node-version == ''")
     expect(steps[requestedNodeIndex].if).toBe("inputs.node-version != ''")
     expect(steps[requestedNodeIndex].with['node-version']).toBe('${{ inputs.node-version }}')
-    expect(steps[requestedNodeIndex].with.cache).toBe('pnpm')
+    expect(steps[requestedNodeIndex].with.cache).toBe(saveOutsidePrs)
+    const restoreIndex = steps.findIndex(
+      (step) => step.name === 'Restore pnpm download store without saving'
+    )
+    expect(restoreIndex).toBeGreaterThan(requestedNodeIndex)
+    expect(restoreIndex).toBeLessThan(
+      steps.findIndex((step) => step.name === 'Install dependencies')
+    )
+    expect(steps[restoreIndex].uses).toBe('actions/cache/restore@v5')
   })
 
   it('uses the repository package-manager version for every direct pnpm setup', () => {
@@ -297,9 +340,10 @@ describe('PR workflow parallelism', () => {
       (step) => step.uses === './.github/actions/install-node-dependencies'
     )
 
-    for (const jobName of ['typecheck', 'git_compatibility', 'xterm_patch_sync']) {
+    for (const jobName of ['typecheck', 'git_compatibility']) {
       expect(installFor(jobName).with, jobName).toBeUndefined()
     }
+    expect(installFor('xterm_patch_sync')).toBeUndefined()
     expect(installFor('static_analysis').with['native-runtime']).toBe('node')
     expect(installFor('shell_contracts').with['native-runtime']).toBe('node')
     expect(sharedTestInstall.with['native-runtime']).toBe('node')
@@ -414,7 +458,9 @@ describe('PR workflow parallelism', () => {
     expect(electronCacheResolution.if).toBe(
       "inputs.native-runtime == 'electron' || inputs.cache-electron-package == 'true'"
     )
-    expect(electronCache.if).toBe(electronCacheResolution.if)
+    expect(electronCache.if).toBe(
+      "(github.event_name != 'pull_request' || runner.os != 'Linux') && steps.electron-package-cache.outputs.version != ''"
+    )
     expect(electronCache.uses).toBe('actions/cache@v5')
     expect(electronCache.with.key).toContain('steps.electron-package-cache.outputs.version')
     expect(dependencyAction.inputs['cache-electron-package'].default).toBe('false')
@@ -452,11 +498,26 @@ describe('PR workflow parallelism', () => {
     }
   })
 
+  it('keeps advisory unit-selection evidence off the gate', () => {
+    // It is continue-on-error, so it can never fail a PR. Living inside unit-tests.yml made a
+    // caller's `needs: test` wait for it anyway, holding verify ~36s past the last shard. Pinned
+    // here so it cannot drift back onto the critical path.
+    const evidence = workflow.jobs.unit_selection_evidence
+    expect(evidence.uses).toBe('./.github/workflows/unit-selection-evidence.yml')
+    expect(evidence.needs).toEqual(['test'])
+    expect(workflow.jobs.verify.needs).not.toContain('unit_selection_evidence')
+    expect(unitTestWorkflow.jobs.selection_evidence).toBeUndefined()
+    const evidenceWorkflow = parse(
+      readFileSync('.github/workflows/unit-selection-evidence.yml', 'utf8')
+    )
+    const job = evidenceWorkflow.jobs.selection_evidence
+    expect(job['continue-on-error']).toBe(true)
+  })
+
   it('keeps verify as the aggregate required check', () => {
     expect(workflow.jobs.verify.needs).toEqual([
       'code_paths',
       'static_analysis',
-      'root_directory_guard',
       'typecheck',
       'git_compatibility',
       'codex_index_heal_contract',
@@ -491,9 +552,11 @@ describe('PR workflow parallelism', () => {
     // The bundling tests skip themselves without mobile/node_modules, which is what keeps the
     // sharded `test` job green. Only this env var stops that skip from spreading to the one job
     // that installs them, so a typo here would leave the whole job passing vacuously.
-    const step = workflow.jobs.mobile_web_app.steps.find((entry) =>
-      entry.run?.includes('build-mobile-web-app-bundle.test.mjs')
+    const step = workflow.jobs.mobile_web_app.steps.find(
+      (entry) => entry.name === 'Builder, override census and render checks'
     )
+    expect(step.run).toContain('node config/scripts/run-mobile-web-app-checks.mjs')
+    expect(step.run).not.toContain('--prepare-route-snapshot')
     expect(step.env[MOBILE_WEB_APP_DEPENDENCIES_REQUIRED_ENV]).toBe('1')
   })
 })
diff --git a/config/scripts/profile-state-worker-smoke.mjs b/config/scripts/profile-state-worker-smoke.mjs
new file mode 100644
index 00000000000..81ff1b5eaf1
--- /dev/null
+++ b/config/scripts/profile-state-worker-smoke.mjs
@@ -0,0 +1,156 @@
+import { deepStrictEqual } from 'node:assert'
+import { randomUUID } from 'node:crypto'
+import { build } from 'esbuild'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { Worker } from 'node:worker_threads'
+import { runProcessSync } from './script-child-process.mjs'
+import {
+  ORCAD_PROFILE_PREFLIGHT_FLAG,
+  parseOrcadProfilePreflight
+} from '../../src/shared/orcad-profile-preflight.ts'
+import { ORCAD_BUN_VERSION } from '../../src/shared/orcad-bun-runtime.ts'
+
+async function initializeFixture(directory, databasePath, profileId) {
+  const fixture = join(directory, 'initialize.cjs')
+  await build({
+    stdin: {
+      contents: `import { openProfileStateDatabase } from './src/main/persistence/profile-state/profile-state-database';
+        export function initialize(path, profileId) { openProfileStateDatabase(path, profileId).db.close() }`,
+      resolveDir: resolve(import.meta.dirname, '../..'),
+      sourcefile: 'profile-state-build-fixture.ts'
+    },
+    outfile: fixture,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    logLevel: 'silent'
+  })
+  createRequire(import.meta.url)(fixture).initialize(databasePath, profileId)
+}
+
+function runWorker(entry, workerData, steps, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const worker = new Worker(entry, { workerData, execArgv: [] })
+    let received = 0
+    let failure
+    const stop = (error) => {
+      failure ??= error
+      void worker.terminate().catch((terminationError) => {
+        failure ??= terminationError
+      })
+    }
+    const timer = setTimeout(() => stop(new Error(`${entry} timed out`)), timeoutMs)
+    worker.on('message', (response) => {
+      if (failure) {
+        return
+      }
+      const step = steps[received]
+      if (!step) {
+        stop(new Error(`${entry} sent an unexpected response`))
+        return
+      }
+      try {
+        if (response?.ok === false) {
+          throw new Error(`${entry}: ${response.error?.message ?? response.error}`)
+        }
+        for (const [key, expected] of Object.entries(step.reply)) {
+          deepStrictEqual(response?.[key], expected, `${entry}: unexpected ${key}`)
+        }
+        received++
+        const next = steps[received]
+        if (next) {
+          worker.postMessage(next.request)
+        }
+      } catch (error) {
+        stop(error)
+      }
+    })
+    worker.on('error', (error) => {
+      failure ??= error
+    })
+    worker.once('exit', (code) => {
+      clearTimeout(timer)
+      if (failure || code !== 0 || received !== steps.length) {
+        reject(failure ?? new Error(`${entry} exited before completing its protocol (${code})`))
+      } else {
+        resolve()
+      }
+    })
+  })
+}
+
+/** Exercise the shipped entries and copied state before publishing their content version. */
+export async function smokeProfileStateWorkers(outDir, { timeoutMs = 30_000, runtimePath } = {}) {
+  if (runtimePath) {
+    const nonce = randomUUID()
+    const result = runProcessSync({
+      program: runtimePath,
+      args: [join(outDir, 'orcad.js'), ORCAD_PROFILE_PREFLIGHT_FLAG, nonce],
+      env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1' },
+      timeoutMs,
+      maxOutputBytes: 64 * 1024
+    })
+    if (result.code !== 0 || result.timedOut || result.outputTruncated) {
+      throw new Error(`Packaged profile runtime preflight failed: ${result.stderr}`)
+    }
+    parseOrcadProfilePreflight(result.stdout, nonce, ORCAD_BUN_VERSION)
+    return
+  }
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-worker-smoke-'))
+  const databasePath = join(directory, 'profile.db')
+  const targetPath = join(directory, 'backup.db')
+  const profileId = 'build-smoke'
+  const payload = JSON.stringify({ theme: 'dark', witness: 'saved \ud800 \u{1f419}' })
+  try {
+    await initializeFixture(directory, databasePath, profileId)
+    await runWorker(
+      join(outDir, 'profile-state-writer-worker-entry.js'),
+      { databasePath, profileId, revision: 0 },
+      [
+        { reply: { id: 0, ok: true, revision: 0 } },
+        {
+          request: {
+            id: 1,
+            command: 'write-complete',
+            replacements: [{ domain: 'settings', payload }]
+          },
+          reply: { id: 1, ok: true, revision: 1 }
+        },
+        {
+          request: { id: 2, command: 'close' },
+          reply: { id: 2, ok: true, revision: 1 }
+        }
+      ],
+      timeoutMs
+    )
+    await runWorker(
+      join(outDir, 'profile-state-backup-worker-entry.js'),
+      { databasePath, profileId, targetPath },
+      [{ reply: { ok: true } }],
+      timeoutMs
+    )
+    const { DatabaseSync } = process.getBuiltinModule('node:sqlite')
+    const database = new DatabaseSync(targetPath, { readOnly: true })
+    try {
+      deepStrictEqual(database.prepare('PRAGMA quick_check').get()['quick_check'], 'ok')
+      deepStrictEqual(
+        database
+          .prepare("SELECT payload FROM profile_state_documents WHERE domain = 'settings'")
+          .get()?.payload,
+        payload
+      )
+      deepStrictEqual(
+        database.prepare("SELECT value FROM profile_state_meta WHERE key = 'revision'").get()
+          ?.value,
+        '1'
+      )
+    } finally {
+      database.close()
+    }
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+}
diff --git a/config/scripts/profile-state-worker-smoke.test.mjs b/config/scripts/profile-state-worker-smoke.test.mjs
new file mode 100644
index 00000000000..06f45e9fd6d
--- /dev/null
+++ b/config/scripts/profile-state-worker-smoke.test.mjs
@@ -0,0 +1,91 @@
+import { build } from 'esbuild'
+import { copyFileSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { smokeProfileStateWorkers } from './profile-state-worker-smoke.mjs'
+
+const directories = []
+const writerFilename = 'profile-state-writer-worker-entry.js'
+const backupFilename = 'profile-state-backup-worker-entry.js'
+let builtDirectory
+
+function fixtureDirectory() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-worker-build-test-'))
+  directories.push(directory)
+  return directory
+}
+
+beforeAll(async () => {
+  builtDirectory = fixtureDirectory()
+  await Promise.all(
+    ['writer', 'backup'].map((role) =>
+      build({
+        entryPoints: [
+          resolve(`src/main/persistence/profile-state/profile-state-${role}-worker-entry.ts`)
+        ],
+        outfile: join(builtDirectory, `profile-state-${role}-worker-entry.js`),
+        bundle: true,
+        platform: 'node',
+        target: 'node18',
+        format: 'cjs',
+        logLevel: 'silent'
+      })
+    )
+  )
+})
+
+afterAll(() => {
+  for (const directory of directories) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+describe('profile state build smoke', () => {
+  it('writes through the built writer and verifies the built backup after handle release', async () => {
+    await expect(smokeProfileStateWorkers(builtDirectory)).resolves.toBeUndefined()
+  })
+
+  it('rejects a worker that exits without completing its protocol', async () => {
+    const directory = fixtureDirectory()
+    writeFileSync(join(directory, writerFilename), 'process.exit(0)\n')
+    await expect(smokeProfileStateWorkers(directory)).rejects.toThrow('before completing')
+  })
+
+  it('rejects a mismatched startup revision', async () => {
+    const directory = fixtureDirectory()
+    writeFileSync(
+      join(directory, writerFilename),
+      `const { parentPort } = require('node:worker_threads')
+      parentPort.postMessage({ id: 0, ok: true, revision: 7 })
+      parentPort.close()`
+    )
+    await expect(smokeProfileStateWorkers(directory)).rejects.toThrow('unexpected revision')
+  })
+
+  it('does not accept a close acknowledgement from a worker that remains alive', async () => {
+    const directory = fixtureDirectory()
+    writeFileSync(
+      join(directory, writerFilename),
+      `const { parentPort } = require('node:worker_threads')
+      parentPort.postMessage({ id: 0, ok: true, revision: 0 })
+      parentPort.on('message', ({ id }) => parentPort.postMessage({ id, ok: true, revision: 1 }))
+      setInterval(() => {}, 1000)`
+    )
+    await expect(smokeProfileStateWorkers(directory, { timeoutMs: 2_000 })).rejects.toThrow(
+      'timed out'
+    )
+  })
+
+  it('does not accept a successful backup response without the copied database', async () => {
+    const directory = fixtureDirectory()
+    copyFileSync(join(builtDirectory, writerFilename), join(directory, writerFilename))
+    writeFileSync(
+      join(directory, backupFilename),
+      `const { parentPort } = require('node:worker_threads')
+      parentPort.postMessage({ ok: true })
+      parentPort.close()`
+    )
+    await expect(smokeProfileStateWorkers(directory)).rejects.toThrow()
+  })
+})
diff --git a/config/scripts/pullfrog-review-scope.cjs b/config/scripts/pullfrog-review-scope.cjs
new file mode 100644
index 00000000000..5168d5bd7ef
--- /dev/null
+++ b/config/scripts/pullfrog-review-scope.cjs
@@ -0,0 +1,64 @@
+function reviewNumber(inputs) {
+  if (/^[1-9]\d*$/.test(inputs.pull_request_number ?? '')) {
+    return Number(inputs.pull_request_number)
+  }
+  const match =
+    / \| PR ([1-9]\d*)$/.exec(inputs.name ?? '') ??
+    /^Review (?:new commits on )?#([1-9]\d*) \[[\w-]+\]$/.exec(inputs.name ?? '')
+  return match ? Number(match[1]) : null
+}
+
+function reviewRunOrder(runs, number, runId) {
+  const related = runs.filter((run) => reviewNumber({ name: run.display_title }) === number)
+  return {
+    superseded: related.some((run) => run.id > runId),
+    older: related
+      .filter(
+        (run) =>
+          run.id < runId &&
+          ['queued', 'in_progress', 'waiting', 'pending', 'requested'].includes(run.status)
+      )
+      .map((run) => run.id)
+  }
+}
+
+async function reviewScope({ github, context, core }) {
+  const inputs = context.payload.inputs ?? {}
+  const number = reviewNumber(inputs)
+  core.setOutput('current', 'true')
+  if (!number || !Number.isSafeInteger(number)) {
+    return
+  }
+  try {
+    const { data: pr } = await github.rest.pulls.get({ ...context.repo, pull_number: number })
+    if (pr.state !== 'open' || (inputs.head_sha && inputs.head_sha !== pr.head.sha)) {
+      core.setOutput('current', 'false')
+      return
+    }
+    core.setOutput('head', pr.head.sha)
+    core.setOutput('number', String(number))
+    const { data } = await github.rest.actions.listWorkflowRuns({
+      ...context.repo,
+      workflow_id: 'pullfrog.yml',
+      event: 'workflow_dispatch',
+      per_page: 100
+    })
+    const order = reviewRunOrder(data.workflow_runs, number, context.runId)
+    if (order.superseded) {
+      core.setOutput('current', 'false')
+      return
+    }
+    // Run IDs, unlike scope-job completion order, cannot let an older review cancel a newer one.
+    for (const runId of order.older) {
+      try {
+        await github.rest.actions.cancelWorkflowRun({ ...context.repo, run_id: runId })
+      } catch (error) {
+        core.warning(`Could not cancel older review ${runId}: ${error.message}`)
+      }
+    }
+  } catch (error) {
+    core.warning(`Review identity unavailable; leaving this task independent: ${error.message}`)
+  }
+}
+
+module.exports = { reviewNumber, reviewRunOrder, reviewScope }
diff --git a/config/scripts/pullfrog-review-scope.test.mjs b/config/scripts/pullfrog-review-scope.test.mjs
new file mode 100644
index 00000000000..2a3f902da87
--- /dev/null
+++ b/config/scripts/pullfrog-review-scope.test.mjs
@@ -0,0 +1,109 @@
+import { expect, it, vi } from 'vitest'
+import scope from './pullfrog-review-scope.cjs'
+
+it('groups a current review by PR while leaving other agent tasks independent', async () => {
+  const get = vi.fn(async () => ({ data: { state: 'open', head: { sha: 'current' } } }))
+  const core = { setOutput: vi.fn(), warning: vi.fn() }
+  const context = {
+    repo: { owner: 'stablyai', repo: 'orca' },
+    runId: 7,
+    payload: { inputs: { name: 'Review #42 [abc]' } }
+  }
+  const github = {
+    rest: {
+      pulls: { get },
+      actions: { listWorkflowRuns: async () => ({ data: { workflow_runs: [] } }) }
+    }
+  }
+  await scope.reviewScope({ core, context, github })
+  expect(get).toHaveBeenCalledWith({ owner: 'stablyai', repo: 'orca', pull_number: 42 })
+  expect(core.setOutput).toHaveBeenCalledWith('head', 'current')
+  get.mockClear()
+  await scope.reviewScope({
+    core,
+    github,
+    context: { ...context, payload: { inputs: { name: 'Investigate #42' } } }
+  })
+  expect(get).not.toHaveBeenCalled()
+  expect(core.setOutput).toHaveBeenLastCalledWith('current', 'true')
+})
+
+it('coalesces only explicit or recognized PR review identities', () => {
+  expect(scope.reviewNumber({ name: 'Review #23532 [85jpk]' })).toBe(23532)
+  expect(scope.reviewNumber({ name: 'Review new commits on #22727 [24lpq]' })).toBe(22727)
+  expect(scope.reviewNumber({ pull_request_number: '123' })).toBe(123)
+  for (const name of ['Fix #123', 'Review #12; echo test', 'Review #123', '', 'Review #0 [abc]']) {
+    expect(scope.reviewNumber({ name })).toBeNull()
+  }
+})
+
+it('skips closed or explicitly stale reviews and tolerates lookup failure', async () => {
+  for (const data of [
+    { state: 'closed', head: { sha: 'a' } },
+    { state: 'open', head: { sha: 'b' } }
+  ]) {
+    const core = { setOutput: vi.fn(), warning: vi.fn() }
+    await scope.reviewScope({
+      core,
+      context: {
+        repo: {},
+        runId: 1,
+        payload: { inputs: { pull_request_number: '1', head_sha: 'a' } }
+      },
+      github: { rest: { pulls: { get: async () => ({ data }) } } }
+    })
+    expect(core.setOutput).toHaveBeenCalledWith('current', 'false')
+  }
+  const core = { setOutput: vi.fn(), warning: vi.fn() }
+  await scope.reviewScope({
+    core,
+    context: { repo: {}, runId: 2, payload: { inputs: { pull_request_number: '1' } } },
+    github: {
+      rest: {
+        pulls: {
+          get: async () => {
+            throw new Error('offline')
+          }
+        }
+      }
+    }
+  })
+  expect(core.setOutput).toHaveBeenCalledWith('current', 'true')
+  expect(core.warning).toHaveBeenCalled()
+})
+
+it('a delayed older scope cannot cancel or replace a newer review', async () => {
+  const runs = [
+    { id: 6, display_title: 'Review #42 [a]', status: 'in_progress' },
+    { id: 8, display_title: 'Custom review | PR 42', status: 'queued' },
+    { id: 5, display_title: 'Investigate #42', status: 'in_progress' },
+    { id: 4, display_title: 'Review #43 [other]', status: 'in_progress' }
+  ]
+  for (const runId of [7, 9]) {
+    const cancelWorkflowRun = vi.fn(async () => ({}))
+    const core = { setOutput: vi.fn(), warning: vi.fn() }
+    await scope.reviewScope({
+      context: {
+        repo: { owner: 'stablyai', repo: 'orca' },
+        runId,
+        payload: { inputs: { name: 'Review #42 [current]' } }
+      },
+      core,
+      github: {
+        rest: {
+          pulls: { get: async () => ({ data: { state: 'open', head: { sha: 'head' } } }) },
+          actions: {
+            listWorkflowRuns: async () => ({ data: { workflow_runs: runs } }),
+            cancelWorkflowRun
+          }
+        }
+      }
+    })
+    if (runId === 7) {
+      expect(cancelWorkflowRun).not.toHaveBeenCalled()
+      expect(core.setOutput).toHaveBeenCalledWith('current', 'false')
+    } else {
+      expect(cancelWorkflowRun.mock.calls.map(([args]) => args.run_id)).toEqual([6, 8])
+    }
+  }
+})
diff --git a/config/scripts/rebuild-native-deps-test-fixtures.mjs b/config/scripts/rebuild-native-deps-test-fixtures.mjs
index 7a5eb182212..333c8f939ef 100644
--- a/config/scripts/rebuild-native-deps-test-fixtures.mjs
+++ b/config/scripts/rebuild-native-deps-test-fixtures.mjs
@@ -439,7 +439,7 @@ export function writeFakeWindowsProcessTree(projectDir) {
   mkdirSync(processTreeDir, { recursive: true })
   writeFileSync(
     join(processTreeDir, 'index.js'),
-    `module.exports = { supportedProcessDataFlags: ${CREATION_TIME_FLAG} }\n`
+    `module.exports = { supportedProcessDataFlags: ${CREATION_TIME_FLAG}, getProcessCreationTime: () => undefined }\n`
   )
 }
 
@@ -480,19 +480,29 @@ export function writeFakeWindowsProcessTreeWithNodeAddonApi(
     join(processTreeDir, 'src', 'process_worker.cc'),
     creationTimePatchApplied ? 'object.Set("creationTimeMs", process.creationTimeMs);\n' : '\n'
   )
+  writeFileSync(
+    join(processTreeDir, 'src', 'addon.cc'),
+    creationTimePatchApplied ? 'exports.Set("getProcessCreationTime", getter);\n' : '\n'
+  )
   mkdirSync(join(processTreeDir, 'lib'), { recursive: true })
   writeFileSync(
     join(processTreeDir, 'lib', 'index.js'),
-    creationTimePatchApplied ? 'exports.ProcessDataFlag["CreationTime"] = 4;\n' : '\n'
+    creationTimePatchApplied
+      ? 'exports.ProcessDataFlag["CreationTime"] = 4;\nexports.getProcessCreationTime = getter;\n'
+      : '\n'
   )
   writeFileSync(
     join(processTreeDir, 'lib', 'index.ts'),
-    creationTimePatchApplied ? 'export enum ProcessDataFlag { CreationTime = 4 }\n' : '\n'
+    creationTimePatchApplied
+      ? 'export enum ProcessDataFlag { CreationTime = 4 }\nexport const getProcessCreationTime = getter;\n'
+      : '\n'
   )
   mkdirSync(join(processTreeDir, 'typings'), { recursive: true })
   writeFileSync(
     join(processTreeDir, 'typings', 'windows-process-tree.d.ts'),
-    creationTimePatchApplied ? 'creationTimeMs?: number\n' : '\n'
+    creationTimePatchApplied
+      ? 'creationTimeMs?: number\nexport const getProcessCreationTime: Function;\n'
+      : '\n'
   )
   writeFileSync(join(nodeAddonApiDir, 'package.json'), '{"name":"node-addon-api"}\n')
   writeFileSync(join(nodeAddonApiDir, 'napi.h'), '// napi.h\n')
diff --git a/config/scripts/regenerate-xterm-patches.mjs b/config/scripts/regenerate-xterm-patches.mjs
index 672be8bee61..c67c6eb6622 100644
--- a/config/scripts/regenerate-xterm-patches.mjs
+++ b/config/scripts/regenerate-xterm-patches.mjs
@@ -236,6 +236,7 @@ function ensureDependencies(upstreamRoot, manifest) {
   const stamp = path.join(upstreamRoot, 'node_modules', '.orca-xterm-install-stamp')
   const want = `${manifest.upstream.commit}\n${statSync(lockfile).size}\n`
   if (existsSync(stamp) && readFileSync(stamp, 'utf8') === want) {
+    assertToolchain(upstreamRoot, manifest)
     return
   }
   run('npm', ['ci'], {
diff --git a/config/scripts/regenerate-xterm-patches.test.mjs b/config/scripts/regenerate-xterm-patches.test.mjs
index 5261d0c74cd..0d1329043de 100644
--- a/config/scripts/regenerate-xterm-patches.test.mjs
+++ b/config/scripts/regenerate-xterm-patches.test.mjs
@@ -98,26 +98,6 @@ const PATCHED = {
 }
 
 describe('pnpm diff format', () => {
-  it('keeps the exact git flags pnpm uses, so patches survive `pnpm patch-commit`', () => {
-    expect(PNPM_DIFF_FLAGS).toEqual([
-      '-c',
-      'core.safecrlf=false',
-      '-c',
-      'core.quotePath=false',
-      'diff',
-      '--src-prefix=a/',
-      '--dst-prefix=b/',
-      '--ignore-cr-at-eol',
-      '--irreversible-delete',
-      '--full-index',
-      '--no-index',
-      '--text',
-      '--no-ext-diff',
-      '--no-color',
-      '--'
-    ])
-  })
-
   it('matches pnpm git config isolation', () => {
     const environment = pnpmDiffEnvironment({ PATH: '/usr/bin', HOME: '/Users/someone' })
     expect(environment).toMatchObject({
diff --git a/config/scripts/relay-artifact-manifest.test.mjs b/config/scripts/relay-artifact-manifest.test.mjs
index 2796a361778..5f66ee7136f 100644
--- a/config/scripts/relay-artifact-manifest.test.mjs
+++ b/config/scripts/relay-artifact-manifest.test.mjs
@@ -5,7 +5,15 @@
 // and never forks.
 import { execFileSync } from 'node:child_process'
 import { createHash } from 'node:crypto'
-import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync } from 'node:fs'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join, resolve } from 'node:path'
 import { afterAll, beforeAll, describe, expect, it } from 'vitest'
@@ -13,7 +21,8 @@ import {
   RELAY_BUILD_PLATFORMS,
   RELAY_VERSION_FILENAME,
   isWindowsRelayPlatform,
-  relayArtifactFilenames
+  relayArtifactFilenames,
+  relayOptionalArtifactFilenames
 } from '../../src/shared/relay-artifacts.ts'
 
 const projectDir = resolve(import.meta.dirname, '../..')
@@ -22,6 +31,12 @@ const projectDir = resolve(import.meta.dirname, '../..')
 const relayOutDir = mkdtempSync(join(tmpdir(), 'orca-relay-contract-'))
 
 beforeAll(() => {
+  // A repeated build must not copy stale companions into the other platform bundles.
+  for (const platform of RELAY_BUILD_PLATFORMS) {
+    const outDir = join(relayOutDir, platform)
+    mkdirSync(outDir, { recursive: true })
+    writeFileSync(join(outDir, 'stale-companion.js'), 'throw new Error("stale")')
+  }
   execFileSync('node', [join(projectDir, 'config', 'scripts', 'build-relay.mjs')], {
     cwd: projectDir,
     stdio: 'pipe',
@@ -46,13 +61,22 @@ describe('packaged relay artifact manifest', () => {
     const emitted = readdirSync(outDir)
       .filter((name) => name !== RELAY_VERSION_FILENAME)
       .sort()
-    expect(emitted).toEqual([...expected].sort())
+    const optional = relayOptionalArtifactFilenames(isWindowsRelayPlatform(platform)).filter(
+      (filename) => existsSync(join(outDir, filename))
+    )
+    expect(emitted).toEqual([...expected, ...optional].sort())
   })
 
   it.each([...RELAY_BUILD_PLATFORMS])('hashes every declared artifact for %s', (platform) => {
     const outDir = join(relayOutDir, platform)
     const hash = createHash('sha256')
-    for (const filename of relayArtifactFilenames(isWindowsRelayPlatform(platform))) {
+    const artifacts = [
+      ...relayArtifactFilenames(isWindowsRelayPlatform(platform)),
+      ...relayOptionalArtifactFilenames(isWindowsRelayPlatform(platform)).filter((filename) =>
+        existsSync(join(outDir, filename))
+      )
+    ]
+    for (const filename of artifacts) {
       hash.update(readFileSync(join(outDir, filename)))
     }
     const version = readFileSync(join(outDir, RELAY_VERSION_FILENAME), 'utf8')
diff --git a/config/scripts/release-e2e-dispatch-contract.test.mjs b/config/scripts/release-e2e-dispatch-contract.test.mjs
index 4590e8bc136..2277cd399a4 100644
--- a/config/scripts/release-e2e-dispatch-contract.test.mjs
+++ b/config/scripts/release-e2e-dispatch-contract.test.mjs
@@ -53,7 +53,6 @@ describe('release E2E dispatch contract', () => {
     expect(buildStep.run).toContain('pnpm run build:relay &')
     expect(buildStep.run).toContain('relay_pid=$!')
     expect(buildStep.run).toContain('wait "$relay_pid"')
-    expect(buildStep.run).toContain('pnpm run build:web-from-renderer')
   })
 
   it('primes the Electron native cache before every E2E consumer', () => {
@@ -72,12 +71,29 @@ describe('release E2E dispatch contract', () => {
   it('includes the paired-runtime web client in the shared E2E build artifact', () => {
     const buildStep = e2eWorkflow.jobs.build.steps.find((step) => step.name === 'Build E2E outputs')
 
-    expect(buildStep.run).toContain('electron-vite build --mode e2e')
+    expect(buildStep.run).toContain('pnpm run build:electron-vite:parallel --mode e2e')
     expect(buildStep.env.VITE_EXPOSE_STORE).toBe('true')
-    expect(buildStep.run).toContain('pnpm run build:web-from-renderer')
     expect(buildStep.run).toContain('pnpm run build:relay')
   })
 
+  it('joins the shared CLI and web builds before uploading complete E2E output', () => {
+    const steps = e2eWorkflow.jobs.build.steps
+    const electron = steps.findIndex((step) => step.name === 'Build E2E outputs')
+    const cli = steps.findIndex((step) => step.id === 'e2e-cli')
+    const web = steps.findIndex((step) => step.name === 'Project shared E2E web client')
+    const join = steps.findIndex((step) => step.wait === 'e2e-cli')
+    const upload = steps.findIndex((step) => step.name === 'Upload E2E build output')
+    expect(cli).toBeGreaterThan(electron)
+    expect(steps[cli].background).toBe(true)
+    expect(steps[cli].run).toContain('pnpm run build:cli')
+    expect(steps[cli].run).toContain('scripts["prepare:cli-output"]')
+    expect(web).toBeGreaterThan(cli)
+    expect(steps[web].run).toBe('pnpm run build:web-from-renderer')
+    expect(join).toBeGreaterThan(web)
+    expect(upload).toBeGreaterThan(join)
+    expect(steps[upload].with.path).toBe('out/')
+  })
+
   it('hands the built relay artifact to every E2E run command', () => {
     const uploadStep = e2eWorkflow.jobs.build.steps.find(
       (step) => step.name === 'Upload E2E build output'
diff --git a/config/scripts/release-policy.mjs b/config/scripts/release-policy.mjs
new file mode 100644
index 00000000000..4733e79f2b4
--- /dev/null
+++ b/config/scripts/release-policy.mjs
@@ -0,0 +1,138 @@
+// Enforced by .github/workflows/release-policy.yml on release events.
+
+const BOT_LOGIN = 'github-actions[bot]'
+const BOT_EMAIL = '41898282+github-actions[bot]@users.noreply.github.com'
+const NUMBER = '(?:0|[1-9][0-9]*)'
+const VERSION = `${NUMBER}\\.${NUMBER}\\.${NUMBER}`
+const STABLE_TAG = new RegExp(`^v${VERSION}$`)
+const RC_TAG = new RegExp(`^v${VERSION}-rc\\.${NUMBER}(?:\\.[0-9A-Za-z]+)?$`)
+const MOBILE_TAG = new RegExp(`^mobile(?:-android)?-v${VERSION}$`)
+
+export function isPrereleaseTag(tag) {
+  return RC_TAG.test(tag) || MOBILE_TAG.test(tag)
+}
+
+export function compareStableTags(left, right) {
+  const a = left.slice(1).split('.').map(Number)
+  const b = right.slice(1).split('.').map(Number)
+  return a.reduce((result, part, index) => result || part - b[index], 0)
+}
+
+function escapeRegExp(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+// Why: Cut Release creates the annotated tag and its `release: vX` commit, but the
+// release object keeps whoever created the draft first, which can be a person.
+export async function isCutByReleasePipeline(github, { owner, repo }, tag) {
+  if (!STABLE_TAG.test(tag) && !RC_TAG.test(tag)) {
+    return false
+  }
+  let ref
+  try {
+    ;({ data: ref } = await github.rest.git.getRef({ owner, repo, ref: `tags/${tag}` }))
+  } catch (error) {
+    if (error.status === 404) {
+      return false
+    }
+    throw error
+  }
+  if (ref.object.type !== 'tag') {
+    return false
+  }
+  const { data: tagObject } = await github.rest.git.getTag({
+    owner,
+    repo,
+    tag_sha: ref.object.sha
+  })
+  if (tagObject.tagger?.email !== BOT_EMAIL || tagObject.object.type !== 'commit') {
+    return false
+  }
+  const { data: commit } = await github.rest.git.getCommit({
+    owner,
+    repo,
+    commit_sha: tagObject.object.sha
+  })
+  const subject = commit.message.split('\n')[0]
+  return new RegExp(`^release: ${escapeRegExp(tag)}(?: \\[rc-slot:[^\\]]+\\])?$`).test(subject)
+}
+
+async function isAuthorizedRelease(github, repoRef, release) {
+  const tag = release.tag_name
+  if (!STABLE_TAG.test(tag) && !isPrereleaseTag(tag)) {
+    return false
+  }
+  return release.author?.login === BOT_LOGIN || isCutByReleasePipeline(github, repoRef, tag)
+}
+
+// Why: the highest authorized stable release must be Latest; GitHub's own pick
+// (and the old bot-author-only filter) can move it to an older version.
+export async function restoreLatestStable(github, repoRef) {
+  const releases = await github.paginate(github.rest.repos.listReleases, {
+    ...repoRef,
+    per_page: 100
+  })
+  const candidates = releases
+    .filter((release) => !release.draft && !release.prerelease && STABLE_TAG.test(release.tag_name))
+    .sort((left, right) => compareStableTags(right.tag_name, left.tag_name))
+  for (const release of candidates) {
+    if (!(await isAuthorizedRelease(github, repoRef, release))) {
+      continue
+    }
+    await github.rest.repos.updateRelease({
+      ...repoRef,
+      release_id: release.id,
+      make_latest: 'true'
+    })
+    return release.tag_name
+  }
+  return null
+}
+
+export async function enforceReleasePolicy({ github, context, core }) {
+  const { release, action } = context.payload
+  const tag = release.tag_name
+  const author = release.author?.login
+  const repoRef = context.repo
+  const expectedPrerelease = isPrereleaseTag(tag)
+
+  if (await isAuthorizedRelease(github, repoRef, release)) {
+    if (release.prerelease !== expectedPrerelease) {
+      await github.rest.repos.updateRelease({
+        ...repoRef,
+        release_id: release.id,
+        prerelease: expectedPrerelease,
+        make_latest: expectedPrerelease ? 'false' : 'legacy'
+      })
+    }
+    await restoreLatestStable(github, repoRef)
+    return
+  }
+
+  // Why: editing notes on a live release is not a publication; deleting on edit
+  // took down the v1.4.216 release and its tag.
+  if (action !== 'published') {
+    core.warning(
+      `Release ${tag} by ${author || 'unknown'} is outside release policy; left as-is on "${action}".`
+    )
+    return
+  }
+
+  await github.rest.repos.updateRelease({
+    ...repoRef,
+    release_id: release.id,
+    draft: true,
+    prerelease: true,
+    make_latest: 'false'
+  })
+  await restoreLatestStable(github, repoRef)
+  await github.rest.repos.deleteRelease({ ...repoRef, release_id: release.id })
+  try {
+    await github.rest.git.deleteRef({ ...repoRef, ref: `tags/${tag}` })
+  } catch (error) {
+    if (error.status !== 404) {
+      throw error
+    }
+  }
+  core.warning(`Deleted unauthorized release ${tag} created by ${author || 'unknown'}.`)
+}
diff --git a/config/scripts/release-policy.test.mjs b/config/scripts/release-policy.test.mjs
new file mode 100644
index 00000000000..6478f6bb0c4
--- /dev/null
+++ b/config/scripts/release-policy.test.mjs
@@ -0,0 +1,150 @@
+import { describe, expect, it, vi } from 'vitest'
+import { enforceReleasePolicy, restoreLatestStable } from './release-policy.mjs'
+
+const BOT_EMAIL = '41898282+github-actions[bot]@users.noreply.github.com'
+const repoRef = { owner: 'stablyai', repo: 'orca' }
+
+function notFound() {
+  return Object.assign(new Error('Not Found'), { status: 404 })
+}
+
+// tags: { [tag]: { tagger, subject } } for annotated tags; missing tags 404.
+function createGithub({ releases = [], tags = {} } = {}) {
+  const rest = {
+    repos: {
+      listReleases: vi.fn(),
+      updateRelease: vi.fn(async () => ({ data: {} })),
+      deleteRelease: vi.fn(async () => ({ data: {} }))
+    },
+    git: {
+      getRef: vi.fn(async ({ ref }) => {
+        const tag = ref.replace(/^tags\//, '')
+        if (!tags[tag]) {
+          throw notFound()
+        }
+        return { data: { object: { type: 'tag', sha: `tag-${tag}` } } }
+      }),
+      getTag: vi.fn(async ({ tag_sha }) => {
+        const tag = tag_sha.replace(/^tag-/, '')
+        return {
+          data: {
+            tagger: { email: tags[tag].tagger ?? BOT_EMAIL },
+            object: { type: 'commit', sha: `commit-${tag}` }
+          }
+        }
+      }),
+      getCommit: vi.fn(async ({ commit_sha }) => {
+        const tag = commit_sha.replace(/^commit-/, '')
+        return { data: { message: `${tags[tag].subject ?? `release: ${tag}`}\n` } }
+      }),
+      deleteRef: vi.fn(async () => ({ data: {} }))
+    }
+  }
+  return { rest, paginate: vi.fn(async () => releases) }
+}
+
+function release(tag, author, overrides = {}) {
+  return {
+    id: Number(tag.replace(/\D/g, '')),
+    tag_name: tag,
+    author: { login: author },
+    draft: false,
+    prerelease: false,
+    ...overrides
+  }
+}
+
+function run(github, payloadRelease, action) {
+  const core = { warning: vi.fn() }
+  const context = { payload: { release: payloadRelease, action }, repo: repoRef }
+  return enforceReleasePolicy({ github, context, core }).then(() => core)
+}
+
+describe('release policy', () => {
+  it('keeps a pipeline-cut release whose draft a person created', async () => {
+    const r216 = release('v1.4.216', 'Jinwoo-H')
+    const github = createGithub({
+      releases: [r216, release('v1.4.214', 'github-actions[bot]')],
+      tags: { 'v1.4.216': {}, 'v1.4.214': {} }
+    })
+
+    await run(github, r216, 'edited')
+
+    expect(github.rest.repos.deleteRelease).not.toHaveBeenCalled()
+    expect(github.rest.git.deleteRef).not.toHaveBeenCalled()
+    expect(github.rest.repos.updateRelease).toHaveBeenCalledWith({
+      ...repoRef,
+      release_id: r216.id,
+      make_latest: 'true'
+    })
+  })
+
+  it('never deletes an unauthorized release on edit', async () => {
+    const qa = release('v1.4.300', 'someone')
+    const github = createGithub({ releases: [qa] })
+
+    const core = await run(github, qa, 'edited')
+
+    expect(github.rest.repos.deleteRelease).not.toHaveBeenCalled()
+    expect(github.rest.git.deleteRef).not.toHaveBeenCalled()
+    expect(core.warning).toHaveBeenCalledWith(expect.stringContaining('left as-is'))
+  })
+
+  it('deletes a published release whose tag was not cut by the pipeline', async () => {
+    const qa = release('v1.4.300', 'someone')
+    const github = createGithub({
+      releases: [qa, release('v1.4.215', 'nwparker')],
+      tags: { 'v1.4.300': { tagger: 'someone@example.com' }, 'v1.4.215': {} }
+    })
+
+    await run(github, qa, 'published')
+
+    expect(github.rest.repos.deleteRelease).toHaveBeenCalledWith({ ...repoRef, release_id: qa.id })
+    expect(github.rest.git.deleteRef).toHaveBeenCalledWith({ ...repoRef, ref: 'tags/v1.4.300' })
+  })
+
+  it('rejects a bot-tagged tag whose commit is not a release commit', async () => {
+    const qa = release('v1.4.300', 'someone')
+    const github = createGithub({ tags: { 'v1.4.300': { subject: 'fix: something' } } })
+
+    await run(github, qa, 'published')
+
+    expect(github.rest.repos.deleteRelease).toHaveBeenCalled()
+  })
+
+  it('accepts scheduled RC release commits', async () => {
+    const rc = release('v1.4.217-rc.1', 'someone', { prerelease: true })
+    const github = createGithub({
+      tags: { 'v1.4.217-rc.1': { subject: 'release: v1.4.217-rc.1 [rc-slot:2026-09-28-15]' } }
+    })
+
+    await run(github, rc, 'published')
+
+    expect(github.rest.repos.deleteRelease).not.toHaveBeenCalled()
+  })
+
+  it('restores Latest to the highest pipeline-cut stable, not only bot-authored ones', async () => {
+    const github = createGithub({
+      releases: [
+        release('v1.4.214', 'github-actions[bot]'),
+        release('v1.4.215', 'nwparker'),
+        release('v1.4.216-rc.0', 'github-actions[bot]', { prerelease: true })
+      ],
+      tags: { 'v1.4.214': {}, 'v1.4.215': {} }
+    })
+
+    await expect(restoreLatestStable(github, repoRef)).resolves.toBe('v1.4.215')
+    expect(github.rest.repos.updateRelease).toHaveBeenCalledTimes(1)
+  })
+
+  it('compares versions numerically when picking Latest', async () => {
+    const github = createGithub({
+      releases: [
+        release('v1.4.99', 'github-actions[bot]'),
+        release('v1.4.100', 'github-actions[bot]')
+      ]
+    })
+
+    await expect(restoreLatestStable(github, repoRef)).resolves.toBe('v1.4.100')
+  })
+})
diff --git a/config/scripts/replace-cached-nsis-elevate.test.mjs b/config/scripts/replace-cached-nsis-elevate.test.mjs
index a88461703c3..ffdcc0b4b5b 100644
--- a/config/scripts/replace-cached-nsis-elevate.test.mjs
+++ b/config/scripts/replace-cached-nsis-elevate.test.mjs
@@ -357,8 +357,7 @@ describe('release-cut.yml swaps the cached elevate.exe through the resolver', ()
     expect(step.run).toContain("$subject -notlike '*CN=SignPath Foundation*'")
   })
 
-  // The inner-signing chain stays fail-open: a loud red step, not an unbuildable release.
-  it('keeps the step unable to fail the release job', () => {
-    expect(swapStep()['continue-on-error']).toBe(true)
+  it('blocks the release when the cache swap fails', () => {
+    expect(swapStep()['continue-on-error']).toBeUndefined()
   })
 })
diff --git a/config/scripts/run-bun-profile-tests.mjs b/config/scripts/run-bun-profile-tests.mjs
new file mode 100644
index 00000000000..debd895675b
--- /dev/null
+++ b/config/scripts/run-bun-profile-tests.mjs
@@ -0,0 +1,74 @@
+import { join, resolve } from 'node:path'
+import { randomUUID } from 'node:crypto'
+import { readFileSync } from 'node:fs'
+import {
+  ORCAD_VERSION_FILENAME,
+  orcadBunRuntimeFilename
+} from '../../src/shared/orcad-artifacts.ts'
+import { ORCAD_BUN_VERSION } from '../../src/shared/orcad-bun-runtime.ts'
+import {
+  ORCAD_PROFILE_PREFLIGHT_FLAG,
+  parseOrcadProfilePreflight
+} from '../../src/shared/orcad-profile-preflight.ts'
+import { currentTarget } from './build-orcad-bun.mjs'
+import { runProcessSync } from './script-child-process.mjs'
+import { bunProfileTestPaths } from './bun-profile-test-paths.mjs'
+
+const root = resolve(import.meta.dirname, '../..')
+const target = currentTarget()
+const artifact = process.argv.includes('--artifact')
+const testArgs = process.argv.slice(2).filter((arg) => arg !== '--artifact')
+const runtimeDir = artifact
+  ? join(root, 'out', 'orcad')
+  : join(root, 'out', '.bun-profile-test-runtime', target)
+const runtimePath = join(runtimeDir, orcadBunRuntimeFilename(target))
+const env = { ...process.env, ORCA_BACKGROUND_LAUNCH: '1', BUN_EXECUTABLE: runtimePath }
+
+function run(program, args) {
+  const result = runProcessSync({
+    program,
+    args,
+    cwd: root,
+    env,
+    stdio: 'inherit',
+    timeoutMs: null
+  })
+  if (result.code !== 0) {
+    process.exit(result.code ?? 1)
+  }
+}
+
+if (artifact) {
+  const nonce = randomUUID()
+  const result = runProcessSync({
+    program: runtimePath,
+    args: [join(runtimeDir, 'orcad.js'), ORCAD_PROFILE_PREFLIGHT_FLAG, nonce],
+    cwd: root,
+    env,
+    timeoutMs: 90_000
+  })
+  if (result.code !== 0 || result.timedOut || result.outputTruncated) {
+    throw new Error(`Bundled runtime readiness failed: ${result.stderr}`)
+  }
+  const response = parseOrcadProfilePreflight(
+    result.stdout,
+    nonce,
+    ORCAD_BUN_VERSION,
+    readFileSync(join(runtimeDir, ORCAD_VERSION_FILENAME), 'utf8').trim()
+  )
+  process.stdout.write(`${JSON.stringify({ target, ...response })}\n`)
+} else {
+  run(process.execPath, [
+    join(root, 'config/scripts/build-orcad-bun.mjs'),
+    '--runtime-only',
+    '--out-dir',
+    runtimeDir
+  ])
+}
+run(runtimePath, [
+  join(root, 'node_modules/vitest/vitest.mjs'),
+  'run',
+  '--config',
+  'config/vitest.config.ts',
+  ...(testArgs.length > 0 ? testArgs : bunProfileTestPaths({ artifact }))
+])
diff --git a/config/scripts/run-electron-vite-targets-in-parallel.mjs b/config/scripts/run-electron-vite-targets-in-parallel.mjs
index 2c0d0064424..149e35ca67e 100644
--- a/config/scripts/run-electron-vite-targets-in-parallel.mjs
+++ b/config/scripts/run-electron-vite-targets-in-parallel.mjs
@@ -11,7 +11,7 @@ function buildTarget(target) {
   return new Promise((resolve, reject) => {
     const child = spawn(
       process.execPath,
-      [buildScript, '--config', targetConfig, '--ignoreConfigWarning'],
+      [buildScript, '--config', targetConfig, '--ignoreConfigWarning', ...process.argv.slice(2)],
       {
         stdio: 'inherit',
         env: {
diff --git a/config/scripts/run-headless-serve-shutdown-docker.mjs b/config/scripts/run-headless-serve-shutdown-docker.mjs
index 4c367b5f7c4..f5119961c83 100755
--- a/config/scripts/run-headless-serve-shutdown-docker.mjs
+++ b/config/scripts/run-headless-serve-shutdown-docker.mjs
@@ -63,6 +63,9 @@ try {
     'build',
     '--platform',
     platform,
+    ...(process.env.ORCA_SHUTDOWN_FIXTURE_CACHE_IMAGE
+      ? ['--cache-from', process.env.ORCA_SHUTDOWN_FIXTURE_CACHE_IMAGE]
+      : []),
     '-f',
     shutdownDockerfile,
     '-t',
diff --git a/config/scripts/run-linux-cli-launch-contract-docker.mjs b/config/scripts/run-linux-cli-launch-contract-docker.mjs
index bd414947026..5cf14009c1c 100755
--- a/config/scripts/run-linux-cli-launch-contract-docker.mjs
+++ b/config/scripts/run-linux-cli-launch-contract-docker.mjs
@@ -14,7 +14,6 @@ const suffix = `${process.pid}-${Date.now()}`
 const artifactVolume = `orca-cli-contract-artifact-${suffix}`
 const tagArchitecture = platform?.split('/')[1] ?? process.arch
 const tag = `orca-cli-launch-contract:ubuntu-24.04-${tagArchitecture}-${suffix}`
-const base = 'ubuntu@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90'
 const containers = new Set()
 let artifactVolumeCreated = false
 const CASE_TIMEOUT_MS = 90_000
@@ -176,8 +175,9 @@ function buildImage() {
   const buildArgs = [
     'build',
     ...dockerPlatformArgs,
-    '--build-arg',
-    `BASE_IMAGE=${base}`,
+    ...(process.env.ORCA_CLI_FIXTURE_CACHE_IMAGE
+      ? ['--cache-from', process.env.ORCA_CLI_FIXTURE_CACHE_IMAGE]
+      : []),
     '-f',
     'config/docker/cli-launch-contract/Dockerfile',
     '-t',
diff --git a/config/scripts/run-mobile-web-app-checks.mjs b/config/scripts/run-mobile-web-app-checks.mjs
new file mode 100644
index 00000000000..666b7d6d68d
--- /dev/null
+++ b/config/scripts/run-mobile-web-app-checks.mjs
@@ -0,0 +1,88 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { createRequire } from 'node:module'
+import { mobileWebAppModuleClosure } from './build-mobile-web-app-bundle.mjs'
+import { readRouteSnapshot } from './mobile-web-app-route-snapshot.mjs'
+import { PAGE_ROUTE_MODULES } from './mobile-web-app-page-route-modules.mjs'
+import { spawnProcess } from './script-child-process.mjs'
+
+const require = createRequire(import.meta.url)
+const mobileWebCheckArgs = [
+  'run',
+  '--config',
+  'config/vitest.config.ts',
+  'config/scripts/mobile-web-app-',
+  'config/scripts/build-mobile-web-app-bundle.test.mjs'
+]
+
+export async function prepareRouteSnapshot(file, collect = mobileWebAppModuleClosure) {
+  rmSync(file, { force: true })
+  const routes = []
+  for (const route of new Set(PAGE_ROUTE_MODULES.values())) {
+    const closure = await collect(['app/_layout', 'app/h/_layout', route])
+    routes.push({ route, closure })
+  }
+  writeFileSync(file, JSON.stringify({ version: 1, routes }))
+}
+
+export async function withPreparedRouteSnapshot(file, run) {
+  try {
+    for (const route of new Set(PAGE_ROUTE_MODULES.values())) {
+      if (!readRouteSnapshot(route, file)) {
+        throw new Error(`Prepared mobile route snapshot is missing ${route}`)
+      }
+    }
+    return await run(file)
+  } finally {
+    rmSync(file, { force: true })
+  }
+}
+
+export async function withRouteSnapshot(run, collect = mobileWebAppModuleClosure) {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-route-snapshot-'))
+  try {
+    const file = join(directory, 'routes.json')
+    await prepareRouteSnapshot(file, collect)
+    return await withPreparedRouteSnapshot(file, run)
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+}
+
+function runTests(file) {
+  return new Promise((resolve, reject) => {
+    const child = spawnProcess({
+      program: process.execPath,
+      args: [
+        join(dirname(require.resolve('vitest/package.json')), 'vitest.mjs'),
+        ...mobileWebCheckArgs,
+        ...process.argv.slice(2)
+      ],
+      env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1', ORCA_MOBILE_WEB_ROUTE_SNAPSHOT: file },
+      stdio: 'inherit'
+    })
+    child.once('error', reject)
+    child.once('close', (code, signal) => {
+      if (code === 0 && signal === null) {
+        resolve()
+      } else {
+        reject(new Error(`Mobile web checks failed (code=${code}, signal=${signal})`))
+      }
+    })
+  })
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  if (process.argv[2] === '--prepare-route-snapshot') {
+    if (process.argv.length !== 4) {
+      throw new Error('Expected --prepare-route-snapshot FILE')
+    }
+    await prepareRouteSnapshot(process.argv[3])
+  } else if (process.env.ORCA_MOBILE_WEB_PREPARED_ROUTE_SNAPSHOT) {
+    await withPreparedRouteSnapshot(process.env.ORCA_MOBILE_WEB_PREPARED_ROUTE_SNAPSHOT, runTests)
+  } else {
+    await withRouteSnapshot(runTests)
+  }
+}
diff --git a/config/scripts/run-ssh-docker-e2e.mjs b/config/scripts/run-ssh-docker-e2e.mjs
index 6a1fb69a728..64709cdbb43 100644
--- a/config/scripts/run-ssh-docker-e2e.mjs
+++ b/config/scripts/run-ssh-docker-e2e.mjs
@@ -40,9 +40,6 @@ if (runtime.status !== 0) {
 // grep-inverts away.
 //
 // Known gaps in SSH e2e coverage, recorded here because nothing else names them:
-//   - The job that runs this is still called `ssh-docker-watcher-isolation`, though watcher
-//     isolation is now one spec of many. Renaming it changes the GitHub check name and can
-//     break required-check config, so the name understates the job on purpose.
 //   - E2E does not gate merges: `verify.needs` in pr.yml omits `e2e` while the suite is red on
 //     main. Nothing in this lane blocks a PR yet. pr.yml's Require-successful-checks comment
 //     has the exact wiring to flip it, and the gate contract asserts the current state.
diff --git a/config/scripts/run-terminal-ibus-hangul-e2e.mjs b/config/scripts/run-terminal-ibus-hangul-e2e.mjs
index 572f1988629..dead1c42f13 100644
--- a/config/scripts/run-terminal-ibus-hangul-e2e.mjs
+++ b/config/scripts/run-terminal-ibus-hangul-e2e.mjs
@@ -254,7 +254,6 @@ async function runInsideSession(evidenceDir) {
             'run',
             'test:e2e:headful',
             '--workers=1',
-            '--',
             'tests/e2e/terminal-ibus-hangul-native.spec.ts',
             'tests/e2e/terminal-hangul-terminating-digit-native.spec.ts'
           ],
diff --git a/config/scripts/runtime-serve-terminal-smoke.mjs b/config/scripts/runtime-serve-terminal-smoke.mjs
index a03c85983d8..c1d998717ff 100644
--- a/config/scripts/runtime-serve-terminal-smoke.mjs
+++ b/config/scripts/runtime-serve-terminal-smoke.mjs
@@ -388,7 +388,9 @@ async function main() {
       child.kill('SIGTERM')
       const exited = await Promise.race([
         new Promise((r) => child.on('exit', () => r(true))),
-        new Promise((r) => setTimeout(() => r(false), SHUTDOWN_TIMEOUT_MS))
+        // unref'd: the loser of this race must not hold the event loop open after the
+        // winner already decided. The timer still bounds the wait.
+        new Promise((r) => setTimeout(() => r(false), SHUTDOWN_TIMEOUT_MS).unref())
       ])
       if (!exited) {
         child.kill('SIGKILL')
diff --git a/config/scripts/script-child-process.mjs b/config/scripts/script-child-process.mjs
new file mode 100644
index 00000000000..fca512c3324
--- /dev/null
+++ b/config/scripts/script-child-process.mjs
@@ -0,0 +1,35 @@
+import { build } from 'esbuild'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { pathToFileURL } from 'node:url'
+
+const root = resolve(import.meta.dirname, '../..')
+const temporary = mkdtempSync(join(tmpdir(), 'orca-script-child-process-'))
+const output = join(temporary, 'child-process.mjs')
+let implementation
+
+try {
+  await build({
+    stdin: {
+      contents: [
+        `export { runProcessSync, spawnProcess } from ${JSON.stringify(join(root, 'src/shared/child-process/run-process.ts'))}`
+      ].join('\n'),
+      resolveDir: root,
+      sourcefile: 'script-child-process-entry.ts'
+    },
+    bundle: true,
+    platform: 'node',
+    target: 'node20',
+    format: 'esm',
+    outfile: output,
+    logLevel: 'silent'
+  })
+  implementation = await import(pathToFileURL(output).href)
+} finally {
+  rmSync(temporary, { recursive: true, force: true })
+}
+
+export const runProcessSync = implementation.runProcessSync
+
+export const spawnProcess = implementation.spawnProcess
diff --git a/config/scripts/script-module-dependencies.mjs b/config/scripts/script-module-dependencies.mjs
index b92db587a81..51381cdc4fb 100644
--- a/config/scripts/script-module-dependencies.mjs
+++ b/config/scripts/script-module-dependencies.mjs
@@ -1,8 +1,8 @@
 import { copyFileSync, mkdirSync, readFileSync } from 'node:fs'
-import { basename, dirname, join } from 'node:path'
+import { dirname, join, relative } from 'node:path'
 
 /**
- * Copy a script and every co-located module it imports into a fixture's `config/scripts`.
+ * Copy a script and its relative modules, preserving their paths in the fixture.
  *
  * Walked rather than listed: a module the script needs but the fixture never copied fails every
  * test in the suite with a module-resolution error that looks nothing like the defect it hides.
@@ -10,7 +10,9 @@ import { basename, dirname, join } from 'node:path'
 export function copyScriptWithLocalModules(sourceScriptPath, destinationScriptsDir) {
   mkdirSync(destinationScriptsDir, { recursive: true })
   for (const modulePath of collectScriptModules(sourceScriptPath)) {
-    copyFileSync(modulePath, join(destinationScriptsDir, basename(modulePath)))
+    const destination = join(destinationScriptsDir, relative(dirname(sourceScriptPath), modulePath))
+    mkdirSync(dirname(destination), { recursive: true })
+    copyFileSync(modulePath, destination)
   }
 }
 
@@ -27,7 +29,7 @@ function collectScriptModules(scriptPath, seen = new Set()) {
   // not against this file, so following them would stage the wrong path.
   const source = readFileSync(scriptPath, 'utf8')
   const specifiers = source.matchAll(
-    /(?:\bfrom|\brequire\s*\(|\bimport\s*\(|\bimport)\s*'(\.\/[^']+)'/g
+    /(?:\bfrom|\brequire\s*\(|\bimport\s*\(|\bimport)\s*'(\.\.?\/[^']+)'/g
   )
   for (const [, specifier] of specifiers) {
     collectScriptModules(join(dirname(scriptPath), specifier), seen)
diff --git a/config/scripts/script-module-dependencies.test.mjs b/config/scripts/script-module-dependencies.test.mjs
index 998226e0427..68482954ee3 100644
--- a/config/scripts/script-module-dependencies.test.mjs
+++ b/config/scripts/script-module-dependencies.test.mjs
@@ -1,4 +1,11 @@
-import { existsSync, mkdtempSync, readdirSync, writeFileSync } from 'node:fs'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  writeFileSync
+} from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -23,6 +30,23 @@ function copiedNames(files, entryName) {
 }
 
 describe('copyScriptWithLocalModules', () => {
+  it('preserves parent paths for modules shared with the runtime', () => {
+    const sourceDir = sourceTree({ 'runtime.ts': 'export const value = 42\n' })
+    mkdirSync(join(sourceDir, 'scripts'))
+    writeFileSync(
+      join(sourceDir, 'scripts', 'entry.mjs'),
+      "export { value } from '../runtime.ts'\n"
+    )
+    const destinationRoot = mkdtempSync(join(fixtureDir, 'dest-'))
+    copyScriptWithLocalModules(
+      join(sourceDir, 'scripts', 'entry.mjs'),
+      join(destinationRoot, 'scripts')
+    )
+    expect(readFileSync(join(destinationRoot, 'runtime.ts'), 'utf8')).toBe(
+      'export const value = 42\n'
+    )
+  })
+
   it('takes the entry script itself', () => {
     expect(copiedNames({ 'entry.mjs': 'export const a = 1\n' }, 'entry.mjs')).toEqual(['entry.mjs'])
   })
diff --git a/config/scripts/skills-cli-package-workflow.test.mjs b/config/scripts/skills-cli-package-workflow.test.mjs
index 07f7beb46ac..489437dd61f 100644
--- a/config/scripts/skills-cli-package-workflow.test.mjs
+++ b/config/scripts/skills-cli-package-workflow.test.mjs
@@ -14,7 +14,6 @@ describe('packaged skills CLI PR gates', () => {
 
     expect(job['runs-on']).toBe('windows-2022')
     expect(buildStep.run).toBe('pnpm run build:release:parallel')
-    expect(buildStep.env.ORCA_REUSE_WINDOWS_CLI_LAUNCHER).toBe('1')
     expect(prepareStep.run).toBe('node config/scripts/ensure-native-runtime.mjs --runtime=electron')
     expect(packageStep.run).toContain('electron-builder')
     expect(packageStep.run).toContain('--dir')
diff --git a/config/scripts/ssh-browser-e2e-routing.test.mjs b/config/scripts/ssh-browser-e2e-routing.test.mjs
index 0b46131cf14..a36df63dfd9 100644
--- a/config/scripts/ssh-browser-e2e-routing.test.mjs
+++ b/config/scripts/ssh-browser-e2e-routing.test.mjs
@@ -2,7 +2,7 @@ import { readFileSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import { parse } from 'yaml'
 import { expect, it } from 'vitest'
-import { selectPrE2eSpecs } from './pr-e2e-source-routing.mjs'
+import { selectPrE2eSpecs, shouldRunReusablePrE2e } from './pr-e2e-source-routing.mjs'
 
 const root = resolve(import.meta.dirname, '../..')
 const workflow = parse(readFileSync(join(root, '.github/workflows/e2e.yml'), 'utf8'))
@@ -62,3 +62,24 @@ it('executes both Docker network routes in a Node job with their opt-in enabled'
     spec
   )
 })
+
+it('runs the local SSH browser spec when its route source changes', () => {
+  const spec = 'tests/e2e/local-ssh-browser-routing.spec.ts'
+  for (const changed of [
+    'src/main/browser/local-ssh-browser-route.ts',
+    'src/main/browser/local-ssh-browser-partitions.ts',
+    'src/renderer/src/components/browser-pane/use-ssh-workspace-browser-route.ts',
+    'src/renderer/src/components/browser-pane/assemble-chrome/ssh-routed-browser-page-gate.tsx',
+    'src/renderer/src/lib/worktree-host-connection-phase.ts'
+  ]) {
+    expect(selectPrE2eSpecs([changed])).toContain(spec)
+    expect(shouldRunReusablePrE2e([changed])).toBe(true)
+  }
+  for (const unrelated of [
+    'src/renderer/src/components/browser-pane/use-ssh-workspace-browser-route.host-connection.test.tsx',
+    'src/main/browser/local-ssh-browser-route.test.ts',
+    'src/renderer/src/components/browser-pane/BrowserPane.tsx'
+  ]) {
+    expect(selectPrE2eSpecs([unrelated])).not.toContain(spec)
+  }
+})
diff --git a/config/scripts/ssh-docker-ci-sharding.test.mjs b/config/scripts/ssh-docker-ci-sharding.test.mjs
new file mode 100644
index 00000000000..403c059e92c
--- /dev/null
+++ b/config/scripts/ssh-docker-ci-sharding.test.mjs
@@ -0,0 +1,97 @@
+import { readFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { dirname, join } from 'node:path'
+import { expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { runProcess } from '../../src/shared/child-process/run-process'
+
+const require = createRequire(import.meta.url)
+const root = join(import.meta.dirname, '../..')
+const workflow = parse(readFileSync(join(root, '.github/workflows/e2e.yml'), 'utf8'))
+const job = workflow.jobs['ssh-docker-watcher-isolation']
+const readRunner = (name) => readFileSync(join(root, `config/scripts/${name}.mjs`), 'utf8')
+const runnerSpecs = (name) =>
+  [...readRunner(name).matchAll(/^    '(tests\/e2e\/[^']+\.spec\.ts)',/gm)].map((match) => match[1])
+const runners = [
+  'run-ssh-docker-e2e',
+  'run-ssh-docker-watcher-isolation-e2e',
+  'run-ssh-docker-terminal-parking-e2e'
+]
+
+it('gives every removed SSH spec a dedicated owner even for test-only edits', () => {
+  const changedRun = workflow.jobs['changed-e2e'].steps.find(
+    (step) => step.name === 'Run changed E2E specs'
+  ).run
+  const excluded = [...changedRun.matchAll(/\. != "([^"]+)"/g)].map((match) => match[1])
+  const owned = runners.flatMap(runnerSpecs)
+  expect(owned.length).toBeGreaterThan(25)
+  expect(new Set(owned).size).toBe(owned.length)
+  for (const spec of owned) {
+    expect(excluded, spec).toContain(spec)
+    expect(job.if, spec).toContain(`contains(inputs.test_files, '${spec}')`)
+  }
+  expect(excluded.filter((spec) => !owned.includes(spec)).sort()).toEqual([
+    'tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts',
+    'tests/e2e/ssh-localhost.spec.ts',
+    'tests/e2e/terminal-ibus-hangul-native.spec.ts'
+  ])
+})
+
+it('native Playwright shards preserve every SSH test and project exactly once', async () => {
+  const cli = join(dirname(require.resolve('playwright/package.json')), 'cli.js')
+  const env = {
+    ...process.env,
+    ORCA_BACKGROUND_LAUNCH: '1',
+    ORCA_E2E_SSH_DOCKER: '1',
+    ORCA_E2E_LOCAL_SSH_BROWSER: '1',
+    ORCA_E2E_SSH_CLIENT_HOSTED_BROWSER: '1',
+    ORCA_E2E_WEB_CLIENT: '1'
+  }
+  async function discover(extra = []) {
+    const result = await runProcess({
+      program: process.execPath,
+      cwd: root,
+      args: [
+        cli,
+        'test',
+        ...runnerSpecs(runners[0]),
+        '--config',
+        'tests/playwright.config.ts',
+        '--project=electron-headless',
+        '--project=electron-headful',
+        '--workers=1',
+        '--list',
+        '--reporter=json',
+        ...extra
+      ],
+      env,
+      timeoutMs: 30000
+    })
+    expect(result.code, result.stderr).toBe(0)
+    const report = JSON.parse(result.stdout)
+    expect(report.errors).toEqual([])
+    const ids = []
+    function visit(suite) {
+      for (const spec of suite.specs ?? []) {
+        for (const test of spec.tests) {
+          ids.push(`${spec.id}:${test.projectName}`)
+        }
+      }
+      for (const child of suite.suites ?? []) {
+        visit(child)
+      }
+    }
+    visit(report)
+    return ids
+  }
+  const full = await discover()
+  const sharded = []
+  for (const index of job.strategy.matrix.shard) {
+    const selected = await discover([`--shard=${index}/4`])
+    expect(selected.length).toBeGreaterThan(0)
+    sharded.push(...selected)
+  }
+  expect(full.length).toBeGreaterThanOrEqual(40)
+  expect(new Set(sharded).size).toBe(sharded.length)
+  expect(sharded.sort()).toEqual(full.sort())
+}, 90000)
diff --git a/config/scripts/terminal-ime-e2e-workflow.test.mjs b/config/scripts/terminal-ime-e2e-workflow.test.mjs
index 65277b5e898..cb12839a2af 100644
--- a/config/scripts/terminal-ime-e2e-workflow.test.mjs
+++ b/config/scripts/terminal-ime-e2e-workflow.test.mjs
@@ -45,29 +45,6 @@ describe('terminal IME e2e workflow', () => {
     expect(nativeIndex).toBeGreaterThan(deterministicIndex)
   })
 
-  it('keeps IBus lifecycle scoped to owned processes', () => {
-    const runner = readFileSync(
-      join(projectDir, 'config/scripts/run-terminal-ibus-hangul-e2e.mjs'),
-      'utf8'
-    )
-
-    expect(runner).toContain(
-      "['--xim', '--verbose', '--panel=disable', '--emoji-extension=disable']"
-    )
-    expect(runner).toContain("spawn('xfwm4', ['--compositor=off']")
-    expect(runner).toContain("['initial-input-mode', 'hangul']")
-    expect(runner).toContain("['hangul-keyboard', '2']")
-    expect(runner).toContain("process.kill(-processGroupId, 'SIGTERM')")
-    expect(runner).toContain("process.kill(-processGroupId, 'SIGKILL')")
-    expect(runner).toContain('const killDeadline = Date.now() + processKillTimeoutMs')
-    expect(runner).toMatch(
-      /'test:e2e:headful',\s*'--workers=1',\s*'--',\s*'tests\/e2e\/terminal-ibus-hangul-native\.spec\.ts'/
-    )
-    expect(runner).not.toContain("'--replace'")
-    expect(runner).not.toContain('killall')
-    expect(runner).not.toContain('pkill')
-  })
-
   it('runs native Wayland independently with CJK fonts and retained evidence', () => {
     const job = workflow.jobs['linux-wayland']
     expect(job.needs).toBeUndefined()
@@ -82,13 +59,4 @@ describe('terminal IME e2e workflow', () => {
     expect(upload.if).toBe('always()')
     expect(upload.with.name).toBe('terminal-wayland-ime-evidence')
   })
-
-  it('bounds blocking native input commands', () => {
-    const nativeSpec = readFileSync(
-      join(projectDir, 'tests/e2e/terminal-ibus-hangul-native.spec.ts'),
-      'utf8'
-    )
-
-    expect(nativeSpec.match(/timeout: NATIVE_COMMAND_TIMEOUT_MS/g)).toHaveLength(3)
-  })
 })
diff --git a/config/scripts/terminal-partial-escape-tail-benchmark.mjs b/config/scripts/terminal-partial-escape-tail-benchmark.mjs
index 0337daa4e9d..0ba8e974161 100644
--- a/config/scripts/terminal-partial-escape-tail-benchmark.mjs
+++ b/config/scripts/terminal-partial-escape-tail-benchmark.mjs
@@ -3,15 +3,16 @@
 // baseline with the pre-change shape (unconditional concat + per-code-unit walk). Equivalence is
 // proven over a corpus first, so the reported speedup cannot come from the gate changing the answer.
 import { performance } from 'node:perf_hooks'
-import {
-  advancePartialEscapeTail,
-  extractPartialEscapeTail,
-  MAX_PARTIAL_ESCAPE_TAIL_LENGTH
-} from '../../src/shared/terminal-partial-escape-tail.ts'
+import { createJiti } from 'jiti'
 
 const CHUNK_BYTES = 16 * 1024
 const CHUNKS = 640
 const ROUNDS = 7
+// jiti, not a bare `node` import: type-stripping cannot resolve the extensionless
+// relative imports inside the module graph under test.
+const jiti = createJiti(import.meta.url)
+const { advancePartialEscapeTail, extractPartialEscapeTail, MAX_PARTIAL_ESCAPE_TAIL_LENGTH } =
+  await jiti.import('../../src/shared/terminal-partial-escape-tail.ts')
 
 function baselineAdvance(pendingTail, chunk) {
   const tail = extractPartialEscapeTail(pendingTail + chunk)
diff --git a/config/scripts/verify-dev-channel-packaging.test.mjs b/config/scripts/verify-dev-channel-packaging.test.mjs
index dfde5d461d2..ceef8f76174 100644
--- a/config/scripts/verify-dev-channel-packaging.test.mjs
+++ b/config/scripts/verify-dev-channel-packaging.test.mjs
@@ -53,19 +53,6 @@ describe('electron-builder dev-channel identity', () => {
     expect(config.win.verifyUpdateCodeSignature).toBe(false)
   })
 
-  // Why on every channel: the hook is the only handle electron-builder gives on
-  // the NSIS uninstaller, and it signs nothing — it relays the file to and from
-  // the CI SignPath request. Carrying it must not drag a publisherName onto a
-  // dev build, which is the failure the split above exists to prevent.
-  it('carries the uninstaller sign hook without changing publisherName semantics', () => {
-    for (const env of [{}, WIN_ADHOC_ENV]) {
-      const config = loadConfigWithEnv(env)
-      expect(typeof config.win.signtoolOptions.sign).toBe('function')
-    }
-    expect(loadConfigWithEnv({}).win.signtoolOptions.publisherName).toBe('SignPath Foundation')
-    expect(loadConfigWithEnv(WIN_ADHOC_ENV).win.signtoolOptions.publisherName).toBeUndefined()
-  })
-
   it.each([
     ['hourly', { ORCA_WIN_HOURLY: '1' }, 'orca-hourly'],
     ['daily', { ORCA_WIN_DAILY: '1' }, 'orca-daily'],
diff --git a/config/scripts/verify-linux-glibc-floor.cjs b/config/scripts/verify-linux-glibc-floor.cjs
index 3d4a0ca3c1d..ebfdb2b8816 100644
--- a/config/scripts/verify-linux-glibc-floor.cjs
+++ b/config/scripts/verify-linux-glibc-floor.cjs
@@ -366,23 +366,38 @@ function parseImportedSymbols(objdumpOutput) {
 /** Version needs + DT_NEEDED from a single `objdump -p` (fail-closed). */
 function readDynamicInfo(filePath, objdumpPath) {
   const output = runObjdump(objdumpPath, '-p', filePath)
+  const versionNeeds = parseVersionNeeds(output)
+  const neededLibraries = parseNeededLibraries(output)
   return {
-    versionNeeds: parseVersionNeeds(output),
-    neededLibraries: parseNeededLibraries(output)
+    versionNeeds,
+    neededLibraries,
+    // LLVM prints an empty Dynamic Section even for static executables.
+    isStatic:
+      /^Program Header:/m.test(output) &&
+      /^\s+LOAD\s+off\s+0x[0-9a-f]+/m.test(output) &&
+      !/^\s+(?:DYNAMIC|INTERP)\s+off\s+/m.test(output) &&
+      versionNeeds.length === 0 &&
+      neededLibraries.size === 0
   }
 }
 
+function isMuslTemplatePayload(filePath, neededLibraries, versionNeeds) {
+  return (
+    /(?:^|[/\\])orcad-template[/\\]targets[/\\]linux-(?:x64|arm64)-musl[/\\]/.test(filePath) &&
+    [...neededLibraries].some(
+      (name) => name === 'libc.so' || /^libc\.musl-[\w-]+\.so\.1$/.test(name)
+    ) &&
+    ![...neededLibraries, ...versionNeeds.map((need) => need.library)].some((name) =>
+      /^(?:libc\.so\.6|libm\.so\.6|libpthread\.so\.0|libdl\.so\.2|librt\.so\.1|ld-linux.*)$/.test(
+        name
+      )
+    )
+  )
+}
+
 /** Imported (undefined) dynamic symbols from `objdump -T` (fail-closed). */
 function readImportedSymbols(filePath, objdumpPath) {
-  try {
-    return parseImportedSymbols(runObjdump(objdumpPath, '-T', filePath))
-  } catch (error) {
-    // Why: a statically linked binary (bundled ripgrep) has no dynamic symbol table to import from.
-    if (error instanceof Error && error.message.includes('not a dynamic object')) {
-      return new Set()
-    }
-    throw error
-  }
+  return parseImportedSymbols(runObjdump(objdumpPath, '-T', filePath))
 }
 
 /**
@@ -433,15 +448,20 @@ function verifyLinuxGlibcFloor(rootDir, options = {}) {
 
   const offenders = []
   for (const filePath of binaries) {
-    const { versionNeeds, neededLibraries } = readDynamicInfo(filePath, objdumpPath)
-    const floorViolations = findFloorViolations(versionNeeds, filePath)
+    const { versionNeeds, neededLibraries, isStatic } = readDynamicInfo(filePath, objdumpPath)
+    const isMuslTarget = isMuslTemplatePayload(filePath, neededLibraries, versionNeeds)
+    // Remote musl payloads use their host's C++ runtime, not Ubuntu's libstdc++ or libutil.
+    const floorViolations = findFloorViolations(versionNeeds, filePath).filter(
+      (need) => !isMuslTarget || !isLibstdcxxNode(need.name)
+    )
     // Only pay for `objdump -T` when a relocated-symbol provider is not already
     // in DT_NEEDED (the common, healthy case short-circuits without it).
-    const providerViolations = Object.values(RELOCATED_SYMBOL_PROVIDERS).some(
-      (library) => !neededLibraries.has(library)
-    )
-      ? findMissingProviderDeps(readImportedSymbols(filePath, objdumpPath), neededLibraries)
-      : []
+    const providerViolations =
+      !isStatic &&
+      !isMuslTarget &&
+      Object.values(RELOCATED_SYMBOL_PROVIDERS).some((library) => !neededLibraries.has(library))
+        ? findMissingProviderDeps(readImportedSymbols(filePath, objdumpPath), neededLibraries)
+        : []
     if (floorViolations.length > 0 || providerViolations.length > 0) {
       offenders.push({ filePath, floorViolations, providerViolations })
     }
@@ -473,7 +493,7 @@ function verifyLinuxGlibcFloor(rootDir, options = {}) {
   }
 
   console.log(
-    `[verify-linux-glibc-floor] OK — ${binaries.length} bundled native binaries all load on ${FLOOR_LABEL}`
+    `[verify-linux-glibc-floor] OK — ${binaries.length} bundled native binaries meet applicable ${FLOOR_LABEL} requirements`
   )
 }
 
diff --git a/config/scripts/verify-linux-glibc-payloads.test.mjs b/config/scripts/verify-linux-glibc-payloads.test.mjs
new file mode 100644
index 00000000000..9a68142cf9e
--- /dev/null
+++ b/config/scripts/verify-linux-glibc-payloads.test.mjs
@@ -0,0 +1,124 @@
+import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+
+const require = createRequire(import.meta.url)
+const { verifyLinuxGlibcFloor } = require('./verify-linux-glibc-floor.cjs')
+const roots = []
+const STATIC_HEADERS = 'Program Header:\n    LOAD off 0x0000000000000000\n'
+const MUSL_TARGET = 'orcad-template/targets/linux-arm64-musl/watcher.node'
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+async function writeObjdumpFixture(
+  headers,
+  { filename = 'browser', symbolTableError = false } = {}
+) {
+  const root = await mkdtemp(join(tmpdir(), 'orca-glibc-payload-'))
+  roots.push(root)
+  const app = join(root, 'app')
+  const binary = join(app, ...filename.split('/'))
+  await mkdir(dirname(binary), { recursive: true })
+  const elf = Buffer.alloc(64)
+  elf.write('\x7fELF', 0, 'latin1')
+  elf[4] = 2
+  elf[5] = 1
+  elf[6] = 1
+  elf.writeUInt16LE(0xb7, 18)
+  await writeFile(binary, elf)
+  await writeFile(join(root, 'private-headers.txt'), headers)
+  const objdumpPath = join(root, 'objdump-stub.sh')
+  await writeFile(
+    objdumpPath,
+    [
+      '#!/bin/sh',
+      'case "$1" in',
+      '  --version) echo "GNU objdump (fixture)" ;;',
+      '  -p) cat "$(dirname "$0")/private-headers.txt" ;;',
+      symbolTableError
+        ? '  -T) echo "not a dynamic object" >&2; exit 1 ;;'
+        : '  -T) echo "0000 DF *UND* 0000 openpty" ;;',
+      'esac'
+    ].join('\n'),
+    { mode: 0o755 }
+  )
+  return () => verifyLinuxGlibcFloor(app, { objdumpPath, targetArch: 'arm64' })
+}
+
+describe.skipIf(process.platform === 'win32')('static ELF and remote musl payloads', () => {
+  it.each(['', '\nDynamic Section:\n'])(
+    'accepts static LOAD segments with no dynamic imports (section suffix %j)',
+    async (suffix) => {
+      const verify = await writeObjdumpFixture(STATIC_HEADERS + suffix, { symbolTableError: true })
+      expect(verify).not.toThrow()
+    }
+  )
+
+  it.each([
+    ['missing program headers', 'Dynamic Section:\n'],
+    ['dynamic segment', `${STATIC_HEADERS} DYNAMIC off 0x0000000000001000\n`],
+    ['interpreter segment', `${STATIC_HEADERS} INTERP off 0x0000000000001000\n`],
+    ['dependency without a dynamic segment', `${STATIC_HEADERS}  NEEDED libc.so.6\n`]
+  ])('preserves symbol-table failures for %s', async (_label, headers) => {
+    const verify = await writeObjdumpFixture(headers, { symbolTableError: true })
+    expect(verify).toThrow(/objdump -T failed/)
+  })
+
+  it.each(['libc.so', 'libc.musl-aarch64.so.1'])(
+    'does not apply Ubuntu C++ or libutil requirements to a remote payload linked to %s',
+    async (libc) => {
+      const verify = await writeObjdumpFixture(
+        `Dynamic Section:\n  NEEDED ${libc}\n  NEEDED libstdc++.so.6\n` +
+          'Version References:\n  required from libstdc++.so.6:\n    0x0 0x00 02 GLIBCXX_3.4.29\n',
+        { filename: MUSL_TARGET }
+      )
+      expect(verify).not.toThrow()
+    }
+  )
+
+  it.each([
+    ['desktop addon', 'watcher.node', 'libc.so'],
+    ['glibc target', 'orcad-template/targets/linux-arm64-glibc/watcher.node', 'libc.so'],
+    ['mislabeled glibc target', MUSL_TARGET, 'libc.so.6'],
+    ['mixed libc dependencies', MUSL_TARGET, 'libc.so\n  NEEDED libc.so.6']
+  ])('retains Ubuntu floor and provider checks for %s', async (_label, filename, libc) => {
+    const verify = await writeObjdumpFixture(
+      `Dynamic Section:\n  NEEDED ${libc}\n  NEEDED libstdc++.so.6\n` +
+        'Version References:\n  required from libstdc++.so.6:\n    0x0 0x00 02 GLIBCXX_3.4.29\n',
+      { filename }
+    )
+    expect(verify).toThrow(
+      /needs GLIBCXX_3.4.29.*imports openpty but libutil.so.1 is not in DT_NEEDED/
+    )
+  })
+
+  it('still rejects too-new glibc version needs in a musl payload', async () => {
+    const verify = await writeObjdumpFixture(
+      'Dynamic Section:\n  NEEDED libc.so\nVersion References:\n' +
+        '  required from libc.so:\n    0x0 0x00 02 GLIBC_2.34\n',
+      { filename: MUSL_TARGET }
+    )
+    expect(verify).toThrow(/needs GLIBC_2.34/)
+  })
+
+  it('retains the provider check when version references disclose a glibc dependency', async () => {
+    const verify = await writeObjdumpFixture(
+      'Dynamic Section:\n  NEEDED libc.so\nVersion References:\n' +
+        '  required from libc.so.6:\n    0x0 0x00 02 GLIBC_2.17\n',
+      { filename: MUSL_TARGET }
+    )
+    expect(verify).toThrow(/imports openpty but libutil.so.1 is not in DT_NEEDED/)
+  })
+
+  it('preserves objdump failures for a musl-labeled file without proven musl dependencies', async () => {
+    const verify = await writeObjdumpFixture('Dynamic Section:\n', {
+      filename: MUSL_TARGET,
+      symbolTableError: true
+    })
+    expect(verify).toThrow(/objdump -T failed/)
+  })
+})
diff --git a/config/scripts/verify-localization-catalog.mjs b/config/scripts/verify-localization-catalog.mjs
index a73e9d5e3cc..a155e8741d3 100644
--- a/config/scripts/verify-localization-catalog.mjs
+++ b/config/scripts/verify-localization-catalog.mjs
@@ -442,7 +442,27 @@ async function reportPluginCatalog(root, catalog, pluginCatalogPath) {
   return interpolationMismatches.length > 0 ? 1 : 0
 }
 
-export async function main(root = process.cwd(), options = parseArgs(process.argv.slice(2))) {
+export async function collectLocalizationReferences(root) {
+  const sourceRoots = LOCALIZATION_SOURCE_ROOTS.map((sourceRoot) => path.join(root, sourceRoot))
+  const references = []
+
+  for (const sourceRoot of sourceRoots) {
+    const files = await collectSourceFiles(root, sourceRoot)
+    for (const filePath of files) {
+      references.push(
+        ...collectLocalizationKeyReferences(filePath, await fs.readFile(filePath, 'utf8'), root)
+      )
+    }
+  }
+
+  return references
+}
+
+export async function main(
+  root = process.cwd(),
+  options = parseArgs(process.argv.slice(2)),
+  sharedReferences
+) {
   const localesDir = path.join(root, LOCALES_RELATIVE_DIR)
   const catalogPath = path.join(localesDir, 'en.json')
   const catalog = JSON.parse(await fs.readFile(catalogPath, 'utf8'))
@@ -461,17 +481,7 @@ export async function main(root = process.cwd(), options = parseArgs(process.arg
     return 0
   }
   let catalogKeys = new Set(flattenCatalogKeys(catalog))
-  const sourceRoots = LOCALIZATION_SOURCE_ROOTS.map((sourceRoot) => path.join(root, sourceRoot))
-  const references = []
-
-  for (const sourceRoot of sourceRoots) {
-    const files = await collectSourceFiles(root, sourceRoot)
-    for (const filePath of files) {
-      references.push(
-        ...collectLocalizationKeyReferences(filePath, await fs.readFile(filePath, 'utf8'), root)
-      )
-    }
-  }
+  const references = sharedReferences ?? (await collectLocalizationReferences(root))
 
   const missing = references.filter((reference) => !catalogKeys.has(reference.key))
   if (missing.length > 0) {
diff --git a/config/scripts/verify-localization-catalogs.mjs b/config/scripts/verify-localization-catalogs.mjs
new file mode 100644
index 00000000000..73eb9ab943b
--- /dev/null
+++ b/config/scripts/verify-localization-catalogs.mjs
@@ -0,0 +1,30 @@
+import process from 'node:process'
+import { pathToFileURL } from 'node:url'
+import {
+  collectLocalizationReferences,
+  main as verifyCatalog
+} from './verify-localization-catalog.mjs'
+import { main as verifyRuntimeCatalog } from './generate-runtime-required-english-catalog.mjs'
+
+export async function main(root = process.cwd()) {
+  // Share only this invocation's scan, never cached evidence from another checkout.
+  const references = await collectLocalizationReferences(root)
+  const results = await Promise.allSettled([
+    verifyCatalog(root, {}, references),
+    verifyRuntimeCatalog(root, [], references)
+  ])
+  let exitCode = 0
+  for (const result of results) {
+    if (result.status === 'rejected') {
+      console.error(result.reason)
+      exitCode = 1
+    } else if (result.value !== 0) {
+      exitCode = 1
+    }
+  }
+  return exitCode
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  process.exit(await main())
+}
diff --git a/config/scripts/verify-localization-catalogs.test.mjs b/config/scripts/verify-localization-catalogs.test.mjs
new file mode 100644
index 00000000000..038bf34254e
--- /dev/null
+++ b/config/scripts/verify-localization-catalogs.test.mjs
@@ -0,0 +1,80 @@
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { main as verifyTogether } from './verify-localization-catalogs.mjs'
+import { main as verifyCatalog } from './verify-localization-catalog.mjs'
+import { main as verifyRuntimeCatalog } from './generate-runtime-required-english-catalog.mjs'
+
+const directories = []
+const renderer = 'src/renderer/src'
+const englishPath = `${renderer}/i18n/locales/en.json`
+const runtimePath = `${renderer}/i18n/en-runtime-required.json`
+
+async function fixture() {
+  const root = await mkdtemp(join(tmpdir(), 'orca-localization-checks-'))
+  directories.push(root)
+  await mkdir(join(root, renderer, 'i18n/locales'), { recursive: true })
+  await mkdir(join(root, 'src/main'), { recursive: true })
+  await writeFile(join(root, renderer, 'greeting.ts'), "translate('hello', 'Hello')\n")
+  await writeFile(join(root, 'src/main/ready.ts'), "translateMain('ready', 'Ready')\n")
+  await writeFile(
+    join(root, englishPath),
+    JSON.stringify({ hello: 'Hello', ready: 'Ready', dynamic: 'Required' })
+  )
+  await writeFile(join(root, runtimePath), JSON.stringify({ dynamic: 'Required' }))
+  return root
+}
+
+afterEach(async () => {
+  await Promise.all(directories.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('combined localization verification', () => {
+  it.each([
+    ['valid catalogs', undefined, undefined, 0, 0],
+    ['missing reference', `${renderer}/greeting.ts`, "translate('missing', 'Missing')", 1, 1],
+    ['missing runtime entry', runtimePath, '{}', 0, 1],
+    ['contradictory runtime entry', runtimePath, '{"dynamic":"Wrong"}', 0, 1],
+    ['malformed runtime catalog', runtimePath, '{', 0, 1],
+    [
+      'inconsistent placeholders',
+      `${renderer}/greeting.ts`,
+      "translate('hello', 'Hello {{name}}'); translate('hello', 'Hello {{account}}')",
+      1,
+      1
+    ]
+  ])(
+    'preserves both standalone verdicts: %s',
+    async (_name, file, contents, catalogCode, combinedCode) => {
+      const root = await fixture()
+      if (file) {
+        await writeFile(join(root, file), contents)
+      }
+      const results = await Promise.allSettled([
+        verifyCatalog(root, {}),
+        verifyRuntimeCatalog(root, [])
+      ])
+      expect(results[0]).toMatchObject({ status: 'fulfilled', value: catalogCode })
+      const expected = results.some((result) => result.status === 'rejected' || result.value !== 0)
+        ? 1
+        : 0
+      expect(expected).toBe(combinedCode)
+      expect(await verifyTogether(root)).toBe(expected)
+    }
+  )
+
+  it('reads source edits, new files, removals, and separate roots on each invocation', async () => {
+    const root = await fixture()
+    expect(await verifyTogether(root)).toBe(0)
+    await writeFile(join(root, renderer, 'greeting.ts'), "translate('hello', 'New fallback')")
+    expect(await verifyTogether(root)).toBe(1)
+    await writeFile(join(root, renderer, 'greeting.ts'), "translate('hello', 'Hello')")
+    expect(await verifyTogether(root)).toBe(0)
+    await writeFile(join(root, 'src/main/added.ts'), "translateMain('absent', 'Absent')")
+    expect(await verifyTogether(root)).toBe(1)
+    await rm(join(root, 'src/main/added.ts'))
+    expect(await verifyTogether(root)).toBe(0)
+    expect(await verifyTogether(await fixture())).toBe(0)
+  })
+})
diff --git a/config/scripts/verify-packaged-orcad-template.cjs b/config/scripts/verify-packaged-orcad-template.cjs
new file mode 100644
index 00000000000..ad0e3fe485a
--- /dev/null
+++ b/config/scripts/verify-packaged-orcad-template.cjs
@@ -0,0 +1,150 @@
+const { createHash } = require('node:crypto')
+const { lstatSync, readFileSync, readdirSync } = require('node:fs')
+const { basename, join } = require('node:path')
+const {
+  ORCAD_BUILD_TARGET_FILENAME,
+  ORCAD_TEMPLATE_MANIFEST_FILENAME,
+  ORCAD_TEMPLATE_TARGETS_DIR,
+  orcadTemplateCommonFilenames
+} = require('../../src/shared/orcad-artifacts.ts')
+const { ORCAD_TEMPLATE_TARGETS } = require('../../src/shared/orcad-bun-runtime.ts')
+
+const SHA256_PATTERN = /^[a-f0-9]{64}$/
+const BROWSER_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/
+
+function sha256(path) {
+  return createHash('sha256').update(readFileSync(path)).digest('hex')
+}
+
+function readManifest(templateDir) {
+  const path = join(templateDir, ORCAD_TEMPLATE_MANIFEST_FILENAME)
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'))
+  } catch (error) {
+    throw new Error(
+      `[verify-packaged-orcad-template] invalid manifest at ${path}: ${error instanceof Error ? error.message : String(error)}`
+    )
+  }
+}
+
+function requireRecord(value, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error(`[verify-packaged-orcad-template] ${label} must be an object`)
+  }
+  return value
+}
+
+function requireSha256(value, label) {
+  if (typeof value !== 'string' || !SHA256_PATTERN.test(value)) {
+    throw new Error(`[verify-packaged-orcad-template] ${label} must be a SHA-256 digest`)
+  }
+  return value
+}
+
+function requireRegularFile(path, label) {
+  let metadata
+  try {
+    metadata = lstatSync(path)
+  } catch {
+    throw new Error(`[verify-packaged-orcad-template] missing ${label} at ${path}`)
+  }
+  if (!metadata.isFile() || metadata.isSymbolicLink()) {
+    throw new Error(`[verify-packaged-orcad-template] ${label} is not a regular file at ${path}`)
+  }
+}
+
+function verifyFile(path, expected, label) {
+  requireRegularFile(path, label)
+  const actual = sha256(path)
+  if (actual !== expected) {
+    throw new Error(
+      `[verify-packaged-orcad-template] ${label} checksum mismatch: expected ${expected}, got ${actual}`
+    )
+  }
+}
+
+function requireExactNames(actual, expected, label) {
+  const actualNames = [...actual].sort()
+  const expectedNames = [...expected].sort()
+  if (
+    actualNames.length !== expectedNames.length ||
+    actualNames.some((name, index) => name !== expectedNames[index])
+  ) {
+    throw new Error(
+      `[verify-packaged-orcad-template] ${label} mismatch: expected=${expectedNames.join(',')} actual=${actualNames.join(',')}`
+    )
+  }
+}
+
+function verifyTarget(templateDir, target, value) {
+  const targetManifest = requireRecord(value, `${target} manifest`)
+  const targetSha256 = requireSha256(targetManifest.targetSha256, `${target} targetSha256`)
+  const watcherSha256 = requireSha256(targetManifest.watcherSha256, `${target} watcherSha256`)
+  const hasBrowserName = Object.hasOwn(targetManifest, 'browserName')
+  const hasBrowserSha256 = Object.hasOwn(targetManifest, 'browserSha256')
+  if (hasBrowserName !== hasBrowserSha256) {
+    throw new Error(
+      `[verify-packaged-orcad-template] ${target} browserName and browserSha256 must both be present`
+    )
+  }
+  const targetDir = join(templateDir, ORCAD_TEMPLATE_TARGETS_DIR, target)
+  const targetIdentity = join(targetDir, ORCAD_BUILD_TARGET_FILENAME)
+  verifyFile(targetIdentity, targetSha256, `${target} build target`)
+  if (readFileSync(targetIdentity, 'utf8').trim() !== target) {
+    throw new Error(`[verify-packaged-orcad-template] ${target} build target identity disagrees`)
+  }
+  verifyFile(join(targetDir, 'watcher.node'), watcherSha256, `${target} watcher`)
+
+  const expectedFiles = [ORCAD_BUILD_TARGET_FILENAME, 'watcher.node']
+  if (hasBrowserName) {
+    const browserName = targetManifest.browserName
+    if (
+      typeof browserName !== 'string' ||
+      !BROWSER_NAME_PATTERN.test(browserName) ||
+      basename(browserName) !== browserName
+    ) {
+      throw new Error(`[verify-packaged-orcad-template] ${target} browserName is invalid`)
+    }
+    verifyFile(
+      join(targetDir, browserName),
+      requireSha256(targetManifest.browserSha256, `${target} browserSha256`),
+      `${target} browser`
+    )
+    expectedFiles.push(browserName)
+  }
+  requireExactNames(readdirSync(targetDir), expectedFiles, `${target} file inventory`)
+}
+
+function verifyPackagedOrcadTemplate(resourcesDir) {
+  const templateDir = join(resourcesDir, 'orcad-template')
+  const manifest = requireRecord(readManifest(templateDir), 'manifest')
+  if (manifest.schemaVersion !== 2) {
+    throw new Error('[verify-packaged-orcad-template] manifest schemaVersion must be 2')
+  }
+  const commonSha256 = requireRecord(manifest.commonSha256, 'commonSha256')
+  const commonFilenames = orcadTemplateCommonFilenames()
+  requireExactNames(Object.keys(commonSha256), commonFilenames, 'common manifest inventory')
+  for (const filename of commonFilenames) {
+    verifyFile(
+      join(templateDir, ...filename.split('/')),
+      requireSha256(commonSha256[filename], `${filename} checksum`),
+      filename
+    )
+  }
+
+  const targets = requireRecord(manifest.targets, 'targets')
+  requireExactNames(Object.keys(targets), ORCAD_TEMPLATE_TARGETS, 'target manifest inventory')
+  requireExactNames(
+    readdirSync(join(templateDir, ORCAD_TEMPLATE_TARGETS_DIR)),
+    ORCAD_TEMPLATE_TARGETS,
+    'target directory inventory'
+  )
+  for (const target of ORCAD_TEMPLATE_TARGETS) {
+    verifyTarget(templateDir, target, targets[target])
+  }
+  console.log(
+    `[verify-packaged-orcad-template] OK — verified ${ORCAD_TEMPLATE_TARGETS.length} Bun targets`
+  )
+}
+
+module.exports = { verifyPackagedOrcadTemplate }
diff --git a/config/scripts/verify-packaged-orcad-template.test.mjs b/config/scripts/verify-packaged-orcad-template.test.mjs
new file mode 100644
index 00000000000..9be9b456439
--- /dev/null
+++ b/config/scripts/verify-packaged-orcad-template.test.mjs
@@ -0,0 +1,93 @@
+import { createRequire } from 'node:module'
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  ORCAD_TEMPLATE_MANIFEST_FILENAME,
+  ORCAD_TEMPLATE_TARGETS_DIR
+} from '../../src/shared/orcad-artifacts.ts'
+import { writeOrcadTemplateTestFixture } from './orcad-template-test-fixture.mjs'
+
+const require = createRequire(import.meta.url)
+const { verifyPackagedOrcadTemplate } = require('./verify-packaged-orcad-template.cjs')
+const builderConfig = require('../electron-builder.config.cjs')
+const roots = []
+
+async function createFixture() {
+  const root = await mkdtemp(join(tmpdir(), 'orca-packaged-orcad-template-'))
+  roots.push(root)
+  const templateDir = await writeOrcadTemplateTestFixture(root)
+  return { root, templateDir }
+}
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('verifyPackagedOrcadTemplate', () => {
+  it('accepts the exact six-target packaged template', async () => {
+    const fixture = await createFixture()
+
+    expect(() => verifyPackagedOrcadTemplate(fixture.root)).not.toThrow()
+  })
+
+  it('rejects target-native bytes changed after manifest generation', async () => {
+    const fixture = await createFixture()
+    await writeFile(
+      join(fixture.templateDir, ORCAD_TEMPLATE_TARGETS_DIR, 'linux-x64-glibc', 'watcher.node'),
+      'mutated'
+    )
+
+    expect(() => verifyPackagedOrcadTemplate(fixture.root)).toThrow(
+      'linux-x64-glibc watcher checksum mismatch'
+    )
+  })
+
+  it('rejects a missing Windows PTY gate worker', async () => {
+    const fixture = await createFixture()
+    await rm(join(fixture.templateDir, 'windows-bun-pty-gate-entry.js'))
+
+    expect(() => verifyPackagedOrcadTemplate(fixture.root)).toThrow('windows-bun-pty-gate-entry.js')
+  })
+
+  it.each(['writer', 'backup'])(
+    'requires the profile %s worker and its exact bytes',
+    async (role) => {
+      const fixture = await createFixture()
+      const filename = `profile-state-${role}-worker-entry.js`
+      await writeFile(join(fixture.templateDir, filename), 'stale-worker')
+      expect(() => verifyPackagedOrcadTemplate(fixture.root)).toThrow(
+        `${filename} checksum mismatch`
+      )
+      await rm(join(fixture.templateDir, filename))
+      expect(() => verifyPackagedOrcadTemplate(fixture.root)).toThrow(`missing ${filename}`)
+    }
+  )
+
+  it('rejects a missing target before the package reaches deployment', async () => {
+    const fixture = await createFixture()
+    const manifestPath = join(fixture.templateDir, ORCAD_TEMPLATE_MANIFEST_FILENAME)
+    const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+    delete manifest.targets['linux-arm64-musl']
+    await writeFile(manifestPath, JSON.stringify(manifest))
+
+    expect(() => verifyPackagedOrcadTemplate(fixture.root)).toThrow(
+      'target manifest inventory mismatch'
+    )
+  })
+
+  it('does not ship the unused deployment template in desktop packages', async () => {
+    for (const platform of ['win', 'mac', 'linux']) {
+      expect(
+        builderConfig[platform].extraResources.some(
+          (resource) => typeof resource === 'object' && resource.to.startsWith('orcad-template')
+        )
+      ).toBe(false)
+    }
+    const { scripts } = JSON.parse(await readFile(join(process.cwd(), 'package.json'), 'utf8'))
+    for (const name of ['build:desktop', 'build:release', 'build:release:parallel']) {
+      expect(scripts[name]).not.toContain('build:orcad-template')
+    }
+  })
+})
diff --git a/config/scripts/vitest-caller-identity-env-setup.ts b/config/scripts/vitest-caller-identity-env-setup.ts
new file mode 100644
index 00000000000..1d14998e46c
--- /dev/null
+++ b/config/scripts/vitest-caller-identity-env-setup.ts
@@ -0,0 +1,8 @@
+/**
+ * Why: a structured chat exports its own orchestration caller identity to every child, including a
+ * test runner it launches. Inherited, it would decide which CLI identity branch a test exercises
+ * depending on who ran the suite; suites that need one set it themselves.
+ */
+for (const name of ['ORCA_AGENT_SESSION_ID', 'ORCA_STRUCTURED_SESSION']) {
+  delete process.env[name]
+}
diff --git a/config/scripts/win-crash-survival-e2e.test.mjs b/config/scripts/win-crash-survival-e2e.test.mjs
index 40a2e1bb483..9c772eb01eb 100644
--- a/config/scripts/win-crash-survival-e2e.test.mjs
+++ b/config/scripts/win-crash-survival-e2e.test.mjs
@@ -1,4 +1,3 @@
-import { readFileSync } from 'node:fs'
 import { describe, expect, it, vi } from 'vitest'
 import { parseArgs } from '../../tests/tools/win-crash-survival-e2e/cli-args.mjs'
 import { buildCrashAssertions } from '../../tests/tools/win-crash-survival-e2e/crash-assertions.mjs'
@@ -13,26 +12,6 @@ import { closeApp, resolveElectronMainPid } from '../../tests/tools/win-update-e
 import { isPidAlive } from '../../tests/tools/win-update-e2e/daemon-processes.mjs'
 
 describe('win-crash-survival-e2e proof contracts', () => {
-  it('keeps the packaged proof manually dispatchable without a PR trigger', () => {
-    const workflow = readFileSync('.github/workflows/win-crash-survival-e2e.yml', 'utf8')
-    expect(workflow).not.toMatch(/^  pull_request:/m)
-    expect(workflow).toMatch(/^  workflow_dispatch:/m)
-    expect(workflow).not.toMatch(/^  push:/m)
-    expect(workflow).toContain('--expect "$env:EXPECT"')
-    expect(workflow).toContain('exit $LASTEXITCODE')
-    expect(workflow).toContain("'!config/**/*.test.*'")
-    expect(workflow).toContain("'!src/**/*.test.*'")
-    expect(workflow).toContain("'!src/**/*.bench.*'")
-    expect(workflow).toContain("'!config/reliability-gates.jsonc'")
-    expect(workflow).toContain("'resources/**'")
-    expect(workflow).toContain('cache: pnpm')
-    expect(workflow.indexOf('- name: Setup Node.js')).toBeGreaterThan(
-      workflow.indexOf('- name: Setup pnpm')
-    )
-    expect(workflow).toContain("if: steps.cache-installer.outputs.cache-hit != 'true'")
-    expect(workflow).toContain('crash-survival-electron-builder-')
-  })
-
   it('requires the full survival oracle, including daemon identity and reattach', () => {
     const base = {
       profile: 'survival',
@@ -58,15 +37,6 @@ describe('win-crash-survival-e2e proof contracts', () => {
     ).toBe(false)
   })
 
-  it('scans for FailFast only after the post-crash input probe', () => {
-    const harness = readFileSync('tests/tools/win-crash-survival-e2e/run.mjs', 'utf8')
-    const scanIndex = harness.indexOf('const { events: failFastEvents }')
-    const probeIndex = harness.indexOf('reattachProven = await proveReattachedShell')
-    expect(scanIndex).not.toBe(-1)
-    expect(probeIndex).not.toBe(-1)
-    expect(scanIndex).toBeGreaterThan(probeIndex)
-  })
-
   it('fails closed when the Windows event log query fails', () => {
     let command = ''
     expect(() =>
@@ -162,11 +132,7 @@ describe('win-crash-survival-e2e proof contracts', () => {
     expect(reattachSentinelMatches('1660|canary|extra', 'canary', 1660)).toBe(false)
   })
 
-  it('requires the real packaged main for the crash proof but permits fallback cleanup', async () => {
-    const harness = readFileSync('tests/tools/win-crash-survival-e2e/run.mjs', 'utf8')
-    expect(harness).toContain(
-      'resolveElectronMainPid(session.app, { allowLauncherFallback: false })'
-    )
+  it('resolves the real packaged main but permits fallback cleanup', async () => {
     expect(
       await resolveElectronMainPid({
         evaluate: async () => 222,
diff --git a/config/scripts/win32-test-lane-registration.test.mjs b/config/scripts/win32-test-lane-registration.test.mjs
index a1566c55c31..0cd947f722b 100644
--- a/config/scripts/win32-test-lane-registration.test.mjs
+++ b/config/scripts/win32-test-lane-registration.test.mjs
@@ -69,7 +69,10 @@ import { classifyPrJobs } from './pr-code-change-scope.mjs'
 
 const projectDir = resolve(import.meta.dirname, '../..')
 const WINDOWS_LANE_JOB = 'package_windows'
-const WINDOWS_LANE_STEP = 'Test Windows-specific boundaries'
+const WINDOWS_LANE_STEPS = [
+  'Test Windows-specific boundaries',
+  'Test Windows installer process probe'
+]
 const WINDOWS_LANE_RUNNER = 'windows-2022'
 
 /**
@@ -288,19 +291,20 @@ function readWindowsWorkflow() {
   const jobs = Object.entries(workflow.jobs ?? {})
   const windowsJobs = jobs.filter(([, job]) => couldRunOnWindows(job?.['runs-on']))
   const steps = workflow.jobs?.[WINDOWS_LANE_JOB]?.steps ?? []
-  const step = steps.find((candidate) => candidate?.name === WINDOWS_LANE_STEP)
-  if (!step) {
-    throw new Error(
-      `No "${WINDOWS_LANE_STEP}" step in the ${WINDOWS_LANE_JOB} job of .github/workflows/pr.yml. ` +
-        'If it was renamed, update WINDOWS_LANE_STEP here -- do not delete this guard.'
-    )
-  }
-  const run = String(step.run ?? '')
-  if (!run.includes('vitest run')) {
-    throw new Error(
-      `The "${WINDOWS_LANE_STEP}" step no longer invokes vitest; this guard is stale.`
-    )
-  }
+  const runs = WINDOWS_LANE_STEPS.map((name) => {
+    const step = steps.find((candidate) => candidate?.name === name)
+    if (!step) {
+      throw new Error(
+        `No "${name}" step in ${WINDOWS_LANE_JOB}; update WINDOWS_LANE_STEPS if renamed.`
+      )
+    }
+    const run = String(step.run ?? '')
+    if (!run.includes('vitest run')) {
+      throw new Error(`The "${name}" step no longer invokes vitest; this guard is stale.`)
+    }
+    return run
+  })
+  const run = runs.join(' ')
   return {
     windowsJobNames: windowsJobs.map(([name]) => name),
     laneFiles: run.split(/\s+/).filter((token) => TEST_FILE_PATTERN.test(token))
@@ -331,7 +335,7 @@ function registrationFailure(path) {
   const missing = []
   if (!laneFiles.includes(path)) {
     missing.push(
-      `add "${path}" to the "${WINDOWS_LANE_STEP}" vitest argv in .github/workflows/pr.yml ` +
+      `add "${path}" to the "${WINDOWS_LANE_STEPS[0]}" vitest argv in .github/workflows/pr.yml ` +
         `(job ${WINDOWS_LANE_JOB})`
     )
   }
diff --git a/config/scripts/windows-process-tree-creation-time.cjs b/config/scripts/windows-process-tree-creation-time.cjs
index 88f231f14d3..769cd885434 100644
--- a/config/scripts/windows-process-tree-creation-time.cjs
+++ b/config/scripts/windows-process-tree-creation-time.cjs
@@ -1,7 +1,7 @@
 'use strict'
 
 /**
- * Prove the COMPILED addon understands `CREATIONTIME`, not just the patched JS.
+ * Prove the compiled addon supports table and synchronous process creation-time reads.
  *
  * Unlike node-pty, this package ships a prebuilt `.node` at the same
  * `build/Release/` path node-gyp writes to, so neither a load nor a path check
@@ -23,17 +23,19 @@ function assertWindowsProcessTreeCreationTime({ module, platform = process.platf
     return
   }
   const supported = module?.supportedProcessDataFlags
-  if (typeof supported === 'number' && (supported & CREATION_TIME_FLAG) !== 0) {
+  if (
+    typeof supported === 'number' &&
+    (supported & CREATION_TIME_FLAG) !== 0 &&
+    typeof module?.getProcessCreationTime === 'function'
+  ) {
     return
   }
   throw new Error(
     [
-      '@vscode/windows-process-tree does not report CreationTime support',
+      '@vscode/windows-process-tree does not report CreationTime support with a synchronous identity getter',
       `(supportedProcessDataFlags=${String(supported)}).`,
-      'That is the tarball prebuilt, not a build of the patched source, so every',
-      'process row comes back without creationTimeMs: Windows descendant exit',
-      'verification cannot identify a PID and structured Claude/Codex chat runs',
-      'with an unprovable child-tree reaper.',
+      'This is an unpatched or older binary, so process identities or synchronous',
+      'profile-owner recovery are unavailable.',
       'Rebuild it from source so config/patches/@vscode__windows-process-tree@0.8.0.patch applies.'
     ].join(' ')
   )
diff --git a/config/scripts/windows-process-tree-creation-time.test.mjs b/config/scripts/windows-process-tree-creation-time.test.mjs
new file mode 100644
index 00000000000..8bfbf17d713
--- /dev/null
+++ b/config/scripts/windows-process-tree-creation-time.test.mjs
@@ -0,0 +1,37 @@
+import { createRequire } from 'node:module'
+import { expect, it } from 'vitest'
+
+const { assertWindowsProcessTreeCreationTime } = createRequire(import.meta.url)(
+  './windows-process-tree-creation-time.cjs'
+)
+
+it('rejects a previously patched binary that has table creation times but no synchronous getter', () => {
+  expect(() =>
+    assertWindowsProcessTreeCreationTime({
+      platform: 'win32',
+      module: { supportedProcessDataFlags: 7 }
+    })
+  ).toThrow('synchronous identity getter')
+})
+
+it('accepts the compiled capability only when both readers are available', () => {
+  expect(() =>
+    assertWindowsProcessTreeCreationTime({
+      platform: 'win32',
+      module: { supportedProcessDataFlags: 7, getProcessCreationTime: () => undefined }
+    })
+  ).not.toThrow()
+})
+
+it('still rejects a binary without table creation-time support', () => {
+  expect(() =>
+    assertWindowsProcessTreeCreationTime({
+      platform: 'win32',
+      module: { getProcessCreationTime: () => undefined }
+    })
+  ).toThrow('CreationTime support')
+})
+
+it('does not require Windows native capabilities on another platform', () => {
+  expect(() => assertWindowsProcessTreeCreationTime({ platform: 'darwin' })).not.toThrow()
+})
diff --git a/config/scripts/windows-process-tree-gyp-path.test.mjs b/config/scripts/windows-process-tree-gyp-path.test.mjs
index f1d3742e583..0f8a651e12f 100644
--- a/config/scripts/windows-process-tree-gyp-path.test.mjs
+++ b/config/scripts/windows-process-tree-gyp-path.test.mjs
@@ -1,43 +1,13 @@
 import { execFileSync } from 'node:child_process'
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync } from 'node:fs'
 import { isAbsolute, join, resolve } from 'node:path'
 import { describe, expect, it } from 'vitest'
 
 const projectDir = resolve(import.meta.dirname, '../..')
-const PATCH = readFileSync(
-  join(projectDir, 'config/patches/@vscode__windows-process-tree@0.8.0.patch'),
-  'utf8'
-)
 const PACKAGE_DIR = join(projectDir, 'node_modules', '@vscode', 'windows-process-tree')
 const RESOLVED_GYP = "require.resolve('node-addon-api/node_addon_api.gyp')"
 
 describe('windows-process-tree node-addon-api gyp path', () => {
-  it('stages headers without a pnpm-sensitive gyp dependency', () => {
-    expect(PATCH).not.toContain('+        "../../node-addon-api')
-    expect(PATCH).toContain('+          "include_dirs": ["deps/node-addon-api"],')
-    expect(PATCH).toContain('+          "defines": ["NAPI_CPP_EXCEPTIONS", "_HAS_EXCEPTIONS=1"],')
-    const buildScript = readFileSync(
-      join(projectDir, 'config/scripts/build-windows-process-tree-relay-addon.mjs'),
-      'utf8'
-    )
-    expect(buildScript).toContain('stageWindowsProcessTreeNodeAddonApiHeaders(PACKAGE_DIR)')
-    expect(buildScript).toContain('Repaired un-applied pnpm patch hunks before build.')
-    const rebuildHelper = readFileSync(
-      join(projectDir, 'config/scripts/windows-process-tree-gyp-rebuild.mjs'),
-      'utf8'
-    )
-    expect(rebuildHelper).toContain("createRequire(join(packageDir, 'package.json'))")
-    expect(rebuildHelper).toContain("resolve('node-addon-api/package.json')")
-    expect(rebuildHelper).toContain("'napi.h'")
-    expect(rebuildHelper).toContain("'napi-inl.h'")
-    expect(rebuildHelper).toContain("'napi-inl.deprecated.h'")
-    const rebuildScript = readFileSync(
-      join(projectDir, 'config/scripts/rebuild-native-deps.mjs'),
-      'utf8'
-    )
-    expect(rebuildScript).toContain('stageWindowsProcessTreeNodeAddonApiHeaders()')
-  })
-
   // The installed Windows dependency is exercised by the Windows CI lane.
   it.runIf(process.platform === 'win32')(
     'resolves node_addon_api.gyp to a real file from the package directory',
diff --git a/config/scripts/windows-process-tree-gyp-rebuild.mjs b/config/scripts/windows-process-tree-gyp-rebuild.mjs
index 6f21fb2a153..befbcf96acc 100644
--- a/config/scripts/windows-process-tree-gyp-rebuild.mjs
+++ b/config/scripts/windows-process-tree-gyp-rebuild.mjs
@@ -39,9 +39,13 @@ const CREATION_TIME_PATCH_MARKERS = [
   ['src/process.cc', 'GetProcessCreationTime(pinfo)'],
   ['src/process.cc', 'GetProcessTimes(hProcess, &creationTime'],
   ['src/process_worker.cc', 'object.Set("creationTimeMs"'],
+  ['src/addon.cc', 'exports.Set("getProcessCreationTime"'],
   ['lib/index.js', '["CreationTime"] = 4'],
+  ['lib/index.js', 'exports.getProcessCreationTime'],
   ['lib/index.ts', 'CreationTime = 4'],
-  ['typings/windows-process-tree.d.ts', 'creationTimeMs?: number']
+  ['lib/index.ts', 'export const getProcessCreationTime'],
+  ['typings/windows-process-tree.d.ts', 'creationTimeMs?: number'],
+  ['typings/windows-process-tree.d.ts', 'export const getProcessCreationTime']
 ]
 
 export const WINDOWS_PROCESS_TREE_NODE_ADDON_API_HEADERS = [
diff --git a/config/scripts/windows-pty-native-capability-workflow.test.mjs b/config/scripts/windows-pty-native-capability-workflow.test.mjs
deleted file mode 100644
index e1742a43bb0..00000000000
--- a/config/scripts/windows-pty-native-capability-workflow.test.mjs
+++ /dev/null
@@ -1,88 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { describe, expect, it } from 'vitest'
-import { parse } from 'yaml'
-
-const workflow = parse(readFileSync('.github/workflows/pr.yml', 'utf8'))
-const packageJson = JSON.parse(readFileSync('package.json', 'utf8'))
-
-describe('packaged Windows PTY native capability routing', () => {
-  it('runs the packaged executable immediately after the unpacked app is built', () => {
-    const job = workflow.jobs.package_windows
-    const packageIndex = job.steps.findIndex((step) => step.name === 'Package unpacked app')
-    const smokeIndex = job.steps.findIndex(
-      (step) => step.name === 'Smoke packaged Windows PTY native capability'
-    )
-    const smoke = job.steps[smokeIndex]
-
-    expect(job['runs-on']).toBe('windows-2022')
-    expect(smokeIndex).toBe(packageIndex + 1)
-    expect(smoke.run).toBe(
-      'pnpm run smoke:windows-pty-native-capability -- --exe=dist/win-unpacked/Orca.exe'
-    )
-    expect(smoke.if).toBeUndefined()
-    expect(smoke['continue-on-error']).toBeUndefined()
-    expect(packageJson.scripts['smoke:windows-pty-native-capability']).toBe(
-      'node tests/tools/windows-pty-native-capability-smoke/run.mjs'
-    )
-  })
-
-  it('keeps patched source rebuild, release build, runtime reuse, and aggregate routing intact', () => {
-    const job = workflow.jobs.package_windows
-    const install = job.steps.find(
-      (step) => step.uses === './.github/actions/install-node-dependencies'
-    )
-    const nodeCacheSave = job.steps.find(
-      (step) => step.name === 'Save compiled Node native modules'
-    )
-    const electronCache = job.steps.find(
-      (step) => step.name === 'Restore compiled Electron native modules'
-    )
-    const build = job.steps.find((step) => step.name === 'Build package inputs')
-    const prepare = job.steps.find((step) => step.name === 'Prepare Electron native runtime')
-    const packageStep = job.steps.find((step) => step.name === 'Package unpacked app')
-    const verify = workflow.jobs.verify.steps.find(
-      (step) => step.name === 'Require successful checks'
-    )
-    const ensureNativeRuntime = readFileSync('config/scripts/ensure-native-runtime.mjs', 'utf8')
-
-    expect(install.with['native-runtime']).toBe('node')
-    expect(install.with['persist-native-cache']).toBe('false')
-    expect(nodeCacheSave.uses).toBe('actions/cache/save@v5')
-    expect(nodeCacheSave.with.key).toContain('-node-node')
-    expect(electronCache.with.key).toContain('-electron-node')
-    for (const cache of [nodeCacheSave, electronCache]) {
-      expect(cache.with.key).toContain('.github/actions/install-node-dependencies/action.yml')
-      expect(cache.with.key).toContain('config/scripts/ensure-native-runtime.mjs')
-      expect(cache.with.key).toContain('config/scripts/rebuild-native-deps.mjs')
-    }
-    expect(ensureNativeRuntime).toContain("runPnpm(['exec', 'node-gyp', 'rebuild']")
-    expect(ensureNativeRuntime).toContain("resolve(moduleDir, 'scripts', 'post-install.js')")
-    expect(build.run).toBe('pnpm run build:release:parallel')
-    expect(build.env.ORCA_REUSE_WINDOWS_CLI_LAUNCHER).toBe('1')
-    expect(prepare.run).toBe('node config/scripts/ensure-native-runtime.mjs --runtime=electron')
-    expect(packageStep.env.ORCA_REUSE_PREPARED_NATIVE_RUNTIME).toBe('1')
-    expect(workflow.jobs.verify.needs).toContain('package_windows')
-    expect(verify.env.PACKAGE_WINDOWS).toBe('${{ needs.package_windows.result }}')
-    expect(verify.run).toContain('"$PACKAGE_WINDOWS"')
-  })
-
-  it('keeps the native probe event-based, scoped, and runnable in packaged Node mode', () => {
-    const driver = readFileSync('tests/tools/windows-pty-native-capability-smoke/run.mjs', 'utf8')
-    const probe = readFileSync(
-      'tests/tools/windows-pty-native-capability-smoke/packaged-node-pty-capability-probe.cjs',
-      'utf8'
-    )
-    const source = `${driver}\n${probe}`
-
-    expect(driver).toContain("ELECTRON_RUN_AS_NODE: '1'")
-    expect(source).not.toMatch(/\b(?:sleep|tasklist|taskkill)\b/i)
-    expect(source).not.toContain('maxRetries')
-    expect(source).not.toContain('retryDelay')
-    expect(source).not.toContain("from 'node:child_process'")
-    expect(source).not.toContain("require('node:child_process')")
-    expect(probe).toContain("'System32', 'wscript.exe'")
-    expect(probe).toContain('real-orca-detached-launcher.vbs')
-    expect(probe).not.toMatch(/cmd\.exe|start "" \/b/i)
-    expect(probe).toContain('native.terminateJob(target._pty, target.pid)')
-  })
-})
diff --git a/config/scripts/windows-pty-table-stress.cjs b/config/scripts/windows-pty-table-stress.cjs
new file mode 100644
index 00000000000..b703e18d19c
--- /dev/null
+++ b/config/scripts/windows-pty-table-stress.cjs
@@ -0,0 +1,156 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const { createHash } = require('node:crypto')
+const { readFileSync, writeSync } = require('node:fs')
+const { dirname, resolve } = require('node:path')
+
+function report(phase, details = {}) {
+  writeSync(1, `${JSON.stringify({ phase, hostPid: process.pid, ...details })}\n`)
+}
+
+async function exerciseTable() {
+  assert.equal(process.platform, 'win32', 'This probe requires real Windows ConPTY')
+  const rounds = Number(process.env.ORCA_PTY_TABLE_STRESS_ROUNDS ?? 8)
+  assert.ok(Number.isInteger(rounds) && rounds > 0 && rounds <= 2000)
+  const pty = require('node-pty')
+  const nativePath = require.resolve('node-pty/lib/utils')
+  const loaded = require(nativePath).loadNativeModule('conpty')
+  const native = loaded.module
+  const addonPath = resolve(dirname(nativePath), loaded.dir, 'conpty.node')
+  report('native', {
+    addonPath,
+    sha256: createHash('sha256').update(readFileSync(addonPath)).digest('hex'),
+    node: process.version,
+    rounds
+  })
+  // Unlike production's fallback, this crash probe requires a host that permits nested jobs.
+  const hostJobAssigned = native.assignCurrentProcessToJob()
+  report('host-job-precondition', { assigned: hostJobAssigned })
+  assert.equal(hostJobAssigned, true, 'Probe precondition: host must permit a crash-cleanup job')
+
+  const spawned = []
+  function spawn(round, slot) {
+    report('spawn', { round, slot })
+    const proc = pty.spawn(process.env.ComSpec || 'cmd.exe', ['/d', '/q'], {
+      cwd: process.cwd(),
+      cols: 80,
+      rows: 24,
+      useConptyDll: true
+    })
+    const record = { proc, output: '', exited: false, closed: false }
+    const marker = `ORCA_PTY_READY_${spawned.length}`
+    let resolveReady
+    record.ready = new Promise((resolve) => {
+      resolveReady = resolve
+    })
+    record.exit = new Promise((resolveExit) => {
+      proc.onExit((event) => {
+        record.exited = true
+        resolveReady(false)
+        resolveExit(event)
+      })
+    })
+    proc.onData((chunk) => {
+      record.output = (record.output + chunk).slice(-2048)
+      if (record.output.includes(marker)) {
+        resolveReady(true)
+      }
+    })
+    spawned.push(record)
+    // Escaping one letter keeps echoed input from satisfying the output marker.
+    proc.write(`echo ${marker.replace('READY', 'REA^DY')}\r`)
+    return record
+  }
+
+  async function waitForReady(records) {
+    let timer
+    try {
+      await Promise.race([
+        Promise.all(
+          records.map(async (record) => {
+            assert.equal(await record.ready, true, `Shell exited before ready: ${record.output}`)
+          })
+        ),
+        new Promise((_, reject) => {
+          timer = setTimeout(() => {
+            const transcripts = records.map(({ proc, output }) => ({ pid: proc.pid, output }))
+            reject(new Error(`PTY readiness timed out: ${JSON.stringify(transcripts)}`))
+          }, 15_000)
+        })
+      ])
+    } finally {
+      clearTimeout(timer)
+    }
+    for (const { proc } of records) {
+      const members = native.listJobProcessIds(proc._pty, proc.pid)
+      assert.ok(members?.includes(proc.pid), `Ready shell ${proc.pid} must retain its job`)
+    }
+    report('ready', { shellPids: records.map(({ proc }) => proc.pid) })
+  }
+
+  function close(record, round, slot) {
+    report('kill', { round, slot, shellPid: record.proc.pid })
+    record.proc.kill()
+    record.closed = true
+  }
+
+  let failure
+  try {
+    const survivor = spawn(-1, -1)
+    await waitForReady([survivor])
+    const slots = []
+    for (let round = 0; round < rounds; round += 1) {
+      for (let slot = 0; slot < 3; slot += 1) {
+        if (slots[slot]) {
+          close(slots[slot], round, slot)
+        }
+        // The next lookup/insertion overlaps the previous shell's native exit watcher.
+        slots[slot] = spawn(round, slot)
+        report('resize-clear-list', { round, slot, shellPid: survivor.proc.pid })
+        survivor.proc.resize(80 + (round % 2), 24)
+        survivor.proc.clear()
+        const members = native.listJobProcessIds(survivor.proc._pty, survivor.proc.pid)
+        assert.ok(members?.includes(survivor.proc.pid), 'A live survivor must retain its job')
+      }
+      // A ready terminal runs kill/resize/clear immediately instead of deferring them.
+      await waitForReady(slots)
+    }
+    assert.equal(survivor.exited, false, survivor.output)
+    report('overlap-complete', { terminals: spawned.length })
+  } catch (error) {
+    failure = { error }
+  } finally {
+    for (const record of spawned) {
+      if (!record.closed) {
+        close(record, -1, -1)
+      }
+    }
+    let timer
+    try {
+      await Promise.race([
+        Promise.all(spawned.map((record) => record.exit)),
+        new Promise((_, reject) => {
+          timer = setTimeout(() => reject(new Error('PTY exit callbacks did not drain')), 15_000)
+        })
+      ])
+    } catch (error) {
+      if (failure) {
+        report('drain-error', { message: error.stack })
+      } else {
+        failure = { error }
+      }
+    } finally {
+      clearTimeout(timer)
+    }
+  }
+  if (failure) {
+    throw failure.error
+  }
+  report('complete', { terminals: spawned.length })
+}
+
+exerciseTable().catch((error) => {
+  report('error', { message: error.stack })
+  process.exitCode = 1
+})
diff --git a/config/scripts/windows-signing-notification.test.mjs b/config/scripts/windows-signing-notification.test.mjs
new file mode 100644
index 00000000000..d5b6671e9d0
--- /dev/null
+++ b/config/scripts/windows-signing-notification.test.mjs
@@ -0,0 +1,37 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+
+const releaseSteps = () =>
+  parse(readFileSync(new URL('../../.github/workflows/release-cut.yml', import.meta.url), 'utf8'))
+    .jobs.build.steps
+const stepNamed = (steps, name) => steps.find((step) => step.name === name)
+
+describe('Windows signing failure notification', () => {
+  it('alerts Slack after signing failures without masking the release failure', () => {
+    const steps = releaseSteps()
+    const notify = stepNamed(steps, 'Notify Slack when Windows signing fails')
+    const names = steps.map((step) => step.name)
+    expect(stepNamed(steps, 'Install SignPath PowerShell module').id).toBe('install-signpath')
+    expect(notify.if).toBe(
+      "failure() && matrix.platform == 'win' && github.run_attempt == 1 && steps.install-signpath.outcome != '' && steps.install-signpath.outcome != 'skipped'"
+    )
+    expect(notify['continue-on-error']).toBe(true)
+    expect(names.indexOf(notify.name)).toBeGreaterThan(
+      names.indexOf('Verify Windows inner binary signatures')
+    )
+    expect(names.indexOf(notify.name)).toBeLessThan(
+      names.indexOf('Publish signed Windows release artifacts')
+    )
+    expect(notify.env.SLACK_WEBHOOK_URL).toBe('${{ secrets.SLACK_WEBHOOK_URL }}')
+    expect(notify.env.INNER_REQUEST_ID).toContain(
+      'steps.submit-inner-signing.outputs.signing-request-id'
+    )
+    expect(notify.env.INSTALLER_REQUEST_ID).toContain(
+      'steps.submit-signing-request.outputs.signing-request-id'
+    )
+    expect(notify.run).toContain('Publication is blocked.')
+    expect(notify.run).toContain('Late SignPath approval does not resume this run')
+    expect(notify.run).toContain('Invoke-RestMethod -Method Post')
+  })
+})
diff --git a/config/scripts/windows-signing-workflow-contract.test.mjs b/config/scripts/windows-signing-workflow-contract.test.mjs
deleted file mode 100644
index c321db8cfd2..00000000000
--- a/config/scripts/windows-signing-workflow-contract.test.mjs
+++ /dev/null
@@ -1,458 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { createRequire } from 'node:module'
-import { join, resolve } from 'node:path'
-import { describe, expect, it } from 'vitest'
-import { parse } from 'yaml'
-
-const projectDir = resolve(import.meta.dirname, '../..')
-
-const readWorkflow = (relativePath) => parse(readFileSync(join(projectDir, relativePath), 'utf8'))
-
-describe('Windows signing workflow contract', () => {
-  it('preflights SignPath module install before Windows signing side effects', () => {
-    const parsedWorkflow = readWorkflow('.github/workflows/release-cut.yml')
-    const steps = parsedWorkflow.jobs.build.steps
-    const stepNames = steps.map((step) => step.name)
-    const installStepIndexes = stepNames.flatMap((name, index) =>
-      name === 'Install SignPath PowerShell module' ? [index] : []
-    )
-    const buildIndex = stepNames.indexOf('Build Windows release artifacts')
-    const verifyNodePtyIndex = stepNames.indexOf('Verify Windows node-pty ConPTY runtime')
-    const uploadIndex = stepNames.indexOf('Upload unsigned Windows installer for SignPath')
-    const downloadIndex = stepNames.indexOf('Download signed Windows installer from SignPath')
-
-    expect(verifyNodePtyIndex).toBe(buildIndex + 1)
-    expect(installStepIndexes).toEqual([verifyNodePtyIndex + 1])
-    expect(installStepIndexes[0]).toBeLessThan(uploadIndex)
-
-    expect(steps[verifyNodePtyIndex].run).toContain(
-      'dist/win-unpacked/resources/node_modules/node-pty/build/Release'
-    )
-    expect(steps[verifyNodePtyIndex].run).toContain('conpty/conpty.dll')
-
-    const uploadThroughDownloadScript = steps
-      .slice(uploadIndex, downloadIndex + 1)
-      .map((step) => step.run ?? '')
-      .join('\n')
-
-    expect(uploadThroughDownloadScript).not.toContain('Install-Module -Name SignPath')
-
-    const installStep = steps[installStepIndexes[0]]
-
-    expect(installStep.if).toBe("matrix.platform == 'win' && github.run_attempt == 1")
-    expect(installStep.uses).toBe('./.github/actions/install-signpath-module')
-    expect(installStep.run).toBeUndefined()
-
-    const installAction = readWorkflow('.github/actions/install-signpath-module/action.yml')
-    const actionStep = installAction.runs.steps[0]
-    const installRun = actionStep.run
-    const sleepSeconds = [...installRun.matchAll(/Start-Sleep -Seconds (\d+)/g)].map(
-      ([, seconds]) => seconds
-    )
-
-    expect(installAction.runs.using).toBe('composite')
-    expect(actionStep.shell).toBe('pwsh')
-    expect(installRun).toContain(
-      'if ($null -eq (Get-PSRepository -Name PSGallery -ErrorAction SilentlyContinue))'
-    )
-    expect(installRun).toContain('Register-PSRepository -Default -InstallationPolicy Trusted')
-    expect(installRun).toContain('Set-PSRepository -Name PSGallery -InstallationPolicy Trusted')
-    expect(installRun).toMatch(/\$env:PSModulePath -split \[System\.IO\.Path\]::PathSeparator/)
-    expect(installRun).toContain(
-      "$signPathModulePath = Join-Path -Path $currentUserModuleRoot -ChildPath 'SignPath'"
-    )
-    expect(installRun).toMatch(/for \(\$attempt = 1; \$attempt -le 3; \$attempt\+\+\)/)
-    expect(sleepSeconds).toContain('15')
-    expect(sleepSeconds).toContain('30')
-    expect(installRun).toContain(
-      'Install-Module -Name SignPath -Repository PSGallery -MinimumVersion 4.0.0 -MaximumVersion 4.999.999 -Scope CurrentUser -Force -AllowClobber -ErrorAction Stop'
-    )
-    expect(installRun).toContain('Import-Module SignPath -ErrorAction Stop')
-    expect(installRun).toContain(
-      'Get-Command -Name Get-SignedArtifact -Module SignPath -ErrorAction Stop'
-    )
-    expect(installRun).toContain('Remove-Item -LiteralPath $signPathModulePath -Recurse -Force')
-    expect(installRun).not.toContain('SignPath*')
-    expect(installRun).not.toMatch(/throw\s+\$_/)
-  })
-
-  it('falls back to a hash-pinned SignPath nupkg when the gallery API is down', () => {
-    const installAction = readWorkflow('.github/actions/install-signpath-module/action.yml')
-    const installRun = installAction.runs.steps[0].run
-
-    // Why: the gallery API 403s during Azure Front Door incidents while its CDN
-    // stays up, so a pinned nupkg is the fallback. The hash pin is the only
-    // integrity check on that route — losing it would let any payload install.
-    const { 'fallback-version': version, 'fallback-sha256': sha256 } = installAction.inputs
-    expect(version.default).toMatch(/^4\.\d+\.\d+$/)
-    expect(sha256.default).toMatch(/^[0-9a-f]{64}$/)
-    expect(installRun).toContain('Get-FileHash -LiteralPath $nupkg -Algorithm SHA256')
-    expect(installRun).toContain('$actualHash -ne $expectedHash.ToUpperInvariant()')
-    expect(installRun).toContain('throw "SHA-256 mismatch for $source')
-    expect(installRun).toContain(
-      'https://cdn.powershellgallery.com/packages/signpath.$version.nupkg'
-    )
-
-    // The module only resolves by name when the folder matches its ModuleVersion.
-    expect(installRun).toContain(
-      '$versionRoot = Join-Path -Path $signPathModulePath -ChildPath $version'
-    )
-    // The fallback only runs after the gallery route is exhausted, and still
-    // fails the job when neither route produced a usable module.
-    expect(installRun.indexOf('$installed = $true')).toBeLessThan(
-      installRun.indexOf('if (-not $installed)')
-    )
-    expect(installRun).toContain('throw "Unable to install the SignPath PowerShell module')
-  })
-
-  it('still installs SignPath when the cut ref predates the composite action', () => {
-    const parsedWorkflow = readWorkflow('.github/workflows/release-cut.yml')
-    const steps = parsedWorkflow.jobs.build.steps
-    const stepNames = steps.map((step) => step.name)
-    const checkoutIndex = stepNames.indexOf('Checkout')
-    const restoreIndex = stepNames.indexOf('Restore composite actions from the workflow ref')
-    const installIndex = stepNames.indexOf('Install SignPath PowerShell module')
-
-    // Why: the build job checks out the cut tag, which for a hotfix cut from an
-    // older ref can predate `.github/actions/install-signpath-module`; without
-    // this restore the `uses: ./…` step dies on a missing action.yml.
-    expect(restoreIndex).toBeGreaterThan(checkoutIndex)
-    expect(restoreIndex).toBeLessThan(installIndex)
-
-    const restoreStep = steps[restoreIndex]
-    const restoreRun = restoreStep.run
-
-    expect(restoreStep.env.WORKFLOW_SHA).toBe('${{ github.workflow_sha }}')
-    expect(restoreRun).toContain('.github/actions/install-signpath-module/action.yml')
-    expect(restoreRun).toContain('git fetch --no-tags --depth=1 origin "$WORKFLOW_SHA"')
-    expect(restoreRun).toContain('git checkout "$WORKFLOW_SHA" -- .github/actions')
-
-    // Why: restoring the action must not turn signing into a soft dependency —
-    // a missing module still has to fail the Windows job, and the CDN fallback
-    // still has to reject an unexpected payload.
-    expect(steps[installIndex]['continue-on-error']).toBeUndefined()
-    expect(restoreStep['continue-on-error']).toBeUndefined()
-
-    const installRun = readWorkflow('.github/actions/install-signpath-module/action.yml').runs
-      .steps[0].run
-
-    expect(installRun).toContain('$actualHash -ne $expectedHash.ToUpperInvariant()')
-    expect(installRun).toContain('throw "SHA-256 mismatch for $source')
-  })
-
-  it('never recreates Windows signing requests on a workflow rerun', () => {
-    const parsedWorkflow = readWorkflow('.github/workflows/release-cut.yml')
-    const steps = parsedWorkflow.jobs.build.steps
-    const stepNames = steps.map((step) => step.name)
-    const skipStep = steps.find((step) => step.name === 'Skip Windows artifact rebuild on rerun')
-
-    expect(skipStep?.if).toBe("matrix.platform == 'win' && github.run_attempt != 1")
-    expect(skipStep?.run).toContain('Existing signed release assets must be reused')
-
-    const signingStepNames = [
-      'Build Windows release artifacts',
-      'Stage unsigned inner PE files for signing',
-      'Upload unsigned inner binaries for SignPath',
-      'Submit inner binaries signing request',
-      'Download signed inner binaries from SignPath',
-      'Upload unsigned Windows installer for SignPath',
-      'Submit Windows installer signing request',
-      'Download signed Windows installer from SignPath',
-      'Stage signed Windows release assets',
-      'Publish signed Windows release artifacts'
-    ]
-
-    for (const stepName of signingStepNames) {
-      const step = steps[stepNames.indexOf(stepName)]
-      expect(step?.if, stepName).toContain('github.run_attempt == 1')
-    }
-  })
-
-  it('shares one SignPath module install path between release and rehearsal', () => {
-    const rehearsalWorkflow = readWorkflow('.github/workflows/windows-signing-rehearsal.yml')
-    const stepNames = rehearsalWorkflow.jobs.rehearse.steps.map((step) => step.name)
-    const installIndex = stepNames.indexOf('Install SignPath PowerShell module')
-
-    // Why: the rehearsal exists to prove the real signing flow, so it must
-    // install the module exactly the way the release job does.
-    expect(rehearsalWorkflow.jobs.rehearse.steps[installIndex].uses).toBe(
-      './.github/actions/install-signpath-module'
-    )
-    expect(rehearsalWorkflow.jobs.rehearse.steps[installIndex].run).toBeUndefined()
-    expect(installIndex).toBeLessThan(
-      stepNames.indexOf('Download signed inner binaries from SignPath')
-    )
-  })
-
-  it('verifies Windows inner binary signatures fail-open before publishing', () => {
-    const parsedWorkflow = readWorkflow('.github/workflows/release-cut.yml')
-    const steps = parsedWorkflow.jobs.build.steps
-    const stepNames = steps.map((step) => step.name)
-    const outerVerifyIndex = stepNames.indexOf('Verify signed Windows installer')
-    const innerVerifyIndex = stepNames.indexOf('Verify Windows inner binary signatures')
-    const evidenceIndex = stepNames.indexOf('Upload Windows inner signing evidence')
-    const publishIndex = stepNames.indexOf('Publish signed Windows release artifacts')
-
-    expect(outerVerifyIndex).toBeGreaterThan(-1)
-    expect(innerVerifyIndex).toBe(outerVerifyIndex + 1)
-    expect(evidenceIndex).toBe(innerVerifyIndex + 1)
-    expect(publishIndex).toBe(evidenceIndex + 1)
-
-    // Why fail-open: unsigned inner binaries must warn, not block, until the
-    // flow is proven on a real release (issue #7785). Flip this to 'true'
-    // together with the workflow env to make the gate required.
-    expect(steps[innerVerifyIndex].env.ORCA_WINDOWS_INNER_SIGNATURE_REQUIRED).toBe('false')
-
-    // Why: every step in the inner-signing chain must be unable to fail the
-    // release — a SignPath outage or timeout falls through to today's
-    // unsigned-inner flow instead of blocking the cut.
-    const innerChainStepNames = [
-      'Stage unsigned inner PE files for signing',
-      'Upload unsigned inner binaries for SignPath',
-      'Submit inner binaries signing request',
-      'Notify Slack that inner-binary signing is waiting for approval',
-      'Download signed inner binaries from SignPath',
-      'Restore signed inner binaries into unpacked app',
-      'Restore signed uninstaller for the installer rebuild',
-      'Replace cached elevate.exe with the signed copy',
-      'Rebuild NSIS installer from signed unpacked app'
-    ]
-    for (const stepName of innerChainStepNames) {
-      const step = steps[stepNames.indexOf(stepName)]
-      expect(step, stepName).toBeDefined()
-      expect(step['continue-on-error'], stepName).toBe(true)
-    }
-  })
-})
-
-// Why these exist: the NSIS uninstaller is generated inside electron-builder's
-// uninstaller pass and deleted immediately after being embedded, so the only way
-// CI can sign it is the export/import relay through win.signtoolOptions.sign.
-// Every link is asserted here the way Orca.exe and conpty_console_list.node are.
-describe('Windows NSIS uninstaller signing', () => {
-  const releaseSteps = () => readWorkflow('.github/workflows/release-cut.yml').jobs.build.steps
-  const stepNamed = (steps, name) => steps.find((step) => step.name === name)
-
-  const EXPORT_ENV = 'ORCA_WIN_UNINSTALLER_EXPORT_PATH'
-  const SIGNED_ENV = 'ORCA_WIN_UNINSTALLER_SIGNED_PATH'
-
-  it('exports the uninstaller from the first Windows build', () => {
-    const build = stepNamed(releaseSteps(), 'Build Windows release artifacts')
-
-    expect(build.env[EXPORT_ENV]).toContain('uninstaller-signing')
-    expect(build.env[EXPORT_ENV]).toContain('orca-uninstaller.exe')
-  })
-
-  // Why this is a test and not a comment: `files` in the electron-builder config
-  // is all-negation, so app-builder packs whatever is left in the checkout root.
-  // These steps retry, and a retried attempt would pack an unsigned .exe into
-  // app.asar — the very defect this chain removes. Every relay path must live
-  // outside the checkout.
-  it('keeps every relay path out of the packed checkout', () => {
-    const relayEnvValues = [
-      ...releaseSteps(),
-      ...readWorkflow('.github/workflows/windows-signing-rehearsal.yml').jobs.rehearse.steps
-    ].flatMap((step) => [step.env?.[EXPORT_ENV], step.env?.[SIGNED_ENV]].filter(Boolean))
-
-    expect(relayEnvValues.length).toBe(4)
-    for (const value of relayEnvValues) {
-      expect(value).toContain('runner.temp')
-      expect(value).not.toContain('github.workspace')
-    }
-
-    const relayScripts = [
-      ...releaseSteps(),
-      ...readWorkflow('.github/workflows/windows-signing-rehearsal.yml').jobs.rehearse.steps
-    ]
-      .map((step) => step.run ?? '')
-      .filter((run) => run.includes('uninstaller-signing'))
-
-    expect(relayScripts.length).toBeGreaterThan(0)
-    for (const run of relayScripts) {
-      // Why count occurrences rather than assert `toContain` once: a step
-      // carrying two relay paths could root the first in RUNNER_TEMP and leave
-      // the second bare-relative — which resolves against the checkout, and is
-      // exactly the shape of the defect this test exists to catch.
-      const mentions = run.match(/uninstaller-signing/g) ?? []
-      const rooted = run.match(/Join-Path \$env:RUNNER_TEMP 'uninstaller-signing/g) ?? []
-
-      expect(rooted.length, run).toBe(mentions.length)
-      expect(run).not.toContain('$env:GITHUB_WORKSPACE')
-    }
-  })
-
-  it('stages the uninstaller into the same request as the inner binaries', () => {
-    const stage = stepNamed(releaseSteps(), 'Stage unsigned inner PE files for signing')
-
-    expect(stage.run).toContain('uninstaller-signing\\unsigned\\orca-uninstaller.exe')
-    expect(stage.run).toContain('uninstaller\\orca-uninstaller.exe')
-    // No third SignPath request: exactly two submissions, as budgeted for the
-    // 1h + 4h approval waits inside the 360-minute job cap.
-    const submissions = releaseSteps().filter(
-      (step) => step.uses === 'signpath/github-action-submit-signing-request@v2'
-    )
-    expect(submissions).toHaveLength(2)
-  })
-
-  // A staged-but-unreturned uninstaller must not fail the inner chain, or a
-  // SignPath artifact-configuration gap would cost the inner-binary signatures.
-  it('keeps the uninstaller out of the inner-binary copy-back list', () => {
-    const stage = stepNamed(releaseSteps(), 'Stage unsigned inner PE files for signing')
-    const restoreInner = stepNamed(
-      releaseSteps(),
-      'Restore signed inner binaries into unpacked app'
-    )
-
-    expect(stage.run).not.toMatch(/\$list\.Add\(['"]uninstaller/)
-    expect(restoreInner.run).not.toContain('orca-uninstaller.exe')
-  })
-
-  // This step's outcome gates the upload of every inner binary, so a filesystem
-  // error while staging the uninstaller must not escape — otherwise one
-  // uninstaller-specific failure costs every inner-binary signature, which is
-  // strictly worse than the behaviour before this chain existed.
-  it('cannot let an uninstaller staging failure cost the inner-binary signatures', () => {
-    const stage = stepNamed(releaseSteps(), 'Stage unsigned inner PE files for signing')
-    const uninstallerBlock = stage.run.slice(stage.run.indexOf('$exportedUninstaller'))
-
-    expect(stage.run).toMatch(/try \{[\s\S]*\$exportedUninstaller[\s\S]*\} catch \{/)
-    expect(uninstallerBlock).toContain('::warning::Could not stage the NSIS uninstaller')
-    expect(uninstallerBlock).not.toContain('throw')
-    // Explicit, so the catch does not silently depend on GitHub's
-    // $ErrorActionPreference='Stop' default for `shell: pwsh`.
-    expect(uninstallerBlock).toContain('New-Item -ItemType Directory -Force -Path (Split-Path')
-    expect(uninstallerBlock).toMatch(/New-Item[^\r\n]*-ErrorAction Stop/)
-    expect(uninstallerBlock).toMatch(/Copy-Item[^\r\n]*-ErrorAction Stop/)
-    // The upload it gates still keys off this step, so the catch is load-bearing.
-    expect(stepNamed(releaseSteps(), 'Upload unsigned inner binaries for SignPath').if).toContain(
-      "steps.stage-inner.outcome == 'success'"
-    )
-  })
-
-  it('re-injects the signed uninstaller into the rebuilt installer', () => {
-    const steps = releaseSteps()
-    const restore = stepNamed(steps, 'Restore signed uninstaller for the installer rebuild')
-    const rebuild = stepNamed(steps, 'Rebuild NSIS installer from signed unpacked app')
-    const names = steps.map((step) => step.name)
-
-    expect(restore.if).toContain('github.run_attempt == 1')
-    expect(restore.if).toContain("steps.restore-signed-inner.outcome == 'success'")
-    expect(restore.run).toContain('orca-uninstaller.exe')
-    expect(names.indexOf(restore.name)).toBeLessThan(names.indexOf(rebuild.name))
-    expect(rebuild.env[SIGNED_ENV]).toContain('uninstaller-signing')
-    // The rebuild must not depend on the uninstaller leg: a missing signed
-    // uninstaller ships today's installer, it does not skip the rebuild.
-    expect(rebuild.if).not.toContain('restore-signed-uninstaller')
-  })
-
-  // NSIS hides the uninstaller in a compressed data section the bundled 7za
-  // cannot read, so the gate proves it from the sign hook's digest receipt
-  // instead of extracting it — and only when the relay actually ran.
-  it('reports the embedded uninstaller in the inner-binary evidence gate', () => {
-    const gate = stepNamed(releaseSteps(), 'Verify Windows inner binary signatures')
-
-    expect(gate.env.UNINSTALLER_SIGNING_COMPLETED).toBe(
-      "${{ steps.restore-signed-uninstaller.outcome == 'success' }}"
-    )
-    expect(gate.run).toContain('.embedded-sha256')
-    expect(gate.run).toContain("$env:UNINSTALLER_SIGNING_COMPLETED -eq 'true'")
-    expect(gate.run).toContain('not signed by SignPath Foundation: Uninstall Orca.exe')
-    // The uninstaller must not join the 7z payload loop, which cannot see it.
-    expect(gate.run).not.toContain("$targets += 'Uninstall Orca.exe'")
-  })
-
-  it('rehearses the uninstaller leg end to end', () => {
-    const steps = readWorkflow('.github/workflows/windows-signing-rehearsal.yml').jobs.rehearse
-      .steps
-    const names = steps.map((step) => step.name)
-    const pack = stepNamed(steps, 'Package Windows app and export the NSIS uninstaller')
-    const rebuild = stepNamed(steps, 'Build NSIS installer from signed unpacked app')
-    const verify = stepNamed(steps, 'Verify signatures end to end')
-
-    // --dir never produces an uninstaller, so the rehearsal has to build the
-    // installer the way release-cut's first Windows pass does.
-    expect(pack.run).toContain('--win --publish never')
-    expect(pack.run).not.toContain('--dir')
-    expect(pack.env[EXPORT_ENV]).toContain('orca-uninstaller.exe')
-    expect(names).toContain('Restore signed uninstaller for the installer rebuild')
-    expect(rebuild.env[SIGNED_ENV]).toContain('orca-uninstaller.exe')
-    expect(verify.run).toContain('.embedded-sha256')
-    // The receipt only proves the import leg ran. The rehearsal is where the
-    // shipped uninstaller itself gets checked — the release job cannot install
-    // onto the runner it publishes from.
-    expect(verify.run).toContain('shipped: Uninstall Orca.exe')
-    expect(verify.run).toContain('-tnsis')
-    expect(verify.run).toContain("-ArgumentList '/S'")
-  })
-
-  // This workflow is the merge gate, so it must not be able to fail on its own
-  // artefact: 7-Zip's NSIS handler is unreliable enough that its output has to
-  // be corroborated before a signature verdict is drawn from it.
-  it('never lets an unreliable extract fail the rehearsal', () => {
-    const steps = readWorkflow('.github/workflows/windows-signing-rehearsal.yml').jobs.rehearse
-      .steps
-    const verify = stepNamed(steps, 'Verify signatures end to end')
-
-    // The 7-Zip route is only trusted when it reproduces the relayed bytes;
-    // otherwise it falls through to the install route rather than failing.
-    expect(verify.run).toContain(
-      'Write-Host "7-Zip\'s NSIS output did not match the relayed digest; falling back to a silent install."'
-    )
-    expect(verify.run).toMatch(/\$installedUninstaller = \$null\r?\n\s*\}/)
-
-    // The comparison that is not tautological: a file NSIS wrote out, against
-    // the digest the sign hook recorded.
-    expect(verify.run).toContain('$shippedDigest -ne $expectedDigest')
-    expect(verify.run).toContain('the uninstaller the installer ships is not the relayed one')
-
-    // An installer that prompts must not hang to the 360-minute job cap, and
-    // the app it launches must not outlive the step holding install-dir handles.
-    expect(verify.run).toContain('-PassThru')
-    expect(verify.run).toContain('$installerProcess.WaitForExit(300000)')
-    expect(verify.run).toContain('the silent install did not exit within 5 minutes')
-    expect(verify.run).toMatch(/for \(\$attempt = 0; \$attempt -lt 20; \$attempt\+\+\)/)
-    expect(verify.run).toContain("Get-Process -Name 'orca-terminal-daemon'")
-  })
-
-  // resources\elevate.exe is downgraded to advisory because app-builder-lib's
-  // CopyElevateHelper clobbers it on every nsis pack — a pre-existing defect
-  // that predates the uninstaller relay and is being tracked separately. The
-  // escape hatch it needed is the kind that quietly grows until the gate
-  // asserts nothing, so pin it to exactly that one file.
-  it('confines the advisory escape hatch to elevate.exe', () => {
-    const steps = readWorkflow('.github/workflows/windows-signing-rehearsal.yml').jobs.rehearse
-      .steps
-    const verify = stepNamed(steps, 'Verify signatures end to end')
-    const advisoryCalls = verify.run
-      .split('\n')
-      .filter((line) => line.includes('-Advisory') && line.includes('Test-Signature'))
-
-    expect(advisoryCalls).toHaveLength(1)
-    expect(advisoryCalls[0]).toContain('installed: $relative')
-    expect(verify.run).toContain("if ($relative -eq 'resources\\elevate.exe')")
-
-    // Both uninstaller verdicts stay fatal — the whole point of the gate.
-    for (const call of ['relayed: orca-uninstaller.exe', 'shipped: Uninstall Orca.exe']) {
-      const line = verify.run
-        .split('\n')
-        .find((it) => it.includes(`Test-Signature`) && it.includes(call))
-      expect(line, call).toBeDefined()
-      expect(line, call).not.toContain('-Advisory')
-    }
-
-    // An advisory must still reach the evidence artifact, or downgrading it
-    // becomes indistinguishable from deleting the check.
-    expect(verify.run).toContain('ADVISORY (known pre-existing')
-    expect(verify.run).toContain('$script:advisories.Add($problem)')
-  })
-
-  it('wires the electron-builder sign hook that the relay depends on', () => {
-    const require = createRequire(import.meta.url)
-    const configPath = resolve(projectDir, 'config/electron-builder.config.cjs')
-    delete require.cache[require.resolve(configPath)]
-    const config = require(configPath)
-
-    expect(typeof config.win.signtoolOptions.sign).toBe('function')
-    delete require.cache[require.resolve(configPath)]
-  })
-})
diff --git a/config/scripts/worktree-refresh-churn-benchmark.mjs b/config/scripts/worktree-refresh-churn-benchmark.mjs
index 5a165801ded..9e7fdffcf3c 100644
--- a/config/scripts/worktree-refresh-churn-benchmark.mjs
+++ b/config/scripts/worktree-refresh-churn-benchmark.mjs
@@ -1,7 +1,16 @@
 #!/usr/bin/env node
 import { performance } from 'node:perf_hooks'
-import { planWorktreeSortOrderUpdates } from '../../src/shared/worktree/sort-order-update.ts'
-import { reuseEqualCatalogRows } from '../../src/renderer/src/store/slices/worktree-catalog-reconciliation.ts'
+import { createJiti } from 'jiti'
+
+// jiti, not a bare `node` import: type-stripping cannot resolve the extensionless
+// relative imports inside the module graph under test.
+const jiti = createJiti(import.meta.url)
+const { planWorktreeSortOrderUpdates } = await jiti.import(
+  '../../src/shared/worktree/sort-order-update.ts'
+)
+const { reuseEqualCatalogRows } = await jiti.import(
+  '../../src/renderer/src/store/slices/worktree-catalog-reconciliation.ts'
+)
 
 const WORKTREE_COUNT = 655
 const TAB_COUNT = 1_895
diff --git a/config/scripts/xterm-dependency-cache.test.mjs b/config/scripts/xterm-dependency-cache.test.mjs
new file mode 100644
index 00000000000..4c4f69191ef
--- /dev/null
+++ b/config/scripts/xterm-dependency-cache.test.mjs
@@ -0,0 +1,72 @@
+import { readFileSync } from 'node:fs'
+import { expect, it } from 'vitest'
+import { parse } from 'yaml'
+
+const readYaml = (path) => parse(readFileSync(new URL(path, import.meta.url), 'utf8'))
+const action = readYaml('../../.github/actions/prepare-xterm-dependencies/action.yml')
+const workflow = readYaml('../../.github/workflows/ci-xterm-cache.yml')
+const restore = action.runs.steps.find((step) => step.id === 'restore')
+
+it('separates toolchains and restores dependencies without a stale fallback or build results', () => {
+  for (const input of [
+    'runner.os',
+    'runtime.outputs.image',
+    'runner.arch',
+    'runtime.outputs.node',
+    'xterm-upstream.json',
+    'regenerate-xterm-patches.mjs',
+    'xterm-patch-text.mjs',
+    'prepare-xterm-dependencies/action.yml'
+  ]) {
+    expect(restore.with.key).toContain(input)
+  }
+  expect(restore.uses).toBe('actions/cache/restore@v5')
+  expect(restore.with['restore-keys']).toBeUndefined()
+  expect(restore.with.path.trim().split('\n')).toEqual([
+    '${{ runner.temp }}/xterm-patch-build/upstream/.git',
+    '${{ runner.temp }}/xterm-patch-build/upstream/node_modules'
+  ])
+})
+
+it('publishes only from main after a successful fresh verification, and skips work on hits', () => {
+  expect(workflow.on.pull_request).toBeUndefined()
+  expect(workflow.on.push.branches).toEqual(['main'])
+  expect(workflow.jobs.seed.if).toBe("github.ref == 'refs/heads/main'")
+  expect(workflow.permissions).toEqual({ contents: 'read' })
+  const steps = workflow.jobs.seed.steps
+  const verify = steps.find((step) => step.name === 'Verify and populate dependencies')
+  const save = steps.find((step) => step.uses === 'actions/cache/save@v5')
+  expect(verify.if).toBe("steps.cache.outputs.cache-hit != 'true'")
+  expect(save.if).toBe(verify.if)
+  expect(save.with.path).toBe(restore.with.path)
+  expect(save.with.key).toBe('${{ steps.cache.outputs.cache-key }}')
+  expect(steps.indexOf(save)).toBeGreaterThan(steps.indexOf(verify))
+  expect(verify.run).toContain('regenerate-xterm-patches.mjs --check')
+  const pr = readYaml('../../.github/workflows/pr.yml').jobs.xterm_patch_sync.steps
+  expect(workflow.jobs.seed['runs-on']).toBe(
+    readYaml('../../.github/workflows/pr.yml').jobs.xterm_patch_sync['runs-on']
+  )
+  expect(pr.some((step) => step.uses === './.github/actions/prepare-xterm-dependencies')).toBe(true)
+  expect(pr.some((step) => /cache(?:\/save)?@/.test(step.uses ?? ''))).toBe(false)
+  expect(pr.at(-1).run).toContain('regenerate-xterm-patches.mjs --check')
+})
+
+it('restores download fallback only on a miss and preserves its established key and paths', () => {
+  const fallback = action.runs.steps.at(-1)
+  const save = workflow.jobs.seed.steps.at(-1)
+  expect(fallback.if).toBe("steps.restore.outputs.cache-hit != 'true'")
+  expect(fallback.uses).toBe('actions/cache/restore@v5')
+  expect(fallback.with).toEqual(save.with)
+  expect(save.if).toBe("steps.cache.outputs.cache-hit != 'true'")
+})
+
+it('runs the standalone generator without installing unrelated Orca dependencies', () => {
+  const steps = readYaml('../../.github/workflows/pr.yml').jobs.xterm_patch_sync.steps
+  expect(steps.some((step) => step.uses === './.github/actions/install-node-dependencies')).toBe(
+    false
+  )
+  expect(steps.find((step) => step.uses === 'actions/setup-node@v6').with).toEqual({
+    'node-version-file': 'package.json',
+    'package-manager-cache': false
+  })
+})
diff --git a/config/scripts/xterm-image-wasm-budget-contract.test.mjs b/config/scripts/xterm-image-wasm-budget-contract.test.mjs
new file mode 100644
index 00000000000..9ec5f4fc750
--- /dev/null
+++ b/config/scripts/xterm-image-wasm-budget-contract.test.mjs
@@ -0,0 +1,160 @@
+import { createRequire } from 'node:module'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+const require = createRequire(import.meta.url)
+const { Terminal } = require('@xterm/xterm')
+const { ImageAddon } = require('@xterm/addon-image')
+
+// V8 caps live wasm memories per renderer (~124 under Electron's sandbox), so
+// these contracts pin that idle terminals hold none and that exhaustion drops
+// an image instead of wedging the terminal's write queue.
+
+const SIXEL_RED_REGISTER_1 = '\x1bPq#1;2;100;0;0#1~\x1b\\'
+const SIXEL_USE_REGISTER_1 = '\x1bPq#1~\x1b\\'
+const PNG_1X1 =
+  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=='
+const IIP_PNG = `\x1b]1337;File=inline=1;size=${Buffer.from(PNG_1X1, 'base64').length}:${PNG_1X1}\x07`
+
+class TrackedBitmap {
+  width = 1
+  height = 1
+  close = vi.fn()
+}
+
+function stubCanvasGlobals() {
+  const painted = []
+  vi.stubGlobal('ImageBitmap', TrackedBitmap)
+  vi.stubGlobal('window', { ImageBitmap: TrackedBitmap })
+  vi.stubGlobal('createImageBitmap', async () => new TrackedBitmap())
+  vi.stubGlobal(
+    'ImageData',
+    class {
+      constructor(data, width, height) {
+        Object.assign(this, { data: new Uint8ClampedArray(data), width, height })
+      }
+    }
+  )
+  vi.stubGlobal('document', {
+    createElement: () => ({
+      width: 0,
+      height: 0,
+      getContext: () => ({ putImageData: (image) => painted.push(image) })
+    })
+  })
+  return painted
+}
+
+function createTerminal(options = {}) {
+  const terminal = new Terminal({ allowProposedApi: true })
+  const addon = new ImageAddon({
+    enableSizeReports: false,
+    storageLimit: 32,
+    kittySizeLimit: 8 * 1024 * 1024,
+    ...options
+  })
+  terminal.loadAddon(addon)
+  return {
+    terminal,
+    addon,
+    sixel: addon._handlers.get('sixel'),
+    iip: addon._handlers.get('iip')
+  }
+}
+
+function write(terminal, data) {
+  return new Promise((resolve) => terminal.write(data, resolve))
+}
+
+// A throw out of a handler leaves xterm's write queue waiting forever.
+function writeOrWedge(terminal, data) {
+  return Promise.race([
+    write(terminal, data).then(() => 'parsed'),
+    new Promise((resolve) => setTimeout(() => resolve('wedged'), 2000))
+  ])
+}
+
+function firstPixel(image) {
+  return Array.from(image.data.subarray(0, 4))
+}
+
+afterEach(() => vi.unstubAllGlobals())
+
+describe('xterm image wasm budget', () => {
+  it('keeps idle terminals free of wasm decoders', async () => {
+    const panes = Array.from({ length: 300 }, () => createTerminal())
+    try {
+      // Let any asynchronous decoder instantiation settle.
+      await new Promise((resolve) => setTimeout(resolve, 100))
+      for (const { sixel, iip } of panes) {
+        expect(sixel._dec).toBeUndefined()
+        expect(iip._dec._inst).toBeNull()
+        expect(iip._qoiDec._inst).toBeFalsy()
+      }
+    } finally {
+      for (const { terminal } of panes) {
+        terminal.dispose()
+      }
+    }
+  })
+
+  it('returns decoders after each SIXEL and IIP image', async () => {
+    const painted = stubCanvasGlobals()
+    const { terminal, addon, sixel, iip } = createTerminal()
+    let added = 0
+    addon.onImageAdded(() => added++)
+    try {
+      await write(terminal, SIXEL_RED_REGISTER_1)
+      expect(painted).toHaveLength(1)
+      expect(sixel._dec).toBeUndefined()
+
+      await write(terminal, IIP_PNG)
+      await new Promise((resolve) => setTimeout(resolve, 0))
+      expect(iip._dec._inst).toBeNull()
+      expect(added).toBe(2)
+    } finally {
+      terminal.dispose()
+    }
+  })
+
+  it('keeps SIXEL color registers across images until a terminal reset', async () => {
+    const painted = stubCanvasGlobals()
+    const { terminal } = createTerminal()
+    try {
+      await write(terminal, SIXEL_RED_REGISTER_1)
+      await write(terminal, SIXEL_USE_REGISTER_1)
+      expect(firstPixel(painted[1])).toEqual([255, 0, 0, 255])
+
+      await write(terminal, '\x1bc')
+      await write(terminal, SIXEL_USE_REGISTER_1)
+      expect(firstPixel(painted[2])).not.toEqual([255, 0, 0, 255])
+    } finally {
+      terminal.dispose()
+    }
+  })
+
+  it('drops images without wedging the parser when wasm memory is exhausted', async () => {
+    stubCanvasGlobals()
+    // A pixelLimit no other test uses keeps the shared SIXEL pool empty for this key.
+    const { terminal, addon } = createTerminal({ pixelLimit: 1234567 })
+    const replies = []
+    terminal.onData((data) => replies.push(data))
+    function exhausted() {
+      throw new RangeError('WebAssembly.Memory(): could not allocate memory')
+    }
+    vi.stubGlobal('WebAssembly', { ...WebAssembly, Memory: exhausted, Instance: exhausted })
+    try {
+      expect(await writeOrWedge(terminal, '\x1b_Ga=T,f=32,s=1,v=1,i=7;AAAA/w==\x1b\\')).toBe(
+        'parsed'
+      )
+      expect(await writeOrWedge(terminal, IIP_PNG)).toBe('parsed')
+      expect(await writeOrWedge(terminal, SIXEL_USE_REGISTER_1)).toBe('parsed')
+      expect(await writeOrWedge(terminal, 'after')).toBe('parsed')
+
+      expect(addon._storage._images.size).toBe(0)
+      expect(replies.join('')).toContain('ENOMEM')
+      expect(terminal.buffer.active.getLine(0).translateToString(true)).toContain('after')
+    } finally {
+      terminal.dispose()
+    }
+  })
+})
diff --git a/config/scripts/zip-extractor-command.mjs b/config/scripts/zip-extractor-command.mjs
new file mode 100644
index 00000000000..fbd4c696748
--- /dev/null
+++ b/config/scripts/zip-extractor-command.mjs
@@ -0,0 +1 @@
+export { getZipExtractorCommand } from '../../src/shared/zip-extractor-command.ts'
diff --git a/config/scripts/zip-extractor-command.test.mjs b/config/scripts/zip-extractor-command.test.mjs
new file mode 100644
index 00000000000..9cc574f87ec
--- /dev/null
+++ b/config/scripts/zip-extractor-command.test.mjs
@@ -0,0 +1,62 @@
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { runProcessSync } from './script-child-process.mjs'
+import { getZipExtractorCommand } from './zip-extractor-command.mjs'
+
+const directories = []
+afterEach(() => {
+  vi.unstubAllEnvs()
+  vi.restoreAllMocks()
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function extract(bytes) {
+  const directory = mkdtempSync(join(tmpdir(), "orca archive '$ "))
+  directories.push(directory)
+  const archive = join(directory, "source '$.zip")
+  const destination = join(directory, "output '$")
+  writeFileSync(archive, bytes)
+  mkdirSync(destination)
+  const command = getZipExtractorCommand(archive, destination)
+  const result = runProcessSync({ program: command.file, args: command.args, timeoutMs: 120_000 })
+  return { result, destination }
+}
+
+describe('native archive extraction', () => {
+  it('uses the system archive reader on Windows unless an override is configured', () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+    vi.stubEnv('SystemRoot', 'C:\\Windows')
+    vi.stubEnv('ORCA_UNZIP_BIN', '')
+    expect(getZipExtractorCommand('source.zip', 'output')).toEqual({
+      file: join('C:\\Windows', 'System32', 'tar.exe'),
+      args: ['-xf', 'source.zip', '-C', 'output'],
+      label: 'tar'
+    })
+    vi.stubEnv('ORCA_UNZIP_BIN', 'C:\\tools\\unzip.exe')
+    expect(getZipExtractorCommand("source '$.zip", "output '$")).toEqual({
+      file: 'C:\\tools\\unzip.exe',
+      args: ['-q', "source '$.zip", '-d', "output '$"],
+      label: 'unzip'
+    })
+  })
+
+  it('extracts through paths containing spaces, apostrophes and shell characters', () => {
+    const { result, destination } = extract(
+      Buffer.from(
+        'UEsDBBQAAAAAAI1iOF16rk6zGAAAABgAAAALAAAAcGF5bG9hZC50eHR2ZXJpZmllZCBhcmNoaXZlIHBheWxvYWRQSwECFAMUAAAAAACNYjhdeq5OsxgAAAAYAAAACwAAAAAAAAAAAAAAgAEAAAAAcGF5bG9hZC50eHRQSwUGAAAAAAEAAQA5AAAAQQAAAAAA',
+        'base64'
+      )
+    )
+    expect(result.code, result.stderr).toBe(0)
+    expect(readFileSync(join(destination, 'payload.txt'), 'utf8')).toBe('verified archive payload')
+  })
+
+  it('fails on a malformed archive', () => {
+    const { result } = extract('invalid archive')
+    expect(result.code).not.toBe(0)
+  })
+})
diff --git a/config/tsconfig.cli.json b/config/tsconfig.cli.json
index 9c77c8c595f..85f3529b2dc 100644
--- a/config/tsconfig.cli.json
+++ b/config/tsconfig.cli.json
@@ -6,7 +6,10 @@
     "../src/main/agent-state-file-reader.ts",
     "../src/main/agent-hooks/grok-replay-guard.ts",
     "../src/main/claude/hook-script.ts",
-    "../src/main/claude/claude-session-end-hook-capability.ts",
+    "../src/main/claude/claude-hook-event-versions.ts",
+    "../src/main/claude/claude-managed-hook-events.ts",
+    "../src/main/qoder/hook-service.ts",
+    "../src/main/codebuddy/hook-service.ts",
     "../src/main/agent-hooks/hook-stdin-contract.ts",
     "../src/main/agent-hooks/hook-post-command.ts",
     "../src/main/agent-hooks/hook-config-write-path.ts",
@@ -18,8 +21,80 @@
     "../src/main/agent-hooks/managed-agent-hook-controls.ts",
     "../src/main/agent-hooks/managed-agent-hook-registry.ts",
     "../src/main/agent-hooks/managed-hook-script-refresh.ts",
+    "../src/main/agent-hooks/managed-hooks-json-events.ts",
     "../src/main/agent-hooks/posix-hook-command.ts",
     "../src/main/agent-hooks/runtime-home-hook-command.ts",
+    "../src/main/orca-profiles/profile-storage-paths.ts",
+    "../src/main/orca-profiles/profile-index-store.ts",
+    "../src/main/orca-profiles/profile-telemetry-consent-seed.ts",
+    "../src/main/orca-profiles/profile-legacy-state-import.ts",
+    "../src/main/persistence/profile-state/profile-state-migration.ts",
+    "../src/main/persistence/profile-state/profile-state-database-publication.ts",
+    "../src/main/persistence/profile-state/profile-state-database.ts",
+    "../src/main/persistence/profile-state/profile-state-database-errors.ts",
+    "../src/main/persistence/profile-state/profile-state-database-validation.ts",
+    "../src/main/persistence/profile-state/profile-state-database-schema.ts",
+    "../src/main/persistence/profile-state/profile-state-documents.ts",
+    "../src/main/persistence/profile-state/legacy-json/profile-state-json-acceptance.ts",
+    "../src/main/persistence/profile-state/profile-state-revision.ts",
+    "../src/main/persistence/profile-state/profile-state-read-snapshot.ts",
+    "../src/main/persistence/profile-state/profile-state-sqlite-authority.ts",
+    "../src/main/persistence/profile-state/legacy-json/profile-state-authority-exports.ts",
+    "../src/main/persistence/profile-state/profile-state-complete-replacements.ts",
+    "../src/main/persistence/profile-state/profile-state-revision-readmission.ts",
+    "../src/main/persistence/profile-state/profile-state-writer-protocol.ts",
+    "../src/main/persistence/loading-store/profile-state-authority.ts",
+    "../src/main/persistence/profile-state/profile-state-automation-runs-migration.ts",
+    "../src/main/persistence/profile-state/profile-state-document-reader.ts",
+    "../src/main/persistence/profile-state/profile-state-document-validation.ts",
+    "../src/main/persistence/profile-state/profile-state-domain-writes.ts",
+    "../src/main/persistence/profile-state/profile-state-write-transaction.ts",
+    "../src/main/persistence/profile-state/profile-state-domain-write-validation.ts",
+    "../src/main/persistence/profile-state/profile-state-domain-reader.ts",
+    "../src/main/persistence/profile-state/profile-state-automation-runs.ts",
+    "../src/main/persistence/profile-state/profile-state-automation-runs-model.ts",
+    "../src/main/persistence/profile-state/profile-state-automation-runs-payload.ts",
+    "../src/main/persistence/profile-state/profile-state-automation-runs-reader.ts",
+    "../src/main/persistence/profile-state/profile-state-automation-runs-storage.ts",
+    "../src/main/persistence/profile-state/profile-state-automation-runs-validation.ts",
+    "../src/main/persistence/profile-state/profile-state-automation-runs-writer.ts",
+    "../src/main/persistence/profile-state/profile-state-offline-settings.ts",
+    "../src/main/persistence/profile-state/legacy-json/profile-state-export-path.ts",
+    "../src/main/persistence/profile-state/legacy-json/profile-state-legacy-backup-path.ts",
+    "../src/main/persistence/profile-state/profile-state-backup-path.ts",
+    "../src/main/persistence/profile-state/profile-state-backup-rotation.ts",
+    "../src/main/persistence/profile-state/profile-state-backup-job.ts",
+    "../src/main/persistence/profile-state/profile-state-backup-worker.ts",
+    "../src/main/persistence/profile-state/profile-state-backup-worker-entry.ts",
+    "../src/main/worker-thread-entry-path.ts",
+    "../src/main/persistence/profile-state/profile-state-database-snapshot.ts",
+    "../src/main/persistence/profile-state/profile-state-database-recovery.ts",
+    "../src/main/persistence/profile-state/profile-state-recovery-required.ts",
+    "../src/main/persistence/profile-state/legacy-json/profile-state-recovery.ts",
+    "../src/main/persistence/profile-state/profile-state-recovery-copy.ts",
+    "../src/main/persistence/profile-state/profile-state-recovery-command.ts",
+    "../src/main/orca-profiles/profile-project-move-record.ts",
+    "../src/main/orca-profiles/profile-project-domain-changes.ts",
+    "../src/main/persistence/profile-state/profile-state-active-location.ts",
+    "../src/main/persistence/profile-state/profile-state-access.ts",
+    "../src/main/persistence/profile-state/profile-state-access-owner.ts",
+    "../src/main/persistence/profile-state/profile-state-access-identity.ts",
+    "../src/main/windows-native-registry.ts",
+    "../src/main/windows/windows-command-line-recovery-health.ts",
+    "../src/main/windows/windows-process-table.ts",
+    "../src/main/windows/windows-process-table-cim-scan.ts",
+    "../src/main/daemon/daemon-process-start-time.ts",
+    "../src/main/daemon/daemon-process-identity-query.ts",
+    "../src/main/startup/startup-diagnostics.ts",
+    "../src/main/persistence/profile-state/legacy-json/profile-state-versioned-export.ts",
+    "../src/main/persistence/profile-state/profile-state-backup-temporary-files.ts",
+    "../src/main/persistence/profile-state/profile-state-database-quarantine.ts",
+    "../src/main/persistence/profile-state/profile-state-storage-classification.ts",
+    "../src/main/durable-file-write.ts",
+    "../src/shared/secure-file.ts",
+    "../src/main/sqlite/harden-database-files.ts",
+    "../src/main/startup/http1-compatibility-marker.ts",
+    "../src/main/startup/http1-compatibility-profile-state.ts",
     "../src/main/agent-hooks/windows-direct-cmd-hook-command.ts",
     "../src/main/agent-hooks/windows-powershell-hook-launcher.ts",
     "../src/main/amp/agent-status-plugin-source.ts",
@@ -33,6 +108,7 @@
     "../src/main/claude/hook-service.ts",
     "../src/main/claude/statusline-script.ts",
     "../src/main/claude-accounts/keychain.ts",
+    "../src/main/macos-keychain/generic-password.ts",
     "../src/main/codex/codex-app-server-capability-cache.ts",
     "../src/main/codex/codex-app-server-capability-signal.ts",
     "../src/main/codex/codex-app-server-client.ts",
@@ -91,6 +167,7 @@
     "../src/main/codex/config-toml-hook-trust-read.ts",
     "../src/main/codex/config-toml-key-path.ts",
     "../src/main/codex/config-toml-line-scan.ts",
+    "../src/main/codex/config-toml-mcp-servers.ts",
     "../src/main/codex/config-toml-project-trust.ts",
     "../src/main/codex/config-toml-runtime-owned-sections.ts",
     "../src/main/codex/config-toml-syntax.ts",
@@ -124,6 +201,8 @@
     "../src/main/devin/hook-settings.ts",
     "../src/main/devin/hook-service.ts",
     "../src/main/devin/hook-config-json.ts",
+    "../src/main/hermes/hermes-config-document.ts",
+    "../src/main/hermes/hermes-config-source-edits.ts",
     "../src/main/hermes/hermes-config-yaml.ts",
     "../src/main/hermes/hermes-home-filesystem.ts",
     "../src/main/hermes/hermes-managed-plugin-source.ts",
@@ -132,6 +211,9 @@
     "../src/main/in-flight-run-dedupe.ts",
     "../src/main/kimi/hook-service.ts",
     "../src/main/kimi/kimi-hook-config-toml.ts",
+    "../src/main/dsh/dsh-home-patch.ts",
+    "../src/main/dsh/hook-service.ts",
+    "../src/main/dsh/hook-settings.ts",
     "../src/main/muse/hook-config-json.ts",
     "../src/main/muse/hook-service.ts",
     "../src/main/muse/hook-settings.ts",
@@ -149,6 +231,12 @@
     "../src/main/startup/cli-command-names.ts",
     "../src/main/runtime/runtime-metadata.ts",
     "../src/main/sqlite/sync-database.ts",
+    "../src/main/sqlite/bun-readonly-wal.ts",
+    "../src/main/sqlite/sqlite-statement.ts",
+    "../src/main/sqlite/sqlite-integer-reader.ts",
+    "../src/main/sqlite/node-sqlite-statement.ts",
+    "../src/main/sqlite/bun-sqlite-statement.ts",
+    "../src/main/sqlite/bun-sqlite-database.ts",
     "../src/main/win32-utils.ts"
   ],
   "compilerOptions": {
diff --git a/config/tsconfig.node.json b/config/tsconfig.node.json
index c42b937a467..0d3077d8f0e 100644
--- a/config/tsconfig.node.json
+++ b/config/tsconfig.node.json
@@ -4,8 +4,11 @@
     "../electron.vite.config.*",
     "./build-plugins/**/*",
     "./scripts/vitest-host-ports-setup.ts",
+    "./scripts/vitest-caller-identity-env-setup.ts",
     "../src/main/**/*",
     "../src/renderer/src/lib/skill-freshness-display-status.ts",
+    "../src/renderer/src/components/native-chat/native-chat-resolution-receipt.ts",
+    "../src/renderer/src/components/native-chat/structured-agent-question-projection.ts",
     "../src/preload/**/*",
     "../src/shared/**/*",
     "../src/relay/**/*",
diff --git a/config/update-translation.txt b/config/update-translation.txt
new file mode 100644
index 00000000000..d1a85bab724
--- /dev/null
+++ b/config/update-translation.txt
@@ -0,0 +1,67 @@
+# Translation scan tracker
+
+Recurring task: after a batch of merged PRs, scan for i18n gaps and fix them:
+1. unkeyed user-visible UI strings (gate: `audit:localization` / `verify:localization-coverage`),
+2. keyed strings missing target-locale translations (en.json has the key, es/fr/ja/ko/zh does not),
+3. badly translated target values (placeholder mismatch, brand/term policy violations).
+
+Method (reproducible):
+- `node config/scripts/verify-localization-catalog.mjs` — key references vs en.json,
+  per-locale coverage, interpolation mismatches, generic-term regressions.
+- `node config/scripts/audit-localization-coverage.mjs --check` — unkeyed strings.
+- `node config/scripts/verify-localization-extraction.mjs` — en.json in sync with code.
+- Missing-key delta since last scan: flatten en.json at HEAD vs at the last-scanned
+  base commit, keep keys absent from each target locale.
+- Translate the delta per `config/i18n-translation-source.md` policy and the overrides in
+  `config/scripts/locale-*-overrides.mjs` / `locale-*-fixes.mjs` / `locale-generic-ui-terms.mjs`
+  (brands such as Orca/OpenCode/Git/Python stay Latin; `{{placeholders}}`, markdown links,
+  backtick code spans, and `[python.org](...)` links are preserved verbatim).
+- Apply with `node config/scripts/apply-translation-delta.mjs /tmp/translations.json`
+  (validates placeholder parity and runs every value through `repairTranslatedValue`
+  so CJK spacing, brand-mistranslation fixes, and phrase fixes match the repo pipeline).
+- Re-run all four gates plus the vitest locale suites before finishing.
+- Mobile (`mobile/`) has no locale catalogs (only SVG `translate()` transforms); out of scope
+  until the mobile catalog migration lands. Missing keys fall back to English at runtime
+  (sparse-catalog architecture, PR #8512), so untranslated leftovers are safe, not broken.
+
+## Scan 2026-09-25 (first tracked scan; no prior file existed)
+
+- HEAD scanned: 80e0bee23b (2026-09-24)
+- Window covered: 519bde81df^ .. HEAD (all PRs merged 2026-09-23..2026-09-24 back to and
+  including #22519; en.json deltas computed per commit, full commit list below).
+- Gates before fix: catalog verify PASS, coverage --check PASS (58 allowlisted), extraction
+  PASS, runtime-catalog PASS. So no unkeyed strings and en.json in sync; the gap was
+  target-locale coverage only.
+
+## Scan 2026-09-26
+
+- HEAD scanned: a15a5c8c1a6 (origin/main @ 067975bfd1 plus merge; 12 newest main
+  commits add zero en keys, verified).
+- Window covered: 80e0bee23b .. HEAD. Note: the previous scan's own branch commits
+  (chat-resume/Git-toolchain/notebook translations + fr/ko terminology fixes +
+  jupyter fix) have since landed upstream as #22746, so this scan's base-to-HEAD
+  delta already includes them; the merge was resolved with --theirs on
+  es/fr/ja/zh (our stale native-chat.handoff.* translations correctly dropped:
+  the keys were removed from en.json by upstream #22783).
+- Delta since base: 113 new en keys (mostly sessionSearch x44, resume-modal
+  activity, ipynb venv, Cursor accounts, feature-tips), 4 changed en values
+  (3x "mid-turn" -> "working" resume copy; screenshotsHint gained {{maxSize}}).
+  fr/ja/ko/zh translations of the 3 resume keys already matched new semantics.
+- Applied: es +111 (107 new + 3 resume + screenshotsHint), fr/ja/ko/zh +100 each
+  (99 new + screenshotsHint) via apply-translation-delta.mjs (pipeline repaired
+  ja 使用状況->使用量 x1, ja phrase x2, zh 智能体->代理 x5). Strictly additive:
+  +511 keys, 0 removed.
+- Gates after fix: catalog verify PASS (fr/ja/ko/zh 14733/14733 = 100%;
+  es 12328/14733, remaining 2405 missing are pre-existing es backlog, out of
+  delta scope), coverage --check PASS (58 allowlisted), extraction PASS,
+  locale vitest suites PASS (policy x7 files, ko overrides, generic terms,
+  frozen keywords, native-chat locales).
+- Reviews (3 of max 4 rounds, subagents; round 0 = 5 parallel translators):
+  R1 fixed 20 (es kw.rateLimit->EN per 10-hit precedent; fr NBSP guillemets;
+  ja settingsLink/progressStarting; ko demo-snippet localization x8 +
+  consentInstruction fragment; zh x6 incl. 仪表盘/表结构/工作流程).
+  R2 fixed 5 and reverted fr NBSP->plain spaces (91-vs-7 file convention;
+  R1 evidence was circular) + ja kw.spend->追加料金 + ja particle fix +
+  ko 색인화. R3 sign-off clean on all locales (R2 fixes byte-verified,
+  full placeholder parity 0 mismatches, 0 missing keys).
+
diff --git a/config/vitest.config.ts b/config/vitest.config.ts
index beaf82f4e12..d2a58616934 100644
--- a/config/vitest.config.ts
+++ b/config/vitest.config.ts
@@ -1,5 +1,6 @@
 import { resolve } from 'node:path'
 import { defineConfig } from 'vitest/config'
+import { UNIT_INCLUDE, UNIT_EXCLUDE } from './scripts/ci-unit-files.mjs'
 import TimingSequencer from './scripts/ci-unit-sequencer.mjs'
 
 const windowsTestWorkerOptions = process.platform === 'win32' ? { maxWorkers: 4 } : {}
@@ -16,8 +17,13 @@ export default defineConfig({
   },
   test: {
     environment: 'node',
+    // Bun's external-module cache otherwise loses Zod named exports across mocked graphs.
+    ...(process.versions.bun ? { server: { deps: { inline: ['zod'] } } } : {}),
     ...(process.env.ORCA_BALANCE_UNIT_SHARDS === '1'
-      ? { sequence: { sequencer: TimingSequencer } }
+      ? {
+          sequence: { sequencer: TimingSequencer },
+          reporters: ['default', resolve('config/scripts/ci-unit-timing-reporter.mjs')]
+        }
       : {}),
     // Why: Node 26's undefined Web Storage globals prevent Vitest from installing happy-dom's.
     // Why --expose-gc: retention tests need a deterministic collection point to measure what a queue really holds.
@@ -26,16 +32,11 @@ export default defineConfig({
     setupFiles: [
       resolve('config/scripts/happy-dom-offscreen-canvas.ts'),
       resolve('config/scripts/happy-dom-mutation-observer-retention.ts'),
-      resolve('config/scripts/vitest-host-ports-setup.ts')
-    ],
-    include: [
-      'src/**/*.test.ts',
-      'src/**/*.test.tsx',
-      'config/scripts/**/*.test.ts',
-      'config/scripts/**/*.test.mjs',
-      'tests/tools/**/*.test.mjs',
-      'tests/e2e/**/*.unit.test.ts'
+      resolve('config/scripts/vitest-host-ports-setup.ts'),
+      resolve('config/scripts/vitest-caller-identity-env-setup.ts')
     ],
+    include: UNIT_INCLUDE,
+    ...(process.env.ORCA_BALANCE_UNIT_SHARDS === '1' ? { exclude: UNIT_EXCLUDE } : {}),
     // Why: the full suite runs heavy TS transforms plus real git/http fixtures;
     // the Vitest 5s defaults are too tight for the slowest integration cases.
     hookTimeout: 60_000,
diff --git a/docs/assets/readme-downloads.svg b/docs/assets/readme-downloads.svg
index 42f7829a90a..a38a95a2da4 100644
--- a/docs/assets/readme-downloads.svg
+++ b/docs/assets/readme-downloads.svg
@@ -1,5 +1,5 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="106" height="20" role="img" aria-label="downloads: 77m">
-  <title>downloads: 77m</title>
+<svg xmlns="http://www.w3.org/2000/svg" width="106" height="20" role="img" aria-label="downloads: 84m">
+  <title>downloads: 84m</title>
   <linearGradient id="s" x2="0" y2="100%">
     <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
     <stop offset="1" stop-opacity=".1"/>
@@ -15,7 +15,7 @@
   <g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="11">
     <text x="37" y="15" fill="#010101" fill-opacity=".3">downloads</text>
     <text x="37" y="14">downloads</text>
-    <text x="90" y="15" fill="#010101" fill-opacity=".3">77m</text>
-    <text x="90" y="14">77m</text>
+    <text x="90" y="15" fill="#010101" fill-opacity=".3">84m</text>
+    <text x="90" y="14">84m</text>
   </g>
 </svg>
diff --git a/docs/assets/star-history.png b/docs/assets/star-history.png
index f069eb9059c..2de5029eee2 100644
Binary files a/docs/assets/star-history.png and b/docs/assets/star-history.png differ
diff --git a/docs/bug-reproductions/opencode2-form-created-kinds/README.md b/docs/bug-reproductions/opencode2-form-created-kinds/README.md
index 8ac1dbfe449..f3a0b4713e2 100644
--- a/docs/bug-reproductions/opencode2-form-created-kinds/README.md
+++ b/docs/bug-reproductions/opencode2-form-created-kinds/README.md
@@ -13,8 +13,8 @@ against a real `opencode serve` instance and reading the server's `/api/event` S
 v2.0.12 bundle (still exactly five on `v2.0.15`, in `tool/plugin/question.ts`,
 `tool/plugin/websearch.ts` and `mcp/index.ts`):
 
-| `metadata.kind`      | Form title                                    | `sessionID` | Blocks the pane owner    |
-| -------------------- | --------------------------------------------- | ----------- | ------------------------ |
+| `metadata.kind`      | Form title                                    | `sessionID` | Blocks the pane owner     |
+| -------------------- | --------------------------------------------- | ----------- | ------------------------- |
 | `question`           | `Questions`                                   | the session | yes — the `question` tool |
 | `websearch.provider` | `Web Search` / `Choose a web search provider` | the session | yes — the turn is stalled |
 | `mcp-elicitation`    | `<server> is requesting input`                | `"global"`  | no — see below            |
diff --git a/docs/readme/README.es.md b/docs/readme/README.es.md
index fdd067ef763..17ec41e8294 100644
--- a/docs/readme/README.es.md
+++ b/docs/readme/README.es.md
@@ -179,6 +179,7 @@ Funciona con **cualquier agente CLI** — si corre en una terminal, corre en Orc
   <a href="https://cursor.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=cursor.com&sz=64" alt="Cursor logo" width="16" valign="middle" /> Cursor</kbd></a> &nbsp;
   <a href="https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli"><kbd><img src="https://www.google.com/s2/favicons?domain=github.com&sz=64" alt="GitHub Copilot logo" width="16" valign="middle" /> GitHub Copilot</kbd></a> &nbsp;
   <a href="https://dev.meta.ai/docs/muse-code"><kbd><img src="../../src/shared/agent-icons/muse.png" alt="Muse logo" width="16" valign="middle" /> Muse</kbd></a> &nbsp;
+  <a href="https://deepseek-harness.github.io/deepseek-harness/"><kbd><img src="../../src/shared/agent-icons/dsh.png" alt="DeepSeek Harness logo" width="16" valign="middle" /> DeepSeek Harness</kbd></a> &nbsp;
   <a href="https://zcode.z.ai/en/docs"><kbd><img src="../../src/shared/agent-icons/zcode.png" alt="ZCode logo" width="16" valign="middle" /> ZCode</kbd></a> &nbsp;
   <a href="https://opencode.ai/docs/cli/"><kbd><img src="https://www.google.com/s2/favicons?domain=opencode.ai&sz=64" alt="OpenCode logo" width="16" valign="middle" /> OpenCode</kbd></a> &nbsp;
   <a href="https://ampcode.com/manual#install"><kbd><img src="https://www.google.com/s2/favicons?domain=ampcode.com&sz=64" alt="Amp logo" width="16" valign="middle" /> Amp</kbd></a> &nbsp;
@@ -193,6 +194,7 @@ Funciona con **cualquier agente CLI** — si corre en una terminal, corre en Orc
   <a href="https://github.com/charmbracelet/crush"><kbd><img src="https://www.google.com/s2/favicons?domain=charm.sh&sz=64" alt="Charm logo" width="16" valign="middle" /> Charm</kbd></a> &nbsp;
   <a href="https://docs.cline.bot/cline-cli/overview"><kbd><img src="https://www.google.com/s2/favicons?domain=cline.bot&sz=64" alt="Cline logo" width="16" valign="middle" /> Cline</kbd></a> &nbsp;
   <a href="https://www.codebuff.com/docs/help/quick-start"><kbd><img src="https://www.google.com/s2/favicons?domain=codebuff.com&sz=64" alt="Codebuff logo" width="16" valign="middle" /> Codebuff</kbd></a> &nbsp;
+  <a href="https://freebuff.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=freebuff.com&sz=64" alt="Freebuff logo" width="16" valign="middle" /> Freebuff</kbd></a> &nbsp;
   <a href="https://commandcode.ai/docs/quickstart"><kbd><img src="https://www.google.com/s2/favicons?domain=commandcode.ai&sz=64" alt="Command Code logo" width="16" valign="middle" /> Command Code</kbd></a> &nbsp;
   <a href="https://docs.continue.dev/guides/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=continue.dev&sz=64" alt="Continue logo" width="16" valign="middle" /> Continue</kbd></a> &nbsp;
   <a href="https://docs.factory.ai/cli/getting-started/quickstart"><kbd><img src="../assets/droid-logo.svg" alt="Droid logo" width="16" valign="middle" /> Droid</kbd></a> &nbsp;
diff --git a/docs/readme/README.fr.md b/docs/readme/README.fr.md
index 56cfc334fd7..d2757d919b2 100644
--- a/docs/readme/README.fr.md
+++ b/docs/readme/README.fr.md
@@ -40,7 +40,7 @@
 
 Surveillez et pilotez vos agents depuis votre téléphone — soyez notifié quand un agent termine, et envoyez des instructions de suivi où que vous soyez.
 
-[App Store iOS](https://apps.apple.com/us/app/orca-ide/id6766130217) · [TestFlight](https://testflight.apple.com/join/YjeGMQBA) · [APK Android 0.0.50](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.50/app-release.apk) · [Docs →](https://www.onorca.dev/docs/mobile)
+[App Store iOS](https://apps.apple.com/us/app/orca-ide/id6766130217) · [APK Android 0.0.50](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.50/app-release.apk) · [Docs →](https://www.onorca.dev/docs/mobile)
 
 </td>
 <td width="50%">
@@ -183,6 +183,7 @@ Fonctionne avec **n'importe quel agent CLI** — s'il tourne dans un terminal, i
   <a href="https://cursor.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=cursor.com&sz=64" alt="Logo Cursor" width="16" valign="middle" /> Cursor</kbd></a> &nbsp;
   <a href="https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli"><kbd><img src="https://www.google.com/s2/favicons?domain=github.com&sz=64" alt="Logo GitHub Copilot" width="16" valign="middle" /> GitHub Copilot</kbd></a> &nbsp;
   <a href="https://dev.meta.ai/docs/muse-code"><kbd><img src="../../src/shared/agent-icons/muse.png" alt="Logo Muse" width="16" valign="middle" /> Muse</kbd></a> &nbsp;
+  <a href="https://deepseek-harness.github.io/deepseek-harness/"><kbd><img src="../../src/shared/agent-icons/dsh.png" alt="DeepSeek Harness logo" width="16" valign="middle" /> DeepSeek Harness</kbd></a> &nbsp;
   <a href="https://zcode.z.ai/en/docs"><kbd><img src="../../src/shared/agent-icons/zcode.png" alt="Logo ZCode" width="16" valign="middle" /> ZCode</kbd></a> &nbsp;
   <a href="https://opencode.ai/docs/cli/"><kbd><img src="https://www.google.com/s2/favicons?domain=opencode.ai&sz=64" alt="Logo OpenCode" width="16" valign="middle" /> OpenCode</kbd></a> &nbsp;
   <a href="https://mimo.xiaomi.com/coder"><kbd><img src="https://www.google.com/s2/favicons?domain=mimo.xiaomi.com&sz=64" alt="Logo MiMo Code" width="16" valign="middle" /> MiMo Code</kbd></a> &nbsp;
@@ -199,6 +200,7 @@ Fonctionne avec **n'importe quel agent CLI** — s'il tourne dans un terminal, i
   <a href="https://github.com/charmbracelet/crush"><kbd><img src="https://www.google.com/s2/favicons?domain=charm.sh&sz=64" alt="Logo Charm" width="16" valign="middle" /> Charm</kbd></a> &nbsp;
   <a href="https://docs.cline.bot/cline-cli/overview"><kbd><img src="https://www.google.com/s2/favicons?domain=cline.bot&sz=64" alt="Logo Cline" width="16" valign="middle" /> Cline</kbd></a> &nbsp;
   <a href="https://www.codebuff.com/docs/help/quick-start"><kbd><img src="https://www.google.com/s2/favicons?domain=codebuff.com&sz=64" alt="Logo Codebuff" width="16" valign="middle" /> Codebuff</kbd></a> &nbsp;
+  <a href="https://freebuff.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=freebuff.com&sz=64" alt="Logo Freebuff" width="16" valign="middle" /> Freebuff</kbd></a> &nbsp;
   <a href="https://commandcode.ai/docs/quickstart"><kbd><img src="https://www.google.com/s2/favicons?domain=commandcode.ai&sz=64" alt="Logo Command Code" width="16" valign="middle" /> Command Code</kbd></a> &nbsp;
   <a href="https://docs.continue.dev/guides/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=continue.dev&sz=64" alt="Logo Continue" width="16" valign="middle" /> Continue</kbd></a> &nbsp;
   <a href="https://docs.factory.ai/cli/getting-started/quickstart"><kbd><img src="../assets/droid-logo.svg" alt="Logo Droid" width="16" valign="middle" /> Droid</kbd></a> &nbsp;
@@ -236,7 +238,7 @@ yay -S stably-orca-bin
 
 Associez-la à l'app de bureau pour surveiller et piloter vos agents depuis votre téléphone.
 
-- **iOS :** [Télécharger sur l'App Store](https://apps.apple.com/us/app/orca-ide/id6766130217) ou [rejoindre TestFlight](https://testflight.apple.com/join/YjeGMQBA)
+- **iOS :** [Télécharger sur l'App Store](https://apps.apple.com/us/app/orca-ide/id6766130217)
 - **Android :** [Télécharger l'APK 0.0.50](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.50/app-release.apk)
 
 ---
diff --git a/docs/readme/README.ja.md b/docs/readme/README.ja.md
index e5eee5781b0..ed37efa595f 100644
--- a/docs/readme/README.ja.md
+++ b/docs/readme/README.ja.md
@@ -179,6 +179,7 @@ PR、Issue、プロジェクトボードをアプリ内で閲覧 — 任意の
   <a href="https://cursor.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=cursor.com&sz=64" alt="Cursor logo" width="16" valign="middle" /> Cursor</kbd></a> &nbsp;
   <a href="https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli"><kbd><img src="https://www.google.com/s2/favicons?domain=github.com&sz=64" alt="GitHub Copilot logo" width="16" valign="middle" /> GitHub Copilot</kbd></a> &nbsp;
   <a href="https://dev.meta.ai/docs/muse-code"><kbd><img src="../../src/shared/agent-icons/muse.png" alt="Muse logo" width="16" valign="middle" /> Muse</kbd></a> &nbsp;
+  <a href="https://deepseek-harness.github.io/deepseek-harness/"><kbd><img src="../../src/shared/agent-icons/dsh.png" alt="DeepSeek Harness logo" width="16" valign="middle" /> DeepSeek Harness</kbd></a> &nbsp;
   <a href="https://zcode.z.ai/en/docs"><kbd><img src="../../src/shared/agent-icons/zcode.png" alt="ZCode logo" width="16" valign="middle" /> ZCode</kbd></a> &nbsp;
   <a href="https://opencode.ai/docs/cli/"><kbd><img src="https://www.google.com/s2/favicons?domain=opencode.ai&sz=64" alt="OpenCode logo" width="16" valign="middle" /> OpenCode</kbd></a> &nbsp;
   <a href="https://ampcode.com/manual#install"><kbd><img src="https://www.google.com/s2/favicons?domain=ampcode.com&sz=64" alt="Amp logo" width="16" valign="middle" /> Amp</kbd></a> &nbsp;
@@ -193,6 +194,7 @@ PR、Issue、プロジェクトボードをアプリ内で閲覧 — 任意の
   <a href="https://github.com/charmbracelet/crush"><kbd><img src="https://www.google.com/s2/favicons?domain=charm.sh&sz=64" alt="Charm logo" width="16" valign="middle" /> Charm</kbd></a> &nbsp;
   <a href="https://docs.cline.bot/cline-cli/overview"><kbd><img src="https://www.google.com/s2/favicons?domain=cline.bot&sz=64" alt="Cline logo" width="16" valign="middle" /> Cline</kbd></a> &nbsp;
   <a href="https://www.codebuff.com/docs/help/quick-start"><kbd><img src="https://www.google.com/s2/favicons?domain=codebuff.com&sz=64" alt="Codebuff logo" width="16" valign="middle" /> Codebuff</kbd></a> &nbsp;
+  <a href="https://freebuff.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=freebuff.com&sz=64" alt="Freebuff logo" width="16" valign="middle" /> Freebuff</kbd></a> &nbsp;
   <a href="https://commandcode.ai/docs/quickstart"><kbd><img src="https://www.google.com/s2/favicons?domain=commandcode.ai&sz=64" alt="Command Code logo" width="16" valign="middle" /> Command Code</kbd></a> &nbsp;
   <a href="https://docs.continue.dev/guides/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=continue.dev&sz=64" alt="Continue logo" width="16" valign="middle" /> Continue</kbd></a> &nbsp;
   <a href="https://docs.factory.ai/cli/getting-started/quickstart"><kbd><img src="../assets/droid-logo.svg" alt="Droid logo" width="16" valign="middle" /> Droid</kbd></a> &nbsp;
diff --git a/docs/readme/README.ko.md b/docs/readme/README.ko.md
index 17528c25ee0..25e20764c37 100644
--- a/docs/readme/README.ko.md
+++ b/docs/readme/README.ko.md
@@ -36,7 +36,7 @@
 
 휴대폰에서 에이전트를 모니터링하고 조종하세요 — 에이전트가 완료되면 알림을 받고 어디서든 후속 지시를 보낼 수 있습니다.
 
-[iOS App Store](https://apps.apple.com/us/app/orca-ide/id6766130217) · [TestFlight](https://testflight.apple.com/join/YjeGMQBA) · [Android APK 0.0.50](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.50/app-release.apk) · [문서 →](https://www.onorca.dev/docs/mobile)
+[iOS App Store](https://apps.apple.com/us/app/orca-ide/id6766130217) · [Android APK 0.0.50](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.50/app-release.apk) · [문서 →](https://www.onorca.dev/docs/mobile)
 
 </td>
 <td width="50%">
@@ -179,6 +179,7 @@ diff의 어느 줄에든 코멘트를 남기고 에이전트에게 바로 보내
   <a href="https://cursor.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=cursor.com&sz=64" alt="Cursor logo" width="16" valign="middle" /> Cursor</kbd></a> &nbsp;
   <a href="https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli"><kbd><img src="https://www.google.com/s2/favicons?domain=github.com&sz=64" alt="GitHub Copilot logo" width="16" valign="middle" /> GitHub Copilot</kbd></a> &nbsp;
   <a href="https://dev.meta.ai/docs/muse-code"><kbd><img src="../../src/shared/agent-icons/muse.png" alt="Muse logo" width="16" valign="middle" /> Muse</kbd></a> &nbsp;
+  <a href="https://deepseek-harness.github.io/deepseek-harness/"><kbd><img src="../../src/shared/agent-icons/dsh.png" alt="DeepSeek Harness logo" width="16" valign="middle" /> DeepSeek Harness</kbd></a> &nbsp;
   <a href="https://zcode.z.ai/en/docs"><kbd><img src="../../src/shared/agent-icons/zcode.png" alt="ZCode logo" width="16" valign="middle" /> ZCode</kbd></a> &nbsp;
   <a href="https://opencode.ai/docs/cli/"><kbd><img src="https://www.google.com/s2/favicons?domain=opencode.ai&sz=64" alt="OpenCode logo" width="16" valign="middle" /> OpenCode</kbd></a> &nbsp;
   <a href="https://mimo.xiaomi.com/coder"><kbd><img src="https://www.google.com/s2/favicons?domain=mimo.xiaomi.com&sz=64" alt="MiMo Code logo" width="16" valign="middle" /> MiMo Code</kbd></a> &nbsp;
@@ -195,6 +196,7 @@ diff의 어느 줄에든 코멘트를 남기고 에이전트에게 바로 보내
   <a href="https://github.com/charmbracelet/crush"><kbd><img src="https://www.google.com/s2/favicons?domain=charm.sh&sz=64" alt="Charm logo" width="16" valign="middle" /> Charm</kbd></a> &nbsp;
   <a href="https://docs.cline.bot/cline-cli/overview"><kbd><img src="https://www.google.com/s2/favicons?domain=cline.bot&sz=64" alt="Cline logo" width="16" valign="middle" /> Cline</kbd></a> &nbsp;
   <a href="https://www.codebuff.com/docs/help/quick-start"><kbd><img src="https://www.google.com/s2/favicons?domain=codebuff.com&sz=64" alt="Codebuff logo" width="16" valign="middle" /> Codebuff</kbd></a> &nbsp;
+  <a href="https://freebuff.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=freebuff.com&sz=64" alt="Freebuff logo" width="16" valign="middle" /> Freebuff</kbd></a> &nbsp;
   <a href="https://commandcode.ai/docs/quickstart"><kbd><img src="https://www.google.com/s2/favicons?domain=commandcode.ai&sz=64" alt="Command Code logo" width="16" valign="middle" /> Command Code</kbd></a> &nbsp;
   <a href="https://docs.continue.dev/guides/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=continue.dev&sz=64" alt="Continue logo" width="16" valign="middle" /> Continue</kbd></a> &nbsp;
   <a href="https://docs.factory.ai/cli/getting-started/quickstart"><kbd><img src="../assets/droid-logo.svg" alt="Droid logo" width="16" valign="middle" /> Droid</kbd></a> &nbsp;
@@ -231,7 +233,7 @@ yay -S stably-orca-bin
 
 데스크톱 앱과 페어링해 휴대폰에서 에이전트를 모니터링하고 조종하세요.
 
-- **iOS:** [App Store에서 다운로드](https://apps.apple.com/us/app/orca-ide/id6766130217) 또는 [TestFlight 참여](https://testflight.apple.com/join/YjeGMQBA)
+- **iOS:** [App Store에서 다운로드](https://apps.apple.com/us/app/orca-ide/id6766130217)
 - **Android:** [APK 0.0.50 다운로드](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.50/app-release.apk) · [설치 가이드](https://www.onorca.dev/docs/android-apk)
 
 ---
diff --git a/docs/readme/README.pt.md b/docs/readme/README.pt.md
index 568a6d0de0d..baa17f95955 100644
--- a/docs/readme/README.pt.md
+++ b/docs/readme/README.pt.md
@@ -36,7 +36,7 @@
 
 Monitore e conduza seus agentes pelo celular — receba uma notificação quando um agente terminar e envie instruções de acompanhamento de qualquer lugar.
 
-[App Store para iOS](https://apps.apple.com/us/app/orca-ide/id6766130217) · [TestFlight](https://testflight.apple.com/join/YjeGMQBA) · [APK Android 0.0.50](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.50/app-release.apk) · [Docs →](https://www.onorca.dev/docs/mobile)
+[App Store para iOS](https://apps.apple.com/us/app/orca-ide/id6766130217) · [APK Android 0.0.50](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.50/app-release.apk) · [Docs →](https://www.onorca.dev/docs/mobile)
 
 </td>
 <td width="50%">
@@ -179,6 +179,7 @@ Funciona com **qualquer agente CLI** — se roda em um terminal, roda no Orca.
   <a href="https://cursor.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=cursor.com&sz=64" alt="Logotipo do Cursor" width="16" valign="middle" /> Cursor</kbd></a> &nbsp;
   <a href="https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli"><kbd><img src="https://www.google.com/s2/favicons?domain=github.com&sz=64" alt="Logotipo do GitHub Copilot" width="16" valign="middle" /> GitHub Copilot</kbd></a> &nbsp;
   <a href="https://dev.meta.ai/docs/muse-code"><kbd><img src="../../src/shared/agent-icons/muse.png" alt="Logotipo do Muse" width="16" valign="middle" /> Muse</kbd></a> &nbsp;
+  <a href="https://deepseek-harness.github.io/deepseek-harness/"><kbd><img src="../../src/shared/agent-icons/dsh.png" alt="DeepSeek Harness logo" width="16" valign="middle" /> DeepSeek Harness</kbd></a> &nbsp;
   <a href="https://zcode.z.ai/en/docs"><kbd><img src="../../src/shared/agent-icons/zcode.png" alt="Logotipo do ZCode" width="16" valign="middle" /> ZCode</kbd></a> &nbsp;
   <a href="https://opencode.ai/docs/cli/"><kbd><img src="https://www.google.com/s2/favicons?domain=opencode.ai&sz=64" alt="Logotipo do OpenCode" width="16" valign="middle" /> OpenCode</kbd></a> &nbsp;
   <a href="https://mimo.xiaomi.com/coder"><kbd><img src="https://www.google.com/s2/favicons?domain=mimo.xiaomi.com&sz=64" alt="Logotipo do MiMo Code" width="16" valign="middle" /> MiMo Code</kbd></a> &nbsp;
@@ -195,6 +196,7 @@ Funciona com **qualquer agente CLI** — se roda em um terminal, roda no Orca.
   <a href="https://github.com/charmbracelet/crush"><kbd><img src="https://www.google.com/s2/favicons?domain=charm.sh&sz=64" alt="Logotipo do Charm" width="16" valign="middle" /> Charm</kbd></a> &nbsp;
   <a href="https://docs.cline.bot/cline-cli/overview"><kbd><img src="https://www.google.com/s2/favicons?domain=cline.bot&sz=64" alt="Logotipo do Cline" width="16" valign="middle" /> Cline</kbd></a> &nbsp;
   <a href="https://www.codebuff.com/docs/help/quick-start"><kbd><img src="https://www.google.com/s2/favicons?domain=codebuff.com&sz=64" alt="Logotipo do Codebuff" width="16" valign="middle" /> Codebuff</kbd></a> &nbsp;
+  <a href="https://freebuff.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=freebuff.com&sz=64" alt="Logotipo do Freebuff" width="16" valign="middle" /> Freebuff</kbd></a> &nbsp;
   <a href="https://commandcode.ai/docs/quickstart"><kbd><img src="https://www.google.com/s2/favicons?domain=commandcode.ai&sz=64" alt="Logotipo do Command Code" width="16" valign="middle" /> Command Code</kbd></a> &nbsp;
   <a href="https://docs.continue.dev/guides/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=continue.dev&sz=64" alt="Logotipo do Continue" width="16" valign="middle" /> Continue</kbd></a> &nbsp;
   <a href="https://docs.factory.ai/cli/getting-started/quickstart"><kbd><img src="../assets/droid-logo.svg" alt="Logotipo do Droid" width="16" valign="middle" /> Droid</kbd></a> &nbsp;
@@ -231,7 +233,7 @@ yay -S stably-orca-bin
 
 Conecte ao app desktop para monitorar e conduzir seus agentes pelo celular.
 
-- **iOS:** [Baixar na App Store](https://apps.apple.com/us/app/orca-ide/id6766130217) ou [entrar no TestFlight](https://testflight.apple.com/join/YjeGMQBA)
+- **iOS:** [Baixar na App Store](https://apps.apple.com/us/app/orca-ide/id6766130217)
 - **Android:** [Baixar APK 0.0.50](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.50/app-release.apk)
 
 ---
diff --git a/docs/readme/README.zh-CN.md b/docs/readme/README.zh-CN.md
index 7882935dfa4..54583f4777b 100644
--- a/docs/readme/README.zh-CN.md
+++ b/docs/readme/README.zh-CN.md
@@ -179,6 +179,7 @@ VS Code 的编辑器，处处自动保存 — 把文件或图片直接拖入智
   <a href="https://cursor.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=cursor.com&sz=64" alt="Cursor logo" width="16" valign="middle" /> Cursor</kbd></a> &nbsp;
   <a href="https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli"><kbd><img src="https://www.google.com/s2/favicons?domain=github.com&sz=64" alt="GitHub Copilot logo" width="16" valign="middle" /> GitHub Copilot</kbd></a> &nbsp;
   <a href="https://dev.meta.ai/docs/muse-code"><kbd><img src="../../src/shared/agent-icons/muse.png" alt="Muse logo" width="16" valign="middle" /> Muse</kbd></a> &nbsp;
+  <a href="https://deepseek-harness.github.io/deepseek-harness/"><kbd><img src="../../src/shared/agent-icons/dsh.png" alt="DeepSeek Harness logo" width="16" valign="middle" /> DeepSeek Harness</kbd></a> &nbsp;
   <a href="https://zcode.z.ai/en/docs"><kbd><img src="../../src/shared/agent-icons/zcode.png" alt="ZCode logo" width="16" valign="middle" /> ZCode</kbd></a> &nbsp;
   <a href="https://opencode.ai/docs/cli/"><kbd><img src="https://www.google.com/s2/favicons?domain=opencode.ai&sz=64" alt="OpenCode logo" width="16" valign="middle" /> OpenCode</kbd></a> &nbsp;
   <a href="https://ampcode.com/manual#install"><kbd><img src="https://www.google.com/s2/favicons?domain=ampcode.com&sz=64" alt="Amp logo" width="16" valign="middle" /> Amp</kbd></a> &nbsp;
@@ -193,6 +194,7 @@ VS Code 的编辑器，处处自动保存 — 把文件或图片直接拖入智
   <a href="https://github.com/charmbracelet/crush"><kbd><img src="https://www.google.com/s2/favicons?domain=charm.sh&sz=64" alt="Charm logo" width="16" valign="middle" /> Charm</kbd></a> &nbsp;
   <a href="https://docs.cline.bot/cline-cli/overview"><kbd><img src="https://www.google.com/s2/favicons?domain=cline.bot&sz=64" alt="Cline logo" width="16" valign="middle" /> Cline</kbd></a> &nbsp;
   <a href="https://www.codebuff.com/docs/help/quick-start"><kbd><img src="https://www.google.com/s2/favicons?domain=codebuff.com&sz=64" alt="Codebuff logo" width="16" valign="middle" /> Codebuff</kbd></a> &nbsp;
+  <a href="https://freebuff.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=freebuff.com&sz=64" alt="Freebuff logo" width="16" valign="middle" /> Freebuff</kbd></a> &nbsp;
   <a href="https://commandcode.ai/docs/quickstart"><kbd><img src="https://www.google.com/s2/favicons?domain=commandcode.ai&sz=64" alt="Command Code logo" width="16" valign="middle" /> Command Code</kbd></a> &nbsp;
   <a href="https://docs.continue.dev/guides/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=continue.dev&sz=64" alt="Continue logo" width="16" valign="middle" /> Continue</kbd></a> &nbsp;
   <a href="https://docs.factory.ai/cli/getting-started/quickstart"><kbd><img src="../assets/droid-logo.svg" alt="Droid logo" width="16" valign="middle" /> Droid</kbd></a> &nbsp;
diff --git a/docs/reference/agent-status-store.md b/docs/reference/agent-status-store.md
index 4dff79d6666..b7ce4fa16dd 100644
--- a/docs/reference/agent-status-store.md
+++ b/docs/reference/agent-status-store.md
@@ -105,8 +105,15 @@ ingests the summary into the hook server as a status row:
 | `structuredHost`                                    | `'owned'` while `summary.hostExecutionOwned` is set, otherwise `'held'`; `worktree ps` derives its row's `structuredHostOwned` from it                                        |
 | prompt, tool, last message, model, provider session | the summary's fields                                                                                                                                                          |
 
-Sessions with no persisted turn (`status === null`) produce no row, matching
-what the chat shows. When the host revokes live ownership the row is re-set
+Sessions with no request (`status === null`) produce no row. A request is a
+turn record, an assistant message, a user message the provider journaled itself
+(history, an older host), an accepted or unanswered send, or a send the agent or
+its start refused; a send that was withdrawn, or left undelivered by a
+restart or a close, fails nobody and makes nothing listable.
+`summary.turnOutcome` is the latest request's verdict: its turn's outcome, or
+`failure` for a send the agent or its start refused (a send that joined a running
+turn is answered by that turn). The row also publishes `interrupted` from
+`mainAgent.outcome`, exactly as the hook lanes do. When the host revokes live ownership the row is re-set
 without the flag; when the host closes or evicts the session the row is
 dropped. Both already exist as feed events (`revokeLive` and the roster
 filter in `liveSessionSummaries`); PR 1 turns them into store writes.
@@ -218,6 +225,32 @@ sends no hook at all on a cancel and no `is_interrupt` on Stop; that flag on a
 turn boundary remains a secondary source for builds that send it, and
 `StopFailure` maps to `failure`.
 
+Readers decode the verdict through one accessor, `agentMainAgentVerdict`, which
+reads the main agent's own state, not the combined row's: `mainAgent.outcome`
+while `mainAgent.state` is `done`, then the legacy `interrupted` flag as a
+cancellation, which alone needs the combined `done`. So a main agent that
+failed while its subagents still run has a verdict on a `working` row. Every
+copy of a row (state-history entries, sleep records, `worktree ps` rows) takes
+the verdict through `agentVerdictFields`, which carries `interrupted` and the
+whole `mainAgent` (state, outcome and its own clock) together, so a copy agrees
+with the row and can date a failure by `mainAgent.stateStartedAt`.
+
+Display reads the verdict through `agentVerdictDisplayMark`: a failure marks the
+agent failed whatever the combined state, because it is news the user must see
+even while subagents run; a stop marks it interrupted only on a `done` row, so
+a stopped or finished main agent with live child work still reads working.
+Each subagent keeps its own row and state. Container rollups (worktree card,
+terminal tab, Cmd+J) rank a pending question first, then a failure, then live
+work, then a stop, then done. On the worktree card, a failure retained after its
+agent's pane went away has no expiry, so it ranks below live work and above a
+stop. Lifecycle waiters keep reading the combined `state`.
+
+Policy splits the verdict two ways. Clean-finish policy (hibernation, pane
+ownership, the star-nag value moment) treats a failure like a cancellation
+(`agentTurnEndedUncleanly`). Attention (completion time, Smart Sort, sticky
+retention, Cmd+J Recent) demotes only a turn the user stopped
+(`agentTurnStoppedByUser`); a failure ranks like a completion.
+
 Admission is one function, `normalizeAgentStatusPayload`, on the relay wire,
 IPC and disk. A malformed `mainAgent` drops the field and keeps the row. Old hosts
 send none and readers fall back to `state`. Hook rows persist it inside the
diff --git a/docs/reference/antigravity-readiness-evidence.md b/docs/reference/antigravity-readiness-evidence.md
index 2700730fccf..db505d2ff03 100644
--- a/docs/reference/antigravity-readiness-evidence.md
+++ b/docs/reference/antigravity-readiness-evidence.md
@@ -251,7 +251,7 @@ What the captures support and the shipped detector now does:
   API-key users.
 - **Veto an active model picker.** `Switch Model` followed by a labeled selection row means the
   bare caret belongs to the composer behind the picker; readiness resumes after `Exited /model
-  command`.
+command`.
 - **Do not anchor on `headerIndex`.** The banner is printed once and never reprinted.
 - **The blocked-signal path already works** for the trust dialog: `antigravity-dialog-trust-workspace.txt`
   is correctly refused today, by wording, not by structure.
diff --git a/docs/reference/ci-demand-rollout.md b/docs/reference/ci-demand-rollout.md
new file mode 100644
index 00000000000..081d276c4bf
--- /dev/null
+++ b/docs/reference/ci-demand-rollout.md
@@ -0,0 +1,148 @@
+# CI demand rollout
+
+This implements the September 28 runner-demand analysis. The baseline inventory
+covered September 27 04:00–September 28 04:00 UTC: 4,028 workflow runs, with
+463 stratified job samples. Estimated occupancy was 1,081 runner-hours, dominated
+by PR unit shards (414 hours) and Bun qualification (262 hours). These are
+sampled sums of job durations across different runner pools, not billing totals
+or a guaranteed forecast of savings.
+
+## What runs now
+
+| Work                         | Ordinary draft update                                                          | Ready PR / final checks                       | Main reference                          |
+| ---------------------------- | ------------------------------------------------------------------------------ | --------------------------------------------- | --------------------------------------- |
+| Static analysis and types    | Immediately                                                                    | Immediately                                   | Existing workflows                      |
+| Unit suite                   | Full, with shadow selection evidence                                           | Full                                          | Existing daily Node 24/26 x86 suite     |
+| Packages                     | After successful static analysis and types                                     | Same                                          | Existing release workflows              |
+| Bun persistence              | Linux x64 for ordinary runtime changes; all six platforms for sensitive inputs | All six platforms when Bun inputs changed     | Full nightly qualification at 11:30 UTC |
+| Bun glibc/musl qualification | Sensitive inputs only, after persistence succeeds                              | Both architectures after persistence succeeds | Both architectures                      |
+| E2E                          | Existing targeted routing                                                      | Existing targeted routing                     | One complete run at 17:00 UTC           |
+
+Bun-sensitive inputs include root/toolchain files, configuration, native code,
+resources, platform-specific paths, persistence, SQLite, orcad, providers,
+daemon, SSH, relay, and child-process code. Dependency discovery failure, a
+missing event or an incomplete diff retains full qualification. An unrelated
+change still skips Bun through the existing dependency classifier. No native
+artifact is shared across platforms or ABIs. The routine draft reduction is an
+explicit coverage-placement change; it does not assert identical per-update
+coverage. Every non-draft synchronize event and the ready-for-review event
+restores full qualification.
+
+Expensive PR jobs wait for static/type success. This reduces fan-out for failed
+or rapidly superseded commits without sleeping on a runner. Successful isolated
+PRs pay the extra stage latency. Existing per-PR cancellation remains in place.
+Package assertions, native boundaries, SSH/folder coverage, cache warming and
+slow-test assertions are retained.
+
+## Unit selection rollout
+
+`ci-unit-plan.mjs` discovers the same include/exclude set as Vitest and follows
+static imports, re-exports, literal dynamic imports, CommonJS requires and the
+renderer aliases. Consumers of indirect filesystem/process inputs remain in the
+candidate set, as do script/tool tests. Global configuration changes, deletions,
+renames involving removed paths, unknown inputs and graph failures run the full
+suite. A shard verifies the plan's source SHA and complete discovery list before
+using it. Missing/stale artifacts fall back to full coverage, even if that means
+running the suite on fewer shards.
+
+The initial policy is **shadow**, with every shard retained. A full run spends
+`FULL_SHARD_COUNT` (five) concurrency slots: the account is charged a slot per job
+rather than per core, so eight 6.5-minute shards made this matrix 68% of daily slot
+demand while the arm pool queued 10.5 minutes at p95. The first
+local inventory matched Vitest exactly (9,950 files at validation); representative
+source changes retained roughly 88% of files because of indirect input readers.
+That is evidence for conservative coverage, not evidence of the analysis's
+hypothetical 50% unit-work reduction. Improvements to indirect dependency
+modeling should be demonstrated against full results before expanding selection.
+
+Every shard uploads `unit-selection.json`, `unit-timings.json` (including module
+outcomes), and its assignment. The evidence job combines these into
+`unit-selection-review-attempt-N/selection-review.json`, reporting:
+
+- Whether every discovered file appeared once across a complete reference run.
+- Failures outside the candidate set, including failures in otherwise red runs.
+- Measured worker time that selection would omit; worker times overlap and are
+  not runner occupancy or a prediction of wall-clock savings.
+
+Missing/duplicate shards, stale plans, interrupted runs and unhandled errors do
+not count as complete references. Diagnostic upload/report failures do not make
+tests pass and do not independently fail successful tests.
+
+After representative complete shadow runs show no missed failures, set repository
+variable `ORCA_UNIT_SELECTION_MODE=selected` to enable selection **only for draft
+PRs**. Keep full ready-PR checks and the daily compatibility suite. Inspect at
+least a week's evidence across renderer, main, shared, SSH and fixture changes
+before promotion, including red runs rather than only successful examples.
+Unknown variable values retain shadow mode. Unset the variable or set it to
+`shadow` to roll back immediately. Selected runs use one to eight timing-balanced
+shards based on retained work.
+
+Ready-for-review result reuse includes `unit full` in its source/workflow
+identity. A green selected draft cannot satisfy the final full check, even if
+the repository variable changes between runs. An already successful _full_
+identical-source check can still be reused.
+
+To inspect downloaded shard artifacts locally:
+
+```sh
+node config/scripts/ci-unit-selection-review.mjs ARTIFACT_DIRECTORY
+```
+
+## Review automation
+
+Pullfrog recognizes the existing `Review #N [id]` and
+`Review new commits on #N [id]` dispatch names. Explicit dispatchers may provide
+`pull_request_number` and `head_sha`. Explicit PR identities share concurrency at the workflow boundary. Legacy review
+names use a bounded lookup of the latest 100 dispatches and cancel only lower
+run IDs for the same PR; a delayed older scope cannot cancel a newer review.
+Unrecognized tasks are never grouped. The scope job alone has Actions write
+permission for ordered cancellation. Closed PRs and explicitly stale heads
+are skipped. A second head check prevents starting an agent after its queued
+head has changed. Unrecognized agent tasks remain independent; lookup failures
+also retain an independent task rather than cancelling unrelated work.
+
+This does not introduce a fixed debounce interval or remove final reviews.
+Dispatchers should supply `head_sha` for reliable stale-at-dispatch detection;
+legacy names identify a PR but do not prove which head the prompt describes.
+
+## E2E signal
+
+The daily reference still executes all shards and keeps original verdicts. Each
+shard uploads Playwright JSON and publishes expected, skipped, unexpected, flaky
+and startup-error counts with the failing test names/messages. Targeted PR and
+manual coverage remain available. This change does not fix the historically
+red tests or pretend they pass.
+
+`config/e2e-failure-tracking.json` can separate an evidenced repeated failure
+from new failures in the summary. Each entry must have exact `file`, full
+`title`, `project`, a nonempty stable `message` substring, an `@owner`, a linked
+repository `issue`, and an ISO `expires` review date. Expired/malformed entries
+are ignored and reported; changed error signatures appear as untracked. Entries
+never skip a test or change its exit status. The initial list is empty because
+the analysis established red workflows but did not establish owners and
+reproductions for individual failures. Do not blanket-baseline an entire red run.
+
+## Capacity measurements and acceptance
+
+`CI runner demand` runs daily at 04:23 UTC and can be dispatched manually. It
+reads the previous 24 complete hours in hourly pages, samples up to six runs per
+workflow/outcome stratum, and fetches job pages with bounded concurrency. An
+hour exceeding the API's 1,000-result search cap fails visibly. The report and
+raw evidence are retained for 30 days. No extra runner pool is provisioned.
+
+The report measures the full job durations of runs **created** in the window,
+not occupancy clipped to the window: earlier runs that overlap it are excluded,
+and completed sampled jobs may finish after it. This matches the baseline
+cohort method. Workflow IDs keep ref-qualified paths in one sampling stratum.
+
+The report shows weighted runner-hours and cancelled-run hours per workflow,
+runner-minutes per completed PR _run_, and weighted queue/provisioning p95 per
+runner label. It counts latest attempts only, excludes incomplete jobs, and
+retains zero-job observations. It does not measure other repositories competing
+for organization capacity. Compare equivalent traffic windows, not raw totals
+alone. The collector needs only `contents: read` and `actions: read`.
+
+After a week, compare runner-minutes per PR run, cancellation occupancy and
+queue p95 in each affected pool. Count newly added planning/reference overhead.
+A 25–35% overall reduction remains an experiment target, not an achieved result;
+selection, coalescing and matrix reductions overlap and cannot simply be added.
diff --git a/docs/reference/ci-runner-efficiency.md b/docs/reference/ci-runner-efficiency.md
index 6d688598097..5a59c75db5e 100644
--- a/docs/reference/ci-runner-efficiency.md
+++ b/docs/reference/ci-runner-efficiency.md
@@ -1,5 +1,350 @@
 # CI efficiency and runner capacity
 
+The [September 28 demand rollout](ci-demand-rollout.md) documents staged checks,
+unit-selection evidence, Bun qualification, review cancellation and daily occupancy reports.
+
+## September 27 follow-up
+
+### Shared E2E CLI output
+
+E2E consumers previously compiled the CLI individually even though they downloaded
+shared Electron, web, and relay output. The producer now compiles the CLI once,
+in parallel with web projection after Electron has finished clearing `out/main`.
+Consumers repair executable permissions and install their own dev launcher with
+the same preparation script used by local CLI builds. Older refs without that
+script retain their original per-consumer compilation.
+
+An [eight-sample comparison](https://github.com/stablyai/orca/actions/runs/36307081200)
+measured producer time increasing from 26.3–27.9s to 38.8–41.0s, while consumer
+CLI compilation fell from 20.9–21.2s to 0.06–0.07s of direct preparation. All 5,519
+output files matched byte-for-byte, and every sample passed the CLI help smoke.
+A four-sample
+[final implementation comparison](https://github.com/stablyai/orca/actions/runs/36307382635)
+also passed parity and CLI smoke checks. Consumer compilation took 4.7 / 12.8s
+versus 0.08 / 0.06s of preparation; producer time increased by 0.2 / 7.1s in
+the paired trials. Across both runs this models roughly 1.1–4.7 aggregate runner
+minutes saved across 14 consumers, before artifact transfer overhead. Runner
+variation is substantial; this is not a measured workflow wall-time reduction.
+Test coverage and deadlines stay intact.
+
+
+[PR #23368](https://github.com/stablyai/orca/pull/23368) overlaps shell installation
+with dependency setup, starts localization extraction before the orcad smoke,
+and prepares mobile route snapshots while WebKit and the bundle are being built.
+Its 27 checks passed without retries; seven existing conditional checks skipped.
+
+Same-runner comparisons in both orders measured:
+
+| Work | Before | After | Evidence |
+| --- | --- | --- | --- |
+| Static block | 63.5 / 74.7s | 38.9 / 55.6s | [Full comparisons](https://github.com/stablyai/orca/actions/runs/36302208990) |
+| Shell job, downloads warmed equally | 76.8 / 70.3s | 64.4 / 64.0s | [Controlled shell runs](https://github.com/stablyai/orca/actions/runs/36302612626) |
+| Mobile preparation | 19.8–21.6s | 18.0–18.5s | [Eight measurements](https://github.com/stablyai/orca/actions/runs/36302877583) |
+| Web projection and mobile build | 17.2–17.3s | 11.7–12.1s | [Eight measurements](https://github.com/stablyai/orca/actions/runs/36302974324) |
+| Mobile verifier fixture suite | 25.47 / 25.35s | 20.04 / 19.92s | [Four full-suite runs](https://github.com/stablyai/orca/actions/runs/36302692823) |
+| E2E build outputs | 28.6–30.4s | 25.8–27.8s | [Eight measurements](https://github.com/stablyai/orca/actions/runs/36304001325) |
+
+Full mobile-job timings were dominated by first-run apt installation and browser
+test variation; the controlled preparation measurement is the scheduling evidence.
+All 1,248 web/mobile output files matched byte-for-byte in the build comparison.
+The fixture suite kept all 47 tests, isolated mutable copies, and the verifier's
+two fresh builds. No deadline, isolation, or worker-count changes were needed.
+
+E2E builds reuse the existing isolated main/preload/renderer build wrapper, now
+forwarding `--mode e2e` to each target. All 2,640 output files matched byte-for-byte
+in both execution orders, including the exposed test store and relay artifacts.
+This saves a few build seconds; it does not speed up the E2E tests themselves.
+
+The existing unit assignment was already balanced at about 919 historical
+worker-seconds per shard; fresh x86 elapsed times still ranged from 254 to 433s.
+Refreshing weights alone would encode runner variation rather than resolve it.
+An [identical-source architecture pilot](https://github.com/stablyai/orca/actions/runs/36302250920)
+ran shards 1 and 8 on both four-CPU hosted runners. Complete jobs improved from
+449 to 404s and 461 to 384s on ARM, including setup; test and skip counts matched.
+A [full ARM run](https://github.com/stablyai/orca/actions/runs/36302906752) then passed
+all eight shards in 329–373 test seconds (365–412 job seconds). Uploaded reports
+matched the same complete x86 assignment: 9,876 files, each exactly once, no
+unhandled errors. These are elapsed samples excluding queue time, not a guarantee
+that every ARM allocation is faster than every x86 allocation.
+
+PR unit shards and their cache primer now use ARM; a main-branch warmer seeds
+that architecture's existing native and pnpm cache keys. Native, package, and
+relay gates continue on x86. The daily workflow retains complete x86 coverage on
+both Node 24 and Node 26, including relay integration. Thus PR unit architecture
+changes, while x86 unit coverage remains scheduled; this is an explicit coverage
+placement tradeoff rather than a claim of identical per-PR host coverage.
+
+PR validation exposed a WebRTC probe timeout inside a hidden renderer. Isolated
+and four-concurrent probes passed on both architectures; the original cause is
+unproven. The probe now uses Electron main for the same three-second observation
+interval. A [fault-injection comparison](https://github.com/stablyai/orca/actions/runs/36304349257)
+passed with renderer timers unavailable on both architectures, while the original
+probe failed the negative control. Packet assertions and deadlines are unchanged.
+A subsequent Windows run timed out in the installer's real CIM process query
+after verifying restricted policy. Its unchanged probe now runs before the
+concurrent native suite, removing that source of contention without relaxing
+the twenty-second process deadline or dropping either PowerShell architecture.
+
+Replacing Vitest deep comparisons with Node assertions in the status-store
+oracle saved only about one local second in an initial trial. The change was
+not retained: that evidence did not justify changing assertion semantics.
+
+The combined root/mobile pnpm cache is now present on main and was restored in
+the September 27 static comparison, so another warmer for that key is unnecessary.
+
+A [fixture-warmer overlap trial](https://github.com/stablyai/orca/actions/runs/36303613587)
+ran faster after initialization but exposed a first-use action-download race:
+both background composites downloaded `actions/cache@v5` simultaneously, and
+one briefly could not find `restore/action.yml`. The existing cache fallback
+rebuilt the image and the job passed, but that recovery erased the speedup.
+Keep the dedicated warmer serial. PR package restores remain safe from this
+observed first-use race because their earlier top-level cache action is loaded
+before the composites start; the workflow contract now preserves that ordering.
+
+## Four follow-up changes
+
+- Keep the readiness event, but reuse required checks only after an Actions API
+  lookup proves that the same PR head, tested merge commit, and workflow commit
+  already completed successfully. A changed base, missing proof, failed lookup,
+  or still-running check falls back to the full checks. Advisory tests retain
+  their normal readiness routing. The mobile and line-count workflows have no
+  draft-dependent work, so they no longer run again when a draft becomes ready.
+- Route the Bun matrix using the actual headless build and selected tests'
+  transitive imports, with conservative inclusion for dynamic workers, native
+  inputs, fixtures, and toolchain changes. A graph failure runs the full matrix;
+  manual dispatch still runs all ten platform jobs. The shared test selectors
+  retain the same 85 files. Unrelated shard timings and mobile-test tooling can
+  skip the matrix; shared shortcut definitions remain real runtime dependencies
+  and still run it. Building the graph does not execute the imported modules.
+- Restore pnpm stores on PRs using setup-node's existing key and store path,
+  without publishing more PR-private copies. Non-PR setup-node caching and
+  native/TypeScript caches keep their existing behavior. A missing main store
+  still installs with the frozen lockfile. The mixed root/mobile store may miss
+  repeatedly because the existing main warmer only seeds the root lockfile.
+- Batch only the PowerShell quota-fixture reservations within each test, using
+  the original generated scripts in fresh local scopes. Commands under test
+  retain separate processes, real file identities, and existing race assertions.
+  A traced local run confirms 44 PowerShell starts become 24, with all 21 cases
+  passing. Alternating after/before/after elapsed times were 50.00/59.28/37.00
+  seconds on a shared macOS arm64 host; that variance does not justify a precise
+  percentage or hosted runner-time claim. Test budgets and worker counts are
+  unchanged.
+
+The reproducible pnpm-store comparison is
+`ORCA_BACKGROUND_LAUNCH=1 node config/scripts/ci-pnpm-store-benchmark.mjs --samples=3`.
+On macOS arm64 with BSD tar, three alternating fresh-store pairs eliminated a
+median 332,746,995-byte archive per miss. Median install time was 17.33 seconds
+before and 16.94 after; the removed archive step alone took 53.51 seconds.
+Those local disk/CPU measurements exclude uploads and are not a prediction of
+Linux or Windows hosted savings. Restore cost is common to both policies.
+
+## September 26 verification
+
+[PR #23053](https://github.com/stablyai/orca/pull/23053) was merged before its
+latest full run finished. That run,
+[36221874572](https://github.com/stablyai/orca/actions/runs/36221874572), ultimately
+failed the mobile pending-frame precondition, just as the previous run had.
+All eight unit shards passed, but the aggregate did not. An unchanged assertion
+was not enough evidence to label the failure an unrelated flake.
+
+Main subsequently received the deterministic frame hold in PR #22635. The real
+terminal refit now queues a frame that the recorder holds until disposal has
+finished, then releases surviving work against a remounted terminal. This
+follow-up adds a negative control: cancellation is disabled only during disposal,
+and the same recorder must report a document-owned callback after disposal.
+The normal case retains its pending-work and zero-leak assertions. Both cases
+passed five fresh headless Chromium runs locally; the complete terminal-render
+file passed all 13 tests. Browser dependencies were required, so these were real
+render checks rather than skipped bundles.
+
+Unit model tests now import Monaco's editor API directly, preserving real models
+and undo stacks without loading every language contribution. The registry bridge
+requires only the editor and URI interfaces it actually uses. The full application
+still imports its existing Monaco entry point; no production runtime behavior,
+assertions, worker counts, timeouts or isolation settings changed.
+A controlled local comparison (macOS arm64, Node 26.6.0, Vitest 4.1.11,
+`--maxWorkers=1` only for this comparison) kept six files and all 32 tests.
+Three warm original samples took 14.53/12.84/11.62 seconds; three editor-API
+samples took 12.95/9.81/7.99 seconds, alternating back to the original imports
+between measurements. Median elapsed time fell 12.84 to 9.81 seconds (23.6%);
+median import time fell 10.73 to 7.94 seconds (26.0%). The initial cold original
+sample, 20.29 seconds, is excluded. Shared-host variance remains; this is a
+focused measurement, not a claim of a 23.6% improvement to the full unit suite.
+
+The default-branch warmer
+[36221917346](https://github.com/stablyai/orca/actions/runs/36221917346) successfully
+published native modules and TypeScript state. Fresh PRs
+[#23101](https://github.com/stablyai/orca/pull/23101) and
+[#23104](https://github.com/stablyai/orca/pull/23104) restored both on their first
+runs. Scope inventories showed neither PR had a private copy; the TypeScript
+key existed only on main. Native restore took 0.45/0.54 seconds; TypeScript restore
+took 0.38/1.31 seconds, with compiler steps of 8/39 seconds versus the warmer's
+80-second cold compiler step. PR #23104 used the prefix fallback after its base
+advanced, confirming reuse across commits as well as PRs.
+
+The same warmer saved a 22.5 MB Git cache, but the exact key disappeared before
+it was reused. Quota eviction is plausible, not proven: the usage API reported
+17.48 GiB while a separate live 100-entry sample contained 15.15 GiB of pnpm
+stores alone. These rapidly changing inventories are not atomic. The root-only
+warmer does not seed the root-plus-mobile download-store key used by static
+analysis, so both fresh PRs saved another roughly 350 MiB store. Controlling that
+cache duplication is a remaining opportunity; hourly warming alone cannot
+promise retention. Git's checksum-verified cold-build fallback remains required.
+
+The unit scheduling baseline now comes from all eight successful Node 24 shards in
+[run 36294142683](https://github.com/stablyai/orca/actions/runs/36294142683).
+All 9,847 measurements match current discovery exactly once; the previous baseline
+had 165 unmeasured files and one deleted path. Applying the same measurements to
+both assignments reduces the largest projected load from 1,043.811 to 919.695
+worker-seconds (11.9%). This is a scheduling projection, not an elapsed-time claim;
+runner variation remains visible in the source run. See
+[provenance and reproduction](../../config/scripts/ci-shard-timings.md).
+
+## Recording compilation reuse
+
+[Benchmark run 36295773765](https://github.com/stablyai/orca/actions/runs/36295773765)
+compared the complete mobile suite on two hosted runners in opposite orders.
+Compilation reuse reduced elapsed time from 439.002 to 138.308 seconds and from
+560.926 to 200.751 seconds (64–68%). Each run preserved all 9,629 original test
+verdicts and passed four additional cache regression tests. Compiled code is
+bounded to 512 entries; exports, dependencies, and scenario state remain fresh.
+
+Splitting family recordings across four files took 145.165 and 217.226 seconds,
+5–8% slower than compilation reuse alone, so the original suite structure stays.
+All 787 goldens were regenerated from the unchanged pinned product tree; only
+the recorder digest changed, with identical recording bodies and value pools.
+
+Desktop validation in [run 36295671576](https://github.com/stablyai/orca/actions/runs/36295671576)
+passed all eight shards. The longest test step was 419 seconds versus 429 in the
+source run; summed test time was 3,028 versus 3,031 seconds. Runner variation
+prevents attributing that small elapsed-time difference solely to the weights.
+
+## September 25 follow-up
+
+The current queue is a bigger part of PR latency than setup. Successful full PR
+[36212793136](https://github.com/stablyai/orca/actions/runs/36212793136) used
+**74.6 aggregate runner-minutes**, including **55.5** for its eight unit shards.
+Those jobs ran for 315–448 seconds but waited 229–1,076 seconds to start. The
+three-second final `verify` job waited another 264 seconds. These are observed
+job creation-to-start and start-to-completion intervals, not billing figures.
+
+This follow-up keeps the existing tests, isolation, eight unit shards, platform
+coverage, and release behavior:
+
+- Make the reusable unit-test call and final aggregate respect cancellation.
+  Their old `always()` conditions kept superseded work alive despite workflow
+  cancellation. In [36215475069](https://github.com/stablyai/orca/actions/runs/36215475069),
+  a newer push cancelled ordinary jobs while all eight unit shards remained
+  queued and the replacement workflow remained pending. `!cancelled()` still
+  evaluates after failed/skipped dependencies, without resisting cancellation.
+  Two other superseded PR runs reproduced this: at 04:27 UTC on September 26,
+  [36216165253](https://github.com/stablyai/orca/actions/runs/36216165253) and
+  [36215543186](https://github.com/stablyai/orca/actions/runs/36215543186) still held
+  11 runners, with two more obsolete jobs queued. They had consumed another
+  71.3 runner-minutes after replacement pushes. After rechecking current PR heads
+  and replacement runs, both obsolete runs were force-cancelled; their replacements
+  left the blocked pending state.
+- Combine root/README guards with change detection. A real sparse checkout kept
+  all 29,487 index entries while materializing only 12 files (192 KB). This
+  eliminates one runner allocation and checkout per PR. README link checks still
+  see tracked targets outside the working tree and run on docs-only PRs.
+- Use free `ubuntu-slim` containers for small guard/aggregate/API jobs; trial
+  free `ubuntu-24.04-arm` for typechecking, which needs no native runtime.
+  Both share the account's standard concurrency limit. Different labels do
+  **not** grant extra concurrent jobs; hosted timings determine their value.
+- Cancel superseded PR attempts in the Git termination, Pi owner, and Pi provider
+  runtime workflows, retaining independent manual runs.
+- Fetch only complete HEAD ancestry for cloud secret scanning. The old checkout
+  fetched every branch and tag and took 55 seconds in
+  [36214130174](https://github.com/stablyai/orca/actions/runs/36214130174).
+  Real Git fixtures prove both merge parents and deleted historical contents
+  still produce the identical scanned patches.
+- Remove the cloud lockfile from the eight unit shards' download-cache key; the
+  dedicated relay integration job still includes it. Record actual per-file
+  environment, setup, import, and test durations for the existing shard planner.
+  Shard 4 spent 535 worker-seconds importing and 357 executing tests; a uniform
+  per-file import estimate misses that cost. See [timing refresh](../../config/scripts/ci-shard-timings.md).
+- Seed Node 24 native modules, the pinned Git compatibility binary, and TypeScript
+  state on the default branch, hourly
+  and when dependency/toolchain inputs change. One ten-minute-bounded hosted job
+  reuses existing cache keys and skips typechecking an already-cached commit.
+  New PRs can restore default-branch caches, while caches saved by another PR
+  are inaccessible. The audit found 80 entries totaling 10.67 GiB, including
+  9.31 GiB of pnpm stores, but no main-branch Node 24 native or TypeScript state.
+  Seven PRs held separate copies of the same pnpm key (2.36 GB combined).
+  Git preparation now has one shared action with the unchanged cache key,
+  checksum, and build command. In
+  [36212101873](https://github.com/stablyai/orca/actions/runs/36212101873), a new PR
+  spent 40 seconds compiling the same Git 2.25.5 binary; main-branch warming
+  makes that cache available to new PRs too.
+
+The hosted trial also removes repeated work in mobile bundle checks. The
+builder keeps private snapshots of the default real output for read-only checks
+(15 identical builds become two), and haptics checks reuse each route closure
+(32 builds become eight). Determinism, custom inputs, malformed routes, stale
+outputs, and tampered manifests retain independent builds. A mutation regression
+proves Buffer/manifest consumers cannot change another assertion's fixture.
+The grant census reuses parsed references for unchanged file contents, still
+reads source every time, and has a real-file edit invalidation regression.
+The first hosted mobile lane used 400 seconds for its 448 tests; the grant
+census alone took 259 seconds. Locally, the same one-worker invocation of the
+three changed files fell from 243.07 seconds (101 passing tests) to 49.49 seconds
+(103 passing tests). Hosted run
+[36217238462](https://github.com/stablyai/orca/actions/runs/36217238462) retained
+the same 43 files and passed all 450 tests: the original 448 plus two regressions.
+Its test step fell from 400.26 to 205.17 seconds, and the complete job fell from
+498 to 298 seconds (40% less runner time). Builder, haptics, and grant-census file
+times fell from 73.70/88.94/258.58 seconds to 29.24/32.98/22.58 seconds.
+The later default-worker verification retained the same 450-test coverage, but
+its unchanged terminal-render test failed twice on the pre-existing timing
+assertion that a frame must be pending at disposal (`expected 0 to be greater
+than 0`). Its other 449 tests passed; no mobile source or assertion was relaxed.
+
+A four-worker experiment reduced aggregate unit job time from 3,386 to 3,133
+seconds (7.5%), but the repeat run exceeded the palette matcher's existing
+180ms performance budget at 235ms. The override was removed; retain Vitest's
+default worker count, isolation, timeouts, retries, and coverage. The first trial
+also found an outdated hook-order snapshot after main added three layout-persistence
+hooks. That snapshot was refreshed only after comparing the exact old and merged
+hook sequences. Final verification is linked from
+[PR #23053](https://github.com/stablyai/orca/pull/23053). Failed timing reports
+never replace the checked-in baseline.
+
+No account settings, paid services, or runner entitlements changed. Standard
+public-repository runners remain free. GitHub documents plan concurrency limits
+of Free 20, Pro 40, Team 60, Enterprise 500, and permits support requests for
+increases. The organization's actual entitlement was not exposed by the API.
+See [runner specifications](https://docs.github.com/en/actions/reference/runners/github-hosted-runners)
+and [concurrency limits](https://docs.github.com/en/actions/reference/limits).
+
+Hosted observations from [PR run 36215718607](https://github.com/stablyai/orca/actions/runs/36215718607):
+
+| Check                                     | Earlier sample |        Trial | Result               |
+| ----------------------------------------- | -------------: | -----------: | -------------------- |
+| Detection plus repository guards          |  54s, two jobs | 26s, one job | Passed               |
+| Typecheck (whole job)                     |       109s x64 |      81s ARM | Passed               |
+| Typecheck command, cold incremental state |        76s x64 |      51s ARM | Passed               |
+| Cloud secret scan (whole job)             |            69s |          55s | Passed               |
+| Cloud checkout/history fetch              |            55s |          40s | Identical scan scope |
+
+The [warmup trial](https://github.com/stablyai/orca/actions/runs/36215718295)
+passed in 54 seconds. Its x64 compiler restored the ARM job's incremental state
+and rechecked the same source in eight seconds. Unit shard 3 subsequently
+restored its pnpm/native cache keys successfully. Actual sharing across different
+PRs requires the producer to land on the default branch; this trial validates
+commands and key compatibility, not a completed default-branch rollout.
+The follow-up warmup built the Git binary in 40 seconds; the PR Git check restored
+that exact key and passed in 62 seconds overall. Its TypeScript refresh took
+seven seconds after restoring earlier incremental state.
+
+These are small observational samples from different revisions, not controlled
+benchmarks. The cold typecheck log confirms an incremental-cache miss. Queue
+changes must be separated from active duration and concurrent account traffic.
+At the time of that trial, checked-in shard weights were unchanged; the September
+26 refresh above now uses the complete successful unit reports.
+
+## September 5 audit
+
 Audit date: September 5, 2026. No paid capacity or provider configuration changed.
 
 ## Measurements and changes
diff --git a/docs/reference/codebuddy-harness.md b/docs/reference/codebuddy-harness.md
new file mode 100644
index 00000000000..e59eaec855e
--- /dev/null
+++ b/docs/reference/codebuddy-harness.md
@@ -0,0 +1,44 @@
+# CodeBuddy terminal harness
+
+CodeBuddy uses its own identity in the desktop and mobile agent catalogs, process
+detection, telemetry, hooks, resume records and AI Vault. `codebuddy` and `cbc`
+identify the interactive CLI; print, server, ACP and detached background modes do
+not identify an interactive pane. Model and effort selections use `--model` and
+`--effort`; the CLI resolves its stable model aliases for the current account.
+
+Managed hooks use the existing Claude-compatible installer and transport, with
+CodeBuddy's own `.codebuddy/settings.json` and hook source. Installation preserves
+user hooks and statusline configuration. Local and SSH installers share the same
+plan; Windows explicitly selects CodeBuddy's supported PowerShell hook shell.
+Status flows through the execution host's canonical hook store.
+
+## Observed lifecycle
+
+Verified with the authenticated CodeBuddy 2.159.0 CLI on macOS:
+
+- `UserPromptSubmit` starts work. `SessionStart` can arrive afterward and must not
+  settle that work.
+- An unanswered `AskUserQuestion` emits a `Notification` with
+  `notification_type: permission_prompt` and the message
+  `needs your permission to use AskUserQuestion`.
+- In this version, `PreToolUse(AskUserQuestion)` arrives **after** the user answers;
+  it resumes working, followed by `PostToolUse` and `Stop`.
+- `Stop` supplies the final assistant message and the provider session identity
+  supplies the resume command.
+
+The sanitized real event sequence is
+`src/shared/__fixtures__/codebuddy-question-hooks.jsonl`. The regression test
+replays it through the shared hook listener. Qoder keeps its existing lifecycle
+semantics while sharing the common event projection.
+
+AI Vault reads CodeBuddy's `type: message` JSONL records with top-level roles and
+`input_text` / `output_text` content blocks. Local, WSL and SSH discovery use the
+provider's `.codebuddy/projects` tree and the same incremental parser.
+
+## Validation scope
+
+Live macOS checks exercised launch through Orca's agent menu, model switching,
+question waiting, answer submission, working and completion indicators, history
+discovery and a resumed session recalling its earlier answer. Hidden-renderer CDP
+screenshots record the working, question and completed states. Windows, Linux,
+WSL and SSH runtime execution have not been exercised live on this machine.
diff --git a/docs/reference/monaco-language-associations.md b/docs/reference/monaco-language-associations.md
new file mode 100644
index 00000000000..a159477e176
--- /dev/null
+++ b/docs/reference/monaco-language-associations.md
@@ -0,0 +1,30 @@
+# Monaco filename associations
+
+Orca imports Monaco's full `editor.main.js` entry point, which registers the built-in
+languages and loads their grammars on demand. Filename detection must not load the
+editor itself: it also runs during session restoration and before the editor mounts.
+
+`monaco-language-associations.json` contains the registration metadata from the
+installed package's entry point. Regenerate it after upgrading Monaco:
+
+```sh
+node config/scripts/generate-monaco-associations.mjs
+pnpm exec oxfmt --write src/renderer/src/lib/monaco-language-associations.json
+```
+
+The generator reads syntax trees without executing contributions or grammar loaders.
+Its test compares the checked-in metadata to the installed package. The original
+list was verified against a clone of `microsoft/monaco-editor`, tag `v0.55.1`, commit
+`516f350bdaf7a82f6731bd128a9ec86a6e5fa47d` (`src/basic-languages` and `src/language`).
+
+Existing Orca filename and extension choices take precedence. This preserves custom
+Vue, Svelte, Astro, Nim, Typst, JSONL, notebook and preview handling, as well as the
+Markdown mapping for MDX. The fallback matches exact filenames before the longest
+extension, case-insensitively, and resolves duplicate associations in upstream
+registration order (the last registration wins, so `.pp` selects Ruby over Pascal).
+
+Monaco 0.55.1 has 90 registrations, 81 with filenames or extensions. Registrations
+without either remain available in Monaco but cannot be inferred from a path. This
+does not add VS Code extensions or language servers, guess from file contents, or
+change mobile's separate lowlight grammar set. The renderer uses only the basename,
+so local, Windows, SSH and folder-workspace paths share the same detection.
diff --git a/docs/reference/orcad-operations.md b/docs/reference/orcad-operations.md
index 0fafdb1feed..63f03777c17 100644
--- a/docs/reference/orcad-operations.md
+++ b/docs/reference/orcad-operations.md
@@ -145,11 +145,11 @@ An external supervisor (systemd, launchd, a process manager). orcad conforms to
   after the listener is bound and the daemon verdict is in. There is no separate readiness
   socket; the line is the signal. Set the supervisor's start timeout generously — the daemon
   launch has its own retries and can take tens of seconds on a cold host.
-- **Shutdown.** `SIGTERM` or `SIGINT` starts a graceful stop. A **second** signal exits
-  immediately with code 1 rather than being swallowed — a supervisor's second signal means
-  its first deadline elapsed, and waiting silently is what turns a stop into a `SIGKILL`,
-  the one teardown that skips the daemon handoff. orcad also imposes its own 15s deadline
-  and exits 1, so the failure stays attributable instead of arriving as an unlogged kill.
+- **Shutdown.** `SIGTERM` or `SIGINT` starts one graceful stop. Repeated signals share
+  that stop because a supervisor may signal both the launcher and its child. A 15s deadline
+  exits with code 1 if teardown stalls. The bundled runtime also stops gracefully if its
+  launcher's IPC channel closes. On POSIX, both the launcher and runtime ignore `SIGHUP`,
+  so terminal hangups do not stop a headless host. Use `SIGTERM` or `SIGINT` to stop it.
 - **Exit codes.**
 
   | Code | Meaning                                                      | Supervisor should    |
diff --git a/docs/reference/qoder-integration.md b/docs/reference/qoder-integration.md
new file mode 100644
index 00000000000..5aa5c55147e
--- /dev/null
+++ b/docs/reference/qoder-integration.md
@@ -0,0 +1,90 @@
+# Qoder CLI integration
+
+Orca registers `qodercli` as `qoder`: detection, picker/settings, desktop and mobile
+identity, prompt launch, permission flags, managed hooks, workspace trust, and
+session resume use the existing TUI-agent and hook-status paths.
+
+## Verified contract
+
+Verified on macOS with Qoder CLI 1.1.64, including its versioned executable
+`qodercli-1.1.64`:
+
+- `--prompt-interactive` starts an interactive prompt; `--resume <id>` resumes a
+  session; `--dangerously-skip-permissions` is the permission bypass flag.
+- Hooks use the Claude-shaped nested configuration in `~/.qoder/settings.json`.
+  Orca registers its own `/hook/qoder` source and preserves user hooks.
+- Real SessionStart, UserPromptSubmit, Notification and SessionEnd events are
+  captured in `src/shared/__fixtures__/qoder-no-account-hooks.jsonl`, including
+  `source: resume` with the original session ID.
+- Trust is `permissions.trustDirectories` in that settings file, using the
+  canonical workspace path. A workspace `.trusted` marker did not bypass the
+  trust dialog in this version. Remote trust uses the execution host filesystem.
+- Qoder emits its `◇ … | Ready` title while the trust menu owns input. Readiness
+  therefore requires the live composer text, not merely this title or silence.
+  Raw PTY fixtures under `src/main/runtime/__fixtures__/qoder-*` cover trust,
+  unauthenticated prompt handling and the ready composer.
+- A hidden Orca dev instance launched Qoder from New Tab in a folder workspace.
+  Its icon, label, terminal rendering and failed-turn indicator were inspected.
+  A harmless prompt reached Qoder, which reported its credit usage limit; the
+  canonical hook store recorded Qoder identity, session metadata and failure.
+
+## Compatibility and limits
+
+Windows hooks explicitly select Qoder's documented PowerShell shell, avoiding
+an assumption that Qoder uses Git Bash just because it is installed. They reuse
+the existing managed `.cmd` payload without adding an encoded PowerShell hop.
+The configuration shape and preservation are tested; Windows, Linux and SSH
+execution have not been exercised live here.
+
+Resume requests to remote hosts require `agent-session.qoder-resume.v1`, so an
+older host is not sent an agent enum it cannot accept. Remote hook installation
+and trust preservation have automated coverage.
+
+Successful model output, tool execution and live permission dialogs remain
+unverified because the available account has exhausted its credits. Hook event
+mapping for these paths follows the official documentation. The China executable
+`qoderclicn` is not registered; it was not available for verification.
+
+Every launch Orca starts (New Tab, workspace and draft launches, automations)
+pre-trusts the workspace at spawn while the agent-wide "Trust the folder when
+Orca starts an agent" setting is on. A hand-typed `qodercli` in a plain terminal
+can still show Qoder's trust dialog.
+
+## Sources
+
+- [Official hooks documentation](https://docs.qoder.com/cli/hooks)
+- [#15291](https://github.com/stablyai/orca/pull/15291): registration and hook proposal
+- [#13311](https://github.com/stablyai/orca/pull/13311): icon asset (commit
+  `b56197025530adb1b82d97a364a8c3d4a02c0d42`) and agent integration
+- [#8611](https://github.com/stablyai/orca/pull/8611) and
+  [#12910](https://github.com/stablyai/orca/pull/12910): contributor implementations
+- [#16540](https://github.com/stablyai/orca/issues/16540): Qoder misidentified as Gemini
+
+Contributor patches informed the integration; they were not applied wholesale.
+In particular, the trust marker proposal was replaced using the installed CLI's
+observed settings write, and no renderer workaround was added because the live
+WebGL terminal rendered correctly.
+
+## Cross-review of open proposals
+
+Reviewed the current patches for all six open Qoder PRs on 2026-09-28:
+
+| PR | Incorporated or confirmed | Deliberate differences |
+| --- | --- | --- |
+| #7502 (vincent-lxc) | Agent registration, mobile parity, identity before Gemini | Use structural titles and the current public permission flag. |
+| #8611 (Eridanus117, building on #7502) | Qoder hook source, notification/permission mapping, session resume | 1.1.64 supports `--prompt-interactive`; preserve startup session identity and ignore compact restarts. |
+| #9655 (xingqingzzp-gif) | Cross-checked minimum registration coverage | Placeholder icon and detection-only scope are superseded by the fuller integration; no code copied. |
+| #12910 (jyang2004) | Reuse the Claude-compatible installer with an event subset, plus remote installation | Use observed `.qoder` path and `/hook/qoder`; Qwen and the China build remain separate work. |
+| #13311 (sorrycc) | Icon, structural title disambiguation, headless detection, display glyph cleanup | No DOM renderer override: 1.1.64 renders correctly in the live WebGL terminal. No unverified executable alias. |
+| #15291 (adlternative) | Versioned binary recognition, trust preflight wiring, skills mapping and resume | Trust comes from settings, not `.trusted`; include notifications, permission and failure events with Qoder-specific normalization. |
+
+The rendered left sidebar was checked in the hidden Electron app using a temporary
+folder workspace and real Qoder hooks. The workspace fixture needed a parent path
+on its project group to appear in the sidebar. No agent status was injected into
+the renderer. A real prompt updated the row text and returned a credit-limit error;
+the row and workspace card showed failure with the Qoder icon. A DOM observer
+recorded the prompt-row transition before failure. Permission/waiting and successful
+completion remain automated event-mapping tests, not live model/tool verification.
+
+Commit co-authors credit all six proposal authors for the implementation and
+registration groundwork, including xingqingzzp-gif’s minimal registration proposal.
diff --git a/docs/reference/remote-wire-compatibility.md b/docs/reference/remote-wire-compatibility.md
index d72f93770c5..b2bcb3c40f4 100644
--- a/docs/reference/remote-wire-compatibility.md
+++ b/docs/reference/remote-wire-compatibility.md
@@ -181,8 +181,10 @@ hand-written. It covers the three skews that surface can fail on:
 - a new client against the old dispatcher always gets an answer rather than silence,
   and `method_not_found` for every method that release does not register, so the
   absence is visible during negotiation instead of by calling;
-- a cursor survives a host restart: the client's fence is refused as stale with the live
-  one attached, and resuming from the held cursor replays only what it missed.
+- a cursor survives a host restart: a reattach at the client's fence is refused as stale
+  with the live one attached, a write still carrying that fence is delivered (writes are
+  named by their target, and every released client still sends a fence), and resuming from
+  the held cursor replays only what it missed.
 
 Run it with:
 
diff --git a/docs/reference/ssh-execution-boundary.md b/docs/reference/ssh-execution-boundary.md
index a113a5e6f29..12aeea89753 100644
--- a/docs/reference/ssh-execution-boundary.md
+++ b/docs/reference/ssh-execution-boundary.md
@@ -83,12 +83,12 @@ worth — is answered by `RuntimeHostContact` (`src/shared/runtime-host-contact.
 never be mapped onto one:
 
 - `refused` is the host answering and turning us away — unauthorized, a protocol mismatch, a status
-  method it does not implement. That is positive evidence about the *connection*, and it says
+  method it does not implement. That is positive evidence about the _connection_, and it says
   nothing whatever about whether the host's PTYs are running. They almost certainly still are.
 - `retired` is the pairing being ended by explicit user action. Same point: the client stops having
   a route, the remote work is unaffected.
 
-Both are reasons to stop *trusting a cached answer*, never reasons to report a process `exited`. A
+Both are reasons to stop _trusting a cached answer_, never reasons to report a process `exited`. A
 reader that needs a process verdict must still get it from the host that owns the process, by the
 tests above.
 
diff --git a/docs/reference/ssh-reconnect-source-recovery.md b/docs/reference/ssh-reconnect-source-recovery.md
index 5dffc50e7dd..e8c12cf5189 100644
--- a/docs/reference/ssh-reconnect-source-recovery.md
+++ b/docs/reference/ssh-reconnect-source-recovery.md
@@ -129,6 +129,18 @@ the renderer retries.
 The SSH e2e lane must be green and triggering on **source** changes before any of this is attempted.
 It was skipping for 15 specs; four regressions reached a user during that window.
 
+## Resolved: a disposed pane killed its successor's new shell
+
+A pane rebuilt during its first spawn uses the same reservation key, so main can return the
+same PTY to both transports (#19386, #22578). The disposed transport must keep that shell
+while its tab and layout leaf remain and its execution host's workspace is not being deleted.
+A live transport refusing the id still retires it (#11003). This applies to local, WSL and SSH
+IPC terminals; the remote-runtime transport has no corresponding kill.
+
+The remount trigger in the Scan-22 user report remains unknown. A retained shell can outlive
+its tab if the tab closes before a successor binds it; keeping potentially owned work follows
+the SSH execution boundary.
+
 ## Open: the pane behind a preserved tab does not always rebind
 
 The merge now keeps a local tab the host has never been told about, so the tab and its title survive
diff --git a/docs/reference/windows-daemon-host-relocation.md b/docs/reference/windows-daemon-host-relocation.md
index f560597e25e..c5cb34e8ab5 100644
--- a/docs/reference/windows-daemon-host-relocation.md
+++ b/docs/reference/windows-daemon-host-relocation.md
@@ -11,7 +11,7 @@ Read this before changing the copy plan, the host exe name, the LOCALAPPDATA lay
 
 ## What the relocation actually escapes
 
-The killer is **electron-builder's process sweep, matched on image path** — not file deletion.
+The killer is **electron-builder's process sweep** — not file deletion.
 Windows will not delete a running image, so `RMDir /r "$INSTDIR"` cannot end the daemon on its own.
 
 In app-builder-lib's `allowOnlyOneInstallerInstance.nsh`, `FIND_PROCESS` / `KILL_PROCESS` have two
@@ -22,15 +22,22 @@ branches:
 | Primary  | `powershell.exe` runs, `Get-CimInstance` resolves, and `Get-ExecutionPolicy -Scope Process` is not `Restricted` | `Win32_Process` where `$_.Path.StartsWith('$INSTDIR', 'CurrentCultureIgnoreCase')` — **path-scoped**                                                                  |
 | Fallback | otherwise                                                                                                       | per-user: `taskkill /F /IM "<AppName>.exe" /FI "PID ne $pid" /FI "USERNAME eq %USERNAME%"`; per-machine: the same without the username filter — **image-name-scoped** |
 
-The probe reads the **process** scope, not the effective policy, and Group Policy writes
-`MachinePolicy`/`UserPolicy` — so a GPO-managed host whose effective policy is `Restricted` still
-exits 0 and takes the primary branch. The fallback is reached only when `powershell.exe` is absent,
-`Get-CimInstance` does not resolve, PowerShell is blocked outright (WDAC/AppLocker, Server Core), or
-an inherited `PSExecutionPolicyPreference=Restricted` is in the environment.
+The upstream policy check can select the image-name fallback even when the inline process query
+works. `Restricted` disallows script files, not inline commands. A packaged trace for #22872
+showed that fallback successfully killing the relocated `Orca.exe` during an update; the
+genuine-uninstall cleanup guard was not responsible.
 
-So on essentially every machine the sweep is path-scoped, and a daemon whose image lives under
-`%LOCALAPPDATA%` is out of range regardless of what the file is called. **Survival is a property of
-the path.** The name only matters on the fallback branch.
+Orca's `customCheckAppRunning` in `config/nsis/orca-process-check.nsh` tests the actual inline
+`Get-CimInstance Win32_Process` query with terminating errors. Success selects the path-scoped
+branch; any other result retains the upstream fallback. The hook reuses upstream process
+selection, retry, permission and installation-mode handling. It neither overrides execution
+policy nor assumes PowerShell is available.
+
+A daemon outside `$INSTDIR` survives the path-scoped sweep. A genuinely unavailable process query
+still permits an image-name sweep and cold restore. Updates also run the **old installed
+uninstaller**, whose old capability check cannot be repaired by the new installer: the first
+upgrade can still cold-restore on an affected host. Once both binaries contain the hook, later
+updates use the actual capability test on both sides.
 
 ## Why the exe is copied verbatim (and not renamed)
 
@@ -99,15 +106,22 @@ stop being scored.
   `orca-terminal-daemon.exe` name stays in the macro to reap hosts left by older builds.
 - `LOCAL_HOST_ROOT_NAME` in `daemon-host-relocation.ts` and the path in the uninstall macro are the
   same directory. Change both together.
+- Every native module the daemon bundle `require()`s must be in the copy plan
+  (`daemon-host-manifest.ts`). A missing one does not fail the fork: bare `require` walks up from the
+  relocated bundle, finds nothing, and the caller's fallback runs forever. That is how
+  `@vscode/windows-process-tree` went missing and every process-table read became a
+  `powershell.exe` CIM scan (#16905). A host missing the addon's runtime files counts as
+  unmaterialized, so hosts built before it was copied get rebuilt.
 
 ## Verifying a change
 
-Unit coverage lives in `src/main/daemon/daemon-host-relocation.test.ts` (copy plan, verbatim
+Unit coverage lives in `src/main/daemon/daemon-host-relocation.test.ts` (copy plan, native-addon mirror, verbatim
 naming, marker/atomic publish, fail-open, prune veto). Nothing in unit tests can prove survival, so
 any change to this file or to the NSIS macro needs the packaged harnesses:
 
 - `.github/workflows/win-update-survival-e2e.yml` — builds an installer from the branch and updates
-  it over itself with `--expect survival`. The primary proof.
+  it over itself with `--expect survival`. Verify normal and child-scoped `Restricted` policy;
+  also verify released-to-branch migration with the expected cold-restore limitation.
 - `.github/workflows/win-crash-survival-e2e.yml` — proves the daemon survives a main-process crash.
 - `.github/workflows/windows-terminal-restart-e2e.yml` — terminal restart behaviour.
 - `.github/workflows/win-update-e2e.yml` — release-tag-to-release-tag update, both `survival` and
diff --git a/docs/reference/windows-edr-posture.md b/docs/reference/windows-edr-posture.md
index 1ba19df87ea..f1e63657f76 100644
--- a/docs/reference/windows-edr-posture.md
+++ b/docs/reference/windows-edr-posture.md
@@ -203,7 +203,9 @@ unquoted parameter string on whitespace.
 
 One site still spells `-ExecutionPolicy Bypass` with **no** encoding, the weaker
 signal: `src/main/cli/wsl-cli-scripts.ts` (`-File`, and it is a real script
-file, so the switch is not a no-op there). `src/main/system-fonts.ts` dropped it
+file, so the switch is not a no-op there). Every Orca-managed WSL terminal now
+reaches it by default on each CLI call (`docs/reference/wsl-managed-cli.md`), not
+only after the user registers the WSL CLI. `src/main/system-fonts.ts` dropped it
 for plain `-Command`; `src/shared/secure-path-windows-acl.ts` no longer runs
 PowerShell at all, having moved to `icacls.exe`; and computer use now asks for
 `-ExecutionPolicy RemoteSigned` in
diff --git a/docs/reference/wsl-managed-cli.md b/docs/reference/wsl-managed-cli.md
new file mode 100644
index 00000000000..8ae3b61aa62
--- /dev/null
+++ b/docs/reference/wsl-managed-cli.md
@@ -0,0 +1,37 @@
+# CLI access in Orca-managed WSL shells
+
+A WSL terminal on a Windows host gets this app's CLI (`orca-ide` packaged,
+`orca-dev` in development) on its PATH with nothing installed in the guest:
+`~/.local/bin`, shell profiles, and the Windows user PATH are untouched. External
+WSL shells still need Settings → General registration.
+
+1. **Host.** `buildPtyHostEnv` calls `getManagedWslCliDir` for WSL panes only. It
+   writes a launcher and PowerShell bridge (reusing `wsl-cli-scripts.ts`) under
+   `<userData>/wsl-managed-cli/<content hash>` and exports `ORCA_WSL_CLI_DIR`.
+   Content addressing follows `shell-wrapper-content-address.ts`: builds sharing
+   user data never overwrite each other, and a present file is complete because
+   each one lands by rename. Old directories are not collected.
+2. **Crossing.** `addOrcaWslInteropEnv` adds `ORCA_WSL_CLI_DIR/p`, so both the
+   daemon and in-process spawn paths translate it with the distro's own mounts.
+3. **Guest.** `WSL_MANAGED_CLI_PATH_RESTORE` runs after user startup files in the
+   bash rcfile and the local zsh first-prompt hook, which run once per Orca shell.
+   It leads PATH with the directory when `$ORCA_WSL_CLI_DIR/$ORCA_CLI_COMMAND` is
+   executable, and otherwise prints one warning. Other login shells get no CLI;
+   nothing blocks a shell.
+
+The colocated launcher finds its bridge beside itself and PowerShell by Windows
+path, so neither guest PATH nor the automount root matters. The bridge pins this
+app's user-data directory and is written with a UTF-8 BOM so Windows PowerShell 5.1
+reads non-ASCII paths correctly. It clears `ORCA_WSL_CLI_DIR`, which WSLENV maps
+back to Windows, so an app the CLI starts never inherits it. In development it runs
+Electron as Node on `out/cli/index.js` directly, with the environment
+`buildWindowsDevLauncher` sets (`ORCA_APP_EXECUTABLE`, stashed `NODE_OPTIONS`).
+Otherwise it launches its child exactly like the registered bridge.
+
+A missing runtime (logged once) or a failed write (logged per spawn) leaves
+`ORCA_WSL_CLI_DIR` unset. A terminal daemon from an older build adds no WSLENV
+entry, so its WSL panes lack the CLI until the daemon restarts.
+
+Run the opt-in end-to-end test on Windows with `ORCA_BACKGROUND_LAUNCH=1`,
+`ORCA_TEST_MANAGED_WSL=1`, and optionally `ORCA_TEST_WSL_DISTRO=<distro>`. The zsh
+case skips when the distro lacks `zsh` or `script`.
diff --git a/docs/reference/xterm-patch-regeneration.md b/docs/reference/xterm-patch-regeneration.md
index d398f10a6bb..3197de33f20 100644
--- a/docs/reference/xterm-patch-regeneration.md
+++ b/docs/reference/xterm-patch-regeneration.md
@@ -48,6 +48,15 @@ after reset, disable or disposal. `config/scripts/xterm-image-lifecycle-contract
 exercises those boundaries against the installed addon. Font zoom scales visible
 tiles without creating enlarged full-image canvases;
 `config/scripts/xterm-image-resize-contract.test.mjs` checks allocation and tile mapping.
+Every wasm memory reserves its guard region inside V8's sandbox, which caps a
+renderer at about 124 live memories no matter how much RAM is free. Upstream
+gave each terminal a SIXEL decoder at activation and kept IIP decoders after the
+first image, so a window with ~120+ terminals ran out. The patch borrows SIXEL
+decoders from a small shared pool only while a sequence is open, keeping color
+registers on the terminal, and drops IIP decoders after each image. A decoder
+that cannot be allocated drops that image; before the patch it threw out of the
+parser and left the terminal's write queue stuck.
+`config/scripts/xterm-image-wasm-budget-contract.test.mjs` covers both.
 
 ## Rules
 
diff --git a/docs/site/content/docs/agents/supported.mdx b/docs/site/content/docs/agents/supported.mdx
index 6532e04fb58..ecc8cfd1305 100644
--- a/docs/site/content/docs/agents/supported.mdx
+++ b/docs/site/content/docs/agents/supported.mdx
@@ -45,9 +45,12 @@ To restore prompts for one agent only, edit that agent's default arguments or en
 | Auggie             | Auto-setup                                                                                                                 | [Augment](https://docs.augmentcode.com/cli/overview)                                              |
 | Autohand           | Auto-setup                                                                                                                 | [Autohand](https://github.com/autohandai/code-cli)                                                |
 | Cline              | Auto-setup                                                                                                                 | [Cline](https://docs.cline.bot/cline-cli/overview)                                                |
+| CodeBuddy          | `npm install -g @tencent-ai/codebuddy-code`                                                                                | [CodeBuddy](https://www.codebuddy.ai/cli)                                                         |
 | Codebuff           | Auto-setup                                                                                                                 | [Codebuff](https://www.codebuff.com/docs/help/quick-start)                                        |
+| Freebuff           | Auto-setup                                                                                                                 | [Freebuff](https://freebuff.com/cli)                                                              |
 | Command Code       | Auto-setup, status                                                                                                         | [Command Code](https://commandcode.ai/docs/quickstart)                                            |
 | Muse               | macOS/Linux; trusts the workspace at launch                                                                                | [Meta](https://dev.meta.ai/docs/muse-code)                                                        |
+| DeepSeek Harness   | Launched through its `dsh-tui` profile; hooks, status, questions, resume                                                   | [DeepSeek](https://deepseek-harness.github.io/deepseek-harness/)                                  |
 | ZCode              | Deep integration; needs a `zcode` CLI that ships the TUI (see note below)                                                  | [Z.ai](https://zcode.z.ai/en/docs)                                                                |
 | Continue           | Auto-setup                                                                                                                 | [Continue](https://docs.continue.dev/guides/cli)                                                  |
 | Cursor CLI         | Deep integration                                                                                                           | [Cursor](https://cursor.com/cli)                                                                  |
diff --git a/docs/site/content/docs/telemetry.mdx b/docs/site/content/docs/telemetry.mdx
index 604202e067e..f7f8568cd95 100644
--- a/docs/site/content/docs/telemetry.mdx
+++ b/docs/site/content/docs/telemetry.mdx
@@ -21,12 +21,12 @@ The categories of behavior we observe:
 
 - **Lifecycle** — when the app opens. Used to estimate daily, weekly, and monthly active users.
 - **Repos and workspaces** — when you add a repo or create a workspace. We record _how_ you did it (e.g. folder picker vs. clone URL; command palette vs. drag-and-drop), never the repo name, URL, path, branch name, or any free-form text.
-- **Agents** — when you start an agent, which agent kind it was (from a fixed list like `claude-code`, `codex`, `gemini`, etc.), and where you launched it from. Never the prompt, model details, or agent output.
+- **Agents** — which agents you use and their token counts. Never prompts or agent output.
 - **Agent errors** — a coarse error category and which agent kind was involved. We never see raw error messages or stack traces; per-incident detail stays in a local diagnostic trace file on your machine and only reaches Orca if you explicitly share a diagnostic bundle.
 - **Settings** — when you toggle one of a small whitelisted set of feature-flag or UX preferences. We record which preference changed and whether it's a boolean or an enum, never the raw value of any free-form setting.
 - **Privacy controls** — when you opt in or out of telemetry, so we can tell from aggregate data whether our consent UI is working.
 
-Every field we transmit is either a fixed enum value, a version string, or the anonymous local ID. No free-form strings from any UI input ever leave your machine.
+Fields include fixed enum values, version strings, numeric counts and revisions, and random local IDs. Conversation IDs allow repeated token summaries for the same conversation to be associated; they are pseudonymous. No free-form strings from any UI input ever leave your machine.
 
 ## What we never send
 
diff --git a/electron.vite.config.ts b/electron.vite.config.ts
index 3cd58f4a25f..87156caf6e4 100644
--- a/electron.vite.config.ts
+++ b/electron.vite.config.ts
@@ -5,7 +5,10 @@ import react from '@vitejs/plugin-react'
 import tailwindcss from '@tailwindcss/vite'
 import { createBootstrapFatalExitBanner } from './config/build-plugins/bootstrap-fatal-exit-banner'
 import { createPdfjsViewerAssetsPlugin } from './config/build-plugins/pdfjs-viewer-assets'
-import { createPlainNodeEntryGuardPlugin } from './config/build-plugins/plain-node-entry-guard'
+import {
+  CLI_MAIN_ENTRY_NAMES,
+  createPlainNodeEntryGuardPlugin
+} from './config/build-plugins/plain-node-entry-guard'
 import packageJson from './package.json' with { type: 'json' }
 
 const BUNDLED_MAIN_DEPENDENCIES = new Set([
@@ -246,6 +249,12 @@ export const electronViteConfig: UserConfig = {
           // corpora and read SQLite synchronously; a worker thread keeps that
           // off the main-process event loop.
           'usage-scan-worker-entry': resolve('src/main/usage/usage-scan-worker-entry.ts'),
+          'profile-state-backup-worker-entry': resolve(
+            'src/main/persistence/profile-state/profile-state-backup-worker-entry.ts'
+          ),
+          'profile-state-writer-worker-entry': resolve(
+            'src/main/persistence/profile-state/profile-state-writer-worker-entry.ts'
+          ),
           // Why: forked with ELECTRON_RUN_AS_NODE so @parcel/watcher faults
           // can't take down the main process (issue #7547).
           'parcel-watcher-process-entry': resolve('src/main/ipc/parcel-watcher-process-entry.ts'),
@@ -254,16 +263,9 @@ export const electronViteConfig: UserConfig = {
           'main-thread-hang-watchdog-entry': resolve(
             'src/main/hang-watchdog/main-thread-hang-watchdog-entry.ts'
           ),
-          // Why: electron-vite cleans out/main in dev. The dev CLI imports
-          // this path for `orca agent hooks ...`, so it must survive rebuilds.
-          'agent-hooks/managed-agent-hook-controls': resolve(
-            'src/main/agent-hooks/managed-agent-hook-controls.ts'
-          ),
-          'codex/managed-home-shell-preflight': resolve(
-            'src/main/codex/managed-home-shell-preflight.ts'
-          ),
-          // Why: account import mutates the user's macOS Keychain from the CLI.
-          'claude-accounts/keychain': resolve('src/main/claude-accounts/keychain.ts')
+          ...Object.fromEntries(
+            CLI_MAIN_ENTRY_NAMES.map((module) => [module, resolve(`src/main/${module}.ts`)])
+          )
         },
         // Why: Rolldown's SSR default is ESM, but Electron and sidecar launchers
         // consume these stable CommonJS paths.
diff --git a/mobile/README.md b/mobile/README.md
index be17a867702..c27b22e11fd 100644
--- a/mobile/README.md
+++ b/mobile/README.md
@@ -180,7 +180,7 @@ Do **not** bump for additive changes:
 
 Set `MIN_COMPATIBLE_MOBILE_VERSION` (kill-switch) when desktop ships a change that requires a minimum mobile version to function safely. Same for `MIN_COMPATIBLE_DESKTOP_VERSION` from the mobile side.
 
-When a verdict is `blocked`, `mobile/src/components/ProtocolBlockScreen.tsx` renders a screen pointing the user at either the App Store (mobile too old) or GitHub Releases (desktop too old).
+When a verdict is `blocked`, `mobile/src/components/ProtocolBlockScreen.tsx` renders a screen pointing the user at the update that clears it. When mobile is too old it opens the newest release if the installed app's update check knows one, otherwise the App Store (iOS) or GitHub Releases (Android). When desktop is too old it opens GitHub Releases.
 
 To exercise the block screen locally: set `MIN_COMPATIBLE_DESKTOP_VERSION = 999` in `mobile/src/transport/protocol-version.ts`, rebuild, pair to any desktop. Revert before merging.
 
diff --git a/mobile/app/_layout.tsx b/mobile/app/_layout.tsx
index c65008db7ce..711ee41ffd3 100644
--- a/mobile/app/_layout.tsx
+++ b/mobile/app/_layout.tsx
@@ -24,6 +24,7 @@ import { ensureDesktopNotificationChannel } from '../src/notifications/desktop-n
 import { loadHostCatalog } from '../src/transport/host-store'
 import { extractPairingCodeFromUrl } from '../src/transport/pairing'
 import { recoverMobileRelayPairing } from '../src/transport/mobile-relay-pairing-recovery'
+import { appUpdateChecker } from '../src/app-update/app-update-runtime'
 
 // Why: keeps the native splash screen visible until the React tree is mounted
 // and ready to render. Without this the user sees a blank white/black frame
@@ -65,6 +66,8 @@ export default function RootLayout() {
   // Why: a rolled APNs/FCM token stops delivering silently, so every paired host
   // has to be re-registered with the new one as soon as the provider hands it over.
   useEffect(() => startPushTokenSync(), [])
+  // Cold start, then foreground and timer checks on the desktop updater's cadence.
+  useEffect(() => appUpdateChecker.start(), [])
   useEffect(() => startAndroidForegroundPushPresentation(), [])
 
   // Why: route `orca://pair?...` deep links to the confirm screen so
diff --git a/mobile/app/h/[hostId]/edit.tsx b/mobile/app/h/[hostId]/edit.tsx
index af15f28ad20..90e9bc6c167 100644
--- a/mobile/app/h/[hostId]/edit.tsx
+++ b/mobile/app/h/[hostId]/edit.tsx
@@ -17,15 +17,16 @@ import { colors, radii, spacing, typography } from '../../../src/theme/mobile-th
 import { loadHosts, updateHostNameAndEndpoint } from '../../../src/transport/host-store'
 import { displayHostEndpoint } from '../../../src/transport/host-endpoint'
 import { resolveHostEndpointEdit } from '../../../src/transport/host-endpoint-edit'
-import { useForceReconnect, usePrimeHosts } from '../../../src/transport/client-context'
+import { usePrimeHosts, useRefreshHostClient } from '../../../src/transport/client-context'
 import type { HostProfile } from '../../../src/transport/types'
+import { hostOs } from '../../../src/platform/host-os'
 
 export default function EditHostScreen() {
   const router = useRouter()
   const insets = useSafeAreaInsets()
   const { hostId } = useLocalSearchParams<{ hostId: string }>()
   const primeHosts = usePrimeHosts()
-  const forceReconnectHost = useForceReconnect()
+  const refreshHostClient = useRefreshHostClient()
 
   const [host, setHost] = useState<HostProfile | null>(null)
   const [loadError, setLoadError] = useState<string | null>(null)
@@ -130,10 +131,8 @@ export default function EditHostScreen() {
     router.back()
 
     if (nextEndpoint !== undefined) {
-      // Why: reconnect is a follow-on side effect of a save that already
-      // committed — its failure or a hang must not be reported as a save
-      // failure or block navigating back.
-      void forceReconnectHost?.(host.id).catch(() => {})
+      // Why: the live client, even one riding the relay, and its primed profile hold the old address.
+      refreshHostClient(host.id)
     }
   }
 
@@ -181,7 +180,7 @@ export default function EditHostScreen() {
       ) : (
         <KeyboardAvoidingView
           style={styles.flex}
-          behavior={Platform.OS === 'ios' ? 'padding' : undefined}
+          behavior={hostOs() === 'ios' ? 'padding' : undefined}
         >
           <ScrollView
             contentContainerStyle={[styles.form, { paddingBottom: insets.bottom + spacing.xl }]}
diff --git a/mobile/app/settings.tsx b/mobile/app/settings.tsx
index eb954a8e83d..8b3267e2f86 100644
--- a/mobile/app/settings.tsx
+++ b/mobile/app/settings.tsx
@@ -2,6 +2,7 @@ import { Linking } from 'react-native'
 import { useRouter } from 'expo-router'
 import SettingsMenuScreen from '../src/settings/settings-menu-screen'
 import { PendingCredentialCleanupCard } from '../src/settings/pending-credential-cleanup-card'
+import { SettingsAppUpdateSection } from '../src/settings/settings-app-update-section'
 
 export default function NativeSettingsRoute() {
   const router = useRouter()
@@ -10,6 +11,7 @@ export default function NativeSettingsRoute() {
       push={(route) => router.push(route)}
       openExternal={(url) => Linking.openURL(url)}
     >
+      <SettingsAppUpdateSection />
       <PendingCredentialCleanupCard />
     </SettingsMenuScreen>
   )
diff --git a/mobile/modules/orca-mobile-web-shell/ios/MobileWebShellKeyboardAccessory.swift b/mobile/modules/orca-mobile-web-shell/ios/MobileWebShellKeyboardAccessory.swift
new file mode 100644
index 00000000000..43de70947b0
--- /dev/null
+++ b/mobile/modules/orca-mobile-web-shell/ios/MobileWebShellKeyboardAccessory.swift
@@ -0,0 +1,50 @@
+import ObjectiveC
+import UIKit
+import WebKit
+
+/// Removes WKWebView's form accessory bar (up, down, done). Native screens have none, and the
+/// keyboard event the shell publishes counts it, so the page lifted by the bar as well. WebKit
+/// exposes no switch, so the content view is moved onto a subclass whose `inputAccessoryView` is
+/// nil, the same technique react-native-webview's `hideKeyboardAccessoryView` uses.
+func hideKeyboardAccessoryBar(of webView: WKWebView) {
+  guard
+    let content = webView.scrollView.subviews.first(where: {
+      String(describing: type(of: $0)).hasPrefix("WKContent")
+    })
+  else {
+    return
+  }
+  let base: AnyClass = type(of: content)
+  let name = "\(NSStringFromClass(base))_OrcaNoAccessory"
+  let subclass: AnyClass
+  if let existing = NSClassFromString(name) {
+    subclass = existing
+  } else {
+    guard let created = objc_allocateClassPair(base, name, 0) else {
+      return
+    }
+    let noAccessory: @convention(block) (AnyObject) -> UIView? = { _ in nil }
+    let selector = #selector(getter: UIResponder.inputAccessoryView)
+    let typeEncoding = method_getTypeEncoding(class_getInstanceMethod(UIResponder.self, selector)!)
+    class_addMethod(created, selector, imp_implementationWithBlock(noAccessory), typeEncoding)
+    objc_registerClassPair(created)
+    subclass = created
+  }
+  object_setClass(content, subclass)
+}
+
+/// Stops WKWebView reacting to the keyboard itself. It listens for the keyboard's frame and scrolls
+/// the document to reveal the focused field, on top of the lift the page already applies from the
+/// height the shell sends, so the page moved twice. The shell's own listeners are unaffected.
+func ignoreKeyboardNotifications(in webView: WKWebView) {
+  for name in [
+    UIResponder.keyboardWillShowNotification,
+    UIResponder.keyboardDidShowNotification,
+    UIResponder.keyboardWillHideNotification,
+    UIResponder.keyboardDidHideNotification,
+    UIResponder.keyboardWillChangeFrameNotification,
+    UIResponder.keyboardDidChangeFrameNotification
+  ] {
+    NotificationCenter.default.removeObserver(webView, name: name, object: nil)
+  }
+}
diff --git a/mobile/modules/orca-mobile-web-shell/ios/MobileWebShellView.swift b/mobile/modules/orca-mobile-web-shell/ios/MobileWebShellView.swift
index 0a2122f8183..abf9e7a70ed 100644
--- a/mobile/modules/orca-mobile-web-shell/ios/MobileWebShellView.swift
+++ b/mobile/modules/orca-mobile-web-shell/ios/MobileWebShellView.swift
@@ -221,6 +221,8 @@ final class OrcaMobileWebShellView: ExpoView, WKNavigationDelegate, WKUIDelegate
     webView.backgroundColor = .clear
     webView.scrollView.backgroundColor = .clear
     webView.scrollView.contentInsetAdjustmentBehavior = .never
+    hideKeyboardAccessoryBar(of: webView)
+    ignoreKeyboardNotifications(in: webView)
     webView.translatesAutoresizingMaskIntoConstraints = false
     addSubview(webView)
     NSLayoutConstraint.activate([
diff --git a/mobile/package.json b/mobile/package.json
index cd0d5df409e..13724e1c57a 100644
--- a/mobile/package.json
+++ b/mobile/package.json
@@ -49,7 +49,7 @@
     "expo-splash-screen": "^55.0.25",
     "expo-status-bar": "^55.0.6",
     "expo-task-manager": "~55.0.20",
-    "fflate": "0.8.2",
+    "fflate": "0.8.3",
     "lowlight": "^3.3.0",
     "lucide-react-native": "^1.14.0",
     "mermaid": "11.17.2",
@@ -60,27 +60,27 @@
     "react-native-reanimated": "4.3.4",
     "react-native-safe-area-context": "^5.7.0",
     "react-native-screens": "^4.24.0",
-    "react-native-svg": "^15.15.4",
+    "react-native-svg": "^15.15.5",
     "react-native-uitextview": "2.2.0",
     "react-native-web": "^0.21.2",
     "react-native-webview": "13.16.2",
     "react-native-worklets": "^0.8.3",
     "tweetnacl": "^1.0.3",
     "ws": "^8.21.3",
-    "zod": "~4.4.3",
-    "zustand": "^5.0.13"
+    "zod": "~4.6.5",
+    "zustand": "^5.0.15"
   },
   "devDependencies": {
     "@types/react": "^19.2.14",
     "@types/react-native": "^0.73.0",
     "@types/react-test-renderer": "19.1.0",
     "@types/ws": "^8.18.1",
-    "acorn": "8.15.0",
+    "acorn": "8.18.0",
     "esbuild": "0.25.4",
     "expo-module-scripts": "^55.0.2",
     "happy-dom": "^20.11.8",
-    "oxfmt": "^0.65.0",
-    "oxlint": "^1.80.0",
+    "oxfmt": "^0.70.0",
+    "oxlint": "^1.85.0",
     "react-test-renderer": "19.2.8",
     "tsx": "^4.22.4",
     "typescript": "6.0.3",
diff --git a/mobile/pnpm-lock.yaml b/mobile/pnpm-lock.yaml
index c9834eec892..f55a633e3f6 100644
--- a/mobile/pnpm-lock.yaml
+++ b/mobile/pnpm-lock.yaml
@@ -100,7 +100,7 @@ importers:
         version: 55.0.27(patch_hash=ce20843a3daad4185d7e8571788fa323ba4d11984936188790858650a61749c0)(expo@55.0.30)(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)(typescript@6.0.3)
       expo-router:
         specifier: ^55.0.18
-        version: 55.0.18(a23394d2f99d0f32345ec3f01a246fbf)
+        version: 55.0.18(05d3bd5bc5f5a85f046d39988db35c3c)
       expo-secure-store:
         specifier: ^55.0.18
         version: 55.0.18(expo@55.0.30)
@@ -114,14 +114,14 @@ importers:
         specifier: ~55.0.20
         version: 55.0.20(expo@55.0.30)(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))
       fflate:
-        specifier: 0.8.2
-        version: 0.8.2
+        specifier: 0.8.3
+        version: 0.8.3
       lowlight:
         specifier: ^3.3.0
         version: 3.3.0
       lucide-react-native:
         specifier: ^1.14.0
-        version: 1.14.0(react-native-svg@15.15.4(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
+        version: 1.14.0(react-native-svg@15.15.5(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
       mermaid:
         specifier: 11.17.2
         version: 11.17.2
@@ -147,8 +147,8 @@ importers:
         specifier: ^4.24.0
         version: 4.24.0(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
       react-native-svg:
-        specifier: ^15.15.4
-        version: 15.15.4(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
+        specifier: ^15.15.5
+        version: 15.15.5(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
       react-native-uitextview:
         specifier: 2.2.0
         version: 2.2.0(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
@@ -168,11 +168,11 @@ importers:
         specifier: ^8.21.3
         version: 8.21.3
       zod:
-        specifier: ~4.4.3
-        version: 4.4.3
+        specifier: ~4.6.5
+        version: 4.6.5
       zustand:
-        specifier: ^5.0.13
-        version: 5.0.13(@types/react@19.2.14)(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8))
+        specifier: ^5.0.15
+        version: 5.0.15(@types/react@19.2.14)(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8))
     devDependencies:
       '@types/react':
         specifier: ^19.2.14
@@ -187,23 +187,23 @@ importers:
         specifier: ^8.18.1
         version: 8.18.1
       acorn:
-        specifier: 8.15.0
-        version: 8.15.0
+        specifier: 8.18.0
+        version: 8.18.0
       esbuild:
         specifier: 0.25.4
         version: 0.25.4
       expo-module-scripts:
         specifier: ^55.0.2
-        version: 55.0.2(@babel/core@7.29.7)(@babel/runtime@7.29.7)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.7))(esbuild@0.25.4)(eslint@9.39.4)(expo@55.0.30)(jest@29.7.0(@types/node@26.5.1))(prettier@2.8.8)(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-refresh@0.14.2)(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8)
+        version: 55.0.2(@babel/core@7.29.7)(@babel/runtime@7.29.7)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.7))(esbuild@0.25.4)(eslint@9.39.4)(expo@55.0.30)(jest@29.7.0(@types/node@26.6.2))(prettier@2.8.8)(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-refresh@0.14.2)(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8)
       happy-dom:
         specifier: ^20.11.8
         version: 20.11.8
       oxfmt:
-        specifier: ^0.65.0
-        version: 0.65.0
+        specifier: ^0.70.0
+        version: 0.70.0
       oxlint:
-        specifier: ^1.80.0
-        version: 1.80.0
+        specifier: ^1.85.0
+        version: 1.85.0
       react-test-renderer:
         specifier: 19.2.8
         version: 19.2.8(react@19.2.8)
@@ -215,10 +215,10 @@ importers:
         version: 6.0.3
       vite:
         specifier: ^8.0.16
-        version: 8.1.0(@types/node@26.5.1)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1)
+        version: 8.1.0(@types/node@26.6.2)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1)
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@26.5.1)(happy-dom@20.11.8)(jsdom@20.0.3)(vite@8.1.0(@types/node@26.5.1)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1))
+        version: 4.1.11(@types/node@26.6.2)(happy-dom@20.11.8)(jsdom@20.0.3)(vite@8.1.0(@types/node@26.6.2)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1))
 
 packages:
 
@@ -451,6 +451,11 @@ packages:
     engines: {node: '>=6.0.0'}
     hasBin: true
 
+  '@babel/parser@7.29.9':
+    resolution: {integrity: sha512-CjXrNHTnvqBVqHgdBysY3vk2T8tpJHb5/RMeHJBTyVa9xgugCB0CJTx/3oO8RV2QRQP391RWpB7D6hLjm8V9uA==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
   '@babel/plugin-bugfix-firefox-class-in-computed-class-key@7.28.5':
     resolution: {integrity: sha512-87GDMS3tsmMSi/3bWOte1UblL+YUTFMV8SZPZ2eSEL17s74Cw/l63rR6NmGVKMYW2GYi85nE+/d6Hw5N0bEk2Q==}
     engines: {node: '>=6.9.0'}
@@ -1129,6 +1134,12 @@ packages:
     peerDependencies:
       '@babel/core': ^7.0.0-0
 
+  '@babel/plugin-transform-typescript@7.29.9':
+    resolution: {integrity: sha512-FFwIwzU+7SCOuxxV4YtJql6T9981ZVTm+FHO5GhVsRqCTdy0WwrEZh3l42ARpXruJUDGOptdduHW6Zr7pNPLNg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
   '@babel/plugin-transform-unicode-escapes@7.27.1':
     resolution: {integrity: sha512-Ysg4v6AmF26k9vpfFuTZg8HRfVWzsh1kVfowA23y9j/Gu6dOuahdUVhkLqpObp3JIv27MLSii6noRnuKN8H0Mg==}
     engines: {node: '>=6.9.0'}
@@ -1968,246 +1979,246 @@ packages:
   '@oxc-project/types@0.137.0':
     resolution: {integrity: sha512-WT+Gb24i8hmvo85AIv2oEYouEXkRlKAlT9WaCa3TfLgNCN+GhrJOGZuIlMouAh38Qe4QOx26eUOVsq70qXrywA==}
 
-  '@oxfmt/binding-android-arm-eabi@0.65.0':
-    resolution: {integrity: sha512-M10Gs1SSpTNI6ahGx3M/OlIdUF4hkaP6OgUb+MS79t/Pgflk3r1nW5gPFqsZGUAXg0H1AfANT9AvLdBSTIhZKg==}
+  '@oxfmt/binding-android-arm-eabi@0.70.0':
+    resolution: {integrity: sha512-Xd7YO4/T2axEj6FTLcj4Why3mTBqFMg+x24xtorT4Lb2+1g82090GH0a/4U1m0pABGYiix2bq1pqkYrmV3f0Sw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxfmt/binding-android-arm64@0.65.0':
-    resolution: {integrity: sha512-6DXH5sftNlaHpWJG50hFMF+Qxtq5D2TmahvcDPxWNcGIf8qrC9Y0YgHYcYZ2hlWzaccKXh/f3GcssH8vtkl4JA==}
+  '@oxfmt/binding-android-arm64@0.70.0':
+    resolution: {integrity: sha512-x9rlMYyKXdgKdYyUJzGsK1ZV8P4di/J32ipzcS6Jet6p9r9UAh28neXIMtdlSaJJycdi61Z4YkcLKLpk8ueFjg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxfmt/binding-darwin-arm64@0.65.0':
-    resolution: {integrity: sha512-K9m7lr53pcOLETNsC88sWes/GWHUGjZyHx95UhYcSXy0r30haLdeXlSufSenEAtoLaW753WN8/l4M7GYcRt6cg==}
+  '@oxfmt/binding-darwin-arm64@0.70.0':
+    resolution: {integrity: sha512-IUTUPvrBVYy7POh4stXzRdz4IVC/1QSaviCWoyenSlOhGu0X9j5K07vCTM9biLjAA2Zs31l0Rj5vvRpj9n95wA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxfmt/binding-darwin-x64@0.65.0':
-    resolution: {integrity: sha512-sTNwIx1gre3MyiHOPLu7IGW4UyMScYL4DTmJT01p4vzB0En+OJUQz6KuH8t0PpsClRSaMuY3b0QmtoPItfO8Lg==}
+  '@oxfmt/binding-darwin-x64@0.70.0':
+    resolution: {integrity: sha512-vw745q870oTd6J517O24asoX4/E+eK0nxYIFoedSLqgJ+nI5En7+ZS82iZSHZ69zevQrnOXiyHP01dA+t8xD8w==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxfmt/binding-freebsd-x64@0.65.0':
-    resolution: {integrity: sha512-lYZMVIiIpnjGu5hJb2jxA8NYQ/e0OTGuaiAf4dqlGPNnPmUTu23FZRMltmjro/KkQm1uE4NT4n5yJ2zWmKcpfA==}
+  '@oxfmt/binding-freebsd-x64@0.70.0':
+    resolution: {integrity: sha512-NO14EgSM9dFkcg+MfGPxvsKqXYs9LKaxPrOKXpv1R0rLokGGFDcCq6dBMq18dE4wlpFOovX0UZY2uh1P30O7QA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxfmt/binding-linux-arm-gnueabihf@0.65.0':
-    resolution: {integrity: sha512-gIdXFAt/bURnjxuoedDEWdZ0PEWEmdDcm8qdpoFYYvW3QMk/5D4vUaH4mlMeRpeTdST4izUgHVO6RawQ4QulJw==}
+  '@oxfmt/binding-linux-arm-gnueabihf@0.70.0':
+    resolution: {integrity: sha512-139OEhHarj9CYoJ/i9gXlPv4KLBGtLj2toseOWYFf09QwlhklaZk+wW3aOvlqoeZtuayvkoSNVWra7WJ21s3VQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxfmt/binding-linux-arm-musleabihf@0.65.0':
-    resolution: {integrity: sha512-jJVyADto7gA2AaX5qAjAexrxx9PJQaKWOe8PICE7yKMbjBRyOHcmj9TtVJ+MZYDUQ3hodU0AcoTj0jFQ1W4C6Q==}
+  '@oxfmt/binding-linux-arm-musleabihf@0.70.0':
+    resolution: {integrity: sha512-GEh2PY3IWTE0M24eNhTduountANSbWyDmMnzFSQE/nGg/bjPugbUgiGuFu+xdqcQSd/HKSwH80/F2yVVD48yhA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxfmt/binding-linux-arm64-gnu@0.65.0':
-    resolution: {integrity: sha512-p3RFkB+u7u+8up99b/NEcI1hdpLDiGgJYNwDorB60n7eH+eKposAKuMBxx+NqB3b+sJP4CZmYDh9G7X62tUsKg==}
+  '@oxfmt/binding-linux-arm64-gnu@0.70.0':
+    resolution: {integrity: sha512-En5i+UJmZSPxuSf47F2Hl5YOzKB0bicQLnGQkeTCMQ35cWLtbrSwACJKfiLqRZrk05DwSnsJkhBRaM3OURtIaA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-arm64-musl@0.65.0':
-    resolution: {integrity: sha512-5Prb0uFzJHr+OUD/qS/TmU526wD+PaHDsm3KoRiUXbMIDpTSErjeQYkK3OQeshAvD/PuLa9WGEi9WPajjdOZJg==}
+  '@oxfmt/binding-linux-arm64-musl@0.70.0':
+    resolution: {integrity: sha512-WWOoV5W9Im3flVwOVrWn/2DUlOF8v5vcCip+kcNuaMpulRCh6nzzt1Su2vcL2F908YJIXNV3HvegbBHuyLwKHg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-linux-ppc64-gnu@0.65.0':
-    resolution: {integrity: sha512-S8svxTp81obnF3admN9yd+u2rOYXtyzThLGBTg1PY6TPtGcC09BaaXLQD+TBSMa7yvqhCDZ8DFri+S/yG60qCg==}
+  '@oxfmt/binding-linux-ppc64-gnu@0.70.0':
+    resolution: {integrity: sha512-YUouneIqW+5n7aE8xx/zeZ6/utr/KH7oykcGoFyd8Uz8uh591T1oKlnoWA3BsRq/ZR42oY1w4MUYvS/0e/MQOA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-riscv64-gnu@0.65.0':
-    resolution: {integrity: sha512-WtXBr75G/h2qOHy8SiGtC1R6aS3jt4mE52v1D8AtwMXIgoOmSNP9lKvbSaTRoL0e5wsMPoi6T72QWDYPu+S+nA==}
+  '@oxfmt/binding-linux-riscv64-gnu@0.70.0':
+    resolution: {integrity: sha512-iEnMf21S5aGVa4hViDGY8sAQ/AHyCu2JPyrQF8P06wtHhSkD1YJBeT4m/KiGewgf7+a5XCYSCRIPcRQa1xwEoQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-riscv64-musl@0.65.0':
-    resolution: {integrity: sha512-YwSLVvpaz4o/nv/miiPEBJz+eJ+VmbgNIrao6RccK9ce+L5EA8wP+ZD0uFeq6wKOza6zoWv/dR0sj6lip6R3EA==}
+  '@oxfmt/binding-linux-riscv64-musl@0.70.0':
+    resolution: {integrity: sha512-91Sdniaj20fQzyMeCxMDzTP4c9s4RB8dGQ308xHhDR0n6U7+1Xq7N9klE7mfXq8iV3lRmIGSXi5X23Hn/0XX/g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-linux-s390x-gnu@0.65.0':
-    resolution: {integrity: sha512-XQTPqgvyrgkKcFq+Tp2eK6JS7sqqJ+nRmy2Fav4j3I+i4dJoPJm7YwEdoeSDX9xkqj9jZ/lWfF3bXUWztIrn6A==}
+  '@oxfmt/binding-linux-s390x-gnu@0.70.0':
+    resolution: {integrity: sha512-uUV30M6E+2TKKGMaKiwfeL4RZrviHXlUxsrYJ/jFBb+1EZy+pnFT+hF73eeWdzh5NqPOAnw0iiMAIqjqiLZPFg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-x64-gnu@0.65.0':
-    resolution: {integrity: sha512-cjZlx6S/VkeCNWCbwZriTnLnZeTcV3DEyeRGSw/2wwLP9viq+C0bJ4bC1k/ZLkFxDcB1lUgSasPkYGP1bdraOg==}
+  '@oxfmt/binding-linux-x64-gnu@0.70.0':
+    resolution: {integrity: sha512-ivMcX6kNDPhqtbOaBt/ItFlLlTlXNHLgRuNmxP6Na6UuYXRT10llpJcAPbGeRgjjb3Qzv4jwPp3fB0hui50WNQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-x64-musl@0.65.0':
-    resolution: {integrity: sha512-2azCjxdLtK4zCcIOU1dlXlU0xxfbPi6EjwWx7Ac7teWPidIIDOcIhudup83xNCKYhtqeVd/gaVDOxbUq4syXWA==}
+  '@oxfmt/binding-linux-x64-musl@0.70.0':
+    resolution: {integrity: sha512-w+S+fERxYmlZSyZlJK/U292FjyBoH8cCEj21/tYJX6atX5kNSn+HDkhlFQKT2zcMwUW0uAtUL/bOrlwJZwqRdA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-openharmony-arm64@0.65.0':
-    resolution: {integrity: sha512-KXQ7xi1e/voP0IQaw6fG6XY4Z5+Llf1XmRSZS1t7pVFCecFJ0iXaboKmVwjFtp5MLlT5iWQrJ2U1C3GJdZ2u+Q==}
+  '@oxfmt/binding-openharmony-arm64@0.70.0':
+    resolution: {integrity: sha512-Zlom1Xkx257R8bk4ZI4zJsrGno2opknz1+5v5baka3nn4FPyvNSdh8JUL4CdN1S1OWRMvJ9UJQ+RfIqGGCUEfA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxfmt/binding-win32-arm64-msvc@0.65.0':
-    resolution: {integrity: sha512-2FbbjG5jEqLSLKVJwBap84uJfpn5Y5A53KEO0aUNr+zeiRB9nyPUIFMcSbZVMFLitfBytFWRNngozXYjb6Rsbw==}
+  '@oxfmt/binding-win32-arm64-msvc@0.70.0':
+    resolution: {integrity: sha512-FQgPW5R17vzt7cgrJ8eG/dqX00o2xHsqFeLfw4xzA9FRHpN/DjFo9YDonvIIXGxiEuS9F/jZPnGO+KHNKuCo4Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxfmt/binding-win32-ia32-msvc@0.65.0':
-    resolution: {integrity: sha512-LJ+ZacAPSjegDOnSLyA1TMWAhdDrsK4el3REdr1oL2UtVBCMhO2II/Sb3cEW6mF2MfLhl8hDNCSvc7KSbgk3LQ==}
+  '@oxfmt/binding-win32-ia32-msvc@0.70.0':
+    resolution: {integrity: sha512-ZfZublNhZ+XBndMiXhkiLlPE+XyGRDa0CweeTL6t1fZypfCh1LTg7e5CvnOeTBunq15MskOcRempumSPGAaCQA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxfmt/binding-win32-x64-msvc@0.65.0':
-    resolution: {integrity: sha512-higu9cWEO6XXFzATD1jf0mCK34rNfN2H9JrJie7QB1IhleVpTh0QlLH9Ip2C1H/Nd5n0v5pvRtC+5R0uE4HpVg==}
+  '@oxfmt/binding-win32-x64-msvc@0.70.0':
+    resolution: {integrity: sha512-HlIZEn+WzLQL0DszNzldiRl/DPRCX5R0Vkt6qeUPR1YHwy52hZZo4x6HoTOVmKRP2wUiwPGtKsihNY/f8KRaBg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
 
-  '@oxlint/binding-android-arm-eabi@1.80.0':
-    resolution: {integrity: sha512-RM3Plj+biQpxa5d1GOOX6ciDlcUROmm4OZ/pLTpitkQt2mJv4jhtY4cbgaetOm5UKWZe05/TGQ6o1Vl8EOHkrA==}
+  '@oxlint/binding-android-arm-eabi@1.85.0':
+    resolution: {integrity: sha512-q2KO/Zso9UT+OMn0NF9ywn4E4t0MI3yxiDhNyhsQ7DyQJrC4FhFE4TXOi4bktFnOWXTMds8qZSbpv2XwRaNOBg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxlint/binding-android-arm64@1.80.0':
-    resolution: {integrity: sha512-YlO5JEf0Yr2bUUlu8O8daVcUxtcGGbcSmyV7E7nSbJbfAdxTE0PFPwgnIlw7wXJaTYjb+qs5hI5q3jxUkI7cAw==}
+  '@oxlint/binding-android-arm64@1.85.0':
+    resolution: {integrity: sha512-SxLN3ALjoT9NNdvpjEevGeHvfzTAFrF0NBYB5tzK7/GtCKMze3j1e/m/X2ozqGj2U9hfGG/dg/OG8vpVK4PiDA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxlint/binding-darwin-arm64@1.80.0':
-    resolution: {integrity: sha512-BULDOyO3AhsmdWfQeIUCykDt3dd7XZBGLhp1eIh56skRv01O+cNjNPwXMIbeW1x4+pxcln5if72wcRgViVo7PA==}
+  '@oxlint/binding-darwin-arm64@1.85.0':
+    resolution: {integrity: sha512-Y/Sup/J4f0f9UGsSd/xyCNTeWL+gepO63GBdEDAfue9nBsnk9zMmnIXx1O6b1V8C90vB5nucYNZ0pbMXAp8zJA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxlint/binding-darwin-x64@1.80.0':
-    resolution: {integrity: sha512-YJ4JzLw7N5TDSQFlA0hAQGHvnDZgyypm1yunObVWcWiF9KM7eGCJKYKLgTC2Fi/57OdnBhbj4OkzPGdFQJ6HyA==}
+  '@oxlint/binding-darwin-x64@1.85.0':
+    resolution: {integrity: sha512-ApOSNC04ynpDTwvBD+//0wyfODRSbEzvRoKpX8teffmc27z8AockwSNeMXGJXn5KP85eahDgR/2llICWLkzcnw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxlint/binding-freebsd-x64@1.80.0':
-    resolution: {integrity: sha512-AYUIk5QnL0s8oWAYsREZwkRYy1SupJTXALo93J1TgzHywxQtdM99FecRMQ87MXEdPQ0j1TmEpeeq3fGNkpvMqg==}
+  '@oxlint/binding-freebsd-x64@1.85.0':
+    resolution: {integrity: sha512-bNrVrCOA/kHky3Tu79IXWXe5bhIgLXfUuUEDHlAGOHUk96MkvDZ1ecaQF19rwstrnaqfP1o9nBTqzIr9+ZHkUg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.80.0':
-    resolution: {integrity: sha512-9hBZVANupQ89W9dXyE0n8doCyaW5pDyGn3y6XlIMPZ+rIKuyqkr3SNUXmVJIhuvUq0NBU3RBiSXXE69l4XI6KA==}
+  '@oxlint/binding-linux-arm-gnueabihf@1.85.0':
+    resolution: {integrity: sha512-NUrzOJ1s/EqsVvfn2L/1D8Wro2LPIZUbihL8kOJLh5fEdGEN3rdOGUYq3HwnUIL8sjpoP+4N6RaGrgmMJnaMPw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm-musleabihf@1.80.0':
-    resolution: {integrity: sha512-SvS2uKqzY+pbfuvAHzH4338R6Zwo805GAwrIMVvK1KxoOWCIjZUdfzTCvilD7z6JK91v011+zYMryabhDo2AsQ==}
+  '@oxlint/binding-linux-arm-musleabihf@1.85.0':
+    resolution: {integrity: sha512-UJXrAT3E/RWkEqXLIs2ehETja1qfgkPb+5gwLIIS+o/6cf+grHvoOXTa5997a/YNQfcJS0DRBTOfZt95cvOI1g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm64-gnu@1.80.0':
-    resolution: {integrity: sha512-tCLadyqRVL3pQTRPNg7cjXKvcvS4fbyXeQHhKk5BTJ1oftQln5/yIIWbu/Xom/DX41zv2P9QGt6+D/TtQVtY3A==}
+  '@oxlint/binding-linux-arm64-gnu@1.85.0':
+    resolution: {integrity: sha512-lK40QLjI0HxigO7CjDDshEtfYIeiYS0020v5BHFPqN4uuQBQxd2K9LNom2dW15o9F1937quSCRVp4ZsVhdbYdg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-arm64-musl@1.80.0':
-    resolution: {integrity: sha512-XfpCNRlOPcLlJl4Bn/FUhjqlR6BVavEykERBf/MV7YA9VZDa5g5znVqYhyviMafcxS9Pe/i/kPvHNO0U6svEHQ==}
+  '@oxlint/binding-linux-arm64-musl@1.85.0':
+    resolution: {integrity: sha512-c2zbdBwGKreHXwRx3gWBuFGJxLhxgsg6YlZ+3H+RgRusU/UEV9jNwJ3HGYK+nRo0LvBa7mt6Kj86xoVotUo8cw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-ppc64-gnu@1.80.0':
-    resolution: {integrity: sha512-3I4yMwcFG9NeO8ioY6JBBuKsIm5GL/x7MATt1S4tVWaxPu5HcJ+XnLUbcVBTxG8q2Wu56HSj+NmXQiVYb1lp6A==}
+  '@oxlint/binding-linux-ppc64-gnu@1.85.0':
+    resolution: {integrity: sha512-tlt/Hy8lZ97/lCPmCgw/B3k/mwh+BzaIPbPkldZEly7TwLmx0xe2CQcaW2g/rR0dOgS9JNGCZsMEqLhUNMGvaw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-gnu@1.80.0':
-    resolution: {integrity: sha512-E1wAKymkpe1/E8helzBKdm81OBOF+ezxRyXRMEuik3ZpWDER5CPOKZwF66RsdwW98uwZv8UTFremUQtC1CzdJA==}
+  '@oxlint/binding-linux-riscv64-gnu@1.85.0':
+    resolution: {integrity: sha512-3tNR9Xey82X0zKuY1d8hJ6Rc9gwRDurmqGLnQZa5xqOXy8/YyiqFXjAtugkKLY82obOlpK1eSiDRlgcNPuxtIg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-musl@1.80.0':
-    resolution: {integrity: sha512-+gLRGD4sIo3+VA++iham5UxD9tKSoJ/VOrROCEXIcknrYtQg6iIQgvjN0cpiRF7N6UYC7pJbvHJlDnMge5LRpQ==}
+  '@oxlint/binding-linux-riscv64-musl@1.85.0':
+    resolution: {integrity: sha512-wbGRd5PqCcjkJFHhZuZ2OBSUQY9czlQsoA/cQQB9JK/L9mC5MQgGoKAh+xd8QjA5V+0D3j+Qd1lAWn1I8zlelA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-s390x-gnu@1.80.0':
-    resolution: {integrity: sha512-aR0PrzHj9leW3NmzBAAP4EzdoBNoJcs9sjnIQPIwyRnBGYrRbXUIpEB5Q39AqK3PLY5JK5uEhDQDiUa1QSAstw==}
+  '@oxlint/binding-linux-s390x-gnu@1.85.0':
+    resolution: {integrity: sha512-3Sn0kSrE4DPZCWV/8o+n4x3aFZxI9ulMnkYlwCbJ8eUVkwRK2IerohE/A/z3SNbCwoPFOCJmGE5Avrq0rrvdvQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-gnu@1.80.0':
-    resolution: {integrity: sha512-vSVh5cSo3Xxs6ghBCcFJlpbkbENzDog1qXtoXLa/HC3aCrR4XO76GZbXmQoCPHnu99nQpdCeC3H9tdNICfDh7A==}
+  '@oxlint/binding-linux-x64-gnu@1.85.0':
+    resolution: {integrity: sha512-JY2pxxYfB62bAGfejljVCqc44etItehPuAyaeSAdMuEMtwNA00ggMnS66lC1oIhos6oOXUkuU6mZ9bpFh3BqWg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-musl@1.80.0':
-    resolution: {integrity: sha512-FfzBXpNQ8u7/ZI/p8bl73MeZ508Ax3hxWp3SiJpEFiC+BB9XcXy5FAZHTLKDPSzrUpxQZSZJAVdDmuJp/+HDBQ==}
+  '@oxlint/binding-linux-x64-musl@1.85.0':
+    resolution: {integrity: sha512-5k74vZ6qJBjBHEOlBk9B/iv68Yu0F1Afw/vvT2ar6OGCqEeXLaSjXz2n/IPCbhLG22UoKoYEJTzpYraRdcp6PA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-openharmony-arm64@1.80.0':
-    resolution: {integrity: sha512-zMzbkumtmprCgRwoYNzcB3iC39fXdJIMLMU33KdCjEGLlJGOEt1+LwQ4LF8ndLzAEKVz4BR0y3V6Xrkk3Nm3yA==}
+  '@oxlint/binding-openharmony-arm64@1.85.0':
+    resolution: {integrity: sha512-GbAl5qt5TCkPLXTaIISZJnugrcBhra6rodcXc9jYt620UtdsTt71NlNmJmm0frxzFpd54x/G+MkitEJA8I/BoA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxlint/binding-win32-arm64-msvc@1.80.0':
-    resolution: {integrity: sha512-ib6iRcrXsk4t1fm3iKcwksyWh1ZkZXC/2mEzakl0ai2+6HZunf1WWMZ/xP9EJAvw9g9K4UVTC3NF/+G2qLrbTQ==}
+  '@oxlint/binding-win32-arm64-msvc@1.85.0':
+    resolution: {integrity: sha512-kjmws5MK0et2swk4ND85D7NVQyDHw162i6whtZDLUA/lo6FQyBZDcmMRCMcVZcNrAhIaftVb00x9ChGDOjjNJA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxlint/binding-win32-ia32-msvc@1.80.0':
-    resolution: {integrity: sha512-xhRWBMpLxZvgKAH6+DJZmpP+W8Y8UdQOSU1JfxSWNXsaBaRGW77j+1hCuNHlzj7OH4SPN8fYd1q0o2qrDtoVyw==}
+  '@oxlint/binding-win32-ia32-msvc@1.85.0':
+    resolution: {integrity: sha512-eSsIJx9n4yxvOqYTZyPEMyEXRmE60XH7xGAU7i0Qbsn1lf6Za3CWJ9aRd82oSFKXaxhp+sA6/yMJVRIpLpna6A==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxlint/binding-win32-x64-msvc@1.80.0':
-    resolution: {integrity: sha512-yAnO7lwBYQnz2pcfBPIGQQZWIX5zd5R/1aAKIF3oE+TVj7IhoHcROjOkz3sRDngzqhfPKfFaXqug5j5rE5dn6Q==}
+  '@oxlint/binding-win32-x64-msvc@1.85.0':
+    resolution: {integrity: sha512-pBebIPUpKKhWrhSMWhy8TdAZBewiXnfxmaAGxhzxM1068GagqFaTwgKlU6e+UyJ2sPR+VoHouhXuGJkQjsrDvA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
@@ -2899,14 +2910,8 @@ packages:
   '@types/node@25.6.0':
     resolution: {integrity: sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ==}
 
-  '@types/node@26.1.1':
-    resolution: {integrity: sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw==}
-
-  '@types/node@26.1.2':
-    resolution: {integrity: sha512-Vu4a5UFA9rIIFJ7rB/Vaafh9lrCQszopTCx6KjFboXTGQbPNasehVR5TEiithSDGyd1DEiUByggTZsg8jukeIg==}
-
-  '@types/node@26.5.1':
-    resolution: {integrity: sha512-CzNm2FezW4VR/LjG6yUdiEgLE/rAQ9Slj5gCu/C2VrdcW7I0ahNZ8DRbHT7zOZ6r3ONgd/bsQIeSaoDGrd1C6g==}
+  '@types/node@26.6.2':
+    resolution: {integrity: sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==}
 
   '@types/react-native@0.73.0':
     resolution: {integrity: sha512-6ZRPQrYM72qYKGWidEttRe6M5DZBEV5F+MHMHqd4TTYx0tfkcdrUFGdef6CCxY0jXU7wldvd/zA/b0A/kTeJmA==}
@@ -3132,8 +3137,8 @@ packages:
     resolution: {integrity: sha512-HEHNfbars9v4pgpW6SO1KSPkfoS0xVOM/9UzkJltjlsHZmJasxg8aXkuZa7SMf8vKGIBhpUsPluQSqhJFCqebw==}
     engines: {node: '>=0.4.0'}
 
-  acorn@8.15.0:
-    resolution: {integrity: sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==}
+  acorn@8.18.0:
+    resolution: {integrity: sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==}
     engines: {node: '>=0.4.0'}
     hasBin: true
 
@@ -4564,8 +4569,8 @@ packages:
   fetch-nodeshim@0.4.10:
     resolution: {integrity: sha512-m6I8ALe4L4XpdETy7MJZWs6L1IVMbjs99bwbpIKphxX+0CTns4IKDWJY0LWfr4YsFjfg+z1TjzTMU8lKl8rG0w==}
 
-  fflate@0.8.2:
-    resolution: {integrity: sha512-cPJU47OaAoCbg0pBvzsgpTPhmhqI5eJjh/JIu8tPj5q+T7iLvW/JAYUqmE7KOB4R1ZyEhzBaIQpQpardBF5z8A==}
+  fflate@0.8.3:
+    resolution: {integrity: sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==}
 
   file-entry-cache@8.0.0:
     resolution: {integrity: sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==}
@@ -5831,8 +5836,8 @@ packages:
     resolution: {integrity: sha512-qFOyK5PjiWZd+QQIh+1jhdb9LpxTF0qs7Pm8o5QHYZ0M3vKqSqzsZaEB6oWlxZ+q2sJBMI/Ktgd2N5ZwQoRHfg==}
     engines: {node: '>= 0.4'}
 
-  oxfmt@0.65.0:
-    resolution: {integrity: sha512-SgS5VgnP42T0zl3zWD+xoH8FCqg1SAFnSRoOT/qeoa6gxcYIqrDMOmcXIg/EWSN92Du4ogB4riuKhKd6Y4CGhw==}
+  oxfmt@0.70.0:
+    resolution: {integrity: sha512-IsHxZ4y0wQLLMhnrJblBJgZsLDzfULrJnAw5j/QqsTlMa/m3AqsbToi+W71uhBGaqlqq/PbbjvHc09TJwdv3Tw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -5844,8 +5849,8 @@ packages:
       vite-plus:
         optional: true
 
-  oxlint@1.80.0:
-    resolution: {integrity: sha512-5nTiSps4qdbCWLbxzuO00alHkEO2exR9YMN/ig6QXWrLsYSG0KaObOAM+l6oU2LcKPWoSAGYbkZIGEu1ViiWKA==}
+  oxlint@1.85.0:
+    resolution: {integrity: sha512-bc26s97nuvPj1ViyPsqmKecVkUWFMEdtayO8MaQ6oiLfs1pj94cQlZZhrh4BPNlr9HQosjhIlwgZKsfcwmcNgg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -6095,8 +6100,8 @@ packages:
       react: '*'
       react-native: '*'
 
-  react-native-svg@15.15.4:
-    resolution: {integrity: sha512-boT/vIRgj6zZKBpfTPJJiYWMbZE9duBMOwPK6kCSTgxsS947IFMOq9OgIFkpWZTB7t229H24pDRkh3W9ZK/J1A==}
+  react-native-svg@15.15.5:
+    resolution: {integrity: sha512-L4go5jA+GWutdJ/JucuN20cjAbMg1HmMtAP+wZ+3JLCf6Jd0bhXQHxciRP/AQm/FlrIEZwkMcHNZP+FXAiic0w==}
     peerDependencies:
       react: '*'
       react-native: '*'
@@ -6653,8 +6658,8 @@ packages:
     resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
     engines: {node: '>=12.0.0'}
 
-  tinypool@2.1.0:
-    resolution: {integrity: sha512-Pugqs6M0m7Lv1I7FtxN4aoyToKg1C4tu+/381vH35y8oENM/Ai7f7C4StcoK4/+BSw9ebcS8jRiVrORFKCALLw==}
+  tinypool@2.1.2:
+    resolution: {integrity: sha512-9YodfrxS9g9IbFr/KOjE5bAeJ0p61n3bW6mqvy0jtoeKd1kTW1Cxm0oulm6KX2lyM9Gl6WIe8nEbY7LWv5ZJww==}
     engines: {node: ^20.0.0 || >=22.0.0}
 
   tinyrainbow@3.1.0:
@@ -6793,9 +6798,6 @@ packages:
   undici-types@7.19.2:
     resolution: {integrity: sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg==}
 
-  undici-types@8.3.0:
-    resolution: {integrity: sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==}
-
   undici-types@8.9.0:
     resolution: {integrity: sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==}
 
@@ -7147,11 +7149,11 @@ packages:
   zod@3.25.76:
     resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==}
 
-  zod@4.4.3:
-    resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==}
+  zod@4.6.5:
+    resolution: {integrity: sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==}
 
-  zustand@5.0.13:
-    resolution: {integrity: sha512-efI2tVaVQPqtOh114loML/Z80Y4NP3yc+Ff0fYiZJPauNeWZeIp/bRFD7I9bfmCOYBh/PHxlglQ9+wvlwnPikQ==}
+  zustand@5.0.15:
+    resolution: {integrity: sha512-MpSEjRiBkA9crSYeOUH32rJC7SVqAbm0Fqcqge/bUi2PPoLcBWKOsG+C8mevmpr8TwXHBVkChbbJiyvkE+i/3A==}
     engines: {node: '>=12.20.0'}
     peerDependencies:
       '@types/react': '>=18.0.0'
@@ -7497,6 +7499,10 @@ snapshots:
     dependencies:
       '@babel/types': 7.29.8
 
+  '@babel/parser@7.29.9':
+    dependencies:
+      '@babel/types': 7.29.8
+
   '@babel/plugin-bugfix-firefox-class-in-computed-class-key@7.28.5(@babel/core@7.29.7)':
     dependencies:
       '@babel/core': 7.29.7
@@ -8245,6 +8251,17 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@babel/plugin-transform-typescript@7.29.9(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-annotate-as-pure': 7.29.7
+      '@babel/helper-create-class-features-plugin': 7.29.7(@babel/core@7.29.7)
+      '@babel/helper-plugin-utils': 7.29.7
+      '@babel/helper-skip-transparent-expression-wrappers': 7.29.7
+      '@babel/plugin-syntax-typescript': 7.29.7(@babel/core@7.29.7)
+    transitivePeerDependencies:
+      - supports-color
+
   '@babel/plugin-transform-unicode-escapes@7.27.1(@babel/core@7.29.7)':
     dependencies:
       '@babel/core': 7.29.7
@@ -8742,7 +8759,7 @@ snapshots:
       ws: 8.21.3
       zod: 3.25.76
     optionalDependencies:
-      expo-router: 55.0.18(a23394d2f99d0f32345ec3f01a246fbf)
+      expo-router: 55.0.18(05d3bd5bc5f5a85f046d39988db35c3c)
       react-native: 0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8)
     transitivePeerDependencies:
       - '@expo/dom-webview'
@@ -9076,7 +9093,7 @@ snapshots:
       react: 19.2.8
     optionalDependencies:
       '@expo/metro-runtime': 55.0.12(@expo/dom-webview@55.0.6)(expo@55.0.30)(react-dom@19.2.8(react@19.2.8))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
-      expo-router: 55.0.18(a23394d2f99d0f32345ec3f01a246fbf)
+      expo-router: 55.0.18(05d3bd5bc5f5a85f046d39988db35c3c)
       react-dom: 19.2.8(react@19.2.8)
     transitivePeerDependencies:
       - supports-color
@@ -9148,7 +9165,7 @@ snapshots:
   '@jest/console@29.7.0':
     dependencies:
       '@jest/types': 29.6.3
-      '@types/node': 26.1.1
+      '@types/node': 26.6.2
       chalk: 4.1.2
       jest-message-util: 29.7.0
       jest-util: 29.7.0
@@ -9161,14 +9178,14 @@ snapshots:
       '@jest/test-result': 29.7.0
       '@jest/transform': 29.7.0
       '@jest/types': 29.6.3
-      '@types/node': 26.5.1
+      '@types/node': 26.6.2
       ansi-escapes: 4.3.2
       chalk: 4.1.2
       ci-info: 3.9.0
       exit: 0.1.2
       graceful-fs: 4.2.11
       jest-changed-files: 29.7.0
-      jest-config: 29.7.0(@types/node@26.5.1)
+      jest-config: 29.7.0(@types/node@26.6.2)
       jest-haste-map: 29.7.0
       jest-message-util: 29.7.0
       jest-regex-util: 29.6.3
@@ -9199,7 +9216,7 @@ snapshots:
     dependencies:
       '@jest/fake-timers': 29.7.0
       '@jest/types': 29.6.3
-      '@types/node': 25.6.0
+      '@types/node': 26.6.2
       jest-mock: 29.7.0
 
   '@jest/expect-utils@29.7.0':
@@ -9217,7 +9234,7 @@ snapshots:
     dependencies:
       '@jest/types': 29.6.3
       '@sinonjs/fake-timers': 10.3.0
-      '@types/node': 25.6.0
+      '@types/node': 26.6.2
       jest-message-util: 29.7.0
       jest-mock: 29.7.0
       jest-util: 29.7.0
@@ -9241,7 +9258,7 @@ snapshots:
       '@jest/transform': 29.7.0
       '@jest/types': 29.6.3
       '@jridgewell/trace-mapping': 0.3.31
-      '@types/node': 26.5.1
+      '@types/node': 26.6.2
       chalk: 4.1.2
       collect-v8-coverage: 1.0.3
       exit: 0.1.2
@@ -9315,7 +9332,7 @@ snapshots:
       '@jest/schemas': 29.6.3
       '@types/istanbul-lib-coverage': 2.0.6
       '@types/istanbul-reports': 3.0.4
-      '@types/node': 26.1.1
+      '@types/node': 26.6.2
       '@types/yargs': 17.0.35
       chalk: 4.1.2
 
@@ -9367,118 +9384,118 @@ snapshots:
 
   '@oxc-project/types@0.137.0': {}
 
-  '@oxfmt/binding-android-arm-eabi@0.65.0':
+  '@oxfmt/binding-android-arm-eabi@0.70.0':
     optional: true
 
-  '@oxfmt/binding-android-arm64@0.65.0':
+  '@oxfmt/binding-android-arm64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-darwin-arm64@0.65.0':
+  '@oxfmt/binding-darwin-arm64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-darwin-x64@0.65.0':
+  '@oxfmt/binding-darwin-x64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-freebsd-x64@0.65.0':
+  '@oxfmt/binding-freebsd-x64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm-gnueabihf@0.65.0':
+  '@oxfmt/binding-linux-arm-gnueabihf@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm-musleabihf@0.65.0':
+  '@oxfmt/binding-linux-arm-musleabihf@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm64-gnu@0.65.0':
+  '@oxfmt/binding-linux-arm64-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm64-musl@0.65.0':
+  '@oxfmt/binding-linux-arm64-musl@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-ppc64-gnu@0.65.0':
+  '@oxfmt/binding-linux-ppc64-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-riscv64-gnu@0.65.0':
+  '@oxfmt/binding-linux-riscv64-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-riscv64-musl@0.65.0':
+  '@oxfmt/binding-linux-riscv64-musl@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-s390x-gnu@0.65.0':
+  '@oxfmt/binding-linux-s390x-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-x64-gnu@0.65.0':
+  '@oxfmt/binding-linux-x64-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-x64-musl@0.65.0':
+  '@oxfmt/binding-linux-x64-musl@0.70.0':
     optional: true
 
-  '@oxfmt/binding-openharmony-arm64@0.65.0':
+  '@oxfmt/binding-openharmony-arm64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-win32-arm64-msvc@0.65.0':
+  '@oxfmt/binding-win32-arm64-msvc@0.70.0':
     optional: true
 
-  '@oxfmt/binding-win32-ia32-msvc@0.65.0':
+  '@oxfmt/binding-win32-ia32-msvc@0.70.0':
     optional: true
 
-  '@oxfmt/binding-win32-x64-msvc@0.65.0':
+  '@oxfmt/binding-win32-x64-msvc@0.70.0':
     optional: true
 
-  '@oxlint/binding-android-arm-eabi@1.80.0':
+  '@oxlint/binding-android-arm-eabi@1.85.0':
     optional: true
 
-  '@oxlint/binding-android-arm64@1.80.0':
+  '@oxlint/binding-android-arm64@1.85.0':
     optional: true
 
-  '@oxlint/binding-darwin-arm64@1.80.0':
+  '@oxlint/binding-darwin-arm64@1.85.0':
     optional: true
 
-  '@oxlint/binding-darwin-x64@1.80.0':
+  '@oxlint/binding-darwin-x64@1.85.0':
     optional: true
 
-  '@oxlint/binding-freebsd-x64@1.80.0':
+  '@oxlint/binding-freebsd-x64@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.80.0':
+  '@oxlint/binding-linux-arm-gnueabihf@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-musleabihf@1.80.0':
+  '@oxlint/binding-linux-arm-musleabihf@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-gnu@1.80.0':
+  '@oxlint/binding-linux-arm64-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-musl@1.80.0':
+  '@oxlint/binding-linux-arm64-musl@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-ppc64-gnu@1.80.0':
+  '@oxlint/binding-linux-ppc64-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-gnu@1.80.0':
+  '@oxlint/binding-linux-riscv64-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-musl@1.80.0':
+  '@oxlint/binding-linux-riscv64-musl@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-s390x-gnu@1.80.0':
+  '@oxlint/binding-linux-s390x-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-gnu@1.80.0':
+  '@oxlint/binding-linux-x64-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-musl@1.80.0':
+  '@oxlint/binding-linux-x64-musl@1.85.0':
     optional: true
 
-  '@oxlint/binding-openharmony-arm64@1.80.0':
+  '@oxlint/binding-openharmony-arm64@1.85.0':
     optional: true
 
-  '@oxlint/binding-win32-arm64-msvc@1.80.0':
+  '@oxlint/binding-win32-arm64-msvc@1.85.0':
     optional: true
 
-  '@oxlint/binding-win32-ia32-msvc@1.80.0':
+  '@oxlint/binding-win32-ia32-msvc@1.85.0':
     optional: true
 
-  '@oxlint/binding-win32-x64-msvc@1.80.0':
+  '@oxlint/binding-win32-x64-msvc@1.85.0':
     optional: true
 
   '@pkgr/core@0.2.9': {}
@@ -9835,7 +9852,7 @@ snapshots:
       '@babel/plugin-transform-react-jsx-source': 7.29.7(@babel/core@7.29.7)
       '@babel/plugin-transform-regenerator': 7.29.8(@babel/core@7.29.7)
       '@babel/plugin-transform-runtime': 7.29.7(@babel/core@7.29.7)
-      '@babel/plugin-transform-typescript': 7.29.7(@babel/core@7.29.7)
+      '@babel/plugin-transform-typescript': 7.29.9(@babel/core@7.29.7)
       '@babel/plugin-transform-unicode-regex': 7.29.7(@babel/core@7.29.7)
       '@react-native/babel-plugin-codegen': 0.85.2(@babel/core@7.29.7)
       babel-plugin-syntax-hermes-parser: 0.33.3
@@ -9867,7 +9884,7 @@ snapshots:
   '@react-native/codegen@0.85.2(@babel/core@7.29.7)':
     dependencies:
       '@babel/core': 7.29.7
-      '@babel/parser': 7.29.8
+      '@babel/parser': 7.29.9
       hermes-parser: 0.33.3
       invariant: 2.2.4
       nullthrows: 1.1.1
@@ -10086,7 +10103,7 @@ snapshots:
 
   '@standard-schema/spec@1.1.0': {}
 
-  '@testing-library/react-native@13.3.3(jest@29.7.0(@types/node@26.5.1))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8)':
+  '@testing-library/react-native@13.3.3(jest@29.7.0(@types/node@26.6.2))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       jest-matcher-utils: 30.3.0
       picocolors: 1.1.1
@@ -10096,7 +10113,7 @@ snapshots:
       react-test-renderer: 19.2.8(react@19.2.8)
       redent: 3.0.0
     optionalDependencies:
-      jest: 29.7.0(@types/node@26.5.1)
+      jest: 29.7.0(@types/node@26.6.2)
 
   '@tootallnate/once@2.0.1': {}
 
@@ -10260,7 +10277,7 @@ snapshots:
 
   '@types/graceful-fs@4.1.9':
     dependencies:
-      '@types/node': 26.1.1
+      '@types/node': 26.6.2
 
   '@types/hammerjs@2.0.46': {}
 
@@ -10285,7 +10302,7 @@ snapshots:
 
   '@types/jsdom@20.0.1':
     dependencies:
-      '@types/node': 25.6.0
+      '@types/node': 26.6.2
       '@types/tough-cookie': 4.0.5
       parse5: 7.3.0
 
@@ -10297,15 +10314,7 @@ snapshots:
     dependencies:
       undici-types: 7.19.2
 
-  '@types/node@26.1.1':
-    dependencies:
-      undici-types: 8.3.0
-
-  '@types/node@26.1.2':
-    dependencies:
-      undici-types: 8.3.0
-
-  '@types/node@26.5.1':
+  '@types/node@26.6.2':
     dependencies:
       undici-types: 8.9.0
 
@@ -10489,13 +10498,13 @@ snapshots:
       chai: 6.2.2
       tinyrainbow: 3.1.0
 
-  '@vitest/mocker@4.1.11(vite@8.1.0(@types/node@26.5.1)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1))':
+  '@vitest/mocker@4.1.11(vite@8.1.0(@types/node@26.6.2)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1))':
     dependencies:
       '@vitest/spy': 4.1.11
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
-      vite: 8.1.0(@types/node@26.5.1)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1)
+      vite: 8.1.0(@types/node@26.6.2)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1)
 
   '@vitest/pretty-format@4.1.11':
     dependencies:
@@ -10553,18 +10562,18 @@ snapshots:
 
   acorn-globals@7.0.1:
     dependencies:
-      acorn: 8.15.0
+      acorn: 8.18.0
       acorn-walk: 8.3.5
 
-  acorn-jsx@5.3.2(acorn@8.15.0):
+  acorn-jsx@5.3.2(acorn@8.18.0):
     dependencies:
-      acorn: 8.15.0
+      acorn: 8.18.0
 
   acorn-walk@8.3.5:
     dependencies:
-      acorn: 8.15.0
+      acorn: 8.18.0
 
-  acorn@8.15.0: {}
+  acorn@8.18.0: {}
 
   agent-base@6.0.2:
     dependencies:
@@ -10956,7 +10965,7 @@ snapshots:
 
   buffer-image-size@0.6.4:
     dependencies:
-      '@types/node': 26.1.2
+      '@types/node': 26.6.2
 
   buffer@6.0.3:
     dependencies:
@@ -11027,7 +11036,7 @@ snapshots:
 
   chrome-launcher@0.15.2:
     dependencies:
-      '@types/node': 26.1.2
+      '@types/node': 26.6.2
       escape-string-regexp: 4.0.0
       is-wsl: 2.2.0
       lighthouse-logger: 1.4.2
@@ -11036,7 +11045,7 @@ snapshots:
 
   chromium-edge-launcher@0.2.0:
     dependencies:
-      '@types/node': 26.1.2
+      '@types/node': 26.6.2
       escape-string-regexp: 4.0.0
       is-wsl: 2.2.0
       lighthouse-logger: 1.4.2
@@ -11148,13 +11157,13 @@ snapshots:
     dependencies:
       layout-base: 2.0.1
 
-  create-jest@29.7.0(@types/node@26.5.1):
+  create-jest@29.7.0(@types/node@26.6.2):
     dependencies:
       '@jest/types': 29.6.3
       chalk: 4.1.2
       exit: 0.1.2
       graceful-fs: 4.2.11
-      jest-config: 29.7.0(@types/node@26.5.1)
+      jest-config: 29.7.0(@types/node@26.6.2)
       jest-util: 29.7.0
       prompts: 2.4.2
     transitivePeerDependencies:
@@ -11936,8 +11945,8 @@ snapshots:
 
   espree@10.4.0:
     dependencies:
-      acorn: 8.15.0
-      acorn-jsx: 5.3.2(acorn@8.15.0)
+      acorn: 8.18.0
+      acorn-jsx: 5.3.2(acorn@8.18.0)
       eslint-visitor-keys: 4.2.1
 
   esprima@4.0.1: {}
@@ -12133,7 +12142,7 @@ snapshots:
       expo: 55.0.30(e404b20c1cb2e50a7d80f2cede5c5264)
       expo-json-utils: 55.0.2
 
-  expo-module-scripts@55.0.2(@babel/core@7.29.7)(@babel/runtime@7.29.7)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.7))(esbuild@0.25.4)(eslint@9.39.4)(expo@55.0.30)(jest@29.7.0(@types/node@26.5.1))(prettier@2.8.8)(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-refresh@0.14.2)(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8):
+  expo-module-scripts@55.0.2(@babel/core@7.29.7)(@babel/runtime@7.29.7)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.7))(esbuild@0.25.4)(eslint@9.39.4)(expo@55.0.30)(jest@29.7.0(@types/node@26.6.2))(prettier@2.8.8)(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-refresh@0.14.2)(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8):
     dependencies:
       '@babel/cli': 7.28.6(@babel/core@7.29.7)
       '@babel/plugin-transform-export-namespace-from': 7.27.1(@babel/core@7.29.7)
@@ -12141,7 +12150,7 @@ snapshots:
       '@babel/preset-typescript': 7.28.5(@babel/core@7.29.7)
       '@expo/npm-proofread': 1.0.1
       '@expo/spawn-async': 1.7.2
-      '@testing-library/react-native': 13.3.3(jest@29.7.0(@types/node@26.5.1))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8)
+      '@testing-library/react-native': 13.3.3(jest@29.7.0(@types/node@26.6.2))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8)
       '@tsconfig/node18': 18.2.6
       '@types/jest': 29.5.14
       babel-plugin-dynamic-import-node: 2.3.3
@@ -12149,11 +12158,11 @@ snapshots:
       commander: 12.1.0
       eslint-config-universe: 15.0.4(eslint@9.39.4)(prettier@2.8.8)(typescript@5.9.3)
       glob: 13.0.6
-      jest-expo: 55.0.17(@babel/core@7.29.7)(expo@55.0.30)(jest@29.7.0(@types/node@26.5.1))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)(typescript@5.9.3)
+      jest-expo: 55.0.17(@babel/core@7.29.7)(expo@55.0.30)(jest@29.7.0(@types/node@26.6.2))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)(typescript@5.9.3)
       jest-snapshot-prettier: prettier@2.8.8
-      jest-watch-typeahead: 2.2.1(jest@29.7.0(@types/node@26.5.1))
+      jest-watch-typeahead: 2.2.1(jest@29.7.0(@types/node@26.6.2))
       resolve-workspace-root: 2.0.1
-      ts-jest: 29.0.5(@babel/core@7.29.7)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.7))(esbuild@0.25.4)(jest@29.7.0(@types/node@26.5.1))(typescript@5.9.3)
+      ts-jest: 29.0.5(@babel/core@7.29.7)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.7))(esbuild@0.25.4)(jest@29.7.0(@types/node@26.6.2))(typescript@5.9.3)
       typescript: 5.9.3
     transitivePeerDependencies:
       - '@babel/core'
@@ -12216,7 +12225,7 @@ snapshots:
       - supports-color
       - typescript
 
-  expo-router@55.0.18(a23394d2f99d0f32345ec3f01a246fbf):
+  expo-router@55.0.18(05d3bd5bc5f5a85f046d39988db35c3c):
     dependencies:
       '@expo/log-box': 55.0.13(@expo/dom-webview@55.0.6)(expo@55.0.30)(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
       '@expo/metro-runtime': 55.0.12(@expo/dom-webview@55.0.6)(expo@55.0.30)(react-dom@19.2.8(react@19.2.8))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
@@ -12253,7 +12262,7 @@ snapshots:
       use-latest-callback: 0.2.6(react@19.2.8)
       vaul: 1.1.2(@types/react@19.2.14)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
     optionalDependencies:
-      '@testing-library/react-native': 13.3.3(jest@29.7.0(@types/node@26.5.1))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8)
+      '@testing-library/react-native': 13.3.3(jest@29.7.0(@types/node@26.6.2))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8)
       react-dom: 19.2.8(react@19.2.8)
       react-native-gesture-handler: 2.31.2(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
       react-native-reanimated: 4.3.4(react-native-worklets@0.8.3(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
@@ -12387,7 +12396,7 @@ snapshots:
 
   fetch-nodeshim@0.4.10: {}
 
-  fflate@0.8.2: {}
+  fflate@0.8.3: {}
 
   file-entry-cache@8.0.0:
     dependencies:
@@ -12553,7 +12562,7 @@ snapshots:
 
   happy-dom@20.11.8:
     dependencies:
-      '@types/node': 26.1.2
+      '@types/node': 26.6.2
       '@types/whatwg-mimetype': 3.0.2
       '@types/ws': 8.18.1
       buffer-image-size: 0.6.4
@@ -12871,7 +12880,7 @@ snapshots:
   istanbul-lib-instrument@6.0.3:
     dependencies:
       '@babel/core': 7.29.7
-      '@babel/parser': 7.29.8
+      '@babel/parser': 7.29.9
       '@istanbuljs/schema': 0.1.6
       istanbul-lib-coverage: 3.2.2
       semver: 7.8.5
@@ -12918,7 +12927,7 @@ snapshots:
       '@jest/expect': 29.7.0
       '@jest/test-result': 29.7.0
       '@jest/types': 29.6.3
-      '@types/node': 26.5.1
+      '@types/node': 26.6.2
       chalk: 4.1.2
       co: 4.6.0
       dedent: 1.7.2
@@ -12938,16 +12947,16 @@ snapshots:
       - babel-plugin-macros
       - supports-color
 
-  jest-cli@29.7.0(@types/node@26.5.1):
+  jest-cli@29.7.0(@types/node@26.6.2):
     dependencies:
       '@jest/core': 29.7.0
       '@jest/test-result': 29.7.0
       '@jest/types': 29.6.3
       chalk: 4.1.2
-      create-jest: 29.7.0(@types/node@26.5.1)
+      create-jest: 29.7.0(@types/node@26.6.2)
       exit: 0.1.2
       import-local: 3.2.0
-      jest-config: 29.7.0(@types/node@26.5.1)
+      jest-config: 29.7.0(@types/node@26.6.2)
       jest-util: 29.7.0
       jest-validate: 29.7.0
       yargs: 17.7.3
@@ -12957,7 +12966,7 @@ snapshots:
       - supports-color
       - ts-node
 
-  jest-config@29.7.0(@types/node@26.5.1):
+  jest-config@29.7.0(@types/node@26.6.2):
     dependencies:
       '@babel/core': 7.29.7
       '@jest/test-sequencer': 29.7.0
@@ -12982,7 +12991,7 @@ snapshots:
       slash: 3.0.0
       strip-json-comments: 3.1.1
     optionalDependencies:
-      '@types/node': 26.5.1
+      '@types/node': 26.6.2
     transitivePeerDependencies:
       - babel-plugin-macros
       - supports-color
@@ -13019,7 +13028,7 @@ snapshots:
       '@jest/fake-timers': 29.7.0
       '@jest/types': 29.6.3
       '@types/jsdom': 20.0.1
-      '@types/node': 25.6.0
+      '@types/node': 26.6.2
       jest-mock: 29.7.0
       jest-util: 29.7.0
       jsdom: 20.0.3
@@ -13033,11 +13042,11 @@ snapshots:
       '@jest/environment': 29.7.0
       '@jest/fake-timers': 29.7.0
       '@jest/types': 29.6.3
-      '@types/node': 26.1.2
+      '@types/node': 26.6.2
       jest-mock: 29.7.0
       jest-util: 29.7.0
 
-  jest-expo@55.0.17(@babel/core@7.29.7)(expo@55.0.30)(jest@29.7.0(@types/node@26.5.1))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)(typescript@5.9.3):
+  jest-expo@55.0.17(@babel/core@7.29.7)(expo@55.0.30)(jest@29.7.0(@types/node@26.6.2))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)(typescript@5.9.3):
     dependencies:
       '@expo/config': 55.0.16(typescript@5.9.3)
       '@expo/json-file': 10.0.14
@@ -13048,7 +13057,7 @@ snapshots:
       jest-environment-jsdom: 29.7.0
       jest-snapshot: 29.7.0
       jest-watch-select-projects: 2.0.0
-      jest-watch-typeahead: 2.2.1(jest@29.7.0(@types/node@26.5.1))
+      jest-watch-typeahead: 2.2.1(jest@29.7.0(@types/node@26.6.2))
       json5: 2.2.3
       lodash: 4.18.1
       react-native: 0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8)
@@ -13071,7 +13080,7 @@ snapshots:
     dependencies:
       '@jest/types': 29.6.3
       '@types/graceful-fs': 4.1.9
-      '@types/node': 26.1.1
+      '@types/node': 26.6.2
       anymatch: 3.1.3
       fb-watchman: 2.0.2
       graceful-fs: 4.2.11
@@ -13117,7 +13126,7 @@ snapshots:
   jest-mock@29.7.0:
     dependencies:
       '@jest/types': 29.6.3
-      '@types/node': 25.6.0
+      '@types/node': 26.6.2
       jest-util: 29.7.0
 
   jest-pnp-resolver@1.2.3(jest-resolve@29.7.0):
@@ -13152,7 +13161,7 @@ snapshots:
       '@jest/test-result': 29.7.0
       '@jest/transform': 29.7.0
       '@jest/types': 29.6.3
-      '@types/node': 26.5.1
+      '@types/node': 26.6.2
       chalk: 4.1.2
       emittery: 0.13.1
       graceful-fs: 4.2.11
@@ -13180,7 +13189,7 @@ snapshots:
       '@jest/test-result': 29.7.0
       '@jest/transform': 29.7.0
       '@jest/types': 29.6.3
-      '@types/node': 26.5.1
+      '@types/node': 26.6.2
       chalk: 4.1.2
       cjs-module-lexer: 1.4.3
       collect-v8-coverage: 1.0.3
@@ -13226,7 +13235,7 @@ snapshots:
   jest-util@29.7.0:
     dependencies:
       '@jest/types': 29.6.3
-      '@types/node': 26.1.1
+      '@types/node': 26.6.2
       chalk: 4.1.2
       ci-info: 3.9.0
       graceful-fs: 4.2.11
@@ -13247,11 +13256,11 @@ snapshots:
       chalk: 3.0.0
       prompts: 2.4.2
 
-  jest-watch-typeahead@2.2.1(jest@29.7.0(@types/node@26.5.1)):
+  jest-watch-typeahead@2.2.1(jest@29.7.0(@types/node@26.6.2)):
     dependencies:
       ansi-escapes: 6.2.1
       chalk: 4.1.2
-      jest: 29.7.0(@types/node@26.5.1)
+      jest: 29.7.0(@types/node@26.6.2)
       jest-regex-util: 29.6.3
       jest-watcher: 29.7.0
       slash: 5.1.0
@@ -13262,7 +13271,7 @@ snapshots:
     dependencies:
       '@jest/test-result': 29.7.0
       '@jest/types': 29.6.3
-      '@types/node': 25.6.0
+      '@types/node': 26.6.2
       ansi-escapes: 4.3.2
       chalk: 4.1.2
       emittery: 0.13.1
@@ -13271,17 +13280,17 @@ snapshots:
 
   jest-worker@29.7.0:
     dependencies:
-      '@types/node': 26.1.1
+      '@types/node': 26.6.2
       jest-util: 29.7.0
       merge-stream: 2.0.0
       supports-color: 8.1.1
 
-  jest@29.7.0(@types/node@26.5.1):
+  jest@29.7.0(@types/node@26.6.2):
     dependencies:
       '@jest/core': 29.7.0
       '@jest/types': 29.6.3
       import-local: 3.2.0
-      jest-cli: 29.7.0(@types/node@26.5.1)
+      jest-cli: 29.7.0(@types/node@26.6.2)
     transitivePeerDependencies:
       - '@types/node'
       - babel-plugin-macros
@@ -13306,7 +13315,7 @@ snapshots:
   jsdom@20.0.3:
     dependencies:
       abab: 2.0.6
-      acorn: 8.15.0
+      acorn: 8.18.0
       acorn-globals: 7.0.1
       cssom: 0.5.0
       cssstyle: 2.3.0
@@ -13484,11 +13493,11 @@ snapshots:
     dependencies:
       yallist: 3.1.1
 
-  lucide-react-native@1.14.0(react-native-svg@15.15.4(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8):
+  lucide-react-native@1.14.0(react-native-svg@15.15.5(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8):
     dependencies:
       react: 19.2.8
       react-native: 0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8)
-      react-native-svg: 15.15.4(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
+      react-native-svg: 15.15.5(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
 
   magic-string@0.30.21:
     dependencies:
@@ -13792,7 +13801,7 @@ snapshots:
     dependencies:
       '@babel/core': 7.29.7
       '@babel/generator': 7.29.8
-      '@babel/parser': 7.29.8
+      '@babel/parser': 7.29.9
       '@babel/types': 7.29.8
       flow-enums-runtime: 0.0.6
       metro: 0.84.6
@@ -13858,7 +13867,7 @@ snapshots:
       '@babel/code-frame': 7.29.7
       '@babel/core': 7.29.7
       '@babel/generator': 7.29.8
-      '@babel/parser': 7.29.8
+      '@babel/parser': 7.29.9
       '@babel/template': 7.29.7
       '@babel/traverse': 7.29.8
       '@babel/types': 7.29.8
@@ -14100,51 +14109,51 @@ snapshots:
       object-keys: 1.1.1
       safe-push-apply: 1.0.0
 
-  oxfmt@0.65.0:
+  oxfmt@0.70.0:
     dependencies:
-      tinypool: 2.1.0
+      tinypool: 2.1.2
     optionalDependencies:
-      '@oxfmt/binding-android-arm-eabi': 0.65.0
-      '@oxfmt/binding-android-arm64': 0.65.0
-      '@oxfmt/binding-darwin-arm64': 0.65.0
-      '@oxfmt/binding-darwin-x64': 0.65.0
-      '@oxfmt/binding-freebsd-x64': 0.65.0
-      '@oxfmt/binding-linux-arm-gnueabihf': 0.65.0
-      '@oxfmt/binding-linux-arm-musleabihf': 0.65.0
-      '@oxfmt/binding-linux-arm64-gnu': 0.65.0
-      '@oxfmt/binding-linux-arm64-musl': 0.65.0
-      '@oxfmt/binding-linux-ppc64-gnu': 0.65.0
-      '@oxfmt/binding-linux-riscv64-gnu': 0.65.0
-      '@oxfmt/binding-linux-riscv64-musl': 0.65.0
-      '@oxfmt/binding-linux-s390x-gnu': 0.65.0
-      '@oxfmt/binding-linux-x64-gnu': 0.65.0
-      '@oxfmt/binding-linux-x64-musl': 0.65.0
-      '@oxfmt/binding-openharmony-arm64': 0.65.0
-      '@oxfmt/binding-win32-arm64-msvc': 0.65.0
-      '@oxfmt/binding-win32-ia32-msvc': 0.65.0
-      '@oxfmt/binding-win32-x64-msvc': 0.65.0
+      '@oxfmt/binding-android-arm-eabi': 0.70.0
+      '@oxfmt/binding-android-arm64': 0.70.0
+      '@oxfmt/binding-darwin-arm64': 0.70.0
+      '@oxfmt/binding-darwin-x64': 0.70.0
+      '@oxfmt/binding-freebsd-x64': 0.70.0
+      '@oxfmt/binding-linux-arm-gnueabihf': 0.70.0
+      '@oxfmt/binding-linux-arm-musleabihf': 0.70.0
+      '@oxfmt/binding-linux-arm64-gnu': 0.70.0
+      '@oxfmt/binding-linux-arm64-musl': 0.70.0
+      '@oxfmt/binding-linux-ppc64-gnu': 0.70.0
+      '@oxfmt/binding-linux-riscv64-gnu': 0.70.0
+      '@oxfmt/binding-linux-riscv64-musl': 0.70.0
+      '@oxfmt/binding-linux-s390x-gnu': 0.70.0
+      '@oxfmt/binding-linux-x64-gnu': 0.70.0
+      '@oxfmt/binding-linux-x64-musl': 0.70.0
+      '@oxfmt/binding-openharmony-arm64': 0.70.0
+      '@oxfmt/binding-win32-arm64-msvc': 0.70.0
+      '@oxfmt/binding-win32-ia32-msvc': 0.70.0
+      '@oxfmt/binding-win32-x64-msvc': 0.70.0
 
-  oxlint@1.80.0:
+  oxlint@1.85.0:
     optionalDependencies:
-      '@oxlint/binding-android-arm-eabi': 1.80.0
-      '@oxlint/binding-android-arm64': 1.80.0
-      '@oxlint/binding-darwin-arm64': 1.80.0
-      '@oxlint/binding-darwin-x64': 1.80.0
-      '@oxlint/binding-freebsd-x64': 1.80.0
-      '@oxlint/binding-linux-arm-gnueabihf': 1.80.0
-      '@oxlint/binding-linux-arm-musleabihf': 1.80.0
-      '@oxlint/binding-linux-arm64-gnu': 1.80.0
-      '@oxlint/binding-linux-arm64-musl': 1.80.0
-      '@oxlint/binding-linux-ppc64-gnu': 1.80.0
-      '@oxlint/binding-linux-riscv64-gnu': 1.80.0
-      '@oxlint/binding-linux-riscv64-musl': 1.80.0
-      '@oxlint/binding-linux-s390x-gnu': 1.80.0
-      '@oxlint/binding-linux-x64-gnu': 1.80.0
-      '@oxlint/binding-linux-x64-musl': 1.80.0
-      '@oxlint/binding-openharmony-arm64': 1.80.0
-      '@oxlint/binding-win32-arm64-msvc': 1.80.0
-      '@oxlint/binding-win32-ia32-msvc': 1.80.0
-      '@oxlint/binding-win32-x64-msvc': 1.80.0
+      '@oxlint/binding-android-arm-eabi': 1.85.0
+      '@oxlint/binding-android-arm64': 1.85.0
+      '@oxlint/binding-darwin-arm64': 1.85.0
+      '@oxlint/binding-darwin-x64': 1.85.0
+      '@oxlint/binding-freebsd-x64': 1.85.0
+      '@oxlint/binding-linux-arm-gnueabihf': 1.85.0
+      '@oxlint/binding-linux-arm-musleabihf': 1.85.0
+      '@oxlint/binding-linux-arm64-gnu': 1.85.0
+      '@oxlint/binding-linux-arm64-musl': 1.85.0
+      '@oxlint/binding-linux-ppc64-gnu': 1.85.0
+      '@oxlint/binding-linux-riscv64-gnu': 1.85.0
+      '@oxlint/binding-linux-riscv64-musl': 1.85.0
+      '@oxlint/binding-linux-s390x-gnu': 1.85.0
+      '@oxlint/binding-linux-x64-gnu': 1.85.0
+      '@oxlint/binding-linux-x64-musl': 1.85.0
+      '@oxlint/binding-openharmony-arm64': 1.85.0
+      '@oxlint/binding-win32-arm64-msvc': 1.85.0
+      '@oxlint/binding-win32-ia32-msvc': 1.85.0
+      '@oxlint/binding-win32-x64-msvc': 1.85.0
 
   p-limit@2.3.0:
     dependencies:
@@ -14365,13 +14374,12 @@ snapshots:
       react-native: 0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8)
       warn-once: 0.1.1
 
-  react-native-svg@15.15.4(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8):
+  react-native-svg@15.15.5(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8):
     dependencies:
       css-select: 5.2.2
       css-tree: 1.1.3
       react: 19.2.8
       react-native: 0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8)
-      warn-once: 0.1.1
 
   react-native-uitextview@2.2.0(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8):
     dependencies:
@@ -14995,14 +15003,14 @@ snapshots:
   terser@5.49.1:
     dependencies:
       '@jridgewell/source-map': 0.3.11
-      acorn: 8.15.0
+      acorn: 8.18.0
       commander: 2.20.3
       source-map-support: 0.5.21
 
   terser@5.51.2:
     dependencies:
       '@jridgewell/source-map': 0.3.11
-      acorn: 8.15.0
+      acorn: 8.18.0
       commander: 2.20.3
       source-map-support: 0.5.21
 
@@ -15023,7 +15031,7 @@ snapshots:
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
 
-  tinypool@2.1.0: {}
+  tinypool@2.1.2: {}
 
   tinyrainbow@3.1.0: {}
 
@@ -15061,11 +15069,11 @@ snapshots:
 
   ts-dedent@2.3.0: {}
 
-  ts-jest@29.0.5(@babel/core@7.29.7)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.7))(esbuild@0.25.4)(jest@29.7.0(@types/node@26.5.1))(typescript@5.9.3):
+  ts-jest@29.0.5(@babel/core@7.29.7)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.7))(esbuild@0.25.4)(jest@29.7.0(@types/node@26.6.2))(typescript@5.9.3):
     dependencies:
       bs-logger: 0.2.6
       fast-json-stable-stringify: 2.1.0
-      jest: 29.7.0(@types/node@26.5.1)
+      jest: 29.7.0(@types/node@26.6.2)
       jest-util: 29.7.0
       json5: 2.2.3
       lodash.memoize: 4.1.2
@@ -15158,8 +15166,6 @@ snapshots:
 
   undici-types@7.19.2: {}
 
-  undici-types@8.3.0: {}
-
   undici-types@8.9.0: {}
 
   unicode-canonical-property-names-ecmascript@2.0.1: {}
@@ -15240,7 +15246,7 @@ snapshots:
       - '@types/react'
       - '@types/react-dom'
 
-  vite@8.1.0(@types/node@26.5.1)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1):
+  vite@8.1.0(@types/node@26.6.2)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1):
     dependencies:
       lightningcss: 1.32.0
       picomatch: 4.0.4
@@ -15248,17 +15254,17 @@ snapshots:
       rolldown: 1.1.3
       tinyglobby: 0.2.17
     optionalDependencies:
-      '@types/node': 26.5.1
+      '@types/node': 26.6.2
       esbuild: 0.25.4
       fsevents: 2.3.3
       terser: 5.51.2
       tsx: 4.22.4
       yaml: 2.9.1
 
-  vitest@4.1.11(@types/node@26.5.1)(happy-dom@20.11.8)(jsdom@20.0.3)(vite@8.1.0(@types/node@26.5.1)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1)):
+  vitest@4.1.11(@types/node@26.6.2)(happy-dom@20.11.8)(jsdom@20.0.3)(vite@8.1.0(@types/node@26.6.2)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1)):
     dependencies:
       '@vitest/expect': 4.1.11
-      '@vitest/mocker': 4.1.11(vite@8.1.0(@types/node@26.5.1)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1))
+      '@vitest/mocker': 4.1.11(vite@8.1.0(@types/node@26.6.2)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1))
       '@vitest/pretty-format': 4.1.11
       '@vitest/runner': 4.1.11
       '@vitest/snapshot': 4.1.11
@@ -15275,10 +15281,10 @@ snapshots:
       tinyexec: 1.1.2
       tinyglobby: 0.2.17
       tinyrainbow: 3.1.0
-      vite: 8.1.0(@types/node@26.5.1)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1)
+      vite: 8.1.0(@types/node@26.6.2)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1)
       why-is-node-running: 2.3.0
     optionalDependencies:
-      '@types/node': 26.5.1
+      '@types/node': 26.6.2
       happy-dom: 20.11.8
       jsdom: 20.0.3
     transitivePeerDependencies:
@@ -15445,9 +15451,9 @@ snapshots:
 
   zod@3.25.76: {}
 
-  zod@4.4.3: {}
+  zod@4.6.5: {}
 
-  zustand@5.0.13(@types/react@19.2.14)(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8)):
+  zustand@5.0.15(@types/react@19.2.14)(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8)):
     optionalDependencies:
       '@types/react': 19.2.14
       react: 19.2.8
diff --git a/mobile/rpc-foundation/goldens/aivault-history-scan-fulfilled.json b/mobile/rpc-foundation/goldens/aivault-history-scan-fulfilled.json
index 138ac018b19..6ef54a83628 100644
--- a/mobile/rpc-foundation/goldens/aivault-history-scan-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/aivault-history-scan-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "ec16931c5431d3dbb05729d4670c381a434bff71648d334b7b5224db188fdccb",
   "scenarioSha256": "0431ac82cbb8c60b16f4432fd0da7cff665485d668e512b20fc1168ec63db3fe",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-history-scan-unsupported.json b/mobile/rpc-foundation/goldens/aivault-history-scan-unsupported.json
index 5428fd527d7..3a35da500e4 100644
--- a/mobile/rpc-foundation/goldens/aivault-history-scan-unsupported.json
+++ b/mobile/rpc-foundation/goldens/aivault-history-scan-unsupported.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "ec16931c5431d3dbb05729d4670c381a434bff71648d334b7b5224db188fdccb",
   "scenarioSha256": "e97c6db772a70ee1912419ac67835b6074aaf9a341d4360389a11465f08092c5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-history-scan-worktrees-late.json b/mobile/rpc-foundation/goldens/aivault-history-scan-worktrees-late.json
index 9129eb79bce..36b7356fa85 100644
--- a/mobile/rpc-foundation/goldens/aivault-history-scan-worktrees-late.json
+++ b/mobile/rpc-foundation/goldens/aivault-history-scan-worktrees-late.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "ec16931c5431d3dbb05729d4670c381a434bff71648d334b7b5224db188fdccb",
   "scenarioSha256": "10011c7c75e74d9c2e880c5458c9156264ae07e91956a80946ede1d4e684952a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-history-screen-listed.json b/mobile/rpc-foundation/goldens/aivault-history-screen-listed.json
index 2ada66f375d..a8428f3f769 100644
--- a/mobile/rpc-foundation/goldens/aivault-history-screen-listed.json
+++ b/mobile/rpc-foundation/goldens/aivault-history-screen-listed.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c78ab47eea594b7e1988403321ff9ba135ca60c513bb9d5848bdde26c0ffe3c3",
   "scenarioSha256": "d52d3c5858298a4a6a90bd9a8986b780004477de105fe93f6303d9c303ffea38",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-history-screen-worktrees.json b/mobile/rpc-foundation/goldens/aivault-history-screen-worktrees.json
index 51d7379306f..78615f8dfe9 100644
--- a/mobile/rpc-foundation/goldens/aivault-history-screen-worktrees.json
+++ b/mobile/rpc-foundation/goldens/aivault-history-screen-worktrees.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c78ab47eea594b7e1988403321ff9ba135ca60c513bb9d5848bdde26c0ffe3c3",
   "scenarioSha256": "f50f63c4e2a69793b3d322ed16089c4241ff6169d8f9549106480230fb8dd5e7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-resume-launch-create-refused.json b/mobile/rpc-foundation/goldens/aivault-resume-launch-create-refused.json
index 235bc5d615f..471dedaaf50 100644
--- a/mobile/rpc-foundation/goldens/aivault-resume-launch-create-refused.json
+++ b/mobile/rpc-foundation/goldens/aivault-resume-launch-create-refused.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "ebf1bbc01ad7704fe79eff0969fcc2d4af8ebfa7c2410d2ed9d3ae8c6976b434",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-resume-launch-invalid-tab.json b/mobile/rpc-foundation/goldens/aivault-resume-launch-invalid-tab.json
index c35a49bb02c..1ad487aacb3 100644
--- a/mobile/rpc-foundation/goldens/aivault-resume-launch-invalid-tab.json
+++ b/mobile/rpc-foundation/goldens/aivault-resume-launch-invalid-tab.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "281ccf5a082f3788ae8bf19f742ea4baf35c20c78bc91d7d91873845583e1a91",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-resume-launch-locked.json b/mobile/rpc-foundation/goldens/aivault-resume-launch-locked.json
index f5139e8d1b0..4c8dc5fb9c4 100644
--- a/mobile/rpc-foundation/goldens/aivault-resume-launch-locked.json
+++ b/mobile/rpc-foundation/goldens/aivault-resume-launch-locked.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "941fcf202417c94ef546f5ee331983689d8b72397dac6f61dda944ca24abed9e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-resume-launch-sent.json b/mobile/rpc-foundation/goldens/aivault-resume-launch-sent.json
index da5cf078d42..282e71573a8 100644
--- a/mobile/rpc-foundation/goldens/aivault-resume-launch-sent.json
+++ b/mobile/rpc-foundation/goldens/aivault-resume-launch-sent.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "f0ac1c996e5b1b4043e0a081978476c6c2dd8a5d517d5752857721205a588fb0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-resume-prepare-refused.json b/mobile/rpc-foundation/goldens/aivault-resume-prepare-refused.json
index 10b7aac7b26..3a4721a0f4b 100644
--- a/mobile/rpc-foundation/goldens/aivault-resume-prepare-refused.json
+++ b/mobile/rpc-foundation/goldens/aivault-resume-prepare-refused.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "dc9926f95475413627315e1f1c96740ececa697c6a0a5e3c42e18cfd4d58448a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-resume-prepare-repin.json b/mobile/rpc-foundation/goldens/aivault-resume-prepare-repin.json
index 482a5f3c124..053b21b1497 100644
--- a/mobile/rpc-foundation/goldens/aivault-resume-prepare-repin.json
+++ b/mobile/rpc-foundation/goldens/aivault-resume-prepare-repin.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "6719aea706086a68709894546f9595264407db2df94fa56180cb3c68b08aaa69",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-resume-prepare-skipped.json b/mobile/rpc-foundation/goldens/aivault-resume-prepare-skipped.json
index 846679f2350..364437f8312 100644
--- a/mobile/rpc-foundation/goldens/aivault-resume-prepare-skipped.json
+++ b/mobile/rpc-foundation/goldens/aivault-resume-prepare-skipped.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "3afaf2807506f5bde2159b367f34c6b777739d6aad564796d54ac0da05b5bd02",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-resume-prepare-unavailable.json b/mobile/rpc-foundation/goldens/aivault-resume-prepare-unavailable.json
index 828d326b17a..bd96c6c2258 100644
--- a/mobile/rpc-foundation/goldens/aivault-resume-prepare-unavailable.json
+++ b/mobile/rpc-foundation/goldens/aivault-resume-prepare-unavailable.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "a5eedea5f551e0ca0e143292f1d9aa8920dd7af62a02d8e8777666ab3779c019",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/b1.json b/mobile/rpc-foundation/goldens/b1.json
index 81f53ccf960..9a15abc2d9f 100644
--- a/mobile/rpc-foundation/goldens/b1.json
+++ b/mobile/rpc-foundation/goldens/b1.json
@@ -3,9 +3,9 @@
   "family": "legacy-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "262eaad263a45aa13ec5b27c12b59946b12c202474229fff7a5727dba6d702ca",
   "scenarioSha256": "23ffc912a432dcd3ff70be1903a8d518cf85634f27a2be6d21585963e338e7e3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/b2.json b/mobile/rpc-foundation/goldens/b2.json
index f6482e8e381..bfadb7c217b 100644
--- a/mobile/rpc-foundation/goldens/b2.json
+++ b/mobile/rpc-foundation/goldens/b2.json
@@ -3,9 +3,9 @@
   "family": "project-explicit-false",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "b31992be2f91bd61fbe1b8a5400da3b7a56753564b0b0b2b38bc5d549812d693",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/b3.json b/mobile/rpc-foundation/goldens/b3.json
index eeffb08a3c7..0c193234114 100644
--- a/mobile/rpc-foundation/goldens/b3.json
+++ b/mobile/rpc-foundation/goldens/b3.json
@@ -3,9 +3,9 @@
   "family": "linear-detail-barrier",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "130e493fcd7765e037405f59e6cc78a0cc1793b1ae092cad933ff9d5a9df8b7a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/browser-dialog-accepted.json b/mobile/rpc-foundation/goldens/browser-dialog-accepted.json
index 9ff6bcea77a..92e6e7f1bd3 100644
--- a/mobile/rpc-foundation/goldens/browser-dialog-accepted.json
+++ b/mobile/rpc-foundation/goldens/browser-dialog-accepted.json
@@ -3,9 +3,9 @@
   "family": "browser.dialog",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "95f377bc4d8bf1248cafed26b2e9f425ad37e8d3c99e354bd6a8c67eb9bd9b1b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/browser-dialog-dismissed.json b/mobile/rpc-foundation/goldens/browser-dialog-dismissed.json
index 27dd51920b2..c58585023aa 100644
--- a/mobile/rpc-foundation/goldens/browser-dialog-dismissed.json
+++ b/mobile/rpc-foundation/goldens/browser-dialog-dismissed.json
@@ -3,9 +3,9 @@
   "family": "browser.dialog",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "5071188ee492a4ced5be793b2dab32baa9750ee6535128635f274fd79198e2f1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/browser-keyboard-input.json b/mobile/rpc-foundation/goldens/browser-keyboard-input.json
index 40f8cd6c169..cb71b55fe8b 100644
--- a/mobile/rpc-foundation/goldens/browser-keyboard-input.json
+++ b/mobile/rpc-foundation/goldens/browser-keyboard-input.json
@@ -3,9 +3,9 @@
   "family": "browser.keyboard",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "eb2294c30af70ebc2bac092dc5105249ae8cf1941f750406622f7ff6dd70cc1b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/browser-pointer-click-accepted.json b/mobile/rpc-foundation/goldens/browser-pointer-click-accepted.json
index 286578bb734..66357181750 100644
--- a/mobile/rpc-foundation/goldens/browser-pointer-click-accepted.json
+++ b/mobile/rpc-foundation/goldens/browser-pointer-click-accepted.json
@@ -3,9 +3,9 @@
   "family": "browser.pointer-click",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "73faa87b359a11959543542016295bb6b36a10934dd99ad5c1a77a4290a608cd",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/browser-pointer-click-fallback.json b/mobile/rpc-foundation/goldens/browser-pointer-click-fallback.json
index 3b15861a690..ae082a2ca37 100644
--- a/mobile/rpc-foundation/goldens/browser-pointer-click-fallback.json
+++ b/mobile/rpc-foundation/goldens/browser-pointer-click-fallback.json
@@ -3,9 +3,9 @@
   "family": "browser.pointer-click",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "34efd4d8568ac15d4e67d475e28194522d6413ad27dce1d6850718af15b3f874",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/browser-wheel-scrolled.json b/mobile/rpc-foundation/goldens/browser-wheel-scrolled.json
index b63a025d9df..9f0cd64d513 100644
--- a/mobile/rpc-foundation/goldens/browser-wheel-scrolled.json
+++ b/mobile/rpc-foundation/goldens/browser-wheel-scrolled.json
@@ -3,9 +3,9 @@
   "family": "browser.wheel",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "e1bc21248ccff45ff217e385a51618b6f5724c037bfbefa03bb76a48dd4d793b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/clipboard-image-attachment-anonymous.json b/mobile/rpc-foundation/goldens/clipboard-image-attachment-anonymous.json
index 4ba6af31aa3..d84ddeb6506 100644
--- a/mobile/rpc-foundation/goldens/clipboard-image-attachment-anonymous.json
+++ b/mobile/rpc-foundation/goldens/clipboard-image-attachment-anonymous.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-attachment",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "5411e29436e9faf18a1b81f369082f3ae087a9a96a2e1ea0f97e65e9391bfd0c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/clipboard-image-attachment-blocked-before-send.json b/mobile/rpc-foundation/goldens/clipboard-image-attachment-blocked-before-send.json
index 534af264932..3572d9d5157 100644
--- a/mobile/rpc-foundation/goldens/clipboard-image-attachment-blocked-before-send.json
+++ b/mobile/rpc-foundation/goldens/clipboard-image-attachment-blocked-before-send.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-attachment",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "ea04d03c15d3cb94be7fe111a8a6219c4e0304095679bbae62af623f5b36c9f4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/clipboard-image-attachment-cancelled.json b/mobile/rpc-foundation/goldens/clipboard-image-attachment-cancelled.json
index 8f65829490c..faccc05498a 100644
--- a/mobile/rpc-foundation/goldens/clipboard-image-attachment-cancelled.json
+++ b/mobile/rpc-foundation/goldens/clipboard-image-attachment-cancelled.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-attachment",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "e6be7d5dd6b4f5083627a3ba864b1b040d71bf72b60ad940b7d0d575964a7b80",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/clipboard-image-attachment-pasted.json b/mobile/rpc-foundation/goldens/clipboard-image-attachment-pasted.json
index d53f736fca3..3bca19c1547 100644
--- a/mobile/rpc-foundation/goldens/clipboard-image-attachment-pasted.json
+++ b/mobile/rpc-foundation/goldens/clipboard-image-attachment-pasted.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-attachment",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "d6db064741cd68d6ad8a3e490a774d8145adb4a5b7cca8218f5c972b1a31f93b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/clipboard-image-attachment-upload-refused.json b/mobile/rpc-foundation/goldens/clipboard-image-attachment-upload-refused.json
index 8ac9a6ffd51..66b955c4391 100644
--- a/mobile/rpc-foundation/goldens/clipboard-image-attachment-upload-refused.json
+++ b/mobile/rpc-foundation/goldens/clipboard-image-attachment-upload-refused.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-attachment",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "e7f492523421873f045726e15ec95eac26d43f7e971a33fd89ec1a9749492987",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/clipboard-image-upload-aborts-on-chunk-failure.json b/mobile/rpc-foundation/goldens/clipboard-image-upload-aborts-on-chunk-failure.json
index 4f7905702c0..2fb196d4a09 100644
--- a/mobile/rpc-foundation/goldens/clipboard-image-upload-aborts-on-chunk-failure.json
+++ b/mobile/rpc-foundation/goldens/clipboard-image-upload-aborts-on-chunk-failure.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "195c2f15d81c70012ea88750ab3f84bfe512f7e422f7d2d09fb7919bd9cfd85a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/clipboard-image-upload-chunked.json b/mobile/rpc-foundation/goldens/clipboard-image-upload-chunked.json
index d4896e18d34..f48c54c9c2f 100644
--- a/mobile/rpc-foundation/goldens/clipboard-image-upload-chunked.json
+++ b/mobile/rpc-foundation/goldens/clipboard-image-upload-chunked.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "160101326d39705c2036c12646ff6b13d997a1cf91bdc86e5e29279ba31867e4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/clipboard-image-upload-single-frame-fallback.json b/mobile/rpc-foundation/goldens/clipboard-image-upload-single-frame-fallback.json
index c9f7be2575f..7a868190426 100644
--- a/mobile/rpc-foundation/goldens/clipboard-image-upload-single-frame-fallback.json
+++ b/mobile/rpc-foundation/goldens/clipboard-image-upload-single-frame-fallback.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "89ffa843d08ee27dd44b7bba507ce84661b0df73c35f7a8c273e004604710dc9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/clipboard-image-upload-start-refused.json b/mobile/rpc-foundation/goldens/clipboard-image-upload-start-refused.json
index 41bf286bfb8..534630a38f8 100644
--- a/mobile/rpc-foundation/goldens/clipboard-image-upload-start-refused.json
+++ b/mobile/rpc-foundation/goldens/clipboard-image-upload-start-refused.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "bf0227939c2d41d6a1ebc5b07a31196043e78f1580811bd32ec6fc5f447f5934",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/codex-reset-credit-consumed.json b/mobile/rpc-foundation/goldens/codex-reset-credit-consumed.json
index 0fbe26af936..13e76f06d12 100644
--- a/mobile/rpc-foundation/goldens/codex-reset-credit-consumed.json
+++ b/mobile/rpc-foundation/goldens/codex-reset-credit-consumed.json
@@ -3,9 +3,9 @@
   "family": "components.codex-reset-credit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "76b53dea504a688493843e23e8e7d052fc196f559bb1e2579d0fd38bf3156d0e",
   "scenarioSha256": "00260be9809576607ac91bfacd9fa6cc4f8a190c6b88804c977ea07d36d7162e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/codex-reset-credit-resumed.json b/mobile/rpc-foundation/goldens/codex-reset-credit-resumed.json
index 121bca0f229..c406a8e8a52 100644
--- a/mobile/rpc-foundation/goldens/codex-reset-credit-resumed.json
+++ b/mobile/rpc-foundation/goldens/codex-reset-credit-resumed.json
@@ -3,9 +3,9 @@
   "family": "components.codex-reset-credit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "76b53dea504a688493843e23e8e7d052fc196f559bb1e2579d0fd38bf3156d0e",
   "scenarioSha256": "d85a4031b701e563941afcdd7375cf78a1ee1487a0dab722f8516c2bc8d3dcee",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/components-codex-capability.json b/mobile/rpc-foundation/goldens/components-codex-capability.json
index 8aac0e8aedc..ac016b526c8 100644
--- a/mobile/rpc-foundation/goldens/components-codex-capability.json
+++ b/mobile/rpc-foundation/goldens/components-codex-capability.json
@@ -3,9 +3,9 @@
   "family": "components.codex-reset-capability",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "88570b9d2376863c7f88d7ed8c745a5fb771deddbc7409f8944fa861dd4bdce9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/components-setup-ask.json b/mobile/rpc-foundation/goldens/components-setup-ask.json
index 2ae8db30432..cd0b7d708ff 100644
--- a/mobile/rpc-foundation/goldens/components-setup-ask.json
+++ b/mobile/rpc-foundation/goldens/components-setup-ask.json
@@ -3,9 +3,9 @@
   "family": "components.setup-script",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "d4052f119c7ed68dc922c8beeb0074701f1532b10e48e284fb71aa165a17e437",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/components-target-local.json b/mobile/rpc-foundation/goldens/components-target-local.json
index fd278621d76..368cae38a04 100644
--- a/mobile/rpc-foundation/goldens/components-target-local.json
+++ b/mobile/rpc-foundation/goldens/components-target-local.json
@@ -3,9 +3,9 @@
   "family": "components.execution-target-local",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "2e0d3021621698b63117e250dd5e9762b5bfb3dc1911e27c510e9539bd2ee6c9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/components-target-ssh.json b/mobile/rpc-foundation/goldens/components-target-ssh.json
index ec8ac53cb66..a9a17cb7ff7 100644
--- a/mobile/rpc-foundation/goldens/components-target-ssh.json
+++ b/mobile/rpc-foundation/goldens/components-target-ssh.json
@@ -3,9 +3,9 @@
   "family": "components.execution-target",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "82b891c7a7a2f255e2d22a372ee6112c9cc1f650259244e87f2e8c1356e97e5f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/diff-review-branch-compare.json b/mobile/rpc-foundation/goldens/diff-review-branch-compare.json
index 582d306216c..3f07f5ecf1c 100644
--- a/mobile/rpc-foundation/goldens/diff-review-branch-compare.json
+++ b/mobile/rpc-foundation/goldens/diff-review-branch-compare.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "b7579013e65f0f5fe503c10cf2294cb9d4ac1938108275de001db6e02cf2cc21",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/diff-review-branch-file-diff.json b/mobile/rpc-foundation/goldens/diff-review-branch-file-diff.json
index e83accdd3d6..c7ea21ede21 100644
--- a/mobile/rpc-foundation/goldens/diff-review-branch-file-diff.json
+++ b/mobile/rpc-foundation/goldens/diff-review-branch-file-diff.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "6c71b0f217a464dffbc6f5736605b840edac74ebaf0664edc0ab85984bb64328",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/diff-review-notes-refused-before-compare.json b/mobile/rpc-foundation/goldens/diff-review-notes-refused-before-compare.json
index 925190fb970..83c531b5f6c 100644
--- a/mobile/rpc-foundation/goldens/diff-review-notes-refused-before-compare.json
+++ b/mobile/rpc-foundation/goldens/diff-review-notes-refused-before-compare.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "3e7fa054f77587b9ac24b6732a9926273b0f2ff35a266e633d0ccd1dada932cc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/diff-review-refused-file-diff.json b/mobile/rpc-foundation/goldens/diff-review-refused-file-diff.json
index 6eb0847e376..cf7befd530f 100644
--- a/mobile/rpc-foundation/goldens/diff-review-refused-file-diff.json
+++ b/mobile/rpc-foundation/goldens/diff-review-refused-file-diff.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "d1b04fe2945a2799ac8465d8fd9e45ab790ae29b401a0cf4fef68ebc5fa3cc76",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/diff-review-snapshot.json b/mobile/rpc-foundation/goldens/diff-review-snapshot.json
index 9a9cc8515a8..01dad0da72a 100644
--- a/mobile/rpc-foundation/goldens/diff-review-snapshot.json
+++ b/mobile/rpc-foundation/goldens/diff-review-snapshot.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "fa0a81462196458fdded5b7c00aa4e73975c2111afdd8dac115871490a481da2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/diff-review-status-unavailable.json b/mobile/rpc-foundation/goldens/diff-review-status-unavailable.json
index a64f277b101..95dad784ae0 100644
--- a/mobile/rpc-foundation/goldens/diff-review-status-unavailable.json
+++ b/mobile/rpc-foundation/goldens/diff-review-status-unavailable.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "182f37fbe6ae7c0694b50d603ecd4a03bc9a8c7c9738ebb775b47eb5f3b9660f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/diff-review-worktree-file-diff.json b/mobile/rpc-foundation/goldens/diff-review-worktree-file-diff.json
index 4170ae899c8..d10b03e95fa 100644
--- a/mobile/rpc-foundation/goldens/diff-review-worktree-file-diff.json
+++ b/mobile/rpc-foundation/goldens/diff-review-worktree-file-diff.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "538b68485a2268d311fcc7e13ff1a3e446ba4aa010bc18633af8e938a6688257",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/file-tap-open-refused.json b/mobile/rpc-foundation/goldens/file-tap-open-refused.json
index a59f72b4b0e..a720373bd68 100644
--- a/mobile/rpc-foundation/goldens/file-tap-open-refused.json
+++ b/mobile/rpc-foundation/goldens/file-tap-open-refused.json
@@ -3,9 +3,9 @@
   "family": "files.terminal-path-tap",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e20a76ecd5e820dc4797fb25307810af68b5ced996dba2b9599464a21b5cbe1b",
   "scenarioSha256": "a927e85c3ae58cd3b017955fe28aeffec6a5471b51d782f116639a3aaf4af77d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/file-tap-opens-worktree-file.json b/mobile/rpc-foundation/goldens/file-tap-opens-worktree-file.json
index 5231a7246ea..473c24d61e4 100644
--- a/mobile/rpc-foundation/goldens/file-tap-opens-worktree-file.json
+++ b/mobile/rpc-foundation/goldens/file-tap-opens-worktree-file.json
@@ -3,9 +3,9 @@
   "family": "files.terminal-path-tap",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e20a76ecd5e820dc4797fb25307810af68b5ced996dba2b9599464a21b5cbe1b",
   "scenarioSha256": "297ea4075333e178ca20247eb0abf6600efb44fe2b33f5142d1c1cabffb5a2d3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/file-tap-previews-absolute-artifact.json b/mobile/rpc-foundation/goldens/file-tap-previews-absolute-artifact.json
index 93703028b3e..be82eabac54 100644
--- a/mobile/rpc-foundation/goldens/file-tap-previews-absolute-artifact.json
+++ b/mobile/rpc-foundation/goldens/file-tap-previews-absolute-artifact.json
@@ -3,9 +3,9 @@
   "family": "files.terminal-path-tap",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e20a76ecd5e820dc4797fb25307810af68b5ced996dba2b9599464a21b5cbe1b",
   "scenarioSha256": "f1844c2608ce90250fddfc78c0b35bb1bf3647598a5ab2914eca0d8cb4403a38",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/file-tap-resolve-miss.json b/mobile/rpc-foundation/goldens/file-tap-resolve-miss.json
index f6e3a409248..893d9079f99 100644
--- a/mobile/rpc-foundation/goldens/file-tap-resolve-miss.json
+++ b/mobile/rpc-foundation/goldens/file-tap-resolve-miss.json
@@ -3,9 +3,9 @@
   "family": "files.terminal-path-tap",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e20a76ecd5e820dc4797fb25307810af68b5ced996dba2b9599464a21b5cbe1b",
   "scenarioSha256": "0f76b96408081737b3d630ee837dbb80bcce6670b6acc4f1f7c033a69bd40533",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/file-tap-resolve-refused.json b/mobile/rpc-foundation/goldens/file-tap-resolve-refused.json
index 883c92d9c41..8a3b9697513 100644
--- a/mobile/rpc-foundation/goldens/file-tap-resolve-refused.json
+++ b/mobile/rpc-foundation/goldens/file-tap-resolve-refused.json
@@ -3,9 +3,9 @@
   "family": "files.terminal-path-tap",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e20a76ecd5e820dc4797fb25307810af68b5ced996dba2b9599464a21b5cbe1b",
   "scenarioSha256": "1ada35966dfb65afbb9b3dc8139961b8f042e2d53241b9608a080d0e655a5987",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-explorer-legacy-fallback.json b/mobile/rpc-foundation/goldens/files-explorer-legacy-fallback.json
index 0462d22c879..464cff554f6 100644
--- a/mobile/rpc-foundation/goldens/files-explorer-legacy-fallback.json
+++ b/mobile/rpc-foundation/goldens/files-explorer-legacy-fallback.json
@@ -3,9 +3,9 @@
   "family": "files.explorer-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "7a42a348f4407b94cf75ac77a4b6b783b7d28103b1ae1d111d2708dab0dd4a0c",
   "scenarioSha256": "ec02d3f76085619fad35231e12654ec6e926e423c6799fd0df53708743000612",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-explorer-readdir.json b/mobile/rpc-foundation/goldens/files-explorer-readdir.json
index 53db822bf7e..7040c7fa941 100644
--- a/mobile/rpc-foundation/goldens/files-explorer-readdir.json
+++ b/mobile/rpc-foundation/goldens/files-explorer-readdir.json
@@ -3,9 +3,9 @@
   "family": "files.explorer-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "7a42a348f4407b94cf75ac77a4b6b783b7d28103b1ae1d111d2708dab0dd4a0c",
   "scenarioSha256": "0b87a230cf1c4219e415c840a088502c8bda7cd2fb525bde1a83a5903d6fd96b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-ownership-local.json b/mobile/rpc-foundation/goldens/files-ownership-local.json
index 7b35aa46289..b6d098c6847 100644
--- a/mobile/rpc-foundation/goldens/files-ownership-local.json
+++ b/mobile/rpc-foundation/goldens/files-ownership-local.json
@@ -3,9 +3,9 @@
   "family": "files.mutation-ownership",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "8d24f52eb4194c3bc5d9f0dcabade6d7a09c066f79f911657647ed21dbecb3b1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-ownership-ssh.json b/mobile/rpc-foundation/goldens/files-ownership-ssh.json
index ecc59c03404..840241b5dde 100644
--- a/mobile/rpc-foundation/goldens/files-ownership-ssh.json
+++ b/mobile/rpc-foundation/goldens/files-ownership-ssh.json
@@ -3,9 +3,9 @@
   "family": "files.mutation-ownership",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "4cd0be3a1c338b4b68211c717fd10738653c553fdb3b072db6706ff8175a8bd1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-preview-artifact-direct.json b/mobile/rpc-foundation/goldens/files-preview-artifact-direct.json
index 24ff06390c2..3e3cc06fa0b 100644
--- a/mobile/rpc-foundation/goldens/files-preview-artifact-direct.json
+++ b/mobile/rpc-foundation/goldens/files-preview-artifact-direct.json
@@ -3,9 +3,9 @@
   "family": "files.preview-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "dd8b7a0916a84c7d763a163759c02210ae99f8fbccfccaa98796b8610c5da97c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-preview-artifact-image-read.json b/mobile/rpc-foundation/goldens/files-preview-artifact-image-read.json
index fa5976b8921..41e0b8f264a 100644
--- a/mobile/rpc-foundation/goldens/files-preview-artifact-image-read.json
+++ b/mobile/rpc-foundation/goldens/files-preview-artifact-image-read.json
@@ -3,9 +3,9 @@
   "family": "files.preview-artifact-image",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "39fe4bce80a2323dbc276235daab48e7fe55d1fdb9c1ea1eeac7c17bceb8df18",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-preview-artifact-image.json b/mobile/rpc-foundation/goldens/files-preview-artifact-image.json
index 5c3fa542e60..5b32ba88fdb 100644
--- a/mobile/rpc-foundation/goldens/files-preview-artifact-image.json
+++ b/mobile/rpc-foundation/goldens/files-preview-artifact-image.json
@@ -3,9 +3,9 @@
   "family": "files.preview-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "d15c1f4e0f95b5c49a8f889d2d37458225293d7306c8439690d972d2df4c29c0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-preview-grant-refresh.json b/mobile/rpc-foundation/goldens/files-preview-grant-refresh.json
index 3369018db8b..9243972416b 100644
--- a/mobile/rpc-foundation/goldens/files-preview-grant-refresh.json
+++ b/mobile/rpc-foundation/goldens/files-preview-grant-refresh.json
@@ -3,9 +3,9 @@
   "family": "files.preview-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "055f3b45442c1736f10ee98c493e2ece1885fdb68d925ee627e2ba20853537e0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-preview-worktree-image-read.json b/mobile/rpc-foundation/goldens/files-preview-worktree-image-read.json
index 0c26e710113..4d93fe03bd2 100644
--- a/mobile/rpc-foundation/goldens/files-preview-worktree-image-read.json
+++ b/mobile/rpc-foundation/goldens/files-preview-worktree-image-read.json
@@ -3,9 +3,9 @@
   "family": "files.preview-worktree-image",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "767af05bb58756f4adc960b95ee6547cc28145c7f6c7c6a4b27582aed9741e37",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-preview-worktree-image.json b/mobile/rpc-foundation/goldens/files-preview-worktree-image.json
index f4d0a451a6b..cbb93ac956f 100644
--- a/mobile/rpc-foundation/goldens/files-preview-worktree-image.json
+++ b/mobile/rpc-foundation/goldens/files-preview-worktree-image.json
@@ -3,9 +3,9 @@
   "family": "files.preview-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "0ffaffb472b663e08a42317d799a2a000211dda5b127fb21cc64f04f73800130",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-preview-worktree-text-read.json b/mobile/rpc-foundation/goldens/files-preview-worktree-text-read.json
index 4fd15993011..39b7592599b 100644
--- a/mobile/rpc-foundation/goldens/files-preview-worktree-text-read.json
+++ b/mobile/rpc-foundation/goldens/files-preview-worktree-text-read.json
@@ -3,9 +3,9 @@
   "family": "files.preview-worktree-text",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "21c3c61a18939873157f74c8d2d28bceae01abc702565af1ca897ab7304cb93c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-preview-worktree.json b/mobile/rpc-foundation/goldens/files-preview-worktree.json
index 26ffcb76c16..a5aef0e3159 100644
--- a/mobile/rpc-foundation/goldens/files-preview-worktree.json
+++ b/mobile/rpc-foundation/goldens/files-preview-worktree.json
@@ -3,9 +3,9 @@
   "family": "files.preview-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "bcba4a7d9d929078c5ed80fc7e1acd45859d0b4c559767a919b0396dc6a70a3e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-save-blind.json b/mobile/rpc-foundation/goldens/files-save-blind.json
index 71cda2a96f8..aec1dd64c3f 100644
--- a/mobile/rpc-foundation/goldens/files-save-blind.json
+++ b/mobile/rpc-foundation/goldens/files-save-blind.json
@@ -3,9 +3,9 @@
   "family": "files.preview-save",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "8b5c3e87d989966d7b252f19a537040cd5078ba9355a824e7e49af3424390a3e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-save-verified.json b/mobile/rpc-foundation/goldens/files-save-verified.json
index dbfd8d5b492..46df37697f6 100644
--- a/mobile/rpc-foundation/goldens/files-save-verified.json
+++ b/mobile/rpc-foundation/goldens/files-save-verified.json
@@ -3,9 +3,9 @@
   "family": "files.preview-save",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "6e124d16173074d851d58593b20b25889ed13a3d8021c08fbed53b85a7d3196e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-tab-doc-shapes.json b/mobile/rpc-foundation/goldens/files-tab-doc-shapes.json
index 6db183589c5..27d51209f60 100644
--- a/mobile/rpc-foundation/goldens/files-tab-doc-shapes.json
+++ b/mobile/rpc-foundation/goldens/files-tab-doc-shapes.json
@@ -3,9 +3,9 @@
   "family": "files.tab-doc",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "b636221f719dae19a3af6772b687b0bcb300c9910645d23e98c309578ec1c5c5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/home-host-accounts.json b/mobile/rpc-foundation/goldens/home-host-accounts.json
index 942c306887f..1c08f1f2182 100644
--- a/mobile/rpc-foundation/goldens/home-host-accounts.json
+++ b/mobile/rpc-foundation/goldens/home-host-accounts.json
@@ -3,9 +3,9 @@
   "family": "home.host-accounts",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c632fdbc4b730777ecb09f08bec14cca0586042b01ed99d40d0228806c7def4a",
   "scenarioSha256": "366426641e25542fcc6fcd351ece6a1ee897c8b3974c08eb7557eadfa4d3b06f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/home-host-stats.json b/mobile/rpc-foundation/goldens/home-host-stats.json
index 78ab06c6496..3a054248c61 100644
--- a/mobile/rpc-foundation/goldens/home-host-stats.json
+++ b/mobile/rpc-foundation/goldens/home-host-stats.json
@@ -3,9 +3,9 @@
   "family": "home.host-stats",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a9e0780298a1443664e7ae02056168aa34d67556c9c056d51a82c7b4a73ad35b",
   "scenarioSha256": "bd5f4e5f24a29d96c4c98950691c6571918332f71ebb1f29ee97a9abc857ac29",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/host-view-settings-sync.json b/mobile/rpc-foundation/goldens/host-view-settings-sync.json
index d2334aab98a..816c089f1fb 100644
--- a/mobile/rpc-foundation/goldens/host-view-settings-sync.json
+++ b/mobile/rpc-foundation/goldens/host-view-settings-sync.json
@@ -3,9 +3,9 @@
   "family": "host.view-settings",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a9e0780298a1443664e7ae02056168aa34d67556c9c056d51a82c7b4a73ad35b",
   "scenarioSha256": "1ee6031227fa3efd5b36841afa60f7b2264eacdd9c6126e5851d5acb39ffaadd",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/host-worktree-actions-pin-open-delete.json b/mobile/rpc-foundation/goldens/host-worktree-actions-pin-open-delete.json
index a9848ecfcdf..0c0b68ccb85 100644
--- a/mobile/rpc-foundation/goldens/host-worktree-actions-pin-open-delete.json
+++ b/mobile/rpc-foundation/goldens/host-worktree-actions-pin-open-delete.json
@@ -3,9 +3,9 @@
   "family": "host.worktree-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "92c29bd78ca0c0d5917e9386fc447bb9a1698b1d1ffaba0db7546eaac60da639",
   "scenarioSha256": "720add498c79425ca8efc9764fd5d8307fe33bc891842604cfc899f770b79811",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/host-worktree-delete-refused.json b/mobile/rpc-foundation/goldens/host-worktree-delete-refused.json
index 6b5ee05d2eb..24b183a8c23 100644
--- a/mobile/rpc-foundation/goldens/host-worktree-delete-refused.json
+++ b/mobile/rpc-foundation/goldens/host-worktree-delete-refused.json
@@ -3,9 +3,9 @@
   "family": "host.worktree-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "92c29bd78ca0c0d5917e9386fc447bb9a1698b1d1ffaba0db7546eaac60da639",
   "scenarioSha256": "5dd5e7eabaabba1e471b13958f59891c3b28f553087c96315598c83a14ded7e7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/host-worktree-refresh-stream.json b/mobile/rpc-foundation/goldens/host-worktree-refresh-stream.json
index f612d38b6e1..14eb6648b9e 100644
--- a/mobile/rpc-foundation/goldens/host-worktree-refresh-stream.json
+++ b/mobile/rpc-foundation/goldens/host-worktree-refresh-stream.json
@@ -3,9 +3,9 @@
   "family": "host-worktree-refresh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "6ac11f1ab42fea3b718d9714e512a4e8a344aea66ae170fbe9ef2b5ae82dbe0a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/interruptions-inventory-lifecycle.json b/mobile/rpc-foundation/goldens/interruptions-inventory-lifecycle.json
index e3cbfee16c2..f81c6f006c1 100644
--- a/mobile/rpc-foundation/goldens/interruptions-inventory-lifecycle.json
+++ b/mobile/rpc-foundation/goldens/interruptions-inventory-lifecycle.json
@@ -3,9 +3,9 @@
   "family": "legacy-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "262eaad263a45aa13ec5b27c12b59946b12c202474229fff7a5727dba6d702ca",
   "scenarioSha256": "d6c57a5153d915f0a0c0fd9e305cac70b41b7eb8be226fc865227ebf1821e5d1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/interruptions-settings-bot-overrides-fulfilled.json b/mobile/rpc-foundation/goldens/interruptions-settings-bot-overrides-fulfilled.json
index 7179d41c404..75f4655c495 100644
--- a/mobile/rpc-foundation/goldens/interruptions-settings-bot-overrides-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/interruptions-settings-bot-overrides-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.bot-overrides",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "2d5c6dea28aa1a7bb9e4aa14a4c8441527d9ad401ad30161f05ea1f8da836bb2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/inventory-lifecycle.json b/mobile/rpc-foundation/goldens/inventory-lifecycle.json
index a18fec28bfe..9d91e04f7e1 100644
--- a/mobile/rpc-foundation/goldens/inventory-lifecycle.json
+++ b/mobile/rpc-foundation/goldens/inventory-lifecycle.json
@@ -3,9 +3,9 @@
   "family": "legacy-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "262eaad263a45aa13ec5b27c12b59946b12c202474229fff7a5727dba6d702ca",
   "scenarioSha256": "3471f5bcd6923c7b8ba3a737bb45b5239689deb78c00e85a828f38a6d6d68a05",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/inventory-repeat-query.json b/mobile/rpc-foundation/goldens/inventory-repeat-query.json
index 907cd72fdb6..bd59a443cd4 100644
--- a/mobile/rpc-foundation/goldens/inventory-repeat-query.json
+++ b/mobile/rpc-foundation/goldens/inventory-repeat-query.json
@@ -3,9 +3,9 @@
   "family": "legacy-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "262eaad263a45aa13ec5b27c12b59946b12c202474229fff7a5727dba6d702ca",
   "scenarioSha256": "73a468d5c7a51c2dbb7af2642f0050d05d861fce29295460c48d7c51f86bf57f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/lifecycle-b3.json b/mobile/rpc-foundation/goldens/lifecycle-b3.json
index 2b6a7cda34c..7e2360fe036 100644
--- a/mobile/rpc-foundation/goldens/lifecycle-b3.json
+++ b/mobile/rpc-foundation/goldens/lifecycle-b3.json
@@ -3,9 +3,9 @@
   "family": "linear-detail-barrier",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "8be12d116865d27e8dfd37921d2c723d63da101ec1197b1f5b2d9510838e1943",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/lifecycle-inventory-lifecycle.json b/mobile/rpc-foundation/goldens/lifecycle-inventory-lifecycle.json
index 139ced2e51d..f7336ccbbe7 100644
--- a/mobile/rpc-foundation/goldens/lifecycle-inventory-lifecycle.json
+++ b/mobile/rpc-foundation/goldens/lifecycle-inventory-lifecycle.json
@@ -3,9 +3,9 @@
   "family": "legacy-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "262eaad263a45aa13ec5b27c12b59946b12c202474229fff7a5727dba6d702ca",
   "scenarioSha256": "46bbafcc57fe2e3aee41a14bc26a0375b7b56e58030705fe4c28841a272b2560",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/lifecycle-settings-bot-overrides-fulfilled.json b/mobile/rpc-foundation/goldens/lifecycle-settings-bot-overrides-fulfilled.json
index 92d72070492..9790c96577d 100644
--- a/mobile/rpc-foundation/goldens/lifecycle-settings-bot-overrides-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/lifecycle-settings-bot-overrides-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.bot-overrides",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "eb80283956c93849778f23cbabf1dbf83b72744197af4f6f50335b2fc1590d87",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/lifecycle-settings-task-hydration-fulfilled.json b/mobile/rpc-foundation/goldens/lifecycle-settings-task-hydration-fulfilled.json
index d9e51abcd5d..30d5dcd810b 100644
--- a/mobile/rpc-foundation/goldens/lifecycle-settings-task-hydration-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/lifecycle-settings-task-hydration-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "3a8eab831602443d320ca0aa0f35dc269d8d511e76bdae8fd025c433561d068d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/lifecycle-settings-workspace-context-fulfilled.json b/mobile/rpc-foundation/goldens/lifecycle-settings-workspace-context-fulfilled.json
index b3d371f6d85..680f57a39d1 100644
--- a/mobile/rpc-foundation/goldens/lifecycle-settings-workspace-context-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/lifecycle-settings-workspace-context-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": ["new-workspace-runtime-context-null-results-degrade-to-absent"],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "136fb1d8d5925ad12ba22f4dd6c72573a9ad03b6a6ec8308668f0d9cd71aa36d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/linear-select-workspace.json b/mobile/rpc-foundation/goldens/linear-select-workspace.json
index 886eb37bac9..8b09a9eabaf 100644
--- a/mobile/rpc-foundation/goldens/linear-select-workspace.json
+++ b/mobile/rpc-foundation/goldens/linear-select-workspace.json
@@ -3,9 +3,9 @@
   "family": "linear.select-workspace-picker",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b65996c152b632d553a31e07e31ea5c76f998eada42cf0966923d730da21908f",
   "scenarioSha256": "b6eb40d9a91c89179483afec93fbc121b99ef679d3b2433575b26694d0c577d5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/live-worktree-name-stream.json b/mobile/rpc-foundation/goldens/live-worktree-name-stream.json
index 502ac2c4a1b..d447052e209 100644
--- a/mobile/rpc-foundation/goldens/live-worktree-name-stream.json
+++ b/mobile/rpc-foundation/goldens/live-worktree-name-stream.json
@@ -3,9 +3,9 @@
   "family": "live-worktree-name",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "056abf42b34537025fed30a4401bd465c93bc21558babb826f21b5c803b487eb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-agentsession.structured-create-agentsession.create-1.json b/mobile/rpc-foundation/goldens/matrix-agentsession.structured-create-agentsession.create-1.json
index 73031f5dd01..0b34b18281f 100644
--- a/mobile/rpc-foundation/goldens/matrix-agentsession.structured-create-agentsession.create-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-agentsession.structured-create-agentsession.create-1.json
@@ -3,9 +3,9 @@
   "family": "agentSession.structured-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d340697a64a198066b1037a550afb9a0de7507246a545901d2fc0a23407f38d6",
   "scenarioSha256": "81ed7c1a4276cf1d891334c64c06362b88b5f9690b3ebae6d0988559b1faab0f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-agentsession.structured-create-agentsession.createsupport-1.json b/mobile/rpc-foundation/goldens/matrix-agentsession.structured-create-agentsession.createsupport-1.json
index 009775fe97e..cd6023d27fc 100644
--- a/mobile/rpc-foundation/goldens/matrix-agentsession.structured-create-agentsession.createsupport-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-agentsession.structured-create-agentsession.createsupport-1.json
@@ -3,9 +3,9 @@
   "family": "agentSession.structured-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d340697a64a198066b1037a550afb9a0de7507246a545901d2fc0a23407f38d6",
   "scenarioSha256": "eed54b1c4c77eec4b411d8daa197b20c8cfb4b86ac2d01f1d7ee2de23c27dff8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-agentsession.structured-launch-agentsession.createsupport-1.json b/mobile/rpc-foundation/goldens/matrix-agentsession.structured-launch-agentsession.createsupport-1.json
index 5a83b362b7c..ec6debc9569 100644
--- a/mobile/rpc-foundation/goldens/matrix-agentsession.structured-launch-agentsession.createsupport-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-agentsession.structured-launch-agentsession.createsupport-1.json
@@ -3,9 +3,9 @@
   "family": "agentSession.structured-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d340697a64a198066b1037a550afb9a0de7507246a545901d2fc0a23407f38d6",
   "scenarioSha256": "211e3780edc0ff5fa0529c0de0e8bc2fd746a19c8a6b4e49900f6c4e56d53f7c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-aivault.history-aivault.listsessions-1.json b/mobile/rpc-foundation/goldens/matrix-aivault.history-aivault.listsessions-1.json
index 9b4367b2e44..59c2e88f2f7 100644
--- a/mobile/rpc-foundation/goldens/matrix-aivault.history-aivault.listsessions-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-aivault.history-aivault.listsessions-1.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "ec16931c5431d3dbb05729d4670c381a434bff71648d334b7b5224db188fdccb",
   "scenarioSha256": "efb8d1cd2a2ff0ade4cdc48a1aacec565e33b405bbe95c100b86534cdde49740",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-platform-status.json b/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-platform-status.json
index 4c3ff790ed3..db343c4d9ce 100644
--- a/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-platform-status.json
+++ b/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-platform-status.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c78ab47eea594b7e1988403321ff9ba135ca60c513bb9d5848bdde26c0ffe3c3",
   "scenarioSha256": "30e00c0d94413aab61b164fb9a658e526448addc4c42fd8892b1c28335d30beb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-status.get-2.json b/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-status.get-2.json
index 423658b85f2..3180b9e1026 100644
--- a/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-status.get-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-status.get-2.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c78ab47eea594b7e1988403321ff9ba135ca60c513bb9d5848bdde26c0ffe3c3",
   "scenarioSha256": "b146be741484f2a6dca25e97f52b9ed10f8a2b28bd00e6b56acffbcd82136b2f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-worktree.ps-1.json b/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-worktree.ps-1.json
index baa2b32cecd..eefffe47e3d 100644
--- a/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-worktree.ps-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-worktree.ps-1.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c78ab47eea594b7e1988403321ff9ba135ca60c513bb9d5848bdde26c0ffe3c3",
   "scenarioSha256": "5365449c24d789c6c01604b520b795502d0bec352032686efecd121fc4497f96",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-aivault.history-status.get-1.json b/mobile/rpc-foundation/goldens/matrix-aivault.history-status.get-1.json
index 5998c3a57c1..14074c72992 100644
--- a/mobile/rpc-foundation/goldens/matrix-aivault.history-status.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-aivault.history-status.get-1.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "ec16931c5431d3dbb05729d4670c381a434bff71648d334b7b5224db188fdccb",
   "scenarioSha256": "a5698ca720dad08561a509c9c18f7586611fc68c58bd86791f4fcefc7915ab1f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-aivault.resume-launch-session.tabs.createterminal-1.json b/mobile/rpc-foundation/goldens/matrix-aivault.resume-launch-session.tabs.createterminal-1.json
index d57df29f92a..f697dd75895 100644
--- a/mobile/rpc-foundation/goldens/matrix-aivault.resume-launch-session.tabs.createterminal-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-aivault.resume-launch-session.tabs.createterminal-1.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "f721ab4438c4183927ce5ebc5fd6f1f18414701a5fa3b2807c359785829962a3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-aivault.resume-launch-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-aivault.resume-launch-terminal.send-1.json
index 64d41c51404..9c324ada9ae 100644
--- a/mobile/rpc-foundation/goldens/matrix-aivault.resume-launch-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-aivault.resume-launch-terminal.send-1.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "aa812132ede83e4aced73a644e996df82a38bfc70ead70a5db2e9af8a8b1bfff",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-aivault.resume-preparation-aivault.preparesessionresume-1.json b/mobile/rpc-foundation/goldens/matrix-aivault.resume-preparation-aivault.preparesessionresume-1.json
index afa2a150835..74eb4fb9718 100644
--- a/mobile/rpc-foundation/goldens/matrix-aivault.resume-preparation-aivault.preparesessionresume-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-aivault.resume-preparation-aivault.preparesessionresume-1.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "c3b400967b0b1c7bd3f82a278f4b10855ade72d384922ec4d34795c7bb20084d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-browser.dialog-browser.dialogaccept-1.json b/mobile/rpc-foundation/goldens/matrix-browser.dialog-browser.dialogaccept-1.json
index 05b01229696..0a19dcd1c05 100644
--- a/mobile/rpc-foundation/goldens/matrix-browser.dialog-browser.dialogaccept-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-browser.dialog-browser.dialogaccept-1.json
@@ -3,9 +3,9 @@
   "family": "browser.dialog",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "9cae732e4227d4c2fe874a5fb2e104552c16cbc91b59523de8fd46454660cde8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-browser.keyboard-browser.keyboardinserttext-1.json b/mobile/rpc-foundation/goldens/matrix-browser.keyboard-browser.keyboardinserttext-1.json
index d0b3f2ae73b..311653ef59b 100644
--- a/mobile/rpc-foundation/goldens/matrix-browser.keyboard-browser.keyboardinserttext-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-browser.keyboard-browser.keyboardinserttext-1.json
@@ -3,9 +3,9 @@
   "family": "browser.keyboard",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "fc3411f3f4cb58b6a1338ea943f59446fda7819931814e9ab002e35e2de42462",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-browser.keyboard-browser.keypress-1.json b/mobile/rpc-foundation/goldens/matrix-browser.keyboard-browser.keypress-1.json
index 3cea35fa4c0..b65213291e4 100644
--- a/mobile/rpc-foundation/goldens/matrix-browser.keyboard-browser.keypress-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-browser.keyboard-browser.keypress-1.json
@@ -3,9 +3,9 @@
   "family": "browser.keyboard",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "c1df871e84d4399e9a447caaff244241933c0dfc7c3d5e114d022e54b0ed7ed4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mouseclick-1.json b/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mouseclick-1.json
index 48525de13b5..8d9815b87ad 100644
--- a/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mouseclick-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mouseclick-1.json
@@ -3,9 +3,9 @@
   "family": "browser.pointer-click",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "91a1ef5e07178585f583dd1609543c3bfb0c71d13eb4ce1eedab3acc2635f0da",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mousedown-1.json b/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mousedown-1.json
index 0a5e89c3437..6bf6cd5d772 100644
--- a/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mousedown-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mousedown-1.json
@@ -3,9 +3,9 @@
   "family": "browser.pointer-click",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "a302565f0172a763bfb0865389849703d3ceb52d848e1bc40f2204ce7f97bbef",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mousemove-1.json b/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mousemove-1.json
index 10fe98aa96d..cd961f9dbad 100644
--- a/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mousemove-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mousemove-1.json
@@ -3,9 +3,9 @@
   "family": "browser.pointer-click",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "33cb8faa9c8b50945a2d8275140c65f483b8023c890a5a16165a759f0a59baad",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mouseup-1.json b/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mouseup-1.json
index d6758e269a0..c387f92f51c 100644
--- a/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mouseup-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mouseup-1.json
@@ -3,9 +3,9 @@
   "family": "browser.pointer-click",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "96c4862084d7ba2a8e07047abcee1716220ba35d9c754bcb97f7227020976c95",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-browser.wheel-browser.mousemove-1.json b/mobile/rpc-foundation/goldens/matrix-browser.wheel-browser.mousemove-1.json
index d02f6288d5d..f3226c9c524 100644
--- a/mobile/rpc-foundation/goldens/matrix-browser.wheel-browser.mousemove-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-browser.wheel-browser.mousemove-1.json
@@ -3,9 +3,9 @@
   "family": "browser.wheel",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "c1283bbfb340e968bbd4c86ac63489995d6191290751316228d27779dc6a2c55",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-browser.wheel-browser.mousewheel-1.json b/mobile/rpc-foundation/goldens/matrix-browser.wheel-browser.mousewheel-1.json
index d8a99346330..feb0d90bc69 100644
--- a/mobile/rpc-foundation/goldens/matrix-browser.wheel-browser.mousewheel-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-browser.wheel-browser.mousewheel-1.json
@@ -3,9 +3,9 @@
   "family": "browser.wheel",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "092777c9ce457dcae95eafbe083c70510580569ac74e31c0d4224ac94b9fad76",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-clipboard.image-attachment-clipboard.startimageupload-1.json b/mobile/rpc-foundation/goldens/matrix-clipboard.image-attachment-clipboard.startimageupload-1.json
index 4dd41c688e3..b1dba1e3e20 100644
--- a/mobile/rpc-foundation/goldens/matrix-clipboard.image-attachment-clipboard.startimageupload-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-clipboard.image-attachment-clipboard.startimageupload-1.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-attachment",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "fc690a2ac59a6fbcdc08f9b91e769cd793f5a48d9034a50c2d587ce0d0fca3d9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-clipboard.image-upload-clipboard.saveimageastempfile-1.json b/mobile/rpc-foundation/goldens/matrix-clipboard.image-upload-clipboard.saveimageastempfile-1.json
index 2eebac11745..eb2e87c054b 100644
--- a/mobile/rpc-foundation/goldens/matrix-clipboard.image-upload-clipboard.saveimageastempfile-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-clipboard.image-upload-clipboard.saveimageastempfile-1.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "fa69748b6d0e29abc37757b48bcb22dac07af1686554200ceaf18b4e3d62e4ac",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-clipboard.image-upload-clipboard.startimageupload-1.json b/mobile/rpc-foundation/goldens/matrix-clipboard.image-upload-clipboard.startimageupload-1.json
index 5048dba4657..7bfa35d6bf7 100644
--- a/mobile/rpc-foundation/goldens/matrix-clipboard.image-upload-clipboard.startimageupload-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-clipboard.image-upload-clipboard.startimageupload-1.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "a4bea606723da4d4a86db6e04c46266801149a852a8861b15e637d5c0855c679",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-components.codex-reset-capability-status.get-1.json b/mobile/rpc-foundation/goldens/matrix-components.codex-reset-capability-status.get-1.json
index 07943a101e8..94982eae7a4 100644
--- a/mobile/rpc-foundation/goldens/matrix-components.codex-reset-capability-status.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-components.codex-reset-capability-status.get-1.json
@@ -3,9 +3,9 @@
   "family": "components.codex-reset-capability",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "06c2ad6d4b464f889a640be7a238f6d0ff7c54b0e93fb5ea22aaa856dadb0336",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-components.codex-reset-credit-accounts.consumecodexresetcredit-1.json b/mobile/rpc-foundation/goldens/matrix-components.codex-reset-credit-accounts.consumecodexresetcredit-1.json
index bd3e2652406..3ce59a3eed1 100644
--- a/mobile/rpc-foundation/goldens/matrix-components.codex-reset-credit-accounts.consumecodexresetcredit-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-components.codex-reset-credit-accounts.consumecodexresetcredit-1.json
@@ -3,9 +3,9 @@
   "family": "components.codex-reset-credit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "76b53dea504a688493843e23e8e7d052fc196f559bb1e2579d0fd38bf3156d0e",
   "scenarioSha256": "cc6de73be00be072f9a3b7fd63459fd1a529c45d0916a67d5fe6d90dbee61e91",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-components.execution-target-local-preflight.detectagents-1.json b/mobile/rpc-foundation/goldens/matrix-components.execution-target-local-preflight.detectagents-1.json
index 186e3027367..35d31d5944e 100644
--- a/mobile/rpc-foundation/goldens/matrix-components.execution-target-local-preflight.detectagents-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-components.execution-target-local-preflight.detectagents-1.json
@@ -3,9 +3,9 @@
   "family": "components.execution-target-local",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "f88ee2f5d19b19cc53dca5180a9b5936a13a00a82e8a4636a5e895262b669dec",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-components.execution-target-preflight.detectremoteagents-1.json b/mobile/rpc-foundation/goldens/matrix-components.execution-target-preflight.detectremoteagents-1.json
index de6ecc4e25a..d0d574c24d0 100644
--- a/mobile/rpc-foundation/goldens/matrix-components.execution-target-preflight.detectremoteagents-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-components.execution-target-preflight.detectremoteagents-1.json
@@ -3,9 +3,9 @@
   "family": "components.execution-target",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "79a49cddf66935007afb9be8a30593b778f02237894e5fd4d2898b526fc125df",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-components.execution-target-ssh.connect-1.json b/mobile/rpc-foundation/goldens/matrix-components.execution-target-ssh.connect-1.json
index 25db7be9c01..00b2627d372 100644
--- a/mobile/rpc-foundation/goldens/matrix-components.execution-target-ssh.connect-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-components.execution-target-ssh.connect-1.json
@@ -3,9 +3,9 @@
   "family": "components.execution-target",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "8b8f7fe7227d44330e216e0bf5d366c41b54d9bf76acfb24df2c1770984b9f27",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-components.execution-target-ssh.getstate-1.json b/mobile/rpc-foundation/goldens/matrix-components.execution-target-ssh.getstate-1.json
index 2af11764bcb..aa799d98bab 100644
--- a/mobile/rpc-foundation/goldens/matrix-components.execution-target-ssh.getstate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-components.execution-target-ssh.getstate-1.json
@@ -3,9 +3,9 @@
   "family": "components.execution-target",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "6832d23c6500e4fcb20abe7c53bc4f5abe72180dc0ad747a4907b82d99bc75d0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-components.new-workspace-repositories-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-components.new-workspace-repositories-repo.list-1.json
index c2ba49c4741..1755641e3b9 100644
--- a/mobile/rpc-foundation/goldens/matrix-components.new-workspace-repositories-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-components.new-workspace-repositories-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "components.new-workspace-repositories",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "64c1772f0f95a3c43fbb14398a8804b2b4784f7f18874e4fd79767ae634c7faa",
   "scenarioSha256": "95f7dbb11bca7203d29bd13230d4a286f49ff20596535163094e1bff73e7f3cb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-components.setup-script-repo.hooks-1.json b/mobile/rpc-foundation/goldens/matrix-components.setup-script-repo.hooks-1.json
index e3604e4cc26..7baed039405 100644
--- a/mobile/rpc-foundation/goldens/matrix-components.setup-script-repo.hooks-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-components.setup-script-repo.hooks-1.json
@@ -3,9 +3,9 @@
   "family": "components.setup-script",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "a844134d7bad3c7c12107d60dbd298f5cfba778703fb9dd0f7ad454615d26b07",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.explorer-screen-files.list-1.json b/mobile/rpc-foundation/goldens/matrix-files.explorer-screen-files.list-1.json
index 2091a0a312c..ea8be7a73a9 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.explorer-screen-files.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.explorer-screen-files.list-1.json
@@ -3,9 +3,9 @@
   "family": "files.explorer-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "7a42a348f4407b94cf75ac77a4b6b783b7d28103b1ae1d111d2708dab0dd4a0c",
   "scenarioSha256": "38b5590173c1f6791d1b35c0f036e2f844ed4b0e39c880e8e376c5f314adaade",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.explorer-screen-files.readdir-1.json b/mobile/rpc-foundation/goldens/matrix-files.explorer-screen-files.readdir-1.json
index 050b93b4dca..3688b256d50 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.explorer-screen-files.readdir-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.explorer-screen-files.readdir-1.json
@@ -3,9 +3,9 @@
   "family": "files.explorer-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "7a42a348f4407b94cf75ac77a4b6b783b7d28103b1ae1d111d2708dab0dd4a0c",
   "scenarioSha256": "8c1fa604104c5551b8418af225c9420b1292f0c55b392f847985947c66749959",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-ssh.getstate-1.json b/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-ssh.getstate-1.json
index 236eaf0ef85..1c8fa472391 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-ssh.getstate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-ssh.getstate-1.json
@@ -3,9 +3,9 @@
   "family": "files.mutation-ownership",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "5815450e8d07f463423ca0bd8237830791c220234201abffc6fa13e698913516",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-status.get-1.json b/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-status.get-1.json
index 3c60f097813..17086fa447b 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-status.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-status.get-1.json
@@ -3,9 +3,9 @@
   "family": "files.mutation-ownership",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "b9cfb187224a4b42efe8ccfcd96145833730d135c4fffa345716f95991a4700f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-worktree.show-1.json b/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-worktree.show-1.json
index 48fe28826e6..56076e0f4ad 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-worktree.show-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-worktree.show-1.json
@@ -3,9 +3,9 @@
   "family": "files.mutation-ownership",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "0bf3b17048bceb0bc8592405facd99cb8086274509206d9e55cd589a05d7415f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.preview-artifact-image-files.readterminalartifactpreview-1.json b/mobile/rpc-foundation/goldens/matrix-files.preview-artifact-image-files.readterminalartifactpreview-1.json
index 5ba9435f08d..50d61015efa 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.preview-artifact-image-files.readterminalartifactpreview-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.preview-artifact-image-files.readterminalartifactpreview-1.json
@@ -3,9 +3,9 @@
   "family": "files.preview-artifact-image",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "83cad9595793b30d38115ba7118ae1400ecb2af21327853183e91289f4f33a04",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.readterminalartifact-1.json b/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.readterminalartifact-1.json
index 0a5a1ef37c3..c543b73ed00 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.readterminalartifact-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.readterminalartifact-1.json
@@ -3,9 +3,9 @@
   "family": "files.preview-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "dbd20e271999641affbd4b52635c8864e25f08aa6db820a46d0773faa09770c6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.readterminalartifact-2.json b/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.readterminalartifact-2.json
index 81d9933d56d..626b040575f 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.readterminalartifact-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.readterminalartifact-2.json
@@ -3,9 +3,9 @@
   "family": "files.preview-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "c4a09003352ba4e97a17ec4109cc125298cf7123b317265cc5eca06e8dcc0615",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.resolveterminalpath-1.json b/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.resolveterminalpath-1.json
index ad5ac88cb82..8a0a083467f 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.resolveterminalpath-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.resolveterminalpath-1.json
@@ -3,9 +3,9 @@
   "family": "files.preview-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "ecdeff2713e454925158dde09782713d76f39455729bb25688a6ffcfff154f30",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.preview-save-files.readterminalartifact-1.json b/mobile/rpc-foundation/goldens/matrix-files.preview-save-files.readterminalartifact-1.json
index 28f4c23ddee..cbbb9d47328 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.preview-save-files.readterminalartifact-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.preview-save-files.readterminalartifact-1.json
@@ -3,9 +3,9 @@
   "family": "files.preview-save",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "1a4f7dff351be244712bedb8f495c83a531cfbfc5b5923267d1ed46bf2d6d11b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.preview-save-files.writeterminalartifact-1.json b/mobile/rpc-foundation/goldens/matrix-files.preview-save-files.writeterminalartifact-1.json
index 9597b5eead5..27823082639 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.preview-save-files.writeterminalartifact-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.preview-save-files.writeterminalartifact-1.json
@@ -3,9 +3,9 @@
   "family": "files.preview-save",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "8d443bda91fe5a1fa74910d525bb2ec40f639109bc71afbd42bccd949b3d463f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.preview-worktree-image-files.readpreview-1.json b/mobile/rpc-foundation/goldens/matrix-files.preview-worktree-image-files.readpreview-1.json
index a07d836a00f..47645772e58 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.preview-worktree-image-files.readpreview-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.preview-worktree-image-files.readpreview-1.json
@@ -3,9 +3,9 @@
   "family": "files.preview-worktree-image",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "0962cb776492001a60db2ca89d715faec94c648962f140077fc9a85355784d81",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.preview-worktree-text-files.read-1.json b/mobile/rpc-foundation/goldens/matrix-files.preview-worktree-text-files.read-1.json
index 9506c514c2c..de2963177be 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.preview-worktree-text-files.read-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.preview-worktree-text-files.read-1.json
@@ -3,9 +3,9 @@
   "family": "files.preview-worktree-text",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "08d73805619f00748caa5726a7fb0d9b9c561f93ec1e6dd28b27065a4515d65d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.tab-doc-files.read-1.json b/mobile/rpc-foundation/goldens/matrix-files.tab-doc-files.read-1.json
index 4ae8b32ef00..b5e6cfc91ad 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.tab-doc-files.read-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.tab-doc-files.read-1.json
@@ -3,9 +3,9 @@
   "family": "files.tab-doc",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "65895c028637185238baf4fd4f1297c11f528a289fe8173a41c48dc5a0b37c26",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.tab-doc-files.readpreview-1.json b/mobile/rpc-foundation/goldens/matrix-files.tab-doc-files.readpreview-1.json
index 9ca4c270bf9..22689159042 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.tab-doc-files.readpreview-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.tab-doc-files.readpreview-1.json
@@ -3,9 +3,9 @@
   "family": "files.tab-doc",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "2ceca0ecd901fd78838fcbdc789cbb6b96f04674b850a0994c7611f5db804915",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.tab-doc-git.diff-1.json b/mobile/rpc-foundation/goldens/matrix-files.tab-doc-git.diff-1.json
index 6fdaef5a892..799c9705dac 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.tab-doc-git.diff-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.tab-doc-git.diff-1.json
@@ -3,9 +3,9 @@
   "family": "files.tab-doc",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "c4db2424b8a35fd97b3fea00b4dd91a3c8d50c6fb73795811ef5402e3d14f8df",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.terminal-path-tap-files.open-1.json b/mobile/rpc-foundation/goldens/matrix-files.terminal-path-tap-files.open-1.json
index af209a3b05e..cbbfba9084e 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.terminal-path-tap-files.open-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.terminal-path-tap-files.open-1.json
@@ -3,9 +3,9 @@
   "family": "files.terminal-path-tap",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e20a76ecd5e820dc4797fb25307810af68b5ced996dba2b9599464a21b5cbe1b",
   "scenarioSha256": "73dbbb8b96662af57240194be4af5726697d402b624a807d003ab56fea04dbd7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.terminal-path-tap-files.resolveterminalpath-1.json b/mobile/rpc-foundation/goldens/matrix-files.terminal-path-tap-files.resolveterminalpath-1.json
index d6f3deff671..88c7ee4a5d9 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.terminal-path-tap-files.resolveterminalpath-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.terminal-path-tap-files.resolveterminalpath-1.json
@@ -3,9 +3,9 @@
   "family": "files.terminal-path-tap",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e20a76ecd5e820dc4797fb25307810af68b5ced996dba2b9599464a21b5cbe1b",
   "scenarioSha256": "ba8728e890e0e9c10ea163bd16f4f99fbc9727cd2f9c4ed69c56436d8bc29f89",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-repo.baserefdefault-1.json b/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-repo.baserefdefault-1.json
index 6bdf64feb60..8faa8e04ff0 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-repo.baserefdefault-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-repo.baserefdefault-1.json
@@ -3,9 +3,9 @@
   "family": "git.base-ref-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "5605a2984d7692aa80e5e38f804bdfed4b1ce8ac2102def5dc728b1a79dc1acf",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-repo.list-1.json
index 06f4065bb06..7f74fb4aec2 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "git.base-ref-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "ed0e97ead1aad0b45bdfc48f5fe4e498810d0cfee88f07d3c6228db56fda1dd9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-worktree.show-1.json b/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-worktree.show-1.json
index 217f4f21ce9..3a6f2595dc2 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-worktree.show-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-worktree.show-1.json
@@ -3,9 +3,9 @@
   "family": "git.base-ref-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "1db6919b94df3b8548838ff4c206fafa3a09ea096b17c04483f78f9321ccb1ba",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.branch-diff-preview-git.branchdiff-1.json b/mobile/rpc-foundation/goldens/matrix-git.branch-diff-preview-git.branchdiff-1.json
index 24f97963c0a..52f9ffb990d 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.branch-diff-preview-git.branchdiff-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.branch-diff-preview-git.branchdiff-1.json
@@ -3,9 +3,9 @@
   "family": "git.branch-diff-preview",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "42879d7300691a80aa0d09a2aeb5f8cb9438fc72b0ac7f24b0bbae4309f3a2ca",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.changes-load-git.branchcompare-1.json b/mobile/rpc-foundation/goldens/matrix-git.changes-load-git.branchcompare-1.json
index 75b015bc54c..33a04446c22 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.changes-load-git.branchcompare-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.changes-load-git.branchcompare-1.json
@@ -3,9 +3,9 @@
   "family": "git.changes-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "afdfde4c58b6ff2047ea1b2f18b955074c0ae23850d4ac8783e69c0724096eab",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.changes-load-git.status-1.json b/mobile/rpc-foundation/goldens/matrix-git.changes-load-git.status-1.json
index 374e2c01635..873590e1738 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.changes-load-git.status-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.changes-load-git.status-1.json
@@ -3,9 +3,9 @@
   "family": "git.changes-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "a428557212fd35e84506b671c2b254d7ce5cab486dada61fc9b5e5357f76df2c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.changes-load-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-git.changes-load-repo.list-1.json
index f21d898895b..d0861a416f7 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.changes-load-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.changes-load-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "git.changes-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "901b8f44a090b5871b3edc20be72c4f407889b4830fcb00be0e99c8c96274cc5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.changes-load-worktree.show-1.json b/mobile/rpc-foundation/goldens/matrix-git.changes-load-worktree.show-1.json
index ca5ff6797a9..759960d29be 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.changes-load-worktree.show-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.changes-load-worktree.show-1.json
@@ -3,9 +3,9 @@
   "family": "git.changes-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "d40c9235948cb1cd85bec5451ce0f4183074e0a12a35834d8c911c35e99a6599",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.commit-message-ai-git.generatecommitmessage-1.json b/mobile/rpc-foundation/goldens/matrix-git.commit-message-ai-git.generatecommitmessage-1.json
index 92f4380c0a4..cc0915b5da1 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.commit-message-ai-git.generatecommitmessage-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.commit-message-ai-git.generatecommitmessage-1.json
@@ -3,9 +3,9 @@
   "family": "git.commit-message-ai",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "22ea5279155ecf749aaab521ffd570221ac3169b177fc1daf85ef93a49d38260",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.history-commit-files-git.commitcompare-1.json b/mobile/rpc-foundation/goldens/matrix-git.history-commit-files-git.commitcompare-1.json
index 361c5e4e31b..22154cba8db 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.history-commit-files-git.commitcompare-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.history-commit-files-git.commitcompare-1.json
@@ -3,9 +3,9 @@
   "family": "git.history-commit-files",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "fc12c33acd3f3a34cbdb5893204be009bb089e2383a715fea4151c912de11ab0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.history-commit-files-git.history-1.json b/mobile/rpc-foundation/goldens/matrix-git.history-commit-files-git.history-1.json
index 284ef288b49..41ea7ef88c9 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.history-commit-files-git.history-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.history-commit-files-git.history-1.json
@@ -3,9 +3,9 @@
   "family": "git.history-commit-files",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "52610bb18381d371e479a5bef4a160814547baa355104059949b1c35b87342bc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.history-read-git.history-1.json b/mobile/rpc-foundation/goldens/matrix-git.history-read-git.history-1.json
index e4655f8ca1b..f7b434f07f2 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.history-read-git.history-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.history-read-git.history-1.json
@@ -3,9 +3,9 @@
   "family": "git.history-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "86254ed87ad3427d6ee4631d7348075039ba2d4d7496d59f27f03f78580f35a1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.remote-prerequisite-git.push-1.json b/mobile/rpc-foundation/goldens/matrix-git.remote-prerequisite-git.push-1.json
index 254f951a6d3..09a61fdf6a9 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.remote-prerequisite-git.push-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.remote-prerequisite-git.push-1.json
@@ -3,9 +3,9 @@
   "family": "git.remote-prerequisite",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "5009c22df7e74a850bcea41fc110ea7d7eb4bdada623837279f32eaa5149a9b8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.review-preparation-git.status-1.json b/mobile/rpc-foundation/goldens/matrix-git.review-preparation-git.status-1.json
index 0d3995b3dda..42583f373eb 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.review-preparation-git.status-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.review-preparation-git.status-1.json
@@ -3,9 +3,9 @@
   "family": "git.review-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "485b2751006ee8fb4df28b228ea7adda85779feae83974eb0f7e795e31c500a1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.addissuecomment-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.addissuecomment-1.json
index bdda6ce56ce..62c66a3f290 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.addissuecomment-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.addissuecomment-1.json
@@ -3,10 +3,10 @@
   "family": "github.pr-comment-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "0c8f09683408a919dd3ac2b7cd12197d8745882627134cde95ecee209575b027",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.addprreviewcommentreply-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.addprreviewcommentreply-1.json
index 1f4b3c6e4e0..b73165eec51 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.addprreviewcommentreply-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.addprreviewcommentreply-1.json
@@ -3,10 +3,10 @@
   "family": "github.pr-comment-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "4f2b61df5e59d2efe81d467214a78132654035cbcb4d929385410b53f735c9fe",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.project.deleteissuecommentbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.project.deleteissuecommentbyslug-1.json
index af5a3d2c948..fbf6ad42dab 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.project.deleteissuecommentbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.project.deleteissuecommentbyslug-1.json
@@ -3,10 +3,10 @@
   "family": "github.pr-comment-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "04b2052cce6f24d9e208c992f204355639409ddc9793b3044b394c0e38d3c284",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.project.updateissuecommentbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.project.updateissuecommentbyslug-1.json
index 54c7a6a0f60..779447db68f 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.project.updateissuecommentbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.project.updateissuecommentbyslug-1.json
@@ -3,10 +3,10 @@
   "family": "github.pr-comment-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "8f849437158296753a84a75dfdbaf69852bcdb6cdc6e8205496961ec16e4be21",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.resolvereviewthread-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.resolvereviewthread-1.json
index c1de0f3172d..7c273405b9a 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.resolvereviewthread-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.resolvereviewthread-1.json
@@ -3,10 +3,10 @@
   "family": "github.pr-comment-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "77eba7deff3f15e64795cdcbefd009abfcf2379e7293eefb1f154ca1e99f4d5d",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.mergepr-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.mergepr-1.json
index 961dc02ad3b..60da5e69d90 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.mergepr-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.mergepr-1.json
@@ -3,10 +3,10 @@
   "family": "github.pr-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "2235d05e0d2c6f1a9518cfdd76870e303cccd35289d6a44334147b6a5b6b675e",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.removeprreviewers-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.removeprreviewers-1.json
index 6ecc112b389..9ed23a32fa5 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.removeprreviewers-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.removeprreviewers-1.json
@@ -3,10 +3,10 @@
   "family": "github.pr-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "2cea87c339b35daf62c963092c01c6379db43f2ee4ca5cb2b5f817975b0caf65",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.requestprreviewers-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.requestprreviewers-1.json
index eb252678995..9283542be66 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.requestprreviewers-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.requestprreviewers-1.json
@@ -3,10 +3,10 @@
   "family": "github.pr-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "78de11de556c91782590725819b22821732a12d3769f493d165c80bc7fcc1f53",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.rerunprchecks-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.rerunprchecks-1.json
index a72a18bc738..e6c7867f661 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.rerunprchecks-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.rerunprchecks-1.json
@@ -3,10 +3,10 @@
   "family": "github.pr-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "ac7e91b4d35021eca63af8ce01f9a2c7959109e4cb824009881437cb94dbfe82",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.setprautomerge-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.setprautomerge-1.json
index 335963320e7..2006a95f750 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.setprautomerge-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.setprautomerge-1.json
@@ -3,10 +3,10 @@
   "family": "github.pr-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "a85682e5009d634bf468b8dbe4f35a957988754ed9c2b07d57ad475c1590d1f6",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.updateprstate-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.updateprstate-1.json
index 72ecaeeee17..a0861716158 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.updateprstate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.updateprstate-1.json
@@ -3,10 +3,10 @@
   "family": "github.pr-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "30f321fcbfaf09505bc6e18e64c09ca49c0dcdb7c5e12c4e27c2429b3e1066ca",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.listassignableusers-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.listassignableusers-1.json
index ebed5e5df4b..b19cc59b3cb 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.listassignableusers-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.listassignableusers-1.json
@@ -3,10 +3,10 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "507743a5925a37be32156b3d8df83ddb8e08c262d2c2f44bbd117dee4672bbc5",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prcheckdetails-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prcheckdetails-1.json
index 040a47db6ff..d380df581fa 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prcheckdetails-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prcheckdetails-1.json
@@ -3,10 +3,10 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "6efca320cf31a1de988110004a9fb7b67fdad279a789e046ad6b5141b66e5bf1",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prchecks-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prchecks-1.json
index 6019a53f188..72dcdfb78e5 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prchecks-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prchecks-1.json
@@ -3,10 +3,10 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "c77d7c7a05ecb9b27180ef28ca63a28e1c1ca42db2bb54a468699da77281ae35",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prforbranch-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prforbranch-1.json
index c0ee2cf8e5b..44c1903490d 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prforbranch-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prforbranch-1.json
@@ -3,10 +3,10 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "3b3d3032b992fc7461b13de8a42512affa12fb018ad583898179a9934c13b414",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.reposlug-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.reposlug-1.json
index aef2a7c741c..6019ffcda0d 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.reposlug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.reposlug-1.json
@@ -3,10 +3,10 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "4ebe865f874b0b4a813860ec7356b8dc214ea02f0a9036cb003efe863d89b83e",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.workitemdetails-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.workitemdetails-1.json
index 1a26b6cc659..0ae89de8d33 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.workitemdetails-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.workitemdetails-1.json
@@ -3,10 +3,10 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "bc3350efc030f824fc21046aea8c6dc9a46993b6c75613c66874fde59af9171a",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-read-hostedreview.forbranch-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-read-hostedreview.forbranch-1.json
index 77e47a1d316..5f9ef8cf2df 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-read-hostedreview.forbranch-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-read-hostedreview.forbranch-1.json
@@ -3,10 +3,10 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "9171e982babc4e56852fe35bafa7a9f3aeda2be5bd4648f29aaa04ca7119d5d2",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-title-mutation-github.updateprtitle-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-title-mutation-github.updateprtitle-1.json
index 67a72fabf0e..47c31a74fa8 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-title-mutation-github.updateprtitle-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-title-mutation-github.updateprtitle-1.json
@@ -3,10 +3,10 @@
   "family": "github.pr-title-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "fe91d5518501a078dff3010e74c4b9d70122f88a629e384336cd1b6a84de36a8",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-home.host-accounts-accounts.list-1.json b/mobile/rpc-foundation/goldens/matrix-home.host-accounts-accounts.list-1.json
index cfc9689d64b..23f85ce5135 100644
--- a/mobile/rpc-foundation/goldens/matrix-home.host-accounts-accounts.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-home.host-accounts-accounts.list-1.json
@@ -3,9 +3,9 @@
   "family": "home.host-accounts",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c632fdbc4b730777ecb09f08bec14cca0586042b01ed99d40d0228806c7def4a",
   "scenarioSha256": "047e4c8fb2c4b374406658ec3954ac00fda96928bdd999a33ab9867284ffb4a4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-home.host-stats-stats.summary-1.json b/mobile/rpc-foundation/goldens/matrix-home.host-stats-stats.summary-1.json
index 48cb9d756fa..78f4ff8637c 100644
--- a/mobile/rpc-foundation/goldens/matrix-home.host-stats-stats.summary-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-home.host-stats-stats.summary-1.json
@@ -3,9 +3,9 @@
   "family": "home.host-stats",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a9e0780298a1443664e7ae02056168aa34d67556c9c056d51a82c7b4a73ad35b",
   "scenarioSha256": "5518e08c1b20f0ddd4cb6bc81ff9af032b1a38daf24f3d3497bac5df8b2d0ec5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-1.json b/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-1.json
index ec9703dd536..a42ea1618e3 100644
--- a/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-1.json
@@ -3,9 +3,9 @@
   "family": "host-worktree-refresh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "0604294e541a4b2c73e0501cfc393c84384342ffcae286211a657ca5bc5892b7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-2.json b/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-2.json
index 1b0188dfc55..2c23bc27af3 100644
--- a/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-2.json
@@ -3,9 +3,9 @@
   "family": "host-worktree-refresh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "6d03d17a5711db33473611858b225e2ac42fe33d2a982fbb0defdbd1dce037d6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-3.json b/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-3.json
index 181fa7bb08e..a8d7a2996a5 100644
--- a/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-3.json
+++ b/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-3.json
@@ -3,9 +3,9 @@
   "family": "host-worktree-refresh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "f36f11b3d69397bd98651fdad4614a4115098e23667e4dfc397c1d9ff2dc3186",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-2-1.json b/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-2-1.json
index 34a3ba0f71f..f0a64292b4b 100644
--- a/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-2-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-2-1.json
@@ -3,9 +3,9 @@
   "family": "host-worktree-refresh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "a70fa323de86b706f05818f321095349ed55b265804ec0ebb54419314a3ca612",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-host.view-settings-ui.get-1.json b/mobile/rpc-foundation/goldens/matrix-host.view-settings-ui.get-1.json
index 1c08cf3e620..1106cb86c86 100644
--- a/mobile/rpc-foundation/goldens/matrix-host.view-settings-ui.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-host.view-settings-ui.get-1.json
@@ -3,9 +3,9 @@
   "family": "host.view-settings",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a9e0780298a1443664e7ae02056168aa34d67556c9c056d51a82c7b4a73ad35b",
   "scenarioSha256": "a9a3191e2e8c36870ce2769a7bb972813f435267fdc6ed9e42632a57a227bbd6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-host.view-settings-ui.set-1.json b/mobile/rpc-foundation/goldens/matrix-host.view-settings-ui.set-1.json
index 062c6b5c55f..550f6ab0692 100644
--- a/mobile/rpc-foundation/goldens/matrix-host.view-settings-ui.set-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-host.view-settings-ui.set-1.json
@@ -3,9 +3,9 @@
   "family": "host.view-settings",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a9e0780298a1443664e7ae02056168aa34d67556c9c056d51a82c7b4a73ad35b",
   "scenarioSha256": "30cbeff90a845ab5dd576e302156e859338357b608e87e9fadeddf18ae93d9ca",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.activate-1.json b/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.activate-1.json
index 24dd08ddd0f..66fbd0c1581 100644
--- a/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.activate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.activate-1.json
@@ -3,9 +3,9 @@
   "family": "host.worktree-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "92c29bd78ca0c0d5917e9386fc447bb9a1698b1d1ffaba0db7546eaac60da639",
   "scenarioSha256": "7e842584620018d5ec5560711d63a472302e8da80cfe65dfcd2952aebb509af2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.rm-1.json b/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.rm-1.json
index 53c0d93f126..e02ca63bc03 100644
--- a/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.rm-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.rm-1.json
@@ -3,9 +3,9 @@
   "family": "host.worktree-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "92c29bd78ca0c0d5917e9386fc447bb9a1698b1d1ffaba0db7546eaac60da639",
   "scenarioSha256": "c47656a4ca21762e4b5a247ddf9a96efb746bec81e942ffa308a774bab1449e2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.set-1.json b/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.set-1.json
index ff4adf398e7..4806487e491 100644
--- a/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.set-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.set-1.json
@@ -3,9 +3,9 @@
   "family": "host.worktree-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "92c29bd78ca0c0d5917e9386fc447bb9a1698b1d1ffaba0db7546eaac60da639",
   "scenarioSha256": "054f1b1380fc6cfd4b0f4a85d6f143822a12a0a732d550dd85eef64a6556b3ba",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-git.push-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-git.push-1.json
index f0f3fafdf06..c7a337c7ff8 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-git.push-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-git.push-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "fcf5cdc7388457156dd81fe28a470f42fbabac7435ec5572cb19e209f410ca84",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-hostedreview.create-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-hostedreview.create-1.json
index 8d1c9e2f1eb..084ae0eb3c4 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-hostedreview.create-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-hostedreview.create-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "26e666a57805f354602a5b3906a691b10c8d6db66c77acc96c67153279c515a7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-worktree.set-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-worktree.set-1.json
index c04911e023c..d7a851d1961 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-worktree.set-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-worktree.set-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "08c25b6cb5bc12a7f67e858f229d15cf66b98b2ad4601b11f18c4c03f4a59669",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.bulkstage-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.bulkstage-1.json
index 872f7e4d6bf..92830817434 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.bulkstage-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.bulkstage-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "ff9d1bfd6337607f3d3e8162692b589ecea4a32ae01b5ebb3c602f8f0a55642c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.commit-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.commit-1.json
index 2300437d364..afa2a75f531 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.commit-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.commit-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "efeb9b248aeb98fac71c043d50afe0036cf804d3c11edfccd4e050fe8f3d8f9b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.generatecommitmessage-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.generatecommitmessage-1.json
index b22d017e1d7..bd2cbd157d2 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.generatecommitmessage-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.generatecommitmessage-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "7b0d9ddcb8df83fc4e465aa6b0dcf05aa0d8f266cd4bb8651969cb8321bcf549",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.push-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.push-1.json
index 88504ddf876..3cc12abc095 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.push-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.push-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "72c1f08739db1c0dfcd48adffaca582a3596116c1c377f95f7dab8b08b7e6cdc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-1.json
index f3f6f31dee4..42b37f5e84b 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "1f002f900c1a3c92e8f7c72261579ee5015ec1529c003a1b32bcf3eaf98b672d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-2.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-2.json
index 1179fd3b074..ef0f8c712b2 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-2.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "3a6487a07457e0e5aa6fc3fccfa43687acfb06d94334e621081728de937e4e8d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-3.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-3.json
index 3b812fd1187..b7b2a671250 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-3.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-3.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "7355c45a707fa8a31f0999c4805a5b1dace4c65b727e711231f784b2f92c05ff",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-4.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-4.json
index 5f187e633e8..a8ce25f9bbd 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-4.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-4.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "45cda6757b76399d282d4b07992dab21bbb8236faadedba5e92eab8818e886bf",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.create-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.create-1.json
index 3284b030fbe..3759154b4e1 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.create-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.create-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "0ca08d5e70e1780a6ee5c919491dcddb062a22623f803e9960a329825f274cbe",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.getcreationeligibility-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.getcreationeligibility-1.json
index 906c4b1190f..0e40268acb0 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.getcreationeligibility-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.getcreationeligibility-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "658eb7bbf63b3a4b38eca0b1733e523962b6b6943644d65aab6f5c7e62534d6a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.getcreationeligibility-2.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.getcreationeligibility-2.json
index a247a558705..c675b06fa8e 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.getcreationeligibility-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.getcreationeligibility-2.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "75ba135731290bf734a5eef0b65f9ad8b7cac453c4e2006faac88a5da9dbe3a3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-worktree.set-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-worktree.set-1.json
index e9b028c19e3..538870af29d 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-worktree.set-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-worktree.set-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "beb1161b98ffde8c5f1128e843766a1da3182d195f1f0a9012e12e5318ae01bc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.eligibility-hostedreview.getcreationeligibility-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.eligibility-hostedreview.getcreationeligibility-1.json
index 7285a669b09..1df91fdaa27 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.eligibility-hostedreview.getcreationeligibility-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.eligibility-hostedreview.getcreationeligibility-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.eligibility",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "6c4de90e2617d204e82ca5e65eb17fc397acbcbb9dc0ec18594d2a7739e3528b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-legacy-inventory-files.searchpaths-1.json b/mobile/rpc-foundation/goldens/matrix-legacy-inventory-files.searchpaths-1.json
index fd61f743bc9..6a139b31c7f 100644
--- a/mobile/rpc-foundation/goldens/matrix-legacy-inventory-files.searchpaths-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-legacy-inventory-files.searchpaths-1.json
@@ -3,9 +3,9 @@
   "family": "legacy-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "262eaad263a45aa13ec5b27c12b59946b12c202474229fff7a5727dba6d702ca",
   "scenarioSha256": "4f6472fb7add960be9bcc8596a748264d7cb0755a782ebe9e85753ab1d1d5710",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-legacy-inventory-files.searchpaths-2.json b/mobile/rpc-foundation/goldens/matrix-legacy-inventory-files.searchpaths-2.json
index f048b02b6a0..130466a562e 100644
--- a/mobile/rpc-foundation/goldens/matrix-legacy-inventory-files.searchpaths-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-legacy-inventory-files.searchpaths-2.json
@@ -3,9 +3,9 @@
   "family": "legacy-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "262eaad263a45aa13ec5b27c12b59946b12c202474229fff7a5727dba6d702ca",
   "scenarioSha256": "048c3ec55ec67d09d9b02e17822f1154adca577e57ffe6d3059102d552d2f759",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-legacy-inventory-fresh-inventory.json b/mobile/rpc-foundation/goldens/matrix-legacy-inventory-fresh-inventory.json
index 060d918cc4d..5fdba91f369 100644
--- a/mobile/rpc-foundation/goldens/matrix-legacy-inventory-fresh-inventory.json
+++ b/mobile/rpc-foundation/goldens/matrix-legacy-inventory-fresh-inventory.json
@@ -3,9 +3,9 @@
   "family": "legacy-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "262eaad263a45aa13ec5b27c12b59946b12c202474229fff7a5727dba6d702ca",
   "scenarioSha256": "ad458a3407e3f1303343b46a1308b43535abef2c9ed2f68db59157db5b91daa1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-legacy-inventory-old-inventory.json b/mobile/rpc-foundation/goldens/matrix-legacy-inventory-old-inventory.json
index 663ba7f7f4b..ba5af956cf7 100644
--- a/mobile/rpc-foundation/goldens/matrix-legacy-inventory-old-inventory.json
+++ b/mobile/rpc-foundation/goldens/matrix-legacy-inventory-old-inventory.json
@@ -3,9 +3,9 @@
   "family": "legacy-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "262eaad263a45aa13ec5b27c12b59946b12c202474229fff7a5727dba6d702ca",
   "scenarioSha256": "52742d894d0ea53db89729101664a393b10794d9c2d2fe7b40b020643a13af81",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-linear-detail-barrier-linear.getissue-1.json b/mobile/rpc-foundation/goldens/matrix-linear-detail-barrier-linear.getissue-1.json
index 7b0fa011e02..2390e34ff61 100644
--- a/mobile/rpc-foundation/goldens/matrix-linear-detail-barrier-linear.getissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-linear-detail-barrier-linear.getissue-1.json
@@ -3,9 +3,9 @@
   "family": "linear-detail-barrier",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "8e00afc85e5b82d75bedecea0c748a3c8658cfc8545650e755c03f51fdc932d6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-linear-detail-barrier-linear.issuecomments-1.json b/mobile/rpc-foundation/goldens/matrix-linear-detail-barrier-linear.issuecomments-1.json
index 2e45536dd41..e2d88cab2b4 100644
--- a/mobile/rpc-foundation/goldens/matrix-linear-detail-barrier-linear.issuecomments-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-linear-detail-barrier-linear.issuecomments-1.json
@@ -3,9 +3,9 @@
   "family": "linear-detail-barrier",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "40289acce4a3542773f74681d255d67cfddadf6c42317928d6728f26a76f6cfb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-linear.select-workspace-picker-linear.selectworkspace-1.json b/mobile/rpc-foundation/goldens/matrix-linear.select-workspace-picker-linear.selectworkspace-1.json
index 372c4294e6e..a8f96e8e2a4 100644
--- a/mobile/rpc-foundation/goldens/matrix-linear.select-workspace-picker-linear.selectworkspace-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-linear.select-workspace-picker-linear.selectworkspace-1.json
@@ -3,9 +3,9 @@
   "family": "linear.select-workspace-picker",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b65996c152b632d553a31e07e31ea5c76f998eada42cf0966923d730da21908f",
   "scenarioSha256": "c7de1f6fc0895d4ddf1b87a83859da46c583f098e058f14c8f85d48120c80c40",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-1-1.json b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-1-1.json
index 6a1fd700f8a..3b25254189d 100644
--- a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-1-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-1-1.json
@@ -3,9 +3,9 @@
   "family": "live-worktree-name",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "f3fa2738875e15b640f21e56d3a0628333cd5b271242314b9c328822eec01d34",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-1-2.json b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-1-2.json
index 1041ff86a6b..134c9d20b6a 100644
--- a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-1-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-1-2.json
@@ -3,9 +3,9 @@
   "family": "live-worktree-name",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "24b9ef7c06386b8af8303cfb196d2f652e46759b40aadb7b6af5144c964ea179",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-2-1.json b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-2-1.json
index a4870e79533..468860649ba 100644
--- a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-2-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-2-1.json
@@ -3,9 +3,9 @@
   "family": "live-worktree-name",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "e13633e6b76dce4aec343c391359adfd39430e91af1b183140fe4423316c81e1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-1.json b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-1.json
index da10803c37c..7d24ee905bf 100644
--- a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-1.json
@@ -3,9 +3,9 @@
   "family": "live-worktree-name",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "0bbbff1a914ba146777515d6d971144cc62f29f2d484a264513a1ce0f48be96a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-2.json b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-2.json
index 0b94fa8a20e..4a7246dd8ad 100644
--- a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-2.json
@@ -3,9 +3,9 @@
   "family": "live-worktree-name",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "2ed321bfdc419635734c37b0a1cc4f85d6d92766846e25a37bd547dfa3af8f72",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-3.json b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-3.json
index 90d594ed204..cb3cf6a0c88 100644
--- a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-3.json
+++ b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-3.json
@@ -3,9 +3,9 @@
   "family": "live-worktree-name",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "ab7efe1dc6ef2ddfffa69c88bcc936f43393968a2281bc0ebfc864be650e7af1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-app-js.json b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-app-js.json
index bcb135c61a2..691c7fd9641 100644
--- a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-app-js.json
+++ b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-app-js.json
@@ -3,9 +3,9 @@
   "family": "mobileWeb.bundle-fetch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "af339fef2c684d5709c6d3f279e5f0d9c33d17b6d4e5c89e501963400901b564",
   "scenarioSha256": "9de83f3ad2d85d1304a6ff00046b128a97318b3d859c78aa9acde73d9419aabe",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-index-head.json b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-index-head.json
index 6a224d2fef9..7c317bd0d3e 100644
--- a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-index-head.json
+++ b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-index-head.json
@@ -3,9 +3,9 @@
   "family": "mobileWeb.bundle-fetch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "af339fef2c684d5709c6d3f279e5f0d9c33d17b6d4e5c89e501963400901b564",
   "scenarioSha256": "b15dbbc7f1d9ecc6918c9b9aec395fca93108e39f6b02c82f559dc060383a03b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-index-tail.json b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-index-tail.json
index 5a5564ddaae..1f340020c13 100644
--- a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-index-tail.json
+++ b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-index-tail.json
@@ -3,9 +3,9 @@
   "family": "mobileWeb.bundle-fetch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "af339fef2c684d5709c6d3f279e5f0d9c33d17b6d4e5c89e501963400901b564",
   "scenarioSha256": "89539ae4d46c4fd7d93f06e464da91ebfb6da6abad4eda03f67c3bf727c8731f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-mobileweb.bundle.manifest-1.json b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-mobileweb.bundle.manifest-1.json
index 8f4fd84b77d..68be45d8e12 100644
--- a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-mobileweb.bundle.manifest-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-mobileweb.bundle.manifest-1.json
@@ -3,9 +3,9 @@
   "family": "mobileWeb.bundle-fetch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "af339fef2c684d5709c6d3f279e5f0d9c33d17b6d4e5c89e501963400901b564",
   "scenarioSha256": "f453e5e35d31bb2f1638ae68d97db16a0955375d3863e124e2aa57f7d1fa292c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-manifest-mobileweb.bundle.manifest-1.json b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-manifest-mobileweb.bundle.manifest-1.json
index 64a880a192a..2050d842189 100644
--- a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-manifest-mobileweb.bundle.manifest-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-manifest-mobileweb.bundle.manifest-1.json
@@ -3,9 +3,9 @@
   "family": "mobileWeb.bundle-manifest",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "af339fef2c684d5709c6d3f279e5f0d9c33d17b6d4e5c89e501963400901b564",
   "scenarioSha256": "8f5211fd3de1d77d3ea139f22bd6fc6119c72c08aa016f252a0df14bedf23ab3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-nativechat.image-paste-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-nativechat.image-paste-terminal.send-1.json
index ebf4d10988d..dbc904960f4 100644
--- a/mobile/rpc-foundation/goldens/matrix-nativechat.image-paste-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-nativechat.image-paste-terminal.send-1.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "165402f60bc723edb2a867f09573fdae11a7c2ee4ef2be891916cfeb8aab21a0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-nativechat.image-paste-terminal.send-2.json b/mobile/rpc-foundation/goldens/matrix-nativechat.image-paste-terminal.send-2.json
index 0023445a1ca..832893f802b 100644
--- a/mobile/rpc-foundation/goldens/matrix-nativechat.image-paste-terminal.send-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-nativechat.image-paste-terminal.send-2.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "443fb50425d5cdbf0b289c6c051732090f165abba9b1ba4c39b712a459c612c9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-nativechat.image-upload-clipboard.startimageupload-1.json b/mobile/rpc-foundation/goldens/matrix-nativechat.image-upload-clipboard.startimageupload-1.json
index 65b66e3ce3c..ad3cce3dba0 100644
--- a/mobile/rpc-foundation/goldens/matrix-nativechat.image-upload-clipboard.startimageupload-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-nativechat.image-upload-clipboard.startimageupload-1.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "0478b692709ef0fe3cd75bf0d47fc27fcbb50ebc779e231537ba36638a0125f8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-nativechat.session-option-pick-settings.mutatenativechatsessionoptions-1.json b/mobile/rpc-foundation/goldens/matrix-nativechat.session-option-pick-settings.mutatenativechatsessionoptions-1.json
index e113278f2cb..943930c3689 100644
--- a/mobile/rpc-foundation/goldens/matrix-nativechat.session-option-pick-settings.mutatenativechatsessionoptions-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-nativechat.session-option-pick-settings.mutatenativechatsessionoptions-1.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.session-option-pick",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "1305f50c6e838d89d0a9e65d9011d2a532a2f75f7b3aea73f9e33330214f5724",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-nativechat.terminal-write-orchestration.workerterminaluserinput-1.json b/mobile/rpc-foundation/goldens/matrix-nativechat.terminal-write-orchestration.workerterminaluserinput-1.json
index ecbd24c2627..54883c53712 100644
--- a/mobile/rpc-foundation/goldens/matrix-nativechat.terminal-write-orchestration.workerterminaluserinput-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-nativechat.terminal-write-orchestration.workerterminaluserinput-1.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.terminal-write",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "860d3a80815ec68dc3fe2891a69888b80ec60fa205940e31f14643fb1097ead5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-nativechat.terminal-write-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-nativechat.terminal-write-terminal.send-1.json
index 282d6c938af..adbebc68d8c 100644
--- a/mobile/rpc-foundation/goldens/matrix-nativechat.terminal-write-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-nativechat.terminal-write-terminal.send-1.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.terminal-write",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "c4193d972250dbe72907dcd32b8300b22986edfa5eeb651268c3838835177c64",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.getmissedsince-1.json b/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.getmissedsince-1.json
index 00387216397..61d73af5f29 100644
--- a/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.getmissedsince-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.getmissedsince-1.json
@@ -3,11 +3,11 @@
   "family": "notifications.desktop-stream",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f0b64994ed7d98c0479488e37df23cc997468e1be9b1466a9da91ac1a6260b43",
-  "scenarioSha256": "2e5aebadffe5146ac782e01160e0f1351732eadcf19bf24fede940d30dc4d3d4",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "eacf859143588ae6bee2804975d642b6c1088d57ae77ffe298620250d9a9f0e4",
+  "scenarioSha256": "e13d3072f9a0ff4458ec4231013d29f7131144b52089914cd08914652a2e136b",
   "platform": "darwin",
   "scenarioVersion": 1,
   "projectionVersion": 2,
@@ -201,16 +201,6 @@
         }
       }
     },
-    "2637263140a2": {
-      "name": "notifications.unsubscribe#1",
-      "ordinal": 8,
-      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.unsubscribe\",\"params\":{\"subscriptionId\":\"sub-1\"}}"
-    },
-    "2920ec417a8b": {
-      "name": "notifications.unsubscribe#1",
-      "ordinal": 6,
-      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.unsubscribe\",\"params\":{\"subscriptionId\":\"sub-1\"}}"
-    },
     "3375d09a55cf": {
       "name": "notifications.getMissedSince#1",
       "ordinal": 2,
@@ -255,6 +245,40 @@
         }
       }
     },
+    "4510854e3d64": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 6,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": {
+            "unsubscribed": true
+          }
+        }
+      }
+    },
     "45aca32cac62": {
       "name": "notification-tray.dismiss",
       "ordinal": 7,
@@ -270,6 +294,11 @@
         "value": "[{\"key\":\"[\\\"Yw3NKWbEM2aRElRI\\\",\\\"epoch-1\\\",\\\"note-2\\\"]\",\"seq\":8,\"expiresAt\":1767312000000}]"
       }
     },
+    "4c376c5d53ac": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 9,
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.unsubscribe\",\"params\":{\"subscriptionId\":\"sub-1\"}}"
+    },
     "5359579cc62d": {
       "running": true
     },
@@ -311,6 +340,32 @@
         "startedAt": 0
       }
     },
+    "6efd92e320ef": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 6,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "pending",
+        "startedAt": 0
+      }
+    },
     "780db26d7a92": {
       "name": "device-store.setItem",
       "ordinal": 4,
@@ -366,9 +421,74 @@
         }
       }
     },
+    "96f940529e7e": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "pending",
+        "startedAt": 0
+      }
+    },
+    "97d75ba51dcd": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": {
+            "unsubscribed": true
+          }
+        }
+      }
+    },
     "a0b2bcfcde77": {
       "running": false
     },
+    "ab0e4b79457f": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 7,
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.unsubscribe\",\"params\":{\"subscriptionId\":\"sub-1\"}}"
+    },
     "bd0b7e80a522": {
       "name": "notifications.getMissedSince#1",
       "ordinal": 2,
@@ -697,8 +817,8 @@
       {
         "id": "notifications-desktop-stream.normal:unsubscribing",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2637263140a2"],
+          "sender": ["18a100fb6bae", "96f940529e7e"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -710,8 +830,8 @@
       {
         "id": "notifications-desktop-stream.normal:stopped",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2637263140a2"],
+          "sender": ["18a100fb6bae", "97d75ba51dcd"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -747,8 +867,8 @@
       {
         "id": "notifications-desktop-stream.result-absent:unsubscribing",
         "observation": {
-          "sender": ["02230dcfa6da"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["02230dcfa6da", "6efd92e320ef"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -760,8 +880,8 @@
       {
         "id": "notifications-desktop-stream.result-absent:stopped",
         "observation": {
-          "sender": ["02230dcfa6da"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["02230dcfa6da", "4510854e3d64"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -797,8 +917,8 @@
       {
         "id": "notifications-desktop-stream.result-null:unsubscribing",
         "observation": {
-          "sender": ["d59a014964bb"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["d59a014964bb", "6efd92e320ef"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -810,8 +930,8 @@
       {
         "id": "notifications-desktop-stream.result-null:stopped",
         "observation": {
-          "sender": ["d59a014964bb"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["d59a014964bb", "4510854e3d64"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -847,8 +967,8 @@
       {
         "id": "notifications-desktop-stream.inner-ok-missing:unsubscribing",
         "observation": {
-          "sender": ["1bd7c7788c02"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["1bd7c7788c02", "6efd92e320ef"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -860,8 +980,8 @@
       {
         "id": "notifications-desktop-stream.inner-ok-missing:stopped",
         "observation": {
-          "sender": ["1bd7c7788c02"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["1bd7c7788c02", "4510854e3d64"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -897,8 +1017,8 @@
       {
         "id": "notifications-desktop-stream.inner-false-string-error:unsubscribing",
         "observation": {
-          "sender": ["db9ab7020419"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["db9ab7020419", "6efd92e320ef"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -910,8 +1030,8 @@
       {
         "id": "notifications-desktop-stream.inner-false-string-error:stopped",
         "observation": {
-          "sender": ["db9ab7020419"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["db9ab7020419", "4510854e3d64"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -947,8 +1067,8 @@
       {
         "id": "notifications-desktop-stream.inner-false-object-error:unsubscribing",
         "observation": {
-          "sender": ["d82b5b38d83a"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["d82b5b38d83a", "6efd92e320ef"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -960,8 +1080,8 @@
       {
         "id": "notifications-desktop-stream.inner-false-object-error:stopped",
         "observation": {
-          "sender": ["d82b5b38d83a"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["d82b5b38d83a", "4510854e3d64"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -997,8 +1117,8 @@
       {
         "id": "notifications-desktop-stream.outer-refused:unsubscribing",
         "observation": {
-          "sender": ["bd0b7e80a522"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["bd0b7e80a522", "6efd92e320ef"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -1010,8 +1130,8 @@
       {
         "id": "notifications-desktop-stream.outer-refused:stopped",
         "observation": {
-          "sender": ["bd0b7e80a522"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["bd0b7e80a522", "4510854e3d64"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -1047,8 +1167,8 @@
       {
         "id": "notifications-desktop-stream.outer-refused-no-message:unsubscribing",
         "observation": {
-          "sender": ["96a4611eaddf"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["96a4611eaddf", "6efd92e320ef"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -1060,8 +1180,8 @@
       {
         "id": "notifications-desktop-stream.outer-refused-no-message:stopped",
         "observation": {
-          "sender": ["96a4611eaddf"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["96a4611eaddf", "4510854e3d64"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -1097,8 +1217,8 @@
       {
         "id": "notifications-desktop-stream.method-not-found:unsubscribing",
         "observation": {
-          "sender": ["04c682993381"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["04c682993381", "6efd92e320ef"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -1110,8 +1230,8 @@
       {
         "id": "notifications-desktop-stream.method-not-found:stopped",
         "observation": {
-          "sender": ["04c682993381"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["04c682993381", "4510854e3d64"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -1147,8 +1267,8 @@
       {
         "id": "notifications-desktop-stream.transport-rejection:unsubscribing",
         "observation": {
-          "sender": ["e0765719f8a1"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["e0765719f8a1", "6efd92e320ef"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -1160,8 +1280,8 @@
       {
         "id": "notifications-desktop-stream.transport-rejection:stopped",
         "observation": {
-          "sender": ["e0765719f8a1"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["e0765719f8a1", "4510854e3d64"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -1197,8 +1317,8 @@
       {
         "id": "notifications-desktop-stream.transport-rejection-no-message:unsubscribing",
         "observation": {
-          "sender": ["3375d09a55cf"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["3375d09a55cf", "6efd92e320ef"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -1210,8 +1330,8 @@
       {
         "id": "notifications-desktop-stream.transport-rejection-no-message:stopped",
         "observation": {
-          "sender": ["3375d09a55cf"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["3375d09a55cf", "4510854e3d64"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
diff --git a/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.subscribe-1-1.json b/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.subscribe-1-1.json
index fda029fa87c..0469a376f8a 100644
--- a/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.subscribe-1-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.subscribe-1-1.json
@@ -3,11 +3,11 @@
   "family": "notifications.desktop-stream",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f0b64994ed7d98c0479488e37df23cc997468e1be9b1466a9da91ac1a6260b43",
-  "scenarioSha256": "49c798dc85bfd8468fc741059cfa4277938290b01b117e387f970e5788e5bbb8",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "eacf859143588ae6bee2804975d642b6c1088d57ae77ffe298620250d9a9f0e4",
+  "scenarioSha256": "aca5a21c0928ca5e84aac346f543a6840691c92b124c845cd01e3f2de553ea3d",
   "platform": "darwin",
   "scenarioVersion": 1,
   "projectionVersion": 2,
@@ -77,22 +77,6 @@
         "frame": "notifications.subscribe#1"
       }
     },
-    "2637263140a2": {
-      "name": "notifications.unsubscribe#1",
-      "ordinal": 8,
-      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.unsubscribe\",\"params\":{\"subscriptionId\":\"sub-1\"}}"
-    },
-    "2d36a975fe26": {
-      "name": "streams-registered-at-teardown",
-      "ordinal": 4,
-      "value": [
-        {
-          "cancelled": true,
-          "method": "notifications.subscribe",
-          "payload": "notifications.subscribe#1"
-        }
-      ]
-    },
     "43a1a92c1eef": {
       "name": "device-store.setItem",
       "ordinal": 3,
@@ -116,6 +100,11 @@
         "value": "[{\"key\":\"[\\\"Yw3NKWbEM2aRElRI\\\",\\\"epoch-1\\\",\\\"note-2\\\"]\",\"seq\":8,\"expiresAt\":1767312000000}]"
       }
     },
+    "4c376c5d53ac": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 9,
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.unsubscribe\",\"params\":{\"subscriptionId\":\"sub-1\"}}"
+    },
     "5359579cc62d": {
       "running": true
     },
@@ -157,17 +146,6 @@
         "startedAt": 0
       }
     },
-    "75b571e0e5f9": {
-      "name": "streams-registered-at-teardown",
-      "ordinal": 5,
-      "value": [
-        {
-          "cancelled": true,
-          "method": "notifications.subscribe",
-          "payload": "notifications.subscribe#1"
-        }
-      ]
-    },
     "806522730ba0": {
       "name": "device-store.setItem",
       "ordinal": 2,
@@ -176,6 +154,66 @@
         "value": "[{\"key\":\"[\\\"Yw3NKWbEM2aRElRI\\\",\\\"epoch-1\\\",\\\"note-2\\\"]\",\"seq\":8,\"expiresAt\":1767312000000}]"
       }
     },
+    "96f940529e7e": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "pending",
+        "startedAt": 0
+      }
+    },
+    "97d75ba51dcd": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": {
+            "unsubscribed": true
+          }
+        }
+      }
+    },
     "a0b2bcfcde77": {
       "running": false
     },
@@ -218,17 +256,6 @@
         "$rpc": "undefined"
       }
     },
-    "eceafa6140cb": {
-      "name": "streams-registered-at-teardown",
-      "ordinal": 2,
-      "value": [
-        {
-          "cancelled": true,
-          "method": "notifications.subscribe",
-          "payload": "notifications.subscribe#1"
-        }
-      ]
-    },
     "f552b5040ec7": {
       "name": "notifications.subscribe#1",
       "ordinal": 1,
@@ -265,18 +292,6 @@
           "effects": []
         }
       },
-      {
-        "id": "notifications-desktop-stream.prelude:cleanup",
-        "observation": {
-          "sender": [],
-          "payloads": ["f552b5040ec7"],
-          "settlements": {
-            "start": "eb79a9b3682a"
-          },
-          "state": "5359579cc62d",
-          "effects": ["eceafa6140cb"]
-        }
-      },
       {
         "id": "notifications-desktop-stream.normal:ready",
         "observation": {
@@ -316,8 +331,8 @@
       {
         "id": "notifications-desktop-stream.normal:unsubscribing",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2637263140a2"],
+          "sender": ["18a100fb6bae", "96f940529e7e"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -329,8 +344,8 @@
       {
         "id": "notifications-desktop-stream.normal:stopped",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2637263140a2"],
+          "sender": ["18a100fb6bae", "97d75ba51dcd"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -401,19 +416,6 @@
           "effects": ["1a0189471376", "43a1a92c1eef", "c0f34fb4c2f6"]
         }
       },
-      {
-        "id": "notifications-desktop-stream.result-absent:cleanup",
-        "observation": {
-          "sender": [],
-          "payloads": ["f552b5040ec7"],
-          "settlements": {
-            "start": "eb79a9b3682a",
-            "stop": "eb79a9b3682a"
-          },
-          "state": "a0b2bcfcde77",
-          "effects": ["1a0189471376", "43a1a92c1eef", "c0f34fb4c2f6", "75b571e0e5f9"]
-        }
-      },
       {
         "id": "notifications-desktop-stream.result-null:ready",
         "observation": {
@@ -476,19 +478,6 @@
           "effects": ["e2464612dc94", "43a1a92c1eef", "c0f34fb4c2f6"]
         }
       },
-      {
-        "id": "notifications-desktop-stream.result-null:cleanup",
-        "observation": {
-          "sender": [],
-          "payloads": ["f552b5040ec7"],
-          "settlements": {
-            "start": "eb79a9b3682a",
-            "stop": "eb79a9b3682a"
-          },
-          "state": "a0b2bcfcde77",
-          "effects": ["e2464612dc94", "43a1a92c1eef", "c0f34fb4c2f6", "75b571e0e5f9"]
-        }
-      },
       {
         "id": "notifications-desktop-stream.inner-ok-missing:ready",
         "observation": {
@@ -551,19 +540,6 @@
           "effects": ["806522730ba0", "ac63e18df12c"]
         }
       },
-      {
-        "id": "notifications-desktop-stream.inner-ok-missing:cleanup",
-        "observation": {
-          "sender": [],
-          "payloads": ["f552b5040ec7"],
-          "settlements": {
-            "start": "eb79a9b3682a",
-            "stop": "eb79a9b3682a"
-          },
-          "state": "a0b2bcfcde77",
-          "effects": ["806522730ba0", "ac63e18df12c", "2d36a975fe26"]
-        }
-      },
       {
         "id": "notifications-desktop-stream.inner-false-string-error:ready",
         "observation": {
@@ -626,19 +602,6 @@
           "effects": ["806522730ba0", "ac63e18df12c"]
         }
       },
-      {
-        "id": "notifications-desktop-stream.inner-false-string-error:cleanup",
-        "observation": {
-          "sender": [],
-          "payloads": ["f552b5040ec7"],
-          "settlements": {
-            "start": "eb79a9b3682a",
-            "stop": "eb79a9b3682a"
-          },
-          "state": "a0b2bcfcde77",
-          "effects": ["806522730ba0", "ac63e18df12c", "2d36a975fe26"]
-        }
-      },
       {
         "id": "notifications-desktop-stream.inner-false-object-error:ready",
         "observation": {
@@ -701,19 +664,6 @@
           "effects": ["806522730ba0", "ac63e18df12c"]
         }
       },
-      {
-        "id": "notifications-desktop-stream.inner-false-object-error:cleanup",
-        "observation": {
-          "sender": [],
-          "payloads": ["f552b5040ec7"],
-          "settlements": {
-            "start": "eb79a9b3682a",
-            "stop": "eb79a9b3682a"
-          },
-          "state": "a0b2bcfcde77",
-          "effects": ["806522730ba0", "ac63e18df12c", "2d36a975fe26"]
-        }
-      },
       {
         "id": "notifications-desktop-stream.outer-refused:ready",
         "observation": {
diff --git a/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.subscribe-1-2.json b/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.subscribe-1-2.json
index 01cadd347a6..5b664656b9a 100644
--- a/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.subscribe-1-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.subscribe-1-2.json
@@ -3,11 +3,11 @@
   "family": "notifications.desktop-stream",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f0b64994ed7d98c0479488e37df23cc997468e1be9b1466a9da91ac1a6260b43",
-  "scenarioSha256": "432f28b3adce4b3eff757fdb1c3ee163c8f86d878e84142da95d2bfdd5e1776e",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "eacf859143588ae6bee2804975d642b6c1088d57ae77ffe298620250d9a9f0e4",
+  "scenarioSha256": "53c8aa2ecfc045a50180dc707e353e22eef8511c0815ebacd3bda8cfb69d65c0",
   "platform": "darwin",
   "scenarioVersion": 1,
   "projectionVersion": 2,
@@ -82,10 +82,65 @@
       "ordinal": 8,
       "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.unsubscribe\",\"params\":{\"subscriptionId\":\"sub-1\"}}"
     },
-    "2920ec417a8b": {
+    "41b12aedee99": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "pending",
+        "startedAt": 0
+      }
+    },
+    "4510854e3d64": {
       "name": "notifications.unsubscribe#1",
       "ordinal": 6,
-      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.unsubscribe\",\"params\":{\"subscriptionId\":\"sub-1\"}}"
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": {
+            "unsubscribed": true
+          }
+        }
+      }
     },
     "45aca32cac62": {
       "name": "notification-tray.dismiss",
@@ -102,6 +157,11 @@
         "value": "[{\"key\":\"[\\\"Yw3NKWbEM2aRElRI\\\",\\\"epoch-1\\\",\\\"note-2\\\"]\",\"seq\":8,\"expiresAt\":1767312000000}]"
       }
     },
+    "4c376c5d53ac": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 9,
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.unsubscribe\",\"params\":{\"subscriptionId\":\"sub-1\"}}"
+    },
     "5359579cc62d": {
       "running": true
     },
@@ -155,6 +215,92 @@
         "frame": "notifications.subscribe#1"
       }
     },
+    "6efd92e320ef": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 6,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "pending",
+        "startedAt": 0
+      }
+    },
+    "96f940529e7e": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "pending",
+        "startedAt": 0
+      }
+    },
+    "97d75ba51dcd": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": {
+            "unsubscribed": true
+          }
+        }
+      }
+    },
     "a0b2bcfcde77": {
       "running": false
     },
@@ -181,6 +327,40 @@
       "ordinal": 1,
       "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.subscribe\",\"params\":{\"includeDesktopSuppressed\":true}}"
     },
+    "f56cd17671f6": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": {
+            "unsubscribed": true
+          }
+        }
+      }
+    },
     "f79cc42f0819": {
       "name": "notification-tray.dismiss",
       "ordinal": 5,
@@ -251,8 +431,8 @@
       {
         "id": "notifications-desktop-stream.normal:unsubscribing",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2637263140a2"],
+          "sender": ["18a100fb6bae", "96f940529e7e"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -264,8 +444,8 @@
       {
         "id": "notifications-desktop-stream.normal:stopped",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2637263140a2"],
+          "sender": ["18a100fb6bae", "97d75ba51dcd"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -289,8 +469,8 @@
       {
         "id": "notifications-desktop-stream.result-absent:unsubscribing",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
+          "sender": ["18a100fb6bae", "41b12aedee99"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2637263140a2"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -302,8 +482,8 @@
       {
         "id": "notifications-desktop-stream.result-absent:stopped",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
+          "sender": ["18a100fb6bae", "f56cd17671f6"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2637263140a2"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -327,8 +507,8 @@
       {
         "id": "notifications-desktop-stream.result-null:unsubscribing",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
+          "sender": ["18a100fb6bae", "41b12aedee99"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2637263140a2"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -340,8 +520,8 @@
       {
         "id": "notifications-desktop-stream.result-null:stopped",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
+          "sender": ["18a100fb6bae", "f56cd17671f6"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2637263140a2"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -365,8 +545,8 @@
       {
         "id": "notifications-desktop-stream.inner-ok-missing:unsubscribing",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["18a100fb6bae", "6efd92e320ef"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -378,8 +558,8 @@
       {
         "id": "notifications-desktop-stream.inner-ok-missing:stopped",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["18a100fb6bae", "4510854e3d64"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -403,8 +583,8 @@
       {
         "id": "notifications-desktop-stream.inner-false-string-error:unsubscribing",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["18a100fb6bae", "6efd92e320ef"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -416,8 +596,8 @@
       {
         "id": "notifications-desktop-stream.inner-false-string-error:stopped",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["18a100fb6bae", "4510854e3d64"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -441,8 +621,8 @@
       {
         "id": "notifications-desktop-stream.inner-false-object-error:unsubscribing",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["18a100fb6bae", "6efd92e320ef"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -454,8 +634,8 @@
       {
         "id": "notifications-desktop-stream.inner-false-object-error:stopped",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2920ec417a8b"],
+          "sender": ["18a100fb6bae", "4510854e3d64"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -479,8 +659,8 @@
       {
         "id": "notifications-desktop-stream.outer-refused:unsubscribing",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a"],
+          "sender": ["18a100fb6bae", "6efd92e320ef"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -492,8 +672,8 @@
       {
         "id": "notifications-desktop-stream.outer-refused:stopped",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a"],
+          "sender": ["18a100fb6bae", "4510854e3d64"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -517,8 +697,8 @@
       {
         "id": "notifications-desktop-stream.outer-refused-no-message:unsubscribing",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a"],
+          "sender": ["18a100fb6bae", "6efd92e320ef"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -530,8 +710,8 @@
       {
         "id": "notifications-desktop-stream.outer-refused-no-message:stopped",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a"],
+          "sender": ["18a100fb6bae", "4510854e3d64"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -555,8 +735,8 @@
       {
         "id": "notifications-desktop-stream.method-not-found:unsubscribing",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a"],
+          "sender": ["18a100fb6bae", "6efd92e320ef"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -568,8 +748,8 @@
       {
         "id": "notifications-desktop-stream.method-not-found:stopped",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a"],
+          "sender": ["18a100fb6bae", "4510854e3d64"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "ab0e4b79457f"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
diff --git a/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.unsubscribe-1.json b/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.unsubscribe-1.json
new file mode 100644
index 00000000000..2c8015a134e
--- /dev/null
+++ b/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.unsubscribe-1.json
@@ -0,0 +1,775 @@
+{
+  "operation": "notifications.desktop-stream",
+  "family": "notifications.desktop-stream",
+  "namedDeltas": [],
+  "runnerVersion": 1,
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "eacf859143588ae6bee2804975d642b6c1088d57ae77ffe298620250d9a9f0e4",
+  "scenarioSha256": "afd3985ecdc07a1880aaee81739432633a1e87ec2de2c02166f43a6c78cb493b",
+  "platform": "darwin",
+  "scenarioVersion": 1,
+  "projectionVersion": 2,
+  "goldenFormatVersion": 5,
+  "values": {
+    "18a100fb6bae": {
+      "name": "notifications.getMissedSince#1",
+      "ordinal": 2,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.getMissedSince"
+        },
+        {
+          "name": "params",
+          "value": {
+            "deliveredPushes": [
+              {
+                "notificationEpoch": "epoch-1",
+                "notificationId": "note-1",
+                "notificationSeq": 7
+              },
+              {
+                "notificationEpoch": "epoch-1",
+                "notificationId": "note-2",
+                "notificationSeq": 8
+              }
+            ],
+            "lastSeenSeq": 9007199254740991
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-2",
+          "ok": true,
+          "result": {
+            "dismissedPushes": [
+              {
+                "notificationEpoch": "epoch-1",
+                "notificationId": "note-1",
+                "notificationSeq": 7
+              }
+            ]
+          }
+        }
+      }
+    },
+    "31580ba60f39": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": {
+            "error": "refused"
+          }
+        }
+      }
+    },
+    "45aca32cac62": {
+      "name": "notification-tray.dismiss",
+      "ordinal": 7,
+      "value": {
+        "identifier": "tray-2"
+      }
+    },
+    "4924583cde9d": {
+      "name": "device-store.setItem",
+      "ordinal": 6,
+      "value": {
+        "key": "orca:pushDismissalWatermarks:v1",
+        "value": "[{\"key\":\"[\\\"Yw3NKWbEM2aRElRI\\\",\\\"epoch-1\\\",\\\"note-2\\\"]\",\"seq\":8,\"expiresAt\":1767312000000}]"
+      }
+    },
+    "4c376c5d53ac": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 9,
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.unsubscribe\",\"params\":{\"subscriptionId\":\"sub-1\"}}"
+    },
+    "5359579cc62d": {
+      "running": true
+    },
+    "55b2f497c709": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "rejected",
+        "startedAt": 0,
+        "settledAt": 0,
+        "error": {
+          "category": "Error",
+          "message": "",
+          "isRpcDeliveryUnknown": true
+        }
+      }
+    },
+    "5bbb691c4e73": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "error": {
+            "code": "refused",
+            "message": ""
+          },
+          "id": "frame-3",
+          "ok": false
+        }
+      }
+    },
+    "67485a6a910e": {
+      "name": "notifications.getMissedSince#1",
+      "ordinal": 2,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.getMissedSince"
+        },
+        {
+          "name": "params",
+          "value": {
+            "deliveredPushes": [
+              {
+                "notificationEpoch": "epoch-1",
+                "notificationId": "note-1",
+                "notificationSeq": 7
+              },
+              {
+                "notificationEpoch": "epoch-1",
+                "notificationId": "note-2",
+                "notificationSeq": 8
+              }
+            ],
+            "lastSeenSeq": 9007199254740991
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "pending",
+        "startedAt": 0
+      }
+    },
+    "6ebc5caed1cf": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true
+        }
+      }
+    },
+    "96f940529e7e": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "pending",
+        "startedAt": 0
+      }
+    },
+    "97d75ba51dcd": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": {
+            "unsubscribed": true
+          }
+        }
+      }
+    },
+    "a0b2bcfcde77": {
+      "running": false
+    },
+    "b02d0b3cb3fb": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": {
+            "$rpc": "null"
+          }
+        }
+      }
+    },
+    "b7a7822cc9d3": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "error": {
+            "code": "method_not_found",
+            "message": "Unknown method"
+          },
+          "id": "frame-3",
+          "ok": false
+        }
+      }
+    },
+    "c3e6dac5f619": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "error": {
+            "code": "refused",
+            "message": "outer refused"
+          },
+          "id": "frame-3",
+          "ok": false
+        }
+      }
+    },
+    "c7a0ec1c071d": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": {
+            "error": "inner refused",
+            "ok": false
+          }
+        }
+      }
+    },
+    "cb4d5f9980e8": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": {
+            "error": {
+              "message": "inner refused"
+            },
+            "ok": false
+          }
+        }
+      }
+    },
+    "e074c0b6fa0a": {
+      "name": "notifications.getMissedSince#1",
+      "ordinal": 3,
+      "json": "{\"id\":\"frame-2\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.getMissedSince\",\"params\":{\"lastSeenSeq\":9007199254740991,\"deliveredPushes\":[{\"notificationId\":\"note-1\",\"notificationEpoch\":\"epoch-1\",\"notificationSeq\":7},{\"notificationId\":\"note-2\",\"notificationEpoch\":\"epoch-1\",\"notificationSeq\":8}]}}"
+    },
+    "e1fb5599ca9c": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "rejected",
+        "startedAt": 0,
+        "settledAt": 0,
+        "error": {
+          "category": "Error",
+          "message": "transport failure",
+          "isRpcDeliveryUnknown": true
+        }
+      }
+    },
+    "eb79a9b3682a": {
+      "status": "fulfilled",
+      "startedAt": 0,
+      "settledAt": 0,
+      "value": {
+        "$rpc": "undefined"
+      }
+    },
+    "f552b5040ec7": {
+      "name": "notifications.subscribe#1",
+      "ordinal": 1,
+      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.subscribe\",\"params\":{\"includeDesktopSuppressed\":true}}"
+    },
+    "f79cc42f0819": {
+      "name": "notification-tray.dismiss",
+      "ordinal": 5,
+      "value": {
+        "identifier": "tray-1"
+      }
+    },
+    "ff11f542ada5": {
+      "name": "device-store.setItem",
+      "ordinal": 4,
+      "value": {
+        "key": "orca:pushDismissalWatermarks:v1",
+        "value": "[{\"key\":\"[\\\"Yw3NKWbEM2aRElRI\\\",\\\"epoch-1\\\",\\\"note-1\\\"]\",\"seq\":7,\"expiresAt\":1767312000000}]"
+      }
+    }
+  },
+  "recording": {
+    "scenario": "matrix-notifications.desktop-stream-notifications.unsubscribe-1",
+    "checkpoints": [
+      {
+        "id": "notifications-desktop-stream.prelude:subscribed",
+        "observation": {
+          "sender": [],
+          "payloads": ["f552b5040ec7"],
+          "settlements": {
+            "start": "eb79a9b3682a"
+          },
+          "state": "5359579cc62d",
+          "effects": []
+        }
+      },
+      {
+        "id": "notifications-desktop-stream.prelude:ready",
+        "observation": {
+          "sender": ["67485a6a910e"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a"],
+          "settlements": {
+            "start": "eb79a9b3682a"
+          },
+          "state": "5359579cc62d",
+          "effects": []
+        }
+      },
+      {
+        "id": "notifications-desktop-stream.prelude:caught-up",
+        "observation": {
+          "sender": ["18a100fb6bae"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a"],
+          "settlements": {
+            "start": "eb79a9b3682a"
+          },
+          "state": "5359579cc62d",
+          "effects": ["ff11f542ada5", "f79cc42f0819"]
+        }
+      },
+      {
+        "id": "notifications-desktop-stream.prelude:dismissed",
+        "observation": {
+          "sender": ["18a100fb6bae"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a"],
+          "settlements": {
+            "start": "eb79a9b3682a"
+          },
+          "state": "5359579cc62d",
+          "effects": ["ff11f542ada5", "f79cc42f0819", "4924583cde9d", "45aca32cac62"]
+        }
+      },
+      {
+        "id": "notifications-desktop-stream.prelude:unsubscribing",
+        "observation": {
+          "sender": ["18a100fb6bae", "96f940529e7e"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
+          "settlements": {
+            "start": "eb79a9b3682a",
+            "stop": "eb79a9b3682a"
+          },
+          "state": "a0b2bcfcde77",
+          "effects": ["ff11f542ada5", "f79cc42f0819", "4924583cde9d", "45aca32cac62"]
+        }
+      },
+      {
+        "id": "notifications-desktop-stream.normal:stopped",
+        "observation": {
+          "sender": ["18a100fb6bae", "97d75ba51dcd"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
+          "settlements": {
+            "start": "eb79a9b3682a",
+            "stop": "eb79a9b3682a"
+          },
+          "state": "a0b2bcfcde77",
+          "effects": ["ff11f542ada5", "f79cc42f0819", "4924583cde9d", "45aca32cac62"]
+        }
+      },
+      {
+        "id": "notifications-desktop-stream.result-absent:stopped",
+        "observation": {
+          "sender": ["18a100fb6bae", "6ebc5caed1cf"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
+          "settlements": {
+            "start": "eb79a9b3682a",
+            "stop": "eb79a9b3682a"
+          },
+          "state": "a0b2bcfcde77",
+          "effects": ["ff11f542ada5", "f79cc42f0819", "4924583cde9d", "45aca32cac62"]
+        }
+      },
+      {
+        "id": "notifications-desktop-stream.result-null:stopped",
+        "observation": {
+          "sender": ["18a100fb6bae", "b02d0b3cb3fb"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
+          "settlements": {
+            "start": "eb79a9b3682a",
+            "stop": "eb79a9b3682a"
+          },
+          "state": "a0b2bcfcde77",
+          "effects": ["ff11f542ada5", "f79cc42f0819", "4924583cde9d", "45aca32cac62"]
+        }
+      },
+      {
+        "id": "notifications-desktop-stream.inner-ok-missing:stopped",
+        "observation": {
+          "sender": ["18a100fb6bae", "31580ba60f39"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
+          "settlements": {
+            "start": "eb79a9b3682a",
+            "stop": "eb79a9b3682a"
+          },
+          "state": "a0b2bcfcde77",
+          "effects": ["ff11f542ada5", "f79cc42f0819", "4924583cde9d", "45aca32cac62"]
+        }
+      },
+      {
+        "id": "notifications-desktop-stream.inner-false-string-error:stopped",
+        "observation": {
+          "sender": ["18a100fb6bae", "c7a0ec1c071d"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
+          "settlements": {
+            "start": "eb79a9b3682a",
+            "stop": "eb79a9b3682a"
+          },
+          "state": "a0b2bcfcde77",
+          "effects": ["ff11f542ada5", "f79cc42f0819", "4924583cde9d", "45aca32cac62"]
+        }
+      },
+      {
+        "id": "notifications-desktop-stream.inner-false-object-error:stopped",
+        "observation": {
+          "sender": ["18a100fb6bae", "cb4d5f9980e8"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
+          "settlements": {
+            "start": "eb79a9b3682a",
+            "stop": "eb79a9b3682a"
+          },
+          "state": "a0b2bcfcde77",
+          "effects": ["ff11f542ada5", "f79cc42f0819", "4924583cde9d", "45aca32cac62"]
+        }
+      },
+      {
+        "id": "notifications-desktop-stream.outer-refused:stopped",
+        "observation": {
+          "sender": ["18a100fb6bae", "c3e6dac5f619"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
+          "settlements": {
+            "start": "eb79a9b3682a",
+            "stop": "eb79a9b3682a"
+          },
+          "state": "a0b2bcfcde77",
+          "effects": ["ff11f542ada5", "f79cc42f0819", "4924583cde9d", "45aca32cac62"]
+        }
+      },
+      {
+        "id": "notifications-desktop-stream.outer-refused-no-message:stopped",
+        "observation": {
+          "sender": ["18a100fb6bae", "5bbb691c4e73"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
+          "settlements": {
+            "start": "eb79a9b3682a",
+            "stop": "eb79a9b3682a"
+          },
+          "state": "a0b2bcfcde77",
+          "effects": ["ff11f542ada5", "f79cc42f0819", "4924583cde9d", "45aca32cac62"]
+        }
+      },
+      {
+        "id": "notifications-desktop-stream.method-not-found:stopped",
+        "observation": {
+          "sender": ["18a100fb6bae", "b7a7822cc9d3"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
+          "settlements": {
+            "start": "eb79a9b3682a",
+            "stop": "eb79a9b3682a"
+          },
+          "state": "a0b2bcfcde77",
+          "effects": ["ff11f542ada5", "f79cc42f0819", "4924583cde9d", "45aca32cac62"]
+        }
+      },
+      {
+        "id": "notifications-desktop-stream.transport-rejection:stopped",
+        "observation": {
+          "sender": ["18a100fb6bae", "e1fb5599ca9c"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
+          "settlements": {
+            "start": "eb79a9b3682a",
+            "stop": "eb79a9b3682a"
+          },
+          "state": "a0b2bcfcde77",
+          "effects": ["ff11f542ada5", "f79cc42f0819", "4924583cde9d", "45aca32cac62"]
+        }
+      },
+      {
+        "id": "notifications-desktop-stream.transport-rejection-no-message:stopped",
+        "observation": {
+          "sender": ["18a100fb6bae", "55b2f497c709"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
+          "settlements": {
+            "start": "eb79a9b3682a",
+            "stop": "eb79a9b3682a"
+          },
+          "state": "a0b2bcfcde77",
+          "effects": ["ff11f542ada5", "f79cc42f0819", "4924583cde9d", "45aca32cac62"]
+        }
+      }
+    ]
+  }
+}
diff --git a/mobile/rpc-foundation/goldens/matrix-notifications.display-test-screen-notifications.testpush-1.json b/mobile/rpc-foundation/goldens/matrix-notifications.display-test-screen-notifications.testpush-1.json
index c69350863bf..b38cc08fae2 100644
--- a/mobile/rpc-foundation/goldens/matrix-notifications.display-test-screen-notifications.testpush-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-notifications.display-test-screen-notifications.testpush-1.json
@@ -3,9 +3,9 @@
   "family": "notifications.display-test-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f55275c268e49679b37d72ce6cbe71186ce02c77fe3fd53f0f21e796502d62e8",
   "scenarioSha256": "b7a862c0de7dd4efcdf3f4db7c5aeda6b765ab58498f40f3b21232264758b16f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-notifications.push-dismissal-notifications.getmissedsince-1.json b/mobile/rpc-foundation/goldens/matrix-notifications.push-dismissal-notifications.getmissedsince-1.json
index ed571df8433..1ae52a81e99 100644
--- a/mobile/rpc-foundation/goldens/matrix-notifications.push-dismissal-notifications.getmissedsince-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-notifications.push-dismissal-notifications.getmissedsince-1.json
@@ -3,9 +3,9 @@
   "family": "notifications.push-dismissal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "595a3eb2994d0596b9fcd0707b175b4e978625053dfbc5c541b0350c0cbfb524",
   "scenarioSha256": "9ab21cda2ac956c70ddd23fe589778bbb46333314508cf92770d668ba59d5a90",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-notifications.push-registration-notifications.registerpush-1.json b/mobile/rpc-foundation/goldens/matrix-notifications.push-registration-notifications.registerpush-1.json
index f3bfd64caad..9141c87dcd8 100644
--- a/mobile/rpc-foundation/goldens/matrix-notifications.push-registration-notifications.registerpush-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-notifications.push-registration-notifications.registerpush-1.json
@@ -3,9 +3,9 @@
   "family": "notifications.push-registration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2e3d939dc162dbc5a38d8a7207111688204a825fd70348721917b3016e1c9470",
   "scenarioSha256": "c77a518d35203370669fea20f7669d7695a2ec851f22b220a8be417c546efeab",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-notifications.push-registration-notifications.unregisterpush-1.json b/mobile/rpc-foundation/goldens/matrix-notifications.push-registration-notifications.unregisterpush-1.json
index a07d4691dd5..5235f9c4292 100644
--- a/mobile/rpc-foundation/goldens/matrix-notifications.push-registration-notifications.unregisterpush-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-notifications.push-registration-notifications.unregisterpush-1.json
@@ -3,9 +3,9 @@
   "family": "notifications.push-registration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2e3d939dc162dbc5a38d8a7207111688204a825fd70348721917b3016e1c9470",
   "scenarioSha256": "bb772b4b000644f18b48dcf78b05863b30906bcf588824d94eff086014fa69e8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-direct-status.json b/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-direct-status.json
index b98c5daaabc..c92800ba023 100644
--- a/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-direct-status.json
+++ b/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-direct-status.json
@@ -3,10 +3,10 @@
   "family": "pairing.pre-profile",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "a28912c9abb97a227904723ff0de8162de31fce66c056da1813e0c18f6e01ccf",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-pairing.getendpoints-1.json b/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-pairing.getendpoints-1.json
index ae1cf470abb..5d1e0252f01 100644
--- a/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-pairing.getendpoints-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-pairing.getendpoints-1.json
@@ -3,10 +3,10 @@
   "family": "pairing.pre-profile",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "ccd2ef7c617d13bdf5987f5f89fed6917206205268633b9ef061b92c3580d672",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-pairing.provisionrelay-1.json b/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-pairing.provisionrelay-1.json
index 0eb37f46700..468c26e0966 100644
--- a/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-pairing.provisionrelay-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-pairing.provisionrelay-1.json
@@ -3,10 +3,10 @@
   "family": "pairing.pre-profile",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "399fa8b85d9c2fc341ea2284a54aed278fd1a5b19a84cc9284c29d5a583bc519",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-relay-status.json b/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-relay-status.json
index 75b075ca1d6..e7959294ae5 100644
--- a/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-relay-status.json
+++ b/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-relay-status.json
@@ -3,10 +3,10 @@
   "family": "pairing.pre-profile",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "14931cc23cd0e6d850f596c880014c606834898acbeee4abff3dc83a94b0c6c0",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-project-explicit-false-github.project.updateissuebyslug-1.json b/mobile/rpc-foundation/goldens/matrix-project-explicit-false-github.project.updateissuebyslug-1.json
index a0c74cb1db2..4f9d9589ced 100644
--- a/mobile/rpc-foundation/goldens/matrix-project-explicit-false-github.project.updateissuebyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-project-explicit-false-github.project.updateissuebyslug-1.json
@@ -3,9 +3,9 @@
   "family": "project-explicit-false",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "926f0d8c37a33d465bf3a04f056600cfc9f1669b1eca7e968aa1a1f797a74c61",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.getendpoints-1.json b/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.getendpoints-1.json
index 8597f3391f9..96946b44f47 100644
--- a/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.getendpoints-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.getendpoints-1.json
@@ -3,10 +3,10 @@
   "family": "relay.credential-rotation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "042d0f9ef57e2a18bf661b79f2f8f92a12125dbc0fc65dd8605f8cd6f7059d10",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.getendpoints-2.json b/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.getendpoints-2.json
index c953875c611..c5b018268eb 100644
--- a/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.getendpoints-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.getendpoints-2.json
@@ -3,10 +3,10 @@
   "family": "relay.credential-rotation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "530aa1f2ddc6fce10d485c8a160ae3e695250b2e80e1e7fc3e8dacb9f5117347",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.provisionrelay-1.json b/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.provisionrelay-1.json
index 2a59066034d..48c1036dc34 100644
--- a/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.provisionrelay-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.provisionrelay-1.json
@@ -3,10 +3,10 @@
   "family": "relay.credential-rotation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "18b1855f354c23cd5bb7af0db698f0a23d28208c3c6b7347f667bf6cd3ed612f",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.getendpoints-1.json b/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.getendpoints-1.json
index e4d8dbedb56..3d0fadd30dd 100644
--- a/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.getendpoints-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.getendpoints-1.json
@@ -3,10 +3,10 @@
   "family": "relay.direct-upgrade",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "03355bc2696d02fed125d9f0e24c6c26c8df2f3709c1c5f4412aaf9317cd41d4",
   "platform": "darwin",
   "scenarioVersion": 1,
@@ -131,6 +131,32 @@
         }
       }
     },
+    "232ca274f695": {
+      "status": "fulfilled",
+      "startedAt": 0,
+      "settledAt": 0,
+      "value": {
+        "bundle": {
+          "current": {
+            "expiresAt": 1767830400000,
+            "hash": "7ehR_WuQWkxwOFJdkHfI5jEg4DeVYWImtDuip60LHK4",
+            "token": "pending00000000000000000000000000000000001x",
+            "version": 4
+          },
+          "deviceToken": "device-token-1",
+          "hostId": "host-1",
+          "v": 1
+        },
+        "relay": {
+          "assignmentEpoch": 1,
+          "cellUrl": "https://cell.example",
+          "directorUrl": "https://director.example",
+          "e2eeFraming": 2,
+          "relayHostId": "relay-host-0001x",
+          "v": 1
+        }
+      }
+    },
     "240d8ec7e573": {
       "name": "pairing.getEndpoints#2",
       "ordinal": 5,
@@ -307,53 +333,6 @@
         }
       }
     },
-    "590b3311b0c4": {
-      "status": "fulfilled",
-      "startedAt": 0,
-      "settledAt": 0,
-      "value": {
-        "bundle": {
-          "current": {
-            "expiresAt": 1767830400000,
-            "hash": "7ehR_WuQWkxwOFJdkHfI5jEg4DeVYWImtDuip60LHK4",
-            "token": "pending00000000000000000000000000000000001x",
-            "version": 4
-          },
-          "deviceToken": "device-token-1",
-          "hostId": "host-1",
-          "v": 1
-        },
-        "host": {
-          "deviceToken": "device-token-1",
-          "endpoint": "ws://192.168.1.10:8765",
-          "endpoints": [
-            {
-              "id": "direct-primary",
-              "kind": "lan",
-              "url": "ws://192.168.1.10:8765"
-            },
-            {
-              "id": "relay-primary",
-              "kind": "relay",
-              "url": "wss://cell.example/v1/connect/relay-host-0001x"
-            }
-          ],
-          "id": "host-1",
-          "lastConnected": 1767225600000,
-          "name": "Fixture host",
-          "publicKeyB64": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
-          "relay": {
-            "assignmentEpoch": 1,
-            "cellUrl": "https://cell.example",
-            "directorUrl": "https://director.example",
-            "e2eeFraming": 2,
-            "relayHostId": "relay-host-0001x",
-            "v": 1
-          },
-          "relayHostId": "relay-host-0001x"
-        }
-      }
-    },
     "691df8767d71": {
       "name": "journal-cleared",
       "ordinal": 9,
@@ -678,7 +657,7 @@
           "sender": ["6e14239ef339", "2fce658b56a1", "240d8ec7e573"],
           "payloads": ["c5d28dd067e4", "f41ffc93936f", "10098087f961"],
           "settlements": {
-            "upgrade": "590b3311b0c4"
+            "upgrade": "232ca274f695"
           },
           "state": "980bbba0b617",
           "effects": ["aaef09eec3f3", "161baaed4df3", "691df8767d71"]
diff --git a/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.getendpoints-2.json b/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.getendpoints-2.json
index b8fa6ca81c3..6c7892521f3 100644
--- a/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.getendpoints-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.getendpoints-2.json
@@ -3,10 +3,10 @@
   "family": "relay.direct-upgrade",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "d0c4dd34645308f30c0999ea74c16b53f20e9183832fdf016c3dc21434744b05",
   "platform": "darwin",
   "scenarioVersion": 1,
@@ -66,6 +66,32 @@
       "ordinal": 8,
       "value": "host-1"
     },
+    "232ca274f695": {
+      "status": "fulfilled",
+      "startedAt": 0,
+      "settledAt": 0,
+      "value": {
+        "bundle": {
+          "current": {
+            "expiresAt": 1767830400000,
+            "hash": "7ehR_WuQWkxwOFJdkHfI5jEg4DeVYWImtDuip60LHK4",
+            "token": "pending00000000000000000000000000000000001x",
+            "version": 4
+          },
+          "deviceToken": "device-token-1",
+          "hostId": "host-1",
+          "v": 1
+        },
+        "relay": {
+          "assignmentEpoch": 1,
+          "cellUrl": "https://cell.example",
+          "directorUrl": "https://director.example",
+          "e2eeFraming": 2,
+          "relayHostId": "relay-host-0001x",
+          "v": 1
+        }
+      }
+    },
     "240d8ec7e573": {
       "name": "pairing.getEndpoints#2",
       "ordinal": 5,
@@ -183,53 +209,6 @@
       "journal": "present",
       "outcome": "failed: refused: outer refused"
     },
-    "590b3311b0c4": {
-      "status": "fulfilled",
-      "startedAt": 0,
-      "settledAt": 0,
-      "value": {
-        "bundle": {
-          "current": {
-            "expiresAt": 1767830400000,
-            "hash": "7ehR_WuQWkxwOFJdkHfI5jEg4DeVYWImtDuip60LHK4",
-            "token": "pending00000000000000000000000000000000001x",
-            "version": 4
-          },
-          "deviceToken": "device-token-1",
-          "hostId": "host-1",
-          "v": 1
-        },
-        "host": {
-          "deviceToken": "device-token-1",
-          "endpoint": "ws://192.168.1.10:8765",
-          "endpoints": [
-            {
-              "id": "direct-primary",
-              "kind": "lan",
-              "url": "ws://192.168.1.10:8765"
-            },
-            {
-              "id": "relay-primary",
-              "kind": "relay",
-              "url": "wss://cell.example/v1/connect/relay-host-0001x"
-            }
-          ],
-          "id": "host-1",
-          "lastConnected": 1767225600000,
-          "name": "Fixture host",
-          "publicKeyB64": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
-          "relay": {
-            "assignmentEpoch": 1,
-            "cellUrl": "https://cell.example",
-            "directorUrl": "https://director.example",
-            "e2eeFraming": 2,
-            "relayHostId": "relay-host-0001x",
-            "v": 1
-          },
-          "relayHostId": "relay-host-0001x"
-        }
-      }
-    },
     "5d4b5d435fef": {
       "name": "pairing.getEndpoints#2",
       "ordinal": 5,
@@ -673,7 +652,7 @@
           "sender": ["6e14239ef339", "2fce658b56a1", "240d8ec7e573"],
           "payloads": ["c5d28dd067e4", "f41ffc93936f", "10098087f961"],
           "settlements": {
-            "upgrade": "590b3311b0c4"
+            "upgrade": "232ca274f695"
           },
           "state": "980bbba0b617",
           "effects": ["aaef09eec3f3", "161baaed4df3", "691df8767d71"]
diff --git a/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.provisionrelay-1.json b/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.provisionrelay-1.json
index 49f5f501401..c3b56e5d5b3 100644
--- a/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.provisionrelay-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.provisionrelay-1.json
@@ -3,10 +3,10 @@
   "family": "relay.direct-upgrade",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "0fe163f405373adbb1913dddd79d6d596bf88d69fc27c824ba5a2cd4c1406446",
   "platform": "darwin",
   "scenarioVersion": 1,
@@ -101,6 +101,32 @@
         }
       }
     },
+    "232ca274f695": {
+      "status": "fulfilled",
+      "startedAt": 0,
+      "settledAt": 0,
+      "value": {
+        "bundle": {
+          "current": {
+            "expiresAt": 1767830400000,
+            "hash": "7ehR_WuQWkxwOFJdkHfI5jEg4DeVYWImtDuip60LHK4",
+            "token": "pending00000000000000000000000000000000001x",
+            "version": 4
+          },
+          "deviceToken": "device-token-1",
+          "hostId": "host-1",
+          "v": 1
+        },
+        "relay": {
+          "assignmentEpoch": 1,
+          "cellUrl": "https://cell.example",
+          "directorUrl": "https://director.example",
+          "e2eeFraming": 2,
+          "relayHostId": "relay-host-0001x",
+          "v": 1
+        }
+      }
+    },
     "240d8ec7e573": {
       "name": "pairing.getEndpoints#2",
       "ordinal": 5,
@@ -208,53 +234,6 @@
       "journal": "present",
       "outcome": "failed: refused: outer refused"
     },
-    "590b3311b0c4": {
-      "status": "fulfilled",
-      "startedAt": 0,
-      "settledAt": 0,
-      "value": {
-        "bundle": {
-          "current": {
-            "expiresAt": 1767830400000,
-            "hash": "7ehR_WuQWkxwOFJdkHfI5jEg4DeVYWImtDuip60LHK4",
-            "token": "pending00000000000000000000000000000000001x",
-            "version": 4
-          },
-          "deviceToken": "device-token-1",
-          "hostId": "host-1",
-          "v": 1
-        },
-        "host": {
-          "deviceToken": "device-token-1",
-          "endpoint": "ws://192.168.1.10:8765",
-          "endpoints": [
-            {
-              "id": "direct-primary",
-              "kind": "lan",
-              "url": "ws://192.168.1.10:8765"
-            },
-            {
-              "id": "relay-primary",
-              "kind": "relay",
-              "url": "wss://cell.example/v1/connect/relay-host-0001x"
-            }
-          ],
-          "id": "host-1",
-          "lastConnected": 1767225600000,
-          "name": "Fixture host",
-          "publicKeyB64": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
-          "relay": {
-            "assignmentEpoch": 1,
-            "cellUrl": "https://cell.example",
-            "directorUrl": "https://director.example",
-            "e2eeFraming": 2,
-            "relayHostId": "relay-host-0001x",
-            "v": 1
-          },
-          "relayHostId": "relay-host-0001x"
-        }
-      }
-    },
     "65dfa1d22ba8": {
       "name": "pairing.provisionRelay#1",
       "ordinal": 3,
@@ -688,7 +667,7 @@
           "sender": ["6e14239ef339", "2fce658b56a1", "240d8ec7e573"],
           "payloads": ["c5d28dd067e4", "f41ffc93936f", "10098087f961"],
           "settlements": {
-            "upgrade": "590b3311b0c4"
+            "upgrade": "232ca274f695"
           },
           "state": "980bbba0b617",
           "effects": ["aaef09eec3f3", "161baaed4df3", "691df8767d71"]
diff --git a/mobile/rpc-foundation/goldens/matrix-relay.pairing-recovery-pairing.getendpoints-1.json b/mobile/rpc-foundation/goldens/matrix-relay.pairing-recovery-pairing.getendpoints-1.json
index 5c23b136ea9..f573ceac49a 100644
--- a/mobile/rpc-foundation/goldens/matrix-relay.pairing-recovery-pairing.getendpoints-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-relay.pairing-recovery-pairing.getendpoints-1.json
@@ -3,10 +3,10 @@
   "family": "relay.pairing-recovery",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "5aaa104a652d4f10cd48ab742112cf59fca22f52bbf85ee3716505a9642fbe37",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-session.browser-tab-create-browser.tabcreate-1.json b/mobile/rpc-foundation/goldens/matrix-session.browser-tab-create-browser.tabcreate-1.json
index 6a060dbd2c3..0602fc3486c 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.browser-tab-create-browser.tabcreate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.browser-tab-create-browser.tabcreate-1.json
@@ -3,9 +3,9 @@
   "family": "session.browser-tab-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "6c606813584d6ac89251c725a556d717603acde405a8d45ef6d844e06f2da67a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.content-create-files.createfile-1.json b/mobile/rpc-foundation/goldens/matrix-session.content-create-files.createfile-1.json
index b4bf1c9f495..bb3796fff3d 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.content-create-files.createfile-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.content-create-files.createfile-1.json
@@ -3,9 +3,9 @@
   "family": "session.content-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "06bf92360e6985770c08a9e53be0f55b6e8ff120d4e6411dacc22e88d08cef32",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.content-create-files.open-1.json b/mobile/rpc-foundation/goldens/matrix-session.content-create-files.open-1.json
index 1d597bc9884..8eb617c1276 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.content-create-files.open-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.content-create-files.open-1.json
@@ -3,9 +3,9 @@
   "family": "session.content-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "17f87233352ff8e452f061f4558d58b44643efe49313162d4aad140343a1ead9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.content-create-status.get-1.json b/mobile/rpc-foundation/goldens/matrix-session.content-create-status.get-1.json
index ba8d561b229..17eab0a73f0 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.content-create-status.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.content-create-status.get-1.json
@@ -3,9 +3,9 @@
   "family": "session.content-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "5100bd674509d1d83b1e2594eee036af21ea14b12226185b44070555d1d43060",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.content-create-worktree.show-1.json b/mobile/rpc-foundation/goldens/matrix-session.content-create-worktree.show-1.json
index 5b8d4a3a4c3..57790482359 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.content-create-worktree.show-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.content-create-worktree.show-1.json
@@ -3,9 +3,9 @@
   "family": "session.content-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "b9ca49e401df8710924f200f92a071bac2e120ed43df7be2cfb8a325ab1cd9cb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.create-terminal-session.tabs.createterminal-1.json b/mobile/rpc-foundation/goldens/matrix-session.create-terminal-session.tabs.createterminal-1.json
index 7ae883be384..cd2360ade67 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.create-terminal-session.tabs.createterminal-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.create-terminal-session.tabs.createterminal-1.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "ae1572c1670073d0ac3d2d3abd0e7bee9910cbe4a0b09ecd941e887eeb1db165",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.create-terminal-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-session.create-terminal-terminal.send-1.json
index df69affa3a5..ac3a11e298a 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.create-terminal-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.create-terminal-terminal.send-1.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "62930616f1017ffd4b74546c80b17f3aa3bcee52a6ad62ec144d95872fd31321",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.diff-notes-worktree.show-1.json b/mobile/rpc-foundation/goldens/matrix-session.diff-notes-worktree.show-1.json
index 29305c3e352..7b2125cd906 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.diff-notes-worktree.show-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.diff-notes-worktree.show-1.json
@@ -3,9 +3,9 @@
   "family": "session.diff-notes",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "e54684bad13aa8b8b4794e06351c709053b1c4c6d87776ecdbb1dd1b4406a694",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.diff-review-actions-worktree.set-1.json b/mobile/rpc-foundation/goldens/matrix-session.diff-review-actions-worktree.set-1.json
index 76034b5c1bd..f97d6bde24a 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.diff-review-actions-worktree.set-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.diff-review-actions-worktree.set-1.json
@@ -3,10 +3,10 @@
   "family": "session.diff-review-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "dc3a746274b4197b02b0b3060bbf8ab0f67eb54355c8b9888e1f061e37f777af",
   "scenarioSha256": "c583058382c949e977b7a1287895ed9ccb8cb408b684aef186b629976ff1da4d",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-session.diff-review-base-ref-show.json b/mobile/rpc-foundation/goldens/matrix-session.diff-review-base-ref-show.json
index 1b36f02ce83..dd24b95861b 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.diff-review-base-ref-show.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.diff-review-base-ref-show.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "17e2b30594a2b37e82ff1976377722c2f1c3ae7f01857e50e010a2dd2e89da3a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.diff-review-git.branchcompare-1.json b/mobile/rpc-foundation/goldens/matrix-session.diff-review-git.branchcompare-1.json
index dc2dd9b2106..484ef96b252 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.diff-review-git.branchcompare-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.diff-review-git.branchcompare-1.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "b99f51a5527e42a32ea9203ad75b16f9dd3cdcdc2a3ed235f6467ac1c7e3a4f3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.diff-review-git.status-1.json b/mobile/rpc-foundation/goldens/matrix-session.diff-review-git.status-1.json
index f53672b571b..01e56add623 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.diff-review-git.status-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.diff-review-git.status-1.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "b4627f9ac9bc090a2b48fd35f32d5dc3d66fefe0fb65abab75597ef2c73510ec",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.diff-review-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-session.diff-review-repo.list-1.json
index bae327ca83f..ea6ce1fb562 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.diff-review-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.diff-review-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "c9f720134506b6db71b742c219abe736fca1f90070403d7c96df9396fd048b6f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.diff-review-review-show.json b/mobile/rpc-foundation/goldens/matrix-session.diff-review-review-show.json
index c484c29c717..4dde0a3b811 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.diff-review-review-show.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.diff-review-review-show.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "f17bb817f9a172e776f1814920d58abc7db122da9c49cfe3bbeaf217f82d70d7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.markdown-disk-fallback-files.read-1.json b/mobile/rpc-foundation/goldens/matrix-session.markdown-disk-fallback-files.read-1.json
index 2610b5d3169..f3f194bfb01 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.markdown-disk-fallback-files.read-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.markdown-disk-fallback-files.read-1.json
@@ -3,9 +3,9 @@
   "family": "session.markdown-disk-fallback",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "c4b6c9c21433876e2bb3822f289627e7c5607830559289d35cae066ff895fc23",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.markdown-disk-fallback-markdown.readtab-1.json b/mobile/rpc-foundation/goldens/matrix-session.markdown-disk-fallback-markdown.readtab-1.json
index 7280e55fd38..93b366ccd78 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.markdown-disk-fallback-markdown.readtab-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.markdown-disk-fallback-markdown.readtab-1.json
@@ -3,9 +3,9 @@
   "family": "session.markdown-disk-fallback",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "42ddfcc6c8cac61e5891b72fbac9d04763fa9c52d0cb4f44e1044714a8a1ee77",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.markdown-save-markdown.savetab-1.json b/mobile/rpc-foundation/goldens/matrix-session.markdown-save-markdown.savetab-1.json
index fc36313b449..5625de0572f 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.markdown-save-markdown.savetab-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.markdown-save-markdown.savetab-1.json
@@ -3,9 +3,9 @@
   "family": "session.markdown-save",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "389c6118f3137b78e88af6b901554b0331c652063a00d8ba3119e0883ce82f25",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.readsession-1.json b/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.readsession-1.json
index 2638eece2a3..561aa0c81e3 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.readsession-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.readsession-1.json
@@ -3,11 +3,11 @@
   "family": "session.native-chat-page",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "60ce67f66134d6385aa7fb47f2135436a7b3ce0221e3b2514bea65e06dba5518",
-  "scenarioSha256": "8a6f6d37fd7dbc9e0da081565f24b270949306c47a874568874ec8ce2579076b",
+  "scenarioSha256": "fbea97a327d051f0bf711f89396c3035b14c760559430688f6243710c1938ecb",
   "platform": "darwin",
   "scenarioVersion": 1,
   "projectionVersion": 2,
@@ -31,11 +31,6 @@
       "status": "ready",
       "transcriptLoading": false
     },
-    "09f715780ff1": {
-      "name": "nativeChat.subscribe#1",
-      "ordinal": 1,
-      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
-    },
     "1821d5c2646a": {
       "name": "nativeChat.readSession#1",
       "ordinal": 2,
@@ -84,11 +79,6 @@
       "status": "ready",
       "transcriptLoading": false
     },
-    "1c6ad14c561f": {
-      "name": "nativeChat.unsubscribe#1",
-      "ordinal": 5,
-      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1\"}}"
-    },
     "2dd353a0e048": {
       "name": "nativeChat.readSession#1",
       "ordinal": 2,
@@ -128,6 +118,11 @@
         }
       }
     },
+    "3e14b1ec5bde": {
+      "name": "nativeChat.unsubscribe#2",
+      "ordinal": 6,
+      "json": "{\"id\":\"frame-5\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\"}}"
+    },
     "41f222acdcb2": {
       "name": "nativeChat.readSession#1",
       "ordinal": 2,
@@ -167,10 +162,10 @@
         }
       }
     },
-    "459bc33ee698": {
-      "name": "nativeChat.subscribe#2",
-      "ordinal": 4,
-      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
+    "456781b97acc": {
+      "name": "nativeChat.subscribe#1",
+      "ordinal": 1,
+      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
     },
     "63d9cc126261": {
       "name": "nativeChat.readSession#1",
@@ -208,6 +203,11 @@
         }
       }
     },
+    "663babae1f1d": {
+      "name": "nativeChat.subscribe#2",
+      "ordinal": 4,
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
+    },
     "7b237e9824c8": {
       "crash": {
         "$rpc": "null"
@@ -270,6 +270,11 @@
         }
       }
     },
+    "7eedfcf76fd3": {
+      "name": "nativeChat.unsubscribe#1",
+      "ordinal": 5,
+      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\"}}"
+    },
     "8f91342d7840": {
       "crash": {
         "$rpc": "null"
@@ -573,11 +578,6 @@
         "startedAt": 0
       }
     },
-    "e488a88a0a50": {
-      "name": "nativeChat.unsubscribe#2",
-      "ordinal": 6,
-      "json": "{\"id\":\"frame-5\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1\"}}"
-    },
     "eb79a9b3682a": {
       "status": "fulfilled",
       "startedAt": 0,
@@ -607,7 +607,7 @@
         "id": "native-chat-page-earlier.prelude:subscribed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a"
           },
@@ -619,7 +619,7 @@
         "id": "native-chat-page-earlier.prelude:snapshot",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a"
           },
@@ -631,7 +631,7 @@
         "id": "native-chat-page-earlier.prelude:paging",
         "observation": {
           "sender": ["dadae0a56731"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c"],
+          "payloads": ["456781b97acc", "08ef53d83e8c"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -644,7 +644,7 @@
         "id": "native-chat-page-earlier.normal:paged",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c"],
+          "payloads": ["456781b97acc", "08ef53d83e8c"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -657,7 +657,7 @@
         "id": "native-chat-page-earlier.normal:re-subscribed",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -671,7 +671,7 @@
         "id": "native-chat-page-earlier.normal:replayed",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -686,11 +686,11 @@
         "observation": {
           "sender": ["d83fbb18104a"],
           "payloads": [
-            "09f715780ff1",
+            "456781b97acc",
             "08ef53d83e8c",
-            "459bc33ee698",
-            "1c6ad14c561f",
-            "e488a88a0a50"
+            "663babae1f1d",
+            "7eedfcf76fd3",
+            "3e14b1ec5bde"
           ],
           "settlements": {
             "mount": "eb79a9b3682a",
@@ -706,7 +706,7 @@
         "id": "native-chat-page-earlier.result-absent:paged",
         "observation": {
           "sender": ["1821d5c2646a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c"],
+          "payloads": ["456781b97acc", "08ef53d83e8c"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -719,7 +719,7 @@
         "id": "native-chat-page-earlier.result-absent:re-subscribed",
         "observation": {
           "sender": ["1821d5c2646a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -733,7 +733,7 @@
         "id": "native-chat-page-earlier.result-absent:replayed",
         "observation": {
           "sender": ["1821d5c2646a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -748,11 +748,11 @@
         "observation": {
           "sender": ["1821d5c2646a"],
           "payloads": [
-            "09f715780ff1",
+            "456781b97acc",
             "08ef53d83e8c",
-            "459bc33ee698",
-            "1c6ad14c561f",
-            "e488a88a0a50"
+            "663babae1f1d",
+            "7eedfcf76fd3",
+            "3e14b1ec5bde"
           ],
           "settlements": {
             "mount": "eb79a9b3682a",
@@ -768,7 +768,7 @@
         "id": "native-chat-page-earlier.result-null:paged",
         "observation": {
           "sender": ["a92af671fd39"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c"],
+          "payloads": ["456781b97acc", "08ef53d83e8c"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -781,7 +781,7 @@
         "id": "native-chat-page-earlier.result-null:re-subscribed",
         "observation": {
           "sender": ["a92af671fd39"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -795,7 +795,7 @@
         "id": "native-chat-page-earlier.result-null:replayed",
         "observation": {
           "sender": ["a92af671fd39"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -810,11 +810,11 @@
         "observation": {
           "sender": ["a92af671fd39"],
           "payloads": [
-            "09f715780ff1",
+            "456781b97acc",
             "08ef53d83e8c",
-            "459bc33ee698",
-            "1c6ad14c561f",
-            "e488a88a0a50"
+            "663babae1f1d",
+            "7eedfcf76fd3",
+            "3e14b1ec5bde"
           ],
           "settlements": {
             "mount": "eb79a9b3682a",
@@ -830,7 +830,7 @@
         "id": "native-chat-page-earlier.inner-ok-missing:paged",
         "observation": {
           "sender": ["9a114b6ce2df"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c"],
+          "payloads": ["456781b97acc", "08ef53d83e8c"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -843,7 +843,7 @@
         "id": "native-chat-page-earlier.inner-ok-missing:re-subscribed",
         "observation": {
           "sender": ["9a114b6ce2df"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -857,7 +857,7 @@
         "id": "native-chat-page-earlier.inner-ok-missing:replayed",
         "observation": {
           "sender": ["9a114b6ce2df"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -872,11 +872,11 @@
         "observation": {
           "sender": ["9a114b6ce2df"],
           "payloads": [
-            "09f715780ff1",
+            "456781b97acc",
             "08ef53d83e8c",
-            "459bc33ee698",
-            "1c6ad14c561f",
-            "e488a88a0a50"
+            "663babae1f1d",
+            "7eedfcf76fd3",
+            "3e14b1ec5bde"
           ],
           "settlements": {
             "mount": "eb79a9b3682a",
@@ -892,7 +892,7 @@
         "id": "native-chat-page-earlier.inner-false-string-error:paged",
         "observation": {
           "sender": ["d163a9801643"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c"],
+          "payloads": ["456781b97acc", "08ef53d83e8c"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -905,7 +905,7 @@
         "id": "native-chat-page-earlier.inner-false-string-error:re-subscribed",
         "observation": {
           "sender": ["d163a9801643"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -919,7 +919,7 @@
         "id": "native-chat-page-earlier.inner-false-string-error:replayed",
         "observation": {
           "sender": ["d163a9801643"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -934,11 +934,11 @@
         "observation": {
           "sender": ["d163a9801643"],
           "payloads": [
-            "09f715780ff1",
+            "456781b97acc",
             "08ef53d83e8c",
-            "459bc33ee698",
-            "1c6ad14c561f",
-            "e488a88a0a50"
+            "663babae1f1d",
+            "7eedfcf76fd3",
+            "3e14b1ec5bde"
           ],
           "settlements": {
             "mount": "eb79a9b3682a",
@@ -954,7 +954,7 @@
         "id": "native-chat-page-earlier.inner-false-object-error:paged",
         "observation": {
           "sender": ["9a3f65995021"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c"],
+          "payloads": ["456781b97acc", "08ef53d83e8c"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -967,7 +967,7 @@
         "id": "native-chat-page-earlier.inner-false-object-error:re-subscribed",
         "observation": {
           "sender": ["9a3f65995021"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -981,7 +981,7 @@
         "id": "native-chat-page-earlier.inner-false-object-error:replayed",
         "observation": {
           "sender": ["9a3f65995021"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -996,11 +996,11 @@
         "observation": {
           "sender": ["9a3f65995021"],
           "payloads": [
-            "09f715780ff1",
+            "456781b97acc",
             "08ef53d83e8c",
-            "459bc33ee698",
-            "1c6ad14c561f",
-            "e488a88a0a50"
+            "663babae1f1d",
+            "7eedfcf76fd3",
+            "3e14b1ec5bde"
           ],
           "settlements": {
             "mount": "eb79a9b3682a",
@@ -1016,7 +1016,7 @@
         "id": "native-chat-page-earlier.outer-refused:paged",
         "observation": {
           "sender": ["41f222acdcb2"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c"],
+          "payloads": ["456781b97acc", "08ef53d83e8c"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -1029,7 +1029,7 @@
         "id": "native-chat-page-earlier.outer-refused:re-subscribed",
         "observation": {
           "sender": ["41f222acdcb2"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -1043,7 +1043,7 @@
         "id": "native-chat-page-earlier.outer-refused:replayed",
         "observation": {
           "sender": ["41f222acdcb2"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -1058,11 +1058,11 @@
         "observation": {
           "sender": ["41f222acdcb2"],
           "payloads": [
-            "09f715780ff1",
+            "456781b97acc",
             "08ef53d83e8c",
-            "459bc33ee698",
-            "1c6ad14c561f",
-            "e488a88a0a50"
+            "663babae1f1d",
+            "7eedfcf76fd3",
+            "3e14b1ec5bde"
           ],
           "settlements": {
             "mount": "eb79a9b3682a",
@@ -1078,7 +1078,7 @@
         "id": "native-chat-page-earlier.outer-refused-no-message:paged",
         "observation": {
           "sender": ["2dd353a0e048"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c"],
+          "payloads": ["456781b97acc", "08ef53d83e8c"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -1091,7 +1091,7 @@
         "id": "native-chat-page-earlier.outer-refused-no-message:re-subscribed",
         "observation": {
           "sender": ["2dd353a0e048"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -1105,7 +1105,7 @@
         "id": "native-chat-page-earlier.outer-refused-no-message:replayed",
         "observation": {
           "sender": ["2dd353a0e048"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -1120,11 +1120,11 @@
         "observation": {
           "sender": ["2dd353a0e048"],
           "payloads": [
-            "09f715780ff1",
+            "456781b97acc",
             "08ef53d83e8c",
-            "459bc33ee698",
-            "1c6ad14c561f",
-            "e488a88a0a50"
+            "663babae1f1d",
+            "7eedfcf76fd3",
+            "3e14b1ec5bde"
           ],
           "settlements": {
             "mount": "eb79a9b3682a",
@@ -1140,7 +1140,7 @@
         "id": "native-chat-page-earlier.method-not-found:paged",
         "observation": {
           "sender": ["cea1d50a73fa"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c"],
+          "payloads": ["456781b97acc", "08ef53d83e8c"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -1153,7 +1153,7 @@
         "id": "native-chat-page-earlier.method-not-found:re-subscribed",
         "observation": {
           "sender": ["cea1d50a73fa"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -1167,7 +1167,7 @@
         "id": "native-chat-page-earlier.method-not-found:replayed",
         "observation": {
           "sender": ["cea1d50a73fa"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -1182,11 +1182,11 @@
         "observation": {
           "sender": ["cea1d50a73fa"],
           "payloads": [
-            "09f715780ff1",
+            "456781b97acc",
             "08ef53d83e8c",
-            "459bc33ee698",
-            "1c6ad14c561f",
-            "e488a88a0a50"
+            "663babae1f1d",
+            "7eedfcf76fd3",
+            "3e14b1ec5bde"
           ],
           "settlements": {
             "mount": "eb79a9b3682a",
@@ -1202,7 +1202,7 @@
         "id": "native-chat-page-earlier.transport-rejection:paged",
         "observation": {
           "sender": ["63d9cc126261"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c"],
+          "payloads": ["456781b97acc", "08ef53d83e8c"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -1215,7 +1215,7 @@
         "id": "native-chat-page-earlier.transport-rejection:re-subscribed",
         "observation": {
           "sender": ["63d9cc126261"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -1229,7 +1229,7 @@
         "id": "native-chat-page-earlier.transport-rejection:replayed",
         "observation": {
           "sender": ["63d9cc126261"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -1244,11 +1244,11 @@
         "observation": {
           "sender": ["63d9cc126261"],
           "payloads": [
-            "09f715780ff1",
+            "456781b97acc",
             "08ef53d83e8c",
-            "459bc33ee698",
-            "1c6ad14c561f",
-            "e488a88a0a50"
+            "663babae1f1d",
+            "7eedfcf76fd3",
+            "3e14b1ec5bde"
           ],
           "settlements": {
             "mount": "eb79a9b3682a",
@@ -1264,7 +1264,7 @@
         "id": "native-chat-page-earlier.transport-rejection-no-message:paged",
         "observation": {
           "sender": ["7ee0fd6f2bd8"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c"],
+          "payloads": ["456781b97acc", "08ef53d83e8c"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -1277,7 +1277,7 @@
         "id": "native-chat-page-earlier.transport-rejection-no-message:re-subscribed",
         "observation": {
           "sender": ["7ee0fd6f2bd8"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -1291,7 +1291,7 @@
         "id": "native-chat-page-earlier.transport-rejection-no-message:replayed",
         "observation": {
           "sender": ["7ee0fd6f2bd8"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -1306,11 +1306,11 @@
         "observation": {
           "sender": ["7ee0fd6f2bd8"],
           "payloads": [
-            "09f715780ff1",
+            "456781b97acc",
             "08ef53d83e8c",
-            "459bc33ee698",
-            "1c6ad14c561f",
-            "e488a88a0a50"
+            "663babae1f1d",
+            "7eedfcf76fd3",
+            "3e14b1ec5bde"
           ],
           "settlements": {
             "mount": "eb79a9b3682a",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.subscribe-1-1.json b/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.subscribe-1-1.json
index e56e5063ab8..f0be2f2f10d 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.subscribe-1-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.subscribe-1-1.json
@@ -3,11 +3,11 @@
   "family": "session.native-chat-page",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "60ce67f66134d6385aa7fb47f2135436a7b3ce0221e3b2514bea65e06dba5518",
-  "scenarioSha256": "de804d4fa5287b07be9079d21e0a3cfc7f22d0e4b8649f13a3465a30683a77c8",
+  "scenarioSha256": "d327f9ebb498cc9ea90ec96e942e9b52c7c64af0848afea4c8c4f72641b3eeda",
   "platform": "darwin",
   "scenarioVersion": 1,
   "projectionVersion": 2,
@@ -31,10 +31,10 @@
       "status": "ready",
       "transcriptLoading": false
     },
-    "09f715780ff1": {
-      "name": "nativeChat.subscribe#1",
-      "ordinal": 1,
-      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
+    "1693563703b9": {
+      "name": "nativeChat.unsubscribe#2",
+      "ordinal": 4,
+      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\"}}"
     },
     "197fa03857dd": {
       "crash": {
@@ -49,30 +49,25 @@
       "status": "ready",
       "transcriptLoading": false
     },
-    "1c6ad14c561f": {
-      "name": "nativeChat.unsubscribe#1",
-      "ordinal": 5,
-      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1\"}}"
+    "2a5d879ed94b": {
+      "name": "nativeChat.subscribe#2",
+      "ordinal": 2,
+      "json": "{\"id\":\"frame-2\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
     },
-    "459bc33ee698": {
+    "3e14b1ec5bde": {
+      "name": "nativeChat.unsubscribe#2",
+      "ordinal": 6,
+      "json": "{\"id\":\"frame-5\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\"}}"
+    },
+    "456781b97acc": {
+      "name": "nativeChat.subscribe#1",
+      "ordinal": 1,
+      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
+    },
+    "663babae1f1d": {
       "name": "nativeChat.subscribe#2",
       "ordinal": 4,
-      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
-    },
-    "53eaf803beb5": {
-      "name": "nativeChat.unsubscribe#1",
-      "ordinal": 3,
-      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1\"}}"
-    },
-    "5a78e2e003f7": {
-      "name": "nativeChat.subscribe#2",
-      "ordinal": 3,
-      "json": "{\"id\":\"frame-2\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
-    },
-    "70eb4a48d8d0": {
-      "name": "nativeChat.unsubscribe#2",
-      "ordinal": 5,
-      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1\"}}"
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
     },
     "7b237e9824c8": {
       "crash": {
@@ -100,6 +95,11 @@
       "status": "ready",
       "transcriptLoading": false
     },
+    "7eedfcf76fd3": {
+      "name": "nativeChat.unsubscribe#1",
+      "ordinal": 5,
+      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\"}}"
+    },
     "813c942b745a": {
       "crash": {
         "$rpc": "null"
@@ -124,10 +124,10 @@
       "status": "ready",
       "transcriptLoading": false
     },
-    "91a7795fa0ab": {
+    "96abfc4cef7e": {
       "name": "nativeChat.unsubscribe#1",
       "ordinal": 4,
-      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1\"}}"
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\"}}"
     },
     "9ec06f18374b": {
       "crash": {
@@ -140,6 +140,11 @@
       "status": "ready",
       "transcriptLoading": false
     },
+    "a2b8cf4aa6d5": {
+      "name": "nativeChat.unsubscribe#1",
+      "ordinal": 3,
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\"}}"
+    },
     "b09dcbf7cafc": {
       "crash": {
         "$rpc": "null"
@@ -151,6 +156,11 @@
       "status": "error",
       "transcriptLoading": false
     },
+    "b84b4297f28e": {
+      "name": "nativeChat.subscribe#2",
+      "ordinal": 3,
+      "json": "{\"id\":\"frame-2\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
+    },
     "c5cc569a5dda": {
       "crash": {
         "$rpc": "null"
@@ -279,21 +289,6 @@
         "startedAt": 0
       }
     },
-    "db2678a902bb": {
-      "name": "nativeChat.subscribe#2",
-      "ordinal": 2,
-      "json": "{\"id\":\"frame-2\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
-    },
-    "e488a88a0a50": {
-      "name": "nativeChat.unsubscribe#2",
-      "ordinal": 6,
-      "json": "{\"id\":\"frame-5\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1\"}}"
-    },
-    "e893d19cf5f3": {
-      "name": "nativeChat.unsubscribe#2",
-      "ordinal": 4,
-      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1\"}}"
-    },
     "eb79a9b3682a": {
       "status": "fulfilled",
       "startedAt": 0,
@@ -338,6 +333,11 @@
         },
         "frame": "nativeChat.subscribe#1"
       }
+    },
+    "fb84e5e8aefe": {
+      "name": "nativeChat.unsubscribe#2",
+      "ordinal": 5,
+      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\"}}"
     }
   },
   "recording": {
@@ -347,7 +347,7 @@
         "id": "native-chat-page-earlier.prelude:subscribed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a"
           },
@@ -359,7 +359,7 @@
         "id": "native-chat-page-earlier.normal:snapshot",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a"
           },
@@ -371,7 +371,7 @@
         "id": "native-chat-page-earlier.normal:paging",
         "observation": {
           "sender": ["dadae0a56731"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c"],
+          "payloads": ["456781b97acc", "08ef53d83e8c"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -384,7 +384,7 @@
         "id": "native-chat-page-earlier.normal:paged",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c"],
+          "payloads": ["456781b97acc", "08ef53d83e8c"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -397,7 +397,7 @@
         "id": "native-chat-page-earlier.normal:re-subscribed",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -411,7 +411,7 @@
         "id": "native-chat-page-earlier.normal:replayed",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -426,11 +426,11 @@
         "observation": {
           "sender": ["d83fbb18104a"],
           "payloads": [
-            "09f715780ff1",
+            "456781b97acc",
             "08ef53d83e8c",
-            "459bc33ee698",
-            "1c6ad14c561f",
-            "e488a88a0a50"
+            "663babae1f1d",
+            "7eedfcf76fd3",
+            "3e14b1ec5bde"
           ],
           "settlements": {
             "mount": "eb79a9b3682a",
@@ -446,7 +446,7 @@
         "id": "native-chat-page-earlier.result-absent:snapshot",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a"
           },
@@ -458,7 +458,7 @@
         "id": "native-chat-page-earlier.result-absent:paging",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -471,7 +471,7 @@
         "id": "native-chat-page-earlier.result-absent:paged",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -484,7 +484,7 @@
         "id": "native-chat-page-earlier.result-absent:re-subscribed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "5a78e2e003f7", "91a7795fa0ab"],
+          "payloads": ["456781b97acc", "b84b4297f28e", "96abfc4cef7e"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -498,7 +498,7 @@
         "id": "native-chat-page-earlier.result-absent:replayed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "5a78e2e003f7", "91a7795fa0ab"],
+          "payloads": ["456781b97acc", "b84b4297f28e", "96abfc4cef7e"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -512,7 +512,7 @@
         "id": "native-chat-page-earlier.result-absent:unmounted",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "5a78e2e003f7", "91a7795fa0ab", "70eb4a48d8d0"],
+          "payloads": ["456781b97acc", "b84b4297f28e", "96abfc4cef7e", "fb84e5e8aefe"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -527,7 +527,7 @@
         "id": "native-chat-page-earlier.result-null:snapshot",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a"
           },
@@ -539,7 +539,7 @@
         "id": "native-chat-page-earlier.result-null:paging",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -552,7 +552,7 @@
         "id": "native-chat-page-earlier.result-null:paged",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -565,7 +565,7 @@
         "id": "native-chat-page-earlier.result-null:re-subscribed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "5a78e2e003f7", "91a7795fa0ab"],
+          "payloads": ["456781b97acc", "b84b4297f28e", "96abfc4cef7e"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -579,7 +579,7 @@
         "id": "native-chat-page-earlier.result-null:replayed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "5a78e2e003f7", "91a7795fa0ab"],
+          "payloads": ["456781b97acc", "b84b4297f28e", "96abfc4cef7e"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -593,7 +593,7 @@
         "id": "native-chat-page-earlier.result-null:unmounted",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "5a78e2e003f7", "91a7795fa0ab", "70eb4a48d8d0"],
+          "payloads": ["456781b97acc", "b84b4297f28e", "96abfc4cef7e", "fb84e5e8aefe"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -608,7 +608,7 @@
         "id": "native-chat-page-earlier.inner-ok-missing:snapshot",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a"
           },
@@ -620,7 +620,7 @@
         "id": "native-chat-page-earlier.inner-ok-missing:paging",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -633,7 +633,7 @@
         "id": "native-chat-page-earlier.inner-ok-missing:paged",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -646,7 +646,7 @@
         "id": "native-chat-page-earlier.inner-ok-missing:re-subscribed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "db2678a902bb", "53eaf803beb5"],
+          "payloads": ["456781b97acc", "2a5d879ed94b", "a2b8cf4aa6d5"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -660,7 +660,7 @@
         "id": "native-chat-page-earlier.inner-ok-missing:replayed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "db2678a902bb", "53eaf803beb5"],
+          "payloads": ["456781b97acc", "2a5d879ed94b", "a2b8cf4aa6d5"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -674,7 +674,7 @@
         "id": "native-chat-page-earlier.inner-ok-missing:unmounted",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "db2678a902bb", "53eaf803beb5", "e893d19cf5f3"],
+          "payloads": ["456781b97acc", "2a5d879ed94b", "a2b8cf4aa6d5", "1693563703b9"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -689,7 +689,7 @@
         "id": "native-chat-page-earlier.inner-false-string-error:snapshot",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a"
           },
@@ -701,7 +701,7 @@
         "id": "native-chat-page-earlier.inner-false-string-error:paging",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -714,7 +714,7 @@
         "id": "native-chat-page-earlier.inner-false-string-error:paged",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -727,7 +727,7 @@
         "id": "native-chat-page-earlier.inner-false-string-error:re-subscribed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "db2678a902bb", "53eaf803beb5"],
+          "payloads": ["456781b97acc", "2a5d879ed94b", "a2b8cf4aa6d5"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -741,7 +741,7 @@
         "id": "native-chat-page-earlier.inner-false-string-error:replayed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "db2678a902bb", "53eaf803beb5"],
+          "payloads": ["456781b97acc", "2a5d879ed94b", "a2b8cf4aa6d5"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -755,7 +755,7 @@
         "id": "native-chat-page-earlier.inner-false-string-error:unmounted",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "db2678a902bb", "53eaf803beb5", "e893d19cf5f3"],
+          "payloads": ["456781b97acc", "2a5d879ed94b", "a2b8cf4aa6d5", "1693563703b9"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -770,7 +770,7 @@
         "id": "native-chat-page-earlier.inner-false-object-error:snapshot",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a"
           },
@@ -782,7 +782,7 @@
         "id": "native-chat-page-earlier.inner-false-object-error:paging",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -795,7 +795,7 @@
         "id": "native-chat-page-earlier.inner-false-object-error:paged",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -808,7 +808,7 @@
         "id": "native-chat-page-earlier.inner-false-object-error:re-subscribed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "db2678a902bb", "53eaf803beb5"],
+          "payloads": ["456781b97acc", "2a5d879ed94b", "a2b8cf4aa6d5"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -822,7 +822,7 @@
         "id": "native-chat-page-earlier.inner-false-object-error:replayed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "db2678a902bb", "53eaf803beb5"],
+          "payloads": ["456781b97acc", "2a5d879ed94b", "a2b8cf4aa6d5"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -836,7 +836,7 @@
         "id": "native-chat-page-earlier.inner-false-object-error:unmounted",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "db2678a902bb", "53eaf803beb5", "e893d19cf5f3"],
+          "payloads": ["456781b97acc", "2a5d879ed94b", "a2b8cf4aa6d5", "1693563703b9"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -851,7 +851,7 @@
         "id": "native-chat-page-earlier.outer-refused:snapshot",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a"
           },
@@ -863,7 +863,7 @@
         "id": "native-chat-page-earlier.outer-refused:paging",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -876,7 +876,7 @@
         "id": "native-chat-page-earlier.outer-refused:paged",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -889,7 +889,7 @@
         "id": "native-chat-page-earlier.outer-refused:re-subscribed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "db2678a902bb"],
+          "payloads": ["456781b97acc", "2a5d879ed94b"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -903,7 +903,7 @@
         "id": "native-chat-page-earlier.outer-refused:replayed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "db2678a902bb"],
+          "payloads": ["456781b97acc", "2a5d879ed94b"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -917,7 +917,7 @@
         "id": "native-chat-page-earlier.outer-refused:unmounted",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "db2678a902bb", "53eaf803beb5"],
+          "payloads": ["456781b97acc", "2a5d879ed94b", "a2b8cf4aa6d5"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -932,7 +932,7 @@
         "id": "native-chat-page-earlier.outer-refused-no-message:snapshot",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a"
           },
@@ -944,7 +944,7 @@
         "id": "native-chat-page-earlier.outer-refused-no-message:paging",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -957,7 +957,7 @@
         "id": "native-chat-page-earlier.outer-refused-no-message:paged",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -970,7 +970,7 @@
         "id": "native-chat-page-earlier.outer-refused-no-message:re-subscribed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "db2678a902bb"],
+          "payloads": ["456781b97acc", "2a5d879ed94b"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -984,7 +984,7 @@
         "id": "native-chat-page-earlier.outer-refused-no-message:replayed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "db2678a902bb"],
+          "payloads": ["456781b97acc", "2a5d879ed94b"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -998,7 +998,7 @@
         "id": "native-chat-page-earlier.outer-refused-no-message:unmounted",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "db2678a902bb", "53eaf803beb5"],
+          "payloads": ["456781b97acc", "2a5d879ed94b", "a2b8cf4aa6d5"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -1013,7 +1013,7 @@
         "id": "native-chat-page-earlier.method-not-found:snapshot",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a"
           },
@@ -1025,7 +1025,7 @@
         "id": "native-chat-page-earlier.method-not-found:paging",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -1038,7 +1038,7 @@
         "id": "native-chat-page-earlier.method-not-found:paged",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -1051,7 +1051,7 @@
         "id": "native-chat-page-earlier.method-not-found:re-subscribed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "db2678a902bb"],
+          "payloads": ["456781b97acc", "2a5d879ed94b"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -1065,7 +1065,7 @@
         "id": "native-chat-page-earlier.method-not-found:replayed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "db2678a902bb"],
+          "payloads": ["456781b97acc", "2a5d879ed94b"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -1079,7 +1079,7 @@
         "id": "native-chat-page-earlier.method-not-found:unmounted",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1", "db2678a902bb", "53eaf803beb5"],
+          "payloads": ["456781b97acc", "2a5d879ed94b", "a2b8cf4aa6d5"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.subscribe-2-1.json b/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.subscribe-2-1.json
index 843a2f4954f..1f0634803ac 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.subscribe-2-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.subscribe-2-1.json
@@ -3,11 +3,11 @@
   "family": "session.native-chat-page",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "60ce67f66134d6385aa7fb47f2135436a7b3ce0221e3b2514bea65e06dba5518",
-  "scenarioSha256": "f7535862ae280e7e47916ad25701040e25d3318baceea52515c9d81b4144ae92",
+  "scenarioSha256": "e44bfa9ef3fd2db5c8c72b2e8d9dd51783ebf20379af4978d8fdb8db9784ec1f",
   "platform": "darwin",
   "scenarioVersion": 1,
   "projectionVersion": 2,
@@ -31,16 +31,6 @@
       "status": "ready",
       "transcriptLoading": false
     },
-    "09f715780ff1": {
-      "name": "nativeChat.subscribe#1",
-      "ordinal": 1,
-      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
-    },
-    "1c6ad14c561f": {
-      "name": "nativeChat.unsubscribe#1",
-      "ordinal": 5,
-      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1\"}}"
-    },
     "2614fb8bb258": {
       "name": "stream-listener-crash",
       "ordinal": 6,
@@ -53,15 +43,15 @@
         "frame": "nativeChat.subscribe#2"
       }
     },
-    "3fb11bd56adb": {
+    "3e14b1ec5bde": {
       "name": "nativeChat.unsubscribe#2",
-      "ordinal": 7,
-      "json": "{\"id\":\"frame-5\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1\"}}"
+      "ordinal": 6,
+      "json": "{\"id\":\"frame-5\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\"}}"
     },
-    "459bc33ee698": {
-      "name": "nativeChat.subscribe#2",
-      "ordinal": 4,
-      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
+    "456781b97acc": {
+      "name": "nativeChat.subscribe#1",
+      "ordinal": 1,
+      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
     },
     "6252ebf3de79": {
       "name": "stream-listener-crash",
@@ -75,6 +65,11 @@
         "frame": "nativeChat.subscribe#2"
       }
     },
+    "663babae1f1d": {
+      "name": "nativeChat.subscribe#2",
+      "ordinal": 4,
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
+    },
     "7b237e9824c8": {
       "crash": {
         "$rpc": "null"
@@ -101,6 +96,11 @@
       "status": "ready",
       "transcriptLoading": false
     },
+    "7eedfcf76fd3": {
+      "name": "nativeChat.unsubscribe#1",
+      "ordinal": 5,
+      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\"}}"
+    },
     "8f91342d7840": {
       "crash": {
         "$rpc": "null"
@@ -242,10 +242,10 @@
         "startedAt": 0
       }
     },
-    "e488a88a0a50": {
+    "e4483b4ab66e": {
       "name": "nativeChat.unsubscribe#2",
-      "ordinal": 6,
-      "json": "{\"id\":\"frame-5\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1\"}}"
+      "ordinal": 7,
+      "json": "{\"id\":\"frame-5\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\"}}"
     },
     "eb79a9b3682a": {
       "status": "fulfilled",
@@ -276,7 +276,7 @@
         "id": "native-chat-page-earlier.prelude:subscribed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a"
           },
@@ -288,7 +288,7 @@
         "id": "native-chat-page-earlier.prelude:snapshot",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a"
           },
@@ -300,7 +300,7 @@
         "id": "native-chat-page-earlier.prelude:paging",
         "observation": {
           "sender": ["dadae0a56731"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c"],
+          "payloads": ["456781b97acc", "08ef53d83e8c"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -313,7 +313,7 @@
         "id": "native-chat-page-earlier.prelude:paged",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c"],
+          "payloads": ["456781b97acc", "08ef53d83e8c"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -326,7 +326,7 @@
         "id": "native-chat-page-earlier.prelude:re-subscribed",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -340,7 +340,7 @@
         "id": "native-chat-page-earlier.normal:replayed",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -355,11 +355,11 @@
         "observation": {
           "sender": ["d83fbb18104a"],
           "payloads": [
-            "09f715780ff1",
+            "456781b97acc",
             "08ef53d83e8c",
-            "459bc33ee698",
-            "1c6ad14c561f",
-            "e488a88a0a50"
+            "663babae1f1d",
+            "7eedfcf76fd3",
+            "3e14b1ec5bde"
           ],
           "settlements": {
             "mount": "eb79a9b3682a",
@@ -375,7 +375,7 @@
         "id": "native-chat-page-earlier.result-absent:replayed",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -390,11 +390,11 @@
         "observation": {
           "sender": ["d83fbb18104a"],
           "payloads": [
-            "09f715780ff1",
+            "456781b97acc",
             "08ef53d83e8c",
-            "459bc33ee698",
-            "1c6ad14c561f",
-            "3fb11bd56adb"
+            "663babae1f1d",
+            "7eedfcf76fd3",
+            "e4483b4ab66e"
           ],
           "settlements": {
             "mount": "eb79a9b3682a",
@@ -410,7 +410,7 @@
         "id": "native-chat-page-earlier.result-null:replayed",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -425,11 +425,11 @@
         "observation": {
           "sender": ["d83fbb18104a"],
           "payloads": [
-            "09f715780ff1",
+            "456781b97acc",
             "08ef53d83e8c",
-            "459bc33ee698",
-            "1c6ad14c561f",
-            "3fb11bd56adb"
+            "663babae1f1d",
+            "7eedfcf76fd3",
+            "e4483b4ab66e"
           ],
           "settlements": {
             "mount": "eb79a9b3682a",
@@ -445,7 +445,7 @@
         "id": "native-chat-page-earlier.inner-ok-missing:replayed",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -460,11 +460,11 @@
         "observation": {
           "sender": ["d83fbb18104a"],
           "payloads": [
-            "09f715780ff1",
+            "456781b97acc",
             "08ef53d83e8c",
-            "459bc33ee698",
-            "1c6ad14c561f",
-            "e488a88a0a50"
+            "663babae1f1d",
+            "7eedfcf76fd3",
+            "3e14b1ec5bde"
           ],
           "settlements": {
             "mount": "eb79a9b3682a",
@@ -480,7 +480,7 @@
         "id": "native-chat-page-earlier.inner-false-string-error:replayed",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -495,11 +495,11 @@
         "observation": {
           "sender": ["d83fbb18104a"],
           "payloads": [
-            "09f715780ff1",
+            "456781b97acc",
             "08ef53d83e8c",
-            "459bc33ee698",
-            "1c6ad14c561f",
-            "e488a88a0a50"
+            "663babae1f1d",
+            "7eedfcf76fd3",
+            "3e14b1ec5bde"
           ],
           "settlements": {
             "mount": "eb79a9b3682a",
@@ -515,7 +515,7 @@
         "id": "native-chat-page-earlier.inner-false-object-error:replayed",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -530,11 +530,11 @@
         "observation": {
           "sender": ["d83fbb18104a"],
           "payloads": [
-            "09f715780ff1",
+            "456781b97acc",
             "08ef53d83e8c",
-            "459bc33ee698",
-            "1c6ad14c561f",
-            "e488a88a0a50"
+            "663babae1f1d",
+            "7eedfcf76fd3",
+            "3e14b1ec5bde"
           ],
           "settlements": {
             "mount": "eb79a9b3682a",
@@ -550,7 +550,7 @@
         "id": "native-chat-page-earlier.outer-refused:replayed",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -564,7 +564,7 @@
         "id": "native-chat-page-earlier.outer-refused:unmounted",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -579,7 +579,7 @@
         "id": "native-chat-page-earlier.outer-refused-no-message:replayed",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -593,7 +593,7 @@
         "id": "native-chat-page-earlier.outer-refused-no-message:unmounted",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -608,7 +608,7 @@
         "id": "native-chat-page-earlier.method-not-found:replayed",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -622,7 +622,7 @@
         "id": "native-chat-page-earlier.method-not-found:unmounted",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.native-chat-readability-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-session.native-chat-readability-repo.list-1.json
index 14d817d46f8..76def5b32af 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.native-chat-readability-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.native-chat-readability-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-readability",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "d6a0472f274d55aab584b58b67018d042ee1ba6799f42072a8a5986f45554bfc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-orchestration.workerterminaluserinput-1.json b/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-orchestration.workerterminaluserinput-1.json
index b60d59d9b49..6a44ac07bbf 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-orchestration.workerterminaluserinput-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-orchestration.workerterminaluserinput-1.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-stop",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "a60de7b496f8149593a6e89cd2d29e20fdf75d26536592fec6b0100b43322d3b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-terminal.send-1.json
index fe56950b74b..4f8eae2ee27 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-terminal.send-1.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-stop",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "96499f352af2ff884bfa94996659609fdbd228e1d071ad462400b978ab8e239b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-terminal.send-2.json b/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-terminal.send-2.json
index 101c36c4103..f727014adbc 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-terminal.send-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-terminal.send-2.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-stop",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "c28251d769ca9788952ed4fb29d8665c870fb85f2c5a4f32f8af33baf44498af",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-git.branchcompare-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-git.branchcompare-1.json
index 47d7125c289..d6400056190 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-git.branchcompare-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-git.branchcompare-1.json
@@ -3,10 +3,10 @@
   "family": "session.pr-branch-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "af78542ad2c449b629f8705b940ec92fd16f879a9bcc81ff6ae3a192f804fa2c",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-git.status-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-git.status-1.json
index 27b3eabc809..66e7ef6efc6 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-git.status-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-git.status-1.json
@@ -3,10 +3,10 @@
   "family": "session.pr-branch-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "1e7cad00f4dfcda65a3830b0b2468020816b940611af1b68600de33cd8c1d7c2",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-repo.list-1.json
index bea850ddbc6..ffde2b026ac 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-repo.list-1.json
@@ -3,10 +3,10 @@
   "family": "session.pr-branch-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "d456ec18056eb9663e99d4991784bd802422256d81ddd7509720814da06915f4",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-worktree.show-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-worktree.show-1.json
index 6d5414f9bb8..d5d8a2506e3 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-worktree.show-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-worktree.show-1.json
@@ -3,10 +3,10 @@
   "family": "session.pr-branch-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "039f26cc90d2239028d6ad1d9ecae9cc976d48f386f2d29fbfa425afc702657d",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-github.prchecks-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-github.prchecks-1.json
index 40a934a5489..093c4d7c296 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-github.prchecks-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-github.prchecks-1.json
@@ -3,9 +3,9 @@
   "family": "session.pr-sidebar",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "87ffa2daea415d2682f1112025b5bd9d52404c6fc7c239180a3ad2120678ff1f",
   "scenarioSha256": "97a92fc3e9b496a6295fb01e490407c1154cd19c54777fdce67377e07af08729",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-github.prforbranch-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-github.prforbranch-1.json
index 0a45cf9e5b6..02fa24466e9 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-github.prforbranch-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-github.prforbranch-1.json
@@ -3,9 +3,9 @@
   "family": "session.pr-sidebar",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "87ffa2daea415d2682f1112025b5bd9d52404c6fc7c239180a3ad2120678ff1f",
   "scenarioSha256": "cb052d2107df7bbf24927199935dde7f30352ce875c7ddd7bbab7d8044da0add",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-hostedreview.forbranch-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-hostedreview.forbranch-1.json
index a73350ebc25..34b1b8e12f0 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-hostedreview.forbranch-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-hostedreview.forbranch-1.json
@@ -3,9 +3,9 @@
   "family": "session.pr-sidebar",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "87ffa2daea415d2682f1112025b5bd9d52404c6fc7c239180a3ad2120678ff1f",
   "scenarioSha256": "461af8bf31bbf47e84f64a9177bae34c9b796a3f0158a16041ccb0a1a3ea62ec",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-worktree.show-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-worktree.show-1.json
index 3bd8db00c2b..c39a767051d 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-worktree.show-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-worktree.show-1.json
@@ -3,9 +3,9 @@
   "family": "session.pr-sidebar",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "87ffa2daea415d2682f1112025b5bd9d52404c6fc7c239180a3ad2120678ff1f",
   "scenarioSha256": "1bde693e45b01d09c47a1542cb7e43b4b7798ae52755ba41c5812bc07a425914",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-triage-agent.launchreplay-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-triage-agent.launchreplay-1.json
new file mode 100644
index 00000000000..987cb614dec
--- /dev/null
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-triage-agent.launchreplay-1.json
@@ -0,0 +1,952 @@
+{
+  "operation": "session.pr-triage-launch",
+  "family": "session.pr-triage",
+  "namedDeltas": [],
+  "runnerVersion": 1,
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
+  "scenarioSha256": "ce91b60bc94d61ac67714621cb88c1db62b51f1a6638325b985472eadfcca16b",
+  "platform": "darwin",
+  "scenarioVersion": 1,
+  "projectionVersion": 2,
+  "goldenFormatVersion": 5,
+  "values": {
+    "02188f091419": {
+      "name": "settings.get#1",
+      "ordinal": 2,
+      "args": [
+        {
+          "name": "method",
+          "value": "settings.get"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-2",
+          "ok": true,
+          "result": {
+            "settings": {
+              "defaultTuiAgent": "codex",
+              "disabledTuiAgents": []
+            }
+          }
+        }
+      }
+    },
+    "1c2564f1daca": {
+      "name": "settings.get#1",
+      "ordinal": 4,
+      "json": "{\"id\":\"frame-2\",\"deviceToken\":\"recording-device\",\"method\":\"settings.get\"}"
+    },
+    "28339abecf78": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 8,
+      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"agent.launchReplay\",\"params\":{\"agent\":\"codex\",\"operationId\":\"1767225600000-00000000000040008000000000000001\",\"target\":{\"kind\":\"existing\",\"worktree\":\"id:repo-9::/w\"},\"prompt\":{\"text\":\"Fix the failing checks\",\"delivery\":\"submit\"},\"launchSource\":\"task_page\"}}"
+    },
+    "331b3596787f": {
+      "launched": {
+        "kind": "not-started",
+        "message": "outer refused"
+      }
+    },
+    "35f85fe3b71c": {
+      "name": "repo.list#1",
+      "ordinal": 1,
+      "args": [
+        {
+          "name": "method",
+          "value": "repo.list"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "pending",
+        "startedAt": 0
+      }
+    },
+    "3b9fb3dfed63": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "agent.launchReplay"
+        },
+        {
+          "name": "params",
+          "value": {
+            "agent": "codex",
+            "launchSource": "task_page",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "prompt": {
+              "delivery": "submit",
+              "text": "Fix the failing checks"
+            },
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            }
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "timeoutMs": 90000
+          }
+        }
+      ],
+      "settlement": {
+        "status": "rejected",
+        "startedAt": 0,
+        "settledAt": 0,
+        "error": {
+          "category": "Error",
+          "message": "transport failure",
+          "isRpcDeliveryUnknown": true
+        }
+      }
+    },
+    "3e6a0417d2ee": {
+      "name": "repo.list#1",
+      "ordinal": 1,
+      "args": [
+        {
+          "name": "method",
+          "value": "repo.list"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-1",
+          "ok": true,
+          "result": {
+            "repos": [
+              {
+                "id": "repo-9"
+              }
+            ]
+          }
+        }
+      }
+    },
+    "4a304acaf84f": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "agent.launchReplay"
+        },
+        {
+          "name": "params",
+          "value": {
+            "agent": "codex",
+            "launchSource": "task_page",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "prompt": {
+              "delivery": "submit",
+              "text": "Fix the failing checks"
+            },
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            }
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "timeoutMs": 90000
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "error": {
+            "code": "refused",
+            "message": ""
+          },
+          "id": "frame-4",
+          "ok": false
+        }
+      }
+    },
+    "51d4cb56be85": {
+      "name": "settings.get#1",
+      "ordinal": 2,
+      "args": [
+        {
+          "name": "method",
+          "value": "settings.get"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "pending",
+        "startedAt": 0
+      }
+    },
+    "5b817dac4c7d": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "agent.launchReplay"
+        },
+        {
+          "name": "params",
+          "value": {
+            "agent": "codex",
+            "launchSource": "task_page",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "prompt": {
+              "delivery": "submit",
+              "text": "Fix the failing checks"
+            },
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            }
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "timeoutMs": 90000
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-4",
+          "ok": true,
+          "result": {
+            "error": "inner refused",
+            "ok": false
+          }
+        }
+      }
+    },
+    "675c01bc8b85": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "agent.launchReplay"
+        },
+        {
+          "name": "params",
+          "value": {
+            "agent": "codex",
+            "launchSource": "task_page",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "prompt": {
+              "delivery": "submit",
+              "text": "Fix the failing checks"
+            },
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            }
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "timeoutMs": 90000
+          }
+        }
+      ],
+      "settlement": {
+        "status": "rejected",
+        "startedAt": 0,
+        "settledAt": 0,
+        "error": {
+          "category": "Error",
+          "message": "",
+          "isRpcDeliveryUnknown": true
+        }
+      }
+    },
+    "6d9b52e88b73": {
+      "launched": {
+        "kind": "not-started",
+        "message": "Couldn't start the agent."
+      }
+    },
+    "7cdbda15d605": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "agent.launchReplay"
+        },
+        {
+          "name": "params",
+          "value": {
+            "agent": "codex",
+            "launchSource": "task_page",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "prompt": {
+              "delivery": "submit",
+              "text": "Fix the failing checks"
+            },
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            }
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "timeoutMs": 90000
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-4",
+          "ok": true,
+          "result": {
+            "error": {
+              "message": "inner refused"
+            },
+            "ok": false
+          }
+        }
+      }
+    },
+    "8638ab90602a": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "agent.launchReplay"
+        },
+        {
+          "name": "params",
+          "value": {
+            "agent": "codex",
+            "launchSource": "task_page",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "prompt": {
+              "delivery": "submit",
+              "text": "Fix the failing checks"
+            },
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            }
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "timeoutMs": 90000
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-4",
+          "ok": true
+        }
+      }
+    },
+    "9270aeb7d9c6": {
+      "status": "pending",
+      "startedAt": 0
+    },
+    "9c16efc31903": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 5,
+      "args": [
+        {
+          "name": "method",
+          "value": "preflight.detectAgents"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": ["codex"]
+        }
+      }
+    },
+    "a4273b38df83": {
+      "launched": "unlaunched"
+    },
+    "a8f475e8a3a8": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "agent.launchReplay"
+        },
+        {
+          "name": "params",
+          "value": {
+            "agent": "codex",
+            "launchSource": "task_page",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "prompt": {
+              "delivery": "submit",
+              "text": "Fix the failing checks"
+            },
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            }
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "timeoutMs": 90000
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "error": {
+            "code": "refused",
+            "message": "outer refused"
+          },
+          "id": "frame-4",
+          "ok": false
+        }
+      }
+    },
+    "ab12d545c466": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "agent.launchReplay"
+        },
+        {
+          "name": "params",
+          "value": {
+            "agent": "codex",
+            "launchSource": "task_page",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "prompt": {
+              "delivery": "submit",
+              "text": "Fix the failing checks"
+            },
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            }
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "timeoutMs": 90000
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-4",
+          "ok": true,
+          "result": {
+            "error": "refused"
+          }
+        }
+      }
+    },
+    "b613a82cee3d": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "agent.launchReplay"
+        },
+        {
+          "name": "params",
+          "value": {
+            "agent": "codex",
+            "launchSource": "task_page",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "prompt": {
+              "delivery": "submit",
+              "text": "Fix the failing checks"
+            },
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            }
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "timeoutMs": 90000
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "error": {
+            "code": "method_not_found",
+            "message": "Unknown method"
+          },
+          "id": "frame-4",
+          "ok": false
+        }
+      }
+    },
+    "b81eb9edc2b2": {
+      "name": "agent.launchReplay#2",
+      "ordinal": 9,
+      "args": [
+        {
+          "name": "method",
+          "value": "agent.launchReplay"
+        },
+        {
+          "name": "params",
+          "value": {
+            "agent": "codex",
+            "launchSource": "task_page",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "prompt": {
+              "delivery": "submit",
+              "text": "Fix the failing checks"
+            },
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            }
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "timeoutMs": 90000
+          }
+        }
+      ],
+      "settlement": {
+        "status": "pending",
+        "startedAt": 0
+      }
+    },
+    "ba3fac1eb199": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "agent.launchReplay"
+        },
+        {
+          "name": "params",
+          "value": {
+            "agent": "codex",
+            "launchSource": "task_page",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "prompt": {
+              "delivery": "submit",
+              "text": "Fix the failing checks"
+            },
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            }
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "timeoutMs": 90000
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-4",
+          "ok": true,
+          "result": {
+            "outcome": {
+              "handle": "term-1",
+              "kind": "terminal"
+            },
+            "prompt": {
+              "delivery": "submit",
+              "outcome": "handed-to-terminal"
+            },
+            "receipt": {
+              "detail": "Started a terminal agent, the default for new agent tabs in your settings.",
+              "mode": "terminal",
+              "preferred": "terminal",
+              "reason": "user_default"
+            },
+            "worktreeId": "repo-9::/w"
+          }
+        }
+      }
+    },
+    "c2a44248892e": {
+      "launched": {
+        "kind": "not-started",
+        "message": "Update Orca on your computer to start an agent from your phone."
+      }
+    },
+    "c39600966772": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "agent.launchReplay"
+        },
+        {
+          "name": "params",
+          "value": {
+            "agent": "codex",
+            "launchSource": "task_page",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "prompt": {
+              "delivery": "submit",
+              "text": "Fix the failing checks"
+            },
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            }
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "timeoutMs": 90000
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-4",
+          "ok": true,
+          "result": {
+            "$rpc": "null"
+          }
+        }
+      }
+    },
+    "dca101029f70": {
+      "name": "agent.launchReplay#2",
+      "ordinal": 10,
+      "json": "{\"id\":\"frame-5\",\"deviceToken\":\"recording-device\",\"method\":\"agent.launchReplay\",\"params\":{\"agent\":\"codex\",\"operationId\":\"1767225600000-00000000000040008000000000000001\",\"target\":{\"kind\":\"existing\",\"worktree\":\"id:repo-9::/w\"},\"prompt\":{\"text\":\"Fix the failing checks\",\"delivery\":\"submit\"},\"launchSource\":\"task_page\"}}"
+    },
+    "e0eef7c9fafe": {
+      "name": "repo.list#1",
+      "ordinal": 3,
+      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"repo.list\"}"
+    },
+    "eaa398d8c3aa": {
+      "launched": {
+        "kind": "unconfirmed",
+        "message": "Couldn't confirm the agent started. Check the workspace before trying again."
+      }
+    },
+    "eb79a9b3682a": {
+      "status": "fulfilled",
+      "startedAt": 0,
+      "settledAt": 0,
+      "value": {
+        "$rpc": "undefined"
+      }
+    },
+    "eb8d47f90956": {
+      "launched": {
+        "kind": "sent"
+      }
+    },
+    "f49d184679d1": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 6,
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"preflight.detectAgents\"}"
+    }
+  },
+  "recording": {
+    "scenario": "matrix-session.pr-triage-agent.launchreplay-1",
+    "checkpoints": [
+      {
+        "id": "pr-triage-launch.prelude:pending",
+        "observation": {
+          "sender": ["35f85fe3b71c", "51d4cb56be85"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca"],
+          "settlements": {
+            "launch": "9270aeb7d9c6"
+          },
+          "state": "a4273b38df83",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.normal:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "9c16efc31903", "ba3fac1eb199"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1", "28339abecf78"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "eb8d47f90956",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.result-absent:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "9c16efc31903", "8638ab90602a"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1", "28339abecf78"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "eaa398d8c3aa",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.result-null:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "9c16efc31903", "c39600966772"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1", "28339abecf78"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "eaa398d8c3aa",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.inner-ok-missing:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "9c16efc31903", "ab12d545c466"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1", "28339abecf78"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "eaa398d8c3aa",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.inner-false-string-error:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "9c16efc31903", "5b817dac4c7d"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1", "28339abecf78"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "eaa398d8c3aa",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.inner-false-object-error:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "9c16efc31903", "7cdbda15d605"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1", "28339abecf78"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "eaa398d8c3aa",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.outer-refused:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "9c16efc31903", "a8f475e8a3a8"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1", "28339abecf78"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "331b3596787f",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.outer-refused-no-message:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "9c16efc31903", "4a304acaf84f"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1", "28339abecf78"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "6d9b52e88b73",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.method-not-found:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "9c16efc31903", "b613a82cee3d"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1", "28339abecf78"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "c2a44248892e",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.transport-rejection:launched",
+        "observation": {
+          "sender": [
+            "3e6a0417d2ee",
+            "02188f091419",
+            "9c16efc31903",
+            "3b9fb3dfed63",
+            "b81eb9edc2b2"
+          ],
+          "payloads": [
+            "e0eef7c9fafe",
+            "1c2564f1daca",
+            "f49d184679d1",
+            "28339abecf78",
+            "dca101029f70"
+          ],
+          "settlements": {
+            "launch": "9270aeb7d9c6"
+          },
+          "state": "a4273b38df83",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.transport-rejection-no-message:launched",
+        "observation": {
+          "sender": [
+            "3e6a0417d2ee",
+            "02188f091419",
+            "9c16efc31903",
+            "675c01bc8b85",
+            "b81eb9edc2b2"
+          ],
+          "payloads": [
+            "e0eef7c9fafe",
+            "1c2564f1daca",
+            "f49d184679d1",
+            "28339abecf78",
+            "dca101029f70"
+          ],
+          "settlements": {
+            "launch": "9270aeb7d9c6"
+          },
+          "state": "a4273b38df83",
+          "effects": []
+        }
+      }
+    ]
+  }
+}
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-triage-preflight.detectagents-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-triage-preflight.detectagents-1.json
new file mode 100644
index 00000000000..44ccfd66f75
--- /dev/null
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-triage-preflight.detectagents-1.json
@@ -0,0 +1,793 @@
+{
+  "operation": "session.pr-triage-launch",
+  "family": "session.pr-triage",
+  "namedDeltas": [],
+  "runnerVersion": 1,
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
+  "scenarioSha256": "53a83cb160e90a8be808d9f0bb31826e355d43dd1e42fa6cccf7ca5398b8b579",
+  "platform": "darwin",
+  "scenarioVersion": 1,
+  "projectionVersion": 2,
+  "goldenFormatVersion": 5,
+  "values": {
+    "02188f091419": {
+      "name": "settings.get#1",
+      "ordinal": 2,
+      "args": [
+        {
+          "name": "method",
+          "value": "settings.get"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-2",
+          "ok": true,
+          "result": {
+            "settings": {
+              "defaultTuiAgent": "codex",
+              "disabledTuiAgents": []
+            }
+          }
+        }
+      }
+    },
+    "0220267a7bca": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 5,
+      "args": [
+        {
+          "name": "method",
+          "value": "preflight.detectAgents"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "error": {
+            "code": "method_not_found",
+            "message": "Unknown method"
+          },
+          "id": "frame-3",
+          "ok": false
+        }
+      }
+    },
+    "084fe2afb0ce": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 5,
+      "args": [
+        {
+          "name": "method",
+          "value": "preflight.detectAgents"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": {
+            "error": "refused"
+          }
+        }
+      }
+    },
+    "1963ee2edae9": {
+      "launched": {
+        "kind": "not-started",
+        "message": "Unknown method"
+      }
+    },
+    "1c2564f1daca": {
+      "name": "settings.get#1",
+      "ordinal": 4,
+      "json": "{\"id\":\"frame-2\",\"deviceToken\":\"recording-device\",\"method\":\"settings.get\"}"
+    },
+    "28339abecf78": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 8,
+      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"agent.launchReplay\",\"params\":{\"agent\":\"codex\",\"operationId\":\"1767225600000-00000000000040008000000000000001\",\"target\":{\"kind\":\"existing\",\"worktree\":\"id:repo-9::/w\"},\"prompt\":{\"text\":\"Fix the failing checks\",\"delivery\":\"submit\"},\"launchSource\":\"task_page\"}}"
+    },
+    "331b3596787f": {
+      "launched": {
+        "kind": "not-started",
+        "message": "outer refused"
+      }
+    },
+    "35f85fe3b71c": {
+      "name": "repo.list#1",
+      "ordinal": 1,
+      "args": [
+        {
+          "name": "method",
+          "value": "repo.list"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "pending",
+        "startedAt": 0
+      }
+    },
+    "3e6a0417d2ee": {
+      "name": "repo.list#1",
+      "ordinal": 1,
+      "args": [
+        {
+          "name": "method",
+          "value": "repo.list"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-1",
+          "ok": true,
+          "result": {
+            "repos": [
+              {
+                "id": "repo-9"
+              }
+            ]
+          }
+        }
+      }
+    },
+    "4dd9713de1b0": {
+      "launched": {
+        "kind": "not-started",
+        "message": "The host sent a reply this app could not read (preflight.detectAgents)"
+      }
+    },
+    "51d4cb56be85": {
+      "name": "settings.get#1",
+      "ordinal": 2,
+      "args": [
+        {
+          "name": "method",
+          "value": "settings.get"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "pending",
+        "startedAt": 0
+      }
+    },
+    "570f5efcd445": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 5,
+      "args": [
+        {
+          "name": "method",
+          "value": "preflight.detectAgents"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "error": {
+            "code": "refused",
+            "message": "outer refused"
+          },
+          "id": "frame-3",
+          "ok": false
+        }
+      }
+    },
+    "57f451cceda3": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 5,
+      "args": [
+        {
+          "name": "method",
+          "value": "preflight.detectAgents"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "rejected",
+        "startedAt": 0,
+        "settledAt": 0,
+        "error": {
+          "category": "Error",
+          "message": "",
+          "isRpcDeliveryUnknown": true
+        }
+      }
+    },
+    "585dfba86809": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 5,
+      "args": [
+        {
+          "name": "method",
+          "value": "preflight.detectAgents"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true
+        }
+      }
+    },
+    "6dd8724be3b1": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 5,
+      "args": [
+        {
+          "name": "method",
+          "value": "preflight.detectAgents"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": {
+            "$rpc": "null"
+          }
+        }
+      }
+    },
+    "9270aeb7d9c6": {
+      "status": "pending",
+      "startedAt": 0
+    },
+    "9c16efc31903": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 5,
+      "args": [
+        {
+          "name": "method",
+          "value": "preflight.detectAgents"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": ["codex"]
+        }
+      }
+    },
+    "a4273b38df83": {
+      "launched": "unlaunched"
+    },
+    "a9705081551e": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 5,
+      "args": [
+        {
+          "name": "method",
+          "value": "preflight.detectAgents"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": {
+            "error": {
+              "message": "inner refused"
+            },
+            "ok": false
+          }
+        }
+      }
+    },
+    "ac08a3ca5c67": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 5,
+      "args": [
+        {
+          "name": "method",
+          "value": "preflight.detectAgents"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": {
+            "error": "inner refused",
+            "ok": false
+          }
+        }
+      }
+    },
+    "b13ddf18a62e": {
+      "launched": {
+        "kind": "not-started",
+        "message": "Could not load the available agents."
+      }
+    },
+    "ba3fac1eb199": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "agent.launchReplay"
+        },
+        {
+          "name": "params",
+          "value": {
+            "agent": "codex",
+            "launchSource": "task_page",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "prompt": {
+              "delivery": "submit",
+              "text": "Fix the failing checks"
+            },
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            }
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "timeoutMs": 90000
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-4",
+          "ok": true,
+          "result": {
+            "outcome": {
+              "handle": "term-1",
+              "kind": "terminal"
+            },
+            "prompt": {
+              "delivery": "submit",
+              "outcome": "handed-to-terminal"
+            },
+            "receipt": {
+              "detail": "Started a terminal agent, the default for new agent tabs in your settings.",
+              "mode": "terminal",
+              "preferred": "terminal",
+              "reason": "user_default"
+            },
+            "worktreeId": "repo-9::/w"
+          }
+        }
+      }
+    },
+    "e0eef7c9fafe": {
+      "name": "repo.list#1",
+      "ordinal": 3,
+      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"repo.list\"}"
+    },
+    "e1b544c0b6ec": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 5,
+      "args": [
+        {
+          "name": "method",
+          "value": "preflight.detectAgents"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "rejected",
+        "startedAt": 0,
+        "settledAt": 0,
+        "error": {
+          "category": "Error",
+          "message": "transport failure",
+          "isRpcDeliveryUnknown": true
+        }
+      }
+    },
+    "e35d7003f64c": {
+      "launched": {
+        "kind": "not-started",
+        "message": "transport failure"
+      }
+    },
+    "eb79a9b3682a": {
+      "status": "fulfilled",
+      "startedAt": 0,
+      "settledAt": 0,
+      "value": {
+        "$rpc": "undefined"
+      }
+    },
+    "eb8d47f90956": {
+      "launched": {
+        "kind": "sent"
+      }
+    },
+    "efd2ac432554": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 5,
+      "args": [
+        {
+          "name": "method",
+          "value": "preflight.detectAgents"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "error": {
+            "code": "refused",
+            "message": ""
+          },
+          "id": "frame-3",
+          "ok": false
+        }
+      }
+    },
+    "f49d184679d1": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 6,
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"preflight.detectAgents\"}"
+    }
+  },
+  "recording": {
+    "scenario": "matrix-session.pr-triage-preflight.detectagents-1",
+    "checkpoints": [
+      {
+        "id": "pr-triage-launch.prelude:pending",
+        "observation": {
+          "sender": ["35f85fe3b71c", "51d4cb56be85"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca"],
+          "settlements": {
+            "launch": "9270aeb7d9c6"
+          },
+          "state": "a4273b38df83",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.normal:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "9c16efc31903", "ba3fac1eb199"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1", "28339abecf78"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "eb8d47f90956",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.result-absent:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "585dfba86809"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "4dd9713de1b0",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.result-null:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "6dd8724be3b1"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "4dd9713de1b0",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.inner-ok-missing:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "084fe2afb0ce"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "4dd9713de1b0",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.inner-false-string-error:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "ac08a3ca5c67"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "4dd9713de1b0",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.inner-false-object-error:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "a9705081551e"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "4dd9713de1b0",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.outer-refused:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "570f5efcd445"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "331b3596787f",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.outer-refused-no-message:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "efd2ac432554"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "b13ddf18a62e",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.method-not-found:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "0220267a7bca"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "1963ee2edae9",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.transport-rejection:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "e1b544c0b6ec"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "e35d7003f64c",
+          "effects": []
+        }
+      },
+      {
+        "id": "pr-triage-launch.transport-rejection-no-message:launched",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "57f451cceda3"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "b13ddf18a62e",
+          "effects": []
+        }
+      }
+    ]
+  }
+}
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-triage-session.tabs.createterminal-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-triage-repo.list-1.json
similarity index 54%
rename from mobile/rpc-foundation/goldens/matrix-session.pr-triage-session.tabs.createterminal-1.json
rename to mobile/rpc-foundation/goldens/matrix-session.pr-triage-repo.list-1.json
index 7670dbf940b..c6297229e59 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-triage-session.tabs.createterminal-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-triage-repo.list-1.json
@@ -3,56 +3,34 @@
   "family": "session.pr-triage",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
-  "scenarioSha256": "0d06d27000a8f6ad66480a16c7b84e8464f4b6e1d775326aeae005926e134cb4",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
+  "scenarioSha256": "c9030f183de2c5e86c2ccdfd9d4527d6f2ed71855501ff061620cef2681c6b82",
   "platform": "darwin",
   "scenarioVersion": 1,
   "projectionVersion": 2,
   "goldenFormatVersion": 5,
   "values": {
-    "280ce0d6f832": {
-      "name": "terminal.send#1",
-      "ordinal": 4,
-      "json": "{\"id\":\"frame-2\",\"deviceToken\":\"recording-device\",\"method\":\"terminal.send\",\"params\":{\"terminal\":\"term-1\",\"text\":\"Fix the failing checks\",\"enter\":true}}"
-    },
-    "30ec57518c05": {
-      "status": "rejected",
-      "startedAt": 0,
-      "settledAt": 0,
-      "error": {
-        "category": "Error",
-        "message": "Failed to create terminal",
-        "isRpcDeliveryUnknown": false
+    "01fc75db313f": {
+      "launched": {
+        "kind": "not-started",
+        "message": "The host sent a reply this app could not read (repo.list)"
       }
     },
-    "32a7c0ae7918": {
-      "status": "rejected",
-      "startedAt": 0,
-      "settledAt": 0,
-      "error": {
-        "category": "Error",
-        "message": "outer refused",
-        "isRpcDeliveryUnknown": false
-      }
-    },
-    "3f739faafdd4": {
-      "name": "session.tabs.createTerminal#1",
-      "ordinal": 1,
+    "02188f091419": {
+      "name": "settings.get#1",
+      "ordinal": 2,
       "args": [
         {
           "name": "method",
-          "value": "session.tabs.createTerminal"
+          "value": "settings.get"
         },
         {
           "name": "params",
           "value": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:repo-9::/w"
+            "$rpc": "absent"
           }
         },
         {
@@ -67,239 +45,30 @@
         "startedAt": 0,
         "settledAt": 0,
         "value": {
-          "id": "frame-1",
+          "id": "frame-2",
           "ok": true,
           "result": {
-            "$rpc": "null"
-          }
-        }
-      }
-    },
-    "478ad4afe83e": {
-      "status": "rejected",
-      "startedAt": 0,
-      "settledAt": 0,
-      "error": {
-        "category": "Error",
-        "message": "The host sent a reply this app could not read (session.tabs.createTerminal)",
-        "isRpcDeliveryUnknown": false
-      }
-    },
-    "5093e98ba369": {
-      "name": "session.tabs.createTerminal#1",
-      "ordinal": 1,
-      "args": [
-        {
-          "name": "method",
-          "value": "session.tabs.createTerminal"
-        },
-        {
-          "name": "params",
-          "value": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:repo-9::/w"
-          }
-        },
-        {
-          "name": "options",
-          "value": {
-            "$rpc": "absent"
-          }
-        }
-      ],
-      "settlement": {
-        "status": "fulfilled",
-        "startedAt": 0,
-        "settledAt": 0,
-        "value": {
-          "id": "frame-1",
-          "ok": true,
-          "result": {
-            "tab": {
-              "id": "tab-1",
-              "terminal": "term-1",
-              "title": "Agent",
-              "type": "terminal"
+            "settings": {
+              "defaultTuiAgent": "codex",
+              "disabledTuiAgents": []
             }
           }
         }
       }
     },
-    "5422be2c33b6": {
-      "name": "session.tabs.createTerminal#1",
+    "12e70439f294": {
+      "name": "repo.list#1",
       "ordinal": 1,
       "args": [
         {
           "name": "method",
-          "value": "session.tabs.createTerminal"
+          "value": "repo.list"
         },
         {
           "name": "params",
-          "value": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:repo-9::/w"
-          }
-        },
-        {
-          "name": "options",
           "value": {
             "$rpc": "absent"
           }
-        }
-      ],
-      "settlement": {
-        "status": "fulfilled",
-        "startedAt": 0,
-        "settledAt": 0,
-        "value": {
-          "id": "frame-1",
-          "ok": true,
-          "result": {
-            "error": "inner refused",
-            "ok": false
-          }
-        }
-      }
-    },
-    "6bf6a76b4bf4": {
-      "name": "session.tabs.createTerminal#1",
-      "ordinal": 1,
-      "args": [
-        {
-          "name": "method",
-          "value": "session.tabs.createTerminal"
-        },
-        {
-          "name": "params",
-          "value": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:repo-9::/w"
-          }
-        },
-        {
-          "name": "options",
-          "value": {
-            "$rpc": "absent"
-          }
-        }
-      ],
-      "settlement": {
-        "status": "rejected",
-        "startedAt": 0,
-        "settledAt": 0,
-        "error": {
-          "category": "Error",
-          "message": "",
-          "isRpcDeliveryUnknown": true
-        }
-      }
-    },
-    "72295d1a7229": {
-      "name": "session.tabs.createTerminal#1",
-      "ordinal": 1,
-      "args": [
-        {
-          "name": "method",
-          "value": "session.tabs.createTerminal"
-        },
-        {
-          "name": "params",
-          "value": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:repo-9::/w"
-          }
-        },
-        {
-          "name": "options",
-          "value": {
-            "$rpc": "absent"
-          }
-        }
-      ],
-      "settlement": {
-        "status": "fulfilled",
-        "startedAt": 0,
-        "settledAt": 0,
-        "value": {
-          "id": "frame-1",
-          "ok": true,
-          "result": {
-            "error": "refused"
-          }
-        }
-      }
-    },
-    "76bc1a917546": {
-      "name": "session.tabs.createTerminal#1",
-      "ordinal": 1,
-      "args": [
-        {
-          "name": "method",
-          "value": "session.tabs.createTerminal"
-        },
-        {
-          "name": "params",
-          "value": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:repo-9::/w"
-          }
-        },
-        {
-          "name": "options",
-          "value": {
-            "$rpc": "absent"
-          }
-        }
-      ],
-      "settlement": {
-        "status": "rejected",
-        "startedAt": 0,
-        "settledAt": 0,
-        "error": {
-          "category": "Error",
-          "message": "transport failure",
-          "isRpcDeliveryUnknown": true
-        }
-      }
-    },
-    "9270aeb7d9c6": {
-      "status": "pending",
-      "startedAt": 0
-    },
-    "94d38f1838f6": {
-      "name": "session.tabs.createTerminal#1",
-      "ordinal": 2,
-      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"session.tabs.createTerminal\",\"params\":{\"worktree\":\"id:repo-9::/w\",\"activate\":false,\"select\":true,\"navigation\":\"caller\"}}"
-    },
-    "a4273b38df83": {
-      "launched": "unlaunched"
-    },
-    "a46a4a08b27d": {
-      "name": "session.tabs.createTerminal#1",
-      "ordinal": 1,
-      "args": [
-        {
-          "name": "method",
-          "value": "session.tabs.createTerminal"
-        },
-        {
-          "name": "params",
-          "value": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:repo-9::/w"
-          }
         },
         {
           "name": "options",
@@ -322,31 +91,56 @@
         }
       }
     },
-    "a947768bc0ed": {
-      "status": "rejected",
-      "startedAt": 0,
-      "settledAt": 0,
-      "error": {
-        "category": "Error",
-        "message": "transport failure",
-        "isRpcDeliveryUnknown": true
-      }
-    },
-    "ae5875338dfe": {
-      "name": "session.tabs.createTerminal#1",
+    "1321b4c8c0b8": {
+      "name": "repo.list#1",
       "ordinal": 1,
       "args": [
         {
           "name": "method",
-          "value": "session.tabs.createTerminal"
+          "value": "repo.list"
         },
         {
           "name": "params",
           "value": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:repo-9::/w"
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "rejected",
+        "startedAt": 0,
+        "settledAt": 0,
+        "error": {
+          "category": "Error",
+          "message": "",
+          "isRpcDeliveryUnknown": true
+        }
+      }
+    },
+    "1963ee2edae9": {
+      "launched": {
+        "kind": "not-started",
+        "message": "Unknown method"
+      }
+    },
+    "1b23dab83fcf": {
+      "name": "repo.list#1",
+      "ordinal": 1,
+      "args": [
+        {
+          "name": "method",
+          "value": "repo.list"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
           }
         },
         {
@@ -361,50 +155,166 @@
         "startedAt": 0,
         "settledAt": 0,
         "value": {
-          "error": {
-            "code": "refused",
-            "message": ""
-          },
           "id": "frame-1",
-          "ok": false
+          "ok": true,
+          "result": {
+            "error": "refused"
+          }
         }
       }
     },
-    "b948e8307e81": {
-      "status": "rejected",
-      "startedAt": 0,
-      "settledAt": 0,
-      "error": {
-        "category": "Error",
-        "message": "Unknown method",
-        "isRpcDeliveryUnknown": false
+    "1c2564f1daca": {
+      "name": "settings.get#1",
+      "ordinal": 4,
+      "json": "{\"id\":\"frame-2\",\"deviceToken\":\"recording-device\",\"method\":\"settings.get\"}"
+    },
+    "28339abecf78": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 8,
+      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"agent.launchReplay\",\"params\":{\"agent\":\"codex\",\"operationId\":\"1767225600000-00000000000040008000000000000001\",\"target\":{\"kind\":\"existing\",\"worktree\":\"id:repo-9::/w\"},\"prompt\":{\"text\":\"Fix the failing checks\",\"delivery\":\"submit\"},\"launchSource\":\"task_page\"}}"
+    },
+    "331b3596787f": {
+      "launched": {
+        "kind": "not-started",
+        "message": "outer refused"
       }
     },
-    "c7584e82c72f": {
-      "status": "rejected",
-      "startedAt": 0,
-      "settledAt": 0,
-      "error": {
-        "category": "Error",
-        "message": "",
-        "isRpcDeliveryUnknown": true
-      }
-    },
-    "dea9ae4cf53d": {
-      "name": "session.tabs.createTerminal#1",
+    "35f85fe3b71c": {
+      "name": "repo.list#1",
       "ordinal": 1,
       "args": [
         {
           "name": "method",
-          "value": "session.tabs.createTerminal"
+          "value": "repo.list"
         },
         {
           "name": "params",
           "value": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:repo-9::/w"
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "pending",
+        "startedAt": 0
+      }
+    },
+    "3e6a0417d2ee": {
+      "name": "repo.list#1",
+      "ordinal": 1,
+      "args": [
+        {
+          "name": "method",
+          "value": "repo.list"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-1",
+          "ok": true,
+          "result": {
+            "repos": [
+              {
+                "id": "repo-9"
+              }
+            ]
+          }
+        }
+      }
+    },
+    "48c68906a98a": {
+      "name": "repo.list#1",
+      "ordinal": 1,
+      "args": [
+        {
+          "name": "method",
+          "value": "repo.list"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-1",
+          "ok": true,
+          "result": {
+            "$rpc": "null"
+          }
+        }
+      }
+    },
+    "51d4cb56be85": {
+      "name": "settings.get#1",
+      "ordinal": 2,
+      "args": [
+        {
+          "name": "method",
+          "value": "settings.get"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "pending",
+        "startedAt": 0
+      }
+    },
+    "624ec4e5082c": {
+      "name": "repo.list#1",
+      "ordinal": 1,
+      "args": [
+        {
+          "name": "method",
+          "value": "repo.list"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
           }
         },
         {
@@ -428,21 +338,18 @@
         }
       }
     },
-    "e3995d24a794": {
-      "name": "session.tabs.createTerminal#1",
+    "747c556da67a": {
+      "name": "repo.list#1",
       "ordinal": 1,
       "args": [
         {
           "name": "method",
-          "value": "session.tabs.createTerminal"
+          "value": "repo.list"
         },
         {
           "name": "params",
           "value": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:repo-9::/w"
+            "$rpc": "absent"
           }
         },
         {
@@ -462,29 +369,18 @@
         }
       }
     },
-    "eb79a9b3682a": {
-      "status": "fulfilled",
-      "startedAt": 0,
-      "settledAt": 0,
-      "value": {
-        "$rpc": "undefined"
-      }
-    },
-    "f9b284ac2424": {
-      "name": "session.tabs.createTerminal#1",
+    "8a72d3d14d44": {
+      "name": "repo.list#1",
       "ordinal": 1,
       "args": [
         {
           "name": "method",
-          "value": "session.tabs.createTerminal"
+          "value": "repo.list"
         },
         {
           "name": "params",
           "value": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:repo-9::/w"
+            "$rpc": "absent"
           }
         },
         {
@@ -495,25 +391,134 @@
         }
       ],
       "settlement": {
-        "status": "pending",
-        "startedAt": 0
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-1",
+          "ok": true,
+          "result": {
+            "error": "inner refused",
+            "ok": false
+          }
+        }
       }
     },
-    "fbddf84c2257": {
-      "name": "session.tabs.createTerminal#1",
-      "ordinal": 1,
+    "9270aeb7d9c6": {
+      "status": "pending",
+      "startedAt": 0
+    },
+    "9c16efc31903": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 5,
       "args": [
         {
           "name": "method",
-          "value": "session.tabs.createTerminal"
+          "value": "preflight.detectAgents"
         },
         {
           "name": "params",
           "value": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:repo-9::/w"
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": ["codex"]
+        }
+      }
+    },
+    "a4273b38df83": {
+      "launched": "unlaunched"
+    },
+    "b13ddf18a62e": {
+      "launched": {
+        "kind": "not-started",
+        "message": "Could not load the available agents."
+      }
+    },
+    "ba3fac1eb199": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "agent.launchReplay"
+        },
+        {
+          "name": "params",
+          "value": {
+            "agent": "codex",
+            "launchSource": "task_page",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "prompt": {
+              "delivery": "submit",
+              "text": "Fix the failing checks"
+            },
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            }
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "timeoutMs": 90000
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-4",
+          "ok": true,
+          "result": {
+            "outcome": {
+              "handle": "term-1",
+              "kind": "terminal"
+            },
+            "prompt": {
+              "delivery": "submit",
+              "outcome": "handed-to-terminal"
+            },
+            "receipt": {
+              "detail": "Started a terminal agent, the default for new agent tabs in your settings.",
+              "mode": "terminal",
+              "preferred": "terminal",
+              "reason": "user_default"
+            },
+            "worktreeId": "repo-9::/w"
+          }
+        }
+      }
+    },
+    "d68475063b62": {
+      "name": "repo.list#1",
+      "ordinal": 1,
+      "args": [
+        {
+          "name": "method",
+          "value": "repo.list"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
           }
         },
         {
@@ -539,23 +544,74 @@
         }
       }
     },
-    "fe1fe746e77a": {
-      "launched": "sent"
-    },
-    "fe53d3bce307": {
-      "name": "terminal.send#1",
-      "ordinal": 3,
+    "dae756300589": {
+      "name": "repo.list#1",
+      "ordinal": 1,
       "args": [
         {
           "name": "method",
-          "value": "terminal.send"
+          "value": "repo.list"
         },
         {
           "name": "params",
           "value": {
-            "enter": true,
-            "terminal": "term-1",
-            "text": "Fix the failing checks"
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "rejected",
+        "startedAt": 0,
+        "settledAt": 0,
+        "error": {
+          "category": "Error",
+          "message": "transport failure",
+          "isRpcDeliveryUnknown": true
+        }
+      }
+    },
+    "e0eef7c9fafe": {
+      "name": "repo.list#1",
+      "ordinal": 3,
+      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"repo.list\"}"
+    },
+    "e35d7003f64c": {
+      "launched": {
+        "kind": "not-started",
+        "message": "transport failure"
+      }
+    },
+    "eb79a9b3682a": {
+      "status": "fulfilled",
+      "startedAt": 0,
+      "settledAt": 0,
+      "value": {
+        "$rpc": "undefined"
+      }
+    },
+    "eb8d47f90956": {
+      "launched": {
+        "kind": "sent"
+      }
+    },
+    "f1d579dd459c": {
+      "name": "repo.list#1",
+      "ordinal": 1,
+      "args": [
+        {
+          "name": "method",
+          "value": "repo.list"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
           }
         },
         {
@@ -570,25 +626,29 @@
         "startedAt": 0,
         "settledAt": 0,
         "value": {
-          "id": "frame-2",
-          "ok": true,
-          "result": {
-            "send": {
-              "accepted": true
-            }
-          }
+          "error": {
+            "code": "refused",
+            "message": ""
+          },
+          "id": "frame-1",
+          "ok": false
         }
       }
+    },
+    "f49d184679d1": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 6,
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"preflight.detectAgents\"}"
     }
   },
   "recording": {
-    "scenario": "matrix-session.pr-triage-session.tabs.createterminal-1",
+    "scenario": "matrix-session.pr-triage-repo.list-1",
     "checkpoints": [
       {
         "id": "pr-triage-launch.prelude:pending",
         "observation": {
-          "sender": ["f9b284ac2424"],
-          "payloads": ["94d38f1838f6"],
+          "sender": ["35f85fe3b71c", "51d4cb56be85"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca"],
           "settlements": {
             "launch": "9270aeb7d9c6"
           },
@@ -599,132 +659,132 @@
       {
         "id": "pr-triage-launch.normal:launched",
         "observation": {
-          "sender": ["5093e98ba369", "fe53d3bce307"],
-          "payloads": ["94d38f1838f6", "280ce0d6f832"],
+          "sender": ["3e6a0417d2ee", "02188f091419", "9c16efc31903", "ba3fac1eb199"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1", "28339abecf78"],
           "settlements": {
             "launch": "eb79a9b3682a"
           },
-          "state": "fe1fe746e77a",
+          "state": "eb8d47f90956",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.result-absent:launched",
         "observation": {
-          "sender": ["e3995d24a794"],
-          "payloads": ["94d38f1838f6"],
+          "sender": ["747c556da67a", "02188f091419"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca"],
           "settlements": {
-            "launch": "478ad4afe83e"
+            "launch": "eb79a9b3682a"
           },
-          "state": "a4273b38df83",
+          "state": "01fc75db313f",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.result-null:launched",
         "observation": {
-          "sender": ["3f739faafdd4"],
-          "payloads": ["94d38f1838f6"],
+          "sender": ["48c68906a98a", "02188f091419"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca"],
           "settlements": {
-            "launch": "478ad4afe83e"
+            "launch": "eb79a9b3682a"
           },
-          "state": "a4273b38df83",
+          "state": "01fc75db313f",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.inner-ok-missing:launched",
         "observation": {
-          "sender": ["72295d1a7229"],
-          "payloads": ["94d38f1838f6"],
+          "sender": ["1b23dab83fcf", "02188f091419"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca"],
           "settlements": {
-            "launch": "478ad4afe83e"
+            "launch": "eb79a9b3682a"
           },
-          "state": "a4273b38df83",
+          "state": "01fc75db313f",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.inner-false-string-error:launched",
         "observation": {
-          "sender": ["5422be2c33b6"],
-          "payloads": ["94d38f1838f6"],
+          "sender": ["8a72d3d14d44", "02188f091419"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca"],
           "settlements": {
-            "launch": "478ad4afe83e"
+            "launch": "eb79a9b3682a"
           },
-          "state": "a4273b38df83",
+          "state": "01fc75db313f",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.inner-false-object-error:launched",
         "observation": {
-          "sender": ["fbddf84c2257"],
-          "payloads": ["94d38f1838f6"],
+          "sender": ["d68475063b62", "02188f091419"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca"],
           "settlements": {
-            "launch": "478ad4afe83e"
+            "launch": "eb79a9b3682a"
           },
-          "state": "a4273b38df83",
+          "state": "01fc75db313f",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.outer-refused:launched",
         "observation": {
-          "sender": ["dea9ae4cf53d"],
-          "payloads": ["94d38f1838f6"],
+          "sender": ["624ec4e5082c", "02188f091419"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca"],
           "settlements": {
-            "launch": "32a7c0ae7918"
+            "launch": "eb79a9b3682a"
           },
-          "state": "a4273b38df83",
+          "state": "331b3596787f",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.outer-refused-no-message:launched",
         "observation": {
-          "sender": ["ae5875338dfe"],
-          "payloads": ["94d38f1838f6"],
+          "sender": ["f1d579dd459c", "02188f091419"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca"],
           "settlements": {
-            "launch": "30ec57518c05"
+            "launch": "eb79a9b3682a"
           },
-          "state": "a4273b38df83",
+          "state": "b13ddf18a62e",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.method-not-found:launched",
         "observation": {
-          "sender": ["a46a4a08b27d"],
-          "payloads": ["94d38f1838f6"],
+          "sender": ["12e70439f294", "02188f091419"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca"],
           "settlements": {
-            "launch": "b948e8307e81"
+            "launch": "eb79a9b3682a"
           },
-          "state": "a4273b38df83",
+          "state": "1963ee2edae9",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.transport-rejection:launched",
         "observation": {
-          "sender": ["76bc1a917546"],
-          "payloads": ["94d38f1838f6"],
+          "sender": ["dae756300589", "02188f091419"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca"],
           "settlements": {
-            "launch": "a947768bc0ed"
+            "launch": "eb79a9b3682a"
           },
-          "state": "a4273b38df83",
+          "state": "e35d7003f64c",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.transport-rejection-no-message:launched",
         "observation": {
-          "sender": ["6bf6a76b4bf4"],
-          "payloads": ["94d38f1838f6"],
+          "sender": ["1321b4c8c0b8", "02188f091419"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca"],
           "settlements": {
-            "launch": "c7584e82c72f"
+            "launch": "eb79a9b3682a"
           },
-          "state": "a4273b38df83",
+          "state": "b13ddf18a62e",
           "effects": []
         }
       }
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-triage-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-triage-settings.get-1.json
similarity index 52%
rename from mobile/rpc-foundation/goldens/matrix-session.pr-triage-terminal.send-1.json
rename to mobile/rpc-foundation/goldens/matrix-session.pr-triage-settings.get-1.json
index 97a2d02a53d..41f4c304c5b 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-triage-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-triage-settings.get-1.json
@@ -3,30 +3,28 @@
   "family": "session.pr-triage",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
-  "scenarioSha256": "a288e105a0af6dbbd9657b84f7c4860826184fb7f50dabc6e31b114a70d7ca44",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
+  "scenarioSha256": "39923c0faa941865cc9aead881fef91ce5db117120033fe73665356a61a2ecc6",
   "platform": "darwin",
   "scenarioVersion": 1,
   "projectionVersion": 2,
   "goldenFormatVersion": 5,
   "values": {
-    "0fddcb81d17c": {
-      "name": "terminal.send#1",
-      "ordinal": 3,
+    "02188f091419": {
+      "name": "settings.get#1",
+      "ordinal": 2,
       "args": [
         {
           "name": "method",
-          "value": "terminal.send"
+          "value": "settings.get"
         },
         {
           "name": "params",
           "value": {
-            "enter": true,
-            "terminal": "term-1",
-            "text": "Fix the failing checks"
+            "$rpc": "absent"
           }
         },
         {
@@ -41,279 +39,30 @@
         "startedAt": 0,
         "settledAt": 0,
         "value": {
-          "error": {
-            "code": "refused",
-            "message": "outer refused"
-          },
           "id": "frame-2",
-          "ok": false
-        }
-      }
-    },
-    "1953443d1eef": {
-      "status": "rejected",
-      "startedAt": 0,
-      "settledAt": 0,
-      "error": {
-        "category": "Error",
-        "message": "The host sent a reply this app could not read (terminal.send)",
-        "isRpcDeliveryUnknown": false
-      }
-    },
-    "280ce0d6f832": {
-      "name": "terminal.send#1",
-      "ordinal": 4,
-      "json": "{\"id\":\"frame-2\",\"deviceToken\":\"recording-device\",\"method\":\"terminal.send\",\"params\":{\"terminal\":\"term-1\",\"text\":\"Fix the failing checks\",\"enter\":true}}"
-    },
-    "32a7c0ae7918": {
-      "status": "rejected",
-      "startedAt": 0,
-      "settledAt": 0,
-      "error": {
-        "category": "Error",
-        "message": "outer refused",
-        "isRpcDeliveryUnknown": false
-      }
-    },
-    "5093e98ba369": {
-      "name": "session.tabs.createTerminal#1",
-      "ordinal": 1,
-      "args": [
-        {
-          "name": "method",
-          "value": "session.tabs.createTerminal"
-        },
-        {
-          "name": "params",
-          "value": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:repo-9::/w"
-          }
-        },
-        {
-          "name": "options",
-          "value": {
-            "$rpc": "absent"
-          }
-        }
-      ],
-      "settlement": {
-        "status": "fulfilled",
-        "startedAt": 0,
-        "settledAt": 0,
-        "value": {
-          "id": "frame-1",
           "ok": true,
           "result": {
-            "tab": {
-              "id": "tab-1",
-              "terminal": "term-1",
-              "title": "Agent",
-              "type": "terminal"
+            "settings": {
+              "defaultTuiAgent": "codex",
+              "disabledTuiAgents": []
             }
           }
         }
       }
     },
-    "5101a111b6fc": {
-      "name": "terminal.send#1",
-      "ordinal": 3,
-      "args": [
-        {
-          "name": "method",
-          "value": "terminal.send"
-        },
-        {
-          "name": "params",
-          "value": {
-            "enter": true,
-            "terminal": "term-1",
-            "text": "Fix the failing checks"
-          }
-        },
-        {
-          "name": "options",
-          "value": {
-            "$rpc": "absent"
-          }
-        }
-      ],
-      "settlement": {
-        "status": "fulfilled",
-        "startedAt": 0,
-        "settledAt": 0,
-        "value": {
-          "id": "frame-2",
-          "ok": true
-        }
-      }
-    },
-    "52f741886b88": {
-      "name": "terminal.send#1",
-      "ordinal": 3,
-      "args": [
-        {
-          "name": "method",
-          "value": "terminal.send"
-        },
-        {
-          "name": "params",
-          "value": {
-            "enter": true,
-            "terminal": "term-1",
-            "text": "Fix the failing checks"
-          }
-        },
-        {
-          "name": "options",
-          "value": {
-            "$rpc": "absent"
-          }
-        }
-      ],
-      "settlement": {
-        "status": "fulfilled",
-        "startedAt": 0,
-        "settledAt": 0,
-        "value": {
-          "id": "frame-2",
-          "ok": true,
-          "result": {
-            "error": "refused"
-          }
-        }
-      }
-    },
-    "6ccc8bb71fd9": {
-      "name": "terminal.send#1",
-      "ordinal": 3,
-      "args": [
-        {
-          "name": "method",
-          "value": "terminal.send"
-        },
-        {
-          "name": "params",
-          "value": {
-            "enter": true,
-            "terminal": "term-1",
-            "text": "Fix the failing checks"
-          }
-        },
-        {
-          "name": "options",
-          "value": {
-            "$rpc": "absent"
-          }
-        }
-      ],
-      "settlement": {
-        "status": "rejected",
-        "startedAt": 0,
-        "settledAt": 0,
-        "error": {
-          "category": "Error",
-          "message": "transport failure",
-          "isRpcDeliveryUnknown": true
-        }
-      }
-    },
-    "75252c821440": {
-      "name": "terminal.send#1",
-      "ordinal": 3,
-      "args": [
-        {
-          "name": "method",
-          "value": "terminal.send"
-        },
-        {
-          "name": "params",
-          "value": {
-            "enter": true,
-            "terminal": "term-1",
-            "text": "Fix the failing checks"
-          }
-        },
-        {
-          "name": "options",
-          "value": {
-            "$rpc": "absent"
-          }
-        }
-      ],
-      "settlement": {
-        "status": "fulfilled",
-        "startedAt": 0,
-        "settledAt": 0,
-        "value": {
-          "id": "frame-2",
-          "ok": true,
-          "result": {
-            "$rpc": "null"
-          }
-        }
-      }
-    },
-    "9270aeb7d9c6": {
-      "status": "pending",
-      "startedAt": 0
-    },
-    "94d38f1838f6": {
-      "name": "session.tabs.createTerminal#1",
+    "0ba58e9fadf7": {
+      "name": "settings.get#1",
       "ordinal": 2,
-      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"session.tabs.createTerminal\",\"params\":{\"worktree\":\"id:repo-9::/w\",\"activate\":false,\"select\":true,\"navigation\":\"caller\"}}"
-    },
-    "94fd7b6e1923": {
-      "name": "terminal.send#1",
-      "ordinal": 3,
       "args": [
         {
           "name": "method",
-          "value": "terminal.send"
+          "value": "settings.get"
         },
         {
           "name": "params",
-          "value": {
-            "enter": true,
-            "terminal": "term-1",
-            "text": "Fix the failing checks"
-          }
-        },
-        {
-          "name": "options",
           "value": {
             "$rpc": "absent"
           }
-        }
-      ],
-      "settlement": {
-        "status": "rejected",
-        "startedAt": 0,
-        "settledAt": 0,
-        "error": {
-          "category": "Error",
-          "message": "",
-          "isRpcDeliveryUnknown": true
-        }
-      }
-    },
-    "9d6948ff3085": {
-      "name": "terminal.send#1",
-      "ordinal": 3,
-      "args": [
-        {
-          "name": "method",
-          "value": "terminal.send"
-        },
-        {
-          "name": "params",
-          "value": {
-            "enter": true,
-            "terminal": "term-1",
-            "text": "Fix the failing checks"
-          }
         },
         {
           "name": "options",
@@ -336,33 +85,18 @@
         }
       }
     },
-    "a21f478354cc": {
-      "status": "rejected",
-      "startedAt": 0,
-      "settledAt": 0,
-      "error": {
-        "category": "Error",
-        "message": "Failed to send prompt",
-        "isRpcDeliveryUnknown": false
-      }
-    },
-    "a4273b38df83": {
-      "launched": "unlaunched"
-    },
-    "a89e0dd4a790": {
-      "name": "terminal.send#1",
-      "ordinal": 3,
+    "0ca529648be4": {
+      "name": "settings.get#1",
+      "ordinal": 2,
       "args": [
         {
           "name": "method",
-          "value": "terminal.send"
+          "value": "settings.get"
         },
         {
           "name": "params",
           "value": {
-            "enter": true,
-            "terminal": "term-1",
-            "text": "Fix the failing checks"
+            "$rpc": "absent"
           }
         },
         {
@@ -373,53 +107,39 @@
         }
       ],
       "settlement": {
-        "status": "fulfilled",
+        "status": "rejected",
         "startedAt": 0,
         "settledAt": 0,
-        "value": {
-          "id": "frame-2",
-          "ok": true,
-          "result": {
-            "error": "inner refused",
-            "ok": false
-          }
+        "error": {
+          "category": "Error",
+          "message": "",
+          "isRpcDeliveryUnknown": true
         }
       }
     },
-    "a947768bc0ed": {
-      "status": "rejected",
-      "startedAt": 0,
-      "settledAt": 0,
-      "error": {
-        "category": "Error",
-        "message": "transport failure",
-        "isRpcDeliveryUnknown": true
+    "1963ee2edae9": {
+      "launched": {
+        "kind": "not-started",
+        "message": "Unknown method"
       }
     },
-    "b948e8307e81": {
-      "status": "rejected",
-      "startedAt": 0,
-      "settledAt": 0,
-      "error": {
-        "category": "Error",
-        "message": "Unknown method",
-        "isRpcDeliveryUnknown": false
-      }
+    "1c2564f1daca": {
+      "name": "settings.get#1",
+      "ordinal": 4,
+      "json": "{\"id\":\"frame-2\",\"deviceToken\":\"recording-device\",\"method\":\"settings.get\"}"
     },
-    "bccc77511918": {
-      "name": "terminal.send#1",
-      "ordinal": 3,
+    "1c5359ea3f7d": {
+      "name": "settings.get#1",
+      "ordinal": 2,
       "args": [
         {
           "name": "method",
-          "value": "terminal.send"
+          "value": "settings.get"
         },
         {
           "name": "params",
           "value": {
-            "enter": true,
-            "terminal": "term-1",
-            "text": "Fix the failing checks"
+            "$rpc": "absent"
           }
         },
         {
@@ -445,20 +165,29 @@
         }
       }
     },
-    "bf156998a035": {
-      "name": "terminal.send#1",
-      "ordinal": 3,
+    "28339abecf78": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 8,
+      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"agent.launchReplay\",\"params\":{\"agent\":\"codex\",\"operationId\":\"1767225600000-00000000000040008000000000000001\",\"target\":{\"kind\":\"existing\",\"worktree\":\"id:repo-9::/w\"},\"prompt\":{\"text\":\"Fix the failing checks\",\"delivery\":\"submit\"},\"launchSource\":\"task_page\"}}"
+    },
+    "331b3596787f": {
+      "launched": {
+        "kind": "not-started",
+        "message": "outer refused"
+      }
+    },
+    "34f3a5b8bd78": {
+      "name": "settings.get#1",
+      "ordinal": 2,
       "args": [
         {
           "name": "method",
-          "value": "terminal.send"
+          "value": "settings.get"
         },
         {
           "name": "params",
           "value": {
-            "enter": true,
-            "terminal": "term-1",
-            "text": "Fix the failing checks"
+            "$rpc": "absent"
           }
         },
         {
@@ -482,39 +211,18 @@
         }
       }
     },
-    "c7584e82c72f": {
-      "status": "rejected",
-      "startedAt": 0,
-      "settledAt": 0,
-      "error": {
-        "category": "Error",
-        "message": "",
-        "isRpcDeliveryUnknown": true
-      }
-    },
-    "eb79a9b3682a": {
-      "status": "fulfilled",
-      "startedAt": 0,
-      "settledAt": 0,
-      "value": {
-        "$rpc": "undefined"
-      }
-    },
-    "f9b284ac2424": {
-      "name": "session.tabs.createTerminal#1",
+    "35f85fe3b71c": {
+      "name": "repo.list#1",
       "ordinal": 1,
       "args": [
         {
           "name": "method",
-          "value": "session.tabs.createTerminal"
+          "value": "repo.list"
         },
         {
           "name": "params",
           "value": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:repo-9::/w"
+            "$rpc": "absent"
           }
         },
         {
@@ -529,23 +237,114 @@
         "startedAt": 0
       }
     },
-    "fe1fe746e77a": {
-      "launched": "sent"
-    },
-    "fe53d3bce307": {
-      "name": "terminal.send#1",
-      "ordinal": 3,
+    "3e6a0417d2ee": {
+      "name": "repo.list#1",
+      "ordinal": 1,
       "args": [
         {
           "name": "method",
-          "value": "terminal.send"
+          "value": "repo.list"
         },
         {
           "name": "params",
           "value": {
-            "enter": true,
-            "terminal": "term-1",
-            "text": "Fix the failing checks"
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-1",
+          "ok": true,
+          "result": {
+            "repos": [
+              {
+                "id": "repo-9"
+              }
+            ]
+          }
+        }
+      }
+    },
+    "51d4cb56be85": {
+      "name": "settings.get#1",
+      "ordinal": 2,
+      "args": [
+        {
+          "name": "method",
+          "value": "settings.get"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "pending",
+        "startedAt": 0
+      }
+    },
+    "566d8202b582": {
+      "name": "settings.get#1",
+      "ordinal": 2,
+      "args": [
+        {
+          "name": "method",
+          "value": "settings.get"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "rejected",
+        "startedAt": 0,
+        "settledAt": 0,
+        "error": {
+          "category": "Error",
+          "message": "transport failure",
+          "isRpcDeliveryUnknown": true
+        }
+      }
+    },
+    "69518e60477b": {
+      "name": "settings.get#1",
+      "ordinal": 2,
+      "args": [
+        {
+          "name": "method",
+          "value": "settings.get"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
           }
         },
         {
@@ -563,22 +362,299 @@
           "id": "frame-2",
           "ok": true,
           "result": {
-            "send": {
-              "accepted": true
+            "$rpc": "null"
+          }
+        }
+      }
+    },
+    "753cc167886c": {
+      "launched": {
+        "kind": "not-started",
+        "message": "Cannot read properties of null (reading 'settings')"
+      }
+    },
+    "86798e4821d1": {
+      "name": "settings.get#1",
+      "ordinal": 2,
+      "args": [
+        {
+          "name": "method",
+          "value": "settings.get"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-2",
+          "ok": true,
+          "result": {
+            "error": "inner refused",
+            "ok": false
+          }
+        }
+      }
+    },
+    "9270aeb7d9c6": {
+      "status": "pending",
+      "startedAt": 0
+    },
+    "98bd3a5fda2b": {
+      "name": "settings.get#1",
+      "ordinal": 2,
+      "args": [
+        {
+          "name": "method",
+          "value": "settings.get"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-2",
+          "ok": true
+        }
+      }
+    },
+    "9b538e8b95f3": {
+      "launched": {
+        "kind": "not-started",
+        "message": "Cannot read properties of undefined (reading 'settings')"
+      }
+    },
+    "9c16efc31903": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 5,
+      "args": [
+        {
+          "name": "method",
+          "value": "preflight.detectAgents"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": ["codex"]
+        }
+      }
+    },
+    "a4273b38df83": {
+      "launched": "unlaunched"
+    },
+    "b13ddf18a62e": {
+      "launched": {
+        "kind": "not-started",
+        "message": "Could not load the available agents."
+      }
+    },
+    "ba3fac1eb199": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "agent.launchReplay"
+        },
+        {
+          "name": "params",
+          "value": {
+            "agent": "codex",
+            "launchSource": "task_page",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "prompt": {
+              "delivery": "submit",
+              "text": "Fix the failing checks"
+            },
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
             }
           }
+        },
+        {
+          "name": "options",
+          "value": {
+            "timeoutMs": 90000
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-4",
+          "ok": true,
+          "result": {
+            "outcome": {
+              "handle": "term-1",
+              "kind": "terminal"
+            },
+            "prompt": {
+              "delivery": "submit",
+              "outcome": "handed-to-terminal"
+            },
+            "receipt": {
+              "detail": "Started a terminal agent, the default for new agent tabs in your settings.",
+              "mode": "terminal",
+              "preferred": "terminal",
+              "reason": "user_default"
+            },
+            "worktreeId": "repo-9::/w"
+          }
+        }
+      }
+    },
+    "ceb5fe72c101": {
+      "name": "settings.get#1",
+      "ordinal": 2,
+      "args": [
+        {
+          "name": "method",
+          "value": "settings.get"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "error": {
+            "code": "refused",
+            "message": "outer refused"
+          },
+          "id": "frame-2",
+          "ok": false
+        }
+      }
+    },
+    "e0eef7c9fafe": {
+      "name": "repo.list#1",
+      "ordinal": 3,
+      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"repo.list\"}"
+    },
+    "e35d7003f64c": {
+      "launched": {
+        "kind": "not-started",
+        "message": "transport failure"
+      }
+    },
+    "eb79a9b3682a": {
+      "status": "fulfilled",
+      "startedAt": 0,
+      "settledAt": 0,
+      "value": {
+        "$rpc": "undefined"
+      }
+    },
+    "eb8d47f90956": {
+      "launched": {
+        "kind": "sent"
+      }
+    },
+    "f49d184679d1": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 6,
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"preflight.detectAgents\"}"
+    },
+    "fb9f08890f70": {
+      "name": "settings.get#1",
+      "ordinal": 2,
+      "args": [
+        {
+          "name": "method",
+          "value": "settings.get"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-2",
+          "ok": true,
+          "result": {
+            "error": "refused"
+          }
         }
       }
     }
   },
   "recording": {
-    "scenario": "matrix-session.pr-triage-terminal.send-1",
+    "scenario": "matrix-session.pr-triage-settings.get-1",
     "checkpoints": [
       {
         "id": "pr-triage-launch.prelude:pending",
         "observation": {
-          "sender": ["f9b284ac2424"],
-          "payloads": ["94d38f1838f6"],
+          "sender": ["35f85fe3b71c", "51d4cb56be85"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca"],
           "settlements": {
             "launch": "9270aeb7d9c6"
           },
@@ -589,132 +665,132 @@
       {
         "id": "pr-triage-launch.normal:launched",
         "observation": {
-          "sender": ["5093e98ba369", "fe53d3bce307"],
-          "payloads": ["94d38f1838f6", "280ce0d6f832"],
+          "sender": ["3e6a0417d2ee", "02188f091419", "9c16efc31903", "ba3fac1eb199"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1", "28339abecf78"],
           "settlements": {
             "launch": "eb79a9b3682a"
           },
-          "state": "fe1fe746e77a",
+          "state": "eb8d47f90956",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.result-absent:launched",
         "observation": {
-          "sender": ["5093e98ba369", "5101a111b6fc"],
-          "payloads": ["94d38f1838f6", "280ce0d6f832"],
+          "sender": ["3e6a0417d2ee", "98bd3a5fda2b", "9c16efc31903"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1"],
           "settlements": {
-            "launch": "1953443d1eef"
+            "launch": "eb79a9b3682a"
           },
-          "state": "a4273b38df83",
+          "state": "9b538e8b95f3",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.result-null:launched",
         "observation": {
-          "sender": ["5093e98ba369", "75252c821440"],
-          "payloads": ["94d38f1838f6", "280ce0d6f832"],
+          "sender": ["3e6a0417d2ee", "69518e60477b", "9c16efc31903"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1"],
           "settlements": {
-            "launch": "1953443d1eef"
+            "launch": "eb79a9b3682a"
           },
-          "state": "a4273b38df83",
+          "state": "753cc167886c",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.inner-ok-missing:launched",
         "observation": {
-          "sender": ["5093e98ba369", "52f741886b88"],
-          "payloads": ["94d38f1838f6", "280ce0d6f832"],
+          "sender": ["3e6a0417d2ee", "fb9f08890f70", "9c16efc31903", "ba3fac1eb199"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1", "28339abecf78"],
           "settlements": {
             "launch": "eb79a9b3682a"
           },
-          "state": "fe1fe746e77a",
+          "state": "eb8d47f90956",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.inner-false-string-error:launched",
         "observation": {
-          "sender": ["5093e98ba369", "a89e0dd4a790"],
-          "payloads": ["94d38f1838f6", "280ce0d6f832"],
+          "sender": ["3e6a0417d2ee", "86798e4821d1", "9c16efc31903", "ba3fac1eb199"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1", "28339abecf78"],
           "settlements": {
             "launch": "eb79a9b3682a"
           },
-          "state": "fe1fe746e77a",
+          "state": "eb8d47f90956",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.inner-false-object-error:launched",
         "observation": {
-          "sender": ["5093e98ba369", "bccc77511918"],
-          "payloads": ["94d38f1838f6", "280ce0d6f832"],
+          "sender": ["3e6a0417d2ee", "1c5359ea3f7d", "9c16efc31903", "ba3fac1eb199"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1", "28339abecf78"],
           "settlements": {
             "launch": "eb79a9b3682a"
           },
-          "state": "fe1fe746e77a",
+          "state": "eb8d47f90956",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.outer-refused:launched",
         "observation": {
-          "sender": ["5093e98ba369", "0fddcb81d17c"],
-          "payloads": ["94d38f1838f6", "280ce0d6f832"],
+          "sender": ["3e6a0417d2ee", "ceb5fe72c101", "9c16efc31903"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1"],
           "settlements": {
-            "launch": "32a7c0ae7918"
+            "launch": "eb79a9b3682a"
           },
-          "state": "a4273b38df83",
+          "state": "331b3596787f",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.outer-refused-no-message:launched",
         "observation": {
-          "sender": ["5093e98ba369", "bf156998a035"],
-          "payloads": ["94d38f1838f6", "280ce0d6f832"],
+          "sender": ["3e6a0417d2ee", "34f3a5b8bd78", "9c16efc31903"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1"],
           "settlements": {
-            "launch": "a21f478354cc"
+            "launch": "eb79a9b3682a"
           },
-          "state": "a4273b38df83",
+          "state": "b13ddf18a62e",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.method-not-found:launched",
         "observation": {
-          "sender": ["5093e98ba369", "9d6948ff3085"],
-          "payloads": ["94d38f1838f6", "280ce0d6f832"],
+          "sender": ["3e6a0417d2ee", "0ba58e9fadf7", "9c16efc31903"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1"],
           "settlements": {
-            "launch": "b948e8307e81"
+            "launch": "eb79a9b3682a"
           },
-          "state": "a4273b38df83",
+          "state": "1963ee2edae9",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.transport-rejection:launched",
         "observation": {
-          "sender": ["5093e98ba369", "6ccc8bb71fd9"],
-          "payloads": ["94d38f1838f6", "280ce0d6f832"],
+          "sender": ["3e6a0417d2ee", "566d8202b582", "9c16efc31903"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1"],
           "settlements": {
-            "launch": "a947768bc0ed"
+            "launch": "eb79a9b3682a"
           },
-          "state": "a4273b38df83",
+          "state": "e35d7003f64c",
           "effects": []
         }
       },
       {
         "id": "pr-triage-launch.transport-rejection-no-message:launched",
         "observation": {
-          "sender": ["5093e98ba369", "94fd7b6e1923"],
-          "payloads": ["94d38f1838f6", "280ce0d6f832"],
+          "sender": ["3e6a0417d2ee", "0ca529648be4", "9c16efc31903"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1"],
           "settlements": {
-            "launch": "c7584e82c72f"
+            "launch": "eb79a9b3682a"
           },
-          "state": "a4273b38df83",
+          "state": "b13ddf18a62e",
           "effects": []
         }
       }
diff --git a/mobile/rpc-foundation/goldens/matrix-session.review-branch-diff-git.branchdiff-1.json b/mobile/rpc-foundation/goldens/matrix-session.review-branch-diff-git.branchdiff-1.json
index d76075f652a..ee137c51a0d 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.review-branch-diff-git.branchdiff-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.review-branch-diff-git.branchdiff-1.json
@@ -3,9 +3,9 @@
   "family": "session.review-branch-diff",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "05d42780508d46d5c88f0c987448dc693bb49208a4298e6cf2f0d5e3979066af",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-1.json b/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-1.json
index 2b37aed3254..027ac073eae 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-1.json
@@ -3,9 +3,9 @@
   "family": "session.review-file-diff",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "9567f8594e0287954c1b236b2f0617ed06be04d2b97f82e527c8e3ce732e65c1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-2.json b/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-2.json
index 3678781e334..3eb1f408756 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-2.json
@@ -3,9 +3,9 @@
   "family": "session.review-file-diff",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "95c8c5451aabbbebab8422ccd867b70e000ac62aacf1d231ad0d181cbec3a2b0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-3.json b/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-3.json
index f3515532a9d..47bc4a70851 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-3.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-3.json
@@ -3,9 +3,9 @@
   "family": "session.review-file-diff",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "91558fbfdf10c17a363e38cc0489b1a59e8b1657c51f7444840b2e7d37646851",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.discard-1.json b/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.discard-1.json
index eb3c0d69f5b..3426a1cfd39 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.discard-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.discard-1.json
@@ -3,10 +3,10 @@
   "family": "session.review-git-mutations",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "dc3a746274b4197b02b0b3060bbf8ab0f67eb54355c8b9888e1f061e37f777af",
   "scenarioSha256": "651cb070a4b4ba7deddeb37c08886094b83f006e7cbe2bef65d5433ce0430dff",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.stage-1.json b/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.stage-1.json
index 1e2932ed581..82d7a26da4f 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.stage-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.stage-1.json
@@ -3,10 +3,10 @@
   "family": "session.review-git-mutations",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "dc3a746274b4197b02b0b3060bbf8ab0f67eb54355c8b9888e1f061e37f777af",
   "scenarioSha256": "e0ce643010302d304ba3611bd43932c6cdd0fa9290a3ecd4fffb4fc92c758b77",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.stage-2.json b/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.stage-2.json
index 11cce5dfce0..4d56d16551b 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.stage-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.stage-2.json
@@ -3,10 +3,10 @@
   "family": "session.review-git-mutations",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "dc3a746274b4197b02b0b3060bbf8ab0f67eb54355c8b9888e1f061e37f777af",
   "scenarioSha256": "c6b3b4be6b55daf53ee1f5ff755e73a032c4da5379f90f4973736c032eb79414",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-session.review-send-sheet-session.tabs.list-1.json b/mobile/rpc-foundation/goldens/matrix-session.review-send-sheet-session.tabs.list-1.json
index 1d853b8e298..e62d6c256c1 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.review-send-sheet-session.tabs.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.review-send-sheet-session.tabs.list-1.json
@@ -3,10 +3,10 @@
   "family": "session.review-send-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "dc3a746274b4197b02b0b3060bbf8ab0f67eb54355c8b9888e1f061e37f777af",
   "scenarioSha256": "a71815661dee6129a1b133c398b37ea89a9e4939b45626dada16889acabb2afe",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-session.startup-worktree.activate-1.json b/mobile/rpc-foundation/goldens/matrix-session.startup-worktree.activate-1.json
index cd8bed2da2d..81eb128ff1d 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.startup-worktree.activate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.startup-worktree.activate-1.json
@@ -3,9 +3,9 @@
   "family": "session.startup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "6b08c394e37fd572cf63a4c11934247d379008f11117aa5af33b2926fbd32d1e",
   "scenarioSha256": "f4d1e8eff8e1a3dc7b04fcf5dafb2befca2211922443f1958ba801c49f488152",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.startup-worktree.activate-2.json b/mobile/rpc-foundation/goldens/matrix-session.startup-worktree.activate-2.json
index 4d5b762c3c5..2c4bdf70b9a 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.startup-worktree.activate-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.startup-worktree.activate-2.json
@@ -3,9 +3,9 @@
   "family": "session.startup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "6b08c394e37fd572cf63a4c11934247d379008f11117aa5af33b2926fbd32d1e",
   "scenarioSha256": "7ba969778e57cc5591365c688ef13ce5b09c41db9fa3666d61bbbbfe4e3fd35c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.tab-activation-session.tabs.activate-1.json b/mobile/rpc-foundation/goldens/matrix-session.tab-activation-session.tabs.activate-1.json
index 1ff762bc4bc..3463be7f434 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.tab-activation-session.tabs.activate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.tab-activation-session.tabs.activate-1.json
@@ -3,9 +3,9 @@
   "family": "session.tab-activation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "d25fc19d4e3e9b12f2a60a076ea10741e13fc45dcd9a76bd3a9d88432c3e6fbe",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.tab-activation-terminal.focus-1.json b/mobile/rpc-foundation/goldens/matrix-session.tab-activation-terminal.focus-1.json
index 5a3bd62dc58..d7b4b267084 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.tab-activation-terminal.focus-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.tab-activation-terminal.focus-1.json
@@ -3,9 +3,9 @@
   "family": "session.tab-activation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "5b050af6f02aa90f66340838cb5cc53c8fc0d5693d313b653c23881150384874",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.tab-close-session-session.tabs.close-1.json b/mobile/rpc-foundation/goldens/matrix-session.tab-close-session-session.tabs.close-1.json
index 67420446148..784a6ae9748 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.tab-close-session-session.tabs.close-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.tab-close-session-session.tabs.close-1.json
@@ -3,9 +3,9 @@
   "family": "session.tab-close-session",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "64c12ae20aaf7202c2271134d57e4312127e8f909ad086ba69b4662bbd749bb0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.tab-close-terminal.close-1.json b/mobile/rpc-foundation/goldens/matrix-session.tab-close-terminal.close-1.json
index bf6bf4917a0..0a21b877d03 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.tab-close-terminal.close-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.tab-close-terminal.close-1.json
@@ -3,9 +3,9 @@
   "family": "session.tab-close",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "89141e3e400feea78460ede72d5269bdc885f6d3de75388542b4b7d6dff2840d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.tab-documents-markdown.readtab-1.json b/mobile/rpc-foundation/goldens/matrix-session.tab-documents-markdown.readtab-1.json
index 1b7034ef3cb..5d7236ff406 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.tab-documents-markdown.readtab-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.tab-documents-markdown.readtab-1.json
@@ -3,9 +3,9 @@
   "family": "session.tab-documents",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "c97d925b63253e87ada0777e95a24ccf4e4e1682eda048800b44e335767df648",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.tab-rename-terminal.rename-1.json b/mobile/rpc-foundation/goldens/matrix-session.tab-rename-terminal.rename-1.json
index 566446ff9dc..f0f1627f7ae 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.tab-rename-terminal.rename-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.tab-rename-terminal.rename-1.json
@@ -3,9 +3,9 @@
   "family": "session.tab-rename",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "55c461287c1d8fb6de3c4fe28f801d095678dcf52bfcce39c336c9d61e8be908",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.tab-reveal-session.tabs.activate-1.json b/mobile/rpc-foundation/goldens/matrix-session.tab-reveal-session.tabs.activate-1.json
index ecc70ed21b0..1bdde6edc30 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.tab-reveal-session.tabs.activate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.tab-reveal-session.tabs.activate-1.json
@@ -3,9 +3,9 @@
   "family": "session.tab-reveal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "73366226aeaec1581aeeb47219fc703917143cfd7f6a2eb01d7bd703a7c7612d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.tab-reveal-session.tabs.list-1.json b/mobile/rpc-foundation/goldens/matrix-session.tab-reveal-session.tabs.list-1.json
index 6b02116b0cc..a25108d9756 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.tab-reveal-session.tabs.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.tab-reveal-session.tabs.list-1.json
@@ -3,9 +3,9 @@
   "family": "session.tab-reveal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "c38f2bc5c9faca0774dfe202137877bada9deba165c5e9c955cbe67eae0cbdd9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.tabs-stream-health-session.tabs.list-1.json b/mobile/rpc-foundation/goldens/matrix-session.tabs-stream-health-session.tabs.list-1.json
index 64b718cbcf0..5c7543bdf53 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.tabs-stream-health-session.tabs.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.tabs-stream-health-session.tabs.list-1.json
@@ -3,9 +3,9 @@
   "family": "session.tabs-stream-health",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "fab12524a09049d976da752cbe1b837a0aee04ce6e1eef75cbf517c862cb0d4a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-display-mode-terminal.setdisplaymode-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-display-mode-terminal.setdisplaymode-1.json
index e464c9e9296..40d6c4a181d 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-display-mode-terminal.setdisplaymode-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-display-mode-terminal.setdisplaymode-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-display-mode",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9e90ad39a8d4257adf30166757a6364c4710dc3ae9f06365f80a3dd8f1c94d89",
   "scenarioSha256": "2ae1839ae5f4fb98c2ef250fb5e071508ec1376e737dab28ac589c08f1a42b0e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-orchestration.workerterminaluserinput-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-orchestration.workerterminaluserinput-1.json
index 485d980dcf7..1d2dc157028 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-orchestration.workerterminaluserinput-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-orchestration.workerterminaluserinput-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-gesture-input",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9d119d5ec320e2538105d6ff673b9f4b8e3decbe46527947489dffbcf2ac0472",
   "scenarioSha256": "27e0d44ca22593ff2ecef93de075508863024f3f10f00161818962c07e7b59e1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-terminal.clearbuffer-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-terminal.clearbuffer-1.json
index 3fb11b9d3ea..39901bcf2a0 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-terminal.clearbuffer-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-terminal.clearbuffer-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-gesture-input",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9d119d5ec320e2538105d6ff673b9f4b8e3decbe46527947489dffbcf2ac0472",
   "scenarioSha256": "53ffb52ef015193fdaaeb1ac5a1c88488a607e6cec2e39e87d1e4e3173321983",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-terminal.send-1.json
index 63bf0162cf3..24f8e46e4f7 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-terminal.send-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-gesture-input",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9d119d5ec320e2538105d6ff673b9f4b8e3decbe46527947489dffbcf2ac0472",
   "scenarioSha256": "d7bc4d7a3e7e54accd4b51eef7e83ae70cc0c794738a83af222503a0f12ba70f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-input-send-orchestration.workerterminaluserinput-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-input-send-orchestration.workerterminaluserinput-1.json
index 165b7a8cad4..3d2346bc10d 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-input-send-orchestration.workerterminaluserinput-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-input-send-orchestration.workerterminaluserinput-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-input-send",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "cde3cac5407ef731315d18fc855b2696b9bfd30b90cb43d4a2cc812059cdd987",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-input-send-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-input-send-terminal.send-1.json
index 8e8bfa41e26..7ca79f596e7 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-input-send-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-input-send-terminal.send-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-input-send",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "6575a0f89894d9b66e50a73446dfe92293ceccc7048b556f1ff114fd3ce05b8e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-inventory-terminal.list-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-inventory-terminal.list-1.json
index 2bd6c7e42d8..6e4f7eff7d5 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-inventory-terminal.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-inventory-terminal.list-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "12f1006d704e362552317a3afcb4db4366146da3a863a1c55b524c6fc1b9757a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-orchestration.workerterminaluserinput-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-orchestration.workerterminaluserinput-1.json
index d3556192848..197fee284e7 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-orchestration.workerterminaluserinput-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-orchestration.workerterminaluserinput-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "27c4f13ae43042cf5e6b5ca95e9c1a37db2f1f0c08b31a1164bb56cf0967549a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-settings.get-1.json
index c792245b034..21efbc2287c 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "449f8c793a371dddf1bb9b3beb36b2dbd9b991918dae1f6290df75fe6d2aeace",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-terminal.send-1.json
index eb67eccd6e2..c941a56b38c 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-terminal.send-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "5cc67ab6df80a81be814a16cb60dcc4c703b0fc17594e409697a9fdeb0edeb76",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.worktree-connection-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-session.worktree-connection-repo.list-1.json
index f8d65edad58..9176b157e96 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.worktree-connection-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.worktree-connection-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "session.worktree-connection",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "e7fb7a8083aac4c8c5edc7dd52465ca53bfcded00bf8b1ec18ae7604651bbe32",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.worktree-connection-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-session.worktree-connection-settings.get-1.json
index 6f6eb1d7114..51bda4e452e 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.worktree-connection-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.worktree-connection-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "session.worktree-connection",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "b1e1b221ab7bfe5356c89a09cf4252613c78aecab48b2212e84ac7de885ec569",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings-agent-read-preflight.detectremoteagents-1.json b/mobile/rpc-foundation/goldens/matrix-settings-agent-read-preflight.detectremoteagents-1.json
index f15c5b52bed..d47e75261b5 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings-agent-read-preflight.detectremoteagents-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings-agent-read-preflight.detectremoteagents-1.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "a0effc9a0be519ccd18c1b1abfc8b497cd3858b89ea8d345ac0f8bd6d195cf21",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings-agent-read-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-settings-agent-read-repo.list-1.json
index 1171f24634e..ebe0f8e04dd 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings-agent-read-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings-agent-read-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "c21b2e0e97fab86664f634cc99d77dd587df4af4d02e6286c8380e09844096b2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings-agent-read-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings-agent-read-settings.get-1.json
index 63646921bd5..35a80d20721 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings-agent-read-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings-agent-read-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "46c4e32a921612c736c8cf45ff72ed513431c917ed3dd03f289c0ba4c28d6adb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings-best-effort-settings.update-1.json b/mobile/rpc-foundation/goldens/matrix-settings-best-effort-settings.update-1.json
index b8040e9d5bf..658fecfc329 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings-best-effort-settings.update-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings-best-effort-settings.update-1.json
@@ -3,9 +3,9 @@
   "family": "settings-best-effort",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "cf671da175d50a4c2e1336f4e8338c24c4752db111e1eafd226bee6ff3582b1d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.bot-overrides-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.bot-overrides-settings.get-1.json
index a0bc6afee8b..2f67a0b9200 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.bot-overrides-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.bot-overrides-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.bot-overrides",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "01408cebcc193f8e30119381c8acf494fa5e29850fe010809deb330c2f9bcb36",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.home-providers-linear.status-1.json b/mobile/rpc-foundation/goldens/matrix-settings.home-providers-linear.status-1.json
index 0c484ac1a1a..c093721d93c 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.home-providers-linear.status-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.home-providers-linear.status-1.json
@@ -3,9 +3,9 @@
   "family": "settings.home-providers",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "19b445b39da98d28bcbcdab6f70e47ce208ca68f165e7b62c5fe9762eee67c8d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.home-providers-preflight.check-1.json b/mobile/rpc-foundation/goldens/matrix-settings.home-providers-preflight.check-1.json
index edd28e2374c..75e199b4541 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.home-providers-preflight.check-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.home-providers-preflight.check-1.json
@@ -3,9 +3,9 @@
   "family": "settings.home-providers",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "4953dd0de509ce620b9840d7f460e472dc74f54d53636694d12cba2e3bb51da8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.home-providers-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.home-providers-settings.get-1.json
index a70dd00b755..436ffd2b0bf 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.home-providers-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.home-providers-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.home-providers",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "70f601caeaee957bd3b172fc0fc12e85d6e2d6bed7683c86869559c6c9f25834",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-preflight.detectagents-1.json b/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-preflight.detectagents-1.json
index b2c88c4b7e6..01456550bfb 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-preflight.detectagents-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-preflight.detectagents-1.json
@@ -3,9 +3,9 @@
   "family": "settings.new-tab-local-agents",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "c5db2d14be8dc1b3b3b68c151507da49d1c96b44f94b080c5908a65a885f1763",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-repo.list-1.json
index 0bd8307b865..dcfc4fda671 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "settings.new-tab-local-agents",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "c9b66eb3c676b1e18db588b8e35f267f5618c007ae0955adcc3292740fddfe23",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-settings.get-1.json
index 42c36a9befb..55a9556e40d 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.new-tab-local-agents",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "9eaad87e8f648fdbfa33f493f991f9c7943fbf81f93580067819c4bbb02b672f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.quick-commands-settings.getterminalquickcommands-1.json b/mobile/rpc-foundation/goldens/matrix-settings.quick-commands-settings.getterminalquickcommands-1.json
index cc4685ff61a..2f9d946a098 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.quick-commands-settings.getterminalquickcommands-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.quick-commands-settings.getterminalquickcommands-1.json
@@ -3,9 +3,9 @@
   "family": "settings.quick-commands",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "c6d5040d0fd1e6b852625561aa67d11f555f5adb12303b6f8d0176183026a6b1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.quick-commands-settings.updateterminalquickcommands-1.json b/mobile/rpc-foundation/goldens/matrix-settings.quick-commands-settings.updateterminalquickcommands-1.json
index fa9bdea86d7..d78710cbed1 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.quick-commands-settings.updateterminalquickcommands-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.quick-commands-settings.updateterminalquickcommands-1.json
@@ -3,9 +3,9 @@
   "family": "settings.quick-commands",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "b9edb5c27852d4e1e968f85668f1ea7afde3ed1c6e5c6582d6607f9fa5643356",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-host.platform-1.json b/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-host.platform-1.json
index 68f80c0240d..23b3a133243 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-host.platform-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-host.platform-1.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "687b109bd2bcc0c85b7c858d553e68e2fc4cb5b281d9f8b32836dbacc4bdc8f2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-repo.list-1.json
index 9df2b163800..aa2da189a99 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "3199c745e22973b432b0a36c34bb0bdda994334a4a0cd7ad2daf8b172625ce8d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-settings.get-1.json
index b33d479aa68..759138a54dc 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "5e9c3ff57cf432b24a17ee046636b61b94116a687cfa506cd79dee464542b76b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-ssh.listtargetsummaries-1.json b/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-ssh.listtargetsummaries-1.json
index 4bb83e29e0d..b3decc7b1ed 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-ssh.listtargetsummaries-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-ssh.listtargetsummaries-1.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "a88061d3d1f03074b0ed2b663b523f1602362bc317ba614106f1f646d037d6e3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-folderworkspace.list-1.json b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-folderworkspace.list-1.json
index 341ef462461..f9f76b2713e 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-folderworkspace.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-folderworkspace.list-1.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "50ba7c7963cb494e4b3d484eb334977d21cc69018da57d75a7b6fd0c92860bd2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-projectgroup.list-1.json b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-projectgroup.list-1.json
index 15595aecd85..250d8caae1f 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-projectgroup.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-projectgroup.list-1.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "8dfd4550b39f0cfcb9aaa72fab0631b11f9e776ed389b206b326359d7f4c2d6e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-repo.list-1.json
index 3662092ef5a..f93524d3ac0 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "85dc526201f66409dd6a411c5e14615b82389791ec210efb9889078f5d580373",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-settings.get-1.json
index 2bf12fc7f6d..3fc53c44c43 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "080e10ae774ef097082267da0c8b6d0ebacae582d57b04a189c123258d0e5131",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-worktree.ps-1.json b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-worktree.ps-1.json
index fa66e5755a3..a3287b6921e 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-worktree.ps-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-worktree.ps-1.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "5988fa5ce0bf6b8585f7ec66918123ee086d5cdf1185a4eeff2e88904985064c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-linear.status-1.json b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-linear.status-1.json
index 8dd0aebc45f..348e7987385 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-linear.status-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-linear.status-1.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "f5033a7a3567cc9e016bf09ac8bcd8ff381c3054c041dbccc773f7011918bf1d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-preflight.check-1.json b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-preflight.check-1.json
index ba1b0f808ef..322f56103fc 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-preflight.check-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-preflight.check-1.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "0931b3d35868e5452cb550962f2408b6ce7cd6c89e90a9cf2897425edbb4b42d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-settings.get-1.json
index e7b18916dd5..f10c6f2be4c 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "d0f8d9bfe0e1469af3b0dab8b5c9799d91cc2234e72f0e031d6872059654077d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-status.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-status.get-1.json
index 78a14842c60..3ea8e482eb7 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-status.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-status.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "3f448feff463b59c3927dae020ecd8d4931bb4a6036df6d6af080de2ec5fcf2b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-ui.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-ui.get-1.json
index 1af6e369032..2c09e6235b0 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-ui.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-ui.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "4438f9fd62876333bb980157612aaf457c5a9b9115659c8c941c3b373ad071dd",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-create-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-create-settings.get-1.json
index 1fd461fd9d0..15c2573105b 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-create-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-create-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.task-workspace-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "7e4c5bb29e0f630cda8a09233575b9295e485f3d3e315ebdc0458c69515fcfc7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-create-worktree.create-1.json b/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-create-worktree.create-1.json
index 074026139ac..bf13ed272d8 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-create-worktree.create-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-create-worktree.create-1.json
@@ -3,9 +3,9 @@
   "family": "settings.task-workspace-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "1d7713cf4c23d053105c2abb02340d81d5eb689f4311a0984932d8ebd031b4ce",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-settings.get-1.json
index dbf858785dc..2f645b7eb27 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.task-workspace",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "994ea8b4ddb05774a8c2d5902bb68bf5e8f25399a787262b8f23f458f2790698",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-linear.status-1.json b/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-linear.status-1.json
index 5d160369944..3bee8c510a9 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-linear.status-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-linear.status-1.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": ["new-workspace-runtime-context-null-results-degrade-to-absent"],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "30b3f8d79589e9fb3d7ef804233554fa231f68ab88e5130ddfa78e79221e3c78",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-preflight.check-1.json b/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-preflight.check-1.json
index 973cdb5e03f..3b3009f775b 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-preflight.check-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-preflight.check-1.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": ["new-workspace-runtime-context-null-results-degrade-to-absent"],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "a5366cbd31d899feeb7e1901edd0c78191c2c8c8179ad5d5b24b7ca22bd538f8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-settings.get-1.json
index 445474b7ea5..390118bafe3 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": ["new-workspace-runtime-context-null-results-degrade-to-absent"],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "797ea410af6536410335ebe93b8bc354cd633cf980eb95efbb10bc46f5516cb7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-ui.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-ui.get-1.json
index 9d8c08ad578..6130d5828f1 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-ui.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-ui.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": ["new-workspace-runtime-context-null-results-degrade-to-absent"],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "3cd29e7b6a1cdfd99796a58cf6ad6f9aa3dbac75dd6e989ea99ba6027c210028",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.workspace-submit-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.workspace-submit-settings.get-1.json
index fe24082d474..cece93e8627 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.workspace-submit-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.workspace-submit-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-submit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "a89bdf93df71a958810aba72c80e42f663644781a29e934898e2ddf86c5dd5d5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-speech.dictation-chunk-speech.dictation.chunk-1.json b/mobile/rpc-foundation/goldens/matrix-speech.dictation-chunk-speech.dictation.chunk-1.json
index 9dbccf7d9b8..742f1ffd631 100644
--- a/mobile/rpc-foundation/goldens/matrix-speech.dictation-chunk-speech.dictation.chunk-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-speech.dictation-chunk-speech.dictation.chunk-1.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-chunk",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "cfc84498c2ed080ca2be50725c8ad4fac84eaf2e64ecad1445997949737da11d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-speech.dictation-session-speech.dictation.finish-1.json b/mobile/rpc-foundation/goldens/matrix-speech.dictation-session-speech.dictation.finish-1.json
index cfff4d0e684..b6fc389211e 100644
--- a/mobile/rpc-foundation/goldens/matrix-speech.dictation-session-speech.dictation.finish-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-speech.dictation-session-speech.dictation.finish-1.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-session",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "2cb8e1e5c1c4f9da7dcf68e3fcd51a3979966019b5872279b7347d5f09f381d5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-speech.dictation-session-speech.dictation.start-1.json b/mobile/rpc-foundation/goldens/matrix-speech.dictation-session-speech.dictation.start-1.json
index 0f7d562356b..64fea413f60 100644
--- a/mobile/rpc-foundation/goldens/matrix-speech.dictation-session-speech.dictation.start-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-speech.dictation-session-speech.dictation.start-1.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-session",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "c72f6ff7dad56e5dca200f2c9c71567f0d9811c7e39a9b9aee4543f0f9d9ca0a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-speech.dictation-start-speech.dictation.cancel-1.json b/mobile/rpc-foundation/goldens/matrix-speech.dictation-start-speech.dictation.cancel-1.json
index 4c08f5c1d52..b735d376bb9 100644
--- a/mobile/rpc-foundation/goldens/matrix-speech.dictation-start-speech.dictation.cancel-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-speech.dictation-start-speech.dictation.cancel-1.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-start",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "ef890c668aded545c5423322aeaab0e0715ff80d5f76c6512d6579e277853f6c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-speech.dictation-start-speech.dictation.start-1.json b/mobile/rpc-foundation/goldens/matrix-speech.dictation-start-speech.dictation.start-1.json
index b6af38ea545..83527ece5c3 100644
--- a/mobile/rpc-foundation/goldens/matrix-speech.dictation-start-speech.dictation.start-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-speech.dictation-start-speech.dictation.start-1.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-start",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "cd65f6b30f92d9542d19ad74cc9437ea33a1ec8fbdf4439ba13c14960f8a1994",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.dictation.setup-1.json b/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.dictation.setup-1.json
index 727096c37b5..6cc31c74828 100644
--- a/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.dictation.setup-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.dictation.setup-1.json
@@ -3,9 +3,9 @@
   "family": "speech.setup-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "407a52b099cbf2fcb261010e4235dae2e5e16e11b386fb6bc99d5a2d237af541",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.delete-1.json b/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.delete-1.json
index 47c1db775bf..382272d478d 100644
--- a/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.delete-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.delete-1.json
@@ -3,9 +3,9 @@
   "family": "speech.setup-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "140ede79a9ee0c02bedbfe67551060ef85692b6cb71968a48a1c41fcb4863804",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.download-1.json b/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.download-1.json
index d852322825a..85f19c07c99 100644
--- a/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.download-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.download-1.json
@@ -3,9 +3,9 @@
   "family": "speech.setup-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "6c0a9d2f2e28acd10c3a1f03888c23961e95bff02af10fe0e703d34fe6d60e8b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.list-1.json b/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.list-1.json
index 79df7666081..a8d03caecf5 100644
--- a/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.list-1.json
@@ -3,9 +3,9 @@
   "family": "speech.setup-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "d63062b89cc83321f6bcbd05c55dd21c71c6ff8c8026d026b5d94e44278ed3d8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.addprreviewcomment-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.addprreviewcomment-1.json
index c997cccba45..d6f78c03b93 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.addprreviewcomment-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.addprreviewcomment-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-checks-files",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "7bf61d34ba5217f7c00925612bb17542f3db17e1298294ca3ed647cd46278745",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.prfilecontents-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.prfilecontents-1.json
index 133d043cb42..217655d3db3 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.prfilecontents-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.prfilecontents-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-checks-files",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "0186ae4ee9b3653fd9e7050a5316608a8e68f8bb463e1391862cdb3cd312676b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.rerunprchecks-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.rerunprchecks-1.json
index 9a43eda4868..6e36dd41ea5 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.rerunprchecks-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.rerunprchecks-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-checks-files",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "8f5a47f74635937c88584eeac40d2d9bec960823e7bf8f242e48575355be0d4e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.resolvereviewthread-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.resolvereviewthread-1.json
index 4d94ee599af..8ce850a331f 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.resolvereviewthread-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.resolvereviewthread-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-checks-files",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "c91ad2604cacc2b02ccd727333ba66275a27f783f3adb1faf64699ea0ffa67c2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.setprfileviewed-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.setprfileviewed-1.json
index f6bbd848aec..26d02542e2b 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.setprfileviewed-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.setprfileviewed-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-checks-files",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "984dd772f207f674d511d2711819855c7c6923d858ef87ea159842c337ed3ea0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-github-github.addissuecomment-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-github-github.addissuecomment-1.json
index 77203b387f0..bdd61a682dd 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-github-github.addissuecomment-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-github-github.addissuecomment-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-comment-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "1cc7fdf3139e0c5a81cd83987ffedc4f59cd4866fc1b4018b61e35eacc74fc11",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-gitlab-gitlab.addissuecomment-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-gitlab-gitlab.addissuecomment-1.json
index eba6cad74f9..e893291cac7 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-gitlab-gitlab.addissuecomment-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-gitlab-gitlab.addissuecomment-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-comment-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "154d91d00db23ea2718a6ee0b6c5cafc7233084532b3d561731b059d58e006f5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-gitlab-mr-gitlab.addmrcomment-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-gitlab-mr-gitlab.addmrcomment-1.json
index 99ffa3ce3af..d42cbfed0e0 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-gitlab-mr-gitlab.addmrcomment-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-gitlab-mr-gitlab.addmrcomment-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-comment-gitlab-mr",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "ae07579881829263a2b5590249d4119f5d9f4ef3877149ac3b780ad985413f00",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-github-github.workitemdetails-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-github-github.workitemdetails-1.json
index 8ce1e1e0e77..0383ba4270c 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-github-github.workitemdetails-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-github-github.workitemdetails-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c0ef16b959002e4a3c5347114a0844b95670e274ef010d910b6671ac5f49e783",
   "scenarioSha256": "955729f9100dce7eeb103f7b4d08ff56ac66853b9ad0d33627c0838011287bca",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-gitlab-gitlab.workitemdetails-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-gitlab-gitlab.workitemdetails-1.json
index 293165355ee..a85604f606b 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-gitlab-gitlab.workitemdetails-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-gitlab-gitlab.workitemdetails-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c0ef16b959002e4a3c5347114a0844b95670e274ef010d910b6671ac5f49e783",
   "scenarioSha256": "d163c6125fa180da7575642ee29f4bb18e3678079b7c30a42934550896d5b3c1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-linear-linear.getissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-linear-linear.getissue-1.json
index 7c05c96f5fd..c926516efd6 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-linear-linear.getissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-linear-linear.getissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-linear",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c0ef16b959002e4a3c5347114a0844b95670e274ef010d910b6671ac5f49e783",
   "scenarioSha256": "83b30b2a160d162d16c66aa3bf6a633489e86dd4fd1c30828d2d244164b9c95e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-linear-linear.issuecomments-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-linear-linear.issuecomments-1.json
index 8dd6e5a3295..b8db4173ab1 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-linear-linear.issuecomments-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-linear-linear.issuecomments-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-linear",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c0ef16b959002e4a3c5347114a0844b95670e274ef010d910b6671ac5f49e783",
   "scenarioSha256": "06b06c84f4b8a1ee8e5159d8ada2656da4d7096729759c76601ad4e251310924",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-metadata-github.listassignableusers-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-metadata-github.listassignableusers-1.json
index 1c5b5687be5..d1a8e54e6c3 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-metadata-github.listassignableusers-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-metadata-github.listassignableusers-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "58ea1553e04017c993aea4753aace41ee664705a3fdb3b18569c5a9d7968cf06",
   "scenarioSha256": "3ef6ef046f60d2d11ef81adf69bd5216036405eb05e5fd30cf1c402120488ee5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-metadata-github.listlabels-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-metadata-github.listlabels-1.json
index 439820c57b5..89787932b67 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-metadata-github.listlabels-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-metadata-github.listlabels-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "58ea1553e04017c993aea4753aace41ee664705a3fdb3b18569c5a9d7968cf06",
   "scenarioSha256": "a2ecf4ddc2c9870a8d73cbd920b46bb0663a958ac156dc6de092be3c9474ea2b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-merge-gitlab-gitlab.mergemr-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-merge-gitlab-gitlab.mergemr-1.json
index 507e214fa97..35e8dbdc81c 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-merge-gitlab-gitlab.mergemr-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-merge-gitlab-gitlab.mergemr-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-merge-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "f40d99c60523ad1a6a3a761935e86ab0739337486dd316e6ab3248980e575027",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-github-github.updatepr-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-github-github.updatepr-1.json
index 90ad27b796f..78d2b5b0dd5 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-github-github.updatepr-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-github-github.updatepr-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-metadata-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "27587bfb5745051e3cb27b01dc49b90b6f3c8ddbeb38f20772502fae2f562d91",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-gitlab-gitlab.updateissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-gitlab-gitlab.updateissue-1.json
index b79cdb5317c..8b2db164854 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-gitlab-gitlab.updateissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-gitlab-gitlab.updateissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-metadata-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "01664112d8f24d0a08fa7ba4e2d7f389acb363ce493e083f359f90fa0b87911d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-gitlab-mr-gitlab.updatemr-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-gitlab-mr-gitlab.updatemr-1.json
index a573e557a6b..89256076b2b 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-gitlab-mr-gitlab.updatemr-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-gitlab-mr-gitlab.updatemr-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-metadata-gitlab-mr",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "186444ac8dc34dc63d1fbf304275e2265d96c6742e4c8f1e8e5568aa5504bf5d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.addissuecomment-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.addissuecomment-1.json
index 4a6da23b14f..d9bdde24074 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.addissuecomment-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.addissuecomment-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-reply-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "c6e5ae446b875afba3944a96d931fdca6006ed8e904374e5040088004eb9b044",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.addprreviewcommentreply-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.addprreviewcommentreply-1.json
index 2c62c212e1e..9a20bc63945 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.addprreviewcommentreply-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.addprreviewcommentreply-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-reply-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "2da11d5a9c7a223a59c56ec416ab33acd42d900b4080132bde27313e042808d9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.mergepr-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.mergepr-1.json
index 40c01b3bd82..b4243d1a3f4 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.mergepr-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.mergepr-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-reply-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "a5d8ba37f44421d3efd19617ef319f37fda3fe53004b6829ae2c320f85d5c98d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-linear.updateissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-linear.updateissue-1.json
index 01a9a3825a4..6480f980c2d 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-linear.updateissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-linear.updateissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-reply-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "abc4b882c92ba90a52d3635fe882b2c653bc91ab4d9927f240ebee4dd147b81d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-review-github-github.prchecks-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-review-github-github.prchecks-1.json
index 71917fd91e2..80e61de6f34 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-review-github-github.prchecks-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-review-github-github.prchecks-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-review-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "77b0812842903075bb3d3ec1f7bcea94b1e1dac5993c3c8854bd4c3d2a567988",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-review-github-github.requestprreviewers-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-review-github-github.requestprreviewers-1.json
index dc6ac935bcc..a286207d4c3 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-review-github-github.requestprreviewers-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-review-github-github.requestprreviewers-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-review-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "96a1813de0159396f6a5eb36a764fad4511de0a25eff6323571e1fade2a7f334",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-github.updateissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-github.updateissue-1.json
index 15257b6457c..6fd72eeb02c 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-github.updateissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-github.updateissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-status-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "57c41b51e34e451975a9f28a6461aa3b8e9dcf04cbebaea80ddf14afc4b78edf",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-gitlab.updateissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-gitlab.updateissue-1.json
index 960595b05c4..8b2f7e672f2 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-gitlab.updateissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-gitlab.updateissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-status-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "64a7af1bfac25dfe673832ef0ef7776be8d1a628c995eafd938fa3ad11d7ba0f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-mr-gitlab.updatemrstate-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-mr-gitlab.updatemrstate-1.json
index 75fac61bd9e..c46e19c0c23 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-mr-gitlab.updatemrstate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-mr-gitlab.updatemrstate-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-status-gitlab-mr",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "8443a59a1d432fbcfb9d158995cfa69bef364c33b66a97cbef0e70e197fcad4d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.linear-connect-linear.connect-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.linear-connect-linear.connect-1.json
index 4f507dfe95b..a20e3b94f7c 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.linear-connect-linear.connect-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.linear-connect-linear.connect-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.linear-connect",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "a60d7c0ce3d155116aecbb3d1ca015b4d9de310155f4e840b2fc391dc9d04860",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.addissuecomment-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.addissuecomment-1.json
index 7081c4f16c7..d2d973a9a50 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.addissuecomment-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.addissuecomment-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.linear-item",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "a2c0c5c200b36d2194815e67df2ea50422f6ecfd9df411132202e9660c87c41b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.createissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.createissue-1.json
index eee8c5adb6b..7b065cc63ff 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.createissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.createissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.linear-item",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "8a5c5b210459d3938bc010bc88c69696a631072cd5a6b7e1a3eb3e1fd0da9c8a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.getissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.getissue-1.json
index 870ecc10198..e17f92a64c0 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.getissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.getissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.linear-item",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "ab0ac02611d487a9edd58319c6e4b9302148684f27711afc3b69feaa73fc4b07",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.linear-team-context-linear.listteams-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.linear-team-context-linear.listteams-1.json
index 8ac2143e1f1..6f887c7596c 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.linear-team-context-linear.listteams-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.linear-team-context-linear.listteams-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.linear-team-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "58ea1553e04017c993aea4753aace41ee664705a3fdb3b18569c5a9d7968cf06",
   "scenarioSha256": "c4a5928ef7035ad8bed20945f235f4fa509238b3a167c91df50baefff8e8433f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.linear-team-context-linear.teamstates-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.linear-team-context-linear.teamstates-1.json
index 340d1776dbb..787b27a0e04 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.linear-team-context-linear.teamstates-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.linear-team-context-linear.teamstates-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.linear-team-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "58ea1553e04017c993aea4753aace41ee664705a3fdb3b18569c5a9d7968cf06",
   "scenarioSha256": "8ec517c98775f3af0d45776dc74bcaaf99dcc751e85343084e39c557b6ddede1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.reposlug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.reposlug-1.json
index 4f67760a516..d03b22f15a5 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.reposlug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.reposlug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.paste-lookup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "77b429e1066a877bb3c8513e89e42314bb974478385695ceb36dbaa7c57e654a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.workitem-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.workitem-1.json
index d3052278d69..581f126e77c 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.workitem-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.workitem-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.paste-lookup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "8d58d134262cd828348bc3416f7208b51259dff9ea952eeceaab6e6dcfcfd96a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.workitembyownerrepo-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.workitembyownerrepo-1.json
index 0f2bccaff4e..259f49ad5eb 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.workitembyownerrepo-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.workitembyownerrepo-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.paste-lookup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "4dc2c4cfc9c29ee998796980a7ae6ded99a39f17e143e3db588239bc224b2cc5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-gitlab.workitembypath-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-gitlab.workitembypath-1.json
index e318c66807c..deb9a537b3b 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-gitlab.workitembypath-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-gitlab.workitembypath-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.paste-lookup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "d622fc252f4e2e1d2e244d8781b260ed6e42dee572b8d2fd39d6c3b49baae04a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listaccessible-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listaccessible-1.json
index ae1a560545c..28e4f53044e 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listaccessible-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listaccessible-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-board-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c4272385ed3b0de4feab38de9e4f6363ecd6317fdd4de47f76a98eb18abaf371",
   "scenarioSha256": "7c16d49ffeace5c689309316da6e4638fa1b70d3ef52a78d27db934ae56cf64d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listviews-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listviews-1.json
index ea12540e04d..da23063c41f 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listviews-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listviews-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-board-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c4272385ed3b0de4feab38de9e4f6363ecd6317fdd4de47f76a98eb18abaf371",
   "scenarioSha256": "c5cc9a11a75a86780195be7d1055d1064c8aba78bb8e4e8bbdf033409c2b2aa5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listviews-2.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listviews-2.json
index a7461905f5d..d18c5475735 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listviews-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listviews-2.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-board-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c4272385ed3b0de4feab38de9e4f6363ecd6317fdd4de47f76a98eb18abaf371",
   "scenarioSha256": "7f748bb55df907bba315ea6899c585837d97fa0ea9b312330cf35d95bda87bd1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.resolveref-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.resolveref-1.json
index 44676a43960..9637d15a8d6 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.resolveref-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.resolveref-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-board-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c4272385ed3b0de4feab38de9e4f6363ecd6317fdd4de47f76a98eb18abaf371",
   "scenarioSha256": "4ab4e4022cafd69cbc7af45ddf72d2dad3e8215df363511651d7faea014147d3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.viewtable-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.viewtable-1.json
index c2fb0c65695..ff19f3e28d2 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.viewtable-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.viewtable-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-board-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c4272385ed3b0de4feab38de9e4f6363ecd6317fdd4de47f76a98eb18abaf371",
   "scenarioSha256": "cf64dd43e708ff953ba2cbb2a70378aa8ab5d13ede157af7ba0967d913755b82",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-repo-slugs-github.reposlug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-repo-slugs-github.reposlug-1.json
index 3524e86e869..052d8aa1445 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-repo-slugs-github.reposlug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-repo-slugs-github.reposlug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-repo-slugs",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c4272385ed3b0de4feab38de9e4f6363ecd6317fdd4de47f76a98eb18abaf371",
   "scenarioSha256": "667a06cf9ff8129eee64327566012448abe1fe31f58c0d9b882b13e74db5a877",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.addissuecommentbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.addissuecommentbyslug-1.json
index 3a3017522f6..27c9b075c91 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.addissuecommentbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.addissuecommentbyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-comments-issue",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "9fd4756c2224f3ecbc9ffc82e1ee11615a9e057e600bc56ccaf5c5e2c0e411d8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.updateissuebyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.updateissuebyslug-1.json
index ee951e1b068..ad645a221b3 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.updateissuebyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.updateissuebyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-comments-issue",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "cfe0284f502001a57a9d18585222e5ae4b254d9bac32e0bb4080ee9363e8e019",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.updateissuecommentbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.updateissuecommentbyslug-1.json
index 14e7742ec6b..ad840590c73 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.updateissuecommentbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.updateissuecommentbyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-comments-issue",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "b21a3b3f568bf6caecca62272f4b7882062027684c70878fd5f883622ff2a9ea",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-pr-github.project.updatepullrequestbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-pr-github.project.updatepullrequestbyslug-1.json
index 6cf80d75811..96c89fc9120 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-pr-github.project.updatepullrequestbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-pr-github.project.updatepullrequestbyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-comments-pr",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "e286edb942c338fd844ce8437ac03c872838228515ce833cfd310332354da725",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-detail-github.project.workitemdetailsbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-detail-github.project.workitemdetailsbyslug-1.json
index fc7481a8603..e226268a9e4 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-detail-github.project.workitemdetailsbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-detail-github.project.workitemdetailsbyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-detail",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f8f6e5d500f959b9b15c5498885a05422747880b6aef4ad795bc3064ebbacea6",
   "scenarioSha256": "52b2cc222d9819121ba99f8f603bc76abe420d731e5853116e802a4db59e2d3e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.clearitemfield-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.clearitemfield-1.json
index ad83b5cdc08..fb4b32cee76 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.clearitemfield-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.clearitemfield-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-fields",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "370aeaee59978071ccb821da13c9e6114936c168947b608539cdb80d40cc9889",
   "scenarioSha256": "0fe8c60631cf04d33b34371155f5f80c8426b07b1cbec2fabc5d6d619f2633b8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.updateissuetypebyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.updateissuetypebyslug-1.json
index f17cd2aa2fb..c1058507cad 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.updateissuetypebyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.updateissuetypebyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-fields",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "370aeaee59978071ccb821da13c9e6114936c168947b608539cdb80d40cc9889",
   "scenarioSha256": "8ad021e101d8ef17ed47472a5fbfbeaebb2690a4040c89a0e9ee133e69e4fecd",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.updateitemfield-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.updateitemfield-1.json
index ff6b39439ee..f129ce49043 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.updateitemfield-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.updateitemfield-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-fields",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "370aeaee59978071ccb821da13c9e6114936c168947b608539cdb80d40cc9889",
   "scenarioSha256": "4d33ce12f3f35bea8a98fec2c0378e73caf7fbfb93085545e890b082a392cd60",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.addprreviewcomment-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.addprreviewcomment-1.json
index c79442dee02..9efe8a23302 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.addprreviewcomment-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.addprreviewcomment-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-files-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b228732762828412ad3d9eec3ece00a897d866046e37044322c3911758d6e0a9",
   "scenarioSha256": "3ed626e9d776e009f008c85f5165c8199bc2b85afd279a435e2e0f800737b42f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.mergepr-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.mergepr-1.json
index 8aa84e2bc68..c6d9d313a19 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.mergepr-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.mergepr-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-files-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b228732762828412ad3d9eec3ece00a897d866046e37044322c3911758d6e0a9",
   "scenarioSha256": "1e402d7984c7958ba23fb700464a450374ad72424be8f2669f769199a1a2899e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.prfilecontents-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.prfilecontents-1.json
index fa9eff43014..6efa580b6f1 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.prfilecontents-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.prfilecontents-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-files-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b228732762828412ad3d9eec3ece00a897d866046e37044322c3911758d6e0a9",
   "scenarioSha256": "1b2ead3380b546c94c5da2ed61c9208cd158db9a56ca87e3e72e450668e1e507",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.updateissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.updateissue-1.json
index ae8034bf698..6e7e57a7603 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.updateissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.updateissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-files-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b228732762828412ad3d9eec3ece00a897d866046e37044322c3911758d6e0a9",
   "scenarioSha256": "947b1c1aa9688688a1e4cbdbacfde185fbf5d0b28b13e753ba87bdf7f999aa00",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.updateprstate-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.updateprstate-1.json
index 84c4191b005..e7f245bf55d 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.updateprstate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.updateprstate-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-files-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b228732762828412ad3d9eec3ece00a897d866046e37044322c3911758d6e0a9",
   "scenarioSha256": "cc450fcf20e403eea6ce1ee103c131feccb2906c0ae31c7cd3f3d3fa0b739d68",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listassignableusersbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listassignableusersbyslug-1.json
index 905a85dc65f..a060f28650b 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listassignableusersbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listassignableusersbyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-metadata-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f8f6e5d500f959b9b15c5498885a05422747880b6aef4ad795bc3064ebbacea6",
   "scenarioSha256": "2303fc902e5a6cf6a43db58ef2938538a7b770d1509cc22a9811f4c83051aea1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listissuetypesbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listissuetypesbyslug-1.json
index 7af2d9eaf60..1332e7a94da 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listissuetypesbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listissuetypesbyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-metadata-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f8f6e5d500f959b9b15c5498885a05422747880b6aef4ad795bc3064ebbacea6",
   "scenarioSha256": "8b75854487566ca6da98d391b6822c81c99e61011fc094458ae038905c1c9287",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listlabelsbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listlabelsbyslug-1.json
index b354d83c781..d47914d4de0 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listlabelsbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listlabelsbyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-metadata-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f8f6e5d500f959b9b15c5498885a05422747880b6aef4ad795bc3064ebbacea6",
   "scenarioSha256": "7c948e76afb331e4038298215181adc97cd533c4f79e205e183c08e8a2db20fc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.prchecks-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.prchecks-1.json
index ef614adad8c..2cbda70f052 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.prchecks-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.prchecks-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-review-checks",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "370aeaee59978071ccb821da13c9e6114936c168947b608539cdb80d40cc9889",
   "scenarioSha256": "20e9631df87e40e64d35cee0c0e06b922fe53bd93e3d9e4078633b85a5278b7e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.requestprreviewers-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.requestprreviewers-1.json
index c44286a7bf1..07f01552d4f 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.requestprreviewers-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.requestprreviewers-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-review-checks",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "370aeaee59978071ccb821da13c9e6114936c168947b608539cdb80d40cc9889",
   "scenarioSha256": "2d947b63fb35dad9bbe201061cb51d0b3c5a5e6f3e8018eeda2ec1f962952809",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.rerunprchecks-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.rerunprchecks-1.json
index dab51750e29..c2f0c9f7f39 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.rerunprchecks-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.rerunprchecks-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-review-checks",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "370aeaee59978071ccb821da13c9e6114936c168947b608539cdb80d40cc9889",
   "scenarioSha256": "ca6b0d81b19811806ce332a776361a40e526a73bef90cfa3df05a764e2ee83b6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.setprfileviewed-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.setprfileviewed-1.json
index b1c29a3d774..38603b9b40f 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.setprfileviewed-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.setprfileviewed-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-review-checks",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "370aeaee59978071ccb821da13c9e6114936c168947b608539cdb80d40cc9889",
   "scenarioSha256": "bd58d88e0534366e281869ee79eb75fe65b418d02523d815d8d0d58799edc31b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.addissuecomment-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.addissuecomment-1.json
index bf090d88403..f8678577227 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.addissuecomment-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.addissuecomment-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-threads",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "0f220b97bbb64ef8d347973690e6fab4b305eaaa54c9b7883340415c54e61206",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.addprreviewcommentreply-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.addprreviewcommentreply-1.json
index f9529eaecf6..ca6fd970b8e 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.addprreviewcommentreply-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.addprreviewcommentreply-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-threads",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "85160836c5a5c9bae76aff82c834ceb908f9262a90facd6e055c289362664eaa",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.project.deleteissuecommentbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.project.deleteissuecommentbyslug-1.json
index 15571a28cb5..61a08b403ae 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.project.deleteissuecommentbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.project.deleteissuecommentbyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-threads",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "5bc59cfd0d951ae5193df5c49ce3618d9536be0bc8f8192a7b03000963c2001b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.resolvereviewthread-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.resolvereviewthread-1.json
index 8fb0312fcb8..0e493613061 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.resolvereviewthread-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.resolvereviewthread-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-threads",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "0d8c240718b3911464a6fc486114d67cd6f60aa295cd0886ff755b77d5036014",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-github.countworkitems-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-github.countworkitems-1.json
index 898ab45dc4d..c783739b1ba 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-github.countworkitems-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-github.countworkitems-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.provider-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "e9bdad78cf60e3dd931eab8810d011c6e0066f9a336a206f8f9ca62621b21fee",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-github.listworkitems-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-github.listworkitems-1.json
index 20a55857fa7..7ffd61f3126 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-github.listworkitems-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-github.listworkitems-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.provider-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "a5704c6849de9a45564c8738076ec8c0307754a5acc2c039880fe436771e68b3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-linear.listteams-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-linear.listteams-1.json
index 82874899c47..49d9baea816 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-linear.listteams-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-linear.listteams-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.provider-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "e518040cbd40e3cc8c22e0b70b6de1087386936f75ed2f65f6e7b4fcdc344ba2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-linear.status-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-linear.status-1.json
index e54bf81d6ff..b82edf2578a 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-linear.status-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-linear.status-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.provider-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "f02acd2ed6319b8cb674c04b41a1e96c50e53123a8914790acc8af5410d63f98",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-settings.update-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-settings.update-1.json
index 60c8aefc502..406e26d26f0 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-settings.update-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-settings.update-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.provider-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "2b3006bfe1e7f3040b86ccc698e58ae19ae1aa11389aee2ec2a8f2dfdb0270f4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.route-repo-list-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.route-repo-list-repo.list-1.json
index e64182cd0ae..58f32992765 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.route-repo-list-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.route-repo-list-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.route-repo-list",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "23f974df8b57c723069605de1db80c339ead286b18aae38e67fce03ea50c5180",
   "scenarioSha256": "6373b83783b1a9b061bede3bba7aa3b573c3a50b897102a094df93f926856fdc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-github.listworkitems-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-github.listworkitems-1.json
index 1889464e9d5..b9e265fcaf8 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-github.listworkitems-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-github.listworkitems-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.smart-source-search",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "85c9e5107fe3e74f44d8b3e5c791b80ff0370cdc3ada69dc09fe38d8058fb263",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-gitlab.listworkitems-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-gitlab.listworkitems-1.json
index dfd3caaf6e4..51a360ccb4a 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-gitlab.listworkitems-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-gitlab.listworkitems-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.smart-source-search",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "0db7a8e1e5e740c341167bf045a0ab858f61708e995777fa4cf2e88cff1ec727",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-linear.listissues-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-linear.listissues-1.json
index ada952f93c4..2cd16b21fa2 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-linear.listissues-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-linear.listissues-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.smart-source-search",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "5d9211140d751c6cc844775d3e818f125483f1dac5b78960557ccfe73f41d08f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-linear.searchissues-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-linear.searchissues-1.json
index e422714d40f..17b51549213 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-linear.searchissues-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-linear.searchissues-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.smart-source-search",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "1cfdbdeca951545a4fafd23649991e93a02feea72d174a7c469f18dc64decfc4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-repo.searchrefs-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-repo.searchrefs-1.json
index 506926a8104..052c66008e5 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-repo.searchrefs-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-repo.searchrefs-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.smart-source-search",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "9fc0825ec19c2c90cec44ee284e7c54399e1552bdb15c329727921a15ad62944",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.task-create-github-github.createissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.task-create-github-github.createissue-1.json
index 7143f302b48..9f00ca025d9 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.task-create-github-github.createissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.task-create-github-github.createissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-create-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "014040846f649f3c6ca1175b610ed1b51bae3001e7de103549d7ee1a511a2506",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.task-create-github-repo.update-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.task-create-github-repo.update-1.json
index d5052064452..4709005e1cc 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.task-create-github-repo.update-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.task-create-github-repo.update-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-create-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "9efe74e5a1b0d92f674e6044edfd534693c15b0a153bcb2c0e283a6cd53fa61b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.task-create-gitlab-gitlab.createissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.task-create-gitlab-gitlab.createissue-1.json
index ece55988161..2626e84ed13 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.task-create-gitlab-gitlab.createissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.task-create-gitlab-gitlab.createissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-create-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "217a3da50a54c4cbe19a68835ecfa038eae5b350430f0b8fd0a616bb5bdfe32d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.task-create-linear-linear.createissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.task-create-linear-linear.createissue-1.json
index 49950c87c00..7560954d6ab 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.task-create-linear-linear.createissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.task-create-linear-linear.createissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-create-linear",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "cb4c10cc6401e5b68340bd1fa09381c973348b6e0c7ffef563cde92080c57a15",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.task-list-gitlab-items-gitlab.listworkitems-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.task-list-gitlab-items-gitlab.listworkitems-1.json
index 7f9ff40f33a..f71212f65c8 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.task-list-gitlab-items-gitlab.listworkitems-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.task-list-gitlab-items-gitlab.listworkitems-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-list-gitlab-items",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "038221907a57f5bb25338f9b07a744dbac3ea0a7ea2ba43281f171912f45a586",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.task-list-gitlab-todos-gitlab.todos-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.task-list-gitlab-todos-gitlab.todos-1.json
index 1031ab6f3ad..cade88a2717 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.task-list-gitlab-todos-gitlab.todos-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.task-list-gitlab-todos-gitlab.todos-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-list-gitlab-todos",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "e36b90621e11880ec1e6c16e8e3c89cc14f5d68a4a9e06b8a3098fc0bd0104a2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.task-list-linear-linear.listissues-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.task-list-linear-linear.listissues-1.json
index 0eaaa901f67..62b8622e910 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.task-list-linear-linear.listissues-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.task-list-linear-linear.listissues-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-list-linear",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "39ef28af17e4d3774b42bba1555606770667bc9010692fb1a4492413a940c0a0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.task-list-linear-linear.searchissues-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.task-list-linear-linear.searchissues-1.json
index 8a78e843367..2bf89fe2d92 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.task-list-linear-linear.searchissues-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.task-list-linear-linear.searchissues-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-list-linear",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "c589700af145f58c37292dafb891b3b7d50302fd4ec044155c044ccd48f79c74",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-source-repo.searchrefs-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-source-repo.searchrefs-1.json
index bd874bcd4e8..47c086841da 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-source-repo.searchrefs-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-source-repo.searchrefs-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-source",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "9e91d46870cd69279cc7d8ebfd317ab8b13136ccff9662876c7601a3a83ecafe",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-source-repo.sparsepresets-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-source-repo.sparsepresets-1.json
index b84ec5eff73..9860d96fc97 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-source-repo.sparsepresets-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-source-repo.sparsepresets-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-source",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "2d4a681bffbc5ff9d3040ea0d6bb2603ee940c3c497269d0b63caca564fb25e1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-sparse-repo.savesparsepreset-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-sparse-repo.savesparsepreset-1.json
index 38a3c16e6e0..5fd744f1ef9 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-sparse-repo.savesparsepreset-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-sparse-repo.savesparsepreset-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-sparse",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "3d4637406e2d658b72f73153f0a5e176cb8b143593b72bce0cdf979bc6e4cbdd",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-sparse-ssh.getstate-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-sparse-ssh.getstate-1.json
index 7daf6f61107..1e1dd756412 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-sparse-ssh.getstate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-sparse-ssh.getstate-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-sparse",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "3453024581230908d1e0e9335f5310e7b4ae03faf50d93654b9ff28c464fb95f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-local-preflight.detectagents-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-local-preflight.detectagents-1.json
index bcb09676f64..06de86acd90 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-local-preflight.detectagents-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-local-preflight.detectagents-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-ssh-local",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "28f7ba289c188bfc121ef7b969133711189e887fbfc7b37c8a5401ea7f30b56a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-preflight.detectremoteagents-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-preflight.detectremoteagents-1.json
index 17b9171e5bf..f975a70c17c 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-preflight.detectremoteagents-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-preflight.detectremoteagents-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-ssh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "35771ab92d0d4ff44a1dd6e5f1e5d3137570a2e013bddea5ca77ecac7989ed53",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-repo.hooks-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-repo.hooks-1.json
index 1e2cd827e81..0724567d7b4 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-repo.hooks-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-repo.hooks-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-ssh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "39451d3c811068754f91ac243fe1208f4ce742df53261314345d8209ba761e94",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-ssh.connect-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-ssh.connect-1.json
index 9125ade092b..37fb2248cb9 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-ssh.connect-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-ssh.connect-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-ssh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "5cc1773d06d49d2616da72f2790753322edda6d67e12b5e41116971d34787391",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-terminal.query-reply-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-terminal.query-reply-terminal.send-1.json
index 46e7ef0527d..008d5e8e6b7 100644
--- a/mobile/rpc-foundation/goldens/matrix-terminal.query-reply-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-terminal.query-reply-terminal.send-1.json
@@ -3,10 +3,10 @@
   "family": "terminal.query-reply",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "15b5694a63d54aeb4f4d9a861729e7e3b42ce06b15af6784fcb1afab744ed18b",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-terminal.raw-input-orchestration.workerterminaluserinput-1.json b/mobile/rpc-foundation/goldens/matrix-terminal.raw-input-orchestration.workerterminaluserinput-1.json
index 700ed8b8c70..83ff1df0d89 100644
--- a/mobile/rpc-foundation/goldens/matrix-terminal.raw-input-orchestration.workerterminaluserinput-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-terminal.raw-input-orchestration.workerterminaluserinput-1.json
@@ -3,10 +3,10 @@
   "family": "terminal.raw-input",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "68c039f74da08523d67d8d5b0a178c1d12507ec88d25891cd1377cd3fb40205c",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-terminal.raw-input-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-terminal.raw-input-terminal.send-1.json
index 7f44642e0e5..a9e17222667 100644
--- a/mobile/rpc-foundation/goldens/matrix-terminal.raw-input-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-terminal.raw-input-terminal.send-1.json
@@ -3,10 +3,10 @@
   "family": "terminal.raw-input",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "19d55a77e9c2f64f062070c9985f756e0ba72f3ccc3c884a80843fe888f42a47",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-terminal.takeover-report-orchestration.workerterminaluserinput-1.json b/mobile/rpc-foundation/goldens/matrix-terminal.takeover-report-orchestration.workerterminaluserinput-1.json
index c2121a7a887..ca6171d9dd2 100644
--- a/mobile/rpc-foundation/goldens/matrix-terminal.takeover-report-orchestration.workerterminaluserinput-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-terminal.takeover-report-orchestration.workerterminaluserinput-1.json
@@ -3,10 +3,10 @@
   "family": "terminal.takeover-report",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "6913de3f553b47a7e6663e21b0b93e97df26405c210db876f0b9593bd38936be",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-terminal.takeover-report-orchestration.workerterminaluserinput-2.json b/mobile/rpc-foundation/goldens/matrix-terminal.takeover-report-orchestration.workerterminaluserinput-2.json
index aa4cc213aa8..40e1412acbd 100644
--- a/mobile/rpc-foundation/goldens/matrix-terminal.takeover-report-orchestration.workerterminaluserinput-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-terminal.takeover-report-orchestration.workerterminaluserinput-2.json
@@ -3,10 +3,10 @@
   "family": "terminal.takeover-report",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "da13ec556c0f672371a8cd2aabd4dcc68001c0f9aa47015dfa4b5937355c4c2c",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-terminal.viewport-refit-terminal.updateviewport-1.json b/mobile/rpc-foundation/goldens/matrix-terminal.viewport-refit-terminal.updateviewport-1.json
index d862b9bfc5b..e45be502bf8 100644
--- a/mobile/rpc-foundation/goldens/matrix-terminal.viewport-refit-terminal.updateviewport-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-terminal.viewport-refit-terminal.updateviewport-1.json
@@ -3,10 +3,10 @@
   "family": "terminal.viewport-refit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "bde05ca916393d7f5ccd48686cf13a52fb2dfa599ea874b084c58bd59adb7e7f",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-transport.capability-probe-status.get-1.json b/mobile/rpc-foundation/goldens/matrix-transport.capability-probe-status.get-1.json
index b3b2a78ebd7..e63e7bd73d0 100644
--- a/mobile/rpc-foundation/goldens/matrix-transport.capability-probe-status.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-transport.capability-probe-status.get-1.json
@@ -3,9 +3,9 @@
   "family": "transport.capability-probe",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "874b1a120443ee679e2f4b3974762fd84fc929e93a2117b20bbb0cf373316616",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-transport.host-status-gates-status.get-1.json b/mobile/rpc-foundation/goldens/matrix-transport.host-status-gates-status.get-1.json
index 38fa692d50a..2a61359ed6d 100644
--- a/mobile/rpc-foundation/goldens/matrix-transport.host-status-gates-status.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-transport.host-status-gates-status.get-1.json
@@ -3,9 +3,9 @@
   "family": "transport.host-status-gates",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "d6be62e5eb2737d75634c053098d06a4bb175c64ff915cec6ead79922492a068",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-transport.pairing-race-direct-status.json b/mobile/rpc-foundation/goldens/matrix-transport.pairing-race-direct-status.json
index 14eee060257..385af054cd5 100644
--- a/mobile/rpc-foundation/goldens/matrix-transport.pairing-race-direct-status.json
+++ b/mobile/rpc-foundation/goldens/matrix-transport.pairing-race-direct-status.json
@@ -3,9 +3,9 @@
   "family": "transport.pairing-race",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "1d032c86e7cc12efa3d5044339cb990bd258d830119d0e7b61d1b995b4df29a3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-transport.pairing-race-relay-status.json b/mobile/rpc-foundation/goldens/matrix-transport.pairing-race-relay-status.json
index 15e9b1f374d..d42c938fcfb 100644
--- a/mobile/rpc-foundation/goldens/matrix-transport.pairing-race-relay-status.json
+++ b/mobile/rpc-foundation/goldens/matrix-transport.pairing-race-relay-status.json
@@ -3,9 +3,9 @@
   "family": "transport.pairing-race",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "048ee6d7848e0e4b8d6463ff9dc4124bfd478114ab87f6b52ff82a1dfd6ebc04",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.agent-launch-create-agent.launch-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.agent-launch-create-agent.launch-1.json
index 295a74b420f..c8dc0af54ae 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.agent-launch-create-agent.launch-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.agent-launch-create-agent.launch-1.json
@@ -3,11 +3,11 @@
   "family": "worktree.agent-launch-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
-  "scenarioSha256": "887b5d16b4bee027edf5e2f1122a79a34b223f6926322a99f6e3de83f40bf6ee",
+  "scenarioSha256": "b3d017cee84fc133ab0b0a8d588750f8af907d4688e6c2900a307de25fab8473",
   "platform": "darwin",
   "scenarioVersion": 1,
   "projectionVersion": 2,
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.catalog-snapshot-worktree.ps-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.catalog-snapshot-worktree.ps-1.json
index 6786f066f9f..043eba83634 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.catalog-snapshot-worktree.ps-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.catalog-snapshot-worktree.ps-1.json
@@ -3,9 +3,9 @@
   "family": "worktree.catalog-snapshot",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e942ddfbaa0ba6bfc2993969276987f6528ac53765d125e99a830e261f93a8e",
   "scenarioSha256": "95ca47f382997c412da974e564a46b1ae0c20d6e0f3ca14258d33c8d8b51a160",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.create-retry-worktree.create-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.create-retry-worktree.create-1.json
index 657dea1a292..a314e38d8a6 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.create-retry-worktree.create-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.create-retry-worktree.create-1.json
@@ -3,9 +3,9 @@
   "family": "worktree.create-retry",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "e93a36ef900de27e1a566cdb2389ba4f900a330eadbb476b9bfb1ef05707b352",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.home-catalog-worktree.ps-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.home-catalog-worktree.ps-1.json
index 60c18bd3f81..11222b0926a 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.home-catalog-worktree.ps-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.home-catalog-worktree.ps-1.json
@@ -3,9 +3,9 @@
   "family": "worktree.home-catalog",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e942ddfbaa0ba6bfc2993969276987f6528ac53765d125e99a830e261f93a8e",
   "scenarioSha256": "fa0e28a167a5fba6fe7ffebb9f4ad28dd413d601c07116a24a7781d156f54beb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.hosted-base-worktree.resolvemrbase-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.hosted-base-worktree.resolvemrbase-1.json
index fe9c6aa4b35..472e014ff57 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.hosted-base-worktree.resolvemrbase-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.hosted-base-worktree.resolvemrbase-1.json
@@ -3,9 +3,9 @@
   "family": "worktree.hosted-base",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "a84f8a5acfd428eb77b5c02a3de0fa8b780c666db31bbe574ecf76cdf84adeb2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.hosted-base-worktree.resolveprbase-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.hosted-base-worktree.resolveprbase-1.json
index fc17b9d7cf1..c8293975748 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.hosted-base-worktree.resolveprbase-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.hosted-base-worktree.resolveprbase-1.json
@@ -3,9 +3,9 @@
   "family": "worktree.hosted-base",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "45783a7cbb44b04dbbd6bfd6735799bb4c75e503f43f1821cf8640d11f7464ad",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.retired-names-worktree.listretirednames-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.retired-names-worktree.listretirednames-1.json
index 9406cfe5ff8..def95720e55 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.retired-names-worktree.listretirednames-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.retired-names-worktree.listretirednames-1.json
@@ -3,9 +3,9 @@
   "family": "worktree.retired-names",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e942ddfbaa0ba6bfc2993969276987f6528ac53765d125e99a830e261f93a8e",
   "scenarioSha256": "d321d6c17e67ae90f6ceefb775495ff765a86a35423ed33a212e71ec5e9e94aa",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.review-link-worktree.set-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.review-link-worktree.set-1.json
index 827905ec0e9..76c4ea6362b 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.review-link-worktree.set-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.review-link-worktree.set-1.json
@@ -3,9 +3,9 @@
   "family": "worktree.review-link",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "2fc093ec505bfac04a4ff0adab991baeba985253486dbe9e3ec9884b8d5f0920",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.runtime-capabilities-status.get-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.runtime-capabilities-status.get-1.json
index db6c9fa0d74..e31f22d10ed 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.runtime-capabilities-status.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.runtime-capabilities-status.get-1.json
@@ -3,9 +3,9 @@
   "family": "worktree.runtime-capabilities",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "f70c6b1753377b5a502bf7d1e69dc95617f24c42137471320eb393567efbe735",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.setup-hook-trust-ui.set-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.setup-hook-trust-ui.set-1.json
index 65f82ca1fac..972c641e0f5 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.setup-hook-trust-ui.set-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.setup-hook-trust-ui.set-1.json
@@ -3,9 +3,9 @@
   "family": "worktree.setup-hook-trust",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "8487fd14ed779708415b264e2b80b26b0d5094e379a04f4f32c2cd75ec469182",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/mobile-web-bundle-build-changed.json b/mobile/rpc-foundation/goldens/mobile-web-bundle-build-changed.json
index 54374e6a713..7ef724bdd98 100644
--- a/mobile/rpc-foundation/goldens/mobile-web-bundle-build-changed.json
+++ b/mobile/rpc-foundation/goldens/mobile-web-bundle-build-changed.json
@@ -3,9 +3,9 @@
   "family": "mobileWeb.bundle-fetch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "af339fef2c684d5709c6d3f279e5f0d9c33d17b6d4e5c89e501963400901b564",
   "scenarioSha256": "9bab59797b04304d8e25573664b011949e9b15010270ccbfd0e3d2a4d772180c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/mobile-web-bundle-fetch-paged.json b/mobile/rpc-foundation/goldens/mobile-web-bundle-fetch-paged.json
index c0faed39caa..54288ec5f8e 100644
--- a/mobile/rpc-foundation/goldens/mobile-web-bundle-fetch-paged.json
+++ b/mobile/rpc-foundation/goldens/mobile-web-bundle-fetch-paged.json
@@ -3,9 +3,9 @@
   "family": "mobileWeb.bundle-fetch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "af339fef2c684d5709c6d3f279e5f0d9c33d17b6d4e5c89e501963400901b564",
   "scenarioSha256": "e3044fe513a5fc1fb10c5c00422d965dd760eeea37cfcebc79b4597141f4baa1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/mobile-web-bundle-manifest-read.json b/mobile/rpc-foundation/goldens/mobile-web-bundle-manifest-read.json
index fd114ccdac6..5d6d5146081 100644
--- a/mobile/rpc-foundation/goldens/mobile-web-bundle-manifest-read.json
+++ b/mobile/rpc-foundation/goldens/mobile-web-bundle-manifest-read.json
@@ -3,9 +3,9 @@
   "family": "mobileWeb.bundle-manifest",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "af339fef2c684d5709c6d3f279e5f0d9c33d17b6d4e5c89e501963400901b564",
   "scenarioSha256": "5e9f4e6878be3f534288a90f7ccabc9cfe4e968aa29da372a98c3064d8e4d89e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/mobile-web-bundle-unavailable.json b/mobile/rpc-foundation/goldens/mobile-web-bundle-unavailable.json
index 0df4944894a..3be1b26a7d4 100644
--- a/mobile/rpc-foundation/goldens/mobile-web-bundle-unavailable.json
+++ b/mobile/rpc-foundation/goldens/mobile-web-bundle-unavailable.json
@@ -3,9 +3,9 @@
   "family": "mobileWeb.bundle-fetch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "af339fef2c684d5709c6d3f279e5f0d9c33d17b6d4e5c89e501963400901b564",
   "scenarioSha256": "7333b1c83120bcfd9bdac8888ec1528c1db9b36325509f1328a551676df219c5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-image-paste-single.json b/mobile/rpc-foundation/goldens/native-chat-image-paste-single.json
index e0eaadbe9f7..bbc32316c2b 100644
--- a/mobile/rpc-foundation/goldens/native-chat-image-paste-single.json
+++ b/mobile/rpc-foundation/goldens/native-chat-image-paste-single.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "8e88e44d077ce8f3f3e3214b80e9e8b1e770b9a73025bc284a8333d6a8be07f9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-image-paste-stops-on-rejection.json b/mobile/rpc-foundation/goldens/native-chat-image-paste-stops-on-rejection.json
index 0f4ea203c8c..9f978216403 100644
--- a/mobile/rpc-foundation/goldens/native-chat-image-paste-stops-on-rejection.json
+++ b/mobile/rpc-foundation/goldens/native-chat-image-paste-stops-on-rejection.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "1e2c7d2c238bb87a0fd1896a0151a6cecd670c9b1b2679ca47b39520355c6e05",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-image-paste-trailing-image.json b/mobile/rpc-foundation/goldens/native-chat-image-paste-trailing-image.json
index b509404dcd6..8d06f6b38e4 100644
--- a/mobile/rpc-foundation/goldens/native-chat-image-paste-trailing-image.json
+++ b/mobile/rpc-foundation/goldens/native-chat-image-paste-trailing-image.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "43575aede8307947e027239b4e582df281f6424c9216135ae20d150234f247f6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-image-paste-two-images.json b/mobile/rpc-foundation/goldens/native-chat-image-paste-two-images.json
index 750e035c57c..2d9e52523ea 100644
--- a/mobile/rpc-foundation/goldens/native-chat-image-paste-two-images.json
+++ b/mobile/rpc-foundation/goldens/native-chat-image-paste-two-images.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "4ff80434eea90f31c03522c9277983cc1c88d0292ba7c384fa9760fc1dcb03bf",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-image-upload-cancelled.json b/mobile/rpc-foundation/goldens/native-chat-image-upload-cancelled.json
index 05ddf4cc992..d59db68cb47 100644
--- a/mobile/rpc-foundation/goldens/native-chat-image-upload-cancelled.json
+++ b/mobile/rpc-foundation/goldens/native-chat-image-upload-cancelled.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "1f513883eb62cdd1673eb58809817e2b2f5fd64b74f80ed6e3b9d8c2ef2d33e9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-image-upload-second-fails.json b/mobile/rpc-foundation/goldens/native-chat-image-upload-second-fails.json
index 48e7537a4ba..8ab541e0a5e 100644
--- a/mobile/rpc-foundation/goldens/native-chat-image-upload-second-fails.json
+++ b/mobile/rpc-foundation/goldens/native-chat-image-upload-second-fails.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "181b02243b1ecf98364473ee0b3f4c82a6037b5f5bae33703ab4f611cc050db4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-image-upload-single.json b/mobile/rpc-foundation/goldens/native-chat-image-upload-single.json
index db634362e1f..8872b13f88b 100644
--- a/mobile/rpc-foundation/goldens/native-chat-image-upload-single.json
+++ b/mobile/rpc-foundation/goldens/native-chat-image-upload-single.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "d7dca3742c4086f9ced0ba4b2f6c32ee9fa9272a5a955e8623fdc9cdb4c71528",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-image-upload-start-refused.json b/mobile/rpc-foundation/goldens/native-chat-image-upload-start-refused.json
index 648641eceec..cfc77421ac2 100644
--- a/mobile/rpc-foundation/goldens/native-chat-image-upload-start-refused.json
+++ b/mobile/rpc-foundation/goldens/native-chat-image-upload-start-refused.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "09fd9bf97a4da7313e24f8c333b66c7c1af927bbea0a6d9fef9803856a608c78",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-image-upload-two.json b/mobile/rpc-foundation/goldens/native-chat-image-upload-two.json
index ee817588aec..cc008dbba90 100644
--- a/mobile/rpc-foundation/goldens/native-chat-image-upload-two.json
+++ b/mobile/rpc-foundation/goldens/native-chat-image-upload-two.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "db0397f8f6ae28de0cc7afd91552ee9416d7f7054a76a42aac02f480c6f363d5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-page-earlier.json b/mobile/rpc-foundation/goldens/native-chat-page-earlier.json
index eb74d3e1a76..7bbf8a931c2 100644
--- a/mobile/rpc-foundation/goldens/native-chat-page-earlier.json
+++ b/mobile/rpc-foundation/goldens/native-chat-page-earlier.json
@@ -3,11 +3,11 @@
   "family": "session.native-chat-page",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "60ce67f66134d6385aa7fb47f2135436a7b3ce0221e3b2514bea65e06dba5518",
-  "scenarioSha256": "674cab85ed9896dae311bfc0acfb1d1d1a2a7f25b7546b4714edbb0a585e6178",
+  "scenarioSha256": "03b41c5aabf1b5177903f199d663eb9fdcf8111dac27450518da0e53ce9af176",
   "platform": "darwin",
   "scenarioVersion": 1,
   "projectionVersion": 2,
@@ -31,20 +31,20 @@
       "status": "ready",
       "transcriptLoading": false
     },
-    "09f715780ff1": {
+    "3e14b1ec5bde": {
+      "name": "nativeChat.unsubscribe#2",
+      "ordinal": 6,
+      "json": "{\"id\":\"frame-5\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\"}}"
+    },
+    "456781b97acc": {
       "name": "nativeChat.subscribe#1",
       "ordinal": 1,
-      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
+      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
     },
-    "1c6ad14c561f": {
-      "name": "nativeChat.unsubscribe#1",
-      "ordinal": 5,
-      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1\"}}"
-    },
-    "459bc33ee698": {
+    "663babae1f1d": {
       "name": "nativeChat.subscribe#2",
       "ordinal": 4,
-      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.subscribe\",\"params\":{\"agent\":\"claude\",\"sessionId\":\"session-1\",\"limit\":40,\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\",\"capabilities\":{\"transcriptPending\":1},\"transcriptPath\":\"/work/feature/.claude/session-1.jsonl\"}}"
     },
     "7b237e9824c8": {
       "crash": {
@@ -72,6 +72,11 @@
       "status": "ready",
       "transcriptLoading": false
     },
+    "7eedfcf76fd3": {
+      "name": "nativeChat.unsubscribe#1",
+      "ordinal": 5,
+      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1:00000000-0000-4000-8000-000000000001\"}}"
+    },
     "8f91342d7840": {
       "crash": {
         "$rpc": "null"
@@ -180,11 +185,6 @@
         "startedAt": 0
       }
     },
-    "e488a88a0a50": {
-      "name": "nativeChat.unsubscribe#2",
-      "ordinal": 6,
-      "json": "{\"id\":\"frame-5\",\"deviceToken\":\"recording-device\",\"method\":\"nativeChat.unsubscribe\",\"params\":{\"subscriptionId\":\"claude:session-1\"}}"
-    },
     "eb79a9b3682a": {
       "status": "fulfilled",
       "startedAt": 0,
@@ -214,7 +214,7 @@
         "id": "subscribed",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a"
           },
@@ -226,7 +226,7 @@
         "id": "snapshot",
         "observation": {
           "sender": [],
-          "payloads": ["09f715780ff1"],
+          "payloads": ["456781b97acc"],
           "settlements": {
             "mount": "eb79a9b3682a"
           },
@@ -238,7 +238,7 @@
         "id": "paging",
         "observation": {
           "sender": ["dadae0a56731"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c"],
+          "payloads": ["456781b97acc", "08ef53d83e8c"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -251,7 +251,7 @@
         "id": "paged",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c"],
+          "payloads": ["456781b97acc", "08ef53d83e8c"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a"
@@ -264,7 +264,7 @@
         "id": "re-subscribed",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -278,7 +278,7 @@
         "id": "replayed",
         "observation": {
           "sender": ["d83fbb18104a"],
-          "payloads": ["09f715780ff1", "08ef53d83e8c", "459bc33ee698", "1c6ad14c561f"],
+          "payloads": ["456781b97acc", "08ef53d83e8c", "663babae1f1d", "7eedfcf76fd3"],
           "settlements": {
             "mount": "eb79a9b3682a",
             "page": "eb79a9b3682a",
@@ -293,11 +293,11 @@
         "observation": {
           "sender": ["d83fbb18104a"],
           "payloads": [
-            "09f715780ff1",
+            "456781b97acc",
             "08ef53d83e8c",
-            "459bc33ee698",
-            "1c6ad14c561f",
-            "e488a88a0a50"
+            "663babae1f1d",
+            "7eedfcf76fd3",
+            "3e14b1ec5bde"
           ],
           "settlements": {
             "mount": "eb79a9b3682a",
diff --git a/mobile/rpc-foundation/goldens/native-chat-readability-local-repo.json b/mobile/rpc-foundation/goldens/native-chat-readability-local-repo.json
index 3d1f2a06a6e..5d100c48edc 100644
--- a/mobile/rpc-foundation/goldens/native-chat-readability-local-repo.json
+++ b/mobile/rpc-foundation/goldens/native-chat-readability-local-repo.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-readability",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "46d80cfd496b06ce42ff1ed985e513bbf49b5188bc1128c6d01a74675741935a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-readability-refused.json b/mobile/rpc-foundation/goldens/native-chat-readability-refused.json
index 17f20cbccb7..df8d6ffd030 100644
--- a/mobile/rpc-foundation/goldens/native-chat-readability-refused.json
+++ b/mobile/rpc-foundation/goldens/native-chat-readability-refused.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-readability",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "08a9ab4f180f2d6bb44d2a23f87be0443e8dfdde15f966458270a1bb6f131e0b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-readability-remote-repo.json b/mobile/rpc-foundation/goldens/native-chat-readability-remote-repo.json
index 1ef0ed985d1..34084e6e389 100644
--- a/mobile/rpc-foundation/goldens/native-chat-readability-remote-repo.json
+++ b/mobile/rpc-foundation/goldens/native-chat-readability-remote-repo.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-readability",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "0c6afb12dce2c402dfd7ac24eb4a306e09fcacc78415ecb47b5320b2fe8102b5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-session-option-pick-empty.json b/mobile/rpc-foundation/goldens/native-chat-session-option-pick-empty.json
index c30a5291549..4d16296fe0c 100644
--- a/mobile/rpc-foundation/goldens/native-chat-session-option-pick-empty.json
+++ b/mobile/rpc-foundation/goldens/native-chat-session-option-pick-empty.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.session-option-pick",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "55f675f7d3f380db10dd966ae6d011927dbc7eb8f3abd36e09edf5043ad1131c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-session-option-pick-refused.json b/mobile/rpc-foundation/goldens/native-chat-session-option-pick-refused.json
index 22c2d206a6a..d6925dfef01 100644
--- a/mobile/rpc-foundation/goldens/native-chat-session-option-pick-refused.json
+++ b/mobile/rpc-foundation/goldens/native-chat-session-option-pick-refused.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.session-option-pick",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "57b60064eca4526e5d533de5862e7e86ba69b6722cd04692228bdc768486cd76",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-session-option-pick-written.json b/mobile/rpc-foundation/goldens/native-chat-session-option-pick-written.json
index 53a2bbc6d61..be659883d76 100644
--- a/mobile/rpc-foundation/goldens/native-chat-session-option-pick-written.json
+++ b/mobile/rpc-foundation/goldens/native-chat-session-option-pick-written.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.session-option-pick",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "a180b7ae1f84bc69d7819c7c17b1e2915cb380e8ea8543d68fe6777feb90d0bd",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-stop-accepted.json b/mobile/rpc-foundation/goldens/native-chat-stop-accepted.json
index b046bdaf34d..41a23a01f2b 100644
--- a/mobile/rpc-foundation/goldens/native-chat-stop-accepted.json
+++ b/mobile/rpc-foundation/goldens/native-chat-stop-accepted.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-stop",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "a72f08c12c244912912be34deb3ec12bada6b74f1bc29c0034b347dcba9ddb10",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-stop-both-rejected.json b/mobile/rpc-foundation/goldens/native-chat-stop-both-rejected.json
index 1152ba9abd5..951fc2e9014 100644
--- a/mobile/rpc-foundation/goldens/native-chat-stop-both-rejected.json
+++ b/mobile/rpc-foundation/goldens/native-chat-stop-both-rejected.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-stop",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "a7419d4b3e00d49ebdac7db4fa97ad9d3af9516201f9102beed0376b181e74a5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-stop-delivery-unknown.json b/mobile/rpc-foundation/goldens/native-chat-stop-delivery-unknown.json
index f6eee236170..70f8738cb10 100644
--- a/mobile/rpc-foundation/goldens/native-chat-stop-delivery-unknown.json
+++ b/mobile/rpc-foundation/goldens/native-chat-stop-delivery-unknown.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-stop",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "977ee5602e3a612d537686d17d15312f8b0e775df8800b27bb0d42b8642b4675",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-write-accepted.json b/mobile/rpc-foundation/goldens/native-chat-write-accepted.json
index e351d79bee6..9fdec7ec512 100644
--- a/mobile/rpc-foundation/goldens/native-chat-write-accepted.json
+++ b/mobile/rpc-foundation/goldens/native-chat-write-accepted.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.terminal-write",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "3e8804f21d32370bb0bc48c4ea3d182748d48dc19d73de1b50005f18368566ba",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-write-clear-line.json b/mobile/rpc-foundation/goldens/native-chat-write-clear-line.json
index 34d7db05595..245edecc084 100644
--- a/mobile/rpc-foundation/goldens/native-chat-write-clear-line.json
+++ b/mobile/rpc-foundation/goldens/native-chat-write-clear-line.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.terminal-write",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "b8265928eefc167de59c64dc62ebe40635007a5f73c87ec8b6eb5e0f6dc0ce00",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-write-delivery-unknown.json b/mobile/rpc-foundation/goldens/native-chat-write-delivery-unknown.json
index 267d4150ea9..c29ed1e57b1 100644
--- a/mobile/rpc-foundation/goldens/native-chat-write-delivery-unknown.json
+++ b/mobile/rpc-foundation/goldens/native-chat-write-delivery-unknown.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.terminal-write",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "22f7711ed82a4d56f1886a746838e3eb85c555c9069694ba3aa958e121cc1ee9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-write-rejected.json b/mobile/rpc-foundation/goldens/native-chat-write-rejected.json
index 2f6b817b044..1e894bac5c3 100644
--- a/mobile/rpc-foundation/goldens/native-chat-write-rejected.json
+++ b/mobile/rpc-foundation/goldens/native-chat-write-rejected.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.terminal-write",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "7e05773966a18123aaae297aed9ac44bd841713de88c8a1fa30c31b324118f6f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-write-typed-command.json b/mobile/rpc-foundation/goldens/native-chat-write-typed-command.json
index d75062d25bd..96a61101162 100644
--- a/mobile/rpc-foundation/goldens/native-chat-write-typed-command.json
+++ b/mobile/rpc-foundation/goldens/native-chat-write-typed-command.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.terminal-write",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "a89ff803859c60e5645126de8b0f423807c435dcd856fe8825721f71f3b5bec5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/new-tab-local-agents.json b/mobile/rpc-foundation/goldens/new-tab-local-agents.json
index 86b0e0a1db9..c7488f41069 100644
--- a/mobile/rpc-foundation/goldens/new-tab-local-agents.json
+++ b/mobile/rpc-foundation/goldens/new-tab-local-agents.json
@@ -3,9 +3,9 @@
   "family": "settings.new-tab-local-agents",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "ef016c6b4b77ba0c40b6feba2f670398c641f8ce9f411896e3ae41f38d8be17d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/new-workspace-repositories-fulfilled.json b/mobile/rpc-foundation/goldens/new-workspace-repositories-fulfilled.json
index 5f07c65340f..eb9891af278 100644
--- a/mobile/rpc-foundation/goldens/new-workspace-repositories-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/new-workspace-repositories-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "components.new-workspace-repositories",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "64c1772f0f95a3c43fbb14398a8804b2b4784f7f18874e4fd79767ae634c7faa",
   "scenarioSha256": "41ac47445191a24de5e48877478bdab6fd9c030f48024ea43e053de7b6b68bb5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/notifications-desktop-stream-closed.json b/mobile/rpc-foundation/goldens/notifications-desktop-stream-closed.json
index 2fc50529497..0e6293c5977 100644
--- a/mobile/rpc-foundation/goldens/notifications-desktop-stream-closed.json
+++ b/mobile/rpc-foundation/goldens/notifications-desktop-stream-closed.json
@@ -3,11 +3,11 @@
   "family": "notifications.desktop-stream",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f0b64994ed7d98c0479488e37df23cc997468e1be9b1466a9da91ac1a6260b43",
-  "scenarioSha256": "c19acf00cef5d466c9116b953e9c87f1fdcb10a2b71c29c811ebc4649dac6916",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "eacf859143588ae6bee2804975d642b6c1088d57ae77ffe298620250d9a9f0e4",
+  "scenarioSha256": "24f8c05639f82bc5e32abe3864c3d01a0589e295369028929fed2f0c684f1d0c",
   "platform": "darwin",
   "scenarioVersion": 1,
   "projectionVersion": 2,
@@ -59,14 +59,48 @@
         }
       }
     },
-    "1a6e545a32e3": {
-      "name": "notifications.unsubscribe#1",
-      "ordinal": 4,
-      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.unsubscribe\",\"params\":{\"subscriptionId\":\"sub-1\"}}"
-    },
     "5359579cc62d": {
       "running": true
     },
+    "6a8123e61fb7": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 4,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": {
+            "unsubscribed": true
+          }
+        }
+      }
+    },
+    "851428b22bd4": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 5,
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.unsubscribe\",\"params\":{\"subscriptionId\":\"sub-1\"}}"
+    },
     "a0b2bcfcde77": {
       "running": false
     },
@@ -107,8 +141,8 @@
       {
         "id": "stopped",
         "observation": {
-          "sender": ["0493957d4faf"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "1a6e545a32e3"],
+          "sender": ["0493957d4faf", "6a8123e61fb7"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "851428b22bd4"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -120,8 +154,8 @@
       {
         "id": "not-replayed",
         "observation": {
-          "sender": ["0493957d4faf"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "1a6e545a32e3"],
+          "sender": ["0493957d4faf", "6a8123e61fb7"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "851428b22bd4"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a",
diff --git a/mobile/rpc-foundation/goldens/notifications-desktop-stream-replayed.json b/mobile/rpc-foundation/goldens/notifications-desktop-stream-replayed.json
index 3b29f54cd29..9405eef6c5e 100644
--- a/mobile/rpc-foundation/goldens/notifications-desktop-stream-replayed.json
+++ b/mobile/rpc-foundation/goldens/notifications-desktop-stream-replayed.json
@@ -3,11 +3,11 @@
   "family": "notifications.desktop-stream",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f0b64994ed7d98c0479488e37df23cc997468e1be9b1466a9da91ac1a6260b43",
-  "scenarioSha256": "28d71243b6822c6c2a6abf588f08b582c71f023c97cfa1336929d1cb0d05f0b6",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "eacf859143588ae6bee2804975d642b6c1088d57ae77ffe298620250d9a9f0e4",
+  "scenarioSha256": "0495c25d6e5d8a84fe4192d7aa0e2901fe86ede19ac9c4d72dee27da6694878b",
   "platform": "darwin",
   "scenarioVersion": 1,
   "projectionVersion": 2,
@@ -59,14 +59,40 @@
         }
       }
     },
-    "18432013281e": {
-      "name": "notifications.getMissedSince#2",
+    "22254be88a80": {
+      "name": "device-store.setItem",
       "ordinal": 7,
-      "json": "{\"id\":\"frame-5\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.getMissedSince\",\"params\":{\"lastSeenSeq\":9007199254740991,\"deliveredPushes\":[{\"notificationId\":\"note-1\",\"notificationEpoch\":\"epoch-1\",\"notificationSeq\":7},{\"notificationId\":\"note-2\",\"notificationEpoch\":\"epoch-1\",\"notificationSeq\":8}]}}"
+      "value": {
+        "key": "orca:pushDismissalWatermarks:v1",
+        "value": "[{\"key\":\"[\\\"Yw3NKWbEM2aRElRI\\\",\\\"epoch-1\\\",\\\"note-2\\\"]\",\"seq\":8,\"expiresAt\":1767312000000}]"
+      }
     },
-    "255bc308b04a": {
+    "3c58107b56ba": {
+      "name": "notification-tray.dismiss",
+      "ordinal": 8,
+      "value": {
+        "identifier": "tray-2"
+      }
+    },
+    "426bfb8eb550": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 10,
+      "json": "{\"id\":\"frame-5\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.unsubscribe\",\"params\":{\"subscriptionId\":\"sub-2\"}}"
+    },
+    "4a6b45030823": {
+      "name": "notifications.subscribe#2",
+      "ordinal": 4,
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.subscribe\",\"params\":{\"includeDesktopSuppressed\":true}}"
+    },
+    "5359579cc62d": {
+      "running": true
+    },
+    "a0b2bcfcde77": {
+      "running": false
+    },
+    "bf23abc43d09": {
       "name": "notifications.getMissedSince#2",
-      "ordinal": 6,
+      "ordinal": 5,
       "args": [
         {
           "name": "method",
@@ -102,7 +128,7 @@
         "startedAt": 0,
         "settledAt": 0,
         "value": {
-          "id": "frame-5",
+          "id": "frame-4",
           "ok": true,
           "result": {
             "dismissedPushes": [
@@ -116,42 +142,40 @@
         }
       }
     },
-    "28e98ef5b5dc": {
+    "d2abb60019cf": {
       "name": "notifications.unsubscribe#1",
-      "ordinal": 5,
-      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.unsubscribe\",\"params\":{\"subscriptionId\":\"sub-1\"}}"
-    },
-    "4a6b45030823": {
-      "name": "notifications.subscribe#2",
-      "ordinal": 4,
-      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.subscribe\",\"params\":{\"includeDesktopSuppressed\":true}}"
-    },
-    "5359579cc62d": {
-      "running": true
-    },
-    "7956587756c3": {
-      "name": "device-store.setItem",
-      "ordinal": 8,
-      "value": {
-        "key": "orca:pushDismissalWatermarks:v1",
-        "value": "[{\"key\":\"[\\\"Yw3NKWbEM2aRElRI\\\",\\\"epoch-1\\\",\\\"note-2\\\"]\",\"seq\":8,\"expiresAt\":1767312000000}]"
-      }
-    },
-    "865d199fe5a5": {
-      "name": "notification-tray.dismiss",
       "ordinal": 9,
-      "value": {
-        "identifier": "tray-2"
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-2"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-5",
+          "ok": true,
+          "result": {
+            "unsubscribed": true
+          }
+        }
       }
     },
-    "8be5078e2020": {
-      "name": "notifications.unsubscribe#2",
-      "ordinal": 10,
-      "json": "{\"id\":\"frame-6\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.unsubscribe\",\"params\":{\"subscriptionId\":\"sub-2\"}}"
-    },
-    "a0b2bcfcde77": {
-      "running": false
-    },
     "e074c0b6fa0a": {
       "name": "notifications.getMissedSince#1",
       "ordinal": 3,
@@ -169,6 +193,11 @@
       "name": "notifications.subscribe#1",
       "ordinal": 1,
       "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.subscribe\",\"params\":{\"includeDesktopSuppressed\":true}}"
+    },
+    "fc46b617ff4e": {
+      "name": "notifications.getMissedSince#2",
+      "ordinal": 6,
+      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.getMissedSince\",\"params\":{\"lastSeenSeq\":9007199254740991,\"deliveredPushes\":[{\"notificationId\":\"note-1\",\"notificationEpoch\":\"epoch-1\",\"notificationSeq\":7},{\"notificationId\":\"note-2\",\"notificationEpoch\":\"epoch-1\",\"notificationSeq\":8}]}}"
     }
   },
   "recording": {
@@ -190,7 +219,7 @@
         "id": "re-subscribed",
         "observation": {
           "sender": ["0493957d4faf"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4a6b45030823", "28e98ef5b5dc"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4a6b45030823"],
           "settlements": {
             "start": "eb79a9b3682a",
             "cutover": "eb79a9b3682a"
@@ -202,33 +231,26 @@
       {
         "id": "replayed",
         "observation": {
-          "sender": ["0493957d4faf", "255bc308b04a"],
-          "payloads": [
-            "f552b5040ec7",
-            "e074c0b6fa0a",
-            "4a6b45030823",
-            "28e98ef5b5dc",
-            "18432013281e"
-          ],
+          "sender": ["0493957d4faf", "bf23abc43d09"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4a6b45030823", "fc46b617ff4e"],
           "settlements": {
             "start": "eb79a9b3682a",
             "cutover": "eb79a9b3682a"
           },
           "state": "5359579cc62d",
-          "effects": ["7956587756c3", "865d199fe5a5"]
+          "effects": ["22254be88a80", "3c58107b56ba"]
         }
       },
       {
         "id": "stopped",
         "observation": {
-          "sender": ["0493957d4faf", "255bc308b04a"],
+          "sender": ["0493957d4faf", "bf23abc43d09", "d2abb60019cf"],
           "payloads": [
             "f552b5040ec7",
             "e074c0b6fa0a",
             "4a6b45030823",
-            "28e98ef5b5dc",
-            "18432013281e",
-            "8be5078e2020"
+            "fc46b617ff4e",
+            "426bfb8eb550"
           ],
           "settlements": {
             "start": "eb79a9b3682a",
@@ -236,7 +258,7 @@
             "stop": "eb79a9b3682a"
           },
           "state": "a0b2bcfcde77",
-          "effects": ["7956587756c3", "865d199fe5a5"]
+          "effects": ["22254be88a80", "3c58107b56ba"]
         }
       }
     ]
diff --git a/mobile/rpc-foundation/goldens/notifications-desktop-stream.json b/mobile/rpc-foundation/goldens/notifications-desktop-stream.json
index 8c80566444c..17961bd1445 100644
--- a/mobile/rpc-foundation/goldens/notifications-desktop-stream.json
+++ b/mobile/rpc-foundation/goldens/notifications-desktop-stream.json
@@ -3,11 +3,11 @@
   "family": "notifications.desktop-stream",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f0b64994ed7d98c0479488e37df23cc997468e1be9b1466a9da91ac1a6260b43",
-  "scenarioSha256": "bc355d0cddf9e9771f20d28b10aae59a03ffb88dcff7d5a6a124fb307b260647",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "eacf859143588ae6bee2804975d642b6c1088d57ae77ffe298620250d9a9f0e4",
+  "scenarioSha256": "359add5203e68fcb85586f06babb694ee9d548e1dc58481e6d03871ab9f922cb",
   "platform": "darwin",
   "scenarioVersion": 1,
   "projectionVersion": 2,
@@ -65,11 +65,6 @@
         }
       }
     },
-    "2637263140a2": {
-      "name": "notifications.unsubscribe#1",
-      "ordinal": 8,
-      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.unsubscribe\",\"params\":{\"subscriptionId\":\"sub-1\"}}"
-    },
     "45aca32cac62": {
       "name": "notification-tray.dismiss",
       "ordinal": 7,
@@ -85,6 +80,11 @@
         "value": "[{\"key\":\"[\\\"Yw3NKWbEM2aRElRI\\\",\\\"epoch-1\\\",\\\"note-2\\\"]\",\"seq\":8,\"expiresAt\":1767312000000}]"
       }
     },
+    "4c376c5d53ac": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 9,
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"notifications.unsubscribe\",\"params\":{\"subscriptionId\":\"sub-1\"}}"
+    },
     "5359579cc62d": {
       "running": true
     },
@@ -126,6 +126,66 @@
         "startedAt": 0
       }
     },
+    "96f940529e7e": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "pending",
+        "startedAt": 0
+      }
+    },
+    "97d75ba51dcd": {
+      "name": "notifications.unsubscribe#1",
+      "ordinal": 8,
+      "args": [
+        {
+          "name": "method",
+          "value": "notifications.unsubscribe"
+        },
+        {
+          "name": "params",
+          "value": {
+            "subscriptionId": "sub-1"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": {
+            "unsubscribed": true
+          }
+        }
+      }
+    },
     "a0b2bcfcde77": {
       "running": false
     },
@@ -217,8 +277,8 @@
       {
         "id": "unsubscribing",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2637263140a2"],
+          "sender": ["18a100fb6bae", "96f940529e7e"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
@@ -230,8 +290,8 @@
       {
         "id": "stopped",
         "observation": {
-          "sender": ["18a100fb6bae"],
-          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "2637263140a2"],
+          "sender": ["18a100fb6bae", "97d75ba51dcd"],
+          "payloads": ["f552b5040ec7", "e074c0b6fa0a", "4c376c5d53ac"],
           "settlements": {
             "start": "eb79a9b3682a",
             "stop": "eb79a9b3682a"
diff --git a/mobile/rpc-foundation/goldens/notifications-display-test-accepted.json b/mobile/rpc-foundation/goldens/notifications-display-test-accepted.json
index f1a678c389b..802e6fd81c4 100644
--- a/mobile/rpc-foundation/goldens/notifications-display-test-accepted.json
+++ b/mobile/rpc-foundation/goldens/notifications-display-test-accepted.json
@@ -3,9 +3,9 @@
   "family": "notifications.display-test-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f55275c268e49679b37d72ce6cbe71186ce02c77fe3fd53f0f21e796502d62e8",
   "scenarioSha256": "e19c4ff95d568edbb5c0d6058eb17843be31bdfd528825985963f8ece8cbc652",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/notifications-display-test-not-registered.json b/mobile/rpc-foundation/goldens/notifications-display-test-not-registered.json
index 5f5b0b2dade..512abccdb72 100644
--- a/mobile/rpc-foundation/goldens/notifications-display-test-not-registered.json
+++ b/mobile/rpc-foundation/goldens/notifications-display-test-not-registered.json
@@ -3,9 +3,9 @@
   "family": "notifications.display-test-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f55275c268e49679b37d72ce6cbe71186ce02c77fe3fd53f0f21e796502d62e8",
   "scenarioSha256": "3edeb5f744ed832104df750544b99fea1a1cd9d1b8d2f3f9a5e7c13b415edc3e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/notifications-display-test-rate-limited.json b/mobile/rpc-foundation/goldens/notifications-display-test-rate-limited.json
index 9a165125b2f..bf331d49418 100644
--- a/mobile/rpc-foundation/goldens/notifications-display-test-rate-limited.json
+++ b/mobile/rpc-foundation/goldens/notifications-display-test-rate-limited.json
@@ -3,9 +3,9 @@
   "family": "notifications.display-test-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f55275c268e49679b37d72ce6cbe71186ce02c77fe3fd53f0f21e796502d62e8",
   "scenarioSha256": "53827d812956f05e86d72e44effd017270328eb36588ca90431cf9a8ae97b146",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/notifications-display-test-unknown-reason.json b/mobile/rpc-foundation/goldens/notifications-display-test-unknown-reason.json
index 0232deb6c0c..b423a713326 100644
--- a/mobile/rpc-foundation/goldens/notifications-display-test-unknown-reason.json
+++ b/mobile/rpc-foundation/goldens/notifications-display-test-unknown-reason.json
@@ -3,9 +3,9 @@
   "family": "notifications.display-test-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f55275c268e49679b37d72ce6cbe71186ce02c77fe3fd53f0f21e796502d62e8",
   "scenarioSha256": "37439be5aba4a84cf6c12c5f583a0334405792387edb72ceab388e7c64109eff",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/notifications-push-gateway-rejected.json b/mobile/rpc-foundation/goldens/notifications-push-gateway-rejected.json
index 870e4afa16c..b5dbf04f101 100644
--- a/mobile/rpc-foundation/goldens/notifications-push-gateway-rejected.json
+++ b/mobile/rpc-foundation/goldens/notifications-push-gateway-rejected.json
@@ -3,9 +3,9 @@
   "family": "notifications.push-registration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2e3d939dc162dbc5a38d8a7207111688204a825fd70348721917b3016e1c9470",
   "scenarioSha256": "ac2b214ece34dc25aef2b73d020e04343f81cd48b3d243508be92cfdba01eb45",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/notifications-push-registered.json b/mobile/rpc-foundation/goldens/notifications-push-registered.json
index d3bfd1ae3ae..ec19858aa52 100644
--- a/mobile/rpc-foundation/goldens/notifications-push-registered.json
+++ b/mobile/rpc-foundation/goldens/notifications-push-registered.json
@@ -3,9 +3,9 @@
   "family": "notifications.push-registration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2e3d939dc162dbc5a38d8a7207111688204a825fd70348721917b3016e1c9470",
   "scenarioSha256": "90f49e430518bfc6e662da1d0c55b0084f30ab54dabdd15293b1f8ad9d2fa592",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/pairing-pre-profile-direct-wins-and-provisions.json b/mobile/rpc-foundation/goldens/pairing-pre-profile-direct-wins-and-provisions.json
index 0d329857d08..3175ac457fc 100644
--- a/mobile/rpc-foundation/goldens/pairing-pre-profile-direct-wins-and-provisions.json
+++ b/mobile/rpc-foundation/goldens/pairing-pre-profile-direct-wins-and-provisions.json
@@ -3,10 +3,10 @@
   "family": "pairing.pre-profile",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "e4fb7aa3b071c1207f206adcc0f31e92b6bb98a80f86a0772e48b5cebcab24ff",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/pairing-pre-profile-provision-unsupported-saves-direct-host.json b/mobile/rpc-foundation/goldens/pairing-pre-profile-provision-unsupported-saves-direct-host.json
index 2d99a2614a6..717c6909355 100644
--- a/mobile/rpc-foundation/goldens/pairing-pre-profile-provision-unsupported-saves-direct-host.json
+++ b/mobile/rpc-foundation/goldens/pairing-pre-profile-provision-unsupported-saves-direct-host.json
@@ -3,10 +3,10 @@
   "family": "pairing.pre-profile",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "5696ea2a62bb3f24902305f8bac0c4ae8f1e505f359db76fd69aabe353adae86",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/pairing-pre-profile-times-out.json b/mobile/rpc-foundation/goldens/pairing-pre-profile-times-out.json
index 6b800354e31..f564b4ad354 100644
--- a/mobile/rpc-foundation/goldens/pairing-pre-profile-times-out.json
+++ b/mobile/rpc-foundation/goldens/pairing-pre-profile-times-out.json
@@ -3,10 +3,10 @@
   "family": "pairing.pre-profile",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "9ab72231bf97fbe7eed232019c56568a9411433835eae424628af62c7c6a10c1",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/pr-branch-identity.json b/mobile/rpc-foundation/goldens/pr-branch-identity.json
index 2dbcaeeb91a..27a580e2e82 100644
--- a/mobile/rpc-foundation/goldens/pr-branch-identity.json
+++ b/mobile/rpc-foundation/goldens/pr-branch-identity.json
@@ -3,10 +3,10 @@
   "family": "session.pr-branch-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "d1b208a7bee947a603949fdc1f0d145e8c5576926f89f3e32330585f3a115290",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/pr-branch-repo-context.json b/mobile/rpc-foundation/goldens/pr-branch-repo-context.json
index e9379e1f8ea..f071b7d069b 100644
--- a/mobile/rpc-foundation/goldens/pr-branch-repo-context.json
+++ b/mobile/rpc-foundation/goldens/pr-branch-repo-context.json
@@ -3,10 +3,10 @@
   "family": "session.pr-branch-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "bd715681a856254e0c374b504cece07e5df4c9a75fa2b97c35498df12210fbab",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/pr-comment-mutation.json b/mobile/rpc-foundation/goldens/pr-comment-mutation.json
index cb9a77d2659..f9bbfe85e9a 100644
--- a/mobile/rpc-foundation/goldens/pr-comment-mutation.json
+++ b/mobile/rpc-foundation/goldens/pr-comment-mutation.json
@@ -3,10 +3,10 @@
   "family": "github.pr-comment-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "73cc5da2649b9687bb0d8247fa4ecf3c085746cf398515e8d2b40be2ed0da688",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/pr-comment-resolve-unconfirmed.json b/mobile/rpc-foundation/goldens/pr-comment-resolve-unconfirmed.json
index 06ea01ca782..5f90887db95 100644
--- a/mobile/rpc-foundation/goldens/pr-comment-resolve-unconfirmed.json
+++ b/mobile/rpc-foundation/goldens/pr-comment-resolve-unconfirmed.json
@@ -3,10 +3,10 @@
   "family": "github.pr-comment-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "f425131d29fee8826c00a550fb537d0bd1a37bbaf3b33992984d5e04a990a512",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/pr-mutation-in-band-failure.json b/mobile/rpc-foundation/goldens/pr-mutation-in-band-failure.json
index 36217371111..fe065ccf92f 100644
--- a/mobile/rpc-foundation/goldens/pr-mutation-in-band-failure.json
+++ b/mobile/rpc-foundation/goldens/pr-mutation-in-band-failure.json
@@ -3,10 +3,10 @@
   "family": "github.pr-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "70a94f45dbf7d58d9024c1cc4c94edd98fa48cd5ccffe8f2b7c53fa3e55d18d3",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/pr-mutation-status.json b/mobile/rpc-foundation/goldens/pr-mutation-status.json
index 782f8c8f4db..05068392a19 100644
--- a/mobile/rpc-foundation/goldens/pr-mutation-status.json
+++ b/mobile/rpc-foundation/goldens/pr-mutation-status.json
@@ -3,10 +3,10 @@
   "family": "github.pr-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "e9291209234bacab12201f4c13bb592e06bd405215389e19f0754c23e79eb197",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/pr-read-fork-routing.json b/mobile/rpc-foundation/goldens/pr-read-fork-routing.json
index ee371e85505..a692f2f9414 100644
--- a/mobile/rpc-foundation/goldens/pr-read-fork-routing.json
+++ b/mobile/rpc-foundation/goldens/pr-read-fork-routing.json
@@ -3,10 +3,10 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "ba21f7fc3966cb1e3c1e59d6e8a8b184fa0559bf3037365391ce23e364befd7f",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/pr-read-surface.json b/mobile/rpc-foundation/goldens/pr-read-surface.json
index 39418bfb4fc..383a5dc6a7e 100644
--- a/mobile/rpc-foundation/goldens/pr-read-surface.json
+++ b/mobile/rpc-foundation/goldens/pr-read-surface.json
@@ -3,10 +3,10 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "4246e7ffa62e85aac489c561171a6468f862b7f18eefac9926b65073616b6d35",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/pr-read-upstream-error.json b/mobile/rpc-foundation/goldens/pr-read-upstream-error.json
index 4cc041e3530..0b3f9839ac1 100644
--- a/mobile/rpc-foundation/goldens/pr-read-upstream-error.json
+++ b/mobile/rpc-foundation/goldens/pr-read-upstream-error.json
@@ -3,10 +3,10 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "b2445b299e18664b698d659c5041860b8a253314687666ae467aab441ab07235",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/pr-sidebar-checks-refused.json b/mobile/rpc-foundation/goldens/pr-sidebar-checks-refused.json
index 1ab293f693d..decafb2e4f9 100644
--- a/mobile/rpc-foundation/goldens/pr-sidebar-checks-refused.json
+++ b/mobile/rpc-foundation/goldens/pr-sidebar-checks-refused.json
@@ -3,9 +3,9 @@
   "family": "session.pr-sidebar",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "87ffa2daea415d2682f1112025b5bd9d52404c6fc7c239180a3ad2120678ff1f",
   "scenarioSha256": "1b489d319f6517fe2ee33beaeedf4e0cb0f531c952dc7e9f833ca814366d60cb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/pr-sidebar-load.json b/mobile/rpc-foundation/goldens/pr-sidebar-load.json
index 4afb839a663..e366e8527f7 100644
--- a/mobile/rpc-foundation/goldens/pr-sidebar-load.json
+++ b/mobile/rpc-foundation/goldens/pr-sidebar-load.json
@@ -3,9 +3,9 @@
   "family": "session.pr-sidebar",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "87ffa2daea415d2682f1112025b5bd9d52404c6fc7c239180a3ad2120678ff1f",
   "scenarioSha256": "d4da89a37325ac4e92d9eae8de33f9cc6d9414fcf89a4f44064a7b1e4254102a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/pr-title-mutation.json b/mobile/rpc-foundation/goldens/pr-title-mutation.json
index c8a4df1fe0a..ded7d335836 100644
--- a/mobile/rpc-foundation/goldens/pr-title-mutation.json
+++ b/mobile/rpc-foundation/goldens/pr-title-mutation.json
@@ -3,10 +3,10 @@
   "family": "github.pr-title-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "071e745453795d18d683aaab63e810783e3cee4927b47425c20a3d915397d0dd",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/pr-title-unconfirmed.json b/mobile/rpc-foundation/goldens/pr-title-unconfirmed.json
index 6c33887d147..da0188d3114 100644
--- a/mobile/rpc-foundation/goldens/pr-title-unconfirmed.json
+++ b/mobile/rpc-foundation/goldens/pr-title-unconfirmed.json
@@ -3,10 +3,10 @@
   "family": "github.pr-title-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
   "scenarioSha256": "669260c675021b37252dc5023a7a78e4e90536c2f35d9a5da3e53778e6a0cf52",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/pr-triage-invalid-terminal.json b/mobile/rpc-foundation/goldens/pr-triage-invalid-terminal.json
deleted file mode 100644
index 361fc44ad03..00000000000
--- a/mobile/rpc-foundation/goldens/pr-triage-invalid-terminal.json
+++ /dev/null
@@ -1,91 +0,0 @@
-{
-  "operation": "session.pr-triage-launch",
-  "family": "session.pr-triage",
-  "namedDeltas": [],
-  "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
-  "scenarioSha256": "58ad4e4d5b0200c44f329236e10fd81918a1cc36b33b22cba24662c79dd61b4e",
-  "platform": "darwin",
-  "scenarioVersion": 1,
-  "projectionVersion": 2,
-  "goldenFormatVersion": 5,
-  "values": {
-    "2540affc8fa5": {
-      "name": "session.tabs.createTerminal#1",
-      "ordinal": 1,
-      "args": [
-        {
-          "name": "method",
-          "value": "session.tabs.createTerminal"
-        },
-        {
-          "name": "params",
-          "value": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:repo-9::/w"
-          }
-        },
-        {
-          "name": "options",
-          "value": {
-            "$rpc": "absent"
-          }
-        }
-      ],
-      "settlement": {
-        "status": "fulfilled",
-        "startedAt": 0,
-        "settledAt": 0,
-        "value": {
-          "id": "frame-1",
-          "ok": true,
-          "result": {
-            "tab": {
-              "id": "tab-1"
-            }
-          }
-        }
-      }
-    },
-    "478ad4afe83e": {
-      "status": "rejected",
-      "startedAt": 0,
-      "settledAt": 0,
-      "error": {
-        "category": "Error",
-        "message": "The host sent a reply this app could not read (session.tabs.createTerminal)",
-        "isRpcDeliveryUnknown": false
-      }
-    },
-    "94d38f1838f6": {
-      "name": "session.tabs.createTerminal#1",
-      "ordinal": 2,
-      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"session.tabs.createTerminal\",\"params\":{\"worktree\":\"id:repo-9::/w\",\"activate\":false,\"select\":true,\"navigation\":\"caller\"}}"
-    },
-    "a4273b38df83": {
-      "launched": "unlaunched"
-    }
-  },
-  "recording": {
-    "scenario": "pr-triage-invalid-terminal",
-    "checkpoints": [
-      {
-        "id": "invalid",
-        "observation": {
-          "sender": ["2540affc8fa5"],
-          "payloads": ["94d38f1838f6"],
-          "settlements": {
-            "launch": "478ad4afe83e"
-          },
-          "state": "a4273b38df83",
-          "effects": []
-        }
-      }
-    ]
-  }
-}
diff --git a/mobile/rpc-foundation/goldens/pr-triage-launch-unconfirmed.json b/mobile/rpc-foundation/goldens/pr-triage-launch-unconfirmed.json
new file mode 100644
index 00000000000..d8737cdd93e
--- /dev/null
+++ b/mobile/rpc-foundation/goldens/pr-triage-launch-unconfirmed.json
@@ -0,0 +1,220 @@
+{
+  "operation": "session.pr-triage-launch",
+  "family": "session.pr-triage",
+  "namedDeltas": [],
+  "runnerVersion": 1,
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
+  "scenarioSha256": "ca8e7ca631e72fbec9f3264a2ece10f171c258dc888922e4931ea481a70ecc62",
+  "platform": "darwin",
+  "scenarioVersion": 1,
+  "projectionVersion": 2,
+  "goldenFormatVersion": 5,
+  "values": {
+    "02188f091419": {
+      "name": "settings.get#1",
+      "ordinal": 2,
+      "args": [
+        {
+          "name": "method",
+          "value": "settings.get"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-2",
+          "ok": true,
+          "result": {
+            "settings": {
+              "defaultTuiAgent": "codex",
+              "disabledTuiAgents": []
+            }
+          }
+        }
+      }
+    },
+    "1c2564f1daca": {
+      "name": "settings.get#1",
+      "ordinal": 4,
+      "json": "{\"id\":\"frame-2\",\"deviceToken\":\"recording-device\",\"method\":\"settings.get\"}"
+    },
+    "28339abecf78": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 8,
+      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"agent.launchReplay\",\"params\":{\"agent\":\"codex\",\"operationId\":\"1767225600000-00000000000040008000000000000001\",\"target\":{\"kind\":\"existing\",\"worktree\":\"id:repo-9::/w\"},\"prompt\":{\"text\":\"Fix the failing checks\",\"delivery\":\"submit\"},\"launchSource\":\"task_page\"}}"
+    },
+    "3e6a0417d2ee": {
+      "name": "repo.list#1",
+      "ordinal": 1,
+      "args": [
+        {
+          "name": "method",
+          "value": "repo.list"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-1",
+          "ok": true,
+          "result": {
+            "repos": [
+              {
+                "id": "repo-9"
+              }
+            ]
+          }
+        }
+      }
+    },
+    "9c16efc31903": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 5,
+      "args": [
+        {
+          "name": "method",
+          "value": "preflight.detectAgents"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": ["codex"]
+        }
+      }
+    },
+    "c15f33d27bd2": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "agent.launchReplay"
+        },
+        {
+          "name": "params",
+          "value": {
+            "agent": "codex",
+            "launchSource": "task_page",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "prompt": {
+              "delivery": "submit",
+              "text": "Fix the failing checks"
+            },
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            }
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "timeoutMs": 90000
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "error": {
+            "code": "agent_session_operation_unknown",
+            "message": "agent_session_operation_unknown"
+          },
+          "id": "frame-4",
+          "ok": false
+        }
+      }
+    },
+    "e0eef7c9fafe": {
+      "name": "repo.list#1",
+      "ordinal": 3,
+      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"repo.list\"}"
+    },
+    "eaa398d8c3aa": {
+      "launched": {
+        "kind": "unconfirmed",
+        "message": "Couldn't confirm the agent started. Check the workspace before trying again."
+      }
+    },
+    "eb79a9b3682a": {
+      "status": "fulfilled",
+      "startedAt": 0,
+      "settledAt": 0,
+      "value": {
+        "$rpc": "undefined"
+      }
+    },
+    "f49d184679d1": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 6,
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"preflight.detectAgents\"}"
+    }
+  },
+  "recording": {
+    "scenario": "pr-triage-launch-unconfirmed",
+    "checkpoints": [
+      {
+        "id": "unconfirmed",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "9c16efc31903", "c15f33d27bd2"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1", "28339abecf78"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "eaa398d8c3aa",
+          "effects": []
+        }
+      }
+    ]
+  }
+}
diff --git a/mobile/rpc-foundation/goldens/pr-triage-launch.json b/mobile/rpc-foundation/goldens/pr-triage-launch.json
index 16ab2244e56..6ff7103ef1f 100644
--- a/mobile/rpc-foundation/goldens/pr-triage-launch.json
+++ b/mobile/rpc-foundation/goldens/pr-triage-launch.json
@@ -3,130 +3,29 @@
   "family": "session.pr-triage",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
-  "scenarioSha256": "8bb2ff4e899ee873289fed7c1ef12e7f9dba91949125b1f0e4336d378ceb071e",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
+  "scenarioSha256": "b7c9498eea67df2f670911e3b868a44ba77833813c17e7800dba52ebff530350",
   "platform": "darwin",
   "scenarioVersion": 1,
   "projectionVersion": 2,
   "goldenFormatVersion": 5,
   "values": {
-    "280ce0d6f832": {
-      "name": "terminal.send#1",
-      "ordinal": 4,
-      "json": "{\"id\":\"frame-2\",\"deviceToken\":\"recording-device\",\"method\":\"terminal.send\",\"params\":{\"terminal\":\"term-1\",\"text\":\"Fix the failing checks\",\"enter\":true}}"
-    },
-    "5093e98ba369": {
-      "name": "session.tabs.createTerminal#1",
-      "ordinal": 1,
-      "args": [
-        {
-          "name": "method",
-          "value": "session.tabs.createTerminal"
-        },
-        {
-          "name": "params",
-          "value": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:repo-9::/w"
-          }
-        },
-        {
-          "name": "options",
-          "value": {
-            "$rpc": "absent"
-          }
-        }
-      ],
-      "settlement": {
-        "status": "fulfilled",
-        "startedAt": 0,
-        "settledAt": 0,
-        "value": {
-          "id": "frame-1",
-          "ok": true,
-          "result": {
-            "tab": {
-              "id": "tab-1",
-              "terminal": "term-1",
-              "title": "Agent",
-              "type": "terminal"
-            }
-          }
-        }
-      }
-    },
-    "9270aeb7d9c6": {
-      "status": "pending",
-      "startedAt": 0
-    },
-    "94d38f1838f6": {
-      "name": "session.tabs.createTerminal#1",
+    "02188f091419": {
+      "name": "settings.get#1",
       "ordinal": 2,
-      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"session.tabs.createTerminal\",\"params\":{\"worktree\":\"id:repo-9::/w\",\"activate\":false,\"select\":true,\"navigation\":\"caller\"}}"
-    },
-    "a4273b38df83": {
-      "launched": "unlaunched"
-    },
-    "eb79a9b3682a": {
-      "status": "fulfilled",
-      "startedAt": 0,
-      "settledAt": 0,
-      "value": {
-        "$rpc": "undefined"
-      }
-    },
-    "f9b284ac2424": {
-      "name": "session.tabs.createTerminal#1",
-      "ordinal": 1,
       "args": [
         {
           "name": "method",
-          "value": "session.tabs.createTerminal"
+          "value": "settings.get"
         },
         {
           "name": "params",
-          "value": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:repo-9::/w"
-          }
-        },
-        {
-          "name": "options",
           "value": {
             "$rpc": "absent"
           }
-        }
-      ],
-      "settlement": {
-        "status": "pending",
-        "startedAt": 0
-      }
-    },
-    "fe1fe746e77a": {
-      "launched": "sent"
-    },
-    "fe53d3bce307": {
-      "name": "terminal.send#1",
-      "ordinal": 3,
-      "args": [
-        {
-          "name": "method",
-          "value": "terminal.send"
-        },
-        {
-          "name": "params",
-          "value": {
-            "enter": true,
-            "terminal": "term-1",
-            "text": "Fix the failing checks"
-          }
         },
         {
           "name": "options",
@@ -143,12 +42,233 @@
           "id": "frame-2",
           "ok": true,
           "result": {
-            "send": {
-              "accepted": true
+            "settings": {
+              "defaultTuiAgent": "codex",
+              "disabledTuiAgents": []
             }
           }
         }
       }
+    },
+    "1c2564f1daca": {
+      "name": "settings.get#1",
+      "ordinal": 4,
+      "json": "{\"id\":\"frame-2\",\"deviceToken\":\"recording-device\",\"method\":\"settings.get\"}"
+    },
+    "28339abecf78": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 8,
+      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"agent.launchReplay\",\"params\":{\"agent\":\"codex\",\"operationId\":\"1767225600000-00000000000040008000000000000001\",\"target\":{\"kind\":\"existing\",\"worktree\":\"id:repo-9::/w\"},\"prompt\":{\"text\":\"Fix the failing checks\",\"delivery\":\"submit\"},\"launchSource\":\"task_page\"}}"
+    },
+    "35f85fe3b71c": {
+      "name": "repo.list#1",
+      "ordinal": 1,
+      "args": [
+        {
+          "name": "method",
+          "value": "repo.list"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "pending",
+        "startedAt": 0
+      }
+    },
+    "3e6a0417d2ee": {
+      "name": "repo.list#1",
+      "ordinal": 1,
+      "args": [
+        {
+          "name": "method",
+          "value": "repo.list"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-1",
+          "ok": true,
+          "result": {
+            "repos": [
+              {
+                "id": "repo-9"
+              }
+            ]
+          }
+        }
+      }
+    },
+    "51d4cb56be85": {
+      "name": "settings.get#1",
+      "ordinal": 2,
+      "args": [
+        {
+          "name": "method",
+          "value": "settings.get"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "pending",
+        "startedAt": 0
+      }
+    },
+    "9270aeb7d9c6": {
+      "status": "pending",
+      "startedAt": 0
+    },
+    "9c16efc31903": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 5,
+      "args": [
+        {
+          "name": "method",
+          "value": "preflight.detectAgents"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": ["codex"]
+        }
+      }
+    },
+    "a4273b38df83": {
+      "launched": "unlaunched"
+    },
+    "ba3fac1eb199": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "agent.launchReplay"
+        },
+        {
+          "name": "params",
+          "value": {
+            "agent": "codex",
+            "launchSource": "task_page",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "prompt": {
+              "delivery": "submit",
+              "text": "Fix the failing checks"
+            },
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            }
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "timeoutMs": 90000
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-4",
+          "ok": true,
+          "result": {
+            "outcome": {
+              "handle": "term-1",
+              "kind": "terminal"
+            },
+            "prompt": {
+              "delivery": "submit",
+              "outcome": "handed-to-terminal"
+            },
+            "receipt": {
+              "detail": "Started a terminal agent, the default for new agent tabs in your settings.",
+              "mode": "terminal",
+              "preferred": "terminal",
+              "reason": "user_default"
+            },
+            "worktreeId": "repo-9::/w"
+          }
+        }
+      }
+    },
+    "e0eef7c9fafe": {
+      "name": "repo.list#1",
+      "ordinal": 3,
+      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"repo.list\"}"
+    },
+    "eb79a9b3682a": {
+      "status": "fulfilled",
+      "startedAt": 0,
+      "settledAt": 0,
+      "value": {
+        "$rpc": "undefined"
+      }
+    },
+    "eb8d47f90956": {
+      "launched": {
+        "kind": "sent"
+      }
+    },
+    "f49d184679d1": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 6,
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"preflight.detectAgents\"}"
     }
   },
   "recording": {
@@ -157,8 +277,8 @@
       {
         "id": "pending",
         "observation": {
-          "sender": ["f9b284ac2424"],
-          "payloads": ["94d38f1838f6"],
+          "sender": ["35f85fe3b71c", "51d4cb56be85"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca"],
           "settlements": {
             "launch": "9270aeb7d9c6"
           },
@@ -169,12 +289,12 @@
       {
         "id": "launched",
         "observation": {
-          "sender": ["5093e98ba369", "fe53d3bce307"],
-          "payloads": ["94d38f1838f6", "280ce0d6f832"],
+          "sender": ["3e6a0417d2ee", "02188f091419", "9c16efc31903", "ba3fac1eb199"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1", "28339abecf78"],
           "settlements": {
             "launch": "eb79a9b3682a"
           },
-          "state": "fe1fe746e77a",
+          "state": "eb8d47f90956",
           "effects": []
         }
       }
diff --git a/mobile/rpc-foundation/goldens/pr-triage-prompt-not-delivered.json b/mobile/rpc-foundation/goldens/pr-triage-prompt-not-delivered.json
new file mode 100644
index 00000000000..a73f5adae10
--- /dev/null
+++ b/mobile/rpc-foundation/goldens/pr-triage-prompt-not-delivered.json
@@ -0,0 +1,233 @@
+{
+  "operation": "session.pr-triage-launch",
+  "family": "session.pr-triage",
+  "namedDeltas": [],
+  "runnerVersion": 1,
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
+  "scenarioSha256": "8307180e88773739a587bb3000327888da9ab609554ec66ea46d92b5a816221a",
+  "platform": "darwin",
+  "scenarioVersion": 1,
+  "projectionVersion": 2,
+  "goldenFormatVersion": 5,
+  "values": {
+    "02188f091419": {
+      "name": "settings.get#1",
+      "ordinal": 2,
+      "args": [
+        {
+          "name": "method",
+          "value": "settings.get"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-2",
+          "ok": true,
+          "result": {
+            "settings": {
+              "defaultTuiAgent": "codex",
+              "disabledTuiAgents": []
+            }
+          }
+        }
+      }
+    },
+    "1c2564f1daca": {
+      "name": "settings.get#1",
+      "ordinal": 4,
+      "json": "{\"id\":\"frame-2\",\"deviceToken\":\"recording-device\",\"method\":\"settings.get\"}"
+    },
+    "28339abecf78": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 8,
+      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"agent.launchReplay\",\"params\":{\"agent\":\"codex\",\"operationId\":\"1767225600000-00000000000040008000000000000001\",\"target\":{\"kind\":\"existing\",\"worktree\":\"id:repo-9::/w\"},\"prompt\":{\"text\":\"Fix the failing checks\",\"delivery\":\"submit\"},\"launchSource\":\"task_page\"}}"
+    },
+    "29436402d701": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "agent.launchReplay"
+        },
+        {
+          "name": "params",
+          "value": {
+            "agent": "codex",
+            "launchSource": "task_page",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "prompt": {
+              "delivery": "submit",
+              "text": "Fix the failing checks"
+            },
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            }
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "timeoutMs": 90000
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-4",
+          "ok": true,
+          "result": {
+            "outcome": {
+              "handle": "term-1",
+              "kind": "terminal"
+            },
+            "prompt": {
+              "delivery": "submit",
+              "outcome": "not-delivered"
+            },
+            "receipt": {
+              "detail": "Started a terminal agent, the default for new agent tabs in your settings.",
+              "mode": "terminal",
+              "preferred": "terminal",
+              "reason": "user_default"
+            },
+            "worktreeId": "repo-9::/w"
+          }
+        }
+      }
+    },
+    "3e6a0417d2ee": {
+      "name": "repo.list#1",
+      "ordinal": 1,
+      "args": [
+        {
+          "name": "method",
+          "value": "repo.list"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-1",
+          "ok": true,
+          "result": {
+            "repos": [
+              {
+                "id": "repo-9"
+              }
+            ]
+          }
+        }
+      }
+    },
+    "3fde28ed6a57": {
+      "launched": {
+        "kind": "prompt-not-sent",
+        "prompt": "Fix the failing checks"
+      }
+    },
+    "9c16efc31903": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 5,
+      "args": [
+        {
+          "name": "method",
+          "value": "preflight.detectAgents"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": ["codex"]
+        }
+      }
+    },
+    "e0eef7c9fafe": {
+      "name": "repo.list#1",
+      "ordinal": 3,
+      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"repo.list\"}"
+    },
+    "eb79a9b3682a": {
+      "status": "fulfilled",
+      "startedAt": 0,
+      "settledAt": 0,
+      "value": {
+        "$rpc": "undefined"
+      }
+    },
+    "f49d184679d1": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 6,
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"preflight.detectAgents\"}"
+    }
+  },
+  "recording": {
+    "scenario": "pr-triage-prompt-not-delivered",
+    "checkpoints": [
+      {
+        "id": "prompt-not-sent",
+        "observation": {
+          "sender": ["3e6a0417d2ee", "02188f091419", "9c16efc31903", "29436402d701"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1", "28339abecf78"],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "3fde28ed6a57",
+          "effects": []
+        }
+      }
+    ]
+  }
+}
diff --git a/mobile/rpc-foundation/goldens/pr-triage-send-locked.json b/mobile/rpc-foundation/goldens/pr-triage-send-locked.json
deleted file mode 100644
index bd8cc502ac9..00000000000
--- a/mobile/rpc-foundation/goldens/pr-triage-send-locked.json
+++ /dev/null
@@ -1,137 +0,0 @@
-{
-  "operation": "session.pr-triage-launch",
-  "family": "session.pr-triage",
-  "namedDeltas": [],
-  "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
-  "scenarioSha256": "d80bc346e84bc35e6dce70643dcd3af3ea9e5a7f8a1f2b7a9e92c71c0c30d4c9",
-  "platform": "darwin",
-  "scenarioVersion": 1,
-  "projectionVersion": 2,
-  "goldenFormatVersion": 5,
-  "values": {
-    "0f026fafa7e1": {
-      "status": "rejected",
-      "startedAt": 0,
-      "settledAt": 0,
-      "error": {
-        "category": "Error",
-        "message": "Terminal input is locked",
-        "isRpcDeliveryUnknown": false
-      }
-    },
-    "280ce0d6f832": {
-      "name": "terminal.send#1",
-      "ordinal": 4,
-      "json": "{\"id\":\"frame-2\",\"deviceToken\":\"recording-device\",\"method\":\"terminal.send\",\"params\":{\"terminal\":\"term-1\",\"text\":\"Fix the failing checks\",\"enter\":true}}"
-    },
-    "438dbb654f4e": {
-      "name": "terminal.send#1",
-      "ordinal": 3,
-      "args": [
-        {
-          "name": "method",
-          "value": "terminal.send"
-        },
-        {
-          "name": "params",
-          "value": {
-            "enter": true,
-            "terminal": "term-1",
-            "text": "Fix the failing checks"
-          }
-        },
-        {
-          "name": "options",
-          "value": {
-            "$rpc": "absent"
-          }
-        }
-      ],
-      "settlement": {
-        "status": "fulfilled",
-        "startedAt": 0,
-        "settledAt": 0,
-        "value": {
-          "id": "frame-2",
-          "ok": true,
-          "result": {
-            "send": {
-              "accepted": false
-            }
-          }
-        }
-      }
-    },
-    "5093e98ba369": {
-      "name": "session.tabs.createTerminal#1",
-      "ordinal": 1,
-      "args": [
-        {
-          "name": "method",
-          "value": "session.tabs.createTerminal"
-        },
-        {
-          "name": "params",
-          "value": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:repo-9::/w"
-          }
-        },
-        {
-          "name": "options",
-          "value": {
-            "$rpc": "absent"
-          }
-        }
-      ],
-      "settlement": {
-        "status": "fulfilled",
-        "startedAt": 0,
-        "settledAt": 0,
-        "value": {
-          "id": "frame-1",
-          "ok": true,
-          "result": {
-            "tab": {
-              "id": "tab-1",
-              "terminal": "term-1",
-              "title": "Agent",
-              "type": "terminal"
-            }
-          }
-        }
-      }
-    },
-    "94d38f1838f6": {
-      "name": "session.tabs.createTerminal#1",
-      "ordinal": 2,
-      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"session.tabs.createTerminal\",\"params\":{\"worktree\":\"id:repo-9::/w\",\"activate\":false,\"select\":true,\"navigation\":\"caller\"}}"
-    },
-    "a4273b38df83": {
-      "launched": "unlaunched"
-    }
-  },
-  "recording": {
-    "scenario": "pr-triage-send-locked",
-    "checkpoints": [
-      {
-        "id": "locked",
-        "observation": {
-          "sender": ["5093e98ba369", "438dbb654f4e"],
-          "payloads": ["94d38f1838f6", "280ce0d6f832"],
-          "settlements": {
-            "launch": "0f026fafa7e1"
-          },
-          "state": "a4273b38df83",
-          "effects": []
-        }
-      }
-    ]
-  }
-}
diff --git a/mobile/rpc-foundation/goldens/pr-triage-update-required.json b/mobile/rpc-foundation/goldens/pr-triage-update-required.json
new file mode 100644
index 00000000000..cbe301b3c40
--- /dev/null
+++ b/mobile/rpc-foundation/goldens/pr-triage-update-required.json
@@ -0,0 +1,48 @@
+{
+  "operation": "session.pr-triage-launch",
+  "family": "session.pr-triage",
+  "namedDeltas": [],
+  "runnerVersion": 1,
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "5f65c5b318f4764b0f58a5e7b593333759a9cfa799db45b11190ac26f4083335",
+  "scenarioSha256": "7fc74743e625d338b27a32280692132b5b085cfbb43ecfd0a1ac7caaddbcd459",
+  "platform": "darwin",
+  "scenarioVersion": 1,
+  "projectionVersion": 2,
+  "goldenFormatVersion": 5,
+  "values": {
+    "c2a44248892e": {
+      "launched": {
+        "kind": "not-started",
+        "message": "Update Orca on your computer to start an agent from your phone."
+      }
+    },
+    "eb79a9b3682a": {
+      "status": "fulfilled",
+      "startedAt": 0,
+      "settledAt": 0,
+      "value": {
+        "$rpc": "undefined"
+      }
+    }
+  },
+  "recording": {
+    "scenario": "pr-triage-update-required",
+    "checkpoints": [
+      {
+        "id": "update-required",
+        "observation": {
+          "sender": [],
+          "payloads": [],
+          "settlements": {
+            "launch": "eb79a9b3682a"
+          },
+          "state": "c2a44248892e",
+          "effects": []
+        }
+      }
+    ]
+  }
+}
diff --git a/mobile/rpc-foundation/goldens/probe-new-tab-both-refused.json b/mobile/rpc-foundation/goldens/probe-new-tab-both-refused.json
index 87961085779..aa33ae2bef4 100644
--- a/mobile/rpc-foundation/goldens/probe-new-tab-both-refused.json
+++ b/mobile/rpc-foundation/goldens/probe-new-tab-both-refused.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "819fa73c7700b4d526da91c37558a6498008d745d1debcc26e6bb757550ebf99",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/probe-new-tab-null-sibling-refused.json b/mobile/rpc-foundation/goldens/probe-new-tab-null-sibling-refused.json
index d1d1eba26f8..d6094773deb 100644
--- a/mobile/rpc-foundation/goldens/probe-new-tab-null-sibling-refused.json
+++ b/mobile/rpc-foundation/goldens/probe-new-tab-null-sibling-refused.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "500396d72abd2f73d11ef066bca3f88798c8cbdaef09fa7c1c8d1fbaf0b3b85a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/probe-new-tab-refused-sibling-rejects.json b/mobile/rpc-foundation/goldens/probe-new-tab-refused-sibling-rejects.json
index ba4d9a47b8a..d271e3798dd 100644
--- a/mobile/rpc-foundation/goldens/probe-new-tab-refused-sibling-rejects.json
+++ b/mobile/rpc-foundation/goldens/probe-new-tab-refused-sibling-rejects.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "daf68df8840ea6872521d823cc17e1e5de3f3a74a8855465fcf40cc276e9c2ce",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/probe-new-tab-rejects-sibling-refused.json b/mobile/rpc-foundation/goldens/probe-new-tab-rejects-sibling-refused.json
index 3911a841644..ab349ab182e 100644
--- a/mobile/rpc-foundation/goldens/probe-new-tab-rejects-sibling-refused.json
+++ b/mobile/rpc-foundation/goldens/probe-new-tab-rejects-sibling-refused.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "61e36caf6b3bb01c3ad0db282b7f0fbc0f300d40184f9cf3d7e4e3a3194a4f2a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/push-dismissal-tray-reconciled.json b/mobile/rpc-foundation/goldens/push-dismissal-tray-reconciled.json
index c5baf00a81d..a7b9b9092ca 100644
--- a/mobile/rpc-foundation/goldens/push-dismissal-tray-reconciled.json
+++ b/mobile/rpc-foundation/goldens/push-dismissal-tray-reconciled.json
@@ -3,9 +3,9 @@
   "family": "notifications.push-dismissal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "595a3eb2994d0596b9fcd0707b175b4e978625053dfbc5c541b0350c0cbfb524",
   "scenarioSha256": "318fab8c1efb1786bbdaea7f13b769952c1ce463bc5504dca6a9f545e905b7c9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/quick-commands-load-refused.json b/mobile/rpc-foundation/goldens/quick-commands-load-refused.json
index 181bbf00d00..c3899d5ea23 100644
--- a/mobile/rpc-foundation/goldens/quick-commands-load-refused.json
+++ b/mobile/rpc-foundation/goldens/quick-commands-load-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.quick-commands",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "42573387533f75122f626ce6ec81c1e61fe54cde5df416154bb7cba132f53309",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/quick-commands-loaded-and-saved.json b/mobile/rpc-foundation/goldens/quick-commands-loaded-and-saved.json
index 1b2a4df3faf..e90f6ed24ab 100644
--- a/mobile/rpc-foundation/goldens/quick-commands-loaded-and-saved.json
+++ b/mobile/rpc-foundation/goldens/quick-commands-loaded-and-saved.json
@@ -3,9 +3,9 @@
   "family": "settings.quick-commands",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "a621156bbb662c78a0baa356b60d0af41d10a7bd14e54f23be0581a59377cec3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/quick-commands-save-refused-rolls-back.json b/mobile/rpc-foundation/goldens/quick-commands-save-refused-rolls-back.json
index ed648f43a0d..aef2c14d8d7 100644
--- a/mobile/rpc-foundation/goldens/quick-commands-save-refused-rolls-back.json
+++ b/mobile/rpc-foundation/goldens/quick-commands-save-refused-rolls-back.json
@@ -3,9 +3,9 @@
   "family": "settings.quick-commands",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "72517336e451e1e078135103073c1821e8af27c0702f6dc83b9a686fe7ff8c04",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/relay-direct-upgrade-commits.json b/mobile/rpc-foundation/goldens/relay-direct-upgrade-commits.json
index c70cd1fc1ed..bceb70caca6 100644
--- a/mobile/rpc-foundation/goldens/relay-direct-upgrade-commits.json
+++ b/mobile/rpc-foundation/goldens/relay-direct-upgrade-commits.json
@@ -3,10 +3,10 @@
   "family": "relay.direct-upgrade",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "a92bccd183127829b6dfd85add28e42370d54990f63214940b1c584f7fde56a9",
   "platform": "darwin",
   "scenarioVersion": 1,
@@ -23,6 +23,32 @@
       "ordinal": 8,
       "value": "host-1"
     },
+    "232ca274f695": {
+      "status": "fulfilled",
+      "startedAt": 0,
+      "settledAt": 0,
+      "value": {
+        "bundle": {
+          "current": {
+            "expiresAt": 1767830400000,
+            "hash": "7ehR_WuQWkxwOFJdkHfI5jEg4DeVYWImtDuip60LHK4",
+            "token": "pending00000000000000000000000000000000001x",
+            "version": 4
+          },
+          "deviceToken": "device-token-1",
+          "hostId": "host-1",
+          "v": 1
+        },
+        "relay": {
+          "assignmentEpoch": 1,
+          "cellUrl": "https://cell.example",
+          "directorUrl": "https://director.example",
+          "e2eeFraming": 2,
+          "relayHostId": "relay-host-0001x",
+          "v": 1
+        }
+      }
+    },
     "240d8ec7e573": {
       "name": "pairing.getEndpoints#2",
       "ordinal": 5,
@@ -116,53 +142,6 @@
         }
       }
     },
-    "590b3311b0c4": {
-      "status": "fulfilled",
-      "startedAt": 0,
-      "settledAt": 0,
-      "value": {
-        "bundle": {
-          "current": {
-            "expiresAt": 1767830400000,
-            "hash": "7ehR_WuQWkxwOFJdkHfI5jEg4DeVYWImtDuip60LHK4",
-            "token": "pending00000000000000000000000000000000001x",
-            "version": 4
-          },
-          "deviceToken": "device-token-1",
-          "hostId": "host-1",
-          "v": 1
-        },
-        "host": {
-          "deviceToken": "device-token-1",
-          "endpoint": "ws://192.168.1.10:8765",
-          "endpoints": [
-            {
-              "id": "direct-primary",
-              "kind": "lan",
-              "url": "ws://192.168.1.10:8765"
-            },
-            {
-              "id": "relay-primary",
-              "kind": "relay",
-              "url": "wss://cell.example/v1/connect/relay-host-0001x"
-            }
-          ],
-          "id": "host-1",
-          "lastConnected": 1767225600000,
-          "name": "Fixture host",
-          "publicKeyB64": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
-          "relay": {
-            "assignmentEpoch": 1,
-            "cellUrl": "https://cell.example",
-            "directorUrl": "https://director.example",
-            "e2eeFraming": 2,
-            "relayHostId": "relay-host-0001x",
-            "v": 1
-          },
-          "relayHostId": "relay-host-0001x"
-        }
-      }
-    },
     "691df8767d71": {
       "name": "journal-cleared",
       "ordinal": 9,
@@ -248,7 +227,7 @@
           "sender": ["6e14239ef339", "2fce658b56a1", "240d8ec7e573"],
           "payloads": ["c5d28dd067e4", "f41ffc93936f", "10098087f961"],
           "settlements": {
-            "upgrade": "590b3311b0c4"
+            "upgrade": "232ca274f695"
           },
           "state": "980bbba0b617",
           "effects": ["aaef09eec3f3", "161baaed4df3", "691df8767d71"]
diff --git a/mobile/rpc-foundation/goldens/relay-direct-upgrade-unsupported-host-declines.json b/mobile/rpc-foundation/goldens/relay-direct-upgrade-unsupported-host-declines.json
index deab4528abc..1e3f97d5875 100644
--- a/mobile/rpc-foundation/goldens/relay-direct-upgrade-unsupported-host-declines.json
+++ b/mobile/rpc-foundation/goldens/relay-direct-upgrade-unsupported-host-declines.json
@@ -3,10 +3,10 @@
   "family": "relay.direct-upgrade",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "7d5cad367e76767b039fc5ebc15837930f02c5e1bed33ae7ca4695bae56287bd",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/relay-pairing-recovery-invite-authorizes.json b/mobile/rpc-foundation/goldens/relay-pairing-recovery-invite-authorizes.json
index 62d332e29f7..cc367e9a2c2 100644
--- a/mobile/rpc-foundation/goldens/relay-pairing-recovery-invite-authorizes.json
+++ b/mobile/rpc-foundation/goldens/relay-pairing-recovery-invite-authorizes.json
@@ -3,10 +3,10 @@
   "family": "relay.pairing-recovery",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "8dc3fd27c5720276608ca8743990e4f57d94eab84f620e9aa42702a4686fd5a9",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/relay-pairing-recovery-resume-committed.json b/mobile/rpc-foundation/goldens/relay-pairing-recovery-resume-committed.json
index c3b2a6baf3b..2d865bd0a0b 100644
--- a/mobile/rpc-foundation/goldens/relay-pairing-recovery-resume-committed.json
+++ b/mobile/rpc-foundation/goldens/relay-pairing-recovery-resume-committed.json
@@ -3,10 +3,10 @@
   "family": "relay.pairing-recovery",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "7e54c3af4b8b8e6eac007267fb96620283b735491883c505401c79656d920ca6",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/relay-rotation-installs-and-commits.json b/mobile/rpc-foundation/goldens/relay-rotation-installs-and-commits.json
index 68983a52f50..4d8c94ed30a 100644
--- a/mobile/rpc-foundation/goldens/relay-rotation-installs-and-commits.json
+++ b/mobile/rpc-foundation/goldens/relay-rotation-installs-and-commits.json
@@ -3,10 +3,10 @@
   "family": "relay.credential-rotation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "c786fb19f9593ee60238e42813561edf6f5e976fcf217dff8de977a333fe8451",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/relay-rotation-resumes-committed-pending.json b/mobile/rpc-foundation/goldens/relay-rotation-resumes-committed-pending.json
index 265d0f6cdc5..dd8bc367ad8 100644
--- a/mobile/rpc-foundation/goldens/relay-rotation-resumes-committed-pending.json
+++ b/mobile/rpc-foundation/goldens/relay-rotation-resumes-committed-pending.json
@@ -3,10 +3,10 @@
   "family": "relay.credential-rotation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "96df784c1d56de3bdd04afe20ab019339c7d9a616528ca2617e2fffe4f0157c8",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/review-branch-diff-shapes.json b/mobile/rpc-foundation/goldens/review-branch-diff-shapes.json
index 3d38f932cd0..d596dee94ee 100644
--- a/mobile/rpc-foundation/goldens/review-branch-diff-shapes.json
+++ b/mobile/rpc-foundation/goldens/review-branch-diff-shapes.json
@@ -3,9 +3,9 @@
   "family": "session.review-branch-diff",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "36dbf57e82d87819b403839c22044209f0f399057f62efa7004bb8b899fdbe81",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/review-create-agent-refused.json b/mobile/rpc-foundation/goldens/review-create-agent-refused.json
new file mode 100644
index 00000000000..3c8d1a68361
--- /dev/null
+++ b/mobile/rpc-foundation/goldens/review-create-agent-refused.json
@@ -0,0 +1,249 @@
+{
+  "operation": "session.diff-review-actions",
+  "family": "session.diff-review-actions",
+  "namedDeltas": [],
+  "runnerVersion": 1,
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "dc3a746274b4197b02b0b3060bbf8ab0f67eb54355c8b9888e1f061e37f777af",
+  "scenarioSha256": "0816742351babdb260fcdba92d0020e0216c8ec0d106b560357f295671c83fe2",
+  "platform": "darwin",
+  "scenarioVersion": 1,
+  "projectionVersion": 2,
+  "goldenFormatVersion": 5,
+  "values": {
+    "1c2564f1daca": {
+      "name": "settings.get#1",
+      "ordinal": 4,
+      "json": "{\"id\":\"frame-2\",\"deviceToken\":\"recording-device\",\"method\":\"settings.get\"}"
+    },
+    "5ee9e7b49320": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 8,
+      "json": "{\"id\":\"frame-4\",\"deviceToken\":\"recording-device\",\"method\":\"agent.launchReplay\",\"params\":{\"agent\":\"claude\",\"operationId\":\"1767225600000-00000000000040008000000000000001\",\"target\":{\"kind\":\"existing\",\"worktree\":\"id:workspace-1\"},\"prompt\":{\"text\":\"You are reviewing the current worktree. Address the following mobile review notes.\\n\\nFile: src/app.ts\\nLine: 4\\nUser comment: \\\"needs a test\\\"\\n\\nAfter applying fixes:\\n1. Summarize changed files.\\n2. Run relevant tests.\\n3. Tell me if anything remains risky.\",\"delivery\":\"submit\"},\"launchSource\":\"notes_send\"}}"
+    },
+    "9239a4f232b8": {
+      "name": "repo.list#1",
+      "ordinal": 1,
+      "args": [
+        {
+          "name": "method",
+          "value": "repo.list"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-1",
+          "ok": true,
+          "result": {
+            "repos": [
+              {
+                "id": "workspace-1"
+              }
+            ]
+          }
+        }
+      }
+    },
+    "96a9a954e28f": {
+      "name": "settings.get#1",
+      "ordinal": 2,
+      "args": [
+        {
+          "name": "method",
+          "value": "settings.get"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-2",
+          "ok": true,
+          "result": {
+            "settings": {
+              "defaultTuiAgent": {
+                "$rpc": "null"
+              },
+              "disabledTuiAgents": []
+            }
+          }
+        }
+      }
+    },
+    "bcb5111e6012": {
+      "name": "agent.launchReplay#1",
+      "ordinal": 7,
+      "args": [
+        {
+          "name": "method",
+          "value": "agent.launchReplay"
+        },
+        {
+          "name": "params",
+          "value": {
+            "agent": "claude",
+            "launchSource": "notes_send",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "prompt": {
+              "delivery": "submit",
+              "text": "You are reviewing the current worktree. Address the following mobile review notes.\n\nFile: src/app.ts\nLine: 4\nUser comment: \"needs a test\"\n\nAfter applying fixes:\n1. Summarize changed files.\n2. Run relevant tests.\n3. Tell me if anything remains risky."
+            },
+            "target": {
+              "kind": "existing",
+              "worktree": "id:workspace-1"
+            }
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "timeoutMs": 90000
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "error": {
+            "code": "selector_not_found",
+            "message": "Workspace not found"
+          },
+          "id": "frame-4",
+          "ok": false
+        }
+      }
+    },
+    "e0eef7c9fafe": {
+      "name": "repo.list#1",
+      "ordinal": 3,
+      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"repo.list\"}"
+    },
+    "eb79a9b3682a": {
+      "status": "fulfilled",
+      "startedAt": 0,
+      "settledAt": 0,
+      "value": {
+        "$rpc": "undefined"
+      }
+    },
+    "f49d184679d1": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 6,
+      "json": "{\"id\":\"frame-3\",\"deviceToken\":\"recording-device\",\"method\":\"preflight.detectAgents\"}"
+    },
+    "fc1691a7deca": {
+      "actionError": "Workspace not found",
+      "busyAction": {
+        "$rpc": "null"
+      },
+      "screenState": {
+        "branchCompare": {
+          "$rpc": "null"
+        },
+        "comments": [
+          {
+            "body": "needs a test",
+            "createdAt": 0,
+            "filePath": "src/app.ts",
+            "id": "note-1",
+            "lineNumber": 4,
+            "side": "modified",
+            "worktreeId": "workspace-1"
+          }
+        ],
+        "kind": "ready",
+        "reviewState": {
+          "files": {},
+          "version": 1
+        },
+        "status": {
+          "entries": []
+        }
+      },
+      "sendSheet": {
+        "$rpc": "null"
+      }
+    },
+    "fc3974e714de": {
+      "name": "preflight.detectAgents#1",
+      "ordinal": 5,
+      "args": [
+        {
+          "name": "method",
+          "value": "preflight.detectAgents"
+        },
+        {
+          "name": "params",
+          "value": {
+            "$rpc": "absent"
+          }
+        },
+        {
+          "name": "options",
+          "value": {
+            "$rpc": "absent"
+          }
+        }
+      ],
+      "settlement": {
+        "status": "fulfilled",
+        "startedAt": 0,
+        "settledAt": 0,
+        "value": {
+          "id": "frame-3",
+          "ok": true,
+          "result": ["claude"]
+        }
+      }
+    }
+  },
+  "recording": {
+    "scenario": "review-create-agent-refused",
+    "checkpoints": [
+      {
+        "id": "refused",
+        "observation": {
+          "sender": ["9239a4f232b8", "96a9a954e28f", "fc3974e714de", "bcb5111e6012"],
+          "payloads": ["e0eef7c9fafe", "1c2564f1daca", "f49d184679d1", "5ee9e7b49320"],
+          "settlements": {
+            "create-and-send": "eb79a9b3682a"
+          },
+          "state": "fc1691a7deca",
+          "effects": []
+        }
+      }
+    ]
+  }
+}
diff --git a/mobile/rpc-foundation/goldens/review-create-terminal-refused.json b/mobile/rpc-foundation/goldens/review-create-terminal-refused.json
deleted file mode 100644
index c50a89880f2..00000000000
--- a/mobile/rpc-foundation/goldens/review-create-terminal-refused.json
+++ /dev/null
@@ -1,122 +0,0 @@
-{
-  "operation": "session.diff-review-actions",
-  "family": "session.diff-review-actions",
-  "namedDeltas": [],
-  "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
-  "scenarioSha256": "af837de2e273c5f03130b51d6e1a9bff9ff99a4e8d1c9554a53134acb5924c72",
-  "platform": "darwin",
-  "scenarioVersion": 1,
-  "projectionVersion": 2,
-  "goldenFormatVersion": 5,
-  "values": {
-    "2fc890e4b748": {
-      "actionError": {
-        "$rpc": "null"
-      },
-      "busyAction": {
-        "$rpc": "null"
-      },
-      "screenState": {
-        "branchCompare": {
-          "$rpc": "null"
-        },
-        "comments": [
-          {
-            "body": "needs a test",
-            "createdAt": 0,
-            "filePath": "src/app.ts",
-            "id": "note-1",
-            "lineNumber": 4,
-            "side": "modified",
-            "worktreeId": "workspace-1"
-          }
-        ],
-        "kind": "ready",
-        "reviewState": {
-          "files": {},
-          "version": 1
-        },
-        "status": {
-          "entries": []
-        }
-      },
-      "sendSheet": {
-        "$rpc": "null"
-      }
-    },
-    "6e913cd7b306": {
-      "status": "rejected",
-      "startedAt": 0,
-      "settledAt": 0,
-      "error": {
-        "category": "Error",
-        "message": "Workspace is busy",
-        "isRpcDeliveryUnknown": false
-      }
-    },
-    "88cd0d2b1302": {
-      "name": "session.tabs.createTerminal#1",
-      "ordinal": 2,
-      "json": "{\"id\":\"frame-1\",\"deviceToken\":\"recording-device\",\"method\":\"session.tabs.createTerminal\",\"params\":{\"worktree\":\"id:workspace-1\",\"activate\":false,\"select\":true,\"navigation\":\"caller\"}}"
-    },
-    "fff91a37bc65": {
-      "name": "session.tabs.createTerminal#1",
-      "ordinal": 1,
-      "args": [
-        {
-          "name": "method",
-          "value": "session.tabs.createTerminal"
-        },
-        {
-          "name": "params",
-          "value": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:workspace-1"
-          }
-        },
-        {
-          "name": "options",
-          "value": {
-            "$rpc": "absent"
-          }
-        }
-      ],
-      "settlement": {
-        "status": "fulfilled",
-        "startedAt": 0,
-        "settledAt": 0,
-        "value": {
-          "error": {
-            "code": "worktree_busy",
-            "message": "Workspace is busy"
-          },
-          "id": "frame-1",
-          "ok": false
-        }
-      }
-    }
-  },
-  "recording": {
-    "scenario": "review-create-terminal-refused",
-    "checkpoints": [
-      {
-        "id": "refused",
-        "observation": {
-          "sender": ["fff91a37bc65"],
-          "payloads": ["88cd0d2b1302"],
-          "settlements": {
-            "create-and-send": "6e913cd7b306"
-          },
-          "state": "2fc890e4b748",
-          "effects": []
-        }
-      }
-    ]
-  }
-}
diff --git a/mobile/rpc-foundation/goldens/review-file-diff-shapes.json b/mobile/rpc-foundation/goldens/review-file-diff-shapes.json
index 911bfca0b3b..1bf2bff0a41 100644
--- a/mobile/rpc-foundation/goldens/review-file-diff-shapes.json
+++ b/mobile/rpc-foundation/goldens/review-file-diff-shapes.json
@@ -3,9 +3,9 @@
   "family": "session.review-file-diff",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "30f0d2ecb8ab5a51a85037196325d5bbac53eb48c5d59a5af62e3ab1fc9420e7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/review-git-mutations-run.json b/mobile/rpc-foundation/goldens/review-git-mutations-run.json
index 360404ae8c1..e278a97ef98 100644
--- a/mobile/rpc-foundation/goldens/review-git-mutations-run.json
+++ b/mobile/rpc-foundation/goldens/review-git-mutations-run.json
@@ -3,10 +3,10 @@
   "family": "session.review-git-mutations",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "dc3a746274b4197b02b0b3060bbf8ab0f67eb54355c8b9888e1f061e37f777af",
   "scenarioSha256": "7981ac87c4397b9703330835327c70828cb5a76633f1c4803ded1b66520d184d",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/review-mark-reviewed-persists.json b/mobile/rpc-foundation/goldens/review-mark-reviewed-persists.json
index cab3f3afd0d..c2725fd3d02 100644
--- a/mobile/rpc-foundation/goldens/review-mark-reviewed-persists.json
+++ b/mobile/rpc-foundation/goldens/review-mark-reviewed-persists.json
@@ -3,10 +3,10 @@
   "family": "session.diff-review-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "dc3a746274b4197b02b0b3060bbf8ab0f67eb54355c8b9888e1f061e37f777af",
   "scenarioSha256": "9f1c39e91a97266b0a550d2b2d061592ae050078401ef23177dd2e00db67bf04",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/review-mark-reviewed-rolls-back.json b/mobile/rpc-foundation/goldens/review-mark-reviewed-rolls-back.json
index 8f4c7633a70..6b6c024d378 100644
--- a/mobile/rpc-foundation/goldens/review-mark-reviewed-rolls-back.json
+++ b/mobile/rpc-foundation/goldens/review-mark-reviewed-rolls-back.json
@@ -3,10 +3,10 @@
   "family": "session.diff-review-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "dc3a746274b4197b02b0b3060bbf8ab0f67eb54355c8b9888e1f061e37f777af",
   "scenarioSha256": "c858cfca59148548146b4c0a775e9518d3ab826ef268ccc9af60b04e52cc9e3d",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/review-open-in-session.json b/mobile/rpc-foundation/goldens/review-open-in-session.json
index 6c68ff206ba..39058a52b37 100644
--- a/mobile/rpc-foundation/goldens/review-open-in-session.json
+++ b/mobile/rpc-foundation/goldens/review-open-in-session.json
@@ -3,10 +3,10 @@
   "family": "session.diff-review-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "dc3a746274b4197b02b0b3060bbf8ab0f67eb54355c8b9888e1f061e37f777af",
   "scenarioSha256": "2f0a6aa8ce100edbce9ccf64c81efe64356fccbdcd2e16f561360e2b11b5700f",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/review-send-notes-heals-stale-input.json b/mobile/rpc-foundation/goldens/review-send-notes-heals-stale-input.json
index d7f9a7346df..cd66803c63e 100644
--- a/mobile/rpc-foundation/goldens/review-send-notes-heals-stale-input.json
+++ b/mobile/rpc-foundation/goldens/review-send-notes-heals-stale-input.json
@@ -3,10 +3,10 @@
   "family": "session.diff-review-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "dc3a746274b4197b02b0b3060bbf8ab0f67eb54355c8b9888e1f061e37f777af",
   "scenarioSha256": "7099d7311b2046dde21a2750201718995c0869bc4f17fb7f3ce2b997ce0e6506",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/review-send-sheet-lists-terminals.json b/mobile/rpc-foundation/goldens/review-send-sheet-lists-terminals.json
index c8f0de43a78..8409231fbf1 100644
--- a/mobile/rpc-foundation/goldens/review-send-sheet-lists-terminals.json
+++ b/mobile/rpc-foundation/goldens/review-send-sheet-lists-terminals.json
@@ -3,10 +3,10 @@
   "family": "session.review-send-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "dc3a746274b4197b02b0b3060bbf8ab0f67eb54355c8b9888e1f061e37f777af",
   "scenarioSha256": "8b4a06c1b2918d5ed5f40102c1c7cb411e02aba5e7601e98658d673634784bb0",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/review-stage-file.json b/mobile/rpc-foundation/goldens/review-stage-file.json
index 9016560664f..84fb797ef58 100644
--- a/mobile/rpc-foundation/goldens/review-stage-file.json
+++ b/mobile/rpc-foundation/goldens/review-stage-file.json
@@ -3,10 +3,10 @@
   "family": "session.diff-review-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "dc3a746274b4197b02b0b3060bbf8ab0f67eb54355c8b9888e1f061e37f777af",
   "scenarioSha256": "793e954960d371c6477d4cd3d70a5215c0bd90764684eafdb1e1a2e09790cc86",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/review-stage-refused.json b/mobile/rpc-foundation/goldens/review-stage-refused.json
index 9936334ac68..d5e497377b5 100644
--- a/mobile/rpc-foundation/goldens/review-stage-refused.json
+++ b/mobile/rpc-foundation/goldens/review-stage-refused.json
@@ -3,10 +3,10 @@
   "family": "session.diff-review-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "dc3a746274b4197b02b0b3060bbf8ab0f67eb54355c8b9888e1f061e37f777af",
   "scenarioSha256": "46b720fed417d29f79dbde4cc7941579f2d6a2f920bae24234537480079e7de5",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/sc-base-ref-default.json b/mobile/rpc-foundation/goldens/sc-base-ref-default.json
index dff2a8b580d..10dbbee70ba 100644
--- a/mobile/rpc-foundation/goldens/sc-base-ref-default.json
+++ b/mobile/rpc-foundation/goldens/sc-base-ref-default.json
@@ -3,9 +3,9 @@
   "family": "git.base-ref-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "374129def6baa0e06b808c067831820966638d79d7a782e96c1f2f891cc9dc86",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-base-ref-repo-fallback.json b/mobile/rpc-foundation/goldens/sc-base-ref-repo-fallback.json
index b1888df35d2..deca7626b4d 100644
--- a/mobile/rpc-foundation/goldens/sc-base-ref-repo-fallback.json
+++ b/mobile/rpc-foundation/goldens/sc-base-ref-repo-fallback.json
@@ -3,9 +3,9 @@
   "family": "git.base-ref-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "97a8b8f5b9a7c7467745666becee07f5dfc57fb283d4e80dcbe7941509177598",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-base-ref-unavailable.json b/mobile/rpc-foundation/goldens/sc-base-ref-unavailable.json
index 044da3fc9a1..ac0f972816c 100644
--- a/mobile/rpc-foundation/goldens/sc-base-ref-unavailable.json
+++ b/mobile/rpc-foundation/goldens/sc-base-ref-unavailable.json
@@ -3,9 +3,9 @@
   "family": "git.base-ref-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "25a4762d735dfb4979e6ef31b9fdb380941a824a54b45b3d08ddb2cde25c2eb7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-base-ref-worktree-hit.json b/mobile/rpc-foundation/goldens/sc-base-ref-worktree-hit.json
index 4808d4fbee2..25a7b174717 100644
--- a/mobile/rpc-foundation/goldens/sc-base-ref-worktree-hit.json
+++ b/mobile/rpc-foundation/goldens/sc-base-ref-worktree-hit.json
@@ -3,9 +3,9 @@
   "family": "git.base-ref-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "f3b193f93f6c9de41d11e706ecbd99648eb2ed41ccb7c66cdb80c934e780ed7c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-branch-diff-previewed.json b/mobile/rpc-foundation/goldens/sc-branch-diff-previewed.json
index 90207711179..8c884c8a62b 100644
--- a/mobile/rpc-foundation/goldens/sc-branch-diff-previewed.json
+++ b/mobile/rpc-foundation/goldens/sc-branch-diff-previewed.json
@@ -3,9 +3,9 @@
   "family": "git.branch-diff-preview",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "819d010b9a8bb2741b09f104415f648e0e65d797882a2152ccfa4fb8a107cafc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-changes-loaded.json b/mobile/rpc-foundation/goldens/sc-changes-loaded.json
index 9b494ebd02d..70720a8fb8e 100644
--- a/mobile/rpc-foundation/goldens/sc-changes-loaded.json
+++ b/mobile/rpc-foundation/goldens/sc-changes-loaded.json
@@ -3,9 +3,9 @@
   "family": "git.changes-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "f2c4d64b3761fcd036d9538155037edc4e35492e67ce5eb158372ddc76e55cc9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-commit-message-cancel-rejected.json b/mobile/rpc-foundation/goldens/sc-commit-message-cancel-rejected.json
index c86415965c7..4ad50dbe7b3 100644
--- a/mobile/rpc-foundation/goldens/sc-commit-message-cancel-rejected.json
+++ b/mobile/rpc-foundation/goldens/sc-commit-message-cancel-rejected.json
@@ -3,9 +3,9 @@
   "family": "git.commit-message-ai",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "013db25622b180a8333bb1ef27c22a5b1f8e04148201201e5cc3413a10640781",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-commit-message-canceled.json b/mobile/rpc-foundation/goldens/sc-commit-message-canceled.json
index 17f588bd4b4..36e983ff4d5 100644
--- a/mobile/rpc-foundation/goldens/sc-commit-message-canceled.json
+++ b/mobile/rpc-foundation/goldens/sc-commit-message-canceled.json
@@ -3,9 +3,9 @@
   "family": "git.commit-message-ai",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "15bf6c17f4b524dfbf5373b2eeed61ee2e659421cf8b6e3cff6c0378c7692cc1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-commit-message-generated.json b/mobile/rpc-foundation/goldens/sc-commit-message-generated.json
index 4c0e2bb9770..1a9f5c4c609 100644
--- a/mobile/rpc-foundation/goldens/sc-commit-message-generated.json
+++ b/mobile/rpc-foundation/goldens/sc-commit-message-generated.json
@@ -3,9 +3,9 @@
   "family": "git.commit-message-ai",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "540f05d84d1cbffd566af933c547838c75500bb5d708e8558c21fe8131d724e3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-create-existing-review.json b/mobile/rpc-foundation/goldens/sc-create-existing-review.json
index 55c2d609eb5..b0fd61aa83f 100644
--- a/mobile/rpc-foundation/goldens/sc-create-existing-review.json
+++ b/mobile/rpc-foundation/goldens/sc-create-existing-review.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "7d6099248aa6a2ef19f2e169ff917af794649d9d64d139aa9ffeea6a41355ddc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-create-intent-stage-commit-push-create.json b/mobile/rpc-foundation/goldens/sc-create-intent-stage-commit-push-create.json
index b0092c08316..b50af2a143b 100644
--- a/mobile/rpc-foundation/goldens/sc-create-intent-stage-commit-push-create.json
+++ b/mobile/rpc-foundation/goldens/sc-create-intent-stage-commit-push-create.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "447f9b3d697dbfe21cb7fb6e12d1bf5fa94b023b7e1697bdc2dc82ce7072183f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-create-intent-unlisted-provider.json b/mobile/rpc-foundation/goldens/sc-create-intent-unlisted-provider.json
index c1c15555007..8531e245d9d 100644
--- a/mobile/rpc-foundation/goldens/sc-create-intent-unlisted-provider.json
+++ b/mobile/rpc-foundation/goldens/sc-create-intent-unlisted-provider.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "7a032109038c14b0a0f254097939b877eba62c10ba7b963070988bb4a1c06ef0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-create-link-failure-is-non-fatal.json b/mobile/rpc-foundation/goldens/sc-create-link-failure-is-non-fatal.json
index 806d59ff191..0c5cf7ca5c9 100644
--- a/mobile/rpc-foundation/goldens/sc-create-link-failure-is-non-fatal.json
+++ b/mobile/rpc-foundation/goldens/sc-create-link-failure-is-non-fatal.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "2deb0435ef63a3e0102e28f2f3f331039486d193d1e1ffdfb53ad86d3ff039f0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-create-pushes-then-creates.json b/mobile/rpc-foundation/goldens/sc-create-pushes-then-creates.json
index fe4a4c821f0..d1d67fa88ad 100644
--- a/mobile/rpc-foundation/goldens/sc-create-pushes-then-creates.json
+++ b/mobile/rpc-foundation/goldens/sc-create-pushes-then-creates.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "0f86b3e6059c48cd327c55df2452a9bc6ea85584ffbeacafad496f600c20e06f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-create-refused-empty-message.json b/mobile/rpc-foundation/goldens/sc-create-refused-empty-message.json
index 91c39e09834..d5836036392 100644
--- a/mobile/rpc-foundation/goldens/sc-create-refused-empty-message.json
+++ b/mobile/rpc-foundation/goldens/sc-create-refused-empty-message.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "5008e69a8e396b1deccd98712d92650a630f971cd76a02862a461afb8617b8a4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-create-rejected-empty-message.json b/mobile/rpc-foundation/goldens/sc-create-rejected-empty-message.json
index f8d9162b9ba..8fe06253fdd 100644
--- a/mobile/rpc-foundation/goldens/sc-create-rejected-empty-message.json
+++ b/mobile/rpc-foundation/goldens/sc-create-rejected-empty-message.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "ea71081982a101d0f8624707b59c99de9981e9b1d1bafa25c66d575e3f876ff4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-eligibility-fetched.json b/mobile/rpc-foundation/goldens/sc-eligibility-fetched.json
index 557f5f0826b..56e5dfb49d9 100644
--- a/mobile/rpc-foundation/goldens/sc-eligibility-fetched.json
+++ b/mobile/rpc-foundation/goldens/sc-eligibility-fetched.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.eligibility",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "f6a1595073abe11b33973e8865900a1d849f44221961da5c12ea13aa696f6490",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-history-commit-files.json b/mobile/rpc-foundation/goldens/sc-history-commit-files.json
index d1770858c5e..7ecc50cdb96 100644
--- a/mobile/rpc-foundation/goldens/sc-history-commit-files.json
+++ b/mobile/rpc-foundation/goldens/sc-history-commit-files.json
@@ -3,9 +3,9 @@
   "family": "git.history-commit-files",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "27e71d989da152adcbe40a02186df8b8a2e19a6a0e8bfe727e2133c4360f7639",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-history-loaded.json b/mobile/rpc-foundation/goldens/sc-history-loaded.json
index 2677d4ded2f..d465bfe7397 100644
--- a/mobile/rpc-foundation/goldens/sc-history-loaded.json
+++ b/mobile/rpc-foundation/goldens/sc-history-loaded.json
@@ -3,9 +3,9 @@
   "family": "git.history-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "83f61085a91458bad529905ecc6fe240c598cddfe44a56dd497b8aed9fb8a7e5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-pr-link-hosted-review.json b/mobile/rpc-foundation/goldens/sc-pr-link-hosted-review.json
index 4d581e66826..1f04d795004 100644
--- a/mobile/rpc-foundation/goldens/sc-pr-link-hosted-review.json
+++ b/mobile/rpc-foundation/goldens/sc-pr-link-hosted-review.json
@@ -3,9 +3,9 @@
   "family": "worktree.review-link",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "42b0304b2fdce08b7ff52ec979dd9f199f368e5e4ef0b5370acc417909b592b3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-pr-link-read.json b/mobile/rpc-foundation/goldens/sc-pr-link-read.json
index d98a8ac0ace..6db76201c5e 100644
--- a/mobile/rpc-foundation/goldens/sc-pr-link-read.json
+++ b/mobile/rpc-foundation/goldens/sc-pr-link-read.json
@@ -3,9 +3,9 @@
   "family": "worktree.review-link",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "4520bd54a55eabfe6ec64a4b2f824f095f98b2fffd1bf22fe4f9ec7f63cbfa3f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-pr-link-set.json b/mobile/rpc-foundation/goldens/sc-pr-link-set.json
index d9a1be36247..971ce699f80 100644
--- a/mobile/rpc-foundation/goldens/sc-pr-link-set.json
+++ b/mobile/rpc-foundation/goldens/sc-pr-link-set.json
@@ -3,9 +3,9 @@
   "family": "worktree.review-link",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "b65bad4f8c0ae0b686f6c3db93bd43ffa072ae426f978f1a86ad8008fb24fa24",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-prefill-unavailable-on-refusal.json b/mobile/rpc-foundation/goldens/sc-prefill-unavailable-on-refusal.json
index 2c267e8498a..6b8985b6efd 100644
--- a/mobile/rpc-foundation/goldens/sc-prefill-unavailable-on-refusal.json
+++ b/mobile/rpc-foundation/goldens/sc-prefill-unavailable-on-refusal.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.eligibility",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "9de96287a4dfa6cf5c9a8b683cc696fdc2cd387f86f231e22ee3f100a2e778e3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-prefill-unavailable-on-rejection.json b/mobile/rpc-foundation/goldens/sc-prefill-unavailable-on-rejection.json
index 875ec961d37..25533378b81 100644
--- a/mobile/rpc-foundation/goldens/sc-prefill-unavailable-on-rejection.json
+++ b/mobile/rpc-foundation/goldens/sc-prefill-unavailable-on-rejection.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.eligibility",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "adbdfcc3895cc04d830900de518e689c9e63f6f75569127e1fde24488658e8a0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-prerequisite-force-with-lease.json b/mobile/rpc-foundation/goldens/sc-prerequisite-force-with-lease.json
index 44d2f60505e..033c968f802 100644
--- a/mobile/rpc-foundation/goldens/sc-prerequisite-force-with-lease.json
+++ b/mobile/rpc-foundation/goldens/sc-prerequisite-force-with-lease.json
@@ -3,9 +3,9 @@
   "family": "git.remote-prerequisite",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "ec2847b4af357d8564d8e0a9a1072713c1afd7ff86ba69e9c83c056a6841ee39",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-prerequisite-publish.json b/mobile/rpc-foundation/goldens/sc-prerequisite-publish.json
index 222223036cb..8d6a9ba86ef 100644
--- a/mobile/rpc-foundation/goldens/sc-prerequisite-publish.json
+++ b/mobile/rpc-foundation/goldens/sc-prerequisite-publish.json
@@ -3,9 +3,9 @@
   "family": "git.remote-prerequisite",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "6cf6ebd20adc4cc76a12d3424863ee9db2b24f36593664a1f4e0e05de9a53d39",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-prerequisite-push.json b/mobile/rpc-foundation/goldens/sc-prerequisite-push.json
index f2497fff69d..b2726825fec 100644
--- a/mobile/rpc-foundation/goldens/sc-prerequisite-push.json
+++ b/mobile/rpc-foundation/goldens/sc-prerequisite-push.json
@@ -3,9 +3,9 @@
   "family": "git.remote-prerequisite",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "e6e8197a541cd73e5811a1f28b0dbfc414a4d34c1ae6929fc1bbae1213820674",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-prerequisite-skipped.json b/mobile/rpc-foundation/goldens/sc-prerequisite-skipped.json
index 111449e3669..cab9b0f77b7 100644
--- a/mobile/rpc-foundation/goldens/sc-prerequisite-skipped.json
+++ b/mobile/rpc-foundation/goldens/sc-prerequisite-skipped.json
@@ -3,9 +3,9 @@
   "family": "git.remote-prerequisite",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "523d1ee21e3871a4dffc32f48d2e28c31ecea48cbf3f842acffc8355be06b14b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-reveal-first-poll.json b/mobile/rpc-foundation/goldens/sc-reveal-first-poll.json
index 30d8af5f75c..b674b56547a 100644
--- a/mobile/rpc-foundation/goldens/sc-reveal-first-poll.json
+++ b/mobile/rpc-foundation/goldens/sc-reveal-first-poll.json
@@ -3,9 +3,9 @@
   "family": "session.tab-reveal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "00b26cb279b0a934df98d93ba98a4a0c79e302c7690c582e778dc0156ab4f235",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-reveal-timeout.json b/mobile/rpc-foundation/goldens/sc-reveal-timeout.json
index ea3f9dfdd1c..09f7997334b 100644
--- a/mobile/rpc-foundation/goldens/sc-reveal-timeout.json
+++ b/mobile/rpc-foundation/goldens/sc-reveal-timeout.json
@@ -3,9 +3,9 @@
   "family": "session.tab-reveal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "fcd61f1ef46c42889827a87876239534b851c425f8ef7a9405ea95b8d07d2363",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-review-commit-inner-failure.json b/mobile/rpc-foundation/goldens/sc-review-commit-inner-failure.json
index f0e6f405085..e0e60399b47 100644
--- a/mobile/rpc-foundation/goldens/sc-review-commit-inner-failure.json
+++ b/mobile/rpc-foundation/goldens/sc-review-commit-inner-failure.json
@@ -3,9 +3,9 @@
   "family": "git.review-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "db1fb2a584cd806028b9be861283a63aa4836c83f61558f3d518ddbb7a59498d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-review-commit-refused-empty-message.json b/mobile/rpc-foundation/goldens/sc-review-commit-refused-empty-message.json
index 083cf0b1914..8d154c5dfaa 100644
--- a/mobile/rpc-foundation/goldens/sc-review-commit-refused-empty-message.json
+++ b/mobile/rpc-foundation/goldens/sc-review-commit-refused-empty-message.json
@@ -3,9 +3,9 @@
   "family": "git.review-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "dba1676583dc832ef059285a6bd4c3eefe6be0230e42100cb9d7a125755d136b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-review-commit-rejected.json b/mobile/rpc-foundation/goldens/sc-review-commit-rejected.json
index ef21274321f..9269cac7018 100644
--- a/mobile/rpc-foundation/goldens/sc-review-commit-rejected.json
+++ b/mobile/rpc-foundation/goldens/sc-review-commit-rejected.json
@@ -3,9 +3,9 @@
   "family": "git.review-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "de079de9cc21bfb40da6e1431273b10c3e2a5b5402b91b2b8a85c8d7ac41bc97",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-review-commit.json b/mobile/rpc-foundation/goldens/sc-review-commit.json
index a6d7fd57322..b0c8782c2fb 100644
--- a/mobile/rpc-foundation/goldens/sc-review-commit.json
+++ b/mobile/rpc-foundation/goldens/sc-review-commit.json
@@ -3,9 +3,9 @@
   "family": "git.review-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "a29d518b2d075e8e4811404e0fcbf8948fbfe53a3aefbf0948cb2f2e622e8cbb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-review-status-entries-not-array.json b/mobile/rpc-foundation/goldens/sc-review-status-entries-not-array.json
index 6b8e52b44e3..09c0f73f4f9 100644
--- a/mobile/rpc-foundation/goldens/sc-review-status-entries-not-array.json
+++ b/mobile/rpc-foundation/goldens/sc-review-status-entries-not-array.json
@@ -3,9 +3,9 @@
   "family": "git.review-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "37ba7780ca9525ab313c0a9c781ce5bb26344e63af9272c32ae889621f383b2b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-review-status-normalized.json b/mobile/rpc-foundation/goldens/sc-review-status-normalized.json
index 2c8f6dc5e3d..8a9c960b76a 100644
--- a/mobile/rpc-foundation/goldens/sc-review-status-normalized.json
+++ b/mobile/rpc-foundation/goldens/sc-review-status-normalized.json
@@ -3,9 +3,9 @@
   "family": "git.review-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "93193acd57d6f00abc8e6c22ec3a8f1ca6ce7c5808d906d0aa7c11e41dab4635",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/schedules-b3.json b/mobile/rpc-foundation/goldens/schedules-b3.json
index ea928bafd54..1e1afdf801c 100644
--- a/mobile/rpc-foundation/goldens/schedules-b3.json
+++ b/mobile/rpc-foundation/goldens/schedules-b3.json
@@ -3,9 +3,9 @@
   "family": "linear-detail-barrier",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "b59fb599dd3a5fbc79bb8602dcec4b1c51a392c662efab7efc8324fc718ce8de",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/schedules-settings-home-providers-fulfilled.json b/mobile/rpc-foundation/goldens/schedules-settings-home-providers-fulfilled.json
index b164138d41f..b380930de49 100644
--- a/mobile/rpc-foundation/goldens/schedules-settings-home-providers-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/schedules-settings-home-providers-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.home-providers",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "fbd311a377672a9335521c30734880eea1b04bab0aff367854c1deebcf66b105",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/schedules-settings-new-tab-ssh.json b/mobile/rpc-foundation/goldens/schedules-settings-new-tab-ssh.json
index d03a6b657cd..d25a6875159 100644
--- a/mobile/rpc-foundation/goldens/schedules-settings-new-tab-ssh.json
+++ b/mobile/rpc-foundation/goldens/schedules-settings-new-tab-ssh.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "2726d71130f623e3ad02c168c13269979ca6f84703bf1c5aaf36bd4432dfb516",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/schedules-settings-repo-metadata-fulfilled.json b/mobile/rpc-foundation/goldens/schedules-settings-repo-metadata-fulfilled.json
index b6f75a55de6..7c2571c1359 100644
--- a/mobile/rpc-foundation/goldens/schedules-settings-repo-metadata-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/schedules-settings-repo-metadata-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "664eba1468e229f9ac2dced262e7ad896ead01688dff4c570f397c3f8594efd7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/schedules-settings-resume-metadata-fulfilled.json b/mobile/rpc-foundation/goldens/schedules-settings-resume-metadata-fulfilled.json
index 2de3409b1c0..3a35f071ec1 100644
--- a/mobile/rpc-foundation/goldens/schedules-settings-resume-metadata-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/schedules-settings-resume-metadata-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "7bfba3fae1dc33acf40e8a955bbfccf28580b3daee3270dec6a15e6cefd45a84",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/schedules-settings-task-hydration-fulfilled.json b/mobile/rpc-foundation/goldens/schedules-settings-task-hydration-fulfilled.json
index c75f9c17dbc..7b642ae4e3a 100644
--- a/mobile/rpc-foundation/goldens/schedules-settings-task-hydration-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/schedules-settings-task-hydration-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "02e3ca10296704b5478185e9d3dc0136596a2ee57580d7f9268672568dab4cd4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/schedules-settings-workspace-context-fulfilled.json b/mobile/rpc-foundation/goldens/schedules-settings-workspace-context-fulfilled.json
index da7db747e22..b7d410cdb45 100644
--- a/mobile/rpc-foundation/goldens/schedules-settings-workspace-context-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/schedules-settings-workspace-context-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": ["new-workspace-runtime-context-null-results-degrade-to-absent"],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "eb980fc027ca0200212ba6ad3bf9a1ab3460936a7bb4b04353a9462eecd287a1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-browser-tab-created.json b/mobile/rpc-foundation/goldens/session-browser-tab-created.json
index 827959f1c4f..6deb81f5877 100644
--- a/mobile/rpc-foundation/goldens/session-browser-tab-created.json
+++ b/mobile/rpc-foundation/goldens/session-browser-tab-created.json
@@ -3,9 +3,9 @@
   "family": "session.browser-tab-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "b4b584b1da9569f18475211ff84d157de3e5d3f300719f6848ac51c01d011531",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-browser-refused.json b/mobile/rpc-foundation/goldens/session-create-browser-refused.json
index 257c09cb193..5daf976e8e6 100644
--- a/mobile/rpc-foundation/goldens/session-create-browser-refused.json
+++ b/mobile/rpc-foundation/goldens/session-create-browser-refused.json
@@ -3,9 +3,9 @@
   "family": "session.content-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "59b5f0aac2f8c1aab5fc3a457fb69e1a2f46cc88c617c25e638175acb7f7c0cb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-browser-tab.json b/mobile/rpc-foundation/goldens/session-create-browser-tab.json
index eb82591af17..aa52d3f00ad 100644
--- a/mobile/rpc-foundation/goldens/session-create-browser-tab.json
+++ b/mobile/rpc-foundation/goldens/session-create-browser-tab.json
@@ -3,9 +3,9 @@
   "family": "session.content-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "36dbd24dc3d24be8c14217ced1963d10ef8264438729dd146cbff79d9fbdf279",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-markdown-name-collision.json b/mobile/rpc-foundation/goldens/session-create-markdown-name-collision.json
index 513e88241aa..492e40d7e5f 100644
--- a/mobile/rpc-foundation/goldens/session-create-markdown-name-collision.json
+++ b/mobile/rpc-foundation/goldens/session-create-markdown-name-collision.json
@@ -3,9 +3,9 @@
   "family": "session.content-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "be8d4b4be07b0ee5988471b26813d7d0d2a97fbd789b52e7ce00dd09a2e9d75c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-markdown-note.json b/mobile/rpc-foundation/goldens/session-create-markdown-note.json
index 68897904898..d7612898532 100644
--- a/mobile/rpc-foundation/goldens/session-create-markdown-note.json
+++ b/mobile/rpc-foundation/goldens/session-create-markdown-note.json
@@ -3,9 +3,9 @@
   "family": "session.content-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "4118eea1175cba0f15174072f5715f9054ded09a4cb0c359fc4ee41ad00e9440",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-terminal-ignores-a-second-create-in-flight.json b/mobile/rpc-foundation/goldens/session-create-terminal-ignores-a-second-create-in-flight.json
index 225117385c7..05556e6d5a7 100644
--- a/mobile/rpc-foundation/goldens/session-create-terminal-ignores-a-second-create-in-flight.json
+++ b/mobile/rpc-foundation/goldens/session-create-terminal-ignores-a-second-create-in-flight.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "df99b9c0ebcffb3d8f173c87783862edb0a66befcc3cd73f1096871f45963913",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-terminal-launches-an-agent-quick-command.json b/mobile/rpc-foundation/goldens/session-create-terminal-launches-an-agent-quick-command.json
index 5726718ddb7..58742b950c0 100644
--- a/mobile/rpc-foundation/goldens/session-create-terminal-launches-an-agent-quick-command.json
+++ b/mobile/rpc-foundation/goldens/session-create-terminal-launches-an-agent-quick-command.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "fb9828d5e13917ce394061b2d702890e5198df04ce803363b2ce9f939921d00e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-terminal-refused.json b/mobile/rpc-foundation/goldens/session-create-terminal-refused.json
index 6e26bb7539f..1e1a4d7e58e 100644
--- a/mobile/rpc-foundation/goldens/session-create-terminal-refused.json
+++ b/mobile/rpc-foundation/goldens/session-create-terminal-refused.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "e9c32bdf3357ca5d69ac07cb7bbc63fe279c1a23c44e5c79fa0b1db4fd1c55dd",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-terminal-replaces-active.json b/mobile/rpc-foundation/goldens/session-create-terminal-replaces-active.json
index 020ed30bc5b..c8d49094a52 100644
--- a/mobile/rpc-foundation/goldens/session-create-terminal-replaces-active.json
+++ b/mobile/rpc-foundation/goldens/session-create-terminal-replaces-active.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "726e19307f1e82f0c8ae9a555ec9c27c8eea7f8f40fa700dc0b71c54ecc9ca11",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-terminal-runs-a-quick-command.json b/mobile/rpc-foundation/goldens/session-create-terminal-runs-a-quick-command.json
index 9a475482247..388c8d05d4a 100644
--- a/mobile/rpc-foundation/goldens/session-create-terminal-runs-a-quick-command.json
+++ b/mobile/rpc-foundation/goldens/session-create-terminal-runs-a-quick-command.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "4dfbe31daae64a03fc588f2095235fdd9b37f26ecccefe596c35c8ef8f623651",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-terminal-with-prompt.json b/mobile/rpc-foundation/goldens/session-create-terminal-with-prompt.json
index 8e717e4733a..369edebaee7 100644
--- a/mobile/rpc-foundation/goldens/session-create-terminal-with-prompt.json
+++ b/mobile/rpc-foundation/goldens/session-create-terminal-with-prompt.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "fd654a7e34ae8004543a34a7a301d51858989fdc2bffb02ddf6edb814071b22d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-terminal-without-active-tab.json b/mobile/rpc-foundation/goldens/session-create-terminal-without-active-tab.json
index f71bb2471dc..3100b3a5c56 100644
--- a/mobile/rpc-foundation/goldens/session-create-terminal-without-active-tab.json
+++ b/mobile/rpc-foundation/goldens/session-create-terminal-without-active-tab.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "da78ad25ea15e1c714f0147d34207529362743a56a519153f36b09345dee0ebc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-terminal-without-handle.json b/mobile/rpc-foundation/goldens/session-create-terminal-without-handle.json
index 24685fb9664..b42062b29d7 100644
--- a/mobile/rpc-foundation/goldens/session-create-terminal-without-handle.json
+++ b/mobile/rpc-foundation/goldens/session-create-terminal-without-handle.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "f1952a0e2c9108dadf2f5b85ac1f43ec9db09db0ce81a575bb4dd3a8d18d9c83",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-diff-notes-load-refused.json b/mobile/rpc-foundation/goldens/session-diff-notes-load-refused.json
index 6bd8fbee188..d84c8289b61 100644
--- a/mobile/rpc-foundation/goldens/session-diff-notes-load-refused.json
+++ b/mobile/rpc-foundation/goldens/session-diff-notes-load-refused.json
@@ -3,9 +3,9 @@
   "family": "session.diff-notes",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "5ab16800f82813778078e84739e0ac72886c145d20789dedcea9428ee31b9182",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-diff-notes-loaded.json b/mobile/rpc-foundation/goldens/session-diff-notes-loaded.json
index 3842c397bf5..e0cc94425e7 100644
--- a/mobile/rpc-foundation/goldens/session-diff-notes-loaded.json
+++ b/mobile/rpc-foundation/goldens/session-diff-notes-loaded.json
@@ -3,9 +3,9 @@
   "family": "session.diff-notes",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "795286ff495a243059a3eb55ccbbc9b4adfdd2034258f91f9182e83c7492fa60",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-file-tab-read.json b/mobile/rpc-foundation/goldens/session-file-tab-read.json
index f98035d2111..a66a1b7e518 100644
--- a/mobile/rpc-foundation/goldens/session-file-tab-read.json
+++ b/mobile/rpc-foundation/goldens/session-file-tab-read.json
@@ -3,9 +3,9 @@
   "family": "session.tab-documents",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "82c1d8e87e0a87c1c1a6dba7bd4f61e08f77fe0ae1b3758d1b5543bd9719a53f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-markdown-disk-read.json b/mobile/rpc-foundation/goldens/session-markdown-disk-read.json
index ee29c3a115a..2985dbf24df 100644
--- a/mobile/rpc-foundation/goldens/session-markdown-disk-read.json
+++ b/mobile/rpc-foundation/goldens/session-markdown-disk-read.json
@@ -3,9 +3,9 @@
   "family": "session.markdown-disk-fallback",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "29565833b19968faa701f656d166050419f149d6bb76d1f63f4dd3af76b8e896",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-markdown-disk-served.json b/mobile/rpc-foundation/goldens/session-markdown-disk-served.json
index 7f9edf701f1..e81e397437c 100644
--- a/mobile/rpc-foundation/goldens/session-markdown-disk-served.json
+++ b/mobile/rpc-foundation/goldens/session-markdown-disk-served.json
@@ -3,9 +3,9 @@
   "family": "session.markdown-disk-fallback",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "8375df17afabf282a1d37ffaa3a334b1fa9105ba04e6618f16082f66bfe3f76d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-markdown-save-conflict.json b/mobile/rpc-foundation/goldens/session-markdown-save-conflict.json
index 0f067ec892e..4714d44cffb 100644
--- a/mobile/rpc-foundation/goldens/session-markdown-save-conflict.json
+++ b/mobile/rpc-foundation/goldens/session-markdown-save-conflict.json
@@ -3,9 +3,9 @@
   "family": "session.markdown-save",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "76bccdabb78dc3f16b36987f6b7cefbe41e08167fe39612620e27ad476089f93",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-markdown-saved.json b/mobile/rpc-foundation/goldens/session-markdown-saved.json
index 57e04013653..6b282c3ffc1 100644
--- a/mobile/rpc-foundation/goldens/session-markdown-saved.json
+++ b/mobile/rpc-foundation/goldens/session-markdown-saved.json
@@ -3,9 +3,9 @@
   "family": "session.markdown-save",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "a2b5b73b2455f9efc48361e4b96ab1d3ecc3d136459403c9c3678104604cd774",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-markdown-tab-disk-fallback.json b/mobile/rpc-foundation/goldens/session-markdown-tab-disk-fallback.json
index 82f75057162..0c80c9d614c 100644
--- a/mobile/rpc-foundation/goldens/session-markdown-tab-disk-fallback.json
+++ b/mobile/rpc-foundation/goldens/session-markdown-tab-disk-fallback.json
@@ -3,9 +3,9 @@
   "family": "session.tab-documents",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "f46cef9d1c6a5ed6d8b6f1d180cdf5c666f52e043b70feb07e5fccee885ceeda",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-markdown-tab-read.json b/mobile/rpc-foundation/goldens/session-markdown-tab-read.json
index 78a16c076be..cdd162c2c53 100644
--- a/mobile/rpc-foundation/goldens/session-markdown-tab-read.json
+++ b/mobile/rpc-foundation/goldens/session-markdown-tab-read.json
@@ -3,9 +3,9 @@
   "family": "session.tab-documents",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "f88c39d410655b229aa740b45ccdaa10186f41f7c6cbff9fed6eaee3f0a55844",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-markdown-tab-refused.json b/mobile/rpc-foundation/goldens/session-markdown-tab-refused.json
index bb5dce1fe76..888a9a7ef6e 100644
--- a/mobile/rpc-foundation/goldens/session-markdown-tab-refused.json
+++ b/mobile/rpc-foundation/goldens/session-markdown-tab-refused.json
@@ -3,9 +3,9 @@
   "family": "session.tab-documents",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "63227f28110e90acac78058baa875b1bc7f8895b5033e47016a2ffa9f42f66ce",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-startup-both-activation-sites.json b/mobile/rpc-foundation/goldens/session-startup-both-activation-sites.json
index da997390226..55c7ddf9202 100644
--- a/mobile/rpc-foundation/goldens/session-startup-both-activation-sites.json
+++ b/mobile/rpc-foundation/goldens/session-startup-both-activation-sites.json
@@ -3,9 +3,9 @@
   "family": "session.startup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "6b08c394e37fd572cf63a4c11934247d379008f11117aa5af33b2926fbd32d1e",
   "scenarioSha256": "efb7ff45ac09f1b7f0f3ad7f1b6f09d4d5c349e22de7d9c4d63ca93530552418",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-startup-floating-route-skips-activation.json b/mobile/rpc-foundation/goldens/session-startup-floating-route-skips-activation.json
index b70bfd0845c..97c2168cce6 100644
--- a/mobile/rpc-foundation/goldens/session-startup-floating-route-skips-activation.json
+++ b/mobile/rpc-foundation/goldens/session-startup-floating-route-skips-activation.json
@@ -3,9 +3,9 @@
   "family": "session.startup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "6b08c394e37fd572cf63a4c11934247d379008f11117aa5af33b2926fbd32d1e",
   "scenarioSha256": "82ff29efaa6ee0bf49ce41bfe7dff2083d0f942c10cc9d8bab48925354d17519",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-startup-keeps-terminals-visible-on-reconnect.json b/mobile/rpc-foundation/goldens/session-startup-keeps-terminals-visible-on-reconnect.json
index 295e227a1a7..f7cd9596eba 100644
--- a/mobile/rpc-foundation/goldens/session-startup-keeps-terminals-visible-on-reconnect.json
+++ b/mobile/rpc-foundation/goldens/session-startup-keeps-terminals-visible-on-reconnect.json
@@ -3,9 +3,9 @@
   "family": "session.startup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "6b08c394e37fd572cf63a4c11934247d379008f11117aa5af33b2926fbd32d1e",
   "scenarioSha256": "f540e4a06380a6a5d82d670230c76b7afc2c60302bc27dda13156b620095c5cc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-startup-refused-tab-load-still-loads-terminals.json b/mobile/rpc-foundation/goldens/session-startup-refused-tab-load-still-loads-terminals.json
index 32f5302ae21..30715f84de3 100644
--- a/mobile/rpc-foundation/goldens/session-startup-refused-tab-load-still-loads-terminals.json
+++ b/mobile/rpc-foundation/goldens/session-startup-refused-tab-load-still-loads-terminals.json
@@ -3,9 +3,9 @@
   "family": "session.startup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "6b08c394e37fd572cf63a4c11934247d379008f11117aa5af33b2926fbd32d1e",
   "scenarioSha256": "18d0bbda11a394a13d0eaea12b8748dbeede1ae7212907b0ca70a9bafa037424",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tab-activation-focus-and-activate.json b/mobile/rpc-foundation/goldens/session-tab-activation-focus-and-activate.json
index 29f00490b2c..ea696e6b164 100644
--- a/mobile/rpc-foundation/goldens/session-tab-activation-focus-and-activate.json
+++ b/mobile/rpc-foundation/goldens/session-tab-activation-focus-and-activate.json
@@ -3,9 +3,9 @@
   "family": "session.tab-activation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "72a972996461cc58bda2b1c11dbb4ecdbdecd5ff2f977c3d61e40d635f63c1b9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tab-activation-refused.json b/mobile/rpc-foundation/goldens/session-tab-activation-refused.json
index c1285ffbe1e..c28f4a99a95 100644
--- a/mobile/rpc-foundation/goldens/session-tab-activation-refused.json
+++ b/mobile/rpc-foundation/goldens/session-tab-activation-refused.json
@@ -3,9 +3,9 @@
   "family": "session.tab-activation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "e5049c9ee2aef93194adf1b9540c1eb4b085e6f975648c5ed605718d19fc6afa",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tab-activation-transport-error.json b/mobile/rpc-foundation/goldens/session-tab-activation-transport-error.json
index dabe5627aaa..e34e24a2b60 100644
--- a/mobile/rpc-foundation/goldens/session-tab-activation-transport-error.json
+++ b/mobile/rpc-foundation/goldens/session-tab-activation-transport-error.json
@@ -3,9 +3,9 @@
   "family": "session.tab-activation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "44e25e8624c6d7f072c5f7aa3c706df29d0e751bb59b3fb58bec003233f7e5e3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tab-close-refused-keeps-tab.json b/mobile/rpc-foundation/goldens/session-tab-close-refused-keeps-tab.json
index 213a971fb79..0086ca39bec 100644
--- a/mobile/rpc-foundation/goldens/session-tab-close-refused-keeps-tab.json
+++ b/mobile/rpc-foundation/goldens/session-tab-close-refused-keeps-tab.json
@@ -3,9 +3,9 @@
   "family": "session.tab-close",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "1b3da0207aef65f4b2348aed334284259170c640e767fb354b9e95f3c1369445",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tab-close-session-tab.json b/mobile/rpc-foundation/goldens/session-tab-close-session-tab.json
index fbb31952b6a..ccd45f89519 100644
--- a/mobile/rpc-foundation/goldens/session-tab-close-session-tab.json
+++ b/mobile/rpc-foundation/goldens/session-tab-close-session-tab.json
@@ -3,9 +3,9 @@
   "family": "session.tab-close",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "fe83a7d50d08f874d863eb8872bcb24d974c1dc46571a93d3f9184f8feba63a4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tab-close-terminal.json b/mobile/rpc-foundation/goldens/session-tab-close-terminal.json
index 39059fc9a0d..3f9b15a236c 100644
--- a/mobile/rpc-foundation/goldens/session-tab-close-terminal.json
+++ b/mobile/rpc-foundation/goldens/session-tab-close-terminal.json
@@ -3,9 +3,9 @@
   "family": "session.tab-close",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "194b010d00fdeca85418870fd053ac500c38cae02e98c4bfc544b8fea78bbcb8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tab-closed.json b/mobile/rpc-foundation/goldens/session-tab-closed.json
index e81a5dfa729..05c7d1ee68e 100644
--- a/mobile/rpc-foundation/goldens/session-tab-closed.json
+++ b/mobile/rpc-foundation/goldens/session-tab-closed.json
@@ -3,9 +3,9 @@
   "family": "session.tab-close-session",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "334b50e135103db21b93e60acff31047823371049171b57388df050179a6dcbc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tab-rename.json b/mobile/rpc-foundation/goldens/session-tab-rename.json
index 7ded733e1cb..b1259c2d689 100644
--- a/mobile/rpc-foundation/goldens/session-tab-rename.json
+++ b/mobile/rpc-foundation/goldens/session-tab-rename.json
@@ -3,9 +3,9 @@
   "family": "session.tab-close",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "9e877af8539e5425f65edd6b3ff8af73e719aae2033980411a8e8a3b508dcd9e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tab-renamed.json b/mobile/rpc-foundation/goldens/session-tab-renamed.json
index f8d9f129335..8b8aadaf7fc 100644
--- a/mobile/rpc-foundation/goldens/session-tab-renamed.json
+++ b/mobile/rpc-foundation/goldens/session-tab-renamed.json
@@ -3,9 +3,9 @@
   "family": "session.tab-rename",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "927e7cda255922c2e6ac893f0068679774ce5de988376df1ff8b7d5072f7d127",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tabs-health-errored.json b/mobile/rpc-foundation/goldens/session-tabs-health-errored.json
index c32190f294a..95b474c95ae 100644
--- a/mobile/rpc-foundation/goldens/session-tabs-health-errored.json
+++ b/mobile/rpc-foundation/goldens/session-tabs-health-errored.json
@@ -3,9 +3,9 @@
   "family": "session.tabs-stream-health",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "4f55a21a5c42ff8d96ccb1b16de235f91f9f7e38fe90de7191c36c8c16cc4e43",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tabs-health-reconciled.json b/mobile/rpc-foundation/goldens/session-tabs-health-reconciled.json
index 1d7045e5a77..90e5ff2efe5 100644
--- a/mobile/rpc-foundation/goldens/session-tabs-health-reconciled.json
+++ b/mobile/rpc-foundation/goldens/session-tabs-health-reconciled.json
@@ -3,9 +3,9 @@
   "family": "session.tabs-stream-health",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "29bee268df8e92fb1e3fd59291262c8d2d04a1b7e9fe40f6ed8dd181b0df828a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tabs-health-refused.json b/mobile/rpc-foundation/goldens/session-tabs-health-refused.json
index 3edffc5cf23..15ff9988741 100644
--- a/mobile/rpc-foundation/goldens/session-tabs-health-refused.json
+++ b/mobile/rpc-foundation/goldens/session-tabs-health-refused.json
@@ -3,9 +3,9 @@
   "family": "session.tabs-stream-health",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "101e8ce865088891800680db0e3df787b5f15ceb05ace9840931c384d9732d1c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tabs-health-stale-application-revision.json b/mobile/rpc-foundation/goldens/session-tabs-health-stale-application-revision.json
index b7ebf4089e4..9582935fdb4 100644
--- a/mobile/rpc-foundation/goldens/session-tabs-health-stale-application-revision.json
+++ b/mobile/rpc-foundation/goldens/session-tabs-health-stale-application-revision.json
@@ -3,9 +3,9 @@
   "family": "session.tabs-stream-health",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "5381b6ade796596ac362d4ed64349266e65fe8fd2b4fc778a54315d4b6fda3da",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-take-floor.json b/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-take-floor.json
index 6449ffa46de..f33b9687213 100644
--- a/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-take-floor.json
+++ b/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-take-floor.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-display-mode",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9e90ad39a8d4257adf30166757a6364c4710dc3ae9f06365f80a3dd8f1c94d89",
   "scenarioSha256": "a4ba13014a128c0e06a3d40b9e3fa3b0136b07f52a92c89a9afa3c73bc39d69f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-without-device-token.json b/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-without-device-token.json
index 48604cb4811..603f5530dc9 100644
--- a/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-without-device-token.json
+++ b/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-without-device-token.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-display-mode",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9e90ad39a8d4257adf30166757a6364c4710dc3ae9f06365f80a3dd8f1c94d89",
   "scenarioSha256": "10295c4779f010c5040a7a04264a8094c342752ea5d75d887ab99f1a57ba4b2e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-without-viewport.json b/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-without-viewport.json
index b780c7797ed..0cffaec8027 100644
--- a/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-without-viewport.json
+++ b/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-without-viewport.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-display-mode",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9e90ad39a8d4257adf30166757a6364c4710dc3ae9f06365f80a3dd8f1c94d89",
   "scenarioSha256": "bb278c4da53b82d84cf50b308901ce196cc1f07c1a84790ad491319ee6746541",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-terminal-display-mode-drops-second-toggle.json b/mobile/rpc-foundation/goldens/session-terminal-display-mode-drops-second-toggle.json
index 7c66404302a..e46caab14e7 100644
--- a/mobile/rpc-foundation/goldens/session-terminal-display-mode-drops-second-toggle.json
+++ b/mobile/rpc-foundation/goldens/session-terminal-display-mode-drops-second-toggle.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-display-mode",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9e90ad39a8d4257adf30166757a6364c4710dc3ae9f06365f80a3dd8f1c94d89",
   "scenarioSha256": "16f645f758f2463bf6e16559d581afbc8794aa56069210f13a45952158d35a4c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-terminal-display-mode-to-desktop.json b/mobile/rpc-foundation/goldens/session-terminal-display-mode-to-desktop.json
index 36c7cf19152..8ad86b80118 100644
--- a/mobile/rpc-foundation/goldens/session-terminal-display-mode-to-desktop.json
+++ b/mobile/rpc-foundation/goldens/session-terminal-display-mode-to-desktop.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-display-mode",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9e90ad39a8d4257adf30166757a6364c4710dc3ae9f06365f80a3dd8f1c94d89",
   "scenarioSha256": "fc81b0ac28970f9db27276c90f486306d74387f1404d757216a09823fedf680c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-terminal-list-dedupes-handles.json b/mobile/rpc-foundation/goldens/session-terminal-list-dedupes-handles.json
index efd15e590ac..0a2cd68eed8 100644
--- a/mobile/rpc-foundation/goldens/session-terminal-list-dedupes-handles.json
+++ b/mobile/rpc-foundation/goldens/session-terminal-list-dedupes-handles.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "d0f5ecc9c8fcb10193f481648215a54460ce5a54a8fbd2ded3921a9599fefc0a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-terminal-list-empty-guarded.json b/mobile/rpc-foundation/goldens/session-terminal-list-empty-guarded.json
index b8057e608a1..7fc3a0910f5 100644
--- a/mobile/rpc-foundation/goldens/session-terminal-list-empty-guarded.json
+++ b/mobile/rpc-foundation/goldens/session-terminal-list-empty-guarded.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "5c2b3237a14f9df9357ab458b2e21f2df8e68ad6bf6dc5670c0ace7eeb567e80",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-terminal-list-merged.json b/mobile/rpc-foundation/goldens/session-terminal-list-merged.json
index fcf78c9c113..c7e41af3dd2 100644
--- a/mobile/rpc-foundation/goldens/session-terminal-list-merged.json
+++ b/mobile/rpc-foundation/goldens/session-terminal-list-merged.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "9f3fb6e58e8d9ef4f52b2b6c0a42b6e4285d5786060f966261795cf64d055f65",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-terminal-list-refused.json b/mobile/rpc-foundation/goldens/session-terminal-list-refused.json
index 004920f5fa4..bf04373e27f 100644
--- a/mobile/rpc-foundation/goldens/session-terminal-list-refused.json
+++ b/mobile/rpc-foundation/goldens/session-terminal-list-refused.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "10a8ba5332f4fc2f90cff537ca69f2f1474339cbc4996f67a6feaea70669fb25",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-bot-overrides-fulfilled.json b/mobile/rpc-foundation/goldens/settings-bot-overrides-fulfilled.json
index a9dc1f26ffa..08a040137ad 100644
--- a/mobile/rpc-foundation/goldens/settings-bot-overrides-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/settings-bot-overrides-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.bot-overrides",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "4b4b4a8d1acaaec1c8dde0233dc49a696ffe53466578477efcbcdb7263dbd617",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-bot-overrides-refresh-refused.json b/mobile/rpc-foundation/goldens/settings-bot-overrides-refresh-refused.json
index 9b033fc7b6d..049f6140c7e 100644
--- a/mobile/rpc-foundation/goldens/settings-bot-overrides-refresh-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-bot-overrides-refresh-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.bot-overrides",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "cac4980465661fba372e187699741123a4edeb9270125a0a1cad7bbb6a6adebd",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-bot-overrides-refused.json b/mobile/rpc-foundation/goldens/settings-bot-overrides-refused.json
index 01b58c7e256..a25288fe082 100644
--- a/mobile/rpc-foundation/goldens/settings-bot-overrides-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-bot-overrides-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.bot-overrides",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "f8ebd2348373b2b39c167735e0c418dfe868511fb5306ecba90cb6f2a905b95e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-bot-overrides-transport-error.json b/mobile/rpc-foundation/goldens/settings-bot-overrides-transport-error.json
index 24e77a1c0ab..9aebfb7c31e 100644
--- a/mobile/rpc-foundation/goldens/settings-bot-overrides-transport-error.json
+++ b/mobile/rpc-foundation/goldens/settings-bot-overrides-transport-error.json
@@ -3,9 +3,9 @@
   "family": "settings.bot-overrides",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "f7e63144421a689f05cc50ad87ec901a9eaeb3163165656887be12a5f2753005",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-home-coalesced.json b/mobile/rpc-foundation/goldens/settings-home-coalesced.json
index fd5c0ec9811..2947a4462c3 100644
--- a/mobile/rpc-foundation/goldens/settings-home-coalesced.json
+++ b/mobile/rpc-foundation/goldens/settings-home-coalesced.json
@@ -3,9 +3,9 @@
   "family": "settings.home-providers",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "d8d6f738ee11d84d6e9e546624f4babcb42476432f6bddbc74e8519d9ca18370",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-home-providers-fulfilled.json b/mobile/rpc-foundation/goldens/settings-home-providers-fulfilled.json
index 34ed9878bad..1e73bf07a49 100644
--- a/mobile/rpc-foundation/goldens/settings-home-providers-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/settings-home-providers-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.home-providers",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "a32b2fc99e830c58460e6f7c857aed0048738a55501e508eb236604680b9c235",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-home-providers-refuse-after-data.json b/mobile/rpc-foundation/goldens/settings-home-providers-refuse-after-data.json
index 102c754f3e0..56d1b42221a 100644
--- a/mobile/rpc-foundation/goldens/settings-home-providers-refuse-after-data.json
+++ b/mobile/rpc-foundation/goldens/settings-home-providers-refuse-after-data.json
@@ -3,9 +3,9 @@
   "family": "settings.home-providers",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "78c48025c4af6cc0f1f136448c0ede9f76b7485d7b33b1356d11dec017bd9053",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-home-providers-refused.json b/mobile/rpc-foundation/goldens/settings-home-providers-refused.json
index 73a26a44f6a..86c728eef18 100644
--- a/mobile/rpc-foundation/goldens/settings-home-providers-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-home-providers-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.home-providers",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "c22f33a0ed28622d4d53ae31e934056f87d2c10e8dc4475831ae1ee5fd3a9b8b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-home-providers-transport-error.json b/mobile/rpc-foundation/goldens/settings-home-providers-transport-error.json
index da08df0a10c..e1f3f91a4be 100644
--- a/mobile/rpc-foundation/goldens/settings-home-providers-transport-error.json
+++ b/mobile/rpc-foundation/goldens/settings-home-providers-transport-error.json
@@ -3,9 +3,9 @@
   "family": "settings.home-providers",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "4f16b43dddfb9257828342b0297317868df24b03fd98a89c66f5cd1897829d73",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-new-tab-refused.json b/mobile/rpc-foundation/goldens/settings-new-tab-refused.json
index db4b7068a28..2813bd01976 100644
--- a/mobile/rpc-foundation/goldens/settings-new-tab-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-new-tab-refused.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "b6fb40be3bb92d7d9f1a79d99dee077cf95097077917679dc99702f912241fa4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-new-tab-ssh.json b/mobile/rpc-foundation/goldens/settings-new-tab-ssh.json
index e5f503b4496..baedb315e7f 100644
--- a/mobile/rpc-foundation/goldens/settings-new-tab-ssh.json
+++ b/mobile/rpc-foundation/goldens/settings-new-tab-ssh.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "31f8a348322551738b14207b3477bae492d48d45c5d51be4d97ffaca2fe2b6e1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-new-tab-transport-error.json b/mobile/rpc-foundation/goldens/settings-new-tab-transport-error.json
index 9a233b4e14d..e115ecf0963 100644
--- a/mobile/rpc-foundation/goldens/settings-new-tab-transport-error.json
+++ b/mobile/rpc-foundation/goldens/settings-new-tab-transport-error.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "1347663aba0ada1eee8e88fac306757dc0d29fe21f0d062ac2d3968a30a2f214",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-repo-cache-expiry.json b/mobile/rpc-foundation/goldens/settings-repo-cache-expiry.json
index b0f0729e98b..7350a2bad50 100644
--- a/mobile/rpc-foundation/goldens/settings-repo-cache-expiry.json
+++ b/mobile/rpc-foundation/goldens/settings-repo-cache-expiry.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "adebd553e2648278d719a1d7299cb36683fce714682a1ab7b49d4c9027eea34e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-repo-metadata-fulfilled.json b/mobile/rpc-foundation/goldens/settings-repo-metadata-fulfilled.json
index dc687364802..292f9d4966d 100644
--- a/mobile/rpc-foundation/goldens/settings-repo-metadata-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/settings-repo-metadata-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "b45eba2007e8e2668f524cd7503b8a711eba67816c9c35af5c3725a1afe32d8d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-repo-metadata-icons.json b/mobile/rpc-foundation/goldens/settings-repo-metadata-icons.json
index b997c6ef173..d1e73111967 100644
--- a/mobile/rpc-foundation/goldens/settings-repo-metadata-icons.json
+++ b/mobile/rpc-foundation/goldens/settings-repo-metadata-icons.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "e67b645d8c4fa42e93d4cf36f45311922f7b9d9d8cc597a12f55c664d840901b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-repo-metadata-refuse-after-data.json b/mobile/rpc-foundation/goldens/settings-repo-metadata-refuse-after-data.json
index f61546b1da4..d1b7d34a7ce 100644
--- a/mobile/rpc-foundation/goldens/settings-repo-metadata-refuse-after-data.json
+++ b/mobile/rpc-foundation/goldens/settings-repo-metadata-refuse-after-data.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "b1c0b957b828c32e7ec388ec6668273fe84bbe5d11d8286b9a246fa92395a26e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-repo-metadata-refused.json b/mobile/rpc-foundation/goldens/settings-repo-metadata-refused.json
index be0e2a7a88d..6c6cae9931b 100644
--- a/mobile/rpc-foundation/goldens/settings-repo-metadata-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-repo-metadata-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "867b6905c8a533ddd1c7c8174bf4aadd5fd725cc72bdddbcb2ea8af26e219078",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-repo-metadata-single-host.json b/mobile/rpc-foundation/goldens/settings-repo-metadata-single-host.json
index 55462267d0b..271ac3adce1 100644
--- a/mobile/rpc-foundation/goldens/settings-repo-metadata-single-host.json
+++ b/mobile/rpc-foundation/goldens/settings-repo-metadata-single-host.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "d8a00a72849f1ed254c3b35ebcc330dd1bb15b189f006bd1517853a19e53de6c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-repo-metadata-transport-error.json b/mobile/rpc-foundation/goldens/settings-repo-metadata-transport-error.json
index 50648ed2444..60952605b79 100644
--- a/mobile/rpc-foundation/goldens/settings-repo-metadata-transport-error.json
+++ b/mobile/rpc-foundation/goldens/settings-repo-metadata-transport-error.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "741db13a84dbcec2e97e80605d742e69558954657c72f8450f3f8bc177dd01b6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-resume-metadata-fulfilled.json b/mobile/rpc-foundation/goldens/settings-resume-metadata-fulfilled.json
index ea7e7ed51f4..f42a846d7cd 100644
--- a/mobile/rpc-foundation/goldens/settings-resume-metadata-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/settings-resume-metadata-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "7a8d0a5305aafea56733c229989b6e825fe9b8a681f48f6cef405350304520b6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-resume-metadata-refuse-after-data.json b/mobile/rpc-foundation/goldens/settings-resume-metadata-refuse-after-data.json
index 74e0308567f..254cfa4ae3a 100644
--- a/mobile/rpc-foundation/goldens/settings-resume-metadata-refuse-after-data.json
+++ b/mobile/rpc-foundation/goldens/settings-resume-metadata-refuse-after-data.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "a11756ecaf7c2d3955b9512aa7479ca55d810341f1492f472985abb538e140e8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-resume-metadata-refused.json b/mobile/rpc-foundation/goldens/settings-resume-metadata-refused.json
index e094aed830b..d525fa843bd 100644
--- a/mobile/rpc-foundation/goldens/settings-resume-metadata-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-resume-metadata-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "def0640be601a8013f9537f161b60d8c14ac9551931e5ee4d4cc2acd3c2baf2a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-resume-metadata-transport-error.json b/mobile/rpc-foundation/goldens/settings-resume-metadata-transport-error.json
index 65041c222c2..760ce9a98f9 100644
--- a/mobile/rpc-foundation/goldens/settings-resume-metadata-transport-error.json
+++ b/mobile/rpc-foundation/goldens/settings-resume-metadata-transport-error.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "17c31d0c2b7ae5322fd59bafcfa1d2779ae9eff841e12c0cf16b27e454b49f13",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-hydration-fulfilled.json b/mobile/rpc-foundation/goldens/settings-task-hydration-fulfilled.json
index 62180dea3e3..928406393ef 100644
--- a/mobile/rpc-foundation/goldens/settings-task-hydration-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/settings-task-hydration-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "c08cce5d1f71761dbf504863b736e5546abb42b9ff4ab8ced65c7c42e3d66c0e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-hydration-refuse-after-data.json b/mobile/rpc-foundation/goldens/settings-task-hydration-refuse-after-data.json
index ff267d58d37..6108369d305 100644
--- a/mobile/rpc-foundation/goldens/settings-task-hydration-refuse-after-data.json
+++ b/mobile/rpc-foundation/goldens/settings-task-hydration-refuse-after-data.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "b23c3076081901c89e8a8fb8d20028e03f030db040c9cd793b6f2c7cd49d8f25",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-hydration-refused.json b/mobile/rpc-foundation/goldens/settings-task-hydration-refused.json
index cfb87a5fd00..f92e6cbad3f 100644
--- a/mobile/rpc-foundation/goldens/settings-task-hydration-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-task-hydration-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "a510ff7505cddbd6dad3c7e5a2dcde206a5dab1940901511d72c97aca576a6f1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-hydration-transport-error.json b/mobile/rpc-foundation/goldens/settings-task-hydration-transport-error.json
index 6807c5d4f35..e2603614171 100644
--- a/mobile/rpc-foundation/goldens/settings-task-hydration-transport-error.json
+++ b/mobile/rpc-foundation/goldens/settings-task-hydration-transport-error.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "d4a2fef3aefb78bdb4aed94fda982124f24a3af3832227654d324735f44aaeeb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-workspace-create-linear.json b/mobile/rpc-foundation/goldens/settings-task-workspace-create-linear.json
index 2a34965f516..464e6542556 100644
--- a/mobile/rpc-foundation/goldens/settings-task-workspace-create-linear.json
+++ b/mobile/rpc-foundation/goldens/settings-task-workspace-create-linear.json
@@ -3,9 +3,9 @@
   "family": "settings.task-workspace-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "662c3e04e31bce5757f09f91e3e3739fb9d57767b7443be4dc936705b64b1432",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-workspace-create-pr-start-point.json b/mobile/rpc-foundation/goldens/settings-task-workspace-create-pr-start-point.json
index 3ea1e4c5ff8..7cd82ce914c 100644
--- a/mobile/rpc-foundation/goldens/settings-task-workspace-create-pr-start-point.json
+++ b/mobile/rpc-foundation/goldens/settings-task-workspace-create-pr-start-point.json
@@ -3,9 +3,9 @@
   "family": "settings.task-workspace-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "8ae9e1dbb32d404eac9e01f71dacf1c37497030220a8e988c0093bb7ed2d159b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-workspace-fulfilled.json b/mobile/rpc-foundation/goldens/settings-task-workspace-fulfilled.json
index ba74e7357c6..56bb1d7c73c 100644
--- a/mobile/rpc-foundation/goldens/settings-task-workspace-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/settings-task-workspace-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.task-workspace",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "5c4c890e4c71e80fa8847a5e29700fc9df3ac3bd634bad6289db37522fadd621",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-workspace-refused.json b/mobile/rpc-foundation/goldens/settings-task-workspace-refused.json
index e9d7012313c..68285f62b12 100644
--- a/mobile/rpc-foundation/goldens/settings-task-workspace-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-task-workspace-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.task-workspace",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "a699a0a5b128fa422dab0c7557b5aa18599b2d23fa6685cdcc02e17edf328af1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-workspace-transport-error.json b/mobile/rpc-foundation/goldens/settings-task-workspace-transport-error.json
index f685e79296b..ee7120657c8 100644
--- a/mobile/rpc-foundation/goldens/settings-task-workspace-transport-error.json
+++ b/mobile/rpc-foundation/goldens/settings-task-workspace-transport-error.json
@@ -3,9 +3,9 @@
   "family": "settings.task-workspace",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "a5e812cd508826b3f01ec3798c621ab4303de6536a364113f01a4770dd197bb5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-write.json b/mobile/rpc-foundation/goldens/settings-task-write.json
index 71a64a2a3ba..1f0608c5c8d 100644
--- a/mobile/rpc-foundation/goldens/settings-task-write.json
+++ b/mobile/rpc-foundation/goldens/settings-task-write.json
@@ -3,9 +3,9 @@
   "family": "settings-best-effort",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "bbcdefe16b07068a81f3c46ae60df01ccb0fbe5a7c1eade3f584f6f0130c23fe",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-workspace-context-fulfilled.json b/mobile/rpc-foundation/goldens/settings-workspace-context-fulfilled.json
index b42f534066e..6ae267a2311 100644
--- a/mobile/rpc-foundation/goldens/settings-workspace-context-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/settings-workspace-context-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": ["new-workspace-runtime-context-null-results-degrade-to-absent"],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "287f94e469548f28c9d5591ff6ffb916fa22caa18776b091542b75704c9e1fee",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-workspace-context-refuse-after-data.json b/mobile/rpc-foundation/goldens/settings-workspace-context-refuse-after-data.json
index 00a8984496c..b4f8655e2dd 100644
--- a/mobile/rpc-foundation/goldens/settings-workspace-context-refuse-after-data.json
+++ b/mobile/rpc-foundation/goldens/settings-workspace-context-refuse-after-data.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "76793a56e7b9e596d8c42e9a5a1c47337db32d7437bec2e41d6e7253943f3fd8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-workspace-context-refused.json b/mobile/rpc-foundation/goldens/settings-workspace-context-refused.json
index 215cb1d8881..808294a091c 100644
--- a/mobile/rpc-foundation/goldens/settings-workspace-context-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-workspace-context-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": ["new-workspace-runtime-context-null-results-degrade-to-absent"],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "ad19fc24973b49ee7d14bc31460a7e4af5d207db6a2375b52b5a0aa878e09205",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-workspace-context-transport-error.json b/mobile/rpc-foundation/goldens/settings-workspace-context-transport-error.json
index fa2385e06f3..9af04fed292 100644
--- a/mobile/rpc-foundation/goldens/settings-workspace-context-transport-error.json
+++ b/mobile/rpc-foundation/goldens/settings-workspace-context-transport-error.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": ["new-workspace-runtime-context-null-results-degrade-to-absent"],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "a2c80c9cdbb631f3a8fa648dfbb9e691418467d6ead8fe769d72e7e1d8b552b4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-workspace-submit-fulfilled.json b/mobile/rpc-foundation/goldens/settings-workspace-submit-fulfilled.json
index f0a607571da..cc03b5aee27 100644
--- a/mobile/rpc-foundation/goldens/settings-workspace-submit-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/settings-workspace-submit-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-submit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "b10ff86086c134284cb0446e8857cd4b55f5ff2bd0507388ec659a95f25e2a19",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-workspace-submit-refused.json b/mobile/rpc-foundation/goldens/settings-workspace-submit-refused.json
index 1cf69e05d5e..7b326ea94ae 100644
--- a/mobile/rpc-foundation/goldens/settings-workspace-submit-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-workspace-submit-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-submit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "373ea3743dac4e0845df01d5c8f75c909563b8c517f3858293a478234dc9ca5c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-workspace-submit-transport-error.json b/mobile/rpc-foundation/goldens/settings-workspace-submit-transport-error.json
index 7f91a10f10e..68b39374e33 100644
--- a/mobile/rpc-foundation/goldens/settings-workspace-submit-transport-error.json
+++ b/mobile/rpc-foundation/goldens/settings-workspace-submit-transport-error.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-submit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "dfbacbd6392ae8e8199550952fe917e7c01182349df6c99a06eb0682cfd9175c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-audio-chunk-acknowledged.json b/mobile/rpc-foundation/goldens/speech-audio-chunk-acknowledged.json
index c2d497c7879..3590e03e681 100644
--- a/mobile/rpc-foundation/goldens/speech-audio-chunk-acknowledged.json
+++ b/mobile/rpc-foundation/goldens/speech-audio-chunk-acknowledged.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-chunk",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "08b583790d858a4cb7cf7377126818b6d05766c02587343ec89a167f94094082",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-desktop-start-fulfilled.json b/mobile/rpc-foundation/goldens/speech-desktop-start-fulfilled.json
index 8307603fe4f..352286ecccb 100644
--- a/mobile/rpc-foundation/goldens/speech-desktop-start-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/speech-desktop-start-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-start",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "35fadd03f2c98344e22d6aec2dc85ad15ca5ac8e092fc1c29a20366db5d46628",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-desktop-start-recording-failed.json b/mobile/rpc-foundation/goldens/speech-desktop-start-recording-failed.json
index d24e8de8512..846cb5ba35f 100644
--- a/mobile/rpc-foundation/goldens/speech-desktop-start-recording-failed.json
+++ b/mobile/rpc-foundation/goldens/speech-desktop-start-recording-failed.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-start",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "75b8d1b7ed98b2bf7420986958d0a36222b007c535f85c1308b534301241ec2d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-desktop-start-superseded.json b/mobile/rpc-foundation/goldens/speech-desktop-start-superseded.json
index 741ac4f99e8..f197196e47d 100644
--- a/mobile/rpc-foundation/goldens/speech-desktop-start-superseded.json
+++ b/mobile/rpc-foundation/goldens/speech-desktop-start-superseded.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-start",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "b1c4a6d6c94d54fb5f60eb2deb437562ededd724140dd3973d842d7c29bf1a60",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-dictation-session-cancelled.json b/mobile/rpc-foundation/goldens/speech-dictation-session-cancelled.json
index 6299878ffcb..9757102aa41 100644
--- a/mobile/rpc-foundation/goldens/speech-dictation-session-cancelled.json
+++ b/mobile/rpc-foundation/goldens/speech-dictation-session-cancelled.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-session",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "5fe007d384731f954e086c16886055722fab45bafac23f4c4d52f0bb1f47acc9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-dictation-session-transcript.json b/mobile/rpc-foundation/goldens/speech-dictation-session-transcript.json
index e477eb722b8..1fd8f76ae1c 100644
--- a/mobile/rpc-foundation/goldens/speech-dictation-session-transcript.json
+++ b/mobile/rpc-foundation/goldens/speech-dictation-session-transcript.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-session",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "cd3be6291ce181c4acfd7bacc0a8380f296fa5db13a52c4c0fcd75cfff3ae7d6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-setup-sheet-denied-to-mobile.json b/mobile/rpc-foundation/goldens/speech-setup-sheet-denied-to-mobile.json
index 106fe857887..a3fbed59688 100644
--- a/mobile/rpc-foundation/goldens/speech-setup-sheet-denied-to-mobile.json
+++ b/mobile/rpc-foundation/goldens/speech-setup-sheet-denied-to-mobile.json
@@ -3,9 +3,9 @@
   "family": "speech.setup-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "69c1c20ea667a2b6a5b53aeb3d9af11b2b707e04086e15ee4ff9e954b1701851",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-setup-sheet-fulfilled.json b/mobile/rpc-foundation/goldens/speech-setup-sheet-fulfilled.json
index ff286fa6fbc..9ea8c77bf1b 100644
--- a/mobile/rpc-foundation/goldens/speech-setup-sheet-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/speech-setup-sheet-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "speech.setup-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "748e1bc0575fca6baab51b19cbbea5ac6185fca2a15dc4d8577212134355cd7e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-setup-sheet-legacy-desktop.json b/mobile/rpc-foundation/goldens/speech-setup-sheet-legacy-desktop.json
index 0425cba1fba..93b3668d75c 100644
--- a/mobile/rpc-foundation/goldens/speech-setup-sheet-legacy-desktop.json
+++ b/mobile/rpc-foundation/goldens/speech-setup-sheet-legacy-desktop.json
@@ -3,9 +3,9 @@
   "family": "speech.setup-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "0ba2d8283fe98206c7500b62732e30acdc5b8e55f50b7ea8cae96403b803d519",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-setup-sheet-model-vocabulary.json b/mobile/rpc-foundation/goldens/speech-setup-sheet-model-vocabulary.json
index bff7d93129f..f0b5ba17c0a 100644
--- a/mobile/rpc-foundation/goldens/speech-setup-sheet-model-vocabulary.json
+++ b/mobile/rpc-foundation/goldens/speech-setup-sheet-model-vocabulary.json
@@ -3,9 +3,9 @@
   "family": "speech.setup-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "88e563aa087955b9ef6447b7e73711f90d5befb7c082270da58695c3a7169e67",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/structured-agent-session-created.json b/mobile/rpc-foundation/goldens/structured-agent-session-created.json
index 5d60c2f0636..17e1d6d7118 100644
--- a/mobile/rpc-foundation/goldens/structured-agent-session-created.json
+++ b/mobile/rpc-foundation/goldens/structured-agent-session-created.json
@@ -3,9 +3,9 @@
   "family": "agentSession.structured-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d340697a64a198066b1037a550afb9a0de7507246a545901d2fc0a23407f38d6",
   "scenarioSha256": "6e2d1633645a3072241729328cc71ea2979533d28797c14de86c8b3457ac018a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/structured-launch-created.json b/mobile/rpc-foundation/goldens/structured-launch-created.json
index df40cd82f89..c52cca577cf 100644
--- a/mobile/rpc-foundation/goldens/structured-launch-created.json
+++ b/mobile/rpc-foundation/goldens/structured-launch-created.json
@@ -3,9 +3,9 @@
   "family": "agentSession.structured-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d340697a64a198066b1037a550afb9a0de7507246a545901d2fc0a23407f38d6",
   "scenarioSha256": "0b5dd55868490e4d62d7d718821dec9634773b20d32fe9889523606a3f6b9168",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/structured-launch-definitive-refusal.json b/mobile/rpc-foundation/goldens/structured-launch-definitive-refusal.json
index 696e6f49e60..94bb37d7e69 100644
--- a/mobile/rpc-foundation/goldens/structured-launch-definitive-refusal.json
+++ b/mobile/rpc-foundation/goldens/structured-launch-definitive-refusal.json
@@ -3,9 +3,9 @@
   "family": "agentSession.structured-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d340697a64a198066b1037a550afb9a0de7507246a545901d2fc0a23407f38d6",
   "scenarioSha256": "64916f2d8ab51132b08c3e8c72f89c3a2698d83945def294f42edf22eb6d08ea",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/structured-launch-replays-dropped-create.json b/mobile/rpc-foundation/goldens/structured-launch-replays-dropped-create.json
index 33bcaa6115d..8401e5555de 100644
--- a/mobile/rpc-foundation/goldens/structured-launch-replays-dropped-create.json
+++ b/mobile/rpc-foundation/goldens/structured-launch-replays-dropped-create.json
@@ -3,9 +3,9 @@
   "family": "agentSession.structured-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d340697a64a198066b1037a550afb9a0de7507246a545901d2fc0a23407f38d6",
   "scenarioSha256": "fb1ab1209f0a7c03ee1b3985401ce2df080d673532f045c4fca26e754d5e5a9f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/structured-launch-support-refused.json b/mobile/rpc-foundation/goldens/structured-launch-support-refused.json
index 1be64c3c39c..d4523cb4292 100644
--- a/mobile/rpc-foundation/goldens/structured-launch-support-refused.json
+++ b/mobile/rpc-foundation/goldens/structured-launch-support-refused.json
@@ -3,9 +3,9 @@
   "family": "agentSession.structured-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d340697a64a198066b1037a550afb9a0de7507246a545901d2fc0a23407f38d6",
   "scenarioSha256": "d8928461e3295d265872e5f98fb8aad445b5edc55fc76f137e45c0cff0d8b961",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/structured-launch-unsupported.json b/mobile/rpc-foundation/goldens/structured-launch-unsupported.json
index 9561d241024..4458dcdea72 100644
--- a/mobile/rpc-foundation/goldens/structured-launch-unsupported.json
+++ b/mobile/rpc-foundation/goldens/structured-launch-unsupported.json
@@ -3,9 +3,9 @@
   "family": "agentSession.structured-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d340697a64a198066b1037a550afb9a0de7507246a545901d2fc0a23407f38d6",
   "scenarioSha256": "c30e9cae49e134715c009a98f423f3e4a9d552c014be3e28b38e98c57999b6f5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tasks-route-repo-list.json b/mobile/rpc-foundation/goldens/tasks-route-repo-list.json
index 7d8a8cd156a..bd0aa55d946 100644
--- a/mobile/rpc-foundation/goldens/tasks-route-repo-list.json
+++ b/mobile/rpc-foundation/goldens/tasks-route-repo-list.json
@@ -3,9 +3,9 @@
   "family": "tasks.route-repo-list",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "23f974df8b57c723069605de1db80c339ead286b18aae38e67fce03ea50c5180",
   "scenarioSha256": "b62ca571d4defcc2e53960033c5b4eb3f7e406b57664664cbc6a173041a9f803",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/terminal-gesture-flush-and-clear.json b/mobile/rpc-foundation/goldens/terminal-gesture-flush-and-clear.json
index c4a2a11cf68..536d8405000 100644
--- a/mobile/rpc-foundation/goldens/terminal-gesture-flush-and-clear.json
+++ b/mobile/rpc-foundation/goldens/terminal-gesture-flush-and-clear.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-gesture-input",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9d119d5ec320e2538105d6ff673b9f4b8e3decbe46527947489dffbcf2ac0472",
   "scenarioSha256": "97e6d63c6b4bc154e94be6cf3dcd25620b4656cacd2b62cdc872ff793b39ebd2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/terminal-input-send-accepted.json b/mobile/rpc-foundation/goldens/terminal-input-send-accepted.json
index 91700ea1d92..434cecfbb9a 100644
--- a/mobile/rpc-foundation/goldens/terminal-input-send-accepted.json
+++ b/mobile/rpc-foundation/goldens/terminal-input-send-accepted.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-input-send",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "7cdbf3308411ed6764cc1cdcc0f663a27ddc9390fcc329c49fad4b27cb5a7fd5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/terminal-input-send-refused.json b/mobile/rpc-foundation/goldens/terminal-input-send-refused.json
index 46c68490946..24362f5c32b 100644
--- a/mobile/rpc-foundation/goldens/terminal-input-send-refused.json
+++ b/mobile/rpc-foundation/goldens/terminal-input-send-refused.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-input-send",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "eb5e47e3accccc7ca280ca029f97405905b0cee8a05afb9ef15448314041d9d4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/terminal-live-input-accepted.json b/mobile/rpc-foundation/goldens/terminal-live-input-accepted.json
index 7d875896d7d..28acf9e76a2 100644
--- a/mobile/rpc-foundation/goldens/terminal-live-input-accepted.json
+++ b/mobile/rpc-foundation/goldens/terminal-live-input-accepted.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-input-send",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "391a4f681443f099e6ea4417811d82d730242dfe07e21f74b0ad49a98bcd7c81",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/terminal-paste-accepted.json b/mobile/rpc-foundation/goldens/terminal-paste-accepted.json
index aabbf942a92..8e3f4d5d15e 100644
--- a/mobile/rpc-foundation/goldens/terminal-paste-accepted.json
+++ b/mobile/rpc-foundation/goldens/terminal-paste-accepted.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "48bb495de3b54f2b2edc0543f0f232ff4fd6068d5aca34d005766ebacbb078c9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/terminal-paste-refused.json b/mobile/rpc-foundation/goldens/terminal-paste-refused.json
index 1f7d903274e..fddeb22da33 100644
--- a/mobile/rpc-foundation/goldens/terminal-paste-refused.json
+++ b/mobile/rpc-foundation/goldens/terminal-paste-refused.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "78e62b9125252accc7f6d2ce772b93c84a917b01d2df308c1f9fb163d9127665",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/terminal-query-reply-accepted.json b/mobile/rpc-foundation/goldens/terminal-query-reply-accepted.json
index 94bdf013b06..dcc7aab9662 100644
--- a/mobile/rpc-foundation/goldens/terminal-query-reply-accepted.json
+++ b/mobile/rpc-foundation/goldens/terminal-query-reply-accepted.json
@@ -3,10 +3,10 @@
   "family": "terminal.query-reply",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "bfa1d5f83b4112d3cce6a19e9dc27daf9281ed99745bc01bd19226dd7b268c71",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/terminal-query-reply-unsubscribed.json b/mobile/rpc-foundation/goldens/terminal-query-reply-unsubscribed.json
index 789e2b44de5..5c1f3a899e9 100644
--- a/mobile/rpc-foundation/goldens/terminal-query-reply-unsubscribed.json
+++ b/mobile/rpc-foundation/goldens/terminal-query-reply-unsubscribed.json
@@ -3,10 +3,10 @@
   "family": "terminal.query-reply",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "ad03596f31eeccc5e9eb7e5061b1af705f9af249f76377c8f5ce1a9db257770f",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/terminal-raw-input-refused.json b/mobile/rpc-foundation/goldens/terminal-raw-input-refused.json
index d11759056dd..42697f3a237 100644
--- a/mobile/rpc-foundation/goldens/terminal-raw-input-refused.json
+++ b/mobile/rpc-foundation/goldens/terminal-raw-input-refused.json
@@ -3,10 +3,10 @@
   "family": "terminal.raw-input",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "76fc0c1499ec48a67428f35eba705f68147d2ff2c344b67aa0c9d60ed999f173",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/terminal-raw-input-reported.json b/mobile/rpc-foundation/goldens/terminal-raw-input-reported.json
index c880b3e511d..0e781f862e8 100644
--- a/mobile/rpc-foundation/goldens/terminal-raw-input-reported.json
+++ b/mobile/rpc-foundation/goldens/terminal-raw-input-reported.json
@@ -3,10 +3,10 @@
   "family": "terminal.raw-input",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "579077efd3a4652a6930af3f6690138c20536270cbcd7274246047d2e322199f",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/terminal-takeover-report-accepted.json b/mobile/rpc-foundation/goldens/terminal-takeover-report-accepted.json
index d493105fc81..eb21fb61e3a 100644
--- a/mobile/rpc-foundation/goldens/terminal-takeover-report-accepted.json
+++ b/mobile/rpc-foundation/goldens/terminal-takeover-report-accepted.json
@@ -3,10 +3,10 @@
   "family": "terminal.takeover-report",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "c2236257032fab72ebb007391313eec4e5f0a1bdb4fbcbd907117f9914ffafc6",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/terminal-takeover-report-retried.json b/mobile/rpc-foundation/goldens/terminal-takeover-report-retried.json
index c5806ead0e4..64099032f26 100644
--- a/mobile/rpc-foundation/goldens/terminal-takeover-report-retried.json
+++ b/mobile/rpc-foundation/goldens/terminal-takeover-report-retried.json
@@ -3,10 +3,10 @@
   "family": "terminal.takeover-report",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "8ad436ca6c3de8b0b3148326337acce18a8a4cf3c514acad1a4530a001f28c75",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/terminal-viewport-refit-applied.json b/mobile/rpc-foundation/goldens/terminal-viewport-refit-applied.json
index b290f9f9b8d..13c2cb03d22 100644
--- a/mobile/rpc-foundation/goldens/terminal-viewport-refit-applied.json
+++ b/mobile/rpc-foundation/goldens/terminal-viewport-refit-applied.json
@@ -3,10 +3,10 @@
   "family": "terminal.viewport-refit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "f966c2ef2e747a5231f423147ddaf38458cb08c719434b274016a5e4abc10771",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/terminal-viewport-refit-legacy-desktop.json b/mobile/rpc-foundation/goldens/terminal-viewport-refit-legacy-desktop.json
index 331c5c4639d..bbe8d0d1f0f 100644
--- a/mobile/rpc-foundation/goldens/terminal-viewport-refit-legacy-desktop.json
+++ b/mobile/rpc-foundation/goldens/terminal-viewport-refit-legacy-desktop.json
@@ -3,10 +3,10 @@
   "family": "terminal.viewport-refit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "88961a369cb7a7fa92708bb83aa7f818e904018e8cfcedc2f50ef9a0058c8b9d",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/terminal-worktree-connection-resolved.json b/mobile/rpc-foundation/goldens/terminal-worktree-connection-resolved.json
index c72ebf8f1d7..81be7c0da07 100644
--- a/mobile/rpc-foundation/goldens/terminal-worktree-connection-resolved.json
+++ b/mobile/rpc-foundation/goldens/terminal-worktree-connection-resolved.json
@@ -3,9 +3,9 @@
   "family": "session.worktree-connection",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "f921c4a764cdf7a4c1df0a7ec618d7c3b1d8a05ee4baa42d66f3bc0d95b3f550",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-create-github.json b/mobile/rpc-foundation/goldens/tk-create-github.json
index 969875bcbdf..67c6ab4317d 100644
--- a/mobile/rpc-foundation/goldens/tk-create-github.json
+++ b/mobile/rpc-foundation/goldens/tk-create-github.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-create-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "260a84280f69c43ac582149d9befe6ae547b2ad2b5f56a181d8e3a1314a0a071",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-create-gitlab.json b/mobile/rpc-foundation/goldens/tk-create-gitlab.json
index 753e5c53626..0af3694de2a 100644
--- a/mobile/rpc-foundation/goldens/tk-create-gitlab.json
+++ b/mobile/rpc-foundation/goldens/tk-create-gitlab.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-create-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "a4d3d1f322d49593056bd20f4122bbf0309d2161123e404161950bcab65decd5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-create-linear.json b/mobile/rpc-foundation/goldens/tk-create-linear.json
index d172b04bae3..d1556e4b793 100644
--- a/mobile/rpc-foundation/goldens/tk-create-linear.json
+++ b/mobile/rpc-foundation/goldens/tk-create-linear.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-create-linear",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "f6c7eea985190d9edeead5b36f90c8aa98679f69d19dab7579fec88841645259",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-checks-files.json b/mobile/rpc-foundation/goldens/tk-item-checks-files.json
index ec06bcba8e5..eb40bd98427 100644
--- a/mobile/rpc-foundation/goldens/tk-item-checks-files.json
+++ b/mobile/rpc-foundation/goldens/tk-item-checks-files.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-checks-files",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "644a27c1e3fa6bfa73c7822c2949e9534508e5e3a996b0e8e56be6326658d123",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-comment-github.json b/mobile/rpc-foundation/goldens/tk-item-comment-github.json
index 27e92a3bdc8..1425a7a620d 100644
--- a/mobile/rpc-foundation/goldens/tk-item-comment-github.json
+++ b/mobile/rpc-foundation/goldens/tk-item-comment-github.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-comment-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "fb0cdff9e02bac37b0bd8e1c47922474823d46fa735f3069ed70cdad41800be6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-comment-gitlab-mr.json b/mobile/rpc-foundation/goldens/tk-item-comment-gitlab-mr.json
index eebecb33fcb..e261e47f965 100644
--- a/mobile/rpc-foundation/goldens/tk-item-comment-gitlab-mr.json
+++ b/mobile/rpc-foundation/goldens/tk-item-comment-gitlab-mr.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-comment-gitlab-mr",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "cb696d402b8af2b9a54d4d6f9d85abfc12280e73b360196e55ec25530e610eee",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-comment-gitlab.json b/mobile/rpc-foundation/goldens/tk-item-comment-gitlab.json
index 7ce78c1ff5d..5b4ee99c8d4 100644
--- a/mobile/rpc-foundation/goldens/tk-item-comment-gitlab.json
+++ b/mobile/rpc-foundation/goldens/tk-item-comment-gitlab.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-comment-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "d993b9f74cf8c5d7af8d31a73cf19d97141c54f6fcf009e98ca5b9106f3ba35b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-detail-github-reactions.json b/mobile/rpc-foundation/goldens/tk-item-detail-github-reactions.json
index 674754d664b..d4ab810f27e 100644
--- a/mobile/rpc-foundation/goldens/tk-item-detail-github-reactions.json
+++ b/mobile/rpc-foundation/goldens/tk-item-detail-github-reactions.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c0ef16b959002e4a3c5347114a0844b95670e274ef010d910b6671ac5f49e783",
   "scenarioSha256": "885dafb68162f5777fc050af34dbe3443940d041a45bfb18c51dfcf433ed54f3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-detail-github.json b/mobile/rpc-foundation/goldens/tk-item-detail-github.json
index 2f1699e8605..07f4e4167ff 100644
--- a/mobile/rpc-foundation/goldens/tk-item-detail-github.json
+++ b/mobile/rpc-foundation/goldens/tk-item-detail-github.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c0ef16b959002e4a3c5347114a0844b95670e274ef010d910b6671ac5f49e783",
   "scenarioSha256": "5fbff075d7da476f93c2a7da871c2afacc67822d1317acf6c23000195e2b2576",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-detail-gitlab-reactions.json b/mobile/rpc-foundation/goldens/tk-item-detail-gitlab-reactions.json
index 218d36d017e..a6c42c83294 100644
--- a/mobile/rpc-foundation/goldens/tk-item-detail-gitlab-reactions.json
+++ b/mobile/rpc-foundation/goldens/tk-item-detail-gitlab-reactions.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c0ef16b959002e4a3c5347114a0844b95670e274ef010d910b6671ac5f49e783",
   "scenarioSha256": "c49d2df6c31f37c488ce9d29a801dd8ad0aa668ae380fc60b1f790ef508281d8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-detail-gitlab.json b/mobile/rpc-foundation/goldens/tk-item-detail-gitlab.json
index e042a1e2541..f15be67bf48 100644
--- a/mobile/rpc-foundation/goldens/tk-item-detail-gitlab.json
+++ b/mobile/rpc-foundation/goldens/tk-item-detail-gitlab.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c0ef16b959002e4a3c5347114a0844b95670e274ef010d910b6671ac5f49e783",
   "scenarioSha256": "36bbd34ed8b8f67e516ce7cd230b01ab88f14369fda632037c46dbbd1a0d95a3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-detail-linear.json b/mobile/rpc-foundation/goldens/tk-item-detail-linear.json
index 0a78825be4f..6a510812101 100644
--- a/mobile/rpc-foundation/goldens/tk-item-detail-linear.json
+++ b/mobile/rpc-foundation/goldens/tk-item-detail-linear.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-linear",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c0ef16b959002e4a3c5347114a0844b95670e274ef010d910b6671ac5f49e783",
   "scenarioSha256": "f0407adc774b29553bdd177885e8ea9047127c4ebe8298de160a421fb4c1fe67",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-detail-metadata.json b/mobile/rpc-foundation/goldens/tk-item-detail-metadata.json
index eb5795fd9ef..aea175188d1 100644
--- a/mobile/rpc-foundation/goldens/tk-item-detail-metadata.json
+++ b/mobile/rpc-foundation/goldens/tk-item-detail-metadata.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "58ea1553e04017c993aea4753aace41ee664705a3fdb3b18569c5a9d7968cf06",
   "scenarioSha256": "e6429c235d8c0b0376f71fea7b47c3b9ff22b850c92922b85ff993ae8b6cd6d0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-merge-gitlab.json b/mobile/rpc-foundation/goldens/tk-item-merge-gitlab.json
index 35f5ffe48ff..b4de86e9f23 100644
--- a/mobile/rpc-foundation/goldens/tk-item-merge-gitlab.json
+++ b/mobile/rpc-foundation/goldens/tk-item-merge-gitlab.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-merge-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "28d8dfb15fec1ecaaa1c675c9c8c0cdc196e184a6884625c44dfe1f0f9fc8e7e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-metadata-github.json b/mobile/rpc-foundation/goldens/tk-item-metadata-github.json
index 26e800449ad..faf64e71b55 100644
--- a/mobile/rpc-foundation/goldens/tk-item-metadata-github.json
+++ b/mobile/rpc-foundation/goldens/tk-item-metadata-github.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-metadata-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "010c65eaa056c5df0b867dd5b5851e206e8479e9fcce02515f1e326df4b8889c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-metadata-gitlab-mr.json b/mobile/rpc-foundation/goldens/tk-item-metadata-gitlab-mr.json
index 704d38dffd5..898bb1783b5 100644
--- a/mobile/rpc-foundation/goldens/tk-item-metadata-gitlab-mr.json
+++ b/mobile/rpc-foundation/goldens/tk-item-metadata-gitlab-mr.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-metadata-gitlab-mr",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "daa54da6cfb8d96c2a66c138beeaf70c764f96a60bdc84f2ff4cde80483cb365",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-metadata-gitlab.json b/mobile/rpc-foundation/goldens/tk-item-metadata-gitlab.json
index 49945027d90..9ed746026c5 100644
--- a/mobile/rpc-foundation/goldens/tk-item-metadata-gitlab.json
+++ b/mobile/rpc-foundation/goldens/tk-item-metadata-gitlab.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-metadata-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "4daf374f040e27836c154245d6a7fbad9ba3f6e6c0c9608218451286e4712d6b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-reply-merge.json b/mobile/rpc-foundation/goldens/tk-item-reply-merge.json
index 67c9d74b9f9..333d9665d6e 100644
--- a/mobile/rpc-foundation/goldens/tk-item-reply-merge.json
+++ b/mobile/rpc-foundation/goldens/tk-item-reply-merge.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-reply-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "b8e60092a29ea4944a891adc026444cc1da18c52221876f9e7c07b450b34cea8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-review-github.json b/mobile/rpc-foundation/goldens/tk-item-review-github.json
index f07d5d2b92d..e9b0b8bd591 100644
--- a/mobile/rpc-foundation/goldens/tk-item-review-github.json
+++ b/mobile/rpc-foundation/goldens/tk-item-review-github.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-review-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "3ba358ff7b6a95d9158257225483f77578dfa10c8643cdf89f8a81e0022997e9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-status-gitlab-mr.json b/mobile/rpc-foundation/goldens/tk-item-status-gitlab-mr.json
index 0e1b880d1f9..a9f34788ca0 100644
--- a/mobile/rpc-foundation/goldens/tk-item-status-gitlab-mr.json
+++ b/mobile/rpc-foundation/goldens/tk-item-status-gitlab-mr.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-status-gitlab-mr",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "5de4936aed0efd0d8bd5bc5ce893d561f6bc3d0fdf4a76c9e33e7cbefd6ec362",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-status-gitlab.json b/mobile/rpc-foundation/goldens/tk-item-status-gitlab.json
index c8f28d2c37b..99a9c8f3508 100644
--- a/mobile/rpc-foundation/goldens/tk-item-status-gitlab.json
+++ b/mobile/rpc-foundation/goldens/tk-item-status-gitlab.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-status-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "85414544a9e8570567770b43e6bf5cfcc406c9b9b4ffed3a4ff0c8187beb7549",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-linear-connect.json b/mobile/rpc-foundation/goldens/tk-linear-connect.json
index b095658355e..26b55231196 100644
--- a/mobile/rpc-foundation/goldens/tk-linear-connect.json
+++ b/mobile/rpc-foundation/goldens/tk-linear-connect.json
@@ -3,9 +3,9 @@
   "family": "tasks.linear-connect",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "d1bd7ad9b647a50403953ba01d3a4bcccc5f4020c2aefa6146cca8c7688612c1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-linear-item.json b/mobile/rpc-foundation/goldens/tk-linear-item.json
index 1e99002b8ca..b66888f3ad7 100644
--- a/mobile/rpc-foundation/goldens/tk-linear-item.json
+++ b/mobile/rpc-foundation/goldens/tk-linear-item.json
@@ -3,9 +3,9 @@
   "family": "tasks.linear-item",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "354eaff5243b3aae774c375aa303548d82c4db106a89ada39907d6654fa549b3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-linear-team-context.json b/mobile/rpc-foundation/goldens/tk-linear-team-context.json
index 8e312e1495e..c8be6943a10 100644
--- a/mobile/rpc-foundation/goldens/tk-linear-team-context.json
+++ b/mobile/rpc-foundation/goldens/tk-linear-team-context.json
@@ -3,9 +3,9 @@
   "family": "tasks.linear-team-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "58ea1553e04017c993aea4753aace41ee664705a3fdb3b18569c5a9d7968cf06",
   "scenarioSha256": "524c2421e61d663dd1344a47ab0552c3bb029ad09e0b6271eac91f1548e8265c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-list-gitlab-items.json b/mobile/rpc-foundation/goldens/tk-list-gitlab-items.json
index 55926ae5990..a37d60ee891 100644
--- a/mobile/rpc-foundation/goldens/tk-list-gitlab-items.json
+++ b/mobile/rpc-foundation/goldens/tk-list-gitlab-items.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-list-gitlab-items",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "9b26b8f112021fe65c156b7d4067071551bcdab44a5858f8a933f7ace66e6f80",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-list-gitlab-todos.json b/mobile/rpc-foundation/goldens/tk-list-gitlab-todos.json
index a43523684f5..0e2da3bbda5 100644
--- a/mobile/rpc-foundation/goldens/tk-list-gitlab-todos.json
+++ b/mobile/rpc-foundation/goldens/tk-list-gitlab-todos.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-list-gitlab-todos",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "ba91378284c5dc3dc470f0601e4ff0202622a8d1fb97f27ab45c096d65c0bb48",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-list-linear.json b/mobile/rpc-foundation/goldens/tk-list-linear.json
index 8e138fdb809..4c6b0faca0b 100644
--- a/mobile/rpc-foundation/goldens/tk-list-linear.json
+++ b/mobile/rpc-foundation/goldens/tk-list-linear.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-list-linear",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "216ddbf8cb71481d179563d8b033d7dc6cd71bface049e83073b977909776fc9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-board-load.json b/mobile/rpc-foundation/goldens/tk-project-board-load.json
index a1f725899da..9d9f0580422 100644
--- a/mobile/rpc-foundation/goldens/tk-project-board-load.json
+++ b/mobile/rpc-foundation/goldens/tk-project-board-load.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-board-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c4272385ed3b0de4feab38de9e4f6363ecd6317fdd4de47f76a98eb18abaf371",
   "scenarioSha256": "7840e811e81d3645f1c874b871158202a53432989f3b5c849df12550b082813b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-repo-slugs.json b/mobile/rpc-foundation/goldens/tk-project-repo-slugs.json
index 5952c14acb2..a90963ab6af 100644
--- a/mobile/rpc-foundation/goldens/tk-project-repo-slugs.json
+++ b/mobile/rpc-foundation/goldens/tk-project-repo-slugs.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-repo-slugs",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c4272385ed3b0de4feab38de9e4f6363ecd6317fdd4de47f76a98eb18abaf371",
   "scenarioSha256": "a83d5768892764af2dd6866f03d51c09aef63d1c5d3e0645bd5e1c16454b201f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-row-comments-issue.json b/mobile/rpc-foundation/goldens/tk-project-row-comments-issue.json
index 0f1d2ded429..6572d173cb2 100644
--- a/mobile/rpc-foundation/goldens/tk-project-row-comments-issue.json
+++ b/mobile/rpc-foundation/goldens/tk-project-row-comments-issue.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-comments-issue",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "6f1bfb05a9df6482200bbab4400fd07a09955d47fcc468e1d2feda1ca9875aa1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-row-comments-pr.json b/mobile/rpc-foundation/goldens/tk-project-row-comments-pr.json
index 1fd772fc492..e430076d972 100644
--- a/mobile/rpc-foundation/goldens/tk-project-row-comments-pr.json
+++ b/mobile/rpc-foundation/goldens/tk-project-row-comments-pr.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-comments-pr",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "e5ff558593fd32d66e6ba1722ebf54d50992c9c2b6db41ef2435b47972fbd0fd",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-row-detail.json b/mobile/rpc-foundation/goldens/tk-project-row-detail.json
index 033dd9e8f9e..1711eb53060 100644
--- a/mobile/rpc-foundation/goldens/tk-project-row-detail.json
+++ b/mobile/rpc-foundation/goldens/tk-project-row-detail.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-detail",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f8f6e5d500f959b9b15c5498885a05422747880b6aef4ad795bc3064ebbacea6",
   "scenarioSha256": "f572b37cfd15f41f283e5f96b772a1055670f80e68064ac81477d9b768fc971a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-row-fields.json b/mobile/rpc-foundation/goldens/tk-project-row-fields.json
index 10b7d9a17a5..8bf17f0b96a 100644
--- a/mobile/rpc-foundation/goldens/tk-project-row-fields.json
+++ b/mobile/rpc-foundation/goldens/tk-project-row-fields.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-fields",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "370aeaee59978071ccb821da13c9e6114936c168947b608539cdb80d40cc9889",
   "scenarioSha256": "af54a351f4b79fff4a11948fc47a9f5194733065682ff96d6b46b9ae292e327e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-row-files-merge.json b/mobile/rpc-foundation/goldens/tk-project-row-files-merge.json
index dbcaadc67b9..5fd4951068a 100644
--- a/mobile/rpc-foundation/goldens/tk-project-row-files-merge.json
+++ b/mobile/rpc-foundation/goldens/tk-project-row-files-merge.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-files-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b228732762828412ad3d9eec3ece00a897d866046e37044322c3911758d6e0a9",
   "scenarioSha256": "fef96700723edcf7d0a55ee05928a0293b8a28217b161cd3823437f3bc33b1ec",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-row-metadata-load.json b/mobile/rpc-foundation/goldens/tk-project-row-metadata-load.json
index 90e142cb754..841f3848346 100644
--- a/mobile/rpc-foundation/goldens/tk-project-row-metadata-load.json
+++ b/mobile/rpc-foundation/goldens/tk-project-row-metadata-load.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-metadata-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f8f6e5d500f959b9b15c5498885a05422747880b6aef4ad795bc3064ebbacea6",
   "scenarioSha256": "60ea389fe16734fb53db01101f1feb4496653a99faa09e4309b3790a50d558d7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-row-review-checks.json b/mobile/rpc-foundation/goldens/tk-project-row-review-checks.json
index aaed2fcc417..dca69478d78 100644
--- a/mobile/rpc-foundation/goldens/tk-project-row-review-checks.json
+++ b/mobile/rpc-foundation/goldens/tk-project-row-review-checks.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-review-checks",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "370aeaee59978071ccb821da13c9e6114936c168947b608539cdb80d40cc9889",
   "scenarioSha256": "08caec8e0ab5e674aabbf034ca88fc4a000c4b645ad6397afe6dc18db1f7c098",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-row-threads.json b/mobile/rpc-foundation/goldens/tk-project-row-threads.json
index 21beb2ebd59..ae55c763fac 100644
--- a/mobile/rpc-foundation/goldens/tk-project-row-threads.json
+++ b/mobile/rpc-foundation/goldens/tk-project-row-threads.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-threads",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "815f55c0fb848fc9345a66bb7b71b1351f17e56129e005eb1776d6b47c831647",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-provider-load.json b/mobile/rpc-foundation/goldens/tk-provider-load.json
index e22913afbc5..1e77d6ecd63 100644
--- a/mobile/rpc-foundation/goldens/tk-provider-load.json
+++ b/mobile/rpc-foundation/goldens/tk-provider-load.json
@@ -3,9 +3,9 @@
   "family": "tasks.provider-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "21b6272878cba5f2b41c89378c178933ffc9406fe69b9c693fc5021a265ef2c9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-capability-probe-cutover-reasks-fast.json b/mobile/rpc-foundation/goldens/transport-capability-probe-cutover-reasks-fast.json
index b8fe673a760..5b979d0b6ca 100644
--- a/mobile/rpc-foundation/goldens/transport-capability-probe-cutover-reasks-fast.json
+++ b/mobile/rpc-foundation/goldens/transport-capability-probe-cutover-reasks-fast.json
@@ -3,9 +3,9 @@
   "family": "transport.capability-probe",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "c5d28c2973881ae6cc94c7d8f6eef544046461f15e236634489afd272b5f1e6b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-capability-probe-non-string-capabilities-drop.json b/mobile/rpc-foundation/goldens/transport-capability-probe-non-string-capabilities-drop.json
index 731809142f5..e42b66d2244 100644
--- a/mobile/rpc-foundation/goldens/transport-capability-probe-non-string-capabilities-drop.json
+++ b/mobile/rpc-foundation/goldens/transport-capability-probe-non-string-capabilities-drop.json
@@ -3,9 +3,9 @@
   "family": "transport.capability-probe",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "95ef0a8b60bf92ef5c12a73f923dc143989b34374fb319f812fbaa58c79aa6a6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-capability-probe-publishes.json b/mobile/rpc-foundation/goldens/transport-capability-probe-publishes.json
index dd202d1a9f8..c49fb5fe798 100644
--- a/mobile/rpc-foundation/goldens/transport-capability-probe-publishes.json
+++ b/mobile/rpc-foundation/goldens/transport-capability-probe-publishes.json
@@ -3,9 +3,9 @@
   "family": "transport.capability-probe",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "6e0c3a784992e383a05ccfdf34e44e6f74ebd55ff17c4de0b05b2dfb4197c681",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-capability-probe-refused-backs-off.json b/mobile/rpc-foundation/goldens/transport-capability-probe-refused-backs-off.json
index 29beb2c1076..f722bd60b07 100644
--- a/mobile/rpc-foundation/goldens/transport-capability-probe-refused-backs-off.json
+++ b/mobile/rpc-foundation/goldens/transport-capability-probe-refused-backs-off.json
@@ -3,9 +3,9 @@
   "family": "transport.capability-probe",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "2ba1e1d70c98e2fd0d2d2dce6f68c11a186756f05207747e156375fc613940d7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-host-status-gates-drop-keeps-capabilities.json b/mobile/rpc-foundation/goldens/transport-host-status-gates-drop-keeps-capabilities.json
index 791099b5636..cf3e90bb3a6 100644
--- a/mobile/rpc-foundation/goldens/transport-host-status-gates-drop-keeps-capabilities.json
+++ b/mobile/rpc-foundation/goldens/transport-host-status-gates-drop-keeps-capabilities.json
@@ -3,9 +3,9 @@
   "family": "transport.host-status-gates",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "f25f444aca6cf768c602bf879e6b30235d1c4c0632636cfd245bd6e27959756b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-host-status-gates-ready.json b/mobile/rpc-foundation/goldens/transport-host-status-gates-ready.json
index 85652d7cf4b..85e0b192680 100644
--- a/mobile/rpc-foundation/goldens/transport-host-status-gates-ready.json
+++ b/mobile/rpc-foundation/goldens/transport-host-status-gates-ready.json
@@ -3,9 +3,9 @@
   "family": "transport.host-status-gates",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "9c5095c24bdf5ab65d6387cc22b9984fee3aa7d5ce93d96bcb470944ac253f86",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-host-status-gates-refused-degrades.json b/mobile/rpc-foundation/goldens/transport-host-status-gates-refused-degrades.json
index 74bb445d0f4..ab9d9ddb832 100644
--- a/mobile/rpc-foundation/goldens/transport-host-status-gates-refused-degrades.json
+++ b/mobile/rpc-foundation/goldens/transport-host-status-gates-refused-degrades.json
@@ -3,9 +3,9 @@
   "family": "transport.host-status-gates",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "a7871b5f1d37b0156970858d5a7fcab3105de7a8a6bfe827299a36f2b2ba5548",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-pairing-race-both-refused.json b/mobile/rpc-foundation/goldens/transport-pairing-race-both-refused.json
index 1d5145bd51e..20b3585ac75 100644
--- a/mobile/rpc-foundation/goldens/transport-pairing-race-both-refused.json
+++ b/mobile/rpc-foundation/goldens/transport-pairing-race-both-refused.json
@@ -3,9 +3,9 @@
   "family": "transport.pairing-race",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "4f0ddbea3c08ea3e90f6e707215a4831f06aed408065b45d0771028d256d6b12",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-pairing-race-direct-completes-first.json b/mobile/rpc-foundation/goldens/transport-pairing-race-direct-completes-first.json
index 9f49fca663b..70d9a5c3bad 100644
--- a/mobile/rpc-foundation/goldens/transport-pairing-race-direct-completes-first.json
+++ b/mobile/rpc-foundation/goldens/transport-pairing-race-direct-completes-first.json
@@ -3,9 +3,9 @@
   "family": "transport.pairing-race",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "488173fa313295f97aa88fb4bf1944fdb655e37cfd2444e9d15515bd6ad82d95",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-pairing-race-relay-completes-first.json b/mobile/rpc-foundation/goldens/transport-pairing-race-relay-completes-first.json
index 9dd189ab083..6f362c6175d 100644
--- a/mobile/rpc-foundation/goldens/transport-pairing-race-relay-completes-first.json
+++ b/mobile/rpc-foundation/goldens/transport-pairing-race-relay-completes-first.json
@@ -3,9 +3,9 @@
   "family": "transport.pairing-race",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "dee9824e5ec32115fa7dfaaf223fc34c28d057a5526ac3dad42365543288a934",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-pairing-race-relay-wins-when-direct-refused.json b/mobile/rpc-foundation/goldens/transport-pairing-race-relay-wins-when-direct-refused.json
index fa7118627b6..7d0bf5c1fd7 100644
--- a/mobile/rpc-foundation/goldens/transport-pairing-race-relay-wins-when-direct-refused.json
+++ b/mobile/rpc-foundation/goldens/transport-pairing-race-relay-wins-when-direct-refused.json
@@ -3,9 +3,9 @@
   "family": "transport.pairing-race",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "a34ffec446f9bbc465bd3f7d0a43166c9bc221a6ece8714e0b5717169625cf43",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-capabilities-advertised.json b/mobile/rpc-foundation/goldens/tw-capabilities-advertised.json
index 0014ce741ed..ecaba9b4aae 100644
--- a/mobile/rpc-foundation/goldens/tw-capabilities-advertised.json
+++ b/mobile/rpc-foundation/goldens/tw-capabilities-advertised.json
@@ -3,9 +3,9 @@
   "family": "worktree.runtime-capabilities",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "9d79bcfd6957d11d5ce8c3296f1038a3cfab81eedad7f990b44071104dfd0f91",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-capabilities-cutover-retried.json b/mobile/rpc-foundation/goldens/tw-capabilities-cutover-retried.json
index 078d7559558..4f4705e5fef 100644
--- a/mobile/rpc-foundation/goldens/tw-capabilities-cutover-retried.json
+++ b/mobile/rpc-foundation/goldens/tw-capabilities-cutover-retried.json
@@ -3,9 +3,9 @@
   "family": "worktree.runtime-capabilities",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "fb9c0e4b7c34f9bd1bd355b606c6ba75a7583cff3788000b7ed013612f5574fe",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-capabilities-legacy-idempotency.json b/mobile/rpc-foundation/goldens/tw-capabilities-legacy-idempotency.json
index cb3e3851322..fdb4e4a87c0 100644
--- a/mobile/rpc-foundation/goldens/tw-capabilities-legacy-idempotency.json
+++ b/mobile/rpc-foundation/goldens/tw-capabilities-legacy-idempotency.json
@@ -3,9 +3,9 @@
   "family": "worktree.runtime-capabilities",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "d73fed49e0a7e3e054d5c2fa75780f98bf78b6fa7e02f1ccb2fdc49465cf2fe5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-create-retry-agent-launched.json b/mobile/rpc-foundation/goldens/tw-create-retry-agent-launched.json
index 0294dffac9d..5ae125871aa 100644
--- a/mobile/rpc-foundation/goldens/tw-create-retry-agent-launched.json
+++ b/mobile/rpc-foundation/goldens/tw-create-retry-agent-launched.json
@@ -3,11 +3,11 @@
   "family": "worktree.agent-launch-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
-  "scenarioSha256": "85595f5fdde16441d22bf07c14c65edda6cb90019d036aae2c5031d19664e66f",
+  "scenarioSha256": "d193972745f28b4a8da9b19176ba9825b7b6eb78f28802c6f6eea99e155fdfe6",
   "platform": "darwin",
   "scenarioVersion": 1,
   "projectionVersion": 2,
diff --git a/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-after-drop.json b/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-after-drop.json
index 8bb8a138b92..6fcb380d044 100644
--- a/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-after-drop.json
+++ b/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-after-drop.json
@@ -3,9 +3,9 @@
   "family": "worktree.create-retry",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "a99bb80a5826af1df8d74114fcc5654aa42c9208747b512cea9bd5ca65b64ccb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-while-connected.json b/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-while-connected.json
index 556a99f76b4..3ab274b7ebd 100644
--- a/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-while-connected.json
+++ b/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-while-connected.json
@@ -3,9 +3,9 @@
   "family": "worktree.create-retry",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "3cda09e4a4ad4092f5f9a48b7c9715a99a51eb3bc4bed00f7054537a9e21cea9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-without-idempotency.json b/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-without-idempotency.json
index a97d0865f4d..dd9b8542755 100644
--- a/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-without-idempotency.json
+++ b/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-without-idempotency.json
@@ -3,9 +3,9 @@
   "family": "worktree.create-retry",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "61097c13b262a4454510936fa9c9554a07865b610f18407f1b67bdd74476df08",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-create-retry-created.json b/mobile/rpc-foundation/goldens/tw-create-retry-created.json
index 419b0d524dd..f1d083a87fa 100644
--- a/mobile/rpc-foundation/goldens/tw-create-retry-created.json
+++ b/mobile/rpc-foundation/goldens/tw-create-retry-created.json
@@ -3,9 +3,9 @@
   "family": "worktree.create-retry",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "0278216fee698c00118bb0e73a7fe755dc59c3b8e2b0459153edae64f155774c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-create-retry-name-collision.json b/mobile/rpc-foundation/goldens/tw-create-retry-name-collision.json
index 0f5920a49db..936103e30b4 100644
--- a/mobile/rpc-foundation/goldens/tw-create-retry-name-collision.json
+++ b/mobile/rpc-foundation/goldens/tw-create-retry-name-collision.json
@@ -3,9 +3,9 @@
   "family": "worktree.create-retry",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "6cb658dadc9e146c4f36c6ce643451e72300b8cdda19cc684ffa9fb2b0822c0a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-create-retry-unretryable-refusal.json b/mobile/rpc-foundation/goldens/tw-create-retry-unretryable-refusal.json
index 27a590d47fe..45d181d1ac6 100644
--- a/mobile/rpc-foundation/goldens/tw-create-retry-unretryable-refusal.json
+++ b/mobile/rpc-foundation/goldens/tw-create-retry-unretryable-refusal.json
@@ -3,9 +3,9 @@
   "family": "worktree.create-retry",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "16abe9e1a8d4cff17b3ea29d40277ae30a3d555a4a9efa08b2745c3a85b02740",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-create-retry-warning-kept.json b/mobile/rpc-foundation/goldens/tw-create-retry-warning-kept.json
index e00b1e05b44..f4478f35cd2 100644
--- a/mobile/rpc-foundation/goldens/tw-create-retry-warning-kept.json
+++ b/mobile/rpc-foundation/goldens/tw-create-retry-warning-kept.json
@@ -3,9 +3,9 @@
   "family": "worktree.create-retry",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "f469b2b7d61e7fc500fa97b5548f5a3732b0dbcdb405412a514a609f786dfbb5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-hosted-base-resolved.json b/mobile/rpc-foundation/goldens/tw-hosted-base-resolved.json
index 97f85efb870..f14200b3d9c 100644
--- a/mobile/rpc-foundation/goldens/tw-hosted-base-resolved.json
+++ b/mobile/rpc-foundation/goldens/tw-hosted-base-resolved.json
@@ -3,9 +3,9 @@
   "family": "worktree.hosted-base",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "b3734c24f8a083d3efcdd995ea6a57e608d3d3ae3bbbd514db19dcf69448fa48",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-hosted-base-soft-error.json b/mobile/rpc-foundation/goldens/tw-hosted-base-soft-error.json
index dfc31d108e7..eb3ad787667 100644
--- a/mobile/rpc-foundation/goldens/tw-hosted-base-soft-error.json
+++ b/mobile/rpc-foundation/goldens/tw-hosted-base-soft-error.json
@@ -3,9 +3,9 @@
   "family": "worktree.hosted-base",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "451e74a430d2549976fa360a0e43e76a8d855b1470b8e313797019770ceca4cb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-paste-lookup-resolved.json b/mobile/rpc-foundation/goldens/tw-paste-lookup-resolved.json
index f549bf3db44..366a0fe1e37 100644
--- a/mobile/rpc-foundation/goldens/tw-paste-lookup-resolved.json
+++ b/mobile/rpc-foundation/goldens/tw-paste-lookup-resolved.json
@@ -3,9 +3,9 @@
   "family": "tasks.paste-lookup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "81be14c5ec31045004465de4234d1f682f5946d6f8dac7a42263e285b1f24591",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-paste-lookup-slug-refused.json b/mobile/rpc-foundation/goldens/tw-paste-lookup-slug-refused.json
index d85e66640ac..fbb7a572314 100644
--- a/mobile/rpc-foundation/goldens/tw-paste-lookup-slug-refused.json
+++ b/mobile/rpc-foundation/goldens/tw-paste-lookup-slug-refused.json
@@ -3,9 +3,9 @@
   "family": "tasks.paste-lookup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "e9d85c576adf93063a8f56d49d28869c402cad38122732b46b8ec021d25db5e3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-paste-lookup-slug-unsupported.json b/mobile/rpc-foundation/goldens/tw-paste-lookup-slug-unsupported.json
index 6b09ab06eee..5607d75a0fc 100644
--- a/mobile/rpc-foundation/goldens/tw-paste-lookup-slug-unsupported.json
+++ b/mobile/rpc-foundation/goldens/tw-paste-lookup-slug-unsupported.json
@@ -3,9 +3,9 @@
   "family": "tasks.paste-lookup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "14509b4c1cc3beb00cc329b6bae46913f59b3938f76c0bd3bf3e374f34fb680d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-setup-hook-trust-always.json b/mobile/rpc-foundation/goldens/tw-setup-hook-trust-always.json
index 192b7248f11..05e1f1a4642 100644
--- a/mobile/rpc-foundation/goldens/tw-setup-hook-trust-always.json
+++ b/mobile/rpc-foundation/goldens/tw-setup-hook-trust-always.json
@@ -3,9 +3,9 @@
   "family": "worktree.setup-hook-trust",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "0d2e3f48aadf45abbf6927b72ed5fef4caa8e3eb2efd1046339a3fbfab6f9f18",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-setup-hook-trust-approved.json b/mobile/rpc-foundation/goldens/tw-setup-hook-trust-approved.json
index 5bd9d8d627b..c99f0e02e72 100644
--- a/mobile/rpc-foundation/goldens/tw-setup-hook-trust-approved.json
+++ b/mobile/rpc-foundation/goldens/tw-setup-hook-trust-approved.json
@@ -3,9 +3,9 @@
   "family": "worktree.setup-hook-trust",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "f54f5c6dbbe7dbcf8e85e9bd36b27ca9bea7de65d5e35dabace49b3fc766a403",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-smart-search-all-providers.json b/mobile/rpc-foundation/goldens/tw-smart-search-all-providers.json
index 849843a2c0e..7f72648e740 100644
--- a/mobile/rpc-foundation/goldens/tw-smart-search-all-providers.json
+++ b/mobile/rpc-foundation/goldens/tw-smart-search-all-providers.json
@@ -3,9 +3,9 @@
   "family": "tasks.smart-source-search",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "5d869d55848aea469954eb945ddc2b74f366387f8fc2853b7ae01de779208c4a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-smart-search-gitlab-provider-error.json b/mobile/rpc-foundation/goldens/tw-smart-search-gitlab-provider-error.json
index 5f8ba944433..e75a5f9629d 100644
--- a/mobile/rpc-foundation/goldens/tw-smart-search-gitlab-provider-error.json
+++ b/mobile/rpc-foundation/goldens/tw-smart-search-gitlab-provider-error.json
@@ -3,9 +3,9 @@
   "family": "tasks.smart-source-search",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "4537bf83f7a030521eec549adf4490da5be183471d5a9f9e58b71815b29481ff",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-smart-search-linear-listed.json b/mobile/rpc-foundation/goldens/tw-smart-search-linear-listed.json
index 4eb9810dd6d..e24f06cda78 100644
--- a/mobile/rpc-foundation/goldens/tw-smart-search-linear-listed.json
+++ b/mobile/rpc-foundation/goldens/tw-smart-search-linear-listed.json
@@ -3,9 +3,9 @@
   "family": "tasks.smart-source-search",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "9681485eec93644a01dd6dff0d07f9629361a86989a900176c5aaff3d5805db3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-task-preferences-resume-write.json b/mobile/rpc-foundation/goldens/tw-task-preferences-resume-write.json
index 96e130872a2..c0931d667f5 100644
--- a/mobile/rpc-foundation/goldens/tw-task-preferences-resume-write.json
+++ b/mobile/rpc-foundation/goldens/tw-task-preferences-resume-write.json
@@ -3,9 +3,9 @@
   "family": "settings-best-effort",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "31bfa49f888b0eb3f72873bf4a3af26129e78c23126e8fc8fe45b952caa60904",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-workspace-source-presets-refused.json b/mobile/rpc-foundation/goldens/tw-workspace-source-presets-refused.json
index 9ff8639f85e..b55cb69442d 100644
--- a/mobile/rpc-foundation/goldens/tw-workspace-source-presets-refused.json
+++ b/mobile/rpc-foundation/goldens/tw-workspace-source-presets-refused.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-source",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "2cd1e8972f226572744dad7da82afffbdf0452a121c1cd8c3334d5c3fde5d57c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-workspace-source-presets.json b/mobile/rpc-foundation/goldens/tw-workspace-source-presets.json
index 6651794a125..c6995acd852 100644
--- a/mobile/rpc-foundation/goldens/tw-workspace-source-presets.json
+++ b/mobile/rpc-foundation/goldens/tw-workspace-source-presets.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-source",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "046dd3a125a3c9abcf5a0dd122818939b516adb91cbda2554b3409d4bb3a7980",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-workspace-sparse-missing-preset.json b/mobile/rpc-foundation/goldens/tw-workspace-sparse-missing-preset.json
index b3d33ee6ed3..5ab919765cc 100644
--- a/mobile/rpc-foundation/goldens/tw-workspace-sparse-missing-preset.json
+++ b/mobile/rpc-foundation/goldens/tw-workspace-sparse-missing-preset.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-sparse",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "865a659012dd882fd6073813585e2911a1d6252404fbf5a5e273f062b89fc91d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-workspace-sparse-saved.json b/mobile/rpc-foundation/goldens/tw-workspace-sparse-saved.json
index f3dbb6eeab3..7422c107f80 100644
--- a/mobile/rpc-foundation/goldens/tw-workspace-sparse-saved.json
+++ b/mobile/rpc-foundation/goldens/tw-workspace-sparse-saved.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-sparse",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "124f664e339bfd83a1d892e1cd953a78fdf0dc4b20c4272356d24079c72a3e04",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-workspace-ssh-connect-refused.json b/mobile/rpc-foundation/goldens/tw-workspace-ssh-connect-refused.json
index bff88247cca..d54173c47c5 100644
--- a/mobile/rpc-foundation/goldens/tw-workspace-ssh-connect-refused.json
+++ b/mobile/rpc-foundation/goldens/tw-workspace-ssh-connect-refused.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-ssh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "dd25391fdd3dc864ae493f72d013e789884a21e9c71522edc79323bc2b6c7f76",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-workspace-ssh-connected.json b/mobile/rpc-foundation/goldens/tw-workspace-ssh-connected.json
index 5e68fec1227..4c751c73812 100644
--- a/mobile/rpc-foundation/goldens/tw-workspace-ssh-connected.json
+++ b/mobile/rpc-foundation/goldens/tw-workspace-ssh-connected.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-ssh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "495f51d9c2f7f3d71f53a53e88786b8d1f767a5bf66b8655c28222d2909a964c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-workspace-ssh-local-agents.json b/mobile/rpc-foundation/goldens/tw-workspace-ssh-local-agents.json
index 332cea82987..f18edad9f80 100644
--- a/mobile/rpc-foundation/goldens/tw-workspace-ssh-local-agents.json
+++ b/mobile/rpc-foundation/goldens/tw-workspace-ssh-local-agents.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-ssh-local",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "af0623c2d106d2ed18ef9149d4990539f9ed82146ae091a872a3e1d792efeffe",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-workspace-ssh-not-ready.json b/mobile/rpc-foundation/goldens/tw-workspace-ssh-not-ready.json
index b60873d2335..a17db278e23 100644
--- a/mobile/rpc-foundation/goldens/tw-workspace-ssh-not-ready.json
+++ b/mobile/rpc-foundation/goldens/tw-workspace-ssh-not-ready.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-ssh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "3aa23f15da8fe9972e47c767db454b41750ca353ab10797082fde4514ffe9da0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/worktree-catalog-snapshot-unreadable.json b/mobile/rpc-foundation/goldens/worktree-catalog-snapshot-unreadable.json
index ff0c84aeb6d..c168e39a1a1 100644
--- a/mobile/rpc-foundation/goldens/worktree-catalog-snapshot-unreadable.json
+++ b/mobile/rpc-foundation/goldens/worktree-catalog-snapshot-unreadable.json
@@ -3,9 +3,9 @@
   "family": "worktree.catalog-snapshot",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e942ddfbaa0ba6bfc2993969276987f6528ac53765d125e99a830e261f93a8e",
   "scenarioSha256": "e28e66567389598edbc720c89f5af73b5beca836cd0357af235d8ddc3d29fbfc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/worktree-catalog-snapshot.json b/mobile/rpc-foundation/goldens/worktree-catalog-snapshot.json
index 642a739806c..934747f67a7 100644
--- a/mobile/rpc-foundation/goldens/worktree-catalog-snapshot.json
+++ b/mobile/rpc-foundation/goldens/worktree-catalog-snapshot.json
@@ -3,9 +3,9 @@
   "family": "worktree.catalog-snapshot",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e942ddfbaa0ba6bfc2993969276987f6528ac53765d125e99a830e261f93a8e",
   "scenarioSha256": "d2947158840576cbd0f0604ed3d37b0f446c63c6d439b4d1b7def7fe8524523d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/worktree-home-catalog.json b/mobile/rpc-foundation/goldens/worktree-home-catalog.json
index 2f8232f17ad..11dbd180822 100644
--- a/mobile/rpc-foundation/goldens/worktree-home-catalog.json
+++ b/mobile/rpc-foundation/goldens/worktree-home-catalog.json
@@ -3,9 +3,9 @@
   "family": "worktree.home-catalog",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e942ddfbaa0ba6bfc2993969276987f6528ac53765d125e99a830e261f93a8e",
   "scenarioSha256": "4749bb3b871275ba08f026f9b6bcfd383605f443e7bba70a7f89175b91db6fa5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/worktree-retired-names.json b/mobile/rpc-foundation/goldens/worktree-retired-names.json
index b0e598ca7e6..ee383f18ad4 100644
--- a/mobile/rpc-foundation/goldens/worktree-retired-names.json
+++ b/mobile/rpc-foundation/goldens/worktree-retired-names.json
@@ -3,9 +3,9 @@
   "family": "worktree.retired-names",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "ca865964d90db4c42bf4807049ffb54d7d2f552a4666798a2d2e5cbf14723edd",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e942ddfbaa0ba6bfc2993969276987f6528ac53765d125e99a830e261f93a8e",
   "scenarioSha256": "2faa07ee5f12b3ed584117359d3b7aeb9c78a04e8fc49e753372f8c3927a3740",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/pilot-scenarios.json b/mobile/rpc-foundation/pilot-scenarios.json
index 62cb3afb5f5..166a29e8c9d 100644
--- a/mobile/rpc-foundation/pilot-scenarios.json
+++ b/mobile/rpc-foundation/pilot-scenarios.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "baseline": "a547d8903b91908502892cc3ca68cb0986397901",
+  "baseline": "1cae30b028e6b967575d65f18e8a0e868583e993",
   "scenarios": [
     {
       "id": "b1",
@@ -5939,7 +5939,7 @@
       "family": "worktree.agent-launch-create",
       "sites": [
         "mobile/src/tasks/worktree-create-retry.ts",
-        "mobile/src/tasks/agent-launch-worktree-create.ts"
+        "mobile/src/tasks/agent-launch-request.ts"
       ],
       "schedules": [],
       "steps": [
@@ -9382,37 +9382,78 @@
           "checkpoint": "pending"
         },
         {
-          "complete": "session.tabs.createTerminal#1",
+          "complete": "repo.list#1",
           "params": {
-            "worktree": "id:repo-9::/w",
-            "activate": false,
-            "select": true,
-            "navigation": "caller"
+            "$undefined": true
           },
           "reply": {
             "ok": true,
             "result": {
-              "tab": {
-                "id": "tab-1",
-                "type": "terminal",
-                "terminal": "term-1",
-                "title": "Agent"
+              "repos": [
+                {
+                  "id": "repo-9"
+                }
+              ]
+            }
+          }
+        },
+        {
+          "complete": "settings.get#1",
+          "params": {
+            "$undefined": true
+          },
+          "reply": {
+            "ok": true,
+            "result": {
+              "settings": {
+                "defaultTuiAgent": "codex",
+                "disabledTuiAgents": []
               }
             }
           }
         },
         {
-          "complete": "terminal.send#1",
+          "complete": "preflight.detectAgents#1",
           "params": {
-            "terminal": "term-1",
-            "text": "Fix the failing checks",
-            "enter": true
+            "$undefined": true
+          },
+          "reply": {
+            "ok": true,
+            "result": ["codex"]
+          }
+        },
+        {
+          "complete": "agent.launchReplay#1",
+          "params": {
+            "agent": "codex",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            },
+            "prompt": {
+              "text": "Fix the failing checks",
+              "delivery": "submit"
+            },
+            "launchSource": "task_page"
           },
           "reply": {
             "ok": true,
             "result": {
-              "send": {
-                "accepted": true
+              "outcome": {
+                "kind": "terminal",
+                "handle": "term-1"
+              },
+              "worktreeId": "repo-9::/w",
+              "receipt": {
+                "mode": "terminal",
+                "preferred": "terminal",
+                "reason": "user_default",
+                "detail": "Started a terminal agent, the default for new agent tabs in your settings."
+              },
+              "prompt": {
+                "delivery": "submit",
+                "outcome": "handed-to-terminal"
               }
             }
           }
@@ -9423,7 +9464,7 @@
       ]
     },
     {
-      "id": "pr-triage-send-locked",
+      "id": "pr-triage-prompt-not-delivered",
       "operation": "session.pr-triage-launch",
       "version": 1,
       "family": "session.pr-triage",
@@ -9435,48 +9476,89 @@
           "id": "launch"
         },
         {
-          "complete": "session.tabs.createTerminal#1",
+          "complete": "repo.list#1",
           "params": {
-            "worktree": "id:repo-9::/w",
-            "activate": false,
-            "select": true,
-            "navigation": "caller"
+            "$undefined": true
           },
           "reply": {
             "ok": true,
             "result": {
-              "tab": {
-                "id": "tab-1",
-                "type": "terminal",
-                "terminal": "term-1",
-                "title": "Agent"
+              "repos": [
+                {
+                  "id": "repo-9"
+                }
+              ]
+            }
+          }
+        },
+        {
+          "complete": "settings.get#1",
+          "params": {
+            "$undefined": true
+          },
+          "reply": {
+            "ok": true,
+            "result": {
+              "settings": {
+                "defaultTuiAgent": "codex",
+                "disabledTuiAgents": []
               }
             }
           }
         },
         {
-          "complete": "terminal.send#1",
+          "complete": "preflight.detectAgents#1",
           "params": {
-            "terminal": "term-1",
-            "text": "Fix the failing checks",
-            "enter": true
+            "$undefined": true
+          },
+          "reply": {
+            "ok": true,
+            "result": ["codex"]
+          }
+        },
+        {
+          "complete": "agent.launchReplay#1",
+          "params": {
+            "agent": "codex",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            },
+            "prompt": {
+              "text": "Fix the failing checks",
+              "delivery": "submit"
+            },
+            "launchSource": "task_page"
           },
           "reply": {
             "ok": true,
             "result": {
-              "send": {
-                "accepted": false
+              "outcome": {
+                "kind": "terminal",
+                "handle": "term-1"
+              },
+              "worktreeId": "repo-9::/w",
+              "receipt": {
+                "mode": "terminal",
+                "preferred": "terminal",
+                "reason": "user_default",
+                "detail": "Started a terminal agent, the default for new agent tabs in your settings."
+              },
+              "prompt": {
+                "delivery": "submit",
+                "outcome": "not-delivered"
               }
             }
           }
         },
         {
-          "checkpoint": "locked"
+          "checkpoint": "prompt-not-sent"
         }
       ]
     },
     {
-      "id": "pr-triage-invalid-terminal",
+      "id": "pr-triage-launch-unconfirmed",
       "operation": "session.pr-triage-launch",
       "version": 1,
       "family": "session.pr-triage",
@@ -9488,24 +9570,91 @@
           "id": "launch"
         },
         {
-          "complete": "session.tabs.createTerminal#1",
+          "complete": "repo.list#1",
           "params": {
-            "worktree": "id:repo-9::/w",
-            "activate": false,
-            "select": true,
-            "navigation": "caller"
+            "$undefined": true
           },
           "reply": {
             "ok": true,
             "result": {
-              "tab": {
-                "id": "tab-1"
+              "repos": [
+                {
+                  "id": "repo-9"
+                }
+              ]
+            }
+          }
+        },
+        {
+          "complete": "settings.get#1",
+          "params": {
+            "$undefined": true
+          },
+          "reply": {
+            "ok": true,
+            "result": {
+              "settings": {
+                "defaultTuiAgent": "codex",
+                "disabledTuiAgents": []
               }
             }
           }
         },
         {
-          "checkpoint": "invalid"
+          "complete": "preflight.detectAgents#1",
+          "params": {
+            "$undefined": true
+          },
+          "reply": {
+            "ok": true,
+            "result": ["codex"]
+          }
+        },
+        {
+          "complete": "agent.launchReplay#1",
+          "params": {
+            "agent": "codex",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "target": {
+              "kind": "existing",
+              "worktree": "id:repo-9::/w"
+            },
+            "prompt": {
+              "text": "Fix the failing checks",
+              "delivery": "submit"
+            },
+            "launchSource": "task_page"
+          },
+          "reply": {
+            "ok": false,
+            "error": {
+              "code": "agent_session_operation_unknown",
+              "message": "agent_session_operation_unknown"
+            }
+          }
+        },
+        {
+          "checkpoint": "unconfirmed"
+        }
+      ]
+    },
+    {
+      "id": "pr-triage-update-required",
+      "operation": "session.pr-triage-launch",
+      "version": 1,
+      "family": "session.pr-triage",
+      "sites": ["mobile/src/session/pr-ai-triage-launch.ts"],
+      "schedules": [],
+      "steps": [
+        {
+          "action": "launch",
+          "id": "launch",
+          "args": {
+            "legacyHost": true
+          }
+        },
+        {
+          "checkpoint": "update-required"
         }
       ]
     },
@@ -18657,7 +18806,7 @@
       ]
     },
     {
-      "id": "review-create-terminal-refused",
+      "id": "review-create-agent-refused",
       "operation": "session.diff-review-actions",
       "version": 1,
       "family": "session.diff-review-actions",
@@ -18675,18 +18824,66 @@
           "id": "create-and-send"
         },
         {
-          "complete": "session.tabs.createTerminal#1",
+          "complete": "repo.list#1",
           "params": {
-            "activate": false,
-            "navigation": "caller",
-            "select": true,
-            "worktree": "id:workspace-1"
+            "$undefined": true
+          },
+          "reply": {
+            "ok": true,
+            "result": {
+              "repos": [
+                {
+                  "id": "workspace-1"
+                }
+              ]
+            }
+          }
+        },
+        {
+          "complete": "settings.get#1",
+          "params": {
+            "$undefined": true
+          },
+          "reply": {
+            "ok": true,
+            "result": {
+              "settings": {
+                "defaultTuiAgent": null,
+                "disabledTuiAgents": []
+              }
+            }
+          }
+        },
+        {
+          "complete": "preflight.detectAgents#1",
+          "params": {
+            "$undefined": true
+          },
+          "reply": {
+            "ok": true,
+            "result": ["claude"]
+          }
+        },
+        {
+          "complete": "agent.launchReplay#1",
+          "params": {
+            "agent": "claude",
+            "operationId": "1767225600000-00000000000040008000000000000001",
+            "target": {
+              "kind": "existing",
+              "worktree": "id:workspace-1"
+            },
+            "prompt": {
+              "delivery": "submit",
+              "text": "You are reviewing the current worktree. Address the following mobile review notes.\n\nFile: src/app.ts\nLine: 4\nUser comment: \"needs a test\"\n\nAfter applying fixes:\n1. Summarize changed files.\n2. Run relevant tests.\n3. Tell me if anything remains risky."
+            },
+            "launchSource": "notes_send"
           },
           "reply": {
             "ok": false,
             "error": {
-              "code": "worktree_busy",
-              "message": "Workspace is busy"
+              "code": "selector_not_found",
+              "message": "Workspace not found"
             }
           }
         },
@@ -21242,7 +21439,7 @@
             "agent": "claude",
             "sessionId": "session-1",
             "limit": 40,
-            "subscriptionId": "claude:session-1",
+            "subscriptionId": "claude:session-1:00000000-0000-4000-8000-000000000001",
             "capabilities": {
               "transcriptPending": 1
             },
@@ -21353,7 +21550,7 @@
             "agent": "claude",
             "sessionId": "session-1",
             "limit": 40,
-            "subscriptionId": "claude:session-1",
+            "subscriptionId": "claude:session-1:00000000-0000-4000-8000-000000000001",
             "capabilities": {
               "transcriptPending": 1
             },
diff --git a/mobile/scripts/rpc-recording-pin-guard.mts b/mobile/scripts/rpc-recording-pin-guard.mts
index c7b11a48495..807893dcb28 100644
--- a/mobile/scripts/rpc-recording-pin-guard.mts
+++ b/mobile/scripts/rpc-recording-pin-guard.mts
@@ -1,10 +1,12 @@
 /**
  * Guards the two claims `mobile/rpc-foundation/goldens` makes about its pin.
  *
- * `ancestry`  — `baseline` names a commit in this history. A behaviour-change branch pins its own
- *               last fenced commit; that commit stops being reachable the moment the branch
- *               squash-merges, and nobody can run `--record` on main again until a hand-made repin
- *               lands. Ordinary product drift past a reachable pin is normal and is not a failure.
+ * `reachable` — `baseline` names a commit this repository keeps: one in this history, or one in
+ *               the head of a pull request GitHub associates with that commit. A behaviour-change
+ *               branch pins its own last fenced commit, which the squash leaves out of main's
+ *               history; `refs/pull/<n>/head` outlives the branch, so the pin stays checkable out.
+ *               GitHub only names the candidates; git's ancestry check decides. Ordinary product
+ *               drift past a kept pin is normal and is not a failure.
  * `reproduce` — the goldens on disk are what the recorder produces from the PINNED tree. The
  *               recording suites replay the corpus against the CURRENT tree on every run, which is
  *               the same claim only while the fenced tree still matches the pin.
@@ -17,6 +19,7 @@ import { join, resolve } from 'node:path'
 import { runProcess } from '../../src/shared/child-process/run-process.ts'
 import { RECORDING_DRIVERS } from '../src/test-support/rpc-recording/recording-drivers.ts'
 import { readScenarios } from '../src/test-support/rpc-recording/scenario-input.ts'
+import { checkPinReachable, PIN_MANIFEST } from './rpc-recording-pin-reachability.mts'
 
 /** The recorder is exempt from the fence, so a reproduction lays the candidate copy over the pin. */
 const RECORDER_OVERLAY = 'mobile/src/test-support/rpc-recording'
@@ -67,90 +70,11 @@ export function assertReproductionSuitesExist(root: string): void {
   }
 }
 
-export type PinAncestryFailure = 'shallow' | 'unreachable' | 'not-an-ancestor'
-export type PinAncestryVerdict =
-  | { ok: true; baseline: string; ref: string }
-  | { ok: false; baseline: string; ref: string; failure: PinAncestryFailure; message: string }
-
 async function git(cwd: string, args: readonly string[]) {
   return await runProcess({ program: 'git', args: [...args], cwd })
 }
 function readPinnedBaseline(root: string): string {
-  return readScenarios(resolve(root, 'mobile/rpc-foundation/pilot-scenarios.json')).baseline
-}
-export function repinInstruction(baseline: string, ref: string, cause: string): string {
-  return [
-    `The RPC recording corpus is pinned to a commit that ${cause}.`,
-    '',
-    `  baseline  ${baseline}   (mobile/rpc-foundation/pilot-scenarios.json)`,
-    `  head      ${ref}`,
-    '',
-    'Every golden under mobile/rpc-foundation/goldens claims it was recorded from that tree, and',
-    '`--record` refuses on any other tree, so the corpus cannot be refreshed until the pin names a',
-    'commit that is reachable from here. Repin and re-record, both in one commit:',
-    '',
-    `  git switch -c repin-rpc-recording ${ref}`,
-    `  # set "baseline" in mobile/rpc-foundation/pilot-scenarios.json to ${ref}`,
-    '  ORCA_BACKGROUND_LAUNCH=1 RPC_FOUNDATION_RECORD=1 \\',
-    '    pnpm --dir mobile exec tsx scripts/rpc-recording.mts --record',
-    '',
-    'Re-record everything: the repin rewrites the `baseline` header of every golden, so a partial',
-    'refresh leaves the corpus pinned to two different trees. See',
-    'mobile/src/test-support/rpc-recording/README.md, "Recording a behaviour change".'
-  ].join('\n')
-}
-const SHALLOW_MESSAGE = [
-  'Cannot judge the recording pin: this is a shallow clone.',
-  '',
-  '`git merge-base --is-ancestor` answers from grafted history, so it would report a verdict this',
-  'guard has no evidence for. Check out with `fetch-depth: 0`.'
-].join('\n')
-
-export async function checkPinAncestry(
-  root: string,
-  baseline: string,
-  ref: string
-): Promise<PinAncestryVerdict> {
-  const shallow = await git(root, ['rev-parse', '--is-shallow-repository'])
-  if (shallow.code !== 0) {
-    throw new Error(`Could not ask git whether the clone is shallow: ${shallow.stderr.trim()}`)
-  }
-  if (shallow.stdout.trim() !== 'false') {
-    return { ok: false, baseline, ref, failure: 'shallow', message: SHALLOW_MESSAGE }
-  }
-  const head = await git(root, ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`])
-  if (head.code !== 0) {
-    throw new Error(`Cannot resolve ${ref} to a commit in this repository`)
-  }
-  // Resolved, because the instruction below is a command to paste: `HEAD` in it moves with whatever
-  // the reader has checked out by the time they read the log.
-  const resolved = head.stdout.trim()
-  const pinned = await git(root, ['rev-parse', '--verify', '--quiet', `${baseline}^{commit}`])
-  if (pinned.code !== 0) {
-    return {
-      ok: false,
-      baseline,
-      ref,
-      failure: 'unreachable',
-      message: repinInstruction(baseline, resolved, 'is not a commit in this repository at all')
-    }
-  }
-  const ancestor = await git(root, ['merge-base', '--is-ancestor', baseline, ref])
-  if (ancestor.code === 0) {
-    return { ok: true, baseline, ref }
-  }
-  // Why only 1: git reserves higher codes for real errors, and treating one as "not an ancestor"
-  // would turn a broken repository into a repin instruction nobody can act on.
-  if (ancestor.code !== 1) {
-    throw new Error(`git merge-base --is-ancestor failed: ${ancestor.stderr.trim()}`)
-  }
-  return {
-    ok: false,
-    baseline,
-    ref,
-    failure: 'not-an-ancestor',
-    message: repinInstruction(baseline, resolved, 'is not an ancestor of this commit')
-  }
+  return readScenarios(resolve(root, PIN_MANIFEST)).baseline
 }
 
 /** Whether anything a reproduction reads from the candidate tree moved since `since`. */
@@ -284,18 +208,22 @@ async function main(argv: readonly string[]): Promise<void> {
   const check = argv[0]
   const root = resolve(import.meta.dirname, '../..')
   const baseline = readPinnedBaseline(root)
-  if (check === 'ancestry') {
+  if (check === 'reachable') {
     const ref = argv.includes('--ref') ? argv[argv.indexOf('--ref') + 1] : 'HEAD'
     if (!ref) {
       throw new Error('--ref needs a commit')
     }
-    const verdict = await checkPinAncestry(root, baseline, ref)
+    const verdict = await checkPinReachable(root, baseline, ref)
     if (!verdict.ok) {
       process.stderr.write(`${verdict.message}\n`)
       process.exitCode = 1
       return
     }
-    process.stdout.write(`Recording pin ${baseline} is an ancestor of ${ref}.\n`)
+    process.stdout.write(
+      verdict.pullRequest === null
+        ? `Recording pin ${baseline} is an ancestor of ${ref}.\n`
+        : `Recording pin ${baseline} is kept by refs/pull/${verdict.pullRequest}/head.\n`
+    )
     return
   }
   if (check === 'reproduce') {
@@ -313,6 +241,13 @@ async function main(argv: readonly string[]): Promise<void> {
         return
       }
     }
+    // Also fetches a pin that only its pull request's head still holds, so the checkout can find it.
+    const verdict = await checkPinReachable(root, baseline, 'HEAD')
+    if (!verdict.ok) {
+      process.stderr.write(`${verdict.message}\n`)
+      process.exitCode = 1
+      return
+    }
     if (!(await reproduceFromPin(root, baseline))) {
       process.stderr.write(`\n${REPRODUCTION_FAILURE}\n`)
       process.exitCode = 1
@@ -322,7 +257,7 @@ async function main(argv: readonly string[]): Promise<void> {
     return
   }
   throw new Error(
-    'Usage: rpc-recording-pin-guard.mts ancestry [--ref <commit>]\n     | reproduce [--if-changed-since <commit>]'
+    'Usage: rpc-recording-pin-guard.mts reachable [--ref <commit>]\n     | reproduce [--if-changed-since <commit>]'
   )
 }
 
diff --git a/mobile/scripts/rpc-recording-pin-guard.test.ts b/mobile/scripts/rpc-recording-pin-guard.test.ts
index e6154d51c2c..616034d72b1 100644
--- a/mobile/scripts/rpc-recording-pin-guard.test.ts
+++ b/mobile/scripts/rpc-recording-pin-guard.test.ts
@@ -1,16 +1,21 @@
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
-import { afterAll, describe, expect, it } from 'vitest'
+import { afterAll, afterEach, describe, expect, it, vi } from 'vitest'
 import { runProcess } from '../../src/shared/child-process/run-process'
 import {
   assertReproductionSuitesExist,
-  checkPinAncestry,
   corpusProvenanceChanged,
   removeScratchWorktree,
-  repinInstruction,
   REPRODUCTION_SUITES
 } from './rpc-recording-pin-guard.mts'
+import {
+  checkPinReachable,
+  gitHubRepositoryFromRemote,
+  PIN_MANIFEST,
+  pullRequestsWithCommit,
+  repinInstruction
+} from './rpc-recording-pin-reachability.mts'
 
 const scratch: string[] = []
 async function git(cwd: string, ...args: string[]): Promise<string> {
@@ -54,6 +59,50 @@ async function seedProvenance(repository: string): Promise<string> {
   return await commitAt(repository, RECORDER_FILE, 'recorder')
 }
 const MISSING_SHA = '0123456789abcdef0123456789abcdef01234567'
+function pinManifest(baseline: string): string {
+  return JSON.stringify({ baseline, scenarios: [] })
+}
+/**
+ * A behaviour-change branch that pinned its own commit, squash-merged onto main, with the host
+ * keeping the branch head at `refs/pull/7/head` the way GitHub does after the branch is gone.
+ */
+async function squashMergedPin(change: string, subject = `${change} (#7)`) {
+  const work = await throwawayRepository()
+  await commit(work, 'one')
+  await git(work, 'switch', '--quiet', '--create', 'behaviour-change')
+  const branchPin = await commit(work, change)
+  await commitAt(work, PIN_MANIFEST, pinManifest(branchPin))
+  await git(work, 'switch', '--quiet', 'main')
+  await git(work, 'merge', '--quiet', '--squash', 'behaviour-change')
+  await git(work, 'commit', '--quiet', '--no-verify', '--message', subject)
+  const remote = join(work, '..', 'remote.git')
+  await git(work, 'init', '--quiet', '--bare', remote)
+  await git(work, 'push', '--quiet', remote, 'main', 'behaviour-change:refs/pull/7/head')
+  await git(work, 'branch', '--quiet', '-D', 'behaviour-change')
+  return { work, remote, branchPin }
+}
+async function cloneMain(remote: string): Promise<string> {
+  const clone = join(remote, '..', `clone-${scratch.length}-${Date.now()}`)
+  await git(
+    join(remote, '..'),
+    'clone',
+    '--quiet',
+    '--single-branch',
+    '--branch',
+    'main',
+    remote,
+    clone
+  )
+  await git(clone, 'config', 'user.email', 'pin-guard@example.invalid')
+  await git(clone, 'config', 'user.name', 'Pin Guard')
+  return clone
+}
+// Stand-ins for GitHub's "pull requests associated with this commit" answer.
+const heldByPullRequest7 = async () => [7]
+const heldByNoPullRequest = async () => []
+const unasked = async (): Promise<number[]> => {
+  throw new Error('a pin in this history must not send the guard to GitHub')
+}
 
 // File scope, not per-suite: a suite-local hook fires before the later suites have made theirs.
 afterAll(async () => {
@@ -62,18 +111,18 @@ afterAll(async () => {
   }
 })
 
-describe('recording pin ancestry', () => {
+describe('recording pin reachability', () => {
   it('passes when the pin is the commit itself', async () => {
     const repository = await throwawayRepository()
     const first = await commit(repository, 'one')
-    expect(await checkPinAncestry(repository, first, first)).toMatchObject({ ok: true })
+    expect(await checkPinReachable(repository, first, first, unasked)).toMatchObject({ ok: true })
   })
 
   it('passes on ordinary drift: the tree has moved on, the pin is still reachable', async () => {
     const repository = await throwawayRepository()
     const pin = await commit(repository, 'one')
     const head = await commit(repository, 'two')
-    expect(await checkPinAncestry(repository, pin, head)).toMatchObject({ ok: true })
+    expect(await checkPinReachable(repository, pin, head, unasked)).toMatchObject({ ok: true })
   })
 
   it('passes on a branch that pinned its own commit, judged against that branch', async () => {
@@ -82,7 +131,9 @@ describe('recording pin ancestry', () => {
     await git(repository, 'switch', '--quiet', '--create', 'behaviour-change')
     const branchPin = await commit(repository, 'two')
     const branchHead = await commit(repository, 'three')
-    expect(await checkPinAncestry(repository, branchPin, branchHead)).toMatchObject({ ok: true })
+    expect(await checkPinReachable(repository, branchPin, branchHead, unasked)).toMatchObject({
+      ok: true
+    })
   })
 
   it('passes a branch cut before main repinned, judged against the merge preview', async () => {
@@ -98,29 +149,115 @@ describe('recording pin ancestry', () => {
     await git(repository, 'merge', '--quiet', '--no-edit', 'main')
     const preview = await git(repository, 'rev-parse', 'HEAD')
     // The preview is the tree CI checks out and reads the pin from, so it is the tree to judge.
-    expect(await checkPinAncestry(repository, mainPin, preview)).toMatchObject({ ok: true })
+    expect(await checkPinReachable(repository, mainPin, preview, unasked)).toMatchObject({
+      ok: true
+    })
     // The head sha would have failed this ordinary branch, and told the author to repin to it.
-    expect(await checkPinAncestry(repository, mainPin, branchHead)).toMatchObject({
+    expect(
+      await checkPinReachable(repository, mainPin, branchHead, heldByNoPullRequest)
+    ).toMatchObject({
       ok: false,
       failure: 'not-an-ancestor'
     })
   })
 
-  it('fails once that branch squash-merges and the pin leaves the history', async () => {
+  it('passes once that branch squash-merges, through the head its pull request keeps', async () => {
+    const { remote, branchPin } = await squashMergedPin('two')
+    // Only main: the branch is deleted, so the pin is nowhere in this clone until it is fetched.
+    const clone = await cloneMain(remote)
+    expect(await checkPinReachable(clone, branchPin, 'HEAD', heldByPullRequest7)).toMatchObject({
+      ok: true,
+      pullRequest: 7
+    })
+    const drifted = await commit(clone, 'later product change on main')
+    expect(await checkPinReachable(clone, branchPin, drifted, heldByPullRequest7)).toMatchObject({
+      ok: true,
+      pullRequest: 7
+    })
+    // The reproduction checks the pinned tree out next, which needs the fetched commit.
+    await git(clone, 'cat-file', '-e', `${branchPin}^{commit}`)
+  })
+
+  it('passes a branch opened after that squash, judged against its merge preview', async () => {
+    const { remote, branchPin } = await squashMergedPin('two')
+    const clone = await cloneMain(remote)
+    await git(clone, 'switch', '--quiet', '--create', 'later-branch')
+    await commitAt(clone, 'mobile/src/later.ts', 'later branch change')
+    await git(clone, 'switch', '--quiet', '--detach', 'main')
+    await commit(clone, 'main moved on')
+    await git(clone, 'merge', '--quiet', '--no-ff', '--no-edit', 'later-branch')
+    expect(await checkPinReachable(clone, branchPin, 'HEAD', heldByPullRequest7)).toMatchObject({
+      ok: true,
+      pullRequest: 7
+    })
+  })
+
+  it('passes a squash whose edited title lost its (#n), since GitHub names the pull request', async () => {
+    const { remote, branchPin } = await squashMergedPin('two', 'two, title edited at merge')
+    const clone = await cloneMain(remote)
+    expect(await checkPinReachable(clone, branchPin, 'HEAD', heldByPullRequest7)).toMatchObject({
+      ok: true,
+      pullRequest: 7
+    })
+  })
+
+  it('passes through the first associated pull request whose head holds the pin', async () => {
+    const { remote, branchPin, work } = await squashMergedPin('two')
+    await git(work, 'push', '--quiet', remote, 'main:refs/pull/9/head')
+    const clone = await cloneMain(remote)
+    expect(await checkPinReachable(clone, branchPin, 'HEAD', async () => [9, 7])).toMatchObject({
+      ok: true,
+      pullRequest: 7
+    })
+  })
+
+  it('fails the merge preview of a branch whose rebase dropped the commit it pinned', async () => {
+    const { remote } = await squashMergedPin('two')
+    const clone = await cloneMain(remote)
+    await git(clone, 'switch', '--quiet', '--create', 'rebased')
+    const droppedPin = await commit(clone, 'three')
+    await commitAt(clone, PIN_MANIFEST, pinManifest(droppedPin))
+    await git(clone, 'switch', '--quiet', 'main')
+    await commitAt(clone, 'mobile/src/moved.ts', 'main moved on')
+    // The rebase rewrites both commits; the manifest still names the one that is gone.
+    await git(clone, 'rebase', '--quiet', 'main', 'rebased')
+    await git(clone, 'switch', '--quiet', '--detach', 'main')
+    await git(clone, 'merge', '--quiet', '--no-ff', '--no-edit', 'rebased')
+    // Caught on the pull request: after the squash no head would hold the pin either.
+    const verdict = await checkPinReachable(clone, droppedPin, 'HEAD', heldByNoPullRequest)
+    expect(verdict).toMatchObject({ ok: false, failure: 'not-an-ancestor' })
+    expect(verdict.ok ? '' : verdict.message).toContain('GitHub associates no pull request')
+  })
+
+  it("fails when the pull request's head no longer holds the pin", async () => {
+    const { remote, branchPin, work } = await squashMergedPin('two')
+    // A force-push after pinning: the pin is left in no ref the host keeps.
+    await git(work, 'push', '--quiet', '--force', remote, 'main:refs/pull/7/head')
+    await git(work, 'push', '--quiet', remote, `${branchPin}:refs/heads/stray`)
+    const clone = await cloneMain(remote)
+    await git(clone, 'fetch', '--quiet', 'origin', 'stray')
+    const verdict = await checkPinReachable(clone, branchPin, 'HEAD', heldByPullRequest7)
+    expect(verdict).toMatchObject({ ok: false, failure: 'not-an-ancestor' })
+    expect(verdict.ok ? '' : verdict.message).toContain('refs/pull/7/head')
+  })
+
+  it('fails once that branch squash-merges if GitHub associates no pull request with it', async () => {
     const repository = await throwawayRepository()
     const base = await commit(repository, 'one')
     await git(repository, 'switch', '--quiet', '--create', 'behaviour-change')
     const branchPin = await commit(repository, 'two')
     await git(repository, 'switch', '--quiet', 'main')
     await git(repository, 'reset', '--quiet', '--hard', base)
+    await commitAt(repository, PIN_MANIFEST, pinManifest(branchPin))
     const squashed = await commit(repository, 'two, squashed')
-    const verdict = await checkPinAncestry(repository, branchPin, squashed)
+    const verdict = await checkPinReachable(repository, branchPin, squashed, heldByNoPullRequest)
     expect(verdict).toMatchObject({ ok: false, failure: 'not-an-ancestor' })
     expect(verdict.ok).toBe(false)
     if (verdict.ok) {
       return
     }
     expect(verdict.message).toContain(branchPin)
+    expect(verdict.message).toContain('GitHub associates no pull request')
     expect(verdict.message).toContain('scripts/rpc-recording.mts --record')
     expect(verdict.message).toContain('mobile/rpc-foundation/pilot-scenarios.json')
   })
@@ -128,11 +265,22 @@ describe('recording pin ancestry', () => {
   it('fails with the same instruction when the pin is no commit at all', async () => {
     const repository = await throwawayRepository()
     const head = await commit(repository, 'one')
-    const verdict = await checkPinAncestry(repository, MISSING_SHA, head)
+    const verdict = await checkPinReachable(repository, MISSING_SHA, head, heldByNoPullRequest)
     expect(verdict).toMatchObject({ ok: false, failure: 'unreachable' })
     expect(verdict.ok ? '' : verdict.message).toContain('scripts/rpc-recording.mts --record')
   })
 
+  it('lets a failed GitHub lookup propagate, never a pass or a repin instruction', async () => {
+    const { remote, branchPin } = await squashMergedPin('two')
+    const clone = await cloneMain(remote)
+    const broken = async (): Promise<number[]> => {
+      throw new Error('GitHub answered 502')
+    }
+    await expect(checkPinReachable(clone, branchPin, 'HEAD', broken)).rejects.toThrow(
+      'GitHub answered 502'
+    )
+  })
+
   it('refuses to answer on a shallow clone instead of trusting grafted history', async () => {
     const repository = await throwawayRepository()
     const pin = await commit(repository, 'one')
@@ -141,19 +289,74 @@ describe('recording pin ancestry', () => {
     const clone = join(repository, '..', 'shallow')
     await git(repository, 'clone', '--quiet', '--depth', '1', `file://${repository}`, clone)
     // The pin is real and reachable in the full repository; only the missing history hides it.
-    expect(await checkPinAncestry(repository, pin, head)).toMatchObject({ ok: true })
-    const verdict = await checkPinAncestry(clone, pin, 'HEAD')
+    expect(await checkPinReachable(repository, pin, head, unasked)).toMatchObject({ ok: true })
+    const verdict = await checkPinReachable(clone, pin, 'HEAD', unasked)
     expect(verdict).toMatchObject({ ok: false, failure: 'shallow' })
     expect(verdict.ok ? '' : verdict.message).toContain('fetch-depth: 0')
   })
 
   it('names the head and the pin in the instruction', () => {
     expect(
-      repinInstruction('a'.repeat(40), 'b'.repeat(40), 'is not an ancestor of this commit')
+      repinInstruction('a'.repeat(40), 'b'.repeat(40), 'is not a commit in this repository at all')
     ).toContain(`git switch -c repin-rpc-recording ${'b'.repeat(40)}`)
   })
 })
 
+describe("GitHub's pull requests for a pinned commit", () => {
+  const pin = 'a'.repeat(40)
+  const answer = (status: number, body: unknown) =>
+    vi.fn(async () => new Response(JSON.stringify(body), { status }))
+  afterEach(() => {
+    vi.unstubAllGlobals()
+    vi.unstubAllEnvs()
+  })
+
+  it('asks with the token when one is set and reads the pull request numbers', async () => {
+    vi.stubEnv('GITHUB_REPOSITORY', 'stablyai/orca')
+    vi.stubEnv('GITHUB_TOKEN', 'test-token')
+    const fetch = answer(200, [{ number: 22762 }, { number: 5 }])
+    vi.stubGlobal('fetch', fetch)
+    expect(await pullRequestsWithCommit('/unused', pin)).toEqual([22762, 5])
+    expect(fetch).toHaveBeenCalledWith(
+      `https://api.github.com/repos/stablyai/orca/commits/${pin}/pulls`,
+      expect.objectContaining({
+        headers: {
+          Accept: 'application/vnd.github+json',
+          Authorization: 'Bearer test-token'
+        }
+      })
+    )
+  })
+
+  it('reads no pull request for a commit GitHub has never seen', async () => {
+    vi.stubEnv('GITHUB_REPOSITORY', 'stablyai/orca')
+    vi.stubGlobal('fetch', answer(422, { message: `No commit found for SHA: ${pin}` }))
+    expect(await pullRequestsWithCommit('/unused', pin)).toEqual([])
+  })
+
+  it('names the rate limit when GitHub refuses a call made without a token', async () => {
+    vi.stubEnv('GITHUB_REPOSITORY', 'stablyai/orca')
+    vi.stubEnv('GITHUB_TOKEN', '')
+    vi.stubEnv('GH_TOKEN', '')
+    vi.stubGlobal('fetch', answer(403, { message: 'API rate limit exceeded' }))
+    await expect(pullRequestsWithCommit('/unused', pin)).rejects.toThrow(
+      /answered 403[\s\S]*API rate limit exceeded[\s\S]*set GITHUB_TOKEN or GH_TOKEN/
+    )
+  })
+
+  it('reads owner and repo from https and ssh remotes, and nothing from another host', () => {
+    expect(gitHubRepositoryFromRemote('https://github.com/stablyai/orca.git\n')).toBe(
+      'stablyai/orca'
+    )
+    expect(gitHubRepositoryFromRemote('https://github.com/stablyai/orca')).toBe('stablyai/orca')
+    expect(gitHubRepositoryFromRemote('git@github.com:stablyai/orca.git')).toBe('stablyai/orca')
+    expect(gitHubRepositoryFromRemote('ssh://git@github.com/stablyai/orca.git')).toBe(
+      'stablyai/orca'
+    )
+    expect(gitHubRepositoryFromRemote('/tmp/remote.git')).toBeNull()
+  })
+})
+
 describe('what a reproduction reads from the candidate tree', () => {
   it('skips the run when only product sources moved', async () => {
     const repository = await throwawayRepository()
diff --git a/mobile/scripts/rpc-recording-pin-reachability.mts b/mobile/scripts/rpc-recording-pin-reachability.mts
new file mode 100644
index 00000000000..c7ec31ccfb1
--- /dev/null
+++ b/mobile/scripts/rpc-recording-pin-reachability.mts
@@ -0,0 +1,204 @@
+/**
+ * Whether the RPC recording pin names a commit this repository keeps: one in this history, or one in
+ * the head of a pull request that GitHub associates with the pinned commit.
+ */
+import { runProcess } from '../../src/shared/child-process/run-process.ts'
+
+export const PIN_MANIFEST = 'mobile/rpc-foundation/pilot-scenarios.json'
+const PIN_REMOTE = 'origin'
+const PIN_FETCH_TIMEOUT_MS = 180_000
+const PULL_REQUEST_LOOKUP_TIMEOUT_MS = 30_000
+
+export type PinReachabilityFailure = 'shallow' | 'unreachable' | 'not-an-ancestor'
+export type PinReachabilityVerdict =
+  | { ok: true; baseline: string; ref: string; pullRequest: number | null }
+  | { ok: false; baseline: string; ref: string; failure: PinReachabilityFailure; message: string }
+/** Only nominates pull requests; git's ancestry check decides, so a wrong answer can only fail. */
+export type PullRequestLookup = (root: string, commit: string) => Promise<number[]>
+
+async function git(cwd: string, args: readonly string[], timeoutMs?: number) {
+  return await runProcess({ program: 'git', args: [...args], cwd, timeoutMs })
+}
+function failureDetail(result: { stderr: string; timedOut: boolean }, timeoutMs: number): string {
+  return result.timedOut ? `timed out after ${timeoutMs / 1000}s` : result.stderr.trim()
+}
+export function repinInstruction(baseline: string, ref: string, cause: string): string {
+  return [
+    `The RPC recording corpus is pinned to a commit that ${cause}.`,
+    '',
+    `  baseline  ${baseline}   (mobile/rpc-foundation/pilot-scenarios.json)`,
+    `  head      ${ref}`,
+    '',
+    'Every golden under mobile/rpc-foundation/goldens claims it was recorded from that tree, and',
+    '`--record` refuses on any other tree, so the corpus cannot be refreshed until the pin names a',
+    'commit that is reachable from here. Repin and re-record, both in one commit:',
+    '',
+    `  git switch -c repin-rpc-recording ${ref}`,
+    `  # set "baseline" in mobile/rpc-foundation/pilot-scenarios.json to ${ref}`,
+    '  ORCA_BACKGROUND_LAUNCH=1 RPC_FOUNDATION_RECORD=1 \\',
+    '    pnpm --dir mobile exec tsx scripts/rpc-recording.mts --record',
+    '',
+    'Re-record everything: the repin rewrites the `baseline` header of every golden, so a partial',
+    'refresh leaves the corpus pinned to two different trees. See',
+    'mobile/src/test-support/rpc-recording/README.md, "Recording a behaviour change".'
+  ].join('\n')
+}
+const SHALLOW_MESSAGE = [
+  'Cannot judge the recording pin: this is a shallow clone.',
+  '',
+  '`git merge-base --is-ancestor` answers from grafted history, so it would report a verdict this',
+  'guard has no evidence for. Check out with `fetch-depth: 0`.'
+].join('\n')
+
+async function isAncestor(root: string, commit: string, of: string): Promise<boolean> {
+  const ancestor = await git(root, ['merge-base', '--is-ancestor', commit, of])
+  // Why only 0 and 1: git reserves higher codes for real errors, and treating one as "not an
+  // ancestor" would turn a broken repository into a repin instruction nobody can act on.
+  if (ancestor.code !== 0 && ancestor.code !== 1) {
+    throw new Error(`git merge-base --is-ancestor failed: ${ancestor.stderr.trim()}`)
+  }
+  return ancestor.code === 0
+}
+
+/** `owner/repo` from a GitHub remote URL, https or ssh. */
+export function gitHubRepositoryFromRemote(url: string): string | null {
+  const match = /github\.com[:/]([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/.exec(url.trim())
+  return match ? `${match[1]}/${match[2]}` : null
+}
+async function gitHubRepository(root: string): Promise<string> {
+  if (process.env.GITHUB_REPOSITORY) {
+    return process.env.GITHUB_REPOSITORY
+  }
+  const remote = await git(root, ['remote', 'get-url', PIN_REMOTE])
+  const repository = remote.code === 0 ? gitHubRepositoryFromRemote(remote.stdout) : null
+  if (!repository) {
+    throw new Error(
+      `Cannot tell which GitHub repository ${PIN_REMOTE} is ` +
+        `(${remote.stdout.trim() || remote.stderr.trim()}); set GITHUB_REPOSITORY=<owner>/<repo>`
+    )
+  }
+  return repository
+}
+
+/** The pull requests GitHub associates with `commit`, whatever the squash title says. */
+export async function pullRequestsWithCommit(root: string, commit: string): Promise<number[]> {
+  const url = `https://api.github.com/repos/${await gitHubRepository(root)}/commits/${commit}/pulls`
+  const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN
+  const response = await fetch(url, {
+    headers: {
+      Accept: 'application/vnd.github+json',
+      ...(token ? { Authorization: `Bearer ${token}` } : {})
+    },
+    signal: AbortSignal.timeout(PULL_REQUEST_LOOKUP_TIMEOUT_MS)
+  }).catch((error: unknown) => {
+    // Node's fetch hides the network reason (DNS, TLS, reset) in `cause`.
+    const cause = error instanceof Error && error.cause ? ` (${String(error.cause)})` : ''
+    throw new Error(
+      `Could not ask GitHub which pull requests hold ${commit} (${url}): ${String(error)}${cause}`
+    )
+  })
+  const body = await response.text()
+  // GitHub's answer for a commit it has never seen, which no pull request can hold.
+  if (response.status === 422 && body.includes('No commit found')) {
+    return []
+  }
+  if (!response.ok) {
+    const rateLimited = !token && (response.status === 403 || response.status === 429)
+    throw new Error(
+      `GitHub answered ${response.status} to ${url}: ${body.slice(0, 300)}` +
+        (rateLimited
+          ? '\nUnauthenticated GitHub API calls are rate-limited; set GITHUB_TOKEN or GH_TOKEN.'
+          : '')
+    )
+  }
+  const pulls: unknown = JSON.parse(body)
+  if (!Array.isArray(pulls)) {
+    throw new Error(
+      `GitHub answered ${url} with something other than a list: ${body.slice(0, 300)}`
+    )
+  }
+  return pulls.flatMap((pull) => (typeof pull?.number === 'number' ? [pull.number] : []))
+}
+
+/** Fetches a pull request's head into a ref of our own, so no other fetch can move it under us. */
+async function fetchPullRequestHead(root: string, pullRequest: number): Promise<string> {
+  const local = `refs/rpc-recording-pin/pull/${pullRequest}`
+  const fetched = await git(
+    root,
+    ['fetch', '--quiet', '--no-tags', PIN_REMOTE, `+refs/pull/${pullRequest}/head:${local}`],
+    PIN_FETCH_TIMEOUT_MS
+  )
+  if (fetched.code !== 0) {
+    const detail = failureDetail(fetched, PIN_FETCH_TIMEOUT_MS)
+    throw new Error(
+      `Could not fetch refs/pull/${pullRequest}/head from ${PIN_REMOTE}, the head of a pull ` +
+        `request GitHub associates with the recording pin: ${detail}`
+    )
+  }
+  return local
+}
+
+export async function checkPinReachable(
+  root: string,
+  baseline: string,
+  ref: string,
+  pullRequestsHolding: PullRequestLookup = pullRequestsWithCommit
+): Promise<PinReachabilityVerdict> {
+  const shallow = await git(root, ['rev-parse', '--is-shallow-repository'])
+  if (shallow.code !== 0) {
+    throw new Error(`Could not ask git whether the clone is shallow: ${shallow.stderr.trim()}`)
+  }
+  if (shallow.stdout.trim() !== 'false') {
+    return { ok: false, baseline, ref, failure: 'shallow', message: SHALLOW_MESSAGE }
+  }
+  const head = await git(root, ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`])
+  if (head.code !== 0) {
+    throw new Error(`Cannot resolve ${ref} to a commit in this repository`)
+  }
+  // Resolved, because the instruction below is a command to paste: `HEAD` in it moves with whatever
+  // the reader has checked out by the time they read the log.
+  const resolved = head.stdout.trim()
+  const present = async () =>
+    (await git(root, ['rev-parse', '--verify', '--quiet', `${baseline}^{commit}`])).code === 0
+  if ((await present()) && (await isAncestor(root, baseline, ref))) {
+    return { ok: true, baseline, ref, pullRequest: null }
+  }
+  // A squash drops the branch commit the pin names, and the branch may already be deleted, but
+  // GitHub keeps the pull request's head ref for good.
+  const pullRequests = await pullRequestsHolding(root, baseline)
+  for (const pullRequest of pullRequests) {
+    const pullRequestHead = await fetchPullRequestHead(root, pullRequest)
+    if ((await present()) && (await isAncestor(root, baseline, pullRequestHead))) {
+      return { ok: true, baseline, ref, pullRequest }
+    }
+  }
+  const pullRequestCause =
+    pullRequests.length === 0
+      ? 'and GitHub associates no pull request with it'
+      : 'and no head of a pull request GitHub associates with it holds it ' +
+        `(${pullRequests.map((pullRequest) => `refs/pull/${pullRequest}/head`).join(', ')})`
+  if (!(await present())) {
+    return {
+      ok: false,
+      baseline,
+      ref,
+      failure: 'unreachable',
+      message: repinInstruction(
+        baseline,
+        resolved,
+        `is not a commit in this clone, ${pullRequestCause}`
+      )
+    }
+  }
+  return {
+    ok: false,
+    baseline,
+    ref,
+    failure: 'not-an-ancestor',
+    message: repinInstruction(
+      baseline,
+      resolved,
+      `is not an ancestor of this commit, ${pullRequestCause}`
+    )
+  }
+}
diff --git a/mobile/scripts/rpc-recording.mts b/mobile/scripts/rpc-recording.mts
index 7ada953da09..c6034a9246e 100644
--- a/mobile/scripts/rpc-recording.mts
+++ b/mobile/scripts/rpc-recording.mts
@@ -24,7 +24,15 @@ const baseline = await runProcess({
   ],
   cwd: root
 })
-if (baseline.code !== 0) {
+// A pin a squash left only in its pull request's head is a missing object, not product drift.
+if (baseline.code !== 0 && baseline.code !== 1) {
+  throw new Error(
+    `Could not diff against the pinned baseline ${input.baseline}: ${baseline.stderr.trim()}\n` +
+      'If your clone lacks that commit, fetch it with\n' +
+      '  pnpm --dir mobile exec tsx scripts/rpc-recording-pin-guard.mts reachable'
+  )
+}
+if (baseline.code === 1) {
   throw new Error('Product sources or lockfile differ from the pinned main baseline')
 }
 // Why a second check: `git diff` only sees tracked paths, so an untracked module under the
diff --git a/mobile/src/accounts/mobile-accounts-route.test.ts b/mobile/src/accounts/mobile-accounts-route.test.ts
index 0b25d44d3f0..2a77c8a2b3a 100644
--- a/mobile/src/accounts/mobile-accounts-route.test.ts
+++ b/mobile/src/accounts/mobile-accounts-route.test.ts
@@ -1,4 +1,3 @@
-import { readFileSync } from 'node:fs'
 import { describe, expect, it, vi } from 'vitest'
 import { mobileAccountsRouteTarget } from './mobile-accounts-route'
 import {
@@ -7,12 +6,6 @@ import {
   type HostStackNavigationState
 } from '../navigation/host-stack-navigation'
 
-const homeSource = readFileSync(new URL('../home/MobileHomeScreen.tsx', import.meta.url), 'utf8')
-const accountCardsSource = readFileSync(
-  new URL('../home/MobileHomeAccountUsageCards.tsx', import.meta.url),
-  'utf8'
-)
-
 function navigationHarness(initialState: HostStackNavigationState) {
   const stateListeners = new Set<() => void>()
   let state = initialState
@@ -85,10 +78,4 @@ describe('mobile accounts route', () => {
       payload: mobileAccountsRouteTarget('host/one')
     })
   })
-
-  it('opens the home account-usage card through the cold-navigator-safe transition', () => {
-    expect(homeSource).toContain('onOpenAccounts={openMobileAccounts}')
-    expect(accountCardsSource).toContain('props.onOpen(host.id)')
-    expect(accountCardsSource).not.toContain('/accounts`')
-  })
 })
diff --git a/mobile/src/agent-history/agent-history-resume-target.test.ts b/mobile/src/agent-history/agent-history-resume-target.test.ts
index d59feb98e15..9c62fa7b34b 100644
--- a/mobile/src/agent-history/agent-history-resume-target.test.ts
+++ b/mobile/src/agent-history/agent-history-resume-target.test.ts
@@ -1,11 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import {
-  getMobileAiVaultResumeRepoTargetStatus,
-  getMobileAiVaultResumeWorktreeTargetStatus,
-  isSupportedMobileAiVaultResumeTargetStatus,
-  mobileAiVaultResumeTargetBlockMessage,
-  resolveMobileAiVaultSessionResumeTarget
-} from './agent-history-resume-target'
+import { resolveMobileAiVaultSessionResumeTarget } from './agent-history-resume-target'
 import type { AiVaultSession } from '../../../src/shared/ai-vault-types'
 import type { Worktree } from '../worktree/workspace-list-types'
 
@@ -52,27 +46,6 @@ function worktree(overrides: Partial<Worktree> & { worktreeId: string; path: str
 }
 
 describe('mobile AI Vault resume target guards', () => {
-  const worktrees = [
-    { worktreeId: 'local-wt', repoId: 'local-repo' },
-    { worktreeId: 'ssh-wt', repoId: 'ssh-repo' },
-    { worktreeId: 'runtime-wt', repoId: 'runtime-repo' },
-    { worktreeId: 'host-owned-wt', repoId: 'local-repo', hostId: 'ssh:builder' as const },
-    {
-      worktreeId: 'folder:folder-local',
-      repoId: 'folder-workspace:group-local',
-      workspaceKind: 'folder-workspace' as const
-    },
-    {
-      worktreeId: 'folder:folder-ssh',
-      repoId: 'folder-workspace:group-local',
-      workspaceKind: 'folder-workspace' as const
-    },
-    {
-      worktreeId: 'folder:folder-runtime',
-      repoId: 'folder-workspace:group-runtime',
-      workspaceKind: 'folder-workspace' as const
-    }
-  ]
   const repos = [
     { id: 'local-repo', path: '/Users/ada/repo', connectionId: null },
     { id: 'ssh-repo', path: '/home/ada/ssh-repo', connectionId: 'builder' },
@@ -98,68 +71,6 @@ describe('mobile AI Vault resume target guards', () => {
     { id: 'group-runtime', executionHostId: 'runtime:devbox' as const }
   ]
 
-  it('classifies local, SSH, runtime, and unknown repos', () => {
-    expect(getMobileAiVaultResumeRepoTargetStatus(repos[0])).toBe('local')
-    expect(getMobileAiVaultResumeRepoTargetStatus(repos[1])).toBe('ssh')
-    expect(getMobileAiVaultResumeRepoTargetStatus(repos[2])).toBe('runtime')
-    expect(getMobileAiVaultResumeRepoTargetStatus(null)).toBe('unknown')
-  })
-
-  it('classifies worktrees from their repo, with worktree host taking precedence', () => {
-    expect(
-      getMobileAiVaultResumeWorktreeTargetStatus({ worktreeId: 'local-wt', worktrees, repos })
-    ).toBe('local')
-    expect(
-      getMobileAiVaultResumeWorktreeTargetStatus({ worktreeId: 'ssh-wt', worktrees, repos })
-    ).toBe('ssh')
-    expect(
-      getMobileAiVaultResumeWorktreeTargetStatus({ worktreeId: 'runtime-wt', worktrees, repos })
-    ).toBe('runtime')
-    expect(
-      getMobileAiVaultResumeWorktreeTargetStatus({ worktreeId: 'host-owned-wt', worktrees, repos })
-    ).toBe('ssh')
-    expect(
-      getMobileAiVaultResumeWorktreeTargetStatus({
-        worktreeId: 'folder:folder-local',
-        worktrees,
-        repos,
-        folderWorkspaces,
-        projectGroups
-      })
-    ).toBe('local')
-    expect(
-      getMobileAiVaultResumeWorktreeTargetStatus({
-        worktreeId: 'folder:folder-ssh',
-        worktrees,
-        repos,
-        folderWorkspaces,
-        projectGroups
-      })
-    ).toBe('ssh')
-    expect(
-      getMobileAiVaultResumeWorktreeTargetStatus({
-        worktreeId: 'folder:folder-runtime',
-        worktrees,
-        repos,
-        folderWorkspaces,
-        projectGroups
-      })
-    ).toBe('runtime')
-    expect(
-      getMobileAiVaultResumeWorktreeTargetStatus({ worktreeId: 'missing', worktrees, repos })
-    ).toBe('unknown')
-  })
-
-  it('supports local targets only; SSH hosts cannot see host-local transcripts', () => {
-    expect(isSupportedMobileAiVaultResumeTargetStatus('local')).toBe(true)
-    expect(isSupportedMobileAiVaultResumeTargetStatus('ssh')).toBe(false)
-    expect(isSupportedMobileAiVaultResumeTargetStatus('runtime')).toBe(false)
-    expect(mobileAiVaultResumeTargetBlockMessage('runtime')).toContain('runtime-hosted')
-    expect(mobileAiVaultResumeTargetBlockMessage('ssh')).toContain('SSH workspace')
-    expect(mobileAiVaultResumeTargetBlockMessage('ssh')).toContain('local workspace')
-    expect(mobileAiVaultResumeTargetBlockMessage('unknown')).toContain('local workspace')
-  })
-
   it('resolves project-scope rows to the matched session worktree before the route worktree', () => {
     const target = resolveMobileAiVaultSessionResumeTarget({
       session: session({ cwd: '/Users/ada/repo/feature/src' }),
diff --git a/mobile/src/agent-history/agent-history-resume-target.ts b/mobile/src/agent-history/agent-history-resume-target.ts
index a63a7ca92c7..d873a9df58f 100644
--- a/mobile/src/agent-history/agent-history-resume-target.ts
+++ b/mobile/src/agent-history/agent-history-resume-target.ts
@@ -53,7 +53,7 @@ export type MobileAiVaultSessionResumeTarget =
     }
   | { status: 'blocked'; message: string }
 
-export function getMobileAiVaultResumeRepoTargetStatus(
+function getMobileAiVaultResumeRepoTargetStatus(
   repo: MobileAiVaultResumeRepo | null | undefined
 ): MobileAiVaultResumeTargetStatus {
   if (!repo) {
@@ -62,7 +62,7 @@ export function getMobileAiVaultResumeRepoTargetStatus(
   return getMobileAiVaultResumeExecutionHostTargetStatus(getRepoExecutionHostId(repo))
 }
 
-export function getMobileAiVaultResumeWorktreeTargetStatus(args: {
+function getMobileAiVaultResumeWorktreeTargetStatus(args: {
   worktreeId: string | null
   worktrees: readonly MobileAiVaultResumeWorktree[]
   repos: readonly MobileAiVaultResumeRepo[]
@@ -94,7 +94,7 @@ export function getMobileAiVaultResumeWorktreeTargetStatus(args: {
   )
 }
 
-export function isSupportedMobileAiVaultResumeTargetStatus(
+function isSupportedMobileAiVaultResumeTargetStatus(
   status: MobileAiVaultResumeTargetStatus
 ): status is 'local' {
   // Why: mobile sessions come from the host-local transcript scan, so an SSH
@@ -102,9 +102,7 @@ export function isSupportedMobileAiVaultResumeTargetStatus(
   return status === 'local'
 }
 
-export function mobileAiVaultResumeTargetBlockMessage(
-  status: MobileAiVaultResumeTargetStatus
-): string {
+function mobileAiVaultResumeTargetBlockMessage(status: MobileAiVaultResumeTargetStatus): string {
   if (status === 'runtime') {
     return 'Resume from history is not available in runtime-hosted workspaces.'
   }
diff --git a/mobile/src/app-update/app-store-update-source.ts b/mobile/src/app-update/app-store-update-source.ts
new file mode 100644
index 00000000000..cad70e0840d
--- /dev/null
+++ b/mobile/src/app-update/app-store-update-source.ts
@@ -0,0 +1,37 @@
+import { z } from 'zod'
+import type { AppUpdateCheckResult, AppUpdateSource } from './app-update-source'
+import { isNewerReleaseVersion } from './app-update-source'
+
+const LOOKUP_URL = 'https://itunes.apple.com/lookup?bundleId=com.stably.orca.mobile'
+
+type Fetch = typeof fetch
+
+const lookupSchema = z.looseObject({ results: z.array(z.unknown()) })
+const listingSchema = z.looseObject({ version: z.string(), trackViewUrl: z.string() })
+
+/**
+ * The store listing's version and page. TestFlight installs have no receipt signal without a new
+ * dependency; they stay quiet because their build is at or ahead of the store's version.
+ */
+export function parseAppStoreLookup(reply: unknown): { version: string; url: string } | null {
+  const lookup = lookupSchema.safeParse(reply)
+  const listing = listingSchema.safeParse(lookup.success ? lookup.data.results[0] : null)
+  return listing.success ? { version: listing.data.version, url: listing.data.trackViewUrl } : null
+}
+
+export function createAppStoreUpdateSource(fetchImpl: Fetch): AppUpdateSource {
+  return {
+    async check(installedVersion, signal): Promise<AppUpdateCheckResult> {
+      const reply = await fetchImpl(LOOKUP_URL, { signal })
+      if (!reply.ok) {
+        throw new Error(`App Store lookup HTTP ${reply.status}`)
+      }
+      const listing = parseAppStoreLookup(await reply.json())
+      return listing && isNewerReleaseVersion(listing.version, installedVersion)
+        ? { kind: 'available', version: listing.version, url: listing.url }
+        : { kind: 'current' }
+    }
+  }
+}
+
+export const appStoreUpdateSource = createAppStoreUpdateSource((input, init) => fetch(input, init))
diff --git a/mobile/src/app-update/app-update-checker.test.ts b/mobile/src/app-update/app-update-checker.test.ts
new file mode 100644
index 00000000000..c76c7d1be76
--- /dev/null
+++ b/mobile/src/app-update/app-update-checker.test.ts
@@ -0,0 +1,293 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AppUpdatePreferences } from '../storage/app-update-preferences'
+import {
+  APP_UPDATE_CHECK_INTERVAL_MS,
+  createAppUpdateChecker,
+  undismissedAppUpdate,
+  type AppUpdateCheckerDeps
+} from './app-update-checker'
+import type { AppUpdateCheckResult, AppUpdateSource } from './app-update-source'
+
+const HOUR = 60 * 60 * 1000
+const T0 = Date.UTC(2026, 8, 28, 12)
+const RELEASE_051 = { version: '0.0.51', url: 'https://example.test/0.0.51' }
+
+type Harness = ReturnType<typeof harness>
+
+function harness(opts: {
+  stored?: Partial<AppUpdatePreferences>
+  installedVersion?: string
+  replies?: (AppUpdateCheckResult | Error | 'hang' | Promise<AppUpdateCheckResult>)[]
+  load?: Promise<void>
+}) {
+  const replies = [...(opts.replies ?? [])]
+  let foreground: () => void = () => {}
+  const saves: unknown[] = []
+  const source: AppUpdateSource = {
+    check: vi.fn(async () => {
+      const reply = replies.shift() ?? { kind: 'current' }
+      if (reply instanceof Promise) {
+        return reply
+      }
+      if (reply === 'hang') {
+        return new Promise<never>(() => {})
+      }
+      if (reply instanceof Error) {
+        throw reply
+      }
+      return reply
+    })
+  }
+  const deps = {
+    source,
+    installedVersion: opts.installedVersion ?? '0.0.48',
+    now: () => Date.now(),
+    setTimer: (run: () => void, delayMs: number) => setTimeout(run, delayMs),
+    clearTimer: (handle: ReturnType<typeof setTimeout>) => clearTimeout(handle),
+    subscribeForeground: (listener: () => void) => {
+      foreground = listener
+      return () => {
+        foreground = () => {}
+      }
+    },
+    loadPreferences: vi.fn(async () => {
+      await opts.load
+      return {
+        lastCheckedAt: null,
+        latest: null,
+        dismissedVersion: null,
+        ...opts.stored
+      }
+    }),
+    saveCheck: async (checkedAt: number, latest: AppUpdatePreferences['latest']) => {
+      saves.push({ checkedAt, latest })
+    },
+    saveDismissedVersion: async (version: string) => {
+      saves.push({ dismissed: version })
+    }
+  } satisfies AppUpdateCheckerDeps
+  const checker = createAppUpdateChecker(deps)
+  return { checker, source, saves, deps, foreground: () => foreground() }
+}
+
+const checks = (h: Harness) => vi.mocked(h.source.check).mock.calls.length
+
+describe('app update checker', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(T0)
+  })
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('checks on cold start when it has never succeeded, and records the result', async () => {
+    const h = harness({ replies: [{ kind: 'available', ...RELEASE_051 }] })
+    h.checker.start()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(checks(h)).toBe(1)
+    expect(h.checker.getSnapshot()).toMatchObject({ lastCheckedAt: T0, available: RELEASE_051 })
+    expect(h.saves).toEqual([{ checkedAt: T0, latest: RELEASE_051 }])
+  })
+
+  it('skips the cold-start check inside 24 h, then runs it when the day is up', async () => {
+    const h = harness({ stored: { lastCheckedAt: T0 - 2 * HOUR, latest: RELEASE_051 } })
+    h.checker.start()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(checks(h)).toBe(0)
+    expect(h.checker.getSnapshot().available).toEqual(RELEASE_051)
+    await vi.advanceTimersByTimeAsync(22 * HOUR - 1)
+    expect(checks(h)).toBe(0)
+    await vi.advanceTimersByTimeAsync(1)
+    expect(checks(h)).toBe(1)
+  })
+
+  it('checks on foreground only once the last success is 24 h old', async () => {
+    const h = harness({ stored: { lastCheckedAt: T0 - 23 * HOUR } })
+    h.checker.start()
+    await vi.advanceTimersByTimeAsync(0)
+    h.foreground()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(checks(h)).toBe(0)
+    // Background suspends timers; the system clock still moves.
+    vi.setSystemTime(T0 + HOUR)
+    h.foreground()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(checks(h)).toBe(1)
+  })
+
+  it('retries a failed check after 1 h, not sooner, and keeps the last success time', async () => {
+    const h = harness({
+      stored: { lastCheckedAt: T0 - 30 * HOUR },
+      replies: [new Error('offline')]
+    })
+    h.checker.start()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(checks(h)).toBe(1)
+    expect(h.checker.getSnapshot().lastCheckedAt).toBe(T0 - 30 * HOUR)
+    h.foreground()
+    await vi.advanceTimersByTimeAsync(HOUR - 1)
+    expect(checks(h)).toBe(1)
+    await vi.advanceTimersByTimeAsync(1)
+    expect(checks(h)).toBe(2)
+    expect(h.checker.getSnapshot().lastCheckedAt).toBe(T0 + HOUR)
+  })
+
+  it('bounds a check at 8 s and counts it as failed', async () => {
+    const h = harness({ stored: { lastCheckedAt: T0 }, replies: ['hang'] })
+    h.checker.start()
+    const outcome = h.checker.checkNow()
+    await vi.advanceTimersByTimeAsync(8000)
+    await expect(outcome).resolves.toBe('failed')
+    expect(h.checker.getSnapshot().checking).toBe(false)
+  })
+
+  it('joins a manual check to one already in flight', async () => {
+    const h = harness({ stored: { lastCheckedAt: T0 }, replies: [{ kind: 'current' }] })
+    h.checker.start()
+    await vi.advanceTimersByTimeAsync(0)
+    const [first, second] = [h.checker.checkNow(), h.checker.checkNow()]
+    await expect(Promise.all([first, second])).resolves.toEqual(['up-to-date', 'up-to-date'])
+    expect(checks(h)).toBe(1)
+  })
+
+  it('manual check reschedules the next automatic check a full day out', async () => {
+    const h = harness({ stored: { lastCheckedAt: T0 - 23 * HOUR } })
+    h.checker.start()
+    await vi.advanceTimersByTimeAsync(0)
+    await h.checker.checkNow()
+    await vi.advanceTimersByTimeAsync(24 * HOUR - 1)
+    expect(checks(h)).toBe(1)
+    await vi.advanceTimersByTimeAsync(1)
+    expect(checks(h)).toBe(2)
+  })
+
+  it('dismisses one version only; the next release offers again', async () => {
+    const h = harness({
+      stored: { lastCheckedAt: T0 - 25 * HOUR },
+      replies: [
+        { kind: 'available', ...RELEASE_051 },
+        { kind: 'available', version: '0.0.52', url: 'https://example.test/0.0.52' }
+      ]
+    })
+    h.checker.start()
+    await vi.advanceTimersByTimeAsync(0)
+    h.checker.dismiss('0.0.51')
+    await vi.advanceTimersByTimeAsync(0)
+    expect(undismissedAppUpdate(h.checker.getSnapshot())).toBeNull()
+    expect(h.checker.getSnapshot().available).toEqual(RELEASE_051)
+    expect(h.saves).toContainEqual({ dismissed: '0.0.51' })
+    await h.checker.checkNow()
+    expect(undismissedAppUpdate(h.checker.getSnapshot())?.version).toBe('0.0.52')
+  })
+
+  it('keeps a stored dismissal across restarts', async () => {
+    const h = harness({
+      stored: { lastCheckedAt: T0, latest: RELEASE_051, dismissedVersion: '0.0.51' }
+    })
+    h.checker.start()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(undismissedAppUpdate(h.checker.getSnapshot())).toBeNull()
+  })
+
+  it('stops offering a stored update once the binary has been updated to it', async () => {
+    const h = harness({
+      installedVersion: '0.0.51',
+      stored: { lastCheckedAt: T0, latest: RELEASE_051 }
+    })
+    h.checker.start()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(h.checker.getSnapshot().available).toBeNull()
+  })
+
+  it('stops scheduling after stop()', async () => {
+    const h = harness({ stored: { lastCheckedAt: T0 - 2 * HOUR } })
+    const stop = h.checker.start()
+    await vi.advanceTimersByTimeAsync(0)
+    stop()
+    await vi.advanceTimersByTimeAsync(2 * APP_UPDATE_CHECK_INTERVAL_MS)
+    expect(checks(h)).toBe(0)
+  })
+
+  it('keeps the 1 h retry for a manual check that fails while the store is still loading', async () => {
+    let finishLoad: () => void = () => {}
+    const h = harness({
+      stored: { lastCheckedAt: T0 - 30 * HOUR },
+      replies: [new Error('offline')],
+      load: new Promise<void>((resolve) => {
+        finishLoad = resolve
+      })
+    })
+    h.checker.start()
+    const outcome = h.checker.checkNow()
+    finishLoad()
+    await expect(outcome).resolves.toBe('failed')
+    await vi.advanceTimersByTimeAsync(HOUR - 1)
+    expect(checks(h)).toBe(1)
+    await vi.advanceTimersByTimeAsync(1)
+    expect(checks(h)).toBe(2)
+  })
+
+  it('applies one load and runs one check across a StrictMode-style double start', async () => {
+    const h = harness({})
+    h.checker.start()()
+    h.checker.start()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(h.deps.loadPreferences).toHaveBeenCalledTimes(1)
+    expect(checks(h)).toBe(1)
+  })
+
+  function deferredReply() {
+    let answer: (result: AppUpdateCheckResult) => void = () => {}
+    const reply = new Promise<AppUpdateCheckResult>((resolve) => {
+      answer = resolve
+    })
+    return { reply, answer: (result: AppUpdateCheckResult) => answer(result) }
+  }
+
+  it('arms no timer for a check that finishes after stop()', async () => {
+    const pending = deferredReply()
+    const h = harness({ stored: { lastCheckedAt: T0 }, replies: [pending.reply] })
+    const stop = h.checker.start()
+    await vi.advanceTimersByTimeAsync(0)
+    const outcome = h.checker.checkNow()
+    await vi.advanceTimersByTimeAsync(0)
+    stop()
+    pending.answer({ kind: 'current' })
+    await outcome
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('schedules the next check when a check in flight across stop and restart completes', async () => {
+    const pending = deferredReply()
+    const h = harness({ stored: { lastCheckedAt: T0 }, replies: [pending.reply] })
+    const stop = h.checker.start()
+    await vi.advanceTimersByTimeAsync(0)
+    const outcome = h.checker.checkNow()
+    await vi.advanceTimersByTimeAsync(0)
+    stop()
+    h.checker.start()
+    await vi.advanceTimersByTimeAsync(0)
+    pending.answer({ kind: 'current' })
+    await outcome
+    expect(vi.getTimerCount()).toBe(1)
+    await vi.advanceTimersByTimeAsync(24 * HOUR)
+    expect(checks(h)).toBe(2)
+  })
+
+  it('runs the check when the armed timer fires even if the clock stepped back', async () => {
+    const h = harness({ stored: { lastCheckedAt: T0 - 2 * HOUR } })
+    h.checker.start()
+    await vi.advanceTimersByTimeAsync(0)
+    vi.setSystemTime(Date.now() - 10 * 60 * 1000)
+    await vi.advanceTimersByTimeAsync(22 * HOUR)
+    expect(checks(h)).toBe(1)
+  })
+
+  it('treats a stored check time ahead of the clock as never checked', async () => {
+    const h = harness({ stored: { lastCheckedAt: T0 + 365 * 24 * HOUR } })
+    h.checker.start()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(checks(h)).toBe(1)
+  })
+})
diff --git a/mobile/src/app-update/app-update-checker.ts b/mobile/src/app-update/app-update-checker.ts
new file mode 100644
index 00000000000..7c2855d9373
--- /dev/null
+++ b/mobile/src/app-update/app-update-checker.ts
@@ -0,0 +1,202 @@
+import type { AppUpdatePreferences, KnownAppUpdate } from '../storage/app-update-preferences'
+import { EMPTY_APP_UPDATE_PREFERENCES } from '../storage/app-update-preferences'
+import type { AppUpdateSource } from './app-update-source'
+import { isNewerReleaseVersion } from './app-update-source'
+
+// Same cadence as the desktop updater (src/main/updater-events.ts).
+export const APP_UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000
+const APP_UPDATE_RETRY_INTERVAL_MS = 60 * 60 * 1000
+const APP_UPDATE_CHECK_TIMEOUT_MS = 8000
+
+type TimerHandle = ReturnType<typeof setTimeout>
+
+export type AppUpdateCheckOutcome = 'available' | 'up-to-date' | 'failed'
+
+export type AppUpdateState = {
+  readonly lastCheckedAt: number | null
+  /** Newer than the installed binary; recomputed from `latest`, so installing it clears this. */
+  readonly available: KnownAppUpdate | null
+  readonly dismissedVersion: string | null
+  readonly checking: boolean
+}
+
+/** The update home should offer: dismissal hides only the version that was dismissed. */
+export function undismissedAppUpdate(state: AppUpdateState): KnownAppUpdate | null {
+  return state.available && state.available.version !== state.dismissedVersion
+    ? state.available
+    : null
+}
+
+export type AppUpdateCheckerDeps = {
+  source: AppUpdateSource | null
+  installedVersion: string | null
+  now: () => number
+  setTimer: (run: () => void, delayMs: number) => TimerHandle
+  clearTimer: (handle: TimerHandle) => void
+  subscribeForeground: (onForeground: () => void) => () => void
+  loadPreferences: () => Promise<AppUpdatePreferences>
+  saveCheck: (checkedAt: number, latest: KnownAppUpdate | null) => Promise<void>
+  saveDismissedVersion: (version: string) => Promise<void>
+}
+
+export function createAppUpdateChecker(deps: AppUpdateCheckerDeps) {
+  let prefs = EMPTY_APP_UPDATE_PREFERENCES
+  let loaded: Promise<void> | null = null
+  let inFlight: Promise<AppUpdateCheckOutcome> | null = null
+  let nextDueAt = 0
+  let timer: TimerHandle | null = null
+  let activeStarts = 0
+  let snapshot = buildSnapshot()
+  const listeners = new Set<() => void>()
+
+  function buildSnapshot(): AppUpdateState {
+    const latest = prefs.latest
+    const available =
+      latest &&
+      deps.installedVersion &&
+      isNewerReleaseVersion(latest.version, deps.installedVersion)
+        ? latest
+        : null
+    return {
+      lastCheckedAt: prefs.lastCheckedAt,
+      available,
+      dismissedVersion: prefs.dismissedVersion,
+      checking: inFlight !== null
+    }
+  }
+
+  function publish(): void {
+    snapshot = buildSnapshot()
+    for (const listener of listeners) {
+      listener()
+    }
+  }
+
+  function clearScheduled(): void {
+    if (timer !== null) {
+      deps.clearTimer(timer)
+      timer = null
+    }
+  }
+
+  function schedule(dueAt: number): void {
+    nextDueAt = dueAt
+    clearScheduled()
+    if (activeStarts > 0) {
+      timer = deps.setTimer(
+        () => {
+          timer = null
+          // The timer is the due time; re-reading the wall clock would stall on a clock step back.
+          if (activeStarts > 0 && inFlight === null) {
+            void checkNow()
+          }
+        },
+        Math.max(0, dueAt - deps.now())
+      )
+    }
+  }
+
+  /** The stored state is read once; every check and dismissal waits for it, so none is overwritten. */
+  function ensureLoaded(): Promise<void> {
+    loaded ??= deps.loadPreferences().then((stored) => {
+      prefs = stored
+      // A stored check time ahead of the clock (clock since corrected) would defer the next check.
+      const checkedAt = stored.lastCheckedAt
+      nextDueAt =
+        checkedAt === null || checkedAt > deps.now() ? 0 : checkedAt + APP_UPDATE_CHECK_INTERVAL_MS
+      publish()
+    })
+    return loaded
+  }
+
+  function runIfDue(): void {
+    void ensureLoaded().then(() => {
+      if (activeStarts > 0 && inFlight === null && deps.now() >= nextDueAt) {
+        void checkNow()
+      }
+    })
+  }
+
+  async function runCheck(source: AppUpdateSource, installed: string) {
+    await ensureLoaded()
+    const controller = new AbortController()
+    // Why race: the bound holds even for a request that does not honour the signal.
+    const timedOut = new Promise<never>((_, reject) => {
+      controller.signal.addEventListener('abort', () => reject(new Error('update check timed out')))
+    })
+    const timeout = deps.setTimer(() => controller.abort(), APP_UPDATE_CHECK_TIMEOUT_MS)
+    try {
+      const result = await Promise.race([source.check(installed, controller.signal), timedOut])
+      const checkedAt = deps.now()
+      const latest =
+        result.kind === 'available' ? { version: result.version, url: result.url } : null
+      prefs = { ...prefs, lastCheckedAt: checkedAt, latest }
+      schedule(checkedAt + APP_UPDATE_CHECK_INTERVAL_MS)
+      await deps.saveCheck(checkedAt, latest).catch(() => {})
+      return latest ? 'available' : 'up-to-date'
+    } catch {
+      schedule(deps.now() + APP_UPDATE_RETRY_INTERVAL_MS)
+      return 'failed'
+    } finally {
+      deps.clearTimer(timeout)
+    }
+  }
+
+  /** Runs now whatever the cadence says; joins a check already in flight. */
+  function checkNow(): Promise<AppUpdateCheckOutcome> {
+    const { source, installedVersion } = deps
+    if (!source || !installedVersion) {
+      return Promise.resolve('failed')
+    }
+    if (inFlight === null) {
+      inFlight = runCheck(source, installedVersion).finally(() => {
+        inFlight = null
+        publish()
+      })
+      publish()
+    }
+    return inFlight
+  }
+
+  /** Cold start: reads what the last run saw, then checks only if the cadence says it is due. */
+  function start(): () => void {
+    let active = true
+    activeStarts += 1
+    const unsubscribe = deps.subscribeForeground(runIfDue)
+    void ensureLoaded().then(() => {
+      if (active && inFlight === null) {
+        schedule(nextDueAt)
+      }
+    })
+    return () => {
+      if (!active) {
+        return
+      }
+      active = false
+      activeStarts -= 1
+      unsubscribe()
+      if (activeStarts === 0) {
+        clearScheduled()
+      }
+    }
+  }
+
+  function dismiss(version: string): void {
+    void ensureLoaded().then(() => {
+      prefs = { ...prefs, dismissedVersion: version }
+      publish()
+      void deps.saveDismissedVersion(version).catch(() => {})
+    })
+  }
+
+  return {
+    start,
+    checkNow,
+    dismiss,
+    getSnapshot: (): AppUpdateState => snapshot,
+    subscribe(listener: () => void): () => void {
+      listeners.add(listener)
+      return () => listeners.delete(listener)
+    }
+  }
+}
diff --git a/mobile/src/app-update/app-update-runtime.ts b/mobile/src/app-update/app-update-runtime.ts
new file mode 100644
index 00000000000..aa2d72c7608
--- /dev/null
+++ b/mobile/src/app-update/app-update-runtime.ts
@@ -0,0 +1,59 @@
+import Constants from 'expo-constants'
+import * as Linking from 'expo-linking'
+import { useSyncExternalStore } from 'react'
+import { AppState, Platform } from 'react-native'
+import {
+  loadAppUpdatePreferences,
+  saveAppUpdateCheck,
+  saveDismissedAppUpdateVersion
+} from '../storage/app-update-preferences'
+import { appStoreUpdateSource } from './app-store-update-source'
+import { createAppUpdateChecker, type AppUpdateState } from './app-update-checker'
+import type { AppUpdateSource } from './app-update-source'
+import { githubReleaseUpdateSource } from './github-release-update-source'
+
+/**
+ * Invariant: this app does not use expo-updates, so `expoConfig` is the manifest embedded in the
+ * binary and its version is the binary's (app.json `version`, Android `versionName`). SDK 55
+ * removed `Constants.nativeAppVersion`; adopting expo-updates would make this the update's version.
+ */
+export const installedAppVersion: string | null = Constants.expoConfig?.version ?? null
+
+/** The channel that installed this binary. */
+function resolveAppUpdateSource(): AppUpdateSource | null {
+  if (Platform.OS === 'android') {
+    return githubReleaseUpdateSource
+  }
+  if (Platform.OS === 'ios') {
+    return appStoreUpdateSource
+  }
+  return null
+}
+
+export const appUpdateChecker = createAppUpdateChecker({
+  source: resolveAppUpdateSource(),
+  installedVersion: installedAppVersion,
+  now: () => Date.now(),
+  setTimer: (run, delayMs) => setTimeout(run, delayMs),
+  clearTimer: (handle) => clearTimeout(handle),
+  subscribeForeground: (onForeground) => {
+    const subscription = AppState.addEventListener('change', (state) => {
+      if (state === 'active') {
+        onForeground()
+      }
+    })
+    return () => subscription.remove()
+  },
+  loadPreferences: loadAppUpdatePreferences,
+  saveCheck: saveAppUpdateCheck,
+  saveDismissedVersion: saveDismissedAppUpdateVersion
+})
+
+export function useAppUpdateState(): AppUpdateState {
+  return useSyncExternalStore(appUpdateChecker.subscribe, appUpdateChecker.getSnapshot)
+}
+
+/** Opens the channel's page for the update: the GitHub release (Android) or App Store (iOS). */
+export function openAppUpdate(url: string): void {
+  void Linking.openURL(url).catch(() => {})
+}
diff --git a/mobile/src/app-update/app-update-source.ts b/mobile/src/app-update/app-update-source.ts
new file mode 100644
index 00000000000..3fe41b7a1ab
--- /dev/null
+++ b/mobile/src/app-update/app-update-source.ts
@@ -0,0 +1,24 @@
+import {
+  compareAppVersions,
+  isPrereleaseAppVersion,
+  isValidAppVersion
+} from '../../../src/shared/app-version'
+
+export type AppUpdateCheckResult =
+  | { kind: 'available'; version: string; url: string }
+  | { kind: 'current' }
+
+/** One install channel. Rejects when the channel could not be asked; never retries itself. */
+export type AppUpdateSource = {
+  check(installedVersion: string, signal: AbortSignal): Promise<AppUpdateCheckResult>
+}
+
+/** True for a plain release version newer than the installed one; prerelease suffixes never qualify. */
+export function isNewerReleaseVersion(candidate: string, installed: string): boolean {
+  return (
+    isValidAppVersion(candidate) &&
+    isValidAppVersion(installed) &&
+    !isPrereleaseAppVersion(candidate) &&
+    compareAppVersions(candidate, installed) > 0
+  )
+}
diff --git a/mobile/src/app-update/app-update-sources.test.ts b/mobile/src/app-update/app-update-sources.test.ts
new file mode 100644
index 00000000000..22c04b641a7
--- /dev/null
+++ b/mobile/src/app-update/app-update-sources.test.ts
@@ -0,0 +1,196 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+import { createAppStoreUpdateSource, parseAppStoreLookup } from './app-store-update-source'
+import { isNewerReleaseVersion } from './app-update-source'
+import {
+  createGithubReleaseUpdateSource,
+  installableReleaseUrl,
+  parseMobileAndroidTagVersions
+} from './github-release-update-source'
+
+// Recorded once from the live endpoints on 2026-09-28, unedited.
+function fixture(name: string): unknown {
+  return JSON.parse(readFileSync(new URL(`./fixtures/${name}`, import.meta.url), 'utf8'))
+}
+const tagRefs = fixture('github-mobile-android-tag-refs.json')
+const release050 = fixture('github-release-mobile-android-v0.0.50.json')
+const lookup = fixture('itunes-lookup-com.stably.orca.mobile.json')
+
+const REFS_URL =
+  'https://api.github.com/repos/stablyai/orca/git/matching-refs/tags/mobile-android-v'
+const releaseUrl = (version: string) =>
+  `https://api.github.com/repos/stablyai/orca/releases/tags/mobile-android-v${version}`
+
+function fakeFetch(routes: Record<string, { status: number; body?: unknown }>) {
+  const requested: string[] = []
+  const fetchImpl: typeof fetch = async (input) => {
+    const url = String(input)
+    requested.push(url)
+    const route = routes[url]
+    if (!route) {
+      throw new Error(`unexpected request ${url}`)
+    }
+    return new Response(JSON.stringify(route.body ?? {}), { status: route.status })
+  }
+  return { fetchImpl, requested }
+}
+
+const signal = new AbortController().signal
+
+describe('version compare', () => {
+  it('orders plain versions numerically and ignores prerelease or malformed candidates', () => {
+    expect(isNewerReleaseVersion('0.0.51', '0.0.48')).toBe(true)
+    expect(isNewerReleaseVersion('0.0.10', '0.0.9')).toBe(true)
+    expect(isNewerReleaseVersion('0.0.48', '0.0.48')).toBe(false)
+    expect(isNewerReleaseVersion('0.0.47', '0.0.48')).toBe(false)
+    expect(isNewerReleaseVersion('0.0.52-rc.1', '0.0.48')).toBe(false)
+    expect(isNewerReleaseVersion('latest', '0.0.48')).toBe(false)
+  })
+})
+
+describe('GitHub release source (Android sideload)', () => {
+  it('reads every mobile-android tag from the recorded refs', () => {
+    const versions = parseMobileAndroidTagVersions(tagRefs)
+    expect(versions).toHaveLength(24)
+    expect(versions).toContain('0.0.50')
+    expect(versions).not.toContain('0.0.49')
+  })
+
+  it('accepts the recorded release only because it is published with an APK', () => {
+    expect(installableReleaseUrl(release050)).toBe(
+      'https://github.com/stablyai/orca/releases/tag/mobile-android-v0.0.50'
+    )
+    expect(installableReleaseUrl({ ...Object(release050), draft: true })).toBeNull()
+    expect(installableReleaseUrl({ ...Object(release050), assets: [] })).toBeNull()
+  })
+
+  it('offers the newest tag above the installed version once its release is proven', async () => {
+    const { fetchImpl, requested } = fakeFetch({
+      [REFS_URL]: { status: 200, body: tagRefs },
+      [releaseUrl('0.0.50')]: { status: 200, body: release050 }
+    })
+    await expect(
+      createGithubReleaseUpdateSource(fetchImpl).check('0.0.47', signal)
+    ).resolves.toEqual({
+      kind: 'available',
+      version: '0.0.50',
+      url: 'https://github.com/stablyai/orca/releases/tag/mobile-android-v0.0.50'
+    })
+    expect(requested).toEqual([REFS_URL, releaseUrl('0.0.50')])
+  })
+
+  it('falls back past a tag whose build never published a release', async () => {
+    const release048 = { ...Object(release050), html_url: 'https://example.test/048' }
+    const { fetchImpl } = fakeFetch({
+      [REFS_URL]: { status: 200, body: tagRefs },
+      [releaseUrl('0.0.50')]: { status: 404 },
+      [releaseUrl('0.0.48')]: { status: 200, body: release048 }
+    })
+    await expect(
+      createGithubReleaseUpdateSource(fetchImpl).check('0.0.47', signal)
+    ).resolves.toEqual({
+      kind: 'available',
+      version: '0.0.48',
+      url: 'https://example.test/048'
+    })
+  })
+
+  it('probes at most three candidates and then reports current', async () => {
+    const { fetchImpl, requested } = fakeFetch({
+      [REFS_URL]: { status: 200, body: tagRefs },
+      [releaseUrl('0.0.50')]: { status: 404 },
+      [releaseUrl('0.0.48')]: { status: 404 },
+      [releaseUrl('0.0.47')]: { status: 404 }
+    })
+    await expect(
+      createGithubReleaseUpdateSource(fetchImpl).check('0.0.14', signal)
+    ).resolves.toEqual({
+      kind: 'current'
+    })
+    expect(requested).toHaveLength(4)
+  })
+
+  it('makes no release probe when nothing is newer', async () => {
+    const { fetchImpl, requested } = fakeFetch({ [REFS_URL]: { status: 200, body: tagRefs } })
+    await expect(
+      createGithubReleaseUpdateSource(fetchImpl).check('0.0.51', signal)
+    ).resolves.toEqual({
+      kind: 'current'
+    })
+    expect(requested).toEqual([REFS_URL])
+  })
+
+  it('opens the release page GitHub reports, not one built from the tag', async () => {
+    const renamed = {
+      ...Object(release050),
+      html_url: 'https://github.com/stablyai/orca/releases/tag/renamed-page'
+    }
+    const { fetchImpl } = fakeFetch({
+      [REFS_URL]: { status: 200, body: tagRefs },
+      [releaseUrl('0.0.50')]: { status: 200, body: renamed }
+    })
+    await expect(
+      createGithubReleaseUpdateSource(fetchImpl).check('0.0.48', signal)
+    ).resolves.toEqual({
+      kind: 'available',
+      version: '0.0.50',
+      url: 'https://github.com/stablyai/orca/releases/tag/renamed-page'
+    })
+  })
+
+  it('rejects on a release probe 5xx instead of moving to an older candidate', async () => {
+    const { fetchImpl, requested } = fakeFetch({
+      [REFS_URL]: { status: 200, body: tagRefs },
+      [releaseUrl('0.0.50')]: { status: 502 }
+    })
+    await expect(
+      createGithubReleaseUpdateSource(fetchImpl).check('0.0.47', signal)
+    ).rejects.toThrow('release HTTP 502')
+    expect(requested).toEqual([REFS_URL, releaseUrl('0.0.50')])
+  })
+
+  it('rejects when a release probe cannot reach GitHub', async () => {
+    const { fetchImpl } = fakeFetch({ [REFS_URL]: { status: 200, body: tagRefs } })
+    await expect(
+      createGithubReleaseUpdateSource(fetchImpl).check('0.0.47', signal)
+    ).rejects.toThrow('unexpected request')
+  })
+
+  it('rejects when GitHub refuses, so the check counts as failed rather than current', async () => {
+    const { fetchImpl } = fakeFetch({ [REFS_URL]: { status: 403 } })
+    await expect(
+      createGithubReleaseUpdateSource(fetchImpl).check('0.0.47', signal)
+    ).rejects.toThrow('tag refs HTTP 403')
+  })
+})
+
+describe('App Store source (iOS)', () => {
+  const LOOKUP = 'https://itunes.apple.com/lookup?bundleId=com.stably.orca.mobile'
+
+  it('reads the store version and App Store page from the recorded lookup', () => {
+    expect(parseAppStoreLookup(lookup)).toEqual({
+      version: '0.0.51',
+      url: 'https://apps.apple.com/us/app/orca-ide/id6766130217?uo=4'
+    })
+  })
+
+  it('offers the store version only when it is newer than the installed one', async () => {
+    const { fetchImpl } = fakeFetch({ [LOOKUP]: { status: 200, body: lookup } })
+    const source = createAppStoreUpdateSource(fetchImpl)
+    await expect(source.check('0.0.48', signal)).resolves.toEqual({
+      kind: 'available',
+      version: '0.0.51',
+      url: 'https://apps.apple.com/us/app/orca-ide/id6766130217?uo=4'
+    })
+    await expect(source.check('0.0.51', signal)).resolves.toEqual({ kind: 'current' })
+  })
+
+  it('stays quiet when the lookup has no listing for this bundle id', async () => {
+    const { fetchImpl } = fakeFetch({
+      [LOOKUP]: { status: 200, body: { resultCount: 0, results: [] } }
+    })
+    await expect(createAppStoreUpdateSource(fetchImpl).check('0.0.1', signal)).resolves.toEqual({
+      kind: 'current'
+    })
+  })
+})
diff --git a/mobile/src/app-update/fixtures/github-mobile-android-tag-refs.json b/mobile/src/app-update/fixtures/github-mobile-android-tag-refs.json
new file mode 100644
index 00000000000..8be30db967b
--- /dev/null
+++ b/mobile/src/app-update/fixtures/github-mobile-android-tag-refs.json
@@ -0,0 +1,242 @@
+[
+  {
+    "ref": "refs/tags/mobile-android-v0.0.14",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjE0",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.14",
+    "object": {
+      "sha": "3247256da0e73409104e17ebf1c476a5cb60b3cf",
+      "type": "tag",
+      "url": "https://api.github.com/repos/stablyai/orca/git/tags/3247256da0e73409104e17ebf1c476a5cb60b3cf"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.15",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjE1",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.15",
+    "object": {
+      "sha": "7b8adaf5f943f1b07668a8e38662690fd8cbf0d0",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/7b8adaf5f943f1b07668a8e38662690fd8cbf0d0"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.16",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjE2",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.16",
+    "object": {
+      "sha": "20882d7a25c33a43b50ea19462a0e50f2deb11c4",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/20882d7a25c33a43b50ea19462a0e50f2deb11c4"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.17",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjE3",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.17",
+    "object": {
+      "sha": "c50391df84ee4034eca2cd5da49ca9ae4c5c4f7d",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/c50391df84ee4034eca2cd5da49ca9ae4c5c4f7d"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.18",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjE4",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.18",
+    "object": {
+      "sha": "9256bd39daaeda0fd86b67f1f50e70850e4f0005",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/9256bd39daaeda0fd86b67f1f50e70850e4f0005"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.19",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjE5",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.19",
+    "object": {
+      "sha": "d7322ec1f239db245c557f85370600ca67639137",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/d7322ec1f239db245c557f85370600ca67639137"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.21",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjIx",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.21",
+    "object": {
+      "sha": "ad13532ab1f8ea31fc434da4d503ba0c93260fb3",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/ad13532ab1f8ea31fc434da4d503ba0c93260fb3"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.22",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjIy",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.22",
+    "object": {
+      "sha": "748bced2e61d47444d6536eecadf8484394e4609",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/748bced2e61d47444d6536eecadf8484394e4609"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.24",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjI0",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.24",
+    "object": {
+      "sha": "3c963dd285783609ab0367cfd95a6b45de2b1603",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/3c963dd285783609ab0367cfd95a6b45de2b1603"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.25",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjI1",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.25",
+    "object": {
+      "sha": "d1cc78d5c5229478fb9f1675a3d3f506d332b367",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/d1cc78d5c5229478fb9f1675a3d3f506d332b367"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.26",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjI2",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.26",
+    "object": {
+      "sha": "cf04845f5b4d787292f041b05f839a8e151fa41b",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/cf04845f5b4d787292f041b05f839a8e151fa41b"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.27",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjI3",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.27",
+    "object": {
+      "sha": "20ebe858af628f3e2b5f73838310636dec6fe0ed",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/20ebe858af628f3e2b5f73838310636dec6fe0ed"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.30",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjMw",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.30",
+    "object": {
+      "sha": "ef87461bfe0346bcef163db971c990ea3adce495",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/ef87461bfe0346bcef163db971c990ea3adce495"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.31",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjMx",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.31",
+    "object": {
+      "sha": "1c275336eddf252a1d1378f9b55a6033278999e8",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/1c275336eddf252a1d1378f9b55a6033278999e8"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.32",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjMy",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.32",
+    "object": {
+      "sha": "c445f26541a0ecb465fc28a7e1a7b5ee5624a0dd",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/c445f26541a0ecb465fc28a7e1a7b5ee5624a0dd"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.36",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjM2",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.36",
+    "object": {
+      "sha": "4543bb68263a89ab520cea62ca69d7ac78330dd3",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/4543bb68263a89ab520cea62ca69d7ac78330dd3"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.37",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjM3",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.37",
+    "object": {
+      "sha": "5a2b329d8d7e96c974aecf4d3e12b707abd7d732",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/5a2b329d8d7e96c974aecf4d3e12b707abd7d732"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.42",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjQy",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.42",
+    "object": {
+      "sha": "20aeb0cb990a17f328b673f51717824d2f9c10ea",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/20aeb0cb990a17f328b673f51717824d2f9c10ea"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.43",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjQz",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.43",
+    "object": {
+      "sha": "cbca291aa7d7270fe8ed8cac5d08fc0b0910c309",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/cbca291aa7d7270fe8ed8cac5d08fc0b0910c309"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.44",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjQ0",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.44",
+    "object": {
+      "sha": "ecfc547ece7aa9483547df26661e90927d1983cc",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/ecfc547ece7aa9483547df26661e90927d1983cc"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.46",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjQ2",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.46",
+    "object": {
+      "sha": "47d462743c2b990b95942c75fb2c1c2493d7f478",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/47d462743c2b990b95942c75fb2c1c2493d7f478"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.47",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjQ3",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.47",
+    "object": {
+      "sha": "38c61379ffd19d3f573877ecfa1099e3616974dd",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/38c61379ffd19d3f573877ecfa1099e3616974dd"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.48",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjQ4",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.48",
+    "object": {
+      "sha": "7e3840a0683f83831502e15f583856fab8977685",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/7e3840a0683f83831502e15f583856fab8977685"
+    }
+  },
+  {
+    "ref": "refs/tags/mobile-android-v0.0.50",
+    "node_id": "REF_kwDORpCz1toAIHJlZnMvdGFncy9tb2JpbGUtYW5kcm9pZC12MC4wLjUw",
+    "url": "https://api.github.com/repos/stablyai/orca/git/refs/tags/mobile-android-v0.0.50",
+    "object": {
+      "sha": "b5ee803d6c45dda9cfd4bb49d58aac47a22ebdc3",
+      "type": "commit",
+      "url": "https://api.github.com/repos/stablyai/orca/git/commits/b5ee803d6c45dda9cfd4bb49d58aac47a22ebdc3"
+    }
+  }
+]
diff --git a/mobile/src/app-update/fixtures/github-release-mobile-android-v0.0.50.json b/mobile/src/app-update/fixtures/github-release-mobile-android-v0.0.50.json
new file mode 100644
index 00000000000..96976684578
--- /dev/null
+++ b/mobile/src/app-update/fixtures/github-release-mobile-android-v0.0.50.json
@@ -0,0 +1,92 @@
+{
+  "url": "https://api.github.com/repos/stablyai/orca/releases/391254643",
+  "assets_url": "https://api.github.com/repos/stablyai/orca/releases/391254643/assets",
+  "upload_url": "https://uploads.github.com/repos/stablyai/orca/releases/391254643/assets{?name,label}",
+  "html_url": "https://github.com/stablyai/orca/releases/tag/mobile-android-v0.0.50",
+  "id": 391254643,
+  "author": {
+    "login": "github-actions[bot]",
+    "id": 41898282,
+    "node_id": "MDM6Qm90NDE4OTgyODI=",
+    "avatar_url": "https://avatars.githubusercontent.com/in/15368?v=4",
+    "gravatar_id": "",
+    "url": "https://api.github.com/users/github-actions%5Bbot%5D",
+    "html_url": "https://github.com/apps/github-actions",
+    "followers_url": "https://api.github.com/users/github-actions%5Bbot%5D/followers",
+    "following_url": "https://api.github.com/users/github-actions%5Bbot%5D/following{/other_user}",
+    "gists_url": "https://api.github.com/users/github-actions%5Bbot%5D/gists{/gist_id}",
+    "starred_url": "https://api.github.com/users/github-actions%5Bbot%5D/starred{/owner}{/repo}",
+    "subscriptions_url": "https://api.github.com/users/github-actions%5Bbot%5D/subscriptions",
+    "organizations_url": "https://api.github.com/users/github-actions%5Bbot%5D/orgs",
+    "repos_url": "https://api.github.com/users/github-actions%5Bbot%5D/repos",
+    "events_url": "https://api.github.com/users/github-actions%5Bbot%5D/events{/privacy}",
+    "received_events_url": "https://api.github.com/users/github-actions%5Bbot%5D/received_events",
+    "type": "Bot",
+    "user_view_type": "public",
+    "site_admin": false
+  },
+  "node_id": "RE_kwDORpCz1s4XUhJz",
+  "tag_name": "mobile-android-v0.0.50",
+  "target_commitish": "main",
+  "name": "Orca Mobile Android mobile-android-v0.0.50",
+  "draft": false,
+  "immutable": false,
+  "prerelease": true,
+  "created_at": "2026-09-18T02:37:26Z",
+  "updated_at": "2026-09-18T06:19:48Z",
+  "published_at": "2026-09-18T06:19:48Z",
+  "assets": [
+    {
+      "url": "https://api.github.com/repos/stablyai/orca/releases/assets/571968911",
+      "id": 571968911,
+      "node_id": "RA_kwDORpCz1s4iF42P",
+      "name": "app-release.apk",
+      "label": "",
+      "uploader": {
+        "login": "github-actions[bot]",
+        "id": 41898282,
+        "node_id": "MDM6Qm90NDE4OTgyODI=",
+        "avatar_url": "https://avatars.githubusercontent.com/in/15368?v=4",
+        "gravatar_id": "",
+        "url": "https://api.github.com/users/github-actions%5Bbot%5D",
+        "html_url": "https://github.com/apps/github-actions",
+        "followers_url": "https://api.github.com/users/github-actions%5Bbot%5D/followers",
+        "following_url": "https://api.github.com/users/github-actions%5Bbot%5D/following{/other_user}",
+        "gists_url": "https://api.github.com/users/github-actions%5Bbot%5D/gists{/gist_id}",
+        "starred_url": "https://api.github.com/users/github-actions%5Bbot%5D/starred{/owner}{/repo}",
+        "subscriptions_url": "https://api.github.com/users/github-actions%5Bbot%5D/subscriptions",
+        "organizations_url": "https://api.github.com/users/github-actions%5Bbot%5D/orgs",
+        "repos_url": "https://api.github.com/users/github-actions%5Bbot%5D/repos",
+        "events_url": "https://api.github.com/users/github-actions%5Bbot%5D/events{/privacy}",
+        "received_events_url": "https://api.github.com/users/github-actions%5Bbot%5D/received_events",
+        "type": "Bot",
+        "user_view_type": "public",
+        "site_admin": false
+      },
+      "content_type": "application/vnd.android.package-archive",
+      "state": "uploaded",
+      "size": 133555371,
+      "digest": "sha256:79b285ca678e0fa00859f5d9348bfdd9d291eff7e1261cd12012c21e2234bad1",
+      "download_count": 10693,
+      "created_at": "2026-09-18T06:19:42Z",
+      "updated_at": "2026-09-18T06:19:46Z",
+      "browser_download_url": "https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.50/app-release.apk"
+    }
+  ],
+  "tarball_url": "https://api.github.com/repos/stablyai/orca/tarball/mobile-android-v0.0.50",
+  "zipball_url": "https://api.github.com/repos/stablyai/orca/zipball/mobile-android-v0.0.50",
+  "body": "## What's Changed\n* Keep the floating workspace above a working native chat pane by @brennanb2025 in https://github.com/stablyai/orca/pull/18692\n* feat(relay-infra): dynamic NAT ports and alerts for the 2026-09-04 stall signals by @Jinwoo-H in https://github.com/stablyai/orca/pull/18693\n* fix(orca-profiles): tell the renderer when a cloud session is revoked by @Jinwoo-H in https://github.com/stablyai/orca/pull/18694\n* feat(relay): tell the phone when its desktop is signed out by @Jinwoo-H in https://github.com/stablyai/orca/pull/18698\n* perf(orchestration): bound the worker terminal archive in linear time by @nwparker in https://github.com/stablyai/orca/pull/18622\n* fix(startup): apply the HTTP/1.1 compatibility toggle for migrated profiles, and stop parsing the settings file pre-ready by @nwparker in https://github.com/stablyai/orca/pull/18621\n* perf(git): overlap the three independent submodule status reads by @nwparker in https://github.com/stablyai/orca/pull/18623\n* test(renderer): pin the runtime-target selector identity stability that #18685 fixed by @nwparker in https://github.com/stablyai/orca/pull/18625\n* perf(terminal): stop copying every PTY chunk for two startup-error detectors by @nwparker in https://github.com/stablyai/orca/pull/18626\n* perf(terminal): gate the Command Code banner scan before building its scan windows by @nwparker in https://github.com/stablyai/orca/pull/18628\n* perf(editor): build the closing-fence pattern once per fence, not once per line by @nwparker in https://github.com/stablyai/orca/pull/18629\n* perf(right-sidebar): cache the active checks status instead of rebuilding its cache keys per store write by @nwparker in https://github.com/stablyai/orca/pull/18631\n* perf(renderer): stop two store selectors allocating on every write by @nwparker in https://github.com/stablyai/orca/pull/18632\n* perf(source-control): stop reconciling selection on every panel render by @nwparker in https://github.com/stablyai/orca/pull/18637\n* perf(sidebar): stop building host projections the row model throws away by @nwparker in https://github.com/stablyai/orca/pull/18638\n* perf(agent-hooks): find spool newlines with Buffer.indexOf, not a per-byte loop by @nwparker in https://github.com/stablyai/orca/pull/18639\n* perf(claude-usage): reject non-assistant transcript lines before parsing them by @nwparker in https://github.com/stablyai/orca/pull/18640\n* perf(orchestration): project task columns so task reads hit the statement cache by @nwparker in https://github.com/stablyai/orca/pull/18641\n* perf(agent-hooks): stop cloning the whole status roster on every hook event by @nwparker in https://github.com/stablyai/orca/pull/18642\n* perf(sidebar): share one natural-worktree-id scan and drop a redundant row-key join by @nwparker in https://github.com/stablyai/orca/pull/18647\n* perf(terminal): use real event-loop yields between chunked writes by @nwparker in https://github.com/stablyai/orca/pull/18627\n* perf(settings): commit free-text account settings on a debounce, not per keystroke by @nwparker in https://github.com/stablyai/orca/pull/18651\n* feat(relay-infra): cell crash-rate alert and incident dashboard by @Jinwoo-H in https://github.com/stablyai/orca/pull/18717\n* feat(relay): let cells dial Cloud SQL over private IP by @Jinwoo-H in https://github.com/stablyai/orca/pull/18720\n* fix(desktop): never replay a refresh token after a timeout; jitter relay lease renewal by @Jinwoo-H in https://github.com/stablyai/orca/pull/18719\n* perf(ports): serve unchanged macOS listeners from remembered metadata by @nwparker in https://github.com/stablyai/orca/pull/18650\n* refactor(agent-session-journal): move the session journal onto SQLite by @brennanb2025 in https://github.com/stablyai/orca/pull/18652\n* fix(relay-ops): a thrown health fetch is not a health reading; auth probe does not require /ready by @Jinwoo-H in https://github.com/stablyai/orca/pull/18723\n* fix(agents): detect agent CLIs installed outside a version manager by @nwparker in https://github.com/stablyai/orca/pull/18336\n* perf(relay): per-cell inventory locks, delta counters, and a pool statement timeout by @Jinwoo-H in https://github.com/stablyai/orca/pull/18722\n* fix(worktrees): stop a failed worktree scan from being recorded as an authoritative empty listing by @nwparker in https://github.com/stablyai/orca/pull/18456\n* fix(native-chat): clarify active progress by @brennanb2025 in https://github.com/stablyai/orca/pull/18705\n* fix(browser-pane): stop a dead client-hosted guest from killing the workbench by @nwparker in https://github.com/stablyai/orca/pull/18334\n* feat(claude): move structured native chat onto the Claude Agent SDK and enable it on macOS and Linux by @brennanb2025 in https://github.com/stablyai/orca/pull/18560\n* Fix Smart create retaining a task checkout hash with Create more by @nwparker in https://github.com/stablyai/orca/pull/18727\n* infra(relay): drop the unapplied region label from runtime log metrics by @Jinwoo-H in https://github.com/stablyai/orca/pull/18734\n* feat(native-chat): expose split and move-to-pane actions in Chat UI mode by @brennanb2025 in https://github.com/stablyai/orca/pull/18714\n* fix(ui): unmount project selector before Add Project handoff by @Jinwoo-H in https://github.com/stablyai/orca/pull/18730\n* fix: show agent commands once without startup polling by @nwparker in https://github.com/stablyai/orca/pull/18729\n* fix(crash-reporting): make the own-Chromium gate a real choke point, and stop a refusal leaking the root by @nwparker in https://github.com/stablyai/orca/pull/18459\n* chore: update in-app Android APK link to 0.0.47 by @AmethystLiang in https://github.com/stablyai/orca/pull/18745\n* Answer the structured-session support probe without installing the host by @brennanb2025 in https://github.com/stablyai/orca/pull/18695\n* fix(native-chat): render Claude structured chat through the same UI as Codex by @brennanb2025 in https://github.com/stablyai/orca/pull/18743\n* fix(orchestration): fence the dispatch CLI preamble so it stops rendering as headings by @brennanb2025 in https://github.com/stablyai/orca/pull/18718\n* fix(relay-ops): retry a failed MIG inventory read once before calling a cell's power state unknown by @Jinwoo-H in https://github.com/stablyai/orca/pull/18740\n* fix(relay-ops): accept monitor evidence from an ancestor commit with identical monitor code by @Jinwoo-H in https://github.com/stablyai/orca/pull/18754\n* fix(terminal): stop a hidden pane's unmeasured 80x24 from overwriting a live PTY's size on reattach by @Jinwoo-H in https://github.com/stablyai/orca/pull/18706\n* fix: use fallback shell readiness and assert fish startup timing by @nwparker in https://github.com/stablyai/orca/pull/18755\n* fix(relay-ops): retry transient admin-endpoint failures in same-cap verify and rehome jobs by @Jinwoo-H in https://github.com/stablyai/orca/pull/18769\n* fix(native-chat): make document paths and links clickable in chat by @brennanb2025 in https://github.com/stablyai/orca/pull/18712\n* fix(native-chat): tell old mobile builds why a structured chat is missing by @brennanb2025 in https://github.com/stablyai/orca/pull/18756\n* fix(relay-ops): retry freshness-only preflight failures on the first same-cap wave too by @Jinwoo-H in https://github.com/stablyai/orca/pull/18778\n* fix(browser): match loading surfaces to the Orca theme by @Jinwoo-H in https://github.com/stablyai/orca/pull/18738\n* fix(browser): present Electron's own user agent so Cloudflare Turnstile clears by @Jinwoo-H in https://github.com/stablyai/orca/pull/18749\n* fix(relay-ops): align the cloud-data freshness bar with Cloud Monitoring publish lag by @Jinwoo-H in https://github.com/stablyai/orca/pull/18798\n* ci(package): retry apt fetches and docker builds behind the Ubuntu mirror by @nwparker in https://github.com/stablyai/orca/pull/18797\n* docs(relay): correct why the ConPTY teardown asset diverges from the desktop patch by @nwparker in https://github.com/stablyai/orca/pull/18636\n* fix: recover from an alternate shell install, and close the relay duplicate-echo gap by @nwparker in https://github.com/stablyai/orca/pull/18796\n* feat(mobile): port the restructured native-chat turn status and live tool progress by @brennanb2025 in https://github.com/stablyai/orca/pull/18761\n* perf(persistence): stop the session write re-scanning and rebuilding unchanged state by @nwparker in https://github.com/stablyai/orca/pull/18739\n* feat(native-chat): render agent file edits as inline diff cards by @brennanb2025 in https://github.com/stablyai/orca/pull/18765\n* fix(recovery): fail a renderer recovery reload that never loads, instead of leaving a dead window by @nwparker in https://github.com/stablyai/orca/pull/18466\n* fix(ssh): compile node-pty from the host's own Node headers instead of nodejs.org (STA-6674) by @nwparker in https://github.com/stablyai/orca/pull/18774\n* Bump mobile app.json to 0.0.48 by @brennanb2025 in https://github.com/stablyai/orca/pull/18801\n* fix(sidebar): confirm filter reset before revealing active workspace by @nwparker in https://github.com/stablyai/orca/pull/18708\n* perf(terminals): let idle panes share one process-table capture instead of forking their own by @nwparker in https://github.com/stablyai/orca/pull/18742\n* perf(native-chat): stop rebuilding every transcript row on every stream frame by @nwparker in https://github.com/stablyai/orca/pull/18744\n* perf(terminal): skip the partial-escape-tail walk on ESC-free PTY chunks by @nwparker in https://github.com/stablyai/orca/pull/18748\n* perf(renderer): index four projections that rescanned their inputs per keystroke by @nwparker in https://github.com/stablyai/orca/pull/18747\n* Show Claude background task status in Native Chat by @brennanb2025 in https://github.com/stablyai/orca/pull/18757\n* fix(sidebar): stop ⌘⇧↓ worktree navigation jumping to the first row by @nwparker in https://github.com/stablyai/orca/pull/18804\n* perf(persistence): skip rewriting unchanged terminal scrollback snapshots by @nwparker in https://github.com/stablyai/orca/pull/18764\n* fix(agent-session): refuse a pre-commit structured create with an envelope by @brennanb2025 in https://github.com/stablyai/orca/pull/18697\n* perf(relay): bound the symlink directory probes a remote readDir fans out by @nwparker in https://github.com/stablyai/orca/pull/18752\n* perf(terminal): cheap-tier process inspection for anchored local agent panes by @nwparker in https://github.com/stablyai/orca/pull/18780\n* fix(ssh): let the host say whether it armed the shell-ready marker by @nwparker in https://github.com/stablyai/orca/pull/18802\n* fix(native-chat): say when a structured launch fell back to a terminal by @brennanb2025 in https://github.com/stablyai/orca/pull/18762\n* fix(test): stop detached git maintenance racing the divergence fixture teardown by @nwparker in https://github.com/stablyai/orca/pull/18810\n* fix(cloud): let the same-cap roll isolate Asia cells by @Jinwoo-H in https://github.com/stablyai/orca/pull/18811\n* fix(renderer): stop a Node-only process-table module blanking the app at boot by @nwparker in https://github.com/stablyai/orca/pull/18814\n* feat(i18n): localize onboarding flow to Japanese by @tb-soshiro in https://github.com/stablyai/orca/pull/18787\n* fix(cloud): validate protocol-0 same-cap cell plans without rehome trust lines by @Jinwoo-H in https://github.com/stablyai/orca/pull/18818\n* perf(worktree): skip remote probes with no possible result by @nwparker in https://github.com/stablyai/orca/pull/18821\n* fix(native-chat): stop a settling handoff throwing an unhandled rejection at teardown by @nwparker in https://github.com/stablyai/orca/pull/18824\n* fix(claude): make the recovery barrier cover an exit still climbing the close ladder by @nwparker in https://github.com/stablyai/orca/pull/18826\n* Reduce minimum tab width from 88px to 72px by @AmethystLiang in https://github.com/stablyai/orca/pull/18871\n* perf(automations): reuse collation setup when sorting names by @nwparker in https://github.com/stablyai/orca/pull/18823\n* fix(relay-ops): per-region cell latency bar and attributable preflight failures by @Jinwoo-H in https://github.com/stablyai/orca/pull/18877\n* test(e2e): follow current sidebar project and activity actions by @nwparker in https://github.com/stablyai/orca/pull/18878\n* fix(runtime): bound terminal-wait blocked-prompt rules to the live screen bottom by @Jinwoo-H in https://github.com/stablyai/orca/pull/18817\n* test(e2e): fence SSH recovery and release exited Electron pipes by @nwparker in https://github.com/stablyai/orca/pull/18880\n* feat(perf): lint repeated sort setup and schedule regression contracts by @nwparker in https://github.com/stablyai/orca/pull/18822\n* feat(native-chat): label Codex tool rows by what the command actually did by @brennanb2025 in https://github.com/stablyai/orca/pull/18760\n* test: preserve Docker context in isolated VM recipes by @nwparker in https://github.com/stablyai/orca/pull/18884\n* Fix favicon retention across same-origin navigations by @AmethystLiang in https://github.com/stablyai/orca/pull/18879\n* test: isolate native crash restoration and refresh stale fixtures by @nwparker in https://github.com/stablyai/orca/pull/18883\n* test: pin worker visibility fixture command and handle by @nwparker in https://github.com/stablyai/orca/pull/18897\n* feat(cli): report SSH host platforms by @nwparker in https://github.com/stablyai/orca/pull/18896\n* test: canonicalize setup fixture paths before worktree lookup by @nwparker in https://github.com/stablyai/orca/pull/18912\n* perf(worktree): remove redundant creation and terminal startup work by @nwparker in https://github.com/stablyai/orca/pull/18793\n* test: align desktop platform oracles with native behavior by @nwparker in https://github.com/stablyai/orca/pull/18915\n* test: follow sidebar reveal confirmation with a stable workspace target by @nwparker in https://github.com/stablyai/orca/pull/18921\n* feat(native-chat): model Codex MCP and web-search items instead of leaking opcodes by @brennanb2025 in https://github.com/stablyai/orca/pull/18763\n* fix(native-chat): publish structured session status from the host so the sidebar never goes stale by @brennanb2025 in https://github.com/stablyai/orca/pull/18776\n* feat(native-chat): stop monitored tasks individually by @brennanb2025 in https://github.com/stablyai/orca/pull/18807\n* fix(native-chat): tell a pre-SQLite chat how to carry on by @brennanb2025 in https://github.com/stablyai/orca/pull/18808\n* fix(agent-session): never open a sibling terminal on an unproven create by @brennanb2025 in https://github.com/stablyai/orca/pull/18735\n* refactor(agent-session): consolidate wire type imports below lint limit by @nwparker in https://github.com/stablyai/orca/pull/18930\n* test(e2e): stabilize terminal launch and rename menu fixtures by @nwparker in https://github.com/stablyai/orca/pull/18928\n* fix(automation): keep explicit background launches off screen by @nwparker in https://github.com/stablyai/orca/pull/18898\n* feat(automations): restore column sorting on the list by @nwparker in https://github.com/stablyai/orca/pull/18885\n* test: pin terminal Codex home to an explicit managed account by @nwparker in https://github.com/stablyai/orca/pull/18935\n* test: deliver real terminal input and preserve setup reports by @nwparker in https://github.com/stablyai/orca/pull/18939\n* test: isolate skill cloud fixture ports across workers by @nwparker in https://github.com/stablyai/orca/pull/18942\n* test: align Source Control AI generation fixtures by @nwparker in https://github.com/stablyai/orca/pull/18941\n* ci: reduce runner overhead and disposable package compression by @nwparker in https://github.com/stablyai/orca/pull/18948\n* test: keep artifact share fixtures unexpired across calendar dates by @nwparker in https://github.com/stablyai/orca/pull/18955\n* docs(relay): 2026-09 reconnect findings, checklist, roadmap, and Roll 2 plan by @Jinwoo-H in https://github.com/stablyai/orca/pull/18958\n* test: make SSH artifact regression fixtures reliable at narrow widths by @nwparker in https://github.com/stablyai/orca/pull/18947\n* test: order restart fixture readiness around daemon recovery by @nwparker in https://github.com/stablyai/orca/pull/18949\n* fix(orchestration): typed error codes for dispatch and worker-start refusals by @Jinwoo-H in https://github.com/stablyai/orca/pull/18902\n* ci: skip idle Mac allocations and redundant native compiler setup by @nwparker in https://github.com/stablyai/orca/pull/18954\n* test: isolate Source Control generation from shared repository remotes by @nwparker in https://github.com/stablyai/orca/pull/18962\n* fix(relay): abandon dead client accepts, jitter and lengthen the control lease, fail direct probes fast by @Jinwoo-H in https://github.com/stablyai/orca/pull/18959\n* fix(hooks): register the Claude hook script directly on Windows (#18875) by @OrcaWin in https://github.com/stablyai/orca/pull/18905\n* fix(ci): store vetted refs in a reftable so case-twin branches don't fail the fetch by @nwparker in https://github.com/stablyai/orca/pull/18970\n* test: drain project menu focus restoration before teardown by @nwparker in https://github.com/stablyai/orca/pull/18971\n* ci: reduce dependency, checkout, and test deadline overhead by @nwparker in https://github.com/stablyai/orca/pull/18968\n* ci: preserve case-twin release refs through checkout and verify trust by @nwparker in https://github.com/stablyai/orca/pull/18980\n* test: honor background mode in paired client window helpers by @nwparker in https://github.com/stablyai/orca/pull/18978\n* test: bound release checkout fixtures and gate delayed imports by @nwparker in https://github.com/stablyai/orca/pull/18981\n* fix(native-chat): repair a structured chat tab permanently fenced by an inherited publication epoch by @brennanb2025 in https://github.com/stablyai/orca/pull/18906\n* ci: expose existing E2E spec selection for manual dispatch by @nwparker in https://github.com/stablyai/orca/pull/18987\n* test: isolate window mocks from inherited launch flags by @nwparker in https://github.com/stablyai/orca/pull/18989\n* test: match explorer filenames independently of git badges by @nwparker in https://github.com/stablyai/orca/pull/18997\n* test: synchronize large repository recovery with Retry request by @nwparker in https://github.com/stablyai/orca/pull/18999\n* perf(relay): drain fragmented frame buffers in linear time by @nwparker in https://github.com/stablyai/orca/pull/18891\n* perf(repos): avoid quadratic icon source scans by @nwparker in https://github.com/stablyai/orca/pull/18892\n* perf(browser): assemble fragmented tunnel frames once by @nwparker in https://github.com/stablyai/orca/pull/18893\n* perf(editor): reuse Markdown source blocks while positioning review notes by @nwparker in https://github.com/stablyai/orca/pull/18895\n* perf(editor): reuse live Markdown search matches across unrelated renders by @nwparker in https://github.com/stablyai/orca/pull/18903\n* perf: decode fragmented CLI replies without repeated scans by @nwparker in https://github.com/stablyai/orca/pull/18909\n* perf: avoid file-to-file scans when selecting deletion roots by @nwparker in https://github.com/stablyai/orca/pull/18913\n* perf: find mobile Markdown placeholder prefixes in one scan by @nwparker in https://github.com/stablyai/orca/pull/18914\n* perf: avoid repeated Quick Open exclusion string allocations by @nwparker in https://github.com/stablyai/orca/pull/18916\n* perf: skip unrelated shared symlink probes during Git status by @nwparker in https://github.com/stablyai/orca/pull/18918\n* perf: avoid splitting every path during file autocomplete by @nwparker in https://github.com/stablyai/orca/pull/18919\n* perf: avoid rescanning emitted source in analysis guards by @nwparker in https://github.com/stablyai/orca/pull/18920\n* perf(cli): skip feature formatters during help and error startup by @nwparker in https://github.com/stablyai/orca/pull/18923\n* perf(explorer): remove redundant dotfile path filter allocation by @nwparker in https://github.com/stablyai/orca/pull/18929\n* perf(watcher): skip remaining filesystem checks after cancellation by @nwparker in https://github.com/stablyai/orca/pull/18931\n* perf(hooks): use native reverse search for transcript lines by @nwparker in https://github.com/stablyai/orca/pull/18936\n* perf(skills): skip symlink probes beyond discovery depth by @nwparker in https://github.com/stablyai/orca/pull/18937\n* perf(mobile): cancel direct probes when their owner stops by @nwparker in https://github.com/stablyai/orca/pull/18940\n* perf(jira): preserve replacement attachment download singleflight by @nwparker in https://github.com/stablyai/orca/pull/18944\n* perf(speech): reuse the model download idle timer by @nwparker in https://github.com/stablyai/orca/pull/18945\n* perf(ssh): reuse and release relay startup buffers by @nwparker in https://github.com/stablyai/orca/pull/18953\n* perf(ssh): reuse streamed response idle timers by @nwparker in https://github.com/stablyai/orca/pull/18956\n* perf(browser): reuse decoded single-chunk upload buffers by @nwparker in https://github.com/stablyai/orca/pull/18960\n* perf(tabs): index saved tab order during hydration repair by @nwparker in https://github.com/stablyai/orca/pull/18964\n* perf(palette): reuse allowed quality arrays during matching by @nwparker in https://github.com/stablyai/orca/pull/18966\n* perf: remember equivalent session tab source identities by @nwparker in https://github.com/stablyai/orca/pull/18976\n* perf(cli): skip impossible typo distance comparisons by @nwparker in https://github.com/stablyai/orca/pull/18977\n* fix(tests): stabilize divider viewport and pointer-capture event ordering by @nwparker in https://github.com/stablyai/orca/pull/19004\n* fix(mobile): stop host streams after relay subscription cancellation by @nwparker in https://github.com/stablyai/orca/pull/18926\n* fix(tests): provide a window manager for Linux Electron CI by @nwparker in https://github.com/stablyai/orca/pull/19007\n* fix(windows): copy the daemon host exe verbatim instead of renaming it (MDE T1036) by @OrcaWin in https://github.com/stablyai/orca/pull/17865\n* fix(computer-use): run the Windows runtime as one persistent helper by @OrcaWin in https://github.com/stablyai/orca/pull/17858\n* fix(windows): drop EDR-flagged -ExecutionPolicy Bypass from encoded PowerShell by @OrcaWin in https://github.com/stablyai/orca/pull/17880\n* fix(windows): read command lines from the kernel, not each process's PEB by @OrcaWin in https://github.com/stablyai/orca/pull/17886\n* fix(windows): scan ports natively instead of encoded PowerShell by @OrcaWin in https://github.com/stablyai/orca/pull/17861\n* fix(security): apply the Windows path-hardening ACL that never ran by @OrcaWin in https://github.com/stablyai/orca/pull/17884\n* perf: avoid repeated whitespace scans in diagnostic redaction by @nwparker in https://github.com/stablyai/orca/pull/18908\n* Improve notification view by @AmethystLiang in https://github.com/stablyai/orca/pull/18699\n* test(child-process): lower DIRECT_IMPORTER_PIN to the ground two PRs took by @OrcaWin in https://github.com/stablyai/orca/pull/19009\n* fix(windows): resolve npm/pnpm .cmd shims past cmd.exe by @OrcaWin in https://github.com/stablyai/orca/pull/17869\n* test: lower child-process import pin after ACL migration by @nwparker in https://github.com/stablyai/orca/pull/19012\n* Open open new link should not navigate away from current link by @AmethystLiang in https://github.com/stablyai/orca/pull/18873\n* perf(windows): split the process table into two flag sets by @OrcaWin in https://github.com/stablyai/orca/pull/17866\n* fix(release): stop shipping an unsigned elevate.exe on Windows by @OrcaWin in https://github.com/stablyai/orca/pull/18044\n* fix(windows): sign the NSIS uninstaller via SignPath by @OrcaWin in https://github.com/stablyai/orca/pull/17868\n* fix(tests): complete hidden SSH dialog exits during cleanup by @nwparker in https://github.com/stablyai/orca/pull/18993\n* Support updating existing draft releases when regenerating notes by @AmethystLiang in https://github.com/stablyai/orca/pull/19014\n* fix(windows): drop no-op -ExecutionPolicy Bypass from -Command spawns by @OrcaWin in https://github.com/stablyai/orca/pull/17873\n* perf(search): assemble fragmented subprocess lines incrementally by @nwparker in https://github.com/stablyai/orca/pull/18973\n* test: use a valid repo filter in workspace reveal coverage by @nwparker in https://github.com/stablyai/orca/pull/19017\n* test: cover native X11 Hangul-plus-digit PTY bytes in CI by @nwparker in https://github.com/stablyai/orca/pull/19013\n* Stop evicted and expired worktree preparations by @nwparker in https://github.com/stablyai/orca/pull/18951\n* Let worktree creation proceed during stale preparation reclamation by @nwparker in https://github.com/stablyai/orca/pull/18967\n* fix(release): revalidate draft state before patching generated notes by @AmethystLiang in https://github.com/stablyai/orca/pull/19019\n* perf(worktree): overlap base refresh with prepared checkout by @nwparker in https://github.com/stablyai/orca/pull/18998\n* test: await fresh inventory after headless terminal materialization by @nwparker in https://github.com/stablyai/orca/pull/19028\n* fix(sidebar): stop a missed pointerup from hiding a remote host section by @nwparker in https://github.com/stablyai/orca/pull/19032\n* test: wait for board pointer readiness before marquee selection by @nwparker in https://github.com/stablyai/orca/pull/19029\n* fix(build): pin config/relay-assets LF so one release is one relay hash by @OrcaWin in https://github.com/stablyai/orca/pull/19024\n* docs(relay): record Roll 2 phase 0/1 (code merge, image, director deploy) by @Jinwoo-H in https://github.com/stablyai/orca/pull/18979\n* feat(github-projects): render Roadmap project views as a timeline by @NaoyaTatetsu in https://github.com/stablyai/orca/pull/17795\n* fix(mobile): preserve iPad hardware keyboard focus by @ramarivera in https://github.com/stablyai/orca/pull/12772\n* test: await reattach replay before checking mouse reset by @nwparker in https://github.com/stablyai/orca/pull/19039\n* test: require recorded Git activity in polling regression by @nwparker in https://github.com/stablyai/orca/pull/19041\n* fix(native-chat): resume a structured chat from Agent Session History by @OrcaWin in https://github.com/stablyai/orca/pull/18933\n* fix(source-control): stack Retry below the too-many-changes message by @nwparker in https://github.com/stablyai/orca/pull/19037\n* test: preserve Windows golden command failures by @nwparker in https://github.com/stablyai/orca/pull/19047\n* test: canonicalize Windows fresh-profile fixture path by @nwparker in https://github.com/stablyai/orca/pull/19049\n* test: repair Windows paste setup and newline expectations by @nwparker in https://github.com/stablyai/orca/pull/19050\n* fix(source-control): stack the Create PR notice's settings link below its message by @nwparker in https://github.com/stablyai/orca/pull/19046\n* test: align Windows shell icons with project runtime ownership by @nwparker in https://github.com/stablyai/orca/pull/19053\n* test: exercise supported ConPTY keyboard protocol reset by @nwparker in https://github.com/stablyai/orca/pull/19054\n* fix(native-chat): honor structured routing with saved options by @brennanb2025 in https://github.com/stablyai/orca/pull/19040\n* fix(packaging): ship Claude agent SDK with desktop builds by @brennanb2025 in https://github.com/stablyai/orca/pull/19042\n* test: reject unsupported app-server in golden agent fixture by @nwparker in https://github.com/stablyai/orca/pull/19056\n* test: reject unsupported app-server in WSL golden stub by @nwparker in https://github.com/stablyai/orca/pull/19062\n* test: canonicalize native Windows paths during repository teardown by @nwparker in https://github.com/stablyai/orca/pull/19064\n* test: run real WSL terminal launch and paste in PR CI by @nwparker in https://github.com/stablyai/orca/pull/19072\n* test: restore SSH bulk-open freeze coverage in headed CI by @nwparker in https://github.com/stablyai/orca/pull/19081\n* test: enable direct and client-hosted SSH browser coverage by @nwparker in https://github.com/stablyai/orca/pull/19090\n* test: reconnect after replacing same-ID runtime pairing by @nwparker in https://github.com/stablyai/orca/pull/19094\n* test: enable Docker SSH browser network route coverage in CI by @nwparker in https://github.com/stablyai/orca/pull/19095\n* docs(relay): Roll 2 cell roll record and checklist ticks by @Jinwoo-H in https://github.com/stablyai/orca/pull/19096\n* test: repair nested SSH fixture after HUB restart by @nwparker in https://github.com/stablyai/orca/pull/19098\n* test: enable localhost SSH terminal and hook journey in CI by @nwparker in https://github.com/stablyai/orca/pull/19097\n* Bump mobile Android versionCode to 16 to match the 0.0.48 release by @brennanb2025 in https://github.com/stablyai/orca/pull/19101\n* test: reuse authoritative SSH connection readiness in localhost fixture by @nwparker in https://github.com/stablyai/orca/pull/19102\n* test: follow retained Activity sidebar during pane selection by @nwparker in https://github.com/stablyai/orca/pull/19107\n* test: isolate source-control generation repositories per scenario by @nwparker in https://github.com/stablyai/orca/pull/19105\n* test: cover SSH reattach replay and enable deterministic Codex CI by @nwparker in https://github.com/stablyai/orca/pull/19106\n* fix(chat): stop terminal focus recovery from stealing Cmd+C in the Chat UI by @brennanb2025 in https://github.com/stablyai/orca/pull/18751\n* Add persistent turn-scoped chat activity indicator by @brennanb2025 in https://github.com/stablyai/orca/pull/19044\n* feat(orchestration): make multi-agent workflows durable by @Jinwoo-H in https://github.com/stablyai/orca/pull/16904\n* fix(ssh-relay): daemon owns the endpoint credential; a losing start never rotates it by @Jinwoo-H in https://github.com/stablyai/orca/pull/19052\n* Recover branch compare on visibility change by @AmethystLiang in https://github.com/stablyai/orca/pull/19021\n* fix(codex): keep large app-server replies alive by @brennanb2025 in https://github.com/stablyai/orca/pull/18590\n* docs(orchestration): never pick a worker model the user did not name by @Jinwoo-H in https://github.com/stablyai/orca/pull/19109\n* feat(mobile): structured native Claude chat by @brennanb2025 in https://github.com/stablyai/orca/pull/18741\n* Seed Cmd-J filter from sidebar scope by @AmethystLiang in https://github.com/stablyai/orca/pull/19036\n* skills: rewrite and trim the seven non-orchestration guides (do not merge without Jinwoo) by @Jinwoo-H in https://github.com/stablyai/orca/pull/18724\n* fix(ci): stop Android release notes exceeding the GitHub body limit by @brennanb2025 in https://github.com/stablyai/orca/pull/19114\n* Update mobile 0.0.48 Android download links by @brennanb2025 in https://github.com/stablyai/orca/pull/19117\n* fix(orchestration): keep worker lineage across app restart (STA-6366) by @Jinwoo-H in https://github.com/stablyai/orca/pull/19121\n* fix(browser): select full URL on initial address bar click by @Jinwoo-H in https://github.com/stablyai/orca/pull/19118\n* fix(windows): unblock structured native chat by exposing process creation time by @brennanb2025 in https://github.com/stablyai/orca/pull/18986\n* Revert \"skills: rewrite the seven non-orchestration guides to one outcome-first standard (#18724)\" by @Jinwoo-H in https://github.com/stablyai/orca/pull/19126\n* perf(store): keep the repo list's identity through workspace hydration by @nwparker in https://github.com/stablyai/orca/pull/19057\n* perf(tabs): keep tab-model identity when reconciliation changed something else by @nwparker in https://github.com/stablyai/orca/pull/19063\n* perf(mobile): skip the agent-status projection join when nothing changed by @nwparker in https://github.com/stablyai/orca/pull/19115\n* perf(worktrees): stop worktree removal from replacing maps it never touched by @nwparker in https://github.com/stablyai/orca/pull/19058\n* perf(selectors): stop two always-mounted selectors allocating per store write by @nwparker in https://github.com/stablyai/orca/pull/19113\n* perf(terminals): stop closing a tab from replacing maps it never touched by @nwparker in https://github.com/stablyai/orca/pull/19060\n* perf(terminals): keep shutdown maps' identity when there is nothing to clear by @nwparker in https://github.com/stablyai/orca/pull/19112\n* perf(store): detect Zustand rerender churn the current audit cannot see by @nwparker in https://github.com/stablyai/orca/pull/19059\n* fix(native-chat): stop seeding a stray terminal beside a chat create by @brennanb2025 in https://github.com/stablyai/orca/pull/19123\n* Improve cmd j ranking by @AmethystLiang in https://github.com/stablyai/orca/pull/19005\n* feat(native-chat): offer the link-action popover for chat links by @brennanb2025 in https://github.com/stablyai/orca/pull/19130\n* fix(ui): keep source control headers readable in narrow sidebars by @nwparker in https://github.com/stablyai/orca/pull/19146\n* fix(gh): log when gh/glab is killed at its deadline by @nwparker in https://github.com/stablyai/orca/pull/18555\n* fix: restore the full sidebar agent row for structured native chat by @brennanb2025 in https://github.com/stablyai/orca/pull/19137\n* fix(native-chat): suppress provider user echoes in Claude and Codex by @brennanb2025 in https://github.com/stablyai/orca/pull/19136\n* fix(native-chat): settle a structured send the provider proves it received after the ack window by @brennanb2025 in https://github.com/stablyai/orca/pull/19140\n* Show provider activity in chat turn tails by @brennanb2025 in https://github.com/stablyai/orca/pull/19055\n* fix(ui): ignore the persistent workspace list when detecting overlays by @nwparker in https://github.com/stablyai/orca/pull/18881\n* fix(windows): reject stale parent PID links in shutdown snapshots by @brennanb2025 in https://github.com/stablyai/orca/pull/19149\n* fix(native-chat): auto-rename the workspace on a structured chat's first turn by @brennanb2025 in https://github.com/stablyai/orca/pull/19138\n* Fix native chat completion sorting and restored activity timestamps by @brennanb2025 in https://github.com/stablyai/orca/pull/19144\n* test: exercise packaged browser compatibility in scheduled CI by @nwparker in https://github.com/stablyai/orca/pull/19157\n* test: refresh palette identities and structured-session journal fixtures by @nwparker in https://github.com/stablyai/orca/pull/19165\n* fix(terminal): preserve ordinary foreground command names by @nwparker in https://github.com/stablyai/orca/pull/18882\n* fix(cmd-j): pass browser tab ownership into palette search by @nwparker in https://github.com/stablyai/orca/pull/18925\n* fix: keep macOS shell ownership proof within recovery budget by @nwparker in https://github.com/stablyai/orca/pull/18932\n* fix: open editor rename after context menu releases focus by @nwparker in https://github.com/stablyai/orca/pull/18934\n* fix: avoid starting browser helpers just to reset absent sessions by @nwparker in https://github.com/stablyai/orca/pull/18952\n* fix: prefer retained provider snapshots during hidden terminal recovery by @nwparker in https://github.com/stablyai/orca/pull/18972\n* fix: preserve overlay focus during terminal mounting and layout by @nwparker in https://github.com/stablyai/orca/pull/18982\n* fix: preserve terminal command probes across control frames by @nwparker in https://github.com/stablyai/orca/pull/19006\n* fix: preserve paired host sessions during startup residue cleanup by @nwparker in https://github.com/stablyai/orca/pull/18922\n* fix: preserve renderer browser publication during client-hosted page updates by @nwparker in https://github.com/stablyai/orca/pull/18961\n* fix: honor remote terminal insertion in the calling client by @nwparker in https://github.com/stablyai/orca/pull/18995\n* fix: keep paired tab updates live after runtime terminal fallback by @nwparker in https://github.com/stablyai/orca/pull/19022\n* fix: avoid credit deadlock during large SSH PTY recovery by @nwparker in https://github.com/stablyai/orca/pull/19026\n* fix: recognize working WSL1 without a WSL2 kernel by @nwparker in https://github.com/stablyai/orca/pull/19061\n* fix(ports): coalesce advertised URL refresh bursts by @nwparker in https://github.com/stablyai/orca/pull/19150\n* perf(agent-status): stop no-op retirements rebuilding the retired-pane-key map by @nwparker in https://github.com/stablyai/orca/pull/19142\n* perf(worktrees): stop worktree teardown replacing arrays and maps it never touched by @nwparker in https://github.com/stablyai/orca/pull/19145\n* fix(cmd-j): remove duplicate browser ownership inputs by @nwparker in https://github.com/stablyai/orca/pull/19172\n* fix: recognize the kimi-code process as the kimi agent by @Aladex in https://github.com/stablyai/orca/pull/18634\n* fix: release floating terminal WebGL contexts while closed by @nwparker in https://github.com/stablyai/orca/pull/19000\n* fix: fence browser recovery to attach inventory placements by @nwparker in https://github.com/stablyai/orca/pull/18910\n* test: refresh paired palette host-qualified row locators by @nwparker in https://github.com/stablyai/orca/pull/19175\n* test: cover native Wayland Hangul in isolated CI by @nwparker in https://github.com/stablyai/orca/pull/19174\n* test(e2e): scope paired preview link checks to confirmation by @nwparker in https://github.com/stablyai/orca/pull/18924\n* test: await rendered remote agent placement before checking mirrors by @nwparker in https://github.com/stablyai/orca/pull/18983\n* test: scope selected runtime project assertions to the sidebar by @nwparker in https://github.com/stablyai/orca/pull/19003\n* test: confirm running-command prompts when closing tabs by @nwparker in https://github.com/stablyai/orca/pull/18965\n* Fix MiniMax China usage routing and credential handling by @weekbin in https://github.com/stablyai/orca/pull/14929\n* fix(rate-limits): stop reporting Grok usage as 0% when the API omits the percent by @TimothyVang in https://github.com/stablyai/orca/pull/17936\n* test: enable software WebGL for Linux CI headful specs by @nwparker in https://github.com/stablyai/orca/pull/19001\n* test: restore snapshot path before draining hydration FIFO by @nwparker in https://github.com/stablyai/orca/pull/19186\n* test: return paired browser state from the successful poll by @nwparker in https://github.com/stablyai/orca/pull/19189\n* feat: real background push notifications for the mobile app (#8129) by @Jinwoo-H in https://github.com/stablyai/orca/pull/18554\n* test: align worker recovery fixture with ownership policy by @nwparker in https://github.com/stablyai/orca/pull/19190\n* feat(orchestration): orchestrate native-born structured chat sessions by @brennanb2025 in https://github.com/stablyai/orca/pull/18827\n* fix(native-chat): remember structured chat model and effort picks by @brennanb2025 in https://github.com/stablyai/orca/pull/19147\n* fix(native-chat): list the slash commands and skills a structured Claude session actually loaded by @brennanb2025 in https://github.com/stablyai/orca/pull/19127\n* skills: rewrite and trim the seven non-orchestration guides by @Jinwoo-H in https://github.com/stablyai/orca/pull/19128\n* feat(chat): support structured /clear and /compact commands by @brennanb2025 in https://github.com/stablyai/orca/pull/19164\n* revert: hold mobile push feature for user testing by @Jinwoo-H in https://github.com/stablyai/orca/pull/19203\n* fix(editor): support Shift+wheel scrolling in combined diffs by @brohoya in https://github.com/stablyai/orca/pull/11756\n* feat(native-chat): resume an Agent Session History row into a new structured chat by @brennanb2025 in https://github.com/stablyai/orca/pull/19176\n* fix(mobile): stop double-scaling commit timestamps in history rows by @blade035 in https://github.com/stablyai/orca/pull/17731\n* fix(runtime): apply the structured-chat setting to every RPC caller by @brennanb2025 in https://github.com/stablyai/orca/pull/18700\n* fix(native-chat): settle structured chat turns stranded by a restart by @brennanb2025 in https://github.com/stablyai/orca/pull/19122\n* fix: eliminate quadratic whitespace trimming during fullscreen scrolling by @nwparker in https://github.com/stablyai/orca/pull/19214\n* Restore independent push gateway deployment by @Jinwoo-H in https://github.com/stablyai/orca/pull/19225\n* Fix push deployment source archive path by @Jinwoo-H in https://github.com/stablyai/orca/pull/19231\n* Reorganize MiniMax modules and de-duplicate shared test state by @nwparker in https://github.com/stablyai/orca/pull/19197\n* fix: repaint hidden output overflow after answered restore deadline by @nwparker in https://github.com/stablyai/orca/pull/18904\n* fix: retain MSYS shell descendants in their terminal job by @nwparker in https://github.com/stablyai/orca/pull/19068\n* fix(test): unbreak main — admit the adoption-replay create fixture through the structured-chat gate by @nwparker in https://github.com/stablyai/orca/pull/19246\n* Fix MiniMax credential-expiry reporting, region sync, and refresh by @nwparker in https://github.com/stablyai/orca/pull/19250\n* fix(orchestration): recover Codex idle after completion title race by @Jinwoo-H in https://github.com/stablyai/orca/pull/19243\n* feat(relay): time successful client accepts and control round trips by @Jinwoo-H in https://github.com/stablyai/orca/pull/19232\n* fix(relay): rehome hosts to their preferred region in either direction by @Jinwoo-H in https://github.com/stablyai/orca/pull/19241\n* perf(mobile): cut the relay reconnect critical path and admit dead sockets faster by @Jinwoo-H in https://github.com/stablyai/orca/pull/19236\n* feat(mobile): draw the last known tab strip while a session reconnects by @Jinwoo-H in https://github.com/stablyai/orca/pull/19258\n* feat(relay): alert on far-cell placement and skewed region hints by @Jinwoo-H in https://github.com/stablyai/orca/pull/19253\n* fix(test): give federation tests a real read-after-write sync barrier by @Jinwoo-H in https://github.com/stablyai/orca/pull/19262\n* revert(mobile): hold the relay reconnect path and cache-first reconnect for a separate mobile pass by @Jinwoo-H in https://github.com/stablyai/orca/pull/19265\n* relay: give the asia-east2 cells the regional rehome identity by @Jinwoo-H in https://github.com/stablyai/orca/pull/19239\n* fix(relay): emit pending-conn details to hosts that advertise the capability (cell side) by @Jinwoo-H in https://github.com/stablyai/orca/pull/19266\n* fix(relay): bound control RTT samples per ping and per flush window by @Jinwoo-H in https://github.com/stablyai/orca/pull/19268\n* fix(relay-ops): let the rehome trust probe approve the asia-east2 cells by @Jinwoo-H in https://github.com/stablyai/orca/pull/19275\n* fix(codex): distinguish personal and enterprise accounts sharing an email by @nwparker in https://github.com/stablyai/orca/pull/19279\n* test(relay): prove the pending-conn capability header reaches acceptControl by @Jinwoo-H in https://github.com/stablyai/orca/pull/19274\n* feat(windows): enable structured Codex chat on native Windows by @brennanb2025 in https://github.com/stablyai/orca/pull/18519\n* test(ssh): isolate the MFA fixture from the developer's real ~/.ssh by @brennanb2025 in https://github.com/stablyai/orca/pull/19300\n* Add localization for activity view and sidebar by @OrcaWin in https://github.com/stablyai/orca/pull/18589\n* fix(native-chat): make structured chat tabs renameable by @brennanb2025 in https://github.com/stablyai/orca/pull/19153\n* feat(native-chat): show Codex subagent activity instead of opcode rows by @brennanb2025 in https://github.com/stablyai/orca/pull/18773\n* fix(agent-status): stop a stale self-authored agent title from faking a pending question by @brennanb2025 in https://github.com/stablyai/orca/pull/19237\n* fix(terminal): remount a pane left unbound by a spawn that returned no PTY id by @brennanb2025 in https://github.com/stablyai/orca/pull/19223\n* fix(relay): stop rejecting the near region on a cold first probe by @Jinwoo-H in https://github.com/stablyai/orca/pull/19233\n* perf(mobile): cut the relay reconnect critical path and admit dead sockets faster (mobile pass) by @Jinwoo-H in https://github.com/stablyai/orca/pull/19280\n* perf(mobile): open a session with parallel startup RPCs and a pre-warmed terminal engine by @Jinwoo-H in https://github.com/stablyai/orca/pull/19260\n* fix(relay): attach a phone whose accept straddles a control rebind (desktop side) by @Jinwoo-H in https://github.com/stablyai/orca/pull/19238\n* tools: add a phone-vantage relay connect benchmark by @Jinwoo-H in https://github.com/stablyai/orca/pull/19251\n* feat(mobile): draw the last known tab strip while a session reconnects (mobile pass) by @Jinwoo-H in https://github.com/stablyai/orca/pull/19281\n* feat(relay): log the region probe and name the assigned cell by @Jinwoo-H in https://github.com/stablyai/orca/pull/19307\n* perf(mobile): race the direct and relay dials from t=0 on every reconnect by @Jinwoo-H in https://github.com/stablyai/orca/pull/19308\n* feat(mobile): time relay dial stages so diagnostics say where a slow connect went by @Jinwoo-H in https://github.com/stablyai/orca/pull/19245\n* Persist agents sidebar search visibility as pairing-local preference by @AmethystLiang in https://github.com/stablyai/orca/pull/19313\n* feat(chat): add structured session rewind backend by @brennanb2025 in https://github.com/stablyai/orca/pull/19235\n* Defer inactive browser pages across worktree switches by @AmethystLiang in https://github.com/stablyai/orca/pull/19326\n* fix(native-chat): stop an unanswered host from reading as one that refuses structured chat by @brennanb2025 in https://github.com/stablyai/orca/pull/19321\n* fix(native-chat): scope composer file drops to the pane that received them by @brennanb2025 in https://github.com/stablyai/orca/pull/19328\n* revert(mobile): pull the relay connect-speed mobile pass pending a smaller, verified re-land by @Jinwoo-H in https://github.com/stablyai/orca/pull/19348\n* fix(relay): never cache a region hint from a one-region catalog by @Jinwoo-H in https://github.com/stablyai/orca/pull/19349\n* Show native chat message timestamps on hover by @brennanb2025 in https://github.com/stablyai/orca/pull/19218\n* feat(native-chat): add execution details and tool row identity by @brennanb2025 in https://github.com/stablyai/orca/pull/19226\n* chore(mobile): remove stale max-lines exceptions by @nwparker in https://github.com/stablyai/orca/pull/19366\n* fix(native-chat): render compaction notices, plan documents, and images by @brennanb2025 in https://github.com/stablyai/orca/pull/19228\n* fix(sidebar): reveal collapsed workspaces without clearing filters by @nwparker in https://github.com/stablyai/orca/pull/19398\n* fix(orchestration): avoid full message scans on working terminal titles by @brennanb2025 in https://github.com/stablyai/orca/pull/19390\n* fix(deps): update desktop parsers for security and bounded resource use by @OrcaWin in https://github.com/stablyai/orca/pull/19361\n* fix(deps): harden cloud HTTP, WebSocket and build dependencies by @OrcaWin in https://github.com/stablyai/orca/pull/19362\n* chore(mobile): patch XML parser security in plist tooling by @OrcaWin in https://github.com/stablyai/orca/pull/19380\n* chore(docs): patch brace expansion resource exhaustion fixes by @OrcaWin in https://github.com/stablyai/orca/pull/19382\n* fix(deps): update react-i18next for TypeScript 7 and translation parsing by @OrcaWin in https://github.com/stablyai/orca/pull/19378\n* fix(deps): update DOMPurify for sanitizer and document-context fixes by @OrcaWin in https://github.com/stablyai/orca/pull/19377\n* fix(ci): read the changed-path list past the first pipe buffer by @nwparker in https://github.com/stablyai/orca/pull/19409\n* fix(xterm): remove scrollback decorations by identity by @bbingz in https://github.com/stablyai/orca/pull/13178\n* feat(native-chat): read a tool batch as a group by @brennanb2025 in https://github.com/stablyai/orca/pull/19372\n* fix(deps): upgrade Electron to 43.6 for startup performance and crash fixes by @OrcaWin in https://github.com/stablyai/orca/pull/19369\n* fix: preserve user input during terminal scrollback replay by @nwparker in https://github.com/stablyai/orca/pull/19075\n* Unify sidebar create actions into single dropdown menu by @AmethystLiang in https://github.com/stablyai/orca/pull/19375\n* fix: preserve terminal retirement proof across renderer publications by @nwparker in https://github.com/stablyai/orca/pull/19002\n* perf(renderer): avoid per-second spinner animation events by @OrcaWin in https://github.com/stablyai/orca/pull/19407\n* fix(pi): show input modals as waiting instead of working by @mmarabel in https://github.com/stablyai/orca/pull/18836\n* Fix sidebar create menu E2E races by @AmethystLiang in https://github.com/stablyai/orca/pull/19448\n* test: cover input in five simultaneously flooding SSH panes by @nwparker in https://github.com/stablyai/orca/pull/19071\n* fix(runtime): stop a first status publication retiring in-flight worktree scans by @nwparker in https://github.com/stablyai/orca/pull/19357\n* fix(clipboard): route runtime-owned SSH image paste through the runtime by @nwparker in https://github.com/stablyai/orca/pull/19352\n* fix(sidebar): label pinned rows with their host on a multi-host sidebar by @nwparker in https://github.com/stablyai/orca/pull/19351\n* Log error details on session kill failure by @AmethystLiang in https://github.com/stablyai/orca/pull/19381\n* Stabilize scrollbar gutter to prevent message list layout shift by @AmethystLiang in https://github.com/stablyai/orca/pull/19332\n* Rank activity status groups by attention level by @AmethystLiang in https://github.com/stablyai/orca/pull/19329\n* perf: index selected team IDs and choose primary team in one pass by @OrcaWin in https://github.com/stablyai/orca/pull/19504\n* perf: skip Git-status indexing without eligible editors by @OrcaWin in https://github.com/stablyai/orca/pull/19437\n* perf: stop filesystem authorization at the first matching root by @OrcaWin in https://github.com/stablyai/orca/pull/19438\n* perf: index editor ownership and restored workspace projections by @OrcaWin in https://github.com/stablyai/orca/pull/19444\n* fix: avoid duplicate repository groups during catalog refresh by @kiendle in https://github.com/stablyai/orca/pull/19170\n* Fix native PTY I/O failures disabling session termination by @AmethystLiang in https://github.com/stablyai/orca/pull/19523\n* perf: index project table option and iteration order by @OrcaWin in https://github.com/stablyai/orca/pull/19476\n* perf: stop clone URL discovery at the first usable source by @OrcaWin in https://github.com/stablyai/orca/pull/19477\n* perf: clone only changed work-item pages by @OrcaWin in https://github.com/stablyai/orca/pull/19478\n* perf: use counted membership for worker transcript roster twins by @OrcaWin in https://github.com/stablyai/orca/pull/19484\n* perf: skip sorting when all final automation runs fit by @OrcaWin in https://github.com/stablyai/orca/pull/19485\n* perf: parse Git history headers without splitting commit bodies by @OrcaWin in https://github.com/stablyai/orca/pull/19486\n* perf: index forgotten Codex turns for bounded ordinal retention by @OrcaWin in https://github.com/stablyai/orca/pull/19488\n* perf: cache matched and unmatched Claude usage cwd attribution by @OrcaWin in https://github.com/stablyai/orca/pull/19489\n* perf: sum omitted workspace sizes without intermediate objects by @OrcaWin in https://github.com/stablyai/orca/pull/19491\n* fix(activity): show working agents under \"unread only\" by giving working turns a read receipt by @AmethystLiang in https://github.com/stablyai/orca/pull/19535\n* test: fix automation and browser reconciliation e2e tests by @AmethystLiang in https://github.com/stablyai/orca/pull/19530\n* perf: index VM feature restoration and precompute sorting identities by @OrcaWin in https://github.com/stablyai/orca/pull/19457\n* perf: reuse normalized path matchers for batch deletion by @OrcaWin in https://github.com/stablyai/orca/pull/19458\n* perf: normalize only retained browser history candidates by @OrcaWin in https://github.com/stablyai/orca/pull/19460\n* perf: index prior memberships during project identity succession by @OrcaWin in https://github.com/stablyai/orca/pull/19463\n* perf: precompute Jira priority and timestamp sorting keys by @OrcaWin in https://github.com/stablyai/orca/pull/19472\n* perf: parse external automation dates once per run by @OrcaWin in https://github.com/stablyai/orca/pull/19474\n* Verify failure causality in PR checks fix prompt before making changes by @AmethystLiang in https://github.com/stablyai/orca/pull/19435\n* fix(remote): keep terminal tabs syncing after orphan recovery by @shaharmor in https://github.com/stablyai/orca/pull/19065\n* perf(native-chat): bound journal reads during paged catch-up by @nwparker in https://github.com/stablyai/orca/pull/19360\n* perf(native-chat): preserve historical tool rows while streaming by @nwparker in https://github.com/stablyai/orca/pull/19364\n* perf: memoize ancestry when selecting foreground agents by @OrcaWin in https://github.com/stablyai/orca/pull/19502\n* fix(terminal): fold-safe CAN/SUB and double-ESC handling in partial-escape tail by @nwparker in https://github.com/stablyai/orca/pull/19521\n* perf: lazily index case-insensitive Windows environment keys by @OrcaWin in https://github.com/stablyai/orca/pull/19483\n* perf: select highest usage totals without full sorting by @OrcaWin in https://github.com/stablyai/orca/pull/19490\n* fix(agent-hooks): guard every Windows missing-target fallback before it reads stdin by @nwparker in https://github.com/stablyai/orca/pull/19415\n* perf: count GitLab diff line prefixes without splitting all lines by @OrcaWin in https://github.com/stablyai/orca/pull/19505\n* fix(terminal): remove host-retired ghost panes in paired remote splits (#17770) by @nwparker in https://github.com/stablyai/orca/pull/19365\n* feat(terminal): make the contrast floor user-configurable (#10754) by @nwparker in https://github.com/stablyai/orca/pull/18126\n* fix(orchestration): file federated worker mail under the coordinator Run by @Jinwoo-H in https://github.com/stablyai/orca/pull/19542\n* fix(orchestration): refuse Task re-open under a live worker; allow stop re-issue on a stranded row by @Jinwoo-H in https://github.com/stablyai/orca/pull/19551\n* fix(i18n): drop orphan TerminalPane.minimumContrast entries that broke main static analysis by @nwparker in https://github.com/stablyai/orca/pull/19566\n* Remove settled-worker automatic resume and hibernation fences by @Jinwoo-H in https://github.com/stablyai/orca/pull/19544\n* fix(pi): finish the dialog-wait signal on every surface by @nwparker in https://github.com/stablyai/orca/pull/19533\n* Organize activity menu into filter and view sections by @AmethystLiang in https://github.com/stablyai/orca/pull/19547\n* fix(orchestration): own a worker terminal from creation, not after the boot wait by @Jinwoo-H in https://github.com/stablyai/orca/pull/19608\n* fix(orchestration): fence worker release on mobile keystrokes by @Jinwoo-H in https://github.com/stablyai/orca/pull/19337\n* fix(native-chat): place effort to the right of model picker by @brennanb2025 in https://github.com/stablyai/orca/pull/19617\n* Show picker-selected native chat skills as pills by @brennanb2025 in https://github.com/stablyai/orca/pull/19616\n* fix(native-chat): reveal message chrome on keyboard focus, not any focus by @brennanb2025 in https://github.com/stablyai/orca/pull/19426\n* Unify native chat and workspace tab command dispatch by @brennanb2025 in https://github.com/stablyai/orca/pull/19621\n* fix(browser): load newly opened background tabs by @brennanb2025 in https://github.com/stablyai/orca/pull/19633\n* fix(renderer): align native chat pane layering by @brennanb2025 in https://github.com/stablyai/orca/pull/19626\n* Summarize turn file changes and preserve resolved prompt receipts by @brennanb2025 in https://github.com/stablyai/orca/pull/19229\n* perf: track pane alias singleton or ambiguity without copying buckets by @OrcaWin in https://github.com/stablyai/orca/pull/19479\n* perf: preserve store state on unchanged document titles by @OrcaWin in https://github.com/stablyai/orca/pull/19459\n* perf: index document history workspace and path identities by @OrcaWin in https://github.com/stablyai/orca/pull/19461\n* perf: index unified tabs for browser palette entries by @OrcaWin in https://github.com/stablyai/orca/pull/19464\n* perf: append to owned project source lists without repeated copying by @OrcaWin in https://github.com/stablyai/orca/pull/19465\n* perf: lazily index workspace tabs during terminal binding replay by @OrcaWin in https://github.com/stablyai/orca/pull/19466\n* perf: retire exhausted buckets from host-balanced listings by @OrcaWin in https://github.com/stablyai/orca/pull/19493\n* perf: replay pending chat asks with a FIFO cursor by @OrcaWin in https://github.com/stablyai/orca/pull/19496\n* perf: cache same-axis pane subtree weights during equalization by @OrcaWin in https://github.com/stablyai/orca/pull/19500\n* perf: group chat history sequences lazily within result windows by @OrcaWin in https://github.com/stablyai/orca/pull/19501\n* perf: measure sidebar row geometry once before sorting delete anchors by @OrcaWin in https://github.com/stablyai/orca/pull/19503\n* perf: concatenate only carried JSONL line prefixes by @OrcaWin in https://github.com/stablyai/orca/pull/19506\n* perf: index discovered skill IDs and names for batch selection by @OrcaWin in https://github.com/stablyai/orca/pull/19507\n* perf: skip fuzzy ranking when exact file matches fill the window by @OrcaWin in https://github.com/stablyai/orca/pull/19509\n* perf: index tab membership when rebasing authoritative sessions by @OrcaWin in https://github.com/stablyai/orca/pull/19510\n* perf: reuse collators when sorting discovered skills by @OrcaWin in https://github.com/stablyai/orca/pull/19440\n* perf: reuse collators when scanning Warp themes by @OrcaWin in https://github.com/stablyai/orca/pull/19441\n* perf: avoid repeated pending SOCKS payload copies by @OrcaWin in https://github.com/stablyai/orca/pull/19439\n* perf(terminal): avoid quadratic status-marker scans in output bursts by @nwparker in https://github.com/stablyai/orca/pull/19373\n* perf: index selected-host SSH leases by PTY by @OrcaWin in https://github.com/stablyai/orca/pull/19467\n* perf: index selected ancestor coverage during sidebar drag by @OrcaWin in https://github.com/stablyai/orca/pull/19443\n* perf: index Resource Manager labels and accumulated workspace rows by @OrcaWin in https://github.com/stablyai/orca/pull/19480\n* perf: drop oversized diagnostic records before retaining serialized text by @OrcaWin in https://github.com/stablyai/orca/pull/19445\n* perf: index selected skills when reporting bundle failures by @OrcaWin in https://github.com/stablyai/orca/pull/19481\n* perf: bound tool pairing and avoid unused attribution arrays by @OrcaWin in https://github.com/stablyai/orca/pull/19468\n* perf: scope activation inventory to the owning host and workspace by @OrcaWin in https://github.com/stablyai/orca/pull/19447\n* perf: index closed browser page IDs during focus cleanup by @OrcaWin in https://github.com/stablyai/orca/pull/19449\n* perf: prune metadata caches only when an entry can expire by @OrcaWin in https://github.com/stablyai/orca/pull/19450\n* perf: index observable skill installations by locked name by @OrcaWin in https://github.com/stablyai/orca/pull/19451\n* perf: skip folder-scope construction for separate repository imports by @OrcaWin in https://github.com/stablyai/orca/pull/19452\n* perf: validate terminal adoption MRU membership with group sets by @OrcaWin in https://github.com/stablyai/orca/pull/19482\n* perf: index terminal neighbor order and remaining membership by @OrcaWin in https://github.com/stablyai/orca/pull/19453\n* perf: index usage session breakdowns during aggregation and merge by @OrcaWin in https://github.com/stablyai/orca/pull/19487\n* perf: reuse AI-vault path matchers and query and sort keys by @OrcaWin in https://github.com/stablyai/orca/pull/19469\n* perf: cache AI-vault project attribution by host and cwd by @OrcaWin in https://github.com/stablyai/orca/pull/19470\n* perf: select checks-panel workspace attribution in one pass by @OrcaWin in https://github.com/stablyai/orca/pull/19471\n* perf: cache update timestamps for Linear and Jira result sorting by @OrcaWin in https://github.com/stablyai/orca/pull/19473\n* perf: reuse naturally ordered unique Codex trust ranges by @OrcaWin in https://github.com/stablyai/orca/pull/19492\n* perf: count command-line escapes without regex match arrays by @OrcaWin in https://github.com/stablyai/orca/pull/19499\n* perf: check backfill date cardinality before expanding ranges by @OrcaWin in https://github.com/stablyai/orca/pull/19456\n* perf: reuse normalized task-page repository selection by @OrcaWin in https://github.com/stablyai/orca/pull/19454\n* fix(native-chat): unify launch routing and support structured worker placement by @brennanb2025 in https://github.com/stablyai/orca/pull/19431\n* feat(native-chat): show Claude subagent activity on the shared carrier by @brennanb2025 in https://github.com/stablyai/orca/pull/18806\n* fix(orchestration): unify structured-session status across worktree ps and sidebar by @brennanb2025 in https://github.com/stablyai/orca/pull/19217\n* fix(native-chat): expand Claude slash commands sent with an attachment by @brennanb2025 in https://github.com/stablyai/orca/pull/19654\n* fix(native-chat): keep collapsible chevrons beside their header text by @brennanb2025 in https://github.com/stablyai/orca/pull/19656\n* fix(orchestration): worker-start settles readiness on observed turn start, not write acceptance by @brennanb2025 in https://github.com/stablyai/orca/pull/19423\n* test(orchestration): pin the Run-required contract for unbound direct mail by @brennanb2025 in https://github.com/stablyai/orca/pull/19684\n* fix(orchestration): accept a missing Run id from older federation coordinators by @brennanb2025 in https://github.com/stablyai/orca/pull/19689\n* Render task checklists with update diffs and a composer progress panel by @brennanb2025 in https://github.com/stablyai/orca/pull/19230\n* fix(lint): preserve deliberate collator benchmark baselines by @brennanb2025 in https://github.com/stablyai/orca/pull/19686\n* fix(native-chat): merge duplicate native-chat-types import by @Jinwoo-H in https://github.com/stablyai/orca/pull/19698\n* fix(orchestration): file mail from terminals in no Run under an unbound Run by @Jinwoo-H in https://github.com/stablyai/orca/pull/19696\n* feat(native-chat): report Codex background tasks in the chat strip by @brennanb2025 in https://github.com/stablyai/orca/pull/19346\n* Unify tab surface selection across workspace activation by @brennanb2025 in https://github.com/stablyai/orca/pull/19635\n* refactor(ai-vault): split the session scanner into a transcript reader and consumers by @Jinwoo-H in https://github.com/stablyai/orca/pull/19666\n* perf: stop queued metadata work after watcher cancellation by @OrcaWin in https://github.com/stablyai/orca/pull/19446\n* perf(runtime): skip hibernation inventories without completed agents by @nwparker in https://github.com/stablyai/orca/pull/19391\n* perf(workspaces): skip unchanged heartbeat subscriber work by @nwparker in https://github.com/stablyai/orca/pull/19392\n* perf: probe requested pane keys instead of enumerating records by @OrcaWin in https://github.com/stablyai/orca/pull/19494\n* perf: resolve current-workspace document addresses before catalog scans by @OrcaWin in https://github.com/stablyai/orca/pull/19495\n* perf: materialize only the requested recent plugin audit lines by @OrcaWin in https://github.com/stablyai/orca/pull/19498\n* test(ci): replace fixed teardown waits with bounded polls by @nwparker in https://github.com/stablyai/orca/pull/19720\n* perf: stop merging OS-opened files at the pending queue cap by @OrcaWin in https://github.com/stablyai/orca/pull/19508\n* perf(terminal): skip plain text between partial escape sequences by @nwparker in https://github.com/stablyai/orca/pull/19393\n* perf(terminal): release oversized backing strings behind pending controls by @nwparker in https://github.com/stablyai/orca/pull/19396\n* perf(terminal): skip ordinary output in preview control scans by @nwparker in https://github.com/stablyai/orca/pull/19400\n* perf(terminal): own retained tail rows so they stop pinning their chunks by @nwparker in https://github.com/stablyai/orca/pull/19528\n* perf: check tunnel queue capacity before copying frame payloads by @OrcaWin in https://github.com/stablyai/orca/pull/19497\n* Replace the sidebar create dropdown with two direct action buttons by @AmethystLiang in https://github.com/stablyai/orca/pull/19653\n* fix(native-chat): keep worktree active during chat creation by @Jinwoo-H in https://github.com/stablyai/orca/pull/19753\n* fix(push): isolate deployment and validate candidates before activation by @Jinwoo-H in https://github.com/stablyai/orca/pull/19771\n* fix(native-chat): show Claude working from the send, not the provider echo by @brennanb2025 in https://github.com/stablyai/orca/pull/19822\n* fix(mobile): enable patch-free iOS text selection in native chat by @brennanb2025 in https://github.com/stablyai/orca/pull/19769\n* perf(terminal): resume OSC terminator search past the carried frame by @nwparker in https://github.com/stablyai/orca/pull/19839\n* perf(native-chat): bound retained items on the structured session path by @nwparker in https://github.com/stablyai/orca/pull/19841\n* perf(terminal): share one ESC dispatch table between the two scanners by @nwparker in https://github.com/stablyai/orca/pull/19842\n* fix(native-chat): one `/` picker for every agent, anywhere in the prompt by @brennanb2025 in https://github.com/stablyai/orca/pull/19832\n* feat(native-chat): the background-tasks strip says what is running by @brennanb2025 in https://github.com/stablyai/orca/pull/19311\n* fix(i18n): drop the stale TerminalPane.minimumContrast entries from the runtime catalog (main red again) by @nwparker in https://github.com/stablyai/orca/pull/19575\n* fix(native-chat): keep an older page from punching a hole in the transcript by @nwparker in https://github.com/stablyai/orca/pull/19845\n* refactor(agent-status): publish structured sessions into the hook server store by @brennanb2025 in https://github.com/stablyai/orca/pull/19683\n* fix(orchestration): scope @ group addresses to the sender's Run by @Jinwoo-H in https://github.com/stablyai/orca/pull/19783\n* feat(native-chat): show live background work and name each row by kind by @brennanb2025 in https://github.com/stablyai/orca/pull/19705\n* feat(sidebar): show native-chat subagents as sidebar child rows, like CLI agents already do by @brennanb2025 in https://github.com/stablyai/orca/pull/19807\n* feat(native-chat): focus the message box when a chat appears by @brennanb2025 in https://github.com/stablyai/orca/pull/19868\n* fix(relay): keep failed rehome polls out of the durable failure budget by @Jinwoo-H in https://github.com/stablyai/orca/pull/19915\n* fix(orchestration): revalidate an attempted Enter instead of resending it by @brennanb2025 in https://github.com/stablyai/orca/pull/19911\n* test(native-chat): split structured question fixtures by @brennanb2025 in https://github.com/stablyai/orca/pull/19924\n* Make the structured turn lifecycle row durable so completed durations survive by @brennanb2025 in https://github.com/stablyai/orca/pull/19695\n* refactor(native-chat): unify agent session launch and open drafts in structured chat by @brennanb2025 in https://github.com/stablyai/orca/pull/19681\n* feat(cloud): native push gateway and dedicated infrastructure (1/3) by @Jinwoo-H in https://github.com/stablyai/orca/pull/19912\n* fix(browser): restore the Chrome-shaped browser identity (STA-7147) by @brennanb2025 in https://github.com/stablyai/orca/pull/19927\n* refactor(mobile): extract settings, diagnostics and editor-document screens from their routes by @Jinwoo-H in https://github.com/stablyai/orca/pull/19675\n* fix(native-chat): never adopt an unlisted model as the launch default by @brennanb2025 in https://github.com/stablyai/orca/pull/19854\n* fix(native-chat): settle a structured send on admission, not on the provider echo by @brennanb2025 in https://github.com/stablyai/orca/pull/19863\n* feat(desktop): native mobile push integration (2/3) by @Jinwoo-H in https://github.com/stablyai/orca/pull/19935\n* fix(sidebar): let an agent row show the provider's own session title by @brennanb2025 in https://github.com/stablyai/orca/pull/19936\n* fix(editor): make markdown images inline so a paragraph stays schema-valid by @OrcaWin in https://github.com/stablyai/orca/pull/19746\n* feat(native-chat): record the provider's name for an agent session by @brennanb2025 in https://github.com/stablyai/orca/pull/19908\n* fix(release): port three release-gate fixes to main so cuts stop re-inheriting them by @brennanb2025 in https://github.com/stablyai/orca/pull/19945\n* refactor(renderer): share path head elision by @AmethystLiang in https://github.com/stablyai/orca/pull/19938\n* feat(cmd-j): compact palette location layout by @AmethystLiang in https://github.com/stablyai/orca/pull/19939\n* refactor(mobile): name the RPC acceptance policies call sites hand-rolled by @Jinwoo-H in https://github.com/stablyai/orca/pull/19960\n* fix: prompt unexpectedly signed-out Cloud users once per version by @Jinwoo-H in https://github.com/stablyai/orca/pull/19966\n* feat(ai-vault-search): session search index as a transcript reader consumer by @Jinwoo-H in https://github.com/stablyai/orca/pull/19687\n* fix(native-chat): pass agent-implemented slash commands through to the agent by @brennanb2025 in https://github.com/stablyai/orca/pull/19929\n* perf(terminal): stop rebuilding per-workspace collections on a worktree switch by @nwparker in https://github.com/stablyai/orca/pull/19975\n* feat(rpc): generate a shared params catalog from the host registry, gated on parse parity by @Jinwoo-H in https://github.com/stablyai/orca/pull/19961\n* feat(native-chat): describe slash commands from the provider's own report by @brennanb2025 in https://github.com/stablyai/orca/pull/19928\n* perf(terminal): stop spending reveal-restore frames on panes that replay nothing by @nwparker in https://github.com/stablyai/orca/pull/19972\n* i18n: Make file reveal labels translatable by @OrcaWin in https://github.com/stablyai/orca/pull/20010\n* perf(native-chat): mount only the transcript rows near the viewport by @brennanb2025 in https://github.com/stablyai/orca/pull/19869\n* feat(mobile): receive native push notifications from paired desktops by @Jinwoo-H in https://github.com/stablyai/orca/pull/19951\n* fix(workspaces): seed shells only for blank selection by @brennanb2025 in https://github.com/stablyai/orca/pull/19940\n* Hide desktop theme imports from paired web clients by @OrcaWin in https://github.com/stablyai/orca/pull/20015\n* feat(ai-vault-search): session search query engine over the index by @Jinwoo-H in https://github.com/stablyai/orca/pull/19750\n* refactor(shared): derive WellKnownAgentType from TuiAgent by @AmethystLiang in https://github.com/stablyai/orca/pull/19645\n* Revert \"feat(ai-vault-search): session search query engine over the index (#19750)\" by @Jinwoo-H in https://github.com/stablyai/orca/pull/20023\n* feat(ai-vault-search): session search indexer library owning backfill, reconcile and retention by @Jinwoo-H in https://github.com/stablyai/orca/pull/19751\n* refactor(rpc): make defineMethod preserve the method name and handler result by @Jinwoo-H in https://github.com/stablyai/orca/pull/20016\n* fix(daemon): pin owner-only modes on persisted terminal history by @nwparker in https://github.com/stablyai/orca/pull/19954\n* Revert mobile push rollout pending delivery investigation by @Jinwoo-H in https://github.com/stablyai/orca/pull/20040\n* fix(pi): retire stale spinner and prompt timers across reloads by @nwparker in https://github.com/stablyai/orca/pull/20035\n* fix(terminal): stop the recovery budget erasing itself during a remount by @OrcaWin in https://github.com/stablyai/orca/pull/19745\n* fix(monaco): bound embedded-language recursion in svelte/astro/vue grammars by @OrcaWin in https://github.com/stablyai/orca/pull/19748\n* fix(runtime): agent-neutral wait-blocked reasons by @OrcaWin in https://github.com/stablyai/orca/pull/19749\n* fix(worktrees): close an idle structured chat on delete instead of refusing by @brennanb2025 in https://github.com/stablyai/orca/pull/19762\n* fix(runtime): let connections own host status recovery by @Jinwoo-H in https://github.com/stablyai/orca/pull/20003\n* fix(native-chat): show one live-turn indicator, and make Thinking mean reasoning by @brennanb2025 in https://github.com/stablyai/orca/pull/19977\n* perf(terminal): mount only the visible pane on a worktree switch by @nwparker in https://github.com/stablyai/orca/pull/20034\n* test(monaco): drive the real Monarch tokenizer instead of walking rule tables by @nwparker in https://github.com/stablyai/orca/pull/19981\n* test(runtime): capture real Antigravity transcripts — the detector is inverted on live output by @nwparker in https://github.com/stablyai/orca/pull/19983\n* fix(pi): claim the status pane when the inherited owner PID is dead (STA-5245) by @brennanb2025 in https://github.com/stablyai/orca/pull/16631\n* fix(pi): load extension providers for source control generation by @nwparker in https://github.com/stablyai/orca/pull/20070\n* fix(terminal): keep a deliberately slept workspace cold until it is woken by @nwparker in https://github.com/stablyai/orca/pull/20075\n* perf(daemon): stop scanning every cell for OSC links that cannot exist by @nwparker in https://github.com/stablyai/orca/pull/20077\n* fix(terminal): move the recovery ledger onto the tab row and gate it on observed outcome by @nwparker in https://github.com/stablyai/orca/pull/20025\n* fix(push): preserve distinct Android alerts while offline by @Jinwoo-H in https://github.com/stablyai/orca/pull/20066\n* feat(native-chat): show when a Codex goal is set, changed, or cleared by @brennanb2025 in https://github.com/stablyai/orca/pull/19923\n* Fix remote hosted review browser routing by @Jinwoo-H in https://github.com/stablyai/orca/pull/20030\n* fix(mobile): surface host create warnings and terminal-create errors by @brennanb2025 in https://github.com/stablyai/orca/pull/20125\n* feat(relay): correct regional placement only when the source is idle by @Jinwoo-H in https://github.com/stablyai/orca/pull/20105\n* test(relay): harden regional rehome race coverage by @Jinwoo-H in https://github.com/stablyai/orca/pull/20136\n* feat(desktop): measure relay regions and reconnect after idle cutover by @Jinwoo-H in https://github.com/stablyai/orca/pull/20106\n* refactor(agent-status): delete the runtime's retained row store (PR 1b) by @brennanb2025 in https://github.com/stablyai/orca/pull/19785\n* fix(deps): take Electron 43.7.0 for the glibc environ use-after-free (#20081) by @nwparker in https://github.com/stablyai/orca/pull/20089\n* fix(browser): decode Chromium SameSite storage values (135 cookies silently lost per profile) by @brennanb2025 in https://github.com/stablyai/orca/pull/20076\n* fix(terminal): re-run deferred tab admission when a plan installs mid-activation by @brennanb2025 in https://github.com/stablyai/orca/pull/20176\n* fix(workspaces): complete a worktree create when a post-create step throws by @brennanb2025 in https://github.com/stablyai/orca/pull/20175\n* feat(relay): support protocol 3 in cell rollout gates by @Jinwoo-H in https://github.com/stablyai/orca/pull/20174\n* fix(e2e): remove four real flake sources and one caret race by @brennanb2025 in https://github.com/stablyai/orca/pull/20169\n* fix(source-control): pass the Antigravity prompt to agy --print by @nwparker in https://github.com/stablyai/orca/pull/20147\n* fix(e2e): run worktree first-paint probe on a mapped window by @brennanb2025 in https://github.com/stablyai/orca/pull/20197\n* fix(relay): bound idle rehome polling and skip disabled scans by @Jinwoo-H in https://github.com/stablyai/orca/pull/20203\n* fix(hooks): stop orphaned managed markers from consuming user TOML by @nwparker in https://github.com/stablyai/orca/pull/20148\n* fix(codex): reconcile marketplace and plugin tables through the config mirror by @nwparker in https://github.com/stablyai/orca/pull/20150\n* fix(relay): reuse canary across completed rollout batches by @Jinwoo-H in https://github.com/stablyai/orca/pull/20214\n* Restore mobile push and fix cold-start dismissals by @Jinwoo-H in https://github.com/stablyai/orca/pull/20068\n* fix(cloud): tolerate sparse director errors in rollout monitor by @Jinwoo-H in https://github.com/stablyai/orca/pull/20238\n* feat(ai-vault-search): session search query engine over the index by @Jinwoo-H in https://github.com/stablyai/orca/pull/20029\n* feat(mobile): add typed RPC operations and fence raw requests by @Jinwoo-H in https://github.com/stablyai/orca/pull/20018\n* fix(native-chat): shrink skill pill text by @brennanb2025 in https://github.com/stablyai/orca/pull/20254\n* fix(claude): refuse a structured model the provider does not list by @brennanb2025 in https://github.com/stablyai/orca/pull/19946\n* perf: defer closed menus to speed up cold worktree switching by @nwparker in https://github.com/stablyai/orca/pull/20311\n* test: replace fixed UI waits with observable readiness by @nwparker in https://github.com/stablyai/orca/pull/20369\n* ci: reuse immutable package setup across shutdown checks by @nwparker in https://github.com/stablyai/orca/pull/20368\n* perf: index Hermes session correlation instead of rescanning history by @nwparker in https://github.com/stablyai/orca/pull/20275\n* fix: prevent infinite loops in mobile Markdown rendering by @nwparker in https://github.com/stablyai/orca/pull/20313\n* perf: eliminate mobile review table delimiter backtracking by @nwparker in https://github.com/stablyai/orca/pull/20317\n* perf: eliminate repeated mobile Markdown link suffix scans by @nwparker in https://github.com/stablyai/orca/pull/20322\n* ci: narrow pnpm cache keys and shallow development checkouts by @nwparker in https://github.com/stablyai/orca/pull/20370\n* perf(browser): fill plain fields in one stdin edit by @nwparker in https://github.com/stablyai/orca/pull/20364\n* Fix landing footer menu placement by @nwparker in https://github.com/stablyai/orca/pull/20360\n* ci: balance existing unit and E2E shards using recorded timings by @nwparker in https://github.com/stablyai/orca/pull/20367\n* fix(cloud): diagnose wrapped relay trust probe failures by @Jinwoo-H in https://github.com/stablyai/orca/pull/20403\n* refactor(renderer): improve IPC error handling with clamped and unclamped variants by @AmethystLiang in https://github.com/stablyai/orca/pull/20340\n* Make sidebar nesting easier while preserving animated reordering by @nwparker in https://github.com/stablyai/orca/pull/20412\n* refactor(preload): drop the unused raw electron IPC bridge by @nwparker in https://github.com/stablyai/orca/pull/20419\n* fix(browser): move cookie scoping off psl's stale suffix list by @nwparker in https://github.com/stablyai/orca/pull/20421\n* fix(claude-accounts): stop path resolution from creating the config directory by @makoto-developer in https://github.com/stablyai/orca/pull/12309\n* perf: normalize title evidence once per label search by @nwparker in https://github.com/stablyai/orca/pull/20331\n* fix(runtime): GC expired proven-absent leaf PTY verdicts by @innocarpe in https://github.com/stablyai/orca/pull/12810\n* fix(ai-vault): close OpenCode handles when query_only setup fails by @bbingz in https://github.com/stablyai/orca/pull/14134\n* perf(wsl): release environment probe deadline timers by @OrcaWin in https://github.com/stablyai/orca/pull/20207\n* perf(daemon): bound immediate flush queue scans by @OrcaWin in https://github.com/stablyai/orca/pull/20209\n* perf(mobile): normalize history scope paths once per candidate by @nwparker in https://github.com/stablyai/orca/pull/20210\n* perf(automations): skip sorting count-only Hermes history by @OrcaWin in https://github.com/stablyai/orca/pull/20213\n* perf(chat): reuse streamed delta byte lengths by @OrcaWin in https://github.com/stablyai/orca/pull/20215\n* perf(files): skip unused Quick Open byte accounting by @OrcaWin in https://github.com/stablyai/orca/pull/20216\n* perf(relay): reuse host data attachment owner without inventory copies by @nwparker in https://github.com/stablyai/orca/pull/20219\n* perf(mobile): avoid materializing input characters on backspace by @OrcaWin in https://github.com/stablyai/orca/pull/20220\n* perf(browser): skip unneeded inventory compaction planning by @OrcaWin in https://github.com/stablyai/orca/pull/20221\n* perf(usage): skip session scans for empty breakdowns by @OrcaWin in https://github.com/stablyai/orca/pull/20222\n* perf(session): reuse persisted tab membership set by @OrcaWin in https://github.com/stablyai/orca/pull/20223\n* perf(diff): skip unused extension extraction during search by @OrcaWin in https://github.com/stablyai/orca/pull/20225\n* perf(mobile): bound autocomplete substring retention by @OrcaWin in https://github.com/stablyai/orca/pull/20226\n* perf: index pending terminal reconnect tab lookups by @OrcaWin in https://github.com/stablyai/orca/pull/20229\n* perf: skip ordinary strings in JSON structure checks by @OrcaWin in https://github.com/stablyai/orca/pull/20232\n* perf: avoid rescanning partial browser sidecar responses by @OrcaWin in https://github.com/stablyai/orca/pull/20242\n* perf: count local RPC request bytes incrementally by @OrcaWin in https://github.com/stablyai/orca/pull/20243\n* perf(history): cache numeric transcript timeline bounds by @OrcaWin in https://github.com/stablyai/orca/pull/20244\n* perf: stop heading lookup at the requested occurrence by @OrcaWin in https://github.com/stablyai/orca/pull/20246\n* perf: defer browser search row formatting until matched by @OrcaWin in https://github.com/stablyai/orca/pull/20248\n* perf: stop preparing over-limit palette queries by @OrcaWin in https://github.com/stablyai/orca/pull/20250\n* perf: avoid duplicate repository directory probes by @OrcaWin in https://github.com/stablyai/orca/pull/20253\n* perf: compile nested repository ignore patterns once by @OrcaWin in https://github.com/stablyai/orca/pull/20256\n* perf: avoid repeated model pricing name normalization by @OrcaWin in https://github.com/stablyai/orca/pull/20257\n* perf(skills): index source ownership counts per discovery by @OrcaWin in https://github.com/stablyai/orca/pull/20259\n* perf(plugins): stop collection traversal at message size limit by @nwparker in https://github.com/stablyai/orca/pull/20260\n* perf(history): scan legacy alternate-screen markers linearly by @OrcaWin in https://github.com/stablyai/orca/pull/20267\n* perf: reuse skill file digest when normalized bytes match by @OrcaWin in https://github.com/stablyai/orca/pull/20268\n* perf(native): avoid sanitizing snapshot values twice by @nwparker in https://github.com/stablyai/orca/pull/20271\n* perf: encode skill Git tree sort keys once by @OrcaWin in https://github.com/stablyai/orca/pull/20272\n* perf: skip decoding discarded diagnostic error bodies by @OrcaWin in https://github.com/stablyai/orca/pull/20276\n* perf: avoid flattening tabs for smart-sort liveness check by @OrcaWin in https://github.com/stablyai/orca/pull/20279\n* perf: accept UTF-8 text that fits the worst-case byte bound by @OrcaWin in https://github.com/stablyai/orca/pull/20286\n* perf: bound rich Markdown comment detection and preservation scans by @nwparker in https://github.com/stablyai/orca/pull/20287\n* perf(ipc): bound SSH ACK batch selection scans by @nwparker in https://github.com/stablyai/orca/pull/20288\n* perf: avoid copying completed terminal source ranges by @OrcaWin in https://github.com/stablyai/orca/pull/20289\n* perf(ssh): skip terminal source spans awaiting ACK publication by @OrcaWin in https://github.com/stablyai/orca/pull/20290\n* perf: reuse diagnostic bundle byte count by @OrcaWin in https://github.com/stablyai/orca/pull/20292\n* perf: normalize manifest text files once by @OrcaWin in https://github.com/stablyai/orca/pull/20294\n* perf: reuse formatter within reset timestamp conversion by @OrcaWin in https://github.com/stablyai/orca/pull/20295\n* perf: defer scrollback pruning indexes until needed by @OrcaWin in https://github.com/stablyai/orca/pull/20297\n* perf(daemon): reuse encoded unsplit NDJSON frames by @nwparker in https://github.com/stablyai/orca/pull/20298\n* perf(browser): index iframe session refs for snapshot lookup by @nwparker in https://github.com/stablyai/orca/pull/20300\n* perf: reuse computed project identity in projection by @OrcaWin in https://github.com/stablyai/orca/pull/20303\n* perf: stop archive size scan once over budget by @OrcaWin in https://github.com/stablyai/orca/pull/20304\n* perf: avoid per-item arrays in journal projection by @OrcaWin in https://github.com/stablyai/orca/pull/20305\n* perf: reuse Windows PATH normalization within merges by @OrcaWin in https://github.com/stablyai/orca/pull/20309\n* perf: find path basename without splitting all segments by @OrcaWin in https://github.com/stablyai/orca/pull/20312\n* perf(ssh): copy cleanup tab map only once by @OrcaWin in https://github.com/stablyai/orca/pull/20315\n* perf: fast-path Windows arguments without escapes by @OrcaWin in https://github.com/stablyai/orca/pull/20318\n* perf(checks): bound log excerpt byte-limit checks by @OrcaWin in https://github.com/stablyai/orca/pull/20319\n* perf: use native newline search in rich Markdown code stripping by @nwparker in https://github.com/stablyai/orca/pull/20320\n* perf: stop building chat diff sections beyond preview limit by @OrcaWin in https://github.com/stablyai/orca/pull/20321\n* perf: count chat tool calls without a filtered array by @OrcaWin in https://github.com/stablyai/orca/pull/20328\n* perf: reject file-count labels before parsing edit patches by @OrcaWin in https://github.com/stablyai/orca/pull/20330\n* perf(terminal): reuse bounded native snapshot byte checks by @OrcaWin in https://github.com/stablyai/orca/pull/20333\n* perf: select matching model IDs without sorting by @OrcaWin in https://github.com/stablyai/orca/pull/20334\n* perf: remove duplicate empty-file filtering from search finalization by @OrcaWin in https://github.com/stablyai/orca/pull/20335\n* perf: avoid repeated history page byte serialization by @nwparker in https://github.com/stablyai/orca/pull/20337\n* perf: collect terminal snapshot replay without wrapper arrays by @OrcaWin in https://github.com/stablyai/orca/pull/20338\n* perf: reuse accepted project group IDs for parent validation by @OrcaWin in https://github.com/stablyai/orca/pull/20341\n* perf: compute check severity once per sort by @OrcaWin in https://github.com/stablyai/orca/pull/20342\n* perf: count bot comments without a filtered array by @OrcaWin in https://github.com/stablyai/orca/pull/20343\n* perf: index relay drain migration inventories once by @nwparker in https://github.com/stablyai/orca/pull/20344\n* perf: avoid typed-array iteration in shared SHA-256 blocks by @OrcaWin in https://github.com/stablyai/orca/pull/20346\n* perf: reuse shared SHA-256 for renderer fallback by @OrcaWin in https://github.com/stablyai/orca/pull/20347\n* perf(computer): avoid rescanning fragmented native provider replies by @OrcaWin in https://github.com/stablyai/orca/pull/20348\n* perf: skip nonmatching spans in Quick Open scoring by @nwparker in https://github.com/stablyai/orca/pull/20349\n* perf: skip dominated quick command search fields by @nwparker in https://github.com/stablyai/orca/pull/20352\n* perf: reuse normalized executable during agent recognition by @OrcaWin in https://github.com/stablyai/orca/pull/20353\n* perf(localization): prefilter absent brands before regex matching by @OrcaWin in https://github.com/stablyai/orca/pull/20354\n* perf: avoid copying single-chunk process output by @OrcaWin in https://github.com/stablyai/orca/pull/20355\n* perf: scan chat activity text from its last line by @nwparker in https://github.com/stablyai/orca/pull/20356\n* perf(mobile): reuse UTF-8 prefix truncation for diagnostics by @OrcaWin in https://github.com/stablyai/orca/pull/20358\n* perf(checks): bound earlier error context collection by @OrcaWin in https://github.com/stablyai/orca/pull/20211\n* perf(mobile): reuse numeric collators across source control sorts by @nwparker in https://github.com/stablyai/orca/pull/20224\n* perf(mobile): precompute task sort keys and reuse repository collation by @nwparker in https://github.com/stablyai/orca/pull/20233\n* perf(agents): avoid cloning lineage ancestor sets by @OrcaWin in https://github.com/stablyai/orca/pull/20236\n* perf(plugins): reconcile shortcut conflicts once per owner by @nwparker in https://github.com/stablyai/orca/pull/20237\n* perf: avoid rescanning partial transcript records by @OrcaWin in https://github.com/stablyai/orca/pull/20239\n* perf: use native newline search for Markdown review excerpts by @nwparker in https://github.com/stablyai/orca/pull/20245\n* perf(ai-vault): deduplicate session scan batches incrementally by @OrcaWin in https://github.com/stablyai/orca/pull/20255\n* perf: stop review acknowledgement summaries at the first readable line by @nwparker in https://github.com/stablyai/orca/pull/20263\n* perf(git): classify bulk discard paths once by @nwparker in https://github.com/stablyai/orca/pull/20274\n* perf: eliminate quadratic palette phrase placement scans by @nwparker in https://github.com/stablyai/orca/pull/20306\n* perf: avoid repeated unclosed-tag scans in mobile reviews by @nwparker in https://github.com/stablyai/orca/pull/20329\n* perf(plugins): index contributed keybindings by command by @nwparker in https://github.com/stablyai/orca/pull/20241\n* perf(mobile): precompute Linear issue sort keys by @nwparker in https://github.com/stablyai/orca/pull/20249\n* perf(chat): join transcript line fragments at record boundaries by @OrcaWin in https://github.com/stablyai/orca/pull/20278\n* perf(cmd-j): scan phrase word boundaries monotonically by @nwparker in https://github.com/stablyai/orca/pull/20282\n* perf(ai-vault): count recent sessions for scan cutoffs by @OrcaWin in https://github.com/stablyai/orca/pull/20301\n* perf: remove repeated sibling scans from cyclic agent lineage cleanup by @nwparker in https://github.com/stablyai/orca/pull/20302\n* perf: reuse pending filesystem watcher debounce timers by @OrcaWin in https://github.com/stablyai/orca/pull/20264\n* fix(editor): eliminate multi-second Markdown blank-run scans by @nwparker in https://github.com/stablyai/orca/pull/20231\n* perf: avoid rescanning partial Windows desktop responses by @OrcaWin in https://github.com/stablyai/orca/pull/20235\n* fix(chat): bound journal replay memory by live history by @nwparker in https://github.com/stablyai/orca/pull/20247\n* perf(android): queue fragmented scrcpy video packets by @OrcaWin in https://github.com/stablyai/orca/pull/20230\n* perf(mobile): skip successful duplicate connection log saves by @nwparker in https://github.com/stablyai/orca/pull/20252\n* perf: skip impossible inline HTML comment matches during encoding by @nwparker in https://github.com/stablyai/orca/pull/20293\n* chore: remove 20.7 MiB of duplicate and unused media by @nwparker in https://github.com/stablyai/orca/pull/20416\n* perf: bound whitespace normalization for tool previews by @nwparker in https://github.com/stablyai/orca/pull/20332\n* fix(tabs): cancel split drags when the window loses focus by @OrcaWin in https://github.com/stablyai/orca/pull/20323\n* fix(updater): open background check errors from the status bar by @OrcaWin in https://github.com/stablyai/orca/pull/20270\n* perf(relay): sort latency samples once per percentile pair by @nwparker in https://github.com/stablyai/orca/pull/20427\n* perf(skills): test agent ownership without building a deduped list by @nwparker in https://github.com/stablyai/orca/pull/20428\n* perf(git): reject non-HEAD refs before sorting remotes by @nwparker in https://github.com/stablyai/orca/pull/20429\n* perf(mobile): release consumed terminal write-queue slots by @nwparker in https://github.com/stablyai/orca/pull/20430\n* perf(git): normalize tracked discard paths once per operation by @nwparker in https://github.com/stablyai/orca/pull/20299\n* refactor(windows): vendor the registry addon as @orca/windows-registry by @nwparker in https://github.com/stablyai/orca/pull/20438\n* fix(resource-manager): show saved folder workspace names and groups by @OrcaWin in https://github.com/stablyai/orca/pull/20324\n* test(relay): differential coverage for the single-pass host-data owner lookup by @nwparker in https://github.com/stablyai/orca/pull/20426\n* perf(mobile): reuse Linear grouping between list and board by @nwparker in https://github.com/stablyai/orca/pull/20431\n* chore(deps): pin serve-sim to an exact version by @nwparker in https://github.com/stablyai/orca/pull/20446\n* Add code quality lint for type assertions by @AmethystLiang in https://github.com/stablyai/orca/pull/19462\n* fix(ci): cache the vendored addon where node-gyp actually writes it by @nwparker in https://github.com/stablyai/orca/pull/20445\n* perf: accelerate cancellable remote transcript line scanning by @OrcaWin in https://github.com/stablyai/orca/pull/20351\n* fix(ci): match the truncated windows-process-tree virtual store dir by @nwparker in https://github.com/stablyai/orca/pull/20447\n* build(macos): parallelize native helpers with complete cancellation by @espetro in https://github.com/stablyai/orca/pull/19651\n* perf: skip WSL discovery when filtering native-only paths by @OrcaWin in https://github.com/stablyai/orca/pull/20266\n* perf(mobile): reuse Linear ordering for list and board grouping by @nwparker in https://github.com/stablyai/orca/pull/20314\n* Reduce native dependency installs to the host platform by @nwparker in https://github.com/stablyai/orca/pull/20420\n* perf(ai-vault): bound per-row bookkeeping in unlimited session scans by @nwparker in https://github.com/stablyai/orca/pull/20291\n* perf(tooling): reuse directory entry types in source scans by @OrcaWin in https://github.com/stablyai/orca/pull/20212\n* fix(skills): evict removed runtime discovery cache by @bbingz in https://github.com/stablyai/orca/pull/11489\n* fix(automations): isolate the scheduler tick and refuse oversized cron steps by @nwparker in https://github.com/stablyai/orca/pull/20152\n* fix(runtime): stop a name-only agent title from satisfying tui-idle by @nwparker in https://github.com/stablyai/orca/pull/20155\n* fix(agent-hooks): stop navigation Escape from inferring completion by @nwparker in https://github.com/stablyai/orca/pull/20149\n* fix(mobile): reuse current workspace on notification taps by @Jinwoo-H in https://github.com/stablyai/orca/pull/20310\n* fix(ai-vault): re-read a transcript rewritten to its previous size by @Jinwoo-H in https://github.com/stablyai/orca/pull/20261\n* fix(sidebar): show agent activity before workspace activation by @Jinwoo-H in https://github.com/stablyai/orca/pull/20398\n* test(rpc): add a compile-time params catalog parity gate by @Jinwoo-H in https://github.com/stablyai/orca/pull/20281\n* test(scripts): widen the Windows shim ratchet to catch package bin spawns by @Jinwoo-H in https://github.com/stablyai/orca/pull/20285\n* refactor(native-chat): give each structured dispatch state exactly one meaning by @brennanb2025 in https://github.com/stablyai/orca/pull/20133\n* feat(native-chat): decide a restart-stranded send against provider history by @brennanb2025 in https://github.com/stablyai/orca/pull/20139\n* fix(native-chat): wait for the runtime capability probe before resolving the creation launch route by @brennanb2025 in https://github.com/stablyai/orca/pull/19819\n* fix(worktrees): retire the chat tab of a chat with no child when its workspace goes by @brennanb2025 in https://github.com/stablyai/orca/pull/19970\n* feat(ai-vault-search): public session search contract and transports by @Jinwoo-H in https://github.com/stablyai/orca/pull/20277\n* refactor(mobile): migrate settings reads to RpcOperation by @Jinwoo-H in https://github.com/stablyai/orca/pull/20499\n* fix(mobile): give native chat one tail-follow owner so streaming stops jumping by @brennanb2025 in https://github.com/stablyai/orca/pull/20493\n* fix(mobile): preserve delivery ambiguity across transport cutover by @Jinwoo-H in https://github.com/stablyai/orca/pull/20280\n* fix(runtime): reject malformed file Base64 padding by @Jinwoo-H in https://github.com/stablyai/orca/pull/20283\n* fix(tasks): preserve repository results under GitHub search quota by @OrcaWin in https://github.com/stablyai/orca/pull/20460\n* fix(ai-vault): stream oversized remote session transcripts by @OrcaWin in https://github.com/stablyai/orca/pull/20455\n* fix(grok): stop replayed Claude/Cursor hooks reporting Grok panes as Claude by @brennanb2025 in https://github.com/stablyai/orca/pull/20507\n* fix(browser): press keys through a US-layout CDP key table instead of a subprocess per keystroke by @atreidesend in https://github.com/stablyai/orca/pull/15310\n* fix(rpc): validate provider-specific fields in TaskProviderIdentity by @Jinwoo-H in https://github.com/stablyai/orca/pull/20284\n* perf(terminal): batch file-link checks on their owning host by @OrcaWin in https://github.com/stablyai/orca/pull/20463\n* feat(native-chat): support file drag and drop by @brennanb2025 in https://github.com/stablyai/orca/pull/20494\n\n## New Contributors\n* @tb-soshiro made their first contribution in https://github.com/stablyai/orca/pull/18787\n* @NaoyaTatetsu made their first contribution in https://github.com/stablyai/orca/pull/17795\n* @ramarivera made their first contribution in https://github.com/stablyai/orca/pull/12772\n* @Aladex made their first contribution in https://github.com/stablyai/orca/pull/18634\n* @weekbin made their first contribution in https://github.com/stablyai/orca/pull/14929\n* @TimothyVang made their first contribution in https://github.com/stablyai/orca/pull/17936\n* @brohoya made their first contribution in https://github.com/stablyai/orca/pull/11756\n* @blade035 made their first contribution in https://github.com/stablyai/orca/pull/17731\n* @kiendle made their first contribution in https://github.com/stablyai/orca/pull/19170\n* @espetro made their first contribution in https://github.com/stablyai/orca/pull/19651\n* @atreidesend made their first contribution in https://github.com/stablyai/orca/pull/15310\n\n**Full Changelog**: https://github.com/stablyai/orca/compare/mobile-android-v0.0.48...mobile-android-v0.0.50\n",
+  "reactions": {
+    "url": "https://api.github.com/repos/stablyai/orca/releases/391254643/reactions",
+    "total_count": 18,
+    "+1": 0,
+    "-1": 0,
+    "laugh": 0,
+    "hooray": 0,
+    "confused": 0,
+    "heart": 14,
+    "rocket": 4,
+    "eyes": 0
+  },
+  "mentions_count": 21
+}
diff --git a/mobile/src/app-update/fixtures/itunes-lookup-com.stably.orca.mobile.json b/mobile/src/app-update/fixtures/itunes-lookup-com.stably.orca.mobile.json
new file mode 100644
index 00000000000..f4de826ef72
--- /dev/null
+++ b/mobile/src/app-update/fixtures/itunes-lookup-com.stably.orca.mobile.json
@@ -0,0 +1,189 @@
+{
+  "resultCount": 1,
+  "results": [
+    {
+      "isGameCenterEnabled": false,
+      "features": ["iosUniversal"],
+      "supportedDevices": [
+        "iPhone5s-iPhone5s",
+        "iPadAir-iPadAir",
+        "iPadAirCellular-iPadAirCellular",
+        "iPadMiniRetina-iPadMiniRetina",
+        "iPadMiniRetinaCellular-iPadMiniRetinaCellular",
+        "iPhone6-iPhone6",
+        "iPhone6Plus-iPhone6Plus",
+        "iPadAir2-iPadAir2",
+        "iPadAir2Cellular-iPadAir2Cellular",
+        "iPadMini3-iPadMini3",
+        "iPadMini3Cellular-iPadMini3Cellular",
+        "iPodTouchSixthGen-iPodTouchSixthGen",
+        "iPhone6s-iPhone6s",
+        "iPhone6sPlus-iPhone6sPlus",
+        "iPadMini4-iPadMini4",
+        "iPadMini4Cellular-iPadMini4Cellular",
+        "iPadPro-iPadPro",
+        "iPadProCellular-iPadProCellular",
+        "iPadPro97-iPadPro97",
+        "iPadPro97Cellular-iPadPro97Cellular",
+        "iPhoneSE-iPhoneSE",
+        "iPhone7-iPhone7",
+        "iPhone7Plus-iPhone7Plus",
+        "iPad611-iPad611",
+        "iPad612-iPad612",
+        "iPad71-iPad71",
+        "iPad72-iPad72",
+        "iPad73-iPad73",
+        "iPad74-iPad74",
+        "iPhone8-iPhone8",
+        "iPhone8Plus-iPhone8Plus",
+        "iPhoneX-iPhoneX",
+        "iPad75-iPad75",
+        "iPad76-iPad76",
+        "iPhoneXS-iPhoneXS",
+        "iPhoneXSMax-iPhoneXSMax",
+        "iPhoneXR-iPhoneXR",
+        "iPad812-iPad812",
+        "iPad834-iPad834",
+        "iPad856-iPad856",
+        "iPad878-iPad878",
+        "iPadMini5-iPadMini5",
+        "iPadMini5Cellular-iPadMini5Cellular",
+        "iPadAir3-iPadAir3",
+        "iPadAir3Cellular-iPadAir3Cellular",
+        "iPodTouchSeventhGen-iPodTouchSeventhGen",
+        "iPhone11-iPhone11",
+        "iPhone11Pro-iPhone11Pro",
+        "iPadSeventhGen-iPadSeventhGen",
+        "iPadSeventhGenCellular-iPadSeventhGenCellular",
+        "iPhone11ProMax-iPhone11ProMax",
+        "iPhoneSESecondGen-iPhoneSESecondGen",
+        "iPadProSecondGen-iPadProSecondGen",
+        "iPadProSecondGenCellular-iPadProSecondGenCellular",
+        "iPadProFourthGen-iPadProFourthGen",
+        "iPadProFourthGenCellular-iPadProFourthGenCellular",
+        "iPhone12Mini-iPhone12Mini",
+        "iPhone12-iPhone12",
+        "iPhone12Pro-iPhone12Pro",
+        "iPhone12ProMax-iPhone12ProMax",
+        "iPadAir4-iPadAir4",
+        "iPadAir4Cellular-iPadAir4Cellular",
+        "iPadEighthGen-iPadEighthGen",
+        "iPadEighthGenCellular-iPadEighthGenCellular",
+        "iPadProThirdGen-iPadProThirdGen",
+        "iPadProThirdGenCellular-iPadProThirdGenCellular",
+        "iPadProFifthGen-iPadProFifthGen",
+        "iPadProFifthGenCellular-iPadProFifthGenCellular",
+        "iPhone13Pro-iPhone13Pro",
+        "iPhone13ProMax-iPhone13ProMax",
+        "iPhone13Mini-iPhone13Mini",
+        "iPhone13-iPhone13",
+        "iPadMiniSixthGen-iPadMiniSixthGen",
+        "iPadMiniSixthGenCellular-iPadMiniSixthGenCellular",
+        "iPadNinthGen-iPadNinthGen",
+        "iPadNinthGenCellular-iPadNinthGenCellular",
+        "iPhoneSEThirdGen-iPhoneSEThirdGen",
+        "iPadAirFifthGen-iPadAirFifthGen",
+        "iPadAirFifthGenCellular-iPadAirFifthGenCellular",
+        "iPhone14-iPhone14",
+        "iPhone14Plus-iPhone14Plus",
+        "iPhone14Pro-iPhone14Pro",
+        "iPhone14ProMax-iPhone14ProMax",
+        "iPadTenthGen-iPadTenthGen",
+        "iPadTenthGenCellular-iPadTenthGenCellular",
+        "iPadPro11FourthGen-iPadPro11FourthGen",
+        "iPadPro11FourthGenCellular-iPadPro11FourthGenCellular",
+        "iPadProSixthGen-iPadProSixthGen",
+        "iPadProSixthGenCellular-iPadProSixthGenCellular",
+        "iPhone15-iPhone15",
+        "iPhone15Plus-iPhone15Plus",
+        "iPhone15Pro-iPhone15Pro",
+        "iPhone15ProMax-iPhone15ProMax",
+        "iPadAir11M2-iPadAir11M2",
+        "iPadAir11M2Cellular-iPadAir11M2Cellular",
+        "iPadAir13M2-iPadAir13M2",
+        "iPadAir13M2Cellular-iPadAir13M2Cellular",
+        "iPadPro11M4-iPadPro11M4",
+        "iPadPro11M4Cellular-iPadPro11M4Cellular",
+        "iPadPro13M4-iPadPro13M4",
+        "iPadPro13M4Cellular-iPadPro13M4Cellular",
+        "iPhone16-iPhone16",
+        "iPhone16Plus-iPhone16Plus",
+        "iPhone16Pro-iPhone16Pro",
+        "iPhone16ProMax-iPhone16ProMax",
+        "iPadMiniA17Pro-iPadMiniA17Pro",
+        "iPadMiniA17ProCellular-iPadMiniA17ProCellular",
+        "iPhone16e-iPhone16e",
+        "iPadA16-iPadA16",
+        "iPadA16Cellular-iPadA16Cellular",
+        "iPadAir11M3-iPadAir11M3",
+        "iPadAir11M3Cellular-iPadAir11M3Cellular",
+        "iPadAir13M3-iPadAir13M3",
+        "iPadAir13M3Cellular-iPadAir13M3Cellular",
+        "iPhone17Pro-iPhone17Pro",
+        "iPhone17ProMax-iPhone17ProMax",
+        "iPhone17-iPhone17",
+        "iPhoneAir-iPhoneAir",
+        "iPadPro11M5-iPadPro11M5",
+        "iPadPro11M5Cellular-iPadPro11M5Cellular",
+        "iPadPro13M5-iPadPro13M5",
+        "iPadPro13M5Cellular-iPadPro13M5Cellular",
+        "iPhone17e-iPhone17e",
+        "iPadAir11M4-iPadAir11M4",
+        "iPadAir11M4Cellular-iPadAir11M4Cellular",
+        "iPadAir13M4-iPadAir13M4",
+        "iPadAir13M4Cellular-iPadAir13M4Cellular",
+        "iPhone18Pro-iPhone18Pro",
+        "iPhone18ProMax-iPhone18ProMax",
+        "iPhoneDuo-iPhoneDuo"
+      ],
+      "advisories": [],
+      "kind": "software",
+      "artistViewUrl": "https://apps.apple.com/us/developer/lovecast-llc/id1498017204?uo=4",
+      "artworkUrl60": "https://is1-ssl.mzstatic.com/image/thumb/Purple221/v4/89/b3/29/89b32922-c086-9d30-fd7c-ac48e1392aa6/AppIcon-0-0-1x_U007epad-0-1-85-220.png/60x60bb.jpg",
+      "artworkUrl100": "https://is1-ssl.mzstatic.com/image/thumb/Purple221/v4/89/b3/29/89b32922-c086-9d30-fd7c-ac48e1392aa6/AppIcon-0-0-1x_U007epad-0-1-85-220.png/100x100bb.jpg",
+      "appletvScreenshotUrls": [],
+      "artworkUrl512": "https://is1-ssl.mzstatic.com/image/thumb/Purple221/v4/89/b3/29/89b32922-c086-9d30-fd7c-ac48e1392aa6/AppIcon-0-0-1x_U007epad-0-1-85-220.png/512x512bb.jpg",
+      "screenshotUrls": [
+        "https://is1-ssl.mzstatic.com/image/thumb/PurpleSource211/v4/7d/c0/9e/7dc09e7d-e1df-c528-41c6-2eff0bac4b9b/01-terminal.png/320x480bb.jpg",
+        "https://is1-ssl.mzstatic.com/image/thumb/PurpleSource221/v4/93/6f/1f/936f1fe8-a0fc-cfaa-2ecb-89d7c71f02f3/03-homepage.png/320x480bb.jpg",
+        "https://is1-ssl.mzstatic.com/image/thumb/PurpleSource221/v4/d6/e2/9f/d6e29f00-bdd8-c29c-f533-97a4a217be03/02-workspace.png/320x480bb.jpg",
+        "https://is1-ssl.mzstatic.com/image/thumb/PurpleSource211/v4/3e/82/15/3e8215b7-80db-f4b3-3942-bc634899c394/04-create-wt.png/320x480bb.jpg"
+      ],
+      "ipadScreenshotUrls": [
+        "https://is1-ssl.mzstatic.com/image/thumb/PurpleSource221/v4/e5/01/a2/e501a2f6-8e2c-11a2-ad6a-c9b42f49e905/apple-ipadpro13-spacegrey-portrait-promo-opaque.png/360x480bb.jpg"
+      ],
+      "releaseNotes": "Clearer chat while agents work\n• A proposed plan now appears as a plan you can read, not a generic approval prompt.\n• Approval requests show what the agent actually asked for instead of raw tool data.\n• The working timer counts from the message that started the turn.\n\nSteadier workspace setup\n• Creating a workspace no longer risks starting two if the reply is lost on the way back.\n• A worktree that launches an agent on creation opens straight into its chat.\n• A newly created tab stays put when the host list refreshes.\n\nFixes\n• Pairing no longer reports a declined permission as a missing feature.\n• The notification opt-in screen is clearer about what you are turning on.\n• Sign-in now accepts enterprise-managed GitHub accounts.",
+      "bundleId": "com.stably.orca.mobile",
+      "genres": ["Developer Tools"],
+      "price": 0.0,
+      "artistId": 1498017204,
+      "artistName": "Lovecast LLC",
+      "primaryGenreName": "Developer Tools",
+      "primaryGenreId": 6026,
+      "releaseDate": "2026-05-07T07:00:00Z",
+      "isVppDeviceBasedLicensingEnabled": true,
+      "trackName": "Orca IDE",
+      "trackId": 6766130217,
+      "sellerName": "Lovecast LLC",
+      "genreIds": ["6026"],
+      "currentVersionReleaseDate": "2026-09-19T07:09:57Z",
+      "version": "0.0.51",
+      "wrapperType": "software",
+      "currency": "USD",
+      "description": "Orca Mobile is the companion app for Orca, the open-source agentic coding workspace for macOS, Linux, and Windows. Pair your iPhone to your desktop in seconds and pick up a terminal session from the couch, the kitchen, or across the office.\n\nWHAT IT DOES\n\n• Live mirror of your desktop terminal, including running AI agent sessions (Claude Code, Codex, custom CLIs).\n• Full keyboard input — type, tab-complete, Ctrl-C, scroll back, all from the phone.\n• Multi-worktree, multi-terminal: jump between projects with a tap.\n• Phone-fit zoom and a smart on-screen keyboard with quick Ctrl/Alt accessory keys and shortcuts.\n• Background long-running commands and get a notification when a TUI goes idle (e.g. when Claude finishes thinking).\n\nHOW IT WORKS\n\nOrca Mobile is a thin client. Nothing runs on your phone except the viewer. Your code, your shells, your AI agents — all of that stays on your desktop. The phone shows you what's happening and forwards your keystrokes back over an encrypted local-network connection.\n\nPairing is end-to-end encrypted. Your desktop generates a one-time keypair and shows a QR code; you scan it from the app. After that, all traffic between phone and desktop is sealed with that pair's keys.\n\nPRIVACY\n\n• No analytics SDK, no crash reporter, no third-party SDKs of any kind in the iOS app.\n• Pairing tokens and your preference list live in the app's own sandbox. The app's traffic to your desktop is end-to-end encrypted on your local network only.\n• The Orca desktop app collects anonymized usage metrics per the policy at https://www.onorca.dev/privacy. The mobile app itself does not.\n• Open source: every line is auditable at https://github.com/stablyai/orca.\n\nREQUIREMENTS\n\n• An iPhone (iOS 16+) on the same Wi-Fi as your desktop.\n• The Orca desktop app, free, from https://www.onorca.dev/ or https://github.com/stablyai/orca/releases.",
+      "trackCensoredName": "Orca IDE",
+      "trackViewUrl": "https://apps.apple.com/us/app/orca-ide/id6766130217?uo=4",
+      "contentAdvisoryRating": "4+",
+      "averageUserRating": 4.58621000000000034191316444776020944118499755859375,
+      "averageUserRatingForCurrentVersion": 4.58621000000000034191316444776020944118499755859375,
+      "languageCodesISO2A": ["EN"],
+      "fileSizeBytes": "41495552",
+      "formattedPrice": "Free",
+      "userRatingCountForCurrentVersion": 29,
+      "trackContentRating": "4+",
+      "sellerUrl": "https://www.onorca.dev/",
+      "minimumOsVersion": "15.1",
+      "userRatingCount": 29
+    }
+  ]
+}
diff --git a/mobile/src/app-update/github-release-update-source.ts b/mobile/src/app-update/github-release-update-source.ts
new file mode 100644
index 00000000000..c32c3475121
--- /dev/null
+++ b/mobile/src/app-update/github-release-update-source.ts
@@ -0,0 +1,77 @@
+import { z } from 'zod'
+import { compareAppVersions } from '../../../src/shared/app-version'
+import type { AppUpdateCheckResult, AppUpdateSource } from './app-update-source'
+import { isNewerReleaseVersion } from './app-update-source'
+
+const REPO_API = 'https://api.github.com/repos/stablyai/orca'
+// Why tag refs, not releases.atom or /releases?per_page=100: both are newest-first windows that a
+// run of desktop releases fills, pushing the newest mobile release out and reading as "current".
+// The release `prerelease` flag is not a filter: every mobile-android-v* release is published as one.
+const TAG_PREFIX = 'mobile-android-v'
+// Why: the release workflow pushes the tag before the APK build, so a failed build leaves a
+// tag with no release; probe a few older candidates, bounded like the desktop's manifest probe.
+const MAX_RELEASE_PROBES = 3
+
+type Fetch = typeof fetch
+
+const tagRefsSchema = z.array(z.looseObject({ ref: z.string() }))
+const installableReleaseSchema = z.looseObject({
+  draft: z.literal(false),
+  html_url: z.string(),
+  assets: z.array(z.looseObject({ name: z.string() }))
+})
+
+/** Versions named by the tag refs GitHub returns for the mobile-android prefix. */
+export function parseMobileAndroidTagVersions(refs: unknown): string[] {
+  const prefix = `refs/tags/${TAG_PREFIX}`
+  return tagRefsSchema
+    .parse(refs)
+    .filter(({ ref }) => ref.startsWith(prefix))
+    .map(({ ref }) => ref.slice(prefix.length))
+}
+
+/** The release page when the tag has a published release carrying an APK, else null. */
+export function installableReleaseUrl(release: unknown): string | null {
+  const parsed = installableReleaseSchema.safeParse(release)
+  return parsed.success && parsed.data.assets.some((asset) => asset.name.endsWith('.apk'))
+    ? parsed.data.html_url
+    : null
+}
+
+export function createGithubReleaseUpdateSource(fetchImpl: Fetch): AppUpdateSource {
+  return {
+    async check(installedVersion, signal): Promise<AppUpdateCheckResult> {
+      const refsReply = await fetchImpl(`${REPO_API}/git/matching-refs/tags/${TAG_PREFIX}`, {
+        signal
+      })
+      if (!refsReply.ok) {
+        throw new Error(`tag refs HTTP ${refsReply.status}`)
+      }
+      const candidates = parseMobileAndroidTagVersions(await refsReply.json())
+        .filter((version) => isNewerReleaseVersion(version, installedVersion))
+        .sort((left, right) => compareAppVersions(right, left))
+        .slice(0, MAX_RELEASE_PROBES)
+      for (const version of candidates) {
+        const releaseReply = await fetchImpl(
+          `${REPO_API}/releases/tags/${encodeURIComponent(`${TAG_PREFIX}${version}`)}`,
+          { signal }
+        )
+        if (releaseReply.status === 404) {
+          continue
+        }
+        if (!releaseReply.ok) {
+          throw new Error(`release HTTP ${releaseReply.status}`)
+        }
+        const url = installableReleaseUrl(await releaseReply.json())
+        if (url) {
+          return { kind: 'available', version, url }
+        }
+      }
+      return { kind: 'current' }
+    }
+  }
+}
+
+export const githubReleaseUpdateSource = createGithubReleaseUpdateSource((input, init) =>
+  fetch(input, init)
+)
diff --git a/mobile/src/app-update/use-wall-app-update.test.ts b/mobile/src/app-update/use-wall-app-update.test.ts
new file mode 100644
index 00000000000..96dcde4fe5d
--- /dev/null
+++ b/mobile/src/app-update/use-wall-app-update.test.ts
@@ -0,0 +1,53 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import type { AppUpdateState } from './app-update-checker'
+import { useWallAppUpdate } from './use-wall-app-update'
+import { useWallAppUpdate as usePageWallAppUpdate } from './use-wall-app-update.web'
+
+const runtime = vi.hoisted(() => {
+  const state: { snapshot: AppUpdateState } = {
+    snapshot: { lastCheckedAt: null, available: null, dismissedVersion: null, checking: false }
+  }
+  return state
+})
+
+vi.mock('./app-update-runtime', () => ({ useAppUpdateState: () => runtime.snapshot }))
+
+const RELEASE = { version: '0.0.52', url: 'https://example.test/0.0.52' }
+
+describe('useWallAppUpdate', () => {
+  it('offers a release dismissed on home, because it is the way past the wall', () => {
+    runtime.snapshot = {
+      lastCheckedAt: 1,
+      available: RELEASE,
+      dismissedVersion: RELEASE.version,
+      checking: false
+    }
+    expect(useWallAppUpdate()).toEqual(RELEASE)
+  })
+
+  it('offers nothing when no release is known', () => {
+    runtime.snapshot = {
+      lastCheckedAt: 1,
+      available: null,
+      dismissedVersion: null,
+      checking: false
+    }
+    expect(useWallAppUpdate()).toBeNull()
+  })
+})
+
+describe('the page form of useWallAppUpdate', () => {
+  it('offers nothing', () => {
+    expect(usePageWallAppUpdate()).toBeNull()
+  })
+
+  // CI's page-closure pin does not count modules, so this is the only guard on this page path.
+  it('imports only types, so the page bundle never carries the checker', () => {
+    const source = readFileSync(join(import.meta.dirname, 'use-wall-app-update.web.ts'), 'utf8')
+    const imports = source.split('\n').filter((line) => line.startsWith('import'))
+    expect(imports.length).toBeGreaterThan(0)
+    expect(imports.every((line) => line.startsWith('import type '))).toBe(true)
+  })
+})
diff --git a/mobile/src/app-update/use-wall-app-update.ts b/mobile/src/app-update/use-wall-app-update.ts
new file mode 100644
index 00000000000..06b2683a5ce
--- /dev/null
+++ b/mobile/src/app-update/use-wall-app-update.ts
@@ -0,0 +1,8 @@
+import type { KnownAppUpdate } from '../storage/app-update-preferences'
+import { useAppUpdateState } from './app-update-runtime'
+
+// Dismissal is ignored: this release is the way past the wall. The checker's own cadence
+// already covers the wall, so nothing is triggered here.
+export function useWallAppUpdate(): KnownAppUpdate | null {
+  return useAppUpdateState().available
+}
diff --git a/mobile/src/app-update/use-wall-app-update.web.ts b/mobile/src/app-update/use-wall-app-update.web.ts
new file mode 100644
index 00000000000..936103c5a9b
--- /dev/null
+++ b/mobile/src/app-update/use-wall-app-update.web.ts
@@ -0,0 +1,6 @@
+import type { KnownAppUpdate } from '../storage/app-update-preferences'
+
+// The page bundle must not carry the checker; the wall inside the page keeps the fallback link.
+export function useWallAppUpdate(): KnownAppUpdate | null {
+  return null
+}
diff --git a/mobile/src/browser/mobile-browser-pane-source.test.ts b/mobile/src/browser/mobile-browser-pane-source.test.ts
deleted file mode 100644
index 69cd5af5391..00000000000
--- a/mobile/src/browser/mobile-browser-pane-source.test.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { describe, expect, it } from 'vitest'
-
-const source = readFileSync(new URL('./MobileBrowserPane.tsx', import.meta.url), 'utf8')
-
-function sliceBetween(startPattern: string, endPattern: string): string {
-  const start = source.indexOf(startPattern)
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = source.indexOf(endPattern, start)
-  expect(end).toBeGreaterThan(start)
-  return source.slice(start, end)
-}
-
-describe('MobileBrowserPane source invariants', () => {
-  it('mirrors handler refs in a layout effect instead of during render', () => {
-    const mirrorBlock = sliceBetween(
-      'useLayoutEffect(() => {',
-      '  useEffect(() => {\n    lastZoomResetUrlRef.current'
-    )
-
-    expect(mirrorBlock).toContain('frameMetadataRef.current = frameMetadata')
-    expect(mirrorBlock).toContain('layoutRef.current = layout')
-    expect(mirrorBlock).toContain('dialogRef.current = dialog')
-    expect(mirrorBlock).toContain('zoomRef.current = zoom')
-    expect(mirrorBlock).toContain('}, [dialog, frameMetadata, layout, zoom])')
-  })
-})
diff --git a/mobile/src/components/AgentLaunchNotice.test.tsx b/mobile/src/components/AgentLaunchNotice.test.tsx
new file mode 100644
index 00000000000..e1b7b07efce
--- /dev/null
+++ b/mobile/src/components/AgentLaunchNotice.test.tsx
@@ -0,0 +1,94 @@
+import { createElement, type ReactNode } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('react-native', async () => {
+  const React = await import('react')
+  return {
+    Pressable: ({ children, ...props }: { children?: ReactNode }) =>
+      React.createElement('Pressable', props, children),
+    Text: ({ children, ...props }: { children?: ReactNode }) =>
+      React.createElement('Text', props, children),
+    View: ({ children, ...props }: { children?: ReactNode }) =>
+      React.createElement('View', props, children),
+    StyleSheet: { create: (styles: unknown) => styles }
+  }
+})
+vi.mock('../platform/clipboard', () => ({
+  useClipboardWriter: () => ({ writeText: async () => {} })
+}))
+
+import { AgentLaunchNotice } from './AgentLaunchNotice'
+import { AGENT_LAUNCH_UPDATE_REQUIRED_MESSAGE } from '../session/mobile-existing-agent-launch'
+import type { MobileAgentLaunchAvailability } from '../session/mobile-agent-launch-availability'
+
+const ERROR_STYLE = { color: 'red' }
+
+describe('AgentLaunchNotice', () => {
+  let renderer: ReactTestRenderer | null = null
+
+  afterEach(() => {
+    act(() => renderer?.unmount())
+    renderer = null
+  })
+
+  function lines(props: {
+    availability?: MobileAgentLaunchAvailability
+    success?: string | null
+    error?: string | null
+    warning?: string | null
+  }): { text: string; isError: boolean }[] {
+    act(() => {
+      renderer = create(
+        createElement(AgentLaunchNotice, {
+          availability: props.availability ?? 'available',
+          success: props.success ?? null,
+          error: props.error ?? null,
+          warning: props.warning ?? null,
+          undeliveredPrompt: null,
+          errorStyle: ERROR_STYLE
+        })
+      )
+    })
+    return (renderer?.root.findAll((node) => String(node.type) === 'Text') ?? []).map((node) => ({
+      text: String(node.props.children),
+      isError: node.props.style === ERROR_STYLE
+    }))
+  }
+
+  it('shows the host warning on a launch that went ahead as secondary text, not an error', () => {
+    expect(lines({ warning: 'the requested arguments were ignored.' })).toEqual([
+      { text: 'the requested arguments were ignored.', isError: false }
+    ])
+  })
+
+  it('keeps a real failure in the error style beside a warning', () => {
+    expect(
+      lines({ error: "The agent started, but the prompt wasn't sent.", warning: 'w' })
+    ).toEqual([
+      { text: "The agent started, but the prompt wasn't sent.", isError: true },
+      { text: 'w', isError: false }
+    ])
+  })
+
+  it('drops a stale warning while the host cannot take a launch', () => {
+    expect(lines({ availability: 'update-required', warning: 'w' })).toEqual([
+      { text: AGENT_LAUNCH_UPDATE_REQUIRED_MESSAGE, isError: true }
+    ])
+  })
+
+  it('confirms a launch that went ahead, with any host note beneath it', () => {
+    expect(lines({ success: 'Agent started in feature-login', warning: 'w' })).toEqual([
+      { text: 'Agent started in feature-login', isError: false },
+      { text: 'w', isError: false }
+    ])
+  })
+
+  it('never confirms beside an error', () => {
+    expect(lines({ success: 'Agent started', error: 'e' })).toEqual([{ text: 'e', isError: true }])
+  })
+
+  it('renders nothing with nothing to say', () => {
+    expect(lines({})).toEqual([])
+  })
+})
diff --git a/mobile/src/components/AgentLaunchNotice.tsx b/mobile/src/components/AgentLaunchNotice.tsx
new file mode 100644
index 00000000000..00d309477ef
--- /dev/null
+++ b/mobile/src/components/AgentLaunchNotice.tsx
@@ -0,0 +1,89 @@
+import { useState } from 'react'
+import { Pressable, StyleSheet, Text, View, type StyleProp, type TextStyle } from 'react-native'
+import { useClipboardWriter } from '../platform/clipboard'
+import {
+  AGENT_LAUNCH_STATUS_UNREADABLE_MESSAGE,
+  AGENT_LAUNCH_UPDATE_REQUIRED_MESSAGE
+} from '../session/mobile-existing-agent-launch'
+import type { MobileAgentLaunchAvailability } from '../session/mobile-agent-launch-availability'
+import { colors, spacing, typography } from '../theme/mobile-theme'
+
+type Props = {
+  availability: MobileAgentLaunchAvailability
+  /** The confirmation that the agent started with its prompt. */
+  success: string | null
+  error: string | null
+  /** The host's note on a launch that went ahead; secondary text, not an error. */
+  warning: string | null
+  /** The prompt of an agent that started without it, offered for the user to paste in. */
+  undeliveredPrompt: string | null
+  errorStyle: StyleProp<TextStyle>
+}
+
+/** The status line under an AI button that starts an agent with a prompt. */
+export function AgentLaunchNotice({
+  availability,
+  success,
+  error,
+  warning,
+  undeliveredPrompt,
+  errorStyle
+}: Props) {
+  const clipboard = useClipboardWriter()
+  const [copyState, setCopyState] = useState<{ prompt: string; label: string } | null>(null)
+  const availabilityMessage =
+    availability === 'update-required'
+      ? AGENT_LAUNCH_UPDATE_REQUIRED_MESSAGE
+      : availability === 'unverified'
+        ? AGENT_LAUNCH_STATUS_UNREADABLE_MESSAGE
+        : null
+  const message = availabilityMessage ?? error
+  const note = availabilityMessage ? null : warning
+  const confirmation = message ? null : success
+  if (!message && !note && !confirmation) {
+    return null
+  }
+  const copyLabel =
+    copyState && copyState.prompt === undeliveredPrompt ? copyState.label : 'Copy prompt'
+  return (
+    <View style={styles.notice}>
+      {confirmation ? <Text style={styles.successText}>{confirmation}</Text> : null}
+      {message ? <Text style={errorStyle}>{message}</Text> : null}
+      {note ? <Text style={styles.warningText}>{note}</Text> : null}
+      {undeliveredPrompt ? (
+        <Pressable
+          onPress={() => {
+            clipboard.writeText(undeliveredPrompt).then(
+              () => setCopyState({ prompt: undeliveredPrompt, label: 'Copied' }),
+              () => setCopyState({ prompt: undeliveredPrompt, label: "Couldn't copy" })
+            )
+          }}
+          accessibilityRole="button"
+          accessibilityLabel="Copy prompt"
+          hitSlop={spacing.sm}
+        >
+          <Text style={styles.copyText}>{copyLabel}</Text>
+        </Pressable>
+      ) : null}
+    </View>
+  )
+}
+
+const styles = StyleSheet.create({
+  notice: {
+    gap: spacing.xs
+  },
+  successText: {
+    color: colors.statusGreen,
+    fontSize: typography.metaSize
+  },
+  warningText: {
+    color: colors.textSecondary,
+    fontSize: typography.metaSize
+  },
+  copyText: {
+    color: colors.accentBlue,
+    fontSize: typography.metaSize,
+    fontWeight: '600'
+  }
+})
diff --git a/mobile/src/components/AgentStateDot.tsx b/mobile/src/components/AgentStateDot.tsx
index 1637296d900..80ef9d9d239 100644
--- a/mobile/src/components/AgentStateDot.tsx
+++ b/mobile/src/components/AgentStateDot.tsx
@@ -5,7 +5,7 @@ import type { AgentDotState } from '../worktree/agent-row-display'
 
 // Per-agent state indicator, 1:1 with desktop AgentStateDot
 // (src/renderer/src/components/AgentStateDot.tsx): yellow spinner for 'working',
-// emerald for 'done', red for blocked/waiting/interrupted (attention), neutral
+// emerald for 'done', red for blocked/waiting/interrupted/failed (attention), neutral
 // for idle. Distinct from the worktree-level AgentSpinner, which collapses the
 // agent vocabulary into the 5-state rollup the sidebar dot uses.
 const DOT_COLORS: Record<Exclude<AgentDotState, 'working' | 'monitoring'>, string> = {
@@ -13,6 +13,7 @@ const DOT_COLORS: Record<Exclude<AgentDotState, 'working' | 'monitoring'>, strin
   blocked: '#ef4444',
   waiting: '#ef4444',
   interrupted: '#ef4444',
+  failed: '#ef4444',
   idle: 'rgba(115,115,115,0.4)'
 }
 const WORKING_COLOR = '#eab308'
diff --git a/mobile/src/components/BottomDrawer.tsx b/mobile/src/components/BottomDrawer.tsx
index 9d27c2c0c4e..4b381511d76 100644
--- a/mobile/src/components/BottomDrawer.tsx
+++ b/mobile/src/components/BottomDrawer.tsx
@@ -1,6 +1,5 @@
-import { type ReactNode, useCallback, useEffect, useRef, useState } from 'react'
-import { resolveBottomDrawerMounted } from './bottom-drawer-mount-state'
-import { MountedBottomDrawer } from './mounted-bottom-drawer'
+import type { ReactNode } from 'react'
+import { KeyedBottomDrawer } from './keyed-bottom-drawer'
 
 type Props = {
   visible: boolean
@@ -19,75 +18,21 @@ type Props = {
   zIndex?: number
 }
 
-export function BottomDrawer({
-  visible,
-  onClose,
-  onAfterClose,
-  children,
-  dragContentToDismiss = true,
-  contentScrollable = true,
-  fillAvailable = false,
-  interactive = true,
-  zIndex
-}: Props) {
-  const [mounted, setMounted] = useState(visible)
-  const onAfterCloseRef = useRef(onAfterClose)
-  const hiddenHandledRef = useRef(false)
-  const afterClosePendingRef = useRef(false)
-
-  useEffect(() => {
-    onAfterCloseRef.current = onAfterClose
-  }, [onAfterClose])
-
-  useEffect(() => {
-    if (visible) {
-      hiddenHandledRef.current = false
-      afterClosePendingRef.current = false
-    }
-  }, [visible])
-
-  useEffect(() => {
-    if (mounted || !afterClosePendingRef.current) {
-      return
-    }
-    afterClosePendingRef.current = false
-    onAfterCloseRef.current?.()
-  }, [mounted])
-
-  const handleHidden = useCallback(() => {
-    if (hiddenHandledRef.current) {
-      return
-    }
-    hiddenHandledRef.current = true
-    afterClosePendingRef.current = true
-    setMounted(false)
-  }, [])
-  const resolvedMounted = resolveBottomDrawerMounted(visible, mounted)
-
-  // Why: opening drawers should mount before commit; waiting for a passive
-  // Effect adds a null render before every drawer can animate in.
-  if (resolvedMounted !== mounted) {
-    setMounted(resolvedMounted)
-  }
-
-  // Why: hidden drawers are rendered by parent screens even while closed; keep
-  // their Reanimated/Gesture setup out of hot paths like commit-message typing.
-  if (!resolvedMounted) {
-    return null
-  }
+const SHOWN = 'shown'
+const sheetKey = () => SHOWN
 
+export function BottomDrawer({ visible, onClose, onAfterClose, children, ...drawerProps }: Props) {
+  // Why: hidden drawers are rendered by parent screens even while closed; the keyed drawer
+  // renders nothing until shown, which keeps Reanimated/Gesture setup out of hot paths.
   return (
-    <MountedBottomDrawer
-      visible={visible}
+    <KeyedBottomDrawer
+      {...drawerProps}
+      sheet={visible ? SHOWN : null}
+      sheetKey={sheetKey}
       onClose={onClose}
-      onHidden={handleHidden}
-      dragContentToDismiss={dragContentToDismiss}
-      contentScrollable={contentScrollable}
-      fillAvailable={fillAvailable}
-      interactive={interactive}
-      zIndex={zIndex}
+      onAfterClose={onAfterClose}
     >
-      {children}
-    </MountedBottomDrawer>
+      {() => children}
+    </KeyedBottomDrawer>
   )
 }
diff --git a/mobile/src/components/ConfirmModal.tsx b/mobile/src/components/ConfirmModal.tsx
index a393593b5cf..5d0f70e6081 100644
--- a/mobile/src/components/ConfirmModal.tsx
+++ b/mobile/src/components/ConfirmModal.tsx
@@ -2,8 +2,7 @@ import { View, Text, Pressable, StyleSheet } from 'react-native'
 import { colors, spacing, radii, typography } from '../theme/mobile-theme'
 import { BottomDrawer } from './BottomDrawer'
 
-type Props = {
-  visible: boolean
+type ContentProps = {
   title: string
   message?: string
   confirmLabel?: string
@@ -13,8 +12,17 @@ type Props = {
   onCancel: () => void
 }
 
-export function ConfirmModal({
-  visible,
+type Props = ContentProps & { visible: boolean }
+
+export function ConfirmModal({ visible, ...content }: Props) {
+  return (
+    <BottomDrawer visible={visible} onClose={content.onCancel}>
+      <ConfirmContent {...content} />
+    </BottomDrawer>
+  )
+}
+
+export function ConfirmContent({
   title,
   message,
   confirmLabel = 'Confirm',
@@ -22,9 +30,9 @@ export function ConfirmModal({
   destructive = false,
   onConfirm,
   onCancel
-}: Props) {
+}: ContentProps) {
   return (
-    <BottomDrawer visible={visible} onClose={onCancel}>
+    <>
       <View style={styles.content}>
         <Text style={styles.title}>{title}</Text>
         {message ? <Text style={styles.message}>{message}</Text> : null}
@@ -52,7 +60,7 @@ export function ConfirmModal({
           </Text>
         </Pressable>
       </View>
-    </BottomDrawer>
+    </>
   )
 }
 
diff --git a/mobile/src/components/HostProtocolGate.test.ts b/mobile/src/components/HostProtocolGate.test.ts
index d3a94f3a7df..575d23dbfbb 100644
--- a/mobile/src/components/HostProtocolGate.test.ts
+++ b/mobile/src/components/HostProtocolGate.test.ts
@@ -37,6 +37,8 @@ const hostClient = vi.hoisted(() => ({
 vi.mock('../transport/client-context', () => ({
   useHostClient: () => hostClient.current
 }))
+// The wall's release offer: the native hook imports the update checker module.
+vi.mock('../app-update/use-wall-app-update', () => ({ useWallAppUpdate: () => null }))
 // Descriptor bookkeeping only; the real recorder reaches the native keychain through host-store.
 vi.mock('../transport/host-descriptor-recorder', () => ({
   recordHostDescriptorFromStatus: vi.fn()
diff --git a/mobile/src/components/MobileDiffReviewDrawers.tsx b/mobile/src/components/MobileDiffReviewDrawers.tsx
index 9f979761fe8..828a09beaec 100644
--- a/mobile/src/components/MobileDiffReviewDrawers.tsx
+++ b/mobile/src/components/MobileDiffReviewDrawers.tsx
@@ -1,75 +1,104 @@
 import { useMemo } from 'react'
-import { KeyboardAvoidingView, Platform, Pressable, Text, TextInput, View } from 'react-native'
+import { KeyboardAvoidingView, Pressable, Text, TextInput, View } from 'react-native'
 import { Check, Copy, FileText, Plus, Send, Trash2, X } from 'lucide-react-native'
 import type { DiffComment } from '../../../src/shared/diff-comment-types'
-import { useKeyboardAvoidingPadding } from '../platform/keyboard-occlusion'
 import { colors } from '../theme/mobile-theme'
 import type { ActionSheetAction } from './ActionSheetModal'
-import { ActionSheetModal } from './ActionSheetModal'
-import { BottomDrawer } from './BottomDrawer'
-import { ConfirmModal } from './ConfirmModal'
-import { mobileReviewCountLabel } from '../session/mobile-diff-review-screen-model'
+import { ActionSheetContent } from './ActionSheetModal'
+import { ConfirmContent } from './ConfirmModal'
+import { KeyedBottomDrawer } from './keyed-bottom-drawer'
+import { AGENT_LAUNCH_STATUS_UNREADABLE_MESSAGE } from '../session/mobile-existing-agent-launch'
+import {
+  mobileReviewCountLabel,
+  type ComposerState,
+  type SendSheetState
+} from '../session/mobile-diff-review-screen-model'
+import { reviewSheetKey, type ReviewSheet } from '../session/mobile-diff-review-sheets'
 import type { useMobileDiffReviewController } from '../session/use-mobile-diff-review-controller'
 import { mobileDiffReviewStyles as styles } from './mobile-diff-review-screen-styles'
+import { hostOs } from '../platform/host-os'
 
 type Props = {
   controller: ReturnType<typeof useMobileDiffReviewController>
 }
 
 export function MobileDiffReviewDrawers({ controller }: Props) {
-  const sendActions = useSendActions(controller)
-  const overflowActions = useOverflowActions(controller)
+  // One drawer for every review sheet: iOS cannot present a sheet while another is still closing.
   return (
-    <>
-      <ActionSheetModal
-        visible={controller.showOverflow}
-        title="Review Actions"
-        message={
-          controller.reviewedUnstagedCount > 0
-            ? `${controller.reviewedUnstagedCount} reviewed unstaged files can be staged`
-            : undefined
-        }
-        actions={overflowActions}
-        onClose={() => controller.setShowOverflow(false)}
-      />
-      <ActionSheetModal
-        visible={controller.sendSheet !== null}
-        title="Send Notes"
-        message={sendSheetMessage(controller)}
-        actions={sendActions}
-        onClose={() => controller.setSendSheet(null)}
-      />
-      <ConfirmModal
-        visible={controller.discardTarget !== null}
-        title="Discard File"
-        message={
-          controller.discardTarget
-            ? `Discard changes to "${controller.discardTarget.filePath}"? This cannot be undone.`
-            : undefined
-        }
-        confirmLabel="Discard"
-        destructive
-        onConfirm={() => {
-          const target = controller.discardTarget
-          controller.setDiscardTarget(null)
-          if (target) {
-            void controller.runGitMutation('git.discard', target)
-          }
-        }}
-        onCancel={() => controller.setDiscardTarget(null)}
-      />
-      <NoteComposerDrawer controller={controller} />
-      <CompletionDrawer controller={controller} />
-    </>
+    <KeyedBottomDrawer
+      sheet={controller.sheet}
+      sheetKey={reviewSheetKey}
+      onClose={(presented) => controller.closeSheet(presented.kind)}
+    >
+      {(presented) => <ReviewSheetContent controller={controller} sheet={presented} />}
+    </KeyedBottomDrawer>
   )
 }
 
-function useSendActions(controller: ReturnType<typeof useMobileDiffReviewController>) {
+function ReviewSheetContent({ controller, sheet }: Props & { sheet: ReviewSheet }) {
+  switch (sheet.kind) {
+    case 'actions':
+      return <ReviewActionsContent controller={controller} />
+    case 'send':
+      return <SendNotesContent controller={controller} load={sheet.load} />
+    case 'discard':
+      return (
+        <ConfirmContent
+          title="Discard File"
+          message={`Discard changes to "${sheet.target.filePath}"? This cannot be undone.`}
+          confirmLabel="Discard"
+          destructive
+          onConfirm={() => {
+            controller.closeSheet('discard')
+            void controller.runGitMutation('git.discard', sheet.target)
+          }}
+          onCancel={() => controller.closeSheet('discard')}
+        />
+      )
+    case 'composer':
+      return <NoteComposerContent controller={controller} composer={sheet.composer} />
+    case 'completion':
+      return <CompletionContent controller={controller} />
+  }
+}
+
+function ReviewActionsContent({ controller }: Props) {
+  const overflowActions = useOverflowActions(controller)
+  return (
+    <ActionSheetContent
+      title="Review Actions"
+      message={
+        controller.reviewedUnstagedCount > 0
+          ? `${controller.reviewedUnstagedCount} reviewed unstaged files can be staged`
+          : undefined
+      }
+      actions={overflowActions}
+      onClose={() => controller.closeSheet('actions')}
+    />
+  )
+}
+
+function SendNotesContent({ controller, load }: Props & { load: SendSheetState }) {
+  const sendActions = useSendActions(controller, load)
+  return (
+    <ActionSheetContent
+      title="Send Notes"
+      message={sendSheetMessage(controller, load)}
+      actions={sendActions}
+      onClose={() => controller.closeSheet('send')}
+    />
+  )
+}
+
+function useSendActions(
+  controller: ReturnType<typeof useMobileDiffReviewController>,
+  load: SendSheetState
+) {
   return useMemo<ActionSheetAction[]>(() => {
     const comments = controller.unsentComments
     const terminalActions =
-      controller.sendSheet?.kind === 'ready' || controller.sendSheet?.kind === 'error'
-        ? controller.sendSheet.terminals.map((terminal) => ({
+      load.kind === 'ready' || load.kind === 'error'
+        ? load.terminals.map((terminal) => ({
             label: `${terminal.title || 'Terminal'} (${terminal.terminal.slice(0, 6)})`,
             icon: Send,
             disabled: comments.length === 0,
@@ -82,7 +111,12 @@ function useSendActions(controller: ReturnType<typeof useMobileDiffReviewControl
       {
         label: 'New Agent Session',
         icon: Plus,
-        disabled: comments.length === 0,
+        disabled: comments.length === 0 || controller.agentLaunchAvailability !== 'available',
+        ...(controller.agentLaunchAvailability === 'update-required'
+          ? { hint: 'Update Orca on your computer' }
+          : controller.agentLaunchAvailability === 'unverified'
+            ? { hint: AGENT_LAUNCH_STATUS_UNREADABLE_MESSAGE }
+            : {}),
         skipAutoClose: true,
         onPress: () => void controller.createTerminalAndSend(comments)
       },
@@ -94,7 +128,7 @@ function useSendActions(controller: ReturnType<typeof useMobileDiffReviewControl
         onPress: () => void controller.copyNotes()
       }
     ]
-  }, [controller])
+  }, [controller, load])
 }
 
 function useOverflowActions(controller: ReturnType<typeof useMobileDiffReviewController>) {
@@ -111,7 +145,6 @@ function useOverflowActions(controller: ReturnType<typeof useMobileDiffReviewCon
         label: 'Send Unsent Notes',
         icon: Send,
         disabled: controller.unsentComments.length === 0,
-        skipAutoClose: true,
         onPress: () => void controller.openSendSheet()
       },
       {
@@ -152,65 +185,54 @@ function useOverflowActions(controller: ReturnType<typeof useMobileDiffReviewCon
 }
 
 function sendSheetMessage(
-  controller: ReturnType<typeof useMobileDiffReviewController>
+  controller: ReturnType<typeof useMobileDiffReviewController>,
+  load: SendSheetState
 ): string | undefined {
-  return controller.sendSheet?.kind === 'loading'
+  return load.kind === 'loading'
     ? 'Loading agent sessions...'
-    : controller.sendSheet?.kind === 'error'
-      ? controller.sendSheet.message
+    : load.kind === 'error'
+      ? load.message
       : `${controller.unsentComments.length} unsent notes`
 }
 
-function NoteComposerDrawer({ controller }: Props) {
-  const composer = controller.composer
-  // Zero on a phone, where `KeyboardAvoidingView` above already moved this; the page's own
-  // keyboard measurement where it cannot, because that view is driven by events RN Web never
-  // sends. Padding rather than a second avoiding view: the drawer owns the position.
-  const keyboardPadding = useKeyboardAvoidingPadding()
+function NoteComposerContent({ controller, composer }: Props & { composer: ComposerState }) {
   return (
-    <BottomDrawer visible={composer !== null} onClose={controller.closeComposer}>
-      <KeyboardAvoidingView
-        behavior={Platform.OS === 'ios' ? 'padding' : undefined}
-        style={keyboardPadding > 0 ? { paddingBottom: keyboardPadding } : undefined}
-      >
-        <View style={styles.composerHeader}>
-          <View>
-            <Text style={styles.drawerTitle}>
-              {composer?.mode === 'edit' ? 'Edit Note' : 'Add Note'}
-            </Text>
-            <Text style={styles.drawerSubtitle}>
-              {composer?.mode === 'create' && composer.lineNumber > 0
-                ? `Line ${composer.lineNumber}`
-                : 'File note'}
-            </Text>
-          </View>
-          <Pressable
-            style={({ pressed }) => [styles.iconButton, pressed && styles.iconButtonPressed]}
-            onPress={controller.closeComposer}
-            accessibilityRole="button"
-            accessibilityLabel="Cancel note"
-          >
-            <X size={18} color={colors.textPrimary} strokeWidth={2.2} />
-          </Pressable>
+    <KeyboardAvoidingView behavior={hostOs() === 'ios' ? 'padding' : undefined}>
+      <View style={styles.composerHeader}>
+        <View>
+          <Text style={styles.drawerTitle}>
+            {composer.mode === 'edit' ? 'Edit Note' : 'Add Note'}
+          </Text>
+          <Text style={styles.drawerSubtitle}>
+            {composer.mode === 'create' && composer.lineNumber > 0
+              ? `Line ${composer.lineNumber}`
+              : 'File note'}
+          </Text>
         </View>
-        <TextInput
-          style={styles.composerInput}
-          value={controller.composerBody}
-          onChangeText={controller.setComposerBody}
-          multiline
-          autoFocus
-          placeholder="Review note"
-          placeholderTextColor={colors.textMuted}
-          accessibilityLabel={composerLabel(composer)}
-        />
-        <View style={styles.drawerButtonRow}>
-          {composer?.mode === 'edit' ? (
-            <DeleteNoteButton onPress={controller.deleteComment} />
-          ) : null}
-          <SaveNoteButton controller={controller} composer={composer} />
-        </View>
-      </KeyboardAvoidingView>
-    </BottomDrawer>
+        <Pressable
+          style={({ pressed }) => [styles.iconButton, pressed && styles.iconButtonPressed]}
+          onPress={controller.closeComposer}
+          accessibilityRole="button"
+          accessibilityLabel="Cancel note"
+        >
+          <X size={18} color={colors.textPrimary} strokeWidth={2.2} />
+        </Pressable>
+      </View>
+      <TextInput
+        style={styles.composerInput}
+        value={controller.composerBody}
+        onChangeText={controller.setComposerBody}
+        multiline
+        autoFocus
+        placeholder="Review note"
+        placeholderTextColor={colors.textMuted}
+        accessibilityLabel={composerLabel(composer)}
+      />
+      <View style={styles.drawerButtonRow}>
+        {composer.mode === 'edit' ? <DeleteNoteButton onPress={controller.deleteComment} /> : null}
+        <SaveNoteButton controller={controller} composer={composer} />
+      </View>
+    </KeyboardAvoidingView>
   )
 }
 
@@ -262,14 +284,11 @@ function SaveNoteButton({
   )
 }
 
-function CompletionDrawer({ controller }: Props) {
+function CompletionContent({ controller }: Props) {
   const noteCount =
     controller.screenState.kind === 'ready' ? controller.screenState.comments.length : 0
   return (
-    <BottomDrawer
-      visible={controller.showCompletion}
-      onClose={() => controller.setShowCompletion(false)}
-    >
+    <>
       <Text style={styles.drawerTitle}>Review Complete</Text>
       <Text style={styles.drawerSubtitle}>
         {mobileReviewCountLabel(controller.queue.length, 'file', 'files')} reviewed,{' '}
@@ -297,6 +316,6 @@ function CompletionDrawer({ controller }: Props) {
           <Text style={styles.primaryButtonText}>Send Notes</Text>
         </Pressable>
       </View>
-    </BottomDrawer>
+    </>
   )
 }
diff --git a/mobile/src/components/MobileDiffReviewScreenView.tsx b/mobile/src/components/MobileDiffReviewScreenView.tsx
index 3e68dd7c8f7..06b24f3f5e7 100644
--- a/mobile/src/components/MobileDiffReviewScreenView.tsx
+++ b/mobile/src/components/MobileDiffReviewScreenView.tsx
@@ -61,7 +61,7 @@ export function MobileDiffReviewScreenView({ controller, onBack }: Props) {
         unsentCount={controller.unsentComments.length}
         worktreeLabel={controller.worktreeLabel}
         onBack={onBack}
-        onOpenActions={() => controller.setShowOverflow(true)}
+        onOpenActions={() => controller.openSheet({ kind: 'actions' })}
         onOpenPRSidebar={controller.openPRSidebar}
         onSelectFilter={controller.selectFilter}
       />
@@ -104,7 +104,7 @@ export function MobileDiffReviewScreenView({ controller, onBack }: Props) {
               busyAction={controller.busyAction}
               item={controller.currentItem}
               onAddFileNote={() => controller.openComposer(0)}
-              onDiscard={controller.setDiscardTarget}
+              onDiscard={(target) => controller.openSheet({ kind: 'discard', target })}
               onGitMutation={(method, item) => void controller.runGitMutation(method, item)}
               onMarkReviewed={() => void controller.markReviewed()}
               onMoveFile={controller.moveFile}
@@ -124,6 +124,7 @@ export function MobileDiffReviewScreenView({ controller, onBack }: Props) {
               gitStatus={gitStatus}
               headSha={controller.prSidebarHeadSha}
               bottomInset={insets.bottom}
+              workspaceLabel={controller.worktreeLabel}
             />
           </View>
         ) : null}
@@ -144,6 +145,7 @@ export function MobileDiffReviewScreenView({ controller, onBack }: Props) {
             gitBranch={controller.prSidebarBranch}
             gitStatus={gitStatus}
             headSha={controller.prSidebarHeadSha}
+            workspaceLabel={controller.worktreeLabel}
           />
         </RightDrawer>
       ) : null}
diff --git a/mobile/src/components/MobileHostCard.test.ts b/mobile/src/components/MobileHostCard.test.ts
index e29ab50bfab..9a5354e8bf7 100644
--- a/mobile/src/components/MobileHostCard.test.ts
+++ b/mobile/src/components/MobileHostCard.test.ts
@@ -342,7 +342,6 @@ describe('MobileHostCard', () => {
             deviceToken: 'token',
             publicKeyB64: 'key',
             lastConnected: 1,
-            relayHostId: 'AbCdEf0123_-xyZ9',
             relay: {
               v: 1 as const,
               directorUrl: 'https://relay-staging.onorca.dev',
diff --git a/mobile/src/components/MobileHostCard.tsx b/mobile/src/components/MobileHostCard.tsx
index cadaf186fb2..19cf9d93993 100644
--- a/mobile/src/components/MobileHostCard.tsx
+++ b/mobile/src/components/MobileHostCard.tsx
@@ -178,7 +178,6 @@ const styles = StyleSheet.create({
   metaText: { flex: 1, fontSize: 12, color: colors.textSecondary },
   worktreeMetaText: {
     marginTop: 2,
-    marginLeft: spacing.xl,
     fontSize: 12,
     color: colors.textMuted
   },
diff --git a/mobile/src/components/MobilePRSidebar.tsx b/mobile/src/components/MobilePRSidebar.tsx
index 710adb68594..4f0aed5b28d 100644
--- a/mobile/src/components/MobilePRSidebar.tsx
+++ b/mobile/src/components/MobilePRSidebar.tsx
@@ -14,6 +14,7 @@ import {
   type MobilePrTitleAction
 } from '../session/use-mobile-pr-title-action'
 import { useMobilePrAiTriage, type MobilePrAiTriage } from '../session/use-mobile-pr-ai-triage'
+import { useHostProtocolGates } from './HostProtocolGate'
 import { usePRBotAuthorOverrides } from '../session/use-pr-bot-author-overrides'
 import { buildFixChecksPrompt, buildResolveConflictsPrompt } from '../session/pr-ai-triage-prompt'
 import { prSidebarRenderBranch } from './mobile-pr-sidebar-presentation'
@@ -42,6 +43,8 @@ type Props = {
   bottomInset?: number
   // Hub chrome already shows open-on-web; hide the in-body icon there.
   showOpenOnWeb?: boolean
+  /** Named when an AI button's agent starts; the branch stands in when absent. */
+  workspaceLabel: string | null
 }
 
 // Mutation hooks run unconditionally here and gate internally until a PR is ready.
@@ -56,8 +59,10 @@ export function MobilePRSidebar({
   gitStatus,
   headSha,
   bottomInset = 0,
-  showOpenOnWeb = true
+  showOpenOnWeb = true,
+  workspaceLabel
 }: Props) {
+  const launchWorkspaceLabel = workspaceLabel || gitBranch
   const branch = prSidebarRenderBranch(state)
   // prNumber is 0 until ready; the hook gates on `ready` so it never fires early.
   const prNumber = state.kind === 'ready' ? state.data.pr.number : 0
@@ -89,7 +94,16 @@ export function MobilePRSidebar({
     prRepo,
     refetch
   })
-  const triage = useMobilePrAiTriage({ client, connState, worktreeId })
+  const { hostCapabilities, statusPending, statusReadable } = useHostProtocolGates()
+  const triage = useMobilePrAiTriage({
+    client,
+    connState,
+    worktreeId,
+    workspaceLabel: launchWorkspaceLabel,
+    hostCapabilities,
+    hostStatusPending: statusPending,
+    hostStatusReadable: statusReadable
+  })
   // Keyed on the PR payload identity so overrides re-fetch with each PR refetch
   // instead of staying a stale one-shot snapshot for the whole session.
   const botAuthorOverrides = usePRBotAuthorOverrides(
@@ -122,6 +136,7 @@ export function MobilePRSidebar({
         commentActions={commentActions}
         titleAction={titleAction}
         triage={triage}
+        workspaceLabel={launchWorkspaceLabel}
         botAuthorOverrides={botAuthorOverrides}
         showOpenOnWeb={showOpenOnWeb}
       />
@@ -143,6 +158,7 @@ function PrSidebarContent({
   commentActions,
   titleAction,
   triage,
+  workspaceLabel,
   showOpenOnWeb,
   botAuthorOverrides
 }: {
@@ -159,6 +175,7 @@ function PrSidebarContent({
   commentActions: MobilePrCommentActions
   titleAction: MobilePrTitleAction
   triage: MobilePrAiTriage
+  workspaceLabel: string | null
   showOpenOnWeb: boolean
   botAuthorOverrides: ReadonlySet<string>
 }) {
@@ -211,6 +228,7 @@ function PrSidebarContent({
         gitBranch={gitBranch}
         gitStatus={gitStatus}
         connState={connState}
+        workspaceLabel={workspaceLabel}
         onCreated={refetch}
       />
     )
@@ -271,7 +289,8 @@ function PrSidebarSections({
         })
       ),
     isBusy: triage.isBusy('fix-checks'),
-    error: triage.error
+    availability: triage.availability,
+    ...triage.noticeFor('fix-checks')
   }
   const conflictsTriage = {
     resolveConflicts: () =>
@@ -283,7 +302,8 @@ function PrSidebarSections({
         })
       ),
     isBusy: triage.isBusy('resolve-conflicts'),
-    error: triage.error
+    availability: triage.availability,
+    ...triage.noticeFor('resolve-conflicts')
   }
   // One card for identity + actions so the ready PR isn't a stack of thin
   // duplicate blocks (badge row, title, branches, then another action band).
diff --git a/mobile/src/components/ProtocolBlockScreen.test.ts b/mobile/src/components/ProtocolBlockScreen.test.ts
index a69b52566e3..7a33bfa28c8 100644
--- a/mobile/src/components/ProtocolBlockScreen.test.ts
+++ b/mobile/src/components/ProtocolBlockScreen.test.ts
@@ -1,6 +1,7 @@
 import { createElement } from 'react'
 import { act, create, type ReactTestRenderer } from 'react-test-renderer'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { KnownAppUpdate } from '../storage/app-update-preferences'
 import type { BlockedVerdict } from './ProtocolBlockScreen'
 import { ProtocolBlockScreen } from './ProtocolBlockScreen'
 
@@ -10,6 +11,14 @@ const nativeTestState = vi.hoisted(() => {
   return { openUrl: vi.fn(), platform }
 })
 
+const wallUpdate = vi.hoisted(() => {
+  const state: { current: KnownAppUpdate | null } = { current: null }
+  return state
+})
+
+// The release the installed app's update check found; the real hook imports the checker module.
+vi.mock('../app-update/use-wall-app-update', () => ({ useWallAppUpdate: () => wallUpdate.current }))
+
 vi.mock('react-native', () => ({
   Linking: { openURL: nativeTestState.openUrl },
   Platform: nativeTestState.platform,
@@ -30,7 +39,8 @@ const RELEASES_URL = 'https://github.com/stablyai/orca/releases'
 
 let renderer: ReactTestRenderer | null = null
 
-function render(verdict: BlockedVerdict): string {
+function render(verdict: BlockedVerdict, mobileUpdate: KnownAppUpdate | null = null): string {
+  wallUpdate.current = mobileUpdate
   act(() => {
     renderer = create(createElement(ProtocolBlockScreen, { verdict }))
   })
@@ -151,6 +161,19 @@ describe('ProtocolBlockScreen', () => {
     expect(primaryActionUrl()).toBe(RELEASES_URL)
   })
 
+  it('sends a desktop whose page is older than this shell to the desktop update', () => {
+    const output = render({
+      kind: 'blocked',
+      reason: 'bundle-incompatible',
+      side: 'desktop',
+      pageVersion: 0,
+      requiredPageVersion: 1
+    })
+    expect(output).toContain('Update Orca on your computer')
+    expect(output).toContain('This paired desktop app is too old for your current Orca Mobile app')
+    expect(primaryActionUrl()).toBe(RELEASES_URL)
+  })
+
   it('routes an Android bundle wall to GitHub Releases, not a store that has no listing', () => {
     nativeTestState.platform.OS = 'android'
     const output = render({
@@ -168,4 +191,43 @@ describe('ProtocolBlockScreen', () => {
     // The presence precondition for the absence asserted on the refresh wall above.
     expect(pressableCount()).toBe(2)
   })
+
+  describe('with the newest release known', () => {
+    const release = {
+      version: '0.0.52',
+      url: 'https://github.com/stablyai/orca/releases/tag/mobile-v0.0.52'
+    }
+
+    it.each(['ios', 'android'] as const)('opens that exact release on %s', (os) => {
+      nativeTestState.platform.OS = os
+      const output = render(
+        { kind: 'blocked', reason: 'bundle-shell-too-old', schemaVersion: 2 },
+        release
+      )
+      expect(output).toContain('Get Orca 0.0.52')
+      expect(output).not.toContain('Open App Store')
+      expect(output).not.toContain('Open GitHub Releases')
+      expect(primaryActionUrl()).toBe(release.url)
+    })
+
+    it('leaves the desktop wall on the desktop releases', () => {
+      const output = render({ kind: 'blocked', reason: 'bundle-unavailable' }, release)
+      expect(output).not.toContain('Get Orca')
+      expect(primaryActionUrl()).toBe(RELEASES_URL)
+    })
+  })
+
+  it.each([
+    ['ios', 'Open App Store', 'itms-apps://apps.apple.com/app/orca-ide/id6766130217'],
+    ['android', 'Open GitHub Releases', RELEASES_URL]
+  ] as const)('keeps the %s store link when no release is known', (os, label, url) => {
+    nativeTestState.platform.OS = os
+    const output = render(
+      { kind: 'blocked', reason: 'mobile-too-old', desktopVersion: 5, requiredMobileVersion: 9 },
+      null
+    )
+    expect(output).toContain(label)
+    expect(output).not.toContain('Get Orca')
+    expect(primaryActionUrl()).toBe(url)
+  })
 })
diff --git a/mobile/src/components/ProtocolBlockScreen.tsx b/mobile/src/components/ProtocolBlockScreen.tsx
index 392a0a5851a..c6d7eba1e22 100644
--- a/mobile/src/components/ProtocolBlockScreen.tsx
+++ b/mobile/src/components/ProtocolBlockScreen.tsx
@@ -1,3 +1,4 @@
+import { useWallAppUpdate } from '../app-update/use-wall-app-update'
 import { openExternalLink } from '../platform/external-link'
 import { useRouteHandoff } from '../navigation/route-handoff'
 import { Platform, Pressable, StyleSheet, Text, View } from 'react-native'
@@ -67,18 +68,22 @@ function blockBody(verdict: BlockedVerdict, remedy: BlockRemedy, storeName: stri
 
 export function ProtocolBlockScreen({ verdict }: Props) {
   const router = useRouteHandoff()
+  const mobileUpdate = useWallAppUpdate()
   const remedy = blockRemedy(verdict)
   // Why: Android APKs ship through GitHub Releases until a Play Store listing exists.
   const mobileUpdateTarget =
     Platform.OS === 'ios'
       ? { label: 'Open App Store', url: IOS_APP_STORE_URL, storeName: 'the App Store' }
       : { label: 'Open GitHub Releases', url: RELEASES_URL, storeName: 'GitHub Releases' }
+  const mobileAction = mobileUpdate
+    ? { label: `Get Orca ${mobileUpdate.version}`, url: mobileUpdate.url }
+    : { label: mobileUpdateTarget.label, url: mobileUpdateTarget.url }
   // No download to offer when the fix is a refetch: reconnecting is what this screen leaves you to do.
   const primaryAction =
     remedy === 'refresh-bundle'
       ? null
       : remedy === 'update-mobile'
-        ? { label: mobileUpdateTarget.label, url: mobileUpdateTarget.url }
+        ? mobileAction
         : { label: 'Open GitHub Releases', url: RELEASES_URL }
 
   const title = blockTitle(remedy)
diff --git a/mobile/src/components/StatusDot.tsx b/mobile/src/components/StatusDot.tsx
index f9514b4e0bf..a1e974f1cd2 100644
--- a/mobile/src/components/StatusDot.tsx
+++ b/mobile/src/components/StatusDot.tsx
@@ -42,7 +42,6 @@ const styles = StyleSheet.create({
   dot: {
     width: 8,
     height: 8,
-    borderRadius: 4,
-    marginRight: 8
+    borderRadius: 4
   }
 })
diff --git a/mobile/src/components/WorktreeAgentRow.tsx b/mobile/src/components/WorktreeAgentRow.tsx
index 8740d12eaed..cd8e10b3454 100644
--- a/mobile/src/components/WorktreeAgentRow.tsx
+++ b/mobile/src/components/WorktreeAgentRow.tsx
@@ -2,7 +2,12 @@ import { memo } from 'react'
 import { StyleSheet, Text, View } from 'react-native'
 import type { RuntimeWorktreeAgentRow } from '../../../src/shared/runtime-types'
 import { colors, spacing } from '../theme/mobile-theme'
-import { agentDisplayLabel, agentDotState, formatTimeAgo } from '../worktree/agent-row-display'
+import {
+  agentDisplayLabel,
+  agentDotState,
+  agentRowTimeAt,
+  formatTimeAgo
+} from '../worktree/agent-row-display'
 import { AgentStateDot } from './AgentStateDot'
 import { MobileAgentIcon } from './MobileAgentIcon'
 
@@ -22,7 +27,7 @@ type Props = {
 function WorktreeAgentRowComponent({ agent, depth, now, unvisited }: Props) {
   const dotState = agentDotState(agent, now)
   const label = agentDisplayLabel(agent, now)
-  const ts = formatTimeAgo(agent.stateStartedAt, now)
+  const ts = formatTimeAgo(agentRowTimeAt(agent), now)
 
   return (
     <View style={[styles.row, { paddingLeft: depth * INDENT_PER_DEPTH }]}>
diff --git a/mobile/src/components/accounts-snapshot.ts b/mobile/src/components/accounts-snapshot.ts
index 8baf0213623..f95f291da9d 100644
--- a/mobile/src/components/accounts-snapshot.ts
+++ b/mobile/src/components/accounts-snapshot.ts
@@ -39,7 +39,8 @@ export const ProviderRateLimitsSchema = z
       'kimi',
       'minimax',
       'grok',
-      'antigravity'
+      'antigravity',
+      'cursor'
     ]),
     session: RateLimitWindowSchema.nullable(),
     weekly: RateLimitWindowSchema.nullable(),
diff --git a/mobile/src/components/bottom-drawer-back-while-hiding.test.tsx b/mobile/src/components/bottom-drawer-back-while-hiding.test.tsx
new file mode 100644
index 00000000000..a038560b44f
--- /dev/null
+++ b/mobile/src/components/bottom-drawer-back-while-hiding.test.tsx
@@ -0,0 +1,151 @@
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+type Timing = { to: number; callback?: (finished: boolean) => void }
+
+// Models Reanimated's contract: assigning a new animation cancels the running one,
+// whose callback then gets finished=false.
+const animations = vi.hoisted((): { running: Timing[] } => ({ running: [] }))
+
+vi.mock('../navigation/use-back-claim', () => ({ useBackClaim: () => {} }))
+vi.mock('../platform/keyboard-occlusion', () => ({
+  currentSoftKeyboardHeight: () => 0,
+  subscribeSoftKeyboard: () => () => {}
+}))
+vi.mock('react-native', () => ({
+  Keyboard: { dismiss: () => {} },
+  Modal: 'Modal',
+  Platform: { OS: 'android', select: (options: { android?: unknown }) => options.android },
+  Pressable: 'Pressable',
+  ScrollView: 'ScrollView',
+  StyleSheet: { create: <T,>(styles: T) => styles, absoluteFillObject: {} },
+  View: 'View',
+  useWindowDimensions: () => ({ width: 412, height: 900 })
+}))
+vi.mock('react-native-safe-area-context', () => ({
+  useSafeAreaInsets: () => ({ top: 24, bottom: 0, left: 0, right: 0 })
+}))
+vi.mock('react-native-gesture-handler', () => {
+  const chain: Record<string, unknown> = {}
+  for (const method of [
+    'activeOffsetY',
+    'simultaneousWithExternalGesture',
+    'onBegin',
+    'onUpdate',
+    'onEnd'
+  ]) {
+    chain[method] = () => chain
+  }
+  return {
+    Gesture: { Pan: () => chain, Native: () => chain },
+    GestureDetector: 'GestureDetector',
+    GestureHandlerRootView: 'GestureHandlerRootView'
+  }
+})
+vi.mock('react-native-reanimated', () => {
+  function isTiming(value: unknown): value is Timing {
+    return typeof value === 'object' && value !== null && 'to' in value
+  }
+  return {
+    default: { View: 'AnimatedView', ScrollView: 'AnimatedScrollView' },
+    useSharedValue: (initial: number) => {
+      let value = initial
+      let current: Timing | null = null
+      return {
+        get value() {
+          return value
+        },
+        set value(next: unknown) {
+          if (current) {
+            const cancelled = current
+            current = null
+            animations.running = animations.running.filter((entry) => entry !== cancelled)
+            cancelled.callback?.(false)
+          }
+          if (isTiming(next)) {
+            current = next
+            animations.running.push(next)
+            value = next.to
+          } else if (typeof next === 'number') {
+            value = next
+          }
+        }
+      }
+    },
+    useAnimatedStyle: () => ({}),
+    useAnimatedScrollHandler: () => () => {},
+    withSpring: (to: number) => to,
+    withTiming: (to: number, _config?: unknown, callback?: (finished: boolean) => void) => ({
+      to,
+      callback
+    }),
+    runOnJS: (fn: () => void) => fn,
+    interpolate: () => 0,
+    Extrapolation: { CLAMP: 'clamp' }
+  }
+})
+
+import { MountedBottomDrawer } from './mounted-bottom-drawer'
+
+function finishAnimations(): void {
+  const finishing = animations.running
+  animations.running = []
+  act(() => {
+    for (const animation of finishing) {
+      animation.callback?.(true)
+    }
+  })
+}
+
+function drawer(visible: boolean, onClose: () => void, onHidden: () => void) {
+  return (
+    <MountedBottomDrawer visible={visible} onClose={onClose} onHidden={onHidden}>
+      {null}
+    </MountedBottomDrawer>
+  )
+}
+
+function pressAndroidBack(renderer: ReactTestRenderer): void {
+  act(() => renderer.root.find((node) => String(node.type) === 'Modal').props.onRequestClose())
+}
+
+describe('bottom drawer close request while hiding', () => {
+  afterEach(() => {
+    animations.running = []
+  })
+
+  it('still closes an open drawer on Android Back', () => {
+    const onClose = vi.fn()
+    let renderer!: ReactTestRenderer
+    act(() => {
+      renderer = create(drawer(true, onClose, vi.fn()))
+    })
+    finishAnimations()
+
+    pressAndroidBack(renderer)
+    finishAnimations()
+
+    expect(onClose).toHaveBeenCalledTimes(1)
+    act(() => renderer.unmount())
+  })
+
+  // A Back press inside the hide animation used to restart it, so onHidden never fired
+  // and the drawer's invisible Modal stayed up, swallowing every tap on the screen.
+  it('lets the hide finish when Back is pressed mid-close', () => {
+    const onClose = vi.fn()
+    const onHidden = vi.fn()
+    let renderer!: ReactTestRenderer
+    act(() => {
+      renderer = create(drawer(true, onClose, onHidden))
+    })
+    finishAnimations()
+    act(() => renderer.update(drawer(false, onClose, onHidden)))
+
+    pressAndroidBack(renderer)
+    finishAnimations()
+
+    expect(onHidden).toHaveBeenCalledTimes(1)
+    expect(onClose).not.toHaveBeenCalled()
+    act(() => renderer.unmount())
+  })
+})
diff --git a/mobile/src/components/bottom-drawer-close-lifecycle.test.ts b/mobile/src/components/bottom-drawer-close-lifecycle.test.ts
index 94eb8a8495c..2e993af225c 100644
--- a/mobile/src/components/bottom-drawer-close-lifecycle.test.ts
+++ b/mobile/src/components/bottom-drawer-close-lifecycle.test.ts
@@ -98,4 +98,23 @@ describe('BottomDrawer close lifecycle', () => {
     expect(latestAfterClose).toHaveBeenCalledTimes(1)
     expect(renderer.toJSON()).toBeNull()
   })
+
+  // The hide finished and the drawer reopened before the scheduled JS callback ran; that late
+  // callback used to latch, so the next close never unmounted and its invisible Modal ate taps.
+  it('a hide that lands after a reopen does not swallow the next close', () => {
+    const onAfterClose = vi.fn()
+    const renderer = renderDrawer(true, vi.fn(), onAfterClose)
+    const lateOnHidden = mountedDrawer(renderer).props.onHidden
+    updateDrawer(renderer, false, vi.fn(), onAfterClose)
+    updateDrawer(renderer, true, vi.fn(), onAfterClose)
+
+    act(() => lateOnHidden())
+    expect(mountedDrawer(renderer).props.visible).toBe(true)
+    expect(onAfterClose).not.toHaveBeenCalled()
+
+    updateDrawer(renderer, false, vi.fn(), onAfterClose)
+    act(() => mountedDrawer(renderer).props.onHidden())
+    expect(renderer.toJSON()).toBeNull()
+    expect(onAfterClose).toHaveBeenCalledTimes(1)
+  })
 })
diff --git a/mobile/src/components/keyed-bottom-drawer.test.tsx b/mobile/src/components/keyed-bottom-drawer.test.tsx
new file mode 100644
index 00000000000..26d95521ce4
--- /dev/null
+++ b/mobile/src/components/keyed-bottom-drawer.test.tsx
@@ -0,0 +1,294 @@
+import { createElement, Profiler, useLayoutEffect, useState, type ReactElement } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+
+// iOS cannot present a native Modal while another is still presented, even mid-close. Each mounted
+// MountedBottomDrawer is one native Modal; this mock records when each mounts and unmounts, in which
+// commit, and which sheets it ever showed, so the tests can check the drawer's lifecycle directly.
+
+type Drawer = {
+  id: number
+  keys: Set<string>
+  visible: boolean
+  onHidden: () => void
+  onClose: () => void
+}
+type Event = { type: 'mount' | 'unmount'; id: number; commit: number }
+
+type Modals = {
+  commit: number
+  nextId: number
+  all: Drawer[]
+  live: Map<number, Drawer>
+  events: Event[]
+}
+
+const modals = vi.hoisted((): Modals => ({
+  commit: 0,
+  nextId: 0,
+  all: [],
+  live: new Map(),
+  events: []
+}))
+
+vi.mock('./mounted-bottom-drawer', () => ({
+  MountedBottomDrawer: function MockMountedBottomDrawer(props: {
+    visible: boolean
+    onHidden: () => void
+    onClose: () => void
+    children: ReactElement<{ name: string }>
+  }) {
+    const [drawer] = useState((): Drawer => ({ id: modals.nextId++, keys: new Set(), ...props }))
+    useLayoutEffect(() => {
+      drawer.visible = props.visible
+      drawer.onHidden = props.onHidden
+      drawer.onClose = props.onClose
+      drawer.keys.add(props.children.props.name)
+    })
+    useLayoutEffect(() => {
+      modals.all.push(drawer)
+      modals.live.set(drawer.id, drawer)
+      modals.events.push({ type: 'mount', id: drawer.id, commit: modals.commit })
+      return () => {
+        modals.live.delete(drawer.id)
+        modals.events.push({ type: 'unmount', id: drawer.id, commit: modals.commit })
+      }
+    }, [])
+    return props.children
+  }
+}))
+
+const { KeyedBottomDrawer } = await import('./keyed-bottom-drawer')
+
+type Sheet = { name: string; version: number }
+
+let renderer: ReactTestRenderer | null = null
+let onAfterClose: Mock<(closed: Sheet) => void>
+
+function tree(sheet: Sheet | null, onClose: (presented: Sheet) => void = () => {}): ReactElement {
+  return (
+    <Profiler
+      id="drawer"
+      // Why: runs once per commit after its subtree's layout effects, so it numbers commits.
+      onRender={() => {
+        modals.commit++
+      }}
+    >
+      <KeyedBottomDrawer<Sheet>
+        sheet={sheet}
+        sheetKey={(s) => s.name}
+        onClose={onClose}
+        onAfterClose={onAfterClose}
+      >
+        {(presented) =>
+          createElement('SheetContent', { name: presented.name, version: presented.version })
+        }
+      </KeyedBottomDrawer>
+    </Profiler>
+  )
+}
+
+function request(sheet: Sheet | null): void {
+  act(() => {
+    if (renderer) {
+      renderer.update(tree(sheet))
+    } else {
+      renderer = create(tree(sheet))
+    }
+  })
+}
+
+function only(): Drawer | null {
+  expect(modals.live.size).toBeLessThanOrEqual(1)
+  return [...modals.live.values()][0] ?? null
+}
+
+function presented(): { name: string; version: number; visible: boolean } | null {
+  const drawer = only()
+  if (!drawer) {
+    return null
+  }
+  const content = renderer!.root.find((node) => String(node.type) === 'SheetContent')
+  return { name: content.props.name, version: content.props.version, visible: drawer.visible }
+}
+
+/** The native hide animation of the mounted drawer finished. */
+function finishHide(drawer = only()): void {
+  act(() => drawer?.onHidden())
+}
+
+function mounts(): Event[] {
+  return modals.events.filter((event) => event.type === 'mount')
+}
+
+const A = { name: 'a', version: 1 }
+const B = { name: 'b', version: 1 }
+const C = { name: 'c', version: 1 }
+
+beforeEach(() => {
+  modals.commit = 0
+  modals.nextId = 0
+  modals.all = []
+  modals.live.clear()
+  modals.events = []
+  onAfterClose = vi.fn()
+})
+
+afterEach(() => {
+  act(() => renderer?.unmount())
+  renderer = null
+})
+
+describe('KeyedBottomDrawer', () => {
+  it('presents a request at once when nothing is presented', () => {
+    request(null)
+    expect(presented()).toBeNull()
+    request(A)
+    expect(presented()).toEqual({ name: 'a', version: 1, visible: true })
+  })
+
+  it('hides the presented sheet and shows the next only after its Modal has unmounted', () => {
+    request(A)
+    request(B)
+    // A keeps its content through the close; B is not mounted yet.
+    expect(presented()).toEqual({ name: 'a', version: 1, visible: false })
+
+    finishHide()
+    expect(presented()).toEqual({ name: 'b', version: 1, visible: true })
+    expect(onAfterClose).toHaveBeenCalledExactlyOnceWith(A)
+
+    const unmountA = modals.events.find((event) => event.type === 'unmount')
+    const mountB = mounts()[1]!
+    // A commit with no Modal at all lands between A leaving and B arriving.
+    expect(mountB.commit).toBeGreaterThan(unmountA!.commit)
+  })
+
+  it('presents the latest request after a close, never one replaced before it was shown', () => {
+    request(A)
+    request(B)
+    request(C)
+    finishHide()
+    expect(presented()?.name).toBe('c')
+    expect(modals.all.map((drawer) => [...drawer.keys])).toEqual([['a'], ['c']])
+  })
+
+  it('a request cleared before the close finishes presents nothing afterwards', () => {
+    request(A)
+    request(B)
+    request(null)
+    finishHide()
+    expect(presented()).toBeNull()
+    expect(mounts()).toHaveLength(1)
+  })
+
+  it('reopening the same sheet mid-close re-shows the same Modal with the new content', () => {
+    request(A)
+    const drawer = only()
+    request(null)
+    expect(presented()?.visible).toBe(false)
+    request({ name: 'a', version: 2 })
+    expect(presented()).toEqual({ name: 'a', version: 2, visible: true })
+    expect(only()).toBe(drawer)
+    expect(mounts()).toHaveLength(1)
+  })
+
+  it('switching away and back to the presented sheet mid-close re-shows it', () => {
+    request(A)
+    request(B)
+    request(A)
+    expect(presented()).toEqual({ name: 'a', version: 1, visible: true })
+    finishHide()
+    expect(presented()?.visible).toBe(true)
+    expect(mounts()).toHaveLength(1)
+  })
+
+  // The hide animation finishes, the sheet reopens before the scheduled JS callback runs, and then
+  // the callback lands: it must not unmount the shown sheet or swallow the next close.
+  it('ignores a hide that lands after a reopen and still honours the next close', () => {
+    request(A)
+    const drawer = only()!
+    request(null)
+    request(A)
+    finishHide(drawer)
+    expect(presented()).toEqual({ name: 'a', version: 1, visible: true })
+    expect(onAfterClose).not.toHaveBeenCalled()
+
+    request(B)
+    finishHide()
+    expect(presented()).toEqual({ name: 'b', version: 1, visible: true })
+    expect(onAfterClose).toHaveBeenCalledExactlyOnceWith(A)
+  })
+
+  it('a hide from an earlier Modal cannot close a later one', () => {
+    request(A)
+    const first = only()!
+    request(null)
+    finishHide()
+    request(B)
+    request(null)
+    act(() => first.onHidden())
+    expect(presented()).toEqual({ name: 'b', version: 1, visible: false })
+    finishHide()
+    expect(presented()).toBeNull()
+  })
+
+  it('reports the close with the sheet that was presented', () => {
+    const onClose = vi.fn()
+    act(() => {
+      renderer = create(tree({ name: 'a', version: 3 }, onClose))
+    })
+    act(() => only()?.onClose())
+    expect(onClose).toHaveBeenCalledExactlyOnceWith({ name: 'a', version: 3 })
+  })
+
+  it('keeps one Modal, never swaps its sheet, and always settles on the latest request', () => {
+    const names = ['a', 'b', 'c']
+    let seed = 11
+    const random = (n: number) => {
+      seed = (seed * 48271) % 2147483647
+      return seed % n
+    }
+    let latestName: string | null = null
+    let version = 0
+    for (let step = 0; step < 600; step++) {
+      const move = random(5)
+      if (move === 2) {
+        finishHide()
+      } else if (move === 3) {
+        // A stale or early hide from whichever Modal is up.
+        act(() => only()?.onHidden())
+      } else {
+        // A new request, or the same sheet again with fresh content.
+        const pick = random(names.length + 1)
+        latestName = move === 4 ? latestName : (names[pick] ?? null)
+        request(latestName === null ? null : { name: latestName, version: ++version })
+      }
+      const shown = presented()
+      if (shown?.visible) {
+        expect(shown.name).toBe(latestName)
+      }
+    }
+    // Settle: finishing every pending hide lands on the latest request.
+    for (let i = 0; i < 3; i++) {
+      if (presented()?.visible === false) {
+        finishHide()
+      }
+    }
+    expect(presented()?.name ?? null).toBe(latestName)
+
+    expect(modals.all.length).toBeGreaterThan(20)
+    for (const drawer of modals.all) {
+      expect(drawer.keys.size).toBe(1)
+    }
+    // Each Modal mounted in a later commit than the one before it left.
+    const ordered = modals.events
+    for (let i = 1; i < ordered.length; i++) {
+      const event = ordered[i]!
+      if (event.type === 'mount') {
+        const previous = ordered[i - 1]!
+        expect(previous.type).toBe('unmount')
+        expect(event.commit).toBeGreaterThan(previous.commit)
+      }
+    }
+  })
+})
diff --git a/mobile/src/components/keyed-bottom-drawer.tsx b/mobile/src/components/keyed-bottom-drawer.tsx
new file mode 100644
index 00000000000..83265cc079b
--- /dev/null
+++ b/mobile/src/components/keyed-bottom-drawer.tsx
@@ -0,0 +1,106 @@
+import { type ReactNode, useCallback, useEffect, useRef, useState } from 'react'
+import { MountedBottomDrawer, type MountedBottomDrawerProps } from './mounted-bottom-drawer'
+
+// iOS cannot present a native Modal while another is still presented, even mid-close, so one
+// drawer owns what is on screen and swaps sheets only after the previous Modal has unmounted.
+
+type Props<T> = Omit<MountedBottomDrawerProps, 'visible' | 'onClose' | 'onHidden' | 'children'> & {
+  /** The sheet the screen wants shown, or null for none. */
+  sheet: T | null
+  /** Sheets with the same key are one presentation: new content refreshes it in place. */
+  sheetKey: (sheet: T) => string
+  onClose: (presented: T) => void
+  /** Runs once a sheet's Modal has unmounted, in the commit after it left the tree. */
+  onAfterClose?: (closed: T) => void
+  children: (presented: T) => ReactNode
+}
+
+type Presentation<T> = {
+  presented: T | null
+  /** The presented sheet is animating closed. */
+  closing: boolean
+  /** Just unmounted; nothing may present until a commit without its Modal has landed. */
+  released: T | null
+  /** Identifies one mounted Modal so a hide from an earlier one cannot close a later one. */
+  epoch: number
+}
+
+export function KeyedBottomDrawer<T>({
+  sheet,
+  sheetKey,
+  onClose,
+  onAfterClose,
+  children,
+  ...drawerProps
+}: Props<T>) {
+  const [state, setState] = useState<Presentation<T>>(() => ({
+    presented: sheet,
+    closing: false,
+    released: null,
+    epoch: 0
+  }))
+  const onAfterCloseRef = useRef(onAfterClose)
+  useEffect(() => {
+    onAfterCloseRef.current = onAfterClose
+  }, [onAfterClose])
+
+  const next = followRequest(state, sheet, sheetKey)
+  // Why: present in the same render as the request so opening does not add a blank commit.
+  if (next !== state) {
+    setState(next)
+  }
+
+  const { epoch, released } = next
+  const handleHidden = useCallback(() => {
+    // Why: a hide that finished before a reopen re-showed this sheet must not unmount it.
+    setState((current) =>
+      current.epoch === epoch && current.closing
+        ? { presented: null, closing: false, released: current.presented, epoch: epoch + 1 }
+        : current
+    )
+  }, [epoch])
+
+  useEffect(() => {
+    if (released === null) {
+      return
+    }
+    onAfterCloseRef.current?.(released)
+    setState((current) =>
+      current.released === released ? { ...current, released: null } : current
+    )
+  }, [released])
+
+  const presented = next.presented
+  if (presented === null) {
+    return null
+  }
+  return (
+    <MountedBottomDrawer
+      {...drawerProps}
+      visible={!next.closing}
+      onClose={() => onClose(presented)}
+      onHidden={handleHidden}
+    >
+      {children(presented)}
+    </MountedBottomDrawer>
+  )
+}
+
+function followRequest<T>(
+  state: Presentation<T>,
+  sheet: T | null,
+  sheetKey: (sheet: T) => string
+): Presentation<T> {
+  const { presented } = state
+  if (presented === null) {
+    return sheet !== null && state.released === null
+      ? { ...state, presented: sheet, closing: false }
+      : state
+  }
+  if (sheet !== null && sheetKey(sheet) === sheetKey(presented)) {
+    return sheet !== presented || state.closing
+      ? { ...state, presented: sheet, closing: false }
+      : state
+  }
+  return state.closing ? state : { ...state, closing: true }
+}
diff --git a/mobile/src/components/mobile-agent-icon-assets.test.ts b/mobile/src/components/mobile-agent-icon-assets.test.ts
index f4f6325d806..7020d4b4977 100644
--- a/mobile/src/components/mobile-agent-icon-assets.test.ts
+++ b/mobile/src/components/mobile-agent-icon-assets.test.ts
@@ -1,4 +1,4 @@
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync } from 'node:fs'
 import path from 'node:path'
 import { describe, expect, it } from 'vitest'
 import type { TuiAgent } from '../../../src/shared/tui-agent'
@@ -17,7 +17,6 @@ const GLYPH_AGENT_IDS = new Set<TuiAgent>([
 
 const dirname = import.meta.dirname
 const assetsDir = path.resolve(dirname, '../../../src/shared/agent-icons')
-const assetsModuleSource = readFileSync(path.join(dirname, 'mobile-agent-icon-assets.ts'), 'utf8')
 
 // Why: these agents previously loaded from Google's favicon service, which is
 // unreachable in some regions/offline (#8451). Every one that lacks a glyph
@@ -34,12 +33,4 @@ describe('mobile bundled agent icons', () => {
       )
     }
   })
-
-  it('wires every favicon-path agent into the bundled asset map', () => {
-    for (const id of agentsNeedingBundledIcon) {
-      expect(assetsModuleSource, `${id} not mapped in mobile-agent-icon-assets.ts`).toContain(
-        `agent-icons/${id}.png`
-      )
-    }
-  })
 })
diff --git a/mobile/src/components/mobile-agent-icon-assets.ts b/mobile/src/components/mobile-agent-icon-assets.ts
index 473b557096e..53745ead77e 100644
--- a/mobile/src/components/mobile-agent-icon-assets.ts
+++ b/mobile/src/components/mobile-agent-icon-assets.ts
@@ -18,6 +18,8 @@ export const MOBILE_AGENT_ICON_ASSETS: Partial<Record<TuiAgent, ImageSourcePropT
   ante: require('../../../src/shared/agent-icons/ante.png'),
   trae: require('../../../src/shared/agent-icons/trae.png'),
   'prime-agent': require('../../../src/shared/agent-icons/prime-agent.png'),
+  codebuddy: require('../../../src/shared/agent-icons/codebuddy.png'),
+  qoder: require('../../../src/shared/agent-icons/qoder.png'),
   gemini: require('../../../src/shared/agent-icons/gemini.png'),
   antigravity: require('../../../src/shared/agent-icons/antigravity.png'),
   goose: require('../../../src/shared/agent-icons/goose.png'),
@@ -29,6 +31,7 @@ export const MOBILE_AGENT_ICON_ASSETS: Partial<Record<TuiAgent, ImageSourcePropT
   autohand: require('../../../src/shared/agent-icons/autohand.png'),
   cline: require('../../../src/shared/agent-icons/cline.png'),
   codebuff: require('../../../src/shared/agent-icons/codebuff.png'),
+  freebuff: require('../../../src/shared/agent-icons/freebuff.png'),
   'command-code': require('../../../src/shared/agent-icons/command-code.png'),
   continue: require('../../../src/shared/agent-icons/continue.png'),
   cursor: require('../../../src/shared/agent-icons/cursor.png'),
@@ -40,6 +43,7 @@ export const MOBILE_AGENT_ICON_ASSETS: Partial<Record<TuiAgent, ImageSourcePropT
   hermes: require('../../../src/shared/agent-icons/hermes.png'),
   devin: require('../../../src/shared/agent-icons/devin.png'),
   muse: require('../../../src/shared/agent-icons/muse.png'),
+  dsh: require('../../../src/shared/agent-icons/dsh.png'),
   zcode: require('../../../src/shared/agent-icons/zcode.png'),
   openclaw: require('../../../src/shared/agent-icons/openclaw.png')
 }
diff --git a/mobile/src/components/mobile-diff-review-send-sheet-stacking.test.ts b/mobile/src/components/mobile-diff-review-send-sheet-stacking.test.ts
new file mode 100644
index 00000000000..f0e865dd4d1
--- /dev/null
+++ b/mobile/src/components/mobile-diff-review-send-sheet-stacking.test.ts
@@ -0,0 +1,311 @@
+import { createElement } from 'react'
+import { act, create, type ReactTestInstance, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { DiffComment } from '../../../src/shared/diff-comment-types'
+import type { RpcClient } from '../transport/rpc-client'
+import type { ReviewScreenState } from '../session/mobile-diff-review-screen-model'
+
+// iOS cannot present a review sheet while another is still on screen (even mid-close): the second
+// presentation silently fails and every later tap on the screen is swallowed. These drive the real
+// controller and keyed drawer; only the native drawer is mocked, and its finished hide animation is
+// played by calling its `onHidden`.
+
+vi.mock('react-native', () => ({
+  ActivityIndicator: 'ActivityIndicator',
+  KeyboardAvoidingView: 'KeyboardAvoidingView',
+  Platform: { OS: 'ios' },
+  Pressable: 'Pressable',
+  StyleSheet: { create: <T>(styles: T) => styles, hairlineWidth: 1 },
+  Text: 'Text',
+  TextInput: 'TextInput',
+  View: 'View'
+}))
+vi.mock('lucide-react-native', () => ({
+  Check: 'Check',
+  Copy: 'Copy',
+  Edit3: 'Edit3',
+  FileText: 'FileText',
+  Plus: 'Plus',
+  Send: 'Send',
+  Trash2: 'Trash2',
+  X: 'X'
+}))
+vi.mock('expo-haptics', () => ({
+  impactAsync: vi.fn(async () => {}),
+  notificationAsync: vi.fn(async () => {}),
+  selectionAsync: vi.fn(async () => {}),
+  performAndroidHapticsAsync: vi.fn(async () => {}),
+  AndroidHaptics: {},
+  ImpactFeedbackStyle: {},
+  NotificationFeedbackType: {}
+}))
+vi.mock('expo-clipboard', () => ({ setStringAsync: vi.fn() }))
+vi.mock('./mobile-diff-review-screen-styles', () => ({
+  mobileDiffReviewStyles: new Proxy({}, { get: () => ({}) })
+}))
+vi.mock('./mounted-bottom-drawer', () => ({ MountedBottomDrawer: 'MountedBottomDrawer' }))
+const loadSnapshot = vi.hoisted(() => vi.fn())
+vi.mock('../session/mobile-diff-review-loaders', () => ({
+  loadMobileDiffReviewSnapshot: loadSnapshot,
+  loadMobileDiffReviewDiff: vi.fn().mockResolvedValue({ kind: 'idle' })
+}))
+vi.mock('../session/use-mobile-pr-sidebar-controller', () => ({
+  useMobilePrSidebarController: () => ({})
+}))
+
+const { MobileDiffReviewDrawers } = await import('./MobileDiffReviewDrawers')
+const { useMobileDiffReviewController } =
+  await import('../session/use-mobile-diff-review-controller')
+
+type Controller = ReturnType<typeof useMobileDiffReviewController>
+type Deferred = { promise: Promise<unknown>; resolve: (value: unknown) => void }
+
+function deferred(): Deferred {
+  let resolve: (value: unknown) => void = () => {}
+  const promise = new Promise<unknown>((settle) => {
+    resolve = settle
+  })
+  return { promise, resolve }
+}
+
+const NOTE: DiffComment = {
+  id: 'note-1',
+  worktreeId: 'wt-1',
+  filePath: 'src/a.ts',
+  lineNumber: 3,
+  body: 'rename this',
+  createdAt: 1,
+  side: 'modified'
+}
+
+const SNAPSHOT: ReviewScreenState = {
+  kind: 'ready',
+  status: {
+    entries: [{ path: 'src/a.ts', status: 'modified', area: 'unstaged' }],
+    conflictOperation: undefined,
+    upstreamStatus: undefined,
+    branch: 'feature',
+    head: 'abc123'
+  },
+  branchCompare: null,
+  comments: [NOTE],
+  reviewState: { version: 1, files: {} }
+}
+
+const TABS_REPLY = {
+  id: 'tabs',
+  ok: true,
+  result: { tabs: [{ type: 'terminal', id: 'tab-1', terminal: 'terminal-1', title: 'codex' }] },
+  _meta: { runtimeId: 'runtime' }
+}
+const SAVE_REPLY = { id: 'save', ok: true, result: {}, _meta: { runtimeId: 'runtime' } }
+
+let renderer: ReactTestRenderer | null = null
+let controller: Controller
+let replies: Map<string, Deferred>
+
+function Screen({ client }: { client: RpcClient }) {
+  controller = useMobileDiffReviewController({
+    client,
+    connState: 'connected',
+    hostCapabilities: [],
+    hostStatusPending: false,
+    hostStatusReadable: true,
+    hostId: 'host-1',
+    worktreeId: 'wt-1',
+    name: 'review',
+    initialFilter: 'all',
+    initialTarget: null,
+    onOpenSession: () => {},
+    onReconnect: null
+  })
+  return createElement(MobileDiffReviewDrawers, { controller })
+}
+
+/** Every RPC waits until the test answers it, so each case controls when a load or save lands. */
+async function mountScreen(): Promise<void> {
+  replies = new Map()
+  const sendRequest = vi.fn((method: string) => {
+    const reply = deferred()
+    replies.set(method, reply)
+    return reply.promise
+  })
+  loadSnapshot.mockResolvedValue(SNAPSHOT)
+  await act(async () => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the operations under test only call `sendRequest`.
+    renderer = create(createElement(Screen, { client: { sendRequest } as unknown as RpcClient }))
+    await Promise.resolve()
+  })
+  expect(controller.currentItem).not.toBeNull()
+}
+
+async function answer(method: string, reply: unknown): Promise<void> {
+  const pending = replies.get(method)
+  expect(pending, `${method} was never requested`).toBeDefined()
+  await act(async () => {
+    pending?.resolve(reply)
+    await new Promise((settle) => setTimeout(settle, 0))
+  })
+}
+
+function textOf(node: ReactTestInstance): string[] {
+  return node
+    .findAll((child) => String(child.type) === 'Text')
+    .flatMap((text) => text.children.filter((child) => typeof child === 'string'))
+}
+
+/** Every mounted native drawer: each is its own Modal, so there must never be two. */
+function mountedDrawers(): ReactTestInstance[] {
+  return renderer!.root.findAll((node) => String(node.type) === 'MountedBottomDrawer')
+}
+
+/** The mounted sheet, which must carry this title (the first text it renders). */
+function drawer(title: string): ReactTestInstance {
+  const [mounted, ...others] = mountedDrawers()
+  expect(others).toEqual([])
+  expect(mounted && textOf(mounted)[0]).toBe(title)
+  return mounted!
+}
+
+function shownSheets(): string[] {
+  const mounted = mountedDrawers()
+  expect(mounted.length).toBeLessThanOrEqual(1)
+  return mounted.filter((node) => node.props.visible === true).map((node) => textOf(node)[0]!)
+}
+
+function press(within: ReactTestInstance, label: string): void {
+  const target = within.find(
+    (node) =>
+      String(node.type) === 'Pressable' &&
+      (node.props.accessibilityLabel === label || textOf(node).includes(label))
+  )
+  act(() => target.props.onPress())
+}
+
+/** The drawer's native hide animation finished. */
+function finishClosing(title: string): void {
+  const closing = drawer(title)
+  expect(closing.props.visible).toBe(false)
+  act(() => closing.props.onHidden())
+}
+
+/** Marks the only file reviewed; the save stays in flight until `answer('worktree.set')`. */
+function startMarkReviewed(): Promise<void> {
+  let marking: Promise<void> = Promise.resolve()
+  act(() => {
+    marking = controller.markReviewed()
+  })
+  return marking
+}
+
+async function completeReview(): Promise<void> {
+  const marking = startMarkReviewed()
+  await answer('worktree.set', SAVE_REPLY)
+  await act(() => marking)
+}
+
+beforeEach(() => {
+  loadSnapshot.mockReset()
+})
+
+afterEach(() => {
+  act(() => renderer?.unmount())
+  renderer = null
+})
+
+describe('review screen sheets never stack', () => {
+  it('Send Unsent Notes shows Send Notes only after Review Actions has closed', async () => {
+    await mountScreen()
+    act(() => controller.openSheet({ kind: 'actions' }))
+    expect(shownSheets()).toEqual(['Review Actions'])
+
+    press(drawer('Review Actions'), 'Send Unsent Notes')
+    expect(shownSheets()).toEqual([])
+
+    await answer('session.tabs.list', TABS_REPLY)
+    expect(shownSheets()).toEqual([])
+
+    finishClosing('Review Actions')
+    expect(shownSheets()).toEqual(['Send Notes'])
+    expect(textOf(drawer('Send Notes'))).toContain('codex (termin)')
+  })
+
+  it('Review Complete → Send shows Send Notes only after Review Complete has closed', async () => {
+    await mountScreen()
+    await completeReview()
+    expect(shownSheets()).toEqual(['Review Complete'])
+
+    press(drawer('Review Complete'), 'Send notes to agent')
+    expect(shownSheets()).toEqual([])
+
+    finishClosing('Review Complete')
+    expect(shownSheets()).toEqual(['Send Notes'])
+  })
+
+  it('does not open Send Notes when Review Complete closes for another reason', async () => {
+    await mountScreen()
+    await completeReview()
+
+    act(() => drawer('Review Complete').props.onClose())
+    finishClosing('Review Complete')
+
+    expect(shownSheets()).toEqual([])
+  })
+
+  it('Review Complete arriving while another sheet is open waits for that sheet to close', async () => {
+    await mountScreen()
+    const marking = startMarkReviewed()
+    // The user opens Review Actions while the save is still in flight.
+    act(() => controller.openSheet({ kind: 'actions' }))
+    await answer('worktree.set', SAVE_REPLY)
+    await act(() => marking)
+    expect(shownSheets()).toEqual(['Review Actions'])
+
+    act(() => drawer('Review Actions').props.onClose())
+    expect(shownSheets()).toEqual([])
+
+    finishClosing('Review Actions')
+    expect(shownSheets()).toEqual(['Review Complete'])
+  })
+
+  it('a sheet replaced before it was ever shown is never mounted', async () => {
+    await mountScreen()
+    act(() => {
+      controller.openSheet({ kind: 'completion' })
+      controller.openSheet({ kind: 'actions' })
+    })
+    expect(shownSheets()).toEqual(['Review Actions'])
+
+    act(() => {
+      controller.openSheet({ kind: 'completion' })
+      controller.closeSheet('completion')
+    })
+    expect(shownSheets()).toEqual([])
+    finishClosing('Review Actions')
+    expect(mountedDrawers()).toEqual([])
+  })
+
+  it('a send list that lands after Send Notes was dismissed does not bring it back', async () => {
+    await mountScreen()
+    act(() => void controller.openSendSheet())
+    expect(shownSheets()).toEqual(['Send Notes'])
+
+    act(() => drawer('Send Notes').props.onClose())
+    await answer('session.tabs.list', TABS_REPLY)
+    finishClosing('Send Notes')
+    expect(mountedDrawers()).toEqual([])
+
+    act(() => controller.openSheet({ kind: 'actions' }))
+    expect(shownSheets()).toEqual(['Review Actions'])
+  })
+
+  it('Discard keeps its file through the close and discards the file it showed', async () => {
+    await mountScreen()
+    const target = controller.currentItem!
+    act(() => controller.openSheet({ kind: 'discard', target }))
+    press(drawer('Discard File'), 'Discard')
+    expect(shownSheets()).toEqual([])
+    expect(textOf(drawer('Discard File')).join(' ')).toContain(target.filePath)
+    expect(replies.has('git.discard')).toBe(true)
+  })
+})
diff --git a/mobile/src/components/mounted-bottom-drawer-page-keyboard.web.test.tsx b/mobile/src/components/mounted-bottom-drawer-page-keyboard.web.test.tsx
index a741f5c864d..d7d0c67a0cb 100644
--- a/mobile/src/components/mounted-bottom-drawer-page-keyboard.web.test.tsx
+++ b/mobile/src/components/mounted-bottom-drawer-page-keyboard.web.test.tsx
@@ -69,6 +69,7 @@ vi.mock('react-native-reanimated', () => ({
 }))
 
 import { MountedBottomDrawer } from './mounted-bottom-drawer'
+import { publishShellKeyboardSource } from '../platform/keyboard-occlusion.web'
 
 const RESTING_HEIGHT = 900
 const IME_HEIGHT = 300
@@ -106,15 +107,36 @@ describe('a fill-mode sheet on the page', () => {
     act(() => renderer.unmount())
   })
 
-  it('does not lift over a keyboard the shell already shortened the WebView for', () => {
-    setWindowHeight(RESTING_HEIGHT)
-    const renderer = renderFillSheet()
-    act(() => setWindowHeight(RESTING_HEIGHT - IME_HEIGHT))
-    // The shortened window is the whole avoidance: the sheet's height follows it and nothing lifts.
-    expect(sheetStyle(renderer)).toMatchObject({
-      marginBottom: 0,
-      height: RESTING_HEIGHT - IME_HEIGHT - 24 - 16
+  it('sits on the keyboard the shell says covers the page, as it does natively', () => {
+    let height = 0
+    const listeners = new Set<(next: number) => void>()
+    publishShellKeyboardSource({
+      read: () => height,
+      subscribe: (listener) => {
+        listeners.add(listener)
+        return () => listeners.delete(listener)
+      }
     })
-    act(() => renderer.unmount())
+    try {
+      setWindowHeight(RESTING_HEIGHT)
+      const renderer = renderFillSheet()
+      act(() => {
+        height = IME_HEIGHT
+        listeners.forEach((listener) => listener(IME_HEIGHT))
+      })
+      expect(sheetStyle(renderer)).toMatchObject({
+        marginBottom: IME_HEIGHT,
+        height: RESTING_HEIGHT - IME_HEIGHT - 24 - 16
+      })
+      act(() => {
+        height = 0
+        listeners.forEach((listener) => listener(0))
+      })
+      expect(sheetStyle(renderer).marginBottom).toBe(0)
+      act(() => renderer.unmount())
+      expect(listeners.size).toBe(0)
+    } finally {
+      publishShellKeyboardSource(null)
+    }
   })
 })
diff --git a/mobile/src/components/mounted-bottom-drawer.tsx b/mobile/src/components/mounted-bottom-drawer.tsx
index ea85c320861..764a3c5437e 100644
--- a/mobile/src/components/mounted-bottom-drawer.tsx
+++ b/mobile/src/components/mounted-bottom-drawer.tsx
@@ -1,13 +1,5 @@
 import { type ReactNode, useCallback, useEffect, useRef, useState } from 'react'
-import {
-  View,
-  Pressable,
-  useWindowDimensions,
-  ScrollView,
-  Keyboard,
-  Modal,
-  Platform
-} from 'react-native'
+import { View, Pressable, useWindowDimensions, ScrollView, Keyboard, Modal } from 'react-native'
 import { useSafeAreaInsets } from 'react-native-safe-area-context'
 import { Gesture, GestureDetector, GestureHandlerRootView } from 'react-native-gesture-handler'
 import Animated, {
@@ -29,6 +21,7 @@ import { useInsideBottomDrawerModalHost } from './bottom-drawer-modal-host'
 import { useResponsiveLayout } from '../layout/responsive-layout'
 import { useBackClaim } from '../navigation/use-back-claim'
 import { currentSoftKeyboardHeight, subscribeSoftKeyboard } from '../platform/keyboard-occlusion'
+import { hostOs } from '../platform/host-os'
 
 const DISMISS_THRESHOLD = 80
 const SPRING_CONFIG = { damping: 28, stiffness: 400 }
@@ -131,8 +124,7 @@ export function MountedBottomDrawer({
   // Why: KeyboardAvoidingView and useAnimatedKeyboard are both unreliable
   // inside Modal (iOS ignores KAV; Android needs adjustNothing for
   // useAnimatedKeyboard). The keyboard seam's events work on both platforms
-  // and give the exact height; inside the shell's page none fire, because
-  // the shell shortens the WebView above the IME.
+  // and give the exact height; inside the shell's page they are the shell's.
   useEffect(() => {
     // Pinned-under sheets stay visible for size but must not ride the keyboard —
     // only the top interactive sheet owns inset/lift.
@@ -147,7 +139,7 @@ export function MountedBottomDrawer({
         keyboardHeight,
         bottomInset: insets.bottom,
         fillAvailable,
-        platform: Platform.OS
+        platform: hostOs()
       })
       setKeyboardInset(inset)
       if (duration > 0) {
@@ -185,13 +177,18 @@ export function MountedBottomDrawer({
   }, [visible, interactive, insets.bottom, fillAvailable])
 
   const dismiss = useCallback(() => {
+    // Why: restarting the hide animation cancels it, so onHidden never fires and the
+    // invisible Modal stays up swallowing taps (Android Back lands here mid-close).
+    if (!visible) {
+      return
+    }
     Keyboard.dismiss()
     progress.value = withTiming(0, { duration: BOTTOM_DRAWER_HIDE_DURATION_MS }, (finished) => {
       if (finished) {
         runOnJS(onClose)()
       }
     })
-  }, [onClose, progress])
+  }, [onClose, progress, visible])
 
   // One seam, both platforms: natively this is the hardware key, and inside the shell's page it is
   // a claim the shell hands one press over on. Every session sheet renders through this component,
diff --git a/mobile/src/components/pr-sidebar/MobilePrViewPanel.tsx b/mobile/src/components/pr-sidebar/MobilePrViewPanel.tsx
index f587074e12e..4f76073e7cb 100644
--- a/mobile/src/components/pr-sidebar/MobilePrViewPanel.tsx
+++ b/mobile/src/components/pr-sidebar/MobilePrViewPanel.tsx
@@ -17,6 +17,7 @@ type Props = {
   isGithubRepo?: boolean
   branchContextLoaded?: boolean
   controller: MobilePrSidebarController
+  workspaceLabel: string | null
 }
 
 // Chromeless PR sidebar body for the source-control hub's Pull Request segment.
@@ -31,7 +32,8 @@ export function MobilePrViewPanelBody({
   gitStatus,
   isGithubRepo = true,
   branchContextLoaded = true,
-  controller
+  controller,
+  workspaceLabel
 }: Props) {
   const insets = useSafeAreaInsets()
 
@@ -64,6 +66,7 @@ export function MobilePrViewPanelBody({
         bottomInset={insets.bottom}
         // Hub header already hosts open-on-web while this segment is active.
         showOpenOnWeb={false}
+        workspaceLabel={workspaceLabel}
       />
     </View>
   )
diff --git a/mobile/src/components/pr-sidebar/PRChecksSection.tsx b/mobile/src/components/pr-sidebar/PRChecksSection.tsx
index 881c3c60bde..67c4a71ed87 100644
--- a/mobile/src/components/pr-sidebar/PRChecksSection.tsx
+++ b/mobile/src/components/pr-sidebar/PRChecksSection.tsx
@@ -22,12 +22,18 @@ import { PRSection } from './PRSection'
 import { PRCheckDetailView, type DetailEntry } from './PRCheckDetail'
 import { mobilePrSidebarStyles as styles } from './mobile-pr-sidebar-styles'
 import { prAiTriageStyles as triageStyles } from './pr-ai-triage-styles'
+import { AgentLaunchNotice } from '../AgentLaunchNotice'
+import type { MobileAgentLaunchAvailability } from '../../session/mobile-agent-launch-availability'
 
 // Launches the "Fix checks with AI" agent. Absent for display-only usages.
 export type PrChecksTriage = {
   fixChecks: () => void
   isBusy: boolean
+  availability: MobileAgentLaunchAvailability
+  success: string | null
   error: string | null
+  warning: string | null
+  undeliveredPrompt: string | null
 }
 
 type Props = {
@@ -190,7 +196,7 @@ export function PRChecksSection({
           <Pressable
             style={({ pressed }) => [triageStyles.triageStripButton, pressed && { opacity: 0.7 }]}
             onPress={triage.fixChecks}
-            disabled={triage.isBusy}
+            disabled={triage.isBusy || triage.availability !== 'available'}
             accessibilityRole="button"
             accessibilityLabel="Fix failing checks with AI"
           >
@@ -203,7 +209,16 @@ export function PRChecksSection({
           </Pressable>
         </View>
       ) : null}
-      {triage?.error ? <Text style={triageStyles.triageError}>{triage.error}</Text> : null}
+      {triage ? (
+        <AgentLaunchNotice
+          availability={summary.failed > 0 ? triage.availability : 'available'}
+          success={triage.success}
+          error={triage.error}
+          warning={triage.warning}
+          undeliveredPrompt={triage.undeliveredPrompt}
+          errorStyle={triageStyles.triageError}
+        />
+      ) : null}
       {checksError ? <Text style={triageStyles.triageError}>{checksError}</Text> : null}
       {sorted.map((check) => {
         const key = prCheckKey(check)
diff --git a/mobile/src/components/pr-sidebar/PRConflictingFilesSection.tsx b/mobile/src/components/pr-sidebar/PRConflictingFilesSection.tsx
index badb33a6fd0..99996fa1baf 100644
--- a/mobile/src/components/pr-sidebar/PRConflictingFilesSection.tsx
+++ b/mobile/src/components/pr-sidebar/PRConflictingFilesSection.tsx
@@ -8,12 +8,18 @@ import { PRSection } from './PRSection'
 import { resolveConflictDisplay } from './pr-conflict-presentation'
 import { prConflictStyles as styles } from './pr-conflict-styles'
 import { prAiTriageStyles as triageStyles } from './pr-ai-triage-styles'
+import { AgentLaunchNotice } from '../AgentLaunchNotice'
+import type { MobileAgentLaunchAvailability } from '../../session/mobile-agent-launch-availability'
 
 // Launches the "Resolve conflicts with AI" agent. Absent for display-only usages.
 export type PrConflictsTriage = {
   resolveConflicts: () => void
   isBusy: boolean
+  availability: MobileAgentLaunchAvailability
+  success: string | null
   error: string | null
+  warning: string | null
+  undeliveredPrompt: string | null
 }
 
 type Props = {
@@ -157,7 +163,7 @@ export function PRConflictingFilesSection({ pr, isRefreshing = false, triage }:
               pressed && triageStyles.triageButtonPressed
             ]}
             onPress={triage.resolveConflicts}
-            disabled={triage.isBusy}
+            disabled={triage.isBusy || triage.availability !== 'available'}
             accessibilityRole="button"
             accessibilityLabel="Resolve conflicts with AI"
           >
@@ -168,7 +174,14 @@ export function PRConflictingFilesSection({ pr, isRefreshing = false, triage }:
             )}
             <Text style={triageStyles.triageButtonText}>Resolve conflicts with AI</Text>
           </Pressable>
-          {triage.error ? <Text style={triageStyles.triageError}>{triage.error}</Text> : null}
+          <AgentLaunchNotice
+            availability={triage.availability}
+            success={triage.success}
+            error={triage.error}
+            warning={triage.warning}
+            undeliveredPrompt={triage.undeliveredPrompt}
+            errorStyle={triageStyles.triageError}
+          />
         </View>
       ) : null}
     </PRSection>
diff --git a/mobile/src/components/pr-sidebar/PrSidebarCreateEmptyState.tsx b/mobile/src/components/pr-sidebar/PrSidebarCreateEmptyState.tsx
index cffde86ea5b..ac07248f925 100644
--- a/mobile/src/components/pr-sidebar/PrSidebarCreateEmptyState.tsx
+++ b/mobile/src/components/pr-sidebar/PrSidebarCreateEmptyState.tsx
@@ -28,6 +28,8 @@ type Props = {
   gitBranch: string | null
   gitStatus: MobileGitStatusResult | null
   connState: ConnectionState
+  /** Named when the commit-recovery agent starts. */
+  workspaceLabel: string | null
   // Refetches the sidebar after create or an explicit empty-state refresh.
   onCreated: () => void
 }
@@ -43,6 +45,7 @@ export function PrSidebarCreateEmptyState({
   gitBranch,
   gitStatus,
   connState,
+  workspaceLabel,
   onCreated
 }: Props) {
   const [mode, setMode] = useState<Mode>('choose')
@@ -57,6 +60,7 @@ export function PrSidebarCreateEmptyState({
     client,
     connState,
     worktreeId,
+    workspaceLabel,
     failure: commitFailureRecovery
   })
 
diff --git a/mobile/src/components/use-new-workspace-create-submit.ts b/mobile/src/components/use-new-workspace-create-submit.ts
index df47a69b65a..5ea89f23efc 100644
--- a/mobile/src/components/use-new-workspace-create-submit.ts
+++ b/mobile/src/components/use-new-workspace-create-submit.ts
@@ -14,7 +14,7 @@ import {
 import { createWorkspaceFromComposerSource } from '../tasks/source-workspace-create'
 import { normalizeWorkspaceAgent } from '../tasks/workspace-agent-selection'
 import type { WorkspaceCreateSetupDecision } from '../tasks/workspace-create-params'
-import type { AgentLaunchSupport } from '../tasks/agent-launch-worktree-create'
+import type { AgentLaunchSupport } from '../tasks/agent-launch-request'
 import type { WorkspaceSshGate } from '../tasks/workspace-ssh-gate'
 import type { useMobileComposerSource } from '../tasks/use-mobile-composer-source'
 import type { WorktreeCreateIdempotencySupport } from '../tasks/worktree-create-idempotency-policy'
diff --git a/mobile/src/diagnostics/use-mobile-web-bundle-probe.test.tsx b/mobile/src/diagnostics/use-mobile-web-bundle-probe.test.tsx
index c7878e65ea5..b72cb584d02 100644
--- a/mobile/src/diagnostics/use-mobile-web-bundle-probe.test.tsx
+++ b/mobile/src/diagnostics/use-mobile-web-bundle-probe.test.tsx
@@ -23,6 +23,9 @@ vi.mock('../transport/runtime-status-probe', () => ({ startRuntimeStatusProbe: (
 vi.mock('../transport/connection-revival-triggers', () => ({
   subscribeConnectionRevivalTriggers: () => () => {}
 }))
+vi.mock('../transport/connection-log-background-flush', () => ({
+  subscribeConnectionLogBackgroundFlush: () => () => {}
+}))
 vi.mock('../transport/mobile-web-bundle-fetch', () => ({
   fetchMobileWebBundle: (...args: unknown[]) => fetchMock(...args)
 }))
diff --git a/mobile/src/files/files-router-seam-census.test.ts b/mobile/src/files/files-router-seam-census.test.ts
deleted file mode 100644
index 360b040b2df..00000000000
--- a/mobile/src/files/files-router-seam-census.test.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import {
-  callsRouteHandoff,
-  importsExpoRouterValue,
-  parse,
-  productFiles
-} from '../navigation/router-seam-census.test-support'
-
-const FILES_ROOT = import.meta.dirname
-
-/**
- * Which modules here hold a router, so the census cannot pass by seeing nothing.
- *
- * The walk and the two rules are the seam's, shared with every other domain that runs them; what
- * stays here is this domain's own evidence: which of its modules are meant to hold a router.
- */
-const ROUTER_HOLDERS = ['MobileFilePreviewScreen.tsx', 'MobileFileExplorerPanel.tsx']
-
-describe('the files domain reaches the router through the handoff seam', () => {
-  const files = productFiles(FILES_ROOT)
-
-  it('walks the modules it is written against', () => {
-    expect(files).toEqual(expect.arrayContaining(ROUTER_HOLDERS))
-  })
-
-  it('imports no router from expo-router, which the page cannot hand a route back through', () => {
-    expect(files.filter((name) => importsExpoRouterValue(parse(FILES_ROOT, name)))).toEqual([])
-  })
-
-  it('takes the router from useRouteHandoff at every screen that holds one', () => {
-    expect(files.filter((name) => callsRouteHandoff(parse(FILES_ROOT, name))).sort()).toEqual(
-      [...ROUTER_HOLDERS].sort()
-    )
-  })
-})
diff --git a/mobile/src/home-host-edit-navigation-source.test.ts b/mobile/src/home-host-edit-navigation-source.test.ts
deleted file mode 100644
index 617dd030c8a..00000000000
--- a/mobile/src/home-host-edit-navigation-source.test.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { describe, expect, it } from 'vitest'
-
-const homeSource = readFileSync(new URL('./home/MobileHomeScreen.tsx', import.meta.url), 'utf8')
-
-describe('Home host edit navigation wiring', () => {
-  it('uses the cold-navigator-safe edit transition', () => {
-    expect(homeSource).toMatch(/const openMobileHostEdit = useOpenMobileHostEdit\(\)/)
-    expect(homeSource).toMatch(/onEdit:\s*openMobileHostEdit/)
-  })
-})
diff --git a/mobile/src/home/AppUpdateCard.test.tsx b/mobile/src/home/AppUpdateCard.test.tsx
new file mode 100644
index 00000000000..7a98a91f91f
--- /dev/null
+++ b/mobile/src/home/AppUpdateCard.test.tsx
@@ -0,0 +1,50 @@
+import { createElement } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { AppUpdateCard } from './AppUpdateCard'
+
+vi.mock('react-native', () => ({
+  Pressable: 'Pressable',
+  StyleSheet: { create: <T,>(styles: T) => styles },
+  Text: 'Text',
+  View: 'View'
+}))
+vi.mock('lucide-react-native', () => ({ ArrowUpFromLine: 'ArrowUpFromLine', X: 'X' }))
+
+describe('AppUpdateCard', () => {
+  let renderer: ReactTestRenderer | null = null
+  afterEach(() => {
+    act(() => renderer?.unmount())
+    renderer = null
+  })
+
+  function render() {
+    const onPress = vi.fn()
+    const onDismiss = vi.fn()
+    act(() => {
+      renderer = create(createElement(AppUpdateCard, { version: '0.0.51', onPress, onDismiss }))
+    })
+    const root = renderer!.root
+    const texts = root
+      .findAll((node) => String(node.type) === 'Text')
+      .flatMap((node) => node.children.filter((child) => typeof child === 'string'))
+    return { root, texts, onPress, onDismiss }
+  }
+
+  it('says which version is available and how to get it, with a monochrome glyph', () => {
+    const { root, texts } = render()
+    expect(texts).toEqual(['Orca 0.0.51 is available', 'Tap to update'])
+    expect(root.find((node) => String(node.type) === 'ArrowUpFromLine').props.color).toBe('#e0e0e0')
+  })
+
+  it('opens the update from the card body and dismisses from the X', () => {
+    const { root, onPress, onDismiss } = render()
+    const [body, dismiss] = root.findAll((node) => String(node.type) === 'Pressable')
+    expect(dismiss.props.accessibilityLabel).toBe('Dismiss Orca 0.0.51 update')
+    act(() => body.props.onPress())
+    expect(onPress).toHaveBeenCalledTimes(1)
+    expect(onDismiss).not.toHaveBeenCalled()
+    act(() => dismiss.props.onPress())
+    expect(onDismiss).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/mobile/src/home/AppUpdateCard.tsx b/mobile/src/home/AppUpdateCard.tsx
new file mode 100644
index 00000000000..6713bcbfd12
--- /dev/null
+++ b/mobile/src/home/AppUpdateCard.tsx
@@ -0,0 +1,86 @@
+import { ArrowUpFromLine, X } from 'lucide-react-native'
+import { Pressable, StyleSheet, Text, View } from 'react-native'
+import { colors, radii, spacing } from '../theme/mobile-theme'
+
+/** Home's update notice, drawn in the host card's frame so it reads as part of that list. */
+export function AppUpdateCard(props: {
+  version: string
+  onPress: () => void
+  onDismiss: () => void
+}) {
+  const title = `Orca ${props.version} is available`
+  return (
+    <View style={styles.card}>
+      <Pressable
+        accessibilityRole="button"
+        accessibilityLabel={`${title}, tap to update`}
+        style={({ pressed }) => [styles.cardMain, pressed && styles.cardPressed]}
+        onPress={props.onPress}
+      >
+        <View style={styles.icon}>
+          <ArrowUpFromLine size={20} strokeWidth={1.75} color={colors.textPrimary} />
+        </View>
+        <View style={styles.main}>
+          <Text style={styles.title} numberOfLines={1}>
+            {title}
+          </Text>
+          <Text style={styles.subtitle} numberOfLines={1}>
+            Tap to update
+          </Text>
+        </View>
+      </Pressable>
+      <Pressable
+        accessibilityRole="button"
+        accessibilityLabel={`Dismiss Orca ${props.version} update`}
+        hitSlop={8}
+        style={({ pressed }) => [styles.dismissButton, pressed && styles.dismissPressed]}
+        onPress={props.onDismiss}
+      >
+        <X size={16} color={colors.textSecondary} />
+      </Pressable>
+    </View>
+  )
+}
+
+// Same frame, icon well and spacing as MobileHostCard.
+const styles = StyleSheet.create({
+  card: {
+    flexDirection: 'row',
+    alignItems: 'center',
+    borderRadius: radii.card,
+    backgroundColor: colors.bgPanel,
+    borderWidth: 1,
+    borderColor: colors.borderSubtle,
+    overflow: 'hidden'
+  },
+  cardMain: {
+    flex: 1,
+    minWidth: 0,
+    flexDirection: 'row',
+    alignItems: 'center',
+    paddingLeft: spacing.md,
+    paddingVertical: 12
+  },
+  cardPressed: { backgroundColor: colors.bgRaised },
+  icon: {
+    width: 46,
+    height: 46,
+    borderRadius: 13,
+    alignItems: 'center',
+    justifyContent: 'center',
+    backgroundColor: colors.bgRaised,
+    marginRight: 14
+  },
+  main: { flex: 1, minWidth: 0, marginRight: spacing.sm },
+  title: { color: colors.textPrimary, fontSize: 15, fontWeight: '600', lineHeight: 20 },
+  subtitle: { color: colors.textSecondary, fontSize: 12, lineHeight: 16 },
+  dismissButton: {
+    width: 40,
+    height: 40,
+    marginHorizontal: spacing.xs,
+    borderRadius: radii.row,
+    alignItems: 'center',
+    justifyContent: 'center'
+  },
+  dismissPressed: { backgroundColor: colors.bgRaised }
+})
diff --git a/mobile/src/home/MobileHomeAppUpdateCard.tsx b/mobile/src/home/MobileHomeAppUpdateCard.tsx
new file mode 100644
index 00000000000..51bc41d8602
--- /dev/null
+++ b/mobile/src/home/MobileHomeAppUpdateCard.tsx
@@ -0,0 +1,27 @@
+import { StyleSheet, View } from 'react-native'
+import { undismissedAppUpdate } from '../app-update/app-update-checker'
+import {
+  appUpdateChecker,
+  openAppUpdate,
+  useAppUpdateState
+} from '../app-update/app-update-runtime'
+import { AppUpdateCard } from './AppUpdateCard'
+import { spacing } from '../theme/mobile-theme'
+
+export function MobileHomeAppUpdateCard() {
+  const available = undismissedAppUpdate(useAppUpdateState())
+  if (!available) {
+    return null
+  }
+  return (
+    <View style={styles.slot}>
+      <AppUpdateCard
+        version={available.version}
+        onPress={() => openAppUpdate(available.url)}
+        onDismiss={() => appUpdateChecker.dismiss(available.version)}
+      />
+    </View>
+  )
+}
+
+const styles = StyleSheet.create({ slot: { marginBottom: spacing.lg } })
diff --git a/mobile/src/home/MobileHomeListHeader.tsx b/mobile/src/home/MobileHomeListHeader.tsx
index 7e47c9ae9d6..f7da47c9733 100644
--- a/mobile/src/home/MobileHomeListHeader.tsx
+++ b/mobile/src/home/MobileHomeListHeader.tsx
@@ -1,6 +1,7 @@
 import { StyleSheet, Text, View } from 'react-native'
 import type { HomeStatsSummary } from '../stats/home-stats-total'
 import { colors, spacing } from '../theme/mobile-theme'
+import { MobileHomeAppUpdateCard } from './MobileHomeAppUpdateCard'
 
 function formatDuration(ms: number): string {
   const totalMinutes = Math.floor(ms / 60_000)
@@ -36,6 +37,7 @@ export function MobileHomeListHeader({ stats }: { stats: HomeStatsSummary | null
           </View>
         </View>
       ) : null}
+      <MobileHomeAppUpdateCard />
       <Text style={styles.sectionHeading}>Desktops</Text>
     </View>
   )
diff --git a/mobile/src/hooks/use-mobile-dictation-source.test.ts b/mobile/src/hooks/use-mobile-dictation-source.test.ts
deleted file mode 100644
index aedc0543bce..00000000000
--- a/mobile/src/hooks/use-mobile-dictation-source.test.ts
+++ /dev/null
@@ -1,97 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { describe, expect, it } from 'vitest'
-
-const source = readFileSync(new URL('./use-mobile-dictation.ts', import.meta.url), 'utf8')
-const nativeCaptureSource = readFileSync(
-  new URL('../platform/dictation-capture.ts', import.meta.url),
-  'utf8'
-)
-
-function sliceSource(sourceText: string, startPattern: string, endPattern: string): string {
-  const start = sourceText.indexOf(startPattern)
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = sourceText.indexOf(endPattern, start)
-  expect(end).toBeGreaterThan(start)
-  return sourceText.slice(start, end)
-}
-
-function sliceBetween(startPattern: string, endPattern: string): string {
-  return sliceSource(source, startPattern, endPattern)
-}
-
-describe('useMobileDictation source invariants', () => {
-  it('publishes live option refs from committed renders before passive Effects flush', () => {
-    const refDeclarations = sliceBetween(
-      'const clientRef = useRef(client)',
-      'useLayoutEffect(() => {'
-    )
-    expect(refDeclarations).not.toContain('.current =')
-
-    const mirrorEffect = sliceBetween('useLayoutEffect(() => {', 'const reportError =')
-    expect(mirrorEffect).toContain('clientRef.current = client')
-    expect(mirrorEffect).toContain('enabledRef.current = enabled')
-    expect(mirrorEffect).toContain('onTranscriptRef.current = onTranscript')
-    expect(mirrorEffect).toContain('onErrorRef.current = onError')
-    expect(mirrorEffect).toContain('}, [client, enabled, onTranscript, onError])')
-  })
-
-  it('carries audio the capture dropped into the same refusal the budget raises', () => {
-    const chunkHandler = sliceBetween('const sub = capture.onChunk(', 'return () => sub.remove()')
-    expect(chunkHandler).toContain('if (chunk.droppedBytes > 0)')
-    expect(chunkHandler).toContain('MOBILE_DICTATION_CONNECTION_SLOW_ERROR_MESSAGE')
-    // Only the page can drop: the seam's native half is where the microphone is.
-    expect(nativeCaptureSource).toContain('droppedBytes: 0')
-  })
-
-  it('resets pending audio bytes whenever pending chunk tracking is cleared', () => {
-    const pendingChunkClears = source.match(/pendingChunksRef\.current\.clear\(\)/g) ?? []
-    const pendingAudioResets = source.match(/pendingAudioBudgetRef\.current\.reset\(\)/g) ?? []
-
-    expect(pendingAudioResets).toHaveLength(pendingChunkClears.length)
-  })
-
-  it('closes the capture on every path that ends a dictation', () => {
-    const closeAudio = sliceBetween(
-      'const closeDictationAudio = useCallback(',
-      'const failActiveDictation ='
-    )
-    expect(closeAudio).toContain('capture.end()')
-    const cleanupSlices = [
-      sliceBetween('const failActiveDictation = useCallback(', 'useEffect(() => {'),
-      sliceBetween('const abandonDictation = useCallback(', 'const cancel ='),
-      sliceBetween('return () => {\n      const dictationId = activeIdRef.current', '  return {')
-    ]
-    for (const cleanupSlice of cleanupSlices) {
-      expect(cleanupSlice).toContain('closeDictationAudio()')
-    }
-    // The capture hands over its tail before the pending sends are taken, or the finish overtakes
-    // the last chunk. `mobile-dictation-stop-tail.test.tsx` drives the order this pins.
-    const stopBody = sliceBetween(
-      'const stop = useCallback(async () => {',
-      'const abandonDictation ='
-    )
-    expect(stopBody.indexOf('capture.end()')).toBeLessThan(
-      stopBody.indexOf('await Promise.allSettled')
-    )
-  })
-
-  it('routes an audio interruption through cancel and a disable through the reporting abort', () => {
-    const interruptionEffect = sliceBetween('capture.onInterruption(', 'return () => sub.remove()')
-    const disabledEffect = sliceBetween(
-      'useEffect(() => {\n    if (!enabled) {',
-      '  }, [abandonDictation, enabled])'
-    )
-
-    expect(interruptionEffect).toContain('void cancel()')
-    // A disable is not the user's cancel, so it carries the reason the composer shows; the user's
-    // own cancel is the one end that passes none. `mobile-dictation-input-closed-mid-start.test.tsx`
-    // drives both halves.
-    expect(disabledEffect).toContain(
-      'void abandonDictation(MOBILE_DICTATION_INPUT_CLOSED_ERROR_MESSAGE)'
-    )
-    expect(source).toContain('const cancel = useCallback(() => abandonDictation(null)')
-    // Which interruptions end a capture is one predicate both seams read, so a page cannot cancel
-    // on a kind the device ignores. `dictation-capture.test.ts` drives the rule itself.
-    expect(nativeCaptureSource).toContain('bridgeAudioInterruptionEndsCapture(event.data)')
-  })
-})
diff --git a/mobile/src/host-edit-route-accessibility.test.ts b/mobile/src/host-edit-route-accessibility.test.ts
index d5fc20521a9..12d4ae230e1 100644
--- a/mobile/src/host-edit-route-accessibility.test.ts
+++ b/mobile/src/host-edit-route-accessibility.test.ts
@@ -5,7 +5,7 @@ import EditHostScreen from '../app/h/[hostId]/edit'
 
 const dependencies = vi.hoisted(() => ({
   back: vi.fn(),
-  forceReconnectHost: vi.fn(),
+  refreshHostClient: vi.fn(),
   loadHosts: vi.fn(),
   primeHosts: vi.fn(),
   updateHostNameAndEndpoint: vi.fn()
@@ -42,8 +42,8 @@ vi.mock('./transport/host-store', () => ({
 }))
 
 vi.mock('./transport/client-context', () => ({
-  useForceReconnect: () => dependencies.forceReconnectHost,
-  usePrimeHosts: () => dependencies.primeHosts
+  usePrimeHosts: () => dependencies.primeHosts,
+  useRefreshHostClient: () => dependencies.refreshHostClient
 }))
 
 async function renderEditHostRoute(): Promise<ReactTestRenderer> {
diff --git a/mobile/src/host-edit-save-flow.test.ts b/mobile/src/host-edit-save-flow.test.ts
index 835af6330f3..0c55da0cb0f 100644
--- a/mobile/src/host-edit-save-flow.test.ts
+++ b/mobile/src/host-edit-save-flow.test.ts
@@ -5,7 +5,7 @@ import EditHostScreen from '../app/h/[hostId]/edit'
 
 const dependencies = vi.hoisted(() => ({
   back: vi.fn(),
-  forceReconnectHost: vi.fn(),
+  refreshHostClient: vi.fn(),
   loadHosts: vi.fn(),
   primeHosts: vi.fn(),
   updateHostNameAndEndpoint: vi.fn(),
@@ -43,8 +43,8 @@ vi.mock('./transport/host-store', () => ({
 }))
 
 vi.mock('./transport/client-context', () => ({
-  useForceReconnect: () => dependencies.forceReconnectHost,
-  usePrimeHosts: () => dependencies.primeHosts
+  usePrimeHosts: () => dependencies.primeHosts,
+  useRefreshHostClient: () => dependencies.refreshHostClient
 }))
 
 const HOST_FIXTURE = {
@@ -120,7 +120,7 @@ describe('edit host handleSave', () => {
   beforeEach(() => {
     dependencies.hostId = 'host-1'
     dependencies.back.mockReset()
-    dependencies.forceReconnectHost.mockReset().mockResolvedValue(undefined)
+    dependencies.refreshHostClient.mockReset()
     dependencies.loadHosts.mockReset().mockResolvedValue([HOST_FIXTURE])
     dependencies.primeHosts.mockReset()
     dependencies.updateHostNameAndEndpoint.mockReset().mockResolvedValue(undefined)
@@ -143,7 +143,7 @@ describe('edit host handleSave', () => {
     expect(dependencies.updateHostNameAndEndpoint).toHaveBeenCalledWith('host-1', {
       personalName: 'Home Desk'
     })
-    expect(dependencies.forceReconnectHost).not.toHaveBeenCalled()
+    expect(dependencies.refreshHostClient).not.toHaveBeenCalled()
     expect(dependencies.back).toHaveBeenCalledTimes(1)
 
     act(() => renderer.unmount())
@@ -157,7 +157,7 @@ describe('edit host handleSave', () => {
     expect(dependencies.updateHostNameAndEndpoint).toHaveBeenCalledWith('host-1', {
       endpoint: 'ws://192.168.1.20:6768'
     })
-    expect(dependencies.forceReconnectHost).toHaveBeenCalledWith('host-1')
+    expect(dependencies.refreshHostClient).toHaveBeenCalledWith('host-1')
     expect(dependencies.back).toHaveBeenCalledTimes(1)
 
     act(() => renderer.unmount())
@@ -174,7 +174,7 @@ describe('edit host handleSave', () => {
       personalName: 'Home Desk',
       endpoint: 'ws://192.168.1.20:6768'
     })
-    expect(dependencies.forceReconnectHost).toHaveBeenCalledWith('host-1')
+    expect(dependencies.refreshHostClient).toHaveBeenCalledWith('host-1')
     expect(dependencies.back).toHaveBeenCalledTimes(1)
 
     act(() => renderer.unmount())
@@ -185,7 +185,7 @@ describe('edit host handleSave', () => {
     await pressSave(renderer)
 
     expect(dependencies.updateHostNameAndEndpoint).not.toHaveBeenCalled()
-    expect(dependencies.forceReconnectHost).not.toHaveBeenCalled()
+    expect(dependencies.refreshHostClient).not.toHaveBeenCalled()
     expect(dependencies.back).toHaveBeenCalledTimes(1)
 
     act(() => renderer.unmount())
@@ -198,7 +198,7 @@ describe('edit host handleSave', () => {
     await pressSave(renderer)
 
     expect(findText(renderer, 'Host not found')).toBe(true)
-    expect(dependencies.forceReconnectHost).not.toHaveBeenCalled()
+    expect(dependencies.refreshHostClient).not.toHaveBeenCalled()
     expect(dependencies.back).not.toHaveBeenCalled()
 
     act(() => renderer.unmount())
@@ -218,23 +218,6 @@ describe('edit host handleSave', () => {
     act(() => renderer.unmount())
   })
 
-  it('still navigates back and shows no error when the post-save reconnect rejects', async () => {
-    dependencies.forceReconnectHost.mockRejectedValueOnce(new Error('connect failed'))
-    const renderer = await renderEditHostRoute()
-    setFieldValue(renderer, 'Address', '192.168.1.20:6768')
-    await pressSave(renderer)
-    await act(async () => {
-      await Promise.resolve()
-      await Promise.resolve()
-    })
-
-    expect(dependencies.forceReconnectHost).toHaveBeenCalledWith('host-1')
-    expect(dependencies.back).toHaveBeenCalledTimes(1)
-    expect(findText(renderer, 'connect failed')).toBe(false)
-
-    act(() => renderer.unmount())
-  })
-
   it('ignores a second Save trigger while a save is already in flight', async () => {
     let resolveSave: () => void = () => {}
     dependencies.updateHostNameAndEndpoint.mockImplementationOnce(
@@ -269,7 +252,7 @@ describe('edit host load() error states', () => {
   beforeEach(() => {
     dependencies.hostId = 'host-1'
     dependencies.back.mockReset()
-    dependencies.forceReconnectHost.mockReset().mockResolvedValue(undefined)
+    dependencies.refreshHostClient.mockReset()
     dependencies.loadHosts.mockReset().mockResolvedValue([HOST_FIXTURE])
     dependencies.primeHosts.mockReset()
     dependencies.updateHostNameAndEndpoint.mockReset().mockResolvedValue(undefined)
diff --git a/mobile/src/host-screen/host-route-href-encoding.test.ts b/mobile/src/host-screen/host-route-href-encoding.test.ts
deleted file mode 100644
index c1ced2afe90..00000000000
--- a/mobile/src/host-screen/host-route-href-encoding.test.ts
+++ /dev/null
@@ -1,76 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-/**
- * Every host-route target the host page builds, and whether its host id survives being one segment.
- *
- * `useLocalSearchParams` and the persisted host store both answer the decoded id, and the store
- * admits any non-empty string, so an id carrying `/`, `?`, `#` or whitespace stops being the single
- * segment `matchesRoutePattern` reads it as the moment it is interpolated raw. Inside the shell's
- * page that decides where a tap goes: the handoff matches the pathname against the shell's
- * `pageRoutes` before it chooses between this document and the native stack.
- *
- * A census rather than six assertions, because the failure is a habit and not a bug: each of these
- * sites was written by copying the one next to it, and the seventh will be too.
- */
-const MOBILE_ROOT = join(import.meta.dirname, '..', '..')
-
-/** The files that build a target from the host list and its row sheet. */
-const HOST_PAGE_SOURCES = [
-  'src/host-screen/host-screen-header.tsx',
-  'src/host-screen/host-screen-overlays.tsx',
-  'src/host-screen/use-host-worktree-actions.ts',
-  'src/agent-history/worktree-navigation-actions.ts'
-]
-
-/**
- * The two `/h/${...}` reads that are not targets.
- *
- * Both compare against a pathname the router answers rather than building a link, so encoding them
- * would change what a comparison matches instead of what a tap opens. They are listed by the text
- * that makes them comparisons, so a line that stopped being one stops being exempt.
- */
-const COMPARISONS = ['pathname === `/h/${hostId}`']
-
-const HOST_SEGMENT = /`\/h\/\$\{([^}]*)\}/g
-
-function hostInterpolations(source: string): string[] {
-  return [...source.matchAll(HOST_SEGMENT)].map((match) => match[1] ?? '')
-}
-
-describe('every host-route target the host page builds', () => {
-  it('reaches the census, so the assertion below cannot pass on an empty list', () => {
-    const found = HOST_PAGE_SOURCES.flatMap((path) =>
-      hostInterpolations(readFileSync(join(MOBILE_ROOT, path), 'utf8'))
-    )
-    expect(found.length).toBeGreaterThanOrEqual(6)
-  })
-
-  it('encodes the host id, at every site', () => {
-    const raw: string[] = []
-    for (const path of HOST_PAGE_SOURCES) {
-      const source = readFileSync(join(MOBILE_ROOT, path), 'utf8')
-      const exempt = COMPARISONS.filter((text) => source.includes(text)).length
-      const unencoded = hostInterpolations(source).filter(
-        (expression) => !expression.includes('encodeURIComponent')
-      )
-      // The comparisons are subtracted rather than matched away, so a file that lost its comparison
-      // and gained a raw target does not come out even.
-      if (unencoded.length > exempt) {
-        raw.push(`${path}: ${unencoded.length - exempt} raw`)
-      }
-    }
-    expect(raw).toEqual([])
-  })
-
-  it('keeps the pathname comparisons out of the count for a stated reason, not by accident', () => {
-    const source = readFileSync(
-      join(MOBILE_ROOT, 'src/host-screen/use-host-worktree-actions.ts'),
-      'utf8'
-    )
-    // Present, so the exemption above is answering something real; and a comparison, so the
-    // exemption is not quietly covering a target.
-    expect(source).toContain(COMPARISONS[0])
-  })
-})
diff --git a/mobile/src/host-screen/host-screen-primary-styles.ts b/mobile/src/host-screen/host-screen-primary-styles.ts
index 1f13dd17b16..e262af906b5 100644
--- a/mobile/src/host-screen/host-screen-primary-styles.ts
+++ b/mobile/src/host-screen/host-screen-primary-styles.ts
@@ -39,7 +39,7 @@ export const hostScreenPrimaryStyles = StyleSheet.create({
     minWidth: 0,
     marginRight: spacing.md
   },
-  hostIdentityLine: { flexDirection: 'row', alignItems: 'center', minWidth: 0 },
+  hostIdentityLine: { flexDirection: 'row', alignItems: 'center', gap: spacing.sm, minWidth: 0 },
   hostPlatformText: {
     marginLeft: 16,
     color: colors.textSecondary,
diff --git a/mobile/src/mobile-web-shell/MobileWebShellScreen.test.tsx b/mobile/src/mobile-web-shell/MobileWebShellScreen.test.tsx
index b41c67a2d71..9366902a1c8 100644
--- a/mobile/src/mobile-web-shell/MobileWebShellScreen.test.tsx
+++ b/mobile/src/mobile-web-shell/MobileWebShellScreen.test.tsx
@@ -19,6 +19,7 @@ vi.mock('lucide-react-native', mocks['lucide-react-native'])
 vi.mock('react-native-safe-area-context', mocks['react-native-safe-area-context'])
 vi.mock('expo-router', mocks['expo-router'])
 vi.mock('../../modules/orca-mobile-web-shell/src', mocks['../../modules/orca-mobile-web-shell/src'])
+vi.mock('../app-update/use-wall-app-update', mocks['../app-update/use-wall-app-update'])
 vi.mock('../transport/client-context', mocks['../transport/client-context'])
 vi.mock('./use-page-host-snapshot', mocks['./use-page-host-snapshot'])
 vi.mock('./use-mobile-web-shell-session', mocks['./use-mobile-web-shell-session'])
@@ -28,7 +29,6 @@ import { act, create } from 'react-test-renderer'
 import { bridgeId, clientFrame, createFakeRpcClient } from './bridge-host-test-fakes'
 import {
   byName,
-  DEFAULT_ROUTE_GRANTS,
   trackRenderedScreen,
   NativeFallback,
   SCREEN_BUILD_ID as BUILD_ID,
@@ -39,14 +39,13 @@ import {
   textOf,
   updateScreen as reRenderScreen
 } from './mobile-web-shell-screen-test-harness'
-import { BRIDGE_BACK_CLAIM_NOTIFY, BRIDGE_BACK_FRAME } from './bridge/bridge-page-back'
+import { BRIDGE_BACK_CLAIM_NOTIFY } from './bridge/bridge-page-back'
 import { BRIDGE_PAGE_PAINTED } from './bridge/bridge-page-painted'
 import {
   BRIDGE_FAULT_GRANT,
   BRIDGE_NAVIGATE_BACK_NOTIFY,
   readBridgeHostMessage
 } from './bridge/bridge-envelope'
-import { BRIDGE_ROUTE_UPDATE_ACCEPT } from './bridge/bridge-route-update'
 import { MobileWebShellScreen } from './MobileWebShellScreen'
 import type { MobileWebShellSessionState } from './mobile-web-shell-session-contract'
 import type { ReactTestInstance, ReactTestRenderer } from 'react-test-renderer'
@@ -151,7 +150,6 @@ describe('the hybrid shell screen', () => {
     const tree = await renderScreen(readyState('session-one'))
     const view = byName(tree, 'ShellViewProbe')[0]
     expect(view.props.bridgeEnabled).toBe(true)
-    expect(typeof view.props.onBridgeMessage).toBe('function')
     // Delivered with no client behind it: there is no host to answer, and nothing throws.
     await act(async () => {
       view.props.onBridgeMessage({ nativeEvent: { json: '{"v":1,"type":"ready"}' } })
@@ -227,7 +225,7 @@ describe('the hybrid shell screen', () => {
     tree: ReactTestRenderer
     initRoutes: () => (Record<string, string> | undefined)[]
     move: (next: Record<string, string>) => Promise<void>
-    ready: (accepts?: readonly string[]) => Promise<void>
+    ready: () => Promise<void>
   }> {
     const element = (next: Record<string, string>) =>
       createElement(MobileWebShellScreen, {
@@ -259,10 +257,10 @@ describe('the hybrid shell screen', () => {
           tree.update(element(next))
         })
       },
-      ready: async (accepts = [BRIDGE_ROUTE_UPDATE_ACCEPT]) => {
+      ready: async () => {
         await act(async () => {
           byName(tree, 'ShellViewProbe')[0]?.props.onBridgeMessage({
-            nativeEvent: { json: clientFrame({ type: 'ready', accepts }) }
+            nativeEvent: { json: clientFrame({ type: 'ready' }) }
           })
         })
       }
@@ -302,18 +300,6 @@ describe('the hybrid shell screen', () => {
     warned.mockRestore()
   })
 
-  it('sends no second init to a page that never said it takes one', async () => {
-    dependencies.client = createFakeRpcClient()
-    const page = await renderForRoute({ paneKey: '' })
-    // A page built before route updates existed declares nothing, and reads a second `init` as a
-    // replacement: the route still moves, so its next `ready` is answered with the new one.
-    await page.ready([])
-    await page.move({ paneKey: 'pane-1' })
-    expect(page.initRoutes()).toEqual([{ paneKey: '' }])
-    await page.ready([])
-    expect(page.initRoutes()).toEqual([{ paneKey: '' }, { paneKey: 'pane-1' }])
-  })
-
   it('ends that wait on the page asking for a session', async () => {
     dependencies.client = createFakeRpcClient()
     const tree = await renderScreen(readyState('session-one'))
@@ -434,7 +420,7 @@ describe('the hybrid shell screen', () => {
     const tree = await renderScreen(readyState('session-one'))
     await act(async () => {
       byName(tree, 'ShellViewProbe')[0].props.onBridgeMessage({
-        nativeEvent: { json: clientFrame({ type: 'ready', accepts: [BRIDGE_BACK_FRAME] }) }
+        nativeEvent: { json: clientFrame({ type: 'ready' }) }
       })
       byName(tree, 'ShellViewProbe')[0].props.onBridgeMessage({
         nativeEvent: {
@@ -647,41 +633,6 @@ describe('a refused update is said beside the page, not in front of it', () => {
   })
 })
 
-/**
- * Last in the file on purpose: it is the case the block above would have poisoned.
- *
- * Those cases grant the screencast lane and install a client, and before the shared setup reset
- * them both, whatever ran next inherited a route granted a lane it never asked for. Deleting the
- * reset fails here and nowhere else, because nothing else runs after a case that mutates them.
- */
-describe('what one case mutates does not reach the next', () => {
-  it('starts from the shared route grants and no client', () => {
-    expect({ grants: dependencies.routeGrants, client: dependencies.client }).toEqual({
-      grants: DEFAULT_ROUTE_GRANTS,
-      client: null
-    })
-  })
-
-  it('keeps both bar strips off the view for a page that does not pad for them', async () => {
-    // A page served from an older desktop has no reader for the insets, so the shell reserves
-    // the strips itself. Edge-to-edge makes the manifest's `adjustResize` inert, so the keyboard
-    // strip comes off the view too: the page's `visualViewport` reads full height with the IME up.
-    const tree = await renderScreen(readyState('session-keyboard'))
-    const root = tree.root.find((node) => node.props.testID === 'mobile-web-shell-ready')
-    expect(root.props.style[1]).toEqual({ paddingTop: 44, paddingBottom: 8 })
-
-    await act(async () => {
-      dependencies.keyboardListeners.get('keyboardWillShow')?.({ endCoordinates: { height: 336 } })
-    })
-    expect(root.props.style[1]).toEqual({ paddingTop: 44, paddingBottom: 336 })
-
-    await act(async () => {
-      dependencies.keyboardListeners.get('keyboardWillHide')?.({ endCoordinates: { height: 0 } })
-    })
-    expect(root.props.style[1]).toEqual({ paddingTop: 44, paddingBottom: 8 })
-  })
-})
-
 /**
  * What is on screen between the generation being mounted and the page having a frame.
  *
@@ -718,17 +669,17 @@ describe('the frame under a page that has not painted', () => {
     expect(tree.root.findAll((node) => node.props.testID === 'mobile-web-shell-cover')).toEqual([])
   })
 
-  it('covers the same box the view gets, which is what the keyboard strip shortens', async () => {
+  it('covers the same box the view gets, which the keyboard does not shorten', async () => {
     // Both are children of the padded root: the view is `flex: 1` and the cover is an absolute
-    // fill, so Yoga lays each of them out against the same content box. The keyboard takes its
-    // strip off that box, so it takes it off both, and the cover cannot leave a gap the view fills.
+    // fill, so Yoga lays each of them out against the same content box, and the cover cannot leave
+    // a gap the view fills. The keyboard covers that box rather than taking a strip off it.
     dependencies.pageFrame = 'unpainted'
     const tree = await renderScreen(readyState('session-keyboard-cover'))
     const root = tree.root.find((node) => node.props.testID === 'mobile-web-shell-ready')
     await act(async () => {
       dependencies.keyboardListeners.get('keyboardWillShow')?.({ endCoordinates: { height: 336 } })
     })
-    expect(root.props.style[1]).toEqual({ paddingTop: 44, paddingBottom: 336 })
+    expect(root.props.style[1]).toEqual({ paddingTop: 0 })
     const cover = tree.root.find((node) => node.props.testID === 'mobile-web-shell-cover')
     expect(cover.props.style[0]).toMatchObject({
       position: 'absolute',
@@ -750,13 +701,10 @@ describe('the frame under a page that has not painted', () => {
     const probe = byName(tree, 'ShellViewProbe')[0]
     await act(async () => {
       probe.props.onBridgeMessage({
-        nativeEvent: { json: clientFrame({ type: 'ready', reports: [BRIDGE_PAGE_PAINTED] }) }
+        nativeEvent: { json: clientFrame({ type: 'ready' }) }
       })
     })
-    expect(dependencies.reportPageReady).toHaveBeenCalledWith({
-      reports: [BRIDGE_PAGE_PAINTED],
-      accepts: []
-    })
+    expect(dependencies.reportPageReady).toHaveBeenCalledTimes(1)
     await act(async () => {
       probe.props.onBridgeMessage({
         nativeEvent: { json: clientFrame({ type: 'notify', name: BRIDGE_PAGE_PAINTED }) }
diff --git a/mobile/src/mobile-web-shell/MobileWebShellScreen.tsx b/mobile/src/mobile-web-shell/MobileWebShellScreen.tsx
index 83d6d172499..88cedd9fd6d 100644
--- a/mobile/src/mobile-web-shell/MobileWebShellScreen.tsx
+++ b/mobile/src/mobile-web-shell/MobileWebShellScreen.tsx
@@ -1,13 +1,5 @@
 import { useEffect, useState, type ReactNode } from 'react'
-import {
-  ActivityIndicator,
-  Linking,
-  Platform,
-  Pressable,
-  StyleSheet,
-  Text,
-  View
-} from 'react-native'
+import { ActivityIndicator, Linking, Pressable, StyleSheet, Text, View } from 'react-native'
 import { useNavigation, useRouter } from 'expo-router'
 import { useSafeAreaInsets } from 'react-native-safe-area-context'
 import {
@@ -34,7 +26,6 @@ import { playPageHaptic } from './page-haptics'
 import { useMobileWebShellBridge } from './use-mobile-web-shell-bridge'
 import type { MobileWebShellRuntime } from './mobile-web-shell-runtime'
 import { useKeyboardOcclusion } from '../platform/keyboard-occlusion'
-import { softwareKeyboardWindowInset } from '../platform/software-keyboard-window-inset'
 import { useNativeDeviceVerbs } from '../platform/use-native-device-verbs'
 import { useShellPageBack } from './use-shell-page-back'
 import { useShellStackPop } from './use-shell-stack-pop'
@@ -178,16 +169,6 @@ export function MobileWebShellScreen({
   runtime
 }: MobileWebShellScreenProps) {
   const insets = useSafeAreaInsets()
-  // The page cannot see the IME for itself: edge-to-edge makes the manifest's `adjustResize` inert,
-  // so the window never shrinks and `visualViewport` inside the WebView reads full height with the
-  // keyboard up — the session route lays its live input row out under the keys. The shell owns the
-  // window, so it takes the strip off the view and the page lays out in what is left.
-  const keyboardHeight = useKeyboardOcclusion()
-  const keyboardInset = softwareKeyboardWindowInset({
-    keyboardHeight,
-    bottomInset: insets.bottom,
-    platform: Platform.OS
-  })
   const router = useRouter()
   const navigation = useNavigation()
   const popShellStack = useShellStackPop()
@@ -207,19 +188,18 @@ export function MobileWebShellScreen({
     reportPageBackClaim,
     pageReady,
     pageFrame,
-    backClaimed,
-    pageOwnsSafeArea
+    backClaimed
   } = useMobileWebShellSession({ hostId, routePathname: route.pathname, runtime })
   // Which mount the notice was dismissed on, not whether it was: a later refusal opens its own
   // generation under a new session id, so it is not silenced by a tap on the one before it.
   const [noticeDismissedFor, setNoticeDismissedFor] = useState<string | null>(null)
   const noticeShown =
     updateNotice !== null && state.kind === 'ready' && noticeDismissedFor !== state.sessionId
-  const pageInsets = pageSafeAreaInsets({
-    insets,
-    keyboardInset,
-    topCovered: noticeShown
-  })
+  // The page cannot see the IME for itself: edge-to-edge makes `adjustResize` inert and the view's
+  // IME insets are zeroed, so `visualViewport` never shrinks. The keyboard covers the view like a
+  // native screen, and the page lifts by the height native screens read.
+  const keyboardInset = Math.max(0, useKeyboardOcclusion())
+  const pageInsets = pageSafeAreaInsets({ insets, topCovered: noticeShown })
   const { snapshot, unreadable, readStorage, refreshStorage, writeStorage } = usePageHostSnapshot(
     hostId,
     route.pathname
@@ -242,6 +222,7 @@ export function MobileWebShellScreen({
     hostId,
     route,
     safeAreaInsets: pageInsets,
+    keyboardInset,
     pageRoutes,
     pageRouteGrants,
     routeGrants,
@@ -264,12 +245,12 @@ export function MobileWebShellScreen({
     // the map as they are made. This re-seats that map on the store afterwards, for the key whose
     // write never persisted, and it runs on every ask because a document that reloads inside this
     // mount asks again.
-    onPageReady: (ready) => {
-      reportPageReady(ready)
+    onPageReady: () => {
+      reportPageReady()
       void refreshStorage()
     },
     // The one thing that says the page is something to look at. The cover below stays up until it
-    // lands, for a page that declared it would send one.
+    // lands.
     onPagePainted: reportPagePainted,
     // While this is true the key below belongs to the page, not to the stack this screen sits on.
     onPageBackClaim: reportPageBackClaim,
@@ -323,6 +304,11 @@ export function MobileWebShellScreen({
   }, [publishRoute, route])
 
   usePublishedSafeAreaInsets(bridge.publishSafeAreaInsets, pageInsets)
+  // Every keyboard event, a height change while open included, so the page never holds a stale one.
+  const publishKeyboardInset = bridge.publishKeyboardInset
+  useEffect(() => {
+    publishKeyboardInset(keyboardInset)
+  }, [publishKeyboardInset, keyboardInset])
 
   // The navigation object rather than the router: what this takes away is this screen's own place
   // on the stack, which is a screen option, and the router has no member that says it.
@@ -372,12 +358,9 @@ export function MobileWebShellScreen({
     <View
       style={[
         styles.shellRoot,
-        // Edge-to-edge like a native screen, for a page that pads for the bars itself; an older page
-        // keeps the strips. The keyboard strip stays off either way, since the page cannot see it,
-        // and the banner takes the status bar strip when it shows.
-        pageOwnsSafeArea
-          ? { paddingTop: noticeShown ? insets.top : 0, paddingBottom: keyboardInset }
-          : { paddingTop: insets.top, paddingBottom: Math.max(insets.bottom, keyboardInset) }
+        // Edge-to-edge like a native screen: the page pads for the bars itself from the insets
+        // `init` carries. The banner takes the status bar strip when it shows.
+        { paddingTop: noticeShown ? insets.top : 0 }
       ]}
       testID="mobile-web-shell-ready"
     >
diff --git a/mobile/src/mobile-web-shell/bridge-host-back.test.ts b/mobile/src/mobile-web-shell/bridge-host-back.test.ts
index 7010e85ea8b..d368c74d524 100644
--- a/mobile/src/mobile-web-shell/bridge-host-back.test.ts
+++ b/mobile/src/mobile-web-shell/bridge-host-back.test.ts
@@ -3,8 +3,8 @@ import { clientFrame } from './bridge-host-test-fakes'
 import { harness } from './bridge-host-test-harness'
 import { BRIDGE_BACK_CLAIM_NOTIFY, BRIDGE_BACK_FRAME } from './bridge/bridge-page-back'
 
-function ready(accepts?: readonly string[]): string {
-  return clientFrame(accepts === undefined ? { type: 'ready' } : { type: 'ready', accepts })
+function ready(): string {
+  return clientFrame({ type: 'ready' })
 }
 
 function claim(claimed: boolean): string {
@@ -21,7 +21,7 @@ function claim(claimed: boolean): string {
 describe('the claim a host holds on the device Back key', () => {
   it('carries the page taking the key and letting it go, and says neither twice', () => {
     const bridge = harness()
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     bridge.host.receive(claim(true))
     bridge.host.receive(claim(true))
     bridge.host.receive(claim(false))
@@ -30,15 +30,15 @@ describe('the claim a host holds on the device Back key', () => {
 
   it('drops it on the next document saying ready, which is the one that has to claim again', () => {
     const bridge = harness()
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     bridge.host.receive(claim(true))
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     expect(bridge.backClaims).toEqual([true, false])
   })
 
   it('drops it when the page closes, which is the document saying it is going', () => {
     const bridge = harness()
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     bridge.host.receive(claim(true))
     bridge.host.receive(clientFrame({ type: 'close' }))
     expect(bridge.backClaims).toEqual([true, false])
@@ -53,7 +53,7 @@ describe('the claim a host holds on the device Back key', () => {
    */
   it('reports nothing when the host itself ends: the claim belongs to the session', () => {
     const bridge = harness()
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     bridge.host.receive(claim(true))
     bridge.host.dispose()
     expect(bridge.backClaims).toEqual([true])
@@ -61,35 +61,35 @@ describe('the claim a host holds on the device Back key', () => {
 
   it('hands what the session established to the host that takes over from it', () => {
     const bridge = harness()
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     bridge.host.receive(claim(true))
     bridge.host.dispose()
-    expect(bridge.host.readSessionBack()).toEqual({ accepts: [BRIDGE_BACK_FRAME], claimed: true })
+    expect(bridge.host.readSessionBack()).toEqual({ claimed: true })
   })
 
   it('takes that seed without announcing a claim the screen never heard go', () => {
     const rebuilt = harness({
-      sessionBack: { accepts: [BRIDGE_BACK_FRAME], claimed: true },
+      sessionBack: { claimed: true },
       sessionEstablished: true
     })
     expect(rebuilt.backClaims).toEqual([])
-    // And it delivers on it: the page said it takes a press, over a session that is still open.
+    // And it delivers on it, over a session that is still open.
     expect(rebuilt.host.sendBack()).toBe(true)
     expect(rebuilt.last()).toEqual({ v: 1, type: BRIDGE_BACK_FRAME })
   })
 
   it('lets the next document reset a carried claim, so the seed is not a latch', () => {
     const rebuilt = harness({
-      sessionBack: { accepts: [BRIDGE_BACK_FRAME], claimed: true },
+      sessionBack: { claimed: true },
       sessionEstablished: true
     })
-    rebuilt.host.receive(ready([BRIDGE_BACK_FRAME]))
+    rebuilt.host.receive(ready())
     expect(rebuilt.backClaims).toEqual([false])
   })
 
   it('says nothing on a document that never claimed, so a drop is always a real one', () => {
     const bridge = harness()
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     bridge.host.receive(clientFrame({ type: 'close' }))
     bridge.host.dispose()
     expect(bridge.backClaims).toEqual([])
@@ -110,7 +110,7 @@ describe('the claim a host holds on the device Back key', () => {
 describe('handing one press to the page', () => {
   it('posts a back frame to a page that said it takes one', () => {
     const bridge = harness()
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     expect(bridge.host.sendBack()).toBe(true)
     expect(bridge.last()).toEqual({ v: 1, type: BRIDGE_BACK_FRAME })
   })
@@ -120,24 +120,16 @@ describe('handing one press to the page', () => {
    * one as `unrecognised-message` and drops the whole thing, so the shell must not send it. False
    * is what leaves the press to the navigator, which is what Back did before this lane.
    */
-  it('sends nothing to a page that never declared it, and says so to the caller', () => {
-    const bridge = harness()
-    bridge.host.receive(ready())
-    const before = bridge.posted.length
-    expect(bridge.host.sendBack()).toBe(false)
-    expect(bridge.posted).toHaveLength(before)
-  })
-
   it('sends nothing between documents, when the view belongs to no page', () => {
     const bridge = harness()
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     bridge.host.receive(clientFrame({ type: 'close' }))
     expect(bridge.host.sendBack()).toBe(false)
   })
 
   it('sends nothing once the host is disposed', () => {
     const bridge = harness()
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     bridge.host.dispose()
     expect(bridge.host.sendBack()).toBe(false)
   })
diff --git a/mobile/src/mobile-web-shell/bridge-host-back.ts b/mobile/src/mobile-web-shell/bridge-host-back.ts
index b9cbe108e55..a835be0e354 100644
--- a/mobile/src/mobile-web-shell/bridge-host-back.ts
+++ b/mobile/src/mobile-web-shell/bridge-host-back.ts
@@ -2,8 +2,7 @@ import { BRIDGE_PROTOCOL_VERSION, type BridgeHostMessage } from './bridge/bridge
 import { BRIDGE_BACK_FRAME } from './bridge/bridge-page-back'
 
 /**
- * What one session has established about the device Back key: what its page declared it takes, and
- * whether it is holding the key right now.
+ * What one session has established about the device Back key: whether its page is holding it.
  *
  * Carried across a host rebuild rather than relearned, the way `sessionEstablished` already is. A
  * client swapped under a live page is not a new document — the WebView stays mounted and the page
@@ -11,8 +10,6 @@ import { BRIDGE_BACK_FRAME } from './bridge/bridge-page-back'
  * under an open sheet.
  */
 export type BridgeSessionBack = {
-  /** What the page's last `ready` said it takes. Empty for a page too old to name the frame. */
-  readonly accepts: readonly string[]
   readonly claimed: boolean
 }
 
@@ -29,14 +26,12 @@ export type BridgeSessionBack = {
  * whoever builds the replacement, and reports nothing, because the claim belongs to the session.
  */
 export type BridgeHostBack = {
-  /** A document has spoken: it takes what it named, and claims nothing until it says otherwise. */
-  readonly readReady: (accepts: readonly string[]) => void
+  /** A document has spoken: it claims nothing until it says otherwise. */
+  readonly readReady: () => void
   /** The page holding Back, or letting it go. */
   readonly readClaim: (claimed: boolean) => void
-  /**
-   * Posts one press. False when this page never said it takes one — every page older than the
-   * frame — and the caller then leaves Back to the navigator, which is what it did before this.
-   */
+  /** Posts one press. False when no document can take it, and the caller leaves Back to the
+   *  navigator. */
   readonly send: () => boolean
   /** The document is gone; whatever it claimed goes with it. */
   readonly drop: () => void
@@ -53,7 +48,6 @@ export function createBridgeHostBack(args: {
    *  a host opening a session of its own, which has established nothing yet. */
   established?: BridgeSessionBack
 }): BridgeHostBack {
-  let accepts: readonly string[] = args.established?.accepts ?? []
   // Seeded without a report: the screen never heard this claim go, because it did not.
   let claimed = args.established?.claimed ?? false
 
@@ -66,10 +60,7 @@ export function createBridgeHostBack(args: {
   }
 
   return {
-    readReady: (next) => {
-      accepts = next
-      drop()
-    },
+    readReady: drop,
     readClaim: (next) => {
       if (next === claimed) {
         return
@@ -78,13 +69,13 @@ export function createBridgeHostBack(args: {
       args.onClaim(next)
     },
     send: () => {
-      if (!accepts.includes(BRIDGE_BACK_FRAME) || !args.deliverable()) {
+      if (!args.deliverable()) {
         return false
       }
       args.send({ v: BRIDGE_PROTOCOL_VERSION, type: BRIDGE_BACK_FRAME })
       return true
     },
     drop,
-    read: () => ({ accepts, claimed })
+    read: () => ({ claimed })
   }
 }
diff --git a/mobile/src/mobile-web-shell/bridge-host-contract.ts b/mobile/src/mobile-web-shell/bridge-host-contract.ts
index f360fdc0d96..a9f9dfcb10b 100644
--- a/mobile/src/mobile-web-shell/bridge-host-contract.ts
+++ b/mobile/src/mobile-web-shell/bridge-host-contract.ts
@@ -5,7 +5,6 @@ import type { BridgeRefusal } from './bridge/bridge-caps'
 import type { BridgeInitHost, BridgeInitRoute } from './bridge/bridge-envelope'
 import type { BridgeClearableRouteParam } from './bridge/bridge-route-update'
 import type { BridgeSafeAreaInsets } from './bridge/bridge-safe-area-insets'
-import type { PageReadyDeclaration } from './mobile-web-shell-session-contract'
 import type { BridgeHapticsKind } from './bridge/bridge-haptics-notify'
 import type { BridgeErrorCapture } from './bridge/bridge-error-capture'
 import type { BridgeNativeVerb } from './bridge/bridge-native-verbs'
@@ -133,6 +132,9 @@ export type BridgeHostOptions = {
   /** How much of the WebView sits under a system bar when it is drawn edge-to-edge. Zeros when
    *  absent; moved later with `publishSafeAreaInsets`. */
   safeAreaInsets?: BridgeSafeAreaInsets
+  /** The keyboard height native screens read on the shell's OS. 0 when absent; moved later with
+   *  `publishKeyboardInset`. */
+  keyboardInset?: number
   /**
    * This device's identity to that host, as the native screens already send it, swapped in for the
    * page's placeholder on the way out. Read at forward time rather than captured: the host outlives
@@ -202,12 +204,8 @@ export type BridgeHostOptions = {
    * the same reason as the fault: the shell bounds the wait for it, and a host built without this
    * would leave a document that never spoke looking exactly like one still starting up.
    */
-  onPageReady: (ready: PageReadyDeclaration) => void
-  /**
-   * The page has a frame on screen. Only pages whose `ready` listed `BRIDGE_PAGE_PAINTED` post it,
-   * which is why `onPageReady` carries that list: a caller covering the view until this arrives
-   * has to know whether it is coming, and a page served from an older desktop never sends one.
-   */
+  onPageReady: () => void
+  /** The page has a frame on screen, which a caller covering the view until then waits for. */
   onPagePainted: () => void
   /**
    * The page is holding the device Back key, or has let it go. Required, because the shell only
diff --git a/mobile/src/mobile-web-shell/bridge-host-init.test.ts b/mobile/src/mobile-web-shell/bridge-host-init.test.ts
index 6e2f86788f2..0b0b52687fc 100644
--- a/mobile/src/mobile-web-shell/bridge-host-init.test.ts
+++ b/mobile/src/mobile-web-shell/bridge-host-init.test.ts
@@ -7,10 +7,6 @@ import {
   BRIDGE_MAX_SUBSCRIPTIONS
 } from './bridge/bridge-caps'
 import { BRIDGE_FAULT_GRANT } from './bridge/bridge-envelope'
-import { BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT } from './bridge/bridge-page-client-identity'
-import { BRIDGE_BACK_CLAIM_NOTIFY } from './bridge/bridge-page-back'
-import { BRIDGE_PAGE_PAINTED } from './bridge/bridge-page-painted'
-import { BRIDGE_ROUTE_PARAM_CLEAR } from './bridge/bridge-route-update'
 import { routeViewOf } from './page-route-policy'
 
 describe('init and state', () => {
@@ -29,13 +25,6 @@ describe('init and state', () => {
       type: 'init',
       sessionId: 'session-a',
       buildId: 'build-a',
-      // What this shell takes from the page, which is the page's own check before it posts one.
-      accepts: [
-        BRIDGE_ROUTE_PARAM_CLEAR,
-        BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT,
-        BRIDGE_PAGE_PAINTED,
-        BRIDGE_BACK_CLAIM_NOTIFY
-      ],
       connection: {
         state: 'reconnecting',
         reconnectAttempt: 3,
@@ -265,7 +254,7 @@ describe('init and state', () => {
       route: { pathname: '/h/host-a/session/wt-1' },
       post: () => (view.gone ? Promise.reject(new Error('the view is gone')) : Promise.resolve())
     })
-    // A page that declares nothing is never sent a second `init`, so the tap can only be held.
+    // The second `init` the tap sends is refused with the view, so only the held route is left.
     bridge.host.receive(clientFrame({ type: 'ready' }))
     bridge.host.publishRoute({
       pathname: '/h/host-a/session/wt-1',
@@ -274,7 +263,7 @@ describe('init and state', () => {
     for (let turn = 0; turn < 4; turn += 1) {
       await Promise.resolve()
     }
-    expect(bridge.posted).toHaveLength(1)
+    expect(bridge.posted).toHaveLength(2)
     // The next document over the same host: a reload, or the view coming back.
     view.gone = false
     bridge.host.receive(clientFrame({ type: 'ready' }))
diff --git a/mobile/src/mobile-web-shell/bridge-host-notifications.test.ts b/mobile/src/mobile-web-shell/bridge-host-notifications.test.ts
index dc9436074e8..1e7b7904a10 100644
--- a/mobile/src/mobile-web-shell/bridge-host-notifications.test.ts
+++ b/mobile/src/mobile-web-shell/bridge-host-notifications.test.ts
@@ -6,8 +6,6 @@ import {
   BRIDGE_FAULT_GRANT,
   BRIDGE_NAVIGATE_BACK_NOTIFY
 } from './bridge/bridge-envelope'
-import { BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT } from './bridge/bridge-page-client-identity'
-import { BRIDGE_BACK_CLAIM_NOTIFY } from './bridge/bridge-page-back'
 import { BRIDGE_PAGE_PAINTED } from './bridge/bridge-page-painted'
 import { BRIDGE_ROUTE_PARAM_CLEAR } from './bridge/bridge-route-update'
 import {
@@ -462,20 +460,6 @@ describe('the page erasing a one-shot route param', () => {
     expect(bridge.routeParamClears()).toEqual([])
     expect(bridge.diagnostics).toEqual([{ kind: 'refused', refusal: 'unrecognised-message' }])
   })
-
-  it('tells the page it takes a clear, so a page built for an older shell does not post one', () => {
-    const bridge = harness({ route: { pathname: '/h/host-a/session/wt-1' } })
-    bridge.host.receive(clientFrame({ type: 'ready' }))
-    const init = bridge.last()
-    // Written out rather than compared against `BRIDGE_SHELL_ACCEPTS`: a list that pins itself
-    // pins nothing, and this is the frame an older page reads to decide what it may post.
-    expect(init.type === 'init' && init.accepts).toEqual([
-      BRIDGE_ROUTE_PARAM_CLEAR,
-      BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT,
-      BRIDGE_PAGE_PAINTED,
-      BRIDGE_BACK_CLAIM_NOTIFY
-    ])
-  })
 })
 
 /**
@@ -485,20 +469,13 @@ describe('the page erasing a one-shot route param', () => {
 describe('the page reporting its first frame', () => {
   it('hands the report to the session and asks the client for nothing', () => {
     const bridge = harness()
-    bridge.host.receive(clientFrame({ type: 'ready', reports: [BRIDGE_PAGE_PAINTED] }))
+    bridge.host.receive(clientFrame({ type: 'ready' }))
     bridge.host.receive(clientFrame({ type: 'notify', name: BRIDGE_PAGE_PAINTED }))
     expect(bridge.pagePaintCount()).toBe(1)
     expect(bridge.client.requests).toHaveLength(0)
     expect(bridge.client.foregroundCalls).toHaveLength(0)
   })
 
-  it('forwards what each ready declared, including a name this shell does not implement', () => {
-    const bridge = harness()
-    bridge.host.receive(clientFrame({ type: 'ready', reports: [BRIDGE_PAGE_PAINTED, 'weather'] }))
-    bridge.host.receive(clientFrame({ type: 'ready' }))
-    expect(bridge.pageReports()).toEqual([[BRIDGE_PAGE_PAINTED, 'weather'], []])
-  })
-
   it('refuses a report from a document nothing has answered', () => {
     const bridge = harness()
     bridge.host.receive(clientFrame({ type: 'notify', name: BRIDGE_PAGE_PAINTED }))
diff --git a/mobile/src/mobile-web-shell/bridge-host-route.ts b/mobile/src/mobile-web-shell/bridge-host-route.ts
index 055932a5ffe..1306ea276a2 100644
--- a/mobile/src/mobile-web-shell/bridge-host-route.ts
+++ b/mobile/src/mobile-web-shell/bridge-host-route.ts
@@ -1,11 +1,6 @@
-import {
-  BridgeInitRouteSchema,
-  type BridgeClientMessage,
-  type BridgeInitRoute
-} from './bridge/bridge-envelope'
+import { BridgeInitRouteSchema, type BridgeInitRoute } from './bridge/bridge-envelope'
 import { readBridgeRouteUpdate } from './bridge/bridge-route-update'
 import {
-  BRIDGE_SAFE_AREA_ACCEPT,
   sameSafeAreaInsets,
   ZERO_SAFE_AREA_INSETS,
   type BridgeSafeAreaInsets
@@ -17,13 +12,10 @@ export type BridgeHostRoute = {
   readonly current: () => BridgeInitRoute | null
   /** Why the opened route was refused, for the line the host prints at construction. */
   readonly openIssue: () => string
-  /** What the page's latest `ready` said it can be sent. Reset by each document's `ready`. */
-  readonly readReady: (message: Extract<BridgeClientMessage, { type: 'ready' }>) => void
   /**
    * Hands the page a rewritten param for the screen it is already on, and sends one `init` when
    * that moved the route. The held route moves either way, so a page that reloads inside this
-   * mount is given the newest one on its next `ready` even when it is too old to be sent one in
-   * flight.
+   * mount is given the newest one on its next `ready`.
    *
    * Answers nothing, and nothing here learns anything from a post (ruling 34). It cannot: a frame
    * the page received and then failed to handle is caught by the page and reported there, so what
@@ -36,10 +28,14 @@ export type BridgeHostRoute = {
   /** The insets the next `init` carries. */
   readonly safeAreaInsets: () => BridgeSafeAreaInsets
   /**
-   * Moves the held insets, and sends one `init` when they moved and the page reads them. The same
-   * lane as a pane update: held either way, so the next `ready` carries them.
+   * Moves the held insets, and sends one `init` when they moved. The same lane as a pane update:
+   * held either way, so the next `ready` carries them.
    */
   readonly publishSafeAreaInsets: (next: BridgeSafeAreaInsets, deliverable: boolean) => void
+  /** The keyboard height the next `init` carries. */
+  readonly keyboardInset: () => number
+  /** Moves the held keyboard height on the same lane as the insets. */
+  readonly publishKeyboardInset: (next: number, deliverable: boolean) => void
 }
 
 /**
@@ -65,19 +61,17 @@ export function createBridgeHostRoute(args: {
   sendInit: () => void
   onRefused: (issue: string) => void
   safeAreaInsets?: BridgeSafeAreaInsets
+  keyboardInset?: number
 }): BridgeHostRoute {
   const parsed = BridgeInitRouteSchema.safeParse(args.opened)
   let route = parsed.success && !args.refused ? parsed.data : null
-  let accepts: readonly string[] = []
   let insets = args.safeAreaInsets ?? ZERO_SAFE_AREA_INSETS
+  let keyboard = args.keyboardInset ?? 0
   return {
     current: () => route,
     openIssue: () => (parsed.success ? 'unknown' : (parsed.error.issues[0]?.message ?? 'unknown')),
-    readReady: (message) => {
-      accepts = message.accepts ?? []
-    },
     publish: (next, deliverable) => {
-      const update = readBridgeRouteUpdate({ held: route, next, accepts, deliverable })
+      const update = readBridgeRouteUpdate({ held: route, next, deliverable })
       if (update.kind === 'refuse') {
         args.onRefused(update.issue)
         return
@@ -93,8 +87,17 @@ export function createBridgeHostRoute(args: {
         return
       }
       insets = next
-      // Only to a page that reads them: a re-init to one that does not is a wasted frame per move.
-      if (deliverable && accepts.includes(BRIDGE_SAFE_AREA_ACCEPT)) {
+      if (deliverable) {
+        args.sendInit()
+      }
+    },
+    keyboardInset: () => keyboard,
+    publishKeyboardInset: (next, deliverable) => {
+      if (keyboard === next) {
+        return
+      }
+      keyboard = next
+      if (deliverable) {
         args.sendInit()
       }
     }
diff --git a/mobile/src/mobile-web-shell/bridge-host-test-harness.ts b/mobile/src/mobile-web-shell/bridge-host-test-harness.ts
index 835698e24ac..5c3d602a4ed 100644
--- a/mobile/src/mobile-web-shell/bridge-host-test-harness.ts
+++ b/mobile/src/mobile-web-shell/bridge-host-test-harness.ts
@@ -50,7 +50,6 @@ export type Harness = {
   /** Every claim the host reported, in order, including the false it sends when a document ends. */
   backClaims: boolean[]
   /** What each answered `ready` declared it reports, in order. */
-  pageReports: () => readonly (readonly string[])[]
   /** One entry per `ready` answered, saying whether its `init` reached the page. Filled as each
    *  post settles, so a case reads it after awaiting the turn the post resolves on. */
   /** Every clear the page asked for, in order. */
@@ -120,7 +119,6 @@ export function harness(
   let pageReadies = 0
   let pagePaints = 0
   /** What each answered `ready` declared it reports, in order. */
-  const pageReports: (readonly string[])[] = []
   /** One entry per `ready` answered, saying whether an `init` actually went out for it. */
   const routeParamClears: { param: string; value: string }[] = []
   const routeRefusals: string[] = []
@@ -146,9 +144,8 @@ export function harness(
     readStorage:
       options.readStorage ?? (() => ({ storage: options.storage ?? {}, storageOversize: [] })),
     onStorageWrite: (key, value) => storageWrites.push({ key, value }),
-    onPageReady: ({ reports }) => {
+    onPageReady: () => {
       pageReadies += 1
-      pageReports.push(reports)
     },
     onPageBackClaim: (claimed) => backClaims.push(claimed),
     onPagePainted: () => {
@@ -212,7 +209,6 @@ export function harness(
     pageReadyCount: () => pageReadies,
     pagePaintCount: () => pagePaints,
     backClaims,
-    pageReports: () => pageReports,
     routeParamClears: () => routeParamClears,
     routeRefusals,
     pageFaults,
diff --git a/mobile/src/mobile-web-shell/bridge-host.ts b/mobile/src/mobile-web-shell/bridge-host.ts
index 28e25c2e452..9431b4500db 100644
--- a/mobile/src/mobile-web-shell/bridge-host.ts
+++ b/mobile/src/mobile-web-shell/bridge-host.ts
@@ -13,7 +13,7 @@ import {
   type BridgeInitRoute
 } from './bridge/bridge-envelope'
 import { BridgePageRouteGrantsSchema } from './bridge/bridge-page-route-grants'
-import { BRIDGE_SHELL_ACCEPTS, createBridgeInitFrame } from './bridge/bridge-init-frame'
+import { createBridgeInitFrame } from './bridge/bridge-init-frame'
 import { splitBridgeReply } from './bridge/bridge-reply-chunking'
 import { createBridgeHostFrames } from './bridge-host-frames'
 import { createBridgeHostBack, type BridgeSessionBack } from './bridge-host-back'
@@ -31,9 +31,8 @@ export type BridgeHost = {
    * Hands this session a rewritten route: same screen, different params (ruling 33.1).
    *
    * The held route moves either way, so a page that reloads inside this mount is told the newest
-   * one; the frame goes out only to a page that declared `BRIDGE_ROUTE_UPDATE_ACCEPT`, because a
-   * page too old to name it reads a second `init` as a replacement. A different pathname is a
-   * different screen and is refused here — that is a remount, which is what the shell already does.
+   * one. A different pathname is a different screen and is refused here — that is a remount,
+   * which is what the shell already does.
    *
    * Answers nothing, and nothing is tracked (ruling 34): a frame the view refused is repaired by
    * the next `init`, and the request it carried is spent by the page, which erases the param it
@@ -42,6 +41,8 @@ export type BridgeHost = {
   publishRoute: (next: BridgeInitRoute) => void
   /** Hands this session moved safe-area insets over the same re-sent `init` a route update takes. */
   publishSafeAreaInsets: (next: BridgeSafeAreaInsets) => void
+  /** Hands this session a moved keyboard height over the same re-sent `init`. */
+  publishKeyboardInset: (next: number) => void
   /**
    * Hands the page one Back press. False when this document never said it takes one, which is
    * every page older than the frame; the caller then leaves the key to the navigator.
@@ -87,7 +88,8 @@ export function createBridgeHost(options: BridgeHostOptions): BridgeHost {
       sendInit()
     },
     onRefused: (issue) => options.onDiagnostic?.({ kind: 'route-update-refused', issue }),
-    ...(options.safeAreaInsets === undefined ? {} : { safeAreaInsets: options.safeAreaInsets })
+    ...(options.safeAreaInsets === undefined ? {} : { safeAreaInsets: options.safeAreaInsets }),
+    ...(options.keyboardInset === undefined ? {} : { keyboardInset: options.keyboardInset })
   })
   let closed = false
   // One document's turn at the bridge. `close` ends it and the next `ready` begins the next one;
@@ -163,12 +165,12 @@ export function createBridgeHost(options: BridgeHostOptions): BridgeHost {
           connection: snapshot(),
           route,
           safeAreaInsets: routes.safeAreaInsets(),
+          keyboardInset: routes.keyboardInset(),
           pageRoutes,
           ...(parsedRouteGrants?.success === true
             ? { pageRouteGrants: parsedRouteGrants.data }
             : {}),
           granted,
-          accepts: BRIDGE_SHELL_ACCEPTS,
           host,
           ...options.readStorage()
         })
@@ -249,16 +251,12 @@ export function createBridgeHost(options: BridgeHostOptions): BridgeHost {
     // re-asked `ready` from the document already being served is answered the same way.
     if (message.type === 'ready') {
       serving = true
-      routes.readReady(message)
-      back.readReady(message.accepts ?? [])
+      back.readReady()
       // Every time it is asked, not once: the page re-asks on a backoff, and each ask is answered
       // with the route the shell holds now. That is the whole repair path for a frame that never
       // arrived (ruling 34) — nothing here waits on one, and nothing retries one.
       sendInit()
-      // Forwarded verbatim, including a name this shell has never implemented: what each report
-      // means is the caller's, and this host's job is that the list belongs to the document that
-      // just spoke rather than to the one before it.
-      options.onPageReady({ reports: message.reports ?? [], accepts: message.accepts ?? [] })
+      options.onPageReady()
       return
     }
     if (!serving) {
@@ -337,6 +335,9 @@ export function createBridgeHost(options: BridgeHostOptions): BridgeHost {
     publishSafeAreaInsets: (next) => {
       routes.publishSafeAreaInsets(next, deliverable())
     },
+    publishKeyboardInset: (next) => {
+      routes.publishKeyboardInset(next, deliverable())
+    },
     sendBack: back.send,
     readSessionBack: back.read,
     dispose
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-back-round-trip.test.ts b/mobile/src/mobile-web-shell/bridge/bridge-back-round-trip.test.ts
index 1ceb977eb71..a4940d4d9d8 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-back-round-trip.test.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-back-round-trip.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it, vi } from 'vitest'
 import { BRIDGE_PROTOCOL_VERSION } from './bridge-envelope'
-import { BRIDGE_BACK_CLAIM_NOTIFY, BRIDGE_BACK_FRAME } from './bridge-page-back'
+import { BRIDGE_BACK_CLAIM_NOTIFY } from './bridge-page-back'
 import { createFakeBridgePortPair, type BridgePortPair } from './bridge-port-pair-test-harness'
 import type { FakeRpcClient } from '../bridge-host-test-fakes'
 
@@ -58,9 +58,7 @@ describe('a Back press crossing from the shell to the page', () => {
     release()
     await pair.flush()
     // The shell still sends one, standing in for a claim that went stale in flight.
-    pair.host.receive(
-      JSON.stringify({ v: BRIDGE_PROTOCOL_VERSION, type: 'ready', accepts: [BRIDGE_BACK_FRAME] })
-    )
+    pair.host.receive(JSON.stringify({ v: BRIDGE_PROTOCOL_VERSION, type: 'ready' }))
     await pair.flush()
     expect(pair.host.sendBack()).toBe(true)
     await pair.flush()
@@ -83,18 +81,14 @@ describe('a Back press crossing from the shell to the page', () => {
     expect(pair.backClaims).toEqual([true])
     // The page re-asks, which is what a stale `state` frame makes it do; the host drops the claim
     // answering it, and the page's re-assert is what puts the two back in step.
-    pair.host.receive(
-      JSON.stringify({ v: BRIDGE_PROTOCOL_VERSION, type: 'ready', accepts: [BRIDGE_BACK_FRAME] })
-    )
+    pair.host.receive(JSON.stringify({ v: BRIDGE_PROTOCOL_VERSION, type: 'ready' }))
     await pair.flush()
     expect(pair.backClaims).toEqual([true, false, true])
   })
 
   it('says nothing again when this document is holding nothing', async () => {
     const pair = await opened()
-    pair.host.receive(
-      JSON.stringify({ v: BRIDGE_PROTOCOL_VERSION, type: 'ready', accepts: [BRIDGE_BACK_FRAME] })
-    )
+    pair.host.receive(JSON.stringify({ v: BRIDGE_PROTOCOL_VERSION, type: 'ready' }))
     await pair.flush()
     expect(notifies(pair)).toEqual([])
     expect(pair.backClaims).toEqual([])
@@ -111,66 +105,22 @@ describe('a Back press crossing from the shell to the page', () => {
   })
 })
 
-/**
- * Both halves of the mixed-version matrix. The page bundle is served by a desktop that updates
- * independently of the installed shell, so one side older than the other is the normal state and
- * each direction has to degrade to exactly what Back did before this lane: the navigator pops.
- */
-describe('a shell and a page built either side of the Back lane', () => {
-  it('old shell, new page: the page never posts a claim it was not offered', async () => {
-    // The `init.accepts` this shell sends, with the claim taken back out of it on the wire — which
-    // is exactly the frame a shell built before the name would have posted.
-    const pair = createFakeBridgePortPair({
-      rewriteToPage: (json) => {
-        const frame: Record<string, unknown> = JSON.parse(json)
-        const accepts = frame.accepts
-        if (frame.type !== 'init' || !Array.isArray(accepts)) {
-          return json
-        }
-        return JSON.stringify({
-          ...frame,
-          accepts: accepts.filter((name) => name !== BRIDGE_BACK_CLAIM_NOTIFY)
-        })
-      }
-    })
-    await pair.flush()
-    pair.client.claimBack(() => true)
-    await pair.flush()
-    expect(notifies(pair)).toEqual([])
-    expect(pair.backClaims).toEqual([])
-    // And the re-assert is held to the same declaration: a second `init` from a shell that never
-    // named the claim is still one the page says nothing back to.
-    pair.host.receive(JSON.stringify({ v: BRIDGE_PROTOCOL_VERSION, type: 'ready' }))
-    await pair.flush()
-    expect(notifies(pair)).toEqual([])
-  })
-
-  it('new shell, old page: the shell never sends a press the page would refuse', async () => {
+describe('the Back lane with no negotiation', () => {
+  it('hands a press to any page it serves, whose ready declares nothing', async () => {
     const pair = await opened()
-    // The same document reloaded as a build that declares nothing, which is what a released page is.
     pair.host.receive(JSON.stringify({ v: BRIDGE_PROTOCOL_VERSION, type: 'ready' }))
     await pair.flush()
     const before = pair.toPage.length
-    expect(pair.host.sendBack()).toBe(false)
-    await pair.flush()
-    expect(pair.toPage).toHaveLength(before)
-  })
-
-  /** Why that gate has to exist: an older page's reader takes the whole frame down rather than
-   *  ignoring a type it has never heard of. */
-  it('a page too old to read the frame refuses it whole', async () => {
-    const pair = createFakeBridgePortPair({
-      rewriteToPage: (json) =>
-        JSON.parse(json).type === BRIDGE_BACK_FRAME ? '{"v":1,"type":"b4ck"}' : json
-    })
-    await pair.flush()
-    pair.host.receive(
-      JSON.stringify({ v: BRIDGE_PROTOCOL_VERSION, type: 'ready', accepts: [BRIDGE_BACK_FRAME] })
-    )
-    await pair.flush()
     expect(pair.host.sendBack()).toBe(true)
     await pair.flush()
-    expect(pair.diagnostics).toContainEqual({ kind: 'refused', refusal: 'unrecognised-message' })
-    expect(pair.backPops).toEqual([])
+    expect(pair.toPage.length).toBe(before + 1)
+  })
+
+  it('posts the claim to the shell with nothing offered in init', async () => {
+    const pair = await opened()
+    pair.client.claimBack(() => true)
+    await pair.flush()
+    expect(notifies(pair)).toEqual([BRIDGE_BACK_CLAIM_NOTIFY])
+    expect(pair.backClaims).toEqual([true])
   })
 })
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-caps.ts b/mobile/src/mobile-web-shell/bridge/bridge-caps.ts
index de7056a9b70..4e625884b84 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-caps.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-caps.ts
@@ -138,15 +138,6 @@ export function isBridgeExternalLinkUrl(url: string): boolean {
 }
 export const BRIDGE_MAX_PAGE_ROUTES = 64
 
-/**
- * What a page may say it can be sent, bounded the way every other list on the envelope is.
- *
- * A frame bound and not a vocabulary: the shell acts on the names it knows and ignores the rest,
- * which is what lets a newer page declare one an older shell has never heard of.
- */
-export const BRIDGE_MAX_PAGE_ACCEPTS = 16
-export const BRIDGE_MAX_PAGE_ACCEPT_CHARS = 64
-
 /** A host id, its name and its endpoint. Bounded because the page renders all three. */
 export const BRIDGE_MAX_HOST_FIELD_CHARS = 1024
 
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-client-frame-cap-boundary.test.ts b/mobile/src/mobile-web-shell/bridge/bridge-client-frame-cap-boundary.test.ts
index 1901b5f368c..b29219f178e 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-client-frame-cap-boundary.test.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-client-frame-cap-boundary.test.ts
@@ -1,6 +1,4 @@
 import { describe, expect, it } from 'vitest'
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
 import { BRIDGE_MAX_MESSAGE_BYTES, parseBridgeMessage } from './bridge-caps'
 import { createFakeBridgePortPair } from './bridge-port-pair-test-harness'
 
@@ -95,18 +93,4 @@ describe('the page frame cap at its boundary', () => {
     expect(read.ok).toBe(false)
     expect(read.ok ? null : read.refusal).toBe('oversized')
   })
-
-  it('reaches the cap through the shared predicate and spells it nowhere else', () => {
-    // The census half. A copy of the bound inside the client is a second spelling that can only
-    // drift from the one the reader applies, and it would pass every case above on the day it was
-    // written. `isBridgeFrameWithinCap` is the one thing both sides call.
-    const client = readFileSync(join(import.meta.dirname, 'bridge-rpc-client.ts'), 'utf8')
-    expect(client).toContain('isBridgeFrameWithinCap(')
-    expect(client).not.toContain('BRIDGE_MAX_MESSAGE_BYTES')
-    // And the predicate is the reader's own, not a lookalike beside it: the module that parses
-    // inbound frames is the module that exports it.
-    const caps = readFileSync(join(import.meta.dirname, 'bridge-caps.ts'), 'utf8')
-    expect(caps).toContain('export function isBridgeFrameWithinCap')
-    expect(caps).toContain('if (!isBridgeFrameWithinCap(raw))')
-  })
 })
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-client-frame-cap-unit.test.ts b/mobile/src/mobile-web-shell/bridge/bridge-client-frame-cap-unit.test.ts
index f4ab3eb9bd3..351810c682a 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-client-frame-cap-unit.test.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-client-frame-cap-unit.test.ts
@@ -1,6 +1,4 @@
 import { describe, expect, it } from 'vitest'
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
 import { BRIDGE_MAX_MESSAGE_BYTES, parseBridgeMessage, utf8ByteLength } from './bridge-caps'
 import { createFakeBridgePortPair } from './bridge-port-pair-test-harness'
 
@@ -28,18 +26,6 @@ const WIDE_CHARACTER = '漢'
 const WIDE_CHARACTER_COUNT = 250_000
 
 describe('what the frame cap counts', () => {
-  it('is the unit both shells count, read from their own sources', () => {
-    const shell = join(import.meta.dirname, '..', '..', '..', 'modules', 'orca-mobile-web-shell')
-    const swift = readFileSync(join(shell, 'ios', 'MobileWebShellView.swift'), 'utf8')
-    const kotlin = readFileSync(
-      join(shell, 'android/src/main/java/expo/modules/orcamobilewebshell/MobileWebShellView.kt'),
-      'utf8'
-    )
-    // The inbound gate on each platform, by the expression it measures with.
-    expect(swift).toContain('bridgeGate.accepts(byteCount: json.utf8.count)')
-    expect(kotlin).toContain('bridgeGate.accepts(json.toByteArray(Charsets.UTF_8).size)')
-  })
-
   it('refuses a frame under the cap in code units and over it in bytes', async () => {
     const pad = WIDE_CHARACTER.repeat(WIDE_CHARACTER_COUNT)
     // The precondition, without which this is just another oversized frame: a sender reading
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-client-init-handshake.ts b/mobile/src/mobile-web-shell/bridge/bridge-client-init-handshake.ts
index 609016f033e..24060668e24 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-client-init-handshake.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-client-init-handshake.ts
@@ -1,8 +1,4 @@
 import { BRIDGE_PROTOCOL_VERSION, type BridgeClientMessage } from './bridge-envelope'
-import { BRIDGE_BACK_FRAME } from './bridge-page-back'
-import { BRIDGE_PAGE_PAINTED } from './bridge-page-painted'
-import { BRIDGE_ROUTE_UPDATE_ACCEPT } from './bridge-route-update'
-import { BRIDGE_SAFE_AREA_ACCEPT } from './bridge-safe-area-insets'
 
 /** The page asks again until the shell answers; a session has no other way to start. */
 export const BRIDGE_READY_RETRY_MIN_MS = 50
@@ -53,17 +49,8 @@ export function createBridgeInitHandshake(ask: () => void): BridgeInitHandshake
   }
 }
 
-/**
- * What the page says on every ask, because the shell reads it off whichever `ready` it answers.
- * `accepts` is what this page build can be sent: a second `init` for the session it holds, the
- * Back frame, and insets it pads for itself. `reports` runs the other way: what a shell may wait
- * for this page to post, and the shell holds a frame over the view until it arrives.
- */
+/** What the page says on every ask. It declares nothing: the shell serves no page older than its
+ *  floor, so every page it talks to takes everything the shell sends. */
 export function createPageReadyFrame(): Extract<BridgeClientMessage, { type: 'ready' }> {
-  return {
-    v: BRIDGE_PROTOCOL_VERSION,
-    type: 'ready',
-    accepts: [BRIDGE_ROUTE_UPDATE_ACCEPT, BRIDGE_BACK_FRAME, BRIDGE_SAFE_AREA_ACCEPT],
-    reports: [BRIDGE_PAGE_PAINTED]
-  }
+  return { v: BRIDGE_PROTOCOL_VERSION, type: 'ready' }
 }
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-client-notifications.ts b/mobile/src/mobile-web-shell/bridge/bridge-client-notifications.ts
index b900a095725..993782d8818 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-client-notifications.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-client-notifications.ts
@@ -43,8 +43,6 @@ export type BridgeClientNotificationDeps = {
   isClosed: () => boolean
   /** What `init.grants.native` named. A grant the shell did not give is a frame it would refuse. */
   hasGrant: (name: string) => boolean
-  /** What `init.accepts` named. The other half of the same read: a capability rather than a grant. */
-  shellAccepts: (name: string) => boolean
 }
 
 export type BridgeClientNotifications = {
@@ -140,25 +138,12 @@ export function createBridgeClientNotifications(
         error: captureBridgeError(error)
       })
     },
-    // Gated on the shell saying it takes one, not on a grant: `notify` is a closed union, so an
-    // older shell answers an unknown name with an error frame per mount. Answering nothing, because
-    // a page that has painted has nothing else to do about a shell that will not hear it.
+    // Not on a grant: every session takes it, and a page that has painted has nothing else to do.
     notifyPagePainted: () => {
-      if (deps.shellAccepts(BRIDGE_PAGE_PAINTED)) {
-        post({ v: BRIDGE_PROTOCOL_VERSION, type: 'notify', name: BRIDGE_PAGE_PAINTED })
-      }
+      post({ v: BRIDGE_PROTOCOL_VERSION, type: 'notify', name: BRIDGE_PAGE_PAINTED })
     },
-    // Gated the same way, for the same reason, and answering nothing: a shell that will not hear
-    // the claim keeps the key, which is what every shell did before this frame existed.
     notifyBackClaim: (claimed) => {
-      if (deps.shellAccepts(BRIDGE_BACK_CLAIM_NOTIFY)) {
-        post({
-          v: BRIDGE_PROTOCOL_VERSION,
-          type: 'notify',
-          name: BRIDGE_BACK_CLAIM_NOTIFY,
-          claimed
-        })
-      }
+      post({ v: BRIDGE_PROTOCOL_VERSION, type: 'notify', name: BRIDGE_BACK_CLAIM_NOTIFY, claimed })
     }
   }
 }
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-client-session.ts b/mobile/src/mobile-web-shell/bridge/bridge-client-session.ts
index 02d8a534829..09085cb2ec6 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-client-session.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-client-session.ts
@@ -27,6 +27,8 @@ export type BridgeShellSession = {
   /** How much of the WebView sits under a system bar. Zeros for a shell that reserves the bars
    *  outside the view, which is every shell before the field. */
   safeAreaInsets: BridgeSafeAreaInsets
+  /** The keyboard height native screens read on the shell's OS; 0 while it is closed. */
+  keyboardInset: number
   /** Null for a shell too old to name it; the page's own `loadHosts()` then answers with nothing. */
   host: BridgeInitHost | null
   /** The allowlisted keys as the app held them when this page opened. */
@@ -34,14 +36,6 @@ export type BridgeShellSession = {
   /** The allowlisted keys `storage` could not carry because the app's value is over the page's cap
    *  (ruling 33.6). Empty for a shell too old to name them, which is what it was before. */
   storageOversize: readonly string[]
-  /**
-   * What this shell takes from the page beyond the frames every shell has taken (ruling 34).
-   *
-   * Empty for a shell that named none, which is every shell before this field: a page that posts
-   * one of these to one of those has the whole frame refused as `unrecognised-message`, so the
-   * check is the page's and it is made from here.
-   */
-  accepts: readonly string[]
 }
 
 /**
@@ -61,9 +55,9 @@ export function readShellSession(
     pageRoutes: message.pageRoutes ?? [],
     pageRouteGrants: message.pageRouteGrants ?? null,
     safeAreaInsets: message.safeAreaInsets ?? ZERO_SAFE_AREA_INSETS,
+    keyboardInset: message.keyboardInset ?? 0,
     host: message.host ?? null,
     storage: message.storage ?? {},
-    storageOversize: message.storageOversize ?? [],
-    accepts: message.accepts ?? []
+    storageOversize: message.storageOversize ?? []
   }
 }
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-client-shell-session.ts b/mobile/src/mobile-web-shell/bridge/bridge-client-shell-session.ts
index db5614119e8..03181a4e03f 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-client-shell-session.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-client-shell-session.ts
@@ -31,6 +31,8 @@ export type BridgeClientShellSession = {
   onRouteUpdate: (listener: (route: BridgeInitRoute | null) => void) => () => void
   /** Fires when an `init` moved the safe-area insets the page holds, including a replacement's. */
   onSafeAreaInsetsUpdate: (listener: (insets: BridgeSafeAreaInsets) => void) => () => void
+  /** Fires when an `init` moved the keyboard height the page holds, including a replacement's. */
+  onKeyboardInsetUpdate: (listener: (height: number) => void) => () => void
   /** Drops the session and every listener waiting on one, which `close` is the only caller of. */
   close: () => void
 }
@@ -45,6 +47,7 @@ export function createBridgeClientShellSession(args: {
   const readyListeners = new Set<() => void>()
   const routeUpdateListeners = new Set<(route: BridgeInitRoute | null) => void>()
   const insetsListeners = new Set<(insets: BridgeSafeAreaInsets) => void>()
+  const keyboardListeners = new Set<(height: number) => void>()
 
   return {
     current: () => session,
@@ -62,10 +65,12 @@ export function createBridgeClientShellSession(args: {
       // The held object when the values match, so a reader keyed on identity does not re-render
       // for a re-asked `ready`.
       const safeAreaInsets = held === null || movedInsets ? sent : held.safeAreaInsets
+      const keyboardInset = message.keyboardInset ?? 0
+      const movedKeyboard = held !== null && held.keyboardInset !== keyboardInset
       session =
         update === null
           ? { ...readShellSession(message), safeAreaInsets }
-          : { ...update, route: message.route ?? null, safeAreaInsets }
+          : { ...update, route: message.route ?? null, safeAreaInsets, keyboardInset }
       // Re-primed either way, because a second `init` is also how the page recovers a cache it has
       // refused a `state` frame into: the shell rebuilt under it publishes a generation the page's
       // own is newer than, and this frame is what puts the two back in step. A pane update carries
@@ -80,6 +85,11 @@ export function createBridgeClientShellSession(args: {
           listener(safeAreaInsets)
         }
       }
+      if (movedKeyboard) {
+        for (const listener of keyboardListeners) {
+          listener(keyboardInset)
+        }
+      }
       // Only a route that moved is an update. The shell answers every `ready` with the route it
       // holds, and the page re-asks after a refused `state` frame, so publishing each of those
       // would hand the pane hook the route it is already on.
@@ -114,6 +124,12 @@ export function createBridgeClientShellSession(args: {
         insetsListeners.delete(listener)
       }
     },
+    onKeyboardInsetUpdate: (listener) => {
+      keyboardListeners.add(listener)
+      return () => {
+        keyboardListeners.delete(listener)
+      }
+    },
     close: () => {
       session = null
       readyListeners.clear()
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-envelope.test.ts b/mobile/src/mobile-web-shell/bridge/bridge-envelope.test.ts
index 056dcf7bb18..a1abc7c2d3c 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-envelope.test.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-envelope.test.ts
@@ -1,14 +1,9 @@
 import { describe, expect, it } from 'vitest'
 import {
   BrowserScreencastOpcode,
-  type BrowserScreencastFormat,
   type BrowserScreencastFrame
 } from '../../transport/browser-screencast-protocol'
 import { isRpcResponse } from '../../transport/rpc-response-shape'
-import type { ConnectionState, ForegroundNudgeReason, RpcResponse } from '../../transport/types'
-import type { SendRequestOptions } from '../../transport/unvalidated-rpc-request-port'
-import { readFileSync } from 'node:fs'
-import { fileURLToPath } from 'node:url'
 import {
   BRIDGE_MAX_MESSAGE_BYTES,
   BRIDGE_MAX_METHOD_CHARS,
@@ -23,18 +18,14 @@ import {
 } from './bridge-caps'
 import { BRIDGE_HAPTICS_KINDS, BRIDGE_HAPTICS_NOTIFY } from './bridge-haptics-notify'
 import {
-  BRIDGE_BINARY_FORMATS,
-  BRIDGE_CONNECTION_STATES,
   BRIDGE_FAULT_GRANT,
-  BRIDGE_FOREGROUND_NUDGE_REASONS,
   BRIDGE_NAVIGATE_BACK_NOTIFY,
   BRIDGE_PROTOCOL_VERSION,
   readBridgeClientMessage,
   readBridgeHostMessage,
-  type BridgeHostMessage,
-  type BridgeReplyPayload
+  type BridgeHostMessage
 } from './bridge-envelope'
-import { BRIDGE_BACK_CLAIM_NOTIFY, BRIDGE_BACK_FRAME } from './bridge-page-back'
+import { BRIDGE_BACK_CLAIM_NOTIFY } from './bridge-page-back'
 import { BRIDGE_PAGE_PAINTED } from './bridge-page-painted'
 
 const ID = 'AAAAAAAAAAAAAAAAAAAAAA'
@@ -89,20 +80,12 @@ function client(fields: Record<string, unknown>): Record<string, unknown> {
 describe('client messages', () => {
   const accepted = [
     ['ready', { type: 'ready' }],
-    ['ready naming what it reports', { type: 'ready', reports: [BRIDGE_PAGE_PAINTED] }],
-    // A shell with no row for the name reads a report it will never wait on, which is what an
-    // additive field has to look like in the older direction.
-    [
-      'ready naming a report this shell does not implement',
-      { type: 'ready', reports: ['weather'] }
-    ],
     ['a page painted notify', { type: 'notify', name: BRIDGE_PAGE_PAINTED }],
     ['a back claim', { type: 'notify', name: BRIDGE_BACK_CLAIM_NOTIFY, claimed: true }],
     [
       'a back claim being let go',
       { type: 'notify', name: BRIDGE_BACK_CLAIM_NOTIFY, claimed: false }
     ],
-    ['ready naming what it takes', { type: 'ready', accepts: [BRIDGE_BACK_FRAME] }],
     ['request without params', { type: 'request', id: ID, method: 'status.get' }],
     ['request with params', { type: 'request', id: ID, method: 'status.get', params: { a: 1 } }],
     [
@@ -600,86 +583,7 @@ describe('the reply reader is the native acceptance predicate', () => {
   })
 })
 
-describe('type pins', () => {
-  it('pins the protocol version both sides send', () => {
-    expect(BRIDGE_PROTOCOL_VERSION).toBe(1)
-  })
-
-  it('closes the connection states over the transport union', () => {
-    const asTransport = (value: (typeof BRIDGE_CONNECTION_STATES)[number]): ConnectionState => value
-    const asBridge = (value: ConnectionState): (typeof BRIDGE_CONNECTION_STATES)[number] => value
-    expect(BRIDGE_CONNECTION_STATES.map(asTransport).map(asBridge)).toEqual([
-      ...BRIDGE_CONNECTION_STATES
-    ])
-  })
-
-  it('closes the foreground reasons over the transport union', () => {
-    const asTransport = (
-      value: (typeof BRIDGE_FOREGROUND_NUDGE_REASONS)[number]
-    ): ForegroundNudgeReason => value
-    const asBridge = (
-      value: ForegroundNudgeReason
-    ): (typeof BRIDGE_FOREGROUND_NUDGE_REASONS)[number] => value
-    expect(BRIDGE_FOREGROUND_NUDGE_REASONS.map(asTransport).map(asBridge)).toEqual([
-      ...BRIDGE_FOREGROUND_NUDGE_REASONS
-    ])
-  })
-
-  it('resolves a reply payload to the transport envelope the page hands its callers', () => {
-    const asRpcResponse = (value: BridgeReplyPayload): RpcResponse => value
-    const read = readHost(client({ type: 'reply', id: ID, payload: SUCCESS_PAYLOAD }))
-    const payload =
-      read.ok && read.message.type === 'reply' && 'payload' in read.message
-        ? asRpcResponse(read.message.payload)
-        : null
-    expect(payload).toEqual(SUCCESS_PAYLOAD)
-  })
-
-  it('accepts every option the raw sender declares', () => {
-    // Both directions: the literal has to satisfy the type, and the type has to have no key the
-    // literal is missing, so a new option fails to compile until the schema learns it.
-    const optionKeys: Record<keyof SendRequestOptions, true> = {
-      timeoutMs: true,
-      budgetSpansConnect: true,
-      failWhenDisconnected: true
-    }
-    const options: SendRequestOptions = {
-      timeoutMs: 1000,
-      budgetSpansConnect: true,
-      failWhenDisconnected: true
-    }
-    expect(Object.keys(optionKeys).toSorted()).toEqual(Object.keys(options).toSorted())
-    expect(readClient(client({ type: 'request', id: ID, method: 'm', options })).ok).toBe(true)
-  })
-
-  it('bounds the viewport exactly where the desktop terminal contract does', () => {
-    // A viewport the page sends is replayed on resubscribe by every stream naming that terminal,
-    // the native screens' included. One the desktop refuses there would kill a stream the page
-    // never opened, so the two bounds have to be the same number.
-    //
-    // Read rather than imported: mobile may not pull a contract *value* into its bundle, and the
-    // boundary test that enforces that scans this file too.
-    const contract = readFileSync(
-      fileURLToPath(
-        new URL('../../../../src/shared/rpc-contract/terminal-unary-params.ts', import.meta.url)
-      ),
-      'utf8'
-    )
-    const start = contract.indexOf('export const TerminalViewport')
-    expect(start).toBeGreaterThan(-1)
-    const declaration = contract.slice(start, contract.indexOf('})', start))
-    expect(declaration).toContain(`cols: z.number().int().min(1).max(${BRIDGE_MAX_VIEWPORT_COLS})`)
-    expect(declaration).toContain(`rows: z.number().int().min(1).max(${BRIDGE_MAX_VIEWPORT_ROWS})`)
-  })
-
-  it('closes the binary formats over the screencast protocol', () => {
-    const asProtocol = (value: (typeof BRIDGE_BINARY_FORMATS)[number]): BrowserScreencastFormat =>
-      value
-    const asBridge = (value: BrowserScreencastFormat): (typeof BRIDGE_BINARY_FORMATS)[number] =>
-      value
-    expect(BRIDGE_BINARY_FORMATS.map(asProtocol).map(asBridge)).toEqual([...BRIDGE_BINARY_FORMATS])
-  })
-
+describe('the screencast frame reader', () => {
   it('refuses a screencast metadata field that is not a finite number', () => {
     const keys = [
       'offsetTop',
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-envelope.ts b/mobile/src/mobile-web-shell/bridge/bridge-envelope.ts
index ae8729f96ce..d24f1ab599c 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-envelope.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-envelope.ts
@@ -7,6 +7,7 @@ import { BridgeErrorCaptureSchema } from './bridge-error-capture'
 import { BridgeInitRouteSchema, type BridgeInitRoute } from './bridge-init-route'
 import { BridgePageRouteGrantsSchema } from './bridge-page-route-grants'
 import { BridgeSafeAreaInsetsSchema } from './bridge-safe-area-insets'
+import { BridgeKeyboardInsetSchema } from './bridge-keyboard-inset'
 import { BridgeNotifySchema } from './bridge-notify-envelope'
 import { BRIDGE_BACK_FRAME } from './bridge-page-back'
 import { BRIDGE_ID_PATTERN, idSchema, methodSchema, versionSchema } from './bridge-frame-fields'
@@ -26,8 +27,6 @@ import {
   PAGE_STORAGE_MAX_VALUE_CHARS
 } from '../page-storage-keys'
 import {
-  BRIDGE_MAX_PAGE_ACCEPT_CHARS,
-  BRIDGE_MAX_PAGE_ACCEPTS,
   BRIDGE_MAX_PAGE_ROUTES,
   BRIDGE_MAX_REPLY_PARTS,
   BRIDGE_MAX_ROUTE_PATHNAME_CHARS,
@@ -170,37 +169,7 @@ const replyPartSchema = z.object({
 const BridgeClientMessageSchema = z.discriminatedUnion('type', [
   z.object({
     v: versionSchema,
-    type: z.literal('ready'),
-    /**
-     * What this page can be sent beyond its first `init`; the names and why live in
-     * `bridge-route-update.ts`, which is the only one there is.
-     *
-     * Optional, and safe in both directions without a version bump: a page that sends none is
-     * never sent a second `init`, and a shell that reads none never sends one. An unknown name is
-     * accepted by the schema and ignored by the shell, which is what a newer page declaring a
-     * capability this shell has never implemented has to look like.
-     */
-    accepts: z
-      .array(z.string().min(1).max(BRIDGE_MAX_PAGE_ACCEPT_CHARS))
-      .max(BRIDGE_MAX_PAGE_ACCEPTS)
-      .optional(),
-    /**
-     * What this page will post that the shell may have to wait for, which today is
-     * `BRIDGE_PAGE_PAINTED` and nothing else.
-     *
-     * `accepts` runs the other way and cannot stand in for this: it says what may be sent *to* the
-     * page. A shell waiting on a frame has to know the page will send one, because the generation
-     * is served by a desktop that updates independently of the installed shell — an undeclared
-     * wait would hide a working page built before the frame existed.
-     *
-     * Optional and additive in both directions, on the same bounds as `accepts`: a page that
-     * declares none is waited for by nothing, and an unknown name is a report this shell does not
-     * act on.
-     */
-    reports: z
-      .array(z.string().min(1).max(BRIDGE_MAX_PAGE_ACCEPT_CHARS))
-      .max(BRIDGE_MAX_PAGE_ACCEPTS)
-      .optional()
+    type: z.literal('ready')
   }),
   z.object({
     v: versionSchema,
@@ -282,8 +251,7 @@ const BridgeHostMessageSchema = z.union([
     connection: BridgeConnectionSnapshotSchema
   }),
   // One Back press, and nothing else: the shell pops what it pushed, so a frame naming where to go
-  // back to would be naming a screen the page cannot see. Sent only to a page whose `ready` listed
-  // `BRIDGE_BACK_FRAME`, because an older page's reader refuses the whole frame.
+  // back to would be naming a screen the page cannot see.
   z.object({ v: versionSchema, type: z.literal(BRIDGE_BACK_FRAME) }),
   z.object({
     v: versionSchema,
@@ -307,6 +275,8 @@ const BridgeHostMessageSchema = z.union([
     route: BridgeInitRouteSchema.optional(),
     /** How much of the WebView is under a system bar; absent reads as zeros. */
     safeAreaInsets: BridgeSafeAreaInsetsSchema.optional(),
+    /** The keyboard height native screens read on the shell's OS; absent reads as 0. */
+    keyboardInset: BridgeKeyboardInsetSchema.optional(),
     host: BridgeInitHostSchema.optional(),
     storage: BridgeInitStorageSchema.optional(),
     /**
@@ -343,19 +313,7 @@ const BridgeHostMessageSchema = z.union([
      * behaviour, an older page ignores it. The grant grammar is the manifest's own, so a name the
      * bundle could not have declared cannot arrive here either.
      */
-    pageRouteGrants: BridgePageRouteGrantsSchema.optional(),
-    /**
-     * What this shell accepts from the page beyond the frames every shell has always taken, which
-     * today is `BRIDGE_ROUTE_PARAM_CLEAR` and nothing else.
-     *
-     * The mirror of `ready.accepts`, and optional for the same reason: a shell that sends none is
-     * never posted a clear, and a page that reads none never posts one. An unknown name is a
-     * capability this page has never heard of and is ignored.
-     */
-    accepts: z
-      .array(z.string().min(1).max(BRIDGE_MAX_PAGE_ACCEPT_CHARS))
-      .max(BRIDGE_MAX_PAGE_ACCEPTS)
-      .optional()
+    pageRouteGrants: BridgePageRouteGrantsSchema.optional()
   })
 ])
 
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-init-frame.ts b/mobile/src/mobile-web-shell/bridge/bridge-init-frame.ts
index 582ed79548c..c31244c23ac 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-init-frame.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-init-frame.ts
@@ -8,10 +8,6 @@ import {
   type BridgeInitHost,
   type BridgeInitRoute
 } from './bridge-envelope'
-import { BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT } from './bridge-page-client-identity'
-import { BRIDGE_BACK_CLAIM_NOTIFY } from './bridge-page-back'
-import { BRIDGE_PAGE_PAINTED } from './bridge-page-painted'
-import { BRIDGE_ROUTE_PARAM_CLEAR } from './bridge-route-update'
 import {
   sameSafeAreaInsets,
   ZERO_SAFE_AREA_INSETS,
@@ -34,18 +30,6 @@ export const BRIDGE_NATIVE_GRANTS: readonly string[] = [
   ...MOBILE_WEB_SHELL_GRANTS
 ]
 
-/**
- * What this shell accepts from a page beyond the frames every shell has always taken. Additive
- * names on an optional list, so no version moves: a page that knows none posts none, one told
- * nothing claims no identity, and one told nothing reports no paint.
- */
-export const BRIDGE_SHELL_ACCEPTS: readonly string[] = [
-  BRIDGE_ROUTE_PARAM_CLEAR,
-  BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT,
-  BRIDGE_PAGE_PAINTED,
-  BRIDGE_BACK_CLAIM_NOTIFY
-]
-
 /** The one frame that starts a session, built in one place so its caps and its grants agree. */
 export function createBridgeInitFrame(args: {
   sessionId: string
@@ -57,13 +41,13 @@ export function createBridgeInitFrame(args: {
   pageRoutes: readonly string[]
   /** How much of the WebView sits under a system bar, for a page that pads for them itself. */
   safeAreaInsets?: BridgeSafeAreaInsets
+  /** The keyboard height native screens read on the shell's OS. */
+  keyboardInset?: number
   /** What each of those patterns declared, so the page can tell a hop it may keep from one it
    *  must hand back. Omitted by a shell that has none, which leaves the page on its old rule. */
   pageRouteGrants?: readonly { pathname: string; grants: readonly string[] }[]
   /** What this session may do: the protocol's own grant plus what its route declared. */
   granted: readonly string[]
-  /** What this shell takes from the page beyond the frames every shell has taken (ruling 34). */
-  accepts?: readonly string[]
   /** The host the page is showing, minus the credential the bridge already carries for it. */
   host: BridgeInitHost
   /** The allowlisted keys as the app holds them right now. */
@@ -94,12 +78,10 @@ export function createBridgeInitFrame(args: {
     sameSafeAreaInsets(args.safeAreaInsets, ZERO_SAFE_AREA_INSETS)
       ? {}
       : { safeAreaInsets: { ...args.safeAreaInsets } }),
-    pageRoutes: [...args.pageRoutes],
-    // Omitted when empty for the reason `storageOversize` is: a shell that declares nothing and
-    // one that declares an empty list are the same answer to the page's check.
-    ...(args.accepts === undefined || args.accepts.length === 0
+    ...(args.keyboardInset === undefined || args.keyboardInset === 0
       ? {}
-      : { accepts: [...args.accepts] }),
+      : { keyboardInset: args.keyboardInset }),
+    pageRoutes: [...args.pageRoutes],
     // Copied entry by entry for the reason the grants are: nothing the shell keeps may be
     // reachable through a frame it hands out.
     ...(args.pageRouteGrants === undefined
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-keyboard-inset.test.ts b/mobile/src/mobile-web-shell/bridge/bridge-keyboard-inset.test.ts
new file mode 100644
index 00000000000..9cdf24ae99b
--- /dev/null
+++ b/mobile/src/mobile-web-shell/bridge/bridge-keyboard-inset.test.ts
@@ -0,0 +1,91 @@
+import { describe, expect, it } from 'vitest'
+import { createFakeBridgePortPair } from './bridge-port-pair-test-harness'
+import { readBridgeHostMessage } from './bridge-envelope'
+import { createBridgeInitFrame } from './bridge-init-frame'
+import { readShellSession } from './bridge-client-session'
+
+function initFrame(keyboardInset?: number) {
+  return createBridgeInitFrame({
+    sessionId: 'session-a',
+    buildId: 'build-a',
+    connection: {
+      state: 'connected',
+      reconnectAttempt: 0,
+      lastConnectedAt: null,
+      lastInboundAt: null,
+      generation: null
+    },
+    route: { pathname: '/h/host-a' },
+    pageRoutes: ['/h/[hostId]'],
+    granted: [],
+    host: { id: 'host-a', name: 'Host A', endpoint: 'ws://host-a', lastConnected: 0 },
+    storage: {},
+    ...(keyboardInset === undefined ? {} : { keyboardInset })
+  })
+}
+
+function readInit(json: string) {
+  const read = readBridgeHostMessage(json)
+  if (!read.ok || read.message.type !== 'init') {
+    throw new Error(
+      `not an init the page would read: ${read.ok ? read.message.type : read.refusal}`
+    )
+  }
+  return read.message
+}
+
+describe('keyboardInset on init', () => {
+  it('reads an init without the field as 0, which is every shell before it', () => {
+    const init = readInit(JSON.stringify(initFrame()))
+    expect('keyboardInset' in init).toBe(false)
+    expect(readShellSession(init).keyboardInset).toBe(0)
+  })
+
+  it('passes the keyboard height through to the session the page holds', () => {
+    expect(readShellSession(readInit(JSON.stringify(initFrame(312)))).keyboardInset).toBe(312)
+  })
+
+  it('omits 0, since absent and closed are the same answer', () => {
+    expect('keyboardInset' in initFrame(0)).toBe(false)
+  })
+
+  it('refuses an init whose keyboard no device produces', () => {
+    for (const bad of [-1, 1e9, Number.NaN, '312']) {
+      const frame = { ...initFrame(), keyboardInset: bad }
+      expect(readBridgeHostMessage(JSON.stringify(frame)).ok, String(bad)).toBe(false)
+    }
+  })
+})
+
+describe('a keyboard that moves under a live page', () => {
+  it('re-sends init on show, height change and hide, and the page reads each in place', async () => {
+    const pair = createFakeBridgePortPair()
+    await pair.flush()
+    const session = pair.client.getShellSession()
+    expect(session?.keyboardInset).toBe(0)
+    const seen: number[] = []
+    pair.client.onKeyboardInsetUpdate((height) => seen.push(height))
+
+    // Pixel_API_37: the IME opens at 312, the suggestion strip grows it by 34, then it closes.
+    for (const height of [312, 346, 0]) {
+      pair.host.publishKeyboardInset(height)
+      await pair.flush()
+      expect(pair.client.getShellSession()?.keyboardInset).toBe(height)
+    }
+    expect(seen).toEqual([312, 346, 0])
+    // Same session: a keyboard update is not a replacement.
+    expect(pair.client.getShellSession()?.sessionId).toBe(session?.sessionId)
+    expect(pair.client.getShellSession()?.route).toEqual(session?.route)
+  })
+
+  it('sends nothing for a height that did not move', async () => {
+    const pair = createFakeBridgePortPair({ keyboardInset: 312 })
+    await pair.flush()
+    const inits = () => pair.readToPage().filter((frame) => frame.type === 'init').length
+    const before = inits()
+    pair.host.publishKeyboardInset(312)
+    await pair.flush()
+    expect(inits()).toBe(before)
+    expect(pair.client.getShellSession()?.keyboardInset).toBe(312)
+  })
+})
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-keyboard-inset.ts b/mobile/src/mobile-web-shell/bridge/bridge-keyboard-inset.ts
new file mode 100644
index 00000000000..c11a642e8c2
--- /dev/null
+++ b/mobile/src/mobile-web-shell/bridge/bridge-keyboard-inset.ts
@@ -0,0 +1,9 @@
+import { z } from 'zod'
+import { BRIDGE_MAX_SAFE_AREA_INSET } from './bridge-safe-area-insets'
+
+/**
+ * The software keyboard's height as native screens read it on the shell's OS (iOS from the
+ * window's bottom, Android above the bars), in the page's px; 0 while it is closed. The shell
+ * overlays the IME on the view like a native screen, and the page cannot measure it.
+ */
+export const BridgeKeyboardInsetSchema = z.number().finite().min(0).max(BRIDGE_MAX_SAFE_AREA_INSET)
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-native-verbs.test.ts b/mobile/src/mobile-web-shell/bridge/bridge-native-verbs.test.ts
index b25016775f8..7acf280b63f 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-native-verbs.test.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-native-verbs.test.ts
@@ -99,19 +99,6 @@ describe('reading a native verb call', () => {
 })
 
 describe('the media verbs on the same seam', () => {
-  it('serves all three, and each is a grant name of its own', () => {
-    expect([...BRIDGE_NATIVE_VERB_NAMES]).toEqual([
-      'native.clipboard.write',
-      'native.clipboard.read',
-      'native.media.pick',
-      'native.media.read',
-      'native.media.release',
-      'native.audio.start',
-      'native.audio.read',
-      'native.audio.stop'
-    ])
-  })
-
   it('answers each verb with the params it parsed', () => {
     expect(
       readBridgeNativeVerbCall({
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-notify-grants.ts b/mobile/src/mobile-web-shell/bridge/bridge-notify-grants.ts
index d363be3f5fd..04683d78739 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-notify-grants.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-notify-grants.ts
@@ -37,11 +37,10 @@ const BRIDGE_NOTIFY_GRANTS: Readonly<Record<BridgeNotifyName, string | null>> =
   // The protocol's own as well: it spends a request this shell handed the page, on a param closed
   // to the one the shell hands over, so there is nothing here for a grant to gate.
   [BRIDGE_ROUTE_PARAM_CLEAR]: null,
-  // The page reporting on its own document. Nothing here reaches the host or the device, and the
-  // shell acts on it only for a page that declared it in `ready.reports`.
+  // The page reporting on its own document. Nothing here reaches the host or the device.
   [BRIDGE_PAGE_PAINTED]: null,
   // The page reporting on its own document as well. A claim is not a capability: the shell decides
-  // whether to hand the key over, and it acts on this only for a page that declared it takes one.
+  // whether to hand the key over.
   [BRIDGE_BACK_CLAIM_NOTIFY]: null,
   navigate: 'navigate',
   [BRIDGE_NAVIGATE_BACK_NOTIFY]: 'navigate',
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-page-back.ts b/mobile/src/mobile-web-shell/bridge/bridge-page-back.ts
index 87d08d46d6f..e7c151f63e4 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-page-back.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-page-back.ts
@@ -1,12 +1,8 @@
-/**
- * The device Back key, in the two places it is named: the page's claim on it, and the frame that
- * hands one press over. Negotiated both ways, because each is a closed list on the other side — a
- * claim to a shell that never advertised it is an error frame per mount on every shell installed,
- * and a `back` to a page that never asked for one is a frame its reader drops.
- */
+/** The device Back key, in the two places it is named: the page's claim on it, and the frame that
+ *  hands one press over. */
 
-/** Page to shell, on `init.accepts`: this document is holding Back, or has let it go. */
+/** Page to shell, a notify: this document is holding Back, or has let it go. */
 export const BRIDGE_BACK_CLAIM_NOTIFY = 'back-claim'
 
-/** Shell to page, on `ready.accepts`: one Back press, handed to whoever claimed it. */
+/** Shell to page, a frame: one Back press, handed to whoever claimed it. */
 export const BRIDGE_BACK_FRAME = 'back'
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-page-client-identity.test.ts b/mobile/src/mobile-web-shell/bridge/bridge-page-client-identity.test.ts
index bda9737f02f..b65a8faeee2 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-page-client-identity.test.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-page-client-identity.test.ts
@@ -1,7 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import {
   BRIDGE_PAGE_CLIENT_ID,
-  BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT,
   BridgePageClientIdentityUnavailableError,
   substituteBridgePageClientIdentity
 } from './bridge-page-client-identity'
@@ -39,7 +38,6 @@ describe('the placeholder a page claims', () => {
     // The composer's send journal refuses a retained operation whose caller changed, and it has no
     // expiry. A per-document identity would turn "send it again" into a permanent refusal.
     expect(BRIDGE_PAGE_CLIENT_ID).toBe('orca-page-client')
-    expect(BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT).toBe('page-client-identity')
   })
 
   it('becomes the device identity in both fields a page carries one in', () => {
@@ -184,12 +182,6 @@ describe('the shell substitutes on both doors to the client', () => {
       }
     })
   })
-
-  it('tells the page it performs the swap, on a list an older page ignores', () => {
-    const bridge = harness({ ready: true })
-    const init = bridge.frames().find((message) => message.type === 'init')
-    expect(init?.accepts).toContain(BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT)
-  })
 })
 
 describe('what the page hears when the shell has no identity', () => {
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-page-client-identity.ts b/mobile/src/mobile-web-shell/bridge/bridge-page-client-identity.ts
index a23a8b4c319..44277fa0d24 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-page-client-identity.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-page-client-identity.ts
@@ -8,9 +8,6 @@
 /** What a page puts in `client.id`. Fixed, so a resent message fingerprints the same caller. */
 export const BRIDGE_PAGE_CLIENT_ID = 'orca-page-client'
 
-/** `init.accepts` name for a shell that swaps. A page told nothing claims no identity at all. */
-export const BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT = 'page-client-identity'
-
 /** The two fields a page carries an identity in. `mobileClient` is native chat's spelling. */
 const IDENTITY_FIELDS = ['client', 'mobileClient'] as const
 
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-page-painted.ts b/mobile/src/mobile-web-shell/bridge/bridge-page-painted.ts
index effa3c07a05..41266b01fe0 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-page-painted.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-page-painted.ts
@@ -1,6 +1,2 @@
-/**
- * The page's first frame, in all three places it is named: `ready.reports`, the notify, and
- * `init.accepts`. Negotiated both ways, because the notify union is closed — a report to a shell
- * that never advertised it is an error frame per mount on every shell already installed.
- */
+/** The notify a page posts when its first frame is on screen; the shell covers the view until it. */
 export const BRIDGE_PAGE_PAINTED = 'painted'
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-port-pair-test-harness.test.ts b/mobile/src/mobile-web-shell/bridge/bridge-port-pair-test-harness.test.ts
index 705360361db..ac532410aa0 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-port-pair-test-harness.test.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-port-pair-test-harness.test.ts
@@ -2,10 +2,6 @@ import { describe, expect, it } from 'vitest'
 import type { RpcClient } from '../../transport/rpc-client'
 import type { RpcResponse } from '../../transport/types'
 import { createBridgePortPair, createFakeBridgePortPair } from './bridge-port-pair-test-harness'
-import { BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT } from './bridge-page-client-identity'
-import { BRIDGE_BACK_CLAIM_NOTIFY } from './bridge-page-back'
-import { BRIDGE_PAGE_PAINTED } from './bridge-page-painted'
-import { BRIDGE_ROUTE_PARAM_CLEAR } from './bridge-route-update'
 
 /** Every member of the contract, none of them a fake anything: the pair must carry a plain client. */
 function plainShellClient(record: string[]): RpcClient {
@@ -43,15 +39,10 @@ describe('the bridge port pair', () => {
       pageRoutes: expect.any(Array),
       pageRouteGrants: null,
       safeAreaInsets: { top: 0, right: 0, bottom: 0, left: 0 },
+      keyboardInset: 0,
       host: expect.objectContaining({ id: expect.any(String) }),
       storage: expect.any(Object),
-      storageOversize: [],
-      accepts: [
-        BRIDGE_ROUTE_PARAM_CLEAR,
-        BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT,
-        BRIDGE_PAGE_PAINTED,
-        BRIDGE_BACK_CLAIM_NOTIFY
-      ]
+      storageOversize: []
     })
   })
 
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-port-pair-test-harness.ts b/mobile/src/mobile-web-shell/bridge/bridge-port-pair-test-harness.ts
index bf9b611a540..1b329207d53 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-port-pair-test-harness.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-port-pair-test-harness.ts
@@ -60,7 +60,6 @@ export type BridgePortPair<TRpc extends RpcClient = FakeRpcClient> = {
   /** Every claim on the device Back key the host reported, in order. */
   readonly backClaims: boolean[]
   /** What each answered `ready` declared it reports, in order. */
-  readonly pageReports: () => readonly (readonly string[])[]
   /** Every clear the page asked the shell for, in order. */
   readonly routeParamClears: () => readonly { param: string; value: string }[]
   /** Why the host refused to open a session at all, if it did. */
@@ -105,6 +104,7 @@ export type BridgePortPairOptions<TRpc extends RpcClient> = {
   /** Replaces the verb handler, for the arms where the shell refuses rather than answers. */
   serveNativeVerb?: (verb: BridgeNativeVerb, params: unknown) => Promise<unknown>
   safeAreaInsets?: BridgeSafeAreaInsets
+  keyboardInset?: number
 }
 
 type Lane = {
@@ -210,7 +210,6 @@ export function createBridgePortPair<TRpc extends RpcClient>(
   let pageReadies = 0
   let pagePaints = 0
   /** What each answered `ready` declared it reports, in order. */
-  const pageReports: (readonly string[])[] = []
   const routeParamClears: { param: string; value: string }[] = []
   const routeRefusals: string[] = []
   let receiveOnPage: ((json: string) => void) | null = null
@@ -229,6 +228,7 @@ export function createBridgePortPair<TRpc extends RpcClient>(
     sessionId: options.sessionId ?? 'session-a',
     route: options.route ?? { pathname: '/h/host-a' },
     ...(options.safeAreaInsets === undefined ? {} : { safeAreaInsets: options.safeAreaInsets }),
+    ...(options.keyboardInset === undefined ? {} : { keyboardInset: options.keyboardInset }),
     readClientIdentity: () =>
       options.clientIdentity === undefined ? PORT_PAIR_CLIENT_IDENTITY : options.clientIdentity,
     pageRoutes: options.pageRoutes ?? ['/h/[hostId]'],
@@ -254,9 +254,8 @@ export function createBridgePortPair<TRpc extends RpcClient>(
     }),
     onStorageWrite: (key, value) => storageWrites.push({ key, value }),
     onPageFault: (error) => pageFaults.push(error),
-    onPageReady: ({ reports }) => {
+    onPageReady: () => {
       pageReadies += 1
-      pageReports.push(reports)
     },
     onPagePainted: () => {
       pagePaints += 1
@@ -299,7 +298,6 @@ export function createBridgePortPair<TRpc extends RpcClient>(
     pageReadyCount: () => pageReadies,
     pagePaintCount: () => pagePaints,
     backClaims,
-    pageReports: () => pageReports,
     routeParamClears: () => routeParamClears,
     routeRefusals,
     async flush(): Promise<void> {
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-route-update.test.ts b/mobile/src/mobile-web-shell/bridge/bridge-route-update.test.ts
index aaef95a00ff..ff3b1c0b3bb 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-route-update.test.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-route-update.test.ts
@@ -1,7 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import { createFakeBridgePortPair } from './bridge-port-pair-test-harness'
 import type { BridgeInitRoute } from './bridge-envelope'
-import { BRIDGE_ROUTE_UPDATE_ACCEPT } from './bridge-route-update'
 
 const SESSION = '/h/host-a/session/wt-1'
 
@@ -79,17 +78,13 @@ describe('a route update over a re-sent init', () => {
   it('publishes nothing for a re-asked ready that carries the route the page holds', async () => {
     const pair = await openedOnTheSession()
     const seen = recordRouteUpdates(pair)
-    pair.host.receive(
-      JSON.stringify({ v: 1, type: 'ready', accepts: [BRIDGE_ROUTE_UPDATE_ACCEPT] })
-    )
+    pair.host.receive(JSON.stringify({ v: 1, type: 'ready' }))
     await pair.flush()
     expect(seen).toEqual([])
     // And the same ask after a real update still leaves exactly the one delivery behind it.
     pair.host.publishRoute(sessionRoute('pane-1'))
     await pair.flush()
-    pair.host.receive(
-      JSON.stringify({ v: 1, type: 'ready', accepts: [BRIDGE_ROUTE_UPDATE_ACCEPT] })
-    )
+    pair.host.receive(JSON.stringify({ v: 1, type: 'ready' }))
     await pair.flush()
     expect(seen).toEqual(['pane-1'])
   })
@@ -114,32 +109,13 @@ describe('a route update over a re-sent init', () => {
     expect(pair.client.getShellSession()?.storage).toBe(before)
   })
 
-  /**
-   * Wire compatibility, the half a schema cannot state: an older page never declares `accepts`, so
-   * the shell must not post it a second `init`. That page would read one as a replacement and
-   * settle every request it held; the tap it degrades to losing is what it loses today.
-   */
-  it('sends no second init to a page that never declared it accepts one', async () => {
+  it('sends the second init to a page whose ready declares nothing', async () => {
     const pair = await openedOnTheSession()
-    expect(pair.readToShell().find((frame) => frame.type === 'ready')?.accepts).toContain(
-      BRIDGE_ROUTE_UPDATE_ACCEPT
-    )
-    // This page, then the same document reloaded as a build that declares nothing -- which is what
-    // a released page is. The host reads `accepts` off whichever `ready` it last answered.
     pair.host.receive(JSON.stringify({ v: 1, type: 'ready' }))
     await pair.flush()
     const framesBefore = pair.toPage.length
     pair.host.publishRoute(sessionRoute('pane-1'))
     await pair.flush()
-    expect(pair.toPage.length).toBe(framesBefore)
-    // And the contrast, so the case fails when the gate stops gating rather than when it starts.
-    pair.host.receive(
-      JSON.stringify({ v: 1, type: 'ready', accepts: [BRIDGE_ROUTE_UPDATE_ACCEPT] })
-    )
-    await pair.flush()
-    const framesAfterReady = pair.toPage.length
-    pair.host.publishRoute(sessionRoute('pane-2'))
-    await pair.flush()
-    expect(pair.toPage.length).toBe(framesAfterReady + 1)
+    expect(pair.toPage.length).toBe(framesBefore + 1)
   })
 })
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-route-update.ts b/mobile/src/mobile-web-shell/bridge/bridge-route-update.ts
index 93e42564424..1f5d3c00e5a 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-route-update.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-route-update.ts
@@ -2,23 +2,15 @@ import { BridgeInitRouteSchema, type BridgeInitRoute } from './bridge-init-route
 import { shellScreenRouteKey } from '../shell-screen-route'
 
 /**
- * The one thing a page can say it accepts, which is a second `init` for the session it already has.
- *
  * A notification tap for another pane of the session on screen rewrites one route param of a page
  * that is already mounted, and the shell has no push lane to deliver it on: `notify` runs
  * page-to-shell only, and a shell-to-page frame kind would need a capability of its own
  * (`bridge-audio-verbs.ts` refused one for raw PCM). `init` already carries `route`, is already
- * re-sent on every `ready` and is already re-read, so the pane request rides it.
- *
- * Declared by the page rather than assumed by the shell, in both directions. A page too old to
- * name it reads a second `init` as a replacement and settles every request it holds, so a shell
- * that sent one unasked would break it; a shell too old to re-send one leaves a newer page exactly
- * where it is today. Both degrade to the repeat tap doing nothing, which is what it does now.
+ * re-sent on every `ready` and is already re-read, so the pane request rides a second `init`.
  */
-export const BRIDGE_ROUTE_UPDATE_ACCEPT = 'route-update'
 
 /**
- * The one thing a shell can say it accepts, which is a page erasing a one-shot route param.
+ * The notify a page posts to erase a one-shot route param.
  *
  * The reader erases (ruling 34). A notification tap writes `paneKey` onto the native route, the
  * shell re-sends `init` for as long as it holds one, and the page — having applied the pane — asks
@@ -28,10 +20,6 @@ export const BRIDGE_ROUTE_UPDATE_ACCEPT = 'route-update'
  * Every one of those is followed by a fresh document's `ready`, answered with the route the shell
  * holds then. A clear naming a pane the tap has already moved past is refused by the comparison
  * rather than by a sequence number.
- *
- * Declared in `init` rather than assumed, in the direction `ready.accepts` runs the other way. No
- * shipped shell serves a page, so nothing needs negotiating today; the declaration is here so the
- * page's check exists from the first version that can post one.
  */
 export const BRIDGE_ROUTE_PARAM_CLEAR = 'route-param-clear'
 
@@ -67,8 +55,8 @@ export function bridgeRouteMoved(
  * What a host does with a rewritten route: hold it for the next `init`, send one now, or refuse.
  *
  * `hold` and `send` both move what the host will publish, because a page that reloads inside this
- * mount must be handed the newest route on its next `ready` even when it is too old to be sent one
- * in flight. Only `send` is a frame, and only a frame lets the caller clear the param it delivered.
+ * mount must be handed the newest route on its next `ready`. Only `send` is a frame, and only a
+ * frame lets the caller clear the param it delivered.
  */
 export type BridgeRouteUpdate =
   | { readonly kind: 'send'; readonly route: BridgeInitRoute }
@@ -86,8 +74,6 @@ export type BridgeRouteUpdate =
 export function readBridgeRouteUpdate(args: {
   held: BridgeInitRoute | null
   next: BridgeInitRoute
-  /** What the page's last `ready` declared. Empty for every page built before this existed. */
-  accepts: readonly string[]
   /** Whether this host has a served document that has already had an `init`. */
   deliverable: boolean
 }): BridgeRouteUpdate {
@@ -100,6 +86,5 @@ export function readBridgeRouteUpdate(args: {
     return { kind: 'refuse', issue: 'not-this-screen' }
   }
   const moved = bridgeRouteMoved(held, parsed.data)
-  const sendable = moved && args.deliverable && args.accepts.includes(BRIDGE_ROUTE_UPDATE_ACCEPT)
-  return { kind: sendable ? 'send' : 'hold', route: parsed.data }
+  return { kind: moved && args.deliverable ? 'send' : 'hold', route: parsed.data }
 }
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-rpc-client-frames.test.ts b/mobile/src/mobile-web-shell/bridge/bridge-rpc-client-frames.test.ts
index 55cff6ace69..f651e23b080 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-rpc-client-frames.test.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-rpc-client-frames.test.ts
@@ -12,10 +12,6 @@ import {
   BRIDGE_ACK_INTERVAL_FRAMES
 } from './bridge-client-subscriptions'
 import { BRIDGE_PROTOCOL_VERSION, type BridgeHostMessage } from './bridge-envelope'
-import { BRIDGE_BACK_FRAME } from './bridge-page-back'
-import { BRIDGE_PAGE_PAINTED } from './bridge-page-painted'
-import { BRIDGE_ROUTE_UPDATE_ACCEPT } from './bridge-route-update'
-import { BRIDGE_SAFE_AREA_ACCEPT } from './bridge-safe-area-insets'
 import {
   BRIDGE_READY_RETRY_MAX_MS,
   BRIDGE_READY_RETRY_MIN_MS
@@ -43,16 +39,9 @@ afterEach(() => {
 })
 
 describe('bridge client handshake', () => {
-  it('asks for a session as soon as it exists, naming what it can be sent and what it reports', () => {
+  it('asks for a session as soon as it exists, declaring nothing', () => {
     const page = createPageClient()
-    expect(page.frames()).toEqual([
-      {
-        v: BRIDGE_PROTOCOL_VERSION,
-        type: 'ready',
-        accepts: [BRIDGE_ROUTE_UPDATE_ACCEPT, BRIDGE_BACK_FRAME, BRIDGE_SAFE_AREA_ACCEPT],
-        reports: [BRIDGE_PAGE_PAINTED]
-      }
-    ])
+    expect(page.frames()).toEqual([{ v: BRIDGE_PROTOCOL_VERSION, type: 'ready' }])
   })
 
   it('keeps asking on a widening backoff until init answers', () => {
@@ -141,13 +130,11 @@ describe('bridge client handshake', () => {
       pageRouteGrants: null,
       // And no insets, which is the shell that reserves the bar strips outside the view.
       safeAreaInsets: { top: 0, right: 0, bottom: 0, left: 0 },
+      keyboardInset: 0,
       // And no host and no stored keys, which is what `host-store.web.ts` then answers with.
       host: null,
       storage: {},
-      storageOversize: [],
-      // And one that takes nothing from the page beyond the frames every shell has taken, which
-      // is what stops the page posting an erase it would refuse whole (ruling 34).
-      accepts: []
+      storageOversize: []
     })
   })
 
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-rpc-client.ts b/mobile/src/mobile-web-shell/bridge/bridge-rpc-client.ts
index 452bcceb57c..687d26637f7 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-rpc-client.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-rpc-client.ts
@@ -77,6 +77,8 @@ export type BridgeRpcClient = RpcClient & {
   onRouteUpdate: (listener: (route: BridgeInitRoute | null) => void) => () => void
   /** Fires when an `init` moved the safe-area insets; the value itself is on `getShellSession`. */
   onSafeAreaInsetsUpdate: (listener: (insets: BridgeSafeAreaInsets) => void) => () => void
+  /** Fires when an `init` moved the keyboard height; the value itself is on `getShellSession`. */
+  onKeyboardInsetUpdate: (listener: (height: number) => void) => () => void
   getShellSession: () => BridgeShellSession | null
   /**
    * Asks the shell to open a screen this page does not render. False when the shell granted no
@@ -108,7 +110,6 @@ export type BridgeRpcClient = RpcClient & {
   /**
    * Tells the shell this document has a frame on screen, which is the only thing that does: the
    * shell sees a document commit and a page say `ready`, and neither of those is a painted tree.
-   * Declared in `ready.reports`, so a shell waiting for it is one this page will answer.
    */
   notifyPagePainted: () => void
   /**
@@ -141,9 +142,8 @@ export type BridgeRpcClient = RpcClient & {
    * (ruling 34). The reader erases: the shell tracks no delivery, so a request stays on the route
    * and keeps arriving until the page that applied it says so.
    *
-   * False when this shell never declared it takes one, which is every shell older than the field.
-   * Nothing is owed the caller either way — a clear that did not leave is repaired by the request
-   * arriving again, which is the same path a lost frame takes.
+   * False when the frame could not leave. Nothing is owed the caller — a clear that did not leave
+   * is repaired by the request arriving again, which is the same path a lost frame takes.
    */
   clearRouteParam: (param: BridgeClearableRouteParam, value: string) => boolean
 }
@@ -292,8 +292,7 @@ export function createBridgeRpcClient(options: BridgeRpcClientOptions): BridgeRp
     subscriptions,
     report,
     // Declared here rather than beside the others: the re-assert has to run after the session has
-    // taken this frame, so the claim's own gate reads this `init`'s `accepts` and a shell that
-    // never named it still hears nothing.
+    // taken this frame.
     acceptInit: (message) => {
       handshake.stop()
       shellSession.accept(message)
@@ -412,8 +411,7 @@ export function createBridgeRpcClient(options: BridgeRpcClientOptions): BridgeRp
     send: posted,
     requireSession,
     isClosed: () => closed,
-    hasGrant: (name) => shellSession.current()?.grants.native.includes(name) === true,
-    shellAccepts: (name) => shellSession.current()?.accepts.includes(name) === true
+    hasGrant: (name) => shellSession.current()?.grants.native.includes(name) === true
   })
 
   const unsubscribeFromMessages = options.onMessage(receive)
@@ -465,9 +463,9 @@ export function createBridgeRpcClient(options: BridgeRpcClientOptions): BridgeRp
     onReady: shellSession.onReady,
     onRouteUpdate: shellSession.onRouteUpdate,
     onSafeAreaInsetsUpdate: shellSession.onSafeAreaInsetsUpdate,
+    onKeyboardInsetUpdate: shellSession.onKeyboardInsetUpdate,
     getShellSession: shellSession.current,
     clearRouteParam: (param, value) =>
-      shellSession.current()?.accepts.includes(BRIDGE_ROUTE_PARAM_CLEAR) === true &&
       posted({
         v: BRIDGE_PROTOCOL_VERSION,
         type: 'notify',
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-safe-area-insets.ts b/mobile/src/mobile-web-shell/bridge/bridge-safe-area-insets.ts
index ada32878371..67d42c774c4 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-safe-area-insets.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-safe-area-insets.ts
@@ -41,10 +41,3 @@ export function sameSafeAreaInsets(
     left.left === right.left
   )
 }
-
-/**
- * What a page puts in `ready.accepts` to say it pads for the system bars itself. The shell draws
- * the WebView edge-to-edge only for such a page: an older page has no reader for the insets and
- * would lay its header under the status bar, so it keeps the strips the shell reserves.
- */
-export const BRIDGE_SAFE_AREA_ACCEPT = 'safe-area-insets'
diff --git a/mobile/src/mobile-web-shell/bridge/page-bootstrap.test.ts b/mobile/src/mobile-web-shell/bridge/page-bootstrap.test.ts
index 24089338e57..32a82b9f9c0 100644
--- a/mobile/src/mobile-web-shell/bridge/page-bootstrap.test.ts
+++ b/mobile/src/mobile-web-shell/bridge/page-bootstrap.test.ts
@@ -8,7 +8,6 @@ import {
   PAGE_MOUNT_STATE_KEY,
   PAGE_SESSION_ID_KEY,
   shellRouteHref,
-  stampPageMountState,
   type PageMountTarget
 } from './page-bootstrap'
 import type { BridgeRpcClient, BridgeShellSession } from './bridge-rpc-client'
@@ -248,13 +247,3 @@ describe('the url the page writes for a route', () => {
     )
   })
 })
-
-describe('the mount state attribute', () => {
-  it('records the last state reached, so the entry can say its script ran', () => {
-    const target = createTarget()
-    stampPageMountState(target, 'started')
-    expect(target.dataset[PAGE_MOUNT_STATE_KEY]).toBe('started')
-    stampPageMountState(target, 'mounted')
-    expect(target.dataset[PAGE_MOUNT_STATE_KEY]).toBe('mounted')
-  })
-})
diff --git a/mobile/src/mobile-web-shell/bridge/page-first-paint-through-the-bridge.test.ts b/mobile/src/mobile-web-shell/bridge/page-first-paint-through-the-bridge.test.ts
index 86d5189db5e..46faf5f38c1 100644
--- a/mobile/src/mobile-web-shell/bridge/page-first-paint-through-the-bridge.test.ts
+++ b/mobile/src/mobile-web-shell/bridge/page-first-paint-through-the-bridge.test.ts
@@ -1,37 +1,16 @@
 /**
- * The paint report end to end, and the three pairings it has to survive: a shell that never
- * advertised it, a page that never declared it, and two halves that did both.
- *
- * Driven through the real port pair rather than a mocked host, because what is worth proving is
- * that each half reads the other's word off a real frame rather than assuming it.
+ * The paint report end to end, driven through the real port pair rather than a mocked host, because
+ * what is worth proving is that the page's post reaches the shell's cover over a real frame.
  */
 import { describe, expect, it } from 'vitest'
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
 import { createFakeRpcClient } from '../bridge-host-test-fakes'
 import { createFakeBridgePortPair } from './bridge-port-pair-test-harness'
-import { BRIDGE_PAGE_PAINTED } from './bridge-page-painted'
 import { createRouteScreenPaintReporter } from './page-first-paint'
 
-/** One `init` frame with one name taken out of `accepts`, which is what an older shell sends. */
-function stripAccept(json: string, name: string): string {
-  const frame: unknown = JSON.parse(json)
-  if (typeof frame !== 'object' || frame === null || !('type' in frame)) {
-    return json
-  }
-  const record: Record<string, unknown> = { ...frame }
-  if (record.type !== 'init' || !Array.isArray(record.accepts)) {
-    return json
-  }
-  record.accepts = record.accepts.filter((entry) => entry !== name)
-  return JSON.stringify(record)
-}
-
 describe('the page telling the shell it has a frame', () => {
-  it('new shell, new page: declares on ready and posts after the first paint', async () => {
+  it('posts after the first paint, and not before', async () => {
     const pair = createFakeBridgePortPair({ rpc: createFakeRpcClient() })
     await pair.flush()
-    expect(pair.pageReports()).toEqual([[BRIDGE_PAGE_PAINTED]])
     expect(pair.pagePaintCount()).toBe(0)
 
     // The two frames the entry waits out, drained by hand so "after the paint" is a step.
@@ -52,48 +31,6 @@ describe('the page telling the shell it has a frame', () => {
     expect(pair.pagePaintCount()).toBe(1)
   })
 
-  it('old shell, new page: posts nothing, so no shell is left refusing a frame', async () => {
-    // Stands for every shell installed before this change: `notify` is a closed union there, so an
-    // unasked-for report is an error frame per mount rather than a dropped one.
-    const pair = createFakeBridgePortPair({
-      rpc: createFakeRpcClient(),
-      rewriteToPage: (json) => stripAccept(json, BRIDGE_PAGE_PAINTED)
-    })
-    await pair.flush()
-    expect(pair.client.getShellSession()?.accepts).not.toContain(BRIDGE_PAGE_PAINTED)
-    const framesToShell = pair.toShell.length
-    pair.client.notifyPagePainted()
-    await pair.flush()
-    expect(pair.toShell).toHaveLength(framesToShell)
-    expect(pair.pagePaintCount()).toBe(0)
-    expect(pair.hostDiagnostics).not.toContainEqual(
-      expect.objectContaining({ refusal: 'unrecognised-message' })
-    )
-  })
-
-  it('advertises the report in init, which is what the page reads before posting one', async () => {
-    const pair = createFakeBridgePortPair({ rpc: createFakeRpcClient() })
-    await pair.flush()
-    expect(pair.client.getShellSession()?.accepts).toContain(BRIDGE_PAGE_PAINTED)
-  })
-
-  it('is reported by the page entry, from the effect that runs after the tree commits', () => {
-    // The one call site, pinned: every test above drives the client directly, so a deleted line in
-    // the entry would leave a shell covering a page that has painted and will never say so.
-    const entry = readFileSync(
-      join(import.meta.dirname, '..', '..', '..', 'web-entry', 'index.tsx'),
-      'utf8'
-    )
-    expect(entry).toContain('createRouteScreenPaintReporter(')
-    expect(entry).toContain('client.notifyPagePainted()')
-    // Handed to the route screen rather than called from the wrapper's own effect, which commits
-    // while the route's chunk is still arriving and the body is empty.
-    expect(entry).toContain('RouteScreenPaintProvider')
-    expect(entry).not.toMatch(
-      /stampPageMountState\(target, 'mounted'\)\s*\n\s*reportRouteScreenPaint/
-    )
-  })
-
   it('costs the shell nothing to hear: no request, no subscription, no reply', async () => {
     const rpc = createFakeRpcClient()
     const pair = createFakeBridgePortPair({ rpc })
diff --git a/mobile/src/mobile-web-shell/catch-all-page-route-states.test.tsx b/mobile/src/mobile-web-shell/catch-all-page-route-states.test.tsx
index 6cbe33132cf..06e4a6f9f87 100644
--- a/mobile/src/mobile-web-shell/catch-all-page-route-states.test.tsx
+++ b/mobile/src/mobile-web-shell/catch-all-page-route-states.test.tsx
@@ -118,6 +118,10 @@ vi.mock('../../modules/orca-mobile-web-shell/src', async () => {
     parseMobileWebShellLoadState: loadState.parseMobileWebShellLoadState
   }
 })
+// The wall's release offer: the native hook imports the update checker module.
+vi.mock('../app-update/use-wall-app-update', () => ({
+  useWallAppUpdate: () => null
+}))
 vi.mock('../transport/client-context', () => ({ useHostClient: () => ({ client: null }) }))
 vi.mock('./use-page-host-snapshot', () => ({
   usePageHostSnapshot: () => ({
diff --git a/mobile/src/mobile-web-shell/generation-store-host-removal-race.test.ts b/mobile/src/mobile-web-shell/generation-store-host-removal-race.test.ts
index bf27caef164..87fe1644906 100644
--- a/mobile/src/mobile-web-shell/generation-store-host-removal-race.test.ts
+++ b/mobile/src/mobile-web-shell/generation-store-host-removal-race.test.ts
@@ -103,7 +103,7 @@ async function seedHosts(store: GenerationStore): Promise<void> {
 }
 
 function indexedHostKeys(fileSystem: FakeGenerationFileSystem): string[] {
-  return Object.keys(JSON.parse(fileSystem.text(INDEX) ?? '{}')).sort()
+  return [...JSON.parse(fileSystem.text(INDEX) ?? '[]')].sort()
 }
 
 type Sides = { session: () => GenerationStore; removeHost: (hostId: string) => Promise<void> }
diff --git a/mobile/src/mobile-web-shell/generation-store.test.ts b/mobile/src/mobile-web-shell/generation-store.test.ts
index 03ed6876a54..e7caf90315d 100644
--- a/mobile/src/mobile-web-shell/generation-store.test.ts
+++ b/mobile/src/mobile-web-shell/generation-store.test.ts
@@ -72,10 +72,14 @@ async function activate(
   await store.commitGeneration(await store.stageGeneration(hostKey, result))
 }
 
+function hostKeys(count: number): string[] {
+  return Array.from({ length: count }, (_, index) => deriveHostCacheKey(`host-${index}`))
+}
+
 describe('generation store', () => {
   it('stages and commits exactly the manifest, with the manifest written last', async () => {
     const fs = createFakeFileSystem()
-    const store = createGenerationStore({ fileSystem: fs, now: () => 10 })
+    const store = createGenerationStore({ fileSystem: fs })
 
     await activate(store, HOST)
 
@@ -94,7 +98,7 @@ describe('generation store', () => {
     const staged = fs.writes.filter((path) => path.includes('/tmp/'))
     expect(staged.at(-1)).toBe(`${HOST}/tmp/${build}/manifest.json`)
     expect(staged).toHaveLength(3)
-    expect(fs.text('hosts.json')).toBe(JSON.stringify({ [HOST]: 10 }))
+    expect(fs.text('hosts.json')).toBe(JSON.stringify([HOST]))
   })
 
   it('reads back the activation it committed', async () => {
@@ -154,7 +158,7 @@ describe('generation store', () => {
 
   it('treats a second commit of the same build as a no-op', async () => {
     const fs = createFakeFileSystem()
-    const store = createGenerationStore({ fileSystem: fs, now: () => 10 })
+    const store = createGenerationStore({ fileSystem: fs })
 
     await activate(store, HOST)
     const before = fs.paths()
@@ -209,9 +213,8 @@ describe('generation store', () => {
 
   it('evicts the least recently activated host past the ceiling', async () => {
     const fs = createFakeFileSystem()
-    let clock = 0
-    const store = createGenerationStore({ fileSystem: fs, now: () => (clock += 1) })
-    const hosts = ['a', 'b', 'c', 'd', 'e'].map((name) => deriveHostCacheKey(name))
+    const store = createGenerationStore({ fileSystem: fs })
+    const hosts = hostKeys(MAX_CACHED_HOSTS + 1)
 
     for (const host of hosts) {
       await activate(store, host)
@@ -222,25 +225,23 @@ describe('generation store', () => {
     for (const host of hosts.slice(1)) {
       expect((await store.readActiveGeneration(host))?.buildId).toBe(BUILD)
     }
-    expect(Object.keys(JSON.parse(fs.text('hosts.json') ?? '{}'))).toHaveLength(MAX_CACHED_HOSTS)
+    expect(fs.text('hosts.json')).toBe(JSON.stringify(hosts.slice(1)))
   })
 
   it('evicts a host with no index entry before the least recently activated one', async () => {
     const fs = createFakeFileSystem()
-    let clock = 0
-    const store = createGenerationStore({ fileSystem: fs, now: () => (clock += 1) })
-    const oldest = deriveHostCacheKey('a')
+    const store = createGenerationStore({ fileSystem: fs })
+    const [oldest, ...rest] = hostKeys(MAX_CACHED_HOSTS - 1)
     const orphan = deriveHostCacheKey('orphan')
-    for (const name of ['a', 'b', 'c']) {
-      await activate(store, deriveHostCacheKey(name))
+    for (const host of [oldest, ...rest]) {
+      await activate(store, host)
     }
     // Activated last, so recency alone would keep it; its index entry is what goes missing.
     await activate(store, orphan)
-    const index: Record<string, number> = JSON.parse(fs.text('hosts.json') ?? '{}')
-    delete index[orphan]
-    fs.seed('hosts.json', { kind: 'file', bytes: new TextEncoder().encode(JSON.stringify(index)) })
+    const order = [oldest, ...rest]
+    fs.seed('hosts.json', { kind: 'file', bytes: new TextEncoder().encode(JSON.stringify(order)) })
 
-    await activate(store, deriveHostCacheKey('d'))
+    await activate(store, deriveHostCacheKey('one-too-many'))
 
     expect(fs.paths().some((path) => path.startsWith(orphan))).toBe(false)
     expect((await store.readActiveGeneration(oldest))?.buildId).toBe(BUILD)
@@ -248,36 +249,102 @@ describe('generation store', () => {
 
   it('counts a recommit of the build a host already has as use of that host', async () => {
     const fs = createFakeFileSystem()
-    let clock = 0
-    const store = createGenerationStore({ fileSystem: fs, now: () => (clock += 1) })
-    const kept = deriveHostCacheKey('a')
-    const evicted = deriveHostCacheKey('b')
-    for (const name of ['a', 'b', 'c', 'd']) {
-      await activate(store, deriveHostCacheKey(name))
+    const store = createGenerationStore({ fileSystem: fs })
+    const hosts = hostKeys(MAX_CACHED_HOSTS)
+    const [kept, evicted] = hosts
+    for (const host of hosts) {
+      await activate(store, host)
     }
-    // A redownload of the bundle host A already has, which takes the same-build commit path.
+    // A redownload of the bundle the oldest host already has, which takes the same-build path.
     await activate(store, kept)
 
-    await activate(store, deriveHostCacheKey('e'))
+    await activate(store, deriveHostCacheKey('one-too-many'))
 
     expect(fs.paths().some((path) => path.startsWith(evicted))).toBe(false)
     expect((await store.readActiveGeneration(kept))?.buildId).toBe(BUILD)
   })
 
+  it('counts opening a cached generation as use of that host', async () => {
+    const fs = createFakeFileSystem()
+    const store = createGenerationStore({ fileSystem: fs })
+    const hosts = hostKeys(MAX_CACHED_HOSTS)
+    for (const host of hosts) {
+      await activate(store, host)
+    }
+    expect((await store.readActiveGeneration(hosts[0]))?.buildId).toBe(BUILD)
+
+    await activate(store, deriveHostCacheKey('one-too-many'))
+
+    expect((await store.readActiveGeneration(hosts[0]))?.buildId).toBe(BUILD)
+    expect(fs.paths().some((path) => path.startsWith(hosts[1]))).toBe(false)
+  })
+
+  it('writes nothing when a read finds no active generation', async () => {
+    const fs = createFakeFileSystem()
+    const store = createGenerationStore({ fileSystem: fs })
+    await activate(store, HOST)
+    const writesBefore = fs.writes.length
+
+    expect(await store.readActiveGeneration(deriveHostCacheKey('never-opened'))).toBeNull()
+
+    expect(fs.writes).toHaveLength(writesBefore)
+    expect(fs.text('hosts.json')).toBe(JSON.stringify([HOST]))
+  })
+
+  it('returns the generation when an open cannot write the index', async () => {
+    const fs = createFakeFileSystem()
+    const store = createGenerationStore({ fileSystem: fs })
+    const other = deriveHostCacheKey('other')
+    await activate(store, HOST)
+    await activate(store, other)
+    fs.failWritesAt('hosts.json')
+
+    expect((await store.readActiveGeneration(HOST))?.buildId).toBe(BUILD)
+    expect(fs.text('hosts.json')).toBe(JSON.stringify([HOST, other]))
+  })
+
+  it('rewrites the index on an open only when the host is not already the newest', async () => {
+    const fs = createFakeFileSystem()
+    const store = createGenerationStore({ fileSystem: fs })
+    const [older, newest] = hostKeys(2)
+    await activate(store, older)
+    await activate(store, newest)
+    const before = { text: fs.text('hosts.json'), writes: fs.writes.length }
+
+    expect((await store.readActiveGeneration(newest))?.buildId).toBe(BUILD)
+    expect({ text: fs.text('hosts.json'), writes: fs.writes.length }).toEqual(before)
+
+    expect((await store.readActiveGeneration(older))?.buildId).toBe(BUILD)
+    expect(fs.text('hosts.json')).toBe(JSON.stringify([newest, older]))
+  })
+
+  it('reads the timestamp record earlier builds wrote as an empty order', async () => {
+    const fs = createFakeFileSystem()
+    const store = createGenerationStore({ fileSystem: fs })
+    const other = deriveHostCacheKey('other')
+    fs.seed('hosts.json', {
+      kind: 'file',
+      bytes: new TextEncoder().encode(JSON.stringify({ [HOST]: 1, [other]: 2 }))
+    })
+    await activate(store, other)
+
+    expect(fs.text('hosts.json')).toBe(JSON.stringify([other]))
+  })
+
   it('never counts or evicts a host that is only mid-download', async () => {
     const fs = createFakeFileSystem()
-    let clock = 0
-    const store = createGenerationStore({ fileSystem: fs, now: () => (clock += 1) })
-    const oldest = deriveHostCacheKey('a')
+    const store = createGenerationStore({ fileSystem: fs })
+    const hosts = hostKeys(MAX_CACHED_HOSTS)
+    const oldest = hosts[0]
     const downloading = deriveHostCacheKey('downloading')
-    for (const name of ['a', 'b', 'c', 'd']) {
-      await activate(store, deriveHostCacheKey(name))
+    for (const host of hosts) {
+      await activate(store, host)
     }
     const staged = await store.stageGeneration(downloading, buildResult({}))
 
-    await activate(store, deriveHostCacheKey('e'))
+    await activate(store, deriveHostCacheKey('one-too-many'))
 
-    // The ceiling is four cached generations, so the fifth activation evicts the least recently
+    // The ceiling counts cached generations, so the activation past it evicts the least recently
     // activated host and leaves the download alone.
     expect(fs.paths().some((path) => path.startsWith(oldest))).toBe(false)
     expect(fs.text(`${staged.directory.slice(ROOT.length + 1)}/manifest.json`)).not.toBeNull()
@@ -366,7 +433,7 @@ describe('generation store', () => {
 
     expect(await store.readActiveGeneration(HOST)).toBeNull()
     expect((await store.readActiveGeneration(other))?.buildId).toBe(BUILD)
-    expect(Object.keys(JSON.parse(fs.text('hosts.json') ?? '{}'))).toEqual([other])
+    expect(fs.text('hosts.json')).toBe(JSON.stringify([other]))
   })
 
   it('refuses a rename that did not carry the tree, as Android below API 26 can', async () => {
@@ -400,8 +467,8 @@ describe('generation store', () => {
 
   it('activates normally when the recency index cannot be read', async () => {
     const fs = createFakeFileSystem()
-    const store = createGenerationStore({ fileSystem: fs, now: () => 10 })
-    fs.seed('hosts.json', { kind: 'file', bytes: new TextEncoder().encode('{}') })
+    const store = createGenerationStore({ fileSystem: fs })
+    fs.seed('hosts.json', { kind: 'file', bytes: new TextEncoder().encode('[]') })
     fs.failReadsAt('hosts.json')
 
     await activate(store, HOST)
@@ -439,26 +506,6 @@ describe('generation store', () => {
     expect((await store.readActiveGeneration(HOST))?.buildId).toBe(BUILD)
   })
 
-  it('keeps the host it just activated when the clock jumps backward', async () => {
-    const fs = createFakeFileSystem()
-    const times = [100, 200, 300, 400, 1]
-    let tick = 0
-    const store = createGenerationStore({ fileSystem: fs, now: () => times[tick++] ?? 0 })
-    const hosts = ['a', 'b', 'c', 'd', 'e'].map((name) => deriveHostCacheKey(name))
-
-    for (const host of hosts) {
-      await activate(store, host)
-    }
-
-    expect((await store.readActiveGeneration(hosts[4]))?.directory).toBe(
-      `${ROOT}/${hosts[4]}/generations/${BUILD}`
-    )
-    expect(await store.readActiveGeneration(hosts[0])).toBeNull()
-    for (const host of hosts.slice(1)) {
-      expect((await store.readActiveGeneration(host))?.buildId).toBe(BUILD)
-    }
-  })
-
   it('returns the activation even when the recency index cannot be written', async () => {
     const fs = createFakeFileSystem()
     const store = createGenerationStore({ fileSystem: fs })
@@ -486,16 +533,16 @@ describe('generation store', () => {
 
   it('prunes an index entry whose host tree is gone', async () => {
     const fs = createFakeFileSystem()
-    const store = createGenerationStore({ fileSystem: fs, now: () => 10 })
+    const store = createGenerationStore({ fileSystem: fs })
     const stale = deriveHostCacheKey('uninstalled')
     fs.seed('hosts.json', {
       kind: 'file',
-      bytes: new TextEncoder().encode(JSON.stringify({ [stale]: 5 }))
+      bytes: new TextEncoder().encode(JSON.stringify([stale]))
     })
 
     await activate(store, HOST)
 
-    expect(fs.text('hosts.json')).toBe(JSON.stringify({ [HOST]: 10 }))
+    expect(fs.text('hosts.json')).toBe(JSON.stringify([HOST]))
   })
 
   it('refuses a staged handle it did not issue', async () => {
@@ -519,8 +566,7 @@ describe('generation store', () => {
 
   it('ignores a directory under the cache root that is not a host key', async () => {
     const fs = createFakeFileSystem()
-    let clock = 0
-    const store = createGenerationStore({ fileSystem: fs, now: () => (clock += 1) })
+    const store = createGenerationStore({ fileSystem: fs })
     // Whatever else lives under the OS cache directory is not this store's to count or delete.
     fs.seed('not-a-host-key/stray.txt', { kind: 'file', bytes: new Uint8Array(1) })
     const hosts = ['a', 'b', 'c', 'd'].map((name) => deriveHostCacheKey(name))
diff --git a/mobile/src/mobile-web-shell/generation-store.ts b/mobile/src/mobile-web-shell/generation-store.ts
index 75a315ca332..53281212294 100644
--- a/mobile/src/mobile-web-shell/generation-store.ts
+++ b/mobile/src/mobile-web-shell/generation-store.ts
@@ -23,8 +23,8 @@ const GENERATIONS_DIRECTORY_NAME = 'generations'
 const STAGING_DIRECTORY_NAME = 'tmp'
 const HOST_INDEX_FILE_NAME = 'hosts.json'
 
-/** The architecture reference's cache ceiling: four hosts, least recently activated evicted. */
-export const MAX_CACHED_HOSTS = 4
+/** Least recently used host evicted past this. */
+export const MAX_CACHED_HOSTS = 6
 
 export type ActiveGeneration = {
   readonly buildId: string
@@ -67,15 +67,14 @@ export type GenerationStore = {
   forgetHostUpdateFailures(hostId: string): Promise<void>
 }
 
-/** Recency only, so anything unreadable degrades to "evict this host first". */
-const HostIndexSchema = z.record(z.string(), z.number().int().nonnegative())
+/** Host cache keys, least recently used first. Recency only, so anything unreadable degrades to
+ *  "evict this host first"; the timestamp record earlier builds wrote reads as empty once. */
+const HostOrderSchema = z.array(z.string())
 
 export function createGenerationStore(options: {
   fileSystem: GenerationFileSystem
-  now?: () => number
 }): GenerationStore {
   const fs = options.fileSystem
-  const now = options.now ?? Date.now
   // `StagedGeneration` is structurally typed, so any object of that shape would otherwise let
   // `commitGeneration` rename over, and `abortStagedGeneration` delete, a directory of the caller's
   // choosing. Only handles this store minted are honoured.
@@ -87,25 +86,30 @@ export function createGenerationStore(options: {
   const stagingRoot = (hostKey: string): string =>
     joinUri(hostRoot(hostKey), STAGING_DIRECTORY_NAME)
 
-  async function readHostIndex(): Promise<Map<string, number>> {
+  async function readHostOrder(): Promise<readonly string[]> {
     // Unreadable is treated as absent here, unlike a manifest: an index nobody can read costs
     // eviction order, and the next activation rewrites it whole.
     const text = await fs.readText(joinUri(fs.rootUri, HOST_INDEX_FILE_NAME)).catch(() => null)
-    const parsed = text === null ? null : HostIndexSchema.safeParse(parseJson(text))
-    return new Map(Object.entries(parsed?.success === true ? parsed.data : {}))
+    const parsed = text === null ? null : HostOrderSchema.safeParse(parseJson(text))
+    return parsed?.success === true ? parsed.data : []
   }
 
-  async function writeHostIndex(index: ReadonlyMap<string, number>): Promise<void> {
+  async function writeHostOrder(order: readonly string[]): Promise<void> {
     // Recency, not truth: a full disk here must not turn an activation that is already on disk
     // into a thrown commit, and the next activation rewrites the whole index anyway.
     await fs
-      .writeText(
-        joinUri(fs.rootUri, HOST_INDEX_FILE_NAME),
-        JSON.stringify(Object.fromEntries(index))
-      )
+      .writeText(joinUri(fs.rootUri, HOST_INDEX_FILE_NAME), JSON.stringify(order))
       .catch(() => undefined)
   }
 
+  /** Use without an eviction pass, because the host count did not change. */
+  async function touchHost(hostKey: string): Promise<void> {
+    const order = await readHostOrder()
+    if (order.at(-1) !== hostKey) {
+      await writeHostOrder(withHostLast(order, hostKey))
+    }
+  }
+
   async function listHostDirectories(): Promise<readonly GenerationDirectoryEntry[]> {
     const entries = await fs.list(fs.rootUri)
     return entries.filter((entry) => entry.isDirectory && isHostCacheKey(entry.name))
@@ -129,26 +133,20 @@ export function createGenerationStore(options: {
     await fs.delete(hostRoot(hostKey))
   }
 
-  async function enforceHostLimit(index: Map<string, number>, activated: string): Promise<void> {
+  async function enforceHostLimit(order: readonly string[]): Promise<void> {
     const hosts = await listActivatedHosts()
-    const present = new Set(hosts)
-    for (const key of Array.from(index.keys())) {
-      if (!present.has(key)) {
-        index.delete(key)
-      }
-    }
-    // A host with no index entry sorts first: the index is recency, not truth, so a lost or
+    // A host missing from the order sorts first: the index is recency, not truth, so a lost or
     // truncated one costs eviction order rather than a generation. The host just activated is
-    // never a candidate, because `now()` is a wall clock: one backward jump would otherwise make
-    // the newest entry the oldest and evict the tree the caller is about to open.
-    const candidates = hosts
-      .filter((host) => host !== activated)
-      .sort((left, right) => (index.get(left) ?? 0) - (index.get(right) ?? 0))
-    for (const host of candidates.slice(0, Math.max(0, hosts.length - MAX_CACHED_HOSTS))) {
+    // last, so it is never among the evicted.
+    const evicted = new Set(
+      [...hosts]
+        .sort((left, right) => order.indexOf(left) - order.indexOf(right))
+        .slice(0, Math.max(0, hosts.length - MAX_CACHED_HOSTS))
+    )
+    for (const host of evicted) {
       await dropHostTree(host)
-      index.delete(host)
     }
-    await writeHostIndex(index)
+    await writeHostOrder(order.filter((key) => hosts.includes(key) && !evicted.has(key)))
   }
 
   async function readActive(hostKey: string): Promise<ActiveGeneration | null> {
@@ -242,12 +240,9 @@ export function createGenerationStore(options: {
       existing?.isDirectory === true &&
       (await fs.fileExists(joinUri(target, MANIFEST_FILE_NAME)))
     ) {
-      // Still an activation, so it still counts as use: without this a host that redownloads the
-      // bundle it already has stays the least recently activated and is evicted first. No eviction
-      // pass, because the host count did not change.
-      const index = await readHostIndex()
-      index.set(staged.hostKey, now())
-      await writeHostIndex(index)
+      // Still an activation: without this a host that redownloads the bundle it already has stays
+      // the least recently used and is evicted first.
+      await touchHost(staged.hostKey)
       await fs.delete(staged.directory)
       return active
     }
@@ -271,10 +266,17 @@ export function createGenerationStore(options: {
       await fs.delete(target)
       throw new Error(`generation ${staged.buildId} did not carry its manifest through the rename`)
     }
-    const index = await readHostIndex()
-    index.set(staged.hostKey, now())
-    // Enforced here rather than left to a caller: the four-host ceiling is this module's invariant.
-    await enforceHostLimit(index, staged.hostKey)
+    // Enforced here rather than left to a caller: the host ceiling is this module's invariant.
+    await enforceHostLimit(withHostLast(await readHostOrder(), staged.hostKey))
+    return active
+  }
+
+  async function openActive(hostKey: string): Promise<ActiveGeneration | null> {
+    const active = await readActive(hostKey)
+    // An open is use, so a daily host downloaded long ago is not evicted first.
+    if (active !== null) {
+      await touchHost(hostKey)
+    }
     return active
   }
 
@@ -304,9 +306,9 @@ export function createGenerationStore(options: {
 
   async function deleteHost(hostKey: string): Promise<void> {
     await dropHostTree(hostKey)
-    const index = await readHostIndex()
-    if (index.delete(hostKey)) {
-      await writeHostIndex(index)
+    const order = await readHostOrder()
+    if (order.includes(hostKey)) {
+      await writeHostOrder(order.filter((key) => key !== hostKey))
     }
   }
 
@@ -322,7 +324,7 @@ export function createGenerationStore(options: {
   }
 
   return {
-    readActiveGeneration: (hostKey) => serialize(() => readActive(hostKey)),
+    readActiveGeneration: (hostKey) => serialize(() => openActive(hostKey)),
     stageGeneration: (hostKey, result) => serialize(() => stage(hostKey, result)),
     commitGeneration: (staged) => serialize(() => commit(staged)),
     abortStagedGeneration: (staged) =>
@@ -339,6 +341,10 @@ export function createGenerationStore(options: {
   }
 }
 
+function withHostLast(order: readonly string[], hostKey: string): string[] {
+  return [...order.filter((key) => key !== hostKey), hostKey]
+}
+
 function parseJson(text: string): unknown {
   try {
     return JSON.parse(text)
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-back-claim-state.test.ts b/mobile/src/mobile-web-shell/mobile-web-shell-back-claim-state.test.ts
index 29c0d802860..b75cd2b5447 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-back-claim-state.test.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-back-claim-state.test.ts
@@ -13,7 +13,7 @@ describe('the page claiming the device Back key', () => {
   function claimed(): MobileWebShellStep {
     return run(
       readySession().session,
-      { type: 'page-ready', reports: [], accepts: [] },
+      { type: 'page-ready' },
       { type: 'page-back-claim', claimed: true }
     )
   }
@@ -38,7 +38,7 @@ describe('the page claiming the device Back key', () => {
   })
 
   it('drops it when the document asks for a session again, so the page has to claim again', () => {
-    const reasked = run(claimed().session, { type: 'page-ready', reports: [], accepts: [] })
+    const reasked = run(claimed().session, { type: 'page-ready' })
     expect(shellPageBackClaimed(reasked.session)).toBe(false)
   })
 
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-failed-update-fallback.test.ts b/mobile/src/mobile-web-shell/mobile-web-shell-failed-update-fallback.test.ts
index 7814b33c73f..3ae35fc7a6e 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-failed-update-fallback.test.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-failed-update-fallback.test.ts
@@ -122,6 +122,7 @@ function manifestOf(
     buildId: computeMobileWebBundleId(assets),
     minCompatibleRuntimeProtocolVersion: 2,
     runtimeProtocolVersion,
+    pageVersion: 1,
     entrypoint: 'index.html',
     totalBytes: TOTAL_BYTES,
     assets,
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-flag-census.test.ts b/mobile/src/mobile-web-shell/mobile-web-shell-flag-census.test.ts
deleted file mode 100644
index fd23a133375..00000000000
--- a/mobile/src/mobile-web-shell/mobile-web-shell-flag-census.test.ts
+++ /dev/null
@@ -1,207 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join, relative } from 'node:path'
-import { describe, expect, it } from 'vitest'
-import { censusSourceFiles } from '../test-support/census-source-files'
-
-/**
- * The hybrid shell flag is the whole of what keeps this feature dark in a native build, so who
- * touches it is a product invariant rather than a convention. A second reader is how a dark feature
- * stops being dark: a launch-time sweep, a prefetch or a menu item that consults the flag would run
- * in a native store build the moment anything flipped it, and none of those would fail a type
- * check.
- *
- * The build-kind fact is the same shape of invariant one level up. `EXPO_PUBLIC_MOBILE_SHELL` is
- * what a release workflow sets to build the OTA binary, and a second module spelling it would be a
- * second answer to "is this the page's build" that no type check would catch either.
- */
-const MOBILE_ROOT = join(import.meta.dirname, '..', '..')
-const FLAG_KEY = 'orca:mobileWebShellEnabled'
-/** The inlined form. Prose may name the variable; this is the spelling that reads it. */
-const BUILD_SWITCH_READ = 'process.env.EXPO_PUBLIC_'
-/** The other spelling Expo's plugin inlines, which is how the rule above would be evaded. */
-const BUILD_SWITCH_BRACKET_READ = "process.env['EXPO_PUBLIC_"
-const DEFINITION = 'src/storage/preferences.ts'
-/** The one product reader, which only the shared switch decision asks. */
-const FLAG_HOOK = 'src/mobile-web-shell/use-mobile-web-shell-enabled.ts'
-/** The one caller of that hook: every route asks this instead, so its list is the whole census. */
-const DECISION = 'src/mobile-web-shell/shell-switch-decision.ts'
-const ROUTE = 'app/h/[hostId]/web.tsx'
-const HOST_ROUTE = 'app/h/[hostId]/index.tsx'
-const AGENT_HISTORY_ROUTE = 'app/h/[hostId]/agent-history/[worktreeId].tsx'
-const TASKS_ROUTE = 'app/h/[hostId]/tasks.tsx'
-const FILES_ROUTE = 'app/h/[hostId]/files/[worktreeId].tsx'
-const FILES_PREVIEW_ROUTE = 'app/h/[hostId]/files/preview/[worktreeId].tsx'
-const SOURCE_CONTROL_ROUTE = 'app/h/[hostId]/source-control/[worktreeId].tsx'
-const REVIEW_ROUTE = 'app/h/[hostId]/review/[worktreeId].tsx'
-const SESSION_ROUTE = 'app/h/[hostId]/session/[worktreeId].tsx'
-/** The one switch with no native screen behind it; its route file only re-exports this body. */
-const CATCH_ALL_ROUTE = 'src/mobile-web-shell/catch-all-page-route.tsx'
-/** What a switch paints while the decision is `pending`, and the third thing every switch names. */
-const PENDING_SCREEN = 'src/mobile-web-shell/ShellSwitchPendingScreen.tsx'
-/** One entry per screen the flag can switch to the page, which is what a review reads. */
-const SWITCHED_ROUTES = [
-  HOST_ROUTE,
-  AGENT_HISTORY_ROUTE,
-  TASKS_ROUTE,
-  FILES_ROUTE,
-  FILES_PREVIEW_ROUTE,
-  SOURCE_CONTROL_ROUTE,
-  REVIEW_ROUTE,
-  SESSION_ROUTE,
-  CATCH_ALL_ROUTE
-]
-const DEVELOPER_ROW = 'src/diagnostics/mobile-web-shell-dev-row.tsx'
-/** The one screen that decides whether that row mounts, which is a build-kind question. */
-const TROUBLESHOOT_ROUTE = 'app/troubleshoot.tsx'
-/** Every tree that ships in the app bundle, with the floor each must clear. `modules` is two files,
- *  but it is where the native view lives and so the easiest place for a second reader to hide. */
-const TREES = { src: 200, app: 10, modules: 1 }
-const SHELL_VIEW = 'modules/orca-mobile-web-shell/src/index.ts'
-
-function sourceFiles(directory: string): string[] {
-  return censusSourceFiles(join(MOBILE_ROOT, directory))
-    .map((path) => relative(MOBILE_ROOT, path))
-    .filter((path) => /\.tsx?$/.test(path) && !path.includes('.test.'))
-}
-
-const SOURCES = Object.keys(TREES)
-  .flatMap((tree) => sourceFiles(tree))
-  .map((path) => ({
-    path: path.split('\\').join('/'),
-    text: readFileSync(join(MOBILE_ROOT, path), 'utf8')
-  }))
-
-function filesContaining(needle: string): string[] {
-  return SOURCES.filter((file) => file.text.includes(needle))
-    .map((file) => file.path)
-    .sort()
-}
-
-/**
- * The same matches with the line each was read off, as the failure message for the rules below.
- *
- * A census that answers only with paths tells a reader which file is wrong and nothing about what
- * in it is: the needles here are identifiers, and a file can name one in an import, a call or a
- * comment. The snippet is what turns "this list moved" into the edit that moved it.
- */
-function matchesOf(needle: string): string {
-  // Sorted by path then by line number, not as text: `:59:` sorts before `:4:` as a string, which
-  // reads as a file whose matches are out of order.
-  return [...SOURCES]
-    .sort((left, right) => left.path.localeCompare(right.path))
-    .flatMap((file) =>
-      file.text
-        .split('\n')
-        .flatMap((line, index) =>
-          line.includes(needle) ? [`${file.path}:${index + 1}: ${line.trim()}`] : []
-        )
-    )
-    .join('\n')
-}
-
-describe('who touches the hybrid shell flag', () => {
-  it('reaches every shipped tree, so the absence assertions below cannot pass vacuously', () => {
-    const paths = SOURCES.map((file) => file.path)
-    expect(paths).toContain(DEFINITION)
-    expect(paths).toContain(FLAG_HOOK)
-    expect(paths).toContain(DECISION)
-    expect(paths).toContain(PENDING_SCREEN)
-    expect(paths).toContain(ROUTE)
-    for (const route of SWITCHED_ROUTES) {
-      expect(paths).toContain(route)
-    }
-    expect(paths).toContain(DEVELOPER_ROW)
-    expect(paths).toContain(TROUBLESHOOT_ROUTE)
-    expect(paths).toContain(SHELL_VIEW)
-    const trees = Object.keys(TREES)
-    for (const [tree, floor] of Object.entries(TREES)) {
-      expect(paths.filter((path) => path.startsWith(`${tree}/`)).length).toBeGreaterThan(floor)
-    }
-    expect(paths.filter((path) => !trees.some((tree) => path.startsWith(`${tree}/`)))).toEqual([])
-  })
-
-  it('keeps the storage key itself in one module', () => {
-    expect(filesContaining(FLAG_KEY)).toEqual([DEFINITION])
-  })
-
-  it('reads the build-time switch in one module', () => {
-    // `babel-preset-expo` inlines an `EXPO_PUBLIC_*` variable only where it is spelled as a
-    // literal member expression of `process.env`, so a second read is a second literal to keep in
-    // step with the workflow input — and a value copied out into a binding is not rewritten at
-    // all, which reads `undefined` on a device and answers native in a build that is not.
-    //
-    // Prose is not a read: the docblocks that name the variable are how a reader finds this
-    // module, and pinning them would make every wording change a census failure.
-    expect(filesContaining(BUILD_SWITCH_READ), matchesOf(BUILD_SWITCH_READ)).toEqual([DEFINITION])
-    expect(
-      filesContaining(BUILD_SWITCH_BRACKET_READ),
-      matchesOf(BUILD_SWITCH_BRACKET_READ)
-    ).toEqual([])
-  })
-
-  it('answers the build kind through one named function, asked by the flag and the row label', () => {
-    expect(filesContaining('mobileShellBuildKind'), matchesOf('mobileShellBuildKind')).toEqual(
-      [DEFINITION, DEVELOPER_ROW].sort()
-    )
-  })
-
-  it('is read by one hook and by the developer row that writes it, and nowhere else', () => {
-    expect(filesContaining('loadMobileWebShellEnabled')).toEqual(
-      [DEFINITION, DEVELOPER_ROW, FLAG_HOOK].sort()
-    )
-  })
-
-  it('is read by the shared switch decision and by nothing else', () => {
-    // The narrowest this has ever been, and the reason the rule below is total: a route cannot
-    // hold a private opinion about the flag — including about the window where it is still `null`
-    // — without reading it, and this is the only place that reads it.
-    expect(
-      filesContaining('useMobileWebShellEnabled'),
-      matchesOf('useMobileWebShellEnabled')
-    ).toEqual([DECISION, FLAG_HOOK].sort())
-  })
-
-  it('reaches the switched routes through that decision and no others', () => {
-    // Each switched route is a screen the flag decides the renderer of, and one more is one more
-    // place a dark feature could turn itself on. The list grows once per domain series, in the PR
-    // that switches the route file to MobileWebShellScreen, and never as a side effect of anything
-    // else. A switched route is inert until MOBILE_WEB_PAGE_ROUTES lists it as well, so an entry
-    // here can land a PR ahead of that one.
-    expect(filesContaining('useShellSwitchDecision'), matchesOf('useShellSwitchDecision')).toEqual(
-      [DECISION, ROUTE, ...SWITCHED_ROUTES].sort()
-    )
-  })
-
-  it('gives every one of them the same neutral state to paint while the flag is unresolved', () => {
-    // The rule a sixth switch would otherwise regress past. Reading the flag through the decision
-    // is not on its own enough: a switch that ignored `pending` and fell through to its native
-    // screen would satisfy the rule above and still flash native in front of a flag-on user. This
-    // one says every switch names the neutral screen, which is existence rather than shape — where
-    // it names it is the route test's business, and `shell-switch-null-flag.test.tsx` drives all
-    // nine through the states themselves.
-    expect(
-      filesContaining('ShellSwitchPendingScreen'),
-      matchesOf('ShellSwitchPendingScreen')
-    ).toEqual([PENDING_SCREEN, ROUTE, ...SWITCHED_ROUTES].sort())
-  })
-
-  it('fences the build kind in one place, which the read, the hook and the row gate ask', () => {
-    // The test that makes a native store build unable to turn the flag on: `__DEV__`, or a binary
-    // built with the switch set to `ota`. The hook starts its state on it so a native release
-    // build never reaches the neutral state, which is the same answer `loadMobileWebShellEnabled`
-    // gives one render later — and two spellings of one build-kind test are two things to keep
-    // true, where this feature's darkness rests on exactly one.
-    //
-    // The Troubleshoot route asks the same question to decide whether to mount the toggle, which
-    // is the one place a user can switch an OTA build back to the native screens. Asking it rather
-    // than re-deriving it is why that row and the flag can never disagree about the build.
-    expect(
-      filesContaining('mobileWebShellFlagCanBeOn'),
-      matchesOf('mobileWebShellFlagCanBeOn')
-    ).toEqual([DEFINITION, FLAG_HOOK, TROUBLESHOOT_ROUTE].sort())
-  })
-
-  it('is written only by the developer row', () => {
-    expect(filesContaining('saveMobileWebShellEnabled')).toEqual([DEFINITION, DEVELOPER_ROW].sort())
-  })
-})
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-gates.ts b/mobile/src/mobile-web-shell/mobile-web-shell-gates.ts
index 9850161ff20..26e50574309 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-gates.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-gates.ts
@@ -65,8 +65,8 @@ export function gateVerdict(gates: MobileWebShellGates): MobileWebShellGateVerdi
   }
   // Never a wall on an unreadable status: the empty capability list it leaves behind is
   // indistinguishable from a desktop that ships no bundle, and that wall tells the wrong story. It
-  // is not a wait either — the gate settles once per host screen and does not probe again — so the
-  // one honest answer is to say the status could not be read and let a fresh gate reopen it.
+  // is not a wait either — the gate settles closed and only re-asks in the background — so the one
+  // honest answer is to say the status could not be read; a later readable status reopens it.
   if (!gates.statusReadable) {
     return { kind: 'status-unreadable' }
   }
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-keyboard-overlay-screen.test.tsx b/mobile/src/mobile-web-shell/mobile-web-shell-keyboard-overlay-screen.test.tsx
new file mode 100644
index 00000000000..2303b0b9e47
--- /dev/null
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-keyboard-overlay-screen.test.tsx
@@ -0,0 +1,109 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const harness = await vi.hoisted(async () => await import('./mobile-web-shell-screen-test-harness'))
+const dependencies = vi.hoisted(() => harness.createScreenDependencies())
+
+const { screenModuleMocks } = await vi.hoisted(
+  async () => await import('./mobile-web-shell-screen-test-mocks')
+)
+const mocks = vi.hoisted(() => screenModuleMocks(dependencies))
+vi.mock('react-native', mocks['react-native'])
+vi.mock('expo-clipboard', mocks['expo-clipboard'])
+vi.mock('expo-haptics', mocks['expo-haptics'])
+vi.mock('expo-document-picker', mocks['expo-document-picker'])
+vi.mock('@orca/expo-two-way-audio', mocks['@orca/expo-two-way-audio'])
+vi.mock('expo-keep-awake', mocks['expo-keep-awake'])
+vi.mock('expo-image-picker', mocks['expo-image-picker'])
+vi.mock('expo-file-system', mocks['expo-file-system'])
+vi.mock('lucide-react-native', mocks['lucide-react-native'])
+vi.mock('react-native-safe-area-context', mocks['react-native-safe-area-context'])
+vi.mock('expo-router', mocks['expo-router'])
+vi.mock('../../modules/orca-mobile-web-shell/src', mocks['../../modules/orca-mobile-web-shell/src'])
+vi.mock('../app-update/use-wall-app-update', mocks['../app-update/use-wall-app-update'])
+vi.mock('../transport/client-context', mocks['../transport/client-context'])
+vi.mock('./use-page-host-snapshot', mocks['./use-page-host-snapshot'])
+vi.mock('./use-mobile-web-shell-session', mocks['./use-mobile-web-shell-session'])
+
+import { act } from 'react-test-renderer'
+import { clientFrame, createFakeRpcClient } from './bridge-host-test-fakes'
+import {
+  byName,
+  readyState,
+  renderScreen as mountScreen
+} from './mobile-web-shell-screen-test-harness'
+import { readBridgeHostMessage } from './bridge/bridge-envelope'
+import { MobileWebShellScreen } from './MobileWebShellScreen'
+import type { MobileWebShellSessionState } from './mobile-web-shell-session-contract'
+import type { ReactTestRenderer } from 'react-test-renderer'
+
+const renderScreen = (state: MobileWebShellSessionState): Promise<ReactTestRenderer> =>
+  mountScreen(MobileWebShellScreen, dependencies, state)
+
+afterEach(harness.unmountRenderedScreens)
+
+beforeEach(() => {
+  harness.resetScreenDependencies(dependencies)
+})
+
+const WINDOW = { top: 44, right: 0, bottom: 8, left: 0 }
+
+/**
+ * The page is covered by the keyboard like a native screen: the view keeps its size, and the page
+ * is told the height on every keyboard event.
+ */
+describe('a page the keyboard covers', () => {
+  async function openPage(sessionId: string) {
+    dependencies.client = createFakeRpcClient()
+    const tree = await renderScreen(readyState(sessionId))
+    await act(async () => {
+      byName(tree, 'ShellViewProbe')[0]?.props.onBridgeMessage({
+        nativeEvent: { json: clientFrame({ type: 'ready' }) }
+      })
+    })
+    const root = () => tree.root.find((node) => node.props.testID === 'mobile-web-shell-ready')
+    const inits = () =>
+      dependencies.posted.flatMap((json) => {
+        const read = readBridgeHostMessage(json)
+        return read.ok && read.message.type === 'init'
+          ? [{ keyboard: read.message.keyboardInset ?? 0, insets: read.message.safeAreaInsets }]
+          : []
+      })
+    const keyboard = async (height: number) => {
+      await act(async () => {
+        const ios = dependencies.platform === 'ios'
+        const name =
+          height > 0
+            ? ios
+              ? 'keyboardWillShow'
+              : 'keyboardDidShow'
+            : ios
+              ? 'keyboardWillHide'
+              : 'keyboardDidHide'
+        dependencies.keyboardListeners.get(name)?.({ endCoordinates: { height } })
+      })
+    }
+    return { root, inits, keyboard }
+  }
+
+  for (const platform of ['ios', 'android'] as const) {
+    it(`never shortens the view, and publishes show, a height change and hide (${platform})`, async () => {
+      dependencies.platform = platform
+      const page = await openPage(`session-overlay-${platform}`)
+      // Pixel_API_37: 312 up, 346 with the suggestion strip, then closed. The inset tracks each, so
+      // a keyboard that changes height while open leaves no gap above it.
+      for (const height of [312, 346, 0]) {
+        await page.keyboard(height)
+        expect(page.root().props.style[1]).toEqual({ paddingTop: 0 })
+      }
+      // The keyboard's own height as native screens read it on this OS, home indicator included on
+      // iOS; the page's arithmetic branches on the shell's OS, as native does. The bottom inset
+      // stays the window's.
+      expect(page.inits()).toEqual([
+        { keyboard: 0, insets: WINDOW },
+        { keyboard: 312, insets: WINDOW },
+        { keyboard: 346, insets: WINDOW },
+        { keyboard: 0, insets: WINDOW }
+      ])
+    })
+  }
+})
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-offline-grant-staleness.test.ts b/mobile/src/mobile-web-shell/mobile-web-shell-offline-grant-staleness.test.ts
index c39c5560464..1fb8acee474 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-offline-grant-staleness.test.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-offline-grant-staleness.test.ts
@@ -110,6 +110,7 @@ function manifestGranting(
     buildId: BUILD_ID,
     minCompatibleRuntimeProtocolVersion: 2,
     runtimeProtocolVersion: 5,
+    pageVersion: 1,
     entrypoint: 'index.html',
     totalBytes: TOTAL_BYTES,
     assets: ASSETS,
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-router-seam-census.test.ts b/mobile/src/mobile-web-shell/mobile-web-shell-router-seam-census.test.ts
deleted file mode 100644
index e7d8b6c00d3..00000000000
--- a/mobile/src/mobile-web-shell/mobile-web-shell-router-seam-census.test.ts
+++ /dev/null
@@ -1,94 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import {
-  callsRouteHandoff,
-  expoRouterValueImports,
-  parse,
-  productFiles
-} from '../navigation/router-seam-census.test-support'
-
-const SHELL_ROOT = import.meta.dirname
-
-/**
- * The tree that is both halves of the handoff, which is why it needs its own census.
- *
- * Every other domain here is page code: a screen the shell may serve, where expo-router's own
- * router posts no `navigate` and a target outside the page paints Unmatched over it. This tree is
- * different — it holds the app end of the seam as well, so the rule cannot be "no router" and has
- * to name which modules are the app end.
- *
- * It is also the tree where the gap showed: `PageRouteUnavailableScreen` shipped with a bare
- * `useRouter` and nothing caught it, because the three landed censuses walk `src/session`,
- * `src/files` and `src/source-control` and this tree had none.
- */
-
-/**
- * The two modules that ARE the app end of the handoff, and so hold expo-router's own router.
- *
- * `MobileWebShellScreen` is what hosts the page; its `router.push` is the `onNavigate` the page's
- * `navigate` notify arrives at, so routing it through the seam would hand the page's target back to
- * the page. `useShellStackPop` is the same for `onNavigateBack`: it pops the native stack the shell
- * was pushed onto. Neither has a `.web.*` sibling and neither can run inside the page — the page has
- * no shell within it — so neither is a screen the seam exists for.
- */
-const SHELL_SIDE_ROUTER_HOLDERS = ['MobileWebShellScreen.tsx', 'use-shell-stack-pop.ts']
-
-/**
- * The screens here that render on the page and therefore must reach the router through the seam.
- *
- * One today. `PageRouteUnavailableScreen` is rendered by the catch-all on the device and by its
- * `.web.tsx` sibling inside the page, so a bare replace there navigates within the WebView to a
- * route the page does not carry instead of leaving it.
- */
-const ROUTER_HOLDERS = ['PageRouteUnavailableScreen.tsx']
-
-/**
- * The expo-router names this tree may import outside those two, and why none is a router.
- *
- * `useLocalSearchParams` reads the params of the route already mounted and `usePathname` reads
- * which route that is. Neither takes a target, so neither can put a screen in front of the page.
- *
- * A closed list rather than a ban on `useRouter`, for the reason the session census gives:
- * expo-router also exports a module-singleton `router` that navigates from a plain function, and a
- * rule written against the one spelling would read that as clean.
- */
-const NON_NAVIGATING_ROUTER_NAMES = ['useLocalSearchParams', 'usePathname']
-
-describe('the mobile-web-shell tree reaches the router through the handoff seam', () => {
-  const files = productFiles(SHELL_ROOT)
-
-  it('walks the modules it is written against, so the empty list below means something', () => {
-    expect(files).toEqual(expect.arrayContaining(SHELL_SIDE_ROUTER_HOLDERS))
-    expect(files).toEqual(expect.arrayContaining(ROUTER_HOLDERS))
-    // The whole tree, not the five files that touch a router: a walk that collapsed to those would
-    // report an empty finding list for a domain it never read.
-    expect(files.length).toBeGreaterThan(60)
-  })
-
-  it('imports nothing from expo-router that can navigate, outside the two that are the seam', () => {
-    const offenders = files
-      .filter((name) => !SHELL_SIDE_ROUTER_HOLDERS.includes(name))
-      .map((name) => ({
-        name,
-        imported: expoRouterValueImports(parse(SHELL_ROOT, name)).filter(
-          (imported) => !NON_NAVIGATING_ROUTER_NAMES.includes(imported)
-        )
-      }))
-      .filter((entry) => entry.imported.length > 0)
-      .map((entry) => `${entry.name} (${entry.imported.join(', ')})`)
-    expect(offenders).toEqual([])
-  })
-
-  it('takes the router from useRouteHandoff at every screen the page renders', () => {
-    expect(files.filter((name) => callsRouteHandoff(parse(SHELL_ROOT, name))).sort()).toEqual(
-      [...ROUTER_HOLDERS].sort()
-    )
-  })
-
-  it('still holds a real router at the app end, which is what the exemption is for', () => {
-    // The completeness half: the rule above also passes over a tree whose two seam modules stopped
-    // navigating at all, which is what it would read as if someone moved them and left this list.
-    for (const name of SHELL_SIDE_ROUTER_HOLDERS) {
-      expect(expoRouterValueImports(parse(SHELL_ROOT, name)), name).toContain('useRouter')
-    }
-  })
-})
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-safe-area-screen.test.tsx b/mobile/src/mobile-web-shell/mobile-web-shell-safe-area-screen.test.tsx
index e8fcf93aad7..678253ce146 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-safe-area-screen.test.tsx
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-safe-area-screen.test.tsx
@@ -19,6 +19,7 @@ vi.mock('lucide-react-native', mocks['lucide-react-native'])
 vi.mock('react-native-safe-area-context', mocks['react-native-safe-area-context'])
 vi.mock('expo-router', mocks['expo-router'])
 vi.mock('../../modules/orca-mobile-web-shell/src', mocks['../../modules/orca-mobile-web-shell/src'])
+vi.mock('../app-update/use-wall-app-update', mocks['../app-update/use-wall-app-update'])
 vi.mock('../transport/client-context', mocks['../transport/client-context'])
 vi.mock('./use-page-host-snapshot', mocks['./use-page-host-snapshot'])
 vi.mock('./use-mobile-web-shell-session', mocks['./use-mobile-web-shell-session'])
@@ -31,8 +32,6 @@ import {
   renderScreen as mountScreen
 } from './mobile-web-shell-screen-test-harness'
 import { readBridgeHostMessage } from './bridge/bridge-envelope'
-import { BRIDGE_ROUTE_UPDATE_ACCEPT } from './bridge/bridge-route-update'
-import { BRIDGE_SAFE_AREA_ACCEPT } from './bridge/bridge-safe-area-insets'
 import { MobileWebShellScreen } from './MobileWebShellScreen'
 import type { MobileWebShellSessionState } from './mobile-web-shell-session-contract'
 import type { ReactTestRenderer } from 'react-test-renderer'
@@ -47,16 +46,16 @@ beforeEach(() => {
 })
 
 /**
- * A page that pads for the system bars itself gets the whole window, like a native screen: it
+ * Every page pads for the system bars itself and gets the whole window, like a native screen: it
  * paints under both bars and its SafeAreaViews pad by the insets `init` carries.
  */
 describe('a page that owns its safe area', () => {
-  async function openPage(sessionId: string, accepts: readonly string[]) {
+  async function openPage(sessionId: string) {
     dependencies.client = createFakeRpcClient()
     const tree = await renderScreen(readyState(sessionId))
     await act(async () => {
       byName(tree, 'ShellViewProbe')[0]?.props.onBridgeMessage({
-        nativeEvent: { json: clientFrame({ type: 'ready', accepts }) }
+        nativeEvent: { json: clientFrame({ type: 'ready' }) }
       })
     })
     const root = () => tree.root.find((node) => node.props.testID === 'mobile-web-shell-ready')
@@ -65,73 +64,31 @@ describe('a page that owns its safe area', () => {
         const read = readBridgeHostMessage(json)
         return read.ok && read.message.type === 'init' ? [read.message.safeAreaInsets ?? null] : []
       })
-    const keyboard = async (height: number) => {
-      await act(async () => {
-        const ios = dependencies.platform === 'ios'
-        const name =
-          height > 0
-            ? ios
-              ? 'keyboardWillShow'
-              : 'keyboardDidShow'
-            : ios
-              ? 'keyboardWillHide'
-              : 'keyboardDidHide'
-        dependencies.keyboardListeners.get(name)?.({ endCoordinates: { height } })
-      })
-    }
-    return { tree, root, initInsets, keyboard }
-  }
-  const ownedPage = (sessionId: string) => {
-    dependencies.pageOwnsSafeArea = true
-    return openPage(sessionId, [BRIDGE_ROUTE_UPDATE_ACCEPT, BRIDGE_SAFE_AREA_ACCEPT])
+    return { tree, root, initInsets }
   }
+  // A `ready` that declares nothing: every page the shell serves reads the insets.
+  const ownedPage = openPage
   const WINDOW = { top: 44, right: 0, bottom: 8, left: 0 }
 
   it('draws the view edge-to-edge and hands the page the insets it now sits under', async () => {
     const page = await ownedPage('session-owned')
-    expect(page.root().props.style[1]).toEqual({ paddingTop: 0, paddingBottom: 0 })
+    expect(page.root().props.style[1]).toEqual({ paddingTop: 0 })
     expect(page.initInsets()).toEqual([WINDOW])
   })
 
-  it('re-sends init with no bottom inset while the keyboard ends the view', async () => {
-    const page = await ownedPage('session-owned-keyboard')
-    await page.keyboard(336)
-    // The view ends at the keyboard's top, so nothing of it is under the gesture bar.
-    expect(page.root().props.style[1]).toEqual({ paddingTop: 0, paddingBottom: 336 })
-    await page.keyboard(0)
-    expect(page.root().props.style[1]).toEqual({ paddingTop: 0, paddingBottom: 0 })
-    expect(page.initInsets()).toEqual([WINDOW, { ...WINDOW, bottom: 0 }, WINDOW])
-  })
-
-  it('does the same on Android, where the IME strip is measured above the gesture bar', async () => {
-    dependencies.platform = 'android'
-    const page = await ownedPage('session-owned-android')
-    await page.keyboard(336)
-    expect(page.root().props.style[1]).toEqual({ paddingTop: 0, paddingBottom: 344 })
-    await page.keyboard(0)
-    expect(page.root().props.style[1]).toEqual({ paddingTop: 0, paddingBottom: 0 })
-    expect(page.initInsets()).toEqual([WINDOW, { ...WINDOW, bottom: 0 }, WINDOW])
-  })
-
   it('gives the status bar strip to the update banner while it shows', async () => {
     dependencies.updateNotice = 'update-failed'
     const page = await ownedPage('session-owned-banner')
-    expect(page.root().props.style[1]).toEqual({ paddingTop: 44, paddingBottom: 0 })
+    expect(page.root().props.style[1]).toEqual({ paddingTop: 44 })
     expect(page.initInsets()).toEqual([{ ...WINDOW, top: 0 }])
+    const dismiss = byName(page.tree, 'Pressable').find(
+      (node) => node.props.accessibilityLabel === 'Dismiss notice'
+    )
+    expect(dismiss).toBeDefined()
     await act(async () => {
-      byName(page.tree, 'Pressable')
-        .find((node) => node.props.accessibilityLabel === 'Dismiss notice')
-        ?.props.onPress()
+      dismiss?.props.onPress()
     })
-    expect(page.root().props.style[1]).toEqual({ paddingTop: 0, paddingBottom: 0 })
+    expect(page.root().props.style[1]).toEqual({ paddingTop: 0 })
     expect(page.initInsets()).toEqual([{ ...WINDOW, top: 0 }, WINDOW])
   })
-
-  it('sends no second init to an older page that takes route updates but not insets', async () => {
-    const page = await openPage('session-older', [BRIDGE_ROUTE_UPDATE_ACCEPT])
-    await page.keyboard(336)
-    await page.keyboard(0)
-    expect(page.root().props.style[1]).toEqual({ paddingTop: 44, paddingBottom: 8 })
-    expect(page.initInsets()).toHaveLength(1)
-  })
 })
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-safe-area-state.test.ts b/mobile/src/mobile-web-shell/mobile-web-shell-safe-area-state.test.ts
deleted file mode 100644
index 0ea58b85b0b..00000000000
--- a/mobile/src/mobile-web-shell/mobile-web-shell-safe-area-state.test.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { readySession, run } from './mobile-web-shell-session-test-fixtures'
-import { BRIDGE_SAFE_AREA_ACCEPT } from './bridge/bridge-safe-area-insets'
-import { shellPageOwnsSafeArea } from './page-document-state'
-
-/** Whether the shell may draw the view edge-to-edge, which only the document on screen can say. */
-describe('the page declaring it pads for the system bars', () => {
-  const owned = () =>
-    run(readySession().session, {
-      type: 'page-ready',
-      reports: [],
-      accepts: [BRIDGE_SAFE_AREA_ACCEPT]
-    })
-
-  it('is read off the ready that declared it', () => {
-    expect(shellPageOwnsSafeArea(owned().session)).toBe(true)
-  })
-
-  it('is false for a page that did not declare it, which is every page before the name', () => {
-    const older = run(readySession().session, { type: 'page-ready', reports: [], accepts: [] })
-    expect(shellPageOwnsSafeArea(older.session)).toBe(false)
-  })
-
-  it('is dropped when a replacement document starts, so the next one has to say it again', () => {
-    expect(shellPageOwnsSafeArea(run(owned().session, { type: 'document-started' }).session)).toBe(
-      false
-    )
-  })
-
-  it('is not read once the generation is off screen', () => {
-    const failed = run(owned().session, { type: 'shell-failed', reason: 'document-load-failed' })
-    expect(shellPageOwnsSafeArea(failed.session)).toBe(false)
-  })
-})
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-screen-test-harness.tsx b/mobile/src/mobile-web-shell/mobile-web-shell-screen-test-harness.tsx
index 64135cef248..a1b81f1bdc4 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-screen-test-harness.tsx
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-screen-test-harness.tsx
@@ -55,9 +55,7 @@ export type ScreenDependencies = {
   setScreenOptions: Mock
   /** Whether the session says the page is holding the device Back key. */
   backClaimed: boolean
-  /** Whether the session says the page pads for the system bars itself. */
-  pageOwnsSafeArea: boolean
-  /** What `Platform.OS` answers, which picks the keyboard events and the IME strip. */
+  /** What `Platform.OS` answers, which picks the keyboard events. */
   platform: 'ios' | 'android'
   reportPageBackClaim: Mock
   /** Whether the mounted host would take a press, which is a page that declared it takes one. */
@@ -70,7 +68,7 @@ export const SCREEN_SNAPSHOT = {
   host: { id: 'host-1', name: 'Host One', endpoint: 'ws://host-1', lastConnected: 3 }
 }
 
-export const DEFAULT_ROUTE_GRANTS: readonly string[] = [
+const DEFAULT_ROUTE_GRANTS: readonly string[] = [
   'navigate',
   'storage',
   'externalLink',
@@ -114,7 +112,6 @@ export function createScreenDependencies(): ScreenDependencies {
     backHandlers: new Map(),
     setScreenOptions: vi.fn(),
     backClaimed: false,
-    pageOwnsSafeArea: false,
     platform: 'ios',
     reportPageBackClaim: vi.fn(),
     sendBackDelivers: true,
@@ -154,7 +151,6 @@ export function resetScreenDependencies(dependencies: ScreenDependencies): void
   dependencies.setScreenOptions.mockReset()
   dependencies.reportPageBackClaim.mockReset()
   dependencies.backClaimed = false
-  dependencies.pageOwnsSafeArea = false
   dependencies.platform = 'ios'
   dependencies.sendBackDelivers = true
   dependencies.backSends = 0
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-screen-test-mocks.tsx b/mobile/src/mobile-web-shell/mobile-web-shell-screen-test-mocks.tsx
index c622c77f11d..02e512a355e 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-screen-test-mocks.tsx
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-screen-test-mocks.tsx
@@ -144,6 +144,8 @@ export function screenModuleMocks(dependencies: ScreenDependencies) {
         parseMobileWebShellLoadState: parseMobileWebShellLoadState
       }
     },
+    // The wall's release offer: the native hook imports the update checker module.
+    '../app-update/use-wall-app-update': () => ({ useWallAppUpdate: () => null }),
     // The real bridge hook runs, so the props it owns are the ones the view is handed here; only the
     // client lookup is stubbed, because reaching it imports the Expo runtime this test does not have.
     '../transport/client-context': () => ({
@@ -180,8 +182,7 @@ export function screenModuleMocks(dependencies: ScreenDependencies) {
         reportPageBackClaim: dependencies.reportPageBackClaim,
         pageReady: dependencies.pageReady,
         pageFrame: dependencies.pageFrame,
-        backClaimed: dependencies.backClaimed,
-        pageOwnsSafeArea: dependencies.pageOwnsSafeArea
+        backClaimed: dependencies.backClaimed
       })
     })
   }
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-session-contract.ts b/mobile/src/mobile-web-shell/mobile-web-shell-session-contract.ts
index 98f0df8a900..bfc8c5f385e 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-session-contract.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-session-contract.ts
@@ -11,11 +11,6 @@ import type {
   MobileWebShellUpdateFailureFacts
 } from './mobile-web-shell-update-failure'
 
-/** What one `ready` declared: what the page will report, and what it can be sent. */
-export type PageReadyDeclaration = {
-  readonly reports: readonly string[]
-  readonly accepts: readonly string[]
-}
 /**
  * Whether the host can be asked anything right now.
  *
@@ -218,12 +213,9 @@ export type MobileWebShellSessionEvent =
   /** The native view finished a document. Unstamped, like the view's failure and for the same
    *  reason: the view exists only under the generation on screen. */
   | { readonly type: 'document-loaded' }
-  /**
-   * The page said `ready` over the bridge, which is the only proof its code ran at all, carrying
-   * what that `ready` declared it reports and accepts.
-   */
-  | ({ readonly type: 'page-ready' } & PageReadyDeclaration)
-  /** The page has a frame on screen. Only a page that declared it ever sends one. */
+  /** The page said `ready` over the bridge, which is the only proof its code ran at all. */
+  | { readonly type: 'page-ready' }
+  /** The page has a frame on screen. */
   | { readonly type: 'page-painted' }
   /** The page is holding the device Back key, or has let it go. The host sends false on its own
    *  for every way a document ends, so this never has to be inferred from silence. */
@@ -251,9 +243,6 @@ export type MobileWebShellSession = {
   /** Whether the document on screen has spoken over the bridge. Cleared by every new document,
    *  because each one has to prove itself: the last one's word says nothing about this one. */
   readonly pageReady: boolean
-  /** Whether this document said it would report its first paint. Cleared with `pageReady`, and
-   *  false for every page built before the report existed. */
-  readonly pageReportsPaint: boolean
   /** Whether this document has reported a frame on screen. Cleared with `pageReady`. */
   readonly pagePainted: boolean
   /**
@@ -264,9 +253,6 @@ export type MobileWebShellSession = {
    * with it, which is a key that does nothing at all.
    */
   readonly pageBackClaimed: boolean
-  /** Whether this document pads for the system bars itself, so the view may go edge-to-edge.
-   *  Cleared with `pageReady`, and false for every page built before the declaration existed. */
-  readonly pageOwnsSafeArea: boolean
   /** The gates the current step was taken on; null until the first one arrives. */
   readonly gates: MobileWebShellGates | null
   readonly cached: CachedGeneration | null
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-session-effects.test.ts b/mobile/src/mobile-web-shell/mobile-web-shell-session-effects.test.ts
index 24f3e9a01b8..5777cb8173f 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-session-effects.test.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-session-effects.test.ts
@@ -20,7 +20,7 @@ import { MobileWebBundleFetchError } from '../transport/mobile-web-bundle-fetch-
 import { markRpcDeliveryUnknown } from '../transport/rpc-delivery-ambiguity'
 import type { RpcClient } from '../transport/rpc-client'
 import type { GenerationStore } from './generation-store'
-import { download, readManifest } from './mobile-web-shell-session-effects'
+import { download, openCache, readManifest } from './mobile-web-shell-session-effects'
 
 // The mocked operations never touch the client; they only need one to exist.
 const CLIENT: RpcClient = {
@@ -128,6 +128,27 @@ describe('the manifest read', () => {
   })
 })
 
+describe('the page version the floor reads', () => {
+  it('is carried from the host manifest to the reducer', async () => {
+    doubles.manifest = () => Promise.resolve({ manifest: { ...MANIFEST, pageVersion: 4 } })
+    const { events, send } = collect()
+    await readManifest(CLIENT, 3, send)
+    expect(events).toMatchObject([{ type: 'manifest-read', manifest: { pageVersion: 4 } }])
+  })
+
+  it('is carried from the cached manifest to the generation judged against the host', async () => {
+    const store: GenerationStore = {
+      ...storeThat(null),
+      readActiveGeneration: async () => ({
+        buildId: MANIFEST.buildId,
+        directory: 'd',
+        manifest: { ...MANIFEST, pageVersion: 4, routes: [] }
+      })
+    }
+    expect((await openCache(store, 'k'))?.compat.pageVersion).toBe(4)
+  })
+})
+
 describe('the download', () => {
   beforeEach(() => {
     doubles.fetch = () =>
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-session-effects.ts b/mobile/src/mobile-web-shell/mobile-web-shell-session-effects.ts
index 989f56bb99b..56f3ab554d0 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-session-effects.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-session-effects.ts
@@ -40,7 +40,9 @@ export async function openCache(
           compat: {
             schemaVersion: active.manifest.schemaVersion,
             runtimeProtocolVersion: active.manifest.runtimeProtocolVersion,
-            minCompatibleRuntimeProtocolVersion: active.manifest.minCompatibleRuntimeProtocolVersion
+            minCompatibleRuntimeProtocolVersion:
+              active.manifest.minCompatibleRuntimeProtocolVersion,
+            pageVersion: active.manifest.pageVersion
           }
         }
   } catch {
@@ -78,6 +80,7 @@ export async function readManifest(
         schemaVersion: manifest.schemaVersion,
         runtimeProtocolVersion: manifest.runtimeProtocolVersion,
         minCompatibleRuntimeProtocolVersion: manifest.minCompatibleRuntimeProtocolVersion,
+        pageVersion: manifest.pageVersion,
         totalBytes: manifest.totalBytes,
         totalAssets: manifest.assets.length,
         routes: manifest.routes,
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-session-test-fixtures.ts b/mobile/src/mobile-web-shell/mobile-web-shell-session-test-fixtures.ts
index 2151597353e..17fb655dba6 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-session-test-fixtures.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-session-test-fixtures.ts
@@ -41,6 +41,7 @@ export const MANIFEST_WIRE: MobileWebBundleManifestRead = {
   buildId: 'b'.repeat(64),
   minCompatibleRuntimeProtocolVersion: 2,
   runtimeProtocolVersion: 5,
+  pageVersion: 1,
   entrypoint: 'index.html',
   totalBytes: 4096,
   assets: [
@@ -86,6 +87,7 @@ export function manifestFacts(wire: MobileWebBundleManifestRead): MobileWebShell
     schemaVersion: wire.schemaVersion,
     runtimeProtocolVersion: wire.runtimeProtocolVersion,
     minCompatibleRuntimeProtocolVersion: wire.minCompatibleRuntimeProtocolVersion,
+    pageVersion: wire.pageVersion,
     totalBytes: wire.totalBytes,
     totalAssets: wire.assets.length,
     routes: wire.routes,
@@ -103,7 +105,8 @@ export const CACHED: CachedGeneration = {
   compat: {
     schemaVersion: MANIFEST.schemaVersion,
     runtimeProtocolVersion: MANIFEST.runtimeProtocolVersion,
-    minCompatibleRuntimeProtocolVersion: MANIFEST.minCompatibleRuntimeProtocolVersion
+    minCompatibleRuntimeProtocolVersion: MANIFEST.minCompatibleRuntimeProtocolVersion,
+    pageVersion: MANIFEST.pageVersion
   }
 }
 
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-session.test.ts b/mobile/src/mobile-web-shell/mobile-web-shell-session.test.ts
index 1cf6c0914b0..a0cf5fd0774 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-session.test.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-session.test.ts
@@ -14,7 +14,6 @@ import {
   LINK_LOST,
   withoutRecord
 } from './mobile-web-shell-session-test-fixtures'
-import { BRIDGE_PAGE_PAINTED } from './bridge/bridge-page-painted'
 import { shellPageFrame } from './shell-page-frame'
 
 describe('the gates decide whether a step is taken at all', () => {
@@ -221,6 +220,25 @@ describe('the connected flow', () => {
     })
   })
 
+  it('walls a listed route whose page is older than this shell, as a desktop to update', () => {
+    for (const manifest of [
+      { ...MANIFEST, pageVersion: 0 },
+      { ...MANIFEST, pageVersion: undefined }
+    ]) {
+      const step = run(afterCacheRead(null).session, { type: 'manifest-read', manifest })
+      expect(step.session.state).toEqual({
+        kind: 'wall',
+        verdict: {
+          kind: 'blocked',
+          reason: 'bundle-incompatible',
+          side: 'desktop',
+          pageVersion: 0,
+          requiredPageVersion: 1
+        }
+      })
+    }
+  })
+
   it('tells the page which routes it may keep, so it hands the rest back', () => {
     const step = run(afterCacheRead(null).session, { type: 'manifest-read', manifest: MANIFEST })
     expect(step.session.pageRoutes).toEqual(['/h/[hostId]'])
@@ -690,11 +708,7 @@ describe('the page has to speak for the document that loaded', () => {
   })
 
   it('arms nothing when the page spoke first, because there is nothing left to wait for', () => {
-    const step = run(
-      readySession().session,
-      { type: 'page-ready', reports: [], accepts: [] },
-      { type: 'document-loaded' }
-    )
+    const step = run(readySession().session, { type: 'page-ready' }, { type: 'document-loaded' })
     expect(step.effects).toEqual([])
     expect(step.session.pageReady).toBe(true)
   })
@@ -718,7 +732,7 @@ describe('the page has to speak for the document that loaded', () => {
     const step = run(
       readySession().session,
       { type: 'document-loaded' },
-      { type: 'page-ready', reports: [], accepts: [] },
+      { type: 'page-ready' },
       { type: 'page-ready-deadline' }
     )
     expect(step.effects).toEqual([])
@@ -737,7 +751,7 @@ describe('the page has to speak for the document that loaded', () => {
   })
 
   it('makes the second document prove itself, rather than riding the first one word', () => {
-    const spoken = run(readySession().session, { type: 'page-ready', reports: [], accepts: [] })
+    const spoken = run(readySession().session, { type: 'page-ready' })
     const remounted = run(spoken.session, { type: 'remounted', sessionId: 'session-two' })
     expect(remounted.session.pageReady).toBe(false)
     expect(run(remounted.session, { type: 'document-loaded' }).effects).toEqual([
@@ -746,11 +760,7 @@ describe('the page has to speak for the document that loaded', () => {
   })
 
   it('leaves a remounted document its own wait when the first one expires late', () => {
-    const first = run(
-      readySession().session,
-      { type: 'document-loaded' },
-      { type: 'page-ready', reports: [], accepts: [] }
-    )
+    const first = run(readySession().session, { type: 'document-loaded' }, { type: 'page-ready' })
     const armed = first.session.flow
     const second = run(
       first.session,
@@ -766,7 +776,7 @@ describe('the page has to speak for the document that loaded', () => {
   })
 
   it('makes a freshly activated generation prove itself too', () => {
-    const spoken = run(readySession().session, { type: 'page-ready', reports: [], accepts: [] })
+    const spoken = run(readySession().session, { type: 'page-ready' })
     const reactivated = run(spoken.session, {
       type: 'activated',
       generationDirectory: CACHED.directory,
@@ -784,13 +794,8 @@ describe('the page has to speak for the document that loaded', () => {
  * thing that says the view is worth showing is the page saying so.
  */
 describe('the page reporting a frame on screen', () => {
-  it('records what the ready declared and keeps the frame covered until the report', () => {
-    const spoken = run(readySession().session, {
-      type: 'page-ready',
-      reports: [BRIDGE_PAGE_PAINTED],
-      accepts: []
-    })
-    expect(spoken.session.pageReportsPaint).toBe(true)
+  it('keeps the frame covered past ready until the report', () => {
+    const spoken = run(readySession().session, { type: 'page-ready' })
     expect(spoken.session.pagePainted).toBe(false)
     expect(shellPageFrame(spoken.session)).toBe('unpainted')
     const painted = run(spoken.session, { type: 'page-painted' })
@@ -798,42 +803,15 @@ describe('the page reporting a frame on screen', () => {
     expect(shellPageFrame(painted.session)).toBe('painted')
   })
 
-  it('new shell, old page: ignores an undeclared report and uncovers on ready', () => {
-    const spoken = run(readySession().session, { type: 'page-ready', reports: [], accepts: [] })
-    const step = run(spoken.session, { type: 'page-painted' })
-    expect(step.session.pagePainted).toBe(false)
-    // Uncovered anyway: `ready` is the newest word a page built before the report can say.
-    expect(shellPageFrame(step.session)).toBe('painted')
-  })
-
-  it('re-reads the declaration on every ask, because a reload asks again', () => {
-    const declared = run(readySession().session, {
-      type: 'page-ready',
-      reports: [BRIDGE_PAGE_PAINTED],
-      accepts: []
-    })
-    const reloaded = run(declared.session, { type: 'page-ready', reports: [], accepts: [] })
-    expect(reloaded.session.pageReportsPaint).toBe(false)
-  })
-
   it('makes a remounted document report its own frame', () => {
-    const painted = run(
-      readySession().session,
-      { type: 'page-ready', reports: [BRIDGE_PAGE_PAINTED], accepts: [] },
-      { type: 'page-painted' }
-    )
+    const painted = run(readySession().session, { type: 'page-ready' }, { type: 'page-painted' })
     const remounted = run(painted.session, { type: 'remounted', sessionId: 'session-two' })
     expect(remounted.session.pagePainted).toBe(false)
-    expect(remounted.session.pageReportsPaint).toBe(false)
     expect(shellPageFrame(remounted.session)).toBe('unpainted')
   })
 
   it('makes a freshly activated generation report its own frame', () => {
-    const painted = run(
-      readySession().session,
-      { type: 'page-ready', reports: [BRIDGE_PAGE_PAINTED], accepts: [] },
-      { type: 'page-painted' }
-    )
+    const painted = run(readySession().session, { type: 'page-ready' }, { type: 'page-painted' })
     const reactivated = run(painted.session, {
       type: 'activated',
       generationDirectory: CACHED.directory,
@@ -843,24 +821,15 @@ describe('the page reporting a frame on screen', () => {
       elapsedMs: 9
     })
     expect(reactivated.session.pagePainted).toBe(false)
-    expect(reactivated.session.pageReportsPaint).toBe(false)
   })
 
   it('makes the document that replaced a painted one inside this mount report its own frame', () => {
-    const painted = run(
-      readySession().session,
-      { type: 'page-ready', reports: [BRIDGE_PAGE_PAINTED], accepts: [] },
-      { type: 'page-painted' }
-    )
+    const painted = run(readySession().session, { type: 'page-ready' }, { type: 'page-painted' })
     expect(shellPageFrame(painted.session)).toBe('painted')
     // No new session and no new generation: the view reloaded under the one already on screen.
     const restarted = run(painted.session, { type: 'document-started' })
     expect(restarted.session.pagePainted).toBe(false)
-    const reasked = run(restarted.session, {
-      type: 'page-ready',
-      reports: [BRIDGE_PAGE_PAINTED],
-      accepts: []
-    })
+    const reasked = run(restarted.session, { type: 'page-ready' })
     expect(shellPageFrame(reasked.session)).toBe('unpainted')
     expect(shellPageFrame(run(reasked.session, { type: 'page-painted' }).session)).toBe('painted')
   })
@@ -869,11 +838,7 @@ describe('the page reporting a frame on screen', () => {
     const loaded = run(readySession().session, { type: 'document-loaded' })
     expect(loaded.effects).toEqual([{ kind: 'await-page-ready' }])
     const armed = loaded.session.flow
-    const spoken = run(loaded.session, {
-      type: 'page-ready',
-      reports: [BRIDGE_PAGE_PAINTED],
-      accepts: []
-    })
+    const spoken = run(loaded.session, { type: 'page-ready' })
     const restarted = run(spoken.session, { type: 'document-started' })
     // The replacement is still loading and has said nothing, which is exactly what the retired
     // document's deadline reads as a document that never loaded.
@@ -888,9 +853,9 @@ describe('the page reporting a frame on screen', () => {
   it('keeps the frame of a document that repeats its own handshake', () => {
     const painted = run(
       readySession().session,
-      { type: 'page-ready', reports: [BRIDGE_PAGE_PAINTED], accepts: [] },
+      { type: 'page-ready' },
       { type: 'page-painted' },
-      { type: 'page-ready', reports: [BRIDGE_PAGE_PAINTED], accepts: [] }
+      { type: 'page-ready' }
     )
     // The document never restarted, so its frame is still the one on screen.
     expect(painted.session.pagePainted).toBe(true)
@@ -900,8 +865,9 @@ describe('the page reporting a frame on screen', () => {
   it('records nothing from a page whose generation is no longer on screen', () => {
     const failed = run(readySession().session, {
       type: 'shell-failed',
-      reason: 'render-process-gone'
+      reason: 'document-load-failed'
     })
+    expect(failed.session.state.kind).not.toBe('ready')
     expect(run(failed.session, { type: 'page-painted' }).session.pagePainted).toBe(false)
   })
 })
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-session.ts b/mobile/src/mobile-web-shell/mobile-web-shell-session.ts
index 5a0a25b7db6..595e1d92dfd 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-session.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-session.ts
@@ -39,10 +39,8 @@ export function createMobileWebShellSession(routePathname: string): MobileWebShe
     retriedOnce: false,
     remountedOnce: false,
     pageReady: false,
-    pageReportsPaint: false,
     pagePainted: false,
     pageBackClaimed: false,
-    pageOwnsSafeArea: false,
     gates: null,
     cached: null,
     updateNotice: null,
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-update-failure-log.test.ts b/mobile/src/mobile-web-shell/mobile-web-shell-update-failure-log.test.ts
index 832fee81e50..abd4c300bf8 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-update-failure-log.test.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-update-failure-log.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import { createFakeGenerationFileSystem } from './generation-file-system-fake'
-import { createGenerationStore } from './generation-store'
+import { createGenerationStore, MAX_CACHED_HOSTS } from './generation-store'
 import { deriveHostCacheKey } from './host-cache-key'
 import type { MobileWebShellUpdateFailure } from './mobile-web-shell-update-failure'
 import {
@@ -45,11 +45,18 @@ describe('appendUpdateFailure', () => {
   })
 
   it('holds a ceiling across hosts, evicting the oldest of all', () => {
-    const kept = appendAll(Array.from({ length: 30 }, (_, at) => failure(`host-${at}`, at)))
+    const kept = appendAll(
+      Array.from({ length: MAX_UPDATE_FAILURES + 10 }, (_, at) => failure(`host-${at}`, at))
+    )
     expect(kept).toHaveLength(MAX_UPDATE_FAILURES)
     expect(kept[0]?.at).toBe(10)
   })
 
+  // Pinned here because deriving it would make the failure log import the store that imports it.
+  it('keeps a full per-host history for every cached host', () => {
+    expect(MAX_UPDATE_FAILURES).toBe(MAX_UPDATE_FAILURES_PER_HOST * MAX_CACHED_HOSTS)
+  })
+
   it('drops a build id that is not a digest rather than keep host text', () => {
     const [entry] = appendUpdateFailure([], {
       ...failure('host-1', 0),
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-update-failure-log.ts b/mobile/src/mobile-web-shell/mobile-web-shell-update-failure-log.ts
index 357ddbe831f..dbca08f5f10 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-update-failure-log.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-update-failure-log.ts
@@ -16,8 +16,8 @@ import {
  * download from a host that fails every launch, while the file stays a few kilobytes.
  */
 export const MAX_UPDATE_FAILURES_PER_HOST = 5
-/** A ceiling across hosts too, because hosts are not otherwise bounded: four hosts' worth. */
-export const MAX_UPDATE_FAILURES = 20
+/** A ceiling across hosts too, because hosts are not otherwise bounded: six cached hosts' worth. */
+export const MAX_UPDATE_FAILURES = 30
 
 const UPDATE_FAILURE_LOG_FILE_NAME = 'update-failures.json'
 
diff --git a/mobile/src/mobile-web-shell/page-document-state.ts b/mobile/src/mobile-web-shell/page-document-state.ts
index 935f201d346..e2405f24591 100644
--- a/mobile/src/mobile-web-shell/page-document-state.ts
+++ b/mobile/src/mobile-web-shell/page-document-state.ts
@@ -1,5 +1,3 @@
-import { BRIDGE_PAGE_PAINTED } from './bridge/bridge-page-painted'
-import { BRIDGE_SAFE_AREA_ACCEPT } from './bridge/bridge-safe-area-insets'
 import type {
   MobileWebShellSession,
   MobileWebShellSessionEvent
@@ -8,10 +6,8 @@ import type {
 /** Everything one document told the shell about itself, which the next one has to say again. */
 export const CLEAR_PAGE_DOCUMENT_STATE = {
   pageReady: false,
-  pageReportsPaint: false,
   pagePainted: false,
-  pageBackClaimed: false,
-  pageOwnsSafeArea: false
+  pageBackClaimed: false
 } as const
 
 /** The three things a document reports about itself, as the reducer receives them. */
@@ -25,7 +21,7 @@ export type PageDocumentEvent = Extract<
  * view exists only under the generation on screen.
  */
 export function pageDocumentStatePatch(
-  session: Pick<MobileWebShellSession, 'state' | 'pageReportsPaint'>,
+  session: Pick<MobileWebShellSession, 'state'>,
   event: PageDocumentEvent
 ): Partial<MobileWebShellSession> {
   if (session.state.kind !== 'ready') {
@@ -35,25 +31,8 @@ export function pageDocumentStatePatch(
     return { pageBackClaimed: event.claimed }
   }
   if (event.type === 'page-ready') {
-    // Re-read on every ask rather than latched: a document that reloads inside this mount asks
-    // again, and it is the newest ask that says whether a paint report is coming. The key goes with
-    // it: the host drops the claim on the same `ready`, so a page that still holds one re-claims.
-    return {
-      pageReady: true,
-      pageReportsPaint: event.reports.includes(BRIDGE_PAGE_PAINTED),
-      pageBackClaimed: false,
-      pageOwnsSafeArea: event.accepts.includes(BRIDGE_SAFE_AREA_ACCEPT)
-    }
+    // The host drops the claim on the same `ready`, so a page that still holds one re-claims.
+    return { pageReady: true, pageBackClaimed: false }
   }
-  // Kept off a page that never said it would report: acting on an unasked-for frame would make
-  // the wait depend on a name arriving instead of on a claim the page made.
-  return session.pageReportsPaint ? { pagePainted: true } : {}
-}
-
-/** Whether the shell may draw the view edge-to-edge: gated on `ready` like the Back claim, so a
- *  declaration never outlives the document on screen. */
-export function shellPageOwnsSafeArea(
-  session: Pick<MobileWebShellSession, 'state' | 'pageOwnsSafeArea'>
-): boolean {
-  return session.state.kind === 'ready' && session.pageOwnsSafeArea
+  return { pagePainted: true }
 }
diff --git a/mobile/src/mobile-web-shell/page-haptics.test.ts b/mobile/src/mobile-web-shell/page-haptics.test.ts
index 864aeb7f007..a4abec869a3 100644
--- a/mobile/src/mobile-web-shell/page-haptics.test.ts
+++ b/mobile/src/mobile-web-shell/page-haptics.test.ts
@@ -7,7 +7,7 @@
  * `HapticFeedbackConstants` must not be written twice.
  */
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { BRIDGE_HAPTICS_KINDS, type BridgeHapticsKind } from './bridge/bridge-haptics-notify'
+import { BRIDGE_HAPTICS_KINDS } from './bridge/bridge-haptics-notify'
 
 /** Annotated rather than asserted: the platform is a two-value union and the log starts empty. */
 type MockDevice = { platform: { OS: 'ios' | 'android' }; calls: string[] }
@@ -108,10 +108,3 @@ describe('the kinds and the functions behind them', () => {
     expect(new Set(calls).size).toBe(BRIDGE_HAPTICS_KINDS.length)
   })
 })
-
-describe('the kind union', () => {
-  it('is the five the app has and nothing else', () => {
-    const kinds: readonly BridgeHapticsKind[] = BRIDGE_HAPTICS_KINDS
-    expect([...kinds]).toEqual(['mediumImpact', 'selection', 'success', 'error', 'edgeBump'])
-  })
-})
diff --git a/mobile/src/mobile-web-shell/page-safe-area-insets.test.ts b/mobile/src/mobile-web-shell/page-safe-area-insets.test.ts
index 76877567b31..e0bd1305405 100644
--- a/mobile/src/mobile-web-shell/page-safe-area-insets.test.ts
+++ b/mobile/src/mobile-web-shell/page-safe-area-insets.test.ts
@@ -5,22 +5,10 @@ const WINDOW = { top: 52, right: 12, bottom: 24, left: 12 }
 
 describe('the insets the page pads for', () => {
   it('is the window insets while nothing of the shell stands over the view', () => {
-    expect(pageSafeAreaInsets({ insets: WINDOW, keyboardInset: 0, topCovered: false })).toEqual(
-      WINDOW
-    )
-  })
-
-  it('has no bottom while the keyboard ends the view above the gesture bar', () => {
-    expect(pageSafeAreaInsets({ insets: WINDOW, keyboardInset: 360, topCovered: false })).toEqual({
-      ...WINDOW,
-      bottom: 0
-    })
+    expect(pageSafeAreaInsets({ insets: WINDOW, topCovered: false })).toEqual(WINDOW)
   })
 
   it('has no top while the shell banner takes the status bar strip', () => {
-    expect(pageSafeAreaInsets({ insets: WINDOW, keyboardInset: 0, topCovered: true })).toEqual({
-      ...WINDOW,
-      top: 0
-    })
+    expect(pageSafeAreaInsets({ insets: WINDOW, topCovered: true })).toEqual({ ...WINDOW, top: 0 })
   })
 })
diff --git a/mobile/src/mobile-web-shell/page-safe-area-insets.ts b/mobile/src/mobile-web-shell/page-safe-area-insets.ts
index 3b9666baca9..71da590370b 100644
--- a/mobile/src/mobile-web-shell/page-safe-area-insets.ts
+++ b/mobile/src/mobile-web-shell/page-safe-area-insets.ts
@@ -4,26 +4,24 @@ import type { BridgeSafeAreaInsets } from './bridge/bridge-safe-area-insets'
 /**
  * The part of an edge-to-edge WebView that sits under a system bar, which is what the page pads for.
  *
- * Not the window's insets as they are: with the keyboard up the shell already ends the view at the
- * keyboard's top, so nothing of the page is under the gesture bar, and a banner the shell draws above
- * the view takes the status bar strip itself.
+ * The window's insets, as a native screen reads them with the keyboard covering it, except where
+ * the shell's banner stands above the view and takes the status bar strip itself.
  */
 export function pageSafeAreaInsets(input: {
   insets: BridgeSafeAreaInsets
-  keyboardInset: number
   topCovered: boolean
 }): BridgeSafeAreaInsets {
   const { insets } = input
   return {
     top: input.topCovered ? 0 : insets.top,
     right: insets.right,
-    bottom: input.keyboardInset > 0 ? 0 : insets.bottom,
+    bottom: insets.bottom,
     left: insets.left
   }
 }
 
-/** Hands moved insets to the page over the re-sent `init` a pane move takes: the keyboard, a
- *  rotation, or the shell's banner. Keyed on the four numbers, so a render moves nothing. */
+/** Hands moved insets to the page over the re-sent `init` a pane move takes: a rotation or the
+ *  shell's banner. Keyed on the four numbers, so a render moves nothing. */
 export function usePublishedSafeAreaInsets(
   publish: (insets: BridgeSafeAreaInsets) => void,
   insets: BridgeSafeAreaInsets
diff --git a/mobile/src/mobile-web-shell/shell-page-frame.test.ts b/mobile/src/mobile-web-shell/shell-page-frame.test.ts
index 243f5763d77..8c4d7b5b6d8 100644
--- a/mobile/src/mobile-web-shell/shell-page-frame.test.ts
+++ b/mobile/src/mobile-web-shell/shell-page-frame.test.ts
@@ -1,5 +1,4 @@
 import { describe, expect, it } from 'vitest'
-import { BRIDGE_PAGE_PAINTED } from './bridge/bridge-page-painted'
 import type { MobileWebShellSessionState } from './mobile-web-shell-session-contract'
 import { shellPageFrame } from './shell-page-frame'
 
@@ -12,18 +11,8 @@ const READY: MobileWebShellSessionState = {
   elapsedMs: 1
 }
 
-function frame(patch: {
-  state?: MobileWebShellSessionState
-  pageReady?: boolean
-  pageReportsPaint?: boolean
-  pagePainted?: boolean
-}) {
-  return shellPageFrame({
-    state: patch.state ?? READY,
-    pageReady: patch.pageReady ?? false,
-    pageReportsPaint: patch.pageReportsPaint ?? false,
-    pagePainted: patch.pagePainted ?? false
-  })
+function frame(patch: { state?: MobileWebShellSessionState; pagePainted?: boolean }) {
+  return shellPageFrame({ state: patch.state ?? READY, pagePainted: patch.pagePainted ?? false })
 }
 
 describe('how long the shell keeps its own frame up', () => {
@@ -38,33 +27,13 @@ describe('how long the shell keeps its own frame up', () => {
     }
   })
 
-  it('covers a mounted view that has said nothing, which is the whole of the page boot', () => {
+  it('covers a mounted view until the page reports a frame, handshake or not', () => {
+    // `ready` is posted before the tree is built, so the view is mounted, empty and showing the
+    // surface behind it for every frame between the two.
     expect(frame({})).toBe('unpainted')
   })
 
-  it('keeps covering a page that has handshaken and not yet painted', () => {
-    // The gap this exists for: `ready` is posted before the tree is built, so the view is mounted,
-    // empty and showing the surface behind it for every frame between the two.
-    expect(frame({ pageReady: true, pageReportsPaint: true })).toBe('unpainted')
-  })
-
-  it('new shell, new page: uncovers on the page reporting a frame', () => {
-    expect(frame({ pageReady: true, pageReportsPaint: true, pagePainted: true })).toBe('painted')
-  })
-
-  it('new shell, old page: uncovers on ready, the newest word that page will ever say', () => {
-    // A generation served by a desktop built before the report exists. Waiting on a frame it
-    // cannot send would hide a working workspace for the life of the document.
-    expect(frame({ pageReady: true, pageReportsPaint: false })).toBe('painted')
-  })
-
-  it('reads the declaration off the list the page sent, not off the shell', () => {
-    // The name is what the page puts in `ready.reports`, so the frame follows that list and not a
-    // flag the shell set: a list without it is a page whose newest word is `ready`.
-    const declared = [BRIDGE_PAGE_PAINTED].includes(BRIDGE_PAGE_PAINTED)
-    expect(frame({ pageReady: true, pageReportsPaint: declared })).toBe('unpainted')
-    expect(
-      frame({ pageReady: true, pageReportsPaint: ['other'].includes(BRIDGE_PAGE_PAINTED) })
-    ).toBe('painted')
+  it('uncovers on the page reporting a frame', () => {
+    expect(frame({ pagePainted: true })).toBe('painted')
   })
 })
diff --git a/mobile/src/mobile-web-shell/shell-page-frame.ts b/mobile/src/mobile-web-shell/shell-page-frame.ts
index 02d870a0f48..45094d9d0a0 100644
--- a/mobile/src/mobile-web-shell/shell-page-frame.ts
+++ b/mobile/src/mobile-web-shell/shell-page-frame.ts
@@ -7,19 +7,12 @@ import type { MobileWebShellSession } from './mobile-web-shell-session-contract'
  */
 export type ShellPageFrame = 'pending' | 'unpainted' | 'painted'
 
-/**
- * Bounded by the page's declaration, never by a timer. A page that declared none is one served by
- * a desktop older than the report, and `ready` is the newest thing it will ever say: waiting on a
- * word it cannot speak would hide a working workspace for the life of the document.
- */
+/** Up until the page reports a frame of its own; every page the shell serves reports one. */
 export function shellPageFrame(
-  session: Pick<MobileWebShellSession, 'state' | 'pageReady' | 'pageReportsPaint' | 'pagePainted'>
+  session: Pick<MobileWebShellSession, 'state' | 'pagePainted'>
 ): ShellPageFrame {
   if (session.state.kind !== 'ready') {
     return 'pending'
   }
-  if (session.pagePainted) {
-    return 'painted'
-  }
-  return session.pageReportsPaint || !session.pageReady ? 'unpainted' : 'painted'
+  return session.pagePainted ? 'painted' : 'unpainted'
 }
diff --git a/mobile/src/mobile-web-shell/shell-screen-route-census.test.ts b/mobile/src/mobile-web-shell/shell-screen-route-census.test.ts
deleted file mode 100644
index 1626e376966..00000000000
--- a/mobile/src/mobile-web-shell/shell-screen-route-census.test.ts
+++ /dev/null
@@ -1,278 +0,0 @@
-import { existsSync, readdirSync, readFileSync } from 'node:fs'
-import { dirname, join, resolve } from 'node:path'
-import ts from 'typescript-api'
-import { describe, expect, it } from 'vitest'
-
-const HOST_ROUTES = join(import.meta.dirname, '..', '..', 'app', 'h', '[hostId]')
-const PAGE_ROUTE_REGISTRY = join(
-  import.meta.dirname,
-  '..',
-  '..',
-  '..',
-  'config',
-  'scripts',
-  'mobile-web-page-routes.mjs'
-)
-
-/**
- * Every switch that hands a route to the shell asks whether the route is one the page can be
- * given, and asks it in one place.
- *
- * A route the schema refuses is dropped to `null` by `bridge-host.ts` and reaches the phone as an
- * `init` naming no screen, which the page answers with "Update Orca to open this workspace" — a
- * failure screen in place of the native screen sitting right behind the switch. Three routes had
- * each grown their own copy of the call and two had none at all, which is the state this census
- * ends: the predicate is `shellScreenRoute`, and a switch that spells it itself has a second
- * spelling of a rule that can only drift from the one the page reads.
- *
- * The walk is over the route tree rather than a list, so a route added later is held to this
- * without anyone remembering to add it here.
- */
-function hostRouteFiles(directory: string = HOST_ROUTES, prefix = ''): string[] {
-  return readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
-    const name = prefix === '' ? entry.name : `${prefix}/${entry.name}`
-    if (entry.isDirectory()) {
-      return hostRouteFiles(join(directory, entry.name), name)
-    }
-    return entry.name.endsWith('.tsx') && !entry.name.includes('.test.') ? [name] : []
-  })
-}
-
-/**
- * A route file's body: the file itself, or the module its default export comes from.
- *
- * `[...page].tsx` is the reason: expo-router 55 reads a file's platform from the first dot of its
- * stripped name, so a catch-all cannot carry a `.web.tsx` sibling under `app/` without registering
- * a second route, and its body lives under `src/` where the stem is plain. Following the export
- * keeps the walk derived from the tree rather than from a list beside it.
- *
- * Fails closed, which is the half that matters. A shape this cannot resolve is a file whose body
- * it never read, and an unread body is exactly where a switch that skips `shellScreenRoute` would
- * sit — so an unknown shape is named by the census rather than quietly treated as a non-switch.
- */
-type RouteBody =
-  | { readonly kind: 'source'; readonly text: string }
-  | { readonly kind: 'unresolved'; readonly why: string }
-
-/** The module specifier a file's default export comes from, or null when the body is local. */
-function defaultExportSource(parsed: ts.SourceFile): string | null | undefined {
-  const importedFrom = new Map<string, string>()
-  for (const statement of parsed.statements) {
-    if (ts.isImportDeclaration(statement) && ts.isStringLiteral(statement.moduleSpecifier)) {
-      const clause = statement.importClause
-      if (clause?.name !== undefined) {
-        importedFrom.set(clause.name.text, statement.moduleSpecifier.text)
-      }
-      const bindings = clause?.namedBindings
-      if (bindings !== undefined && ts.isNamedImports(bindings)) {
-        for (const element of bindings.elements) {
-          importedFrom.set(element.name.text, statement.moduleSpecifier.text)
-        }
-      }
-    }
-  }
-  for (const statement of parsed.statements) {
-    // `export { default } from 'x'`, and `export { Body as default } from 'x'`.
-    if (
-      ts.isExportDeclaration(statement) &&
-      statement.moduleSpecifier !== undefined &&
-      ts.isStringLiteral(statement.moduleSpecifier) &&
-      statement.exportClause !== undefined &&
-      ts.isNamedExports(statement.exportClause) &&
-      statement.exportClause.elements.some((element) => element.name.text === 'default')
-    ) {
-      return statement.moduleSpecifier.text
-    }
-    if (ts.isExportAssignment(statement) && statement.isExportEquals !== true) {
-      // `export default Body` where `Body` came from an import: the body is over there. Any other
-      // expression — a function, a class, a local — is this file's own.
-      return ts.isIdentifier(statement.expression)
-        ? (importedFrom.get(statement.expression.text) ?? null)
-        : null
-    }
-    // `export default function …` / `export default class …`: the body is here.
-    if (
-      (ts.isFunctionDeclaration(statement) || ts.isClassDeclaration(statement)) &&
-      statement.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.DefaultKeyword) ===
-        true
-    ) {
-      return null
-    }
-  }
-  return undefined
-}
-
-function bodyOf(name: string): RouteBody {
-  const routeFile = join(HOST_ROUTES, name)
-  const source = readFileSync(routeFile, 'utf8')
-  const specifier = defaultExportSource(parse(source))
-  if (specifier === undefined) {
-    return { kind: 'unresolved', why: 'no default export this census recognises' }
-  }
-  if (specifier === null) {
-    return { kind: 'source', text: source }
-  }
-  if (!specifier.startsWith('.')) {
-    return { kind: 'unresolved', why: `default export comes from the package "${specifier}"` }
-  }
-  const base = resolve(dirname(routeFile), specifier)
-  for (const extension of ['.tsx', '.ts']) {
-    if (existsSync(`${base}${extension}`)) {
-      return { kind: 'source', text: readFileSync(`${base}${extension}`, 'utf8') }
-    }
-  }
-  return { kind: 'unresolved', why: `no module at "${specifier}"` }
-}
-
-/** The body text, for the rules below; an unresolved shape is caught by its own case first. */
-function read(name: string): string {
-  const body = bodyOf(name)
-  return body.kind === 'source' ? body.text : ''
-}
-
-/**
- * The one switch that hands over a route the rule refuses, on purpose.
- *
- * `web.tsx` is `__DEV__`-only and its fallback is `Redirect href="/h/<hostId>"`, not a native
- * screen. Adopting the guard there sends a `..` deep link through that redirect to the host route,
- * which this PR keeps native, so the developer lands on the host list with nothing said about why
- * the page did not open. Handed over instead, the same id reaches the bridge and comes back as the
- * host's own failure screen, which is the better verdict for a route whose whole purpose is to
- * open the page deliberately; `mobile-web-shell-route.test.tsx` pins that by name.
- *
- * Exempted here rather than silently unwalked, so the exception is read when it changes.
- */
-const HANDS_OVER_UNJUDGED = ['web.tsx']
-
-const parse = (source: string): ts.SourceFile =>
-  ts.createSourceFile('route.tsx', source, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX)
-
-function importsNames(parsed: ts.SourceFile, module: string): string[] {
-  return parsed.statements.flatMap((statement) => {
-    if (!ts.isImportDeclaration(statement) || !ts.isStringLiteral(statement.moduleSpecifier)) {
-      return []
-    }
-    if (!statement.moduleSpecifier.text.endsWith(module)) {
-      return []
-    }
-    const bindings = statement.importClause?.namedBindings
-    return bindings !== undefined && ts.isNamedImports(bindings)
-      ? bindings.elements.map((element) => element.name.text)
-      : []
-  })
-}
-
-/**
- * A switch is a route file that imports the shell screen.
- *
- * The import rather than `<MobileWebShellScreen` in the text: a switch that renders it through an
- * alias, or across a line break the formatter chose, is still a switch, and a file that only
- * mentions the name in a comment is not one.
- */
-function mountsShell(parsed: ts.SourceFile): boolean {
-  return importsNames(parsed, 'MobileWebShellScreen').includes('MobileWebShellScreen')
-}
-
-/**
- * Whether the module calls the name it imported, not merely imports it.
- *
- * An import alone is what a switch has while the call sits behind a condition that never runs, or
- * after someone deletes the call and leaves the import for the formatter to trim later. The rule
- * is that every switch asks, so the census reads the asking.
- */
-function callsName(parsed: ts.SourceFile, name: string): boolean {
-  let called = false
-  const visit = (node: ts.Node): void => {
-    if (
-      ts.isCallExpression(node) &&
-      ts.isIdentifier(node.expression) &&
-      node.expression.text === name
-    ) {
-      called = true
-    }
-    ts.forEachChild(node, visit)
-  }
-  ts.forEachChild(parsed, visit)
-  return called
-}
-
-describe('the switches that hand a route to the shell', () => {
-  const switches = hostRouteFiles().filter((name) => mountsShell(parse(read(name))))
-
-  it('walks the directory every registered route lives under', () => {
-    // The root above is written out rather than derived, so this is what ties it to the manifest:
-    // a page route outside `/h/[hostId]` would be a switch this census never reads.
-    const pathnames = [
-      ...readFileSync(PAGE_ROUTE_REGISTRY, 'utf8').matchAll(/pathname: '([^']+)'/g)
-    ].map((match) => match[1])
-    expect(pathnames.length).toBeGreaterThan(0)
-    expect(pathnames.filter((pathname) => !pathname.startsWith('/h/[hostId]'))).toEqual([])
-  })
-
-  /**
-   * Every route file's body was read, so `switches` is a census and not a sample.
-   *
-   * A shape this cannot resolve is a body it never opened, and every rule below would read that
-   * file as "not a switch" — the one answer a census must never give by default.
-   */
-  it('resolves every route file to a body, naming any shape it cannot', () => {
-    expect(
-      hostRouteFiles()
-        .map((name) => ({ name, body: bodyOf(name) }))
-        .filter((entry) => entry.body.kind === 'unresolved')
-        .map((entry) => `${entry.name}: ${entry.body.kind === 'unresolved' ? entry.body.why : ''}`)
-    ).toEqual([])
-  })
-
-  it('walks the route tree and finds them, so the rules below cannot pass vacuously', () => {
-    expect(switches.sort()).toEqual([
-      '[...page].tsx',
-      'agent-history/[worktreeId].tsx',
-      'files/[worktreeId].tsx',
-      'files/preview/[worktreeId].tsx',
-      'index.tsx',
-      'review/[worktreeId].tsx',
-      'session/[worktreeId].tsx',
-      'source-control/[worktreeId].tsx',
-      'tasks.tsx',
-      'web.tsx'
-    ])
-  })
-
-  it('asks shellScreenRoute whether the route is one the page can be given', () => {
-    // Imports it *and* calls it: an import the call no longer reaches is a switch that stopped
-    // asking while still looking like one.
-    expect(
-      switches
-        .filter((name) => !HANDS_OVER_UNJUDGED.includes(name))
-        .filter((name) => {
-          const parsed = parse(read(name))
-          return (
-            !importsNames(parsed, 'shell-screen-route').includes('shellScreenRoute') ||
-            !callsName(parsed, 'shellScreenRoute')
-          )
-        })
-    ).toEqual([])
-  })
-
-  it('reads the call rather than the import, on a fixture that has only the import', () => {
-    // The rule the case above cannot show against the tree, every switch there calling what it
-    // imports: an import with no call is named.
-    const importOnly = parse(
-      "import { shellScreenRoute } from '../../../src/mobile-web-shell/shell-screen-route'\n" +
-        "import { MobileWebShellScreen } from '../../../src/mobile-web-shell/MobileWebShellScreen'\n" +
-        'export default function Route() {\n  return <MobileWebShellScreen />\n}\n'
-    )
-    expect(mountsShell(importOnly)).toBe(true)
-    expect(importsNames(importOnly, 'shell-screen-route')).toContain('shellScreenRoute')
-    expect(callsName(importOnly, 'shellScreenRoute')).toBe(false)
-  })
-
-  it('spells the rule nowhere else, so the page and the app cannot disagree about it', () => {
-    // The copies this census ends. `shellScreenRoute` is the one caller of the schema outside the
-    // bridge, and a switch that reaches for it again is writing the second spelling back.
-    expect(switches.filter((name) => read(name).includes('BridgeInitRouteSchema'))).toEqual([])
-    // And the exemption names a switch that exists, so it cannot outlive the file it excuses.
-    expect(switches).toEqual(expect.arrayContaining(HANDS_OVER_UNJUDGED))
-  })
-})
diff --git a/mobile/src/mobile-web-shell/shell-view-keyboard-accessory.test.ts b/mobile/src/mobile-web-shell/shell-view-keyboard-accessory.test.ts
new file mode 100644
index 00000000000..56e542fd40a
--- /dev/null
+++ b/mobile/src/mobile-web-shell/shell-view-keyboard-accessory.test.ts
@@ -0,0 +1,31 @@
+import { describe, expect, it } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+/**
+ * The iOS shell's keyboard, read off the Swift view: a property of a live WKWebView, so what is
+ * checkable here is that the view installs the fix, and the simulator proof measures its effect.
+ *
+ * iPhone 17 simulator, measured: WKWebView's form accessory bar (up, down, done) rides on the
+ * keyboard, and the keyboard event's height counts it, so the page's terminal lifted 376 pt against
+ * native's 274 and its dock stood 52 pt above the bar.
+ */
+const SHELL = join(import.meta.dirname, '..', '..', 'modules', 'orca-mobile-web-shell', 'ios')
+
+describe("the iOS WebView's keyboard", () => {
+  it('carries no form accessory bar, so the keyboard is the height a native screen reads', () => {
+    const view = readFileSync(join(SHELL, 'MobileWebShellView.swift'), 'utf8')
+    expect(view).toContain('hideKeyboardAccessoryBar(of: webView)')
+    const accessory = readFileSync(join(SHELL, 'MobileWebShellKeyboardAccessory.swift'), 'utf8')
+    expect(accessory).toContain('inputAccessoryView')
+  })
+
+  it('does not scroll the page to reveal a focused field, which the page lifts itself', () => {
+    // iPhone 17 simulator: focusing the page's commit message scrolled the whole document up, the
+    // header off screen and the bar 384 pt above the keyboard (shot ios-43).
+    const view = readFileSync(join(SHELL, 'MobileWebShellView.swift'), 'utf8')
+    expect(view).toContain('ignoreKeyboardNotifications(in: webView)')
+    const accessory = readFileSync(join(SHELL, 'MobileWebShellKeyboardAccessory.swift'), 'utf8')
+    expect(accessory).toContain('keyboardWillChangeFrameNotification')
+  })
+})
diff --git a/mobile/src/mobile-web-shell/shell-view-surface.test.ts b/mobile/src/mobile-web-shell/shell-view-surface.test.ts
deleted file mode 100644
index 7d8817147ca..00000000000
--- a/mobile/src/mobile-web-shell/shell-view-surface.test.ts
+++ /dev/null
@@ -1,44 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { colors } from '../theme/mobile-theme'
-
-/**
- * What the WebView paints before its document does, read off both shells.
- *
- * Neither can be proven from a JVM or a Swift unit test: it is a property of a live view. What is
- * checkable is that neither shell gives the view a surface of its own, which is what makes the
- * frame behind it — the screen's own, in the app's own colours — the thing on screen.
- *
- * The two defaults differ and both are wrong. Android's WebView paints nothing under a transparent
- * background, which is fine; a WKWebView is opaque by default and paints white, so a dark app
- * opening a page flashed white for the whole of the page's boot.
- */
-const SHELL = join(import.meta.dirname, '..', '..', 'modules', 'orca-mobile-web-shell')
-
-function source(relative: string): string {
-  return readFileSync(join(SHELL, relative), 'utf8')
-}
-
-describe('what a mounted view paints before the page does', () => {
-  it('gives the Android view no surface of its own', () => {
-    const kotlin = source(
-      'android/src/main/java/expo/modules/orcamobilewebshell/MobileWebShellView.kt'
-    )
-    expect(kotlin).toContain('view.setBackgroundColor(Color.TRANSPARENT)')
-  })
-
-  it('gives the iOS view none either, which is not its default', () => {
-    const swift = source('ios/MobileWebShellView.swift')
-    expect(swift).toContain('webView.isOpaque = false')
-    expect(swift).toContain('webView.backgroundColor = .clear')
-    expect(swift).toContain('webView.scrollView.backgroundColor = .clear')
-  })
-
-  it('leaves the app surface as the one colour behind a page, and it is not black', () => {
-    // What shows through both: the screen's own root, which is where the token is read.
-    const screen = readFileSync(join(import.meta.dirname, 'MobileWebShellScreen.tsx'), 'utf8')
-    expect(screen).toContain('backgroundColor: colors.bgBase')
-    expect(colors.bgBase).not.toBe('#000000')
-  })
-})
diff --git a/mobile/src/mobile-web-shell/use-mobile-web-shell-bridge.test.ts b/mobile/src/mobile-web-shell/use-mobile-web-shell-bridge.test.ts
index 82ed511a223..67bc07fba2c 100644
--- a/mobile/src/mobile-web-shell/use-mobile-web-shell-bridge.test.ts
+++ b/mobile/src/mobile-web-shell/use-mobile-web-shell-bridge.test.ts
@@ -151,6 +151,7 @@ function Harness(props: {
     // Built inline on every render, as a caller writes it: the host is not rebuilt for it.
     route: { pathname: '/h/host-1' },
     safeAreaInsets: { top: 0, right: 0, bottom: 0, left: 0 },
+    keyboardInset: 0,
     pageRoutes: ['/h/[hostId]'],
     pageRouteGrants: [{ pathname: '/h/[hostId]', grants: ['navigate', 'storage'] }],
     routeGrants: [
@@ -338,7 +339,7 @@ describe('the bridge channel', () => {
 
   it("hands the page's first paint to the caller that owns the cover over the view", async () => {
     const mounted = await mount(readyState('session-one'))
-    await mounted.deliver(clientFrame({ type: 'ready', reports: [BRIDGE_PAGE_PAINTED] }))
+    await mounted.deliver(clientFrame({ type: 'ready' }))
     expect(mounted.probe.paints).toBe(0)
     await mounted.deliver(clientFrame({ type: 'notify', name: BRIDGE_PAGE_PAINTED }))
     expect(mounted.probe.paints).toBe(1)
@@ -657,13 +658,13 @@ describe('client changes', () => {
    *
    * A client swapped under a live page is not a new document: the WebView stays mounted, the
    * session id does not move, and the page neither handshakes again nor hears that anything
-   * happened. What it declared and what it is holding therefore belong to the session, the way
+   * happened. What it is holding therefore belongs to the session, the way
    * `sessionEstablished` already does — a rebuilt host that started over would answer every press
    * with "I cannot deliver this" and pop the screen out from under an open sheet.
    */
   it('keeps delivering Back to an open sheet after the host is rebuilt under it', async () => {
     const mounted = await mount(readyState('session-one'))
-    await mounted.deliver(clientFrame({ type: 'ready', accepts: [BRIDGE_BACK_FRAME] }))
+    await mounted.deliver(clientFrame({ type: 'ready' }))
     await mounted.deliver(
       clientFrame({ type: 'notify', name: BRIDGE_BACK_CLAIM_NOTIFY, claimed: true })
     )
@@ -681,47 +682,17 @@ describe('client changes', () => {
     expect(mounted.frames('session-one').slice(before)).toEqual([{ v: 1, type: BRIDGE_BACK_FRAME }])
   })
 
-  /** The other half of the same seed: a page that never said it takes a press is still one the
-   *  rebuilt host will not send to. An empty declaration is a declaration. */
-  it('sends nothing after a rebuild to a page that never declared the frame', async () => {
-    const mounted = await mount(readyState('session-one'))
-    await mounted.deliver(clientFrame({ type: 'ready' }))
-    doubles.client = createFakeRpcClient()
-    await mounted.update(readyState('session-one'))
-    const before = mounted.frames('session-one').length
-    expect(mounted.probe.view?.sendBack()).toBe(false)
-    expect(mounted.frames('session-one')).toHaveLength(before)
-  })
-
-  /** The seed is the session's, not the hook's. A different session id is a different document,
-   *  which has declared nothing and is holding nothing until it says so itself. */
-  it('carries nothing into a host built for a different session', async () => {
-    // Both mounts stand for an established session, so the rebuilt host's own pre-handshake gate
-    // is already open and the declaration is the only thing left that can refuse the press.
-    const mounted = await mount(readyState('session-one'), true)
-    await mounted.deliver(clientFrame({ type: 'ready', accepts: [BRIDGE_BACK_FRAME] }))
-    await mounted.deliver(
-      clientFrame({ type: 'notify', name: BRIDGE_BACK_CLAIM_NOTIFY, claimed: true })
-    )
-    // The control: the same rebuild inside the session does keep delivering.
-    doubles.client = createFakeRpcClient()
-    await mounted.update(readyState('session-one'))
-    expect(mounted.probe.view?.sendBack()).toBe(true)
-    await mounted.update(readyState('session-two'))
-    expect(mounted.probe.view?.sendBack()).toBe(false)
-  })
-
   /** A new document inside the same session still starts over: its own `ready` is what the host
    *  reads, and the seed is not a latch. */
   it('drops the carried claim when the next document says ready', async () => {
     const mounted = await mount(readyState('session-one'))
-    await mounted.deliver(clientFrame({ type: 'ready', accepts: [BRIDGE_BACK_FRAME] }))
+    await mounted.deliver(clientFrame({ type: 'ready' }))
     await mounted.deliver(
       clientFrame({ type: 'notify', name: BRIDGE_BACK_CLAIM_NOTIFY, claimed: true })
     )
     doubles.client = createFakeRpcClient()
     await mounted.update(readyState('session-one'))
-    await mounted.deliver(clientFrame({ type: 'ready', accepts: [BRIDGE_BACK_FRAME] }))
+    await mounted.deliver(clientFrame({ type: 'ready' }))
     expect(mounted.probe.backClaims).toEqual([true, false])
   })
 
diff --git a/mobile/src/mobile-web-shell/use-mobile-web-shell-bridge.ts b/mobile/src/mobile-web-shell/use-mobile-web-shell-bridge.ts
index 2489e1ef564..3a55096ac32 100644
--- a/mobile/src/mobile-web-shell/use-mobile-web-shell-bridge.ts
+++ b/mobile/src/mobile-web-shell/use-mobile-web-shell-bridge.ts
@@ -14,10 +14,7 @@ import type { BridgeSessionBack } from './bridge-host-back'
 import type { BridgeNavigateBackOutcome } from './bridge-host-contract'
 import type { BridgeNativeVerb } from './bridge/bridge-native-verbs'
 import type { BridgeErrorCapture } from './bridge/bridge-error-capture'
-import type {
-  MobileWebShellSessionState,
-  PageReadyDeclaration
-} from './mobile-web-shell-session-contract'
+import type { MobileWebShellSessionState } from './mobile-web-shell-session-contract'
 import type { PageHostSnapshot } from './use-page-host-snapshot'
 import type { PageStorageForInit } from './page-storage-keys'
 
@@ -62,6 +59,8 @@ export type MobileWebShellBridgeView = {
   readonly publishRoute: (route: BridgeInitRoute) => void
   /** Hands the mounted host moved safe-area insets; dropped with no host, as a route is. */
   readonly publishSafeAreaInsets: (insets: BridgeSafeAreaInsets) => void
+  /** Hands the mounted host a moved keyboard height; dropped with no host, as the insets are. */
+  readonly publishKeyboardInset: (height: number) => void
   /**
    * Hands the mounted host one Back press. False when there is no host, or when the document it
    * serves never said it takes one — the caller then leaves the key to the navigator.
@@ -86,6 +85,8 @@ export type MobileWebShellBridgeArgs = {
   route: BridgeInitRoute
   /** What the first `init` of a new host carries; later moves go through `publishSafeAreaInsets`. */
   safeAreaInsets: BridgeSafeAreaInsets
+  /** What the first `init` of a new host carries; later moves go through `publishKeyboardInset`. */
+  keyboardInset: number
   /** The route patterns the page keeps for itself; everything else comes back as `navigate`. */
   pageRoutes: readonly string[]
   pageRouteGrants: readonly { pathname: string; grants: readonly string[] }[]
@@ -113,10 +114,9 @@ export type MobileWebShellBridgeArgs = {
   onStorageWrite: (key: string, value: string | null) => void
   /** The page could not render the generation on screen. Reported, never recovered from here. */
   onPageFault: (error: BridgeErrorCapture) => void
-  /** The page asked for a session, and what it declared it reports. Reported so the screen can
-   *  stop waiting for it, and so it knows whether a paint report is coming. */
-  onPageReady: (ready: PageReadyDeclaration) => void
-  /** The page has a frame on screen, from a page that said it would report one. */
+  /** The page asked for a session. Reported so the screen can stop waiting for it. */
+  onPageReady: () => void
+  /** The page has a frame on screen. */
   onPagePainted: () => void
   /** The page is holding the device Back key, or has let it go. False arrives on its own for
    *  every way a document ends, so no claim outlives the page that made it. */
@@ -195,6 +195,7 @@ export function useMobileWebShellBridge(args: MobileWebShellBridgeArgs): MobileW
       sessionId,
       route: latest.route,
       safeAreaInsets: latest.safeAreaInsets,
+      keyboardInset: latest.keyboardInset,
       pageRoutes: latest.pageRoutes,
       pageRouteGrants: latest.pageRouteGrants,
       routeGrants: latest.routeGrants,
@@ -222,7 +223,7 @@ export function useMobileWebShellBridge(args: MobileWebShellBridgeArgs): MobileW
       onRouteParamClear: (param, value) => argsRef.current.onRouteParamClear(param, value),
       onRouteRefused: (issue) => argsRef.current.onRouteRefused(issue),
       onBinaryFramesDropped: (total) => argsRef.current.onBinaryFramesDropped(total),
-      onPageReady: (ready) => argsRef.current.onPageReady(ready),
+      onPageReady: () => argsRef.current.onPageReady(),
       onPagePainted: () => argsRef.current.onPagePainted(),
       onPageBackClaim: (claimed) => argsRef.current.onPageBackClaim(claimed)
     })
@@ -283,6 +284,15 @@ export function useMobileWebShellBridge(args: MobileWebShellBridgeArgs): MobileW
       },
       [buildId, client, sessionId, snapshot]
     ),
+    publishKeyboardInset: useCallback(
+      (height: number) => {
+        const mounted = hostRef.current
+        if (mounted !== null && mounted.sessionId === sessionId) {
+          mounted.host.publishKeyboardInset(height)
+        }
+      },
+      [buildId, client, sessionId, snapshot]
+    ),
     // Fenced on the session the way inbound frames are, and answering false rather than throwing
     // when there is no host: the caller is a hardware key handler, and a press it cannot forward
     // is one the navigator has to be left to answer.
diff --git a/mobile/src/mobile-web-shell/use-mobile-web-shell-session.test.ts b/mobile/src/mobile-web-shell/use-mobile-web-shell-session.test.ts
index 0787874b441..f9ab6443788 100644
--- a/mobile/src/mobile-web-shell/use-mobile-web-shell-session.test.ts
+++ b/mobile/src/mobile-web-shell/use-mobile-web-shell-session.test.ts
@@ -41,6 +41,7 @@ const doubles = vi.hoisted((): Doubles => {
     buildId: 'b'.repeat(64),
     minCompatibleRuntimeProtocolVersion: 2,
     runtimeProtocolVersion: 5,
+    pageVersion: 1,
     entrypoint: 'index.html',
     totalBytes: 2048,
     assets: [
@@ -210,7 +211,7 @@ type Mounted = {
   /** Whether the page had spoken, as every render of the hook reported it. */
   handshakes: () => readonly boolean[]
   documentLoaded: () => void
-  pageReady: (reports?: readonly string[]) => void
+  pageReady: () => void
   timers: ReturnType<typeof createTimerSeam>
 }
 
@@ -219,7 +220,7 @@ async function mount(store: GenerationStore): Promise<Mounted> {
   const handle: {
     retry: () => void
     documentLoaded: () => void
-    pageReady: (ready: { reports: readonly string[]; accepts: readonly string[] }) => void
+    pageReady: () => void
     states: MobileWebShellSessionState[]
     handshakes: boolean[]
   } = {
@@ -262,7 +263,7 @@ async function mount(store: GenerationStore): Promise<Mounted> {
     states: () => handle.states,
     handshakes: () => handle.handshakes,
     documentLoaded: () => handle.documentLoaded(),
-    pageReady: (reports: readonly string[] = []) => handle.pageReady({ reports, accepts: [] }),
+    pageReady: () => handle.pageReady(),
     timers
   }
 }
diff --git a/mobile/src/mobile-web-shell/use-mobile-web-shell-session.ts b/mobile/src/mobile-web-shell/use-mobile-web-shell-session.ts
index da22cd69a2e..57eea752065 100644
--- a/mobile/src/mobile-web-shell/use-mobile-web-shell-session.ts
+++ b/mobile/src/mobile-web-shell/use-mobile-web-shell-session.ts
@@ -21,10 +21,8 @@ import type {
   MobileWebShellSessionEffect,
   MobileWebShellSessionEvent,
   MobileWebShellSessionState,
-  MobileWebShellUpdateNotice,
-  PageReadyDeclaration
+  MobileWebShellUpdateNotice
 } from './mobile-web-shell-session-contract'
-import { shellPageOwnsSafeArea } from './page-document-state'
 
 export type MobileWebShellSessionView = {
   readonly state: MobileWebShellSessionState
@@ -42,10 +40,9 @@ export type MobileWebShellSessionView = {
   readonly reportDocumentStarted: () => void
   /** The native view finished a document; starts the wait for the page's first word. */
   readonly reportDocumentLoaded: () => void
-  /** The page spoke over the bridge; ends that wait, whichever of the two arrived first. Carries
-   *  what that `ready` declared it reports, which is what says whether a paint is coming. */
-  readonly reportPageReady: (ready: PageReadyDeclaration) => void
-  /** The page has a frame on screen. Ignored for a page that never said it would report one. */
+  /** The page spoke over the bridge; ends that wait, whichever of the two arrived first. */
+  readonly reportPageReady: () => void
+  /** The page has a frame on screen. */
   readonly reportPagePainted: () => void
   /** The page took the device Back key, or let it go. */
   readonly reportPageBackClaim: (claimed: boolean) => void
@@ -62,9 +59,6 @@ export type MobileWebShellSessionView = {
   /** Whether the shell should take Back off the navigator. Projected for the same reason as
    *  `pageReady`: a claim moves nothing else, so no other value would re-render to carry it. */
   readonly backClaimed: boolean
-  /** Whether the document on screen pads for the system bars itself. Projected for the same
-   *  reason as `backClaimed`. */
-  readonly pageOwnsSafeArea: boolean
 }
 
 /**
@@ -95,9 +89,6 @@ export function useMobileWebShellSession(args: {
   const [pageReady, setPageReady] = useState(sessionRef.current.pageReady)
   const [pageFrame, setPageFrame] = useState(() => shellPageFrame(sessionRef.current))
   const [backClaimed, setBackClaimed] = useState(() => shellPageBackClaimed(sessionRef.current))
-  const [pageOwnsSafeArea, setPageOwnsSafeArea] = useState(() =>
-    shellPageOwnsSafeArea(sessionRef.current)
-  )
   const hostKey = useMemo(() => deriveHostCacheKey(hostId), [hostId])
   const startedAtRef = useRef(runtime.now())
   // Bumped by anything that invalidates work in flight; every dispatch out of an effect checks it.
@@ -121,7 +112,6 @@ export function useMobileWebShellSession(args: {
     setPageReady(stepped.session.pageReady)
     setPageFrame(shellPageFrame(stepped.session))
     setBackClaimed(shellPageBackClaimed(stepped.session))
-    setPageOwnsSafeArea(shellPageOwnsSafeArea(stepped.session))
     for (const effect of stepped.effects) {
       // Every effect of a step belongs to the flow that step produced, and its result carries that
       // number back, so a flow the session has since restarted reports into nothing.
@@ -281,12 +271,9 @@ export function useMobileWebShellSession(args: {
     dispatch(epochRef.current, { type: 'document-loaded' })
   }, [dispatch])
 
-  const reportPageReady = useCallback(
-    (ready: PageReadyDeclaration) => {
-      dispatch(epochRef.current, { type: 'page-ready', ...ready })
-    },
-    [dispatch]
-  )
+  const reportPageReady = useCallback(() => {
+    dispatch(epochRef.current, { type: 'page-ready' })
+  }, [dispatch])
 
   const reportPagePainted = useCallback(() => {
     dispatch(epochRef.current, { type: 'page-painted' })
@@ -314,7 +301,6 @@ export function useMobileWebShellSession(args: {
     reportPageReady,
     reportPagePainted,
     reportPageBackClaim,
-    backClaimed,
-    pageOwnsSafeArea
+    backClaimed
   }
 }
diff --git a/mobile/src/mobile-web-shell/use-shell-page-back.ts b/mobile/src/mobile-web-shell/use-shell-page-back.ts
index dd1ac0ac7b1..ecf8f145f20 100644
--- a/mobile/src/mobile-web-shell/use-shell-page-back.ts
+++ b/mobile/src/mobile-web-shell/use-shell-page-back.ts
@@ -9,7 +9,7 @@ import { BackHandler, Platform } from 'react-native'
  * and posted; iOS has none, so what is taken away is the stack's swipe-back gesture — a swipe while
  * a sheet is open would leave the screen with the sheet still on it.
  *
- * Nothing is registered without a live claim, so a page too old to make one, a shell whose page has
+ * Nothing is registered without a live claim, so a page holding nothing, a shell whose page has
  * faulted, and a session between documents all keep today's behaviour: the navigator pops.
  */
 export function useShellPageBack(args: {
diff --git a/mobile/src/notifications/desktop-notification-channel.test.ts b/mobile/src/notifications/desktop-notification-channel.test.ts
index 95ff41ebe35..283f3f668d4 100644
--- a/mobile/src/notifications/desktop-notification-channel.test.ts
+++ b/mobile/src/notifications/desktop-notification-channel.test.ts
@@ -1,4 +1,3 @@
-import { readFileSync } from 'node:fs'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import * as Notifications from 'expo-notifications'
 import { Platform } from 'react-native'
@@ -48,15 +47,3 @@ describe('ensureDesktopNotificationChannel', () => {
     await expect(ensureDesktopNotificationChannel()).rejects.toThrow('no channels')
   })
 })
-
-describe('app boot', () => {
-  it('creates the channel at startup, not only once a socket subscribes', () => {
-    // A background push can be the first thing to target 'orca-desktop', and Android
-    // drops a notification whose channel does not exist. Asserted against the source
-    // because vitest only collects src/, so app/_layout.tsx has no runtime coverage.
-    const layout = readFileSync(new URL('../../app/_layout.tsx', import.meta.url), 'utf8')
-
-    expect(layout).toContain("from '../src/notifications/desktop-notification-channel'")
-    expect(layout).toMatch(/^void ensureDesktopNotificationChannel\(\)\.catch\(/m)
-  })
-})
diff --git a/mobile/src/notifications/notification-route-coordination.test.ts b/mobile/src/notifications/notification-route-coordination.test.ts
index 6f1b8a4aeec..a55d3809f5f 100644
--- a/mobile/src/notifications/notification-route-coordination.test.ts
+++ b/mobile/src/notifications/notification-route-coordination.test.ts
@@ -1,4 +1,3 @@
-import { readFileSync } from 'node:fs'
 import { describe, expect, it, vi } from 'vitest'
 import { getNotificationNavigationTarget } from './notification-routing'
 import {
@@ -7,8 +6,6 @@ import {
   type HostStackNavigationState
 } from '../navigation/host-stack-navigation'
 
-const rootLayoutSource = readFileSync(new URL('../../app/_layout.tsx', import.meta.url), 'utf8')
-
 function navigationHarness(initialState: HostStackNavigationState | undefined) {
   const stateListeners = new Set<() => void>()
   let state = initialState
@@ -100,20 +97,6 @@ describe('notification route coordination', () => {
   it('leaves a host-only notification as a shallow push with nothing to coordinate', () => {
     expect(getNotificationNavigationTarget({ hostId: 'host-1' })?.sessionTarget).toBeNull()
   })
-
-  it('routes notification taps through the coordinated transition, not a bare push', () => {
-    const start = rootLayoutSource.indexOf('// ─── Notification tap routing ───')
-    const end = rootLayoutSource.indexOf('// ─── End notification tap routing ───', start)
-
-    // Assert the markers first: a renamed banner would otherwise slice garbage and report a
-    // missing call instead of the real cause.
-    expect(start).toBeGreaterThanOrEqual(0)
-    expect(end).toBeGreaterThan(start)
-
-    const notificationEffect = rootLayoutSource.slice(start, end)
-    expect(notificationEffect).toContain('openNotificationRoute(target)')
-    expect(notificationEffect).not.toContain('router.push(')
-  })
 })
 
 it('reuses the current workspace screen and targets the notification pane without pushing', () => {
diff --git a/mobile/src/platform/host-os.ts b/mobile/src/platform/host-os.ts
new file mode 100644
index 00000000000..da58fbe0d1e
--- /dev/null
+++ b/mobile/src/platform/host-os.ts
@@ -0,0 +1,8 @@
+import { Platform } from 'react-native'
+
+/** The OS a screen's keyboard and inset arithmetic is for. Natively, the one it runs on. */
+export type HostOs = 'ios' | 'android' | 'windows' | 'macos' | 'web'
+
+export function hostOs(): HostOs {
+  return Platform.OS
+}
diff --git a/mobile/src/platform/host-os.web.test.ts b/mobile/src/platform/host-os.web.test.ts
new file mode 100644
index 00000000000..fcc3d446f36
--- /dev/null
+++ b/mobile/src/platform/host-os.web.test.ts
@@ -0,0 +1,38 @@
+// @vitest-environment happy-dom
+import { afterEach, describe, expect, it } from 'vitest'
+import { hostOs } from './host-os.web'
+
+function agent(userAgent: string, platform = '', maxTouchPoints = 0) {
+  Object.defineProperty(navigator, 'userAgent', { value: userAgent, configurable: true })
+  Object.defineProperty(navigator, 'platform', { value: platform, configurable: true })
+  Object.defineProperty(navigator, 'maxTouchPoints', { value: maxTouchPoints, configurable: true })
+}
+
+afterEach(() => agent(''))
+
+describe("the page's host OS", () => {
+  it('reads the phone off the WebView user agent', () => {
+    agent(
+      'Mozilla/5.0 (iPhone; CPU iPhone OS 26_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148'
+    )
+    expect(hostOs()).toBe('ios')
+    agent(
+      'Mozilla/5.0 (Linux; Android 17; sdk_gphone64_arm64 Build/CP1A; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/144.0 Mobile Safari/537.36'
+    )
+    expect(hostOs()).toBe('android')
+  })
+
+  it('reads an iPad that still names itself in the user agent', () => {
+    agent(
+      'Mozilla/5.0 (iPad; CPU OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148'
+    )
+    expect(hostOs()).toBe('ios')
+  })
+
+  it('takes an iPad, which reports a Mac, by its touch points', () => {
+    agent('Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15', 'MacIntel', 5)
+    expect(hostOs()).toBe('ios')
+    agent('Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15', 'MacIntel', 0)
+    expect(hostOs()).toBe('web')
+  })
+})
diff --git a/mobile/src/platform/host-os.web.ts b/mobile/src/platform/host-os.web.ts
new file mode 100644
index 00000000000..755cf3a2ace
--- /dev/null
+++ b/mobile/src/platform/host-os.web.ts
@@ -0,0 +1,19 @@
+import type { HostOs } from './host-os'
+
+export type { HostOs } from './host-os'
+
+/**
+ * Web sibling: `Platform.OS` is `web` inside the shell's page, but the keyboard it lifts over is the
+ * phone's, whose height the shell reports in that OS's own terms. So the page answers the phone's
+ * OS from the WebView's user agent. iPadOS reports a Mac, which only its touch points give away.
+ */
+export function hostOs(): HostOs {
+  const agent = globalThis.navigator?.userAgent ?? ''
+  if (/iP(ad|hone|od)/.test(agent)) {
+    return 'ios'
+  }
+  if (globalThis.navigator?.platform === 'MacIntel' && globalThis.navigator.maxTouchPoints > 1) {
+    return 'ios'
+  }
+  return agent.includes('Android') ? 'android' : 'web'
+}
diff --git a/mobile/src/platform/keyboard-geometry-owner-census.test.ts b/mobile/src/platform/keyboard-geometry-owner-census.test.ts
deleted file mode 100644
index 25c90d0d1ee..00000000000
--- a/mobile/src/platform/keyboard-geometry-owner-census.test.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-/**
- * Who may ask React Native's `Keyboard` for geometry: the keyboard seam, and one named exception.
- *
- * react-native-web's `Keyboard` has no `metrics` and an `addListener` that never fires, so a page
- * screen that asks it directly either throws (a fill sheet crashed the page on `metrics()`) or waits
- * forever. The seam has a web sibling that answers from the window instead; everything else reads it.
- */
-import { readFileSync } from 'node:fs'
-import { relative } from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { describe, expect, it } from 'vitest'
-import { censusSourceFiles } from '../test-support/census-source-files'
-
-const MOBILE_DIR = fileURLToPath(new URL('../../', import.meta.url))
-const SRC_DIR = fileURLToPath(new URL('../', import.meta.url))
-
-const SEAM = 'src/platform/keyboard-occlusion.ts'
-/** A one-shot "open after the keyboard hides" with a timer fallback; it subscribes only while the
- *  seam reports a keyboard, which on the page is never, so there it cannot wait forever. */
-const TAB_SHEET_AFTER_HIDE = 'src/session/use-mobile-session-terminal-send-actions.ts'
-
-const asksKeyboard = (line: string): boolean =>
-  line.includes('Keyboard.metrics(') || line.includes('Keyboard.addListener(')
-
-function callers(): string[] {
-  return censusSourceFiles(SRC_DIR)
-    .filter((file) => /\.tsx?$/.test(file) && !/\.test\.tsx?$/.test(file))
-    .filter((file) => readFileSync(file, 'utf8').split('\n').some(asksKeyboard))
-    .map((file) => relative(MOBILE_DIR, file))
-    .sort()
-}
-
-describe("React Native's Keyboard geometry", () => {
-  it('is read only by the keyboard seam and the tab sheet that waits for a hide', () => {
-    // Also the presence precondition: the seam itself must match, or the matcher is broken.
-    expect(callers()).toEqual([SEAM, TAB_SHEET_AFTER_HIDE].sort())
-  })
-})
diff --git a/mobile/src/platform/keyboard-occlusion.test.tsx b/mobile/src/platform/keyboard-occlusion.test.tsx
index 526da87f12d..c388c775de2 100644
--- a/mobile/src/platform/keyboard-occlusion.test.tsx
+++ b/mobile/src/platform/keyboard-occlusion.test.tsx
@@ -47,14 +47,12 @@ vi.mock('react-native', () => ({
 import {
   currentSoftKeyboardHeight,
   subscribeSoftKeyboard,
-  useKeyboardAvoidingPadding,
   useKeyboardOcclusion,
   useSoftKeyboard,
   type SoftKeyboardState
 } from './keyboard-occlusion'
 
 let lift = 0
-let padding = 0
 let keyboardState: SoftKeyboardState = { height: 0, visible: false }
 
 function Harness(): null {
@@ -62,12 +60,6 @@ function Harness(): null {
   return null
 }
 
-/** Separate, so the padding case measures the padding hook's own subscriptions and nothing else. */
-function PaddingHarness(): null {
-  padding = useKeyboardAvoidingPadding()
-  return null
-}
-
 function StateHarness(): null {
   keyboardState = useSoftKeyboard()
   return null
@@ -94,7 +86,6 @@ describe('the keyboard the phone reports', () => {
     keyboard.addListenerCalls = 0
     keyboard.metrics = undefined
     lift = 0
-    padding = 0
     keyboardState = { height: 0, visible: false }
   })
 
@@ -137,17 +128,6 @@ describe('the keyboard the phone reports', () => {
     expect(keyboard.removed.sort()).toEqual(['keyboardWillHide', 'keyboardWillShow'])
   })
 
-  it('asks a phone for no composer padding, because KeyboardAvoidingView already moved it', async () => {
-    // Rendered, not called: a hook read outside a component measures whatever the module does at
-    // the top of its body and nothing its effects do, which is where a subscription would live.
-    // And it subscribes to nothing doing it, so a composer that calls this renders as often as it
-    // does today — which is what makes adding the call to a shared component safe.
-    await mountComponent(PaddingHarness)
-    expect(padding).toBe(0)
-    expect(keyboard.addListenerCalls).toBe(0)
-    expect(keyboard.listeners.size).toBe(0)
-  })
-
   it('answers both facts from one subscription, so a screen wanting each pays for one', async () => {
     // The session screen reads the height to lift its dock and the flag to hold off the terminal
     // refit. Two hooks would mean two listener pairs and two renders per keyboard event.
diff --git a/mobile/src/platform/keyboard-occlusion.ts b/mobile/src/platform/keyboard-occlusion.ts
index 6b0fc0deb2b..aa952871d98 100644
--- a/mobile/src/platform/keyboard-occlusion.ts
+++ b/mobile/src/platform/keyboard-occlusion.ts
@@ -1,5 +1,6 @@
 import { useEffect, useState } from 'react'
-import { Keyboard, Platform } from 'react-native'
+import { Keyboard } from 'react-native'
+import { hostOs } from './host-os'
 
 /** How much of the bottom of the layout viewport it covers, and whether it is open at all. */
 export type SoftKeyboardState = { readonly height: number; readonly visible: boolean }
@@ -44,8 +45,8 @@ export function subscribeSoftKeyboard(
   onShow: (height: number, duration: number) => void,
   onHide: (duration: number) => void
 ): () => void {
-  const showEvent = Platform.OS === 'ios' ? 'keyboardWillShow' : 'keyboardDidShow'
-  const hideEvent = Platform.OS === 'ios' ? 'keyboardWillHide' : 'keyboardDidHide'
+  const showEvent = hostOs() === 'ios' ? 'keyboardWillShow' : 'keyboardDidShow'
+  const hideEvent = hostOs() === 'ios' ? 'keyboardWillHide' : 'keyboardDidHide'
   const show = Keyboard.addListener(showEvent, (event) =>
     onShow(event.endCoordinates.height, event.duration)
   )
@@ -68,17 +69,3 @@ export function currentSoftKeyboardHeight(): number {
 export function useKeyboardOcclusion(): number {
   return useSoftKeyboard().height
 }
-
-/**
- * The bottom padding a composer needs to clear the keyboard, which natively is none.
- *
- * `KeyboardAvoidingView` already moves the composer on a phone, so adding padding there would move
- * it twice. It is inert on the web for the same reason the `Keyboard` stub is — it is driven by
- * those events — so there the padding is the whole of the avoidance.
- *
- * A second name rather than a `Platform.OS` branch at the call site: this one subscribes to nothing
- * on a phone, so a composer that asks for it renders exactly as many times as it does today.
- */
-export function useKeyboardAvoidingPadding(): number {
-  return 0
-}
diff --git a/mobile/src/platform/keyboard-occlusion.web.test.tsx b/mobile/src/platform/keyboard-occlusion.web.test.tsx
index 11e96afff8f..b6bae0e8547 100644
--- a/mobile/src/platform/keyboard-occlusion.web.test.tsx
+++ b/mobile/src/platform/keyboard-occlusion.web.test.tsx
@@ -5,9 +5,9 @@ import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import {
   currentSoftKeyboardHeight,
   subscribeSoftKeyboard,
-  useKeyboardAvoidingPadding,
   useKeyboardOcclusion,
   useSoftKeyboard,
+  publishShellKeyboardSource,
   type SoftKeyboardState
 } from './keyboard-occlusion.web'
 
@@ -62,11 +62,9 @@ class FakeVisualViewport extends EventTarget {
 const LAYOUT_HEIGHT = 800
 let viewport: FakeVisualViewport | null = null
 let lift = 0
-let padding = 0
 
 function Harness(): null {
   lift = useKeyboardOcclusion()
-  padding = useKeyboardAvoidingPadding()
   return null
 }
 
@@ -83,7 +81,6 @@ async function mount(): Promise<ReturnType<typeof create>> {
 
 beforeEach(() => {
   lift = 0
-  padding = 0
   viewport = new FakeVisualViewport(LAYOUT_HEIGHT)
   Object.defineProperty(window, 'innerHeight', { value: LAYOUT_HEIGHT, configurable: true })
   Object.defineProperty(window, 'visualViewport', { value: viewport, configurable: true })
@@ -189,15 +186,9 @@ describe('the keyboard the browser reports', () => {
     expect(lift).toBe(0)
   })
 
-  it('is the whole of the avoidance here, where KeyboardAvoidingView is inert', async () => {
-    await mount()
-    await act(async () => viewport?.resizeTo(464))
-    expect(padding).toBe(336)
-  })
-
   it('removes both listeners on unmount', async () => {
     const tree = await mount()
-    expect(viewport?.counts).toEqual({ resize: 2, scroll: 2 })
+    expect(viewport?.counts).toEqual({ resize: 1, scroll: 1 })
     await act(async () => tree.unmount())
     expect(viewport?.counts).toEqual({ resize: 0, scroll: 0 })
   })
@@ -237,7 +228,7 @@ describe('the keyboard as events, for a sheet', () => {
     expect(lift).toBe(0)
   })
 
-  it('stays silent when nothing is covered, which is the shell shortening the WebView', () => {
+  it('stays silent while the visual viewport covers nothing', () => {
     const calls: string[] = []
     const unsubscribe = subscribeSoftKeyboard(
       () => calls.push('show'),
@@ -262,7 +253,6 @@ describe('the keyboard as events, for a sheet', () => {
   })
 })
 
-const LAYOUT_WIDTH = 400
 let keyboardState: SoftKeyboardState = { height: 0, visible: false }
 
 function StateHarness(): null {
@@ -270,16 +260,6 @@ function StateHarness(): null {
   return null
 }
 
-function resizeWindow(width: number, height: number): void {
-  Object.defineProperty(window, 'innerWidth', { value: width, configurable: true })
-  Object.defineProperty(window, 'innerHeight', { value: height, configurable: true })
-  window.dispatchEvent(new Event('resize'))
-}
-
-/** Tracked so a case that resizes the window is not also re-rendering an earlier case's harness,
- *  which shares this file's one `keyboardState`. */
-const mountedStateHarnesses: ReturnType<typeof create>[] = []
-
 async function mountState(): Promise<ReturnType<typeof create>> {
   let tree: ReturnType<typeof create> | null = null
   await act(async () => {
@@ -288,65 +268,102 @@ async function mountState(): Promise<ReturnType<typeof create>> {
   if (tree === null) {
     throw new Error('the harness did not mount')
   }
-  mountedStateHarnesses.push(tree)
   return tree
 }
 
-/**
- * The shell shortens the WebView to sit above the IME, so by the time the page measures itself
- * nothing is covered and `visualViewport` reads full height. The resize is what is left.
- */
-describe('the keyboard the page cannot see, because the shell already moved it', () => {
-  beforeEach(() => {
-    act(() => {
-      for (const tree of mountedStateHarnesses.splice(0)) {
-        tree.unmount()
+/** The shell's side of the bridge, as the entry publishes it: the height `init` last carried. */
+function createShellKeyboard(initial = 0) {
+  let height = initial
+  const listeners = new Set<(height: number) => void>()
+  return {
+    source: {
+      read: () => height,
+      subscribe: (listener: (height: number) => void) => {
+        listeners.add(listener)
+        return () => {
+          listeners.delete(listener)
+        }
       }
-    })
-    keyboardState = { height: 0, visible: false }
-    Object.defineProperty(window, 'innerWidth', { value: LAYOUT_WIDTH, configurable: true })
-    Object.defineProperty(window, 'innerHeight', { value: LAYOUT_HEIGHT, configurable: true })
-  })
+    },
+    move: (next: number) => {
+      height = next
+      for (const listener of listeners) {
+        listener(next)
+      }
+    },
+    listenerCount: () => listeners.size
+  }
+}
 
-  it('reads no keyboard while the window keeps the height it mounted at', async () => {
-    await mountState()
-    expect(keyboardState).toEqual({ height: 0, visible: false })
-  })
-
-  it('calls the window shortened at an unchanged width the keyboard, and covers nothing by it', async () => {
-    await mountState()
-    await act(async () => resizeWindow(LAYOUT_WIDTH, LAYOUT_HEIGHT - 336))
-    expect(keyboardState).toEqual({ height: 0, visible: true })
-  })
-
-  it('drops the flag when the window gets its height back', async () => {
-    await mountState()
-    await act(async () => resizeWindow(LAYOUT_WIDTH, LAYOUT_HEIGHT - 336))
-    await act(async () => resizeWindow(LAYOUT_WIDTH, LAYOUT_HEIGHT))
-    expect(keyboardState.visible).toBe(false)
-  })
-
-  it('reads a rotation as a new window rather than a keyboard, because the width moved too', async () => {
-    await mountState()
-    await act(async () => resizeWindow(LAYOUT_HEIGHT, LAYOUT_WIDTH))
-    expect(keyboardState.visible).toBe(false)
-    // And the shorter window is now the one the next keyboard is measured against.
-    await act(async () => resizeWindow(LAYOUT_HEIGHT, LAYOUT_WIDTH - 200))
-    expect(keyboardState.visible).toBe(true)
-  })
-
-  it('takes a window that grew as the new resting height, not as a keyboard closing twice', async () => {
-    await mountState()
-    await act(async () => resizeWindow(LAYOUT_WIDTH, LAYOUT_HEIGHT + 60))
-    expect(keyboardState.visible).toBe(false)
-    await act(async () => resizeWindow(LAYOUT_WIDTH, LAYOUT_HEIGHT))
-    expect(keyboardState.visible).toBe(true)
-  })
-
-  it('stops listening on unmount', async () => {
+describe('the state a native screen reads, from the browser outside the shell', () => {
+  it('is open exactly while something is covered', async () => {
     const tree = await mountState()
+    expect(keyboardState).toEqual({ height: 0, visible: false })
+    await act(async () => viewport?.resizeTo(464))
+    expect(keyboardState).toEqual({ height: 336, visible: true })
+    await act(async () => viewport?.resizeTo(LAYOUT_HEIGHT))
+    expect(keyboardState).toEqual({ height: 0, visible: false })
     await act(async () => tree.unmount())
-    await act(async () => resizeWindow(LAYOUT_WIDTH, LAYOUT_HEIGHT - 336))
-    expect(keyboardState.visible).toBe(false)
+  })
+})
+
+/**
+ * Inside the shell the keyboard covers the page as it covers a native screen, but the page cannot
+ * measure it: the WebView's IME insets are zeroed, so `visualViewport` never moves. The shell says
+ * the height over the bridge, and every reader here answers from that.
+ */
+describe('the keyboard the shell says covers the page', () => {
+  afterEach(() => {
+    publishShellKeyboardSource(null)
+  })
+
+  it('answers the height the shell sent, and ignores the visual viewport', async () => {
+    const shell = createShellKeyboard()
+    publishShellKeyboardSource(shell.source)
+    const tree = await mountState()
+    const lifted = await mount()
+    // Pixel_API_37: the IME opens at 312 and the suggestion strip grows it to 346.
+    for (const height of [312, 346]) {
+      await act(async () => shell.move(height))
+      expect(keyboardState).toEqual({ height, visible: true })
+      expect(lift).toBe(height)
+    }
+    await act(async () => viewport?.resizeTo(464))
+    expect(keyboardState.height).toBe(346)
+    await act(async () => shell.move(0))
+    expect(keyboardState).toEqual({ height: 0, visible: false })
+    expect(lift).toBe(0)
+    await act(async () => {
+      tree.unmount()
+      lifted.unmount()
+    })
+    expect(shell.listenerCount()).toBe(0)
+  })
+
+  it('reads a keyboard already up at mount, which the shell sent in the first init', async () => {
+    publishShellKeyboardSource(createShellKeyboard(312).source)
+    expect(currentSoftKeyboardHeight()).toBe(312)
+    const tree = await mountState()
+    expect(keyboardState).toEqual({ height: 312, visible: true })
+    await act(async () => tree.unmount())
+  })
+
+  it('hands a sheet each height as a show and the close as one hide', () => {
+    const shell = createShellKeyboard()
+    publishShellKeyboardSource(shell.source)
+    const calls: string[] = []
+    const unsubscribe = subscribeSoftKeyboard(
+      (height, duration) => calls.push(`show ${height} ${duration}`),
+      (duration) => calls.push(`hide ${duration}`)
+    )
+    viewport?.resizeTo(464)
+    shell.move(312)
+    shell.move(346)
+    shell.move(0)
+    shell.move(0)
+    expect(calls).toEqual(['show 312 0', 'show 346 0', 'hide 0'])
+    unsubscribe()
+    expect(shell.listenerCount()).toBe(0)
+    expect(viewport?.counts).toEqual({ resize: 0, scroll: 0 })
   })
 })
diff --git a/mobile/src/platform/keyboard-occlusion.web.ts b/mobile/src/platform/keyboard-occlusion.web.ts
index 05500f369ee..c157f24cb4c 100644
--- a/mobile/src/platform/keyboard-occlusion.web.ts
+++ b/mobile/src/platform/keyboard-occlusion.web.ts
@@ -1,7 +1,24 @@
 import { useEffect, useState } from 'react'
 
+/** The height the shell last said over the bridge, and a way to hear it move. */
+export type ShellKeyboardSource = {
+  read: () => number
+  subscribe: (listener: (height: number) => void) => () => void
+}
+
+let shellKeyboard: ShellKeyboardSource | null = null
+
 /**
- * Web sibling: the keyboard's height as the browser reports it, which is not as an event.
+ * Called once by the page entry. Inside the shell the keyboard covers the page as it covers a
+ * native screen, but the WebView's IME insets are zeroed, so `visualViewport` never moves: the
+ * shell is the only thing that knows the height, and every reader below answers from it.
+ */
+export function publishShellKeyboardSource(source: ShellKeyboardSource | null): void {
+  shellKeyboard = source
+}
+
+/**
+ * Outside the shell: the keyboard's height as the browser reports it, which is not as an event.
  *
  * react-native-web's `Keyboard` is a stub whose `addListener` returns a subscription that never
  * fires, so every screen waiting for `keyboardDidShow` inside the shell's page waits forever and
@@ -48,21 +65,15 @@ function visualViewport(): VisualViewport | undefined {
 }
 
 /**
- * The strip as events, with duration 0: the browser has already moved the viewport by the time it
- * says so. Inside the shell nothing fires, because the shell shortens the WebView above the IME and
- * the strip stays 0; in a plain mobile browser the keyboard overlays the page and this is the lift.
+ * The strip as events, with duration 0: the shell and the browser have both moved the keyboard by
+ * the time they say so.
  */
 export function subscribeSoftKeyboard(
   onShow: (height: number, duration: number) => void,
   onHide: (duration: number) => void
 ): () => void {
-  const viewport = visualViewport()
-  if (viewport === undefined) {
-    return () => {}
-  }
-  let open = occlusion(viewport) > 0
-  const read = (): void => {
-    const height = occlusion(viewport)
+  let open = currentSoftKeyboardHeight() > 0
+  const read = (height: number): void => {
     if (height > 0) {
       open = true
       onShow(height, 0)
@@ -71,17 +82,28 @@ export function subscribeSoftKeyboard(
       onHide(0)
     }
   }
-  viewport.addEventListener('resize', read)
-  viewport.addEventListener('scroll', read)
+  if (shellKeyboard !== null) {
+    return shellKeyboard.subscribe(read)
+  }
+  const viewport = visualViewport()
+  if (viewport === undefined) {
+    return () => {}
+  }
+  const measure = (): void => read(occlusion(viewport))
+  viewport.addEventListener('resize', measure)
+  viewport.addEventListener('scroll', measure)
 
   return () => {
-    viewport.removeEventListener('resize', read)
-    viewport.removeEventListener('scroll', read)
+    viewport.removeEventListener('resize', measure)
+    viewport.removeEventListener('scroll', measure)
   }
 }
 
 /** A keyboard already up when a composer opens gets no event at all. */
 export function currentSoftKeyboardHeight(): number {
+  if (shellKeyboard !== null) {
+    return shellKeyboard.read()
+  }
   const viewport = visualViewport()
   return viewport === undefined ? 0 : occlusion(viewport)
 }
@@ -100,50 +122,10 @@ export function useKeyboardOcclusion(): number {
   return keyboardLift
 }
 
-/**
- * On the web the padding is the whole of the avoidance: `KeyboardAvoidingView` is driven by the
- * `Keyboard` events this file exists because the page never receives.
- */
-export function useKeyboardAvoidingPadding(): number {
-  return useKeyboardOcclusion()
-}
-
-/** The sibling's shape; the two facts it answers together are measured separately here. */
+/** The sibling's shape. Open is a covered strip here: neither source reports a keyboard of 0. */
 export type SoftKeyboardState = { readonly height: number; readonly visible: boolean }
 
-/**
- * Whether a keyboard is open, which here is not what it covers: the shell shortens the WebView to
- * sit above the IME, so nothing covers the page and the occlusion above reads 0, correctly. The
- * resize is what is left of the keyboard — inside the shell's WebView the shell's own bottom
- * padding is the one thing that changes this window's height without changing its width too.
- */
-function useShortenedWindow(): boolean {
-  const [shortened, setShortened] = useState(false)
-
-  useEffect(() => {
-    // The tallest height seen at this width is the resting one; a width change is a rotation or a
-    // fold, which starts the comparison again. A page that mounts with the keyboard already up
-    // reads false until it closes once, which costs one terminal refit and no correctness.
-    let width = window.innerWidth
-    let tallest = window.innerHeight
-    const read = (): void => {
-      if (window.innerWidth !== width) {
-        width = window.innerWidth
-        tallest = window.innerHeight
-      } else if (window.innerHeight > tallest) {
-        tallest = window.innerHeight
-      }
-      setShortened(window.innerHeight < tallest)
-    }
-    read()
-    window.addEventListener('resize', read)
-
-    return () => window.removeEventListener('resize', read)
-  }, [])
-
-  return shortened
-}
-
 export function useSoftKeyboard(): SoftKeyboardState {
-  return { height: useKeyboardOcclusion(), visible: useShortenedWindow() }
+  const height = useKeyboardOcclusion()
+  return { height, visible: height > 0 }
 }
diff --git a/mobile/src/platform/keyboard-persisting-taps.ts b/mobile/src/platform/keyboard-persisting-taps.ts
new file mode 100644
index 00000000000..77185a5f2b3
--- /dev/null
+++ b/mobile/src/platform/keyboard-persisting-taps.ts
@@ -0,0 +1,6 @@
+export type KeyboardPersistingTaps = 'always' | 'handled'
+
+/** Natively a Pressable never takes focus; the ScrollView's `keyboardShouldPersistTaps` is the rule. */
+export function useKeyboardPersistingTaps(_mode: KeyboardPersistingTaps): undefined {
+  return undefined
+}
diff --git a/mobile/src/platform/keyboard-persisting-taps.web.test.ts b/mobile/src/platform/keyboard-persisting-taps.web.test.ts
new file mode 100644
index 00000000000..9bea438b405
--- /dev/null
+++ b/mobile/src/platform/keyboard-persisting-taps.web.test.ts
@@ -0,0 +1,87 @@
+// @vitest-environment happy-dom
+/**
+ * The page's form of `keyboardShouldPersistTaps`, which react-native-web ignores.
+ *
+ * Measured on Pixel_API_37: a tap on a dock key or a session tab moves focus from the live input
+ * to the Pressable (tabindex 0) on mousedown, and the IME closes. Natively a Pressable never takes
+ * focus, so the same taps keep the keyboard up.
+ */
+import { afterEach, describe, expect, it } from 'vitest'
+import { keepTextFocusThroughTaps } from './keyboard-persisting-taps.web'
+
+function plant() {
+  const container = document.createElement('div')
+  const button = document.createElement('div')
+  button.tabIndex = 0
+  const label = document.createElement('span')
+  button.appendChild(label)
+  const gap = document.createElement('span')
+  const field = document.createElement('input')
+  container.append(button, gap, field)
+  const liveInput = document.createElement('input')
+  document.body.append(container, liveInput)
+  return { container, label, gap, field, liveInput }
+}
+
+/** Whether a mousedown on `target` was kept from moving focus. */
+function pressKeepsFocus(target: Element): boolean {
+  const event = new MouseEvent('mousedown', { bubbles: true, cancelable: true })
+  target.dispatchEvent(event)
+  return event.defaultPrevented
+}
+
+afterEach(() => {
+  document.body.innerHTML = ''
+})
+
+describe('keepTextFocusThroughTaps', () => {
+  it("keeps a text field's focus through a tap on a pressable, in both modes", () => {
+    for (const mode of ['always', 'handled'] as const) {
+      const { container, label, liveInput } = plant()
+      const release = keepTextFocusThroughTaps(container, mode)
+      liveInput.focus()
+      expect(pressKeepsFocus(label), mode).toBe(true)
+      release()
+      document.body.innerHTML = ''
+    }
+  })
+
+  it('lets a tap on nothing pressable dismiss only when taps are handled', () => {
+    const always = plant()
+    keepTextFocusThroughTaps(always.container, 'always')
+    always.liveInput.focus()
+    expect(pressKeepsFocus(always.gap)).toBe(true)
+    document.body.innerHTML = ''
+
+    const handled = plant()
+    keepTextFocusThroughTaps(handled.container, 'handled')
+    handled.liveInput.focus()
+    expect(pressKeepsFocus(handled.gap)).toBe(false)
+  })
+
+  it('leaves focus alone when no text field holds it, or when the tap is on a text field', () => {
+    const { container, label, field, liveInput } = plant()
+    keepTextFocusThroughTaps(container, 'always')
+    expect(pressKeepsFocus(label)).toBe(false)
+    liveInput.focus()
+    expect(pressKeepsFocus(field)).toBe(false)
+  })
+
+  it('does not count a focusable ancestor above the container as a pressable in the bar', () => {
+    const outer = document.createElement('div')
+    outer.tabIndex = 0
+    const { container, gap, liveInput } = plant()
+    outer.append(container)
+    document.body.prepend(outer)
+    keepTextFocusThroughTaps(container, 'handled')
+    liveInput.focus()
+    expect(pressKeepsFocus(gap)).toBe(false)
+  })
+
+  it('stops when released', () => {
+    const { container, label, liveInput } = plant()
+    keepTextFocusThroughTaps(container, 'always')()
+    liveInput.focus()
+    expect(pressKeepsFocus(label)).toBe(false)
+  })
+})
diff --git a/mobile/src/platform/keyboard-persisting-taps.web.ts b/mobile/src/platform/keyboard-persisting-taps.web.ts
new file mode 100644
index 00000000000..ae05cf0355f
--- /dev/null
+++ b/mobile/src/platform/keyboard-persisting-taps.web.ts
@@ -0,0 +1,56 @@
+import { useCallback, useRef } from 'react'
+import type { KeyboardPersistingTaps } from './keyboard-persisting-taps'
+
+export type { KeyboardPersistingTaps } from './keyboard-persisting-taps'
+
+function isTextField(element: Element | null): boolean {
+  if (!(element instanceof HTMLElement)) {
+    return false
+  }
+  return (
+    element instanceof HTMLInputElement ||
+    element instanceof HTMLTextAreaElement ||
+    element.isContentEditable
+  )
+}
+
+/** A focusable element between the tap and the container; an ancestor above it is not in the bar. */
+function isPressableInside(container: HTMLElement, target: Element): boolean {
+  const pressable = target.closest('[tabindex]:not([tabindex="-1"])')
+  return pressable !== null && pressable !== container && container.contains(pressable)
+}
+
+/**
+ * `keyboardShouldPersistTaps` for the page: react-native-web ignores it, and a Pressable there is a
+ * focusable element that takes focus on mousedown, which blurs the text field and closes the IME.
+ * `handled` keeps focus only for a tap on something pressable; `always` for any tap.
+ */
+export function keepTextFocusThroughTaps(
+  container: HTMLElement,
+  mode: KeyboardPersistingTaps
+): () => void {
+  const onMouseDown = (event: MouseEvent) => {
+    const target = event.target instanceof Element ? event.target : null
+    if (!isTextField(document.activeElement) || !target || isTextField(target)) {
+      return
+    }
+    if (mode === 'handled' && !isPressableInside(container, target)) {
+      return
+    }
+    event.preventDefault()
+  }
+  container.addEventListener('mousedown', onMouseDown, true)
+  return () => container.removeEventListener('mousedown', onMouseDown, true)
+}
+
+/** A ref for the View that holds the taps; on the page that View is its DOM element. */
+export function useKeyboardPersistingTaps(mode: KeyboardPersistingTaps) {
+  const releaseRef = useRef<(() => void) | null>(null)
+  return useCallback(
+    (node: unknown) => {
+      releaseRef.current?.()
+      releaseRef.current = node instanceof HTMLElement ? keepTextFocusThroughTaps(node, mode) : null
+    },
+    [mode]
+  )
+}
diff --git a/mobile/src/platform/live-input-composing-range.test.ts b/mobile/src/platform/live-input-composing-range.test.ts
new file mode 100644
index 00000000000..f056f03e837
--- /dev/null
+++ b/mobile/src/platform/live-input-composing-range.test.ts
@@ -0,0 +1,44 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { reportedLiveInputComposing } from './live-input-composing-range'
+import { reportedLiveInputComposing as reportedPageLiveInputComposing } from './live-input-composing-range.web'
+
+const ANDROID_WEBVIEW = 'Mozilla/5.0 (Linux; Android 16; wv) Chrome/140'
+const IPHONE_WEBVIEW = 'Mozilla/5.0 (iPhone; CPU iPhone OS 19_0 like Mac OS X) AppleWebKit/605.1.15'
+
+describe('the composing range a live input reports', () => {
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  it('passes the native event through, whatever the user agent says', () => {
+    vi.stubGlobal('navigator', { userAgent: ANDROID_WEBVIEW })
+    expect([true, false, undefined].map(reportedLiveInputComposing)).toEqual([
+      true,
+      false,
+      undefined
+    ])
+  })
+
+  it('reports no range in an Android WebView, as native Android does', () => {
+    vi.stubGlobal('navigator', { userAgent: ANDROID_WEBVIEW })
+    expect([true, false, undefined].map(reportedPageLiveInputComposing)).toEqual([
+      undefined,
+      undefined,
+      undefined
+    ])
+  })
+
+  it("passes the DOM's range through in any other browser", () => {
+    vi.stubGlobal('navigator', { userAgent: IPHONE_WEBVIEW })
+    expect([true, false, undefined].map(reportedPageLiveInputComposing)).toEqual([
+      true,
+      false,
+      undefined
+    ])
+  })
+
+  it('passes the range through where there is no navigator', () => {
+    vi.stubGlobal('navigator', undefined)
+    expect(reportedPageLiveInputComposing(true)).toBe(true)
+  })
+})
diff --git a/mobile/src/platform/live-input-composing-range.ts b/mobile/src/platform/live-input-composing-range.ts
new file mode 100644
index 00000000000..99835eed7d6
--- /dev/null
+++ b/mobile/src/platform/live-input-composing-range.ts
@@ -0,0 +1,7 @@
+/**
+ * The marked-text range a live input's change event reports, as the host's text system means it.
+ * Native passes the event's own through: iOS reports its range, React Native Android reports none.
+ */
+export function reportedLiveInputComposing(isComposing: boolean | undefined): boolean | undefined {
+  return isComposing
+}
diff --git a/mobile/src/platform/live-input-composing-range.web.ts b/mobile/src/platform/live-input-composing-range.web.ts
new file mode 100644
index 00000000000..61b46a3096e
--- /dev/null
+++ b/mobile/src/platform/live-input-composing-range.web.ts
@@ -0,0 +1,11 @@
+/**
+ * Web sibling: the event is the DOM's, so its `isComposing` passes through except in an Android
+ * WebView, which reports none, as native Android does.
+ */
+export function reportedLiveInputComposing(isComposing: boolean | undefined): boolean | undefined {
+  // Why: Android keyboards compose every Latin word, so the DOM's range would hold each one unsent.
+  if (globalThis.navigator?.userAgent?.includes('Android')) {
+    return undefined
+  }
+  return isComposing
+}
diff --git a/mobile/src/platform/microphone-screen-lock-census.test.ts b/mobile/src/platform/microphone-screen-lock-census.test.ts
deleted file mode 100644
index 992918930e4..00000000000
--- a/mobile/src/platform/microphone-screen-lock-census.test.ts
+++ /dev/null
@@ -1,104 +0,0 @@
-/**
- * Who may name the screen: one module, and nothing on the page.
- *
- * The screen a dictation holds awake is a property of the microphone, so the device module that
- * opens the mic takes it and gives it back. Everything above that — the composer's five states, the
- * pending-audio budget, where a transcript is routed — has no business naming it, and the page has
- * no way to: the verb it used to ask through is gone, along with the tag pools, the timeouts and
- * the foreground re-acquire that existed to keep the page's idea of the screen and the device's
- * agreeing.
- *
- * A census rather than a rule in a reviewer's head, because the seam grew back twice from exactly
- * the shape this forbids: a page that can ask for a wake tag acquires the bookkeeping to track what
- * it asked for. Existence, not shape — any import of the package, and any mention of the verb's
- * name at all, from any file but the one owner.
- */
-import { readFileSync, readdirSync } from 'node:fs'
-import { relative, join } from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { describe, expect, it } from 'vitest'
-
-const MOBILE_DIR = fileURLToPath(new URL('../../', import.meta.url))
-
-/** The one module that may hold the screen: the device calls the microphone's capture makes. */
-const SCREEN_LOCK_OWNER = 'src/platform/native-audio-device.ts'
-
-/** This file names both things it forbids, so it reads every file but itself. */
-const CENSUS = 'src/platform/microphone-screen-lock-census.test.ts'
-
-const KEEP_AWAKE_PACKAGE = 'expo-keep-awake'
-
-/** Built rather than written, so the census does not contain the word it bans. */
-const RETIRED_VERB_WORD = `wake${'lock'}`
-
-function sourceFiles(): string[] {
-  const found: string[] = []
-  const walk = (dir: string): void => {
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
-      const full = join(dir, entry.name)
-      if (entry.isDirectory()) {
-        walk(full)
-        continue
-      }
-      if (entry.name.endsWith('.ts') || entry.name.endsWith('.tsx')) {
-        found.push(relative(MOBILE_DIR, full))
-      }
-    }
-  }
-  for (const root of ['src', 'app']) {
-    walk(join(MOBILE_DIR, root))
-  }
-  return found.sort()
-}
-
-/** The line, not just the file: a census that answers "somewhere in 1,400 files" is one a reader
- *  has to re-run by hand before they can act on it. */
-function hits(match: (line: string) => boolean, skip: readonly string[]): string[] {
-  const found: string[] = []
-  for (const file of sourceFiles()) {
-    if (skip.includes(file)) {
-      continue
-    }
-    const lines = readFileSync(join(MOBILE_DIR, file), 'utf8').split('\n')
-    for (const [index, line] of lines.entries()) {
-      if (match(line)) {
-        found.push(`${file}:${index + 1}: ${line.trim()}`)
-      }
-    }
-  }
-  return found
-}
-
-/** An import of the package, which is a module that can hold the screen. A test's `vi.mock` of it
- *  is not one: the mock exists because the graph reaches the owner, which is the rule holding. */
-const importsKeepAwake = (line: string): boolean =>
-  line.includes(`from '${KEEP_AWAKE_PACKAGE}'`) || line.includes(`require('${KEEP_AWAKE_PACKAGE}')`)
-
-const namesRetiredVerb = (line: string): boolean =>
-  line.toLowerCase().includes(RETIRED_VERB_WORD.toLowerCase())
-
-describe('the one module that may hold the screen awake', () => {
-  it('is the only one that imports the keep-awake package', () => {
-    expect(hits(importsKeepAwake, [SCREEN_LOCK_OWNER, CENSUS])).toEqual([])
-  })
-
-  it('does import it, so the absence above is the rule holding and not the match missing', () => {
-    // The presence precondition every absence needs: the matcher finds the one file that should
-    // match, so a typo in the package name fails here rather than passing everywhere.
-    expect(hits(importsKeepAwake, [CENSUS]).map((hit) => hit.split(':')[0])).toEqual([
-      SCREEN_LOCK_OWNER
-    ])
-  })
-
-  it('leaves no page-facing name for the screen anywhere in the app', () => {
-    // The retired verb, in any casing: a grant row, a schema, a server, a tag, a mock or a comment
-    // pointing at a seam that no longer exists.
-    expect(hits(namesRetiredVerb, [CENSUS])).toEqual([])
-  })
-
-  it('reads a tree big enough for those absences to mean something', () => {
-    // A walk that found nothing would pass all three rules above by having nothing to judge.
-    expect(sourceFiles().length).toBeGreaterThan(900)
-    expect(sourceFiles()).toContain(SCREEN_LOCK_OWNER)
-  })
-})
diff --git a/mobile/src/platform/software-keyboard-window-inset.test.ts b/mobile/src/platform/software-keyboard-window-inset.test.ts
deleted file mode 100644
index b458993d0ea..00000000000
--- a/mobile/src/platform/software-keyboard-window-inset.test.ts
+++ /dev/null
@@ -1,39 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { softwareKeyboardWindowInset } from './software-keyboard-window-inset'
-
-describe('the strip of the window the software keyboard takes', () => {
-  it('is nothing while the keyboard is closed', () => {
-    expect(
-      softwareKeyboardWindowInset({ keyboardHeight: 0, bottomInset: 48, platform: 'android' })
-    ).toBe(0)
-  })
-
-  it('is the iOS frame height as reported, which already spans the home indicator', () => {
-    expect(
-      softwareKeyboardWindowInset({ keyboardHeight: 336, bottomInset: 34, platform: 'ios' })
-    ).toBe(336)
-  })
-
-  it('adds the navigation bar back on Android, whose IME height stops above it', () => {
-    // The session dock is the proof this split is real: it pads itself by the inset and then
-    // translates by the raw height, which lands on the keys only if Android's excludes the bar.
-    expect(
-      softwareKeyboardWindowInset({ keyboardHeight: 336, bottomInset: 48, platform: 'android' })
-    ).toBe(384)
-  })
-
-  it('takes the page host as a phone, since it is one: the shell runs no web build', () => {
-    expect(
-      softwareKeyboardWindowInset({ keyboardHeight: 300, bottomInset: 20, platform: 'web' })
-    ).toBe(320)
-  })
-
-  it('never reports a negative strip, whatever the event and the inset say', () => {
-    expect(
-      softwareKeyboardWindowInset({ keyboardHeight: -10, bottomInset: 48, platform: 'android' })
-    ).toBe(0)
-    expect(
-      softwareKeyboardWindowInset({ keyboardHeight: 336, bottomInset: -48, platform: 'android' })
-    ).toBe(336)
-  })
-})
diff --git a/mobile/src/platform/software-keyboard-window-inset.ts b/mobile/src/platform/software-keyboard-window-inset.ts
deleted file mode 100644
index 0c15bba7c2a..00000000000
--- a/mobile/src/platform/software-keyboard-window-inset.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-/**
- * The strip at the bottom of the window the software keyboard takes, for a view that owns the
- * window and has to shorten itself out of the way. The two platforms measure the IME from
- * different edges: iOS's frame height starts at the bottom of the window and already spans the
- * home indicator, Android's starts above the system bars, so only Android adds the bar back.
- */
-export function softwareKeyboardWindowInset(input: {
-  keyboardHeight: number
-  bottomInset: number
-  platform: 'ios' | 'android' | 'windows' | 'macos' | 'web'
-}): number {
-  const keyboardHeight = Math.max(0, input.keyboardHeight)
-  if (keyboardHeight === 0) {
-    return 0
-  }
-  return input.platform === 'ios' ? keyboardHeight : keyboardHeight + Math.max(0, input.bottomInset)
-}
diff --git a/mobile/src/session/MobileDiffReviewRouteScreen.tsx b/mobile/src/session/MobileDiffReviewRouteScreen.tsx
index f457bd4f64d..58c19b19da6 100644
--- a/mobile/src/session/MobileDiffReviewRouteScreen.tsx
+++ b/mobile/src/session/MobileDiffReviewRouteScreen.tsx
@@ -5,6 +5,7 @@ import { firstReviewParam, normalizeReviewFilterParam } from './mobile-diff-revi
 import { normalizeReviewAreaParam } from './mobile-diff-review-positioning'
 import { useMobileDiffReviewController } from './use-mobile-diff-review-controller'
 import { useForceReconnect, useHostClient } from '../transport/client-context'
+import { useHostProtocolGates } from '../components/HostProtocolGate'
 import { useRouteHandoff } from '../navigation/route-handoff'
 
 /**
@@ -51,9 +52,13 @@ export function MobileDiffReviewRouteScreen() {
     )
   }, [hostId, name, router, worktreeId])
 
+  const { hostCapabilities, statusPending, statusReadable } = useHostProtocolGates()
   const controller = useMobileDiffReviewController({
     client,
     connState,
+    hostCapabilities,
+    hostStatusPending: statusPending,
+    hostStatusReadable: statusReadable,
     hostId,
     worktreeId,
     name,
diff --git a/mobile/src/session/MobileNativeChatMessage.test.ts b/mobile/src/session/MobileNativeChatMessage.test.ts
index 67e90132866..935fe2ef0f3 100644
--- a/mobile/src/session/MobileNativeChatMessage.test.ts
+++ b/mobile/src/session/MobileNativeChatMessage.test.ts
@@ -285,3 +285,74 @@ describe('MobileNativeChatMessage', () => {
     })
   })
 })
+
+describe("MobileNativeChatMessage — a subagent's row speaks as that subagent", () => {
+  let renderer: ReactTestRenderer | null = null
+
+  afterEach(() => {
+    act(() => renderer?.unmount())
+    renderer = null
+  })
+
+  function renderAgentRow(agentId: string | undefined, subagentLabel?: string): ReactTestRenderer {
+    const message: NativeChatMessage = {
+      id: 'a1',
+      role: 'assistant',
+      blocks: [{ type: 'text', text: 'The PR is CLEAN.' }],
+      timestamp: null,
+      source: 'transcript',
+      ...(agentId === undefined ? {} : { agentId })
+    }
+    act(() => {
+      renderer = create(createElement(MobileNativeChatMessage, { message, subagentLabel }))
+    })
+    return renderer!
+  }
+
+  const captions = (tree: ReactTestRenderer): ReactTestInstance[] =>
+    tree.root
+      .findAllByType('Text' as never)
+      .filter((node) => typeof node.props.accessibilityLabel === 'string')
+
+  it('names the subagent that wrote the row', () => {
+    const [caption] = captions(renderAgentRow('task-1', 'review the PR'))
+    expect(caption?.props.accessibilityLabel).toBe('Written by subagent review the PR')
+    expect(caption?.children.join('')).toBe('review the PR')
+  })
+
+  it('still marks the row as a subagent when no loaded roster names it', () => {
+    const [caption] = captions(renderAgentRow('task-9'))
+    expect(caption?.children.join('')).toBe('Subagent')
+  })
+
+  it("adds nothing to the session's own row", () => {
+    expect(captions(renderAgentRow(undefined, 'review the PR'))).toEqual([])
+  })
+
+  it('names no one on a settled row whose only content is hidden, and names the live one', () => {
+    const toolOnly: NativeChatMessage = {
+      id: 'a2',
+      role: 'assistant',
+      blocks: [{ type: 'tool-call', name: 'Grep', input: {}, state: 'completed' }],
+      timestamp: null,
+      source: 'transcript',
+      agentId: 'task-1'
+    }
+    const renderToolOnly = (activeTurnIsWorking: boolean): ReactTestRenderer => {
+      act(() => {
+        renderer = create(
+          createElement(MobileNativeChatMessage, {
+            message: toolOnly,
+            subagentLabel: 'review the PR',
+            structuredActivityUi: true,
+            activeTurnIsWorking
+          })
+        )
+      })
+      return renderer!
+    }
+    expect(captions(renderToolOnly(false))).toEqual([])
+    act(() => renderer?.unmount())
+    expect(captions(renderToolOnly(true))).toHaveLength(1)
+  })
+})
diff --git a/mobile/src/session/MobileNativeChatMessage.tsx b/mobile/src/session/MobileNativeChatMessage.tsx
index 9b480fdd7d9..a2f14196e36 100644
--- a/mobile/src/session/MobileNativeChatMessage.tsx
+++ b/mobile/src/session/MobileNativeChatMessage.tsx
@@ -4,6 +4,8 @@ import { Image, Text as NativeText, View } from 'react-native'
 import { splitNativeChatBlocks } from '../../../src/shared/native-chat-tool-fold'
 import { selectActiveToolCall } from '../../../src/shared/native-chat-tool-activity'
 import { isImageRefBlock, isTextBlock } from '../../../src/shared/native-chat-types'
+import { agentJournalItemSubagentId } from '../../../src/shared/agent-session-journal-producer'
+import { NATIVE_CHAT_SUBAGENT_ATTRIBUTION_COPY } from '../../../src/shared/native-chat-subagent-attribution'
 import type { NativeChatBlock, NativeChatMessage } from '../../../src/shared/native-chat-types'
 import { MobileMarkdown } from '../components/MobileMarkdown'
 import { MobileNativeChatTurnStatus } from './MobileNativeChatTurnStatus'
@@ -71,19 +73,23 @@ function MobileNativeChatMessageImpl({
   fontScale = 1,
   onOpenFile,
   turnStatus,
+  turnStatusAbove = false,
   turnExpanded,
   turnKey,
   onToggleTurn,
   activeTurnIsWorking,
-  structuredActivityUi = false
+  structuredActivityUi = false,
+  subagentLabel
 }: {
   message: NativeChatMessage
   toolsExpanded?: boolean
   /** Multiplies all chat text sizes for pinch-to-zoom (1 = no change). */
   fontScale?: number
   onOpenFile?: (relativePath: string) => void
-  /** This settled turn's status row, rendered under its user message. */
+  /** This turn's status row, rendered under its opening user message. */
   turnStatus?: NativeChatTurnStatus | null
+  /** Render the status above the row: its turn has no user bubble of its own. */
+  turnStatusAbove?: boolean
   /** Whether the turn caret has disclosed this turn's activity. */
   turnExpanded?: boolean
   /** Set only when this row's turn has settled and can disclose its activity. */
@@ -94,6 +100,8 @@ function MobileNativeChatMessageImpl({
   activeTurnIsWorking?: boolean
   /** Structured lane only: live tool progress plus the turn-status disclosure. */
   structuredActivityUi?: boolean
+  /** The roster's name for the subagent that wrote this row, when one names it. */
+  subagentLabel?: string
 }): React.JSX.Element {
   const isUser = message.role === 'user'
   const isReasoning = message.role === 'reasoning'
@@ -115,13 +123,50 @@ function MobileNativeChatMessageImpl({
     !turnExpanded &&
     !toolsExpanded
   const showToolRun = tools.length > 0 && !settledToolsHidden
+  // A subagent's row sits where it happened but speaks as that subagent. A row
+  // whose only content is hidden behind its settled turn names no one.
+  const subagentName =
+    isUser || agentJournalItemSubagentId(message) === null || (prose.length === 0 && !showToolRun)
+      ? null
+      : (subagentLabel ?? NATIVE_CHAT_SUBAGENT_ATTRIBUTION_COPY.unnamed)
 
+  const statusRow = turnStatus ? (
+    <MobileNativeChatTurnStatus
+      startedAt={turnStatus.startedAt}
+      workedSeconds={turnStatus.workedSeconds}
+      expanded={turnExpanded ?? false}
+      onToggleExpanded={turnKey && onToggleTurn ? () => onToggleTurn(turnKey) : undefined}
+    />
+  ) : null
   return (
     <>
+      {/* A turn with no user bubble carries its bar above its first row. */}
+      {turnStatusAbove ? statusRow : null}
       <View style={[styles.row, isUser && styles.rowUser]}>
         <View
-          style={[styles.content, isUser && styles.userBubble, isReasoning && styles.reasoning]}
+          style={[
+            styles.content,
+            isUser && styles.userBubble,
+            isReasoning && styles.reasoning,
+            subagentName !== null && styles.subagent
+          ]}
         >
+          {subagentName !== null ? (
+            <NativeText
+              style={styles.subagentCaption}
+              accessibilityLabel={
+                subagentLabel === undefined
+                  ? subagentName
+                  : NATIVE_CHAT_SUBAGENT_ATTRIBUTION_COPY.writtenBy.replaceAll(
+                      '{{value0}}',
+                      subagentLabel
+                    )
+              }
+              numberOfLines={1}
+            >
+              {subagentName}
+            </NativeText>
+          ) : null}
           {prose.map((block, index) => (
             <Prose
               key={index}
@@ -145,15 +190,7 @@ function MobileNativeChatMessageImpl({
           ) : null}
         </View>
       </View>
-      {turnStatus ? (
-        <MobileNativeChatTurnStatus
-          startedAt={turnStatus.startedAt}
-          thinking={turnStatus.thinking}
-          workedSeconds={turnStatus.workedSeconds}
-          expanded={turnExpanded ?? false}
-          onToggleExpanded={turnKey && onToggleTurn ? () => onToggleTurn(turnKey) : undefined}
-        />
-      ) : null}
+      {turnStatusAbove ? null : statusRow}
     </>
   )
 }
diff --git a/mobile/src/session/MobileNativeChatOverlay.tsx b/mobile/src/session/MobileNativeChatOverlay.tsx
index 65f25e4ea24..9640608114b 100644
--- a/mobile/src/session/MobileNativeChatOverlay.tsx
+++ b/mobile/src/session/MobileNativeChatOverlay.tsx
@@ -76,6 +76,7 @@ export function MobileNativeChatOverlay({
         turnIndicator={controller.nativeChatTurnIndicator}
         workingStartedAt={controller.nativeChatWorkingStartedAt}
         settledTurns={controller.nativeChatSettledTurns}
+        turnJournal={controller.nativeChatTurnJournal}
         streaming={streaming}
         onStop={controller.handleNativeChatStop}
         ask={controller.nativeChatAsk}
diff --git a/mobile/src/session/MobileNativeChatTurnStatus.test.ts b/mobile/src/session/MobileNativeChatTurnStatus.test.ts
index 6b6a1d49e07..e99412b42bf 100644
--- a/mobile/src/session/MobileNativeChatTurnStatus.test.ts
+++ b/mobile/src/session/MobileNativeChatTurnStatus.test.ts
@@ -19,27 +19,34 @@ vi.mock('react-native', async () => {
 })
 vi.mock('lucide-react-native', () => ({ ChevronRight: 'ChevronRight' }))
 
-import { MobileNativeChatTurnStatus } from './MobileNativeChatTurnStatus'
+import {
+  MobileNativeChatTurnActivity,
+  MobileNativeChatTurnStatus
+} from './MobileNativeChatTurnStatus'
+
+const labels = (node: ReactTestInstance): string[] =>
+  node.findAllByType('Text' as never).map((text) => String(text.children.join('')))
+
+const spinners = (node: ReactTestInstance): ReactTestInstance[] =>
+  node.findAllByType('ActivityIndicator' as never)
+
+let renderer: ReactTestRenderer | null = null
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.setSystemTime(new Date('2026-09-04T00:00:00Z'))
+})
+
+afterEach(() => {
+  act(() => renderer?.unmount())
+  renderer = null
+  vi.useRealTimers()
+})
 
 describe('MobileNativeChatTurnStatus', () => {
-  let renderer: ReactTestRenderer | null = null
-
-  beforeEach(() => {
-    vi.useFakeTimers()
-    vi.setSystemTime(new Date('2026-09-04T00:00:00Z'))
-  })
-
-  afterEach(() => {
-    act(() => renderer?.unmount())
-    renderer = null
-    vi.useRealTimers()
-  })
-
   function render(props: {
     startedAt: number | null
-    thinking: boolean
     workedSeconds?: number | null
-    activityText?: string | null
     expanded?: boolean
     onToggleExpanded?: () => void
   }): ReactTestRenderer {
@@ -49,49 +56,19 @@ describe('MobileNativeChatTurnStatus', () => {
     return renderer!
   }
 
-  const labels = (node: ReactTestInstance): string[] =>
-    node.findAllByType('Text' as never).map((text) => String(text.children.join('')))
-
-  const spinners = (node: ReactTestInstance): ReactTestInstance[] =>
-    node.findAllByType('ActivityIndicator' as never)
-
-  it('reads "Thinking" beside one spinner while the turn reasons', () => {
-    const tree = render({ startedAt: Date.now(), thinking: true })
-    expect(labels(tree.root)).toEqual(['Thinking'])
-    expect(spinners(tree.root)).toHaveLength(1)
-  })
-
-  it('counts up on that same single row when the turn is not reasoning', () => {
-    const startedAt = Date.now()
-    const tree = render({ startedAt, thinking: false })
+  it('counts up from the first second while the turn runs, with no spinner', () => {
+    const tree = render({ startedAt: Date.now() })
     expect(labels(tree.root)).toEqual(['Working for 0s'])
     act(() => {
       vi.advanceTimersByTime(12_000)
     })
     expect(labels(tree.root)).toEqual(['Working for 12s'])
-    expect(spinners(tree.root)).toHaveLength(1)
-  })
-
-  it('lets provider activity text beat both fallbacks and hold the clock', () => {
-    const tree = render({
-      startedAt: Date.now(),
-      thinking: true,
-      activityText: 'Running pnpm test'
-    })
-    expect(labels(tree.root)).toEqual(['Running pnpm test'])
-    expect(spinners(tree.root)).toHaveLength(1)
-    // No label consumes the duration, so nothing schedules a tick for it.
-    expect(vi.getTimerCount()).toBe(0)
+    expect(spinners(tree.root)).toHaveLength(0)
   })
 
   it('settles to a tappable "Worked for" row that toggles the turn', () => {
     const onToggleExpanded = vi.fn()
-    const tree = render({
-      startedAt: Date.now(),
-      thinking: false,
-      workedSeconds: 184,
-      onToggleExpanded
-    })
+    const tree = render({ startedAt: Date.now(), workedSeconds: 184, onToggleExpanded })
     expect(labels(tree.root)).toEqual(['Worked for 3m 4s'])
     const button = tree.root.findByType('Pressable' as never)
     expect(button.props.accessibilityLabel).toBe('Toggle turn details')
@@ -101,19 +78,46 @@ describe('MobileNativeChatTurnStatus', () => {
   })
 
   it('stays a plain row when the settled turn has nothing to disclose', () => {
-    const tree = render({ startedAt: Date.now(), thinking: false, workedSeconds: 5 })
+    const tree = render({ startedAt: Date.now(), workedSeconds: 5 })
     expect(tree.root.findAllByType('Pressable' as never)).toHaveLength(0)
     expect(labels(tree.root)).toEqual(['Worked for 5s'])
   })
 
-  it('holds no interval, and no spinner, once the turn has settled', () => {
-    const tree = render({ startedAt: Date.now(), thinking: false, workedSeconds: 5 })
+  it('holds no interval once the turn has settled', () => {
+    render({ startedAt: Date.now(), workedSeconds: 5 })
     expect(vi.getTimerCount()).toBe(0)
-    expect(spinners(tree.root)).toHaveLength(0)
+  })
+})
+
+describe('MobileNativeChatTurnActivity', () => {
+  function render(props: { thinking: boolean; activityText?: string | null }): ReactTestRenderer {
+    act(() => {
+      renderer = create(createElement(MobileNativeChatTurnActivity, props))
+    })
+    return renderer!
+  }
+
+  it('reads "Thinking" beside one spinner while the turn reasons', () => {
+    const tree = render({ thinking: true })
+    expect(labels(tree.root)).toEqual(['Thinking'])
+    expect(spinners(tree.root)).toHaveLength(1)
   })
 
-  it('announces the live row to assistive tech', () => {
-    const tree = render({ startedAt: Date.now(), thinking: true })
+  // The bar owns the clock; the tail line never repeats it.
+  it('reads plain "Working…" when the turn is not reasoning, and holds no timer', () => {
+    const tree = render({ thinking: false })
+    expect(labels(tree.root)).toEqual(['Working…'])
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('lets provider activity text beat both fallbacks', () => {
+    const tree = render({ thinking: true, activityText: 'Running pnpm test' })
+    expect(labels(tree.root)).toEqual(['Running pnpm test'])
+    expect(spinners(tree.root)).toHaveLength(1)
+  })
+
+  it('announces the live line to assistive tech', () => {
+    const tree = render({ thinking: true })
     const row = tree.root.findByType('View' as never)
     expect(row.props.accessibilityLiveRegion).toBe('polite')
     expect(row.props.accessibilityLabel).toBe('Agent is responding')
diff --git a/mobile/src/session/MobileNativeChatTurnStatus.tsx b/mobile/src/session/MobileNativeChatTurnStatus.tsx
index acf922265f6..25003685240 100644
--- a/mobile/src/session/MobileNativeChatTurnStatus.tsx
+++ b/mobile/src/session/MobileNativeChatTurnStatus.tsx
@@ -26,38 +26,28 @@ function useElapsedSeconds(startedAt: number | null, counting: boolean): number
   return counting ? nativeChatElapsedSeconds(startedAt, mountedAt, now) : 0
 }
 
-/** The per-turn status row. While the turn runs it is the one live indicator — a
- *  spinner beside what the provider says it is doing, else "Thinking", else
- *  "Working for 12s". It settles to a tappable "Worked for 3m 4s" that discloses
- *  the turn's tool activity. Desktop parity: `NativeChatTurnActivityLine` for the
- *  live row, `NativeChatWorkingStatus` for the settled one. */
+/** The turn bar under the user's message: "Working for 12s" while the turn runs,
+ *  settling in place to a tappable "Worked for 3m 4s" that discloses the turn's
+ *  tool activity. Desktop parity: `NativeChatWorkingStatus`. */
 export function MobileNativeChatTurnStatus({
   startedAt,
-  thinking,
   workedSeconds,
-  activityText,
   expanded = false,
   onToggleExpanded
 }: {
   startedAt: number | null
-  thinking: boolean
   workedSeconds?: number | null
-  /** Provider activity copy for a live turn; outranks the other two labels. */
-  activityText?: string | null
   expanded?: boolean
   onToggleExpanded?: () => void
 }): React.JSX.Element {
   const settled = workedSeconds != null
-  const counting = !settled && !thinking && !activityText?.trim()
-  const elapsedSeconds = useElapsedSeconds(startedAt, counting)
-  const label = settled
-    ? formatNativeChatTurnStatusLabel({ thinking, workedSeconds, elapsedSeconds })
-    : formatNativeChatActiveTurnLabel({ activityText, thinking, elapsedSeconds })
+  const elapsedSeconds = useElapsedSeconds(startedAt, !settled)
+  const label = formatNativeChatTurnStatusLabel({ workedSeconds, elapsedSeconds })
 
   if (settled && onToggleExpanded) {
     return (
       <Pressable
-        style={({ pressed }) => [styles.row, styles.rowSettled, pressed && styles.pressed]}
+        style={({ pressed }) => [styles.row, styles.bar, pressed && styles.pressed]}
         onPress={onToggleExpanded}
         hitSlop={6}
         accessibilityRole="button"
@@ -72,15 +62,34 @@ export function MobileNativeChatTurnStatus({
     )
   }
 
+  return (
+    <View style={[styles.row, styles.bar]}>
+      <Text style={styles.label} numberOfLines={1}>
+        {label}
+      </Text>
+    </View>
+  )
+}
+
+/** The live turn's tail line: a spinner beside what the provider says it is doing,
+ *  else "Thinking", else "Working…". The clock stays in the turn bar. Desktop
+ *  parity: `NativeChatTurnActivityLine`. */
+export function MobileNativeChatTurnActivity({
+  thinking,
+  activityText
+}: {
+  thinking: boolean
+  activityText?: string | null
+}): React.JSX.Element {
   return (
     <View
-      style={[styles.row, settled ? styles.rowSettled : null]}
+      style={styles.row}
       accessibilityLiveRegion="polite"
       accessibilityLabel={NATIVE_CHAT_TURN_STATUS_COPY.responding}
     >
-      {settled ? null : <ActivityIndicator size="small" color={colors.textMuted} />}
+      <ActivityIndicator size="small" color={colors.textMuted} />
       <Text style={styles.label} numberOfLines={1}>
-        {label}
+        {formatNativeChatActiveTurnLabel({ activityText, thinking })}
       </Text>
     </View>
   )
@@ -94,7 +103,7 @@ const styles = StyleSheet.create({
     minHeight: 28,
     paddingHorizontal: spacing.md
   },
-  rowSettled: {
+  bar: {
     borderBottomWidth: StyleSheet.hairlineWidth,
     borderBottomColor: colors.borderSubtle
   },
diff --git a/mobile/src/session/MobileNativeChatView.test.ts b/mobile/src/session/MobileNativeChatView.test.ts
index 6b80c3500ae..fa29e13c8c8 100644
--- a/mobile/src/session/MobileNativeChatView.test.ts
+++ b/mobile/src/session/MobileNativeChatView.test.ts
@@ -703,14 +703,14 @@ describe('MobileNativeChatView', () => {
       return renderer!.root.findAll((node) => node.type === 'WorkingIndicator')
     }
 
-    it('puts the live status at the turn tail and drops the three-dot indicator', async () => {
+    it('puts the clock bar under the prompt, activity at the tail, and drops the three dots', async () => {
       const folded = [userTurn('u1', 'go'), assistantTurn('a1', 'still working')]
       await render({ messages: folded, folded, structuredActivityUi: true, agentWorking: true })
       const props = rowProps('u1')
       expect(props.structuredActivityUi).toBe(true)
-      expect(props.turnStatus).toBeNull()
-      // Nothing reports reasoning, so the one live footer counts instead of guessing.
-      expect(footerProps()).toMatchObject({ thinking: false, workedSeconds: null })
+      expect(props.turnStatus).toMatchObject({ workedSeconds: null })
+      // Nothing reports reasoning, so the tail line reads plain working instead of guessing.
+      expect(footerProps()).toEqual({ thinking: false, activityText: null })
       expect(listIds().at(-1)).toBe('a1')
       expect(props.activeTurnIsWorking).toBe(true)
       expect(workingIndicators()).toHaveLength(0)
@@ -778,7 +778,7 @@ describe('MobileNativeChatView', () => {
       expect(renderer!.root.findAll((node) => node.type === testCase.cardType)).toHaveLength(1)
 
       await update(working)
-      expect(footerProps()).toMatchObject({ thinking: false, workedSeconds: null })
+      expect(footerProps()).toMatchObject({ thinking: false })
       expect(rowProps('a1').activeTurnIsWorking).toBe(true)
     })
 
@@ -791,8 +791,8 @@ describe('MobileNativeChatView', () => {
         agentWorking: true,
         turnIndicator: { thinking: true, activityText: null }
       })
-      expect(rowProps('u1').turnStatus).toBeNull()
-      expect(footerProps()).toMatchObject({ thinking: true, workedSeconds: null })
+      expect(rowProps('u1').turnStatus).toMatchObject({ workedSeconds: null })
+      expect(footerProps()).toMatchObject({ thinking: true })
     })
 
     it('hands the live row the provider activity copy that outranks its fallbacks', async () => {
@@ -838,8 +838,8 @@ describe('MobileNativeChatView', () => {
     it('settles the finished turn to a tappable duration', async () => {
       const folded = [userTurn('u1', 'go'), assistantTurn('a1', 'done')]
       await render({ messages: folded, folded, structuredActivityUi: true, agentWorking: true })
-      expect(rowProps('u1').turnStatus).toBeNull()
-      expect(footerProps()).toMatchObject({ thinking: false, workedSeconds: null })
+      expect(rowProps('u1').turnStatus).toMatchObject({ workedSeconds: null })
+      expect(footerProps()).toMatchObject({ thinking: false })
       await update({ messages: folded, folded, structuredActivityUi: true, agentWorking: false })
       const settled = rowProps('u1')
       expect(settled.turnStatus).toMatchObject({ thinking: false })
@@ -857,7 +857,7 @@ describe('MobileNativeChatView', () => {
       expect(rowProps('a1').turnStatus).toBeNull()
       // The assistant row still belongs to the live turn, so its tool row stays visible.
       expect(rowProps('a1').activeTurnIsWorking).toBe(true)
-      expect(footerProps()).toMatchObject({ workedSeconds: null })
+      expect(footerProps()).toMatchObject({ thinking: false })
     })
 
     it('does not carry a running turn clock across chat surfaces', async () => {
@@ -872,7 +872,7 @@ describe('MobileNativeChatView', () => {
           agentWorking: true,
           sendSurfaceId: 'host\0worktree\0tab-a'
         })
-        expect(footerProps()).toMatchObject({ startedAt: 1_000 })
+        expect(rowProps('u1').turnStatus).toMatchObject({ startedAt: 1_000 })
 
         vi.setSystemTime(12_000)
         const secondTab = [userTurn('u2', 'second')]
@@ -884,7 +884,7 @@ describe('MobileNativeChatView', () => {
           sendSurfaceId: 'host\0worktree\0tab-b'
         })
 
-        expect(footerProps()).toMatchObject({ startedAt: 12_000 })
+        expect(rowProps('u2').turnStatus).toMatchObject({ startedAt: 12_000 })
       } finally {
         vi.useRealTimers()
       }
diff --git a/mobile/src/session/MobileNativeChatView.tsx b/mobile/src/session/MobileNativeChatView.tsx
index 6a51601d151..6247c5f6c7c 100644
--- a/mobile/src/session/MobileNativeChatView.tsx
+++ b/mobile/src/session/MobileNativeChatView.tsx
@@ -13,12 +13,18 @@ import { GestureDetector, GestureHandlerRootView } from 'react-native-gesture-ha
 import { ArrowDown, ChevronsDownUp, ChevronsUpDown, Square } from 'lucide-react-native'
 import type { AskAnswerSelection, AskPrompt } from '../../../src/shared/native-chat-ask'
 import type { NativeChatMessage } from '../../../src/shared/native-chat-types'
+import {
+  nativeChatSubagentLabel,
+  nativeChatSubagentLabels
+} from '../../../src/shared/native-chat-subagent-attribution'
 import type {
   NativeChatLiveTurnIndicator,
   NativeChatSettledTurns
 } from '../../../src/shared/native-chat-turn-status'
+import type { NativeChatTurnJournal } from '../../../src/shared/native-chat-turn-membership'
 import { colors } from '../theme/mobile-theme'
 import { styles } from './mobile-native-chat-view-styles'
+import { mobileNativeChatListFooter } from './mobile-native-chat-list-footer'
 import {
   buildMobileNativeChatTransientData,
   mobileNativeChatEmptyState,
@@ -28,7 +34,7 @@ import { useMobileNativeChatPinchGesture } from './use-mobile-native-chat-pinch-
 import { useMobileNativeChatTailFollow } from './use-mobile-native-chat-tail-follow'
 import { useMobileNativeChatTurnDisclosure } from './use-mobile-native-chat-turn-disclosure'
 import { useSettledMobileNativeChatInputLock } from './use-mobile-native-chat-input-lease'
-import { MobileNativeChatTurnStatus } from './MobileNativeChatTurnStatus'
+import { MobileNativeChatTurnActivity } from './MobileNativeChatTurnStatus'
 import { MobileAgentWorkingIndicator } from './MobileAgentWorkingIndicator'
 import type { PendingNativeChatImage } from './mobile-native-chat-image-attachment'
 import { MobileNativeChatComposer } from './MobileNativeChatComposer'
@@ -62,6 +68,8 @@ type Props = {
   /** Structured lane: host-recorded turn timing feeding the per-turn status rows. */
   workingStartedAt?: number | null
   settledTurns?: NativeChatSettledTurns | null
+  /** Structured lane: the journal that places each row in its turn. */
+  turnJournal?: NativeChatTurnJournal | null
   /** Interrupt the agent mid-turn (shown as a Stop button on the working bar). */
   /** Interrupt a provider turn. */
   onStop?: () => void
@@ -147,6 +155,7 @@ export function MobileNativeChatView({
   turnIndicator = null,
   workingStartedAt,
   settledTurns,
+  turnJournal = null,
   onStop,
   streaming,
   hasMore,
@@ -209,6 +218,7 @@ export function MobileNativeChatView({
       }),
     [messages, folded, streaming, pending, imagePreviewsByMessageId]
   )
+  const subagentLabels = useMemo(() => nativeChatSubagentLabels(messages), [messages])
   const {
     listRef,
     showJumpToTail,
@@ -265,6 +275,7 @@ export function MobileNativeChatView({
     isWorking: agentWorking === true,
     workingStartedAt,
     settledTurns,
+    turnJournal,
     thinking: turnIndicator?.thinking === true,
     activityText: turnIndicator?.activityText ?? null,
     scopeKey: sendSurfaceId
@@ -281,12 +292,21 @@ export function MobileNativeChatView({
         onOpenFile={onOpenFile}
         structuredActivityUi={structuredActivityUi}
         onToggleTurn={turns.onToggleTurn}
+        subagentLabel={nativeChatSubagentLabel(subagentLabels, item)}
         {...turns.resolveRow(index, item)}
       />
     ),
-    [toolsExpanded, fontScale, onOpenFile, structuredActivityUi, turns]
+    [toolsExpanded, fontScale, onOpenFile, structuredActivityUi, subagentLabels, turns]
   )
 
+  const liveStatus =
+    structuredActivityUi && agentWorking && !hasPendingStructuredInteraction && turns.active ? (
+      <MobileNativeChatTurnActivity
+        thinking={turns.active.thinking}
+        activityText={turns.activeActivityText}
+      />
+    ) : null
+
   const emptyState = mobileNativeChatEmptyState(status, agent ?? null, error)
   const showLoading = status === 'loading' && messages.length === 0
 
@@ -303,7 +323,7 @@ export function MobileNativeChatView({
           <GestureDetector gesture={pinchGesture}>
             <FlatList
               ref={listRef}
-              data={data}
+              data={turns.listMessages}
               keyExtractor={(item) => item.id}
               renderItem={renderItem}
               contentContainerStyle={styles.listContent}
@@ -333,19 +353,11 @@ export function MobileNativeChatView({
                   </Pressable>
                 ) : null
               }
-              ListFooterComponent={
-                structuredActivityUi &&
-                agentWorking &&
-                !hasPendingStructuredInteraction &&
-                turns.active ? (
-                  <MobileNativeChatTurnStatus
-                    startedAt={turns.active.startedAt}
-                    thinking={turns.active.thinking}
-                    workedSeconds={turns.active.workedSeconds}
-                    activityText={turns.activeActivityText}
-                  />
-                ) : null
-              }
+              ListFooterComponent={mobileNativeChatListFooter(
+                liveStatus,
+                turns.waitingRows,
+                renderItem
+              )}
               ListEmptyComponent={
                 emptyState ? (
                   <View style={styles.center}>
diff --git a/mobile/src/session/MobileNativeChatView.waiting-rows.test.ts b/mobile/src/session/MobileNativeChatView.waiting-rows.test.ts
new file mode 100644
index 00000000000..c0b7fbb5fa2
--- /dev/null
+++ b/mobile/src/session/MobileNativeChatView.waiting-rows.test.ts
@@ -0,0 +1,169 @@
+import { createElement } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, expect, it, vi } from 'vitest'
+import type { AgentJournalRenderItem } from '../../../src/shared/agent-session-journal-types'
+import type { NativeChatMessage } from '../../../src/shared/native-chat-types'
+import { MobileNativeChatView } from './MobileNativeChatView'
+
+vi.mock('react-native', async () => {
+  const React = await import('react')
+  return {
+    ActivityIndicator: 'ActivityIndicator',
+    FlatList: React.forwardRef((props, ref) => {
+      React.useImperativeHandle(ref, () => ({ scrollToEnd: vi.fn(), scrollToOffset: vi.fn() }), [])
+      return React.createElement('FlatList', props)
+    }),
+    Pressable: 'Pressable',
+    StyleSheet: { create: (styles: unknown) => styles, hairlineWidth: 1 },
+    Text: 'Text',
+    View: 'View'
+  }
+})
+vi.mock('react-native-safe-area-context', () => ({
+  useSafeAreaInsets: () => ({ top: 0, bottom: 0, left: 0, right: 0 })
+}))
+vi.mock('react-native-gesture-handler', () => {
+  const chain = { runOnJS: () => chain, onStart: () => chain, onUpdate: () => chain }
+  return {
+    Gesture: { Simultaneous: () => ({}), Native: () => ({}), Pinch: () => chain },
+    GestureDetector: 'GestureDetector',
+    GestureHandlerRootView: 'GestureHandlerRootView'
+  }
+})
+vi.mock('lucide-react-native', () => ({
+  ArrowDown: 'ArrowDown',
+  ChevronsDownUp: 'ChevronsDownUp',
+  ChevronsUpDown: 'ChevronsUpDown',
+  Square: 'Square'
+}))
+vi.mock('./MobileNativeChatMessage', () => ({ MobileNativeChatMessage: 'ChatMessage' }))
+vi.mock('./MobileNativeChatTurnStatus', () => ({ MobileNativeChatTurnActivity: 'LiveStatus' }))
+vi.mock('./MobileNativeChatComposer', () => ({ MobileNativeChatComposer: 'Composer' }))
+vi.mock('./MobileNativeChatAsk', () => ({ MobileNativeChatAsk: 'ChatAsk' }))
+vi.mock('./MobileNativeChatPermission', () => ({ MobileNativeChatPermission: 'ChatPermission' }))
+vi.mock('./MobileNativeChatQuestion', () => ({ MobileNativeChatQuestion: 'ChatQuestion' }))
+vi.mock('./MobileAgentWorkingIndicator', () => ({
+  MobileAgentWorkingIndicator: 'WorkingIndicator'
+}))
+
+let renderer: ReactTestRenderer | null = null
+afterEach(() => {
+  act(() => renderer?.unmount())
+  renderer = null
+})
+
+function user(id: string, text: string, queued = false): NativeChatMessage {
+  return {
+    id,
+    role: 'user',
+    blocks: [{ type: 'text', text }],
+    timestamp: 1,
+    source: 'hook',
+    ...(queued ? { queued: true as const } : {})
+  }
+}
+
+function row(itemId: string, sequence: number, body: AgentJournalRenderItem['body']) {
+  return {
+    itemId,
+    revision: 0,
+    sequence,
+    observedAt: sequence,
+    turnScope: { kind: 'thread' as const },
+    body
+  }
+}
+
+function renderView(
+  folded: NativeChatMessage[],
+  items: AgentJournalRenderItem[]
+): { listed: string[]; footer: string[] } {
+  act(() => {
+    renderer = create(
+      createElement(MobileNativeChatView, {
+        messages: [],
+        folded,
+        status: 'ready',
+        streaming: null,
+        onSend: vi.fn().mockResolvedValue(true),
+        sendSurfaceId: 'tab-a',
+        getSendCompletionGeneration: () => 0,
+        getComposerEditGeneration: () => 0,
+        pending: [],
+        composerText: '',
+        onComposerTextChange: vi.fn(),
+        structuredActivityUi: true,
+        agentWorking: true,
+        turnJournal: { items, submissions: [] }
+      })
+    )
+  })
+  const list = renderer!.root.find((node) => String(node.type) === 'FlatList')
+  let footer: ReactTestRenderer | null = null
+  act(() => {
+    footer = create(list.props.ListFooterComponent)
+  })
+  const drawn = footer!.root
+    .findAll((node) => String(node.type) === 'LiveStatus' || String(node.type) === 'ChatMessage')
+    .map((node) => (String(node.type) === 'LiveStatus' ? 'status' : node.props.message.id))
+  act(() => footer!.unmount())
+  return {
+    listed: list.props.data.map((message: NativeChatMessage) => message.id),
+    footer: drawn
+  }
+}
+
+it('draws a message waiting behind a running /compact after the live status, not in the list', () => {
+  const drawn = renderView(
+    [user('compact', '/compact'), user('held', 'Say DONE', true)],
+    [
+      row('compact', 1, {
+        kind: 'message',
+        role: 'user',
+        blocks: [{ type: 'text', text: '/compact' }],
+        command: { name: 'compact' }
+      }),
+      row('command-turn', 2, {
+        kind: 'turn',
+        turnId: 'compact:1',
+        state: 'running',
+        userItemId: 'compact',
+        startedAt: 1
+      }),
+      row('held', 3, {
+        kind: 'message',
+        role: 'user',
+        blocks: [{ type: 'text', text: 'Say DONE' }]
+      })
+    ]
+  )
+
+  expect(drawn).toEqual({ listed: ['compact'], footer: ['status', 'held'] })
+})
+
+it('keeps a steer on its way into an ordinary running turn in the list, above the live status', () => {
+  const drawn = renderView(
+    [user('ask', 'List three fruits'), user('steer', 'Make it four', true)],
+    [
+      row('ask', 1, {
+        kind: 'message',
+        role: 'user',
+        blocks: [{ type: 'text', text: 'List three fruits' }]
+      }),
+      row('turn', 2, {
+        kind: 'turn',
+        turnId: 'turn-1',
+        state: 'running',
+        userItemId: 'ask',
+        startedAt: 1
+      }),
+      row('steer', 3, {
+        kind: 'message',
+        role: 'user',
+        blocks: [{ type: 'text', text: 'Make it four' }]
+      })
+    ]
+  )
+
+  expect(drawn).toEqual({ listed: ['ask', 'steer'], footer: ['status'] })
+})
diff --git a/mobile/src/session/MobileSessionActiveContent.tsx b/mobile/src/session/MobileSessionActiveContent.tsx
index 83cabe1c372..9c4f0eb313f 100644
--- a/mobile/src/session/MobileSessionActiveContent.tsx
+++ b/mobile/src/session/MobileSessionActiveContent.tsx
@@ -32,8 +32,6 @@ export function MobileSessionActiveContent({
     setShowCreateTabDrawer,
     dictationMode,
     toastMessage,
-    terminalFrameHeightRef,
-    setTerminalFrameWidth,
     handleTerminalTap,
     browserScreencastSupported,
     showToast,
@@ -53,9 +51,10 @@ export function MobileSessionActiveContent({
     copyMarkdownLocalContent,
     discardMarkdownLocalContent,
     saveMarkdownTab,
-    notifyTerminalFrameHeight,
     setTerminalWebViewRef,
     handleTerminalWebReady,
+    notifyTerminalFrame,
+    notifyTerminalCellBoxChange,
     handleFileTap,
     handleNativeChatFileTap,
     handleTerminalOpenUrl,
@@ -81,7 +80,7 @@ export function MobileSessionActiveContent({
     toastAnimatedStyle,
     createTabBusy
   } = controller
-  return showLoadingState ? (
+  const content = showLoadingState ? (
     <View style={styles.emptyState}>
       <ActivityIndicator size="small" color={colors.textSecondary} />
     </View>
@@ -192,19 +191,7 @@ export function MobileSessionActiveContent({
       )}
     </View>
   ) : (
-    <View
-      // Why: react-native-web observes onLayout only on a View that mounts with it; unkeyed, this reuses the loading View and never reports.
-      key="terminal-frame"
-      style={styles.terminalFrame}
-      onLayout={(e) => {
-        terminalFrameHeightRef.current = e.nativeEvent.layout.height
-        // Why: notify height imperatively so dock settling re-fits the PTY without rerendering SessionScreen.
-        const nextWidth = Math.round(e.nativeEvent.layout.width)
-        const nextHeight = Math.round(e.nativeEvent.layout.height)
-        setTerminalFrameWidth((prev) => (prev === nextWidth ? prev : nextWidth))
-        notifyTerminalFrameHeight(nextHeight)
-      }}
-    >
+    <View style={styles.terminalFrame}>
       {terminals.map((terminal) => (
         <TerminalPaneView
           key={terminal.handle}
@@ -220,6 +207,7 @@ export function MobileSessionActiveContent({
           }}
           onRef={setTerminalWebViewRef}
           onWebReady={handleTerminalWebReady}
+          onCellBoxChange={notifyTerminalCellBoxChange}
           onSelectionMode={handleSelectionMode}
           onSelectionCopy={handleSelectionCopy}
           onSelectionEvicted={handleSelectionEvicted}
@@ -256,4 +244,16 @@ export function MobileSessionActiveContent({
       )}
     </View>
   )
+  return (
+    <View
+      // Why: one frame under every branch; react-native-web observes onLayout only on a View that mounts with it.
+      style={styles.contentFrame}
+      onLayout={(e) => {
+        const { width, height } = e.nativeEvent.layout
+        notifyTerminalFrame({ width, height })
+      }}
+    >
+      {content}
+    </View>
+  )
 }
diff --git a/mobile/src/session/MobileSessionCommandDock.tsx b/mobile/src/session/MobileSessionCommandDock.tsx
index ed12bb6e51a..87b46246572 100644
--- a/mobile/src/session/MobileSessionCommandDock.tsx
+++ b/mobile/src/session/MobileSessionCommandDock.tsx
@@ -1,4 +1,5 @@
-import { View, Text, ScrollView, TextInput, Pressable, Platform } from 'react-native'
+import { View, Text, ScrollView, TextInput, Pressable } from 'react-native'
+import { hostOs } from '../platform/host-os'
 import {
   ArrowUp,
   ChevronDown,
@@ -19,6 +20,7 @@ import { MobileTerminalInputActions } from './MobileTerminalInputActions'
 import { isTerminalPhoneDisplayMode } from './mobile-session-route-helpers'
 import { colors } from '../theme/mobile-theme'
 import { styles } from './mobile-session-styles'
+import { useKeyboardPersistingTaps } from '../platform/keyboard-persisting-taps'
 import type { MobileSessionController } from './use-mobile-session-controller'
 
 export function MobileSessionCommandDock({ controller }: { controller: MobileSessionController }) {
@@ -65,6 +67,7 @@ export function MobileSessionCommandDock({ controller }: { controller: MobileSes
     activeBrowserTab,
     keyboardLift
   } = controller
+  const accessoryBarKeepsKeyboard = useKeyboardPersistingTaps('always')
   return (
     !activeMarkdownTab &&
     !activeFileTab &&
@@ -77,7 +80,7 @@ export function MobileSessionCommandDock({ controller }: { controller: MobileSes
         ]}
       >
         {/* Accessory keys */}
-        <View style={styles.accessoryBar}>
+        <View ref={accessoryBarKeepsKeyboard} style={styles.accessoryBar}>
           {/* Why: fixed keyboard escape hatch; outside ScrollView + shortcut path so it can't scroll away or be hidden (#5106). */}
           {keyboardLift > 0 && (
             <Pressable
@@ -303,7 +306,7 @@ export function MobileSessionCommandDock({ controller }: { controller: MobileSes
               smartInsertDelete={false}
               // Why: iOS textContentType overrides autoComplete and can narrow the keyboard; keep IME switching available.
               autoComplete="off"
-              keyboardType={getTerminalLiveInputKeyboardType(Platform.OS)}
+              keyboardType={getTerminalLiveInputKeyboardType(hostOs())}
               returnKeyType="default"
               blurOnSubmit={false}
               editable={canSend}
@@ -316,7 +319,7 @@ export function MobileSessionCommandDock({ controller }: { controller: MobileSes
               ref={bindCommandField}
               // Why: Android caches IME inputType at mount, so toggling autocomplete must remount there; iOS updates in place.
               key={
-                Platform.OS === 'android'
+                hostOs() === 'android'
                   ? autocompleteEnabled
                     ? 'cmd-input-ac-on'
                     : 'cmd-input-ac-off'
@@ -334,7 +337,7 @@ export function MobileSessionCommandDock({ controller }: { controller: MobileSes
               smartInsertDelete={false}
               // Why: not autofill content, but keyboard must stay default so non-Latin IMEs remain selectable.
               autoComplete="off"
-              keyboardType={getTerminalCommandKeyboardType(Platform.OS, autocompleteEnabled)}
+              keyboardType={getTerminalCommandKeyboardType(hostOs(), autocompleteEnabled)}
               returnKeyType="send"
               blurOnSubmit={false}
               // Why: composing is local — an outage must not lock the field or discard typed text (#6713).
diff --git a/mobile/src/session/MobileSessionHeader.tsx b/mobile/src/session/MobileSessionHeader.tsx
index d8cd0644b3a..b0d59a78158 100644
--- a/mobile/src/session/MobileSessionHeader.tsx
+++ b/mobile/src/session/MobileSessionHeader.tsx
@@ -21,6 +21,7 @@ import {
 import { colors } from '../theme/mobile-theme'
 import { QuickCommandsTabButton } from './QuickCommandsTabButton'
 import { styles } from './mobile-session-styles'
+import { useKeyboardPersistingTaps } from '../platform/keyboard-persisting-taps'
 import type { MobileSessionController } from './use-mobile-session-controller'
 
 export function MobileSessionHeader({ controller }: { controller: MobileSessionController }) {
@@ -58,6 +59,7 @@ export function MobileSessionHeader({ controller }: { controller: MobileSessionC
     handlePanelTap,
     showHeaderMoreButton
   } = controller
+  const tabBarKeepsKeyboard = useKeyboardPersistingTaps('handled')
   return (
     <SafeAreaView style={styles.sessionChrome} edges={['top']}>
       <View style={styles.sessionTopBar}>
@@ -119,7 +121,7 @@ export function MobileSessionHeader({ controller }: { controller: MobileSessionC
       </View>
 
       {visibleTabs.length > 0 && (
-        <View style={styles.tabBar}>
+        <View ref={tabBarKeepsKeyboard} style={styles.tabBar}>
           {/* Why: tab taps must register on first press with the keyboard open instead of being eaten by dismissal (#5106). */}
           <ScrollView
             ref={tabStripRef}
diff --git a/mobile/src/session/MobileSessionMarkdownReader.tsx b/mobile/src/session/MobileSessionMarkdownReader.tsx
index 4e1d380c9a3..134dc34b87a 100644
--- a/mobile/src/session/MobileSessionMarkdownReader.tsx
+++ b/mobile/src/session/MobileSessionMarkdownReader.tsx
@@ -3,6 +3,7 @@ import { View, Text, Pressable, ActivityIndicator } from 'react-native'
 import { RefreshCw } from 'lucide-react-native'
 import { MobileRichMarkdownEditor } from '../components/MobileRichMarkdownEditor'
 import { resolveMarkdownFloatingActionsBottom } from './markdown-floating-actions-layout'
+import { markdownReaderStatusText } from './mobile-markdown-reader-status'
 import { colors, spacing } from '../theme/mobile-theme'
 import { styles } from './mobile-session-styles'
 import type { MarkdownDocState } from './mobile-session-route-types'
@@ -48,13 +49,7 @@ export function MarkdownReader({
     )
   }
 
-  const statusText = doc.saveError
-    ? doc.saveError
-    : doc.readOnlyReason
-      ? 'Read only'
-      : doc.stale
-        ? 'Changed on desktop'
-        : null
+  const statusText = markdownReaderStatusText(doc)
   const showRefresh = (doc.stale && !doc.isDirty) || !doc.editable
   const showCopy = doc.saveError || !doc.editable
   const showSave = doc.isDirty || doc.saving
diff --git a/mobile/src/session/TerminalPaneView.tsx b/mobile/src/session/TerminalPaneView.tsx
index 06174cd0378..03631d11467 100644
--- a/mobile/src/session/TerminalPaneView.tsx
+++ b/mobile/src/session/TerminalPaneView.tsx
@@ -28,6 +28,7 @@ type TerminalPaneViewProps = {
   onFileTap: (handle: string, pathText: string, line: number | null, column: number | null) => void
   onOpenUrl: (handle: string, url: string) => void
   onTextScaleChange: (scale: number) => void
+  onCellBoxChange: (handle: string) => void
 }
 
 export function TerminalPaneView({
@@ -49,7 +50,8 @@ export function TerminalPaneView({
   onTerminalTap,
   onFileTap,
   onOpenUrl,
-  onTextScaleChange
+  onTextScaleChange,
+  onCellBoxChange
 }: TerminalPaneViewProps) {
   const setRef = useCallback(
     (ref: TerminalWebViewHandle | null) => {
@@ -74,6 +76,7 @@ export function TerminalPaneView({
         style={styles.terminalWebView}
         terminalTheme={terminalTheme}
         textScale={textScale}
+        shownAtMount={active}
         onWebReady={() => onWebReady(handle)}
         onSelectionMode={(a) => onSelectionMode(handle, a)}
         onSelectionCopy={(t) => onSelectionCopy(handle, t)}
@@ -87,6 +90,7 @@ export function TerminalPaneView({
         onFileTap={(pathText, line, column) => onFileTap(handle, pathText, line, column)}
         onOpenUrl={(url) => onOpenUrl(handle, url)}
         onTextScaleChange={onTextScaleChange}
+        onCellBoxChange={() => onCellBoxChange(handle)}
       />
     </View>
   )
diff --git a/mobile/src/session/agent-send-keyboard-dismissal-wiring.test.ts b/mobile/src/session/agent-send-keyboard-dismissal-wiring.test.ts
deleted file mode 100644
index 03b5398939d..00000000000
--- a/mobile/src/session/agent-send-keyboard-dismissal-wiring.test.ts
+++ /dev/null
@@ -1,212 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { readMobileSessionRouteSource } from './mobile-session-route-source-family.test-support'
-
-const runtimeSource = readMobileSessionRouteSource('./use-mobile-session-terminal-runtime.ts')
-const nativeChatSource = readMobileSessionRouteSource(
-  './use-mobile-session-native-chat-dictation.ts'
-)
-const sendActionsSource = readMobileSessionRouteSource(
-  './use-mobile-session-terminal-send-actions.ts'
-)
-const commandDockSource = readMobileSessionRouteSource('./MobileSessionCommandDock.tsx')
-const tabApplicationSource = readMobileSessionRouteSource('./use-mobile-session-tab-application.ts')
-const terminalListSource = readMobileSessionRouteSource('./use-mobile-session-terminal-list.ts')
-const startupSource = readMobileSessionRouteSource('./use-mobile-session-startup.ts')
-const bufferedDraftHookSource = readMobileSessionRouteSource(
-  '../terminal/use-buffered-terminal-drafts.ts'
-)
-const keyboardDismissalHookSource = readMobileSessionRouteSource(
-  './use-agent-send-keyboard-dismissal.ts'
-)
-
-function sourceSlice(source: string, anchorStart: string, anchorEnd: string): string {
-  const start = source.indexOf(anchorStart)
-  expect(start).toBeGreaterThanOrEqual(0)
-  // Why: a duplicated start anchor would silently slice the wrong region.
-  expect(source.indexOf(anchorStart, start + 1)).toBe(-1)
-  const end = source.indexOf(anchorEnd, start)
-  expect(end).toBeGreaterThan(start)
-  return source.slice(start, end + anchorEnd.length)
-}
-
-describe('terminal send keyboard dismissal wiring', () => {
-  it('gates the dismissal on the agent-session predicate', () => {
-    const slice = sourceSlice(
-      sendActionsSource,
-      'const dismissKeyboardAfterAgentSend = useAgentSendKeyboardDismissal(',
-      'getSendCompletionGeneration\n  )'
-    )
-    expect(slice).toContain('dismissSoftwareKeyboard')
-    expect(keyboardDismissalHookSource).toContain(
-      'shouldDismissKeyboardAfterTerminalSend(origin.tab, accepted)'
-    )
-    expect(keyboardDismissalHookSource).toContain(
-      'origin.generation === getSendCompletionGeneration()'
-    )
-    expect(keyboardDismissalHookSource).toContain('dismissSoftwareKeyboard()')
-    expect(keyboardDismissalHookSource).toContain('return useCallback(')
-    expect(sendActionsSource).toContain(
-      "import { useAgentSendKeyboardDismissal } from './use-agent-send-keyboard-dismissal'"
-    )
-  })
-
-  it('invalidates pending terminal sends when the focused input surface changes', () => {
-    const slice = sourceSlice(
-      nativeChatSource,
-      'const getSendCompletionGeneration = useMobileSendCompletionGeneration({',
-      '})'
-    )
-    expect(nativeChatSource).toContain(
-      'const routeKey = nativeChatScopeKey ?? `${hostId}\\0${worktreeId}`'
-    )
-    expect(slice).toContain(
-      'surfaceKey: JSON.stringify([routeKey, activeHandle, showNativeChat, liveInputEnabled])'
-    )
-  })
-
-  it('dismisses after the live input submits, which is the only Enter path', () => {
-    // terminal-live-input.ts deliberately keeps Enter off the key map, so
-    // submitLiveInput is the single send seam for the live field.
-    const slice = sourceSlice(
-      sendActionsSource,
-      'const submitLiveInput = useCallback(() => {',
-      'useTerminalTextFieldSubmitBinding(liveInputRef, submitLiveInput)'
-    )
-    expect(slice).toContain('const submit = handleLiveInputSubmit()')
-    expect(slice).toContain('generation: getSendCompletionGeneration()')
-    expect(slice).toContain('interaction: getLiveInteractionGeneration()')
-    expect(slice).toContain('sendOrigin.interaction === getLiveInteractionGeneration()')
-    expect(slice).toContain('dismissKeyboardAfterAgentSend(')
-  })
-
-  it('gives the live field both Enter paths and neither blur', () => {
-    // The page reaches submitLiveInput through the ref binding, because react-native-web withholds
-    // onSubmitEditing under an open composition; native reaches it through the editor action.
-    const slice = sourceSlice(
-      commandDockSource,
-      'ref={bindLiveInputField}',
-      'importantForAutofill="no"'
-    )
-    expect(slice).toContain('onSubmitEditing={submitLiveInput}')
-    // Explicit dismissal replaces RN's blur, which stays off so a shell send
-    // does not drop focus.
-    expect(slice).toContain('blurOnSubmit={false}')
-  })
-
-  it('dismisses the buffered command send only once the write is accepted', () => {
-    const slice = sourceSlice(
-      sendActionsSource,
-      'async function handleSend() {',
-      'async function handleAccessoryKey('
-    )
-    const acceptedAt = slice.indexOf(
-      'const accepted = terminalInputSend.interpret(response) === true'
-    )
-    const restoreAt = slice.indexOf('restoreRejectedDraft()', acceptedAt)
-    const dismissAt = slice.indexOf('dismissKeyboardAfterAgentSend(')
-    const responseAt = slice.indexOf('const response = await terminalInputSend.request(')
-    const catchAt = slice.indexOf('} catch {')
-    expect(dismissAt).toBeGreaterThan(0)
-    expect(responseAt).toBeGreaterThan(0)
-    expect(acceptedAt).toBeGreaterThan(responseAt)
-    expect(restoreAt).toBeGreaterThan(acceptedAt)
-    expect(dismissAt).toBeGreaterThan(responseAt)
-    expect(slice).toContain(
-      'const draftUnchanged =\n        accepted && bufferedTerminalDraftState.settleBufferedTerminalDraftSend(bufferedDraftSend)'
-    )
-    expect(slice).toContain('dismissKeyboardAfterAgentSend(sendOrigin, accepted && draftUnchanged)')
-    expect(catchAt).toBeGreaterThan(0)
-    // Both resolved rejections and transport failures restore the raw draft.
-    expect(dismissAt).toBeLessThan(catchAt)
-    expect(slice.slice(catchAt)).not.toContain('dismissKeyboardAfterAgentSend(')
-    expect(slice.slice(catchAt)).toContain('restoreRejectedDraft()')
-  })
-
-  it('keeps buffered Return focused until accepted-agent dismissal runs', () => {
-    const slice = sourceSlice(
-      commandDockSource,
-      'ref={bindCommandField}',
-      'onSubmitEditing={() => void handleSend()}'
-    )
-    expect(slice).toContain('blurOnSubmit={false}')
-  })
-
-  it('restores a rejected buffered draft by origin without generation fencing', () => {
-    const sendSlice = sourceSlice(
-      sendActionsSource,
-      'async function handleSend() {',
-      'async function handleAccessoryKey('
-    )
-    const originAt = sendSlice.indexOf('handle: activeHandle')
-    const requestAt = sendSlice.indexOf('await terminalInputSend.request(')
-    const restoreSlice = sourceSlice(
-      sendActionsSource,
-      'const bufferedDraftSend = bufferedTerminalDraftState.beginBufferedTerminalDraftSend(',
-      'bufferedTerminalDraftState.restoreRejectedDraft(bufferedDraftSend)'
-    )
-    expect(originAt).toBeGreaterThan(0)
-    expect(originAt).toBeLessThan(requestAt)
-    expect(restoreSlice).toContain('activeHandle,\n      draft')
-    expect(bufferedDraftHookSource).not.toContain('getSendCompletionGeneration()')
-    expect(bufferedDraftHookSource).toContain(
-      'restoreRejectedBufferedTerminalDraft(current, send.token.handle, send.draft)'
-    )
-    expect(sendSlice.match(/restoreRejectedDraft\(\)/g)).toHaveLength(2)
-    expect(keyboardDismissalHookSource).toContain(
-      'origin.generation === getSendCompletionGeneration()'
-    )
-  })
-
-  it('keeps buffered draft callbacks scoped to terminal surfaces and prunes ended tabs', () => {
-    expect(bufferedDraftHookSource).toContain('const handle = activeHandleRef.current')
-    expect(bufferedDraftHookSource).toContain('invalidateBufferedTerminalDraftRestoration(')
-    expect(bufferedDraftHookSource).toContain(
-      'setDrafts((current) => updateBufferedTerminalDraft(current, handle, value))'
-    )
-    expect(bufferedDraftHookSource).toContain('pruneBufferedTerminalDraftRestorations(')
-    expect(runtimeSource).toContain('useRef(bufferedTerminalDraftState.reconcileTerminalTabs)')
-    expect(tabApplicationSource).toContain(
-      'reconcileBufferedDraftsRef.current(currentSessionTabs, nextTabs, {'
-    )
-    const routeResetSlice = sourceSlice(
-      startupSource,
-      '// Why: Expo reuses this screen across worktrees;',
-      'clearDelayedActionTimers()\n    }'
-    )
-    expect(routeResetSlice).toContain('bufferedTerminalDraftState.resetDrafts()')
-    expect(routeResetSlice).toContain('bufferedTerminalDraftState.clearPendingRestorations()')
-  })
-
-  it('bounds buffered drafts on the terminal.list sweep, against the retained set', () => {
-    // The drafts record and the pending-restoration map both live as long as the
-    // session screen does; this one call is the only thing that bounds either.
-    const slice = sourceSlice(
-      terminalListSource,
-      'const liveHandles = new Set(result.terminals.map((terminal) => terminal.handle))',
-      'setTerminalKeyboardMetrics((prev) => pruneTerminalKeyboardMetrics(prev, shouldPrune))'
-    )
-    expect(slice).toContain('const retainedHandles = resolveRetainedTerminalHandles(pruneContext)')
-    expect(slice).toContain('bufferedTerminalDraftState.pruneDrafts(retainedHandles)')
-    // Not the raw list: terminal.list omits a chat-covered handle while the desktop
-    // graph reloads, so sweeping drafts against it erases text the user still holds.
-    expect(slice).not.toContain('pruneDrafts(liveHandles)')
-    expect(slice.match(/pruneDrafts\(/g)).toHaveLength(1)
-    expect(bufferedDraftHookSource).toContain(
-      'setDrafts((current) => pruneBufferedTerminalDrafts(current, retainedMappedHandles))'
-    )
-    expect(bufferedDraftHookSource).toContain(
-      'pruneBufferedTerminalDraftRestorations(pendingRestorationsRef.current, retainedMappedHandles)'
-    )
-  })
-
-  it('leaves the accessory shortcut keys alone, Enter included', () => {
-    // Why: the accessory bar sits on top of the keyboard — dismissing would
-    // pull away the very row the user is tapping.
-    const slice = sourceSlice(
-      sendActionsSource,
-      'async function handleAccessoryKey(',
-      'const sendLiveTerminalInput = useCallback('
-    )
-    expect(slice).not.toContain('dismissKeyboardAfterAgentSend')
-  })
-})
diff --git a/mobile/src/session/mobile-agent-launch-availability.test.ts b/mobile/src/session/mobile-agent-launch-availability.test.ts
new file mode 100644
index 00000000000..b1775f13311
--- /dev/null
+++ b/mobile/src/session/mobile-agent-launch-availability.test.ts
@@ -0,0 +1,46 @@
+import { describe, expect, it } from 'vitest'
+import { resolveMobileAgentLaunchAvailability } from './mobile-agent-launch-availability'
+
+const LAUNCH = ['agent.launch.v2', 'agent.launch.replay.v1', 'agent.launch.replay-required.v1']
+
+describe('resolveMobileAgentLaunchAvailability', () => {
+  it('is available when the host advertises the replay-required launch', () => {
+    expect(
+      resolveMobileAgentLaunchAvailability({
+        hostCapabilities: LAUNCH,
+        statusPending: false,
+        statusReadable: true
+      })
+    ).toBe('available')
+  })
+
+  it('asks for an update only when the host answered without the capability', () => {
+    expect(
+      resolveMobileAgentLaunchAvailability({
+        hostCapabilities: ['agent.launch.v2'],
+        statusPending: false,
+        statusReadable: true
+      })
+    ).toBe('update-required')
+  })
+
+  it('does not blame the host version when its status could not be read', () => {
+    expect(
+      resolveMobileAgentLaunchAvailability({
+        hostCapabilities: [],
+        statusPending: false,
+        statusReadable: false
+      })
+    ).toBe('unverified')
+  })
+
+  it('waits while the status is being read', () => {
+    expect(
+      resolveMobileAgentLaunchAvailability({
+        hostCapabilities: [],
+        statusPending: true,
+        statusReadable: false
+      })
+    ).toBe('checking')
+  })
+})
diff --git a/mobile/src/session/mobile-agent-launch-availability.ts b/mobile/src/session/mobile-agent-launch-availability.ts
new file mode 100644
index 00000000000..81871fb7ab9
--- /dev/null
+++ b/mobile/src/session/mobile-agent-launch-availability.ts
@@ -0,0 +1,32 @@
+import { supportsMobileExistingAgentLaunch } from './mobile-existing-agent-launch'
+
+/**
+ * Whether an AI button that starts an agent with a prompt can be used on this host. There is no
+ * older-host fallback: the path before `agent.launch` typed the prompt into a bare shell.
+ * `unverified`: the host's status could not be read, so whether it is too old is unknown.
+ */
+export type MobileAgentLaunchAvailability =
+  | 'checking'
+  | 'available'
+  | 'update-required'
+  | 'unverified'
+
+/** The host status gates this reads (`useHostProtocolGates`). */
+export type MobileAgentLaunchHostStatus = {
+  hostCapabilities: readonly string[]
+  statusPending: boolean
+  statusReadable: boolean
+}
+
+export function resolveMobileAgentLaunchAvailability(
+  host: MobileAgentLaunchHostStatus
+): MobileAgentLaunchAvailability {
+  if (supportsMobileExistingAgentLaunch(host.hostCapabilities)) {
+    return 'available'
+  }
+  if (host.statusPending) {
+    return 'checking'
+  }
+  // Only a host that answered without the capability is too old to update.
+  return host.statusReadable ? 'update-required' : 'unverified'
+}
diff --git a/mobile/src/session/mobile-dictation-refused-start-routing.test.tsx b/mobile/src/session/mobile-dictation-refused-start-routing.test.tsx
index b073eda047d..41dc8b5d11f 100644
--- a/mobile/src/session/mobile-dictation-refused-start-routing.test.tsx
+++ b/mobile/src/session/mobile-dictation-refused-start-routing.test.tsx
@@ -92,7 +92,7 @@ function mount(client: FakeRpcClient): Mounted {
       worktreeId: 'w1',
       client,
       connState: 'connected',
-      agentSessionPromptCancelSupported: true,
+      agentSessionHostSupport: { promptCancel: true, questionAnswers: false },
       setInput: () => {},
       liveInputTerminalHandles: new Set<string>(),
       activeHandle: 't1',
diff --git a/mobile/src/session/mobile-diff-review-retry.test.tsx b/mobile/src/session/mobile-diff-review-retry.test.tsx
index 093a66b29a4..c7d8f3fb868 100644
--- a/mobile/src/session/mobile-diff-review-retry.test.tsx
+++ b/mobile/src/session/mobile-diff-review-retry.test.tsx
@@ -55,6 +55,9 @@ function ReviewWhileUnreachable({
   const controller = useMobileDiffReviewController({
     client,
     connState,
+    hostCapabilities: [],
+    hostStatusPending: false,
+    hostStatusReadable: true,
     hostId: 'host-1',
     worktreeId: 'wt-1',
     name: 'review',
diff --git a/mobile/src/session/mobile-diff-review-sheets.test.ts b/mobile/src/session/mobile-diff-review-sheets.test.ts
new file mode 100644
index 00000000000..2a0f70c28df
--- /dev/null
+++ b/mobile/src/session/mobile-diff-review-sheets.test.ts
@@ -0,0 +1,151 @@
+import { describe, expect, it } from 'vitest'
+import type { MobileDiffReviewQueueItem } from './mobile-diff-review-queue'
+import type { SendSheetState } from './mobile-diff-review-screen-model'
+import {
+  NO_REVIEW_SHEETS,
+  reduceReviewSheets,
+  reviewComposer,
+  type ReviewSheet,
+  type ReviewSheetsAction,
+  type ReviewSheetsState
+} from './mobile-diff-review-sheets'
+
+const ACTIONS: ReviewSheet = { kind: 'actions' }
+const COMPLETION: ReviewSheet = { kind: 'completion' }
+const SEND_LOADING: ReviewSheet = { kind: 'send', load: { kind: 'loading' } }
+const COMPOSER: ReviewSheet = { kind: 'composer', composer: { mode: 'create', lineNumber: 4 } }
+const READY: SendSheetState = { kind: 'ready', terminals: [] }
+const DISCARD_TARGET: MobileDiffReviewQueueItem = {
+  key: 'unstaged:src/a.ts',
+  scope: 'unstaged',
+  area: 'unstaged',
+  filePath: 'src/a.ts',
+  status: 'modified',
+  title: 'a.ts',
+  subtitle: 'src',
+  canStage: true,
+  canUnstage: false,
+  canDiscard: true,
+  isGeneratedOrLockFile: false,
+  diffIdentity: 'identity-1',
+  noteCount: 0,
+  unsentNoteCount: 0,
+  staleNoteCount: 0,
+  isReviewed: false,
+  changedSinceReview: false
+}
+
+function run(...actions: ReviewSheetsAction[]): ReviewSheetsState {
+  return actions.reduce(reduceReviewSheets, NO_REVIEW_SHEETS)
+}
+
+const open = (sheet: ReviewSheet): ReviewSheetsAction => ({ type: 'open', sheet })
+const openWhenIdle = (sheet: ReviewSheet): ReviewSheetsAction => ({ type: 'openWhenIdle', sheet })
+const close = (kind: ReviewSheet['kind']): ReviewSheetsAction => ({ type: 'close', kind })
+const updateSend = (load: SendSheetState): ReviewSheetsAction => ({ type: 'updateSend', load })
+const DISCARD: ReviewSheet = { kind: 'discard', target: DISCARD_TARGET }
+
+describe('review screen sheet requests', () => {
+  it('the newest request wins', () => {
+    expect(run(open(ACTIONS))).toEqual({ requested: ACTIONS, deferred: null })
+    expect(run(open(ACTIONS), open(SEND_LOADING), open(COMPOSER))).toEqual({
+      requested: COMPOSER,
+      deferred: null
+    })
+  })
+
+  it('closing a sheet clears the request only for that sheet', () => {
+    expect(run(open(DISCARD), close('discard'))).toEqual(NO_REVIEW_SHEETS)
+    const state = run(open(ACTIONS))
+    expect(reduceReviewSheets(state, close('send'))).toBe(state)
+  })
+
+  it('exposes the requested composer only', () => {
+    expect(reviewComposer(run(open(COMPOSER)))).toEqual({ mode: 'create', lineNumber: 4 })
+    expect(reviewComposer(run(open(COMPOSER), close('composer')))).toBeNull()
+  })
+
+  it('openWhenIdle opens at once when nothing is requested', () => {
+    expect(run(openWhenIdle(COMPLETION))).toEqual({ requested: COMPLETION, deferred: null })
+  })
+
+  it('openWhenIdle waits behind the user sheet and opens when it closes', () => {
+    const waiting = run(open(ACTIONS), openWhenIdle(COMPLETION))
+    expect(waiting).toEqual({ requested: ACTIONS, deferred: COMPLETION })
+    expect(reduceReviewSheets(waiting, close('actions'))).toEqual({
+      requested: COMPLETION,
+      deferred: null
+    })
+  })
+
+  // Review Complete → Send Notes, then a second Mark Reviewed save lands while Review Complete is
+  // still closing: Send Notes must stay the request.
+  it('a late Review Complete never displaces a sheet the user asked for', () => {
+    const state = run(open(COMPLETION), open(SEND_LOADING), openWhenIdle(COMPLETION))
+    expect(state.requested).toEqual(SEND_LOADING)
+    expect(run(open(ACTIONS), open(SEND_LOADING), openWhenIdle(COMPLETION)).requested).toEqual(
+      SEND_LOADING
+    )
+  })
+
+  it('openWhenIdle does not repeat a sheet that is already requested or waiting', () => {
+    const shown = run(openWhenIdle(COMPLETION))
+    expect(reduceReviewSheets(shown, openWhenIdle(COMPLETION))).toBe(shown)
+    const waiting = run(open(ACTIONS), openWhenIdle(COMPLETION))
+    expect(reduceReviewSheets(waiting, openWhenIdle(COMPLETION))).toBe(waiting)
+  })
+
+  it('moving to another sheet drops a waiting background sheet', () => {
+    expect(run(open(ACTIONS), openWhenIdle(COMPLETION), open(SEND_LOADING))).toEqual({
+      requested: SEND_LOADING,
+      deferred: null
+    })
+  })
+
+  it('refreshing the requested sheet keeps a waiting background sheet', () => {
+    const edit: ReviewSheet = { kind: 'composer', composer: { mode: 'create', lineNumber: 9 } }
+    expect(run(open(COMPOSER), openWhenIdle(COMPLETION), open(edit))).toEqual({
+      requested: edit,
+      deferred: COMPLETION
+    })
+  })
+
+  it('closing a waiting background sheet leaves the user sheet alone', () => {
+    expect(run(open(ACTIONS), openWhenIdle(COMPLETION), close('completion'))).toEqual({
+      requested: ACTIONS,
+      deferred: null
+    })
+  })
+
+  it('updateSend fills a requested Send Notes', () => {
+    expect(run(open(SEND_LOADING), updateSend(READY)).requested).toEqual({
+      kind: 'send',
+      load: READY
+    })
+  })
+
+  it('a send list that lands after Send Notes was dismissed does not bring it back', () => {
+    const dismissed = run(open(SEND_LOADING), close('send'))
+    expect(reduceReviewSheets(dismissed, updateSend(READY))).toBe(dismissed)
+    const moved = run(open(SEND_LOADING), open(ACTIONS))
+    expect(reduceReviewSheets(moved, updateSend(READY))).toBe(moved)
+  })
+
+  it('never waits a sheet behind nothing or behind its own kind', () => {
+    const sheets = [ACTIONS, COMPLETION, SEND_LOADING, COMPOSER, DISCARD]
+    const actions: ReviewSheetsAction[] = [updateSend(READY)]
+    for (const sheet of sheets) {
+      actions.push(open(sheet), openWhenIdle(sheet), close(sheet.kind))
+    }
+    let seed = 7
+    let state = NO_REVIEW_SHEETS
+    for (let step = 0; step < 2000; step++) {
+      seed = (seed * 48271) % 2147483647
+      state = reduceReviewSheets(state, actions[seed % actions.length]!)
+      if (state.deferred !== null) {
+        expect(state.requested).not.toBeNull()
+        expect(state.deferred.kind).not.toBe(state.requested?.kind)
+      }
+    }
+  })
+})
diff --git a/mobile/src/session/mobile-diff-review-sheets.ts b/mobile/src/session/mobile-diff-review-sheets.ts
new file mode 100644
index 00000000000..29a87f478c7
--- /dev/null
+++ b/mobile/src/session/mobile-diff-review-sheets.ts
@@ -0,0 +1,86 @@
+import type { MobileDiffReviewQueueItem } from './mobile-diff-review-queue'
+import type { ComposerState, SendSheetState } from './mobile-diff-review-screen-model'
+
+// Which review sheet the user wants; the screen's one keyed drawer decides when it can be shown.
+
+export type ReviewSheet =
+  | { kind: 'actions' }
+  | { kind: 'send'; load: SendSheetState }
+  | { kind: 'discard'; target: MobileDiffReviewQueueItem }
+  | { kind: 'composer'; composer: ComposerState }
+  | { kind: 'completion' }
+
+export type ReviewSheetKind = ReviewSheet['kind']
+
+export type ReviewSheetsState = {
+  requested: ReviewSheet | null
+  /** A background sheet waiting for `requested` to close; never of the same kind. */
+  deferred: ReviewSheet | null
+}
+
+export type ReviewSheetsAction =
+  | { type: 'open'; sheet: ReviewSheet }
+  | { type: 'openWhenIdle'; sheet: ReviewSheet }
+  | { type: 'close'; kind: ReviewSheetKind }
+  | { type: 'updateSend'; load: SendSheetState }
+
+export const NO_REVIEW_SHEETS: ReviewSheetsState = { requested: null, deferred: null }
+
+export function reduceReviewSheets(
+  state: ReviewSheetsState,
+  action: ReviewSheetsAction
+): ReviewSheetsState {
+  const { requested, deferred } = state
+  switch (action.type) {
+    case 'open':
+      // Why: the newest request wins; a background sheet only survives a refresh of the same sheet.
+      return {
+        requested: action.sheet,
+        deferred: requested?.kind === action.sheet.kind ? deferred : null
+      }
+    case 'openWhenIdle':
+      if (!requested) {
+        return { requested: action.sheet, deferred: null }
+      }
+      // Why: a background opener waits behind the user's sheet and never displaces it.
+      if (deferred || requested.kind === action.sheet.kind) {
+        return state
+      }
+      return { requested, deferred: action.sheet }
+    case 'close':
+      if (requested?.kind === action.kind) {
+        return { requested: deferred, deferred: null }
+      }
+      if (deferred?.kind === action.kind) {
+        return { requested, deferred: null }
+      }
+      return state
+    case 'updateSend':
+      // Why: a list that resolves after Send Notes was dismissed must not bring it back.
+      if (requested?.kind !== 'send') {
+        return state
+      }
+      return { requested: { kind: 'send', load: action.load }, deferred }
+  }
+}
+
+export function reviewComposer(state: ReviewSheetsState): ComposerState | null {
+  return state.requested?.kind === 'composer' ? state.requested.composer : null
+}
+
+/** The only ways callers change the review screen's sheets. */
+export function reviewSheetIntents(dispatch: (action: ReviewSheetsAction) => void) {
+  return {
+    openSheet: (sheet: ReviewSheet) => dispatch({ type: 'open', sheet }),
+    /** For async openers: waits for the user's sheet to close instead of closing it. */
+    openSheetWhenIdle: (sheet: ReviewSheet) => dispatch({ type: 'openWhenIdle', sheet }),
+    closeSheet: (kind: ReviewSheetKind) => dispatch({ type: 'close', kind }),
+    updateSendSheet: (load: SendSheetState) => dispatch({ type: 'updateSend', load })
+  }
+}
+
+export type ReviewSheetIntents = ReturnType<typeof reviewSheetIntents>
+
+export function reviewSheetKey(sheet: ReviewSheet): ReviewSheetKind {
+  return sheet.kind
+}
diff --git a/mobile/src/session/mobile-existing-agent-launch.test.ts b/mobile/src/session/mobile-existing-agent-launch.test.ts
new file mode 100644
index 00000000000..ce54670151b
--- /dev/null
+++ b/mobile/src/session/mobile-existing-agent-launch.test.ts
@@ -0,0 +1,253 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { RpcClient } from '../transport/rpc-client'
+import { markRpcDeliveryUnknown } from '../transport/rpc-delivery-ambiguity'
+import type { RpcResponse } from '../transport/types'
+import {
+  AGENT_LAUNCH_UNCONFIRMED_MESSAGE,
+  PROMPTED_AGENT_LAUNCH_TIMEOUT_MS,
+  launchAgentInExistingWorkspace,
+  supportsMobileExistingAgentLaunch
+} from './mobile-existing-agent-launch'
+
+// A connected client whose only behaviour is the scripted `sendRequest`.
+function requestPortRpcClient(sendRequest: RpcClient['sendRequest']): RpcClient {
+  return {
+    sendRequest,
+    subscribe: () => () => {},
+    updateTerminalSubscriptionViewport: () => {},
+    getState: () => 'connected',
+    getReconnectAttempt: () => 0,
+    getLastConnectedAt: () => null,
+    onStateChange: () => () => {},
+    notifyForeground: () => {},
+    close: () => {}
+  }
+}
+
+function requestParam(params: unknown, key: string): unknown {
+  return params && typeof params === 'object' && key in params
+    ? Object.getOwnPropertyDescriptor(params, key)?.value
+    : undefined
+}
+
+const LAUNCH_CAPABILITIES = [
+  'agent.launch.v2',
+  'agent.launch.replay.v1',
+  'agent.launch.replay-required.v1'
+]
+const RECEIPT = {
+  mode: 'terminal',
+  preferred: 'terminal',
+  reason: 'user_default',
+  detail: 'Started a terminal agent.'
+}
+
+function launched(result: Record<string, unknown>): RpcResponse {
+  return {
+    id: '1',
+    ok: true,
+    result: {
+      outcome: { kind: 'terminal', handle: 'term-1' },
+      worktreeId: 'wt-1',
+      receipt: RECEIPT,
+      ...result
+    },
+    _meta: { runtimeId: 'r' }
+  }
+}
+
+function refused(code: string, message = code): RpcResponse {
+  return { id: '1', ok: false, error: { code, message }, _meta: { runtimeId: 'r' } }
+}
+
+function scriptedClient(...outcomes: Array<RpcResponse | { throws: unknown }>) {
+  let call = 0
+  const sendRequest = vi.fn(async (_method: string, _params?: unknown, _options?: unknown) => {
+    const outcome = outcomes[Math.min(call, outcomes.length - 1)]!
+    call += 1
+    if ('throws' in outcome) {
+      throw outcome.throws
+    }
+    return outcome
+  })
+  return { client: requestPortRpcClient(sendRequest), sendRequest }
+}
+
+function launch(
+  client: RpcClient,
+  extra: Partial<Parameters<typeof launchAgentInExistingWorkspace>[0]> = {}
+) {
+  return launchAgentInExistingWorkspace({
+    client,
+    hostCapabilities: LAUNCH_CAPABILITIES,
+    worktreeId: 'wt-1',
+    agent: 'claude',
+    mintOperationId: () => 'op-1',
+    ...extra
+  })
+}
+
+describe('supportsMobileExistingAgentLaunch', () => {
+  it('requires the replay ledger, not just agent.launch', () => {
+    expect(supportsMobileExistingAgentLaunch(LAUNCH_CAPABILITIES)).toBe(true)
+    expect(supportsMobileExistingAgentLaunch(['agent.launch.v2'])).toBe(false)
+    expect(supportsMobileExistingAgentLaunch([])).toBe(false)
+    expect(supportsMobileExistingAgentLaunch(undefined)).toBe(false)
+  })
+})
+
+describe('launchAgentInExistingWorkspace', () => {
+  it('sends nothing to a host without the launch capabilities', async () => {
+    const { client, sendRequest } = scriptedClient(launched({}))
+    await expect(launch(client, { hostCapabilities: ['agent.launch.v2'] })).resolves.toEqual({
+      kind: 'unsupported'
+    })
+    expect(sendRequest).not.toHaveBeenCalled()
+  })
+
+  it('launches through agent.launchReplay into the existing workspace with the prompt', async () => {
+    const { client, sendRequest } = scriptedClient(
+      launched({ prompt: { delivery: 'submit', outcome: 'handed-to-terminal' } })
+    )
+    const result = await launch(client, {
+      prompt: { text: 'Fix it', delivery: 'submit' },
+      launchSource: 'task_page'
+    })
+    expect(sendRequest).toHaveBeenCalledWith(
+      'agent.launchReplay',
+      {
+        agent: 'claude',
+        operationId: 'op-1',
+        target: { kind: 'existing', worktree: 'id:wt-1' },
+        prompt: { text: 'Fix it', delivery: 'submit' },
+        launchSource: 'task_page'
+      },
+      // The host may wait 60s for the agent before pasting; the default 30s would give up first.
+      { timeoutMs: PROMPTED_AGENT_LAUNCH_TIMEOUT_MS }
+    )
+    expect(result).toMatchObject({ kind: 'launched', promptDelivered: true })
+  })
+
+  it('keeps the default timeout for a launch with no prompt', async () => {
+    const { client, sendRequest } = scriptedClient(launched({}))
+    await expect(launch(client)).resolves.toMatchObject({
+      kind: 'launched',
+      promptDelivered: null
+    })
+    expect(sendRequest.mock.calls[0]![2]).toBeUndefined()
+  })
+
+  it('reports a journaled prompt as delivered', async () => {
+    const { client } = scriptedClient(
+      launched({
+        outcome: { kind: 'structured', sessionId: 'claude_s1', handle: 'h' },
+        prompt: { delivery: 'submit', outcome: 'journaled', messageId: 'm-1' }
+      })
+    )
+    await expect(
+      launch(client, { prompt: { text: 'Fix it', delivery: 'submit' } })
+    ).resolves.toMatchObject({ kind: 'launched', promptDelivered: true })
+  })
+
+  it('reports not-delivered so the caller keeps the prompt', async () => {
+    const { client } = scriptedClient(
+      launched({ prompt: { delivery: 'submit', outcome: 'not-delivered' } })
+    )
+    await expect(
+      launch(client, { prompt: { text: 'Fix it', delivery: 'submit' } })
+    ).resolves.toMatchObject({ kind: 'launched', promptDelivered: false })
+  })
+
+  it('under-claims a prompted launch whose receipt carries no prompt disposal', async () => {
+    const { client } = scriptedClient(launched({}))
+    await expect(
+      launch(client, { prompt: { text: 'Fix it', delivery: 'submit' } })
+    ).resolves.toMatchObject({ kind: 'launched', promptDelivered: false })
+  })
+
+  it('treats a refusal of the first send as an unsupported host', async () => {
+    const { client } = scriptedClient(refused('agent_launch_replay_unsupported'))
+    await expect(launch(client)).resolves.toEqual({ kind: 'unsupported' })
+  })
+
+  it('never reads a refusal after a replay as unsupported: the first attempt may have run', async () => {
+    const { client, sendRequest } = scriptedClient(
+      { throws: markRpcDeliveryUnknown(new Error('Connection interrupted')) },
+      refused('agent_launch_replay_unsupported')
+    )
+    await expect(launch(client)).resolves.toEqual({
+      kind: 'unknown',
+      message: AGENT_LAUNCH_UNCONFIRMED_MESSAGE
+    })
+    // The replay reuses the same operation id.
+    expect(sendRequest.mock.calls.map(([, params]) => requestParam(params, 'operationId'))).toEqual(
+      ['op-1', 'op-1']
+    )
+  })
+
+  it('maps an unknown outcome to readable copy instead of the raw code', async () => {
+    const { client } = scriptedClient(refused('agent_session_operation_unknown'))
+    await expect(launch(client)).resolves.toEqual({
+      kind: 'unknown',
+      message: AGENT_LAUNCH_UNCONFIRMED_MESSAGE
+    })
+  })
+
+  it('surfaces a refusal from before the launch with the host message', async () => {
+    const { client } = scriptedClient(refused('selector_not_found', 'Workspace not found'))
+    await expect(launch(client)).resolves.toEqual({
+      kind: 'failed',
+      message: 'Workspace not found'
+    })
+  })
+
+  it('reports unknown when no answer arrives at all', async () => {
+    const { client } = scriptedClient({ throws: new Error('Request timed out') })
+    await expect(launch(client)).resolves.toEqual({
+      kind: 'unknown',
+      message: AGENT_LAUNCH_UNCONFIRMED_MESSAGE
+    })
+  })
+
+  it('mints a new operation for every call so a later tap is a new launch', async () => {
+    const { client, sendRequest } = scriptedClient(launched({}))
+    const ids = ['op-a', 'op-b']
+    await launch(client, { mintOperationId: () => ids.shift()! })
+    await launch(client, { mintOperationId: () => ids.shift()! })
+    expect(sendRequest.mock.calls.map(([, params]) => requestParam(params, 'operationId'))).toEqual(
+      ['op-a', 'op-b']
+    )
+  })
+
+  it('works against a v1.4.206-shaped host', async () => {
+    // v1.4.206 (the first release with these capabilities) parses a plain object that knows only
+    // these keys and strips the rest; its terminal arm starts the agent without the prompt.
+    const v1_4_206Keys = new Set([
+      'agent',
+      'operationId',
+      'target',
+      'prompt',
+      'sessionOptions',
+      'reuseTerminal'
+    ])
+    let parsed: Record<string, unknown> | null = null
+    const client = requestPortRpcClient(async (_method, params) => {
+      parsed = Object.fromEntries(
+        Object.entries(params ?? {}).filter(([key]) => v1_4_206Keys.has(key))
+      )
+      return launched({ prompt: { delivery: 'submit', outcome: 'not-delivered' } })
+    })
+    const result = await launch(client, {
+      prompt: { text: 'Fix it', delivery: 'submit' },
+      launchSource: 'task_page'
+    })
+    // Only telemetry is lost; the launch itself carries nothing that host would drop.
+    expect(parsed).toEqual({
+      agent: 'claude',
+      operationId: 'op-1',
+      target: { kind: 'existing', worktree: 'id:wt-1' },
+      prompt: { text: 'Fix it', delivery: 'submit' }
+    })
+    expect(result).toMatchObject({ kind: 'launched', promptDelivered: false })
+  })
+})
diff --git a/mobile/src/session/mobile-existing-agent-launch.ts b/mobile/src/session/mobile-existing-agent-launch.ts
new file mode 100644
index 00000000000..2a7d23071ad
--- /dev/null
+++ b/mobile/src/session/mobile-existing-agent-launch.ts
@@ -0,0 +1,126 @@
+/**
+ * Starting an agent in a workspace that already exists, through the host's `agent.launch`.
+ *
+ * The phone states intent (which agent, where, what to say) and the host decides whether it runs
+ * as a structured chat or a terminal agent, and how the prompt reaches it. Kept free of React so
+ * every outcome is unit-testable.
+ */
+
+import type { AgentLaunchPrompt, AgentLaunchResult } from '../../../src/shared/agent-launch-intent'
+import type { TuiAgent } from '../../../src/shared/tui-agent'
+import type { RpcClient } from '../transport/rpc-client'
+import { agentLaunchReplayRun } from '../tasks/mobile-workspace-create-operations'
+import {
+  agentLaunchExistingParams,
+  isAgentLaunchReplayUnsupportedRefusal,
+  readAgentLaunchSupport
+} from '../tasks/agent-launch-request'
+import { sendReplayingAmbiguousDelivery } from '../tasks/replay-on-ambiguous-delivery'
+import { structuredSessionOperationId } from './structured-session-operation-id'
+
+// Why: the host waits up to 60s for a terminal agent to become ready before pasting the prompt,
+// so a prompted launch must outlive that wait or the phone reports a launch that is still running.
+export const PROMPTED_AGENT_LAUNCH_TIMEOUT_MS = 90_000
+
+export const AGENT_LAUNCH_UPDATE_REQUIRED_MESSAGE =
+  'Update Orca on your computer to start an agent from your phone.'
+
+// host-status-gates keeps re-reading a failed status in the background, so the user need not act.
+export const AGENT_LAUNCH_STATUS_UNREADABLE_MESSAGE = "Could not read this host's status. Retrying…"
+
+export const AGENT_LAUNCH_UNCONFIRMED_MESSAGE =
+  "Couldn't confirm the agent started. Check the workspace before trying again."
+
+export type MobileExistingAgentLaunch =
+  /** The host answered. `promptDelivered` is null when no prompt was sent. */
+  | { kind: 'launched'; result: AgentLaunchResult; promptDelivered: boolean | null }
+  /** This host can't take the launch; nothing was started. */
+  | { kind: 'unsupported' }
+  /** The host refused before starting anything. */
+  | { kind: 'failed'; message: string }
+  /** The agent may or may not be running; the caller must not launch again on its own. */
+  | { kind: 'unknown'; message: string }
+
+export function supportsMobileExistingAgentLaunch(
+  hostCapabilities: readonly string[] | null | undefined
+): boolean {
+  const support = readAgentLaunchSupport(hostCapabilities)
+  return support !== false && support.replay
+}
+
+export async function launchAgentInExistingWorkspace(args: {
+  client: RpcClient
+  hostCapabilities: readonly string[] | null | undefined
+  worktreeId: string
+  agent: TuiAgent
+  prompt?: AgentLaunchPrompt
+  launchSource?: string
+  // Injected in tests; each call is one new operation, so a later tap never replays this one.
+  mintOperationId?: () => string
+}): Promise<MobileExistingAgentLaunch> {
+  if (!supportsMobileExistingAgentLaunch(args.hostCapabilities)) {
+    return { kind: 'unsupported' }
+  }
+  const params = agentLaunchExistingParams({
+    agent: args.agent,
+    worktreeId: args.worktreeId,
+    operationId: (args.mintOperationId ?? structuredSessionOperationId)(),
+    ...(args.prompt ? { prompt: args.prompt } : {}),
+    ...(args.launchSource ? { launchSource: args.launchSource } : {})
+  })
+  let sent
+  try {
+    sent = await sendReplayingAmbiguousDelivery(
+      args.client,
+      () =>
+        agentLaunchReplayRun.request(
+          args.client,
+          params,
+          args.prompt ? { timeoutMs: PROMPTED_AGENT_LAUNCH_TIMEOUT_MS } : undefined
+        ),
+      { kind: 'durable' }
+    )
+  } catch {
+    // The request reached the wire and no answer came back, even after replays.
+    return { kind: 'unknown', message: AGENT_LAUNCH_UNCONFIRMED_MESSAGE }
+  }
+  const { response, replayed } = sent
+  if (!response.ok) {
+    return classifyLaunchRefusal(response.error, replayed)
+  }
+  let result: AgentLaunchResult
+  try {
+    result = agentLaunchReplayRun.interpret(response)
+  } catch {
+    return { kind: 'unknown', message: AGENT_LAUNCH_UNCONFIRMED_MESSAGE }
+  }
+  return {
+    kind: 'launched',
+    result,
+    // A receipt missing from a prompted launch under-claims: the phone keeps the text.
+    promptDelivered: args.prompt
+      ? result.prompt !== undefined && result.prompt.outcome !== 'not-delivered'
+      : null
+  }
+}
+
+function classifyLaunchRefusal(
+  error: { code?: string; message?: string },
+  replayed: boolean
+): MobileExistingAgentLaunch {
+  if (isAgentLaunchReplayUnsupportedRefusal(error)) {
+    // Only a refusal of the first send proves nothing ran; after a replay it may be a replacement
+    // connection whose capability list hasn't landed, answering for an attempt that did start.
+    return replayed
+      ? { kind: 'unknown', message: AGENT_LAUNCH_UNCONFIRMED_MESSAGE }
+      : { kind: 'unsupported' }
+  }
+  if (
+    error.code === 'agent_session_operation_unknown' ||
+    error.code === 'agent_session_operation_expired'
+  ) {
+    return { kind: 'unknown', message: AGENT_LAUNCH_UNCONFIRMED_MESSAGE }
+  }
+  const message = error.message?.trim()
+  return { kind: 'failed', message: message || "Couldn't start the agent." }
+}
diff --git a/mobile/src/session/mobile-file-language.ts b/mobile/src/session/mobile-file-language.ts
index 03b368c9411..a40e4e4d5c6 100644
--- a/mobile/src/session/mobile-file-language.ts
+++ b/mobile/src/session/mobile-file-language.ts
@@ -89,5 +89,10 @@ export function detectMobileFileLanguage(filePath: string, preferredLanguage?: s
     return exact
   }
 
-  return EXT_TO_LANGUAGE[extname(filename).toLowerCase()] ?? 'plaintext'
+  const lowerName = filename.toLowerCase()
+  // Scoped dotenv names fall back to INI only when no specific extension matches.
+  return (
+    EXT_TO_LANGUAGE[extname(filename).toLowerCase()] ??
+    (lowerName === '.env' || lowerName.startsWith('.env.') ? 'ini' : 'plaintext')
+  )
 }
diff --git a/mobile/src/session/mobile-file-syntax.test.ts b/mobile/src/session/mobile-file-syntax.test.ts
index f01a240e10f..821a1261960 100644
--- a/mobile/src/session/mobile-file-syntax.test.ts
+++ b/mobile/src/session/mobile-file-syntax.test.ts
@@ -9,6 +9,65 @@ import {
 import type { MobileDiffLine } from './mobile-diff-lines'
 
 describe('mobile file syntax highlighting', () => {
+  it.each([
+    ['.env', 'ini'],
+    ['.env.local', 'ini'],
+    ['.env.development', 'ini'],
+    ['.env.production', 'ini'],
+    ['.env.functions.local', 'ini'],
+    ['.env.staging', 'ini'],
+    ['.env.test.example', 'ini'],
+    ['config/.env.development.local', 'ini'],
+    ['.ENV', 'ini'],
+    ['.ENV.STAGING', 'ini'],
+    ['C:\\repo\\.EnV.FUNCTIONS.LOCAL', 'ini'],
+    ['\\\\server\\share\\.env.test.example', 'ini'],
+    ['.env.sh', 'shell'],
+    ['.ENV.SH', 'shell'],
+    ['.env.json', 'json'],
+    ['.env.local.ts', 'typescript'],
+    ['.env/CMakeLists.txt', 'cmake'],
+    ['C:\\repo\\.env.local\\Dockerfile', 'dockerfile'],
+    ['.envrc', 'plaintext'],
+    ['.environment', 'plaintext'],
+    ['env.staging', 'plaintext'],
+    ['dev.env', 'plaintext'],
+    ['other.env.local', 'plaintext'],
+    ['..env.local', 'plaintext'],
+    ['.env.staging/readme', 'plaintext'],
+    ['C:\\repo\\.env.local\\notes', 'plaintext'],
+    ['', 'plaintext']
+  ])('detects dotenv names without overriding specific mappings: %s', (filePath, expected) => {
+    expect(detectMobileFileLanguage(filePath)).toBe(expected)
+  })
+
+  it('keeps a mobile language preference ahead of the dotenv fallback', () => {
+    expect(detectMobileFileLanguage('.env.staging', ' JSON ')).toBe('json')
+    expect(detectMobileFileLanguage('.env.staging', ' plaintext ')).toBe('ini')
+  })
+
+  it('highlights dotenv file and diff contents with the bundled ini grammar', () => {
+    const language = resolveMobileSyntaxLanguage('.env.functions.local', 'plaintext')
+    const content = '# Local settings\nAPI_URL="https://example.test"\nPORT=54321'
+    expect(language).toBe('ini')
+    const file = highlightMobileCode(content, language)
+    expect(file.highlighted).toBe(true)
+    expect(file.segments.map((segment) => segment.text).join('')).toBe(content)
+    expect(file.segments).toEqual(
+      expect.arrayContaining([
+        { text: '# Local settings', kind: 'comment' },
+        { text: 'API_URL', kind: 'variable' },
+        { text: '"https://example.test"', kind: 'string' }
+      ])
+    )
+    const [line] = highlightMobileDiffLines(
+      [{ kind: 'add', text: 'PORT=54321', newLineNumber: 3 }],
+      language
+    )
+    expect(line).toMatchObject({ kind: 'add', newLineNumber: 3, highlighted: true })
+    expect(line?.segments).toContainEqual({ text: 'PORT', kind: 'variable' })
+  })
+
   it('detects common source languages from file paths', () => {
     expect(detectMobileFileLanguage('src/App.tsx')).toBe('typescript')
     expect(detectMobileFileLanguage('config/vitest.config.mts')).toBe('typescript')
diff --git a/mobile/src/session/mobile-markdown-disk-fallback.test.ts b/mobile/src/session/mobile-markdown-disk-fallback.test.ts
index 04de6c7f14f..fb172e1a425 100644
--- a/mobile/src/session/mobile-markdown-disk-fallback.test.ts
+++ b/mobile/src/session/mobile-markdown-disk-fallback.test.ts
@@ -75,17 +75,20 @@ describe('buildMarkdownDiskFallbackDoc', () => {
     })
   })
 
-  it('warns when the disk read is truncated', () => {
+  it('marks a truncated disk read so the status line names it', () => {
     expect(
       buildMarkdownDiskFallbackDoc({
         content: '# Partial',
         truncated: true,
+        byteLength: 700_000,
         tabIsDirty: true
       })
     ).toMatchObject({
       editable: false,
       stale: true,
-      readOnlyReason: 'File too large for mobile preview'
+      readOnlyReason: 'Desktop has unsaved changes. Showing disk content.',
+      truncated: true,
+      byteLength: 700_000
     })
   })
 })
diff --git a/mobile/src/session/mobile-markdown-disk-fallback.ts b/mobile/src/session/mobile-markdown-disk-fallback.ts
index 910fb072564..81fa55e14cd 100644
--- a/mobile/src/session/mobile-markdown-disk-fallback.ts
+++ b/mobile/src/session/mobile-markdown-disk-fallback.ts
@@ -1,4 +1,5 @@
 import type { RpcFailure } from '../transport/types'
+import type { MarkdownDocState } from './mobile-session-route-types'
 
 const RENDERER_UNAVAILABLE = 'renderer_unavailable'
 
@@ -9,26 +10,24 @@ export function shouldReadMarkdownFromDiskAfterReadTabFailure(response: RpcFailu
   )
 }
 
-// `truncated` is optional because the preview reader salvages it: an absent flag reads as not
-// truncated here, which is the branch main took for a reply that omitted it.
 export function buildMarkdownDiskFallbackDoc(args: {
   content: string
-  truncated: boolean | undefined
+  truncated?: boolean
+  byteLength?: number
   tabIsDirty: boolean
-}) {
-  const readOnlyReason = args.truncated
-    ? 'File too large for mobile preview'
-    : args.tabIsDirty
-      ? 'Desktop has unsaved changes. Showing disk content.'
-      : 'Editing needs Orca desktop running.'
+}): Extract<MarkdownDocState, { status: 'ready' }> {
+  const readOnlyReason = args.tabIsDirty
+    ? 'Desktop has unsaved changes. Showing disk content.'
+    : 'Editing needs Orca desktop running.'
   return {
-    status: 'ready' as const,
+    status: 'ready',
     content: args.content,
     localContent: args.content,
     baseVersion: '',
     isDirty: false,
     editable: false,
     stale: args.tabIsDirty,
-    readOnlyReason
+    readOnlyReason,
+    ...(args.truncated ? { truncated: true, byteLength: args.byteLength } : {})
   }
 }
diff --git a/mobile/src/session/mobile-markdown-reader-status.test.ts b/mobile/src/session/mobile-markdown-reader-status.test.ts
new file mode 100644
index 00000000000..8bee01b44d6
--- /dev/null
+++ b/mobile/src/session/mobile-markdown-reader-status.test.ts
@@ -0,0 +1,30 @@
+import { describe, expect, it } from 'vitest'
+import { markdownReaderStatusText } from './mobile-markdown-reader-status'
+
+const readOnlyDoc = {
+  status: 'ready' as const,
+  content: '# head',
+  localContent: '# head',
+  baseVersion: 'v1',
+  isDirty: false,
+  editable: false,
+  readOnlyReason: 'file_too_large'
+}
+
+describe('markdownReaderStatusText', () => {
+  it('names a truncated preview and the full file size the way file tabs do', () => {
+    expect(
+      markdownReaderStatusText({ ...readOnlyDoc, truncated: true, byteLength: 3_000_000 })
+    ).toBe('Preview truncated. File size: 2.9 MB.')
+  })
+
+  it('keeps read-only, stale, and save-error states as before', () => {
+    expect(markdownReaderStatusText(readOnlyDoc)).toBe('Read only')
+    expect(
+      markdownReaderStatusText({ ...readOnlyDoc, readOnlyReason: undefined, stale: true })
+    ).toBe('Changed on desktop')
+    expect(markdownReaderStatusText({ ...readOnlyDoc, saveError: 'Save failed' })).toBe(
+      'Save failed'
+    )
+  })
+})
diff --git a/mobile/src/session/mobile-markdown-reader-status.ts b/mobile/src/session/mobile-markdown-reader-status.ts
new file mode 100644
index 00000000000..060b73beffb
--- /dev/null
+++ b/mobile/src/session/mobile-markdown-reader-status.ts
@@ -0,0 +1,20 @@
+import { formatPreviewByteLength } from '../files/mobile-file-preview-response'
+import type { MarkdownDocState } from './mobile-session-route-types'
+
+/** The markdown floating bar's status line; a truncated preview reads like a file tab's note. */
+export function markdownReaderStatusText(
+  doc: Extract<MarkdownDocState, { status: 'ready' }>
+): string | null {
+  if (doc.saveError) {
+    return doc.saveError
+  }
+  if (doc.truncated) {
+    return doc.byteLength === undefined
+      ? 'Preview truncated.'
+      : `Preview truncated. File size: ${formatPreviewByteLength(doc.byteLength)}.`
+  }
+  if (doc.readOnlyReason) {
+    return 'Read only'
+  }
+  return doc.stale ? 'Changed on desktop' : null
+}
diff --git a/mobile/src/session/mobile-native-chat-answer-stepping.test.ts b/mobile/src/session/mobile-native-chat-answer-stepping.test.ts
index 05e05b1f188..e9049b00cc1 100644
--- a/mobile/src/session/mobile-native-chat-answer-stepping.test.ts
+++ b/mobile/src/session/mobile-native-chat-answer-stepping.test.ts
@@ -3,17 +3,10 @@ import {
   mobileNativeChatQuestionOffsets,
   scheduleMobileClaudeAnswer,
   MOBILE_NATIVE_CHAT_ADVANCE_BUFFER_MS,
-  MOBILE_NATIVE_CHAT_QUESTION_STEP_MS,
   MOBILE_NATIVE_CHAT_SUBMIT_DELAY_MS
 } from './mobile-native-chat-answer-stepping'
 
 describe('mobileNativeChatQuestionOffsets', () => {
-  it('matches the desktop cadence constants', () => {
-    expect(MOBILE_NATIVE_CHAT_SUBMIT_DELAY_MS).toBe(500)
-    expect(MOBILE_NATIVE_CHAT_ADVANCE_BUFFER_MS).toBe(500)
-    expect(MOBILE_NATIVE_CHAT_QUESTION_STEP_MS).toBe(1000)
-  })
-
   it('paces each question a full step apart, Enter 500ms after its body', () => {
     expect(mobileNativeChatQuestionOffsets(0)).toEqual({ bodyAt: 0, enterAt: 500 })
     expect(mobileNativeChatQuestionOffsets(1)).toEqual({ bodyAt: 1000, enterAt: 1500 })
diff --git a/mobile/src/session/mobile-native-chat-controller-contract.ts b/mobile/src/session/mobile-native-chat-controller-contract.ts
index 78c5ebeb1cf..8e4cffe158f 100644
--- a/mobile/src/session/mobile-native-chat-controller-contract.ts
+++ b/mobile/src/session/mobile-native-chat-controller-contract.ts
@@ -10,6 +10,7 @@ import type {
   NativeChatLiveTurnIndicator,
   NativeChatSettledTurns
 } from '../../../src/shared/native-chat-turn-status'
+import type { NativeChatTurnJournal } from '../../../src/shared/native-chat-turn-membership'
 import type { MobileNativeChatSendOutcome } from './mobile-native-chat-send'
 import type { MobileNativeChatPendingMessage } from './use-mobile-native-chat-drafts'
 import type { useMobileNativeChatSession } from './use-mobile-native-chat-session'
@@ -37,6 +38,8 @@ export type MobileNativeChatController = {
   /** Structured lane: host-recorded turn timing for the per-turn status rows. */
   nativeChatWorkingStartedAt: number | null
   nativeChatSettledTurns: NativeChatSettledTurns | null
+  /** Structured lane: the journal that places each transcript row in its turn. */
+  nativeChatTurnJournal: NativeChatTurnJournal | null
   nativeChatCanStop: boolean
   nativeChatStreamingText?: string
   /** Agent mid-turn, regardless of whether chat is the visible view. */
diff --git a/mobile/src/session/mobile-native-chat-list-footer.tsx b/mobile/src/session/mobile-native-chat-list-footer.tsx
new file mode 100644
index 00000000000..df81930e5fb
--- /dev/null
+++ b/mobile/src/session/mobile-native-chat-list-footer.tsx
@@ -0,0 +1,23 @@
+import { Fragment, type ReactElement } from 'react'
+import type { NativeChatMessage } from '../../../src/shared/native-chat-types'
+
+type MobileNativeChatListRow = { item: NativeChatMessage; index: number }
+
+/** The live turn's status, then the messages waiting behind that turn, drawn below it. */
+export function mobileNativeChatListFooter(
+  liveStatus: ReactElement | null,
+  waitingRows: readonly MobileNativeChatListRow[],
+  renderRow: (row: MobileNativeChatListRow) => ReactElement
+): ReactElement | null {
+  if (waitingRows.length === 0) {
+    return liveStatus
+  }
+  return (
+    <>
+      {liveStatus}
+      {waitingRows.map((row) => (
+        <Fragment key={row.item.id}>{renderRow(row)}</Fragment>
+      ))}
+    </>
+  )
+}
diff --git a/mobile/src/session/mobile-native-chat-message-styles.ts b/mobile/src/session/mobile-native-chat-message-styles.ts
index 51ff9ab1f36..88e97018521 100644
--- a/mobile/src/session/mobile-native-chat-message-styles.ts
+++ b/mobile/src/session/mobile-native-chat-message-styles.ts
@@ -32,6 +32,17 @@ export const styles = StyleSheet.create({
   reasoning: {
     opacity: 0.7
   },
+  // A subagent's row is an aside to the conversation, set off the way desktop sets it off.
+  subagent: {
+    borderLeftWidth: 2,
+    borderLeftColor: colors.borderSubtle,
+    paddingLeft: spacing.md
+  },
+  subagentCaption: {
+    color: colors.textMuted,
+    fontFamily: typography.monoFamily,
+    fontSize: MONO_SIZE
+  },
   toolRun: {
     marginTop: spacing.xs
   },
diff --git a/mobile/src/session/mobile-native-chat-message-text.test.ts b/mobile/src/session/mobile-native-chat-message-text.test.ts
deleted file mode 100644
index 165313c2e43..00000000000
--- a/mobile/src/session/mobile-native-chat-message-text.test.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { clampFontScale, FONT_SCALE_MAX, FONT_SCALE_MIN } from './mobile-native-chat-message-text'
-
-describe('clampFontScale', () => {
-  it('clamps below the minimum', () => {
-    expect(clampFontScale(0.1)).toBe(FONT_SCALE_MIN)
-  })
-
-  it('clamps above the maximum', () => {
-    expect(clampFontScale(5)).toBe(FONT_SCALE_MAX)
-  })
-
-  it('passes through an in-range value', () => {
-    expect(clampFontScale(1.2)).toBe(1.2)
-  })
-
-  it('falls back to 1 for NaN', () => {
-    expect(clampFontScale(Number.NaN)).toBe(1)
-  })
-})
diff --git a/mobile/src/session/mobile-native-chat-message-text.ts b/mobile/src/session/mobile-native-chat-message-text.ts
index 84d2f8f1cc9..22f09f322a9 100644
--- a/mobile/src/session/mobile-native-chat-message-text.ts
+++ b/mobile/src/session/mobile-native-chat-message-text.ts
@@ -1,9 +1,9 @@
 /** Pinch-to-zoom font bounds. Default 1 means no visible change until pinched. */
-export const FONT_SCALE_MIN = 0.8
-export const FONT_SCALE_MAX = 1.8
+const FONT_SCALE_MIN = 0.8
+const FONT_SCALE_MAX = 1.8
 
 /** Clamp a proposed font scale into the supported range. */
-export function clampFontScale(scale: number): number {
+function clampFontScale(scale: number): number {
   if (Number.isNaN(scale)) {
     return 1
   }
diff --git a/mobile/src/session/mobile-native-chat-noise.test.ts b/mobile/src/session/mobile-native-chat-noise.test.ts
index 0369a609135..dcda3f3dace 100644
--- a/mobile/src/session/mobile-native-chat-noise.test.ts
+++ b/mobile/src/session/mobile-native-chat-noise.test.ts
@@ -44,6 +44,7 @@ describe('isNoiseMessage', () => {
 
   it('keeps assistant and tool turns', () => {
     expect(isNoiseMessage(msg('assistant', '<system-reminder> in prose'))).toBe(false)
+    expect(isNoiseMessage(msg('system', 'Conversation interrupted'))).toBe(false)
   })
 
   it('keeps a user turn that carries tool results', () => {
diff --git a/mobile/src/session/mobile-native-chat-stream-frame.test.ts b/mobile/src/session/mobile-native-chat-stream-frame.test.ts
index e7733dac1ce..2112d1d9b96 100644
--- a/mobile/src/session/mobile-native-chat-stream-frame.test.ts
+++ b/mobile/src/session/mobile-native-chat-stream-frame.test.ts
@@ -350,7 +350,7 @@ describe('applyMobileNativeChatStreamFrame', () => {
     })
   })
 
-  it('surfaces snapshot errors and ignores unrelated frames', () => {
+  it('surfaces snapshot errors, reports a host end as an error, and ignores unrelated frames', () => {
     const merger = createNativeChatMerger()
     expect(
       applyMobileNativeChatStreamFrame({
@@ -375,6 +375,14 @@ describe('applyMobileNativeChatStreamFrame', () => {
         limit: 40,
         replaceSnapshot: true
       })
+    ).toEqual({ kind: 'error', error: 'Transcript stream ended' })
+    expect(
+      applyMobileNativeChatStreamFrame({
+        merger,
+        frame: { type: 'subscribed' },
+        limit: 40,
+        replaceSnapshot: true
+      })
     ).toEqual({ kind: 'ignored' })
   })
 })
diff --git a/mobile/src/session/mobile-native-chat-stream-frame.ts b/mobile/src/session/mobile-native-chat-stream-frame.ts
index 8984a04a0e3..96d74da3a6b 100644
--- a/mobile/src/session/mobile-native-chat-stream-frame.ts
+++ b/mobile/src/session/mobile-native-chat-stream-frame.ts
@@ -78,6 +78,10 @@ export function applyMobileNativeChatStreamFrame(args: {
   if (frame.type === 'error') {
     return { kind: 'error', error: frame.message ?? frame.error ?? 'Transcript stream failed' }
   }
+  // Why: a feed's token is its own, so an end that reaches here was not asked for; the feed is dead.
+  if (frame.type === 'end') {
+    return { kind: 'error', error: 'Transcript stream ended' }
+  }
   if (frame.type !== 'snapshot' && frame.type !== 'replacement' && frame.type !== 'appended') {
     return { kind: 'ignored' }
   }
diff --git a/mobile/src/session/mobile-new-tab-agent-loader.ts b/mobile/src/session/mobile-new-tab-agent-loader.ts
index f22ebda5990..5cc02b54421 100644
--- a/mobile/src/session/mobile-new-tab-agent-loader.ts
+++ b/mobile/src/session/mobile-new-tab-agent-loader.ts
@@ -15,10 +15,18 @@ import {
   type MobileNewTabAgentSettings
 } from './mobile-new-tab-agent-options'
 
-export async function loadMobileNewTabAgentOptions(args: {
+/** What a launch in this workspace can choose from: the host's settings, the agents detected on
+ *  the workspace's execution host, and the workspace's repo (absent for the floating workspace). */
+export type MobileAgentLaunchContext = {
+  settings: unknown
+  detectedAgents: unknown[]
+  repo: MobileRuntimeRepoSummary | null
+}
+
+export async function loadMobileAgentLaunchContext(args: {
   client: RpcClient
   worktreeId: string
-}): Promise<MobileNewTabAgentOption[]> {
+}): Promise<MobileAgentLaunchContext> {
   const { client, worktreeId } = args
   // Started before the settings read, not inside the array: the detection request goes on the wire
   // first, and the recorded sender order is what says so.
@@ -31,10 +39,18 @@ export async function loadMobileNewTabAgentOptions(args: {
   // Interpreted after the group, not inside it: whichever peer failed first must not decide the
   // error the sheet shows, and main raised the detection refusal only once settings had settled.
   const detected = detectedAgents.interpret(detectedAgents.reply)
+  return { settings: readSettings(), detectedAgents: detected, repo: detectedAgents.repo }
+}
+
+export async function loadMobileNewTabAgentOptions(args: {
+  client: RpcClient
+  worktreeId: string
+}): Promise<MobileNewTabAgentOption[]> {
+  const context = await loadMobileAgentLaunchContext(args)
   return buildMobileNewTabAgentOptions(
     // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Preserve the established response shape at this boundary.
-    readSettings() as MobileNewTabAgentSettings | undefined,
-    detected
+    context.settings as MobileNewTabAgentSettings | undefined,
+    context.detectedAgents
   )
 }
 
@@ -42,6 +58,7 @@ export async function loadMobileNewTabAgentOptions(args: {
 type DetectedAgentsReply = {
   reply: RpcResponse
   interpret: (reply: RpcResponse) => unknown[]
+  repo: MobileRuntimeRepoSummary | null
 }
 
 async function loadDetectedAgents(
@@ -52,7 +69,8 @@ async function loadDetectedAgents(
   if (isFloatingWorkspaceWorktreeId(worktreeId)) {
     return {
       reply: await preflightDetectAgentsRead.request(client),
-      interpret: preflightDetectAgentsRead.interpret
+      interpret: preflightDetectAgentsRead.interpret,
+      repo: null
     }
   }
   const repoResponse = await newTabRepoListRead.request(client)
@@ -67,10 +85,12 @@ async function loadDetectedAgents(
   return connectionId
     ? {
         reply: await preflightDetectRemoteAgentsRead.request(client, { connectionId }),
-        interpret: preflightDetectRemoteAgentsRead.interpret
+        interpret: preflightDetectRemoteAgentsRead.interpret,
+        repo
       }
     : {
         reply: await preflightDetectAgentsRead.request(client),
-        interpret: preflightDetectAgentsRead.interpret
+        interpret: preflightDetectAgentsRead.interpret,
+        repo
       }
 }
diff --git a/mobile/src/session/mobile-session-connection-retry.test.tsx b/mobile/src/session/mobile-session-connection-retry.test.tsx
index 0102819b311..410c6dea196 100644
--- a/mobile/src/session/mobile-session-connection-retry.test.tsx
+++ b/mobile/src/session/mobile-session-connection-retry.test.tsx
@@ -30,7 +30,7 @@ function present(forceReconnectHost: ForceReconnect): Presentation {
     toastOpacityRef: { current: 1 },
     hostEndpoint: null,
     initialSessionAutoCreateRef: { current: null },
-    terminalFrameHeightRef: { current: 0 },
+    terminalFrameRef: { current: null },
     handleCreateTerminal: () => Promise.resolve(),
     visibleTabs: [],
     forceReconnectHost
diff --git a/mobile/src/session/mobile-session-frame-styles.ts b/mobile/src/session/mobile-session-frame-styles.ts
index a02c14be014..22ac97d23c8 100644
--- a/mobile/src/session/mobile-session-frame-styles.ts
+++ b/mobile/src/session/mobile-session-frame-styles.ts
@@ -70,6 +70,7 @@ export const mobileSessionFrameStyles = StyleSheet.create({
   sessionMetaRow: {
     flexDirection: 'row',
     alignItems: 'center',
+    gap: spacing.sm,
     marginTop: 2
   },
   sessionMetaText: {
@@ -142,6 +143,11 @@ export const mobileSessionFrameStyles = StyleSheet.create({
     height: 18,
     backgroundColor: colors.borderSubtle
   },
+  // The content slot every branch renders in, measured as the terminal's frame; clips nothing.
+  contentFrame: {
+    flex: 1,
+    minHeight: 0
+  },
   terminalFrame: {
     flex: 1,
     minHeight: 0,
diff --git a/mobile/src/session/mobile-session-last-tab-close.test.ts b/mobile/src/session/mobile-session-last-tab-close.test.ts
deleted file mode 100644
index a15a62b1535..00000000000
--- a/mobile/src/session/mobile-session-last-tab-close.test.ts
+++ /dev/null
@@ -1,43 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { readMobileSessionRouteSourceFamily } from './mobile-session-route-source-family.test-support'
-
-const sessionRouteSource = readMobileSessionRouteSourceFamily()
-
-describe('mobile session last-tab close', () => {
-  it('preserves terminal identity while an empty snapshot may be transient', () => {
-    const start = sessionRouteSource.indexOf('const applySessionTabs = useCallback')
-    const end = sessionRouteSource.indexOf('const readMarkdownTab', start)
-    const block = sessionRouteSource.slice(start, end)
-
-    expect(block).toContain('} else if (active) {')
-    expect(block).toContain('retainMissingSurfaces: result.tabs.length === 0')
-  })
-
-  it('clears stale active identity when closing leaves no tabs', () => {
-    const start = sessionRouteSource.indexOf('async function handleCloseSessionTab')
-    const end = sessionRouteSource.indexOf('const bulkCloseActions', start)
-    const block = sessionRouteSource.slice(start, end)
-
-    expect(block).toContain(
-      'activeSessionTabIdRef.current === tab.id || remainingTabs.length === 0'
-    )
-    expect(block).toContain('activeSessionTabIdRef.current = null')
-    expect(block).toContain('activeHandleRef.current = null')
-    expect(block).toContain(
-      'reconcileBufferedDraftsRef.current(sessionTabsRef.current, remainingTabs)'
-    )
-  })
-
-  it('ignores a pending terminal handle when the host requests follow navigation', () => {
-    const start = sessionRouteSource.indexOf('const applySessionTabs = useCallback')
-    const end = sessionRouteSource.indexOf('const readMarkdownTab', start)
-    const block = sessionRouteSource.slice(start, end)
-
-    const followsHost = block.indexOf("const followsHost = result.navigationIntent === 'follow'")
-    const pendingHandle = block.indexOf('const pendingActiveTerminalHandle = followsHost')
-
-    expect(followsHost).toBeGreaterThanOrEqual(0)
-    expect(pendingHandle).toBeGreaterThan(followsHost)
-    expect(block.slice(pendingHandle, pendingHandle + 150)).toContain('? null')
-  })
-})
diff --git a/mobile/src/session/mobile-session-route-parity.test.ts b/mobile/src/session/mobile-session-route-parity.test.ts
deleted file mode 100644
index 60df6b17d08..00000000000
--- a/mobile/src/session/mobile-session-route-parity.test.ts
+++ /dev/null
@@ -1,624 +0,0 @@
-import { createHash } from 'node:crypto'
-import { readFileSync } from 'node:fs'
-import { fileURLToPath } from 'node:url'
-import ts from 'typescript-api'
-import { describe, expect, it } from 'vitest'
-import { MOBILE_SESSION_ROUTE_SOURCE_FILES } from './mobile-session-route-source-family.test-support'
-
-const SESSION_FILES = MOBILE_SESSION_ROUTE_SOURCE_FILES
-/** The function the route mounts, which C7.7 moved out of the route file and into a component. */
-const ROOT_COMPONENT = 'MobileSessionRouteScreen'
-const LOGIC_EXPANSION_NAMES = new Set([
-  'useMobileSessionController',
-  'useMobileSessionFoundation',
-  'useMobileSessionScreenState',
-  'useMobileSessionTerminalRuntime',
-  'useMobileSessionFeedbackCapabilities',
-  'useMobileSessionNativeChatDictation',
-  'useMobileSessionTerminalSubscriptionFoundation',
-  'useMobileSessionTerminalSubscription',
-  'useMobileSessionTerminalStreamDisplay',
-  'useMobileSessionTerminalList',
-  'useMobileSessionTabApplication',
-  'useMobileSessionDocumentReaders',
-  'useMobileSessionDiffComments',
-  'useMobileSessionMarkdownActions',
-  'useMobileSessionTabReconciliation',
-  'useMobileSessionLifecycle',
-  'useMobileSessionKeyboardState',
-  'useMobileSessionStartup',
-  'useMobileSessionPreferenceFocus',
-  'useMobileSessionTabSwitching',
-  'useMobileSessionTerminalWebview',
-  'useMobileSessionTerminalSendActions',
-  'useMobileSessionFileActions',
-  'useMobileSessionTerminalInput',
-  'useMobileSessionAccessorySelection',
-  'useMobileSessionAttachments',
-  'useMobileSessionTerminalCreateActions',
-  'useMobileSessionContentCreateActions',
-  'useMobileSessionCloseActions',
-  'useMobileSessionBulkClose',
-  'useMobileSessionPresentation',
-  'useMobileSessionPanelRouteActions'
-])
-const SURFACE_EXPANSION_NAMES = new Set([
-  'MobileSessionSurface',
-  'MobileSessionHeader',
-  'MobileSessionContentRow',
-  'MobileSessionActiveContent',
-  'MobileSessionCommandDock',
-  'MobileSessionSheets'
-])
-const CONTENT_COMPONENT_NAMES = ['MarkdownReader', 'DiffLineRow', 'FileReader'] as const
-const HOST_COMPONENT_NAMES = new Set([
-  'ActivityIndicator',
-  'Animated.View',
-  'FlatList',
-  'Image',
-  'Pressable',
-  'SafeAreaView',
-  'ScrollView',
-  'Text',
-  'TextInput',
-  'View'
-])
-
-// Refreshed by C7.2: five clipboard hooks joined the expanded route, which is the whole of the +5 —
-// a writer in the diff-note, Markdown and selection actions, a reader in the selection actions and
-// the attachment probe. The screen's other four clipboard sites (the terminal's paste, the sheets,
-// the quick-command row, the diff-review send) sit outside the walk from `MobileSessionRouteScreen`
-// and so do not move this pin. The copy-path sheet also gained the failure toast the other two had.
-// Refreshed for `reportDictationFailure`, the whole of that +1: the composer's two dictation
-// failure handlers were one policy written twice, and only `onError`'s copy knew about the setup
-// sheet, so a refused start showed the desktop's own `voice_dictation_disabled` as a toast.
-//
-// Refreshed again for the page's keyboard: the screen's own `Keyboard.addListener` pair became the
-// `useSoftKeyboard` seam, because react-native-web never fires those events and the live input row
-// laid itself out under the IME. +2 hooks (the seam, and the one effect split into a visibility one
-// and a height one), +1 effect, -2 registrations and -2 removals for the listener pair, and -6
-// strings: the four event names and the two `'ios'` guards that chose between them. Re-recorded
-// against the merged tree, since neither side's hash covers the other's change.
-//
-// Refreshed for the terminal fields' submit seam: react-native-web withholds `onSubmitEditing`
-// when the Enter keydown reports an open composition, which is a soft keyboard's normal mid-word
-// state, so both of the dock's fields also bind the page's own line-break signal. +4 hooks and +2
-// callbacks in the send actions — `submitLiveInput` and `submitBufferedDraft`, each with a
-// `useTerminalTextFieldSubmitBinding` beside it — and both fields moved their ref, the live one
-// its submit handler too.
-// Moved once more, -1 hook and -1 callback: `submitBufferedDraft` stopped being a `useCallback`.
-// Memoizing it on `[]` froze the per-render `handleSend` it reads, whose guard needs a `client`
-// and an `activeHandle` the first render does not have, so the page's line-break submit could
-// never pass it. Found by pullfrog on #22300.
-// Moved, count unchanged, when the Markdown actions' Back `useEffect` became `useBackClaim`, the
-// seam that also claims the key on the page while a draft is dirty.
-const HEAD_MAIN_HOOK_SHA256 = '914bf72e0bf0abe2b22850467b5dfdc3ab3fd19111924f1de91d9c1d9d1ce74f'
-const HEAD_HOOK_BINDING_SHA256 = 'd0677b98b909f8a24089ac5d6afe9ad2c238fa6c24969da1e84e01cd6f653a16'
-const HEAD_CALLBACK_IDENTITY_SHA256 =
-  'e396ab759b2401acef45dea428e97c7f8f24fff41aae7fb7858da5a5b145c64c'
-// Pins that no callback body in the route changed unnoticed. Body text, not behaviour: the sends
-// and repo reads inside them now name their `RpcOperation` instead of the raw `sendRequest` port.
-// Refreshed in step 6 for the gesture flush, whose `terminal.send` became `terminalInputSend` and
-// whose accepted-check became that operation's own verdict, then again when that check was spelled
-// `=== true` to match the other four sites reading the same verdict. Refreshed in step 7 for the
-// reply casts the checked readers made unnecessary — the markdown tab doc, the worktree record's
-// `diffComments` and the browser tab's page id are typed by their schemas now. Refreshed once more
-// on the merge, for the display-mode toggle whose send became `terminalDisplayModeSet`. Refreshed
-// for the files domain's step 7, which retired the markdown disk fallback's `{ content, truncated,
-// byteLength }` cast: the preview reader checks the content and salvages the flag, so `readMarkdownTab`
-// reads `fallback.value` directly. The dictation-mode refresh is main's own body again — it forwards
-// whatever mode the reply carried, so an absent one leaves the mic as inert as main left it.
-// Refreshed on the merge of C7.2 and C7.3, which moved this pin from both sides: the terminal
-// subscribe now carries the snapshot byte budget its transport imposes, nothing on a phone and the
-// frame cap inside the shell's page, and the Markdown copy action gained the failure branch that
-// answers a refused write. Re-recorded against the merged tree, since neither side's hash covers
-// the other's body. The hook and string counts are C7.2's and stand.
-// Refreshed once more for the two dictation failure handlers, which now both call
-// `reportDictationFailure` instead of each choosing between the setup sheet and a toast.
-const HEAD_CALLBACK_BODY_SHA256 = '349ad6f766da14b3bce23a13f3a67f2b013efadd8896f63b7b68e724b9726d9b'
-// Refreshed for the startup effect: both `worktree.activate` sends became `worktreeActivate`, and
-// the sleeping-agent check reads that operation's verdict instead of the reply envelope. Refreshed
-// again when the reporter took the reply and interpreted it itself, retiring the hand-built
-// refusal the timer site passed when it had no reply at all. Refreshed once more for the
-// last-visited-worktree effect, whose bare store write became the one writer of that key, so the
-// hybrid shell's page mirror sees it as it is written rather than one `init` later. Refreshed for
-// the diff-comments effect, which now catches the loader's rejection. Count unchanged.
-// Moved again by the keyboard seam above, which is the +1 effect.
-// -1 effect for the Markdown actions' Back registration, which is `useBackClaim`'s own now.
-const HEAD_EFFECT_SHA256 = '69096e20a44fa03a2c364e00a617eeabc437a79bb850b9135408d35fbd4d4a71'
-const HEAD_CONTENT_HOOK_SHA256 = '9c3b612fef3f370d66873aefdbe1d701f20cb64ded31fef5cc45fde6f8189581'
-// Same pin for the 12 bodies that sit in nested functions rather than callbacks, moved by the same
-// rewrite of those send and read expressions. Count unchanged. Refreshed again in step 6 for
-// `handleClearTerminal`, whose send became `terminalBufferClear`, in step 7 for the browser tab
-// create, whose `{ browserPageId?: string }` cast its schema now carries, and once more for
-// `handleCreateTerminal`, whose send became `sessionTabCreateTerminal` and whose `response.ok`
-// branch became that operation's own throw-the-host-message acceptance. Refreshed for negotiated
-// optimistic placement, which defers to legacy host snapshots when ownership paths disagree.
-const HEAD_NESTED_FUNCTION_SHA256 =
-  '923b5ea7fe3330cbd98213b72736bf1f653115ddb5492cb8eb8306d8ca4f28e8'
-// -1 registration and -1 removal: the Markdown actions' `BackHandler` pair is `useBackClaim`'s.
-const HEAD_NATIVE_REGISTRATION_SHA256 =
-  '87d4599f475575131d4d5daa20f0dac579ca6c829353cbb654206ea6965dadae'
-const HEAD_NATIVE_REMOVAL_SHA256 =
-  '089bebbc1e4f2e68c5dbaf189bb605d8d5bb247ef5ca52b9db08cc2661afc097'
-const HEAD_TIMER_CREATION_SHA256 =
-  '1a31b625e2174c3db77272249843196d2b6b06ab1e654a96d8f7858e3082e66b'
-const HEAD_TIMER_CLEANUP_SHA256 = 'c73f1d1c2cc89642f3d727d6f3b6b81860a9d6f34234541a2065ec3d1a8cd116'
-// Six method literals fewer than before step 6: `terminal.send` and `terminal.clearBuffer` went
-// first, then `worktree.activate` twice, `session.tabs.createTerminal` and
-// `terminal.setDisplayMode`. Each is now fixed at its operation's definition instead of being
-// spelled at the call site. Two literals more across C7.2, both of them the toast a refused write
-// now shows: "Couldn't copy path" when the sheets moved onto the clipboard seam, taking the count
-// from 532 to 533, and "Couldn't copy" when the Markdown copy action gained the failure branch the
-// other copy paths already had, taking it to 534.
-//
-// Two more across C7.7, 534 -> 536: `'web'`, the platform guard the Markdown actions'
-// `BackHandler` registration gained so it stops logging on the page, and `"button"`, the
-// accessibility role the header's Back control gained so the page serves it by name. Neither is a
-// behaviour change on a phone. The same `'web'` moves the effect hash, and `"button"` the host-JSX
-// hash. The effect hash moved a second time and back: the diff-notes loader's uncaught rejection
-// was caught and then reverted, because the fix moves `matrix-session.diff-notes-worktree.show-1`
-// and a golden is a review event — so this hash is the one the uncaught `void` call produces.
-//
-// 536 -> 530 for the keyboard seam above: the four event names and the two `'ios'` guards left
-// with the listener pair.
-//
-// The host-JSX hash moved for the header's reconnect tap, which now also checks the re-dial exists:
-// the page's provider hands out none. Nothing a phone renders or does changed.
-//
-// 530 -> 529: `'hardwareBackPress'` left with the Markdown actions' registration for `useBackClaim`.
-//
-// 529 -> 530, and the host-JSX hash: `key="terminal-frame"`, so the page's frame mounts with its
-// onLayout rather than reusing the loading View. Native measured 47 rows before and after: its
-// frame reported either way, and its window is its frame, so both measure paths agree there.
-const HEAD_RUNTIME_STRING_SHA256 =
-  'd7eea5438ff7b4ee77c9bf652626adfdc3d2b49716ffb660df078f70bae0d88d'
-// Moved by both of the dock's fields: their refs, and the live one's submit handler, are the seam's now.
-const HEAD_HOST_JSX_SHA256 = 'ca4c8b46af86a05cb671de91c22111c9e4aaeefd4a04c7b8b09976ca01a31c9b'
-const HEAD_LEAF_JSX_SHA256 = 'c7e1a4b90197697f1eaa640c38da63281b4f7b84fb036ae2152f00c2f7d7cb77'
-const HEAD_STYLE_REFERENCE_SHA256 =
-  '295a3501c2c6d7bea7c8bbf38b3f3534f01344cd7e1b91bb8e07c040821d596a'
-const HEAD_IDENTITY_FIELD_SHA256 =
-  '91146853930a34dd1f3d80e5c97fbacd7cf19fb93dd26fe8fc6f29169622f9d6'
-const HEAD_NAVIGATION_SHA256 = '9d96f5dad7de555d6553eac39c0fab00efad507470fd562cb9beaa32db16f512'
-const HEAD_CAPABILITY_SHA256 = '67c3154b71b542bb63a4365d3ea75aef19ef133c02f509318619618221786fab'
-
-type Definition = { declaration: ts.FunctionDeclaration; sourceFile: ts.SourceFile }
-type HookFacts = {
-  bindings: string[]
-  callbackBodies: string[]
-  callbacks: string[]
-  effects: string[]
-  hooks: string[]
-}
-
-const printer = ts.createPrinter({ removeComments: true })
-const sourceFiles = new Map<string, ts.SourceFile>()
-
-function parse(relativePath: string): ts.SourceFile {
-  const cached = sourceFiles.get(relativePath)
-  if (cached) {
-    return cached
-  }
-  const filePath = fileURLToPath(new URL(relativePath, import.meta.url))
-  const sourceFile = ts.createSourceFile(
-    relativePath,
-    readFileSync(filePath, 'utf8'),
-    ts.ScriptTarget.Latest,
-    true,
-    relativePath.endsWith('.tsx') ? ts.ScriptKind.TSX : ts.ScriptKind.TS
-  )
-  sourceFiles.set(relativePath, sourceFile)
-  return sourceFile
-}
-
-function canonical(node: ts.Node, sourceFile: ts.SourceFile): string {
-  return printer.printNode(ts.EmitHint.Unspecified, node, sourceFile).replace(/\s+/g, '')
-}
-
-function hash(values: readonly string[]): string {
-  return createHash('sha256').update(values.join('\n')).digest('hex')
-}
-
-function readDefinitions(): Map<string, Definition> {
-  const definitions = new Map<string, Definition>()
-  for (const relativePath of SESSION_FILES) {
-    const sourceFile = parse(relativePath)
-    const visit = (node: ts.Node): void => {
-      if (ts.isFunctionDeclaration(node) && node.name) {
-        definitions.set(node.name.text, { declaration: node, sourceFile })
-      }
-      ts.forEachChild(node, visit)
-    }
-    visit(sourceFile)
-  }
-  return definitions
-}
-
-function visitLogicalFunction(
-  name: string,
-  definitions: ReadonlyMap<string, Definition>,
-  onNode: (node: ts.Node, sourceFile: ts.SourceFile) => void,
-  active = new Set<string>()
-): void {
-  const definition = definitions.get(name)
-  if (!definition?.declaration.body) {
-    throw new Error(`Missing session function: ${name}`)
-  }
-  if (active.has(name)) {
-    throw new Error(`Recursive session function: ${name}`)
-  }
-  const nextActive = new Set(active).add(name)
-  const visit = (node: ts.Node): void => {
-    if (
-      ts.isCallExpression(node) &&
-      ts.isIdentifier(node.expression) &&
-      LOGIC_EXPANSION_NAMES.has(node.expression.text)
-    ) {
-      visitLogicalFunction(node.expression.text, definitions, onNode, nextActive)
-      return
-    }
-    onNode(node, definition.sourceFile)
-    ts.forEachChild(node, visit)
-  }
-  visit(definition.declaration.body)
-}
-
-function readHookFacts(name: string, definitions: ReadonlyMap<string, Definition>): HookFacts {
-  const facts: HookFacts = {
-    bindings: [],
-    callbackBodies: [],
-    callbacks: [],
-    effects: [],
-    hooks: []
-  }
-  visitLogicalFunction(name, definitions, (node, sourceFile) => {
-    if (
-      !ts.isCallExpression(node) ||
-      !ts.isIdentifier(node.expression) ||
-      !/^use[A-Z]/.test(node.expression.text)
-    ) {
-      return
-    }
-    const hookName = node.expression.text
-    facts.hooks.push(hookName)
-    const owner = ts.isVariableDeclaration(node.parent)
-      ? node.parent.name.getText(sourceFile)
-      : ts.isExpressionStatement(node.parent)
-        ? '<statement>'
-        : ts.isCallExpression(node.parent) && ts.isIdentifier(node.parent.expression)
-          ? `<argument:${node.parent.expression.text}>`
-          : '<nested>'
-    const lastArgument = node.arguments.at(-1)
-    const dependencies =
-      lastArgument && ts.isArrayLiteralExpression(lastArgument)
-        ? canonical(lastArgument, sourceFile)
-        : '<none>'
-    facts.bindings.push(`${hookName}|${owner}|${dependencies}`)
-    if (hookName === 'useCallback') {
-      facts.callbacks.push(`${owner}|${dependencies}`)
-      facts.callbackBodies.push(
-        `${owner}|${canonical(node.arguments[0], sourceFile)}|${dependencies}`
-      )
-    }
-    if (hookName === 'useEffect') {
-      facts.effects.push(`${canonical(node.arguments[0], sourceFile)}|${dependencies}`)
-    }
-  })
-  return facts
-}
-
-function readNestedFunctions(definitions: ReadonlyMap<string, Definition>): string[] {
-  const functions: string[] = []
-  const visitDefinition = (name: string, active: ReadonlySet<string>): void => {
-    const definition = definitions.get(name)
-    if (!definition?.declaration.body || active.has(name)) {
-      throw new Error(`Invalid nested-function stage: ${name}`)
-    }
-    const nextActive = new Set(active).add(name)
-    const visit = (node: ts.Node): void => {
-      if (
-        ts.isCallExpression(node) &&
-        ts.isIdentifier(node.expression) &&
-        LOGIC_EXPANSION_NAMES.has(node.expression.text)
-      ) {
-        visitDefinition(node.expression.text, nextActive)
-        return
-      }
-      if (ts.isFunctionDeclaration(node) && node.name) {
-        functions.push(`${node.name.text}|${canonical(node, definition.sourceFile)}`)
-        return
-      }
-      ts.forEachChild(node, visit)
-    }
-    visit(definition.declaration.body)
-  }
-  visitDefinition(ROOT_COMPONENT, new Set())
-  return functions
-}
-
-function readNativeAndTimerFacts(definitions: ReadonlyMap<string, Definition>): {
-  cleanups: string[]
-  creations: string[]
-  registrations: string[]
-  removals: string[]
-} {
-  const registrations: string[] = []
-  const removals: string[] = []
-  const creations: string[] = []
-  const cleanups: string[] = []
-  const collect = (node: ts.Node, sourceFile: ts.SourceFile): void => {
-    if (!ts.isCallExpression(node)) {
-      return
-    }
-    if (ts.isPropertyAccessExpression(node.expression)) {
-      const receiver = node.expression.expression.getText(sourceFile)
-      const method = node.expression.name.text
-      if (
-        ['BackHandler', 'AppState', 'Keyboard'].includes(receiver) &&
-        ['addEventListener', 'addListener'].includes(method)
-      ) {
-        registrations.push(canonical(node, sourceFile))
-      }
-      if (method === 'remove') {
-        removals.push(canonical(node, sourceFile))
-      }
-    }
-    if (ts.isIdentifier(node.expression)) {
-      if (['setTimeout', 'setInterval', 'requestAnimationFrame'].includes(node.expression.text)) {
-        creations.push(canonical(node, sourceFile))
-      }
-      if (
-        ['clearTimeout', 'clearInterval', 'cancelAnimationFrame'].includes(node.expression.text)
-      ) {
-        cleanups.push(canonical(node, sourceFile))
-      }
-    }
-  }
-  visitLogicalFunction('FileReader', definitions, collect)
-  visitLogicalFunction(ROOT_COMPONENT, definitions, collect)
-  return { cleanups, creations, registrations, removals }
-}
-
-function isRuntimeNode(node: ts.Node): boolean {
-  for (let parent = node.parent; parent; parent = parent.parent) {
-    if (
-      ts.isImportDeclaration(parent) ||
-      ts.isExportDeclaration(parent) ||
-      ts.isImportTypeNode(parent) ||
-      ts.isTypeNode(parent)
-    ) {
-      return false
-    }
-  }
-  return true
-}
-
-function readRuntimeStrings(): string[] {
-  const values: string[] = []
-  for (const relativePath of SESSION_FILES) {
-    const visit = (node: ts.Node): void => {
-      if (isRuntimeNode(node)) {
-        if (
-          ts.isStringLiteral(node) ||
-          ts.isNoSubstitutionTemplateLiteral(node) ||
-          ts.isTemplateHead(node) ||
-          ts.isTemplateMiddle(node) ||
-          ts.isTemplateTail(node)
-        ) {
-          values.push(node.text)
-        }
-        if (ts.isJsxText(node) && node.text.trim()) {
-          values.push(node.text.replace(/\s+/g, ' ').trim())
-        }
-      }
-      ts.forEachChild(node, visit)
-    }
-    visit(parse(relativePath))
-  }
-  return values.sort()
-}
-
-function readJsxFacts(definitions: ReadonlyMap<string, Definition>): {
-  host: string[]
-  leaf: string[]
-  styleReferences: string[]
-} {
-  const host: string[] = []
-  const leaf: string[] = []
-  const active = new Set<string>()
-  const visitDefinition = (name: string): void => {
-    const definition = definitions.get(name)
-    if (!definition?.declaration.body || active.has(name)) {
-      throw new Error(`Invalid JSX stage: ${name}`)
-    }
-    active.add(name)
-    const visit = (node: ts.Node): void => {
-      if (
-        ts.isCallExpression(node) &&
-        ts.isIdentifier(node.expression) &&
-        LOGIC_EXPANSION_NAMES.has(node.expression.text)
-      ) {
-        visitDefinition(node.expression.text)
-        return
-      }
-      if (ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node)) {
-        const opening = ts.isJsxElement(node) ? node.openingElement : node
-        const tagName = opening.tagName.getText(definition.sourceFile)
-        if (SURFACE_EXPANSION_NAMES.has(tagName)) {
-          visitDefinition(tagName)
-          return
-        }
-        const attributes = opening.attributes.properties
-          .map((attribute) => {
-            if (ts.isJsxSpreadAttribute(attribute)) {
-              return `...${canonical(attribute.expression, definition.sourceFile)}`
-            }
-            const attributeName = attribute.name.getText(definition.sourceFile)
-            if (!attribute.initializer) {
-              return attributeName
-            }
-            if (ts.isStringLiteral(attribute.initializer)) {
-              return `${attributeName}=${JSON.stringify(attribute.initializer.text)}`
-            }
-            return `${attributeName}=${
-              attribute.initializer.expression
-                ? canonical(attribute.initializer.expression, definition.sourceFile)
-                : ''
-            }`
-          })
-          .join(',')
-        ;(HOST_COMPONENT_NAMES.has(tagName) ? host : leaf).push(`${tagName}|${attributes}`)
-        for (const attribute of opening.attributes.properties) {
-          ts.forEachChild(attribute, visit)
-        }
-        if (ts.isJsxElement(node)) {
-          for (const child of node.children) {
-            visit(child)
-          }
-        }
-        return
-      }
-      if (ts.isJsxFragment(node)) {
-        for (const child of node.children) {
-          visit(child)
-        }
-        return
-      }
-      ts.forEachChild(node, visit)
-    }
-    visit(definition.declaration.body)
-    active.delete(name)
-  }
-  for (const name of CONTENT_COMPONENT_NAMES) {
-    visitDefinition(name)
-  }
-  visitDefinition(ROOT_COMPONENT)
-  const styleReferences: string[] = []
-  for (const record of [...host, ...leaf]) {
-    for (const match of record.matchAll(/styles\.([A-Za-z0-9_]+)/g)) {
-      styleReferences.push(match[1])
-    }
-  }
-  return { host, leaf, styleReferences }
-}
-
-function readCompatibilityFacts(definitions: ReadonlyMap<string, Definition>): {
-  capabilities: string[]
-  identityFields: string[]
-  navigation: string[]
-} {
-  const capabilities: string[] = []
-  const identityFields: string[] = []
-  const navigation: string[] = []
-  visitLogicalFunction(ROOT_COMPONENT, definitions, (node, sourceFile) => {
-    if (!isRuntimeNode(node)) {
-      return
-    }
-    if (ts.isPropertyAssignment(node)) {
-      const name = node.name.getText(sourceFile)
-      if (['notifyClients', 'deviceToken', 'clientId'].includes(name)) {
-        identityFields.push(`${name}|${canonical(node.initializer, sourceFile)}`)
-      }
-      if (
-        name === 'client' &&
-        ts.isObjectLiteralExpression(node.initializer) &&
-        node.initializer.properties.some(
-          (property) => property.name?.getText(sourceFile) === 'id'
-        ) &&
-        node.initializer.properties.some(
-          (property) => property.name?.getText(sourceFile) === 'type'
-        )
-      ) {
-        identityFields.push(`client|${canonical(node.initializer, sourceFile)}`)
-      }
-    }
-    if (!ts.isCallExpression(node)) {
-      return
-    }
-    if (
-      ts.isPropertyAccessExpression(node.expression) &&
-      node.expression.expression.getText(sourceFile) === 'router' &&
-      ['push', 'replace', 'back'].includes(node.expression.name.text)
-    ) {
-      navigation.push(canonical(node, sourceFile))
-    }
-    const callName = ts.isIdentifier(node.expression)
-      ? node.expression.text
-      : ts.isPropertyAccessExpression(node.expression)
-        ? node.expression.name.text
-        : ''
-    const callText = canonical(node, sourceFile)
-    if (
-      ['startRuntimeCapabilityProbe', 'supportsMobileQuickCommands'].includes(callName) ||
-      (callName === 'includes' && callText.includes('capabilities.includes'))
-    ) {
-      capabilities.push(callText)
-    }
-  })
-  return { capabilities, identityFields, navigation }
-}
-
-describe('mobile session route extraction parity', () => {
-  it('preserves hooks, callbacks, effects, and nested action bodies', () => {
-    const definitions = readDefinitions()
-    const main = readHookFacts(ROOT_COMPONENT, definitions)
-    const contentBindings = CONTENT_COMPONENT_NAMES.flatMap(
-      (name) => readHookFacts(name, definitions).bindings
-    )
-    expect(main.hooks).toHaveLength(281)
-    expect(hash(main.hooks)).toBe(HEAD_MAIN_HOOK_SHA256)
-    expect(hash(main.bindings)).toBe(HEAD_HOOK_BINDING_SHA256)
-    expect(main.callbacks).toHaveLength(79)
-    expect(hash(main.callbacks)).toBe(HEAD_CALLBACK_IDENTITY_SHA256)
-    expect(hash(main.callbackBodies)).toBe(HEAD_CALLBACK_BODY_SHA256)
-    expect(main.effects).toHaveLength(24)
-    expect(hash(main.effects)).toBe(HEAD_EFFECT_SHA256)
-    expect(contentBindings).toHaveLength(14)
-    expect(hash(contentBindings)).toBe(HEAD_CONTENT_HOOK_SHA256)
-    const nestedFunctions = readNestedFunctions(definitions)
-    expect(nestedFunctions).toHaveLength(12)
-    expect(hash(nestedFunctions)).toBe(HEAD_NESTED_FUNCTION_SHA256)
-  })
-
-  it('preserves native listeners, timers, identity payloads, and compatibility gates', () => {
-    const definitions = readDefinitions()
-    const native = readNativeAndTimerFacts(definitions)
-    expect(native.registrations).toHaveLength(4)
-    expect(hash(native.registrations)).toBe(HEAD_NATIVE_REGISTRATION_SHA256)
-    expect(native.removals).toHaveLength(6)
-    expect(hash(native.removals)).toBe(HEAD_NATIVE_REMOVAL_SHA256)
-    expect(native.creations.filter((fact) => fact.startsWith('setTimeout'))).toHaveLength(7)
-    expect(native.creations.filter((fact) => fact.startsWith('setInterval'))).toHaveLength(1)
-    expect(
-      native.creations.filter((fact) => fact.startsWith('requestAnimationFrame'))
-    ).toHaveLength(1)
-    expect(hash(native.creations)).toBe(HEAD_TIMER_CREATION_SHA256)
-    expect(native.cleanups.filter((fact) => fact.startsWith('clearTimeout'))).toHaveLength(11)
-    expect(native.cleanups.filter((fact) => fact.startsWith('clearInterval'))).toHaveLength(1)
-    expect(native.cleanups.filter((fact) => fact.startsWith('cancelAnimationFrame'))).toHaveLength(
-      1
-    )
-    expect(hash(native.cleanups)).toBe(HEAD_TIMER_CLEANUP_SHA256)
-    const compatibility = readCompatibilityFacts(definitions)
-    expect(compatibility.identityFields).toHaveLength(14)
-    expect(hash(compatibility.identityFields)).toBe(HEAD_IDENTITY_FIELD_SHA256)
-    expect(compatibility.navigation).toHaveLength(6)
-    expect(hash(compatibility.navigation)).toBe(HEAD_NAVIGATION_SHA256)
-    expect(compatibility.capabilities).toHaveLength(6)
-    expect(hash(compatibility.capabilities)).toBe(HEAD_CAPABILITY_SHA256)
-  })
-
-  it('preserves runtime strings, styles, and the expanded JSX tree', () => {
-    const strings = readRuntimeStrings()
-    expect(strings).toHaveLength(530)
-    expect(hash(strings)).toBe(HEAD_RUNTIME_STRING_SHA256)
-    const jsx = readJsxFacts(readDefinitions())
-    expect(jsx.host).toHaveLength(124)
-    expect(hash(jsx.host)).toBe(HEAD_HOST_JSX_SHA256)
-    expect(jsx.leaf).toHaveLength(61)
-    expect(hash(jsx.leaf)).toBe(HEAD_LEAF_JSX_SHA256)
-    expect(jsx.styleReferences).toHaveLength(172)
-    expect(hash(jsx.styleReferences)).toBe(HEAD_STYLE_REFERENCE_SHA256)
-  })
-})
diff --git a/mobile/src/session/mobile-session-route-source-family.test-support.ts b/mobile/src/session/mobile-session-route-source-family.test-support.ts
deleted file mode 100644
index 23ae6fb348e..00000000000
--- a/mobile/src/session/mobile-session-route-source-family.test-support.ts
+++ /dev/null
@@ -1,69 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { fileURLToPath } from 'node:url'
-
-/**
- * The session screen as one source family, rooted at the component the route mounts.
- *
- * `MobileSessionRouteScreen.tsx` and not the route file: C7.7 made that file a flag switch, whose
- * business is which of the two screens to render and not what the session screen does. Walking it
- * would pin the switch's own params and literals into an extraction parity hash that is about the
- * screen, and the root function this family is read from is the one that calls the controller.
- */
-export const MOBILE_SESSION_ROUTE_SOURCE_FILES = [
-  './MobileSessionRouteScreen.tsx',
-  './use-mobile-session-controller.ts',
-  './use-mobile-session-foundation.ts',
-  './use-mobile-session-screen-state.ts',
-  './use-mobile-session-terminal-runtime.ts',
-  './use-mobile-session-feedback-capabilities.ts',
-  './use-mobile-session-native-chat-dictation.ts',
-  './use-mobile-session-terminal-subscription-foundation.ts',
-  './use-mobile-session-terminal-subscription.ts',
-  './use-mobile-session-terminal-stream-display.ts',
-  './use-mobile-session-terminal-list.ts',
-  './use-mobile-session-tab-application.ts',
-  './use-mobile-session-document-readers.ts',
-  './use-mobile-session-diff-comments.ts',
-  './use-mobile-session-markdown-actions.ts',
-  './use-mobile-session-tab-reconciliation.ts',
-  './use-mobile-session-lifecycle.ts',
-  './use-mobile-session-keyboard-state.ts',
-  './use-mobile-session-startup.ts',
-  './use-mobile-session-preference-focus.ts',
-  './use-mobile-session-tab-switching.ts',
-  './use-mobile-session-terminal-webview.ts',
-  './use-mobile-session-terminal-send-actions.ts',
-  './use-mobile-session-file-actions.ts',
-  './use-mobile-session-terminal-input.ts',
-  './use-mobile-session-accessory-selection.ts',
-  './use-mobile-session-attachments.ts',
-  './use-mobile-session-terminal-create-actions.ts',
-  './use-mobile-session-content-create-actions.ts',
-  './use-mobile-session-close-actions.ts',
-  './use-mobile-session-bulk-close.ts',
-  './use-mobile-session-presentation.ts',
-  './use-mobile-session-panel-route-actions.tsx',
-  './MobileSessionMarkdownReader.tsx',
-  './MobileSessionDiffLineRow.tsx',
-  './MobileSessionFileReader.tsx',
-  './MobileSessionSurface.tsx',
-  './MobileSessionHeader.tsx',
-  './MobileSessionContentRow.tsx',
-  './MobileSessionActiveContent.tsx',
-  './MobileSessionCommandDock.tsx',
-  './MobileSessionSheets.tsx'
-] as const
-
-export function readMobileSessionRouteSource(relativePath: string): string {
-  return readFileSync(fileURLToPath(new URL(relativePath, import.meta.url)), 'utf8')
-}
-
-export function readMobileSessionRouteSourceFamily(
-  relativePaths: readonly string[] = MOBILE_SESSION_ROUTE_SOURCE_FILES
-): string {
-  return relativePaths
-    .map(
-      (relativePath) => `// Source: ${relativePath}\n${readMobileSessionRouteSource(relativePath)}`
-    )
-    .join('\n')
-}
diff --git a/mobile/src/session/mobile-session-route-types.ts b/mobile/src/session/mobile-session-route-types.ts
index a584049360a..b28583bd037 100644
--- a/mobile/src/session/mobile-session-route-types.ts
+++ b/mobile/src/session/mobile-session-route-types.ts
@@ -91,6 +91,8 @@ export type MarkdownDocState =
       saving?: boolean
       saveError?: string
       readOnlyReason?: string
+      truncated?: true
+      byteLength?: number
     }
   | { status: 'error'; message: string }
 
diff --git a/mobile/src/session/mobile-session-route.test.ts b/mobile/src/session/mobile-session-route.test.ts
index 33872e0271f..4cd040a061a 100644
--- a/mobile/src/session/mobile-session-route.test.ts
+++ b/mobile/src/session/mobile-session-route.test.ts
@@ -1,4 +1,3 @@
-import { readFileSync } from 'node:fs'
 import { describe, expect, it, vi } from 'vitest'
 import { mobileSessionRouteTarget } from './mobile-session-route'
 import {
@@ -7,8 +6,6 @@ import {
   type HostStackNavigationState
 } from '../navigation/host-stack-navigation'
 
-const homeSource = readFileSync(new URL('../home/MobileHomeScreen.tsx', import.meta.url), 'utf8')
-
 function navigationHarness(initialState: HostStackNavigationState) {
   const stateListeners = new Set<() => void>()
   let state = initialState
@@ -95,20 +92,4 @@ describe('mobile session route', () => {
       payload: target
     })
   })
-
-  it('routes the home Resume card through the cold-navigator-safe transition', () => {
-    expect(homeSource).toContain('onOpenResume={openResume}')
-
-    // The tap handler itself must go through the coordinated transition; its only
-    // direct push is the shallow noticed host-index route for a proven-missing target.
-    const handlerStart = homeSource.indexOf('const openResume = useCallback(')
-    const handlerEnd = homeSource.indexOf('[data.router, openMobileSession]', handlerStart)
-    expect(handlerStart).toBeGreaterThanOrEqual(0)
-    expect(handlerEnd).toBeGreaterThan(handlerStart)
-
-    const openResume = homeSource.slice(handlerStart, handlerEnd)
-    expect(openResume).toContain('openMobileSession({')
-    expect(openResume.match(/router\.push\(/g)).toHaveLength(1)
-    expect(openResume).toContain('data.router.push(hostRouteWithNotice(')
-  })
 })
diff --git a/mobile/src/session/mobile-session-startup-source.test.ts b/mobile/src/session/mobile-session-startup-source.test.ts
deleted file mode 100644
index b457164beed..00000000000
--- a/mobile/src/session/mobile-session-startup-source.test.ts
+++ /dev/null
@@ -1,295 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import {
-  readMobileSessionRouteSource,
-  readMobileSessionRouteSourceFamily
-} from './mobile-session-route-source-family.test-support'
-
-const source = readMobileSessionRouteSourceFamily()
-const startupSource = readMobileSessionRouteSource('./use-mobile-session-startup.ts')
-const tabReconciliationSource = readMobileSessionRouteSource(
-  './use-mobile-session-tab-reconciliation.ts'
-)
-const bulkCloseSource = readMobileSessionRouteSource('./use-mobile-session-bulk-close.ts')
-const presentationSource = readMobileSessionRouteSource('./use-mobile-session-presentation.ts')
-const tabSwitchingSource = readMobileSessionRouteSource('./use-mobile-session-tab-switching.ts')
-const sheetsSource = readMobileSessionRouteSource('./MobileSessionSheets.tsx')
-const reconciliationHookSource = readMobileSessionRouteSource(
-  './use-mobile-session-tabs-reconciliation.ts'
-)
-const terminalInventoryRecoverySource = readMobileSessionRouteSource(
-  './use-mobile-terminal-inventory-recovery.ts'
-)
-const terminalSubscriptionSource = readMobileSessionRouteSource(
-  './use-mobile-session-terminal-subscription.ts'
-)
-const terminalListSource = readMobileSessionRouteSource('./use-mobile-session-terminal-list.ts')
-const tabReconciliationOwnerSource = readMobileSessionRouteSource(
-  './use-mobile-session-tab-reconciliation.ts'
-)
-const autoCreateHookSource = readMobileSessionRouteSource(
-  './use-initial-session-terminal-autocreate.ts'
-)
-const foundationSource = readMobileSessionRouteSource('./use-mobile-session-foundation.ts')
-const terminalRuntimeSource = readMobileSessionRouteSource(
-  './use-mobile-session-terminal-runtime.ts'
-)
-const terminalSubscriptionSourceForIdentity = readMobileSessionRouteSource(
-  './use-mobile-session-terminal-subscription.ts'
-)
-const lifecycleSource = readMobileSessionRouteSource('./use-mobile-session-lifecycle.ts')
-
-function sliceBetween(startPattern: string, endPattern: string, targetSource = source): string {
-  const start = targetSource.indexOf(startPattern)
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = targetSource.indexOf(endPattern, start)
-  expect(end).toBeGreaterThan(start)
-  return targetSource.slice(start, end)
-}
-
-describe('mobile session startup', () => {
-  it('auto-creates one terminal for a newly created empty session', () => {
-    expect(source).toContain('useWorktreeSessionTabsLoaded(worktreeId)')
-    expect(source).toContain(
-      'initialSessionAutoCreateRef.current = createInitialSessionAutoCreateState()'
-    )
-
-    const autoCreateCall = sliceBetween(
-      'useInitialSessionTerminalAutoCreate({',
-      'const connectionVerdict =',
-      presentationSource
-    )
-    expect(autoCreateCall).toContain('stateRef: initialSessionAutoCreateRef')
-    expect(autoCreateCall).toContain(
-      'consumeCreationRoute: () => router.setParams({ created: undefined })'
-    )
-    expect(autoCreateCall).toContain("newlyCreatedWorkspace: created === '1'")
-    expect(autoCreateCall).toContain('visibleTabCount: visibleTabs.length')
-    expect(autoCreateCall).toContain('createTerminal: () => void handleCreateTerminal()')
-
-    expect(autoCreateHookSource).toContain('shouldAutoCreateInitialSessionTerminal({')
-    expect(autoCreateHookSource).toContain('stateRef.current.autoCreatedForWorktree === worktreeId')
-    expect(autoCreateHookSource).toContain('stateRef.current.autoCreatedForWorktree = worktreeId')
-    expect(autoCreateHookSource).toContain("connState === 'connected'")
-    expect(autoCreateHookSource).toContain('(visibleTabCount > 0 || activeHandle !== null)')
-    // Why: both callbacks are re-created every render, so the effect must reach them
-    // through useEffectEvent rather than deps or a render-time ref write.
-    expect(autoCreateHookSource).toContain('useEffectEvent(args.consumeCreationRoute)')
-    expect(autoCreateHookSource).toContain('useEffectEvent(args.createTerminal)')
-    expect(autoCreateHookSource).toContain('consumeCreationRoute()')
-    expect(autoCreateHookSource).toContain('createTerminal()')
-  })
-
-  it('arms the auto-create only until the route has published a tab (#9717)', () => {
-    // Emptiness after a populated list is a close, not a cold hydrate.
-    expect(source).toContain(
-      'initialSessionAutoCreateRef.current.sawSessionTabs ||= nextTabs.length > 0'
-    )
-
-    const autoCreateCall = sliceBetween(
-      'useInitialSessionTerminalAutoCreate({',
-      'const connectionVerdict =',
-      presentationSource
-    )
-    expect(autoCreateCall).toContain('stateRef: initialSessionAutoCreateRef')
-    expect(autoCreateHookSource).toContain('sawSessionTabs: stateRef.current.sawSessionTabs')
-  })
-
-  it('delegates stream ownership while retaining degraded polling and a certified sweep', () => {
-    expect(source).toContain('useMobileSessionTabsReconciliation<')
-    expect(source).toContain('const applicationRevision = ++appliedSessionTabsRevisionRef.current')
-    expect(source).toContain('getApplicationRevision: getSessionTabsApplicationRevision')
-    expect(source).not.toContain("client.subscribe(\n      'session.tabs.subscribe'")
-    expect(reconciliationHookSource).toContain("client.subscribe(\n      'session.tabs.subscribe'")
-    expect(reconciliationHookSource).toContain("if (AppState.currentState !== 'active')")
-    expect(reconciliationHookSource).toContain('suspendTerminalInventoryRecovery(true)')
-    expect(reconciliationHookSource).toContain('controller.poll()')
-    expect(reconciliationHookSource).toContain('tabsRequest !== null')
-    expect(reconciliationHookSource).toContain('void refreshTerminalInventory()')
-    expect(reconciliationHookSource).toContain("AppState.addEventListener('change'")
-    expect(reconciliationHookSource).toContain('const interval = setInterval(')
-    expect(reconciliationHookSource).toContain('RECONCILIATION_INTERVAL_MS = 2000')
-    expect(terminalInventoryRecoverySource).toContain('CERTIFIED_TERMINAL_SWEEP_MS = 60_000')
-    expect(reconciliationHookSource).toContain('controller.setReconciliationActive(false)')
-    expect(reconciliationHookSource).toContain('clearInterval(interval)')
-    expect(reconciliationHookSource).toContain('appStateSubscription.remove()')
-  })
-
-  it('binds terminal identity to the shared client before subscription effects run', () => {
-    expect(foundationSource).toContain('const { client, clientId, state: connState }')
-    expect(foundationSource).toContain('    clientId,')
-    expect(terminalRuntimeSource).toContain('useRef<string | null>(clientId)')
-    expect(terminalRuntimeSource).toContain('deviceTokenRef.current = clientId')
-    expect(terminalRuntimeSource).toContain('inputGate.canSend && clientId !== null')
-    expect(terminalSubscriptionSourceForIdentity).toContain('if (clientId === null)')
-    expect(terminalSubscriptionSourceForIdentity).toContain(
-      "client: { id: clientId, type: 'mobile' as const }"
-    )
-    expect(lifecycleSource).not.toContain('deviceTokenRef.current = host.deviceToken')
-  })
-
-  it('confirms terminal stream teardown with a committed inventory-recovery bridge', () => {
-    expect(terminalSubscriptionSource).toContain(
-      "if (data.type === 'end' || data.type === 'error')"
-    )
-    expect(terminalSubscriptionSource).toContain('signalTerminalInventoryRecovery()')
-    expect(terminalInventoryRecoverySource).toContain('actionRef.current = recoveryAction')
-    expect(terminalInventoryRecoverySource).toContain('pendingSignalScopeRef.current = scopeKey')
-    expect(terminalInventoryRecoverySource).toContain(
-      'committedScope !== null && committedScope !== scopeKey'
-    )
-    expect(terminalListSource).toContain('return terminalInventoryRequest.activate()')
-    expect(terminalListSource).toContain('if (!isCurrent() || !response.accepted)')
-    expect(terminalInventoryRecoverySource).toContain(
-      'TERMINAL_INVENTORY_CONFIRMATION_DELAY_MS = 750'
-    )
-    expect(terminalInventoryRecoverySource).toContain(
-      'refreshTerminalInventory({ allowEmptyLoaded: true })'
-    )
-  })
-
-  it('loads session tabs without waiting for desktop activation', () => {
-    const startupEffect = sliceBetween(
-      'void (async () => {',
-      'return () => {\n      disposed = true',
-      startupSource
-    )
-
-    // Both sends migrated to the typed `worktreeActivate` operation in step 6; what these pin is
-    // unchanged — the plain activation is fired and not awaited, and it goes out before the tab load.
-    expect(startupEffect).toContain('void worktreeActivate\n          .request(client, {')
-    expect(startupEffect).toContain("if (client && created !== '1' && !isFloatingWorkspaceRoute)")
-    expect(startupEffect).toContain("if (client && created === '1' && !isFloatingWorkspaceRoute)")
-    expect(startupEffect).toContain('notifyClients: false')
-    expect(startupEffect).toContain("navigation: 'caller'")
-    expect(startupEffect).not.toContain('await worktreeActivate\n          .request(client, {')
-    expect(startupEffect.indexOf('worktreeActivate\n          .request(client, {')).toBeLessThan(
-      startupEffect.indexOf('await ensureSessionTabs()')
-    )
-    expect(startupEffect).toContain('headlessActivationNeedsHostRenderer(activation.value)')
-    expect(startupEffect).toContain("showToast('Open Orca on the host to wake sleeping agents.'")
-  })
-
-  it('fails runtime capability gates closed before probing a replacement client', () => {
-    const capabilityEffect = sliceBetween(
-      'const hostQueryReplyInputSupportedRef = useRef(false)',
-      'return {\n    consumeAcceptedSessionTabs',
-      tabReconciliationSource
-    )
-    const probeStart = capabilityEffect.indexOf('startRuntimeCapabilityProbe(client,')
-
-    expect(probeStart).toBeGreaterThanOrEqual(0)
-    for (const reset of [
-      'setBrowserScreencastSupported(null)',
-      'setAgentSessionHistorySupported(null)',
-      'setQuickCommandsSupported(null)',
-      'setShowQuickCommands(false)',
-      'hostQueryReplyInputSupportedRef.current = false'
-    ]) {
-      const resetIndex = capabilityEffect.lastIndexOf(reset)
-      expect(resetIndex).toBeGreaterThanOrEqual(0)
-      expect(resetIndex).toBeLessThan(probeStart)
-    }
-  })
-
-  it('activates an already-selected pending terminal tab after hydration', () => {
-    expect(source).toContain(
-      'const pendingTerminalActivationAttemptRef = useRef<string | null>(null)'
-    )
-    expect(source).toContain('pendingTerminalActivationAttemptRef.current = null')
-
-    const pendingActivationEffect = sliceBetween(
-      "if (!client || connState !== 'connected' || !activePendingTerminalTab) {",
-      'return {\n    bulkCloseActions',
-      bulkCloseSource
-    )
-    expect(pendingActivationEffect).toContain(
-      'pendingTerminalActivationAttemptRef.current === activationKey'
-    )
-    expect(pendingActivationEffect).toContain('activateMobileSessionTab(client,')
-    expect(pendingActivationEffect).toContain('tabId: activePendingTerminalTab.id')
-    expect(pendingActivationEffect).toContain('leafId: activePendingTerminalTab.leafId')
-    expect(pendingActivationEffect).toContain('notifyClients: false')
-    expect(pendingActivationEffect).toContain("navigation: 'caller'")
-    expect(pendingActivationEffect).toContain(
-      'applySessionTabs((response as RpcSuccess).result as SessionTabsResult)'
-    )
-    expect(pendingActivationEffect).toContain('scheduleDelayedAction(() => void fetchSessionTabs()')
-  })
-
-  it('keeps ready terminal taps local while publishing caller selection', () => {
-    const readyTerminalSwitch = sliceBetween(
-      'const switchTab = useCallback(',
-      'const switchSessionTab = useCallback(',
-      tabSwitchingSource
-    )
-
-    expect(readyTerminalSwitch).not.toContain('focusMobileTerminal(client, handle)')
-    expect(readyTerminalSwitch).toContain('activateMobileSessionTab(client,')
-    expect(readyTerminalSwitch).toContain('notifyClients: false')
-    expect(readyTerminalSwitch).toContain("navigation: 'caller'")
-  })
-
-  it('keeps background and pending session-tab activation local to the phone', () => {
-    const activationRequests = source.split('activateMobileSessionTab(client,').slice(1)
-
-    expect(activationRequests).toHaveLength(4)
-    for (const request of activationRequests) {
-      expect(request.slice(0, request.indexOf('})'))).toContain('notifyClients: false')
-      expect(request.slice(0, request.indexOf('})'))).toContain("navigation: 'caller'")
-    }
-  })
-
-  it('keeps dynamic agent rows above fixed New Tab actions', () => {
-    const newTabActions = sliceBetween(
-      'title="New Tab"',
-      'onClose={() => setShowCreateTabDrawer',
-      sheetsSource
-    )
-
-    expect(newTabActions.indexOf('...createTabAgentActions')).toBeLessThan(
-      newTabActions.indexOf("label: 'Terminal'")
-    )
-    expect(newTabActions.indexOf("label: 'Terminal'")).toBeLessThan(
-      newTabActions.indexOf("label: 'Browser'")
-    )
-    expect(newTabActions.indexOf("label: 'Browser'")).toBeLessThan(
-      newTabActions.indexOf("label: 'Markdown Note'")
-    )
-  })
-
-  it('wires pending-handle recovery through its bounded context (STA-4256)', () => {
-    const applySessionTabs = sliceBetween(
-      'const applySessionTabs = useCallback(',
-      'const consumeAcceptedSessionTabs = useCallback('
-    )
-    const recoveryContext = sliceBetween(
-      'const pendingTerminalRecoveryContextCache = useMemo(',
-      'const sessionTabsFetchReporting',
-      tabReconciliationOwnerSource
-    )
-
-    const tabsRefWrite = 'sessionTabsRef.current = nextTabs'
-    const tabsStateWrite = 'setSessionTabs((prev)'
-    const activeRefWrite = 'activeSessionTabIdRef.current = active?.id ?? null'
-    const activeStateWrite = 'setActiveSessionTabId(active?.id ?? null)'
-    for (const write of [tabsRefWrite, tabsStateWrite, activeRefWrite, activeStateWrite]) {
-      expect(applySessionTabs).toContain(write)
-    }
-    expect(applySessionTabs.indexOf(tabsRefWrite)).toBeLessThan(
-      applySessionTabs.indexOf(tabsStateWrite)
-    )
-    expect(applySessionTabs.indexOf(activeRefWrite)).toBeLessThan(
-      applySessionTabs.indexOf(activeStateWrite)
-    )
-    expect(recoveryContext).toContain('() => new PendingTerminalHandleRecoveryContextCache()')
-    expect(recoveryContext).toContain('sessionTabsRef.current,')
-    expect(recoveryContext).toContain('activeSessionTabIdRef.current')
-    expect(recoveryContext).toContain(
-      'const pendingTerminalRecoveryContextKey = getPendingTerminalRecoveryContextKey()'
-    )
-    expect(source).toContain('hasRecoveryNeed: hasSessionTabsRecoveryNeed')
-    expect(source).toContain('getPendingTerminalRecoveryContextKey,')
-    expect(source).toContain('onPendingTerminalRecoveryParked: setParkedPendingTerminalContext')
-    expect(source).toContain('retryPendingTerminalRecovery()')
-  })
-})
diff --git a/mobile/src/session/mobile-session-terminal-frame-layout.test.tsx b/mobile/src/session/mobile-session-terminal-frame-layout.test.tsx
index 857a6ac561a..1cec63717c7 100644
--- a/mobile/src/session/mobile-session-terminal-frame-layout.test.tsx
+++ b/mobile/src/session/mobile-session-terminal-frame-layout.test.tsx
@@ -45,17 +45,20 @@ import { MobileSessionActiveContent } from './MobileSessionActiveContent'
 
 type Controller = Parameters<typeof MobileSessionActiveContent>[0]['controller']
 
+type Branch = 'loading' | 'pending' | 'terminal'
+
 function controller(
-  showLoadingState: boolean,
-  notifyTerminalFrameHeight: (height: number) => void
+  branch: Branch | boolean,
+  notifyTerminalFrame: (frame: { width: number; height: number }) => void
 ): Controller {
+  const shown = branch === true ? 'loading' : branch === false ? 'terminal' : branch
   const scope = {
-    showLoadingState,
+    showLoadingState: shown === 'loading',
+    activePendingTerminalTab: shown === 'pending' ? { title: 'Loading terminal' } : null,
+    isPendingTerminalRecoveryParked: false,
     showEmptyState: false,
     terminals: [],
-    terminalFrameHeightRef: { current: 0 },
-    setTerminalFrameWidth: () => {},
-    notifyTerminalFrameHeight,
+    notifyTerminalFrame,
     dictation: { isRecording: false },
     nativeChatSendError: { message: null, clear: () => {} }
   }
@@ -66,8 +69,8 @@ function controller(
 describe('the terminal frame on the page', () => {
   it('reports its height when the session opens from the loading state', () => {
     const heights: number[] = []
-    const notify = (height: number): void => {
-      heights.push(height)
+    const notify = (frame: { height: number }): void => {
+      heights.push(frame.height)
     }
     let renderer: ReturnType<typeof create> | undefined
     act(() => {
@@ -82,4 +85,30 @@ describe('the terminal frame on the page', () => {
     })
     expect(heights).toEqual([FRAME.height])
   })
+
+  it('stays one mounted frame across loading, a pending terminal and the terminal', () => {
+    // A frame that remounts per branch reports again on every return; one that stays reports once.
+    const heights: number[] = []
+    const notify = (frame: { height: number }): void => {
+      heights.push(frame.height)
+    }
+    let renderer: ReturnType<typeof create> | undefined
+    const show = (branch: Branch) => {
+      const element = createElement(MobileSessionActiveContent, {
+        controller: controller(branch, notify)
+      })
+      act(() => {
+        if (renderer) {
+          renderer.update(element)
+        } else {
+          renderer = create(element)
+        }
+      })
+    }
+    show('loading')
+    show('terminal')
+    show('pending')
+    show('terminal')
+    expect(heights).toEqual([FRAME.height])
+  })
 })
diff --git a/mobile/src/session/mobile-source-control-launch-agent.ts b/mobile/src/session/mobile-source-control-launch-agent.ts
new file mode 100644
index 00000000000..e017c48410c
--- /dev/null
+++ b/mobile/src/session/mobile-source-control-launch-agent.ts
@@ -0,0 +1,89 @@
+/**
+ * Which agent a source-control AI button starts from the phone: the desktop's own resolution
+ * (`pickSourceControlLaunchAgent`), fed the same saved recipe, default agent and detected agents.
+ */
+
+import type { GlobalSettings } from '../../../src/shared/global-settings-types'
+import type { Repo } from '../../../src/shared/repo-types'
+import type {
+  SourceControlActionRecipe,
+  SourceControlLaunchActionId
+} from '../../../src/shared/source-control-ai-actions'
+import { resolveSourceControlActionRecipe } from '../../../src/shared/source-control-ai'
+import {
+  pickSourceControlLaunchAgent,
+  readSourceControlLaunchRecipeAgentId
+} from '../../../src/shared/source-control-launch-agent-selection'
+import { filterEnabledTuiAgents } from '../../../src/shared/tui-agent-selection'
+import type { TuiAgent } from '../../../src/shared/tui-agent'
+import { isMobileTuiAgent } from '../tasks/mobile-tui-agents'
+import type { MobileAgentLaunchContext } from './mobile-new-tab-agent-loader'
+
+export type MobileSourceControlLaunchAgent =
+  /** `recipe`: the action's saved recipe, for its prompt template; null with no action. */
+  | { kind: 'agent'; agent: TuiAgent; recipe: SourceControlActionRecipe | null }
+  | { kind: 'unavailable'; message: string }
+
+type LaunchAgentSettings = Pick<
+  GlobalSettings,
+  'sourceControlAi' | 'commitMessageAi' | 'defaultTuiAgent' | 'disabledTuiAgents'
+>
+
+export function resolveMobileSourceControlLaunchAgent(
+  context: MobileAgentLaunchContext,
+  // Null for a launch with no saved recipe, such as sending review notes.
+  actionId: SourceControlLaunchActionId | null
+): MobileSourceControlLaunchAgent {
+  const settings = readLaunchAgentSettings(context.settings)
+  const detectedAgents = context.detectedAgents.filter(isMobileTuiAgent)
+  const recipe = actionId ? readSavedRecipe(settings, context.repo, actionId) : null
+  const savedAgent = readSourceControlLaunchRecipeAgentId(recipe)
+  // Why: the phone has no pre-launch dialog showing the pick, so a saved agent that can't run here
+  // is an error, as on the desktop's direct launch, rather than a silent swap to another agent.
+  if (
+    savedAgent &&
+    !filterEnabledTuiAgents(detectedAgents, settings?.disabledTuiAgents).includes(savedAgent)
+  ) {
+    return {
+      kind: 'unavailable',
+      message: 'The saved agent for this action is not available on this workspace host.'
+    }
+  }
+  const agent = pickSourceControlLaunchAgent({
+    savedAgent,
+    defaultAgent: settings?.defaultTuiAgent,
+    detectedAgents,
+    disabledAgents: settings?.disabledTuiAgents
+  })
+  return agent
+    ? { kind: 'agent', agent, recipe }
+    : { kind: 'unavailable', message: 'No enabled AI agent was detected on this workspace host.' }
+}
+
+function readLaunchAgentSettings(settings: unknown): LaunchAgentSettings | null {
+  if (!settings || typeof settings !== 'object') {
+    return null
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: settings.get answers with the host's GlobalSettings, and every member read here goes through a normalizer or an enabled-agent filter.
+  return settings as LaunchAgentSettings
+}
+
+function readSavedRecipe(
+  settings: LaunchAgentSettings | null,
+  repo: unknown,
+  actionId: SourceControlLaunchActionId
+): SourceControlActionRecipe | null {
+  try {
+    return resolveSourceControlActionRecipe({ settings, repo: readRepoOverrides(repo), actionId })
+  } catch {
+    // A recipe the phone cannot read must not block the button; the default agent still applies.
+    return null
+  }
+}
+
+function readRepoOverrides(repo: unknown): Pick<Repo, 'sourceControlAi'> | null {
+  return repo && typeof repo === 'object' && 'sourceControlAi' in repo
+    ? // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the recipe resolver normalizes this member from unknown (normalizeRepoSourceControlAiOverrides).
+      { sourceControlAi: repo.sourceControlAi as Repo['sourceControlAi'] }
+    : null
+}
diff --git a/mobile/src/session/mobile-structured-agent-prompts.ts b/mobile/src/session/mobile-structured-agent-prompts.ts
index d11a2fc0317..649fc06b774 100644
--- a/mobile/src/session/mobile-structured-agent-prompts.ts
+++ b/mobile/src/session/mobile-structured-agent-prompts.ts
@@ -1,4 +1,8 @@
 import type { AgentJournalRenderItem } from '../../../src/shared/agent-session-journal-types'
+import {
+  agentSessionPromptQuestions,
+  type AgentSessionQuestionAnswer
+} from '../../../src/shared/agent-session-question-answer'
 import type { MobileChatPermission } from './mobile-native-chat-permission'
 import type { MobileChatQuestion } from './mobile-native-chat-question'
 import {
@@ -21,6 +25,12 @@ export type StructuredPromptResponseTarget = {
   optionId: string
 }
 
+export type StructuredQuestionResponseTarget = {
+  itemId: string
+  expectedRevision: number
+  answer: AgentSessionQuestionAnswer
+}
+
 type PromptTokenPayload =
   | {
       kind: 'approval'
@@ -32,6 +42,7 @@ type PromptTokenPayload =
       kind: 'question-option'
       itemId: string
       revision: number
+      questionId: string
       optionId: string
     }
   | {
@@ -55,10 +66,6 @@ export function pendingStructuredQuestion(
   return item.body.kind === 'question' && item.body.resolution.state === 'pending'
 }
 
-function encodeQuestionAnswer(questionId: string, answer: string): string {
-  return `${encodeURIComponent(questionId)}:${encodeURIComponent(answer)}`
-}
-
 function encodePromptToken(payload: PromptTokenPayload): string {
   return `${STRUCTURED_PROMPT_TOKEN_PREFIX}${encodeURIComponent(JSON.stringify(payload))}`
 }
@@ -86,11 +93,16 @@ function decodePromptToken(value: string): PromptTokenPayload | null {
         optionId: decoded.optionId
       }
     }
-    if (decoded.kind === 'question-option' && typeof decoded.optionId === 'string') {
+    if (
+      decoded.kind === 'question-option' &&
+      typeof decoded.questionId === 'string' &&
+      typeof decoded.optionId === 'string'
+    ) {
       return {
         kind: decoded.kind,
         itemId: decoded.itemId,
         revision: decoded.revision,
+        questionId: decoded.questionId,
         optionId: decoded.optionId
       }
     }
@@ -169,6 +181,10 @@ export function projectStructuredQuestion(
       { itemId: prompt.itemId, expectedRevision: prompt.revision }
     )
   }
+  const [question] = agentSessionPromptQuestions(prompt.body)
+  if (!question) {
+    return null
+  }
   const optionDescriptions = prompt.body.options.map((option) => option.description)
   return {
     question: prompt.body.question,
@@ -182,6 +198,7 @@ export function projectStructuredQuestion(
         kind: 'question-option',
         itemId: prompt.itemId,
         revision: prompt.revision,
+        questionId: question.id,
         optionId: option.id
       })
     ),
@@ -228,13 +245,13 @@ export function structuredApprovalResponseTarget(
 export function structuredQuestionResponseTarget(
   response: string,
   currentPrompt: StructuredQuestionItem | null
-): StructuredPromptResponseTarget | null {
+): StructuredQuestionResponseTarget | null {
   const token = decodePromptToken(response)
   if (token?.kind === 'question-option') {
     return {
       itemId: token.itemId,
       expectedRevision: token.revision,
-      optionId: token.optionId
+      answer: { questionId: token.questionId, optionIds: [token.optionId] }
     }
   }
   if (token) {
@@ -247,29 +264,30 @@ export function structuredQuestionResponseTarget(
       ? {
           itemId: freeText.payload.itemId,
           expectedRevision: freeText.payload.revision,
-          optionId: encodeQuestionAnswer(freeText.payload.questionId, answer)
+          answer: { questionId: freeText.payload.questionId, optionIds: [], other: answer }
         }
       : null
   }
   if (!currentPrompt) {
     return null
   }
+  const [question] = agentSessionPromptQuestions(currentPrompt.body)
   const trimmed = response.trim()
   const option = currentPrompt.body.options.find(
     (candidate) => candidate.id === response || candidate.label === trimmed
   )
-  if (option) {
+  if (question && option) {
     return {
       itemId: currentPrompt.itemId,
       expectedRevision: currentPrompt.revision,
-      optionId: option.id
+      answer: { questionId: question.id, optionIds: [option.id] }
     }
   }
-  return currentPrompt.body.freeTextQuestionId && trimmed
+  return question && currentPrompt.body.freeTextQuestionId && trimmed
     ? {
         itemId: currentPrompt.itemId,
         expectedRevision: currentPrompt.revision,
-        optionId: encodeQuestionAnswer(currentPrompt.body.freeTextQuestionId, trimmed)
+        answer: { questionId: question.id, optionIds: [], other: trimmed }
       }
     : null
 }
diff --git a/mobile/src/session/mobile-structured-agent-session-cancel.ts b/mobile/src/session/mobile-structured-agent-session-cancel.ts
index f144accc2e7..4666cad4817 100644
--- a/mobile/src/session/mobile-structured-agent-session-cancel.ts
+++ b/mobile/src/session/mobile-structured-agent-session-cancel.ts
@@ -75,7 +75,7 @@ export async function requestMobileStructuredAgentSessionCancel(args: {
   } else if (result.status === 'refused') {
     onSendError(result.message)
   } else if (result.status === 'failed') {
-    onSendError(result.message === 'Request not sent' ? 'Stop not sent' : result.message)
+    onSendError(result.message)
   }
   return false
 }
diff --git a/mobile/src/session/mobile-structured-agent-session-host-support.test.ts b/mobile/src/session/mobile-structured-agent-session-host-support.test.ts
new file mode 100644
index 00000000000..6857855c9b4
--- /dev/null
+++ b/mobile/src/session/mobile-structured-agent-session-host-support.test.ts
@@ -0,0 +1,21 @@
+import { describe, expect, it } from 'vitest'
+import {
+  AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY,
+  AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY
+} from '../../../src/shared/protocol-version'
+import { structuredAgentSessionHostSupport } from './mobile-structured-agent-session-host-support'
+
+describe('structuredAgentSessionHostSupport', () => {
+  it('reads each structured-session feature from the host capability list', () => {
+    expect(structuredAgentSessionHostSupport([])).toEqual({
+      promptCancel: false,
+      questionAnswers: false
+    })
+    expect(
+      structuredAgentSessionHostSupport([AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY])
+    ).toEqual({ promptCancel: false, questionAnswers: true })
+    expect(
+      structuredAgentSessionHostSupport([AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY])
+    ).toEqual({ promptCancel: true, questionAnswers: false })
+  })
+})
diff --git a/mobile/src/session/mobile-structured-agent-session-host-support.ts b/mobile/src/session/mobile-structured-agent-session-host-support.ts
new file mode 100644
index 00000000000..939f7d559f4
--- /dev/null
+++ b/mobile/src/session/mobile-structured-agent-session-host-support.ts
@@ -0,0 +1,19 @@
+import {
+  AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY,
+  AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY
+} from '../../../src/shared/protocol-version'
+
+/** Structured-session features the connected host advertised; null until the status probe answers. */
+export type StructuredAgentSessionHostSupport = {
+  promptCancel: boolean
+  questionAnswers: boolean
+}
+
+export function structuredAgentSessionHostSupport(
+  capabilities: readonly string[]
+): StructuredAgentSessionHostSupport {
+  return {
+    promptCancel: capabilities.includes(AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY),
+    questionAnswers: capabilities.includes(AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY)
+  }
+}
diff --git a/mobile/src/session/mobile-structured-agent-session-rpc.ts b/mobile/src/session/mobile-structured-agent-session-rpc.ts
index 27c50d85104..bca14e293f7 100644
--- a/mobile/src/session/mobile-structured-agent-session-rpc.ts
+++ b/mobile/src/session/mobile-structured-agent-session-rpc.ts
@@ -8,6 +8,17 @@ import type {
   AgentSessionWireRefusalCode
 } from '../../../src/shared/agent-session-wire'
 import { structuredAgentSessionPayloadFingerprint } from '../../../src/shared/structured-agent-session-mutation'
+import {
+  agentSessionRefusalNotice,
+  agentSessionWriteFailureNotice,
+  agentSessionWriteNoticeEnglish,
+  agentSessionWriteNoticeParts
+} from '../../../src/shared/agent-session-refusal-notice'
+import {
+  agentSessionRpcErrorFailure,
+  agentSessionWriteKindForMethod,
+  type AgentSessionWriteKind
+} from '../../../src/shared/agent-session-write-failure'
 import { structuredSessionOperationId } from './structured-session-operation-id'
 import { isRpcDeliveryUnknown } from '../transport/rpc-delivery-ambiguity'
 import type { RpcClient } from '../transport/rpc-client'
@@ -46,13 +57,6 @@ class AgentSessionRpcResponseError extends Error {
   }
 }
 
-const PRE_HANDLER_RPC_REFUSALS = new Set([
-  'invalid_argument',
-  'method_not_found',
-  'method_not_supported',
-  'unauthorized'
-])
-
 export async function callAgentSession<TResult>(
   client: RpcClient,
   method: string,
@@ -115,6 +119,15 @@ export function timeoutForDeadline(deadline: number | undefined): number | null
   return timeoutMs >= MOBILE_NATIVE_CHAT_MIN_WRITE_TIMEOUT_MS ? timeoutMs : null
 }
 
+/** A refused phone send goes back into the composer; there is no Retry control. */
+function phoneWriteKind(
+  fingerprintMethod: string,
+  fields: Record<string, unknown>
+): AgentSessionWriteKind {
+  const write = agentSessionWriteKindForMethod(fingerprintMethod, fields)
+  return write === 'send' ? 'composer-send' : write
+}
+
 export async function requestStructuredAgentSessionMutation<TValue>(args: {
   client: RpcClient
   method: string
@@ -163,10 +176,25 @@ export async function requestStructuredAgentSessionMutation<TValue>(args: {
     }
     return result.ok
       ? { status: 'accepted', value: result.value }
-      : { status: 'refused', code: result.refusal.code, message: result.refusal.message }
+      : {
+          status: 'refused',
+          code: result.refusal.code,
+          message: agentSessionRefusalNotice(
+            result.refusal,
+            phoneWriteKind(fingerprintMethod, fields)
+          )
+        }
   } catch (error) {
-    if (error instanceof AgentSessionRpcResponseError && PRE_HANDLER_RPC_REFUSALS.has(error.code)) {
-      return { status: 'failed', message: error.message }
+    const answered =
+      error instanceof AgentSessionRpcResponseError ? agentSessionRpcErrorFailure(error.code) : null
+    if (answered && answered.kind !== 'unconfirmed') {
+      // The host turned the request away before running it; its text is written for a log.
+      return {
+        status: 'failed',
+        message: agentSessionWriteNoticeEnglish(
+          agentSessionWriteNoticeParts(answered, phoneWriteKind(fingerprintMethod, fields))
+        )
+      }
     }
     if (
       isRpcDeliveryUnknown(error) ||
@@ -177,7 +205,7 @@ export async function requestStructuredAgentSessionMutation<TValue>(args: {
     }
     return {
       status: 'failed',
-      message: error instanceof Error ? error.message : 'Request not sent'
+      message: agentSessionWriteFailureNotice(phoneWriteKind(fingerprintMethod, fields))
     }
   }
 }
diff --git a/mobile/src/session/mobile-structured-grouped-question.test.ts b/mobile/src/session/mobile-structured-grouped-question.test.ts
index 45a365864d9..37a4dc125c2 100644
--- a/mobile/src/session/mobile-structured-grouped-question.test.ts
+++ b/mobile/src/session/mobile-structured-grouped-question.test.ts
@@ -1,6 +1,5 @@
 import { describe, expect, it } from 'vitest'
 import type { AgentJournalQuestion } from '../../../src/shared/agent-session-journal-types'
-import { decodeAgentSessionQuestionAnswers } from '../../../src/shared/agent-session-question-answer'
 import {
   formatQuestionAnswer,
   formatQuestionFreeTextAnswer,
@@ -85,7 +84,7 @@ describe('mobile structured grouped questions', () => {
     expect(second).toMatchObject({ question: 'Which regions? (2 of 2)', multiSelect: true })
   })
 
-  it('submits the whole group as one encoded answer on the last step', () => {
+  it('submits the whole group as one set of answers on the last step', () => {
     const questions = [question(), SECOND]
     const draft: GroupedQuestionDraft = {
       promptKey: PROMPT_KEY,
@@ -102,9 +101,7 @@ describe('mobile structured grouped questions', () => {
     })
 
     expect(result?.kind).toBe('submit')
-    expect(
-      decodeAgentSessionQuestionAnswers(result?.kind === 'submit' ? result.optionId : '')
-    ).toEqual([
+    expect(result?.kind === 'submit' ? result.answers : null).toEqual([
       { questionId: 'q1', optionIds: ['q1:choice-1'] },
       { questionId: 'q2', optionIds: ['q2:choice-1', 'q2:choice-2'] }
     ])
@@ -121,9 +118,9 @@ describe('mobile structured grouped questions', () => {
       promptKey: PROMPT_KEY
     })
 
-    expect(
-      decodeAgentSessionQuestionAnswers(result?.kind === 'submit' ? result.optionId : '')
-    ).toEqual([{ questionId: 'q1', optionIds: [], other: 'DuckDB' }])
+    expect(result?.kind === 'submit' ? result.answers : null).toEqual([
+      { questionId: 'q1', optionIds: [], other: 'DuckDB' }
+    ])
   })
 
   it('keeps selected options and other text for grouped multi-select answers', () => {
@@ -137,9 +134,9 @@ describe('mobile structured grouped questions', () => {
       promptKey: PROMPT_KEY
     })
 
-    expect(
-      decodeAgentSessionQuestionAnswers(result?.kind === 'submit' ? result.optionId : '')
-    ).toEqual([{ questionId: 'q2', optionIds: ['q2:choice-1'], other: 'ap-south' }])
+    expect(result?.kind === 'submit' ? result.answers : null).toEqual([
+      { questionId: 'q2', optionIds: ['q2:choice-1'], other: 'ap-south' }
+    ])
   })
 
   it('gives each step a distinct card key so a selection cannot carry into the next question', () => {
diff --git a/mobile/src/session/mobile-structured-grouped-question.ts b/mobile/src/session/mobile-structured-grouped-question.ts
index 031cdf3f10f..d111b4de95a 100644
--- a/mobile/src/session/mobile-structured-grouped-question.ts
+++ b/mobile/src/session/mobile-structured-grouped-question.ts
@@ -1,6 +1,5 @@
 import type { AgentJournalQuestion } from '../../../src/shared/agent-session-journal-types'
 import {
-  encodeAgentSessionQuestionAnswers,
   isValidAgentSessionQuestionAnswers,
   type AgentSessionQuestionAnswer
 } from '../../../src/shared/agent-session-question-answer'
@@ -11,7 +10,7 @@ import type { MobileChatQuestion } from './mobile-native-chat-question'
  * prompt. The host then leaves the flat `question.options` EMPTY and puts the real content in
  * `questions`, so a client that reads only the flat shape renders an unanswerable card and the turn
  * stalls. The phone has room for one question at a time, so the group is answered as steps and
- * submitted once — the host accepts the whole group as one encoded option id.
+ * submitted once as one set of answers.
  */
 export type GroupedQuestionDraft = {
   /** Identifies the exact prompt revision these answers belong to; a revised prompt discards them. */
@@ -21,7 +20,7 @@ export type GroupedQuestionDraft = {
 
 export type GroupedQuestionAdvance =
   | { kind: 'advance'; draft: GroupedQuestionDraft }
-  | { kind: 'submit'; optionId: string }
+  | { kind: 'submit'; answers: AgentSessionQuestionAnswer[] }
 
 const GROUPED_TOKEN_PREFIX = 'structured-grouped-question:'
 
@@ -195,7 +194,7 @@ function answerFromResponse(
 
 /**
  * Fold one answer into the draft. Returns `advance` while questions remain and `submit` with the
- * encoded group once the last one lands; null when the response does not answer this prompt step.
+ * whole group once the last one lands; null when the response does not answer this prompt step.
  */
 export function advanceGroupedQuestion(args: {
   response: string
@@ -218,6 +217,6 @@ export function advanceGroupedQuestion(args: {
   }
   // Never send a group the host would refuse — the user would see a silent failure with no way back.
   return isValidAgentSessionQuestionAnswers(args.questions, answers)
-    ? { kind: 'submit', optionId: encodeAgentSessionQuestionAnswers(answers) }
+    ? { kind: 'submit', answers }
     : null
 }
diff --git a/mobile/src/session/mobile-structured-operation-id-retirement.test.ts b/mobile/src/session/mobile-structured-operation-id-retirement.test.ts
index 6c8b50e33b8..82ccd1e19dc 100644
--- a/mobile/src/session/mobile-structured-operation-id-retirement.test.ts
+++ b/mobile/src/session/mobile-structured-operation-id-retirement.test.ts
@@ -131,3 +131,102 @@ describe('structured Stop after an unknown outcome', () => {
     expect(operationIds.size).toBe(1)
   })
 })
+
+describe('what a structured refusal says on the phone', () => {
+  it("replaces the host's diagnostic with words a person can act on", async () => {
+    const result = await requestStructuredAgentSessionMutation({
+      client: fakeClient(async () => ({
+        ok: true,
+        result: {
+          ok: false,
+          refusal: {
+            code: 'agent_session_checkpoint_stale',
+            message: 'Expected runtime fence 1; the session is at 3.'
+          }
+        },
+        _meta: { runtimeId: 'runtime-1' }
+      })),
+      method: 'agentSession.send',
+      fingerprintMethod: 'agentSession.send',
+      sessionId: 'session-1',
+      expectedRuntimeFence: 1,
+      fields: { body: 'hello' },
+      clientOperationId: `1900000000000-${'c'.repeat(32)}`
+    })
+
+    expect(result).toEqual({
+      status: 'refused',
+      code: 'agent_session_checkpoint_stale',
+      message: 'Your message was not sent. Send it again.'
+    })
+  })
+
+  it('says what the host named as the reason, in the same words as desktop', async () => {
+    const result = await requestStructuredAgentSessionMutation({
+      client: fakeClient(async () => ({
+        ok: true,
+        result: {
+          ok: false,
+          refusal: {
+            code: 'agent_session_operation_invalid',
+            message: 'This conversation has been cleared. Use the current conversation.',
+            details: { reason: 'conversationCleared' }
+          }
+        },
+        _meta: { runtimeId: 'runtime-1' }
+      })),
+      method: 'agentSession.send',
+      fingerprintMethod: 'agentSession.send',
+      sessionId: 'session-1',
+      expectedRuntimeFence: 1,
+      fields: { body: 'hello' },
+      clientOperationId: `1900000000000-${'e'.repeat(32)}`
+    })
+
+    expect(result).toEqual({
+      status: 'refused',
+      code: 'agent_session_operation_invalid',
+      message:
+        'This conversation has been cleared. Your message was not sent. Open the current conversation to continue.'
+    })
+  })
+
+  const stop = {
+    method: 'agentSession.cancel',
+    fingerprintMethod: 'agentSession.cancel',
+    sessionId: 'session-1',
+    expectedRuntimeFence: 1,
+    fields: { turnId: 'turn-1' },
+    clientOperationId: `1900000000000-${'d'.repeat(32)}`
+  }
+
+  it("keeps a failed request's transport text off the screen", async () => {
+    const result = await requestStructuredAgentSessionMutation({
+      ...stop,
+      client: fakeClient(async () => {
+        throw new Error('ECONNRESET 10.0.0.2:443')
+      })
+    })
+
+    expect(result).toEqual({
+      status: 'failed',
+      message: "The agent wasn't stopped."
+    })
+  })
+
+  it("keeps the host's text off the screen when it turns the request away unrun", async () => {
+    const result = await requestStructuredAgentSessionMutation({
+      ...stop,
+      client: fakeClient(async () => ({
+        ok: false,
+        error: { code: 'method_not_found', message: 'Unknown method: agentSession.cancel' },
+        _meta: { runtimeId: 'runtime-1' }
+      }))
+    })
+
+    expect(result).toEqual({
+      status: 'failed',
+      message: "The Orca running this chat doesn't support this. Update Orca, then try again."
+    })
+  })
+})
diff --git a/mobile/src/session/mobile-structured-send-delivery.test.ts b/mobile/src/session/mobile-structured-send-delivery.test.ts
index 614cadac391..00af8a1e178 100644
--- a/mobile/src/session/mobile-structured-send-delivery.test.ts
+++ b/mobile/src/session/mobile-structured-send-delivery.test.ts
@@ -39,6 +39,29 @@ describe('mobileStructuredSendDelivery', () => {
     }
   })
 
+  it('classifies a queued draft answer as accepted and spends its id, replays included', () => {
+    // The host holds the message now; a later identical send is a new message.
+    for (const state of ['waiting', 'dispatched', 'returned', 'withdrawn'] as const) {
+      const queued: StructuredAgentSessionMutationCallResult<AgentSessionSendResult> = {
+        status: 'accepted',
+        value: {
+          clientMessageId: 'client-1',
+          queued: { messageId: 'client-1', position: 1, state }
+        }
+      }
+      expect(mobileStructuredSendDelivery(queued)).toEqual({
+        outcome: 'accepted',
+        operationIdSpent: true,
+        error: null
+      })
+      expect(mobileStructuredSendDelivery(queued, true)).toEqual({
+        outcome: 'accepted',
+        operationIdSpent: true,
+        error: null
+      })
+    }
+  })
+
   it('does not report a retained payload replay as a new accepted send', () => {
     for (const dispatchState of ['accepted', 'pending'] as const) {
       expect(mobileStructuredSendDelivery(accepted(dispatchState), true)).toEqual({
@@ -58,7 +81,7 @@ describe('mobileStructuredSendDelivery', () => {
     ).toEqual({
       outcome: 'rejected',
       operationIdSpent: true,
-      error: "Couldn't reach the agent. Your message was not sent — Retry to send it again."
+      error: "Orca couldn't reach the agent. Your message was not sent. Send it again."
     })
   })
 
@@ -94,13 +117,16 @@ describe('mobileStructuredSendDelivery', () => {
         message: 'Outcome unknown'
       })
     ).toEqual({ outcome: 'unknown', operationIdSpent: false, error: null })
-    expect(mobileStructuredSendDelivery({ status: 'failed', message: 'Request not sent' })).toEqual(
-      {
-        outcome: 'rejected',
-        operationIdSpent: true,
-        error: 'Message not sent'
-      }
-    )
+    expect(
+      mobileStructuredSendDelivery({
+        status: 'failed',
+        message: 'Your message was not sent. Send it again.'
+      })
+    ).toEqual({
+      outcome: 'rejected',
+      operationIdSpent: true,
+      error: 'Your message was not sent. Send it again.'
+    })
   })
 
   it('never releases an ambiguous id on a later RPC refusal or failure', () => {
@@ -115,8 +141,15 @@ describe('mobileStructuredSendDelivery', () => {
       )
     ).toEqual({ outcome: 'rejected', operationIdSpent: false, error: 'Operation expired' })
     expect(
-      mobileStructuredSendDelivery({ status: 'failed', message: 'Request not sent' }, true)
-    ).toEqual({ outcome: 'rejected', operationIdSpent: false, error: 'Message not sent' })
+      mobileStructuredSendDelivery(
+        { status: 'failed', message: 'Your message was not sent. Send it again.' },
+        true
+      )
+    ).toEqual({
+      outcome: 'rejected',
+      operationIdSpent: false,
+      error: 'Your message was not sent. Send it again.'
+    })
   })
 
   it('fails closed when an invalid host response omits the required submission', () => {
diff --git a/mobile/src/session/mobile-structured-send-delivery.ts b/mobile/src/session/mobile-structured-send-delivery.ts
index 70f8a8f0d3d..6c90158a54f 100644
--- a/mobile/src/session/mobile-structured-send-delivery.ts
+++ b/mobile/src/session/mobile-structured-send-delivery.ts
@@ -21,6 +21,7 @@
 //     the retry has to stay a replay. Rotating here is what sent one message to a
 //     model five times.
 
+import type { AgentJournalSubmission } from '../../../src/shared/agent-session-journal-types'
 import type { AgentSessionSendResult } from '../../../src/shared/agent-session-wire'
 import { agentSessionRefusalOperationState } from '../../../src/shared/agent-session-refusal-retry'
 import { structuredAgentSessionRejectionNotice } from '../../../src/shared/structured-agent-session-send-disposition'
@@ -57,10 +58,17 @@ export function mobileStructuredSendDelivery(
     return {
       outcome: 'rejected',
       operationIdSpent: !retained,
-      error: result.message === 'Request not sent' ? 'Message not sent' : result.message
+      error: result.message
     }
   }
-  const submission = result.value.submission as AgentSessionSendResult['submission'] | undefined
+  if ('queued' in result.value && result.value.queued) {
+    // The host holds (or already settled) the draft: the send is spent — a
+    // later identical message is a new message. A withdrawn replay is spent
+    // too, never unknown: its card was deleted or carried by a /clear.
+    return { outcome: 'accepted', operationIdSpent: true, error: null }
+  }
+  const submission: AgentJournalSubmission | undefined =
+    'submission' in result.value ? result.value.submission : undefined
   if (!submission || submission.dispatchState === 'unknown') {
     return { outcome: 'unknown', operationIdSpent: false, error: null }
   }
@@ -68,7 +76,7 @@ export function mobileStructuredSendDelivery(
     return {
       outcome: 'rejected',
       operationIdSpent: true,
-      error: structuredAgentSessionRejectionNotice(submission.reason)
+      error: structuredAgentSessionRejectionNotice(submission.reason, 'composer-send')
     }
   }
   if (retained) {
diff --git a/mobile/src/session/mobile-terminal-viewport-resubscribe.test.ts b/mobile/src/session/mobile-terminal-viewport-resubscribe.test.ts
index 35aac89f6f8..752d2016979 100644
--- a/mobile/src/session/mobile-terminal-viewport-resubscribe.test.ts
+++ b/mobile/src/session/mobile-terminal-viewport-resubscribe.test.ts
@@ -239,6 +239,7 @@ describe('runTerminalViewportFitPass', () => {
     viewportMeasured?: boolean
     viewport?: { cols: number; rows: number } | null
     measured?: { cols: number; rows: number } | null
+    sentViewport?: { cols: number; rows: number } | null
     budget?: TerminalViewportResubscribeBudget
   }) {
     const budget = overrides.budget ?? new TerminalViewportResubscribeBudget()
@@ -251,7 +252,7 @@ describe('runTerminalViewportFitPass', () => {
     const scheduled: { fn: () => void; ms: number }[] = []
     const webView = {
       awaitReady: () => Promise.resolve(),
-      measureFitDimensions: () => Promise.resolve(overrides.measured ?? PHONE)
+      fitDimensions: () => (overrides.measured === undefined ? PHONE : overrides.measured)
     }
     const unsubscribeTerminal = vi.fn((handle: string) => {
       terminalUnsubsRef.current.delete(handle)
@@ -266,6 +267,7 @@ describe('runTerminalViewportFitPass', () => {
       seq: 1,
       hostCols: overrides.hostCols ?? null,
       hostRows: overrides.hostRows ?? null,
+      sentViewport: overrides.sentViewport ?? null,
       budget,
       diagnostics,
       viewportRef: { current: overrides.viewport ?? null },
@@ -273,7 +275,7 @@ describe('runTerminalViewportFitPass', () => {
       subscribeSeqRef: { current: new Map([[HANDLE, 1]]) },
       initializedHandlesRef: { current: new Set([HANDLE]) },
       terminalUnsubsRef,
-      terminalFrameHeightRef: { current: 0 },
+      terminalFrameRef: { current: { width: 390, height: 600 } },
       getTerminalRef: () => webView,
       unsubscribeTerminal,
       subscribeToTerminal,
@@ -313,6 +315,38 @@ describe('runTerminalViewportFitPass', () => {
     expect(h.budget.attempts(HANDLE)).toBe(1)
   })
 
+  it('re-measures a stale sent viewport after the flag was cleared, and resubscribes at the phone size', async () => {
+    const stale = { cols: 80, rows: 30 }
+    const h = makeHarness({
+      hostCols: stale.cols,
+      hostRows: stale.rows,
+      viewportMeasured: false,
+      viewport: stale,
+      sentViewport: stale,
+      measured: PHONE
+    })
+    runTerminalViewportFitPass(h.args)
+    await settle()
+    expect(h.unsubscribeTerminal).toHaveBeenCalledTimes(1)
+    expect(h.subscribeToTerminal).toHaveBeenCalledTimes(1)
+    expect(h.args.viewportRef.current).toEqual(PHONE)
+  })
+
+  it('re-measures locally and skips the round trip when the host matches the viewport the subscribe carried', async () => {
+    const h = makeHarness({
+      hostCols: PHONE.cols,
+      hostRows: PHONE.rows,
+      viewportMeasured: false,
+      viewport: PHONE,
+      sentViewport: PHONE
+    })
+    runTerminalViewportFitPass(h.args)
+    await settle()
+    expect(h.unsubscribeTerminal).not.toHaveBeenCalled()
+    expect(h.subscribeToTerminal).not.toHaveBeenCalled()
+    expect(h.budget.attempts(HANDLE)).toBe(0)
+  })
+
   it('treats an equal fresh measure as convergence instead of resubscribing', async () => {
     const budget = new TerminalViewportResubscribeBudget()
     budget.chargeAttempt(HANDLE)
diff --git a/mobile/src/session/mobile-terminal-viewport-resubscribe.ts b/mobile/src/session/mobile-terminal-viewport-resubscribe.ts
index 175eb9d92b8..f0fc70a1333 100644
--- a/mobile/src/session/mobile-terminal-viewport-resubscribe.ts
+++ b/mobile/src/session/mobile-terminal-viewport-resubscribe.ts
@@ -2,6 +2,7 @@
  *  frame dims can never equal the phone viewport must not re-arm the stream
  *  forever — it broke gesture recognition and drained battery at ~25 cycles/s. */
 
+import type { TerminalFrame } from '../terminal/terminal-webview-messages'
 import type { MobileTerminalDiagnostics } from './mobile-terminal-diagnostics'
 
 export const MAX_TERMINAL_VIEWPORT_RESUBSCRIBE_ATTEMPTS = 3
@@ -173,11 +174,11 @@ export class TerminalViewportResubscribeBudget {
   }
 }
 
-type MutableRef<T> = { current: T }
+export type MutableRef<T> = { current: T }
 
 type TerminalFitWebView = {
   awaitReady: () => Promise<unknown>
-  measureFitDimensions: (frameHeight?: number) => Promise<TerminalViewportDims | null | undefined>
+  fitDimensions: (frame: { width: number; height: number }) => TerminalViewportDims | null
 }
 
 export type TerminalViewportFitPassArgs = {
@@ -185,6 +186,8 @@ export type TerminalViewportFitPassArgs = {
   seq: number
   hostCols: number | null
   hostRows: number | null
+  /** The viewport this subscribe carried; null when it went without one. */
+  sentViewport: TerminalViewportDims | null
   budget: TerminalViewportResubscribeBudget
   diagnostics: Pick<
     MobileTerminalDiagnostics,
@@ -195,7 +198,7 @@ export type TerminalViewportFitPassArgs = {
   subscribeSeqRef: MutableRef<Map<string, number>>
   initializedHandlesRef: MutableRef<Set<string>>
   terminalUnsubsRef: MutableRef<Map<string, () => void>>
-  terminalFrameHeightRef: MutableRef<number>
+  terminalFrameRef: MutableRef<TerminalFrame | null>
   getTerminalRef: (handle: string | null) => TerminalFitWebView | undefined
   unsubscribeTerminal: (handle: string) => void
   subscribeToTerminal: (handle: string) => void
@@ -230,9 +233,10 @@ export function runTerminalViewportFitPass(args: TerminalViewportFitPassArgs): v
     }
     return
   }
-  const viewportWasMeasured = args.viewportMeasuredRef.current
+  // Why: a subscribe that carried a viewport already told the host one; a fresh measure that matches it needs no round trip.
+  const viewportWasMeasured = args.viewportMeasuredRef.current || args.sentViewport != null
   void (async () => {
-    // Why: wait for init()'s rAF chain before measuring, else the measure races ahead and returns null (log dump 2026-05-06).
+    // Why: wait for init()'s rAF chain, which reports the box the fit reads (log dump 2026-05-06).
     await args.getTerminalRef(handle)?.awaitReady()
     if (
       args.subscribeSeqRef.current.get(handle) !== seq ||
@@ -240,17 +244,9 @@ export function runTerminalViewportFitPass(args: TerminalViewportFitPassArgs): v
     ) {
       return
     }
-    const dims = await args
-      .getTerminalRef(handle)
-      ?.measureFitDimensions(args.terminalFrameHeightRef.current || undefined)
-    // Why: re-check seq — the awaits may have let a newer subscribe cycle arm; tearing it down would resubscribe a stale generation.
-    if (
-      args.subscribeSeqRef.current.get(handle) !== seq ||
-      !budget.isRetryGenerationCurrent(handle, retryGeneration)
-    ) {
-      return
-    }
-    if (!args.getTerminalRef(handle) || !dims) {
+    const frame = args.terminalFrameRef.current
+    const dims = frame ? args.getTerminalRef(handle)?.fitDimensions(frame) : null
+    if (!dims) {
       return
     }
     args.viewportRef.current = dims
diff --git a/mobile/src/session/mobile-worker-takeover-send-sites.test.ts b/mobile/src/session/mobile-worker-takeover-send-sites.test.ts
index 1c13100e1c8..17175a5e139 100644
--- a/mobile/src/session/mobile-worker-takeover-send-sites.test.ts
+++ b/mobile/src/session/mobile-worker-takeover-send-sites.test.ts
@@ -13,7 +13,6 @@ import {
   clearMobileNativeChatInput
 } from './mobile-native-chat-send'
 import { sendMobileTerminalQueryReply } from '../terminal/mobile-terminal-query-reply'
-import { createTerminalAndSendPrompt } from './pr-ai-triage-launch'
 import { useMobileDiffReviewSendActions } from './use-mobile-diff-review-send-actions'
 import { pasteMobileNativeChatImagePaths } from './mobile-native-chat-image-send'
 
@@ -110,13 +109,14 @@ function mountSendSites(client: ReturnType<typeof clientFixture>, handle = 'term
       onSuccess: vi.fn(),
       refreshCanPaste: vi.fn()
     } as never)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: untyped vi.fn() stubs stand in for callbacks whose returns the send path never reads.
     diff = useMobileDiffReviewSendActions({
       client: client as unknown as RpcClient,
       connState: 'connected',
       worktreeId: 'workspace',
       screenState: { kind: 'loading' },
       setActionError: vi.fn(),
-      setSendSheet: vi.fn(),
+      sheets: { openSheet: vi.fn(), closeSheet: vi.fn(), updateSendSheet: vi.fn() },
       saveCommentsAndReviewState: vi.fn()
     } as never)
     return null
@@ -178,7 +178,6 @@ function mountSendSites(client: ReturnType<typeof clientFixture>, handle = 'term
         imagePaths: ['/tmp/picture.png'],
         followedByText: true
       }),
-    'PR triage': () => createTerminalAndSendPrompt(client, 'workspace', 'fix checks'),
     'diff review': () => diff.sendPromptToTerminal(handle, []),
     programmatic: () => client.sendRequest('terminal.send')
   }
@@ -239,23 +238,19 @@ it.each(realSites)('%s reports on its send target once per handle per 30 seconds
   expect(reports()[2][1]).toEqual({ terminal: 'term-2' })
 })
 
-it.each([
-  'query reply',
-  'image heal',
-  'image attachment',
-  'PR triage',
-  'diff review',
-  'programmatic'
-] as const)('%s never reports takeover', async (site) => {
-  const client = clientFixture()
-  const sites = mountSendSites(client)
-  await act(async () => {
-    await sites[site]()
-    await sites[site]()
-  })
-  expect(client.sendRequest.mock.calls.some(([method]) => method === 'terminal.send')).toBe(true)
-  expect(client.sendRequest.mock.calls.filter(([method]) => method === REPORT)).toHaveLength(0)
-})
+it.each(['query reply', 'image heal', 'image attachment', 'diff review', 'programmatic'] as const)(
+  '%s never reports takeover',
+  async (site) => {
+    const client = clientFixture()
+    const sites = mountSendSites(client)
+    await act(async () => {
+      await sites[site]()
+      await sites[site]()
+    })
+    expect(client.sendRequest.mock.calls.some(([method]) => method === 'terminal.send')).toBe(true)
+    expect(client.sendRequest.mock.calls.filter(([method]) => method === REPORT)).toHaveLength(0)
+  }
+)
 
 it.each(realSites)('%s does not report a rejected send', async (site) => {
   const client = clientFixture()
diff --git a/mobile/src/session/pr-ai-triage-launch.test.ts b/mobile/src/session/pr-ai-triage-launch.test.ts
index 5641bbe37d4..16c8132836f 100644
--- a/mobile/src/session/pr-ai-triage-launch.test.ts
+++ b/mobile/src/session/pr-ai-triage-launch.test.ts
@@ -1,64 +1,319 @@
 import { describe, expect, it, vi } from 'vitest'
+import type { RpcClient } from '../transport/rpc-client'
 import type { RpcResponse } from '../transport/types'
-import { createTerminalAndSendPrompt } from './pr-ai-triage-launch'
+import { AGENT_LAUNCH_UPDATE_REQUIRED_MESSAGE } from './mobile-existing-agent-launch'
+import {
+  AGENT_PROMPT_NOT_SENT_MESSAGE,
+  agentStartedMessage,
+  launchAgentWithPrompt,
+  promptedLaunchNotice
+} from './pr-ai-triage-launch'
 
-function success(result: unknown): RpcResponse {
+// A connected client whose only behaviour is the scripted `sendRequest`.
+function requestPortRpcClient(sendRequest: RpcClient['sendRequest']): RpcClient {
+  return {
+    sendRequest,
+    subscribe: () => () => {},
+    updateTerminalSubscriptionViewport: () => {},
+    getState: () => 'connected',
+    getReconnectAttempt: () => 0,
+    getLastConnectedAt: () => null,
+    onStateChange: () => () => {},
+    notifyForeground: () => {},
+    close: () => {}
+  }
+}
+
+const LAUNCH_CAPABILITIES = [
+  'agent.launch.v2',
+  'agent.launch.replay.v1',
+  'agent.launch.replay-required.v1'
+]
+const RECEIPT = {
+  mode: 'terminal',
+  preferred: 'terminal',
+  reason: 'user_default',
+  detail: 'Started a terminal agent.'
+}
+
+function ok(result: unknown): RpcResponse {
   return { id: 'x', ok: true, result, _meta: { runtimeId: 'r' } }
 }
 
-function failure(message: string): RpcResponse {
-  return { id: 'x', ok: false, error: { code: 'E', message }, _meta: { runtimeId: 'r' } }
+// Answers by method so the order of the agent loader's reads doesn't matter.
+function hostClient(replies: { settings?: unknown; detected?: unknown[]; launch?: RpcResponse }) {
+  const sendRequest = vi.fn(async (method: string, _params?: unknown) => {
+    if (method === 'repo.list') {
+      return ok({ repos: [{ id: 'repo-1' }] })
+    }
+    if (method === 'settings.get') {
+      return ok({ settings: replies.settings ?? {} })
+    }
+    if (method === 'preflight.detectAgents') {
+      return ok(replies.detected ?? ['claude', 'codex'])
+    }
+    if (method === 'agent.launchReplay') {
+      return replies.launch ?? ok({})
+    }
+    throw new Error(`unexpected ${method}`)
+  })
+  return { client: requestPortRpcClient(sendRequest), sendRequest }
 }
 
-const createdTerminal = success({ tab: { type: 'terminal', id: 't1', terminal: 'term-1' } })
-const sendAccepted = success({ send: { accepted: true } })
-
-function clientReturning(...responses: RpcResponse[]) {
-  const sendRequest = vi.fn(async () => responses[sendRequest.mock.calls.length - 1])
-  return { sendRequest }
+function launchedWith(prompt: unknown, warning?: string): RpcResponse {
+  return ok({
+    outcome: { kind: 'terminal', handle: 'term-1' },
+    worktreeId: 'repo-1::/w',
+    receipt: RECEIPT,
+    ...(prompt ? { prompt } : {}),
+    ...(warning ? { warning } : {})
+  })
 }
 
-describe('createTerminalAndSendPrompt', () => {
-  it('creates a terminal then sends the prompt with enter', async () => {
-    const client = clientReturning(createdTerminal, sendAccepted)
-    await createTerminalAndSendPrompt(client, 'wt-1', 'do the thing')
+function run(client: RpcClient, hostCapabilities: readonly string[] = LAUNCH_CAPABILITIES) {
+  return launchAgentWithPrompt({
+    client,
+    hostCapabilities,
+    worktreeId: 'repo-1::/w',
+    actionId: 'fixChecks',
+    prompt: 'Fix the failing checks',
+    launchSource: 'task_page'
+  })
+}
 
-    expect(client.sendRequest).toHaveBeenNthCalledWith(1, 'session.tabs.createTerminal', {
-      worktree: 'id:wt-1',
-      activate: false,
-      select: true,
-      navigation: 'caller'
+function launchParams(sendRequest: ReturnType<typeof hostClient>['sendRequest']) {
+  return sendRequest.mock.calls.find(([method]) => method === 'agent.launchReplay')?.[1]
+}
+
+describe('launchAgentWithPrompt', () => {
+  it('never creates a bare shell: an older host gets update copy and no request', async () => {
+    const { client, sendRequest } = hostClient({})
+    await expect(run(client, [])).resolves.toEqual({
+      kind: 'not-started',
+      message: AGENT_LAUNCH_UPDATE_REQUIRED_MESSAGE
     })
-    expect(client.sendRequest).toHaveBeenNthCalledWith(2, 'terminal.send', {
-      terminal: 'term-1',
-      text: 'do the thing',
-      enter: true
+    expect(sendRequest).not.toHaveBeenCalled()
+  })
+
+  it('starts the default agent with the prompt through the host', async () => {
+    const { client, sendRequest } = hostClient({
+      settings: { defaultTuiAgent: 'codex' },
+      launch: launchedWith({ delivery: 'submit', outcome: 'handed-to-terminal' })
+    })
+    await expect(run(client)).resolves.toEqual({ kind: 'sent' })
+    expect(launchParams(sendRequest)).toMatchObject({
+      agent: 'codex',
+      target: { kind: 'existing', worktree: 'id:repo-1::/w' },
+      prompt: { text: 'Fix the failing checks', delivery: 'submit' },
+      launchSource: 'task_page'
+    })
+    // No saved arguments: the host applies the user's configured defaults.
+    expect(launchParams(sendRequest)).not.toHaveProperty('agentArgs')
+    expect(sendRequest.mock.calls.some(([method]) => method === 'terminal.send')).toBe(false)
+    expect(
+      sendRequest.mock.calls.some(([method]) => method === 'session.tabs.createTerminal')
+    ).toBe(false)
+  })
+
+  it("honours the action's saved agent over the default", async () => {
+    const { client, sendRequest } = hostClient({
+      settings: {
+        defaultTuiAgent: 'codex',
+        sourceControlAi: { actions: { fixChecks: { agentId: 'claude' } } }
+      },
+      launch: launchedWith({ delivery: 'submit', outcome: 'handed-to-terminal' })
+    })
+    await run(client)
+    expect(launchParams(sendRequest)).toMatchObject({ agent: 'claude' })
+  })
+
+  it("wraps the prompt in the action's saved template, as the desktop does", async () => {
+    const { client, sendRequest } = hostClient({
+      settings: {
+        defaultTuiAgent: 'claude',
+        sourceControlAi: {
+          actions: { fixChecks: { commandInputTemplate: '/review first\n\n{basePrompt}' } }
+        }
+      },
+      launch: launchedWith({ delivery: 'submit', outcome: 'handed-to-terminal' })
+    })
+    await run(client)
+    expect(launchParams(sendRequest)).toMatchObject({
+      prompt: { text: '/review first\n\nFix the failing checks', delivery: 'submit' }
     })
   })
 
-  it('throws and skips terminal.send when createTerminal fails', async () => {
-    const client = clientReturning(failure('boom'))
-    await expect(createTerminalAndSendPrompt(client, 'wt-1', 'p')).rejects.toThrow('boom')
-    expect(client.sendRequest).toHaveBeenCalledTimes(1)
+  it('refuses to launch with an empty saved template rather than send no prompt', async () => {
+    const { client, sendRequest } = hostClient({
+      settings: {
+        defaultTuiAgent: 'claude',
+        sourceControlAi: { actions: { fixChecks: { commandInputTemplate: '   ' } } }
+      }
+    })
+    await expect(run(client)).resolves.toMatchObject({ kind: 'not-started' })
+    expect(launchParams(sendRequest)).toBeUndefined()
   })
 
-  it('throws when the created-terminal response is malformed', async () => {
-    const client = clientReturning(success({ tab: { type: 'terminal' } }))
-    await expect(createTerminalAndSendPrompt(client, 'wt-1', 'p')).rejects.toThrow(
-      'The host sent a reply this app could not read (session.tabs.createTerminal)'
-    )
-    expect(client.sendRequest).toHaveBeenCalledTimes(1)
+  it('falls back to the default agent on an older host that publishes no recipes', async () => {
+    const { client, sendRequest } = hostClient({
+      // A host before the recipe projection: settings.get carries no sourceControlAi at all.
+      settings: { defaultTuiAgent: 'codex', disabledTuiAgents: [] },
+      launch: launchedWith({ delivery: 'submit', outcome: 'handed-to-terminal' })
+    })
+    await expect(run(client)).resolves.toEqual({ kind: 'sent' })
+    expect(launchParams(sendRequest)).toMatchObject({
+      agent: 'codex',
+      prompt: { text: 'Fix the failing checks' }
+    })
   })
 
-  it('throws when terminal.send returns a failure', async () => {
-    const client = clientReturning(createdTerminal, failure('send failed'))
-    await expect(createTerminalAndSendPrompt(client, 'wt-1', 'p')).rejects.toThrow('send failed')
+  it("never sends the action's saved agent arguments; the agent's defaults apply", async () => {
+    const { client, sendRequest } = hostClient({
+      settings: {
+        defaultTuiAgent: 'claude',
+        sourceControlAi: { actions: { fixChecks: { agentArgs: '--model opus' } } }
+      },
+      launch: launchedWith({ delivery: 'submit', outcome: 'handed-to-terminal' })
+    })
+    await run(client)
+    expect(launchParams(sendRequest)).toMatchObject({ agent: 'claude' })
+    expect(launchParams(sendRequest)).not.toHaveProperty('agentArgs')
   })
 
-  it('throws when terminal input is locked', async () => {
-    const client = clientReturning(createdTerminal, success({ send: { accepted: false } }))
-    await expect(createTerminalAndSendPrompt(client, 'wt-1', 'p')).rejects.toThrow(
-      'Terminal input is locked'
+  it('refuses rather than swaps when the saved agent is not on this host', async () => {
+    const { client, sendRequest } = hostClient({
+      settings: { sourceControlAi: { actions: { fixChecks: { agentId: 'gemini' } } } },
+      detected: ['claude']
+    })
+    await expect(run(client)).resolves.toEqual({
+      kind: 'not-started',
+      message: 'The saved agent for this action is not available on this workspace host.'
+    })
+    expect(launchParams(sendRequest)).toBeUndefined()
+  })
+
+  it('still launches an agent when the default is a blank terminal', async () => {
+    const { client, sendRequest } = hostClient({
+      settings: { defaultTuiAgent: 'blank' },
+      detected: ['codex', 'claude'],
+      launch: launchedWith({ delivery: 'submit', outcome: 'handed-to-terminal' })
+    })
+    await run(client)
+    // Catalog order, as the desktop resolves it.
+    expect(launchParams(sendRequest)).toMatchObject({ agent: 'claude' })
+  })
+
+  it('reports no agent when none is detected and enabled', async () => {
+    const { client } = hostClient({
+      settings: { disabledTuiAgents: ['claude'] },
+      detected: ['claude']
+    })
+    await expect(run(client)).resolves.toEqual({
+      kind: 'not-started',
+      message: 'No enabled AI agent was detected on this workspace host.'
+    })
+  })
+
+  it('reports prompt-not-sent when the agent started without its prompt (v1.4.206-207 hosts)', async () => {
+    // Those hosts start a terminal agent with no prompt and say so.
+    const { client } = hostClient({
+      launch: launchedWith({ delivery: 'submit', outcome: 'not-delivered' })
+    })
+    await expect(run(client)).resolves.toEqual({
+      kind: 'prompt-not-sent',
+      prompt: 'Fix the failing checks'
+    })
+  })
+
+  it('passes the host warning through', async () => {
+    const { client } = hostClient({
+      launch: launchedWith(
+        { delivery: 'submit', outcome: 'journaled', messageId: 'm' },
+        '  launch arguments were ignored  '
+      )
+    })
+    await expect(run(client)).resolves.toEqual({
+      kind: 'sent',
+      warning: 'launch arguments were ignored'
+    })
+  })
+
+  it('reports an unknown outcome as unconfirmed', async () => {
+    const { client } = hostClient({
+      launch: {
+        id: 'x',
+        ok: false,
+        error: {
+          code: 'agent_session_operation_unknown',
+          message: 'agent_session_operation_unknown'
+        },
+        _meta: { runtimeId: 'r' }
+      }
+    })
+    await expect(run(client)).resolves.toMatchObject({ kind: 'unconfirmed' })
+  })
+})
+
+describe('promptedLaunchNotice', () => {
+  it('keeps the prompt only when the agent started without it', () => {
+    expect(promptedLaunchNotice({ kind: 'prompt-not-sent', prompt: 'p' })).toEqual({
+      succeeded: false,
+      success: null,
+      error: AGENT_PROMPT_NOT_SENT_MESSAGE,
+      warning: null,
+      undeliveredPrompt: 'p'
+    })
+    expect(promptedLaunchNotice({ kind: 'sent' })).toEqual({
+      succeeded: true,
+      success: 'Agent started',
+      error: null,
+      warning: null,
+      undeliveredPrompt: null
+    })
+    expect(promptedLaunchNotice({ kind: 'unconfirmed', message: 'm' })).toEqual({
+      succeeded: false,
+      success: null,
+      error: 'm',
+      warning: null,
+      undeliveredPrompt: null
+    })
+  })
+
+  // The host can attach a warning to a launch it still carried out.
+  it('never reports the host warning on a launch that went ahead as an error', () => {
+    expect(promptedLaunchNotice({ kind: 'sent', warning: 'arguments were ignored' })).toEqual({
+      succeeded: true,
+      success: 'Agent started',
+      error: null,
+      warning: 'arguments were ignored',
+      undeliveredPrompt: null
+    })
+    expect(
+      promptedLaunchNotice({
+        kind: 'prompt-not-sent',
+        prompt: 'p',
+        warning: 'arguments were ignored'
+      })
+    ).toEqual({
+      succeeded: false,
+      success: null,
+      error: AGENT_PROMPT_NOT_SENT_MESSAGE,
+      warning: 'arguments were ignored',
+      undeliveredPrompt: 'p'
+    })
+  })
+})
+
+describe('agentStartedMessage', () => {
+  // Issue #20543: a launch from the phone must say it happened, and where.
+  it('names the workspace the agent started in', () => {
+    expect(promptedLaunchNotice({ kind: 'sent' }, 'feature-login').success).toBe(
+      'Agent started in feature-login'
     )
+  })
+
+  it('still confirms the launch when the screen knows no workspace name', () => {
+    expect(agentStartedMessage(null)).toBe('Agent started')
+    expect(agentStartedMessage('   ')).toBe('Agent started')
   })
 })
diff --git a/mobile/src/session/pr-ai-triage-launch.ts b/mobile/src/session/pr-ai-triage-launch.ts
index 2e02b299813..61c160b224e 100644
--- a/mobile/src/session/pr-ai-triage-launch.ts
+++ b/mobile/src/session/pr-ai-triage-launch.ts
@@ -1,43 +1,139 @@
-import { refusedRpcMessageOrFallback } from '../transport/rpc-refusal-message'
-import { reviewTerminalCreateRun, reviewTerminalSendRun } from './mobile-review-terminal-operations'
-import type { RpcOperationSender } from '../transport/rpc-operation-sender'
+import type { SourceControlLaunchActionId } from '../../../src/shared/source-control-ai-actions'
+import { buildSourceControlRecoveryAgentCommandInput } from '../../../src/shared/source-control-recovery-agent-command'
+import type { RpcClient } from '../transport/rpc-client'
+import {
+  AGENT_LAUNCH_UPDATE_REQUIRED_MESSAGE,
+  launchAgentInExistingWorkspace,
+  supportsMobileExistingAgentLaunch
+} from './mobile-existing-agent-launch'
+import { loadMobileAgentLaunchContext } from './mobile-new-tab-agent-loader'
+import { resolveMobileSourceControlLaunchAgent } from './mobile-source-control-launch-agent'
 
-// Pure launch path for the PR triage actions ("Fix checks with AI" / "Resolve
-// conflicts with AI"). Reuses the same two RPCs the diff-review send flow uses —
-// session.tabs.createTerminal then terminal.send — so the prompt is dropped into a
-// fresh agent terminal in the worktree. Kept free of react-native imports so it
-// stays unit-testable in the node test environment.
-export async function createTerminalAndSendPrompt(
-  client: RpcOperationSender,
-  worktreeId: string,
+// Launch path for the phone's AI buttons ("Fix checks with AI", "Resolve conflicts with AI", commit
+// recovery, review notes). The host starts the agent and delivers the prompt; the phone never
+// types a prompt into a shell. Kept free of react-native imports so it unit-tests under node.
+
+export type MobilePromptedAgentLaunch =
+  | { kind: 'sent'; warning?: string }
+  /** The agent started but `prompt`, the text as sent, did not reach it; the caller offers it. */
+  | { kind: 'prompt-not-sent'; prompt: string; warning?: string }
+  /** Nothing started; `message` says why. */
+  | { kind: 'not-started'; message: string }
+  /** The agent may be running; do not launch again until the user has looked. */
+  | { kind: 'unconfirmed'; message: string }
+
+export const AGENT_PROMPT_NOT_SENT_MESSAGE = "The agent started, but the prompt wasn't sent."
+
+export async function launchAgentWithPrompt(args: {
+  client: RpcClient
+  hostCapabilities: readonly string[] | null | undefined
+  worktreeId: string
+  actionId: SourceControlLaunchActionId | null
   prompt: string
-): Promise<void> {
-  // Each request is awaited outside its catch so a transport drop propagates as the original
-  // error object; only a refusal is rewritten into the step's own copy.
-  const createdReply = await reviewTerminalCreateRun.request(client, {
-    worktree: `id:${worktreeId}`,
-    activate: false,
-    select: true,
-    navigation: 'caller'
-  })
-  let terminalTab
-  try {
-    terminalTab = reviewTerminalCreateRun.interpret(createdReply)
-  } catch (error) {
-    throw new Error(refusedRpcMessageOrFallback(error, 'Failed to create terminal'))
+  launchSource: string
+}): Promise<MobilePromptedAgentLaunch> {
+  if (!supportsMobileExistingAgentLaunch(args.hostCapabilities)) {
+    return { kind: 'not-started', message: AGENT_LAUNCH_UPDATE_REQUIRED_MESSAGE }
   }
-  const sentReply = await reviewTerminalSendRun.request(client, {
-    terminal: terminalTab.terminal,
-    text: prompt,
-    enter: true
-  })
-  let accepted
+  let resolved
   try {
-    accepted = reviewTerminalSendRun.interpret(sentReply)
+    resolved = resolveMobileSourceControlLaunchAgent(
+      await loadMobileAgentLaunchContext({ client: args.client, worktreeId: args.worktreeId }),
+      args.actionId
+    )
   } catch (error) {
-    throw new Error(refusedRpcMessageOrFallback(error, 'Failed to send prompt'))
+    const message = error instanceof Error ? error.message.trim() : ''
+    return { kind: 'not-started', message: message || 'Could not load the available agents.' }
   }
-  if (!accepted) {
-    throw new Error('Terminal input is locked')
+  if (resolved.kind === 'unavailable') {
+    return { kind: 'not-started', message: resolved.message }
+  }
+  const { recipe } = resolved
+  // The desktop wraps each action's prompt in the user's saved template the same way.
+  const text = args.actionId
+    ? buildSourceControlRecoveryAgentCommandInput({
+        actionId: args.actionId,
+        commandInputTemplate: recipe?.commandInputTemplate,
+        basePrompt: args.prompt
+      })
+    : args.prompt
+  if (!text) {
+    return {
+      kind: 'not-started',
+      message:
+        "This action's saved prompt is empty. Update Source Control AI settings on your computer."
+    }
+  }
+  const launched = await launchAgentInExistingWorkspace({
+    client: args.client,
+    hostCapabilities: args.hostCapabilities,
+    worktreeId: args.worktreeId,
+    agent: resolved.agent,
+    // Why no saved agent arguments: whether they apply depends on the route and shell the host picks
+    // after this request, so the phone leaves them out and the agent's default arguments apply.
+    prompt: { text, delivery: 'submit' },
+    launchSource: args.launchSource
+  })
+  switch (launched.kind) {
+    case 'launched': {
+      const warning = launched.result.warning?.trim()
+      const extra = warning ? { warning } : {}
+      return launched.promptDelivered
+        ? { kind: 'sent', ...extra }
+        : { kind: 'prompt-not-sent', prompt: text, ...extra }
+    }
+    case 'unsupported':
+      return { kind: 'not-started', message: AGENT_LAUNCH_UPDATE_REQUIRED_MESSAGE }
+    case 'failed':
+      return { kind: 'not-started', message: launched.message }
+    case 'unknown':
+      return { kind: 'unconfirmed', message: launched.message }
+  }
+}
+
+/** The confirmation under an AI button, naming the workspace when the screen knows it. */
+export function agentStartedMessage(workspaceLabel: string | null | undefined): string {
+  const label = workspaceLabel?.trim()
+  return label ? `Agent started in ${label}` : 'Agent started'
+}
+
+/** What the button shows after a launch; one mapping so every AI button reads the same.
+ *  `warning` is the host's note on a launch that went ahead, so it is never shown as a failure. */
+export function promptedLaunchNotice(
+  result: MobilePromptedAgentLaunch,
+  workspaceLabel?: string | null
+): {
+  succeeded: boolean
+  success: string | null
+  error: string | null
+  warning: string | null
+  undeliveredPrompt: string | null
+} {
+  switch (result.kind) {
+    case 'sent':
+      return {
+        succeeded: true,
+        success: agentStartedMessage(workspaceLabel),
+        error: null,
+        warning: result.warning ?? null,
+        undeliveredPrompt: null
+      }
+    case 'prompt-not-sent':
+      return {
+        succeeded: false,
+        success: null,
+        error: AGENT_PROMPT_NOT_SENT_MESSAGE,
+        warning: result.warning ?? null,
+        undeliveredPrompt: result.prompt
+      }
+    case 'not-started':
+    case 'unconfirmed':
+      return {
+        succeeded: false,
+        success: null,
+        error: result.message,
+        warning: null,
+        undeliveredPrompt: null
+      }
   }
 }
diff --git a/mobile/src/session/quick-commands-tab-stability-source.test.ts b/mobile/src/session/quick-commands-tab-stability-source.test.ts
deleted file mode 100644
index 9c744a5f982..00000000000
--- a/mobile/src/session/quick-commands-tab-stability-source.test.ts
+++ /dev/null
@@ -1,67 +0,0 @@
-import ts from 'typescript'
-import { describe, expect, it } from 'vitest'
-import { readMobileSessionRouteSource } from './mobile-session-route-source-family.test-support'
-
-const sourcePath = './MobileSessionHeader.tsx'
-const source = readMobileSessionRouteSource(sourcePath)
-const sheetsSource = readMobileSessionRouteSource('./MobileSessionSheets.tsx')
-const sourceFile = ts.createSourceFile(
-  sourcePath,
-  source,
-  ts.ScriptTarget.Latest,
-  true,
-  ts.ScriptKind.TSX
-)
-
-function findQuickCommandsTabButtons(): ts.JsxSelfClosingElement[] {
-  const matches: ts.JsxSelfClosingElement[] = []
-
-  function visit(node: ts.Node): void {
-    if (
-      ts.isJsxSelfClosingElement(node) &&
-      node.tagName.getText(sourceFile) === 'QuickCommandsTabButton'
-    ) {
-      matches.push(node)
-    }
-    ts.forEachChild(node, visit)
-  }
-
-  visit(sourceFile)
-  return matches
-}
-
-function getQuickCommandsTabSource(): string {
-  const start = source.indexOf('accessibilityLabel="New tab"')
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = source.indexOf('</SafeAreaView>', start)
-  expect(end).toBeGreaterThan(start)
-  return source.slice(start, end)
-}
-
-describe('quick-commands tab stability', () => {
-  it('keeps the button mounted while preserving the capability gate', () => {
-    const tabSource = getQuickCommandsTabSource()
-    const buttons = findQuickCommandsTabButtons()
-
-    expect(buttons).toHaveLength(1)
-    const tabBar = buttons[0].parent
-    expect(ts.isJsxElement(tabBar)).toBe(true)
-    if (!ts.isJsxElement(tabBar)) {
-      return
-    }
-    expect(tabBar.openingElement.tagName.getText(sourceFile)).toBe('View')
-    const style = tabBar.openingElement.attributes.properties.find(
-      (attribute): attribute is ts.JsxAttribute =>
-        ts.isJsxAttribute(attribute) && attribute.name.getText(sourceFile) === 'style'
-    )
-    expect(style?.initializer?.getText(sourceFile)).toBe('{styles.tabBar}')
-    expect(tabSource).toContain('if (quickCommandsSupported === true)')
-    expect(tabSource).toContain('setShowQuickCommands(true)')
-    expect(tabSource).toContain('Desktop update required for quick commands')
-    expect(tabSource).toContain('Checking desktop capabilities — try again in a moment')
-  })
-
-  it('only presents the sheet after support is confirmed', () => {
-    expect(sheetsSource).toContain('visible={showQuickCommands && quickCommandsSupported === true}')
-  })
-})
diff --git a/mobile/src/session/session-read-reply-schema.ts b/mobile/src/session/session-read-reply-schema.ts
index 2a2417c6673..14d163360a0 100644
--- a/mobile/src/session/session-read-reply-schema.ts
+++ b/mobile/src/session/session-read-reply-schema.ts
@@ -106,17 +106,20 @@ export const sessionWorktreeRecordSchema = z
 /**
  * A markdown tab's document, read the same way on load and on save.
  *
- * `content`, `version` and `isDirty` are required: use-mobile-session-document-readers.ts:38-45
- * publishes all three into the tab's ready state with no guard, so a reply missing one rendered
- * `undefined` in the editor and saved against an undefined base version.
- * `editable` and `readOnlyReason` are guarded on the same lines and stay optional.
+ * `content`, `version` and `isDirty` are required: `readMarkdownTab` in
+ * `useMobileSessionDocumentReaders` publishes all three into the tab's ready state with no guard,
+ * so a reply missing one rendered `undefined` in the editor and saved against an undefined base
+ * version. `editable` and `readOnlyReason` are guarded there and stay optional, as are
+ * `truncated` and `byteLength`, which only a host that truncates oversize documents sends.
  */
 export const markdownTabDocumentSchema = z.looseObject({
   content: z.string(),
   version: z.string(),
   isDirty: z.boolean(),
   editable: salvagedOptional('editable', z.boolean()),
-  readOnlyReason: salvagedOptional('readOnlyReason', z.string())
+  readOnlyReason: salvagedOptional('readOnlyReason', z.string()),
+  truncated: salvagedOptional('truncated', z.boolean()),
+  byteLength: salvagedOptional('byteLength', z.number())
 })
 
 /**
diff --git a/mobile/src/session/session-router-seam-census.test.ts b/mobile/src/session/session-router-seam-census.test.ts
deleted file mode 100644
index 9f73a5434ca..00000000000
--- a/mobile/src/session/session-router-seam-census.test.ts
+++ /dev/null
@@ -1,79 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import {
-  callsRouteHandoff,
-  expoRouterValueImports,
-  parse,
-  productFiles
-} from '../navigation/router-seam-census.test-support'
-
-const SESSION_ROOT = import.meta.dirname
-
-/**
- * Which modules here hold a router, so the census cannot pass by seeing nothing.
- *
- * Four, and each for a different target. The foundation hook bounces a deleted workspace back to
- * its host; the file-tap handlers push a preview route from a terminal link or a chat path; the
- * notification hook consumes a pane tap by rewriting this route's own params; the review route
- * body replaces to the session screen and pops the stack behind it. Only the first two and the
- * last can leave the page, which is the whole reason the third is in the list anyway — a
- * `setParams` on expo-router's router and a `setParams` on the handoff's are the same call, and
- * listing it here is what stops someone later giving it back its own `useRouter` because "it never
- * navigates".
- */
-const ROUTER_HOLDERS = [
-  'MobileDiffReviewRouteScreen.tsx',
-  'use-mobile-file-tap-handlers.ts',
-  'use-mobile-session-foundation.ts',
-  'use-notification-pane-navigation.ts'
-]
-
-/**
- * The expo-router names this domain may still import, and why each one is not a router.
- *
- * `useFocusEffect` reads whether this screen is the focused one in the document's own stack and
- * `useLocalSearchParams` reads the params of the route already mounted. Neither takes a target, so
- * neither can put a screen in front of the page; both are the page's own router answering about the
- * page's own route, which is exactly what it is for.
- *
- * A closed list rather than a ban on `useRouter`: the hazard is anything that navigates, and
- * expo-router exports a module-singleton `router` that does it from a plain function. A rule written
- * against the one spelling would have read that as clean.
- */
-const NON_NAVIGATING_ROUTER_NAMES = ['useFocusEffect', 'useLocalSearchParams']
-
-describe('the session domain reaches the router through the handoff seam', () => {
-  const files = productFiles(SESSION_ROOT)
-
-  it('walks the modules it is written against', () => {
-    expect(files).toEqual(expect.arrayContaining(ROUTER_HOLDERS))
-    expect(files.length).toBeGreaterThan(200)
-  })
-
-  it('imports nothing from expo-router that can navigate', () => {
-    const offenders = files
-      .map((name) => ({
-        name,
-        imported: expoRouterValueImports(parse(SESSION_ROOT, name)).filter(
-          (imported) => !NON_NAVIGATING_ROUTER_NAMES.includes(imported)
-        )
-      }))
-      .filter((entry) => entry.imported.length > 0)
-      .map((entry) => `${entry.name} (${entry.imported.join(', ')})`)
-    expect(offenders).toEqual([])
-  })
-
-  it('takes the router from useRouteHandoff at every screen that holds one', () => {
-    expect(files.filter((name) => callsRouteHandoff(parse(SESSION_ROOT, name))).sort()).toEqual(
-      [...ROUTER_HOLDERS].sort()
-    )
-  })
-
-  it('still reaches expo-router for the two names that answer about its own route', () => {
-    // The completeness half: the rule above also passes over a domain that imports nothing at all,
-    // which is what it would read as if someone moved these hooks and left the list behind.
-    const imported = new Set(
-      files.flatMap((name) => expoRouterValueImports(parse(SESSION_ROOT, name)))
-    )
-    expect([...imported].sort()).toEqual([...NON_NAVIGATING_ROUTER_NAMES].sort())
-  })
-})
diff --git a/mobile/src/session/terminal-field-submit-binding-wiring.test.ts b/mobile/src/session/terminal-field-submit-binding-wiring.test.ts
deleted file mode 100644
index 25a4761af85..00000000000
--- a/mobile/src/session/terminal-field-submit-binding-wiring.test.ts
+++ /dev/null
@@ -1,66 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { readMobileSessionRouteSource } from './mobile-session-route-source-family.test-support'
-
-const sendActionsSource = readMobileSessionRouteSource(
-  './use-mobile-session-terminal-send-actions.ts'
-)
-
-const BINDING_CALL = 'useTerminalTextFieldSubmitBinding('
-
-/** The handler each field hands its submit binding, in source order. */
-function readBoundSubmitNames(source: string): string[] {
-  const names: string[] = []
-  let at = source.indexOf(BINDING_CALL)
-  while (at >= 0) {
-    const args = source.slice(at + BINDING_CALL.length, source.indexOf(')', at))
-    const handler = args.split(',')[1]?.trim()
-    if (handler) {
-      names.push(handler)
-    }
-    at = source.indexOf(BINDING_CALL, at + 1)
-  }
-  return names
-}
-
-/**
- * The rule: a handler bound through `useTerminalTextFieldSubmitBinding` must not be frozen on an
- * empty dependency list.
- *
- * `handleSend` is a per-render function whose guard reads `client`, `activeHandle` and `canSend`,
- * all absent on the first render, so a submit memoized on `[]` is one closure for the life of the
- * component and the field's line-break submit can never pass that guard. The field's own
- * `onSubmitEditing` prop keeps working, which is what hid it.
- *
- * Why a source rule and not a render: every check that mounts its own submit writes the identity
- * under test itself, so the render rig's probe route could catch neither the defect nor the fix.
- * `terminal-field-submit-binding-send.test.tsx` reads the behaviour instead and catches spellings
- * this cannot; this one is the cheap guard beside it.
- */
-describe('the submit handlers the terminal fields bind', () => {
-  it('names one handler per bound field', () => {
-    expect(readBoundSubmitNames(sendActionsSource)).toEqual([
-      'submitLiveInput',
-      'submitBufferedDraft'
-    ])
-  })
-
-  it('freezes none of them on an empty dependency list', () => {
-    for (const name of readBoundSubmitNames(sendActionsSource)) {
-      const declaredAt = sendActionsSource.indexOf(`const ${name} = `)
-      expect(declaredAt).toBeGreaterThanOrEqual(0)
-      const boundAt = sendActionsSource.indexOf(`${BINDING_CALL}`, declaredAt)
-      expect(boundAt).toBeGreaterThan(declaredAt)
-      expect(sendActionsSource.slice(declaredAt, boundAt)).not.toContain('}, [])')
-    }
-  })
-
-  // The other half of the rule: a handler that is memoized must name what it reads, so the closure
-  // moves when the send guard's inputs do.
-  it('gives the live input submit the dependencies its closure reads', () => {
-    const declaredAt = sendActionsSource.indexOf('const submitLiveInput = ')
-    const boundAt = sendActionsSource.indexOf(BINDING_CALL, declaredAt)
-    const slice = sendActionsSource.slice(declaredAt, boundAt)
-    expect(slice).toContain('handleLiveInputSubmit')
-    expect(slice).toContain('activeSessionTab')
-  })
-})
diff --git a/mobile/src/session/use-mobile-diff-review-comment-actions.ts b/mobile/src/session/use-mobile-diff-review-comment-actions.ts
index d49350f1519..b5e2df91e16 100644
--- a/mobile/src/session/use-mobile-diff-review-comment-actions.ts
+++ b/mobile/src/session/use-mobile-diff-review-comment-actions.ts
@@ -21,6 +21,7 @@ import {
   nextReviewIndexAfterMarkReviewed,
   reviewDescriptorFromItem
 } from './mobile-diff-review-screen-model'
+import type { ReviewSheetIntents } from './mobile-diff-review-sheets'
 
 type CommentActionsInput = {
   client: RpcClient | null
@@ -36,10 +37,9 @@ type CommentActionsInput = {
   composerBody: string
   setScreenState: Dispatch<SetStateAction<ReviewScreenState>>
   setCurrentIndex: Dispatch<SetStateAction<number>>
-  setComposer: Dispatch<SetStateAction<ComposerState | null>>
   setComposerBody: Dispatch<SetStateAction<string>>
   setActionError: Dispatch<SetStateAction<string | null>>
-  setShowCompletion: Dispatch<SetStateAction<boolean>>
+  sheets: Pick<ReviewSheetIntents, 'openSheet' | 'openSheetWhenIdle' | 'closeSheet'>
 }
 
 export function useMobileDiffReviewCommentActions(input: CommentActionsInput) {
@@ -57,11 +57,11 @@ export function useMobileDiffReviewCommentActions(input: CommentActionsInput) {
     composerBody,
     setScreenState,
     setCurrentIndex,
-    setComposer,
     setComposerBody,
     setActionError,
-    setShowCompletion
+    sheets
   } = input
+  const { openSheet, openSheetWhenIdle, closeSheet } = sheets
 
   const persistMetadata = useCallback(
     async (comments: readonly DiffComment[], reviewState: MobileDiffReviewState) => {
@@ -109,24 +109,24 @@ export function useMobileDiffReviewCommentActions(input: CommentActionsInput) {
 
   const openComposer = useCallback(
     (lineNumber: number) => {
-      setComposer({ mode: 'create', lineNumber })
+      openSheet({ kind: 'composer', composer: { mode: 'create', lineNumber } })
       setComposerBody('')
     },
-    [setComposer, setComposerBody]
+    [openSheet, setComposerBody]
   )
 
   const openEditComposer = useCallback(
     (comment: DiffComment) => {
-      setComposer({ mode: 'edit', comment })
+      openSheet({ kind: 'composer', composer: { mode: 'edit', comment } })
       setComposerBody(comment.body)
     },
-    [setComposer, setComposerBody]
+    [openSheet, setComposerBody]
   )
 
   const closeComposer = useCallback(() => {
-    setComposer(null)
+    closeSheet('composer')
     setComposerBody('')
-  }, [setComposer, setComposerBody])
+  }, [closeSheet, setComposerBody])
 
   const saveComposer = useCallback(async () => {
     if (!composer || !currentItem || screenState.kind !== 'ready') {
@@ -201,18 +201,19 @@ export function useMobileDiffReviewCommentActions(input: CommentActionsInput) {
     if (nextIndex !== null) {
       setCurrentIndex(nextIndex)
     } else {
-      setShowCompletion(true)
+      // Why: the save can outlast a sheet the user opened meanwhile; never stack on or close it.
+      openSheetWhenIdle({ kind: 'completion' })
     }
   }, [
     currentIndex,
     currentItem,
     filter,
     filteredQueue,
+    openSheetWhenIdle,
     queue,
     saveCommentsAndReviewState,
     screenState,
-    setCurrentIndex,
-    setShowCompletion
+    setCurrentIndex
   ])
 
   const markUnreviewed = useCallback(async () => {
diff --git a/mobile/src/session/use-mobile-diff-review-controller.test.ts b/mobile/src/session/use-mobile-diff-review-controller.test.ts
index 5056b3cb546..31db5abf911 100644
--- a/mobile/src/session/use-mobile-diff-review-controller.test.ts
+++ b/mobile/src/session/use-mobile-diff-review-controller.test.ts
@@ -43,6 +43,9 @@ describe('useMobileDiffReviewController', () => {
     const controller = useMobileDiffReviewController({
       client,
       connState,
+      hostCapabilities: [],
+      hostStatusPending: false,
+      hostStatusReadable: true,
       hostId: 'host-1',
       worktreeId: 'wt-1',
       name: 'review',
diff --git a/mobile/src/session/use-mobile-diff-review-controller.ts b/mobile/src/session/use-mobile-diff-review-controller.ts
index 1efab1fe4ee..ae5648f6053 100644
--- a/mobile/src/session/use-mobile-diff-review-controller.ts
+++ b/mobile/src/session/use-mobile-diff-review-controller.ts
@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
+import { useCallback, useEffect, useMemo, useReducer, useRef, useState } from 'react'
 import type { FlatList } from 'react-native'
 import type { DiffComment } from '../../../src/shared/diff-comment-types'
 import type { ConnectionState } from '../transport/types'
@@ -10,8 +10,7 @@ import {
   filterMobileDiffReviewQueue,
   mobileDiffReviewCommentMatchesItem,
   summarizeMobileDiffReviewQueue,
-  type MobileDiffReviewQueueFilter,
-  type MobileDiffReviewQueueItem
+  type MobileDiffReviewQueueFilter
 } from './mobile-diff-review-queue'
 import {
   findMobileDiffReviewInitialIndex,
@@ -20,18 +19,23 @@ import {
 import { loadMobileDiffReviewSnapshot } from './mobile-diff-review-loaders'
 import { useMobileDiffReviewDiffLoading } from './use-mobile-diff-review-diff-loading'
 import { canOpenMobileBranchCompareDiff } from '../source-control/mobile-branch-compare'
-import type {
-  ComposerState,
-  ReviewDiffLine,
-  ReviewScreenState,
-  SendSheetState
-} from './mobile-diff-review-screen-model'
+import type { ReviewDiffLine, ReviewScreenState } from './mobile-diff-review-screen-model'
+import {
+  NO_REVIEW_SHEETS,
+  reduceReviewSheets,
+  reviewComposer,
+  reviewSheetIntents
+} from './mobile-diff-review-sheets'
 import { useMobileDiffReviewInteractions } from './use-mobile-diff-review-interactions'
+import { resolveMobileAgentLaunchAvailability } from './mobile-agent-launch-availability'
 import { useMobilePrSidebarController } from './use-mobile-pr-sidebar-controller'
 
 type ControllerInput = {
   client: RpcClient | null
   connState: ConnectionState
+  hostCapabilities: readonly string[]
+  hostStatusPending: boolean
+  hostStatusReadable: boolean
   hostId: string
   worktreeId: string
   name: string
@@ -46,6 +50,9 @@ export function useMobileDiffReviewController(input: ControllerInput) {
   const {
     client,
     connState,
+    hostCapabilities,
+    hostStatusPending,
+    hostStatusReadable,
     hostId,
     worktreeId,
     name,
@@ -62,14 +69,12 @@ export function useMobileDiffReviewController(input: ControllerInput) {
   const [filter, setFilter] = useState<MobileDiffReviewQueueFilter>(initialFilter)
   const [currentIndex, setCurrentIndex] = useState(0)
   const [activeHunkIndex, setActiveHunkIndex] = useState<number | null>(null)
-  const [composer, setComposer] = useState<ComposerState | null>(null)
+  const [sheets, dispatchSheets] = useReducer(reduceReviewSheets, NO_REVIEW_SHEETS)
+  const sheetIntents = useMemo(() => reviewSheetIntents(dispatchSheets), [])
+  const composer = reviewComposer(sheets)
   const [composerBody, setComposerBody] = useState('')
   const [actionError, setActionError] = useState<string | null>(null)
   const [busyAction, setBusyAction] = useState<string | null>(null)
-  const [discardTarget, setDiscardTarget] = useState<MobileDiffReviewQueueItem | null>(null)
-  const [showOverflow, setShowOverflow] = useState(false)
-  const [sendSheet, setSendSheet] = useState<SendSheetState | null>(null)
-  const [showCompletion, setShowCompletion] = useState(false)
   const worktreeLabel = getWorktreeLabel(name, worktreeId)
 
   const loadReviewData = useCallback(async () => {
@@ -227,6 +232,7 @@ export function useMobileDiffReviewController(input: ControllerInput) {
   const interactions = useMobileDiffReviewInteractions({
     client,
     connState,
+    hostCapabilities,
     hostId,
     worktreeId,
     screenState,
@@ -244,12 +250,10 @@ export function useMobileDiffReviewController(input: ControllerInput) {
     setFilter,
     setCurrentIndex,
     setActiveHunkIndex,
-    setComposer,
     setComposerBody,
     setActionError,
     setBusyAction,
-    setSendSheet,
-    setShowCompletion,
+    sheets: sheetIntents,
     loadReviewData,
     onOpenSession,
     onReconnect
@@ -258,6 +262,12 @@ export function useMobileDiffReviewController(input: ControllerInput) {
   return {
     ...interactions,
     ...prSidebar,
+    ...sheetIntents,
+    agentLaunchAvailability: resolveMobileAgentLaunchAvailability({
+      hostCapabilities,
+      statusPending: hostStatusPending,
+      statusReadable: hostStatusReadable
+    }),
     // Exposed so the screen can thread the RPC client + worktree into the PR
     // sidebar's lazy check-detail fetches (U5) and mutation actions (U6).
     client,
@@ -274,7 +284,6 @@ export function useMobileDiffReviewController(input: ControllerInput) {
     currentIndex,
     currentItem,
     diffState,
-    discardTarget,
     fileNotes: commentsByLine.get(0) ?? [],
     filter,
     filteredQueue,
@@ -283,14 +292,8 @@ export function useMobileDiffReviewController(input: ControllerInput) {
     reviewedCount,
     reviewedUnstagedCount,
     screenState,
-    sendSheet,
     setComposerBody,
-    setDiscardTarget,
-    setSendSheet,
-    setShowCompletion,
-    setShowOverflow,
-    showCompletion,
-    showOverflow,
+    sheet: sheets.requested,
     staleCommentIds,
     unsentComments,
     worktreeLabel
diff --git a/mobile/src/session/use-mobile-diff-review-interactions.ts b/mobile/src/session/use-mobile-diff-review-interactions.ts
index 53dc69fadad..f3a5d855eaa 100644
--- a/mobile/src/session/use-mobile-diff-review-interactions.ts
+++ b/mobile/src/session/use-mobile-diff-review-interactions.ts
@@ -12,9 +12,9 @@ import type {
   ComposerState,
   ReviewDiffLine,
   ReviewDiffState,
-  ReviewScreenState,
-  SendSheetState
+  ReviewScreenState
 } from './mobile-diff-review-screen-model'
+import type { ReviewSheetIntents } from './mobile-diff-review-sheets'
 import { sourceFileDiffOpenRun } from '../source-control/mobile-source-file-open-operations'
 import { refusedRpcMessageOrFallback } from '../transport/rpc-refusal-message'
 import { useMobileDiffReviewCommentActions } from './use-mobile-diff-review-comment-actions'
@@ -25,6 +25,7 @@ import { connectionRetryAction } from '../transport/connection-retry-action'
 type InteractionInput = {
   client: RpcClient | null
   connState: ConnectionState
+  hostCapabilities: readonly string[]
   hostId: string
   worktreeId: string
   screenState: ReviewScreenState
@@ -42,12 +43,10 @@ type InteractionInput = {
   setFilter: Dispatch<SetStateAction<MobileDiffReviewQueueFilter>>
   setCurrentIndex: Dispatch<SetStateAction<number>>
   setActiveHunkIndex: Dispatch<SetStateAction<number | null>>
-  setComposer: Dispatch<SetStateAction<ComposerState | null>>
   setComposerBody: Dispatch<SetStateAction<string>>
   setActionError: Dispatch<SetStateAction<string | null>>
   setBusyAction: Dispatch<SetStateAction<string | null>>
-  setSendSheet: Dispatch<SetStateAction<SendSheetState | null>>
-  setShowCompletion: Dispatch<SetStateAction<boolean>>
+  sheets: ReviewSheetIntents
   loadReviewData: () => Promise<void>
   onOpenSession: () => void
   onReconnect: ((hostId: string) => void | Promise<void>) | null
@@ -57,6 +56,7 @@ export function useMobileDiffReviewInteractions(input: InteractionInput) {
   const {
     client,
     connState,
+    hostCapabilities,
     hostId,
     worktreeId,
     screenState,
@@ -74,12 +74,10 @@ export function useMobileDiffReviewInteractions(input: InteractionInput) {
     setFilter,
     setCurrentIndex,
     setActiveHunkIndex,
-    setComposer,
     setComposerBody,
     setActionError,
     setBusyAction,
-    setSendSheet,
-    setShowCompletion,
+    sheets,
     loadReviewData,
     onOpenSession,
     onReconnect
@@ -108,10 +106,9 @@ export function useMobileDiffReviewInteractions(input: InteractionInput) {
     composerBody,
     setScreenState,
     setCurrentIndex,
-    setComposer,
     setComposerBody,
     setActionError,
-    setShowCompletion
+    sheets
   })
 
   const { runGitMutation, stageReviewedFiles } = useMobileDiffReviewGitActions({
@@ -128,10 +125,11 @@ export function useMobileDiffReviewInteractions(input: InteractionInput) {
     useMobileDiffReviewSendActions({
       client,
       connState,
+      hostCapabilities,
       worktreeId,
       screenState,
       setActionError,
-      setSendSheet,
+      sheets,
       saveCommentsAndReviewState
     })
 
diff --git a/mobile/src/session/use-mobile-diff-review-send-actions.test.ts b/mobile/src/session/use-mobile-diff-review-send-actions.test.ts
index f763a8f3078..125e2e58350 100644
--- a/mobile/src/session/use-mobile-diff-review-send-actions.test.ts
+++ b/mobile/src/session/use-mobile-diff-review-send-actions.test.ts
@@ -1,9 +1,11 @@
 import { createElement } from 'react'
 import { act, create, type ReactTestRenderer } from 'react-test-renderer'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
 import type { DiffComment } from '../../../src/shared/diff-comment-types'
 import type { RpcClient } from '../transport/rpc-client'
+import type { RpcResponse } from '../transport/types'
 import type { ReviewScreenState } from './mobile-diff-review-screen-model'
+import type { ReviewSheetIntents } from './mobile-diff-review-sheets'
 import {
   isMobileNativeChatInputStale,
   markMobileNativeChatInputStale,
@@ -11,6 +13,21 @@ import {
 } from './mobile-native-chat-stale-input'
 import { useMobileDiffReviewSendActions } from './use-mobile-diff-review-send-actions'
 
+// A connected client whose only behaviour is the scripted `sendRequest`.
+function requestPortRpcClient(sendRequest: RpcClient['sendRequest']): RpcClient {
+  return {
+    sendRequest,
+    subscribe: () => () => {},
+    updateTerminalSubscriptionViewport: () => {},
+    getState: () => 'connected',
+    getReconnectAttempt: () => 0,
+    getLastConnectedAt: () => null,
+    onStateChange: () => () => {},
+    notifyForeground: () => {},
+    close: () => {}
+  }
+}
+
 type SendActions = ReturnType<typeof useMobileDiffReviewSendActions>
 
 vi.mock('../platform/haptics', () => ({ triggerSuccess: vi.fn() }))
@@ -38,6 +55,46 @@ const COMMENT: DiffComment = {
   side: 'modified'
 }
 
+const LAUNCH_CAPABILITIES = [
+  'agent.launch.v2',
+  'agent.launch.replay.v1',
+  'agent.launch.replay-required.v1'
+]
+
+function rpcReply(result: unknown) {
+  return { id: 'rpc', ok: true as const, result, _meta: { runtimeId: 'r' } }
+}
+
+function launchedReply(promptOutcome: 'handed-to-terminal' | 'not-delivered', warning?: string) {
+  return rpcReply({
+    outcome: { kind: 'terminal', handle: 'term-1' },
+    worktreeId: 'wt-1',
+    receipt: { mode: 'terminal', preferred: 'terminal', reason: 'user_default', detail: 'd' },
+    prompt: { delivery: 'submit', outcome: promptOutcome },
+    ...(warning ? { warning } : {})
+  })
+}
+
+// Answers the agent loader's reads and the launch, by method.
+function launchClient(
+  promptOutcome: 'handed-to-terminal' | 'not-delivered',
+  launchReply: () => Promise<RpcResponse> = async () => launchedReply(promptOutcome)
+) {
+  const sendRequest = vi.fn(async (method: string, _params?: unknown): Promise<RpcResponse> => {
+    if (method === 'repo.list') {
+      return rpcReply({ repos: [{ id: 'wt-1' }] })
+    }
+    if (method === 'settings.get') {
+      return rpcReply({ settings: { defaultTuiAgent: 'codex' } })
+    }
+    if (method === 'preflight.detectAgents') {
+      return rpcReply(['codex'])
+    }
+    return launchReply()
+  })
+  return { client: requestPortRpcClient(sendRequest), sendRequest }
+}
+
 const READY: ReviewScreenState = {
   kind: 'ready',
   status: { entries: [], conflictOperation: 'none' },
@@ -51,14 +108,20 @@ describe('useMobileDiffReviewSendActions', () => {
   let actions: SendActions | null = null
   let mountedClient: RpcClient | null = null
   let setActionError: ReturnType<typeof vi.fn>
-  let setSendSheet: ReturnType<typeof vi.fn>
+  let sheets: {
+    openSheet: Mock<ReviewSheetIntents['openSheet']>
+    closeSheet: Mock<ReviewSheetIntents['closeSheet']>
+    updateSendSheet: Mock<ReviewSheetIntents['updateSendSheet']>
+  }
   let saveCommentsAndReviewState: ReturnType<typeof vi.fn>
+  let screenState: ReviewScreenState = READY
 
   beforeEach(() => {
+    screenState = READY
     clipboardMock.setStringAsync.mockReset().mockResolvedValue(true)
     resetMobileNativeChatStaleInputForTests()
     setActionError = vi.fn()
-    setSendSheet = vi.fn()
+    sheets = { openSheet: vi.fn(), closeSheet: vi.fn(), updateSendSheet: vi.fn() }
     saveCommentsAndReviewState = vi.fn().mockResolvedValue(undefined)
   })
 
@@ -73,10 +136,11 @@ describe('useMobileDiffReviewSendActions', () => {
     actions = useMobileDiffReviewSendActions({
       client: mountedClient,
       connState: 'connected',
+      hostCapabilities: LAUNCH_CAPABILITIES,
       worktreeId: 'wt-1',
-      screenState: READY,
+      screenState,
       setActionError,
-      setSendSheet,
+      sheets,
       saveCommentsAndReviewState
     })
     return null
@@ -158,7 +222,7 @@ describe('useMobileDiffReviewSendActions', () => {
     expect(sendRequest.mock.calls[0]?.[1]).toMatchObject({ text: '\x15', enter: false })
     expect(saveCommentsAndReviewState).not.toHaveBeenCalled()
     expect(setActionError).not.toHaveBeenCalled()
-    expect(setSendSheet).not.toHaveBeenCalled()
+    expect(sheets.closeSheet).not.toHaveBeenCalled()
     // Marker survives for the next attempt.
     expect(isMobileNativeChatInputStale('terminal-1')).toBe(true)
   })
@@ -192,7 +256,7 @@ describe('useMobileDiffReviewSendActions', () => {
     expect(sendRequest.mock.calls[0]?.[1]).toMatchObject({ terminal: 'terminal-1', enter: true })
     expect(saveCommentsAndReviewState).toHaveBeenCalledTimes(1)
     expect(setActionError).toHaveBeenCalledWith('Review notes sent')
-    expect(setSendSheet).toHaveBeenCalledWith(null)
+    expect(sheets.closeSheet).toHaveBeenCalledWith('send')
   })
 
   it('only heals the terminal that was marked', async () => {
@@ -239,4 +303,141 @@ describe('useMobileDiffReviewSendActions', () => {
     expect((error as Error).message).toBe('pane gone')
     expect(saveCommentsAndReviewState).not.toHaveBeenCalled()
   })
+
+  it('starts a new agent with the notes through the host and marks them sent', async () => {
+    const { client, sendRequest } = launchClient('handed-to-terminal')
+    await mount(client)
+    await act(async () => {
+      await actions?.createTerminalAndSend([COMMENT])
+    })
+    const launch = sendRequest.mock.calls.find(([method]) => method === 'agent.launchReplay')
+    expect(launch?.[1]).toMatchObject({
+      agent: 'codex',
+      target: { kind: 'existing', worktree: 'id:wt-1' },
+      prompt: { delivery: 'submit' },
+      launchSource: 'notes_send'
+    })
+    expect(sendRequest.mock.calls.some(([method]) => method === 'terminal.send')).toBe(false)
+    expect(saveCommentsAndReviewState).toHaveBeenCalledOnce()
+    expect(setActionError).toHaveBeenLastCalledWith('Review notes sent')
+  })
+
+  it('keeps saying the notes were sent when the host adds a warning', async () => {
+    await mount(
+      launchClient('handed-to-terminal', async () =>
+        launchedReply('handed-to-terminal', 'the requested arguments were ignored.')
+      ).client
+    )
+    await act(async () => {
+      await actions?.createTerminalAndSend([COMMENT])
+    })
+    expect(saveCommentsAndReviewState).toHaveBeenCalledOnce()
+    expect(setActionError).toHaveBeenLastCalledWith(
+      'Review notes sent. the requested arguments were ignored.'
+    )
+  })
+
+  it('says it is waiting for the desktop instead of rejecting when there is no connection', async () => {
+    await mountWithoutClient()
+    await act(async () => {
+      await expect(actions?.createTerminalAndSend([COMMENT])).resolves.toBeUndefined()
+    })
+    expect(sheets.closeSheet).toHaveBeenCalledWith('send')
+    expect(setActionError).toHaveBeenLastCalledWith('Waiting for desktop...')
+  })
+
+  it('keeps the notes unsent when the agent started without them', async () => {
+    await mount(launchClient('not-delivered').client)
+    await act(async () => {
+      await actions?.createTerminalAndSend([COMMENT])
+    })
+    expect(saveCommentsAndReviewState).not.toHaveBeenCalled()
+    expect(setActionError).toHaveBeenLastCalledWith(
+      "The agent started, but the notes weren't sent. Use Copy Notes to paste them."
+    )
+  })
+
+  it('shows a launch that did not start on the review screen instead of rejecting', async () => {
+    await mount(
+      launchClient('handed-to-terminal', async () => ({
+        id: 'rpc',
+        ok: false,
+        error: { code: 'selector_not_found', message: 'Workspace not found' },
+        _meta: { runtimeId: 'r' }
+      })).client
+    )
+    await act(async () => {
+      await actions?.createTerminalAndSend([COMMENT])
+    })
+    expect(sheets.closeSheet).toHaveBeenCalledWith('send')
+    expect(setActionError).toHaveBeenLastCalledWith('Workspace not found')
+    expect(saveCommentsAndReviewState).not.toHaveBeenCalled()
+  })
+
+  it('starts one agent for a double tap and keeps notes written while it starts', async () => {
+    let answerLaunch: (reply: RpcResponse) => void = () => {}
+    const { client, sendRequest } = launchClient(
+      'handed-to-terminal',
+      () =>
+        new Promise<RpcResponse>((resolve) => {
+          answerLaunch = resolve
+        })
+    )
+    await mount(client)
+    let first: Promise<void> | undefined
+    await act(async () => {
+      first = actions?.createTerminalAndSend([COMMENT])
+      await actions?.createTerminalAndSend([COMMENT])
+    })
+    expect(setActionError).toHaveBeenLastCalledWith('Starting an agent...')
+    const written: DiffComment = { ...COMMENT, id: 'comment-2', body: 'written meanwhile' }
+    screenState = { ...READY, comments: [COMMENT, written] }
+    await act(async () => {
+      renderer?.update(createElement(Harness))
+    })
+    await act(async () => {
+      answerLaunch(launchedReply('handed-to-terminal'))
+      await first
+    })
+    expect(
+      sendRequest.mock.calls.filter(([method]) => method === 'agent.launchReplay')
+    ).toHaveLength(1)
+    expect(saveCommentsAndReviewState).toHaveBeenCalledWith(
+      [
+        expect.objectContaining({ id: 'comment-1', sentAt: expect.any(Number) }),
+        expect.not.objectContaining({ sentAt: expect.anything() })
+      ],
+      READY.reviewState
+    )
+    expect(saveCommentsAndReviewState.mock.calls[0]?.[0]?.[1]?.id).toBe('comment-2')
+    expect(setActionError).toHaveBeenLastCalledWith('Review notes sent')
+  })
+
+  // The save rolls back to the screen it was created with, so a stale one would drop newer notes.
+  it('marks the notes sent through the save of the latest render, not the one from the tap', async () => {
+    let answerLaunch: (reply: RpcResponse) => void = () => {}
+    const { client } = launchClient(
+      'handed-to-terminal',
+      () =>
+        new Promise<RpcResponse>((resolve) => {
+          answerLaunch = resolve
+        })
+    )
+    await mount(client)
+    let first: Promise<void> | undefined
+    await act(async () => {
+      first = actions?.createTerminalAndSend([COMMENT])
+    })
+    const tapTimeSave = saveCommentsAndReviewState
+    saveCommentsAndReviewState = vi.fn().mockResolvedValue(undefined)
+    await act(async () => {
+      renderer?.update(createElement(Harness))
+    })
+    await act(async () => {
+      answerLaunch(launchedReply('handed-to-terminal'))
+      await first
+    })
+    expect(tapTimeSave).not.toHaveBeenCalled()
+    expect(saveCommentsAndReviewState).toHaveBeenCalledOnce()
+  })
 })
diff --git a/mobile/src/session/use-mobile-diff-review-send-actions.ts b/mobile/src/session/use-mobile-diff-review-send-actions.ts
index 8413cf61c36..bea344cd387 100644
--- a/mobile/src/session/use-mobile-diff-review-send-actions.ts
+++ b/mobile/src/session/use-mobile-diff-review-send-actions.ts
@@ -1,4 +1,4 @@
-import { useCallback, type Dispatch, type SetStateAction } from 'react'
+import { useCallback, useEffect, useRef, type Dispatch, type SetStateAction } from 'react'
 import type { DiffComment, MobileDiffReviewState } from '../../../src/shared/diff-comment-types'
 import type { ConnectionState } from '../transport/types'
 import type { RpcClient } from '../transport/rpc-client'
@@ -6,22 +6,21 @@ import { useClipboardWriter } from '../platform/clipboard'
 import { triggerSuccess } from '../platform/haptics'
 import { formatDiffComments, formatMobileDiffReviewPrompt } from './mobile-diff-comments'
 import { clearSentMobileDiffComments, markMobileDiffCommentsSent } from './mobile-diff-comment-edit'
-import {
-  reviewTerminalCreateRun,
-  reviewTerminalListRead,
-  reviewTerminalSendRun
-} from './mobile-review-terminal-operations'
+import { reviewTerminalListRead, reviewTerminalSendRun } from './mobile-review-terminal-operations'
+import { launchAgentWithPrompt } from './pr-ai-triage-launch'
 import { interpretOrThrowRefusalMessage } from '../transport/rpc-refusal-message'
 import { healMobileNativeChatStaleInput } from './mobile-native-chat-stale-input'
-import type { ReviewScreenState, SendSheetState } from './mobile-diff-review-screen-model'
+import type { ReviewScreenState } from './mobile-diff-review-screen-model'
+import type { ReviewSheetIntents } from './mobile-diff-review-sheets'
 
 type SendActionsInput = {
   client: RpcClient | null
   connState: ConnectionState
+  hostCapabilities: readonly string[]
   worktreeId: string
   screenState: ReviewScreenState
   setActionError: Dispatch<SetStateAction<string | null>>
-  setSendSheet: Dispatch<SetStateAction<SendSheetState | null>>
+  sheets: Pick<ReviewSheetIntents, 'openSheet' | 'closeSheet' | 'updateSendSheet'>
   saveCommentsAndReviewState: (
     comments: DiffComment[],
     reviewState: MobileDiffReviewState
@@ -35,12 +34,14 @@ export function useMobileDiffReviewSendActions(input: SendActionsInput) {
   const {
     client,
     connState,
+    hostCapabilities,
     worktreeId,
     screenState,
     setActionError,
-    setSendSheet,
+    sheets,
     saveCommentsAndReviewState
   } = input
+  const { openSheet, closeSheet, updateSendSheet } = sheets
 
   const copyNotes = useCallback(async () => {
     if (screenState.kind !== 'ready' || screenState.comments.length === 0) {
@@ -66,20 +67,27 @@ export function useMobileDiffReviewSendActions(input: SendActionsInput) {
     await saveCommentsAndReviewState(nextComments, screenState.reviewState)
   }, [saveCommentsAndReviewState, screenState])
 
-  const markNotesSent = useCallback(
-    async (comments: readonly DiffComment[]) => {
-      if (screenState.kind !== 'ready') {
-        return
-      }
-      const next = markMobileDiffCommentsSent(
-        screenState.comments,
-        new Set(comments.map((comment) => comment.id)),
-        Date.now()
-      )
-      await saveCommentsAndReviewState(next, screenState.reviewState)
-    },
-    [saveCommentsAndReviewState, screenState]
-  )
+  // Read when a send settles, not when it was tapped: an agent launch can take a minute, and notes
+  // written meanwhile must survive the whole-list save below, and its rollback if that save fails.
+  const latestRef = useRef({ screenState, save: saveCommentsAndReviewState })
+  useEffect(() => {
+    latestRef.current = { screenState, save: saveCommentsAndReviewState }
+  }, [saveCommentsAndReviewState, screenState])
+  // One launch at a time: each tap is a new operation, so a second tap would start a second agent.
+  const agentLaunchInFlightRef = useRef(false)
+
+  const markNotesSent = useCallback(async (comments: readonly DiffComment[]) => {
+    const { screenState: current, save } = latestRef.current
+    if (current.kind !== 'ready') {
+      return
+    }
+    const next = markMobileDiffCommentsSent(
+      current.comments,
+      new Set(comments.map((comment) => comment.id)),
+      Date.now()
+    )
+    await save(next, current.reviewState)
+  }, [])
 
   const sendPromptToTerminal = useCallback(
     async (terminal: string, comments: readonly DiffComment[]) => {
@@ -107,30 +115,58 @@ export function useMobileDiffReviewSendActions(input: SendActionsInput) {
       await markNotesSent(comments)
       triggerSuccess()
       setActionError('Review notes sent')
-      setSendSheet(null)
+      closeSheet('send')
     },
-    [client, connState, markNotesSent, setActionError, setSendSheet]
+    [client, connState, closeSheet, markNotesSent, setActionError]
   )
 
   const createTerminalAndSend = useCallback(
     async (comments: readonly DiffComment[]) => {
+      // Reported, not thrown: the sheet's caller drops the promise, so a throw would show nothing.
       if (!client || connState !== 'connected') {
-        throw new Error('Waiting for desktop...')
+        closeSheet('send')
+        setActionError('Waiting for desktop...')
+        return
       }
-      const response = await reviewTerminalCreateRun.request(client, {
-        worktree: `id:${worktreeId}`,
-        activate: false,
-        select: true,
-        navigation: 'caller'
-      })
-      let created
-      created = interpretOrThrowRefusalMessage(
-        () => reviewTerminalCreateRun.interpret(response),
-        'Failed to create terminal'
-      )
-      await sendPromptToTerminal(created.terminal, comments)
+      if (agentLaunchInFlightRef.current) {
+        return
+      }
+      agentLaunchInFlightRef.current = true
+      // Closed up front so the wait (up to a minute for a terminal agent) shows its progress here.
+      closeSheet('send')
+      setActionError('Starting an agent...')
+      let result
+      try {
+        // The desktop asks which agent to use; the review screen has no picker, so this takes the
+        // desktop's own default resolution with no saved recipe.
+        result = await launchAgentWithPrompt({
+          client,
+          hostCapabilities,
+          worktreeId,
+          prompt: formatMobileDiffReviewPrompt(comments),
+          actionId: null,
+          launchSource: 'notes_send'
+        })
+      } finally {
+        agentLaunchInFlightRef.current = false
+      }
+      if (result.kind === 'not-started' || result.kind === 'unconfirmed') {
+        setActionError(result.message)
+        return
+      }
+      if (result.kind === 'prompt-not-sent') {
+        // Notes stay unsent so Copy Notes and a later send still carry them.
+        setActionError(
+          "The agent started, but the notes weren't sent. Use Copy Notes to paste them."
+        )
+        return
+      }
+      await markNotesSent(comments)
+      triggerSuccess()
+      // The warning is a note on a launch that went ahead, so it follows the success, not replaces it.
+      setActionError(result.warning ? `Review notes sent. ${result.warning}` : 'Review notes sent')
     },
-    [client, connState, sendPromptToTerminal, worktreeId]
+    [client, closeSheet, connState, hostCapabilities, markNotesSent, setActionError, worktreeId]
   )
 
   const openSendSheet = useCallback(async () => {
@@ -138,7 +174,7 @@ export function useMobileDiffReviewSendActions(input: SendActionsInput) {
       setActionError('Waiting for desktop...')
       return
     }
-    setSendSheet({ kind: 'loading' })
+    openSheet({ kind: 'send', load: { kind: 'loading' } })
     try {
       const response = await reviewTerminalListRead.request(client, {
         worktree: `id:${worktreeId}`
@@ -148,15 +184,15 @@ export function useMobileDiffReviewSendActions(input: SendActionsInput) {
         () => reviewTerminalListRead.interpret(response),
         'Unable to load agent sessions'
       )
-      setSendSheet({ kind: 'ready', terminals })
+      updateSendSheet({ kind: 'ready', terminals })
     } catch (err) {
-      setSendSheet({
+      updateSendSheet({
         kind: 'error',
         message: err instanceof Error ? err.message : 'Unable to load agent sessions',
         terminals: []
       })
     }
-  }, [client, connState, setActionError, setSendSheet, worktreeId])
+  }, [client, connState, openSheet, setActionError, updateSendSheet, worktreeId])
 
   return {
     clearSentNotes,
diff --git a/mobile/src/session/use-mobile-native-chat-controller.ts b/mobile/src/session/use-mobile-native-chat-controller.ts
index a3a49e53552..0d236770be3 100644
--- a/mobile/src/session/use-mobile-native-chat-controller.ts
+++ b/mobile/src/session/use-mobile-native-chat-controller.ts
@@ -2,6 +2,7 @@ import { useLayoutEffect, useRef, type MutableRefObject } from 'react'
 import type { RpcClient } from '../transport/rpc-client'
 import type { ConnectionState } from '../transport/types'
 import type { MobileNativeChatTab } from './mobile-native-chat-eligibility'
+import type { StructuredAgentSessionHostSupport } from './mobile-structured-agent-session-host-support'
 import { useMobileNativeChatAskDismiss } from './use-mobile-native-chat-ask-dismiss'
 import { useMobileNativeChatDrafts } from './use-mobile-native-chat-drafts'
 import { useMobileNativeChatFileSearch } from './use-mobile-native-chat-file-search'
@@ -36,7 +37,7 @@ export function useMobileNativeChatController(args: {
   /** Live socket state; the lease collapses on disconnect but one render later. */
   connState: ConnectionState
   /** Host capability fact from the shared runtime status probe. */
-  agentSessionPromptCancelSupported?: boolean | null
+  agentSessionHostSupport?: StructuredAgentSessionHostSupport | null
   onSendError: (message: string) => void
   /** Retires a held failure banner. Any accepted chat write clears it — a delivered
    *  answer or permission reply must not sit under a stale "not sent". */
@@ -53,7 +54,7 @@ export function useMobileNativeChatController(args: {
     nativeChatTranscriptIsLocalReadable,
     nativeChatInputLeaseReady,
     connState,
-    agentSessionPromptCancelSupported = null,
+    agentSessionHostSupport = null,
     onSendError,
     onSendResolved
   } = args
@@ -93,7 +94,7 @@ export function useMobileNativeChatController(args: {
       callerIdentity: deviceTokenRef.current ?? '',
       enabled: showNativeChat,
       connState,
-      promptCancelSupported: agentSessionPromptCancelSupported,
+      hostSupport: agentSessionHostSupport,
       onSendError
     })
   const {
@@ -287,6 +288,7 @@ export function useMobileNativeChatController(args: {
     nativeChatTurnIndicator: activeChatStructured ? structuredNativeChat.turnIndicator : null,
     nativeChatWorkingStartedAt: activeChatStructured ? structuredNativeChat.workingStartedAt : null,
     nativeChatSettledTurns: activeChatStructured ? structuredNativeChat.settledTurns : null,
+    nativeChatTurnJournal: activeChatStructured ? structuredNativeChat.turnJournal : null,
     nativeChatCanStop: activeChatStructured
       ? structuredNativeChat.turnId !== null
       : nativeChatAgentWorking,
diff --git a/mobile/src/session/use-mobile-native-chat-session-lane.ts b/mobile/src/session/use-mobile-native-chat-session-lane.ts
index bfeb1b06945..147cf017ac0 100644
--- a/mobile/src/session/use-mobile-native-chat-session-lane.ts
+++ b/mobile/src/session/use-mobile-native-chat-session-lane.ts
@@ -1,5 +1,6 @@
 import type { RpcClient } from '../transport/rpc-client'
 import type { ConnectionState } from '../transport/types'
+import type { StructuredAgentSessionHostSupport } from './mobile-structured-agent-session-host-support'
 import { useMobileNativeChatSession } from './use-mobile-native-chat-session'
 import { useMobileStructuredAgentSession } from './use-mobile-structured-agent-session'
 
@@ -15,7 +16,7 @@ export function useMobileNativeChatSessionLane({
   sessionId,
   sourceIdentity,
   callerIdentity,
-  promptCancelSupported,
+  hostSupport,
   enabled,
   connState,
   onSendError
@@ -30,7 +31,7 @@ export function useMobileNativeChatSessionLane({
   sessionId: string | null
   sourceIdentity: Parameters<typeof useMobileNativeChatSession>[0]['sourceIdentity']
   callerIdentity: string
-  promptCancelSupported?: boolean | null
+  hostSupport: StructuredAgentSessionHostSupport | null
   enabled: boolean
   connState: ConnectionState
   onSendError: (message: string) => void
@@ -50,7 +51,7 @@ export function useMobileNativeChatSessionLane({
     sessionId: structured ? sessionId : null,
     sourceIdentity,
     callerIdentity,
-    promptCancelSupported,
+    hostSupport,
     enabled,
     // Holds are connection-scoped; dropping this on transport loss lets the hook
     // reacquire the provider without clearing the cached transcript.
diff --git a/mobile/src/session/use-mobile-native-chat-session-stream-end.test.ts b/mobile/src/session/use-mobile-native-chat-session-stream-end.test.ts
new file mode 100644
index 00000000000..2ff419fab5f
--- /dev/null
+++ b/mobile/src/session/use-mobile-native-chat-session-stream-end.test.ts
@@ -0,0 +1,417 @@
+import { createElement, Fragment, type ReactElement } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { NativeChatMessage } from '../../../src/shared/native-chat-types'
+import type { RpcClient } from '../transport/rpc-client'
+import { MobileRelayRpcStreams } from '../transport/mobile-relay-rpc-streams'
+import { RpcClientStreamRegistry } from '../transport/rpc-client-stream-registry'
+import type { RpcResponse } from '../transport/types'
+import {
+  useMobileNativeChatSession,
+  type MobileNativeChatSession
+} from './use-mobile-native-chat-session'
+
+function message(id: string): NativeChatMessage {
+  return {
+    id,
+    role: 'assistant',
+    blocks: [{ type: 'text', text: id }],
+    timestamp: 1,
+    source: 'transcript'
+  }
+}
+
+function streamed(id: string, result: unknown): RpcResponse {
+  return { id, ok: true, streaming: true, result, _meta: { runtimeId: 'runtime-1' } }
+}
+
+type SentRequest = { id: string; method: string; params?: unknown }
+
+function readSentRequest(value: unknown): SentRequest {
+  if (
+    typeof value !== 'object' ||
+    value === null ||
+    !('id' in value) ||
+    !('method' in value) ||
+    typeof value.id !== 'string' ||
+    typeof value.method !== 'string'
+  ) {
+    throw new Error('unexpected request shape')
+  }
+  return {
+    id: value.id,
+    method: value.method,
+    params: 'params' in value ? value.params : undefined
+  }
+}
+
+function testClient(subscribe: RpcClient['subscribe']): RpcClient {
+  return {
+    sendRequest: () => new Promise<RpcResponse>(() => {}),
+    subscribe,
+    updateTerminalSubscriptionViewport: () => {},
+    getState: () => 'connected',
+    getReconnectAttempt: () => 0,
+    getLastConnectedAt: () => null,
+    onStateChange: () => () => {},
+    notifyForeground: () => {},
+    close: () => {}
+  }
+}
+
+/** A client whose host is the test: every subscribe's listener is kept, in order. */
+function listenerClient(): {
+  client: RpcClient
+  subscribe: ReturnType<typeof vi.fn<RpcClient['subscribe']>>
+  listeners: ((frame: unknown) => void)[]
+} {
+  const listeners: ((frame: unknown) => void)[] = []
+  const subscribe = vi.fn<RpcClient['subscribe']>((_method, _params, onData) => {
+    listeners.push(onData)
+    return () => {}
+  })
+  return { client: testClient(subscribe), subscribe, listeners }
+}
+
+/** A host that, like the runtime, keys each feed by its token: a same-token subscribe ends the feed
+ *  it replaces, and an unsubscribe ends whatever holds the token. Frames queue until `deliver`, so
+ *  each end lands a round trip after the request that caused it. */
+function evictingHost(): {
+  client: RpcClient
+  subscribe: ReturnType<typeof vi.fn<RpcClient['subscribe']>>
+  deliver: () => Promise<void>
+} {
+  const live = new Map<string, (frame: unknown) => void>()
+  let queued: (() => void)[] = []
+  const subscribe = vi.fn<RpcClient['subscribe']>((_method, params, onData) => {
+    const token =
+      typeof params === 'object' && params !== null && 'subscriptionId' in params
+        ? String(params.subscriptionId)
+        : ''
+    const replaced = live.get(token)
+    live.set(token, onData)
+    if (replaced) {
+      queued.push(() => replaced({ type: 'end' }))
+    }
+    queued.push(() => onData({ type: 'snapshot', messages: [message('a')], hasMore: false }))
+    return () => {
+      const holder = live.get(token)
+      live.delete(token)
+      if (holder && holder !== onData) {
+        queued.push(() => holder({ type: 'end' }))
+      }
+    }
+  })
+  const deliver = async (): Promise<void> => {
+    // Bounded so a same-token fight between screens shows up as an ended feed, not a hang.
+    for (let round = 0; round < 10 && queued.length > 0; round += 1) {
+      const frames = queued
+      queued = []
+      await act(async () => {
+        for (const frame of frames) {
+          frame()
+        }
+      })
+    }
+  }
+  return { client: testClient(subscribe), subscribe, deliver }
+}
+
+/** A paired host as the phone's real stream layer sees it: requests out, replies in. */
+type TransportRig = {
+  client: RpcClient
+  sent: SentRequest[]
+  reply: (response: RpcResponse) => void
+  /** Drops and re-authenticates the socket; only the direct transport replays its streams. */
+  reconnect?: () => void
+}
+
+function directRig(): TransportRig {
+  const sent: SentRequest[] = []
+  let nextId = 0
+  const registry = new RpcClientStreamRegistry({
+    nextId: () => `rpc-${++nextId}`,
+    deviceToken: 'device-token',
+    getState: () => 'connected',
+    sendEncrypted: (request) => {
+      sent.push(readSentRequest(request))
+      return true
+    }
+  })
+  return {
+    client: testClient(registry.subscribe.bind(registry)),
+    sent,
+    reply: (response) => registry.handleResponse(response),
+    reconnect: () => {
+      registry.markForReplay()
+      registry.replayAfterAuthentication()
+    }
+  }
+}
+
+function relayRig(): TransportRig {
+  const sent: SentRequest[] = []
+  let nextId = 0
+  const streams = new MobileRelayRpcStreams({
+    nextId: () => `relay-${++nextId}`,
+    sendFrame: (request) => {
+      sent.push(request)
+      return true
+    },
+    waitForConnected: async () => {}
+  })
+  return {
+    client: testClient(streams.subscribe.bind(streams)),
+    sent,
+    reply: (response) => streams.handleResponse(response)
+  }
+}
+
+describe('useMobileNativeChatSession host-ended stream', () => {
+  let renderer: ReactTestRenderer | null = null
+  let state: MobileNativeChatSession | null = null
+
+  beforeEach(() => {
+    state = null
+  })
+
+  afterEach(() => {
+    act(() => renderer?.unmount())
+    renderer = null
+  })
+
+  function Harness({
+    client,
+    agent = 'claude',
+    sessionId = 'session'
+  }: {
+    client: RpcClient
+    agent?: string | null
+    sessionId?: string
+  }): null {
+    state = useMobileNativeChatSession({
+      client,
+      sourceIdentity: 'host-a\0workspace-a',
+      agent,
+      sessionId,
+      transcriptPath: null
+    })
+    return null
+  }
+
+  async function render(props: {
+    client: RpcClient
+    agent?: string | null
+    sessionId?: string
+  }): Promise<void> {
+    await act(async () => {
+      if (renderer) {
+        renderer.update(createElement(Harness, props))
+      } else {
+        renderer = create(createElement(Harness, props))
+      }
+    })
+  }
+
+  function sentWith(rig: TransportRig, method: string): SentRequest[] {
+    return rig.sent.filter((request) => request.method === method)
+  }
+
+  function tokenOf(request: SentRequest): unknown {
+    const params = request.params
+    return typeof params === 'object' && params !== null && 'subscriptionId' in params
+      ? params.subscriptionId
+      : undefined
+  }
+
+  it.each([
+    ['direct', directRig],
+    ['relay', relayRig]
+  ])(
+    'settles a chat feed the host ended on a %s connection as an error, not ready',
+    async (_label, makeRig) => {
+      const rig = makeRig()
+      await render({ client: rig.client })
+      const [first] = sentWith(rig, 'nativeChat.subscribe')
+      await act(async () => {
+        rig.reply(
+          streamed(first!.id, { type: 'snapshot', messages: [message('a')], hasMore: false })
+        )
+      })
+      expect(state?.status).toBe('ready')
+
+      await act(async () => {
+        rig.reply(streamed(first!.id, { type: 'end' }))
+      })
+
+      expect(state?.status).toBe('error')
+      expect(state?.transcriptLoading).toBe(false)
+      // The conversation stays on screen; nothing reopens behind the user's back.
+      expect(state?.messages.map((entry) => entry.id)).toEqual(['a'])
+      expect(sentWith(rig, 'nativeChat.subscribe')).toHaveLength(1)
+    }
+  )
+
+  it.each([
+    ['direct', directRig],
+    ['relay', relayRig]
+  ])(
+    'leaving and re-entering an ended %s chat resubscribes with a fresh token',
+    async (_label, makeRig) => {
+      const rig = makeRig()
+      await render({ client: rig.client })
+      const [first] = sentWith(rig, 'nativeChat.subscribe')
+      await act(async () => {
+        rig.reply(streamed(first!.id, { type: 'end' }))
+      })
+      expect(state?.status).toBe('error')
+
+      // Toggle to the terminal view and back.
+      await render({ client: rig.client, agent: null })
+      await render({ client: rig.client })
+      const subscribes = sentWith(rig, 'nativeChat.subscribe')
+      expect(subscribes).toHaveLength(2)
+      expect(tokenOf(subscribes[1]!)).toMatch(/^claude:session:./)
+      expect(tokenOf(subscribes[1]!)).not.toBe(tokenOf(first!))
+      // The ended feed is already gone on the host, so leaving it names nothing.
+      expect(sentWith(rig, 'nativeChat.unsubscribe')).toEqual([])
+      expect(state?.status).toBe('loading')
+
+      await act(async () => {
+        rig.reply(
+          streamed(subscribes[1]!.id, {
+            type: 'snapshot',
+            messages: [message('a'), message('b')],
+            hasMore: false
+          })
+        )
+      })
+      expect(state?.status).toBe('ready')
+      expect(state?.messages.map((entry) => entry.id)).toEqual(['a', 'b'])
+    }
+  )
+
+  it('ignores an end on a stream it already closed itself', async () => {
+    const { client, subscribe, listeners } = listenerClient()
+    await render({ client })
+    await render({ client, sessionId: 'other' })
+    expect(subscribe).toHaveBeenCalledTimes(2)
+    await act(async () =>
+      listeners[1]!({ type: 'snapshot', messages: [message('a')], hasMore: false })
+    )
+
+    await act(async () => listeners[0]!({ type: 'end' }))
+
+    expect(state?.status).toBe('ready')
+    expect(subscribe).toHaveBeenCalledTimes(2)
+  })
+})
+
+describe('useMobileNativeChatSession feeds across stacked screens', () => {
+  let renderer: ReactTestRenderer | null = null
+  const states = new Map<string, MobileNativeChatSession>()
+
+  beforeEach(() => {
+    states.clear()
+  })
+
+  afterEach(() => {
+    act(() => renderer?.unmount())
+    renderer = null
+  })
+
+  function Screen({ name, client }: { name: string; client: RpcClient }): null {
+    states.set(
+      name,
+      useMobileNativeChatSession({
+        client,
+        sourceIdentity: 'host-a\0workspace-a',
+        agent: 'claude',
+        sessionId: 'session',
+        transcriptPath: null
+      })
+    )
+    return null
+  }
+
+  function Stack({ client, screens }: { client: RpcClient; screens: string[] }): ReactElement {
+    return createElement(
+      Fragment,
+      null,
+      ...screens.map((name) => createElement(Screen, { key: name, name, client }))
+    )
+  }
+
+  async function render(client: RpcClient, screens: string[]): Promise<void> {
+    await act(async () => {
+      if (renderer) {
+        renderer.update(createElement(Stack, { client, screens }))
+      } else {
+        renderer = create(createElement(Stack, { client, screens }))
+      }
+    })
+  }
+
+  function tokenOf(request: SentRequest | unknown[]): unknown {
+    const params = Array.isArray(request) ? request[1] : request.params
+    return typeof params === 'object' && params !== null && 'subscriptionId' in params
+      ? params.subscriptionId
+      : undefined
+  }
+
+  it('keeps both feeds live when a pushed screen opens the same chat, and after it pops', async () => {
+    const host = evictingHost()
+    await render(host.client, ['under'])
+    await host.deliver()
+    expect(states.get('under')?.status).toBe('ready')
+
+    // Resuming from agent history pushes a second screen for the same chat.
+    await render(host.client, ['under', 'top'])
+    await host.deliver()
+    expect(states.get('under')?.status).toBe('ready')
+    expect(states.get('top')?.status).toBe('ready')
+    expect(host.subscribe).toHaveBeenCalledTimes(2)
+    const [under, top] = host.subscribe.mock.calls
+    expect(tokenOf(under!)).not.toBe(tokenOf(top!))
+
+    // Popping the pushed screen releases its own feed only.
+    await render(host.client, ['under'])
+    await host.deliver()
+    expect(host.subscribe).toHaveBeenCalledTimes(2)
+    expect(states.get('under')?.status).toBe('ready')
+  })
+
+  it.each([
+    ['direct', directRig],
+    ['relay', relayRig]
+  ])(
+    'names each %s chat feed by its own token on replay and unsubscribe',
+    async (_label, makeRig) => {
+      const rig = makeRig()
+      await render(rig.client, ['under', 'top'])
+      const [under, top] = rig.sent.filter((request) => request.method === 'nativeChat.subscribe')
+      expect(tokenOf(under!)).toMatch(/^claude:session:/)
+      expect(tokenOf(top!)).toMatch(/^claude:session:/)
+      expect(tokenOf(under!)).not.toBe(tokenOf(top!))
+
+      if (rig.reconnect) {
+        rig.reconnect()
+        const replayed = rig.sent
+          .filter((request) => request.method === 'nativeChat.subscribe')
+          .slice(2)
+        expect(replayed.map((request) => [request.id, tokenOf(request)])).toEqual([
+          [under!.id, tokenOf(under!)],
+          [top!.id, tokenOf(top!)]
+        ])
+      }
+
+      // The older screen leaves while the newer one stays: its unsubscribe must still be sent.
+      await render(rig.client, ['top'])
+      expect(
+        rig.sent
+          .filter((request) => request.method === 'nativeChat.unsubscribe')
+          .map((request) => request.params)
+      ).toEqual([{ subscriptionId: tokenOf(under!) }])
+    }
+  )
+})
diff --git a/mobile/src/session/use-mobile-native-chat-session.ts b/mobile/src/session/use-mobile-native-chat-session.ts
index 537c3b8b8e3..1f8bdae2d48 100644
--- a/mobile/src/session/use-mobile-native-chat-session.ts
+++ b/mobile/src/session/use-mobile-native-chat-session.ts
@@ -12,6 +12,7 @@ import {
   applyMobileNativeChatStreamFrame,
   type MobileNativeChatStreamFrame
 } from './mobile-native-chat-stream-frame'
+import { structuredSessionRandomUuid } from './structured-session-operation-id'
 
 export type MobileNativeChatStatus =
   | 'idle'
@@ -154,7 +155,12 @@ export function useMobileNativeChatSession(args: {
         agent,
         sessionId,
         limit: limitRef.current,
-        subscriptionId: buildNativeChatSubscriptionId(agent, sessionId),
+        // Why: a token of its own, so another screen on this chat never evicts this feed on the host.
+        subscriptionId: buildNativeChatSubscriptionId(
+          agent,
+          sessionId,
+          structuredSessionRandomUuid()
+        ),
         capabilities: { transcriptPending: 1 },
         ...(transcriptPath ? { transcriptPath } : {})
       },
diff --git a/mobile/src/session/use-mobile-native-chat-turn-disclosure.test.tsx b/mobile/src/session/use-mobile-native-chat-turn-disclosure.test.tsx
index 33e99bfb603..f5cc0ff8c02 100644
--- a/mobile/src/session/use-mobile-native-chat-turn-disclosure.test.tsx
+++ b/mobile/src/session/use-mobile-native-chat-turn-disclosure.test.tsx
@@ -1,7 +1,13 @@
 import { createElement } from 'react'
 import { act, create, type ReactTestRenderer } from 'react-test-renderer'
 import { afterEach, describe, expect, it, vi } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalRenderItem,
+  AgentJournalTurnScope
+} from '../../../src/shared/agent-session-journal-types'
 import type { NativeChatMessage } from '../../../src/shared/native-chat-types'
+import type { NativeChatTurnJournal } from '../../../src/shared/native-chat-turn-membership'
 import type { NativeChatSettledTurns } from '../../../src/shared/native-chat-turn-status'
 import { useMobileNativeChatTurnDisclosure } from './use-mobile-native-chat-turn-disclosure'
 
@@ -20,12 +26,16 @@ function Harness({
   enabled,
   isWorking = true,
   settledTurns,
+  turnJournal,
+  workingStartedAt,
   scopeKey = 'host\0worktree\0tab-a'
 }: {
   messages: readonly NativeChatMessage[]
   enabled: boolean
   isWorking?: boolean
   settledTurns?: NativeChatSettledTurns
+  turnJournal?: NativeChatTurnJournal
+  workingStartedAt?: number | null
   scopeKey?: string
 }): React.JSX.Element {
   const disclosure = useMobileNativeChatTurnDisclosure({
@@ -33,6 +43,8 @@ function Harness({
     enabled,
     isWorking,
     settledTurns,
+    turnJournal,
+    workingStartedAt,
     scopeKey
   })
   return createElement('result', { disclosure })
@@ -144,6 +156,38 @@ describe('useMobileNativeChatTurnDisclosure', () => {
     }
   })
 
+  it('keeps the live bar on every render until it settles in place', () => {
+    vi.useFakeTimers()
+    try {
+      vi.setSystemTime(1_000)
+      const messages = [userMessage('u1')]
+      const seen: unknown[] = []
+      function Recorder({ isWorking }: { isWorking: boolean }): React.JSX.Element {
+        const disclosure = useMobileNativeChatTurnDisclosure({
+          messages,
+          enabled: true,
+          isWorking,
+          scopeKey: 'host\0worktree\0tab-a'
+        })
+        seen.push(disclosure.resolveRow(0, messages[0]).turnStatus)
+        return createElement('result', { disclosure })
+      }
+      act(() => {
+        renderer = create(createElement(Recorder, { isWorking: true }))
+      })
+      vi.setSystemTime(6_000)
+      seen.length = 0
+      // No host duration for this turn: the settle is stamped locally, one pass later.
+      act(() => {
+        renderer?.update(createElement(Recorder, { isWorking: false }))
+      })
+      expect(seen).not.toContain(null)
+      expect(seen.at(-1)).toEqual({ startedAt: 1_000, thinking: false, workedSeconds: 5 })
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
   it('suppresses local duration when the host explicitly cannot verify the end', () => {
     vi.useFakeTimers()
     try {
@@ -170,6 +214,433 @@ describe('useMobileNativeChatTurnDisclosure', () => {
     }
   })
 
+  describe('keeps the live bar under the prompt that opened the running turn, not a mid-turn send', () => {
+    const tool: NativeChatMessage = {
+      id: 'tool-a',
+      role: 'assistant',
+      blocks: [
+        { type: 'tool-call', name: 'Bash', input: { command: 'sleep 15' }, state: 'running' }
+      ],
+      timestamp: null,
+      source: 'transcript'
+    }
+    const messages = [userMessage('A'), tool, userMessage('B')]
+    const user = (
+      id: string,
+      sequence: number,
+      turnScope?: AgentJournalTurnScope
+    ): AgentJournalRenderItem => ({
+      itemId: id,
+      revision: 0,
+      sequence,
+      observedAt: sequence,
+      body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: id }] },
+      ...(turnScope ? { turnScope } : {})
+    })
+    const turn = (
+      turnId: string,
+      sequence: number,
+      state: 'running' | 'interrupted',
+      userItemId: string,
+      turnScope?: AgentJournalTurnScope
+    ): AgentJournalRenderItem => ({
+      itemId: turnId,
+      revision: 0,
+      sequence,
+      observedAt: sequence,
+      body: { kind: 'turn', turnId, state, userItemId },
+      ...(turnScope ? { turnScope } : {})
+    })
+    const toolItem = (
+      sequence: number,
+      turnScope?: AgentJournalTurnScope
+    ): AgentJournalRenderItem => ({
+      itemId: 'tool-a',
+      revision: 0,
+      sequence,
+      observedAt: sequence,
+      body: {
+        kind: 'tool-call',
+        name: 'Bash',
+        input: { command: 'sleep 15' },
+        state: 'running'
+      },
+      ...(turnScope ? { turnScope } : {})
+    })
+    const rows = () => {
+      const disclosure = renderer!.root.findByType('result').props.disclosure
+      return messages.map((message, index) => disclosure.resolveRow(index, message))
+    }
+    const render = (props: Parameters<typeof Harness>[0]) =>
+      act(() => {
+        if (renderer) {
+          renderer.update(createElement(Harness, props))
+        } else {
+          renderer = create(createElement(Harness, props))
+        }
+      })
+
+    it("on a host that states each row's turn, the steered message and the work are one live turn", () => {
+      vi.useFakeTimers()
+      try {
+        vi.setSystemTime(10_000)
+        const t1 = { kind: 'turn', turnItemId: 't1' } as const
+        const thread = { kind: 'thread' } as const
+        // B was handed over while A's turn runs, so the host scopes it to that turn.
+        const whileA = [
+          user('A', 1, thread),
+          turn('t1', 2, 'running', 'A', thread),
+          toolItem(3, t1),
+          user('B', 4, t1)
+        ]
+        render({
+          messages,
+          enabled: true,
+          workingStartedAt: 5_000,
+          turnJournal: { items: whileA, submissions: [] }
+        })
+        let [rowA, rowTool, rowB] = rows()
+        expect(rowA.turnStatus).toEqual({ startedAt: 5_000, thinking: false, workedSeconds: null })
+        expect(rowB.turnStatus).toBeNull()
+        expect([rowA, rowTool, rowB].map((row) => row.activeTurnIsWorking)).toEqual([
+          true,
+          true,
+          true
+        ])
+
+        // B's own turn opens: A takes the host's settled duration, B counts from A's end.
+        const whileB = [
+          user('A', 1, thread),
+          turn('t1', 2, 'interrupted', 'A', thread),
+          toolItem(3, t1),
+          user('B', 4, t1),
+          turn('t2', 5, 'running', 'B', thread)
+        ]
+        render({
+          messages,
+          enabled: true,
+          workingStartedAt: 22_000,
+          settledTurns: new Map([['A', { startedAt: 5_000, workedSeconds: 17 }]]),
+          turnJournal: { items: whileB, submissions: [] }
+        })
+        ;[rowA, rowTool, rowB] = rows()
+        expect(rowA.turnStatus).toEqual({ startedAt: 5_000, thinking: false, workedSeconds: 17 })
+        expect(rowB.turnStatus).toEqual({ startedAt: 22_000, thinking: false, workedSeconds: null })
+        expect(rowB.activeTurnIsWorking).toBe(true)
+        expect(rowTool.activeTurnIsWorking).toBe(false)
+      } finally {
+        vi.useRealTimers()
+      }
+    })
+
+    it('on a host that states no turn, the bar and liveness follow the running record by journal order', () => {
+      vi.useFakeTimers()
+      try {
+        vi.setSystemTime(10_000)
+        const whileA = [user('A', 1), turn('t1', 2, 'running', 'A'), toolItem(3), user('B', 4)]
+        render({
+          messages,
+          enabled: true,
+          workingStartedAt: 5_000,
+          turnJournal: { items: whileA, submissions: [] }
+        })
+        let [rowA, rowTool, rowB] = rows()
+        expect(rowA.turnStatus).toEqual({ startedAt: 5_000, thinking: false, workedSeconds: null })
+        expect(rowB.turnStatus).toBeNull()
+        // Liveness follows the owning turn: A's tool row stays live while B waits.
+        expect(rowTool.activeTurnIsWorking).toBe(true)
+        expect(rowB.activeTurnIsWorking).toBe(false)
+
+        const whileB = [
+          user('A', 1),
+          turn('t1', 2, 'interrupted', 'A'),
+          toolItem(3),
+          user('B', 4),
+          turn('t2', 5, 'running', 'B')
+        ]
+        render({
+          messages,
+          enabled: true,
+          workingStartedAt: 22_000,
+          settledTurns: new Map([['A', { startedAt: 5_000, workedSeconds: 17 }]]),
+          turnJournal: { items: whileB, submissions: [] }
+        })
+        ;[rowA, , rowB] = rows()
+        expect(rowA.turnStatus).toEqual({ startedAt: 5_000, thinking: false, workedSeconds: 17 })
+        expect(rowB.turnStatus).toEqual({ startedAt: 22_000, thinking: false, workedSeconds: null })
+      } finally {
+        vi.useRealTimers()
+      }
+    })
+  })
+
+  /** A journal of `entries` in order, each naming the turn it belongs to (null for none). With
+   *  `statesScope` false the rows carry no scope, as an older host writes them. */
+  function journalOf(
+    entries: readonly [itemId: string, body: AgentJournalItemBody, turnItemId: string | null][],
+    statesScope: boolean
+  ): NativeChatTurnJournal {
+    return {
+      items: entries.map(([itemId, body, turnItemId], index) => ({
+        itemId,
+        revision: 0,
+        sequence: index + 1,
+        observedAt: index + 1,
+        body,
+        ...(statesScope
+          ? {
+              turnScope: turnItemId
+                ? { kind: 'turn' as const, turnItemId }
+                : { kind: 'thread' as const }
+            }
+          : {})
+      })),
+      submissions: []
+    }
+  }
+  const said = (role: 'user' | 'assistant'): AgentJournalItemBody => ({
+    kind: 'message',
+    role,
+    blocks: []
+  })
+  const record = (
+    turnId: string,
+    state: 'running' | 'completed',
+    userItemId: string
+  ): AgentJournalItemBody => ({ kind: 'turn', turnId, state, userItemId })
+  const hosts = [
+    ['states each row’s turn', true],
+    ['states no scope', false]
+  ] as const
+
+  it.each(hosts)(
+    "keeps a running turn's rows live across a mid-turn send the host folded in, on a host that %s",
+    (_host, statesScope) => {
+      vi.useFakeTimers()
+      try {
+        vi.setSystemTime(10_000)
+        const tool = (id: string): NativeChatMessage => ({
+          id,
+          role: 'assistant',
+          blocks: [
+            { type: 'tool-call', name: 'Bash', input: { command: 'sleep 15' }, state: 'running' }
+          ],
+          timestamp: null,
+          source: 'transcript'
+        })
+        // The #23621 shape: B lands mid-turn and the tool rows after it are still A's.
+        const messages = [userMessage('A'), tool('t1'), userMessage('B'), tool('t2')]
+        const turnJournal = journalOf(
+          [
+            ['A', said('user'), null],
+            ['tA', record('tA', 'running', 'A'), null],
+            ['t1', said('assistant'), 'tA'],
+            ['B', said('user'), 'tA'],
+            ['t2', said('assistant'), 'tA']
+          ],
+          statesScope
+        )
+        act(() => {
+          renderer = create(
+            createElement(Harness, {
+              messages,
+              enabled: true,
+              workingStartedAt: 5_000,
+              turnJournal
+            })
+          )
+        })
+        const disclosure = renderer!.root.findByType('result').props.disclosure
+        const [rowA, rowT1, rowB, rowT2] = messages.map((message, index) =>
+          disclosure.resolveRow(index, message)
+        )
+        expect(rowA.turnStatus).toEqual({ startedAt: 5_000, thinking: false, workedSeconds: null })
+        // The steered bubble shares A's turn but never carries a bar of its own.
+        expect(rowB.turnStatus).toBeNull()
+        expect(rowT1.activeTurnIsWorking).toBe(true)
+        expect(rowT2.activeTurnIsWorking).toBe(true)
+      } finally {
+        vi.useRealTimers()
+      }
+    }
+  )
+
+  it.each(hosts)(
+    "anchors a provider-opened turn's bar above its first row, on a host that %s",
+    (_host, statesScope) => {
+      vi.useFakeTimers()
+      try {
+        vi.setSystemTime(10_000)
+        const woke: NativeChatMessage = {
+          id: 'woke',
+          role: 'assistant',
+          blocks: [{ type: 'text', text: 'Woke up.' }],
+          timestamp: null,
+          source: 'transcript'
+        }
+        const messages = [userMessage('u1'), woke]
+        const turnJournal = journalOf(
+          [
+            ['u1', said('user'), null],
+            ['wake', record('wake', 'completed', 'claude:wake'), null],
+            ['woke', said('assistant'), 'wake']
+          ],
+          statesScope
+        )
+        act(() => {
+          renderer = create(
+            createElement(Harness, {
+              messages,
+              enabled: true,
+              isWorking: false,
+              settledTurns: new Map([['wake', { startedAt: 5_000, workedSeconds: 9 }]]),
+              turnJournal
+            })
+          )
+        })
+        const disclosure = renderer!.root.findByType('result').props.disclosure
+        const [rowU1, rowWoke] = messages.map((message, index) =>
+          disclosure.resolveRow(index, message)
+        )
+        expect(rowU1.turnStatus).toBeNull()
+        expect(rowWoke.turnStatus).toEqual({ startedAt: 5_000, thinking: false, workedSeconds: 9 })
+        expect(rowWoke.turnStatusAbove).toBe(true)
+      } finally {
+        vi.useRealTimers()
+      }
+    }
+  )
+
+  it.each(hosts)(
+    "never hands a provider-opened turn's clock to a message sent during it, on a host that %s",
+    (_host, statesScope) => {
+      vi.useFakeTimers()
+      try {
+        vi.setSystemTime(10_000)
+        const row = (id: string): NativeChatMessage => ({
+          id,
+          role: 'assistant',
+          blocks: [{ type: 'text', text: id }],
+          timestamp: null,
+          source: 'transcript'
+        })
+        // A wake turn runs; B is sent during it and folded in, so B opened nothing.
+        const messages = [row('w1'), userMessage('B'), row('w2')]
+        const journal = (state: 'running' | 'completed') =>
+          journalOf(
+            [
+              ['wake', record('wake', state, 'claude:wake'), null],
+              ['w1', said('assistant'), 'wake'],
+              ['B', said('user'), 'wake'],
+              ['w2', said('assistant'), 'wake']
+            ],
+            statesScope
+          )
+        act(() => {
+          renderer = create(
+            createElement(Harness, {
+              messages,
+              enabled: true,
+              workingStartedAt: 5_000,
+              turnJournal: journal('running'),
+              settledTurns: new Map([['wake', null]])
+            })
+          )
+        })
+        // The wake turn settles: the host no longer names a running turn.
+        vi.setSystemTime(20_000)
+        act(() => {
+          renderer!.update(
+            createElement(Harness, {
+              messages,
+              enabled: true,
+              isWorking: false,
+              workingStartedAt: null,
+              turnJournal: journal('completed'),
+              settledTurns: new Map([['wake', { startedAt: 5_000, workedSeconds: 15 }]])
+            })
+          )
+        })
+        const disclosure = renderer!.root.findByType('result').props.disclosure
+        const [rowW1, rowB] = messages.map((message, index) =>
+          disclosure.resolveRow(index, message)
+        )
+        expect(rowW1.turnStatus).toEqual({ startedAt: 5_000, thinking: false, workedSeconds: 15 })
+        expect(rowB.turnStatus).toBeNull()
+      } finally {
+        vi.useRealTimers()
+      }
+    }
+  )
+
+  // Claude runs A; B is sent mid-turn and Claude answers it after A. The journal writes B when it
+  // is sent, so A's remaining tool run and its answer follow B there, and B's turn opens after them.
+  it.each(hosts)(
+    "draws A's remaining rows under A's bar, then B's bubble and turn, on a host that %s",
+    (_host, statesScope) => {
+      vi.useFakeTimers()
+      try {
+        vi.setSystemTime(30_000)
+        const message = (id: string, role: 'user' | 'assistant'): NativeChatMessage => ({
+          id,
+          role,
+          blocks: [{ type: 'text', text: id }],
+          timestamp: null,
+          source: 'transcript'
+        })
+        const messages = [
+          message('A', 'user'),
+          message('a-tool-1', 'assistant'),
+          message('B', 'user'),
+          message('a-tool-2', 'assistant'),
+          message('FIRST DONE', 'assistant'),
+          message('b-answer', 'assistant')
+        ]
+        const turnJournal = journalOf(
+          [
+            ['A', said('user'), null],
+            ['tA', record('tA', 'completed', 'A'), null],
+            ['a-tool-1', said('assistant'), 'tA'],
+            // Handed over while A runs, so the host scopes it to A's turn until its own opens.
+            ['B', said('user'), 'tA'],
+            ['a-tool-2', said('assistant'), 'tA'],
+            ['FIRST DONE', said('assistant'), 'tA'],
+            ['tB', record('tB', 'running', 'B'), null],
+            ['b-answer', said('assistant'), 'tB']
+          ],
+          statesScope
+        )
+        act(() => {
+          renderer = create(
+            createElement(Harness, {
+              messages,
+              enabled: true,
+              workingStartedAt: 29_000,
+              settledTurns: new Map([['A', { startedAt: 5_000, workedSeconds: 17 }]]),
+              turnJournal
+            })
+          )
+        })
+        const disclosure = renderer!.root.findByType('result').props.disclosure
+        const list: NativeChatMessage[] = disclosure.listMessages
+        const drawn = list.map((entry, index) => {
+          const row = disclosure.resolveRow(index, entry)
+          return [entry.id, row.turnStatus?.workedSeconds, row.activeTurnIsWorking]
+        })
+        expect(drawn).toEqual([
+          ['A', 17, false],
+          ['a-tool-1', undefined, false],
+          ['a-tool-2', undefined, false],
+          ['FIRST DONE', undefined, false],
+          ['B', null, true],
+          ['b-answer', undefined, true]
+        ])
+      } finally {
+        vi.useRealTimers()
+      }
+    }
+  )
+
   it('keeps at most the latest 128 turns expanded', () => {
     vi.useFakeTimers()
     try {
@@ -204,4 +675,47 @@ describe('useMobileNativeChatTurnDisclosure', () => {
       vi.useRealTimers()
     }
   })
+
+  it('keeps a turn the provider opened live while it runs, and the turn before it settled', () => {
+    let sequence = 0
+    const entry = (
+      itemId: string,
+      body: AgentJournalItemBody,
+      turnScope: AgentJournalTurnScope = { kind: 'thread' }
+    ): AgentJournalRenderItem => {
+      sequence += 1
+      return { itemId, revision: 0, sequence, observedAt: sequence, body, turnScope }
+    }
+    const said = (itemId: string, turnItemId: string) =>
+      entry(
+        itemId,
+        { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: itemId }] },
+        { kind: 'turn', turnItemId }
+      )
+    const items = [
+      entry('u1', { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'go' }] }),
+      entry('t1', { kind: 'turn', turnId: 't1', state: 'completed', userItemId: 'u1' }),
+      said('a1', 't1'),
+      entry('wake', { kind: 'turn', turnId: 'wake', state: 'running', userItemId: 'claude:wake' }),
+      said('wake-note', 'wake')
+    ]
+    const messages: NativeChatMessage[] = ['u1', 'a1', 'wake-note'].map((id, index) => ({
+      ...userMessage(id),
+      role: index === 0 ? 'user' : 'assistant'
+    }))
+    act(() => {
+      renderer = create(
+        createElement(Harness, {
+          messages,
+          enabled: true,
+          settledTurns: new Map([['u1', { startedAt: 500, workedSeconds: 4 }]]),
+          turnJournal: { items, submissions: [] }
+        })
+      )
+    })
+    const disclosure = renderer!.root.findByType('result').props.disclosure
+    const rows = messages.map((message, index) => disclosure.resolveRow(index, message))
+    expect(rows.map((row) => row.activeTurnIsWorking)).toEqual([false, false, true])
+    expect(rows[0].turnStatus?.workedSeconds).toBe(4)
+  })
 })
diff --git a/mobile/src/session/use-mobile-native-chat-turn-disclosure.ts b/mobile/src/session/use-mobile-native-chat-turn-disclosure.ts
index a67a6a88663..6e1d4df395e 100644
--- a/mobile/src/session/use-mobile-native-chat-turn-disclosure.ts
+++ b/mobile/src/session/use-mobile-native-chat-turn-disclosure.ts
@@ -2,17 +2,27 @@ import { useCallback, useMemo, useState } from 'react'
 import type { NativeChatMessage } from '../../../src/shared/native-chat-types'
 import type { NativeChatSettledTurns } from '../../../src/shared/native-chat-turn-status'
 import {
-  MOBILE_UNANCHORED_TURN_KEY,
+  nativeChatMessagesWaitingBehindLiveTurn,
+  nativeChatTurnMembership,
+  type NativeChatTurnJournal
+} from '../../../src/shared/native-chat-turn-membership'
+import {
+  nativeChatRowsInDrawOrder,
+  nativeChatTurnBarRows
+} from '../../../src/shared/native-chat-turn-grouping'
+import {
   useMobileNativeChatTurnStatus,
   type NativeChatTurnStatus
 } from './use-mobile-native-chat-turn-status'
 
 const EMPTY_TURN_IDS: ReadonlySet<string> = new Set()
-const EMPTY_TURN_KEYS: readonly undefined[] = []
+const NO_TURN_KEYS: readonly undefined[] = []
 const MAX_EXPANDED_TURNS = 128
 
 export type MobileNativeChatTurnRow = {
   turnStatus: NativeChatTurnStatus | null
+  /** The bar renders above the row: its turn has no user bubble of its own. */
+  turnStatusAbove?: boolean
   turnExpanded: boolean
   /** Set only on a settled turn — the one row that has activity to disclose. */
   turnKey?: string
@@ -28,6 +38,7 @@ export function useMobileNativeChatTurnDisclosure({
   isWorking,
   workingStartedAt,
   settledTurns,
+  turnJournal = null,
   thinking = false,
   activityText = null,
   scopeKey
@@ -38,6 +49,8 @@ export function useMobileNativeChatTurnDisclosure({
   workingStartedAt?: number | null
   /** Host-recorded durations; they outrank whatever this client observed. */
   settledTurns?: NativeChatSettledTurns | null
+  /** The journal that places each row in its turn; absent groups rows by position. */
+  turnJournal?: NativeChatTurnJournal | null
   /** Whether the turn is reasoning right now, derived from its journal content. */
   thinking?: boolean
   /** What the provider says the live turn is doing; outranks the other labels. */
@@ -50,9 +63,39 @@ export function useMobileNativeChatTurnDisclosure({
   activeActivityText: string | null
   onToggleTurn: (turnKey: string) => void
   resolveRow: (index: number, message: NativeChatMessage) => MobileNativeChatTurnRow
+  /** The list's rows, in the order they draw, less those waiting behind the live turn. */
+  listMessages: readonly NativeChatMessage[]
+  /** Rows waiting behind the live turn, drawn after its live status. */
+  waitingRows: readonly { item: NativeChatMessage; index: number }[]
 } {
+  // Resolve each row's turn, which turn is live, and the order the rows draw in, once: from the
+  // turn record when the host states scopes, else by journal order.
+  const { rows, turnKeys, liveTurnKey } = useMemo(() => {
+    if (!enabled) {
+      return { rows: messages, turnKeys: NO_TURN_KEYS, liveTurnKey: undefined }
+    }
+    const membership = nativeChatTurnMembership(messages, turnJournal)
+    return {
+      rows: nativeChatRowsInDrawOrder(messages, membership.drawOrder),
+      turnKeys: nativeChatRowsInDrawOrder(membership.turnKeys, membership.drawOrder),
+      liveTurnKey: membership.liveTurnKey
+    }
+  }, [enabled, messages, turnJournal])
+  // A message waiting behind the live turn draws after that turn's live status, not in the list.
+  const waiting = useMemo(() => {
+    const ids = enabled ? nativeChatMessagesWaitingBehindLiveTurn(rows, turnJournal?.items) : null
+    if (!ids?.size) {
+      return { listMessages: rows, waitingRows: [], indexById: null }
+    }
+    return {
+      listMessages: rows.filter((message) => !ids.has(message.id)),
+      waitingRows: rows.flatMap((item, index) => (ids.has(item.id) ? [{ item, index }] : [])),
+      indexById: new Map(rows.map((message, index) => [message.id, index]))
+    }
+  }, [enabled, rows, turnJournal])
   const turnStatuses = useMobileNativeChatTurnStatus({
-    messages,
+    turnKeys,
+    liveTurnKey,
     enabled,
     isWorking,
     workingStartedAt,
@@ -84,49 +127,50 @@ export function useMobileNativeChatTurnDisclosure({
     },
     [scopeKey]
   )
-  // Resolve each row's turn boundary once — a findLast per row is quadratic on a
-  // long transcript.
-  const turnKeys = useMemo(() => {
-    if (!enabled) {
-      return EMPTY_TURN_KEYS
-    }
-    let turnKey: string | undefined
-    return messages.map((message) => {
-      if (message.role === 'user') {
-        turnKey = message.id
-      }
-      return turnKey
-    })
-  }, [enabled, messages])
+  const bars = useMemo(() => nativeChatTurnBarRows(rows, turnKeys), [rows, turnKeys])
 
   const { active, activeTurnKey, completedByTurn } = turnStatuses
   const activeActivityText = enabled && isWorking ? (activityText ?? null) : null
   const resolveRow = useCallback(
-    (index: number, message: NativeChatMessage): MobileNativeChatTurnRow => {
+    (listIndex: number, message: NativeChatMessage): MobileNativeChatTurnRow => {
+      const index = waiting.indexById?.get(message.id) ?? listIndex
       const turnKey = turnKeys[index]
+      const bar = turnKey === undefined ? undefined : bars.get(turnKey)
+      // A turn's bar draws at its first row; the live turn's carries its running clock and settles
+      // in place. A message folded into a turn (a steer) carries none.
       const turnStatus =
-        !enabled || message.role !== 'user'
-          ? null
-          : turnKey
-            ? (completedByTurn[turnKey] ?? null)
-            : null
+        enabled && turnKey !== undefined && bar?.index === index
+          ? turnKey === activeTurnKey
+            ? active
+            : (completedByTurn[turnKey] ?? null)
+          : null
       return {
         turnStatus,
+        ...(bar?.above === true && turnStatus !== null ? { turnStatusAbove: true } : {}),
         turnExpanded: turnKey ? expandedTurnIds.has(turnKey) : false,
         // Why: the key travels and the row calls one stable handler with it. A
         // closure per row would be a new identity every render of a streaming
         // transcript, defeating the row's memo; caching one per turn would mean
         // writing a ref during render, which react-freeze can discard.
         turnKey: turnKey && turnStatus?.workedSeconds != null ? turnKey : undefined,
-        // With no user boundary at all, the session's working state stays authoritative.
-        activeTurnIsWorking:
-          enabled &&
-          isWorking &&
-          (turnKey === activeTurnKey ||
-            (turnKey === undefined && activeTurnKey === MOBILE_UNANCHORED_TURN_KEY))
+        // Liveness is the live turn's rows, not the newest prompt's: a running turn's rows stay live
+        // while a newer message waits behind it. With no user boundary at all, the session's
+        // working state stays authoritative.
+        activeTurnIsWorking: enabled && isWorking && turnKey === liveTurnKey
       }
     },
-    [turnKeys, enabled, activeTurnKey, completedByTurn, expandedTurnIds, isWorking]
+    [
+      turnKeys,
+      waiting,
+      bars,
+      liveTurnKey,
+      enabled,
+      activeTurnKey,
+      active,
+      completedByTurn,
+      expandedTurnIds,
+      isWorking
+    ]
   )
 
   return {
@@ -134,6 +178,8 @@ export function useMobileNativeChatTurnDisclosure({
     activeActivityText,
     /** Stable for a given chat scope, so it never disturbs a row's memo. */
     onToggleTurn: toggleExpandedTurn,
-    resolveRow
+    resolveRow,
+    listMessages: waiting.listMessages,
+    waitingRows: waiting.waitingRows
   }
 }
diff --git a/mobile/src/session/use-mobile-native-chat-turn-status.ts b/mobile/src/session/use-mobile-native-chat-turn-status.ts
index f7cbb2dd887..f7d440dd738 100644
--- a/mobile/src/session/use-mobile-native-chat-turn-status.ts
+++ b/mobile/src/session/use-mobile-native-chat-turn-status.ts
@@ -1,6 +1,6 @@
 import { useEffect, useMemo, useRef, useState } from 'react'
-import type { NativeChatMessage } from '../../../src/shared/native-chat-types'
 import {
+  NATIVE_CHAT_UNANCHORED_TURN_KEY,
   reduceNativeChatTurnTiming,
   selectNativeChatTurnStatuses,
   type NativeChatSettledTurns,
@@ -10,7 +10,6 @@ import {
 
 export type { NativeChatTurnStatus }
 
-export const MOBILE_UNANCHORED_TURN_KEY = '__unanchored__'
 const EMPTY_TURN_TIMING_BY_TURN: NativeChatTurnTimingByTurn = Object.freeze({})
 
 type ScopedTurnTiming = {
@@ -21,7 +20,8 @@ type ScopedTurnTiming = {
 /** Per-turn "Thinking / Working for N / Worked for N" timing, on the same shared
  *  state machine the desktop renderer uses so the two surfaces stamp turns alike. */
 export function useMobileNativeChatTurnStatus({
-  messages,
+  turnKeys,
+  liveTurnKey,
   enabled,
   isWorking,
   workingStartedAt,
@@ -29,7 +29,10 @@ export function useMobileNativeChatTurnStatus({
   thinking = false,
   scopeKey
 }: {
-  messages: readonly NativeChatMessage[]
+  /** Each row's turn, as `nativeChatTurnMembership` places it. */
+  turnKeys: readonly (string | undefined)[]
+  /** The live turn, whose bar carries the running clock (`nativeChatTurnMembership`). */
+  liveTurnKey: string | undefined
   enabled: boolean
   isWorking: boolean
   workingStartedAt?: number | null
@@ -44,11 +47,7 @@ export function useMobileNativeChatTurnStatus({
   completedByTurn: Readonly<Record<string, NativeChatTurnStatus>>
   activeTurnKey: string
 } {
-  const latestUserIndex = enabled
-    ? messages.findLastIndex((message) => message.role === 'user')
-    : -1
-  const latestUserId = latestUserIndex !== -1 ? (messages[latestUserIndex]?.id ?? null) : null
-  const activeTurnKey = latestUserId ?? MOBILE_UNANCHORED_TURN_KEY
+  const activeTurnKey = (enabled ? liveTurnKey : undefined) ?? NATIVE_CHAT_UNANCHORED_TURN_KEY
   const [scopedTiming, setScopedTiming] = useState<ScopedTurnTiming>(() => ({
     scopeKey,
     timingByTurn: {}
@@ -67,9 +66,7 @@ export function useMobileNativeChatTurnStatus({
     if (!enabled) {
       return
     }
-    const validTurnKeys = new Set(
-      messages.filter((message) => message.role === 'user').map((message) => message.id)
-    )
+    const validTurnKeys = new Set(turnKeys.filter((turnKey) => turnKey !== undefined))
     const previousActiveTurnKey =
       previousActiveTurn.current?.scopeKey === scopeKey
         ? previousActiveTurn.current.turnKey
@@ -90,7 +87,7 @@ export function useMobileNativeChatTurnStatus({
         ? current
         : { scopeKey, timingByTurn: nextTiming }
     })
-  }, [activeTurnKey, enabled, isWorking, messages, scopeKey, workingStartedAt])
+  }, [activeTurnKey, enabled, isWorking, scopeKey, turnKeys, workingStartedAt])
 
   // Why: the selection rebuilds its status objects on every call, and a streaming
   // turn re-renders ~20x/s. Without this, every settled turn's row gets fresh
diff --git a/mobile/src/session/use-mobile-pr-ai-triage.test.ts b/mobile/src/session/use-mobile-pr-ai-triage.test.ts
new file mode 100644
index 00000000000..d3e284fe882
--- /dev/null
+++ b/mobile/src/session/use-mobile-pr-ai-triage.test.ts
@@ -0,0 +1,120 @@
+import { createElement } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { RpcClient } from '../transport/rpc-client'
+import type { ConnectionState, RpcResponse } from '../transport/types'
+
+vi.mock('../platform/haptics', () => ({ triggerError: vi.fn(), triggerSuccess: vi.fn() }))
+
+import { useMobilePrAiTriage, type MobilePrAiTriage } from './use-mobile-pr-ai-triage'
+
+const LAUNCH_CAPABILITIES = [
+  'agent.launch.v2',
+  'agent.launch.replay.v1',
+  'agent.launch.replay-required.v1'
+]
+
+function rpcReply(result: unknown): RpcResponse {
+  return { id: 'rpc', ok: true, result, _meta: { runtimeId: 'r' } }
+}
+
+const LAUNCHED_WITH_PROMPT = rpcReply({
+  outcome: { kind: 'terminal', handle: 'term-1' },
+  worktreeId: 'wt-1',
+  receipt: { mode: 'terminal', preferred: 'terminal', reason: 'user_default', detail: 'd' },
+  prompt: { delivery: 'submit', outcome: 'handed-to-terminal' }
+})
+
+const LAUNCHED_WITHOUT_PROMPT = rpcReply({
+  outcome: { kind: 'terminal', handle: 'term-1' },
+  worktreeId: 'wt-1',
+  receipt: { mode: 'terminal', preferred: 'terminal', reason: 'user_default', detail: 'd' },
+  prompt: { delivery: 'submit', outcome: 'not-delivered' }
+})
+
+function hostClient(launchReply: RpcResponse = LAUNCHED_WITHOUT_PROMPT): RpcClient {
+  const sendRequest = vi.fn(async (method: string): Promise<RpcResponse> => {
+    if (method === 'repo.list') {
+      return rpcReply({ repos: [{ id: 'wt-1' }] })
+    }
+    if (method === 'settings.get') {
+      return rpcReply({ settings: { defaultTuiAgent: 'codex' } })
+    }
+    if (method === 'preflight.detectAgents') {
+      return rpcReply(['codex'])
+    }
+    return launchReply
+  })
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the hook reaches the client only through sendRequest.
+  return { sendRequest } as unknown as RpcClient
+}
+
+describe('useMobilePrAiTriage', () => {
+  let renderer: ReactTestRenderer | null = null
+  let triage: MobilePrAiTriage | null = null
+
+  afterEach(() => {
+    act(() => renderer?.unmount())
+    renderer = null
+    triage = null
+  })
+
+  function mount(client: RpcClient | null, connState: ConnectionState = 'connected') {
+    function Harness(): null {
+      triage = useMobilePrAiTriage({
+        client,
+        connState,
+        worktreeId: 'wt-1',
+        workspaceLabel: 'feature-login',
+        hostCapabilities: LAUNCH_CAPABILITIES,
+        hostStatusPending: false,
+        hostStatusReadable: true
+      })
+      return null
+    }
+    act(() => {
+      renderer = create(createElement(Harness))
+    })
+  }
+
+  it('shows an undelivered prompt only under the button that launched it', async () => {
+    mount(hostClient())
+    await act(async () => {
+      await triage?.launch('fix-checks', () => 'fix the failing checks')
+    })
+    expect(triage?.noticeFor('fix-checks')).toMatchObject({
+      error: "The agent started, but the prompt wasn't sent."
+    })
+    expect(triage?.noticeFor('fix-checks').undeliveredPrompt).toContain('fix the failing checks')
+    expect(triage?.noticeFor('fix-checks').success).toBeNull()
+    expect(triage?.noticeFor('resolve-conflicts')).toEqual({
+      success: null,
+      error: null,
+      warning: null,
+      undeliveredPrompt: null
+    })
+  })
+
+  it('confirms a launch that delivered its prompt under the tapped button, naming the workspace', async () => {
+    mount(hostClient(LAUNCHED_WITH_PROMPT))
+    await act(async () => {
+      await triage?.launch('resolve-conflicts', () => 'resolve the conflicts')
+    })
+    expect(triage?.noticeFor('resolve-conflicts')).toEqual({
+      success: 'Agent started in feature-login',
+      error: null,
+      warning: null,
+      undeliveredPrompt: null
+    })
+    expect(triage?.noticeFor('fix-checks').success).toBeNull()
+  })
+
+  it('shows a refusal before launch only under the tapped button', async () => {
+    mount(null, 'disconnected')
+    await act(async () => {
+      await triage?.launch('resolve-conflicts', () => 'resolve')
+    })
+    expect(triage?.noticeFor('resolve-conflicts').error).toBe('Waiting for desktop…')
+    expect(triage?.noticeFor('fix-checks').error).toBeNull()
+  })
+})
diff --git a/mobile/src/session/use-mobile-pr-ai-triage.ts b/mobile/src/session/use-mobile-pr-ai-triage.ts
index d3186f36ab1..70215d9bbf0 100644
--- a/mobile/src/session/use-mobile-pr-ai-triage.ts
+++ b/mobile/src/session/use-mobile-pr-ai-triage.ts
@@ -2,61 +2,131 @@ import { useCallback, useRef, useState } from 'react'
 import type { ConnectionState } from '../transport/types'
 import type { RpcClient } from '../transport/rpc-client'
 import { triggerError, triggerSuccess } from '../platform/haptics'
-import { createTerminalAndSendPrompt } from './pr-ai-triage-launch'
+import { launchAgentWithPrompt, promptedLaunchNotice } from './pr-ai-triage-launch'
+import {
+  resolveMobileAgentLaunchAvailability,
+  type MobileAgentLaunchAvailability
+} from './mobile-agent-launch-availability'
 
 // Launches an agent for the PR triage actions ("Fix checks with AI" / "Resolve
-// conflicts with AI") via createTerminalAndSendPrompt; see pr-ai-triage-launch.ts.
+// conflicts with AI") via launchAgentWithPrompt; see pr-ai-triage-launch.ts.
 
 export type PrAiTriageKey = 'fix-checks' | 'resolve-conflicts'
 
+// The desktop's saved-recipe ids and telemetry sources for the same two buttons.
+const TRIAGE_LAUNCH = {
+  'fix-checks': { actionId: 'fixChecks', launchSource: 'task_page' },
+  'resolve-conflicts': { actionId: 'resolveConflicts', launchSource: 'conflict_resolution' }
+} as const
+
+/** What the last launch from one button left to show under that button. */
+export type PrAiTriageLaunchNotice = {
+  success: string | null
+  error: string | null
+  warning: string | null
+  /** The agent started without its prompt; kept so the user can paste it in themselves. */
+  undeliveredPrompt: string | null
+}
+
+const NO_LAUNCH_NOTICE: PrAiTriageLaunchNotice = {
+  success: null,
+  error: null,
+  warning: null,
+  undeliveredPrompt: null
+}
+
 type Input = {
   client: RpcClient | null
   connState: ConnectionState
   worktreeId: string
+  /** Named in the confirmation; the screen's workspace label, else its branch. */
+  workspaceLabel: string | null
+  hostCapabilities: readonly string[]
+  hostStatusPending: boolean
+  hostStatusReadable: boolean
 }
 
 export function useMobilePrAiTriage(input: Input) {
-  const { client, connState, worktreeId } = input
+  const {
+    client,
+    connState,
+    worktreeId,
+    workspaceLabel,
+    hostCapabilities,
+    hostStatusPending,
+    hostStatusReadable
+  } = input
   const [busyKey, setBusyKey] = useState<PrAiTriageKey | null>(null)
-  const [error, setError] = useState<string | null>(null)
+  // Keyed by button, so one button's launch never shows (or offers to copy) under the other.
+  const [notices, setNotices] = useState<Partial<Record<PrAiTriageKey, PrAiTriageLaunchNotice>>>({})
   // Synchronous lock: setBusyKey commits async, so a fast double-tap could pass the
   // busyKey check twice before either render. The ref flips immediately and dedupes.
   const inFlightRef = useRef(false)
+  const availability: MobileAgentLaunchAvailability = resolveMobileAgentLaunchAvailability({
+    hostCapabilities,
+    statusPending: hostStatusPending,
+    statusReadable: hostStatusReadable
+  })
+
+  const setNotice = useCallback((key: PrAiTriageKey, notice: PrAiTriageLaunchNotice) => {
+    setNotices((current) => ({ ...current, [key]: notice }))
+  }, [])
 
   const launch = useCallback(
     async (key: PrAiTriageKey, buildPrompt: () => string): Promise<boolean> => {
       // Guard re-entry: one triage launch at a time keeps us from opening a pile
-      // of terminals on a fast double-tap.
+      // of agents on a fast double-tap.
       if (inFlightRef.current || busyKey !== null) {
         return false
       }
       if (!client || connState !== 'connected') {
-        setError('Waiting for desktop…')
+        setNotice(key, { ...NO_LAUNCH_NOTICE, error: 'Waiting for desktop…' })
         triggerError()
         return false
       }
       inFlightRef.current = true
       setBusyKey(key)
-      setError(null)
+      setNotice(key, NO_LAUNCH_NOTICE)
       try {
-        await createTerminalAndSendPrompt(client, worktreeId, buildPrompt())
-        triggerSuccess()
-        return true
+        const prompt = buildPrompt()
+        const result = await launchAgentWithPrompt({
+          client,
+          hostCapabilities,
+          worktreeId,
+          prompt,
+          ...TRIAGE_LAUNCH[key]
+        })
+        const notice = promptedLaunchNotice(result, workspaceLabel)
+        if (notice.succeeded) {
+          triggerSuccess()
+        } else {
+          triggerError()
+        }
+        setNotice(key, {
+          success: notice.success,
+          error: notice.error,
+          warning: notice.warning,
+          undeliveredPrompt: notice.undeliveredPrompt
+        })
+        return notice.succeeded
       } catch (err) {
         triggerError()
-        setError(err instanceof Error ? err.message : 'Failed to launch agent')
+        setNotice(key, {
+          ...NO_LAUNCH_NOTICE,
+          error: err instanceof Error ? err.message : 'Failed to launch agent'
+        })
         return false
       } finally {
         inFlightRef.current = false
         setBusyKey(null)
       }
     },
-    [busyKey, client, connState, worktreeId]
+    [busyKey, client, connState, hostCapabilities, setNotice, workspaceLabel, worktreeId]
   )
 
   return {
-    error,
-    clearError: useCallback(() => setError(null), []),
+    availability,
+    noticeFor: (key: PrAiTriageKey): PrAiTriageLaunchNotice => notices[key] ?? NO_LAUNCH_NOTICE,
     isBusy: useCallback((key: PrAiTriageKey) => busyKey === key, [busyKey]),
     launch
   }
diff --git a/mobile/src/session/use-mobile-session-accessory-selection.ts b/mobile/src/session/use-mobile-session-accessory-selection.ts
index 7e3cfcfa76c..a9795d82b1f 100644
--- a/mobile/src/session/use-mobile-session-accessory-selection.ts
+++ b/mobile/src/session/use-mobile-session-accessory-selection.ts
@@ -8,9 +8,10 @@ import {
   triggerError,
   triggerEdgeBump
 } from '../platform/haptics'
-import type {
-  TerminalKeyboardAvoidanceMetrics,
-  TerminalModes
+import {
+  sameTerminalKeyboardAvoidanceMetrics,
+  type TerminalKeyboardAvoidanceMetrics,
+  type TerminalModes
 } from '../terminal/terminal-webview-contract'
 import type { createTerminalLiveAccessoryInput } from '../terminal/terminal-live-accessory-input'
 import { clearTerminalLiveInputFocusTimer } from '../terminal/terminal-live-input'
@@ -165,13 +166,7 @@ export function useMobileSessionAccessorySelection(scope: MobileSessionTerminalI
     (handle: string, metrics: TerminalKeyboardAvoidanceMetrics) => {
       setTerminalKeyboardMetrics((prev) => {
         const current = prev.get(handle)
-        if (
-          current &&
-          current.cursorY === metrics.cursorY &&
-          current.contentBottomRow === metrics.contentBottomRow &&
-          current.rows === metrics.rows &&
-          current.altScreen === metrics.altScreen
-        ) {
+        if (current && sameTerminalKeyboardAvoidanceMetrics(current, metrics)) {
           return prev
         }
         return new Map(prev).set(handle, metrics)
diff --git a/mobile/src/session/use-mobile-session-document-readers.test.ts b/mobile/src/session/use-mobile-session-document-readers.test.ts
new file mode 100644
index 00000000000..70de6de02a3
--- /dev/null
+++ b/mobile/src/session/use-mobile-session-document-readers.test.ts
@@ -0,0 +1,95 @@
+import { describe, expect, it, vi } from 'vitest'
+import { hookMount, performHookAction } from '../test-support/rpc-recording/hook-mount'
+import { mountFixture } from '../test-support/rpc-recording/recorder-fixture-shape'
+import type { RpcResponse } from '../transport/types'
+import type { MarkdownDocState } from './mobile-session-route-types'
+import { useMobileSessionDocumentReaders } from './use-mobile-session-document-readers'
+
+const META = { runtimeId: 'runtime-1' }
+
+async function readMarkdown(reply: RpcResponse): Promise<MarkdownDocState | undefined> {
+  let docs = new Map<string, MarkdownDocState>()
+  let readers: ReturnType<typeof useMobileSessionDocumentReaders> | undefined
+  const hook = hookMount(() => {
+    readers = useMobileSessionDocumentReaders(
+      mountFixture<Parameters<typeof useMobileSessionDocumentReaders>[0]>({
+        worktreeId: 'wt-1',
+        client: { sendRequest: vi.fn(async (): Promise<RpcResponse> => reply) },
+        setMarkdownDocs: (update) => {
+          docs = typeof update === 'function' ? update(docs) : update
+        },
+        setFileDocs: () => {}
+      })
+    )
+  })
+  hook.mount()
+  await performHookAction(() =>
+    readers?.readMarkdownTab(
+      mountFixture<Parameters<typeof readers.readMarkdownTab>[0]>({
+        type: 'markdown',
+        id: 'tab-md',
+        relativePath: 'README.md',
+        isDirty: false
+      })
+    )
+  )
+  hook.unmount()
+  return docs.get('tab-md')
+}
+
+function readTabResult(extra: Record<string, unknown> = {}): RpcResponse {
+  return {
+    id: 'frame-1',
+    ok: true,
+    result: {
+      tabId: 'tab-md',
+      content: '# head',
+      version: 'content:6:0',
+      isDirty: false,
+      editable: false,
+      readOnlyReason: 'file_too_large',
+      ...extra
+    },
+    _meta: META
+  }
+}
+
+describe('useMobileSessionDocumentReaders markdown reads', () => {
+  it('shows an older desktop refusing an oversize file as too large', async () => {
+    const doc = await readMarkdown({
+      id: 'frame-1',
+      ok: false,
+      error: { code: 'runtime_error', message: 'file_too_large' },
+      _meta: META
+    })
+    expect(doc).toEqual({ status: 'error', message: 'File too large for mobile preview' })
+  })
+
+  it('keeps the generic message for an unknown refusal', async () => {
+    const doc = await readMarkdown({
+      id: 'frame-1',
+      ok: false,
+      error: { code: 'tab_not_found', message: 'No such tab' },
+      _meta: META
+    })
+    expect(doc).toEqual({ status: 'error', message: "Couldn't load markdown" })
+  })
+
+  it('carries a truncated prefix and the full size into the document', async () => {
+    const doc = await readMarkdown(readTabResult({ truncated: true, byteLength: 3_000_000 }))
+    expect(doc).toMatchObject({
+      status: 'ready',
+      content: '# head',
+      editable: false,
+      truncated: true,
+      byteLength: 3_000_000
+    })
+  })
+
+  it('adds no truncation fields for a whole document', async () => {
+    const doc = await readMarkdown(readTabResult())
+    expect(doc).toMatchObject({ status: 'ready', content: '# head' })
+    expect(doc).not.toHaveProperty('truncated')
+    expect(doc).not.toHaveProperty('byteLength')
+  })
+})
diff --git a/mobile/src/session/use-mobile-session-document-readers.ts b/mobile/src/session/use-mobile-session-document-readers.ts
index 857d1981570..bc2e3d69e8e 100644
--- a/mobile/src/session/use-mobile-session-document-readers.ts
+++ b/mobile/src/session/use-mobile-session-document-readers.ts
@@ -34,7 +34,10 @@ export function useMobileSessionDocumentReaders(scope: MobileSessionTabApplicati
               isDirty: false,
               editable: result.editable === true,
               stale: result.isDirty,
-              readOnlyReason: result.readOnlyReason
+              readOnlyReason: result.readOnlyReason,
+              ...(result.truncated === true
+                ? { truncated: true, byteLength: result.byteLength }
+                : {})
             })
           )
           return
@@ -59,15 +62,16 @@ export function useMobileSessionDocumentReaders(scope: MobileSessionTabApplicati
             buildMarkdownDiskFallbackDoc({
               content: fileResult.content,
               truncated: fileResult.truncated,
+              byteLength: fileResult.byteLength,
               tabIsDirty: tab.isDirty
             })
           )
         )
-      } catch {
+      } catch (err) {
         setMarkdownDocs((prev) =>
           new Map(prev).set(tab.id, {
             status: 'error',
-            message: "Couldn't load markdown"
+            message: documentReadErrorMessage(err, "Couldn't load markdown")
           })
         )
       }
@@ -89,15 +93,12 @@ export function useMobileSessionDocumentReaders(scope: MobileSessionTabApplicati
         })
         setFileDocs((prev) => new Map(prev).set(tab.id, doc))
       } catch (err) {
-        const message = err instanceof Error ? err.message : ''
-        const previewMessage =
-          message === 'binary_file'
-            ? 'Binary preview unavailable'
-            : message === 'file_too_large'
-              ? 'File too large for mobile preview'
-              : tab.diffSource === 'staged' || tab.diffSource === 'unstaged'
-                ? "Couldn't load diff preview"
-                : "Couldn't load file preview"
+        const previewMessage = documentReadErrorMessage(
+          err,
+          tab.diffSource === 'staged' || tab.diffSource === 'unstaged'
+            ? "Couldn't load diff preview"
+            : "Couldn't load file preview"
+        )
         setFileDocs((prev) =>
           new Map(prev).set(tab.id, {
             status: 'error',
@@ -114,5 +115,17 @@ export function useMobileSessionDocumentReaders(scope: MobileSessionTabApplicati
   }
 }
 
+// Why: older desktops refuse oversize markdown as a bare runtime_error whose message is the code.
+function documentReadErrorMessage(err: unknown, fallback: string): string {
+  const message = err instanceof Error ? err.message : ''
+  if (message === 'binary_file') {
+    return 'Binary preview unavailable'
+  }
+  if (message === 'file_too_large') {
+    return 'File too large for mobile preview'
+  }
+  return fallback
+}
+
 export type MobileSessionDocumentReadersModel = MobileSessionTabApplicationModel &
   ReturnType<typeof useMobileSessionDocumentReaders>
diff --git a/mobile/src/session/use-mobile-session-feedback-capabilities.ts b/mobile/src/session/use-mobile-session-feedback-capabilities.ts
index f0231189309..ea8d6438bf4 100644
--- a/mobile/src/session/use-mobile-session-feedback-capabilities.ts
+++ b/mobile/src/session/use-mobile-session-feedback-capabilities.ts
@@ -2,6 +2,7 @@ import { useState, useRef, useCallback } from 'react'
 import { Animated } from 'react-native'
 import { reconcileMobileSessionCreateWarningState } from './mobile-session-create-warning-state'
 import type { MobileSessionTerminalRuntimeModel } from './use-mobile-session-terminal-runtime'
+import type { StructuredAgentSessionHostSupport } from './mobile-structured-agent-session-host-support'
 
 export function useMobileSessionFeedbackCapabilities(scope: MobileSessionTerminalRuntimeModel) {
   const {
@@ -32,11 +33,10 @@ export function useMobileSessionFeedbackCapabilities(scope: MobileSessionTermina
     null
   )
   const [quickCommandsSupported, setQuickCommandsSupported] = useState<boolean | null>(null)
-  // Prompt cancellation is negotiated with the same host capability probe as
+  // Structured-session features are negotiated with the same host capability probe as
   // the other session surfaces; consumers never maintain a second status cache.
-  const [agentSessionPromptCancelSupported, setAgentSessionPromptCancelSupported] = useState<
-    boolean | null
-  >(null)
+  const [agentSessionHostSupport, setAgentSessionHostSupport] =
+    useState<StructuredAgentSessionHostSupport | null>(null)
   // Why: stable callbacks (handleFileTap) read the live value via this ref, since
   // the capability probe resolves after the callbacks are created.
   const browserScreencastSupportedRef = useRef(browserScreencastSupported)
@@ -120,8 +120,8 @@ export function useMobileSessionFeedbackCapabilities(scope: MobileSessionTermina
     setAgentSessionHistorySupported,
     quickCommandsSupported,
     setQuickCommandsSupported,
-    agentSessionPromptCancelSupported,
-    setAgentSessionPromptCancelSupported,
+    agentSessionHostSupport,
+    setAgentSessionHostSupport,
     browserScreencastSupportedRef,
     reconciledCreateWarningState,
     createWarning,
diff --git a/mobile/src/session/use-mobile-session-keyboard-state.test.tsx b/mobile/src/session/use-mobile-session-keyboard-state.test.tsx
index e1f12b7414d..96ab0a8d4ab 100644
--- a/mobile/src/session/use-mobile-session-keyboard-state.test.tsx
+++ b/mobile/src/session/use-mobile-session-keyboard-state.test.tsx
@@ -73,8 +73,7 @@ function Harness(): null {
     initializedHandlesRef: { current: new Set() },
     showNativeChatRef: { current: false },
     subscribeToTerminal: () => {},
-    terminalFrameHeightRef: { current: 0 },
-    terminalFrameWidth: 0,
+    terminalFrameRef: { current: null },
     terminalRefs: { current: new Map() },
     unsubscribeTerminal: () => {},
     viewportMeasuredRef: { current: false },
@@ -121,10 +120,10 @@ describe('what the session screen hears about the keyboard', () => {
     expect(harness.notifyKeyboardVisibility).toHaveBeenLastCalledWith(false)
   })
 
-  it('holds the refit off on the page, where the keyboard is open and covers nothing', async () => {
-    // Inside the shell the WebView is already shortened, so the seam reports no occlusion: the
-    // dock needs no lift. Refitting on that height change would reflow the desktop PTY on every
-    // keyboard open, which is the reflow the visibility flag exists to defer.
+  it('holds the refit off for a keyboard that is open and covers nothing', async () => {
+    // A floating keyboard reports no occlusion, so the dock needs no lift. Refitting on that height
+    // change would reflow the desktop PTY on every keyboard open, which is the reflow the
+    // visibility flag exists to defer.
     const tree = await mount()
     harness.keyboard = { height: 0, visible: true }
     await rerender(tree)
diff --git a/mobile/src/session/use-mobile-session-keyboard-state.ts b/mobile/src/session/use-mobile-session-keyboard-state.ts
index 6d9ec467a35..cfc5f9af011 100644
--- a/mobile/src/session/use-mobile-session-keyboard-state.ts
+++ b/mobile/src/session/use-mobile-session-keyboard-state.ts
@@ -31,8 +31,7 @@ export type MobileSessionKeyboardScope = Pick<
   | 'tabStripOffsetRef'
   | 'tabStripRef'
   | 'tabStripViewportWidthRef'
-  | 'terminalFrameHeightRef'
-  | 'terminalFrameWidth'
+  | 'terminalFrameRef'
   | 'terminalRefs'
   | 'terminals'
   | 'terminalTextScale'
@@ -67,17 +66,21 @@ export function useMobileSessionKeyboardState(scope: MobileSessionKeyboardScope)
     terminalRefs,
     initializedHandlesRef,
     activeHandleRef,
-    terminalFrameHeightRef,
-    terminalFrameWidth,
+    terminalFrameRef,
     showNativeChatRef,
     unsubscribeTerminal,
     subscribeToTerminal
   } = scope
   // Why: non-subscribe layout refits (tab strip, fold, rotation) live in a dedicated hook — see terminal-viewport-refit.ts.
-  const { notifyTerminalFrameHeight, notifyKeyboardVisibility } = useTerminalViewportRefit({
+  const {
+    notifyTerminalFrameHeight,
+    notifyTerminalFrameWidth,
+    notifyKeyboardVisibility,
+    notifyTerminalCellBoxChange
+  } = useTerminalViewportRefit({
     activeHandleRef,
     terminalRefs,
-    terminalFrameHeightRef,
+    terminalFrameRef,
     viewportRef,
     viewportMeasuredRef,
     nativeChatCoveredRef: showNativeChatRef,
@@ -87,7 +90,6 @@ export function useMobileSessionKeyboardState(scope: MobileSessionKeyboardScope)
     connState,
     tabStripVisible: terminals.length > 1,
     textScale: terminalTextScale,
-    terminalFrameWidth,
     unsubscribeTerminal,
     subscribeToTerminal
   })
@@ -151,7 +153,9 @@ export function useMobileSessionKeyboardState(scope: MobileSessionKeyboardScope)
   }, [router])
   return {
     notifyTerminalFrameHeight,
+    notifyTerminalFrameWidth,
     notifyKeyboardVisibility,
+    notifyTerminalCellBoxChange,
     scrollActiveTabIntoView,
     handleDeleteCustomKey,
     handleManageShortcuts
diff --git a/mobile/src/session/use-mobile-session-native-chat-dictation.ts b/mobile/src/session/use-mobile-session-native-chat-dictation.ts
index 8ea9de2b9f0..4dc1743e221 100644
--- a/mobile/src/session/use-mobile-session-native-chat-dictation.ts
+++ b/mobile/src/session/use-mobile-session-native-chat-dictation.ts
@@ -27,7 +27,7 @@ export function useMobileSessionNativeChatDictation(
     worktreeId,
     client,
     connState,
-    agentSessionPromptCancelSupported,
+    agentSessionHostSupport,
     setInput,
     liveInputTerminalHandles,
     activeHandle,
@@ -73,7 +73,7 @@ export function useMobileSessionNativeChatDictation(
     nativeChatTranscriptIsLocalReadable,
     nativeChatInputLeaseReady,
     connState,
-    agentSessionPromptCancelSupported,
+    agentSessionHostSupport,
     onSendError: nativeChatSendError.show,
     onSendResolved: nativeChatSendError.clear
   })
diff --git a/mobile/src/session/use-mobile-session-presentation.ts b/mobile/src/session/use-mobile-session-presentation.ts
index 2bea9158db0..dca323343b0 100644
--- a/mobile/src/session/use-mobile-session-presentation.ts
+++ b/mobile/src/session/use-mobile-session-presentation.ts
@@ -1,9 +1,9 @@
-import { Platform } from 'react-native'
 import { classifyConnection, verdictDisplayLabel } from '../transport/connection-health'
 import { computeActiveTerminalKeyboardLift } from '../terminal/terminal-keyboard-avoidance-lift'
 import { useInitialSessionTerminalAutoCreate } from './use-initial-session-terminal-autocreate'
 import { MOBILE_SESSION_STATUS_LABELS } from './mobile-session-route-helpers'
 import type { MobileSessionBulkCloseModel } from './use-mobile-session-bulk-close'
+import { hostOs } from '../platform/host-os'
 
 export function useMobileSessionPresentation(scope: MobileSessionBulkCloseModel) {
   const {
@@ -25,7 +25,7 @@ export function useMobileSessionPresentation(scope: MobileSessionBulkCloseModel)
     toastOpacityRef,
     hostEndpoint,
     initialSessionAutoCreateRef,
-    terminalFrameHeightRef,
+    terminalFrameRef,
     handleCreateTerminal,
     visibleTabs,
     forceReconnectHost
@@ -77,14 +77,14 @@ export function useMobileSessionPresentation(scope: MobileSessionBulkCloseModel)
   // Why: iOS keyboard height includes the home-indicator inset; Android IME height does not.
   const keyboardLift =
     keyboardHeight > 0
-      ? Platform.OS === 'ios'
+      ? hostOs() === 'ios'
         ? Math.max(0, keyboardHeight - insets.bottom)
         : keyboardHeight
       : 0
   const activeTerminalKeyboardLift = computeActiveTerminalKeyboardLift({
     keyboardLift,
     metrics: activeHandle ? terminalKeyboardMetrics.get(activeHandle) : undefined,
-    terminalFrameHeight: terminalFrameHeightRef.current
+    terminalFrameHeight: terminalFrameRef.current?.height ?? 0
   })
   const toastAnimatedStyle = {
     opacity: toastOpacityRef.current,
diff --git a/mobile/src/session/use-mobile-session-tab-reconciliation.ts b/mobile/src/session/use-mobile-session-tab-reconciliation.ts
index da7a48e035c..9f9af59833d 100644
--- a/mobile/src/session/use-mobile-session-tab-reconciliation.ts
+++ b/mobile/src/session/use-mobile-session-tab-reconciliation.ts
@@ -2,10 +2,8 @@ import { useEffect, useRef, useCallback, useMemo, useState } from 'react'
 import { startRuntimeCapabilityProbe } from '../transport/runtime-capability-probe'
 import { supportsMobileQuickCommands } from '../terminal/quick-commands'
 import { MOBILE_AI_VAULT_CAPABILITY } from '../agent-history/agent-history-capability'
-import {
-  AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY,
-  TERMINAL_QUERY_REPLY_INPUT_RUNTIME_CAPABILITY
-} from '../../../src/shared/protocol-version'
+import { TERMINAL_QUERY_REPLY_INPUT_RUNTIME_CAPABILITY } from '../../../src/shared/protocol-version'
+import { structuredAgentSessionHostSupport } from './mobile-structured-agent-session-host-support'
 import { runAcceptedMobileSessionTabsEffects } from './mobile-session-tabs-accepted-effects'
 import type { SessionTabsStreamSource } from './mobile-session-tabs-stream-health'
 import { useMobileSessionTabsFetchReporting } from './use-mobile-session-tabs-fetch-reporting'
@@ -34,7 +32,7 @@ export function useMobileSessionTabReconciliation(scope: MobileSessionMarkdownAc
     switchSessionTabRef,
     setBrowserScreencastSupported,
     setAgentSessionHistorySupported,
-    setAgentSessionPromptCancelSupported,
+    setAgentSessionHostSupport,
     setQuickCommandsSupported,
     nativeChatStream,
     fetchTerminals,
@@ -152,7 +150,7 @@ export function useMobileSessionTabReconciliation(scope: MobileSessionMarkdownAc
     if (!client || connState !== 'connected') {
       setBrowserScreencastSupported(null)
       setAgentSessionHistorySupported(null)
-      setAgentSessionPromptCancelSupported(null)
+      setAgentSessionHostSupport(null)
       setQuickCommandsSupported(null)
       setShowQuickCommands(false)
       hostQueryReplyInputSupportedRef.current = false
@@ -162,7 +160,7 @@ export function useMobileSessionTabReconciliation(scope: MobileSessionMarkdownAc
     // host; clear the prior capability before exposing host-specific actions.
     setBrowserScreencastSupported(null)
     setAgentSessionHistorySupported(null)
-    setAgentSessionPromptCancelSupported(null)
+    setAgentSessionHostSupport(null)
     setQuickCommandsSupported(null)
     setShowQuickCommands(false)
     hostQueryReplyInputSupportedRef.current = false
@@ -171,9 +169,7 @@ export function useMobileSessionTabReconciliation(scope: MobileSessionMarkdownAc
     return startRuntimeCapabilityProbe(client, (capabilities) => {
       setBrowserScreencastSupported(capabilities.includes('browser.screencast.v1'))
       setAgentSessionHistorySupported(capabilities.includes(MOBILE_AI_VAULT_CAPABILITY))
-      setAgentSessionPromptCancelSupported(
-        capabilities.includes(AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY)
-      )
+      setAgentSessionHostSupport(structuredAgentSessionHostSupport(capabilities))
       setQuickCommandsSupported(supportsMobileQuickCommands(capabilities))
       // Why: hosts without this capability strip inputKind from terminal.send,
       // so a forwarded xterm reply would become floor-stealing shell input.
diff --git a/mobile/src/session/use-mobile-session-terminal-runtime.ts b/mobile/src/session/use-mobile-session-terminal-runtime.ts
index 374a9eefd94..b19213f5356 100644
--- a/mobile/src/session/use-mobile-session-terminal-runtime.ts
+++ b/mobile/src/session/use-mobile-session-terminal-runtime.ts
@@ -1,10 +1,12 @@
 import { useState, useRef, useCallback } from 'react'
-import { Platform, type Keyboard, type TextInput } from 'react-native'
+import type { TerminalFrame } from '../terminal/terminal-webview-messages'
+import type { Keyboard, TextInput } from 'react-native'
 import { useFocusEffect } from 'expo-router'
 import type { RpcClient } from '../transport/rpc-client'
 import type { ConnectionState } from '../transport/types'
 import type { TerminalModes, TerminalWebViewHandle } from '../terminal/terminal-webview-contract'
 import { useTerminalLiveInputFocus } from '../terminal/use-terminal-live-input-focus'
+import { reopensFocusedInputWhenKeyboardHidden } from '../terminal/terminal-live-input-keyboard-reopen'
 import type { TerminalLiveInputSender } from '../terminal/terminal-live-input-sender'
 import { useTerminalLiveInputCommit } from '../terminal/use-terminal-live-input-commit'
 import { resolveMobileTerminalInputGate } from '../terminal/terminal-input-connection-gate'
@@ -101,10 +103,9 @@ export function useMobileSessionTerminalRuntime(scope: MobileSessionScreenStateM
   // Why: highest applyLayout seq seen per handle; drop older scrollback/resized as stale, but a >20 gap resets (fresh subscription/server restart).
   const layoutSeqRef = useRef<Map<string, number>>(new Map())
   const sendingRef = useRef(false)
-  // Why: exact terminal-frame height for measureFitDimensions; window.innerHeight can overstate the visible area.
-  const terminalFrameHeightRef = useRef<number>(0)
-  // Why: sidebar resizes change the terminal frame width without a window-dim change; track it so the refit hook re-fits (see terminal-viewport-refit.ts).
-  const [terminalFrameWidth, setTerminalFrameWidth] = useState(0)
+  // Why: the terminal frame React Native laid out, unrounded, for every fit; window.innerHeight can
+  // overstate the visible area. Null until the frame's first layout.
+  const terminalFrameRef = useRef<TerminalFrame | null>(null)
   const activeSessionTab = sessionTabs.find((tab) => tab.id === activeSessionTabId) ?? null
   const {
     clearPendingLiveInputCommit,
@@ -142,7 +143,7 @@ export function useMobileSessionTerminalRuntime(scope: MobileSessionScreenStateM
     lifecycleIdentity: client,
     lifecycleKey: JSON.stringify([hostId, worktreeId, connState]),
     liveInputEnabled,
-    reopenFocusedInputWhenKeyboardHidden: Platform.OS === 'android',
+    reopenFocusedInputWhenKeyboardHidden: reopensFocusedInputWhenKeyboardHidden(),
     timerRef: liveInputFocusTimerRef
   })
   useFocusEffect(
@@ -195,9 +196,7 @@ export function useMobileSessionTerminalRuntime(scope: MobileSessionScreenStateM
     delayedActionTimersRef,
     layoutSeqRef,
     sendingRef,
-    terminalFrameHeightRef,
-    terminalFrameWidth,
-    setTerminalFrameWidth,
+    terminalFrameRef,
     activeSessionTab,
     clearPendingLiveInputCommit,
     flushPendingLiveInputBeforeExternalSend,
diff --git a/mobile/src/session/use-mobile-session-terminal-subscription-foundation.ts b/mobile/src/session/use-mobile-session-terminal-subscription-foundation.ts
index 76d8229b288..306adec9b33 100644
--- a/mobile/src/session/use-mobile-session-terminal-subscription-foundation.ts
+++ b/mobile/src/session/use-mobile-session-terminal-subscription-foundation.ts
@@ -8,8 +8,6 @@ export function useMobileSessionTerminalSubscriptionFoundation(
     setCoveredStreamRevision,
     setTerminalKeyboardMetrics,
     terminalCwdRef,
-    viewportRef,
-    viewportMeasuredRef,
     terminalRefs,
     terminalUnsubsRef,
     subscribingHandlesRef,
@@ -21,7 +19,6 @@ export function useMobileSessionTerminalSubscriptionFoundation(
     activeHandleRef,
     subscribeSeqRef,
     layoutSeqRef,
-    terminalFrameHeightRef,
     nativeChatInputLeaseReadyRef,
     clearNativeChatInputLease,
     showNativeChatRef
@@ -83,30 +80,11 @@ export function useMobileSessionTerminalSubscriptionFoundation(
       term.clear()
     }
   }, [clearNativeChatInputLease])
-
-  // Why: measure the phone viewport once from the first TerminalWebView; dims ride every subscribe so the server auto-fits without a separate RPC.
-  const measureViewportOnce = useCallback(
-    async (handle: string) => {
-      if (viewportMeasuredRef.current) {
-        return
-      }
-      const dims = await getTerminalRef(handle)?.measureFitDimensions(
-        terminalFrameHeightRef.current || undefined
-      )
-      terminalDiagnosticsRef.current.viewportMeasured(handle, dims, terminalFrameHeightRef.current)
-      if (dims) {
-        viewportRef.current = dims
-        viewportMeasuredRef.current = true
-      }
-    },
-    [getTerminalRef]
-  )
   return {
     getTerminalRef,
     unsubscribeTerminal,
     unsubscribeTerminalRef,
-    clearTerminalCache,
-    measureViewportOnce
+    clearTerminalCache
   }
 }
 
diff --git a/mobile/src/session/use-mobile-session-terminal-subscription.test.tsx b/mobile/src/session/use-mobile-session-terminal-subscription.test.tsx
new file mode 100644
index 00000000000..ef2954e183b
--- /dev/null
+++ b/mobile/src/session/use-mobile-session-terminal-subscription.test.tsx
@@ -0,0 +1,230 @@
+import { createElement } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { TerminalWebViewHandle } from '../terminal/terminal-webview-contract'
+import { MobileTerminalDiagnostics } from './mobile-terminal-diagnostics'
+import { TerminalViewportResubscribeBudget } from './mobile-terminal-viewport-resubscribe'
+import type { MobileSessionTerminalSubscriptionFoundationModel } from './use-mobile-session-terminal-subscription-foundation'
+import { useMobileSessionTerminalSubscription } from './use-mobile-session-terminal-subscription'
+import type { MobileSessionTabSwitchingModel } from './use-mobile-session-tab-switching'
+import { useMobileSessionTerminalWebview } from './use-mobile-session-terminal-webview'
+
+const HANDLE = 'term-1'
+const PHONE = { cols: 55, rows: 44 }
+
+type StreamHandler = (result: unknown) => void
+
+/** The route's subscribe, driven end to end against a recording client and terminal. */
+function subscriptionHarness(opts: {
+  fit: typeof PHONE | null
+  webReady: boolean
+  frameWidth?: number
+  viewport?: typeof PHONE
+}) {
+  let fit = opts.fit
+  const order: string[] = []
+  const handlers: StreamHandler[] = []
+  const terminal: TerminalWebViewHandle = {
+    prepareForForegroundRecovery: vi.fn(),
+    write: vi.fn(),
+    init: vi.fn(({ cols, rows }: { cols: number; rows: number }) => {
+      order.push(`init ${cols}x${rows}`)
+      // An init's document reports its laid-out box before its ready.
+      fit = fit ?? PHONE
+    }),
+    resize: vi.fn(),
+    reflow: vi.fn(),
+    clear: vi.fn(),
+    fitDimensions: vi.fn(() => fit),
+    resetZoom: vi.fn(),
+    cancelSelect: vi.fn(),
+    doSelectAll: vi.fn(),
+    awaitReady: vi.fn(async () => {})
+  }
+  const terminalUnsubsRef = { current: new Map<string, () => void>() }
+  const subscribeSeqRef = { current: new Map<string, number>() }
+  const subscribingHandlesRef = { current: new Set<string>() }
+  const initializedHandlesRef = { current: new Set<string>() }
+  const webReadyHandlesRef = { current: new Set<string>(opts.webReady ? [HANDLE] : []) }
+  const terminalFrameRef: { current: { width: number; height: number } | null } = {
+    current: opts.frameWidth === 0 ? null : { width: opts.frameWidth ?? 427, height: 751 }
+  }
+  const fields = {
+    client: {
+      subscribe: vi.fn(
+        (_method: string, params: Record<string, unknown>, onData: StreamHandler) => {
+          order.push(`subscribe ${JSON.stringify(params.viewport ?? null)}`)
+          handlers.push(onData)
+          return () => {}
+        }
+      )
+    },
+    clientId: 'client-1',
+    setTerminalModes: vi.fn(),
+    terminalCwdRef: { current: new Map() },
+    viewportRef: { current: opts.viewport ?? null },
+    viewportMeasuredRef: { current: opts.viewport !== undefined },
+    terminalUnsubsRef,
+    subscribingHandlesRef,
+    leaseOnlyHandlesRef: { current: new Set<string>() },
+    initializedHandlesRef,
+    terminalDiagnosticsRef: { current: new MobileTerminalDiagnostics() },
+    viewportResubscribeBudgetRef: { current: new TerminalViewportResubscribeBudget() },
+    webReadyHandlesRef,
+    activeHandleRef: { current: HANDLE },
+    subscribeSeqRef,
+    layoutSeqRef: { current: new Map() },
+    terminalFrameRef,
+    scheduleDelayedAction: vi.fn(),
+    showToast: vi.fn(),
+    markNativeChatInputLeaseReady: vi.fn(),
+    showNativeChatRef: { current: false },
+    getTerminalRef: (handle: string | null) => (handle === HANDLE ? terminal : undefined),
+    unsubscribeTerminal: (handle: string) => {
+      terminalUnsubsRef.current.delete(handle)
+      subscribingHandlesRef.current.delete(handle)
+      subscribeSeqRef.current.set(handle, (subscribeSeqRef.current.get(handle) ?? 0) + 1)
+    },
+    unsubscribeTerminalRef: { current: vi.fn() },
+    signalTerminalInventoryRecovery: vi.fn(),
+    terminalRefs: { current: new Map([[HANDLE, terminal]]) },
+    pendingActiveTerminalHandleRef: { current: null },
+    nativeChatStream: { notifyWebReady: vi.fn() },
+    terminalGestureInputBucketsRef: { current: new Map() },
+    terminalGestureInputQueuesRef: { current: new Map() },
+    terminalGestureInputInFlightRef: { current: new Set() },
+    activeSessionTab: null,
+    markdownDocs: new Map(),
+    fileDocs: new Map(),
+    readMarkdownTab: vi.fn(),
+    readFileTab: vi.fn(),
+    notifyTerminalFrameHeight: vi.fn(),
+    notifyTerminalFrameWidth: vi.fn()
+  }
+  let subscribe: ((handle: string) => void) | undefined
+  let webReady: ((handle: string) => void) | undefined
+  let notifyFrame: ((frame: { width: number; height: number }) => void) | undefined
+  function Probe() {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the hook destructures only the fields built above.
+    const scope = fields as unknown as MobileSessionTerminalSubscriptionFoundationModel
+    subscribe = useMobileSessionTerminalSubscription(scope).subscribeToTerminal
+    const withSubscribe = { ...fields, subscribeToTerminal: subscribe }
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the web-ready handler reads only the fields built above.
+    const webviewScope = withSubscribe as unknown as MobileSessionTabSwitchingModel
+    const webview = useMobileSessionTerminalWebview(webviewScope)
+    webReady = webview.handleTerminalWebReady
+    notifyFrame = webview.notifyTerminalFrame
+    return null
+  }
+  act(() => {
+    renderer = create(createElement(Probe))
+  })
+  const scrollback = (index: number, cols: number, rows: number) =>
+    act(() => {
+      handlers[index]({ type: 'scrollback', seq: 1, cols, rows, serialized: 'x' })
+    })
+  return {
+    order,
+    subscribe: () => act(() => subscribe!(HANDLE)),
+    scrollback,
+    terminal,
+    // The document's web-ready, carrying the box xterm laid out.
+    documentReady: () => {
+      act(() => webReady!(HANDLE))
+    },
+    fields,
+    terminalFrameRef,
+    // The frame's onLayout.
+    layOutFrame: (width: number, height = 751) => act(() => notifyFrame!({ width, height }))
+  }
+}
+
+let renderer: ReactTestRenderer | undefined
+afterEach(() => {
+  act(() => renderer?.unmount())
+  renderer = undefined
+})
+
+describe('a terminal first subscribe', () => {
+  it('does not subscribe before its document is ready, then subscribes once from its box', async () => {
+    const harness = subscriptionHarness({ fit: PHONE, webReady: false })
+    harness.subscribe()
+    expect(harness.order).toEqual([])
+    harness.documentReady()
+    expect(harness.order).toEqual(['subscribe {"cols":55,"rows":44}'])
+    harness.scrollback(0, PHONE.cols, PHONE.rows)
+    await act(async () => {})
+    expect(harness.order).toEqual(['subscribe {"cols":55,"rows":44}', 'init 55x44'])
+  })
+
+  it('resubscribes a document reloaded after its first ready, which lost its terminal', async () => {
+    const harness = subscriptionHarness({ fit: PHONE, webReady: false })
+    harness.documentReady()
+    harness.scrollback(0, PHONE.cols, PHONE.rows)
+    await act(async () => {})
+    harness.documentReady()
+    harness.scrollback(1, PHONE.cols, PHONE.rows)
+    await act(async () => {})
+    expect(harness.order.filter((step) => step.startsWith('init'))).toEqual([
+      'init 55x44',
+      'init 55x44'
+    ])
+  })
+
+  it('sizes from the reported box against the laid-out frame', () => {
+    const harness = subscriptionHarness({ fit: PHONE, webReady: true, frameWidth: 427.5 })
+    harness.subscribe()
+    expect(harness.terminal.fitDimensions).toHaveBeenCalledWith({ width: 427.5, height: 751 })
+    expect(harness.order).toEqual(['subscribe {"cols":55,"rows":44}'])
+  })
+
+  it('keeps a measured viewport rather than fitting again', () => {
+    const measured = { cols: 60, rows: 40 }
+    const harness = subscriptionHarness({ fit: PHONE, webReady: true, viewport: measured })
+    harness.subscribe()
+    expect(harness.terminal.fitDimensions).not.toHaveBeenCalled()
+    expect(harness.order).toEqual(['subscribe {"cols":60,"rows":40}'])
+  })
+
+  it('holds a ready document without a box until its frame is laid out', () => {
+    const harness = subscriptionHarness({ fit: null, webReady: true, frameWidth: 0 })
+    harness.subscribe()
+    expect(harness.order).toEqual([])
+    // The frame's first layout subscribes the document held back for it.
+    harness.layOutFrame(427)
+    expect(harness.order).toEqual(['subscribe null'])
+  })
+
+  it('keeps one frame, notifies a new width, and subscribes on the first layout only', () => {
+    const harness = subscriptionHarness({ fit: null, webReady: true, frameWidth: 0 })
+    const { notifyTerminalFrameHeight, notifyTerminalFrameWidth } = harness.fields
+    harness.layOutFrame(0, 0)
+    expect(harness.terminalFrameRef.current).toBeNull()
+    harness.layOutFrame(427, 751)
+    harness.layOutFrame(427, 700)
+    expect(harness.order).toEqual(['subscribe null'])
+    expect(notifyTerminalFrameWidth).not.toHaveBeenCalled()
+    // A hidden 0x0 layout keeps the box it was laid out at.
+    harness.layOutFrame(0, 0)
+    expect(harness.terminalFrameRef.current).toEqual({ width: 427, height: 700 })
+    harness.layOutFrame(360.5, 700)
+    expect(harness.terminalFrameRef.current).toEqual({ width: 360.5, height: 700 })
+    expect(notifyTerminalFrameWidth).toHaveBeenCalledTimes(1)
+    expect(notifyTerminalFrameHeight.mock.calls.map(([height]) => height)).toEqual([
+      0, 751, 700, 0, 700
+    ])
+  })
+
+  it('goes without dims when no cell box was reported, and the fit pass resubscribes once', async () => {
+    const harness = subscriptionHarness({ fit: null, webReady: true })
+    harness.subscribe()
+    expect(harness.order).toEqual(['subscribe null'])
+    harness.scrollback(0, 120, 40)
+    await vi.waitFor(() => expect(harness.order).toHaveLength(3))
+    expect(harness.order).toEqual([
+      'subscribe null',
+      'init 120x40',
+      'subscribe {"cols":55,"rows":44}'
+    ])
+  })
+})
diff --git a/mobile/src/session/use-mobile-session-terminal-subscription.ts b/mobile/src/session/use-mobile-session-terminal-subscription.ts
index e92fb12488e..73af79a959d 100644
--- a/mobile/src/session/use-mobile-session-terminal-subscription.ts
+++ b/mobile/src/session/use-mobile-session-terminal-subscription.ts
@@ -34,7 +34,7 @@ export function useMobileSessionTerminalSubscription(
     activeHandleRef,
     subscribeSeqRef,
     layoutSeqRef,
-    terminalFrameHeightRef,
+    terminalFrameRef,
     scheduleDelayedAction,
     showToast,
     markNativeChatInputLeaseReady,
@@ -72,7 +72,8 @@ export function useMobileSessionTerminalSubscription(
       )
       // Why: a native-chat-covered terminal has no mounted webview, so only gate on the webview when not covered.
       if (!covered) {
-        if (!getTerminalRef(handle)) {
+        const ref = getTerminalRef(handle)
+        if (!ref) {
           logSkippedGate('no-webview-ref')
           return
         }
@@ -80,6 +81,21 @@ export function useMobileSessionTerminalSubscription(
           logSkippedGate('webview-not-ready')
           return
         }
+        const frame = terminalFrameRef.current
+        if (!viewportMeasuredRef.current) {
+          // Why: the frame's first layout subscribes it; going now would miss the dims (page web-ready precedes it).
+          if (!frame) {
+            logSkippedGate('frame-not-laid-out')
+            return
+          }
+          // Why: sized from the box the ready document reported, the host serializes the snapshot at the phone's size.
+          const dims = ref.fitDimensions(frame)
+          diagnostics.viewportMeasured(handle, dims, frame.height)
+          if (dims) {
+            viewportRef.current = dims
+            viewportMeasuredRef.current = true
+          }
+        }
       }
 
       subscribingHandlesRef.current.add(handle)
@@ -91,6 +107,10 @@ export function useMobileSessionTerminalSubscription(
       const seq = (subscribeSeqRef.current.get(handle) ?? 0) + 1
       subscribeSeqRef.current.set(handle, seq)
       diagnostics.streamArmed(handle, seq, viewportRef.current)
+      const sentViewport = nativeChatTerminalStream.mobileNativeChatSubscribeViewport(
+        covered,
+        viewportRef.current
+      )
 
       // Why: viewport is embedded in the subscribe params so the server auto-fits before serializing scrollback (no focus→safeFit race).
       const unsub = subscribeMobileTerminalSafely(
@@ -98,10 +118,7 @@ export function useMobileSessionTerminalSubscription(
         {
           terminal: handle,
           client: { id: clientId, type: 'mobile' as const },
-          viewport: nativeChatTerminalStream.mobileNativeChatSubscribeViewport(
-            covered,
-            viewportRef.current
-          ),
+          viewport: sentViewport,
           capabilities: nativeChatTerminalStream.mobileNativeChatTerminalCapabilities(covered),
           // Undefined on a phone, where no per-message cap exists; omitted rather than sent as
           // undefined so an older host sees the params it has always seen.
@@ -178,7 +195,7 @@ export function useMobileSessionTerminalSubscription(
               })
               return
             }
-            ref.init(cols, rows, initialData, false, oscLinks)
+            ref.init({ cols, rows, initialData, oscLinks, frame: terminalFrameRef.current })
             initializedHandlesRef.current.add(handle)
             if (data.displayMode) {
               const displayMode = data.displayMode as MobileDisplayMode
@@ -189,14 +206,15 @@ export function useMobileSessionTerminalSubscription(
             }
             // Why: cold-start refit — init()'s fit can run against a transient scrollWidth, so re-fire against a settled DOM.
             scheduleDelayedAction(() => getTerminalRef(handle)?.resetZoom(), 200)
-            // Why: first subscribe has no viewport (xterm not loaded yet), so measure after init
-            // and resubscribe so the server can phone-fit — bounded per handle so a
+            // Why: a subscribe without a viewport (no reported cell box) measures after init and
+            // resubscribes so the server can phone-fit — bounded per handle so a
             // non-converging host degrades visibly instead of hot-looping (STA-3337).
             runTerminalViewportFitPass({
               handle,
               seq,
               hostCols,
               hostRows,
+              sentViewport: sentViewport ?? null,
               budget: viewportResubscribeBudgetRef.current,
               diagnostics,
               viewportRef,
@@ -204,7 +222,7 @@ export function useMobileSessionTerminalSubscription(
               subscribeSeqRef,
               initializedHandlesRef,
               terminalUnsubsRef,
-              terminalFrameHeightRef,
+              terminalFrameRef,
               getTerminalRef,
               unsubscribeTerminal,
               subscribeToTerminal,
@@ -245,9 +263,16 @@ export function useMobileSessionTerminalSubscription(
             diagnostics.streamResized(handle, seq, eventSeq, data, getTerminalRef(handle) != null)
             const oscLinks = isTerminalOscLinkRanges(data.oscLinks) ? data.oscLinks : undefined
             if (serialized != null) {
-              getTerminalRef(handle)?.init(cols, rows, serialized, true, oscLinks)
+              getTerminalRef(handle)?.init({
+                cols,
+                rows,
+                initialData: serialized,
+                preserveScroll: true,
+                oscLinks,
+                frame: terminalFrameRef.current
+              })
             } else {
-              getTerminalRef(handle)?.resize(cols, rows)
+              getTerminalRef(handle)?.resize(cols, rows, terminalFrameRef.current)
             }
             if (data.displayMode) {
               const displayMode = data.displayMode as MobileDisplayMode
diff --git a/mobile/src/session/use-mobile-session-terminal-webview.ts b/mobile/src/session/use-mobile-session-terminal-webview.ts
index 56af08c6309..484930f1218 100644
--- a/mobile/src/session/use-mobile-session-terminal-webview.ts
+++ b/mobile/src/session/use-mobile-session-terminal-webview.ts
@@ -1,5 +1,6 @@
 import { useEffect, useCallback } from 'react'
 import type { TerminalWebViewHandle } from '../terminal/terminal-webview-contract'
+import type { TerminalFrame } from '../terminal/terminal-webview-messages'
 import type { MobileSessionTabSwitchingModel } from './use-mobile-session-tab-switching'
 
 export function useMobileSessionTerminalWebview(scope: MobileSessionTabSwitchingModel) {
@@ -18,11 +19,13 @@ export function useMobileSessionTerminalWebview(scope: MobileSessionTabSwitching
     pendingActiveTerminalHandleRef,
     activeSessionTab,
     unsubscribeTerminal,
-    measureViewportOnce,
     subscribeToTerminal,
     nativeChatStream,
     readMarkdownTab,
-    readFileTab
+    readFileTab,
+    terminalFrameRef,
+    notifyTerminalFrameHeight,
+    notifyTerminalFrameWidth
   } = scope
   // Why: only store the ref; subscribe on web-ready to avoid the blank-terminal race (init queued before xterm.js loaded).
   const setTerminalWebViewRef = useCallback((handle: string, ref: TerminalWebViewHandle | null) => {
@@ -60,20 +63,48 @@ export function useMobileSessionTerminalWebview(scope: MobileSessionTabSwitching
         }
         return
       }
-      // Why: first subscribe may skip (no WebView ref); await measure so it carries the viewport, else it races measureViewportOnce and skips.
       // Why: a just-created tab can lose activeHandleRef to a lagging snapshot; honor the pending marker so its web-ready subscribe still fires.
-      const isIntendedActive = () =>
+      const isIntendedActive =
         handle === activeHandleRef.current || handle === pendingActiveTerminalHandleRef.current
-      if (isIntendedActive() && !terminalUnsubsRef.current.has(handle)) {
-        void (async () => {
-          await measureViewportOnce(handle)
-          if (isIntendedActive() && !terminalUnsubsRef.current.has(handle)) {
-            subscribeToTerminal(handle)
-          }
-        })()
+      // Why: web-ready carried the cell box xterm laid out, so subscribeToTerminal sizes this subscribe.
+      if (isIntendedActive && !terminalUnsubsRef.current.has(handle)) {
+        subscribeToTerminal(handle)
       }
     },
-    [measureViewportOnce, nativeChatStream, subscribeToTerminal, unsubscribeTerminal]
+    [nativeChatStream, subscribeToTerminal, unsubscribeTerminal]
+  )
+
+  const subscribeIntendedActiveTerminal = useCallback(() => {
+    const handle = pendingActiveTerminalHandleRef.current ?? activeHandleRef.current
+    if (handle && !terminalUnsubsRef.current.has(handle)) {
+      subscribeToTerminal(handle)
+    }
+  }, [activeHandleRef, pendingActiveTerminalHandleRef, subscribeToTerminal, terminalUnsubsRef])
+
+  /** The terminal frame React Native laid out: kept in the one frame ref, then what it changed. */
+  const notifyTerminalFrame = useCallback(
+    (frame: TerminalFrame) => {
+      // Why: notify height imperatively so dock settling re-fits the PTY without rerendering SessionScreen.
+      notifyTerminalFrameHeight(Math.round(frame.height))
+      // Why: the page reports a hidden frame as 0x0; it keeps the box it was laid out at.
+      if (frame.width <= 0) {
+        return
+      }
+      const previous = terminalFrameRef.current
+      terminalFrameRef.current = frame
+      if (!previous) {
+        // Why: a ready document held back for its frame subscribes on the first layout.
+        subscribeIntendedActiveTerminal()
+      } else if (frame.width !== previous.width) {
+        notifyTerminalFrameWidth()
+      }
+    },
+    [
+      notifyTerminalFrameHeight,
+      notifyTerminalFrameWidth,
+      subscribeIntendedActiveTerminal,
+      terminalFrameRef
+    ]
   )
 
   useEffect(() => {
@@ -97,7 +128,8 @@ export function useMobileSessionTerminalWebview(scope: MobileSessionTabSwitching
   }, [activeSessionTab, fileDocs, readFileTab])
   return {
     setTerminalWebViewRef,
-    handleTerminalWebReady
+    handleTerminalWebReady,
+    notifyTerminalFrame
   }
 }
 
diff --git a/mobile/src/session/use-mobile-structured-agent-session-hold-refused.test.tsx b/mobile/src/session/use-mobile-structured-agent-session-hold-refused.test.tsx
new file mode 100644
index 00000000000..cba5ec91ba8
--- /dev/null
+++ b/mobile/src/session/use-mobile-structured-agent-session-hold-refused.test.tsx
@@ -0,0 +1,103 @@
+import { createElement } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import type { AgentSessionSubscribeEvent } from '../../../src/shared/agent-session-wire'
+import type { RpcClient } from '../transport/rpc-client'
+import { useMobileStructuredAgentSession } from './use-mobile-structured-agent-session'
+
+const asyncStorage = vi.hoisted(() => ({
+  getItem: vi.fn(async () => null),
+  setItem: vi.fn(async () => undefined),
+  removeItem: vi.fn(async () => undefined)
+}))
+
+vi.mock('@react-native-async-storage/async-storage', () => ({ default: asyncStorage }))
+
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a literal snapshot frame; the hook reads its type, page and fence.
+const SNAPSHOT: AgentSessionSubscribeEvent = {
+  type: 'snapshot',
+  sessionId: 'session-1',
+  fence: 3,
+  page: {
+    sessionId: 'session-1',
+    epoch: 'epoch-1',
+    direction: 'tail',
+    items: [
+      {
+        itemId: 'msg-1',
+        revision: 1,
+        sequence: 1,
+        observedAt: 10,
+        body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'still here' }] }
+      }
+    ],
+    removedItemIds: [],
+    submissions: [],
+    window: {
+      oldest: { epoch: 'epoch-1', sequence: 1 },
+      newest: { epoch: 'epoch-1', sequence: 1 },
+      nextCursor: { epoch: 'epoch-1', sequence: 2 }
+    },
+    liveCursor: { epoch: 'epoch-1', sequence: 1 },
+    hasOlder: false,
+    hasNewer: false
+  }
+} as AgentSessionSubscribeEvent
+
+let renderer: ReactTestRenderer | null = null
+let hook: ReturnType<typeof useMobileStructuredAgentSession> | null = null
+
+afterEach(() => {
+  act(() => renderer?.unmount())
+  renderer = null
+  hook = null
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+it('subscribes when an older host refuses the hold, and shows the transcript (P2-24)', async () => {
+  const sendRequest = vi.fn(async (method: string) =>
+    method === 'agentSession.hold'
+      ? {
+          ok: false,
+          error: { code: 'agent_session_owner_restart_failed', message: 'Codex could not start.' },
+          _meta: { runtimeId: 'runtime-1' }
+        }
+      : { ok: true, result: {}, _meta: { runtimeId: 'runtime-1' } }
+  )
+  const subscribe = vi.fn((_method: string, _params: unknown, onData: (value: unknown) => void) => {
+    onData(SNAPSHOT)
+    return () => undefined
+  })
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: an RPC client stub with the two members the hook calls.
+  const client = { sendRequest, subscribe } as unknown as RpcClient
+  function Harness(): null {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the hook's options, of which this test supplies the ones it reads.
+    hook = useMobileStructuredAgentSession({
+      client,
+      sessionId: 'session-1',
+      sourceIdentity: 'host-a\0workspace-a',
+      enabled: true,
+      connected: true,
+      agent: 'codex',
+      onSendError: () => undefined
+    } as never)
+    return null
+  }
+
+  act(() => {
+    renderer = create(createElement(Harness))
+  })
+
+  await vi.waitFor(() =>
+    expect(subscribe).toHaveBeenCalledWith(
+      'agentSession.subscribe',
+      { sessionId: 'session-1' },
+      expect.any(Function)
+    )
+  )
+  await vi.waitFor(() => expect(hook?.session.messages.length).toBeGreaterThan(0))
+  expect(hook?.session.status).not.toBe('error')
+})
diff --git a/mobile/src/session/use-mobile-structured-agent-session-prompt-cancel.test.tsx b/mobile/src/session/use-mobile-structured-agent-session-prompt-cancel.test.tsx
index 2ce48ff908d..2e18bce750c 100644
--- a/mobile/src/session/use-mobile-structured-agent-session-prompt-cancel.test.tsx
+++ b/mobile/src/session/use-mobile-structured-agent-session-prompt-cancel.test.tsx
@@ -5,7 +5,14 @@ import type { AgentJournalRenderItem } from '../../../src/shared/agent-session-j
 import type { StructuredAgentSessionState } from '../../../src/shared/structured-agent-session-reducer'
 import type { RpcClient } from '../transport/rpc-client'
 
-const mocks = vi.hoisted(() => ({ sendRequest: vi.fn() }))
+const mocks = vi.hoisted(() => ({
+  sendRequest: vi.fn(),
+  promptResponses: vi.fn(() => ({
+    groupedDraft: null,
+    respondPermission: vi.fn(),
+    respondQuestion: vi.fn()
+  }))
+}))
 vi.mock('./use-mobile-structured-agent-state', () => ({
   useMobileStructuredAgentState: () => ({
     state,
@@ -25,11 +32,7 @@ vi.mock('./use-mobile-structured-agent-options', () => ({
   })
 }))
 vi.mock('./use-mobile-structured-prompt-responses', () => ({
-  useMobileStructuredPromptResponses: () => ({
-    groupedDraft: null,
-    respondPermission: vi.fn(),
-    respondQuestion: vi.fn()
-  })
+  useMobileStructuredPromptResponses: mocks.promptResponses
 }))
 vi.mock('./use-mobile-structured-send-operation-reconciliation', () => ({
   useMobileStructuredSendOperationReconciliation: vi.fn()
@@ -104,7 +107,13 @@ const client: RpcClient = {
   close: () => {}
 }
 
-function Harness({ promptCancelSupported }: { promptCancelSupported: boolean }): null {
+function Harness({
+  promptCancelSupported,
+  questionAnswersSupported = false
+}: {
+  promptCancelSupported: boolean
+  questionAnswersSupported?: boolean
+}): null {
   hook = useMobileStructuredAgentSession({
     client,
     sessionId: 'session-1',
@@ -112,7 +121,7 @@ function Harness({ promptCancelSupported }: { promptCancelSupported: boolean }):
     enabled: true,
     connected: true,
     agent: 'codex',
-    promptCancelSupported,
+    hostSupport: { promptCancel: promptCancelSupported, questionAnswers: questionAnswersSupported },
     onSendError: vi.fn()
   })
   return null
@@ -151,6 +160,17 @@ describe('mobile structured prompt cancellation', () => {
     renderer = null
   })
 
+  it('hands question answering the host answers capability', () => {
+    act(() => {
+      renderer = create(
+        createElement(Harness, { promptCancelSupported: false, questionAnswersSupported: true })
+      )
+    })
+    expect(mocks.promptResponses).toHaveBeenLastCalledWith(
+      expect.objectContaining({ questionAnswersSupported: true })
+    )
+  })
+
   it('sends the clicked prompt identity on capable hosts', async () => {
     act(() => {
       renderer = create(createElement(Harness, { promptCancelSupported: true }))
diff --git a/mobile/src/session/use-mobile-structured-agent-session.ts b/mobile/src/session/use-mobile-structured-agent-session.ts
index 2a24d38a38e..2fa5c2b2a96 100644
--- a/mobile/src/session/use-mobile-structured-agent-session.ts
+++ b/mobile/src/session/use-mobile-structured-agent-session.ts
@@ -7,7 +7,7 @@ import {
 import { encodeNativeChatTranscriptIdentity } from '../../../src/shared/native-chat-transcript-retention'
 import type { MobileNativeChatSendOutcome } from './mobile-native-chat-send'
 import { projectStructuredAgentSessionMessages } from '../../../src/shared/structured-agent-session-message-projection'
-import { hasUnansweredStructuredAgentSessionDispatch } from '../../../src/shared/structured-agent-session-projection'
+import { isStructuredAgentSessionMainAgentWorking } from '../../../src/shared/structured-agent-session-main-agent-working'
 import {
   activeStructuredAgentSessionTurnId,
   isStructuredAgentSessionThinking
@@ -32,6 +32,7 @@ import type { MobileNativeChatSession } from './use-mobile-native-chat-session'
 import type { NativeChatLiveTurnIndicator } from '../../../src/shared/native-chat-turn-status'
 import { useMobileStructuredAgentState } from './use-mobile-structured-agent-state'
 import { useMobileStructuredPromptResponses } from './use-mobile-structured-prompt-responses'
+import type { StructuredAgentSessionHostSupport } from './mobile-structured-agent-session-host-support'
 import { useMobileStructuredAgentOptions } from './use-mobile-structured-agent-options'
 import { useMobileStructuredAgentTurnTiming } from './use-mobile-structured-agent-turn-timing'
 import { sendMobileStructuredAgentSessionMessage } from './mobile-structured-agent-session-send'
@@ -77,8 +78,8 @@ export function useMobileStructuredAgentSession(args: {
   enabled: boolean
   /** Live transport only; gates the connection-scoped hold, nothing else. */
   connected: boolean
-  /** Capability fact from the shared runtime status probe; null follows legacy cancellation. */
-  promptCancelSupported?: boolean | null
+  /** Capability facts from the shared runtime status probe; null follows the legacy wire. */
+  hostSupport: StructuredAgentSessionHostSupport | null
   agent: string | null
   onSendError: (message: string) => void
 }): StructuredMobileSession {
@@ -91,8 +92,9 @@ export function useMobileStructuredAgentSession(args: {
     sourceIdentity = '',
     enabled,
     onSendError,
-    promptCancelSupported = null
+    hostSupport
   } = args
+  const promptCancelSupported = hostSupport?.promptCancel ?? null
   const sessionKey = encodeNativeChatTranscriptIdentity([sourceIdentity, agent, sessionId])
   const operationIdsRef = useRef(new Map<string, string>())
   const commandPendingRef = useRef(false)
@@ -240,6 +242,7 @@ export function useMobileStructuredAgentSession(args: {
     stateRef,
     sessionKey,
     mutate,
+    questionAnswersSupported: hostSupport?.questionAnswers ?? null,
     onSendError
   })
 
@@ -289,9 +292,7 @@ export function useMobileStructuredAgentSession(args: {
       loadingEarlier: loadingOlder,
       loadEarlier
     },
-    isWorking:
-      turnId !== null ||
-      hasUnansweredStructuredAgentSessionDispatch(state.submissions, state.fence),
+    isWorking: isStructuredAgentSessionMainAgentWorking(turnId, state.submissions, state.fence),
     turnId,
     turnIndicator,
     ...turnTiming,
diff --git a/mobile/src/session/use-mobile-structured-agent-state.ts b/mobile/src/session/use-mobile-structured-agent-state.ts
index 49426004968..d2b6d1a5062 100644
--- a/mobile/src/session/use-mobile-structured-agent-state.ts
+++ b/mobile/src/session/use-mobile-structured-agent-state.ts
@@ -19,6 +19,33 @@ const MAX_RETAINED_SESSION_STATES = 32
 /** Bounded so a busy stream cannot turn one Load-earlier tap into an endless read chain. */
 const OLDER_PAGE_ANCHOR_ATTEMPTS = 3
 
+/**
+ * Opens the transcript stream once the hold settles, either way: a refused hold is an older host
+ * saying it could not start the agent — which the next send does — never a reason to hide the
+ * transcript. Returns what ends the stream, opened or not yet. Outside the effect so its cleanup
+ * rule can see the stream is owned.
+ */
+function openTranscriptAfterHold(
+  client: RpcClient,
+  sessionId: string,
+  held: Promise<unknown>,
+  onFrame: (raw: unknown) => void
+): () => void {
+  let ended = false
+  let close = (): void => {}
+  void held
+    .catch(() => undefined)
+    .then(() => {
+      if (!ended) {
+        close = client.subscribe('agentSession.subscribe', { sessionId }, onFrame)
+      }
+    })
+  return () => {
+    ended = true
+    close()
+  }
+}
+
 function isSubscribeEvent(value: unknown): value is AgentSessionSubscribeEvent {
   if (typeof value !== 'object' || value === null) {
     return false
@@ -101,39 +128,21 @@ export function useMobileStructuredAgentState(args: {
     }
     apply({ type: 'loading' })
     const holderId = structuredAgentSessionHolderId('mobile-chat')
-    let cancelled = false
-    let unsubscribe = (): void => {}
     const held = callAgentSession(client, 'agentSession.hold', {
       sessionId,
       holderId
     })
-    void held
-      .then(() => {
-        if (cancelled) {
-          return
-        }
-        unsubscribe = client.subscribe('agentSession.subscribe', { sessionId }, (raw) => {
-          if (
-            typeof raw === 'object' &&
-            raw !== null &&
-            (raw as { type?: unknown }).type === 'error'
-          ) {
-            apply({ type: 'error', message: String((raw as { message?: unknown }).message ?? '') })
-            return
-          }
-          if (isSubscribeEvent(raw)) {
-            apply({ type: 'event', event: raw })
-          }
-        })
-      })
-      .catch((error: unknown) => {
-        if (!cancelled) {
-          apply({ type: 'error', message: error instanceof Error ? error.message : String(error) })
-        }
-      })
+    const endStream = openTranscriptAfterHold(client, sessionId, held, (raw) => {
+      if (typeof raw === 'object' && raw !== null && 'type' in raw && raw.type === 'error') {
+        apply({ type: 'error', message: 'message' in raw ? String(raw.message ?? '') : '' })
+        return
+      }
+      if (isSubscribeEvent(raw)) {
+        apply({ type: 'event', event: raw })
+      }
+    })
     return () => {
-      cancelled = true
-      unsubscribe()
+      endStream()
       void held
         .then(() =>
           callAgentSession(
diff --git a/mobile/src/session/use-mobile-structured-agent-turn-timing.test.tsx b/mobile/src/session/use-mobile-structured-agent-turn-timing.test.tsx
index 944b1d9be13..bc14028c872 100644
--- a/mobile/src/session/use-mobile-structured-agent-turn-timing.test.tsx
+++ b/mobile/src/session/use-mobile-structured-agent-turn-timing.test.tsx
@@ -86,7 +86,8 @@ describe('useMobileStructuredAgentTurnTiming', () => {
     vi.useFakeTimers()
     vi.setSystemTime(CLIENT_NOW)
     const items = [
-      user('u1', 1),
+      // The acknowledged send: its entry's key is the submission's, not the provider's.
+      user('orca:first', 1),
       lifecycle(
         't1',
         2,
diff --git a/mobile/src/session/use-mobile-structured-agent-turn-timing.ts b/mobile/src/session/use-mobile-structured-agent-turn-timing.ts
index 811320510a2..34f0df7edff 100644
--- a/mobile/src/session/use-mobile-structured-agent-turn-timing.ts
+++ b/mobile/src/session/use-mobile-structured-agent-turn-timing.ts
@@ -4,11 +4,9 @@ import type {
   AgentJournalSubmission
 } from '../../../src/shared/agent-session-journal-types'
 import type { NativeChatSettledTurns } from '../../../src/shared/native-chat-turn-status'
+import type { NativeChatTurnJournal } from '../../../src/shared/native-chat-turn-membership'
 import type { StructuredAgentHostClock } from '../../../src/shared/structured-agent-session-reducer'
-import {
-  selectStructuredAgentRunningTurnTiming,
-  selectStructuredAgentSettledTurns
-} from '../../../src/shared/structured-agent-session-turn-timing'
+import { selectStructuredAgentTurnBars } from '../../../src/shared/structured-agent-session-turn-timing'
 import {
   stepStructuredAgentTurnClock,
   type StructuredAgentTurnClockLatch
@@ -28,16 +26,18 @@ export function useMobileStructuredAgentTurnTiming(
     hostClock?: StructuredAgentHostClock | null
   },
   turnId: string | null
-): { settledTurns: NativeChatSettledTurns; workingStartedAt: number | null } {
-  const settledTurns = useMemo(
-    () => selectStructuredAgentSettledTurns(items, submissions),
-    [items, submissions]
+): {
+  settledTurns: NativeChatSettledTurns
+  /** What places each transcript row in its turn; the same read desktop makes. */
+  turnJournal: NativeChatTurnJournal
+  workingStartedAt: number | null
+} {
+  const { settledTurns, runningTiming } = useMemo(
+    () => selectStructuredAgentTurnBars(items, submissions, turnId),
+    [items, submissions, turnId]
   )
+  const turnJournal = useMemo(() => ({ items, submissions }), [items, submissions])
   const [latch, setLatch] = useState<StructuredAgentTurnClockLatch | null>(null)
-  const runningTiming = useMemo(
-    () => (turnId === null ? null : selectStructuredAgentRunningTurnTiming(items, turnId)),
-    [items, turnId]
-  )
   // Stamp during render (React's derive-from-props pattern) so the first paint of
   // a new turn already counts from the right instant.
   const step = stepStructuredAgentTurnClock({
@@ -50,5 +50,5 @@ export function useMobileStructuredAgentTurnTiming(
   if (step.latch !== latch) {
     setLatch(step.latch)
   }
-  return { settledTurns, workingStartedAt: step.workingStartedAt }
+  return { settledTurns, turnJournal, workingStartedAt: step.workingStartedAt }
 }
diff --git a/mobile/src/session/use-mobile-structured-prompt-responses.test.tsx b/mobile/src/session/use-mobile-structured-prompt-responses.test.tsx
index 05a2b7fc380..67e15635aa5 100644
--- a/mobile/src/session/use-mobile-structured-prompt-responses.test.tsx
+++ b/mobile/src/session/use-mobile-structured-prompt-responses.test.tsx
@@ -7,7 +7,12 @@ import {
   EMPTY_STRUCTURED_AGENT_SESSION,
   type StructuredAgentSessionState
 } from '../../../src/shared/structured-agent-session-reducer'
-import { projectStructuredQuestion } from './mobile-structured-agent-prompts'
+import { encodeAgentSessionQuestionAnswers } from '../../../src/shared/agent-session-question-answer'
+import { formatQuestionFreeTextAnswer } from './mobile-native-chat-question'
+import {
+  projectStructuredQuestion,
+  type StructuredQuestionItem
+} from './mobile-structured-agent-prompts'
 import type {
   StructuredAgentSessionMutate,
   StructuredAgentSessionMutationResult
@@ -72,6 +77,8 @@ function Probe(props: {
   sessionKey: string
   state: StructuredAgentSessionState
   mutate: StructuredAgentSessionMutate
+  questionAnswersSupported?: boolean | null
+  onSendError?: (message: string) => void
 }) {
   const stateRef = useRef(props.state)
   stateRef.current = props.state
@@ -79,7 +86,8 @@ function Probe(props: {
     stateRef,
     sessionKey: props.sessionKey,
     mutate: props.mutate,
-    onSendError: vi.fn()
+    questionAnswersSupported: props.questionAnswersSupported ?? null,
+    onSendError: props.onSendError ?? vi.fn()
   })
   return null
 }
@@ -172,4 +180,298 @@ describe('useMobileStructuredPromptResponses', () => {
       expect(hook().groupedDraft?.answers).toHaveLength(1)
     }
   )
+
+  describe('answer wire', () => {
+    const LONG_ANSWER = 'Proceed with the replacement, but wait for the capture. '.repeat(30).trim()
+
+    function singlePrompt(): StructuredQuestionItem {
+      return {
+        itemId: 'item-s',
+        revision: 3,
+        sequence: 1,
+        observedAt: 1,
+        body: {
+          kind: 'question',
+          question: 'Anything else?',
+          options: [
+            { id: 'yes', label: 'Yes' },
+            { id: 'no', label: 'No' }
+          ],
+          freeTextQuestionId: 'notes',
+          resolution: {
+            state: 'pending',
+            selectedOptionId: null,
+            resolvedBy: null,
+            resolvedAt: null
+          }
+        }
+      }
+    }
+
+    // Records what was sent; the verdict is irrelevant to the wire shape under test.
+    function recordingMutate() {
+      const sent: { method: string; fields: Record<string, unknown> }[] = []
+      const mutate: StructuredAgentSessionMutate = async (method, _fingerprint, fields) => {
+        sent.push({ method, fields })
+        return { status: 'rejected' }
+      }
+      return { mutate, sent }
+    }
+
+    function mount(
+      prompt: AgentJournalRenderItem,
+      mutate: StructuredAgentSessionMutate,
+      questionAnswersSupported: boolean | null,
+      onSendError?: (message: string) => void
+    ): void {
+      act(() => {
+        renderer = create(
+          createElement(Probe, {
+            sessionKey: 'session-a',
+            state: sessionState(prompt),
+            mutate,
+            questionAnswersSupported,
+            onSendError
+          })
+        )
+      })
+    }
+
+    function sentFields(sent: ReturnType<typeof recordingMutate>['sent']): Record<string, unknown> {
+      expect(sent).toHaveLength(1)
+      expect(sent[0]!.method).toBe('agentSession.respondToQuestion')
+      return sent[0]!.fields
+    }
+
+    it('sends a long typed answer as structured answers to a capable host', async () => {
+      const prompt = singlePrompt()
+      const { mutate, sent } = recordingMutate()
+      mount(prompt, mutate, true)
+      const card = projectStructuredQuestion(prompt)!
+
+      await act(async () => {
+        await hook().respondQuestion(formatQuestionFreeTextAnswer(card, LONG_ANSWER))
+      })
+
+      expect(sentFields(sent)).toEqual({
+        itemId: 'item-s',
+        expectedRevision: 3,
+        answers: [{ questionId: 'notes', optionIds: [], other: LONG_ANSWER }]
+      })
+    })
+
+    it('packs a typed answer into the option id for a host that predates answers', async () => {
+      const prompt = singlePrompt()
+      const { mutate, sent } = recordingMutate()
+      mount(prompt, mutate, null)
+      const card = projectStructuredQuestion(prompt)!
+
+      await act(async () => {
+        await hook().respondQuestion(formatQuestionFreeTextAnswer(card, '  DuckDB  '))
+      })
+
+      expect(sentFields(sent)).toEqual({
+        itemId: 'item-s',
+        expectedRevision: 3,
+        optionId: 'notes:DuckDB'
+      })
+    })
+
+    it('tries structured answers for an answer too long to pack while support is unknown', async () => {
+      const prompt = singlePrompt()
+      const { mutate, sent } = recordingMutate()
+      mount(prompt, mutate, null)
+
+      await act(async () => {
+        await hook().respondQuestion(
+          formatQuestionFreeTextAnswer(projectStructuredQuestion(prompt)!, LONG_ANSWER)
+        )
+      })
+
+      expect(sentFields(sent)).toEqual({
+        itemId: 'item-s',
+        expectedRevision: 3,
+        answers: [{ questionId: 'notes', optionIds: [], other: LONG_ANSWER }]
+      })
+    })
+
+    it('tells the user to update an older host instead of sending an answer it must refuse', async () => {
+      const prompt = singlePrompt()
+      const { mutate, sent } = recordingMutate()
+      const onSendError = vi.fn()
+      mount(prompt, mutate, false, onSendError)
+
+      let accepted = true
+      await act(async () => {
+        accepted = await hook().respondQuestion(
+          formatQuestionFreeTextAnswer(projectStructuredQuestion(prompt)!, LONG_ANSWER)
+        )
+      })
+
+      expect(accepted).toBe(false)
+      expect(sent).toEqual([])
+      expect(onSendError).toHaveBeenCalledWith(
+        'Update Orca on your computer to send answers this long'
+      )
+    })
+
+    it.each([
+      [true, { answers: [{ questionId: 'notes', optionIds: ['no'] }] }],
+      [false, { optionId: 'no' }]
+    ])(
+      'answers an option tap for the question it was shown on (answers: %s)',
+      async (supported, wire) => {
+        const prompt = singlePrompt()
+        const { mutate, sent } = recordingMutate()
+        mount(prompt, mutate, supported)
+
+        await act(async () => {
+          await hook().respondQuestion(projectStructuredQuestion(prompt)!.optionTokens[1]!)
+        })
+
+        expect(sentFields(sent)).toEqual({ itemId: 'item-s', expectedRevision: 3, ...wire })
+      }
+    )
+
+    it.each([true, false])('submits a grouped question once (answers: %s)', async (supported) => {
+      const prompt = groupedPrompt('item-g', 1)
+      const { mutate, sent } = recordingMutate()
+      mount(prompt, mutate, supported)
+
+      await act(async () => {
+        await hook().respondQuestion(projectedResponse(prompt, null))
+      })
+      await act(async () => {
+        await hook().respondQuestion(projectedResponse(prompt, hook().groupedDraft))
+      })
+
+      const answers = [
+        { questionId: 'q1', optionIds: ['q1:choice-1'] },
+        { questionId: 'q2', optionIds: ['q2:choice-1'] }
+      ]
+      expect(sentFields(sent)).toEqual({
+        itemId: 'item-g',
+        expectedRevision: 1,
+        ...(supported ? { answers } : { optionId: encodeAgentSessionQuestionAnswers(answers) })
+      })
+    })
+
+    // Claude always sends a question list, so this is the path a long typed Claude answer takes.
+    it.each([
+      [true, true],
+      [null, true],
+      [false, false]
+    ])('submits a grouped long typed answer (answers: %s)', async (supported, expectSent) => {
+      const base = groupedPrompt('item-g', 1)
+      if (base.body.kind !== 'question' || !base.body.questions) {
+        throw new Error('expected a grouped question')
+      }
+      const [first, second] = base.body.questions
+      const prompt: AgentJournalRenderItem = {
+        ...base,
+        body: { ...base.body, questions: [first!, { ...second!, freeTextQuestionId: 'q2' }] }
+      }
+      const { mutate, sent } = recordingMutate()
+      const onSendError = vi.fn()
+      mount(prompt, mutate, supported, onSendError)
+
+      await act(async () => {
+        await hook().respondQuestion(projectedResponse(prompt, null))
+      })
+      const step = projectStructuredQuestion(prompt, hook().groupedDraft)!
+      await act(async () => {
+        await hook().respondQuestion(formatQuestionFreeTextAnswer(step, LONG_ANSWER))
+      })
+
+      if (!expectSent) {
+        expect(sent).toEqual([])
+        expect(onSendError).toHaveBeenCalledWith(
+          'Update Orca on your computer to send answers this long'
+        )
+        return
+      }
+      expect(sentFields(sent)).toEqual({
+        itemId: 'item-g',
+        expectedRevision: 1,
+        answers: [
+          { questionId: 'q1', optionIds: ['q1:choice-1'] },
+          { questionId: 'q2', optionIds: [], other: LONG_ANSWER }
+        ]
+      })
+    })
+
+    it('keeps a grouped draft an older host cannot take so it sends after an update', async () => {
+      const base = groupedPrompt('item-g', 1)
+      if (base.body.kind !== 'question' || !base.body.questions) {
+        throw new Error('expected a grouped question')
+      }
+      const [first, second] = base.body.questions
+      const prompt: AgentJournalRenderItem = {
+        ...base,
+        body: { ...base.body, questions: [{ ...first!, freeTextQuestionId: 'q1' }, second!] }
+      }
+      const { mutate, sent } = recordingMutate()
+      const onSendError = vi.fn()
+      mount(prompt, mutate, false, onSendError)
+
+      let advanced = false
+      await act(async () => {
+        advanced = await hook().respondQuestion(
+          formatQuestionFreeTextAnswer(projectStructuredQuestion(prompt, null)!, LONG_ANSWER)
+        )
+      })
+      expect(advanced).toBe(true)
+      await act(async () => {
+        await hook().respondQuestion(projectedResponse(prompt, hook().groupedDraft))
+      })
+
+      expect(sent).toEqual([])
+      expect(onSendError).toHaveBeenCalledWith(
+        'Update Orca on your computer to send answers this long'
+      )
+      expect(hook().groupedDraft).not.toBeNull()
+
+      act(() => {
+        renderer?.update(
+          createElement(Probe, {
+            sessionKey: 'session-a',
+            state: sessionState(prompt),
+            mutate,
+            questionAnswersSupported: true,
+            onSendError
+          })
+        )
+      })
+      await act(async () => {
+        await hook().respondQuestion(projectedResponse(prompt, hook().groupedDraft))
+      })
+
+      expect(sentFields(sent)).toEqual({
+        itemId: 'item-g',
+        expectedRevision: 1,
+        answers: [
+          { questionId: 'q1', optionIds: [], other: LONG_ANSWER },
+          { questionId: 'q2', optionIds: ['q2:choice-1'] }
+        ]
+      })
+    })
+
+    it('names the single question an option tap answers when the prompt has no typed field', async () => {
+      const base = singlePrompt()
+      const { freeTextQuestionId: _omitted, ...body } = base.body
+      const prompt: StructuredQuestionItem = { ...base, body }
+      const { mutate, sent } = recordingMutate()
+      mount(prompt, mutate, true)
+
+      await act(async () => {
+        await hook().respondQuestion(projectStructuredQuestion(prompt)!.optionTokens[0]!)
+      })
+
+      expect(sentFields(sent)).toEqual({
+        itemId: 'item-s',
+        expectedRevision: 3,
+        answers: [{ questionId: 'q1', optionIds: ['yes'] }]
+      })
+    })
+  })
 })
diff --git a/mobile/src/session/use-mobile-structured-prompt-responses.ts b/mobile/src/session/use-mobile-structured-prompt-responses.ts
index 8340b7edee8..093029b2be5 100644
--- a/mobile/src/session/use-mobile-structured-prompt-responses.ts
+++ b/mobile/src/session/use-mobile-structured-prompt-responses.ts
@@ -1,5 +1,11 @@
 import { useCallback, useState } from 'react'
 import type { AgentSessionPromptResult } from '../../../src/shared/agent-session-wire'
+import type { AgentJournalQuestionItem } from '../../../src/shared/agent-session-journal-types'
+import {
+  AGENT_SESSION_RESPONSE_OPTION_ID_MAX_LENGTH,
+  legacyAgentSessionSelectedOptionId,
+  type AgentSessionQuestionAnswer
+} from '../../../src/shared/agent-session-question-answer'
 import type { StructuredAgentSessionState } from '../../../src/shared/structured-agent-session-reducer'
 import {
   pendingStructuredApproval,
@@ -7,7 +13,10 @@ import {
   structuredApprovalResponseTarget,
   structuredQuestionResponseTarget
 } from './mobile-structured-agent-prompts'
-import type { StructuredAgentSessionMutate } from './mobile-structured-agent-session-rpc'
+import type {
+  StructuredAgentSessionMutate,
+  StructuredAgentSessionMutationResult
+} from './mobile-structured-agent-session-rpc'
 import {
   advanceGroupedQuestion,
   groupedQuestionPromptKey,
@@ -23,13 +32,15 @@ export function useMobileStructuredPromptResponses(args: {
   stateRef: { readonly current: StructuredAgentSessionState }
   sessionKey: string
   mutate: StructuredAgentSessionMutate
+  /** Host takes structured `answers`; otherwise the answer is packed into `optionId`. */
+  questionAnswersSupported: boolean | null
   onSendError: (message: string) => void
 }): {
   groupedDraft: GroupedQuestionDraft | null
   respondPermission: (optionId: string) => Promise<boolean>
   respondQuestion: (answer: string) => Promise<boolean>
 } {
-  const { mutate, onSendError, sessionKey, stateRef } = args
+  const { mutate, onSendError, questionAnswersSupported, sessionKey, stateRef } = args
   // Partially answered grouped question, held only until its last step is submitted. The session it
   // was collected in is stored with it and checked on read, so switching sessions drops the draft
   // without an effect that would render the stale one for a frame first.
@@ -62,6 +73,38 @@ export function useMobileStructuredPromptResponses(args: {
     [mutate, onSendError, stateRef]
   )
 
+  const sendAnswers = useCallback(
+    (
+      target: { itemId: string; expectedRevision: number },
+      body: Pick<AgentJournalQuestionItem, 'questions'>,
+      answers: AgentSessionQuestionAnswer[]
+    ): Promise<StructuredAgentSessionMutationResult<AgentSessionPromptResult> | null> => {
+      const send = (fields: Record<string, unknown>) =>
+        mutate<AgentSessionPromptResult>(
+          'agentSession.respondToQuestion',
+          'agentSession.respondTo:question',
+          { ...target, ...fields }
+        )
+      if (questionAnswersSupported === true) {
+        return send({ answers })
+      }
+      const optionId = legacyAgentSessionSelectedOptionId(body, answers)
+      if (optionId === null) {
+        return Promise.resolve(null)
+      }
+      if (optionId.length > AGENT_SESSION_RESPONSE_OPTION_ID_MAX_LENGTH) {
+        // Too long to pack for any host: while support is unknown, `answers` is the only form that can land.
+        if (questionAnswersSupported === null) {
+          return send({ answers })
+        }
+        onSendError('Update Orca on your computer to send answers this long')
+        return Promise.resolve(null)
+      }
+      return send({ optionId })
+    },
+    [mutate, onSendError, questionAnswersSupported]
+  )
+
   const respondQuestion = useCallback(
     async (answer: string): Promise<boolean> => {
       const prompt = stateRef.current.items.find(pendingStructuredQuestion) ?? null
@@ -80,11 +123,14 @@ export function useMobileStructuredPromptResponses(args: {
           setCollected({ sessionKey, draft: grouped.draft })
           return true
         }
-        const result = await mutate<AgentSessionPromptResult>(
-          'agentSession.respondToQuestion',
-          'agentSession.respondTo:question',
-          { itemId: prompt.itemId, expectedRevision: prompt.revision, optionId: grouped.optionId }
+        const result = await sendAnswers(
+          { itemId: prompt.itemId, expectedRevision: prompt.revision },
+          prompt.body,
+          grouped.answers
         )
+        if (!result) {
+          return false
+        }
         if (result.status !== 'rejected') {
           // The group left the phone; a retry must start from the first question, not a stale tail.
           setCollected((current) =>
@@ -103,18 +149,22 @@ export function useMobileStructuredPromptResponses(args: {
       if (!target) {
         return false
       }
-      const result = await mutate<AgentSessionPromptResult>(
-        'agentSession.respondToQuestion',
-        'agentSession.respondTo:question',
-        target
+      const result = await sendAnswers(
+        { itemId: target.itemId, expectedRevision: target.expectedRevision },
+        // Grouped questions returned above, so this is a single question.
+        {},
+        [target.answer]
       )
+      if (!result) {
+        return false
+      }
       if (result.status === 'unknown') {
         onSendError('Answer unconfirmed — check chat before retrying')
         return false
       }
       return result.status === 'accepted'
     },
-    [groupedDraft, mutate, onSendError, sessionKey, stateRef]
+    [groupedDraft, onSendError, sendAnswers, sessionKey, stateRef]
   )
 
   return { groupedDraft, respondPermission, respondQuestion }
diff --git a/mobile/src/settings/app-update-settings-rows.test.tsx b/mobile/src/settings/app-update-settings-rows.test.tsx
new file mode 100644
index 00000000000..77177bf7d63
--- /dev/null
+++ b/mobile/src/settings/app-update-settings-rows.test.tsx
@@ -0,0 +1,90 @@
+import { createElement } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { AppUpdateSettingsRows, type AppUpdateCheckRowStatus } from './app-update-settings-rows'
+
+vi.mock('react-native', () => ({
+  Pressable: 'Pressable',
+  StyleSheet: { create: <T,>(styles: T) => styles, hairlineWidth: 1 },
+  Text: 'Text',
+  View: 'View'
+}))
+
+const NOW = Date.UTC(2026, 8, 28, 12)
+const HOUR = 60 * 60 * 1000
+
+describe('AppUpdateSettingsRows', () => {
+  let renderer: ReactTestRenderer | null = null
+  afterEach(() => {
+    act(() => renderer?.unmount())
+    renderer = null
+  })
+
+  function render(opts: {
+    available?: { version: string; url: string } | null
+    lastCheckedAt?: number | null
+    checkStatus?: AppUpdateCheckRowStatus
+  }) {
+    const onUpdate = vi.fn()
+    const onCheck = vi.fn()
+    act(() => {
+      renderer = create(
+        createElement(AppUpdateSettingsRows, {
+          installedVersion: '0.0.48',
+          available: opts.available ?? null,
+          lastCheckedAt: opts.lastCheckedAt ?? null,
+          now: NOW,
+          checkStatus: opts.checkStatus ?? 'idle',
+          onUpdate,
+          onCheck
+        })
+      )
+    })
+    const root = renderer!.root
+    const texts = root
+      .findAll((node) => String(node.type) === 'Text')
+      .map((node) => node.children.filter((child) => typeof child === 'string').join(''))
+    return {
+      root,
+      texts,
+      onUpdate,
+      onCheck,
+      pressables: root.findAll((node) => String(node.type) === 'Pressable')
+    }
+  }
+
+  it('offers the known update as a tappable row with an Update action', () => {
+    const { texts, pressables, onUpdate } = render({
+      available: { version: '0.0.51', url: 'https://example.test' },
+      lastCheckedAt: NOW - 2 * HOUR
+    })
+    expect(texts).toEqual([
+      'Update to Orca 0.0.51',
+      'Update',
+      'Check for updates',
+      'Last checked 2h ago'
+    ])
+    act(() => pressables[0].props.onPress())
+    expect(onUpdate).toHaveBeenCalledTimes(1)
+  })
+
+  it('shows a plain, untappable version row when current, and Never before a first success', () => {
+    const { texts, pressables } = render({})
+    expect(texts).toEqual(['Version 0.0.48', 'Check for updates', 'Never'])
+    expect(pressables).toHaveLength(1)
+    expect(pressables[0].props.accessibilityLabel).toBe('Check for updates, Never')
+  })
+
+  it('runs the check from its row and shows the transient outcome in place', () => {
+    const idle = render({ lastCheckedAt: NOW - 30_000 })
+    expect(idle.texts.at(-1)).toBe('Last checked just now')
+    act(() => idle.pressables[0].props.onPress())
+    expect(idle.onCheck).toHaveBeenCalledTimes(1)
+    act(() => renderer?.unmount())
+    expect(render({ checkStatus: 'checking' }).pressables[0].props.disabled).toBe(true)
+    act(() => renderer?.unmount())
+    expect(render({ checkStatus: 'up-to-date' }).texts.at(-1)).toBe('Up to date')
+    act(() => renderer?.unmount())
+    expect(render({ checkStatus: 'failed' }).texts.at(-1)).toBe("Couldn't check")
+  })
+})
diff --git a/mobile/src/settings/app-update-settings-rows.tsx b/mobile/src/settings/app-update-settings-rows.tsx
new file mode 100644
index 00000000000..b605a89105b
--- /dev/null
+++ b/mobile/src/settings/app-update-settings-rows.tsx
@@ -0,0 +1,100 @@
+import { Pressable, StyleSheet, Text, View } from 'react-native'
+import type { KnownAppUpdate } from '../storage/app-update-preferences'
+import { colors, spacing, typography } from '../theme/mobile-theme'
+import { formatTimeAgo } from '../worktree/agent-row-display'
+
+export type AppUpdateCheckRowStatus = 'idle' | 'checking' | 'up-to-date' | 'failed'
+
+function checkRowValue(status: AppUpdateCheckRowStatus, lastCheckedAt: number | null, now: number) {
+  if (status === 'checking') {
+    return 'Checking…'
+  }
+  if (status === 'up-to-date') {
+    return 'Up to date'
+  }
+  if (status === 'failed') {
+    return "Couldn't check"
+  }
+  if (lastCheckedAt === null) {
+    return 'Never'
+  }
+  const ago = formatTimeAgo(lastCheckedAt, now)
+  return `Last checked ${ago === 'just now' ? ago : `${ago} ago`}`
+}
+
+/** Settings' version row and manual check; the update row stays after the home card is dismissed. */
+export function AppUpdateSettingsRows(props: {
+  installedVersion: string | null
+  available: KnownAppUpdate | null
+  lastCheckedAt: number | null
+  now: number
+  checkStatus: AppUpdateCheckRowStatus
+  onUpdate: (url: string) => void
+  onCheck: () => void
+}) {
+  const checkValue = checkRowValue(props.checkStatus, props.lastCheckedAt, props.now)
+  const { available, installedVersion, onUpdate } = props
+  const versionRow = available ? (
+    <Pressable
+      accessibilityRole="button"
+      accessibilityLabel={`Update to Orca ${available.version}`}
+      style={({ pressed }) => [styles.row, pressed && styles.rowPressed]}
+      onPress={() => onUpdate(available.url)}
+    >
+      <Text style={styles.rowLabel}>Update to Orca {available.version}</Text>
+      <Text style={styles.actionValue}>Update</Text>
+    </Pressable>
+  ) : installedVersion ? (
+    <View style={styles.row}>
+      <Text style={styles.rowLabel}>Version {installedVersion}</Text>
+    </View>
+  ) : null
+  return (
+    <View style={styles.section}>
+      {versionRow}
+      {versionRow && <View style={styles.separator} />}
+      <Pressable
+        accessibilityRole="button"
+        accessibilityLabel={`Check for updates, ${checkValue}`}
+        accessibilityState={{ busy: props.checkStatus === 'checking' }}
+        disabled={props.checkStatus === 'checking'}
+        style={({ pressed }) => [styles.row, pressed && styles.rowPressed]}
+        onPress={props.onCheck}
+      >
+        <Text style={styles.rowLabel}>Check for updates</Text>
+        <Text style={styles.rowValue}>{checkValue}</Text>
+      </Pressable>
+    </View>
+  )
+}
+
+// Same panel, rows and separator as MobileSettingsSection.
+const styles = StyleSheet.create({
+  section: {
+    backgroundColor: colors.bgPanel,
+    borderRadius: 12,
+    overflow: 'hidden',
+    marginTop: spacing.md
+  },
+  row: {
+    flexDirection: 'row',
+    alignItems: 'center',
+    gap: spacing.sm + 2,
+    paddingVertical: spacing.md,
+    paddingHorizontal: spacing.md + 2
+  },
+  rowPressed: { backgroundColor: colors.bgRaised },
+  rowLabel: {
+    flex: 1,
+    fontSize: typography.bodySize,
+    fontWeight: '500',
+    color: colors.textPrimary
+  },
+  rowValue: { fontSize: typography.metaSize, color: colors.textSecondary },
+  actionValue: { fontSize: typography.bodySize, fontWeight: '600', color: colors.textPrimary },
+  separator: {
+    height: StyleSheet.hairlineWidth,
+    backgroundColor: colors.borderSubtle,
+    marginHorizontal: spacing.md
+  }
+})
diff --git a/mobile/src/settings/settings-app-update-section.tsx b/mobile/src/settings/settings-app-update-section.tsx
new file mode 100644
index 00000000000..4edc93d95a9
--- /dev/null
+++ b/mobile/src/settings/settings-app-update-section.tsx
@@ -0,0 +1,52 @@
+import { useEffect, useState } from 'react'
+import {
+  appUpdateChecker,
+  installedAppVersion,
+  openAppUpdate,
+  useAppUpdateState
+} from '../app-update/app-update-runtime'
+import { AppUpdateSettingsRows, type AppUpdateCheckRowStatus } from './app-update-settings-rows'
+
+const CHECK_RESULT_VISIBLE_MS = 3000
+const RELATIVE_TIME_TICK_MS = 60_000
+
+export function SettingsAppUpdateSection() {
+  const state = useAppUpdateState()
+  const [result, setResult] = useState<'up-to-date' | 'failed' | null>(null)
+  // A check newer than this reads as "just now", so the tick only has to age the label.
+  const [now, setNow] = useState(() => Date.now())
+
+  useEffect(() => {
+    const tick = setInterval(() => setNow(Date.now()), RELATIVE_TIME_TICK_MS)
+    return () => clearInterval(tick)
+  }, [])
+
+  useEffect(() => {
+    if (result === null) {
+      return
+    }
+    const hide = setTimeout(() => setResult(null), CHECK_RESULT_VISIBLE_MS)
+    return () => clearTimeout(hide)
+  }, [result])
+
+  const runCheck = () => {
+    setResult(null)
+    void appUpdateChecker.checkNow().then((outcome) => {
+      // An available update shows in the row above, so only the other outcomes need words here.
+      setResult(outcome === 'available' ? null : outcome)
+    })
+  }
+
+  const checkStatus: AppUpdateCheckRowStatus = state.checking ? 'checking' : (result ?? 'idle')
+  return (
+    <AppUpdateSettingsRows
+      installedVersion={installedAppVersion}
+      available={state.available}
+      lastCheckedAt={state.lastCheckedAt}
+      now={now}
+      checkStatus={checkStatus}
+      onUpdate={openAppUpdate}
+      onCheck={runCheck}
+    />
+  )
+}
diff --git a/mobile/src/source-control/MobileCommitFailurePanel.tsx b/mobile/src/source-control/MobileCommitFailurePanel.tsx
index 451d61db9e5..26fa6b964ba 100644
--- a/mobile/src/source-control/MobileCommitFailurePanel.tsx
+++ b/mobile/src/source-control/MobileCommitFailurePanel.tsx
@@ -2,6 +2,7 @@ import { useState } from 'react'
 import { ActivityIndicator, Pressable, Text, View } from 'react-native'
 import { ChevronDown, ChevronRight, Sparkles } from 'lucide-react-native'
 import { colors } from '../theme/mobile-theme'
+import { AgentLaunchNotice } from '../components/AgentLaunchNotice'
 import type { MobileCommitFailureRecovery } from './mobile-commit-failure-recovery'
 import type { MobileCommitFailureRecoveryAction } from './use-mobile-commit-failure-recovery'
 import { styles } from './mobile-source-control-styles'
@@ -28,11 +29,12 @@ export function MobileCommitFailurePanel({ failure, action }: Props) {
         <Pressable
           style={({ pressed }) => [
             styles.commitFailureFixButton,
-            action.launching && styles.commitFailureFixButtonDisabled,
+            (action.launching || action.availability !== 'available') &&
+              styles.commitFailureFixButtonDisabled,
             pressed && styles.commitFailureFixButtonPressed
           ]}
           onPress={() => void action.launch()}
-          disabled={action.launching}
+          disabled={action.launching || action.availability !== 'available'}
           accessibilityRole="button"
           accessibilityLabel="Fix commit failure with AI"
         >
@@ -65,9 +67,14 @@ export function MobileCommitFailurePanel({ failure, action }: Props) {
           {expanded ? <Text style={styles.commitFailureDetailsText}>{detailsText}</Text> : null}
         </>
       ) : null}
-      {action.launchError ? (
-        <Text style={styles.commitFailureLaunchError}>{action.launchError}</Text>
-      ) : null}
+      <AgentLaunchNotice
+        availability={action.availability}
+        success={action.launchSuccess}
+        error={action.launchError}
+        warning={action.launchWarning}
+        undeliveredPrompt={action.undeliveredPrompt}
+        errorStyle={styles.commitFailureLaunchError}
+      />
     </View>
   )
 }
diff --git a/mobile/src/source-control/MobileSourceControlPanel.tsx b/mobile/src/source-control/MobileSourceControlPanel.tsx
index c223510184e..f63885ac7c5 100644
--- a/mobile/src/source-control/MobileSourceControlPanel.tsx
+++ b/mobile/src/source-control/MobileSourceControlPanel.tsx
@@ -328,6 +328,7 @@ export function MobileSourceControlPanel({
             // Gate on the probe too: isGithubRepo=false mid-probe must render loading, not flash "unavailable".
             branchContextLoaded={ready && prController.prSidebarRepoProbeLoaded}
             controller={prController}
+            workspaceLabel={worktreeLabel}
           />
         </View>
       ) : activeTab === 'pr' ? (
diff --git a/mobile/src/source-control/mobile-pr-create.test.ts b/mobile/src/source-control/mobile-pr-create.test.ts
index d52f4861fd4..4935d514f36 100644
--- a/mobile/src/source-control/mobile-pr-create.test.ts
+++ b/mobile/src/source-control/mobile-pr-create.test.ts
@@ -158,32 +158,6 @@ describe('mobile create form gating parity', () => {
     )
   })
 
-  it('desktop gate hard-blocks on positive unresolved review evidence', () => {
-    // Mobile lacks review-lookup signals, so it fails closed on ambiguity: the
-    // shared desktop gate must return false even when eligibility looks ready.
-    expect(
-      shouldOpenChecksPanelCreateComposer({
-        activeReview: null,
-        isFolder: false,
-        branch: 'feature/x',
-        hostedReviewCreation: eligibility({ canCreate: true }),
-        reviewLookup: 'positive_unresolved'
-      })
-    ).toBe(false)
-  })
-
-  it('desktop gate hard-blocks during a hard refresh error', () => {
-    expect(
-      shouldOpenChecksPanelCreateComposer({
-        activeReview: null,
-        isFolder: false,
-        branch: 'feature/x',
-        hostedReviewCreation: eligibility({ canCreate: true }),
-        hasHardRefreshError: true
-      })
-    ).toBe(false)
-  })
-
   it('fails closed on an unavailable review lookup even when eligibility looks ready', () => {
     // The existing-review lookup could not prove there is no PR; mobile has no
     // review-lookup signal of its own, so create must be blocked.
diff --git a/mobile/src/source-control/source-control-router-seam-census.test.ts b/mobile/src/source-control/source-control-router-seam-census.test.ts
deleted file mode 100644
index e34d4ad93d8..00000000000
--- a/mobile/src/source-control/source-control-router-seam-census.test.ts
+++ /dev/null
@@ -1,44 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import {
-  callsRouteHandoff,
-  importsExpoRouterValue,
-  parse,
-  productFiles
-} from '../navigation/router-seam-census.test-support'
-
-const SOURCE_CONTROL_ROOT = import.meta.dirname
-
-/**
- * Which modules here hold a router, so the census cannot pass by seeing nothing.
- *
- * One holder, not one per screen: the hub's router is taken once in the openers hook and passed
- * down through the state hook to the runners and the panel. So this domain's whole reach into the
- * router is that single call, and the rules below say so rather than counting screens.
- *
- * `use-mobile-source-control-runners.ts` is the case a value/type rule is written for: it named
- * expo-router only to write `ReturnType<typeof useRouter>`, which is a value import in a type
- * position and keeps the module in the graph. `RouteHandoff` is the seam's own name for that type.
- */
-const ROUTER_HOLDERS = ['use-mobile-source-control-openers.ts']
-
-describe('the source-control domain reaches the router through the handoff seam', () => {
-  const files = productFiles(SOURCE_CONTROL_ROOT)
-
-  it('walks the modules it is written against', () => {
-    expect(files).toEqual(expect.arrayContaining(ROUTER_HOLDERS))
-    expect(files).toContain('use-mobile-source-control-runners.ts')
-    expect(files).toContain('MobileSourceControlPanel.tsx')
-  })
-
-  it('imports no router from expo-router, which the page cannot hand a route back through', () => {
-    expect(
-      files.filter((name) => importsExpoRouterValue(parse(SOURCE_CONTROL_ROOT, name)))
-    ).toEqual([])
-  })
-
-  it('takes the router from useRouteHandoff at every screen that holds one', () => {
-    expect(
-      files.filter((name) => callsRouteHandoff(parse(SOURCE_CONTROL_ROOT, name))).sort()
-    ).toEqual([...ROUTER_HOLDERS].sort())
-  })
-})
diff --git a/mobile/src/source-control/use-mobile-commit-failure-recovery.test.ts b/mobile/src/source-control/use-mobile-commit-failure-recovery.test.ts
new file mode 100644
index 00000000000..157a87b7448
--- /dev/null
+++ b/mobile/src/source-control/use-mobile-commit-failure-recovery.test.ts
@@ -0,0 +1,124 @@
+import { createElement } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { RpcClient } from '../transport/rpc-client'
+import type { RpcResponse } from '../transport/types'
+import type { MobileCommitFailureRecovery } from './mobile-commit-failure-recovery'
+
+vi.mock('../platform/haptics', () => ({ triggerError: vi.fn(), triggerSuccess: vi.fn() }))
+vi.mock('../components/HostProtocolGate', () => ({
+  useHostProtocolGates: () => ({
+    hostCapabilities: [
+      'agent.launch.v2',
+      'agent.launch.replay.v1',
+      'agent.launch.replay-required.v1'
+    ],
+    statusPending: false,
+    statusReadable: true
+  })
+}))
+
+import { useMobileCommitFailureRecovery } from './use-mobile-commit-failure-recovery'
+
+type Recovery = ReturnType<typeof useMobileCommitFailureRecovery>
+
+function rpcReply(result: unknown): RpcResponse {
+  return { id: 'rpc', ok: true, result, _meta: { runtimeId: 'r' } }
+}
+
+const LAUNCHED_WITH_WARNING = rpcReply({
+  outcome: { kind: 'terminal', handle: 'term-1' },
+  worktreeId: 'wt-1',
+  receipt: { mode: 'terminal', preferred: 'terminal', reason: 'user_default', detail: 'd' },
+  prompt: { delivery: 'submit', outcome: 'handed-to-terminal' },
+  warning: 'the requested arguments were ignored.'
+})
+
+function hostClient(launchReply: () => Promise<RpcResponse>) {
+  const sendRequest = vi.fn(async (method: string): Promise<RpcResponse> => {
+    if (method === 'repo.list') {
+      return rpcReply({ repos: [{ id: 'wt-1' }] })
+    }
+    if (method === 'settings.get') {
+      return rpcReply({ settings: { defaultTuiAgent: 'codex' } })
+    }
+    if (method === 'preflight.detectAgents') {
+      return rpcReply(['codex'])
+    }
+    return launchReply()
+  })
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the hook reaches the client only through sendRequest.
+  return { client: { sendRequest } as unknown as RpcClient, sendRequest }
+}
+
+const FAILURE: MobileCommitFailureRecovery = {
+  error: 'pre-commit hook failed',
+  commitMessage: 'wip',
+  stagedEntries: []
+}
+
+describe('useMobileCommitFailureRecovery', () => {
+  let renderer: ReactTestRenderer | null = null
+  let recovery: Recovery | null = null
+
+  afterEach(() => {
+    act(() => renderer?.unmount())
+    renderer = null
+    recovery = null
+  })
+
+  function mount(client: RpcClient, failure: MobileCommitFailureRecovery | null = FAILURE) {
+    function Harness(props: { failure: MobileCommitFailureRecovery | null }): null {
+      recovery = useMobileCommitFailureRecovery({
+        client,
+        connState: 'connected',
+        worktreeId: 'wt-1',
+        workspaceLabel: 'feature-login',
+        failure: props.failure
+      })
+      return null
+    }
+    act(() => {
+      renderer = create(createElement(Harness, { failure }))
+    })
+    return (next: MobileCommitFailureRecovery | null) =>
+      act(() => renderer?.update(createElement(Harness, { failure: next })))
+  }
+
+  it('reports the host warning on a launch that went ahead as a warning, not an error', async () => {
+    const rerender = mount(hostClient(async () => LAUNCHED_WITH_WARNING).client)
+    let succeeded: boolean | undefined
+    await act(async () => {
+      succeeded = await recovery?.launch()
+    })
+    expect(succeeded).toBe(true)
+    expect(recovery?.launchError).toBeNull()
+    expect(recovery?.launchWarning).toBe('the requested arguments were ignored.')
+    expect(recovery?.launchSuccess).toBe('Agent started in feature-login')
+    // A new failure is a new launch; the old one's note does not carry over.
+    rerender({ ...FAILURE, error: 'another hook failed' })
+    expect(recovery?.launchWarning).toBeNull()
+    expect(recovery?.launchSuccess).toBeNull()
+  })
+
+  it('starts one agent for two taps before the first one re-renders', async () => {
+    let release: () => void = () => {}
+    const answered = new Promise<void>((resolve) => (release = resolve))
+    const { client, sendRequest } = hostClient(async () => {
+      await answered
+      return LAUNCHED_WITH_WARNING
+    })
+    mount(client)
+    const launch = recovery?.launch
+    let taps: boolean[] = []
+    await act(async () => {
+      const both = Promise.all([launch?.(), launch?.()])
+      release()
+      taps = (await both).map(Boolean)
+    })
+    expect(taps).toEqual([true, false])
+    expect(
+      sendRequest.mock.calls.filter(([method]) => method === 'agent.launchReplay')
+    ).toHaveLength(1)
+  })
+})
diff --git a/mobile/src/source-control/use-mobile-commit-failure-recovery.ts b/mobile/src/source-control/use-mobile-commit-failure-recovery.ts
index a2332fbca51..fb19f7495ee 100644
--- a/mobile/src/source-control/use-mobile-commit-failure-recovery.ts
+++ b/mobile/src/source-control/use-mobile-commit-failure-recovery.ts
@@ -1,8 +1,10 @@
-import { useCallback, useEffect, useMemo, useState } from 'react'
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import type { ConnectionState } from '../transport/types'
 import type { RpcClient } from '../transport/rpc-client'
 import { triggerError, triggerSuccess } from '../platform/haptics'
-import { createTerminalAndSendPrompt } from '../session/pr-ai-triage-launch'
+import { useHostProtocolGates } from '../components/HostProtocolGate'
+import { launchAgentWithPrompt, promptedLaunchNotice } from '../session/pr-ai-triage-launch'
+import { resolveMobileAgentLaunchAvailability } from '../session/mobile-agent-launch-availability'
 import {
   buildFixCommitFailurePrompt,
   type MobileCommitFailureRecovery,
@@ -14,13 +16,45 @@ type Params = {
   client: RpcClient | null
   connState: ConnectionState
   worktreeId: string
+  /** Named in the confirmation; the screen's workspace label, else its branch. */
+  workspaceLabel: string | null
   failure: MobileCommitFailureRecovery | null
 }
 
-export function useMobileCommitFailureRecovery({ client, connState, worktreeId, failure }: Params) {
+export function useMobileCommitFailureRecovery({
+  client,
+  connState,
+  worktreeId,
+  workspaceLabel,
+  failure
+}: Params) {
+  const hostStatus = useHostProtocolGates()
+  const { hostCapabilities } = hostStatus
   const [launching, setLaunching] = useState(false)
+  // `launching` commits on the next render; each tap is a new operation, so a second one in that gap
+  // would start a second agent.
+  const inFlightRef = useRef(false)
   const [launchError, setLaunchError] = useState<string | null>(null)
+  // The agent started without its prompt; kept so the user can paste it in themselves. Keyed by the
+  // failure it was built for, so a new failure never shows the previous one's prompt.
+  const [undelivered, setUndelivered] = useState<{
+    failure: MobileCommitFailureRecovery
+    prompt: string
+  } | null>(null)
+  const undeliveredPrompt = undelivered?.failure === failure ? undelivered.prompt : null
+  // The host's note on a launch that went ahead, keyed the same way.
+  const [warning, setWarning] = useState<{
+    failure: MobileCommitFailureRecovery
+    text: string
+  } | null>(null)
+  const launchWarning = warning?.failure === failure ? warning.text : null
+  const [success, setSuccess] = useState<{
+    failure: MobileCommitFailureRecovery
+    text: string
+  } | null>(null)
+  const launchSuccess = success?.failure === failure ? success.text : null
   const summary = useMemo(() => (failure ? summarizeCommitFailure(failure.error) : null), [failure])
+  const availability = resolveMobileAgentLaunchAvailability(hostStatus)
 
   useEffect(() => {
     setLaunchError(null)
@@ -45,7 +79,7 @@ export function useMobileCommitFailureRecovery({ client, connState, worktreeId,
   )
 
   const launch = useCallback(async (): Promise<boolean> => {
-    if (launching || !prompt) {
+    if (inFlightRef.current || launching || !prompt) {
       return false
     }
     if (!client || connState !== 'connected') {
@@ -53,26 +87,53 @@ export function useMobileCommitFailureRecovery({ client, connState, worktreeId,
       triggerError()
       return false
     }
+    inFlightRef.current = true
     setLaunching(true)
     setLaunchError(null)
+    setWarning(null)
+    setSuccess(null)
+    setUndelivered(null)
     try {
-      await createTerminalAndSendPrompt(client, worktreeId, prompt)
-      triggerSuccess()
-      return true
+      const result = await launchAgentWithPrompt({
+        client,
+        hostCapabilities,
+        worktreeId,
+        prompt,
+        actionId: 'fixCommitFailure',
+        launchSource: 'source_control_recovery'
+      })
+      const notice = promptedLaunchNotice(result, workspaceLabel)
+      if (notice.succeeded) {
+        triggerSuccess()
+      } else {
+        triggerError()
+      }
+      setLaunchError(notice.error)
+      setWarning(failure && notice.warning ? { failure, text: notice.warning } : null)
+      setSuccess(failure && notice.success ? { failure, text: notice.success } : null)
+      setUndelivered(
+        failure && notice.undeliveredPrompt ? { failure, prompt: notice.undeliveredPrompt } : null
+      )
+      return notice.succeeded
     } catch (err) {
       triggerError()
       setLaunchError(err instanceof Error ? err.message : 'Failed to launch agent')
       return false
     } finally {
+      inFlightRef.current = false
       setLaunching(false)
     }
-  }, [client, connState, launching, prompt, worktreeId])
+  }, [client, connState, failure, hostCapabilities, launching, prompt, workspaceLabel, worktreeId])
 
   return {
     summary,
     hasDetails,
     launching,
+    availability,
     launchError,
+    launchWarning,
+    launchSuccess,
+    undeliveredPrompt,
     launch
   }
 }
diff --git a/mobile/src/source-control/use-mobile-hosted-review-eligibility.test.ts b/mobile/src/source-control/use-mobile-hosted-review-eligibility.test.ts
index f6e3eab8873..b30bd883f8e 100644
--- a/mobile/src/source-control/use-mobile-hosted-review-eligibility.test.ts
+++ b/mobile/src/source-control/use-mobile-hosted-review-eligibility.test.ts
@@ -4,7 +4,6 @@ import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { HostedReviewCreationEligibility } from '../../../src/shared/hosted-review'
 import {
   buildMobileHostedReviewEligibilityLoadKey,
-  eligibilityStateAfterMobileHostedReviewError,
   renderedMobileHostedReviewEligibilityState,
   shouldFetchMobileHostedReviewEligibility,
   useMobileHostedReviewEligibility,
@@ -101,38 +100,6 @@ describe('mobile hosted review eligibility loader core', () => {
     expect(local.identity).not.toBe(ssh.identity)
     expect(local.fetch).not.toBe(ssh.fetch)
   })
-
-  it('renders a superseded same-identity snapshot as loading', () => {
-    const input = {
-      hostId: 'host-1',
-      worktreeId: 'wt-1',
-      branch: 'feature',
-      hasUpstream: true,
-      ahead: 0,
-      behind: 0
-    }
-    const older = buildMobileHostedReviewEligibilityLoadKey({
-      ...input,
-      hasUncommittedChanges: false
-    })
-    const newest = buildMobileHostedReviewEligibilityLoadKey({
-      ...input,
-      hasUncommittedChanges: true
-    })
-
-    expect(older.identity).toBe(newest.identity)
-    expect(
-      renderedMobileHostedReviewEligibilityState({
-        snapshot: loadSnapshot(older, { kind: 'ready', eligibility: eligibility() }),
-        key: newest,
-        shouldFetch: true
-      })
-    ).toMatchObject({ kind: 'loading', eligibility: eligibility() })
-  })
-
-  it('fails closed after errors', () => {
-    expect(eligibilityStateAfterMobileHostedReviewError()).toEqual({ kind: 'error' })
-  })
 })
 
 // #8411: what the hook returns is what paints. A fetch-imminent frame must not
diff --git a/mobile/src/source-control/use-mobile-hosted-review-eligibility.ts b/mobile/src/source-control/use-mobile-hosted-review-eligibility.ts
index 5b0c3f04241..fdf2c5ea5c0 100644
--- a/mobile/src/source-control/use-mobile-hosted-review-eligibility.ts
+++ b/mobile/src/source-control/use-mobile-hosted-review-eligibility.ts
@@ -54,7 +54,7 @@ export function shouldFetchMobileHostedReviewEligibility(
   return input.connState === 'connected' && input.client !== null && !!input.branch
 }
 
-export function eligibilityStateAfterMobileHostedReviewError(): MobileCreatePrEligibilityState {
+function eligibilityStateAfterMobileHostedReviewError(): MobileCreatePrEligibilityState {
   return { kind: 'error' }
 }
 
diff --git a/mobile/src/source-control/use-mobile-source-control-commit-failure.ts b/mobile/src/source-control/use-mobile-source-control-commit-failure.ts
index 32b92f24854..bde245667cf 100644
--- a/mobile/src/source-control/use-mobile-source-control-commit-failure.ts
+++ b/mobile/src/source-control/use-mobile-source-control-commit-failure.ts
@@ -11,9 +11,15 @@ type Params = {
   client: RpcClient | null
   connState: ConnectionState
   worktreeId: string
+  worktreeLabel: string | null
 }
 
-export function useMobileSourceControlCommitFailure({ client, connState, worktreeId }: Params): {
+export function useMobileSourceControlCommitFailure({
+  client,
+  connState,
+  worktreeId,
+  worktreeLabel
+}: Params): {
   commitFailureRecovery: MobileCommitFailureRecovery | null
   commitFailureRecoveryAction: ReturnType<typeof useMobileCommitFailureRecovery>
   recordCommitFailure: RecordMobileCommitFailure
@@ -25,6 +31,7 @@ export function useMobileSourceControlCommitFailure({ client, connState, worktre
     client,
     connState,
     worktreeId,
+    workspaceLabel: worktreeLabel,
     failure: commitFailureRecovery
   })
   return { commitFailureRecovery, commitFailureRecoveryAction, recordCommitFailure }
diff --git a/mobile/src/source-control/use-mobile-source-control-state.ts b/mobile/src/source-control/use-mobile-source-control-state.ts
index 1f541739d9a..1e55dfe79ef 100644
--- a/mobile/src/source-control/use-mobile-source-control-state.ts
+++ b/mobile/src/source-control/use-mobile-source-control-state.ts
@@ -78,7 +78,7 @@ export function useMobileSourceControlState(params: MobileSourceControlStatePara
   const worktreeLabel = getWorktreeLabel(name, worktreeId)
   const statusIdentityKey = `${hostId}\0${worktreeId}`
   const { commitFailureRecovery, commitFailureRecoveryAction, recordCommitFailure } =
-    useMobileSourceControlCommitFailure({ client, connState, worktreeId })
+    useMobileSourceControlCommitFailure({ client, connState, worktreeId, worktreeLabel })
   const clearCommitFailureRecovery = useCallback(() => {
     recordCommitFailure(null)
   }, [recordCommitFailure])
diff --git a/mobile/src/storage/app-update-preferences.test.ts b/mobile/src/storage/app-update-preferences.test.ts
new file mode 100644
index 00000000000..dbd7ba4215d
--- /dev/null
+++ b/mobile/src/storage/app-update-preferences.test.ts
@@ -0,0 +1,32 @@
+import { describe, expect, it, vi } from 'vitest'
+import { loadAppUpdatePreferences } from './app-update-preferences'
+
+const stored = new Map<string, string>()
+vi.mock('@react-native-async-storage/async-storage', () => ({
+  default: {
+    multiGet: async (keys: string[]) => keys.map((key) => [key, stored.get(key) ?? null])
+  }
+}))
+
+describe('loadAppUpdatePreferences', () => {
+  it('drops only a corrupt update record, keeping the check time and dismissal beside it', async () => {
+    stored.set('orca:appUpdate:lastCheckedAt', '1700000000000')
+    stored.set('orca:appUpdate:latest', '{not json')
+    stored.set('orca:appUpdate:dismissedVersion', '0.0.51')
+    await expect(loadAppUpdatePreferences()).resolves.toEqual({
+      lastCheckedAt: 1700000000000,
+      latest: null,
+      dismissedVersion: '0.0.51'
+    })
+  })
+
+  it('reads a well-formed update record', async () => {
+    stored.set(
+      'orca:appUpdate:latest',
+      JSON.stringify({ version: '0.0.52', url: 'https://x.test' })
+    )
+    await expect(loadAppUpdatePreferences()).resolves.toMatchObject({
+      latest: { version: '0.0.52', url: 'https://x.test' }
+    })
+  })
+})
diff --git a/mobile/src/storage/app-update-preferences.ts b/mobile/src/storage/app-update-preferences.ts
new file mode 100644
index 00000000000..51e199a68b1
--- /dev/null
+++ b/mobile/src/storage/app-update-preferences.ts
@@ -0,0 +1,64 @@
+import AsyncStorage from '@react-native-async-storage/async-storage'
+import { z } from 'zod'
+
+const LAST_CHECKED_AT_KEY = 'orca:appUpdate:lastCheckedAt'
+const LATEST_KEY = 'orca:appUpdate:latest'
+const DISMISSED_VERSION_KEY = 'orca:appUpdate:dismissedVersion'
+
+export type KnownAppUpdate = { readonly version: string; readonly url: string }
+
+export type AppUpdatePreferences = {
+  /** Last successful check; failures never move it. */
+  readonly lastCheckedAt: number | null
+  /** Newest installable release that check saw, or null when it saw none. */
+  readonly latest: KnownAppUpdate | null
+  readonly dismissedVersion: string | null
+}
+
+export const EMPTY_APP_UPDATE_PREFERENCES: AppUpdatePreferences = {
+  lastCheckedAt: null,
+  latest: null,
+  dismissedVersion: null
+}
+
+const knownAppUpdateSchema = z.object({ version: z.string(), url: z.string() })
+
+// A corrupt record loses only itself, never the check time or the dismissal stored beside it.
+function parseLatest(raw: string | null): KnownAppUpdate | null {
+  try {
+    const parsed = raw ? knownAppUpdateSchema.safeParse(JSON.parse(raw)) : null
+    return parsed?.success ? parsed.data : null
+  } catch {
+    return null
+  }
+}
+
+export async function loadAppUpdatePreferences(): Promise<AppUpdatePreferences> {
+  try {
+    const [[, checkedAt], [, latest], [, dismissed]] = await AsyncStorage.multiGet([
+      LAST_CHECKED_AT_KEY,
+      LATEST_KEY,
+      DISMISSED_VERSION_KEY
+    ])
+    const lastCheckedAt = checkedAt === null ? null : Number(checkedAt)
+    return {
+      lastCheckedAt:
+        lastCheckedAt !== null && Number.isFinite(lastCheckedAt) ? lastCheckedAt : null,
+      latest: parseLatest(latest),
+      dismissedVersion: dismissed
+    }
+  } catch {
+    return EMPTY_APP_UPDATE_PREFERENCES
+  }
+}
+
+export async function saveAppUpdateCheck(checkedAt: number, latest: KnownAppUpdate | null) {
+  await AsyncStorage.multiSet([
+    [LAST_CHECKED_AT_KEY, String(checkedAt)],
+    [LATEST_KEY, latest ? JSON.stringify(latest) : '']
+  ])
+}
+
+export async function saveDismissedAppUpdateVersion(version: string): Promise<void> {
+  await AsyncStorage.setItem(DISMISSED_VERSION_KEY, version)
+}
diff --git a/mobile/src/tasks/agent-launch-worktree-create.test.ts b/mobile/src/tasks/agent-launch-request.test.ts
similarity index 98%
rename from mobile/src/tasks/agent-launch-worktree-create.test.ts
rename to mobile/src/tasks/agent-launch-request.test.ts
index ada5becd4ca..b9b25f17757 100644
--- a/mobile/src/tasks/agent-launch-worktree-create.test.ts
+++ b/mobile/src/tasks/agent-launch-request.test.ts
@@ -3,7 +3,7 @@ import {
   agentLaunchCreateParams,
   isAgentLaunchUnsupportedRefusal,
   readAgentLaunchCreateOutcome
-} from './agent-launch-worktree-create'
+} from './agent-launch-request'
 
 describe('agentLaunchCreateParams', () => {
   it('carries the create payload verbatim minus the reserved agent fields', () => {
diff --git a/mobile/src/tasks/agent-launch-worktree-create.ts b/mobile/src/tasks/agent-launch-request.ts
similarity index 68%
rename from mobile/src/tasks/agent-launch-worktree-create.ts
rename to mobile/src/tasks/agent-launch-request.ts
index 3348d471ce1..ddd0d85383e 100644
--- a/mobile/src/tasks/agent-launch-worktree-create.ts
+++ b/mobile/src/tasks/agent-launch-request.ts
@@ -1,5 +1,9 @@
 /**
- * Issuing a mobile workspace create through `agent.launch` rather than `worktree.create`.
+ * Building mobile's `agent.launch` requests and reading their answers: a workspace create, and a
+ * launch into a workspace that already exists.
+ *
+ * The create half issues a mobile workspace create through `agent.launch` rather than
+ * `worktree.create`.
  *
  * `worktree.create` + `startupAgent` means "create the worktree agent-first": its startup terminal
  * IS the agent, so the structured branch below it is unreachable. That is why picking an agent on
@@ -14,8 +18,13 @@
 
 import {
   withoutReservedAgentCreateFields,
+  type AgentLaunchPrompt,
   type AgentLaunchResult
 } from '../../../src/shared/agent-launch-intent'
+import {
+  AGENT_LAUNCH_REPLAY_REQUIRED_RUNTIME_CAPABILITY,
+  AGENT_LAUNCH_RUNTIME_CAPABILITY
+} from '../../../src/shared/protocol-version'
 import type { TuiAgent } from '../../../src/shared/tui-agent'
 import type { RpcSendParams } from '../transport/rpc-params-contract'
 import type { WorkspaceCreateParams } from './workspace-create-params'
@@ -27,6 +36,16 @@ export type AgentLaunchSupport = {
   replay: boolean
 }
 
+/** Reads the host's advertised capabilities; unsupported stays plain `false`. */
+export function readAgentLaunchSupport(
+  capabilities: readonly string[] | null | undefined
+): AgentLaunchSupport | false {
+  if (!capabilities?.includes(AGENT_LAUNCH_RUNTIME_CAPABILITY)) {
+    return false
+  }
+  return { replay: capabilities.includes(AGENT_LAUNCH_REPLAY_REQUIRED_RUNTIME_CAPABILITY) }
+}
+
 export type WorktreeCreateAgentLaunch = {
   agent: TuiAgent
   /** Resolved before the first create: an older host has no `agent.launch` at all. */
@@ -52,6 +71,27 @@ export function agentLaunchCreateParams(
   }
 }
 
+/**
+ * A launch into a workspace that already exists. Always sent as `agent.launchReplay`: a host that
+ * predates `operationId` would strip it and run the launch unprotected, while the separate method
+ * makes such a host refuse instead.
+ */
+export function agentLaunchExistingParams(args: {
+  agent: TuiAgent
+  worktreeId: string
+  operationId: string
+  prompt?: AgentLaunchPrompt
+  launchSource?: string
+}): RpcSendParams<'agent.launchReplay'> {
+  return {
+    agent: args.agent,
+    operationId: args.operationId,
+    target: { kind: 'existing', worktree: `id:${args.worktreeId}` },
+    ...(args.prompt ? { prompt: args.prompt } : {}),
+    ...(args.launchSource ? { launchSource: args.launchSource } : {})
+  }
+}
+
 /**
  * Reads the launch receipt.
  *
@@ -97,3 +137,12 @@ export function isAgentLaunchUnsupportedRefusal(error: {
   }
   return (error.message ?? '').includes('agent_launch_unsupported')
 }
+
+/** The `agent.launchReplay` twin: an older host rejects the method rather than a field. */
+export function isAgentLaunchReplayUnsupportedRefusal(error: { code?: string }): boolean {
+  return (
+    error.code === 'method_not_found' ||
+    error.code === 'forbidden' ||
+    error.code === 'agent_launch_replay_unsupported'
+  )
+}
diff --git a/mobile/src/tasks/blank-workspace-create.ts b/mobile/src/tasks/blank-workspace-create.ts
index af59df31822..0bdd056533e 100644
--- a/mobile/src/tasks/blank-workspace-create.ts
+++ b/mobile/src/tasks/blank-workspace-create.ts
@@ -1,7 +1,7 @@
 import type { TuiAgent } from '../../../src/shared/tui-agent'
 import type { RpcClient } from '../transport/rpc-client'
 import { createWorktreeWithNameRetry, type WorktreeCreateResult } from './worktree-create-retry'
-import type { WorktreeCreateAgentLaunch } from './agent-launch-worktree-create'
+import type { WorktreeCreateAgentLaunch } from './agent-launch-request'
 import type { WorktreeCreateIdempotencyProbe } from './worktree-create-idempotency-policy'
 import {
   startupAgentCreateFields,
diff --git a/mobile/src/tasks/mobile-tasks-chrome-styles.ts b/mobile/src/tasks/mobile-tasks-chrome-styles.ts
index 76601c4f725..3b0c3f2d6e2 100644
--- a/mobile/src/tasks/mobile-tasks-chrome-styles.ts
+++ b/mobile/src/tasks/mobile-tasks-chrome-styles.ts
@@ -28,6 +28,7 @@ export const mobileTasksChromeStyles = StyleSheet.create({
     flex: 1,
     flexDirection: 'row',
     alignItems: 'center',
+    gap: spacing.sm,
     minWidth: 0
   },
   title: {
diff --git a/mobile/src/tasks/mobile-tasks-refactor-parity.test.ts b/mobile/src/tasks/mobile-tasks-refactor-parity.test.ts
deleted file mode 100644
index 859fb8d1459..00000000000
--- a/mobile/src/tasks/mobile-tasks-refactor-parity.test.ts
+++ /dev/null
@@ -1,156 +0,0 @@
-import { createHash } from 'node:crypto'
-import { describe, expect, it } from 'vitest'
-import {
-  readFlattenedMobileTasksHookSignatures,
-  readMobileTasksSemanticSource,
-  readMobileTasksStyleSource
-} from './mobile-tasks-source-family.test-support'
-import { readFlattenedMobileTasksRenderTokens } from './mobile-tasks-render-parity.test-support'
-import {
-  readFlattenedMobileTasksCoreStatements,
-  readMobileTasksDeclarationSignatures
-} from './mobile-tasks-execution-parity.test-support'
-
-const hash = (parts: string[] | string): string =>
-  createHash('sha256')
-    .update(Array.isArray(parts) ? parts.join('\n') : parts)
-    .digest('hex')
-
-// Bound requests change source signatures the same way bound provider, workspace-creation and
-// settings requests did: the method string and the envelope read leave the screen and an operation
-// name arrives. The behaviour they used to pin is pinned by the recordings in
-// mobile/rpc-foundation/goldens instead, which did not move.
-//
-// The screen-holdout migration takes the last two sends out of this family — the filter sheet's
-// linear.selectWorkspace and the screen-root hook's repo.list. Hook, statement, declaration, render
-// and style counts are all unchanged, and `semantics` is a pure deletion of four lines, none in:
-// two `rpc:` call signatures and the two method literals they carried. The render-token hash moves
-// because the picker's handler now names an operation instead of the client.
-//
-// Step 7's first half moves four of the six again, and moves nothing else. Checked readers on the
-// item and list operations delete the reply casts these consumers carried, plus the three shape
-// tests the reader now answers for: both `Array.isArray(payload)` guards on the checks read and the
-// `typeof count === 'number'` fallback on the item count. Hook, statement, declaration and render
-// counts are unchanged, and the render-token hash does not move at all — nothing this family sees
-// changed inside a JSX tree. `semantics` is a pure deletion of ten lines.
-//
-// Round-1 review moves four, and names what each one is. The reaction reader stops matching
-// `content` against an arm set mobile invented and forwards it, so `DetailComment` loses the eight
-// phantom arms and `COMMENT_REACTION_EMOJI` stops being keyed by them: that is ten string literals
-// gone and the `?? ''` fallback's one added, the whole of `semantics`' 3,290 -> 3,281. The eight
-// alias-only bindings the deleted casts left behind (`const result = created` and its seven
-// siblings) are inlined, which moves the hook and statement hashes without moving their counts.
-// Only those eight: the Linear arm of task creation keeps its own `result`, which is a declaration
-// with a name rather than an alias for one.
-// No `rpc:` signature and no `jsx:` signature moves, the render-token hash does not move, and
-// counts stay at 350 hooks, 417 statements and 194 declarations.
-//
-// The `gitlab.todos` fixture correction moves the same three hashes once more and no others: the
-// to-do row is checked now, so the reader's cast is gone from the list-loading hook and the row
-// type it forwarded is declared by what the reader proves. Counts are unchanged again, and
-// `semantics` does not move, because no RPC call, runtime string or JSX host signature does.
-//
-// Round 2 moves two, and only because one member widens. `GitHubDetailFile.viewerViewedState` is
-// `string` rather than the host's three arms, because the reader forwards it now: that is the
-// declaration hash and the three arm literals, `semantics` 3,281 -> 3,278. `status` keeps its arms
-// and moves nothing, because its only consumer sends it back as a param the host validates against
-// the same set. Hook, statement and render hashes do not move; nothing executable changed.
-//
-// Step 7's tasks-2 half moves the hook, statement, declaration and semantic hashes once more, for
-// the board, runtime, search, workspace-source and workspace-create operations, and moves no count:
-// hooks stay at 350, statements at 417, declarations at 194. `semantics` is a pure deletion of four
-// lines, 3,278 -> 3,274, and all four are the literals inside the one inline cast type this half
-// deletes in use-mobile-tasks-project-detail-loading.tsx — `'DISMISSED'`, `'VIEWED'`, `'UNVIEWED'`
-// and the `['status']` index into GitHubDetailFile. No method literal and no `rpc:` call signature
-// moves.
-//
-// The hook and statement hashes also move for comment text alone: `normalized` reads a statement's
-// full span, so a comment nested inside one is hashed with it. They move once more when the two
-// halves are deduplicated: the project pane's five collection casts and the assignee list's are
-// deleted where the entity schemas from the item half now type those rows.
-//
-// Round 2 of tasks-2 moves the hook and statement hashes a last time, and only those two. One
-// statement changes: the Linear list cast (`found as LinearIssue[]`) becomes `found`, because the
-// nine members linearIssueRowSchema requires make the value assignable to the mobile alias without
-// it. The rest is comment text nested inside statements — three `SAFETY:` lines rewritten to argue
-// from the schemas that landed instead of the fixtures round 1 deleted. Counts are unchanged at 350
-// hooks and 417 statements; the declaration, semantic, render and style hashes do not move, which
-// is the evidence that deleting the cast changed no type and no call.
-//
-// The pullfrog pass on the same round moved both once more, again by comment text alone: the
-// GitHub search `SAFETY:` line now separates the two members the schema requires (`items`,
-// `labels`) from the eight it only types. No statement, type or call changed; counts hold.
-// C2.1 swaps the workspace-creation push onto `hostNewWorktreeSessionRoute`, which already built
-// this href with both segments encoded. Three of the family move and nothing else does: the hook
-// list, because the handler's statements changed shape; the statement hash, for the same reason;
-// and `semantics`, which is a pure deletion of two lines — the `URLSearchParams` construction and
-// the raw `/h/${hostId}/session/...` template it fed. No RPC call, method literal or JSX host
-// signature changed, and the render and style hashes did not move.
-
-// C2.1 swaps the two clipboard writes onto the platform seam, so the comment-review hook gains one
-// hook call and one statement. Two of the family move: the hook list and the statement hash, each
-// by one entry. `semantics` does not — no RPC call, method literal or JSX host signature changed —
-// and the render and style hashes hold.
-
-// C2.8 names the status bar's Back control for the shell, which has no native chrome behind it to
-// announce one. `accessibilityRole="button"` and `accessibilityLabel="Back"` on that one Pressable
-// move the two hashes a JSX prop must move, and only those two. `semantics` 3,272 -> 3,274: the
-// element's host signature widens (`jsx:Pressable:style,onPress` -> the same plus the two props)
-// and the two new runtime strings `"button"` and `"Back"` arrive. The render-token stream gains
-// the eight tokens those two attributes are, 35,195 -> 35,203. No RPC call signature and no method
-// literal moves, and the hook, statement, declaration and style hashes do not move at all, which
-// is the evidence that nothing executable changed.
-//
-// The same commit gives that control the `hitSlop={8}` its four siblings carry, so its touch
-// target is no longer the glyph alone. One more line of `semantics` changes and no line is added
-// or removed — the host signature gains `hitSlop` — so the count holds at 3,274 and only the hash
-// moves. The render-token stream gains the four tokens that one attribute is, 35,203 -> 35,207.
-// Nothing else in the family moves.
-
-const SCREEN_RPC_SCREEN_HOOKS = '0f66df2141117dfec2f8a0adb3f598312e6fda8e80833a365a645796f5ab48c3'
-const PRE_REFACTOR_DIFF_HOOKS = '93c7189b32bed8456cc51814fffa8ce80cf62011ef968a9d53ddec2b9686f58f'
-const SCREEN_RPC_STATEMENTS = 'dd8f33cb3cf96f5c39abac397cb77e35f59079291033a1866ead462b041ab979'
-const MAIN_REBASED_DECLARATIONS = '920a1b66445d10e2a64fbdbe9d7138a4ebe21bbccde1b9ac9c89267cecc584b9'
-const SCREEN_RPC_SEMANTICS = 'e07a63387d57106483ee703ec6c19dea593e0eca5c651758f42bcb36254850b7'
-const PRE_REFACTOR_STYLES = '1db6af69c791d9963928541ad5310942fcbda6d984b422c90b6eb92b6816579a'
-const SCREEN_RPC_RENDER_TREE = '086742f95f1e87fb89d8c67ffd9f7a229799ae05115f9f4bcc1a925e56dcc8bb'
-
-describe('Mobile Tasks refactor parity', () => {
-  it('preserves recursively flattened hook and dependency order', () => {
-    const screenHooks = readFlattenedMobileTasksHookSignatures('MobileTasksScreen')
-    expect(screenHooks).toHaveLength(351)
-    expect(hash(screenHooks)).toBe(SCREEN_RPC_SCREEN_HOOKS)
-
-    const diffHooks = readFlattenedMobileTasksHookSignatures('GitHubPrFileDiff')
-    expect(diffHooks).toHaveLength(3)
-    expect(hash(diffHooks)).toBe(PRE_REFACTOR_DIFF_HOOKS)
-  })
-
-  it('preserves every screen statement in execution order', () => {
-    const statements = readFlattenedMobileTasksCoreStatements()
-    expect(statements).toHaveLength(418)
-    expect(hash(statements)).toBe(SCREEN_RPC_STATEMENTS)
-  })
-
-  it('preserves every moved top-level declaration', () => {
-    const declarations = readMobileTasksDeclarationSignatures()
-    expect(declarations).toHaveLength(194)
-    expect(hash(declarations)).toBe(MAIN_REBASED_DECLARATIONS)
-  })
-
-  it('preserves RPC calls, runtime strings, and JSX host signatures', () => {
-    const semantics = readMobileTasksSemanticSource()
-    expect(semantics.split('\n')).toHaveLength(3_274)
-    expect(hash(semantics)).toBe(SCREEN_RPC_SEMANTICS)
-  })
-
-  it('preserves render expressions and event handlers in tree order', () => {
-    const tokens = readFlattenedMobileTasksRenderTokens()
-    expect(tokens).toHaveLength(35_207)
-    expect(hash(tokens)).toBe(SCREEN_RPC_RENDER_TREE)
-  })
-
-  it('preserves every StyleSheet property and value', () => {
-    expect(hash(readMobileTasksStyleSource())).toBe(PRE_REFACTOR_STYLES)
-  })
-})
diff --git a/mobile/src/tasks/mobile-tasks-reviewer-linear.test.ts b/mobile/src/tasks/mobile-tasks-reviewer-linear.test.ts
new file mode 100644
index 00000000000..3fec8b222ae
--- /dev/null
+++ b/mobile/src/tasks/mobile-tasks-reviewer-linear.test.ts
@@ -0,0 +1,26 @@
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('./mobile-tasks-dependencies', () => import('../theme/mobile-theme'))
+import { reconcileTeamSelection } from './mobile-tasks-reviewer-linear'
+import type { LinearTeam } from './mobile-tasks-provider-detail-types'
+
+function team(id: string): LinearTeam {
+  return { id, name: id, key: id.toUpperCase() }
+}
+
+describe('reconcileTeamSelection', () => {
+  it('selects every team for sticky-all', () => {
+    expect([...reconcileTeamSelection([team('a'), team('b')], null)]).toEqual(['a', 'b'])
+  })
+
+  it('keeps saved teams that still exist', () => {
+    expect([...reconcileTeamSelection([team('a'), team('b')], ['b'])]).toEqual(['b'])
+  })
+
+  // Why: an older host projects its raw store value, which reached 1.4.207
+  // desktops as a string (0a2b6e7f); the mobile list must not fail on it.
+  it('reads a saved value of the wrong shape as sticky-all instead of throwing', () => {
+    expect([...reconcileTeamSelection([team('a'), team('b')], 'a')]).toEqual(['a', 'b'])
+    expect([...reconcileTeamSelection([team('a'), team('b')], { 0: 'a' })]).toEqual(['a', 'b'])
+  })
+})
diff --git a/mobile/src/tasks/mobile-tasks-reviewer-linear.ts b/mobile/src/tasks/mobile-tasks-reviewer-linear.ts
index ed5e51f8bf7..32b872550aa 100644
--- a/mobile/src/tasks/mobile-tasks-reviewer-linear.ts
+++ b/mobile/src/tasks/mobile-tasks-reviewer-linear.ts
@@ -196,11 +196,10 @@ export function linearIssueSecondaryParts(
   return parts
 }
 
-export function reconcileTeamSelection(
-  teams: LinearTeam[],
-  saved: string[] | null | undefined
-): Set<string> {
-  if (!saved) {
+// Why `unknown`: a host predating the desktop fix for 0a2b6e7f projects its
+// raw store value, which can be a string; that must read as sticky-all.
+export function reconcileTeamSelection(teams: LinearTeam[], saved: unknown): Set<string> {
+  if (!Array.isArray(saved)) {
     return new Set(teams.map((team) => team.id))
   }
   const available = new Set(teams.map((team) => team.id))
diff --git a/mobile/src/tasks/mobile-tui-agents.ts b/mobile/src/tasks/mobile-tui-agents.ts
index 46d8dd00886..3b601ec2f68 100644
--- a/mobile/src/tasks/mobile-tui-agents.ts
+++ b/mobile/src/tasks/mobile-tui-agents.ts
@@ -15,6 +15,7 @@ export const MOBILE_TUI_AGENT_LABELS: Record<TuiAgent, string> = TUI_AGENT_DISPL
 
 export const MOBILE_TUI_AGENT_FAVICON_DOMAINS: Partial<Record<TuiAgent, string>> = {
   openclaude: 'openclaude.gitlawb.com',
+  codebuddy: 'codebuddy.ai',
   grok: 'x.ai',
   copilot: 'github.com',
   opencode: 'opencode.ai',
@@ -22,9 +23,11 @@ export const MOBILE_TUI_AGENT_FAVICON_DOMAINS: Partial<Record<TuiAgent, string>>
   ante: 'antigma.ai',
   trae: 'www.trae.cn',
   muse: 'dev.meta.ai',
+  dsh: 'deepseek.com',
   zcode: 'zcode.z.ai',
   omp: 'omp.sh',
   'prime-agent': 'primeintellect.ai',
+  qoder: 'qoder.com',
   gemini: 'gemini.google.com',
   antigravity: 'antigravity.google',
   goose: 'goose-docs.ai',
@@ -36,6 +39,7 @@ export const MOBILE_TUI_AGENT_FAVICON_DOMAINS: Partial<Record<TuiAgent, string>>
   autohand: 'autohand.ai',
   cline: 'cline.bot',
   codebuff: 'codebuff.com',
+  freebuff: 'freebuff.com',
   'command-code': 'commandcode.ai',
   continue: 'continue.dev',
   cursor: 'cursor.com',
diff --git a/mobile/src/tasks/replay-on-ambiguous-delivery.ts b/mobile/src/tasks/replay-on-ambiguous-delivery.ts
new file mode 100644
index 00000000000..5179bdcb492
--- /dev/null
+++ b/mobile/src/tasks/replay-on-ambiguous-delivery.ts
@@ -0,0 +1,115 @@
+import type { RpcClient } from '../transport/rpc-client'
+import type { RpcResponse } from '../transport/types'
+import { isRpcDeliveryUnknown } from '../transport/rpc-delivery-ambiguity'
+import { waitForRpcClientReconnected } from '../transport/rpc-client-reconnect-wait'
+import { isLogicalClientCutoverError } from '../transport/stable-logical-rpc-client'
+import {
+  getWorktreeCreateReplayWindowMs,
+  type WorktreeCreateIdempotencySupport
+} from './worktree-create-idempotency-policy'
+
+// Why: a request in flight when the mobile transport migrates (relay/direct hand-off on shoddy
+// cellular, relay lease rotation) rejects with a cutover error even though the host may have
+// completed it. The caller's replay identity makes a resend safe, so re-issue on the fresh session a
+// bounded number of times instead of surfacing "RPC interrupted by connection migration".
+const CUTOVER_MAX_RETRIES = 5
+
+// Why: a plain socket close (cellular flap, relay drop, the phone backgrounding) also rejects the
+// in-flight frame as delivery-unknown with no generation bump. The host may well have acted, so
+// replay on the same identity instead of reporting a failure.
+const AMBIGUOUS_MAX_RETRIES = 2
+
+// Bounded so a spinner doesn't sit for the whole window; the deadline still caps it.
+export const AMBIGUOUS_RECONNECT_WAIT_MS = 20_000
+
+/**
+ * What makes resending the SAME request safe after an ambiguous delivery.
+ *
+ * `durable`: the host keeps a ledger row for the caller's operation id and answers a replay from it
+ * (or refuses an unknown outcome), so a resend is safe at any time. `window`: the host only caches a
+ * result in memory for a bounded time, so a resend is safe only while that record is guaranteed.
+ */
+export type AmbiguousDeliveryReplay =
+  | { kind: 'durable' }
+  | { kind: 'window'; support: WorktreeCreateIdempotencySupport }
+
+/**
+ * Sends, re-issuing the identical request whenever it went delivery-ambiguous. `send` must resend
+ * the same identity every call: a new one would be a new operation and defeat the replay.
+ *
+ * A definite answer (a success or a refusal) is returned untouched; `replayed` says whether it came
+ * from a resend, because a refusal on a replacement connection says nothing about what the first
+ * attempt did. With no replay policy the first transport error is rethrown.
+ */
+export async function sendReplayingAmbiguousDelivery(
+  client: RpcClient,
+  send: () => Promise<RpcResponse>,
+  replay: AmbiguousDeliveryReplay | null
+): Promise<{ response: RpcResponse; replayed: boolean }> {
+  let migrationRetry = 0
+  let ambiguousRetry = 0
+  const firstSentAt = Date.now()
+  let replayDeadlineAt: number | null = null
+  for (;;) {
+    try {
+      // `send` must hand back the transport promise itself, so a delivery-unknown rejection reaches
+      // the catch below as the object the transport marked — the WeakSet cannot see through a wrapper.
+      const response = await send()
+      return { response, replayed: migrationRetry > 0 || ambiguousRetry > 0 }
+    } catch (error) {
+      if (!replay) {
+        throw error
+      }
+      if (isLogicalClientCutoverError(error)) {
+        if (migrationRetry >= CUTOVER_MAX_RETRIES) {
+          throw error
+        }
+        migrationRetry += 1
+        // Why: LogicalClientCutoverError is raised only after migrateTo installs an
+        // authenticated replacement, so retry immediately instead of adding UI lag.
+        continue
+      }
+      if (!isRpcDeliveryUnknown(error) || ambiguousRetry >= AMBIGUOUS_MAX_RETRIES) {
+        throw error
+      }
+      // A legacy cache may expire before a request timeout; durable receipts refuse unsafe replay.
+      if (replay.kind === 'window' && client.getState() === 'connected') {
+        throw error
+      }
+      // Keep the legacy deadline fixed; the host itself refuses expired durable operation IDs.
+      replayDeadlineAt ??=
+        replay.kind === 'durable'
+          ? Infinity
+          : resolveReplayDeadline(client, firstSentAt, replay.support)
+      const remainingWindowMs = replayDeadlineAt - Date.now()
+      if (remainingWindowMs <= 0) {
+        throw error
+      }
+      ambiguousRetry += 1
+      // Disconnected transports must reconnect before resend; bound the wait even for durable IDs.
+      if (
+        !(await waitForRpcClientReconnected(
+          client,
+          Math.min(AMBIGUOUS_RECONNECT_WAIT_MS, remainingWindowMs)
+        ))
+      ) {
+        throw error
+      }
+    }
+  }
+}
+
+// Latest instant the host's dedupe record is still guaranteed to exist, from the earliest
+// point the request could have resolved. lastInboundAt stamps a frame that really arrived,
+// so it stays honest across a suspension in a way a timer budget cannot; the send is the
+// fallback, and a sound floor either way, because the host cannot resolve a request it has
+// not yet received.
+function resolveReplayDeadline(
+  client: RpcClient,
+  firstSentAt: number,
+  support: WorktreeCreateIdempotencySupport
+): number {
+  const lastInboundAt = client.getLastInboundAt?.() ?? null
+  const anchor = lastInboundAt !== null && lastInboundAt > firstSentAt ? lastInboundAt : firstSentAt
+  return anchor + getWorktreeCreateReplayWindowMs(support)
+}
diff --git a/mobile/src/tasks/source-workspace-create.ts b/mobile/src/tasks/source-workspace-create.ts
index fb86701707a..143f2dde752 100644
--- a/mobile/src/tasks/source-workspace-create.ts
+++ b/mobile/src/tasks/source-workspace-create.ts
@@ -15,7 +15,7 @@ import {
   type WorkspaceCreateTaskItem
 } from './workspace-create-params'
 import { createWorktreeWithNameRetry, type WorktreeCreateResult } from './worktree-create-retry'
-import type { WorktreeCreateAgentLaunch } from './agent-launch-worktree-create'
+import type { WorktreeCreateAgentLaunch } from './agent-launch-request'
 import type { WorktreeCreateIdempotencyProbe } from './worktree-create-idempotency-policy'
 
 // The agent bundle the modal resolved: `choice` drives launch resolution — the
diff --git a/mobile/src/tasks/workspace-create-reply-schema.ts b/mobile/src/tasks/workspace-create-reply-schema.ts
index c632bfee083..647ae3572b6 100644
--- a/mobile/src/tasks/workspace-create-reply-schema.ts
+++ b/mobile/src/tasks/workspace-create-reply-schema.ts
@@ -34,7 +34,7 @@ export const worktreeCreateReceiptSchema = z.looseObject({
  *
  * Nothing under the container is required, because readAgentLaunchCreateOutcome already guards
  * every member it reads — `'worktreeId' in result` and a `typeof`/`trim` pair
- * (agent-launch-worktree-create.ts:55-:64) — and answers `null` when either fails, which
+ * (agent-launch-request.ts, readAgentLaunchCreateOutcome) — and answers `null` when either fails, which
  * worktree-create-retry.ts:123 turns into "Failed to create workspace". That arm is preserved.
  *
  * What the container adds is the reply main could not name: a string, a number or `null` receipt
diff --git a/mobile/src/tasks/worktree-create-capability.ts b/mobile/src/tasks/worktree-create-capability.ts
index 636cb9a4832..ed354522b30 100644
--- a/mobile/src/tasks/worktree-create-capability.ts
+++ b/mobile/src/tasks/worktree-create-capability.ts
@@ -1,9 +1,5 @@
 import { useCallback, useEffect, useRef, useState } from 'react'
-import {
-  AGENT_LAUNCH_REPLAY_REQUIRED_RUNTIME_CAPABILITY,
-  AGENT_LAUNCH_RUNTIME_CAPABILITY
-} from '../../../src/shared/protocol-version'
-import type { AgentLaunchSupport } from './agent-launch-worktree-create'
+import { readAgentLaunchSupport, type AgentLaunchSupport } from './agent-launch-request'
 import type { RpcClient } from '../transport/rpc-client'
 import { isLogicalClientCutoverError } from '../transport/stable-logical-rpc-client'
 import { readMobileRuntimeHostPlatform } from '../transport/mobile-runtime-host-platform'
@@ -59,10 +55,7 @@ export async function readNewWorktreeRuntimeCapabilities(
       const advertisedIdempotency = result.worktreeCreateIdempotency
       return {
         tasksSupported: capabilities.includes(MOBILE_TASKS_CAPABILITY),
-        // Unsupported stays plain `false`, the same shape `worktreeCreateIdempotency` uses.
-        agentLaunch: capabilities.includes(AGENT_LAUNCH_RUNTIME_CAPABILITY)
-          ? { replay: capabilities.includes(AGENT_LAUNCH_REPLAY_REQUIRED_RUNTIME_CAPABILITY) }
-          : false,
+        agentLaunch: readAgentLaunchSupport(capabilities),
         worktreeCreateIdempotency: supportsIdempotency
           ? advertisedIdempotency === undefined
             ? { dedupeTtlMs: WORKTREE_CREATE_DEDUPE_TTL_LEGACY_HOST_MS }
diff --git a/mobile/src/tasks/worktree-create-retry.test.ts b/mobile/src/tasks/worktree-create-retry.test.ts
index b61ab20c30e..a42a0b1e84b 100644
--- a/mobile/src/tasks/worktree-create-retry.test.ts
+++ b/mobile/src/tasks/worktree-create-retry.test.ts
@@ -8,10 +8,8 @@ import {
   WORKTREE_CREATE_DEDUPE_TTL_LEGACY_HOST_MS,
   type WorktreeCreateIdempotencySupport
 } from './worktree-create-idempotency-policy'
-import {
-  createWorktreeWithNameRetry,
-  WORKTREE_CREATE_AMBIGUOUS_RECONNECT_WAIT_MS
-} from './worktree-create-retry'
+import { createWorktreeWithNameRetry } from './worktree-create-retry'
+import { AMBIGUOUS_RECONNECT_WAIT_MS } from './replay-on-ambiguous-delivery'
 import { WORKTREE_CREATE_TIMEOUT_MS } from './workspace-create-timeout'
 
 type Attempt = { method: string; params: Record<string, unknown> }
@@ -840,6 +838,6 @@ describe('createWorktreeWithNameRetry', () => {
     expect(LEGACY_HOST_REPLAY_WINDOW_MS).toBeLessThan(WORKTREE_CREATE_DEDUPE_TTL_LEGACY_HOST_MS)
     // A reconnect wait is clamped when a short advertisement leaves less time.
     const shortReplayWindowMs = getWorktreeCreateReplayWindowMs({ dedupeTtlMs: 20_000 })
-    expect(Math.min(WORKTREE_CREATE_AMBIGUOUS_RECONNECT_WAIT_MS, shortReplayWindowMs)).toBe(10_000)
+    expect(Math.min(AMBIGUOUS_RECONNECT_WAIT_MS, shortReplayWindowMs)).toBe(10_000)
   })
 })
diff --git a/mobile/src/tasks/worktree-create-retry.ts b/mobile/src/tasks/worktree-create-retry.ts
index 19c2b79ead0..7ba680ba635 100644
--- a/mobile/src/tasks/worktree-create-retry.ts
+++ b/mobile/src/tasks/worktree-create-retry.ts
@@ -1,14 +1,11 @@
 import type { TuiAgent } from '../../../src/shared/tui-agent'
 import type { RpcClient } from '../transport/rpc-client'
 import type { RpcResponse } from '../transport/types'
-import { isRpcDeliveryUnknown } from '../transport/rpc-delivery-ambiguity'
 import {
   agentLaunchRun,
   agentLaunchReplayRun,
   worktreeCreateRun
 } from './mobile-workspace-create-operations'
-import { waitForRpcClientReconnected } from '../transport/rpc-client-reconnect-wait'
-import { isLogicalClientCutoverError } from '../transport/stable-logical-rpc-client'
 import {
   CLIENT_WORKTREE_CREATE_MAX_ATTEMPTS,
   getClientWorktreeCreateCandidate,
@@ -17,18 +14,22 @@ import {
 } from '../../../src/shared/new-workspace/worktree-create-retry-policy'
 import {
   agentLaunchCreateParams,
+  isAgentLaunchReplayUnsupportedRefusal,
   isAgentLaunchUnsupportedRefusal,
   readAgentLaunchCreateOutcome,
   type WorktreeCreateAgentLaunch
-} from './agent-launch-worktree-create'
+} from './agent-launch-request'
 import { structuredSessionOperationId } from '../session/structured-session-operation-id'
 import { WORKTREE_CREATE_TIMEOUT_MS } from './workspace-create-timeout'
 import type { WorkspaceCreateParams } from './workspace-create-params'
-import {
-  getWorktreeCreateReplayWindowMs,
-  type WorktreeCreateIdempotencyProbe,
-  type WorktreeCreateIdempotencySupport
+import type {
+  WorktreeCreateIdempotencyProbe,
+  WorktreeCreateIdempotencySupport
 } from './worktree-create-idempotency-policy'
+import {
+  sendReplayingAmbiguousDelivery,
+  type AmbiguousDeliveryReplay
+} from './replay-on-ambiguous-delivery'
 
 // Why: server-side collision checks (branch already exists locally / on a remote
 // / already has PR #N) can fire even after a pre-flight basename dedupe —
@@ -39,26 +40,6 @@ export type WorktreeCreateResult =
   | { worktreeId: string; name: string; warning?: string }
   | { error: string }
 
-// Why: a create in flight when the mobile transport migrates (relay/direct
-// hand-off on shoddy cellular, relay lease rotation) rejects with a cutover error
-// even though the host may have completed it. The shared clientMutationId makes a
-// retry idempotent, so re-issue on the fresh session a bounded number of times
-// instead of surfacing "RPC interrupted by connection migration" with the
-// worktree silently created.
-const WORKTREE_CREATE_CUTOVER_MAX_RETRIES = 5
-
-// Why: a connection migration is not the only way a create goes delivery-ambiguous.
-// A plain socket close (cellular flap, relay drop, the phone backgrounding and the
-// supervisor suspending a billed relay splice) rejects the in-flight frame as
-// delivery-unknown with no generation bump, and create holds the longest budget of
-// any mobile RPC — 10 minutes of clone/fetch/setup — so it is the likeliest request
-// to be caught by one. Surfacing that as a failure is wrong: the host may well have
-// finished the worktree. Replay on the same clientMutationId instead.
-const WORKTREE_CREATE_AMBIGUOUS_MAX_RETRIES = 2
-
-// Bounded so the Create spinner doesn't sit for the whole window; the deadline still caps it.
-export const WORKTREE_CREATE_AMBIGUOUS_RECONNECT_WAIT_MS = 20_000
-
 export type CreateWorktreeWithNameRetryArgs = {
   client: RpcClient
   baseName: string
@@ -120,9 +101,7 @@ export async function createWorktreeWithNameRetry(
       !sent.replayed &&
       launch &&
       (launchOperationId
-        ? response.error.code === 'method_not_found' ||
-          response.error.code === 'forbidden' ||
-          response.error.code === 'agent_launch_replay_unsupported'
+        ? isAgentLaunchReplayUnsupportedRefusal(response.error)
         : isAgentLaunchUnsupportedRefusal(response.error))
     ) {
       // The probe said the host knows `agent.launch` but it refused the call — most likely this
@@ -196,10 +175,9 @@ function readCreateResult(
   }
 }
 
-// Sends the create, re-issuing whenever the request went delivery-ambiguous —
-// the frame reached the wire but no response came back, so the host may already have
-// built the worktree. Every arm below re-sends the SAME two names: a new one would be a new
-// operation and would defeat both mechanisms.
+// Sends the create, re-issuing whenever the request went delivery-ambiguous — the frame reached the
+// wire but no response came back, so the host may already have built the worktree. Every resend
+// carries the SAME two names: a new one would be a new operation and would defeat both mechanisms.
 //
 // On the `worktree.create` route the shared clientMutationId keeps the retry idempotent host-side.
 // On the launch route it does NOT reach the ledger: `agent.launch` caches the whole launch — the
@@ -207,7 +185,7 @@ function readCreateResult(
 // and outside it adds both. `launchOperationId` is what makes the replay durably safe, and it is
 // only sent when the host advertised the ledger.
 // A definite failure (never sent, or a server error response) is returned to the caller untouched.
-async function sendWorktreeCreateResilient(
+function sendWorktreeCreateResilient(
   client: RpcClient,
   launchAgent: TuiAgent | null,
   launchOperationId: string | null,
@@ -215,16 +193,17 @@ async function sendWorktreeCreateResilient(
   worktreeCreateIdempotency: WorktreeCreateIdempotencySupport | false
 ): Promise<{ response: RpcResponse; replayed: boolean }> {
   // Only the selected method's receipt can authorize replay after an ambiguous delivery.
-  const replaySupport = launchAgent ? launchOperationId : worktreeCreateIdempotency
-  let migrationRetry = 0
-  let ambiguousRetry = 0
-  const firstSentAt = Date.now()
-  let replayDeadlineAt: number | null = null
-  for (;;) {
-    try {
-      // `request` is the transport promise itself, so a delivery-unknown rejection reaches the
-      // catch below as the object the transport marked — the WeakSet cannot see through a wrapper.
-      const response = await (launchAgent
+  const replay: AmbiguousDeliveryReplay | null = launchAgent
+    ? launchOperationId
+      ? { kind: 'durable' }
+      : null
+    : worktreeCreateIdempotency
+      ? { kind: 'window', support: worktreeCreateIdempotency }
+      : null
+  return sendReplayingAmbiguousDelivery(
+    client,
+    () =>
+      launchAgent
         ? launchOperationId
           ? agentLaunchReplayRun.request(
               client,
@@ -241,65 +220,9 @@ async function sendWorktreeCreateResilient(
             )
         : worktreeCreateRun.request(client, params, {
             timeoutMs: WORKTREE_CREATE_TIMEOUT_MS
-          }))
-      // A refusal on the replacement connection says nothing about what the first call created.
-      return { response, replayed: migrationRetry > 0 || ambiguousRetry > 0 }
-    } catch (error) {
-      if (!replaySupport) {
-        throw error
-      }
-      if (isLogicalClientCutoverError(error)) {
-        if (migrationRetry >= WORKTREE_CREATE_CUTOVER_MAX_RETRIES) {
-          throw error
-        }
-        migrationRetry += 1
-        // Why: LogicalClientCutoverError is raised only after migrateTo installs an
-        // authenticated replacement, so retry immediately instead of adding UI lag.
-        continue
-      }
-      if (!isRpcDeliveryUnknown(error) || ambiguousRetry >= WORKTREE_CREATE_AMBIGUOUS_MAX_RETRIES) {
-        throw error
-      }
-      // A legacy cache may expire before a request timeout; durable receipts refuse unsafe replay.
-      if (typeof replaySupport !== 'string' && client.getState() === 'connected') {
-        throw error
-      }
-      // Keep the legacy deadline fixed; the host itself refuses expired durable operation IDs.
-      replayDeadlineAt ??=
-        typeof replaySupport === 'string'
-          ? Infinity
-          : resolveReplayDeadline(client, firstSentAt, replaySupport)
-      const remainingWindowMs = replayDeadlineAt - Date.now()
-      if (remainingWindowMs <= 0) {
-        throw error
-      }
-      ambiguousRetry += 1
-      // Disconnected transports must reconnect before resend; bound the wait even for durable IDs.
-      if (
-        !(await waitForRpcClientReconnected(
-          client,
-          Math.min(WORKTREE_CREATE_AMBIGUOUS_RECONNECT_WAIT_MS, remainingWindowMs)
-        ))
-      ) {
-        throw error
-      }
-    }
-  }
-}
-
-// Latest instant the host's dedupe record is still guaranteed to exist, from the earliest
-// point the create could have resolved. lastInboundAt stamps a frame that really arrived,
-// so it stays honest across a suspension in a way a timer budget cannot; the send is the
-// fallback, and a sound floor either way, because the host cannot resolve a create it has
-// not yet received.
-function resolveReplayDeadline(
-  client: RpcClient,
-  firstSentAt: number,
-  support: WorktreeCreateIdempotencySupport
-): number {
-  const lastInboundAt = client.getLastInboundAt?.() ?? null
-  const anchor = lastInboundAt !== null && lastInboundAt > firstSentAt ? lastInboundAt : firstSentAt
-  return anchor + getWorktreeCreateReplayWindowMs(support)
+          }),
+    replay
+  )
 }
 
 function defaultWorktreeCreateMutationId(): string {
diff --git a/mobile/src/terminal/TerminalWebView.tsx b/mobile/src/terminal/TerminalWebView.tsx
index 88d9da6106a..8c474fcd186 100644
--- a/mobile/src/terminal/TerminalWebView.tsx
+++ b/mobile/src/terminal/TerminalWebView.tsx
@@ -1,10 +1,10 @@
-import { useRef, useCallback, forwardRef, useImperativeHandle } from 'react'
+import { useRef, useCallback, useState, forwardRef, useImperativeHandle } from 'react'
 import { Platform, View } from 'react-native'
 import { WebView, type WebViewMessageEvent } from 'react-native-webview'
 import type { TerminalWebViewHandle, TerminalWebViewProps } from './terminal-webview-contract'
 import { TerminalWebViewEngineErrorOverlay } from './terminal-webview-engine-error-state'
 import { TERMINAL_WEBVIEW_FRAME_STYLES } from './terminal-webview-frame-styles'
-import { XTERM_WEBVIEW_SOURCE } from './terminal-webview-html'
+import { xtermWebViewSource } from './terminal-webview-html'
 import type { TerminalWebViewCommand } from './terminal-webview-messages'
 import { useTerminalWebViewController } from './use-terminal-webview-controller'
 
@@ -34,6 +34,13 @@ export const TerminalWebView = forwardRef<TerminalWebViewHandle, Props>(
     })
 
     useImperativeHandle(ref, () => handle, [handle])
+    // Why: the document builds its terminal before ready, so it needs the text scale before any
+    // message can reach it; later changes arrive as set-font-scale.
+    // Why: in the page source rather than injected: Android can run an injected script after the
+    // document's own, which then starts without them.
+    const [source] = useState(() =>
+      xtermWebViewSource({ textScale: props.textScale ?? 1, shown: props.shownAtMount ?? true })
+    )
 
     const handleMessage = useCallback(
       (event: WebViewMessageEvent) => {
@@ -65,7 +72,7 @@ export const TerminalWebView = forwardRef<TerminalWebViewHandle, Props>(
       <View style={[TERMINAL_WEBVIEW_FRAME_STYLES.container, props.style]}>
         <WebView
           ref={webViewRef}
-          source={XTERM_WEBVIEW_SOURCE}
+          source={source}
           style={TERMINAL_WEBVIEW_FRAME_STYLES.webview}
           originWhitelist={['*']}
           javaScriptEnabled
diff --git a/mobile/src/terminal/TerminalWebView.web.tsx b/mobile/src/terminal/TerminalWebView.web.tsx
index c810dbc86d8..38de971d587 100644
--- a/mobile/src/terminal/TerminalWebView.web.tsx
+++ b/mobile/src/terminal/TerminalWebView.web.tsx
@@ -54,6 +54,12 @@ export const TerminalWebView = forwardRef<TerminalWebViewHandle, Props>(
     // The page's answer to the WebView's reload: drop the document and build another one. The host
     // element is keyed on it so React replaces the div rather than handing back one xterm left in.
     const [generation, setGeneration] = useState(0)
+    // Why: every document this view builds starts as the view mounted — its scale, and whether it
+    // was shown — as the native WebView's pre-content script does; later scales arrive with init.
+    const [atMount] = useState(() => ({
+      textScale: props.textScale ?? 1,
+      shown: props.shownAtMount ?? true
+    }))
 
     useImperativeHandle(ref, () => handle, [handle])
     // In an effect, not during render: React may replay or discard render work, and the document
@@ -62,7 +68,6 @@ export const TerminalWebView = forwardRef<TerminalWebViewHandle, Props>(
     useEffect(() => {
       receiveRef.current = receive
     }, [receive])
-
     useEffect(() => {
       // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: react-native-web renders View as a div and forwards the ref to it; this module only ever runs in that build.
       const host = hostRef.current as unknown as HTMLElement | null
@@ -71,7 +76,7 @@ export const TerminalWebView = forwardRef<TerminalWebViewHandle, Props>(
       }
       let live
       try {
-        live = mountTerminalWebDocument(host, (message) => receiveRef.current?.(message))
+        live = mountTerminalWebDocument(host, (message) => receiveRef.current?.(message), atMount)
       } catch (error) {
         // A start that throws is the document's own failure and the factory has already unwound
         // it, so there is no handle and no engine ran: no `error` notify is coming. It goes down
@@ -101,7 +106,11 @@ export const TerminalWebView = forwardRef<TerminalWebViewHandle, Props>(
       }
       // Mounted once per generation: re-running this would throw away a live terminal and its
       // scrollback, and the controller's identity changes with every callback prop.
-    }, [generation])
+    }, [atMount, generation])
+
+    const handleHostLayout = useCallback(() => {
+      documentRef.current?.notifyViewport()
+    }, [])
 
     const handleReload = useCallback(() => {
       clearEngineError()
@@ -112,7 +121,13 @@ export const TerminalWebView = forwardRef<TerminalWebViewHandle, Props>(
 
     return (
       <View style={[TERMINAL_WEBVIEW_FRAME_STYLES.container, props.style]}>
-        <View key={generation} ref={hostRef} style={TERMINAL_WEBVIEW_FRAME_STYLES.webview} />
+        {/* Why: mounted with onLayout, so react-native-web observes it; the document sizes to this box. */}
+        <View
+          key={generation}
+          ref={hostRef}
+          style={TERMINAL_WEBVIEW_FRAME_STYLES.webview}
+          onLayout={handleHostLayout}
+        />
         {engineError ? (
           <TerminalWebViewEngineErrorOverlay message={engineError} onReload={handleReload} />
         ) : null}
diff --git a/mobile/src/terminal/document/document-host-root.test.ts b/mobile/src/terminal/document/document-host-root.test.ts
index e9b3ed5f1e2..8a3e066bbe9 100644
--- a/mobile/src/terminal/document/document-host-root.test.ts
+++ b/mobile/src/terminal/document/document-host-root.test.ts
@@ -224,3 +224,137 @@ describe('two terminal documents on one page', () => {
     two.started.stop()
   })
 })
+
+/** A started document over a measured grid whose cells scale with the font, as xterm's do. */
+function startMeasuredDocument() {
+  document.body.innerHTML = ''
+  const host = plantHost('pinch-host')
+  const engine = terminalDocumentDouble()
+  const parsedWrites: Array<() => void> = []
+  const grid = Object.assign(engine.terminal, {
+    cols: 80,
+    rows: 24,
+    _core: {
+      _renderService: {
+        get dimensions() {
+          const k = grid.options.fontSize / 13
+          return { css: { cell: { width: 7.5 * k, height: 15 * k } } }
+        }
+      }
+    }
+  })
+  grid.resize = (cols: number, rows: number) => {
+    grid.cols = cols
+    grid.rows = rows
+  }
+  grid.onWriteParsed = (listener: () => void) => {
+    parsedWrites.push(listener)
+    return { dispose() {} }
+  }
+  const posted: Array<Record<string, unknown>> = []
+  const started = createTerminalDocument({
+    root: host,
+    postToHost: (message) => {
+      posted.push(message)
+    },
+    hasEngine: () => true,
+    installHostTransport: () => () => {},
+    installErrorReporter: () => () => {},
+    paintDocumentBackground: () => {},
+    viewportRect: () => ({ left: 0, top: 0, width: 412, height: 600 }),
+    createTerminal: () => grid,
+    createUnicode11Addon: () => null,
+    createWebglAddon: () => null
+  })
+  // The app's init carries the frame it laid out.
+  started.send({
+    type: 'init',
+    cols: 80,
+    rows: 24,
+    initialData: '',
+    preserveScroll: false,
+    frame: { width: 412, height: 600 }
+  })
+  const write = () => parsedWrites.forEach((listener) => listener())
+  return { started, posted, surface: surfaceOf(host), write }
+}
+
+const nextFrame = () => new Promise<void>((resolve) => requestAnimationFrame(() => resolve()))
+async function settle() {
+  for (let frame = 0; frame < 10; frame++) {
+    await nextFrame()
+  }
+}
+
+const metricsOf = (posted: Array<Record<string, unknown>>) =>
+  posted.filter((message) => message.type === 'keyboard-avoidance-metrics')
+
+/** A touch on the surface itself, where the pinch listeners are; `fireTouch` reaches only `document`. */
+function fireSurfaceTouch(type: string, surface: HTMLElement, xs: number[]) {
+  const event = new Event(type, { bubbles: true, cancelable: true })
+  Object.defineProperty(event, 'touches', {
+    value: xs.map((x, identifier) => ({ identifier, clientX: x, clientY: 10, target: surface }))
+  })
+  surface.dispatchEvent(event)
+}
+
+/** Two fingers 20px apart, spread to `spread`px, a parsed write mid-gesture, then both lift. */
+function pinchTo(doc: ReturnType<typeof startMeasuredDocument>, spread: number, write = true) {
+  fireSurfaceTouch('touchstart', doc.surface, [10, 30])
+  fireSurfaceTouch('touchmove', doc.surface, [10, 10 + spread])
+  if (write) {
+    doc.write()
+  }
+  fireSurfaceTouch('touchend', doc.surface, [])
+}
+
+/**
+ * The lift's row pitch is read off the scale as drawn, and a pinch moves that scale with no fit
+ * to report it. A write mid-gesture emits the transient pitch; the release must replace it.
+ */
+describe('keyboard-avoidance metrics across a pinch', () => {
+  it('reports the at-rest pitch after a pinch that releases onto the same preset', async () => {
+    const doc = startMeasuredDocument()
+    await settle()
+    const atRest = metricsOf(doc.posted).at(-1)?.rowPitch
+    expect(atRest).toBeGreaterThan(0)
+
+    pinchTo(doc, 21)
+    await settle()
+
+    const metrics = metricsOf(doc.posted)
+    expect(metrics.at(-1)?.rowPitch).toBe(atRest)
+    doc.started.stop()
+  })
+
+  it('reports a release that changes the preset once, through the refit', async () => {
+    const doc = startMeasuredDocument()
+    await settle()
+    const before = metricsOf(doc.posted).length
+
+    pinchTo(doc, 30)
+    const afterWrite = metricsOf(doc.posted).length
+    await settle()
+
+    expect(afterWrite).toBe(before + 1)
+    expect(metricsOf(doc.posted).length).toBe(afterWrite + 1)
+    doc.started.stop()
+  })
+
+  it('never reports the pre-refit pitch when a release lands while a refit is pending', async () => {
+    const doc = startMeasuredDocument()
+    await settle()
+    const before = metricsOf(doc.posted).length
+
+    // The settings change sets the new font now and refits a frame later; the pinch releases
+    // onto that same preset in between.
+    doc.started.send({ type: 'set-font-scale', fontScale: 1.5 })
+    pinchTo(doc, 20, false)
+    await settle()
+
+    const reported = metricsOf(doc.posted).slice(before)
+    expect(reported.map((message) => message.rowPitch)).toEqual([reported.at(-1)?.rowPitch])
+    expect(reported.at(-1)?.rowPitch).toBeGreaterThan(20)
+    doc.started.stop()
+  })
+})
diff --git a/mobile/src/terminal/document/document-host-seams.ts b/mobile/src/terminal/document/document-host-seams.ts
index ec10e313d43..1afaac6c1a1 100644
--- a/mobile/src/terminal/document/document-host-seams.ts
+++ b/mobile/src/terminal/document/document-host-seams.ts
@@ -26,8 +26,13 @@ export type TerminalDocumentViewportRect = {
   top: number
   width: number
   height: number
+  /** The host is `display:none` and the size is the last one it had; a fit waits for it to show. */
+  hidden?: boolean
 }
 
+/** What the host reports: a new box, or the same box back from being hidden. */
+export type TerminalViewportChange = 'resized' | 'shown'
+
 /** The document's runtime error reporter, taking the window error handler's own arguments. */
 export type TerminalDocumentErrorReporter = (
   message: string | (Event & { message?: unknown }),
@@ -40,6 +45,9 @@ export type TerminalDocumentErrorReporter = (
 /** A frame from the host, as its transport delivers it: JSON text from a bridge, or the object. */
 export type TerminalDocumentHostFrame = string | Record<string, unknown> | undefined
 
+/** How a document starts, as its view mounted. */
+export type TerminalDocumentStart = { textScale: number; shown: boolean }
+
 /**
  * The ten host seams, kept apart from the state because the host sets them once when it builds
  * the scope, before the start sequence runs, and no module writes them afterwards.
@@ -63,10 +71,16 @@ export type TerminalDocumentHostSeams = {
   installHostTransport: (receive: (frame: TerminalDocumentHostFrame) => void) => () => void
   /** `message-bridge`: whether the engine is here, which is what readiness is reported on. */
   hasEngine: () => boolean
+  /**
+   * How the document starts, as its view mounted: the app's text scale, which the terminal built
+   * before ready lays out at, and whether it was shown. Only a shown document builds before ready;
+   * every terminal is a WebGL context, and a page or app holds about sixteen.
+   */
+  start: () => TerminalDocumentStart
   /** Every fit, pan, scroll and overlay bound, and every client point mapped into the grid. */
   viewportRect: () => TerminalDocumentViewportRect
-  /** `fit-scale`: calls back when that box changes size, handing back its removal. */
-  observeViewport: (onChange: () => void) => () => void
+  /** `fit-scale`: calls back when that box changes size or is shown again, handing back its removal. */
+  observeViewport: (onChange: (change: TerminalViewportChange) => void) => () => void
   /**
    * Where this document's elements are: the node its markup was planted in, or null for the page
    * the document is running in.
@@ -120,6 +134,12 @@ declare global {
      * quotes it. The document reaches it through a seam, so a page's mount holds its own instead.
      */
     __engineErrors?: string[]
+    /**
+     * The WebView page writes these ahead of the document script: the text scale its view mounted
+     * at, and whether that view was shown then.
+     */
+    __orcaTerminalTextScale?: unknown
+    __orcaTerminalShown?: unknown
   }
   const Terminal: new (options: Record<string, unknown>) => TerminalDocumentTerminal
 }
@@ -213,6 +233,14 @@ export function windowHasEngine() {
   return window.Terminal !== undefined
 }
 
+export function windowStart(): TerminalDocumentStart {
+  const scale = window.__orcaTerminalTextScale
+  return {
+    textScale: typeof scale === 'number' && scale > 0 ? scale : 1,
+    shown: window.__orcaTerminalShown !== false
+  }
+}
+
 /**
  * The WebView's viewport: there the window is the terminal frame. On the page the window is the
  * whole page, taller than the frame by the header and dock, so the page answers with its host.
@@ -222,10 +250,11 @@ export function windowViewportRect(): TerminalDocumentViewportRect {
 }
 
 /** The WebView's frame changes size exactly when its window does. */
-export function observeWindowViewport(onChange: () => void) {
-  window.addEventListener('resize', onChange)
+export function observeWindowViewport(onChange: (change: TerminalViewportChange) => void) {
+  const listener = () => onChange('resized')
+  window.addEventListener('resize', listener)
   return function () {
-    window.removeEventListener('resize', onChange)
+    window.removeEventListener('resize', listener)
   }
 }
 
diff --git a/mobile/src/terminal/document/document-parse-time-effects.test.ts b/mobile/src/terminal/document/document-parse-time-effects.test.ts
index 0acddfb78b3..86b8433ed14 100644
--- a/mobile/src/terminal/document/document-parse-time-effects.test.ts
+++ b/mobile/src/terminal/document/document-parse-time-effects.test.ts
@@ -1,13 +1,9 @@
-import { readFileSync } from 'node:fs'
 import { describe, expect, it } from 'vitest'
 import {
-  DECLARATION_KINDS,
   documentModuleNames,
   documentModuleSource,
   exportedLifecycleFunctions,
-  parseModule,
   parseTimeEffects,
-  readsTheDocument,
   sequenceCalls,
   topLevelDeclarationsReachAnElement
 } from '../../test-support/webview-document-census'
@@ -71,43 +67,6 @@ describe('the document modules at parse time', () => {
     }
   })
 
-  it('would report a planted element read, which the statement filter cannot see', () => {
-    // The second reader has its own precondition. A `const` initialised from the document is a
-    // declaration by shape and a parse-time element read by effect — the exact form that survived
-    // a remount holding the first mount's node — and the statement-kind filter waves it through.
-    const planted =
-      "import { scope } from './document-scope'\n" +
-      "const indicator = document.getElementById('scroll-indicator')\n" +
-      'export function n() {\n  return indicator ?? scope.term\n}\n'
-    expect(parseTimeEffects('planted', planted)).toEqual([
-      "planted: indicator = document.getElementById('scroll-indicator')"
-    ])
-    // And the element reader the case above spends on every module: the same plant, seen by it.
-    expect(topLevelDeclarationsReachAnElement('planted', planted)).toBe(true)
-    // And the other direction, because a reader that flagged every initialiser would agree with
-    // the empty list above only by refusing everything: a plain literal is not work.
-    const inert =
-      "import { scope } from './document-scope'\n" +
-      'const options = { capture: true, passive: false }\n' +
-      'export function n() {\n  return options.capture && scope.term !== null\n}\n'
-    expect(parseTimeEffects('inert', inert)).toEqual([])
-  })
-
-  it('would report one, so the empty list above is a measurement', () => {
-    // The precondition. A walk that matched nothing would agree with an empty expectation just as
-    // happily, so the same reader is aimed at a module that does have a top-level effect: this
-    // test file itself, whose `describe` call is exactly the shape the rule refuses.
-    const source = readFileSync(
-      new URL('./document-parse-time-effects.test.ts', import.meta.url),
-      'utf8'
-    )
-    const running = parseModule('probe', source).body.filter(
-      (statement) => !DECLARATION_KINDS.has(statement.type)
-    )
-    expect(running.length).toBeGreaterThan(0)
-    expect(readsTheDocument({ type: 'Identifier', name: 'document' })).toBe(true)
-  })
-
   it('start and stop: the sequence calls every one there is, and undoes them in reverse', () => {
     // Moving an effect out is only correct if something calls it, and a count cannot say that: a
     // module could export a start nobody runs and the count would agree as soon as the literal
@@ -120,9 +79,6 @@ describe('the document modules at parse time', () => {
       MODULES.filter((name) => name !== THE_SEQUENCE).flatMap((name) =>
         exportedLifecycleFunctions(moduleSource(name), keyword, 'TerminalDocumentScope')
       )
-    expect(moduleSource('selection-overlay')).toContain(
-      'export function stopSelectionOverlay(scope: TerminalDocumentScope) {\n  stopEdgeScroll(scope)'
-    )
 
     const started = sequenceCallsTo('startTerminalDocument')
     // `cancelDocumentFrames` is the frame registry's undo rather than a module's stop, and it is
@@ -145,12 +101,4 @@ describe('the document modules at parse time', () => {
     )
     expect(sequenceCallsTo('stopTerminalDocument').at(-1)).toBe('cancelDocumentFrames')
   })
-
-  it('would name a start the sequence forgot, which is what the comparison above is for', () => {
-    // The precondition, planted rather than argued: a module that exports a start nobody calls is
-    // the failure the set comparison exists to catch, and the reader has to say its name.
-    const planted = sequenceCallsTo('startTerminalDocument')
-    expect(planted).not.toContain('startReflow')
-    expect([...planted, 'startReflow'].sort()).not.toEqual(planted.slice().sort())
-  })
 })
diff --git a/mobile/src/terminal/document/document-scope.ts b/mobile/src/terminal/document/document-scope.ts
index 9be374b2b27..0095a3275ce 100644
--- a/mobile/src/terminal/document/document-scope.ts
+++ b/mobile/src/terminal/document/document-scope.ts
@@ -1,3 +1,4 @@
+import type { TerminalLaidOutCellBox } from '../terminal-cell-box'
 import { DEFAULT_TERMINAL_THEME } from '../terminal-webview-html/theme'
 import {
   createEngineTerminal,
@@ -9,6 +10,7 @@ import {
   postToReactNativeWebView,
   windowCapturedEngineErrors,
   windowHasEngine,
+  windowStart,
   observeWindowViewport,
   windowViewportRect,
   type TerminalDocumentHost,
@@ -94,6 +96,8 @@ export type TerminalDocumentState = {
   terminalFontFamily: string
   /** `terminal-init`: whether the first live chunk since init is still pending. */
   firstDataPending: boolean
+  /** `laid-out-cell-box`: the box last reported or at ready, with the grid it was laid out at. */
+  reportedCellBox: TerminalLaidOutCellBox | null
   /** `terminal-init`: whether the replayed snapshot was an alternate screen. */
   activeAltScreenSnapshot: boolean
   /** `fit-scale`: the fit scale the document committed. */
@@ -156,6 +160,8 @@ export type TerminalDocumentState = {
   pendingTerm: TerminalDocumentTerminal | null
   /** `surface-swap`: the terminal the committed surface is showing. */
   committedTerm: TerminalDocumentTerminal | null
+  /** `terminal-init`: the terminal built before ready, until the first init reuses it. */
+  provisionalTerm: TerminalDocumentTerminal | null
   /** `surface-swap`: the surface the committed terminal is mounted on. */
   committedSurface: HTMLElement | null
   /** `surface-swap`: the hidden replacement surface, until it commits. */
@@ -181,8 +187,10 @@ export type TerminalDocumentState = {
   removeWebglRecovery: (() => void) | null
   /** `fit-scale`: the generation of the retry loop; a bump abandons the one in flight. */
   fitRetryToken: number
-  /** `fit-scale`: the viewport box the last fit was committed for, or null before one. */
-  fittedBox: { width: number; height: number } | null
+  /** `host-message-router`: the terminal frame the app last sent with a grid, or null before one. */
+  hostFrame: { width: number; height: number } | null
+  /** `fit-scale`: the reason of a fit held while the host is hidden, or null when none is owed. */
+  fitPending: string | null
   /** `mouse-click-drag`: the mouse gesture in progress, or null. */
   mouseGesture: TerminalMouseGesture | null
   /** `tap-dispatch`: what the document-level dispatcher has latched onto. */
@@ -263,6 +271,7 @@ function createTerminalDocumentState(): TerminalDocumentState {
     currentTextScale: 1,
     terminalFontFamily: '',
     firstDataPending: false,
+    reportedCellBox: null,
     activeAltScreenSnapshot: false,
     currentScale: 1,
     userScale: 1,
@@ -295,6 +304,7 @@ function createTerminalDocumentState(): TerminalDocumentState {
     surface: null,
     pendingTerm: null,
     committedTerm: null,
+    provisionalTerm: null,
     committedSurface: null,
     pendingSurface: null,
     scrollIndicator: null,
@@ -308,7 +318,8 @@ function createTerminalDocumentState(): TerminalDocumentState {
     removeTapDispatch: null,
     removeWebglRecovery: null,
     fitRetryToken: 0,
-    fittedBox: null,
+    hostFrame: null,
+    fitPending: null,
     mouseGesture: null,
     touchDispatch: {
       mode: 'idle',
@@ -346,6 +357,7 @@ function createTerminalDocumentHostSeams(): TerminalDocumentHostSeams {
     paintDocumentBackground: paintWindowDocumentBackground,
     installHostTransport: installWindowHostTransport,
     hasEngine: windowHasEngine,
+    start: windowStart,
     viewportRect: windowViewportRect,
     observeViewport: observeWindowViewport,
     root: null
diff --git a/mobile/src/terminal/document/document-terminal-shape.ts b/mobile/src/terminal/document/document-terminal-shape.ts
index 15cccfda35b..b5807efdf7f 100644
--- a/mobile/src/terminal/document/document-terminal-shape.ts
+++ b/mobile/src/terminal/document/document-terminal-shape.ts
@@ -102,6 +102,7 @@ export type TerminalDocumentTerminal = {
   onLineFeed?: (listener: () => void) => TerminalDocumentDisposable
   onScroll?: (listener: () => void) => TerminalDocumentDisposable
   onWriteParsed?: (listener: () => void) => TerminalDocumentDisposable
+  onRender?: (listener: () => void) => TerminalDocumentDisposable
   resize: (cols: number, rows: number) => void
   refresh: (start: number, end: number) => void
   dispose: () => void
diff --git a/mobile/src/terminal/document/fit-scale.ts b/mobile/src/terminal/document/fit-scale.ts
index 20aa1c1ee49..8047b9f630c 100644
--- a/mobile/src/terminal/document/fit-scale.ts
+++ b/mobile/src/terminal/document/fit-scale.ts
@@ -3,24 +3,17 @@ import {
   computeFitScale,
   flog,
   getCellWidth,
+  getMeasuredCellHeight,
   getTotalScale,
   updateTransform
 } from './viewport-transform'
 import type { TerminalDocumentScope } from './document-scope'
+import type { TerminalViewportChange } from './document-host-seams'
 import { scheduleDocumentFrame } from './document-frame-registry'
-
-/** The narrowest grid a fit or a text-scale change will fit to. */
-export const MIN_FIT_COLS = 20
+import { emitKeyboardAvoidanceMetrics } from './keyboard-avoidance-metrics'
 
 export function getCellHeight(scope: TerminalDocumentScope) {
-  if (!scope.term || !scope.term._core) {
-    return 15
-  }
-  const core = scope.term._core
-  if (core._renderService && core._renderService.dimensions) {
-    return core._renderService.dimensions.css.cell.height || 15
-  }
-  return 15
+  return getMeasuredCellHeight(scope) || 15
 }
 
 // Why: clamp pan so the terminal content always covers the viewport
@@ -65,23 +58,15 @@ export function adjustRowsForViewport() {}
 // so a backgrounded WebView never spins forever.
 const FIT_RETRY_MAX_FRAMES = 60
 
-function isFittedBox(scope: TerminalDocumentScope) {
-  const { width, height } = scope.viewportRect()
-  const fitted = scope.fittedBox
-  return fitted !== null && fitted.width === width && fitted.height === height
-}
-
-function hasViewportWidth(scope: TerminalDocumentScope) {
-  const width = scope.viewportRect().width
-  return Number.isFinite(width) && width > 0
+function isViewportShown(scope: TerminalDocumentScope) {
+  const { width, hidden } = scope.viewportRect()
+  return hidden !== true && Number.isFinite(width) && width > 0
 }
 
 export function applyFitScale(scope: TerminalDocumentScope, reason: string) {
   if (!scope.term || !scope.term.element) {
     return
   }
-  // Why: a fit asked for while hidden is dropped until a box arrives, and that box may be the old one.
-  scope.fittedBox = null
   const token = ++scope.fitRetryToken
   let attempts = 0
   let lastScrollWidth = -1
@@ -92,8 +77,9 @@ export function applyFitScale(scope: TerminalDocumentScope, reason: string) {
     if (!scope.term || !scope.term.element) {
       return
     }
-    // Why: a display:none host measures 0 wide; the fit stays pending until observeViewport reports a box.
-    if (!hasViewportWidth(scope)) {
+    // Why: a hidden grid may not measure its cells, so the fit is held until the host is shown.
+    if (!isViewportShown(scope)) {
+      scope.fitPending = reason
       return
     }
     attempts++
@@ -134,8 +120,7 @@ export function commitFitScale(
     return
   }
   const preSnapScale = computeFitScale(scope)
-  const { width, height } = scope.viewportRect()
-  scope.fittedBox = { width, height }
+  scope.fitPending = null
   scope.currentScale = preSnapScale
   // Why: when scale is very close to 1 (e.g. 0.97 from xterm scrollbar
   // sub-pixels) snap to 1 to avoid imperceptible shrinkage that prevents
@@ -170,6 +155,8 @@ export function commitFitScale(
     })
   }
   repositionOverlay(scope)
+  // The host's lift reads the drawn row pitch, which a new scale changes with no new output.
+  emitKeyboardAvoidanceMetrics(scope)
 }
 
 /**
@@ -181,10 +168,12 @@ export function commitFitScale(
  * had to copy the five calls into its mount to get it at all (ruling 24).
  */
 export function startFitScale(scope: TerminalDocumentScope) {
-  const refit = () => {
-    // Why: a hidden screen reports 0x0 and then its old box again; native never refits on that, so
-    // only a box other than the one last fitted refits, and the user's pan and zoom survive.
-    if (!hasViewportWidth(scope) || isFittedBox(scope)) {
+  const refit = (change: TerminalViewportChange) => {
+    // Why: showing the same box again is not a resize; only a fit held while hidden runs, so pan and zoom survive.
+    if (change === 'shown') {
+      if (scope.fitPending !== null) {
+        applyFitScale(scope, scope.fitPending)
+      }
       return
     }
     applyFitScale(scope, 'window-resize')
diff --git a/mobile/src/terminal/document/host-message-router.ts b/mobile/src/terminal/document/host-message-router.ts
index 8c63c715b17..0b155e1b70c 100644
--- a/mobile/src/terminal/document/host-message-router.ts
+++ b/mobile/src/terminal/document/host-message-router.ts
@@ -1,6 +1,5 @@
 import type { TerminalDocumentScope } from './document-scope'
-import { scheduleDocumentFrame } from './document-frame-registry'
-import { applyFitScale, MIN_FIT_COLS } from './fit-scale'
+import { applyFitScale } from './fit-scale'
 import { notify } from './host-notify'
 import { emitKeyboardAvoidanceMetrics } from './keyboard-avoidance-metrics'
 import { emitModesIfChanged } from './mode-mirroring'
@@ -12,7 +11,6 @@ import { resetEvictionCounter } from './selection-state-and-eviction'
 import { applyTerminalTheme } from './terminal-theme'
 import { init, resize, write } from './terminal-init'
 import { applyTextScale } from './text-scaling'
-import { flog } from './viewport-transform'
 import { resetWriteQueue } from './write-queue'
 
 /** One message from the host. Every field is optional because the router reads them by type. */
@@ -27,83 +25,20 @@ export type TerminalHostMessage = {
   preserveScroll?: boolean
   oscLinks?: unknown
   data?: string
-  containerHeight?: number
+  frame?: { width: number; height: number } | null
 }
 
-export function measureFitDimensions(
-  scope: TerminalDocumentScope,
-  containerHeightPx: unknown,
-  retriesLeft?: number
-) {
-  if (typeof retriesLeft !== 'number') {
-    retriesLeft = 30
-  }
-  // Why: init and measure are posted back-to-back from React, but
-  // init has an async rAF chain. A measure that runs synchronously
-  // after init can find term null, disposed, lacking element, or
-  // with cells size 0. Retry the whole gate for ~500ms.
-  const notReady = !scope.term || !scope.term.element
-  let cellWidth = 0
-  let cellHeight = 0
-  if (!notReady) {
-    const core = scope.term!._core
-    if (core && core._renderService && core._renderService.dimensions) {
-      cellWidth = core._renderService.dimensions.css.cell.width
-      cellHeight = core._renderService.dimensions.css.cell.height
-    }
-  }
-  if (notReady || cellWidth <= 0 || cellHeight <= 0) {
-    if (retriesLeft > 0) {
-      // Ruling 21: a retry that outlives its mount would answer the next mount's measure.
-      const gen = scope.terminalGeneration
-      scheduleDocumentFrame(scope, function () {
-        if (gen !== scope.terminalGeneration) {
-          return
-        }
-        measureFitDimensions(scope, containerHeightPx, retriesLeft - 1)
-      })
-      return
-    }
-    flog(scope, 'measure-fail', {
-      notReady: notReady,
-      cellWidth: cellWidth,
-      cellHeight: cellHeight,
-      retriesLeft: retriesLeft
-    })
-    notify(scope, { type: 'measure-result', cols: null, rows: null })
-    return
-  }
-  const viewport = scope.viewportRect()
-  const vpWidth = viewport.width
-  // Why: prefer the container height passed from React Native over the
-  // viewport's. The RN layout system knows the exact pixel height of the
-  // terminal frame after the accessory/input bars are subtracted, whereas
-  // the viewport can overstate the visible area due to layout timing or
-  // safe-area insets.
-  const vpHeight =
-    typeof containerHeightPx === 'number' && containerHeightPx > 0
-      ? containerHeightPx
-      : viewport.height
-  const cols = Math.floor(vpWidth / cellWidth)
-  if (cols < MIN_FIT_COLS) {
-    flog(scope, 'measure-skip-small-width', {
-      vpWidth: vpWidth,
-      cellWidth: cellWidth,
-      cols: cols
-    })
-    notify(scope, { type: 'measure-result', cols: null, rows: null })
-    return
-  }
-  // Why: the rows we report become the PTY's actual row count after the
-  // server fits to viewport, and xterm renders exactly that many lines
-  // anchored top-left of the WebView. Subtracting rows here would leave
-  // dead xterm-background space at the bottom of the container and make
-  // the last PTY rows visually appear above an "invisible line." Any
-  // safety margin between the prompt and the accessory bar must come
-  // from RN layout (terminalFrame's flex bounds), not from undersizing
-  // the PTY.
-  const rows = Math.max(8, Math.floor(vpHeight / cellHeight))
-  notify(scope, { type: 'measure-result', cols: cols, rows: rows })
+/** The frame React Native laid out, sent with every grid; null when absent or without a size. */
+function hostFrameOf(msg: TerminalHostMessage) {
+  const frame = msg.frame
+  return frame && frame.width > 0 && frame.height > 0
+    ? { width: frame.width, height: frame.height }
+    : null
+}
+
+/** Keeps the frame a grid was fitted to, for a later text-scale change to fit. */
+function holdHostFrame(scope: TerminalDocumentScope, msg: TerminalHostMessage) {
+  scope.hostFrame = hostFrameOf(msg) ?? scope.hostFrame
 }
 
 export function handleMsg(scope: TerminalDocumentScope, msg: TerminalHostMessage) {
@@ -120,6 +55,7 @@ export function handleMsg(scope: TerminalDocumentScope, msg: TerminalHostMessage
   if (msg.type === 'ping') {
     notify(scope, { type: 'pong', pingId: msg.id })
   } else if (msg.type === 'init') {
+    holdHostFrame(scope, msg)
     init(
       scope,
       msg.cols!,
@@ -144,8 +80,10 @@ export function handleMsg(scope: TerminalDocumentScope, msg: TerminalHostMessage
       applyTextScale(scope, msg.fontScale)
     }
   } else if (msg.type === 'resize') {
+    holdHostFrame(scope, msg)
     resize(scope, msg.cols!, msg.rows!)
   } else if (msg.type === 'reflow') {
+    holdHostFrame(scope, msg)
     reflow(scope, msg.cols!, msg.rows!)
   } else if (msg.type === 'write') {
     write(scope, msg.data!)
@@ -174,8 +112,6 @@ export function handleMsg(scope: TerminalDocumentScope, msg: TerminalHostMessage
       notify(scope, { type: 'selection-evicted' })
       cancelSelect(scope)
     }
-  } else if (msg.type === 'measure') {
-    measureFitDimensions(scope, msg.containerHeight)
   } else if (msg.type === 'reset-zoom') {
     applyFitScale(scope, 'reset-zoom-msg')
   } else if (msg.type === 'set-theme') {
diff --git a/mobile/src/terminal/document/host-seams.test.ts b/mobile/src/terminal/document/host-seams.test.ts
index 0991f4bb9b1..c000062acf0 100644
--- a/mobile/src/terminal/document/host-seams.test.ts
+++ b/mobile/src/terminal/document/host-seams.test.ts
@@ -6,8 +6,7 @@ import { handleMsg } from './host-message-router'
 import { notify } from './host-notify'
 import { flog } from './viewport-transform'
 import { attachWebglAddon } from './webgl-recovery'
-import type { TerminalDocumentHost } from './document-host-seams'
-import { documentSourceText } from './document-module-source.test-support'
+import type { TerminalDocumentHost, TerminalViewportChange } from './document-host-seams'
 
 /**
  * The host seams the page sets, and the window reads and writes they default to.
@@ -205,24 +204,22 @@ describe('the document host seams, by default', () => {
 })
 
 describe('the document host seams, once the page sets them', () => {
-  it('fits a measure with no container height to the host rather than the window', () => {
-    // The page's host is one element on a page that is taller and wider than it; the window is
-    // happy-dom's 1024x768, so a fit read off the window would answer 136x51.
-    const cell = { width: 7.5, height: 15 }
-    const terminal = Object.assign(terminalDouble(), {
-      _core: { _renderService: { dimensions: { css: { cell } } } }
-    })
-    const posted: Record<string, unknown>[] = []
+  it('keeps the frame React Native laid out from each grid, not the viewport CSS rounded', () => {
+    // 1080 device px at a 2.75 pixel ratio: React Native lays the frame out at 392.73 and the
+    // document's viewport reads 393. A grid without a whole frame leaves the last one in place.
+    const frame = { width: 1080 / 2.75, height: 600 }
     const scope = startedScope({
-      createTerminal: () => terminal,
-      postToHost: (message) => posted.push(message),
-      viewportRect: () => ({ left: 0, top: 82, width: 390, height: 600 })
+      createTerminal: () => terminalDouble(),
+      viewportRect: () => ({ left: 0, top: 0, width: 393, height: 600 })
     })
     handleMsg(scope, { type: 'init', cols: 80, rows: 24, initialData: '', preserveScroll: false })
-    handleMsg(scope, { type: 'measure' })
-    expect(posted.filter((message) => message.type === 'measure-result')).toEqual([
-      { type: 'measure-result', cols: 52, rows: 40 }
-    ])
+    expect(scope.hostFrame).toBeNull()
+    handleMsg(scope, { type: 'resize', cols: 50, rows: 40, frame: { width: 390, height: 0 } })
+    expect(scope.hostFrame).toBeNull()
+    handleMsg(scope, { type: 'resize', cols: 50, rows: 40, frame })
+    expect(scope.hostFrame).toEqual(frame)
+    handleMsg(scope, { type: 'reflow', cols: 50, rows: 40 })
+    expect(scope.hostFrame).toEqual(frame)
   })
 
   it('routes every notify to the field and nothing to the bridge', () => {
@@ -232,7 +229,7 @@ describe('the document host seams, once the page sets them', () => {
     const scope = startedScope({ postToHost: (message) => posted.push(message) })
     // The sequence's own `web-ready` is the document reporting itself started; what this case reads
     // is what the two notify paths send afterwards.
-    expect(posted).toEqual([{ type: 'web-ready' }])
+    expect(posted).toEqual([expect.objectContaining({ type: 'web-ready' })])
     posted.length = 0
     notify(scope, { type: 'pong', pingId: 7 })
     flog(scope, 'probe', { n: 1 })
@@ -299,7 +296,7 @@ describe('the document host seams, once the page sets them', () => {
 
 describe("the document's viewport", () => {
   it('refits when the host says its box changed, and not on a window resize it does not own', () => {
-    const changes: (() => void)[] = []
+    const changes: ((change: TerminalViewportChange) => void)[] = []
     const scope = startedScope({
       createTerminal: () => terminalDouble(),
       observeViewport: (onChange) => {
@@ -312,7 +309,10 @@ describe("the document's viewport", () => {
     window.dispatchEvent(new Event('resize'))
     expect(scope.panX).toBe(50)
     expect(changes).toHaveLength(1)
-    changes[0]!()
+    // The same box shown again with no fit held is not a resize: the pan stays.
+    changes[0]!('shown')
+    expect(scope.panX).toBe(50)
+    changes[0]!('resized')
     expect(scope.panX).toBe(0)
   })
 
@@ -323,38 +323,4 @@ describe("the document's viewport", () => {
     window.dispatchEvent(new Event('resize'))
     expect(scope.panX).toBe(0)
   })
-
-  it('is read through the seam everywhere, never off the window directly', () => {
-    // The default in `document-host-seams.ts` is the one window read, so the census runs over
-    // every other module; a raw read elsewhere sizes a page terminal to the whole page.
-    const raw = documentSourceText()
-      .split('\n')
-      .filter((line) => /window\.inner(Height|Width)|\binner(Height|Width)\b/.test(line))
-    expect(raw).toEqual([
-      '  return { left: 0, top: 0, width: window.innerWidth, height: window.innerHeight }'
-    ])
-  })
-
-  it('maps a client point into the grid only through viewportPoint', () => {
-    // On the page the host's origin is not the window's, so a client coordinate used against
-    // anything but another client coordinate lands rows low. Differences of two need no origin.
-    const arithmetic = documentSourceText()
-      .split('\n')
-      .filter((line) => !/^\s*(\*|\/\/)/.test(line))
-      .filter((line) => /client[XY]\s*[-+*/<>]|[-+*/<>]=?\s*[\w.[\]]*client[XY]\b/.test(line))
-      .map((line) => line.trim())
-      .sort()
-    expect(arithmetic).toEqual([
-      'const dx = Math.abs(e.clientX - gesture.startX)',
-      'const dx = Math.abs(mt.clientX - scope.tapCandidate.x)',
-      'const dx = Math.abs(t.clientX - scope.longPressOrigin.x)',
-      'const dx = a.clientX - b.clientX,',
-      'const dy = Math.abs(e.clientY - gesture.startY)',
-      'const dy = Math.abs(mt.clientY - scope.tapCandidate.y)',
-      'const dy = Math.abs(t.clientY - scope.longPressOrigin.y)',
-      'dy = a.clientY - b.clientY',
-      'return viewportPoint(scope, (a.clientX + b.clientX) / 2, (a.clientY + b.clientY) / 2)',
-      'return { x: clientX - frame.left, y: clientY - frame.top }'
-    ])
-  })
 })
diff --git a/mobile/src/terminal/document/keyboard-avoidance-metrics.ts b/mobile/src/terminal/document/keyboard-avoidance-metrics.ts
index 516dfdb1b2a..a0f28d801c1 100644
--- a/mobile/src/terminal/document/keyboard-avoidance-metrics.ts
+++ b/mobile/src/terminal/document/keyboard-avoidance-metrics.ts
@@ -1,3 +1,4 @@
+import { getMeasuredCellHeight, getTotalScale } from './viewport-transform'
 import { notify } from './host-notify'
 import type {
   TerminalDocumentCell,
@@ -70,6 +71,8 @@ export function emitKeyboardAvoidanceMetrics(scope: TerminalDocumentScope) {
     cursorY: scope.term.buffer && scope.term.buffer.active ? scope.term.buffer.active.cursorY : 0,
     contentBottomRow: alt ? 0 : computeContentBottomRow(scope),
     rows: scope.term.rows || 0,
-    altScreen: alt
+    altScreen: alt,
+    // As drawn: desktop display mode scales the desktop's rows down to the phone's width.
+    rowPitch: getMeasuredCellHeight(scope) * getTotalScale(scope)
   })
 }
diff --git a/mobile/src/terminal/document/laid-out-cell-box.test.ts b/mobile/src/terminal/document/laid-out-cell-box.test.ts
new file mode 100644
index 00000000000..5a8ed7453a0
--- /dev/null
+++ b/mobile/src/terminal/document/laid-out-cell-box.test.ts
@@ -0,0 +1,343 @@
+// @vitest-environment happy-dom
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { laidOutCellBox, reportLaidOutCellBox } from './laid-out-cell-box'
+import { createTerminalDocumentScope, type TerminalDocumentScope } from './document-scope'
+import { startTerminalDocument, stopTerminalDocument } from './create-terminal-document'
+import type { TerminalDocumentHost } from './document-host-seams'
+import { fontPxForScale } from './text-scaling'
+import { terminalDocumentDouble } from './document-terminal-double.test-support'
+import { handleMsg } from './host-message-router'
+import { TERMINAL_DOCUMENT_MARKUP } from '../terminal-webview-html/document-markup'
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+  document.body.innerHTML = ''
+})
+
+describe('laidOutCellBox', () => {
+  function scopeWithCell(
+    cell: { width: number; height: number },
+    fontSize: number,
+    posted: Record<string, unknown>[] = []
+  ) {
+    const scope = createTerminalDocumentScope({ postToHost: (message) => posted.push(message) })
+    scope.currentTextScale = 1.25
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the reader touches only cols, rows, options.fontSize and _core's render dimensions.
+    scope.term = {
+      cols: 55,
+      rows: 47,
+      options: { fontSize },
+      _core: { _renderService: { dimensions: { css: { cell } } } }
+    } as unknown as typeof scope.term
+    return scope
+  }
+
+  it('reads the box xterm laid out at the current text scale, with its grid', () => {
+    const scope = scopeWithCell({ width: 29 / 3, height: 21 }, fontPxForScale(1.25))
+    expect(laidOutCellBox(scope)).toEqual({
+      cellBox: { fontScale: 1.25, cellWidth: 29 / 3, cellHeight: 21 },
+      cols: 55,
+      rows: 47
+    })
+  })
+
+  it('tells the host each new box once, and refits only a box that changed at a kept grid', () => {
+    const posted: Record<string, unknown>[] = []
+    const cell = { width: 29 / 3, height: 21 }
+    const scope = scopeWithCell(cell, fontPxForScale(1.25), posted)
+    reportLaidOutCellBox(scope)
+    reportLaidOutCellBox(scope)
+    // A new grid with the same box tells the host nothing; the document holds that grid.
+    Object.assign(scope.term!, { cols: 50 })
+    reportLaidOutCellBox(scope)
+    cell.width = 9.75
+    reportLaidOutCellBox(scope)
+    expect(posted).toEqual([
+      {
+        type: 'cell-box',
+        cellBox: { fontScale: 1.25, cellWidth: 29 / 3, cellHeight: 21 },
+        refit: false
+      },
+      {
+        type: 'cell-box',
+        cellBox: { fontScale: 1.25, cellWidth: 9.75, cellHeight: 21 },
+        refit: true
+      }
+    ])
+  })
+})
+
+describe('a started document', () => {
+  /** A document whose engine builds grids with a cell that follows the font, and every notify. */
+  function started(host: TerminalDocumentHost = {}) {
+    document.body.innerHTML = TERMINAL_DOCUMENT_MARKUP
+    const cell = { width: 23 / 3, height: 15 }
+    const renderListeners: (() => void)[] = []
+    const built: { options: Record<string, unknown> }[] = []
+    const createTerminal = (options: Record<string, unknown>) => {
+      const terminal = terminalDocumentDouble().terminal
+      const grid = Object.assign(terminal, {
+        cols: Number(options.cols),
+        rows: Number(options.rows),
+        options: { ...terminal.options, fontSize: Number(options.fontSize) },
+        _core: {
+          _renderService: {
+            get dimensions() {
+              const k = grid.options.fontSize / 13
+              return { css: { cell: { width: cell.width * k, height: cell.height * k } } }
+            }
+          }
+        },
+        onRender: (listener: () => void) => {
+          renderListeners.push(listener)
+          return { dispose() {} }
+        }
+      })
+      grid.resize = (cols: number, rows: number) => {
+        grid.cols = cols
+        grid.rows = rows
+      }
+      built.push({ options })
+      return grid
+    }
+    const posted: Record<string, unknown>[] = []
+    const scope = createTerminalDocumentScope({
+      installHostTransport: () => () => {},
+      hasEngine: () => true,
+      createTerminal,
+      postToHost: (message) => posted.push(message),
+      ...host
+    })
+    startTerminalDocument(scope)
+    const render = () => renderListeners.forEach((listener) => listener())
+    const init = () =>
+      handleMsg(scope, { type: 'init', cols: 55, rows: 47, initialData: '', preserveScroll: false })
+    return { scope, cell, posted, render, built, init }
+  }
+
+  const nextFrame = () => new Promise<void>((resolve) => requestAnimationFrame(() => resolve()))
+  async function untilReady(posted: Record<string, unknown>[]) {
+    for (let frame = 0; frame < 30 && !posted.some((m) => m.type === 'ready'); frame++) {
+      await nextFrame()
+    }
+  }
+  const boxes = (posted: Record<string, unknown>[]) =>
+    posted.filter((m) => m.type === 'cell-box').map((m) => m.cellBox)
+  const refits = (posted: Record<string, unknown>[]) =>
+    posted.filter((m) => m.type === 'cell-box').map((m) => m.refit)
+  const reflowTo = (scope: TerminalDocumentScope, cols: number) =>
+    handleMsg(scope, { type: 'reflow', cols, rows: 47 })
+
+  it('takes the frame the app laid out from init, resize and reflow', () => {
+    const { scope } = started()
+    try {
+      handleMsg(scope, {
+        type: 'init',
+        cols: 55,
+        rows: 47,
+        initialData: '',
+        preserveScroll: false,
+        frame: { width: 427.5, height: 710 }
+      })
+      expect(scope.hostFrame).toEqual({ width: 427.5, height: 710 })
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('reports ready with the box its own terminal laid out, at the app text scale', () => {
+    const { scope, posted, built } = started({ start: () => ({ textScale: 1.25, shown: true }) })
+    try {
+      expect(built).toHaveLength(1)
+      expect(built[0].options.fontSize).toBe(fontPxForScale(1.25))
+      expect(posted[0]).toEqual({
+        type: 'web-ready',
+        cellBox: { fontScale: 1.25, cellWidth: (23 / 3) * (16 / 13), cellHeight: 15 * (16 / 13) }
+      })
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('leaves no live terminal when opening the one it builds before ready throws', () => {
+    const double = terminalDocumentDouble()
+    double.terminal.open = () => {
+      throw new Error('no surface')
+    }
+    const { scope, posted } = started({ createTerminal: () => double.terminal })
+    try {
+      expect(scope.term).toBeNull()
+      expect(double.disposals()).toBe(1)
+      expect(posted[0]).toEqual({ type: 'web-ready', cellBox: null })
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('builds nothing before ready for a view hidden when it mounted, and reports no box', () => {
+    const { scope, posted, built } = started({ start: () => ({ textScale: 1, shown: false }) })
+    try {
+      expect(built).toHaveLength(0)
+      expect(posted[0]).toEqual({ type: 'web-ready', cellBox: null })
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('reuses that terminal for the first init, so an open builds one xterm', async () => {
+    const { scope, posted, built, init } = started()
+    try {
+      const prepared = scope.term
+      init()
+      await untilReady(posted)
+      expect(built).toHaveLength(1)
+      expect(scope.term).toBe(prepared)
+      expect(scope.term?.cols).toBe(55)
+      expect(scope.term?.rows).toBe(47)
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('keeps the terminal built before ready out of sight until the first init has replayed', async () => {
+    const { scope, posted, init } = started()
+    try {
+      // Hidden, not removed from layout: the box is measured and reported while it is out of sight.
+      expect(scope.surface?.style.visibility).toBe('hidden')
+      expect(scope.surface?.style.display).toBe('')
+      expect(posted[0]).toEqual({
+        type: 'web-ready',
+        cellBox: { fontScale: 1, cellWidth: 23 / 3, cellHeight: 15 }
+      })
+      init()
+      expect(scope.surface?.style.visibility).toBe('hidden')
+      await untilReady(posted)
+      expect(scope.surface?.style.visibility).toBe('')
+      // The box is the ready's own at the init's grid, which the app already holds.
+      expect(posted.filter((message) => message.type === 'cell-box')).toEqual([])
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('reports a paused renderer at ready, before ready itself', async () => {
+    const { scope, cell, posted, init } = started()
+    try {
+      // The DOM renderer's box at the init's grid, which the paused renderer has not drawn yet.
+      cell.width = 7.8
+      init()
+      await untilReady(posted)
+      const types = posted.map((m) => m.type)
+      expect(types.indexOf('cell-box')).toBeGreaterThan(-1)
+      expect(types.indexOf('cell-box')).toBeLessThan(types.indexOf('ready'))
+      expect(boxes(posted)).toEqual([{ fontScale: 1, cellWidth: 7.8, cellHeight: 15 }])
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('reports a text-size change on the render after it, not when the font is set', async () => {
+    // xterm updates the render service's cell box synchronously when fontSize is set
+    // (CharSizeService.measure → RenderService.handleCharSizeChanged), and onRender fires after the
+    // rows it redrew, so the next render reads the new box at the new scale.
+    const { scope, posted, render, init } = started()
+    try {
+      init()
+      await untilReady(posted)
+      const reported = boxes(posted).length
+      handleMsg(scope, { type: 'set-font-scale', fontScale: 1.25 })
+      expect(boxes(posted)).toHaveLength(reported)
+      render()
+      expect(boxes(posted).at(-1)).toEqual({
+        fontScale: 1.25,
+        cellWidth: (23 / 3) * (16 / 13),
+        cellHeight: 15 * (16 / 13)
+      })
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('reports a renderer swap after context loss on the next render', async () => {
+    const { scope, cell, posted, render, init } = started()
+    try {
+      init()
+      await untilReady(posted)
+      cell.width = 7.8
+      render()
+      expect(boxes(posted).at(-1)).toEqual({ fontScale: 1, cellWidth: 7.8, cellHeight: 15 })
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it("refits a DOM first init once, and not again on the refit's own report", async () => {
+    const { scope, cell, posted, render, init } = started()
+    try {
+      // The terminal built before ready laid its box out at 80x24; the DOM renderer's box follows cols.
+      cell.width = 7.8
+      init()
+      await untilReady(posted)
+      expect(refits(posted)).toEqual([true])
+      cell.width = 7.9
+      reflowTo(scope, 54)
+      render()
+      expect(refits(posted)).toEqual([true, false])
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('never refits a box that came with a new grid, so the DOM renderer cannot loop', async () => {
+    const { scope, cell, posted, render, init } = started()
+    try {
+      init()
+      await untilReady(posted)
+      for (const [cols, width] of [
+        [50, 7.9],
+        [55, 7.8],
+        [54, 8]
+      ]) {
+        cell.width = width
+        reflowTo(scope, cols)
+        render()
+      }
+      expect(refits(posted)).toEqual([false, false, false])
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('refits a renderer swap at a grid applied in place', async () => {
+    const { scope, cell, posted, render, init } = started()
+    try {
+      init()
+      await untilReady(posted)
+      // A width change applied in place: the WebGL box is unchanged, so nothing is told.
+      reflowTo(scope, 50)
+      render()
+      expect(refits(posted)).toEqual([])
+      // WebGL context lost: the DOM fallback lays out a new box at the same grid.
+      cell.width = 7.8
+      render()
+      expect(refits(posted)).toEqual([true])
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('refits a re-init at the same grid with a different renderer', async () => {
+    const { scope, cell, posted, init } = started()
+    try {
+      init()
+      await untilReady(posted)
+      posted.length = 0
+      cell.width = 7.8
+      init()
+      await untilReady(posted)
+      expect(refits(posted)).toEqual([true])
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+})
diff --git a/mobile/src/terminal/document/laid-out-cell-box.ts b/mobile/src/terminal/document/laid-out-cell-box.ts
new file mode 100644
index 00000000000..3c6c45fa723
--- /dev/null
+++ b/mobile/src/terminal/document/laid-out-cell-box.ts
@@ -0,0 +1,38 @@
+import { sameCellBox, type TerminalLaidOutCellBox } from '../terminal-cell-box'
+import type { TerminalDocumentScope } from './document-scope'
+import { notify } from './host-notify'
+
+/** The box xterm laid out at the current text scale, with its grid; null before one. */
+export function laidOutCellBox(scope: TerminalDocumentScope): TerminalLaidOutCellBox | null {
+  const term = scope.term
+  const dimensions = term && term._core && term._core._renderService?.dimensions
+  if (!term || !dimensions) {
+    return null
+  }
+  const { width, height } = dimensions.css.cell
+  if (!(width > 0 && height > 0)) {
+    return null
+  }
+  const cellBox = { fontScale: scope.currentTextScale, cellWidth: width, cellHeight: height }
+  return { cellBox, cols: term.cols, rows: term.rows }
+}
+
+/**
+ * Tells the host each box xterm lays out that differs from the last: after init, a renderer swap
+ * on context loss, a text-size or DPR change, or a resize (the DOM renderer's width follows cols).
+ * `refit` is a box that changed while the grid did not, which only a renderer or pixel-ratio
+ * change does; one that arrives with a new grid is that grid's own, so refitting it would loop.
+ */
+export function reportLaidOutCellBox(scope: TerminalDocumentScope) {
+  const laidOut = laidOutCellBox(scope)
+  if (!laidOut) {
+    return
+  }
+  const last = scope.reportedCellBox
+  scope.reportedCellBox = laidOut
+  if (last && sameCellBox(last.cellBox, laidOut.cellBox)) {
+    return
+  }
+  const refit = last !== null && last.cols === laidOut.cols && last.rows === laidOut.rows
+  notify(scope, { type: 'cell-box', cellBox: laidOut.cellBox, refit })
+}
diff --git a/mobile/src/terminal/document/message-bridge.ts b/mobile/src/terminal/document/message-bridge.ts
index b4e21da07b7..f86bec8b743 100644
--- a/mobile/src/terminal/document/message-bridge.ts
+++ b/mobile/src/terminal/document/message-bridge.ts
@@ -1,5 +1,7 @@
 import { handleMsg, type TerminalHostMessage } from './host-message-router'
 import { notify, reportEngineError, type TerminalEngineError } from './host-notify'
+import { laidOutCellBox } from './laid-out-cell-box'
+import { prepareTerminal } from './terminal-init'
 import type { TerminalDocumentScope } from './document-scope'
 import type { TerminalDocumentHostFrame } from './document-host-seams'
 
@@ -45,7 +47,13 @@ export function startMessageBridge(scope: TerminalDocumentScope) {
     handleIncomingMessage(scope, frame)
   )
   if (scope.hasEngine()) {
-    notify(scope, { type: 'web-ready' })
+    // Why: ready carries the cell box xterm itself laid out, so the host sizes the first subscribe.
+    if (scope.start().shown) {
+      prepareTerminal(scope)
+    }
+    // Why: the first init's report is checked against the box the terminal built before ready laid out.
+    scope.reportedCellBox = laidOutCellBox(scope)
+    notify(scope, { type: 'web-ready', cellBox: scope.reportedCellBox?.cellBox ?? null })
   } else {
     reportEngineError(scope, 'terminal engine missing', 'xterm failed to load', true)
   }
diff --git a/mobile/src/terminal/document/native-document-bundle.test.ts b/mobile/src/terminal/document/native-document-bundle.test.ts
index 15eb000ee1f..4389c3bb105 100644
--- a/mobile/src/terminal/document/native-document-bundle.test.ts
+++ b/mobile/src/terminal/document/native-document-bundle.test.ts
@@ -311,7 +311,10 @@ describe('the bundled native document', () => {
     // that ships rather than about a bundle this case built for itself.
     const { script, inputs } = await terminalDocumentBundle()
     expect(inputs.filter((input) => input.includes('node_modules'))).toEqual([])
-    expect(inputs).toHaveLength(47)
+    // 50: `laid-out-cell-box` reads the cell box xterm laid out, for web-ready and each render;
+    // `terminal-grid-fit` is the one fit of that box and `terminal-cell-box` its one comparison,
+    // both shared with the app.
+    expect(inputs).toHaveLength(50)
     expect(script).not.toContain('__commonJS')
     // `__esm` wrappers are esbuild's answer to a cycle, and a cycle would make a module's top level
     // run at first import rather than where the bundle places it.
diff --git a/mobile/src/terminal/document/term-observers.ts b/mobile/src/terminal/document/term-observers.ts
index 80f3ec597af..e35a85acc4f 100644
--- a/mobile/src/terminal/document/term-observers.ts
+++ b/mobile/src/terminal/document/term-observers.ts
@@ -4,6 +4,7 @@ import type { TerminalDocumentScope } from './document-scope'
 import { logFeedAndEvict } from './selection-state-and-eviction'
 import { emitKeyboardAvoidanceMetrics } from './keyboard-avoidance-metrics'
 import { emitModesIfChanged } from './mode-mirroring'
+import { reportLaidOutCellBox } from './laid-out-cell-box'
 
 export function attachTermObservers(scope: TerminalDocumentScope) {
   if (!scope.term) {
@@ -36,6 +37,16 @@ export function attachTermObservers(scope: TerminalDocumentScope) {
       )
     }
   } catch {}
+  // Why: onDimensionsChange skips a renderer swap and a DPR change; every one of them re-renders.
+  try {
+    if (scope.term.onRender) {
+      scope.termObserverDisposables.push(
+        scope.term.onRender(function () {
+          reportLaidOutCellBox(scope)
+        })
+      )
+    }
+  } catch {}
   // Initial emit once buffer settles.
   afterWritesDrained(scope, function () {
     emitModesIfChanged(scope)
diff --git a/mobile/src/terminal/document/terminal-init.ts b/mobile/src/terminal/document/terminal-init.ts
index f63e2b5f508..04e90b4578e 100644
--- a/mobile/src/terminal/document/terminal-init.ts
+++ b/mobile/src/terminal/document/terminal-init.ts
@@ -2,8 +2,9 @@ import { emitKeyboardAvoidanceMetrics } from './keyboard-avoidance-metrics'
 import { MOBILE_TERMINAL_CARET_OPTIONS } from '../terminal-webview-html/theme'
 import { ESC } from './escape-introducers'
 import { notify } from './host-notify'
+import { reportLaidOutCellBox } from './laid-out-cell-box'
 import { fontPxForScale } from './text-scaling'
-import type { TerminalDocumentScope } from './document-scope'
+import type { TerminalDocumentScope, TerminalDocumentTerminal } from './document-scope'
 import { scheduleDocumentFrame } from './document-frame-registry'
 import { applyFitScale } from './fit-scale'
 import {
@@ -21,6 +22,63 @@ import { applyTerminalTheme } from './terminal-theme'
 import { attachWebglAddon, cancelWebglContextRecovery } from './webgl-recovery'
 import { afterWritesDrained, enqueueWrite, pumpWrites, resetWriteQueue } from './write-queue'
 
+/** Builds and opens a terminal on the current surface, with the renderer and addons attached. */
+function openTerminal(scope: TerminalDocumentScope, cols: number, rows: number) {
+  const term = scope.createTerminal({
+    cols: cols,
+    rows: rows,
+    theme: scope.terminalTheme,
+    minimumContrastRatio: scope.terminalMinimumContrastRatio,
+    fontFamily: scope.terminalFontFamily,
+    fontSize: fontPxForScale(scope.currentTextScale),
+    fontWeight: '300',
+    fontWeightBold: '500',
+    scrollback: 5000,
+    // Why: xterm suppresses parser-generated query replies when disableStdin
+    // is true. Native accepts only validated reply grammars from onData.
+    disableStdin: false,
+    cursorBlink: MOBILE_TERMINAL_CARET_OPTIONS.cursorBlink,
+    cursorStyle: MOBILE_TERMINAL_CARET_OPTIONS.cursorStyle,
+    // Native TextInput owns focus; initialize xterm's otherwise-gated main-buffer caret.
+    showCursorImmediately: MOBILE_TERMINAL_CARET_OPTIONS.showCursorImmediately,
+    // A full inactive cell remains visible under the terminal's phone-fit scale.
+    cursorInactiveStyle: MOBILE_TERMINAL_CARET_OPTIONS.cursorInactiveStyle,
+    convertEol: false,
+    allowProposedApi: true
+  })
+  scope.term = term
+  term.open(scope.surface!)
+  attachWebglAddon(scope, true)
+  try {
+    const unicodeAddon = scope.createUnicode11Addon()
+    if (unicodeAddon) {
+      term.loadAddon(unicodeAddon)
+      term.unicode.activeVersion = '11'
+    }
+  } catch {}
+  return term
+}
+
+/**
+ * The document's terminal, built before it reports ready so ready can carry the cell box xterm
+ * lays out at the app's text scale. Any size will do: the first init resizes and reuses it.
+ */
+export function prepareTerminal(scope: TerminalDocumentScope) {
+  // Why: laid out for the measure, but not shown — an empty 80x24 grid and caret until init.
+  scope.surface!.style.visibility = 'hidden'
+  try {
+    scope.committedTerm = openTerminal(scope, 80, 24)
+    scope.provisionalTerm = scope.committedTerm
+  } catch {
+    // Why: init builds again and reports the failure through the path every init failure takes.
+    scope.surface!.style.visibility = ''
+    try {
+      scope.term?.dispose()
+    } catch {}
+    scope.term = null
+  }
+}
+
 export function init(
   scope: TerminalDocumentScope,
   cols: number,
@@ -44,11 +102,15 @@ export function init(
   const scrollAnchorRows = prevB ? Math.max(0, (prevB.baseY || 0) - (prevB.viewportY || 0)) : -1
   scope.terminalGeneration++
   const gen = scope.terminalGeneration
+  const reused = scope.provisionalTerm
+  scope.provisionalTerm = null
   // Why: snapshot replay can contain old queries whose replies must never
   // re-enter the live PTY. Each replacement terminal earns authority anew.
   resetTerminalDataReplyAuthority(scope)
-  cancelWebglContextRecovery(scope)
-  scope.webglAddon = null
+  if (!reused) {
+    cancelWebglContextRecovery(scope)
+    scope.webglAddon = null
+  }
   scope.ready = false
   resetWriteQueue(scope)
   scope.statusDotPendingSelector = false
@@ -77,44 +139,27 @@ export function init(
   scope.initialOscLinks = Array.isArray(nextOscLinks) ? nextOscLinks : []
   scope.initialOscLinkRowOffset = 0
   scope.initialOscLinkEvictionReady = false
-  const surfaceSwap = beginTerminalSurfaceSwap(scope)
-  // oxlint-disable-next-line no-unused-vars -- the document declares it here; removing it is a different program
-  const nextSurface = surfaceSwap.nextSurface
+  // Why: the terminal built before ready is on the committed surface already; only a
+  // replacement needs a hidden surface to replay into.
+  const surfaceSwap = reused ? null : beginTerminalSurfaceSwap(scope)
 
   applyTerminalTheme(scope, nextTheme)
-  scope.term = scope.createTerminal({
-    cols: cols || 80,
-    rows: rows || 24,
-    theme: scope.terminalTheme,
-    minimumContrastRatio: scope.terminalMinimumContrastRatio,
-    fontFamily: scope.terminalFontFamily,
-    fontSize: fontPxForScale(scope.currentTextScale),
-    fontWeight: '300',
-    fontWeightBold: '500',
-    scrollback: 5000,
-    // Why: xterm suppresses parser-generated query replies when disableStdin
-    // is true. Native accepts only validated reply grammars from onData.
-    disableStdin: false,
-    cursorBlink: MOBILE_TERMINAL_CARET_OPTIONS.cursorBlink,
-    cursorStyle: MOBILE_TERMINAL_CARET_OPTIONS.cursorStyle,
-    // Native TextInput owns focus; initialize xterm's otherwise-gated main-buffer caret.
-    showCursorImmediately: MOBILE_TERMINAL_CARET_OPTIONS.showCursorImmediately,
-    // A full inactive cell remains visible under the terminal's phone-fit scale.
-    cursorInactiveStyle: MOBILE_TERMINAL_CARET_OPTIONS.cursorInactiveStyle,
-    convertEol: false,
-    allowProposedApi: true
-  })
-  const nextTerm = scope.term
-  scope.pendingTerm = nextTerm
-  scope.term.open(scope.surface!)
-  attachWebglAddon(scope, true)
-  try {
-    const unicodeAddon = scope.createUnicode11Addon()
-    if (unicodeAddon) {
-      scope.term.loadAddon(unicodeAddon)
-      scope.term.unicode.activeVersion = '11'
+  let nextTerm: TerminalDocumentTerminal
+  if (reused) {
+    nextTerm = reused
+    scope.term = reused
+    reused.reset()
+    reused.options.fontSize = fontPxForScale(scope.currentTextScale)
+    reused.resize(cols || 80, rows || 24)
+    // Why: its box was laid out at 80x24; the first report at this grid must read as the box
+    // changing at a kept grid, which the DOM renderer's cols-dependent box then refits once.
+    if (scope.reportedCellBox) {
+      scope.reportedCellBox = { ...scope.reportedCellBox, cols: reused.cols, rows: reused.rows }
     }
-  } catch {}
+  } else {
+    nextTerm = openTerminal(scope, cols || 80, rows || 24)
+    scope.pendingTerm = nextTerm
+  }
   if (typeof replayData === 'string' && replayData.length > 0) {
     // Why no trailing reset: the snapshot pen belongs to the live host TUI receiving later output.
     enqueueWrite(scope, ESC + '[0m' + replayData)
@@ -124,7 +169,7 @@ export function init(
   resetEvictionCounter(scope)
   cancelSelect(scope)
   attachTermObservers(scope)
-  attachTerminalQueryReplyBridge(scope, scope.term, gen)
+  attachTerminalQueryReplyBridge(scope, nextTerm, gen)
 
   scheduleDocumentFrame(scope, function () {
     if (gen !== scope.terminalGeneration) {
@@ -136,7 +181,12 @@ export function init(
       if (gen !== scope.terminalGeneration) {
         return
       }
-      commitTerminalSurfaceSwap(scope, surfaceSwap, nextTerm)
+      if (surfaceSwap) {
+        commitTerminalSurfaceSwap(scope, surfaceSwap, nextTerm)
+      } else {
+        // The terminal built before ready, shown now that it holds the replay.
+        scope.surface!.style.visibility = ''
+      }
       // Why: restore the reader's place after the rewrapped buffer replays.
       // Replay lands at bottom, so only act when they were scrolled up (rows>0).
       if (scrollAnchorRows > 0 && scope.term && scope.term.buffer && scope.term.buffer.active) {
@@ -150,6 +200,8 @@ export function init(
       scope.initialOscLinkRowOffset = 0
       scope.initialOscLinkEvictionReady = true
       applyFitScale(scope, 'init-replay')
+      // Why: a paused (hidden) render service has not rendered yet, so ready reports it too.
+      reportLaidOutCellBox(scope)
       notify(scope, { type: 'ready', cols: cols, rows: rows })
     })
   })
@@ -207,4 +259,5 @@ export function stopTerminalInit(scope: TerminalDocumentScope) {
   }
   scope.term = null
   scope.committedTerm = null
+  scope.provisionalTerm = null
 }
diff --git a/mobile/src/terminal/document/text-scaling.ts b/mobile/src/terminal/document/text-scaling.ts
index 9fd4cd0dbf3..88d7b5dd762 100644
--- a/mobile/src/terminal/document/text-scaling.ts
+++ b/mobile/src/terminal/document/text-scaling.ts
@@ -2,9 +2,9 @@ import { elementInRoot } from './document-host-seams'
 import { TERMINAL_TEXT_SCALES } from '../terminal-text-scales'
 import type { TerminalDocumentScope } from './document-scope'
 import { scheduleDocumentFrame } from './document-frame-registry'
-import { applyFitScale, getCellHeight, MIN_FIT_COLS } from './fit-scale'
+import { applyFitScale, getCellHeight } from './fit-scale'
+import { fitDimensionsFromCell } from '../terminal-grid-fit'
 import { getCellWidth } from './viewport-transform'
-import { emitKeyboardAvoidanceMetrics } from './keyboard-avoidance-metrics'
 
 // Why: init() flips ready false on every re-init (live width reflow included)
 // while the old surface stays visible; a document-scoped latch drives the
@@ -64,6 +64,8 @@ export function applyTextScale(scope: TerminalDocumentScope, scale: number) {
   }
   const px = fontPxForScale(scale)
   if (scope.term.options.fontSize === px) {
+    // Why: a pinch moved the drawn pitch; the fit commit is the one site that reports it.
+    applyFitScale(scope, 'text-scale')
     return
   }
   scope.term.options.fontSize = px
@@ -76,22 +78,31 @@ export function applyTextScale(scope: TerminalDocumentScope, scale: number) {
     }
     const cellW = getCellWidth(scope)
     const cellH = getCellHeight(scope)
+    // Why: fit the frame React Native laid out, by the same formula; init and measure give it. Before
+    // either, the pre-ready terminal stays hidden until the first init, which applies the font and resizes.
+    const frame = scope.hostFrame
+    if (!frame) {
+      return
+    }
     if (cellW > 0 && cellH > 0) {
-      const cols = Math.floor(scope.viewportRect().width / cellW)
-      if (cols < MIN_FIT_COLS) {
-        // Why: hidden (0 wide) or too narrow; the next box must refit at the new cell size.
-        scope.fittedBox = null
+      const fit = fitDimensionsFromCell(
+        { cellWidth: cellW, cellHeight: cellH },
+        frame.width,
+        frame.height
+      )
+      if (!fit) {
+        // Why: too narrow to resize the grid, but the fit still tracks the new cell size; hidden hosts hold it.
+        applyFitScale(scope, 'text-scale')
         return
       }
-      const rows = Math.max(8, Math.floor(scope.viewportRect().height / cellH))
-      scope.term.resize(cols, rows)
-      emitKeyboardAvoidanceMetrics(scope)
+      scope.term.resize(fit.cols, fit.rows)
     }
     applyFitScale(scope, 'text-scale')
   })
 }
 
 export function startTextScaling(scope: TerminalDocumentScope) {
+  scope.currentTextScale = scope.start().textScale
   scope.scrollIndicator = elementInRoot(scope.root, 'scroll-indicator')
   scope.scrollThumb = elementInRoot(scope.root, 'scroll-thumb')
   scope.terminalFontFamily =
diff --git a/mobile/src/terminal/document/viewport-frame.test.ts b/mobile/src/terminal/document/viewport-frame.test.ts
index 8dee5807bc1..063cf964c6f 100644
--- a/mobile/src/terminal/document/viewport-frame.test.ts
+++ b/mobile/src/terminal/document/viewport-frame.test.ts
@@ -2,7 +2,7 @@
 import { afterEach, describe, expect, it } from 'vitest'
 import { startTerminalDocument, stopTerminalDocument } from './create-terminal-document'
 import { createTerminalDocumentScope, type TerminalDocumentScope } from './document-scope'
-import type { TerminalDocumentHost } from './document-host-seams'
+import type { TerminalDocumentHost, TerminalViewportChange } from './document-host-seams'
 import { terminalDocumentDouble } from './document-terminal-double.test-support'
 import { handleMsg } from './host-message-router'
 import { viewportToMouseReportCell } from './mouse-report-cell'
@@ -110,10 +110,12 @@ describe("the document's frame on the page", () => {
     expect(computeFitScale(scope)).toBe(1)
   })
 
-  it('commits no fit while the host is hidden, and one once it has a box', async () => {
+  it('commits no fit before the host has a box, and one once it has', async () => {
+    // A page host mounted under a hidden screen has no box until RN lays it out; hide and show after
+    // that are the mount's to absorb (terminal-web-document-mount.test.ts).
     let box = { left: 0, top: 0, width: 0, height: 0 }
     const widthsRead: number[] = []
-    const changes: (() => void)[] = []
+    const changes: ((change: TerminalViewportChange) => void)[] = []
     const scope = startedWithGrid({
       viewportRect: () => {
         widthsRead.push(box.width)
@@ -135,7 +137,7 @@ describe("the document's frame on the page", () => {
     await nextFrame()
     expect(scales).toEqual([])
     box = { left: 0, top: 0, width: 390, height: 600 }
-    changes.forEach((onChange) => onChange())
+    changes.forEach((onChange) => onChange('resized'))
     await framesUntil(() => scales.length === 2)
     // The refit repaints at the scale it has, then the fit commits once: 390 / (7.5 x 55).
     expect(scales).toEqual(['1', String(FIT_390)])
@@ -157,92 +159,4 @@ describe("the document's frame on the page", () => {
     expect(edge(400)).toBe(0)
     expect(edge(120)).toBe(-1)
   })
-
-  it('keeps pan and zoom across hide and show, and refits when the box really changes', async () => {
-    // react-native-screens hides the session when another screen covers it and shows it again at
-    // the same size; native never refits on navigation, so the pan the user left must survive.
-    let box = { left: 0, top: 0, width: 390, height: 600 }
-    const changes: (() => void)[] = []
-    const scope = startedWithGrid({
-      viewportRect: () => box,
-      observeViewport: (onChange) => {
-        changes.push(onChange)
-        return () => {}
-      }
-    })
-    const resize = async (width: number, height: number) => {
-      box = { left: 0, top: 0, width, height }
-      changes.forEach((onChange) => onChange())
-      await nextFrame()
-      await nextFrame()
-    }
-    await framesUntil(() => scope.currentScale === FIT_390)
-    scope.panX = -40
-    scope.panY = -30
-    scope.userScale = 1.5
-    const kept = { panX: -40, panY: -30, userScale: 1.5, currentScale: scope.currentScale }
-    const view = () => {
-      const { panX, panY, userScale, currentScale } = scope
-      return { panX, panY, userScale, currentScale }
-    }
-
-    await resize(0, 0)
-    expect(view()).toEqual(kept)
-    await resize(390, 600)
-    expect(view()).toEqual(kept)
-
-    box = { left: 0, top: 0, width: 300, height: 600 }
-    changes.forEach((onChange) => onChange())
-    await framesUntil(() => scope.currentScale === 300 / (7.5 * 55))
-    expect(view()).toEqual({ panX: 0, panY: 0, userScale: 1, currentScale: 300 / (7.5 * 55) })
-  })
-
-  it('refits on show when a fit was asked for while hidden, even at the same box', async () => {
-    let box = { left: 0, top: 0, width: 390, height: 600 }
-    const changes: (() => void)[] = []
-    const scope = startedWithGrid({
-      viewportRect: () => box,
-      observeViewport: (onChange) => {
-        changes.push(onChange)
-        return () => {}
-      }
-    })
-    const show = (width: number, height: number) => {
-      box = { left: 0, top: 0, width, height }
-      changes.forEach((onChange) => onChange())
-    }
-    await framesUntil(() => scope.currentScale === FIT_390)
-    show(0, 0)
-    handleMsg(scope, { type: 'resize', cols: 80, rows: 40 })
-    await nextFrame()
-    show(390, 600)
-    await framesUntil(() => scope.currentScale !== FIT_390, { required: false })
-    expect(scope.currentScale).toBe(390 / (7.5 * 80))
-  })
-
-  it('refits on show after a text-scale change while hidden', async () => {
-    let box = { left: 0, top: 0, width: 390, height: 600 }
-    const changes: (() => void)[] = []
-    const scope = startedWithGrid({
-      viewportRect: () => box,
-      observeViewport: (onChange) => {
-        changes.push(onChange)
-        return () => {}
-      }
-    })
-    const show = (width: number, height: number) => {
-      box = { left: 0, top: 0, width, height }
-      changes.forEach((onChange) => onChange())
-    }
-    await framesUntil(() => scope.currentScale === FIT_390)
-    show(0, 0)
-    handleMsg(scope, { type: 'set-font-scale', fontScale: 0.8 })
-    await nextFrame()
-    await nextFrame()
-    show(390, 600)
-    // The smaller font's cells: 55 columns at fontPxForScale(0.8) = 10 px, 7.5 x 10/13 each.
-    const fitted = 390 / (7.5 * (10 / 13) * 55)
-    await framesUntil(() => scope.currentScale !== FIT_390, { required: false })
-    expect(scope.currentScale).toBe(Math.min(1, fitted) >= 0.95 ? 1 : fitted)
-  })
 })
diff --git a/mobile/src/terminal/document/viewport-transform.ts b/mobile/src/terminal/document/viewport-transform.ts
index 4f60fc9eca1..61190307db4 100644
--- a/mobile/src/terminal/document/viewport-transform.ts
+++ b/mobile/src/terminal/document/viewport-transform.ts
@@ -19,6 +19,15 @@ export function flog(scope: TerminalDocumentScope, tag: string, payload: Record<
   } catch {}
 }
 
+/** 0 until the renderer has measured a cell. */
+export function getMeasuredCellHeight(scope: TerminalDocumentScope) {
+  const core = scope.term?._core
+  if (core && core._renderService && core._renderService.dimensions) {
+    return core._renderService.dimensions.css.cell.height || 0
+  }
+  return 0
+}
+
 export function getCellWidth(scope: TerminalDocumentScope) {
   if (!scope.term || !scope.term._core) {
     return 0
@@ -51,7 +60,7 @@ export function computeFitScale(scope: TerminalDocumentScope) {
     return 1
   }
   const vpWidth = scope.viewportRect().width
-  // Why: a host hidden with display:none measures 0; a 0 scale would blank it when shown again.
+  // Why: a viewport with no width yet (a page host never laid out) would give scale 0 and blank the grid.
   if (vpWidth <= 0) {
     return 1
   }
diff --git a/mobile/src/terminal/terminal-cell-box-refit.test.tsx b/mobile/src/terminal/terminal-cell-box-refit.test.tsx
new file mode 100644
index 00000000000..0bf8e774bc9
--- /dev/null
+++ b/mobile/src/terminal/terminal-cell-box-refit.test.tsx
@@ -0,0 +1,128 @@
+import { createElement } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { TerminalWebViewHandle } from './terminal-webview-contract'
+import { useTerminalViewportRefit, type TerminalViewportDims } from './terminal-viewport-refit'
+
+vi.mock('react-native', () => ({
+  AppState: { currentState: 'active', addEventListener: () => ({ remove() {} }) },
+  Platform: { OS: 'android' },
+  useWindowDimensions: () => ({ width: 427, height: 900 })
+}))
+
+const HANDLE = 'term-1'
+
+/** The session's refit over one open terminal whose document reported a `cellWidth` box. */
+function refitHarness(cellWidth: number) {
+  const terminal: TerminalWebViewHandle = {
+    prepareForForegroundRecovery: vi.fn(),
+    write: vi.fn(),
+    init: vi.fn(),
+    resize: vi.fn(),
+    reflow: vi.fn(),
+    clear: vi.fn(),
+    // The reported box, 47 rows high in the 710 px frame.
+    fitDimensions: vi.fn((frame: { width: number }) => ({
+      cols: Math.floor(frame.width / cellWidth),
+      rows: 47
+    })),
+    resetZoom: vi.fn(),
+    cancelSelect: vi.fn(),
+    doSelectAll: vi.fn(),
+    awaitReady: vi.fn(async () => {})
+  }
+  const viewportRef: { current: TerminalViewportDims | null } = { current: { cols: 55, rows: 47 } }
+  const subscribeToTerminal = vi.fn()
+  const unsubscribeTerminal = vi.fn()
+  const terminalFrameRef: { current: { width: number; height: number } | null } = {
+    current: { width: 427, height: 710 }
+  }
+  let refit: ReturnType<typeof useTerminalViewportRefit> | undefined
+  function Probe() {
+    refit = useTerminalViewportRefit({
+      activeHandleRef: { current: HANDLE },
+      terminalRefs: { current: new Map([[HANDLE, terminal]]) },
+      terminalFrameRef,
+      viewportRef,
+      viewportMeasuredRef: { current: true },
+      nativeChatCoveredRef: { current: false },
+      clientRef: { current: null },
+      deviceTokenRef: { current: null },
+      initializedHandlesRef: { current: new Set([HANDLE]) },
+      connState: 'connected',
+      tabStripVisible: false,
+      textScale: 1,
+      unsubscribeTerminal,
+      subscribeToTerminal
+    })
+    return null
+  }
+  act(() => {
+    renderer = create(createElement(Probe))
+  })
+  return {
+    terminal,
+    viewportRef,
+    subscribeToTerminal,
+    report: (handle: string) => act(() => refit!.notifyTerminalCellBoxChange(handle)),
+    // The session's onLayout: the one frame store, then the width notify.
+    layOut: (width: number) =>
+      act(() => {
+        terminalFrameRef.current = { width, height: 710 }
+        refit!.notifyTerminalFrameWidth()
+      })
+  }
+}
+
+let renderer: ReactTestRenderer | undefined
+beforeEach(() => {
+  vi.useFakeTimers()
+})
+afterEach(() => {
+  act(() => renderer?.unmount())
+  renderer = undefined
+  vi.useRealTimers()
+})
+
+describe('a new cell box for the open terminal', () => {
+  it('refits the PTY to the grid the new box fits, as after a renderer swap', async () => {
+    const harness = refitHarness(7.8)
+    harness.report(HANDLE)
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(150)
+    })
+    expect(harness.terminal.fitDimensions).toHaveBeenLastCalledWith({ width: 427, height: 710 })
+    expect(harness.viewportRef.current).toEqual({ cols: 54, rows: 47 })
+    expect(harness.subscribeToTerminal).toHaveBeenCalledWith(HANDLE)
+  })
+
+  it('leaves a terminal that is not on screen alone', async () => {
+    const harness = refitHarness(7.8)
+    harness.report('term-2')
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(150)
+    })
+    expect(harness.subscribeToTerminal).not.toHaveBeenCalled()
+    expect(harness.viewportRef.current).toEqual({ cols: 55, rows: 47 })
+  })
+
+  it('leaves the PTY alone when a new frame width holds the same grid, as sub-pixel jitter does', async () => {
+    const harness = refitHarness(23 / 3)
+    harness.layOut(427.3)
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(150)
+    })
+    expect(harness.subscribeToTerminal).not.toHaveBeenCalled()
+    expect(harness.viewportRef.current).toEqual({ cols: 55, rows: 47 })
+  })
+
+  it('refits when a new frame width holds a different grid', async () => {
+    const harness = refitHarness(23 / 3)
+    harness.layOut(420)
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(150)
+    })
+    expect(harness.terminal.fitDimensions).toHaveBeenLastCalledWith({ width: 420, height: 710 })
+    expect(harness.viewportRef.current).toEqual({ cols: 54, rows: 47 })
+  })
+})
diff --git a/mobile/src/terminal/terminal-cell-box.test.ts b/mobile/src/terminal/terminal-cell-box.test.ts
new file mode 100644
index 00000000000..9ddec3bcc07
--- /dev/null
+++ b/mobile/src/terminal/terminal-cell-box.test.ts
@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest'
+import { readTerminalCellBox } from './terminal-cell-box'
+
+// 23 device px at DPR 3: the WebGL renderer's 13px cell on the emulator.
+const CELL_1X = { fontScale: 1, cellWidth: 23 / 3, cellHeight: 15 }
+
+describe('readTerminalCellBox', () => {
+  it('reads nothing from a notify without a cell box', () => {
+    expect(readTerminalCellBox({ type: 'web-ready' })).toBeNull()
+  })
+
+  it('reads a well-formed box and rejects a malformed one', () => {
+    expect(readTerminalCellBox({ cellBox: CELL_1X })).toEqual(CELL_1X)
+    expect(readTerminalCellBox({ cellBox: { ...CELL_1X, cellWidth: 0 } })).toBeNull()
+    expect(readTerminalCellBox({ cellBox: [CELL_1X] })).toBeNull()
+  })
+})
diff --git a/mobile/src/terminal/terminal-cell-box.ts b/mobile/src/terminal/terminal-cell-box.ts
new file mode 100644
index 00000000000..84315049991
--- /dev/null
+++ b/mobile/src/terminal/terminal-cell-box.ts
@@ -0,0 +1,36 @@
+/**
+ * The cell box xterm laid out in one document, so the first subscribe after ready carries the phone's dims.
+ *
+ * The document builds its terminal before it reports ready, puts that box in `web-ready`, and
+ * reports it again whenever xterm lays out a different one.
+ */
+export type TerminalCellBox = { fontScale: number; cellWidth: number; cellHeight: number }
+
+/** A box xterm laid out, with the grid it was laid out at: the document's own record. */
+export type TerminalLaidOutCellBox = { cellBox: TerminalCellBox; cols: number; rows: number }
+
+function positive(value: unknown): number | null {
+  return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : null
+}
+
+/** The notify's `cellBox` when well formed; null when absent or malformed. */
+export function readTerminalCellBox(msg: Record<string, unknown>): TerminalCellBox | null {
+  const box = msg.cellBox
+  if (
+    typeof box !== 'object' ||
+    box === null ||
+    !('fontScale' in box && 'cellWidth' in box && 'cellHeight' in box)
+  ) {
+    return null
+  }
+  const fontScale = positive(box.fontScale)
+  const cellWidth = positive(box.cellWidth)
+  const cellHeight = positive(box.cellHeight)
+  return fontScale !== null && cellWidth !== null && cellHeight !== null
+    ? { fontScale, cellWidth, cellHeight }
+    : null
+}
+
+export function sameCellBox(a: TerminalCellBox, b: TerminalCellBox): boolean {
+  return a.fontScale === b.fontScale && a.cellWidth === b.cellWidth && a.cellHeight === b.cellHeight
+}
diff --git a/mobile/src/terminal/terminal-foreground-recovery.test.ts b/mobile/src/terminal/terminal-foreground-recovery.test.ts
index abf1bd01045..50fcda6ec52 100644
--- a/mobile/src/terminal/terminal-foreground-recovery.test.ts
+++ b/mobile/src/terminal/terminal-foreground-recovery.test.ts
@@ -2,23 +2,12 @@ import type { RefObject } from 'react'
 import { describe, expect, it, vi } from 'vitest'
 import type { ConnectionState } from '../transport/types'
 import type { TerminalWebViewHandle } from './TerminalWebView'
-import { readMobileSessionRouteSource } from '../session/mobile-session-route-source-family.test-support'
 import {
   TERMINAL_FOREGROUND_RECOVERY_DELAY_MS,
   recoverActiveTerminalAfterForeground,
   shouldRecoverTerminalOnAppStateChange
 } from './terminal-foreground-recovery'
 
-const lifecycleSource = readMobileSessionRouteSource('../session/use-mobile-session-lifecycle.ts')
-
-function sliceSessionSource(startPattern: string, endPattern: string): string {
-  const start = lifecycleSource.indexOf(startPattern)
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = lifecycleSource.indexOf(endPattern, start)
-  expect(end).toBeGreaterThan(start)
-  return lifecycleSource.slice(start, end)
-}
-
 type RecoveryHarness = {
   activeHandleRef: RefObject<string | null>
   terminalRefs: RefObject<Map<string, TerminalWebViewHandle>>
@@ -139,37 +128,4 @@ describe('terminal foreground recovery', () => {
 
     expect(harness.subscribeToTerminal).not.toHaveBeenCalled()
   })
-
-  it('is wired to AppState foregrounding in the session screen', () => {
-    const foregroundPredicate = sliceSessionSource(
-      'const shouldRecover = shouldRecoverTerminalOnAppStateChange(',
-      'previousAppState = nextAppState'
-    )
-
-    expect(lifecycleSource).toContain('shouldRecoverTerminalOnAppStateChange')
-    expect(foregroundPredicate).toContain('Platform.OS')
-    expect(lifecycleSource).toContain('recoverActiveTerminalAfterForeground({')
-    expect(lifecycleSource).toContain("AppState.addEventListener('change'")
-    const readinessInvalidation = lifecycleSource.indexOf(
-      'terminalRef.prepareForForegroundRecovery()'
-    )
-    const replay = lifecycleSource.indexOf('recoverActiveTerminalAfterForeground({')
-    expect(readinessInvalidation).toBeGreaterThanOrEqual(0)
-    expect(replay).toBeGreaterThan(readinessInvalidation)
-  })
-
-  it('re-runs a deferred recovery once the session screen reconnects', () => {
-    // Why: resume usually lands mid-reconnect; the session screen must retry
-    // recovery on the connState→connected transition or blanked panes stay
-    // stale until a manual tab switch.
-    expect(lifecycleSource).toContain(
-      "pendingForegroundRecoveryRef.current = outcome === 'deferred'"
-    )
-    const reconnectRetry = sliceSessionSource(
-      "if (connState !== 'connected' || !pendingForegroundRecoveryRef.current)",
-      'recoverActiveTerminalAfterForeground({'
-    )
-    expect(reconnectRetry).toContain('pendingForegroundRecoveryRef.current = false')
-    expect(reconnectRetry).toContain("AppState.currentState !== 'active'")
-  })
 })
diff --git a/mobile/src/terminal/terminal-grid-fit.test.ts b/mobile/src/terminal/terminal-grid-fit.test.ts
new file mode 100644
index 00000000000..77c0be8cdcb
--- /dev/null
+++ b/mobile/src/terminal/terminal-grid-fit.test.ts
@@ -0,0 +1,28 @@
+import { describe, expect, it } from 'vitest'
+import { fitDimensionsFromCell } from './terminal-grid-fit'
+
+// 23 device px at DPR 3: the WebGL renderer's 13px cell on the emulator.
+const CELL_1X = { cellWidth: 23 / 3, cellHeight: 15 }
+
+describe('fitDimensionsFromCell', () => {
+  it('fits the frame React Native laid out', () => {
+    // floor(427 / 7.667) = 55, floor(710 / 15) = 47
+    expect(fitDimensionsFromCell(CELL_1X, 427, 710)).toEqual({ cols: 55, rows: 47 })
+  })
+
+  it('answers null for a frame too narrow to fit', () => {
+    expect(fitDimensionsFromCell(CELL_1X, 100, 710)).toBeNull()
+  })
+
+  it('keeps an exact fit at a fractional pixel ratio whole', () => {
+    // 900 device px of frame over 18 px cells at 2.75 is 50 columns; the two quotients divide
+    // to 49.999… in floating point.
+    const cell = { cellWidth: 18 / 2.75, cellHeight: 40 / 2.75 }
+    expect(fitDimensionsFromCell(cell, 900 / 2.75, 1320 / 2.75)).toEqual({ cols: 50, rows: 33 })
+  })
+
+  it('still falls short of a column the frame does not hold', () => {
+    const cell = { cellWidth: 393 / 51, cellHeight: 15 }
+    expect(fitDimensionsFromCell(cell, 1080 / 2.75, 600)?.cols).toBe(50)
+  })
+})
diff --git a/mobile/src/terminal/terminal-grid-fit.ts b/mobile/src/terminal/terminal-grid-fit.ts
new file mode 100644
index 00000000000..3f8daf8c682
--- /dev/null
+++ b/mobile/src/terminal/terminal-grid-fit.ts
@@ -0,0 +1,28 @@
+/**
+ * The one fit of a cell box to the terminal frame, shared by the app and the document so a first
+ * subscribe and every later refit reach the same grid from the same frame width.
+ */
+
+export type TerminalFitDimensions = { cols: number; rows: number }
+
+/** Below these the fit is not a terminal anyone can read, and the caller disables fit-to-phone. */
+export const MIN_FIT_COLS = 20
+export const MIN_FIT_ROWS = 8
+
+// Why: frame and cell are each device pixels over the pixel ratio, so an exact fit can divide to
+// 49.999…; a real shortfall is at least 1/cell-device-px (> 0.02) below the next integer.
+const EXACT_FIT_TOLERANCE = 1e-6
+
+/** The grid the frame (as React Native laid it out) holds at this cell box; null when too narrow. */
+export function fitDimensionsFromCell(
+  cell: { cellWidth: number; cellHeight: number },
+  width: number,
+  height: number
+): TerminalFitDimensions | null {
+  const cols = Math.floor(width / cell.cellWidth + EXACT_FIT_TOLERANCE)
+  if (!(cols >= MIN_FIT_COLS)) {
+    return null
+  }
+  const rows = Math.floor(height / cell.cellHeight + EXACT_FIT_TOLERANCE)
+  return { cols, rows: Math.max(MIN_FIT_ROWS, rows) }
+}
diff --git a/mobile/src/terminal/terminal-input-connection-gate.test.ts b/mobile/src/terminal/terminal-input-connection-gate.test.ts
index 4d55c31bcf4..747f0eaab4c 100644
--- a/mobile/src/terminal/terminal-input-connection-gate.test.ts
+++ b/mobile/src/terminal/terminal-input-connection-gate.test.ts
@@ -1,28 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import { resolveMobileTerminalInputGate } from './terminal-input-connection-gate'
 import { buildTerminalSendParams, TERMINAL_INPUT_SEND_OPTIONS } from './terminal-send-request'
-import { readMobileSessionRouteSource } from '../session/mobile-session-route-source-family.test-support'
-
-const runtimeSource = readMobileSessionRouteSource(
-  '../session/use-mobile-session-terminal-runtime.ts'
-)
-const sendActionsSource = readMobileSessionRouteSource(
-  '../session/use-mobile-session-terminal-send-actions.ts'
-)
-const terminalInputSource = readMobileSessionRouteSource(
-  '../session/use-mobile-session-terminal-input.ts'
-)
-const commandDockSource = readMobileSessionRouteSource('../session/MobileSessionCommandDock.tsx')
-
-function sourceSlice(source: string, anchorStart: string, anchorEnd: string): string {
-  const start = source.indexOf(anchorStart)
-  expect(start).toBeGreaterThanOrEqual(0)
-  // Why: a duplicated start anchor would silently slice the wrong region.
-  expect(source.indexOf(anchorStart, start + 1)).toBe(-1)
-  const end = source.indexOf(anchorEnd, start)
-  expect(end).toBeGreaterThan(start)
-  return source.slice(start, end + anchorEnd.length)
-}
 
 describe('terminal input connection gate', () => {
   it('Given a live connection on a terminal tab Then composing and sending are both allowed', () => {
@@ -83,74 +61,9 @@ describe('terminal input connection gate', () => {
   })
 })
 
-describe('session route offline-compose wiring', () => {
-  it('derives both gates from the shared resolver', () => {
-    expect(runtimeSource).toContain('resolveMobileTerminalInputGate({')
-  })
-
-  it('keeps the buffered command box editable offline while the live capture stays send-gated', () => {
-    const bufferedInput = sourceSlice(
-      commandDockSource,
-      'ref={bindCommandField}',
-      'onSubmitEditing={() => void handleSend()}'
-    )
-    expect(bufferedInput).toContain('editable={canCompose}')
-
-    const liveCapture = sourceSlice(
-      commandDockSource,
-      'ref={bindLiveInputField}',
-      'importantForAutofill="no"'
-    )
-    expect(liveCapture).toContain('editable={canSend}')
-  })
-
-  it('keeps the send button connection-gated so held text cannot fire into a dead link', () => {
-    const sendButton = sourceSlice(
-      commandDockSource,
-      'styles.sendButton,',
-      'accessibilityLabel="Send command"'
-    )
-    expect(sendButton).toContain('disabled={!canSend}')
-  })
-
-  it('holds composed text when the return key submits offline', () => {
-    const handleSend = sourceSlice(
-      sendActionsSource,
-      'async function handleSend()',
-      'sendingRef.current = true'
-    )
-    expect(handleSend).toContain('!canSend')
-  })
-
-  it('keeps the live/buffered mode toggle reachable offline', () => {
-    const modeToggle = sourceSlice(
-      commandDockSource,
-      'liveInputEnabled && styles.accessoryKeyActive',
-      'onPress={toggleLiveInput}'
-    )
-    expect(modeToggle).toContain('disabled={!canCompose}')
-  })
-
-  it('tells the live-input commit hook about connection loss so stale mirror state resets', () => {
-    const hookCall = sourceSlice(
-      runtimeSource,
-      'useTerminalLiveInputCommit({',
-      'setLiveInputCapture'
-    )
-    expect(hookCall).toContain("connected: connState === 'connected'")
-  })
-
+describe('terminal send request shape', () => {
   it('keeps every keystroke-grade terminal send now-or-never so nothing replays after reconnect', () => {
-    // Live mirror, buffered send, and gesture arrows must all opt out of the
-    // connect wait — a parked send replays stale bytes into the PTY. Accessory
-    // keys get the same option inside terminal-live-accessory-raw-send.ts.
-    expect(sendActionsSource).toContain('TERMINAL_INPUT_SEND_OPTIONS')
-    expect(terminalInputSource).toContain('TERMINAL_INPUT_SEND_OPTIONS')
-    const optionUses = [sendActionsSource, terminalInputSource].flatMap(
-      (source) => source.match(/TERMINAL_INPUT_SEND_OPTIONS/g) ?? []
-    ).length
-    // Two owner imports plus one buffered, one live, and one gesture send.
-    expect(optionUses).toBe(5)
+    // A parked send replays stale bytes into the PTY once the socket comes back.
     expect(TERMINAL_INPUT_SEND_OPTIONS).toEqual({ failWhenDisconnected: true })
   })
 
diff --git a/mobile/src/terminal/terminal-ios-dictation-write-back.test.ts b/mobile/src/terminal/terminal-ios-dictation-write-back.test.ts
deleted file mode 100644
index 9929f09c37d..00000000000
--- a/mobile/src/terminal/terminal-ios-dictation-write-back.test.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { readMobileSessionRouteSource } from '../session/mobile-session-route-source-family.test-support'
-
-const commandDockSource = readMobileSessionRouteSource('../session/MobileSessionCommandDock.tsx')
-const sendActionsSource = readMobileSessionRouteSource(
-  '../session/use-mobile-session-terminal-send-actions.ts'
-)
-
-// Why: iOS terminates an active keyboard-dictation (and IME) session whenever
-// JS writes a value into the focused field that differs from the native text
-// (RN applies it via setTextAndSelection / _setAttributedString). Terminal
-// inputs therefore must echo the raw field text in their controlled value and
-// apply dash normalization only on the send/mirror path. See stablyai/orca#7925.
-describe('terminal iOS dictation write-back', () => {
-  it('does not write normalized text back into the buffered command input value', () => {
-    expect(commandDockSource).toContain('onChangeText={bufferedTerminalDraftState.setInput}')
-    expect(commandDockSource).not.toContain('setInput((previousText) => normalizeTerminalTextInput')
-  })
-
-  it('still normalizes the buffered command text at send time', () => {
-    expect(sendActionsSource).toContain('normalizeTerminalTextInput(draft)')
-  })
-})
diff --git a/mobile/src/terminal/terminal-ios-ime-keyboard.test.ts b/mobile/src/terminal/terminal-ios-ime-keyboard.test.ts
deleted file mode 100644
index 573dcf04bbf..00000000000
--- a/mobile/src/terminal/terminal-ios-ime-keyboard.test.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { readMobileSessionRouteSource } from '../session/mobile-session-route-source-family.test-support'
-
-const commandDockSource = readMobileSessionRouteSource('../session/MobileSessionCommandDock.tsx')
-
-describe('terminal iOS IME keyboard', () => {
-  it('does not force terminal inputs onto the ASCII-only iOS keyboard', () => {
-    expect(commandDockSource).not.toContain("'ascii-capable'")
-    expect(commandDockSource).not.toContain('"ascii-capable"')
-  })
-
-  it('subscribes live capture to onChange so the marked-text report survives', () => {
-    // onChangeText hands over only a string, discarding the preedit report that
-    // decides whether the text may reach the PTY at all.
-    expect(commandDockSource).toContain('onChange={handleLiveInputChange}')
-    expect(commandDockSource).not.toContain('onChangeText={handleLiveInputChange}')
-  })
-
-  it('does not put terminal keyboard capture behind iOS textContentType semantics', () => {
-    expect(commandDockSource).not.toContain('textContentType="none"')
-    expect(commandDockSource).toContain('autoComplete="off"')
-  })
-})
diff --git a/mobile/src/terminal/terminal-keyboard-avoidance-lift.test.ts b/mobile/src/terminal/terminal-keyboard-avoidance-lift.test.ts
index 4c11320db2e..d98ba59566e 100644
--- a/mobile/src/terminal/terminal-keyboard-avoidance-lift.test.ts
+++ b/mobile/src/terminal/terminal-keyboard-avoidance-lift.test.ts
@@ -103,6 +103,13 @@ describe('computeActiveTerminalKeyboardLift', () => {
       terminalFrameHeight: FRAME_HEIGHT
     })
     expect(lift).toBeLessThanOrEqual(KEYBOARD_LIFT)
+    // With the drawn row pitch too, and a grid drawn taller than the frame it is lifted in.
+    const taller = computeActiveTerminalKeyboardLift({
+      keyboardLift: KEYBOARD_LIFT,
+      metrics: metrics({ rows: 60, rowPitch: 18, cursorY: 59, contentBottomRow: 59 }),
+      terminalFrameHeight: FRAME_HEIGHT
+    })
+    expect(taller).toBe(KEYBOARD_LIFT)
   })
 
   it('uses the platform-adjusted lift proportionally on iOS and Android', () => {
@@ -119,4 +126,90 @@ describe('computeActiveTerminalKeyboardLift', () => {
     })
     expect({ android, ios }).toEqual({ android: 220, ios: 186 })
   })
+
+  /** Base's arithmetic, kept here as the oracle a covered frame must match to the pixel. */
+  function baseLift(keyboardLift: number, m: TerminalKeyboardAvoidanceMetrics, frame: number) {
+    if (keyboardLift <= 0) {
+      return 0
+    }
+    if (m.rows <= 0 || frame <= 0 || m.altScreen) {
+      return keyboardLift
+    }
+    const rowHeight = frame / m.rows
+    const anchorBottom = (Math.max(m.cursorY, m.contentBottomRow) + 1) * rowHeight
+    return Math.min(keyboardLift, Math.max(0, anchorBottom + rowHeight - (frame - keyboardLift)))
+  }
+
+  describe('a keyboard that covers the frame', () => {
+    const lift = (keyboardLift: number, m: TerminalKeyboardAvoidanceMetrics, frame = 713.7) =>
+      computeActiveTerminalKeyboardLift({
+        keyboardLift,
+        metrics: m,
+        terminalFrameHeight: frame
+      })
+
+    it('keeps base in phone mode, where the fit fills the frame to within a row', () => {
+      // Pixel_API_37: 47 rows of 15 px in a 713.7 px frame under a 312 px keyboard.
+      const phone = metrics({ rows: 47, rowPitch: 15, cursorY: 46, contentBottomRow: 46 })
+      expect(lift(312, phone)).toBe(312)
+      expect(lift(312, phone)).toBe(baseLift(312, phone, 713.7))
+    })
+
+    it('lifts a desktop-mode grid only by what the keyboard hides of it', () => {
+      // Pixel_API_37, measured blank: 40 desktop rows drawn 270 px tall, lifted 312 under the header.
+      const drawn270 = metrics({ rows: 40, rowPitch: 6.75, cursorY: 39, contentBottomRow: 39 })
+      expect(lift(312, drawn270)).toBe(0)
+      expect(lift(312, { ...drawn270, altScreen: true })).toBe(0)
+      // 425 px drawn, the dock at 401.7: the caret row's bottom lands on the dock.
+      const drawn425 = metrics({ rows: 50, rowPitch: 8.5, cursorY: 49, contentBottomRow: 49 })
+      expect(lift(312, drawn425)).toBeCloseTo(23.3, 5)
+      expect(lift(312, { ...drawn425, altScreen: true })).toBeCloseTo(23.3, 5)
+      // A caret mid-grid lifts only enough to clear its row plus one: 47 x 8.5 + 8.5 - 401.7.
+      expect(lift(312, { ...drawn425, cursorY: 46, contentBottomRow: 46 })).toBeCloseTo(6.3, 5)
+      expect(lift(312, { ...drawn425, cursorY: 45, contentBottomRow: 45 })).toBe(0)
+    })
+
+    it('lifts nothing for a keyboard that is open and covers nothing', () => {
+      expect(lift(0, metrics({ rows: 50, rowPitch: 17, cursorY: 49, contentBottomRow: 49 }))).toBe(
+        0
+      )
+    })
+
+    it('stays under the strip while stale rows outlast a rotation or a text-size change', () => {
+      const rotated = metrics({ rows: 47, rowPitch: 15, cursorY: 46, contentBottomRow: 46 })
+      expect(lift(150, rotated, 300)).toBe(150)
+      const resized = metrics({ rows: 47, rowPitch: 18, cursorY: 46, contentBottomRow: 46 })
+      expect(lift(312, resized)).toBe(312)
+    })
+
+    it('matches base wherever the drawn grid fills the frame, and never lifts past it elsewhere', () => {
+      let matched = 0
+      let drawnShort = 0
+      for (const rows of [8, 26, 47, 50, 80]) {
+        for (const rowPitch of [undefined, 5.1, 8.5, 15, 18, 25]) {
+          for (const frame of [300, 401.7, 710.33, 713.7]) {
+            for (const keyboard of [0.5, 150, 312, 336]) {
+              for (const anchor of [0, Math.floor(rows / 2), rows - 1]) {
+                const m = metrics({ rows, rowPitch, cursorY: anchor, contentBottomRow: anchor })
+                const got = lift(keyboard, m, frame)
+                const drawn = rowPitch === undefined ? frame : rows * rowPitch
+                // The fit floors rows, so a grid that fills the frame leaves less than a row.
+                if (drawn >= frame - (rowPitch ?? 0)) {
+                  expect(got).toBe(baseLift(keyboard, m, frame))
+                  matched++
+                  continue
+                }
+                expect(got).toBeLessThanOrEqual(keyboard)
+                expect(got).toBeLessThanOrEqual(Math.max(0, drawn - (frame - keyboard)) + 1e-9)
+                drawnShort++
+              }
+            }
+          }
+        }
+      }
+      // Presence: both halves of the sweep ran.
+      expect(matched).toBeGreaterThan(500)
+      expect(drawnShort).toBeGreaterThan(500)
+    })
+  })
 })
diff --git a/mobile/src/terminal/terminal-keyboard-avoidance-lift.ts b/mobile/src/terminal/terminal-keyboard-avoidance-lift.ts
index 6ada640430d..003b42b50c4 100644
--- a/mobile/src/terminal/terminal-keyboard-avoidance-lift.ts
+++ b/mobile/src/terminal/terminal-keyboard-avoidance-lift.ts
@@ -1,11 +1,16 @@
 import type { TerminalKeyboardAvoidanceMetrics } from './terminal-webview-contract'
 
 type ActiveTerminalKeyboardLiftParams = {
+  // What the keyboard covers of the frame.
   keyboardLift: number
   metrics: TerminalKeyboardAvoidanceMetrics | undefined
   terminalFrameHeight: number
 }
 
+/**
+ * How far to lift the active pane so its anchor row clears the keyboard. Never more than the strip
+ * the keyboard covers, nor more than it hides of the grid as drawn.
+ */
 export function computeActiveTerminalKeyboardLift(
   params: ActiveTerminalKeyboardLiftParams
 ): number {
@@ -16,14 +21,33 @@ export function computeActiveTerminalKeyboardLift(
   if (!metrics || metrics.rows <= 0 || terminalFrameHeight <= 0) {
     return keyboardLift
   }
+  const dockTop = terminalFrameHeight - keyboardLift
+  const pitch = metrics.rowPitch
+  // Desktop display mode draws the desktop's rows scaled down, well short of the frame; lifting
+  // by the strip there moved the whole grid under the header. The fit floors rows, so a gap under
+  // one row is a grid that fills the frame, and keeps the arithmetic below.
+  if (pitch && metrics.rows * pitch < terminalFrameHeight - pitch) {
+    const drawnHidden = metrics.rows * pitch - dockTop
+    if (drawnHidden <= 0) {
+      return 0
+    }
+    const hidden = Math.min(keyboardLift, drawnHidden)
+    return metrics.altScreen ? hidden : Math.min(hidden, anchorOverflow(metrics, pitch, dockTop))
+  }
   if (metrics.altScreen) {
     return keyboardLift
   }
   const rowHeight = terminalFrameHeight / metrics.rows
+  return Math.min(keyboardLift, anchorOverflow(metrics, rowHeight, dockTop))
+}
+
+/** How far the anchor row, plus one row of margin, reaches below `visibleBottom`. */
+function anchorOverflow(
+  metrics: TerminalKeyboardAvoidanceMetrics,
+  rowHeight: number,
+  visibleBottom: number
+): number {
   // Main-buffer TUI footer rows can sit below the caret.
   const anchorRow = Math.max(metrics.cursorY, metrics.contentBottomRow)
-  const anchorBottom = (anchorRow + 1) * rowHeight
-  const dockTop = terminalFrameHeight - keyboardLift
-  const margin = rowHeight
-  return Math.min(keyboardLift, Math.max(0, anchorBottom + margin - dockTop))
+  return Math.max(0, (anchorRow + 1) * rowHeight + rowHeight - visibleBottom)
 }
diff --git a/mobile/src/terminal/terminal-keyboard-avoidance-webview.test.ts b/mobile/src/terminal/terminal-keyboard-avoidance-webview.test.ts
index f47395be049..40a03d14592 100644
--- a/mobile/src/terminal/terminal-keyboard-avoidance-webview.test.ts
+++ b/mobile/src/terminal/terminal-keyboard-avoidance-webview.test.ts
@@ -1,8 +1,9 @@
+// @vitest-environment happy-dom
 import { Terminal } from '@xterm/xterm'
 import { describe, expect, it, vi } from 'vitest'
 import { createTerminalDocumentScope } from './document/document-scope'
-import { documentModuleSource } from './document/document-module-source.test-support'
 import { emitKeyboardAvoidanceMetrics } from './document/keyboard-avoidance-metrics'
+import { commitFitScale } from './document/fit-scale'
 import { parseTerminalKeyboardAvoidanceMetrics } from './terminal-webview-contract'
 
 // The scope object plus the metrics block, exactly as the document carries them.
@@ -13,11 +14,12 @@ import { parseTerminalKeyboardAvoidanceMetrics } from './terminal-webview-contra
  * it is handed, so a case builds one with its own terminal double and reads the notifications back
  * out of the seam it passed in.
  */
-function runMetricsOver(term: unknown): Record<string, unknown>[] {
+function runMetricsOver(term: unknown, fitScale = 1): Record<string, unknown>[] {
   const notifications: Record<string, unknown>[] = []
   const scope = createTerminalDocumentScope({
     postToHost: (message) => notifications.push(message)
   })
+  scope.currentScale = fitScale
   // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: each case's double implements the buffer members the scan reads, which is what the assertions check.
   scope.term = term as typeof scope.term
   emitKeyboardAvoidanceMetrics(scope)
@@ -190,28 +192,44 @@ describe('terminal keyboard-avoidance WebView metrics', () => {
     })
   })
 
-  it('refreshes metrics after every buffer geometry reset', () => {
-    // Four places change the buffer's geometry, and each owes a fresh emit after it: a stale
-    // content-bottom row is what lifts the keyboard over the wrong line. Read from each module's
-    // own source, so a fifth site added in a new module is not silently uncovered.
-    const blocks = [
-      ['terminal-init', 'export function resize('],
-      ['reflow', 'export function reflow('],
-      ['host-message-router', "} else if (msg.type === 'clear') {"],
-      ['text-scaling', 'export function applyTextScale(']
-    ] as const
-
-    for (const [module, opener] of blocks) {
-      const source = documentModuleSource(module)
-      const start = source.indexOf(opener)
-      expect(start, `${module} no longer carries ${opener}`).toBeGreaterThanOrEqual(0)
-      const block = source.slice(start, source.indexOf('\n}', start))
-      const emitAt = block.indexOf('emitKeyboardAvoidanceMetrics(scope)')
-      const geometryAt = block.includes('.resize(')
-        ? block.indexOf('.resize(')
-        : block.indexOf('.reset(')
-      expect(emitAt, `${module} does not emit metrics`).toBeGreaterThanOrEqual(0)
-      expect(emitAt, `${module} emits before it resizes`).toBeGreaterThan(geometryAt)
+  it('reports the row pitch as drawn, fit scale included, and none before a cell is measured', () => {
+    // Desktop display mode keeps the desktop's rows and the fit shrinks the grid by width.
+    const buffer = { cursorY: 0, viewportY: 0, type: 'normal', getLine: () => undefined }
+    const measuredTerm = {
+      buffer: { active: buffer },
+      cols: 10,
+      rows: 47,
+      _core: { _renderService: { dimensions: { css: { cell: { width: 8, height: 15 } } } } }
     }
+    const phone = runMetricsOver(measuredTerm)[0]
+    const desktop = runMetricsOver(measuredTerm, 0.5)[0]
+    const unmeasured = runMetricsOver({ buffer: { active: buffer }, cols: 10, rows: 47 })[0]
+    expect({
+      phone: phone?.rowPitch,
+      desktop: desktop?.rowPitch,
+      unmeasured: unmeasured?.rowPitch
+    }).toEqual({ phone: 15, desktop: 7.5, unmeasured: 0 })
+  })
+
+  it('reports again when a fit commits a new scale, carrying the new pitch', () => {
+    const notifications: Record<string, unknown>[] = []
+    const scope = createTerminalDocumentScope({
+      postToHost: (message) => notifications.push(message),
+      // Half the width 80 columns of 8 px need, so the fit commits a scale of 0.5.
+      viewportRect: () => ({ left: 0, top: 0, width: 320, height: 700 })
+    })
+    const buffer = { cursorY: 0, viewportY: 0, type: 'normal', getLine: () => undefined }
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the double implements every member the fit and the metrics read, which the assertion checks.
+    scope.term = {
+      buffer: { active: buffer },
+      cols: 80,
+      rows: 40,
+      element: { scrollWidth: 640 },
+      _core: { _renderService: { dimensions: { css: { cell: { width: 8, height: 15 } } } } }
+    } as unknown as typeof scope.term
+    scope.surface = document.createElement('div')
+    commitFitScale(scope, 'test', 0, 'test')
+    const metrics = notifications.filter((message) => message.type === 'keyboard-avoidance-metrics')
+    expect(metrics.at(-1)?.rowPitch).toBe(7.5)
   })
 })
diff --git a/mobile/src/terminal/terminal-live-input-affordance.test.ts b/mobile/src/terminal/terminal-live-input-affordance.test.ts
deleted file mode 100644
index 565b355d771..00000000000
--- a/mobile/src/terminal/terminal-live-input-affordance.test.ts
+++ /dev/null
@@ -1,73 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { readFileSync } from 'node:fs'
-import { readMobileSessionRouteSource } from '../session/mobile-session-route-source-family.test-support'
-
-const commandDockSource = readMobileSessionRouteSource('../session/MobileSessionCommandDock.tsx')
-const terminalRuntimeSource = readMobileSessionRouteSource(
-  '../session/use-mobile-session-terminal-runtime.ts'
-)
-const nativeChatSource = readMobileSessionRouteSource(
-  '../session/use-mobile-session-native-chat-dictation.ts'
-)
-const liveInputStatusSource = readFileSync(
-  new URL('../session/MobileTerminalLiveInputStatus.tsx', import.meta.url),
-  'utf8'
-)
-const commandInputStylesSource = readFileSync(
-  new URL('../session/mobile-session-command-input-styles.ts', import.meta.url),
-  'utf8'
-)
-const liveInputFocusSource = readFileSync(
-  new URL('./use-terminal-live-input-focus.ts', import.meta.url),
-  'utf8'
-)
-const sendCompletionGenerationSource = readFileSync(
-  new URL('../session/use-mobile-send-completion-generation.ts', import.meta.url),
-  'utf8'
-)
-
-function liveInputBarBlock(): string {
-  const start = commandDockSource.indexOf('{liveInputEnabled ? (')
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = commandDockSource.indexOf(') : (', start)
-  expect(end).toBeGreaterThan(start)
-  return commandDockSource.slice(start, end)
-}
-
-describe('terminal live input affordance', () => {
-  it('keeps the live status row wired as the keyboard focus control', () => {
-    const block = liveInputBarBlock()
-
-    expect(block).toContain('onPress={focusLiveInput}')
-    expect(block).toContain('accessibilityRole="button"')
-    expect(block).toContain('accessibilityLabel="Show keyboard for live terminal input"')
-    expect(block).toContain(
-      'accessibilityHint="Typed text is sent directly to the active terminal"'
-    )
-    expect(block).toContain('pressed && styles.liveInputFocusTargetPressed')
-    expect(block).toContain('!canSend && styles.liveInputFocusTargetDisabled')
-    expect(block).toContain('showSoftInputOnFocus')
-    expect(block).toContain('liveInputText={liveInputCapture}')
-    expect(terminalRuntimeSource).toContain('useTerminalLiveInputFocus({')
-    expect(nativeChatSource).toContain('useMobileSendCompletionGeneration({')
-    expect(nativeChatSource).toContain('onBlur: resetLiveInputFocus')
-    expect(sendCompletionGenerationSource).toContain('return () => {')
-    expect(sendCompletionGenerationSource).toContain('onBlur()')
-    expect(liveInputFocusSource).toContain('focusTerminalLiveInputTarget(inputRef.current')
-    expect(liveInputFocusSource).toContain('lifecycleIdentity,')
-    expect(liveInputFocusSource).toContain('resetLiveInputFocus')
-    expect(liveInputFocusSource).toContain('keyboardHeight: context.keyboardHeight')
-    expect(liveInputFocusSource).toContain(
-      'scheduleTerminalLiveInputFocus(timerRef, focusLiveInput)'
-    )
-  })
-
-  it('makes the live keyboard target visible instead of status-only chrome', () => {
-    expect(liveInputStatusSource).toContain("'Tap to show keyboard'")
-    expect(liveInputStatusSource).toContain("liveInputText || 'Tap to show keyboard'")
-    expect(liveInputStatusSource).toContain('ellipsizeMode="head"')
-    expect(commandInputStylesSource).toContain('backgroundColor: colors.bgRaised')
-    expect(commandInputStylesSource).toContain('borderWidth: 1')
-    expect(commandInputStylesSource).toContain('liveInputFocusTargetPressed')
-  })
-})
diff --git a/mobile/src/terminal/terminal-live-input-keyboard-reopen.test.ts b/mobile/src/terminal/terminal-live-input-keyboard-reopen.test.ts
new file mode 100644
index 00000000000..c70880c1642
--- /dev/null
+++ b/mobile/src/terminal/terminal-live-input-keyboard-reopen.test.ts
@@ -0,0 +1,17 @@
+import { describe, expect, it, vi } from 'vitest'
+
+const host = vi.hoisted(() => ({ os: 'android' }))
+vi.mock('react-native', () => ({ Platform: { OS: 'web' } }))
+vi.mock('../platform/host-os', () => ({ hostOs: () => host.os }))
+
+const { reopensFocusedInputWhenKeyboardHidden } =
+  await import('./terminal-live-input-keyboard-reopen')
+
+describe('reopening a focused live input whose keyboard is hidden', () => {
+  it("follows the phone's OS on the page, which runs as web", () => {
+    host.os = 'android'
+    expect(reopensFocusedInputWhenKeyboardHidden()).toBe(true)
+    host.os = 'ios'
+    expect(reopensFocusedInputWhenKeyboardHidden()).toBe(false)
+  })
+})
diff --git a/mobile/src/terminal/terminal-live-input-keyboard-reopen.ts b/mobile/src/terminal/terminal-live-input-keyboard-reopen.ts
new file mode 100644
index 00000000000..4fc6cf57e1a
--- /dev/null
+++ b/mobile/src/terminal/terminal-live-input-keyboard-reopen.ts
@@ -0,0 +1,6 @@
+import { hostOs } from '../platform/host-os'
+
+/** Android keeps a hidden TextInput focused after Back closes the IME, so focus must blur first. */
+export function reopensFocusedInputWhenKeyboardHidden(): boolean {
+  return hostOs() === 'android'
+}
diff --git a/mobile/src/terminal/terminal-live-preedit-mirror.ts b/mobile/src/terminal/terminal-live-preedit-mirror.ts
index 29c903f4366..2bc165a625c 100644
--- a/mobile/src/terminal/terminal-live-preedit-mirror.ts
+++ b/mobile/src/terminal/terminal-live-preedit-mirror.ts
@@ -21,9 +21,10 @@ export type TerminalLiveMirrorStep = {
  * ever classified. That is what makes this hold for input methods nobody tested.
  *
  * `composing` is undefined only where the platform reports no range at all —
- * today React Native Android. The fallback holds the trailing non-ASCII run: a
- * conversion IME always leaves one and ASCII keeps its zero-latency echo. It
- * enumerates nothing, and it cannot see an ASCII preedit — only a report can.
+ * today React Native Android and the page on Android. The fallback holds the
+ * trailing non-ASCII run: a conversion IME always leaves one and ASCII keeps its
+ * zero-latency echo. It enumerates nothing, and it cannot see an ASCII preedit —
+ * only a report can.
  */
 function heldPreeditLength(
   fieldCodePoints: readonly string[],
diff --git a/mobile/src/terminal/terminal-live-text-commit.test.ts b/mobile/src/terminal/terminal-live-text-commit.test.ts
index 7c41cb1c5b8..ac177542be8 100644
--- a/mobile/src/terminal/terminal-live-text-commit.test.ts
+++ b/mobile/src/terminal/terminal-live-text-commit.test.ts
@@ -127,14 +127,14 @@ describe('terminal live accessory local edit text', () => {
     const fieldText = `${'a'.repeat(100_000)}🙂`
     const originalIterator = String.prototype[Symbol.iterator]
     let visits = 0
-    const iterator = vi
-      .spyOn(String.prototype, Symbol.iterator)
-      .mockImplementation(function* (this: string) {
-        for (const codePoint of originalIterator.call(this)) {
-          visits += 1
-          yield codePoint
-        }
-      })
+    const iterator = vi.spyOn(String.prototype, Symbol.iterator).mockImplementation(function* (
+      this: string
+    ) {
+      for (const codePoint of originalIterator.call(this)) {
+        visits += 1
+        yield codePoint
+      }
+    })
     let result: string
     try {
       result = getTerminalLiveAccessoryLocalEditText({ localEdit: 'backspace', fieldText })
diff --git a/mobile/src/terminal/terminal-viewport-refit.test.ts b/mobile/src/terminal/terminal-viewport-refit.test.ts
index 7a54c70c868..51a349175be 100644
--- a/mobile/src/terminal/terminal-viewport-refit.test.ts
+++ b/mobile/src/terminal/terminal-viewport-refit.test.ts
@@ -1,58 +1,15 @@
-import { readFileSync } from 'node:fs'
 import { describe, expect, it } from 'vitest'
 import type { RpcResponse } from '../transport/types'
-import { readMobileSessionRouteSource } from '../session/mobile-session-route-source-family.test-support'
 import { terminalViewportUpdate } from './mobile-terminal-operations'
 import {
   isTerminalViewportRefitTargetCurrent,
   reduceTerminalFrameHeightRefit,
   resolveTerminalUpdateViewportCapability,
   type TerminalFrameHeightRefitEvent,
-  type TerminalFrameHeightRefitState,
-  type TerminalUpdateViewportCapability
+  type TerminalFrameHeightRefitState
 } from './terminal-viewport-refit-state'
 
-const hookSource = readFileSync(new URL('./terminal-viewport-refit.ts', import.meta.url), 'utf8')
-const sessionSource = [
-  readMobileSessionRouteSource('../session/use-mobile-session-keyboard-state.ts'),
-  readMobileSessionRouteSource('../session/MobileSessionActiveContent.tsx')
-].join('\n')
-
 describe('terminal viewport refit', () => {
-  it('refits when the window dimensions change (fold/unfold, rotation)', () => {
-    // Why: a PTY fitted on the folded cover screen must be re-measured when
-    // the window grows, or the terminal renders in a fraction of the display.
-    expect(hookSource).toContain('useWindowDimensions()')
-    const start = hookSource.indexOf('const { width: windowWidth, height: windowHeight }')
-    expect(start).toBeGreaterThanOrEqual(0)
-    const resizeEffect = hookSource.slice(start)
-    expect(resizeEffect).toContain('viewportMeasuredRef.current = false')
-    expect(resizeEffect).toContain('scheduleViewportRefit()')
-    expect(resizeEffect).toContain(
-      '[windowWidth, windowHeight, viewportMeasuredRef, scheduleViewportRefit]'
-    )
-  })
-
-  it('still refits when the tab strip toggles visibility', () => {
-    const start = hookSource.indexOf('const prevTabStripVisibleRef')
-    expect(start).toBeGreaterThanOrEqual(0)
-    const tabEffect = hookSource.slice(start, hookSource.indexOf('useWindowDimensions()'))
-    expect(tabEffect).toContain('viewportMeasuredRef.current = false')
-    expect(tabEffect).toContain('scheduleViewportRefit()')
-  })
-
-  it('refits the PTY when terminal text scale changes', () => {
-    // Why: mobile text size must change the real PTY grid, not just scale pixels
-    // in the WebView, or wrapped CLI output diverges from what the shell sees.
-    const start = hookSource.indexOf('const prevTextScaleRef = useRef(textScale)')
-    expect(start).toBeGreaterThanOrEqual(0)
-    const textScaleEffect = hookSource.slice(start, start + 600)
-    expect(textScaleEffect).toContain('prevTextScaleRef.current === textScale')
-    expect(textScaleEffect).toContain('viewportMeasuredRef.current = false')
-    expect(textScaleEffect).toContain('scheduleViewportRefit()')
-    expect(textScaleEffect).toContain('[textScale, viewportMeasuredRef, scheduleViewportRefit]')
-  })
-
   it('coalesces keyboard-visible frame-height churn into one refit after close', () => {
     let state: TerminalFrameHeightRefitState = {
       frameHeight: 600,
@@ -83,17 +40,6 @@ describe('terminal viewport refit', () => {
     expect(refitCount).toBe(2)
   })
 
-  it('routes imperative height notifications through the keyboard-aware reducer', () => {
-    const start = hookSource.indexOf('const notifyFrameHeightRefitEvent = useCallback(')
-    expect(start).toBeGreaterThanOrEqual(0)
-    const notifier = hookSource.slice(start, start + 1_300)
-    expect(notifier).toContain('reduceTerminalFrameHeightRefit(')
-    expect(notifier).toContain("{ type: 'frame-height', height }")
-    expect(notifier).toContain("{ type: 'keyboard-visibility', visible }")
-    expect(notifier).toContain('viewportMeasuredRef.current = false')
-    expect(notifier).toContain('scheduleViewportRefit({ heightOriginated: true })')
-  })
-
   it('re-defers a height refit if the keyboard reopens before the debounce fires', () => {
     // Settle while the keyboard is up -> deferred (pending), no refit.
     let r = reduceTerminalFrameHeightRefit(
@@ -125,93 +71,6 @@ describe('terminal viewport refit', () => {
     expect(ran.state.pending).toBe(false)
   })
 
-  it('re-checks the keyboard at fire time only for height-originated refits', () => {
-    const start = hookSource.indexOf('refitTimerRef.current = setTimeout(')
-    expect(start).toBeGreaterThanOrEqual(0)
-    const timerBody = hookSource.slice(start, start + 900)
-    // The height flag scopes the guard; forced/width refits stay unguarded.
-    expect(timerBody).toContain('if (heightOriginatedRefitRef.current)')
-    expect(timerBody).toContain("type: 'refit-committed'")
-    expect(timerBody).toContain('if (!decision.shouldRefit)')
-  })
-
-  it('suppresses refits while native chat covers the active terminal', () => {
-    // Why: native chat renders the transcript, not the grid — a refit there would
-    // reflow the desktop PTY to phone dims the user never sees.
-    const timerStart = hookSource.indexOf('refitTimerRef.current = setTimeout(')
-    const coveredCheck = hookSource.indexOf('if (nativeChatCoveredRef.current)', timerStart)
-    const measureIndex = hookSource.indexOf('measureFitDimensions', timerStart)
-    expect(timerStart).toBeGreaterThanOrEqual(0)
-    expect(coveredCheck).toBeGreaterThan(timerStart)
-    expect(measureIndex).toBeGreaterThan(coveredCheck)
-    expect(sessionSource).toContain('nativeChatCoveredRef: showNativeChatRef')
-  })
-
-  it('is wired into the session screen', () => {
-    expect(sessionSource).toContain('useTerminalViewportRefit({')
-    expect(sessionSource).toContain('tabStripVisible: terminals.length > 1')
-    expect(sessionSource).toContain('textScale: terminalTextScale')
-    expect(sessionSource).toContain('connState,')
-    expect(sessionSource).toContain('notifyTerminalFrameHeight(nextHeight)')
-    // One seam for both facts: on the page they come apart, because the shell shortens the WebView
-    // and the keyboard covers nothing the screen has to lift for.
-    expect(sessionSource).toContain('const softKeyboard = useSoftKeyboard()')
-    expect(sessionSource).toContain('notifyKeyboardVisibility(softKeyboard.visible)')
-    expect(sessionSource).toContain('setKeyboardHeight(softKeyboard.height)')
-  })
-
-  it('does not rerender SessionScreen for frame-height-only layout changes', () => {
-    // The imperative notifier keeps a dock-settling burst off React's render path.
-    expect(sessionSource).not.toContain('setTerminalFrameHeight')
-    expect(sessionSource).not.toContain('const [terminalFrameHeight,')
-  })
-
-  it('defers height-only window resizes while the keyboard is visible', () => {
-    const start = hookSource.indexOf('const prevWindowDimsRef')
-    const windowEffect = hookSource.slice(start, start + 1_100)
-    expect(windowEffect).toContain(
-      'prev.width === windowWidth && frameHeightRefitStateRef.current.keyboardVisible'
-    )
-  })
-
-  it('forces a refit on iOS foreground and connection recovery', () => {
-    const foregroundEffect = hookSource.slice(
-      hookSource.indexOf("if (Platform.OS !== 'ios')"),
-      hookSource.indexOf('const previousConnStateRef')
-    )
-    const reconnectEffect = hookSource.slice(
-      hookSource.indexOf('const previousConnStateRef'),
-      hookSource.indexOf('disposedRef.current = false')
-    )
-
-    expect(foregroundEffect).toContain("AppState.addEventListener('change'")
-    expect(foregroundEffect).toContain('viewportMeasuredRef.current = false')
-    expect(foregroundEffect).toContain('scheduleForcedViewportRefit()')
-    expect(reconnectEffect).toContain("connState !== 'connected'")
-    expect(reconnectEffect).toContain('viewportMeasuredRef.current = false')
-    expect(reconnectEffect).toContain('scheduleForcedViewportRefit()')
-  })
-
-  it('bypasses the equal-dimensions guard for resume and reconnect refits', () => {
-    expect(hookSource).toContain('const forceRefit = forceNextRefitRef.current')
-    expect(hookSource).toContain(
-      'if (!forceRefit && prev && prev.cols === dims.cols && prev.rows === dims.rows)'
-    )
-    const forceRead = hookSource.indexOf('const forceRefit = forceNextRefitRef.current')
-    const updateViewport = hookSource.indexOf('terminalViewportUpdate.request(rpc,')
-    expect(forceRead).toBeGreaterThanOrEqual(0)
-    expect(updateViewport).toBeGreaterThan(forceRead)
-  })
-
-  it('prefers the in-place updateViewport RPC over resubscribe', () => {
-    const rpcIndex = hookSource.indexOf('terminalViewportUpdate.request(rpc,')
-    const cacheUpdateIndex = hookSource.indexOf('updateTerminalSubscriptionViewport(handle, dims)')
-    const resubscribeIndex = hookSource.indexOf('subscribeToTerminal(handle)')
-    expect(rpcIndex).toBeGreaterThanOrEqual(0)
-    expect(cacheUpdateIndex).toBeGreaterThan(rpcIndex)
-    expect(resubscribeIndex).toBeGreaterThan(rpcIndex)
-  })
-
   it('falls back to legacy resubscribe when an older desktop lacks updateViewport', () => {
     const unsupported = {
       id: 'old-host',
@@ -226,52 +85,8 @@ describe('terminal viewport refit', () => {
         error: { code: 'temporary_failure', message: 'retryable' }
       })
     ).toBe('unknown')
-
-    let capability: TerminalUpdateViewportCapability = 'unknown'
-    let probeCount = 0
-    for (let refit = 0; refit < 10; refit += 1) {
-      if (capability === 'unsupported') {
-        continue
-      }
-      probeCount += 1
-      capability = resolveTerminalUpdateViewportCapability(unsupported)
-    }
-    expect(probeCount).toBe(1)
-
-    const responseCheckIndex = hookSource.indexOf('if (outcome?.updated)')
-    const unsubscribeIndex = hookSource.indexOf('unsubscribeTerminal(handle)', responseCheckIndex)
-    const subscribeIndex = hookSource.indexOf('subscribeToTerminal(handle)', unsubscribeIndex)
-    expect(responseCheckIndex).toBeGreaterThanOrEqual(0)
-    expect(unsubscribeIndex).toBeGreaterThan(responseCheckIndex)
-    expect(subscribeIndex).toBeGreaterThan(unsubscribeIndex)
-    expect(hookSource).toContain("updateViewportCapabilityRef.current !== 'unsupported'")
-    expect(hookSource).toContain("updateViewportCapabilityRef.current = 'unknown'")
-  })
-
-  it('reflows the local xterm scrollback after a successful updateViewport', () => {
-    // Why: updateViewport may only record an informational mobile viewport in
-    // desktop mode. Reflow local scrollback only after the server says it
-    // actually applied phone-fit to the PTY.
-    const appliedIndex = hookSource.indexOf('if (outcome.applied)')
-    const reflowIndex = hookSource.indexOf('ref.reflow(dims.cols, dims.rows)')
-    const cacheUpdateIndex = hookSource.indexOf('updateTerminalSubscriptionViewport(handle, dims)')
-    // Assert each anchor exists before ordering: a missing marker yields -1 and would
-    // let the ordering comparisons pass vacuously.
-    expect(appliedIndex).toBeGreaterThanOrEqual(0)
-    expect(cacheUpdateIndex).toBeGreaterThanOrEqual(0)
-    expect(reflowIndex).toBeGreaterThanOrEqual(0)
-    expect(reflowIndex).toBeGreaterThan(appliedIndex)
-    expect(reflowIndex).toBeGreaterThan(cacheUpdateIndex)
-  })
-
-  it('checks refit freshness after updateViewport resolves before side effects', () => {
-    // Why: rapid dock/sidebar resizing can complete RPCs out of order; a stale
-    // response must not update the viewport cache or locally reflow the old dims.
-    const responseIndex = hookSource.indexOf('terminalViewportUpdate.request(rpc,')
-    const postRpcCurrentIndex = hookSource.indexOf('if (!isCurrentTarget())', responseIndex)
-    const cacheUpdateIndex = hookSource.indexOf('updateTerminalSubscriptionViewport(handle, dims)')
-    expect(postRpcCurrentIndex).toBeGreaterThan(responseIndex)
-    expect(postRpcCurrentIndex).toBeLessThan(cacheUpdateIndex)
+    // A method_not_found refusal latches the capability, so a refit stops re-probing.
+    expect(resolveTerminalUpdateViewportCapability(unsupported)).toBe('unsupported')
   })
 
   it('only treats updateViewport as applied when the runtime updated the subscriber', () => {
diff --git a/mobile/src/terminal/terminal-viewport-refit.ts b/mobile/src/terminal/terminal-viewport-refit.ts
index 50388ee2d7f..533b5f8d51f 100644
--- a/mobile/src/terminal/terminal-viewport-refit.ts
+++ b/mobile/src/terminal/terminal-viewport-refit.ts
@@ -3,6 +3,7 @@ import { AppState, Platform, useWindowDimensions, type AppStateStatus } from 're
 import type { RpcClient } from '../transport/rpc-client'
 import type { ConnectionState } from '../transport/types'
 import type { TerminalWebViewHandle } from './TerminalWebView'
+import type { TerminalFrame } from './terminal-webview-messages'
 import { shouldRecoverTerminalOnAppStateChange } from './terminal-foreground-recovery'
 import { terminalViewportUpdate } from './mobile-terminal-operations'
 import {
@@ -19,7 +20,8 @@ export type TerminalViewportDims = { cols: number; rows: number }
 type TerminalViewportRefitOptions = {
   activeHandleRef: RefObject<string | null>
   terminalRefs: RefObject<Map<string, TerminalWebViewHandle>>
-  terminalFrameHeightRef: RefObject<number>
+  // The terminal frame React Native laid out, unrounded; null until its first layout.
+  terminalFrameRef: RefObject<TerminalFrame | null>
   viewportRef: RefObject<TerminalViewportDims | null>
   viewportMeasuredRef: RefObject<boolean>
   // Why: while native chat covers the active terminal, a refit would push phone dims into a PTY nobody on this device is viewing.
@@ -31,25 +33,16 @@ type TerminalViewportRefitOptions = {
   tabStripVisible: boolean
   // Why: text size (font scale); changing it changes cell size, so the PTY must be re-fitted to a new column count.
   textScale: number
-  // Why: measured frame width; panel dock/undock or sidebar resize changes it with no window/tab change, so it re-fits the PTY.
-  terminalFrameWidth: number
   unsubscribeTerminal: (handle: string) => void
   subscribeToTerminal: (handle: string) => void
 }
 
-type TerminalViewportRefitNotifications = {
-  notifyTerminalFrameHeight: (height: number) => void
-  notifyKeyboardVisibility: (visible: boolean) => void
-}
-
 // Why: re-measure on layout changes outside the subscribe path (tab strip, fold/rotate/resize), or a PTY renders "cut in half" (#4579).
-export function useTerminalViewportRefit(
-  options: TerminalViewportRefitOptions
-): TerminalViewportRefitNotifications {
+export function useTerminalViewportRefit(options: TerminalViewportRefitOptions) {
   const {
     activeHandleRef,
     terminalRefs,
-    terminalFrameHeightRef,
+    terminalFrameRef,
     viewportRef,
     viewportMeasuredRef,
     nativeChatCoveredRef,
@@ -59,7 +52,6 @@ export function useTerminalViewportRefit(
     connState,
     tabStripVisible,
     textScale,
-    terminalFrameWidth,
     unsubscribeTerminal,
     subscribeToTerminal
   } = options
@@ -121,10 +113,12 @@ export function useTerminalViewportRefit(
             currentRunSeq: refitRunSeqRef.current
           })
         void (async () => {
-          const dims = await ref.measureFitDimensions(terminalFrameHeightRef.current || undefined)
+          await ref.awaitReady()
           if (!isCurrentTarget()) {
             return
           }
+          const frame = terminalFrameRef.current
+          const dims = frame ? ref.fitDimensions(frame) : null
           if (!dims) {
             return
           }
@@ -155,7 +149,7 @@ export function useTerminalViewportRefit(
                 rpc.updateTerminalSubscriptionViewport(handle, dims)
                 if (outcome.applied) {
                   // Why: updateViewport re-streams only the visible screen, so local scrollback stays wrapped at the old width — reflow it locally.
-                  ref.reflow(dims.cols, dims.rows)
+                  ref.reflow(dims.cols, dims.rows, frame)
                 }
                 return
               }
@@ -175,7 +169,7 @@ export function useTerminalViewportRefit(
     [
       activeHandleRef,
       terminalRefs,
-      terminalFrameHeightRef,
+      terminalFrameRef,
       viewportRef,
       viewportMeasuredRef,
       nativeChatCoveredRef,
@@ -230,16 +224,26 @@ export function useTerminalViewportRefit(
     scheduleViewportRefit()
   }, [textScale, viewportMeasuredRef, scheduleViewportRefit])
 
-  // Why: panel dock/undock or sidebar resize changes frame width with no window/tab change, so the cached viewport goes stale.
-  const prevFrameWidthRef = useRef(terminalFrameWidth)
-  useEffect(() => {
-    if (prevFrameWidthRef.current === terminalFrameWidth) {
+  // Why: panel dock/undock or a sidebar resize changes the width with no window or tab change; a
+  // width that still fits the PTY's grid (sub-pixel layout jitter) needs no refit.
+  const notifyTerminalFrameWidth = useCallback(() => {
+    const handle = activeHandleRef.current
+    const frame = terminalFrameRef.current
+    const fit = handle && frame ? terminalRefs.current.get(handle)?.fitDimensions(frame) : null
+    const grid = viewportRef.current
+    if (fit && grid && fit.cols === grid.cols && fit.rows === grid.rows) {
       return
     }
-    prevFrameWidthRef.current = terminalFrameWidth
     viewportMeasuredRef.current = false
     scheduleViewportRefit()
-  }, [terminalFrameWidth, viewportMeasuredRef, scheduleViewportRefit])
+  }, [
+    activeHandleRef,
+    terminalFrameRef,
+    terminalRefs,
+    viewportRef,
+    viewportMeasuredRef,
+    scheduleViewportRefit
+  ])
 
   const notifyFrameHeightRefitEvent = useCallback(
     (event: TerminalFrameHeightRefitEvent) => {
@@ -263,6 +267,18 @@ export function useTerminalViewportRefit(
     [notifyFrameHeightRefitEvent]
   )
 
+  // Why: a renderer swap or pixel-ratio change gives the same grid a different cell box.
+  const notifyTerminalCellBoxChange = useCallback(
+    (handle: string) => {
+      if (handle !== activeHandleRef.current) {
+        return
+      }
+      viewportMeasuredRef.current = false
+      scheduleViewportRefit()
+    },
+    [activeHandleRef, viewportMeasuredRef, scheduleViewportRefit]
+  )
+
   useEffect(() => {
     if (Platform.OS !== 'ios') {
       return
@@ -310,5 +326,10 @@ export function useTerminalViewportRefit(
     }
   }, [])
 
-  return { notifyTerminalFrameHeight, notifyKeyboardVisibility }
+  return {
+    notifyTerminalFrameHeight,
+    notifyTerminalFrameWidth,
+    notifyKeyboardVisibility,
+    notifyTerminalCellBoxChange
+  }
 }
diff --git a/mobile/src/terminal/terminal-web-document-mount.test.ts b/mobile/src/terminal/terminal-web-document-mount.test.ts
index 1ce4aa3d40b..3849a02a9e7 100644
--- a/mobile/src/terminal/terminal-web-document-mount.test.ts
+++ b/mobile/src/terminal/terminal-web-document-mount.test.ts
@@ -3,6 +3,8 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { createElement } from 'react'
 import { act, create, type ReactTestRenderer } from 'react-test-renderer'
 import { terminalDocumentDouble } from './document/document-terminal-double.test-support'
+import type { TerminalDocumentTerminal } from './document/document-terminal-shape'
+import type { TerminalWebViewCommand } from './terminal-webview-messages'
 import { TERMINAL_DOCUMENT_MARKUP } from './terminal-webview-html'
 
 /**
@@ -18,16 +20,25 @@ import { TERMINAL_DOCUMENT_MARKUP } from './terminal-webview-html'
  */
 /** Set for the length of one case; the factory throws it instead of building a document. */
 let startThrows: Error | null = null
+/** The text scale each document the factory built was started at, in order. */
+const startedScales: number[] = []
+/** Whether each of those documents was told to build its terminal before ready. */
+const startedBuilds: boolean[] = []
+/** Set for the length of one case; the document builds its terminals here instead of xterm. */
+let gridTerminal: (() => TerminalDocumentTerminal) | null = null
 
 vi.mock('./document/create-terminal-document', async (importOriginal) => {
   const actual = await importOriginal<typeof import('./document/create-terminal-document')>()
   return {
     ...actual,
     createTerminalDocument: (host: Parameters<typeof actual.createTerminalDocument>[0]) => {
+      startedScales.push(host?.start?.().textScale ?? 1)
+      startedBuilds.push(host?.start?.().shown ?? true)
       if (startThrows) {
         throw startThrows
       }
-      return actual.createTerminalDocument(host)
+      const grid = gridTerminal
+      return actual.createTerminalDocument(grid ? { ...host, createTerminal: grid } : host)
     }
   }
 })
@@ -61,9 +72,13 @@ const settle = () => new Promise((resolve) => setTimeout(resolve, 50))
 const INIT = { type: 'init', cols: 80, rows: 24, initialData: '', preserveScroll: false } as const
 
 let renderer: ReactTestRenderer | null = null
+let restoreTransform: (() => void) | null = null
 
 beforeEach(() => {
   startThrows = null
+  startedScales.length = 0
+  startedBuilds.length = 0
+  gridTerminal = null
   document.body.innerHTML = ''
   document.head.innerHTML = ''
 })
@@ -71,6 +86,8 @@ beforeEach(() => {
 afterEach(() => {
   act(() => renderer?.unmount())
   renderer = null
+  restoreTransform?.()
+  restoreTransform = null
 })
 
 describe('a stopped document takes its engines with it', () => {
@@ -244,3 +261,269 @@ describe('the component names the cause of a start that threw', () => {
     expect(engineErrors).toEqual([])
   })
 })
+
+describe('the text scale a document is built at', () => {
+  it('is the one the view mounted with, for a reloaded document too, as on native', () => {
+    const host = plantHost()
+    startThrows = new Error('engine missing')
+    act(() => {
+      renderer = create(createElement(TerminalWebView, { textScale: 1.25 }), {
+        createNodeMock: () => host
+      })
+    })
+    act(() => renderer?.update(createElement(TerminalWebView, { textScale: 1.5 })))
+    startThrows = null
+    act(() => {
+      renderer?.root.find((node) => node.props.accessibilityRole === 'button').props.onPress()
+    })
+    expect(startedScales).toEqual([1.25, 1.25])
+  })
+
+  it('builds nothing before ready on the page for a view hidden when it mounted', () => {
+    const host = plantHost()
+    act(() => {
+      renderer = create(createElement(TerminalWebView, { shownAtMount: false }), {
+        createNodeMock: () => host
+      })
+    })
+    expect(startedBuilds).toEqual([false])
+  })
+})
+
+const CELL = { width: 7.5, height: 15 }
+const FIT_390 = 390 / (7.5 * 55)
+
+/**
+ * A laid-out 55x40 grid whose cells scale with the font, as xterm's do, or read 0 while `cells`
+ * says they cannot be measured: xterm's DOM measure on a `display:none` host, where no
+ * OffscreenCanvas is available.
+ */
+function gridDouble(cells: { measurable: boolean }): TerminalDocumentTerminal {
+  const terminal = terminalDocumentDouble().terminal
+  const cell = () => {
+    const k = cells.measurable ? terminal.options.fontSize / 13 : 0
+    return { width: CELL.width * k, height: CELL.height * k }
+  }
+  const grid = Object.assign(terminal, {
+    cols: 55,
+    rows: 40,
+    _core: {
+      _renderService: {
+        get dimensions() {
+          return { css: { cell: cell() } }
+        }
+      }
+    }
+  })
+  grid.resize = (cols: number, rows: number) => {
+    grid.cols = cols
+    grid.rows = rows
+  }
+  return grid
+}
+
+/**
+ * A mounted page document over a grid, whose host box the case sets and pushes as RN layout does:
+ * react-native-web's `onLayout` reports a `display:none` screen as 0x0 and its return as the old box.
+ */
+async function mountedOverGrid({ laidOutFirst = true } = {}) {
+  const cells = { measurable: true }
+  const grids: TerminalDocumentTerminal[] = []
+  gridTerminal = () => {
+    const grid = gridDouble(cells)
+    grids.push(grid)
+    return grid
+  }
+  const host = plantHost()
+  let box = { width: 390, height: 600 }
+  host.getBoundingClientRect = () => new DOMRect(0, 134, box.width, box.height)
+  const mounted = mountTerminalWebDocument(host, () => {})
+  // Every surface transform the document writes; a refit writes one even when nothing moved. Read
+  // off the style prototype because an init swaps the surface element for a fresh one.
+  const scales: number[] = []
+  const proto: object = Object.getPrototypeOf(host.style)
+  const own = Object.getOwnPropertyDescriptor(proto, 'transform')!
+  const write = own.set!
+  Object.defineProperty(proto, 'transform', {
+    ...own,
+    set(this: CSSStyleDeclaration, value: string) {
+      const scale = /scale\(([^)]*)\)/.exec(String(value))
+      if (scale) {
+        scales.push(Number(scale[1]))
+      }
+      write.call(this, value)
+    }
+  })
+  restoreTransform = () => Object.defineProperty(proto, 'transform', own)
+  let id = 0
+  const send = (command: TerminalWebViewCommand) => mounted.send({ ...command, id: ++id })
+  const layOut = (width: number, height: number) => {
+    box = { width, height }
+    mounted.notifyViewport()
+  }
+  if (laidOutFirst) {
+    layOut(390, 600)
+  }
+  // The app's init carries the frame it laid out.
+  send({
+    type: 'init',
+    cols: 55,
+    rows: 40,
+    initialData: '',
+    preserveScroll: false,
+    frame: { width: 390, height: 600 }
+  })
+  await framesUntil(() => scales.at(-1) === FIT_390)
+  return { mounted, scales, send, layOut, cells, grid: () => grids.at(-1)! }
+}
+
+const nextFrame = () => new Promise<void>((resolve) => requestAnimationFrame(() => resolve()))
+
+async function framesUntil(done: () => boolean, frames = 30) {
+  for (let frame = 0; frame < frames && !done(); frame++) {
+    await nextFrame()
+  }
+  expect(done()).toBe(true)
+}
+
+describe("the page pushes its terminal frame's box into the document", () => {
+  it('refits on a box RN laid out, through the host View, with no ResizeObserver of its own', () => {
+    let observers = 0
+    vi.stubGlobal(
+      'ResizeObserver',
+      class {
+        constructor() {
+          observers += 1
+        }
+        observe() {}
+        disconnect() {}
+      }
+    )
+    try {
+      const host = plantHost()
+      let height = 600
+      host.getBoundingClientRect = () => new DOMRect(0, 134, 390, height)
+      act(() => {
+        renderer = create(createElement(TerminalWebView, {}), { createNodeMock: () => host })
+      })
+      const surface = host.querySelector<HTMLElement>('#terminal-surface')!
+      expect(surface.style.transform).toBe('')
+      const laidOut = renderer!.root.findAll((node) => typeof node.props.onLayout === 'function')
+      expect(laidOut).toHaveLength(1)
+      height = 560
+      act(() => {
+        laidOut[0]!.props.onLayout({ nativeEvent: { layout: { width: 390, height: 560 } } })
+      })
+      expect(surface.style.transform).toContain('scale(1)')
+      expect(observers).toBe(0)
+    } finally {
+      vi.unstubAllGlobals()
+    }
+  })
+
+  it('keeps pan and zoom across hide and show, and refits when the box really changes', async () => {
+    // Native never refits on navigation: its WebView keeps its size while another screen covers it.
+    const { mounted, scales, layOut } = await mountedOverGrid()
+    const fitted = scales.length
+    layOut(0, 0)
+    layOut(390, 600)
+    await nextFrame()
+    await nextFrame()
+    expect(scales).toHaveLength(fitted)
+
+    layOut(300, 600)
+    await framesUntil(() => scales.at(-1) === 300 / (7.5 * 55))
+    mounted.dispose()
+  })
+
+  it('keeps pan and zoom when RN laid the host out before the mount existed', async () => {
+    // The first layout can land before the document does; the box it reported is still the box.
+    const { mounted, scales, layOut } = await mountedOverGrid({ laidOutFirst: false })
+    const fitted = scales.length
+    layOut(0, 0)
+    layOut(390, 600)
+    await nextFrame()
+    await nextFrame()
+    expect(scales).toHaveLength(fitted)
+    mounted.dispose()
+  })
+
+  it('holds a fit asked for while hidden and lands it on show', async () => {
+    const { mounted, scales, send, layOut } = await mountedOverGrid()
+    layOut(0, 0)
+    send({ type: 'resize', cols: 80, rows: 40, frame: null })
+    await nextFrame()
+    await nextFrame()
+    expect(scales.at(-1)).toBe(FIT_390)
+    layOut(390, 600)
+    await framesUntil(() => scales.at(-1) === 390 / (7.5 * 80))
+    // The held fit is spent: a second hide and show must not run it again over the user's pan.
+    const landed = scales.length
+    layOut(0, 0)
+    layOut(390, 600)
+    await nextFrame()
+    await nextFrame()
+    expect(scales).toHaveLength(landed)
+    mounted.dispose()
+  })
+
+  it('never commits a blind fit when the grid cannot be measured while hidden', async () => {
+    // A reconnect re-inits under a covering screen, where xterm's DOM measure reads every cell as 0.
+    const { mounted, scales, send, layOut, cells } = await mountedOverGrid()
+    layOut(0, 0)
+    const shown = scales.length
+    cells.measurable = false
+    send({ type: 'init', cols: 55, rows: 40, initialData: '', preserveScroll: false, frame: null })
+    // Past the retry loop's 60-frame cap, where a fit that did not wait commits scale 1.
+    for (let frame = 0; frame < 75; frame++) {
+      await nextFrame()
+    }
+    expect(scales.slice(shown)).not.toContain(1)
+    cells.measurable = true
+    layOut(390, 600)
+    await framesUntil(() => scales.at(-1) === FIT_390)
+    mounted.dispose()
+  })
+
+  it('fits a text scale too large to resize the grid while visible', async () => {
+    const { mounted, scales, send, layOut, grid } = await mountedOverGrid()
+    layOut(280, 600)
+    // The app's refit for the new width sends its grid with the frame.
+    send({ type: 'resize', cols: 55, rows: 40, frame: { width: 280, height: 600 } })
+    await framesUntil(() => scales.at(-1) === 280 / (7.5 * 55))
+    // fontPxForScale(2) = 26 px: 280 / (7.5 x 2) = 18 columns, under MIN_FIT_COLS, so no resize.
+    send({ type: 'set-font-scale', fontScale: 2 })
+    await framesUntil(() => scales.at(-1) === 280 / (15 * 55))
+    expect(grid().cols).toBe(55)
+    mounted.dispose()
+  })
+
+  it('refits on show after a text scale too large to resize the grid while hidden', async () => {
+    const { mounted, scales, send, layOut } = await mountedOverGrid()
+    layOut(280, 600)
+    // The app's refit for the new width sends its grid with the frame.
+    send({ type: 'resize', cols: 55, rows: 40, frame: { width: 280, height: 600 } })
+    await framesUntil(() => scales.at(-1) === 280 / (7.5 * 55))
+    layOut(0, 0)
+    // fontPxForScale(2) = 26 px: 280 / (7.5 x 2) = 18 columns, under MIN_FIT_COLS, so no resize.
+    send({ type: 'set-font-scale', fontScale: 2 })
+    await nextFrame()
+    await nextFrame()
+    layOut(280, 600)
+    await framesUntil(() => scales.at(-1) === 280 / (15 * 55))
+    mounted.dispose()
+  })
+
+  it('resizes the grid to a text scale changed while hidden, and fits it on show', async () => {
+    const { mounted, scales, send, layOut, grid } = await mountedOverGrid()
+    layOut(0, 0)
+    send({ type: 'set-font-scale', fontScale: 0.8 })
+    // fontPxForScale(0.8) = 10 px: 390 / (7.5 x 10/13) = 67 columns, where stale cells give 52.
+    await framesUntil(() => grid().cols === 67)
+    const hidden = scales.length
+    layOut(390, 600)
+    await framesUntil(() => scales.length > hidden)
+    expect(scales.at(-1)).toBe(1)
+    mounted.dispose()
+  })
+})
diff --git a/mobile/src/terminal/terminal-web-document-mount.ts b/mobile/src/terminal/terminal-web-document-mount.ts
index c1b13e38657..b16afa80095 100644
--- a/mobile/src/terminal/terminal-web-document-mount.ts
+++ b/mobile/src/terminal/terminal-web-document-mount.ts
@@ -2,6 +2,7 @@ import { Terminal } from '@xterm/xterm'
 import { Unicode11Addon } from '@xterm/addon-unicode11'
 import { WebglAddon } from '@xterm/addon-webgl'
 import type { TerminalDocumentTerminal } from './document/document-terminal-shape'
+import type { TerminalDocumentStart, TerminalViewportChange } from './document/document-host-seams'
 import { TERMINAL_DOCUMENT_ELEMENT_STYLE, TERMINAL_DOCUMENT_MARKUP } from './terminal-webview-html'
 import { scopeStyleToHost } from '../style-scoping/document-style-scoping'
 import { XTERM_ENGINE_CSS } from './terminal-webview-engine-css.generated'
@@ -25,6 +26,8 @@ import type { TerminalWebViewCommand } from './terminal-webview-messages'
 export type TerminalWebDocument = {
   /** Hands one host command to the document, as a bridge frame does inside the WebView. */
   send: (command: TerminalWebViewCommand & { id: number }) => void
+  /** RN laid the host out again: the page's counterpart of the WebView's window resize. */
+  notifyViewport: () => void
   dispose: () => void
 }
 
@@ -95,19 +98,23 @@ function createPageWebglAddon(onFallback: (reason: string) => void) {
  * Synchronous, because the factory is a static import and building a document is a function call.
  * A caller's cleanup can therefore never arrive before there is something to clean up.
  */
+/** What the view fixed when it mounted, for every document it builds. */
 export function mountTerminalWebDocument(
   host: HTMLElement,
-  receive: (message: Record<string, unknown>) => void
+  receive: (message: Record<string, unknown>) => void,
+  start: TerminalDocumentStart = { textScale: 1, shown: true }
 ): TerminalWebDocument {
   ensureDocumentStyle()
   host.classList.add(HOST_CLASS)
   host.innerHTML = TERMINAL_DOCUMENT_MARKUP
-  const started = startDocumentOrGiveTheHostBack(host, receive)
+  const viewport = pageViewport(host)
+  const started = startDocumentOrGiveTheHostBack(host, receive, start, viewport)
 
   return {
     send: (command) => {
       started.send(command)
     },
+    notifyViewport: viewport.notify,
     dispose: () => {
       started.stop()
       host.innerHTML = ''
@@ -128,10 +135,12 @@ export function mountTerminalWebDocument(
  */
 function startDocumentOrGiveTheHostBack(
   host: HTMLElement,
-  receive: (message: Record<string, unknown>) => void
+  receive: (message: Record<string, unknown>) => void,
+  start: TerminalDocumentStart,
+  viewport: PageViewport
 ) {
   try {
-    return startPageDocument(host, receive)
+    return startPageDocument(host, receive, start, viewport)
   } catch (error) {
     host.innerHTML = ''
     host.classList.remove(HOST_CLASS)
@@ -139,8 +148,53 @@ function startDocumentOrGiveTheHostBack(
   }
 }
 
+type PageViewport = ReturnType<typeof pageViewport>
+
+/**
+ * The host's box, pushed by RN layout. RN web lays a `display:none` host out as 0x0 and its return
+ * as the same box: the size stays the last real one, as a covered WebView's does, and the return is
+ * a show rather than a resize. Sizes are the client rect's; RN web's are whole-pixel `offsetWidth`s.
+ */
+function pageViewport(host: HTMLElement) {
+  // Seeded from the host, since RN's first layout can land before this mount exists.
+  const seed = host.getBoundingClientRect()
+  let laidOut = { width: seed.width, height: seed.height }
+  let onChange: ((change: TerminalViewportChange) => void) | null = null
+  return {
+    rect: () => {
+      const box = host.getBoundingClientRect()
+      const hidden = box.width <= 0
+      const size = hidden ? laidOut : box
+      return { left: box.left, top: box.top, width: size.width, height: size.height, hidden }
+    },
+    observe: (change: (change: TerminalViewportChange) => void) => {
+      onChange = change
+      return () => {
+        onChange = null
+      }
+    },
+    notify: () => {
+      const { width, height } = host.getBoundingClientRect()
+      if (width <= 0) {
+        return
+      }
+      if (width === laidOut.width && height === laidOut.height) {
+        onChange?.('shown')
+        return
+      }
+      laidOut = { width, height }
+      onChange?.('resized')
+    }
+  }
+}
+
 /** The eleven seams, as the page answers them. */
-function startPageDocument(host: HTMLElement, receive: (message: Record<string, unknown>) => void) {
+function startPageDocument(
+  host: HTMLElement,
+  receive: (message: Record<string, unknown>) => void,
+  start: TerminalDocumentStart,
+  viewport: PageViewport
+) {
   // Written by this document's own reporter: `startHostNotify` installs it through the seam below,
   // which here is a `window` error listener, and every error it forwards is appended before the
   // report that quotes it. What the page cannot have is the WebView head's half — a buffer open
@@ -186,18 +240,13 @@ function startPageDocument(host: HTMLElement, receive: (message: Record<string,
     // fail. Here the engine is the import above, so it is here or this module did not load.
     hasEngine: () => true,
 
-    // The window here is the whole page, header and dock included; the grid is shown in the host.
-    viewportRect: () => {
-      const box = host.getBoundingClientRect()
-      return { left: box.left, top: box.top, width: box.width, height: box.height }
-    },
+    start: () => start,
 
-    // The host resizes without the window: a dock growing, a panel docking beside it.
-    observeViewport: (onChange) => {
-      const observer = new ResizeObserver(onChange)
-      observer.observe(host)
-      return () => observer.disconnect()
-    },
+    // The window here is the whole page, header and dock included; the grid is shown in the host.
+    viewportRect: viewport.rect,
+
+    // The host resizes without the window, and RN layout is what says so: the component pushes it.
+    observeViewport: viewport.observe,
 
     // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the shape is xterm's own, except that `getCell` takes back the cell xterm allocated and the document declares only the members it reads on one.
     createTerminal: (options) => new Terminal(options) as unknown as TerminalDocumentTerminal,
diff --git a/mobile/src/terminal/terminal-webview-cell-box.test.ts b/mobile/src/terminal/terminal-webview-cell-box.test.ts
new file mode 100644
index 00000000000..602bddd0f37
--- /dev/null
+++ b/mobile/src/terminal/terminal-webview-cell-box.test.ts
@@ -0,0 +1,200 @@
+import { createElement, createRef } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { TerminalWebView } from './TerminalWebView'
+import type { TerminalWebViewHandle } from './terminal-webview-contract'
+
+const nativeWebViewMethods = vi.hoisted(() => ({
+  postMessage: vi.fn<(message: string) => void>(),
+  reload: vi.fn<() => void>()
+}))
+
+vi.mock('react-native', () => ({
+  AppState: { currentState: 'active' },
+  Platform: { OS: 'android' },
+  Pressable: 'Pressable',
+  StyleSheet: {
+    absoluteFillObject: { bottom: 0, left: 0, position: 'absolute', right: 0, top: 0 },
+    create: (styles: unknown) => styles
+  },
+  Text: 'Text',
+  View: 'View'
+}))
+
+vi.mock('react-native-webview', async () => {
+  const React = await import('react')
+  const WebView = React.forwardRef((props: Record<string, unknown>, ref) => {
+    React.useImperativeHandle(ref, () => nativeWebViewMethods)
+    return React.createElement('WebView', props)
+  })
+  return { WebView, default: WebView }
+})
+
+vi.mock('lucide-react-native', () => ({ RefreshCw: 'RefreshCw' }))
+
+const FRAME = { width: 427, height: 710 }
+const scale = 1
+const cellAt = (fontScale: number, cellWidth = 23 / 3) => ({ fontScale, cellWidth, cellHeight: 15 })
+
+const renderers: ReactTestRenderer[] = []
+afterEach(() => {
+  act(() => renderers.splice(0).forEach((renderer) => renderer.unmount()))
+  nativeWebViewMethods.postMessage.mockClear()
+  nativeWebViewMethods.reload.mockClear()
+  vi.useRealTimers()
+})
+
+function mount(textScale = scale) {
+  const ref = createRef<TerminalWebViewHandle>()
+  const onCellBoxChange = vi.fn()
+  const onWebReady = vi.fn<() => void>()
+  let renderer: ReactTestRenderer | undefined
+  act(() => {
+    renderer = create(
+      createElement(TerminalWebView, { ref, textScale, onCellBoxChange, onWebReady })
+    )
+  })
+  renderers.push(renderer!)
+  const handle = () => {
+    if (!ref.current) {
+      throw new Error('no handle')
+    }
+    return ref.current
+  }
+  const webView = () => renderer!.root.find((node) => typeof node.props.onMessage === 'function')
+  const notify = (payload: Record<string, unknown>) => {
+    act(() => {
+      webView().props.onMessage({ nativeEvent: { data: JSON.stringify(payload) } })
+    })
+  }
+  return { handle, notify, onCellBoxChange, onWebReady, webView }
+}
+
+function postedTypes(): unknown[] {
+  return nativeWebViewMethods.postMessage.mock.calls.map(([message]) => JSON.parse(message).type)
+}
+
+const cellBoxNotify = (cellWidth: number, refit: boolean) => ({
+  type: 'cell-box',
+  cellBox: cellAt(scale, cellWidth),
+  refit
+})
+
+describe('the cell box xterm laid out', () => {
+  it('sizes a fit from web-ready, which the document sends once its terminal is built', () => {
+    const { handle, notify } = mount()
+    expect(handle().fitDimensions(FRAME)).toBeNull()
+    notify({ type: 'web-ready', cellBox: cellAt(scale) })
+    expect(handle().fitDimensions(FRAME)).toEqual({ cols: 55, rows: 47 })
+    expect(postedTypes()).not.toContain('measure')
+  })
+
+  it('fits each box the document reports, and refits only when the document says so', () => {
+    // The document holds the grid and decides; its tests pin the one-refit bound.
+    const { handle, notify, onCellBoxChange } = mount()
+    notify({ type: 'web-ready', cellBox: cellAt(scale) })
+    notify(cellBoxNotify(7.9, false))
+    expect(onCellBoxChange).not.toHaveBeenCalled()
+    expect(handle().fitDimensions(FRAME)).toEqual({ cols: 54, rows: 47 })
+    notify(cellBoxNotify(7.8, true))
+    expect(onCellBoxChange).toHaveBeenCalledTimes(1)
+    expect(handle().fitDimensions(FRAME)).toEqual({ cols: 54, rows: 47 })
+  })
+
+  it('fits from the box the current document reported, not one an earlier document did', () => {
+    const { handle, notify, webView } = mount()
+    notify({ type: 'web-ready', cellBox: cellAt(scale) })
+    act(() => webView().props.onLoadStart())
+    notify({ type: 'web-ready', cellBox: null })
+    expect(handle().fitDimensions(FRAME)).toBeNull()
+  })
+
+  it("fits only from a ready box at the app's text scale", () => {
+    const { handle, notify, webView } = mount(1.5)
+    // A document built at mount keeps that scale; a reload after a text-size change reports it.
+    notify({ type: 'web-ready', cellBox: cellAt(1) })
+    expect(handle().fitDimensions(FRAME)).toBeNull()
+    act(() => webView().props.onLoadStart())
+    notify({ type: 'web-ready', cellBox: cellAt(1.5) })
+    expect(handle().fitDimensions(FRAME)).toEqual({ cols: 55, rows: 47 })
+  })
+
+  it('fits in the app from the reported box, and sends the frame with every grid', () => {
+    const { handle, notify } = mount()
+    notify({ type: 'web-ready', cellBox: cellAt(scale) })
+    expect(handle().fitDimensions({ width: 427.5, height: 0 })).toBeNull()
+    expect(handle().fitDimensions({ width: 427.5, height: 710 })).toEqual({ cols: 55, rows: 47 })
+    const frame = { width: 427.5, height: 710 }
+    handle().init({ cols: 55, rows: 47, initialData: '', frame })
+    handle().resize(55, 47, frame)
+    handle().reflow(55, 47, frame)
+    const grids = nativeWebViewMethods.postMessage.mock.calls
+      .map(([message]) => JSON.parse(message))
+      .filter((message) => ['init', 'resize', 'reflow'].includes(message.type))
+    expect(grids.map((message) => message.frame)).toEqual([frame, frame, frame])
+    expect(postedTypes()).not.toContain('measure')
+  })
+
+  it('sends nothing before a ready: a load start drops what was queued', () => {
+    const { handle, notify, webView } = mount()
+    handle().init({ cols: 55, rows: 47, initialData: 'snapshot', frame: null })
+    expect(postedTypes()).toEqual([])
+    act(() => webView().props.onLoadStart())
+    notify({ type: 'web-ready', cellBox: cellAt(scale) })
+    expect(postedTypes()).not.toContain('init')
+  })
+
+  it('reloads the same view when its content process ends', () => {
+    const { webView } = mount()
+    const view = webView()
+    act(() => view.props.onContentProcessDidTerminate({ nativeEvent: {} }))
+    expect(nativeWebViewMethods.reload).toHaveBeenCalledTimes(1)
+    expect(webView()).toBe(view)
+  })
+
+  it('drops queued and coalesced commands on a reload or a lost content process', () => {
+    vi.useFakeTimers()
+    const { handle, notify, webView } = mount()
+    act(() => webView().props.onLoadStart())
+    handle().write('for the reloaded document')
+    act(() => webView().props.onLoadStart())
+    handle().write('for the lost content process')
+    act(() => webView().props.onContentProcessDidTerminate({ nativeEvent: {} }))
+    notify({ type: 'web-ready', cellBox: cellAt(scale) })
+    act(() => {
+      vi.runAllTimers()
+    })
+    expect(postedTypes()).not.toContain('write')
+    handle().write('for the current document')
+    act(() => {
+      vi.runAllTimers()
+    })
+    expect(postedTypes()).toContain('write')
+  })
+
+  it('tells the document the app text scale before it builds its terminal', () => {
+    const { webView } = mount(1.25)
+    const html: string = webView().props.source.html
+    const start = html.indexOf('window.__orcaTerminalTextScale = 1.25;')
+    expect(start).toBeGreaterThan(-1)
+    // Ahead of the document script, in the page itself, so no platform can run it late.
+    expect(start).toBeLessThan(html.indexOf('startTerminalDocument'))
+  })
+
+  it('keeps the source it mounted with across renders, so a new text scale does not reload', () => {
+    const { webView } = mount(1)
+    const source = webView().props.source
+    act(() => renderers[0]!.update(createElement(TerminalWebView, { textScale: 1.5 })))
+    expect(webView().props.source).toBe(source)
+  })
+
+  it('tells a document whose view was hidden at mount not to build before ready', () => {
+    let renderer: ReactTestRenderer | undefined
+    act(() => {
+      renderer = create(createElement(TerminalWebView, { shownAtMount: false }))
+    })
+    renderers.push(renderer!)
+    const webView = renderer!.root.find((node) => typeof node.props.onMessage === 'function')
+    expect(webView.props.source.html).toContain('window.__orcaTerminalShown = false;')
+  })
+})
diff --git a/mobile/src/terminal/terminal-webview-consumer-census.test.ts b/mobile/src/terminal/terminal-webview-consumer-census.test.ts
deleted file mode 100644
index cb57e4a4755..00000000000
--- a/mobile/src/terminal/terminal-webview-consumer-census.test.ts
+++ /dev/null
@@ -1,85 +0,0 @@
-import { readFileSync, readdirSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-/**
- * Nothing above the terminal component knows which of the two it has.
- *
- * The page's `TerminalWebView.web.tsx` is resolved by the bundler, not chosen by a caller, so the
- * whole substitution rests on every consumer holding only `terminal-webview-contract` — the props
- * and the handle — and on the one that renders the component naming it without an extension. A
- * consumer that reached into `TerminalWebView.tsx` for a type, or imported `terminal-webview-html`
- * for the document string, would work natively and break on the page in a way no native test sees.
- *
- * Scanned rather than listed, so a new consumer joins the rule by existing.
- */
-
-const terminalDir = import.meta.dirname
-const sessionDir = join(terminalDir, '..', 'session')
-
-/** The modules that may reach into the component's own file or the document's HTML. */
-const ALLOWED_INSIDE_TERMINAL = new Set([
-  'TerminalWebView.tsx',
-  'TerminalWebView.web.tsx',
-  'terminal-web-document-mount.ts',
-  'terminal-webview-html.ts',
-  'terminal-webview-html.web.ts',
-  // Test scaffolding that drives the document's own modules; it is not shipped in either build.
-  'terminal-webview-mouse-test-harness.ts'
-])
-
-const FORBIDDEN_ABOVE_THE_CONTRACT = [
-  /from '(\.\.\/terminal|\.)\/TerminalWebView\.(web\.)?tsx?'/,
-  /from '(\.\.\/terminal|\.)\/terminal-webview-html'/,
-  /from '(\.\.\/terminal|\.)\/terminal-webview-engine(-css)?\.generated'/,
-  /from '(\.\.\/terminal|\.)\/document\//
-]
-
-function productModules(directory: string): string[] {
-  return readdirSync(directory)
-    .filter((name) => /\.tsx?$/.test(name))
-    .filter((name) => !name.includes('.test') && !name.includes('.test-support'))
-    .sort()
-}
-
-function offenders(directory: string, skip: (name: string) => boolean): string[] {
-  const found: string[] = []
-  for (const name of productModules(directory)) {
-    if (skip(name)) {
-      continue
-    }
-    const source = readFileSync(join(directory, name), 'utf8')
-    for (const pattern of FORBIDDEN_ABOVE_THE_CONTRACT) {
-      if (pattern.test(source)) {
-        found.push(`${name}: ${pattern.source}`)
-      }
-    }
-  }
-  return found
-}
-
-describe('the terminal component contract', () => {
-  it('is all that src/session imports of the terminal', () => {
-    expect(offenders(sessionDir, () => false)).toEqual([])
-    // The precondition: a scan that read no session module would report nothing either.
-    const rendering = readFileSync(join(sessionDir, 'TerminalPaneView.tsx'), 'utf8')
-    expect(rendering).toContain("from '../terminal/TerminalWebView'")
-    expect(rendering).toContain("from '../terminal/terminal-webview-contract'")
-  })
-
-  it('is all that the terminal directory itself imports, outside the component and its document', () => {
-    expect(offenders(terminalDir, (name) => ALLOWED_INSIDE_TERMINAL.has(name))).toEqual([])
-    expect(productModules(terminalDir).length).toBeGreaterThan(40)
-  })
-
-  it('would report a consumer that named the component file', () => {
-    // The scan tested on the text it is meant to refuse, so an empty offender list above is a
-    // measurement rather than a regex that matches nothing.
-    const planted = "import { TerminalWebView } from '../terminal/TerminalWebView.tsx'\n"
-    expect(FORBIDDEN_ABOVE_THE_CONTRACT.some((pattern) => pattern.test(planted))).toBe(true)
-    const html = "import { XTERM_HTML } from '../terminal/terminal-webview-html'\n"
-    expect(FORBIDDEN_ABOVE_THE_CONTRACT.some((pattern) => pattern.test(html))).toBe(true)
-    const extensionless = "import { TerminalWebView } from '../terminal/TerminalWebView'\n"
-    expect(FORBIDDEN_ABOVE_THE_CONTRACT.some((pattern) => pattern.test(extensionless))).toBe(false)
-  })
-})
diff --git a/mobile/src/terminal/terminal-webview-contract.test.ts b/mobile/src/terminal/terminal-webview-contract.test.ts
index 0a3527111e3..aca7f9533d8 100644
--- a/mobile/src/terminal/terminal-webview-contract.test.ts
+++ b/mobile/src/terminal/terminal-webview-contract.test.ts
@@ -1,6 +1,10 @@
 import { describe, expect, it } from 'vitest'
 
-import { parseTerminalKeyboardAvoidanceMetrics } from './terminal-webview-contract'
+import {
+  parseTerminalKeyboardAvoidanceMetrics,
+  sameTerminalKeyboardAvoidanceMetrics,
+  type TerminalKeyboardAvoidanceMetrics
+} from './terminal-webview-contract'
 
 describe('parseTerminalKeyboardAvoidanceMetrics', () => {
   it('parses a full payload', () => {
@@ -49,4 +53,44 @@ describe('parseTerminalKeyboardAvoidanceMetrics', () => {
       })
     ).toEqual({ cursorY: 0, contentBottomRow: 0, rows: 0, altScreen: false })
   })
+
+  it('carries the drawn row pitch when the document reports one, and omits it otherwise', () => {
+    expect(parseTerminalKeyboardAvoidanceMetrics({ cursorY: 46, rows: 47, rowPitch: 7.5 })).toEqual(
+      { cursorY: 46, contentBottomRow: 46, rows: 47, altScreen: false, rowPitch: 7.5 }
+    )
+    for (const rowPitch of [undefined, 0, -3, Number.NaN, Number.POSITIVE_INFINITY, '15']) {
+      expect(
+        'rowPitch' in parseTerminalKeyboardAvoidanceMetrics({ cursorY: 1, rows: 4, rowPitch })
+      ).toBe(false)
+    }
+  })
+})
+
+describe('sameTerminalKeyboardAvoidanceMetrics', () => {
+  const metrics: Required<TerminalKeyboardAvoidanceMetrics> = {
+    cursorY: 38,
+    contentBottomRow: 38,
+    rows: 40,
+    altScreen: false,
+    rowPitch: 15
+  }
+  // One variant per field, each differing from `metrics` in that field alone.
+  const variants: [keyof typeof metrics, TerminalKeyboardAvoidanceMetrics][] = [
+    ['cursorY', { ...metrics, cursorY: 39 }],
+    ['contentBottomRow', { ...metrics, contentBottomRow: 39 }],
+    ['rows', { ...metrics, rows: 41 }],
+    ['altScreen', { ...metrics, altScreen: true }],
+    // Desktop display mode, measured on the page: same rows, the fit scale moved to 0.46.
+    ['rowPitch', { ...metrics, rowPitch: 6.96 }]
+  ]
+
+  it('tells apart metrics that differ in any one field', () => {
+    expect(sameTerminalKeyboardAvoidanceMetrics(metrics, { ...metrics })).toBe(true)
+    expect(variants.map(([key]) => key).sort()).toEqual(Object.keys(metrics).sort())
+    for (const [key, variant] of variants) {
+      expect(sameTerminalKeyboardAvoidanceMetrics(metrics, variant), key).toBe(false)
+    }
+    const { rowPitch: _rowPitch, ...older } = metrics
+    expect(sameTerminalKeyboardAvoidanceMetrics(metrics, older)).toBe(false)
+  })
 })
diff --git a/mobile/src/terminal/terminal-webview-contract.ts b/mobile/src/terminal/terminal-webview-contract.ts
index 45b9a38c05a..1c9960ab1ec 100644
--- a/mobile/src/terminal/terminal-webview-contract.ts
+++ b/mobile/src/terminal/terminal-webview-contract.ts
@@ -1,6 +1,8 @@
 import type { RuntimeMobileTerminalTheme } from '../../../src/shared/runtime-types'
 import type { TerminalOscLinkRange } from '../../../src/shared/terminal-osc-link-ranges'
 import type { StyleProp, ViewStyle } from 'react-native'
+import type { TerminalFitDimensions } from './terminal-grid-fit'
+import type { TerminalFrame } from './terminal-webview-messages'
 
 type TerminalMouseTrackingMode = 'none' | 'x10' | 'vt200' | 'drag' | 'any'
 
@@ -18,6 +20,23 @@ export type TerminalKeyboardAvoidanceMetrics = {
   contentBottomRow: number
   rows: number
   altScreen: boolean
+  // CSS px between drawn rows, fit scale included; absent from older documents and before the
+  // renderer has measured.
+  rowPitch?: number
+}
+
+/** Every field: a fit-scale change moves only the row pitch, and the lift must hear it. */
+export function sameTerminalKeyboardAvoidanceMetrics(
+  a: TerminalKeyboardAvoidanceMetrics,
+  b: TerminalKeyboardAvoidanceMetrics
+): boolean {
+  return (
+    a.cursorY === b.cursorY &&
+    a.contentBottomRow === b.contentBottomRow &&
+    a.rows === b.rows &&
+    a.altScreen === b.altScreen &&
+    a.rowPitch === b.rowPitch
+  )
 }
 
 export function parseTerminalKeyboardAvoidanceMetrics(
@@ -30,12 +49,11 @@ export function parseTerminalKeyboardAvoidanceMetrics(
     msg.contentBottomRow === undefined
       ? cursorY
       : Math.min(toNonNegativeInteger(msg.contentBottomRow), maxRow)
-  return {
-    cursorY,
-    contentBottomRow,
-    rows,
-    altScreen: msg.altScreen === true
-  }
+  const metrics = { cursorY, contentBottomRow, rows, altScreen: msg.altScreen === true }
+  const rowPitch = msg.rowPitch
+  return typeof rowPitch === 'number' && Number.isFinite(rowPitch) && rowPitch > 0
+    ? { ...metrics, rowPitch }
+    : metrics
 }
 
 function toNonNegativeInteger(value: unknown): number {
@@ -61,6 +79,8 @@ export type TerminalSelectionEvents = {
   // Why: pinch-to-zoom in the terminal snaps to a text-size preset and reports it
   // here so the app persists it and keeps Settings + other panes in sync.
   onTextScaleChange?: (scale: number) => void
+  // xterm laid out a different cell box at the same grid (renderer swap, pixel-ratio change).
+  onCellBoxChange?: () => void
 }
 
 export type TerminalWebViewProps = {
@@ -69,35 +89,42 @@ export type TerminalWebViewProps = {
   // Why: baseline zoom multiplier applied on top of fit-to-width scale; raw
   // xterm fontSize alone cannot drive apparent size because fitting cancels it.
   textScale?: number
+  // Why: only a view shown when it mounts builds its terminal before ready (one WebGL context each).
+  shownAtMount?: boolean
   onWebReady?: () => void
   onEngineError?: (message: string) => void
 } & TerminalSelectionEvents
 
+/** One init: the grid, the snapshot it replays, and the frame the grid was fitted to. */
+export type TerminalInit = {
+  cols: number
+  rows: number
+  initialData?: string
+  preserveScroll?: boolean
+  oscLinks?: TerminalOscLinkRange[]
+  frame: TerminalFrame | null
+}
+
 export type TerminalWebViewHandle = {
   // Why: iOS can preserve the native view while discarding its JS/backing-store
   // state; foreground recovery must wait for the document to answer before replay.
   prepareForForegroundRecovery: () => void
   write: (data: string) => void
-  init: (
-    cols: number,
-    rows: number,
-    initialData?: string,
-    preserveScroll?: boolean,
-    oscLinks?: TerminalOscLinkRange[]
-  ) => void
-  resize: (cols: number, rows: number) => void
+  init: (init: TerminalInit) => void
+  resize: (cols: number, rows: number, frame: TerminalFrame | null) => void
   // Why: reflow the local xterm buffer (scrollback included) to a new width
   // after a server-side PTY reflow, so older wrapped lines rewrap to match the
   // latest output. No-op on the alternate screen.
-  reflow: (cols: number, rows: number) => void
+  reflow: (cols: number, rows: number, frame: TerminalFrame | null) => void
   clear: () => void
-  measureFitDimensions: (containerHeight?: number) => Promise<{ cols: number; rows: number } | null>
+  /** The grid this frame holds at the cell box the document reported; null without one at this text size. */
+  fitDimensions: (frame: TerminalFrame) => TerminalFitDimensions | null
   resetZoom: () => void
   cancelSelect: () => void
   doSelectAll: () => void
   // Why: lets callers await the WebView-side `init` rAF chain (term.open
-  // → renderService population → first paint) so a follow-up measure
-  // doesn't race ahead and find term=null or cellWidth=0. Resolves on
-  // the next 'ready' notify after the most recent init.
+  // → renderService population → first paint → the init's cell box) so a
+  // follow-up fit reads that box. Resolves on the next 'ready' notify after
+  // the most recent init.
   awaitReady: () => Promise<void>
 }
diff --git a/mobile/src/terminal/terminal-webview-engine.test.ts b/mobile/src/terminal/terminal-webview-engine.test.ts
index 3f3aab326fe..96a4327f090 100644
--- a/mobile/src/terminal/terminal-webview-engine.test.ts
+++ b/mobile/src/terminal/terminal-webview-engine.test.ts
@@ -1,6 +1,4 @@
 // @vitest-environment happy-dom
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
 import { Script } from 'node:vm'
 import { parse } from 'acorn'
 import { describe, expect, it, vi } from 'vitest'
@@ -8,15 +6,8 @@ import { XTERM_ENGINE_CSS } from './terminal-webview-engine-css.generated'
 import { XTERM_ENGINE_JS } from './terminal-webview-engine.generated'
 import { createTerminalDocumentScope } from './document/document-scope'
 import { attachWebglAddon, startWebglRecovery } from './document/webgl-recovery'
-import {
-  documentModuleSource,
-  documentSourceText
-} from './document/document-module-source.test-support'
 import { XTERM_HTML } from './terminal-webview-html'
 
-// The document's own source, so a rule about what the document does is read where it is written.
-const terminalHtmlSource = documentSourceText()
-
 function createWebglRecoveryHarness(failSecondAttach = false) {
   const timers: Array<() => void> = []
   const addons: Array<{
@@ -151,58 +142,6 @@ describe('terminal WebView bundled engine', () => {
     expect(XTERM_ENGINE_CSS).not.toMatch(/<\/style/i)
   })
 
-  it('reports WebView message handler failures instead of swallowing them', () => {
-    const start = terminalHtmlSource.indexOf('function handleIncomingMessage')
-    // Bounded by the next declaration in the same module: ruling 24 took the resize listener out
-    // of the bridge, so the handler is followed by the start that installs the transport.
-    const end = terminalHtmlSource.indexOf('function startMessageBridge', start)
-    expect(start).toBeGreaterThanOrEqual(0)
-    expect(end).toBeGreaterThan(start)
-    const handlerSource = terminalHtmlSource.slice(start, end)
-
-    expect(handlerSource).toContain('reportEngineError(')
-    expect(handlerSource).toContain("'terminal init failed'")
-    expect(handlerSource).toContain("'terminal message failed'")
-    expect(handlerSource).not.toContain('catch(ex) {}')
-  })
-
-  it('classifies runtime errors by a document-scoped ever-ready latch', () => {
-    // Why: init() flips `ready` false on every re-init (live width reflow keeps the
-    // old surface visible meanwhile), so the fatal default and the init-catch must
-    // key off `everReady` — otherwise a transient reflow error blanks a live
-    // terminal behind the fatal overlay. The latch stays set for the document.
-    // Ruling 21: the latch's initial value is in the scope factory, not in a parse-time write.
-    expect(terminalHtmlSource).toContain('everReady: false,')
-    expect(terminalHtmlSource).toContain('scope.everReady = true')
-    expect(terminalHtmlSource).toContain('fatal === undefined ? !scope.everReady : !!fatal')
-    expect(terminalHtmlSource).toContain("msg && msg.type === 'init' && !scope.everReady")
-    expect(terminalHtmlSource).not.toMatch(/fatal === void 0 \? !scope\.ready\b/)
-  })
-
-  it('bounds error capture and non-fatal reporting on a degraded engine', () => {
-    // Why: a constructed-but-broken engine can throw per render frame; both
-    // onerror capture sites must cap the buffer and non-fatal notifies must
-    // stop flooding RN while fatal reports always emit.
-    // Both sites: the document's own reporter, and the shell's inline handler that catches what
-    // fails before the document has run at all.
-    // `dirname`, not the module URL: a DOM-environment case has no `file:` URL to convert.
-    const shell = readFileSync(
-      join(import.meta.dirname, 'terminal-webview-html', 'document-shell.ts'),
-      'utf8'
-    )
-    // The shell's buffer is a global because it is older than any document; the document appends to
-    // it through the seam, so the two sites now spell the same cap over the same list differently.
-    expect(shell).toContain('window.__engineErrors.length < 20')
-    expect(terminalHtmlSource).toContain('const captured = scope.capturedEngineErrors()')
-    expect(terminalHtmlSource).toContain('if (captured.length < 20) {')
-    // The global is read in one place, the seam's own default, and the reporter no longer names it.
-    expect(documentModuleSource('host-notify')).not.toContain('window.__engineErrors')
-    expect(documentModuleSource('document-host-seams')).toContain(
-      'window.__engineErrors = window.__engineErrors ?? []'
-    )
-    expect(terminalHtmlSource).toContain('nonFatalErrorNotifies > 5')
-  })
-
   it('recreates WebGL once after context loss, then stays on the DOM renderer', () => {
     const { addons, logged, term, timers } = createWebglRecoveryHarness()
 
diff --git a/mobile/src/terminal/terminal-webview-html.ts b/mobile/src/terminal/terminal-webview-html.ts
index 01d0e577a86..65bbff60d35 100644
--- a/mobile/src/terminal/terminal-webview-html.ts
+++ b/mobile/src/terminal/terminal-webview-html.ts
@@ -21,4 +21,20 @@ export const XTERM_HTML = [
   TERMINAL_HTML_DOCUMENT_CLOSE
 ].join('')
 
-export const XTERM_WEBVIEW_SOURCE = { html: XTERM_HTML }
+/**
+ * The WebView's document, starting as its view mounted: at this text scale, and whether it was
+ * shown. Written into the page ahead of the document script, which reads them as it starts.
+ */
+export function xtermWebViewSource(start: { textScale: number; shown: boolean }) {
+  const startValues =
+    `window.__orcaTerminalTextScale = ${JSON.stringify(start.textScale)};\n` +
+    `window.__orcaTerminalShown = ${JSON.stringify(start.shown)};\n`
+  return {
+    html: [
+      TERMINAL_HTML_DOCUMENT_SHELL,
+      startValues,
+      TERMINAL_DOCUMENT_SCRIPT,
+      TERMINAL_HTML_DOCUMENT_CLOSE
+    ].join('')
+  }
+}
diff --git a/mobile/src/terminal/terminal-webview-messages.ts b/mobile/src/terminal/terminal-webview-messages.ts
index 35c6e991b68..ca82f173917 100644
--- a/mobile/src/terminal/terminal-webview-messages.ts
+++ b/mobile/src/terminal/terminal-webview-messages.ts
@@ -1,6 +1,9 @@
 import type { RuntimeMobileTerminalTheme } from '../../../src/shared/runtime-types'
 import type { TerminalOscLinkRange } from '../../../src/shared/terminal-osc-link-ranges'
 
+/** The frame React Native laid out, sent with each grid so the document fits a text-size change to it. */
+export type TerminalFrame = { width: number; height: number }
+
 export type TerminalWebViewCommand =
   | { type: 'ping'; id?: number }
   | { type: 'write'; id?: number; data: string }
@@ -16,12 +19,12 @@ export type TerminalWebViewCommand =
       // Why: width-reflow re-streams replay the same content rewrapped at new
       // cols; preserve the reader's scroll position instead of jumping to bottom.
       preserveScroll?: boolean
+      frame: TerminalFrame | null
     }
   | { type: 'set-font-scale'; id?: number; fontScale: number }
-  | { type: 'resize'; id?: number; cols: number; rows: number }
-  | { type: 'reflow'; id?: number; cols: number; rows: number }
+  | { type: 'resize'; id?: number; cols: number; rows: number; frame: TerminalFrame | null }
+  | { type: 'reflow'; id?: number; cols: number; rows: number; frame: TerminalFrame | null }
   | { type: 'clear'; id?: number }
-  | { type: 'measure'; id?: number; containerHeight?: number }
   | { type: 'reset-zoom'; id?: number }
   | { type: 'cancel-select'; id?: number }
   | { type: 'do-select-all'; id?: number }
diff --git a/mobile/src/terminal/terminal-webview-query-reply.test.ts b/mobile/src/terminal/terminal-webview-query-reply.test.ts
index 49b8fb63539..fe090b1436e 100644
--- a/mobile/src/terminal/terminal-webview-query-reply.test.ts
+++ b/mobile/src/terminal/terminal-webview-query-reply.test.ts
@@ -6,7 +6,6 @@ import {
   resetTerminalDataReplyAuthority,
   resumeTerminalDataReplyAuthority
 } from './document/query-reply'
-import { documentModuleSource } from './document/document-module-source.test-support'
 
 type QueryReplyGate = {
   forward: (data: string) => void
@@ -50,32 +49,6 @@ function createQueryReplyGate(notify: (message: unknown) => void): {
 }
 
 describe('mobile terminal query replies', () => {
-  it('forwards xterm-generated data only after initial replay drains', () => {
-    const bridge = documentModuleSource('query-reply')
-    const init = documentModuleSource('terminal-init')
-    // The listener is armed by the bridge, and what it forwards is the gate's own call.
-    expect(bridge).toContain('term.onData(')
-    expect(bridge).toContain('forwardTerminalDataReply(scope, data)')
-    // The terminal takes keystrokes from the host, never from its own textarea: stdin is enabled so
-    // xterm generates replies, and the textarea is read-only so the phone's keyboard cannot type.
-    expect(init).toContain('disableStdin: false')
-    // Both are the bridge's own doing, where the listener it arms is: it takes the key handler and
-    // the textarea in the same breath.
-    expect(bridge).toContain('term.attachCustomKeyEventHandler(')
-    expect(bridge).toContain('term.textarea.readOnly = true')
-  })
-
-  it('mutes a replacement terminal until its own replay drains', () => {
-    const init = documentModuleSource('terminal-init')
-    const initIndex = init.indexOf('export function init(')
-    const disableIndex = init.indexOf('resetTerminalDataReplyAuthority(scope)', initIndex)
-    const enableIndex = init.indexOf('attachTerminalQueryReplyBridge(scope,', disableIndex)
-
-    expect(initIndex).toBeGreaterThanOrEqual(0)
-    expect(disableIndex).toBeGreaterThan(initIndex)
-    expect(enableIndex).toBeGreaterThan(disableIndex)
-  })
-
   it('suppresses replay, then forwards live queries queued behind its boundary', () => {
     const messages: unknown[] = []
     const { gate, queuedBoundaries } = createQueryReplyGate((message) => messages.push(message))
@@ -117,10 +90,5 @@ describe('mobile terminal query replies', () => {
     gate.forward('\x1b[3;4R')
 
     expect(messages).toEqual([{ type: 'terminal-data', bytes: '\x1b[3;4R' }])
-    const router = documentModuleSource('host-message-router')
-    const clearStart = router.indexOf("} else if (msg.type === 'clear') {")
-    const clearEnd = router.indexOf("} else if (msg.type === 'measure')", clearStart)
-    expect(clearStart).toBeGreaterThanOrEqual(0)
-    expect(router.slice(clearStart, clearEnd)).toContain('resumeTerminalDataReplyAuthority(scope)')
   })
 })
diff --git a/mobile/src/terminal/terminal-webview-ready-promises.ts b/mobile/src/terminal/terminal-webview-ready-promises.ts
index fde27fe2846..0eab14849dc 100644
--- a/mobile/src/terminal/terminal-webview-ready-promises.ts
+++ b/mobile/src/terminal/terminal-webview-ready-promises.ts
@@ -1,35 +1,24 @@
 import { useMemo } from 'react'
-import type { TerminalWebViewCommand } from './terminal-webview-messages'
 
 /**
- * The two promises the terminal handle hands out, and the notifies that settle them.
+ * The ready promise the terminal handle hands out, and the notify that settles it.
  *
  * `awaitReady` waits for the document's `init` rAF chain — `term.open`, renderService population,
- * first paint — because a measure that runs synchronously after init finds `term` null or cells
- * of size zero. `measureFitDimensions` waits for the document's answer. Both are promises held
- * across a message round trip, both have a timeout for the case where the document never answers,
- * and both are the same on either host, so they live here rather than in the controller that owns
- * the readiness handshake.
+ * first paint, and the cell box that init reports — so a fit after it reads the init's own box. It
+ * has a timeout for a document that never answers, and is the same on either host.
  */
 
 const READY_TIMEOUT_MS = 3000
-const MEASURE_TIMEOUT_MS = 2000
-/** Below these the fit is not a terminal anyone can read, and the caller disables fit-to-phone. */
-const MIN_FIT_COLS = 20
-const MIN_FIT_ROWS = 8
-
-export type TerminalFitDimensions = { cols: number; rows: number }
 
 export function createTerminalWebViewReadyPromises() {
   let readyPromise: Promise<void> | null = null
   let readyResolve: (() => void) | null = null
-  let measureResolve: ((result: TerminalFitDimensions | null) => void) | null = null
 
   /**
    * Arms a fresh ready promise, resolving any prior one first.
    *
    * Why: an awaiter from the previous generation would otherwise sit on the timeout below — each
-   * leaked timer and closure pinned an awaiting measure caller for the full 3s under rapid
+   * leaked timer and closure pinned an awaiting fit caller for the full 3s under rapid
    * re-init (orientation change, multiple resubscribes), delaying cold-start fit chains.
    */
   function armReady() {
@@ -70,47 +59,7 @@ export function createTerminalWebViewReadyPromises() {
     })
   }
 
-  function measure(
-    send: (command: TerminalWebViewCommand) => void,
-    containerHeight?: number
-  ): Promise<TerminalFitDimensions | null> {
-    return new Promise((resolve) => {
-      measureResolve?.(null)
-      let timeout: ReturnType<typeof setTimeout> | null = null
-      const finish = (result: TerminalFitDimensions | null) => {
-        if (timeout) {
-          clearTimeout(timeout)
-          timeout = null
-        }
-        if (measureResolve === finish) {
-          measureResolve = null
-        }
-        resolve(result)
-      }
-      measureResolve = finish
-      send({ type: 'measure', containerHeight })
-      // Why: if the document doesn't respond (e.g., xterm failed to load), resolve null so the
-      // caller can disable Fit to Phone rather than hanging indefinitely.
-      timeout = setTimeout(() => {
-        if (measureResolve === finish) {
-          finish(null)
-        }
-      }, MEASURE_TIMEOUT_MS)
-    })
-  }
-
-  function resolveMeasure(msg: Record<string, unknown>) {
-    const resolve = measureResolve
-    measureResolve = null
-    if (!resolve) {
-      return
-    }
-    const cols = typeof msg.cols === 'number' ? msg.cols : null
-    const rows = typeof msg.rows === 'number' ? msg.rows : null
-    resolve(cols && rows && cols >= MIN_FIT_COLS && rows >= MIN_FIT_ROWS ? { cols, rows } : null)
-  }
-
-  return { armReady, awaitReady, measure, resolveMeasure, resolveReady }
+  return { armReady, awaitReady, resolveReady }
 }
 
 export function useTerminalWebViewReadyPromises() {
diff --git a/mobile/src/terminal/terminal-webview-reflow.test.ts b/mobile/src/terminal/terminal-webview-reflow.test.ts
deleted file mode 100644
index 5e29cb06c8e..00000000000
--- a/mobile/src/terminal/terminal-webview-reflow.test.ts
+++ /dev/null
@@ -1,65 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { describe, expect, it } from 'vitest'
-import {
-  documentModuleSource,
-  documentSourceText
-} from './document/document-module-source.test-support'
-
-const DOCUMENT_SOURCE = documentSourceText()
-
-// The reflow logic is the document's; the message dispatch and the handle wiring are the
-// component's. Both are read as source, because the document is source now.
-const reflowSource = documentModuleSource('reflow')
-// The handle is built by the controller both components share, which is where the wiring is read.
-const handleSource = readFileSync(
-  new URL('./use-terminal-webview-controller.ts', import.meta.url),
-  'utf8'
-)
-
-function reflowFnBody(): string {
-  const start = reflowSource.indexOf('export function reflow(scope: TerminalDocumentScope')
-  expect(start).toBeGreaterThanOrEqual(0)
-  return reflowSource.slice(start)
-}
-
-describe('terminal WebView reflow', () => {
-  it('skips the alternate screen so TUI snapshots are not mutated', () => {
-    // Why: alt-screen snapshots are repainted by the PTY; a local resize there
-    // can drop SGR attributes (white text). Reflow must early-return.
-    expect(reflowFnBody()).toContain('if (!scope.term || isAlternateBufferActive(scope)) {')
-  })
-
-  it('rewraps the local buffer via term.resize to the new cols', () => {
-    expect(reflowFnBody()).toContain('scope.term.resize(nextCols, nextRows)')
-  })
-
-  it('preserves the user scroll position across the rewrap', () => {
-    const body = reflowFnBody()
-    // At the live bottom -> stay pinned; scrolled up -> hold distance-from-bottom.
-    expect(body).toContain('const wasAtBottom = buffer.viewportY >= buffer.baseY')
-    expect(body).toContain('scope.term.scrollToBottom()')
-    expect(body).toContain('rewrapped.baseY - distanceFromBottom - rewrapped.viewportY')
-  })
-
-  it('is no-op when the dimensions are unchanged', () => {
-    expect(reflowFnBody()).toContain(
-      'if (nextCols === scope.term.cols && nextRows === scope.term.rows) {'
-    )
-  })
-
-  it('is dispatched by the reflow WebView message and exposed on the handle', () => {
-    expect(DOCUMENT_SOURCE).toContain("} else if (msg.type === 'reflow') {")
-    expect(DOCUMENT_SOURCE).toContain('reflow(scope, msg.cols!, msg.rows!)')
-    expect(handleSource).toContain("postMessage({ type: 'reflow', cols, rows })")
-  })
-
-  it('does not locally resize hidden WebViews to a one-column grid', () => {
-    // The floor is a constant of the module that fits the grid, and both readers import it.
-    expect(DOCUMENT_SOURCE).toContain('export const MIN_FIT_COLS = 20')
-    expect(DOCUMENT_SOURCE).toContain('if (cols < MIN_FIT_COLS) {')
-    expect(DOCUMENT_SOURCE).toContain("flog(scope, 'measure-skip-small-width'")
-    expect(DOCUMENT_SOURCE).toContain(
-      "notify(scope, { type: 'measure-result', cols: null, rows: null })"
-    )
-  })
-})
diff --git a/mobile/src/terminal/terminal-webview-scroll-routing.test.ts b/mobile/src/terminal/terminal-webview-scroll-routing.test.ts
deleted file mode 100644
index f62bfdf1ee2..00000000000
--- a/mobile/src/terminal/terminal-webview-scroll-routing.test.ts
+++ /dev/null
@@ -1,262 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { describe, expect, it } from 'vitest'
-import { webviewPageSource } from './document/document-module-source.test-support'
-
-const DOCUMENT_SOURCE = webviewPageSource()
-
-// The RN wrapper and the pending-message queue are TypeScript; everything the WebView runs is the
-// generated document. Concatenated so assertions resolve regardless of file.
-const source =
-  readFileSync(new URL('./TerminalWebView.tsx', import.meta.url), 'utf8') +
-  readFileSync(new URL('./use-terminal-webview-controller.ts', import.meta.url), 'utf8') +
-  readFileSync(new URL('./terminal-webview-ready-promises.ts', import.meta.url), 'utf8') +
-  readFileSync(new URL('./terminal-webview-pending-messages.ts', import.meta.url), 'utf8') +
-  readFileSync(new URL('./terminal-webview-html/document-markup.ts', import.meta.url), 'utf8') +
-  readFileSync(new URL('./terminal-webview-html/document-style.ts', import.meta.url), 'utf8') +
-  DOCUMENT_SOURCE
-const sessionSource = readFileSync(
-  new URL('../session/use-mobile-session-terminal-input.ts', import.meta.url),
-  'utf8'
-)
-const sessionHelperSource = readFileSync(
-  new URL('../session/mobile-session-route-helpers.ts', import.meta.url),
-  'utf8'
-)
-
-function sliceBetween(startPattern: string, endPattern: string): string {
-  const start = source.indexOf(startPattern)
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = source.indexOf(endPattern, start)
-  expect(end).toBeGreaterThan(start)
-  return source.slice(start, end)
-}
-
-describe('TerminalWebView scroll routing', () => {
-  it('keeps Android touch drags inside the terminal WebView', () => {
-    expect(source).toContain('nestedScrollEnabled')
-  })
-
-  it('maps a downward pull at the bottom to older scrollback rows', () => {
-    expect(source).toContain('const deltaY = scope.touchGesture.lastY - y')
-    expect(source).toContain('scope.smoothScrollOffsetY -= deltaY')
-    expect(source).toContain(
-      'const lines = Math.trunc(-scope.smoothScrollOffsetY / effectiveCellH)'
-    )
-
-    const nextViewportY = simulateNormalBufferPull({
-      baseY: 120,
-      viewportY: 120,
-      startY: 300,
-      endY: 340,
-      cellHeight: 20
-    })
-
-    expect(nextViewportY).toBe(118)
-  })
-
-  it('routes alternate-screen and mouse-aware scroll before smooth normal scroll', () => {
-    expect(source).toContain(
-      'return isWheelMouseTrackingMode(getMouseTrackingMode(scope)) || isAlternateBufferActive(scope)'
-    )
-
-    const touchMoveBlock = sliceBetween(
-      "targetSurface.addEventListener(\n    'touchmove'",
-      '{ capture: true, passive: false }'
-    )
-    expect(touchMoveBlock.indexOf('if (shouldRouteScrollToTerminalInput(scope))')).toBeLessThan(
-      touchMoveBlock.indexOf('if (enqueueNormalBufferScrollDelta(scope, deltaY))')
-    )
-    expect(touchMoveBlock).toContain('routeScrollLines(scope, lines, x, y)')
-
-    const momentumBlock = sliceBetween(
-      'function momentumStep(frameTime: number) {',
-      'if (Math.abs(vel) > MIN_VEL)'
-    )
-    expect(momentumBlock.indexOf('if (shouldRouteScrollToTerminalInput(scope))')).toBeLessThan(
-      momentumBlock.indexOf('if (!applyNormalBufferScrollDelta(scope, delta))')
-    )
-    expect(momentumBlock).toContain(
-      'routeScrollLines(scope, lines, scope.touchGesture.lastX, scope.touchGesture.lastY)'
-    )
-  })
-
-  it('does not rubber-band normal scroll at scrollback edges', () => {
-    expect(source).toContain('export function canScrollNormalBufferDelta(')
-    const smoothScrollBlock = sliceBetween(
-      'export function applyNormalBufferScrollDelta(',
-      'export function enqueueNormalBufferScrollDelta('
-    )
-    expect(smoothScrollBlock).toContain('if (!canScrollNormalBufferDelta(scope, deltaY))')
-    expect(smoothScrollBlock).toContain('resetSmoothScrollOffset(scope)')
-    expect(smoothScrollBlock).toContain('return false')
-    expect(smoothScrollBlock).toContain('return true')
-
-    const touchMoveBlock = sliceBetween(
-      "targetSurface.addEventListener(\n    'touchmove'",
-      '{ capture: true, passive: false }'
-    )
-    expect(touchMoveBlock).toContain('if (enqueueNormalBufferScrollDelta(scope, deltaY))')
-    expect(touchMoveBlock).toContain('scope.touchGesture.velY = 0')
-
-    const momentumBlock = sliceBetween(
-      'function momentumStep(frameTime: number) {',
-      'if (Math.abs(vel) > MIN_VEL)'
-    )
-    expect(momentumBlock).toContain('if (!applyNormalBufferScrollDelta(scope, delta))')
-    expect(momentumBlock).toContain('scope.touchGesture.momentumId = null')
-  })
-
-  it('coalesces normal touch scroll row commits onto animation frames', () => {
-    const enqueueBlock = sliceBetween(
-      'export function enqueueNormalBufferScrollDelta(',
-      'export function resetSmoothScrollOffset('
-    )
-    expect(enqueueBlock).toContain('scope.pendingNormalScrollDeltaY += deltaY')
-    expect(enqueueBlock).toContain('if (scope.normalScrollFrameId !== null) {')
-    // Ruling 21: every document frame goes through the scope's registry so dispose can take it
-    // back; the id is still held here, which is what the reset below cancels.
-    expect(enqueueBlock).toContain(
-      'scope.normalScrollFrameId = scheduleDocumentFrame(scope, function () {'
-    )
-    expect(enqueueBlock).toContain('applyNormalBufferScrollDelta(scope, delta)')
-
-    const resetBlock = sliceBetween(
-      'export function resetSmoothScrollOffset(',
-      'export function stopNormalBufferSmoothScroll('
-    )
-    expect(resetBlock).toContain('scope.pendingNormalScrollDeltaY = 0')
-    expect(resetBlock).toContain('cancelAnimationFrame(scope.normalScrollFrameId)')
-  })
-
-  it('bounds native-side pending WebView writes while preserving control messages', () => {
-    expect(source).toContain('const MAX_PENDING_WEB_WRITE_BYTES = 1_000_000')
-    expect(source).toContain('const MAX_PENDING_WEB_WRITE_MESSAGES = 4096')
-    expect(source).toContain('let pendingWriteBytes = 0')
-    expect(source).toContain('let pendingWriteCount = 0')
-    expect(source).toContain('const queue = (msg: TerminalWebViewCommand)')
-    expect(source).toContain('pendingWriteCount > MAX_PENDING_WEB_WRITE_MESSAGES')
-    expect(source).toContain("candidate.type === 'write'")
-    expect(source).toContain('pendingMessages.queue(msg)')
-    expect(source).toContain('pendingMessages.clear()')
-  })
-
-  it('clears WebView await timers when the real response wins', () => {
-    // C7.5 moved both promises into `terminal-webview-ready-promises.ts`, which both components
-    // reach through the controller; the two blocks are the same code in their new home.
-    const measureBlock = sliceBetween('function measure(', 'function resolveMeasure')
-    expect(measureBlock).toContain('clearTimeout(timeout)')
-    expect(measureBlock).toContain('measureResolve === finish')
-
-    const readyBlock = sliceBetween('async function awaitReady()', 'function measure(')
-    expect(readyBlock).toContain('clearTimeout(timeout)')
-    expect(readyBlock).toContain('void pending.finally')
-  })
-
-  it('hides xterm scrollbars and drives the mobile scroll indicator from committed rows', () => {
-    expect(source).toContain('<div id="scroll-indicator"><div id="scroll-thumb"></div></div>')
-    expect(source).toContain('.xterm .xterm-viewport::-webkit-scrollbar')
-    expect(source).toContain('.xterm .xterm-scrollable-element > .xterm-scrollbar')
-    expect(source).toContain('overflow-y: hidden !important')
-    expect(source).toContain('display: none !important')
-    expect(source).toContain('export function updateScrollIndicator(')
-    expect(source).toContain('buffer.viewportY / maxViewportY')
-    expect(source).not.toContain('fractionalRows')
-    expect(source).toContain('scrollThumb.style.transform =')
-    expect(source).toContain('updateScrollIndicator(scope, true)')
-  })
-
-  it('does not apply fractional smooth scroll transforms to terminal content', () => {
-    const updateTransformBlock = sliceBetween(
-      'export function updateTransform(',
-      'export function updateScrollIndicator('
-    )
-    expect(updateTransformBlock).toContain(
-      "'translate(' + scope.panX + 'px,' + scope.panY + 'px) scale(' + getTotalScale(scope) + ')'"
-    )
-    expect(source).not.toContain("querySelector('.xterm-screen')")
-    expect(source).not.toContain('updateTerminalScreenTransform')
-    expect(updateTransformBlock).not.toContain('getVisualPanY() + "px) scale("')
-    expect(updateTransformBlock).not.toContain('smoothScrollOffsetY')
-  })
-
-  it('smooths velocity samples and uses lower friction for mobile momentum', () => {
-    expect(source).toContain('export function updateTouchVelocity(')
-    expect(source).toContain('scope.touchGesture.velY * 0.55 + instantVelocity * 0.45')
-    expect(source).toContain('const FRICTION = 0.972')
-    expect(source).toContain('const MIN_VEL = 0.012')
-    // #21687: the decay is per elapsed millisecond, so a 120 Hz screen coasts the same distance.
-    expect(source).toContain('let lastMomentumTime = performance.now()')
-    expect(source).toContain(
-      'const elapsed = Math.max(1, Math.min(50, frameTime - lastMomentumTime))'
-    )
-    expect(source).toContain('vel *= FRICTION ** (elapsed / 16)')
-    expect(source).toContain('const delta = vel * elapsed')
-  })
-
-  it('keeps selection edge autoscroll active and extends the dragged endpoint', () => {
-    const startBlock = sliceBetween(
-      'export function startEdgeScroll(',
-      'export function stopEdgeScroll('
-    )
-    expect(startBlock.indexOf('stopEdgeScroll(scope)')).toBeLessThan(
-      startBlock.indexOf('scope.edgeScrollDir = dir')
-    )
-    expect(startBlock.indexOf('scope.term.scrollLines(scope.edgeScrollDir)')).toBeLessThan(
-      startBlock.indexOf('syncEdgeScrollSelectionEndpoint(scope)')
-    )
-
-    const dragMoveBlock = sliceBetween(
-      'export function handleDragMove(',
-      'function attachSurfaceEventHandlers('
-    )
-    expect(dragMoveBlock).toContain('scope.edgeScrollClientX = clientX')
-    expect(dragMoveBlock).toContain('scope.edgeScrollClientY = clientY')
-    expect(dragMoveBlock).toContain(
-      'syncSelectionHandleToViewportPoint(scope, handle, clientX, clientY)'
-    )
-  })
-
-  it('allows x10 mouse gesture reports through the mobile session gate', () => {
-    expect(sessionHelperSource).toContain('function isGestureMouseTrackingMode')
-    expect(sessionHelperSource).toContain(
-      "return mode === 'x10' || mode === 'vt200' || mode === 'drag' || mode === 'any'"
-    )
-
-    const inputBlockStart = sessionSource.indexOf('const handleTerminalInput = useCallback')
-    expect(inputBlockStart).toBeGreaterThanOrEqual(0)
-    const inputBlockEnd = sessionSource.indexOf(
-      'async function handleClearTerminal',
-      inputBlockStart
-    )
-    expect(inputBlockEnd).toBeGreaterThan(inputBlockStart)
-    const inputBlock = sessionSource.slice(inputBlockStart, inputBlockEnd)
-    expect(inputBlock).toContain('!isGestureMouseTrackingMode(modes?.mouseTrackingMode)')
-    expect(inputBlock).toContain('const sequenceCount = countTerminalGestureInputSequences(bytes)')
-    expect(inputBlock.indexOf('countTerminalGestureInputSequences')).toBeLessThan(
-      inputBlock.indexOf('enqueueTerminalGestureInput')
-    )
-  })
-})
-
-function simulateNormalBufferPull({
-  baseY,
-  viewportY,
-  startY,
-  endY,
-  cellHeight
-}: {
-  baseY: number
-  viewportY: number
-  startY: number
-  endY: number
-  cellHeight: number
-}): number {
-  const deltaY = startY - endY
-  if (deltaY > 0 ? viewportY >= baseY : viewportY <= 0) {
-    return viewportY
-  }
-  const smoothScrollOffsetY = -deltaY
-  const lines = Math.trunc(-smoothScrollOffsetY / cellHeight)
-  const applied = Math.max(lines, -viewportY)
-  return viewportY + applied
-}
diff --git a/mobile/src/terminal/terminal-webview-text-zoom.test.ts b/mobile/src/terminal/terminal-webview-text-zoom.test.ts
index 9d2403098ca..29ba4bfcd13 100644
--- a/mobile/src/terminal/terminal-webview-text-zoom.test.ts
+++ b/mobile/src/terminal/terminal-webview-text-zoom.test.ts
@@ -1,23 +1,8 @@
 // @vitest-environment happy-dom
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
 import { describe, expect, it, vi } from 'vitest'
 import { createTerminalDocumentScope } from './document/document-scope'
 import { normalizeStatusDotPresentation } from './document/write-queue'
 import { startTextScaling } from './document/text-scaling'
-import { webviewPageSource } from './document/document-module-source.test-support'
-
-const terminalWebViewSource = readFileSync(join(import.meta.dirname, 'TerminalWebView.tsx'), 'utf8')
-const terminalHtmlModuleSource = readFileSync(
-  join(import.meta.dirname, 'terminal-webview-html.ts'),
-  'utf8'
-)
-const terminalHtmlDocumentShellSource = readFileSync(
-  join(import.meta.dirname, 'terminal-webview-html', 'document-shell.ts'),
-  'utf8'
-)
-// The document's own source, which is what the WebView runs once bundled.
-const terminalHtmlSource = webviewPageSource()
 
 function normalizeStatusDotChunks(chunks: string[]) {
   const scope = createTerminalDocumentScope()
@@ -50,47 +35,6 @@ function resolveTerminalFontFamily(navigatorValue: {
 }
 
 describe('TerminalWebView text zoom', () => {
-  it('pins textZoom to 100 so Android system font scale cannot inflate glyphs past xterm cell metrics', () => {
-    const start = terminalWebViewSource.indexOf('<WebView')
-    expect(start).toBeGreaterThanOrEqual(0)
-    const end = terminalWebViewSource.indexOf('/>', start)
-    expect(end).toBeGreaterThan(start)
-    const webViewProps = terminalWebViewSource.slice(start, end)
-    expect(webViewProps).toContain('textZoom={100}')
-  })
-
-  it('keeps the HTML source object stable so parent renders do not reload xterm', () => {
-    const start = terminalWebViewSource.indexOf('<WebView')
-    expect(start).toBeGreaterThanOrEqual(0)
-    const end = terminalWebViewSource.indexOf('/>', start)
-    expect(end).toBeGreaterThan(start)
-    const webViewProps = terminalWebViewSource.slice(start, end)
-    expect(terminalHtmlModuleSource).toContain(
-      'export const XTERM_WEBVIEW_SOURCE = { html: XTERM_HTML }'
-    )
-    expect(webViewProps).toContain('source={XTERM_WEBVIEW_SOURCE}')
-    expect(webViewProps).not.toContain('source={{ html: XTERM_HTML }}')
-  })
-
-  it('forces the Claude status dot to text presentation before xterm writes', () => {
-    expect(terminalHtmlSource).toContain('font-variant-emoji: text')
-    // The dot and its two selectors are the write queue's own constants, and the pattern is a
-    // literal because a construction at a module's top level would be parse-time work (ruling 20).
-    expect(terminalHtmlSource).toContain("const CLAUDE_STATUS_DOT = '\\u23fa'")
-    expect(terminalHtmlSource).toContain("const TEXT_PRESENTATION_SELECTOR = '\\ufe0e'")
-    expect(terminalHtmlSource).toContain("const EMOJI_PRESENTATION_SELECTOR = '\\ufe0f'")
-    expect(terminalHtmlSource).toContain(
-      'const CLAUDE_STATUS_DOT_PATTERN = /\\u23fa[\\ufe0e\\ufe0f]*/g'
-    )
-    expect(terminalHtmlSource).toContain('export function normalizeStatusDotPresentation(')
-    expect(terminalHtmlSource).toContain(
-      'CLAUDE_STATUS_DOT_PATTERN,\n    CLAUDE_STATUS_DOT + TEXT_PRESENTATION_SELECTOR'
-    )
-    expect(terminalHtmlSource).toContain(
-      'scope.writeQueue.push(normalizeStatusDotPresentation(scope, data))'
-    )
-  })
-
   it('normalizes Claude status dots idempotently across write chunks', () => {
     const dot = String.fromCharCode(0x23fa)
     const textSelector = String.fromCharCode(0xfe0e)
@@ -117,36 +61,6 @@ describe('TerminalWebView text zoom', () => {
     )
   })
 
-  it('resets pending Claude status dot selector state when the terminal lifecycle resets', () => {
-    const initStart = terminalHtmlSource.indexOf('export function init(')
-    const initReplay = terminalHtmlSource.indexOf(
-      'const replayData = normalizeInitialData(initialData)'
-    )
-    const clearStart = terminalHtmlSource.indexOf("} else if (msg.type === 'clear') {")
-    const clearEnd = terminalHtmlSource.indexOf("} else if (msg.type === 'measure')", clearStart)
-    expect(initStart).toBeGreaterThanOrEqual(0)
-    expect(initReplay).toBeGreaterThan(initStart)
-    expect(clearStart).toBeGreaterThanOrEqual(0)
-    expect(clearEnd).toBeGreaterThan(clearStart)
-    expect(terminalHtmlSource.slice(initStart, initReplay)).toContain(
-      'scope.statusDotPendingSelector = false'
-    )
-    expect(terminalHtmlSource.slice(clearStart, clearEnd)).toContain(
-      'scope.statusDotPendingSelector = false'
-    )
-  })
-
-  it('loads Unicode 11 before replaying mobile terminal bytes', () => {
-    expect(terminalHtmlDocumentShellSource).toContain('XTERM_ENGINE_JS')
-    expect(terminalHtmlSource).toContain('window.Unicode11Addon.Unicode11Addon')
-    const open = terminalHtmlSource.indexOf('scope.term.open(scope.surface!)')
-    const unicode = terminalHtmlSource.indexOf("scope.term.unicode.activeVersion = '11'")
-    const replay = terminalHtmlSource.indexOf("enqueueWrite(scope, ESC + '[0m' + replayData)")
-    expect(open).toBeGreaterThanOrEqual(0)
-    expect(unicode).toBeGreaterThan(open)
-    expect(replay).toBeGreaterThan(unicode)
-  })
-
   const IOS_IPHONE_NAVIGATOR = {
     userAgent: 'Mozilla/5.0 (iPhone; CPU iPhone OS 19_0 like Mac OS X) AppleWebKit/605.1.15',
     platform: 'iPhone',
diff --git a/mobile/src/terminal/terminal-write-coalescer-boundaries.test.ts b/mobile/src/terminal/terminal-write-coalescer-boundaries.test.ts
index 22e76581a0e..3dd290fa1ff 100644
--- a/mobile/src/terminal/terminal-write-coalescer-boundaries.test.ts
+++ b/mobile/src/terminal/terminal-write-coalescer-boundaries.test.ts
@@ -1,4 +1,3 @@
-import { readFileSync } from 'node:fs'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { TerminalWebViewCommand } from './terminal-webview-messages'
 import { createTerminalWebViewPendingMessages } from './terminal-webview-pending-messages'
@@ -7,15 +6,6 @@ import {
   TERMINAL_WRITE_FLUSH_WINDOW_MS
 } from './terminal-write-coalescer'
 
-const webViewSource = readFileSync(new URL('./TerminalWebView.tsx', import.meta.url), 'utf8')
-// C7.5 moved everything that is not `react-native-webview` into the controller both components
-// share, so the coalescer's boundaries are read there; the component is still read for the two
-// WebView lifecycle events that reach it.
-const controllerSource = readFileSync(
-  new URL('./use-terminal-webview-controller.ts', import.meta.url),
-  'utf8'
-)
-
 // Simulates TerminalWebView's postMessage: ready → deliver, not ready → queue.
 // There is no React render harness in the node environment, so the boundary
 // invariants are gated here against the same pending-queue module the component uses.
@@ -50,12 +40,12 @@ describe('terminal write coalescer boundaries', () => {
     view.coalescer.write('stale-pre-snapshot')
     // init() boundary as wired in TerminalWebView: clear the coalescer, then post init.
     view.coalescer.clear()
-    view.postMessage({ type: 'init', cols: 80, rows: 24, initialData: 'snapshot' })
+    view.postMessage({ type: 'init', cols: 80, rows: 24, initialData: 'snapshot', frame: null })
     vi.runOnlyPendingTimers()
 
     expect(view.delivered).toEqual([
       { type: 'write', data: 'a' },
-      { type: 'init', cols: 80, rows: 24, initialData: 'snapshot' }
+      { type: 'init', cols: 80, rows: 24, initialData: 'snapshot', frame: null }
     ])
     const initIndex = view.delivered.findIndex((msg) => msg.type === 'init')
     expect(initIndex).toBeGreaterThanOrEqual(0)
@@ -75,7 +65,7 @@ describe('terminal write coalescer boundaries', () => {
     // Recovery re-init: coalescer.clear() cancels any pending timer synchronously,
     // so nothing can flush after this point; the queued init supersedes the flush.
     view.coalescer.clear()
-    view.postMessage({ type: 'init', cols: 80, rows: 24, initialData: 'snapshot' })
+    view.postMessage({ type: 'init', cols: 80, rows: 24, initialData: 'snapshot', frame: null })
 
     view.readiness.webReady = true
     view.pendingMessages.flush(view.send)
@@ -84,7 +74,7 @@ describe('terminal write coalescer boundaries', () => {
     expect(view.delivered).toEqual([
       { type: 'write', data: 'live' },
       { type: 'write', data: 'buffered-mid-recovery' },
-      { type: 'init', cols: 80, rows: 24, initialData: 'snapshot' }
+      { type: 'init', cols: 80, rows: 24, initialData: 'snapshot', frame: null }
     ])
     // Invariant: no write reaches the document after the recovery init.
     const initIndex = view.delivered.findIndex((msg) => msg.type === 'init')
@@ -110,69 +100,4 @@ describe('terminal write coalescer boundaries', () => {
       { type: 'write', data: 'still-current-document' }
     ])
   })
-
-  it('routes handle.write through the coalescer whose delivery posts the write command', () => {
-    expect(controllerSource).toContain(
-      "createTerminalWriteCoalescer((data) => postMessage({ type: 'write', data }))"
-    )
-    const writeStart = controllerSource.indexOf('write(data: string) {')
-    expect(writeStart).toBeGreaterThanOrEqual(0)
-    const writeBody = controllerSource.slice(writeStart, writeStart + 120)
-    expect(writeBody).toContain('writeCoalescer.write(data)')
-    expect(writeBody).not.toContain('postMessage')
-  })
-
-  it('clears the coalescer before posting init and clear (snapshot supersession)', () => {
-    // Anchor on the init() signature (unique) — 'init(' alone also matches comments.
-    const initStart = controllerSource.indexOf('initialData?: string,')
-    const initClear = controllerSource.indexOf('writeCoalescer.clear()', initStart)
-    const initPost = controllerSource.indexOf("type: 'init'", initStart)
-    expect(initStart).toBeGreaterThanOrEqual(0)
-    expect(initClear).toBeGreaterThan(initStart)
-    expect(initClear).toBeLessThan(initPost)
-
-    const clearStart = controllerSource.indexOf('clear() {', initPost)
-    const clearBody = controllerSource.slice(clearStart, clearStart + 160)
-    expect(clearStart).toBeGreaterThanOrEqual(0)
-    expect(clearBody.indexOf('writeCoalescer.clear()')).toBeGreaterThanOrEqual(0)
-    expect(clearBody.indexOf('writeCoalescer.clear()')).toBeLessThan(
-      clearBody.indexOf("postMessage({ type: 'clear' })")
-    )
-  })
-
-  it('flushes pending writes before resize and reflow so boundaries observe prior bytes', () => {
-    for (const method of ['resize', 'reflow'] as const) {
-      const start = controllerSource.indexOf(`${method}(cols: number, rows: number) {`)
-      expect(start).toBeGreaterThanOrEqual(0)
-      const body = controllerSource.slice(start, start + 300)
-      const flushIndex = body.indexOf('writeCoalescer.flushNow()')
-      const postIndex = body.indexOf(`postMessage({ type: '${method}'`)
-      expect(flushIndex).toBeGreaterThanOrEqual(0)
-      expect(postIndex).toBeGreaterThan(flushIndex)
-    }
-  })
-
-  it('clears the coalescer in both document-lifecycle hooks alongside pendingMessages', () => {
-    // Both hooks now reach one function, so the clearing is asserted once where it lives and the
-    // two WebView events are asserted to be the callers. Reading only the component would pass on
-    // a `resetReadiness` that had quietly stopped clearing either one.
-    const start = controllerSource.indexOf('const resetReadiness = useCallback')
-    expect(start).toBeGreaterThanOrEqual(0)
-    const body = controllerSource.slice(start, controllerSource.indexOf('}, [', start))
-    expect(body).toContain('pendingMessages.clear()')
-    expect(body).toContain('writeCoalescer.clear()')
-    expect(webViewSource).toContain('onLoadStart={resetReadiness}')
-    const terminated = webViewSource.indexOf('const handleContentProcessDidTerminate')
-    expect(terminated).toBeGreaterThanOrEqual(0)
-    expect(webViewSource.slice(terminated, webViewSource.indexOf('}, [', terminated))).toContain(
-      'resetReadiness()'
-    )
-  })
-
-  it('clears the coalescer on unmount so no timer leaks', () => {
-    const cleanupStart = controllerSource.indexOf('useEffect(() => {\n    return () => {')
-    expect(cleanupStart).toBeGreaterThanOrEqual(0)
-    const cleanupBody = controllerSource.slice(cleanupStart, cleanupStart + 160)
-    expect(cleanupBody).toContain('writeCoalescer.clear()')
-  })
 })
diff --git a/mobile/src/terminal/use-terminal-live-input-commit.test.ts b/mobile/src/terminal/use-terminal-live-input-commit.test.ts
index 87ad2b64292..211454c87ad 100644
--- a/mobile/src/terminal/use-terminal-live-input-commit.test.ts
+++ b/mobile/src/terminal/use-terminal-live-input-commit.test.ts
@@ -6,6 +6,13 @@ import type { TerminalLiveInputSender } from './terminal-live-input-sender'
 import { TERMINAL_LIVE_HELD_PREEDIT_COMMIT_DELAY_MS } from './terminal-live-preedit-mirror'
 import { useTerminalLiveInputCommit } from './use-terminal-live-input-commit'
 
+// The host's report is the seam's subject; here only whether it reports a range at all matters.
+const composingRange = vi.hoisted(() => ({ hostReportsNone: false }))
+vi.mock('../platform/live-input-composing-range', () => ({
+  reportedLiveInputComposing: (isComposing: boolean | undefined) =>
+    composingRange.hostReportsNone ? undefined : isComposing
+}))
+
 type TerminalLiveInputCommitHandlers = ReturnType<typeof useTerminalLiveInputCommit<string>>
 
 /** `isComposing` omitted models a platform that reports no marked-text range. */
@@ -121,6 +128,7 @@ function createTerminalLiveInputCommitHarness({
 describe('terminal live input commit hook', () => {
   afterEach(() => {
     vi.useRealTimers()
+    composingRange.hostReportsNone = false
   })
 
   it('Given Hangul composition and no marked-text report When steps arrive Then no jamo leaks', async () => {
@@ -168,6 +176,41 @@ describe('terminal live input commit hook', () => {
     expect(sent).toEqual([])
   })
 
+  it('Given an Android WebView composing each word When letters follow a slash Then each reaches the terminal as typed', async () => {
+    // Given: the page's field event is the DOM's, and an Android keyboard composes Latin words
+    composingRange.hostReportsNone = true
+    const { handlers, sent } = createTerminalLiveInputCommitHarness()
+
+    // When
+    changeLiveInput(handlers, '/', false)
+    await vi.waitFor(() => expect(sent).toHaveLength(1))
+    for (const fieldText of ['/t', '/tu', '/tui']) {
+      changeLiveInput(handlers, fieldText, true)
+      // Each keystroke on its own, so a held letter cannot hide inside a later batch.
+      await vi.waitFor(() => expect(sent).toHaveLength(fieldText.length))
+    }
+
+    // Then: what native Android sends for the same keys, which report no range there
+    await vi.waitFor(() => expect(sent).toEqual(['/', 't', 'u', 'i']))
+  })
+
+  it('Given an Android WebView composing Hangul When steps arrive Then the non-ASCII run still settles on the timer', async () => {
+    // Given
+    vi.useFakeTimers()
+    composingRange.hostReportsNone = true
+    const { handlers, sent } = createTerminalLiveInputCommitHarness()
+
+    // When
+    for (const fieldText of ['ㅎ', '하', '한']) {
+      changeLiveInput(handlers, fieldText, true)
+      await vi.advanceTimersByTimeAsync(50)
+    }
+    await vi.advanceTimersByTimeAsync(TERMINAL_LIVE_HELD_PREEDIT_COMMIT_DELAY_MS)
+
+    // Then
+    await vi.waitFor(() => expect(sent).toEqual(['한']))
+  })
+
   it('Given an iOS pinyin preedit When accessory Backspace edits it Then only the candidate reaches the terminal', async () => {
     // Given
     vi.useFakeTimers()
diff --git a/mobile/src/terminal/use-terminal-live-input-commit.ts b/mobile/src/terminal/use-terminal-live-input-commit.ts
index 55bc23c3dcc..485a6a1e425 100644
--- a/mobile/src/terminal/use-terminal-live-input-commit.ts
+++ b/mobile/src/terminal/use-terminal-live-input-commit.ts
@@ -1,5 +1,6 @@
 import { useCallback, useEffect, useRef, type RefObject } from 'react'
 import type { TextInput } from 'react-native'
+import { reportedLiveInputComposing } from '../platform/live-input-composing-range'
 import { getTerminalLiveSpecialKeyDecision } from './terminal-live-text-commit'
 import { sendTerminalLiveControlAfterPendingFlush } from './terminal-live-control-send-order'
 import type { TerminalLiveAccessoryInput } from './terminal-live-accessory-input'
@@ -148,7 +149,7 @@ export function useTerminalLiveInputCommit<TTabType extends string>({
       void applyLiveInputMirror(
         activeHandle,
         normalizeTerminalTextInput(nativeEvent.text),
-        nativeEvent.isComposing
+        reportedLiveInputComposing(nativeEvent.isComposing)
       )
     },
     [
diff --git a/mobile/src/terminal/use-terminal-webview-controller.ts b/mobile/src/terminal/use-terminal-webview-controller.ts
index c2c0575f548..8ca48f55a65 100644
--- a/mobile/src/terminal/use-terminal-webview-controller.ts
+++ b/mobile/src/terminal/use-terminal-webview-controller.ts
@@ -1,9 +1,14 @@
 import { useCallback, useEffect, useMemo, useRef } from 'react'
-import type { TerminalOscLinkRange } from '../../../src/shared/terminal-osc-link-ranges'
-import type { TerminalWebViewHandle, TerminalWebViewProps } from './terminal-webview-contract'
+import { readTerminalCellBox, type TerminalCellBox } from './terminal-cell-box'
+import { fitDimensionsFromCell } from './terminal-grid-fit'
+import type {
+  TerminalInit,
+  TerminalWebViewHandle,
+  TerminalWebViewProps
+} from './terminal-webview-contract'
 import { useTerminalWebViewEngineErrorState } from './terminal-webview-engine-error-state'
 import { useTerminalWebReadyWatchdog } from './terminal-webview-ready-watchdog'
-import type { TerminalWebViewCommand } from './terminal-webview-messages'
+import type { TerminalFrame, TerminalWebViewCommand } from './terminal-webview-messages'
 import { createTerminalWebViewPendingMessages } from './terminal-webview-pending-messages'
 import { dispatchTerminalWebViewNotification } from './terminal-webview-notification-dispatch'
 import { routeTerminalQueryReply } from './terminal-webview-query-reply-routing'
@@ -15,7 +20,7 @@ import { createTerminalWriteCoalescer } from './terminal-write-coalescer'
  *
  * The document is the same program on both platforms — inside the WebView it is the generated
  * script, on the page it is the modules that script is generated from — so the readiness
- * handshake, the pending queue, the write coalescer, the ready and measure promises and the whole
+ * handshake, the pending queue, the write coalescer, the ready promise and the whole
  * imperative handle are the same too. What differs is only how a command reaches the document and
  * how a notify comes back: a `postMessage` across the WebView bridge, or a direct call.
  *
@@ -61,7 +66,8 @@ export function useTerminalWebViewController(
     onTerminalTap,
     onFileTap,
     onOpenUrl,
-    onTextScaleChange
+    onTextScaleChange,
+    onCellBoxChange
   } = props
   const { pingsOnForegroundRecovery, post } = transport
   const isWebReadyRef = useRef(false)
@@ -70,9 +76,11 @@ export function useTerminalWebViewController(
   const pendingPingIdRef = useRef<number | null>(null)
   const terminalThemeKey = useMemo(() => JSON.stringify(terminalTheme ?? null), [terminalTheme])
   // Why: each init() call posts 'init' to the document and arms a fresh ready promise. The
-  // document's init() rAF chain ends with a 'ready' notify that resolves it. measureFitDimensions
-  // awaits this so it doesn't race ahead of term.open() / renderService population.
+  // document's init() rAF chain ends with a 'ready' notify that resolves it. A fit awaits this so
+  // it reads the box the init reported.
   const promises = useTerminalWebViewReadyPromises()
+  // The box the current document last reported; its re-reports cover a text-size change.
+  const cellBoxRef = useRef<TerminalCellBox | null>(null)
   const { clearEngineError, engineError, reportEngineError, reportNativeEngineError } =
     useTerminalWebViewEngineErrorState(onEngineError)
   const { armWebReadyWatchdog, clearWebReadyWatchdog } = useTerminalWebReadyWatchdog(
@@ -148,6 +156,8 @@ export function useTerminalWebViewController(
       routeTerminalQueryReply(msg, onTerminalQueryReply)
 
       if (msg.type === 'web-ready') {
+        // Why: nothing subscribes before ready, so a ready's box only sizes the subscribe after it.
+        cellBoxRef.current = readTerminalCellBox(msg)
         confirmWebReady(true)
       } else if (
         msg.type === 'pong' &&
@@ -157,11 +167,14 @@ export function useTerminalWebViewController(
         confirmWebReady(false)
       } else if (msg.type === 'ready') {
         // Why: the document's init() rAF chain has run — term is open, renderService is
-        // populated, first paint has happened. Resolve any pending awaitReady() so a queued
-        // measure can now safely read cell dims.
+        // populated, first paint has happened, and its box was reported. Resolve any pending
+        // awaitReady() so a queued fit reads that box.
         promises.resolveReady()
-      } else if (msg.type === 'measure-result') {
-        promises.resolveMeasure(msg)
+      } else if (msg.type === 'cell-box') {
+        cellBoxRef.current = readTerminalCellBox(msg)
+        if (msg.refit === true) {
+          onCellBoxChange?.()
+        }
       } else {
         dispatchTerminalWebViewNotification(msg, {
           reportEngineError,
@@ -194,7 +207,8 @@ export function useTerminalWebViewController(
       onTerminalTap,
       onFileTap,
       onOpenUrl,
-      onTextScaleChange
+      onTextScaleChange,
+      onCellBoxChange
     ]
   )
 
@@ -209,6 +223,7 @@ export function useTerminalWebViewController(
     pendingPingIdRef.current = null
     pendingMessages.clear()
     writeCoalescer.clear()
+    cellBoxRef.current = null
     armWebReadyWatchdog()
   }, [armWebReadyWatchdog, pendingMessages, writeCoalescer])
 
@@ -222,6 +237,17 @@ export function useTerminalWebViewController(
     postMessage({ type: 'set-font-scale', fontScale: textScale })
   }, [postMessage, textScale])
 
+  const fitDimensions = useCallback(
+    (frame: TerminalFrame) => {
+      const cell = cellBoxRef.current
+      // Why: a box at another scale (a reload keeps the mount's) fits nothing; the route stays unmeasured.
+      return cell && cell.fontScale === textScale && frame.width > 0 && frame.height > 0
+        ? fitDimensionsFromCell(cell, frame.width, frame.height)
+        : null
+    },
+    [textScale]
+  )
+
   const handle = useMemo<TerminalWebViewHandle>(
     () => ({
       prepareForForegroundRecovery() {
@@ -237,13 +263,7 @@ export function useTerminalWebViewController(
       write(data: string) {
         writeCoalescer.write(data)
       },
-      init(
-        cols: number,
-        rows: number,
-        initialData?: string,
-        preserveScroll?: boolean,
-        oscLinks?: TerminalOscLinkRange[]
-      ) {
+      init({ cols, rows, initialData, preserveScroll, oscLinks, frame }: TerminalInit) {
         // Why: arm a fresh ready promise BEFORE posting init. The document resolves it via the
         // 'ready' notify at the end of its rAF chain.
         promises.armReady()
@@ -258,28 +278,24 @@ export function useTerminalWebViewController(
           oscLinks,
           terminalTheme,
           fontScale: textScale,
-          preserveScroll
+          preserveScroll,
+          frame
         })
       },
-      resize(cols: number, rows: number) {
+      resize(cols: number, rows: number, frame: TerminalFrame | null) {
         // Why: resize/reflow must observe all prior writes or bytes reorder.
         writeCoalescer.flushNow()
-        postMessage({ type: 'resize', cols, rows })
+        postMessage({ type: 'resize', cols, rows, frame })
       },
-      reflow(cols: number, rows: number) {
+      reflow(cols: number, rows: number, frame: TerminalFrame | null) {
         writeCoalescer.flushNow()
-        postMessage({ type: 'reflow', cols, rows })
+        postMessage({ type: 'reflow', cols, rows, frame })
       },
       clear() {
         writeCoalescer.clear()
         postMessage({ type: 'clear' })
       },
-      measureFitDimensions(containerHeight?: number) {
-        if (!isWebReadyRef.current) {
-          return Promise.resolve(null)
-        }
-        return promises.measure(sendToDocument, containerHeight)
-      },
+      fitDimensions,
       resetZoom() {
         postMessage({ type: 'reset-zoom' })
       },
@@ -295,6 +311,7 @@ export function useTerminalWebViewController(
     }),
     [
       armWebReadyWatchdog,
+      fitDimensions,
       pingsOnForegroundRecovery,
       postMessage,
       promises,
diff --git a/mobile/src/test-support/bridged-parity/c2-page-closure.test.ts b/mobile/src/test-support/bridged-parity/c2-page-closure.test.ts
deleted file mode 100644
index ca797265cfe..00000000000
--- a/mobile/src/test-support/bridged-parity/c2-page-closure.test.ts
+++ /dev/null
@@ -1,235 +0,0 @@
-import { readdirSync } from 'node:fs'
-import { resolve } from 'node:path'
-import { describe, expect, it } from 'vitest'
-import { C1_PAGE_CLOSURE } from './c1-page-closure'
-import { C2_PAGE_CLOSURE } from './c2-page-closure'
-import { C2_TASK_SOURCE_CLOSURE_FAMILIES } from './c2-task-source-closure-families'
-import { C2_WORK_ITEM_CLOSURE_FAMILIES } from './c2-work-item-closure-families'
-import { C5_PAGE_CLOSURE } from './c5-page-closure'
-import { pinsFromSource } from './page-closure-pin-source'
-import { BRIDGED_PARITY_EXCLUSIONS } from './divergence-classes'
-import {
-  pageClosureDrift,
-  pageClosureExclusions,
-  pageClosureRunTotals,
-  pageClosureTotals,
-  type PageClosureObservation
-} from './page-closure'
-import { readGolden } from '../rpc-recording/golden-recording'
-
-const GOLDENS = resolve(import.meta.dirname, '../../../rpc-foundation/goldens')
-const C1_SOURCE = resolve(import.meta.dirname, 'c1-page-closure.ts')
-
-/** The run a corpus that diverged exactly as the pin says would hand the rule. */
-function asPinned(): Map<string, PageClosureObservation> {
-  const run = new Map<string, PageClosureObservation>()
-  for (const [family, goldens] of Object.entries(C2_PAGE_CLOSURE)) {
-    for (const [id, verdict] of Object.entries(goldens)) {
-      run.set(id, { family, verdict })
-    }
-  }
-  return run
-}
-
-describe('the C2 page closure', () => {
-  /**
-   * The census reads the committed table, and does not re-derive the closure.
-   *
-   * Nothing here or in the gate runs esbuild or maps a scenario's `sites` back to the module graph,
-   * so this fixes how many families the table may hold, not which families belong in it. A golden
-   * arriving in a family already pinned is caught, by `pageClosureDrift` and by this count. A new
-   * *family* entering the closure — a scenario recorded at a site the route newly imports — is
-   * invisible until someone re-derives the closure by hand, as C1's and C5's pins are too.
-   */
-  it('is the census the design named: 68 families, 257 goldens', () => {
-    const goldens = Object.values(C2_PAGE_CLOSURE).flatMap((family) => Object.keys(family))
-    expect({ families: Object.keys(C2_PAGE_CLOSURE).length, goldens: goldens.length }).toEqual({
-      families: 68,
-      goldens: 257
-    })
-    expect(new Set(goldens).size).toBe(goldens.length)
-  })
-
-  /**
-   * The totals, asserted beside the per-id pins rather than instead of them.
-   *
-   * A walk that compares each id to its own verdict cannot see a table built wrong in a way that is
-   * self-consistent — C5 derived exactly that file once, with an empty mismatch list and three
-   * goldens in the wrong class. These counts are what showed it, and the gate re-asserts them
-   * against the run rather than against the table.
-   */
-  it('pins how many goldens land in each class, which a per-id walk cannot see move', () => {
-    expect(pageClosureTotals(C2_PAGE_CLOSURE)).toEqual({
-      identical: 108,
-      'result-absent-settlement': 115,
-      'params-undefined': 29,
-      'result-absent-stream-release': 3,
-      'write-ordinal': 2
-    })
-  })
-
-  it("inherits C1's families whole, with the verdicts C1's file commits", () => {
-    // Against the file's text rather than the imported object, because today the composition
-    // spreads that object and a comparison to it agrees with itself. This holds the shape of the
-    // inheritance: that C2's table carries C1's families at C1's verdicts and overrides none of
-    // them, and it keeps holding if the spread is ever replaced by inlined entries.
-    //
-    // What it cannot hold: a verdict changed inside `c1-page-closure.ts`. C2 inherits whatever C1
-    // commits, so both sides of this comparison move together. Measured, that edit is red in the
-    // bridged-parity gate, which compares the pin to a run rather than to a file, and here in the
-    // class totals and the exclusion count, which pin absolute numbers. It is green in
-    // `c1-page-closure.test.ts`, whose exclusion check is `toBeGreaterThan(0)` and which pins no
-    // class totals at all.
-    //
-    // C2's own rule does not reproduce these pins — measured, it disagrees on 13 of the 103, being
-    // `tasks.smart-source-search` 7, `host-worktree-refresh` 5 and `worktree-catalog-snapshot` 1 —
-    // so inheritance is the derivation rather than a re-derivation that looked close.
-    const committed = pinsFromSource(C1_SOURCE)
-    // The reader found a table rather than nothing, which every assertion below depends on.
-    expect({
-      families: Object.keys(committed).length,
-      pins: Object.values(committed).flatMap(Object.keys).length
-    }).toEqual({ families: 20, pins: 94 })
-    for (const [family, pinned] of Object.entries(committed)) {
-      expect(C2_PAGE_CLOSURE[family], family).toEqual(pinned)
-    }
-    expect(Object.keys(C1_PAGE_CLOSURE)).toEqual(Object.keys(committed))
-  })
-
-  it('agrees with C5 object for object on every family both domains pin', () => {
-    // Two page closures that share a family share the goldens in it. Were one to be re-derived and
-    // the other inherited, this is the assertion that would not hold.
-    const shared = Object.keys(C5_PAGE_CLOSURE).filter((family) => family in C2_PAGE_CLOSURE)
-    expect(shared.length).toBe(20)
-    for (const family of shared) {
-      expect(C2_PAGE_CLOSURE[family], family).toEqual(C5_PAGE_CLOSURE[family])
-    }
-  })
-
-  it('adds 48 families, split across the two halves without overlap', () => {
-    // The composed table is a spread, so a family named in both halves would be taken from the last
-    // one silently. Disjointness is what makes the two files data rather than a precedence rule.
-    const work = Object.keys(C2_WORK_ITEM_CLOSURE_FAMILIES)
-    const source = Object.keys(C2_TASK_SOURCE_CLOSURE_FAMILIES)
-    expect(work.filter((family) => source.includes(family))).toEqual([])
-    expect(work.filter((family) => family in C1_PAGE_CLOSURE)).toEqual([])
-    expect(source.filter((family) => family in C1_PAGE_CLOSURE)).toEqual([])
-    expect({ work: work.length, source: source.length }).toEqual({ work: 26, source: 22 })
-    const added = Object.keys(C2_PAGE_CLOSURE).filter((family) => !(family in C1_PAGE_CLOSURE))
-    expect(added.sort()).toEqual([...work, ...source].sort())
-  })
-
-  it('names the families where a pin proves only that the divergence kept its name', () => {
-    // "266 certified" would read as 266 proofs of byte-identity. Six families have no byte-identical
-    // golden at all, so their 27 say only that the class did not change, and the PR body says so.
-    const wholly = Object.entries(C2_PAGE_CLOSURE)
-      .filter(([, pins]) => !Object.values(pins).includes('identical'))
-      .map(([family, pins]) => [family, Object.keys(pins).length] as const)
-    expect(wholly).toEqual([
-      ['host-worktree-refresh', 5],
-      ['tasks.item-checks-files', 6],
-      ['tasks.item-metadata-gitlab-mr', 2],
-      ['tasks.project-row-files-merge', 6],
-      ['tasks.provider-load', 6],
-      ['tasks.task-list-gitlab-items', 2]
-    ])
-  })
-
-  it('pins goldens that exist, in the family the corpus records them under', () => {
-    for (const [family, goldens] of Object.entries(C2_PAGE_CLOSURE)) {
-      for (const id of Object.keys(goldens)) {
-        // Through the corpus's own reader, which checks the format version and the value pool and
-        // throws a named diagnostic otherwise.
-        const recorded = readGolden(GOLDENS, id)
-        expect({ id, family: recorded.family }).toEqual({ id, family })
-      }
-    }
-  })
-
-  it('claims no golden the corpus does not have', () => {
-    const corpus = new Set(
-      readdirSync(GOLDENS)
-        .filter((name) => name.endsWith('.json'))
-        .map((name) => name.replace(/\.json$/, ''))
-    )
-    const missing = Object.values(C2_PAGE_CLOSURE)
-      .flatMap((family) => Object.keys(family))
-      .filter((id) => !corpus.has(id))
-    expect(missing).toEqual([])
-  })
-
-  it('excludes a closure golden only into a class that has a reason', () => {
-    const exclusions = pageClosureExclusions(C2_PAGE_CLOSURE)
-    expect(exclusions.length).toBe(149)
-    expect(exclusions.filter(([, name]) => BRIDGED_PARITY_EXCLUSIONS[name] === undefined)).toEqual(
-      []
-    )
-  })
-})
-
-describe('reading a run against the C2 pin', () => {
-  it('says nothing when the run is the pin', () => {
-    expect(pageClosureDrift(C2_PAGE_CLOSURE, asPinned())).toEqual([])
-    expect(pageClosureRunTotals(C2_PAGE_CLOSURE, asPinned())).toEqual(
-      pageClosureTotals(C2_PAGE_CLOSURE)
-    )
-  })
-
-  it('names a closure golden that changed verdict', () => {
-    const run = asPinned()
-    const found = [...run].find(([, seen]) => seen.verdict !== 'params-undefined')
-    if (found === undefined) {
-      throw new Error('the pin is empty')
-    }
-    const [id, observation] = found
-    run.set(id, { ...observation, verdict: 'params-undefined' })
-    const drift = pageClosureDrift(C2_PAGE_CLOSURE, run)
-    expect(drift.length).toBe(1)
-    expect(drift[0]).toContain(id)
-    expect(drift[0]).toContain(`pinned ${observation.verdict}, ran params-undefined`)
-    // And in the counts, which is the check that holds when a second golden moves the other way.
-    expect(pageClosureRunTotals(C2_PAGE_CLOSURE, run)).not.toEqual(
-      pageClosureTotals(C2_PAGE_CLOSURE)
-    )
-  })
-
-  it('names a golden newly derived into a closure family, which no id list would', () => {
-    const run = asPinned()
-    const [family] = Object.keys(C2_PAGE_CLOSURE)
-    if (family === undefined) {
-      throw new Error('the pin is empty')
-    }
-    run.set('matrix-arrived-1', { family, verdict: 'identical' })
-    expect(pageClosureDrift(C2_PAGE_CLOSURE, run)).toEqual([
-      `${family}: arrived matrix-arrived-1; left (none)`
-    ])
-  })
-
-  it('names a closure golden the run stopped producing, three ways', () => {
-    const run = asPinned()
-    const [family, goldens] = Object.entries(C2_PAGE_CLOSURE)[0] ?? []
-    const [id] = Object.keys(goldens ?? {})
-    if (family === undefined || id === undefined) {
-      throw new Error('the pin is empty')
-    }
-    run.delete(id)
-    expect(pageClosureDrift(C2_PAGE_CLOSURE, run)).toEqual([
-      `${family}: arrived (none); left ${id}`
-    ])
-    // Drift is one of three. The run's totals fall short of the pin's, and the census above fixes
-    // the number of goldens the table may hold, so a drop cannot be absorbed by deleting the pin.
-    expect(pageClosureRunTotals(C2_PAGE_CLOSURE, run)).not.toEqual(
-      pageClosureTotals(C2_PAGE_CLOSURE)
-    )
-    expect([...run].filter(([, seen]) => seen.family in C2_PAGE_CLOSURE).length).toBe(256)
-  })
-
-  it('ignores every golden outside the closure, which is most of the corpus', () => {
-    const run = asPinned()
-    run.set('session-diff-review-elsewhere', {
-      family: 'session.diff-review',
-      verdict: 'result-absent-settlement'
-    })
-    expect(pageClosureDrift(C2_PAGE_CLOSURE, run)).toEqual([])
-  })
-})
diff --git a/mobile/src/test-support/bridged-parity/c3-page-closure.test.ts b/mobile/src/test-support/bridged-parity/c3-page-closure.test.ts
deleted file mode 100644
index afc1c897564..00000000000
--- a/mobile/src/test-support/bridged-parity/c3-page-closure.test.ts
+++ /dev/null
@@ -1,222 +0,0 @@
-import { readdirSync } from 'node:fs'
-import { resolve } from 'node:path'
-import { describe, expect, it } from 'vitest'
-import { C1_PAGE_CLOSURE } from './c1-page-closure'
-import { C2_PAGE_CLOSURE } from './c2-page-closure'
-import { C3_PAGE_CLOSURE } from './c3-page-closure'
-import { C3_EXPLORER_CLOSURE_FAMILIES } from './c3-explorer-closure-families'
-import { C3_PREVIEW_CLOSURE_FAMILIES } from './c3-preview-closure-families'
-import { C5_PAGE_CLOSURE } from './c5-page-closure'
-import { pinsFromSource } from './page-closure-pin-source'
-import { BRIDGED_PARITY_EXCLUSIONS } from './divergence-classes'
-import {
-  pageClosureDrift,
-  pageClosureExclusions,
-  pageClosureRunTotals,
-  pageClosureTotals,
-  type PageClosureObservation
-} from './page-closure'
-import { readGolden } from '../rpc-recording/golden-recording'
-
-const GOLDENS = resolve(import.meta.dirname, '../../../rpc-foundation/goldens')
-const C1_SOURCE = resolve(import.meta.dirname, 'c1-page-closure.ts')
-
-/** The run a corpus that diverged exactly as the pin says would hand the rule. */
-function asPinned(): Map<string, PageClosureObservation> {
-  const run = new Map<string, PageClosureObservation>()
-  for (const [family, goldens] of Object.entries(C3_PAGE_CLOSURE)) {
-    for (const [id, verdict] of Object.entries(goldens)) {
-      run.set(id, { family, verdict })
-    }
-  }
-  return run
-}
-
-describe('the C3 page closure', () => {
-  /**
-   * The census reads the committed table, and does not re-derive the closure.
-   *
-   * Nothing here or in the gate runs esbuild or maps a scenario's `sites` back to the module graph,
-   * so this fixes how many families the table may hold, not which families belong in it. A golden
-   * arriving in a family already pinned is caught, by `pageClosureDrift` and by this count. A new
-   * *family* entering the closure is invisible until someone re-derives it by hand — which
-   * `config/scripts/mobile-web-app-page-closure-families.test.mjs` now does for both files routes.
-   */
-  it('is the census the design named: 26 families, 116 goldens', () => {
-    const goldens = Object.values(C3_PAGE_CLOSURE).flatMap((family) => Object.keys(family))
-    expect({ families: Object.keys(C3_PAGE_CLOSURE).length, goldens: goldens.length }).toEqual({
-      families: 26,
-      goldens: 116
-    })
-    expect(new Set(goldens).size).toBe(goldens.length)
-  })
-
-  /**
-   * The totals, asserted beside the per-id pins rather than instead of them.
-   *
-   * A walk that compares each id to its own verdict cannot see a table built wrong in a way that is
-   * self-consistent — C5 derived exactly that file once, with an empty mismatch list and three
-   * goldens in the wrong class. These counts are what showed it, and the gate re-asserts them
-   * against the run rather than against the table.
-   */
-  it('pins how many goldens land in each class, which a per-id walk cannot see move', () => {
-    expect(pageClosureTotals(C3_PAGE_CLOSURE)).toEqual({
-      identical: 60,
-      'result-absent-settlement': 44,
-      'params-undefined': 7,
-      'result-absent-stream-release': 3,
-      'write-ordinal': 2
-    })
-  })
-
-  it("inherits C1's families whole, with the verdicts C1's file commits", () => {
-    // Against the file's text rather than the imported object: the composition spreads that object,
-    // so a hand-edited inherited entry would be read back as C1's and agree with itself.
-    //
-    // What this cannot see is an edit to `c1-page-closure.ts` itself, because both sides of the
-    // comparison then move together. What it does see is a C3 half redeclaring an inherited family,
-    // which the spread would otherwise take silently from the last table. Both measured: flipping
-    // `settings-repo-metadata-icons` in C1's file leaves this case green and reds seven others —
-    // the class totals and the exclusion counts in C2's suite and this one, both cross-series
-    // agreements, and C5's own inheritance case, which compares against an independent literal
-    // rather than a spread.
-    //
-    // Redeclaring `settings.repo-metadata` in the preview half always reds this case; how many
-    // others go with it depends on the shape of the redeclaration, so the number is not the claim.
-    // Measured: one golden under the family's name reds seven, because it also shrinks the census
-    // and leaves that family with no byte-identical golden. The family copied verbatim with a
-    // single verdict flipped reds five, the census unmoved. Both keep the load-bearing half — the
-    // spread takes the last table's entry, and this case is what sees it.
-    //
-    // C2's rule does not reproduce these pins — measured here, it disagrees on 13 of the 94,
-    // being `tasks.smart-source-search` 7, `host-worktree-refresh` 5 and
-    // `worktree-catalog-snapshot` 1 — so inheritance is the derivation rather than a
-    // re-derivation that looked close.
-    const committed = pinsFromSource(C1_SOURCE)
-    expect({
-      families: Object.keys(committed).length,
-      pins: Object.values(committed).flatMap(Object.keys).length
-    }).toEqual({ families: 20, pins: 94 })
-    for (const [family, pinned] of Object.entries(committed)) {
-      expect(C3_PAGE_CLOSURE[family], family).toEqual(pinned)
-    }
-  })
-
-  it('agrees with C2 and C5 object for object on every family they share', () => {
-    // Three page closures that share a family share the goldens in it. Were one re-derived and the
-    // others inherited, this is the assertion that would not hold.
-    for (const [name, other] of [
-      ['C2', C2_PAGE_CLOSURE],
-      ['C5', C5_PAGE_CLOSURE]
-    ] as const) {
-      const shared = Object.keys(other).filter((family) => family in C3_PAGE_CLOSURE)
-      expect(shared.length, name).toBe(20)
-      for (const family of shared) {
-        expect(C3_PAGE_CLOSURE[family], `${name}/${family}`).toEqual(other[family])
-      }
-    }
-  })
-
-  it('adds 6 families, split across the two routes without overlap', () => {
-    // The composed table is a spread, so a family named in both halves would be taken from the last
-    // one silently. Disjointness is what makes the two files data rather than a precedence rule.
-    const explorer = Object.keys(C3_EXPLORER_CLOSURE_FAMILIES)
-    const preview = Object.keys(C3_PREVIEW_CLOSURE_FAMILIES)
-    expect(explorer.filter((family) => preview.includes(family))).toEqual([])
-    expect(explorer.filter((family) => family in C1_PAGE_CLOSURE)).toEqual([])
-    expect(preview.filter((family) => family in C1_PAGE_CLOSURE)).toEqual([])
-    expect({ explorer: explorer.length, preview: preview.length }).toEqual({
-      explorer: 1,
-      preview: 5
-    })
-    const added = Object.keys(C3_PAGE_CLOSURE).filter((family) => !(family in C1_PAGE_CLOSURE))
-    expect(added.sort()).toEqual([...explorer, ...preview].sort())
-  })
-
-  it('names the families where a pin proves only that the divergence kept its name', () => {
-    // "125 certified" would read as 125 proofs of byte-identity. One family has no byte-identical
-    // golden at all, so its 5 say only that the class did not change, and the PR body says so.
-    const wholly = Object.entries(C3_PAGE_CLOSURE)
-      .filter(([, pins]) => !Object.values(pins).includes('identical'))
-      .map(([family, pins]) => [family, Object.keys(pins).length] as const)
-    expect(wholly).toEqual([['host-worktree-refresh', 5]])
-  })
-
-  it('pins goldens that exist, in the family the corpus records them under', () => {
-    for (const [family, goldens] of Object.entries(C3_PAGE_CLOSURE)) {
-      for (const id of Object.keys(goldens)) {
-        const recorded = readGolden(GOLDENS, id)
-        expect({ id, family: recorded.family }).toEqual({ id, family })
-      }
-    }
-  })
-
-  it('claims no golden the corpus does not have', () => {
-    const corpus = new Set(
-      readdirSync(GOLDENS)
-        .filter((name) => name.endsWith('.json'))
-        .map((name) => name.replace(/\.json$/, ''))
-    )
-    const missing = Object.values(C3_PAGE_CLOSURE)
-      .flatMap((family) => Object.keys(family))
-      .filter((id) => !corpus.has(id))
-    expect(missing).toEqual([])
-  })
-
-  it('excludes a closure golden only into a class that has a reason', () => {
-    const exclusions = pageClosureExclusions(C3_PAGE_CLOSURE)
-    expect(exclusions.length).toBe(56)
-    expect(exclusions.filter(([, name]) => BRIDGED_PARITY_EXCLUSIONS[name] === undefined)).toEqual(
-      []
-    )
-  })
-})
-
-describe('reading a run against the C3 pin', () => {
-  it('says nothing when the run is the pin', () => {
-    expect(pageClosureDrift(C3_PAGE_CLOSURE, asPinned())).toEqual([])
-    expect(pageClosureRunTotals(C3_PAGE_CLOSURE, asPinned())).toEqual(
-      pageClosureTotals(C3_PAGE_CLOSURE)
-    )
-  })
-
-  it('names a closure golden that changed verdict', () => {
-    const run = asPinned()
-    const found = [...run].find(([, seen]) => seen.verdict !== 'params-undefined')
-    if (found === undefined) {
-      throw new Error('the pin is empty')
-    }
-    const [id, observation] = found
-    run.set(id, { ...observation, verdict: 'params-undefined' })
-    const drift = pageClosureDrift(C3_PAGE_CLOSURE, run)
-    expect(drift.length).toBe(1)
-    expect(drift[0]).toContain(id)
-    expect(drift[0]).toContain(`pinned ${observation.verdict}, ran params-undefined`)
-  })
-
-  it('names a golden the run stopped producing, and moves the totals with it', () => {
-    const run = asPinned()
-    const [family, goldens] = Object.entries(C3_PAGE_CLOSURE)[0] ?? []
-    const [id] = Object.keys(goldens ?? {})
-    if (family === undefined || id === undefined) {
-      throw new Error('the pin is empty')
-    }
-    run.delete(id)
-    expect(pageClosureDrift(C3_PAGE_CLOSURE, run)).toEqual([
-      `${family}: arrived (none); left ${id}`
-    ])
-    // The totals move too, which is the half a per-id walk over what remains cannot see.
-    expect(pageClosureRunTotals(C3_PAGE_CLOSURE, run)).not.toEqual(
-      pageClosureTotals(C3_PAGE_CLOSURE)
-    )
-  })
-
-  it('ignores every golden outside the closure, which is most of the corpus', () => {
-    const run = asPinned()
-    run.set('a-golden-from-another-domain', {
-      family: 'session.diff-review',
-      verdict: 'result-absent-settlement'
-    })
-    expect(pageClosureDrift(C3_PAGE_CLOSURE, run)).toEqual([])
-  })
-})
diff --git a/mobile/src/test-support/bridged-parity/divergence-classes.test.ts b/mobile/src/test-support/bridged-parity/divergence-classes.test.ts
index 8cb82564a9c..ac5fd17cb70 100644
--- a/mobile/src/test-support/bridged-parity/divergence-classes.test.ts
+++ b/mobile/src/test-support/bridged-parity/divergence-classes.test.ts
@@ -236,7 +236,7 @@ describe('what the pin still admits', () => {
   it('goes red on a golden that stopped diverging, which every other check lets through', () => {
     // The direction the rest of the suite cannot see. One `result-absent-settlement` golden
     // reported `identical` instead: nothing is unclassified, every diverging golden is still in an
-    // excluded class, and the corpus is still 786. Only these two numbers moved.
+    // excluded class, and the corpus is still 790. Only these two numbers moved.
     const tally = asCounted()
     const moved: BridgedParityTally = {
       identical: tally.identical + 1,
@@ -250,7 +250,7 @@ describe('what the pin still admits', () => {
     expect(drift.join('\n')).toContain(
       `identical: pinned ${tally.identical}, ran ${moved.identical}`
     )
-    expect(drift.join('\n')).toContain('result-absent-settlement: pinned 340, ran 339')
+    expect(drift.join('\n')).toContain('result-absent-settlement: pinned 343, ran 342')
   })
 
   it('goes red on a class that grew and on the corpus losing a golden', () => {
diff --git a/mobile/src/test-support/bridged-parity/divergence-classes.ts b/mobile/src/test-support/bridged-parity/divergence-classes.ts
index 8ece9d85bc3..bd450d52b16 100644
--- a/mobile/src/test-support/bridged-parity/divergence-classes.ts
+++ b/mobile/src/test-support/bridged-parity/divergence-classes.ts
@@ -2,7 +2,7 @@
  * What a bridged-replay divergence is called, decided by a rule rather than by reading a message.
  *
  * Beside the recorder rather than inside it. Reading a failure cannot change what a recording
- * records, so `recorderSha256` must not cover this: a tightened rule would otherwise re-record 786
+ * records, so `recorderSha256` must not cover this: a tightened rule would otherwise re-record 787
  * headers to say nothing. The recorder's own directory is digested whole, which is why this lives
  * one level up in `test-support`.
  */
@@ -165,7 +165,7 @@ export const BRIDGED_PARITY_EXCLUSIONS: Readonly<Partial<Record<BridgedParityCla
 }
 
 /**
- * What this tree measures, per class, over all 786 goldens.
+ * What this tree measures, per class, over all 790 goldens.
  *
  * A pin, not a description: `bridgedParityTallyDrift` holds every number below to itself exactly,
  * in both directions, and this module's test pins their sum to the size of the corpus. A class that
@@ -179,14 +179,14 @@ export const BRIDGED_PARITY_EXCLUSIONS: Readonly<Partial<Record<BridgedParityCla
  * same story — both numbers move, and both moves are edits here rather than a quiet pass.
  */
 export const BRIDGED_PARITY_BASELINE: Readonly<Record<BridgedParityClass | 'identical', number>> = {
-  identical: 396,
+  identical: 397,
   // Closed by the `_meta` widening: the page's reader is `isRpcResponse` itself.
   'reply-meta-required': 0,
   // Settling a refused reply moved three goldens here out of `write-ordinal`: a rejection that
   // now arrives differs before the ordinal that also moved does. Nothing stopped replaying
   // identically, and the corpus is a fixed size, so a shuffle between two excluded classes cannot
   // hide one.
-  'result-absent-settlement': 340,
+  'result-absent-settlement': 343,
   // Four left here and two left `write-ordinal` for the class below, which is the `cancel` a
   // refused stream frame now posts: the run stops at a renamed occurrence before it reaches the
   // checkpoint or the ordinal that used to be what differed first.
diff --git a/mobile/src/test-support/census-source-files.test.ts b/mobile/src/test-support/census-source-files.test.ts
index 446a4097f66..c5639bfdf1c 100644
--- a/mobile/src/test-support/census-source-files.test.ts
+++ b/mobile/src/test-support/census-source-files.test.ts
@@ -1,4 +1,4 @@
-import { mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join, relative } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -74,36 +74,4 @@ describe('the source files a census reads', () => {
       expect(isGeneratedSource(entry), entry).toBe(true)
     }
   })
-
-  it('is the only walk of its kind left in the tree', () => {
-    // The line every census used to hold a copy of. One spelling, so a tenth census cannot quietly
-    // reintroduce the cost by pasting the walk rather than importing it.
-    const copies: string[] = []
-    const walk = (directory: string): void => {
-      for (const entry of readdirSync(directory, { withFileTypes: true })) {
-        const path = join(directory, entry.name)
-        if (entry.isDirectory()) {
-          if (entry.name !== 'node_modules') {
-            walk(path)
-          }
-          continue
-        }
-        if (!/\.tsx?$/.test(entry.name) || isGeneratedSource(entry.name)) {
-          continue
-        }
-        if (readFileSync(path, 'utf8').includes("entry.name === 'node_modules' ? []")) {
-          copies.push(relative(mobileRoot, path))
-        }
-      }
-    }
-    walk(join(mobileRoot, 'src'))
-    walk(join(mobileRoot, 'app'))
-    // This file is in the list because it carries the line as the text it greps for; the module
-    // beside it is the walk itself. Named rather than filtered out, so a third entry is a failure
-    // that reads as one.
-    expect(copies.sort()).toEqual([
-      'src/test-support/census-source-files.test.ts',
-      'src/test-support/census-source-files.ts'
-    ])
-  })
 })
diff --git a/mobile/src/test-support/rpc-recording/README.md b/mobile/src/test-support/rpc-recording/README.md
index 217391663ce..5139f9aa28b 100644
--- a/mobile/src/test-support/rpc-recording/README.md
+++ b/mobile/src/test-support/rpc-recording/README.md
@@ -185,15 +185,13 @@ five spellings were five independent ways to reach a `ReferenceError` seconds in
 `hostClientContextExposure` is the one copy; the trade is that it sits inside `recorderSha256`, so
 editing it re-records all 786 goldens rather than the five families. A rename of the local is still
 invisible to `tsc` — nothing short of editing the product module makes a private local checkable —
-so `adapter-seam.test.ts` asserts the declaration it names exists exactly once, and refuses a sixth
-inline copy.
+so a rename lands as a `ReferenceError` in every recording that mounts through it.
 
-The adapter seam is the directory, not a filename convention, because a convention is a rule nobody
-enforces. `adapter-seam.test.ts` enforces this one: every file under `adapters/` is a registered
-module, every registered module is declared in the file it is registered under, no adapter module
-imports a sibling (which would leave a golden pinned to one module and driven by two), and
-`pilotMountAdapters` mounts nothing of its own — an adapter defined in an engine file would be
-pinned by `recorderSha256` on all 153 goldens instead of by `adapterSha256` on its own.
+The adapter seam is the directory, not a filename convention: every file under `adapters/` is a
+registered module, every registered module is declared in the file it is registered under, no
+adapter module imports a sibling (which would leave a golden pinned to one module and driven by
+two), and `pilotMountAdapters` mounts nothing of its own — an adapter defined in an engine file
+would be pinned by `recorderSha256` on all 153 goldens instead of by `adapterSha256` on its own.
 
 `scenarioSha256` covers the scenario input _that golden_ was recorded from — one manifest scenario
 for a pilot golden, the generated variants and any hoisted prelude for a matrix or schedule golden,
@@ -529,9 +527,15 @@ a tree that does not produce them, which is the one claim this header exists to
    derived scenarios rather than the manifest, so a repin alone never moves it.
 5. Commit the repin and the refresh together, and state the cause.
 
-After a squash-merge the pinned sha is unreachable from main, so the next recording on main repins
-to main's tip in a follow-up — the same two-step #20563 and #20895 used. A reviewer checking an
-in-flight branch resolves the pin against the branch, where it is a real commit.
+A squash-merge leaves the pinned sha out of main's history, and no follow-up repin is needed: the
+pin guard asks GitHub which pull requests contain the pinned commit
+(`GET /repos/{owner}/{repo}/commits/{sha}/pulls`), fetches each one's `refs/pull/<n>/head`, which
+GitHub keeps after the branch is deleted, and passes only when git finds the pin in one of those
+heads. The squash title plays no part, so editing it at merge time is safe. Run `pnpm --dir mobile
+exec tsx scripts/rpc-recording-pin-guard.mts reachable` to fetch a pin your clone does not have
+before checking it out. It works without a token, and sends `GITHUB_TOKEN` or `GH_TOKEN` when one
+is set, which lifts GitHub's unauthenticated rate limit. A reviewer checking an in-flight branch
+resolves the pin against the branch, where it is a real commit.
 
 Editing the recorder engine on a migration branch is the awkward case: `recorderSha256` moves, so
 every golden needs rewriting, but the product tree no longer matches `baseline`, and bumping
@@ -654,10 +658,9 @@ timer has not run when `dispose()` returns, so reading the set first made a defe
 byte-identical to a stream nobody ever closed.
 
 Why it is not enough to watch the wire: closing a stream only writes a frame when its method has an
-unsubscribe builder, and `agentSession.subscribe` has none. `notifications.subscribe` had none
-until the transport took over its release; deleting its cleanup's `unsubscribeStream()` used to
-fail one golden, the cutover scenario written for it, and the next builder-less method needs no
-scenario of its own.
+unsubscribe builder. `notifications.subscribe` had none until the transport took over its release;
+deleting its cleanup's `unsubscribeStream()` used to fail one golden, the cutover scenario written
+for it, and the next builder-less method needs no scenario of its own.
 
 An empty set is not recorded, so the corpus stays quiet and a family that starts leaking gains a
 checkpoint. Five goldens report a non-empty set today, and all five are the same non-leak: the two
diff --git a/mobile/src/test-support/rpc-recording/adapters/diff-review-action-mount-adapters.ts b/mobile/src/test-support/rpc-recording/adapters/diff-review-action-mount-adapters.ts
index cc8c69061d2..681caa946f9 100644
--- a/mobile/src/test-support/rpc-recording/adapters/diff-review-action-mount-adapters.ts
+++ b/mobile/src/test-support/rpc-recording/adapters/diff-review-action-mount-adapters.ts
@@ -31,6 +31,9 @@ export function diffReviewActionMountAdapters(
       const useInteractions = modules.load<
         typeof import('../../../session/use-mobile-diff-review-interactions')
       >('mobile/src/session/use-mobile-diff-review-interactions.ts').useMobileDiffReviewInteractions
+      const reviewSheets = modules.load<
+        typeof import('../../../session/mobile-diff-review-sheets')
+      >('mobile/src/session/mobile-diff-review-sheets.ts')
       const staleInput = modules.load<
         typeof import('../../../session/mobile-native-chat-stale-input')
       >('mobile/src/session/mobile-native-chat-stale-input.ts')
@@ -75,13 +78,23 @@ export function diffReviewActionMountAdapters(
       }
       let actionError: string | null = null
       let busyAction: string | null = null
-      let sendSheet: SendSheetState | null = null
+      let sheets = reviewSheets.NO_REVIEW_SHEETS
+      const sheetIntents = reviewSheets.reviewSheetIntents((action) => {
+        sheets = reviewSheets.reduceReviewSheets(sheets, action)
+      })
+      const sendSheet = (): SendSheetState | null =>
+        sheets.requested?.kind === 'send' ? sheets.requested.load : null
       let interactions: ReturnType<typeof useInteractions>
       const hook = hookMount(() => {
         interactions = useInteractions(
           mountFixture<Parameters<typeof useInteractions>[0]>({
             client,
             connState: 'connected',
+            hostCapabilities: [
+              'agent.launch.v2',
+              'agent.launch.replay.v1',
+              'agent.launch.replay-required.v1'
+            ],
             hostId: HOST,
             worktreeId: WORKSPACE,
             screenState,
@@ -101,7 +114,6 @@ export function diffReviewActionMountAdapters(
             setFilter: () => {},
             setCurrentIndex: () => {},
             setActiveHunkIndex: () => {},
-            setComposer: () => {},
             setComposerBody: () => {},
             setActionError: (update) => {
               actionError = typeof update === 'function' ? update(actionError) : update
@@ -109,10 +121,7 @@ export function diffReviewActionMountAdapters(
             setBusyAction: (update) => {
               busyAction = typeof update === 'function' ? update(busyAction) : update
             },
-            setSendSheet: (update) => {
-              sendSheet = typeof update === 'function' ? update(sendSheet) : update
-            },
-            setShowCompletion: () => {},
+            sheets: sheetIntents,
             loadReviewData: () => {
               effect('load-review-data', {})
               return Promise.resolve()
@@ -163,7 +172,7 @@ export function diffReviewActionMountAdapters(
             throw new Error(`Unknown review action: ${name}${String(args.unused ?? '')}`)
           })
         },
-        state: () => ({ screenState, actionError, busyAction, sendSheet }),
+        state: () => ({ screenState, actionError, busyAction, sendSheet: sendSheet() }),
         dispose: () => {
           staleInput.resetMobileNativeChatStaleInputForTests()
           hook.unmount()
diff --git a/mobile/src/test-support/rpc-recording/adapters/github-pr-mount-adapters.ts b/mobile/src/test-support/rpc-recording/adapters/github-pr-mount-adapters.ts
index f61d9b6eb6c..94e604d90e1 100644
--- a/mobile/src/test-support/rpc-recording/adapters/github-pr-mount-adapters.ts
+++ b/mobile/src/test-support/rpc-recording/adapters/github-pr-mount-adapters.ts
@@ -171,12 +171,23 @@ export function githubPrMountAdapters(
     'session.pr-triage-launch': ({ client }) => {
       const launch = modules.load<typeof import('../../../session/pr-ai-triage-launch')>(
         'mobile/src/session/pr-ai-triage-launch.ts'
-      ).createTerminalAndSendPrompt
+      ).launchAgentWithPrompt
       let launched: unknown = 'unlaunched'
       return {
         action: (_name, args) =>
-          launch(client, WORKTREE, String(args.prompt ?? 'Fix the failing checks')).then(() => {
-            launched = 'sent'
+          launch({
+            client,
+            // A host older than the launch capabilities advertises neither.
+            hostCapabilities:
+              args.legacyHost === true
+                ? []
+                : ['agent.launch.v2', 'agent.launch.replay.v1', 'agent.launch.replay-required.v1'],
+            worktreeId: WORKTREE,
+            actionId: 'fixChecks',
+            prompt: String(args.prompt ?? 'Fix the failing checks'),
+            launchSource: 'task_page'
+          }).then((result) => {
+            launched = result
           }),
         state: () => ({ launched }),
         dispose: () => {}
diff --git a/mobile/src/test-support/rpc-recording/adapters/pairing-journal-mount-adapters.ts b/mobile/src/test-support/rpc-recording/adapters/pairing-journal-mount-adapters.ts
index 64a6c8715b5..26cd6d0a0d3 100644
--- a/mobile/src/test-support/rpc-recording/adapters/pairing-journal-mount-adapters.ts
+++ b/mobile/src/test-support/rpc-recording/adapters/pairing-journal-mount-adapters.ts
@@ -51,7 +51,7 @@ export function pairingJournalMountAdapters(
               effect('bundle-written', { version: written.current.version })
             },
             loadHosts: async () => [],
-            saveHost: async () => {
+            savePairedHost: async () => {
               effect('host-saved', HOST_ID)
             },
             connectRelay: () => candidateClient(client, effect, 'relay'),
@@ -95,8 +95,8 @@ export function pairingJournalMountAdapters(
               connectRelay: () => candidateClient(client, effect, 'relay'),
               resolveInviteDirector: async () => pairingRelay(),
               resolveHostIdentity: async () => ({ id: HOST_ID, name: 'Fixture host' }),
-              saveHost: async (host: { relayHostId?: string }) => {
-                savedHost = host.relayHostId ?? 'direct-only'
+              savePairedHost: async (host: { relay?: { relayHostId: string } }) => {
+                savedHost = host.relay?.relayHostId ?? 'direct-only'
                 effect('host-saved', savedHost)
               },
               saveJournal: async () => {
diff --git a/mobile/src/test-support/rpc-recording/adapters/relay-credential-mount-adapters.ts b/mobile/src/test-support/rpc-recording/adapters/relay-credential-mount-adapters.ts
index 6cf359e7fb4..75a11afadf9 100644
--- a/mobile/src/test-support/rpc-recording/adapters/relay-credential-mount-adapters.ts
+++ b/mobile/src/test-support/rpc-recording/adapters/relay-credential-mount-adapters.ts
@@ -106,7 +106,7 @@ export function relayCredentialMountAdapters(
               writeBundle: async (written: { current: { version: number } }) => {
                 effect('bundle-written', { version: written.current.version })
               },
-              saveHost: async () => {
+              setRelayRouting: async () => {
                 effect('host-saved', HOST_ID)
               },
               deleteBundle: async () => {
@@ -116,7 +116,7 @@ export function relayCredentialMountAdapters(
           })
           started.then(
             (result) => {
-              outcome = result === null ? 'declined' : result.host.relayHostId
+              outcome = result === null ? 'declined' : result.relay.relayHostId
             },
             (error: unknown) => {
               outcome = `failed: ${error instanceof Error ? error.message : String(error)}`
diff --git a/mobile/src/test-support/rpc-recording/adapters/terminal-mount-adapters.ts b/mobile/src/test-support/rpc-recording/adapters/terminal-mount-adapters.ts
index 0cb0d559cbc..8af181a469b 100644
--- a/mobile/src/test-support/rpc-recording/adapters/terminal-mount-adapters.ts
+++ b/mobile/src/test-support/rpc-recording/adapters/terminal-mount-adapters.ts
@@ -12,9 +12,10 @@ function terminalWebViewHandle(
   dims: { cols: number; rows: number }
 ) {
   return {
-    measureFitDimensions: (frameHeight?: number) => {
-      effect('measure-fit', { frameHeight: frameHeight ?? null })
-      return Promise.resolve(dims)
+    awaitReady: () => Promise.resolve(),
+    fitDimensions: (frame: { height: number }) => {
+      effect('measure-fit', { frameHeight: frame.height })
+      return dims
     },
     reflow: (cols: number, rows: number) => effect('reflow', { cols, rows })
   }
@@ -106,7 +107,7 @@ export function terminalMountAdapters(
         notifications = useRefit({
           activeHandleRef: { current: HANDLE },
           terminalRefs,
-          terminalFrameHeightRef: { current: 600 },
+          terminalFrameRef: { current: { width: 390, height: 600 } },
           viewportRef,
           viewportMeasuredRef,
           nativeChatCoveredRef: { current: false },
@@ -116,7 +117,6 @@ export function terminalMountAdapters(
           connState,
           tabStripVisible: true,
           textScale: 1,
-          terminalFrameWidth: 390,
           unsubscribeTerminal: (handle: string) => effect('unsubscribe-terminal', { handle }),
           subscribeToTerminal: (handle: string) => effect('subscribe-terminal', { handle })
         } as unknown as Parameters<typeof useRefit>[0])
diff --git a/mobile/src/test-support/rpc-recording/compiled-operation-module.test.ts b/mobile/src/test-support/rpc-recording/compiled-operation-module.test.ts
new file mode 100644
index 00000000000..c79a7141d5c
--- /dev/null
+++ b/mobile/src/test-support/rpc-recording/compiled-operation-module.test.ts
@@ -0,0 +1,30 @@
+import { describe, expect, it } from 'vitest'
+import { compiledOperationModule } from './compiled-operation-module'
+
+describe('compiled operation code', () => {
+  it('reuses identical code but separates source, exposure and diagnostic filename', () => {
+    const source = 'const value: number = 1; export const read = () => value'
+    const original = compiledOperationModule('original.ts', source, '')
+    expect(compiledOperationModule('original.ts', source, '')).toBe(original)
+    expect(compiledOperationModule('original.ts', source.replace('= 1', '= 2'), '')).not.toBe(
+      original
+    )
+    expect(compiledOperationModule('original.ts', source, '\nexports.extra = value')).not.toBe(
+      original
+    )
+    expect(compiledOperationModule('different.ts', source, '')).not.toBe(original)
+  })
+
+  it('bounds retained code and still evaluates an evicted module correctly', () => {
+    const source = 'export const value = 42'
+    const original = compiledOperationModule('evicted.ts', source, '')
+    for (let index = 0; index < 512; index++) {
+      compiledOperationModule(`bounded-${index}.ts`, 'export {}', '')
+    }
+    const recompiled = compiledOperationModule('evicted.ts', source, '')
+    expect(recompiled).not.toBe(original)
+    const exports = {}
+    recompiled(() => undefined, exports)
+    expect(exports).toEqual({ value: 42 })
+  })
+})
diff --git a/mobile/src/test-support/rpc-recording/compiled-operation-module.ts b/mobile/src/test-support/rpc-recording/compiled-operation-module.ts
new file mode 100644
index 00000000000..ca9f14a6ed9
--- /dev/null
+++ b/mobile/src/test-support/rpc-recording/compiled-operation-module.ts
@@ -0,0 +1,31 @@
+import { compileFunction } from 'node:vm'
+import ts from 'typescript'
+
+const compiled = new Map<string, ReturnType<typeof compileFunction>>()
+const MAX_COMPILED_MODULES = 512
+
+/** Only code is shared: each invocation receives a fresh require closure and exports object. */
+export function compiledOperationModule(file: string, source: string, exposure: string) {
+  const key = JSON.stringify([file, source, exposure])
+  const cached = compiled.get(key)
+  if (cached) {
+    return cached
+  }
+  const output = ts.transpileModule(source, {
+    compilerOptions: {
+      module: ts.ModuleKind.CommonJS,
+      target: ts.ScriptTarget.ES2022,
+      // Product JSX uses the automatic runtime without importing React.
+      jsx: ts.JsxEmit.ReactJSX
+    }
+  }).outputText
+  const evaluate = compileFunction(output + exposure, ['require', 'exports'], { filename: file })
+  if (compiled.size >= MAX_COMPILED_MODULES) {
+    const oldest = compiled.keys().next().value
+    if (oldest !== undefined) {
+      compiled.delete(oldest)
+    }
+  }
+  compiled.set(key, evaluate)
+  return evaluate
+}
diff --git a/mobile/src/test-support/rpc-recording/native-mounting-substitutes.test.ts b/mobile/src/test-support/rpc-recording/native-mounting-substitutes.test.ts
index 01422c4dda4..4cc4afbb468 100644
--- a/mobile/src/test-support/rpc-recording/native-mounting-substitutes.test.ts
+++ b/mobile/src/test-support/rpc-recording/native-mounting-substitutes.test.ts
@@ -21,7 +21,6 @@ describe('nativeMountingSubstitutes', () => {
     const store = importDefault(substitute('@react-native-async-storage/async-storage')).default
     // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the member is a function by construction; the test asserts what calling it throws.
     const getItem = (store as { getItem: () => unknown }).getItem
-    expect(typeof getItem).toBe('function')
     expect(() => getItem()).toThrow(
       'Native store reached during recording: @react-native-async-storage/async-storage.getItem'
     )
diff --git a/mobile/src/test-support/rpc-recording/operation-module-loader.test.ts b/mobile/src/test-support/rpc-recording/operation-module-loader.test.ts
index bf8d411cff7..d4aea1cf8bd 100644
--- a/mobile/src/test-support/rpc-recording/operation-module-loader.test.ts
+++ b/mobile/src/test-support/rpc-recording/operation-module-loader.test.ts
@@ -1,4 +1,4 @@
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs'
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { createElement } from 'react'
@@ -11,21 +11,84 @@ import { operationModuleLoader } from './operation-module-loader'
  * loader does rather than by what one screen happens to import today.
  */
 const roots: string[] = []
-function loaderOver(files: Record<string, string>): ReturnType<typeof operationModuleLoader> {
+function sourceTree(files: Record<string, string>): string {
   const root = mkdtempSync(join(tmpdir(), 'rpc-loader-'))
   roots.push(root)
   for (const [name, source] of Object.entries(files)) {
     mkdirSync(join(root, 'mobile/src'), { recursive: true })
     writeFileSync(join(root, 'mobile/src', name), source)
   }
-  return operationModuleLoader(root)
+  return root
+}
+function loaderOver(files: Record<string, string>): ReturnType<typeof operationModuleLoader> {
+  return operationModuleLoader(sourceTree(files))
 }
 
 afterAll(() => {
+  for (const root of roots) {
+    rmSync(root, { recursive: true, force: true })
+  }
   roots.length = 0
 })
 
 describe('the mounted module loader', () => {
+  it('reuses code without sharing exports, module state, mounting dependencies or effects', () => {
+    const root = sourceTree({
+      'state.ts': `
+        import { mounted, initial } from 'scenario-device'
+        mounted()
+        let count = initial
+        export const next = () => ++count
+      `,
+      'operation.ts': `export { next } from './state'`
+    })
+    let mounts = 0
+    function scenario(initial: number) {
+      return operationModuleLoader(
+        root,
+        undefined,
+        [],
+        new Map([['scenario-device', { initial, mounted: () => mounts++ }]])
+      )
+    }
+    const firstLoader = scenario(0)
+    const first = firstLoader.load<{ next: () => number }>('mobile/src/operation.ts')
+    expect(first.next()).toBe(1)
+    expect(first.next()).toBe(2)
+    expect(firstLoader.load('mobile/src/operation.ts')).toBe(first)
+    const second = scenario(10).load<{ next: () => number }>('mobile/src/operation.ts')
+    expect(second).not.toBe(first)
+    expect(second.next()).toBe(11)
+    expect(first.next()).toBe(3)
+    expect(mounts).toBe(2)
+  })
+
+  it('keeps mutations, exposure code and later source edits distinct on a warm cache', () => {
+    const source = 'const value: number = 1; export const read = () => value'
+    const root = sourceTree({ 'value.ts': source })
+    const path = 'mobile/src/value.ts'
+    const baseline = operationModuleLoader(root).load<{ read: () => number }>(path)
+    const mutation = { name: 'value', file: 'value.ts', before: '= 1', after: '= 2' }
+    for (let index = 0; index < 2; index++) {
+      const mutated = operationModuleLoader(root, mutation, [
+        ['value.ts', '\nexports.exposed = () => value + 10']
+      ])
+      const result = mutated.load<{ read: () => number; exposed: () => number }>(path)
+      expect(result.read()).toBe(2)
+      expect(result.exposed()).toBe(12)
+      expect(mutated.mutationsApplied()).toBe(1)
+    }
+    expect(baseline.read()).toBe(1)
+    const fresh = operationModuleLoader(root).load<{ read: () => number; exposed?: unknown }>(path)
+    expect(fresh.read()).toBe(1)
+    expect(fresh.exposed).toBeUndefined()
+    writeFileSync(join(root, path), source.replace('= 1', '= 3'))
+    expect(operationModuleLoader(root).load<{ read: () => number }>(path).read()).toBe(3)
+    expect(() => operationModuleLoader(root, mutation).load(path)).toThrow(
+      'Mutant anchor matched 0 sites'
+    )
+  })
+
   /**
    * Product sources compile with the automatic runtime and never import React, so a classic
    * `React.createElement` emit throws `React is not defined` on the first render of every screen.
@@ -66,7 +129,6 @@ describe('the mounted module loader', () => {
       `
     })
     const { read } = modules.load<{ read: () => unknown }>('mobile/src/uses-default.ts')
-    expect(typeof read).toBe('function')
     expect(() => read()).toThrow(
       'Unspecified native mounting dependency: react-native-not-substituted.default'
     )
@@ -97,7 +159,6 @@ describe('the mounted module loader', () => {
       `
     })
     const { read } = modules.load<{ read: () => unknown }>('mobile/src/uses-namespace.ts')
-    expect(typeof read).toBe('function')
     expect(() => read()).toThrow(
       'Unspecified native mounting dependency: expo-not-substituted.selectionAsync'
     )
diff --git a/mobile/src/test-support/rpc-recording/operation-module-loader.ts b/mobile/src/test-support/rpc-recording/operation-module-loader.ts
index 2f337c94964..b2f75a4cb4f 100644
--- a/mobile/src/test-support/rpc-recording/operation-module-loader.ts
+++ b/mobile/src/test-support/rpc-recording/operation-module-loader.ts
@@ -1,10 +1,10 @@
-import { compileFunction } from 'node:vm'
 import { existsSync, readFileSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
 import ts from 'typescript'
 import { nativeMountingSubstitutes } from './native-mounting-substitutes'
 import { observeSalvagedReads } from './salvage-observation'
 import * as deliveryAmbiguity from '../../transport/rpc-delivery-ambiguity'
+import { compiledOperationModule } from './compiled-operation-module'
 
 export type OperationModule = Record<string, (...args: any[]) => unknown>
 /** One anchored in-memory source edit, resolved by the caller so the loader needs no mutant table. */
@@ -139,17 +139,8 @@ export function operationModuleLoader(
     }
     const exports: OperationModule = {}
     cache.set(file, exports)
-    const output = ts.transpileModule(source, {
-      compilerOptions: {
-        module: ts.ModuleKind.CommonJS,
-        target: ts.ScriptTarget.ES2022,
-        // Product sources use the automatic runtime and never import React, so a classic
-        // `React.createElement` emit throws `React is not defined` on the first screen render.
-        jsx: ts.JsxEmit.ReactJSX
-      }
-    }).outputText
     const exposure = exposures.find(([suffix]) => file.endsWith(suffix))?.[1] ?? ''
-    const evaluate = compileFunction(output + exposure, ['require', 'exports'], { filename: file })
+    const evaluate = compiledOperationModule(file, source, exposure)
     evaluate((name: string) => imported(file, name), exports)
     observeSalvagedReads(file, exports)
     return exports
diff --git a/mobile/src/test-support/rpc-recording/rpc-recording-through-bridge.test.ts b/mobile/src/test-support/rpc-recording/rpc-recording-through-bridge.test.ts
index df1e6e5e3a4..502925a900b 100644
--- a/mobile/src/test-support/rpc-recording/rpc-recording-through-bridge.test.ts
+++ b/mobile/src/test-support/rpc-recording/rpc-recording-through-bridge.test.ts
@@ -74,12 +74,12 @@ import { vitestRecordingScheduler } from './vitest-recording-scheduler'
  * `BRIDGED_PARITY_MEMBERS` pins which goldens are in it — a count alone cannot see one golden
  * leaving a class as another arrives.
  *
- * 396 of the 786 replay byte for byte. The other 390 fall in five classes, 340 / 3 / 6 / 33 / 8,
+ * 397 of the 790 replay byte for byte. The other 393 fall in five classes, 343 / 3 / 6 / 33 / 8,
  * and none of them is a reason to re-record anything. `c1-page-closure.ts` then pins, golden by
- * golden, the 103 recorded at a call site the C1 page owns, because a count over 786 cannot tell a
+ * golden, the 103 recorded at a call site the C1 page owns, because a count over 790 cannot tell a
  * domain's regression from another domain's improvement.
  *
- * 1. **result-absent-settlement, 340** and **2. result-absent-observation, 3.**
+ * 1. **result-absent-settlement, 343** and **2. result-absent-observation, 3.**
  *    `{ ok: true }` with no `result` key is refused by the page's reader and by `isRpcResponse`
  *    alike, so this one is not a bridge defect: the recorder injects that partition at the scripted
  *    sender port, below the frame validation both sides do, which is what the README means by not
diff --git a/mobile/src/test-support/rpc-recording/run-recording.ts b/mobile/src/test-support/rpc-recording/run-recording.ts
index 4b451212b97..fc90afaad02 100644
--- a/mobile/src/test-support/rpc-recording/run-recording.ts
+++ b/mobile/src/test-support/rpc-recording/run-recording.ts
@@ -53,8 +53,8 @@ export async function runRecording(
     // byte-identical.
     await scheduler.flush()
     // A stream the product forgot to close is only visible on the wire when its method has an
-    // unsubscribe builder; `agentSession.subscribe` has none, so closing it writes nothing and the
-    // leak stays a live registry record until some later cutover replays it. Observed here, after
+    // unsubscribe builder; closing a builder-less one writes nothing and the leak stays a live
+    // registry record until some later cutover replays it. Observed here, after
     // the product's own cleanup and before the transport tears the registries down, so a
     // builder-less subscription is pinned without a scenario that cuts over to expose it.
     const registered = transport.registeredStreams()
diff --git a/mobile/src/test-support/rpc-recording/subscription-recording.test.ts b/mobile/src/test-support/rpc-recording/subscription-recording.test.ts
index 39924296947..b01647fcf51 100644
--- a/mobile/src/test-support/rpc-recording/subscription-recording.test.ts
+++ b/mobile/src/test-support/rpc-recording/subscription-recording.test.ts
@@ -68,16 +68,16 @@ describe('subscription recordings', () => {
       expect(() => transport.frame(`${CLIENT_EVENTS}#2`, null, changed)).toThrow(
         'Missing subscription payload'
       )
-      // The host's own end of stream, in the two responses it really sends: the `end` event as a
-      // streaming frame, then the unary reply the dispatcher sends once the handler returns. The
-      // second is what closes the stream here, and the registry reports it to the listener as an
-      // error — so the disposer below has no subscription left and publishes no unsubscribe.
+      // The host's streamed `end` closes the stream, so a later reply for the id reaches nothing
+      // and the disposer below has no subscription left to unsubscribe.
       transport.frame(`${CLIENT_EVENTS}#1`, null, {
         ok: true,
         streaming: true,
         result: { type: 'end' }
       })
-      transport.frame(`${CLIENT_EVENTS}#1`, null, { ok: true })
+      expect(() => transport.frame(`${CLIENT_EVENTS}#1`, null, { ok: true })).toThrow(
+        'No open stream for frame'
+      )
       expect(() =>
         transport.frame(`${CLIENT_EVENTS}#1`, null, {
           ok: false,
@@ -86,12 +86,7 @@ describe('subscription recordings', () => {
       ).toThrow('No open stream for frame')
       dispose()
       expect(transport.payloads.map((payload) => payload.name)).toEqual([`${CLIENT_EVENTS}#1`])
-      expect(events).toEqual([
-        readyFrame('sub-1').result,
-        changed.result,
-        { type: 'end' },
-        { type: 'error', message: 'Streaming request ended before it was ready.', error: undefined }
-      ])
+      expect(events).toEqual([readyFrame('sub-1').result, changed.result, { type: 'end' }])
     } finally {
       transport.dispose()
       await clock.flush()
diff --git a/mobile/src/test-support/webview-document-census.ts b/mobile/src/test-support/webview-document-census.ts
index eb050fce3e1..73b9ff71e89 100644
--- a/mobile/src/test-support/webview-document-census.ts
+++ b/mobile/src/test-support/webview-document-census.ts
@@ -17,7 +17,7 @@ import { parseSync } from 'oxc-parser'
  */
 
 /** Statement kinds that only declare. Anything else at a module's top level is work. */
-export const DECLARATION_KINDS = new Set([
+const DECLARATION_KINDS = new Set([
   'ImportDeclaration',
   'ExportNamedDeclaration',
   'ExportDefaultDeclaration',
@@ -83,7 +83,7 @@ function initialiserRuns(node: unknown): boolean {
 }
 
 /** Whether anything at a module's top level reaches an element, at any depth. */
-export function readsTheDocument(node: unknown): boolean {
+function readsTheDocument(node: unknown): boolean {
   if (Array.isArray(node)) {
     return node.some(readsTheDocument)
   }
@@ -93,7 +93,7 @@ export function readsTheDocument(node: unknown): boolean {
   return fieldsOf(node).some(([key, value]) => key !== 'type' && readsTheDocument(value))
 }
 
-export function parseModule(name: string, source: string) {
+function parseModule(name: string, source: string) {
   const { program, errors } = parseSync(`${name}.ts`, source, { lang: 'ts' })
   if (errors.length > 0) {
     throw new Error(`[webview-document-census] ${name}.ts did not parse: ${errors[0]?.message}`)
diff --git a/mobile/src/transport/client-context.test.ts b/mobile/src/transport/client-context.test.ts
index 0d65be5a63f..99a8e31fa4f 100644
--- a/mobile/src/transport/client-context.test.ts
+++ b/mobile/src/transport/client-context.test.ts
@@ -40,12 +40,17 @@ vi.mock('./host-store', () => ({
 vi.mock('./connection-revival-triggers', () => ({
   subscribeConnectionRevivalTriggers: () => () => {}
 }))
+vi.mock('./connection-log-background-flush', () => ({
+  subscribeConnectionLogBackgroundFlush: () => () => {}
+}))
 
 import {
   RpcClientProvider,
   useDisconnectHostClient,
   useForceReconnect,
-  useHostClient
+  useHostClient,
+  usePrimeHosts,
+  useRefreshHostClient
 } from './client-context'
 import { useAllHostClients } from './use-all-host-clients'
 import { useRelayRecoveryStatus } from './client-context-connection-metrics'
@@ -415,6 +420,49 @@ describe('useHostClient', () => {
     }
   })
 
+  it('refreshes a Relay-active owned client onto the saved row after an endpoint edit', async () => {
+    const relayClient = makeFakeClient('connected', 'relay')
+    const replacement = makeFakeClient('connecting', 'tailscale')
+    connectMock.mockReturnValueOnce(relayClient).mockReturnValueOnce(replacement)
+    loadHostsMock.mockResolvedValue([HOST])
+    const edited = { ...HOST, endpoint: 'ws://100.101.102.103:6768' }
+
+    const states: ConnectionState[] = []
+    let refreshHostClient: ((hostId: string) => void) | null = null
+    let primeHosts: ((hosts: (typeof HOST)[]) => void) | null = null
+    let renderer: ReactTestRenderer | null = null
+    function Probe(): null {
+      refreshHostClient = useRefreshHostClient()
+      primeHosts = usePrimeHosts()
+      states.push(useHostClient(HOST.id).state)
+      return null
+    }
+
+    try {
+      await act(async () => {
+        renderer = create(createElement(RpcClientProvider, null, createElement(Probe)))
+        await Promise.resolve()
+      })
+      // A failed post-save re-prime leaves the pre-edit profile cached.
+      act(() => primeHosts?.([HOST]))
+      loadHostsMock.mockResolvedValue([edited])
+      states.length = 0
+
+      await act(async () => {
+        refreshHostClient?.(HOST.id)
+        await Promise.resolve()
+      })
+
+      expect(relayClient.closeMock).toHaveBeenCalled()
+      expect(relayClient.notifyForeground).not.toHaveBeenCalled()
+      expect(connectMock.mock.calls[1]?.[0]).toEqual(edited)
+      // The owner reads amber through the rebuild, never a grey flash.
+      expect(states).not.toContain('disconnected')
+    } finally {
+      act(() => renderer?.unmount())
+    }
+  })
+
   it('rebuilds a pairing-rejected Relay client so re-pairing credentials are re-read', async () => {
     const rejectedRelayClient = makeFakeClient('disconnected', 'relay')
     const replacement = makeFakeClient('connecting', 'tailscale')
diff --git a/mobile/src/transport/client-context.tsx b/mobile/src/transport/client-context.tsx
index 76d26c1bab5..0348c22105d 100644
--- a/mobile/src/transport/client-context.tsx
+++ b/mobile/src/transport/client-context.tsx
@@ -12,6 +12,7 @@ import {
 import type { RpcClient } from './rpc-client'
 import type { StableLogicalRpcClient } from './stable-logical-rpc-client'
 import { subscribeConnectionRevivalTriggers } from './connection-revival-triggers'
+import { subscribeConnectionLogBackgroundFlush } from './connection-log-background-flush'
 import { HostClientOpenRegistry } from './host-client-open-registry'
 import {
   HostClientAcquisitionRegistry,
@@ -20,7 +21,7 @@ import {
 import { HostOpenRetryScheduler } from './host-open-retry-scheduler'
 import { openHostClientEntry, type HostClientStoreEntry } from './host-entry-opener'
 import { shouldPreserveActiveRelay } from './relay-reconnect-preservation'
-import { recordConnectionRevival } from './persisted-connection-log-store'
+import { connectionLogStore, recordConnectionRevival } from './persisted-connection-log-store'
 import {
   createHostClientSelectors,
   listHostClients,
@@ -329,6 +330,14 @@ export function RpcClientProvider({ children }: { children: ReactNode }) {
     })
   }, [])
 
+  // Why: a connection-log write that failed is only retried by the next append, so
+  // flush before the OS can kill a backgrounded app (see connection-log-background-flush).
+  useEffect(() => {
+    return subscribeConnectionLogBackgroundFlush(() => {
+      void connectionLogStore.flush()
+    })
+  }, [])
+
   const value = useMemo<RpcClientContextValue>(
     () => ({
       acquire,
diff --git a/mobile/src/transport/client-context.web.test.tsx b/mobile/src/transport/client-context.web.test.tsx
index c322d07ab7e..1efc5771dd9 100644
--- a/mobile/src/transport/client-context.web.test.tsx
+++ b/mobile/src/transport/client-context.web.test.tsx
@@ -2,10 +2,7 @@ import type { ReactElement } from 'react'
 import { act, create } from 'react-test-renderer'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { BRIDGE_PROTOCOL_VERSION } from '../mobile-web-shell/bridge/bridge-envelope'
-import {
-  BRIDGE_PAGE_CLIENT_ID,
-  BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT
-} from '../mobile-web-shell/bridge/bridge-page-client-identity'
+import { BRIDGE_PAGE_CLIENT_ID } from '../mobile-web-shell/bridge/bridge-page-client-identity'
 import { createShellPageClient } from '../mobile-web-shell/bridge/page-bootstrap'
 import type { BridgeRpcClient } from '../mobile-web-shell/bridge/bridge-rpc-client'
 import type { RpcClientContextValue } from './rpc-client-context-contract'
@@ -35,8 +32,7 @@ const INIT = {
     lastInboundAt: 1800,
     generation: 5
   },
-  grants: { rpc: { maxPendingRequests: 64, maxSubscriptions: 32 }, native: [] },
-  accepts: [BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT]
+  grants: { rpc: { maxPendingRequests: 64, maxSubscriptions: 32 }, native: [] }
 }
 
 /** What the page mounted, and what it holds — the two things the provider decides. */
@@ -172,25 +168,6 @@ describe('the page provider', () => {
     expect(first).toBe(BRIDGE_PAGE_CLIENT_ID)
   })
 
-  it('claims nothing at all when the shell never said it performs the swap', () => {
-    const channel = installChannel()
-    const client = createShellPageClient()
-    if (client === null) {
-      throw new Error('no channel installed')
-    }
-    // An `init` that landed, naming no swap — not a client with no session at all, which would
-    // answer null for a reason that has nothing to do with the capability.
-    channel.deliver({ ...INIT, accepts: [] })
-    act(() => {
-      create(render(client))
-    })
-    expect(readContext().getState('host-a')).toBe('connected')
-
-    // An older shell forwards what the page sent, so a placeholder would reach the host and be
-    // refused as a spoof. Nothing claimed is the honest answer, and it is what shipped before.
-    expect(readContext().getClientId('host-a')).toBe(null)
-  })
-
   it('carries a state change from the shell to the screens watching it', () => {
     const channel = installChannel()
     const client = createReadyClient(channel.deliver)
diff --git a/mobile/src/transport/client-context.web.tsx b/mobile/src/transport/client-context.web.tsx
index 463aff873b2..a1606ba9853 100644
--- a/mobile/src/transport/client-context.web.tsx
+++ b/mobile/src/transport/client-context.web.tsx
@@ -3,10 +3,7 @@
 // side of the bridge already did, and this provider only carries what it holds across the boundary.
 import { createContext, useContext, useMemo, useRef, type ReactNode } from 'react'
 import type { BridgeRpcClient } from '../mobile-web-shell/bridge/bridge-rpc-client'
-import {
-  BRIDGE_PAGE_CLIENT_ID,
-  BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT
-} from '../mobile-web-shell/bridge/bridge-page-client-identity'
+import { BRIDGE_PAGE_CLIENT_ID } from '../mobile-web-shell/bridge/bridge-page-client-identity'
 import type { ConnectionState, HostProfile } from './types'
 import type { RpcClientContextValue } from './rpc-client-context-contract'
 
@@ -61,17 +58,8 @@ export function RpcClientProvider({
       getState: () => client.getState(),
       // Nothing mounts before `init`, so the page's state is never the unknown this answers null for.
       getKnownState: () => client.getState(),
-      /**
-       * A placeholder the shell swaps for this device's real identity, never the credential itself.
-       *
-       * Only when the shell said it performs the swap; a shell that did not leaves this null, which
-       * is no terminal and no live input, because the session route refuses to subscribe or send
-       * without one — but a placeholder the host read itself would be refused as a spoof.
-       */
-      getClientId: () =>
-        client.getShellSession()?.accepts.includes(BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT) === true
-          ? BRIDGE_PAGE_CLIENT_ID
-          : null,
+      /** A placeholder the shell swaps for this device's real identity, never the credential. */
+      getClientId: () => BRIDGE_PAGE_CLIENT_ID,
       getReconnectAttempt: () => client.getReconnectAttempt(),
       getLastConnectedAt: () => client.getLastConnectedAt(),
       // The page reaches its host through the shell bridge, which rides whatever path the RN
diff --git a/mobile/src/transport/connection-log-background-flush.test.ts b/mobile/src/transport/connection-log-background-flush.test.ts
new file mode 100644
index 00000000000..e5563a9fccd
--- /dev/null
+++ b/mobile/src/transport/connection-log-background-flush.test.ts
@@ -0,0 +1,45 @@
+import { beforeEach, describe, expect, it, type Mock, vi } from 'vitest'
+import { subscribeConnectionLogBackgroundFlush } from './connection-log-background-flush'
+
+type AppStateListener = (next: string) => void
+
+let appStateListener: AppStateListener | null = null
+const appStateRemove = vi.fn()
+
+vi.mock('react-native', () => ({
+  AppState: {
+    addEventListener: (_event: string, listener: AppStateListener) => {
+      appStateListener = listener
+      return { remove: appStateRemove }
+    }
+  }
+}))
+
+describe('subscribeConnectionLogBackgroundFlush', () => {
+  let flush: Mock<() => void>
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    appStateListener = null
+    flush = vi.fn<() => void>()
+  })
+
+  it('flushes when the app goes to the background', () => {
+    subscribeConnectionLogBackgroundFlush(flush)
+    appStateListener?.('background')
+    expect(flush).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not flush on foreground or transient inactive states', () => {
+    subscribeConnectionLogBackgroundFlush(flush)
+    appStateListener?.('active')
+    appStateListener?.('inactive')
+    expect(flush).not.toHaveBeenCalled()
+  })
+
+  it('removes the listener on unsubscribe', () => {
+    const unsubscribe = subscribeConnectionLogBackgroundFlush(flush)
+    unsubscribe()
+    expect(appStateRemove).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/mobile/src/transport/connection-log-background-flush.ts b/mobile/src/transport/connection-log-background-flush.ts
new file mode 100644
index 00000000000..860b7e43ca6
--- /dev/null
+++ b/mobile/src/transport/connection-log-background-flush.ts
@@ -0,0 +1,14 @@
+import { AppState } from 'react-native'
+
+// Why: connection-log persistence is best-effort — a failed write is only retried
+// by the next append, so when a disconnect is the last thing that happens the
+// entries explaining it never reach storage. Background is the last point the OS
+// still runs JS before it can kill the process, so flush the newest snapshot there.
+export function subscribeConnectionLogBackgroundFlush(flush: () => void): () => void {
+  const subscription = AppState.addEventListener('change', (next) => {
+    if (next === 'background') {
+      flush()
+    }
+  })
+  return () => subscription.remove()
+}
diff --git a/mobile/src/transport/connection-log-buffer.ts b/mobile/src/transport/connection-log-buffer.ts
index 5af67051cf8..149e8dc4ee8 100644
--- a/mobile/src/transport/connection-log-buffer.ts
+++ b/mobile/src/transport/connection-log-buffer.ts
@@ -9,9 +9,13 @@ import { redactConnectionLogEntry } from '../diagnostics/connection-log-redactio
 // swaps (forceReconnect) and provider remounts (hot reload); bounded so an
 // all-night reconnect loop can't grow memory unbounded.
 const MAX_ENTRIES_PER_HOST = 200
+// Why: a store that just rejected almost always rejects again on the same tick, so
+// the one retry a snapshot gets waits instead of firing back-to-back.
+const PERSISTENCE_RETRY_DELAY_MS = 200
 
 export type ConnectionLogStore = {
   append: (hostId: string, entry: ConnectionLogEntry) => void
+  flush: () => Promise<void>
   get: (hostId: string) => readonly ConnectionLogEntry[]
   hydrate: (hostId: string) => Promise<void>
   subscribe: (hostId: string, listener: () => void) => () => void
@@ -31,10 +35,11 @@ export function createConnectionLogStore(
   const hydratedHosts = new Set<string>()
   const hydrationFailedHosts = new Set<string>()
   const hydrationByHost = new Map<string, Promise<void>>()
-  const saveByHost = new Map<string, Promise<void>>()
+  const activeSaveByHost = new Map<string, Promise<void>>()
+  const dirtyHosts = new Set<string>()
   const persistenceRevisionByHost = new Map<
     string,
-    { snapshot: readonly ConnectionLogEntry[]; saved: boolean }
+    { snapshot: readonly ConnectionLogEntry[]; retried: boolean; saved: boolean }
   >()
   // Why: useSyncExternalStore compares snapshots by reference — getSnapshot
   // must return the SAME array until the data actually changes, or React
@@ -59,36 +64,74 @@ export function createConnectionLogStore(
     }
   }
 
+  // Why: one in-flight save per host, re-reading the revision after each write, so
+  // slow storage retains the in-flight snapshot and the newest pending one instead
+  // of one superseded MAX_ENTRIES_PER_HOST copy per queued append.
+  const runSaveLoop = async (hostId: string, storage: ConnectionLogPersistence): Promise<void> => {
+    try {
+      // Yield once so a synchronous append burst collapses into a single write.
+      await Promise.resolve()
+      while (dirtyHosts.delete(hostId)) {
+        const revision = persistenceRevisionByHost.get(hostId)
+        if (!revision || revision.saved) {
+          return
+        }
+        try {
+          await storage.save(hostId, revision.snapshot)
+          revision.saved = true
+        } catch {
+          // At most one delayed retry per snapshot, and none at all once a newer
+          // snapshot is queued — that snapshot already carries these entries, so
+          // re-attempting this one is pure write amplification.
+          if (!revision.retried && !dirtyHosts.has(hostId)) {
+            revision.retried = true
+            setTimeout(() => persist(hostId), PERSISTENCE_RETRY_DELAY_MS)
+          }
+        }
+      }
+    } finally {
+      activeSaveByHost.delete(hostId)
+    }
+  }
+
   const persist = (hostId: string): void => {
     if (!persistence || !hydratedHosts.has(hostId)) {
       return
     }
     let revision = persistenceRevisionByHost.get(hostId)
     if (!revision) {
-      revision = { snapshot: [...(entriesByHost.get(hostId) ?? [])], saved: false }
+      revision = {
+        snapshot: [...(entriesByHost.get(hostId) ?? [])],
+        retried: false,
+        saved: false
+      }
       persistenceRevisionByHost.set(hostId, revision)
     }
-    const currentRevision = revision
-    if (currentRevision.saved) {
+    if (revision.saved) {
       return
     }
-    const previous = saveByHost.get(hostId) ?? Promise.resolve()
-    const pending = previous
-      .catch(() => {})
-      .then(async () => {
-        // Duplicate requests retain retry opportunities until this revision is durable.
-        if (currentRevision.saved) {
-          return
-        }
-        try {
-          await persistence.save(hostId, currentRevision.snapshot)
-        } catch {
-          await persistence.save(hostId, currentRevision.snapshot)
-        }
-        currentRevision.saved = true
-      })
-      .catch(() => {})
-    saveByHost.set(hostId, pending)
+    dirtyHosts.add(hostId)
+    if (activeSaveByHost.has(hostId)) {
+      return
+    }
+    activeSaveByHost.set(hostId, runSaveLoop(hostId, persistence))
+  }
+
+  // Why: a failed write is otherwise only retried by the next append, so the final
+  // entries explaining a disconnect are lost when the log goes quiet and the OS
+  // kills the app. Two passes: drain whatever is running, then one retry.
+  const flushHost = async (hostId: string): Promise<void> => {
+    for (let pass = 0; pass < 2; pass++) {
+      persist(hostId)
+      const active = activeSaveByHost.get(hostId)
+      if (!active) {
+        return
+      }
+      await active
+      if (persistenceRevisionByHost.get(hostId)?.saved === true) {
+        return
+      }
+    }
   }
 
   const hydrateHost = async (hostId: string, retryAfterFailure: boolean): Promise<void> => {
@@ -148,6 +191,10 @@ export function createConnectionLogStore(
         .catch(() => {})
     },
 
+    flush: async () => {
+      await Promise.all([...entriesByHost.keys()].map((hostId) => flushHost(hostId)))
+    },
+
     get(hostId) {
       const cached = snapshotByHost.get(hostId)
       if (cached) {
diff --git a/mobile/src/transport/connection-log-persistence-backpressure.test.ts b/mobile/src/transport/connection-log-persistence-backpressure.test.ts
new file mode 100644
index 00000000000..0819fc87ee3
--- /dev/null
+++ b/mobile/src/transport/connection-log-persistence-backpressure.test.ts
@@ -0,0 +1,266 @@
+import { describe, expect, it, vi } from 'vitest'
+import { createConnectionLogStore } from './connection-log-buffer'
+import type { ConnectionLogEntry } from './types'
+
+const entry = (id: number): ConnectionLogEntry => ({
+  id: String(id),
+  ts: id,
+  level: 'info',
+  message: `event ${id}`
+})
+
+async function drainMicrotasks(): Promise<void> {
+  for (let i = 0; i < 12; i++) {
+    await Promise.resolve()
+  }
+}
+
+describe('connection log persistence backpressure', () => {
+  it('writes only the latest pending snapshot when storage falls behind', async () => {
+    const saved: string[][] = []
+    let release: () => void = () => {}
+    let delay = false
+    const store = createConnectionLogStore(200, {
+      load: async () => [],
+      save: async (_host, entries) => {
+        saved.push(entries.map((item) => item.id))
+        if (delay) {
+          delay = false
+          await new Promise<void>((resolve) => {
+            release = resolve
+          })
+        }
+      }
+    })
+    await store.hydrate('a')
+    await drainMicrotasks()
+    saved.length = 0
+    delay = true
+    store.append('a', entry(0))
+    await drainMicrotasks()
+    for (let i = 1; i <= 1000; i++) {
+      store.append('a', entry(i))
+      await drainMicrotasks()
+    }
+    expect(saved).toEqual([['0']])
+    release()
+    for (let i = 0; i < 1000; i++) {
+      await drainMicrotasks()
+    }
+    expect(saved).toHaveLength(2)
+    expect(saved[1]).toEqual(store.get('a').map((item) => item.id))
+  })
+
+  it('persists a different host while one host has a stalled save', async () => {
+    const saved: [string, string[]][] = []
+    let release: () => void = () => {}
+    let delay = false
+    const store = createConnectionLogStore(200, {
+      load: async () => [],
+      save: async (host, entries) => {
+        saved.push([host, entries.map((item) => item.id)])
+        if (delay && host === 'a') {
+          delay = false
+          await new Promise<void>((resolve) => {
+            release = resolve
+          })
+        }
+      }
+    })
+    await Promise.all(['a', 'b'].map((host) => store.hydrate(host)))
+    await drainMicrotasks()
+    saved.length = 0
+    delay = true
+    store.append('a', entry(1))
+    await drainMicrotasks()
+    store.append('a', entry(2))
+    store.append('b', entry(3))
+    await drainMicrotasks()
+    expect(saved).toEqual([
+      ['a', ['1']],
+      ['b', ['3']]
+    ])
+    release()
+    await drainMicrotasks()
+    expect(saved.at(-1)).toEqual(['a', ['1', '2']])
+  })
+
+  it('saves the latest snapshot after an older in-flight revision fails', async () => {
+    let rejectSave: (error: Error) => void = () => {}
+    let failing = false
+    let persisted: readonly ConnectionLogEntry[] = []
+    const saved: string[][] = []
+    const persistence = {
+      load: async () => persisted,
+      save: async (_host: string, entries: readonly ConnectionLogEntry[]) => {
+        saved.push(entries.map((item) => item.id))
+        if (failing && entries.length === 1) {
+          if (saved.length === 1) {
+            await new Promise<void>((_resolve, reject) => {
+              rejectSave = reject
+            })
+          }
+          throw new Error('storage unavailable')
+        }
+        persisted = entries
+      }
+    }
+    const store = createConnectionLogStore(2, persistence)
+    await store.hydrate('a')
+    await drainMicrotasks()
+    saved.length = 0
+    failing = true
+    store.append('a', entry(1))
+    await drainMicrotasks()
+    store.append('a', entry(2))
+    await drainMicrotasks()
+    store.append('a', entry(3))
+    await drainMicrotasks()
+    rejectSave(new Error('storage unavailable'))
+    await drainMicrotasks()
+    expect(saved).toEqual([['1'], ['2', '3']])
+    const reloaded = createConnectionLogStore(2, persistence)
+    await reloaded.hydrate('a')
+    expect(reloaded.get('a')).toEqual(store.get('a'))
+  })
+
+  it.each([false, true])(
+    'includes an append during save settlement (deferred=%s)',
+    async (deferred) => {
+      let afterSave = () => {}
+      const saved: string[][] = []
+      const store = createConnectionLogStore(200, {
+        load: async () => [],
+        save: async (_host, entries) => {
+          saved.push(entries.map((item) => item.id))
+          afterSave()
+        }
+      })
+      await store.hydrate('a')
+      await drainMicrotasks()
+      saved.length = 0
+      afterSave = () => {
+        afterSave = () => {}
+        if (deferred) {
+          queueMicrotask(() => store.append('a', entry(2)))
+        } else {
+          store.append('a', entry(2))
+        }
+      }
+      store.append('a', entry(1))
+      await drainMicrotasks()
+      expect(saved).toEqual([['1'], ['1', '2']])
+    }
+  )
+
+  it('attempts the newest snapshot instead of replaying superseded ones', async () => {
+    let release: () => void = () => {}
+    let hold = false
+    let failing = false
+    const attempted: string[][] = []
+    const store = createConnectionLogStore(2, {
+      load: async () => [],
+      save: async (_host, entries) => {
+        attempted.push(entries.map((item) => item.id))
+        if (hold) {
+          hold = false
+          await new Promise<void>((resolve) => {
+            release = resolve
+          })
+        }
+        if (failing) {
+          throw new Error('storage temporarily unavailable')
+        }
+      }
+    })
+    await store.hydrate('a')
+    await drainMicrotasks()
+    attempted.length = 0
+    hold = true
+    failing = true
+    for (let i = 1; i <= 3; i++) {
+      store.append('a', entry(i))
+      await drainMicrotasks()
+    }
+    expect(attempted).toEqual([['1']])
+    release()
+    await drainMicrotasks()
+    // The superseded ['1'] snapshot is never replayed; only the newest one is attempted.
+    expect(attempted).toEqual([['1'], ['2', '3']])
+  })
+
+  it('bounds writes when a long stall unblocks against failing storage', async () => {
+    vi.useFakeTimers()
+    try {
+      let release: () => void = () => {}
+      let hold = false
+      let failing = false
+      let writes = 0
+      const store = createConnectionLogStore(200, {
+        load: async () => [],
+        save: async () => {
+          writes += 1
+          if (hold) {
+            hold = false
+            await new Promise<void>((resolve) => {
+              release = resolve
+            })
+          }
+          if (failing) {
+            throw new Error('storage unavailable')
+          }
+        }
+      })
+      await store.hydrate('a')
+      await drainMicrotasks()
+      writes = 0
+      hold = true
+      failing = true
+      for (let i = 0; i < 500; i++) {
+        store.append('a', entry(i))
+        await drainMicrotasks()
+      }
+      expect(writes).toBe(1)
+      release()
+      for (let i = 0; i < 20; i++) {
+        await drainMicrotasks()
+      }
+      // 500 stalled appends cost the held write plus one attempt at the newest snapshot.
+      expect(writes).toBe(2)
+      await vi.advanceTimersByTimeAsync(5_000)
+      // Draining the backoff adds that snapshot's single retry and nothing more.
+      expect(writes).toBe(3)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('flush persists the newest snapshot after a failed save and a quiet log', async () => {
+    let failing = true
+    let durableIds: string[] = []
+    let writes = 0
+    const store = createConnectionLogStore(200, {
+      load: async () => [],
+      save: async (_host, entries) => {
+        writes += 1
+        if (failing) {
+          throw new Error('storage unavailable')
+        }
+        durableIds = entries.map((item) => item.id)
+      }
+    })
+    await store.hydrate('a')
+    await drainMicrotasks()
+    store.append('a', entry(1))
+    store.append('a', entry(2))
+    await drainMicrotasks()
+    expect(durableIds).toEqual([])
+    failing = false
+    writes = 0
+    await store.flush()
+    expect(durableIds).toEqual(['1', '2'])
+    expect(writes).toBe(1)
+    await store.flush()
+    expect(writes).toBe(1)
+  })
+})
diff --git a/mobile/src/transport/connection-log-persistence-revisions.test.ts b/mobile/src/transport/connection-log-persistence-revisions.test.ts
index e85567d9eaf..abe40775911 100644
--- a/mobile/src/transport/connection-log-persistence-revisions.test.ts
+++ b/mobile/src/transport/connection-log-persistence-revisions.test.ts
@@ -50,7 +50,7 @@ describe('connection log persistence revisions', () => {
     )
   })
 
-  it('preserves distinct queued revisions while a save is delayed', async () => {
+  it('replaces obsolete queued revisions while a save is delayed', async () => {
     const saved: string[][] = []
     let release!: () => void
     let delay = false
@@ -79,27 +79,29 @@ describe('connection log persistence revisions', () => {
     expect(saved).toEqual([['1']])
     release()
     await drain()
-    expect(saved).toEqual([['1'], ['1', '2'], ['2', '3']])
+    expect(saved).toEqual([['1'], ['2', '3']])
   })
 
-  it('retains retries and later attempts when both initial save attempts fail', async () => {
+  it('attempts a failed snapshot once and carries the entries into the next write', async () => {
     const save = vi.fn<ConnectionLogPersistence['save']>(async () => {})
     const store = createConnectionLogStore(200, { load: async () => [], save })
     await store.hydrate('a')
     await drain()
     save.mockClear()
-    save.mockRejectedValueOnce(new Error('first')).mockRejectedValueOnce(new Error('retry'))
+    save.mockRejectedValueOnce(new Error('first'))
     store.append('a', entry(1))
     store.append('a', entry(2))
     store.append('a', entry(3))
     await drain()
-    expect(save).toHaveBeenCalledTimes(3)
-    expect(save.mock.calls[2]?.[1]).toBe(save.mock.calls[0]?.[1])
-    for (const [, snapshot] of save.mock.calls) {
-      expect(snapshot).toEqual([entry(1), entry(2), entry(3)])
-    }
+    expect(save).toHaveBeenCalledTimes(1)
+    expect(save.mock.calls[0]?.[1]).toEqual([entry(1), entry(2), entry(3)])
+    store.append('a', entry(4))
+    await drain()
+    expect(save).toHaveBeenCalledTimes(2)
+    expect(save).toHaveBeenLastCalledWith('a', store.get('a'))
   })
-  it('keeps every queued retry opportunity during a sustained failure', async () => {
+
+  it('writes once per snapshot during a sustained failure', async () => {
     const save = vi.fn<ConnectionLogPersistence['save']>(async () => {})
     const store = createConnectionLogStore(200, { load: async () => [], save })
     await store.hydrate('a')
@@ -109,7 +111,7 @@ describe('connection log persistence revisions', () => {
       store.append('a', entry(i))
     }
     await drain()
-    expect(save).toHaveBeenCalledTimes(6)
+    expect(save).toHaveBeenCalledTimes(1)
     save.mockClear().mockResolvedValue(undefined)
     store.append('a', entry(3))
     await drain()
diff --git a/mobile/src/transport/force-reconnect-page-seam.test.tsx b/mobile/src/transport/force-reconnect-page-seam.test.tsx
index 8aa8aee556e..38d07b0d44b 100644
--- a/mobile/src/transport/force-reconnect-page-seam.test.tsx
+++ b/mobile/src/transport/force-reconnect-page-seam.test.tsx
@@ -27,8 +27,7 @@ const INIT = {
     lastInboundAt: 1800,
     generation: 5
   },
-  grants: { rpc: { maxPendingRequests: 64, maxSubscriptions: 32 }, native: [] },
-  accepts: []
+  grants: { rpc: { maxPendingRequests: 64, maxSubscriptions: 32 }, native: [] }
 }
 
 afterEach(() => {
diff --git a/mobile/src/transport/host-catalog-credential-join.ts b/mobile/src/transport/host-catalog-credential-join.ts
index e914742ff4e..229889b37b7 100644
--- a/mobile/src/transport/host-catalog-credential-join.ts
+++ b/mobile/src/transport/host-catalog-credential-join.ts
@@ -1,10 +1,10 @@
-import type { MobileRelayHostOverlay } from './mobile-relay-host-overlay'
+import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
 import type { HostListSnapshot } from './host-list-load-sharing'
 import type { HostCatalogEntry, StoredHostProfile } from './types'
 
 export async function joinHostCatalogCredentials(args: {
   storedHosts: readonly StoredHostProfile[]
-  overlays: ReadonlyMap<string, MobileRelayHostOverlay>
+  relays: ReadonlyMap<string, MobileRelayEndpoint>
   tokenCache: Map<string, string>
   readToken: (hostId: string) => Promise<string | null>
   getRevision: () => number
@@ -31,17 +31,8 @@ export async function joinHostCatalogCredentials(args: {
         args.tokenCache.set(stored.id, token)
       }
     }
-    const overlay = args.overlays.get(stored.id)
-    const base = {
-      ...stored,
-      ...(overlay
-        ? {
-            endpoints: overlay.endpoints,
-            relayHostId: overlay.relayHostId,
-            relay: overlay.relay
-          }
-        : {})
-    }
+    const relay = args.relays.get(stored.id)
+    const base = { ...stored, ...(relay ? { relay } : {}) }
     const profile = token ? { ...base, deviceToken: token } : null
     catalog.push({ ...base, credentialStatus, profile })
     if (profile) {
diff --git a/mobile/src/transport/host-list-mutation-queue.ts b/mobile/src/transport/host-list-mutation-queue.ts
index 5ed1a06f5ec..c695f362f3d 100644
--- a/mobile/src/transport/host-list-mutation-queue.ts
+++ b/mobile/src/transport/host-list-mutation-queue.ts
@@ -10,9 +10,12 @@ export function hostListMutationsSettled(): Promise<void> {
   return hostListMutation
 }
 
-export function enqueueHostListMutation(operation: () => Promise<void>): Promise<void> {
+export function enqueueHostListMutation<T>(operation: () => Promise<T>): Promise<T> {
   const mutation = hostListMutation.then(operation)
-  hostListMutation = mutation.catch(() => {})
+  hostListMutation = mutation.then(
+    () => {},
+    () => {}
+  )
   return mutation
 }
 
diff --git a/mobile/src/transport/host-logical-client.ts b/mobile/src/transport/host-logical-client.ts
index 7682fc9591b..19d5e8d5ebc 100644
--- a/mobile/src/transport/host-logical-client.ts
+++ b/mobile/src/transport/host-logical-client.ts
@@ -10,7 +10,7 @@ export function openHostLogicalClient(host: HostProfile, onLog: ConnectionLogSin
   // direct socket remains a replaceable first physical generation.
   const logical = createStableLogicalRpcClient(
     connect(host.endpoint, host.deviceToken, host.publicKeyB64, { onLog }),
-    directPathForEndpoint(host, host.endpoint)
+    directPathForEndpoint(host.endpoint)
   )
   if (Platform.OS === 'web') {
     return logical
diff --git a/mobile/src/transport/host-name-identity.test.ts b/mobile/src/transport/host-name-identity.test.ts
index 8c67d86bdec..07277f7b90d 100644
--- a/mobile/src/transport/host-name-identity.test.ts
+++ b/mobile/src/transport/host-name-identity.test.ts
@@ -35,7 +35,7 @@ vi.mock('./host-credential-cleanup', () => ({
 import {
   loadHosts,
   resetHostStoreForTests,
-  saveHost,
+  savePairedHost,
   updateHostDescriptor,
   updateHostNameAndEndpoint
 } from './host-store'
@@ -176,7 +176,7 @@ describe('host name identity', () => {
   describe('re-pair', () => {
     it('preserves the override and descriptor a pairing save knows nothing about', async () => {
       await updateHostDescriptor(TYPED_HOST.id, { machineName: 'm4airs-Air', platform: 'darwin' })
-      await saveHost({
+      await savePairedHost({
         id: TYPED_HOST.id,
         name: 'Windows-Low Spec',
         endpoint: 'ws://10.0.0.9:6768',
@@ -198,7 +198,7 @@ describe('host name identity', () => {
         machineName: 'm4airs-Air',
         platform: 'darwin'
       })
-      await saveHost({
+      await savePairedHost({
         id: GENERATED_HOST.id,
         name: 'Host 1',
         endpoint: GENERATED_HOST.endpoint,
@@ -211,11 +211,11 @@ describe('host name identity', () => {
 
     it('does not roll back identity changed since a connection took its profile snapshot', async () => {
       await updateHostDescriptor(TYPED_HOST.id, { machineName: 'Studio', platform: 'darwin' })
-      // A connection holds this for its lifetime and re-saves it on relay credential rotation.
+      // A connection holds this for its lifetime; a save built from it must not roll identity back.
       const snapshot = (await loadHosts()).find(({ id }) => id === TYPED_HOST.id)!
       await updateHostNameAndEndpoint(TYPED_HOST.id, { personalName: null })
       await updateHostDescriptor(TYPED_HOST.id, { machineName: 'Studio 2', platform: 'darwin' })
-      await saveHost({ ...snapshot, lastConnected: 99 })
+      await savePairedHost({ ...snapshot, lastConnected: 99 })
       const record = stored().find(({ id }) => id === TYPED_HOST.id)
       expect(record?.personalName).toBeUndefined()
       expect(record).toMatchObject({
diff --git a/mobile/src/transport/host-open-recovery.test.tsx b/mobile/src/transport/host-open-recovery.test.tsx
index 972a30dce1c..d4bf4fe669a 100644
--- a/mobile/src/transport/host-open-recovery.test.tsx
+++ b/mobile/src/transport/host-open-recovery.test.tsx
@@ -31,6 +31,9 @@ vi.mock('./connection-revival-triggers', () => ({
     }
   }
 }))
+vi.mock('./connection-log-background-flush', () => ({
+  subscribeConnectionLogBackgroundFlush: () => () => {}
+}))
 
 import {
   useDisconnectHostClient,
diff --git a/mobile/src/transport/host-status-capability-ignorability.test.ts b/mobile/src/transport/host-status-capability-ignorability.test.ts
index 03477a3a918..35762e8699c 100644
--- a/mobile/src/transport/host-status-capability-ignorability.test.ts
+++ b/mobile/src/transport/host-status-capability-ignorability.test.ts
@@ -11,8 +11,8 @@ import { supportsMobileQuickCommands } from '../terminal/quick-commands'
 import { useHostStatusGates, type HostStatusGates } from './host-status-gates'
 import {
   hostAnsweredStatusProbe,
-  readHostStatusGates,
-  readProbedHostCapabilities
+  readProbedHostCapabilities,
+  readProbedHostStatus
 } from './host-status-probe-operations'
 import type { HostStatusReply } from './host-status-reply-schema'
 import type { RpcClient } from './rpc-client'
@@ -107,7 +107,7 @@ async function readEverything(capabilities: readonly string[]): Promise<ClientVi
   const gates = await renderGates(client)
   return {
     gates,
-    gateStatus: readHostStatusGates(reply),
+    gateStatus: readProbedHostStatus(reply)?.status ?? null,
     probedCapabilities: readProbedHostCapabilities(reply),
     answeredProbe: hostAnsweredStatusProbe(reply),
     quickCommandsSupported: supportsMobileQuickCommands(gates.hostCapabilities),
diff --git a/mobile/src/transport/host-status-gates.test.ts b/mobile/src/transport/host-status-gates.test.ts
index 0711d3dfa0e..04de1f0e4fe 100644
--- a/mobile/src/transport/host-status-gates.test.ts
+++ b/mobile/src/transport/host-status-gates.test.ts
@@ -226,4 +226,152 @@ describe('useHostStatusGates', () => {
       renderer?.unmount()
     }
   })
+
+  it('re-reads a status that failed while the connection stayed up', async () => {
+    vi.useFakeTimers()
+    const sendRequest = vi
+      .fn()
+      .mockRejectedValueOnce(new Error('request timed out'))
+      .mockResolvedValueOnce({
+        ok: true,
+        result: {
+          capabilities: ['browser.screencast.v1'],
+          floatingWorkspaceEnabled: true,
+          machineName: 'studio'
+        }
+      })
+    const client = { sendRequest } as unknown as RpcClient
+    let gates: HostStatusGates | null = null
+    let renderer: ReactTestRenderer | null = null
+
+    function Probe(): null {
+      gates = useHostStatusGates({ hostId: 'host-1', client, connState: 'connected' })
+      return null
+    }
+
+    try {
+      await act(async () => {
+        renderer = create(createElement(Probe))
+        await Promise.resolve()
+      })
+      // Settled closed rather than pending, so a failed read never traps the host screen.
+      expect(gates).toMatchObject({
+        hostCapabilities: [],
+        statusPending: false,
+        statusReadable: false
+      })
+      expect(recordDescriptorFromStatusMock).not.toHaveBeenCalled()
+
+      await act(async () => {
+        await vi.advanceTimersByTimeAsync(1_000)
+      })
+      expect(sendRequest).toHaveBeenCalledTimes(2)
+      expect(gates).toMatchObject({
+        hostCapabilities: ['browser.screencast.v1'],
+        statusPending: false,
+        statusReadable: true
+      })
+      expect(recordDescriptorFromStatusMock).toHaveBeenCalledWith(
+        'host-1',
+        expect.objectContaining({ machineName: 'studio' })
+      )
+    } finally {
+      renderer?.unmount()
+      vi.useRealTimers()
+    }
+  })
+
+  it('settles closed on a refusal and re-reads until the host answers', async () => {
+    vi.useFakeTimers()
+    const sendRequest = vi
+      .fn()
+      .mockResolvedValueOnce({ ok: false, error: { code: 'unavailable', message: 'busy' } })
+      .mockResolvedValueOnce({ ok: true, result: { capabilities: ['browser.screencast.v1'] } })
+    const client = { sendRequest } as unknown as RpcClient
+    let gates: HostStatusGates | null = null
+    let renderer: ReactTestRenderer | null = null
+
+    function Probe(): null {
+      gates = useHostStatusGates({ hostId: 'host-1', client, connState: 'connected' })
+      return null
+    }
+
+    try {
+      await act(async () => {
+        renderer = create(createElement(Probe))
+        await Promise.resolve()
+      })
+      expect(gates).toMatchObject({ statusPending: false, statusReadable: false })
+
+      await act(async () => {
+        await vi.advanceTimersByTimeAsync(1_000)
+      })
+      expect(sendRequest).toHaveBeenCalledTimes(2)
+      expect(gates).toMatchObject({
+        hostCapabilities: ['browser.screencast.v1'],
+        statusReadable: true
+      })
+    } finally {
+      renderer?.unmount()
+      vi.useRealTimers()
+    }
+  })
+
+  it('settles closed and stops on a status this app cannot decode', async () => {
+    vi.useFakeTimers()
+    const sendRequest = vi.fn().mockResolvedValue({ ok: true, result: 'not a status' })
+    const client = { sendRequest } as unknown as RpcClient
+    let gates: HostStatusGates | null = null
+    let renderer: ReactTestRenderer | null = null
+
+    function Probe(): null {
+      gates = useHostStatusGates({ hostId: 'host-1', client, connState: 'connected' })
+      return null
+    }
+
+    try {
+      await act(async () => {
+        renderer = create(createElement(Probe))
+        await Promise.resolve()
+      })
+      expect(gates).toMatchObject({ statusPending: false, statusReadable: false })
+      await act(async () => {
+        await vi.advanceTimersByTimeAsync(60_000)
+      })
+      expect(sendRequest).toHaveBeenCalledOnce()
+    } finally {
+      renderer?.unmount()
+      vi.useRealTimers()
+    }
+  })
+
+  it('stops re-reading once the host screen unmounts', async () => {
+    vi.useFakeTimers()
+    const sendRequest = vi.fn().mockRejectedValue(new Error('request timed out'))
+    const client = { sendRequest } as unknown as RpcClient
+    let renderer: ReactTestRenderer | null = null
+
+    function Probe(): null {
+      useHostStatusGates({ hostId: 'host-1', client, connState: 'connected' })
+      return null
+    }
+
+    try {
+      await act(async () => {
+        renderer = create(createElement(Probe))
+        await Promise.resolve()
+      })
+      await act(async () => {
+        renderer?.unmount()
+        renderer = null
+      })
+      await act(async () => {
+        await vi.advanceTimersByTimeAsync(60_000)
+      })
+      expect(sendRequest).toHaveBeenCalledOnce()
+    } finally {
+      renderer?.unmount()
+      vi.useRealTimers()
+    }
+  })
 })
diff --git a/mobile/src/transport/host-status-gates.ts b/mobile/src/transport/host-status-gates.ts
index 21407d80912..7051f7c7018 100644
--- a/mobile/src/transport/host-status-gates.ts
+++ b/mobile/src/transport/host-status-gates.ts
@@ -1,12 +1,12 @@
 import { useEffect, useState } from 'react'
 import type { RpcClient } from './rpc-client'
 import type { ConnectionState } from './types'
-import { hostStatusProbe, readHostStatusGates } from './host-status-probe-operations'
 import { evaluateCompat, type CompatVerdict } from './protocol-compat'
 import type { HostStatusReply } from './host-status-reply-schema'
 import { normalizeHostAppVersion } from './host-app-version'
 import { recordHostAppVersion } from './host-app-version-store'
 import { recordHostDescriptorFromStatus } from './host-descriptor-recorder'
+import { startRuntimeStatusProbe } from './runtime-status-probe'
 
 export type HostStatusGates = {
   hostCapabilities: string[]
@@ -46,6 +46,15 @@ const EMPTY_HOST_PROTOCOL_WINDOW: HostProtocolWindow = {
   minCompatibleMobileVersion: undefined
 }
 
+const UNREADABLE_STATUS_GATES: Omit<HostStatusGates, 'statusPending'> = {
+  hostCapabilities: EMPTY_HOST_CAPABILITIES,
+  floatingWorkspaceEnabled: false,
+  desktopAppVersion: null,
+  compatVerdict: { kind: 'ok' },
+  hostProtocolWindow: EMPTY_HOST_PROTOCOL_WINDOW,
+  statusReadable: false
+}
+
 // Reads status.get on connect for capabilities, protocol-compat verdict, and the
 // floating-workspace flag. Compat constants are wide-open today so this never blocks yet.
 export function useHostStatusGates(args: {
@@ -64,80 +73,10 @@ export function useHostStatusGates(args: {
       setUnverified(true)
       return
     }
-    let cancelled = false
-    const requestClient = client
-    const settle = (gates: Omit<HostStatusGates, 'statusPending'>) => {
-      setLoaded({ hostId, client: requestClient, ...gates })
+    return startHostStatusRead(client, hostId, (gates) => {
+      setLoaded({ hostId, client, ...gates })
       setUnverified(false)
-    }
-    void (async () => {
-      try {
-        const reply = await hostStatusProbe.request(requestClient)
-        if (cancelled) {
-          return
-        }
-        const status = readHostStatusGates(reply)
-        if (!status) {
-          settle({
-            hostCapabilities: [],
-            floatingWorkspaceEnabled: false,
-            desktopAppVersion: null,
-            compatVerdict: { kind: 'ok' },
-            hostProtocolWindow: EMPTY_HOST_PROTOCOL_WINDOW,
-            statusReadable: false
-          })
-          return
-        }
-        const verdict = evaluateCompat({
-          desktopProtocolVersion: status.protocolVersion,
-          desktopMinCompatibleMobileVersion: status.minCompatibleMobileVersion
-        })
-        const desktopAppVersion = normalizeHostAppVersion(status.appVersion)
-        if (hostId && desktopAppVersion) {
-          void recordHostAppVersion(hostId, desktopAppVersion)
-        }
-        if (hostId) {
-          // Why also here: the web page never runs the connection layer's probe, and the host
-          // screen should not wait for it; the recorder is idempotent across the two feeds.
-          recordHostDescriptorFromStatus(hostId, status)
-        }
-        settle({
-          hostCapabilities: status.capabilities ?? [],
-          floatingWorkspaceEnabled: status.floatingWorkspaceEnabled === true,
-          desktopAppVersion,
-          compatVerdict: verdict,
-          hostProtocolWindow: {
-            protocolVersion: status.protocolVersion,
-            minCompatibleMobileVersion: status.minCompatibleMobileVersion
-          },
-          statusReadable: true
-        })
-        if (verdict.kind === 'blocked') {
-          // Why: support breadcrumb to confirm a block fired vs a render bug; no PII, just version ints.
-          console.warn('[protocol-compat] blocked', {
-            reason: verdict.reason,
-            desktopVersion: verdict.desktopVersion,
-            requiredMobileVersion: verdict.requiredMobileVersion,
-            requiredDesktopVersion: verdict.requiredDesktopVersion
-          })
-        }
-      } catch {
-        // Why: a transient status failure must not trap navigation; conservative feature gates remain disabled.
-        if (!cancelled) {
-          settle({
-            hostCapabilities: [],
-            floatingWorkspaceEnabled: false,
-            desktopAppVersion: null,
-            compatVerdict: { kind: 'ok' },
-            hostProtocolWindow: EMPTY_HOST_PROTOCOL_WINDOW,
-            statusReadable: false
-          })
-        }
-      }
-    })()
-    return () => {
-      cancelled = true
-    }
+    })
   }, [client, connState, hostId])
 
   // Why: effects run after render, so key loaded gates by host and client to fail closed during route reuse.
@@ -165,3 +104,67 @@ export function useHostStatusGates(args: {
     statusPending: connState === 'connected' && unverified
   }
 }
+
+/**
+ * Reads status.get until it lands, settling closed on the first failure. Returns the stop function
+ * the effect hands back, so the probe's retry timer is owned outside React.
+ */
+function startHostStatusRead(
+  client: RpcClient,
+  hostId: string | undefined,
+  settle: (gates: Omit<HostStatusGates, 'statusPending'>) => void
+): () => void {
+  let settledClosed = false
+  // Why: a transient status failure must not trap navigation; conservative feature gates remain
+  // disabled. Later failures keep the first one's answer rather than re-render the same closed gates.
+  const settleClosed = () => {
+    if (!settledClosed) {
+      settledClosed = true
+      settle(UNREADABLE_STATUS_GATES)
+    }
+  }
+  return startRuntimeStatusProbe(
+    client,
+    (status) => {
+      // A status this app cannot decode reads the same on every retry, so the probe stops on it.
+      if (!status) {
+        settleClosed()
+        return
+      }
+      const verdict = evaluateCompat({
+        desktopProtocolVersion: status.protocolVersion,
+        desktopMinCompatibleMobileVersion: status.minCompatibleMobileVersion
+      })
+      const desktopAppVersion = normalizeHostAppVersion(status.appVersion)
+      if (hostId && desktopAppVersion) {
+        void recordHostAppVersion(hostId, desktopAppVersion)
+      }
+      if (hostId) {
+        // Why also here: the web page never runs the connection layer's probe, and the host
+        // screen should not wait for it; the recorder is idempotent across the two feeds.
+        recordHostDescriptorFromStatus(hostId, status)
+      }
+      settle({
+        hostCapabilities: status.capabilities ?? [],
+        floatingWorkspaceEnabled: status.floatingWorkspaceEnabled === true,
+        desktopAppVersion,
+        compatVerdict: verdict,
+        hostProtocolWindow: {
+          protocolVersion: status.protocolVersion,
+          minCompatibleMobileVersion: status.minCompatibleMobileVersion
+        },
+        statusReadable: true
+      })
+      if (verdict.kind === 'blocked') {
+        // Why: support breadcrumb to confirm a block fired vs a render bug; no PII, just version ints.
+        console.warn('[protocol-compat] blocked', {
+          reason: verdict.reason,
+          desktopVersion: verdict.desktopVersion,
+          requiredMobileVersion: verdict.requiredMobileVersion,
+          requiredDesktopVersion: verdict.requiredDesktopVersion
+        })
+      }
+    },
+    settleClosed
+  )
+}
diff --git a/mobile/src/transport/host-status-probe-operations.ts b/mobile/src/transport/host-status-probe-operations.ts
index ec9d1ac0e58..0fd13f2c95a 100644
--- a/mobile/src/transport/host-status-probe-operations.ts
+++ b/mobile/src/transport/host-status-probe-operations.ts
@@ -14,12 +14,11 @@ import type { RpcResponse } from './types'
  * surfaces the host's message, `status.create-capabilities-or-skip` is the create drawer's) because
  * an operation name is what a decode failure reports, and because transport must not import tasks.
  *
- * One reader, but three different meanings for an unreadable status, which is why the three
- * readers below exist rather than each caller calling `interpret` directly. The gate wants the
- * failure (its own `catch` degrades to closed gates), and the probe and the race must not have it:
- * both call `interpret` inside a `.then` fulfilment handler, where a throw becomes a detached
- * rejection instead of reaching their rejection handler — the probe would latch capability-gated UI
- * hidden with no retry, and the race would never count the candidate at all.
+ * The readers below exist rather than each caller calling `interpret` directly because neither the
+ * probe (which the gate also runs on) nor the race may have an unreadable status thrown at it: both
+ * call `interpret` inside a `.then` fulfilment handler, where a throw becomes a detached rejection
+ * instead of reaching their rejection handler — the probe would latch capability-gated UI hidden
+ * with no retry, and the race would never count the candidate at all.
  */
 export const hostStatusProbe = bindDeferredRpcOperation(
   defineRpcOperation({
@@ -31,16 +30,6 @@ export const hostStatusProbe = bindDeferredRpcOperation(
   })
 )
 
-/**
- * The gate's read. An unreadable status raises `RpcIncompatibleReplyError` naming `status.get`,
- * which host-status-gates.ts already catches into the same closed gates a property read on a null
- * status used to throw its way to.
- */
-export function readHostStatusGates(reply: RpcResponse): HostStatusReply | null {
-  const accepted = hostStatusProbe.interpret(reply)
-  return accepted.accepted ? accepted.value : null
-}
-
 /**
  * The status the retrying probe delivers, or `null` for a refusal it should back off from.
  *
diff --git a/mobile/src/transport/host-status-reply-schema.ts b/mobile/src/transport/host-status-reply-schema.ts
index 041cbf6a6b9..7f8d834e645 100644
--- a/mobile/src/transport/host-status-reply-schema.ts
+++ b/mobile/src/transport/host-status-reply-schema.ts
@@ -20,7 +20,7 @@ import { NODE_PLATFORM_NAMES } from './mobile-runtime-host-platform'
  * `transport-capability-probe-non-string-capabilities-drop` golden records as `published: [[]]`.
  *
  * The object itself is required, and the three callers each keep the guard that decides what an
- * unreadable status means to them: see `readHostStatusGates`, `readProbedHostCapabilities` and
+ * unreadable status means to them: see `readProbedHostStatus`, `readProbedHostCapabilities` and
  * `hostAnsweredStatusProbe` in host-status-probe-operations.ts.
  */
 export const hostStatusSchema = z.looseObject({
diff --git a/mobile/src/transport/host-store-endpoint.test.ts b/mobile/src/transport/host-store-endpoint.test.ts
index 8553f66e851..59035e0d2b0 100644
--- a/mobile/src/transport/host-store-endpoint.test.ts
+++ b/mobile/src/transport/host-store-endpoint.test.ts
@@ -1,6 +1,14 @@
 import AsyncStorage from '@react-native-async-storage/async-storage'
+import * as SecureStore from 'expo-secure-store'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { updateHostNameAndEndpoint } from './host-store'
+import {
+  loadHosts,
+  RelayRoutingHostRemovedError,
+  resetHostStoreForTests,
+  setRelayRouting,
+  updateHostNameAndEndpoint
+} from './host-store'
+import { resetMobileRelayHostOverlayStoreForTests } from './mobile-relay-host-overlay-store'
 
 vi.mock('@react-native-async-storage/async-storage', () => ({
   default: {
@@ -104,3 +112,110 @@ describe('updateHostNameAndEndpoint', () => {
     expect(AsyncStorage.setItem).not.toHaveBeenCalled()
   })
 })
+
+describe('relay routing after a host edit', () => {
+  const OVERLAY_KEY = 'orca:mobile-relay:host-overlays:v2'
+  const OLD_ENDPOINT = 'ws://192.168.1.10:6768'
+  const NEW_ENDPOINT = 'ws://192.168.1.20:6768'
+  const relay = {
+    v: 1 as const,
+    directorUrl: 'https://relay.onorca.dev',
+    cellUrl: 'https://relay-c1.onorca.dev',
+    assignmentEpoch: 7,
+    relayHostId: 'AbCdEf0123_-xyZ9',
+    e2eeFraming: 2 as const
+  }
+  const moved = { ...relay, cellUrl: 'https://relay-c2.onorca.dev', assignmentEpoch: 8 }
+  const storage = new Map<string, string>()
+
+  function writesTo(key: string): unknown[] {
+    return vi.mocked(AsyncStorage.setItem).mock.calls.filter(([written]) => written === key)
+  }
+
+  beforeEach(() => {
+    resetHostStoreForTests()
+    resetMobileRelayHostOverlayStoreForTests()
+    storage.clear()
+    storage.set(
+      'orca:hosts',
+      JSON.stringify([
+        { id: 'host-1', name: 'Desk', endpoint: OLD_ENDPOINT, publicKeyB64: 'pk', lastConnected: 1 }
+      ])
+    )
+    // An older build's record: a copy of the row's address beside the relay.
+    storage.set(
+      OVERLAY_KEY,
+      JSON.stringify([
+        {
+          v: 2,
+          hostId: 'host-1',
+          endpoints: [
+            { id: 'direct-primary', kind: 'lan', url: OLD_ENDPOINT },
+            { id: 'relay-primary', kind: 'relay', url: 'wss://relay-c1.onorca.dev/v1/connect/id' }
+          ],
+          relayHostId: relay.relayHostId,
+          relay
+        }
+      ])
+    )
+    vi.mocked(AsyncStorage.getItem).mockReset()
+    vi.mocked(AsyncStorage.getItem).mockImplementation(async (key) => storage.get(key) ?? null)
+    vi.mocked(AsyncStorage.setItem).mockReset()
+    vi.mocked(AsyncStorage.setItem).mockImplementation(async (key, value) => {
+      storage.set(key, value)
+    })
+    vi.mocked(SecureStore.getItemAsync).mockResolvedValue('device-token')
+    vi.mocked(SecureStore.setItemAsync).mockReset()
+  })
+
+  it('loads only the edited address, whatever an older overlay stored', async () => {
+    await updateHostNameAndEndpoint('host-1', { endpoint: NEW_ENDPOINT })
+
+    const [host] = await loadHosts()
+    expect(host).toEqual({
+      id: 'host-1',
+      name: 'Desk',
+      personalName: 'Desk',
+      endpoint: NEW_ENDPOINT,
+      publicKeyB64: 'pk',
+      lastConnected: 1,
+      deviceToken: 'device-token',
+      relay
+    })
+  })
+
+  it('keeps an edited endpoint and the device token when relay routing is learned later', async () => {
+    await updateHostNameAndEndpoint('host-1', { personalName: 'Renamed', endpoint: NEW_ENDPOINT })
+    const hostsAfterEdit = storage.get('orca:hosts')
+
+    await setRelayRouting('host-1', moved)
+
+    expect(storage.get('orca:hosts')).toBe(hostsAfterEdit)
+    expect(SecureStore.setItemAsync).not.toHaveBeenCalled()
+    const [host] = await loadHosts()
+    expect(host).toMatchObject({ name: 'Renamed', endpoint: NEW_ENDPOINT, relay: moved })
+  })
+
+  it('does not rewrite storage when relay resolution repeats the stored routing', async () => {
+    await setRelayRouting('host-1', relay)
+    vi.mocked(AsyncStorage.setItem).mockClear()
+
+    await setRelayRouting('host-1', relay)
+
+    expect(AsyncStorage.setItem).not.toHaveBeenCalled()
+    expect(SecureStore.setItemAsync).not.toHaveBeenCalled()
+  })
+
+  it('refuses to write routing for a removed host and leaves no overlay behind', async () => {
+    storage.set('orca:hosts', '[]')
+    storage.set(OVERLAY_KEY, '[]')
+
+    await expect(setRelayRouting('host-1', relay)).rejects.toBeInstanceOf(
+      RelayRoutingHostRemovedError
+    )
+
+    expect(writesTo(OVERLAY_KEY)).toEqual([])
+    expect(writesTo('orca:hosts')).toEqual([])
+    await expect(loadHosts()).resolves.toEqual([])
+  })
+})
diff --git a/mobile/src/transport/host-store.test.ts b/mobile/src/transport/host-store.test.ts
index bb13e23dc4d..60269c01d5e 100644
--- a/mobile/src/transport/host-store.test.ts
+++ b/mobile/src/transport/host-store.test.ts
@@ -1,5 +1,8 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { MobileRelayHostOverlay } from './mobile-relay-host-overlay'
+import {
+  toStoredMobileRelayHostOverlay,
+  type MobileRelayHostOverlay
+} from './mobile-relay-host-overlay'
 
 const asyncStorageMock = vi.hoisted(() => ({
   getItem: vi.fn(),
@@ -41,12 +44,12 @@ vi.mock('./host-credential-cleanup', () => ({
 import {
   loadHostCatalog,
   loadHosts,
-  MobileRelayUpgradeHostRemovedError,
+  RelayRoutingHostRemovedError,
   removeHost,
   resolvePairingHostIdentity,
   resetHostStoreForTests,
-  saveHost,
-  saveExistingHostRelayUpgrade,
+  savePairedHost,
+  setRelayRouting,
   updateHostNameAndEndpoint,
   updateLastConnected
 } from './host-store'
@@ -69,6 +72,14 @@ const HOST_TWO = {
   publicKeyB64: 'key-2',
   lastConnected: 0
 }
+const HOST_ONE_RELAY = {
+  v: 1 as const,
+  directorUrl: 'https://relay.onorca.dev',
+  cellUrl: 'https://relay-c1.onorca.dev',
+  assignmentEpoch: 7,
+  relayHostId: 'AbCdEf0123_-xyZ9',
+  e2eeFraming: 2 as const
+}
 const HOST_ONE_RELAY_BUNDLE = {
   v: 1 as const,
   hostId: HOST_ONE.id,
@@ -175,7 +186,7 @@ describe('host-store list mutations', () => {
   })
 
   it('keeps existing metadata when pairing a distinct host', async () => {
-    await saveHost({
+    await savePairedHost({
       id: 'host-new',
       name: 'Host 3',
       endpoint: 'ws://127.0.0.1:3',
@@ -204,7 +215,7 @@ describe('host-store list mutations', () => {
       { ...HOST_TWO, id: 'host-duplicate', publicKeyB64: HOST_ONE.publicKeyB64 }
     ])
 
-    await saveHost({
+    await savePairedHost({
       ...HOST_ONE,
       endpoint: 'ws://127.0.0.1:3',
       deviceToken: 'replacement-token'
@@ -227,7 +238,11 @@ describe('host-store list mutations', () => {
     secureStoreMock.setItemAsync.mockRejectedValue(new Error('keychain write failed'))
 
     await expect(
-      saveHost({ ...HOST_ONE, endpoint: 'ws://127.0.0.1:3', deviceToken: 'replacement-token' })
+      savePairedHost({
+        ...HOST_ONE,
+        endpoint: 'ws://127.0.0.1:3',
+        deviceToken: 'replacement-token'
+      })
     ).rejects.toThrow('keychain write failed')
 
     expect(JSON.parse(storedHostsRaw)).toEqual([HOST_ONE, duplicate])
@@ -246,7 +261,11 @@ describe('host-store list mutations', () => {
     asyncStorageMock.setItem.mockRejectedValueOnce(new Error('metadata write failed'))
 
     await expect(
-      saveHost({ ...HOST_ONE, endpoint: 'ws://127.0.0.1:3', deviceToken: 'replacement-token' })
+      savePairedHost({
+        ...HOST_ONE,
+        endpoint: 'ws://127.0.0.1:3',
+        deviceToken: 'replacement-token'
+      })
     ).rejects.toThrow('metadata write failed')
 
     expect(JSON.parse(storedHostsRaw)).toEqual([HOST_ONE, duplicate])
@@ -264,7 +283,7 @@ describe('host-store list mutations', () => {
     }
     asyncStorageMock.setItem.mockRejectedValueOnce(new Error('metadata write failed'))
 
-    await expect(saveHost(replacement)).rejects.toThrow('metadata write failed')
+    await expect(savePairedHost(replacement)).rejects.toThrow('metadata write failed')
 
     expect(JSON.parse(storedHostsRaw)).toEqual([HOST_ONE, HOST_TWO])
     expect(recordCleanupIntentMock).toHaveBeenCalledWith(replacement.id)
@@ -281,10 +300,10 @@ describe('host-store list mutations', () => {
       publicKeyB64: HOST_ONE.publicKeyB64
     }
     storedHostsRaw = JSON.stringify([HOST_ONE, duplicate])
-    await saveHost({ ...HOST_ONE, deviceToken: 'token-a' })
+    await savePairedHost({ ...HOST_ONE, deviceToken: 'token-a' })
     const staleCleanup = scheduledCleanup(duplicate.id)
 
-    await saveHost({ ...duplicate, deviceToken: 'token-b' })
+    await savePairedHost({ ...duplicate, deviceToken: 'token-b' })
     await staleCleanup(duplicate.id)
 
     expect(JSON.parse(storedHostsRaw)).toEqual([duplicate])
@@ -390,26 +409,19 @@ describe('host-store list mutations', () => {
           url: 'wss://relay-c1.onorca.dev/v1/connect/AbCdEf0123_-xyZ9'
         }
       ],
-      relayHostId: 'AbCdEf0123_-xyZ9',
-      relay: {
-        v: 1,
-        directorUrl: 'https://relay.onorca.dev',
-        cellUrl: 'https://relay-c1.onorca.dev',
-        assignmentEpoch: 7,
-        relayHostId: 'AbCdEf0123_-xyZ9',
-        e2eeFraming: 2
-      }
+      relayHostId: HOST_ONE_RELAY.relayHostId,
+      relay: HOST_ONE_RELAY
     }
     storedOverlayRaw = JSON.stringify([overlay])
 
-    await saveHost({ ...HOST_ONE, deviceToken: 'replacement-token' })
+    await savePairedHost({ ...HOST_ONE, deviceToken: 'replacement-token' })
 
     expect(JSON.parse(storedOverlayRaw!)).toEqual([])
     expect(secureStoreMock.deleteItemAsync).not.toHaveBeenCalled()
   })
 
   it('does not touch relay storage when saving a new direct-only host', async () => {
-    await saveHost({
+    await savePairedHost({
       id: 'host-new',
       name: 'New Host',
       endpoint: 'ws://127.0.0.1:3',
@@ -423,7 +435,7 @@ describe('host-store list mutations', () => {
   })
 
   it('keeps the normal iOS save on the existing default keychain service', async () => {
-    await saveHost({
+    await savePairedHost({
       id: 'host-new',
       name: 'New Host',
       endpoint: 'ws://127.0.0.1:3',
@@ -467,7 +479,7 @@ describe('host-store list mutations', () => {
       })
     )
 
-    const save = saveHost({ ...HOST_ONE, deviceToken: 'replacement-token' })
+    const save = savePairedHost({ ...HOST_ONE, deviceToken: 'replacement-token' })
     await vi.waitFor(() => expect(secureStoreMock.setItemAsync).toHaveBeenCalledOnce())
     await removeHost(HOST_ONE.id)
     releaseTokenWrite()
@@ -488,7 +500,7 @@ describe('host-store list mutations', () => {
     }
     recordCleanupIntentMock.mockRejectedValueOnce(new Error('intent storage unavailable'))
 
-    await expect(saveHost(replacement)).rejects.toThrow('intent storage unavailable')
+    await expect(savePairedHost(replacement)).rejects.toThrow('intent storage unavailable')
 
     expect(JSON.parse(storedHostsRaw)).toEqual([HOST_ONE, HOST_TWO])
     expect(secureStoreMock.setItemAsync).not.toHaveBeenCalled()
@@ -518,15 +530,8 @@ describe('host-store list mutations', () => {
           url: 'wss://relay-c1.onorca.dev/v1/connect/AbCdEf0123_-xyZ9'
         }
       ],
-      relayHostId: 'AbCdEf0123_-xyZ9',
-      relay: {
-        v: 1,
-        directorUrl: 'https://relay.onorca.dev',
-        cellUrl: 'https://relay-c1.onorca.dev',
-        assignmentEpoch: 7,
-        relayHostId: 'AbCdEf0123_-xyZ9',
-        e2eeFraming: 2
-      }
+      relayHostId: HOST_ONE_RELAY.relayHostId,
+      relay: HOST_ONE_RELAY
     }
     storedOverlayRaw = JSON.stringify([overlay, { ...overlay, hostId: 'removed-by-old-build' }])
     let releaseCleanup: () => void = () => {}
@@ -538,38 +543,32 @@ describe('host-store list mutations', () => {
 
     const hostsLoad = loadHosts()
     await vi.waitFor(() => expect(scheduleCleanupMock).toHaveBeenCalled())
-    await saveHost({
+    await savePairedHost({
       ...HOST_ONE,
       id: 'removed-by-old-build',
       publicKeyB64: 'restored-key',
       deviceToken: 'restored-token',
-      endpoints: overlay.endpoints,
-      relayHostId: overlay.relayHostId,
       relay: overlay.relay
     })
     releaseCleanup()
     const hosts = await hostsLoad
 
-    expect(hosts.find(({ id }) => id === HOST_ONE.id)).toMatchObject({
-      endpoints: overlay.endpoints,
-      relayHostId: overlay.relayHostId,
-      relay: overlay.relay
-    })
+    expect(hosts.find(({ id }) => id === HOST_ONE.id)).toMatchObject({ relay: overlay.relay })
     expect(hosts.some(({ id }) => id === 'removed-by-old-build')).toBe(false)
-    expect(JSON.parse(storedOverlayRaw!)).toContainEqual({
-      ...overlay,
-      hostId: 'removed-by-old-build'
-    })
+    expect(JSON.parse(storedOverlayRaw!)).toContainEqual(
+      toStoredMobileRelayHostOverlay('removed-by-old-build', HOST_ONE_RELAY)
+    )
   })
 
   it('refuses to resurrect a removed host during relay upgrade publication', async () => {
     storedHostsRaw = JSON.stringify([HOST_TWO])
 
-    await expect(
-      saveExistingHostRelayUpgrade({ ...HOST_ONE, deviceToken: 'token-1' })
-    ).rejects.toBeInstanceOf(MobileRelayUpgradeHostRemovedError)
+    await expect(setRelayRouting(HOST_ONE.id, HOST_ONE_RELAY)).rejects.toBeInstanceOf(
+      RelayRoutingHostRemovedError
+    )
 
     expect(JSON.parse(storedHostsRaw)).toEqual([HOST_TWO])
+    expect(storedOverlayRaw).toBeNull()
     expect(secureStoreMock.setItemAsync).not.toHaveBeenCalled()
   })
 
@@ -705,7 +704,7 @@ describe('host-store list mutations', () => {
     expect(hosts.find((host) => host.id === HOST_ONE.id)?.name).toBe('Living Room Mac')
   })
 
-  it('does not share a host-list pass started before saveHost commits its token', async () => {
+  it('does not share a host-list pass started before savePairedHost commits its token', async () => {
     const newHost = {
       id: 'host-new',
       name: 'New Host',
@@ -736,7 +735,7 @@ describe('host-store list mutations', () => {
       return key.endsWith(HOST_ONE.id) || key.endsWith(HOST_TWO.id) ? `token-${key.at(-1)}` : null
     })
 
-    const save = saveHost(newHost)
+    const save = savePairedHost(newHost)
     await vi.waitFor(() => {
       expect(secureStoreMock.setItemAsync).toHaveBeenCalled()
     })
@@ -784,7 +783,7 @@ describe('host-store list mutations', () => {
     await vi.waitFor(() => {
       expect(secureStoreMock.getItemAsync).toHaveBeenCalled()
     })
-    await saveHost(newHost)
+    await savePairedHost(newHost)
     resolvePrewriteTokenRead('token-old')
     await parkedLoad
 
@@ -876,7 +875,7 @@ describe('host-store pairing save after an Android encryption rejection', () =>
       }
     )
 
-    await expect(saveHost(NEW_HOST)).resolves.toBeUndefined()
+    await expect(savePairedHost(NEW_HOST)).resolves.toBeUndefined()
 
     expect(written.get('orca.pairing.v1')).toBe('device-token')
     expect(JSON.parse(storedHostsRaw)).toEqual([
@@ -893,7 +892,7 @@ describe('host-store pairing save after an Android encryption rejection', () =>
   it('still surfaces the failure when no keystore alias can accept the token', async () => {
     secureStoreMock.setItemAsync.mockRejectedValue(ENCRYPT_REJECTION)
 
-    await expect(saveHost(NEW_HOST)).rejects.toBe(ENCRYPT_REJECTION)
+    await expect(savePairedHost(NEW_HOST)).rejects.toBe(ENCRYPT_REJECTION)
   })
 
   it('serves the rotated token to loadHosts so the saved host survives a relaunch', async () => {
@@ -906,7 +905,7 @@ describe('host-store pairing save after an Android encryption rejection', () =>
         written.set(options.keychainService, value)
       }
     )
-    await saveHost(NEW_HOST)
+    await savePairedHost(NEW_HOST)
     // Why: a fresh process has no token cache, so the host list has to come back off the rotated alias.
     resetHostStoreForTests()
     secureStoreMock.getItemAsync.mockImplementation(
diff --git a/mobile/src/transport/host-store.ts b/mobile/src/transport/host-store.ts
index 32f910cd27d..f34b3866d69 100644
--- a/mobile/src/transport/host-store.ts
+++ b/mobile/src/transport/host-store.ts
@@ -1,3 +1,4 @@
+import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
 import { HostProfileSchema } from './types'
 import type { HostCatalogEntry, HostProfile, StoredHostProfile } from './types'
 import { getNextHostNameFromHosts } from './host-names'
@@ -13,10 +14,10 @@ import {
   scheduleHostCredentialCleanup
 } from './host-credential-cleanup'
 import {
-  loadMobileRelayHostOverlayState,
-  removeMobileRelayHostOverlay,
-  removeMobileRelayHostOverlays,
-  saveMobileRelayHostOverlay
+  loadMobileRelayHostRoutingState,
+  removeMobileRelayHostRouting,
+  removeMobileRelayHostRoutings,
+  saveMobileRelayHostRouting
 } from './mobile-relay-host-overlay-store'
 import { scheduleOrphanedMobileRelayCleanup } from './mobile-relay-orphan-cleanup'
 import {
@@ -63,7 +64,7 @@ async function doLoadHostListSnapshot(): Promise<hostListLoads.HostListSnapshot>
   if (!storedHosts) {
     return { catalog: [], profiles: [] }
   }
-  const overlayState = await loadMobileRelayHostOverlayState(
+  const overlayState = await loadMobileRelayHostRoutingState(
     new Set(storedHosts.map(({ id }) => id))
   )
   const orphanWriteRevisions = new Map(
@@ -77,7 +78,7 @@ async function doLoadHostListSnapshot(): Promise<hostListLoads.HostListSnapshot>
   })
   return joinHostCatalogCredentials({
     storedHosts,
-    overlays: overlayState.overlays,
+    relays: overlayState.relays,
     tokenCache,
     readToken: readHostDeviceToken,
     getRevision: hostListLoads.getHostListLoadRevision
@@ -140,7 +141,7 @@ function removeOrphanOverlayIfUnpaired(hostId: string): Promise<void> {
   return enqueueHostListMutation(async () => {
     const hosts = await readStoredHostProfilesForMutation()
     if (!hosts.some(({ id }) => id === hostId)) {
-      await removeMobileRelayHostOverlay(hostId)
+      await removeMobileRelayHostRouting(hostId)
     }
   })
 }
@@ -148,14 +149,28 @@ function removeOrphanOverlayIfUnpaired(hostId: string): Promise<void> {
 // The page's host-store sibling keeps its own no-op, so only the native store reaches persistence.
 export { updateHostDescriptor } from './host-descriptor-persistence'
 
-export class MobileRelayUpgradeHostRemovedError extends Error {}
+export class RelayRoutingHostRemovedError extends Error {}
 
-export const saveHost = (host: HostProfile): Promise<void> => persistHost(host, false)
+/**
+ * Relay routing learned after pairing (re-resolution, rotation, direct upgrade). Routing only; the
+ * row and token belong to pairing and Edit Host.
+ */
+export async function setRelayRouting(hostId: string, relay: MobileRelayEndpoint): Promise<void> {
+  const wrote = await enqueueHostListMutation(async () => {
+    const hosts = await readStoredHostProfilesForMutation()
+    if (!hosts.some(({ id }) => id === hostId)) {
+      // Why: an in-flight relay learner must not resurrect a host the user removed.
+      throw new RelayRoutingHostRemovedError('mobile relay host was removed')
+    }
+    return saveMobileRelayHostRouting(hostId, relay)
+  })
+  if (wrote) {
+    hostListLoads.dropSharedHostListLoad()
+  }
+}
 
-export const saveExistingHostRelayUpgrade = (host: HostProfile): Promise<void> =>
-  persistHost(host, true)
-
-async function persistHost(host: HostProfile, requireExisting: boolean): Promise<void> {
+/** Pairing only (a census fences the importers): it creates or re-pairs the whole host. */
+export async function savePairedHost(host: HostProfile): Promise<void> {
   const validated = HostProfileSchema.parse(host)
   const stored = toStoredHostProfile(validated)
   const duplicateHostIds = new Set<string>()
@@ -179,9 +194,6 @@ async function persistHost(host: HostProfile, requireExisting: boolean): Promise
           .map((candidate) =>
             candidate.id === stored.id ? mergeHostNameIdentity(stored, candidate) : candidate
           )
-      } else if (requireExisting) {
-        // Why: an in-flight relay upgrade must not resurrect a host the user removed.
-        throw new MobileRelayUpgradeHostRemovedError('mobile relay upgrade host was removed')
       } else {
         next = [...hosts.filter(({ id }) => !duplicateHostIds.has(id)), stored]
       }
@@ -217,23 +229,17 @@ async function persistHost(host: HostProfile, requireExisting: boolean): Promise
   }
   // Why: a later removal owns its cleanup intent; cancel only while this publication remains authoritative.
   cancelCleanupForStoredHost(stored.id)
-  if (validated.endpoints) {
-    await saveMobileRelayHostOverlay({
-      v: 2,
-      hostId: stored.id,
-      endpoints: validated.endpoints,
-      relayHostId: validated.relayHostId,
-      relay: validated.relay
-    })
+  if (validated.relay) {
+    await saveMobileRelayHostRouting(stored.id, validated.relay)
     hostListLoads.dropSharedHostListLoad()
   }
   const overlayRemovalIds = [...duplicateHostIds]
-  if (!validated.endpoints && updatedExistingHost) {
+  if (!validated.relay && updatedExistingHost) {
     overlayRemovalIds.push(stored.id)
   }
   if (overlayRemovalIds.length > 0) {
     // Why: reusing an id for direct-only re-pairing must not retain routing metadata from the previous transport state.
-    await removeMobileRelayHostOverlays(overlayRemovalIds)
+    await removeMobileRelayHostRoutings(overlayRemovalIds)
     hostListLoads.dropSharedHostListLoad()
   }
   for (const duplicateHostId of duplicateHostIds) {
@@ -265,7 +271,7 @@ export async function removeHost(hostId: string): Promise<void> {
   }
   tokenCache.delete(hostId)
   try {
-    await removeMobileRelayHostOverlay(hostId)
+    await removeMobileRelayHostRouting(hostId)
     hostListLoads.dropSharedHostListLoad()
   } catch {
     // Base removal is authoritative; a retained overlay can't resurrect the host and is cleaned on a later retry.
diff --git a/mobile/src/transport/host-store.web.ts b/mobile/src/transport/host-store.web.ts
index 8c9d54e588c..fdadca91b86 100644
--- a/mobile/src/transport/host-store.web.ts
+++ b/mobile/src/transport/host-store.web.ts
@@ -3,6 +3,7 @@
 // this host up paints "Host not found" over the host the shell just opened it for. What crosses
 // instead is `init.host`: the profile the screens read, without the credential the bridge carries.
 import { readPageHostProfile } from '../mobile-web-shell/bridge/page-host-profile'
+import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
 import type { HostCatalogEntry, HostProfile } from './types'
 
 /**
@@ -25,8 +26,10 @@ export const loadHostCatalog = (): Promise<HostCatalogEntry[]> =>
   )
 
 /** Pairing happened natively before this document existed, and the page never re-does it. */
-export const saveHost = (_host: HostProfile): Promise<void> => Promise.resolve()
-export const saveExistingHostRelayUpgrade = (_host: HostProfile): Promise<void> => Promise.resolve()
+export const savePairedHost = (_host: HostProfile): Promise<void> => Promise.resolve()
+/** Relay routing belongs to the native endpoint lifecycle, which the page does not run. */
+export const setRelayRouting = (_hostId: string, _relay: MobileRelayEndpoint): Promise<void> =>
+  Promise.resolve()
 export const removeHost = (_hostId: string): Promise<void> => Promise.resolve()
 
 /** A native write the page drops: recency orders the app's host list, which the page does not show. */
diff --git a/mobile/src/transport/mobile-direct-endpoint-probe.test.ts b/mobile/src/transport/mobile-direct-endpoint-probe.test.ts
index 4049b4b073b..e225d02de8a 100644
--- a/mobile/src/transport/mobile-direct-endpoint-probe.test.ts
+++ b/mobile/src/transport/mobile-direct-endpoint-probe.test.ts
@@ -1,7 +1,10 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { RpcClient } from './rpc-client'
-import { openAuthenticatedDirectEndpoint } from './mobile-direct-endpoint-probe'
-import type { ConnectionState, HostProfile, RpcResponse } from './types'
+import {
+  directPathForEndpoint,
+  openAuthenticatedDirectEndpoint
+} from './mobile-direct-endpoint-probe'
+import type { ConnectionState, RpcResponse } from './types'
 
 class FakeClient implements RpcClient {
   readonly sendRequest = vi.fn(async (): Promise<RpcResponse> => ({
@@ -34,42 +37,17 @@ class FakeClient implements RpcClient {
   }
 }
 
-const host: HostProfile = {
-  id: 'host-1',
-  name: 'Blue Whale',
-  endpoint: 'ws://192.168.1.10:6768',
-  deviceToken: 'device-token',
-  publicKeyB64: 'A'.repeat(44),
-  lastConnected: 1,
-  endpoints: [
-    { id: 'lan', kind: 'lan', url: 'ws://192.168.1.10:6768' },
-    { id: 'tailscale', kind: 'tailscale', url: 'ws://100.64.0.2:6768' }
-  ]
-}
-
 describe('mobile direct endpoint probe', () => {
   beforeEach(() => vi.useFakeTimers())
   afterEach(() => vi.useRealTimers())
 
-  it('uses the first authenticated candidate without waiting for a stale primary', async () => {
-    const clients = new Map<string, FakeClient>()
-    const openDirect = vi.fn((endpoint: string) => {
-      const client = new FakeClient('connecting')
-      clients.set(endpoint, client)
-      if (endpoint.includes('100.64.0.2')) {
-        setTimeout(() => client.publishState('connected'), 100)
-      }
-      return client
-    })
-
-    const probing = openAuthenticatedDirectEndpoint(host, openDirect, 12_000)
-    await vi.advanceTimersByTimeAsync(100)
-    const result = await probing
-
-    expect(result?.path).toBe('tailscale')
-    expect(openDirect).toHaveBeenCalledTimes(2)
-    expect(clients.get(host.endpoint)?.close).toHaveBeenCalledOnce()
-    expect(result?.client.close).not.toHaveBeenCalled()
+  it('classifies a tailnet endpoint apart from a LAN one', () => {
+    expect(directPathForEndpoint('ws://100.64.0.2:6768')).toBe('tailscale')
+    expect(directPathForEndpoint('wss://desk.tail1234.ts.net:6768')).toBe('tailscale')
+    expect(directPathForEndpoint('ws://[fd7a:115c:a1e0::1]:6768')).toBe('tailscale')
+    // 100.0.0.0/10 is not the tailnet's 100.64.0.0/10.
+    expect(directPathForEndpoint('ws://100.12.0.2:6768')).toBe('lan')
+    expect(directPathForEndpoint('ws://192.168.1.10:6768')).toBe('lan')
   })
 
   it('fails a whole dead LAN in seconds instead of holding the 12s bound', async () => {
@@ -84,15 +62,13 @@ describe('mobile direct endpoint probe', () => {
       return client
     })
 
-    const probing = openAuthenticatedDirectEndpoint(host, openDirect, 12_000)
+    const probing = openAuthenticatedDirectEndpoint(openDirect, 12_000)
     await vi.advanceTimersByTimeAsync(20)
     await vi.advanceTimersByTimeAsync(2_000)
     await expect(probing).resolves.toBeNull()
 
-    expect(clients).toHaveLength(2)
-    for (const client of clients) {
-      expect(client.close).toHaveBeenCalledOnce()
-    }
+    expect(clients).toHaveLength(1)
+    expect(clients[0]!.close).toHaveBeenCalledOnce()
     // No 12s timer is left behind to fire into a settled probe.
     expect(vi.getTimerCount()).toBe(0)
   })
@@ -100,41 +76,37 @@ describe('mobile direct endpoint probe', () => {
   it('rides out one access-point flap that the first redial recovers', async () => {
     // 'reconnecting' is published on any socket close, so a single RST on the first
     // dial must not book a direct failure and its 60s cooldown.
-    const openDirect = vi.fn((endpoint: string) => {
+    const openDirect = vi.fn(() => {
       const client = new FakeClient('connecting')
-      if (endpoint.includes('100.64.0.2')) {
-        setTimeout(() => client.publishState('reconnecting'), 20)
-        setTimeout(() => client.publishState('connected'), 600)
-      }
+      setTimeout(() => client.publishState('reconnecting'), 20)
+      setTimeout(() => client.publishState('connected'), 600)
       return client
     })
 
-    const probing = openAuthenticatedDirectEndpoint(host, openDirect, 12_000)
+    const probing = openAuthenticatedDirectEndpoint(openDirect, 12_000)
     await vi.advanceTimersByTimeAsync(600)
     const result = await probing
 
-    expect(result?.path).toBe('tailscale')
-    expect(result?.client.close).not.toHaveBeenCalled()
+    expect(result).not.toBeNull()
+    expect(result?.close).not.toHaveBeenCalled()
   })
 
   it('extends the grace once when the redial reaches a handshake', async () => {
     // The redial fires at 500ms, but 'connected' waits on the Noise handshake and a
     // capability RPC, so real work needs more than one grace window.
-    const openDirect = vi.fn((endpoint: string) => {
+    const openDirect = vi.fn(() => {
       const client = new FakeClient('connecting')
-      if (endpoint.includes('100.64.0.2')) {
-        setTimeout(() => client.publishState('reconnecting'), 20)
-        setTimeout(() => client.publishState('handshaking'), 1_500)
-        // Past the first grace window: only the re-arm keeps this probe alive.
-        setTimeout(() => client.publishState('connected'), 3_000)
-      }
+      setTimeout(() => client.publishState('reconnecting'), 20)
+      setTimeout(() => client.publishState('handshaking'), 1_500)
+      // Past the first grace window: only the re-arm keeps this probe alive.
+      setTimeout(() => client.publishState('connected'), 3_000)
       return client
     })
 
-    const probing = openAuthenticatedDirectEndpoint(host, openDirect, 12_000)
+    const probing = openAuthenticatedDirectEndpoint(openDirect, 12_000)
     await vi.advanceTimersByTimeAsync(3_000)
 
-    expect((await probing)?.path).toBe('tailscale')
+    expect(await probing).not.toBeNull()
   })
 
   it('fails a handshake that stalls, one grace after it started', async () => {
@@ -147,7 +119,7 @@ describe('mobile direct endpoint probe', () => {
       return client
     })
 
-    const probing = openAuthenticatedDirectEndpoint(host, openDirect, 12_000)
+    const probing = openAuthenticatedDirectEndpoint(openDirect, 12_000)
     await vi.advanceTimersByTimeAsync(3_499)
     let settled = false
     void probing.then(() => {
@@ -168,7 +140,7 @@ describe('mobile direct endpoint probe', () => {
       return client
     })
 
-    const probing = openAuthenticatedDirectEndpoint(host, openDirect, 12_000)
+    const probing = openAuthenticatedDirectEndpoint(openDirect, 12_000)
     await vi.advanceTimersByTimeAsync(2_019)
     let settled = false
     void probing.then(() => {
diff --git a/mobile/src/transport/mobile-direct-endpoint-probe.ts b/mobile/src/transport/mobile-direct-endpoint-probe.ts
index 038f73b93b8..a586d45eb0a 100644
--- a/mobile/src/transport/mobile-direct-endpoint-probe.ts
+++ b/mobile/src/transport/mobile-direct-endpoint-probe.ts
@@ -1,28 +1,9 @@
+import { isTailscaleEndpoint } from '../../../src/shared/remote-runtime-tailscale-hint'
 import type { RpcClient } from './rpc-client'
 import type { MobileConnectionPath } from './stable-logical-rpc-client'
-import type { HostProfile } from './types'
 
-function directEndpointUrls(host: HostProfile): string[] {
-  const endpoints =
-    host.endpoints?.filter(({ kind }) => kind !== 'relay').map(({ url }) => url) ?? []
-  return [...new Set([host.endpoint, ...endpoints])]
-}
-
-export function directPathForEndpoint(
-  host: HostProfile,
-  endpoint: string
-): Exclude<MobileConnectionPath, 'relay'> {
-  const configured = host.endpoints?.find((candidate) => candidate.url === endpoint)
-  if (configured?.kind === 'tailscale') {
-    return 'tailscale'
-  }
-  try {
-    const hostname = new URL(endpoint).hostname
-    if (hostname.endsWith('.ts.net') || /^100\.(?:\d{1,3}\.){2}\d{1,3}$/.test(hostname)) {
-      return 'tailscale'
-    }
-  } catch {}
-  return 'lan'
+export function directPathForEndpoint(endpoint: string): Exclude<MobileConnectionPath, 'relay'> {
+  return isTailscaleEndpoint(endpoint) ? 'tailscale' : 'lan'
 }
 
 // Why: 'reconnecting' is published on any socket close, so it cannot tell a dead
@@ -98,62 +79,28 @@ function waitForAuthenticatedSession(
 }
 
 export async function openAuthenticatedDirectEndpoint(
-  host: HostProfile,
-  openDirect: (endpoint: string) => RpcClient,
+  openDirect: () => RpcClient,
   timeoutMs: number,
   signal?: AbortSignal
-): Promise<{ client: RpcClient; path: Exclude<MobileConnectionPath, 'relay'> } | null> {
+): Promise<RpcClient | null> {
   if (signal?.aborted) {
     return null
   }
-  const endpoints = directEndpointUrls(host)
-  return await new Promise((resolve) => {
-    const clients = new Set<RpcClient>()
-    let remaining = endpoints.length
-    let settled = false
-    const rejectCandidate = (): void => {
-      remaining--
-      if (!settled && remaining === 0) {
-        settled = true
-        resolve(null)
-      }
-    }
-    for (const endpoint of endpoints) {
-      let client: RpcClient
-      try {
-        client = openDirect(endpoint)
-      } catch {
-        rejectCandidate()
-        continue
-      }
-      clients.add(client)
-      void waitForAuthenticatedSession(client, timeoutMs, signal).then(
-        () => {
-          if (signal?.aborted) {
-            client.close()
-            rejectCandidate()
-            return
-          }
-          if (settled) {
-            client.close()
-            return
-          }
-          settled = true
-          for (const candidate of clients) {
-            if (candidate !== client) {
-              candidate.close()
-            }
-          }
-          resolve({ client, path: directPathForEndpoint(host, endpoint) })
-        },
-        () => {
-          if (settled) {
-            return
-          }
-          client.close()
-          rejectCandidate()
-        }
-      )
-    }
-  })
+  let client: RpcClient
+  try {
+    client = openDirect()
+  } catch {
+    return null
+  }
+  try {
+    await waitForAuthenticatedSession(client, timeoutMs, signal)
+  } catch {
+    client.close()
+    return null
+  }
+  if (signal?.aborted) {
+    client.close()
+    return null
+  }
+  return client
 }
diff --git a/mobile/src/transport/mobile-direct-probe-stop-budget.test.ts b/mobile/src/transport/mobile-direct-probe-stop-budget.test.ts
index 535790ed480..409863bb992 100644
--- a/mobile/src/transport/mobile-direct-probe-stop-budget.test.ts
+++ b/mobile/src/transport/mobile-direct-probe-stop-budget.test.ts
@@ -3,7 +3,8 @@ import {
   dependencies,
   FakeLogicalClient,
   FakeSession,
-  host
+  host,
+  relay
 } from './mobile-endpoint-supervisor-test-fakes'
 import { MobileEndpointHysteresis } from './mobile-endpoint-hysteresis'
 import { createStableLogicalRpcClient } from './stable-logical-rpc-client'
@@ -17,7 +18,7 @@ it('closes in-flight candidates and clears their timeout when the owner stops',
     const candidate = new FakeSession('connecting')
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies({ openDirect: vi.fn(() => candidate) })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(15_000)
     expect(deps.openDirect).toHaveBeenCalledOnce()
@@ -42,7 +43,7 @@ it('closes an authenticated candidate when stop races its completion', async ()
     const candidate = new FakeSession('connecting')
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies({ openDirect: vi.fn(() => candidate) })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(15_000)
     candidate.publishState('connected')
@@ -63,7 +64,7 @@ it('preserves an in-flight probe across a transient background pause', async ()
     const candidate = new FakeSession('connecting')
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies({ openDirect: vi.fn(() => candidate) })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(15_000)
     supervisor.setForeground(false)
@@ -79,54 +80,14 @@ it('preserves an in-flight probe across a transient background pause', async ()
   }
 })
 
-it('releases every candidate when multiple endpoint probes are pending', async () => {
-  vi.useFakeTimers()
-  try {
-    const candidates: FakeSession[] = []
-    const logical = new FakeLogicalClient('connected', 'relay')
-    const deps = dependencies({
-      openDirect: vi.fn(() => {
-        const candidate = new FakeSession('connecting')
-        candidates.push(candidate)
-        return candidate
-      })
-    })
-    const supervisor = new MobileEndpointSupervisor(
-      logical,
-      {
-        ...host,
-        endpoints: [{ id: 'alternate', kind: 'tailscale', url: 'ws://100.64.0.2:6768' }]
-      },
-      deps
-    )
-    await supervisor.start()
-    await vi.advanceTimersByTimeAsync(15_000)
-    expect(candidates).toHaveLength(2)
-    supervisor.stop()
-    await vi.advanceTimersByTimeAsync(0)
-    expect(vi.getTimerCount()).toBe(0)
-    for (const candidate of candidates) {
-      expect(candidate.close).toHaveBeenCalledOnce()
-      candidate.publishState('connected')
-    }
-    await vi.advanceTimersByTimeAsync(60_000)
-    expect(logical.migrateTo).not.toHaveBeenCalled()
-    expect(deps.openDirect).toHaveBeenCalledTimes(2)
-    expect(vi.getTimerCount()).toBe(0)
-  } finally {
-    vi.restoreAllMocks()
-    vi.useRealTimers()
-  }
-})
-
 it.each([false, true])(
   'fences migration finishing after stop (already swapped: %s)',
   async (alreadySwapped) => {
     vi.useFakeTimers()
     try {
       const recordedMigration = vi.spyOn(MobileEndpointHysteresis.prototype, 'recordMigration')
-      const relay = new FakeSession('connected')
-      const logical = createStableLogicalRpcClient(relay, 'relay')
+      const relaySession = new FakeSession('connected')
+      const logical = createStableLogicalRpcClient(relaySession, 'relay')
       const candidates: FakeSession[] = []
       const deps = dependencies({
         openDirect: vi.fn(() => {
@@ -135,7 +96,7 @@ it.each([false, true])(
           return candidate
         })
       })
-      const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+      const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
       const migrate = logical.migrateTo.bind(logical)
       let release!: () => void
       const pending = new Promise<void>((resolve) => {
@@ -153,7 +114,7 @@ it.each([false, true])(
       await supervisor.start()
       await vi.advanceTimersByTimeAsync(60_000)
       expect(migration).toHaveBeenCalledOnce()
-      const requestsBeforeStop = relay.sendRequest.mock.calls.length
+      const requestsBeforeStop = relaySession.sendRequest.mock.calls.length
       const candidateRequestsBeforeStop = candidates[3].sendRequest.mock.calls.length
       const migrationsBeforeStop = recordedMigration.mock.calls.length
       supervisor.stop()
@@ -161,7 +122,7 @@ it.each([false, true])(
       await vi.advanceTimersByTimeAsync(0)
       expect(logical.getActivePath()).toBe(alreadySwapped ? 'lan' : 'relay')
       expect(logical.getGeneration()).toBe(alreadySwapped ? 2 : 1)
-      expect(relay.sendRequest).toHaveBeenCalledTimes(requestsBeforeStop)
+      expect(relaySession.sendRequest).toHaveBeenCalledTimes(requestsBeforeStop)
       expect(candidates[3].sendRequest).toHaveBeenCalledTimes(candidateRequestsBeforeStop)
       expect(recordedMigration).toHaveBeenCalledTimes(migrationsBeforeStop)
       expect(candidates[3].close).toHaveBeenCalledTimes(alreadySwapped ? 0 : 1)
diff --git a/mobile/src/transport/mobile-direct-return-probe.ts b/mobile/src/transport/mobile-direct-return-probe.ts
index c3b3464a3ba..3552805f7ee 100644
--- a/mobile/src/transport/mobile-direct-return-probe.ts
+++ b/mobile/src/transport/mobile-direct-return-probe.ts
@@ -2,7 +2,6 @@ import { openAuthenticatedDirectEndpoint } from './mobile-direct-endpoint-probe'
 import type { MobileEndpointHysteresis } from './mobile-endpoint-hysteresis'
 import type { RpcClient } from './rpc-client'
 import type { ScheduleTimer } from './timer-scheduler'
-import type { HostProfile } from './types'
 import type { MobileConnectionPath } from './stable-logical-rpc-client'
 
 const DIRECT_PROBE_INTERVAL_MS = 15_000
@@ -20,11 +19,11 @@ export class DirectReturnProbe {
       now: () => number
       setTimer: ScheduleTimer
       clearTimer: typeof clearTimeout
-      openDirect: (endpoint: string) => RpcClient
+      openDirect: () => RpcClient
+      directPath: Exclude<MobileConnectionPath, 'relay'>
     },
     private readonly hooks: {
       hysteresis: MobileEndpointHysteresis
-      host: () => HostProfile
       canSchedule: () => boolean
       canAttempt: () => boolean
       beginOperation: () => void
@@ -75,7 +74,6 @@ export class DirectReturnProbe {
     let successful: Awaited<ReturnType<typeof openAuthenticatedDirectEndpoint>> = null
     try {
       successful = await openAuthenticatedDirectEndpoint(
-        this.hooks.host(),
         this.deps.openDirect,
         12_000,
         controller.signal
@@ -88,14 +86,14 @@ export class DirectReturnProbe {
         return
       }
       if (!this.hooks.hysteresis.recordDirectSuccess(this.deps.now())) {
-        successful.client.close()
+        successful.close()
         return
       }
       const candidate = successful
       // Migration owns the candidate, including closing it if cutover is canceled.
       successful = null
       try {
-        await this.hooks.migrate(candidate.client, candidate.path, () => this.stopped)
+        await this.hooks.migrate(candidate, this.deps.directPath, () => this.stopped)
       } catch (error) {
         if (this.stopped) {
           return
@@ -109,7 +107,7 @@ export class DirectReturnProbe {
       await this.hooks.onDirectMigrated()
     } finally {
       this.activeProbe = null
-      successful?.client.close()
+      successful?.close()
       // Why: a relay drop or backoff timer can arrive while the probe owns the
       // operation mutex; afterProbe releases it and replays deferred recovery.
       this.hooks.afterProbe()
diff --git a/mobile/src/transport/mobile-endpoint-lifecycle-host-edit.test.ts b/mobile/src/transport/mobile-endpoint-lifecycle-host-edit.test.ts
new file mode 100644
index 00000000000..b676e979188
--- /dev/null
+++ b/mobile/src/transport/mobile-endpoint-lifecycle-host-edit.test.ts
@@ -0,0 +1,244 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
+
+const storage = vi.hoisted(() => new Map<string, string>())
+const asyncStorageMock = vi.hoisted(() => ({
+  getItem: vi.fn(async (key: string) => storage.get(key) ?? null),
+  setItem: vi.fn(async (key: string, value: string) => {
+    storage.set(key, value)
+  }),
+  removeItem: vi.fn(async (key: string) => {
+    storage.delete(key)
+  })
+}))
+const secureStoreMock = vi.hoisted(() => ({
+  WHEN_UNLOCKED_THIS_DEVICE_ONLY: 'WHEN_UNLOCKED_THIS_DEVICE_ONLY',
+  getItemAsync: vi.fn(async () => 'device-token'),
+  setItemAsync: vi.fn(async () => {}),
+  deleteItemAsync: vi.fn(async () => {})
+}))
+const connectMock = vi.hoisted(() => vi.fn())
+const openRelayMock = vi.hoisted(() => vi.fn())
+const resolveRelayMock = vi.hoisted(() => vi.fn())
+const readBundleMock = vi.hoisted(() => vi.fn())
+const writeBundleMock = vi.hoisted(() => vi.fn(async (..._args: unknown[]) => {}))
+
+vi.mock('@react-native-async-storage/async-storage', () => ({ default: asyncStorageMock }))
+vi.mock('react-native', () => ({ Platform: { OS: 'ios' } }))
+vi.mock('expo-crypto', () => ({ getRandomBytes: (length: number) => new Uint8Array(length) }))
+vi.mock('expo-secure-store', () => secureStoreMock)
+vi.mock('./rpc-client', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('./rpc-client')>()),
+  connect: (...args: unknown[]) => connectMock(...args)
+}))
+vi.mock('./mobile-relay-rpc-session', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('./mobile-relay-rpc-session')>()),
+  connectMobileRelayRpcSession: (...args: unknown[]) => openRelayMock(...args)
+}))
+vi.mock('./mobile-relay-resume-director', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('./mobile-relay-resume-director')>()),
+  resolveMobileRelayEndpoint: (...args: unknown[]) => resolveRelayMock(...args)
+}))
+vi.mock('./mobile-relay-credential-bundle', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('./mobile-relay-credential-bundle')>()),
+  readMobileRelayCredentialBundle: (...args: unknown[]) => readBundleMock(...args),
+  writeMobileRelayCredentialBundle: (...args: unknown[]) => writeBundleMock(...args)
+}))
+
+import { loadHosts, resetHostStoreForTests, updateHostNameAndEndpoint } from './host-store'
+import { startMobileEndpointLifecycle } from './mobile-endpoint-lifecycle'
+import {
+  bundle,
+  FakeLogicalClient,
+  FakeRelaySession,
+  FakeSession,
+  host,
+  mockCredentialRotation,
+  relay
+} from './mobile-endpoint-supervisor-test-fakes'
+import { RelayOuterError } from './mobile-relay-e2ee-link'
+import { resetMobileRelayHostOverlayStoreForTests } from './mobile-relay-host-overlay-store'
+import { createMobileRelayDirectUpgradeJournal } from './mobile-relay-direct-upgrade-journal'
+import { upgradeDirectMobileRelay } from './mobile-relay-direct-upgrade'
+
+const OVERLAY_KEY = 'orca:mobile-relay:host-overlays:v2'
+const EDITED_ENDPOINT = 'ws://192.168.1.20:6768'
+const resolved = { ...relay, cellUrl: 'https://relay-c2.onorca.dev', assignmentEpoch: 8 }
+
+// Starts a relay host whose first dial hits the wrong cell, leaving director resolution pending.
+async function startWithPendingResolution(): Promise<{
+  logical: FakeLogicalClient
+  lifecycle: ReturnType<typeof startMobileEndpointLifecycle>
+  settle: (value: MobileRelayEndpoint) => void
+}> {
+  let settle: (value: MobileRelayEndpoint) => void = () => {}
+  resolveRelayMock.mockReturnValue(
+    new Promise<MobileRelayEndpoint>((resolve) => {
+      settle = resolve
+    })
+  )
+  openRelayMock
+    .mockReturnValueOnce(new FakeRelaySession('disconnected', new RelayOuterError(4409)))
+    .mockReturnValue(new FakeRelaySession('connected'))
+  const logical = new FakeLogicalClient('disconnected', 'lan')
+  const lifecycle = startMobileEndpointLifecycle(logical, host, () => {})
+  await vi.waitFor(() => expect(resolveRelayMock).toHaveBeenCalledOnce())
+  return { logical, lifecycle, settle: (value) => settle(value) }
+}
+
+function overlayWrites(): number {
+  return asyncStorageMock.setItem.mock.calls.filter(([key]) => key === OVERLAY_KEY).length
+}
+
+async function expectEditKept(expectedRelay: MobileRelayEndpoint): Promise<void> {
+  const [saved] = await loadHosts()
+  expect(saved).toMatchObject({
+    name: 'Renamed',
+    endpoint: EDITED_ENDPOINT,
+    deviceToken: 'device-token',
+    relay: expectedRelay
+  })
+  expect(secureStoreMock.setItemAsync).not.toHaveBeenCalled()
+}
+
+describe('mobile endpoint lifecycle host edits', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    storage.clear()
+    resetHostStoreForTests()
+    resetMobileRelayHostOverlayStoreForTests()
+    const { id, name, endpoint, publicKeyB64, lastConnected } = host
+    storage.set('orca:hosts', JSON.stringify([{ id, name, endpoint, publicKeyB64, lastConnected }]))
+    storage.set(
+      OVERLAY_KEY,
+      JSON.stringify([
+        {
+          v: 2,
+          hostId: id,
+          endpoints: [
+            { id: 'direct-primary', kind: 'lan', url: endpoint },
+            { id: 'relay-primary', kind: 'relay', url: 'wss://relay-c1.onorca.dev/v1/connect/id' }
+          ],
+          relayHostId: relay.relayHostId,
+          relay
+        }
+      ])
+    )
+    connectMock.mockImplementation(() => new FakeSession('disconnected'))
+    readBundleMock.mockResolvedValue(bundle)
+  })
+
+  it('keeps an edit made while relay resolution was pending', async () => {
+    const { lifecycle, settle } = await startWithPendingResolution()
+
+    await updateHostNameAndEndpoint(host.id, { personalName: 'Renamed', endpoint: EDITED_ENDPOINT })
+    settle(resolved)
+    await vi.waitFor(() => expect(openRelayMock).toHaveBeenCalledTimes(2))
+
+    await expectEditKept(resolved)
+    lifecycle.stop()
+  })
+
+  it('does not persist a resolution that settles after stop', async () => {
+    const { logical, lifecycle, settle } = await startWithPendingResolution()
+    await updateHostNameAndEndpoint(host.id, { personalName: 'Renamed', endpoint: EDITED_ENDPOINT })
+    const writesBeforeSettle = asyncStorageMock.setItem.mock.calls.length
+
+    lifecycle.stop()
+    const recoveryPathCalls = logical.setRecoveryPath.mock.calls.length
+    settle(resolved)
+    // The withdrawn dial clears the recovery path only after any persistence has run.
+    await vi.waitFor(() =>
+      expect(logical.setRecoveryPath).toHaveBeenCalledTimes(recoveryPathCalls + 1)
+    )
+
+    expect(asyncStorageMock.setItem).toHaveBeenCalledTimes(writesBeforeSettle)
+    await expectEditKept(relay)
+    expect(openRelayMock).toHaveBeenCalledOnce()
+  })
+
+  it('keeps an edit made before a credential rotation publishes its relay', async () => {
+    readBundleMock.mockResolvedValue({
+      ...bundle,
+      current: { ...bundle.current, expiresAt: Date.now() + 60_000 }
+    })
+    const logical = new FakeLogicalClient('connected', 'lan')
+    mockCredentialRotation(logical)
+    const lifecycle = startMobileEndpointLifecycle(logical, host, () => {})
+    await updateHostNameAndEndpoint(host.id, { personalName: 'Renamed', endpoint: EDITED_ENDPOINT })
+
+    logical.publishState('connected')
+    await vi.waitFor(() => expect(overlayWrites()).toBe(1))
+
+    await expectEditKept(relay)
+    lifecycle.stop()
+  })
+
+  it('does not persist relay routing from a rotation that finishes after stop', async () => {
+    readBundleMock.mockResolvedValue({
+      ...bundle,
+      current: { ...bundle.current, expiresAt: Date.now() + 60_000 }
+    })
+    let finishCredentialWrite: () => void = () => {}
+    writeBundleMock.mockResolvedValueOnce().mockReturnValueOnce(
+      new Promise<void>((resolve) => {
+        finishCredentialWrite = resolve
+      })
+    )
+    const logical = new FakeLogicalClient('connected', 'lan')
+    mockCredentialRotation(logical)
+    const lifecycle = startMobileEndpointLifecycle(logical, host, () => {})
+    await updateHostNameAndEndpoint(host.id, { personalName: 'Renamed', endpoint: EDITED_ENDPOINT })
+
+    logical.publishState('connected')
+    await vi.waitFor(() => expect(writeBundleMock).toHaveBeenCalledTimes(2))
+    lifecycle.stop()
+    finishCredentialWrite()
+    await new Promise((resolve) => setTimeout(resolve, 0))
+
+    // The rotated bundle itself stays durable; only the stale relay routing write is skipped.
+    expect(writeBundleMock).toHaveBeenCalledTimes(2)
+    expect(overlayWrites()).toBe(0)
+    await expectEditKept(relay)
+  })
+
+  it('keeps an edit made while a direct-only host was being upgraded to relay', async () => {
+    storage.set(OVERLAY_KEY, '[]')
+    const { relay: _relay, ...directHost } = host
+    const journal = createMobileRelayDirectUpgradeJournal(host.id, (length) =>
+      new Uint8Array(length).fill(3)
+    )
+    const installed = {
+      v: 1,
+      reqId: journal.reqId,
+      authorizationMode: 'authenticated-direct',
+      currentVersion: 1,
+      resumeExpiresAt: 9_999_999
+    }
+    const client = new FakeSession('connected')
+    client.sendRequest.mockResolvedValue({
+      id: 'rpc',
+      ok: true,
+      result: {
+        v: 1,
+        relay,
+        installStatus: { v: 1, reqId: journal.reqId, state: 'committed', result: installed }
+      },
+      _meta: { runtimeId: 'runtime-1' }
+    })
+    await updateHostNameAndEndpoint(host.id, { personalName: 'Renamed', endpoint: EDITED_ENDPOINT })
+
+    // `directHost` is the controller's pre-edit snapshot; only the default routing writer runs.
+    await upgradeDirectMobileRelay({
+      client,
+      host: directHost,
+      dependencies: {
+        readJournal: async () => journal,
+        clearJournal: async () => {},
+        writeBundle: async () => {}
+      }
+    })
+
+    await expectEditKept(relay)
+  })
+})
diff --git a/mobile/src/transport/mobile-endpoint-lifecycle.ts b/mobile/src/transport/mobile-endpoint-lifecycle.ts
index b7cab59c49a..3f727d4e731 100644
--- a/mobile/src/transport/mobile-endpoint-lifecycle.ts
+++ b/mobile/src/transport/mobile-endpoint-lifecycle.ts
@@ -1,5 +1,6 @@
 import * as ExpoCrypto from 'expo-crypto'
 import type { ConnectionLogSink, ForegroundNudgeReason, HostProfile } from './types'
+import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
 import { connect } from './rpc-client'
 import { MobileEndpointSupervisor } from './mobile-endpoint-supervisor'
 import { connectMobileRelayRpcSession } from './mobile-relay-rpc-session'
@@ -8,8 +9,9 @@ import {
   readMobileRelayCredentialBundle,
   writeMobileRelayCredentialBundle
 } from './mobile-relay-credential-bundle'
-import { saveHost } from './host-store'
+import { setRelayRouting } from './host-store'
 import { upgradeDirectMobileRelay } from './mobile-relay-direct-upgrade'
+import { directPathForEndpoint } from './mobile-direct-endpoint-probe'
 import { MobileRelayDirectUpgradeController } from './mobile-relay-direct-upgrade-controller'
 import { defaultCancelTimer, defaultScheduleTimer } from './timer-scheduler'
 import type { StableLogicalRpcClient } from './stable-logical-rpc-client'
@@ -33,11 +35,11 @@ export function startMobileEndpointLifecycle(
   let foreground = true
   let owner: EndpointOwner
 
-  const startSupervisor = async (host: HostProfile): Promise<void> => {
+  const startSupervisor = async (relay: MobileRelayEndpoint): Promise<void> => {
     if (stopped) {
       return
     }
-    const supervisor = createSupervisor(logical, host, onLog)
+    const supervisor = createSupervisor(logical, initialHost, relay, onLog)
     owner.stop()
     owner = supervisor
     supervisor.setForeground(foreground)
@@ -45,7 +47,7 @@ export function startMobileEndpointLifecycle(
   }
 
   if (initialHost.relay) {
-    owner = createSupervisor(logical, initialHost, onLog)
+    owner = createSupervisor(logical, initialHost, initialHost.relay, onLog)
     void owner.start()
   } else {
     owner = new MobileRelayDirectUpgradeController(logical, initialHost, {
@@ -55,7 +57,7 @@ export function startMobileEndpointLifecycle(
           host,
           dependencies: { randomBytes: ExpoCrypto.getRandomBytes }
         }),
-      onUpgraded: ({ host }) => startSupervisor(host)
+      onUpgraded: ({ relay }) => startSupervisor(relay)
     })
     void owner.start()
   }
@@ -83,10 +85,12 @@ export function startMobileEndpointLifecycle(
 function createSupervisor(
   logical: StableLogicalRpcClient,
   host: HostProfile,
+  relay: MobileRelayEndpoint,
   onLog: ConnectionLogSink
 ): MobileEndpointSupervisor {
-  return new MobileEndpointSupervisor(logical, host, {
-    openDirect: (endpoint) => connect(endpoint, host.deviceToken, host.publicKeyB64, { onLog }),
+  return new MobileEndpointSupervisor(logical, host.id, relay, {
+    openDirect: () => connect(host.endpoint, host.deviceToken, host.publicKeyB64, { onLog }),
+    directPath: directPathForEndpoint(host.endpoint),
     openRelay: (relay, credential, confirmReqId, onHostCloseReason) =>
       connectMobileRelayRpcSession({
         relay,
@@ -101,7 +105,7 @@ function createSupervisor(
     resolveRelay: resolveMobileRelayEndpoint,
     readBundle: readMobileRelayCredentialBundle,
     writeBundle: writeMobileRelayCredentialBundle,
-    saveHost,
+    setRelayRouting,
     onLog,
     now: Date.now,
     randomBytes: ExpoCrypto.getRandomBytes,
diff --git a/mobile/src/transport/mobile-endpoint-supervisor-contract.ts b/mobile/src/transport/mobile-endpoint-supervisor-contract.ts
index 247c2ec051e..81620c54ece 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor-contract.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor-contract.ts
@@ -4,11 +4,13 @@ import type { MobileRelayCredentialBundle } from './mobile-relay-credential-bund
 import type { MobileRelayRpcSession } from './mobile-relay-rpc-session'
 import type { resolveMobileRelayEndpoint } from './mobile-relay-resume-director'
 import type { RpcClient } from './rpc-client'
+import type { MobileConnectionPath } from './stable-logical-rpc-client'
 import type { ScheduleTimer } from './timer-scheduler'
-import type { ConnectionLogSink, HostProfile } from './types'
+import type { ConnectionLogSink } from './types'
 
 export type MobileEndpointSupervisorDependencies = {
-  openDirect: (endpoint: string) => RpcClient
+  openDirect: () => RpcClient
+  directPath: Exclude<MobileConnectionPath, 'relay'>
   openRelay: (
     relay: MobileRelayEndpoint,
     credential: { token: string; version: number },
@@ -18,7 +20,7 @@ export type MobileEndpointSupervisorDependencies = {
   resolveRelay: typeof resolveMobileRelayEndpoint
   readBundle: (hostId: string) => Promise<MobileRelayCredentialBundle | null>
   writeBundle: (bundle: MobileRelayCredentialBundle) => Promise<void>
-  saveHost: (host: HostProfile) => Promise<void>
+  setRelayRouting: (hostId: string, relay: MobileRelayEndpoint) => Promise<void>
   now: () => number
   randomBytes: (length: number) => Uint8Array
   setTimer: ScheduleTimer
diff --git a/mobile/src/transport/mobile-endpoint-supervisor-direct-probe.test.ts b/mobile/src/transport/mobile-endpoint-supervisor-direct-probe.test.ts
index 3ee52fc7ddf..d0ca76d0dcc 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor-direct-probe.test.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor-direct-probe.test.ts
@@ -5,7 +5,8 @@ import {
   FakeLogicalClient,
   FakeRelaySession,
   FakeSession,
-  host
+  host,
+  relay
 } from './mobile-endpoint-supervisor-test-fakes'
 
 vi.mock('react-native', () => ({ Platform: { OS: 'ios' } }))
@@ -27,7 +28,7 @@ describe('mobile endpoint supervisor direct probe', () => {
     const direct = new FakeSession('connecting')
     const openRelay = vi.fn(() => new FakeRelaySession('connected'))
     const deps = dependencies({ openDirect: vi.fn(() => direct), openRelay })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     // Foreground return: the probe dials direct at once, the dead LAN answers with
diff --git a/mobile/src/transport/mobile-endpoint-supervisor-nudge.test.ts b/mobile/src/transport/mobile-endpoint-supervisor-nudge.test.ts
index 9db4ea3b9f7..86ea50e5c45 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor-nudge.test.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor-nudge.test.ts
@@ -6,7 +6,8 @@ import {
   FakeLogicalClient,
   FakeRelaySession,
   FakeSession,
-  host
+  host,
+  relay
 } from './mobile-endpoint-supervisor-test-fakes'
 import { MobileEndpointSupervisor } from './mobile-endpoint-supervisor'
 import { MobileRelaySessionEstablisher } from './mobile-relay-session-establisher'
@@ -33,7 +34,7 @@ describe('mobile endpoint supervisor nudges', () => {
     const deps = dependencies({
       openDirect: vi.fn(() => new FakeSession('disconnected'))
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     expect(deps.openRelay).toHaveBeenCalledOnce()
@@ -62,7 +63,7 @@ describe('mobile endpoint supervisor nudges', () => {
       // Deterministic full jitter: fraction 0.5 → half the backoff window.
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     expect(openRelay).toHaveBeenCalledOnce()
@@ -100,7 +101,7 @@ describe('mobile endpoint supervisor nudges', () => {
       openDirect: vi.fn(() => new FakeSession('disconnected')),
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(0)
@@ -119,7 +120,7 @@ describe('mobile endpoint supervisor nudges', () => {
   it('leaves physical relay probing to the session watchdog', async () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     supervisor.nudge('focus')
@@ -138,7 +139,7 @@ describe('mobile endpoint supervisor nudges', () => {
   it('does not suspend a relay from one focus RPC failure', async () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     supervisor.nudge('focus')
@@ -164,7 +165,7 @@ describe('mobile endpoint supervisor nudges', () => {
             })
         )
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
     expect(deps.openRelay).toHaveBeenCalledOnce()
 
@@ -195,7 +196,7 @@ describe('mobile endpoint supervisor nudges', () => {
       readBundle: vi.fn(async () => expired),
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     supervisor.nudge('network-change')
@@ -221,9 +222,11 @@ describe('mobile endpoint supervisor nudges', () => {
       writeBundle: vi.fn(async () => {}),
       isActive: () => true,
       isForeground: () => true,
-      relay: () => host.relay,
+      isStopped: () => false,
+      hostId: host.id,
+      relay,
       resolveRelay: vi.fn(async ({ relay: endpoint }) => endpoint),
-      persistResolvedRelay: vi.fn(async () => {}),
+      setRelayRouting: vi.fn(async () => {}),
       bundle: () => bundle,
       adoptBundle: vi.fn(),
       recordMigration: vi.fn(),
@@ -260,9 +263,11 @@ describe('mobile endpoint supervisor nudges', () => {
       writeBundle: vi.fn(async () => {}),
       isActive: () => active,
       isForeground: () => active,
-      relay: () => host.relay,
+      isStopped: () => false,
+      hostId: host.id,
+      relay,
       resolveRelay: vi.fn(async ({ relay: endpoint }) => endpoint),
-      persistResolvedRelay: vi.fn(async () => {}),
+      setRelayRouting: vi.fn(async () => {}),
       bundle: () => bundle,
       adoptBundle: vi.fn(),
       recordMigration: vi.fn(),
diff --git a/mobile/src/transport/mobile-endpoint-supervisor-stalled-cell.test.ts b/mobile/src/transport/mobile-endpoint-supervisor-stalled-cell.test.ts
index be4050cee5b..b0d567ace28 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor-stalled-cell.test.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor-stalled-cell.test.ts
@@ -43,7 +43,8 @@ describe('relay dial against a cell that took the dial and stalled', () => {
     const onLog = vi.fn()
     const supervisor = new MobileEndpointSupervisor(
       logical,
-      host,
+      host.id,
+      relay,
       dependencies({ openRelay, resolveRelay, onLog })
     )
 
@@ -67,7 +68,8 @@ describe('relay dial against a cell that took the dial and stalled', () => {
     const resolveRelay = vi.fn(async () => relay)
     const supervisor = new MobileEndpointSupervisor(
       logical,
-      host,
+      host.id,
+      relay,
       dependencies({ openRelay, resolveRelay })
     )
 
diff --git a/mobile/src/transport/mobile-endpoint-supervisor-support.ts b/mobile/src/transport/mobile-endpoint-supervisor-support.ts
index 1a2c00f12de..e4294f56fcd 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor-support.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor-support.ts
@@ -3,7 +3,6 @@ import { MobileE2EEAuthenticationError } from './mobile-e2ee-v2-physical-channel
 import { ReplacementAuthenticationTimeoutError } from './replacement-session-authentication'
 import type { RelayReconnectController } from './mobile-relay-reconnect-controller'
 import type { StableLogicalRpcClient } from './stable-logical-rpc-client'
-import type { HostProfile } from './types'
 import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
 
 // Why: a suspect session that survived a failed replacement dial must come down,
@@ -41,10 +40,10 @@ export class RelayDialAbortedError extends Error {
 // cell assignment, persist it durably, then dial once more.
 export async function dialRelayThroughDirectorFallback(args: {
   resumeToken: string
-  relay: () => HostProfile['relay']
+  relay: () => MobileRelayEndpoint
   dial: () => Promise<RelayDialResult>
   resolveRelay: (input: {
-    relay: NonNullable<HostProfile['relay']>
+    relay: MobileRelayEndpoint
     resumeToken: string
   }) => Promise<MobileRelayEndpoint>
   persistResolvedRelay: (resolved: MobileRelayEndpoint) => Promise<void>
@@ -54,8 +53,7 @@ export async function dialRelayThroughDirectorFallback(args: {
   if (
     first.ok ||
     first.error instanceof RelayDialAbortedError ||
-    !isDirectorResolutionFailure(first.error) ||
-    !relay
+    !isDirectorResolutionFailure(first.error)
   ) {
     return first
   }
@@ -80,27 +78,6 @@ export function isDirectorResolutionFailure(error: Error): boolean {
   )
 }
 
-export function relayWebSocketUrl(relay: { cellUrl: string; relayHostId: string }): string {
-  const url = new URL(relay.cellUrl)
-  url.protocol = 'wss:'
-  url.pathname = `/v1/connect/${encodeURIComponent(relay.relayHostId)}`
-  return url.toString()
-}
-
-export async function persistRelayHost(
-  host: HostProfile,
-  relay: MobileRelayEndpoint,
-  saveHost: (host: HostProfile) => Promise<void>
-): Promise<HostProfile> {
-  const endpoints = [
-    ...(host.endpoints ?? [{ id: 'direct-primary', kind: 'lan' as const, url: host.endpoint }])
-  ].filter(({ kind }) => kind !== 'relay')
-  endpoints.push({ id: 'relay-primary', kind: 'relay', url: relayWebSocketUrl(relay) })
-  const updated = { ...host, endpoints, relayHostId: relay.relayHostId, relay }
-  await saveHost(updated)
-  return updated
-}
-
 export function encodeBase64Url(value: Uint8Array): string {
   let binary = ''
   for (const byte of value) {
diff --git a/mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts b/mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts
index 3507127b2a8..70bf1f3aae2 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts
@@ -187,11 +187,6 @@ export const host: HostProfile = {
   deviceToken: 'device-token',
   publicKeyB64: 'A'.repeat(44),
   lastConnected: 1,
-  endpoints: [
-    { id: 'direct-primary', kind: 'lan', url: 'ws://192.168.1.10:6768' },
-    { id: 'relay-primary', kind: 'relay', url: 'wss://relay-c1.onorca.dev/v1/connect/id' }
-  ],
-  relayHostId: relay.relayHostId,
   relay
 }
 export const bundle: MobileRelayCredentialBundle = {
@@ -215,7 +210,8 @@ export function dependencies(
     resolveRelay: vi.fn(async ({ relay }) => relay),
     readBundle: vi.fn(async () => bundle),
     writeBundle: vi.fn(async () => {}),
-    saveHost: vi.fn(async () => {}),
+    setRelayRouting: vi.fn(async () => {}),
+    directPath: 'lan',
     now: Date.now,
     randomBytes: (length) => new Uint8Array(length).fill(1),
     setTimer: defaultScheduleTimer,
diff --git a/mobile/src/transport/mobile-endpoint-supervisor.test.ts b/mobile/src/transport/mobile-endpoint-supervisor.test.ts
index 10ef892a479..367a7867a34 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor.test.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor.test.ts
@@ -31,7 +31,7 @@ describe('mobile endpoint supervisor', () => {
   it('fails over to a confirmed relay session and persists its renewed expiry', async () => {
     const logical = new FakeLogicalClient('disconnected', 'lan')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
 
@@ -51,7 +51,7 @@ describe('mobile endpoint supervisor', () => {
   it('fails over when the direct retry loop publishes reconnecting', async () => {
     const logical = new FakeLogicalClient('connecting', 'lan')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     logical.publishState('handshaking')
@@ -77,7 +77,7 @@ describe('mobile endpoint supervisor', () => {
   it('fails over when direct is already reconnecting before startup completes', async () => {
     const logical = new FakeLogicalClient('reconnecting', 'lan')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
 
@@ -102,7 +102,7 @@ describe('mobile endpoint supervisor', () => {
       .mockResolvedValueOnce(null)
       .mockReturnValueOnce(credentialReadPending)
     const deps = dependencies({ readBundle })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     const starting = supervisor.start()
     await vi.waitFor(() => expect(readBundle).toHaveBeenCalledTimes(2))
@@ -120,7 +120,7 @@ describe('mobile endpoint supervisor', () => {
     const logical = new FakeLogicalClient('reconnecting', 'lan')
     const expired = { ...bundle, current: { ...bundle.current, expiresAt: Date.now() - 1 } }
     const deps = dependencies({ readBundle: vi.fn(async () => expired) })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
 
@@ -136,7 +136,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay: vi.fn(() => new FakeRelaySession('disconnected', new RelayOuterError(4408))),
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
 
@@ -155,7 +155,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     expect(openRelay).toHaveBeenCalledOnce()
@@ -180,7 +180,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       resolveRelay: vi.fn(async () => resolved)
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
 
@@ -191,16 +191,14 @@ describe('mobile endpoint supervisor', () => {
       expect.any(String),
       expect.any(Function)
     )
-    expect(deps.saveHost).toHaveBeenCalledWith(
-      expect.objectContaining({ relay: resolved, endpoint: host.endpoint })
-    )
+    expect(deps.setRelayRouting).toHaveBeenCalledWith(host.id, resolved)
     supervisor.stop()
   })
 
   it('promotes direct only after repeated foreground authenticated probes and dwell', async () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     await vi.advanceTimersByTimeAsync(45_000)
@@ -219,7 +217,7 @@ describe('mobile endpoint supervisor', () => {
       openDirect: vi.fn(() => direct),
       openRelay
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     // Start the probe, then drop the active relay while the probe owns the
@@ -245,7 +243,7 @@ describe('mobile endpoint supervisor', () => {
       onLog,
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     logical.publishState('disconnected')
@@ -270,7 +268,7 @@ describe('mobile endpoint supervisor', () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const expired = { ...bundle, current: { ...bundle.current, expiresAt: Date.now() - 1 } }
     const deps = dependencies({ readBundle: vi.fn(async () => expired) })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     logical.publishState('disconnected')
@@ -289,7 +287,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     logical.publishState('disconnected')
@@ -321,7 +319,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
 
@@ -350,7 +348,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     expect(openRelay).toHaveBeenCalledTimes(2)
@@ -383,7 +381,7 @@ describe('mobile endpoint supervisor', () => {
       ),
       writeBundle
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     writeBundle.mockClear()
@@ -409,7 +407,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       resolveRelay
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
 
@@ -431,7 +429,7 @@ describe('mobile endpoint supervisor', () => {
         throw new Error('secure store unavailable')
       })
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     expect(openRelay).toHaveBeenCalledOnce()
@@ -447,7 +445,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay: vi.fn(() => new FakeRelaySession('disconnected', new RelayOuterError(4408))),
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     expect(vi.getTimerCount()).toBe(1)
@@ -472,7 +470,7 @@ describe('mobile endpoint supervisor', () => {
       writeBundle: vi.fn(() => writePending),
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     const starting = supervisor.start()
     await vi.waitFor(() => expect(deps.writeBundle).toHaveBeenCalledOnce())
@@ -493,7 +491,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
 
@@ -512,7 +510,7 @@ describe('mobile endpoint supervisor', () => {
     const logical = new FakeLogicalClient('disconnected', 'lan')
     const openRelay = vi.fn(() => new FakeRelaySession('disconnected', new RelayOuterError(4401)))
     const deps = dependencies({ openRelay })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     supervisor.setForeground(true)
@@ -544,7 +542,7 @@ describe('mobile endpoint supervisor', () => {
       .mockReturnValueOnce(credentialWritePending)
     mockCredentialRotation(logical)
     const deps = dependencies({ openRelay, writeBundle })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     logical.publishState('connected')
@@ -594,7 +592,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       writeBundle
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     logical.publishState('connected')
@@ -630,7 +628,7 @@ describe('mobile endpoint supervisor', () => {
       openDirect: vi.fn(() => new FakeSession('disconnected')),
       resolveRelay: vi.fn(() => resolvePending)
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     const starting = supervisor.start()
     await vi.waitFor(() => expect(deps.resolveRelay).toHaveBeenCalledOnce())
@@ -659,14 +657,14 @@ describe('mobile endpoint supervisor', () => {
       openDirect: vi.fn(() => new FakeSession('disconnected')),
       resolveRelay: vi.fn(() => resolvePending)
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(60_000)
     await vi.waitFor(() => expect(deps.resolveRelay).toHaveBeenCalledOnce())
     supervisor.setForeground(false)
     finishResolve?.(relay)
-    await vi.waitFor(() => expect(deps.saveHost).toHaveBeenCalledOnce())
+    await vi.waitFor(() => expect(deps.setRelayRouting).toHaveBeenCalledOnce())
     await vi.advanceTimersByTimeAsync(0)
 
     expect(openRelay).toHaveBeenCalledTimes(2)
@@ -685,7 +683,7 @@ describe('mobile endpoint supervisor', () => {
       finishWrite = resolve
     })
     const deps = dependencies({ writeBundle: vi.fn(() => writePending) })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     const starting = supervisor.start()
     await vi.waitFor(() => expect(deps.writeBundle).toHaveBeenCalledOnce())
@@ -706,7 +704,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       openDirect: vi.fn(() => new FakeSession('disconnected'))
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(60_000)
@@ -728,7 +726,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       openDirect: vi.fn(() => new FakeSession('disconnected'))
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     expect(openRelay).toHaveBeenCalledTimes(1)
@@ -752,7 +750,7 @@ describe('mobile endpoint supervisor', () => {
       openDirect: vi.fn(() => new FakeSession('disconnected')),
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(60_000)
@@ -778,7 +776,7 @@ describe('mobile endpoint supervisor', () => {
       openDirect: vi.fn(() => new FakeSession('disconnected')),
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(60_000)
@@ -807,7 +805,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(900)
@@ -828,7 +826,7 @@ describe('mobile endpoint supervisor', () => {
       openDirect: vi.fn(() => new FakeSession('disconnected')),
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     const afterStart = openRelay.mock.calls.length
@@ -844,7 +842,7 @@ describe('mobile endpoint supervisor', () => {
   it('races a relay dial when the direct dial stalls unauthenticated', async () => {
     const logical = new FakeLogicalClient('connecting', 'lan')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(2_499)
@@ -866,7 +864,7 @@ describe('mobile endpoint supervisor', () => {
   it('cancels the grace race when the direct dial authenticates first', async () => {
     const logical = new FakeLogicalClient('connecting', 'lan')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     logical.publishState('connected')
@@ -878,23 +876,10 @@ describe('mobile endpoint supervisor', () => {
     supervisor.stop()
   })
 
-  it('never races a relay dial against a desktop with no relay endpoint', async () => {
-    const logical = new FakeLogicalClient('connecting', 'lan')
-    const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, { ...host, relay: undefined }, deps)
-
-    await supervisor.start()
-    await vi.advanceTimersByTimeAsync(5_000)
-
-    expect(deps.openRelay).not.toHaveBeenCalled()
-    expect(vi.getTimerCount()).toBe(0)
-    supervisor.stop()
-  })
-
   it('drops the pending grace race when the phone backgrounds', async () => {
     const logical = new FakeLogicalClient('connecting', 'lan')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     supervisor.setForeground(false)
@@ -909,7 +894,7 @@ describe('mobile endpoint supervisor', () => {
     const logical = new FakeLogicalClient('connecting', 'lan')
     const openRelay = vi.fn(() => new FakeRelaySession('disconnected', new RelayOuterError(4408)))
     const deps = dependencies({ openRelay, randomBytes: () => new Uint8Array([128, 0]) })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(2_500)
diff --git a/mobile/src/transport/mobile-endpoint-supervisor.ts b/mobile/src/transport/mobile-endpoint-supervisor.ts
index 9ba12f35112..862a739fb12 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor.ts
@@ -5,7 +5,6 @@ import { RelayLeaseRotationTimer } from './mobile-relay-lease-rotation-timer'
 import { MobileEndpointHysteresis } from './mobile-endpoint-hysteresis'
 import {
   liveRelayLeaseExpiry,
-  persistRelayHost,
   suspendRelayIfStillConnected
 } from './mobile-endpoint-supervisor-support'
 import { selectDialableRelayCredentials } from './mobile-relay-credential-selection'
@@ -20,7 +19,8 @@ import { MobileRelayDirectGraceTimer } from './mobile-relay-direct-grace-timer'
 import { MobileRelaySessionEstablisher } from './mobile-relay-session-establisher'
 import * as recoveryPresentation from './mobile-relay-recovery-presentation'
 import type { StableLogicalRpcClient } from './stable-logical-rpc-client'
-import type { ForegroundNudgeReason, HostProfile } from './types'
+import type { ForegroundNudgeReason } from './types'
+import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
 import { MobileRelayBackgroundGrace } from './mobile-relay-background-grace'
 import {
   logRelayConnected,
@@ -54,7 +54,8 @@ export class MobileEndpointSupervisor {
 
   constructor(
     private readonly logical: StableLogicalRpcClient,
-    private host: HostProfile,
+    private readonly hostId: string,
+    relay: MobileRelayEndpoint,
     private readonly dependencies: MobileEndpointSupervisorDependencies
   ) {
     this.hysteresis = new MobileEndpointHysteresis(dependencies.now(), {
@@ -81,7 +82,7 @@ export class MobileEndpointSupervisor {
     })
     // Why: the race owns recovery exactly like a network-change replacement — its
     // failure must book the shared cooldown. recoverRelay's own guards already
-    // cover stopped/background/no-relay, so the timer needs no scope check.
+    // cover stopped/background, so the timer needs no scope check.
     this.directGrace = new MobileRelayDirectGraceTimer(dependencies, logical, () => {
       void this.recoverRelay(true, true)
     })
@@ -93,11 +94,11 @@ export class MobileEndpointSupervisor {
       writeBundle: dependencies.writeBundle,
       isActive: () => this.isActive(),
       isForeground: () => this.backgroundGrace.isForeground(),
-      relay: () => this.host.relay,
+      isStopped: () => this.stopped,
+      hostId,
+      relay,
       resolveRelay: dependencies.resolveRelay,
-      persistResolvedRelay: async (resolved) => {
-        this.host = await persistRelayHost(this.host, resolved, dependencies.saveHost)
-      },
+      setRelayRouting: dependencies.setRelayRouting,
       bundle: () => this.bundle,
       adoptBundle: (bundle) => (this.bundle = bundle),
       recordMigration: () => {
@@ -116,7 +117,6 @@ export class MobileEndpointSupervisor {
     })
     this.directProbe = new DirectReturnProbe(dependencies, {
       hysteresis: this.hysteresis,
-      host: () => this.host,
       canSchedule: () => this.isActive() && this.logical.getActivePath() === 'relay',
       canAttempt: () => this.isActive() && !this.operationInFlight,
       beginOperation: () => (this.operationInFlight = true),
@@ -148,8 +148,8 @@ export class MobileEndpointSupervisor {
   }
 
   async start(): Promise<void> {
-    this.bundle = await this.dependencies.readBundle(this.host.id).catch(() => null)
-    if (this.stopped || !this.host.relay) {
+    this.bundle = await this.dependencies.readBundle(this.hostId).catch(() => null)
+    if (this.stopped) {
       return
     }
     if (!this.bundle) {
@@ -211,7 +211,7 @@ export class MobileEndpointSupervisor {
   // shared cooldown and any session left stale-'connected' by a half-open socket
   // comes down; lease rotation clears it because armRetry owns its own retry.
   private async recoverRelay(forceReplacement = false, ownsRecovery = false): Promise<void> {
-    if (!this.isActive() || !this.host.relay) {
+    if (!this.isActive()) {
       return
     }
     if (this.operationInFlight) {
@@ -247,7 +247,7 @@ export class MobileEndpointSupervisor {
       const selection = await selectDialableRelayCredentials({
         bundle: this.bundle,
         controller: this.relayReconnect,
-        readBundle: () => this.dependencies.readBundle(this.host.id),
+        readBundle: () => this.dependencies.readBundle(this.hostId),
         onAdoptedFresherBundle: () => this.logRelay('adopted fresher durable credential bundle')
       })
       this.bundle = selection.bundle
@@ -325,7 +325,7 @@ export class MobileEndpointSupervisor {
       this.bundle = result.bundle
       // Why: a scheduled rotation can finish after the old credential enters the rejection gate.
       credentialRefreshed = true
-      this.host = await persistRelayHost(this.host, result.relay, this.dependencies.saveHost)
+      await this.sessionEstablisher.adoptRelay(result.relay)
     } catch {
       // Why: pending material remains durable; the next authenticated direct
       // opportunity must reconcile it before creating another install key.
diff --git a/mobile/src/transport/mobile-relay-background-lifecycle.test.ts b/mobile/src/transport/mobile-relay-background-lifecycle.test.ts
index 76bca72426d..53e44f383b8 100644
--- a/mobile/src/transport/mobile-relay-background-lifecycle.test.ts
+++ b/mobile/src/transport/mobile-relay-background-lifecycle.test.ts
@@ -4,7 +4,8 @@ import {
   FakeLogicalClient,
   FakeRelaySession,
   FakeSession,
-  host
+  host,
+  relay
 } from './mobile-endpoint-supervisor-test-fakes'
 import { MobileEndpointSupervisor } from './mobile-endpoint-supervisor'
 
@@ -23,7 +24,7 @@ describe('mobile Relay background lifecycle', () => {
   it('retains a relay session across a quick background and foreground', async () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     supervisor.setForeground(false)
@@ -43,7 +44,7 @@ describe('mobile Relay background lifecycle', () => {
   it('releases a retained relay after 30 seconds and recovers only on foreground', async () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     supervisor.setForeground(false)
@@ -64,7 +65,7 @@ describe('mobile Relay background lifecycle', () => {
   it('enforces an overdue grace on foreground when the background timer was suspended', async () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     supervisor.setForeground(false)
@@ -81,7 +82,7 @@ describe('mobile Relay background lifecycle', () => {
   it('recovers after a retained relay fails while backgrounded', async () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     supervisor.setForeground(false)
@@ -101,7 +102,7 @@ describe('mobile Relay background lifecycle', () => {
   it('does not retain or suspend a healthy direct session in the background', async () => {
     const logical = new FakeLogicalClient('connected', 'tailscale')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     supervisor.setForeground(false)
@@ -120,7 +121,7 @@ describe('mobile Relay background lifecycle', () => {
       openDirect: vi.fn(() => new FakeSession('disconnected')),
       openRelay
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     await vi.advanceTimersByTimeAsync(40_000)
@@ -147,7 +148,7 @@ describe('mobile Relay background lifecycle', () => {
       openRelay,
       writeBundle: vi.fn(() => writeStarted)
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     const starting = supervisor.start()
     await vi.waitFor(() => expect(deps.writeBundle).toHaveBeenCalledOnce())
 
diff --git a/mobile/src/transport/mobile-relay-connect-url.ts b/mobile/src/transport/mobile-relay-connect-url.ts
new file mode 100644
index 00000000000..5f83812764b
--- /dev/null
+++ b/mobile/src/transport/mobile-relay-connect-url.ts
@@ -0,0 +1,7 @@
+/** The relay's phone connect socket for `relayHostId`, on a cell or on the director. */
+export function relayConnectWebSocketUrl(baseUrl: string, relayHostId: string): string {
+  const url = new URL(baseUrl)
+  url.protocol = 'wss:'
+  url.pathname = `/v1/connect/${encodeURIComponent(relayHostId)}`
+  return url.toString()
+}
diff --git a/mobile/src/transport/mobile-relay-direct-upgrade-controller.test.ts b/mobile/src/transport/mobile-relay-direct-upgrade-controller.test.ts
index 28fb7c307f5..0d99c7d9429 100644
--- a/mobile/src/transport/mobile-relay-direct-upgrade-controller.test.ts
+++ b/mobile/src/transport/mobile-relay-direct-upgrade-controller.test.ts
@@ -14,17 +14,13 @@ const directHost: HostProfile = {
 }
 
 const upgraded = {
-  host: {
-    ...directHost,
+  relay: {
+    v: 1 as const,
+    directorUrl: 'https://relay-staging.onorca.dev',
+    cellUrl: 'https://c1.relay-staging.onorca.dev',
+    assignmentEpoch: 4,
     relayHostId: 'AbCdEf0123_-xyZ9',
-    relay: {
-      v: 1 as const,
-      directorUrl: 'https://relay-staging.onorca.dev',
-      cellUrl: 'https://c1.relay-staging.onorca.dev',
-      assignmentEpoch: 4,
-      relayHostId: 'AbCdEf0123_-xyZ9',
-      e2eeFraming: 2 as const
-    }
+    e2eeFraming: 2 as const
   },
   bundle: {
     v: 1 as const,
diff --git a/mobile/src/transport/mobile-relay-direct-upgrade.test.ts b/mobile/src/transport/mobile-relay-direct-upgrade.test.ts
index 13d020ec239..d76e887b299 100644
--- a/mobile/src/transport/mobile-relay-direct-upgrade.test.ts
+++ b/mobile/src/transport/mobile-relay-direct-upgrade.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it, vi } from 'vitest'
 import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
-import { MobileRelayUpgradeHostRemovedError } from './host-store'
+import { RelayRoutingHostRemovedError } from './host-store'
 import {
   createMobileRelayDirectUpgradeJournal,
   type MobileRelayDirectUpgradeJournal
@@ -64,7 +64,7 @@ function dependencies(journal: MobileRelayDirectUpgradeJournal | null = null) {
     }),
     writeBundle: vi.fn(async () => {}),
     deleteBundle: vi.fn(async () => {}),
-    saveHost: vi.fn(async () => {}),
+    setRelayRouting: vi.fn(async () => {}),
     randomBytes: (length: number) => new Uint8Array(length).fill(7)
   }
 }
@@ -113,8 +113,9 @@ describe('existing direct pairing relay upgrade', () => {
       reqId: journal!.reqId,
       newResumeTokenHash: journal!.pendingResumeTokenHash
     })
-    expect(deps.writeBundle).toHaveBeenCalledBefore(deps.saveHost)
-    expect(result?.host.relay).toEqual(relay)
+    expect(deps.writeBundle).toHaveBeenCalledBefore(deps.setRelayRouting)
+    expect(deps.setRelayRouting).toHaveBeenCalledWith(host.id, relay)
+    expect(result?.relay).toEqual(relay)
     expect(deps.clearJournal).toHaveBeenCalledWith(host.id)
   })
 
@@ -153,7 +154,7 @@ describe('existing direct pairing relay upgrade', () => {
     await expect(upgradeDirectMobileRelay({ client, host, dependencies: deps })).resolves.toBeNull()
     expect(deps.clearJournal).toHaveBeenCalledWith(host.id)
     expect(deps.writeBundle).not.toHaveBeenCalled()
-    expect(deps.saveHost).not.toHaveBeenCalled()
+    expect(deps.setRelayRouting).not.toHaveBeenCalled()
   })
 
   // Why 'forbidden': a desktop that predates pairing.getEndpoints has it on neither its mobile
@@ -176,7 +177,7 @@ describe('existing direct pairing relay upgrade', () => {
     await expect(upgradeDirectMobileRelay({ client, host, dependencies: deps })).resolves.toBeNull()
     expect(deps.clearJournal).toHaveBeenCalledWith(host.id)
     expect(deps.writeBundle).not.toHaveBeenCalled()
-    expect(deps.saveHost).not.toHaveBeenCalled()
+    expect(deps.setRelayRouting).not.toHaveBeenCalled()
   })
 
   it('retains the durable journal when relay registration is temporarily unavailable', async () => {
@@ -196,8 +197,8 @@ describe('existing direct pairing relay upgrade', () => {
     )
     const committed = installed(journal)
     const deps = dependencies(journal)
-    deps.saveHost.mockRejectedValue(
-      new MobileRelayUpgradeHostRemovedError('mobile relay upgrade host was removed')
+    deps.setRelayRouting.mockRejectedValue(
+      new RelayRoutingHostRemovedError('mobile relay upgrade host was removed')
     )
     const client = clientWith([
       success({
@@ -209,7 +210,7 @@ describe('existing direct pairing relay upgrade', () => {
 
     await expect(
       upgradeDirectMobileRelay({ client, host, dependencies: deps })
-    ).rejects.toBeInstanceOf(MobileRelayUpgradeHostRemovedError)
+    ).rejects.toBeInstanceOf(RelayRoutingHostRemovedError)
     expect(deps.deleteBundle).toHaveBeenCalledWith(host.id)
     expect(deps.clearJournal).toHaveBeenCalledWith(host.id)
   })
diff --git a/mobile/src/transport/mobile-relay-direct-upgrade.ts b/mobile/src/transport/mobile-relay-direct-upgrade.ts
index 221d5a5d6c1..30b2a76e681 100644
--- a/mobile/src/transport/mobile-relay-direct-upgrade.ts
+++ b/mobile/src/transport/mobile-relay-direct-upgrade.ts
@@ -1,10 +1,10 @@
 import * as ExpoCrypto from 'expo-crypto'
 import type {
   DeviceCredentialInstalled,
+  MobileRelayEndpoint,
   PairingGetEndpointsResult
 } from '../../../src/shared/mobile-relay-credential-contract'
-import { MobileRelayUpgradeHostRemovedError, saveExistingHostRelayUpgrade } from './host-store'
-import { persistRelayHost } from './mobile-endpoint-supervisor-support'
+import { RelayRoutingHostRemovedError, setRelayRouting } from './host-store'
 import {
   MobileRelayCredentialBundleSchema,
   deleteMobileRelayCredentialBundle,
@@ -27,7 +27,7 @@ import type { HostProfile } from './types'
 import { isPairingRelayRpcUnavailable } from './pairing-relay-rpc-unavailable'
 
 export type MobileRelayDirectUpgradeResult = {
-  host: HostProfile
+  relay: MobileRelayEndpoint
   bundle: MobileRelayCredentialBundle
 }
 
@@ -36,7 +36,7 @@ type Dependencies = {
   writeJournal: typeof writeMobileRelayDirectUpgradeJournal
   clearJournal: typeof deleteMobileRelayDirectUpgradeJournal
   writeBundle: typeof writeMobileRelayCredentialBundle
-  saveHost: typeof saveExistingHostRelayUpgrade
+  setRelayRouting: typeof setRelayRouting
   deleteBundle: typeof deleteMobileRelayCredentialBundle
   randomBytes: (length: number) => Uint8Array
 }
@@ -54,7 +54,7 @@ export async function upgradeDirectMobileRelay(args: {
     writeJournal: writeMobileRelayDirectUpgradeJournal,
     clearJournal: deleteMobileRelayDirectUpgradeJournal,
     writeBundle: writeMobileRelayCredentialBundle,
-    saveHost: saveExistingHostRelayUpgrade,
+    setRelayRouting,
     deleteBundle: deleteMobileRelayCredentialBundle,
     randomBytes: ExpoCrypto.getRandomBytes,
     ...args.dependencies
@@ -120,18 +120,17 @@ async function publishCommitted(
   })
   // Why: the overlay must never advertise relay without its matching credential.
   await dependencies.writeBundle(bundle)
-  let updatedHost: HostProfile
   try {
-    updatedHost = await persistRelayHost(host, endpoints.relay, dependencies.saveHost)
+    await dependencies.setRelayRouting(host.id, endpoints.relay)
   } catch (error) {
-    if (error instanceof MobileRelayUpgradeHostRemovedError) {
+    if (error instanceof RelayRoutingHostRemovedError) {
       await dependencies.deleteBundle(host.id)
       await dependencies.clearJournal(host.id)
     }
     throw error
   }
   await dependencies.clearJournal(host.id)
-  return { host: updatedHost, bundle }
+  return { relay: endpoints.relay, bundle }
 }
 
 async function getEndpoints(
diff --git a/mobile/src/transport/mobile-relay-e2ee-link.ts b/mobile/src/transport/mobile-relay-e2ee-link.ts
index 9b1f7a9a355..c2f24f71823 100644
--- a/mobile/src/transport/mobile-relay-e2ee-link.ts
+++ b/mobile/src/transport/mobile-relay-e2ee-link.ts
@@ -9,6 +9,7 @@ import {
 import { MobileE2EEV2ClientSession } from './mobile-e2ee-v2-client-session'
 import { MobileE2EEV2PhysicalChannel } from './mobile-e2ee-v2-physical-channel'
 import { websocketPayloadToUint8 } from './websocket-payload-bytes'
+import { relayConnectWebSocketUrl } from './mobile-relay-connect-url'
 
 // Native WebSockets normally emit close immediately after error; bound the
 // missing-close case so a dead socket cannot leave recovery pending forever.
@@ -54,7 +55,7 @@ export class MobileRelayE2eeLink {
   constructor(options: MobileRelayE2eeLinkOptions) {
     this.options = options
     this.socket = (options.createSocket ?? ((url) => new WebSocket(url)))(
-      relaySocketUrl(options.endpoint)
+      relayConnectWebSocketUrl(options.endpoint.cellUrl, options.endpoint.relayHostId)
     )
     const session = MobileE2EEV2ClientSession.create({
       desktopPublicKeyB64: options.desktopPublicKeyB64,
@@ -188,13 +189,6 @@ export class MobileRelayE2eeLink {
   }
 }
 
-function relaySocketUrl(endpoint: { cellUrl: string; relayHostId: string }): string {
-  const url = new URL(endpoint.cellUrl)
-  url.protocol = 'wss:'
-  url.pathname = `/v1/connect/${encodeURIComponent(endpoint.relayHostId)}`
-  return url.toString()
-}
-
 function asError(error: unknown): Error {
   return error instanceof Error ? error : new Error(String(error))
 }
diff --git a/mobile/src/transport/mobile-relay-host-overlay-store.test.ts b/mobile/src/transport/mobile-relay-host-overlay-store.test.ts
index 812d61ebb1d..d2053b7a515 100644
--- a/mobile/src/transport/mobile-relay-host-overlay-store.test.ts
+++ b/mobile/src/transport/mobile-relay-host-overlay-store.test.ts
@@ -1,4 +1,6 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { z } from 'zod'
+import { MobileRelayEndpointSchema } from '../../../src/shared/mobile-relay-credential-contract'
 
 const asyncStorage = vi.hoisted(() => ({
   getItem: vi.fn(),
@@ -8,35 +10,82 @@ const asyncStorage = vi.hoisted(() => ({
 vi.mock('@react-native-async-storage/async-storage', () => ({ default: asyncStorage }))
 
 import {
-  loadMobileRelayHostOverlays,
-  removeMobileRelayHostOverlays,
+  loadMobileRelayHostRoutingState,
+  removeMobileRelayHostRoutings,
   resetMobileRelayHostOverlayStoreForTests,
-  saveMobileRelayHostOverlay
+  saveMobileRelayHostRouting
 } from './mobile-relay-host-overlay-store'
 import type { MobileRelayHostOverlay } from './mobile-relay-host-overlay'
 
 const STORAGE_KEY = 'orca:mobile-relay:host-overlays:v2'
-const OVERLAY: MobileRelayHostOverlay = {
+const RELAY = {
+  v: 1 as const,
+  directorUrl: 'https://relay.onorca.dev',
+  cellUrl: 'https://relay-c1.onorca.dev',
+  assignmentEpoch: 7,
+  relayHostId: 'AbCdEf0123_-xyZ9',
+  e2eeFraming: 2 as const
+}
+const RELAY_ONLY_OVERLAY: MobileRelayHostOverlay = {
   v: 2,
   hostId: 'host-1',
   endpoints: [
-    { id: 'direct-primary', kind: 'lan', url: 'ws://192.168.1.10:6768' },
     {
       id: 'relay-primary',
       kind: 'relay',
       url: 'wss://relay-c1.onorca.dev/v1/connect/AbCdEf0123_-xyZ9'
     }
   ],
-  relayHostId: 'AbCdEf0123_-xyZ9',
-  relay: {
-    v: 1,
-    directorUrl: 'https://relay.onorca.dev',
-    cellUrl: 'https://relay-c1.onorca.dev',
-    assignmentEpoch: 7,
-    relayHostId: 'AbCdEf0123_-xyZ9',
-    e2eeFraming: 2
-  }
+  relayHostId: RELAY.relayHostId,
+  relay: RELAY
 }
+// What builds before the relay-routing split wrote: a copy of the row's address beside the relay.
+const LEGACY_OVERLAY: MobileRelayHostOverlay = {
+  ...RELAY_ONLY_OVERLAY,
+  endpoints: [
+    { id: 'direct-primary', kind: 'lan', url: 'ws://192.168.1.10:6768' },
+    ...RELAY_ONLY_OVERLAY.endpoints
+  ]
+}
+
+// Frozen copy of the overlay schema shipped builds parse with (relay endpoint schema is shared);
+// they drop a record it rejects.
+const ShippedOverlaySchema = z
+  .object({
+    v: z.literal(2),
+    hostId: z.string().min(1),
+    endpoints: z
+      .array(
+        z
+          .object({
+            id: z.string().min(1).max(128),
+            kind: z.enum(['lan', 'tailscale', 'relay']),
+            url: z.string().min(1).max(2048)
+          })
+          .strict()
+      )
+      .min(1)
+      .max(16),
+    relayHostId: z
+      .string()
+      .regex(/^[A-Za-z0-9_-]{16}$/)
+      .optional(),
+    relay: MobileRelayEndpointSchema.optional()
+  })
+  .strict()
+  .superRefine((overlay, context) => {
+    if ((overlay.relayHostId === undefined) !== (overlay.relay === undefined)) {
+      context.addIssue({ code: 'custom', message: 'Relay identity and endpoint must coexist' })
+      return
+    }
+    if (overlay.relay && overlay.relay.relayHostId !== overlay.relayHostId) {
+      context.addIssue({ code: 'custom', message: 'Relay host identity mismatch' })
+    }
+    const relayEndpointCount = overlay.endpoints.filter(({ kind }) => kind === 'relay').length
+    if (relayEndpointCount !== (overlay.relay ? 1 : 0)) {
+      context.addIssue({ code: 'custom', message: 'Expected exactly one relay endpoint' })
+    }
+  })
 
 describe('mobile relay host overlay store', () => {
   let stored: string | null
@@ -55,35 +104,57 @@ describe('mobile relay host overlay store', () => {
     })
   })
 
-  it('round-trips v2 metadata in a namespace legacy builds do not rewrite', async () => {
-    await saveMobileRelayHostOverlay(OVERLAY)
+  it('round-trips relay routing in a namespace legacy builds do not rewrite', async () => {
+    await expect(saveMobileRelayHostRouting('host-1', RELAY)).resolves.toBe(true)
 
-    await expect(loadMobileRelayHostOverlays(new Set(['host-1']))).resolves.toEqual(
-      new Map([['host-1', OVERLAY]])
-    )
-    expect(asyncStorage.setItem).toHaveBeenCalledWith(STORAGE_KEY, expect.any(String))
+    await expect(loadMobileRelayHostRoutingState(new Set(['host-1']))).resolves.toEqual({
+      relays: new Map([['host-1', RELAY]]),
+      orphanHostIds: []
+    })
+    expect(JSON.parse(stored!)).toEqual([RELAY_ONLY_OVERLAY])
+  })
+
+  it('writes a record the shipped overlay schema still accepts', async () => {
+    await saveMobileRelayHostRouting('host-1', RELAY)
+
+    const [record] = JSON.parse(stored!)
+    expect(ShippedOverlaySchema.safeParse(record).success).toBe(true)
+  })
+
+  it('ignores a direct address an older build stored and drops it on the next routing write', async () => {
+    stored = JSON.stringify([LEGACY_OVERLAY])
+
+    await expect(loadMobileRelayHostRoutingState(new Set(['host-1']))).resolves.toEqual({
+      relays: new Map([['host-1', RELAY]]),
+      orphanHostIds: []
+    })
+    await expect(saveMobileRelayHostRouting('host-1', RELAY)).resolves.toBe(true)
+    expect(JSON.parse(stored!)).toEqual([RELAY_ONLY_OVERLAY])
   })
 
   it('never overlays or resurrects a host whose legacy base was removed', async () => {
-    stored = JSON.stringify([OVERLAY])
+    stored = JSON.stringify([LEGACY_OVERLAY])
 
-    await expect(loadMobileRelayHostOverlays(new Set())).resolves.toEqual(new Map())
+    await expect(loadMobileRelayHostRoutingState(new Set())).resolves.toEqual({
+      relays: new Map(),
+      orphanHostIds: ['host-1']
+    })
     expect(asyncStorage.setItem).not.toHaveBeenCalled()
-    expect(JSON.parse(stored)).toEqual([OVERLAY])
+    expect(JSON.parse(stored)).toEqual([LEGACY_OVERLAY])
   })
 
   it('refuses to overwrite unreadable overlay storage', async () => {
     stored = '{'
 
-    await expect(saveMobileRelayHostOverlay(OVERLAY)).rejects.toThrow(/unreadable/)
+    await expect(saveMobileRelayHostRouting('host-1', RELAY)).rejects.toThrow(/unreadable/)
     expect(asyncStorage.setItem).not.toHaveBeenCalled()
   })
 
   it('removes requested overlays in one storage write', async () => {
-    const second = { ...OVERLAY, hostId: 'host-2' }
-    stored = JSON.stringify([OVERLAY, second])
+    const second = { ...RELAY_ONLY_OVERLAY, hostId: 'host-2' }
+    stored = JSON.stringify([RELAY_ONLY_OVERLAY, second])
 
-    await expect(removeMobileRelayHostOverlays(['host-1', 'host-missing'])).resolves.toBeUndefined()
+    await expect(removeMobileRelayHostRoutings(['host-1', 'host-missing'])).resolves.toBeUndefined()
 
     expect(JSON.parse(stored!)).toEqual([second])
     expect(asyncStorage.getItem).toHaveBeenCalledOnce()
@@ -91,9 +162,9 @@ describe('mobile relay host overlay store', () => {
   })
 
   it('skips the storage write when no requested overlay exists', async () => {
-    stored = JSON.stringify([OVERLAY])
+    stored = JSON.stringify([RELAY_ONLY_OVERLAY])
 
-    await expect(removeMobileRelayHostOverlays(['host-missing'])).resolves.toBeUndefined()
+    await expect(removeMobileRelayHostRoutings(['host-missing'])).resolves.toBeUndefined()
 
     expect(asyncStorage.getItem).toHaveBeenCalledOnce()
     expect(asyncStorage.setItem).not.toHaveBeenCalled()
diff --git a/mobile/src/transport/mobile-relay-host-overlay-store.ts b/mobile/src/transport/mobile-relay-host-overlay-store.ts
index 4960fbec3f0..85ef8b8c181 100644
--- a/mobile/src/transport/mobile-relay-host-overlay-store.ts
+++ b/mobile/src/transport/mobile-relay-host-overlay-store.ts
@@ -1,6 +1,8 @@
 import AsyncStorage from '@react-native-async-storage/async-storage'
+import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
 import {
   MobileRelayHostOverlaySchema,
+  toStoredMobileRelayHostOverlay,
   type MobileRelayHostOverlay
 } from './mobile-relay-host-overlay'
 
@@ -37,74 +39,74 @@ async function readOverlaysForMutation(): Promise<MobileRelayHostOverlay[]> {
 
 async function mutateOverlays(
   update: (overlays: MobileRelayHostOverlay[]) => MobileRelayHostOverlay[]
-): Promise<void> {
+): Promise<boolean> {
   const mutation = overlayMutation.then(async () => {
     const current = await readOverlaysForMutation()
     const next = update(current)
-    // Why: direct-only saves commonly have no overlay to remove; avoid a full
-    // AsyncStorage write when cleanup leaves the durable list unchanged.
-    if (next !== current) {
-      await AsyncStorage.setItem(OVERLAY_STORAGE_KEY, JSON.stringify(next))
+    // Why: an update handing back the list it read changed nothing; skip the full AsyncStorage write.
+    if (next === current) {
+      return false
     }
+    await AsyncStorage.setItem(OVERLAY_STORAGE_KEY, JSON.stringify(next))
+    return true
   })
-  overlayMutation = mutation.catch(() => {})
+  overlayMutation = mutation.then(
+    () => {},
+    () => {}
+  )
   return mutation
 }
 
-export async function loadMobileRelayHostOverlays(
+export async function loadMobileRelayHostRoutingState(
   existingHostIds: ReadonlySet<string>
-): Promise<Map<string, MobileRelayHostOverlay>> {
-  return (await loadMobileRelayHostOverlayState(existingHostIds)).overlays
-}
-
-export async function loadMobileRelayHostOverlayState(
-  existingHostIds: ReadonlySet<string>
-): Promise<{ overlays: Map<string, MobileRelayHostOverlay>; orphanHostIds: string[] }> {
+): Promise<{ relays: Map<string, MobileRelayEndpoint>; orphanHostIds: string[] }> {
   await overlayMutation
   const overlays = parseOverlays(await AsyncStorage.getItem(OVERLAY_STORAGE_KEY)) ?? []
-  const active = new Map<string, MobileRelayHostOverlay>()
+  const relays = new Map<string, MobileRelayEndpoint>()
   const orphanHostIds: string[] = []
   for (const overlay of overlays) {
     // Why: an older app can remove the legacy base without knowing this
     // namespace; never let the retained overlay resurrect that host later.
-    if (existingHostIds.has(overlay.hostId)) {
-      active.set(overlay.hostId, overlay)
-    } else {
+    if (!existingHostIds.has(overlay.hostId)) {
       orphanHostIds.push(overlay.hostId)
+    } else if (overlay.relay) {
+      relays.set(overlay.hostId, overlay.relay)
     }
   }
-  return { overlays: active, orphanHostIds }
+  return { relays, orphanHostIds }
 }
 
-export async function saveMobileRelayHostOverlay(overlay: MobileRelayHostOverlay): Promise<void> {
-  const validated = MobileRelayHostOverlaySchema.parse(overlay)
+/** Resolves whether storage changed. */
+export function saveMobileRelayHostRouting(
+  hostId: string,
+  relay: MobileRelayEndpoint
+): Promise<boolean> {
+  const validated = toStoredMobileRelayHostOverlay(hostId, relay)
   return mutateOverlays((overlays) => {
-    const index = overlays.findIndex(({ hostId }) => hostId === validated.hostId)
+    const index = overlays.findIndex((overlay) => overlay.hostId === hostId)
     if (index === -1) {
       return [...overlays, validated]
     }
+    // Why: a failing relay loop re-resolves the same cell every retry. Both sides are this
+    // schema's output, so key order matches; an older record's direct entry fails the compare.
+    if (JSON.stringify(overlays[index]) === JSON.stringify(validated)) {
+      return overlays
+    }
     const next = overlays.slice()
     next[index] = validated
     return next
   })
 }
 
-export function removeMobileRelayHostOverlay(hostId: string): Promise<void> {
-  return removeMobileRelayHostOverlays([hostId])
+export function removeMobileRelayHostRouting(hostId: string): Promise<void> {
+  return removeMobileRelayHostRoutings([hostId])
 }
 
-export function removeMobileRelayHostOverlays(hostIds: readonly string[]): Promise<void> {
+export async function removeMobileRelayHostRoutings(hostIds: readonly string[]): Promise<void> {
   const targets = new Set(hostIds)
-  let removed = false
-  return mutateOverlays((overlays) => {
-    const next = overlays.filter((overlay) => {
-      if (!targets.has(overlay.hostId)) {
-        return true
-      }
-      removed = true
-      return false
-    })
-    return removed ? next : overlays
+  await mutateOverlays((overlays) => {
+    const next = overlays.filter((overlay) => !targets.has(overlay.hostId))
+    return next.length === overlays.length ? overlays : next
   })
 }
 
diff --git a/mobile/src/transport/mobile-relay-host-overlay.ts b/mobile/src/transport/mobile-relay-host-overlay.ts
index 59c407c9ee3..8076e7a0ad0 100644
--- a/mobile/src/transport/mobile-relay-host-overlay.ts
+++ b/mobile/src/transport/mobile-relay-host-overlay.ts
@@ -1,7 +1,11 @@
 import { z } from 'zod'
-import { MobileRelayEndpointSchema } from '../../../src/shared/mobile-relay-credential-contract'
+import {
+  MobileRelayEndpointSchema,
+  type MobileRelayEndpoint
+} from '../../../src/shared/mobile-relay-credential-contract'
+import { relayConnectWebSocketUrl } from './mobile-relay-connect-url'
 
-export const MobileAccessEndpointSchema = z
+const MobileAccessEndpointSchema = z
   .object({
     id: z.string().min(1).max(128),
     kind: z.enum(['lan', 'tailscale', 'relay']),
@@ -9,6 +13,10 @@ export const MobileAccessEndpointSchema = z
   })
   .strict()
 
+/**
+ * The stored record, which shipped builds also read and write. Only `relay` is authoritative here:
+ * `endpoints` and `relayHostId` are derived copies kept so an older build still parses the record.
+ */
 export const MobileRelayHostOverlaySchema = z
   .object({
     v: z.literal(2),
@@ -43,5 +51,24 @@ export const MobileRelayHostOverlaySchema = z
     }
   })
 
-export type MobileAccessEndpoint = z.infer<typeof MobileAccessEndpointSchema>
 export type MobileRelayHostOverlay = z.infer<typeof MobileRelayHostOverlaySchema>
+
+// Why no direct entry: the host row owns the address, and a copy here outlived every Edit Host.
+export function toStoredMobileRelayHostOverlay(
+  hostId: string,
+  relay: MobileRelayEndpoint
+): MobileRelayHostOverlay {
+  return MobileRelayHostOverlaySchema.parse({
+    v: 2,
+    hostId,
+    endpoints: [
+      {
+        id: 'relay-primary',
+        kind: 'relay',
+        url: relayConnectWebSocketUrl(relay.cellUrl, relay.relayHostId)
+      }
+    ],
+    relayHostId: relay.relayHostId,
+    relay
+  })
+}
diff --git a/mobile/src/transport/mobile-relay-invite-director.ts b/mobile/src/transport/mobile-relay-invite-director.ts
index 408f83c8c09..5ae76024054 100644
--- a/mobile/src/transport/mobile-relay-invite-director.ts
+++ b/mobile/src/transport/mobile-relay-invite-director.ts
@@ -1,4 +1,5 @@
 import type { PairingRelay } from '../../../src/shared/mobile-relay-pairing-offer'
+import { relayConnectWebSocketUrl } from './mobile-relay-connect-url'
 import { RelayMovedSchema } from '../../../src/shared/mobile-relay-phone-protocol'
 
 export class RelayDirectorMoveNotNewerError extends Error {
@@ -28,7 +29,7 @@ export function resolvePairingInviteThroughDirector(args: {
   createSocket?: (url: string) => WebSocket
 }): Promise<PairingRelay> {
   const socket = (args.createSocket ?? ((url) => new WebSocket(url)))(
-    directorWebSocketUrl(args.relay)
+    relayConnectWebSocketUrl(args.relay.directorUrl, args.relay.relayHostId)
   )
   return new Promise((resolve, reject) => {
     let settled = false
@@ -101,10 +102,3 @@ export function resolvePairingInviteThroughDirector(args: {
     }
   })
 }
-
-export function directorWebSocketUrl(relay: PairingRelay): string {
-  const url = new URL(relay.directorUrl)
-  url.protocol = 'wss:'
-  url.pathname = `/v1/connect/${encodeURIComponent(relay.relayHostId)}`
-  return url.toString()
-}
diff --git a/mobile/src/transport/mobile-relay-orphan-cleanup.ts b/mobile/src/transport/mobile-relay-orphan-cleanup.ts
index fd57f01f9c9..14929890f4f 100644
--- a/mobile/src/transport/mobile-relay-orphan-cleanup.ts
+++ b/mobile/src/transport/mobile-relay-orphan-cleanup.ts
@@ -1,14 +1,14 @@
 import { scheduleHostCredentialCleanup } from './host-credential-cleanup'
-import { removeMobileRelayHostOverlay } from './mobile-relay-host-overlay-store'
+import { removeMobileRelayHostRouting } from './mobile-relay-host-overlay-store'
 
 export async function scheduleOrphanedMobileRelayCleanup(args: {
   hostIds: string[]
   deleteCredential: (hostId: string) => Promise<void>
   scheduleCleanup?: typeof scheduleHostCredentialCleanup
-  removeOverlay?: typeof removeMobileRelayHostOverlay
+  removeOverlay?: typeof removeMobileRelayHostRouting
 }): Promise<void> {
   const scheduleCleanup = args.scheduleCleanup ?? scheduleHostCredentialCleanup
-  const removeOverlay = args.removeOverlay ?? removeMobileRelayHostOverlay
+  const removeOverlay = args.removeOverlay ?? removeMobileRelayHostRouting
   for (const hostId of new Set(args.hostIds)) {
     try {
       // Why: an older build may remove the legacy host while retaining the v2
diff --git a/mobile/src/transport/mobile-relay-outage-escalation.test.ts b/mobile/src/transport/mobile-relay-outage-escalation.test.ts
index 93694f1efac..09eac93bf4f 100644
--- a/mobile/src/transport/mobile-relay-outage-escalation.test.ts
+++ b/mobile/src/transport/mobile-relay-outage-escalation.test.ts
@@ -5,7 +5,8 @@ import {
   dependencies,
   FakeRelaySession,
   FakeSession,
-  host
+  host,
+  relay
 } from './mobile-endpoint-supervisor-test-fakes'
 import { RelayOuterError } from './mobile-relay-e2ee-link'
 import { createStableLogicalRpcClient } from './stable-logical-rpc-client'
@@ -40,7 +41,7 @@ describe('continuous Relay outage escalation', () => {
       openRelay,
       randomBytes: () => new Uint8Array([0, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     expect(openRelay).toHaveBeenCalledOnce()
diff --git a/mobile/src/transport/mobile-relay-pairing-recovery.test.ts b/mobile/src/transport/mobile-relay-pairing-recovery.test.ts
index 96d71b37680..e9024e23c24 100644
--- a/mobile/src/transport/mobile-relay-pairing-recovery.test.ts
+++ b/mobile/src/transport/mobile-relay-pairing-recovery.test.ts
@@ -6,7 +6,7 @@ import {
   resetMobileRelayPairingRecoveryForTests
 } from './mobile-relay-pairing-recovery'
 import type { PairingCandidateClient } from './mobile-relay-physical-client'
-import type { PairingOffer, RpcResponse } from './types'
+import type { HostProfile, PairingOffer, RpcResponse } from './types'
 
 vi.mock('react-native', () => ({ Platform: { OS: 'ios' } }))
 vi.mock('expo-crypto', () => ({ getRandomBytes: vi.fn() }))
@@ -92,6 +92,7 @@ function dependencies(args: {
   journal: ReturnType<typeof journal>
   connectRelay: ReturnType<typeof vi.fn>
   bundle?: MobileRelayCredentialBundle | null
+  hosts?: HostProfile[]
 }) {
   return {
     loadJournal: vi.fn(async () => args.journal),
@@ -101,8 +102,8 @@ function dependencies(args: {
     clearJournal: vi.fn(async () => {}),
     readCredentialBundle: vi.fn(async () => args.bundle ?? null),
     writeCredentialBundle: vi.fn(async () => {}),
-    loadHosts: vi.fn(async () => []),
-    saveHost: vi.fn(async () => {}),
+    loadHosts: vi.fn(async (): Promise<HostProfile[]> => args.hosts ?? []),
+    savePairedHost: vi.fn(async () => {}),
     connectRelay: args.connectRelay,
     resolveInviteDirector: vi.fn(async () => {
       throw new Error('director not needed')
@@ -139,7 +140,26 @@ describe('mobile relay pairing recovery', () => {
       })
     )
     expect(deps.writeCredentialBundle).toHaveBeenCalledOnce()
-    expect(deps.saveHost).toHaveBeenCalledOnce()
+    expect(deps.savePairedHost).toHaveBeenCalledOnce()
+    expect(deps.clearJournal).toHaveBeenCalledOnce()
+  })
+
+  it('clears a journal whose relay routing the host already carries, without dialing', async () => {
+    const saved = journal()
+    const connectRelay = vi.fn()
+    const bundle: MobileRelayCredentialBundle = {
+      v: 1,
+      hostId: 'host-1',
+      deviceToken: offer.deviceToken,
+      current: { token: 'C'.repeat(43), hash: 'D'.repeat(43), version: 1, expiresAt: now + 60_000 }
+    }
+    const { relay } = endpoints(saved, { state: 'not-found' })
+    const hosts = [{ ...saved.metadata.host, deviceToken: offer.deviceToken, relay }]
+    const deps = dependencies({ journal: saved, connectRelay, bundle, hosts })
+
+    await expect(recoverMobileRelayPairing(deps)).resolves.toBe('recovered')
+    expect(connectRelay).not.toHaveBeenCalled()
+    expect(deps.savePairedHost).not.toHaveBeenCalled()
     expect(deps.clearJournal).toHaveBeenCalledOnce()
   })
 
diff --git a/mobile/src/transport/mobile-relay-pairing-recovery.ts b/mobile/src/transport/mobile-relay-pairing-recovery.ts
index a6ecd6bbd5a..c93baec9c0d 100644
--- a/mobile/src/transport/mobile-relay-pairing-recovery.ts
+++ b/mobile/src/transport/mobile-relay-pairing-recovery.ts
@@ -1,11 +1,10 @@
 import { Platform } from 'react-native'
 import type {
   DeviceCredentialInstalled,
-  MobileRelayEndpoint,
   PairingGetEndpointsResult
 } from '../../../src/shared/mobile-relay-credential-contract'
 import type { PairingRelay } from '../../../src/shared/mobile-relay-pairing-offer'
-import { loadHosts, saveHost } from './host-store'
+import { loadHosts, savePairedHost } from './host-store'
 import {
   promotePairingJournalCredential,
   readMobileRelayCredentialBundle,
@@ -24,7 +23,7 @@ import {
   type PairingCandidateClient
 } from './mobile-relay-physical-client'
 import { createRecoveringPairingRelayCandidate } from './pairing-relay-candidate'
-import type { HostProfile } from './types'
+import { relayHost } from './pairing-relay-host'
 import {
   relayCredentialProvision,
   relayPairingEndpointsRead
@@ -39,7 +38,7 @@ type RecoveryDependencies = {
   readCredentialBundle: typeof readMobileRelayCredentialBundle
   writeCredentialBundle: typeof writeMobileRelayCredentialBundle
   loadHosts: typeof loadHosts
-  saveHost: typeof saveHost
+  savePairedHost: typeof savePairedHost
   connectRelay: typeof connectMobileRelayForPairing
   resolveInviteDirector: typeof resolvePairingInviteThroughDirector
   now: () => number
@@ -53,7 +52,7 @@ const defaultDependencies: RecoveryDependencies = {
   readCredentialBundle: readMobileRelayCredentialBundle,
   writeCredentialBundle: writeMobileRelayCredentialBundle,
   loadHosts,
-  saveHost,
+  savePairedHost,
   connectRelay: connectMobileRelayForPairing,
   resolveInviteDirector: resolvePairingInviteThroughDirector,
   now: Date.now,
@@ -97,7 +96,7 @@ async function runRecovery(
   const bundle = await dependencies.readCredentialBundle(journal.metadata.host.id).catch(() => null)
   const hosts = await dependencies.loadHosts().catch(() => [])
   const existing = hosts.find(({ id }) => id === journal!.metadata.host.id)
-  if (existing?.relayHostId === journal.metadata.relay.relayHostId && bundle) {
+  if (existing?.relay?.relayHostId === journal.metadata.relay.relayHostId && bundle) {
     await dependencies.clearJournal(journal.metadata.journalId)
     return 'recovered'
   }
@@ -266,27 +265,10 @@ async function publishCommitted(
   await dependencies.writeCredentialBundle(
     promotePairingJournalCredential({ journal: reconciledJournal, installed })
   )
-  await dependencies.saveHost(relayHost(reconciledJournal, endpoints.relay))
+  await dependencies.savePairedHost(relayHost(reconciledJournal, endpoints.relay))
   await dependencies.clearJournal(journal.metadata.journalId)
 }
 
-function relayHost(journal: MobileRelayPairingJournal, relay: MobileRelayEndpoint): HostProfile {
-  const host = journal.metadata.host
-  const url = new URL(relay.cellUrl)
-  url.protocol = 'wss:'
-  url.pathname = `/v1/connect/${encodeURIComponent(relay.relayHostId)}`
-  return {
-    ...host,
-    deviceToken: journal.secrets.deviceToken,
-    endpoints: [
-      { id: 'direct-primary', kind: 'lan', url: host.endpoint },
-      { id: 'relay-primary', kind: 'relay', url: url.toString() }
-    ],
-    relayHostId: relay.relayHostId,
-    relay
-  }
-}
-
 function pairingRelay(journal: MobileRelayPairingJournal): PairingRelay {
   return { ...journal.metadata.relay, inviteToken: journal.secrets.inviteToken }
 }
diff --git a/mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts b/mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts
index 89a0f6f0ef1..4fff86c4605 100644
--- a/mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts
+++ b/mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts
@@ -6,7 +6,8 @@ import {
   dependencies,
   FakeRelaySession,
   FakeSession,
-  host
+  host,
+  relay
 } from './mobile-endpoint-supervisor-test-fakes'
 import { MobileE2EEAuthenticationError } from './mobile-e2ee-v2-physical-channel'
 import { RelayOuterError } from './mobile-relay-e2ee-link'
@@ -65,7 +66,7 @@ describe('continuous Relay pairing-rejection escalation', () => {
       randomBytes: () => new Uint8Array([0, 0]),
       onLog: () => {}
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     return { activeRelay, logical, openRelay, supervisor }
   }
 
diff --git a/mobile/src/transport/mobile-relay-physical-client.ts b/mobile/src/transport/mobile-relay-physical-client.ts
index 9e3e4c259f8..3df30542ffa 100644
--- a/mobile/src/transport/mobile-relay-physical-client.ts
+++ b/mobile/src/transport/mobile-relay-physical-client.ts
@@ -7,6 +7,7 @@ import { isRpcResponse } from './rpc-response-shape'
 import { redactSocketEndpoint } from './socket-event-debug'
 import type { ConnectionLogSink, RpcResponse } from './types'
 import { websocketPayloadToUint8 } from './websocket-payload-bytes'
+import { relayConnectWebSocketUrl } from './mobile-relay-connect-url'
 export { RelayOuterError } from './mobile-relay-e2ee-link'
 import { RelayOuterError } from './mobile-relay-e2ee-link'
 
@@ -34,7 +35,7 @@ export function connectMobileRelayForPairing(args: {
   onLog?: ConnectionLogSink
 }): PairingCandidateClient {
   const requestTimeoutMs = args.requestTimeoutMs ?? 30_000
-  const socketUrl = relayPhoneWebSocketUrl(args.relay)
+  const socketUrl = relayConnectWebSocketUrl(args.relay.cellUrl, args.relay.relayHostId)
   const log = createPairingRelayLogger(args.onLog)
   const cellHost = redactSocketEndpoint(socketUrl)
   log('info', 'Relay: dialing cell', cellHost)
@@ -208,13 +209,6 @@ export function connectMobileRelayForPairing(args: {
   }
 }
 
-export function relayPhoneWebSocketUrl(relay: PairingRelay): string {
-  const url = new URL(relay.cellUrl)
-  url.protocol = 'wss:'
-  url.pathname = `/v1/connect/${encodeURIComponent(relay.relayHostId)}`
-  return url.toString()
-}
-
 function asError(error: unknown): Error {
   return error instanceof Error ? error : new Error(String(error))
 }
diff --git a/mobile/src/transport/mobile-relay-rpc-stream-cancellation.test.ts b/mobile/src/transport/mobile-relay-rpc-stream-cancellation.test.ts
index 0a7a25dfbd7..642ba1981b8 100644
--- a/mobile/src/transport/mobile-relay-rpc-stream-cancellation.test.ts
+++ b/mobile/src/transport/mobile-relay-rpc-stream-cancellation.test.ts
@@ -101,7 +101,7 @@ describe('mobile relay subscription cancellation', () => {
       'terminal.subscribe',
       { terminal: 'term', client: { id: 'phone' } },
       'terminal.unsubscribe',
-      { subscriptionId: 'term:phone', client: { id: 'phone' } }
+      { subscriptionId: 'term:phone', client: { id: 'phone' }, requestId: 'request-1' }
     ],
     [
       'session.tabs.subscribe',
@@ -200,7 +200,8 @@ describe('mobile relay subscription cancellation', () => {
       const older = vi.fn()
       const newer = vi.fn()
       const cancelOlder = streams.subscribe(method, params, older)
-      const cancelNewer = streams.subscribe(method, { ...params }, newer)
+      // A non-slot param differs, which must not split the siblings.
+      const cancelNewer = streams.subscribe(method, { ...params, limit: 5 }, newer)
       await Promise.resolve()
       expect(sendFrame).toHaveBeenCalledTimes(2)
       cancelOlder()
@@ -218,6 +219,103 @@ describe('mobile relay subscription cancellation', () => {
     }
   )
 
+  it('sends no terminal unsubscribe when the listener disposes on end', async () => {
+    const { streams, sendFrame } = createStreams()
+    const events: unknown[] = []
+    let dispose = (): void => {}
+    dispose = streams.subscribe(
+      'terminal.subscribe',
+      { terminal: 'term', client: { id: 'phone', type: 'mobile' } },
+      (event) => {
+        events.push(event)
+        // The host already ended it; a slot-named unsubscribe would retire a newer same-slot stream.
+        dispose()
+      }
+    )
+    await Promise.resolve()
+
+    expect(streams.handleResponse(response('request-1', { type: 'end' }))).toBe(true)
+    dispose()
+
+    expect(events).toEqual([{ type: 'end' }])
+    expect(sendFrame).toHaveBeenCalledTimes(1)
+  })
+
+  it.each([
+    ['nativeChat.subscribe', { agent: 'claude', sessionId: 's1', subscriptionId: 'claude:s1' }],
+    ['terminal.subscribe', { terminal: 'term', client: { id: 'phone' } }]
+  ])(
+    'unsubscribes the newer %s while the evicted older one is still live',
+    async (method, params) => {
+      const { streams, sendFrame } = createStreams()
+      streams.subscribe(method, params, vi.fn())
+      const cancelNewer = streams.subscribe(method, { ...params }, vi.fn())
+      await Promise.resolve()
+      expect(sendFrame).toHaveBeenCalledTimes(2)
+
+      // The newer registration evicted the older on the host; the older's end is still in flight.
+      cancelNewer()
+
+      expect(sendFrame).toHaveBeenCalledTimes(3)
+      expect(sendFrame).toHaveBeenLastCalledWith(
+        expect.objectContaining({ method: method.replace(/\.subscribe$/, '.unsubscribe') })
+      )
+    }
+  )
+
+  it('orders same-slot terminal siblings by when they were sent, not when they subscribed', async () => {
+    const connection = Promise.withResolvers<void>()
+    let waits = 0
+    // The first subscriber waits for the connection; the second is sent at once, so it is older.
+    const { streams, sendFrame } = createStreams(() =>
+      ++waits === 1 ? connection.promise : Promise.resolve()
+    )
+    const cancelSentLast = streams.subscribe(
+      'terminal.subscribe',
+      { terminal: 'term', client: { id: 'phone' }, viewport: { cols: 40, rows: 20 } },
+      vi.fn()
+    )
+    const cancelSentFirst = streams.subscribe(
+      'terminal.subscribe',
+      { terminal: 'term', client: { id: 'phone' }, viewport: { cols: 60, rows: 30 } },
+      vi.fn()
+    )
+    await Promise.resolve()
+    connection.resolve()
+    await Promise.resolve()
+    await Promise.resolve()
+    expect(sendFrame.mock.calls.map(([request]) => request.id)).toEqual(['request-2', 'request-1'])
+
+    cancelSentFirst()
+    expect(sendFrame).toHaveBeenCalledTimes(2)
+    cancelSentLast()
+    expect(sendFrame).toHaveBeenCalledTimes(3)
+    expect(sendFrame).toHaveBeenLastCalledWith({
+      id: 'request-3',
+      method: 'terminal.unsubscribe',
+      params: { subscriptionId: 'term:phone', client: { id: 'phone' }, requestId: 'request-1' }
+    })
+  })
+
+  it('keeps skipping for a live newer terminal sibling though each unsubscribe names its request', async () => {
+    const { streams, sendFrame } = createStreams()
+    const params = { terminal: 'term', client: { id: 'phone' } }
+    const cancelOlder = streams.subscribe('terminal.subscribe', params, vi.fn())
+    const cancelNewer = streams.subscribe('terminal.subscribe', { ...params }, vi.fn())
+    await Promise.resolve()
+
+    // A host without request addressing ends the slot, which the newer stream now owns.
+    cancelOlder()
+    expect(sendFrame).toHaveBeenCalledTimes(2)
+
+    cancelNewer()
+    expect(sendFrame).toHaveBeenLastCalledWith({
+      id: 'request-3',
+      method: 'terminal.unsubscribe',
+      params: { subscriptionId: 'term:phone', client: { id: 'phone' }, requestId: 'request-2' }
+    })
+  })
+
   it('still unsubscribes a shared-token nativeChat stream when the sibling is unsent', async () => {
     const wait = Promise.withResolvers<void>()
     let connected = false
diff --git a/mobile/src/transport/mobile-relay-rpc-streams.test.ts b/mobile/src/transport/mobile-relay-rpc-streams.test.ts
index 0872e0b16d3..581b8f7e247 100644
--- a/mobile/src/transport/mobile-relay-rpc-streams.test.ts
+++ b/mobile/src/transport/mobile-relay-rpc-streams.test.ts
@@ -38,6 +38,40 @@ describe('MobileRelayRpcStreams failure parity', () => {
     expect(sendFrame).toHaveBeenCalledTimes(1)
   })
 
+  it.each([
+    [
+      'an error reply',
+      (streams: MobileRelayRpcStreams) => streams.handleResponse(rpcFailure('stream-1'))
+    ],
+    ['a send failure', () => undefined]
+  ])(
+    'sends no terminal unsubscribe when the listener disposes on %s',
+    async (label, failStream) => {
+      const sendFrame = vi.fn(() => label !== 'a send failure')
+      const streams = new MobileRelayRpcStreams({
+        nextId: () => 'stream-1',
+        sendFrame,
+        waitForConnected: async () => {}
+      })
+      const events: unknown[] = []
+      let dispose = (): void => {}
+      dispose = streams.subscribe(
+        'terminal.subscribe',
+        { terminal: 'term', client: { id: 'phone', type: 'mobile' } },
+        (event) => {
+          events.push(event)
+          dispose()
+        }
+      )
+      await Promise.resolve()
+      failStream(streams)
+      dispose()
+
+      expect(events).toEqual([expect.objectContaining({ type: 'error' })])
+      expect(sendFrame).toHaveBeenCalledTimes(1)
+    }
+  )
+
   it('emits a connection-wait rejection exactly once without sending or cancelling', async () => {
     const listener = vi.fn()
     const sendFrame = vi.fn(() => true)
diff --git a/mobile/src/transport/mobile-relay-rpc-streams.ts b/mobile/src/transport/mobile-relay-rpc-streams.ts
index 29d28017c9c..eaa46bc419b 100644
--- a/mobile/src/transport/mobile-relay-rpc-streams.ts
+++ b/mobile/src/transport/mobile-relay-rpc-streams.ts
@@ -25,11 +25,25 @@ type StreamRecord = {
   streamIds: Set<number>
   subscriptionId?: string
   cancelled: boolean
-  sent: boolean
+  /** Position in this session's send order, or null while unsent. */
+  sendOrder: number | null
   receivedSnapshot?: boolean
 }
 
-type StreamUnsubscribe = { method: string; params: unknown }
+type StreamUnsubscribe = { method: string; params: Record<string, unknown> }
+
+/** The host cleanup slot an unsubscribe names; the rest of its params never identify a sibling. */
+function unsubscribeSlot({ method, params }: StreamUnsubscribe): string | null {
+  if (!('subscriptionId' in params)) {
+    return null
+  }
+  const client =
+    'client' in params && typeof params.client === 'object' && params.client !== null
+      ? params.client
+      : null
+  const clientId = client && 'id' in client ? client.id : null
+  return JSON.stringify([method, params.subscriptionId, clientId])
+}
 
 /** Unsubscribe derived from the subscribe params alone (no server-assigned id). */
 function buildParamsUnsubscribe(
@@ -59,6 +73,7 @@ export class MobileRelayRpcStreams {
   private readonly terminalListeners = new Map<number, (result: unknown) => void>()
   private readonly terminalSnapshots = new Map<number, TerminalSnapshotState>()
   private activeBrowserStream: StreamRecord | null = null
+  private sendCount = 0
 
   constructor(private readonly options: StreamManagerOptions) {}
 
@@ -76,14 +91,14 @@ export class MobileRelayRpcStreams {
       onBinaryFrame: subscribeOptions?.onBinaryFrame,
       streamIds: new Set(),
       cancelled: false,
-      sent: false
+      sendOrder: null
     }
     this.streams.set(id, stream)
     void this.options
       .waitForConnected()
       .then(() => {
         if (!stream.cancelled) {
-          stream.sent = true
+          stream.sendOrder = ++this.sendCount
           if (!this.options.sendFrame({ id, method, params: stream.params })) {
             this.fail(id, stream, 'Connection interrupted')
           }
@@ -150,8 +165,7 @@ export class MobileRelayRpcStreams {
         this.activeBrowserStream = stream
       }
       if (metadata.type === 'end') {
-        stream.listener(result)
-        this.remove(response.id)
+        this.finish(response.id, stream, result)
         return true
       }
     }
@@ -190,11 +204,11 @@ export class MobileRelayRpcStreams {
       return
     }
     stream.cancelled = true
-    if (stream.sent) {
+    if (stream.sendOrder !== null) {
       const byParams = buildParamsUnsubscribe(stream.method, stream.params, id)
       if (stream.method === 'terminal.subscribe') {
         if (byParams) {
-          this.sendUnsubscribe(byParams)
+          this.sendUnsubscribe(byParams, stream.sendOrder, id)
         }
       } else {
         const unsubscribe = stream.subscriptionId
@@ -204,7 +218,7 @@ export class MobileRelayRpcStreams {
           // The host registers cleanup only after resolving the initial snapshot.
           this.cancelledSubscriptions.set(id, { method: stream.method, unsubscribe: byParams })
         } else if (unsubscribe || byParams) {
-          this.sendUnsubscribe((unsubscribe ?? byParams)!)
+          this.sendUnsubscribe((unsubscribe ?? byParams)!, stream.sendOrder)
         } else if (isReadyIdStream(stream.method)) {
           // Keep only the cleanup route while the server assigns its subscription ID.
           this.cancelledSubscriptions.set(id, { method: stream.method })
@@ -214,23 +228,33 @@ export class MobileRelayRpcStreams {
     this.remove(id)
   }
 
-  /** Skip the unsubscribe when a live sibling shares the host cleanup token (e.g. nativeChat's
-   *  deterministic `agent:sessionId`), since the host would evict the sibling's registration. */
-  private sendUnsubscribe(unsubscribe: StreamUnsubscribe): void {
-    if (this.hasLiveOwner(unsubscribe)) {
+  /** Skip when a same-slot sibling sent later has already evicted this stream on the host. */
+  private sendUnsubscribe(
+    unsubscribe: StreamUnsubscribe,
+    sendOrder: number,
+    terminalRequestId?: string
+  ): void {
+    if (this.hasNewerSlotOwner(unsubscribe, sendOrder)) {
       return
     }
-    this.options.sendFrame({ id: this.options.nextId(), ...unsubscribe })
+    // Why: added after the sibling check; an old host strips it and would evict the live sibling.
+    const params = terminalRequestId
+      ? { ...unsubscribe.params, requestId: terminalRequestId }
+      : unsubscribe.params
+    this.options.sendFrame({ id: this.options.nextId(), method: unsubscribe.method, params })
   }
 
-  private hasLiveOwner(unsubscribe: StreamUnsubscribe): boolean {
-    const token = JSON.stringify(unsubscribe)
+  private hasNewerSlotOwner(unsubscribe: StreamUnsubscribe, sendOrder: number): boolean {
+    const slot = unsubscribeSlot(unsubscribe)
+    if (slot === null) {
+      return false
+    }
     for (const [siblingId, sibling] of this.streams) {
-      if (sibling.cancelled || !sibling.sent) {
+      if (sibling.cancelled || sibling.sendOrder === null || sibling.sendOrder < sendOrder) {
         continue
       }
       const siblingUnsubscribe = buildParamsUnsubscribe(sibling.method, sibling.params, siblingId)
-      if (siblingUnsubscribe && JSON.stringify(siblingUnsubscribe) === token) {
+      if (siblingUnsubscribe && unsubscribeSlot(siblingUnsubscribe) === slot) {
         return true
       }
     }
@@ -256,10 +280,12 @@ export class MobileRelayRpcStreams {
     if (stream.cancelled || this.streams.get(id) !== stream) {
       return
     }
-    try {
-      stream.listener({ type: 'error', message, error })
-    } finally {
-      this.remove(id)
-    }
+    this.finish(id, stream, { type: 'error', message, error })
+  }
+
+  /** Removed first, so the listener's dispose cannot name a host-ended stream. */
+  private finish(id: string, stream: StreamRecord, result: unknown): void {
+    this.remove(id)
+    stream.listener(result)
   }
 }
diff --git a/mobile/src/transport/mobile-relay-runtime-failover.test.ts b/mobile/src/transport/mobile-relay-runtime-failover.test.ts
index e7e299209ed..0a9cc8590c9 100644
--- a/mobile/src/transport/mobile-relay-runtime-failover.test.ts
+++ b/mobile/src/transport/mobile-relay-runtime-failover.test.ts
@@ -199,15 +199,6 @@ const host: HostProfile = {
   deviceToken: 'device-token',
   publicKeyB64: 'A'.repeat(44),
   lastConnected: 1,
-  endpoints: [
-    { id: 'direct-primary', kind: 'lan', url: DIRECT_ENDPOINT },
-    {
-      id: 'relay-primary',
-      kind: 'relay',
-      url: 'wss://relay-c1.onorca.dev/v1/connect/id'
-    }
-  ],
-  relayHostId: relay.relayHostId,
   relay
 }
 
@@ -234,7 +225,8 @@ function dependencies(
     resolveRelay: vi.fn(async ({ relay }) => relay),
     readBundle: vi.fn(async () => bundleWith(2, Number.MAX_SAFE_INTEGER)),
     writeBundle: vi.fn(async () => {}),
-    saveHost: vi.fn(async () => {}),
+    setRelayRouting: vi.fn(async () => {}),
+    directPath: 'lan',
     now: Date.now,
     randomBytes: (length: number) => new Uint8Array(length),
     setTimer: (handler, ms) => setTimeout(handler, ms),
@@ -265,7 +257,7 @@ describe('relay runtime recovery without direct connectivity', () => {
       .fn(async () => bundleWith(3, Number.MAX_SAFE_INTEGER))
       .mockResolvedValueOnce(bundleWith(2, Number.MAX_SAFE_INTEGER))
     const deps = dependencies({ openRelay, readBundle })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(0)
@@ -290,7 +282,7 @@ describe('relay runtime recovery without direct connectivity', () => {
       .fn(async () => bundleWith(2, Number.MAX_SAFE_INTEGER))
       .mockResolvedValueOnce(null)
     const deps = dependencies({ readBundle })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     // Pre-fix, a null first read killed relay recovery for the process lifetime.
     await supervisor.start()
@@ -306,7 +298,7 @@ describe('relay runtime recovery without direct connectivity', () => {
     const expired = bundleWith(2, Date.now() - 1)
     const readBundle = vi.fn(async () => expired)
     const deps = dependencies({ readBundle })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(0)
@@ -333,7 +325,7 @@ describe('relay runtime recovery without direct connectivity', () => {
       )
       .mockImplementation(() => new FakeRelaySession('connected'))
     const deps = dependencies({ openRelay })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(0)
@@ -356,7 +348,7 @@ describe('relay runtime recovery without direct connectivity', () => {
       .mockResolvedValueOnce(expired)
       .mockResolvedValueOnce(expired)
     const deps = dependencies({ readBundle })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(0)
@@ -386,7 +378,7 @@ describe('relay runtime recovery without direct connectivity', () => {
       .fn(async () => bundleWith(1, Number.MAX_SAFE_INTEGER))
       .mockResolvedValueOnce(bundleWith(4, Number.MAX_SAFE_INTEGER))
     const deps = dependencies({ openRelay, readBundle })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(0)
@@ -414,7 +406,7 @@ describe('relay runtime recovery without direct connectivity', () => {
     // confuse the churn measurement by migrating back to direct.
     const openDirect = vi.fn(() => new FakeSession('disconnected'))
     const deps = dependencies({ openRelay, openDirect })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(0)
@@ -435,7 +427,7 @@ describe('relay runtime recovery without direct connectivity', () => {
       )
       .mockImplementation(() => new FakeRelaySession('connected'))
     const deps = dependencies({ openRelay })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(0)
@@ -453,7 +445,7 @@ describe('relay runtime recovery without direct connectivity', () => {
   it('restarts Relay promptly after the background grace expires', async () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies({ openDirect: vi.fn(() => new FakeSession('disconnected')) })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     expect(deps.openRelay).not.toHaveBeenCalled()
@@ -476,7 +468,7 @@ describe('relay runtime recovery without direct connectivity', () => {
   it('recovers an expired background Relay through the app-resume manual retry nudge', async () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies({ openDirect: vi.fn(() => new FakeSession('disconnected')) })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     supervisor.setForeground(false)
@@ -539,7 +531,7 @@ describe('failover with a real direct rpc-client', () => {
       'tailscale' as MobileConnectionPath
     )
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(3_000)
@@ -561,7 +553,7 @@ describe('failover with a real direct rpc-client', () => {
         return bundleWith(2, Number.MAX_SAFE_INTEGER)
       })
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     const started = supervisor.start()
     await vi.advanceTimersByTimeAsync(300)
diff --git a/mobile/src/transport/mobile-relay-session-establisher.ts b/mobile/src/transport/mobile-relay-session-establisher.ts
index e50a977500a..959f015752c 100644
--- a/mobile/src/transport/mobile-relay-session-establisher.ts
+++ b/mobile/src/transport/mobile-relay-session-establisher.ts
@@ -12,7 +12,6 @@ import type { RelayReconnectController } from './mobile-relay-reconnect-controll
 import type { StableLogicalRpcClient } from './stable-logical-rpc-client'
 import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
 import { RELAY_HOST_CLOSE_REASON } from '../../../src/shared/relay-host-close-reason'
-import type { HostProfile } from './types'
 
 type EstablishResult = { ok: true } | { ok: false; error: Error }
 
@@ -23,8 +22,10 @@ function directWon(logical: StableLogicalRpcClient): boolean {
 // Turns one relay credential into the active runtime session: resolve the cell
 // assignment if the director rejects the cached one, open the cell socket,
 // migrate the logical client onto it, then persist the resume confirmation and
-// re-arm the supervisor's timers.
+// re-arm the supervisor's timers. Owns the relay it dials.
 export class MobileRelaySessionEstablisher {
+  private relay: MobileRelayEndpoint
+
   constructor(
     private readonly args: {
       logical: StableLogicalRpcClient
@@ -34,9 +35,11 @@ export class MobileRelaySessionEstablisher {
       writeBundle: (bundle: MobileRelayCredentialBundle) => Promise<void>
       isActive: () => boolean
       isForeground: () => boolean
-      relay: () => HostProfile['relay']
+      isStopped: () => boolean
+      hostId: string
+      relay: MobileRelayEndpoint
       resolveRelay: MobileEndpointSupervisorDependencies['resolveRelay']
-      persistResolvedRelay: (resolved: MobileRelayEndpoint) => Promise<void>
+      setRelayRouting: MobileEndpointSupervisorDependencies['setRelayRouting']
       bundle: () => MobileRelayCredentialBundle | null
       adoptBundle: (bundle: MobileRelayCredentialBundle) => void
       // Hysteresis stamp + rotation-pending clear + recovery log line.
@@ -47,7 +50,18 @@ export class MobileRelaySessionEstablisher {
       onBookkeepingError: (error: Error) => void
       onDialFailure: (error: Error) => void
     }
-  ) {}
+  ) {
+    this.relay = args.relay
+  }
+
+  async adoptRelay(relay: MobileRelayEndpoint): Promise<void> {
+    // Why: a stopped supervisor's host may be removed or re-paired; its successor owns routing.
+    if (this.args.isStopped()) {
+      return
+    }
+    await this.args.setRelayRouting(this.args.hostId, relay)
+    this.relay = relay
+  }
 
   // Tries each eligible credential until one establishes. Only a grace-repairable
   // failure (BAD_OUTER_CREDENTIAL) moves on to the next credential.
@@ -81,10 +95,10 @@ export class MobileRelaySessionEstablisher {
   dial(credential: { token: string; version: number }): Promise<EstablishResult> {
     return dialRelayThroughDirectorFallback({
       resumeToken: credential.token,
-      relay: this.args.relay,
+      relay: () => this.relay,
       dial: () => this.establish(credential),
       resolveRelay: this.args.resolveRelay,
-      persistResolvedRelay: this.args.persistResolvedRelay
+      persistResolvedRelay: (resolved) => this.adoptRelay(resolved)
     })
   }
 
@@ -93,14 +107,13 @@ export class MobileRelaySessionEstablisher {
     version: number
   }): Promise<EstablishResult> {
     const { args } = this
-    const relay = args.relay()
     const bundle = args.bundle()
     // Why: director resolution and grace fallback can finish after background/stop.
-    if (!args.isActive() || !relay || !bundle) {
+    if (!args.isActive() || !bundle) {
       return { ok: false, error: new RelayDialAbortedError() }
     }
     const session = args.openRelay(
-      relay,
+      this.relay,
       credential,
       `confirm-${encodeBase64Url(args.randomBytes(16))}`,
       // Asserted on the controller's latch, not on the dial result: the close
diff --git a/mobile/src/transport/mobile-web-bundle-compat.test.ts b/mobile/src/transport/mobile-web-bundle-compat.test.ts
index 639d41ef7db..4fea3dab176 100644
--- a/mobile/src/transport/mobile-web-bundle-compat.test.ts
+++ b/mobile/src/transport/mobile-web-bundle-compat.test.ts
@@ -25,6 +25,7 @@ function manifest(
     schemaVersion: 1,
     runtimeProtocolVersion: 3,
     minCompatibleRuntimeProtocolVersion: 2,
+    pageVersion: 1,
     ...overrides
   }
 }
@@ -189,3 +190,40 @@ describe('evaluateMobileWebBundleCompat', () => {
     expect(SUPPORTED_MOBILE_WEB_BUNDLE_SCHEMA_VERSIONS).toContain(MOBILE_WEB_BUNDLE_SCHEMA_VERSION)
   })
 })
+
+/** The shell requires a page at least as new as itself; an older desktop is walled, never served. */
+describe('the page floor', () => {
+  const tooOld = (pageVersion: number) => ({
+    kind: 'blocked',
+    reason: 'bundle-incompatible',
+    side: 'desktop',
+    pageVersion,
+    requiredPageVersion: 1
+  })
+
+  it('walls a desktop whose page is older than this shell, as a desktop to update', () => {
+    expect(evaluate({ manifest: manifest({ pageVersion: 0 }) })).toEqual(tooOld(0))
+  })
+
+  it('reads a manifest with no page version as older than the floor', () => {
+    const { schemaVersion, runtimeProtocolVersion, minCompatibleRuntimeProtocolVersion } =
+      manifest()
+    const unversioned = {
+      schemaVersion,
+      runtimeProtocolVersion,
+      minCompatibleRuntimeProtocolVersion
+    }
+    expect(evaluate({ manifest: unversioned })).toEqual(tooOld(0))
+  })
+
+  it('opens a page at the floor and one above it', () => {
+    expect(evaluate({ manifest: manifest({ pageVersion: 1 }) })).toEqual({
+      kind: 'ok',
+      manifestChecked: true
+    })
+    expect(evaluate({ manifest: manifest({ pageVersion: 7 }) })).toEqual({
+      kind: 'ok',
+      manifestChecked: true
+    })
+  })
+})
diff --git a/mobile/src/transport/mobile-web-bundle-compat.ts b/mobile/src/transport/mobile-web-bundle-compat.ts
index b331540df66..d039816be14 100644
--- a/mobile/src/transport/mobile-web-bundle-compat.ts
+++ b/mobile/src/transport/mobile-web-bundle-compat.ts
@@ -1,6 +1,10 @@
 import { MOBILE_WEB_BUNDLE_CAPABILITY } from '../../../src/shared/mobile-web-bundle/mobile-web-bundle-capability'
 import type { HostStatusReply } from './host-status-reply-schema'
 
+/** The oldest page this shell serves: the `MOBILE_WEB_PAGE_VERSION` of the page built beside it. An
+ *  older desktop is walled rather than served, so the shell keeps no path for an older page. */
+export const MOBILE_WEB_PAGE_VERSION_FLOOR = 1
+
 /** The manifest schemas this app shell can mount. Widening it is a shell release, so the list is
  *  stated here rather than read off the contract's current version: the contract names the schema
  *  the desktop writes, which is exactly the number this shell may not recognise. */
@@ -24,6 +28,8 @@ export type MobileWebBundleCompatManifest = {
   schemaVersion: number
   runtimeProtocolVersion: number
   minCompatibleRuntimeProtocolVersion: number
+  /** Absent from a desktop older than the field, which reads as 0: below every floor. */
+  pageVersion?: number
 }
 
 export type MobileWebBundleCompatVerdict =
@@ -42,6 +48,14 @@ export type MobileWebBundleCompatVerdict =
       hostProtocolVersion: number
       requiredHostProtocolVersion: number
     }
+  /** The host serves a page older than this shell's floor. */
+  | {
+      kind: 'blocked'
+      reason: 'bundle-incompatible'
+      side: 'desktop'
+      pageVersion: number
+      requiredPageVersion: number
+    }
   /** The bundle is older than the host expects; the caller refetches. */
   | {
       kind: 'blocked'
@@ -90,6 +104,16 @@ export function evaluateMobileWebBundleCompat(input: {
       schemaVersion: manifest.schemaVersion
     }
   }
+  const pageVersion = manifest.pageVersion ?? 0
+  if (pageVersion < MOBILE_WEB_PAGE_VERSION_FLOOR) {
+    return {
+      kind: 'blocked',
+      reason: 'bundle-incompatible',
+      side: 'desktop',
+      pageVersion,
+      requiredPageVersion: MOBILE_WEB_PAGE_VERSION_FLOOR
+    }
+  }
   const hostProtocolVersion = input.hostStatus.protocolVersion ?? 0
   if (hostProtocolVersion < manifest.minCompatibleRuntimeProtocolVersion) {
     return {
diff --git a/mobile/src/transport/mobile-web-bundle-reply-schemas.test.ts b/mobile/src/transport/mobile-web-bundle-reply-schemas.test.ts
index ca00eca7951..57f5618763a 100644
--- a/mobile/src/transport/mobile-web-bundle-reply-schemas.test.ts
+++ b/mobile/src/transport/mobile-web-bundle-reply-schemas.test.ts
@@ -55,6 +55,7 @@ function manifestReply(overrides: Record<string, unknown> = {}) {
     desktopVersion: '1.4.200',
     minCompatibleRuntimeProtocolVersion: 2,
     runtimeProtocolVersion: 2,
+    pageVersion: 1,
     entrypoint: 'index.html',
     totalBytes: 12,
     assets: [asset()],
@@ -234,6 +235,16 @@ describe('mobile web bundle manifest reply reader', () => {
     expect(verdict).toEqual({ kind: 'ok', manifestChecked: true })
   })
 
+  it('reads the page version the floor compares, and one a desktop older than it never wrote', () => {
+    expect(MobileWebBundleManifestReplySchema.parse(manifestReply()).manifest.pageVersion).toBe(1)
+    expect(readManifest(manifestReply({ pageVersion: undefined })).compatible).toBe(true)
+    for (const pageVersion of [-1, 1.5, 'one', null]) {
+      expect(readManifest(manifestReply({ pageVersion })).compatible, String(pageVersion)).toBe(
+        false
+      )
+    }
+  })
+
   it('refuses a manifest with no protocol window, which only a host without the capability sends', () => {
     expect(readManifest(manifestReply({ runtimeProtocolVersion: undefined })).compatible).toBe(
       false
diff --git a/mobile/src/transport/mobile-web-bundle-reply-schemas.ts b/mobile/src/transport/mobile-web-bundle-reply-schemas.ts
index ea68e7dbd14..be9b7bf40ad 100644
--- a/mobile/src/transport/mobile-web-bundle-reply-schemas.ts
+++ b/mobile/src/transport/mobile-web-bundle-reply-schemas.ts
@@ -72,6 +72,7 @@ export const MobileWebBundleManifestReadSchema = z
     buildId: z.string().regex(SHA256_PATTERN),
     minCompatibleRuntimeProtocolVersion: z.number().int().nonnegative(),
     runtimeProtocolVersion: z.number().int().nonnegative(),
+    pageVersion: z.number().int().nonnegative().optional(),
     entrypoint: MobileWebBundleAssetPathSchema,
     totalBytes: z.number().int().nonnegative().max(MOBILE_WEB_BUNDLE_MAX_TOTAL_BYTES),
     assets: z.array(assetSchema).min(1).max(MOBILE_WEB_BUNDLE_MAX_ASSETS),
diff --git a/mobile/src/transport/mobile-web-page-version-floor.test.ts b/mobile/src/transport/mobile-web-page-version-floor.test.ts
new file mode 100644
index 00000000000..284e136e7cc
--- /dev/null
+++ b/mobile/src/transport/mobile-web-page-version-floor.test.ts
@@ -0,0 +1,9 @@
+import { describe, expect, it } from 'vitest'
+import { MOBILE_WEB_PAGE_VERSION } from '../../../src/shared/mobile-web-bundle/manifest-contract'
+import { MOBILE_WEB_PAGE_VERSION_FLOOR } from './mobile-web-bundle-compat'
+
+describe("the shell's page floor", () => {
+  it('never requires a page newer than the one built beside this shell', () => {
+    expect(MOBILE_WEB_PAGE_VERSION_FLOOR).toBeLessThanOrEqual(MOBILE_WEB_PAGE_VERSION)
+  })
+})
diff --git a/mobile/src/transport/pairing-relay-host.ts b/mobile/src/transport/pairing-relay-host.ts
index 4954b079fc9..a8ce6a96534 100644
--- a/mobile/src/transport/pairing-relay-host.ts
+++ b/mobile/src/transport/pairing-relay-host.ts
@@ -10,23 +10,7 @@ export function relayHost(
   relay: MobileRelayEndpoint
 ): HostProfile {
   const host = journal.metadata.host
-  return {
-    ...host,
-    deviceToken: journal.secrets.deviceToken,
-    endpoints: [
-      { id: 'direct-primary', kind: 'lan', url: host.endpoint },
-      { id: 'relay-primary', kind: 'relay', url: relayWebSocketUrl(relay) }
-    ],
-    relayHostId: relay.relayHostId,
-    relay
-  }
-}
-
-export function relayWebSocketUrl(relay: MobileRelayEndpoint): string {
-  const url = new URL(relay.cellUrl)
-  url.protocol = 'wss:'
-  url.pathname = `/v1/connect/${encodeURIComponent(relay.relayHostId)}`
-  return url.toString()
+  return { ...host, deviceToken: journal.secrets.deviceToken, relay }
 }
 
 export function assertCommittedInstall(
diff --git a/mobile/src/transport/pre-profile-pairing-coordinator.test.ts b/mobile/src/transport/pre-profile-pairing-coordinator.test.ts
index bff67eadf2c..0a4484f59c3 100644
--- a/mobile/src/transport/pre-profile-pairing-coordinator.test.ts
+++ b/mobile/src/transport/pre-profile-pairing-coordinator.test.ts
@@ -108,7 +108,7 @@ function dependencies(client: RpcClient, events: string[]) {
       id: hostId,
       name: 'Blue Whale'
     })),
-    saveHost: vi.fn(async (_host: HostProfile) => {
+    savePairedHost: vi.fn(async (_host: HostProfile) => {
       events.push('save-host')
     }),
     saveJournal: vi.fn(async (_journal: MobileRelayPairingJournal) => {
@@ -171,7 +171,7 @@ describe('pre-profile pairing coordinator', () => {
     })
 
     await expect(attempt.result).resolves.toEqual({ hostId: `host-${now}` })
-    expect(deps.saveHost).toHaveBeenCalledWith({
+    expect(deps.savePairedHost).toHaveBeenCalledWith({
       id: `host-${now}`,
       name: 'Blue Whale',
       endpoint: directOffer.endpoint,
@@ -201,7 +201,7 @@ describe('pre-profile pairing coordinator', () => {
     })
 
     await expect(attempt.result).resolves.toEqual({ hostId: 'host-existing' })
-    expect(deps.saveHost).toHaveBeenCalledWith({
+    expect(deps.savePairedHost).toHaveBeenCalledWith({
       id: 'host-existing',
       name: 'Studio Mac',
       endpoint: directOffer.endpoint,
@@ -238,7 +238,7 @@ describe('pre-profile pairing coordinator', () => {
     })
 
     await expect(attempt.result).resolves.toEqual({ hostId: `host-${now}` })
-    expect(deps.saveHost).toHaveBeenCalledOnce()
+    expect(deps.savePairedHost).toHaveBeenCalledOnce()
     expect(deps.recordDescriptorFromStatus).not.toHaveBeenCalled()
   })
 
@@ -256,7 +256,7 @@ describe('pre-profile pairing coordinator', () => {
     })
 
     await expect(attempt.result).resolves.toEqual({ hostId: `host-${now}` })
-    expect(deps.saveHost).toHaveBeenCalledOnce()
+    expect(deps.savePairedHost).toHaveBeenCalledOnce()
   })
 
   it('journals before connecting and publishes only after authoritative direct install', async () => {
@@ -327,19 +327,11 @@ describe('pre-profile pairing coordinator', () => {
       reqId: journal!.metadata.installReqId,
       newResumeTokenHash: journal!.metadata.pendingResumeTokenHash
     })
-    expect(deps.saveHost).toHaveBeenCalledWith(
+    expect(deps.savePairedHost).toHaveBeenCalledWith(
       expect.objectContaining({
         id: `host-${now}`,
         endpoint: directOffer.endpoint,
-        relayHostId: relayOffer.relay!.relayHostId,
-        endpoints: [
-          { id: 'direct-primary', kind: 'lan', url: directOffer.endpoint },
-          {
-            id: 'relay-primary',
-            kind: 'relay',
-            url: `wss://relay-c1.onorca.dev/v1/connect/${relayOffer.relay!.relayHostId}`
-          }
-        ]
+        relay: expect.objectContaining({ relayHostId: relayOffer.relay!.relayHostId })
       })
     )
   })
@@ -356,8 +348,8 @@ describe('pre-profile pairing coordinator', () => {
     })
     await expect(attempt.result).resolves.toEqual({ hostId: `host-${now}` })
 
-    expect(deps.saveHost).toHaveBeenCalledWith(
-      expect.not.objectContaining({ endpoints: expect.anything() })
+    expect(deps.savePairedHost).toHaveBeenCalledWith(
+      expect.not.objectContaining({ relay: expect.anything() })
     )
     expect(events).toEqual([
       'save-journal',
@@ -388,8 +380,8 @@ describe('pre-profile pairing coordinator', () => {
     })
     await expect(attempt.result).resolves.toEqual({ hostId: `host-${now}` })
 
-    expect(deps.saveHost).toHaveBeenCalledWith(
-      expect.not.objectContaining({ endpoints: expect.anything() })
+    expect(deps.savePairedHost).toHaveBeenCalledWith(
+      expect.not.objectContaining({ relay: expect.anything() })
     )
     expect(events).toEqual([
       'save-journal',
@@ -550,6 +542,6 @@ describe('pre-profile pairing coordinator', () => {
 
     await expect(attempt.result).rejects.toThrow(/cancelled/)
     expect(client.close).toHaveBeenCalledOnce()
-    expect(deps.saveHost).not.toHaveBeenCalled()
+    expect(deps.savePairedHost).not.toHaveBeenCalled()
   })
 })
diff --git a/mobile/src/transport/pre-profile-pairing-coordinator.ts b/mobile/src/transport/pre-profile-pairing-coordinator.ts
index 0939938bec3..58b1c793118 100644
--- a/mobile/src/transport/pre-profile-pairing-coordinator.ts
+++ b/mobile/src/transport/pre-profile-pairing-coordinator.ts
@@ -1,6 +1,6 @@
 import { Platform } from 'react-native'
 import { connect, type ConnectOptions } from './rpc-client'
-import { resolvePairingHostIdentity, saveHost } from './host-store'
+import { resolvePairingHostIdentity, savePairedHost } from './host-store'
 import type { HostProfile, PairingOffer } from './types'
 import { isPairingRelayRpcUnavailable } from './pairing-relay-rpc-unavailable'
 import {
@@ -45,7 +45,7 @@ type Dependencies = {
   connectRelay: typeof connectMobileRelayForPairing
   resolveInviteDirector: typeof resolvePairingInviteThroughDirector
   resolveHostIdentity: typeof resolvePairingHostIdentity
-  saveHost: typeof saveHost
+  savePairedHost: typeof savePairedHost
   saveJournal: typeof saveMobileRelayPairingJournal
   updateJournal: typeof updateMobileRelayPairingJournal
   clearJournal: typeof clearMobileRelayPairingJournal
@@ -60,7 +60,7 @@ const defaultDependencies: Dependencies = {
   connectRelay: connectMobileRelayForPairing,
   resolveInviteDirector: resolvePairingInviteThroughDirector,
   resolveHostIdentity: resolvePairingHostIdentity,
-  saveHost,
+  savePairedHost,
   saveJournal: saveMobileRelayPairingJournal,
   updateJournal: updateMobileRelayPairingJournal,
   clearJournal: clearMobileRelayPairingJournal,
@@ -206,7 +206,7 @@ async function runPairing(
   assertActive(isDisposed)
 
   if (!journal) {
-    await dependencies.saveHost(baseHost(offer, hostId, hostName, now))
+    await dependencies.savePairedHost(baseHost(offer, hostId, hostName, now))
     recordWinnerDescriptor(dependencies, hostId, winner.status)
     return { hostId }
   }
@@ -231,7 +231,7 @@ async function runPairing(
     // Why: this commits a LAN-only host instead of failing, so the refusal code is the only
     // record of why the phone never got a relay endpoint.
     log('info', 'Relay: desktop will not serve relay pairing', provision.error.code)
-    await dependencies.saveHost(baseHost(offer, hostId, hostName, now))
+    await dependencies.savePairedHost(baseHost(offer, hostId, hostName, now))
     await dependencies.clearJournal(journal.metadata.journalId)
     recordWinnerDescriptor(dependencies, hostId, winner.status)
     return { hostId }
@@ -247,7 +247,7 @@ async function runPairing(
   }
   assertActive(isDisposed)
   await dependencies.writeCredentialBundle(promotePairingJournalCredential({ journal, installed }))
-  await dependencies.saveHost(relayHost(journal, endpoints.relay))
+  await dependencies.savePairedHost(relayHost(journal, endpoints.relay))
   await dependencies.clearJournal(journal.metadata.journalId)
   recordWinnerDescriptor(dependencies, hostId, winner.status)
   return { hostId }
diff --git a/mobile/src/transport/relay-host-signed-out-supervisor.test.ts b/mobile/src/transport/relay-host-signed-out-supervisor.test.ts
index 1c07b4b7f6b..b2f08ad1980 100644
--- a/mobile/src/transport/relay-host-signed-out-supervisor.test.ts
+++ b/mobile/src/transport/relay-host-signed-out-supervisor.test.ts
@@ -6,7 +6,8 @@ import {
   dependencies,
   FakeLogicalClient,
   FakeRelaySession,
-  host
+  host,
+  relay
 } from './mobile-endpoint-supervisor-test-fakes'
 import { MobileEndpointSupervisor } from './mobile-endpoint-supervisor'
 
@@ -37,7 +38,7 @@ describe('a signed-out desktop reaches the phone verdict', () => {
         )
       })
     })
-    return { logical, supervisor: new MobileEndpointSupervisor(logical, host, deps) }
+    return { logical, supervisor: new MobileEndpointSupervisor(logical, host.id, relay, deps) }
   }
 
   it('latches the sign-out the cell reported', async () => {
diff --git a/mobile/src/transport/rpc-client-runtime-events.test.ts b/mobile/src/transport/rpc-client-runtime-events.test.ts
index 04b2a90039e..ce035f63b0b 100644
--- a/mobile/src/transport/rpc-client-runtime-events.test.ts
+++ b/mobile/src/transport/rpc-client-runtime-events.test.ts
@@ -136,4 +136,30 @@ describe('runtime client-event stream disposal', () => {
     ])
     client.close()
   })
+
+  it('releases the replayed registration on the new socket when disposed before its ready', async () => {
+    const { client, socket: first } = connectReadyClient()
+    const unsubscribe = client.subscribe('runtime.clientEvents.subscribe', null, () => {})
+    const request = sentRequests(first, 'runtime.clientEvents.subscribe')[0]!
+    emitReady(first, request.id, 'runtime-events:first-socket')
+
+    first.close()
+    await vi.advanceTimersByTimeAsync(500)
+    const second = sockets.at(-1)!
+    expect(second).not.toBe(first)
+    second.open()
+    second.receive(JSON.stringify({ type: 'e2ee_ready' }))
+    second.receive('encrypted:{"type":"e2ee_authenticated"}')
+    expect(sentRequests(second, 'runtime.clientEvents.subscribe')).toEqual([
+      expect.objectContaining({ id: request.id })
+    ])
+
+    unsubscribe()
+    emitReady(second, request.id, 'runtime-events:second-socket')
+
+    expect(sentRequests(second, 'runtime.clientEvents.unsubscribe')).toEqual([
+      expect.objectContaining({ params: { subscriptionId: 'runtime-events:second-socket' } })
+    ])
+    client.close()
+  })
 })
diff --git a/mobile/src/transport/rpc-client-session-tabs-stream.ts b/mobile/src/transport/rpc-client-session-tabs-stream.ts
new file mode 100644
index 00000000000..f98a7586921
--- /dev/null
+++ b/mobile/src/transport/rpc-client-session-tabs-stream.ts
@@ -0,0 +1,34 @@
+import { isSnapshotResult } from './rpc-subscription-result-shapes'
+
+type SessionTabsStreamState = {
+  method: string
+  sent?: boolean
+  receivedSnapshot?: boolean
+  cancelled?: boolean
+}
+
+/** Older hosts register a tabs stream only as they emit the first snapshot, so an earlier unsubscribe
+ *  finds nothing there. Newer hosts register on arrival and still send that snapshot, so the hold only delays. */
+function awaitsRegistration(stream: SessionTabsStreamState): boolean {
+  return (
+    stream.method === 'session.tabs.subscribe' && stream.sent === true && !stream.receivedSnapshot
+  )
+}
+
+/** Cancels a stream still awaiting its first snapshot; that snapshot then triggers the unsubscribe. */
+export function holdUnsubscribe(stream: SessionTabsStreamState): boolean {
+  if (!awaitsRegistration(stream)) {
+    return false
+  }
+  stream.cancelled = true
+  return true
+}
+
+/** Returns true when `result` is the tabs stream's snapshot, i.e. the host has registered it. */
+export function recordSnapshot(stream: SessionTabsStreamState, result: unknown): boolean {
+  if (stream.method !== 'session.tabs.subscribe' || !isSnapshotResult(result)) {
+    return false
+  }
+  stream.receivedSnapshot = true
+  return true
+}
diff --git a/mobile/src/transport/rpc-client-stream-registry.test.ts b/mobile/src/transport/rpc-client-stream-registry.test.ts
index 0e7d561be6e..48c62af478d 100644
--- a/mobile/src/transport/rpc-client-stream-registry.test.ts
+++ b/mobile/src/transport/rpc-client-stream-registry.test.ts
@@ -79,6 +79,202 @@ describe('RpcClientStreamRegistry', () => {
     ])
   })
 
+  it.each([
+    ['a streamed end', (id: string) => streamingResponse(id, { type: 'end' })],
+    [
+      'a final end reply',
+      (id: string): RpcResponse => ({
+        id,
+        ok: true,
+        result: { type: 'end' },
+        _meta: { runtimeId: 'runtime-1' }
+      })
+    ],
+    [
+      'an error reply',
+      (id: string): RpcResponse => ({
+        id,
+        ok: false,
+        error: { code: 'runtime_error', message: 'failed' },
+        _meta: { runtimeId: 'runtime-1' }
+      })
+    ]
+  ])('sends no terminal unsubscribe when the listener disposes on %s', (_label, ending) => {
+    const { registry, sent } = createRegistry()
+    const events: unknown[] = []
+    let dispose = (): void => {}
+    dispose = registry.subscribe(
+      'terminal.subscribe',
+      { terminal: 'term-1', client: { id: 'phone', type: 'mobile' } },
+      (event) => {
+        events.push(event)
+        // The session hook disposes synchronously on end/error; a slot-named unsubscribe here
+        // would retire a newer same-slot stream on the host.
+        dispose()
+      }
+    )
+    const request = sent[0]!
+
+    registry.handleResponse(ending(request.id))
+    dispose()
+
+    expect(events).toHaveLength(1)
+    expect(sent).toEqual([request])
+    expect(registry.size()).toBe(0)
+  })
+
+  it('does not replay a terminal stream the host already ended', () => {
+    const { registry, sent, setState } = createRegistry()
+    registry.subscribe(
+      'terminal.subscribe',
+      { terminal: 'term-1', client: { id: 'phone' } },
+      () => {}
+    )
+    const request = sent[0]!
+    registry.handleResponse(streamingResponse(request.id, { type: 'subscribed', streamId: 7 }))
+    registry.handleResponse(streamingResponse(request.id, { type: 'end' }))
+
+    setState('connecting')
+    registry.markForReplay()
+    setState('connected')
+    registry.replayAfterAuthentication()
+
+    expect(sent).toEqual([request])
+  })
+
+  it('unsubscribes a session tabs stream by its own request id', () => {
+    const { registry, sent } = createRegistry()
+    const disposeOlder = registry.subscribe(
+      'session.tabs.subscribe',
+      { worktree: 'wt-1' },
+      () => {}
+    )
+    registry.subscribe('session.tabs.subscribe', { worktree: 'wt-1' }, () => {})
+    const [older, newer] = sent
+    registry.handleResponse(streamingResponse(older!.id, { type: 'snapshot', tabs: [] }))
+
+    disposeOlder()
+
+    // Without the request id the host sweeps every stream for the worktree, including the newer one.
+    expect(sent[2]).toMatchObject({
+      method: 'session.tabs.unsubscribe',
+      params: { worktree: 'wt-1', subscriptionId: older!.id }
+    })
+    expect(newer!.id).not.toBe(older!.id)
+    expect(sent).toHaveLength(3)
+  })
+
+  it('holds a session tabs unsubscribe until the host registers the stream', () => {
+    const { registry, sent } = createRegistry()
+    const events: unknown[] = []
+    const dispose = registry.subscribe('session.tabs.subscribe', { worktree: 'wt-1' }, (event) =>
+      events.push(event)
+    )
+    const subscribe = sent[0]!
+
+    dispose()
+    // Older hosts register only as they emit the first snapshot, so an earlier unsubscribe finds nothing.
+    expect(sent).toHaveLength(1)
+
+    registry.handleResponse(streamingResponse(subscribe.id, { type: 'snapshot', tabs: [] }))
+
+    expect(sent[1]).toMatchObject({
+      method: 'session.tabs.unsubscribe',
+      params: { worktree: 'wt-1', subscriptionId: subscribe.id }
+    })
+    // A host that registered on arrival ends the stream; that end must not unsubscribe again.
+    registry.handleResponse(streamingResponse(subscribe.id, { type: 'end' }))
+    expect(sent).toHaveLength(2)
+    expect(events).toEqual([])
+    expect(registry.size()).toBe(0)
+  })
+
+  it('holds a session tabs unsubscribe again after a reconnect replays the stream', () => {
+    const { registry, sent } = createRegistry()
+    const dispose = registry.subscribe('session.tabs.subscribe', { worktree: 'wt-1' }, () => {})
+    const subscribe = sent[0]!
+    registry.handleResponse(streamingResponse(subscribe.id, { type: 'snapshot', tabs: [] }))
+
+    registry.markForReplay()
+    registry.replayAfterAuthentication()
+    dispose()
+
+    expect(sent.map((request) => request.method)).toEqual([
+      'session.tabs.subscribe',
+      'session.tabs.subscribe'
+    ])
+    registry.handleResponse(streamingResponse(subscribe.id, { type: 'snapshot', tabs: [] }))
+    expect(sent[2]).toMatchObject({
+      method: 'session.tabs.unsubscribe',
+      params: { worktree: 'wt-1', subscriptionId: subscribe.id }
+    })
+  })
+
+  it('drops a held session tabs unsubscribe when the subscribe fails or reconnects first', () => {
+    const { registry, sent } = createRegistry()
+    const events: unknown[] = []
+    const disposeFailed = registry.subscribe(
+      'session.tabs.subscribe',
+      { worktree: 'wt-1' },
+      (event) => events.push(event)
+    )
+    const disposeReplayed = registry.subscribe(
+      'session.tabs.subscribe',
+      { worktree: 'wt-2' },
+      () => {}
+    )
+    const failed = sent[0]!
+    disposeFailed()
+    disposeReplayed()
+
+    registry.handleResponse({
+      id: failed.id,
+      ok: false,
+      error: { code: 'worktree_not_found', message: 'Worktree not found' }
+    })
+    registry.markForReplay()
+    registry.replayAfterAuthentication()
+
+    expect(sent).toHaveLength(2)
+    expect(events).toEqual([])
+    expect(registry.size()).toBe(0)
+  })
+
+  it('ends one transcript stream on dispose and leaves a sibling on the same socket (U-03)', () => {
+    const { registry, sent } = createRegistry()
+    const disposeFirst = registry.subscribe('agentSession.subscribe', { sessionId: 's1' }, () => {})
+    registry.subscribe('agentSession.subscribe', { sessionId: 's2' }, () => {})
+    const [first] = sent
+
+    disposeFirst()
+    expect(sent.at(-1)).toMatchObject({
+      method: 'agentSession.unsubscribe',
+      params: { sessionId: 's1', subscriptionId: first!.id }
+    })
+    expect(sent.filter((request) => request.method === 'agentSession.unsubscribe')).toHaveLength(1)
+  })
+
+  it('names the terminal request it sent when unsubscribing, and keeps the slot for older hosts', () => {
+    const { registry, sent } = createRegistry()
+    const dispose = registry.subscribe(
+      'terminal.subscribe',
+      { terminal: 'term-1', client: { id: 'phone-1', type: 'mobile' } },
+      () => {}
+    )
+    const subscribe = sent[0]!
+
+    dispose()
+
+    expect(sent[1]).toMatchObject({
+      method: 'terminal.unsubscribe',
+      params: {
+        subscriptionId: 'term-1:phone-1',
+        client: { id: 'phone-1' },
+        requestId: subscribe.id
+      }
+    })
+  })
+
   it('keeps a disposed browser tombstone until ready can be unsubscribed', () => {
     const { registry, sent } = createRegistry()
     const dispose = registry.subscribe('browser.screencast', { page: 'page-1' }, () => {})
@@ -98,4 +294,105 @@ describe('RpcClientStreamRegistry', () => {
       params: { subscriptionId: 'browser-screencast:page-1:test' }
     })
   })
+
+  it('releases a replayed browser stream replaced by a new one before its ready', () => {
+    const { registry, sent } = createRegistry()
+    registry.subscribe('browser.screencast', { page: 'page-1' }, () => {})
+    const replayedId = sent[0]!.id
+    registry.handleResponse(
+      streamingResponse(replayedId, { type: 'ready', subscriptionId: 'page-1-old-connection' })
+    )
+
+    registry.markForReplay()
+    registry.replayAfterAuthentication()
+    registry.subscribe('browser.screencast', { page: 'page-2' }, () => {})
+    const replacementId = sent.at(-1)!.id
+    registry.handleResponse(
+      streamingResponse(replayedId, { type: 'ready', subscriptionId: 'page-1-new-connection' })
+    )
+    registry.handleResponse(
+      streamingResponse(replacementId, { type: 'ready', subscriptionId: 'page-2' })
+    )
+
+    expect(
+      sent
+        .filter((request) => request.method === 'browser.screencast.unsubscribe')
+        .map((request) => request.params)
+    ).toEqual([{ subscriptionId: 'page-1-new-connection' }])
+    expect(registry.size()).toBe(1)
+  })
+
+  describe.each([
+    ['runtime.clientEvents.subscribe', 'runtime.clientEvents.unsubscribe', null],
+    ['browser.screencast', 'browser.screencast.unsubscribe', { page: 'page-1' }]
+  ])('%s ready id across a replay', (method, unsubscribeMethod, params) => {
+    function unsubscribes(sent: SentRequest[]): unknown[] {
+      return sent.filter((request) => request.method === unsubscribeMethod).map((r) => r.params)
+    }
+
+    function subscribeReady() {
+      const harness = createRegistry()
+      const dispose = harness.registry.subscribe(method, params, () => {})
+      const requestId = harness.sent[0]!.id
+      harness.registry.handleResponse(
+        streamingResponse(requestId, { type: 'ready', subscriptionId: 'old-connection-id' })
+      )
+      return { ...harness, dispose, requestId }
+    }
+
+    it('releases the replayed registration when disposed before its new ready', () => {
+      const { registry, sent, dispose, requestId } = subscribeReady()
+
+      registry.markForReplay()
+      registry.replayAfterAuthentication()
+      dispose()
+      registry.handleResponse(
+        streamingResponse(requestId, { type: 'ready', subscriptionId: 'new-connection-id' })
+      )
+
+      expect(unsubscribes(sent)).toEqual([{ subscriptionId: 'new-connection-id' }])
+    })
+
+    it('forgets the previous connection id when marked for replay', () => {
+      const { registry, sent, dispose } = subscribeReady()
+
+      registry.markForReplay()
+      dispose()
+
+      // A disposal while disconnected has nothing to name on the next connection.
+      expect(unsubscribes(sent)).toEqual([])
+      expect(registry.size()).toBe(0)
+    })
+
+    it('still releases a stream cancelled before its first ready', () => {
+      const { registry, sent } = createRegistry()
+      const dispose = registry.subscribe(method, params, () => {})
+      const requestId = sent[0]!.id
+
+      dispose()
+      expect(unsubscribes(sent)).toEqual([])
+      registry.handleResponse(
+        streamingResponse(requestId, { type: 'ready', subscriptionId: 'first-id' })
+      )
+
+      expect(unsubscribes(sent)).toEqual([{ subscriptionId: 'first-id' }])
+      expect(registry.size()).toBe(0)
+    })
+
+    it('sends one unsubscribe however often the stream is disposed', () => {
+      const { registry, sent, dispose, requestId } = subscribeReady()
+
+      registry.markForReplay()
+      registry.replayAfterAuthentication()
+      dispose()
+      dispose()
+      registry.handleResponse(
+        streamingResponse(requestId, { type: 'ready', subscriptionId: 'new-connection-id' })
+      )
+      dispose()
+
+      expect(unsubscribes(sent)).toEqual([{ subscriptionId: 'new-connection-id' }])
+      expect(registry.size()).toBe(0)
+    })
+  })
 })
diff --git a/mobile/src/transport/rpc-client-stream-registry.ts b/mobile/src/transport/rpc-client-stream-registry.ts
index f7e6e6de932..1b0ab747e85 100644
--- a/mobile/src/transport/rpc-client-stream-registry.ts
+++ b/mobile/src/transport/rpc-client-stream-registry.ts
@@ -3,17 +3,18 @@ import {
   type BrowserScreencastFrame
 } from './browser-screencast-protocol'
 import {
-  buildStreamUnsubscribe,
-  buildTerminalUnsubscribeParams,
+  buildRequestStreamUnsubscribe,
   updateTerminalSubscriptionViewport
 } from './rpc-client-terminal-subscription'
 import { buildReadyStreamUnsubscribe, isReadyIdStream } from './rpc-client-server-subscription'
 import { isStreamingOpenerReply } from './rpc-acceptance-policies'
 import {
+  isStreamEndResult,
   isStreamingSubscriptionReadyResult,
   isTerminalSubscribedResult
 } from './rpc-subscription-result-shapes'
 import { RpcClientTerminalStreamRouter } from './rpc-client-terminal-stream-router'
+import * as sessionTabsStream from './rpc-client-session-tabs-stream'
 import type { ConnectionState, RpcResponse, RpcSuccess } from './types'
 
 export type RpcStreamingListener = (result: unknown) => void
@@ -30,6 +31,7 @@ type StreamRequest = {
   subscriptionId?: string
   cancelled?: boolean
   sent?: boolean
+  receivedSnapshot?: boolean
 }
 
 type StreamRegistryOptions = {
@@ -68,8 +70,7 @@ export class RpcClientStreamRegistry {
       if (this.send(id, stream)) {
         stream.sent = true
       } else {
-        this.emitError(stream, 'Connection interrupted')
-        this.remove(id)
+        this.finish(id, stream, { type: 'error', message: 'Connection interrupted' })
       }
     } else {
       console.log('[net] subscribe queued — waiting for connected', {
@@ -108,6 +109,7 @@ export class RpcClientStreamRegistry {
     this.pendingBrowserRequestId = null
     for (const [id, stream] of this.streams) {
       stream.sent = false
+      stream.receivedSnapshot = false
       // The id named a registration on the closed socket; the replay's ready brings the new one.
       stream.subscriptionId = undefined
       this.resetTerminalRouting(id)
@@ -122,11 +124,8 @@ export class RpcClientStreamRegistry {
     const stream = this.streams.get(response.id)
     if (response.ok) {
       const result = (response as RpcSuccess).result as Record<string, unknown> | null
-      if (stream && result?.type === 'end') {
-        if (!stream.cancelled) {
-          stream.listener(result)
-        }
-        this.remove(response.id)
+      if (stream && isStreamEndResult(result)) {
+        this.finish(response.id, stream, result)
         return true
       }
       if (stream && result?.type === 'scrollback') {
@@ -137,12 +136,13 @@ export class RpcClientStreamRegistry {
     if (!stream) {
       return false
     }
-    this.emitError(
-      stream,
-      response.ok ? 'Streaming request ended before it was ready.' : response.error.message,
-      response.ok ? undefined : response.error
-    )
-    this.remove(response.id)
+    this.finish(response.id, stream, {
+      type: 'error',
+      message: response.ok
+        ? 'Streaming request ended before it was ready.'
+        : response.error.message,
+      error: response.ok ? undefined : response.error
+    })
     return true
   }
 
@@ -169,6 +169,14 @@ export class RpcClientStreamRegistry {
       return
     }
     const result = response.result
+    if (isStreamEndResult(result)) {
+      this.finish(response.id, stream, result)
+      return
+    }
+    if (sessionTabsStream.recordSnapshot(stream, result) && stream.cancelled) {
+      this.dispose(response.id)
+      return
+    }
     if (isStreamingSubscriptionReadyResult(result)) {
       stream.subscriptionId = result.subscriptionId
       if (stream.cancelled) {
@@ -206,16 +214,12 @@ export class RpcClientStreamRegistry {
       this.disposeServerSubscription(id, stream)
       return
     }
-    if (stream?.method === 'terminal.subscribe') {
-      const params = buildTerminalUnsubscribeParams(stream.params)
-      if (params) {
-        this.sendRpc('terminal.unsubscribe', params)
-      }
-    } else {
-      const unsubscribe = buildStreamUnsubscribe(stream?.method, stream?.params)
-      if (unsubscribe) {
-        this.sendRpc(unsubscribe.method, unsubscribe.params)
-      }
+    if (stream && sessionTabsStream.holdUnsubscribe(stream)) {
+      return
+    }
+    const unsubscribe = buildRequestStreamUnsubscribe(stream?.method, stream?.params, id)
+    if (unsubscribe) {
+      this.sendRpc(unsubscribe.method, unsubscribe.params)
     }
     this.remove(id)
   }
@@ -307,9 +311,12 @@ export class RpcClientStreamRegistry {
     stream.onBinaryFrame?.(frame)
   }
 
-  private emitError(stream: StreamRequest, message: string, error?: unknown): void {
-    if (!stream.cancelled) {
-      stream.listener({ type: 'error', message, error })
+  /** Removed first, so neither the listener's dispose nor a replay can name a host-ended stream. */
+  private finish(id: string, stream: StreamRequest, result: unknown): void {
+    const notify = !stream.cancelled
+    this.remove(id)
+    if (notify) {
+      stream.listener(result)
     }
   }
 }
diff --git a/mobile/src/transport/rpc-client-terminal-subscription.ts b/mobile/src/transport/rpc-client-terminal-subscription.ts
index 405f7f1d9e0..a5db812be14 100644
--- a/mobile/src/transport/rpc-client-terminal-subscription.ts
+++ b/mobile/src/transport/rpc-client-terminal-subscription.ts
@@ -53,6 +53,14 @@ export function buildStreamUnsubscribe(
         }
       : null
   }
+  if (method === 'agentSession.subscribe') {
+    const sessionId = (params as { sessionId?: unknown }).sessionId
+    // The host keys each transcript stream by its frame id; without it every stream of the
+    // session on this socket would end.
+    return typeof sessionId === 'string' && requestId
+      ? { method: 'agentSession.unsubscribe', params: { sessionId, subscriptionId: requestId } }
+      : null
+  }
   if (method === 'nativeChat.subscribe') {
     const subscriptionId = (params as { subscriptionId?: unknown }).subscriptionId
     if (typeof subscriptionId === 'string') {
@@ -68,6 +76,22 @@ export function buildStreamUnsubscribe(
   return null
 }
 
+/** Direct-connection unsubscribe for the stream opened by `requestId`, or null when none is required. */
+export function buildRequestStreamUnsubscribe(
+  method: string | undefined,
+  params: unknown,
+  requestId: string
+): { method: string; params: Record<string, unknown> } | null {
+  if (method !== 'terminal.subscribe') {
+    return buildStreamUnsubscribe(method, params, requestId)
+  }
+  const unsubscribeParams = buildTerminalUnsubscribeParams(params)
+  // Why: `requestId` names this exact request; hosts that predate it strip it and use the slot.
+  return unsubscribeParams
+    ? { method: 'terminal.unsubscribe', params: { ...unsubscribeParams, requestId } }
+    : null
+}
+
 export function buildTerminalUnsubscribeParams(
   params: unknown
 ): { subscriptionId: string; client?: { id: string } } | null {
diff --git a/mobile/src/transport/rpc-client.test.ts b/mobile/src/transport/rpc-client.test.ts
index e88e6c220e6..ff290f72b84 100644
--- a/mobile/src/transport/rpc-client.test.ts
+++ b/mobile/src/transport/rpc-client.test.ts
@@ -196,12 +196,21 @@ describe('mobile rpc-client connection timeout', () => {
       { worktree: 'id:wt-1' },
       () => {}
     )
+    const request = sentRequest(socket, 'session.tabs.subscribe')
+    socket.receive(
+      `encrypted:${JSON.stringify({
+        id: request.id,
+        ok: true,
+        streaming: true,
+        result: { type: 'snapshot', worktree: 'id:wt-1', tabs: [] },
+        _meta: { runtimeId: 'r1' }
+      })}`
+    )
     unsubscribe()
 
-    expect(
-      socket.sent.some((payload) => payload.includes('"method":"session.tabs.unsubscribe"'))
-    ).toBe(true)
-    expect(socket.sent.some((payload) => payload.includes('"worktree":"id:wt-1"'))).toBe(true)
+    expect(sentRequests(socket, 'session.tabs.unsubscribe')).toEqual([
+      expect.objectContaining({ params: { worktree: 'id:wt-1', subscriptionId: request.id } })
+    ])
 
     client.close()
   })
diff --git a/mobile/src/transport/rpc-subscription-inventory.ts b/mobile/src/transport/rpc-subscription-inventory.ts
index 60b458f4b10..b23cd622fd3 100644
--- a/mobile/src/transport/rpc-subscription-inventory.ts
+++ b/mobile/src/transport/rpc-subscription-inventory.ts
@@ -106,7 +106,7 @@ export const RPC_SUBSCRIPTION_SITES: readonly RpcSubscriptionSite[] = [
   {
     file: 'src/session/use-mobile-structured-agent-state.ts',
     method: 'agentSession.subscribe',
-    release: 'connection-close',
+    release: 'params',
     coverage: { kind: 'unwritten-scenario' }
   },
   // The session tab snapshot. Mountable behind the reconciliation controller the hook already
diff --git a/mobile/src/transport/rpc-subscription-result-shapes.ts b/mobile/src/transport/rpc-subscription-result-shapes.ts
index cf09acdb6ca..fa5970f5b23 100644
--- a/mobile/src/transport/rpc-subscription-result-shapes.ts
+++ b/mobile/src/transport/rpc-subscription-result-shapes.ts
@@ -19,3 +19,11 @@ export function isStreamingSubscriptionReadyResult(
     typeof (value as { subscriptionId?: unknown }).subscriptionId === 'string'
   )
 }
+
+export function isStreamEndResult(value: unknown): value is { type: 'end' } {
+  return typeof value === 'object' && value !== null && 'type' in value && value.type === 'end'
+}
+
+export function isSnapshotResult(value: unknown): value is { type: 'snapshot' } {
+  return typeof value === 'object' && value !== null && 'type' in value && value.type === 'snapshot'
+}
diff --git a/mobile/src/transport/runtime-status-probe.test.ts b/mobile/src/transport/runtime-status-probe.test.ts
index 93b36d6dc2f..697a0e7d85f 100644
--- a/mobile/src/transport/runtime-status-probe.test.ts
+++ b/mobile/src/transport/runtime-status-probe.test.ts
@@ -92,4 +92,31 @@ describe('startRuntimeStatusProbe', () => {
     expect(calls()).toBe(3)
     cancel()
   })
+
+  it('reports each failed attempt once its retry is scheduled, and never an answer', async () => {
+    const { client } = makeClient([
+      new Error('request timed out'),
+      new LogicalClientCutoverError(),
+      ok(null)
+    ])
+    const seen: (HostStatusReply | null)[] = []
+    let failed = 0
+    const cancel = startRuntimeStatusProbe(
+      client,
+      (status) => seen.push(status),
+      () => {
+        failed += 1
+      }
+    )
+    await flushMicrotasks()
+    expect(failed).toBe(1)
+    await vi.advanceTimersByTimeAsync(1_000)
+    await flushMicrotasks()
+    expect(failed).toBe(2)
+    await vi.advanceTimersByTimeAsync(250)
+    await flushMicrotasks()
+    expect(seen).toEqual([null])
+    expect(failed).toBe(2)
+    cancel()
+  })
 })
diff --git a/mobile/src/transport/runtime-status-probe.ts b/mobile/src/transport/runtime-status-probe.ts
index 1d748e1e685..08e0943e1b0 100644
--- a/mobile/src/transport/runtime-status-probe.ts
+++ b/mobile/src/transport/runtime-status-probe.ts
@@ -15,12 +15,16 @@ const FAILURE_RETRY_MAX_DELAY_MS = 15_000
  * answered something this build cannot decode — an answer, not a failure, so it is delivered
  * rather than retried. A refusal or transport rejection schedules a retry instead.
  *
+ * `onAttemptFailed` runs on each refusal or rejection, once its retry is scheduled, for a caller
+ * that must show something while the probe keeps asking.
+ *
  * The parameter names the raw port rather than RpcClient because one of the capability callers
  * holds only the sender; the request itself goes through hostStatusProbe.
  */
 export function startRuntimeStatusProbe(
   client: UnvalidatedRpcRequestPort,
-  onStatus: (status: HostStatusReply | null) => void
+  onStatus: (status: HostStatusReply | null) => void,
+  onAttemptFailed?: () => void
 ): () => void {
   let cancelled = false
   let retryTimer: ReturnType<typeof setTimeout> | null = null
@@ -55,6 +59,7 @@ export function startRuntimeStatusProbe(
       ? CUTOVER_RETRY_DELAY_MS
       : Math.min(FAILURE_RETRY_BASE_DELAY_MS * 2 ** failureRetries++, FAILURE_RETRY_MAX_DELAY_MS)
     retryTimer = setTimeout(attempt, delay)
+    onAttemptFailed?.()
   }
 
   attempt()
diff --git a/mobile/src/transport/settings-host-client-lifecycle.test.ts b/mobile/src/transport/settings-host-client-lifecycle.test.ts
index e6c55117e0d..44a9a94f86a 100644
--- a/mobile/src/transport/settings-host-client-lifecycle.test.ts
+++ b/mobile/src/transport/settings-host-client-lifecycle.test.ts
@@ -44,6 +44,9 @@ vi.mock('./host-store', () => ({
 vi.mock('./connection-revival-triggers', () => ({
   subscribeConnectionRevivalTriggers: () => () => {}
 }))
+vi.mock('./connection-log-background-flush', () => ({
+  subscribeConnectionLogBackgroundFlush: () => () => {}
+}))
 
 type FakeClient = RpcClient & {
   closeMock: ReturnType<typeof vi.fn>
diff --git a/mobile/src/transport/timer-receiver-census.test.ts b/mobile/src/transport/timer-receiver-census.test.ts
deleted file mode 100644
index d6cc23bee2f..00000000000
--- a/mobile/src/transport/timer-receiver-census.test.ts
+++ /dev/null
@@ -1,126 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { relative } from 'node:path'
-import { fileURLToPath } from 'node:url'
-import ts from 'typescript-api'
-import { describe, expect, it } from 'vitest'
-import { censusSourceFiles } from '../test-support/census-source-files'
-
-const SOURCE_ROOT = fileURLToPath(new URL('..', import.meta.url))
-const TIMER_GLOBALS = new Set(['setTimeout', 'clearTimeout', 'setInterval', 'clearInterval'])
-const GLOBAL_RECEIVERS = new Set(['global', 'globalThis', 'window'])
-const SHARED_DEFAULTS = new Set(['defaultScheduleTimer', 'defaultCancelTimer'])
-
-// Sites that take their default from timer-scheduler; the census is meaningless if it
-// cannot see them, so an empty or misdirected walk fails instead of passing vacuously.
-const SHARED_DEFAULT_SITES = [
-  'files/mobile-file-preview-navigation.ts',
-  'transport/host-open-retry-scheduler.ts',
-  'transport/mobile-endpoint-lifecycle.ts',
-  'transport/mobile-endpoint-supervisor-test-fakes.ts',
-  'transport/rpc-session-liveness-watchdog.ts'
-]
-
-const PARKING_OPERATORS = new Set([
-  ts.SyntaxKind.QuestionQuestionToken,
-  ts.SyntaxKind.QuestionQuestionEqualsToken,
-  ts.SyntaxKind.BarBarToken,
-  ts.SyntaxKind.BarBarEqualsToken
-])
-
-type Census = { parked: string[]; shared: string[] }
-
-function productFiles(): string[] {
-  return censusSourceFiles(SOURCE_ROOT)
-    .map((path) => relative(SOURCE_ROOT, path).replaceAll('\\', '/'))
-    .filter((entry) => /\.tsx?$/.test(entry) && !/\.test\.tsx?$/.test(entry))
-}
-
-function timerName(node: ts.Node): string | null {
-  if (ts.isIdentifier(node) && TIMER_GLOBALS.has(node.text)) {
-    return node.text
-  }
-  if (
-    ts.isPropertyAccessExpression(node) &&
-    TIMER_GLOBALS.has(node.name.text) &&
-    ts.isIdentifier(node.expression) &&
-    GLOBAL_RECEIVERS.has(node.expression.text)
-  ) {
-    return node.name.text
-  }
-  return null
-}
-
-// The receiver is only lost once the function is parked somewhere a later call reaches
-// through: a nullish/logical default, an object literal member, or an assignment onto a
-// property. A plain local capture stays legal: calling it bare leaves the receiver undefined.
-function parkedTimer(node: ts.Node): ts.Node | null {
-  if (ts.isBinaryExpression(node)) {
-    const operator = node.operatorToken.kind
-    const parks =
-      PARKING_OPERATORS.has(operator) ||
-      (operator === ts.SyntaxKind.EqualsToken && ts.isPropertyAccessExpression(node.left))
-    return parks ? node.right : null
-  }
-  if (ts.isPropertyAssignment(node)) {
-    return node.initializer
-  }
-  if (ts.isShorthandPropertyAssignment(node)) {
-    return node.name
-  }
-  return null
-}
-
-function scanSource(relativePath: string, text: string, census: Census): void {
-  const sourceFile = ts.createSourceFile(relativePath, text, ts.ScriptTarget.Latest, true)
-  const visit = (node: ts.Node): void => {
-    const candidate = parkedTimer(node)
-    const name = candidate === null ? null : timerName(candidate)
-    if (candidate !== null && name !== null) {
-      const line = sourceFile.getLineAndCharacterOfPosition(candidate.getStart(sourceFile)).line + 1
-      census.parked.push(`${relativePath}:${line} ${name}`)
-    }
-    if (ts.isIdentifier(node) && SHARED_DEFAULTS.has(node.text)) {
-      census.shared.push(relativePath)
-    }
-    ts.forEachChild(node, visit)
-  }
-  visit(sourceFile)
-}
-
-function parkedIn(source: string): string[] {
-  const census: Census = { parked: [], shared: [] }
-  scanSource('fixture.ts', source, census)
-  return census.parked
-}
-
-describe('global timer receiver census', () => {
-  const census: Census = { parked: [], shared: [] }
-  for (const relativePath of productFiles()) {
-    scanSource(relativePath, readFileSync(`${SOURCE_ROOT}${relativePath}`, 'utf8'), census)
-  }
-
-  it('sees the shared receiver-free defaults, so an empty or misdirected walk cannot pass', () => {
-    expect(census.shared).toEqual(expect.arrayContaining(SHARED_DEFAULT_SITES))
-  })
-
-  it('parks no bare global timer where a later call would supply a non-global receiver', () => {
-    expect(census.parked).toEqual([])
-  })
-
-  it.each([
-    ['a nullish default', 'const schedule = injected ?? setTimeout'],
-    ['a logical default', 'const schedule = injected || setTimeout'],
-    ['a nullish assignment default', 'schedule ??= setTimeout'],
-    ['a logical assignment default', 'schedule ||= setTimeout'],
-    ['an object literal member', 'const deps = { setTimer: setTimeout }'],
-    ['a shorthand object member', 'const deps = { setTimeout }'],
-    ['an assignment onto a property', 'this.setTimer = setTimeout'],
-    ['a qualified global read', 'const deps = { setTimer: globalThis.setTimeout }']
-  ])('flags a global timer parked by %s', (_form, source) => {
-    expect(parkedIn(source)).toEqual(['fixture.ts:1 setTimeout'])
-  })
-
-  it('leaves a plain local capture alone, which a bare call invokes receiver-free', () => {
-    expect(parkedIn('const schedule = globalThis.setTimeout')).toEqual([])
-  })
-})
diff --git a/mobile/src/transport/types.ts b/mobile/src/transport/types.ts
index 0ed86a7a986..d9c9271c79d 100644
--- a/mobile/src/transport/types.ts
+++ b/mobile/src/transport/types.ts
@@ -4,11 +4,9 @@ import {
   type PairingOffer
 } from '../../../src/shared/mobile-relay-pairing-offer'
 import {
-  MobileAccessEndpointSchema,
-  type MobileAccessEndpoint,
-  type MobileRelayHostOverlay
-} from './mobile-relay-host-overlay'
-import { MobileRelayEndpointSchema } from '../../../src/shared/mobile-relay-credential-contract'
+  MobileRelayEndpointSchema,
+  type MobileRelayEndpoint
+} from '../../../src/shared/mobile-relay-credential-contract'
 import { NODE_PLATFORM_NAMES } from './mobile-runtime-host-platform'
 import { salvagedOptional } from '../../../src/shared/zod-salvage'
 
@@ -116,9 +114,8 @@ export type HostProfile = {
   deviceToken: string
   publicKeyB64: string
   lastConnected: number
-  endpoints?: MobileAccessEndpoint[]
-  relayHostId?: MobileRelayHostOverlay['relayHostId']
-  relay?: MobileRelayHostOverlay['relay']
+  /** Relay routing, joined from the overlay; only `setRelayRouting` and pairing write it. */
+  relay?: MobileRelayEndpoint
 }
 
 export type HostCredentialStatus = 'ready' | 'temporarily-unavailable' | 'missing'
@@ -148,11 +145,6 @@ export const HostProfileSchema = z.object({
   deviceToken: z.string().min(1),
   publicKeyB64: z.string().min(1),
   lastConnected: z.number().finite(),
-  endpoints: z.array(MobileAccessEndpointSchema).min(1).max(16).optional(),
-  relayHostId: z
-    .string()
-    .regex(/^[A-Za-z0-9_-]{16}$/)
-    .optional(),
   relay: MobileRelayEndpointSchema.optional()
 })
 
diff --git a/mobile/src/transport/unchecked-rpc-reader-boundary.test.ts b/mobile/src/transport/unchecked-rpc-reader-boundary.test.ts
index f452a7bd564..463ba943cb5 100644
--- a/mobile/src/transport/unchecked-rpc-reader-boundary.test.ts
+++ b/mobile/src/transport/unchecked-rpc-reader-boundary.test.ts
@@ -128,11 +128,6 @@ describe('unchecked RPC reader boundary', () => {
     expect(observed.size).toBe(inventory.length)
   })
 
-  it('lists each file once', () => {
-    const seen = inventory.map((entry) => entry.file)
-    expect(seen.filter((file, index) => seen.indexOf(file) !== index)).toEqual([])
-  })
-
   it('has no unlisted file holding an unchecked reader', () => {
     const listed = new Set(inventory.map((entry) => entry.file))
     const unlisted = [...observed.keys()].filter((file) => !listed.has(file))
diff --git a/mobile/src/worktree/agent-row-display.test.ts b/mobile/src/worktree/agent-row-display.test.ts
index ee872e40f26..47898017ff8 100644
--- a/mobile/src/worktree/agent-row-display.test.ts
+++ b/mobile/src/worktree/agent-row-display.test.ts
@@ -1,13 +1,26 @@
 import { describe, expect, it } from 'vitest'
 import type { RuntimeWorktreeAgentRow } from '../../../src/shared/runtime-types'
+import {
+  agentMainAgentVerdict,
+  agentVerdictDisplayMark
+} from '../../../src/shared/agent-main-agent-verdict'
+import { AGENT_JOURNAL_TURN_OUTCOMES } from '../../../src/shared/agent-turn-outcome'
 import {
   AGENT_STATUS_STALE_AFTER_MS,
   agentDisplayLabel,
   agentDotState,
   agentIdentityLabel,
+  agentRowTimeAt,
+  agentRowVerdict,
+  agentRowVerdictMark,
   formatTimeAgo
 } from './agent-row-display'
 
+type Outcome = (typeof AGENT_JOURNAL_TURN_OUTCOMES)[number]
+const mainAgentDone = (outcome: Outcome, stateStartedAt = 0) => ({
+  mainAgent: { state: 'done' as const, outcome, stateStartedAt }
+})
+
 function row(overrides: Partial<RuntimeWorktreeAgentRow> = {}): RuntimeWorktreeAgentRow {
   return {
     paneKey: 'p',
@@ -37,8 +50,54 @@ describe('agentDotState', () => {
     expect(agentDotState(row({ state: 'unknown-state' as never }), 0)).toBe('idle')
   })
 
-  it('reports interrupted regardless of state', () => {
+  it('reports the verdict of a done row: failed, interrupted, or an old host legacy flag', () => {
     expect(agentDotState(row({ state: 'done', interrupted: true }), 0)).toBe('interrupted')
+    expect(agentDotState(row({ state: 'done', ...mainAgentDone('failure') }), 0)).toBe('failed')
+    expect(
+      agentDotState(row({ state: 'done', ...mainAgentDone('cancellation'), interrupted: true }), 0)
+    ).toBe('interrupted')
+    expect(agentDotState(row({ state: 'done', ...mainAgentDone('success') }), 0)).toBe('done')
+  })
+
+  it('shows a main agent that failed while its subagents still run as failed', () => {
+    expect(agentDotState(row({ state: 'working', ...mainAgentDone('failure') }), 0)).toBe('failed')
+    expect(agentDotState(row({ state: 'waiting', ...mainAgentDone('failure') }), 0)).toBe('failed')
+    // Only a failure outranks live work; a success or a stop with live subagents reads working.
+    expect(agentDotState(row({ state: 'working', ...mainAgentDone('success') }), 0)).toBe('working')
+    expect(
+      agentDotState(
+        row({ state: 'working', ...mainAgentDone('cancellation'), interrupted: true }),
+        0
+      )
+    ).toBe('working')
+  })
+
+  // The shared accessor cannot be imported by app code here, so this mirror must not drift from it.
+  it('agrees with the desktop verdict accessor on every row', () => {
+    const states = ['working', 'blocked', 'waiting', 'done'] as const
+    const mainAgents = [
+      undefined,
+      ...states.flatMap((state) =>
+        [undefined, ...AGENT_JOURNAL_TURN_OUTCOMES].map((outcome) => ({
+          state,
+          ...(outcome ? { outcome } : {}),
+          stateStartedAt: 0
+        }))
+      )
+    ]
+    for (const state of states) {
+      for (const mainAgent of mainAgents) {
+        for (const interrupted of [false, true]) {
+          const agentRow = { state, interrupted, ...(mainAgent ? { mainAgent } : {}) }
+          expect(agentRowVerdict(agentRow), JSON.stringify(agentRow)).toBe(
+            agentMainAgentVerdict(agentRow)
+          )
+          expect(agentRowVerdictMark(agentRow), JSON.stringify(agentRow)).toBe(
+            agentVerdictDisplayMark(agentRow)
+          )
+        }
+      }
+    }
   })
 
   it('decays a stale active state to idle, matching desktop', () => {
@@ -51,14 +110,36 @@ describe('agentDotState', () => {
     expect(
       agentDotState(row({ state: 'working', updatedAt: 0 }), AGENT_STATUS_STALE_AFTER_MS)
     ).toBe('working')
-    // 'done' never decays; interrupted still wins.
+    // 'done' never decays, and neither does its verdict.
     expect(agentDotState(row({ state: 'done', updatedAt: 0 }), stale)).toBe('done')
-    expect(agentDotState(row({ state: 'working', updatedAt: 0, interrupted: true }), stale)).toBe(
+    expect(agentDotState(row({ state: 'done', updatedAt: 0, interrupted: true }), stale)).toBe(
       'interrupted'
     )
   })
 })
 
+describe('agentRowTimeAt', () => {
+  it('dates a main agent that failed while its subagents run by its own failure', () => {
+    expect(
+      agentRowTimeAt(
+        row({ state: 'working', stateStartedAt: 100, ...mainAgentDone('failure', 900) })
+      )
+    ).toBe(900)
+  })
+
+  it('dates every other row by when its state began', () => {
+    expect(
+      agentRowTimeAt(
+        row({ state: 'working', stateStartedAt: 100, ...mainAgentDone('success', 900) })
+      )
+    ).toBe(100)
+    expect(
+      agentRowTimeAt(row({ state: 'done', stateStartedAt: 100, ...mainAgentDone('failure', 900) }))
+    ).toBe(100)
+    expect(agentRowTimeAt(row({ state: 'working', stateStartedAt: 100 }))).toBe(100)
+  })
+})
+
 describe('agentDisplayLabel', () => {
   it('prefers last message, then prompt, then state label', () => {
     expect(agentDisplayLabel(row({ lastAssistantMessage: 'hello there' }), 0)).toBe('hello there')
diff --git a/mobile/src/worktree/agent-row-display.ts b/mobile/src/worktree/agent-row-display.ts
index c678b522a15..da93aa39220 100644
--- a/mobile/src/worktree/agent-row-display.ts
+++ b/mobile/src/worktree/agent-row-display.ts
@@ -1,4 +1,5 @@
 import type { RuntimeWorktreeAgentRow } from '../../../src/shared/runtime-types'
+import type { AgentJournalTurnOutcome } from '../../../src/shared/agent-turn-outcome'
 
 // Mirrors the desktop AGENT_STATUS_STALE_AFTER_MS (src/shared/agent-status-types.ts:
 // 30 min). Defined locally rather than imported because a runtime-value import
@@ -17,13 +18,39 @@ export type AgentDotState =
   | 'done'
   | 'idle'
   | 'interrupted'
+  | 'failed'
+
+type AgentRowVerdictSource = Pick<RuntimeWorktreeAgentRow, 'state' | 'interrupted' | 'mainAgent'>
+
+// Mirrors desktop agentMainAgentVerdict and agentVerdictDisplayMark
+// (src/shared/agent-main-agent-verdict.ts); a parity test runs both over one table. `mainAgent` is
+// the main agent's own status, sent also while subagents hold the row working; an old host sends none.
+export function agentRowVerdict(row: AgentRowVerdictSource): AgentJournalTurnOutcome | null {
+  if (row.mainAgent && row.mainAgent.state !== 'done') {
+    return null
+  }
+  return row.mainAgent?.outcome ?? (row.state === 'done' && row.interrupted ? 'cancellation' : null)
+}
+
+// A failure outranks every state; a stop marks only a row that is itself done.
+export function agentRowVerdictMark(row: AgentRowVerdictSource): 'failed' | 'interrupted' | null {
+  const verdict = agentRowVerdict(row)
+  if (verdict === 'failure') {
+    return 'failed'
+  }
+  return verdict === 'cancellation' && row.state === 'done' ? 'interrupted' : null
+}
 
 export function agentDotState(
-  row: Pick<RuntimeWorktreeAgentRow, 'state' | 'workingMode' | 'interrupted' | 'updatedAt'>,
+  row: Pick<
+    RuntimeWorktreeAgentRow,
+    'state' | 'workingMode' | 'interrupted' | 'mainAgent' | 'updatedAt'
+  >,
   now: number
 ): AgentDotState {
-  if (row.interrupted) {
-    return 'interrupted'
+  const mark = agentRowVerdictMark(row)
+  if (mark) {
+    return mark
   }
   switch (row.state) {
     case 'blocked':
@@ -56,6 +83,8 @@ export function agentStateLabel(state: AgentDotState): string {
       return 'Waiting for input'
     case 'interrupted':
       return 'Interrupted'
+    case 'failed':
+      return 'Failed'
     case 'done':
       return 'Done'
     case 'idle':
@@ -99,6 +128,17 @@ export function agentIdentityLabel(agentType: string | null): string {
   return known[normalized] ?? normalized.slice(0, 2).toUpperCase()
 }
 
+// When the row's state began, except that a main agent that failed while its subagents run is
+// dated by its own failure. Mirrors desktop lastEnteredDoneAt (agent-finished-timestamp.ts).
+export function agentRowTimeAt(
+  row: Pick<RuntimeWorktreeAgentRow, 'state' | 'interrupted' | 'mainAgent' | 'stateStartedAt'>
+): number {
+  if (row.state !== 'done' && row.mainAgent && agentRowVerdictMark(row) === 'failed') {
+    return row.mainAgent.stateStartedAt
+  }
+  return row.stateStartedAt
+}
+
 // Relative time, matching desktop formatTimeAgo thresholds (just now / Xm / Xh / Xd).
 export function formatTimeAgo(ts: number, now: number): string {
   const delta = now - ts
diff --git a/mobile/src/worktree/home-resume-card.test.ts b/mobile/src/worktree/home-resume-card.test.ts
index 85c6cbab8ee..04a02a7331c 100644
--- a/mobile/src/worktree/home-resume-card.test.ts
+++ b/mobile/src/worktree/home-resume-card.test.ts
@@ -1,4 +1,3 @@
-import { readFileSync } from 'node:fs'
 import { describe, expect, it } from 'vitest'
 import {
   isResumeTargetConfirmedMissing,
@@ -7,11 +6,6 @@ import {
 } from './home-resume-card'
 import type { HomeWorktreeSummary, HostWorktreeInfo } from './home-worktree-info'
 
-const resumeCardSource = readFileSync(
-  new URL('../home/MobileHomeResumeCard.tsx', import.meta.url),
-  'utf8'
-)
-
 function worktree(worktreeId: string): HomeWorktreeSummary {
   return {
     worktreeId,
@@ -121,11 +115,6 @@ describe('home resume card', () => {
       actionable: true
     })
   })
-
-  it('renders the home Resume card inert until its host connects', () => {
-    expect(resumeCardSource).toContain('disabled={!props.card.actionable}')
-    expect(resumeCardSource).toContain('!props.card.actionable && styles.cardDisabled')
-  })
 })
 
 // Why (F7): the card is drawn from a snapshot that can name a workspace the desktop deleted
diff --git a/mobile/src/worktree/workspace-list-picker-options.test.ts b/mobile/src/worktree/workspace-list-picker-options.test.ts
deleted file mode 100644
index b9964fc3850..00000000000
--- a/mobile/src/worktree/workspace-list-picker-options.test.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { WORKSPACE_SORT_OPTIONS } from './workspace-list-picker-options'
-
-describe('WORKSPACE_SORT_OPTIONS', () => {
-  it('keeps the persisted sort values stable for desktop compatibility', () => {
-    expect(WORKSPACE_SORT_OPTIONS.map((option) => option.value)).toEqual([
-      'smart',
-      'name',
-      'recent',
-      'repo',
-      'manual'
-    ])
-  })
-
-  it('keeps the smart sort value while showing the agent activity label', () => {
-    expect(WORKSPACE_SORT_OPTIONS.find((option) => option.value === 'smart')).toEqual({
-      value: 'smart',
-      label: 'Agent activity',
-      subtitle: 'Agents that need attention, then recent activity'
-    })
-  })
-})
diff --git a/mobile/src/worktree/worktree-list-snapshot.test.ts b/mobile/src/worktree/worktree-list-snapshot.test.ts
index c7c5756160f..25c9ecbe852 100644
--- a/mobile/src/worktree/worktree-list-snapshot.test.ts
+++ b/mobile/src/worktree/worktree-list-snapshot.test.ts
@@ -21,6 +21,13 @@ function agent(overrides: Partial<RuntimeWorktreeAgentRow> = {}): RuntimeWorktre
   }
 }
 
+function done(
+  outcome: 'success' | 'failure',
+  stateStartedAt = 1
+): NonNullable<RuntimeWorktreeAgentRow['mainAgent']> {
+  return { state: 'done', outcome, stateStartedAt }
+}
+
 function worktree(overrides: Partial<Worktree> = {}): Worktree {
   const worktreePath = join('/tmp', 'orca', 'worktrees', 'manta')
   return {
@@ -160,6 +167,31 @@ describe('areWorktreeListsEqual', () => {
     expect(areWorktreeListsEqual(first, second)).toBe(false)
   })
 
+  it('detects a verdict change that leaves the interrupted flag as it was', () => {
+    const first = [worktree({ agents: [agent({ state: 'done', mainAgent: done('success') })] })]
+    const second = [worktree({ agents: [agent({ state: 'done', mainAgent: done('failure') })] })]
+
+    expect(areWorktreeListsEqual(first, second)).toBe(false)
+  })
+
+  it('detects a main agent failing while its subagents keep the row working', () => {
+    const first = [worktree({ agents: [agent({ state: 'working' })] })]
+    const second = [worktree({ agents: [agent({ state: 'working', mainAgent: done('failure') })] })]
+
+    expect(areWorktreeListsEqual(first, second)).toBe(false)
+  })
+
+  it('detects the main agent clock moving, which dates a failure', () => {
+    const at = (stateStartedAt: number) => [
+      worktree({
+        agents: [agent({ state: 'working', mainAgent: done('failure', stateStartedAt) })]
+      })
+    ]
+
+    expect(areWorktreeListsEqual(at(1), at(2))).toBe(false)
+    expect(areWorktreeListsEqual(at(1), at(1))).toBe(true)
+  })
+
   it('detects monitoring mode changes within working', () => {
     const first = [worktree({ agents: [agent({ state: 'working' })] })]
     const second = [worktree({ agents: [agent({ state: 'working', workingMode: 'monitoring' })] })]
diff --git a/mobile/src/worktree/worktree-list-snapshot.ts b/mobile/src/worktree/worktree-list-snapshot.ts
index 8fa27c2a197..250c871493f 100644
--- a/mobile/src/worktree/worktree-list-snapshot.ts
+++ b/mobile/src/worktree/worktree-list-snapshot.ts
@@ -110,6 +110,7 @@ function areAgentRowsEqual(
       a.toolName !== b.toolName ||
       a.toolInput !== b.toolInput ||
       a.interrupted !== b.interrupted ||
+      !areMainAgentsEqual(a.mainAgent, b.mainAgent) ||
       a.stateStartedAt !== b.stateStartedAt ||
       a.updatedAt !== b.updatedAt
     ) {
@@ -118,3 +119,20 @@ function areAgentRowsEqual(
   }
   return true
 }
+
+function areMainAgentsEqual(
+  left: RuntimeWorktreeAgentRow['mainAgent'],
+  right: RuntimeWorktreeAgentRow['mainAgent']
+): boolean {
+  if (left === right) {
+    return true
+  }
+  if (!left || !right) {
+    return false
+  }
+  return (
+    left.state === right.state &&
+    left.outcome === right.outcome &&
+    left.stateStartedAt === right.stateStartedAt
+  )
+}
diff --git a/mobile/tests-typecheck-baseline.txt b/mobile/tests-typecheck-baseline.txt
index 34dd8f7cf66..ab63d955f7a 100644
--- a/mobile/tests-typecheck-baseline.txt
+++ b/mobile/tests-typecheck-baseline.txt
@@ -53,7 +53,6 @@ src/session/QuickCommandsSheet.test.ts
 src/session/ai-vault-resume-launch.test.ts
 src/session/mobile-file-tap-open.test.ts
 src/session/mobile-native-chat-open-file.test.ts
-src/session/mobile-session-route-parity.test.ts
 src/session/mobile-session-tab-activation.test.ts
 src/session/mobile-worker-takeover-send-sites.test.ts
 src/session/pending-terminal-handle-recovery-poll.test.ts
diff --git a/mobile/web-entry/index.tsx b/mobile/web-entry/index.tsx
index 2c346e0dbf2..57936f04252 100644
--- a/mobile/web-entry/index.tsx
+++ b/mobile/web-entry/index.tsx
@@ -20,6 +20,7 @@ import { PageFaultBoundary } from '../src/mobile-web-shell/bridge/page-fault-bou
 import { publishPageHostProfile } from '../src/mobile-web-shell/bridge/page-host-profile'
 import { publishExternalLinkOpener } from '../src/platform/external-link.web'
 import { publishHapticsNotifier } from '../src/platform/haptics.web'
+import { publishShellKeyboardSource } from '../src/platform/keyboard-occlusion.web'
 // Named with its extension: this entry is the web build's and the provider it needs is the web
 // sibling's, which takes the page's client. The screens below still import `./client-context`
 // and reach the same module, because the builder resolves both specifiers to the same file.
@@ -111,6 +112,11 @@ bootstrapShellPage({
     // The same shape again, and for the same reason: every haptic on this page is played from a
     // plain function inside a row's press handler, which no provider wraps.
     publishHapticsNotifier((kind) => client.notifyHaptics(kind))
+    // The shell's keyboard height, read by plain functions as well as hooks; 0 while it is closed.
+    publishShellKeyboardSource({
+      read: () => client.getShellSession()?.keyboardInset ?? 0,
+      subscribe: client.onKeyboardInsetUpdate
+    })
     // Scoped to the host `init` named: with none, no key is writable, which is the right answer
     // for a shell too old to say whose list this is.
     publishPageStorage(
diff --git a/mobile/web-entry/web-overrides.json b/mobile/web-entry/web-overrides.json
index 50a31ed61cb..62ad176c57d 100644
--- a/mobile/web-entry/web-overrides.json
+++ b/mobile/web-entry/web-overrides.json
@@ -29,6 +29,10 @@
       "file": "src/transport/host-device-token-store.web.ts",
       "reason": "expo-secure-store resolves to {} on web, and the bridge carries the RPC, so the page holds no device token."
     },
+    {
+      "file": "src/platform/host-os.web.ts",
+      "reason": "Platform.OS is web inside the shell's page, but the keyboard the page lifts over is the phone's, reported in that OS's own terms: iOS counts the home indicator. Keyboard and inset arithmetic branches on the host OS, so this answers the phone's OS from the WebView's user agent, and the page computes what the native screen computes."
+    },
     {
       "file": "app/_layout.web.tsx",
       "reason": "The page's route tree starts at app/h, so without a root layout expo-router mounts DefaultNavigator, an all-edges SafeAreaView that would pad every screen a second time. The native root owns pairing and push and cannot reach the page. This one adds no padding and feeds the insets the shell sent in init to react-native-safe-area-context, whose web provider reads env(safe-area-inset-*) as 0 in both WebViews."
@@ -69,6 +73,14 @@
       "file": "src/platform/keyboard-occlusion.web.ts",
       "reason": "react-native-web's Keyboard is a stub: addListener returns a subscription that never fires and isVisible() is always false, so a screen waiting for keyboardDidShow inside the page waits forever and the software keyboard covers whatever sits at the bottom of the document \u2014 the source-control commit bar, and the review note composer whose KeyboardAvoidingView is driven by those same events. The browser publishes the geometry a different way: the layout viewport keeps its size and visualViewport shrinks, so the occluded strip is innerHeight minus the visual viewport's height and offsetTop, tracked on its resize and scroll. A document with no visualViewport answers 0 rather than guessing."
     },
+    {
+      "file": "src/platform/keyboard-persisting-taps.web.ts",
+      "reason": "react-native-web ignores keyboardShouldPersistTaps, and its Pressable is a focusable element that takes focus on mousedown. On Pixel_API_37 a tap on a session tab or a dock key moved focus off the live input and the IME closed, while natively a Pressable never takes focus and those two ScrollViews persist taps. This sibling gives the tab bar ('handled') and the accessory bar ('always') the same rule by keeping a focused text field's focus through the mousedown; the native module returns no ref."
+    },
+    {
+      "file": "src/platform/live-input-composing-range.web.ts",
+      "reason": "The terminal's Live input reads the change event's isComposing as the text system's marked-text range, and on the page that event is the DOM's. An Android WebView marks the keyboard's composing region, which Samsung and other Latin keyboards keep over every word, so the preedit mirror held each word unsent until the next keystroke or Enter. Native Android reports no range at all; this sibling answers the same in an Android WebView and passes the DOM's range through in any other browser. The native file passes the event's own through."
+    },
     {
       "file": "src/platform/clipboard.web.ts",
       "reason": "expo-clipboard resolves to navigator.clipboard on the web, which needs a secure context; the iOS shell serves the page from the custom scheme orca-mobile-web://<session>/ while Android serves https, so that path would work on one platform and silently not on the other. This one asks the shell through the native.clipboard.write and native.clipboard.read verbs, where the pasteboard is the device's, and rejects when the route was not granted one so the caller's own catch puts that on screen. An image is the same pasteboard reached a different way: native.clipboard.read admits only text, and a 24 MiB base64 image cannot cross an 8 MiB reply cap, so readImage runs native.media.pick with source 'clipboard', reads the staged bytes back a chunk at a time and gives the handle back. contents answers per grant without probing, because the shell serves no 'is there text' verb and reading to find out would raise iOS's paste-consent prompt on every mount."
@@ -188,6 +200,10 @@
     {
       "file": "src/notifications/desktop-notification-channel.web.ts",
       "reason": "The page creates no Android notification channel and the native file already returns early off Android, so what this sibling changes is the import of expo-notifications, whose import-time read breaks the document for the reason push-token.web.ts beside it gives."
+    },
+    {
+      "file": "src/app-update/use-wall-app-update.web.ts",
+      "reason": "The update checker runs in the app, not the page. The native file hands the compatibility wall the release that check found; this one offers none, so the wall inside the page keeps its store or releases link and the page bundle never carries the checker."
     }
   ]
 }
diff --git a/native/computer-use-linux/runtime.py b/native/computer-use-linux/runtime.py
index ac53f6cf65f..464235b206a 100644
--- a/native/computer-use-linux/runtime.py
+++ b/native/computer-use-linux/runtime.py
@@ -406,8 +406,10 @@ def render_accessibility_tree(root, window_rect, root_path, compact_browser_tabs
                 truncation["maxDepthReached"] = True
             return
         item = record(node, len(records), path, window_rect)
-        child_items = list(children(node))
         role_key = (item["controlType"] or "").lower()
+        title = item["name"] or item["automationId"] or ""
+        suppressed = suppress_children(role_key, title, item["value"], None)
+        child_items = [] if suppressed else list(children(node))
         generic_summary = None
         if role_key in {"panel", "filler", "unknown", "section"} and not item["name"] and not item["value"]:
             summary_values = text_snippets(node, limit=8, max_depth=4)
@@ -418,7 +420,6 @@ def render_accessibility_tree(root, window_rect, root_path, compact_browser_tabs
                 walk(child, depth, path + [child_index])
             return
         records.append(item)
-        title = item["name"] or item["automationId"] or ""
         role_label = item["localizedControlType"] or item["controlType"]
         line = f'{item["index"]} {role_label} {sanitize_text(title)}'.rstrip()
         line += formatted_value(role_key, title, item["value"])
@@ -432,7 +433,7 @@ def render_accessibility_tree(root, window_rect, root_path, compact_browser_tabs
         if filtered_actions:
             line += ", Secondary Actions: " + ", ".join(display_action(action) for action in filtered_actions)
         lines.append(("\t" * depth) + line)
-        if generic_summary or suppress_children(role_key, title, item["value"], generic_summary):
+        if generic_summary or suppressed:
             return
         child_line_start = len(lines)
         for child_index, child in child_items:
diff --git a/native/computer-use-linux/runtime_render_test.py b/native/computer-use-linux/runtime_render_test.py
index 83a600c7d2d..d3672912ca6 100644
--- a/native/computer-use-linux/runtime_render_test.py
+++ b/native/computer-use-linux/runtime_render_test.py
@@ -98,6 +98,7 @@ class FakeAccessible:
 
 class FailingChildrenAccessible(FakeAccessible):
     def get_child_count(self):
+        self.counter["child_reads"] += 1
         raise RuntimeError("defunct node")
 
 
@@ -113,9 +114,63 @@ class RuntimeRenderTest(unittest.TestCase):
 
         self.assertEqual([record["name"] for record in records], ["Save"])
         self.assertEqual(lines, ["0 button Save"])
+        self.assertEqual(root.counter["child_reads"], 0)
+        self.assertFalse(truncation["truncated"])
+
+    def test_wide_labeled_controls_never_enumerate_suppressed_children(self):
+        roles = (
+            "button", "check box", "checkbox", "combo box", "heading", "link",
+            "menu item", "page tab", "push button", "radio button",
+        )
+        for role in roles:
+            with self.subTest(role=role):
+                root = FakeAccessible(
+                    role, "Save", children=[FakeAccessible("text", str(i)) for i in range(10000)]
+                )
+
+                records, lines, truncation = render(root)
+
+                self.assertEqual([item["runtimeId"] for item in records], [[0]])
+                self.assertEqual(lines, [f"0 {role} Save"])
+                self.assertEqual(root.counter["child_reads"], 0)
+                self.assertFalse(truncation["truncated"])
+
+    def test_control_value_or_identifier_keeps_suppression(self):
+        value_node = FakeAccessible("combo box", value="Choice", children=[FakeAccessible("text", "Child")])
+        identifier_node = FakeAccessible("button", children=[FakeAccessible("text", "Child")])
+        identifier_node.get_accessible_id = lambda: "save-button"
+        for root, expected in (
+            (value_node, "0 combo box, Value: Choice"),
+            (identifier_node, "0 button save-button"),
+        ):
+            with self.subTest(expected=expected):
+                records, lines, truncation = render(root)
+
+                self.assertEqual(len(records), 1)
+                self.assertEqual(lines, [expected])
+                self.assertEqual(root.counter["child_reads"], 0)
+                self.assertFalse(truncation["truncated"])
+
+    def test_unlabeled_controls_keep_child_indices_and_depth(self):
+        root = FakeAccessible("button", children=[FakeAccessible("button", "Nested")])
+
+        records, lines, truncation = render(root)
+
+        self.assertEqual([item["runtimeId"] for item in records], [[0], [0, 0]])
+        self.assertEqual(lines, ["0 button", "\t1 button Nested"])
         self.assertEqual(root.counter["child_reads"], 2)
         self.assertFalse(truncation["truncated"])
 
+    def test_suppressed_child_failure_keeps_control_output(self):
+        root = FailingChildrenAccessible("button", "Save")
+
+        records, lines, truncation = render(root)
+
+        self.assertEqual([item["name"] for item in records], ["Save"])
+        self.assertEqual(lines, ["0 button Save"])
+        self.assertFalse(truncation["truncated"])
+        self.assertEqual(root.counter["child_reads"], 0)
+
     def test_named_generic_node_skips_unused_summary_walk(self):
         root = FakeAccessible("section", "Details", children=[FakeAccessible("text", "body")])
 
diff --git a/native/windows-cli-launcher/OrcaCliLauncher.cs b/native/windows-cli-launcher/OrcaCliLauncher.cs
index 6261775859b..3357c7b1596 100644
--- a/native/windows-cli-launcher/OrcaCliLauncher.cs
+++ b/native/windows-cli-launcher/OrcaCliLauncher.cs
@@ -2,6 +2,15 @@ using System;
 using System.Diagnostics;
 using System.IO;
 using System.Text;
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+[assembly: AssemblyTitle("Orca CLI Launcher")]
+[assembly: AssemblyDescription("Command-line launcher for Orca")]
+[assembly: AssemblyCompany("Stably AI")]
+[assembly: AssemblyProduct("Orca")]
+[assembly: AssemblyCopyright("Copyright © Stably AI")]
+[assembly: ComVisible(false)]
 
 internal static class OrcaCliLauncher
 {
diff --git a/native/windows-cli-launcher/app.manifest b/native/windows-cli-launcher/app.manifest
new file mode 100644
index 00000000000..34f0426701c
--- /dev/null
+++ b/native/windows-cli-launcher/app.manifest
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+  <assemblyIdentity version="1.0.0.0" processorArchitecture="*" name="StablyAI.Orca.CliLauncher" type="win32"/>
+  <description>Orca CLI Launcher</description>
+  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
+    <security>
+      <requestedPrivileges>
+        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
+      </requestedPrivileges>
+    </security>
+  </trustInfo>
+  <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
+    <application>
+      <!-- Windows 10 and Windows 11 -->
+      <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
+    </application>
+  </compatibility>
+</assembly>
diff --git a/package.json b/package.json
index 5e88d8ab994..0b41ed3980a 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "orca",
-  "version": "1.4.197",
+  "version": "1.4.214",
   "description": "Next-gen IDE for parallel agentic development",
   "homepage": "https://github.com/stablyai/orca",
   "author": "stablyai",
@@ -14,7 +14,7 @@
     "audit:perf": "oxlint --config config/oxlint-performance-audit.json --format json src",
     "test:perf:contracts": "vitest run --config config/vitest.performance.config.ts",
     "format": "oxfmt --write .",
-    "lint": "oxlint && pnpm run audit:anti-slop && pnpm run audit:code-quality:native && pnpm run audit:code-quality:type-aware && pnpm run check:reliability-gates && pnpm run check:dead-classes && pnpm run check:max-lines-ratchet && pnpm run check:ts-nocheck-ratchet && pnpm run check:runtime-electron-ratchet && pnpm run check:readme-local-links && pnpm run verify:rpc-params-catalog && pnpm run verify:bundled-skill-guides && pnpm run verify:skill-bundle-manifest && pnpm run verify:localization-catalog && pnpm run verify:localization-runtime-catalog && pnpm run verify:localization-extraction && pnpm run verify:localization-coverage",
+    "lint": "oxlint && pnpm run audit:anti-slop && pnpm run audit:code-quality:native && pnpm run audit:code-quality:type-aware && pnpm run check:reliability-gates && pnpm run check:dead-classes && pnpm run check:max-lines-ratchet && pnpm run check:ts-nocheck-ratchet && pnpm run check:runtime-electron-ratchet && pnpm run check:readme-local-links && pnpm run verify:rpc-params-catalog && pnpm run verify:bundled-skill-guides && pnpm run verify:skill-bundle-manifest && pnpm run verify:localization-catalogs && pnpm run verify:localization-extraction && pnpm run verify:localization-coverage",
     "audit:code-quality": "pnpm run audit:code-quality:native && pnpm run audit:code-quality:type-aware && pnpm run audit:react-doctor",
     "audit:code-quality:native": "oxlint --config config/oxlint-code-quality-native-plugins.json src config tests mobile --deny-warnings",
     "audit:code-quality:type-aware": "oxlint --type-aware --config config/oxlint-code-quality-type-aware.json src config tests --deny-warnings",
@@ -30,6 +30,7 @@
     "lint:react-doctor:changed": "node config/scripts/lint-react-doctor-changed.mjs",
     "prepare": "husky",
     "test": "node config/scripts/ensure-native-runtime.mjs --runtime=node && vitest run --config config/vitest.config.ts",
+    "test:bun:profile": "node config/scripts/run-bun-profile-tests.mjs",
     "test:skill-sharing:release": "vitest run --config config/vitest.config.ts src/main/skills src/main/runtime/rpc/methods/skills.test.ts src/relay/skill-install-handler.test.ts src/shared/skill-bundle-install-contract.test.ts src/shared/skill-install-contract.test.ts src/shared/skill-install-failure.test.ts src/shared/skill-package-manifest.test.ts",
     "test:repro:remote-agent-session": "pnpm run build:cli && pnpm run build:electron-vite && node config/scripts/remote-agent-session-authority-repro.mjs",
     "capture:agent-transcript": "node config/scripts/ensure-native-runtime.mjs --runtime=node && node config/scripts/capture-agent-pty-transcript.mjs",
@@ -38,7 +39,8 @@
     "check:ts-nocheck-ratchet": "node config/scripts/check-ts-nocheck-ratchet.mjs",
     "check:runtime-electron-ratchet": "node config/scripts/check-runtime-electron-ratchet.mjs",
     "check:readme-local-links": "node config/scripts/check-readme-local-links.mjs",
-    "build:orcad": "node config/scripts/build-orcad.mjs",
+    "build:orcad": "node config/scripts/build-orcad-bun.mjs",
+    "build:orcad-template": "node config/scripts/build-orcad-template.mjs",
     "build:orcad-prebuilds": "node config/scripts/build-orcad-prebuilds.mjs",
     "smoke:orcad-terminal": "node config/scripts/ensure-native-runtime.mjs --runtime=node && pnpm run build:cli && pnpm run build:orcad && node config/scripts/runtime-serve-terminal-smoke.mjs --target orcad",
     "smoke:serve-terminal": "node config/scripts/runtime-serve-terminal-smoke.mjs",
@@ -79,6 +81,7 @@
     "verify:cli-bin": "node config/scripts/verify-cli-bin.mjs",
     "verify:built-skills-cli": "node config/scripts/verify-skills-cli-runtime.cjs out",
     "verify:renderer-boot-graph": "node config/scripts/verify-renderer-boot-graph.mjs",
+    "verify:localization-catalogs": "node config/scripts/verify-localization-catalogs.mjs",
     "verify:localization-catalog": "node config/scripts/verify-localization-catalog.mjs",
     "sync:localization-catalog": "node config/scripts/verify-localization-catalog.mjs --fix",
     "verify:localization-runtime-catalog": "node config/scripts/generate-runtime-required-english-catalog.mjs",
@@ -86,7 +89,8 @@
     "verify:localization-extraction": "node config/scripts/verify-localization-extraction.mjs",
     "verify:localization-coverage": "node config/scripts/audit-localization-coverage.mjs --check",
     "audit:localization": "node config/scripts/audit-localization-coverage.mjs",
-    "build:cli": "tsc -p config/tsconfig.cli.json --outDir out --composite false --incremental false && node config/scripts/verify-cli-bin.mjs --fix-executable --fix-package-json && node config/scripts/install-dev-cli.mjs",
+    "build:cli": "tsc -p config/tsconfig.cli.json --outDir out --composite false --incremental false && pnpm run prepare:cli-output",
+    "prepare:cli-output": "node config/scripts/verify-cli-bin.mjs --fix-executable --fix-package-json && node config/scripts/install-dev-cli.mjs",
     "test:linux-cli-contract": "node config/scripts/run-linux-cli-launch-contract-docker.mjs --appimage dist/orca-linux.AppImage",
     "test:repro:skills-cli-runtime": "pnpm run build:cli && pnpm run build:electron-vite && pnpm run verify:built-skills-cli",
     "build:electron-vite": "node config/scripts/run-electron-vite-build.mjs",
@@ -172,7 +176,7 @@
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.251",
     "@electron-toolkit/utils": "^4.0.0",
-    "@floating-ui/dom": "1.7.6",
+    "@floating-ui/dom": "1.8.0",
     "@linear/sdk": "^82.1.0",
     "@parcel/watcher": "^2.5.6",
     "@streamparser/json": "0.0.26",
@@ -183,18 +187,18 @@
     "i18next": "^26.3.1",
     "jsonc-parser": "^3.3.1",
     "node-pty": "^1.1.0",
-    "posthog-node": "^5.33.3",
+    "posthog-node": "^5.52.5",
     "proper-lockfile": "4.1.2",
     "qrcode": "^1.5.4",
-    "react-i18next": "17.0.13",
+    "react-i18next": "17.0.15",
     "serve-sim": "0.1.40",
     "sherpa-onnx": "1.12.37",
     "ssh2": "^1.17.0",
-    "tldts": "7.4.12",
+    "tldts": "7.4.14",
     "tweetnacl": "^1.0.3",
     "ws": "^8.21.3",
-    "yaml": "^2.8.4",
-    "zod": "~4.5.4"
+    "yaml": "^2.9.1",
+    "zod": "~4.6.5"
   },
   "devDependencies": {
     "@dnd-kit/core": "^6.3.1",
@@ -202,16 +206,16 @@
     "@electron-toolkit/tsconfig": "^2.0.0",
     "@electron/rebuild": "^4.2.0",
     "@monaco-editor/react": "^4.7.0",
-    "@oxlint/plugins": "1.80.0",
-    "@playwright/test": "^1.59.1",
-    "@sanity/diff-match-patch": "^3.2.0",
+    "@oxlint/plugins": "1.85.0",
+    "@playwright/test": "^1.63.0",
+    "@sanity/diff-match-patch": "^3.2.1",
     "@shadcn/lint": "^0.1.0",
-    "@stablyai/playwright-test": "^2.1.14",
+    "@stablyai/playwright-test": "^2.1.16",
     "@tailwindcss/vite": "^4.2.4",
-    "@tanstack/react-virtual": "^3.14.10",
+    "@tanstack/react-virtual": "^3.14.13",
     "@testing-library/jest-dom": "^6.9.1",
-    "@testing-library/react": "^16.3.2",
-    "@testing-library/user-event": "^14.6.1",
+    "@testing-library/react": "^16.3.3",
+    "@testing-library/user-event": "^14.6.7",
     "@tiptap/extension-code-block": "3.31.3",
     "@tiptap/extension-code-block-lowlight": "3.31.3",
     "@tiptap/extension-details": "3.31.3",
@@ -251,8 +255,8 @@
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
     "diff": "8.0.4",
-    "dompurify": "3.4.14",
-    "electron": "43.7.0",
+    "dompurify": "3.4.15",
+    "electron": "43.7.5",
     "electron-builder": "^26.15.3",
     "electron-builder-squirrel-windows": "^26.15.3",
     "electron-vite": "^5.0.0",
@@ -262,7 +266,7 @@
     "happy-dom": "^20.11.8",
     "html-to-image": "^1.11.13",
     "husky": "^9.1.7",
-    "i18next-cli": "1.65.0",
+    "i18next-cli": "1.74.2",
     "katex": "^0.16.45",
     "lint-staged": "^16.4.0",
     "lowlight": "^3.3.0",
@@ -270,8 +274,8 @@
     "marked": "^17.0.1",
     "mermaid": "^11.17.2",
     "monaco-editor": "^0.55.1",
-    "oxfmt": "^0.65.0",
-    "oxlint": "^1.80.0",
+    "oxfmt": "^0.70.0",
+    "oxlint": "^1.85.0",
     "oxlint-plugin-anti-slop": "github:dmmulroy/anti-slop#c44ef22ca116d0ba62a3ff663a0bd13a3f3fa40b",
     "oxlint-plugin-react-doctor": "0.9.1",
     "oxlint-tsgolint": "7.0.2001",
@@ -299,6 +303,7 @@
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.5.0",
     "tailwindcss": "^4.2.4",
+    "tar": "7.5.22",
     "tw-animate-css": "^1.4.0",
     "typescript": "^7.0.2",
     "typescript-api": "npm:typescript@6.0.3",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 513267db1e3..8b5c4b890d4 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -106,18 +106,19 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
-  monaco-editor>dompurify: 3.4.14
+  monaco-editor>dompurify: 3.4.15
 
 patchedDependencies:
-  '@vscode/windows-process-tree@0.8.0': e66202cc623996d02040c93449eb9ae353fddadf426cb53202a59ee710ee6fe7
-  '@xterm/addon-image@0.10.0-beta.300': 5fc280019957573eefe8daa2969534d6090ddb29c6b5842b8f22e99dc1ce3146
+  i18next-cli@1.74.2: 7955b89d3aa229f477408608d331f78c85148a85a85913729f89fac65ad8b207
+  '@vscode/windows-process-tree@0.8.0': b4be93859cefb159949d9cf05f97fa91a221dff0f793a6f03d02d78ae5b32035
+  '@xterm/addon-image@0.10.0-beta.300': e5254a46d6f57bef4a8a19683bfa685afa0ca0127545aea53b54a48104ca3562
   '@xterm/addon-ligatures@0.11.0-beta.300': 47405b9994b5acf1b4e90b49250358c1ca03649854d59560e7732b72fe336920
   '@xterm/addon-search@0.17.0-beta.300': eee5338dd2621ece46e79c61ec06766cd7fadaf79ffdb24e2a8ab68e97ef31f0
   '@xterm/addon-serialize@0.15.0-beta.300': b35533fe252e7e45433150170348889f4e08a6c17f7017ac34ea694d831fec7f
   '@xterm/addon-webgl@0.20.0-beta.299': 94687e89a0115e6e6aa102837f986debdc029c091527ee5eb4a4e17ceaf9473e
   '@xterm/xterm@6.1.0-beta.303': dd0ccc59cd1ccf99f4d76e5aa2456da165fa0804dce19a833d7638bd07ffa393
   lint-staged@16.4.0: 7333b3837f80a7fbd045964db6d76ba4fc118e49134bdbabb00585b6b7b60673
-  node-pty@1.1.0: 346cb29d33dd6eeb14910ff411c7584b0b2ff9a4b271c4b6d23c3b48e6548f74
+  node-pty@1.1.0: 92c95cffab383d86b3b13a460c75a08074468ebf1f3911db8e874e083201f192
 
 importers:
 
@@ -125,13 +126,13 @@ importers:
     dependencies:
       '@anthropic-ai/claude-agent-sdk':
         specifier: 0.3.251
-        version: 0.3.251(@anthropic-ai/sdk@0.122.0(zod@4.5.4))(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.5.4))(zod@4.5.4)
+        version: 0.3.251(@anthropic-ai/sdk@0.122.0(zod@4.6.5))(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.6.5))(zod@4.6.5)
       '@electron-toolkit/utils':
         specifier: ^4.0.0
-        version: 4.0.0(electron@43.7.0(supports-color@7.2.0))
+        version: 4.0.0(electron@43.7.5(supports-color@7.2.0))
       '@floating-ui/dom':
-        specifier: 1.7.6
-        version: 1.7.6
+        specifier: 1.8.0
+        version: 1.8.0
       '@linear/sdk':
         specifier: ^82.1.0
         version: 82.1.0(graphql@16.14.2)
@@ -161,10 +162,10 @@ importers:
         version: 3.3.1
       node-pty:
         specifier: ^1.1.0
-        version: 1.1.0(patch_hash=346cb29d33dd6eeb14910ff411c7584b0b2ff9a4b271c4b6d23c3b48e6548f74)
+        version: 1.1.0(patch_hash=92c95cffab383d86b3b13a460c75a08074468ebf1f3911db8e874e083201f192)
       posthog-node:
-        specifier: ^5.33.3
-        version: 5.33.3
+        specifier: ^5.52.5
+        version: 5.52.5
       proper-lockfile:
         specifier: 4.1.2
         version: 4.1.2
@@ -172,8 +173,8 @@ importers:
         specifier: ^1.5.4
         version: 1.5.4
       react-i18next:
-        specifier: 17.0.13
-        version: 17.0.13(i18next@26.3.1(typescript@7.0.2))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2)
+        specifier: 17.0.15
+        version: 17.0.15(i18next@26.3.1(typescript@7.0.2))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2)
       serve-sim:
         specifier: 0.1.40
         version: 0.1.40(typescript@7.0.2)
@@ -184,8 +185,8 @@ importers:
         specifier: ^1.17.0
         version: 1.17.0
       tldts:
-        specifier: 7.4.12
-        version: 7.4.12
+        specifier: 7.4.14
+        version: 7.4.14
       tweetnacl:
         specifier: ^1.0.3
         version: 1.0.3
@@ -193,11 +194,11 @@ importers:
         specifier: ^8.21.3
         version: 8.21.3
       yaml:
-        specifier: ^2.8.4
-        version: 2.8.4
+        specifier: ^2.9.1
+        version: 2.9.1
       zod:
-        specifier: ~4.5.4
-        version: 4.5.4
+        specifier: ~4.6.5
+        version: 4.6.5
     devDependencies:
       '@dnd-kit/core':
         specifier: ^6.3.1
@@ -215,35 +216,35 @@ importers:
         specifier: ^4.7.0
         version: 4.7.0(monaco-editor@0.55.1)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@oxlint/plugins':
-        specifier: 1.80.0
-        version: 1.80.0
+        specifier: 1.85.0
+        version: 1.85.0
       '@playwright/test':
-        specifier: ^1.59.1
-        version: 1.59.1
+        specifier: ^1.63.0
+        version: 1.63.0
       '@sanity/diff-match-patch':
-        specifier: ^3.2.0
-        version: 3.2.0
+        specifier: ^3.2.1
+        version: 3.2.1
       '@shadcn/lint':
         specifier: ^0.1.0
         version: 0.1.0(eslint@10.10.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@7.0.2)
       '@stablyai/playwright-test':
-        specifier: ^2.1.14
-        version: 2.1.14(@playwright/test@1.59.1)(zod@4.5.4)
+        specifier: ^2.1.16
+        version: 2.1.16(@playwright/test@1.63.0)(zod@4.6.5)
       '@tailwindcss/vite':
         specifier: ^4.2.4
-        version: 4.2.4(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4))
+        version: 4.2.4(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1))
       '@tanstack/react-virtual':
-        specifier: ^3.14.10
-        version: 3.14.10(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+        specifier: ^3.14.13
+        version: 3.14.13(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@testing-library/jest-dom':
         specifier: ^6.9.1
         version: 6.9.1
       '@testing-library/react':
-        specifier: ^16.3.2
-        version: 16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+        specifier: ^16.3.3
+        version: 16.3.3(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@testing-library/user-event':
-        specifier: ^14.6.1
-        version: 14.6.1(@testing-library/dom@10.4.1)
+        specifier: ^14.6.7
+        version: 14.6.7(@testing-library/dom@10.4.1)
       '@tiptap/extension-code-block':
         specifier: 3.31.3
         version: 3.31.3(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)
@@ -294,7 +295,7 @@ importers:
         version: 3.31.3
       '@tiptap/react':
         specifier: 3.31.3
-        version: 3.31.3(@floating-ui/dom@1.7.6)(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+        version: 3.31.3(@floating-ui/dom@1.8.0)(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@tiptap/starter-kit':
         specifier: 3.31.3
         version: 3.31.3
@@ -321,7 +322,7 @@ importers:
         version: 8.18.1
       '@vitejs/plugin-react':
         specifier: ^5.2.0
-        version: 5.2.0(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4))
+        version: 5.2.0(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1))
       '@vscode/ripgrep-universal':
         specifier: 1.18.0
         version: 1.18.0
@@ -330,7 +331,7 @@ importers:
         version: 0.12.0-beta.300(@xterm/xterm@6.1.0-beta.303(patch_hash=dd0ccc59cd1ccf99f4d76e5aa2456da165fa0804dce19a833d7638bd07ffa393))
       '@xterm/addon-image':
         specifier: 0.10.0-beta.300
-        version: 0.10.0-beta.300(patch_hash=5fc280019957573eefe8daa2969534d6090ddb29c6b5842b8f22e99dc1ce3146)(@xterm/xterm@6.1.0-beta.303(patch_hash=dd0ccc59cd1ccf99f4d76e5aa2456da165fa0804dce19a833d7638bd07ffa393))
+        version: 0.10.0-beta.300(patch_hash=e5254a46d6f57bef4a8a19683bfa685afa0ca0127545aea53b54a48104ca3562)(@xterm/xterm@6.1.0-beta.303(patch_hash=dd0ccc59cd1ccf99f4d76e5aa2456da165fa0804dce19a833d7638bd07ffa393))
       '@xterm/addon-ligatures':
         specifier: 0.11.0-beta.300
         version: 0.11.0-beta.300(patch_hash=47405b9994b5acf1b4e90b49250358c1ca03649854d59560e7732b72fe336920)(@xterm/xterm@6.1.0-beta.303(patch_hash=dd0ccc59cd1ccf99f4d76e5aa2456da165fa0804dce19a833d7638bd07ffa393))
@@ -362,11 +363,11 @@ importers:
         specifier: 8.0.4
         version: 8.0.4
       dompurify:
-        specifier: 3.4.14
-        version: 3.4.14
+        specifier: 3.4.15
+        version: 3.4.15
       electron:
-        specifier: 43.7.0
-        version: 43.7.0(supports-color@7.2.0)
+        specifier: 43.7.5
+        version: 43.7.5(supports-color@7.2.0)
       electron-builder:
         specifier: ^26.15.3
         version: 26.15.3(electron-builder-squirrel-windows@26.15.3)
@@ -375,7 +376,7 @@ importers:
         version: 26.15.3(dmg-builder@26.15.3)
       electron-vite:
         specifier: ^5.0.0
-        version: 5.0.0(@swc/core@1.15.46)(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4))
+        version: 5.0.0(@swc/core@1.15.46)(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1))
       emoji-picker-react:
         specifier: ^4.19.1
         version: 4.19.1(react@19.2.8)
@@ -395,8 +396,8 @@ importers:
         specifier: ^9.1.7
         version: 9.1.7
       i18next-cli:
-        specifier: 1.65.0
-        version: 1.65.0(@types/node@25.9.5)(react-dom@19.2.8(react@19.2.8))(typescript@7.0.2)
+        specifier: 1.74.2
+        version: 1.74.2(patch_hash=7955b89d3aa229f477408608d331f78c85148a85a85913729f89fac65ad8b207)(@types/node@25.9.5)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2)
       katex:
         specifier: ^0.16.45
         version: 0.16.45
@@ -419,11 +420,11 @@ importers:
         specifier: ^0.55.1
         version: 0.55.1
       oxfmt:
-        specifier: ^0.65.0
-        version: 0.65.0
+        specifier: ^0.70.0
+        version: 0.70.0
       oxlint:
-        specifier: ^1.80.0
-        version: 1.80.0(oxlint-tsgolint@7.0.2001)
+        specifier: ^1.85.0
+        version: 1.85.0(oxlint-tsgolint@7.0.2001)
       oxlint-plugin-anti-slop:
         specifier: github:dmmulroy/anti-slop#c44ef22ca116d0ba62a3ff663a0bd13a3f3fa40b
         version: https://codeload.github.com/dmmulroy/anti-slop/tar.gz/c44ef22ca116d0ba62a3ff663a0bd13a3f3fa40b
@@ -505,6 +506,9 @@ importers:
       tailwindcss:
         specifier: ^4.2.4
         version: 4.2.4
+      tar:
+        specifier: 7.5.22
+        version: 7.5.22
       tw-animate-css:
         specifier: ^1.4.0
         version: 1.4.0
@@ -519,10 +523,10 @@ importers:
         version: 11.0.5
       vite:
         specifier: npm:rolldown-vite@7.3.1
-        version: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4)
+        version: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1)
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@opentelemetry/api@1.9.1)(@types/node@25.9.5)(happy-dom@20.11.8)(msw@2.14.3(@types/node@25.9.5)(typescript@7.0.2))(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4))
+        version: 4.1.11(@opentelemetry/api@1.9.1)(@types/node@25.9.5)(happy-dom@20.11.8)(msw@2.14.3(@types/node@25.9.5)(typescript@7.0.2))(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1))
       vscode-oniguruma:
         specifier: ^2.0.1
         version: 2.0.1
@@ -538,7 +542,7 @@ importers:
         version: link:native/windows-registry
       '@vscode/windows-process-tree':
         specifier: 0.8.0
-        version: 0.8.0(patch_hash=e66202cc623996d02040c93449eb9ae353fddadf426cb53202a59ee710ee6fe7)
+        version: 0.8.0(patch_hash=b4be93859cefb159949d9cf05f97fa91a221dff0f793a6f03d02d78ae5b32035)
       sherpa-onnx-darwin-arm64:
         specifier: 1.12.37
         version: 1.12.37
@@ -1040,11 +1044,11 @@ packages:
     resolution: {integrity: sha512-IkO+/KEUvwbVpiURZg+P7zF74z5Jxe0UgJxVni+RtoHQ6IZieXaO02kmadomap/q+l6bc/jdPGGqTjhuZnuz1Q==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
-  '@floating-ui/core@1.7.5':
-    resolution: {integrity: sha512-1Ih4WTWyw0+lKyFMcBHGbb5U5FtuHJuujoyyr5zTaWS5EYMeT6Jb2AuDeftsCsEuchO+mM2ij5+q9crhydzLhQ==}
+  '@floating-ui/core@1.8.0':
+    resolution: {integrity: sha512-0CIZ5itps/8x7BG8dEIhs53BvCUH2PCoogtakwRTut+Arm58sJooJ0AuZhLw2HJYIR5cMLNPBSS728sPho2khQ==}
 
-  '@floating-ui/dom@1.7.6':
-    resolution: {integrity: sha512-9gZSAI5XM36880PPMm//9dfiEngYoC6Am2izES1FF406YFsjvyBMmeJ2g4SAju3xWwtuynNRFL2s9hgxpLI5SQ==}
+  '@floating-ui/dom@1.8.0':
+    resolution: {integrity: sha512-yXSrzeHZBTZadLOlfyhCkJHNeLJnHRnRInwdZ40L7ZiaAtrBwoYlsDrX3v5zB1Utk7CLfzcOVnVVWoXEky7Ceg==}
 
   '@floating-ui/react-dom@2.1.8':
     resolution: {integrity: sha512-cC52bHwM/n/CxS87FH0yWdngEZrjdtLW/qVruo68qg+prK7ZQ4YGdut2GyDVpoGeAYe/h899rVeOVm6Oi40k2A==}
@@ -1052,8 +1056,8 @@ packages:
       react: '>=16.8.0'
       react-dom: '>=16.8.0'
 
-  '@floating-ui/utils@0.2.11':
-    resolution: {integrity: sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==}
+  '@floating-ui/utils@0.2.12':
+    resolution: {integrity: sha512-HpCo8tmWzLVad5s2d19EhAz5zqrrQ6s69qd6moPMQvkOuSwDT1YgRfWSVuc4ennqrgv3OHppiOGMQ7oC13yIww==}
 
   '@graphql-typed-document-node/core@3.2.0':
     resolution: {integrity: sha512-mB9oAsNCm9aM3/SOv4YtBMqZbYj10R7dkq8byBqxGY/ncFwhf2oQzMV+LCRlWoDSEBJ3COiR1yeDvMtsoOsuFQ==}
@@ -1096,8 +1100,12 @@ packages:
     resolution: {integrity: sha512-3eTuUO1vH2cZm2ZKHeQxnOqlTi9EfZDGgIe3BL3I4u+rJHocr9Fz86M4fjYABPvFnQG/gGK551HqDiIcETwU6Q==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
 
-  '@inquirer/checkbox@5.2.1':
-    resolution: {integrity: sha512-b6xmA/VlTe0ZgDQHDui+Nav470u7u49nRd8/iuhOcQPO9Ch7lGuogydhi2VOmNlZ+zXcM8IcPuNSwQcdJaF/kw==}
+  '@inquirer/ansi@2.0.8':
+    resolution: {integrity: sha512-WpQM+Ti6Z40EFwwt+uL2p4UabT+W179zHp6HhLVOzfbwnVn05IPO/eXIZXGNqcT1jbQ15SujNLzQ39k4QPPxBQ==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+
+  '@inquirer/checkbox@5.2.5':
+    resolution: {integrity: sha512-bRt8J8m+Fot9CXv+zNQGXUq2ET0MggR1fPz7v6edN6MFYmsbfGnMmkmWZJEegMKqrAC8ej/o1sqisHZXZJMAfQ==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1114,6 +1122,15 @@ packages:
       '@types/node':
         optional: true
 
+  '@inquirer/confirm@6.3.2':
+    resolution: {integrity: sha512-Xvr/0HggjddPtGppuqVmxhTw+Hr8PvsZ/k0HmOEaAqQEt80OITNkFWnsdNmyT0/eM4Ab+iJLx2R8rctlEyfSVg==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
   '@inquirer/core@11.2.1':
     resolution: {integrity: sha512-Qd6GJT1yVyrZZCfN8W2qKF5ApmqryXRhRKCuip8h01x2w/esJQ2XIYc6f9abMIHgKQdBfFTSOdbHRLAhuM09UA==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
@@ -1123,8 +1140,8 @@ packages:
       '@types/node':
         optional: true
 
-  '@inquirer/editor@5.2.2':
-    resolution: {integrity: sha512-ZRVd/oD+sYsUd5zVm0NflqEzlqfYCyHNsqkHl2oWXEUHs12tCbcSFi+wVFEvD8+LGRaMUsVrE7qeo6lSG/S1Vg==}
+  '@inquirer/core@12.0.3':
+    resolution: {integrity: sha512-wsSy0sznmXwkty+2PzZwx00Cazc/E0r0B7mAzdGROz2Ct+DFZXaK7WDjGZvgjRldxH5ZhFVfF2lgkYrqgOw2KA==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1132,8 +1149,8 @@ packages:
       '@types/node':
         optional: true
 
-  '@inquirer/expand@5.1.1':
-    resolution: {integrity: sha512-YmQpenjbFSHAK3sOd44puHh3V1KXXr+JiNpUztoSQ4drLh2rTVzTap/YtlAVu/5xavifIlBfNEzJ/neZJ1a/1g==}
+  '@inquirer/editor@5.3.3':
+    resolution: {integrity: sha512-YsKkS2q63IiLtaDK/9nqzdComN97SDQrmKiyNggN+ceP4ty+Z6VwyTz3FpjeUWeW1Efss2xHFKCC9sx7hnrsxg==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1141,8 +1158,17 @@ packages:
       '@types/node':
         optional: true
 
-  '@inquirer/external-editor@3.0.3':
-    resolution: {integrity: sha512-6thf5I8q7lZwzGLAxPaaGEREEkZ3nyePPDQ1oyobblxmEE8mqTLguScP7pDjUTAibiyb4hfXl+qjUEJ+di/aNA==}
+  '@inquirer/expand@5.1.5':
+    resolution: {integrity: sha512-uHuXLmXW+TtIfT/9vSBotypAkqn1n34Ul+CLGPos/xANyO4Ff5xZzkYhbKR4NEcfVK4a9mHQOpwVZzluSHFRGw==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/external-editor@3.0.5':
+    resolution: {integrity: sha512-f3QQJRIX5ZEneBHNUIuPjmbdzHnmRFJA8r2dkcb8q+OM5Uv5KtnuAttQumnrjcBVBM3mcTX1CkmtAkU58VRZxg==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1154,8 +1180,12 @@ packages:
     resolution: {integrity: sha512-aJ8TBPOGB6f/2qziPfElISTCEd5XOYTFckA2SGjhNmiKzfK/u4ot3v0DUzGVdUnKjN10EqnnEPck36BkyfLnJw==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
 
-  '@inquirer/input@5.1.2':
-    resolution: {integrity: sha512-9K/DDBSQpOyZSkt6sOVP9Vo0TR7atX2kuILsUu0x3wVcVbe97lJwIJKMLdMw25tDYuXl/qp6erT0Xs1rfmcfZg==}
+  '@inquirer/figures@2.0.9':
+    resolution: {integrity: sha512-EAWgUTGQ/Umgga51dE3B2PUHbufuXarDfg86uVgoSgNHNNQnyFKcOrQLWVqYMghuSyHh8+2HUH0Js9cTC1WAdg==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+
+  '@inquirer/input@5.1.6':
+    resolution: {integrity: sha512-HtcJhB2QFVXbLuJ5S3syhNbTUVxYvwqV4VRBDkQceBloC9bmTViUoRFP5PbSaDZb3HzfPmpuU/gG4ybVBz4FHA==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1163,8 +1193,8 @@ packages:
       '@types/node':
         optional: true
 
-  '@inquirer/number@4.1.1':
-    resolution: {integrity: sha512-XF4IXAbPnGPgw0wsbC/i2tPcyfdZgDpUlhsqU0SfT4IRIGWha6Xm9VRgN5yYxJq+jnyXlfXI/nQ3ulfk0iEICA==}
+  '@inquirer/number@4.2.3':
+    resolution: {integrity: sha512-6Yuwh1NGSbu1Lo4N1EWjXs1jKRntLg/ZCwhmeorEHde90v1XxAozdbd4Iu30eOQLW+6h1hp2O9ujNfLSbTPJnA==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1172,8 +1202,8 @@ packages:
       '@types/node':
         optional: true
 
-  '@inquirer/password@5.1.1':
-    resolution: {integrity: sha512-3XBfF7DAsp5qeDsvN5Rd1HmbNokVvEQoUM0QLrRcybC9nX96w3Pbmu7qUsb3IT3J3jBvs2+mTXaKHOUsgHMLzg==}
+  '@inquirer/password@5.2.2':
+    resolution: {integrity: sha512-W9zYdyzogK+6110mqwaSJWCBu2yA5Q/OfnGSjjZB1bNpHlmUozXxTl0+QOZBNeVd6Qo81/qT75gW05gLAtITxw==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1181,8 +1211,8 @@ packages:
       '@types/node':
         optional: true
 
-  '@inquirer/prompts@8.5.2':
-    resolution: {integrity: sha512-IYR/3C/paEVVQYQvdDlFZVjRCJVYHHON0XXMH91KO9GSxs0TdKYWlUdvfQl2EfAHDxUaN3IBffkE/BDTh5nJ6g==}
+  '@inquirer/prompts@8.7.2':
+    resolution: {integrity: sha512-QoRB4wFIjgH5iOhSjoIKMkTvSHDuV+O3OITlIqAYO0oK5x364GJILXiMBvlPiE+klg7Xx9tq5XVqQHcGUDYYPA==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1190,8 +1220,8 @@ packages:
       '@types/node':
         optional: true
 
-  '@inquirer/rawlist@5.3.1':
-    resolution: {integrity: sha512-QqdTqQddL3qPX/PPrjobpsO25NZ4dWXgTLenrR445L2ptLEYE6Z+PD5c5CNDJNx4ugRgELAIpSIJxZaO2jJ2Og==}
+  '@inquirer/rawlist@5.3.5':
+    resolution: {integrity: sha512-1oHky1ONfCOwNrnkQGDE1oaSij/3fI6HFMSf2H/WsGO2lEyDX9My82iggITSy9ddSZ8yk8j9v41OI0fVoSIoaA==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1199,8 +1229,8 @@ packages:
       '@types/node':
         optional: true
 
-  '@inquirer/search@4.2.1':
-    resolution: {integrity: sha512-xJj8QWKRSrfKoBIITLZK61dD3zwo0Rz11fgDImku30/Oe81zMdIdGgrLY2h6RkJ+KZ/GhNYIRMKnH/62qBTA5g==}
+  '@inquirer/search@4.3.3':
+    resolution: {integrity: sha512-fyuIU1Nbpvwlikjg3gXwJFDI11+EFjqQ7P+iByfmivIKQ1vmaykNrD/vy5unHuUqUpsOsnvJ25//tPF7E/RBRA==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1208,8 +1238,8 @@ packages:
       '@types/node':
         optional: true
 
-  '@inquirer/select@5.2.1':
-    resolution: {integrity: sha512-FlDndEUww8m7BfukO2nJa25vhD+H5jxxCv4oGioKqzyWz3nPHhhw4LKdYRSlXuAx7DsdWia7iyaBPKKS95Evfw==}
+  '@inquirer/select@5.2.5':
+    resolution: {integrity: sha512-9kc15hr8r/kI+3DO/xLog5nOzTz1jqsHXa6JBFzmQKhkoJ8Slda1I1L/uD8ZSZ9tF1yp79wwXe7mclvX1rqR2Q==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1226,6 +1256,15 @@ packages:
       '@types/node':
         optional: true
 
+  '@inquirer/type@4.1.1':
+    resolution: {integrity: sha512-yJoHYrMnxIsJZCY+0Vb66Dy3he3kL3e2wOBKhoSwWWAzZAY82emlxwgprCtp6yRixvNRNq9ztfRWQYPNr3Go7A==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
   '@isaacs/fs-minipass@4.0.1':
     resolution: {integrity: sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==}
     engines: {node: '>=18.0.0'}
@@ -1243,6 +1282,9 @@ packages:
   '@jridgewell/sourcemap-codec@1.5.5':
     resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
 
+  '@jridgewell/sourcemap-codec@1.6.0':
+    resolution: {integrity: sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==}
+
   '@jridgewell/trace-mapping@0.3.31':
     resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
 
@@ -1685,124 +1727,124 @@ packages:
   '@oxc-project/types@0.148.0':
     resolution: {integrity: sha512-Nm4s/jB+4FpFsPhWGEC4h7rzksesmtnMXomo6rCMcg/b8zLQuOziRgkCS1fxDCXOlJB/6Q8oABOZ/OP6RIPj9A==}
 
-  '@oxfmt/binding-android-arm-eabi@0.65.0':
-    resolution: {integrity: sha512-M10Gs1SSpTNI6ahGx3M/OlIdUF4hkaP6OgUb+MS79t/Pgflk3r1nW5gPFqsZGUAXg0H1AfANT9AvLdBSTIhZKg==}
+  '@oxfmt/binding-android-arm-eabi@0.70.0':
+    resolution: {integrity: sha512-Xd7YO4/T2axEj6FTLcj4Why3mTBqFMg+x24xtorT4Lb2+1g82090GH0a/4U1m0pABGYiix2bq1pqkYrmV3f0Sw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxfmt/binding-android-arm64@0.65.0':
-    resolution: {integrity: sha512-6DXH5sftNlaHpWJG50hFMF+Qxtq5D2TmahvcDPxWNcGIf8qrC9Y0YgHYcYZ2hlWzaccKXh/f3GcssH8vtkl4JA==}
+  '@oxfmt/binding-android-arm64@0.70.0':
+    resolution: {integrity: sha512-x9rlMYyKXdgKdYyUJzGsK1ZV8P4di/J32ipzcS6Jet6p9r9UAh28neXIMtdlSaJJycdi61Z4YkcLKLpk8ueFjg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxfmt/binding-darwin-arm64@0.65.0':
-    resolution: {integrity: sha512-K9m7lr53pcOLETNsC88sWes/GWHUGjZyHx95UhYcSXy0r30haLdeXlSufSenEAtoLaW753WN8/l4M7GYcRt6cg==}
+  '@oxfmt/binding-darwin-arm64@0.70.0':
+    resolution: {integrity: sha512-IUTUPvrBVYy7POh4stXzRdz4IVC/1QSaviCWoyenSlOhGu0X9j5K07vCTM9biLjAA2Zs31l0Rj5vvRpj9n95wA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxfmt/binding-darwin-x64@0.65.0':
-    resolution: {integrity: sha512-sTNwIx1gre3MyiHOPLu7IGW4UyMScYL4DTmJT01p4vzB0En+OJUQz6KuH8t0PpsClRSaMuY3b0QmtoPItfO8Lg==}
+  '@oxfmt/binding-darwin-x64@0.70.0':
+    resolution: {integrity: sha512-vw745q870oTd6J517O24asoX4/E+eK0nxYIFoedSLqgJ+nI5En7+ZS82iZSHZ69zevQrnOXiyHP01dA+t8xD8w==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxfmt/binding-freebsd-x64@0.65.0':
-    resolution: {integrity: sha512-lYZMVIiIpnjGu5hJb2jxA8NYQ/e0OTGuaiAf4dqlGPNnPmUTu23FZRMltmjro/KkQm1uE4NT4n5yJ2zWmKcpfA==}
+  '@oxfmt/binding-freebsd-x64@0.70.0':
+    resolution: {integrity: sha512-NO14EgSM9dFkcg+MfGPxvsKqXYs9LKaxPrOKXpv1R0rLokGGFDcCq6dBMq18dE4wlpFOovX0UZY2uh1P30O7QA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxfmt/binding-linux-arm-gnueabihf@0.65.0':
-    resolution: {integrity: sha512-gIdXFAt/bURnjxuoedDEWdZ0PEWEmdDcm8qdpoFYYvW3QMk/5D4vUaH4mlMeRpeTdST4izUgHVO6RawQ4QulJw==}
+  '@oxfmt/binding-linux-arm-gnueabihf@0.70.0':
+    resolution: {integrity: sha512-139OEhHarj9CYoJ/i9gXlPv4KLBGtLj2toseOWYFf09QwlhklaZk+wW3aOvlqoeZtuayvkoSNVWra7WJ21s3VQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxfmt/binding-linux-arm-musleabihf@0.65.0':
-    resolution: {integrity: sha512-jJVyADto7gA2AaX5qAjAexrxx9PJQaKWOe8PICE7yKMbjBRyOHcmj9TtVJ+MZYDUQ3hodU0AcoTj0jFQ1W4C6Q==}
+  '@oxfmt/binding-linux-arm-musleabihf@0.70.0':
+    resolution: {integrity: sha512-GEh2PY3IWTE0M24eNhTduountANSbWyDmMnzFSQE/nGg/bjPugbUgiGuFu+xdqcQSd/HKSwH80/F2yVVD48yhA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxfmt/binding-linux-arm64-gnu@0.65.0':
-    resolution: {integrity: sha512-p3RFkB+u7u+8up99b/NEcI1hdpLDiGgJYNwDorB60n7eH+eKposAKuMBxx+NqB3b+sJP4CZmYDh9G7X62tUsKg==}
+  '@oxfmt/binding-linux-arm64-gnu@0.70.0':
+    resolution: {integrity: sha512-En5i+UJmZSPxuSf47F2Hl5YOzKB0bicQLnGQkeTCMQ35cWLtbrSwACJKfiLqRZrk05DwSnsJkhBRaM3OURtIaA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-arm64-musl@0.65.0':
-    resolution: {integrity: sha512-5Prb0uFzJHr+OUD/qS/TmU526wD+PaHDsm3KoRiUXbMIDpTSErjeQYkK3OQeshAvD/PuLa9WGEi9WPajjdOZJg==}
+  '@oxfmt/binding-linux-arm64-musl@0.70.0':
+    resolution: {integrity: sha512-WWOoV5W9Im3flVwOVrWn/2DUlOF8v5vcCip+kcNuaMpulRCh6nzzt1Su2vcL2F908YJIXNV3HvegbBHuyLwKHg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-linux-ppc64-gnu@0.65.0':
-    resolution: {integrity: sha512-S8svxTp81obnF3admN9yd+u2rOYXtyzThLGBTg1PY6TPtGcC09BaaXLQD+TBSMa7yvqhCDZ8DFri+S/yG60qCg==}
+  '@oxfmt/binding-linux-ppc64-gnu@0.70.0':
+    resolution: {integrity: sha512-YUouneIqW+5n7aE8xx/zeZ6/utr/KH7oykcGoFyd8Uz8uh591T1oKlnoWA3BsRq/ZR42oY1w4MUYvS/0e/MQOA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-riscv64-gnu@0.65.0':
-    resolution: {integrity: sha512-WtXBr75G/h2qOHy8SiGtC1R6aS3jt4mE52v1D8AtwMXIgoOmSNP9lKvbSaTRoL0e5wsMPoi6T72QWDYPu+S+nA==}
+  '@oxfmt/binding-linux-riscv64-gnu@0.70.0':
+    resolution: {integrity: sha512-iEnMf21S5aGVa4hViDGY8sAQ/AHyCu2JPyrQF8P06wtHhSkD1YJBeT4m/KiGewgf7+a5XCYSCRIPcRQa1xwEoQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-riscv64-musl@0.65.0':
-    resolution: {integrity: sha512-YwSLVvpaz4o/nv/miiPEBJz+eJ+VmbgNIrao6RccK9ce+L5EA8wP+ZD0uFeq6wKOza6zoWv/dR0sj6lip6R3EA==}
+  '@oxfmt/binding-linux-riscv64-musl@0.70.0':
+    resolution: {integrity: sha512-91Sdniaj20fQzyMeCxMDzTP4c9s4RB8dGQ308xHhDR0n6U7+1Xq7N9klE7mfXq8iV3lRmIGSXi5X23Hn/0XX/g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-linux-s390x-gnu@0.65.0':
-    resolution: {integrity: sha512-XQTPqgvyrgkKcFq+Tp2eK6JS7sqqJ+nRmy2Fav4j3I+i4dJoPJm7YwEdoeSDX9xkqj9jZ/lWfF3bXUWztIrn6A==}
+  '@oxfmt/binding-linux-s390x-gnu@0.70.0':
+    resolution: {integrity: sha512-uUV30M6E+2TKKGMaKiwfeL4RZrviHXlUxsrYJ/jFBb+1EZy+pnFT+hF73eeWdzh5NqPOAnw0iiMAIqjqiLZPFg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-x64-gnu@0.65.0':
-    resolution: {integrity: sha512-cjZlx6S/VkeCNWCbwZriTnLnZeTcV3DEyeRGSw/2wwLP9viq+C0bJ4bC1k/ZLkFxDcB1lUgSasPkYGP1bdraOg==}
+  '@oxfmt/binding-linux-x64-gnu@0.70.0':
+    resolution: {integrity: sha512-ivMcX6kNDPhqtbOaBt/ItFlLlTlXNHLgRuNmxP6Na6UuYXRT10llpJcAPbGeRgjjb3Qzv4jwPp3fB0hui50WNQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-x64-musl@0.65.0':
-    resolution: {integrity: sha512-2azCjxdLtK4zCcIOU1dlXlU0xxfbPi6EjwWx7Ac7teWPidIIDOcIhudup83xNCKYhtqeVd/gaVDOxbUq4syXWA==}
+  '@oxfmt/binding-linux-x64-musl@0.70.0':
+    resolution: {integrity: sha512-w+S+fERxYmlZSyZlJK/U292FjyBoH8cCEj21/tYJX6atX5kNSn+HDkhlFQKT2zcMwUW0uAtUL/bOrlwJZwqRdA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-openharmony-arm64@0.65.0':
-    resolution: {integrity: sha512-KXQ7xi1e/voP0IQaw6fG6XY4Z5+Llf1XmRSZS1t7pVFCecFJ0iXaboKmVwjFtp5MLlT5iWQrJ2U1C3GJdZ2u+Q==}
+  '@oxfmt/binding-openharmony-arm64@0.70.0':
+    resolution: {integrity: sha512-Zlom1Xkx257R8bk4ZI4zJsrGno2opknz1+5v5baka3nn4FPyvNSdh8JUL4CdN1S1OWRMvJ9UJQ+RfIqGGCUEfA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxfmt/binding-win32-arm64-msvc@0.65.0':
-    resolution: {integrity: sha512-2FbbjG5jEqLSLKVJwBap84uJfpn5Y5A53KEO0aUNr+zeiRB9nyPUIFMcSbZVMFLitfBytFWRNngozXYjb6Rsbw==}
+  '@oxfmt/binding-win32-arm64-msvc@0.70.0':
+    resolution: {integrity: sha512-FQgPW5R17vzt7cgrJ8eG/dqX00o2xHsqFeLfw4xzA9FRHpN/DjFo9YDonvIIXGxiEuS9F/jZPnGO+KHNKuCo4Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxfmt/binding-win32-ia32-msvc@0.65.0':
-    resolution: {integrity: sha512-LJ+ZacAPSjegDOnSLyA1TMWAhdDrsK4el3REdr1oL2UtVBCMhO2II/Sb3cEW6mF2MfLhl8hDNCSvc7KSbgk3LQ==}
+  '@oxfmt/binding-win32-ia32-msvc@0.70.0':
+    resolution: {integrity: sha512-ZfZublNhZ+XBndMiXhkiLlPE+XyGRDa0CweeTL6t1fZypfCh1LTg7e5CvnOeTBunq15MskOcRempumSPGAaCQA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxfmt/binding-win32-x64-msvc@0.65.0':
-    resolution: {integrity: sha512-higu9cWEO6XXFzATD1jf0mCK34rNfN2H9JrJie7QB1IhleVpTh0QlLH9Ip2C1H/Nd5n0v5pvRtC+5R0uE4HpVg==}
+  '@oxfmt/binding-win32-x64-msvc@0.70.0':
+    resolution: {integrity: sha512-HlIZEn+WzLQL0DszNzldiRl/DPRCX5R0Vkt6qeUPR1YHwy52hZZo4x6HoTOVmKRP2wUiwPGtKsihNY/f8KRaBg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
@@ -1837,124 +1879,124 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@oxlint/binding-android-arm-eabi@1.80.0':
-    resolution: {integrity: sha512-RM3Plj+biQpxa5d1GOOX6ciDlcUROmm4OZ/pLTpitkQt2mJv4jhtY4cbgaetOm5UKWZe05/TGQ6o1Vl8EOHkrA==}
+  '@oxlint/binding-android-arm-eabi@1.85.0':
+    resolution: {integrity: sha512-q2KO/Zso9UT+OMn0NF9ywn4E4t0MI3yxiDhNyhsQ7DyQJrC4FhFE4TXOi4bktFnOWXTMds8qZSbpv2XwRaNOBg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxlint/binding-android-arm64@1.80.0':
-    resolution: {integrity: sha512-YlO5JEf0Yr2bUUlu8O8daVcUxtcGGbcSmyV7E7nSbJbfAdxTE0PFPwgnIlw7wXJaTYjb+qs5hI5q3jxUkI7cAw==}
+  '@oxlint/binding-android-arm64@1.85.0':
+    resolution: {integrity: sha512-SxLN3ALjoT9NNdvpjEevGeHvfzTAFrF0NBYB5tzK7/GtCKMze3j1e/m/X2ozqGj2U9hfGG/dg/OG8vpVK4PiDA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxlint/binding-darwin-arm64@1.80.0':
-    resolution: {integrity: sha512-BULDOyO3AhsmdWfQeIUCykDt3dd7XZBGLhp1eIh56skRv01O+cNjNPwXMIbeW1x4+pxcln5if72wcRgViVo7PA==}
+  '@oxlint/binding-darwin-arm64@1.85.0':
+    resolution: {integrity: sha512-Y/Sup/J4f0f9UGsSd/xyCNTeWL+gepO63GBdEDAfue9nBsnk9zMmnIXx1O6b1V8C90vB5nucYNZ0pbMXAp8zJA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxlint/binding-darwin-x64@1.80.0':
-    resolution: {integrity: sha512-YJ4JzLw7N5TDSQFlA0hAQGHvnDZgyypm1yunObVWcWiF9KM7eGCJKYKLgTC2Fi/57OdnBhbj4OkzPGdFQJ6HyA==}
+  '@oxlint/binding-darwin-x64@1.85.0':
+    resolution: {integrity: sha512-ApOSNC04ynpDTwvBD+//0wyfODRSbEzvRoKpX8teffmc27z8AockwSNeMXGJXn5KP85eahDgR/2llICWLkzcnw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxlint/binding-freebsd-x64@1.80.0':
-    resolution: {integrity: sha512-AYUIk5QnL0s8oWAYsREZwkRYy1SupJTXALo93J1TgzHywxQtdM99FecRMQ87MXEdPQ0j1TmEpeeq3fGNkpvMqg==}
+  '@oxlint/binding-freebsd-x64@1.85.0':
+    resolution: {integrity: sha512-bNrVrCOA/kHky3Tu79IXWXe5bhIgLXfUuUEDHlAGOHUk96MkvDZ1ecaQF19rwstrnaqfP1o9nBTqzIr9+ZHkUg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.80.0':
-    resolution: {integrity: sha512-9hBZVANupQ89W9dXyE0n8doCyaW5pDyGn3y6XlIMPZ+rIKuyqkr3SNUXmVJIhuvUq0NBU3RBiSXXE69l4XI6KA==}
+  '@oxlint/binding-linux-arm-gnueabihf@1.85.0':
+    resolution: {integrity: sha512-NUrzOJ1s/EqsVvfn2L/1D8Wro2LPIZUbihL8kOJLh5fEdGEN3rdOGUYq3HwnUIL8sjpoP+4N6RaGrgmMJnaMPw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm-musleabihf@1.80.0':
-    resolution: {integrity: sha512-SvS2uKqzY+pbfuvAHzH4338R6Zwo805GAwrIMVvK1KxoOWCIjZUdfzTCvilD7z6JK91v011+zYMryabhDo2AsQ==}
+  '@oxlint/binding-linux-arm-musleabihf@1.85.0':
+    resolution: {integrity: sha512-UJXrAT3E/RWkEqXLIs2ehETja1qfgkPb+5gwLIIS+o/6cf+grHvoOXTa5997a/YNQfcJS0DRBTOfZt95cvOI1g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm64-gnu@1.80.0':
-    resolution: {integrity: sha512-tCLadyqRVL3pQTRPNg7cjXKvcvS4fbyXeQHhKk5BTJ1oftQln5/yIIWbu/Xom/DX41zv2P9QGt6+D/TtQVtY3A==}
+  '@oxlint/binding-linux-arm64-gnu@1.85.0':
+    resolution: {integrity: sha512-lK40QLjI0HxigO7CjDDshEtfYIeiYS0020v5BHFPqN4uuQBQxd2K9LNom2dW15o9F1937quSCRVp4ZsVhdbYdg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-arm64-musl@1.80.0':
-    resolution: {integrity: sha512-XfpCNRlOPcLlJl4Bn/FUhjqlR6BVavEykERBf/MV7YA9VZDa5g5znVqYhyviMafcxS9Pe/i/kPvHNO0U6svEHQ==}
+  '@oxlint/binding-linux-arm64-musl@1.85.0':
+    resolution: {integrity: sha512-c2zbdBwGKreHXwRx3gWBuFGJxLhxgsg6YlZ+3H+RgRusU/UEV9jNwJ3HGYK+nRo0LvBa7mt6Kj86xoVotUo8cw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-ppc64-gnu@1.80.0':
-    resolution: {integrity: sha512-3I4yMwcFG9NeO8ioY6JBBuKsIm5GL/x7MATt1S4tVWaxPu5HcJ+XnLUbcVBTxG8q2Wu56HSj+NmXQiVYb1lp6A==}
+  '@oxlint/binding-linux-ppc64-gnu@1.85.0':
+    resolution: {integrity: sha512-tlt/Hy8lZ97/lCPmCgw/B3k/mwh+BzaIPbPkldZEly7TwLmx0xe2CQcaW2g/rR0dOgS9JNGCZsMEqLhUNMGvaw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-gnu@1.80.0':
-    resolution: {integrity: sha512-E1wAKymkpe1/E8helzBKdm81OBOF+ezxRyXRMEuik3ZpWDER5CPOKZwF66RsdwW98uwZv8UTFremUQtC1CzdJA==}
+  '@oxlint/binding-linux-riscv64-gnu@1.85.0':
+    resolution: {integrity: sha512-3tNR9Xey82X0zKuY1d8hJ6Rc9gwRDurmqGLnQZa5xqOXy8/YyiqFXjAtugkKLY82obOlpK1eSiDRlgcNPuxtIg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-musl@1.80.0':
-    resolution: {integrity: sha512-+gLRGD4sIo3+VA++iham5UxD9tKSoJ/VOrROCEXIcknrYtQg6iIQgvjN0cpiRF7N6UYC7pJbvHJlDnMge5LRpQ==}
+  '@oxlint/binding-linux-riscv64-musl@1.85.0':
+    resolution: {integrity: sha512-wbGRd5PqCcjkJFHhZuZ2OBSUQY9czlQsoA/cQQB9JK/L9mC5MQgGoKAh+xd8QjA5V+0D3j+Qd1lAWn1I8zlelA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-s390x-gnu@1.80.0':
-    resolution: {integrity: sha512-aR0PrzHj9leW3NmzBAAP4EzdoBNoJcs9sjnIQPIwyRnBGYrRbXUIpEB5Q39AqK3PLY5JK5uEhDQDiUa1QSAstw==}
+  '@oxlint/binding-linux-s390x-gnu@1.85.0':
+    resolution: {integrity: sha512-3Sn0kSrE4DPZCWV/8o+n4x3aFZxI9ulMnkYlwCbJ8eUVkwRK2IerohE/A/z3SNbCwoPFOCJmGE5Avrq0rrvdvQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-gnu@1.80.0':
-    resolution: {integrity: sha512-vSVh5cSo3Xxs6ghBCcFJlpbkbENzDog1qXtoXLa/HC3aCrR4XO76GZbXmQoCPHnu99nQpdCeC3H9tdNICfDh7A==}
+  '@oxlint/binding-linux-x64-gnu@1.85.0':
+    resolution: {integrity: sha512-JY2pxxYfB62bAGfejljVCqc44etItehPuAyaeSAdMuEMtwNA00ggMnS66lC1oIhos6oOXUkuU6mZ9bpFh3BqWg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-musl@1.80.0':
-    resolution: {integrity: sha512-FfzBXpNQ8u7/ZI/p8bl73MeZ508Ax3hxWp3SiJpEFiC+BB9XcXy5FAZHTLKDPSzrUpxQZSZJAVdDmuJp/+HDBQ==}
+  '@oxlint/binding-linux-x64-musl@1.85.0':
+    resolution: {integrity: sha512-5k74vZ6qJBjBHEOlBk9B/iv68Yu0F1Afw/vvT2ar6OGCqEeXLaSjXz2n/IPCbhLG22UoKoYEJTzpYraRdcp6PA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-openharmony-arm64@1.80.0':
-    resolution: {integrity: sha512-zMzbkumtmprCgRwoYNzcB3iC39fXdJIMLMU33KdCjEGLlJGOEt1+LwQ4LF8ndLzAEKVz4BR0y3V6Xrkk3Nm3yA==}
+  '@oxlint/binding-openharmony-arm64@1.85.0':
+    resolution: {integrity: sha512-GbAl5qt5TCkPLXTaIISZJnugrcBhra6rodcXc9jYt620UtdsTt71NlNmJmm0frxzFpd54x/G+MkitEJA8I/BoA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxlint/binding-win32-arm64-msvc@1.80.0':
-    resolution: {integrity: sha512-ib6iRcrXsk4t1fm3iKcwksyWh1ZkZXC/2mEzakl0ai2+6HZunf1WWMZ/xP9EJAvw9g9K4UVTC3NF/+G2qLrbTQ==}
+  '@oxlint/binding-win32-arm64-msvc@1.85.0':
+    resolution: {integrity: sha512-kjmws5MK0et2swk4ND85D7NVQyDHw162i6whtZDLUA/lo6FQyBZDcmMRCMcVZcNrAhIaftVb00x9ChGDOjjNJA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxlint/binding-win32-ia32-msvc@1.80.0':
-    resolution: {integrity: sha512-xhRWBMpLxZvgKAH6+DJZmpP+W8Y8UdQOSU1JfxSWNXsaBaRGW77j+1hCuNHlzj7OH4SPN8fYd1q0o2qrDtoVyw==}
+  '@oxlint/binding-win32-ia32-msvc@1.85.0':
+    resolution: {integrity: sha512-eSsIJx9n4yxvOqYTZyPEMyEXRmE60XH7xGAU7i0Qbsn1lf6Za3CWJ9aRd82oSFKXaxhp+sA6/yMJVRIpLpna6A==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxlint/binding-win32-x64-msvc@1.80.0':
-    resolution: {integrity: sha512-yAnO7lwBYQnz2pcfBPIGQQZWIX5zd5R/1aAKIF3oE+TVj7IhoHcROjOkz3sRDngzqhfPKfFaXqug5j5rE5dn6Q==}
+  '@oxlint/binding-win32-x64-msvc@1.85.0':
+    resolution: {integrity: sha512-pBebIPUpKKhWrhSMWhy8TdAZBewiXnfxmaAGxhzxM1068GagqFaTwgKlU6e+UyJ2sPR+VoHouhXuGJkQjsrDvA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
@@ -1963,8 +2005,8 @@ packages:
     resolution: {integrity: sha512-Ypt8KeRYw+4jUtlPirfcHWMrn5ms12VrrFPD+Mds477/7tJxG1Kcz2Yrg2nVcTQEUx/GdlhS+BUg1kmxNm04Ug==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
 
-  '@oxlint/plugins@1.80.0':
-    resolution: {integrity: sha512-QRgH1XqQEYNHa4f1vvPQ5fAdNdncHGIUG1ZWLlGIZHky3qwCEeAKYitZNbZMtaXtAQAAFFTOwqUfzESvimqZNA==}
+  '@oxlint/plugins@1.85.0':
+    resolution: {integrity: sha512-qqHqML3ME3cxGgFvWJG8wwMnJc9ol5SMdtqkq0k8r7l0USmC+HRXYjzDacME4Dqkx4yqrUsBhj0JYvji8fHxJQ==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
 
   '@parcel/watcher-android-arm64@2.5.6':
@@ -2069,16 +2111,16 @@ packages:
     resolution: {integrity: sha512-ODOov0sGMJMf3jPonOkgGqPknTsu+DdQ7kD++gz8aI+aFMOMHFbWAA2taqXXVTdP+OTOQR/znGvSpmkeI0WTYQ==}
     engines: {node: '>=14.18.0'}
 
-  '@playwright/test@1.59.1':
-    resolution: {integrity: sha512-PG6q63nQg5c9rIi4/Z5lR5IVF7yU5MqmKaPOe0HSc0O2cX1fPi96sUQu5j7eo4gKCkB2AnNGoWt7y4/Xx3Kcqg==}
-    engines: {node: '>=18'}
+  '@playwright/test@1.63.0':
+    resolution: {integrity: sha512-oxMK4vllB9RK5NQ2l1pq1IfOf2AvnEuj/vYGDj0H2nMtmtZpKtCwt/l00GEO6xjGfpBNAvjovvYdCm50dRQkpQ==}
+    engines: {node: '>=20'}
     hasBin: true
 
-  '@posthog/core@1.28.3':
-    resolution: {integrity: sha512-SOy0aphKawZzp8jxfeOpTcXPwi6ii0I2V6tX8YXnM+WbxKKR/R+BXLK0jS6LV8kZtW3H5YxmPAfuIbUP1UnGTw==}
+  '@posthog/core@1.55.1':
+    resolution: {integrity: sha512-S76bSbCHGVC8oQa1zyue6A6WzkNf1Ue4oRvfvBNLRnFM3UoWnpWnQ4T/4IzrIEtVCQYv1OI7gk8uL8/U6Tuu7w==}
 
-  '@posthog/types@1.372.9':
-    resolution: {integrity: sha512-B7k9S+H9WUKHXxe1HOkQWbpWtMcrBvsodm5stZaLQ3pYxf9TowtwssdzTtX4hHjzSYqgrS1IpNnJX4vs1KgBzA==}
+  '@posthog/types@1.412.4':
+    resolution: {integrity: sha512-Q7lV9O9TbLngjOYw1ucm3bS3tn48xb1B4ZQdDy8gv7yfKe99hCTeWYG4xZ36nJM80VxpTF9TriiJt5hngDOkBg==}
 
   '@radix-ui/number@1.1.2':
     resolution: {integrity: sha512-ceTwaxc4I5IOi97DgCotl3pqiyRGvffcc0oOsE2dQYaJOFIDsDt4VWG6xEbg1QePv9QWausCEIppud/tJ1wNig==}
@@ -2861,8 +2903,8 @@ packages:
   '@rolldown/pluginutils@1.0.0-rc.3':
     resolution: {integrity: sha512-eybk3TjzzzV97Dlj5c+XrBFW57eTNhzod66y9HrBlzJ6NsCrWCp/2kaPS3K9wJmurBC0Tdw4yPjXKZqlznim3Q==}
 
-  '@sanity/diff-match-patch@3.2.0':
-    resolution: {integrity: sha512-4hPADs0qUThFZkBK/crnfKKHg71qkRowfktBljH2UIxGHHTxIzt8g8fBiXItyCjxkuNy+zpYOdRMifQNv8+Yww==}
+  '@sanity/diff-match-patch@3.2.1':
+    resolution: {integrity: sha512-Ll3BPOn9aPGeBUOFDZpKk0IObL+NI4tNq7VyOKj680xd+iCtfjnbcZZU0vpj94XozVGE0Zf+0FoYWXk2xJgZCg==}
     engines: {node: '>=18.18'}
 
   '@sec-ant/readable-stream@0.4.1':
@@ -2888,8 +2930,8 @@ packages:
   '@stablelib/base64@1.0.1':
     resolution: {integrity: sha512-1bnPQqSxSuc3Ii6MhBysoWCg58j97aUjuCSZrGSmDxNqtytIi0k8utUenAwTZN4V5mXXYGsVUI9zeBqy+jBOSQ==}
 
-  '@stablyai/playwright-base@2.1.14':
-    resolution: {integrity: sha512-/iAgMW5tC0ETDo3mFyTzszRrD7rGFIT4fgDgtZxqa9vPhiTLix/1+GeOOBNY0uS+XRLFY0Uc/irsC3XProL47g==}
+  '@stablyai/playwright-base@2.1.16':
+    resolution: {integrity: sha512-mdZ+WO5VA6hhHcWLQFcDwOolosvrA60dY0Uua8L45iWsqa4RdzEpmoDmdf7m3nGdlHDk9uY8XSJFSXK9qr64Ig==}
     engines: {node: '>=18'}
     peerDependencies:
       '@playwright/test': ^1.52.0
@@ -2898,13 +2940,13 @@ packages:
       zod:
         optional: true
 
-  '@stablyai/playwright-test@2.1.14':
-    resolution: {integrity: sha512-CAyVVnRdsyJg9pbK3Yq5L9lcvEabilFLb2RWeTQybKv7sDkEEqE2t1boXqBt3X6wQO6lsyhUHB9pc10wSwuc4Q==}
+  '@stablyai/playwright-test@2.1.16':
+    resolution: {integrity: sha512-NLbywKt/Y+AFra2puI2Ja3KADBPOQksPSpl6Zk7IlgZvawbz0CNom90aiAQX/jZ0g2KkF94cAQ08UZeVVwGzyA==}
     peerDependencies:
       '@playwright/test': ^1.52.0
 
-  '@stablyai/playwright@2.1.14':
-    resolution: {integrity: sha512-+SkphioOf+o2VWiM3KPm/fFTTjwNHUV5b2ZRPrLMTsW6bwmEvjo2FbVOUobNBqbopQBnntNLd8ZCG2gvw7rwtg==}
+  '@stablyai/playwright@2.1.16':
+    resolution: {integrity: sha512-gG+TIce/Y6Z8l0hJVuJUmD1c0UF+dPrCfqGrebR5TFgO5Vxag5UzgSyoHXEozn2oAfqrnxPE2l9QmkrclIr61w==}
     peerDependencies:
       '@playwright/test': ^1.52.0
 
@@ -2920,18 +2962,36 @@ packages:
     cpu: [arm64]
     os: [darwin]
 
+  '@swc/core-darwin-arm64@1.16.2':
+    resolution: {integrity: sha512-i/j0HNbnn79qnTVPicvay92Nark8fW8NQqn1e2mGERjUXNpBV0+SwQxlRpk2zBhn6laJ8PDI6Kn1nHZhnz3LCA==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [darwin]
+
   '@swc/core-darwin-x64@1.15.46':
     resolution: {integrity: sha512-4Tj4ppVIPCmUMpmGFiGtyEriwLyJ+yi/US4WfBrP/ok8COGddDZXLEzQETnKyK46mjvr1v0jevrS23zjoff7vA==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [darwin]
 
+  '@swc/core-darwin-x64@1.16.2':
+    resolution: {integrity: sha512-HrwqHyEyHVXO3qTk8EkNK7/b6sOZSEoNh+pot6RdE5x0LbNqfo8LtJUvi3UTXr+5ja/o5HbJdW80eCXo+NjbiA==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [darwin]
+
   '@swc/core-linux-arm-gnueabihf@1.15.46':
     resolution: {integrity: sha512-i8tUGnNjyOgMmfmgFSg4aeJLQoFyfpIHK5FjpQAwpRyQIqEUB2w1e8zIDQzY1WhOxx8NoS1S5iUL813Un4Sf5A==}
     engines: {node: '>=10'}
     cpu: [arm]
     os: [linux]
 
+  '@swc/core-linux-arm-gnueabihf@1.16.2':
+    resolution: {integrity: sha512-MdXi83Z/gGp1LIrg+h7HKxiul/z/Bty/ZJSvYAFqDl9zteC1XLSAZdScquKtXPp50rdyXqritTDCqQBhwVfZKA==}
+    engines: {node: '>=10'}
+    cpu: [arm]
+    os: [linux]
+
   '@swc/core-linux-arm64-gnu@1.15.46':
     resolution: {integrity: sha512-c0OnhqzdhfOvv6qhNCcByepB+sNYOGZyhtr2Qa6ZCHvAWTYhSRw4j/u92Stue9PbZ/6q74b9nHzi76+kVzqQHQ==}
     engines: {node: '>=10'}
@@ -2939,6 +2999,13 @@ packages:
     os: [linux]
     libc: [glibc]
 
+  '@swc/core-linux-arm64-gnu@1.16.2':
+    resolution: {integrity: sha512-/jcTmK6Ktz3owM3YtiKvjofV6p3VpHnYzTIrOGwDIOsDigRAAVuZ8east33wYO/7UTdKYFlyHNnJNT0WJqOA3Q==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
   '@swc/core-linux-arm64-musl@1.15.46':
     resolution: {integrity: sha512-imyRpNEcUzFQFV2LE4jL68ErvmKEuZCbvZru77iQREunJ+bR4i658cupTgtG1mLYM3F1Tzy3Sb9xYb02KghWTg==}
     engines: {node: '>=10'}
@@ -2946,6 +3013,13 @@ packages:
     os: [linux]
     libc: [musl]
 
+  '@swc/core-linux-arm64-musl@1.16.2':
+    resolution: {integrity: sha512-4gFarKaFnlJTSlJYKmMhV4u+3YE4uYfiydpBoYjmgQhCf9lAieOq+WilZaK9vVSHeqLuQpTEiGULZqAdsRX5Dw==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
   '@swc/core-linux-ppc64-gnu@1.15.46':
     resolution: {integrity: sha512-ctEfcl/HcUeomK33cbySiHZm98GEDIxTm1EkpBsYCiHxElYBzvTXVeuQT2YwbUXn9XCrjiw4ipyUNk33k26qRg==}
     engines: {node: '>=10'}
@@ -2953,6 +3027,13 @@ packages:
     os: [linux]
     libc: [glibc]
 
+  '@swc/core-linux-ppc64-gnu@1.16.2':
+    resolution: {integrity: sha512-syqSLGd6KlZ1PciNzs6bIUlhOuFztZufebOHaERjc4N4SqNZxyqYd4I+jj/EfOYnpe0kNjccn9HJLN1p5dz3+w==}
+    engines: {node: '>=10'}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
   '@swc/core-linux-s390x-gnu@1.15.46':
     resolution: {integrity: sha512-DxlMdnt84TtRVTv7WL/thWyz9+QU8QZNNoAP9rrk0P68LziuhfePp8MjQ44zIprpTHTsEwyziIuGUUN5iSC1bQ==}
     engines: {node: '>=10'}
@@ -2960,6 +3041,13 @@ packages:
     os: [linux]
     libc: [glibc]
 
+  '@swc/core-linux-s390x-gnu@1.16.2':
+    resolution: {integrity: sha512-ZBBLK+ewGyXLzWeMS7wbKtWBdnif6etn7xvPY/iOfbdsjX/+bgkp1pQt2lWF2wlu2hXYZuhJ/tHZE/QR8/apzg==}
+    engines: {node: '>=10'}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
   '@swc/core-linux-x64-gnu@1.15.46':
     resolution: {integrity: sha512-SKxI7J6t90XPl8hRUqtJi9NfGdunN/E/vZMc7Bc0figeRdOPDBT+Tm8g7cx9xM0T0mewh2l+8dewa3Am27/P+A==}
     engines: {node: '>=10'}
@@ -2967,6 +3055,13 @@ packages:
     os: [linux]
     libc: [glibc]
 
+  '@swc/core-linux-x64-gnu@1.16.2':
+    resolution: {integrity: sha512-LyHJgxCA4Tje0ysBMbEb0tt/ie8kgUKoFE3JAKFhpevmTmhYEoC0H9s47WuDsqiFckF1ITUguZIXJG6K5e0dvg==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
   '@swc/core-linux-x64-musl@1.15.46':
     resolution: {integrity: sha512-qj9T6B7bosI0VEsrWOVXZN1OXxS8Tp63ywyrLxNdOycnUtLdkgYcoBsN5y8ImnDDsnwrEWZOy1e+J4xSe7mA3Q==}
     engines: {node: '>=10'}
@@ -2974,24 +3069,49 @@ packages:
     os: [linux]
     libc: [musl]
 
+  '@swc/core-linux-x64-musl@1.16.2':
+    resolution: {integrity: sha512-PghXJlVM1cgtLfNUR1vxFo1z+PDRAe8cWAJlZZ7spmeiN7BospGXg/MHUg7oNSgwSX7Zo//YKv9P5yD9apsFJQ==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
   '@swc/core-win32-arm64-msvc@1.15.46':
     resolution: {integrity: sha512-8p7l4c3LU+eA5g9Et1JPhNeMC1oQwXTGU+uah8DPIBX7YXzqswvaBtyKVmXefVGi/DJU1x3YJsc3mbAp9aWzSQ==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [win32]
 
+  '@swc/core-win32-arm64-msvc@1.16.2':
+    resolution: {integrity: sha512-StTOSefYBxemvNYYUI3UmO1a8y+hSPjjfHogC2TEHL+Z1PlEBim/XtLas5rS04jAzT9RrNmbtX911SZ42H9jSQ==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [win32]
+
   '@swc/core-win32-ia32-msvc@1.15.46':
     resolution: {integrity: sha512-tUEnfr3Bn9u6FOjUb3PN9p+09qZC2j+wNDLKHzXXZn22rqGcUqR/ohCRSS+nG9B9+X+U+3FewNEHJkTmdIvMjQ==}
     engines: {node: '>=10'}
     cpu: [ia32]
     os: [win32]
 
+  '@swc/core-win32-ia32-msvc@1.16.2':
+    resolution: {integrity: sha512-fycER209DYIzsibpTMC+chND05OfOjgztWL9U8OE6/uUlsOUZH3eh98isBLEnOymYUhlJLEt5++W1+KL/FOh5Q==}
+    engines: {node: '>=10'}
+    cpu: [ia32]
+    os: [win32]
+
   '@swc/core-win32-x64-msvc@1.15.46':
     resolution: {integrity: sha512-Vux7UDzBJYQggSuPfcl2w9iu+IJpgpRCxHzgCaVkELnAXAE4XZMOTX9HNcaNiwfeIDqdu2rkr69RuDm6wY8neA==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [win32]
 
+  '@swc/core-win32-x64-msvc@1.16.2':
+    resolution: {integrity: sha512-cSd1z6ivSrJPVr+moVwOHWjeKy6TpO4/Shwcv5KCrKYXCccxwh4pRy1C3fDioNx2PF1jPZWHKZjtXt+Be9VbaQ==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [win32]
+
   '@swc/core@1.15.46':
     resolution: {integrity: sha512-Ri3em2mBpq3h2zSPliCYl63otDGqek8PPEfv2nWgRQEbZ/VBCNyypVTVQ6cEbTCXBhy+WE2T3fQb08moIyuYaw==}
     engines: {node: '>=10'}
@@ -3001,12 +3121,24 @@ packages:
       '@swc/helpers':
         optional: true
 
+  '@swc/core@1.16.2':
+    resolution: {integrity: sha512-95I4kiSMeveI/Mhi+tE4fiWcWLUMfzfKrk0jtr8LRMqHgOgq+xHS+zExkDqoO4b5OeeuXHMWVdD5MeP3X6sULw==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@swc/helpers': '>=0.5.17'
+    peerDependenciesMeta:
+      '@swc/helpers':
+        optional: true
+
   '@swc/counter@0.1.3':
     resolution: {integrity: sha512-e2BR4lsJkkRlKZ/qCHPw9ZaSxc0MVUd7gtbtaB7aMvHeJVYe8sOB8DBZkP2DtISHGSku9sCK6T6cnY0CtXrOCQ==}
 
   '@swc/types@0.1.27':
     resolution: {integrity: sha512-K6h3iUlqeM946U4sXFYeahefR1YBbXJvko+hv8WS8/0BNJ4OHiHRywMnQUJCqkR7Y9+hqQ1TvEpiKqUhz7NEFg==}
 
+  '@swc/types@0.1.28':
+    resolution: {integrity: sha512-V6Mnml8v09QALx6K0elJ7o9K/MkVDtW3t6L+7Ou/JcWtb3xwId2AH4FeOceySd2JaO87IMw4+6vSZxLm34LPbw==}
+
   '@szmarczak/http-timer@4.0.6':
     resolution: {integrity: sha512-4BAffykYOgO+5nzBWYwE3W90sBgLJoUPRWWcL8wlyiM8IB8ipJz3UMJ9KXQd1RKQXpKp8Tutn80HZtWsu2u76w==}
     engines: {node: '>=10'}
@@ -3105,14 +3237,14 @@ packages:
     peerDependencies:
       vite: ^5.2.0 || ^6 || ^7 || ^8
 
-  '@tanstack/react-virtual@3.14.10':
-    resolution: {integrity: sha512-SRyoUbdFMRHuYXMijV5H4ZarQWpXkj3iANq8OFre+pybeVap8ZJjZ3Nz9bVjx4d8PfobVUQUdKyyyHYk3E+djw==}
+  '@tanstack/react-virtual@3.14.13':
+    resolution: {integrity: sha512-JbDTAwtzZ99aOeCrAfW5EsE5KSq5RWh6Af2dtFwyLIIk48Ja7vm6n4axu/43T3vfjFnEGJalxJ1wyYjSQD6bSg==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
-  '@tanstack/virtual-core@3.17.8':
-    resolution: {integrity: sha512-BfEvehNpOT75r5Ksc5xW6NZuXujTfb7nlSEyVu4XHG3gdxNg1KqXruWbDewXOUaUYIo4oRbSfkjIajz4MAT8tA==}
+  '@tanstack/virtual-core@3.17.11':
+    resolution: {integrity: sha512-+ILjvtHup6Y2hzQ6YzwMgX1Q+oQpxEGOXCEsCNaPoIP0VxMbizIBTmYTDtkerkIQS8/CbP1BRuyt8V/8BCsy1g==}
 
   '@testing-library/dom@10.4.1':
     resolution: {integrity: sha512-o4PXJQidqJl82ckFaXUeoAW+XysPLauYI43Abki5hABd853iMhitooc6znOnczgbTYmEP6U6/y1ZyKAIsvMKGg==}
@@ -3122,8 +3254,8 @@ packages:
     resolution: {integrity: sha512-zIcONa+hVtVSSep9UT3jZ5rizo2BsxgyDYU7WFD5eICBE7no3881HGeb/QkGfsJs6JTkY1aQhT7rIPC7e+0nnA==}
     engines: {node: '>=14', npm: '>=6', yarn: '>=1'}
 
-  '@testing-library/react@16.3.2':
-    resolution: {integrity: sha512-XU5/SytQM+ykqMnAnvB2umaJNIOsLF3PVv//1Ew4CTcpz0/BRyy/af40qqrt7SjKpDdT1saBMc42CUok5gaw+g==}
+  '@testing-library/react@16.3.3':
+    resolution: {integrity: sha512-Uo193NgQbPMz6lrrhtRQQFcMC6Re/ELLFbbuVL30WDlZxlpZf9/lMHTAVxPRLw1q1iu9OJmR1c2BLiENRstdBg==}
     engines: {node: '>=18'}
     peerDependencies:
       '@testing-library/dom': ^10.0.0
@@ -3137,8 +3269,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@testing-library/user-event@14.6.1':
-    resolution: {integrity: sha512-vq7fv0rnt+QTXgPxr5Hjc210p6YKq2kmdziLgnsZGgLJ9e6VAShx1pACLuRjd/AS/sr7phAR58OIIpf0LlmQNw==}
+  '@testing-library/user-event@14.6.7':
+    resolution: {integrity: sha512-MPCpX8bxe8zS+JmmTwLp8jd0dy1rAm60Te/SL8JrQM3qvQJcBOs1d7IefJMyZzqM3EWBrDn/LWDt1BCGu4ASfg==}
     engines: {node: '>=12', npm: '>=6'}
     peerDependencies:
       '@testing-library/dom': '>=7.21.4'
@@ -4207,6 +4339,10 @@ packages:
     resolution: {integrity: sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==}
     engines: {node: '>=20'}
 
+  commander@15.0.0:
+    resolution: {integrity: sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg==}
+    engines: {node: '>=22.12.0'}
+
   commander@5.1.0:
     resolution: {integrity: sha512-P0CysNDQ7rtVw4QIQtm+MRxV66vKFSvlsQvGYXZWR3qFU0jlMKHZZZgw8e+8DSah4UDKMqnknRDQz+xuQXQ/Zg==}
     engines: {node: '>= 6'}
@@ -4569,8 +4705,8 @@ packages:
   dom-accessibility-api@0.6.3:
     resolution: {integrity: sha512-7ZgogeTnjuHbo+ct10G9Ffp0mif17idi0IyWNVA/wcwcm7NPOD/WEHVP3n7n3MhXqxoIYm8d6MuZohYWIZ4T3w==}
 
-  dompurify@3.4.14:
-    resolution: {integrity: sha512-dVoH9z+MY+C9IilgGCk3YfFqjLi3fChm2OiKJMzh6axrJ5qwxqWaZamgmHrpv22CN/KdbZJuGEGgfQoL00LTdg==}
+  dompurify@3.4.15:
+    resolution: {integrity: sha512-EUBjM+B+lkDE41iE82DDSCfkoPGfXx8IxFxPMjNzm/Uk4xDet77rTN9wqlxlVg71kK7XGuUMv6wUxJUwwv+Xyw==}
 
   dotenv-expand@11.0.7:
     resolution: {integrity: sha512-zIHwmZPRshsCdpMDyVsqGmgyP0yT8GAgXUnkdAoJisxvf33k7yO6OuoKmcTGuXPWSsm8Oh88nZicRLA9Y0rUeA==}
@@ -4635,8 +4771,8 @@ packages:
     resolution: {integrity: sha512-bO3y10YikuUwUuDUQRM4KfwNkKhnpVO7IPdbsrejwN9/AABJzzTQ4GeHwyzNSrVO+tEH3/Np255a3sVZpZDjvg==}
     engines: {node: '>=8.0.0'}
 
-  electron@43.7.0:
-    resolution: {integrity: sha512-m98FUehwnoo6q2D9Mr+n602Natb2CRFeKD81GhTdJlKh/Iyud0R1X8hChjpaMBLSsIX9r2ZEFnz0sdIALiO9ZQ==}
+  electron@43.7.5:
+    resolution: {integrity: sha512-AR+OLH/8QAwx6Lz6mhaDQhesbjC/Xh2WOiFSI/CDFU6FKX/qJdBg65bEUn+MLvbvIi/LlaRQeLljnUcKb1KS0A==}
     engines: {node: '>= 22.12.0'}
     hasBin: true
 
@@ -4811,6 +4947,10 @@ packages:
     resolution: {integrity: sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA==}
     engines: {node: '>=18.0.0'}
 
+  execa@10.0.1:
+    resolution: {integrity: sha512-ge98qjkRK4IB7tL7Ju/6qmm5LHoH1eEMt5FNZrz3f4UIYhF28lggX20z3FaX1sgc67msLEn0N0BscOs29iuwyw==}
+    engines: {node: '>=22'}
+
   execa@5.1.1:
     resolution: {integrity: sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==}
     engines: {node: '>=10'}
@@ -4967,11 +5107,6 @@ packages:
   fs.realpath@1.0.0:
     resolution: {integrity: sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==}
 
-  fsevents@2.3.2:
-    resolution: {integrity: sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==}
-    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
-    os: [darwin]
-
   fsevents@2.3.3:
     resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
@@ -5205,13 +5340,13 @@ packages:
     engines: {node: '>=18'}
     hasBin: true
 
-  i18next-cli@1.65.0:
-    resolution: {integrity: sha512-sak+2Ry4P7wtl7xMAZg2sWG2vup1lRHFBKA7h5IeEqFUog51QEgeYUhHxd2x85+MvS4BhVOZZs833clnd1WgYA==}
+  i18next-cli@1.74.2:
+    resolution: {integrity: sha512-y32hOiVNLs85f+TKCl4XqERjD0dFy274IOEXe7/Zyp+WMaQC9VhF33JLO0hQZZKK4PUmYwbRDXaSObeE3PbsmA==}
     engines: {node: '>=22'}
     hasBin: true
 
-  i18next-resources-for-ts@2.1.0:
-    resolution: {integrity: sha512-n5UexwEVt0OoIAhG2MWpSnAVJW1U8mQrQTmXyxc5DMAx+NLhcLZhSMJo/FnUsA5JQ3obTYqTgB7YIuZKWpDgow==}
+  i18next-resources-for-ts@2.1.1:
+    resolution: {integrity: sha512-Xhz8S8dtNIPawzeWdmssnsII1JYsbvPWOLmstJakNcgKSFLCneA+xN7qajj/zlk5nf9sx1KGDTx8RNZ73h68tw==}
     hasBin: true
 
   i18next@26.3.1:
@@ -5222,6 +5357,14 @@ packages:
       typescript:
         optional: true
 
+  i18next@26.4.2:
+    resolution: {integrity: sha512-RX+R0VLg13IbvRuJSxnqykUFS9vQZTl8wYpWPCIUDWVrSGjsQywB5Y+pjzrkboxGAuYfJZVH1InFTdgBdxq6ug==}
+    peerDependencies:
+      typescript: ^5 || ^6 || ^7
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
   iconv-lite@0.6.3:
     resolution: {integrity: sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==}
     engines: {node: '>=0.10.0'}
@@ -5260,8 +5403,8 @@ packages:
   inline-style-parser@0.2.7:
     resolution: {integrity: sha512-Nb2ctOyNR8DqQoR0OwRG95uNWIC0C1lCgf5Naz5H6Ji72KZ8OcFZLz2P5sNgwlyoJ8Yif11oMuYs5pBQa86csA==}
 
-  inquirer@14.0.2:
-    resolution: {integrity: sha512-VsSx1JneSNp3ld1veMTLe+UDcUD8Tw2/jjOthhkX3/IX2q+xHhVELifeb/hsb1fBw31pabEPNUf/xUOyb+KZjA==}
+  inquirer@14.2.2:
+    resolution: {integrity: sha512-WGerZIIb7mTtaFFskkD/P0europ8xBWf1OXACMiugzKPSmVzoqhcPSuSUzbzMch/t3rf1ncBT3v/0WU73cLqJQ==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -5662,6 +5805,9 @@ packages:
   magic-string@0.30.21:
     resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
 
+  magic-string@1.4.2:
+    resolution: {integrity: sha512-vG+rjFRj1PqdIBozIxAGMjPlOhaVe+GXpbttY/iSK7rGcJRMlwNJO7dcUwmUqkymsFLJiNGI06t4D7Fr7yRC9g==}
+
   markdown-table@3.0.4:
     resolution: {integrity: sha512-wiYz4+JrLyb/DqW2hkFJxP7Vd7JuTDm77fvbM8VfEQdmSMqcImWeeRbHwZjBjIFki/VaMK2BhFi7oUUZeM5bqw==}
 
@@ -5927,6 +6073,10 @@ packages:
     resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==}
     engines: {node: 18 || 20 || >=22}
 
+  minimatch@10.2.6:
+    resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==}
+    engines: {node: 18 || 20 || >=22}
+
   minimatch@3.1.5:
     resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==}
 
@@ -6095,6 +6245,10 @@ packages:
     resolution: {integrity: sha512-84cglkRILFxdtA8hAvLNdMrtBpPNBTrQ9/ulg0FA7xLMnD6mifv+enAIeRmvtv+WgdCE+LPGOfQmtJRrVaIVhQ==}
     engines: {node: '>=20'}
 
+  ora@9.4.1:
+    resolution: {integrity: sha512-6VlU9MLXbjVQD04AZCMX28hVtA5bUoadvUqO76MUCVA0ilwJbMiHsITRPfyVm6p/BC0Av/BXMujx39WCe1LEqw==}
+    engines: {node: '>=20'}
+
   orderedmap@2.1.1:
     resolution: {integrity: sha512-TvAWxi0nDe1j/rtMcWcIj94+Ffe6n7zhow33h40SKxmsmozs6dz/e+EajymfoFcHd7sxNn8yHM8839uixMOV6g==}
 
@@ -6109,8 +6263,8 @@ packages:
     resolution: {integrity: sha512-syxUKHeUll89RIABQADcI7sikYrwyssvA6gj4phSSIPezKVM8yMaLAiLLSc7fmzVvrwybfFGFbW5zme9sX87rg==}
     engines: {node: ^20.19.0 || >=22.12.0}
 
-  oxfmt@0.65.0:
-    resolution: {integrity: sha512-SgS5VgnP42T0zl3zWD+xoH8FCqg1SAFnSRoOT/qeoa6gxcYIqrDMOmcXIg/EWSN92Du4ogB4riuKhKd6Y4CGhw==}
+  oxfmt@0.70.0:
+    resolution: {integrity: sha512-IsHxZ4y0wQLLMhnrJblBJgZsLDzfULrJnAw5j/QqsTlMa/m3AqsbToi+W71uhBGaqlqq/PbbjvHc09TJwdv3Tw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -6134,8 +6288,8 @@ packages:
     resolution: {integrity: sha512-KjK/XLcXr1DSyonKhsuFqJRiuKqcyG9j3LJ8nkOsrLzGvodBPqzHOKauy10asLMDI0sUpvb+1sxlzff3udZvfg==}
     hasBin: true
 
-  oxlint@1.80.0:
-    resolution: {integrity: sha512-5nTiSps4qdbCWLbxzuO00alHkEO2exR9YMN/ig6QXWrLsYSG0KaObOAM+l6oU2LcKPWoSAGYbkZIGEu1ViiWKA==}
+  oxlint@1.85.0:
+    resolution: {integrity: sha512-bc26s97nuvPj1ViyPsqmKecVkUWFMEdtayO8MaQ6oiLfs1pj94cQlZZhrh4BPNlr9HQosjhIlwgZKsfcwmcNgg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -6265,14 +6419,14 @@ packages:
     resolution: {integrity: sha512-emEcLuomt2j03vxD54giVB4SxTjnsqkU692xZOZXHDVoYyypEm+b3jpiTcc+Cf+myooc+/Ly0z01jqeNHVgJGw==}
     engines: {node: '>=16.0.0'}
 
-  playwright-core@1.59.1:
-    resolution: {integrity: sha512-HBV/RJg81z5BiiZ9yPzIiClYV/QMsDCKUyogwH9p3MCP6IYjUFu/MActgYAvK0oWyV9NlwM3GLBjADyWgydVyg==}
-    engines: {node: '>=18'}
+  playwright-core@1.63.0:
+    resolution: {integrity: sha512-rYCsBF/M5HjUch52bbtVONEFjv6Xu8sm8h72dNlR5bzIE1fvC/bxgspzkjSfU+MweEMmPM8KJebG6nnyxo5mCg==}
+    engines: {node: '>=20'}
     hasBin: true
 
-  playwright@1.59.1:
-    resolution: {integrity: sha512-C8oWjPR3F81yljW9o5OxcWzfh6avkVwDD2VYdwIGqTkl+OGFISgypqzfu7dOe4QNLL2aqcWBmI3PMtLIK233lw==}
-    engines: {node: '>=18'}
+  playwright@1.63.0:
+    resolution: {integrity: sha512-+7ziBLidS4NaNCdt57SUDT+wYmmd5fmiQejUic/kb+YsYSCPyOOE9sebzMjNmQrsnNpDJqd4WHvV/8lfKfUDUg==}
+    engines: {node: '>=20'}
     hasBin: true
 
   plist@3.1.0:
@@ -6301,8 +6455,8 @@ packages:
     resolution: {integrity: sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==}
     engines: {node: ^10 || ^12 || >=14}
 
-  posthog-node@5.33.3:
-    resolution: {integrity: sha512-6BkdRtRKf/y/j6JGXLUDWpruL9Rebpe2EtbSU3EB+yaI9ukTwEGT8XJQDyM8wcsxu1HdOnvAwN7gnOOu5OgY2A==}
+  posthog-node@5.52.5:
+    resolution: {integrity: sha512-r4KRXh2MvcHYh1s3NUca022GqujkJjpmD4qbRzWOLVTu8BfN3fqZj+MyKIxvHPXsS8sKsNVX+MlKk2qzW0Y4GQ==}
     engines: {node: ^20.20.0 || >=22.22.0}
     peerDependencies:
       rxjs: ^7.0.0
@@ -6474,8 +6628,8 @@ packages:
       react:
         optional: true
 
-  react-i18next@17.0.13:
-    resolution: {integrity: sha512-Cc1PscmblIHA1kljTqDwrcVMI21ydgmUzw0UAeQBe7pAOgfuRLfzXze4EUBQoeDiICzFIXXhHFoZxuetNg5D0Q==}
+  react-i18next@17.0.15:
+    resolution: {integrity: sha512-7uYpx/oBkesLto7cOzOmfITlUBaXHCAcFahmgETMfWr8nbbWRRnVGvz8wsH/xpbNcyoH+NpCcnOQEqWPMO6/hw==}
     peerDependencies:
       i18next: '>= 26.2.0'
       react: '>= 16.8.0'
@@ -7053,19 +7207,19 @@ packages:
     resolution: {integrity: sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==}
     engines: {node: '>=12.0.0'}
 
-  tinypool@2.1.0:
-    resolution: {integrity: sha512-Pugqs6M0m7Lv1I7FtxN4aoyToKg1C4tu+/381vH35y8oENM/Ai7f7C4StcoK4/+BSw9ebcS8jRiVrORFKCALLw==}
+  tinypool@2.1.2:
+    resolution: {integrity: sha512-9YodfrxS9g9IbFr/KOjE5bAeJ0p61n3bW6mqvy0jtoeKd1kTW1Cxm0oulm6KX2lyM9Gl6WIe8nEbY7LWv5ZJww==}
     engines: {node: ^20.0.0 || >=22.0.0}
 
   tinyrainbow@3.1.0:
     resolution: {integrity: sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==}
     engines: {node: '>=14.0.0'}
 
-  tldts-core@7.4.12:
-    resolution: {integrity: sha512-nYNzS2WRf4QJmjzFFgAxLOBjyBxAGRbCy9PVBPaglcYyYajh40VBn+v5Ngr96ZMc7oM0+aCJdtQnNejvdBnXMQ==}
+  tldts-core@7.4.14:
+    resolution: {integrity: sha512-KYkjfJHnIC5t+Gy7hPrMHgJmWc/N9FfmS+fggRPSlpFckidpB9HD6OzPsSTkfDH+MpZgcu2tJPGgLfHl979N1Q==}
 
-  tldts@7.4.12:
-    resolution: {integrity: sha512-WylhSDKVeYnWXL3a+vKTaOxjnOeEGw938hImY8zoRWJjRRK/Jp1K+IihBzIONpUmW4e3WmXT6q5FW6vlESVZCA==}
+  tldts@7.4.14:
+    resolution: {integrity: sha512-EahQoi+Q5oqmG3yxRHx+bwn36OaLbtw6jnTFcGjc8fcmktzTgk45xRnzAx8Ch87PFEiqRhoc3FWBmY+LBrvEGQ==}
     hasBin: true
 
   tmp-promise@3.0.3:
@@ -7341,6 +7495,11 @@ packages:
     resolution: {integrity: sha512-nt+N2dzIutVRxARx1nghPKGv1xHikU7HKdfafKkLNLindmPU/ch3U31NOCGGA/dmPcmb1VlofO0vnKAcsm0o/Q==}
     engines: {node: '>=12'}
 
+  which-command@0.1.0:
+    resolution: {integrity: sha512-XZyoF5/5hZtXitIwzrU4NKK+Wtbb9aB9CezUEw2Q0wlYK8NUYQxC1rRXgNueYLtBAJwXIb+/tFVk4dozciNJMA==}
+    engines: {node: '>=22'}
+    hasBin: true
+
   which-module@2.0.1:
     resolution: {integrity: sha512-iBdZ57RDvnOR9AGBhML2vFZf7h8vmBjhoaZqODJBFWHVtKkDmKuHai3cx5PgVMrX5YDNp27AofYbAwctSS+vhQ==}
 
@@ -7437,13 +7596,8 @@ packages:
     resolution: {integrity: sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==}
     engines: {node: '>=18'}
 
-  yaml@2.8.4:
-    resolution: {integrity: sha512-ml/JPOj9fOQK8RNnWojA67GbZ0ApXAUlN2UQclwv2eVgTgn7O9gg9o7paZWKMp4g0H3nTLtS9LVzhkpOFIKzog==}
-    engines: {node: '>= 14.6'}
-    hasBin: true
-
-  yaml@2.9.0:
-    resolution: {integrity: sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==}
+  yaml@2.9.1:
+    resolution: {integrity: sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==}
     engines: {node: '>= 14.6'}
     hasBin: true
 
@@ -7483,8 +7637,8 @@ packages:
   zod@3.25.76:
     resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==}
 
-  zod@4.5.4:
-    resolution: {integrity: sha512-sC95tT5iHHH9gtpj6A81kh+NEaRAUFN+qlUPDUbRfOMvNf5QCBqsb3WgvnpVtK5Y+4UfA6KqufotuTvMGiTlsA==}
+  zod@4.6.5:
+    resolution: {integrity: sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==}
 
   zustand@5.0.14:
     resolution: {integrity: sha512-/8tAspM5LMPr28b3fwLYrtdj77ECpfZviaP75CMTnwO8ISyaE4GDIG/9rDDYq/cH9D2Xw2A2RXglLInmVBQB/g==}
@@ -7526,18 +7680,18 @@ snapshots:
       package-manager-detector: 1.6.0
       tinyexec: 1.1.2
 
-  '@anthropic-ai/claude-agent-sdk@0.3.251(@anthropic-ai/sdk@0.122.0(zod@4.5.4))(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.5.4))(zod@4.5.4)':
+  '@anthropic-ai/claude-agent-sdk@0.3.251(@anthropic-ai/sdk@0.122.0(zod@4.6.5))(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.6.5))(zod@4.6.5)':
     dependencies:
-      '@anthropic-ai/sdk': 0.122.0(zod@4.5.4)
-      '@modelcontextprotocol/sdk': 1.30.0(supports-color@7.2.0)(zod@4.5.4)
-      zod: 4.5.4
+      '@anthropic-ai/sdk': 0.122.0(zod@4.6.5)
+      '@modelcontextprotocol/sdk': 1.30.0(supports-color@7.2.0)(zod@4.6.5)
+      zod: 4.6.5
 
-  '@anthropic-ai/sdk@0.122.0(zod@4.5.4)':
+  '@anthropic-ai/sdk@0.122.0(zod@4.6.5)':
     dependencies:
       json-schema-to-ts: 3.1.1
       standardwebhooks: 1.1.1
     optionalDependencies:
-      zod: 4.5.4
+      zod: 4.6.5
 
   '@babel/code-frame@7.29.7':
     dependencies:
@@ -7812,9 +7966,9 @@ snapshots:
     dependencies:
       '@types/node': 25.9.5
 
-  '@electron-toolkit/utils@4.0.0(electron@43.7.0(supports-color@7.2.0))':
+  '@electron-toolkit/utils@4.0.0(electron@43.7.5(supports-color@7.2.0))':
     dependencies:
-      electron: 43.7.0(supports-color@7.2.0)
+      electron: 43.7.5(supports-color@7.2.0)
 
   '@electron/asar@3.4.1':
     dependencies:
@@ -8036,22 +8190,22 @@ snapshots:
       '@eslint/core': 1.2.1
       levn: 0.4.1
 
-  '@floating-ui/core@1.7.5':
+  '@floating-ui/core@1.8.0':
     dependencies:
-      '@floating-ui/utils': 0.2.11
+      '@floating-ui/utils': 0.2.12
 
-  '@floating-ui/dom@1.7.6':
+  '@floating-ui/dom@1.8.0':
     dependencies:
-      '@floating-ui/core': 1.7.5
-      '@floating-ui/utils': 0.2.11
+      '@floating-ui/core': 1.8.0
+      '@floating-ui/utils': 0.2.12
 
   '@floating-ui/react-dom@2.1.8(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@floating-ui/dom': 1.7.6
+      '@floating-ui/dom': 1.8.0
       react: 19.2.8
       react-dom: 19.2.8(react@19.2.8)
 
-  '@floating-ui/utils@0.2.11': {}
+  '@floating-ui/utils@0.2.12': {}
 
   '@graphql-typed-document-node/core@3.2.0(graphql@16.14.2)':
     dependencies:
@@ -8085,14 +8239,17 @@ snapshots:
       '@iconify/types': 2.0.0
       mlly: 1.8.2
 
-  '@inquirer/ansi@2.0.7': {}
+  '@inquirer/ansi@2.0.7':
+    optional: true
 
-  '@inquirer/checkbox@5.2.1(@types/node@25.9.5)':
+  '@inquirer/ansi@2.0.8': {}
+
+  '@inquirer/checkbox@5.2.5(@types/node@25.9.5)':
     dependencies:
-      '@inquirer/ansi': 2.0.7
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/figures': 2.0.7
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/ansi': 2.0.8
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/figures': 2.0.9
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
 
@@ -8102,6 +8259,14 @@ snapshots:
       '@inquirer/type': 4.0.7(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
+    optional: true
+
+  '@inquirer/confirm@6.3.2(@types/node@25.9.5)':
+    dependencies:
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
+    optionalDependencies:
+      '@types/node': 25.9.5
 
   '@inquirer/core@11.2.1(@types/node@25.9.5)':
     dependencies:
@@ -8114,95 +8279,116 @@ snapshots:
       signal-exit: 4.1.0
     optionalDependencies:
       '@types/node': 25.9.5
+    optional: true
 
-  '@inquirer/editor@5.2.2(@types/node@25.9.5)':
+  '@inquirer/core@12.0.3(@types/node@25.9.5)':
     dependencies:
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/external-editor': 3.0.3(@types/node@25.9.5)
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/ansi': 2.0.8
+      '@inquirer/figures': 2.0.9
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
+      cli-width: 4.1.0
+      fast-wrap-ansi: 0.2.2
+      mute-stream: 3.0.0
+      signal-exit: 4.1.0
     optionalDependencies:
       '@types/node': 25.9.5
 
-  '@inquirer/expand@5.1.1(@types/node@25.9.5)':
+  '@inquirer/editor@5.3.3(@types/node@25.9.5)':
     dependencies:
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/external-editor': 3.0.5(@types/node@25.9.5)
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
 
-  '@inquirer/external-editor@3.0.3(@types/node@25.9.5)':
+  '@inquirer/expand@5.1.5(@types/node@25.9.5)':
+    dependencies:
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
+    optionalDependencies:
+      '@types/node': 25.9.5
+
+  '@inquirer/external-editor@3.0.5(@types/node@25.9.5)':
     dependencies:
       chardet: 2.2.0
       iconv-lite: 0.7.2
     optionalDependencies:
       '@types/node': 25.9.5
 
-  '@inquirer/figures@2.0.7': {}
+  '@inquirer/figures@2.0.7':
+    optional: true
 
-  '@inquirer/input@5.1.2(@types/node@25.9.5)':
+  '@inquirer/figures@2.0.9': {}
+
+  '@inquirer/input@5.1.6(@types/node@25.9.5)':
     dependencies:
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
 
-  '@inquirer/number@4.1.1(@types/node@25.9.5)':
+  '@inquirer/number@4.2.3(@types/node@25.9.5)':
     dependencies:
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
 
-  '@inquirer/password@5.1.1(@types/node@25.9.5)':
+  '@inquirer/password@5.2.2(@types/node@25.9.5)':
     dependencies:
-      '@inquirer/ansi': 2.0.7
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/ansi': 2.0.8
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
 
-  '@inquirer/prompts@8.5.2(@types/node@25.9.5)':
+  '@inquirer/prompts@8.7.2(@types/node@25.9.5)':
     dependencies:
-      '@inquirer/checkbox': 5.2.1(@types/node@25.9.5)
-      '@inquirer/confirm': 6.1.1(@types/node@25.9.5)
-      '@inquirer/editor': 5.2.2(@types/node@25.9.5)
-      '@inquirer/expand': 5.1.1(@types/node@25.9.5)
-      '@inquirer/input': 5.1.2(@types/node@25.9.5)
-      '@inquirer/number': 4.1.1(@types/node@25.9.5)
-      '@inquirer/password': 5.1.1(@types/node@25.9.5)
-      '@inquirer/rawlist': 5.3.1(@types/node@25.9.5)
-      '@inquirer/search': 4.2.1(@types/node@25.9.5)
-      '@inquirer/select': 5.2.1(@types/node@25.9.5)
+      '@inquirer/checkbox': 5.2.5(@types/node@25.9.5)
+      '@inquirer/confirm': 6.3.2(@types/node@25.9.5)
+      '@inquirer/editor': 5.3.3(@types/node@25.9.5)
+      '@inquirer/expand': 5.1.5(@types/node@25.9.5)
+      '@inquirer/input': 5.1.6(@types/node@25.9.5)
+      '@inquirer/number': 4.2.3(@types/node@25.9.5)
+      '@inquirer/password': 5.2.2(@types/node@25.9.5)
+      '@inquirer/rawlist': 5.3.5(@types/node@25.9.5)
+      '@inquirer/search': 4.3.3(@types/node@25.9.5)
+      '@inquirer/select': 5.2.5(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
 
-  '@inquirer/rawlist@5.3.1(@types/node@25.9.5)':
+  '@inquirer/rawlist@5.3.5(@types/node@25.9.5)':
     dependencies:
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
 
-  '@inquirer/search@4.2.1(@types/node@25.9.5)':
+  '@inquirer/search@4.3.3(@types/node@25.9.5)':
     dependencies:
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/figures': 2.0.7
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/figures': 2.0.9
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
 
-  '@inquirer/select@5.2.1(@types/node@25.9.5)':
+  '@inquirer/select@5.2.5(@types/node@25.9.5)':
     dependencies:
-      '@inquirer/ansi': 2.0.7
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/figures': 2.0.7
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/ansi': 2.0.8
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/figures': 2.0.9
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
 
   '@inquirer/type@4.0.7(@types/node@25.9.5)':
     optionalDependencies:
       '@types/node': 25.9.5
+    optional: true
+
+  '@inquirer/type@4.1.1(@types/node@25.9.5)':
+    optionalDependencies:
+      '@types/node': 25.9.5
 
   '@isaacs/fs-minipass@4.0.1':
     dependencies:
@@ -8222,6 +8408,8 @@ snapshots:
 
   '@jridgewell/sourcemap-codec@1.5.5': {}
 
+  '@jridgewell/sourcemap-codec@1.6.0': {}
+
   '@jridgewell/trace-mapping@0.3.31':
     dependencies:
       '@jridgewell/resolve-uri': 3.1.2
@@ -8258,7 +8446,7 @@ snapshots:
     dependencies:
       '@chevrotain/types': 11.1.2
 
-  '@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.5.4)':
+  '@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.6.5)':
     dependencies:
       '@hono/node-server': 2.1.0(hono@4.13.7)
       ajv: 8.20.0
@@ -8269,14 +8457,14 @@ snapshots:
       eventsource: 3.0.7
       eventsource-parser: 3.0.8
       express: 5.2.1(supports-color@7.2.0)
-      express-rate-limit: 8.5.2(express@5.2.1)
+      express-rate-limit: 8.5.2(express@5.2.1(supports-color@7.2.0))
       hono: 4.13.7
       jose: 6.2.3
       json-schema-typed: 8.0.2
       pkce-challenge: 5.0.1
       raw-body: 3.0.2
-      zod: 4.5.4
-      zod-to-json-schema: 3.25.2(zod@4.5.4)
+      zod: 4.6.5
+      zod-to-json-schema: 3.25.2(zod@4.6.5)
     transitivePeerDependencies:
       - supports-color
 
@@ -8291,7 +8479,7 @@ snapshots:
       eventsource: 3.0.7
       eventsource-parser: 3.0.8
       express: 5.2.1(supports-color@7.2.0)
-      express-rate-limit: 8.5.2(express@5.2.1)
+      express-rate-limit: 8.5.2(express@5.2.1(supports-color@7.2.0))
       hono: 4.13.7
       jose: 6.2.3
       json-schema-typed: 8.0.2
@@ -8550,61 +8738,61 @@ snapshots:
   '@oxc-project/types@0.148.0':
     optional: true
 
-  '@oxfmt/binding-android-arm-eabi@0.65.0':
+  '@oxfmt/binding-android-arm-eabi@0.70.0':
     optional: true
 
-  '@oxfmt/binding-android-arm64@0.65.0':
+  '@oxfmt/binding-android-arm64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-darwin-arm64@0.65.0':
+  '@oxfmt/binding-darwin-arm64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-darwin-x64@0.65.0':
+  '@oxfmt/binding-darwin-x64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-freebsd-x64@0.65.0':
+  '@oxfmt/binding-freebsd-x64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm-gnueabihf@0.65.0':
+  '@oxfmt/binding-linux-arm-gnueabihf@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm-musleabihf@0.65.0':
+  '@oxfmt/binding-linux-arm-musleabihf@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm64-gnu@0.65.0':
+  '@oxfmt/binding-linux-arm64-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm64-musl@0.65.0':
+  '@oxfmt/binding-linux-arm64-musl@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-ppc64-gnu@0.65.0':
+  '@oxfmt/binding-linux-ppc64-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-riscv64-gnu@0.65.0':
+  '@oxfmt/binding-linux-riscv64-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-riscv64-musl@0.65.0':
+  '@oxfmt/binding-linux-riscv64-musl@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-s390x-gnu@0.65.0':
+  '@oxfmt/binding-linux-s390x-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-x64-gnu@0.65.0':
+  '@oxfmt/binding-linux-x64-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-x64-musl@0.65.0':
+  '@oxfmt/binding-linux-x64-musl@0.70.0':
     optional: true
 
-  '@oxfmt/binding-openharmony-arm64@0.65.0':
+  '@oxfmt/binding-openharmony-arm64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-win32-arm64-msvc@0.65.0':
+  '@oxfmt/binding-win32-arm64-msvc@0.70.0':
     optional: true
 
-  '@oxfmt/binding-win32-ia32-msvc@0.65.0':
+  '@oxfmt/binding-win32-ia32-msvc@0.70.0':
     optional: true
 
-  '@oxfmt/binding-win32-x64-msvc@0.65.0':
+  '@oxfmt/binding-win32-x64-msvc@0.70.0':
     optional: true
 
   '@oxlint-tsgolint/darwin-arm64@7.0.2001':
@@ -8625,66 +8813,66 @@ snapshots:
   '@oxlint-tsgolint/win32-x64@7.0.2001':
     optional: true
 
-  '@oxlint/binding-android-arm-eabi@1.80.0':
+  '@oxlint/binding-android-arm-eabi@1.85.0':
     optional: true
 
-  '@oxlint/binding-android-arm64@1.80.0':
+  '@oxlint/binding-android-arm64@1.85.0':
     optional: true
 
-  '@oxlint/binding-darwin-arm64@1.80.0':
+  '@oxlint/binding-darwin-arm64@1.85.0':
     optional: true
 
-  '@oxlint/binding-darwin-x64@1.80.0':
+  '@oxlint/binding-darwin-x64@1.85.0':
     optional: true
 
-  '@oxlint/binding-freebsd-x64@1.80.0':
+  '@oxlint/binding-freebsd-x64@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.80.0':
+  '@oxlint/binding-linux-arm-gnueabihf@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-musleabihf@1.80.0':
+  '@oxlint/binding-linux-arm-musleabihf@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-gnu@1.80.0':
+  '@oxlint/binding-linux-arm64-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-musl@1.80.0':
+  '@oxlint/binding-linux-arm64-musl@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-ppc64-gnu@1.80.0':
+  '@oxlint/binding-linux-ppc64-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-gnu@1.80.0':
+  '@oxlint/binding-linux-riscv64-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-musl@1.80.0':
+  '@oxlint/binding-linux-riscv64-musl@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-s390x-gnu@1.80.0':
+  '@oxlint/binding-linux-s390x-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-gnu@1.80.0':
+  '@oxlint/binding-linux-x64-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-musl@1.80.0':
+  '@oxlint/binding-linux-x64-musl@1.85.0':
     optional: true
 
-  '@oxlint/binding-openharmony-arm64@1.80.0':
+  '@oxlint/binding-openharmony-arm64@1.85.0':
     optional: true
 
-  '@oxlint/binding-win32-arm64-msvc@1.80.0':
+  '@oxlint/binding-win32-arm64-msvc@1.85.0':
     optional: true
 
-  '@oxlint/binding-win32-ia32-msvc@1.80.0':
+  '@oxlint/binding-win32-ia32-msvc@1.85.0':
     optional: true
 
-  '@oxlint/binding-win32-x64-msvc@1.80.0':
+  '@oxlint/binding-win32-x64-msvc@1.85.0':
     optional: true
 
   '@oxlint/plugins@1.78.0': {}
 
-  '@oxlint/plugins@1.80.0': {}
+  '@oxlint/plugins@1.85.0': {}
 
   '@parcel/watcher-android-arm64@2.5.6':
     optional: true
@@ -8768,15 +8956,15 @@ snapshots:
       tslib: 2.8.1
       webcrypto-core: 1.9.2
 
-  '@playwright/test@1.59.1':
+  '@playwright/test@1.63.0':
     dependencies:
-      playwright: 1.59.1
+      playwright: 1.63.0
 
-  '@posthog/core@1.28.3':
+  '@posthog/core@1.55.1':
     dependencies:
-      '@posthog/types': 1.372.9
+      '@posthog/types': 1.412.4
 
-  '@posthog/types@1.372.9': {}
+  '@posthog/types@1.412.4': {}
 
   '@radix-ui/number@1.1.2': {}
 
@@ -9584,7 +9772,7 @@ snapshots:
 
   '@rolldown/pluginutils@1.0.0-rc.3': {}
 
-  '@sanity/diff-match-patch@3.2.0': {}
+  '@sanity/diff-match-patch@3.2.1': {}
 
   '@sec-ant/readable-stream@0.4.1': {}
 
@@ -9606,27 +9794,27 @@ snapshots:
 
   '@stablelib/base64@1.0.1': {}
 
-  '@stablyai/playwright-base@2.1.14(@playwright/test@1.59.1)(zod@4.5.4)':
+  '@stablyai/playwright-base@2.1.16(@playwright/test@1.63.0)(zod@4.6.5)':
     dependencies:
-      '@playwright/test': 1.59.1
+      '@playwright/test': 1.63.0
       jpeg-js: 0.4.4
       p-retry: 4.6.2
       pngjs: 7.0.0
     optionalDependencies:
-      zod: 4.5.4
+      zod: 4.6.5
 
-  '@stablyai/playwright-test@2.1.14(@playwright/test@1.59.1)(zod@4.5.4)':
+  '@stablyai/playwright-test@2.1.16(@playwright/test@1.63.0)(zod@4.6.5)':
     dependencies:
-      '@playwright/test': 1.59.1
-      '@stablyai/playwright': 2.1.14(@playwright/test@1.59.1)(zod@4.5.4)
-      '@stablyai/playwright-base': 2.1.14(@playwright/test@1.59.1)(zod@4.5.4)
+      '@playwright/test': 1.63.0
+      '@stablyai/playwright': 2.1.16(@playwright/test@1.63.0)(zod@4.6.5)
+      '@stablyai/playwright-base': 2.1.16(@playwright/test@1.63.0)(zod@4.6.5)
     transitivePeerDependencies:
       - zod
 
-  '@stablyai/playwright@2.1.14(@playwright/test@1.59.1)(zod@4.5.4)':
+  '@stablyai/playwright@2.1.16(@playwright/test@1.63.0)(zod@4.6.5)':
     dependencies:
-      '@playwright/test': 1.59.1
-      '@stablyai/playwright-base': 2.1.14(@playwright/test@1.59.1)(zod@4.5.4)
+      '@playwright/test': 1.63.0
+      '@stablyai/playwright-base': 2.1.16(@playwright/test@1.63.0)(zod@4.6.5)
     transitivePeerDependencies:
       - zod
 
@@ -9637,39 +9825,75 @@ snapshots:
   '@swc/core-darwin-arm64@1.15.46':
     optional: true
 
+  '@swc/core-darwin-arm64@1.16.2':
+    optional: true
+
   '@swc/core-darwin-x64@1.15.46':
     optional: true
 
+  '@swc/core-darwin-x64@1.16.2':
+    optional: true
+
   '@swc/core-linux-arm-gnueabihf@1.15.46':
     optional: true
 
+  '@swc/core-linux-arm-gnueabihf@1.16.2':
+    optional: true
+
   '@swc/core-linux-arm64-gnu@1.15.46':
     optional: true
 
+  '@swc/core-linux-arm64-gnu@1.16.2':
+    optional: true
+
   '@swc/core-linux-arm64-musl@1.15.46':
     optional: true
 
+  '@swc/core-linux-arm64-musl@1.16.2':
+    optional: true
+
   '@swc/core-linux-ppc64-gnu@1.15.46':
     optional: true
 
+  '@swc/core-linux-ppc64-gnu@1.16.2':
+    optional: true
+
   '@swc/core-linux-s390x-gnu@1.15.46':
     optional: true
 
+  '@swc/core-linux-s390x-gnu@1.16.2':
+    optional: true
+
   '@swc/core-linux-x64-gnu@1.15.46':
     optional: true
 
+  '@swc/core-linux-x64-gnu@1.16.2':
+    optional: true
+
   '@swc/core-linux-x64-musl@1.15.46':
     optional: true
 
+  '@swc/core-linux-x64-musl@1.16.2':
+    optional: true
+
   '@swc/core-win32-arm64-msvc@1.15.46':
     optional: true
 
+  '@swc/core-win32-arm64-msvc@1.16.2':
+    optional: true
+
   '@swc/core-win32-ia32-msvc@1.15.46':
     optional: true
 
+  '@swc/core-win32-ia32-msvc@1.16.2':
+    optional: true
+
   '@swc/core-win32-x64-msvc@1.15.46':
     optional: true
 
+  '@swc/core-win32-x64-msvc@1.16.2':
+    optional: true
+
   '@swc/core@1.15.46':
     dependencies:
       '@swc/counter': 0.1.3
@@ -9688,12 +9912,34 @@ snapshots:
       '@swc/core-win32-ia32-msvc': 1.15.46
       '@swc/core-win32-x64-msvc': 1.15.46
 
+  '@swc/core@1.16.2':
+    dependencies:
+      '@swc/counter': 0.1.3
+      '@swc/types': 0.1.28
+    optionalDependencies:
+      '@swc/core-darwin-arm64': 1.16.2
+      '@swc/core-darwin-x64': 1.16.2
+      '@swc/core-linux-arm-gnueabihf': 1.16.2
+      '@swc/core-linux-arm64-gnu': 1.16.2
+      '@swc/core-linux-arm64-musl': 1.16.2
+      '@swc/core-linux-ppc64-gnu': 1.16.2
+      '@swc/core-linux-s390x-gnu': 1.16.2
+      '@swc/core-linux-x64-gnu': 1.16.2
+      '@swc/core-linux-x64-musl': 1.16.2
+      '@swc/core-win32-arm64-msvc': 1.16.2
+      '@swc/core-win32-ia32-msvc': 1.16.2
+      '@swc/core-win32-x64-msvc': 1.16.2
+
   '@swc/counter@0.1.3': {}
 
   '@swc/types@0.1.27':
     dependencies:
       '@swc/counter': 0.1.3
 
+  '@swc/types@0.1.28':
+    dependencies:
+      '@swc/counter': 0.1.3
+
   '@szmarczak/http-timer@4.0.6':
     dependencies:
       defer-to-connect: 2.0.1
@@ -9759,20 +10005,20 @@ snapshots:
       '@tailwindcss/oxide-win32-arm64-msvc': 4.2.4
       '@tailwindcss/oxide-win32-x64-msvc': 4.2.4
 
-  '@tailwindcss/vite@4.2.4(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4))':
+  '@tailwindcss/vite@4.2.4(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1))':
     dependencies:
       '@tailwindcss/node': 4.2.4
       '@tailwindcss/oxide': 4.2.4
       tailwindcss: 4.2.4
-      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4)
+      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1)
 
-  '@tanstack/react-virtual@3.14.10(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
+  '@tanstack/react-virtual@3.14.13(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@tanstack/virtual-core': 3.17.8
+      '@tanstack/virtual-core': 3.17.11
       react: 19.2.8
       react-dom: 19.2.8(react@19.2.8)
 
-  '@tanstack/virtual-core@3.17.8': {}
+  '@tanstack/virtual-core@3.17.11': {}
 
   '@testing-library/dom@10.4.1':
     dependencies:
@@ -9794,7 +10040,7 @@ snapshots:
       picocolors: 1.1.1
       redent: 3.0.0
 
-  '@testing-library/react@16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
+  '@testing-library/react@16.3.3(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@babel/runtime': 7.29.7
       '@testing-library/dom': 10.4.1
@@ -9804,7 +10050,7 @@ snapshots:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@testing-library/user-event@14.6.1(@testing-library/dom@10.4.1)':
+  '@testing-library/user-event@14.6.7(@testing-library/dom@10.4.1)':
     dependencies:
       '@testing-library/dom': 10.4.1
 
@@ -9823,7 +10069,7 @@ snapshots:
 
   '@tiptap/extension-bubble-menu@3.31.3(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)':
     dependencies:
-      '@floating-ui/dom': 1.7.6
+      '@floating-ui/dom': 1.8.0
       '@tiptap/core': 3.31.3(@tiptap/pm@3.31.3)
       '@tiptap/pm': 3.31.3
     optional: true
@@ -9863,9 +10109,9 @@ snapshots:
     dependencies:
       '@tiptap/extensions': 3.31.3(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)
 
-  '@tiptap/extension-floating-menu@3.31.3(@floating-ui/dom@1.7.6)(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)':
+  '@tiptap/extension-floating-menu@3.31.3(@floating-ui/dom@1.8.0)(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)':
     dependencies:
-      '@floating-ui/dom': 1.7.6
+      '@floating-ui/dom': 1.8.0
       '@tiptap/core': 3.31.3(@tiptap/pm@3.31.3)
       '@tiptap/pm': 3.31.3
     optional: true
@@ -10000,7 +10246,7 @@ snapshots:
       prosemirror-transform: 1.12.0
       prosemirror-view: 1.42.3
 
-  '@tiptap/react@3.31.3(@floating-ui/dom@1.7.6)(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
+  '@tiptap/react@3.31.3(@floating-ui/dom@1.8.0)(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@tiptap/core': 3.31.3(@tiptap/pm@3.31.3)
       '@tiptap/pm': 3.31.3
@@ -10013,7 +10259,7 @@ snapshots:
       use-sync-external-store: 1.6.0(react@19.2.8)
     optionalDependencies:
       '@tiptap/extension-bubble-menu': 3.31.3(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)
-      '@tiptap/extension-floating-menu': 3.31.3(@floating-ui/dom@1.7.6)(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)
+      '@tiptap/extension-floating-menu': 3.31.3(@floating-ui/dom@1.8.0)(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)
     transitivePeerDependencies:
       - '@floating-ui/dom'
 
@@ -10431,7 +10677,7 @@ snapshots:
       d3-selection: 3.0.0
       d3-transition: 3.0.1(d3-selection@3.0.0)
 
-  '@vitejs/plugin-react@5.2.0(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4))':
+  '@vitejs/plugin-react@5.2.0(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1))':
     dependencies:
       '@babel/core': 7.29.7
       '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.29.7)
@@ -10439,7 +10685,7 @@ snapshots:
       '@rolldown/pluginutils': 1.0.0-rc.3
       '@types/babel__core': 7.20.5
       react-refresh: 0.18.0
-      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4)
+      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1)
     transitivePeerDependencies:
       - supports-color
 
@@ -10452,14 +10698,14 @@ snapshots:
       chai: 6.2.2
       tinyrainbow: 3.1.0
 
-  '@vitest/mocker@4.1.11(msw@2.14.3(@types/node@25.9.5)(typescript@7.0.2))(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4))':
+  '@vitest/mocker@4.1.11(msw@2.14.3(@types/node@25.9.5)(typescript@7.0.2))(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1))':
     dependencies:
       '@vitest/spy': 4.1.11
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
       msw: 2.14.3(@types/node@25.9.5)(typescript@7.0.2)
-      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4)
+      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1)
 
   '@vitest/pretty-format@4.1.11':
     dependencies:
@@ -10487,7 +10733,7 @@ snapshots:
 
   '@vscode/ripgrep-universal@1.18.0': {}
 
-  '@vscode/windows-process-tree@0.8.0(patch_hash=e66202cc623996d02040c93449eb9ae353fddadf426cb53202a59ee710ee6fe7)':
+  '@vscode/windows-process-tree@0.8.0(patch_hash=b4be93859cefb159949d9cf05f97fa91a221dff0f793a6f03d02d78ae5b32035)':
     dependencies:
       node-addon-api: 7.1.0
     optional: true
@@ -10498,7 +10744,7 @@ snapshots:
     dependencies:
       '@xterm/xterm': 6.1.0-beta.303(patch_hash=dd0ccc59cd1ccf99f4d76e5aa2456da165fa0804dce19a833d7638bd07ffa393)
 
-  '@xterm/addon-image@0.10.0-beta.300(patch_hash=5fc280019957573eefe8daa2969534d6090ddb29c6b5842b8f22e99dc1ce3146)(@xterm/xterm@6.1.0-beta.303(patch_hash=dd0ccc59cd1ccf99f4d76e5aa2456da165fa0804dce19a833d7638bd07ffa393))':
+  '@xterm/addon-image@0.10.0-beta.300(patch_hash=e5254a46d6f57bef4a8a19683bfa685afa0ca0127545aea53b54a48104ca3562)(@xterm/xterm@6.1.0-beta.303(patch_hash=dd0ccc59cd1ccf99f4d76e5aa2456da165fa0804dce19a833d7638bd07ffa393))':
     dependencies:
       '@xterm/xterm': 6.1.0-beta.303(patch_hash=dd0ccc59cd1ccf99f4d76e5aa2456da165fa0804dce19a833d7638bd07ffa393)
 
@@ -10914,6 +11160,8 @@ snapshots:
 
   commander@14.0.3: {}
 
+  commander@15.0.0: {}
+
   commander@5.1.0: {}
 
   commander@7.2.0: {}
@@ -11266,7 +11514,7 @@ snapshots:
 
   dom-accessibility-api@0.6.3: {}
 
-  dompurify@3.4.14:
+  dompurify@3.4.15:
     optionalDependencies:
       '@types/trusted-types': 2.0.7
 
@@ -11355,7 +11603,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  electron-vite@5.0.0(@swc/core@1.15.46)(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4)):
+  electron-vite@5.0.0(@swc/core@1.15.46)(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1)):
     dependencies:
       '@babel/core': 7.29.7
       '@babel/plugin-transform-arrow-functions': 7.27.1(@babel/core@7.29.7)
@@ -11363,7 +11611,7 @@ snapshots:
       esbuild: 0.25.12
       magic-string: 0.30.21
       picocolors: 1.1.1
-      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4)
+      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1)
     optionalDependencies:
       '@swc/core': 1.15.46
     transitivePeerDependencies:
@@ -11381,7 +11629,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  electron@43.7.0(supports-color@7.2.0):
+  electron@43.7.5(supports-color@7.2.0):
     dependencies:
       '@electron-internal/extract-zip': 1.0.4
       '@electron/get': 5.0.0(supports-color@7.2.0)
@@ -11574,6 +11822,21 @@ snapshots:
     dependencies:
       eventsource-parser: 3.0.8
 
+  execa@10.0.1:
+    dependencies:
+      '@sindresorhus/merge-streams': 4.0.0
+      figures: 6.1.0
+      get-stream: 9.0.1
+      human-signals: 8.0.1
+      is-plain-obj: 4.1.0
+      is-stream: 4.0.1
+      npm-run-path: 6.0.0
+      pretty-ms: 9.3.0
+      signal-exit: 4.1.0
+      strip-final-newline: 4.0.0
+      which-command: 0.1.0
+      yoctocolors: 2.1.2
+
   execa@5.1.1:
     dependencies:
       cross-spawn: 7.0.6
@@ -11605,7 +11868,7 @@ snapshots:
 
   exponential-backoff@3.1.3: {}
 
-  express-rate-limit@8.5.2(express@5.2.1):
+  express-rate-limit@8.5.2(express@5.2.1(supports-color@7.2.0)):
     dependencies:
       express: 5.2.1(supports-color@7.2.0)
       ip-address: 10.4.0
@@ -11791,9 +12054,6 @@ snapshots:
 
   fs.realpath@1.0.0: {}
 
-  fsevents@2.3.2:
-    optional: true
-
   fsevents@2.3.3:
     optional: true
 
@@ -12118,38 +12378,38 @@ snapshots:
 
   husky@9.1.7: {}
 
-  i18next-cli@1.65.0(@types/node@25.9.5)(react-dom@19.2.8(react@19.2.8))(typescript@7.0.2):
+  i18next-cli@1.74.2(patch_hash=7955b89d3aa229f477408608d331f78c85148a85a85913729f89fac65ad8b207)(@types/node@25.9.5)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2):
     dependencies:
       '@croct/json5-parser': 0.2.2
-      '@swc/core': 1.15.46
+      '@swc/core': 1.16.2
       chokidar: 5.0.0
-      commander: 14.0.3
-      execa: 9.6.1
+      commander: 15.0.0
+      execa: 10.0.1
       glob: 13.0.6
-      i18next: 26.3.1(typescript@7.0.2)
-      i18next-resources-for-ts: 2.1.0
-      inquirer: 14.0.2(@types/node@25.9.5)
+      i18next: 26.4.2(typescript@7.0.2)
+      i18next-resources-for-ts: 2.1.1
+      inquirer: 14.2.2(@types/node@25.9.5)
       jiti: 2.7.0
       jsonc-parser: 3.3.1
-      magic-string: 0.30.21
-      minimatch: 10.2.5
-      ora: 9.4.0
-      react: 19.2.8
-      react-i18next: 17.0.13(i18next@26.3.1(typescript@7.0.2))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2)
-      yaml: 2.9.0
+      magic-string: 1.4.2
+      minimatch: 10.2.6
+      ora: 9.4.1
+      react-i18next: 17.0.15(i18next@26.4.2(typescript@7.0.2))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2)
+      yaml: 2.9.1
     transitivePeerDependencies:
       - '@swc/helpers'
       - '@types/node'
+      - react
       - react-dom
       - react-native
       - typescript
 
-  i18next-resources-for-ts@2.1.0:
+  i18next-resources-for-ts@2.1.1:
     dependencies:
       '@babel/runtime': 7.29.7
-      '@swc/core': 1.15.46
+      '@swc/core': 1.16.2
       chokidar: 5.0.0
-      yaml: 2.9.0
+      yaml: 2.9.1
     transitivePeerDependencies:
       - '@swc/helpers'
 
@@ -12157,6 +12417,10 @@ snapshots:
     optionalDependencies:
       typescript: 7.0.2
 
+  i18next@26.4.2(typescript@7.0.2):
+    optionalDependencies:
+      typescript: 7.0.2
+
   iconv-lite@0.6.3:
     dependencies:
       safer-buffer: 2.1.2
@@ -12187,12 +12451,12 @@ snapshots:
 
   inline-style-parser@0.2.7: {}
 
-  inquirer@14.0.2(@types/node@25.9.5):
+  inquirer@14.2.2(@types/node@25.9.5):
     dependencies:
-      '@inquirer/ansi': 2.0.7
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/prompts': 8.5.2(@types/node@25.9.5)
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/ansi': 2.0.8
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/prompts': 8.7.2(@types/node@25.9.5)
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
       mute-stream: 3.0.0
       run-async: 4.0.6
     optionalDependencies:
@@ -12429,7 +12693,7 @@ snapshots:
       picomatch: 4.0.4
       string-argv: 0.3.2
       tinyexec: 1.1.2
-      yaml: 2.8.4
+      yaml: 2.9.1
 
   listr2@9.0.5:
     dependencies:
@@ -12504,6 +12768,10 @@ snapshots:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.5
 
+  magic-string@1.4.2:
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.6.0
+
   markdown-table@3.0.4: {}
 
   marked@14.0.0: {}
@@ -12732,7 +13000,7 @@ snapshots:
       d3-sankey: 0.12.3
       dagre-d3-es: 7.0.14
       dayjs: 1.11.23
-      dompurify: 3.4.14
+      dompurify: 3.4.15
       es-toolkit: 1.46.1
       fastdom: 1.0.12
       katex: 0.16.47
@@ -13003,6 +13271,10 @@ snapshots:
     dependencies:
       brace-expansion: 5.0.9
 
+  minimatch@10.2.6:
+    dependencies:
+      brace-expansion: 5.0.9
+
   minimatch@3.1.5:
     dependencies:
       brace-expansion: 1.1.18
@@ -13036,7 +13308,7 @@ snapshots:
 
   monaco-editor@0.55.1:
     dependencies:
-      dompurify: 3.4.14
+      dompurify: 3.4.15
       marked: 14.0.0
 
   ms@2.1.3: {}
@@ -13108,7 +13380,7 @@ snapshots:
 
   node-int64@0.4.0: {}
 
-  node-pty@1.1.0(patch_hash=346cb29d33dd6eeb14910ff411c7584b0b2ff9a4b271c4b6d23c3b48e6548f74):
+  node-pty@1.1.0(patch_hash=92c95cffab383d86b3b13a460c75a08074468ebf1f3911db8e874e083201f192):
     dependencies:
       node-addon-api: 7.1.1
 
@@ -13199,6 +13471,17 @@ snapshots:
       stdin-discarder: 0.3.2
       string-width: 8.2.1
 
+  ora@9.4.1:
+    dependencies:
+      chalk: 5.6.2
+      cli-cursor: 5.0.0
+      cli-spinners: 3.4.0
+      is-interactive: 2.0.0
+      is-unicode-supported: 2.1.0
+      log-symbols: 7.0.1
+      stdin-discarder: 0.3.2
+      string-width: 8.2.1
+
   orderedmap@2.1.1: {}
 
   outvariant@1.4.3:
@@ -13254,29 +13537,29 @@ snapshots:
       '@oxc-parser/binding-win32-x64-msvc': 0.148.0
     optional: true
 
-  oxfmt@0.65.0:
+  oxfmt@0.70.0:
     dependencies:
-      tinypool: 2.1.0
+      tinypool: 2.1.2
     optionalDependencies:
-      '@oxfmt/binding-android-arm-eabi': 0.65.0
-      '@oxfmt/binding-android-arm64': 0.65.0
-      '@oxfmt/binding-darwin-arm64': 0.65.0
-      '@oxfmt/binding-darwin-x64': 0.65.0
-      '@oxfmt/binding-freebsd-x64': 0.65.0
-      '@oxfmt/binding-linux-arm-gnueabihf': 0.65.0
-      '@oxfmt/binding-linux-arm-musleabihf': 0.65.0
-      '@oxfmt/binding-linux-arm64-gnu': 0.65.0
-      '@oxfmt/binding-linux-arm64-musl': 0.65.0
-      '@oxfmt/binding-linux-ppc64-gnu': 0.65.0
-      '@oxfmt/binding-linux-riscv64-gnu': 0.65.0
-      '@oxfmt/binding-linux-riscv64-musl': 0.65.0
-      '@oxfmt/binding-linux-s390x-gnu': 0.65.0
-      '@oxfmt/binding-linux-x64-gnu': 0.65.0
-      '@oxfmt/binding-linux-x64-musl': 0.65.0
-      '@oxfmt/binding-openharmony-arm64': 0.65.0
-      '@oxfmt/binding-win32-arm64-msvc': 0.65.0
-      '@oxfmt/binding-win32-ia32-msvc': 0.65.0
-      '@oxfmt/binding-win32-x64-msvc': 0.65.0
+      '@oxfmt/binding-android-arm-eabi': 0.70.0
+      '@oxfmt/binding-android-arm64': 0.70.0
+      '@oxfmt/binding-darwin-arm64': 0.70.0
+      '@oxfmt/binding-darwin-x64': 0.70.0
+      '@oxfmt/binding-freebsd-x64': 0.70.0
+      '@oxfmt/binding-linux-arm-gnueabihf': 0.70.0
+      '@oxfmt/binding-linux-arm-musleabihf': 0.70.0
+      '@oxfmt/binding-linux-arm64-gnu': 0.70.0
+      '@oxfmt/binding-linux-arm64-musl': 0.70.0
+      '@oxfmt/binding-linux-ppc64-gnu': 0.70.0
+      '@oxfmt/binding-linux-riscv64-gnu': 0.70.0
+      '@oxfmt/binding-linux-riscv64-musl': 0.70.0
+      '@oxfmt/binding-linux-s390x-gnu': 0.70.0
+      '@oxfmt/binding-linux-x64-gnu': 0.70.0
+      '@oxfmt/binding-linux-x64-musl': 0.70.0
+      '@oxfmt/binding-openharmony-arm64': 0.70.0
+      '@oxfmt/binding-win32-arm64-msvc': 0.70.0
+      '@oxfmt/binding-win32-ia32-msvc': 0.70.0
+      '@oxfmt/binding-win32-x64-msvc': 0.70.0
 
   oxlint-plugin-anti-slop@https://codeload.github.com/dmmulroy/anti-slop/tar.gz/c44ef22ca116d0ba62a3ff663a0bd13a3f3fa40b:
     dependencies:
@@ -13298,27 +13581,27 @@ snapshots:
       '@oxlint-tsgolint/win32-arm64': 7.0.2001
       '@oxlint-tsgolint/win32-x64': 7.0.2001
 
-  oxlint@1.80.0(oxlint-tsgolint@7.0.2001):
+  oxlint@1.85.0(oxlint-tsgolint@7.0.2001):
     optionalDependencies:
-      '@oxlint/binding-android-arm-eabi': 1.80.0
-      '@oxlint/binding-android-arm64': 1.80.0
-      '@oxlint/binding-darwin-arm64': 1.80.0
-      '@oxlint/binding-darwin-x64': 1.80.0
-      '@oxlint/binding-freebsd-x64': 1.80.0
-      '@oxlint/binding-linux-arm-gnueabihf': 1.80.0
-      '@oxlint/binding-linux-arm-musleabihf': 1.80.0
-      '@oxlint/binding-linux-arm64-gnu': 1.80.0
-      '@oxlint/binding-linux-arm64-musl': 1.80.0
-      '@oxlint/binding-linux-ppc64-gnu': 1.80.0
-      '@oxlint/binding-linux-riscv64-gnu': 1.80.0
-      '@oxlint/binding-linux-riscv64-musl': 1.80.0
-      '@oxlint/binding-linux-s390x-gnu': 1.80.0
-      '@oxlint/binding-linux-x64-gnu': 1.80.0
-      '@oxlint/binding-linux-x64-musl': 1.80.0
-      '@oxlint/binding-openharmony-arm64': 1.80.0
-      '@oxlint/binding-win32-arm64-msvc': 1.80.0
-      '@oxlint/binding-win32-ia32-msvc': 1.80.0
-      '@oxlint/binding-win32-x64-msvc': 1.80.0
+      '@oxlint/binding-android-arm-eabi': 1.85.0
+      '@oxlint/binding-android-arm64': 1.85.0
+      '@oxlint/binding-darwin-arm64': 1.85.0
+      '@oxlint/binding-darwin-x64': 1.85.0
+      '@oxlint/binding-freebsd-x64': 1.85.0
+      '@oxlint/binding-linux-arm-gnueabihf': 1.85.0
+      '@oxlint/binding-linux-arm-musleabihf': 1.85.0
+      '@oxlint/binding-linux-arm64-gnu': 1.85.0
+      '@oxlint/binding-linux-arm64-musl': 1.85.0
+      '@oxlint/binding-linux-ppc64-gnu': 1.85.0
+      '@oxlint/binding-linux-riscv64-gnu': 1.85.0
+      '@oxlint/binding-linux-riscv64-musl': 1.85.0
+      '@oxlint/binding-linux-s390x-gnu': 1.85.0
+      '@oxlint/binding-linux-x64-gnu': 1.85.0
+      '@oxlint/binding-linux-x64-musl': 1.85.0
+      '@oxlint/binding-openharmony-arm64': 1.85.0
+      '@oxlint/binding-win32-arm64-msvc': 1.85.0
+      '@oxlint/binding-win32-ia32-msvc': 1.85.0
+      '@oxlint/binding-win32-x64-msvc': 1.85.0
       oxlint-tsgolint: 7.0.2001
 
   p-cancelable@2.1.1: {}
@@ -13430,13 +13713,11 @@ snapshots:
       pvutils: 1.1.5
       tslib: 2.8.1
 
-  playwright-core@1.59.1: {}
+  playwright-core@1.63.0: {}
 
-  playwright@1.59.1:
+  playwright@1.63.0:
     dependencies:
-      playwright-core: 1.59.1
-    optionalDependencies:
-      fsevents: 2.3.2
+      playwright-core: 1.63.0
 
   plist@3.1.0:
     dependencies:
@@ -13466,9 +13747,9 @@ snapshots:
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
-  posthog-node@5.33.3:
+  posthog-node@5.52.5:
     dependencies:
-      '@posthog/core': 1.28.3
+      '@posthog/core': 1.55.1
 
   postject@1.0.0-alpha.6:
     dependencies:
@@ -13713,7 +13994,7 @@ snapshots:
     optionalDependencies:
       react: 19.2.8
 
-  react-i18next@17.0.13(i18next@26.3.1(typescript@7.0.2))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2):
+  react-i18next@17.0.15(i18next@26.3.1(typescript@7.0.2))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2):
     dependencies:
       '@babel/runtime': 7.29.7
       html-parse-stringify: 4.0.1
@@ -13724,6 +14005,17 @@ snapshots:
       react-dom: 19.2.8(react@19.2.8)
       typescript: 7.0.2
 
+  react-i18next@17.0.15(i18next@26.4.2(typescript@7.0.2))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2):
+    dependencies:
+      '@babel/runtime': 7.29.7
+      html-parse-stringify: 4.0.1
+      i18next: 26.4.2(typescript@7.0.2)
+      react: 19.2.8
+      use-sync-external-store: 1.6.0(react@19.2.8)
+    optionalDependencies:
+      react-dom: 19.2.8(react@19.2.8)
+      typescript: 7.0.2
+
   react-is@17.0.2: {}
 
   react-markdown@10.1.0(@types/react@19.2.17)(react@19.2.8):
@@ -13962,7 +14254,7 @@ snapshots:
 
   robust-predicates@3.0.3: {}
 
-  rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4):
+  rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1):
     dependencies:
       '@oxc-project/runtime': 0.101.0
       fdir: 6.5.0(picomatch@4.0.4)
@@ -13976,7 +14268,7 @@ snapshots:
       esbuild: 0.25.12
       fsevents: 2.3.3
       jiti: 2.7.0
-      yaml: 2.8.4
+      yaml: 2.9.1
     transitivePeerDependencies:
       - '@emnapi/core'
       - '@emnapi/runtime'
@@ -14380,15 +14672,15 @@ snapshots:
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
 
-  tinypool@2.1.0: {}
+  tinypool@2.1.2: {}
 
   tinyrainbow@3.1.0: {}
 
-  tldts-core@7.4.12: {}
+  tldts-core@7.4.14: {}
 
-  tldts@7.4.12:
+  tldts@7.4.14:
     dependencies:
-      tldts-core: 7.4.12
+      tldts-core: 7.4.14
 
   tmp-promise@3.0.3:
     dependencies:
@@ -14404,7 +14696,7 @@ snapshots:
 
   tough-cookie@6.0.2:
     dependencies:
-      tldts: 7.4.12
+      tldts: 7.4.14
     optional: true
 
   trim-lines@3.0.1: {}
@@ -14613,10 +14905,10 @@ snapshots:
       '@types/unist': 3.0.3
       vfile-message: 4.0.3
 
-  vitest@4.1.11(@opentelemetry/api@1.9.1)(@types/node@25.9.5)(happy-dom@20.11.8)(msw@2.14.3(@types/node@25.9.5)(typescript@7.0.2))(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4)):
+  vitest@4.1.11(@opentelemetry/api@1.9.1)(@types/node@25.9.5)(happy-dom@20.11.8)(msw@2.14.3(@types/node@25.9.5)(typescript@7.0.2))(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1)):
     dependencies:
       '@vitest/expect': 4.1.11
-      '@vitest/mocker': 4.1.11(msw@2.14.3(@types/node@25.9.5)(typescript@7.0.2))(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4))
+      '@vitest/mocker': 4.1.11(msw@2.14.3(@types/node@25.9.5)(typescript@7.0.2))(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1))
       '@vitest/pretty-format': 4.1.11
       '@vitest/runner': 4.1.11
       '@vitest/snapshot': 4.1.11
@@ -14633,7 +14925,7 @@ snapshots:
       tinyexec: 1.1.2
       tinyglobby: 0.2.16
       tinyrainbow: 3.1.0
-      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4)
+      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1)
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@opentelemetry/api': 1.9.1
@@ -14660,6 +14952,8 @@ snapshots:
 
   whatwg-mimetype@3.0.0: {}
 
+  which-command@0.1.0: {}
+
   which-module@2.0.1: {}
 
   which@2.0.2:
@@ -14726,9 +15020,7 @@ snapshots:
 
   yallist@5.0.0: {}
 
-  yaml@2.8.4: {}
-
-  yaml@2.9.0: {}
+  yaml@2.9.1: {}
 
   yargs-parser@18.1.3:
     dependencies:
@@ -14773,13 +15065,13 @@ snapshots:
     dependencies:
       zod: 3.25.76
 
-  zod-to-json-schema@3.25.2(zod@4.5.4):
+  zod-to-json-schema@3.25.2(zod@4.6.5):
     dependencies:
-      zod: 4.5.4
+      zod: 4.6.5
 
   zod@3.25.76: {}
 
-  zod@4.5.4: {}
+  zod@4.6.5: {}
 
   zustand@5.0.14(@types/react@19.2.17)(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8)):
     optionalDependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 90020c50741..cbb3e10ad4c 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -16,8 +16,8 @@ minimumReleaseAge: 4320
 minimumReleaseAgeExclude:
   - pdfjs-dist@6.3.289
   - zod@4.5.4
-  - electron@43.7.0
   - '@shadcn/lint@0.1.0'
+  - i18next-cli@1.74.2
 shamefullyHoist: true
 
 # Orca always launches the user's own resolved Claude CLI via
@@ -57,7 +57,7 @@ allowBuilds:
   '@orca/windows-registry': false
 
 overrides:
-  monaco-editor>dompurify: 3.4.14
+  monaco-editor>dompurify: 3.4.15
 
 patchedDependencies:
   '@xterm/addon-image@0.10.0-beta.300': config/patches/@xterm__addon-image@0.10.0-beta.300.patch
@@ -69,3 +69,4 @@ patchedDependencies:
   '@xterm/xterm@6.1.0-beta.303': config/patches/@xterm__xterm@6.1.0-beta.303.patch
   lint-staged@16.4.0: config/patches/lint-staged@16.4.0.patch
   '@vscode/windows-process-tree@0.8.0': config/patches/@vscode__windows-process-tree@0.8.0.patch
+  i18next-cli@1.74.2: config/patches/i18next-cli@1.74.2.patch
diff --git a/resources/skills/release-mapping.json b/resources/skills/release-mapping.json
index 4a0fb2a7ae9..3190eb3ea6a 100644
--- a/resources/skills/release-mapping.json
+++ b/resources/skills/release-mapping.json
@@ -639,6 +639,19 @@
         "orca-per-workspace-env": 5,
         "orchestration": 28
       }
+    },
+    {
+      "appVersion": "1.4.214",
+      "skills": {
+        "computer-use": 9,
+        "linear-tickets": 11,
+        "orca-cli": 37,
+        "orca-emulator": 8,
+        "orca-emulator-android": 6,
+        "orca-linear": 9,
+        "orca-per-workspace-env": 6,
+        "orchestration": 29
+      }
     }
   ]
 }
diff --git a/src/cli/cli-command-name-parity.test.ts b/src/cli/cli-command-name-parity.test.ts
deleted file mode 100644
index 32bbcc06add..00000000000
--- a/src/cli/cli-command-name-parity.test.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { CLI_COMMAND_NAMES } from '../main/startup/cli-command-names'
-import { COMMAND_SPECS } from './specs'
-
-const specCommandNames = [...new Set(COMMAND_SPECS.map((spec) => spec.path[0]))].sort()
-
-describe('CLI command-name parity between COMMAND_SPECS and the launch redirect', () => {
-  it('has commands to compare', () => {
-    expect(specCommandNames.length).toBeGreaterThan(0)
-  })
-
-  it('redirects every top-level CLI command', () => {
-    const redirected = new Set<string>(CLI_COMMAND_NAMES)
-    expect(specCommandNames.filter((name) => !redirected.has(name))).toEqual([])
-  })
-
-  it('lists no command that COMMAND_SPECS does not define', () => {
-    const specNames = new Set(specCommandNames)
-    expect([...CLI_COMMAND_NAMES].filter((name) => !specNames.has(name))).toEqual([])
-  })
-
-  it('stays sorted and free of duplicates so additions are easy to review', () => {
-    expect([...CLI_COMMAND_NAMES]).toEqual([...new Set(CLI_COMMAND_NAMES)].sort())
-  })
-})
diff --git a/src/cli/codex-command-classification.test.ts b/src/cli/codex-command-classification.test.ts
index ce92d15ee65..ec178efa55e 100644
--- a/src/cli/codex-command-classification.test.ts
+++ b/src/cli/codex-command-classification.test.ts
@@ -38,6 +38,11 @@ describe('shouldUseRendererBackedCodexTerminal', () => {
     expect(shouldUseRendererBackedCodexTerminal('codex --help')).toBe(false)
   })
 
+  it('reads --no-daemon as a flag, not the subcommand', () => {
+    expect(shouldUseRendererBackedCodexTerminal('codex --no-daemon resume --last')).toBe(true)
+    expect(shouldUseRendererBackedCodexTerminal('codex --no-daemon exec summarize')).toBe(false)
+  })
+
   it('ignores non-Codex commands', () => {
     expect(shouldUseRendererBackedCodexTerminal(undefined)).toBe(false)
     expect(shouldUseRendererBackedCodexTerminal('claude')).toBe(false)
diff --git a/src/cli/codex-command-classification.ts b/src/cli/codex-command-classification.ts
index 941b02c24f6..b68efdcb60d 100644
--- a/src/cli/codex-command-classification.ts
+++ b/src/cli/codex-command-classification.ts
@@ -62,6 +62,7 @@ const CODEX_GLOBAL_BOOLEAN_FLAGS = new Set([
   '--dangerously-bypass-approvals-and-sandbox',
   '--search',
   '--no-alt-screen',
+  '--no-daemon',
   '--help',
   '-h',
   '--version',
diff --git a/src/cli/command-spec.ts b/src/cli/command-spec.ts
index 1922888a292..dbb28a66d71 100644
--- a/src/cli/command-spec.ts
+++ b/src/cli/command-spec.ts
@@ -15,8 +15,13 @@ export type CommandSpec = {
   positionalArgs?: string[]
   examples?: string[]
   notes?: string[]
+  // Why: `--from`/`--terminal` names either the acting caller or a target, and only the spec can
+  // say which. An agent session refuses a caller flag naming anyone else before dispatch.
+  identityFlagRoles?: Partial<Record<IdentityFlag, 'caller' | 'target'>>
 }
 
+export type IdentityFlag = 'from' | 'terminal'
+
 export function specPaths(spec: CommandSpec): string[][] {
   return spec.aliases ? [spec.path, ...spec.aliases] : [spec.path]
 }
diff --git a/src/cli/dispatch.ts b/src/cli/dispatch.ts
index d74de65119e..7ad882b1e11 100644
--- a/src/cli/dispatch.ts
+++ b/src/cli/dispatch.ts
@@ -32,8 +32,7 @@ function buildRoutes(groups: readonly HandlerGroup[]): Map<string, HandlerGroup>
 
 const ROUTES = buildRoutes(HANDLER_GROUPS)
 
-// Why: exposes only the canonical command keys (not the handler internals) so the
-// registry-parity guard can check specs↔handlers without rebuilding the table.
+// Why: exposes only the canonical command keys, not the handler internals.
 export const HANDLER_COMMAND_KEYS: ReadonlySet<string> = new Set(ROUTES.keys())
 
 export async function dispatch(commandPath: string[], ctx: HandlerContext): Promise<void> {
diff --git a/src/cli/handler-group-manifest.test.ts b/src/cli/handler-group-manifest.test.ts
index 3849f39a7c9..147305d72a5 100644
--- a/src/cli/handler-group-manifest.test.ts
+++ b/src/cli/handler-group-manifest.test.ts
@@ -36,27 +36,6 @@ function isHandlerRecord(value: unknown): value is Record<string, unknown> {
 }
 
 describe('handler group manifest', () => {
-  it('lists a loadable group for every entry', async () => {
-    for (const group of HANDLER_GROUPS) {
-      const loaded = await group.load()
-      expect(loaded, `${group.name} resolved to a non-record`).toBeTypeOf('object')
-    }
-  })
-
-  it('matches each group export key-for-key', async () => {
-    const drift: string[] = []
-    for (const group of HANDLER_GROUPS) {
-      const actual = Object.keys(await group.load()).sort()
-      const declared = [...group.keys].sort()
-      if (JSON.stringify(actual) !== JSON.stringify(declared)) {
-        drift.push(
-          `${group.name}: manifest ${JSON.stringify(declared)} !== export ${JSON.stringify(actual)}`
-        )
-      }
-    }
-    expect(drift).toEqual([])
-  })
-
   it('exposes every declared key as a callable handler', async () => {
     const notCallable: string[] = []
     for (const group of HANDLER_GROUPS) {
@@ -70,15 +49,6 @@ describe('handler group manifest', () => {
     expect(notCallable).toEqual([])
   })
 
-  it('reaches every group through dispatch routing', () => {
-    const routes = buildHandlerRoutes(HANDLER_GROUPS)
-    const reached = new Set([...routes.values()].map((group) => group.name))
-    const unreachable = HANDLER_GROUPS.filter((group) => !reached.has(group.name)).map(
-      (group) => group.name
-    )
-    expect(unreachable).toEqual([])
-  })
-
   // Why: dropping a group from the manifest silently unregisters its commands —
   // walk the tree so a new or forgotten handler file fails here, not in prod.
   // Nested modules are spread into a parent group rather than registered under
diff --git a/src/cli/handler-group-manifest.ts b/src/cli/handler-group-manifest.ts
index bda6799a8bc..bf1f1e313d1 100644
--- a/src/cli/handler-group-manifest.ts
+++ b/src/cli/handler-group-manifest.ts
@@ -183,6 +183,11 @@ export const HANDLER_GROUPS: readonly HandlerGroup[] = [
     keys: ['agent hooks prepare-codex', 'agent hooks status', 'agent hooks off', 'agent hooks on'],
     load: async () => (await import('./handlers/agent-hooks.js')).AGENT_HOOK_HANDLERS
   },
+  {
+    name: 'profile-state',
+    keys: ['profile state exports', 'profile state rollback'],
+    load: async () => (await import('./handlers/profile-state.js')).PROFILE_STATE_HANDLERS
+  },
   {
     name: 'diagnostics',
     keys: ['diagnostics memory'],
diff --git a/src/cli/handlers/account-wsl-location.ts b/src/cli/handlers/account-wsl-location.ts
new file mode 100644
index 00000000000..a38aa582672
--- /dev/null
+++ b/src/cli/handlers/account-wsl-location.ts
@@ -0,0 +1,10 @@
+import { parseWslUncPath } from '../../shared/wsl-paths'
+
+// The bridge preserves the caller's distro even when /mnt/c makes cwd a Windows drive path.
+export function getWslAccountTarget(cwd: string): { runtime: 'wsl'; wslDistro: string } | null {
+  const distro =
+    process.platform === 'win32'
+      ? process.env.ORCA_CLI_WSL_DISTRO?.trim() || parseWslUncPath(cwd)?.distro
+      : undefined
+  return distro ? { runtime: 'wsl', wslDistro: distro } : null
+}
diff --git a/src/cli/handlers/account.test.ts b/src/cli/handlers/account.test.ts
index c35f2270e6c..9cecb6f12e4 100644
--- a/src/cli/handlers/account.test.ts
+++ b/src/cli/handlers/account.test.ts
@@ -97,14 +97,16 @@ describe('account CLI handlers', () => {
   const originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform')!
   const originalElectronRunAsNode = process.env.ELECTRON_RUN_AS_NODE
   const originalPathAlias = process.env.Path
+  const originalWslDistroName = process.env.WSL_DISTRO_NAME
+  const originalBridgeDistro = process.env.ORCA_CLI_WSL_DISTRO
   const callMock = vi.fn()
   const client = { call: callMock } as unknown as RuntimeClient
   let logSpy: ReturnType<typeof vi.spyOn>
 
-  function context(agent: string, json = false): HandlerContext {
+  function context(agent: string, json = false, cwd = process.cwd()): HandlerContext {
     return {
       client,
-      cwd: process.cwd(),
+      cwd,
       flags: new Map([['agent', agent]]),
       json,
       rawArgs: []
@@ -136,6 +138,10 @@ describe('account CLI handlers', () => {
     )
     logSpy = vi.spyOn(console, 'log').mockImplementation(() => {})
     process.env.ELECTRON_RUN_AS_NODE = '1'
+    // Why: a test run inside a real distro carries WSL_DISTRO_NAME, which would
+    // leak WSL attribution into every faked-win32 add below.
+    delete process.env.WSL_DISTRO_NAME
+    delete process.env.ORCA_CLI_WSL_DISTRO
   })
 
   afterEach(() => {
@@ -151,6 +157,16 @@ describe('account CLI handlers', () => {
     } else {
       process.env.Path = originalPathAlias
     }
+    if (originalBridgeDistro === undefined) {
+      delete process.env.ORCA_CLI_WSL_DISTRO
+    } else {
+      process.env.ORCA_CLI_WSL_DISTRO = originalBridgeDistro
+    }
+    if (originalWslDistroName === undefined) {
+      delete process.env.WSL_DISTRO_NAME
+    } else {
+      process.env.WSL_DISTRO_NAME = originalWslDistroName
+    }
   })
 
   it('uses Codex device auth and keeps JSON stdout clean', async () => {
@@ -308,6 +324,88 @@ describe('account CLI handlers', () => {
     expect(existsSync(configDir)).toBe(false)
   })
 
+  it('attributes a Claude account added through the WSL bridge to the cwd distro', async () => {
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+
+    await ACCOUNT_HANDLERS['account add'](
+      context('claude', false, String.raw`\\wsl.localhost\Ubuntu-22.04\home\user\project`)
+    )
+
+    const configDir = spawnMock.mock.calls[0]?.[2].env.CLAUDE_CONFIG_DIR
+    expect(callMock).toHaveBeenCalledWith('accounts.addClaudeFromConfigDir', {
+      configDir,
+      runtime: 'wsl',
+      wslDistro: 'Ubuntu-22.04'
+    })
+  })
+
+  it('attributes a Codex account added through the WSL bridge to the cwd distro', async () => {
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+
+    await ACCOUNT_HANDLERS['account add'](
+      context('codex', false, String.raw`\\wsl$\Ubuntu\home\user`)
+    )
+
+    const sourceHome = spawnMock.mock.calls[0]?.[2].env.CODEX_HOME
+    expect(callMock).toHaveBeenCalledWith('accounts.addCodexFromHome', {
+      sourceHome,
+      runtime: 'wsl',
+      wslDistro: 'Ubuntu'
+    })
+  })
+
+  it('uses the explicit bridge distro over an ambient environment or another distro cwd', async () => {
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    process.env.WSL_DISTRO_NAME = 'stale-Windows-value'
+    process.env.ORCA_CLI_WSL_DISTRO = 'Debian'
+
+    await ACCOUNT_HANDLERS['account add'](
+      context('claude', false, String.raw`\\wsl.localhost\Ubuntu-22.04\home\user`)
+    )
+
+    expect(callMock).toHaveBeenCalledWith(
+      'accounts.addClaudeFromConfigDir',
+      expect.objectContaining({ runtime: 'wsl', wslDistro: 'Debian' })
+    )
+  })
+
+  it.each(['claude', 'codex'])(
+    'attributes %s from a Windows mount to the bridge distro',
+    async (agent) => {
+      Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+      process.env.ORCA_CLI_WSL_DISTRO = 'Ubuntu Work'
+      await ACCOUNT_HANDLERS['account add'](context(agent, false, String.raw`C:\work with spaces`))
+      expect(callMock).toHaveBeenCalledWith(
+        agent === 'claude' ? 'accounts.addClaudeFromConfigDir' : 'accounts.addCodexFromHome',
+        expect.objectContaining({ runtime: 'wsl', wslDistro: 'Ubuntu Work' })
+      )
+    }
+  )
+
+  it('ignores an ambient WSL distro in a native Windows account add', async () => {
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    process.env.WSL_DISTRO_NAME = 'stale-Windows-value'
+    await ACCOUNT_HANDLERS['account add'](context('codex', false, String.raw`C:\work`))
+    const sourceHome = spawnMock.mock.calls[0]?.[2].env.CODEX_HOME
+    expect(callMock).toHaveBeenCalledWith('accounts.addCodexFromHome', { sourceHome })
+  })
+
+  it.each(['linux', 'darwin'])(
+    'keeps host attribution when the CLI runs on %s',
+    async (platform) => {
+      // Why: a Linux CLI talks to a Linux runtime whose accounts are host-lane;
+      // WSL_DISTRO_NAME there names the CLI's own environment, not a target lane.
+      Object.defineProperty(process, 'platform', { configurable: true, value: platform })
+      process.env.WSL_DISTRO_NAME = 'Ubuntu-22.04'
+      process.env.ORCA_CLI_WSL_DISTRO = 'Ubuntu-22.04'
+
+      await ACCOUNT_HANDLERS['account add'](context('codex'))
+
+      const sourceHome = spawnMock.mock.calls[0]?.[2].env.CODEX_HOME
+      expect(callMock).toHaveBeenCalledWith('accounts.addCodexFromHome', { sourceHome })
+    }
+  )
+
   it('waits for physical child close before removing interrupted login credentials', async () => {
     // Why: deleting first lets the still-live login recreate credentials afterward.
     Object.defineProperty(process, 'platform', { configurable: true, value: 'linux' })
diff --git a/src/cli/handlers/account.ts b/src/cli/handlers/account.ts
index 5a8bd4d3c6c..b2a06c6d2e2 100644
--- a/src/cli/handlers/account.ts
+++ b/src/cli/handlers/account.ts
@@ -34,6 +34,7 @@ import {
   type InteractiveLoginSession,
   withInteractiveLoginCleanup
 } from './interactive-login-interruption'
+import { getWslAccountTarget } from './account-wsl-location'
 
 // Why: add returns just that provider's state; list returns the full snapshot.
 type AccountsListSnapshot = {
@@ -194,7 +195,7 @@ async function cleanupClaudeLoginArtifacts(
 }
 
 /** Logs into a Claude account in a temp config dir, then registers it with the local runtime. */
-async function addClaudeAccount({ client, json }: HandlerContext): Promise<void> {
+async function addClaudeAccount({ client, cwd, json }: HandlerContext): Promise<void> {
   const configDir = mkdtempSync(join(tmpdir(), 'orca-account-add-claude-'))
   const session: InteractiveLoginSession = {
     child: null,
@@ -225,6 +226,7 @@ async function addClaudeAccount({ client, json }: HandlerContext): Promise<void>
       session.registering = true
       return client.call<ClaudeRateLimitAccountsState>('accounts.addClaudeFromConfigDir', {
         configDir,
+        ...getWslAccountTarget(cwd),
         ...(process.platform === 'darwin'
           ? {
               previousLegacyCredentialsSha256: legacyCredentials
@@ -239,7 +241,7 @@ async function addClaudeAccount({ client, json }: HandlerContext): Promise<void>
 }
 
 /** Logs into a Codex account in a temp CODEX_HOME, then registers it with the local runtime. */
-async function addCodexAccount({ client, json }: HandlerContext): Promise<void> {
+async function addCodexAccount({ client, cwd, json }: HandlerContext): Promise<void> {
   const codexHome = mkdtempSync(join(tmpdir(), 'orca-account-add-codex-'))
   const session: InteractiveLoginSession = {
     child: null,
@@ -263,7 +265,8 @@ async function addCodexAccount({ client, json }: HandlerContext): Promise<void>
       )
       session.registering = true
       return client.call<CodexRateLimitAccountsState>('accounts.addCodexFromHome', {
-        sourceHome: codexHome
+        sourceHome: codexHome,
+        ...getWslAccountTarget(cwd)
       })
     }
   )
diff --git a/src/cli/handlers/agent-hooks-load-boundary.test.ts b/src/cli/handlers/agent-hooks-load-boundary.test.ts
new file mode 100644
index 00000000000..ff11e2a2d50
--- /dev/null
+++ b/src/cli/handlers/agent-hooks-load-boundary.test.ts
@@ -0,0 +1,42 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import { main } from '../index'
+
+const { prepare } = vi.hoisted(() => ({ prepare: vi.fn() }))
+vi.mock('../runtime-client', () => ({
+  RuntimeClient: class {
+    async call() {
+      return { result: { settings: { agentStatusHooksEnabled: true } } }
+    }
+  },
+  RuntimeClientError: Error,
+  getDefaultUserDataPath: () => '/unused/user-data'
+}))
+vi.mock('../../main/codex/managed-home-shell-preflight', () => ({
+  prepareManagedCodexHomeBeforeShellLaunch: prepare
+}))
+vi.mock('../../main/persistence/profile-state/profile-state-offline-settings', () => {
+  throw new Error('Offline profile settings loaded during online preparation')
+})
+vi.mock('../../main/persistence/profile-state/profile-state-access', () => {
+  throw new Error('Profile admission loaded during online preparation')
+})
+vi.mock('../profile-state-location', () => {
+  throw new Error('Profile location loaded during online preparation')
+})
+
+afterEach(() => {
+  vi.unstubAllEnvs()
+  vi.restoreAllMocks()
+  process.exitCode = undefined
+})
+
+it('prepares Codex through the runtime without loading offline profile storage', async () => {
+  vi.stubEnv('WSL_DISTRO_NAME', '')
+  const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+  await main(['agent', 'hooks', 'prepare-codex'])
+  expect(error).not.toHaveBeenCalled()
+  expect(prepare).toHaveBeenCalledWith({
+    userDataPath: '/unused/user-data',
+    hooksEnabled: true
+  })
+})
diff --git a/src/cli/handlers/agent-hooks.test.ts b/src/cli/handlers/agent-hooks.test.ts
index 279a8900bec..2d75a096cc4 100644
--- a/src/cli/handlers/agent-hooks.test.ts
+++ b/src/cli/handlers/agent-hooks.test.ts
@@ -1,9 +1,33 @@
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import * as fs from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  createDefaultLocalOrcaProfile,
+  DEFAULT_LOCAL_ORCA_PROFILE_ID
+} from '../../shared/orca-profiles'
 import { getDefaultPersistedState } from '../../shared/constants'
 import type { PersistedState } from '../../shared/persisted-state-types'
+import {
+  getOrcaProfileDataFile,
+  getOrcaProfileStateDatabaseFile
+} from '../../main/orca-profiles/profile-storage-paths'
+import { openProfileStateDatabase } from '../../main/persistence/profile-state/profile-state-database'
+import * as profileStateDatabase from '../../main/persistence/profile-state/profile-state-database'
+import {
+  exportProfileStateJson,
+  hashProfileStateJson,
+  importProfileStateJson
+} from '../../main/persistence/profile-state/profile-state-documents'
+import { ProfileStateSqliteAuthority } from '../../main/persistence/profile-state/profile-state-sqlite-authority'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission,
+  type ProfileStateRuntimeAdmission
+} from '../../main/persistence/profile-state/profile-state-access'
+
+vi.mock('node:fs', async (original) => ({ ...(await original<typeof fs>()) }))
 
 const {
   applyAgentStatusHooksEnabledMock,
@@ -65,8 +89,16 @@ vi.mock('../../main/codex/managed-home-shell-preflight', () => ({
 
 import { main } from '../index'
 
-function readDataFile(userDataPath: string): PersistedState {
-  return JSON.parse(readFileSync(join(userDataPath, 'orca-data.json'), 'utf-8')) as PersistedState
+function readDefaultProfileState(userDataPath: string) {
+  const opened = openProfileStateDatabase(
+    getOrcaProfileStateDatabaseFile(DEFAULT_LOCAL_ORCA_PROFILE_ID, userDataPath),
+    DEFAULT_LOCAL_ORCA_PROFILE_ID
+  )
+  try {
+    return JSON.parse(exportProfileStateJson(opened.db))
+  } finally {
+    opened.db.close()
+  }
 }
 
 function writeDataFile(userDataPath: string, state: PersistedState): void {
@@ -74,6 +106,17 @@ function writeDataFile(userDataPath: string, state: PersistedState): void {
   writeFileSync(join(userDataPath, 'orca-data.json'), JSON.stringify(state, null, 2), 'utf-8')
 }
 
+function writeActiveProfileIndex(userDataPath: string, profileId: string): void {
+  writeFileSync(
+    join(userDataPath, 'orca-profile-index.json'),
+    JSON.stringify({
+      activeProfileId: profileId,
+      profiles: [{ ...createDefaultLocalOrcaProfile(1), id: profileId }]
+    }),
+    'utf-8'
+  )
+}
+
 async function runAgentHooksOff(userDataPath: string): Promise<void> {
   getDefaultUserDataPathMock.mockReturnValue(userDataPath)
   await main(['agent', 'hooks', 'off', '--json'], userDataPath)
@@ -84,7 +127,7 @@ describe('agent hooks CLI handler', () => {
 
   beforeEach(() => {
     userDataPath = mkdtempSync(join(tmpdir(), 'orca-agent-hooks-cli-'))
-    applyAgentStatusHooksEnabledMock.mockReturnValue([])
+    applyAgentStatusHooksEnabledMock.mockReset().mockReturnValue([])
     callMock.mockReset()
     getCliStatusMock.mockClear()
     getManagedAgentHookStatusesMock.mockReturnValue([])
@@ -103,12 +146,249 @@ describe('agent hooks CLI handler', () => {
   it('keeps new card style off when creating offline settings for a fresh profile', async () => {
     await runAgentHooksOff(userDataPath)
 
-    const persisted = readDataFile(userDataPath)
+    const persisted = readDefaultProfileState(userDataPath)
 
     expect(persisted.settings.experimentalNewWorktreeCardStyle).toBe(false)
     expect(persisted.settings.agentStatusHooksEnabled).toBe(false)
+    expect(existsSync(join(userDataPath, 'orca-data.json'))).toBe(false)
+    expect(existsSync(getOrcaProfileDataFile(DEFAULT_LOCAL_ORCA_PROFILE_ID, userDataPath))).toBe(
+      false
+    )
   })
 
+  it.each(['fresh', 'root-json', 'profile-json'] as const)(
+    'refuses an incapable offline writer before any %s profile or hook changes',
+    async (source) => {
+      const profileId = 'unsupported-runtime'
+      const state = getDefaultPersistedState(userDataPath)
+      const directory =
+        source === 'profile-json' ? join(userDataPath, 'profiles', profileId) : userDataPath
+      if (source !== 'fresh') {
+        writeDataFile(directory, state)
+      }
+      if (source === 'profile-json') {
+        writeActiveProfileIndex(userDataPath, profileId)
+      }
+      vi.spyOn(profileStateDatabase, 'isProfileStateSqliteAvailable').mockReturnValue(false)
+
+      await runAgentHooksOff(userDataPath)
+
+      expect(process.exitCode).toBe(1)
+      expect(applyAgentStatusHooksEnabledMock).not.toHaveBeenCalled()
+      expect(existsSync(join(userDataPath, '.profile-state-access'))).toBe(false)
+      expect(existsSync(getOrcaProfileStateDatabaseFile(profileId, userDataPath))).toBe(false)
+      expect(
+        existsSync(getOrcaProfileStateDatabaseFile(DEFAULT_LOCAL_ORCA_PROFILE_ID, userDataPath))
+      ).toBe(false)
+      if (source !== 'fresh') {
+        expect(JSON.parse(readFileSync(join(directory, 'orca-data.json'), 'utf8'))).toEqual(state)
+      }
+      if (source !== 'profile-json') {
+        expect(existsSync(join(userDataPath, 'orca-profile-index.json'))).toBe(false)
+      }
+      expect(console.log).toHaveBeenCalledWith(expect.stringContaining('bundled Orca CLI'))
+    }
+  )
+
+  it('keeps runtime writes available to an incapable CLI', async () => {
+    vi.spyOn(profileStateDatabase, 'isProfileStateSqliteAvailable').mockReturnValue(false)
+    getCliStatusMock.mockResolvedValueOnce({
+      id: 'test-status',
+      ok: true,
+      result: {
+        app: { running: true, pid: null },
+        runtime: { state: 'ready', reachable: true, runtimeId: null },
+        graph: { state: 'ready' }
+      },
+      _meta: { runtimeId: 'test' }
+    })
+    callMock.mockResolvedValueOnce({ result: {} })
+
+    await runAgentHooksOff(userDataPath)
+
+    expect(process.exitCode).not.toBe(1)
+    expect(callMock).toHaveBeenCalledWith(
+      'settings.update',
+      { agentStatusHooksEnabled: false },
+      { timeoutMs: 10_000 }
+    )
+    expect(applyAgentStatusHooksEnabledMock).not.toHaveBeenCalled()
+    expect(existsSync(join(userDataPath, '.profile-state-access'))).toBe(false)
+    expect(existsSync(join(userDataPath, 'orca-profile-index.json'))).toBe(false)
+  })
+
+  it.each(['root', 'indexed'] as const)(
+    'reads %s JSON status without SQLite or migration',
+    async (source) => {
+      const profileId = 'read-only'
+      const directory =
+        source === 'indexed' ? join(userDataPath, 'profiles', profileId) : userDataPath
+      writeDataFile(directory, getDefaultPersistedState(userDataPath))
+      if (source === 'indexed') {
+        writeActiveProfileIndex(userDataPath, profileId)
+      }
+      getDefaultUserDataPathMock.mockReturnValue(userDataPath)
+      vi.spyOn(profileStateDatabase, 'isProfileStateSqliteAvailable').mockReturnValue(false)
+      const original = readFileSync(join(directory, 'orca-data.json'), 'utf8')
+
+      await main(['agent', 'hooks', 'status', '--json'], userDataPath)
+
+      expect(process.exitCode).not.toBe(1)
+      expect(readFileSync(join(directory, 'orca-data.json'), 'utf8')).toBe(original)
+      expect(existsSync(join(directory, 'profile-state.db'))).toBe(false)
+      expect(applyAgentStatusHooksEnabledMock).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['missing', 'corrupt'] as const)(
+    'uses the backup index when the primary is %s',
+    async (primary) => {
+      const profileId = 'backup-selected'
+      const indexPath = join(userDataPath, 'orca-profile-index.json')
+      writeActiveProfileIndex(userDataPath, profileId)
+      fs.renameSync(indexPath, `${indexPath}.bak`)
+      if (primary === 'corrupt') {
+        writeFileSync(indexPath, '{broken')
+      }
+      writeDataFile(
+        join(userDataPath, 'profiles', profileId),
+        getDefaultPersistedState(userDataPath)
+      )
+
+      await runAgentHooksOff(userDataPath)
+
+      expect(process.exitCode).not.toBe(1)
+      expect(existsSync(getOrcaProfileStateDatabaseFile(profileId, userDataPath))).toBe(true)
+      expect(
+        existsSync(getOrcaProfileStateDatabaseFile(DEFAULT_LOCAL_ORCA_PROFILE_ID, userDataPath))
+      ).toBe(false)
+      const { ensureActiveOrcaProfile } =
+        await import('../../main/orca-profiles/profile-index-store.js')
+      expect(ensureActiveOrcaProfile(userDataPath).profile.id).toBe(profileId)
+    }
+  )
+
+  it.each([0, 1, 2, 3, 4])('refuses a pre-index root with only legacy backup %s', async (slot) => {
+    const backup = join(userDataPath, `orca-data.json.bak.${slot}`)
+    const source = '{"settings":{"agentStatusHooksEnabled":true}}'
+    writeFileSync(backup, source)
+
+    await runAgentHooksOff(userDataPath)
+
+    expect(process.exitCode).toBe(1)
+    expect(readFileSync(backup, 'utf8')).toBe(source)
+    expect(existsSync(join(userDataPath, 'orca-profile-index.json'))).toBe(false)
+    expect(existsSync(join(userDataPath, 'profiles'))).toBe(false)
+    expect(applyAgentStatusHooksEnabledMock).not.toHaveBeenCalled()
+  })
+
+  it.each(['root-json', 'profile-json', 'sqlite'] as const)(
+    'refuses offline %s mutation when startup wins after the stopped-status response',
+    async (backend) => {
+      const profileId = 'startup-race'
+      const directory =
+        backend === 'root-json' ? userDataPath : join(userDataPath, 'profiles', profileId)
+      mkdirSync(directory, { recursive: true })
+      const dataFile = join(directory, 'orca-data.json')
+      const raw = JSON.stringify({
+        settings: { agentStatusHooksEnabled: true },
+        unknown: { retained: null }
+      })
+      writeFileSync(dataFile, raw)
+      if (backend !== 'root-json') {
+        writeActiveProfileIndex(userDataPath, profileId)
+      }
+      const databaseFile = join(directory, 'profile-state.db')
+      if (backend === 'sqlite') {
+        const opened = openProfileStateDatabase(databaseFile, profileId)
+        try {
+          importProfileStateJson(opened.db, raw, {
+            acceptedLegacyJsonHash: hashProfileStateJson(raw)
+          })
+        } finally {
+          opened.db.close()
+        }
+      }
+      const stopped = await getCliStatusMock()
+      let runtime: ProfileStateRuntimeAdmission | undefined
+      getCliStatusMock.mockImplementationOnce(async () => {
+        runtime = acquireProfileStateRuntimeAdmission(userDataPath)
+        return stopped
+      })
+      try {
+        await runAgentHooksOff(userDataPath)
+        expect(process.exitCode).toBe(1)
+        expect(applyAgentStatusHooksEnabledMock).not.toHaveBeenCalled()
+        expect(readFileSync(dataFile, 'utf8')).toBe(raw)
+        if (backend === 'sqlite') {
+          const opened = openProfileStateDatabase(databaseFile, profileId)
+          try {
+            expect(JSON.parse(exportProfileStateJson(opened.db))).toEqual(JSON.parse(raw))
+          } finally {
+            opened.db.close()
+          }
+        }
+      } finally {
+        runtime?.release()
+      }
+      process.exitCode = undefined
+      await runAgentHooksOff(userDataPath)
+      expect(process.exitCode).not.toBe(1)
+      expect(applyAgentStatusHooksEnabledMock).toHaveBeenCalledOnce()
+    }
+  )
+
+  it.each(['root-json', 'profile-json'] as const)(
+    'excludes startup and other offline writers through %s publication',
+    async (backend) => {
+      const profileId = 'offline-first'
+      const directory =
+        backend === 'root-json' ? userDataPath : join(userDataPath, 'profiles', profileId)
+      mkdirSync(directory, { recursive: true })
+      if (backend === 'profile-json') {
+        writeActiveProfileIndex(userDataPath, profileId)
+      }
+      const dataFile = join(directory, 'orca-data.json')
+      writeFileSync(dataFile, JSON.stringify({ settings: { agentStatusHooksEnabled: true } }))
+      const databaseFile = getOrcaProfileStateDatabaseFile(
+        backend === 'root-json' ? DEFAULT_LOCAL_ORCA_PROFILE_ID : profileId,
+        userDataPath
+      )
+      const link = fs.linkSync
+      let checkedPublication = false
+      vi.spyOn(fs, 'linkSync').mockImplementation((source, target) => {
+        if (target === databaseFile) {
+          checkedPublication = true
+          expect(() => acquireProfileStateRuntimeAdmission(userDataPath)).toThrow()
+          expect(() => acquireProfileStateMaintenance(userDataPath)).toThrow()
+        }
+        return link(source, target)
+      })
+      await runAgentHooksOff(userDataPath)
+      expect(checkedPublication).toBe(true)
+      expect(process.exitCode).not.toBe(1)
+      const runtime = acquireProfileStateRuntimeAdmission(userDataPath)
+      try {
+        const opened = openProfileStateDatabase(
+          databaseFile,
+          backend === 'root-json' ? DEFAULT_LOCAL_ORCA_PROFILE_ID : profileId
+        )
+        try {
+          expect(
+            JSON.parse(exportProfileStateJson(opened.db)).settings.agentStatusHooksEnabled
+          ).toBe(false)
+        } finally {
+          opened.db.close()
+        }
+        expect(JSON.parse(readFileSync(dataFile, 'utf8')).settings.agentStatusHooksEnabled).toBe(
+          true
+        )
+      } finally {
+        runtime.release()
+      }
+    }
+  )
+
   it('keeps missing new card style off when updating offline settings', async () => {
     const existing = getDefaultPersistedState(userDataPath)
     delete existing.settings.experimentalNewWorktreeCardStyle
@@ -116,7 +396,9 @@ describe('agent hooks CLI handler', () => {
 
     await runAgentHooksOff(userDataPath)
 
-    expect(readDataFile(userDataPath).settings.experimentalNewWorktreeCardStyle).toBe(false)
+    expect(readDefaultProfileState(userDataPath).settings.experimentalNewWorktreeCardStyle).toBe(
+      false
+    )
   })
 
   it('preserves an existing explicit new card style opt-in when updating offline settings', async () => {
@@ -126,9 +408,36 @@ describe('agent hooks CLI handler', () => {
 
     await runAgentHooksOff(userDataPath)
 
-    expect(readDataFile(userDataPath).settings.experimentalNewWorktreeCardStyle).toBe(true)
+    expect(readDefaultProfileState(userDataPath).settings.experimentalNewWorktreeCardStyle).toBe(
+      true
+    )
   })
 
+  it.each(['on', 'off', 'status', 'prepare-codex'])(
+    'refuses explicit remote selection before local hook command %s',
+    async (command) => {
+      const state = getDefaultPersistedState(userDataPath)
+      writeDataFile(userDataPath, state)
+      const before = readFileSync(join(userDataPath, 'orca-data.json'), 'utf8')
+      getDefaultUserDataPathMock.mockReturnValue(userDataPath)
+
+      for (const selector of ['environment', 'pairing-code']) {
+        process.exitCode = undefined
+        await main(
+          ['agent', 'hooks', command, `--${selector}`, 'unreachable-host', '--json'],
+          userDataPath
+        )
+
+        expect(process.exitCode).toBe(1)
+        expect(getCliStatusMock).not.toHaveBeenCalled()
+        expect(callMock).not.toHaveBeenCalled()
+        expect(applyAgentStatusHooksEnabledMock).not.toHaveBeenCalled()
+        expect(prepareManagedCodexHomeBeforeShellLaunchMock).not.toHaveBeenCalled()
+        expect(readFileSync(join(userDataPath, 'orca-data.json'), 'utf8')).toBe(before)
+      }
+    }
+  )
+
   it('prepares managed Codex trust with the current hooks setting', async () => {
     const state = getDefaultPersistedState(userDataPath)
     state.settings.agentStatusHooksEnabled = false
@@ -231,4 +540,157 @@ describe('agent hooks CLI handler', () => {
       timeoutMs: 1_000
     })
   })
+
+  it('updates an established SQLite profile without rewriting its JSON export', async () => {
+    const profileId = 'work-profile'
+    const profileDirectory = join(userDataPath, 'profiles', profileId)
+    const dataFile = getOrcaProfileDataFile(profileId, userDataPath)
+    const databaseFile = getOrcaProfileStateDatabaseFile(profileId, userDataPath)
+    const raw = JSON.stringify({
+      settings: {
+        agentStatusHooksEnabled: true,
+        disabledTuiAgents: ['codex'],
+        opencodeSessionCookie: 'encrypted-ciphertext'
+      },
+      unknownDomain: { preserved: true }
+    })
+    mkdirSync(profileDirectory, { recursive: true })
+    writeFileSync(dataFile, raw, 'utf-8')
+    writeActiveProfileIndex(userDataPath, profileId)
+    const opened = openProfileStateDatabase(databaseFile, profileId)
+    try {
+      importProfileStateJson(opened.db, raw, {
+        acceptedLegacyJsonHash: hashProfileStateJson(raw)
+      })
+    } finally {
+      opened.db.close()
+    }
+
+    await runAgentHooksOff(userDataPath)
+
+    expect(readFileSync(dataFile, 'utf-8')).toBe(raw)
+    const readBack = openProfileStateDatabase(databaseFile, profileId)
+    try {
+      expect(JSON.parse(exportProfileStateJson(readBack.db))).toMatchObject({
+        settings: {
+          agentStatusHooksEnabled: false,
+          opencodeSessionCookie: 'encrypted-ciphertext',
+          disabledTuiAgents: ['codex']
+        },
+        unknownDomain: { preserved: true }
+      })
+    } finally {
+      readBack.db.close()
+    }
+  })
+
+  it.each(['update-failed', 'unreachable', 'status-failed'] as const)(
+    'preserves a live SQLite writer when runtime contact is %s',
+    async (failure) => {
+      const profileId = 'live-profile'
+      const profileDirectory = join(userDataPath, 'profiles', profileId)
+      mkdirSync(profileDirectory, { recursive: true })
+      writeActiveProfileIndex(userDataPath, profileId)
+      const authority = new ProfileStateSqliteAuthority(
+        getOrcaProfileStateDatabaseFile(profileId, userDataPath),
+        profileId
+      )
+      authority.writeSerializedState(
+        Buffer.from(JSON.stringify({ settings: { agentStatusHooksEnabled: true } }))
+      )
+      if (failure === 'status-failed') {
+        getCliStatusMock.mockRejectedValueOnce(new Error('status transport unavailable'))
+      } else {
+        getCliStatusMock.mockResolvedValueOnce({
+          id: 'test-status',
+          ok: true,
+          result: {
+            app: { running: true, pid: null },
+            runtime: {
+              state: failure === 'unreachable' ? 'starting' : 'ready',
+              reachable: failure !== 'unreachable',
+              runtimeId: null
+            },
+            graph: { state: 'ready' }
+          },
+          _meta: { runtimeId: 'test' }
+        })
+        callMock.mockRejectedValueOnce(new Error('settings request timed out'))
+      }
+      try {
+        await runAgentHooksOff(userDataPath)
+
+        expect(process.exitCode).toBe(1)
+        expect(applyAgentStatusHooksEnabledMock).not.toHaveBeenCalled()
+        expect(() =>
+          authority.writeSerializedDomains([
+            { domain: 'ui', payload: '{"marker":"still-writable"}' }
+          ])
+        ).not.toThrow()
+        const persisted = JSON.parse(authority.readSerializedState() ?? '{}')
+        expect(persisted).toMatchObject({
+          settings: { agentStatusHooksEnabled: true },
+          ui: { marker: 'still-writable' }
+        })
+      } finally {
+        authority.close()
+      }
+    }
+  )
+
+  it('imports a JSON-only active profile before the first settings mutation', async () => {
+    const profileId = 'json-profile'
+    const profileDirectory = join(userDataPath, 'profiles', profileId)
+    mkdirSync(profileDirectory, { recursive: true })
+    writeDataFile(profileDirectory, getDefaultPersistedState(userDataPath))
+    writeActiveProfileIndex(userDataPath, profileId)
+
+    await runAgentHooksOff(userDataPath)
+
+    expect(existsSync(getOrcaProfileStateDatabaseFile(profileId, userDataPath))).toBe(true)
+    expect(
+      JSON.parse(readFileSync(getOrcaProfileDataFile(profileId, userDataPath), 'utf-8')).settings
+        .agentStatusHooksEnabled
+    ).toBe(true)
+    const opened = openProfileStateDatabase(
+      getOrcaProfileStateDatabaseFile(profileId, userDataPath),
+      profileId
+    )
+    try {
+      expect(JSON.parse(exportProfileStateJson(opened.db)).settings.agentStatusHooksEnabled).toBe(
+        false
+      )
+    } finally {
+      opened.db.close()
+    }
+  })
+
+  it('fails closed when a profile has corrupt SQLite alongside legacy JSON', async () => {
+    const profileId = 'corrupt-profile'
+    const profileDirectory = join(userDataPath, 'profiles', profileId)
+    mkdirSync(profileDirectory, { recursive: true })
+    const state = getDefaultPersistedState(userDataPath)
+    writeDataFile(profileDirectory, state)
+    writeActiveProfileIndex(userDataPath, profileId)
+    const databaseFile = getOrcaProfileStateDatabaseFile(profileId, userDataPath)
+    writeFileSync(databaseFile, 'not sqlite', 'utf-8')
+    const before = readFileSync(getOrcaProfileDataFile(profileId, userDataPath), 'utf-8')
+
+    await runAgentHooksOff(userDataPath)
+
+    expect(process.exitCode).toBe(1)
+    expect(readFileSync(getOrcaProfileDataFile(profileId, userDataPath), 'utf-8')).toBe(before)
+  })
+
+  it('fails closed when a profile index is present but unreadable', async () => {
+    const legacy = getDefaultPersistedState(userDataPath)
+    writeDataFile(userDataPath, legacy)
+    writeFileSync(join(userDataPath, 'orca-profile-index.json'), '{ torn', 'utf-8')
+    const before = readFileSync(join(userDataPath, 'orca-data.json'), 'utf-8')
+
+    await runAgentHooksOff(userDataPath)
+
+    expect(process.exitCode).toBe(1)
+    expect(readFileSync(join(userDataPath, 'orca-data.json'), 'utf-8')).toBe(before)
+  })
 })
diff --git a/src/cli/handlers/agent-hooks.ts b/src/cli/handlers/agent-hooks.ts
index 4fcfe64f9b7..91fd5ecde06 100644
--- a/src/cli/handlers/agent-hooks.ts
+++ b/src/cli/handlers/agent-hooks.ts
@@ -1,9 +1,7 @@
-import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs'
-import { homedir } from 'node:os'
-import { dirname, join } from 'node:path'
-import { randomUUID } from 'node:crypto'
+import { join } from 'node:path'
 import type { CommandHandler } from '../dispatch'
 import { printResult } from '../format'
+import { rejectRemoteSelectionFlags } from '../remote-selection-flag-rejection'
 import {
   RuntimeClientError,
   type RuntimeClient,
@@ -11,11 +9,12 @@ import {
   getDefaultUserDataPath
 } from '../runtime-client'
 import type { AgentHookInstallStatus } from '../../shared/agent-hook-types'
-import { getDefaultPersistedState } from '../../shared/constants'
+import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../shared/orca-profiles'
 import { normalizeDisabledTuiAgents } from '../../shared/tui-agent-selection'
 import type { GlobalSettings } from '../../shared/global-settings-types'
-import type { PersistedState } from '../../shared/persisted-state-types'
 import { prepareManagedCodexHomeBeforeShellLaunch } from '../../main/codex/managed-home-shell-preflight'
+import { isAgentStatusHooksEnabledForAgent } from '../../shared/agent-status-hooks-setting'
+import type { ProfileStateOfflineLocation } from '../../main/persistence/profile-state/profile-state-offline-settings'
 
 type AgentHookCommandResult = {
   enabled: boolean
@@ -27,82 +26,49 @@ type AgentHookCommandResult = {
 // Covers managed-home verification, WSL identity, trust grant, and bounded app-server reap.
 const WSL_CODEX_PREPARE_TIMEOUT_MS = 50_000
 
-function getDataPath(): string {
+async function getDataPath(): Promise<string> {
+  return (
+    (await getProfileStateLocation())?.dataFile ?? join(getDefaultUserDataPath(), 'orca-data.json')
+  )
+}
+
+async function getProfileStateLocation(): Promise<ProfileStateOfflineLocation | undefined> {
+  const { getActiveProfileStateLocation } = await import('../profile-state-location.js')
+  return getActiveProfileStateLocation()
+}
+
+function legacyProfileStateLocation(): ProfileStateOfflineLocation {
   const userDataPath = getDefaultUserDataPath()
-  const indexPath = join(userDataPath, 'orca-profile-index.json')
-  for (const candidate of [indexPath, `${indexPath}.bak`]) {
-    try {
-      const parsed: unknown = JSON.parse(readFileSync(candidate, 'utf-8'))
-      if (!isRecord(parsed) || !Array.isArray(parsed.profiles)) {
-        continue
-      }
-      const profileId = parsed.activeProfileId
-      if (
-        typeof profileId === 'string' &&
-        /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(profileId) &&
-        parsed.profiles.some((profile) => isRecord(profile) && profile.id === profileId)
-      ) {
-        return join(userDataPath, 'profiles', profileId, 'orca-data.json')
-      }
-    } catch {
-      // Try the profile-index backup, then the legacy pre-profile path.
-    }
-  }
-  return join(userDataPath, 'orca-data.json')
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value)
-}
-
-function readPersistedState(dataPath: string): PersistedState {
-  if (!existsSync(dataPath)) {
-    return getDefaultPersistedState(homedir())
-  }
-  try {
-    const parsed = JSON.parse(readFileSync(dataPath, 'utf-8'))
-    if (!isRecord(parsed)) {
-      throw new Error('file does not contain a JSON object')
-    }
-    return parsed as PersistedState
-  } catch (error) {
-    throw new RuntimeClientError(
-      'runtime_error',
-      `Could not read ${dataPath}: ${error instanceof Error ? error.message : String(error)}`
-    )
-  }
-}
-
-function writePersistedState(dataPath: string, state: PersistedState): void {
-  mkdirSync(dirname(dataPath), { recursive: true })
-  const tmpPath = join(dirname(dataPath), `.${Date.now()}-${randomUUID()}.tmp`)
-  let renamed = false
-  try {
-    writeFileSync(tmpPath, `${JSON.stringify(state, null, 2)}\n`, 'utf-8')
-    renameSync(tmpPath, dataPath)
-    renamed = true
-  } finally {
-    if (!renamed && existsSync(tmpPath)) {
-      try {
-        unlinkSync(tmpPath)
-      } catch {
-        // best effort
-      }
-    }
-  }
-}
-
-function readHookSettingsFromDisk(): Pick<
-  GlobalSettings,
-  'agentStatusHooksEnabled' | 'disabledTuiAgents'
-> {
-  const state = readPersistedState(getDataPath())
   return {
-    agentStatusHooksEnabled: state.settings?.agentStatusHooksEnabled !== false,
-    disabledTuiAgents: normalizeDisabledTuiAgents(state.settings?.disabledTuiAgents)
+    dataFile: join(userDataPath, 'orca-data.json'),
+    databaseFile: join(userDataPath, 'profile-state.db'),
+    profileId: DEFAULT_LOCAL_ORCA_PROFILE_ID
   }
 }
 
+async function readHookSettingsFromDisk(): Promise<
+  Pick<GlobalSettings, 'agentStatusHooksEnabled' | 'disabledTuiAgents'>
+> {
+  const { acquireProfileStateRuntimeAdmission } =
+    await import('../../main/persistence/profile-state/profile-state-access.js')
+  const admission = acquireProfileStateRuntimeAdmission(getDefaultUserDataPath())
+  try {
+    return await readAdmittedHookSettingsFromDisk()
+  } finally {
+    admission.release()
+  }
+}
+
+async function readAdmittedHookSettingsFromDisk(): Promise<
+  Pick<GlobalSettings, 'agentStatusHooksEnabled' | 'disabledTuiAgents'>
+> {
+  const { readAgentHookSettingsFromProfileState } =
+    await import('../../main/persistence/profile-state/profile-state-offline-settings.js')
+  return readAgentHookSettingsFromProfileState(
+    (await getProfileStateLocation()) ?? legacyProfileStateLocation()
+  )
+}
+
 async function readHookSettings(
   client: RuntimeClient
 ): Promise<Pick<GlobalSettings, 'agentStatusHooksEnabled' | 'disabledTuiAgents'>> {
@@ -123,42 +89,66 @@ async function readHookSettings(
   return readHookSettingsFromDisk()
 }
 
-function updateEnabledOnDisk(enabled: boolean): {
+async function updateEnabledOnDisk(enabled: boolean): Promise<{
   settingsPath: string
   settings: Pick<GlobalSettings, 'agentCmdOverrides' | 'disabledTuiAgents'>
-} {
-  const dataPath = getDataPath()
-  const state = readPersistedState(dataPath)
-  state.settings = {
-    ...getDefaultPersistedState(homedir()).settings,
-    ...state.settings,
-    agentStatusHooksEnabled: enabled
-  }
-  writePersistedState(dataPath, state)
-  return {
-    settingsPath: dataPath,
-    settings: {
-      agentCmdOverrides: state.settings.agentCmdOverrides ?? {},
-      disabledTuiAgents: state.settings.disabledTuiAgents ?? []
-    }
+}> {
+  const { assertOfflineProfileStateMutationRuntime } =
+    await import('../../main/persistence/profile-state/profile-state-offline-settings.js')
+  assertOfflineProfileStateMutationRuntime()
+  const { acquireProfileStateMaintenance } =
+    await import('../../main/persistence/profile-state/profile-state-access.js')
+  // A stopped-status response cannot exclude startup racing the first import.
+  const maintenance = acquireProfileStateMaintenance(getDefaultUserDataPath())
+  try {
+    return await updateAdmittedEnabledOnDisk(enabled)
+  } finally {
+    maintenance.release()
   }
 }
 
+async function updateAdmittedEnabledOnDisk(enabled: boolean): Promise<{
+  settingsPath: string
+  settings: Pick<GlobalSettings, 'agentCmdOverrides' | 'disabledTuiAgents'>
+}> {
+  const { updateAgentHookSettingsFromProfileState, readAgentHookSettingsFromProfileState } =
+    await import('../../main/persistence/profile-state/profile-state-offline-settings.js')
+  let location = await getProfileStateLocation()
+  if (!location) {
+    const legacy = legacyProfileStateLocation()
+    const { classifyProfileStateStorage } =
+      await import('../../main/persistence/profile-state/profile-state-storage-classification.js')
+    const storage = classifyProfileStateStorage(legacy.dataFile, legacy.databaseFile)
+    if (storage !== 'json-only' && storage !== 'neither') {
+      throw new RuntimeClientError('runtime_error', 'Profile state has no active profile index.')
+    }
+    // Validate retained recovery evidence and source bytes before creating the index.
+    readAgentHookSettingsFromProfileState(legacy)
+    const { ensureActiveOrcaProfile } =
+      await import('../../main/orca-profiles/profile-index-store.js')
+    const profile = ensureActiveOrcaProfile(getDefaultUserDataPath())
+    location = {
+      dataFile: profile.dataFile,
+      databaseFile: profile.stateDatabaseFile,
+      profileId: profile.profile.id
+    }
+  }
+  return updateAgentHookSettingsFromProfileState(location, enabled)
+}
+
 async function updateRunningRuntime(client: RuntimeClient, enabled: boolean): Promise<boolean> {
-  try {
-    const status = await client.getCliStatus()
-    if (!status.result.runtime.reachable) {
-      return false
+  const status = await client.getCliStatus()
+  if (!status.result.runtime.reachable) {
+    if (status.result.app.running) {
+      throw new RuntimeClientError(
+        'runtime_error',
+        'Orca is running but unavailable. Retry when it responds, or stop Orca before changing agent hooks offline.'
+      )
     }
-    await client.call(
-      'settings.update',
-      { agentStatusHooksEnabled: enabled },
-      { timeoutMs: 10_000 }
-    )
-    return true
-  } catch {
     return false
   }
+  await client.call('settings.update', { agentStatusHooksEnabled: enabled }, { timeoutMs: 10_000 })
+  return true
 }
 
 function localSuccess<TResult>(result: TResult): RuntimeRpcSuccess<TResult> {
@@ -193,8 +183,8 @@ async function setAgentHooksEnabled(
   const { applyAgentStatusHooksEnabled, getManagedAgentHookStatuses } =
     await import('../../main/agent-hooks/managed-agent-hook-controls.js')
   const updatedRuntime = await updateRunningRuntime(client, enabled)
-  const offlineUpdate = updatedRuntime ? null : updateEnabledOnDisk(enabled)
-  const settingsPath = offlineUpdate?.settingsPath ?? getDataPath()
+  const offlineUpdate = updatedRuntime ? null : await updateEnabledOnDisk(enabled)
+  const settingsPath = offlineUpdate?.settingsPath ?? (await getDataPath())
   const statuses = updatedRuntime
     ? getManagedAgentHookStatuses()
     : await applyAgentStatusHooksEnabled(enabled, offlineUpdate?.settings)
@@ -207,7 +197,8 @@ async function setAgentHooksEnabled(
 }
 
 export const AGENT_HOOK_HANDLERS: Record<string, CommandHandler> = {
-  'agent hooks prepare-codex': async ({ client }) => {
+  'agent hooks prepare-codex': async ({ client, flags }) => {
+    rejectRemoteHookSelection(flags)
     if (process.env.WSL_DISTRO_NAME?.trim()) {
       try {
         await client.call(
@@ -224,30 +215,38 @@ export const AGENT_HOOK_HANDLERS: Record<string, CommandHandler> = {
       }
       return
     }
-    const settings = await readHookSettings(client)
     await prepareManagedCodexHomeBeforeShellLaunch({
       userDataPath: getDefaultUserDataPath(),
-      hooksEnabled:
-        settings.agentStatusHooksEnabled && !settings.disabledTuiAgents.includes('codex')
+      hooksEnabled: isAgentStatusHooksEnabledForAgent(await readHookSettings(client), 'codex')
     })
   },
-  'agent hooks status': async ({ json }) => {
+  'agent hooks status': async ({ json, flags }) => {
+    rejectRemoteHookSelection(flags)
     const { getManagedAgentHookStatuses } =
       await import('../../main/agent-hooks/managed-agent-hook-controls.js')
     const result: AgentHookCommandResult = {
-      enabled: readHookSettingsFromDisk().agentStatusHooksEnabled,
-      settingsPath: getDataPath(),
+      enabled: (await readHookSettingsFromDisk()).agentStatusHooksEnabled,
+      settingsPath: await getDataPath(),
       appliedBy: 'offline',
       statuses: getManagedAgentHookStatuses()
     }
     printResult(localSuccess(result), json, formatAgentHookCommandResult)
   },
-  'agent hooks off': async ({ client, json }) => {
+  'agent hooks off': async ({ client, json, flags }) => {
+    rejectRemoteHookSelection(flags)
     const result = await setAgentHooksEnabled(client, false)
     printResult(localSuccess(result), json, formatAgentHookCommandResult)
   },
-  'agent hooks on': async ({ client, json }) => {
+  'agent hooks on': async ({ client, json, flags }) => {
+    rejectRemoteHookSelection(flags)
     const result = await setAgentHooksEnabled(client, true)
     printResult(localSuccess(result), json, formatAgentHookCommandResult)
   }
 }
+
+function rejectRemoteHookSelection(flags: ReadonlyMap<string, string | boolean>): void {
+  rejectRemoteSelectionFlags(
+    flags,
+    'agent hooks; run this command on the machine whose hooks you want to manage.'
+  )
+}
diff --git a/src/cli/handlers/orchestration-timeout-cli.test.ts b/src/cli/handlers/orchestration-timeout-cli.test.ts
deleted file mode 100644
index 9f60548a809..00000000000
--- a/src/cli/handlers/orchestration-timeout-cli.test.ts
+++ /dev/null
@@ -1,288 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-
-const callMock = vi.fn()
-const originalExitCode = process.exitCode
-const originalCliCommand = process.env.ORCA_CLI_COMMAND
-
-vi.mock('../format', () => ({ printResult: vi.fn() }))
-vi.mock('../selectors', () => ({ getTerminalHandle: vi.fn() }))
-
-import { printResult } from '../format'
-import { ORCHESTRATION_HANDLERS } from './orchestration'
-
-describe('orchestration timeout flag validation', () => {
-  const invalidTimeoutValues: [string, string | boolean][] = [
-    ['missing', true],
-    ['empty', ''],
-    ['non-numeric', 'not-a-number'],
-    ['zero', '0'],
-    ['negative', '-1']
-  ]
-
-  beforeEach(() => {
-    callMock.mockReset()
-    delete process.env.ORCA_TERMINAL_HANDLE
-    delete process.env.ORCA_PANE_KEY
-    process.exitCode = undefined
-  })
-
-  afterEach(() => {
-    process.exitCode = originalExitCode
-    if (originalCliCommand === undefined) {
-      delete process.env.ORCA_CLI_COMMAND
-    } else {
-      process.env.ORCA_CLI_COMMAND = originalCliCommand
-    }
-    vi.restoreAllMocks()
-  })
-
-  const invokeCheck = (flags: Map<string, string | boolean>) =>
-    ORCHESTRATION_HANDLERS['orchestration check']({
-      flags,
-      client: { call: callMock },
-      cwd: '/tmp/repo',
-      json: true
-    } as never)
-
-  const invokeAsk = (flags: Map<string, string | boolean>) =>
-    ORCHESTRATION_HANDLERS['orchestration ask']({
-      flags,
-      client: { call: callMock },
-      cwd: '/tmp/repo',
-      json: true
-    } as never)
-
-  const invokePlainAsk = (flags: Map<string, string | boolean>) =>
-    ORCHESTRATION_HANDLERS['orchestration ask']({
-      flags,
-      client: { call: callMock },
-      cwd: '/tmp/repo',
-      json: false
-    } as never)
-
-  it.each(invalidTimeoutValues)('rejects invalid check --timeout-ms: %s', async (_label, value) => {
-    await expect(
-      invokeCheck(
-        new Map<string, string | boolean>([
-          ['wait', true],
-          ['timeout-ms', value]
-        ])
-      )
-    ).rejects.toThrow(/--timeout-ms/)
-    expect(callMock).not.toHaveBeenCalled()
-  })
-
-  it('passes a parsed check timeout and peek mode into the RPC payload', async () => {
-    process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
-    callMock.mockResolvedValue({ result: { messages: [], count: 0 } })
-    await invokeCheck(
-      new Map<string, string | boolean>([
-        ['wait', true],
-        ['peek', true],
-        ['timeout-ms', '250']
-      ])
-    )
-    // Why: unread:false makes pre-peek runtimes fall back to non-consuming all mode.
-    expect(callMock).toHaveBeenCalledWith('orchestration.check', {
-      terminal: 'term_worker',
-      terminalPaneKey: undefined,
-      unread: false,
-      peek: true,
-      all: undefined,
-      types: undefined,
-      format: undefined,
-      compatibilityCliCommand: expect.stringMatching(/^orca(?:-ide)?$/),
-      run: undefined,
-      ack: undefined,
-      wait: true,
-      timeoutMs: 250
-    })
-  })
-
-  it('filters already-read rows from a peek response for pre-peek runtimes', async () => {
-    process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
-    callMock.mockResolvedValue({
-      result: {
-        messages: [
-          { id: 'msg_old', from_handle: 'a', subject: 'seen', read: 1 },
-          { id: 'msg_new', from_handle: 'a', subject: 'fresh', read: 0 }
-        ],
-        count: 2,
-        formatted: 'banners built from all rows'
-      }
-    })
-    vi.mocked(printResult).mockClear()
-    await invokeCheck(new Map<string, string | boolean>([['peek', true]]))
-    const response = vi.mocked(printResult).mock.calls[0]?.[0] as {
-      result: { messages: { id: string }[]; count: number; formatted?: string }
-    }
-    expect(response.result.messages.map((message) => message.id)).toEqual(['msg_new'])
-    expect(response.result.count).toBe(1)
-    expect(response.result.formatted).toBeUndefined()
-  })
-
-  it('rejects combined read modes before calling the runtime', async () => {
-    process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
-    await expect(
-      invokeCheck(
-        new Map<string, string | boolean>([
-          ['unread', true],
-          ['peek', true]
-        ])
-      )
-    ).rejects.toMatchObject({
-      code: 'invalid_argument',
-      message: expect.stringContaining('read mode')
-    })
-    expect(callMock).not.toHaveBeenCalled()
-  })
-
-  it('warns when a pre-peek runtime returned a full 100-row page', async () => {
-    process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
-    const rows = Array.from({ length: 100 }, (_, index) => ({
-      id: `msg_${index}`,
-      from_handle: 'a',
-      subject: `s${index}`,
-      read: index === 0 ? 0 : 1
-    }))
-    callMock.mockResolvedValue({ result: { messages: rows, count: 100 } })
-    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
-    await invokeCheck(new Map<string, string | boolean>([['peek', true]]))
-    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('newest 100 messages'))
-    errorSpy.mockRestore()
-  })
-
-  it('fails --peek --wait against a runtime that returned only read rows', async () => {
-    process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
-    callMock.mockResolvedValue({
-      result: {
-        messages: [{ id: 'msg_old', from_handle: 'a', subject: 'seen', read: 1 }],
-        count: 1
-      }
-    })
-    await expect(
-      invokeCheck(
-        new Map<string, string | boolean>([
-          ['peek', true],
-          ['wait', true]
-        ])
-      )
-    ).rejects.toMatchObject({ code: 'peek_wait_unsupported' })
-  })
-
-  it.each(invalidTimeoutValues)('rejects invalid ask --timeout-ms: %s', async (_label, value) => {
-    await expect(
-      invokeAsk(
-        new Map<string, string | boolean>([
-          ['to', 'term_coord'],
-          ['question', 'Proceed?'],
-          ['timeout-ms', value]
-        ])
-      )
-    ).rejects.toThrow(/--timeout-ms/)
-    expect(callMock).not.toHaveBeenCalled()
-  })
-
-  it('uses the parsed ask timeout for both runtime wait and client timeout', async () => {
-    process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
-    callMock.mockResolvedValue({
-      result: { answer: 'yes', messageId: 'msg_1', threadId: 'thread_1', timedOut: false }
-    })
-    vi.spyOn(console, 'log').mockImplementation(() => {})
-    await invokeAsk(
-      new Map<string, string | boolean>([
-        ['to', 'term_coord'],
-        ['question', 'Proceed?'],
-        ['timeout-ms', '123']
-      ])
-    )
-    expect(callMock).toHaveBeenCalledWith(
-      'orchestration.ask',
-      {
-        to: 'term_coord',
-        run: undefined,
-        question: 'Proceed?',
-        resume: undefined,
-        options: undefined,
-        timeoutMs: 123,
-        from: 'term_worker',
-        compatibilityCliCommand: expect.stringMatching(/^orca(?:-ide)?$/),
-        compatibilityWindowsCommand: undefined
-      },
-      { timeoutMs: 5_123, orchestrationCapability: undefined }
-    )
-  })
-
-  it('passes an ask resume without creating a new question payload', async () => {
-    process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
-    callMock.mockResolvedValue({
-      result: {
-        answer: 'yes',
-        messageId: 'msg_question',
-        threadId: 'msg_question',
-        timedOut: false
-      }
-    })
-    vi.spyOn(console, 'log').mockImplementation(() => {})
-    await invokeAsk(new Map<string, string | boolean>([['resume', 'msg_question']]))
-    expect(callMock).toHaveBeenCalledWith(
-      'orchestration.ask',
-      {
-        to: undefined,
-        run: undefined,
-        question: undefined,
-        resume: 'msg_question',
-        options: undefined,
-        timeoutMs: undefined,
-        from: 'term_worker',
-        compatibilityCliCommand: expect.stringMatching(/^orca(?:-ide)?$/),
-        compatibilityWindowsCommand: undefined
-      },
-      { timeoutMs: 605_000, orchestrationCapability: undefined }
-    )
-  })
-
-  it('prints the pending message ID and exact capability-bound resume command on timeout', async () => {
-    process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
-    process.env.ORCA_CLI_COMMAND = 'orca-dev'
-    callMock.mockResolvedValue({
-      result: {
-        answer: null,
-        messageId: 'msg_question',
-        threadId: 'thread_question',
-        timedOut: true,
-        timeoutMs: 30_000
-      }
-    })
-    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
-
-    await invokePlainAsk(
-      new Map<string, string | boolean>([
-        ['question', 'Proceed?'],
-        ['dispatch-capability', 'dcap_secret'],
-        ['timeout-ms', '30000']
-      ])
-    )
-
-    expect(errorSpy).toHaveBeenCalledWith(
-      'ask timeout after 30000ms; question is still pending (messageId: msg_question). ' +
-        'Resume waiting; do not ask again:\n' +
-        'orca-dev orchestration ask --from term_worker --dispatch-capability dcap_secret ' +
-        '--resume msg_question --timeout-ms 30000'
-    )
-    expect(process.exitCode).toBe(1)
-  })
-
-  it('rejects ambiguous ask create/resume input before RPC', async () => {
-    process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
-    await expect(
-      invokeAsk(
-        new Map<string, string | boolean>([
-          ['question', 'new'],
-          ['resume', 'msg_old']
-        ])
-      )
-    ).rejects.toMatchObject({ code: 'invalid_argument' })
-    expect(callMock).not.toHaveBeenCalled()
-  })
-})
diff --git a/src/cli/handlers/orchestration-timeout.test.ts b/src/cli/handlers/orchestration-timeout.test.ts
deleted file mode 100644
index 51f0d75098e..00000000000
--- a/src/cli/handlers/orchestration-timeout.test.ts
+++ /dev/null
@@ -1,292 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-
-const callMock = vi.fn()
-const getTerminalHandleMock = vi.hoisted(() => vi.fn())
-const originalTerminalHandle = process.env.ORCA_TERMINAL_HANDLE
-const originalPaneKey = process.env.ORCA_PANE_KEY
-
-vi.mock('../format', () => ({ printResult: vi.fn() }))
-vi.mock('../selectors', () => ({ getTerminalHandle: getTerminalHandleMock }))
-
-import { printResult } from '../format'
-import { ORCHESTRATION_HANDLERS } from './orchestration'
-
-const invalidTimeoutValues: [string, string | boolean][] = [
-  ['missing', true],
-  ['empty', ''],
-  ['non-numeric', 'not-a-number'],
-  ['zero', '0'],
-  ['negative', '-1'],
-  ['fractional', '1.5'],
-  ['rounded fractional', '9007199254740991.1'],
-  ['unsafe integer', String(Number.MAX_SAFE_INTEGER + 1)]
-]
-
-const invokeCheck = (flags: Map<string, string | boolean>) =>
-  ORCHESTRATION_HANDLERS['orchestration check']({
-    flags,
-    client: { call: callMock },
-    cwd: '/tmp/repo',
-    json: true
-  } as never)
-
-const invokeAsk = (flags: Map<string, string | boolean>) =>
-  ORCHESTRATION_HANDLERS['orchestration ask']({
-    flags,
-    client: { call: callMock },
-    cwd: '/tmp/repo',
-    json: true
-  } as never)
-
-beforeEach(() => {
-  callMock.mockReset()
-  getTerminalHandleMock.mockReset()
-  vi.mocked(printResult).mockReset()
-  delete process.env.ORCA_TERMINAL_HANDLE
-  delete process.env.ORCA_PANE_KEY
-})
-
-afterEach(() => {
-  if (originalTerminalHandle === undefined) {
-    delete process.env.ORCA_TERMINAL_HANDLE
-  } else {
-    process.env.ORCA_TERMINAL_HANDLE = originalTerminalHandle
-  }
-  if (originalPaneKey === undefined) {
-    delete process.env.ORCA_PANE_KEY
-  } else {
-    process.env.ORCA_PANE_KEY = originalPaneKey
-  }
-  vi.restoreAllMocks()
-})
-
-describe('orchestration timeout flag validation', () => {
-  it.each(invalidTimeoutValues)('rejects invalid check --timeout-ms: %s', async (_label, value) => {
-    const flags = new Map<string, string | boolean>([
-      ['wait', true],
-      ['timeout-ms', value]
-    ])
-
-    await expect(invokeCheck(flags)).rejects.toThrow(/--timeout-ms/)
-    expect(callMock).not.toHaveBeenCalled()
-    expect(getTerminalHandleMock).not.toHaveBeenCalled()
-  })
-
-  it('passes a parsed check timeout and peek mode into the RPC payload', async () => {
-    process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
-    callMock.mockResolvedValue({ result: { messages: [], count: 0 } })
-
-    await invokeCheck(
-      new Map<string, string | boolean>([
-        ['wait', true],
-        ['peek', true],
-        ['timeout-ms', '250']
-      ])
-    )
-
-    expect(callMock).toHaveBeenCalledWith('orchestration.check', {
-      terminal: 'term_worker',
-      terminalPaneKey: undefined,
-      unread: false,
-      peek: true,
-      all: undefined,
-      types: undefined,
-      format: undefined,
-      compatibilityCliCommand: expect.stringMatching(/^orca(?:-ide)?$/),
-      run: undefined,
-      ack: undefined,
-      wait: true,
-      timeoutMs: 250
-    })
-  })
-
-  it('filters already-read rows from a peek response for pre-peek runtimes', async () => {
-    process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
-    callMock.mockResolvedValue({
-      result: {
-        messages: [
-          { id: 'msg_old', from_handle: 'a', subject: 'seen', read: 1 },
-          { id: 'msg_new', from_handle: 'a', subject: 'fresh', read: 0 }
-        ],
-        count: 2,
-        formatted: 'banners built from all rows'
-      }
-    })
-
-    await invokeCheck(new Map<string, string | boolean>([['peek', true]]))
-
-    const response = vi.mocked(printResult).mock.calls[0]?.[0] as {
-      result: { messages: { id: string }[]; count: number; formatted?: string }
-    }
-    expect(response.result.messages.map((message) => message.id)).toEqual(['msg_new'])
-    expect(response.result.count).toBe(1)
-    expect(response.result.formatted).toBeUndefined()
-  })
-
-  it('rejects combined read modes before calling the runtime', async () => {
-    process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
-
-    await expect(
-      invokeCheck(
-        new Map<string, string | boolean>([
-          ['unread', true],
-          ['peek', true]
-        ])
-      )
-    ).rejects.toMatchObject({
-      code: 'invalid_argument',
-      message: expect.stringContaining('read mode')
-    })
-    expect(callMock).not.toHaveBeenCalled()
-  })
-
-  it('warns when a pre-peek runtime returned a full 100-row page', async () => {
-    process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
-    const rows = Array.from({ length: 100 }, (_, index) => ({
-      id: `msg_${index}`,
-      from_handle: 'a',
-      subject: `s${index}`,
-      read: index === 0 ? 0 : 1
-    }))
-    callMock.mockResolvedValue({ result: { messages: rows, count: 100 } })
-    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
-
-    await invokeCheck(new Map<string, string | boolean>([['peek', true]]))
-
-    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('newest 100 messages'))
-  })
-
-  it('fails --peek --wait against a runtime that returned only read rows', async () => {
-    process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
-    callMock.mockResolvedValue({
-      result: {
-        messages: [{ id: 'msg_old', from_handle: 'a', subject: 'seen', read: 1 }],
-        count: 1
-      }
-    })
-
-    await expect(
-      invokeCheck(
-        new Map<string, string | boolean>([
-          ['peek', true],
-          ['wait', true]
-        ])
-      )
-    ).rejects.toMatchObject({ code: 'peek_wait_unsupported' })
-  })
-
-  it.each(invalidTimeoutValues)('rejects invalid ask --timeout-ms: %s', async (_label, value) => {
-    const flags = new Map<string, string | boolean>([
-      ['to', 'term_coord'],
-      ['question', 'Proceed?'],
-      ['timeout-ms', value]
-    ])
-
-    await expect(invokeAsk(flags)).rejects.toThrow(/--timeout-ms/)
-    expect(callMock).not.toHaveBeenCalled()
-    expect(getTerminalHandleMock).not.toHaveBeenCalled()
-  })
-
-  it.each([String(2_147_483_647), String(Number.MAX_SAFE_INTEGER)])(
-    'clamps a safe ask timeout %s before adding transport headroom',
-    async (rawTimeout) => {
-      process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
-      callMock.mockResolvedValue({
-        result: { answer: 'yes', messageId: 'msg_1', threadId: 'thread_1', timedOut: false }
-      })
-      vi.spyOn(console, 'log').mockImplementation(() => {})
-
-      await invokeAsk(
-        new Map<string, string | boolean>([
-          ['to', 'term_coord'],
-          ['question', 'Proceed?'],
-          ['timeout-ms', rawTimeout]
-        ])
-      )
-
-      expect(callMock).toHaveBeenCalledWith(
-        'orchestration.ask',
-        expect.objectContaining({ timeoutMs: 1_800_000 }),
-        { timeoutMs: 1_805_000 }
-      )
-    }
-  )
-
-  it.each(['+1000', '1000.0', '1e3', '0x3e8'])(
-    'preserves CLI-compatible exact integer timeout syntax %s',
-    async (rawTimeout) => {
-      process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
-      callMock.mockResolvedValue({
-        result: { answer: 'yes', messageId: 'msg_1', threadId: 'thread_1', timedOut: false }
-      })
-      vi.spyOn(console, 'log').mockImplementation(() => {})
-
-      await invokeAsk(
-        new Map<string, string | boolean>([
-          ['to', 'term_coord'],
-          ['question', 'Proceed?'],
-          ['timeout-ms', rawTimeout]
-        ])
-      )
-
-      expect(callMock).toHaveBeenCalledWith(
-        'orchestration.ask',
-        expect.objectContaining({ timeoutMs: 1_000 }),
-        { timeoutMs: 6_000 }
-      )
-    }
-  )
-
-  it('keeps an omitted ask timeout out of the payload while using default headroom', async () => {
-    process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
-    callMock.mockResolvedValue({
-      result: { answer: 'yes', messageId: 'msg_1', threadId: 'thread_1', timedOut: false }
-    })
-    vi.spyOn(console, 'log').mockImplementation(() => {})
-
-    await invokeAsk(
-      new Map<string, string | boolean>([
-        ['to', 'term_coord'],
-        ['question', 'Proceed?']
-      ])
-    )
-
-    expect(callMock).toHaveBeenCalledWith(
-      'orchestration.ask',
-      expect.objectContaining({ timeoutMs: undefined }),
-      { timeoutMs: 605_000 }
-    )
-  })
-
-  it('uses the parsed ask timeout for both runtime wait and client timeout', async () => {
-    process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
-    callMock.mockResolvedValue({
-      result: { answer: 'yes', messageId: 'msg_1', threadId: 'thread_1', timedOut: false }
-    })
-    vi.spyOn(console, 'log').mockImplementation(() => {})
-
-    await invokeAsk(
-      new Map<string, string | boolean>([
-        ['to', 'term_coord'],
-        ['question', 'Proceed?'],
-        ['timeout-ms', '123']
-      ])
-    )
-
-    expect(callMock).toHaveBeenCalledWith(
-      'orchestration.ask',
-      {
-        to: 'term_coord',
-        run: undefined,
-        question: 'Proceed?',
-        resume: undefined,
-        options: undefined,
-        timeoutMs: 123,
-        from: 'term_worker',
-        compatibilityCliCommand: expect.stringMatching(/^orca(?:-ide)?$/),
-        compatibilityWindowsCommand: undefined
-      },
-      { timeoutMs: 5_123, orchestrationCapability: undefined }
-    )
-  })
-})
diff --git a/src/cli/handlers/orchestration.test.ts b/src/cli/handlers/orchestration.test.ts
index e0a20541f91..05134045be1 100644
--- a/src/cli/handlers/orchestration.test.ts
+++ b/src/cli/handlers/orchestration.test.ts
@@ -7,6 +7,8 @@ const originalPaneKey = process.env.ORCA_PANE_KEY
 // Why: a structured-session marker inherited from the runner diverts these cases to the
 // structured refusal, so which branch they exercise would depend on who ran them.
 const originalStructuredSession = process.env.ORCA_STRUCTURED_SESSION
+const originalCliCommand = process.env.ORCA_CLI_COMMAND
+const originalExitCode = process.exitCode
 function lifecycleGroupRecipientError(type: 'worker_done' | 'heartbeat'): string {
   return `${type} messages belong to one exact Dispatch and cannot target a group address.`
 }
@@ -36,6 +38,13 @@ afterEach(() => {
   } else {
     process.env.ORCA_STRUCTURED_SESSION = originalStructuredSession
   }
+  if (originalCliCommand === undefined) {
+    delete process.env.ORCA_CLI_COMMAND
+  } else {
+    process.env.ORCA_CLI_COMMAND = originalCliCommand
+  }
+  process.exitCode = originalExitCode
+  vi.restoreAllMocks()
 })
 
 describe('orchestration send structured payload flags', () => {
@@ -352,7 +361,10 @@ describe('orchestration timeout flag validation', () => {
     ['empty', ''],
     ['non-numeric', 'not-a-number'],
     ['zero', '0'],
-    ['negative', '-1']
+    ['negative', '-1'],
+    ['fractional', '1.5'],
+    ['rounded fractional', '9007199254740991.1'],
+    ['unsafe integer', String(Number.MAX_SAFE_INTEGER + 1)]
   ]
 
   beforeEach(() => {
@@ -360,6 +372,7 @@ describe('orchestration timeout flag validation', () => {
     delete process.env.ORCA_TERMINAL_HANDLE
     delete process.env.ORCA_PANE_KEY
     delete process.env.ORCA_STRUCTURED_SESSION
+    process.exitCode = undefined
   })
 
   const invokeCheck = (flags: Map<string, string | boolean>) =>
@@ -378,6 +391,14 @@ describe('orchestration timeout flag validation', () => {
       json: true
     } as never)
 
+  const invokePlainAsk = (flags: Map<string, string | boolean>) =>
+    ORCHESTRATION_HANDLERS['orchestration ask']({
+      flags,
+      client: { call: callMock },
+      cwd: '/tmp/repo',
+      json: false
+    } as never)
+
   it.each(invalidTimeoutValues)('rejects invalid check --timeout-ms: %s', async (_label, value) => {
     const flags = new Map<string, string | boolean>([
       ['wait', true],
@@ -386,6 +407,7 @@ describe('orchestration timeout flag validation', () => {
 
     await expect(invokeCheck(flags)).rejects.toThrow(/--timeout-ms/)
     expect(callMock).not.toHaveBeenCalled()
+    expect(getTerminalHandleMock).not.toHaveBeenCalled()
   })
 
   it('passes a parsed check timeout and peek mode into the RPC payload', async () => {
@@ -507,6 +529,109 @@ describe('orchestration timeout flag validation', () => {
 
     await expect(invokeAsk(flags)).rejects.toThrow(/--timeout-ms/)
     expect(callMock).not.toHaveBeenCalled()
+    expect(getTerminalHandleMock).not.toHaveBeenCalled()
+  })
+
+  it.each([String(2_147_483_647), String(Number.MAX_SAFE_INTEGER)])(
+    'clamps a safe ask timeout %s before adding transport headroom',
+    async (rawTimeout) => {
+      process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
+      callMock.mockResolvedValue({
+        result: { answer: 'yes', messageId: 'msg_1', threadId: 'thread_1', timedOut: false }
+      })
+      vi.spyOn(console, 'log').mockImplementation(() => {})
+
+      await invokeAsk(
+        new Map<string, string | boolean>([
+          ['to', 'term_coord'],
+          ['question', 'Proceed?'],
+          ['timeout-ms', rawTimeout]
+        ])
+      )
+
+      expect(callMock).toHaveBeenCalledWith(
+        'orchestration.ask',
+        expect.objectContaining({ timeoutMs: 1_800_000 }),
+        { timeoutMs: 1_805_000 }
+      )
+    }
+  )
+
+  it.each(['+1000', '1000.0', '1e3', '0x3e8'])(
+    'preserves CLI-compatible exact integer timeout syntax %s',
+    async (rawTimeout) => {
+      process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
+      callMock.mockResolvedValue({
+        result: { answer: 'yes', messageId: 'msg_1', threadId: 'thread_1', timedOut: false }
+      })
+      vi.spyOn(console, 'log').mockImplementation(() => {})
+
+      await invokeAsk(
+        new Map<string, string | boolean>([
+          ['to', 'term_coord'],
+          ['question', 'Proceed?'],
+          ['timeout-ms', rawTimeout]
+        ])
+      )
+
+      expect(callMock).toHaveBeenCalledWith(
+        'orchestration.ask',
+        expect.objectContaining({ timeoutMs: 1_000 }),
+        { timeoutMs: 6_000 }
+      )
+    }
+  )
+
+  it('keeps an omitted ask timeout out of the payload while using default headroom', async () => {
+    process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
+    callMock.mockResolvedValue({
+      result: { answer: 'yes', messageId: 'msg_1', threadId: 'thread_1', timedOut: false }
+    })
+    vi.spyOn(console, 'log').mockImplementation(() => {})
+
+    await invokeAsk(
+      new Map<string, string | boolean>([
+        ['to', 'term_coord'],
+        ['question', 'Proceed?']
+      ])
+    )
+
+    expect(callMock).toHaveBeenCalledWith(
+      'orchestration.ask',
+      expect.objectContaining({ timeoutMs: undefined }),
+      { timeoutMs: 605_000 }
+    )
+  })
+
+  it('prints the pending message ID and exact capability-bound resume command on timeout', async () => {
+    process.env.ORCA_TERMINAL_HANDLE = 'term_worker'
+    process.env.ORCA_CLI_COMMAND = 'orca-dev'
+    callMock.mockResolvedValue({
+      result: {
+        answer: null,
+        messageId: 'msg_question',
+        threadId: 'thread_question',
+        timedOut: true,
+        timeoutMs: 30_000
+      }
+    })
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+
+    await invokePlainAsk(
+      new Map<string, string | boolean>([
+        ['question', 'Proceed?'],
+        ['dispatch-capability', 'dcap_secret'],
+        ['timeout-ms', '30000']
+      ])
+    )
+
+    expect(errorSpy).toHaveBeenCalledWith(
+      'ask timeout after 30000ms; question is still pending (messageId: msg_question). ' +
+        'Resume waiting; do not ask again:\n' +
+        'orca-dev orchestration ask --from term_worker --dispatch-capability dcap_secret ' +
+        '--resume msg_question --timeout-ms 30000'
+    )
+    expect(process.exitCode).toBe(1)
   })
 
   it('uses the parsed ask timeout for both runtime wait and client timeout', async () => {
diff --git a/src/cli/handlers/orchestration/dispatch-handlers.ts b/src/cli/handlers/orchestration/dispatch-handlers.ts
index afe79ab8e2f..c8ade53e907 100644
--- a/src/cli/handlers/orchestration/dispatch-handlers.ts
+++ b/src/cli/handlers/orchestration/dispatch-handlers.ts
@@ -6,6 +6,7 @@ import { orchestrationMigrationData } from '../../../shared/orchestration-rpc-co
 import { callOrchestrationMutation } from './mutation-request'
 import { isDevCliInvocation } from './runtime-compatibility'
 import { resolveCoordinatorTerminalHandle } from './terminal-identity'
+import { injectedSessionAddress } from '../../../shared/agent-session-caller-env'
 
 export const ORCHESTRATION_DISPATCH_HANDLER: Record<string, CommandHandler> = {
   'orchestration dispatch': async ({ flags, client, cwd, json }) => {
@@ -42,9 +43,12 @@ export const ORCHESTRATION_DISPATCH_HANDLER: Record<string, CommandHandler> = {
 export const ORCHESTRATION_DISPATCH_INSPECTION_HANDLERS: Record<string, CommandHandler> = {
   'orchestration dispatch-show': async ({ flags, client, cwd, json }) => {
     const showPreamble = flags.has('preamble') ? true : undefined
-    // Why: a preview must embed the same real coordinator handle as an actual dispatch.
+    // Why: a preview must embed the same real coordinator handle as an actual dispatch. Its --from
+    // only fills preview text and names no caller, so it passes through unfenced.
     const from = showPreamble
-      ? await resolveCoordinatorTerminalHandle(flags, cwd, client)
+      ? (getOptionalStringFlag(flags, 'from') ??
+        injectedSessionAddress() ??
+        (await resolveCoordinatorTerminalHandle(flags, cwd, client)))
       : undefined
     const result = await client.call<{
       dispatch: { id: string; task_id: string; status: string } | null
diff --git a/src/cli/handlers/orchestration/gate-handlers.ts b/src/cli/handlers/orchestration/gate-handlers.ts
index f9ec4c6583f..44c8f96d818 100644
--- a/src/cli/handlers/orchestration/gate-handlers.ts
+++ b/src/cli/handlers/orchestration/gate-handlers.ts
@@ -2,7 +2,7 @@ import type { CommandHandler } from '../../dispatch'
 import { printResult } from '../../format'
 import { getOptionalJsonFlag, getOptionalStringFlag, getRequiredStringFlag } from '../../flags'
 import { callOrchestrationMutation } from './mutation-request'
-import { resolveCoordinatorTerminalHandle } from './terminal-identity'
+import { resolveCoordinatorTerminalHandle, runScopedSessionCaller } from './terminal-identity'
 
 export const ORCHESTRATION_GATE_HANDLERS: Record<string, CommandHandler> = {
   'orchestration gate-create': async ({ flags, client, cwd, json }) => {
@@ -37,7 +37,9 @@ export const ORCHESTRATION_GATE_HANDLERS: Record<string, CommandHandler> = {
   'orchestration gate-list': async ({ flags, client, cwd, json }) => {
     const run = getOptionalStringFlag(flags, 'run')
     // Why: named runs remain inspectable without a pane; only implicit runs resolve identity.
-    const from = run ? undefined : await resolveCoordinatorTerminalHandle(flags, cwd, client)
+    const from = run
+      ? runScopedSessionCaller(flags)
+      : await resolveCoordinatorTerminalHandle(flags, cwd, client)
     const result = await client.call<{
       gates: { id: string; task_id: string; question: string; status: string }[]
       count: number
diff --git a/src/cli/handlers/orchestration/message-check-handler.ts b/src/cli/handlers/orchestration/message-check-handler.ts
index f2af827ee04..6ace43eac31 100644
--- a/src/cli/handlers/orchestration/message-check-handler.ts
+++ b/src/cli/handlers/orchestration/message-check-handler.ts
@@ -13,7 +13,7 @@ import { startCheckKeepalive } from './check-keepalive'
 import { callOrchestrationMutation } from './mutation-request'
 import { getOptionalPositiveIntegerValueFlag } from './numeric-flags'
 import { flushOrchestrationStdout, resolveCompatibilityCliCommand } from './runtime-compatibility'
-import { resolveOrchestrationTerminalHandle } from './terminal-identity'
+import { orchestrationCallerLabel, resolveOrchestrationTerminalHandle } from './terminal-identity'
 
 type CheckResult = {
   messages: MessageSummary[]
@@ -41,12 +41,16 @@ export const ORCHESTRATION_CHECK_HANDLER: Record<string, CommandHandler> = {
     const timeoutMs = getOptionalPositiveIntegerValueFlag(flags, 'timeout-ms')
     const explicitTerminal = getOptionalStringFlag(flags, 'terminal')
     const terminal = await resolveOrchestrationTerminalHandle(flags, cwd, client, 'terminal')
+    // Why: a session names itself by its id alone; a pane key it inherited is not its identity.
+    const paneKey =
+      explicitTerminal || terminal === undefined ? undefined : process.env.ORCA_PANE_KEY
+    const callerLabel = orchestrationCallerLabel(terminal)
     const stopKeepalive = wait ? startCheckKeepalive(timeoutMs) : null
     let result: Awaited<ReturnType<typeof client.call<CheckResult>>>
     try {
       result = await callOrchestrationMutation<CheckResult>(client, flags, 'orchestration.check', {
         terminal,
-        terminalPaneKey: explicitTerminal ? undefined : process.env.ORCA_PANE_KEY || undefined,
+        terminalPaneKey: paneKey || undefined,
         // Why: old runtimes degrade peek to non-consuming all mode instead of destructive mark-read.
         unread: flags.has('unread') ? true : peek ? false : undefined,
         peek: peek ? true : undefined,
@@ -68,9 +72,9 @@ export const ORCHESTRATION_CHECK_HANDLER: Record<string, CommandHandler> = {
     }
     result = {
       ...result,
-      result: prepareOrchestrationCheckOutput(result.result, terminal, flags.has('format'))
+      result: prepareOrchestrationCheckOutput(result.result, callerLabel, flags.has('format'))
     }
-    printResult(result, json, (value) => formatOrchestrationCheckText(value, terminal))
+    printResult(result, json, (value) => formatOrchestrationCheckText(value, callerLabel))
     const compatibilityAck = result.result.legacyCompatibility?.ackMessageIds
     if (compatibilityAck && compatibilityAck.length > 0) {
       await flushOrchestrationStdout()
diff --git a/src/cli/handlers/orchestration/message-send-handler.ts b/src/cli/handlers/orchestration/message-send-handler.ts
index 088d1361e69..aa9bbaff47e 100644
--- a/src/cli/handlers/orchestration/message-send-handler.ts
+++ b/src/cli/handlers/orchestration/message-send-handler.ts
@@ -2,6 +2,7 @@ import type { CommandHandler } from '../../dispatch'
 import { printResult } from '../../format'
 import { getOptionalStringFlag, getRequiredStringFlag } from '../../flags'
 import { RuntimeClientError } from '../../runtime-client'
+import { readInjectedAgentSessionId } from '../../../shared/agent-session-caller-env'
 import { requireWorkerDoneSettlement } from '../orchestration-worker-settlement'
 import { getOptionalStructuredMessagePayload } from './message-payload'
 import { callOrchestrationMutation } from './mutation-request'
@@ -75,7 +76,8 @@ export const ORCHESTRATION_SEND_HANDLER: Record<string, CommandHandler> = {
     if (
       (type === 'worker_done' || type === 'heartbeat') &&
       !getOptionalStringFlag(flags, 'from') &&
-      !process.env.ORCA_TERMINAL_HANDLE
+      !process.env.ORCA_TERMINAL_HANDLE &&
+      !readInjectedAgentSessionId()
     ) {
       // Why: focus isn't lifecycle authority — an identity-less subprocess must fail closed rather than guess the worker.
       throwNoActiveSenderTerminal()
@@ -94,7 +96,11 @@ export const ORCHESTRATION_SEND_HANDLER: Record<string, CommandHandler> = {
       threadId: getOptionalStringFlag(flags, 'thread-id'),
       payload: getOptionalStructuredMessagePayload(flags),
       // Why: pane key is the remint-stable sender identity the runtime verifies lifecycle ownership against; older runtimes strip it.
-      senderPaneKey: process.env.ORCA_PANE_KEY || undefined,
+      // A session names itself by its id alone.
+      senderPaneKey:
+        from === undefined || readInjectedAgentSessionId()
+          ? undefined
+          : process.env.ORCA_PANE_KEY || undefined,
       waitForLifecycleSettlement: type === 'worker_done' ? true : undefined,
       devMode: isDevCliInvocation()
     }
diff --git a/src/cli/handlers/orchestration/question-handler.ts b/src/cli/handlers/orchestration/question-handler.ts
index bd9e239b6d5..67aaeb16e4d 100644
--- a/src/cli/handlers/orchestration/question-handler.ts
+++ b/src/cli/handlers/orchestration/question-handler.ts
@@ -103,8 +103,8 @@ export const ORCHESTRATION_QUESTION_HANDLER: Record<string, CommandHandler> = {
                 resolveOrchestrationCliExecutable(),
                 'orchestration',
                 'ask',
-                '--from',
-                from,
+                // A session's resume is flagless: its injected id names it again.
+                ...(from ? ['--from', from] : []),
                 ...(dispatchCapability ? ['--dispatch-capability', dispatchCapability] : []),
                 '--resume',
                 messageId,
diff --git a/src/cli/handlers/orchestration/run-handlers.ts b/src/cli/handlers/orchestration/run-handlers.ts
index 7c77913df15..d8abe3533c2 100644
--- a/src/cli/handlers/orchestration/run-handlers.ts
+++ b/src/cli/handlers/orchestration/run-handlers.ts
@@ -39,7 +39,9 @@ export const ORCHESTRATION_RUN_HANDLERS: Record<string, CommandHandler> = {
       run: { id: string; objective: string } | null
     }>('orchestration.runCurrent', { from })
     printResult(result, json, (r) =>
-      r.run ? `${r.run.id} ${r.run.objective}` : 'No Run is bound to this terminal.'
+      r.run
+        ? `${r.run.id} ${r.run.objective}`
+        : `No Run is bound to this ${from === undefined ? 'session' : 'terminal'}.`
     )
   },
 
diff --git a/src/cli/handlers/orchestration/task-handlers.ts b/src/cli/handlers/orchestration/task-handlers.ts
index c4c943261e8..d6201087792 100644
--- a/src/cli/handlers/orchestration/task-handlers.ts
+++ b/src/cli/handlers/orchestration/task-handlers.ts
@@ -4,7 +4,7 @@ import { getOptionalStringFlag, getRequiredStringFlag } from '../../flags'
 import { RuntimeClientError } from '../../runtime-client'
 import { abbreviateOrchestrationTasks } from '../../../shared/orchestration-task-summary'
 import { callOrchestrationMutation } from './mutation-request'
-import { resolveCoordinatorTerminalHandle } from './terminal-identity'
+import { resolveCoordinatorTerminalHandle, runScopedSessionCaller } from './terminal-identity'
 
 const TASK_STATUS_VALUES = [
   'pending',
@@ -39,7 +39,7 @@ export const ORCHESTRATION_TASK_HANDLERS: Record<string, CommandHandler> = {
     const brief = flags.has('brief')
     const run = getOptionalStringFlag(flags, 'run')
     const callerTerminalHandle = run
-      ? undefined
+      ? runScopedSessionCaller(flags)
       : await resolveCoordinatorTerminalHandle(flags, cwd, client)
     const result = await client.call<{
       tasks: {
diff --git a/src/cli/handlers/orchestration/terminal-identity.ts b/src/cli/handlers/orchestration/terminal-identity.ts
index e693d99079d..8cc4f3357e0 100644
--- a/src/cli/handlers/orchestration/terminal-identity.ts
+++ b/src/cli/handlers/orchestration/terminal-identity.ts
@@ -2,16 +2,31 @@ import type { RuntimeClient } from '../../runtime-client'
 import { getOptionalStringFlag } from '../../flags'
 import { RuntimeClientError } from '../../runtime-client'
 import { getTerminalHandle } from '../../selectors'
-import { isStructuredSessionWithoutIdentity } from '../../../shared/structured-session-marker'
+import { hasStructuredSessionMarker } from '../../../shared/structured-session-marker'
+import {
+  injectedSessionAddress,
+  readInjectedAgentSessionId
+} from '../../../shared/agent-session-caller-env'
+import { sessionAddressForHost } from '../../session-caller-flags'
 
+/**
+ * The caller's terminal handle, or `undefined` when an injected agent session id names the caller:
+ * the orchestration envelope carries that id and the host binds the caller param to it, so nothing
+ * is resolved or guessed here, except a session address only the host can place.
+ */
 export async function resolveOrchestrationTerminalHandle(
   flags: Map<string, string | boolean>,
   cwd: string,
   client: RuntimeClient,
   flagName: 'from' | 'terminal',
   options: { validateEnvHandle?: boolean } = {}
-): Promise<string> {
+): Promise<string | undefined> {
+  // A caller flag naming anyone else was already refused at the CLI entry, from the command's spec.
   const explicit = getOptionalStringFlag(flags, flagName)
+  const sessionId = readInjectedAgentSessionId()
+  if (sessionId) {
+    return explicit ? sessionAddressForHost(explicit, sessionId) : undefined
+  }
   if (explicit) {
     return explicit
   }
@@ -35,7 +50,7 @@ export async function resolveOrchestrationTerminalHandle(
   // default, so that guess consumed another pane's oldest unread batch and marked it read, and the
   // rightful worker never saw its mail. Refusing is the only honest answer: this child genuinely
   // cannot infer its own identity.
-  if (isStructuredSessionWithoutIdentity()) {
+  if (hasStructuredSessionMarker()) {
     throw structuredSessionRefusal(flagName)
   }
   if (flagName === 'from') {
@@ -157,11 +172,26 @@ function getClientErrorMessage(err: unknown): string | undefined {
   return typeof message === 'string' ? message : undefined
 }
 
+/** How check output names its caller: the handle, or the session's address. */
+export function orchestrationCallerLabel(handle: string | undefined): string {
+  return handle ?? injectedSessionAddress() ?? 'unknown'
+}
+
+/**
+ * The caller for a read that `--run` scopes: no terminal is resolved, but a session's declared
+ * address still goes to the host, which places a `/clear` root and refuses anyone else.
+ */
+export function runScopedSessionCaller(flags: Map<string, string | boolean>): string | undefined {
+  const declared = getOptionalStringFlag(flags, 'from')
+  const sessionId = readInjectedAgentSessionId()
+  return declared && sessionId ? sessionAddressForHost(declared, sessionId) : undefined
+}
+
 export async function resolveCoordinatorTerminalHandle(
   flags: Map<string, string | boolean>,
   cwd: string,
   client: RuntimeClient
-): Promise<string> {
+): Promise<string | undefined> {
   return await resolveOrchestrationTerminalHandle(flags, cwd, client, 'from', {
     validateEnvHandle: true
   })
@@ -204,7 +234,7 @@ export function throwNoActiveSenderTerminal(): never {
   // place left that would tell an identity-less session to pass a handle it does not have. A stale
   // ORCA_TERMINAL_HANDLE is a different case — that caller HAS an identity, so it keeps the advice
   // to re-run under a live one.
-  if (isStructuredSessionWithoutIdentity() && !process.env.ORCA_TERMINAL_HANDLE) {
+  if (hasStructuredSessionMarker() && !process.env.ORCA_TERMINAL_HANDLE) {
     throw structuredSessionRefusal('from')
   }
   throw new RuntimeClientError(
diff --git a/src/cli/handlers/orchestration/worker-output.ts b/src/cli/handlers/orchestration/worker-output.ts
index 9d6d1949911..d9b5b9a46fa 100644
--- a/src/cli/handlers/orchestration/worker-output.ts
+++ b/src/cli/handlers/orchestration/worker-output.ts
@@ -1,6 +1,6 @@
 import type { RuntimeTerminalRead } from '../../../shared/runtime-types'
 import type { OrchestrationWorkerReadResult } from '../../../shared/orchestration-worker-output'
-import { formatWorkerTranscriptMessage } from '../../../shared/worker-transcript-text'
+import { formatWorkerTranscriptMessages } from '../../../shared/worker-transcript-text'
 
 export type LegacyWorkerReadResult = {
   dispatchId: string
@@ -57,7 +57,7 @@ export function formatWorkerRead(
   const output =
     value.source === 'terminal'
       ? value.terminal.tail.join('\n')
-      : value.transcript.messages.map(formatWorkerTranscriptMessage).join('\n\n')
+      : formatWorkerTranscriptMessages(value.transcript.messages).join('\n\n')
   if (output) {
     return `${details}\n\n${output}`
   }
diff --git a/src/cli/handlers/profile-state-recovery-admission.test.ts b/src/cli/handlers/profile-state-recovery-admission.test.ts
new file mode 100644
index 00000000000..1da200843c9
--- /dev/null
+++ b/src/cli/handlers/profile-state-recovery-admission.test.ts
@@ -0,0 +1,245 @@
+import { mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import * as durableFileWrite from '../../main/durable-file-write'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission
+} from '../../main/persistence/profile-state/profile-state-access'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from '../../main/persistence/profile-state/profile-state-database'
+import {
+  importProfileStateJson,
+  readProfileStateSnapshot
+} from '../../main/persistence/profile-state/profile-state-documents'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath
+} from '../../main/persistence/profile-state/profile-state-backup-path'
+import { writeProfileStateDatabaseSnapshotAsync } from '../../main/persistence/profile-state/profile-state-database-snapshot'
+import { restoreProfileStateDatabaseBackup } from '../../main/persistence/profile-state/profile-state-database-recovery'
+import {
+  assertNoRetainedProfileStateExports,
+  ProfileStateRecoveryRequiredError
+} from '../../main/persistence/profile-state/profile-state-recovery-required'
+import { RuntimeClient } from '../runtime-client'
+import { PROFILE_STATE_HANDLERS } from './profile-state'
+
+const mocks = vi.hoisted(() => ({ root: vi.fn(), status: vi.fn() }))
+vi.mock('../runtime-client', () => ({
+  getDefaultUserDataPath: mocks.root,
+  RuntimeClient: class {
+    getCliStatus = mocks.status
+  },
+  RuntimeClientError: class extends Error {
+    constructor(
+      readonly code: string,
+      message: string
+    ) {
+      super(message)
+    }
+  }
+}))
+
+const roots: string[] = []
+const profileId = 'admission-recovery'
+const backupState = {
+  settings: {
+    theme: 'restored',
+    httpProxyUrl: 'sealed:backup',
+    electronHttp1CompatibilityMode: true
+  },
+  extension: { unknown: [null, '\ud800', 'backup'] },
+  opaque: null
+}
+const liveState = {
+  settings: { theme: 'runtime-before-restore', httpProxyUrl: 'sealed:live' },
+  extension: { unknown: [null, '\ud800', 'live'] },
+  opaque: null
+}
+
+beforeEach(() => {
+  mocks.status.mockReset().mockResolvedValue({
+    result: { app: { running: false }, runtime: { reachable: false } }
+  })
+  vi.spyOn(console, 'log').mockImplementation(() => {})
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+async function fixture() {
+  const root = mkdtempSync(join(tmpdir(), 'orca-recovery-admission-'))
+  roots.push(root)
+  const directory = join(root, 'profiles', profileId)
+  mkdirSync(directory, { recursive: true })
+  writeFileSync(
+    join(root, 'orca-profile-index.json'),
+    JSON.stringify({ activeProfileId: profileId, profiles: [{ id: profileId }] })
+  )
+  const databasePath = join(directory, 'profile-state.db')
+  const dataFile = join(directory, 'orca-data.json')
+  const backupId = createProfileStateDatabaseBackupId()
+  const backupPath = profileStateDatabaseBackupPath(databasePath, backupId)
+  const source = openProfileStateDatabase(databasePath, profileId)
+  try {
+    importProfileStateJson(source.db, JSON.stringify(backupState))
+    await writeProfileStateDatabaseSnapshotAsync(source.db, backupPath)
+    importProfileStateJson(source.db, JSON.stringify(liveState), { expectedRevision: 1 })
+  } finally {
+    source.db.close()
+  }
+  mocks.root.mockReturnValue(root)
+  return { root, directory, databasePath, dataFile, backupId, backupPath }
+}
+
+function rollback(profile: Awaited<ReturnType<typeof fixture>>): Promise<void> {
+  const handler = PROFILE_STATE_HANDLERS['profile state rollback']
+  if (handler === undefined) {
+    throw new Error('Profile rollback handler is missing')
+  }
+  return handler({
+    flags: new Map([['backup', profile.backupId]]),
+    client: new RuntimeClient(profile.root),
+    cwd: profile.root,
+    json: true
+  })
+}
+
+function state(databasePath: string) {
+  const opened = openProfileStateDatabaseReadOnly(databasePath, profileId)
+  try {
+    return readProfileStateSnapshot(opened.db)
+  } finally {
+    opened.db.close()
+  }
+}
+
+describe('offline recovery excludes runtime admission', () => {
+  it('refuses rollback without changing the database when a move journal is unresolved', async () => {
+    const profile = await fixture()
+    const before = readFileSync(profile.databasePath)
+    const intents = join(profile.root, 'profile-move-intents')
+    mkdirSync(intents)
+    const intentPath = join(intents, '00000000-0000-0000-0000-000000000001.json')
+    writeFileSync(intentPath, '{"partial":true}')
+    await expect(rollback(profile)).rejects.toThrow('pending project move')
+    expect(readFileSync(profile.databasePath)).toEqual(before)
+    expect(readFileSync(intentPath, 'utf8')).toBe('{"partial":true}')
+  })
+
+  it('refuses recovery before any mutation when a runtime has already entered', async () => {
+    const profile = await fixture()
+    const original = readFileSync(profile.databasePath)
+    const backup = readFileSync(profile.backupPath)
+    const admission = acquireProfileStateRuntimeAdmission(profile.root)
+    const runtime = openProfileStateDatabase(profile.databasePath, profileId)
+    try {
+      await expect(rollback(profile)).rejects.toThrow('in use')
+      expect(mocks.status).not.toHaveBeenCalled()
+      expect(JSON.parse(readProfileStateSnapshot(runtime.db).json)).toEqual(liveState)
+      expect(readFileSync(profile.databasePath)).toEqual(original)
+      expect(readFileSync(profile.backupPath)).toEqual(backup)
+      expect(
+        readdirSync(profile.directory).some((name) => name.startsWith('profile-state-corrupt'))
+      ).toBe(false)
+    } finally {
+      runtime.db.close()
+      admission.release()
+    }
+  })
+
+  it('blocks startup between the stopped census and restoration while preserving complete original and restored state', async () => {
+    const profile = await fixture()
+    const original = readFileSync(profile.databasePath)
+    const backup = readFileSync(profile.backupPath)
+    mocks.status.mockImplementation(async () => {
+      const stopped = { result: { app: { running: false }, runtime: { reachable: false } } }
+      expect(() => acquireProfileStateRuntimeAdmission(profile.root)).toThrow('in use')
+      expect(() => acquireProfileStateMaintenance(profile.root)).toThrow('in use')
+      return stopped
+    })
+
+    await rollback(profile)
+
+    expect(mocks.status).toHaveBeenCalledOnce()
+    expect(JSON.parse(state(profile.databasePath).json)).toEqual(backupState)
+    expect(readFileSync(profile.backupPath)).toEqual(backup)
+    const quarantine = readdirSync(profile.directory).find((name) =>
+      name.startsWith('profile-state-corrupt')
+    )
+    expect(quarantine).toBeDefined()
+    if (quarantine === undefined) {
+      throw new Error('Recovery did not preserve a quarantine')
+    }
+    const quarantined = join(profile.directory, quarantine, 'profile-state.db')
+    expect(readFileSync(quarantined)).toEqual(original)
+    expect(JSON.parse(state(quarantined).json)).toEqual(liveState)
+    const admission = acquireProfileStateRuntimeAdmission(profile.root)
+    expect(JSON.parse(state(profile.databasePath).json)).toEqual(backupState)
+    admission.release()
+  })
+
+  it('keeps startup blocked after failed durable publication and permits an explicit successful retry', async () => {
+    const profile = await fixture()
+    const backup = readFileSync(profile.backupPath)
+    const rename = durableFileWrite.renameDurableSync
+    const failure = vi
+      .spyOn(durableFileWrite, 'renameDurableSync')
+      .mockImplementation((from, to) => {
+        if (to === profile.databasePath) {
+          throw new Error('injected recovery publication failure')
+        }
+        rename(from, to)
+      })
+    await expect(rollback(profile)).rejects.toThrow('injected recovery publication failure')
+    const admission = acquireProfileStateRuntimeAdmission(profile.root)
+    try {
+      expect(() =>
+        assertNoRetainedProfileStateExports({
+          dataFile: profile.dataFile,
+          databaseFile: profile.databasePath,
+          profileId
+        })
+      ).toThrow(ProfileStateRecoveryRequiredError)
+    } finally {
+      admission.release()
+    }
+    expect(readFileSync(profile.backupPath)).toEqual(backup)
+    const quarantine = readdirSync(profile.directory).find((name) =>
+      name.startsWith('profile-state-corrupt')
+    )
+    if (quarantine === undefined) {
+      throw new Error('Recovery did not preserve original state')
+    }
+    expect(JSON.parse(state(join(profile.directory, quarantine, 'profile-state.db')).json)).toEqual(
+      liveState
+    )
+
+    failure.mockRestore()
+    await rollback(profile)
+
+    expect(JSON.parse(state(profile.databasePath).json)).toEqual(backupState)
+    acquireProfileStateRuntimeAdmission(profile.root).release()
+  })
+
+  it('rejects fabricated or released maintenance handles before replacing any database bytes', async () => {
+    const profile = await fixture()
+    const maintenance = acquireProfileStateMaintenance(profile.root)
+    const original = readFileSync(profile.databasePath)
+    const options = { ...profile, profileId }
+    expect(() =>
+      restoreProfileStateDatabaseBackup({ ...options, maintenance: { ...maintenance } })
+    ).toThrow('acquired')
+    maintenance.release()
+    expect(() => restoreProfileStateDatabaseBackup({ ...options, maintenance })).toThrow('released')
+    expect(readFileSync(profile.databasePath)).toEqual(original)
+  })
+})
diff --git a/src/cli/handlers/profile-state.test.ts b/src/cli/handlers/profile-state.test.ts
new file mode 100644
index 00000000000..259a55d0368
--- /dev/null
+++ b/src/cli/handlers/profile-state.test.ts
@@ -0,0 +1,521 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import * as durableFileWrite from '../../main/durable-file-write'
+import * as http1Marker from '../../main/startup/http1-compatibility-marker'
+import { readPersistedHttp1CompatibilityMode } from '../../main/startup/http1-compatibility-profile-state'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly,
+  profileStateDatabaseFile
+} from '../../main/persistence/profile-state/profile-state-database'
+import {
+  exportProfileStateJson,
+  importProfileStateJson
+} from '../../main/persistence/profile-state/profile-state-documents'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath
+} from '../../main/persistence/profile-state/profile-state-backup-path'
+import { writeProfileStateDatabaseSnapshotAsync } from '../../main/persistence/profile-state/profile-state-database-snapshot'
+import { profileStateJsonExportPath } from '../../main/persistence/profile-state/legacy-json/profile-state-export-path'
+import { main } from '../index'
+
+const { getCliStatusMock, getDefaultUserDataPathMock, runtimeClientConstructorMock } = vi.hoisted(
+  () => ({
+    getCliStatusMock: vi.fn(),
+    getDefaultUserDataPathMock: vi.fn(),
+    runtimeClientConstructorMock: vi.fn()
+  })
+)
+
+vi.mock('../runtime-client', () => {
+  class RuntimeClientError extends Error {
+    readonly code: string
+    readonly data: unknown
+
+    constructor(code: string, message: string, data?: unknown) {
+      super(message)
+      this.code = code
+      this.data = data
+    }
+  }
+
+  class RuntimeClient {
+    getCliStatus = getCliStatusMock
+
+    constructor(
+      _userDataPath?: string,
+      _requestTimeoutMs?: number,
+      remotePairingCode?: string | null,
+      environmentSelector?: string | null
+    ) {
+      runtimeClientConstructorMock(remotePairingCode, environmentSelector)
+    }
+  }
+
+  return {
+    RuntimeClient,
+    RuntimeClientError,
+    getDefaultUserDataPath: getDefaultUserDataPathMock
+  }
+})
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+  runtimeClientConstructorMock.mockReset()
+  process.exitCode = 0
+})
+
+function createProfile(): {
+  userDataPath: string
+  dataFile: string
+  databaseFile: string
+  exportPath: string
+} {
+  const userDataPath = mkdtempSync(join(tmpdir(), 'orca-profile-state-cli-'))
+  temporaryDirectories.push(userDataPath)
+  const profileId = 'profile-cli-recovery'
+  const profileDirectory = join(userDataPath, 'profiles', profileId)
+  mkdirSync(profileDirectory, { recursive: true })
+  writeFileSync(
+    join(userDataPath, 'orca-profile-index.json'),
+    JSON.stringify({ activeProfileId: profileId, profiles: [{ id: profileId }] }),
+    'utf8'
+  )
+  const dataFile = join(profileDirectory, 'orca-data.json')
+  const databaseFile = profileStateDatabaseFile(profileDirectory)
+  const exportPath = profileStateJsonExportPath(dataFile, 1)
+  writeFileSync(dataFile, JSON.stringify({ settings: { theme: 'old' } }), 'utf8')
+  writeFileSync(
+    exportPath,
+    JSON.stringify({ settings: { theme: 'recovered', electronHttp1CompatibilityMode: true } }),
+    'utf8'
+  )
+  writeFileSync(databaseFile, 'damaged sqlite primary', 'utf8')
+  writeFileSync(`${databaseFile}-wal`, 'damaged wal sidecar', 'utf8')
+  return { userDataPath, dataFile, databaseFile, exportPath }
+}
+
+async function createDatabaseBackup(
+  profile: ReturnType<typeof createProfile>,
+  profileId = 'profile-cli-recovery'
+) {
+  const id = createProfileStateDatabaseBackupId()
+  const path = profileStateDatabaseBackupPath(profile.databaseFile, id)
+  const source = openProfileStateDatabase(join(profile.userDataPath, 'backup-source.db'), profileId)
+  try {
+    importProfileStateJson(
+      source.db,
+      JSON.stringify({
+        settings: {
+          theme: 'sqlite-recovered',
+          electronHttp1CompatibilityMode: true,
+          httpProxyUrl: 'sealed:unchanged'
+        },
+        extensionState: { retained: true }
+      })
+    )
+    await writeProfileStateDatabaseSnapshotAsync(source.db, path)
+  } finally {
+    source.db.close()
+  }
+  return { id, path }
+}
+
+describe('profile-state CLI recovery', () => {
+  beforeEach(() => {
+    getCliStatusMock.mockResolvedValue({
+      id: 'status',
+      ok: true,
+      result: {
+        app: { running: false, pid: null },
+        runtime: { state: 'not_running', reachable: false, runtimeId: null },
+        graph: { state: 'not_running' }
+      },
+      _meta: { runtimeId: 'test' }
+    })
+    vi.spyOn(console, 'log').mockImplementation(() => {})
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+  })
+
+  it('restores the selected export through the offline CLI command', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+
+    await main(['profile', 'state', 'rollback', '--revision', '1', '--json'], profile.userDataPath)
+
+    expect(existsSync(profile.databaseFile)).toBe(false)
+    expect(readFileSync(profile.dataFile, 'utf8')).toBe(
+      JSON.stringify({ settings: { theme: 'recovered', electronHttp1CompatibilityMode: true } })
+    )
+    expect(
+      JSON.parse(readFileSync(join(profile.userDataPath, 'http1-compatibility.json'), 'utf8'))
+    ).toMatchObject({
+      enabled: true,
+      profileId: 'profile-cli-recovery'
+    })
+    const output = vi.mocked(console.log).mock.calls.at(-1)?.[0]
+    expect(String(output)).toContain('quarantineDirectory')
+    expect(getCliStatusMock).toHaveBeenCalledOnce()
+  })
+
+  it('adopts current JSON through CLI with an honest source description', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    const original = readFileSync(profile.dataFile)
+    await main(['profile', 'state', 'rollback', '--current-json'], profile.userDataPath)
+    expect(readFileSync(profile.dataFile)).toEqual(original)
+    expect(existsSync(profile.databaseFile)).toBe(false)
+    const output = String(vi.mocked(console.log).mock.calls.at(-1)?.[0])
+    expect(output).toContain('source: current JSON')
+    expect(output).not.toContain('revision:')
+  })
+
+  it('keeps current SQLite through CLI and rewrites the diverged JSON', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    rmSync(profile.databaseFile)
+    rmSync(`${profile.databaseFile}-wal`)
+    rmSync(profile.exportPath)
+    const source = openProfileStateDatabase(profile.databaseFile, 'profile-cli-recovery')
+    try {
+      importProfileStateJson(source.db, JSON.stringify({ settings: { theme: 'sqlite' } }))
+    } finally {
+      source.db.close()
+    }
+    writeFileSync(profile.dataFile, JSON.stringify({ settings: { theme: 'older-build' } }))
+    await main(['profile', 'state', 'rollback', '--current-sqlite'], profile.userDataPath)
+    expect(JSON.parse(readFileSync(profile.dataFile, 'utf8'))).toEqual({
+      settings: { theme: 'sqlite' }
+    })
+    expect(String(vi.mocked(console.log).mock.calls.at(-1)?.[0])).toContain(
+      'source: current SQLite'
+    )
+  })
+
+  it('refuses to keep an unreadable SQLite and leaves JSON untouched', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    const json = readFileSync(profile.dataFile)
+    await main(['profile', 'state', 'rollback', '--current-sqlite', '--json'], profile.userDataPath)
+    expect(process.exitCode).toBe(1)
+    expect(readFileSync(profile.dataFile)).toEqual(json)
+    expect(readFileSync(profile.databaseFile, 'utf8')).toBe('damaged sqlite primary')
+  })
+
+  it.each([
+    ['--current-json', '--revision', '1'],
+    ['--current-json', '--backup', '1'],
+    ['--current-json', '--current-sqlite'],
+    ['--current-json=false'],
+    ['--current-sqlite=false']
+  ])('rejects ambiguous current JSON arguments: %s', async (...flags) => {
+    getCliStatusMock.mockClear()
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    await main(['profile', 'state', 'rollback', ...flags, '--json'], profile.userDataPath)
+    expect(process.exitCode).toBe(1)
+    expect(existsSync(profile.databaseFile)).toBe(true)
+    expect(getCliStatusMock).not.toHaveBeenCalled()
+  })
+
+  it('keeps profile-state recovery local when remote selection is configured', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    vi.stubEnv('ORCA_PAIRING_CODE', 'remote-pairing-code')
+    vi.stubEnv('ORCA_ENVIRONMENT', 'stale-environment')
+
+    await main(['profile', 'state', 'rollback', '--revision', '1', '--json'], profile.userDataPath)
+
+    expect(runtimeClientConstructorMock).toHaveBeenCalledWith(null, null)
+    expect(vi.mocked(console.log).mock.calls.at(-1)?.[0]).toContain('quarantineDirectory')
+  })
+
+  it.each([true, false])(
+    'recovers an absent database and archives every export (legacy JSON present: %s)',
+    async (hasJson) => {
+      const profile = createProfile()
+      getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+      rmSync(profile.databaseFile)
+      rmSync(`${profile.databaseFile}-wal`)
+      if (!hasJson) {
+        rmSync(profile.dataFile)
+      }
+      const laterExport = profileStateJsonExportPath(profile.dataFile, 2)
+      writeFileSync(laterExport, JSON.stringify({ settings: { theme: 'later' } }))
+      const selectedBytes = readFileSync(profile.exportPath)
+      const laterBytes = readFileSync(laterExport)
+
+      await main(
+        ['profile', 'state', 'rollback', '--revision', '1', '--json'],
+        profile.userDataPath
+      )
+
+      expect(process.exitCode).toBe(0)
+      expect(readFileSync(profile.dataFile)).toEqual(selectedBytes)
+      expect(existsSync(profile.exportPath)).toBe(false)
+      expect(existsSync(laterExport)).toBe(false)
+      const output: unknown = JSON.parse(String(vi.mocked(console.log).mock.calls.at(-1)?.[0]))
+      expect(output).toMatchObject({ ok: true, result: { removedDatabaseFiles: [] } })
+      if (
+        !output ||
+        typeof output !== 'object' ||
+        !('result' in output) ||
+        !output.result ||
+        typeof output.result !== 'object' ||
+        !('quarantineDirectory' in output.result) ||
+        typeof output.result.quarantineDirectory !== 'string'
+      ) {
+        throw new Error('Expected rollback archive directory')
+      }
+      const archive = output.result.quarantineDirectory
+      expect(readFileSync(join(archive, basename(profile.exportPath)))).toEqual(selectedBytes)
+      expect(readFileSync(join(archive, basename(laterExport)))).toEqual(laterBytes)
+      expect(existsSync(join(archive, basename(profile.dataFile)))).toBe(hasJson)
+      expect(readPersistedHttp1CompatibilityMode(profile.userDataPath)).toBe(true)
+    }
+  )
+
+  it('preserves all live recovery sources when archiving an export fails', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    const unavailableExport = profileStateJsonExportPath(profile.dataFile, 2)
+    mkdirSync(unavailableExport)
+    const original = readFileSync(profile.dataFile)
+
+    await main(['profile', 'state', 'rollback', '--revision', '1', '--json'], profile.userDataPath)
+
+    expect(process.exitCode).toBe(1)
+    expect(readFileSync(profile.dataFile)).toEqual(original)
+    expect(existsSync(profile.exportPath)).toBe(true)
+    expect(existsSync(profile.databaseFile)).toBe(true)
+    expect(existsSync(`${profile.databaseFile}-wal`)).toBe(true)
+  })
+
+  it('falls back to restored settings when refreshing the marker fails', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    http1Marker.writeHttp1CompatibilityMarker(profile.userDataPath, false, 'profile-cli-recovery')
+    const writeFileDurableSync = durableFileWrite.writeFileDurableSync
+    vi.spyOn(durableFileWrite, 'writeFileDurableSync').mockImplementation(
+      (tmp, target, contents) => {
+        if (target === join(profile.userDataPath, http1Marker.HTTP1_COMPATIBILITY_MARKER_FILE)) {
+          throw new Error('injected marker write failure')
+        }
+        return writeFileDurableSync(tmp, target, contents)
+      }
+    )
+
+    await main(['profile', 'state', 'rollback', '--revision', '1', '--json'], profile.userDataPath)
+
+    expect(existsSync(profile.databaseFile)).toBe(false)
+    expect(
+      http1Marker.readHttp1CompatibilityMarker(profile.userDataPath, 'profile-cli-recovery')
+    ).toBeNull()
+    expect(readPersistedHttp1CompatibilityMode(profile.userDataPath)).toBe(true)
+    expect(String(vi.mocked(console.log).mock.calls.at(-1)?.[0])).toContain('quarantineDirectory')
+  })
+
+  it('preserves SQLite authority when the old marker cannot be invalidated', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    // A directory at the marker path makes non-recursive removal fail on every supported OS.
+    mkdirSync(join(profile.userDataPath, http1Marker.HTTP1_COMPATIBILITY_MARKER_FILE))
+
+    await main(['profile', 'state', 'rollback', '--revision', '1', '--json'], profile.userDataPath)
+
+    expect(readFileSync(profile.databaseFile, 'utf8')).toBe('damaged sqlite primary')
+    expect(existsSync(profile.exportPath)).toBe(true)
+    expect(readFileSync(profile.dataFile, 'utf8')).toBe(
+      JSON.stringify({ settings: { theme: 'old' } })
+    )
+    expect(String(vi.mocked(console.log).mock.calls.at(-1)?.[0])).not.toContain(
+      'quarantineDirectory'
+    )
+    expect(process.exitCode).toBe(1)
+  })
+
+  it('does not invalidate the active setting for an invalid recovery export', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    http1Marker.writeHttp1CompatibilityMarker(profile.userDataPath, true, 'profile-cli-recovery')
+    writeFileSync(profile.exportPath, 'invalid JSON')
+
+    await main(['profile', 'state', 'rollback', '--revision', '1', '--json'], profile.userDataPath)
+
+    expect(existsSync(profile.databaseFile)).toBe(true)
+    expect(
+      http1Marker.readHttp1CompatibilityMarker(profile.userDataPath, 'profile-cli-recovery')
+    ).toBe(true)
+    expect(process.exitCode).toBe(1)
+  })
+
+  it('rejects an explicit remote selector instead of silently ignoring it', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+
+    await main(
+      ['profile', 'state', 'rollback', '--revision', '1', '--environment', 'remote', '--json'],
+      profile.userDataPath
+    )
+
+    expect(existsSync(profile.databaseFile)).toBe(true)
+    expect(vi.mocked(console.log).mock.calls.at(-1)?.[0]).toContain(
+      '`--environment` does not retarget profile-state recovery'
+    )
+  })
+
+  it.each([['--revision', '1'], ['--current-json']])(
+    'refuses rollback while runtime is reachable: %s',
+    async (...flags) => {
+      const profile = createProfile()
+      getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+      getCliStatusMock.mockResolvedValueOnce({
+        id: 'status',
+        ok: true,
+        result: {
+          app: { running: true, pid: 123 },
+          runtime: { state: 'ready', reachable: true, runtimeId: 'desktop' },
+          graph: { state: 'ready' }
+        },
+        _meta: { runtimeId: 'test' }
+      })
+
+      await main(['profile', 'state', 'rollback', ...flags], profile.userDataPath)
+
+      expect(existsSync(profile.databaseFile)).toBe(true)
+      expect(readFileSync(profile.dataFile, 'utf8')).toBe(
+        JSON.stringify({ settings: { theme: 'old' } })
+      )
+      expect(vi.mocked(console.error).mock.calls.at(-1)?.[0]).toContain('Stop Orca')
+    }
+  )
+
+  it('lists SQLite backups alongside JSON exports without opening the damaged primary', async () => {
+    const profile = createProfile()
+    const backup = await createDatabaseBackup(profile)
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    getCliStatusMock.mockClear()
+
+    await main(['profile', 'state', 'exports', '--json'], profile.userDataPath)
+
+    const output: unknown = JSON.parse(String(vi.mocked(console.log).mock.calls.at(-1)?.[0]))
+    expect(output).toMatchObject({
+      ok: true,
+      result: { exportPaths: [profile.exportPath], backups: [{ id: backup.id, path: backup.path }] }
+    })
+    expect(getCliStatusMock).not.toHaveBeenCalled()
+  })
+
+  it.each([true, false])(
+    'restores SQLite backup authority with damaged database present=%s',
+    async (hasDatabase) => {
+      const profile = createProfile()
+      const backup = await createDatabaseBackup(profile)
+      getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+      http1Marker.writeHttp1CompatibilityMarker(profile.userDataPath, false, 'profile-cli-recovery')
+      if (!hasDatabase) {
+        rmSync(profile.databaseFile)
+        rmSync(`${profile.databaseFile}-wal`)
+        rmSync(profile.dataFile)
+      }
+
+      await main(
+        ['profile', 'state', 'rollback', '--backup', backup.id, '--json'],
+        profile.userDataPath
+      )
+
+      expect(process.exitCode).toBe(0)
+      expect(existsSync(profile.dataFile)).toBe(false)
+      expect(existsSync(backup.path)).toBe(true)
+      const restored = openProfileStateDatabaseReadOnly(
+        profile.databaseFile,
+        'profile-cli-recovery'
+      )
+      try {
+        expect(JSON.parse(exportProfileStateJson(restored.db))).toMatchObject({
+          settings: { theme: 'sqlite-recovered', httpProxyUrl: 'sealed:unchanged' },
+          extensionState: { retained: true }
+        })
+      } finally {
+        restored.db.close()
+      }
+      expect(
+        http1Marker.readHttp1CompatibilityMarker(profile.userDataPath, 'profile-cli-recovery')
+      ).toBe(true)
+      expect(String(vi.mocked(console.log).mock.calls.at(-1)?.[0])).toContain('"storage": "sqlite"')
+    }
+  )
+
+  it('rejects a backup belonging to another profile before invalidating the startup marker', async () => {
+    const profile = createProfile()
+    const backup = await createDatabaseBackup(profile, 'foreign-profile')
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    http1Marker.writeHttp1CompatibilityMarker(profile.userDataPath, true, 'profile-cli-recovery')
+
+    await main(
+      ['profile', 'state', 'rollback', '--backup', backup.id, '--json'],
+      profile.userDataPath
+    )
+
+    expect(process.exitCode).toBe(1)
+    expect(readFileSync(profile.databaseFile, 'utf8')).toBe('damaged sqlite primary')
+    expect(
+      http1Marker.readHttp1CompatibilityMarker(profile.userDataPath, 'profile-cli-recovery')
+    ).toBe(true)
+  })
+
+  it('requires an unambiguous retained backup selection', async () => {
+    const profile = createProfile()
+    const backup = await createDatabaseBackup(profile)
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+
+    await main(
+      ['profile', 'state', 'rollback', '--backup', backup.id, '--revision', '1', '--json'],
+      profile.userDataPath
+    )
+
+    expect(process.exitCode).toBe(1)
+    expect(readFileSync(profile.databaseFile, 'utf8')).toBe('damaged sqlite primary')
+    expect(String(vi.mocked(console.log).mock.calls.at(-1)?.[0])).toContain('exactly one')
+  })
+
+  it('rejects escaping backup IDs without touching any recovery artifact', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+
+    await main(
+      ['profile', 'state', 'rollback', '--backup', '../../outside', '--json'],
+      profile.userDataPath
+    )
+
+    expect(process.exitCode).toBe(1)
+    expect(readFileSync(profile.databaseFile, 'utf8')).toBe('damaged sqlite primary')
+    expect(String(vi.mocked(console.log).mock.calls.at(-1)?.[0])).toContain('backup is unavailable')
+  })
+
+  it('refuses database backup restoration while the app is running', async () => {
+    const profile = createProfile()
+    const backup = await createDatabaseBackup(profile)
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    getCliStatusMock.mockResolvedValueOnce({
+      result: { app: { running: true }, runtime: { reachable: false } }
+    })
+
+    await main(
+      ['profile', 'state', 'rollback', '--backup', backup.id, '--json'],
+      profile.userDataPath
+    )
+
+    expect(process.exitCode).toBe(1)
+    expect(readFileSync(profile.databaseFile, 'utf8')).toBe('damaged sqlite primary')
+    expect(String(vi.mocked(console.log).mock.calls.at(-1)?.[0])).toContain('Stop Orca')
+  })
+})
diff --git a/src/cli/handlers/profile-state.ts b/src/cli/handlers/profile-state.ts
new file mode 100644
index 00000000000..be7e70413bb
--- /dev/null
+++ b/src/cli/handlers/profile-state.ts
@@ -0,0 +1,159 @@
+import type { CommandHandler } from '../dispatch'
+import { printResult } from '../format'
+import { rejectRemoteSelectionFlags } from '../remote-selection-flag-rejection'
+import {
+  getDefaultUserDataPath,
+  RuntimeClientError,
+  type RuntimeClient,
+  type RuntimeRpcSuccess
+} from '../runtime-client'
+import {
+  getProfileStateExports,
+  rollbackProfileState
+} from '../../main/persistence/profile-state/profile-state-recovery-command'
+import { acquireProfileStateMaintenance } from '../../main/persistence/profile-state/profile-state-access'
+import {
+  isProfileStateRecoveryCommandError,
+  type ProfileStateExportsResult,
+  type ProfileStateRollbackResult,
+  type ProfileStateRecoverySelector
+} from '../../shared/profile-state-recovery-command'
+import {
+  canLaunchProfileStateRecovery,
+  launchProfileStateRecovery
+} from '../runtime/profile-state-recovery-launch'
+
+function localSuccess<TResult>(result: TResult): RuntimeRpcSuccess<TResult> {
+  return {
+    id: 'local',
+    ok: true,
+    result,
+    _meta: { runtimeId: 'local' }
+  }
+}
+
+function formatExports(result: ProfileStateExportsResult): string {
+  return [
+    `profileId: ${result.profileId}`,
+    `dataFile: ${result.dataFile}`,
+    `databaseFile: ${result.databaseFile}`,
+    'JSON exports:',
+    ...(result.exportPaths.length > 0 ? result.exportPaths : ['(none)']),
+    'SQLite backups:',
+    ...(result.backups.length > 0
+      ? result.backups.map((backup) => `${backup.id}: ${backup.path}`)
+      : ['(none)'])
+  ].join('\n')
+}
+
+function formatRollback(result: ProfileStateRollbackResult): string {
+  return [
+    `profileId: ${result.profileId}`,
+    result.revision === null ? 'source: current JSON' : `revision: ${result.revision}`,
+    ...(result.storage === 'sqlite' && result.backupId === undefined
+      ? ['source: current SQLite']
+      : []),
+    `storage: ${result.storage}`,
+    `restored: ${result.restoredPath}`,
+    `quarantine: ${result.quarantineDirectory}`,
+    `removedDatabaseFiles: ${result.removedDatabaseFiles.length}`
+  ].join('\n')
+}
+
+function rejectProfileStateRemoteSelection(flags: ReadonlyMap<string, string | boolean>): void {
+  rejectRemoteSelectionFlags(
+    flags,
+    "profile-state recovery; it operates on this machine's active profile."
+  )
+}
+
+async function requireStoppedRuntime(client: RuntimeClient): Promise<void> {
+  const status = await client.getCliStatus()
+  if (status.result.runtime.reachable || status.result.app.running) {
+    throw new RuntimeClientError(
+      'runtime_error',
+      'Stop Orca before profile-state rollback so no process can write the SQLite database.'
+    )
+  }
+}
+
+function parseRevision(flags: Map<string, string | boolean>): number {
+  const rawRevision = flags.get('revision')
+  if (typeof rawRevision !== 'string' || rawRevision.length === 0) {
+    throw new RuntimeClientError('invalid_argument', 'Profile-state rollback requires --revision.')
+  }
+  const revision = Number(rawRevision)
+  if (!Number.isSafeInteger(revision) || revision < 1) {
+    throw new RuntimeClientError(
+      'invalid_argument',
+      `Invalid profile-state revision: ${rawRevision}`
+    )
+  }
+  return revision
+}
+
+export const PROFILE_STATE_HANDLERS: Record<string, CommandHandler> = {
+  'profile state exports': async ({ flags, json }) => {
+    rejectProfileStateRemoteSelection(flags)
+    const result = translateRecoveryError(() => getProfileStateExports(getDefaultUserDataPath()))
+    printResult(localSuccess(result), json, formatExports)
+  },
+  'profile state rollback': async ({ client, flags, json }) => {
+    rejectProfileStateRemoteSelection(flags)
+    const selector = parseSelector(flags)
+    const userDataPath = getDefaultUserDataPath()
+    let result: ProfileStateRollbackResult
+    if (canLaunchProfileStateRecovery()) {
+      await requireStoppedRuntime(client)
+      result = await launchProfileStateRecovery({ userDataPath, selector })
+    } else {
+      const maintenance = acquireProfileStateMaintenance(userDataPath)
+      try {
+        await requireStoppedRuntime(client)
+        result = translateRecoveryError(() =>
+          rollbackProfileState(userDataPath, selector, maintenance)
+        )
+      } finally {
+        maintenance.release()
+      }
+    }
+    printResult(localSuccess(result), json, formatRollback)
+  }
+}
+
+function parseSelector(flags: Map<string, string | boolean>): ProfileStateRecoverySelector {
+  const selectors = ['revision', 'backup', 'current-json', 'current-sqlite'] as const
+  if (selectors.filter((flag) => flags.has(flag)).length !== 1) {
+    throw new RuntimeClientError(
+      'invalid_argument',
+      'Select exactly one of --revision, --backup, --current-json, or --current-sqlite.'
+    )
+  }
+  for (const kind of ['current-json', 'current-sqlite'] as const) {
+    if (flags.has(kind)) {
+      if (flags.get(kind) !== true) {
+        throw new RuntimeClientError('invalid_argument', `--${kind} does not take a value.`)
+      }
+      return { kind }
+    }
+  }
+  if (!flags.has('backup')) {
+    return { kind: 'json', revision: parseRevision(flags) }
+  }
+  const backupId = flags.get('backup')
+  if (typeof backupId !== 'string' || backupId.length === 0) {
+    throw new RuntimeClientError('invalid_argument', 'Profile-state rollback requires --backup.')
+  }
+  return { kind: 'sqlite', backupId }
+}
+
+function translateRecoveryError<T>(operation: () => T): T {
+  try {
+    return operation()
+  } catch (error) {
+    if (isProfileStateRecoveryCommandError(error)) {
+      throw new RuntimeClientError(error.code, error.message)
+    }
+    throw error
+  }
+}
diff --git a/src/cli/handlers/terminal-close.ts b/src/cli/handlers/terminal-close.ts
index 5ba8a25b64a..9e65b2f5f47 100644
--- a/src/cli/handlers/terminal-close.ts
+++ b/src/cli/handlers/terminal-close.ts
@@ -6,6 +6,7 @@ import type { CommandHandler } from '../dispatch'
 import { formatTerminalClose, reportCliError, printResult } from '../format'
 import { RuntimeClientError } from '../runtime-client'
 import { getRequiredWorktreeSelector, getTerminalHandle } from '../selectors'
+import { describeUnconfirmedCloseStop } from '../../shared/pty-liveness-verdict'
 
 /** A false stop receipt is an error only when the host supplied a liveness verdict. */
 function terminalCloseFailure(close: RuntimeTerminalClose): RuntimeClientError | null {
@@ -13,14 +14,17 @@ function terminalCloseFailure(close: RuntimeTerminalClose): RuntimeClientError |
     return null
   }
 
-  const verdict = close.ptyStopVerdict
-  const detail =
-    verdict === 'live'
-      ? 'The PTY is live.'
-      : `The PTY was not confirmed stopped: ${close.ptyStopReason ?? 'its host could not be reached'}.`
+  if (close.ptyStopVerdict === 'live') {
+    return new RuntimeClientError(
+      'terminal_stop_live',
+      `Terminal ${close.handle} close failed to confirm the PTY stopped (live). The PTY is live.`,
+      { close }
+    )
+  }
+  // Why: the close itself committed; only the process stop is unproven, so say which.
   return new RuntimeClientError(
-    verdict === 'live' ? 'terminal_stop_live' : 'terminal_stop_unverifiable',
-    `Terminal ${close.handle} close failed to confirm the PTY stopped (${verdict}). ${detail}`,
+    'terminal_stop_unverifiable',
+    `Closed terminal ${close.handle}. ${describeUnconfirmedCloseStop(close)}`,
     { close }
   )
 }
diff --git a/src/cli/handlers/terminal.test.ts b/src/cli/handlers/terminal.test.ts
index 06df95f55a9..c0d9e8acda5 100644
--- a/src/cli/handlers/terminal.test.ts
+++ b/src/cli/handlers/terminal.test.ts
@@ -42,40 +42,57 @@ describe('terminal close CLI', () => {
     expect(process.exitCode).toBeUndefined()
   })
 
-  it('reports an unverifiable PTY stop as a failing JSON outcome', async () => {
-    process.exitCode = undefined
-    const close = {
-      handle: 'term-remote',
-      tabId: 'tab-1',
-      ptyKilled: false,
-      ptyStopVerdict: 'unverifiable' as const,
-      ptyStopReason: 'its SSH provider is no longer registered'
-    }
-    const call = vi.fn().mockResolvedValue({
-      id: 'req-close',
-      ok: true,
-      result: { close },
-      _meta: { runtimeId: 'runtime-1' }
-    })
-    const log = vi.spyOn(console, 'log').mockImplementation(() => {})
-
-    await TERMINAL_HANDLERS['terminal close']({
-      flags: new Map([['terminal', close.handle]]),
-      client: { call } as unknown as RuntimeClient,
-      cwd: '/tmp/worktree',
-      json: true
-    })
-
-    expect(JSON.parse(String(log.mock.calls[0]?.[0]))).toMatchObject({
-      ok: false,
-      error: {
-        code: 'terminal_stop_unverifiable',
-        message: expect.stringContaining('unverifiable'),
-        data: { close }
+  it.each([
+    [
+      'its SSH provider is no longer registered',
+      false,
+      'Closed terminal term-remote. The PTY was not confirmed stopped: its SSH provider is no longer registered.'
+    ],
+    [
+      'Request "pty.shutdown" timed out after 14250ms',
+      true,
+      'Closed terminal term-remote. The PTY was not confirmed stopped: Request "pty.shutdown" timed out after 14250ms. The kill retries when the host reconnects.'
+    ],
+    // An older host never reports a recorded kill, so the same reason promises nothing.
+    [
+      'Request "pty.shutdown" timed out after 14250ms',
+      false,
+      'Closed terminal term-remote. The PTY was not confirmed stopped: Request "pty.shutdown" timed out after 14250ms.'
+    ]
+  ])(
+    'reports an unverifiable stop (%s, kill recorded: %s) as a committed close with exit code 1',
+    async (ptyStopReason, pendingKillRecorded, message) => {
+      process.exitCode = undefined
+      const close = {
+        handle: 'term-remote',
+        tabId: 'tab-1',
+        ptyKilled: false,
+        ptyStopVerdict: 'unverifiable' as const,
+        ptyStopReason,
+        ...(pendingKillRecorded ? { pendingKillRecorded: true as const } : {})
       }
-    })
-    expect(process.exitCode).toBe(1)
-  })
+      const call = vi.fn().mockResolvedValue({
+        id: 'req-close',
+        ok: true,
+        result: { close },
+        _meta: { runtimeId: 'runtime-1' }
+      })
+      const log = vi.spyOn(console, 'log').mockImplementation(() => {})
+
+      await TERMINAL_HANDLERS['terminal close']({
+        flags: new Map([['terminal', close.handle]]),
+        client: { call } as unknown as RuntimeClient,
+        cwd: '/tmp/worktree',
+        json: true
+      })
+
+      expect(JSON.parse(String(log.mock.calls[0]?.[0]))).toMatchObject({
+        ok: false,
+        error: { code: 'terminal_stop_unverifiable', message, data: { close } }
+      })
+      expect(process.exitCode).toBe(1)
+    }
+  )
 
   it('reports a live PTY stop as a failing human outcome', async () => {
     process.exitCode = undefined
diff --git a/src/cli/handlers/worktree.ts b/src/cli/handlers/worktree.ts
index 62ddd27155a..3541beef20b 100644
--- a/src/cli/handlers/worktree.ts
+++ b/src/cli/handlers/worktree.ts
@@ -245,7 +245,8 @@ export const WORKTREE_HANDLERS: Record<string, CommandHandler> = {
       ...(startupAgent
         ? {
             startupAgent,
-            startupPrompt: getPresentStringFlag(flags, 'prompt', { allowEmpty: true }) ?? ''
+            startupPrompt: getPresentStringFlag(flags, 'prompt', { allowEmpty: true }) ?? '',
+            launchSource: 'cli'
           }
         : {})
     })
diff --git a/src/cli/index-orchestration.test.ts b/src/cli/index-orchestration.test.ts
index c4e4438f2e9..bc7366f5b11 100644
--- a/src/cli/index-orchestration.test.ts
+++ b/src/cli/index-orchestration.test.ts
@@ -85,6 +85,25 @@ describe('orca cli worktree awareness', () => {
     expect(logSpy).toHaveBeenCalledWith('Sent 2 messages to 2 recipients')
   })
 
+  it("refuses an agent session's caller flag naming another caller before any request", async () => {
+    // One chokepoint for every verb: the spec says which flag names the caller.
+    process.env.ORCA_AGENT_SESSION_ID = 'f7a1c0de-1111-4222-8333-444455556666'
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {})
+    try {
+      await main(['orchestration', 'check', '--terminal', 'term_sibling', '--json'], '/tmp/repo')
+    } finally {
+      delete process.env.ORCA_AGENT_SESSION_ID
+    }
+
+    expect(callMock).not.toHaveBeenCalled()
+    expect(process.exitCode).toBe(1)
+    expect(JSON.parse(String(logSpy.mock.calls[0]?.[0]))).toMatchObject({
+      ok: false,
+      error: { code: 'consumer_fenced' }
+    })
+    process.exitCode = undefined
+  })
+
   it('rejects no-flag orchestration reset before calling the runtime', async () => {
     await main(['orchestration', 'reset'], '/tmp/repo')
 
diff --git a/src/cli/index-vm-recipe-doctor.test.ts b/src/cli/index-vm-recipe-doctor.test.ts
index c707c5cdc88..1e8bd99e15f 100644
--- a/src/cli/index-vm-recipe-doctor.test.ts
+++ b/src/cli/index-vm-recipe-doctor.test.ts
@@ -198,11 +198,13 @@ describe('orca cli worktree awareness', () => {
           process.nextTick(() => {
             startChild.stdout.emit(
               'data',
-              JSON.stringify({
-                schemaVersion: 1,
-                pairingCode,
-                projectRoot: '/workspace/repo'
-              })
+              Buffer.from(
+                JSON.stringify({
+                  schemaVersion: 1,
+                  pairingCode,
+                  projectRoot: '/workspace/repo'
+                })
+              )
             )
             startChild.emit('exit', 0, null)
             startChild.emit('close', 0, null)
@@ -289,8 +291,8 @@ describe('orca cli worktree awareness', () => {
       // create emits a non-JSON line to stdout + a real diagnostic to stderr, then exits 0
       spawnMock.mockImplementationOnce(() => {
         process.nextTick(() => {
-          startChild.stdout.emit('data', 'Provisioning sandbox...\n')
-          startChild.stderr.emit('data', 'vercel: error: missing scope\n')
+          startChild.stdout.emit('data', Buffer.from('Provisioning sandbox...\n'))
+          startChild.stderr.emit('data', Buffer.from('vercel: error: missing scope\n'))
           startChild.emit('exit', 0, null)
           startChild.emit('close', 0, null)
         })
diff --git a/src/cli/index-worktree-create-agent.test.ts b/src/cli/index-worktree-create-agent.test.ts
index f1d79ef21df..6ae1266b91c 100644
--- a/src/cli/index-worktree-create-agent.test.ts
+++ b/src/cli/index-worktree-create-agent.test.ts
@@ -138,7 +138,8 @@ describe('orca cli worktree awareness', () => {
       callerTerminalHandle: undefined,
       cliProvenanceRequest: {},
       startupAgent: 'codex',
-      startupPrompt: 'hi'
+      startupPrompt: 'hi',
+      launchSource: 'cli'
     })
   })
 
@@ -187,7 +188,8 @@ describe('orca cli worktree awareness', () => {
       callerTerminalHandle: undefined,
       cliProvenanceRequest: {},
       startupAgent: 'codex',
-      startupPrompt: 'hi'
+      startupPrompt: 'hi',
+      launchSource: 'cli'
     })
   })
 
diff --git a/src/cli/index-worktree-create-freebuff.test.ts b/src/cli/index-worktree-create-freebuff.test.ts
new file mode 100644
index 00000000000..aab4b17c36e
--- /dev/null
+++ b/src/cli/index-worktree-create-freebuff.test.ts
@@ -0,0 +1,94 @@
+import { describe, expect, it, vi } from 'vitest'
+
+const {
+  callMock,
+  runtimeClientConstructorMock,
+  serveOrcaAppMock,
+  getDefaultUserDataPathMock,
+  addEnvironmentFromPairingCodeMock,
+  listEnvironmentsMock,
+  spawnMock
+} = vi.hoisted(() => ({
+  callMock: vi.fn(),
+  runtimeClientConstructorMock: vi.fn(),
+  serveOrcaAppMock: vi.fn(),
+  getDefaultUserDataPathMock: vi.fn(() => '/tmp/orca-user-data'),
+  addEnvironmentFromPairingCodeMock: vi.fn(),
+  listEnvironmentsMock: vi.fn(),
+  spawnMock: vi.fn()
+}))
+
+vi.mock('./runtime-client', async () => {
+  const { createRuntimeClientModuleMock } = await import('./index-test-harness.js')
+  return createRuntimeClientModuleMock({
+    callMock,
+    runtimeClientConstructorMock,
+    serveOrcaAppMock,
+    getDefaultUserDataPathMock
+  })
+})
+
+vi.mock('./runtime/environments', () => ({
+  addEnvironmentFromPairingCode: addEnvironmentFromPairingCodeMock,
+  listEnvironments: listEnvironmentsMock,
+  removeEnvironment: vi.fn(),
+  resolveEnvironment: vi.fn()
+}))
+
+vi.mock('child_process', async () => {
+  const { createChildProcessModuleMock } = await import('./index-test-harness.js')
+  return createChildProcessModuleMock(spawnMock)
+})
+
+import { main } from './index'
+import { buildWorktree, okFixture, queueFixtures, worktreeListFixture } from './test-fixtures'
+import { useWorktreeAwarenessEnvironment } from './index-test-harness'
+
+describe('Freebuff worktree creation', () => {
+  useWorktreeAwarenessEnvironment({
+    callMock,
+    serveOrcaAppMock,
+    getDefaultUserDataPathMock,
+    addEnvironmentFromPairingCodeMock,
+    listEnvironmentsMock,
+    spawnMock
+  })
+
+  it('passes Freebuff and its prompt to the runtime without activating the worktree', async () => {
+    queueFixtures(
+      callMock,
+      worktreeListFixture([buildWorktree('/tmp/repo', 'main', 'abc', 'repo-1')]),
+      okFixture('req_create', {
+        worktree: buildWorktree('/tmp/repo/freebuff-task', 'freebuff-task', 'abc', 'repo-1')
+      })
+    )
+    vi.spyOn(console, 'log').mockImplementation(() => {})
+
+    await main(
+      [
+        'worktree',
+        'create',
+        '--repo',
+        'id:repo-1',
+        '--name',
+        'freebuff-task',
+        '--agent',
+        'freebuff',
+        '--prompt',
+        'Review this workspace',
+        '--json'
+      ],
+      '/tmp/repo'
+    )
+
+    expect(callMock).toHaveBeenNthCalledWith(
+      2,
+      'worktree.create',
+      expect.objectContaining({
+        startupAgent: 'freebuff',
+        startupPrompt: 'Review this workspace',
+        activate: false
+      })
+    )
+  })
+})
diff --git a/src/cli/index.ts b/src/cli/index.ts
index 33566dcf837..be527727876 100644
--- a/src/cli/index.ts
+++ b/src/cli/index.ts
@@ -20,6 +20,7 @@ import { printHelp } from './help'
 import type { RuntimeClient } from './runtime-client'
 import { COMMAND_SPECS } from './specs'
 import { resolveOrchestrationCliExecutable } from './runtime/orchestration-recovery-command'
+import { refuseConflictingSessionCallerFlags } from './session-caller-flags'
 
 export { COMMAND_SPECS } from './specs'
 export { buildCurrentWorktreeSelector, normalizeWorktreeSelector } from './selectors'
@@ -38,7 +39,8 @@ function shouldIgnoreRemoteSelection(commandPath: string[]): boolean {
     commandPath[0] === 'serve' ||
     commandPath[0] === 'agent' ||
     commandPath[0] === 'vm' ||
-    commandPath[0] === 'agent-context'
+    commandPath[0] === 'agent-context' ||
+    commandPath[0] === 'profile'
   )
 }
 
@@ -110,6 +112,10 @@ export async function main(
     // lookup so users do not get misleading "Orca is not running" failures for
     // simple command typos or unsupported flags.
     validateCommandAndFlags(COMMAND_SPECS, parsed)
+    refuseConflictingSessionCallerFlags(
+      findCommandSpec(COMMAND_SPECS, parsed.commandPath),
+      parsed.flags
+    )
     const RuntimeClientClass = await loadRuntimeClientClass()
     const ignoreRemoteSelection = shouldIgnoreRemoteSelection(parsed.commandPath)
     const pairingCode = ignoreRemoteSelection ? null : parsed.flags.get('pairing-code')
diff --git a/src/cli/main-module-bundle-parity.test.ts b/src/cli/main-module-bundle-parity.test.ts
deleted file mode 100644
index a109fcb9fdb..00000000000
--- a/src/cli/main-module-bundle-parity.test.ts
+++ /dev/null
@@ -1,58 +0,0 @@
-import { readFileSync, readdirSync } from 'node:fs'
-import { join, resolve } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-const REPO_ROOT = resolve(__dirname, '..', '..')
-const CLI_ROOT = join(REPO_ROOT, 'src', 'cli')
-
-function listCliSourceFiles(dir: string): string[] {
-  return readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
-    const path = join(dir, entry.name)
-    if (entry.isDirectory()) {
-      return listCliSourceFiles(path)
-    }
-    return entry.isFile() && entry.name.endsWith('.ts') && !entry.name.endsWith('.test.ts')
-      ? [path]
-      : []
-  })
-}
-
-// Why: `import type` is erased by tsc, so it needs no emitted module at runtime.
-const VALUE_IMPORT_FROM_MAIN = /(?<!\btype\s)from '\.\.\/\.\.\/main\/([^']+)'/g
-
-function findMainImports(): { file: string; module: string }[] {
-  return listCliSourceFiles(CLI_ROOT).flatMap((file) => {
-    const source = readFileSync(file, 'utf-8')
-    return [...source.matchAll(VALUE_IMPORT_FROM_MAIN)].map((match) => ({
-      file: file.slice(REPO_ROOT.length + 1),
-      module: match[1]
-    }))
-  })
-}
-
-function findElectronViteMainEntries(): Set<string> {
-  const config = readFileSync(join(REPO_ROOT, 'electron.vite.config.ts'), 'utf-8')
-  return new Set(
-    // Why: entries wrap across lines once the path is long, so allow whitespace.
-    [...config.matchAll(/resolve\(\s*'src\/main\/([^']+)\.ts'\s*\)/g)].map((match) => match[1])
-  )
-}
-
-describe('CLI imports of main-process modules', () => {
-  // Why: electron-vite cleans out/main and emits only its declared entries, so a
-  // `src/main/*` module the CLI imports but the config omits is deleted by the
-  // build that runs after `build:cli` — keep source-level feedback ahead of the
-  // final-artifact runtime verifier.
-  it('has an electron-vite entry for every main module the CLI imports', () => {
-    const entries = findElectronViteMainEntries()
-    const missing = findMainImports().filter(({ module }) => !entries.has(module))
-
-    expect(missing).toEqual([])
-  })
-
-  it('finds the imports it is meant to guard', () => {
-    // Why: a broken matcher would make the guard above vacuously pass.
-    expect(findMainImports().length).toBeGreaterThanOrEqual(2)
-    expect(findElectronViteMainEntries().size).toBeGreaterThanOrEqual(2)
-  })
-})
diff --git a/src/cli/orchestration-session-caller-cli.test.ts b/src/cli/orchestration-session-caller-cli.test.ts
new file mode 100644
index 00000000000..402b9d689e8
--- /dev/null
+++ b/src/cli/orchestration-session-caller-cli.test.ts
@@ -0,0 +1,668 @@
+/**
+ * A command that runs inside a structured agent session is that session: the injected
+ * `ORCA_AGENT_SESSION_ID` names the caller, and nothing resolves or guesses a terminal for it.
+ *
+ * One rule for every verb that names a caller: a caller flag may restate the session, but a flag
+ * naming anyone else is refused — never silently dropped, never allowed to win. A session address
+ * the CLI cannot place is left to the host, whose `/clear` lineage decides.
+ * The #21097 accident was a chat that named a sibling's terminal and consumed that sibling's mail.
+ *
+ * The session env here is the hardest case, a chat that inherited a pane's `ORCA_TERMINAL_HANDLE`
+ * and `ORCA_PANE_KEY` (an Orca launched from an Orca terminal), and the implicit-terminal guess has
+ * a sibling to find.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const callMock = vi.hoisted(() => vi.fn())
+const getTerminalHandleMock = vi.hoisted(() => vi.fn())
+
+vi.mock('./format', () => ({ printResult: vi.fn() }))
+vi.mock('./selectors', () => ({ getTerminalHandle: getTerminalHandleMock }))
+
+import { ORCHESTRATION_HANDLERS } from './handlers/orchestration'
+import { findCommandSpec } from './args'
+import { COMMAND_SPECS } from './specs'
+import { refuseConflictingSessionCallerFlags } from './session-caller-flags'
+import { createOrchestrationCompatibilityEnvelope } from './runtime/orchestration-compatibility-envelope'
+import { getDefaultUserDataPath } from './runtime/metadata'
+import { formatCliError, reportCliError } from './cli-error'
+import { RuntimeRpcFailureError } from './runtime/types'
+
+const SESSION = 'f7a1c0de-1111-4222-8333-444455556666'
+/** The session a `/clear` continued as SESSION: the chat's orchestration address stays this one's. */
+const ROOT = '0b5e2d7c-9a41-4c3e-8f62-7d1a3e5b9c08'
+const IDENTITY_ENV = [
+  'ORCA_AGENT_SESSION_ID',
+  'ORCA_TERMINAL_HANDLE',
+  'ORCA_PANE_KEY',
+  'ORCA_STRUCTURED_SESSION'
+] as const
+const originalEnv = Object.fromEntries(IDENTITY_ENV.map((name) => [name, process.env[name]]))
+
+/** Enough of every receipt shape that each handler finishes after its RPC. */
+const RESULT = {
+  result: {
+    run: { id: 'run_1', objective: 'o', consumer_generation: 1 },
+    runs: [],
+    nextCursor: null,
+    messages: [],
+    count: 0,
+    message: { id: 'msg_1' },
+    lifecycle: { action: 'completed' },
+    dispatch: { id: 'dispatch_1', task_id: 'task_1', status: 'dispatched' },
+    gate: { id: 'gate_1', task_id: 'task_1', status: 'pending', resolution: 'r' },
+    gates: [],
+    task: { id: 'task_1', status: 'pending' },
+    tasks: [],
+    answer: 'yes',
+    messageId: 'msg_1',
+    threadId: 'thread_1',
+    timedOut: false,
+    state: 'ready',
+    runId: 'run_1',
+    taskId: 'task_1',
+    dispatchId: 'dispatch_1',
+    effects: [],
+    residualResources: [],
+    workers: [],
+    counts: {}
+  }
+}
+
+type Verb = {
+  command: string
+  flags: Record<string, string | true>
+  /** The flag that names the caller, when the verb has one. */
+  callerFlag?: 'from' | 'terminal'
+  method: string
+  callerParam: 'from' | 'terminal' | 'callerTerminalHandle'
+}
+
+/** Every verb whose request names its caller: the host's caller-param map, from the CLI side.
+ *  `dispatch-show` is not one: its --from only fills preview text, so it is pinned on its own. */
+const CALLER_VERBS: Verb[] = [
+  {
+    command: 'run-create',
+    flags: { objective: 'o' },
+    callerFlag: 'from',
+    method: 'runCreate',
+    callerParam: 'from'
+  },
+  {
+    command: 'run-use',
+    flags: { id: 'run_1' },
+    callerFlag: 'from',
+    method: 'runUse',
+    callerParam: 'from'
+  },
+  {
+    command: 'run-current',
+    flags: {},
+    callerFlag: 'from',
+    method: 'runCurrent',
+    callerParam: 'from'
+  },
+  { command: 'check', flags: {}, callerFlag: 'terminal', method: 'check', callerParam: 'terminal' },
+  {
+    command: 'send',
+    flags: { to: 'term_worker', subject: 's', body: 'b' },
+    callerFlag: 'from',
+    method: 'send',
+    callerParam: 'from'
+  },
+  {
+    command: 'reply',
+    flags: { id: 'msg_1', body: 'b' },
+    callerFlag: 'from',
+    method: 'reply',
+    callerParam: 'from'
+  },
+  {
+    command: 'ask',
+    flags: { to: 'term_worker', question: 'q' },
+    callerFlag: 'from',
+    method: 'ask',
+    callerParam: 'from'
+  },
+  {
+    command: 'dispatch',
+    flags: { task: 'task_1', to: 'term_worker' },
+    callerFlag: 'from',
+    method: 'dispatch',
+    callerParam: 'from'
+  },
+  {
+    command: 'gate-create',
+    flags: { task: 'task_1', question: 'q' },
+    callerFlag: 'from',
+    method: 'gateCreate',
+    callerParam: 'from'
+  },
+  {
+    command: 'gate-resolve',
+    flags: { id: 'gate_1', resolution: 'r' },
+    callerFlag: 'from',
+    method: 'gateResolve',
+    callerParam: 'from'
+  },
+  { command: 'gate-list', flags: {}, callerFlag: 'from', method: 'gateList', callerParam: 'from' },
+  {
+    command: 'task-create',
+    flags: { spec: 's' },
+    callerFlag: 'from',
+    method: 'taskCreate',
+    callerParam: 'callerTerminalHandle'
+  },
+  {
+    command: 'task-list',
+    flags: {},
+    callerFlag: 'from',
+    method: 'taskList',
+    callerParam: 'callerTerminalHandle'
+  },
+  {
+    command: 'task-update',
+    flags: { id: 'task_1', status: 'completed' },
+    callerFlag: 'from',
+    method: 'taskUpdate',
+    callerParam: 'callerTerminalHandle'
+  },
+  {
+    command: 'worker-start',
+    flags: { spec: 's' },
+    callerFlag: 'from',
+    method: 'workerStart',
+    callerParam: 'from'
+  },
+  // No caller flag: its spec takes none. It asks runCurrent for the caller's Run.
+  { command: 'worker-list', flags: {}, method: 'runCurrent', callerParam: 'from' }
+]
+
+/** Enough flags for any verb to get past its own validation to identity resolution. */
+const EVERY_REQUIRED_FLAG = {
+  objective: 'o',
+  id: 'id_1',
+  task: 'task_1',
+  spec: 's',
+  question: 'q',
+  resolution: 'r',
+  subject: 's',
+  body: 'b',
+  to: 'term_worker',
+  status: 'completed',
+  preamble: true,
+  request: 'req_1'
+} as const
+
+function flagMap(flags: Record<string, string | true>): Map<string, string | boolean> {
+  return new Map(Object.entries(flags))
+}
+
+/** What `main()` does between parsing and dispatch: the spec-driven caller check, then the handler. */
+async function invoke(
+  command: string,
+  flags: Map<string, string | boolean>,
+  json = true
+): Promise<void> {
+  const handler = ORCHESTRATION_HANDLERS[`orchestration ${command}`]
+  if (!handler) {
+    throw new Error(`no handler for ${command}`)
+  }
+  refuseConflictingSessionCallerFlags(
+    findCommandSpec(COMMAND_SPECS, ['orchestration', command]),
+    flags
+  )
+  await handler({
+    flags,
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: these handlers read only `call`; RuntimeClient is a class, so a structural double cannot satisfy it without the cast.
+    client: { call: callMock } as never,
+    cwd: '/tmp/repo',
+    json
+  })
+}
+
+function isParams(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function callsTo(method: string): Record<string, unknown>[] {
+  return callMock.mock.calls
+    .filter(([name]) => name === `orchestration.${method}`)
+    .map(([, params]) => (isParams(params) ? params : {}))
+}
+
+function setEnv(env: Partial<Record<(typeof IDENTITY_ENV)[number], string>>): void {
+  for (const name of IDENTITY_ENV) {
+    const value = env[name]
+    if (value === undefined) {
+      delete process.env[name]
+    } else {
+      process.env[name] = value
+    }
+  }
+}
+
+/** A chat with its id, plus a pane identity it inherited from the Orca that launched it. */
+function asSessionWithInheritedPane(): void {
+  setEnv({
+    ORCA_AGENT_SESSION_ID: SESSION,
+    ORCA_TERMINAL_HANDLE: 'term_inherited_pane',
+    ORCA_PANE_KEY: 'tab_inherited:11111111-1111-4111-8111-111111111111'
+  })
+}
+
+beforeEach(() => {
+  callMock.mockReset().mockResolvedValue(RESULT)
+  getTerminalHandleMock.mockReset().mockResolvedValue('term_sibling')
+  vi.spyOn(console, 'log').mockImplementation(() => {})
+  vi.spyOn(console, 'error').mockImplementation(() => {})
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  setEnv(originalEnv)
+  process.exitCode = undefined
+})
+
+describe.each(CALLER_VERBS)('orchestration $command run as an agent session', (verb) => {
+  beforeEach(asSessionWithInheritedPane)
+
+  it('acts as the session: no terminal is resolved, guessed or sent', async () => {
+    await invoke(verb.command, flagMap(verb.flags))
+
+    const [params] = callsTo(verb.method)
+    expect(params, 'the verb reached its method').toBeDefined()
+    expect(params?.[verb.callerParam]).toBeUndefined()
+    // An inherited pane is not the session's identity.
+    expect(params?.terminalPaneKey).toBeUndefined()
+    expect(params?.senderPaneKey).toBeUndefined()
+    expect(getTerminalHandleMock).not.toHaveBeenCalled()
+    expect(callMock.mock.calls.map(([name]) => name)).not.toEqual(
+      expect.arrayContaining([expect.stringMatching(/^terminal\./)])
+    )
+  })
+
+  it.runIf(verb.callerFlag !== undefined)(
+    'refuses a caller flag naming another caller, before any request',
+    async () => {
+      const flags = flagMap({ ...verb.flags, [verb.callerFlag ?? 'from']: 'term_sibling' })
+
+      await expect(invoke(verb.command, flags)).rejects.toMatchObject({
+        code: 'consumer_fenced',
+        message: expect.stringContaining(`agent session ${SESSION}`)
+      })
+      expect(callMock).not.toHaveBeenCalled()
+      expect(getTerminalHandleMock).not.toHaveBeenCalled()
+    }
+  )
+
+  it.runIf(verb.callerFlag !== undefined)(
+    'refuses an inherited pane handle too: the session, not the pane, is the caller',
+    async () => {
+      const flags = flagMap({ ...verb.flags, [verb.callerFlag ?? 'from']: 'term_inherited_pane' })
+
+      await expect(invoke(verb.command, flags)).rejects.toMatchObject({ code: 'consumer_fenced' })
+      expect(callMock).not.toHaveBeenCalled()
+    }
+  )
+
+  it.runIf(verb.callerFlag !== undefined).each([`session:${SESSION}`, SESSION])(
+    'accepts a caller flag that restates the session (%s)',
+    async (restated) => {
+      await invoke(verb.command, flagMap({ ...verb.flags, [verb.callerFlag ?? 'from']: restated }))
+
+      const [params] = callsTo(verb.method)
+      expect(params, 'the verb reached its method').toBeDefined()
+      expect(params?.[verb.callerParam]).toBeUndefined()
+    }
+  )
+})
+
+describe.each(CALLER_VERBS.filter((verb) => verb.callerFlag !== undefined))(
+  'orchestration $command run by a /clear-ed chat',
+  (verb) => {
+    beforeEach(asSessionWithInheritedPane)
+
+    it('sends the address it had before the clear for the host to place, instead of refusing it', async () => {
+      // The chat's address is its lineage root's, which only the host's session records know.
+      const flags = flagMap({ ...verb.flags, [verb.callerFlag ?? 'from']: `session:${ROOT}` })
+      await invoke(verb.command, flags)
+
+      const [params] = callsTo(verb.method)
+      expect(params?.[verb.callerParam]).toBe(`session:${ROOT}`)
+      expect(params?.terminalPaneKey).toBeUndefined()
+      expect(params?.senderPaneKey).toBeUndefined()
+      expect(getTerminalHandleMock).not.toHaveBeenCalled()
+    })
+  }
+)
+
+describe.each([
+  { command: 'gate-list', method: 'gateList', callerParam: 'from' },
+  { command: 'task-list', method: 'taskList', callerParam: 'callerTerminalHandle' }
+])('orchestration $command --run run as an agent session', ({ command, method, callerParam }) => {
+  beforeEach(asSessionWithInheritedPane)
+
+  it('needs no caller, but refuses a --from naming another caller, before any request', async () => {
+    await invoke(command, flagMap({ run: 'run_1' }))
+    expect(callsTo(method)[0]).toMatchObject({ run: 'run_1' })
+    expect(callsTo(method)[0]?.[callerParam]).toBeUndefined()
+
+    callMock.mockClear()
+    await expect(
+      invoke(command, flagMap({ run: 'run_1', from: 'term_sibling' }))
+    ).rejects.toMatchObject({ code: 'consumer_fenced' })
+    expect(callMock).not.toHaveBeenCalled()
+  })
+
+  it('accepts a --from that restates the session', async () => {
+    await invoke(command, flagMap({ run: 'run_1', from: `session:${SESSION}` }))
+    expect(callsTo(method)[0]?.[callerParam]).toBeUndefined()
+  })
+
+  it.each([`session:${ROOT}`, 'session:9d4c1b2a-3e5f-4a6b-8c7d-0e1f2a3b4c5d'])(
+    'sends a session address it cannot place (%s) for the host to check, never dropping it',
+    async (declared) => {
+      // A /clear-ed chat's root is accepted by the host; anyone else is refused there, before any
+      // effect. Dropped here, a conflicting caller would pass unchecked.
+      await invoke(command, flagMap({ run: 'run_1', from: declared }))
+      expect(callsTo(method)[0]).toMatchObject({ run: 'run_1', [callerParam]: declared })
+    }
+  )
+})
+
+describe('the identity a session presents', () => {
+  it("lets a structured worker restate its own minted handle, and nobody else's", async () => {
+    setEnv({ ORCA_AGENT_SESSION_ID: SESSION, ORCA_TERMINAL_HANDLE: 'structworker_self' })
+
+    await invoke('send', flagMap({ from: 'structworker_self', to: 'run:run_1', subject: 's' }))
+    expect(callsTo('send')[0]?.from).toBeUndefined()
+
+    callMock.mockClear()
+    await expect(
+      invoke('send', flagMap({ from: 'structworker_other', to: 'run:run_1', subject: 's' }))
+    ).rejects.toMatchObject({ code: 'consumer_fenced' })
+    expect(callMock).not.toHaveBeenCalled()
+  })
+
+  it("sends a structured worker's lifecycle report as the session, not refused as identity-less", async () => {
+    setEnv({ ORCA_AGENT_SESSION_ID: SESSION })
+
+    await invoke(
+      'send',
+      flagMap({ to: 'run:run_1', subject: 'done', type: 'worker_done', outcome: 'succeeded' })
+    )
+
+    expect(callsTo('send')[0]).toMatchObject({ type: 'worker_done' })
+    expect(callsTo('send')[0]?.from).toBeUndefined()
+  })
+
+  it('never treats a session that has an id as identity-less, even beside the old marker', async () => {
+    setEnv({ ORCA_AGENT_SESSION_ID: SESSION, ORCA_STRUCTURED_SESSION: '1' })
+
+    await invoke('check', flagMap({}))
+
+    expect(callsTo('check')).toHaveLength(1)
+    expect(getTerminalHandleMock).not.toHaveBeenCalled()
+  })
+
+  it('keeps the identity-less refusal, without --from advice, for a child that has no id', async () => {
+    setEnv({ ORCA_STRUCTURED_SESSION: '1' })
+
+    await expect(invoke('reply', flagMap({ id: 'msg_1', body: 'b' }))).rejects.toMatchObject({
+      code: 'no_active_sender_terminal',
+      message: expect.not.stringContaining('Pass --from')
+    })
+    expect(getTerminalHandleMock).not.toHaveBeenCalled()
+    expect(callMock).not.toHaveBeenCalled()
+  })
+
+  it('leaves a terminal agent exactly as it was: its own handle is the caller', async () => {
+    setEnv({ ORCA_TERMINAL_HANDLE: 'term_pty', ORCA_PANE_KEY: 'tab_pty:1:2' })
+    callMock.mockImplementation(async (name: string) =>
+      name === 'terminal.resolveIdentity' ? { result: { identity: { live: true } } } : RESULT
+    )
+
+    await invoke('run-create', flagMap({ objective: 'o' }))
+    await invoke('check', flagMap({}))
+
+    expect(callsTo('runCreate')[0]?.from).toBe('term_pty')
+    expect(callsTo('check')[0]).toMatchObject({
+      terminal: 'term_pty',
+      terminalPaneKey: 'tab_pty:1:2'
+    })
+  })
+
+  it('previews a dispatch with the coordinator address the real dispatch would write', async () => {
+    const preview = async (flags: Record<string, string | true>) => {
+      callMock.mockClear()
+      await invoke('dispatch-show', flagMap({ task: 'task_1', preamble: true, ...flags }))
+      return callsTo('dispatchShow')[0]?.from
+    }
+    asSessionWithInheritedPane()
+    expect(await preview({})).toBe(`session:${SESSION}`)
+    // Not a caller flag: it names the text to preview, so it is never fenced.
+    expect(await preview({ from: 'term_sibling' })).toBe('term_sibling')
+    setEnv({ ORCA_AGENT_SESSION_ID: SESSION, ORCA_TERMINAL_HANDLE: 'structworker_self' })
+    expect(await preview({})).toBe('structworker_self')
+    expect(getTerminalHandleMock).not.toHaveBeenCalled()
+  })
+
+  it('resumes a timed-out ask as the session, without naming a terminal', async () => {
+    asSessionWithInheritedPane()
+    callMock.mockResolvedValue({ result: { ...RESULT.result, answer: null, timedOut: true } })
+    const errors = vi.mocked(console.error)
+
+    await invoke('ask', flagMap({ to: 'term_worker', question: 'q' }), false)
+
+    const advice = errors.mock.calls.map(([line]) => String(line)).join('\n')
+    expect(advice).toContain('--resume msg_1')
+    expect(advice).not.toContain('--from')
+  })
+})
+
+describe('a host refusal of the session', () => {
+  const WORKER_GONE = new RuntimeRpcFailureError({
+    id: 'rpc_1',
+    ok: false,
+    error: {
+      code: 'session_caller_not_live',
+      message: `Agent session ${SESSION} is a structured worker whose worker identity this host no longer has, so it cannot act in orchestration. No effects were applied.`,
+      data: { effectsApplied: false }
+    },
+    _meta: { runtimeId: 'runtime_1' }
+  })
+
+  it.each(['check', 'run-current', 'worker-list'])(
+    'surfaces from %s verbatim, never widened, retried or turned into a terminal guess',
+    async (command) => {
+      asSessionWithInheritedPane()
+      callMock.mockRejectedValue(WORKER_GONE)
+
+      await expect(invoke(command, flagMap({}))).rejects.toBe(WORKER_GONE)
+      expect(getTerminalHandleMock).not.toHaveBeenCalled()
+      expect(formatCliError(WORKER_GONE)).toBe(WORKER_GONE.message)
+    }
+  )
+
+  it('keeps the Orca id a provider-id refusal names, for a JSON reader to branch on', () => {
+    const providerId = new RuntimeRpcFailureError({
+      id: 'rpc_1',
+      ok: false,
+      error: {
+        code: 'session_caller_provider_id',
+        message: 'provider id',
+        data: { effectsApplied: false, orcaSessionId: SESSION }
+      },
+      _meta: { runtimeId: 'runtime_1' }
+    })
+    const printed: string[] = []
+    vi.mocked(console.log).mockImplementation((line: string) => {
+      printed.push(line)
+    })
+
+    reportCliError(providerId, true)
+
+    expect(JSON.parse(printed.join('\n'))).toMatchObject({
+      ok: false,
+      error: { code: 'session_caller_provider_id', data: { orcaSessionId: SESSION } }
+    })
+  })
+})
+
+describe('the orchestration envelope', () => {
+  it('carries the injected id beside whatever terminal evidence the process also has', () => {
+    const envelope = createOrchestrationCompatibilityEnvelope({
+      ORCA_AGENT_SESSION_ID: ` ${SESSION} `,
+      ORCA_TERMINAL_HANDLE: 'term_inherited_pane'
+    })
+
+    expect(envelope.orchestrationCompatibilityEvidence).toEqual({
+      terminalHandle: 'term_inherited_pane',
+      agentSessionId: SESSION
+    })
+  })
+
+  it('binds whichever current Orca CLI the agent reached, not only the one the session names', () => {
+    // A login shell can put another install's `orca` first, and the packaged Windows launcher
+    // rewrites ORCA_CLI_COMMAND in its own process. Neither matters: the id rides the envelope
+    // and the pinned instance is the one dialed.
+    vi.stubEnv('ORCA_USER_DATA_PATH', '/data/session-orca')
+    try {
+      const envelope = createOrchestrationCompatibilityEnvelope({
+        ORCA_AGENT_SESSION_ID: SESSION,
+        ORCA_CLI_COMMAND: 'orca',
+        ORCA_WINDOWS_PACKAGED_CLI_LAUNCHER: '1',
+        ORCA_USER_DATA_PATH: '/data/session-orca'
+      })
+
+      expect(envelope.orchestrationCompatibilityEvidence).toEqual({ agentSessionId: SESSION })
+      expect(getDefaultUserDataPath('linux', '/home/u')).toBe('/data/session-orca')
+    } finally {
+      vi.unstubAllEnvs()
+    }
+  })
+
+  it('claims no session without an injected id', () => {
+    expect(
+      createOrchestrationCompatibilityEnvelope({ ORCA_AGENT_SESSION_ID: '  ' })
+        .orchestrationCompatibilityEvidence
+    ).toBeUndefined()
+  })
+
+  it('keeps a WSL stamp beside the id, so the host can refuse the cross-host claim', () => {
+    const envelope = createOrchestrationCompatibilityEnvelope({
+      ORCA_AGENT_SESSION_ID: SESSION,
+      ORCA_ORCHESTRATION_COMPATIBILITY_HOST_KIND: 'wsl',
+      ORCA_ORCHESTRATION_COMPATIBILITY_HOST_ID: 'local',
+      ORCA_ORCHESTRATION_COMPATIBILITY_HOST_INCARNATION: 'Ubuntu'
+    })
+
+    expect(envelope.orchestrationCompatibilityEvidence).toEqual({
+      agentSessionId: SESSION,
+      host: { kind: 'wsl', hostId: 'local', distro: 'Ubuntu' }
+    })
+  })
+})
+
+describe('which flag names the caller, declared on every spec', () => {
+  const ORCHESTRATION_SPECS = COMMAND_SPECS.filter((spec) => spec.path[0] === 'orchestration')
+
+  it('classifies every --from and --terminal an orchestration verb accepts', () => {
+    // A new verb cannot take either flag without saying whether it names the caller, so the entry
+    // check covers it by construction instead of each handler remembering to refuse.
+    const unclassified = ORCHESTRATION_SPECS.flatMap((spec) =>
+      (['from', 'terminal'] as const)
+        .filter((flag) => spec.allowedFlags.includes(flag) && !spec.identityFlagRoles?.[flag])
+        .map((flag) => `${spec.path.join(' ')} --${flag}`)
+    )
+    expect(unclassified).toEqual([])
+  })
+
+  const callerFlagVerbs = ORCHESTRATION_SPECS.flatMap((spec) =>
+    (['from', 'terminal'] as const)
+      .filter((flag) => spec.identityFlagRoles?.[flag] === 'caller')
+      .map((flag) => ({ command: spec.path[1] ?? '', flag }))
+  )
+
+  it('covers the verbs whose requests name a caller', () => {
+    expect(callerFlagVerbs.length).toBeGreaterThanOrEqual(CALLER_VERBS.length)
+  })
+
+  it.each(callerFlagVerbs)(
+    '$command refuses --$flag naming another caller, before any request',
+    async ({ command, flag }) => {
+      asSessionWithInheritedPane()
+      await expect(
+        invoke(command, flagMap({ ...EVERY_REQUIRED_FLAG, [flag]: 'term_sibling' }))
+      ).rejects.toMatchObject({ code: 'consumer_fenced' })
+      expect(callMock).not.toHaveBeenCalled()
+      expect(getTerminalHandleMock).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(
+    ORCHESTRATION_SPECS.flatMap((spec) =>
+      (['from', 'terminal'] as const)
+        .filter((flag) => spec.identityFlagRoles?.[flag] === 'target')
+        .map((flag) => ({ command: spec.path[1] ?? '', flag }))
+    )
+  )('$command passes a --$flag target through unfenced', async ({ command, flag }) => {
+    asSessionWithInheritedPane()
+    await invoke(command, flagMap({ ...EVERY_REQUIRED_FLAG, [flag]: 'term_sibling' })).catch(
+      (error: unknown) => {
+        expect(error).not.toMatchObject({ code: 'consumer_fenced' })
+      }
+    )
+    expect(callMock.mock.calls.flatMap(([, params]) => Object.values(params ?? {}))).toContain(
+      'term_sibling'
+    )
+  })
+})
+
+describe('every orchestration verb, enumerated', () => {
+  /** Runs every verb once; returns the ones that guessed an implicit terminal. */
+  async function verbsThatGuess(): Promise<string[]> {
+    const guessed: string[] = []
+    for (const command of Object.keys(ORCHESTRATION_HANDLERS)) {
+      const verb = command.replace('orchestration ', '')
+      getTerminalHandleMock.mockClear()
+      callMock.mockClear()
+      await invoke(verb, flagMap(EVERY_REQUIRED_FLAG)).catch(() => undefined)
+      if (getTerminalHandleMock.mock.calls.length > 0) {
+        guessed.push(verb)
+      }
+    }
+    return guessed.sort()
+  }
+
+  it('guesses a terminal for no verb when the session id is present', async () => {
+    // Positive control first: with no identity at all the same harness sees the guess, so an empty
+    // result below is about the id, not a harness that cannot observe a guess.
+    setEnv({})
+    const population = await verbsThatGuess()
+    expect(population).toEqual([
+      'ask',
+      'check',
+      'dispatch',
+      'dispatch-show',
+      'gate-create',
+      'gate-list',
+      'gate-resolve',
+      'reply',
+      'run-create',
+      'run-current',
+      'run-use',
+      'send',
+      'task-create',
+      'task-list',
+      'task-update',
+      'worker-list',
+      'worker-start'
+    ])
+
+    asSessionWithInheritedPane()
+    expect(await verbsThatGuess()).toEqual([])
+  })
+})
diff --git a/src/cli/profile-state-location.ts b/src/cli/profile-state-location.ts
new file mode 100644
index 00000000000..1e9325872a1
--- /dev/null
+++ b/src/cli/profile-state-location.ts
@@ -0,0 +1,13 @@
+import { getActiveProfileStateLocation as resolveActiveProfileStateLocation } from '../main/persistence/profile-state/profile-state-active-location'
+import { RuntimeClientError, getDefaultUserDataPath } from './runtime-client'
+
+export function getActiveProfileStateLocation(userDataPath = getDefaultUserDataPath()) {
+  try {
+    return resolveActiveProfileStateLocation(userDataPath)
+  } catch (error) {
+    throw new RuntimeClientError(
+      'runtime_error',
+      error instanceof Error ? error.message : String(error)
+    )
+  }
+}
diff --git a/src/cli/registry-parity.test.ts b/src/cli/registry-parity.test.ts
deleted file mode 100644
index 588a4e14d08..00000000000
--- a/src/cli/registry-parity.test.ts
+++ /dev/null
@@ -1,46 +0,0 @@
-import { describe, expect, it } from 'vitest'
-
-import type { CommandSpec } from './args'
-import { HANDLER_COMMAND_KEYS } from './dispatch'
-import { findRegistryParityGaps } from './registry-parity'
-import { COMMAND_SPECS } from './specs'
-
-describe('registry parity (live tree)', () => {
-  const handlerKeys = [...HANDLER_COMMAND_KEYS]
-
-  it('has a handler for every canonical spec path', () => {
-    const { specsWithoutHandler } = findRegistryParityGaps(COMMAND_SPECS, handlerKeys)
-    expect(specsWithoutHandler).toEqual([])
-  })
-
-  it('has a spec for every handler key', () => {
-    const { handlersWithoutSpec } = findRegistryParityGaps(COMMAND_SPECS, handlerKeys)
-    expect(handlersWithoutSpec).toEqual([])
-  })
-})
-
-describe('findRegistryParityGaps (fixtures)', () => {
-  const spec = (path: string[], aliases?: string[][]): CommandSpec => ({
-    path,
-    aliases,
-    summary: 's',
-    usage: 'u',
-    allowedFlags: []
-  })
-
-  it('flags a spec with no handler', () => {
-    const gaps = findRegistryParityGaps([spec(['foo', 'bar'])], [])
-    expect(gaps.specsWithoutHandler).toEqual(['foo bar'])
-  })
-
-  it('flags a handler with no spec', () => {
-    const gaps = findRegistryParityGaps([spec(['foo', 'bar'])], ['foo bar', 'ghost cmd'])
-    expect(gaps.handlersWithoutSpec).toEqual(['ghost cmd'])
-  })
-
-  it('does not require a handler for an alias path', () => {
-    const gaps = findRegistryParityGaps([spec(['foo', 'rm'], [['foo', 'remove']])], ['foo rm'])
-    expect(gaps.specsWithoutHandler).toEqual([])
-    expect(gaps.handlersWithoutSpec).toEqual([])
-  })
-})
diff --git a/src/cli/registry-parity.ts b/src/cli/registry-parity.ts
deleted file mode 100644
index 27c0130b555..00000000000
--- a/src/cli/registry-parity.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-import type { CommandSpec } from './args'
-
-// Why: validation/help and dispatch use parallel registries that must not drift.
-
-export type RegistryParityGaps = {
-  handlersWithoutSpec: string[]
-  specsWithoutHandler: string[]
-}
-
-export function findRegistryParityGaps(
-  specs: CommandSpec[],
-  handlerKeys: Iterable<string>
-): RegistryParityGaps {
-  // Why: aliases resolve before dispatch and deliberately have no handler key.
-  const canonical = new Set(specs.map((spec) => spec.path.join(' ')))
-  const handlers = new Set(handlerKeys)
-  return {
-    handlersWithoutSpec: [...handlers].filter((key) => !canonical.has(key)),
-    specsWithoutHandler: [...canonical].filter((key) => !handlers.has(key))
-  }
-}
diff --git a/src/cli/runtime-client-deferral.test.ts b/src/cli/runtime-client-deferral.test.ts
index fdf77082729..7dc29179065 100644
--- a/src/cli/runtime-client-deferral.test.ts
+++ b/src/cli/runtime-client-deferral.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { mkdtempSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 
@@ -60,8 +60,6 @@ vi.mock('./runtime-client', () => {
 import { main } from './index'
 import * as dispatchModule from './dispatch'
 
-const CLI_DIR = __dirname
-
 describe('RuntimeClient module-graph deferral', () => {
   let logSpy: ReturnType<typeof vi.spyOn>
   let errorSpy: ReturnType<typeof vi.spyOn>
@@ -84,39 +82,6 @@ describe('RuntimeClient module-graph deferral', () => {
     process.exitCode = 0
   })
 
-  // Why: the whole point of the change. These modules load on EVERY
-  // invocation, so a value-import of the barrel from any of them drags the
-  // RuntimeClient graph (zod, ws, tweetnacl) back onto the --help path.
-  it.each([
-    'args.ts',
-    'flags.ts',
-    'dispatch.ts',
-    'format.ts',
-    'cli-error.ts',
-    'selectors.ts',
-    'execution-host-flag.ts'
-  ])('%s imports error classes from ./runtime/types, not the barrel', (file) => {
-    const source = readFileSync(join(CLI_DIR, file), 'utf8')
-    const valueImports = source
-      .split('\n')
-      .filter((line) => line.startsWith('import ') && line.includes("'./runtime-client'"))
-    for (const line of valueImports) {
-      expect(line, `${file}: "${line}" must be type-only`).toMatch(/^import type /)
-    }
-    // Why: format.ts re-exports its error formatters; the guarded import lives in cli-error.ts.
-    if (file !== 'format.ts') {
-      expect(source).toContain("} from './runtime/types'")
-    }
-  })
-
-  it('index.ts has no eager value-import of the runtime client', () => {
-    const source = readFileSync(join(CLI_DIR, 'index.ts'), 'utf8')
-    expect(source).toContain("import type { RuntimeClient } from './runtime-client'")
-    expect(source).not.toMatch(/^import \{[^}]*RuntimeClient[^}]*\} from '\.\/runtime-client'/m)
-    expect(source).toContain("await import('./runtime-client.js')")
-    expect(source).toContain("import { reportCliError } from './cli-error'")
-  })
-
   it('constructs no client for --help', async () => {
     await main(['--help'], '/tmp/repo')
     expect(constructorArgsMock).not.toHaveBeenCalled()
@@ -153,7 +118,9 @@ describe('RuntimeClient module-graph deferral', () => {
     async (_name, argv, constructs) => {
       vi.stubEnv('ORCA_PAIRING_CODE', 'pairing-code')
       vi.stubEnv('ORCA_ENVIRONMENT', 'some-environment')
-      getCliStatusMock.mockResolvedValue({ result: { runtime: { reachable: false } } })
+      getCliStatusMock.mockResolvedValue({
+        result: { runtime: { reachable: false }, app: { running: false } }
+      })
 
       await main(argv, '/tmp/repo')
 
diff --git a/src/cli/runtime/launch.ts b/src/cli/runtime/launch.ts
index a326ae333f5..ebf10c2aaa9 100644
--- a/src/cli/runtime/launch.ts
+++ b/src/cli/runtime/launch.ts
@@ -255,7 +255,7 @@ function waitForRecipeJson(child: ReturnType<typeof spawnProcess>): Promise<numb
   })
 }
 
-function getExecutableAppArgs(executable: string): string[] {
+export function getExecutableAppArgs(executable: string): string[] {
   const args = process.env.ORCA_APP_EXECUTABLE_NEEDS_APP_ROOT === '1' ? [resolveAppRoot()] : []
   if (shouldDisableExtractedAppImageSandbox(executable)) {
     args.push('--no-sandbox')
@@ -289,14 +289,14 @@ function getExecutableSpawnOptions(executable: string): Pick<SpawnOptions, 'shel
   return process.platform === 'win32' && /\.(?:cmd|bat)$/i.test(executable) ? { shell: true } : {}
 }
 
-function resolveAppRoot(): string {
+export function resolveAppRoot(): string {
   // Why: dev-mode resource resolution in the Electron child may consult
   // process.cwd(). Pin it to the app root so `orca serve` behaves the same
   // regardless of the shell directory it was launched from.
   return resolve(__dirname, '../../..')
 }
 
-function resolveForegroundOrcaExecutable(): string {
+export function resolveForegroundOrcaExecutable(): string {
   const overrideExecutable = process.env.ORCA_APP_EXECUTABLE
   if (typeof overrideExecutable === 'string' && overrideExecutable.trim().length > 0) {
     return overrideExecutable
diff --git a/src/cli/runtime/orchestration-compatibility-envelope.ts b/src/cli/runtime/orchestration-compatibility-envelope.ts
index 8172e556dc1..7d6c0dfda80 100644
--- a/src/cli/runtime/orchestration-compatibility-envelope.ts
+++ b/src/cli/runtime/orchestration-compatibility-envelope.ts
@@ -1,12 +1,17 @@
 import { randomUUID } from 'node:crypto'
+import { readInjectedAgentSessionId } from '../../shared/agent-session-caller-env'
 import { readOrchestrationCompatibilityEvidence } from '../../shared/orchestration-compatibility-evidence'
 import type { RuntimeOrchestrationEnvelope } from '../../shared/runtime-rpc-envelope'
 
 export function createOrchestrationCompatibilityEnvelope(
   env: NodeJS.ProcessEnv
 ): RuntimeOrchestrationEnvelope {
+  const evidence = readOrchestrationCompatibilityEvidence(env)
+  // Read here, from this CLI's own environment only: the SSH paths build evidence from a remote
+  // shell's environment, where a session id could never name a session on this host.
+  const agentSessionId = readInjectedAgentSessionId(env)
   return {
     compatibilityInvocationId: randomUUID(),
-    orchestrationCompatibilityEvidence: readOrchestrationCompatibilityEvidence(env)
+    orchestrationCompatibilityEvidence: agentSessionId ? { ...evidence, agentSessionId } : evidence
   }
 }
diff --git a/src/cli/runtime/profile-state-recovery-launch.test.ts b/src/cli/runtime/profile-state-recovery-launch.test.ts
new file mode 100644
index 00000000000..36ae0e7868f
--- /dev/null
+++ b/src/cli/runtime/profile-state-recovery-launch.test.ts
@@ -0,0 +1,154 @@
+import { realpathSync } from 'node:fs'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  PROFILE_STATE_RECOVERY_FLAG,
+  PROFILE_STATE_RECOVERY_RESULT_PREFIX
+} from '../../shared/profile-state-recovery-command'
+import {
+  canLaunchProfileStateRecovery,
+  launchProfileStateRecovery
+} from './profile-state-recovery-launch'
+
+const mocks = vi.hoisted(() => ({ run: vi.fn() }))
+vi.mock('../../shared/child-process/run-process', () => ({ runProcess: mocks.run }))
+vi.mock('./launch', () => ({
+  resolveForegroundOrcaExecutable: () => '/packaged/Orca',
+  resolveAppRoot: () => '/application',
+  getExecutableAppArgs: () => ['/application'],
+  stripElectronRunAsNode: (env: NodeJS.ProcessEnv) => {
+    const clean = { ...env }
+    delete clean.ELECTRON_RUN_AS_NODE
+    return clean
+  }
+}))
+
+const result = {
+  profileId: 'profile',
+  dataFile: '/root/orca-data.json',
+  databaseFile: '/root/profile-state.db',
+  exportPaths: [],
+  backups: [],
+  revision: 1,
+  quarantineDirectory: '/root/quarantine',
+  removedDatabaseFiles: [],
+  storage: 'json',
+  restoredPath: '/root/orca-data.json'
+}
+const request = { userDataPath: '.', selector: { kind: 'json', revision: 1 } } as const
+beforeEach(() => {
+  mocks.run.mockReset().mockResolvedValue({
+    code: 0,
+    signal: null,
+    timedOut: false,
+    stdout: `${PROFILE_STATE_RECOVERY_RESULT_PREFIX}${JSON.stringify({ ok: true, result })}\n`,
+    stderr: ''
+  })
+})
+afterEach(() => vi.unstubAllEnvs())
+
+describe('profile-state recovery launch', () => {
+  it('preserves direct participation only for plain Node without an explicit Electron executable', () => {
+    vi.stubEnv('ELECTRON_RUN_AS_NODE', undefined)
+    vi.stubEnv('ORCA_APP_EXECUTABLE', undefined)
+    expect(canLaunchProfileStateRecovery()).toBe(false)
+    vi.stubEnv('ELECTRON_RUN_AS_NODE', '1')
+    expect(canLaunchProfileStateRecovery()).toBe(true)
+    vi.stubEnv('ELECTRON_RUN_AS_NODE', undefined)
+    vi.stubEnv('ORCA_APP_EXECUTABLE', '/explicit/Orca')
+    expect(canLaunchProfileStateRecovery()).toBe(true)
+  })
+
+  it('uses a foreground-safe serve request and binds the canonical recovery root', async () => {
+    vi.stubEnv('ELECTRON_RUN_AS_NODE', '1')
+    vi.stubEnv('ORCA_USER_DATA_PATH', '/stale/root')
+    expect(await launchProfileStateRecovery(request)).toEqual(result)
+    expect(mocks.run).toHaveBeenCalledWith(
+      expect.objectContaining({
+        program: '/packaged/Orca',
+        args: [
+          '/application',
+          '--serve',
+          PROFILE_STATE_RECOVERY_FLAG,
+          JSON.stringify({ ...request, userDataPath: realpathSync('.') })
+        ],
+        env: expect.objectContaining({
+          ORCA_BACKGROUND_LAUNCH: '1',
+          ORCA_USER_DATA_PATH: realpathSync('.')
+        }),
+        timeoutMs: null
+      })
+    )
+    expect(mocks.run.mock.calls[0][0].env).not.toHaveProperty('ELECTRON_RUN_AS_NODE')
+  })
+
+  it('round-trips current JSON selection without requiring an invented revision', async () => {
+    const current = { ...result, revision: null }
+    mocks.run.mockResolvedValue({
+      code: 0,
+      signal: null,
+      timedOut: false,
+      stdout: `${PROFILE_STATE_RECOVERY_RESULT_PREFIX}${JSON.stringify({ ok: true, result: current })}\n`,
+      stderr: ''
+    })
+    expect(
+      await launchProfileStateRecovery({ userDataPath: '.', selector: { kind: 'current-json' } })
+    ).toEqual(current)
+    expect(mocks.run.mock.calls[0][0].args.at(-1)).toContain('"kind":"current-json"')
+  })
+
+  it('preserves a structured refusal from the lock owner', async () => {
+    mocks.run.mockResolvedValue({
+      code: 1,
+      stdout: `${PROFILE_STATE_RECOVERY_RESULT_PREFIX}${JSON.stringify({ ok: false, code: 'invalid_argument', message: 'Backup unavailable' })}`
+    })
+    await expect(launchProfileStateRecovery(request)).rejects.toMatchObject({
+      code: 'invalid_argument',
+      message: 'Backup unavailable'
+    })
+  })
+
+  it.each([
+    { code: 1 },
+    { signal: 'SIGKILL' },
+    { timedOut: true },
+    { outputTruncated: true },
+    { stdout: '' },
+    { stdout: `${PROFILE_STATE_RECOVERY_RESULT_PREFIX}{` },
+    { stdout: `${PROFILE_STATE_RECOVERY_RESULT_PREFIX}{"ok":true,"result":{}}` },
+    {
+      stdout: `${PROFILE_STATE_RECOVERY_RESULT_PREFIX}{}\n${PROFILE_STATE_RECOVERY_RESULT_PREFIX}{}`
+    }
+  ])('rejects incomplete or ambiguous child results %j', async (override) => {
+    const original = await mocks.run()
+    mocks.run.mockResolvedValue({ ...original, ...override })
+    await expect(launchProfileStateRecovery(request)).rejects.toMatchObject({
+      code: 'runtime_error'
+    })
+  })
+
+  it('propagates launch failure without retrying another recovery path', async () => {
+    mocks.run.mockRejectedValue(new Error('Executable unavailable'))
+    await expect(launchProfileStateRecovery(request)).rejects.toThrow('Executable unavailable')
+    expect(mocks.run).toHaveBeenCalledOnce()
+  })
+
+  it('retains bounded child diagnostics when recovery exits without a result', async () => {
+    mocks.run.mockResolvedValue({
+      code: null,
+      signal: 'SIGTRAP',
+      timedOut: false,
+      stdout: '',
+      stderr: `${'x'.repeat(5000)}\nsandbox unavailable\n`
+    })
+    await expect(launchProfileStateRecovery(request)).rejects.toMatchObject({
+      data: {
+        exitCode: null,
+        signal: 'SIGTRAP',
+        timedOut: false,
+        outputTruncated: false,
+        stderr: `${'x'.repeat(5000)}\nsandbox unavailable`.slice(-4096)
+      }
+    })
+    expect(mocks.run).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/cli/runtime/profile-state-recovery-launch.ts b/src/cli/runtime/profile-state-recovery-launch.ts
new file mode 100644
index 00000000000..dd0d68ff2e4
--- /dev/null
+++ b/src/cli/runtime/profile-state-recovery-launch.ts
@@ -0,0 +1,78 @@
+import { realpathSync } from 'node:fs'
+import { runProcess } from '../../shared/child-process/run-process'
+import {
+  PROFILE_STATE_RECOVERY_FLAG,
+  PROFILE_STATE_RECOVERY_RESULT_PREFIX,
+  profileStateRecoveryResponseSchema,
+  type ProfileStateRecoveryRequest,
+  type ProfileStateRollbackResult
+} from '../../shared/profile-state-recovery-command'
+import {
+  getExecutableAppArgs,
+  resolveAppRoot,
+  resolveForegroundOrcaExecutable,
+  stripElectronRunAsNode
+} from './launch'
+import { RuntimeClientError } from './types'
+
+export function canLaunchProfileStateRecovery(): boolean {
+  return process.env.ELECTRON_RUN_AS_NODE === '1' || !!process.env.ORCA_APP_EXECUTABLE?.trim()
+}
+
+export async function launchProfileStateRecovery(
+  request: ProfileStateRecoveryRequest
+): Promise<ProfileStateRollbackResult> {
+  const executable = resolveForegroundOrcaExecutable()
+  const userDataPath = realpathSync(request.userDataPath)
+  const response = await runProcess({
+    program: executable,
+    args: [
+      ...getExecutableAppArgs(executable),
+      '--serve',
+      PROFILE_STATE_RECOVERY_FLAG,
+      JSON.stringify({ ...request, userDataPath })
+    ],
+    cwd: resolveAppRoot(),
+    env: {
+      ...stripElectronRunAsNode(process.env),
+      ORCA_BACKGROUND_LAUNCH: '1',
+      ORCA_USER_DATA_PATH: userDataPath
+    },
+    // Recovery may copy large backups; the lock owner must finish or be explicitly terminated.
+    timeoutMs: null
+  })
+  const lines = response.stdout
+    .split(/\r?\n/)
+    .filter((line) => line.startsWith(PROFILE_STATE_RECOVERY_RESULT_PREFIX))
+  if (!response.outputTruncated && lines.length === 1) {
+    let parsed: unknown
+    try {
+      parsed = JSON.parse(lines[0].slice(PROFILE_STATE_RECOVERY_RESULT_PREFIX.length))
+    } catch {
+      throw new RuntimeClientError(
+        'runtime_error',
+        'Orca recovery returned an invalid response. Inspect retained recovery artifacts before retrying.'
+      )
+    }
+    const result = profileStateRecoveryResponseSchema.safeParse(parsed)
+    if (result.success) {
+      if (!result.data.ok) {
+        throw new RuntimeClientError(result.data.code, result.data.message)
+      }
+      if (response.code === 0 && !response.signal && !response.timedOut) {
+        return result.data.result
+      }
+    }
+  }
+  throw new RuntimeClientError(
+    'runtime_error',
+    'Orca recovery did not complete successfully. Inspect retained recovery artifacts before retrying.',
+    {
+      exitCode: response.code,
+      signal: response.signal,
+      timedOut: response.timedOut,
+      outputTruncated: response.outputTruncated ?? false,
+      stderr: response.stderr.trim().slice(-4096)
+    }
+  )
+}
diff --git a/src/cli/runtime/transport-framing.test.ts b/src/cli/runtime/transport-framing.test.ts
index cf3150f60c9..0f2c27b6a1b 100644
--- a/src/cli/runtime/transport-framing.test.ts
+++ b/src/cli/runtime/transport-framing.test.ts
@@ -66,14 +66,16 @@ describe('CLI runtime response framing', () => {
     const pending = sendRequest(metadata, 'terminal.read', {}, 30000)
     const originalIndexOf = String.prototype.indexOf
     let searchedCharacters = 0
-    const search = vi
-      .spyOn(String.prototype, 'indexOf')
-      .mockImplementation(function (this: string, value, position) {
-        if (value === '\n') {
-          searchedCharacters += this.length - (position ?? 0)
-        }
-        return originalIndexOf.call(this, value, position)
-      })
+    const search = vi.spyOn(String.prototype, 'indexOf').mockImplementation(function (
+      this: string,
+      value,
+      position
+    ) {
+      if (value === '\n') {
+        searchedCharacters += this.length - (position ?? 0)
+      }
+      return originalIndexOf.call(this, value, position)
+    })
     try {
       for (let offset = 0; offset < encoded.length; offset += 256) {
         socket.emit('data', encoded.slice(offset, offset + 256))
diff --git a/src/cli/search-command-arguments.test.ts b/src/cli/search-command-arguments.test.ts
index be9195a1fab..27b06286f52 100644
--- a/src/cli/search-command-arguments.test.ts
+++ b/src/cli/search-command-arguments.test.ts
@@ -126,7 +126,7 @@ describe('orca search argument parsing', () => {
 
   it('rejects an unknown --agent and names the known ones', () => {
     expect(() => parseSearch(['search', 'q', '--agent', 'claude', '--agent', 'bogus'])).toThrow(
-      /Unknown --agent "bogus"\. Known agents: claude, codex, /
+      /Unknown --agent "bogus"\. Known agents: claude, codebuddy, codex, /
     )
   })
 
diff --git a/src/cli/serve-electron-flag-parity.test.ts b/src/cli/serve-electron-flag-parity.test.ts
index a4964e1a824..ef0c040524b 100644
--- a/src/cli/serve-electron-flag-parity.test.ts
+++ b/src/cli/serve-electron-flag-parity.test.ts
@@ -1,8 +1,6 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
 import { describe, expect, it } from 'vitest'
 import { normalizeServeModeArgv } from '../main/startup/serve-mode-argv'
-import { BOOLEAN_FLAGS, GLOBAL_FLAGS } from './args'
+import { BOOLEAN_FLAGS } from './args'
 import { SERVE_COMMAND_SPECS } from './specs/serve'
 
 // Why this test lives under src/cli: the Electron rewrite duplicates the CLI's serve flag list because
@@ -51,31 +49,4 @@ describe('serve flag parity between the CLI spec and the Electron argv rewrite',
     // Idempotent: `orca serve` spawns the app already in this shape, and the rewrite runs over it too.
     expect(normalizeServeModeArgv(expected)).toEqual(expected)
   })
-
-  it('emits the same --serve-* names the CLI spawns with and the main process reads', () => {
-    // Why source text: serveOrcaApp spawns a real process; keeping both names visible here makes
-    // the rewrite/parser contract fail loudly if either side drifts.
-    const launchSource = readFileSync(join(process.cwd(), 'src/cli/runtime/launch.ts'), 'utf8')
-    const serveOptionsSource = readFileSync(
-      join(process.cwd(), 'src/main/startup/serve-options.ts'),
-      'utf8'
-    )
-    const start = serveOptionsSource.indexOf('export function getServeOptions(')
-    // Why bound the anchor: an unresolved indexOf slices to EOF and passes vacuously.
-    expect(start).toBeGreaterThanOrEqual(0)
-    const end = serveOptionsSource.indexOf('\n}', start)
-    expect(end).toBeGreaterThan(start)
-    const getServeOptionsBody = serveOptionsSource.slice(start, end)
-
-    for (const flag of translatedFlags) {
-      expect(launchSource).toContain(`'--serve-${flag}'`)
-      expect(getServeOptionsBody).toContain(`'--serve-${flag}'`)
-    }
-  })
-
-  it('keeps the untranslated allowlist tied to real global flags', () => {
-    for (const flag of UNTRANSLATED_GLOBAL_FLAGS) {
-      expect(GLOBAL_FLAGS).toContain(flag)
-    }
-  })
 })
diff --git a/src/cli/session-caller-flags.ts b/src/cli/session-caller-flags.ts
new file mode 100644
index 00000000000..80078ffda7b
--- /dev/null
+++ b/src/cli/session-caller-flags.ts
@@ -0,0 +1,73 @@
+/**
+ * An agent session is its own orchestration caller. A flag that names the caller may restate that
+ * session, but one naming anyone else is refused before any effect — never dropped, never allowed
+ * to win. Against a host that predates session callers this is the only guard: such a host
+ * would honor the flag as the caller, which is how a chat consumed a sibling's mail (#21097).
+ *
+ * Whether `--from`/`--terminal` names the caller or a target is declared on the command's spec
+ * (`identityFlagRoles`) and checked once, here, at the CLI entry, so a handler cannot forget it.
+ *
+ * A `/clear`ed chat keeps its lineage root's address, which only the host's records can place, so
+ * a session address that is not this session's own spelling goes to the host's canonical-id check.
+ */
+
+import type { CommandSpec, IdentityFlag } from './command-spec'
+import { RuntimeClientError } from './runtime/types'
+import {
+  injectedSessionAddress,
+  readInjectedAgentSessionId
+} from '../shared/agent-session-caller-env'
+import { ORCA_SESSION_ADDRESS_PREFIX } from '../shared/orca-session-address-prefix'
+
+export function refuseConflictingSessionCallerFlags(
+  spec: CommandSpec | undefined,
+  flags: ReadonlyMap<string, string | boolean>,
+  env: NodeJS.ProcessEnv = process.env
+): void {
+  const sessionId = readInjectedAgentSessionId(env)
+  if (!sessionId || !spec?.identityFlagRoles) {
+    return
+  }
+  for (const flagName of IDENTITY_FLAGS) {
+    const declared = flags.get(flagName)
+    if (
+      spec.identityFlagRoles[flagName] === 'caller' &&
+      typeof declared === 'string' &&
+      !namesInjectedSession(declared, sessionId, env) &&
+      !sessionAddressForHost(declared, sessionId, env)
+    ) {
+      throw new RuntimeClientError(
+        'consumer_fenced',
+        `This command runs as agent session ${sessionId}, so --${flagName} ${declared} would act as a ` +
+          `different caller. Drop --${flagName}: this session's orchestration commands already act ` +
+          `as this session. No request was sent.`
+      )
+    }
+  }
+}
+
+const IDENTITY_FLAGS: readonly IdentityFlag[] = ['from', 'terminal']
+
+/**
+ * The session's own spellings, plus the handle a structured worker session was minted. Plain
+ * strings: this runs at the CLI entry for every command, before the address codec's module graph.
+ */
+function namesInjectedSession(value: string, sessionId: string, env: NodeJS.ProcessEnv): boolean {
+  return (
+    value === sessionId ||
+    value === `${ORCA_SESSION_ADDRESS_PREFIX}${sessionId}` ||
+    value === injectedSessionAddress(env)
+  )
+}
+
+/** A session address only the host can place: this session's `/clear` root, or someone else. */
+export function sessionAddressForHost(
+  value: string,
+  sessionId: string,
+  env: NodeJS.ProcessEnv = process.env
+): string | undefined {
+  return value.startsWith(ORCA_SESSION_ADDRESS_PREFIX) &&
+    !namesInjectedSession(value, sessionId, env)
+    ? value
+    : undefined
+}
diff --git a/src/cli/specs/index.ts b/src/cli/specs/index.ts
index ee9db22dc1a..b817749f425 100644
--- a/src/cli/specs/index.ts
+++ b/src/cli/specs/index.ts
@@ -18,6 +18,7 @@ import { VM_COMMAND_SPECS } from './vm'
 import { SKILL_COMMAND_SPECS } from './skills'
 import { ARTIFACT_COMMAND_SPECS } from './artifacts'
 import { SEARCH_COMMAND_SPECS } from './search'
+import { PROFILE_STATE_COMMAND_SPECS } from './profile-state'
 
 export const COMMAND_SPECS: CommandSpec[] = [
   ...CORE_COMMAND_SPECS,
@@ -38,5 +39,6 @@ export const COMMAND_SPECS: CommandSpec[] = [
   ...VM_COMMAND_SPECS,
   ...EMULATOR_COMMAND_SPECS,
   ...SKILL_COMMAND_SPECS,
-  ...SEARCH_COMMAND_SPECS
+  ...SEARCH_COMMAND_SPECS,
+  ...PROFILE_STATE_COMMAND_SPECS
 ]
diff --git a/src/cli/specs/orchestration-worker-specs.ts b/src/cli/specs/orchestration-worker-specs.ts
index 1448667e54a..04423ffc6fb 100644
--- a/src/cli/specs/orchestration-worker-specs.ts
+++ b/src/cli/specs/orchestration-worker-specs.ts
@@ -31,6 +31,7 @@ export const ORCHESTRATION_WORKER_COMMAND_SPECS: CommandSpec[] = [
       'from',
       'retry-request'
     ],
+    identityFlagRoles: { from: 'caller', terminal: 'target' },
     notes: [
       'Current and existing worktrees never rerun setup; a fresh agent terminal is created unless --terminal is explicit.',
       'When reusing --terminal, pass --worktree for that terminal; current means the coordinator worktree.',
diff --git a/src/cli/specs/orchestration.ts b/src/cli/specs/orchestration.ts
index 458afa2e525..8c4418f38ba 100644
--- a/src/cli/specs/orchestration.ts
+++ b/src/cli/specs/orchestration.ts
@@ -9,6 +9,7 @@ export const ORCHESTRATION_COMMAND_SPECS: CommandSpec[] = [
     usage:
       'orca orchestration run-create --objective <text> [--from <handle>] [--retry-request <id>] [--json]',
     allowedFlags: [...GLOBAL_FLAGS, 'objective', 'from', 'retry-request'],
+    identityFlagRoles: { from: 'caller' },
     notes: [
       'A Run is a namespace and home inbox. It never schedules or places workers.',
       '--retry-request is only for exact recovery after an unknown mutation result.'
@@ -20,6 +21,7 @@ export const ORCHESTRATION_COMMAND_SPECS: CommandSpec[] = [
     usage:
       'orca orchestration run-use --id <run_id> [--from <handle>] [--takeover-legacy] [--retry-request <id>] [--json]',
     allowedFlags: [...GLOBAL_FLAGS, 'id', 'from', 'takeover-legacy', 'retry-request'],
+    identityFlagRoles: { from: 'caller' },
     notes: [
       '--takeover-legacy must run in the live coordinator agent terminal it binds; it preserves existing worker assignments.'
     ]
@@ -28,7 +30,8 @@ export const ORCHESTRATION_COMMAND_SPECS: CommandSpec[] = [
     path: ['orchestration', 'run-current'],
     summary: 'Show the Run bound to this coordinator terminal',
     usage: 'orca orchestration run-current [--from <handle>] [--json]',
-    allowedFlags: [...GLOBAL_FLAGS, 'from']
+    allowedFlags: [...GLOBAL_FLAGS, 'from'],
+    identityFlagRoles: { from: 'caller' }
   },
   {
     path: ['orchestration', 'run-list'],
@@ -67,6 +70,7 @@ export const ORCHESTRATION_COMMAND_SPECS: CommandSpec[] = [
       'report-path',
       'phase'
     ],
+    identityFlagRoles: { from: 'caller' },
     notes: [
       'Valid --type values: status, dispatch, worker_done, merge_ready, escalation, handoff, decision_gate, question, heartbeat.',
       'To answer a worker question, use orchestration reply --id <msg_id> --body <text> with the same Orca CLI executable.',
@@ -109,6 +113,7 @@ export const ORCHESTRATION_COMMAND_SPECS: CommandSpec[] = [
       'timeout-ms',
       'retry-request'
     ],
+    identityFlagRoles: { terminal: 'caller' },
     notes: [
       'On Windows PowerShell, quote comma-separated type filters, e.g. --types "worker_done,escalation".',
       '--types is the wake condition for --wait; a returned Delivery is always the whole FIFO batch, so it is never filtered by type. Without --wait it has no effect on consuming checks. Only --peek and --all filter their rows.',
@@ -121,13 +126,15 @@ export const ORCHESTRATION_COMMAND_SPECS: CommandSpec[] = [
     summary: 'Reply to a message',
     usage:
       'orca orchestration reply --id <msg_id> --body <text> [--run <run_id>] [--from <handle>] [--retry-request <id>] [--json]',
-    allowedFlags: [...GLOBAL_FLAGS, 'id', 'body', 'run', 'from', 'retry-request']
+    allowedFlags: [...GLOBAL_FLAGS, 'id', 'body', 'run', 'from', 'retry-request'],
+    identityFlagRoles: { from: 'caller' }
   },
   {
     path: ['orchestration', 'inbox'],
     summary: 'Show messages across (or for) recipients',
     usage: 'orca orchestration inbox [--limit <n>] [--terminal <handle>] [--full] [--json]',
-    allowedFlags: [...GLOBAL_FLAGS, 'limit', 'terminal', 'full']
+    allowedFlags: [...GLOBAL_FLAGS, 'limit', 'terminal', 'full'],
+    identityFlagRoles: { terminal: 'target' }
   },
   {
     path: ['orchestration', 'task-create'],
@@ -144,7 +151,8 @@ export const ORCHESTRATION_COMMAND_SPECS: CommandSpec[] = [
       'run',
       'from',
       'retry-request'
-    ]
+    ],
+    identityFlagRoles: { from: 'caller' }
   },
   {
     path: ['orchestration', 'task-list'],
@@ -152,6 +160,7 @@ export const ORCHESTRATION_COMMAND_SPECS: CommandSpec[] = [
     usage:
       'orca orchestration task-list [--status <status>] [--ready] [--brief] [--run <run_id>] [--from <handle>] [--json]',
     allowedFlags: [...GLOBAL_FLAGS, 'status', 'ready', 'brief', 'run', 'from'],
+    identityFlagRoles: { from: 'caller' },
     notes: ['--brief collapses whitespace and caps each spec at 160 characters.']
   },
   {
@@ -160,6 +169,7 @@ export const ORCHESTRATION_COMMAND_SPECS: CommandSpec[] = [
     usage:
       'orca orchestration task-update --id <task_id> --status <status> [--result <json>] [--run <run_id>] [--from <handle>] [--retry-request <id>] [--json]',
     allowedFlags: [...GLOBAL_FLAGS, 'id', 'status', 'result', 'run', 'from', 'retry-request'],
+    identityFlagRoles: { from: 'caller' },
     notes: ['Valid --status values: pending, ready, dispatched, completed, failed, blocked.']
   },
   ...ORCHESTRATION_WORKER_COMMAND_SPECS,
@@ -178,7 +188,8 @@ export const ORCHESTRATION_COMMAND_SPECS: CommandSpec[] = [
       'dry-run',
       'return-preamble',
       'retry-request'
-    ]
+    ],
+    identityFlagRoles: { from: 'caller' }
   },
   {
     path: ['orchestration', 'request-show'],
@@ -196,7 +207,8 @@ export const ORCHESTRATION_COMMAND_SPECS: CommandSpec[] = [
     summary: 'Show dispatch context for a task',
     usage:
       'orca orchestration dispatch-show --task <task_id> [--preamble] [--from <handle>] [--json]',
-    allowedFlags: [...GLOBAL_FLAGS, 'task', 'preamble', 'from']
+    allowedFlags: [...GLOBAL_FLAGS, 'task', 'preamble', 'from'],
+    identityFlagRoles: { from: 'target' }
   },
   {
     path: ['orchestration', 'ask'],
@@ -215,6 +227,7 @@ export const ORCHESTRATION_COMMAND_SPECS: CommandSpec[] = [
       'from',
       'retry-request'
     ],
+    identityFlagRoles: { from: 'caller' },
     notes: [
       'From an active Dispatch, a new question defaults to its owning Run mailbox.',
       'Timeout leaves the question pending; resume with the original message ID.'
@@ -234,6 +247,7 @@ export const ORCHESTRATION_COMMAND_SPECS: CommandSpec[] = [
       'max-concurrent',
       'worktree'
     ],
+    identityFlagRoles: { from: 'caller' },
     notes: [
       'This command performs no effects and returns the exact `skills get orchestration --full` recovery action.',
       'Use the lightweight Run, Task, and worker-start primitives described by the current skill.'
@@ -254,14 +268,16 @@ export const ORCHESTRATION_COMMAND_SPECS: CommandSpec[] = [
     summary: 'Create a decision gate blocking a task',
     usage:
       'orca orchestration gate-create --task <task_id> --question <text> [--options <json_array>] [--from <handle>] [--retry-request <id>] [--json]',
-    allowedFlags: [...GLOBAL_FLAGS, 'task', 'question', 'options', 'from', 'retry-request']
+    allowedFlags: [...GLOBAL_FLAGS, 'task', 'question', 'options', 'from', 'retry-request'],
+    identityFlagRoles: { from: 'caller' }
   },
   {
     path: ['orchestration', 'gate-resolve'],
     summary: 'Resolve a pending decision gate',
     usage:
       'orca orchestration gate-resolve --id <gate_id> --resolution <text> [--from <handle>] [--retry-request <id>] [--json]',
-    allowedFlags: [...GLOBAL_FLAGS, 'id', 'resolution', 'from', 'retry-request']
+    allowedFlags: [...GLOBAL_FLAGS, 'id', 'resolution', 'from', 'retry-request'],
+    identityFlagRoles: { from: 'caller' }
   },
   {
     path: ['orchestration', 'gate-list'],
@@ -269,6 +285,7 @@ export const ORCHESTRATION_COMMAND_SPECS: CommandSpec[] = [
     usage:
       'orca orchestration gate-list [--task <task_id>] [--status <status>] [--run <run_id>] [--from <handle>] [--json]',
     allowedFlags: [...GLOBAL_FLAGS, 'task', 'status', 'run', 'from'],
+    identityFlagRoles: { from: 'caller' },
     notes: ['--run inspects a named Run without binding; otherwise gates are scoped to the caller.']
   },
   {
diff --git a/src/cli/specs/profile-state.test.ts b/src/cli/specs/profile-state.test.ts
new file mode 100644
index 00000000000..53798b47de3
--- /dev/null
+++ b/src/cli/specs/profile-state.test.ts
@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest'
+import { parseArgs, validateCommandAndFlags } from '../args'
+import { PROFILE_STATE_COMMAND_SPECS } from './profile-state'
+
+describe('profile state rollback discovery', () => {
+  it.each([
+    { argv: ['profile', 'state', 'rollback', '--current-json'] },
+    { argv: ['--current-json', 'profile', 'state', 'rollback'] },
+    { argv: ['profile', '--current-json', 'state', 'rollback'] }
+  ])('parses the current JSON selector as a boolean: $argv', ({ argv }) => {
+    const parsed = parseArgs(argv)
+    expect(parsed.commandPath).toEqual(['profile', 'state', 'rollback'])
+    expect(parsed.flags.get('current-json')).toBe(true)
+    expect(() => validateCommandAndFlags(PROFILE_STATE_COMMAND_SPECS, parsed)).not.toThrow()
+  })
+
+  it('parses the current SQLite selector as a boolean', () => {
+    const parsed = parseArgs(['profile', 'state', 'rollback', '--current-sqlite'])
+    expect(parsed.flags.get('current-sqlite')).toBe(true)
+    expect(() => validateCommandAndFlags(PROFILE_STATE_COMMAND_SPECS, parsed)).not.toThrow()
+  })
+
+  it('explains that adoption selects one full state and preserves both copies', () => {
+    const spec = PROFILE_STATE_COMMAND_SPECS.find((item) => item.path.at(-1) === 'rollback')
+    expect(spec?.usage).toContain('--current-json')
+    expect(spec?.notes?.join('\n')).toContain('without merging; both copies are archived')
+    expect(spec?.examples).toContain('orca profile state rollback --current-json')
+  })
+})
diff --git a/src/cli/specs/profile-state.ts b/src/cli/specs/profile-state.ts
new file mode 100644
index 00000000000..89c9ed13315
--- /dev/null
+++ b/src/cli/specs/profile-state.ts
@@ -0,0 +1,33 @@
+import type { CommandSpec } from '../args'
+import { GLOBAL_FLAGS } from '../args'
+
+export const PROFILE_STATE_COMMAND_SPECS: CommandSpec[] = [
+  {
+    path: ['profile', 'state', 'exports'],
+    summary: 'List retained SQLite backups and JSON exports for profile-state recovery',
+    usage: 'orca profile state exports [--json]',
+    allowedFlags: [...GLOBAL_FLAGS]
+  },
+  {
+    path: ['profile', 'state', 'rollback'],
+    destructive: true,
+    summary:
+      'Restore a SQLite backup or retained JSON export, or keep the current JSON or SQLite profile',
+    usage:
+      'orca profile state rollback (--backup <id> | --revision <revision> | --current-json | --current-sqlite) [--json]',
+    allowedFlags: [...GLOBAL_FLAGS, 'revision', 'backup', 'current-json', 'current-sqlite'],
+    notes: [
+      'Orca must be stopped. Recovery validates the selected artifact and archives the current database family, JSON, and retained recovery artifacts before replacing state.',
+      '--backup restores SQLite authority; --revision restores a JSON export for an older compatible runtime.',
+      '--current-json keeps the current orca-data.json, including edits from an older build. It replaces SQLite state without merging; both copies are archived. The next SQLite-capable start imports the selected JSON.',
+      '--current-sqlite keeps the current SQLite state and discards JSON edits from an older build. The JSON is archived, then rewritten from SQLite.'
+    ],
+    examples: [
+      'orca profile state exports',
+      'orca profile state rollback --backup <id>',
+      'orca profile state rollback --revision 1',
+      'orca profile state rollback --current-json',
+      'orca profile state rollback --current-sqlite'
+    ]
+  }
+]
diff --git a/src/cli/terminal-format.test.ts b/src/cli/terminal-format.test.ts
index 294fbc09cee..ee0a985441e 100644
--- a/src/cli/terminal-format.test.ts
+++ b/src/cli/terminal-format.test.ts
@@ -57,6 +57,22 @@ describe('formatTerminalClose', () => {
     )
   })
 
+  it('promises the reconnect replay only when the host recorded the kill for it', () => {
+    const close = {
+      handle: 'term_remote',
+      tabId: 'tab-1',
+      ptyKilled: false,
+      ptyStopVerdict: 'unverifiable' as const,
+      ptyStopReason: 'SSH connection lost, reconnecting...'
+    }
+    expect(formatTerminalClose({ close: { ...close, pendingKillRecorded: true } })).toBe(
+      'Closed terminal term_remote. The PTY was not confirmed stopped: SSH connection lost, reconnecting... The kill retries when the host reconnects.'
+    )
+    expect(formatTerminalClose({ close })).toBe(
+      'Closed terminal term_remote. The PTY was not confirmed stopped: SSH connection lost, reconnecting...'
+    )
+  })
+
   it('names a PTY known to be live', () => {
     expect(
       formatTerminalClose({
diff --git a/src/cli/terminal-format.ts b/src/cli/terminal-format.ts
index 97e117b2229..5a67a6413aa 100644
--- a/src/cli/terminal-format.ts
+++ b/src/cli/terminal-format.ts
@@ -1,4 +1,4 @@
-import { PTY_LIVE_NOTE, describeUnconfirmedStop } from '../shared/pty-liveness-verdict'
+import { PTY_LIVE_NOTE, describeUnconfirmedCloseStop } from '../shared/pty-liveness-verdict'
 import { describeTerminalWaitBlockedReason } from '../shared/terminal-wait-blocked-reason-legacy-alias'
 import { formatListingHostScope, type WithAnnotatedHostScope } from './omitted-host-scope-selectors'
 import type {
@@ -254,7 +254,7 @@ function describePtyStop(close: RuntimeTerminalClose): string {
     return ` ${PTY_LIVE_NOTE}`
   }
   if (close.ptyStopVerdict === 'unverifiable') {
-    return ` ${describeUnconfirmedStop(close.ptyStopReason ?? 'its host could not be reached')}`
+    return ` ${describeUnconfirmedCloseStop(close)}`
   }
   return ''
 }
diff --git a/src/main/__fixtures__/shell-wrapper-snapshots/daemon-bash-rcfile.txt b/src/main/__fixtures__/shell-wrapper-snapshots/daemon-bash-rcfile.txt
index 536831230b4..bfbd9b420e2 100644
--- a/src/main/__fixtures__/shell-wrapper-snapshots/daemon-bash-rcfile.txt
+++ b/src/main/__fixtures__/shell-wrapper-snapshots/daemon-bash-rcfile.txt
@@ -104,11 +104,22 @@ fi
 # Why || : twice — zsh alone aborts inside the substitution, but every shell's
 # assignment adopts its exit status, so an absent codex trips set -e in bash too.
 __orca_codex_binary="$(unalias codex 2>/dev/null || :; command -v codex 2>/dev/null || :)"
-if [[ -n "${ORCA_CODEX_LAUNCH_PREFLIGHT:-}" && -x "${ORCA_CODEX_LAUNCH_PREFLIGHT}" && -n "${__orca_codex_binary:-}" && -x "${__orca_codex_binary}" ]]; then
+if [[ -n "${__orca_codex_binary:-}" && -x "${__orca_codex_binary}" ]]; then
   # Why the function reserved word: it suppresses alias expansion of the name,
   # which otherwise rewrites this header at parse time and aborts the whole file.
   function codex {
-    "${ORCA_CODEX_LAUNCH_PREFLIGHT}" agent hooks prepare-codex >/dev/null 2>&1 || :
+    # Why local: zsh's warn_create_global warns for each global a function creates.
+    local __orca_codex_arg __orca_codex_isolate="${ORCA_CODEX_ISOLATE:-1}"
+    if [[ -n "${ORCA_CODEX_LAUNCH_PREFLIGHT:-}" && -x "${ORCA_CODEX_LAUNCH_PREFLIGHT}" ]]; then
+      "${ORCA_CODEX_LAUNCH_PREFLIGHT}" agent hooks prepare-codex >/dev/null 2>&1 || :
+    fi
+    for __orca_codex_arg in "$@"; do
+      case "$__orca_codex_arg" in agents|queue|--no-daemon|--remote|--remote=*) __orca_codex_isolate=0 ;; esac
+    done
+    # Why probe every launch: a cached answer goes stale across an upgrade, and 0.155 and older exit 2 on the flag.
+    if [[ "$__orca_codex_isolate" != 0 ]]; then
+      case "$(command codex --help 2>/dev/null </dev/null)" in *--no-daemon*) set -- --no-daemon "$@" ;; esac
+    fi
     command codex "$@"
   }
 fi
diff --git a/src/main/__fixtures__/shell-wrapper-snapshots/daemon-fish-init.txt b/src/main/__fixtures__/shell-wrapper-snapshots/daemon-fish-init.txt
index df2d2c3cc0e..ff24125e2c0 100644
--- a/src/main/__fixtures__/shell-wrapper-snapshots/daemon-fish-init.txt
+++ b/src/main/__fixtures__/shell-wrapper-snapshots/daemon-fish-init.txt
@@ -6,9 +6,14 @@ end
 # absent, leaving "test = file" — fish then errors instead of failing closed.
 # Quoting in place is not the fix; fish never substitutes inside double quotes.
 set -l __orca_codex_type (type -t codex 2>/dev/null)
-if test -x "$ORCA_CODEX_LAUNCH_PREFLIGHT"; and test "$__orca_codex_type" = file
+if test "$__orca_codex_type" = file
   function codex
-    command "$ORCA_CODEX_LAUNCH_PREFLIGHT" agent hooks prepare-codex >/dev/null 2>&1; or true
+    if test -x "$ORCA_CODEX_LAUNCH_PREFLIGHT"
+      command "$ORCA_CODEX_LAUNCH_PREFLIGHT" agent hooks prepare-codex >/dev/null 2>&1; or true
+    end
+    if test "$ORCA_CODEX_ISOLATE" != 0; and not string match -qr -- '^(agents|queue|--no-daemon|--remote|--remote=.*)$' $argv; and command codex --help 2>/dev/null </dev/null | string match -q -- '*--no-daemon*'
+      set argv --no-daemon $argv
+    end
     command codex $argv
   end
 end
diff --git a/src/main/__fixtures__/shell-wrapper-snapshots/daemon-zsh-zshenv.txt b/src/main/__fixtures__/shell-wrapper-snapshots/daemon-zsh-zshenv.txt
index f86bd569381..12d37e0f724 100644
--- a/src/main/__fixtures__/shell-wrapper-snapshots/daemon-zsh-zshenv.txt
+++ b/src/main/__fixtures__/shell-wrapper-snapshots/daemon-zsh-zshenv.txt
@@ -136,22 +136,33 @@ __orca_deferred_init() {
 
     # Why: Codex must keep using Orca's runtime CODEX_HOME after rc files.
     [[ -n "${ORCA_CODEX_HOME:-}" ]] && export CODEX_HOME="${ORCA_CODEX_HOME}"
-    # Why: a typed alias expands inside the shell, after pane launch prep.
-    # Why unalias inside the substitution: an alias named codex makes command -v
-    # report the alias text, and the subshell leaves the user's own alias intact.
-    # Why || : twice — zsh alone aborts inside the substitution, but every shell's
-    # assignment adopts its exit status, so an absent codex trips set -e in bash too.
-    __orca_codex_binary="$(unalias codex 2>/dev/null || :; command -v codex 2>/dev/null || :)"
-    if [[ -n "${ORCA_CODEX_LAUNCH_PREFLIGHT:-}" && -x "${ORCA_CODEX_LAUNCH_PREFLIGHT}" && -n "${__orca_codex_binary:-}" && -x "${__orca_codex_binary}" ]]; then
-      # Why the function reserved word: it suppresses alias expansion of the name,
-      # which otherwise rewrites this header at parse time and aborts the whole file.
-      function codex {
-        "${ORCA_CODEX_LAUNCH_PREFLIGHT}" agent hooks prepare-codex >/dev/null 2>&1 || :
-        command codex "$@"
-      }
-    fi
-    unset __orca_codex_binary
   fi
+  # Why: a typed alias expands inside the shell, after pane launch prep.
+  # Why unalias inside the substitution: an alias named codex makes command -v
+  # report the alias text, and the subshell leaves the user's own alias intact.
+  # Why || : twice — zsh alone aborts inside the substitution, but every shell's
+  # assignment adopts its exit status, so an absent codex trips set -e in bash too.
+  __orca_codex_binary="$(unalias codex 2>/dev/null || :; command -v codex 2>/dev/null || :)"
+  if [[ -n "${__orca_codex_binary:-}" && -x "${__orca_codex_binary}" ]]; then
+    # Why the function reserved word: it suppresses alias expansion of the name,
+    # which otherwise rewrites this header at parse time and aborts the whole file.
+    function codex {
+      # Why local: zsh's warn_create_global warns for each global a function creates.
+      local __orca_codex_arg __orca_codex_isolate="${ORCA_CODEX_ISOLATE:-1}"
+      if [[ -n "${ORCA_CODEX_LAUNCH_PREFLIGHT:-}" && -x "${ORCA_CODEX_LAUNCH_PREFLIGHT}" ]]; then
+        "${ORCA_CODEX_LAUNCH_PREFLIGHT}" agent hooks prepare-codex >/dev/null 2>&1 || :
+      fi
+      for __orca_codex_arg in "$@"; do
+        case "$__orca_codex_arg" in agents|queue|--no-daemon|--remote|--remote=*) __orca_codex_isolate=0 ;; esac
+      done
+      # Why probe every launch: a cached answer goes stale across an upgrade, and 0.155 and older exit 2 on the flag.
+      if [[ "$__orca_codex_isolate" != 0 ]]; then
+        case "$(command codex --help 2>/dev/null </dev/null)" in *--no-daemon*) set -- --no-daemon "$@" ;; esac
+      fi
+      command codex "$@"
+    }
+  fi
+  unset __orca_codex_binary
   if [[ -n "${_orca_histfile:-}" ]]; then
     HISTFILE="$_orca_histfile"
   fi
diff --git a/src/main/__fixtures__/shell-wrapper-snapshots/local-bash-rcfile.txt b/src/main/__fixtures__/shell-wrapper-snapshots/local-bash-rcfile.txt
index a11d3e6183e..d947f956e48 100644
--- a/src/main/__fixtures__/shell-wrapper-snapshots/local-bash-rcfile.txt
+++ b/src/main/__fixtures__/shell-wrapper-snapshots/local-bash-rcfile.txt
@@ -33,6 +33,13 @@ __orca_restore_agent_teams_path() {
   export PATH="${ORCA_AGENT_TEAMS_SHIM_DIR}:$PATH"
 }
 __orca_restore_agent_teams_path
+if [ -n "${ORCA_WSL_CLI_DIR:-}" ]; then
+  if [ -x "$ORCA_WSL_CLI_DIR/${ORCA_CLI_COMMAND:-}" ]; then
+    export PATH="$ORCA_WSL_CLI_DIR${PATH:+:$PATH}"
+  else
+    printf 'Orca CLI unavailable: cannot run %s. Check WSL Windows-drive mount options.\n' "$ORCA_WSL_CLI_DIR/${ORCA_CLI_COMMAND:-}" >&2
+  fi
+fi
 # Why: user startup files may set the default OpenCode config after Orca's
 # spawn env; restore the Orca-managed config dir before the first prompt.
 [[ -n "${ORCA_OPENCODE_CONFIG_DIR:-}" ]] && export OPENCODE_CONFIG_DIR="${ORCA_OPENCODE_CONFIG_DIR}"
@@ -107,11 +114,22 @@ fi
 # Why || : twice — zsh alone aborts inside the substitution, but every shell's
 # assignment adopts its exit status, so an absent codex trips set -e in bash too.
 __orca_codex_binary="$(unalias codex 2>/dev/null || :; command -v codex 2>/dev/null || :)"
-if [[ -n "${ORCA_CODEX_LAUNCH_PREFLIGHT:-}" && -x "${ORCA_CODEX_LAUNCH_PREFLIGHT}" && -n "${__orca_codex_binary:-}" && -x "${__orca_codex_binary}" ]]; then
+if [[ -n "${__orca_codex_binary:-}" && -x "${__orca_codex_binary}" ]]; then
   # Why the function reserved word: it suppresses alias expansion of the name,
   # which otherwise rewrites this header at parse time and aborts the whole file.
   function codex {
-    "${ORCA_CODEX_LAUNCH_PREFLIGHT}" agent hooks prepare-codex >/dev/null 2>&1 || :
+    # Why local: zsh's warn_create_global warns for each global a function creates.
+    local __orca_codex_arg __orca_codex_isolate="${ORCA_CODEX_ISOLATE:-1}"
+    if [[ -n "${ORCA_CODEX_LAUNCH_PREFLIGHT:-}" && -x "${ORCA_CODEX_LAUNCH_PREFLIGHT}" ]]; then
+      "${ORCA_CODEX_LAUNCH_PREFLIGHT}" agent hooks prepare-codex >/dev/null 2>&1 || :
+    fi
+    for __orca_codex_arg in "$@"; do
+      case "$__orca_codex_arg" in agents|queue|--no-daemon|--remote|--remote=*) __orca_codex_isolate=0 ;; esac
+    done
+    # Why probe every launch: a cached answer goes stale across an upgrade, and 0.155 and older exit 2 on the flag.
+    if [[ "$__orca_codex_isolate" != 0 ]]; then
+      case "$(command codex --help 2>/dev/null </dev/null)" in *--no-daemon*) set -- --no-daemon "$@" ;; esac
+    fi
     command codex "$@"
   }
 fi
diff --git a/src/main/__fixtures__/shell-wrapper-snapshots/local-fish-init.txt b/src/main/__fixtures__/shell-wrapper-snapshots/local-fish-init.txt
index df2d2c3cc0e..ff24125e2c0 100644
--- a/src/main/__fixtures__/shell-wrapper-snapshots/local-fish-init.txt
+++ b/src/main/__fixtures__/shell-wrapper-snapshots/local-fish-init.txt
@@ -6,9 +6,14 @@ end
 # absent, leaving "test = file" — fish then errors instead of failing closed.
 # Quoting in place is not the fix; fish never substitutes inside double quotes.
 set -l __orca_codex_type (type -t codex 2>/dev/null)
-if test -x "$ORCA_CODEX_LAUNCH_PREFLIGHT"; and test "$__orca_codex_type" = file
+if test "$__orca_codex_type" = file
   function codex
-    command "$ORCA_CODEX_LAUNCH_PREFLIGHT" agent hooks prepare-codex >/dev/null 2>&1; or true
+    if test -x "$ORCA_CODEX_LAUNCH_PREFLIGHT"
+      command "$ORCA_CODEX_LAUNCH_PREFLIGHT" agent hooks prepare-codex >/dev/null 2>&1; or true
+    end
+    if test "$ORCA_CODEX_ISOLATE" != 0; and not string match -qr -- '^(agents|queue|--no-daemon|--remote|--remote=.*)$' $argv; and command codex --help 2>/dev/null </dev/null | string match -q -- '*--no-daemon*'
+      set argv --no-daemon $argv
+    end
     command codex $argv
   end
 end
diff --git a/src/main/__fixtures__/shell-wrapper-snapshots/local-zsh-zshenv.txt b/src/main/__fixtures__/shell-wrapper-snapshots/local-zsh-zshenv.txt
index 35a262b5e02..93fb79a907a 100644
--- a/src/main/__fixtures__/shell-wrapper-snapshots/local-zsh-zshenv.txt
+++ b/src/main/__fixtures__/shell-wrapper-snapshots/local-zsh-zshenv.txt
@@ -60,6 +60,13 @@ __orca_deferred_init() {
   else
     precmd_functions=(${precmd_functions:#__orca_deferred_init})
   fi
+  if [ -n "${ORCA_WSL_CLI_DIR:-}" ]; then
+    if [ -x "$ORCA_WSL_CLI_DIR/${ORCA_CLI_COMMAND:-}" ]; then
+      export PATH="$ORCA_WSL_CLI_DIR${PATH:+:$PATH}"
+    else
+      printf 'Orca CLI unavailable: cannot run %s. Check WSL Windows-drive mount options.\n' "$ORCA_WSL_CLI_DIR/${ORCA_CLI_COMMAND:-}" >&2
+    fi
+  fi
   if __orca_has_feature overlay; then
     # Why: ~/.zshrc can export the user's default OpenCode config after spawn.
     __orca_restore_agent_teams_path() {
@@ -136,22 +143,33 @@ __orca_deferred_init() {
 
     # Why: Codex must keep using Orca's runtime CODEX_HOME after rc files.
     [[ -n "${ORCA_CODEX_HOME:-}" ]] && export CODEX_HOME="${ORCA_CODEX_HOME}"
-    # Why: a typed alias expands inside the shell, after pane launch prep.
-    # Why unalias inside the substitution: an alias named codex makes command -v
-    # report the alias text, and the subshell leaves the user's own alias intact.
-    # Why || : twice — zsh alone aborts inside the substitution, but every shell's
-    # assignment adopts its exit status, so an absent codex trips set -e in bash too.
-    __orca_codex_binary="$(unalias codex 2>/dev/null || :; command -v codex 2>/dev/null || :)"
-    if [[ -n "${ORCA_CODEX_LAUNCH_PREFLIGHT:-}" && -x "${ORCA_CODEX_LAUNCH_PREFLIGHT}" && -n "${__orca_codex_binary:-}" && -x "${__orca_codex_binary}" ]]; then
-      # Why the function reserved word: it suppresses alias expansion of the name,
-      # which otherwise rewrites this header at parse time and aborts the whole file.
-      function codex {
-        "${ORCA_CODEX_LAUNCH_PREFLIGHT}" agent hooks prepare-codex >/dev/null 2>&1 || :
-        command codex "$@"
-      }
-    fi
-    unset __orca_codex_binary
   fi
+  # Why: a typed alias expands inside the shell, after pane launch prep.
+  # Why unalias inside the substitution: an alias named codex makes command -v
+  # report the alias text, and the subshell leaves the user's own alias intact.
+  # Why || : twice — zsh alone aborts inside the substitution, but every shell's
+  # assignment adopts its exit status, so an absent codex trips set -e in bash too.
+  __orca_codex_binary="$(unalias codex 2>/dev/null || :; command -v codex 2>/dev/null || :)"
+  if [[ -n "${__orca_codex_binary:-}" && -x "${__orca_codex_binary}" ]]; then
+    # Why the function reserved word: it suppresses alias expansion of the name,
+    # which otherwise rewrites this header at parse time and aborts the whole file.
+    function codex {
+      # Why local: zsh's warn_create_global warns for each global a function creates.
+      local __orca_codex_arg __orca_codex_isolate="${ORCA_CODEX_ISOLATE:-1}"
+      if [[ -n "${ORCA_CODEX_LAUNCH_PREFLIGHT:-}" && -x "${ORCA_CODEX_LAUNCH_PREFLIGHT}" ]]; then
+        "${ORCA_CODEX_LAUNCH_PREFLIGHT}" agent hooks prepare-codex >/dev/null 2>&1 || :
+      fi
+      for __orca_codex_arg in "$@"; do
+        case "$__orca_codex_arg" in agents|queue|--no-daemon|--remote|--remote=*) __orca_codex_isolate=0 ;; esac
+      done
+      # Why probe every launch: a cached answer goes stale across an upgrade, and 0.155 and older exit 2 on the flag.
+      if [[ "$__orca_codex_isolate" != 0 ]]; then
+        case "$(command codex --help 2>/dev/null </dev/null)" in *--no-daemon*) set -- --no-daemon "$@" ;; esac
+      fi
+      command codex "$@"
+    }
+  fi
+  unset __orca_codex_binary
   if [[ -n "${_orca_histfile:-}" ]]; then
     HISTFILE="$_orca_histfile"
   fi
diff --git a/src/main/__fixtures__/shell-wrapper-snapshots/relay-bash-rcfile.txt b/src/main/__fixtures__/shell-wrapper-snapshots/relay-bash-rcfile.txt
index 61bdd01dd50..3042bb11df4 100644
--- a/src/main/__fixtures__/shell-wrapper-snapshots/relay-bash-rcfile.txt
+++ b/src/main/__fixtures__/shell-wrapper-snapshots/relay-bash-rcfile.txt
@@ -88,6 +88,32 @@ if [[ -n "${ORCA_OMP_STATUS_EXTENSION:-}" ]]; then
   function omp { __orca_omp "$@"; }
 fi
 
+# Why: a typed alias expands inside the shell, after pane launch prep.
+# Why unalias inside the substitution: an alias named codex makes command -v
+# report the alias text, and the subshell leaves the user's own alias intact.
+# Why || : twice — zsh alone aborts inside the substitution, but every shell's
+# assignment adopts its exit status, so an absent codex trips set -e in bash too.
+__orca_codex_binary="$(unalias codex 2>/dev/null || :; command -v codex 2>/dev/null || :)"
+if [[ -n "${__orca_codex_binary:-}" && -x "${__orca_codex_binary}" ]]; then
+  # Why the function reserved word: it suppresses alias expansion of the name,
+  # which otherwise rewrites this header at parse time and aborts the whole file.
+  function codex {
+    # Why local: zsh's warn_create_global warns for each global a function creates.
+    local __orca_codex_arg __orca_codex_isolate="${ORCA_CODEX_ISOLATE:-1}"
+    if [[ -n "${ORCA_CODEX_LAUNCH_PREFLIGHT:-}" && -x "${ORCA_CODEX_LAUNCH_PREFLIGHT}" ]]; then
+      "${ORCA_CODEX_LAUNCH_PREFLIGHT}" agent hooks prepare-codex >/dev/null 2>&1 || :
+    fi
+    for __orca_codex_arg in "$@"; do
+      case "$__orca_codex_arg" in agents|queue|--no-daemon|--remote|--remote=*) __orca_codex_isolate=0 ;; esac
+    done
+    # Why probe every launch: a cached answer goes stale across an upgrade, and 0.155 and older exit 2 on the flag.
+    if [[ "$__orca_codex_isolate" != 0 ]]; then
+      case "$(command codex --help 2>/dev/null </dev/null)" in *--no-daemon*) set -- --no-daemon "$@" ;; esac
+    fi
+    command codex "$@"
+  }
+fi
+unset __orca_codex_binary
 if [[ -n "${ORCA_HISTFILE:-}" ]]; then
   HISTFILE="$ORCA_HISTFILE"
   builtin unset ORCA_HISTFILE
diff --git a/src/main/__fixtures__/shell-wrapper-snapshots/relay-zsh-zshenv.txt b/src/main/__fixtures__/shell-wrapper-snapshots/relay-zsh-zshenv.txt
index ff90115d30d..4299ebb42b5 100644
--- a/src/main/__fixtures__/shell-wrapper-snapshots/relay-zsh-zshenv.txt
+++ b/src/main/__fixtures__/shell-wrapper-snapshots/relay-zsh-zshenv.txt
@@ -108,6 +108,32 @@ __orca_deferred_init() {
       function omp { __orca_omp "$@"; }
     fi
   fi
+  # Why: a typed alias expands inside the shell, after pane launch prep.
+  # Why unalias inside the substitution: an alias named codex makes command -v
+  # report the alias text, and the subshell leaves the user's own alias intact.
+  # Why || : twice — zsh alone aborts inside the substitution, but every shell's
+  # assignment adopts its exit status, so an absent codex trips set -e in bash too.
+  __orca_codex_binary="$(unalias codex 2>/dev/null || :; command -v codex 2>/dev/null || :)"
+  if [[ -n "${__orca_codex_binary:-}" && -x "${__orca_codex_binary}" ]]; then
+    # Why the function reserved word: it suppresses alias expansion of the name,
+    # which otherwise rewrites this header at parse time and aborts the whole file.
+    function codex {
+      # Why local: zsh's warn_create_global warns for each global a function creates.
+      local __orca_codex_arg __orca_codex_isolate="${ORCA_CODEX_ISOLATE:-1}"
+      if [[ -n "${ORCA_CODEX_LAUNCH_PREFLIGHT:-}" && -x "${ORCA_CODEX_LAUNCH_PREFLIGHT}" ]]; then
+        "${ORCA_CODEX_LAUNCH_PREFLIGHT}" agent hooks prepare-codex >/dev/null 2>&1 || :
+      fi
+      for __orca_codex_arg in "$@"; do
+        case "$__orca_codex_arg" in agents|queue|--no-daemon|--remote|--remote=*) __orca_codex_isolate=0 ;; esac
+      done
+      # Why probe every launch: a cached answer goes stale across an upgrade, and 0.155 and older exit 2 on the flag.
+      if [[ "$__orca_codex_isolate" != 0 ]]; then
+        case "$(command codex --help 2>/dev/null </dev/null)" in *--no-daemon*) set -- --no-daemon "$@" ;; esac
+      fi
+      command codex "$@"
+    }
+  fi
+  unset __orca_codex_binary
   if [[ -n "${_orca_histfile:-}" ]]; then
     HISTFILE="$_orca_histfile"
   fi
diff --git a/src/main/active-view-persistence-boundary.test.ts b/src/main/active-view-persistence-boundary.test.ts
index 26bb25ac70e..54112b2b08f 100644
--- a/src/main/active-view-persistence-boundary.test.ts
+++ b/src/main/active-view-persistence-boundary.test.ts
@@ -1,3 +1,8 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson
+} from './persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
@@ -27,7 +32,8 @@ describe('active-view persistence boundary', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-active-view-boundary-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
     rmSync(testState.dir, { recursive: true, force: true })
   })
@@ -37,9 +43,9 @@ describe('active-view persistence boundary', () => {
     vi.resetModules()
     const { Store } = await import('./persistence')
     const dataFile = join(testState.dir, 'orca-data.json')
-    const store = new Store({ dataFile })
+    const store = createSqliteTestStore(Store, { dataFile })
     store.flush()
-    const durableBefore = readFileSync(dataFile, 'utf-8')
+    const durableBefore = readPersistedStateJson(dataFile)
 
     store.updateUI({ activeView: 'settings' })
     vi.advanceTimersByTime(1_000)
@@ -49,10 +55,10 @@ describe('active-view persistence boundary', () => {
     const preferencePayload = readFileSync(preferenceFile, 'utf-8')
     expect(Buffer.byteLength(preferencePayload)).toBeLessThan(64)
     expect(JSON.parse(preferencePayload)).toEqual({ activeView: 'settings' })
-    expect(readFileSync(dataFile, 'utf-8')).toBe(durableBefore)
+    expect(readPersistedStateJson(dataFile)).toBe(durableBefore)
     expect(store.getUI().activeView).toBe('settings')
 
-    const reloaded = new Store({ dataFile })
+    const reloaded = createSqliteTestStore(Store, { dataFile })
     expect(reloaded.getUI().activeView).toBe('settings')
   })
 })
diff --git a/src/main/active-view-preference.ts b/src/main/active-view-preference.ts
index eb6098f8c1d..41115306e95 100644
--- a/src/main/active-view-preference.ts
+++ b/src/main/active-view-preference.ts
@@ -43,6 +43,7 @@ export class ActiveViewPreference {
   /** Set by flushAsync so the quit flush is the final write; see scheduleSave. */
   private quitFlushStarted = false
   private quitFlushPromise: Promise<void> | null = null
+  private maintenancePaused = false
 
   constructor(dataFile: string, legacyActiveView: unknown) {
     this.file = getActiveViewPreferenceFile(dataFile)
@@ -78,6 +79,9 @@ export class ActiveViewPreference {
       return
     }
     this.writeGeneration += 1
+    if (this.maintenancePaused) {
+      return
+    }
     if (this.writeTimer) {
       clearTimeout(this.writeTimer)
     }
@@ -246,4 +250,21 @@ export class ActiveViewPreference {
       await this.pendingWrite
     }
   }
+
+  pauseForMaintenance(): () => void {
+    if (this.maintenancePaused || this.quitFlushStarted) {
+      throw new Error('Active-view persistence is already paused')
+    }
+    this.maintenancePaused = true
+    if (this.writeTimer) {
+      clearTimeout(this.writeTimer)
+      this.writeTimer = null
+    }
+    return () => {
+      this.maintenancePaused = false
+      if (this.activeView !== this.persistedActiveView) {
+        this.scheduleSave()
+      }
+    }
+  }
 }
diff --git a/src/main/agent-auth-restart-preservation.test.ts b/src/main/agent-auth-restart-preservation.test.ts
index 70063128068..291d294d9ba 100644
--- a/src/main/agent-auth-restart-preservation.test.ts
+++ b/src/main/agent-auth-restart-preservation.test.ts
@@ -151,12 +151,14 @@ describe('preserveAgentAuthBeforeRestart', () => {
     )
   })
 
-  it('flushes the store when auth services are missing', async () => {
+  it('checkpoints admitted state without waiting for ongoing edits when auth services are missing', async () => {
     const flushPendingOrThrowAsync = vi.fn()
 
     await preserveAgentAuthBeforeRestart({ store: { flushPendingOrThrowAsync } })
 
-    expect(flushPendingOrThrowAsync).toHaveBeenCalledTimes(1)
+    expect(flushPendingOrThrowAsync).toHaveBeenCalledExactlyOnceWith({
+      drainToStableGeneration: false
+    })
   })
 
   it('logs secret-free warnings and does not throw when sync fails', async () => {
diff --git a/src/main/agent-auth-restart-preservation.ts b/src/main/agent-auth-restart-preservation.ts
index a3e24ef8abe..d00641088cc 100644
--- a/src/main/agent-auth-restart-preservation.ts
+++ b/src/main/agent-auth-restart-preservation.ts
@@ -44,7 +44,7 @@ export async function preserveAgentAuthBeforeRestart({
   const storePreservation = store
     ? runWithinLifecycleTimeout(
         'Store persistence',
-        () => store.flushPendingOrThrowAsync(),
+        () => store.flushPendingOrThrowAsync({ drainToStableGeneration: false }),
         remainingLifecycleTime(startedAt)
       )
     : Promise.resolve()
diff --git a/src/main/agent-hooks/installer-utils.test.ts b/src/main/agent-hooks/installer-utils.test.ts
index 40966c0f725..1a4f087f19b 100644
--- a/src/main/agent-hooks/installer-utils.test.ts
+++ b/src/main/agent-hooks/installer-utils.test.ts
@@ -638,6 +638,15 @@ describe('wrapWindowsHookCommand', () => {
     )
   })
 
+  it('doubles typographic single quotes in the script path literal', () => {
+    const decoded = decodeWindowsHookCommand(
+      wrapWindowsHookCommand('C:\\Users\\O\u2019Brien\\.orca\\agent-hooks\\codex-hook.cmd')
+    )
+    expect(decoded).toContain(
+      "Test-Path -LiteralPath 'C:\\Users\\O\u2019\u2019Brien\\.orca\\agent-hooks\\codex-hook.cmd'"
+    )
+  })
+
   it('scopes environment variables inside the encoded launcher', () => {
     const command = wrapWindowsHookCommand('C:\\hooks\\copilot-hook.ps1', {
       ORCA_COPILOT_HOOK_EVENT: 'UserPromptSubmit'
diff --git a/src/main/agent-hooks/installer-utils.ts b/src/main/agent-hooks/installer-utils.ts
index a1cd7877638..9eb23e44316 100644
--- a/src/main/agent-hooks/installer-utils.ts
+++ b/src/main/agent-hooks/installer-utils.ts
@@ -12,6 +12,7 @@ import { homedir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { randomUUID } from 'node:crypto'
 import type { AgentHookSource } from '../../shared/agent-hook-relay'
+import { quotePowerShellLiteral } from '../../shared/powershell-native-argument'
 import { grantDirAcl, isPermissionError } from '../win32-utils'
 import { resolveHooksJsonWritePath } from './hook-config-write-path'
 import { writeRollingFileBackup } from '../rolling-file-backup'
@@ -108,10 +109,6 @@ export function getSharedManagedScriptPath(scriptFileName: string): string {
 
 export { wrapPosixHookCommand } from './posix-hook-command'
 
-export function quotePowerShellString(value: string): string {
-  return `'${value.replaceAll("'", "''")}'`
-}
-
 export {
   wrapWindowsPowerShellEncodedCommand,
   WINDOWS_POWERSHELL_HOOK_SWITCHES
@@ -134,14 +131,14 @@ export function buildWindowsHookPowerShellCommand(
   options: { fallbackStdout?: string } = {}
 ): string {
   // Why: the encoded launcher protects paths across Windows shells and drains stdin when the config points at a missing script.
-  const quoted = quotePowerShellString(scriptPath)
+  const quoted = quotePowerShellLiteral(scriptPath)
   const envPrefix = Object.entries(env)
-    .map(([key, value]) => `$env:${key} = ${quotePowerShellString(value)}; `)
+    .map(([key, value]) => `$env:${key} = ${quotePowerShellLiteral(value)}; `)
     .join('')
   const fallback =
     options.fallbackStdout === undefined
       ? ''
-      : `Write-Output ${quotePowerShellString(options.fallbackStdout)}; `
+      : `Write-Output ${quotePowerShellLiteral(options.fallbackStdout)}; `
   // Why the order: answer first (a gate event reads silence as deny), then the shared
   // env guard, and only then own stdin — outside an Orca pane the caller may abandon the
   // pipe, and ReadToEnd would strand the launcher there forever (#11549).
@@ -323,7 +320,7 @@ export function writeHooksJson(
   config: Record<string, unknown>,
   // Why: `serialized` lets a JSONC config (Devin) supply text edited in place, so the
   // atomic write + rolling backup below stay shared instead of being reimplemented.
-  options?: { preserveMode?: boolean; serialized?: string }
+  options?: { preserveMode?: boolean; defaultMode?: number; serialized?: string }
 ): void {
   const writePath = resolveHooksJsonWritePath(configPath)
   const dir = dirname(writePath)
@@ -334,7 +331,9 @@ export function writeHooksJson(
   const tmpPath = join(dir, `.${Date.now()}-${randomUUID()}.tmp`)
   const serialized = options?.serialized ?? `${JSON.stringify(config, null, 2)}\n`
   const existingMode =
-    options?.preserveMode === true && existsSync(writePath) ? statSync(writePath).mode : undefined
+    options?.preserveMode === true && existsSync(writePath)
+      ? statSync(writePath).mode & 0o777
+      : options?.defaultMode
 
   // Why: skip the write (and therefore the .bak rotation) when the on-disk
   // content is already identical. Without this, every install() rewrites the
@@ -351,7 +350,11 @@ export function writeHooksJson(
   }
 
   try {
-    writeFileSync(tmpPath, serialized, { encoding: 'utf-8', mode: existingMode })
+    writeFileSync(tmpPath, serialized, { encoding: 'utf-8', mode: existingMode, flag: 'wx' })
+    if (existingMode !== undefined && process.platform !== 'win32') {
+      // Preserve requested permissions even with a stricter process umask.
+      chmodSync(tmpPath, existingMode)
+    }
     // Why: single rolling backup — one file, no accumulation in ~/.claude.
     // Protects against a merge-logic bug producing bad JSON; the original is
     // always recoverable from <configPath>.bak until the next write.
diff --git a/src/main/agent-hooks/managed-agent-hook-controls.test.ts b/src/main/agent-hooks/managed-agent-hook-controls.test.ts
index 625cc06f505..ee38da3a7fe 100644
--- a/src/main/agent-hooks/managed-agent-hook-controls.test.ts
+++ b/src/main/agent-hooks/managed-agent-hook-controls.test.ts
@@ -19,7 +19,7 @@ vi.mock('./local-agent-cli-presence', () => ({
   detectLocalManagedAgentCliPresence: mocks.detect
 }))
 
-vi.mock('../claude/claude-session-end-hook-capability', () => ({
+vi.mock('../claude/claude-hook-event-versions', () => ({
   probeClaudeCliVersion: mocks.probeClaudeVersion
 }))
 
diff --git a/src/main/agent-hooks/managed-agent-hook-controls.ts b/src/main/agent-hooks/managed-agent-hook-controls.ts
index 7edfd94c7c8..a667e056669 100644
--- a/src/main/agent-hooks/managed-agent-hook-controls.ts
+++ b/src/main/agent-hooks/managed-agent-hook-controls.ts
@@ -5,7 +5,11 @@ import {
 } from '../../shared/managed-agent-hook-targets'
 import { normalizeDisabledTuiAgents } from '../../shared/tui-agent-selection'
 import type { GlobalSettings } from '../../shared/global-settings-types'
-import { probeClaudeCliVersion } from '../claude/claude-session-end-hook-capability'
+import {
+  isAgentStatusHooksEnabled,
+  isAgentStatusHooksEnabledForAgent
+} from '../../shared/agent-status-hooks-setting'
+import { probeClaudeCliVersion } from '../claude/claude-hook-event-versions'
 import { detectLocalManagedAgentCliPresence } from './local-agent-cli-presence'
 import {
   MANAGED_AGENT_HOOK_ASYNC_REMOVERS,
@@ -19,6 +23,10 @@ import {
 
 export { MANAGED_AGENT_HOOK_INSTALLERS } from './managed-agent-hook-registry'
 export { prepareManagedCodexHomeBeforeShellLaunch } from '../codex/managed-home-shell-preflight'
+export {
+  isAgentStatusHooksEnabled,
+  isAgentStatusHooksEnabledForAgent
+} from '../../shared/agent-status-hooks-setting'
 
 type ManagedHookSettings = Partial<
   Pick<GlobalSettings, 'agentCmdOverrides' | 'agentStatusHooksEnabled' | 'disabledTuiAgents'>
@@ -37,12 +45,6 @@ type RemoveOptions = {
   agents?: readonly AgentHookTarget[]
 }
 
-export function isAgentStatusHooksEnabled(
-  settings: Partial<Pick<GlobalSettings, 'agentStatusHooksEnabled'>> | null | undefined
-): boolean {
-  return settings?.agentStatusHooksEnabled !== false
-}
-
 export type StartupManagedHookAction = 'install' | 'skip'
 
 // Why never 'remove': this reads THIS instance's settings, but the managed hook files are
@@ -60,10 +62,7 @@ export function shouldInstallStartupManagedAgentHook(
   settings: ManagedHookSettings,
   agent: AgentHookTarget
 ): boolean {
-  return (
-    resolveStartupManagedHookAction(settings) === 'install' &&
-    !normalizeDisabledTuiAgents(settings?.disabledTuiAgents).includes(agent)
-  )
+  return isAgentStatusHooksEnabledForAgent(settings, agent)
 }
 
 export function shouldContinueManagedHookStartup(
@@ -71,11 +70,7 @@ export function shouldContinueManagedHookStartup(
   settings: ManagedHookSettings,
   agent: AgentHookTarget
 ): boolean {
-  return (
-    !isQuitting &&
-    isAgentStatusHooksEnabled(settings) &&
-    !normalizeDisabledTuiAgents(settings?.disabledTuiAgents).includes(agent)
-  )
+  return !isQuitting && isAgentStatusHooksEnabledForAgent(settings, agent)
 }
 
 function errorStatus(agent: AgentHookTarget, error: unknown): AgentHookInstallStatus {
diff --git a/src/main/agent-hooks/managed-agent-hook-registry.ts b/src/main/agent-hooks/managed-agent-hook-registry.ts
index 560233e8363..11b642ee090 100644
--- a/src/main/agent-hooks/managed-agent-hook-registry.ts
+++ b/src/main/agent-hooks/managed-agent-hook-registry.ts
@@ -1,3 +1,5 @@
+import { codebuddyHookService } from '../codebuddy/hook-service'
+import { qoderHookService } from '../qoder/hook-service'
 import type { AgentHookInstallStatus } from '../../shared/agent-hook-types'
 import type { HookInstallAgent } from '../../shared/telemetry-events'
 import { ampHookService } from '../amp/hook-service'
@@ -8,6 +10,7 @@ import { commandCodeHookService } from '../command-code/hook-service'
 import { copilotHookService } from '../copilot/hook-service'
 import { cursorHookService } from '../cursor/hook-service'
 import { devinHookService } from '../devin/hook-service'
+import { dshHookService } from '../dsh/hook-service'
 import { droidHookService } from '../droid/hook-service'
 import { geminiHookService } from '../gemini/hook-service'
 import { grokHookService } from '../grok/hook-service'
@@ -43,6 +46,8 @@ export const MANAGED_AGENT_HOOK_INSTALLERS: readonly ManagedAgentHookInstaller[]
   ['openclaude', () => openClaudeHookService.install()],
   ['codex', () => codexHookService.install()],
   ['gemini', () => geminiHookService.install()],
+  ['qoder', () => qoderHookService.install()],
+  ['codebuddy', () => codebuddyHookService.install()],
   ['antigravity', () => antigravityHookService.install()],
   ['amp', () => ampHookService.install()],
   ['cursor', () => cursorHookService.install()],
@@ -54,7 +59,8 @@ export const MANAGED_AGENT_HOOK_INSTALLERS: readonly ManagedAgentHookInstaller[]
   ['devin', () => devinHookService.install()],
   ['kimi', () => kimiHookService.install()],
   ['muse', () => museHookService.install()],
-  ['zcode', () => zcodeHookService.install()]
+  ['zcode', () => zcodeHookService.install()],
+  ['dsh', () => dshHookService.install()]
 ]
 
 // Why: covers the shared launcher/statusline scripts under ~/.orca/agent-hooks — the files a
@@ -68,6 +74,8 @@ export const MANAGED_AGENT_HOOK_SCRIPT_REFRESHERS: readonly ManagedAgentHookScri
   ['openclaude', () => openClaudeHookService.refreshManagedScripts()],
   ['codex', () => codexHookService.refreshManagedScripts()],
   ['gemini', () => geminiHookService.refreshManagedScripts()],
+  ['qoder', () => qoderHookService.refreshManagedScripts()],
+  ['codebuddy', () => codebuddyHookService.refreshManagedScripts()],
   ['antigravity', () => antigravityHookService.refreshManagedScripts()],
   ['cursor', () => cursorHookService.refreshManagedScripts()],
   ['droid', () => droidHookService.refreshManagedScripts()],
@@ -77,7 +85,8 @@ export const MANAGED_AGENT_HOOK_SCRIPT_REFRESHERS: readonly ManagedAgentHookScri
   ['devin', () => devinHookService.refreshManagedScripts()],
   ['kimi', () => kimiHookService.refreshManagedScripts()],
   ['muse', () => museHookService.refreshManagedScripts()],
-  ['zcode', () => zcodeHookService.refreshManagedScripts()]
+  ['zcode', () => zcodeHookService.refreshManagedScripts()],
+  ['dsh', () => dshHookService.refreshManagedScripts()]
 ]
 
 export const MANAGED_AGENT_HOOK_REMOVERS: readonly ManagedAgentHookRemover[] = [
@@ -85,6 +94,8 @@ export const MANAGED_AGENT_HOOK_REMOVERS: readonly ManagedAgentHookRemover[] = [
   ['openclaude', () => openClaudeHookService.remove()],
   ['codex', () => codexHookService.remove()],
   ['gemini', () => geminiHookService.remove()],
+  ['qoder', () => qoderHookService.remove()],
+  ['codebuddy', () => codebuddyHookService.remove()],
   ['antigravity', () => antigravityHookService.remove()],
   ['amp', () => ampHookService.remove()],
   ['cursor', () => cursorHookService.remove()],
@@ -96,7 +107,8 @@ export const MANAGED_AGENT_HOOK_REMOVERS: readonly ManagedAgentHookRemover[] = [
   ['devin', () => devinHookService.remove()],
   ['kimi', () => kimiHookService.remove()],
   ['muse', () => museHookService.remove()],
-  ['zcode', () => zcodeHookService.remove()]
+  ['zcode', () => zcodeHookService.remove()],
+  ['dsh', () => dshHookService.remove()]
 ]
 
 export const MANAGED_AGENT_HOOK_ASYNC_REMOVERS: readonly ManagedAgentHookAsyncRemover[] = [
@@ -108,6 +120,8 @@ export const MANAGED_AGENT_HOOK_STATUS_READERS: readonly ManagedAgentHookStatusR
   ['openclaude', () => openClaudeHookService.getStatus()],
   ['codex', () => codexHookService.getStatus()],
   ['gemini', () => geminiHookService.getStatus()],
+  ['qoder', () => qoderHookService.getStatus()],
+  ['codebuddy', () => codebuddyHookService.getStatus()],
   ['antigravity', () => antigravityHookService.getStatus()],
   ['amp', () => ampHookService.getStatus()],
   ['cursor', () => cursorHookService.getStatus()],
@@ -119,5 +133,6 @@ export const MANAGED_AGENT_HOOK_STATUS_READERS: readonly ManagedAgentHookStatusR
   ['devin', () => devinHookService.getStatus()],
   ['kimi', () => kimiHookService.getStatus()],
   ['muse', () => museHookService.getStatus()],
-  ['zcode', () => zcodeHookService.getStatus()]
+  ['zcode', () => zcodeHookService.getStatus()],
+  ['dsh', () => dshHookService.getStatus()]
 ]
diff --git a/src/main/agent-hooks/managed-hook-command-contract.test.ts b/src/main/agent-hooks/managed-hook-command-contract.test.ts
index 774e9396c25..ebb1412ec58 100644
--- a/src/main/agent-hooks/managed-hook-command-contract.test.ts
+++ b/src/main/agent-hooks/managed-hook-command-contract.test.ts
@@ -22,6 +22,7 @@ import {
 import { getDevinManagedCommand, getDevinRemoteManagedCommand } from '../devin/hook-settings'
 import { getGrokManagedCommand } from '../grok/grok-hook-script'
 import { getMuseManagedCommand, getMuseRemoteManagedCommand } from '../muse/hook-settings'
+import { getDshManagedCommand, getDshRemoteManagedCommand } from '../dsh/hook-settings'
 import { getZCodeManagedCommand, getZCodeRemoteManagedCommand } from '../zcode/hook-settings'
 import {
   wrapPosixHookCommand,
@@ -81,6 +82,34 @@ const buildersByAgent = new Map<string, CommandBuilders>([
       remote: (path) => [getClaudeRemoteCommand(path)]
     }
   ],
+  [
+    'qoder',
+    {
+      local: (path) => [
+        getManagedLifecycleHook(path, {
+          configDirName: '.qoder',
+          scriptBaseName: 'qoder-hook',
+          usesWindowsCompatLauncher: true,
+          windowsHookShell: 'powershell'
+        }).command
+      ],
+      remote: (path) => [getClaudeRemoteCommand(path)]
+    }
+  ],
+  [
+    'codebuddy',
+    {
+      local: (path) => [
+        getManagedLifecycleHook(path, {
+          configDirName: '.codebuddy',
+          scriptBaseName: 'codebuddy-hook',
+          usesWindowsCompatLauncher: true,
+          windowsHookShell: 'powershell'
+        }).command
+      ],
+      remote: (path) => [getClaudeRemoteCommand(path)]
+    }
+  ],
   [
     'codex',
     {
@@ -151,6 +180,13 @@ const buildersByAgent = new Map<string, CommandBuilders>([
       remote: (path) => [getMuseRemoteManagedCommand(path)]
     }
   ],
+  [
+    'dsh',
+    {
+      local: (path) => [getDshManagedCommand(path)],
+      remote: (path) => [getDshRemoteManagedCommand(path)]
+    }
+  ],
   [
     'zcode',
     {
@@ -198,10 +234,16 @@ describe('managed hook command contract', () => {
       expect(commands.length).toBeGreaterThan(0)
       for (const command of commands) {
         expect(command.length).toBeGreaterThan(0)
-        // Native Windows Codex evaluates PowerShell variables without Grok's dollar-byte scanner.
+        // Native PowerShell hooks evaluate these variables without Grok's dollar-byte scanner.
         const scannedCommand =
-          agent === 'codex' && platform === 'win32' && command.startsWith('if (Test-Path')
-            ? command.replaceAll('$LASTEXITCODE', '').replaceAll('$env:', '')
+          platform === 'win32' &&
+          ((agent === 'codex' && command.startsWith('if (Test-Path')) ||
+            ((agent === 'qoder' || agent === 'codebuddy') &&
+              command.startsWith('$scriptPath = Join-Path')))
+            ? command
+                .replaceAll('$LASTEXITCODE', '')
+                .replaceAll('$env:', '')
+                .replaceAll('$scriptPath', '')
             : command
         expect(findBareHookCommandVariables(scannedCommand), command).toEqual([])
       }
diff --git a/src/main/agent-hooks/managed-hook-detection-commands.ts b/src/main/agent-hooks/managed-hook-detection-commands.ts
index f9507160e27..0d3ee8280d5 100644
--- a/src/main/agent-hooks/managed-hook-detection-commands.ts
+++ b/src/main/agent-hooks/managed-hook-detection-commands.ts
@@ -7,7 +7,7 @@ import { MANAGED_AGENT_HOOK_TARGETS } from '../../shared/managed-agent-hook-targ
 import { normalizeDisabledTuiAgents } from '../../shared/tui-agent-selection'
 import type { GlobalSettings } from '../../shared/global-settings-types'
 import type { TuiAgentDetectionCommand } from '../ipc/tui-agent-detection-commands'
-import { parseClaudeCliVersion } from '../claude/claude-session-end-hook-capability'
+import { parseClaudeCliVersion } from '../claude/claude-hook-event-versions'
 
 export type ManagedHookDetectionSettings = Partial<
   Pick<GlobalSettings, 'agentCmdOverrides' | 'disabledTuiAgents' | 'agentStatusHooksEnabled'>
diff --git a/src/main/agent-hooks/managed-hooks-json-events.ts b/src/main/agent-hooks/managed-hooks-json-events.ts
new file mode 100644
index 00000000000..bff2bbf6942
--- /dev/null
+++ b/src/main/agent-hooks/managed-hooks-json-events.ts
@@ -0,0 +1,38 @@
+import { isPlainObject } from './installer-utils'
+
+/**
+ * Which of `events` an Orca-owned `{ hooks: { <event>: [{ hooks: [{ command }] }] } }` file
+ * still registers under a managed command.
+ *
+ * Shared by every agent whose managed hooks file Orca generates wholesale (Muse, DSH), so
+ * "installed", "partial" and "not_installed" cannot drift between them.
+ *
+ * Why every lookup is guarded: the file is on disk and hand-editable, so any node can be
+ * null, a scalar, or the wrong container. A malformed node reads as "event absent" — status
+ * calculation must report a broken install, never throw on it.
+ */
+export function readManagedHookEventsFromJson(
+  parsed: unknown,
+  events: readonly string[],
+  isManagedCommand: (command: string | undefined) => boolean
+): Set<string> {
+  const hooks = isPlainObject(parsed) && isPlainObject(parsed.hooks) ? parsed.hooks : {}
+  return new Set(
+    events.filter((event) =>
+      asArray(hooks[event]).some((definition) =>
+        asArray(isPlainObject(definition) ? definition.hooks : null).some((hook) =>
+          isManagedCommand(readCommand(hook))
+        )
+      )
+    )
+  )
+}
+
+function asArray(value: unknown): readonly unknown[] {
+  return Array.isArray(value) ? value : []
+}
+
+function readCommand(hook: unknown): string | undefined {
+  const command = isPlainObject(hook) ? hook.command : undefined
+  return typeof command === 'string' ? command : undefined
+}
diff --git a/src/main/agent-hooks/opencode-plugin-settings.ts b/src/main/agent-hooks/opencode-plugin-settings.ts
new file mode 100644
index 00000000000..e05f488c6a1
--- /dev/null
+++ b/src/main/agent-hooks/opencode-plugin-settings.ts
@@ -0,0 +1,23 @@
+import type { PluginSources } from '../../relay/plugin-overlay'
+import { isAgentStatusHooksEnabledForAgent } from '../../shared/agent-status-hooks-setting'
+import type { ManagedHookDetectionSettings } from './managed-hook-detection-commands'
+
+function enabled(settings: ManagedHookDetectionSettings, agent: 'opencode' | 'opencode2'): boolean {
+  return isAgentStatusHooksEnabledForAgent(settings, agent)
+}
+
+export function openCodePluginSettingsKey(settings: ManagedHookDetectionSettings): string {
+  return `${enabled(settings, 'opencode')}:${enabled(settings, 'opencode2')}`
+}
+
+export function selectOpenCodePluginSources(
+  sources: PluginSources,
+  settings: ManagedHookDetectionSettings
+): PluginSources {
+  // Older relays retain omitted sources; an empty string replaces the cache and cannot write a plugin.
+  return {
+    ...sources,
+    opencodePluginSource: enabled(settings, 'opencode') ? sources.opencodePluginSource : '',
+    opencode2PluginSource: enabled(settings, 'opencode2') ? sources.opencode2PluginSource : ''
+  }
+}
diff --git a/src/main/agent-hooks/remote-hook-service-installers.test.ts b/src/main/agent-hooks/remote-hook-service-installers.test.ts
index 148d5f719d7..f3cc23937b4 100644
--- a/src/main/agent-hooks/remote-hook-service-installers.test.ts
+++ b/src/main/agent-hooks/remote-hook-service-installers.test.ts
@@ -1,3 +1,4 @@
+import { qoderHookService } from '../qoder/hook-service'
 import { describe, expect, it, vi } from 'vitest'
 import { parse as parseJsonc } from 'jsonc-parser'
 import type { SFTPWrapper } from 'ssh2'
@@ -685,6 +686,18 @@ describe('remote hook service installers', () => {
     expect(fs.modes.get('/home/dev/.orca/agent-hooks/copilot-hook.sh')).toBe(0o755)
   })
 
+  it('installs Qoder on the execution host with its own event endpoint', async () => {
+    const { sftp, fs } = createFakeSftp()
+    const result = await qoderHookService.installRemote(sftp, '/home/dev/')
+    expect(result.state).toBe('installed')
+    expect(result.configPath).toBe('/home/dev/.qoder/settings.json')
+    const settings = JSON.parse(fs.files.get(result.configPath) ?? '{}')
+    expect(settings.hooks.SessionEnd).toHaveLength(1)
+    expect(settings.hooks.Notification).toHaveLength(1)
+    expect(settings.hooks.TeammateIdle).toBeUndefined()
+    expect(fs.files.get('/home/dev/.orca/agent-hooks/qoder-hook.sh')).toContain('/hook/qoder')
+  })
+
   it('installs Droid and Copilot when running the aggregate remote installer (issue #7253)', async () => {
     const { sftp } = createFakeSftp()
     const results = await installRemoteManagedAgentHooks(sftp, '/home/dev', {
diff --git a/src/main/agent-hooks/remote-hook-service-registry-coverage.test.ts b/src/main/agent-hooks/remote-hook-service-registry-coverage.test.ts
index f145ebc9be8..dea6c4a4663 100644
--- a/src/main/agent-hooks/remote-hook-service-registry-coverage.test.ts
+++ b/src/main/agent-hooks/remote-hook-service-registry-coverage.test.ts
@@ -1,3 +1,4 @@
+import { codebuddyHookService } from '../codebuddy/hook-service'
 import { describe, expect, it, vi } from 'vitest'
 
 vi.mock('electron', () => ({
@@ -19,8 +20,10 @@ import { geminiHookService } from '../gemini/hook-service'
 import { grokHookService } from '../grok/hook-service'
 import { hermesHookService } from '../hermes/hook-service'
 import { kimiHookService } from '../kimi/hook-service'
+import { dshHookService } from '../dsh/hook-service'
 import { museHookService } from '../muse/hook-service'
 import { openClaudeHookService } from '../openclaude/hook-service'
+import { qoderHookService } from '../qoder/hook-service'
 import { zcodeHookService } from '../zcode/hook-service'
 import { MANAGED_AGENT_HOOK_INSTALLERS } from './managed-agent-hook-controls'
 import { REMOTE_MANAGED_HOOK_INSTALLER_AGENTS } from './remote-managed-hook-installers'
@@ -50,7 +53,10 @@ describe('remote hook service registry coverage', () => {
       ['devin', devinHookService],
       ['kimi', kimiHookService],
       ['muse', museHookService],
-      ['zcode', zcodeHookService]
+      ['qoder', qoderHookService],
+      ['codebuddy', codebuddyHookService],
+      ['zcode', zcodeHookService],
+      ['dsh', dshHookService]
     ])
 
     // Guard against a service silently missing from the map above as new agents land.
diff --git a/src/main/agent-hooks/remote-managed-hook-installers.ts b/src/main/agent-hooks/remote-managed-hook-installers.ts
index 1f42bdd68a6..b012af91ff3 100644
--- a/src/main/agent-hooks/remote-managed-hook-installers.ts
+++ b/src/main/agent-hooks/remote-managed-hook-installers.ts
@@ -1,3 +1,5 @@
+import { codebuddyHookService } from '../codebuddy/hook-service'
+import { qoderHookService } from '../qoder/hook-service'
 import type { SFTPWrapper } from 'ssh2'
 import type { AgentHookInstallStatus, AgentHookTarget } from '../../shared/agent-hook-types'
 import { ampHookService } from '../amp/hook-service'
@@ -13,6 +15,7 @@ import { droidHookService } from '../droid/hook-service'
 import { grokHookService } from '../grok/hook-service'
 import { hermesHookService } from '../hermes/hook-service'
 import { kimiHookService } from '../kimi/hook-service'
+import { dshHookService } from '../dsh/hook-service'
 import { museHookService } from '../muse/hook-service'
 import { zcodeHookService } from '../zcode/hook-service'
 import { openClaudeHookService } from '../openclaude/hook-service'
@@ -61,6 +64,8 @@ const REMOTE_MANAGED_HOOK_INSTALLERS: readonly RemoteManagedHookInstaller[] = [
       })
   ],
   ['gemini', (sftp, remoteHome) => geminiHookService.installRemote(sftp, remoteHome)],
+  ['qoder', (sftp, remoteHome) => qoderHookService.installRemote(sftp, remoteHome)],
+  ['codebuddy', (sftp, remoteHome) => codebuddyHookService.installRemote(sftp, remoteHome)],
   ['antigravity', (sftp, remoteHome) => antigravityHookService.installRemote(sftp, remoteHome)],
   ['amp', (sftp, remoteHome) => ampHookService.installRemote(sftp, remoteHome)],
   ['cursor', (sftp, remoteHome) => cursorHookService.installRemote(sftp, remoteHome)],
@@ -76,7 +81,8 @@ const REMOTE_MANAGED_HOOK_INSTALLERS: readonly RemoteManagedHookInstaller[] = [
   ['devin', (sftp, remoteHome) => devinHookService.installRemote(sftp, remoteHome)],
   ['kimi', (sftp, remoteHome) => kimiHookService.installRemote(sftp, remoteHome)],
   ['muse', (sftp, remoteHome) => museHookService.installRemote(sftp, remoteHome)],
-  ['zcode', (sftp, remoteHome) => zcodeHookService.installRemote(sftp, remoteHome)]
+  ['zcode', (sftp, remoteHome) => zcodeHookService.installRemote(sftp, remoteHome)],
+  ['dsh', (sftp, remoteHome) => dshHookService.installRemote(sftp, remoteHome)]
 ]
 
 /** Agents wired into the remote (SSH) hook installer. Exported so an invariant
diff --git a/src/main/agent-hooks/server-opencode-binder.test.ts b/src/main/agent-hooks/server-opencode-binder.test.ts
index 59d1c9142fe..328dc98c04c 100644
--- a/src/main/agent-hooks/server-opencode-binder.test.ts
+++ b/src/main/agent-hooks/server-opencode-binder.test.ts
@@ -70,7 +70,13 @@ describe('opencode binder loop', () => {
         { paneKey: PANE_A, directory: DIR, worktreeId: `repo::${DIR}`, shellPid: 111 }
       ],
       sweep: async () => [
-        { pid: 112, ppid: 111, startedAtMs: Date.now() - 120_000, executable: 'opencode', argv: ['opencode'] }
+        {
+          pid: 112,
+          ppid: 111,
+          startedAtMs: Date.now() - 120_000,
+          executable: 'opencode',
+          argv: ['opencode']
+        }
       ]
     })
   })
diff --git a/src/main/agent-hooks/server-retired-pane-new-turn.test.ts b/src/main/agent-hooks/server-retired-pane-new-turn.test.ts
index d38f6c836c7..23dbb56c695 100644
--- a/src/main/agent-hooks/server-retired-pane-new-turn.test.ts
+++ b/src/main/agent-hooks/server-retired-pane-new-turn.test.ts
@@ -22,8 +22,10 @@ afterEach(() => vi.restoreAllMocks())
  *  classifier names no boundary for that source. That is not the same as "can never revive":
  *  mimo-code's boundary is an explicit-prompt MessagePart, which the gate handles separately. */
 const NEW_TURN_EVENT: Record<AgentHookSource, string | null> = {
+  qoder: 'SessionStart',
   claude: 'SessionStart',
   kimi: 'UserPromptSubmit',
+  codebuddy: 'UserPromptSubmit',
   codex: 'SessionStart',
   gemini: 'BeforeAgent',
   antigravity: 'PreInvocation',
@@ -42,7 +44,8 @@ const NEW_TURN_EVENT: Record<AgentHookSource, string | null> = {
   'mimo-code': null,
   'command-code': null,
   muse: 'UserPromptSubmit',
-  zcode: 'SessionStart'
+  zcode: 'SessionStart',
+  dsh: 'SessionStart'
 }
 
 function reviveRetiredPane(source: unknown, hookEventName: string): boolean {
diff --git a/src/main/agent-hooks/server-turn-started-at.test.ts b/src/main/agent-hooks/server-turn-started-at.test.ts
new file mode 100644
index 00000000000..63ebd136be6
--- /dev/null
+++ b/src/main/agent-hooks/server-turn-started-at.test.ts
@@ -0,0 +1,185 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { AgentHookServer, _internals } from './server'
+import { buildBody, postHookEvent, PANE } from './server.test-fixtures'
+
+const { getCohortAtEmitMock, trackMock } = vi.hoisted(() => ({
+  getCohortAtEmitMock: vi.fn(),
+  trackMock: vi.fn()
+}))
+
+vi.mock('../telemetry/client', () => ({ track: trackMock }))
+vi.mock('../telemetry/cohort-classifier', () => ({ getCohortAtEmit: getCohortAtEmitMock }))
+
+beforeEach(() => {
+  _internals.resetCachesForTests()
+  getCohortAtEmitMock.mockReturnValue({})
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+// Distinct host stamps: each event lands on a later millisecond than the one before it.
+async function nextMillisecond(): Promise<void> {
+  await new Promise((resolve) => setTimeout(resolve, 5))
+}
+
+// The execution host stamps when the main agent's turn began, so every reader (and a reload, which
+// starts the renderer with no state history) gets the turn start rather than rebuilding it.
+describe('the host-stamped turn start', () => {
+  const servers: AgentHookServer[] = []
+  let userDataPath: string
+
+  beforeEach(() => {
+    userDataPath = mkdtempSync(join(tmpdir(), 'orca-turn-started-at-'))
+  })
+
+  afterEach(() => {
+    for (const server of servers) {
+      server.stop()
+    }
+    servers.length = 0
+    rmSync(userDataPath, { recursive: true, force: true })
+  })
+
+  async function startServer(): Promise<AgentHookServer> {
+    const server = new AgentHookServer()
+    servers.push(server)
+    await server.start({ env: 'production', userDataPath })
+    return server
+  }
+
+  async function post(server: AgentHookServer, payload: Record<string, unknown>): Promise<void> {
+    const response = await postHookEvent(server, buildBody(payload))
+    expect(response.status).toBe(204)
+    await nextMillisecond()
+  }
+
+  function turnStartedAt(server: AgentHookServer): number | undefined {
+    return server.getStatusSnapshot()[0]?.turnStartedAt
+  }
+
+  it('stamps a new main-agent turn and carries it across tools, a wait and its answer', async () => {
+    const server = await startServer()
+    await post(server, { hook_event_name: 'UserPromptSubmit', prompt: 'Rename the module' })
+    const started = turnStartedAt(server)
+    expect(started).toBe(server.getStatusSnapshot()[0]?.stateStartedAt)
+
+    const bash = { tool_name: 'Bash', tool_input: { command: 'pnpm build' }, tool_use_id: 'tu-1' }
+    await post(server, { hook_event_name: 'PreToolUse', ...bash })
+    await post(server, { hook_event_name: 'PermissionRequest', ...bash })
+    expect(server.getStatusSnapshot()[0]).toMatchObject({ state: 'waiting' })
+    await post(server, { hook_event_name: 'PostToolUse', ...bash })
+    // The answer restarted the state clock, not the turn's.
+    expect(server.getStatusSnapshot()[0]).toMatchObject({ state: 'working' })
+    expect(server.getStatusSnapshot()[0]?.stateStartedAt).toBeGreaterThan(started!)
+    expect(turnStartedAt(server)).toBe(started)
+
+    await post(server, { hook_event_name: 'Stop' })
+    // Kept on the finished turn, so a reader can time it from the host's own facts.
+    expect(server.getStatusSnapshot()[0]).toMatchObject({ state: 'done', turnStartedAt: started })
+  })
+
+  it('is not stamped by a child agent, and the same prompt sent again is a new turn', async () => {
+    const server = await startServer()
+    await post(server, { hook_event_name: 'UserPromptSubmit', prompt: 'Rename the module' })
+    const started = turnStartedAt(server)
+
+    await post(server, {
+      hook_event_name: 'UserPromptSubmit',
+      prompt: 'child task',
+      agent_id: 'child-1'
+    })
+    expect(turnStartedAt(server)).toBe(started)
+
+    // Esc at a permission prompt fires no hook, so the resend follows the stale wait directly.
+    await post(server, { hook_event_name: 'PermissionRequest', tool_name: 'Bash', tool_input: {} })
+    await post(server, { hook_event_name: 'UserPromptSubmit', prompt: 'Rename the module' })
+    expect(turnStartedAt(server)).toBeGreaterThan(started!)
+  })
+
+  it('is not stamped by a relayed replay', async () => {
+    const server = await startServer()
+    const envelope = {
+      paneKey: PANE,
+      tabId: 'tab-1',
+      source: 'claude' as const,
+      hookEventName: 'UserPromptSubmit',
+      payload: { state: 'working' as const, prompt: 'relayed', agentType: 'claude' as const }
+    }
+    server.ingestRemote(envelope, 'ssh-turn')
+    const started = turnStartedAt(server)
+    expect(started).toEqual(expect.any(Number))
+    await nextMillisecond()
+
+    server.ingestRemote({ ...envelope, isReplay: true }, 'ssh-turn')
+    expect(turnStartedAt(server)).toBe(started)
+  })
+
+  // A session start lands an idle boundary row: no turn is open until the next prompt.
+  it('clears on a session boundary', async () => {
+    const server = await startServer()
+    await post(server, { hook_event_name: 'UserPromptSubmit', prompt: 'Rename the module' })
+    expect(turnStartedAt(server)).toEqual(expect.any(Number))
+
+    await post(server, { hook_event_name: 'SessionStart', source: 'clear' })
+    expect(server.getStatusSnapshot()[0]).toMatchObject({ state: 'done', sessionBoundary: true })
+    expect(server.getStatusSnapshot()[0]).not.toHaveProperty('turnStartedAt')
+  })
+
+  // An OSC repaint can land before the prompt hook; it must not count from the finished turn.
+  it('drops the stamp when a finished main agent runs again with no turn-opening event', async () => {
+    const server = await startServer()
+    await post(server, { hook_event_name: 'UserPromptSubmit', prompt: 'Rename the module' })
+    await post(server, { hook_event_name: 'Stop' })
+    expect(turnStartedAt(server)).toEqual(expect.any(Number))
+
+    server.ingestTerminalStatus({
+      paneKey: PANE,
+      tabId: 'tab-1',
+      worktreeId: 'wt-1',
+      payload: { state: 'working', prompt: 'Rename the module', agentType: 'claude' }
+    })
+    expect(server.getStatusSnapshot()[0]).toMatchObject({ state: 'working' })
+    expect(server.getStatusSnapshot()[0]).not.toHaveProperty('turnStartedAt')
+  })
+
+  it('cannot be declared by a producer', async () => {
+    const server = await startServer()
+    await post(server, {
+      hook_event_name: 'UserPromptSubmit',
+      prompt: 'Rename the module',
+      turnStartedAt: 1
+    })
+    await post(server, { hook_event_name: 'PreToolUse', tool_name: 'Bash', turnStartedAt: 1 })
+    expect(turnStartedAt(server)).toBeGreaterThan(1)
+  })
+
+  it('reaches the live push and survives a restart through the status file', async () => {
+    const server = await startServer()
+    const pushed: (number | undefined)[] = []
+    server.setListener((status) => pushed.push(status.turnStartedAt))
+    await post(server, { hook_event_name: 'UserPromptSubmit', prompt: 'Rename the module' })
+    await post(server, { hook_event_name: 'PreToolUse', tool_name: 'Bash', tool_input: {} })
+    const started = turnStartedAt(server)
+    expect(pushed.at(-1)).toBe(started)
+    server.flushStatusPersistSync()
+    server.stop()
+    const file = JSON.parse(
+      readFileSync(join(userDataPath, 'agent-hooks', 'last-status.json'), 'utf8')
+    )
+    expect(file.entries[PANE].turnStartedAt).toBe(started)
+
+    const restarted = await startServer()
+    expect(restarted.getStatusSnapshot()[0]).toMatchObject({
+      restoredUnconfirmed: true,
+      turnStartedAt: started
+    })
+    // The turn goes on after the restart: the next event carries the restored stamp.
+    await post(restarted, { hook_event_name: 'PostToolUse', tool_name: 'Bash', tool_input: {} })
+    expect(turnStartedAt(restarted)).toBe(started)
+  })
+})
diff --git a/src/main/agent-hooks/server/server-ingest-structured.ts b/src/main/agent-hooks/server/server-ingest-structured.ts
index 5a5e2ce5ecf..19ee70e88af 100644
--- a/src/main/agent-hooks/server/server-ingest-structured.ts
+++ b/src/main/agent-hooks/server/server-ingest-structured.ts
@@ -11,7 +11,8 @@ import {
 } from '../../../shared/structured-agent-session-projection'
 import {
   continueMainAgentStatus,
-  isAgentStatusHeldOpenByChildWork
+  isAgentStatusHeldOpenByChildWork,
+  mainAgentTurnInterrupted
 } from '../../../shared/agent-lead-status-fold'
 import { structuredAgentSessionAgentStatus } from '../../../shared/structured-agent-session-agent-status'
 import {
@@ -73,6 +74,8 @@ export abstract class AgentHookServerIngestStructured extends AgentHookServerIng
       state,
       ...(workingMode ? { workingMode } : {}),
       mainAgent,
+      // Readers that predate `mainAgent` read a cancellation off this flag, as the hook lanes publish it.
+      interrupted: mainAgentTurnInterrupted(mainAgent),
       prompt: summary.latestPrompt,
       agentType: summary.agent,
       ...(summary.model ? { model: summary.model } : {}),
diff --git a/src/main/agent-hooks/server/server-persistence-validation.ts b/src/main/agent-hooks/server/server-persistence-validation.ts
index f88766217c1..7203f174a0e 100644
--- a/src/main/agent-hooks/server/server-persistence-validation.ts
+++ b/src/main/agent-hooks/server/server-persistence-validation.ts
@@ -149,6 +149,7 @@ export function sanitizeHydratedEntry(
     source === 'claude' && (record.compactTrigger === 'manual' || record.compactTrigger === 'auto')
       ? record.compactTrigger
       : undefined
+  const turnStartedAt = record.turnStartedAt
   return {
     paneKey,
     source,
@@ -170,7 +171,10 @@ export function sanitizeHydratedEntry(
     retainedForLiveness: retainedForLiveness ? true : undefined,
     payload,
     receivedAt,
-    stateStartedAt
+    stateStartedAt,
+    ...(typeof turnStartedAt === 'number' && Number.isFinite(turnStartedAt) && turnStartedAt > 0
+      ? { turnStartedAt }
+      : {})
   }
 }
 
diff --git a/src/main/agent-hooks/server/server-row-ownership.test.ts b/src/main/agent-hooks/server/server-row-ownership.test.ts
new file mode 100644
index 00000000000..e466ef879d2
--- /dev/null
+++ b/src/main/agent-hooks/server/server-row-ownership.test.ts
@@ -0,0 +1,142 @@
+import { describe, expect, it } from 'vitest'
+import { AgentHookServer } from '../server'
+import type { AgentHookStatusRowMutation, EnrichedAgentHookEventPayload } from './server-types'
+
+const PANE_KEY = 'tab-row:55555555-5555-4555-8555-555555555555'
+
+class RowMutationProbe extends AgentHookServer {
+  readonly mutations: AgentHookStatusRowMutation[] = []
+
+  constructor() {
+    super()
+    this.subscribeStatusRowMutations((mutation) => this.mutations.push(mutation))
+  }
+
+  commit(
+    before: EnrichedAgentHookEventPayload | null | undefined,
+    after: EnrichedAgentHookEventPayload | null | undefined
+  ): boolean {
+    return this.commitStatusRowMutation(before, after)
+  }
+}
+
+function row(
+  overrides: Partial<EnrichedAgentHookEventPayload> = {}
+): EnrichedAgentHookEventPayload {
+  return {
+    paneKey: PANE_KEY,
+    tabId: 'tab-row',
+    worktreeId: 'worktree',
+    connectionId: null,
+    receivedAt: 1_000,
+    stateStartedAt: 900,
+    terminalHandle: 'term_row',
+    ...overrides,
+    payload: {
+      state: 'working',
+      prompt: 'ship it',
+      agentType: 'opencode',
+      lastAssistantMessage: 'x'.repeat(8_000),
+      subagents: [{ id: 'child-1', state: 'working', agentType: 'claude', startedAt: 800 }],
+      ...overrides.payload
+    }
+  }
+}
+
+describe('status-row change detection', () => {
+  it('treats the same row object on both sides as unchanged', () => {
+    const probe = new RowMutationProbe()
+    const same = row()
+    expect(probe.commit(same, same)).toBe(false)
+    expect(probe.commit(null, undefined)).toBe(false)
+    expect(probe.mutations).toEqual([])
+  })
+
+  it('ignores a rebuilt row whose published content is identical', () => {
+    const probe = new RowMutationProbe()
+    const before = row()
+    const rebuilt = row({
+      receivedAt: 2_000,
+      evidenceObservedAt: 1_500,
+      launchToken: 'launch-2',
+      promptInteractionKey: 'turn-2',
+      observation: {
+        origin: 'hook',
+        authorityId: 'authority',
+        incarnation: 1,
+        revision: 7,
+        observedAt: 2_000
+      },
+      payload: { ...before.payload, subagents: before.payload.subagents?.map((s) => ({ ...s })) }
+    })
+    expect(probe.commit(before, rebuilt)).toBe(false)
+    expect(probe.mutations).toEqual([])
+  })
+
+  it('ignores key order, which a producer is free to change', () => {
+    const probe = new RowMutationProbe()
+    const before = row()
+    const reordered: EnrichedAgentHookEventPayload = {
+      payload: {
+        subagents: before.payload.subagents?.map((s) => ({ ...s })),
+        lastAssistantMessage: before.payload.lastAssistantMessage,
+        agentType: before.payload.agentType,
+        prompt: before.payload.prompt,
+        state: before.payload.state
+      },
+      terminalHandle: before.terminalHandle,
+      stateStartedAt: before.stateStartedAt,
+      receivedAt: before.receivedAt,
+      connectionId: before.connectionId,
+      worktreeId: before.worktreeId,
+      tabId: before.tabId,
+      paneKey: before.paneKey
+    }
+    expect(probe.commit(before, reordered)).toBe(false)
+  })
+
+  // Why: paired clients read the whole payload off session.tabs, so no field may be skipped.
+  it.each<[string, Partial<EnrichedAgentHookEventPayload>]>([
+    ['state', { payload: { state: 'done', prompt: 'ship it' } }],
+    [
+      'lastAssistantMessage',
+      { payload: { state: 'working', prompt: 'ship it', lastAssistantMessage: 'y' } }
+    ],
+    [
+      'subagents',
+      {
+        payload: {
+          state: 'working',
+          prompt: 'ship it',
+          subagents: [{ id: 'child-1', state: 'idle', agentType: 'claude', startedAt: 800 }]
+        }
+      }
+    ],
+    [
+      'a newly present payload field',
+      { payload: { state: 'working', prompt: 'ship it', model: 'm' } }
+    ],
+    ['stateStartedAt', { stateStartedAt: 950 }],
+    ['connectionId', { connectionId: 'ssh-a' }],
+    ['terminalHandle', { terminalHandle: 'term_other' }],
+    ['providerSession', { providerSession: { key: 'session_id', id: 's-1' } }],
+    ['structuredHost', { structuredHost: 'owned' }]
+  ])('publishes a change to %s', (_field, overrides) => {
+    const probe = new RowMutationProbe()
+    const before = row()
+    expect(probe.commit(before, row(overrides))).toBe(true)
+    expect(probe.mutations).toEqual([
+      {
+        before: { paneKey: PANE_KEY, worktreeId: 'worktree', terminalHandle: 'term_row' },
+        after: expect.objectContaining({ paneKey: PANE_KEY })
+      }
+    ])
+  })
+
+  it('publishes a row appearing or disappearing', () => {
+    const probe = new RowMutationProbe()
+    expect(probe.commit(null, row())).toBe(true)
+    expect(probe.commit(row(), undefined)).toBe(true)
+    expect(probe.mutations).toHaveLength(2)
+  })
+})
diff --git a/src/main/agent-hooks/server/server-row-ownership.ts b/src/main/agent-hooks/server/server-row-ownership.ts
index 2895eb463e4..cde178e335d 100644
--- a/src/main/agent-hooks/server/server-row-ownership.ts
+++ b/src/main/agent-hooks/server/server-row-ownership.ts
@@ -4,6 +4,7 @@ import {
 } from '../../../shared/wsl-hook-relay-contract'
 import { splitWorktreeIdForFilesystem, worktreeIdsEqual } from '../../../shared/worktree/id'
 import { parseWslUncPath } from '../../../shared/wsl-paths'
+import { structuralValuesEqualIgnoringUndefined } from '../../../shared/structural-value-equality'
 import type { AgentHookEventPayload } from '../../../shared/agent-hook-listener/listener-event'
 import type {
   AgentHookStatusRowIdentity,
@@ -27,10 +28,7 @@ function toMutationIdentity(
   }
 }
 
-function semanticRowJson(row: EnrichedAgentHookEventPayload | null | undefined): string | null {
-  if (!row) {
-    return null
-  }
+function semanticRow(row: EnrichedAgentHookEventPayload): Record<string, unknown> {
   const {
     receivedAt: _receivedAt,
     evidenceObservedAt: _evidenceObservedAt,
@@ -39,7 +37,22 @@ function semanticRowJson(row: EnrichedAgentHookEventPayload | null | undefined):
     promptInteractionKey: _promptInteractionKey,
     ...semantic
   } = toAgentStatusIpcPayload(row)
-  return JSON.stringify(semantic)
+  return semantic
+}
+
+// Why: runs on every status write; a structural walk exits on the first difference and skips
+// shared leaves (e.g. an unchanged 8 KB lastAssistantMessage) instead of serializing both rows.
+function semanticRowsEqual(
+  before: EnrichedAgentHookEventPayload | null | undefined,
+  after: EnrichedAgentHookEventPayload | null | undefined
+): boolean {
+  if (before === after || (!before && !after)) {
+    return true
+  }
+  if (!before || !after) {
+    return false
+  }
+  return structuralValuesEqualIgnoringUndefined(semanticRow(before), semanticRow(after))
 }
 
 function wslDistroForWorktree(worktreeId: string | undefined): string | null {
@@ -113,7 +126,7 @@ export abstract class AgentHookServerRowOwnership extends AgentHookServerListene
     if (after?.terminalHandle) {
       this.paneKeyByTerminalHandle.set(after.terminalHandle, after.paneKey)
     }
-    if (!emit || semanticRowJson(before) === semanticRowJson(after)) {
+    if (!emit || semanticRowsEqual(before, after)) {
       return false
     }
     const mutation: AgentHookStatusRowMutation = {
diff --git a/src/main/agent-hooks/server/server-status-application.ts b/src/main/agent-hooks/server/server-status-application.ts
index 8863dc178b9..674fa8a0760 100644
--- a/src/main/agent-hooks/server/server-status-application.ts
+++ b/src/main/agent-hooks/server/server-status-application.ts
@@ -10,6 +10,7 @@ import type {
   AgentStatusObservationOrigin
 } from '../../../shared/agent-status-observation'
 import { AGENT_STATUS_2A_CURRENT_PRODUCER_MODE } from '../../../shared/agent-status-legacy-adapter'
+import type { AgentStatusState, ParsedAgentStatusPayload } from '../../../shared/agent-status-types'
 import { admitLegacyAgentStatus } from '../../../shared/agent-hook-listener/listener-state'
 import type { EnrichedAgentHookEventPayload } from './server-types'
 import { agentTypeToPromptSentAgentKind } from './server-status-identity'
@@ -18,6 +19,41 @@ import { AgentHookServerStatusDisposition } from './server-status-disposition'
 /** Bounds the retained observation clock; eviction only degrades a replay to `now`. */
 const MAX_REMEMBERED_EVIDENCE_OBSERVATIONS = 1024
 
+function mainAgentState(payload: ParsedAgentStatusPayload): AgentStatusState {
+  return payload.mainAgent?.state ?? payload.state
+}
+
+/**
+ * When the main agent's current turn began. Its own turn-opening event stamps it (the same
+ * classifier the observation boundary uses), except a session boundary, which lands idle with no
+ * turn open. Replays, child events and identity-only rows restate a turn rather than open one.
+ */
+function resolveTurnStartedAt(
+  previous: EnrichedAgentHookEventPayload | undefined,
+  payload: AgentHookEventPayload,
+  at: number
+): number | undefined {
+  if (
+    payload.source !== undefined &&
+    payload.toolAgentId === undefined &&
+    payload.isReplay !== true &&
+    payload.providerSessionOnly !== true &&
+    isNewTurnEvent(payload.source, payload.hookEventName)
+  ) {
+    return payload.payload.sessionBoundary === true ? undefined : at
+  }
+  // Why: a settled main agent running again with no opening event (an OSC repaint racing the
+  // prompt hook) is a turn edge nothing dated; carrying the old stamp would count from that turn.
+  if (
+    previous &&
+    mainAgentState(previous.payload) === 'done' &&
+    mainAgentState(payload.payload) !== 'done'
+  ) {
+    return undefined
+  }
+  return previous?.turnStartedAt
+}
+
 export abstract class AgentHookServerStatusApplication extends AgentHookServerStatusDisposition {
   protected refreshTerminalStatusEvidence(
     previous: EnrichedAgentHookEventPayload,
@@ -113,12 +149,15 @@ export abstract class AgentHookServerStatusApplication extends AgentHookServerSt
       previous && previous.payload.state === payload.payload.state && !commandCodeNewTurn
         ? previous.stateStartedAt
         : (observedAt ?? now)
+    const turnStartedAt = resolveTurnStartedAt(previous, payload, observedAt ?? now)
     // Why: `stateStartedAt` tracks the current state, while `receivedAt` tracks every arrival.
     return {
       ...payload,
       receivedAt: now,
       evidenceObservedAt: observedAt ?? this.resolveEvidenceObservedAt(payload, previous, now),
-      stateStartedAt
+      stateStartedAt,
+      // Always written here, so a producer can never declare it.
+      turnStartedAt
     }
   }
 
diff --git a/src/main/agent-hooks/server/server-status-identity.ts b/src/main/agent-hooks/server/server-status-identity.ts
index 1694c4b1b67..4400b43efee 100644
--- a/src/main/agent-hooks/server/server-status-identity.ts
+++ b/src/main/agent-hooks/server/server-status-identity.ts
@@ -63,6 +63,7 @@ export function toAgentStatusIpcPayload(
       ? { evidenceObservedAt: entry.evidenceObservedAt }
       : {}),
     stateStartedAt: entry.stateStartedAt,
+    ...(entry.turnStartedAt !== undefined ? { turnStartedAt: entry.turnStartedAt } : {}),
     ...(entry.providerSession ? { providerSession: entry.providerSession } : {}),
     ...(entry.providerSessionOnly ? { providerSessionOnly: true } : {}),
     ...(entry.promptInteractionKey ? { promptInteractionKey: entry.promptInteractionKey } : {}),
diff --git a/src/main/agent-hooks/server/server-types.ts b/src/main/agent-hooks/server/server-types.ts
index d1466797798..79b4e569cdd 100644
--- a/src/main/agent-hooks/server/server-types.ts
+++ b/src/main/agent-hooks/server/server-types.ts
@@ -19,6 +19,9 @@ export type EnrichedAgentHookEventPayload = AgentHookEventPayload & {
    *  main restart; absent means "never separately observed" and consumers use `receivedAt`. */
   evidenceObservedAt?: number
   stateStartedAt: number
+  /** When the main agent's current turn began, on this server's clock. Stamped only here, from the
+   *  main agent's own turn-opening event; absent when no such event was seen. */
+  turnStartedAt?: number
   /** Provenance/ordering stamped by this server as the pane authority (STA-4293). Read by nothing yet. */
   observation?: AgentStatusObservation
   /** Stamped at hydrate for nonterminal states; never persisted (hydrate re-stamps) and cleared by any accepted live event replacing the entry. */
diff --git a/src/main/agent-hooks/wsl-guest-plugin-install.ts b/src/main/agent-hooks/wsl-guest-plugin-install.ts
index 80b98bed6f4..40bf43ce024 100644
--- a/src/main/agent-hooks/wsl-guest-plugin-install.ts
+++ b/src/main/agent-hooks/wsl-guest-plugin-install.ts
@@ -4,11 +4,14 @@
 // Mirrors the SSH relay's installPluginsOnRelay swallow list.
 import type { SshChannelMultiplexer } from '../ssh/ssh-channel-multiplexer'
 import { AGENT_HOOK_INSTALL_PLUGINS_METHOD } from '../../shared/agent-hook-relay'
+import { selectOpenCodePluginSources } from './opencode-plugin-settings'
+import type { ManagedHookDetectionSettings } from './managed-hook-detection-commands'
 import type { PluginSources } from '../../relay/plugin-overlay'
 
 /** Structural, not the deps type itself, so this stays free of the deps module. */
 type GuestPluginInstallDeps = {
   pluginSources: () => PluginSources
+  managedHookSettings?: () => ManagedHookDetectionSettings
   warn: (message: string) => void
 }
 
@@ -29,7 +32,7 @@ export async function requestGuestOpenCodeOverlayDir(
   try {
     // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Runtime validation or the local test fixture establishes the asserted shape.
     const res = (await mux.request(AGENT_HOOK_INSTALL_PLUGINS_METHOD, {
-      ...deps.pluginSources(),
+      ...selectOpenCodePluginSources(deps.pluginSources(), deps.managedHookSettings?.() ?? null),
       ...(launchKind ? { launchKind } : {})
     })) as {
       overlayDirs?: { opencode?: unknown; opencode2?: unknown; pi?: unknown; omp?: unknown }
diff --git a/src/main/agent-hooks/wsl-hook-relay-guest-install.ts b/src/main/agent-hooks/wsl-hook-relay-guest-install.ts
index 103a5e9909b..87e29f2d414 100644
--- a/src/main/agent-hooks/wsl-hook-relay-guest-install.ts
+++ b/src/main/agent-hooks/wsl-hook-relay-guest-install.ts
@@ -8,6 +8,7 @@ import { requestGuestOpenCodeOverlayDir } from './wsl-guest-plugin-install'
 import { installWslGuestHooks } from './wsl-hook-fs-adapter'
 import { REINSTALL_MIN_INTERVAL_MS, type WslHookRelayManagerDeps } from './wsl-hook-relay-deps'
 import type { SshChannelMultiplexer } from '../ssh/ssh-channel-multiplexer'
+import { openCodePluginSettingsKey } from './opencode-plugin-settings'
 import type { PluginSources } from '../../relay/plugin-overlay'
 
 /** Structural slice of WslHookRelayManagerDeps — only what an install pass uses. */
@@ -30,6 +31,10 @@ type GuestInstallState = {
   piAgentDir?: string
   ompStatusExtension?: string
   lastInstallAt?: number
+  lastOpenCodeSettings?: string
+  // Failed attempts throttle retries without claiming the guest accepted those settings.
+  lastAttemptOpenCodeSettings?: string
+  lastInstallMux?: SshChannelMultiplexer
   launchKinds?: Set<'pi' | 'omp'>
   installation?: Promise<void>
 }
@@ -52,11 +57,17 @@ export async function runWslRelayGuestInstall(
   if (state.installation) {
     return state.installation
   }
-  state.installation = installGuestHooksAndPlugins(deps, state, mux, guestHome)
+  // Publish ownership before an installer can re-enter the ensure path.
+  const installation = Promise.resolve().then(() =>
+    installGuestHooksAndPlugins(deps, state, mux, guestHome)
+  )
+  state.installation = installation
   try {
-    await state.installation
+    await installation
   } finally {
-    state.installation = undefined
+    if (state.installation === installation) {
+      state.installation = undefined
+    }
   }
 }
 
@@ -66,7 +77,15 @@ async function installGuestHooksAndPlugins(
   mux: SshChannelMultiplexer,
   guestHome: string
 ): Promise<void> {
+  if (state.mux !== mux || mux.isDisposed()) {
+    return
+  }
+  if (state.lastInstallMux !== mux) {
+    state.lastOpenCodeSettings = undefined
+  }
+  state.lastInstallMux = mux
   state.lastInstallAt = Date.now()
+  state.lastAttemptOpenCodeSettings = openCodePluginSettingsKey(deps.managedHookSettings())
   await installWslGuestHooks({
     mux,
     guestHome,
@@ -81,11 +100,27 @@ async function installGuestHooksAndPlugins(
   // PTY env points OPENCODE_CONFIG_DIR at; identity-guarded against teardown.
   const kinds = requestedKinds(state)
   for (const kind of kinds) {
-    const overlay = await requestGuestOpenCodeOverlayDir(mux, deps, state.distro, kind)
-    if (state.mux !== mux) {
+    if (state.mux !== mux || mux.isDisposed()) {
+      return
+    }
+    const currentSettings = deps.managedHookSettings()
+    const settings = currentSettings && {
+      ...currentSettings,
+      disabledTuiAgents: currentSettings.disabledTuiAgents?.slice()
+    }
+    const settingsKey = openCodePluginSettingsKey(settings)
+    state.lastAttemptOpenCodeSettings = settingsKey
+    const overlay = await requestGuestOpenCodeOverlayDir(
+      mux,
+      { ...deps, managedHookSettings: () => settings },
+      state.distro,
+      kind
+    )
+    if (state.mux !== mux || mux.isDisposed()) {
       return
     }
     if (overlay.kind !== 'unavailable') {
+      state.lastOpenCodeSettings = settingsKey
       state.opencodeOverlayDir = overlay.kind === 'dir' ? overlay.dir : undefined
       state.opencode2OverlayDir = overlay.kind === 'dir' ? overlay.dir2 : undefined
       if (kind === 'pi') {
@@ -102,25 +137,34 @@ export async function maybeRerunWslRelayGuestInstall(
   deps: GuestInstallDeps,
   state: GuestInstallState
 ): Promise<void> {
-  if (state.installation) {
-    await state.installation
-    return
-  }
-  const mux = state.mux
-  const guestHome = state.guestHome
-  if (
-    !mux ||
-    !guestHome ||
-    mux.isDisposed() ||
-    Date.now() - (state.lastInstallAt ?? 0) < REINSTALL_MIN_INTERVAL_MS
-  ) {
-    return
-  }
-  try {
-    // Why: the pass also re-ships the plugin source, so a mid-session Orca upgrade refreshes it.
-    await runWslRelayGuestInstall(deps, state, mux, guestHome)
-  } catch (err) {
-    const detail = err instanceof Error ? err.message : String(err)
-    deps.warn(`[agent-hooks] WSL hook reinstall for '${state.distro}' failed: ${detail}`)
+  let waited = false
+  // Every settled pass can expose newer settings or another waiter's task.
+  for (;;) {
+    try {
+      if (state.installation) {
+        waited = true
+        await state.installation
+        continue
+      }
+      const mux = state.mux
+      const guestHome = state.guestHome
+      const settingsKey = openCodePluginSettingsKey(deps.managedHookSettings())
+      if (
+        !mux ||
+        !guestHome ||
+        mux.isDisposed() ||
+        (state.lastInstallMux === mux &&
+          (waited || Date.now() - (state.lastInstallAt ?? 0) < REINSTALL_MIN_INTERVAL_MS) &&
+          (state.lastOpenCodeSettings === settingsKey ||
+            state.lastAttemptOpenCodeSettings === settingsKey))
+      ) {
+        return
+      }
+      waited = true
+      await runWslRelayGuestInstall(deps, state, mux, guestHome)
+    } catch (err) {
+      const detail = err instanceof Error ? err.message : String(err)
+      deps.warn(`[agent-hooks] WSL hook reinstall for '${state.distro}' failed: ${detail}`)
+    }
   }
 }
diff --git a/src/main/agent-hooks/wsl-hook-relay-sentinel.test.ts b/src/main/agent-hooks/wsl-hook-relay-sentinel.test.ts
index d8f504beca3..d23d59288b4 100644
--- a/src/main/agent-hooks/wsl-hook-relay-sentinel.test.ts
+++ b/src/main/agent-hooks/wsl-hook-relay-sentinel.test.ts
@@ -81,8 +81,6 @@ describe('waitForWslRelaySentinel', () => {
     emitStdout(child, sentinel.subarray(0, mid))
     emitStdout(child, sentinel.subarray(mid))
     const transport = await promise
-    expect(typeof transport.write).toBe('function')
-    expect(typeof transport.onData).toBe('function')
     transport.pauseReads?.()
     transport.resumeReads?.()
     expect(child.stdout.pause).toHaveBeenCalledOnce()
diff --git a/src/main/agent-hooks/wsl-hook-relay-state.ts b/src/main/agent-hooks/wsl-hook-relay-state.ts
index 509231b97d9..2648280addd 100644
--- a/src/main/agent-hooks/wsl-hook-relay-state.ts
+++ b/src/main/agent-hooks/wsl-hook-relay-state.ts
@@ -21,4 +21,7 @@ export type WslRelayDistroState = {
   restartTimer?: ReturnType<typeof setTimeout>
   reinstallTimer?: ReturnType<typeof setTimeout>
   lastInstallAt?: number
+  lastOpenCodeSettings?: string
+  lastAttemptOpenCodeSettings?: string
+  lastInstallMux?: SshChannelMultiplexer
 }
diff --git a/src/main/agent-hooks/wsl-opencode-install-race.test.ts b/src/main/agent-hooks/wsl-opencode-install-race.test.ts
new file mode 100644
index 00000000000..ccb8e79a445
--- /dev/null
+++ b/src/main/agent-hooks/wsl-opencode-install-race.test.ts
@@ -0,0 +1,326 @@
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import type { TuiAgent } from '../../shared/tui-agent'
+import { RelayDispatcher } from '../../relay/dispatcher'
+import { PluginOverlayManager } from '../../relay/plugin-overlay'
+import { createInstallPluginsHandler } from '../../relay/wsl-install-plugins-handler'
+import { SshChannelMultiplexer } from '../ssh/ssh-channel-multiplexer'
+import { AGENT_HOOK_INSTALL_PLUGINS_METHOD } from '../../shared/agent-hook-relay'
+import {
+  maybeRerunWslRelayGuestInstall,
+  runWslRelayGuestInstall
+} from './wsl-hook-relay-guest-install'
+import type { WslRelayDistroState } from './wsl-hook-relay-state'
+import { REINSTALL_MIN_INTERVAL_MS } from './wsl-hook-relay-deps'
+
+function heldRequest() {
+  const reached = Promise.withResolvers<void>()
+  const release = Promise.withResolvers<void>()
+  return {
+    reached: reached.promise,
+    release: release.resolve,
+    wait: async () => {
+      reached.resolve()
+      await release.promise
+    }
+  }
+}
+
+let root: string
+let state: WslRelayDistroState
+let settings: { disabledTuiAgents: TuiAgent[] }
+let guests: { mux: SshChannelMultiplexer; dispatcher: RelayDispatcher }[]
+const sources = { opencodePluginSource: '// v1', opencode2PluginSource: '// v2' }
+const deps = {
+  pluginSources: () => sources,
+  managedHookSettings: () => settings,
+  installHooks: vi.fn(async () => []),
+  installCodex: async () => null,
+  warn: vi.fn<(message: string) => void>()
+}
+
+function createGuest(name: string, beforeInstall?: (index: number) => Promise<void>) {
+  const home = join(root, name)
+  mkdirSync(join(home, '.config', 'opencode'), { recursive: true })
+  const callbacks: ((data: Buffer) => void)[] = []
+  const dispatcher = new RelayDispatcher((data) => callbacks.forEach((callback) => callback(data)))
+  const mux = new SshChannelMultiplexer({
+    write: (data) => dispatcher.feed(data),
+    onData: (callback) => {
+      callbacks.push(callback)
+    },
+    onClose: () => {}
+  })
+  const install = createInstallPluginsHandler(new PluginOverlayManager({ homeDir: home }), {
+    HOME: home,
+    XDG_CONFIG_HOME: join(home, '.config'),
+    ORCA_WSL_HOOK_INSTANCE: name
+  })
+  const requests: Record<string, unknown>[] = []
+  dispatcher.onRequest('preflight.detectAgents', async () => ({ agents: [] }))
+  dispatcher.onRequest(AGENT_HOOK_INSTALL_PLUGINS_METHOD, async (params) => {
+    requests.push(params)
+    await beforeInstall?.(requests.length)
+    return install(params)
+  })
+  const guest = { home, mux, dispatcher, requests }
+  guests.push(guest)
+  return guest
+}
+
+function connect(guest: ReturnType<typeof createGuest>) {
+  state.mux = guest.mux
+  state.guestHome = guest.home
+}
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'orca-wsl-install-race-'))
+  guests = []
+  settings = { disabledTuiAgents: [] }
+  deps.installHooks.mockReset().mockResolvedValue([])
+  deps.warn.mockReset()
+  state = {
+    distro: 'fixture',
+    phase: 'running',
+    launchKinds: new Set(),
+    failures: 0,
+    cooldownUntil: 0
+  }
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const guest of guests) {
+    guest.mux.dispose()
+    guest.dispatcher.dispose()
+  }
+  rmSync(root, { recursive: true, force: true })
+})
+
+it.each([true, false])('coalesces waiters through a held %s enablement toggle', async (enabled) => {
+  const first = heldRequest()
+  const second = heldRequest()
+  const guest = createGuest('guest', (index) => (index === 1 ? first.wait() : second.wait()))
+  connect(guest)
+  settings.disabledTuiAgents = enabled ? [] : ['opencode', 'opencode2']
+  const initial = runWslRelayGuestInstall(deps, state, guest.mux, guest.home)
+  await first.reached
+  settings.disabledTuiAgents = enabled ? ['opencode', 'opencode2'] : []
+  let settled = 0
+  const waiters = Array.from({ length: 4 }, () =>
+    maybeRerunWslRelayGuestInstall(deps, state).then(() => {
+      settled++
+    })
+  )
+  first.release()
+  await vi.waitFor(() => expect(guest.requests).toHaveLength(2), { timeout: 1000 })
+  await second.reached
+  expect(settled).toBe(0)
+  expect(guest.requests).toHaveLength(2)
+  second.release()
+  await Promise.all([initial, ...waiters])
+  expect(guest.requests).toHaveLength(2)
+  expect(guest.requests[1]).toMatchObject(
+    enabled ? { opencodePluginSource: '', opencode2PluginSource: '' } : sources
+  )
+  if (enabled) {
+    expect(state.opencodeOverlayDir).toBeUndefined()
+    expect(state.opencode2OverlayDir).toBeUndefined()
+  } else {
+    expect(
+      readFileSync(join(state.opencodeOverlayDir!, 'plugins', 'orca-opencode-status.js'), 'utf8')
+    ).toBe('// v1')
+    expect(
+      readFileSync(join(state.opencode2OverlayDir!, 'plugins', 'orca-opencode2-status.js'), 'utf8')
+    ).toBe('// v2')
+  }
+  await maybeRerunWslRelayGuestInstall(deps, state)
+  expect(guest.requests).toHaveLength(2)
+  expect(state.installation).toBeUndefined()
+})
+
+it('drains reentrant toggles during successive requests without duplicate passes', async () => {
+  const waiters: Promise<void>[] = []
+  const guest = createGuest('guest', async (index) => {
+    if (index <= 2) {
+      settings.disabledTuiAgents = index === 1 ? ['opencode'] : ['opencode', 'opencode2']
+      waiters.push(maybeRerunWslRelayGuestInstall(deps, state))
+    }
+  })
+  connect(guest)
+  await maybeRerunWslRelayGuestInstall(deps, state)
+  await Promise.all(waiters)
+  expect(
+    guest.requests.map((params) => [params.opencodePluginSource, params.opencode2PluginSource])
+  ).toEqual([
+    ['// v1', '// v2'],
+    ['', '// v2'],
+    ['', '']
+  ])
+  expect(state.opencodeOverlayDir).toBeUndefined()
+  expect(state.opencode2OverlayDir).toBeUndefined()
+})
+
+it('does not reinstall for rapid toggles that return to the in-flight settings', async () => {
+  const held = heldRequest()
+  const guest = createGuest('guest', () => held.wait())
+  connect(guest)
+  const initial = runWslRelayGuestInstall(deps, state, guest.mux, guest.home)
+  await held.reached
+  settings.disabledTuiAgents = ['opencode', 'opencode2']
+  const disabled = maybeRerunWslRelayGuestInstall(deps, state)
+  settings.disabledTuiAgents = []
+  const enabled = maybeRerunWslRelayGuestInstall(deps, state)
+  held.release()
+  await Promise.all([initial, disabled, enabled])
+  expect(guest.requests).toHaveLength(1)
+  expect(state.opencodeOverlayDir).toBeTruthy()
+  expect(state.opencode2OverlayDir).toBeTruthy()
+})
+
+it('coalesces an ensure re-entering before the first asynchronous hook operation', async () => {
+  const guest = createGuest('guest')
+  connect(guest)
+  const waiters: Promise<void>[] = []
+  vi.spyOn(deps, 'managedHookSettings').mockImplementationOnce(() => {
+    waiters.push(maybeRerunWslRelayGuestInstall(deps, state))
+    return settings
+  })
+  await runWslRelayGuestInstall(deps, state, guest.mux, guest.home)
+  await Promise.all(waiters)
+  expect(guest.requests).toHaveLength(1)
+  expect(state.opencodeOverlayDir).toBeTruthy()
+})
+
+it('finishes a slow pass once, leaving time-based refresh to a later ensure', async () => {
+  let now = Date.now()
+  vi.spyOn(Date, 'now').mockImplementation(() => now)
+  const held = heldRequest()
+  const guest = createGuest('guest', async (index) => {
+    if (index === 1) {
+      await held.wait()
+    }
+  })
+  connect(guest)
+  const initial = maybeRerunWslRelayGuestInstall(deps, state)
+  await held.reached
+  now += REINSTALL_MIN_INTERVAL_MS + 1
+  held.release()
+  await initial
+  expect(guest.requests).toHaveLength(1)
+  await maybeRerunWslRelayGuestInstall(deps, state)
+  expect(guest.requests).toHaveLength(2)
+})
+
+it.each([true, false])(
+  'handles a rejected joined task with changed settings %s',
+  async (changed) => {
+    const reached = Promise.withResolvers<void>()
+    const rejected = Promise.withResolvers<void>()
+    const guest = createGuest('guest')
+    connect(guest)
+    guest.dispatcher.onRequest('preflight.detectAgents', async () => ({ agents: ['claude'] }))
+    deps.installHooks.mockImplementationOnce(async () => {
+      reached.resolve()
+      await rejected.promise
+      return []
+    })
+    const initial = runWslRelayGuestInstall(deps, state, guest.mux, guest.home).catch(
+      (error) => error
+    )
+    await reached.promise
+    if (changed) {
+      settings.disabledTuiAgents = ['opencode', 'opencode2']
+    }
+    const waiter = maybeRerunWslRelayGuestInstall(deps, state)
+    rejected.reject(new Error('fixture installation failed'))
+    expect(await initial).toMatchObject({ message: 'fixture installation failed' })
+    await waiter
+    expect(deps.warn).toHaveBeenCalledWith(expect.stringContaining('fixture installation failed'))
+    expect(guest.requests).toHaveLength(changed ? 1 : 0)
+    if (changed) {
+      expect(guest.requests[0]).toMatchObject({
+        opencodePluginSource: '',
+        opencode2PluginSource: ''
+      })
+    }
+    expect(state.installation).toBeUndefined()
+    expect(state.opencodeOverlayDir).toBeUndefined()
+  }
+)
+
+it('does not publish a held response or reinstall after ownership is removed', async () => {
+  const held = heldRequest()
+  const guest = createGuest('retired', () => held.wait())
+  connect(guest)
+  const initial = runWslRelayGuestInstall(deps, state, guest.mux, guest.home)
+  await held.reached
+  settings.disabledTuiAgents = ['opencode', 'opencode2']
+  const waiter = maybeRerunWslRelayGuestInstall(deps, state)
+  state.mux = undefined
+  held.release()
+  await Promise.all([initial, waiter])
+  expect(guest.requests).toHaveLength(1)
+  expect(state.opencodeOverlayDir).toBeUndefined()
+  expect(state.opencode2OverlayDir).toBeUndefined()
+})
+
+it('leaves the replacement task and its paths owned by the new mux', async () => {
+  const oldHeld = heldRequest()
+  const nextHeld = heldRequest()
+  const old = createGuest('old', () => oldHeld.wait())
+  connect(old)
+  const initial = runWslRelayGuestInstall(deps, state, old.mux, old.home)
+  await oldHeld.reached
+  const waiter = maybeRerunWslRelayGuestInstall(deps, state)
+  const next = createGuest('next', () => nextHeld.wait())
+  connect(next)
+  state.installation = undefined
+  const replacement = runWslRelayGuestInstall(deps, state, next.mux, next.home)
+  await nextHeld.reached
+  const ownedTask = state.installation
+  oldHeld.release()
+  await initial
+  expect(state.installation).toBe(ownedTask)
+  expect(state.opencodeOverlayDir).toBeUndefined()
+  expect(state.opencode2OverlayDir).toBeUndefined()
+  nextHeld.release()
+  await Promise.all([waiter, replacement])
+  expect(state.opencodeOverlayDir).toContain(next.home)
+  expect(state.opencode2OverlayDir).toContain(next.home)
+  expect(old.requests).toHaveLength(1)
+  expect(next.requests).toHaveLength(1)
+})
+
+it('does not dispatch plugins after teardown during hook detection', async () => {
+  const held = heldRequest()
+  const guest = createGuest('retired')
+  connect(guest)
+  guest.dispatcher.onRequest('preflight.detectAgents', async () => {
+    await held.wait()
+    return { agents: [] }
+  })
+  const initial = runWslRelayGuestInstall(deps, state, guest.mux, guest.home)
+  await held.reached
+  state.mux = undefined
+  held.release()
+  await initial
+  expect(guest.requests).toHaveLength(0)
+  expect(state.opencodeOverlayDir).toBeUndefined()
+})
+
+it('does not dispatch a recheck on a disposed mux', async () => {
+  const held = heldRequest()
+  const guest = createGuest('disposed', () => held.wait())
+  connect(guest)
+  const initial = runWslRelayGuestInstall(deps, state, guest.mux, guest.home)
+  await held.reached
+  settings.disabledTuiAgents = ['opencode', 'opencode2']
+  const waiter = maybeRerunWslRelayGuestInstall(deps, state)
+  guest.mux.dispose()
+  held.release()
+  await Promise.all([initial, waiter])
+  expect(guest.requests).toHaveLength(1)
+  expect(state.opencodeOverlayDir).toBeUndefined()
+})
diff --git a/src/main/agent-hooks/wsl-opencode-settings-lifetime.test.ts b/src/main/agent-hooks/wsl-opencode-settings-lifetime.test.ts
new file mode 100644
index 00000000000..29cf139ace5
--- /dev/null
+++ b/src/main/agent-hooks/wsl-opencode-settings-lifetime.test.ts
@@ -0,0 +1,353 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { EventEmitter } from 'node:events'
+import type { ChildProcessWithoutNullStreams } from 'node:child_process'
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { RelayDispatcher } from '../../relay/dispatcher'
+import { PluginOverlayManager } from '../../relay/plugin-overlay'
+import { createInstallPluginsHandler } from '../../relay/wsl-install-plugins-handler'
+import { WslHookRelayManager } from './wsl-hook-relay-manager'
+import { REINSTALL_MIN_INTERVAL_MS } from './wsl-hook-relay-deps'
+import type { MultiplexerTransport } from '../ssh/ssh-channel-multiplexer'
+import type { TuiAgent } from '../../shared/tui-agent'
+import {
+  AGENT_HOOK_INSTALL_PLUGINS_METHOD,
+  AGENT_HOOK_REQUEST_REPLAY_METHOD
+} from '../../shared/agent-hook-relay'
+import { WSL_HOOK_FS_METHODS } from '../../shared/wsl-hook-relay-contract'
+
+function gate() {
+  const reached = Promise.withResolvers<void>()
+  const release = Promise.withResolvers<void>()
+  return {
+    reached: reached.promise,
+    release: release.resolve,
+    wait: async () => {
+      reached.resolve()
+      await release.promise
+    }
+  }
+}
+
+function fakeChild(): ChildProcessWithoutNullStreams {
+  const child = Object.assign(new EventEmitter(), {
+    stdout: new EventEmitter(),
+    stderr: new EventEmitter(),
+    stdin: { write: () => true, end: () => {}, on: () => {} },
+    kill: () => true
+  })
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The injected launcher and link only use these emitter, stream, and kill members; no process is spawned.
+  return child as unknown as ChildProcessWithoutNullStreams
+}
+
+// Guest materialization uses POSIX home semantics; native Windows needs the WSL rig.
+describe.skipIf(process.platform === 'win32')('WSL public-manager settings lifetime', () => {
+  let root: string
+  let manager: WslHookRelayManager
+  let guests: ReturnType<typeof createGuest>[]
+  let activeGuest: ReturnType<typeof createGuest>
+  let settings: { disabledTuiAgents: TuiAgent[] }
+  let requests: Record<string, unknown>[]
+  let now: number
+  let detectionCount: number
+  let hookCount: number
+  let pause: 'detect' | 'hooks' | 'plugin'
+  let rejectRequest: boolean
+  let rejectHooks: boolean
+  let onPluginRequest: ((index: number) => Promise<void>) | undefined
+  let beforeSources: ReturnType<typeof gate>
+  let pendingRequest: ReturnType<typeof gate>
+  const sources = {
+    opencodePluginSource: '// independent v1',
+    opencode2PluginSource: '// independent v2',
+    piExtensionSource: '// pi',
+    ompExtensionSource: '// omp'
+  }
+
+  function createGuest(name: string): {
+    home: string
+    transport: MultiplexerTransport
+    dispatcher: RelayDispatcher
+  } {
+    const home = join(root, name)
+    mkdirSync(join(home, '.config', 'opencode'), { recursive: true })
+    writeFileSync(join(home, '.config', 'opencode', 'opencode.json'), '{"model":"fixture"}')
+    const callbacks: ((data: Buffer) => void)[] = []
+    const transport: MultiplexerTransport = {
+      write: (data) => dispatcher.feed(data),
+      onData: (callback) => {
+        callbacks.push(callback)
+      },
+      onClose: () => {}
+    }
+    const dispatcher = new RelayDispatcher((data) =>
+      callbacks.forEach((callback) => callback(data))
+    )
+    dispatcher.onRequest(WSL_HOOK_FS_METHODS.home, async () => ({ ok: true, home }))
+    dispatcher.onRequest(AGENT_HOOK_REQUEST_REPLAY_METHOD, async () => ({ replayed: 0 }))
+    dispatcher.onRequest('preflight.detectAgents', async () => {
+      if (++detectionCount === 2 && pause === 'detect') {
+        await beforeSources.wait()
+      }
+      return { agents: ['claude'] }
+    })
+    const install = createInstallPluginsHandler(new PluginOverlayManager({ homeDir: home }), {
+      HOME: home,
+      XDG_CONFIG_HOME: join(home, '.config'),
+      ORCA_WSL_HOOK_INSTANCE: 'independent-manager'
+    })
+    dispatcher.onRequest(AGENT_HOOK_INSTALL_PLUGINS_METHOD, async (params) => {
+      requests.push(params)
+      if (onPluginRequest) {
+        await onPluginRequest(requests.length)
+      } else if (requests.length === 2) {
+        await pendingRequest.wait()
+        if (rejectRequest) {
+          throw new Error('fixture plugin request rejected')
+        }
+      }
+      return install(params)
+    })
+    const guest = { home, transport, dispatcher }
+    guests.push(guest)
+    return guest
+  }
+
+  beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), 'orca-wsl-manager-boundary-'))
+    settings = { disabledTuiAgents: [] }
+    requests = []
+    now = Date.now()
+    vi.spyOn(Date, 'now').mockImplementation(() => now)
+    rejectRequest = false
+    rejectHooks = false
+    onPluginRequest = undefined
+    detectionCount = 0
+    hookCount = 0
+    beforeSources = gate()
+    pendingRequest = gate()
+    guests = []
+    activeGuest = createGuest('first')
+    manager = new WslHookRelayManager({
+      platform: () => 'win32',
+      remoteHooksEnabled: () => true,
+      hookCoordsEnv: () => ({ ORCA_AGENT_HOOK_PORT: '43117', ORCA_AGENT_HOOK_TOKEN: 'fixture' }),
+      instanceKey: () => 'independent',
+      resolveBundle: () => ({ jsPath: join(root, 'relay.js'), version: 'fixture' }),
+      readBundle: () => Buffer.from('// fixture'),
+      listDistros: async () => ['fixture'],
+      isDistroRunning: async () => true,
+      spawnRelay: () => fakeChild(),
+      runInstall: async () => ({ code: 0, stderr: '' }),
+      waitForSentinel: async () => activeGuest.transport,
+      ingest: () => {},
+      installHooks: async () => {
+        if (++hookCount === 2 && pause === 'hooks') {
+          await beforeSources.wait()
+        }
+        if (rejectHooks) {
+          throw new Error('fixture hook failure')
+        }
+        return []
+      },
+      installCodex: async () => null,
+      managedHookSettings: () => settings,
+      pluginSources: () => sources,
+      warn: vi.fn(),
+      transientRetryDelayMs: 1
+    })
+  })
+  afterEach(() => {
+    manager.disposeAll()
+    for (const guest of guests) {
+      guest.dispatcher.dispose()
+    }
+    vi.restoreAllMocks()
+    rmSync(root, { recursive: true, force: true })
+  })
+
+  const cases = (['detect', 'hooks', 'plugin'] as const).flatMap((stage) =>
+    [true, false].flatMap((initialEnabled) =>
+      [true, false].map((toggleBack) => ({ stage, initialEnabled, toggleBack }))
+    )
+  )
+
+  it.each(cases)(
+    'manager settings across $stage: initially enabled $initialEnabled, toggle back $toggleBack',
+    async ({ stage, initialEnabled, toggleBack }) => {
+      pause = stage
+      const setEnabled = (enabled: boolean) => {
+        settings = { disabledTuiAgents: enabled ? [] : ['opencode', 'opencode2'] }
+      }
+      setEnabled(initialEnabled)
+      await manager.ensureForDistro('fixture')
+      expect(requests).toHaveLength(1)
+      now += REINSTALL_MIN_INTERVAL_MS + 1
+      const refresh = manager.ensureForDistro('fixture')
+      const waiters: Promise<void>[] = [refresh]
+      if (stage !== 'plugin') {
+        await beforeSources.reached
+        setEnabled(!initialEnabled)
+        waiters.push(manager.ensureForDistro('fixture'))
+        beforeSources.release()
+      }
+      await pendingRequest.reached
+      const sentEnabled = stage === 'plugin' ? initialEnabled : !initialEnabled
+      expect(requests[1]).toMatchObject(
+        sentEnabled
+          ? sources
+          : {
+              opencodePluginSource: '',
+              opencode2PluginSource: ''
+            }
+      )
+      if (stage === 'plugin') {
+        setEnabled(!initialEnabled)
+        waiters.push(manager.ensureForDistro('fixture'))
+      }
+      const finalEnabled = toggleBack ? initialEnabled : !initialEnabled
+      setEnabled(finalEnabled)
+      waiters.push(...Array.from({ length: 4 }, () => manager.ensureForDistro('fixture')))
+      pendingRequest.release()
+      await Promise.all(waiters)
+      expect(requests).toHaveLength(sentEnabled === finalEnabled ? 2 : 3)
+      expect(requests.at(-1)).toMatchObject(
+        finalEnabled
+          ? sources
+          : {
+              opencodePluginSource: '',
+              opencode2PluginSource: ''
+            }
+      )
+      for (const agent of ['opencode', 'opencode2'] as const) {
+        const dir = manager.getOpenCodeOverlayDir('fixture', agent)
+        if (finalEnabled) {
+          expect(dir).toBeTruthy()
+          if (!dir) {
+            throw new Error('missing enabled overlay')
+          }
+          expect(readFileSync(join(dir, 'plugins', `orca-${agent}-status.js`), 'utf8')).toBe(
+            agent === 'opencode' ? sources.opencodePluginSource : sources.opencode2PluginSource
+          )
+        } else {
+          expect(dir).toBeNull()
+        }
+      }
+      const settledCount = requests.length
+      await manager.ensureForDistro('fixture')
+      expect(requests).toHaveLength(settledCount)
+    }
+  )
+
+  it('preserves known pointers after plugin rejection without treating it as revocation', async () => {
+    pause = 'detect'
+    await manager.ensureForDistro('fixture')
+    const oldV1 = manager.getOpenCodeOverlayDir('fixture')
+    const oldV2 = manager.getOpenCodeOverlayDir('fixture', 'opencode2')
+    now += REINSTALL_MIN_INTERVAL_MS + 1
+    const refresh = manager.ensureForDistro('fixture')
+    await beforeSources.reached
+    settings = { disabledTuiAgents: ['opencode', 'opencode2'] }
+    const disabled = manager.ensureForDistro('fixture')
+    beforeSources.release()
+    await pendingRequest.reached
+    rejectRequest = true
+    settings = { disabledTuiAgents: [] }
+    const restored = manager.ensureForDistro('fixture')
+    pendingRequest.release()
+    await Promise.all([refresh, disabled, restored])
+    expect(requests).toHaveLength(2)
+    expect(manager.getOpenCodeOverlayDir('fixture')).toBe(oldV1)
+    expect(manager.getOpenCodeOverlayDir('fixture', 'opencode2')).toBe(oldV2)
+    await manager.ensureForDistro('fixture')
+    expect(requests).toHaveLength(2)
+  })
+
+  it('tracks the settings sent by successive Pi and OMP requests', async () => {
+    pause = 'plugin'
+    await manager.ensureForDistro('fixture', undefined, 'pi')
+    const secondKind = gate()
+    onPluginRequest = async (index) => {
+      if (index === 2) {
+        await pendingRequest.wait()
+      }
+      if (index === 3) {
+        await secondKind.wait()
+      }
+    }
+    const refresh = manager.ensureForDistro('fixture', undefined, 'omp')
+    await pendingRequest.reached
+    settings.disabledTuiAgents = ['opencode', 'opencode2']
+    const disabled = manager.ensureForDistro('fixture')
+    pendingRequest.release()
+    await secondKind.reached
+    expect(requests[2]).toMatchObject({
+      launchKind: 'omp',
+      opencodePluginSource: '',
+      opencode2PluginSource: ''
+    })
+    settings.disabledTuiAgents = []
+    const restored = manager.ensureForDistro('fixture')
+    secondKind.release()
+    await Promise.all([refresh, disabled, restored])
+    expect(requests.map((request) => request.launchKind)).toEqual(['pi', 'pi', 'omp', 'pi', 'omp'])
+    expect(requests.at(-1)).toMatchObject(sources)
+    expect(manager.getOpenCodeOverlayDir('fixture')).toBeTruthy()
+    expect(manager.getOpenCodeOverlayDir('fixture', 'opencode2')).toBeTruthy()
+    const pi = manager.getGuestAgentPath('fixture', 'pi')
+    const omp = manager.getGuestAgentPath('fixture', 'omp')
+    if (!pi || !omp) {
+      throw new Error('missing guest agent paths')
+    }
+    expect(readFileSync(join(pi, 'extensions', 'orca-agent-status.ts'), 'utf8')).toContain('// pi')
+    expect(readFileSync(omp, 'utf8')).toContain('// omp')
+    await manager.ensureForDistro('fixture')
+    expect(requests).toHaveLength(5)
+  })
+
+  it('bounds repeated pre-plugin failures and retries after the cooldown', async () => {
+    pause = 'hooks'
+    await manager.ensureForDistro('fixture')
+    const previous = manager.getOpenCodeOverlayDir('fixture')
+    now += REINSTALL_MIN_INTERVAL_MS + 1
+    const refresh = manager.ensureForDistro('fixture')
+    await beforeSources.reached
+    settings.disabledTuiAgents = ['opencode', 'opencode2']
+    rejectHooks = true
+    const waiters = Array.from({ length: 4 }, () => manager.ensureForDistro('fixture'))
+    beforeSources.release()
+    await Promise.all([refresh, ...waiters])
+    expect(hookCount).toBe(3)
+    expect(requests).toHaveLength(1)
+    expect(manager.getOpenCodeOverlayDir('fixture')).toBe(previous)
+    await manager.ensureForDistro('fixture')
+    expect(hookCount).toBe(3)
+    now += REINSTALL_MIN_INTERVAL_MS + 1
+    rejectHooks = false
+    pendingRequest.release()
+    await manager.ensureForDistro('fixture')
+    expect(hookCount).toBe(4)
+    expect(requests.at(-1)).toMatchObject({ opencodePluginSource: '', opencode2PluginSource: '' })
+    expect(manager.getOpenCodeOverlayDir('fixture')).toBeNull()
+  })
+
+  it('keeps a disposed generation from publishing into a reconnected manager', async () => {
+    pause = 'plugin'
+    await manager.ensureForDistro('fixture')
+    now += REINSTALL_MIN_INTERVAL_MS + 1
+    const refresh = manager.ensureForDistro('fixture')
+    await pendingRequest.reached
+    const waiters = Array.from({ length: 4 }, () => manager.ensureForDistro('fixture'))
+    manager.disposeAll({ permanent: false })
+    activeGuest = createGuest('replacement')
+    await manager.ensureForDistro('fixture')
+    const current = manager.getOpenCodeOverlayDir('fixture')
+    expect(current).toContain(activeGuest.home)
+    pendingRequest.release()
+    await Promise.all([refresh, ...waiters])
+    expect(requests).toHaveLength(3)
+    expect(manager.getOpenCodeOverlayDir('fixture')).toBe(current)
+    expect(manager.getOpenCodeOverlayDir('fixture', 'opencode2')).toContain(activeGuest.home)
+  })
+})
diff --git a/src/main/agent-hooks/wsl-opencode-settings.test.ts b/src/main/agent-hooks/wsl-opencode-settings.test.ts
new file mode 100644
index 00000000000..0e868635ea2
--- /dev/null
+++ b/src/main/agent-hooks/wsl-opencode-settings.test.ts
@@ -0,0 +1,136 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import type { TuiAgent } from '../../shared/tui-agent'
+import { RelayDispatcher } from '../../relay/dispatcher'
+import { PluginOverlayManager } from '../../relay/plugin-overlay'
+import { createInstallPluginsHandler } from '../../relay/wsl-install-plugins-handler'
+import { SshChannelMultiplexer } from '../ssh/ssh-channel-multiplexer'
+import { AGENT_HOOK_INSTALL_PLUGINS_METHOD } from '../../shared/agent-hook-relay'
+import { requestGuestOpenCodeOverlayDir } from './wsl-guest-plugin-install'
+import {
+  maybeRerunWslRelayGuestInstall,
+  runWslRelayGuestInstall
+} from './wsl-hook-relay-guest-install'
+import type { WslRelayDistroState } from './wsl-hook-relay-state'
+
+let home: string
+let dispatcher: RelayDispatcher
+let mux: SshChannelMultiplexer
+let state: WslRelayDistroState
+let settings: { disabledTuiAgents: TuiAgent[] }
+let params: Record<string, unknown>[]
+const sources = {
+  opencodePluginSource: '// v1',
+  opencode2PluginSource: '// v2',
+  piExtensionSource: '// pi'
+}
+const deps = {
+  pluginSources: () => sources,
+  managedHookSettings: () => settings,
+  installHooks: async () => [],
+  installCodex: async () => null,
+  warn: (message: string) => {
+    throw new Error(message)
+  }
+}
+beforeEach(() => {
+  home = mkdtempSync(join(tmpdir(), 'orca-wsl-opencode-settings-'))
+  const xdg = join(home, 'xdg')
+  mkdirSync(join(xdg, 'opencode'), { recursive: true })
+  writeFileSync(join(xdg, 'opencode', 'opencode.json'), '{"model":"guest-fixture"}')
+  settings = { disabledTuiAgents: [] }
+  params = []
+  const callbacks: ((data: Buffer) => void)[] = []
+  dispatcher = new RelayDispatcher((data) => {
+    for (const callback of callbacks) {
+      callback(data)
+    }
+  })
+  mux = new SshChannelMultiplexer({
+    write: (data) => {
+      dispatcher.feed(data)
+    },
+    onData: (callback) => {
+      callbacks.push(callback)
+    },
+    onClose: () => {}
+  })
+  const install = createInstallPluginsHandler(new PluginOverlayManager({ homeDir: home }), {
+    HOME: home,
+    XDG_CONFIG_HOME: xdg,
+    ORCA_WSL_HOOK_INSTANCE: 'settings-fixture'
+  })
+  dispatcher.onRequest('preflight.detectAgents', async () => ({ agents: [] }))
+  dispatcher.onRequest(AGENT_HOOK_INSTALL_PLUGINS_METHOD, async (request) => {
+    params.push(request)
+    return install(request)
+  })
+  state = {
+    distro: 'fixture',
+    phase: 'running',
+    mux,
+    guestHome: home,
+    launchKinds: new Set(),
+    failures: 0,
+    cooldownUntil: 0
+  }
+})
+afterEach(() => {
+  mux.dispose()
+  dispatcher.dispose()
+  rmSync(home, { recursive: true, force: true })
+})
+
+describe('WSL settings over the existing plugin RPC into real fixture overlays', () => {
+  const cases: TuiAgent[][] = [[], ['opencode'], ['opencode2'], ['opencode', 'opencode2']]
+  it.each(cases.map((disabled) => ({ disabled })))(
+    'honors disabled $disabled',
+    async ({ disabled }) => {
+      settings.disabledTuiAgents = disabled
+      const result = await requestGuestOpenCodeOverlayDir(mux, deps, 'fixture')
+      for (const agent of ['opencode', 'opencode2'] as const) {
+        const key = agent === 'opencode' ? 'opencodePluginSource' : 'opencode2PluginSource'
+        expect(params[0][key]).toBe(disabled.includes(agent) ? '' : sources[key])
+      }
+      if (result.kind === 'dir') {
+        expect(Boolean(result.dir)).toBe(!disabled.includes('opencode'))
+        expect(Boolean(result.dir2)).toBe(!disabled.includes('opencode2'))
+        const dir = result.dir ?? result.dir2
+        if (!dir) {
+          throw new Error('missing overlay')
+        }
+        expect(readFileSync(join(dir, 'opencode.json'), 'utf8')).toBe('{"model":"guest-fixture"}')
+      } else {
+        expect(disabled).toEqual(['opencode', 'opencode2'])
+      }
+      expect(params[0].piExtensionSource).toBe('// pi')
+    }
+  )
+
+  it('revokes cached sources before the reinstall interval and re-enables the same service', async () => {
+    await runWslRelayGuestInstall(deps, state, mux, home)
+    const dir = state.opencodeOverlayDir
+    if (!dir) {
+      throw new Error('missing original overlay')
+    }
+    const path = join(dir, 'plugins', 'orca-opencode-status.js')
+    writeFileSync(path, '// installed sentinel')
+    settings.disabledTuiAgents = ['opencode']
+    await maybeRerunWslRelayGuestInstall(deps, state)
+    expect(state.opencodeOverlayDir).toBeUndefined()
+    expect(state.opencode2OverlayDir).toBeTruthy()
+    expect(readFileSync(path, 'utf8')).toBe('// installed sentinel')
+    const omitted = await requestGuestOpenCodeOverlayDir(
+      mux,
+      { ...deps, pluginSources: () => ({}) },
+      'fixture'
+    )
+    expect(omitted.kind === 'dir' ? omitted.dir : undefined).toBeUndefined()
+    settings.disabledTuiAgents = []
+    await maybeRerunWslRelayGuestInstall(deps, state)
+    expect(state.opencodeOverlayDir).toBe(dir)
+    expect(existsSync(path)).toBe(true)
+  })
+})
diff --git a/src/main/agent-launch/__fixtures__/host-agent-startup-call-sites.txt b/src/main/agent-launch/__fixtures__/host-agent-startup-call-sites.txt
new file mode 100644
index 00000000000..de078fd731e
--- /dev/null
+++ b/src/main/agent-launch/__fixtures__/host-agent-startup-call-sites.txt
@@ -0,0 +1,10 @@
+# Host-side calls to the agent startup-plan builders, per file: <path> <calls> <decision>.
+#   attributes      a fresh agent the host builds; carries agentStartedTelemetry
+#   resume          continues an existing agent session; not a new start
+#   mobile-followup the phone's session-tab launch; attribution is a separate follow-up
+# The resolve-worktree-removal-target call also serves a bare typed command, which stays unattributed.
+src/main/runtime/orca-runtime-create-agent-session.ts 2 attributes
+src/main/runtime/orca-runtime-resolve-worktree-removal-target.ts 1 attributes
+src/main/runtime/runtime-worktree-agent-startup.ts 3 attributes
+src/main/runtime/orca-runtime-get-agent-session-execution-namespace.ts 1 resume
+src/main/runtime/orca-runtime-resolve-mobile-session-terminal-command.ts 1 mobile-followup
diff --git a/src/main/agent-launch/agent-launch-executor.test.ts b/src/main/agent-launch/agent-launch-executor.test.ts
index a95e71a30ef..e7270287fb5 100644
--- a/src/main/agent-launch/agent-launch-executor.test.ts
+++ b/src/main/agent-launch/agent-launch-executor.test.ts
@@ -265,7 +265,7 @@ describe('the prompt receipt', () => {
       'createStructuredSession',
       'deliverStructuredPrompt'
     ])
-    // The send must name the lease the create was admitted under, not one re-read later.
+    // The send carries the create's own fence; nothing re-reads the session for it.
     expect(h.deliverStructuredPrompt).toHaveBeenCalledWith({
       sessionId: 'sess-1',
       fence: 4,
diff --git a/src/main/agent-launch/agent-launch-executor.ts b/src/main/agent-launch/agent-launch-executor.ts
index 090a65f7650..1d9bae4f45d 100644
--- a/src/main/agent-launch/agent-launch-executor.ts
+++ b/src/main/agent-launch/agent-launch-executor.ts
@@ -21,8 +21,8 @@
  * for a workspace it can resolve. That is why the decision is in two halves rather than one.
  *
  * What genuinely differs per surface is only how a surface is *built* — an orchestration worker's
- * session takes a dispatch hold and a mailbox that a plain launch must not take — so that is
- * injected as a factory instead of branched on here.
+ * session takes a redrive subscription and a mailbox that a plain launch must not take — so that
+ * is injected as a factory instead of branched on here.
  */
 
 import { parsePaneKey } from '../../shared/stable-pane-id'
diff --git a/src/main/agent-launch/agent-launch-not-started.ts b/src/main/agent-launch/agent-launch-not-started.ts
new file mode 100644
index 00000000000..ca40f53378f
--- /dev/null
+++ b/src/main/agent-launch/agent-launch-not-started.ts
@@ -0,0 +1,37 @@
+/**
+ * A launch whose terminal failed before its spawn was requested: nothing was created, so the
+ * launch can settle as failed with its real cause instead of an unknown outcome.
+ *
+ * The original error is remembered rather than wrapped, so the caller still receives the host's own
+ * code and message. After the request leaves this process a failure proves nothing — an SSH or
+ * daemon spawn whose reply was lost may still have started — so only this earlier point counts.
+ *
+ * The verdict belongs to the launch, not to the error object: a failed pane spawn rejects the same
+ * error into the spawner (after its request left) and into a concurrent create waiting on that pane
+ * (before its own request left), so a mark on the error itself would clear both.
+ */
+export type TerminalSpawnDispatch = {
+  onPtySpawnDispatched: () => void
+  /** Rethrows the create's failure, remembering it when the spawn request had not yet left. */
+  rethrow: (error: unknown) => never
+  /** True only for the error this launch's create threw before its spawn request left. */
+  failedBeforeDispatch: (error: unknown) => boolean
+}
+
+export function trackTerminalSpawnDispatch(): TerminalSpawnDispatch {
+  let dispatched = false
+  let notStarted: { error: unknown } | undefined
+  return {
+    onPtySpawnDispatched: () => {
+      dispatched = true
+    },
+    rethrow: (error) => {
+      if (!dispatched) {
+        notStarted = { error }
+      }
+      throw error
+    },
+    failedBeforeDispatch: (error) =>
+      !dispatched && notStarted !== undefined && notStarted.error === error
+  }
+}
diff --git a/src/main/agent-launch/agent-launch-surface-factories.ts b/src/main/agent-launch/agent-launch-surface-factories.ts
index 11d72274bd4..867eac40ab6 100644
--- a/src/main/agent-launch/agent-launch-surface-factories.ts
+++ b/src/main/agent-launch/agent-launch-surface-factories.ts
@@ -8,8 +8,8 @@ import type { AgentLaunchPrompt } from '../../shared/agent-launch-intent'
 import type { TuiAgent } from '../../shared/tui-agent'
 
 /** How a surface is built once the executor has decided which one. Injected because an
- *  orchestration worker's session carries a dispatch hold and a mailbox a plain launch must not
- *  take, while the decision and ordering above it are identical. */
+ *  orchestration worker's session carries a redrive subscription and a mailbox a plain launch
+ *  must not take, while the decision and ordering above it are identical. */
 export type AgentLaunchSurfaceFactory = {
   createStructuredSession(args: {
     worktreeId: string
@@ -64,8 +64,8 @@ export type AgentLaunchSurfaceFactory = {
   deliverTerminalPrompt?(args: { handle: string; prompt: AgentLaunchPrompt }): Promise<boolean>
 }
 
-/** `fence` is carried out of the create because a send must name the lease it was admitted against,
- *  and re-reading it later would read whatever fence the session has by then. */
+/** `fence` is the lease the create was admitted at, carried so the launch prompt's send can fill its
+ *  envelope without re-reading the session; the host does not check a write's fence. */
 export type AgentLaunchStructuredSurface = {
   sessionId: string
   handle: string
diff --git a/src/main/agent-launch/agent-started-telemetry.ts b/src/main/agent-launch/agent-started-telemetry.ts
new file mode 100644
index 00000000000..2d1ff76179d
--- /dev/null
+++ b/src/main/agent-launch/agent-started-telemetry.ts
@@ -0,0 +1,30 @@
+/**
+ * The `agent_started` triple for an agent launch the host builds, of which only `launch_source`
+ * comes from the caller.
+ *
+ * `agent_kind` and `request_kind` are derived rather than accepted — the host already knows both,
+ * and a value it derives is a value a caller cannot misreport. `request_kind` is always `new`
+ * because a host-built launch is always a fresh agent.
+ *
+ * Every launch is attributed: a caller that names no surface, or one this build has never heard of
+ * (a newer client), is recorded as `unknown` rather than dropped. The wire keeps the arm set open so
+ * an older host cannot refuse a newer client's launch over a label, and resolving it here, leniently,
+ * keeps that label from gating the launch at the point it is actually used.
+ */
+
+import { tuiAgentToAgentKind } from '../../shared/agent-kind'
+import { launchSourceSchema } from '../../shared/telemetry-property-schemas'
+import type { TuiAgent } from '../../shared/tui-agent'
+import type { WorktreeStartupLaunch } from '../../shared/worktree/launch-types'
+
+export function agentStartedTelemetry(
+  agent: TuiAgent,
+  launchSource: string | undefined
+): NonNullable<WorktreeStartupLaunch['telemetry']> {
+  const parsed = launchSourceSchema.safeParse(launchSource)
+  return {
+    agent_kind: tuiAgentToAgentKind(agent),
+    launch_source: parsed.success ? parsed.data : 'unknown',
+    request_kind: 'new'
+  }
+}
diff --git a/src/main/agent-launch/host-agent-startup-attribution.test.ts b/src/main/agent-launch/host-agent-startup-attribution.test.ts
new file mode 100644
index 00000000000..612caab8001
--- /dev/null
+++ b/src/main/agent-launch/host-agent-startup-attribution.test.ts
@@ -0,0 +1,99 @@
+import { readFileSync, readdirSync, statSync } from 'node:fs'
+import { join, relative, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+/**
+ * Every host-side call that builds an agent's startup command has made an attribution decision.
+ *
+ * `agent_started` is recorded per call site, and twice a new host builder shipped without one, so
+ * that agent's launches were silently uncounted. A new call, or another call in a listed file,
+ * fails here until its author decides and records whether that launch is a fresh start.
+ */
+const DECISIONS = ['attributes', 'resume', 'mobile-followup'] as const
+
+const LISTED: ReadonlyMap<string, { calls: number; decision: string }> = new Map(
+  readFileSync(join(__dirname, '__fixtures__', 'host-agent-startup-call-sites.txt'), 'utf8')
+    .split('\n')
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0 && !line.startsWith('#'))
+    .map((line) => {
+      const [path, calls, decision] = line.split(/\s+/)
+      return [path, { calls: Number(calls), decision }] as const
+    })
+)
+
+const BUILDER_CALL =
+  /\b(?:buildAgentStartupPlan|buildAgentDraftLaunchPlan|buildAgentResumeStartupPlan)\s*\(/g
+
+const DECIDE =
+  'Decide attribution: a fresh agent the host builds must carry ' +
+  '`agentStartedTelemetry(agent, launchSource)` (src/main/agent-launch/agent-started-telemetry.ts) ' +
+  'on its startup; a resume or a bare typed command must not. Then record the file, its call ' +
+  'count and the decision in __fixtures__/host-agent-startup-call-sites.txt.'
+
+function isTestFile(path: string): boolean {
+  return /\.(?:test|spec)\.tsx?$/.test(path) || path.includes('/__tests__/')
+}
+
+function collectSourceFiles(root: string): string[] {
+  return readdirSync(root).flatMap((entry) => {
+    const full = join(root, entry)
+    if (statSync(full).isDirectory()) {
+      return entry === '__fixtures__' ? [] : collectSourceFiles(full)
+    }
+    return /\.tsx?$/.test(entry) ? [full] : []
+  })
+}
+
+/** Drop comment-only lines so prose naming a builder is not a call. */
+function codeText(contents: string): string {
+  return contents
+    .split('\n')
+    .filter((line) => !/^\s*(?:\/\/|\/\*|\*)/.test(line))
+    .join('\n')
+}
+
+describe('host agent startup attribution', () => {
+  const repoRoot = resolve(__dirname, '..', '..', '..')
+  const files = collectSourceFiles(join(repoRoot, 'src', 'main'))
+  const found = new Map<string, number>()
+  for (const file of files) {
+    const path = relative(repoRoot, file).split('\\').join('/')
+    const calls = isTestFile(path)
+      ? 0
+      : (codeText(readFileSync(file, 'utf8')).match(BUILDER_CALL)?.length ?? 0)
+    if (calls > 0) {
+      found.set(path, calls)
+    }
+  }
+
+  it('scans a plausible number of files', () => {
+    // A broken root would make the guard silently vacuous.
+    expect(files.length).toBeGreaterThan(500)
+  })
+
+  it('has an attribution decision for every builder call', () => {
+    const undecided = [...found]
+      .filter(([path, calls]) => calls > (LISTED.get(path)?.calls ?? 0))
+      .map(([path, calls]) => `${path}: ${calls} calls, ${LISTED.get(path)?.calls ?? 0} decided`)
+    expect(undecided, `New host-built agent startup. ${DECIDE}`).toEqual([])
+  })
+
+  it('has no stale entry', () => {
+    // A count left above reality lets the next call in that file land without a decision.
+    const stale = [...LISTED]
+      .filter(([path, entry]) => entry.calls > (found.get(path) ?? 0))
+      .map(([path, entry]) => `${path}: ${found.get(path) ?? 0} calls, ${entry.calls} listed`)
+    expect(stale, 'Lower or delete the entry to match the calls that remain.').toEqual([])
+  })
+
+  it('uses the known decision vocabulary', () => {
+    const unknown = [...LISTED].filter(
+      ([, entry]) => !DECISIONS.some((decision) => decision === entry.decision)
+    )
+    expect(
+      unknown.map(([path]) => path),
+      `Use one of: ${DECISIONS.join(', ')}.`
+    ).toEqual([])
+  })
+})
diff --git a/src/main/agent-trust-presets.test.ts b/src/main/agent-trust-presets.test.ts
index 5e7521ae468..c3f615f7bb6 100644
--- a/src/main/agent-trust-presets.test.ts
+++ b/src/main/agent-trust-presets.test.ts
@@ -46,6 +46,7 @@ const {
 } = await import('./agent-trust-presets')
 const { runExclusivelyForCodexTrustConfig } =
   await import('./codex/codex-trust-config-mutation-queue')
+const { getLocalCodexTrustConfigFiles } = await import('./codex/codex-home-paths')
 
 beforeEach(() => {
   testState.fakeHomeDir = mkdtempSync(join(tmpdir(), 'orca-trust-presets-'))
@@ -224,7 +225,7 @@ describe('markCodexProjectTrusted', () => {
     })
     try {
       const held = runExclusivelyForCodexTrustConfig(configPath, () => grantHoldingTheFile)
-      const marked = markCodexProjectTrusted(workspace)
+      const marked = markCodexProjectTrusted(workspace, getLocalCodexTrustConfigFiles())
       await Promise.resolve()
       expect(existsSync(configPath)).toBe(false)
 
@@ -248,7 +249,7 @@ describe('markCodexProjectTrusted', () => {
       writeFileSync(join(workspace, '.git'), `gitdir: ${worktreeGitDir}\n`, 'utf-8')
       writeFileSync(join(worktreeGitDir, 'gitdir'), join(workspace, '.git'), 'utf-8')
 
-      await markCodexProjectTrusted(workspace)
+      await markCodexProjectTrusted(workspace, getLocalCodexTrustConfigFiles())
 
       const repositoryRoot = realpathSync.native(repository)
       const workspaceRoot = realpathSync.native(workspace)
@@ -283,12 +284,12 @@ describe('markCodexProjectTrusted', () => {
       writeFileSync(join(workspace, '.git'), `gitdir: ${arbitraryGitDir}\n`, 'utf-8')
       writeFileSync(join(arbitraryGitDir, 'commondir'), join(unrelatedRoot, '.git'), 'utf-8')
 
-      await markCodexProjectTrusted(workspace)
+      await markCodexProjectTrusted(workspace, getLocalCodexTrustConfigFiles())
       const structuredGitDir = join(unrelatedRoot, '.git', 'worktrees', 'feature')
       mkdirSync(structuredGitDir, { recursive: true })
       writeFileSync(join(workspace, '.git'), `gitdir: ${structuredGitDir}\n`, 'utf-8')
       writeFileSync(join(structuredGitDir, 'gitdir'), join(unrelatedRoot, '.git'), 'utf-8')
-      await markCodexProjectTrusted(workspace)
+      await markCodexProjectTrusted(workspace, getLocalCodexTrustConfigFiles())
 
       const written = readFileSync(join(testState.fakeHomeDir, '.codex', 'config.toml'), 'utf-8')
       expect(written).toContain(
@@ -306,7 +307,7 @@ describe('markCodexProjectTrusted', () => {
     const workspace = mkdtempSync(join(tmpdir(), 'orca-codex-ws-'))
     try {
       const realpath = realpathSync.native(workspace)
-      await markCodexProjectTrusted(workspace)
+      await markCodexProjectTrusted(workspace, getLocalCodexTrustConfigFiles())
       const configPath = join(testState.fakeHomeDir, '.codex', 'config.toml')
       const runtimeConfigPath = join(
         testState.userDataDir,
@@ -360,7 +361,7 @@ describe('markCodexProjectTrusted', () => {
         'utf-8'
       )
 
-      await markCodexProjectTrusted(workspace)
+      await markCodexProjectTrusted(workspace, getLocalCodexTrustConfigFiles())
 
       const written = readFileSync(join(codexDir, 'config.toml'), 'utf-8')
       const runtimeWritten = readFileSync(join(runtimeCodexDir, 'config.toml'), 'utf-8')
diff --git a/src/main/agent-trust-presets.ts b/src/main/agent-trust-presets.ts
index 30e2ba487f3..22f6dcb72dd 100644
--- a/src/main/agent-trust-presets.ts
+++ b/src/main/agent-trust-presets.ts
@@ -2,11 +2,11 @@ import { existsSync, mkdirSync, readFileSync, realpathSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { basename, dirname, join, resolve } from 'node:path'
 import { writeFileAtomically } from './codex-accounts/fs-utils'
-import { getOrcaManagedCodexHomePath } from './codex/codex-home-paths'
 import { upsertProjectTrustLevel } from './codex/config-toml-trust'
 import { runExclusivelyForCodexTrustConfig } from './codex/codex-trust-config-mutation-queue'
+import type { TuiAgentConfig } from '../shared/tui-agent-config'
 
-export type AgentTrustPreset = 'cursor' | 'copilot' | 'codex' | 'antigravity'
+export type AgentTrustPreset = NonNullable<TuiAgentConfig['preflightTrust']>
 
 /**
  * Pre-mark a workspace as trusted for cursor-agent, GitHub Copilot CLI, or
@@ -161,25 +161,31 @@ export function markAntigravityWorkspaceTrusted(workspacePath: string): void {
  *
  * Verified against codex-rs/tui/src/onboarding/trust_directory.rs and
  * codex-rs/core/src/config/config_tests.rs in the Codex CLI source.
+ *
+ * `configFiles` names every config.toml the launched Codex may read, in the
+ * hook installer's lock order (an Orca-owned CODEX_HOME before the system one).
  */
-export function markCodexProjectTrusted(workspacePath: string): Promise<void> {
+export function markCodexProjectTrusted(
+  workspacePath: string,
+  configFiles: readonly string[]
+): Promise<void> {
   const absPath = resolveCodexProjectTrustRoot(workspacePath)
-  const systemTomlPath = join(homedir(), '.codex', 'config.toml')
-  // Why: Orca-launched Codex runs with an Orca-owned CODEX_HOME, so the trust
-  // preset must also update the runtime config Codex will actually read.
-  const runtimeTomlPath = join(getOrcaManagedCodexHomePath(), 'config.toml')
   // Why (#16441): hook installs now await a codex app-server grant, so an
   // unqueued write here can land inside their capture->restore window and be
   // reverted. Same runtime-before-system lock order the installer takes.
-  return runExclusivelyForCodexTrustConfig(runtimeTomlPath, () =>
-    runExclusivelyForCodexTrustConfig(systemTomlPath, async () => {
-      upsertProjectTrustLevel(systemTomlPath, absPath, 'trusted')
-      upsertProjectTrustLevel(runtimeTomlPath, absPath, 'trusted')
-    })
+  const write = configFiles.reduceRight<() => Promise<void>>(
+    (inner, configFile) => () => runExclusivelyForCodexTrustConfig(configFile, inner),
+    async () => {
+      for (const configFile of configFiles) {
+        upsertProjectTrustLevel(configFile, absPath, 'trusted')
+      }
+    }
   )
+  return write()
 }
 
-function resolveCodexProjectTrustRoot(workspacePath: string): string {
+/** The folder Codex looks trust up under: a linked worktree's main checkout, else the realpath. */
+export function resolveCodexProjectTrustRoot(workspacePath: string): string {
   const absPath = canonicalize(workspacePath)
   try {
     const gitDirReference = readFileSync(join(absPath, '.git'), 'utf-8').trim()
diff --git a/src/main/agent-trust-write-deadline.ts b/src/main/agent-trust-write-deadline.ts
new file mode 100644
index 00000000000..450966a67de
--- /dev/null
+++ b/src/main/agent-trust-write-deadline.ts
@@ -0,0 +1,48 @@
+import type { AgentTrustPreset } from './agent-trust-presets'
+
+/**
+ * Why: callers hold launch admission on a trust write, but the write is not
+ * self-bounding. The local Codex writer queues on the per-`config.toml` lane
+ * shared with hook installs and app-server trust grants (up to 10s native /
+ * 30s WSL each, with no cap on how many are already queued). Without a cap the
+ * user clicks "start agent" and nothing happens, with no error.
+ *
+ * 20s covers a native grant session holding the lane with headroom. Past that
+ * we stop waiting and let the launch proceed *untrusted*: the write is never
+ * cancelled and still lands, and the agent meanwhile raises its own "Do you
+ * trust this folder?" prompt. Giving up therefore fails closed — it can only
+ * lose the ordering optimisation, never grant trust that was not written.
+ */
+export const AGENT_TRUST_WRITE_DEADLINE_MS = 20_000
+
+/** Writers with no shared lock lane, local or on the relay: a stall past this means the agent asks. */
+export const SHORT_AGENT_TRUST_WRITE_DEADLINE_MS = 1_500
+
+/**
+ * Awaits a trust write but never longer than the deadline. Rejections
+ * propagate to the caller's best-effort catch; a deadline miss is reported as
+ * a named warning rather than an exception, because every caller treats a
+ * failed trust write as "let the agent ask the user".
+ */
+export async function awaitAgentTrustWriteWithinDeadline(
+  write: Promise<void>,
+  context: { preset: AgentTrustPreset; workspacePath: string; deadlineMs?: number }
+): Promise<void> {
+  const deadlineMs = context.deadlineMs ?? AGENT_TRUST_WRITE_DEADLINE_MS
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const expiry = new Promise<'expired'>((resolve) => {
+    timer = setTimeout(() => resolve('expired'), deadlineMs)
+  })
+  try {
+    // Why race adopts `write`: it attaches handlers, so a rejection arriving
+    // after the deadline is consumed here instead of surfacing unhandled.
+    const outcome = await Promise.race([write.then(() => 'written' as const), expiry])
+    if (outcome === 'expired') {
+      console.warn(
+        `[agent-trust] ${context.preset} trust write for ${context.workspacePath} did not settle within ${deadlineMs}ms; continuing untrusted so the agent can prompt`
+      )
+    }
+  } finally {
+    clearTimeout(timer)
+  }
+}
diff --git a/src/main/agent-workspace-trust-guard-failure.test.ts b/src/main/agent-workspace-trust-guard-failure.test.ts
new file mode 100644
index 00000000000..9f5e1ab7d9b
--- /dev/null
+++ b/src/main/agent-workspace-trust-guard-failure.test.ts
@@ -0,0 +1,33 @@
+import { describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  copilot: vi.fn<(path: string) => void>()
+}))
+
+vi.mock('../shared/home-or-filesystem-root', () => ({
+  isTooBroadToPreTrust: () => {
+    throw new Error('homedir unavailable')
+  }
+}))
+vi.mock('./agent-trust-presets', () => ({
+  markCodexProjectTrusted: vi.fn(async () => {}),
+  markCursorWorkspaceTrusted: vi.fn(),
+  markCopilotFolderTrusted: mocks.copilot,
+  markAntigravityWorkspaceTrusted: vi.fn()
+}))
+
+import { applyAgentWorkspaceTrust } from './agent-workspace-trust'
+
+describe('applyAgentWorkspaceTrust when the breadth guard fails', () => {
+  it('writes nothing and never fails the launch', async () => {
+    await expect(
+      applyAgentWorkspaceTrust('copilot', '/workspace/app', {
+        env: {},
+        claudeAuth: null,
+        wslDistro: null,
+        connectionId: null
+      })
+    ).resolves.toEqual({})
+    expect(mocks.copilot).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/agent-workspace-trust-spawn.test.ts b/src/main/agent-workspace-trust-spawn.test.ts
new file mode 100644
index 00000000000..17204bd0f5d
--- /dev/null
+++ b/src/main/agent-workspace-trust-spawn.test.ts
@@ -0,0 +1,173 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { TUI_AGENT_CONFIG, isTuiAgent } from '../shared/tui-agent-config'
+
+const applyAgentWorkspaceTrust = vi.hoisted(() =>
+  vi.fn<(preset: string, path: string, context: unknown) => Promise<object>>(async () => ({}))
+)
+vi.mock('./agent-workspace-trust', () => ({ applyAgentWorkspaceTrust }))
+
+import { applyAgentWorkspaceTrustToSpawn } from './agent-workspace-trust-spawn'
+
+const store = {
+  getFolderWorkspace: (id: string) => (id === 'fw-1' ? { folderPath: '/notes' } : undefined)
+}
+
+function spawnArgs(overrides: Partial<Parameters<typeof applyAgentWorkspaceTrustToSpawn>[0]>) {
+  return {
+    launchAgent: 'claude',
+    worktreeId: 'repo-1::/repo/wt',
+    cwd: undefined,
+    store,
+    isFreshLaunch: true,
+    settings: { agentWorkspaceTrustEnabled: true },
+    env: { CLAUDE_CONFIG_DIR: '/cfg' },
+    claudeAuth: null,
+    wslDistro: null,
+    connectionId: null,
+    spawnOptions: {},
+    ...overrides
+  }
+}
+
+const PRESET_AGENTS = Object.keys(TUI_AGENT_CONFIG)
+  .filter(isTuiAgent)
+  .filter((agent) => TUI_AGENT_CONFIG[agent].preflightTrust)
+
+beforeEach(() => {
+  applyAgentWorkspaceTrust.mockClear()
+})
+
+describe('applyAgentWorkspaceTrustToSpawn', () => {
+  it('covers both Claude launch modes and every other preset agent', () => {
+    expect(PRESET_AGENTS).toEqual(
+      expect.arrayContaining([
+        'claude',
+        'claude-agent-teams',
+        'codex',
+        'cursor',
+        'copilot',
+        'qoder',
+        'antigravity'
+      ])
+    )
+    expect(TUI_AGENT_CONFIG['claude-agent-teams'].preflightTrust).toBe('claude')
+  })
+
+  describe.each(PRESET_AGENTS)('%s', (agent) => {
+    const preset = TUI_AGENT_CONFIG[agent].preflightTrust
+
+    it.each([
+      ['a linked worktree', 'repo-1::/repo/wt', '/repo/wt'],
+      ['a main checkout', 'repo-1::/repo', '/repo'],
+      [
+        'a folder repo workspace',
+        'repo-2::/folder::workspace:0f8fad5b-d9cb-469f-a165-70867728950e',
+        '/folder'
+      ],
+      ['a folder workspace', 'folder:fw-1', '/notes']
+    ])('trusts %s', async (_label, worktreeId, expectedPath) => {
+      await applyAgentWorkspaceTrustToSpawn(spawnArgs({ launchAgent: agent, worktreeId }))
+      expect(applyAgentWorkspaceTrust).toHaveBeenCalledWith(preset, expectedPath, {
+        env: { CLAUDE_CONFIG_DIR: '/cfg' },
+        claudeAuth: null,
+        wslDistro: null,
+        connectionId: null
+      })
+    })
+
+    it('does nothing with the setting off', () => {
+      expect(
+        applyAgentWorkspaceTrustToSpawn(
+          spawnArgs({ launchAgent: agent, settings: { agentWorkspaceTrustEnabled: false } })
+        )
+      ).toBeNull()
+      expect(applyAgentWorkspaceTrust).not.toHaveBeenCalled()
+    })
+
+    it('does nothing for a restored or reattached pane', () => {
+      expect(
+        applyAgentWorkspaceTrustToSpawn(spawnArgs({ launchAgent: agent, isFreshLaunch: false }))
+      ).toBeNull()
+      expect(applyAgentWorkspaceTrust).not.toHaveBeenCalled()
+    })
+
+    it('routes an SSH launch to its connection', async () => {
+      await applyAgentWorkspaceTrustToSpawn(
+        spawnArgs({ launchAgent: agent, worktreeId: 'repo-1::/srv/wt', connectionId: 'ssh-1' })
+      )
+      expect(applyAgentWorkspaceTrust).toHaveBeenCalledWith(
+        preset,
+        '/srv/wt',
+        expect.objectContaining({ connectionId: 'ssh-1' })
+      )
+    })
+
+    it('passes the WSL distro so the writer targets the guest or skips', async () => {
+      await applyAgentWorkspaceTrustToSpawn(spawnArgs({ launchAgent: agent, wslDistro: 'Ubuntu' }))
+      expect(applyAgentWorkspaceTrust).toHaveBeenCalledWith(
+        preset,
+        '/repo/wt',
+        expect.objectContaining({ wslDistro: 'Ubuntu' })
+      )
+    })
+  })
+
+  it('forwards the relay field the dispatcher returns for an SSH launch', async () => {
+    applyAgentWorkspaceTrust.mockResolvedValueOnce({
+      agentWorkspaceTrust: { workspacePath: '/srv/wt' }
+    })
+    const spawnOptions = {}
+    await applyAgentWorkspaceTrustToSpawn(
+      spawnArgs({ worktreeId: 'repo-1::/srv/wt', connectionId: 'ssh-1', spawnOptions })
+    )
+    expect(spawnOptions).toEqual({ agentWorkspaceTrust: { workspacePath: '/srv/wt' } })
+  })
+
+  it('trusts Codex in a floating terminal at the folder it starts in', async () => {
+    await applyAgentWorkspaceTrustToSpawn(
+      spawnArgs({ launchAgent: 'codex', worktreeId: 'global-floating-terminal', cwd: '/Users/me' })
+    )
+    expect(applyAgentWorkspaceTrust).toHaveBeenCalledWith('codex', '/Users/me', expect.anything())
+  })
+
+  it('trusts Codex at a subfolder it starts in, which its lookup keys on', async () => {
+    await applyAgentWorkspaceTrustToSpawn(
+      spawnArgs({ launchAgent: 'codex', worktreeId: 'folder:fw-1', cwd: '/notes/sub' })
+    )
+    expect(applyAgentWorkspaceTrust).toHaveBeenCalledWith('codex', '/notes/sub', expect.anything())
+  })
+
+  it.each(PRESET_AGENTS.filter((agent) => agent !== 'codex'))(
+    'trusts the workspace root for %s, whose trust covers its subfolders or matches the root',
+    async (agent) => {
+      await applyAgentWorkspaceTrustToSpawn(
+        spawnArgs({ launchAgent: agent, worktreeId: 'folder:fw-1', cwd: '/notes/sub' })
+      )
+      expect(applyAgentWorkspaceTrust).toHaveBeenCalledWith(
+        TUI_AGENT_CONFIG[agent].preflightTrust,
+        '/notes',
+        expect.anything()
+      )
+    }
+  )
+
+  it('treats an unset setting as on', async () => {
+    await applyAgentWorkspaceTrustToSpawn(spawnArgs({ settings: undefined }))
+    expect(applyAgentWorkspaceTrust).toHaveBeenCalledTimes(1)
+  })
+
+  it.each([
+    ['an agent with no trust preset', { launchAgent: 'gemini' }],
+    ['a plain terminal with no declared agent', { launchAgent: undefined }],
+    ['a floating terminal', { worktreeId: 'global-floating-terminal', cwd: '/Users/me' }],
+    [
+      'Codex with no start folder and no workspace',
+      { launchAgent: 'codex', worktreeId: 'global-floating-terminal' }
+    ],
+    ['an unknown folder workspace', { worktreeId: 'folder:missing' }],
+    ['a spawn with no workspace', { worktreeId: undefined }]
+  ])('does nothing, and gives the builder nothing to await, for %s', (_label, overrides) => {
+    expect(applyAgentWorkspaceTrustToSpawn(spawnArgs(overrides))).toBeNull()
+    expect(applyAgentWorkspaceTrust).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/agent-workspace-trust-spawn.ts b/src/main/agent-workspace-trust-spawn.ts
new file mode 100644
index 00000000000..f893529b53b
--- /dev/null
+++ b/src/main/agent-workspace-trust-spawn.ts
@@ -0,0 +1,89 @@
+import { TUI_AGENT_CONFIG, isTuiAgent } from '../shared/tui-agent-config'
+import type { GlobalSettings } from '../shared/global-settings-types'
+import { resolveTerminalWorkspacePath } from '../shared/terminal-startup-cwd'
+import {
+  applyAgentWorkspaceTrust,
+  type AgentTrustLaunchContext,
+  type AgentTrustSpawnFields
+} from './agent-workspace-trust'
+import { AGENT_TRUST_KEYED_BY_START_FOLDER } from './execution-host-workspace-trust'
+
+type AgentWorkspaceTrustSetting =
+  | Pick<GlobalSettings, 'agentWorkspaceTrustEnabled'>
+  | null
+  | undefined
+
+function isAgentWorkspaceTrustOn(settings: AgentWorkspaceTrustSetting): boolean {
+  return settings?.agentWorkspaceTrustEnabled !== false
+}
+
+/**
+ * The one place Orca pre-trusts a workspace: every Orca-started agent PTY passes
+ * through a spawn builder with its declared `launchAgent`, which survives setup-script
+ * wrapping. Reattaches and restores are skipped so trust is never re-run for them.
+ * Structured Codex chats have no PTY and enter below instead. Returns null when there is nothing to write, so other spawns take no extra tick:
+ * the builders arbitrate pane-spawn reservation races that a tick can reorder.
+ */
+export function applyAgentWorkspaceTrustToSpawn(
+  args: {
+    launchAgent: unknown
+    /** Worktree or folder workspace id; its root is the folder the agent is trusted in. */
+    worktreeId: string | undefined
+    /** The resolved folder the agent starts in; floating terminals have only this. */
+    cwd: string | undefined
+    store: { getFolderWorkspace: (id: string) => { folderPath: string } | undefined } | undefined
+    isFreshLaunch: boolean
+    settings: AgentWorkspaceTrustSetting
+    spawnOptions: AgentTrustSpawnFields
+  } & AgentTrustLaunchContext
+): Promise<void> | null {
+  if (!args.isFreshLaunch || !isAgentWorkspaceTrustOn(args.settings)) {
+    return null
+  }
+  const preset = isTuiAgent(args.launchAgent)
+    ? TUI_AGENT_CONFIG[args.launchAgent].preflightTrust
+    : undefined
+  if (!preset) {
+    return null
+  }
+  const workspaceRoot = resolveTerminalWorkspacePath(
+    args.worktreeId,
+    (folderWorkspaceId) => args.store?.getFolderWorkspace(folderWorkspaceId)?.folderPath
+  )
+  const workspacePath = AGENT_TRUST_KEYED_BY_START_FOLDER[preset]
+    ? args.cwd || workspaceRoot
+    : workspaceRoot
+  if (!workspacePath) {
+    return null
+  }
+  return applyAgentWorkspaceTrust(preset, workspacePath, {
+    env: args.env,
+    claudeAuth: args.claudeAuth,
+    wslDistro: args.wslDistro,
+    connectionId: args.connectionId
+  }).then((fields) => {
+    if (fields.agentWorkspaceTrust) {
+      args.spawnOptions.agentWorkspaceTrust = fields.agentWorkspaceTrust
+    }
+  })
+}
+
+/**
+ * Structured Codex chats are the one agent start with no PTY. Codex's app-server trusts the
+ * folder itself only when the chat may write it, so a read-only chat would ignore `.codex` config.
+ */
+export async function applyStructuredCodexWorkspaceTrust(args: {
+  workspacePath: string
+  launchEnv: Record<string, string | undefined>
+  settings: AgentWorkspaceTrustSetting
+}): Promise<void> {
+  if (!isAgentWorkspaceTrustOn(args.settings)) {
+    return
+  }
+  await applyAgentWorkspaceTrust('codex', args.workspacePath, {
+    env: args.launchEnv,
+    claudeAuth: null,
+    wslDistro: null,
+    connectionId: null
+  })
+}
diff --git a/src/main/agent-workspace-trust.test.ts b/src/main/agent-workspace-trust.test.ts
new file mode 100644
index 00000000000..97960a205f9
--- /dev/null
+++ b/src/main/agent-workspace-trust.test.ts
@@ -0,0 +1,286 @@
+import {
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync
+} from 'node:fs'
+import { homedir, tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as ClaudeFolderTrustFile from './claude/claude-folder-trust-file'
+
+const CODEX_CONFIG_FILES = ['/orca/codex-home/config.toml', '/home/u/.codex/config.toml']
+
+const mocks = vi.hoisted(() => ({
+  codex: vi.fn<(path: string, configFiles: readonly string[]) => Promise<void>>(async () => {}),
+  cursor: vi.fn<(path: string) => void>(),
+  copilot: vi.fn<(path: string) => void>(),
+  antigravity: vi.fn<(path: string) => void>(),
+  qoder: vi.fn<(path: string) => void>(),
+  claudeGrant: vi.fn<typeof ClaudeFolderTrustFile.grantClaudeWorkspaceTrust>()
+}))
+
+vi.mock('./agent-trust-presets', () => ({
+  resolveCodexProjectTrustRoot: (path: string) => path,
+  markCodexProjectTrusted: mocks.codex,
+  markCursorWorkspaceTrusted: mocks.cursor,
+  markCopilotFolderTrusted: mocks.copilot,
+  markAntigravityWorkspaceTrusted: mocks.antigravity
+}))
+vi.mock('./codex/codex-home-paths', () => ({
+  getLocalCodexTrustConfigFiles: () => CODEX_CONFIG_FILES
+}))
+vi.mock('./qoder/workspace-trust', () => ({ markQoderWorkspaceTrusted: mocks.qoder }))
+vi.mock('./claude/claude-folder-trust-file', async (importOriginal) => {
+  const actual = await importOriginal<typeof ClaudeFolderTrustFile>()
+  mocks.claudeGrant.mockImplementation(actual.grantClaudeWorkspaceTrust)
+  return { ...actual, grantClaudeWorkspaceTrust: mocks.claudeGrant }
+})
+
+import { applyAgentWorkspaceTrust, type AgentTrustLaunchContext } from './agent-workspace-trust'
+import { clearWslHomeCache, rememberWslHome } from './wsl-home-cache'
+import {
+  AGENT_TRUST_WRITE_DEADLINE_MS,
+  SHORT_AGENT_TRUST_WRITE_DEADLINE_MS
+} from './agent-trust-write-deadline'
+
+const WORKSPACE = '/workspace/app'
+const local: AgentTrustLaunchContext = {
+  env: {},
+  claudeAuth: null,
+  wslDistro: null,
+  connectionId: null
+}
+
+function pending(): { promise: Promise<void>; release: () => void } {
+  let release!: () => void
+  const promise = new Promise<void>((resolve) => {
+    release = resolve
+  })
+  return { promise, release }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('applyAgentWorkspaceTrust on this machine', () => {
+  it.each([
+    ['codex', mocks.codex],
+    ['cursor', mocks.cursor],
+    ['copilot', mocks.copilot],
+    ['qoder', mocks.qoder],
+    // Why: one of the old copied switches omitted Antigravity, so workers launched there asked.
+    ['antigravity', mocks.antigravity]
+  ] as const)('writes the %s preset for the workspace', async (preset, writer) => {
+    await expect(applyAgentWorkspaceTrust(preset, WORKSPACE, local)).resolves.toEqual({})
+    expect(writer).toHaveBeenCalledWith(
+      WORKSPACE,
+      ...(preset === 'codex' ? [CODEX_CONFIG_FILES] : [])
+    )
+  })
+
+  it('contains a rejected or throwing write so the launch proceeds', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    mocks.codex.mockRejectedValueOnce(new Error('write failed'))
+    mocks.cursor.mockImplementationOnce(() => {
+      throw new Error('write failed')
+    })
+    await expect(applyAgentWorkspaceTrust('codex', WORKSPACE, local)).resolves.toEqual({})
+    await expect(applyAgentWorkspaceTrust('cursor', WORKSPACE, local)).resolves.toEqual({})
+    expect(warn).toHaveBeenCalledTimes(2)
+    warn.mockRestore()
+  })
+
+  it('gives only Codex the long deadline its shared config lane needs', async () => {
+    vi.useFakeTimers()
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const codexWrite = pending()
+    mocks.codex.mockReturnValueOnce(codexWrite.promise)
+    let codexSettled = false
+    const codex = applyAgentWorkspaceTrust('codex', WORKSPACE, local).then(() => {
+      codexSettled = true
+    })
+    await vi.advanceTimersByTimeAsync(SHORT_AGENT_TRUST_WRITE_DEADLINE_MS + 1)
+    expect(codexSettled).toBe(false)
+    await vi.advanceTimersByTimeAsync(AGENT_TRUST_WRITE_DEADLINE_MS)
+    await codex
+    expect(codexSettled).toBe(true)
+    codexWrite.release()
+    warn.mockRestore()
+  })
+
+  // Why: a config dir that does not exist keeps a regression here from writing a real config.
+  const noConfig = { ...local, env: { CLAUDE_CONFIG_DIR: join(tmpdir(), 'orca-no-claude-config') } }
+  it.each([
+    ['the home folder', homedir(), noConfig],
+    [
+      'the home the spawn env names',
+      '/home/agent',
+      { ...noConfig, env: { ...noConfig.env, HOME: '/home/agent' } }
+    ],
+    ['a filesystem root', '/', noConfig],
+    ['a drive root', 'C:\\', noConfig]
+  ])(
+    'never pre-trusts %s for an agent that inherits trust from it',
+    async (_label, workspacePath, context) => {
+      for (const preset of ['claude', 'copilot', 'qoder'] as const) {
+        await expect(applyAgentWorkspaceTrust(preset, workspacePath, context)).resolves.toEqual({})
+      }
+      for (const writer of [mocks.copilot, mocks.qoder, mocks.claudeGrant]) {
+        expect(writer).not.toHaveBeenCalled()
+      }
+    }
+  )
+
+  it('trusts the home folder for Codex, Cursor and Antigravity, whose trust there stays there', async () => {
+    for (const preset of ['codex', 'cursor', 'antigravity'] as const) {
+      await applyAgentWorkspaceTrust(preset, homedir(), noConfig)
+    }
+    expect(mocks.codex).toHaveBeenCalledWith(homedir(), CODEX_CONFIG_FILES)
+    expect(mocks.cursor).toHaveBeenCalledWith(homedir())
+    expect(mocks.antigravity).toHaveBeenCalledWith(homedir())
+  })
+
+  it('never pre-trusts a home reached through a symlink, since the writers store the realpath', async () => {
+    const root = realpathSync(mkdtempSync(join(tmpdir(), 'orca-agent-trust-home-')))
+    try {
+      const home = join(root, 'home')
+      mkdirSync(home)
+      symlinkSync(home, join(root, 'home-link'), 'junction')
+      const cases = [
+        [join(root, 'home-link'), home],
+        [home, join(root, 'home-link')]
+      ]
+      for (const [workspacePath, homePath] of cases) {
+        const context = { ...noConfig, env: { ...noConfig.env, HOME: homePath } }
+        for (const preset of ['claude', 'copilot', 'qoder'] as const) {
+          await applyAgentWorkspaceTrust(preset, workspacePath, context)
+        }
+      }
+      for (const writer of [mocks.copilot, mocks.qoder, mocks.claudeGrant]) {
+        expect(writer).not.toHaveBeenCalled()
+      }
+    } finally {
+      rmSync(root, { recursive: true, force: true })
+    }
+  })
+
+  it.each([
+    ['a WSL distro', { ...local, wslDistro: 'Ubuntu' }, WORKSPACE],
+    ['a WSL UNC workspace', local, '\\\\wsl.localhost\\Ubuntu\\home\\u\\wt']
+  ])('never writes the Windows home for %s', async (_label, context, workspacePath) => {
+    for (const preset of ['codex', 'cursor', 'copilot', 'qoder', 'antigravity'] as const) {
+      await applyAgentWorkspaceTrust(preset, workspacePath, context)
+    }
+    for (const writer of [mocks.codex, mocks.cursor, mocks.copilot, mocks.qoder]) {
+      expect(writer).not.toHaveBeenCalled()
+    }
+    expect(mocks.antigravity).not.toHaveBeenCalled()
+  })
+  describe('for Claude in a WSL guest', () => {
+    const wslAuth = {
+      configDir: '\\\\wsl.localhost\\Ubuntu\\home\\u\\.claude',
+      runtime: 'wsl',
+      wslDistro: 'Ubuntu',
+      wslLinuxConfigDir: '/home/u/.claude',
+      envPatch: {},
+      stripAuthEnv: false,
+      provenance: 'test'
+    } as const
+    const wsl = { ...local, claudeAuth: wslAuth, wslDistro: 'Ubuntu' }
+
+    afterEach(() => {
+      clearWslHomeCache()
+    })
+
+    it("writes nothing while the guest's home is unknown", async () => {
+      await applyAgentWorkspaceTrust('claude', '\\\\wsl.localhost\\Ubuntu\\home\\u\\wt', wsl)
+      expect(mocks.claudeGrant).not.toHaveBeenCalled()
+    })
+
+    it("never pre-trusts the guest's home, however the distro is spelled", async () => {
+      rememberWslHome('Ubuntu', '\\\\wsl.localhost\\Ubuntu\\home\\u')
+      await applyAgentWorkspaceTrust('claude', '\\\\wsl$\\ubuntu\\home\\u', wsl)
+      expect(mocks.claudeGrant).not.toHaveBeenCalled()
+    })
+
+    it("grants a folder under the guest's known home", async () => {
+      rememberWslHome('ubuntu', '\\\\wsl.localhost\\Ubuntu\\home\\u')
+      mocks.claudeGrant.mockResolvedValueOnce('unchanged')
+      await applyAgentWorkspaceTrust('claude', '\\\\wsl.localhost\\Ubuntu\\home\\u\\wt', wsl)
+      expect(mocks.claudeGrant).toHaveBeenCalledTimes(1)
+    })
+  })
+})
+
+describe('applyAgentWorkspaceTrust for Claude', () => {
+  let root: string
+
+  beforeEach(() => {
+    root = realpathSync(mkdtempSync(join(tmpdir(), 'orca-agent-trust-')))
+  })
+
+  afterEach(() => {
+    rmSync(root, { recursive: true, force: true })
+  })
+
+  it('grants in the config file the final spawn env names', async () => {
+    writeFileSync(join(root, '.claude.json'), '{}')
+    await applyAgentWorkspaceTrust('claude', root, {
+      ...local,
+      env: { CLAUDE_CONFIG_DIR: root }
+    })
+    expect(JSON.parse(readFileSync(join(root, '.claude.json'), 'utf-8'))).toEqual({
+      projects: { [root]: { hasTrustDialogAccepted: true } }
+    })
+  })
+
+  it('gives a local Claude write a short budget, after which Claude asks', async () => {
+    vi.useFakeTimers()
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const grant = pending()
+    mocks.claudeGrant.mockReturnValueOnce(grant.promise.then(() => 'granted' as const))
+    let settled = false
+    const claude = applyAgentWorkspaceTrust('claude', root, {
+      ...local,
+      env: { CLAUDE_CONFIG_DIR: root }
+    }).then(() => {
+      settled = true
+    })
+    await vi.advanceTimersByTimeAsync(SHORT_AGENT_TRUST_WRITE_DEADLINE_MS - 1)
+    expect(settled).toBe(false)
+    await vi.advanceTimersByTimeAsync(2)
+    await claude
+    expect(settled).toBe(true)
+    expect(String(warn.mock.calls[0]?.[0])).toContain('did not settle')
+    grant.release()
+    warn.mockRestore()
+  })
+
+  it.each(['claude', 'codex', 'cursor', 'copilot', 'qoder', 'antigravity'] as const)(
+    'hands an SSH %s launch to the relay instead of writing anything here',
+    async (preset) => {
+      await expect(
+        applyAgentWorkspaceTrust(preset, '/srv/wt', { ...local, connectionId: 'ssh-1' })
+      ).resolves.toEqual({ agentWorkspaceTrust: { workspacePath: '/srv/wt' } })
+      for (const writer of [
+        mocks.codex,
+        mocks.cursor,
+        mocks.copilot,
+        mocks.qoder,
+        mocks.antigravity,
+        mocks.claudeGrant
+      ]) {
+        expect(writer).not.toHaveBeenCalled()
+      }
+    }
+  )
+})
diff --git a/src/main/agent-workspace-trust.ts b/src/main/agent-workspace-trust.ts
new file mode 100644
index 00000000000..58d39b36122
--- /dev/null
+++ b/src/main/agent-workspace-trust.ts
@@ -0,0 +1,80 @@
+import { homedir } from 'node:os'
+import {
+  AGENT_TRUST_WRITE_DEADLINE_MS,
+  SHORT_AGENT_TRUST_WRITE_DEADLINE_MS
+} from './agent-trust-write-deadline'
+import type { AgentTrustPreset } from './agent-trust-presets'
+import { resolveLocalClaudeTrustConfig } from './claude/claude-folder-trust-file'
+import type { ClaudeRuntimeAuthPreparation } from './claude-accounts/runtime-auth/runtime-auth-types'
+import type { AgentWorkspaceTrustSpawnRequest } from '../shared/agent-workspace-trust-spawn-request'
+import { parseWslUncPath } from '../shared/wsl-paths'
+import { applyWorkspaceTrustOnThisHost } from './execution-host-workspace-trust'
+import { getLocalCodexTrustConfigFiles } from './codex/codex-home-paths'
+import { getCachedWslHome } from './wsl-home-cache'
+
+/** What a trust writer needs to reach the file the launched agent will read. */
+export type AgentTrustLaunchContext = {
+  /** The final spawn env, before the host's own process env. */
+  env: Record<string, string | undefined> | undefined
+  /** Managed-account auth prep for a Claude launch; names a WSL guest's config dir. */
+  claudeAuth: ClaudeRuntimeAuthPreparation | null
+  wslDistro: string | null
+  /** SSH connection that runs the agent; null means this machine. */
+  connectionId: string | null
+}
+
+/** Spawn fields the dispatcher asks the caller to forward to the process owner. */
+export type AgentTrustSpawnFields = {
+  agentWorkspaceTrust?: AgentWorkspaceTrustSpawnRequest
+}
+
+function isWslLaunch(workspacePath: string, context: AgentTrustLaunchContext): boolean {
+  return (
+    Boolean(context.wslDistro) ||
+    context.claudeAuth?.runtime === 'wsl' ||
+    parseWslUncPath(workspacePath) !== null
+  )
+}
+
+/** Homes an agent on this machine may read trust under; SSH hosts check their own. */
+function localHomePaths(workspacePath: string, context: AgentTrustLaunchContext) {
+  const wslWorkspace = parseWslUncPath(workspacePath)
+  // Why: a WSL guest agent reads trust under the guest's home; an uncached one means write nothing.
+  return wslWorkspace
+    ? [getCachedWslHome(wslWorkspace.distro)]
+    : [homedir(), context.env?.HOME, context.env?.USERPROFILE]
+}
+
+/**
+ * Pre-trusts `workspacePath` for the agent Orca is about to start, on the host that runs
+ * it. Never throws and never waits past the preset's deadline: a miss means the agent asks.
+ */
+export async function applyAgentWorkspaceTrust(
+  preset: AgentTrustPreset,
+  workspacePath: string,
+  context: AgentTrustLaunchContext
+): Promise<AgentTrustSpawnFields> {
+  if (context.connectionId) {
+    // Why: the SSH host's relay writes on its own disk, under its own homes and the agent's final env.
+    return { agentWorkspaceTrust: { workspacePath } }
+  }
+  // Why: the other writers target this host's home, which a WSL guest agent never reads.
+  if (preset !== 'claude' && isWslLaunch(workspacePath, context)) {
+    return {}
+  }
+  await applyWorkspaceTrustOnThisHost(preset, workspacePath, () => ({
+    homes: localHomePaths(workspacePath, context),
+    claudeConfig: () =>
+      resolveLocalClaudeTrustConfig({
+        workspacePath,
+        env: { ...process.env, ...context.env },
+        claudeAuth: context.claudeAuth,
+        wslDistro: context.wslDistro
+      }),
+    codexConfigFiles: getLocalCodexTrustConfigFiles,
+    // Why: Codex queues behind a config lane it shares with Orca's hook installs.
+    deadlineMs:
+      preset === 'codex' ? AGENT_TRUST_WRITE_DEADLINE_MS : SHORT_AGENT_TRUST_WRITE_DEADLINE_MS
+  }))
+  return {}
+}
diff --git a/src/main/ai-vault-search/session-search-deleted-sources.test.ts b/src/main/ai-vault-search/session-search-deleted-sources.test.ts
index 5fd4e5cd630..39fbda9bb14 100644
--- a/src/main/ai-vault-search/session-search-deleted-sources.test.ts
+++ b/src/main/ai-vault-search/session-search-deleted-sources.test.ts
@@ -264,6 +264,31 @@ it('keeps a synthetic row when this pass did not enumerate its container', async
   ).resolves.toMatchObject({ retired: [], unverifiable: [row] })
 })
 
+it('keeps a ZCode SQLite row when its database read failed during discovery', async () => {
+  const db = join(harness.root, 'db.sqlite')
+  await writeFile(db, '')
+  const row = `${db}#zcode-session`
+
+  const result = await retire([row], { roots: [] })
+  expect(result.retired).toEqual([])
+  expect(result.unverifiable).toEqual([row])
+  expect(removed).toEqual([])
+})
+
+it('retires a ZCode SQLite row only after a successful full database enumeration', async () => {
+  const db = join(harness.root, 'db.sqlite')
+  await writeFile(db, '')
+  const kept = `${db}#session-1`
+  const deleted = `${db}#session-2`
+
+  const result = await retire([kept, deleted], {
+    roots: [],
+    enumeratedContainers: new Map([[db, new Set(['session-1'])]])
+  })
+  expect(result.retired).toEqual([deleted])
+  expect(result.unverifiable).toEqual([])
+})
+
 it('retires a synthetic row when the container it came from is gone', async () => {
   const db = join(harness.root, 'opencode.db')
   await writeFile(db, '')
diff --git a/src/main/ai-vault-search/session-search-host-registration.test.ts b/src/main/ai-vault-search/session-search-host-registration.test.ts
index e2a31ec4f21..5a535d3e554 100644
--- a/src/main/ai-vault-search/session-search-host-registration.test.ts
+++ b/src/main/ai-vault-search/session-search-host-registration.test.ts
@@ -1,4 +1,3 @@
-import { readFileSync } from 'node:fs'
 import { join } from 'node:path'
 import { afterEach, beforeEach, expect, it, vi } from 'vitest'
 import { resetSessionParseCacheForTests } from '../ai-vault/session-scanner-parse-cache'
@@ -33,8 +32,6 @@ vi.mock('../ai-vault/cached-session-list', async (importOriginal) => ({
   localAiVaultScanRoots
 }))
 
-const ROOT = join(import.meta.dirname, '..', '..', '..')
-
 let harness: SessionSearchIndexerHarness
 let installed: { apply?(settings: AiVaultSearchSettings): void; dispose(): void } | null
 
@@ -141,26 +138,6 @@ it('registers an in-process service for a host with no scanner child', async ()
   })
 })
 
-// The behavioural tests above prove the installers register; these prove each
-// host's boot path reaches one, which no unit of either module can show.
-it.each([
-  [
-    'desktop and headless serve',
-    'src/main/startup/main-process-runtime-service.ts',
-    'installChildSessionSearchService'
-  ],
-  ['orcad', 'src/main/orcad/orcad-session-search.ts', 'installInProcessSessionSearchService'],
-  [
-    'the relay daemon',
-    'src/relay/relay-runtime-services.ts',
-    'installInProcessSessionSearchService'
-  ]
-])('boots %s with a registered session search service', (_host, file, installer) => {
-  const source = readFileSync(join(ROOT, file), 'utf8')
-  expect(source).toContain(installer)
-  expect(source).toMatch(new RegExp(`${installer}\\(\\{`))
-})
-
 it('disables immediately without root discovery', async () => {
   const { installChildSessionSearchService, applySessionSearchSettingsChange } =
     await import('./session-search-enablement')
@@ -231,11 +208,3 @@ it('re-applies consent on an in-process host without reinstalling the service',
     reason: 'disabled'
   })
 })
-
-// orcad reaches the index through the deps hook the runtime RPC calls; the wiring is
-// what no unit of either module can show.
-it('wires orcad consent from the runtime hook to the installed service', () => {
-  const source = readFileSync(join(ROOT, 'src/main/orcad/orcad-entry.ts'), 'utf8')
-  expect(source).toContain('applySessionSearchSettings:')
-  expect(source).toContain('sessionSearch?.apply(next)')
-})
diff --git a/src/main/ai-vault-search/session-search-scan-roots.test.ts b/src/main/ai-vault-search/session-search-scan-roots.test.ts
index 39324ca5da8..0d30ca632e8 100644
--- a/src/main/ai-vault-search/session-search-scan-roots.test.ts
+++ b/src/main/ai-vault-search/session-search-scan-roots.test.ts
@@ -76,3 +76,26 @@ it('reads an added, dropped or changed root as a different set', () => {
   expect(sameSessionSearchRoots(base, { openclawStateDir: STATE })).toBe(false)
   expect(sameSessionSearchRoots(base, { ...base, wslHomeDirs: ['/home/b'] })).toBe(false)
 })
+
+it('compares WSL readers structurally without restarting for reordered objects', () => {
+  const ubuntu = { distro: 'Ubuntu', executable: '/usr/bin/node', readerPath: '/reader.cjs' }
+  const debian = { distro: 'Debian', error: 'Preparing' }
+  expect(
+    sameSessionSearchRoots(
+      { wslOpenCodeReaders: [ubuntu, debian] },
+      {
+        wslOpenCodeReaders: [
+          { error: 'Preparing', distro: 'debian' },
+          { readerPath: '/reader.cjs', executable: '/usr/bin/node', distro: 'ubuntu' }
+        ]
+      }
+    )
+  ).toBe(true)
+  expect(sameSessionSearchRoots({}, { wslOpenCodeReaders: [] })).toBe(true)
+  expect(
+    sameSessionSearchRoots(
+      { wslOpenCodeReaders: [ubuntu] },
+      { wslOpenCodeReaders: [{ ...ubuntu, executable: '/new/node' }] }
+    )
+  ).toBe(false)
+})
diff --git a/src/main/ai-vault-search/session-search-scan-roots.ts b/src/main/ai-vault-search/session-search-scan-roots.ts
index 5c1041eac25..d8eb766a371 100644
--- a/src/main/ai-vault-search/session-search-scan-roots.ts
+++ b/src/main/ai-vault-search/session-search-scan-roots.ts
@@ -153,10 +153,22 @@ export function sameSessionSearchRoots(
 }
 
 function comparableRootFields(roots: SessionSearchScanRoots): string[] {
-  return Object.entries(roots)
+  const { wslOpenCodeReaders, ...pathRoots } = roots
+  return Object.entries(pathRoots)
     .filter(([, value]) => value !== undefined)
     .map(
       ([key, value]) => `${key}=${JSON.stringify(Array.isArray(value) ? [...value].sort() : value)}`
     )
+    .concat(
+      (wslOpenCodeReaders ?? []).map(
+        (reader) =>
+          `wslOpenCodeReaders=${JSON.stringify([
+            reader.distro.toLowerCase(),
+            reader.executable,
+            reader.readerPath,
+            reader.error
+          ])}`
+      )
+    )
     .sort()
 }
diff --git a/src/main/ai-vault-search/session-search-synthetic-sources.ts b/src/main/ai-vault-search/session-search-synthetic-sources.ts
index 86222b9c5fe..59541e7924f 100644
--- a/src/main/ai-vault-search/session-search-synthetic-sources.ts
+++ b/src/main/ai-vault-search/session-search-synthetic-sources.ts
@@ -4,15 +4,14 @@ import type { SessionFileCandidate } from '../ai-vault/session-scanner-types'
 
 /**
  * A row whose path names a container and an entry inside it rather than a file
- * of its own. OpenCode's SQLite sessions are the one shape today
- * (`<opencode.db>#<sessionId>`), which is why this reads through that source's
- * own splitter rather than reinventing the encoding.
+ * of its own. OpenCode and ZCode SQLite sessions share the same encoding,
+ * with distinct database names validated by the source splitter.
  */
 export type SessionSearchSyntheticSource = { container: string; id: string }
 
 export function splitSyntheticSessionSource(path: string): SessionSearchSyntheticSource | null {
-  const openCode = splitOpenCodeSqliteCandidate(path)
-  return openCode ? { container: openCode.dbPath, id: openCode.sessionId } : null
+  const sqlite = splitOpenCodeSqliteCandidate(path) ?? splitOpenCodeSqliteCandidate(path, 'zcode')
+  return sqlite ? { container: sqlite.dbPath, id: sqlite.sessionId } : null
 }
 
 /**
diff --git a/src/main/ai-vault/cached-session-list-wsl-probe.test.ts b/src/main/ai-vault/cached-session-list-wsl-probe.test.ts
index e5857faf378..0c2ef27316a 100644
--- a/src/main/ai-vault/cached-session-list-wsl-probe.test.ts
+++ b/src/main/ai-vault/cached-session-list-wsl-probe.test.ts
@@ -15,6 +15,9 @@ vi.mock('./session-scanner-worker-spawn', () => ({
   scanAiVaultSessionsInWorker,
   resetAiVaultScannerWorkerForTests: vi.fn()
 }))
+vi.mock('./opencode-wsl-runtime-preparation', () => ({
+  prepareOpenCodeWslReaders: vi.fn(async () => [])
+}))
 
 import { _resetWslCachesForTests, _setWslCachesForTests, listWslDistrosAsync } from '../wsl'
 import { filterPathsToRunningWslDistrosAsync } from '../wsl-running-path-filter'
diff --git a/src/main/ai-vault/cached-session-list.ts b/src/main/ai-vault/cached-session-list.ts
index 673de66e666..0d1cbabb7c8 100644
--- a/src/main/ai-vault/cached-session-list.ts
+++ b/src/main/ai-vault/cached-session-list.ts
@@ -8,6 +8,7 @@ import { getCachedWslDistros, hasCachedWslDistros, listRunningWslHomeDirsAsync }
 import { filterPathsToRunningWslDistrosAsync } from '../wsl-running-path-filter'
 import type { AiVaultListArgs, AiVaultListResult } from '../../shared/ai-vault-types'
 import type { AiVaultScanOptions } from './session-scanner-types'
+import { prepareOpenCodeWslReaders } from './opencode-wsl-runtime-preparation'
 import { LOCAL_EXECUTION_HOST_ID } from '../../shared/execution-host'
 import { AiVaultScanCoordinator } from './ai-vault-scan-coordinator'
 import {
@@ -57,7 +58,7 @@ export function configureAiVaultSessionSources(next: AiVaultSessionSources): voi
  */
 export async function localAiVaultScanRoots(): Promise<
   Required<Pick<AiVaultScanOptions, 'additionalCodexSessionsDirs' | 'wslHomeDirs'>> &
-    Pick<AiVaultScanOptions, 'executionHostId'>
+    Pick<AiVaultScanOptions, 'executionHostId' | 'wslOpenCodeReaders'>
 > {
   const [additionalCodexHomes, wslHomeDirs] = await Promise.all([
     filterPathsToRunningWslDistrosAsync(configuredAdditionalCodexHomePaths()),
@@ -66,6 +67,7 @@ export async function localAiVaultScanRoots(): Promise<
   return {
     additionalCodexSessionsDirs: additionalCodexHomes.map((homePath) => join(homePath, 'sessions')),
     wslHomeDirs,
+    wslOpenCodeReaders: await prepareOpenCodeWslReaders(wslHomeDirs),
     // Why: this scan is always host-local; callers addressing this host by a
     // runtime id get the result restamped at the RPC edge, never rescanned.
     executionHostId: LOCAL_EXECUTION_HOST_ID
diff --git a/src/main/ai-vault/opencode-wsl-runtime-preparation.test.ts b/src/main/ai-vault/opencode-wsl-runtime-preparation.test.ts
new file mode 100644
index 00000000000..d78130a119f
--- /dev/null
+++ b/src/main/ai-vault/opencode-wsl-runtime-preparation.test.ts
@@ -0,0 +1,260 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { ORCAD_BUN_RELEASE_ASSETS } from '../../shared/orcad-bun-runtime'
+import { runProcess } from '../../shared/child-process/run-process'
+import type * as preparationModule from './opencode-wsl-runtime-preparation'
+
+const mocks = vi.hoisted(() => ({
+  exists: vi.fn(() => true),
+  run: vi.fn(),
+  running: vi.fn(async (paths: readonly string[]) => [...paths]),
+  download: vi.fn(async () => 'C:\\cache\\bun'),
+  bundles: vi.fn((platform: string) => [`C:/relay/${platform}`])
+}))
+vi.mock('node:fs', () => ({ existsSync: mocks.exists }))
+vi.mock('../../shared/app-environment', () => ({
+  getAppEnvironment: () => ({
+    getAppPath: () => 'C:/app',
+    getPath: () => 'C:/profile'
+  })
+}))
+vi.mock('../wsl/wsl-runner', () => ({ runWslProcess: mocks.run }))
+vi.mock('../wsl-running-path-filter', () => ({
+  filterPathsToRunningWslDistrosAsync: mocks.running
+}))
+vi.mock('../ssh/orcad-bun-runtime-materializer', () => ({
+  materializeCachedOrcadBunRuntime: mocks.download
+}))
+vi.mock('../ssh/relay-bundle-paths', () => ({ relayBundleCandidates: mocks.bundles }))
+
+const home = String.raw`\\wsl.localhost\Ubuntu\home\ada`
+const success = (stdout: string) => ({ stdout, stderr: '', code: 0, timedOut: false })
+let prepare: typeof preparationModule.prepareOpenCodeWslReaders
+
+beforeEach(async () => {
+  vi.resetModules()
+  vi.clearAllMocks()
+  vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+  mocks.exists.mockReturnValue(true)
+  mocks.running.mockImplementation(async (paths) => [...paths])
+  mocks.run.mockImplementation(async (spec) =>
+    success(
+      spec.script?.startsWith('data=')
+        ? 'present'
+        : spec.program === 'wslpath'
+          ? '/mnt/c/reader.cjs'
+          : '/usr/bin/node'
+    )
+  )
+  prepare = (await import('./opencode-wsl-runtime-preparation')).prepareOpenCodeWslReaders
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+})
+
+async function prepared() {
+  let result = await prepare([home])
+  await vi.waitFor(async () => {
+    result = await prepare([home])
+    expect(result[0]?.executable).toBeDefined()
+  })
+  return result
+}
+
+describe('WSL SQLite runtime preparation', () => {
+  it('returns immediately, coalesces distro aliases, and uses an actual guest SQLite probe', async () => {
+    let release: (value: ReturnType<typeof success>) => void = () => {}
+    mocks.run.mockReturnValueOnce(
+      new Promise((resolve) => {
+        release = resolve
+      })
+    )
+    expect(await prepare([home, String.raw`\\wsl$\ubuntu\home\ada`])).toHaveLength(1)
+    await vi.waitFor(() => expect(mocks.run).toHaveBeenCalledOnce())
+    expect((await prepare([home]))[0]?.error).toContain('Preparing')
+    expect(mocks.run).toHaveBeenCalledOnce()
+    release(success('present'))
+    expect(await prepared()).toEqual([
+      { distro: 'ubuntu', executable: '/usr/bin/node', readerPath: '/mnt/c/reader.cjs' }
+    ])
+    expect(mocks.run).toHaveBeenCalledWith(
+      expect.objectContaining({
+        program: 'node',
+        loginPath: 'preferred',
+        args: ['-e', expect.stringContaining("require('node:sqlite')")]
+      })
+    )
+    expect(mocks.bundles.mock.calls.map(([platform]) => platform)).toEqual([
+      'linux-x64',
+      'linux-arm64'
+    ])
+    expect(mocks.download).not.toHaveBeenCalled()
+  })
+
+  it('does not start a stopped distro and retries a failed preparation after cooldown', async () => {
+    let now = 10_000
+    vi.spyOn(Date, 'now').mockImplementation(() => now)
+    mocks.running.mockResolvedValue([])
+    await prepare([home])
+    await vi.waitFor(async () => expect((await prepare([home]))[0]?.error).toContain('not running'))
+    expect(mocks.run).not.toHaveBeenCalled()
+    mocks.running.mockImplementation(async (paths) => [...paths])
+    expect((await prepare([home]))[0]?.error).toContain('not running')
+    now += 30_001
+    expect((await prepared())[0]?.executable).toBe('/usr/bin/node')
+  })
+
+  it('keeps a working reader during revalidation and prunes completed removed distros', async () => {
+    let now = 10_000
+    vi.spyOn(Date, 'now').mockImplementation(() => now)
+    const ready = await prepared()
+    now += 600_001
+    let release: (value: ReturnType<typeof success>) => void = () => {}
+    mocks.run.mockReturnValueOnce(
+      new Promise((resolve) => {
+        release = resolve
+      })
+    )
+    expect(await prepare([home])).toEqual(ready)
+    await vi.waitFor(() => expect(mocks.run).toHaveBeenCalledTimes(4))
+    expect(await prepare([home])).toEqual(ready)
+    mocks.run.mockResolvedValueOnce(success('/mnt/c/repaired-reader.cjs'))
+    release(success('present'))
+    await vi.waitFor(async () =>
+      expect((await prepare([home]))[0]?.readerPath).toBe('/mnt/c/repaired-reader.cjs')
+    )
+    expect(await prepare([])).toEqual([])
+    expect((await prepare([home]))[0]?.error).toContain('Preparing')
+    await prepared()
+  })
+
+  it('falls back to the pinned proxy runtime, verifies the guest stage, and preserves literal argv', async () => {
+    const expected = ORCAD_BUN_RELEASE_ASSETS['linux-arm64-musl'].executableSha256
+    mocks.run.mockImplementation(async (spec) => {
+      if (spec.script?.startsWith('data=')) {
+        return success('present')
+      }
+      if (spec.program === 'node') {
+        return { ...success(''), code: 1, stderr: 'no sqlite' }
+      }
+      if (spec.program === 'uname') {
+        return success('aarch64')
+      }
+      if (spec.program === 'wslpath') {
+        return success('/mnt/c/reader $literal.cjs')
+      }
+      if (spec.script?.startsWith('getconf')) {
+        return success('musl libc')
+      }
+      if (spec.script?.startsWith('printf')) {
+        return success('/home/ada $literal')
+      }
+      return success('')
+    })
+    const result = await prepared()
+    expect(mocks.download).toHaveBeenCalledWith(
+      'linux-arm64-musl',
+      expect.any(String),
+      expect.objectContaining({ signal: expect.any(AbortSignal) })
+    )
+    expect(result[0]?.executable).toBe(
+      `/home/ada $literal/.cache/orca/vault-sqlite/${expected}/bun`
+    )
+    expect(mocks.run).toHaveBeenCalledWith(
+      expect.objectContaining({
+        args: ['/mnt/c/reader $literal.cjs', result[0]?.executable, expected],
+        script: expect.stringContaining('actual=$(sha256sum -- "$stage")')
+      })
+    )
+    expect(
+      mocks.run.mock.calls.every(
+        ([spec]) => spec.timeoutMs <= 15_000 && spec.maxOutputBytes === 16_384
+      )
+    ).toBe(true)
+  })
+
+  it('rechecks running state after downloading before it copies a runtime', async () => {
+    mocks.run.mockImplementation(async (spec) => {
+      if (spec.script?.startsWith('data=')) {
+        return success('present')
+      }
+      if (spec.program === 'node') {
+        return { ...success(''), code: 1 }
+      }
+      if (spec.program === 'uname') {
+        return success('x86_64')
+      }
+      if (spec.program === 'wslpath') {
+        return success('/mnt/c/reader.cjs')
+      }
+      if (spec.script?.startsWith('getconf')) {
+        return success('glibc 2.31')
+      }
+      if (spec.script?.startsWith('printf')) {
+        return success('/home/ada')
+      }
+      return success('')
+    })
+    mocks.download.mockImplementationOnce(async () => {
+      mocks.running.mockResolvedValue([])
+      return 'C:\\cache\\bun'
+    })
+    await prepare([home])
+    await vi.waitFor(async () => expect((await prepare([home]))[0]?.error).toContain('not running'))
+    expect(mocks.run.mock.calls.some(([spec]) => spec.script?.includes('mv -f'))).toBe(false)
+  })
+
+  it('ignores native roots and does no work outside Windows', async () => {
+    expect(await prepare(['C:\\Users\\ada'])).toEqual([])
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('linux')
+    expect(await prepare([home])).toEqual([])
+    expect(mocks.run).not.toHaveBeenCalled()
+  })
+
+  it('skips runtime setup without a database and rechecks soon after OpenCode starts', async () => {
+    let now = 10_000
+    vi.spyOn(Date, 'now').mockImplementation(() => now)
+    mocks.run.mockResolvedValueOnce(success(''))
+    await prepare([home])
+    await vi.waitFor(async () =>
+      expect((await prepare([home]))[0]?.error).toContain('No OpenCode database')
+    )
+    expect(mocks.run).toHaveBeenCalledOnce()
+    expect(mocks.download).not.toHaveBeenCalled()
+    expect(mocks.run.mock.calls[0]?.[0].script).toContain('OPENCODE_DB')
+    expect(mocks.run.mock.calls[0]?.[0].script).toContain('XDG_DATA_HOME')
+    now += 30_001
+    expect((await prepared())[0]?.executable).toBe('/usr/bin/node')
+    expect(mocks.running).toHaveBeenCalledWith(expect.any(Array), { requireConfirmed: true })
+  })
+
+  it.skipIf(process.platform === 'win32')(
+    'keeps the discovery default visible when guest overrides point elsewhere',
+    async () => {
+      await prepared()
+      const script = mocks.run.mock.calls[0]?.[0].script
+      const directory = await mkdtemp(join(tmpdir(), 'orca-wsl-presence-'))
+      try {
+        const data = join(directory, '.local', 'share', 'opencode')
+        await mkdir(data, { recursive: true })
+        await writeFile(join(data, 'opencode.db'), '')
+        const result = await runProcess({
+          program: '/bin/sh',
+          args: ['-c', script],
+          env: {
+            HOME: directory,
+            XDG_DATA_HOME: join(directory, 'empty'),
+            OPENCODE_DB: ':memory:'
+          }
+        })
+        expect(result.code).toBe(0)
+        expect(result.stdout).toBe('present')
+      } finally {
+        await rm(directory, { recursive: true, force: true })
+      }
+    }
+  )
+})
diff --git a/src/main/ai-vault/opencode-wsl-runtime-preparation.ts b/src/main/ai-vault/opencode-wsl-runtime-preparation.ts
new file mode 100644
index 00000000000..c9bc81fff77
--- /dev/null
+++ b/src/main/ai-vault/opencode-wsl-runtime-preparation.ts
@@ -0,0 +1,191 @@
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { getAppEnvironment } from '../../shared/app-environment'
+import { waitForPromiseWithSignal } from '../../shared/abort-signal-reason'
+import { ORCAD_BUN_RELEASE_ASSETS, type OrcadBunTarget } from '../../shared/orcad-bun-runtime'
+import { RELAY_OPENCODE_SQLITE_READER_FILENAME } from '../../shared/relay-artifacts'
+import { parseWslUncPath, toWindowsWslUncPath } from '../../shared/wsl-paths'
+import { relayBundleCandidates } from '../ssh/relay-bundle-paths'
+import { materializeCachedOrcadBunRuntime } from '../ssh/orcad-bun-runtime-materializer'
+import { parseOrcadLinuxLibc } from '../ssh/orcad-deployment-target'
+import { runWslProcess, type WslSpec } from '../wsl/wsl-runner'
+import { filterPathsToRunningWslDistrosAsync } from '../wsl-running-path-filter'
+import type { OpenCodeWslRuntime } from './session-scanner-opencode-wsl-runtime'
+
+const preparation = new Map<string, { value: OpenCodeWslRuntime; expires: number }>()
+const downloads = new Map<OrcadBunTarget, Promise<string>>()
+const PREPARATION_TIMEOUT_MS = 180_000
+const SQLITE_PROBE = `const db=new (require('node:sqlite').DatabaseSync)(':memory:');db.prepare('SELECT 1').get();db.close();process.stdout.write(process.execPath)`
+
+/** Only running distro roots enter here; a slow first install must not hold up local history. */
+export async function prepareOpenCodeWslReaders(
+  roots: readonly string[]
+): Promise<OpenCodeWslRuntime[]> {
+  if (process.platform !== 'win32') {
+    return []
+  }
+  const distros = new Map<string, string>()
+  for (const root of roots) {
+    const distro = parseWslUncPath(root)?.distro
+    if (distro) {
+      distros.set(distro.toLowerCase(), distro)
+    }
+  }
+  for (const [key, entry] of preparation) {
+    if (!distros.has(key) && Number.isFinite(entry.expires)) {
+      preparation.delete(key)
+    }
+  }
+  return [...distros].map(([key, distro]) => {
+    const previous = preparation.get(key)
+    if (previous && previous.expires > Date.now()) {
+      return previous.value
+    }
+    const entry: { expires: number; value: OpenCodeWslRuntime } = {
+      expires: Number.POSITIVE_INFINITY,
+      value: previous?.value.executable
+        ? previous.value
+        : {
+            distro,
+            error: 'Preparing the WSL SQLite reader. Refresh Vault after setup finishes.'
+          }
+    }
+    preparation.set(key, entry)
+    void prepare(distro).then(
+      (runtime) => {
+        entry.expires = Date.now() + (runtime.executable ? 10 * 60_000 : 30_000)
+        entry.value = runtime
+      },
+      (error: unknown) => {
+        entry.expires = Date.now() + 30_000
+        entry.value = { distro, error: error instanceof Error ? error.message : String(error) }
+      }
+    )
+    return entry.value
+  })
+}
+
+async function prepare(distro: string): Promise<OpenCodeWslRuntime> {
+  const deadline = Date.now() + PREPARATION_TIMEOUT_MS
+  const signal = AbortSignal.timeout(PREPARATION_TIMEOUT_MS)
+  const run = async (spec: WslSpec): Promise<string> => {
+    signal.throwIfAborted()
+    const running = await waitForPromiseWithSignal(
+      filterPathsToRunningWslDistrosAsync([toWindowsWslUncPath('/', distro)], {
+        requireConfirmed: true
+      }),
+      signal
+    )
+    if (running.length === 0) {
+      throw new Error(`WSL distro ${distro} is not running. Start it to read its history.`)
+    }
+    signal.throwIfAborted()
+    const result = await runWslProcess({
+      ...spec,
+      distro,
+      timeoutMs: Math.max(1, Math.min(15_000, deadline - Date.now())),
+      maxOutputBytes: 16 * 1024
+    })
+    if (result.code !== 0 || result.timedOut) {
+      throw new Error(`WSL SQLite reader setup failed: ${result.stderr.trim() || 'command failed'}`)
+    }
+    return result.stdout.trim()
+  }
+  const app = getAppEnvironment()
+  // The reader is plain JavaScript; either packaged Linux architecture is usable.
+  const reader = (['linux-x64', 'linux-arm64'] as const)
+    .flatMap((platform) => relayBundleCandidates(platform, app.getAppPath()))
+    .map((directory) => join(directory, RELAY_OPENCODE_SQLITE_READER_FILENAME))
+    .find(existsSync)
+  if (!reader) {
+    throw new Error('The bundled WSL SQLite reader is missing. Reinstall Orca to repair it.')
+  }
+  const hasDatabase = await run({
+    script: [
+      'data="${XDG_DATA_HOME:-$HOME/.local/share}/opencode"',
+      // WSL discovery still enumerates the default data root independently of guest overrides.
+      'for db in "$HOME/.local/share/opencode"/opencode.db "$HOME/.local/share/opencode"/opencode-*.db; do if [ -f "$db" ]; then printf present; exit 0; fi; done',
+      'case "${OPENCODE_DB-}" in',
+      '  :memory:) exit 0 ;;',
+      '  /*) [ ! -f "$OPENCODE_DB" ] || printf present ;;',
+      '  "") for db in "$data"/opencode*.db; do if [ -f "$db" ]; then printf present; break; fi; done ;;',
+      '  *) [ ! -f "$data/$OPENCODE_DB" ] || printf present ;;',
+      'esac'
+    ].join('\n'),
+    loginPath: 'none'
+  })
+  if (hasDatabase !== 'present') {
+    return { distro, error: 'No OpenCode database is present in this WSL distro.' }
+  }
+  const readerPath = await run({
+    program: 'wslpath',
+    args: ['-a', '-u', reader],
+    loginPath: 'none'
+  })
+  let executable: string | null = null
+  try {
+    executable = await run({ program: 'node', args: ['-e', SQLITE_PROBE], loginPath: 'preferred' })
+  } catch {
+    // Older guest Node remains supported; only the SQLite reader needs this runtime.
+  }
+  if (!executable?.startsWith('/')) {
+    const arch = await run({ program: 'uname', args: ['-m'], loginPath: 'none' })
+    if (arch !== 'x86_64' && arch !== 'aarch64' && arch !== 'arm64') {
+      throw new Error(`Unsupported WSL SQLite reader architecture: ${arch}`)
+    }
+    const libc = parseOrcadLinuxLibc(
+      await run({
+        script:
+          'getconf GNU_LIBC_VERSION 2>/dev/null || ldd --version 2>&1 || ' +
+          'for loader in /lib/ld-musl-*.so.1; do [ ! -e "$loader" ] || { echo musl; break; }; done',
+        loginPath: 'none'
+      })
+    )
+    const target = `linux-${arch === 'x86_64' ? 'x64' : 'arm64'}-${libc}` as const
+    const expected = ORCAD_BUN_RELEASE_ASSETS[target].executableSha256
+    const home = await run({ script: 'printf %s "$HOME"', loginPath: 'none' })
+    if (!home.startsWith('/')) {
+      throw new Error('WSL did not provide an absolute home directory.')
+    }
+    executable = `${home}/.cache/orca/vault-sqlite/${expected}/bun`
+    const present = await run({
+      script: 'if [ -x "$1" ]; then sha256sum -- "$1"; fi',
+      args: [executable],
+      loginPath: 'none'
+    })
+    if (!present.startsWith(`${expected} `)) {
+      let download = downloads.get(target)
+      if (!download) {
+        download = materializeCachedOrcadBunRuntime(
+          target,
+          join(app.getPath('userData'), 'orcad-artifacts'),
+          {
+            signal: AbortSignal.timeout(PREPARATION_TIMEOUT_MS)
+          }
+        ).finally(() => downloads.delete(target))
+        downloads.set(target, download)
+      }
+      const localRuntime = await waitForPromiseWithSignal(download, signal)
+      const source = await run({
+        program: 'wslpath',
+        args: ['-a', '-u', localRuntime],
+        loginPath: 'none'
+      })
+      await run({
+        script: [
+          'set -eu; umask 077',
+          'mkdir -p -- "${2%/*}"',
+          'stage=$(mktemp "${2}.upload.XXXXXX")',
+          'trap \'rm -f -- "$stage"\' EXIT',
+          'cp -- "$1" "$stage"',
+          'actual=$(sha256sum -- "$stage"); [ "${actual%% *}" = "$3" ]',
+          'chmod 700 "$stage"',
+          'mv -f -- "$stage" "$2"'
+        ].join('\n'),
+        args: [source, executable, expected],
+        loginPath: 'none'
+      })
+    }
+  }
+  return { distro, executable, readerPath }
+}
diff --git a/src/main/ai-vault/remote-session-large-transcripts.test.ts b/src/main/ai-vault/remote-session-large-transcripts.test.ts
index 73c33aec27f..e6bac42fd7e 100644
--- a/src/main/ai-vault/remote-session-large-transcripts.test.ts
+++ b/src/main/ai-vault/remote-session-large-transcripts.test.ts
@@ -28,7 +28,7 @@ describe('large remote history through real relay filesystem', () => {
       await writeFile(badPath, metadata('bad') + 'x'.repeat(11 * 1024 * 1024))
       await writeFile(join(directory, 'good.jsonl'), metadata('good'))
       const result = await scanRemoteAiVaultSessions({
-        provider: createRelayAiVaultFilesystemProvider(),
+        provider: createRelayAiVaultFilesystemProvider({ homeDirectory: home, environment: {} }),
         executionHostId: 'ssh:record-limit',
         remoteHome: home,
         hostPlatform: platform,
@@ -94,7 +94,7 @@ describe('large remote history through real relay filesystem', () => {
           filler.slice(filler.length / 2)
       )
       const result = await scanRemoteAiVaultSessions({
-        provider: createRelayAiVaultFilesystemProvider(),
+        provider: createRelayAiVaultFilesystemProvider({ homeDirectory: home, environment: {} }),
         executionHostId: 'ssh:synthetic-17744',
         remoteHome: home,
         hostPlatform: platform,
@@ -161,7 +161,7 @@ describe('large remote history through real relay filesystem', () => {
         await mkdir(dirname(path), { recursive: true })
         await writeFile(path, JSON.stringify(record))
         const result = await scanRemoteAiVaultSessions({
-          provider: createRelayAiVaultFilesystemProvider(),
+          provider: createRelayAiVaultFilesystemProvider({ homeDirectory: home, environment: {} }),
           executionHostId: `ssh:large-${agent}`,
           remoteHome: home,
           hostPlatform: platform,
@@ -185,7 +185,10 @@ describe('large remote history through real relay filesystem', () => {
       await mkdir(directory, { recursive: true })
       const content = jsonl([{ type: 'session_meta', payload: { id: 'small', cwd: '/repo' } }])
       await writeFile(join(directory, 'small.jsonl'), content)
-      const provider = createRelayAiVaultFilesystemProvider()
+      const provider = createRelayAiVaultFilesystemProvider({
+        homeDirectory: home,
+        environment: {}
+      })
       provider.readTranscriptBytes = () => {
         throw new Error('Small file must keep its existing read path')
       }
diff --git a/src/main/ai-vault/remote-session-parse-cache.ts b/src/main/ai-vault/remote-session-parse-cache.ts
index c892c4961ef..24d63c3dc2a 100644
--- a/src/main/ai-vault/remote-session-parse-cache.ts
+++ b/src/main/ai-vault/remote-session-parse-cache.ts
@@ -35,6 +35,10 @@ export function remoteSessionParseHostKey(context: RemoteScannerContext): string
   return `${context.executionHostId}\u0000${context.hostPlatform.relayPlatform}`
 }
 
+export function remoteSessionCandidateKey(candidate: RemoteSessionCandidate): string {
+  return `${candidate.source.agent}\u0000${candidate.file.path}`
+}
+
 function storeEntry(path: string, entry: RemoteSessionParseCacheEntry): void {
   cache.delete(path)
   cache.set(path, entry)
@@ -79,7 +83,8 @@ export async function parseRemoteSessionFileCached(args: {
   stats?: RemoteSessionParseStats
 }): Promise<AiVaultSession | null> {
   const { file } = args.candidate
-  const entry = cache.get(file.path)
+  const key = remoteSessionCandidateKey(args.candidate)
+  const entry = cache.get(key)
   const unchanged =
     entry !== undefined &&
     entry.hostKey === args.hostKey &&
@@ -96,7 +101,7 @@ export async function parseRemoteSessionFileCached(args: {
       entry.session = await args.refreshReusedSession(entry.session)
     }
     // Refresh recency without re-parsing so the LRU evicts cold paths first.
-    storeEntry(file.path, entry)
+    storeEntry(key, entry)
     return entry.session
   }
 
@@ -104,7 +109,7 @@ export async function parseRemoteSessionFileCached(args: {
   if (args.stats) {
     args.stats.parsed++
   }
-  storeEntry(file.path, {
+  storeEntry(key, {
     mtimeMs: file.mtimeMs,
     sizeBytes: file.sizeBytes ?? null,
     hostKey: args.hostKey,
diff --git a/src/main/ai-vault/remote-session-scan-concurrency.ts b/src/main/ai-vault/remote-session-scan-concurrency.ts
index e74375259f5..a336af84a06 100644
--- a/src/main/ai-vault/remote-session-scan-concurrency.ts
+++ b/src/main/ai-vault/remote-session-scan-concurrency.ts
@@ -14,6 +14,7 @@ export function limitRemoteScanFilesystemConcurrency(
 ): RemoteSessionFilesystemProvider {
   const gate = createConcurrencyGate(maxInFlight)
   return {
+    openCode: provider.openCode,
     readDir: (dirPath) => gate(() => provider.readDir(dirPath)),
     readFile: (filePath) => gate(() => provider.readFile(filePath)),
     stat: (filePath) => gate(() => provider.stat(filePath)),
diff --git a/src/main/ai-vault/remote-session-scanner-discovery.ts b/src/main/ai-vault/remote-session-scanner-discovery.ts
index 1fb25213f32..f6b13b24e30 100644
--- a/src/main/ai-vault/remote-session-scanner-discovery.ts
+++ b/src/main/ai-vault/remote-session-scanner-discovery.ts
@@ -22,6 +22,11 @@ export async function discoverRemoteSourceCandidates(args: {
   context: RemoteScannerContext
   issues: AiVaultScanIssue[]
 }): Promise<RemoteSessionCandidate[]> {
+  if (args.source.discover) {
+    const files = await args.source.discover(args.context, args.issues)
+    throwIfAiVaultScanCancelled(args.context.signal)
+    return files.map((file) => ({ source: args.source, file }))
+  }
   const walked = args.source.fixedChildFileSegments
     ? await listRemoteFixedChildFiles(args.source, args.context, args.issues)
     : await walkRemoteSessionFiles(args.source, args.context, args.issues)
diff --git a/src/main/ai-vault/remote-session-scanner-opencode-source.ts b/src/main/ai-vault/remote-session-scanner-opencode-source.ts
new file mode 100644
index 00000000000..c42f4b6cb09
--- /dev/null
+++ b/src/main/ai-vault/remote-session-scanner-opencode-source.ts
@@ -0,0 +1,149 @@
+import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
+import { isOpenCodeV2DatabaseName } from '../../shared/opencode-database-name'
+import { joinRemotePath } from '../ssh/ssh-remote-platform'
+import { throwIfAiVaultScanCancelled } from './ai-vault-scan-cancellation'
+import { isMissingRemoteSessionPathError } from './remote-session-file-stat'
+import { discoverRemoteSourceCandidates } from './remote-session-scanner-discovery'
+import { remotePathSegments } from './remote-session-scanner-source-parsers'
+import type {
+  RemoteOpenCodeSessionReader,
+  RemoteScannerContext,
+  RemoteSessionSource
+} from './remote-session-scanner-types'
+import { recordSessionScanIssue } from './session-scan-issues'
+import { restampAiVaultListResult } from './session-list-results'
+import { splitOpenCodeSqliteCandidate } from './session-scanner-opencode-sqlite-paths'
+import { errorMessage } from './session-scanner-values'
+
+export function remoteOpenCodeSources(
+  reader: RemoteOpenCodeSessionReader | undefined,
+  candidateLimit: number
+): RemoteSessionSource[] {
+  if (!reader) {
+    return []
+  }
+  let databasePaths: Promise<string[]> | undefined
+  return (['opencode', 'opencode2'] as const).map((agent) => {
+    const source: RemoteSessionSource = {
+      agent,
+      rootDir: reader.dataDirectory,
+      extensions: ['.json'],
+      parse: async () => null,
+      parseCandidate: async (file, context) => {
+        throwIfAiVaultScanCancelled(context.signal)
+        const candidate = splitOpenCodeSqliteCandidate(file.path)
+        const session = candidate
+          ? await reader.parse({
+              ...candidate,
+              platform: context.hostPlatform.os,
+              ...(agent === 'opencode2' ? { agent } : {}),
+              signal: context.signal
+            })
+          : await reader.parseLegacy(file, context.hostPlatform.os)
+        throwIfAiVaultScanCancelled(context.signal)
+        if (!session) {
+          return null
+        }
+        const stamped = restampAiVaultListResult(
+          { sessions: [session], issues: [], scannedAt: '' },
+          context.executionHostId
+        ).sessions[0]
+        return stamped ? { ...stamped, executionHostPlatform: context.hostPlatform.os } : null
+      },
+      discover: async (context, issues) => {
+        databasePaths ??= discoverDatabasePaths(reader, context, issues)
+        const paths = await databasePaths
+        const ownPaths =
+          agent === 'opencode2'
+            ? paths
+            : paths.filter(
+                (path) => !isOpenCodeV2DatabaseName(remotePathSegments(path).at(-1) ?? '')
+              )
+        const readIssues: AiVaultScanIssue[] = []
+        const candidates = await reader.list({
+          dbPaths: ownPaths,
+          limit: candidateLimit,
+          issues: readIssues,
+          ...(agent === 'opencode2' ? { agent } : {}),
+          signal: context.signal
+        })
+        throwIfAiVaultScanCancelled(context.signal)
+        for (const issue of readIssues) {
+          recordSessionScanIssue(issues, { ...issue, executionHostId: context.executionHostId })
+        }
+        const files = candidates.map((candidate) => candidate.file)
+        if (agent === 'opencode2') {
+          return files
+        }
+        const legacy = await discoverRemoteSourceCandidates({
+          source: {
+            ...source,
+            discover: undefined,
+            rootDir: joinRemotePath(
+              context.hostPlatform,
+              reader.dataDirectory,
+              'storage',
+              'session'
+            )
+          },
+          context,
+          issues
+        })
+        const ids = new Set(files.map((file) => splitOpenCodeSqliteCandidate(file.path)?.sessionId))
+        return [
+          ...files,
+          ...legacy
+            .filter(
+              ({ file }) =>
+                !ids.has(
+                  remotePathSegments(file.path)
+                    .at(-1)
+                    ?.replace(/\.json$/, '')
+                )
+            )
+            .map(({ file }) => file)
+        ]
+      }
+    }
+    return source
+  })
+}
+
+async function discoverDatabasePaths(
+  reader: RemoteOpenCodeSessionReader,
+  context: RemoteScannerContext,
+  issues: AiVaultScanIssue[]
+): Promise<string[]> {
+  throwIfAiVaultScanCancelled(context.signal)
+  if (reader.databasePath === null) {
+    return []
+  }
+  try {
+    if (reader.databasePath !== undefined) {
+      const stat = await context.provider.stat(reader.databasePath)
+      return stat.type === 'file' || stat.type === 'symlink' ? [reader.databasePath] : []
+    }
+    const entries = await context.provider.readDir(reader.dataDirectory)
+    return entries
+      .filter(
+        (entry) =>
+          !entry.isDirectory &&
+          !entry.isSymlink &&
+          /^opencode(?:-[A-Za-z0-9_.-]+)?\.db$/.test(entry.name)
+      )
+      .map((entry) => joinRemotePath(context.hostPlatform, reader.dataDirectory, entry.name))
+      .sort()
+  } catch (error) {
+    throwIfAiVaultScanCancelled(context.signal)
+    if (!isMissingRemoteSessionPathError(error)) {
+      recordSessionScanIssue(issues, {
+        executionHostId: context.executionHostId,
+        agent: 'opencode',
+        kind: 'scope',
+        path: reader.databasePath ?? reader.dataDirectory,
+        message: errorMessage(error)
+      })
+    }
+    return []
+  }
+}
diff --git a/src/main/ai-vault/remote-session-scanner-opencode.test.ts b/src/main/ai-vault/remote-session-scanner-opencode.test.ts
new file mode 100644
index 00000000000..573ee1939cf
--- /dev/null
+++ b/src/main/ai-vault/remote-session-scanner-opencode.test.ts
@@ -0,0 +1,235 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AiVaultSession } from '../../shared/ai-vault-types'
+import { getRemoteHostPlatform } from '../ssh/ssh-remote-platform'
+import { resetRemoteSessionParseCacheForTests } from './remote-session-parse-cache'
+import { scanRemoteAiVaultSessions } from './remote-session-scanner'
+import { MemoryRemoteProvider, jsonLines } from './remote-session-scanner-test-fixtures'
+import type { RemoteOpenCodeSessionReader } from './remote-session-scanner-types'
+import { createAccumulator, finalizeSession, updateTimeline } from './session-scanner-accumulator'
+import {
+  buildOpenCodeSqliteCandidatePath,
+  splitOpenCodeSqliteCandidate
+} from './session-scanner-opencode-sqlite-paths'
+import type { FileWithMtime } from './session-scanner-types'
+
+const remoteHome = '/home/ada'
+const dataDirectory = `${remoteHome}/.local/share/opencode`
+const hostPlatform = getRemoteHostPlatform('linux-x64')
+const scanOptions = { remoteHome, hostPlatform, executionHostId: 'ssh:one' as const }
+
+beforeEach(resetRemoteSessionParseCacheForTests)
+
+function fixture() {
+  const sessions = new Map<string, AiVaultSession>()
+  const list: RemoteOpenCodeSessionReader['list'] = vi.fn(async (args) =>
+    [...sessions.values()]
+      .filter(
+        (session) =>
+          session.agent === (args.agent ?? 'opencode') && args.dbPaths.includes(session.filePath)
+      )
+      .sort((left, right) => Date.parse(right.modifiedAt) - Date.parse(left.modifiedAt))
+      .slice(0, args.limit)
+      .map((session) => ({
+        agent: session.agent,
+        codexHome: null,
+        file: file(
+          buildOpenCodeSqliteCandidatePath(session.filePath, session.sessionId),
+          Date.parse(session.modifiedAt)
+        )
+      }))
+  )
+  const parse: RemoteOpenCodeSessionReader['parse'] = vi.fn(
+    async (args) =>
+      sessions.get(
+        `${args.agent ?? 'opencode'}:${buildOpenCodeSqliteCandidatePath(args.dbPath, args.sessionId)}`
+      ) ?? null
+  )
+  const parseLegacy = vi.fn(async (entry: FileWithMtime) =>
+    session('opencode', 'legacy', entry, '/home/ada/repo')
+  )
+  const provider = Object.assign(new MemoryRemoteProvider(), {
+    openCode: { dataDirectory, list, parse, parseLegacy }
+  })
+  const add = (
+    id: string,
+    mtime: number,
+    options: { agent?: 'opencode' | 'opencode2'; cwd?: string; dbName?: string } = {}
+  ) => {
+    const agent = options.agent ?? 'opencode'
+    const dbPath = `${dataDirectory}/${options.dbName ?? 'opencode.db'}`
+    provider.addFile(dbPath, 'database', 1)
+    const path = buildOpenCodeSqliteCandidatePath(dbPath, id)
+    sessions.set(
+      `${agent}:${path}`,
+      session(agent, id, file(path, mtime), options.cwd ?? '/home/ada/other')
+    )
+  }
+  return { provider, add, list, parse, parseLegacy }
+}
+
+function file(path: string, mtimeMs: number): FileWithMtime {
+  return { path, mtimeMs, modifiedAt: new Date(mtimeMs).toISOString() }
+}
+
+function session(
+  agent: 'opencode' | 'opencode2',
+  sessionId: string,
+  entry: FileWithMtime,
+  cwd: string
+): AiVaultSession {
+  const accumulator = createAccumulator({
+    agent,
+    file: { ...entry, path: splitOpenCodeSqliteCandidate(entry.path)?.dbPath ?? entry.path },
+    sessionId
+  })
+  accumulator.cwd = cwd
+  updateTimeline(accumulator, entry.modifiedAt)
+  const parsed = finalizeSession(accumulator, 'linux')
+  if (!parsed) {
+    throw new Error('Invalid fixture session')
+  }
+  return parsed
+}
+
+describe('remote OpenCode discovery', () => {
+  it('sorts database rows with file-backed agents before applying the global cap', async () => {
+    const { provider, add } = fixture()
+    add('older', 1000)
+    add('newest', 3000)
+    provider.addFile(
+      `${remoteHome}/.claude/projects/project/middle.jsonl`,
+      jsonLines([
+        {
+          sessionId: 'middle',
+          timestamp: new Date(2000).toISOString(),
+          type: 'user',
+          message: { content: 'middle' }
+        }
+      ]),
+      2000
+    )
+    const read = vi.spyOn(provider, 'readFile')
+    const result = await scanRemoteAiVaultSessions({ ...scanOptions, provider, limit: 2 })
+    expect(result.issues).toEqual([])
+    expect(result.sessions.map((entry) => entry.sessionId)).toEqual(['newest', 'middle'])
+    expect(result.sessions[0]).toMatchObject({
+      executionHostId: 'ssh:one',
+      executionHostPlatform: 'linux',
+      id: `ssh:one:opencode:newest:${dataDirectory}/opencode.db`
+    })
+    expect(read.mock.calls.every(([path]) => !path.includes('.db#'))).toBe(true)
+  })
+
+  it('retains older scoped rows beyond the recent parse budget', async () => {
+    const { provider, add, list } = fixture()
+    for (let index = 0; index < 10; index++) {
+      add(`other-${index}`, 10000 + index)
+    }
+    add('scoped', 1000, { cwd: '/home/ada/repo/app' })
+    const result = await scanRemoteAiVaultSessions({
+      ...scanOptions,
+      provider,
+      limit: 1,
+      scopePaths: ['/home/ada/repo']
+    })
+    expect(result.sessions.map((entry) => entry.sessionId)).toEqual(['other-9', 'scoped'])
+    expect(list).toHaveBeenCalledWith(expect.objectContaining({ limit: 1003 }))
+  })
+
+  it('drops stale legacy duplicates before limiting while keeping legacy-only history', async () => {
+    const { provider, add, parseLegacy } = fixture()
+    add('migrated', 2000)
+    provider.addFile(`${dataDirectory}/storage/session/project/migrated.json`, '{}', 9000)
+    provider.addFile(`${dataDirectory}/storage/session/project/legacy.json`, '{}', 1000)
+    const result = await scanRemoteAiVaultSessions({ ...scanOptions, provider, limit: 10 })
+    expect(result.sessions.map((entry) => entry.sessionId)).toEqual(['migrated', 'legacy'])
+    expect(parseLegacy).toHaveBeenCalledTimes(1)
+    expect(parseLegacy).toHaveBeenCalledWith(
+      expect.objectContaining({ path: expect.stringContaining('/legacy.json') }),
+      'linux'
+    )
+  })
+
+  it('keeps v1 and v2 identities separate in a shared database and parse cache', async () => {
+    const { provider, add, parse, list } = fixture()
+    add('same-id', 2000)
+    add('same-id', 2000, { agent: 'opencode2' })
+    add('beta', 1000, { agent: 'opencode2', dbName: 'opencode-next.db' })
+    const first = await scanRemoteAiVaultSessions({ ...scanOptions, provider })
+    const second = await scanRemoteAiVaultSessions({ ...scanOptions, provider })
+    expect(first.sessions.map((entry) => entry.agent).sort()).toEqual([
+      'opencode',
+      'opencode2',
+      'opencode2'
+    ])
+    expect(second.sessions).toEqual(first.sessions)
+    expect(parse).toHaveBeenCalledTimes(3)
+    expect(list).toHaveBeenCalledWith(
+      expect.objectContaining({ dbPaths: [`${dataDirectory}/opencode.db`] })
+    )
+    expect(list).toHaveBeenCalledWith(
+      expect.objectContaining({
+        dbPaths: [`${dataDirectory}/opencode-next.db`, `${dataDirectory}/opencode.db`],
+        agent: 'opencode2'
+      })
+    )
+  })
+
+  it('invalidates cached database rows after updates and across hosts', async () => {
+    const { provider, add, parse } = fixture()
+    add('session', 1000)
+    await scanRemoteAiVaultSessions({ ...scanOptions, provider })
+    add('session', 2000)
+    const updated = await scanRemoteAiVaultSessions({ ...scanOptions, provider })
+    const other = await scanRemoteAiVaultSessions({
+      ...scanOptions,
+      executionHostId: 'ssh:two',
+      provider
+    })
+    expect(parse).toHaveBeenCalledTimes(3)
+    expect(updated.sessions[0]?.modifiedAt).toBe(new Date(2000).toISOString())
+    expect(other.sessions[0]?.executionHostId).toBe('ssh:two')
+  })
+
+  it('propagates cancellation into the reader and does not cache cancelled parses', async () => {
+    const { provider, add, parse } = fixture()
+    add('session', 1000)
+    const controller = new AbortController()
+    provider.openCode.parse = async (args) => {
+      expect(args.signal).toBe(controller.signal)
+      controller.abort()
+      return parse(args)
+    }
+    await expect(
+      scanRemoteAiVaultSessions({ ...scanOptions, provider, signal: controller.signal })
+    ).rejects.toMatchObject({ name: 'AbortError' })
+    provider.openCode.parse = parse
+    await scanRemoteAiVaultSessions({ ...scanOptions, provider })
+    expect(parse).toHaveBeenCalledTimes(2)
+  })
+
+  it('leaves legacy filesystem providers on their existing fallback', async () => {
+    const provider = new MemoryRemoteProvider()
+    provider.addFile(`${dataDirectory}/opencode.db`, 'database', 1000)
+    const result = await scanRemoteAiVaultSessions({ ...scanOptions, provider })
+    expect(result.sessions).toEqual([])
+    expect(result.issues).toEqual([])
+    expect(provider.readDirPaths).not.toContain(dataDirectory)
+  })
+
+  it('honors an explicitly configured database symlink without enumerating sibling databases', async () => {
+    const { provider, add, list } = fixture()
+    add('selected', 1000, { dbName: 'opencode-team.db' })
+    add('other', 2000)
+    const selected = `${dataDirectory}/opencode-team.db`
+    Object.assign(provider.openCode, { databasePath: selected })
+    const stat = provider.stat.bind(provider)
+    vi.spyOn(provider, 'stat').mockImplementation(async (path) =>
+      path === selected ? { type: 'symlink', size: 20, mtime: 1000, mtimeMs: 1000 } : stat(path)
+    )
+    const result = await scanRemoteAiVaultSessions({ ...scanOptions, provider })
+    expect(result.sessions.map((entry) => entry.sessionId)).toEqual(['selected'])
+    expect(list).toHaveBeenCalledWith(expect.objectContaining({ dbPaths: [selected] }))
+    expect(provider.readDirPaths).not.toContain(dataDirectory)
+  })
+})
diff --git a/src/main/ai-vault/remote-session-scanner-sources.ts b/src/main/ai-vault/remote-session-scanner-sources.ts
index ed34e8b52a5..dfd012415d5 100644
--- a/src/main/ai-vault/remote-session-scanner-sources.ts
+++ b/src/main/ai-vault/remote-session-scanner-sources.ts
@@ -8,6 +8,7 @@ import { isAntigravityTranscriptPath } from './session-scanner-antigravity-paths
 import { parseCodexSessionContent } from './session-scanner-codex-parser'
 import { parseDroidSessionContent } from './session-scanner-droid-parser'
 import { parseClaudeSessionContent } from './session-scanner-primary-parsers'
+import { parseCodebuddySessionContent } from './session-scanner-codebuddy-parser'
 import { parseGeminiSessionContent } from './session-scanner-gemini-parsers'
 import { parseCopilotSessionContent } from './session-scanner-copilot-parser'
 import { parseCursorSessionContent } from './session-scanner-cursor-parser'
@@ -65,6 +66,17 @@ export function remoteSessionSources(
       // top-level sessions carrying the parent's sessionId.
       partitionSubagentTranscripts: partitionSubagentTranscriptPaths
     },
+    {
+      // The execution host owns CodeBuddy's transcripts, including subagent pruning.
+      ...jsonlSource(
+        'codebuddy',
+        remoteHome,
+        hostPlatform,
+        ['.codebuddy', 'projects'],
+        parseCodebuddySessionContent
+      ),
+      partitionSubagentTranscripts: partitionSubagentTranscriptPaths
+    },
     remoteAntigravitySource(remoteHome, hostPlatform),
     source(
       'gemini',
diff --git a/src/main/ai-vault/remote-session-scanner-types.ts b/src/main/ai-vault/remote-session-scanner-types.ts
index 7f78cbb5d60..408a2ca47be 100644
--- a/src/main/ai-vault/remote-session-scanner-types.ts
+++ b/src/main/ai-vault/remote-session-scanner-types.ts
@@ -1,10 +1,17 @@
-import type { AiVaultAgent, AiVaultSession } from '../../shared/ai-vault-types'
+import type { AiVaultAgent, AiVaultScanIssue, AiVaultSession } from '../../shared/ai-vault-types'
 import type { ExecutionHostId } from '../../shared/execution-host'
 import type { IFilesystemProvider } from '../providers/types'
 import type { RemoteHostPlatform } from '../ssh/ssh-remote-platform'
 import type { FileWithMtime } from './session-scanner-types'
 import type { SubagentTranscriptPartition } from './session-scanner-subagent-transcripts'
 import type { AntigravityWorkspaceResolver } from './session-scanner-antigravity-history'
+import type { OpenCodeSqliteWorkerClient } from './session-scanner-opencode-sqlite-worker-client'
+
+export type RemoteOpenCodeSessionReader = Pick<OpenCodeSqliteWorkerClient, 'list' | 'parse'> & {
+  dataDirectory: string
+  databasePath?: string | null
+  parseLegacy: (file: FileWithMtime, platform: NodeJS.Platform) => Promise<AiVaultSession | null>
+}
 
 export type RemoteScannerContext = {
   provider: RemoteSessionFilesystemProvider
@@ -21,6 +28,8 @@ export type RemoteSessionFilesystemProvider = Pick<
 > & {
   /** Available only beside the execution host's disk; never opens a client path. */
   readTranscriptBytes?: (path: string, signal?: AbortSignal) => AsyncIterable<Buffer>
+  /** Execution-host database access; absent from remote filesystem RPC providers. */
+  openCode?: RemoteOpenCodeSessionReader
 }
 
 export type RemoteParserOptions = {
@@ -31,6 +40,11 @@ export type RemoteParserOptions = {
 export type RemoteSessionSource = {
   agent: AiVaultAgent
   rootDir: string
+  discover?: (context: RemoteScannerContext, issues: AiVaultScanIssue[]) => Promise<FileWithMtime[]>
+  parseCandidate?: (
+    file: FileWithMtime,
+    context: RemoteScannerContext
+  ) => Promise<AiVaultSession | null>
   // Codex sources only: the CODEX_HOME the root belongs to, so bridged or
   // backfilled rollout aliases across remote roots collapse to one canonical row.
   codexHome?: string
diff --git a/src/main/ai-vault/remote-session-scanner.ts b/src/main/ai-vault/remote-session-scanner.ts
index 2ebaba9103a..17f9bdc35a8 100644
--- a/src/main/ai-vault/remote-session-scanner.ts
+++ b/src/main/ai-vault/remote-session-scanner.ts
@@ -16,6 +16,7 @@ import {
 import { ScannedSessionCollection, dedupeScannedSessions } from './session-root-dedup'
 import {
   parseRemoteSessionFileCached,
+  remoteSessionCandidateKey,
   remoteSessionParseHostKey
 } from './remote-session-parse-cache'
 import { remoteCodexIndexedTitleReader } from './remote-session-scanner-codex-index'
@@ -36,6 +37,7 @@ import { canStopParsingSessions } from './session-scan-cutoff'
 import { refreshCodexTitleFromIndex } from './session-scanner-codex-cached-title'
 import { limitRemoteScanFilesystemConcurrency } from './remote-session-scan-concurrency'
 import { aiVaultScanLimit } from '../../shared/ai-vault-session-depth'
+import { remoteOpenCodeSources } from './remote-session-scanner-opencode-source'
 
 const REMOTE_SCAN_CONCURRENCY = 8
 const REMOTE_PARSE_CANDIDATE_MULTIPLIER = 2
@@ -84,7 +86,14 @@ export async function scanRemoteAiVaultSessions(args: {
   const candidates = dedupeCodexRolloutFileAliases(
     (
       await mapRemoteScanBatches(
-        remoteSessionSources(args.remoteHome, args.hostPlatform),
+        [
+          ...remoteSessionSources(args.remoteHome, args.hostPlatform),
+          ...remoteOpenCodeSources(
+            provider.openCode,
+            limit * REMOTE_PARSE_CANDIDATE_MULTIPLIER +
+              (args.scopePaths?.length ? REMOTE_SCOPE_PARSE_CANDIDATE_LIMIT + 1 : 0)
+          )
+        ],
         REMOTE_SCAN_CONCURRENCY,
         (source) => discoverRemoteSourceCandidates({ source, context, issues }),
         args.signal
@@ -120,7 +129,7 @@ export async function scanRemoteAiVaultSessions(args: {
     issues,
     scopePaths,
     limit,
-    alreadyParsedFilePaths: parsed.parsedFilePaths
+    alreadyParsedCandidateKeys: parsed.parsedCandidateKeys
   })
   const scopeSessions = dedupeScannedSessions([...parsedScopeSessions, ...extraScopeSessions])
     .sort((left, right) => sessionSortTime(right) - sessionSortTime(left))
@@ -138,9 +147,9 @@ async function parseRemoteSessionCandidates(args: {
   context: RemoteScannerContext
   issues: AiVaultScanIssue[]
   limit: number
-}): Promise<{ sessions: AiVaultSession[]; parsedFilePaths: Set<string> }> {
+}): Promise<{ sessions: AiVaultSession[]; parsedCandidateKeys: Set<string> }> {
   const sessions = new ScannedSessionCollection()
-  const parsedFilePaths = new Set<string>()
+  const parsedCandidateKeys = new Set<string>()
   let index = 0
 
   while (index < args.candidates.length) {
@@ -153,7 +162,7 @@ async function parseRemoteSessionCandidates(args: {
     const batchSize = Math.min(REMOTE_SCAN_CONCURRENCY, needed, remaining)
     const batch = args.candidates.slice(index, index + batchSize)
     for (const candidate of batch) {
-      parsedFilePaths.add(candidate.file.path)
+      parsedCandidateKeys.add(remoteSessionCandidateKey(candidate))
     }
     throwIfAiVaultScanCancelled(args.context.signal)
     const results = await Promise.all(
@@ -171,7 +180,7 @@ async function parseRemoteSessionCandidates(args: {
   // The loop can terminate on the yield after its final batch, so re-check
   // rather than letting a cancelled scan return a partial parse as a success.
   throwIfAiVaultScanCancelled(args.context.signal)
-  return { sessions: [...sessions.values()], parsedFilePaths }
+  return { sessions: [...sessions.values()], parsedCandidateKeys }
 }
 
 async function scanRemoteInScopeSessions(args: {
@@ -180,14 +189,14 @@ async function scanRemoteInScopeSessions(args: {
   issues: AiVaultScanIssue[]
   scopePaths: readonly string[]
   limit: number
-  alreadyParsedFilePaths: ReadonlySet<string>
+  alreadyParsedCandidateKeys: ReadonlySet<string>
 }): Promise<AiVaultSession[]> {
   if (args.scopePaths.length === 0) {
     return []
   }
 
   const candidates = args.candidates.filter(
-    (candidate) => !args.alreadyParsedFilePaths.has(candidate.file.path)
+    (candidate) => !args.alreadyParsedCandidateKeys.has(remoteSessionCandidateKey(candidate))
   )
   const bound = Math.min(candidates.length, REMOTE_SCOPE_PARSE_CANDIDATE_LIMIT)
   const sessions: AiVaultSession[] = []
diff --git a/src/main/ai-vault/remote-session-transcript-read.ts b/src/main/ai-vault/remote-session-transcript-read.ts
index 42ea29af409..bc9d4a59532 100644
--- a/src/main/ai-vault/remote-session-transcript-read.ts
+++ b/src/main/ai-vault/remote-session-transcript-read.ts
@@ -9,6 +9,9 @@ export async function parseRemoteSessionTranscript(
   candidate: RemoteSessionCandidate,
   context: RemoteScannerContext
 ): Promise<AiVaultSession | null> {
+  if (candidate.source.parseCandidate) {
+    return candidate.source.parseCandidate(candidate.file, context)
+  }
   const sidecar = candidate.file.sidecar
   const exceedsWholeReadLimit =
     (candidate.file.sizeBytes ?? 0) > LEGACY_SESSION_TEXT_LIMIT_BYTES ||
diff --git a/src/main/ai-vault/session-cwd-bucket-layouts.test.ts b/src/main/ai-vault/session-cwd-bucket-layouts.test.ts
index 38c2f0b68e2..7cbbbfbcc6d 100644
--- a/src/main/ai-vault/session-cwd-bucket-layouts.test.ts
+++ b/src/main/ai-vault/session-cwd-bucket-layouts.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { PI_CWD_BUCKET_LAYOUT } from './session-cwd-bucket-layouts'
+import { PI_CWD_BUCKET_LAYOUT, CODEBUDDY_CWD_BUCKET_LAYOUT } from './session-cwd-bucket-layouts'
 
 function piDirInScope(dirName: string, scopePath: string): boolean {
   return PI_CWD_BUCKET_LAYOUT.isDirInScope(
@@ -31,3 +31,19 @@ describe('PI_CWD_BUCKET_LAYOUT', () => {
     expect(piDirInScope('--C--Users-ada-repo--', 'C:\\Users\\ada\\repo')).toBe(true)
   })
 })
+
+describe('CODEBUDDY_CWD_BUCKET_LAYOUT', () => {
+  it.each([
+    ['C:\\Users\\ada\\repo', 'C-Users-ada-repo-src'],
+    ['/home/ada/repo', 'home-ada-repo-src'],
+    ['/', 'home-ada-repo'],
+    [`/${'界'.repeat(100)}`, `${'界'.repeat(60)}-hash`]
+  ])('keeps candidate buckets for %s', (scope, bucket) => {
+    expect(
+      CODEBUDDY_CWD_BUCKET_LAYOUT.isDirInScope(
+        bucket,
+        new Set(CODEBUDDY_CWD_BUCKET_LAYOUT.encodeScopePrefixes(scope))
+      )
+    ).toBe(true)
+  })
+})
diff --git a/src/main/ai-vault/session-cwd-bucket-layouts.ts b/src/main/ai-vault/session-cwd-bucket-layouts.ts
index d8b4a565949..3f0195cdcd4 100644
--- a/src/main/ai-vault/session-cwd-bucket-layouts.ts
+++ b/src/main/ai-vault/session-cwd-bucket-layouts.ts
@@ -3,7 +3,7 @@ import { encodeClaudeProjectPaths, isClaudeProjectDirInScope } from './claude-pr
 
 /** An agent that keeps one directory per cwd, named by a lossy encoding of that cwd. */
 export type CwdBucketLayout = {
-  agent: Extract<AiVaultAgent, 'claude' | 'pi'>
+  agent: Extract<AiVaultAgent, 'claude' | 'pi' | 'codebuddy'>
   encodeScopePrefixes: (scopePath: string) => string[]
   isDirInScope: (dirName: string, prefixes: ReadonlySet<string>) => boolean
 }
@@ -41,3 +41,28 @@ export const PI_CWD_BUCKET_LAYOUT: CwdBucketLayout = {
     return false
   }
 }
+
+// CodeBuddy 2.159.0 collapses separators and retains 180 UTF-8 bytes before long-path hashes.
+function codebuddyScopePrefix(path: string): string {
+  const encoded = path
+    .replace(/[/\\:]+/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-|-$/g, '')
+  let prefix = ''
+  for (const character of encoded) {
+    if (Buffer.byteLength(prefix + character, 'utf8') > 180) {
+      break
+    }
+    prefix += character
+  }
+  return prefix
+}
+
+export const CODEBUDDY_CWD_BUCKET_LAYOUT: CwdBucketLayout = {
+  agent: 'codebuddy',
+  encodeScopePrefixes: (path) => [
+    ...new Set([path, path.normalize('NFC')].map(codebuddyScopePrefix))
+  ],
+  // This is only a prefilter: each transcript's cwd decides membership, including lossy collisions.
+  isDirInScope: (name, prefixes) => [...prefixes].some((prefix) => name.startsWith(prefix))
+}
diff --git a/src/main/ai-vault/session-first-user-prompt-opencode.test.ts b/src/main/ai-vault/session-first-user-prompt-opencode.test.ts
new file mode 100644
index 00000000000..c0d81a531a6
--- /dev/null
+++ b/src/main/ai-vault/session-first-user-prompt-opencode.test.ts
@@ -0,0 +1,86 @@
+import { beforeEach, expect, it, vi } from 'vitest'
+import { readAiVaultFirstUserPrompt } from './session-first-user-prompt-read'
+
+const reader = vi.hoisted(() => ({ v1: vi.fn(), v2: vi.fn() }))
+vi.mock('./session-scanner-opencode-sqlite-worker-spawn', () => ({
+  parseOpenCodeSqliteSessionViaWorker: reader.v1,
+  parseOpenCode2SqliteSessionViaWorker: reader.v2
+}))
+
+beforeEach(() => {
+  reader.v1.mockReset().mockResolvedValue({ firstUserPrompt: 'full first prompt' })
+  reader.v2.mockReset().mockResolvedValue({ firstUserPrompt: 'full second-schema prompt' })
+})
+
+it('asks the host reader for the full prompt instead of opening SQLite in the calling process', async () => {
+  expect(
+    await readAiVaultFirstUserPrompt({
+      agent: 'opencode',
+      filePath: '/home/me/opencode.db#session-1'
+    })
+  ).toEqual({ prompt: 'full first prompt' })
+  expect(reader.v1).toHaveBeenCalledWith({
+    dbPath: '/home/me/opencode.db',
+    sessionId: 'session-1',
+    platform: process.platform,
+    fullFirstUserPrompt: true
+  })
+})
+
+it('keeps a WSL database address intact for host routing', async () => {
+  const dbPath = '\\\\wsl.localhost\\Ubuntu\\home\\me\\opencode.db'
+  expect(
+    await readAiVaultFirstUserPrompt({
+      agent: 'opencode',
+      filePath: dbPath,
+      sessionId: 'session-1'
+    })
+  ).toEqual({ prompt: 'full first prompt' })
+  expect(reader.v1).toHaveBeenCalledWith(
+    expect.objectContaining({
+      dbPath,
+      sessionId: 'session-1',
+      fullFirstUserPrompt: true
+    })
+  )
+})
+
+it('supports the v2 schema through the same full-prompt worker contract', async () => {
+  expect(
+    await readAiVaultFirstUserPrompt({
+      agent: 'opencode2',
+      filePath: '/home/me/opencode.db',
+      sessionId: 'channel/session-1'
+    })
+  ).toEqual({ prompt: 'full second-schema prompt' })
+  expect(reader.v2).toHaveBeenCalledWith(
+    expect.objectContaining({
+      sessionId: 'channel/session-1',
+      fullFirstUserPrompt: true
+    })
+  )
+  expect(reader.v1).not.toHaveBeenCalled()
+})
+
+it('does not substitute local history for a remote session', async () => {
+  expect(
+    await readAiVaultFirstUserPrompt({
+      agent: 'opencode',
+      filePath: '/home/me/opencode.db',
+      sessionId: 'session-1',
+      executionHostId: 'ssh:host'
+    })
+  ).toEqual({ prompt: null })
+  expect(reader.v1).not.toHaveBeenCalled()
+})
+
+it('degrades a failed guest read to an unavailable prompt', async () => {
+  reader.v1.mockRejectedValue(new Error('guest stopped'))
+  expect(
+    await readAiVaultFirstUserPrompt({
+      agent: 'opencode',
+      filePath: '/home/me/opencode.db',
+      sessionId: 'session-1'
+    })
+  ).toEqual({ prompt: null })
+})
diff --git a/src/main/ai-vault/session-first-user-prompt-read.ts b/src/main/ai-vault/session-first-user-prompt-read.ts
index ac5a35f2a53..c0aa1b8a219 100644
--- a/src/main/ai-vault/session-first-user-prompt-read.ts
+++ b/src/main/ai-vault/session-first-user-prompt-read.ts
@@ -7,9 +7,15 @@ import { LOCAL_EXECUTION_HOST_ID, type ExecutionHostId } from '../../shared/exec
 import { wslGatedStat } from '../native-chat/wsl-transcript-fs-access'
 import { parseAgentSessionFile } from './session-scanner-agent-parser'
 import { withFullFirstUserPromptCapture } from './session-scanner-first-user-prompt-capture'
-import { parseOpenCodeSqliteSession } from './session-scanner-opencode-sqlite'
+import {
+  parseOpenCodeSqliteSessionViaWorker,
+  parseOpenCode2SqliteSessionViaWorker,
+  parseZcodeSqliteSessionViaWorker
+} from './session-scanner-opencode-sqlite-worker-spawn'
 import { splitOpenCodeSqliteCandidate } from './session-scanner-opencode-sqlite-paths'
 import type { FileWithMtime } from './session-scanner-types'
+import type { OpenCodeWslRuntime } from './session-scanner-opencode-wsl-runtime'
+import { configureOpenCodeWslReaders } from './session-scanner-opencode-wsl-client'
 
 export type ReadAiVaultFirstUserPromptArgs = {
   agent: AiVaultAgent
@@ -17,6 +23,7 @@ export type ReadAiVaultFirstUserPromptArgs = {
   sessionId?: string
   executionHostId?: ExecutionHostId
   codexHome?: string | null
+  wslOpenCodeReaders?: readonly OpenCodeWslRuntime[]
 }
 
 export type ReadAiVaultFirstUserPromptResult = AiVaultFirstUserPromptResult
@@ -39,6 +46,9 @@ export async function readAiVaultFirstUserPrompt(
   if (executionHostId !== LOCAL_EXECUTION_HOST_ID) {
     return { prompt: null }
   }
+  if (args.wslOpenCodeReaders) {
+    configureOpenCodeWslReaders(args.wslOpenCodeReaders)
+  }
 
   // Why: partial/corrupt transcripts make parsers throw. Resolve null like every
   // other unavailable case instead of rejecting the IPC call.
@@ -66,20 +76,26 @@ async function parseSessionForFullFirstUserPrompt(args: {
   sessionId?: string
   codexHome: string | null
 }): Promise<AiVaultSession | null> {
-  // Why: OpenCode SQLite sessions store filePath as the db path (not db#id).
-  // Re-parse in-process under full capture so ALS applies and we can read the
-  // earliest user row (worker list-scan path only joins newest messages).
-  if (args.agent === 'opencode') {
-    const fromSynthetic = splitOpenCodeSqliteCandidate(args.filePath)
+  // Full capture belongs inside the reader, including the guest reader for WSL.
+  if (args.agent === 'opencode' || args.agent === 'opencode2' || args.agent === 'zcode') {
+    const parse =
+      args.agent === 'opencode2'
+        ? parseOpenCode2SqliteSessionViaWorker
+        : args.agent === 'zcode'
+          ? parseZcodeSqliteSessionViaWorker
+          : parseOpenCodeSqliteSessionViaWorker
+    const fromSynthetic = splitOpenCodeSqliteCandidate(args.filePath, args.agent)
     if (fromSynthetic) {
-      return parseOpenCodeSqliteSession({
+      return parse({
+        fullFirstUserPrompt: true,
         dbPath: fromSynthetic.dbPath,
         sessionId: fromSynthetic.sessionId,
         platform: process.platform
       })
     }
     if (args.sessionId) {
-      return parseOpenCodeSqliteSession({
+      return parse({
+        fullFirstUserPrompt: true,
         dbPath: args.filePath,
         sessionId: args.sessionId,
         platform: process.platform
diff --git a/src/main/ai-vault/session-scanner-agent-parser.ts b/src/main/ai-vault/session-scanner-agent-parser.ts
index 7ca808173cf..95910d208b7 100644
--- a/src/main/ai-vault/session-scanner-agent-parser.ts
+++ b/src/main/ai-vault/session-scanner-agent-parser.ts
@@ -1,4 +1,6 @@
+import { parseCodebuddySessionFile } from './session-scanner-codebuddy-parser'
 import type { AiVaultSession } from '../../shared/ai-vault-types'
+import { throwIfSignalAborted } from '../../shared/abort-signal-reason'
 import { parseDevinSessionFile } from './session-scanner-devin-parser'
 import { parseAntigravitySessionFile } from './session-scanner-antigravity-parser'
 import { parseDroidSessionFile } from './session-scanner-droid-parser'
@@ -11,8 +13,10 @@ import { splitOpenCodeSqliteCandidate } from './session-scanner-opencode-sqlite-
 import {
   captureOpenCodeSqliteSessionViaWorker,
   captureOpenCode2SqliteSessionViaWorker,
+  captureZcodeSqliteSessionViaWorker,
   parseOpenCode2SqliteSessionViaWorker,
-  parseOpenCodeSqliteSessionViaWorker
+  parseOpenCodeSqliteSessionViaWorker,
+  parseZcodeSqliteSessionViaWorker
 } from './session-scanner-opencode-sqlite-worker-spawn'
 import { parseClaudeSessionFile } from './session-scanner-primary-parsers'
 import { parseGeminiSessionFile } from './session-scanner-gemini-parsers'
@@ -35,17 +39,36 @@ import type { TranscriptMessageSink } from './session-transcript-consumers'
 async function readOpenCodeSqliteCandidate(
   sqliteCandidate: { dbPath: string; sessionId: string },
   platform: NodeJS.Platform,
-  messages?: TranscriptMessageSink
+  messages?: TranscriptMessageSink,
+  signal?: AbortSignal,
+  agent?: 'opencode2' | 'zcode'
 ): Promise<AiVaultSession | null> {
-  const request = { ...sqliteCandidate, platform }
+  throwIfSignalAborted(signal)
+  const request = { ...sqliteCandidate, platform, signal }
   if (!messages?.active) {
-    return parseOpenCodeSqliteSessionViaWorker(request)
+    const parse =
+      agent === 'opencode2'
+        ? parseOpenCode2SqliteSessionViaWorker
+        : agent === 'zcode'
+          ? parseZcodeSqliteSessionViaWorker
+          : parseOpenCodeSqliteSessionViaWorker
+    const session = await parse(request)
+    throwIfSignalAborted(signal)
+    return session
   }
-  const capture = await captureOpenCodeSqliteSessionViaWorker(request)
-  for (const message of capture.messages) {
+  const capture =
+    agent === 'opencode2'
+      ? captureOpenCode2SqliteSessionViaWorker
+      : agent === 'zcode'
+        ? captureZcodeSqliteSessionViaWorker
+        : captureOpenCodeSqliteSessionViaWorker
+  const result = await capture(request)
+  for (const message of result.messages) {
+    throwIfSignalAborted(signal)
     messages.push(message)
   }
-  return capture.session
+  throwIfSignalAborted(signal)
+  return result.session
 }
 
 /**
@@ -61,9 +84,12 @@ async function readOpenCodeSqliteCandidate(
 export async function parseAgentSessionFile(
   candidate: SessionFileCandidate,
   platform: NodeJS.Platform,
-  messages?: TranscriptMessageSink
+  messages?: TranscriptMessageSink,
+  signal?: AbortSignal
 ): Promise<AiVaultSession | null> {
   switch (candidate.agent) {
+    case 'codebuddy':
+      return parseCodebuddySessionFile(candidate.file, platform, messages)
     case 'claude':
       return parseClaudeSessionFile(candidate.file, platform, messages)
     case 'codex':
@@ -88,7 +114,7 @@ export async function parseAgentSessionFile(
       // real filesystem paths and fall through to the JSON parser.
       const sqliteCandidate = splitOpenCodeSqliteCandidate(candidate.file.path)
       if (sqliteCandidate) {
-        return readOpenCodeSqliteCandidate(sqliteCandidate, platform, messages)
+        return readOpenCodeSqliteCandidate(sqliteCandidate, platform, messages, signal)
       }
       return parseOpenCodeSessionFile(candidate.file, platform, messages)
     }
@@ -98,25 +124,16 @@ export async function parseAgentSessionFile(
       // candidate path; there is no legacy file store.
       const sqliteCandidate = splitOpenCodeSqliteCandidate(candidate.file.path)
       if (sqliteCandidate) {
-        if (messages?.active) {
-          const capture = await captureOpenCode2SqliteSessionViaWorker({
-            dbPath: sqliteCandidate.dbPath,
-            sessionId: sqliteCandidate.sessionId,
-            platform
-          })
-          for (const message of capture.messages) {
-            messages.push(message)
-          }
-          return capture.session
-        }
-        return parseOpenCode2SqliteSessionViaWorker({
-          dbPath: sqliteCandidate.dbPath,
-          sessionId: sqliteCandidate.sessionId,
-          platform
-        })
+        return readOpenCodeSqliteCandidate(sqliteCandidate, platform, messages, signal, 'opencode2')
       }
       return null
     }
+    case 'zcode': {
+      const sqliteCandidate = splitOpenCodeSqliteCandidate(candidate.file.path, 'zcode')
+      return sqliteCandidate
+        ? readOpenCodeSqliteCandidate(sqliteCandidate, platform, messages, signal, 'zcode')
+        : null
+    }
     case 'grok':
       return parseGrokSessionFile(candidate.file, platform, messages)
     case 'hermes':
diff --git a/src/main/ai-vault/session-scanner-agent-sources.ts b/src/main/ai-vault/session-scanner-agent-sources.ts
index ee10422031b..66d069b68cc 100644
--- a/src/main/ai-vault/session-scanner-agent-sources.ts
+++ b/src/main/ai-vault/session-scanner-agent-sources.ts
@@ -34,6 +34,7 @@ const COPILOT_SESSIONS_DIR = join(
   'session-state'
 )
 const CURSOR_PROJECTS_DIR = join(homedir(), '.cursor', 'projects')
+const CODEBUDDY_PROJECTS_DIR = join(homedir(), '.codebuddy', 'projects')
 const HERMES_SESSIONS_DIR = join(homedir(), '.hermes', 'sessions')
 const ROVO_SESSIONS_DIR = join(homedir(), '.rovodev', 'sessions')
 const OPENCLAW_STATE_DIR = resolveAbsoluteDirOverride(
@@ -114,6 +115,15 @@ export const AI_VAULT_AGENT_SOURCES: AiVaultAgentSourceTable = {
     // their parent instead.
     directoryPredicate: (name) => name !== SUBAGENT_DIR_NAME
   },
+  codebuddy: {
+    rootDirs: (options, wslHomeDirs) => [
+      options.codebuddyProjectsDir ?? CODEBUDDY_PROJECTS_DIR,
+      ...wslHomeDirs.map((homeDir) => join(homeDir, '.codebuddy', 'projects'))
+    ],
+    extensions: ['.jsonl'],
+    // Nested subagent transcripts are not independent top-level conversations.
+    directoryPredicate: (name) => name !== SUBAGENT_DIR_NAME
+  },
   codex: {
     rootDirs: (options, wslHomeDirs) =>
       uniqueCodexSessionsDirs([
diff --git a/src/main/ai-vault/session-scanner-background.ts b/src/main/ai-vault/session-scanner-background.ts
index 6903e689a64..70eca2434ef 100644
--- a/src/main/ai-vault/session-scanner-background.ts
+++ b/src/main/ai-vault/session-scanner-background.ts
@@ -25,6 +25,7 @@ import {
 } from './session-scanner-worker-spawn'
 import type { AiVaultWorkerScanOptions } from './session-scanner-worker-protocol'
 import { listLocalAiVaultSubagentSessions } from './session-subagent-reader'
+import { isWslUncPath } from '../../shared/wsl-paths'
 
 export function shouldUseAiVaultServiceProcess(): boolean {
   const configured = process.env.ORCA_AI_VAULT_SERVICE_PROCESS
@@ -70,9 +71,14 @@ export function listAiVaultSubagentSessionsInBackground(
     : listLocalAiVaultSubagentSessions(request)
 }
 
-export function readAiVaultFirstUserPromptInBackground(
+export async function readAiVaultFirstUserPromptInBackground(
   request: ReadAiVaultFirstUserPromptArgs
 ): Promise<ReadAiVaultFirstUserPromptResult> {
+  if (process.platform === 'win32' && isWslUncPath(request.filePath)) {
+    const { localAiVaultScanRoots } = await import('./cached-session-list')
+    const roots = await localAiVaultScanRoots()
+    request = { ...request, wslOpenCodeReaders: roots.wslOpenCodeReaders ?? [] }
+  }
   return shouldUseAiVaultServiceProcess()
     ? readAiVaultFirstUserPromptInService(request)
     : readAiVaultFirstUserPrompt(request)
diff --git a/src/main/ai-vault/session-scanner-codebuddy-parser.ts b/src/main/ai-vault/session-scanner-codebuddy-parser.ts
new file mode 100644
index 00000000000..94fc52d1eab
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-codebuddy-parser.ts
@@ -0,0 +1,230 @@
+import { createInterface } from 'node:readline'
+import {
+  remoteSessionContentLines,
+  type RemoteSessionContent
+} from './remote-session-content-lines'
+import { openTranscriptReadStream } from '../native-chat/wsl-transcript-fs-access'
+import type { AiVaultSession } from '../../shared/ai-vault-types'
+import type { ExecutionHostId } from '../../shared/execution-host'
+import { isKnownHarnessInjectedUserTurnText } from '../../shared/harness-injected-user-turns'
+import type { FileWithMtime, ResumableSessionParseState } from './session-scanner-types'
+import type { TranscriptMessageSink } from './session-transcript-consumers'
+import {
+  addPreviewMessage,
+  accumulatorSessionIdentity,
+  createAccumulator,
+  finalizeSession,
+  sessionIdFromFileName,
+  updateLatestLocation,
+  updateTimeline
+} from './session-scanner-accumulator'
+import {
+  asRecord,
+  extractString,
+  normalizeTitleText,
+  parseJsonObject
+} from './session-scanner-values'
+
+type ParserSessionOptions = {
+  executionHostId?: ExecutionHostId
+  executionHostPlatform?: NodeJS.Platform | null
+}
+
+// CodeBuddy stores top-level message roles and input_text/output_text blocks, not Claude records.
+export type CodebuddySessionParseState = {
+  accumulator: ReturnType<typeof createAccumulator>
+  aiTitle: string | null
+  firstUserTitle: string | null
+}
+
+export function createCodebuddySessionParseState(
+  file: FileWithMtime,
+  messages?: TranscriptMessageSink
+): CodebuddySessionParseState {
+  return {
+    accumulator: createAccumulator({
+      agent: 'codebuddy',
+      file,
+      sessionId: sessionIdFromFileName(file.path),
+      messages
+    }),
+    aiTitle: null,
+    firstUserTitle: null
+  }
+}
+
+export function cloneCodebuddySessionParseState(
+  state: CodebuddySessionParseState
+): CodebuddySessionParseState {
+  return {
+    accumulator: {
+      ...state.accumulator,
+      previewMessages: [...state.accumulator.previewMessages]
+    },
+    aiTitle: state.aiTitle,
+    firstUserTitle: state.firstUserTitle
+  }
+}
+
+// CodeBuddy conversation content is an array of typed text blocks; join the
+// text ones. Non-text blocks (tool calls, diffs) carry no preview copy.
+function codebuddyContentText(content: unknown): string | null {
+  if (typeof content === 'string') {
+    return content
+  }
+  if (!Array.isArray(content)) {
+    return null
+  }
+  const parts = content
+    .map((block) => {
+      const record = asRecord(block)
+      const type = extractString(record?.type)
+      return type === 'input_text' || type === 'output_text' || type === 'text'
+        ? extractString(record?.text)
+        : null
+    })
+    .filter((text): text is string => typeof text === 'string' && text.length > 0)
+  return parts.length > 0 ? parts.join('\n\n') : null
+}
+
+export function consumeCodebuddySessionLine(state: CodebuddySessionParseState, line: string): void {
+  const { accumulator } = state
+  const record = parseJsonObject(line)
+  if (!record) {
+    return
+  }
+
+  if (typeof record.sessionId === 'string' && record.sessionId.trim()) {
+    accumulator.sessionId = record.sessionId.trim()
+  }
+  updateTimeline(accumulator, record.timestamp)
+  updateLatestLocation(accumulator, record)
+
+  // The CLI's own session title; later summaries revise it, like Claude's
+  // custom-title.
+  if (record.type === 'summary') {
+    const summary = normalizeTitleText(extractString(record.summary) ?? '')
+    if (summary) {
+      accumulator.title = summary
+    }
+    return
+  }
+
+  if (record.type === 'ai-title') {
+    const title = normalizeTitleText(extractString(record.aiTitle) ?? '')
+    if (title) {
+      // CodeBuddy can revise generated names; AI Vault mirrors the current one.
+      state.aiTitle = title
+    }
+    return
+  }
+
+  if (record.type !== 'message') {
+    return
+  }
+
+  const role = extractString(record.role)
+  const text = codebuddyContentText(record.content)
+  accumulator.messageCount++
+  if (role === 'user') {
+    // Meta prompts (injected context) only seed the last-resort title.
+    // `providerData.skipRun` marks machinery-injected turns that never reached
+    // the model as a user prompt.
+    const isMetaUserTurn =
+      asRecord(record.providerData)?.skipRun === true ||
+      (text != null && isKnownHarnessInjectedUserTurnText(text))
+    addPreviewMessage(accumulator, {
+      role: 'user',
+      text,
+      timestamp: record.timestamp,
+      seedFirstUserPrompt: !isMetaUserTurn
+    })
+    if (text && !isMetaUserTurn) {
+      state.firstUserTitle ??= text
+    }
+    return
+  }
+  if (role === 'assistant') {
+    addPreviewMessage(accumulator, { role: 'assistant', text, timestamp: record.timestamp })
+    const model = extractString(asRecord(record.providerData)?.model)
+    if (model) {
+      accumulator.model = model
+    }
+  }
+}
+
+export function finalizeCodebuddySessionParseState(
+  state: CodebuddySessionParseState,
+  platform: NodeJS.Platform,
+  options: ParserSessionOptions = {}
+): AiVaultSession | null {
+  // Finalize a snapshot: the live state (and its preview array) may keep
+  // accumulating appended lines after this session object is handed out.
+  const snapshot = cloneCodebuddySessionParseState(state)
+  // Why: the CLI's summary title wins via accumulator.title; the generated
+  // ai-title should outrank the raw first prompt when present.
+  snapshot.accumulator.fallbackTitle = snapshot.aiTitle ?? snapshot.firstUserTitle
+  return finalizeSession(snapshot.accumulator, platform, options)
+}
+
+function codebuddyResumeStateFromParseState(
+  state: CodebuddySessionParseState
+): ResumableSessionParseState {
+  return {
+    consumeLine: (line) => consumeCodebuddySessionLine(state, line),
+    identity: () => accumulatorSessionIdentity(state.accumulator),
+    clone: () => codebuddyResumeStateFromParseState(cloneCodebuddySessionParseState(state)),
+    touchFile: (file) => {
+      state.accumulator.modifiedAt = file.modifiedAt
+    },
+    finalize: (platform, options) => finalizeCodebuddySessionParseState(state, platform, options)
+  }
+}
+
+export function createCodebuddySessionResumeState(
+  file: FileWithMtime,
+  messages?: TranscriptMessageSink
+): ResumableSessionParseState {
+  return codebuddyResumeStateFromParseState(createCodebuddySessionParseState(file, messages))
+}
+
+export async function parseCodebuddySessionFile(
+  file: FileWithMtime,
+  platform: NodeJS.Platform = process.platform,
+  messages?: TranscriptMessageSink
+): Promise<AiVaultSession | null> {
+  const lines = createInterface({
+    input: openTranscriptReadStream(file.path, { encoding: 'utf-8' }, 'scan'),
+    crlfDelay: Infinity
+  })
+  return parseCodebuddySessionLines({ file, lines, platform, messages })
+}
+
+export async function parseCodebuddySessionContent(
+  file: FileWithMtime,
+  content: RemoteSessionContent,
+  platform: NodeJS.Platform = process.platform,
+  options: ParserSessionOptions = {},
+  signal?: AbortSignal
+): Promise<AiVaultSession | null> {
+  return parseCodebuddySessionLines({
+    file,
+    lines: remoteSessionContentLines(content, signal),
+    platform,
+    options
+  })
+}
+
+async function parseCodebuddySessionLines(args: {
+  file: FileWithMtime
+  lines: AsyncIterable<string> | Iterable<string>
+  platform: NodeJS.Platform
+  options?: ParserSessionOptions
+  messages?: TranscriptMessageSink
+}): Promise<AiVaultSession | null> {
+  const state = createCodebuddySessionParseState(args.file, args.messages)
+  for await (const line of args.lines) {
+    consumeCodebuddySessionLine(state, line)
+  }
+  return finalizeCodebuddySessionParseState(state, args.platform, args.options)
+}
diff --git a/src/main/ai-vault/session-scanner-codebuddy-scope.test.ts b/src/main/ai-vault/session-scanner-codebuddy-scope.test.ts
new file mode 100644
index 00000000000..9086ab1e811
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-codebuddy-scope.test.ts
@@ -0,0 +1,135 @@
+import { mkdtemp, mkdir, rm, utimes, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { scanAiVaultSessions } from './session-scanner'
+import { resetProjectDirCwdCacheForTests } from './session-scanner-scope-discovery'
+import { isolatedScanRoots, jsonLines } from './session-scanner-test-fixtures'
+
+let tempRoots: string[] = []
+
+afterEach(async () => {
+  await Promise.all(tempRoots.map((root) => rm(root, { recursive: true, force: true })))
+  tempRoots = []
+  resetProjectDirCwdCacheForTests()
+})
+
+function codebuddySessionDirName(cwd: string): string {
+  return cwd
+    .replace(/[/\\:]+/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-|-$/g, '')
+}
+
+async function writeCodeBuddySession(args: {
+  sessionsDir: string
+  cwd: string
+  id: string
+  timestamp: string
+}): Promise<void> {
+  const dir = join(args.sessionsDir, codebuddySessionDirName(args.cwd))
+  await mkdir(dir, { recursive: true })
+  const file = join(dir, `${args.id}.jsonl`)
+  await writeFile(
+    file,
+    jsonLines([
+      {
+        type: 'message',
+        timestamp: args.timestamp,
+        sessionId: args.id,
+        cwd: args.cwd,
+        role: 'user',
+        content: [{ type: 'input_text', text: `prompt ${args.id}` }]
+      }
+    ])
+  )
+  const time = new Date(args.timestamp)
+  await utimes(file, time, time)
+}
+
+describe('scanAiVaultSessions — CodeBuddy scope discovery', () => {
+  it('lists an older in-scope CodeBuddy session the recency cap would drop', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-ai-vault-codebuddy-scope-'))
+    tempRoots.push(root)
+    const roots = isolatedScanRoots(root)
+    const workspace = '/home/ada/orca/workspaces/orca/feature'
+
+    await writeCodeBuddySession({
+      sessionsDir: roots.codebuddyProjectsDir,
+      cwd: `${workspace}/packages/app`,
+      id: 'old-in-scope',
+      timestamp: '2026-05-01T10:00:00.000Z'
+    })
+    // Newer, out of scope, and a sibling whose encoding shares the workspace prefix.
+    await writeCodeBuddySession({
+      sessionsDir: roots.codebuddyProjectsDir,
+      cwd: '/home/ada/other',
+      id: 'recent-elsewhere',
+      timestamp: '2026-06-01T10:00:00.000Z'
+    })
+    await writeCodeBuddySession({
+      sessionsDir: roots.codebuddyProjectsDir,
+      cwd: `${workspace}-sibling`,
+      id: 'sibling',
+      timestamp: '2026-04-01T10:00:00.000Z'
+    })
+
+    const result = await scanAiVaultSessions({
+      ...roots,
+      platform: 'linux',
+      limit: 1,
+      scopePaths: [workspace]
+    })
+    const ids = result.sessions.map((session) => session.sessionId)
+
+    expect(ids).toContain('old-in-scope')
+    expect(ids).toContain('recent-elsewhere')
+    expect(ids).not.toContain('sibling')
+    expect(result.sessions.find((session) => session.sessionId === 'old-in-scope')?.agent).toBe(
+      'codebuddy'
+    )
+  })
+
+  it('finds an older session when another cwd shares its encoded bucket', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-codebuddy-collision-'))
+    tempRoots.push(root)
+    const roots = isolatedScanRoots(root)
+    for (const [cwd, id, timestamp] of [
+      ['/home/ada/repo/app', 'in-scope', '2026-04-01T10:00:00.000Z'],
+      ['/home/ada/repo-app', 'collision', '2026-05-01T10:00:00.000Z'],
+      ['/home/ada/elsewhere', 'recent', '2026-06-01T10:00:00.000Z']
+    ]) {
+      await writeCodeBuddySession({ sessionsDir: roots.codebuddyProjectsDir, cwd, id, timestamp })
+    }
+    const result = await scanAiVaultSessions({
+      ...roots,
+      platform: 'linux',
+      limit: 1,
+      scopePaths: ['/home/ada/repo/app']
+    })
+    expect(result.sessions.map((session) => session.sessionId)).toContain('in-scope')
+    expect(result.sessions.map((session) => session.sessionId)).not.toContain('collision')
+  })
+
+  it('adds nothing when no scope is requested', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-ai-vault-codebuddy-noscope-'))
+    tempRoots.push(root)
+    const roots = isolatedScanRoots(root)
+    await writeCodeBuddySession({
+      sessionsDir: roots.codebuddyProjectsDir,
+      cwd: '/home/ada/old',
+      id: 'old',
+      timestamp: '2026-05-01T10:00:00.000Z'
+    })
+    await writeCodeBuddySession({
+      sessionsDir: roots.codebuddyProjectsDir,
+      cwd: '/home/ada/new',
+      id: 'new',
+      timestamp: '2026-06-01T10:00:00.000Z'
+    })
+
+    const result = await scanAiVaultSessions({ ...roots, platform: 'linux', limit: 1 })
+
+    expect(result.sessions.map((session) => session.sessionId)).toEqual(['new'])
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-codebuddy-source.test.ts b/src/main/ai-vault/session-scanner-codebuddy-source.test.ts
new file mode 100644
index 00000000000..a171ac6d671
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-codebuddy-source.test.ts
@@ -0,0 +1,80 @@
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { scanAiVaultSessions } from './session-scanner'
+import { isolatedScanRoots, jsonLines } from './session-scanner-test-fixtures'
+
+let tempRoots: string[] = []
+
+afterEach(async () => {
+  await Promise.all(tempRoots.map((root) => rm(root, { recursive: true, force: true })))
+  tempRoots = []
+})
+
+describe('scanAiVaultSessions — CodeBuddy transcripts', () => {
+  it('discovers ~/.codebuddy/projects transcripts and attributes them to codebuddy', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-ai-vault-codebuddy-'))
+    tempRoots.push(root)
+    const roots = isolatedScanRoots(root)
+    await mkdir(join(roots.codebuddyProjectsDir, 'project'), { recursive: true })
+
+    await writeFile(
+      join(roots.codebuddyProjectsDir, 'project', 'codebuddy-session.jsonl'),
+      jsonLines([
+        {
+          id: 'cb-msg-1',
+          timestamp: 1_777_634_400_000,
+          type: 'message',
+          role: 'user',
+          content: [{ type: 'input_text', text: 'fix the flaky test' }],
+          sessionId: 'codebuddy-session',
+          cwd: '/repo/app'
+        },
+        {
+          id: 'cb-msg-2',
+          timestamp: 1_777_634_405_000,
+          type: 'message',
+          role: 'assistant',
+          status: 'completed',
+          content: [{ type: 'output_text', text: 'On it' }],
+          providerData: { model: 'glm-5.3-flash' },
+          sessionId: 'codebuddy-session',
+          cwd: '/repo/app'
+        },
+        {
+          id: 'cb-title-1',
+          timestamp: 1_777_634_406_000,
+          type: 'ai-title',
+          aiTitle: 'Fixing the flaky test',
+          sessionId: 'codebuddy-session',
+          cwd: '/repo/app'
+        },
+        {
+          id: 'cb-summary-1',
+          timestamp: 1_777_634_407_000,
+          type: 'summary',
+          summary: 'Fix the flaky test',
+          providerData: { source: 'initial-user-message' }
+        }
+      ])
+    )
+
+    const result = await scanAiVaultSessions({ ...roots, platform: 'darwin' })
+
+    const codebuddy = result.sessions.find((session) => session.agent === 'codebuddy')
+    expect(codebuddy).toMatchObject({
+      sessionId: 'codebuddy-session',
+      cwd: '/repo/app',
+      title: 'Fix the flaky test',
+      model: 'glm-5.3-flash',
+      resumeCommand: "cd '/repo/app' && codebuddy --resume 'codebuddy-session'",
+      filePath: join(roots.codebuddyProjectsDir, 'project', 'codebuddy-session.jsonl')
+    })
+    expect(codebuddy?.messageCount).toBe(2)
+    expect(codebuddy?.previewMessages.map((message) => message.text)).toEqual([
+      'fix the flaky test',
+      'On it'
+    ])
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-codex-workers.test.ts b/src/main/ai-vault/session-scanner-codex-workers.test.ts
index 79271cbf39e..4d001d00422 100644
--- a/src/main/ai-vault/session-scanner-codex-workers.test.ts
+++ b/src/main/ai-vault/session-scanner-codex-workers.test.ts
@@ -219,6 +219,7 @@ describe('scanAiVaultSessions Codex worker sessions', () => {
       droidProjectsDir: join(root, 'droid-projects'),
       kimiSessionsDir: join(root, 'kimi-sessions'),
       museSessionsDir: join(root, 'muse-sessions'),
+      zcodeDbPath: join(root, 'zcode-db.sqlite'),
       platform: 'darwin'
     })
 
diff --git a/src/main/ai-vault/session-scanner-every-agent-fixture.ts b/src/main/ai-vault/session-scanner-every-agent-fixture.ts
index 5ae04c11b57..23caa8e348d 100644
--- a/src/main/ai-vault/session-scanner-every-agent-fixture.ts
+++ b/src/main/ai-vault/session-scanner-every-agent-fixture.ts
@@ -5,6 +5,7 @@ import {
 } from './session-scanner-test-fixtures'
 import { writeDocumentAgentFixtures } from './session-scanner-document-agent-fixtures'
 import { writeLogAgentFixtures } from './session-scanner-log-agent-fixtures'
+import { writeOpenCodeSqliteDatabase } from './session-scanner-opencode-sqlite-fixture'
 
 // Why this is shared rather than inline in one test: it is the only place that
 // writes one transcript in every supported agent's own format. A scan test and
@@ -34,5 +35,13 @@ export async function writeEveryAgentVault(root: string): Promise<EveryAgentVaul
   await writeDocumentAgentFixtures(root, roots, antigravitySessionId)
   await writeMuseScannerFixture(roots.museSessionsDir)
   roots.opencodeDbPaths = [await writeOpenCode2SqliteFixture(root)]
+  writeOpenCodeSqliteDatabase(roots.zcodeDbPath, [
+    {
+      id: 'zcode-session',
+      directory: '/tmp/zcode',
+      title: 'ZCode title',
+      turns: [{ role: 'user', parts: ['ZCode session prompt'] }]
+    }
+  ])
   return { roots, antigravitySessionId, ompSessionFile, primeAgentSessionFile }
 }
diff --git a/src/main/ai-vault/session-scanner-log-agent-fixtures.ts b/src/main/ai-vault/session-scanner-log-agent-fixtures.ts
index ed2cf8d2eee..be080271269 100644
--- a/src/main/ai-vault/session-scanner-log-agent-fixtures.ts
+++ b/src/main/ai-vault/session-scanner-log-agent-fixtures.ts
@@ -32,6 +32,23 @@ export async function writeLogAgentFixtures(
     ])
   )
 
+  // CodeBuddy writes its own message-record shape under its own root.
+  await mkdir(join(roots.codebuddyProjectsDir, 'project'), { recursive: true })
+  await writeFile(
+    join(roots.codebuddyProjectsDir, 'project', 'codebuddy-session.jsonl'),
+    jsonlBody([
+      {
+        id: 'codebuddy-msg-1',
+        timestamp: 1_777_634_430_000,
+        type: 'message',
+        role: 'user',
+        content: [{ type: 'input_text', text: 'CodeBuddy title' }],
+        sessionId: 'codebuddy-session',
+        cwd: '/tmp/codebuddy'
+      }
+    ])
+  )
+
   await mkdir(join(roots.codexSessionsDir, '2026', '05', '01'), { recursive: true })
   await writeFile(
     join(roots.codexSessionsDir, '2026', '05', '01', 'rollout-2026-codex-session.jsonl'),
diff --git a/src/main/ai-vault/session-scanner-opencode-cancellation.test.ts b/src/main/ai-vault/session-scanner-opencode-cancellation.test.ts
new file mode 100644
index 00000000000..4f47af380cd
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-cancellation.test.ts
@@ -0,0 +1,122 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as workerSpawn from './session-scanner-opencode-sqlite-worker-spawn'
+import type { SessionFileDiscovery } from './session-scanner-types'
+import type { TranscriptReadOutcome } from './session-transcript-consumers'
+import { createAccumulator, finalizeSession } from './session-scanner-accumulator'
+
+const readers = vi.hoisted(() => ({
+  parse: vi.fn<typeof workerSpawn.parseOpenCodeSqliteSessionViaWorker>(),
+  capture: vi.fn<typeof workerSpawn.captureOpenCodeSqliteSessionViaWorker>(),
+  discover: vi.fn<() => Promise<SessionFileDiscovery[]>>()
+}))
+vi.mock('./session-scanner-opencode-sqlite-worker-spawn', () => ({
+  parseOpenCodeSqliteSessionViaWorker: readers.parse,
+  parseOpenCode2SqliteSessionViaWorker: readers.parse,
+  captureOpenCodeSqliteSessionViaWorker: readers.capture,
+  captureOpenCode2SqliteSessionViaWorker: readers.capture
+}))
+vi.mock('./session-scanner-source-discovery', () => ({
+  discoverAiVaultSessionSources: readers.discover
+}))
+import { scanAiVaultSessions } from './session-scanner'
+import { resetSessionParseCacheForTests } from './session-scanner-parse-cache'
+import {
+  registerTranscriptConsumer,
+  resetTranscriptConsumersForTests
+} from './session-transcript-consumers'
+
+const file = {
+  path: '/fixture/opencode.db#session',
+  mtimeMs: 1,
+  modifiedAt: new Date(1).toISOString()
+}
+const messages = [
+  { role: 'user' as const, text: 'First', timestamp: null },
+  { role: 'assistant' as const, text: 'Second', timestamp: null }
+]
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  resetSessionParseCacheForTests()
+})
+afterEach(() => {
+  resetTranscriptConsumersForTests()
+  resetSessionParseCacheForTests()
+})
+
+function configure(agent: 'opencode' | 'opencode2') {
+  readers.discover.mockResolvedValue([{ agent, rootDir: '/fixture', files: [file] }])
+  const accumulator = createAccumulator({ agent, file, sessionId: 'session' })
+  accumulator.title = 'SQLite session'
+  return finalizeSession(accumulator, 'linux')
+}
+
+function untilAborted(signal: AbortSignal | undefined): Promise<never> {
+  if (!signal) {
+    throw new Error('SQLite request did not receive the scan signal')
+  }
+  return new Promise((_resolve, reject) => {
+    signal.addEventListener('abort', () => reject(signal.reason), { once: true })
+  })
+}
+
+describe.each(['opencode', 'opencode2'] as const)('%s scan cancellation', (agent) => {
+  it.each(['parse', 'capture'] as const)(
+    'cancels an active %s and retries the uncached read',
+    async (mode) => {
+      const session = configure(agent)
+      const outcomes: TranscriptReadOutcome[] = []
+      if (mode === 'capture') {
+        registerTranscriptConsumer({
+          beginRead: () => ({ message() {}, finish: (outcome) => outcomes.push(outcome) })
+        })
+        readers.capture.mockImplementationOnce(({ signal }) => untilAborted(signal))
+      } else {
+        readers.parse.mockImplementationOnce(({ signal }) => untilAborted(signal))
+      }
+      const controller = new AbortController()
+      const pending = scanAiVaultSessions({ platform: 'linux', signal: controller.signal })
+      const rejected = expect(pending).rejects.toMatchObject({ name: 'AbortError' })
+      await vi.waitFor(() => expect(readers[mode]).toHaveBeenCalledOnce())
+      controller.abort(new Error('Cancelled SQLite scan'))
+      await rejected
+      if (mode === 'capture') {
+        expect(outcomes).toEqual([{ session: null, byteOffset: 0, incomplete: true }])
+      }
+      readers.parse.mockResolvedValue(session)
+      readers.capture.mockResolvedValue({ session, messages })
+      const retried = await scanAiVaultSessions({ platform: 'linux' })
+      expect(readers[mode]).toHaveBeenCalledTimes(2)
+      expect(retried.sessions).toHaveLength(1)
+      if (mode === 'capture') {
+        expect(outcomes.at(-1)?.incomplete).toBe(false)
+      }
+    }
+  )
+
+  it('marks a partially delivered capture incomplete and never caches it', async () => {
+    const session = configure(agent)
+    const controller = new AbortController()
+    const outcomes: TranscriptReadOutcome[] = []
+    const received: string[] = []
+    registerTranscriptConsumer({
+      beginRead: () => ({
+        message(message) {
+          received.push(message.text)
+          controller.abort()
+        },
+        finish: (outcome) => outcomes.push(outcome)
+      })
+    })
+    readers.capture.mockResolvedValue({ session, messages })
+    await expect(
+      scanAiVaultSessions({ platform: 'linux', signal: controller.signal })
+    ).rejects.toMatchObject({ name: 'AbortError' })
+    expect(received).toEqual(['First'])
+    expect(outcomes).toEqual([{ session: null, byteOffset: 0, incomplete: true }])
+    resetTranscriptConsumersForTests()
+    readers.parse.mockResolvedValue(session)
+    expect((await scanAiVaultSessions({ platform: 'linux' })).sessions).toHaveLength(1)
+    expect(readers.parse).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-opencode-process-admission.test.ts b/src/main/ai-vault/session-scanner-opencode-process-admission.test.ts
new file mode 100644
index 00000000000..5f8920043a1
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-process-admission.test.ts
@@ -0,0 +1,116 @@
+import { EventEmitter } from 'node:events'
+import { PassThrough } from 'node:stream'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createOpenCodeSqliteProcessClient } from './session-scanner-opencode-sqlite-process-client'
+
+const mocked = vi.hoisted(() => ({ spawn: vi.fn() }))
+vi.mock('../../shared/child-process/run-process', () => ({ spawnProcess: mocked.spawn }))
+
+function child() {
+  const process = Object.assign(new EventEmitter(), {
+    stdin: new PassThrough(),
+    stdout: new PassThrough(),
+    stderr: new PassThrough(),
+    unref: vi.fn(),
+    kill: vi.fn()
+  })
+  process.stdin.on('data', (data) => {
+    const request = JSON.parse(data.toString())
+    if (request.sessionId !== 'block') {
+      process.stdout.write(`${JSON.stringify({ id: request.id, ok: true, value: null })}\n`)
+    }
+  })
+  return process
+}
+const args = { dbPath: '/home/ada/opencode.db', sessionId: 'session', platform: 'linux' as const }
+const clients: ReturnType<typeof createOpenCodeSqliteProcessClient>[] = []
+afterEach(() => {
+  clients.splice(0).forEach((client) => client.dispose())
+  vi.restoreAllMocks()
+  vi.clearAllMocks()
+})
+
+function reader(beforeSpawn: (signal: AbortSignal) => Promise<void>, idleTeardownMs = 30_000) {
+  mocked.spawn.mockImplementation(child)
+  const result = createOpenCodeSqliteProcessClient({
+    executable: 'wsl.exe',
+    args: ['--exec', '/runtime', '/reader'],
+    beforeSpawn,
+    idleTeardownMs
+  })
+  clients.push(result)
+  return result
+}
+
+describe('SQLite process launch admission', () => {
+  it('does not probe a reader cancelled before admission starts', async () => {
+    const admit = vi.fn(async () => {})
+    const client = reader(admit)
+    const cancellation = new AbortController()
+    const pending = client.parse({ ...args, signal: cancellation.signal })
+    const rejected = expect(pending).rejects.toThrow('cancelled')
+    cancellation.abort(new Error('cancelled'))
+    await rejected
+    await Promise.resolve()
+    expect(admit).not.toHaveBeenCalled()
+    expect(mocked.spawn).not.toHaveBeenCalled()
+  })
+
+  it('probes once per process, reuses it for every read, and reprobes after idle expiry', async () => {
+    const admit = vi.fn(async () => {})
+    const client = reader(admit, 15)
+    for (let index = 0; index < 20; index++) {
+      expect(await client.parse(args)).toBeNull()
+    }
+    expect(admit).toHaveBeenCalledOnce()
+    expect(mocked.spawn).toHaveBeenCalledOnce()
+    await vi.waitFor(() => expect(mocked.spawn.mock.results[0]?.value.kill).toHaveBeenCalled())
+    await client.parse(args)
+    expect(admit).toHaveBeenCalledTimes(2)
+    expect(mocked.spawn).toHaveBeenCalledTimes(2)
+  })
+
+  it('blocks every queued respawn after the execution host stops', async () => {
+    const admit = vi.fn(async () => {})
+    const client = reader(admit)
+    const active = client.parse({ ...args, sessionId: 'block' }).catch((error: unknown) => error)
+    const queued = Array.from({ length: 4 }, () =>
+      client.parse(args).catch((error: unknown) => error)
+    )
+    await vi.waitFor(() => expect(mocked.spawn).toHaveBeenCalledOnce())
+    admit.mockRejectedValue(new Error('Distro is not running'))
+    mocked.spawn.mock.results[0]?.value.emit('exit', 1)
+    expect(await active).toMatchObject({ message: expect.stringContaining('exited') })
+    for (const result of await Promise.all(queued)) {
+      expect(result).toBeInstanceOf(Error)
+    }
+    expect(mocked.spawn).toHaveBeenCalledOnce()
+    expect(admit.mock.calls.length).toBeGreaterThan(1)
+  })
+
+  it('rejects unavailable admission and cancels a pending probe without a late spawn', async () => {
+    const refused = reader(async () => {
+      throw new Error('Running state unavailable')
+    })
+    await expect(refused.parse(args)).rejects.toThrow('Running state unavailable')
+    expect(mocked.spawn).not.toHaveBeenCalled()
+    let finish = () => {}
+    const admit = vi.fn(
+      () =>
+        new Promise<void>((resolve) => {
+          finish = resolve
+        })
+    )
+    const waiting = reader(admit)
+    const cancellation = new AbortController()
+    const pending = waiting.parse({ ...args, signal: cancellation.signal })
+    const rejected = expect(pending).rejects.toThrow('cancelled')
+    await vi.waitFor(() => expect(admit).toHaveBeenCalledOnce())
+    cancellation.abort(new Error('cancelled'))
+    await rejected
+    finish()
+    await Promise.resolve()
+    await Promise.resolve()
+    expect(mocked.spawn).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-opencode-sources.ts b/src/main/ai-vault/session-scanner-opencode-sources.ts
index ea93787d642..5f15f17d758 100644
--- a/src/main/ai-vault/session-scanner-opencode-sources.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sources.ts
@@ -24,11 +24,14 @@ export function opencodeDiscoveries(
           storageDir,
           dbPaths: dbPaths.filter((path) => !isOpenCodeV2DatabaseName(basename(path))),
           limitPerAgent: limit,
-          issues
+          issues,
+          signal: options.signal
         })
       ),
       // Current releases share opencode.db with v1; the worker checks for v2 tables.
-      paths.then((dbPaths) => discoverOpenCode2Sessions(storageDir, dbPaths, limit, issues))
+      paths.then((dbPaths) =>
+        discoverOpenCode2Sessions(storageDir, dbPaths, limit, issues, options.signal)
+      )
     ]
   })
 }
@@ -96,9 +99,10 @@ async function discoverOpenCode2Sessions(
   storageDir: string,
   dbPaths: readonly string[],
   limit: number,
-  issues: AiVaultScanIssue[]
+  issues: AiVaultScanIssue[],
+  signal?: AbortSignal
 ): Promise<SessionFileDiscovery> {
-  const files = await listOpenCode2SqliteSessionsViaWorker({ dbPaths, limit, issues })
+  const files = await listOpenCode2SqliteSessionsViaWorker({ dbPaths, limit, issues, signal })
   return {
     agent: 'opencode2' as const,
     rootDir: storageDir,
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-capture.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-capture.ts
index f4622118956..ef15b368ef3 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-capture.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-capture.ts
@@ -10,6 +10,7 @@ import { readOpenCodeDatabase } from './session-scanner-opencode-sqlite-open'
 import { canReadOpenCodeMessageParts } from './session-scanner-opencode-sqlite-schema'
 import type { TranscriptMessage, TranscriptMessageRole } from './session-transcript-consumers'
 import { boundedText, toolCallText } from './session-transcript-message-content'
+import { zcodeVisibleMessageFilter } from './session-scanner-zcode-visibility'
 import type SyncDatabase from '../sqlite/sync-database'
 
 // Why: the session list needs the newest few messages, and the search index
@@ -119,7 +120,7 @@ function captureRole(role: string | null): TranscriptMessageRole | null {
   return role === 'user' || role === 'assistant' ? role : null
 }
 
-function buildCaptureQuery(): string {
+function buildCaptureQuery(agent: 'opencode' | 'zcode'): string {
   // Message order, then part order within a message: the same key the preview
   // read uses, run forwards and without the newest-N window.
   return `SELECT m.id AS message_id,
@@ -130,6 +131,7 @@ function buildCaptureQuery(): string {
           FROM message m
           JOIN part p ON p.message_id = m.id
           WHERE m.session_id = ?
+            ${zcodeVisibleMessageFilter(agent)}
             AND json_extract(m.data, '$.role') IN ('user','assistant')
             AND json_extract(p.data, '$.type') IN ${OPENCODE_CAPTURE_PART_TYPES}
           ORDER BY m.time_created ASC, m.id ASC, p.time_created ASC, p.rowid ASC
@@ -149,20 +151,24 @@ function buildCaptureQuery(): string {
  */
 export function readOpenCodeSessionMessages(
   db: SyncDatabase,
-  sessionId: string
+  sessionId: string,
+  agent: 'opencode' | 'zcode' = 'opencode'
 ): TranscriptMessage[] {
+  const agentName = agent === 'zcode' ? 'ZCode' : 'OpenCode'
   if (!canReadOpenCodeMessageParts(db)) {
     // Thrown for the same reason the part limit below throws: an empty capture
     // returned here is committed under a complete-read cursor, so the session
     // stays out of search with nothing on its row to say why and no retry.
     throw new Error(
-      `OpenCode session ${sessionId} uses an unreadable message-part schema; its transcript was not read.`
+      `${agentName} session ${sessionId} uses an unreadable message-part schema; its transcript was not read.`
     )
   }
-  const rows = db.prepare(buildCaptureQuery()).all(sessionId, OPENCODE_CAPTURE_RECORD_LIMIT + 1)
+  const rows = db
+    .prepare(buildCaptureQuery(agent))
+    .all(sessionId, OPENCODE_CAPTURE_RECORD_LIMIT + 1)
   if (rows.length > OPENCODE_CAPTURE_RECORD_LIMIT) {
     throw new Error(
-      `OpenCode session ${sessionId} holds more than ${OPENCODE_CAPTURE_RECORD_LIMIT} text parts; its transcript was not read.`
+      `${agentName} session ${sessionId} holds more than ${OPENCODE_CAPTURE_RECORD_LIMIT} text parts; its transcript was not read.`
     )
   }
 
@@ -178,7 +184,7 @@ export function readOpenCodeSessionMessages(
     captured += message.text.length
     if (captured > OPENCODE_CAPTURE_TEXT_LIMIT) {
       throw new Error(
-        `OpenCode session ${sessionId} decodes to more than ${OPENCODE_CAPTURE_TEXT_LIMIT} characters; its transcript was not read.`
+        `${agentName} session ${sessionId} decodes to more than ${OPENCODE_CAPTURE_TEXT_LIMIT} characters; its transcript was not read.`
       )
     }
     messages.push(message)
@@ -237,13 +243,17 @@ export async function captureOpenCodeSqliteSession(args: {
   dbPath: string
   sessionId: string
   platform: NodeJS.Platform
+  agent?: 'opencode' | 'zcode'
 }): Promise<OpenCodeSqliteCapture> {
   return readOpenCodeDatabase({
     dbPath: args.dbPath,
     read: (db) => {
       const session = readOpenCodeSqliteSession({ db, ...args })
       // No session row is no transcript: the id names nothing in this database.
-      return { session, messages: session ? readOpenCodeSessionMessages(db, args.sessionId) : [] }
+      return {
+        session,
+        messages: session ? readOpenCodeSessionMessages(db, args.sessionId, args.agent) : []
+      }
     }
   })
 }
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-coexistence.test.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-coexistence.test.ts
index ff51677d27f..e2fbcb22512 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-coexistence.test.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-coexistence.test.ts
@@ -17,6 +17,9 @@ vi.mock('./session-scanner-opencode-sqlite-worker-spawn', async () => {
   return {
     listOpenCode2SqliteSessionsViaWorker: listOpenCode2SqliteSessions,
     listOpenCodeSqliteSessionsViaWorker: listOpenCodeSqliteSessions,
+    // ZCode reuses the OpenCode SQLite lister; the worker only varies the agent it stamps.
+    listZcodeSqliteSessionsViaWorker: (args: Parameters<typeof listOpenCodeSqliteSessions>[0]) =>
+      listOpenCodeSqliteSessions({ ...args, agent: 'zcode' }),
     parseOpenCodeSqliteSessionViaWorker: parseOpenCodeSqliteSession
   }
 })
@@ -54,6 +57,7 @@ function isolatedScanRoots(root: string) {
     droidProjectsDir: join(root, 'droid-projects'),
     kimiSessionsDir: join(root, 'kimi-sessions'),
     museSessionsDir: join(root, 'muse-sessions'),
+    zcodeDbPath: join(root, 'zcode-db.sqlite'),
     ompSessionsDir: join(root, 'omp-sessions'),
     primeAgentSessionsDir: join(root, 'prime-agent-sessions')
   }
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-discovery.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-discovery.ts
index a32ca1b2447..f8d8a84a7a9 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-discovery.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-discovery.ts
@@ -40,6 +40,7 @@ export async function discoverOpenCodeSessions(args: {
   dbPaths: readonly string[]
   limitPerAgent: number
   issues: AiVaultScanIssue[]
+  signal?: AbortSignal
 }): Promise<SessionFileDiscovery> {
   const [fileDiscovery, sqliteCandidates] = await Promise.all([
     discoverFiles({
@@ -54,7 +55,8 @@ export async function discoverOpenCodeSessions(args: {
     listOpenCodeSqliteSessionsViaWorker({
       dbPaths: args.dbPaths,
       limit: args.limitPerAgent,
-      issues: args.issues
+      issues: args.issues,
+      signal: args.signal
     })
   ])
 
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-dispatch.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-dispatch.ts
new file mode 100644
index 00000000000..e483f9482e1
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-dispatch.ts
@@ -0,0 +1,68 @@
+import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
+import { captureOpenCodeSqliteSession } from './session-scanner-opencode-sqlite-capture'
+import { listOpenCodeSqliteSessions } from './session-scanner-opencode-sqlite-list'
+import { parseOpenCodeSqliteSession } from './session-scanner-opencode-sqlite'
+import { listOpenCode2SqliteSessions } from './session-scanner-opencode2-sqlite-list'
+import {
+  captureOpenCode2SqliteSession,
+  parseOpenCode2SqliteSession
+} from './session-scanner-opencode2-sqlite'
+import type {
+  OpenCodeSqliteWorkerRequest,
+  OpenCodeSqliteWorkerResponse
+} from './session-scanner-opencode-sqlite-worker-protocol'
+
+import { withFullFirstUserPromptCapture } from './session-scanner-first-user-prompt-capture'
+
+export async function handleOpenCodeSqliteRequest(
+  request: OpenCodeSqliteWorkerRequest
+): Promise<OpenCodeSqliteWorkerResponse> {
+  try {
+    if (request.kind === 'list') {
+      const issues: AiVaultScanIssue[] = []
+      const candidates =
+        request.agent === 'opencode2'
+          ? await listOpenCode2SqliteSessions({
+              dbPaths: request.dbPaths,
+              limit: request.limit ?? Infinity,
+              issues
+            })
+          : await listOpenCodeSqliteSessions({
+              dbPaths: request.dbPaths,
+              limit: request.limit ?? Infinity,
+              issues,
+              agent: request.agent === 'zcode' ? 'zcode' : 'opencode'
+            })
+      return { id: request.id, ok: true, value: { candidates, issues } }
+    }
+    if (request.kind === 'capture') {
+      const capture =
+        request.agent === 'opencode2'
+          ? await captureOpenCode2SqliteSession(request)
+          : await captureOpenCodeSqliteSession({
+              ...request,
+              agent: request.agent === 'zcode' ? 'zcode' : 'opencode'
+            })
+      return { id: request.id, ok: true, value: capture }
+    }
+    const parse = async () =>
+      request.agent === 'opencode2'
+        ? await parseOpenCode2SqliteSession({
+            dbPath: request.dbPath,
+            sessionId: request.sessionId,
+            platform: request.platform
+          })
+        : await parseOpenCodeSqliteSession({
+            dbPath: request.dbPath,
+            sessionId: request.sessionId,
+            platform: request.platform,
+            agent: request.agent === 'zcode' ? 'zcode' : 'opencode'
+          })
+    const session = request.fullFirstUserPrompt
+      ? await withFullFirstUserPromptCapture(parse)
+      : await parse()
+    return { id: request.id, ok: true, value: session }
+  } catch (err) {
+    return { id: request.id, ok: false, error: err instanceof Error ? err.message : String(err) }
+  }
+}
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-list.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-list.ts
index 93f9daab98c..7e739ba2238 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-list.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-list.ts
@@ -1,4 +1,4 @@
-import type { AiVaultAgent, AiVaultScanIssue } from '../../shared/ai-vault-types'
+import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
 import {
   buildOpenCodeSqliteCandidatePath,
   splitOpenCodeSqliteCandidate
@@ -54,13 +54,17 @@ function readSessionRows(db: SyncDatabase, limit: number): SessionRow[] {
   return (limited ? statement.all(limit) : statement.all()) as SessionRow[]
 }
 
-function rowToCandidate(row: SessionRow, dbPath: string): SessionFileCandidate {
+function rowToCandidate(
+  row: SessionRow,
+  dbPath: string,
+  agent: 'opencode' | 'zcode'
+): SessionFileCandidate {
   const mtimeMs =
     typeof row.time_updated === 'number' && row.time_updated > 0
       ? row.time_updated
       : row.time_created
   return {
-    agent: 'opencode' as AiVaultAgent,
+    agent,
     file: {
       path: buildOpenCodeSqliteCandidatePath(dbPath, row.id),
       mtimeMs,
@@ -70,10 +74,13 @@ function rowToCandidate(row: SessionRow, dbPath: string): SessionFileCandidate {
   }
 }
 
-function dedupeAndSortSqliteCandidates(candidates: SessionFileCandidate[]): SessionFileCandidate[] {
+function dedupeAndSortSqliteCandidates(
+  candidates: SessionFileCandidate[],
+  agent: 'opencode' | 'zcode'
+): SessionFileCandidate[] {
   const candidatesBySessionId = new Map<string, SessionFileCandidate>()
   for (const candidate of candidates) {
-    const parsed = splitOpenCodeSqliteCandidate(candidate.file.path)
+    const parsed = splitOpenCodeSqliteCandidate(candidate.file.path, agent)
     if (!parsed) {
       continue
     }
@@ -102,8 +109,10 @@ export async function listOpenCodeSqliteSessions(args: {
   dbPaths: readonly string[]
   limit: number
   issues: AiVaultScanIssue[]
+  agent?: 'opencode' | 'zcode'
 }): Promise<SessionFileCandidate[]> {
   const candidates: SessionFileCandidate[] = []
+  const agent = args.agent ?? 'opencode'
   for (const dbPath of args.dbPaths) {
     try {
       const rows = readOpenCodeDatabase({
@@ -111,12 +120,12 @@ export async function listOpenCodeSqliteSessions(args: {
         read: (db) => readSessionRows(db, args.limit)
       })
       for (const row of rows) {
-        candidates.push(rowToCandidate(row, dbPath))
+        candidates.push(rowToCandidate(row, dbPath, agent))
       }
     } catch (err) {
       // A whole DB failed, not one transcript: kinded so the panel says so.
-      args.issues.push(openCodeDatabaseScanIssue(dbPath, err))
+      args.issues.push(openCodeDatabaseScanIssue(dbPath, err, agent))
     }
   }
-  return dedupeAndSortSqliteCandidates(candidates)
+  return dedupeAndSortSqliteCandidates(candidates, agent)
 }
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-open.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-open.ts
index 43e32da2ff5..32f807cb1d9 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-open.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-open.ts
@@ -82,8 +82,13 @@ export function readOpenCodeDatabase<T>(args: {
  * @param error - The thrown value from the read.
  * @returns A kinded scan issue with actionable copy.
  */
-export function openCodeDatabaseScanIssue(dbPath: string, error: unknown): AiVaultScanIssue {
+export function openCodeDatabaseScanIssue(
+  dbPath: string,
+  error: unknown,
+  agent: 'opencode' | 'zcode' = 'opencode'
+): AiVaultScanIssue {
   const name = basename(dbPath)
+  const label = agent === 'zcode' ? 'ZCode' : 'OpenCode'
   // `fileMustExist` already proved the database file is there before SQLite ran,
   // so this needs no fs probe of its own — an extra sync stat on a 9p share is
   // exactly the hang the WSL transcript gate exists to prevent.
@@ -96,18 +101,18 @@ export function openCodeDatabaseScanIssue(dbPath: string, error: unknown): AiVau
   const overWslShare = isWslUncPath(dbPath)
   const detail =
     kind === 'contended' && !overWslShare
-      ? `OpenCode is writing to ${name} right now, so its history was skipped. It is read again on the next refresh.`
+      ? `${label} is writing to ${name} right now, so its history was skipped. It is read again on the next refresh.`
       : kind === 'unreadable'
-        ? `OpenCode history in ${name} could not be read: ${errorMessage(error)}`
-        : unreadableShareDetail(dbPath, name)
-  return { agent: 'opencode', kind: 'scope', path: dbPath, message: detail }
+        ? `${label} history in ${name} could not be read: ${errorMessage(error)}`
+        : unreadableShareDetail(dbPath, name, label)
+  return { agent, kind: 'scope', path: dbPath, message: detail }
 }
 
-function unreadableShareDetail(dbPath: string, name: string): string {
+function unreadableShareDetail(dbPath: string, name: string, label: string): string {
   // A known limitation, not a failure the user can act on: nothing they do on
   // the Windows side makes the share hand out SQLite's locks. Deliberately not
   // "flush the write-ahead log" either — checkpointing changes nothing here.
   return isWslUncPath(dbPath)
-    ? "OpenCode sessions inside WSL can't be searched from Windows yet."
-    : `OpenCode history in ${name} could not be read. Its write-ahead log cannot be opened read-only on this filesystem. Exit OpenCode cleanly to flush the log.`
+    ? `${label} sessions inside WSL can't be searched from Windows yet.`
+    : `${label} history in ${name} could not be read. Its write-ahead log cannot be opened read-only on this filesystem. Exit ${label} cleanly to flush the log.`
 }
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-paths.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-paths.ts
index 7f0a61a674a..77c0e464154 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-paths.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-paths.ts
@@ -26,7 +26,8 @@ export function buildOpenCodeSqliteCandidatePath(dbPath: string, sessionId: stri
  * @returns `{ dbPath, sessionId }` if the path is a valid synthetic candidate, `null` otherwise.
  */
 export function splitOpenCodeSqliteCandidate(
-  candidatePath: string
+  candidatePath: string,
+  agent: 'opencode' | 'opencode2' | 'zcode' = 'opencode'
 ): { dbPath: string; sessionId: string } | null {
   const separatorIndex = candidatePath.lastIndexOf(OPENCODE_SQLITE_PATH_SEPARATOR)
   if (separatorIndex <= 0 || separatorIndex === candidatePath.length - 1) {
@@ -39,7 +40,11 @@ export function splitOpenCodeSqliteCandidate(
   }
   // Why: OpenCode DB files are named opencode*.db; reject anything else so we
   // never misroute a real filesystem path that happens to contain '#'.
-  if (!/^opencode(?:-[A-Za-z0-9_.-]+)?\.db$/i.test(basename(dbPath))) {
+  const validName =
+    agent === 'zcode'
+      ? basename(dbPath).toLowerCase() === 'db.sqlite'
+      : /^opencode(?:-[A-Za-z0-9_.-]+)?\.db$/i.test(basename(dbPath))
+  if (!validName) {
     return null
   }
   return { dbPath, sessionId }
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-process-client.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-process-client.ts
new file mode 100644
index 00000000000..59e12071dec
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-process-client.ts
@@ -0,0 +1,154 @@
+import { EventEmitter } from 'node:events'
+import { spawnProcess } from '../../shared/child-process/run-process'
+import { waitForPromiseWithSignal } from '../../shared/abort-signal-reason'
+import type { WorkerRequestTransport } from '../lazy-worker-thread-host'
+import { OpenCodeSqliteWorkerClient } from './session-scanner-opencode-sqlite-worker-client'
+import {
+  createOpenCodeSqliteLineDecoder,
+  encodeOpenCodeSqliteFrame,
+  OPENCODE_SQLITE_REQUEST_MAX_BYTES,
+  OPENCODE_SQLITE_RESPONSE_MAX_BYTES
+} from './session-scanner-opencode-sqlite-process-framing'
+
+export type OpenCodeSqliteProcessOptions = {
+  executable: string
+  args: readonly string[]
+  env?: NodeJS.ProcessEnv
+  cwd?: string
+  log?: (message: string) => void
+  requestTimeoutMs?: number
+  idleTeardownMs?: number
+  beforeSpawn?: (signal: AbortSignal) => Promise<void>
+}
+
+function createProcessTransport(options: OpenCodeSqliteProcessOptions): WorkerRequestTransport {
+  const child = spawnProcess({
+    program: options.executable,
+    args: options.args,
+    env: options.env,
+    cwd: options.cwd
+  })
+  const events = new EventEmitter()
+  let retired = false
+  const fault = (error: Error): void => {
+    if (!retired) {
+      events.emit('error', error)
+    }
+  }
+  const decode = createOpenCodeSqliteLineDecoder(OPENCODE_SQLITE_RESPONSE_MAX_BYTES, (line) => {
+    const response: unknown = JSON.parse(line)
+    if (
+      typeof response !== 'object' ||
+      response === null ||
+      !('id' in response) ||
+      !Number.isSafeInteger(response.id) ||
+      !('ok' in response) ||
+      typeof response.ok !== 'boolean' ||
+      (!response.ok && (!('error' in response) || typeof response.error !== 'string'))
+    ) {
+      throw new Error('Invalid OpenCode SQLite process response.')
+    }
+    events.emit('message', response)
+  })
+  child.stdout.on('data', (chunk: Buffer) => {
+    if (retired) {
+      return
+    }
+    try {
+      decode(chunk)
+    } catch (error) {
+      fault(error instanceof Error ? error : new Error(String(error)))
+    }
+  })
+  // Diagnostics never share the framed response channel or accumulate in memory.
+  child.stderr.resume()
+  child.on('error', fault)
+  child.stdin.on('error', fault)
+  child.stdout.on('error', fault)
+  child.stderr.on('error', fault)
+  child.on('exit', (code) => {
+    if (!retired) {
+      events.emit('exit', code ?? 1)
+    }
+  })
+  return Object.assign(events, {
+    postMessage(request: unknown): void {
+      if (retired || child.stdin.destroyed) {
+        throw new Error('OpenCode SQLite reader process is unavailable.')
+      }
+      child.stdin.write(encodeOpenCodeSqliteFrame(request, OPENCODE_SQLITE_REQUEST_MAX_BYTES))
+    },
+    unref(): void {
+      child.unref()
+      for (const stream of [child.stdin, child.stdout, child.stderr]) {
+        if ('unref' in stream && typeof stream.unref === 'function') {
+          stream.unref()
+        }
+      }
+    },
+    async terminate(): Promise<number> {
+      retired = true
+      // EOF reaches the guest reader even when this process is an SSH/WSL launcher.
+      child.stdin.end()
+      child.kill('SIGKILL')
+      child.stdout.destroy()
+      child.stderr.destroy()
+      return 0
+    }
+  })
+}
+
+export function createOpenCodeSqliteProcessClient(
+  options: OpenCodeSqliteProcessOptions
+): OpenCodeSqliteWorkerClient {
+  return new OpenCodeSqliteWorkerClient({
+    workerFactory: () =>
+      options.beforeSpawn
+        ? createAdmittedProcessTransport(options, options.beforeSpawn)
+        : createProcessTransport(options),
+    log: options.log,
+    requestTimeoutMs: options.requestTimeoutMs,
+    idleTeardownMs: options.idleTeardownMs
+  })
+}
+
+/** Admission belongs to each process birth, including respawns queued after a failure. */
+function createAdmittedProcessTransport(
+  options: OpenCodeSqliteProcessOptions,
+  admit: (signal: AbortSignal) => Promise<void>
+): WorkerRequestTransport {
+  const events = new EventEmitter()
+  const controller = new AbortController()
+  let transport: WorkerRequestTransport | undefined
+  const ready = Promise.resolve().then(async () => {
+    controller.signal.throwIfAborted()
+    await waitForPromiseWithSignal(admit(controller.signal), controller.signal)
+    controller.signal.throwIfAborted()
+    transport = createProcessTransport(options)
+    transport.on('message', (message) => events.emit('message', message))
+    transport.on('error', (error) => events.emit('error', error))
+    transport.on('exit', (code) => events.emit('exit', code))
+    transport.unref()
+    return transport
+  })
+  return Object.assign(events, {
+    postMessage(request: unknown): void {
+      void ready
+        .then((processTransport) => {
+          controller.signal.throwIfAborted()
+          processTransport.postMessage(request)
+        })
+        .catch((error: unknown) => {
+          if (!controller.signal.aborted) {
+            events.emit('error', error instanceof Error ? error : new Error(String(error)))
+          }
+        })
+    },
+    unref(): void {},
+    async terminate(): Promise<number> {
+      controller.abort()
+      transport?.removeAllListeners()
+      return transport ? transport.terminate() : 0
+    }
+  })
+}
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-process-entry.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-process-entry.ts
new file mode 100644
index 00000000000..e53d89eeeab
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-process-entry.ts
@@ -0,0 +1,117 @@
+import { isMainThread, parentPort, Worker } from 'node:worker_threads'
+import { handleOpenCodeSqliteRequest } from './session-scanner-opencode-sqlite-dispatch'
+import type { OpenCodeSqliteWorkerRequest } from './session-scanner-opencode-sqlite-worker-protocol'
+import {
+  createOpenCodeSqliteLineDecoder,
+  encodeOpenCodeSqliteFrame,
+  OPENCODE_SQLITE_PROCESS_MAX_TIMEOUT_MS,
+  OPENCODE_SQLITE_REQUEST_MAX_BYTES,
+  OPENCODE_SQLITE_RESPONSE_MAX_BYTES
+} from './session-scanner-opencode-sqlite-process-framing'
+
+function validRequest(value: unknown): value is OpenCodeSqliteWorkerRequest {
+  if (
+    typeof value !== 'object' ||
+    value === null ||
+    !('id' in value) ||
+    !Number.isSafeInteger(value.id) ||
+    !('kind' in value) ||
+    ('agent' in value && value.agent !== 'opencode2' && value.agent !== 'zcode') ||
+    ('timeoutMs' in value &&
+      (typeof value.timeoutMs !== 'number' ||
+        !Number.isFinite(value.timeoutMs) ||
+        value.timeoutMs <= 0))
+  ) {
+    return false
+  }
+  if (value.kind === 'list') {
+    return (
+      'dbPaths' in value &&
+      Array.isArray(value.dbPaths) &&
+      value.dbPaths.every((path) => typeof path === 'string') &&
+      'limit' in value &&
+      (value.limit === null ||
+        (typeof value.limit === 'number' && Number.isSafeInteger(value.limit) && value.limit >= 0))
+    )
+  }
+  return (
+    (value.kind === 'parse' || value.kind === 'capture') &&
+    'dbPath' in value &&
+    typeof value.dbPath === 'string' &&
+    'sessionId' in value &&
+    typeof value.sessionId === 'string' &&
+    'platform' in value &&
+    typeof value.platform === 'string' &&
+    [
+      'aix',
+      'android',
+      'darwin',
+      'freebsd',
+      'haiku',
+      'linux',
+      'openbsd',
+      'sunos',
+      'win32',
+      'cygwin',
+      'netbsd'
+    ].includes(value.platform) &&
+    (!('fullFirstUserPrompt' in value) || typeof value.fullFirstUserPrompt === 'boolean')
+  )
+}
+
+if (!isMainThread) {
+  const port = parentPort
+  if (!port) {
+    throw new Error('Missing OpenCode SQLite process worker port.')
+  }
+  port.on('message', (request: OpenCodeSqliteWorkerRequest) => {
+    void handleOpenCodeSqliteRequest(request).then((response) => {
+      try {
+        port.postMessage(encodeOpenCodeSqliteFrame(response, OPENCODE_SQLITE_RESPONSE_MAX_BYTES))
+      } catch {
+        port.postMessage(
+          `${JSON.stringify({
+            id: request.id,
+            ok: false,
+            error: 'OpenCode SQLite response exceeds its byte limit.'
+          })}\n`
+        )
+      }
+    })
+  })
+} else {
+  // Keep stdin and the hard deadline responsive while SQLite blocks its worker.
+  const worker = new Worker(__filename)
+  let activeId: number | null = null
+  let deadline: ReturnType<typeof setTimeout> | undefined
+  const stop = (code: number): never => process.exit(code)
+  worker.on('error', () => stop(1))
+  worker.on('exit', () => stop(1))
+  worker.on('message', (line: string) => {
+    clearTimeout(deadline)
+    activeId = null
+    process.stdout.write(line)
+  })
+  const decode = createOpenCodeSqliteLineDecoder(OPENCODE_SQLITE_REQUEST_MAX_BYTES, (line) => {
+    const request: unknown = JSON.parse(line)
+    if (!validRequest(request) || activeId !== null) {
+      return stop(1)
+    }
+    activeId = request.id
+    deadline = setTimeout(
+      () => stop(124),
+      Math.min(request.timeoutMs ?? 30_000, OPENCODE_SQLITE_PROCESS_MAX_TIMEOUT_MS)
+    )
+    worker.postMessage(request)
+  })
+  process.stdin.on('data', (chunk: Buffer) => {
+    try {
+      decode(chunk)
+    } catch {
+      stop(1)
+    }
+  })
+  process.stdin.on('end', () => stop(0))
+  process.stdin.on('error', () => stop(1))
+  process.stdout.on('error', () => stop(1))
+}
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-process-framing.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-process-framing.ts
new file mode 100644
index 00000000000..9458456cd8d
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-process-framing.ts
@@ -0,0 +1,25 @@
+import { SearchSubprocessLineAccumulator } from '../../shared/search-subprocess-lines'
+
+export const OPENCODE_SQLITE_REQUEST_MAX_BYTES = 1024 * 1024
+export const OPENCODE_SQLITE_RESPONSE_MAX_BYTES = 32 * 1024 * 1024
+export const OPENCODE_SQLITE_PROCESS_MAX_TIMEOUT_MS = 60_000
+
+export function createOpenCodeSqliteLineDecoder(
+  maxBytes: number,
+  onLine: (line: string) => void
+): (chunk: Buffer) => void {
+  const lines = new SearchSubprocessLineAccumulator(maxBytes)
+  return (chunk) => {
+    if (!lines.push(chunk, onLine)) {
+      throw new Error('OpenCode SQLite transport frame exceeds its byte limit.')
+    }
+  }
+}
+
+export function encodeOpenCodeSqliteFrame(value: unknown, maxBytes: number): string {
+  const line = JSON.stringify(value)
+  if (Buffer.byteLength(line) > maxBytes) {
+    throw new Error('OpenCode SQLite transport frame exceeds its byte limit.')
+  }
+  return `${line}\n`
+}
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-process.test.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-process.test.ts
new file mode 100644
index 00000000000..91402885721
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-process.test.ts
@@ -0,0 +1,253 @@
+import { build } from 'esbuild'
+import { existsSync, mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+import * as processRunner from '../../shared/child-process/run-process'
+import { runProcess, spawnProcess } from '../../shared/child-process/run-process'
+import { ORCAD_BUN_VERSION } from '../../shared/orcad-bun-runtime'
+import { orcadBunRuntimeFilename } from '../../shared/orcad-artifacts'
+import SyncDatabase from '../sqlite/sync-database'
+import { appendTurns, writeOpenCodeSqliteDatabase } from './session-scanner-opencode-sqlite-fixture'
+import { createOpenCodeSqliteProcessClient } from './session-scanner-opencode-sqlite-process-client'
+import {
+  OPENCODE_SQLITE_REQUEST_MAX_BYTES,
+  OPENCODE_SQLITE_RESPONSE_MAX_BYTES
+} from './session-scanner-opencode-sqlite-process-framing'
+import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
+
+const bun =
+  process.env.BUN_EXECUTABLE ?? resolve('out/orcad', orcadBunRuntimeFilename(process.platform))
+const directory = mkdtempSync(join(tmpdir(), 'orca-opencode-process-'))
+const entry = join(directory, 'reader.cjs')
+const dbPath = join(directory, 'opencode.db')
+const oversizedPath = join(directory, 'oversized.db')
+const prompt = 'A complete first prompt. '.repeat(200)
+let writer: SyncDatabase
+
+beforeAll(async () => {
+  await build({
+    entryPoints: ['src/main/ai-vault/session-scanner-opencode-sqlite-process-entry.ts'],
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    target: 'node22',
+    external: ['bun:sqlite'],
+    outfile: entry,
+    logLevel: 'silent'
+  })
+  writeOpenCodeSqliteDatabase(dbPath, [{ id: 'wal-session', turns: [] }])
+  writer = new SyncDatabase(dbPath)
+  writer.pragma('journal_mode = WAL')
+  writer.pragma('wal_autocheckpoint = 0')
+  appendTurns(writer, { id: 'wal-session', turns: [{ role: 'user', parts: [prompt] }] }, Date.now())
+  writeOpenCodeSqliteDatabase(oversizedPath, [
+    {
+      id: 'oversized',
+      turns: Array.from({ length: 130 }, () => ({
+        role: 'user' as const,
+        parts: ['x'.repeat(256 * 1024)]
+      }))
+    }
+  ])
+})
+
+afterAll(() => {
+  writer?.close()
+  rmSync(directory, { recursive: true, force: true })
+})
+
+for (const [runtime, executable] of [
+  ['Node', process.execPath],
+  ['Bun', bun]
+]) {
+  describe.skipIf(!existsSync(executable))(`OpenCode SQLite process under ${runtime}`, () => {
+    it('uses the deployed runtime and reads live WAL, full prompts and captures in one persistent child', async () => {
+      if (runtime === 'Bun') {
+        expect((await runProcess({ program: executable, args: ['--version'] })).stdout.trim()).toBe(
+          ORCAD_BUN_VERSION
+        )
+      }
+      expect(existsSync(`${dbPath}-wal`)).toBe(true)
+      const spawn = vi.spyOn(processRunner, 'spawnProcess')
+      const client = createOpenCodeSqliteProcessClient({
+        executable,
+        args: [entry],
+        cwd: directory,
+        beforeSpawn: async () => {}
+      })
+      try {
+        const issues: AiVaultScanIssue[] = []
+        const listed = await client.list({ dbPaths: [dbPath], limit: 5, issues })
+        expect(issues).toEqual([])
+        expect(listed).toHaveLength(1)
+        expect(await client.list({ dbPaths: [dbPath], limit: Infinity, issues })).toHaveLength(1)
+        const args = { dbPath, sessionId: 'wal-session', platform: process.platform }
+        expect((await client.parse(args))?.firstUserPrompt).toBeUndefined()
+        expect((await client.parse({ ...args, fullFirstUserPrompt: true }))?.firstUserPrompt).toBe(
+          prompt.trim()
+        )
+        expect((await client.capture(args)).messages).toEqual([
+          expect.objectContaining({ role: 'user', text: prompt })
+        ])
+        expect(spawn).toHaveBeenCalledOnce()
+      } finally {
+        client.dispose()
+        spawn.mockRestore()
+      }
+    })
+
+    it('fails oversized query responses without truncating a transcript and remains usable', async () => {
+      const client = createOpenCodeSqliteProcessClient({ executable, args: [entry] })
+      try {
+        await expect(
+          client.capture({
+            dbPath: oversizedPath,
+            sessionId: 'oversized',
+            platform: process.platform
+          })
+        ).rejects.toThrow('response exceeds its byte limit')
+        expect(
+          await client.parse({ dbPath, sessionId: 'wal-session', platform: process.platform })
+        ).not.toBeNull()
+      } finally {
+        client.dispose()
+      }
+    })
+
+    it('exits on parent EOF even while SQLite is busy, and enforces its own hard deadline', async () => {
+      const lockedPath = join(directory, `locked-${runtime}.db`)
+      writeOpenCodeSqliteDatabase(lockedPath, [{ id: 'locked', turns: [] }])
+      const lock = new SyncDatabase(lockedPath)
+      lock.exec('BEGIN EXCLUSIVE')
+      try {
+        const request = `${JSON.stringify({
+          id: 1,
+          kind: 'parse',
+          dbPath: lockedPath,
+          sessionId: 'locked',
+          platform: process.platform,
+          timeoutMs: 100
+        })}\n`
+        const child = spawnProcess({ program: executable, args: [entry] })
+        child.stderr.resume()
+        child.stdout.resume()
+        const exit = new Promise<number | null>((resolveExit) => child.once('exit', resolveExit))
+        child.stdin.on('error', () => {})
+        child.stdin.write(request)
+        expect(await exit).toBe(124)
+
+        const eof = await runProcess({
+          program: executable,
+          args: [entry],
+          input: request,
+          timeoutMs: 2_000
+        })
+        expect(eof.timedOut).toBe(false)
+        expect(eof.code).toBe(0)
+
+        const client = createOpenCodeSqliteProcessClient({ executable, args: [entry] })
+        const cancellation = new AbortController()
+        try {
+          const pending = client.parse({
+            dbPath: lockedPath,
+            sessionId: 'locked',
+            platform: process.platform,
+            signal: cancellation.signal
+          })
+          const rejected = expect(pending).rejects.toThrow('SQL read cancelled')
+          await new Promise((resolveDelay) => setTimeout(resolveDelay, 100))
+          cancellation.abort(new Error('SQL read cancelled'))
+          await rejected
+        } finally {
+          client.dispose()
+        }
+      } finally {
+        lock.exec('ROLLBACK')
+        lock.close()
+      }
+    })
+
+    it('rejects oversized request frames before running a query', async () => {
+      const result = await runProcess({
+        program: executable,
+        args: [entry],
+        input: 'x'.repeat(OPENCODE_SQLITE_REQUEST_MAX_BYTES + 1),
+        timeoutMs: 2_000
+      })
+      expect(result.code).toBe(1)
+      expect(result.stdout).toBe('')
+    })
+  })
+}
+
+describe('OpenCode SQLite process retirement', () => {
+  const args = { dbPath, sessionId: 'wal-session', platform: process.platform }
+
+  it('closes the child at idle expiry and creates one new reader for the next request', async () => {
+    const spawn = vi.spyOn(processRunner, 'spawnProcess')
+    const client = createOpenCodeSqliteProcessClient({
+      executable: process.execPath,
+      args: [entry],
+      idleTeardownMs: 20
+    })
+    try {
+      expect(await client.parse(args)).not.toBeNull()
+      const firstChild = spawn.mock.results[0]?.value
+      expect(firstChild).toBeDefined()
+      await vi.waitFor(() => expect(firstChild.signalCode).toBe('SIGKILL'))
+      expect(await client.parse(args)).not.toBeNull()
+      expect(spawn).toHaveBeenCalledTimes(2)
+    } finally {
+      client.dispose()
+      spawn.mockRestore()
+    }
+  })
+
+  it('cancels an active read, enforces queue limits, and fails closed after disposal', async () => {
+    const client = createOpenCodeSqliteProcessClient({
+      executable: process.execPath,
+      args: ['-e', 'process.stdin.resume();setInterval(()=>{},1000)'],
+      requestTimeoutMs: 5_000
+    })
+    const signal = new AbortController()
+    const active = client.parse({ ...args, signal: signal.signal }).catch((error: unknown) => error)
+    const queued = Array.from({ length: 64 }, () =>
+      client.parse(args).catch((error: unknown) => error)
+    )
+    await expect(client.parse(args)).rejects.toThrow('queue is full')
+    signal.abort(new Error('read cancelled'))
+    expect(await active).toMatchObject({ message: 'read cancelled' })
+    client.dispose()
+    expect(await Promise.all(queued)).toHaveLength(64)
+    await expect(client.parse(args)).rejects.toThrow('disposed')
+  })
+
+  it('retires a silent process at timeout and rejects bounded stdout/input overflow', async () => {
+    const silent = createOpenCodeSqliteProcessClient({
+      executable: process.execPath,
+      args: ['-e', 'process.stdin.resume();setInterval(()=>{},1000)'],
+      requestTimeoutMs: 100
+    })
+    try {
+      await expect(silent.parse(args)).rejects.toThrow('timed out')
+    } finally {
+      silent.dispose()
+    }
+    const noisy = createOpenCodeSqliteProcessClient({
+      executable: process.execPath,
+      args: [
+        '-e',
+        `process.stdin.once('data',()=>process.stdout.write('x'.repeat(${OPENCODE_SQLITE_RESPONSE_MAX_BYTES + 1})));`
+      ]
+    })
+    try {
+      await expect(noisy.parse(args)).rejects.toThrow('byte limit')
+      await expect(
+        noisy.parse({ ...args, dbPath: 'x'.repeat(OPENCODE_SQLITE_REQUEST_MAX_BYTES) })
+      ).rejects.toThrow('byte limit')
+    } finally {
+      noisy.dispose()
+    }
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-rows.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-rows.ts
new file mode 100644
index 00000000000..6d72cc4f64e
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-rows.ts
@@ -0,0 +1,48 @@
+import type { SqliteRow } from '../sqlite/sqlite-statement'
+import type { SQLOutputValue } from 'node:sqlite'
+
+type SessionRow = {
+  id: string
+  title: string | null
+  directory: string | null
+  time_created: number
+  time_updated: number
+  model_json: string | null
+  agent: string | null
+  tokens_input: number
+  tokens_output: number
+  tokens_reasoning: number
+  tokens_cache_read: number
+  cost: number
+  message_count: number
+}
+
+// Why guards and not casts: `SqliteStatement` hands back `Record<string, SQLOutputValue>`,
+// so the column types are only a claim about the query until something checks them. A row
+// from a schema that drifted, or from a database another tool wrote, reaches here too.
+export function readPartDataRow(row: SqliteRow): { part_data: string } | null {
+  return typeof row.part_data === 'string' ? { part_data: row.part_data } : null
+}
+
+export function readSessionRow(row: SqliteRow | undefined): SessionRow | null {
+  if (!row || typeof row.id !== 'string') {
+    return null
+  }
+  const text = (value: SQLOutputValue): string | null => (typeof value === 'string' ? value : null)
+  const count = (value: SQLOutputValue): number => (typeof value === 'number' ? value : 0)
+  return {
+    id: row.id,
+    title: text(row.title),
+    directory: text(row.directory),
+    time_created: count(row.time_created),
+    time_updated: count(row.time_updated),
+    model_json: text(row.model_json),
+    agent: text(row.agent),
+    tokens_input: count(row.tokens_input),
+    tokens_output: count(row.tokens_output),
+    tokens_reasoning: count(row.tokens_reasoning),
+    tokens_cache_read: count(row.tokens_cache_read),
+    cost: count(row.cost),
+    message_count: count(row.message_count)
+  }
+}
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-worker-client.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-worker-client.ts
index 1103a8379e5..c5f96c030e3 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-worker-client.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-worker-client.ts
@@ -52,16 +52,24 @@ function sessionReadFailure(err: unknown): Error {
  * SQLite work onto the main thread.
  */
 export class OpenCodeSqliteWorkerClient {
+  private readonly requestTimeoutMs: number | undefined
   private readonly requests: WorkerThreadRequestQueue<
     OpenCodeSqliteWorkerRequest,
     OpenCodeSqliteWorkerResponse
   >
 
-  constructor(options: { workerFactory: WorkerThreadFactory; log?: (message: string) => void }) {
+  constructor(options: {
+    workerFactory: WorkerThreadFactory
+    log?: (message: string) => void
+    idleTeardownMs?: number
+    requestTimeoutMs?: number
+  }) {
+    this.requestTimeoutMs = options.requestTimeoutMs
     const log = options.log ?? ((message: string) => console.warn(message))
     this.requests = new WorkerThreadRequestQueue({
       factory: options.workerFactory,
-      idleTeardownMs: IDLE_TEARDOWN_MS,
+      idleTeardownMs: options.idleTeardownMs ?? IDLE_TEARDOWN_MS,
+      queueCap: { maxQueuedCalls: 64, describeFull: () => 'OpenCode SQLite reader queue is full.' },
       maxConsecutiveDeaths: MAX_CONSECUTIVE_DEATHS,
       createUnavailableError: (message) => new OpenCodeSqliteWorkerUnavailableError(message),
       describeTimeout: (timeoutMs) => `OpenCode SQLite worker timed out after ${timeoutMs}ms`,
@@ -90,7 +98,8 @@ export class OpenCodeSqliteWorkerClient {
     dbPaths: readonly string[]
     limit: number
     issues: AiVaultScanIssue[]
-    agent?: 'opencode2'
+    agent?: 'opencode2' | 'zcode'
+    signal?: AbortSignal
   }): Promise<SessionFileCandidate[]> {
     if (args.dbPaths.length === 0) {
       return []
@@ -102,14 +111,18 @@ export class OpenCodeSqliteWorkerClient {
           id,
           kind: 'list',
           dbPaths: args.dbPaths,
-          limit: args.limit,
+          limit: Number.isFinite(args.limit) ? args.limit : null,
           ...(args.agent ? { agent: args.agent } : {})
         }),
-        LIST_TIMEOUT_MS
+        LIST_TIMEOUT_MS,
+        args.signal
       )) as OpenCodeSqliteListValue
       args.issues.push(...value.issues)
       return value.candidates
     } catch (err) {
+      if (args.signal?.aborted) {
+        throw err
+      }
       if (err instanceof OpenCodeSqliteWorkerUnavailableError) {
         // Kinded: a whole source failed, not a transcript.
         args.issues.push({
@@ -144,22 +157,26 @@ export class OpenCodeSqliteWorkerClient {
    *   worker timeout/crash so the scanner records a per-session scan issue.
    */
   async parse(args: {
+    fullFirstUserPrompt?: boolean
     dbPath: string
     sessionId: string
     platform: NodeJS.Platform
-    agent?: 'opencode2'
+    agent?: 'opencode2' | 'zcode'
+    signal?: AbortSignal
   }): Promise<AiVaultSession | null> {
     try {
       const value = await this.dispatch(
         (id) => ({
           id,
           kind: 'parse',
+          ...(args.fullFirstUserPrompt ? { fullFirstUserPrompt: true } : {}),
           dbPath: args.dbPath,
           sessionId: args.sessionId,
           platform: args.platform,
           ...(args.agent ? { agent: args.agent } : {})
         }),
-        PARSE_TIMEOUT_MS
+        PARSE_TIMEOUT_MS,
+        args.signal
       )
       // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the worker's parse leg returns exactly this, built by the repo's own reader on the other side of a structured clone.
       return value as AiVaultSession | null
@@ -184,7 +201,8 @@ export class OpenCodeSqliteWorkerClient {
     dbPath: string
     sessionId: string
     platform: NodeJS.Platform
-    agent?: 'opencode2'
+    agent?: 'opencode2' | 'zcode'
+    signal?: AbortSignal
   }): Promise<OpenCodeSqliteCaptureValue> {
     try {
       const value = await this.dispatch(
@@ -196,7 +214,8 @@ export class OpenCodeSqliteWorkerClient {
           platform: args.platform,
           ...(args.agent ? { agent: args.agent } : {})
         }),
-        CAPTURE_TIMEOUT_MS
+        CAPTURE_TIMEOUT_MS,
+        args.signal
       )
       return parseOpenCodeSqliteCaptureValue(value)
     } catch (err) {
@@ -204,11 +223,21 @@ export class OpenCodeSqliteWorkerClient {
     }
   }
 
+  dispose(): void {
+    this.requests.dispose()
+  }
+
   private async dispatch(
     buildRequest: (id: number) => OpenCodeSqliteWorkerRequest,
-    timeoutMs: number
+    timeoutMs: number,
+    signal?: AbortSignal
   ): Promise<unknown> {
-    const response = await this.requests.dispatch(buildRequest, timeoutMs)
+    const deadline = this.requestTimeoutMs ?? timeoutMs
+    const response = await this.requests.dispatch(
+      (id) => ({ ...buildRequest(id), timeoutMs: deadline }),
+      deadline,
+      signal
+    )
     if (!response.ok) {
       throw new Error(response.error)
     }
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-worker-entry.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-worker-entry.ts
index 7441bb1564a..704f80a53a7 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-worker-entry.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-worker-entry.ts
@@ -1,75 +1,14 @@
 import { parentPort } from 'node:worker_threads'
-import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
-import { captureOpenCodeSqliteSession } from './session-scanner-opencode-sqlite-capture'
-import { listOpenCodeSqliteSessions } from './session-scanner-opencode-sqlite-list'
-import { parseOpenCodeSqliteSession } from './session-scanner-opencode-sqlite'
-import { listOpenCode2SqliteSessions } from './session-scanner-opencode2-sqlite-list'
-import {
-  captureOpenCode2SqliteSession,
-  parseOpenCode2SqliteSession
-} from './session-scanner-opencode2-sqlite'
-import type {
-  OpenCodeSqliteWorkerRequest,
-  OpenCodeSqliteWorkerResponse
-} from './session-scanner-opencode-sqlite-worker-protocol'
-
-// Why (#8864): OpenCode SQLite reads use synchronous node:sqlite. Running them
-// on this worker thread keeps the multi-GB-DB scan off the Electron main-process
-// event loop. The client dispatches one request at a time, so this loop stays
-// serial; imports must remain electron-free (see the worker-protocol note).
+import type { OpenCodeSqliteWorkerRequest } from './session-scanner-opencode-sqlite-worker-protocol'
+import { handleOpenCodeSqliteRequest } from './session-scanner-opencode-sqlite-dispatch'
 
 if (!parentPort) {
   throw new Error('OpenCode SQLite worker must run with a parent port.')
 }
 const port = parentPort
 
-async function handleRequest(
-  request: OpenCodeSqliteWorkerRequest
-): Promise<OpenCodeSqliteWorkerResponse> {
-  try {
-    if (request.kind === 'list') {
-      const issues: AiVaultScanIssue[] = []
-      const candidates =
-        request.agent === 'opencode2'
-          ? await listOpenCode2SqliteSessions({
-              dbPaths: request.dbPaths,
-              limit: request.limit,
-              issues
-            })
-          : await listOpenCodeSqliteSessions({
-              dbPaths: request.dbPaths,
-              limit: request.limit,
-              issues
-            })
-      return { id: request.id, ok: true, value: { candidates, issues } }
-    }
-    if (request.kind === 'capture') {
-      const capture =
-        request.agent === 'opencode2'
-          ? await captureOpenCode2SqliteSession(request)
-          : await captureOpenCodeSqliteSession(request)
-      return { id: request.id, ok: true, value: capture }
-    }
-    const session =
-      request.agent === 'opencode2'
-        ? await parseOpenCode2SqliteSession({
-            dbPath: request.dbPath,
-            sessionId: request.sessionId,
-            platform: request.platform
-          })
-        : await parseOpenCodeSqliteSession({
-            dbPath: request.dbPath,
-            sessionId: request.sessionId,
-            platform: request.platform
-          })
-    return { id: request.id, ok: true, value: session }
-  } catch (err) {
-    return { id: request.id, ok: false, error: err instanceof Error ? err.message : String(err) }
-  }
-}
-
 port.on('message', (request: OpenCodeSqliteWorkerRequest) => {
-  void handleRequest(request).then((response) => {
+  void handleOpenCodeSqliteRequest(request).then((response) => {
     try {
       port.postMessage(response)
     } catch {
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-worker-protocol.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-worker-protocol.ts
index e18cad32c2c..9c8e42a5c7f 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-worker-protocol.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-worker-protocol.ts
@@ -10,19 +10,20 @@ export type OpenCodeSqliteListRequest = {
   id: number
   kind: 'list'
   dbPaths: readonly string[]
-  limit: number
+  limit: number | null
   /** When 'opencode2', lists from the v2 channel-scoped DB schema (session_v2). */
-  agent?: 'opencode2'
+  agent?: 'opencode2' | 'zcode'
 }
 
 export type OpenCodeSqliteParseRequest = {
   id: number
   kind: 'parse'
+  fullFirstUserPrompt?: boolean
   dbPath: string
   sessionId: string
   platform: NodeJS.Platform
   /** When 'opencode2', parses from the v2 channel-scoped DB schema (session_v2). */
-  agent?: 'opencode2'
+  agent?: 'opencode2' | 'zcode'
 }
 
 // Same arguments as `parse`, different answer: the session plus every message
@@ -35,13 +36,14 @@ export type OpenCodeSqliteCaptureRequest = {
   sessionId: string
   platform: NodeJS.Platform
   /** When 'opencode2', captures from the v2 channel-scoped schema. */
-  agent?: 'opencode2'
+  agent?: 'opencode2' | 'zcode'
 }
 
-export type OpenCodeSqliteWorkerRequest =
+export type OpenCodeSqliteWorkerRequest = (
   | OpenCodeSqliteListRequest
   | OpenCodeSqliteParseRequest
   | OpenCodeSqliteCaptureRequest
+) & { timeoutMs?: number }
 
 // The list leg returns candidates plus the issues it accumulated; the worker
 // mutates a local array and hands it back so the caller can merge it into the
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-worker-spawn.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-worker-spawn.ts
index c1e89e9fc79..68b1bacf698 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-worker-spawn.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-worker-spawn.ts
@@ -2,9 +2,19 @@ import { existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { Worker } from 'node:worker_threads'
 import type { AiVaultScanIssue, AiVaultSession } from '../../shared/ai-vault-types'
+import { throwIfSignalAborted } from '../../shared/abort-signal-reason'
 import type { SessionFileCandidate } from './session-scanner-types'
 import type { OpenCodeSqliteCaptureValue } from './session-scanner-opencode-sqlite-worker-protocol'
 import { OpenCodeSqliteWorkerClient } from './session-scanner-opencode-sqlite-worker-client'
+import {
+  buildOpenCodeSqliteCandidatePath,
+  splitOpenCodeSqliteCandidate
+} from './session-scanner-opencode-sqlite-paths'
+import {
+  mapOpenCodeWslSession,
+  openCodeWslClient,
+  openCodeWslPath
+} from './session-scanner-opencode-wsl-client'
 
 // Why: resolve the built worker entry + own the process-wide shared client so
 // the client class stays free of Electron (require'd lazily here) and the
@@ -53,8 +63,9 @@ export function listOpenCodeSqliteSessionsViaWorker(args: {
   dbPaths: readonly string[]
   limit: number
   issues: AiVaultScanIssue[]
+  signal?: AbortSignal
 }): Promise<SessionFileCandidate[]> {
-  return getSharedClient().list(args)
+  return listForHost(args)
 }
 
 /**
@@ -65,8 +76,18 @@ export function listOpenCode2SqliteSessionsViaWorker(args: {
   dbPaths: readonly string[]
   limit: number
   issues: AiVaultScanIssue[]
+  signal?: AbortSignal
 }): Promise<SessionFileCandidate[]> {
-  return getSharedClient().list({ ...args, agent: 'opencode2' })
+  return listForHost({ ...args, agent: 'opencode2' })
+}
+
+export function listZcodeSqliteSessionsViaWorker(args: {
+  dbPaths: readonly string[]
+  limit: number
+  issues: AiVaultScanIssue[]
+  signal?: AbortSignal
+}): Promise<SessionFileCandidate[]> {
+  return listForHost({ ...args, agent: 'zcode' })
 }
 
 /**
@@ -77,19 +98,33 @@ export function listOpenCode2SqliteSessionsViaWorker(args: {
  * @returns The parsed session, or `null` when it does not exist.
  */
 export function parseOpenCodeSqliteSessionViaWorker(args: {
+  fullFirstUserPrompt?: boolean
   dbPath: string
   sessionId: string
   platform: NodeJS.Platform
+  signal?: AbortSignal
 }): Promise<AiVaultSession | null> {
-  return getSharedClient().parse(args)
+  return parseForHost(args)
 }
 
 export function parseOpenCode2SqliteSessionViaWorker(args: {
+  fullFirstUserPrompt?: boolean
   dbPath: string
   sessionId: string
   platform: NodeJS.Platform
+  signal?: AbortSignal
 }): Promise<AiVaultSession | null> {
-  return getSharedClient().parse({ ...args, agent: 'opencode2' })
+  return parseForHost({ ...args, agent: 'opencode2' })
+}
+
+export function parseZcodeSqliteSessionViaWorker(args: {
+  fullFirstUserPrompt?: boolean
+  dbPath: string
+  sessionId: string
+  platform: NodeJS.Platform
+  signal?: AbortSignal
+}): Promise<AiVaultSession | null> {
+  return parseForHost({ ...args, agent: 'zcode' })
 }
 
 /**
@@ -104,14 +139,109 @@ export function captureOpenCodeSqliteSessionViaWorker(args: {
   dbPath: string
   sessionId: string
   platform: NodeJS.Platform
+  signal?: AbortSignal
 }): Promise<OpenCodeSqliteCaptureValue> {
-  return getSharedClient().capture(args)
+  return captureForHost(args)
 }
 
 export function captureOpenCode2SqliteSessionViaWorker(args: {
   dbPath: string
   sessionId: string
   platform: NodeJS.Platform
+  signal?: AbortSignal
 }): Promise<OpenCodeSqliteCaptureValue> {
-  return getSharedClient().capture({ ...args, agent: 'opencode2' })
+  return captureForHost({ ...args, agent: 'opencode2' })
+}
+
+export function captureZcodeSqliteSessionViaWorker(args: {
+  dbPath: string
+  sessionId: string
+  platform: NodeJS.Platform
+  signal?: AbortSignal
+}): Promise<OpenCodeSqliteCaptureValue> {
+  return captureForHost({ ...args, agent: 'zcode' })
+}
+
+async function listForHost(
+  args: Parameters<OpenCodeSqliteWorkerClient['list']>[0]
+): Promise<SessionFileCandidate[]> {
+  throwIfSignalAborted(args.signal)
+  const native: string[] = []
+  const groups = new Map<string, { distro: string; paths: Map<string, string> }>()
+  for (const path of args.dbPaths) {
+    const wsl = openCodeWslPath(path)
+    if (!wsl) {
+      native.push(path)
+      continue
+    }
+    const key = wsl.distro.toLowerCase()
+    const group = groups.get(key) ?? { distro: wsl.distro, paths: new Map<string, string>() }
+    group.paths.set(wsl.linuxPath, path)
+    groups.set(key, group)
+  }
+  const candidates = await Promise.all([
+    native.length ? getSharedClient().list({ ...args, dbPaths: native }) : Promise.resolve([]),
+    ...[...groups.values()].map(async ({ distro, paths }) => {
+      const first = paths.values().next().value!
+      const issues: AiVaultScanIssue[] = []
+      try {
+        const client = await openCodeWslClient(distro, first, args.signal)
+        const result = await client.list({ ...args, dbPaths: [...paths.keys()], issues })
+        return result.flatMap((candidate) => {
+          const parsed = splitOpenCodeSqliteCandidate(candidate.file.path, args.agent)
+          const original = parsed && paths.get(parsed.dbPath)
+          return parsed && original
+            ? [
+                {
+                  ...candidate,
+                  file: {
+                    ...candidate.file,
+                    path: buildOpenCodeSqliteCandidatePath(original, parsed.sessionId)
+                  }
+                }
+              ]
+            : []
+        })
+      } catch (error) {
+        throwIfSignalAborted(args.signal)
+        issues.push({
+          agent: args.agent ?? 'opencode',
+          kind: 'scope',
+          path: first,
+          message: error instanceof Error ? error.message : String(error)
+        })
+        return []
+      } finally {
+        args.issues.push(
+          ...issues.map((issue) => ({ ...issue, path: paths.get(issue.path) ?? issue.path }))
+        )
+      }
+    })
+  ])
+  throwIfSignalAborted(args.signal)
+  return candidates.flat().sort((a, b) => b.file.mtimeMs - a.file.mtimeMs)
+}
+
+async function parseForHost(
+  args: Parameters<OpenCodeSqliteWorkerClient['parse']>[0]
+): Promise<AiVaultSession | null> {
+  const wsl = openCodeWslPath(args.dbPath)
+  if (!wsl) {
+    return getSharedClient().parse(args)
+  }
+  const client = await openCodeWslClient(wsl.distro, args.dbPath, args.signal)
+  const session = await client.parse({ ...args, dbPath: wsl.linuxPath, platform: 'linux' })
+  return mapOpenCodeWslSession(session, args.dbPath)
+}
+
+async function captureForHost(
+  args: Parameters<OpenCodeSqliteWorkerClient['capture']>[0]
+): Promise<OpenCodeSqliteCaptureValue> {
+  const wsl = openCodeWslPath(args.dbPath)
+  if (!wsl) {
+    return getSharedClient().capture(args)
+  }
+  const client = await openCodeWslClient(wsl.distro, args.dbPath, args.signal)
+  const capture = await client.capture({ ...args, dbPath: wsl.linuxPath, platform: 'linux' })
+  return { ...capture, session: mapOpenCodeWslSession(capture.session, args.dbPath) }
 }
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite.ts b/src/main/ai-vault/session-scanner-opencode-sqlite.ts
index 291a4ce0e88..4e3d8bc74b8 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite.ts
@@ -10,11 +10,13 @@ import {
   shouldCaptureFullFirstUserPrompt
 } from './session-scanner-first-user-prompt'
 import { readOpenCodeDatabase } from './session-scanner-opencode-sqlite-open'
+import { readPartDataRow, readSessionRow } from './session-scanner-opencode-sqlite-rows'
 import {
   canCountOpenCodeMessages,
   canReadOpenCodeMessageParts
 } from './session-scanner-opencode-sqlite-schema'
 import { normalizeTitleText } from './session-scanner-values'
+import { zcodeVisibleMessageFilter } from './session-scanner-zcode-visibility'
 import type SyncDatabase from '../sqlite/sync-database'
 import { columnExists, tableExists } from '../opencode-usage/schema-helpers'
 
@@ -34,22 +36,6 @@ const OPENCODE_SQLITE_PREVIEW_MESSAGE_WINDOW = 100
 // Bounds a pathological single message; a real typed prompt is a handful of parts.
 const FIRST_USER_PROMPT_PART_LIMIT = 512
 
-type SessionRow = {
-  id: string
-  title: string | null
-  directory: string | null
-  time_created: number
-  time_updated: number
-  model_json: string | null
-  agent: string | null
-  tokens_input: number
-  tokens_output: number
-  tokens_reasoning: number
-  tokens_cache_read: number
-  cost: number
-  message_count: number
-}
-
 type PreviewRow = {
   role: string | null
   part_data: string
@@ -74,10 +60,11 @@ function sessionNumberColumnSelect(db: SyncDatabase, columnName: string): string
   return columnExists(db, 'session', columnName) ? `s.${columnName}` : '0'
 }
 
-function buildSessionQuery(db: SyncDatabase): string {
+function buildSessionQuery(db: SyncDatabase, agent: 'opencode' | 'zcode'): string {
   const messageCountSubquery = canCountOpenCodeMessages(db)
     ? `(SELECT COUNT(*) FROM message m
         WHERE m.session_id = s.id
+          ${zcodeVisibleMessageFilter(agent)}
           AND json_extract(m.data, '$.role') IN ('user','assistant'))`
     : '0'
   return `SELECT s.id,
@@ -150,7 +137,11 @@ export function extractPartText(partData: string): string | null {
   }
 }
 
-function readFirstUserPromptFromOpenCodeDb(db: SyncDatabase, sessionId: string): string | null {
+function readFirstUserPromptFromOpenCodeDb(
+  db: SyncDatabase,
+  sessionId: string,
+  agent: 'opencode' | 'zcode'
+): string | null {
   if (!canReadOpenCodeMessageParts(db)) {
     return null
   }
@@ -168,6 +159,7 @@ function readFirstUserPromptFromOpenCodeDb(db: SyncDatabase, sessionId: string):
                  FROM message m
                  JOIN part fp ON fp.message_id = m.id
                  WHERE m.session_id = ?
+                   ${zcodeVisibleMessageFilter(agent)}
                    AND json_extract(m.data, '$.role') = 'user'
                    AND json_extract(fp.data, '$.type') = 'text'
                  ORDER BY m.time_created ASC, m.id ASC
@@ -177,7 +169,9 @@ function readFirstUserPromptFromOpenCodeDb(db: SyncDatabase, sessionId: string):
          ORDER BY p.time_created ASC, p.rowid ASC
          LIMIT ${FIRST_USER_PROMPT_PART_LIMIT}`
       )
-      .all(sessionId) as { part_data: string }[]
+      .all(sessionId)
+      .map(readPartDataRow)
+      .filter((row): row is { part_data: string } => row !== null)
 
     const parts: string[] = []
     for (const row of rows) {
@@ -195,7 +189,7 @@ function readFirstUserPromptFromOpenCodeDb(db: SyncDatabase, sessionId: string):
   }
 }
 
-function buildPreviewQuery(db: SyncDatabase): string | null {
+function buildPreviewQuery(db: SyncDatabase, agent: 'opencode' | 'zcode'): string | null {
   if (!canReadOpenCodeMessageParts(db)) {
     return null
   }
@@ -206,6 +200,7 @@ function buildPreviewQuery(db: SyncDatabase): string | null {
                  json_extract(m.data, '$.summary.body') AS summary_body
           FROM (SELECT id, data FROM message
                 WHERE session_id = ?
+                ${zcodeVisibleMessageFilter(agent, 'data')}
                 ORDER BY time_created DESC, id DESC
                 LIMIT ${OPENCODE_SQLITE_PREVIEW_MESSAGE_WINDOW}) m
           JOIN part p ON p.message_id = m.id
@@ -231,6 +226,7 @@ export async function parseOpenCodeSqliteSession(args: {
   dbPath: string
   sessionId: string
   platform: NodeJS.Platform
+  agent?: 'opencode' | 'zcode'
 }): Promise<AiVaultSession | null> {
   return readOpenCodeDatabase({
     dbPath: args.dbPath,
@@ -245,12 +241,14 @@ export function readOpenCodeSqliteSession(args: {
   dbPath: string
   sessionId: string
   platform: NodeJS.Platform
+  agent?: 'opencode' | 'zcode'
 }): AiVaultSession | null {
   const { db, dbPath, sessionId, platform } = args
   if (!canReadOpenCodeSessions(db)) {
     return null
   }
-  const row = db.prepare(buildSessionQuery(db)).get(sessionId) as SessionRow | undefined
+  const agent = args.agent ?? 'opencode'
+  const row = readSessionRow(db.prepare(buildSessionQuery(db, agent)).get(sessionId))
   if (!row || row.id !== sessionId) {
     return null
   }
@@ -262,7 +260,7 @@ export function readOpenCodeSqliteSession(args: {
   // Why: discovery uses a synthetic db#session path only for parser routing.
   // The UI's log open/reveal actions need a real filesystem path.
   const accumulator = createAccumulator({
-    agent: 'opencode',
+    agent: args.agent ?? 'opencode',
     file: {
       path: dbPath,
       mtimeMs,
@@ -279,7 +277,7 @@ export function readOpenCodeSqliteSession(args: {
   updateTimeline(accumulator, row.time_created)
   updateTimeline(accumulator, row.time_updated)
 
-  const previewSql = buildPreviewQuery(db)
+  const previewSql = buildPreviewQuery(db, agent)
   if (previewSql) {
     // Why: SQL already dropped anything older than the newest-N window, so the
     // accumulator never shifts and cannot detect the truncation itself. Ask for
@@ -322,7 +320,7 @@ export function readOpenCodeSqliteSession(args: {
   // Why: list preview only joins the newest messages. On-demand copy needs the
   // session's earliest real user text part, not a later turn still in the window.
   if (shouldCaptureFullFirstUserPrompt()) {
-    accumulator.firstUserPrompt = readFirstUserPromptFromOpenCodeDb(db, sessionId)
+    accumulator.firstUserPrompt = readFirstUserPromptFromOpenCodeDb(db, sessionId, agent)
   }
 
   return finalizeSession(accumulator, platform)
diff --git a/src/main/ai-vault/session-scanner-opencode-wsl-client.test.ts b/src/main/ai-vault/session-scanner-opencode-wsl-client.test.ts
new file mode 100644
index 00000000000..2d0e52bfc81
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-wsl-client.test.ts
@@ -0,0 +1,131 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createAccumulator, finalizeSession } from './session-scanner-accumulator'
+import type { OpenCodeSqliteProcessOptions } from './session-scanner-opencode-sqlite-process-client'
+
+const mocks = vi.hoisted(() => ({
+  running: vi.fn(async (paths: readonly string[]) => [...paths]),
+  create: vi.fn((_options: OpenCodeSqliteProcessOptions) => ({ dispose: vi.fn() }))
+}))
+vi.mock('../wsl-running-path-filter', () => ({
+  filterPathsToRunningWslDistrosAsync: mocks.running
+}))
+vi.mock('./session-scanner-opencode-sqlite-process-client', () => ({
+  createOpenCodeSqliteProcessClient: mocks.create
+}))
+vi.mock('../wsl/wsl-executable-path', () => ({
+  resolveWslExecutablePath: () => 'C:\\Windows\\System32\\wsl.exe'
+}))
+vi.mock('../wsl-interop-spawn-directory', () => ({
+  resolveWslInteropSpawnCwd: () => 'C:\\Windows'
+}))
+import {
+  configureOpenCodeWslReaders,
+  mapOpenCodeWslSession,
+  openCodeWslClient
+} from './session-scanner-opencode-wsl-client'
+
+const path = String.raw`\\wsl$\Ubuntu\home\ada\opencode.db`
+const runtime = {
+  distro: 'Ubuntu',
+  executable: '/usr/bin/node',
+  readerPath: '/mnt/c/reader $literal.cjs'
+}
+
+beforeEach(() => {
+  configureOpenCodeWslReaders([])
+  vi.clearAllMocks()
+  mocks.running.mockImplementation(async (paths) => [...paths])
+})
+afterEach(() => {
+  configureOpenCodeWslReaders([])
+  vi.restoreAllMocks()
+  vi.unstubAllEnvs()
+})
+
+describe('WSL SQLite reader clients', () => {
+  it('reuses one client per distro and uses literal --exec argv with a safe host cwd and env', async () => {
+    vi.stubEnv('NODE_OPTIONS', '--require=host-loader')
+    vi.stubEnv('WSLENV', 'NODE_OPTIONS/u')
+    configureOpenCodeWslReaders([runtime])
+    const first = await openCodeWslClient('Ubuntu', path)
+    configureOpenCodeWslReaders([
+      { readerPath: runtime.readerPath, executable: runtime.executable, distro: 'ubuntu' }
+    ])
+    expect(await openCodeWslClient('ubuntu', path)).toBe(first)
+    expect(mocks.create).toHaveBeenCalledOnce()
+    expect(mocks.running).not.toHaveBeenCalled()
+    expect(mocks.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        args: ['-d', 'Ubuntu', '--exec', '/usr/bin/node', '/mnt/c/reader $literal.cjs'],
+        cwd: 'C:\\Windows'
+      })
+    )
+    const options = mocks.create.mock.calls[0]?.[0]
+    expect(options).toEqual(
+      expect.objectContaining({
+        env: expect.not.objectContaining({
+          NODE_OPTIONS: expect.anything(),
+          WSLENV: expect.anything()
+        })
+      })
+    )
+  })
+
+  it('checks confirmed running state at process creation and retires changed configurations', async () => {
+    configureOpenCodeWslReaders([runtime])
+    await openCodeWslClient('Ubuntu', path)
+    const first = mocks.create.mock.results[0]?.value
+    const admit = mocks.create.mock.calls[0]?.[0].beforeSpawn
+    expect(admit).toBeDefined()
+    await admit?.(new AbortController().signal)
+    expect(mocks.running).toHaveBeenCalledWith([path], { requireConfirmed: true })
+    mocks.running.mockResolvedValueOnce([])
+    await expect(admit?.(new AbortController().signal)).rejects.toThrow('not running')
+    configureOpenCodeWslReaders([{ ...runtime, executable: '/new/node' }])
+    expect(first?.dispose).toHaveBeenCalledOnce()
+    await openCodeWslClient('Ubuntu', path)
+    const second = mocks.create.mock.results[1]?.value
+    configureOpenCodeWslReaders([])
+    expect(second?.dispose).toHaveBeenCalledOnce()
+  })
+
+  it('cancels a running-distro probe before creating a child', async () => {
+    configureOpenCodeWslReaders([runtime])
+    await openCodeWslClient('Ubuntu', path)
+    mocks.running.mockReturnValue(new Promise(() => {}))
+    const controller = new AbortController()
+    const pending = mocks.create.mock.calls[0]?.[0].beforeSpawn?.(controller.signal)
+    controller.abort(new Error('cancelled probe'))
+    await expect(pending).rejects.toThrow('cancelled probe')
+    expect(mocks.create).toHaveBeenCalledOnce()
+  })
+
+  it('keeps unavailable readers unavailable until repaired configuration arrives', async () => {
+    configureOpenCodeWslReaders([{ distro: 'Ubuntu', error: 'Preparing' }])
+    await expect(openCodeWslClient('Ubuntu', path)).rejects.toThrow('Preparing')
+    expect(mocks.create).not.toHaveBeenCalled()
+    configureOpenCodeWslReaders([runtime])
+    await openCodeWslClient('Ubuntu', path)
+    expect(mocks.create).toHaveBeenCalledOnce()
+  })
+
+  it('restores the original database identity and distro cwd while retaining a Linux resume command', () => {
+    const accumulator = createAccumulator({
+      agent: 'opencode',
+      sessionId: 'session',
+      file: { path: '/home/ada/opencode.db', mtimeMs: 1, modifiedAt: new Date(1).toISOString() }
+    })
+    accumulator.cwd = '/home/ada/project $literal'
+    accumulator.title = 'A session'
+    const native = finalizeSession(accumulator, 'linux')
+    const mapped = mapOpenCodeWslSession(native, path)
+    expect(mapped).toMatchObject({
+      id: `local:opencode:session:${path}`,
+      filePath: path,
+      cwd: '/home/ada/project $literal',
+      executionHostPlatform: 'linux',
+      resumeCommand: "cd '/home/ada/project $literal' && opencode --session 'session'"
+    })
+    expect(mapOpenCodeWslSession(null, path)).toBeNull()
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-opencode-wsl-client.ts b/src/main/ai-vault/session-scanner-opencode-wsl-client.ts
new file mode 100644
index 00000000000..1c93c2616a6
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-wsl-client.ts
@@ -0,0 +1,93 @@
+import type { AiVaultSession } from '../../shared/ai-vault-types'
+import { waitForPromiseWithSignal, throwIfSignalAborted } from '../../shared/abort-signal-reason'
+import { buildWslExecArgs } from '../../shared/wsl-login-shell-command'
+import { parseWslUncPath } from '../../shared/wsl-paths'
+import { resolveWslExecutablePath } from '../wsl/wsl-executable-path'
+import { resolveWslInteropSpawnCwd } from '../wsl-interop-spawn-directory'
+import { filterPathsToRunningWslDistrosAsync } from '../wsl-running-path-filter'
+import { createOpenCodeSqliteProcessClient } from './session-scanner-opencode-sqlite-process-client'
+import type { OpenCodeSqliteWorkerClient } from './session-scanner-opencode-sqlite-worker-client'
+import type { OpenCodeWslRuntime } from './session-scanner-opencode-wsl-runtime'
+import { buildRelayAiVaultServiceEnv } from './session-scanner-service-env'
+
+const runtimes = new Map<string, OpenCodeWslRuntime>()
+const clients = new Map<string, OpenCodeSqliteWorkerClient>()
+
+export function configureOpenCodeWslReaders(entries: readonly OpenCodeWslRuntime[]): void {
+  const present = new Set(entries.map((entry) => entry.distro.toLowerCase()))
+  for (const key of runtimes.keys()) {
+    if (!present.has(key)) {
+      clients.get(key)?.dispose()
+      clients.delete(key)
+      runtimes.delete(key)
+    }
+  }
+  for (const entry of entries) {
+    const key = entry.distro.toLowerCase()
+    const previous = runtimes.get(key)
+    if (
+      previous?.executable !== entry.executable ||
+      previous?.readerPath !== entry.readerPath ||
+      previous?.error !== entry.error
+    ) {
+      clients.get(key)?.dispose()
+      clients.delete(key)
+      runtimes.set(key, entry)
+    }
+  }
+}
+
+export function openCodeWslPath(path: string): ReturnType<typeof parseWslUncPath> {
+  return process.platform === 'win32' ? parseWslUncPath(path) : null
+}
+
+export async function openCodeWslClient(
+  distro: string,
+  dbPath: string,
+  signal?: AbortSignal
+): Promise<OpenCodeSqliteWorkerClient> {
+  throwIfSignalAborted(signal)
+  const key = distro.toLowerCase()
+  const runtime = runtimes.get(key)
+  if (!runtime || runtime.error !== undefined) {
+    throw new Error(
+      runtime?.error ?? 'The WSL SQLite reader is not prepared. Refresh Vault to retry.'
+    )
+  }
+  let client = clients.get(key)
+  if (!client) {
+    client = createOpenCodeSqliteProcessClient({
+      executable: resolveWslExecutablePath(),
+      args: buildWslExecArgs(distro, [runtime.executable, runtime.readerPath]),
+      cwd: resolveWslInteropSpawnCwd(),
+      env: { ...buildRelayAiVaultServiceEnv(), WSL_UTF8: '1' },
+      async beforeSpawn(spawnSignal) {
+        const running = await waitForPromiseWithSignal(
+          filterPathsToRunningWslDistrosAsync([dbPath], { requireConfirmed: true }),
+          spawnSignal
+        )
+        if (running.length === 0) {
+          throw new Error(`WSL distro ${distro} is not running. Start it to read its history.`)
+        }
+      }
+    })
+    clients.set(key, client)
+  }
+  return client
+}
+
+/** Keep database reads Windows-addressable and the working directory native to its host. */
+export function mapOpenCodeWslSession(
+  session: AiVaultSession | null,
+  dbPath: string
+): AiVaultSession | null {
+  if (!session) {
+    return null
+  }
+  return {
+    ...session,
+    id: `${session.executionHostId}:${session.agent}:${session.sessionId}:${dbPath}`,
+    filePath: dbPath,
+    executionHostPlatform: 'linux'
+  }
+}
diff --git a/src/main/ai-vault/session-scanner-opencode-wsl-routing.test.ts b/src/main/ai-vault/session-scanner-opencode-wsl-routing.test.ts
new file mode 100644
index 00000000000..754211c323c
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-wsl-routing.test.ts
@@ -0,0 +1,174 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
+import { createAccumulator, finalizeSession } from './session-scanner-accumulator'
+import type { SessionFileCandidate } from './session-scanner-types'
+import type * as wslClientModule from './session-scanner-opencode-wsl-client'
+
+const mocks = vi.hoisted(() => ({
+  native: {
+    list: vi.fn(async (): Promise<SessionFileCandidate[]> => []),
+    parse: vi.fn(async () => null),
+    capture: vi.fn(async () => ({ session: null, messages: [] }))
+  },
+  guest: vi.fn()
+}))
+vi.mock('./session-scanner-opencode-sqlite-worker-client', () => ({
+  OpenCodeSqliteWorkerClient: class {
+    list = mocks.native.list
+    parse = mocks.native.parse
+    capture = mocks.native.capture
+  }
+}))
+vi.mock('./session-scanner-opencode-wsl-client', async (importOriginal) => ({
+  ...(await importOriginal<typeof wslClientModule>()),
+  openCodeWslClient: mocks.guest
+}))
+import {
+  captureOpenCode2SqliteSessionViaWorker,
+  captureOpenCodeSqliteSessionViaWorker,
+  listOpenCode2SqliteSessionsViaWorker,
+  listOpenCodeSqliteSessionsViaWorker,
+  parseOpenCode2SqliteSessionViaWorker,
+  parseOpenCodeSqliteSessionViaWorker
+} from './session-scanner-opencode-sqlite-worker-spawn'
+
+const ubuntu = '//wsl.localhost/Ubuntu/home/ada/opencode.db'
+const debian = '//wsl$/Debian/home/ada/opencode.db'
+const native = 'C:/Users/ada/opencode.db'
+const guest = '/home/ada/opencode.db'
+
+function row(path: string) {
+  return {
+    agent: 'opencode' as const,
+    codexHome: null,
+    file: { path: `${path}#same-session`, mtimeMs: 1, modifiedAt: new Date(1).toISOString() }
+  }
+}
+function session() {
+  const accumulator = createAccumulator({
+    agent: 'opencode',
+    sessionId: 'same-session',
+    file: row(guest).file
+  })
+  accumulator.title = 'Session'
+  accumulator.cwd = '/home/ada/repo'
+  return finalizeSession(accumulator, 'linux')
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+})
+afterEach(() => vi.restoreAllMocks())
+
+describe('OpenCode SQLite execution-host routes', () => {
+  it('separates native and distro databases and preserves equal IDs in different distros', async () => {
+    const list = vi.fn(async (args) => [row(args.dbPaths[0])])
+    mocks.guest.mockResolvedValue({ list })
+    mocks.native.list.mockResolvedValueOnce([row(native)])
+    const issues: AiVaultScanIssue[] = []
+    const result = await listOpenCodeSqliteSessionsViaWorker({
+      dbPaths: [native, ubuntu, debian],
+      limit: 2,
+      issues
+    })
+    expect(result.map((entry) => entry.file.path)).toEqual([
+      `${native}#same-session`,
+      `${ubuntu}#same-session`,
+      `${debian}#same-session`
+    ])
+    expect(mocks.native.list).toHaveBeenCalledWith(expect.objectContaining({ dbPaths: [native] }))
+    expect(list).toHaveBeenCalledTimes(2)
+    expect(list.mock.calls.every(([args]) => args.dbPaths[0] === guest)).toBe(true)
+    expect(mocks.guest).toHaveBeenNthCalledWith(1, 'Ubuntu', ubuntu, undefined)
+    expect(mocks.guest).toHaveBeenNthCalledWith(2, 'Debian', debian, undefined)
+    expect(issues).toEqual([])
+  })
+
+  it('maps guest list issues back to the original database and omits unavailable distros', async () => {
+    mocks.guest
+      .mockResolvedValueOnce({
+        list: vi.fn(async (args) => {
+          args.issues.push({ agent: 'opencode2', path: guest, message: 'locked' })
+          return []
+        })
+      })
+      .mockRejectedValueOnce(new Error('Distro stopped'))
+    const issues: AiVaultScanIssue[] = []
+    await listOpenCode2SqliteSessionsViaWorker({ dbPaths: [ubuntu, debian], limit: 2, issues })
+    expect(issues).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ path: ubuntu, message: 'locked' }),
+        expect.objectContaining({ path: debian, kind: 'scope', message: 'Distro stopped' })
+      ])
+    )
+    expect(mocks.native.list).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    ['v1', parseOpenCodeSqliteSessionViaWorker, captureOpenCodeSqliteSessionViaWorker, undefined],
+    [
+      'v2',
+      parseOpenCode2SqliteSessionViaWorker,
+      captureOpenCode2SqliteSessionViaWorker,
+      'opencode2'
+    ]
+  ] as const)(
+    'routes %s parse/capture to Linux and restores the caller identity',
+    async (_label, parse, capture, agent) => {
+      const parsed = session()
+      const messages = [{ role: 'user' as const, text: 'Complete transcript', timestamp: null }]
+      const reader = {
+        parse: vi.fn(async () => parsed),
+        capture: vi.fn(async () => ({ session: parsed, messages }))
+      }
+      mocks.guest.mockResolvedValue(reader)
+      const controller = new AbortController()
+      const args = {
+        dbPath: ubuntu,
+        sessionId: 'same-session',
+        platform: 'win32' as const,
+        signal: controller.signal
+      }
+      expect(await parse({ ...args, fullFirstUserPrompt: true })).toMatchObject({
+        id: `local:opencode:same-session:${ubuntu}`,
+        filePath: ubuntu,
+        cwd: '/home/ada/repo',
+        executionHostPlatform: 'linux'
+      })
+      expect(reader.parse).toHaveBeenCalledWith({
+        ...args,
+        dbPath: guest,
+        platform: 'linux',
+        fullFirstUserPrompt: true,
+        ...(agent ? { agent } : {})
+      })
+      expect(await capture(args)).toMatchObject({ session: { filePath: ubuntu }, messages })
+      expect(reader.capture).toHaveBeenCalledWith({
+        ...args,
+        dbPath: guest,
+        platform: 'linux',
+        ...(agent ? { agent } : {})
+      })
+      expect(mocks.native.parse).not.toHaveBeenCalled()
+      expect(mocks.native.capture).not.toHaveBeenCalled()
+    }
+  )
+
+  it('propagates cancellation instead of returning an empty successful list', async () => {
+    const controller = new AbortController()
+    mocks.guest.mockImplementationOnce(async () => {
+      controller.abort(new Error('cancelled'))
+      throw new Error('cancelled')
+    })
+    await expect(
+      listOpenCodeSqliteSessionsViaWorker({
+        dbPaths: [ubuntu],
+        limit: 1,
+        issues: [],
+        signal: controller.signal
+      })
+    ).rejects.toThrow('cancelled')
+    expect(mocks.native.list).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-opencode-wsl-runtime.ts b/src/main/ai-vault/session-scanner-opencode-wsl-runtime.ts
new file mode 100644
index 00000000000..df03c61ef6d
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-wsl-runtime.ts
@@ -0,0 +1,4 @@
+export type OpenCodeWslRuntime = { distro: string } & (
+  | { executable: string; readerPath: string; error?: never }
+  | { error: string; executable?: never; readerPath?: never }
+)
diff --git a/src/main/ai-vault/session-scanner-parse-cache.ts b/src/main/ai-vault/session-scanner-parse-cache.ts
index a5eb98235e4..a00f4edd2cf 100644
--- a/src/main/ai-vault/session-scanner-parse-cache.ts
+++ b/src/main/ai-vault/session-scanner-parse-cache.ts
@@ -5,6 +5,7 @@ import { createCodexSessionResumeState } from './session-scanner-codex-parser'
 import { createDroidSessionResumeState } from './session-scanner-droid-parser'
 import { createMessageGraphSessionResumeState } from './session-scanner-graph-parsers'
 import { createClaudeSessionResumeState } from './session-scanner-primary-parsers'
+import { createCodebuddySessionResumeState } from './session-scanner-codebuddy-parser'
 import { createGeminiJsonlSessionResumeState } from './session-scanner-gemini-parsers'
 import { createCopilotSessionResumeState } from './session-scanner-copilot-parser'
 import { createCursorSessionResumeState } from './session-scanner-cursor-parser'
@@ -51,6 +52,8 @@ function resumableStateFactoryFor(
   switch (candidate.agent) {
     case 'claude':
       return (messages) => createClaudeSessionResumeState(candidate.file, messages)
+    case 'codebuddy':
+      return (messages) => createCodebuddySessionResumeState(candidate.file, messages)
     case 'codex':
       return (messages) =>
         createCodexSessionResumeState(candidate.file, candidate.codexHome, messages)
@@ -81,6 +84,7 @@ function resumableStateFactoryFor(
     case 'muse':
     case 'opencode':
     case 'opencode2':
+    case 'zcode':
     case 'rovo':
       return null
   }
@@ -114,12 +118,13 @@ export async function parseAgentSessionFileCached(
   candidate: SessionFileCandidate,
   platform: NodeJS.Platform,
   stats?: SessionParseStats,
-  requireRead?: SessionParseReadRequirement
+  requireRead?: SessionParseReadRequirement,
+  signal?: AbortSignal
 ): Promise<AiVaultSession | null> {
   // The whole lookup-read-store sequence runs in the lane: a concurrent parse of
   // the same path shares this entry's resume point and its message channel.
   return inSessionParseFileLane(candidate.file.path, () =>
-    parseCachedInLane(candidate, platform, stats, requireRead)
+    parseCachedInLane(candidate, platform, stats, requireRead, signal)
   )
 }
 
@@ -162,7 +167,8 @@ async function parseCachedInLane(
   candidate: SessionFileCandidate,
   platform: NodeJS.Platform,
   stats?: SessionParseStats,
-  requireRead?: SessionParseReadRequirement
+  requireRead?: SessionParseReadRequirement,
+  signal?: AbortSignal
 ): Promise<AiVaultSession | null> {
   const { file } = candidate
   if (
@@ -216,7 +222,7 @@ async function parseCachedInLane(
     return enriched.session
   }
 
-  const session = await readWholeTranscript({ candidate, platform, stats })
+  const session = await readWholeTranscript({ candidate, platform, stats, signal })
   // Whole-file agents merge the sibling here just like the resumable branch
   // does post-read; the raw fold stays in foldSession so a sibling-only change
   // re-merges without re-reading the transcript.
diff --git a/src/main/ai-vault/session-scanner-scope-discovery.ts b/src/main/ai-vault/session-scanner-scope-discovery.ts
index d9ef112f772..52795830e66 100644
--- a/src/main/ai-vault/session-scanner-scope-discovery.ts
+++ b/src/main/ai-vault/session-scanner-scope-discovery.ts
@@ -20,7 +20,7 @@ const REPRESENTATIVE_CWD_LINE_LIMIT = 200
 const REPRESENTATIVE_FILE_LIMIT = 3
 const TRANSCRIPT_EXTENSIONS = new Set(['.jsonl'])
 
-// Both encodings are lossy; retain Claude’s existing cache and verify each Pi transcript.
+// Bucket encodings are lossy; retain Claude’s cache and verify other transcripts individually.
 const PROJECT_DIR_CWD_CACHE_MAX = 2048
 const projectDirCwdCache = new Map<string, string>()
 
@@ -75,7 +75,7 @@ type InScopeDiscoveryArgs = {
 }
 
 /**
- * Fully include the transcripts of cwd-bucket directories (Claude, Pi) whose cwd
+ * Fully include the transcripts of cwd-bucket directories (Claude, Pi, CodeBuddy) whose cwd
  * falls inside the active workspace/project paths.
  *
  * Why: these agents keep one directory per cwd, e.g. `~/.claude/projects/<cwd-encoded>/`.
@@ -108,7 +108,7 @@ export async function discoverInScopeCwdBucketFiles(
       }
       await collectBucketFiles({
         agent: layout.agent,
-        scopePaths: layout.agent === 'pi' ? args.scopePaths : undefined,
+        scopePaths: layout.agent !== 'claude' ? args.scopePaths : undefined,
         projectDir,
         issues: args.issues,
         collected,
diff --git a/src/main/ai-vault/session-scanner-service-env.test.ts b/src/main/ai-vault/session-scanner-service-env.test.ts
index b04db9e0c92..e658cb63bbb 100644
--- a/src/main/ai-vault/session-scanner-service-env.test.ts
+++ b/src/main/ai-vault/session-scanner-service-env.test.ts
@@ -150,5 +150,17 @@ it('carries OMP root/profile inputs only to the desktop service, retaining empty
     XDG_DATA_HOME: '/home/dev/data'
   }
   expect(buildAiVaultServiceEnv(roots, 'linux')).toEqual({ ...roots, ELECTRON_RUN_AS_NODE: '1' })
-  expect(buildRelayAiVaultServiceEnv(roots, 'linux')).toEqual({})
+  expect(buildRelayAiVaultServiceEnv(roots, 'linux')).toEqual({ XDG_DATA_HOME: '/home/dev/data' })
+})
+
+it('preserves execution-host OpenCode roots in the relay service', () => {
+  expect(
+    buildRelayAiVaultServiceEnv(
+      { XDG_DATA_HOME: '/srv/data', OPENCODE_DB: 'opencode-team.db' },
+      'linux'
+    )
+  ).toEqual({
+    XDG_DATA_HOME: '/srv/data',
+    OPENCODE_DB: 'opencode-team.db'
+  })
 })
diff --git a/src/main/ai-vault/session-scanner-service-env.ts b/src/main/ai-vault/session-scanner-service-env.ts
index 257ba676d8c..063df2dcc63 100644
--- a/src/main/ai-vault/session-scanner-service-env.ts
+++ b/src/main/ai-vault/session-scanner-service-env.ts
@@ -97,10 +97,14 @@ export function buildAiVaultServiceEnv(
   return env
 }
 
-/** Relay: the sidecar takes every root from its init message, not the environment. */
+/** Relay: home comes from init; OpenCode also supports host-side data overrides. */
 export function buildRelayAiVaultServiceEnv(
   baseEnv: NodeJS.ProcessEnv = process.env,
   platform: NodeJS.Platform = process.platform
 ): NodeJS.ProcessEnv {
-  return pickAllowedEnv(RUNTIME_ENV_ALLOWLIST, baseEnv, platform)
+  return pickAllowedEnv(
+    [...RUNTIME_ENV_ALLOWLIST, 'XDG_DATA_HOME', 'OPENCODE_DB'],
+    baseEnv,
+    platform
+  )
 }
diff --git a/src/main/ai-vault/session-scanner-source-discovery.ts b/src/main/ai-vault/session-scanner-source-discovery.ts
index d62fdd4d19d..62b2e0562a8 100644
--- a/src/main/ai-vault/session-scanner-source-discovery.ts
+++ b/src/main/ai-vault/session-scanner-source-discovery.ts
@@ -2,9 +2,11 @@ import { delimiter } from 'node:path'
 import type { AiVaultAgent, AiVaultScanIssue } from '../../shared/ai-vault-types'
 import { discoverFiles } from './session-scanner-discovery'
 import { opencodeDiscoveries } from './session-scanner-opencode-sources'
+import { zcodeDiscoveries } from './session-scanner-zcode-sources'
 import { antigravityDiscoveries } from './session-scanner-antigravity-sources'
 import { AI_VAULT_AGENT_SOURCES, type AiVaultAgentSource } from './session-scanner-agent-sources'
 import { normalizedWslHomeDirs } from './session-scanner-roots'
+import { configureOpenCodeWslReaders } from './session-scanner-opencode-wsl-client'
 import type { AiVaultScanOptions, SessionFileDiscovery } from './session-scanner-types'
 
 export { DEFAULT_CODEX_HOME_DIR } from './session-scanner-agent-sources'
@@ -15,6 +17,9 @@ export async function discoverAiVaultSessionSources(args: {
   issues: AiVaultScanIssue[]
 }): Promise<SessionFileDiscovery[]> {
   const { options, limitPerAgent, issues } = args
+  if (options.wslOpenCodeReaders) {
+    configureOpenCodeWslReaders(options.wslOpenCodeReaders)
+  }
   const wslHomeDirs = normalizedWslHomeDirs(options.wslHomeDirs)
 
   // The Cursor chat-meta scan scope is owned by scanAiVaultSessions: it has to
@@ -24,6 +29,7 @@ export async function discoverAiVaultSessionSources(args: {
     // SQLite DB. discoverOpenCodeSessions runs both the file scanner (legacy)
     // and the SQLite scanner (1.17.x); dedup by sessionId happens inside.
     ...opencodeDiscoveries(options, wslHomeDirs, limitPerAgent, issues),
+    ...zcodeDiscoveries(options, wslHomeDirs, limitPerAgent, issues),
     ...antigravityDiscoveries(options, wslHomeDirs, limitPerAgent, issues),
     ...Object.entries(AI_VAULT_AGENT_SOURCES).flatMap(([agent, source]) =>
       source
diff --git a/src/main/ai-vault/session-scanner-test-fixtures.ts b/src/main/ai-vault/session-scanner-test-fixtures.ts
index 7146d237bf7..0d9b8cef5ab 100644
--- a/src/main/ai-vault/session-scanner-test-fixtures.ts
+++ b/src/main/ai-vault/session-scanner-test-fixtures.ts
@@ -54,6 +54,7 @@ export async function writeOpenCode2SqliteFixture(root: string): Promise<string>
 export function isolatedScanRoots(root: string) {
   return {
     claudeProjectsDir: join(root, 'claude-projects'),
+    codebuddyProjectsDir: join(root, 'codebuddy-projects'),
     codexSessionsDir: join(root, 'codex-sessions'),
     geminiSessionsDir: join(root, 'gemini-sessions'),
     antigravityBrainDir: join(root, 'antigravity-brain'),
@@ -63,6 +64,7 @@ export function isolatedScanRoots(root: string) {
     // Why: prevent the SQLite scanner from picking up the real
     // ~/.local/share/opencode/opencode.db during tests.
     opencodeDbPaths: [] as readonly string[],
+    zcodeDbPath: join(root, 'zcode', 'db.sqlite'),
     grokSessionsDir: join(root, 'grok-sessions'),
     devinTranscriptsDir: join(root, 'devin-transcripts'),
     hermesSessionsDir: join(root, 'hermes-sessions'),
diff --git a/src/main/ai-vault/session-scanner-types.ts b/src/main/ai-vault/session-scanner-types.ts
index ede4173a090..be97a4b3187 100644
--- a/src/main/ai-vault/session-scanner-types.ts
+++ b/src/main/ai-vault/session-scanner-types.ts
@@ -10,15 +10,18 @@ import type {
   TranscriptSessionIdentity
 } from './session-transcript-consumers'
 import type { SessionSidecarObservation } from './session-sidecar-stat'
+import type { OpenCodeWslRuntime } from './session-scanner-opencode-wsl-runtime'
 
 export type AiVaultScanOptions = {
   claudeProjectsDir?: string
+  codebuddyProjectsDir?: string
   codexSessionsDir?: string
   additionalCodexSessionsDirs?: readonly string[]
   // Why: tests inject a sandbox "real ~/.codex" so real-home attribution
   // (codexHome null → unprefixed resume) is testable without the user's home.
   defaultCodexHomeDir?: string
   wslHomeDirs?: readonly string[]
+  wslOpenCodeReaders?: readonly OpenCodeWslRuntime[]
   geminiSessionsDir?: string
   antigravityBrainDir?: string
   copilotSessionsDir?: string
@@ -27,6 +30,8 @@ export type AiVaultScanOptions = {
   // Why: OpenCode 1.17.x stores sessions in SQLite; tests inject a temp DB
   // here so they don't depend on the real ~/.local/share/opencode.
   opencodeDbPaths?: readonly string[]
+  /** Test override for the ZCode CLI's OpenCode-shaped SQLite database. */
+  zcodeDbPath?: string
   grokSessionsDir?: string
   devinTranscriptsDir?: string
   hermesSessionsDir?: string
diff --git a/src/main/ai-vault/session-scanner-unlimited-dedup.test.ts b/src/main/ai-vault/session-scanner-unlimited-dedup.test.ts
index d217c2bf489..8e912021e5f 100644
--- a/src/main/ai-vault/session-scanner-unlimited-dedup.test.ts
+++ b/src/main/ai-vault/session-scanner-unlimited-dedup.test.ts
@@ -1,5 +1,6 @@
 import { beforeEach, expect, it, vi } from 'vitest'
 import type * as SessionDedup from './session-root-dedup'
+import type * as RemoteSessionParseCache from './remote-session-parse-cache'
 import type { AiVaultSession } from '../../shared/ai-vault-types'
 
 const fixture = vi.hoisted((): { sessions: AiVaultSession[]; visits: number } => ({
@@ -31,7 +32,8 @@ vi.mock('./remote-session-scanner-sources', () => ({ remoteSessionSources: () =>
 vi.mock('./remote-session-scanner-discovery', () => ({
   discoverRemoteSourceCandidates: async () => candidates()
 }))
-vi.mock('./remote-session-parse-cache', () => ({
+vi.mock('./remote-session-parse-cache', async (original) => ({
+  ...(await original<typeof RemoteSessionParseCache>()),
   remoteSessionParseHostKey: () => 'fixture',
   parseRemoteSessionFileCached: async ({ candidate }: { candidate: { session: AiVaultSession } }) =>
     candidate.session
diff --git a/src/main/ai-vault/session-scanner-zcode-sources.test.ts b/src/main/ai-vault/session-scanner-zcode-sources.test.ts
new file mode 100644
index 00000000000..4ed6667342f
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-zcode-sources.test.ts
@@ -0,0 +1,41 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
+import { wslGatedAccess } from '../native-chat/wsl-transcript-fs-access'
+import { zcodeDiscoveries } from './session-scanner-zcode-sources'
+
+vi.mock('../native-chat/wsl-transcript-fs-access', () => ({ wslGatedAccess: vi.fn() }))
+
+const access = vi.mocked(wslGatedAccess)
+
+afterEach(() => access.mockReset())
+
+it.each(['EACCES', 'EPERM', 'EIO'])(
+  'reports a ZCode database %s error instead of treating it as absent',
+  async (code) => {
+    access.mockRejectedValueOnce(
+      Object.assign(new Error(`Cannot read database: ${code}`), { code })
+    )
+    const issues: AiVaultScanIssue[] = []
+
+    const [discovery] = await Promise.all(
+      zcodeDiscoveries({ zcodeDbPath: '/example/db.sqlite' }, [], 10, issues)
+    )
+
+    expect(discovery?.files).toEqual([])
+    expect(issues).toEqual([
+      { agent: 'zcode', path: '/example/db.sqlite', message: `Cannot read database: ${code}` }
+    ])
+  }
+)
+
+it('silently skips a ZCode database that does not exist', async () => {
+  access.mockRejectedValueOnce(Object.assign(new Error('No such file'), { code: 'ENOENT' }))
+  const issues: AiVaultScanIssue[] = []
+
+  const [discovery] = await Promise.all(
+    zcodeDiscoveries({ zcodeDbPath: '/example/db.sqlite' }, [], 10, issues)
+  )
+
+  expect(discovery?.files).toEqual([])
+  expect(issues).toEqual([])
+})
diff --git a/src/main/ai-vault/session-scanner-zcode-sources.ts b/src/main/ai-vault/session-scanner-zcode-sources.ts
new file mode 100644
index 00000000000..68b013712e9
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-zcode-sources.ts
@@ -0,0 +1,55 @@
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
+import { throwIfSignalAborted } from '../../shared/abort-signal-reason'
+import { wslGatedAccess } from '../native-chat/wsl-transcript-fs-access'
+import { listZcodeSqliteSessionsViaWorker } from './session-scanner-opencode-sqlite-worker-spawn'
+import type { AiVaultScanOptions, SessionFileDiscovery } from './session-scanner-types'
+
+// ZCode's CLI stores its OpenCode-shaped history in a separate database.
+// Keep discovery separate so an OpenCode install cannot absorb ZCode rows.
+export function zcodeDiscoveries(
+  options: AiVaultScanOptions,
+  wslHomeDirs: readonly string[],
+  limit: number,
+  issues: AiVaultScanIssue[]
+): Promise<SessionFileDiscovery>[] {
+  const paths = options.zcodeDbPath
+    ? [options.zcodeDbPath]
+    : [homedir(), ...wslHomeDirs].map((home) => join(home, '.zcode', 'cli', 'db', 'db.sqlite'))
+  return paths.map(async (dbPath) => ({
+    agent: 'zcode' as const,
+    rootDir: dbPath,
+    files: (await zcodeDatabaseExists(dbPath, issues, options.signal))
+      ? (
+          await listZcodeSqliteSessionsViaWorker({
+            dbPaths: [dbPath],
+            limit,
+            issues,
+            signal: options.signal
+          })
+        ).map((candidate) => candidate.file)
+      : []
+  }))
+}
+
+async function zcodeDatabaseExists(
+  dbPath: string,
+  issues: AiVaultScanIssue[],
+  signal?: AbortSignal
+): Promise<boolean> {
+  try {
+    return await wslGatedAccess(dbPath, 'scan', signal)
+  } catch (error) {
+    throwIfSignalAborted(signal)
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+      return false
+    }
+    issues.push({
+      agent: 'zcode',
+      path: dbPath,
+      message: error instanceof Error ? error.message : String(error)
+    })
+    return false
+  }
+}
diff --git a/src/main/ai-vault/session-scanner-zcode-visibility.ts b/src/main/ai-vault/session-scanner-zcode-visibility.ts
new file mode 100644
index 00000000000..06c0446b0e0
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-zcode-visibility.ts
@@ -0,0 +1,9 @@
+/** Keep ZCode's hidden transcript messages out of every AI Vault read path. */
+export function zcodeVisibleMessageFilter(
+  agent: 'opencode' | 'zcode',
+  column: 'm.data' | 'data' = 'm.data'
+): string {
+  return agent === 'zcode'
+    ? `AND COALESCE(json_extract(${column}, '$.semantics.transcriptVisibility'), 'visible') != 'hidden'`
+    : ''
+}
diff --git a/src/main/ai-vault/session-scanner-zcode.test.ts b/src/main/ai-vault/session-scanner-zcode.test.ts
new file mode 100644
index 00000000000..4783b213450
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-zcode.test.ts
@@ -0,0 +1,188 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { handleOpenCodeSqliteRequest } from './session-scanner-opencode-sqlite-dispatch'
+import { splitOpenCodeSqliteCandidate } from './session-scanner-opencode-sqlite-paths'
+import { writeOpenCodeSqliteDatabase } from './session-scanner-opencode-sqlite-fixture'
+import SyncDatabase from '../sqlite/sync-database'
+
+// Why readers and not casts: the worker dispatch returns `value: unknown` on purpose — it
+// crosses a process boundary. Narrowing here keeps the repo's no-assertions rule and fails
+// the test with a readable message if the payload shape ever changes.
+function readCandidates(value: unknown): { agent: string; path: string }[] {
+  if (typeof value !== 'object' || value === null || !('candidates' in value)) {
+    throw new Error('expected a listing payload with candidates')
+  }
+  const { candidates } = value
+  if (!Array.isArray(candidates)) {
+    throw new Error('expected candidates to be an array')
+  }
+  return candidates.map((candidate) => {
+    const agent = readStringField(candidate, 'agent')
+    const file = isRecord(candidate) ? candidate['file'] : null
+    return { agent, path: readStringField(file, 'path') }
+  })
+}
+
+function readMessageTexts(value: unknown): { text: string }[] {
+  if (typeof value !== 'object' || value === null || !('messages' in value)) {
+    throw new Error('expected a capture payload with messages')
+  }
+  const { messages } = value
+  if (!Array.isArray(messages)) {
+    throw new Error('expected messages to be an array')
+  }
+  return messages.map((message) => ({ text: readStringField(message, 'text') }))
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null
+}
+
+function readStringField(value: unknown, field: string): string {
+  const read = isRecord(value) ? value[field] : null
+  if (typeof read !== 'string') {
+    throw new Error(`expected a string \`${field}\``)
+  }
+  return read
+}
+
+const directories: string[] = []
+afterEach(() => {
+  for (const directory of directories) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  directories.length = 0
+})
+
+describe('ZCode AI Vault SQLite worker', () => {
+  it('lists, parses, and captures ZCode sessions without labelling them OpenCode', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-zcode-ai-vault-'))
+    directories.push(directory)
+    const dbPath = join(directory, 'db.sqlite')
+    writeOpenCodeSqliteDatabase(dbPath, [
+      {
+        id: 'zcode-session',
+        directory: '/repo',
+        title: 'ZCode task',
+        turns: [
+          { role: 'user', parts: ['Fix the import'] },
+          { role: 'assistant', parts: ['Import fixed'] }
+        ]
+      }
+    ])
+
+    const listed = await handleOpenCodeSqliteRequest({
+      id: 1,
+      kind: 'list',
+      agent: 'zcode',
+      dbPaths: [dbPath],
+      limit: 10
+    })
+    expect(listed.ok).toBe(true)
+    if (!listed.ok) {
+      return
+    }
+    const candidates = readCandidates(listed.value)
+    expect(candidates).toHaveLength(1)
+    expect(candidates[0]?.agent).toBe('zcode')
+    expect(splitOpenCodeSqliteCandidate(candidates[0]!.path, 'zcode')).toEqual({
+      dbPath,
+      sessionId: 'zcode-session'
+    })
+    expect(splitOpenCodeSqliteCandidate(candidates[0]!.path)).toBeNull()
+
+    const parsed = await handleOpenCodeSqliteRequest({
+      id: 2,
+      kind: 'parse',
+      agent: 'zcode',
+      dbPath,
+      sessionId: 'zcode-session',
+      platform: 'darwin'
+    })
+    expect(parsed).toMatchObject({
+      ok: true,
+      value: {
+        agent: 'zcode',
+        title: 'ZCode task',
+        resumeCommand: "cd '/repo' && zcode --resume 'zcode-session'"
+      }
+    })
+
+    const captured = await handleOpenCodeSqliteRequest({
+      id: 3,
+      kind: 'capture',
+      agent: 'zcode',
+      dbPath,
+      sessionId: 'zcode-session',
+      platform: 'darwin'
+    })
+    expect(captured).toMatchObject({ ok: true, value: { session: { agent: 'zcode' } } })
+    if (!captured.ok) {
+      return
+    }
+    expect(readMessageTexts(captured.value)).toEqual(
+      expect.arrayContaining([expect.objectContaining({ text: 'Fix the import' })])
+    )
+  })
+
+  it('excludes ZCode hidden transcript messages from preview and search', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-zcode-ai-vault-'))
+    directories.push(directory)
+    const dbPath = join(directory, 'db.sqlite')
+    writeOpenCodeSqliteDatabase(dbPath, [
+      {
+        id: 'visible-session',
+        turns: [
+          { role: 'user', parts: ['internal reminder'] },
+          { role: 'user', parts: ['visible request'] },
+          { role: 'assistant', parts: ['visible response'] }
+        ]
+      }
+    ])
+    const db = new SyncDatabase(dbPath)
+    try {
+      db.prepare(
+        "UPDATE message SET data = json_set(data, '$.semantics.transcriptVisibility', 'hidden') WHERE id LIKE '%-msg-0-%'"
+      ).run()
+    } finally {
+      db.close()
+    }
+
+    const parsed = await handleOpenCodeSqliteRequest({
+      id: 4,
+      kind: 'parse',
+      agent: 'zcode',
+      dbPath,
+      sessionId: 'visible-session',
+      platform: 'darwin',
+      fullFirstUserPrompt: true
+    })
+    expect(parsed).toMatchObject({
+      ok: true,
+      value: {
+        messageCount: 2,
+        firstUserPrompt: 'visible request'
+      }
+    })
+    if (!parsed.ok) {
+      return
+    }
+    expect(JSON.stringify(parsed.value)).not.toContain('internal reminder')
+
+    const captured = await handleOpenCodeSqliteRequest({
+      id: 5,
+      kind: 'capture',
+      agent: 'zcode',
+      dbPath,
+      sessionId: 'visible-session',
+      platform: 'darwin'
+    })
+    expect(captured.ok).toBe(true)
+    if (!captured.ok) {
+      return
+    }
+    expect(JSON.stringify(captured.value)).not.toContain('internal reminder')
+  })
+})
diff --git a/src/main/ai-vault/session-scanner.test.ts b/src/main/ai-vault/session-scanner.test.ts
index b8963ce80b8..5bbe8d09751 100644
--- a/src/main/ai-vault/session-scanner.test.ts
+++ b/src/main/ai-vault/session-scanner.test.ts
@@ -23,9 +23,15 @@ vi.mock('./session-scanner-opencode-sqlite-worker-spawn', async () => {
     listOpenCodeSqliteSessionsViaWorker: (
       args: Parameters<typeof v1List.listOpenCodeSqliteSessions>[0]
     ) => v1List.listOpenCodeSqliteSessions(args),
+    listZcodeSqliteSessionsViaWorker: (
+      args: Parameters<typeof v1List.listOpenCodeSqliteSessions>[0]
+    ) => v1List.listOpenCodeSqliteSessions({ ...args, agent: 'zcode' }),
     parseOpenCodeSqliteSessionViaWorker: (
       args: Parameters<typeof v1Parse.parseOpenCodeSqliteSession>[0]
     ) => v1Parse.parseOpenCodeSqliteSession(args),
+    parseZcodeSqliteSessionViaWorker: (
+      args: Parameters<typeof v1Parse.parseOpenCodeSqliteSession>[0]
+    ) => v1Parse.parseOpenCodeSqliteSession({ ...args, agent: 'zcode' }),
     listOpenCode2SqliteSessionsViaWorker: (
       args: Parameters<typeof v2List.listOpenCode2SqliteSessions>[0]
     ) => v2List.listOpenCode2SqliteSessions(args),
@@ -400,7 +406,7 @@ describe('scanAiVaultSessions', () => {
       await writeEveryAgentVault(root)
     await writeMuseScannerFixture(roots.museSessionsDir)
 
-    const result = await scanAiVaultSessions({ ...roots, platform: 'darwin', limit: 20 })
+    const result = await scanAiVaultSessions({ ...roots, platform: 'darwin', limit: 25 })
 
     expect(result.issues).toEqual([])
     expect(new Set(result.sessions.map((session) => session.agent))).toEqual(
@@ -428,6 +434,7 @@ describe('scanAiVaultSessions', () => {
     expect(commandByAgent.get('opencode2')).toBe(
       "cd '/tmp/opencode2' && opencode2 --standalone --session 'opencode2-session'"
     )
+    expect(commandByAgent.get('zcode')).toBe("cd '/tmp/zcode' && zcode --resume 'zcode-session'")
     expect(commandByAgent.get('grok')).toBe("cd '/tmp/grok' && grok --resume 'grok-session'")
     expect(commandByAgent.get('hermes')).toBe(
       "cd '/tmp/hermes' && hermes --resume 'hermes-session'"
diff --git a/src/main/ai-vault/session-scanner.ts b/src/main/ai-vault/session-scanner.ts
index c730eac6385..f56f17af796 100644
--- a/src/main/ai-vault/session-scanner.ts
+++ b/src/main/ai-vault/session-scanner.ts
@@ -27,7 +27,11 @@ import { getSessionParseCacheEntry } from './session-parse-cache-store'
 import { describeSkippedTranscriptRecords } from './session-transcript-record-budget'
 import { canStopParsingSessions } from './session-scan-cutoff'
 import { discoverInScopeCwdBucketFiles } from './session-scanner-scope-discovery'
-import { CLAUDE_CWD_BUCKET_LAYOUT, PI_CWD_BUCKET_LAYOUT } from './session-cwd-bucket-layouts'
+import {
+  CLAUDE_CWD_BUCKET_LAYOUT,
+  PI_CWD_BUCKET_LAYOUT,
+  CODEBUDDY_CWD_BUCKET_LAYOUT
+} from './session-cwd-bucket-layouts'
 import { discoverAiVaultSessionSources } from './session-scanner-source-discovery'
 import { cursorChatMetaRefusals, withCursorChatMetaScan } from './session-scanner-cursor-chat-meta'
 import type {
@@ -166,7 +170,11 @@ function mergeSessions(
 
 // Agents whose on-disk layout names a directory per cwd, so a scope's older
 // sessions can be found without reading every transcript's header.
-const CWD_BUCKET_LAYOUTS = [CLAUDE_CWD_BUCKET_LAYOUT, PI_CWD_BUCKET_LAYOUT]
+const CWD_BUCKET_LAYOUTS = [
+  CLAUDE_CWD_BUCKET_LAYOUT,
+  PI_CWD_BUCKET_LAYOUT,
+  CODEBUDDY_CWD_BUCKET_LAYOUT
+]
 
 async function scanInScopeSessions(args: {
   discoveries: SessionFileDiscovery[]
@@ -240,7 +248,8 @@ async function parseSessionCandidates(args: {
           args.platform,
           args.executionHostId,
           args.parseStats,
-          args.antigravityWorkspaceResolver
+          args.antigravityWorkspaceResolver,
+          args.signal
         )
       )
     )
@@ -268,10 +277,17 @@ async function parseSessionCandidate(
   platform: NodeJS.Platform,
   executionHostId: ExecutionHostId,
   parseStats: SessionParseStats,
-  antigravityWorkspaceResolver?: AntigravityWorkspaceResolver
+  antigravityWorkspaceResolver?: AntigravityWorkspaceResolver,
+  signal?: AbortSignal
 ): Promise<SessionParseResult> {
   try {
-    let session = await parseAgentSessionFileCached(candidate, platform, parseStats)
+    let session = await parseAgentSessionFileCached(
+      candidate,
+      platform,
+      parseStats,
+      undefined,
+      signal
+    )
     if (session && candidate.antigravityHistoryPath && antigravityWorkspaceResolver) {
       session = await antigravityWorkspaceResolver.enrich(session, candidate.antigravityHistoryPath)
     }
diff --git a/src/main/ai-vault/session-transcript-every-agent-capture.test.ts b/src/main/ai-vault/session-transcript-every-agent-capture.test.ts
index 0d135cdb7e8..20b28fdb49b 100644
--- a/src/main/ai-vault/session-transcript-every-agent-capture.test.ts
+++ b/src/main/ai-vault/session-transcript-every-agent-capture.test.ts
@@ -20,18 +20,27 @@ vi.mock('./session-scanner-opencode-sqlite-worker-spawn', async () => {
     listOpenCode2SqliteSessionsViaWorker: (
       args: Parameters<typeof list2.listOpenCode2SqliteSessions>[0]
     ) => list2.listOpenCode2SqliteSessions(args),
+    listZcodeSqliteSessionsViaWorker: (
+      args: Parameters<typeof list.listOpenCodeSqliteSessions>[0]
+    ) => list.listOpenCodeSqliteSessions({ ...args, agent: 'zcode' }),
     parseOpenCodeSqliteSessionViaWorker: (
       args: Parameters<typeof parse.parseOpenCodeSqliteSession>[0]
     ) => parse.parseOpenCodeSqliteSession(args),
     parseOpenCode2SqliteSessionViaWorker: (
       args: Parameters<typeof parse2.parseOpenCode2SqliteSession>[0]
     ) => parse2.parseOpenCode2SqliteSession(args),
+    parseZcodeSqliteSessionViaWorker: (
+      args: Parameters<typeof parse.parseOpenCodeSqliteSession>[0]
+    ) => parse.parseOpenCodeSqliteSession({ ...args, agent: 'zcode' }),
     captureOpenCodeSqliteSessionViaWorker: (
       args: Parameters<typeof capture.captureOpenCodeSqliteSession>[0]
     ) => capture.captureOpenCodeSqliteSession(args),
     captureOpenCode2SqliteSessionViaWorker: (
       args: Parameters<typeof capture2.captureOpenCode2SqliteSession>[0]
-    ) => capture2.captureOpenCode2SqliteSession(args)
+    ) => capture2.captureOpenCode2SqliteSession(args),
+    captureZcodeSqliteSessionViaWorker: (
+      args: Parameters<typeof capture.captureOpenCodeSqliteSession>[0]
+    ) => capture.captureOpenCodeSqliteSession({ ...args, agent: 'zcode' })
   }
 })
 import { AI_VAULT_AGENTS, type AiVaultAgent } from '../../shared/ai-vault-types'
diff --git a/src/main/ai-vault/session-transcript-reader.ts b/src/main/ai-vault/session-transcript-reader.ts
index 8a5cd4e93e7..f9eb4e91b11 100644
--- a/src/main/ai-vault/session-transcript-reader.ts
+++ b/src/main/ai-vault/session-transcript-reader.ts
@@ -160,6 +160,7 @@ export async function readWholeTranscript(args: {
   candidate: SessionFileCandidate
   platform: NodeJS.Platform
   stats?: TranscriptReadStats
+  signal?: AbortSignal
 }): Promise<AiVaultSession | null> {
   const { file } = args.candidate
   if (args.stats) {
@@ -169,7 +170,7 @@ export async function readWholeTranscript(args: {
   const channel = new TranscriptMessageChannel()
   channel.beginRead({ candidate: args.candidate, mode: 'replace', previousByteOffset: 0 })
   try {
-    const session = await parseAgentSessionFile(args.candidate, args.platform, channel)
+    const session = await parseAgentSessionFile(args.candidate, args.platform, channel, args.signal)
     channel.finishRead({ session, byteOffset: file.sizeBytes ?? 0, incomplete: false })
     return session
   } catch (error) {
diff --git a/src/main/artifacts/artifact-share-record-allocation.test.ts b/src/main/artifacts/artifact-share-record-allocation.test.ts
new file mode 100644
index 00000000000..489e0870dd4
--- /dev/null
+++ b/src/main/artifacts/artifact-share-record-allocation.test.ts
@@ -0,0 +1,62 @@
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, expect, it, vi } from 'vitest'
+import { getArtifactShareRecord } from './artifact-share-record-store'
+
+const createdPaths: string[] = []
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  await Promise.all(
+    createdPaths.splice(0).map((path) => rm(path, { recursive: true, force: true }))
+  )
+})
+
+it('constructs one record map when all ten thousand stored shares remain valid', async () => {
+  const userDataPath = await mkdtemp(join(tmpdir(), 'orca-artifact-record-allocation-'))
+  createdPaths.push(userDataPath)
+  const profileId = 'allocation-profile'
+  const profileDirectory = join(userDataPath, 'profiles', profileId)
+  await mkdir(profileDirectory, { recursive: true })
+  const recordsPath = join(profileDirectory, 'artifact-shares.json')
+  const scope = {
+    cloudUserId: 'user-a',
+    cloudProfileId: 'cloud-a',
+    cloudOrganizationId: 'org-a',
+    apiOrigin: 'https://share.onorca.dev'
+  }
+  const sourceKey = 'allocation-source-0'
+  const shares = Object.fromEntries(
+    Array.from({ length: 10_000 }, (_, index) => [
+      `allocation-source-${index}`,
+      {
+        ...scope,
+        slug: `artifact-${index}`,
+        editToken: 'synthetic-edit-token',
+        shareUrl: `https://share.onorca.dev/a/artifact-${index}`,
+        expiresAt: '2099-01-01T00:00:00.000Z',
+        savedAt: index
+      }
+    ])
+  )
+  const serialized = JSON.stringify({ version: 2, lifecycleGeneration: 7, shares })
+  await writeFile(recordsPath, serialized)
+  const fromEntries = Object.fromEntries
+  let recordMaps = 0
+  vi.spyOn(Object, 'fromEntries').mockImplementation((entries) => {
+    const result = fromEntries(entries)
+    if (Object.hasOwn(result, sourceKey)) {
+      recordMaps += 1
+    }
+    return result
+  })
+
+  expect(getArtifactShareRecord(profileId, userDataPath, sourceKey, scope)).toMatchObject({
+    slug: 'artifact-0',
+    editToken: 'synthetic-edit-token'
+  })
+
+  expect(recordMaps).toBe(1)
+  expect(await readFile(recordsPath, 'utf8')).toBe(serialized)
+})
diff --git a/src/main/artifacts/artifact-share-record-store.ts b/src/main/artifacts/artifact-share-record-store.ts
index a16ec19333c..ac448fbc564 100644
--- a/src/main/artifacts/artifact-share-record-store.ts
+++ b/src/main/artifacts/artifact-share-record-store.ts
@@ -94,7 +94,7 @@ function pruneRecords(
       ? unexpired.sort(compareRecordsNewestFirst).slice(0, MAX_ARTIFACT_SHARE_RECORDS)
       : unexpired
   return {
-    shares: Object.fromEntries(retained),
+    shares: retained.length === currentEntries.length ? shares : Object.fromEntries(retained),
     changed: retained.length !== currentEntries.length
   }
 }
diff --git a/src/main/automations/automation-dispatch-host-fence.test.ts b/src/main/automations/automation-dispatch-host-fence.test.ts
index a974ebb4ae0..1f28f5accd7 100644
--- a/src/main/automations/automation-dispatch-host-fence.test.ts
+++ b/src/main/automations/automation-dispatch-host-fence.test.ts
@@ -10,17 +10,19 @@
  */
 
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdtempSync, rmSync } from 'node:fs'
+import { mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { Repo } from '../../shared/repo-types'
 import type { SshTarget } from '../../shared/ssh-types'
 import type { Automation } from '../../shared/automations-types'
 import { AUTOMATION_ORPHAN_ISSUES } from '../../shared/automation-list-scope'
+import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
 import type { Store } from '../persistence'
 import { resolveAutomationRunTarget } from './run-target-resolution'
 import { AutomationService } from './service'
 import { installFakeAppEnvironment } from '../../../config/scripts/vitest-host-ports-setup'
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 
 const testState = { dir: '' }
 
@@ -40,7 +42,7 @@ async function createStore(): Promise<Store> {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store: StoreClass, initDataPath } = await import('../persistence')
   initDataPath()
-  return new StoreClass()
+  return createSqliteTestStore(StoreClass, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 /** The reachable shape: a runtime-owned id is derived, not minted per lifecycle. */
@@ -183,9 +185,10 @@ describe('scheduled dispatch fenced on the host the record captured', () => {
     vi.useFakeTimers()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
-    rmSync(testState.dir, { recursive: true, force: true })
+    removeTreeSync(testState.dir)
   })
 
   it('refuses the run once the same id carries a new registration', async () => {
diff --git a/src/main/automations/automation-dispatch-request.ts b/src/main/automations/automation-dispatch-request.ts
new file mode 100644
index 00000000000..348a1b9ecee
--- /dev/null
+++ b/src/main/automations/automation-dispatch-request.ts
@@ -0,0 +1,154 @@
+import type { WebContents } from 'electron'
+import { isDeepStrictEqual } from 'node:util'
+import type { Automation, AutomationRun } from '../../shared/automations-types'
+import { getRepoExecutionHostId } from '../../shared/execution-host'
+import type { Store } from '../persistence'
+import type { AutomationRunWriter } from './automation-run-writer'
+import type { HeadlessAutomationDispatcher } from './headless-dispatch'
+import type { HeadlessAutomationDispatchContext } from './headless-dispatch-runner'
+import { runHeadlessAutomationDispatch } from './headless-dispatch-runner'
+import type { AutomationRunTargetResult } from './run-target-resolution'
+import { createAutomationDispatchToken } from './dispatch-tokens'
+import { NO_DISPATCH_HOST, sendRendererDispatch } from './dispatch-refusal'
+
+export type AutomationRendererChannel = Pick<WebContents, 'isDestroyed' | 'send'>
+
+export class AutomationDispatchCancelledError extends Error {}
+
+type DispatchContext = Pick<
+  HeadlessAutomationDispatchContext,
+  'runPrecheck' | 'markDispatchResult' | 'watchRun'
+> & {
+  store: Store
+  runs: AutomationRunWriter
+  isActive(): boolean
+  getRenderer(): AutomationRendererChannel | null
+  headlessDispatcher: HeadlessAutomationDispatcher | null
+  resolveTarget(automation: Automation): AutomationRunTargetResult
+}
+
+function definition(automation: Automation) {
+  const { lastRunAt: _last, updatedAt: _updated, nextRunAt: _next, ...configured } = automation
+  return configured
+}
+
+function destination(target: Extract<AutomationRunTargetResult, { ok: true }>) {
+  return {
+    cwd: target.cwd,
+    repoId: target.repo.id,
+    repoPath: target.repo.path,
+    host: getRepoExecutionHostId(target.repo),
+    setupId: target.setup?.id
+  }
+}
+
+/** Claim durably, then recheck everything that an acknowledgement wait can invalidate. */
+export async function requestAutomationDispatch(
+  ctx: DispatchContext,
+  automation: Automation,
+  run: AutomationRun,
+  expectedTarget: AutomationRunTargetResult
+): Promise<AutomationRun> {
+  const expectedDefinition = structuredClone(definition(automation))
+  const expectedDestination = expectedTarget.ok ? destination(expectedTarget) : undefined
+  const readRun = (): AutomationRun => {
+    if (!ctx.isActive()) {
+      throw new AutomationDispatchCancelledError(
+        'Orca stopped before this automation could launch.'
+      )
+    }
+    const current = ctx.store.listAutomationRuns(automation.id).find((entry) => entry.id === run.id)
+    if (!current || !ctx.store.listAutomations().some((entry) => entry.id === automation.id)) {
+      throw new AutomationDispatchCancelledError(
+        'The automation was removed before it could launch.'
+      )
+    }
+    return current
+  }
+  const resolveCurrentTarget = (): AutomationRunTargetResult => {
+    const current = ctx.store.listAutomations().find((entry) => entry.id === automation.id)
+    if (!current || !isDeepStrictEqual(expectedDefinition, definition(current))) {
+      return { ok: false, error: 'The automation changed before this run could launch.' }
+    }
+    const target = ctx.resolveTarget(current)
+    if (
+      target.ok &&
+      expectedDestination &&
+      !isDeepStrictEqual(expectedDestination, destination(target))
+    ) {
+      return {
+        ok: false,
+        error: 'The automation destination changed before this run could launch.'
+      }
+    }
+    return target
+  }
+  const refuse = (error: string) =>
+    ctx.runs.updateRun({
+      runId: run.id,
+      status: 'skipped_unavailable',
+      workspaceId: automation.workspaceId,
+      error
+    })
+  const returnDurable = async (current: AutomationRun) => {
+    await ctx.store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    return current
+  }
+
+  run = readRun()
+  if (run.status !== 'pending') {
+    return returnDurable(run)
+  }
+  let target = resolveCurrentTarget()
+  if (!target.ok || (!ctx.getRenderer() && !ctx.headlessDispatcher)) {
+    return refuse(target.ok ? NO_DISPATCH_HOST : target.error)
+  }
+  await ctx.runs.updateRun({
+    runId: run.id,
+    status: 'dispatching',
+    workspaceId: automation.workspaceId,
+    error: null
+  })
+
+  run = readRun()
+  if (run.status !== 'dispatching') {
+    return returnDurable(run)
+  }
+  target = resolveCurrentTarget()
+  if (!target.ok) {
+    return refuse(target.error)
+  }
+  const renderer = ctx.getRenderer()
+  if (renderer) {
+    return sendRendererDispatch(
+      renderer,
+      {
+        automation,
+        run,
+        dispatchToken: createAutomationDispatchToken(automation.id, run.id)
+      },
+      ctx.runs,
+      run
+    )
+  }
+  const dispatcher = ctx.headlessDispatcher
+  if (!dispatcher) {
+    return refuse(NO_DISPATCH_HOST)
+  }
+  return runHeadlessAutomationDispatch({
+    ...ctx,
+    automation,
+    run,
+    target,
+    dispatcher: (request) => {
+      if (readRun().status !== 'dispatching') {
+        throw new AutomationDispatchCancelledError('The run changed before its agent could launch.')
+      }
+      const latestTarget = resolveCurrentTarget()
+      if (!latestTarget.ok) {
+        throw new AutomationDispatchCancelledError(latestTarget.error)
+      }
+      return dispatcher({ ...request, target: latestTarget })
+    }
+  })
+}
diff --git a/src/main/automations/automation-owner-fencing.test.ts b/src/main/automations/automation-owner-fencing.test.ts
index 02e3419f38a..14852c0267d 100644
--- a/src/main/automations/automation-owner-fencing.test.ts
+++ b/src/main/automations/automation-owner-fencing.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 /**
  * The desktop authority's end of the scoped-list and owner-fenced contracts:
  * a parameterless read still answers with everything it stores, a scoped read is
@@ -106,14 +107,15 @@ async function createStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 beforeEach(() => {
   testState.dir = mkdtempSync(join(tmpdir(), 'automation-fencing-'))
 })
 
-afterEach(() => {
+afterEach(async () => {
+  await closeTestStores()
   rmSync(testState.dir, { recursive: true, force: true })
 })
 
diff --git a/src/main/automations/automation-run-writer.test.ts b/src/main/automations/automation-run-writer.test.ts
index a149f28ea38..f6130fbf223 100644
--- a/src/main/automations/automation-run-writer.test.ts
+++ b/src/main/automations/automation-run-writer.test.ts
@@ -5,20 +5,27 @@
  */
 import { describe, expect, it, vi } from 'vitest'
 import { createAutomationRunWriter } from './automation-run-writer'
-import { AutomationService } from './service'
+import { collectAutomationRunUsage } from './run-usage-collection'
+import { buildProfileStateCutoverFixture } from '../persistence/profile-state-cutover-fixture'
 import type { Store } from '../persistence'
-import type { Automation, AutomationRun } from '../../shared/automations-types'
 
 const SSH_SELECTOR = { kind: 'ssh', targetId: 'ssh-1' } as const
 
+const data = buildProfileStateCutoverFixture('/fixture')
+const automation = { ...data.automations[0], id: 'auto-1' }
+const run = { ...data.automationRuns[0], id: 'run-1', automationId: automation.id }
+
 function writerWith(selector: ReturnType<Store['automationChangeSelector']>) {
   const publish = vi.fn()
   const automationChangeSelector = vi.fn(() => selector)
   const store = {
-    createAutomationRun: vi.fn(() => ({ id: 'run-1', automationId: 'auto-1' }) as AutomationRun),
-    updateAutomationRun: vi.fn(() => ({ id: 'run-1', automationId: 'auto-1' }) as AutomationRun),
+    flushPendingOrThrowAsync: vi.fn().mockResolvedValue(undefined),
+    createAutomationRun: vi.fn(() => run),
+    updateAutomationRun: vi.fn(() => run),
+    recordRepeatedAutomationSkip: vi.fn(() => null),
+    advanceAutomationNextRun: vi.fn(() => automation),
     automationChangeSelector
-  } as unknown as Store
+  }
   return {
     publish,
     automationChangeSelector,
@@ -28,61 +35,68 @@ function writerWith(selector: ReturnType<Store['automationChangeSelector']>) {
 }
 
 describe('automation run writer publications', () => {
-  it('names the host a created run belongs to', () => {
+  it('waits for durable acknowledgement before publishing or returning a run', async () => {
+    const { store, writer, publish } = writerWith(SSH_SELECTOR)
+    const acknowledgement = Promise.withResolvers<void>()
+    vi.spyOn(store, 'flushPendingOrThrowAsync').mockReturnValue(acknowledgement.promise)
+    const completed = vi.fn()
+    const pending = writer.updateRun({ runId: 'run-1', status: 'dispatching' }).then(completed)
+    await Promise.resolve()
+    expect(publish).not.toHaveBeenCalled()
+    expect(completed).not.toHaveBeenCalled()
+    acknowledgement.resolve()
+    await pending
+    expect(publish).toHaveBeenCalledOnce()
+    expect(completed).toHaveBeenCalledOnce()
+  })
+
+  it('rejects a failed write without publishing success', async () => {
+    const { store, writer, publish } = writerWith(SSH_SELECTOR)
+    vi.spyOn(store, 'flushPendingOrThrowAsync').mockRejectedValue(new Error('disk full'))
+    await expect(writer.updateRun({ runId: 'run-1', status: 'completed' })).rejects.toThrow(
+      'disk full'
+    )
+    expect(publish).not.toHaveBeenCalled()
+  })
+
+  it('names the host a created run belongs to', async () => {
     const { writer, publish } = writerWith(SSH_SELECTOR)
-    writer.createRun({ id: 'auto-1' } as Automation, 0, 'scheduled')
+    await writer.createRun(automation, 0, 'scheduled')
     expect(publish).toHaveBeenCalledWith({ reason: 'run', selector: SSH_SELECTOR })
   })
 
-  it('resolves the host from the written run, which is all a dispatch result names', () => {
+  it('resolves the host from the written run, which is all a dispatch result names', async () => {
     const { writer, publish, automationChangeSelector } = writerWith(SSH_SELECTOR)
-    writer.updateRun({ runId: 'run-1', status: 'completed', usage: null })
+    await writer.updateRun({ runId: 'run-1', status: 'completed', usage: null })
     expect(automationChangeSelector).toHaveBeenCalledWith('auto-1')
     expect(publish).toHaveBeenCalledWith({ reason: 'run', selector: SSH_SELECTOR })
   })
 
-  it('keeps the usage reason on a usage-bearing write', () => {
+  it('keeps the usage reason on a usage-bearing write', async () => {
     const { writer, publish } = writerWith({ kind: 'self' })
-    writer.updateRun({
+    await writer.updateRun({
       runId: 'run-1',
       status: 'completed',
-      usage: { status: 'known' } as AutomationRun['usage']
+      usage: await collectAutomationRunUsage({
+        automation,
+        run,
+        claudeUsage: null,
+        codexUsage: null
+      })
     })
     expect(publish).toHaveBeenCalledWith({ reason: 'usage', selector: { kind: 'self' } })
   })
 
   // Over-broad beats silent: a subscriber must still hear that something changed.
-  it('falls back to the whole authority when the record can no longer be named', () => {
+  it('falls back to the whole authority when the record can no longer be named', async () => {
     const { writer, publish } = writerWith(null)
-    writer.createRun({ id: 'auto-1' } as Automation, 0, 'scheduled')
+    await writer.createRun(automation, 0, 'scheduled')
     expect(publish).toHaveBeenCalledWith({ reason: 'run' })
   })
 
-  it('does not project a selector nobody will hear', () => {
-    const automationChangeSelector = vi.fn(() => SSH_SELECTOR)
-    const store = {
-      createAutomationRun: vi.fn(() => ({ id: 'run-1', automationId: 'auto-1' }) as AutomationRun),
-      automationChangeSelector
-    } as unknown as Store
-    createAutomationRunWriter(store, null).createRun({ id: 'auto-1' } as Automation, 0, 'scheduled')
+  it('does not project a selector nobody will hear', async () => {
+    const { store, automationChangeSelector } = writerWith(SSH_SELECTOR)
+    await createAutomationRunWriter(store, null).createRun(automation, 0, 'scheduled')
     expect(automationChangeSelector).not.toHaveBeenCalled()
   })
-
-  // Why the renderer dispatch path no longer emits its own: the scoped event is
-  // published during the write, so it is queued before the reply the caller awaits.
-  it('publishes before markDispatchResult settles', async () => {
-    const publish = vi.fn()
-    const store = {
-      updateAutomationRun: vi.fn(
-        () => ({ id: 'run-1', automationId: 'auto-1', status: 'dispatched' }) as AutomationRun
-      ),
-      automationChangeSelector: vi.fn(() => SSH_SELECTOR)
-    } as unknown as Store
-    const service = new AutomationService(store, { onAutomationsChanged: publish })
-
-    const settled = service.markDispatchResult({ runId: 'run-1', status: 'dispatched' })
-
-    expect(publish).toHaveBeenCalledWith({ reason: 'run', selector: SSH_SELECTOR })
-    await settled
-  })
 })
diff --git a/src/main/automations/automation-run-writer.ts b/src/main/automations/automation-run-writer.ts
index ef08c84de49..1f813a62d0c 100644
--- a/src/main/automations/automation-run-writer.ts
+++ b/src/main/automations/automation-run-writer.ts
@@ -2,18 +2,31 @@ import type { Store } from '../persistence'
 import type { PublishAutomationsChanged } from '../../shared/runtime-client-events'
 import type { AutomationDispatchResult, AutomationRun } from '../../shared/automations-types'
 
+type DurableWrite<T extends (...args: never[]) => unknown> = (
+  ...args: Parameters<T>
+) => Promise<ReturnType<T>>
+
 export type AutomationRunWriter = {
-  createRun: Store['createAutomationRun']
-  updateRun: Store['updateAutomationRun']
+  createRun: DurableWrite<Store['createAutomationRun']>
+  updateRun: DurableWrite<Store['updateAutomationRun']>
   /** Null when nothing could be folded — the caller then writes an ordinary run. */
-  repeatSkip: Store['recordRepeatedAutomationSkip']
+  repeatSkip: DurableWrite<Store['recordRepeatedAutomationSkip']>
+  advanceNextRun: DurableWrite<Store['advanceAutomationNextRun']>
 }
 
 /** Wraps run persistence so every committed write announces itself. Clients with
  *  the Automations page closed — or none attached at all — have no other way to
  *  learn that a run progressed, so the event must follow the write, not a render. */
 export function createAutomationRunWriter(
-  store: Store,
+  store: Pick<
+    Store,
+    | 'createAutomationRun'
+    | 'updateAutomationRun'
+    | 'recordRepeatedAutomationSkip'
+    | 'advanceAutomationNextRun'
+    | 'automationChangeSelector'
+    | 'flushPendingOrThrowAsync'
+  >,
   publish: PublishAutomationsChanged | null
 ): AutomationRunWriter {
   // A run write never moves the record, so its own host is the whole publication.
@@ -26,19 +39,27 @@ export function createAutomationRunWriter(
     publish({ reason, ...(selector ? { selector } : {}) })
   }
   return {
-    createRun: (automation, scheduledFor, trigger): AutomationRun => {
+    advanceNextRun: async (id, now) => {
+      const automation = store.advanceAutomationNextRun(id, now)
+      await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+      return automation
+    },
+    createRun: async (automation, scheduledFor, trigger): Promise<AutomationRun> => {
       const run = store.createAutomationRun(automation, scheduledFor, trigger)
+      await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
       announce(automation.id, 'run')
       return run
     },
-    updateRun: (result: AutomationDispatchResult): AutomationRun => {
+    updateRun: async (result: AutomationDispatchResult): Promise<AutomationRun> => {
       const run = store.updateAutomationRun(result)
+      await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
       announce(run.automationId, result.usage ? 'usage' : 'run')
       return run
     },
-    repeatSkip: (automationId, error, scheduledFor): AutomationRun | null => {
+    repeatSkip: async (automationId, error, scheduledFor): Promise<AutomationRun | null> => {
       const run = store.recordRepeatedAutomationSkip(automationId, error, scheduledFor)
       if (run) {
+        await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
         announce(automationId, 'run')
       }
       return run
diff --git a/src/main/automations/automation-skip-coalescing.test.ts b/src/main/automations/automation-skip-coalescing.test.ts
index 5ab58c1e831..089a0dab196 100644
--- a/src/main/automations/automation-skip-coalescing.test.ts
+++ b/src/main/automations/automation-skip-coalescing.test.ts
@@ -6,12 +6,19 @@
  */
 
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { Repo } from '../../shared/repo-types'
 import type { Automation } from '../../shared/automations-types'
+import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
 import type { Store } from '../persistence'
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson,
+  writePersistedStateJson
+} from '../persistence-test-harness'
 import { AutomationService } from './service'
 import { installFakeAppEnvironment } from '../../../config/scripts/vitest-host-ports-setup'
 
@@ -33,7 +40,7 @@ async function createStore(): Promise<Store> {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store: StoreClass, initDataPath } = await import('../persistence')
   initDataPath()
-  return new StoreClass()
+  return createSqliteTestStore(StoreClass, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 const makeRepo = (): Repo => ({
@@ -66,8 +73,10 @@ async function seedUnresolvableAutomation(): Promise<{ store: Store; automation:
     rrule: 'FREQ=DAILY;BYHOUR=9;BYMINUTE=0',
     dtstart: new Date('2026-05-12T00:00:00').getTime()
   })
+  seed.flushOrThrow()
+  await seed.freezeWritesAsync()
   const file = join(testState.dir, 'orca-data.json')
-  const state = JSON.parse(readFileSync(file, 'utf-8'))
+  const state = JSON.parse(readPersistedStateJson(file))
   state.automations[0].runContext = {
     kind: 'workspace-run',
     projectId: 'project-1',
@@ -76,7 +85,7 @@ async function seedUnresolvableAutomation(): Promise<{ store: Store; automation:
     repoId: 'r1',
     path: '/repo'
   }
-  writeFileSync(file, JSON.stringify(state, null, 2), 'utf-8')
+  writePersistedStateJson(file, JSON.stringify(state))
   return { store: await createStore(), automation }
 }
 
@@ -132,9 +141,10 @@ describe('repeated skipped_unavailable coalescing', () => {
     vi.useFakeTimers()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
-    rmSync(testState.dir, { recursive: true, force: true })
+    removeTreeSync(testState.dir)
   })
 
   it('folds every later refusal into the first record instead of writing a row each', async () => {
@@ -288,10 +298,10 @@ describe('repeated skipped_unavailable coalescing', () => {
     const scheduledFor = Date.now()
     seedSkip(store, automation, scheduledFor, SETUP_GONE)
     store.recordRepeatedAutomationSkip(automation.id, SETUP_GONE, scheduledFor + 1000)
-    store.flush()
+    store.flushOrThrow()
+    await store.freezeWritesAsync()
 
-    const { Store: StoreClass } = await import('../persistence')
-    const reloaded = new StoreClass()
+    const reloaded = await createStore()
 
     expect(reloaded.listAutomationRuns(automation.id)[0]?.occurrenceCount).toBe(2)
     expect(
diff --git a/src/main/automations/automation-update-host-retarget.test.ts b/src/main/automations/automation-update-host-retarget.test.ts
index d52bd29e0c3..62c2b000d6f 100644
--- a/src/main/automations/automation-update-host-retarget.test.ts
+++ b/src/main/automations/automation-update-host-retarget.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 /**
  * An update may not move a record to another host unless it was asked to.
  *
@@ -123,7 +124,7 @@ async function createStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 type Store = Awaited<ReturnType<typeof createStore>>
@@ -146,7 +147,8 @@ beforeEach(() => {
   testState.dir = mkdtempSync(join(tmpdir(), 'automation-retarget-'))
 })
 
-afterEach(() => {
+afterEach(async () => {
+  await closeTestStores()
   rmSync(testState.dir, { recursive: true, force: true })
   vi.resetModules()
 })
diff --git a/src/main/automations/automation-worker-durability.test.ts b/src/main/automations/automation-worker-durability.test.ts
new file mode 100644
index 00000000000..22d13899e3b
--- /dev/null
+++ b/src/main/automations/automation-worker-durability.test.ts
@@ -0,0 +1,245 @@
+import { describe, expect, it, vi } from 'vitest'
+import { AutomationService } from './service'
+import type { Store } from '../persistence'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from '../persistence/loading-store/profile-state-maintenance-fixture'
+
+vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+async function fixture() {
+  const fixture = await createWorkerMaintenanceFixture()
+  for (const automation of fixture.store.listAutomations()) {
+    fixture.store.updateAutomation(automation.id, { enabled: false })
+  }
+  const automation = fixture.store.createAutomation({
+    name: 'Durable run',
+    prompt: 'Check the project',
+    agentId: 'claude',
+    projectId: 'repo-local',
+    workspaceMode: 'existing',
+    workspaceId: 'repo-local::/fixture/local',
+    timezone: 'UTC',
+    rrule: 'FREQ=HOURLY;BYMINUTE=0',
+    dtstart: Date.now() - 60_000
+  })
+  await fixture.store.flushPendingOrThrowAsync()
+  return { ...fixture, automation }
+}
+
+const launch = { workspaceId: 'repo-local::/fixture/local', terminalSessionId: 'run-tab' }
+
+function blockAcknowledgement(store: Store, index: number) {
+  const gate = maintenanceBarrier()
+  const blocked = maintenanceBarrier()
+  const flush = store.flushPendingOrThrowAsync.bind(store)
+  let calls = 0
+  vi.spyOn(store, 'flushPendingOrThrowAsync').mockImplementation(async (options) => {
+    calls += 1
+    if (calls === index) {
+      blocked.resolve()
+      await gate.promise
+    }
+    await flush(options)
+  })
+  return { blocked: blocked.promise, release: gate.resolve }
+}
+
+describe('automation background writer durability', () => {
+  it('claims a shared occurrence once when callers await the same pending row', async () => {
+    vi.spyOn(Date, 'now').mockReturnValue(1_800_000_000_000)
+    const { store, automation } = await fixture()
+    const dispatcher = vi.fn(async () => launch)
+    const service = new AutomationService(store, { headlessDispatcher: dispatcher })
+    try {
+      const runs = await Promise.all([service.runNow(automation.id), service.runNow(automation.id)])
+      expect(new Set(runs.map((run) => run.id)).size).toBe(1)
+      expect(dispatcher).toHaveBeenCalledOnce()
+    } finally {
+      service.stop()
+    }
+  })
+
+  it('persists dispatch intent before starting external work', async () => {
+    const { store, automation, readState } = await fixture()
+    const gate = maintenanceBarrier()
+    const flush = store.flushPendingOrThrowAsync.bind(store)
+    vi.spyOn(store, 'flushPendingOrThrowAsync').mockImplementationOnce(async (options) => {
+      await gate.promise
+      await flush(options)
+    })
+    const dispatcher = vi.fn(async () => {
+      expect(readState().automationRuns).toContainEqual(
+        expect.objectContaining({ automationId: automation.id, status: 'dispatching' })
+      )
+      return launch
+    })
+    const service = new AutomationService(store, { headlessDispatcher: dispatcher })
+    try {
+      const run = service.runNow(automation.id)
+      await Promise.resolve()
+      expect(dispatcher).not.toHaveBeenCalled()
+      gate.resolve()
+      await expect(run).resolves.toMatchObject({ status: 'dispatched' })
+      expect(dispatcher).toHaveBeenCalledOnce()
+    } finally {
+      service.stop()
+    }
+  })
+
+  it('never dispatches when the writer refuses the durable acknowledgement', async () => {
+    const { store, automation } = await fixture()
+    vi.spyOn(store, 'flushPendingOrThrowAsync').mockRejectedValueOnce(new Error('disk full'))
+    const dispatcher = vi.fn(async () => launch)
+    const service = new AutomationService(store, { headlessDispatcher: dispatcher })
+    try {
+      await expect(service.runNow(automation.id)).rejects.toThrow('disk full')
+      expect(dispatcher).not.toHaveBeenCalled()
+    } finally {
+      service.stop()
+    }
+  })
+
+  it.each([
+    ['dispatching', 1],
+    ['dispatched', 1],
+    ['completed', 1],
+    ['dispatching', 120_001],
+    ['dispatched', 120_001],
+    ['completed', 120_001]
+  ] as const)(
+    'preserves a durable %s occurrence after %s ms when next-run advancement was interrupted',
+    async (status, lateness) => {
+      const clock = vi.spyOn(Date, 'now').mockReturnValue(1_800_000_000_000)
+      const { store, automation, readState } = await fixture()
+      store.updateAutomation(automation.id, { missedRunGraceMinutes: 0 })
+      const dueAt = automation.nextRunAt
+      const run = store.createAutomationRun(automation, dueAt)
+      store.updateAutomationRun({ runId: run.id, status })
+      await store.flushPendingOrThrowAsync()
+      clock.mockReturnValue(dueAt + lateness)
+      const dispatcher = vi.fn(async () => launch)
+      const service = new AutomationService(store, { headlessDispatcher: dispatcher })
+      try {
+        service.start()
+        await vi.waitFor(() => {
+          const stored = readState().automations.find(
+            (entry: { id: string }) => entry.id === automation.id
+          )
+          expect(stored.nextRunAt).toBeGreaterThan(dueAt + lateness)
+        })
+        expect(dispatcher).not.toHaveBeenCalled()
+        expect(store.listAutomationRuns(automation.id)).toHaveLength(1)
+        expect(store.listAutomationRuns(automation.id)[0].status).toBe(status)
+      } finally {
+        service.stop()
+      }
+    }
+  )
+
+  it.each([1, 2])('cancels a pending dispatch stopped during acknowledgement %s', async (index) => {
+    const { store, automation } = await fixture()
+    const acknowledgement = blockAcknowledgement(store, index)
+    const dispatcher = vi.fn(async () => launch)
+    const service = new AutomationService(store, { headlessDispatcher: dispatcher })
+    const pending = service.runNow(automation.id)
+    const rejected = expect(pending).rejects.toThrow('stopped before')
+    await acknowledgement.blocked
+    service.stop()
+    acknowledgement.release()
+    await rejected
+    expect(dispatcher).not.toHaveBeenCalled()
+  })
+
+  it('does not resurrect or dispatch an automation deleted during its intent acknowledgement', async () => {
+    const { store, automation, readState } = await fixture()
+    const acknowledgement = blockAcknowledgement(store, 2)
+    const dispatcher = vi.fn(async () => launch)
+    const service = new AutomationService(store, { headlessDispatcher: dispatcher })
+    try {
+      const pending = service.runNow(automation.id)
+      const rejected = expect(pending).rejects.toThrow('removed before')
+      await acknowledgement.blocked
+      store.deleteAutomation(automation.id)
+      acknowledgement.release()
+      await rejected
+      expect(dispatcher).not.toHaveBeenCalled()
+      expect(
+        readState().automationRuns.some(
+          (run: { automationId: string }) => run.automationId === automation.id
+        )
+      ).toBe(false)
+    } finally {
+      service.stop()
+    }
+  })
+
+  it.each([1, 2])('refuses changed instructions during acknowledgement %s', async (index) => {
+    const { store, automation } = await fixture()
+    const acknowledgement = blockAcknowledgement(store, index)
+    const dispatcher = vi.fn(async () => launch)
+    const service = new AutomationService(store, { headlessDispatcher: dispatcher })
+    try {
+      const pending = service.runNow(automation.id)
+      await acknowledgement.blocked
+      store.updateAutomation(automation.id, { prompt: 'Different instructions' })
+      acknowledgement.release()
+      await expect(pending).resolves.toMatchObject({
+        status: 'skipped_unavailable',
+        error: expect.stringContaining('changed before')
+      })
+      expect(dispatcher).not.toHaveBeenCalled()
+    } finally {
+      service.stop()
+    }
+  })
+
+  it.each([1, 2])('refuses a moved execution host during acknowledgement %s', async (index) => {
+    const { store, automation } = await fixture()
+    const acknowledgement = blockAcknowledgement(store, index)
+    const dispatcher = vi.fn(async () => launch)
+    const service = new AutomationService(store, { headlessDispatcher: dispatcher })
+    try {
+      const pending = service.runNow(automation.id)
+      await acknowledgement.blocked
+      store.updateRepo('repo-local', { executionHostId: 'runtime:other-host' })
+      acknowledgement.release()
+      await expect(pending).resolves.toMatchObject({ status: 'skipped_unavailable' })
+      expect(dispatcher).not.toHaveBeenCalled()
+    } finally {
+      service.stop()
+    }
+  })
+
+  it.each(['disconnect', 'replacement'] as const)(
+    'refuses an unready renderer after %s during acknowledgement',
+    async (change) => {
+      const { store, automation } = await fixture()
+      const acknowledgement = blockAcknowledgement(store, 2)
+      const renderer = { isDestroyed: () => false, send: vi.fn() }
+      const replacement = { isDestroyed: () => false, send: vi.fn() }
+      const service = new AutomationService(store)
+      service.setWebContents(renderer)
+      service.setRendererReady()
+      try {
+        const pending = service.runNow(automation.id)
+        await acknowledgement.blocked
+        service.setWebContents(change === 'disconnect' ? null : replacement)
+        acknowledgement.release()
+        await expect(pending).resolves.toMatchObject({ status: 'skipped_unavailable' })
+        expect(renderer.send).not.toHaveBeenCalled()
+        expect(replacement.send).not.toHaveBeenCalled()
+      } finally {
+        service.stop()
+      }
+    }
+  )
+})
diff --git a/src/main/automations/automation-workspace-host-attribution.test.ts b/src/main/automations/automation-workspace-host-attribution.test.ts
index e5d66c27dc2..326de8fad23 100644
--- a/src/main/automations/automation-workspace-host-attribution.test.ts
+++ b/src/main/automations/automation-workspace-host-attribution.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 /**
  * A folder workspace can pin its execution host while its repo stays local.
  * The desktop authority used to project only the repo, so those records listed
@@ -119,14 +120,15 @@ async function createStore(
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 beforeEach(() => {
   testState.dir = mkdtempSync(join(tmpdir(), 'automation-workspace-host-'))
 })
 
-afterEach(() => {
+afterEach(async () => {
+  await closeTestStores()
   rmSync(testState.dir, { recursive: true, force: true })
 })
 
@@ -218,7 +220,8 @@ describe('dispatch refused for an ambiguous workspace host', () => {
     vi.useFakeTimers()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
     rmSync(testState.dir, { recursive: true, force: true })
   })
diff --git a/src/main/automations/automation-zero-grace-tick-latency.test.ts b/src/main/automations/automation-zero-grace-tick-latency.test.ts
index 4639a872887..94020e03bef 100644
--- a/src/main/automations/automation-zero-grace-tick-latency.test.ts
+++ b/src/main/automations/automation-zero-grace-tick-latency.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
@@ -24,7 +25,7 @@ async function createStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 const makeRepo = (overrides: Partial<Repo> = {}): Repo => ({
@@ -42,7 +43,8 @@ describe('AutomationService zero-grace tick latency', () => {
     vi.useFakeTimers()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
     rmSync(testState.dir, { recursive: true, force: true })
   })
@@ -76,7 +78,11 @@ describe('AutomationService zero-grace tick latency', () => {
     service.setWebContents({ isDestroyed: () => false, send: vi.fn() })
     service.start()
     service.setRendererReady()
-    await vi.advanceTimersByTimeAsync(0)
+    await vi.waitFor(() => {
+      if (store.listAutomations().some((automation) => automation.nextRunAt <= at)) {
+        throw new Error('Automation evaluation is still saving its next occurrence')
+      }
+    })
     service.stop()
   }
 
diff --git a/src/main/automations/dispatch-refusal.test.ts b/src/main/automations/dispatch-refusal.test.ts
index 233deb3e782..27179f1cf56 100644
--- a/src/main/automations/dispatch-refusal.test.ts
+++ b/src/main/automations/dispatch-refusal.test.ts
@@ -59,13 +59,14 @@ function makeRunWriter(foldsRepeat: boolean): {
   const created: string[] = []
   const updated: { status: string; error?: string | null }[] = []
   const writer: AutomationRunWriter = {
-    repeatSkip: () => (foldsRepeat ? makeRun('folded') : null),
-    createRun: () => {
+    advanceNextRun: async () => brokenAutomation,
+    repeatSkip: async () => (foldsRepeat ? makeRun('folded') : null),
+    createRun: async () => {
       const run = makeRun(`run-${created.length + 1}`)
       created.push(run.id)
       return run
     },
-    updateRun: (args) => {
+    updateRun: async (args) => {
       updated.push({ status: args.status, error: args.error })
       return { ...makeRun(args.runId), status: args.status, error: args.error ?? null }
     }
@@ -78,11 +79,11 @@ describe('recordUnevaluableAutomation', () => {
     vi.restoreAllMocks()
   })
 
-  it('writes one run and logs once when the record is newly broken', () => {
+  it('writes one run and logs once when the record is newly broken', async () => {
     const logged = vi.spyOn(console, 'error').mockImplementation(() => {})
     const { writer, created, updated } = makeRunWriter(false)
 
-    recordUnevaluableAutomation({
+    await recordUnevaluableAutomation({
       runs: writer,
       automation: brokenAutomation,
       error: new Error('Invalid cron day of month.')
@@ -95,12 +96,12 @@ describe('recordUnevaluableAutomation', () => {
 
   // The record is retried every tick on purpose, so a repaired schedule resumes on its own.
   // The fold is what keeps that from writing a row, and logging, once per tick forever.
-  it('stays silent on a record it has already reported', () => {
+  it('stays silent on a record it has already reported', async () => {
     const logged = vi.spyOn(console, 'error').mockImplementation(() => {})
     const { writer, created } = makeRunWriter(true)
 
     for (let tick = 0; tick < 5; tick += 1) {
-      recordUnevaluableAutomation({
+      await recordUnevaluableAutomation({
         runs: writer,
         automation: brokenAutomation,
         error: new Error('Invalid cron day of month.')
diff --git a/src/main/automations/dispatch-refusal.ts b/src/main/automations/dispatch-refusal.ts
index 4a5fffa1b16..286abb2f252 100644
--- a/src/main/automations/dispatch-refusal.ts
+++ b/src/main/automations/dispatch-refusal.ts
@@ -43,17 +43,17 @@ export function describeScheduledRefusal(input: {
  * and doc:94 asks for both. Never dispatches: the reason is the one the
  * scheduler would have written for the same record.
  */
-export function recordRefusedAutomationRun(input: {
+export async function recordRefusedAutomationRun(input: {
   store: Store
   runs: AutomationRunWriter
   automation: Automation
   allowRemoteHostScheduling: boolean
-}): void {
+}): Promise<void> {
   const target = resolveAutomationRunTarget(input.store, input.automation, {
     allowRemoteHostScheduling: input.allowRemoteHostScheduling
   })
-  const run = input.runs.createRun(input.automation, Date.now(), 'manual')
-  input.runs.updateRun({
+  const run = await input.runs.createRun(input.automation, Date.now(), 'manual')
+  await input.runs.updateRun({
     runId: run.id,
     status: 'skipped_unavailable',
     workspaceId: input.automation.workspaceId,
@@ -66,21 +66,24 @@ export function recordRefusedAutomationRun(input: {
  * stalled. Folds on the fixed sentence and the unchanged nextRunAt, so a record that stays
  * broken writes one row rather than one per tick, and never throws back into the tick.
  */
-export function recordUnevaluableAutomation(input: {
+export async function recordUnevaluableAutomation(input: {
   runs: AutomationRunWriter
   automation: Automation
   error: unknown
-}): void {
+}): Promise<void> {
   const { automation } = input
   try {
     // nextRunAt deliberately stays put: the record is retried so a repaired schedule resumes
     // on its own. The fold is what keeps that from writing a row — and logging — every tick.
-    if (input.runs.repeatSkip(automation.id, UNEVALUABLE_SCHEDULE, automation.nextRunAt)) {
+    if (await input.runs.repeatSkip(automation.id, UNEVALUABLE_SCHEDULE, automation.nextRunAt)) {
       return
     }
     console.error('[automations] failed to evaluate automation:', automation.id, input.error)
-    const run = input.runs.createRun(automation, automation.nextRunAt)
-    input.runs.updateRun({
+    const run = await input.runs.createRun(automation, automation.nextRunAt)
+    if (run.status !== 'pending') {
+      return
+    }
+    await input.runs.updateRun({
       runId: run.id,
       status: 'skipped_unavailable',
       workspaceId: automation.workspaceId,
@@ -101,12 +104,12 @@ export function recordUnevaluableAutomation(input: {
  * Sends the dispatch request through the renderer channel, closing the run out as
  * `dispatch_failed` when the send throws — a failed send is not an unreadable schedule.
  */
-export function sendRendererDispatch(
+export async function sendRendererDispatch(
   channel: Pick<WebContents, 'send'> | null,
   payload: AutomationDispatchRequest,
   runs: AutomationRunWriter,
   run: AutomationRun
-): AutomationRun {
+): Promise<AutomationRun> {
   try {
     channel?.send('automations:dispatchRequested', payload)
     return run
@@ -153,13 +156,16 @@ export function missedBeyondGrace(input: {
   return input.now - input.scheduledFor > graceMs + jitterMs
 }
 
-export function recordMissedRun(input: {
+export async function recordMissedRun(input: {
   runs: AutomationRunWriter
   automation: Automation
   scheduledFor: number
-}): void {
-  const missed = input.runs.createRun(input.automation, input.scheduledFor)
-  input.runs.updateRun({
+}): Promise<void> {
+  const missed = await input.runs.createRun(input.automation, input.scheduledFor)
+  if (missed.status !== 'pending') {
+    return
+  }
+  await input.runs.updateRun({
     runId: missed.id,
     status: 'skipped_missed',
     workspaceId: input.automation.workspaceId,
diff --git a/src/main/automations/headless-dispatch-durability.test.ts b/src/main/automations/headless-dispatch-durability.test.ts
new file mode 100644
index 00000000000..ea5403801e0
--- /dev/null
+++ b/src/main/automations/headless-dispatch-durability.test.ts
@@ -0,0 +1,107 @@
+import { describe, expect, it, vi } from 'vitest'
+import { buildProfileStateCutoverFixture } from '../persistence/profile-state-cutover-fixture'
+import type { AutomationRun } from '../../shared/automations-types'
+import type { HeadlessAutomationDispatchLaunch } from './headless-dispatch'
+import { runHeadlessAutomationDispatch } from './headless-dispatch-runner'
+
+function fixture(launch: HeadlessAutomationDispatchLaunch) {
+  const state = buildProfileStateCutoverFixture('/fixture')
+  const automation = { ...state.automations[0], precheck: null }
+  const run: AutomationRun = {
+    ...state.automationRuns[0],
+    automationId: automation.id,
+    status: 'dispatching'
+  }
+  const dispatched: AutomationRun = { ...run, ...launch, status: 'dispatched' }
+  return {
+    automation,
+    run,
+    target: { ok: true as const, cwd: state.repos[0].path, repo: state.repos[0] },
+    dispatcher: vi.fn(async () => launch),
+    runs: {
+      createRun: vi.fn(async () => run),
+      updateRun: vi.fn(async () => dispatched),
+      repeatSkip: vi.fn(async () => null),
+      advanceNextRun: vi.fn(async () => automation)
+    },
+    runPrecheck: vi.fn(async () => null),
+    markDispatchResult: vi.fn(async () => dispatched),
+    watchRun: vi.fn()
+  }
+}
+
+const terminal = {
+  workspaceId: 'launched-workspace',
+  terminalSessionId: 'launched-tab',
+  terminalPaneKey: 'launched-pane',
+  terminalPtyId: 'launched-pty'
+}
+
+describe('headless automation observation during persistence', () => {
+  it('handles an early completion rejection while the dispatched write is stalled', async () => {
+    const completion = Promise.withResolvers<never>()
+    const acknowledgement = Promise.withResolvers<AutomationRun>()
+    const context = fixture({ ...terminal, completion: completion.promise })
+    context.runs.updateRun.mockReturnValueOnce(acknowledgement.promise)
+    const pending = runHeadlessAutomationDispatch(context)
+    await vi.waitFor(() => expect(context.runs.updateRun).toHaveBeenCalledOnce())
+    completion.reject(new Error('agent exited early'))
+    await vi.waitFor(() =>
+      expect(context.markDispatchResult).toHaveBeenCalledWith({
+        runId: context.run.id,
+        status: 'dispatch_failed',
+        ...terminal,
+        workspaceDisplayName: null,
+        error: 'agent exited early'
+      })
+    )
+    acknowledgement.resolve({ ...context.run, ...terminal, status: 'dispatched' })
+    await pending
+  })
+
+  it('starts terminal observation even when the dispatched write fails after launch', async () => {
+    const context = fixture(terminal)
+    const failure = new Error('disk full')
+    context.runs.updateRun.mockRejectedValueOnce(failure)
+    await expect(runHeadlessAutomationDispatch(context)).rejects.toBe(failure)
+    expect(context.watchRun).toHaveBeenCalledExactlyOnceWith(
+      expect.objectContaining({
+        ...terminal,
+        status: 'dispatched'
+      })
+    )
+    expect(context.runs.updateRun).toHaveBeenCalledExactlyOnceWith(
+      expect.objectContaining({
+        ...terminal,
+        status: 'dispatched'
+      })
+    )
+  })
+
+  it('keeps receiving completion after the launched run fails to persist', async () => {
+    const completion = Promise.withResolvers<{ status: 'completed' }>()
+    const context = fixture({ ...terminal, completion: completion.promise })
+    context.runs.updateRun.mockRejectedValueOnce(new Error('writer unavailable'))
+    await expect(runHeadlessAutomationDispatch(context)).rejects.toThrow('writer unavailable')
+    completion.resolve({ status: 'completed' })
+    await vi.waitFor(() =>
+      expect(context.markDispatchResult).toHaveBeenCalledWith(
+        expect.objectContaining({ ...terminal, status: 'completed' })
+      )
+    )
+    expect(context.runs.updateRun).toHaveBeenCalledOnce()
+  })
+
+  it('records an actual launch rejection as dispatch failure', async () => {
+    const context = fixture(terminal)
+    context.dispatcher.mockRejectedValueOnce(new Error('shell unavailable'))
+    await runHeadlessAutomationDispatch(context)
+    expect(context.runs.updateRun).toHaveBeenCalledExactlyOnceWith({
+      runId: context.run.id,
+      status: 'dispatch_failed',
+      workspaceId: context.automation.workspaceId,
+      error: 'shell unavailable'
+    })
+    expect(context.watchRun).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/automations/headless-dispatch-runner.ts b/src/main/automations/headless-dispatch-runner.ts
index 8d4e3aed290..5a0ed60582c 100644
--- a/src/main/automations/headless-dispatch-runner.ts
+++ b/src/main/automations/headless-dispatch-runner.ts
@@ -8,7 +8,10 @@ import {
   didAutomationPrecheckPass,
   formatAutomationPrecheckFailure
 } from '../../shared/automation-precheck'
-import type { HeadlessAutomationDispatcher } from './headless-dispatch'
+import type {
+  HeadlessAutomationDispatcher,
+  HeadlessAutomationDispatchLaunch
+} from './headless-dispatch'
 import type { AutomationRunTargetResult } from './run-target-resolution'
 import type { AutomationRunWriter } from './automation-run-writer'
 
@@ -42,47 +45,9 @@ export async function runHeadlessAutomationDispatch(
       error: formatAutomationPrecheckFailure(precheckResult)
     })
   }
+  let launch: HeadlessAutomationDispatchLaunch
   try {
-    const launch = await ctx.dispatcher({ automation, run, target })
-    const launchRunTarget = {
-      workspaceId: launch.workspaceId,
-      workspaceDisplayName: launch.workspaceDisplayName ?? null,
-      terminalSessionId: launch.terminalSessionId,
-      terminalPaneKey: launch.terminalPaneKey ?? null,
-      terminalPtyId: launch.terminalPtyId ?? null
-    }
-    const updated = runs.updateRun({
-      runId: run.id,
-      status: 'dispatched',
-      ...launchRunTarget,
-      error: null
-    })
-    if (!launch.completion) {
-      // Why: a dispatcher that reports no completion promise would otherwise
-      // leave the run at 'dispatched' for the process lifetime.
-      ctx.watchRun(updated)
-      return updated
-    }
-    void launch.completion
-      .then((completion) =>
-        ctx.markDispatchResult({
-          runId: run.id,
-          status: completion.status,
-          ...launchRunTarget,
-          precheckResult,
-          outputSnapshot: completion.outputSnapshot ?? null,
-          error: completion.error ?? null
-        })
-      )
-      .catch((error) =>
-        ctx.markDispatchResult({
-          runId: run.id,
-          status: 'dispatch_failed',
-          ...launchRunTarget,
-          error: describeDispatchError(error)
-        })
-      )
-    return updated
+    launch = await ctx.dispatcher({ automation, run, target })
   } catch (error) {
     return runs.updateRun({
       runId: run.id,
@@ -91,4 +56,43 @@ export async function runHeadlessAutomationDispatch(
       error: describeDispatchError(error)
     })
   }
+  const launchRunTarget = {
+    workspaceId: launch.workspaceId,
+    workspaceDisplayName: launch.workspaceDisplayName ?? null,
+    terminalSessionId: launch.terminalSessionId,
+    terminalPaneKey: launch.terminalPaneKey ?? null,
+    terminalPtyId: launch.terminalPtyId ?? null
+  }
+  const updated = runs.updateRun({
+    runId: run.id,
+    status: 'dispatched',
+    ...launchRunTarget,
+    error: null
+  })
+  // Observe the launched agent even while persistence is stalled or rejects its acknowledgement.
+  if (!launch.completion) {
+    ctx.watchRun({ ...run, ...launchRunTarget, status: 'dispatched', error: null })
+  } else {
+    void launch.completion
+      .then(
+        (completion) =>
+          ctx.markDispatchResult({
+            runId: run.id,
+            status: completion.status,
+            ...launchRunTarget,
+            precheckResult,
+            outputSnapshot: completion.outputSnapshot ?? null,
+            error: completion.error ?? null
+          }),
+        (error) =>
+          ctx.markDispatchResult({
+            runId: run.id,
+            status: 'dispatch_failed',
+            ...launchRunTarget,
+            error: describeDispatchError(error)
+          })
+      )
+      .catch((error) => console.error('[automations] Failed to persist run completion:', error))
+  }
+  return updated
 }
diff --git a/src/main/automations/refused-manual-run.test.ts b/src/main/automations/refused-manual-run.test.ts
index 2e6b4a16cdf..6336b870bd9 100644
--- a/src/main/automations/refused-manual-run.test.ts
+++ b/src/main/automations/refused-manual-run.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 /**
  * doc:94 pairs "return the typed `target_removed` conflict" with "record a
  * skipped-run reason". The scheduler already did both; a manual attempt used to
@@ -98,7 +99,7 @@ async function createStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  const store = new Store()
+  const store = createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
   const service = new AutomationService(store, { tickMs: 60_000 })
   // Manual runs arrive over the shared runtime RPC surface for every transport.
   const { OrcaRuntimeService } = await import('../runtime/orca-runtime')
@@ -125,7 +126,8 @@ describe('manual run refused before dispatch', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'automation-refused-manual-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/automations/refused-manual-run.ts b/src/main/automations/refused-manual-run.ts
index f6a103408c2..b3b60786654 100644
--- a/src/main/automations/refused-manual-run.ts
+++ b/src/main/automations/refused-manual-run.ts
@@ -19,7 +19,7 @@ import {
 
 type RefusableAutomationService = {
   runNow: (automationId: string) => Promise<AutomationRun>
-  recordRefusedRun: (automationId: string) => void
+  recordRefusedRun: (automationId: string) => void | Promise<void>
 }
 
 export async function runAutomationNowFenced(input: {
@@ -34,7 +34,7 @@ export async function runAutomationNowFenced(input: {
       error instanceof AutomationOwnerConflictError &&
       error.code === AUTOMATION_OWNER_CONFLICT_CODES.targetRemoved
     ) {
-      input.service.recordRefusedRun(input.automationId)
+      await input.service.recordRefusedRun(input.automationId)
     }
     throw error
   }
diff --git a/src/main/automations/retained-run-reconciliation.test.ts b/src/main/automations/retained-run-reconciliation.test.ts
index 57afd5ba963..f8f8b6e9017 100644
--- a/src/main/automations/retained-run-reconciliation.test.ts
+++ b/src/main/automations/retained-run-reconciliation.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
@@ -32,7 +33,7 @@ async function createStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 type TestStore = Awaited<ReturnType<typeof createStore>>
@@ -125,7 +126,8 @@ describe('reconciling retained runs against a graph that has not published yet',
     vi.setSystemTime(new Date('2026-06-01T12:00:00Z'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
     rmSync(testState.dir, { recursive: true, force: true })
   })
diff --git a/src/main/automations/run-completion-watcher.test.ts b/src/main/automations/run-completion-watcher.test.ts
index 31c1aea0bb4..69eb7a17201 100644
--- a/src/main/automations/run-completion-watcher.test.ts
+++ b/src/main/automations/run-completion-watcher.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
@@ -36,7 +37,7 @@ async function createStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 const makeRepo = (overrides: Partial<Repo> = {}): Repo => ({
@@ -97,7 +98,8 @@ describe('authority-owned automation run completion', () => {
     ipcHandlers.clear()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
@@ -168,6 +170,9 @@ describe('authority-owned automation run completion', () => {
   it('reconciles stranded runs on startup without claiming completion', async () => {
     const store = await createStore()
     const automation = createAutomation(store)
+    store.updateAutomation(automation.id, { enabled: false })
+    const pendingManual = store.createAutomationRun(automation, 3_000, 'manual')
+    const pendingScheduled = store.createAutomationRun(automation, 4_000, 'scheduled')
     const dispatched = store.createAutomationRun(automation, 1_000, 'manual')
     store.updateAutomationRun({
       runId: dispatched.id,
@@ -199,6 +204,11 @@ describe('authority-owned automation run completion', () => {
     expect(readRun(store, automation.id, dispatching.id).status).toBe('dispatch_failed')
     expect(readRun(store, automation.id, dispatched.id).error).toContain('terminal')
     expect(readRun(store, automation.id, dispatching.id).error).toContain('agent started')
+    expect(readRun(store, automation.id, pendingManual.id)).toMatchObject({
+      status: 'dispatch_failed',
+      error: 'Orca stopped before this manual run could launch.'
+    })
+    expect(readRun(store, automation.id, pendingScheduled.id).status).toBe('pending')
     service.stop()
     vi.useRealTimers()
   })
@@ -322,7 +332,8 @@ describe('automationsChanged publication', () => {
     ipcHandlers.clear()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
@@ -341,7 +352,7 @@ describe('automationsChanged publication', () => {
     })
 
     const run = await service.runNow(automation.id)
-    expect(seen.map((entry) => entry.payload.reason)).toEqual(['run', 'run'])
+    expect(seen.map((entry) => entry.payload.reason)).toEqual(['run', 'run', 'run'])
     expect(seen.at(-1)?.status).toBe('dispatched')
 
     await service.markDispatchResult({
@@ -350,7 +361,7 @@ describe('automationsChanged publication', () => {
       ...LAUNCH_TARGET,
       error: null
     })
-    expect(seen.map((entry) => entry.payload.reason)).toEqual(['run', 'run', 'run', 'usage'])
+    expect(seen.map((entry) => entry.payload.reason)).toEqual(['run', 'run', 'run', 'run', 'usage'])
     expect(seen.at(-1)?.status).toBe('completed')
     // Every run/usage write names its own host, so one automation's run cannot
     // invalidate the rest of the authority.
diff --git a/src/main/automations/run-completion-watcher.ts b/src/main/automations/run-completion-watcher.ts
index 4ac125082fb..ab53efaee58 100644
--- a/src/main/automations/run-completion-watcher.ts
+++ b/src/main/automations/run-completion-watcher.ts
@@ -24,6 +24,9 @@ export type AutomationRunTerminalObserver = {
 
 /** Truthful reason for a run this authority can no longer observe; never claims completion. */
 export function describeStrandedAutomationRun(run: AutomationRun): string {
+  if (run.status === 'pending') {
+    return 'Orca stopped before this manual run could launch.'
+  }
   if (run.status === 'dispatching') {
     return 'Orca stopped before this run reported that its agent started.'
   }
@@ -139,7 +142,12 @@ export class AutomationRunCompletionWatcher {
    *  reported ready and still cannot find it. */
   reconcileRetainedRuns(runs: readonly AutomationRun[]): void {
     this.reconciler.reconcile(
-      runs.filter((run) => run.status === 'dispatched' || run.status === 'dispatching')
+      runs.filter(
+        (run) =>
+          run.status === 'dispatched' ||
+          run.status === 'dispatching' ||
+          (run.status === 'pending' && run.trigger === 'manual')
+      )
     )
   }
 
diff --git a/src/main/automations/service-precheck.test.ts b/src/main/automations/service-precheck.test.ts
index c13359b546d..2bd3b5dd969 100644
--- a/src/main/automations/service-precheck.test.ts
+++ b/src/main/automations/service-precheck.test.ts
@@ -1,5 +1,11 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson,
+  writePersistedStateJson
+} from '../persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdtempSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { Repo } from '../../shared/repo-types'
@@ -31,7 +37,7 @@ async function createStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 const makeRepo = (overrides: Partial<Repo> = {}): Repo => ({
@@ -51,9 +57,9 @@ function mutateDataFile(
   }) => void
 ): void {
   const file = join(testState.dir, 'orca-data.json')
-  const state = JSON.parse(readFileSync(file, 'utf-8'))
+  const state = JSON.parse(readPersistedStateJson(file))
   mutate(state)
-  writeFileSync(file, JSON.stringify(state, null, 2), 'utf-8')
+  writePersistedStateJson(file, JSON.stringify(state))
 }
 
 describe('AutomationService prechecks', () => {
@@ -63,7 +69,8 @@ describe('AutomationService prechecks', () => {
     vi.useFakeTimers()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
     rmSync(testState.dir, { recursive: true, force: true })
   })
diff --git a/src/main/automations/service.test.ts b/src/main/automations/service.test.ts
index 7077a70b6d1..77aa8b8a6f3 100644
--- a/src/main/automations/service.test.ts
+++ b/src/main/automations/service.test.ts
@@ -1,5 +1,11 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson,
+  writePersistedStateJson
+} from '../persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdtempSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { Repo } from '../../shared/repo-types'
@@ -26,15 +32,15 @@ async function createStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 /** Simulate registry drift after a record was stored; the create path derives contexts itself. */
 function mutateDataFile(mutate: (state: { automations: Record<string, unknown>[] }) => void): void {
   const file = join(testState.dir, 'orca-data.json')
-  const state = JSON.parse(readFileSync(file, 'utf-8'))
+  const state = JSON.parse(readPersistedStateJson(file))
   mutate(state)
-  writeFileSync(file, JSON.stringify(state, null, 2), 'utf-8')
+  writePersistedStateJson(file, JSON.stringify(state))
 }
 
 const makeRepo = (overrides: Partial<Repo> = {}): Repo => ({
@@ -52,7 +58,8 @@ describe('AutomationService', () => {
     vi.useFakeTimers()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
     rmSync(testState.dir, { recursive: true, force: true })
   })
diff --git a/src/main/automations/service.ts b/src/main/automations/service.ts
index 227a290783b..1ff8eafbd6b 100644
--- a/src/main/automations/service.ts
+++ b/src/main/automations/service.ts
@@ -1,13 +1,13 @@
-import type { WebContents } from 'electron'
-
-/** All the service asks of the renderer: is it still there, and take this message. Narrower
- *  than WebContents so a test can supply the real shape instead of casting one. */
-export type AutomationRendererChannel = Pick<WebContents, 'isDestroyed' | 'send'>
+import {
+  AutomationDispatchCancelledError,
+  requestAutomationDispatch,
+  type AutomationRendererChannel
+} from './automation-dispatch-request'
+export type { AutomationRendererChannel } from './automation-dispatch-request'
 import type { Store } from '../persistence'
 import {
   isFinalAutomationRunStatus,
   type Automation,
-  type AutomationDispatchRequest,
   type AutomationDispatchResult,
   type AutomationPrecheckResult,
   type AutomationRun
@@ -18,8 +18,7 @@ import { runAutomationPrecheck } from './precheck-runner'
 import { resolveAutomationRunTarget, type AutomationRunTargetResult } from './run-target-resolution'
 import { writeAutomationRunUsage } from './run-usage-collection'
 import type { HeadlessAutomationDispatcher } from './headless-dispatch'
-import { clearAutomationDispatchTokens, createAutomationDispatchToken } from './dispatch-tokens'
-import { runHeadlessAutomationDispatch } from './headless-dispatch-runner'
+import { clearAutomationDispatchTokens } from './dispatch-tokens'
 import {
   AutomationRunCompletionWatcher,
   type AutomationRunTerminalObserver
@@ -31,9 +30,7 @@ import {
   missedBeyondGrace,
   recordMissedRun,
   recordRefusedAutomationRun,
-  recordUnevaluableAutomation,
-  sendRendererDispatch,
-  NO_DISPATCH_HOST
+  recordUnevaluableAutomation
 } from './dispatch-refusal'
 import type {
   AutomationsChangedPayload,
@@ -49,6 +46,8 @@ export class AutomationService {
   private webContents: AutomationRendererChannel | null = null
   private rendererReady = false
   private evaluating = false
+  private stopped = false
+  private dispatchGeneration = 0
   private readonly claudeUsage: ClaudeUsageStore | null
   private readonly codexUsage: CodexUsageStore | null
   private readonly allowRemoteHostScheduling: boolean
@@ -114,6 +113,7 @@ export class AutomationService {
     if (this.timer) {
       return
     }
+    this.stopped = false
     this.timer = setInterval(() => {
       void this.evaluateDueRuns()
     }, this.tickMs)
@@ -130,6 +130,8 @@ export class AutomationService {
   }
 
   stop(): void {
+    this.stopped = true
+    this.dispatchGeneration += 1
     this.completionWatcher?.dispose()
     if (!this.timer) {
       return
@@ -139,19 +141,21 @@ export class AutomationService {
   }
 
   async runNow(automationId: string): Promise<AutomationRun> {
+    const generation = this.dispatchGeneration
     const automation = this.store.listAutomations().find((entry) => entry.id === automationId)
     if (!automation) {
       throw new Error('Automation not found.')
     }
-    const run = this.runs.createRun(automation, Date.now(), 'manual')
-    return await this.requestDispatch(automation, run, this.resolveTarget(automation))
+    const target = this.resolveTarget(automation)
+    const run = await this.runs.createRun(automation, Date.now(), 'manual')
+    return await this.requestDispatch(automation, run, target, generation)
   }
 
   /** The run-history row doc:94 pairs with the typed refusal an execute fence throws. */
-  recordRefusedRun(automationId: string): void {
+  async recordRefusedRun(automationId: string): Promise<void> {
     const automation = this.store.listAutomations().find((entry) => entry.id === automationId)
     if (automation) {
-      recordRefusedAutomationRun({
+      await recordRefusedAutomationRun({
         store: this.store,
         runs: this.runs,
         automation,
@@ -198,7 +202,7 @@ export class AutomationService {
   }
 
   async markDispatchResult(result: AutomationDispatchResult): Promise<AutomationRun> {
-    const run = this.runs.updateRun(result)
+    const run = await this.runs.updateRun(result)
     clearAutomationDispatchTokens(run.automationId, run.id)
     if (!isFinalAutomationRunStatus(run.status)) {
       if (run.status === 'dispatched') {
@@ -224,13 +228,17 @@ export class AutomationService {
   }
 
   private async evaluateDueRuns(): Promise<void> {
-    if (this.evaluating) {
+    if (this.evaluating || this.stopped) {
       return
     }
     this.evaluating = true
+    const generation = this.dispatchGeneration
     try {
       const now = Date.now()
       for (const automation of this.store.listAutomations()) {
+        if (this.stopped || generation !== this.dispatchGeneration) {
+          break
+        }
         if (!automation.enabled || automation.nextRunAt > now) {
           continue
         }
@@ -239,7 +247,14 @@ export class AutomationService {
         try {
           await this.evaluateAutomation(automation, now)
         } catch (error) {
-          recordUnevaluableAutomation({ runs: this.runs, automation, error })
+          if (
+            !(error instanceof AutomationDispatchCancelledError) &&
+            !this.stopped &&
+            generation === this.dispatchGeneration &&
+            this.store.listAutomations().some((current) => current.id === automation.id)
+          ) {
+            await recordUnevaluableAutomation({ runs: this.runs, automation, error })
+          }
         }
       }
     } finally {
@@ -248,14 +263,15 @@ export class AutomationService {
   }
 
   private async evaluateAutomation(automation: Automation, now: number): Promise<void> {
+    const generation = this.dispatchGeneration
     const scheduledFor = this.store.getLatestAutomationOccurrence(automation, now)
     if (scheduledFor === null) {
-      this.store.advanceAutomationNextRun(automation.id, now)
+      await this.runs.advanceNextRun(automation.id, now)
       return
     }
     if (missedBeyondGrace({ automation, scheduledFor, now, tickMs: this.tickMs })) {
-      recordMissedRun({ runs: this.runs, automation, scheduledFor })
-      this.store.advanceAutomationNextRun(automation.id, now)
+      await recordMissedRun({ runs: this.runs, automation, scheduledFor })
+      await this.runs.advanceNextRun(automation.id, now)
       return
     }
 
@@ -263,14 +279,20 @@ export class AutomationService {
     // */5 automation would otherwise write ~288 identical rows a day — past
     // retention, which would evict the automation's real history.
     const target = this.resolveTarget(automation)
-    const refusal = describeScheduledRefusal({ target, canDispatch: this.canDispatch() })
-    if (refusal && this.runs.repeatSkip(automation.id, refusal, scheduledFor)) {
-      this.store.advanceAutomationNextRun(automation.id, now)
+    const canDispatch = this.canDispatchToRenderer() || Boolean(this.headlessDispatcher)
+    const refusal = describeScheduledRefusal({ target, canDispatch })
+    if (refusal && (await this.runs.repeatSkip(automation.id, refusal, scheduledFor))) {
+      await this.runs.advanceNextRun(automation.id, now)
       return
     }
 
-    await this.requestDispatch(automation, this.runs.createRun(automation, scheduledFor), target)
-    this.store.advanceAutomationNextRun(automation.id, now)
+    await this.requestDispatch(
+      automation,
+      await this.runs.createRun(automation, scheduledFor),
+      target,
+      generation
+    )
+    await this.runs.advanceNextRun(automation.id, now)
   }
 
   private resolveTarget(automation: Automation): AutomationRunTargetResult {
@@ -284,55 +306,27 @@ export class AutomationService {
     return Boolean(webContents && !webContents.isDestroyed() && this.rendererReady)
   }
 
-  /** Headless serve counts: it launches runs with no window at all. */
-  private canDispatch(): boolean {
-    return this.canDispatchToRenderer() || Boolean(this.headlessDispatcher)
-  }
-
-  private async requestDispatch(
+  private requestDispatch(
     automation: Automation,
     run: AutomationRun,
-    target: AutomationRunTargetResult
+    target: AutomationRunTargetResult,
+    generation: number
   ): Promise<AutomationRun> {
-    if (!target.ok) {
-      return this.runs.updateRun({
-        runId: run.id,
-        status: 'skipped_unavailable',
-        workspaceId: automation.workspaceId,
-        error: target.error
-      })
-    }
-    if (!this.canDispatchToRenderer()) {
-      if (this.headlessDispatcher) {
-        return await runHeadlessAutomationDispatch({
-          automation,
-          run,
-          target,
-          dispatcher: this.headlessDispatcher,
-          runs: this.runs,
-          runPrecheck: () => this.runPrecheck(automation.id, run.id),
-          markDispatchResult: (result) => this.markDispatchResult(result),
-          watchRun: (dispatched) => this.completionWatcher?.watch(dispatched)
-        })
-      }
-      return this.runs.updateRun({
-        runId: run.id,
-        status: 'skipped_unavailable',
-        workspaceId: automation.workspaceId,
-        error: NO_DISPATCH_HOST
-      })
-    }
-    const updated = this.runs.updateRun({
-      runId: run.id,
-      status: 'dispatching',
-      workspaceId: automation.workspaceId,
-      error: null
-    })
-    const payload: AutomationDispatchRequest = {
+    return requestAutomationDispatch(
+      {
+        store: this.store,
+        runs: this.runs,
+        isActive: () => !this.stopped && generation === this.dispatchGeneration,
+        getRenderer: () => (this.canDispatchToRenderer() ? this.webContents : null),
+        headlessDispatcher: this.headlessDispatcher,
+        resolveTarget: (current) => this.resolveTarget(current),
+        runPrecheck: () => this.runPrecheck(automation.id, run.id),
+        markDispatchResult: (result) => this.markDispatchResult(result),
+        watchRun: (dispatched) => this.completionWatcher?.watch(dispatched)
+      },
       automation,
-      run: updated,
-      dispatchToken: createAutomationDispatchToken(automation.id, updated.id)
-    }
-    return sendRendererDispatch(this.webContents, payload, this.runs, updated)
+      run,
+      target
+    )
   }
 }
diff --git a/src/main/browser/agent-browser-bridge-state-commands.ts b/src/main/browser/agent-browser-bridge-state-commands.ts
index 4e03055da57..779c6930887 100644
--- a/src/main/browser/agent-browser-bridge-state-commands.ts
+++ b/src/main/browser/agent-browser-bridge-state-commands.ts
@@ -15,6 +15,7 @@ import type {
 import { BrowserError } from './cdp-bridge'
 import { parseShellArgs, stripAgentBrowserTargetArgs } from './agent-browser-bridge-process'
 import { AgentBrowserBridgeInteractionCommands } from './agent-browser-bridge-interaction-commands'
+import { sendGuestCdpCommand } from './guest-cdp-command'
 
 export abstract class AgentBrowserBridgeStateCommands extends AgentBrowserBridgeInteractionCommands {
   // ── Cookie commands ──
@@ -101,16 +102,14 @@ export abstract class AgentBrowserBridgeStateCommands extends AgentBrowserBridge
       }
 
       // Why: agent-browser's `set viewport` has no `mobile` flag, so apply the emulation directly via CDP to honor Orca's --mobile.
-      await dbg.sendCommand('Emulation.setDeviceMetricsOverride', {
+      await sendGuestCdpCommand(wc, 'Emulation.setDeviceMetricsOverride', {
         width,
         height,
         deviceScaleFactor: scale,
         mobile
       })
       // Why: BrowserView's compositor can keep the old host size after a metrics-only resize, cropping remote screencast clients.
-      await Promise.resolve(dbg.sendCommand('Emulation.setVisibleSize', { width, height })).catch(
-        () => {}
-      )
+      await sendGuestCdpCommand(wc, 'Emulation.setVisibleSize', { width, height }).catch(() => {})
 
       return {
         width,
diff --git a/src/main/browser/agent-browser-bridge-test-harness.ts b/src/main/browser/agent-browser-bridge-test-harness.ts
index c4c28006e82..34e381838b2 100644
--- a/src/main/browser/agent-browser-bridge-test-harness.ts
+++ b/src/main/browser/agent-browser-bridge-test-harness.ts
@@ -56,6 +56,7 @@ export type MockWebContents = {
   on: Mock<(event: string, listener: MockEmitterListener) => void>
   removeListener: Mock<(event: string, listener: MockEmitterListener) => void>
   isDestroyed: () => boolean
+  isCrashed: () => boolean
   invalidate: Mock<() => void>
   focus: Mock<() => void>
   debugger: MockWebContentsDebugger
@@ -78,6 +79,7 @@ export function mockWebContents(
     on: vi.fn(),
     removeListener: vi.fn(),
     isDestroyed: () => false,
+    isCrashed: () => false,
     invalidate: vi.fn(),
     focus: vi.fn(),
     debugger: {
diff --git a/src/main/browser/browser-manager-auth-user-agent.test.ts b/src/main/browser/browser-manager-auth-user-agent.test.ts
index d85a785a887..1a24369f58c 100644
--- a/src/main/browser/browser-manager-auth-user-agent.test.ts
+++ b/src/main/browser/browser-manager-auth-user-agent.test.ts
@@ -137,10 +137,22 @@ describe('browserManager', () => {
       { userAgent: guestBaseUserAgent }
     ])
 
-    // A navigation that doesn't change the required UA must not thrash setUserAgent.
+    // The next direct navigation is the first safe moment to rewrite the WebContents UA, so it
+    // restores the process identity there and drops the CDP override that stood in for it.
     setUserAgent.mockClear()
+    sendCommand.mockClear()
     didStartNavigation(null, 'https://example.com/', false, true)
+    expect(setUserAgent).toHaveBeenCalledOnce()
+    expect(setUserAgent).toHaveBeenLastCalledWith(guestBaseUserAgent)
+    expect(sendCommand).toHaveBeenCalledWith('Emulation.setUserAgentOverride', { userAgent: '' })
+    await expect(sendCommand.mock.results.at(-1)?.value).resolves.toBeUndefined()
+
+    // A navigation that doesn't change the required UA must not thrash either layer.
+    setUserAgent.mockClear()
+    sendCommand.mockClear()
+    didStartNavigation(null, 'https://example.org/', false, true)
     expect(setUserAgent).not.toHaveBeenCalled()
+    expect(sendCommand).not.toHaveBeenCalled()
   })
 
   it('leaves the UA untouched on Google auth hosts in native process mode', () => {
@@ -270,7 +282,8 @@ describe('browserManager', () => {
 
     // Why: the CDP override outranks the WebContents UA, so getUserAgent() still reports the base
     // identity. Leaving the auth host must read the override, not that stale value, or the guest
-    // keeps presenting Firefox on every later host.
+    // keeps presenting Firefox on every later host. The WebContents UA already presents the process
+    // identity, so leaving clears the override rather than restating the UA without client hints.
     sendCommand.mockClear()
     const didStartNavigation = guestOnMock.mock.calls.find(
       ([event]) => event === 'did-start-navigation'
@@ -282,8 +295,8 @@ describe('browserManager', () => {
 
     expect(guest.setUserAgent).not.toHaveBeenCalled()
     expect(sendCommand.mock.calls).toEqual([
-      ['Emulation.setUserAgentOverride', { userAgent: guestBaseUserAgent }],
-      ['Emulation.setUserAgentOverride', { userAgent: guestBaseUserAgent }]
+      ['Emulation.setUserAgentOverride', { userAgent: '' }],
+      ['Emulation.setUserAgentOverride', { userAgent: '' }]
     ])
 
     // A newer confirmed write outranks an older write that remains in flight.
@@ -330,9 +343,7 @@ describe('browserManager', () => {
 
     sendCommand.mockClear()
     didStartNavigation(null, 'https://example.com/', false, true)
-    expect(sendCommand).toHaveBeenCalledWith('Emulation.setUserAgentOverride', {
-      userAgent: guestBaseUserAgent
-    })
+    expect(sendCommand).toHaveBeenCalledWith('Emulation.setUserAgentOverride', { userAgent: '' })
     browserManager.unregisterGuest('browser-redirect-ua')
   })
 
@@ -420,14 +431,14 @@ describe('browserManager', () => {
     )
   })
 
-  // Why: the direct-navigation branch still writes the Firefox UA through WebContents.setUserAgent,
-  // and nothing ever restores it once the guest switches to the CDP override. A viewport preset that
-  // read getUserAgent() back as its base identity would therefore republish Firefox on every ordinary
-  // host — the wire UA saying Firefox while sec-ch-ua still says Chrome, the exact cross-layer tell
-  // this scope exists to remove.
-  it('keeps a viewport preset on the session identity after an auth-host visit', async () => {
+  // Why: a direct navigation onto the auth host writes Firefox into the WebContents UA, and a redirect
+  // off it cannot rewrite that layer without cancelling the navigation. Clearing the CDP override
+  // there would expose that stale Firefox UA on an ordinary host, so the override must carry the
+  // process identity until the next direct navigation can restore the WebContents UA and clear it.
+  it('never clears the override onto a stale Firefox WebContents UA and heals it on the next navigation', async () => {
     browserMocks.processUserAgent = GUEST_CLEAN_UA
-    const { guest, debuggerSendCommand } = makeViewportGuest(9001)
+    const { guest, debuggerSendCommand, presentedUserAgent, standingUserAgentOverride } =
+      makeViewportGuest(9001)
     webContentsFromIdMock.mockReturnValue(guest)
     browserManager.attachGuestPolicies(guest as never)
     browserManager.registerGuest({
@@ -452,22 +463,23 @@ describe('browserManager', () => {
 
     didStartNavigation(null, 'https://accounts.google.com/v3/signin/identifier', false, true)
     await flushViewportOps()
-    // The direct branch pins the WebContents UA to Firefox and never restores it.
     expect((guest.getUserAgent as () => string)()).toBe(googleAuthUserAgent())
 
+    debuggerSendCommand.mockClear()
     willRedirect({ preventDefault: vi.fn() }, 'https://myaccount.google.com/', false, true)
     await flushViewportOps()
+    expect(debuggerSendCommand).toHaveBeenLastCalledWith('Emulation.setUserAgentOverride', {
+      userAgent: GUEST_CLEAN_UA
+    })
+    expect(presentedUserAgent()).toBe(GUEST_CLEAN_UA)
 
     debuggerSendCommand.mockClear()
     didStartNavigation(null, 'https://github.com/', false, true)
     await flushViewportOps()
-
-    const uaWrites = debuggerSendCommand.mock.calls.filter(
-      ([method]) => method === 'Emulation.setUserAgentOverride'
-    )
-    expect(uaWrites.length).toBeGreaterThan(0)
-    for (const [, params] of uaWrites) {
-      expect((params as { userAgent: string }).userAgent).toBe(GUEST_CLEAN_UA)
-    }
+    expect(debuggerSendCommand).toHaveBeenLastCalledWith('Emulation.setUserAgentOverride', {
+      userAgent: ''
+    })
+    expect(standingUserAgentOverride()).toBeNull()
+    expect(presentedUserAgent()).toBe(GUEST_CLEAN_UA)
   })
 })
diff --git a/src/main/browser/browser-manager-bindings.ts b/src/main/browser/browser-manager-bindings.ts
index 931c5c6bc3b..4bd30d4dc92 100644
--- a/src/main/browser/browser-manager-bindings.ts
+++ b/src/main/browser/browser-manager-bindings.ts
@@ -77,8 +77,8 @@ export abstract class BrowserManagerBindings extends BrowserManagerGrab {
         resolveRenderer: (tabId) =>
           resolveRendererWebContents(this.rendererWebContentsIdByTabId, tabId),
         isViewportPresetActive: () => {
-          const state = this.viewportPresetActiveByTabId.get(browserTabId)
-          return state?.guestWebContentsId === guest.id && state.active
+          const state = this.viewportPresetByTabId.get(browserTabId)
+          return state?.guestWebContentsId === guest.id && state.requested !== null
         },
         canViewportScroll: (mouse) => this.canViewportScroll(browserTabId, mouse),
         onViewportWheelConsumed: (deltaX, deltaY) =>
diff --git a/src/main/browser/browser-manager-guest-cleanup.ts b/src/main/browser/browser-manager-guest-cleanup.ts
index a815e95e431..67ded30cecc 100644
--- a/src/main/browser/browser-manager-guest-cleanup.ts
+++ b/src/main/browser/browser-manager-guest-cleanup.ts
@@ -23,7 +23,7 @@ export abstract class BrowserManagerGuestCleanup extends BrowserManagerGuestNavi
     this.offscreenGuestIds.delete(guestWebContentsId)
     this.popupOwnerContextByGuestId.delete(guestWebContentsId)
     this.pageInitiatedTabBudgetByRootGuestId.delete(guestWebContentsId)
-    this.authUserAgentOverrideStateByGuestId.delete(guestWebContentsId)
+    this.cdpUserAgentOverrideStateByGuestId.delete(guestWebContentsId)
     this.pendingNavigationByGuestId.delete(guestWebContentsId)
     // Why: a popup must stop inheriting authorization the moment its owner retires, before Chromium destroys the child.
     if (isPrimaryGuest) {
diff --git a/src/main/browser/browser-manager-guest-navigation-policy.ts b/src/main/browser/browser-manager-guest-navigation-policy.ts
index a2b8bf0b329..9e8a301476f 100644
--- a/src/main/browser/browser-manager-guest-navigation-policy.ts
+++ b/src/main/browser/browser-manager-guest-navigation-policy.ts
@@ -35,7 +35,7 @@ export abstract class BrowserManagerGuestNavigationPolicy extends BrowserManager
         return
       }
       this.updatePendingNavigationForRedirect(guest.id, url)
-      this.applyGoogleAuthUserAgent(guest, url, { duringRedirect: true })
+      void this.retargetTabIdentity(guest, url)
     }
 
     const didFailLoadHandler = (
@@ -51,8 +51,8 @@ export abstract class BrowserManagerGuestNavigationPolicy extends BrowserManager
       // Why: a nav that never committed must not leave its target standing as the tab's host.
       const failedNavigationWasCurrent = this.failPendingNavigation(guest.id, validatedURL)
       if (failedNavigationWasCurrent) {
-        // The attempted host never committed, so restore every UA layer to the document that remains.
-        this.applyGoogleAuthUserAgent(guest, guest.getURL())
+        // Restore the identity of the document that remains (usually the failed URL's error page).
+        void this.retargetTabIdentity(guest, guest.getURL())
       }
       const browserPageId = this.tabIdByWebContentsId.get(guest.id)
       const certificateFailure = browserPageId
@@ -91,7 +91,7 @@ export abstract class BrowserManagerGuestNavigationPolicy extends BrowserManager
     const didStartNavigationHandler = (
       _event: Electron.Event,
       url: string,
-      _isInPlace: boolean,
+      isInPlace: boolean,
       isMainFrame: boolean
     ): void => {
       if (!isMainFrame || isChromiumInternalErrorUrl(url)) {
@@ -100,7 +100,7 @@ export abstract class BrowserManagerGuestNavigationPolicy extends BrowserManager
       // Why: getURL() still reports the previous committed URL until this navigation commits, so
       // every UA writer must read the in-flight target or they disagree about the tab's host.
       this.startPendingNavigation(guest.id, url)
-      this.applyGoogleAuthUserAgent(guest, url)
+      void this.presentTabIdentityAtNavigationStart(guest, url, isInPlace)
       this.certificateTrustController?.onMainFrameNavigationStarted(guest.id)
       // Why: a pre-registration failure belongs only to its own nav; a replacement nav must not replay it.
       this.pendingLoadFailuresByGuestId.delete(guest.id)
diff --git a/src/main/browser/browser-manager-guest-policy.ts b/src/main/browser/browser-manager-guest-policy.ts
index dd418d71af7..270df87a9a8 100644
--- a/src/main/browser/browser-manager-guest-policy.ts
+++ b/src/main/browser/browser-manager-guest-policy.ts
@@ -26,7 +26,7 @@ export abstract class BrowserManagerGuestPolicy extends BrowserManagerGuestClean
     if (inheritedOwnerContext) {
       this.popupOwnerContextByGuestId.set(guest.id, inheritedOwnerContext)
     }
-    const disposeAuthDetachTracking = this.trackDebuggerDetachForAuthUserAgent(guest)
+    const disposeDetachTracking = this.trackDebuggerDetachForCdpOverrides(guest)
     // Why: disable throttling so background screenshots still get frames; else the compositor stalls and capture returns empty.
     guest.setBackgroundThrottling(false)
     const disposePopupPolicy = this.installGuestPopupPolicy(guest, !inheritedOwnerContext)
@@ -34,7 +34,7 @@ export abstract class BrowserManagerGuestPolicy extends BrowserManagerGuestClean
 
     // Why: store cleanup so unregisterGuest can drop these listeners on teardown and let the WebContents wrapper GC.
     this.policyCleanupByGuestId.set(guest.id, () => {
-      disposeAuthDetachTracking()
+      disposeDetachTracking()
       disposePopupPolicy()
       disposeNavigationPolicy()
     })
diff --git a/src/main/browser/browser-manager-navigation.ts b/src/main/browser/browser-manager-navigation.ts
index a7dcf5cd4fc..1911e9c92b6 100644
--- a/src/main/browser/browser-manager-navigation.ts
+++ b/src/main/browser/browser-manager-navigation.ts
@@ -1,145 +1,152 @@
 import { openPopupWithOriginBar, type PopupChildWindowOptions } from './popup-origin-bar-window'
 import { getBrowserProcessUserAgentIdentity } from './browser-process-user-agent'
 import type { BrowserSessionRequestUserAgentResolver } from './browser-session-ua'
-import { googleAuthUserAgent, isGoogleAuthUrl } from './browser-google-auth-ua'
+import { isGoogleAuthUrl } from './browser-google-auth-ua'
 import {
-  buildViewportUserAgentOverride,
-  type ViewportUserAgentOverride
-} from './browser-viewport-user-agent'
+  googleAuthTabIdentity,
+  resolveBrowserTabIdentity,
+  type BrowserTabIdentity
+} from './browser-tab-identity'
 import {
   safeOrigin,
-  type AuthUserAgentOverrideOperation,
-  type AuthUserAgentOverrideState
+  type CdpUserAgentOverride,
+  type CdpUserAgentOverrideOperation,
+  type CdpUserAgentOverrideState
 } from './browser-manager-types'
 import { BrowserManagerVisibility } from './browser-manager-visibility'
 
 export abstract class BrowserManagerNavigation extends BrowserManagerVisibility {
   resolveBrowserGuestRequestUserAgent(
     request: Parameters<BrowserSessionRequestUserAgentResolver>[0]
-  ): ViewportUserAgentOverride {
-    const identity = getBrowserProcessUserAgentIdentity()
-    const firefoxUa = googleAuthUserAgent()
+  ): BrowserTabIdentity {
+    const processIdentity = getBrowserProcessUserAgentIdentity()
+    const googleAuth = googleAuthTabIdentity()
     const pendingNavigation =
       request.webContentsId === undefined
         ? undefined
         : this.pendingNavigationByGuestId.get(request.webContentsId)
     // Firefox is delivered per-target and cannot reach workers; keep it clean-only to preserve one
     // coherent identity per mode instead of pairing a Firefox document with native workers.
-    const googleAuthEnabled = identity.mode === 'clean'
+    const googleAuthEnabled = processIdentity.mode === 'clean'
     if (
       googleAuthEnabled &&
-      request.currentUserAgent === firefoxUa &&
+      request.currentUserAgent === googleAuth.userAgent &&
       (!pendingNavigation || isGoogleAuthUrl(pendingNavigation.currentUrl))
     ) {
-      return { userAgent: firefoxUa }
+      return googleAuth
     }
-    const overrideState =
+    const standingOverride =
       request.webContentsId === undefined
         ? undefined
-        : this.authUserAgentOverrideStateByGuestId.get(request.webContentsId)
-    const latestPendingOverride = overrideState?.pending.at(-1)
-    const currentOverride =
-      latestPendingOverride &&
-      latestPendingOverride.sequence > (overrideState?.confirmed?.sequence ?? -1)
-        ? latestPendingOverride
-        : overrideState?.confirmed
+        : this.standingCdpUserAgentOverride(request.webContentsId)
     if (
       googleAuthEnabled &&
-      !currentOverride &&
-      request.effectiveUserAgent === firefoxUa &&
+      !standingOverride &&
+      request.effectiveUserAgent === googleAuth.userAgent &&
       (!pendingNavigation || isGoogleAuthUrl(pendingNavigation.currentUrl))
     ) {
-      return { userAgent: firefoxUa }
+      return googleAuth
     }
-    if (googleAuthEnabled && currentOverride?.userAgent === firefoxUa) {
-      return { userAgent: firefoxUa }
+    if (googleAuthEnabled && standingOverride?.userAgent === googleAuth.userAgent) {
+      return googleAuth
     }
-    const browserPageId =
-      request.webContentsId === undefined
-        ? undefined
-        : this.tabIdByWebContentsId.get(request.webContentsId)
     // Shared and service worker requests carry no webContentsId, and resolving a session-wide mobile
     // intent for one put the mobile UA on the wire for a context whose own navigator.userAgent is
     // desktop-clean — and for every tab sharing the session. One context, one identity: those workers
     // stay on the session identity, while emulation reaches documents and the emulated tab's dedicated
-    // workers, which carry the owning webContentsId and so resolve through browserPageId.
-    const mobile = browserPageId
-      ? (this.viewportUaOverrideMobileByTabId.get(browserPageId) ?? false)
-      : false
-    return buildViewportUserAgentOverride({
+    // workers, which carry the owning webContentsId.
+    // Why the standing override and not the requested preset: the wire must match what the document
+    // presents, and a preset whose CDP write never landed (no debugger, a failed write) presents none.
+    return resolveBrowserTabIdentity({
       url: request.url,
-      mobile,
-      baseUserAgent: identity.userAgent,
-      googleAuthEnabled
+      mobile: standingOverride?.userAgentMetadata?.mobile === true,
+      processIdentity
     })
   }
 
-  // Why: navigator.userAgent (read by Google's auth JS) reflects the WebContents UA,
-  // not the request header, so the Firefox switch in the session request hook
-  // must be matched here per navigation or the two layers disagree — itself a bot tell.
-  protected applyGoogleAuthUserAgent(
+  // Why: gate on the DIRECT page id, not ownerTabId — a popup has no device-metrics override of its
+  // own, so inheriting the owner tab's preset would pair a mobile UA with a desktop viewport.
+  protected hasMobileViewportApplied(guestWebContentsId: number): boolean {
+    const browserPageId = this.tabIdByWebContentsId.get(guestWebContentsId)
+    const preset = browserPageId ? this.viewportPresetByTabId.get(browserPageId) : undefined
+    return preset?.guestWebContentsId === guestWebContentsId && preset.applied?.mobile === true
+  }
+
+  /**
+   * The only writer of the WebContents UA. Chromium cancels a redirect, and reloads a loading
+   * document, when that UA changes at any other moment; a cross-document did-start-navigation is
+   * the one point where it lands on the new document alone. Call it synchronously from that event.
+   */
+  protected presentTabIdentityAtNavigationStart(
     guest: Electron.WebContents,
     url: string,
-    options: { duringRedirect?: boolean } = {}
-  ): void {
-    const browserPageId = this.tabIdByWebContentsId.get(guest.id)
-    const identity = getBrowserProcessUserAgentIdentity()
-    if (identity.mode === 'native') {
-      if (browserPageId) {
-        this.reapplyViewportUserAgentOverride(guest, browserPageId, url)
-      }
-      return
-    }
-    const firefoxUa = googleAuthUserAgent()
-    const overrideState = this.authUserAgentOverrideStateByGuestId.get(guest.id)
-    const latestPendingOverride = overrideState?.pending.at(-1)
-    const confirmedOverride = overrideState?.confirmed
-    const currentOverride =
-      latestPendingOverride && latestPendingOverride.sequence > (confirmedOverride?.sequence ?? -1)
-        ? latestPendingOverride
-        : confirmedOverride
-    const currentUa = currentOverride?.userAgent ?? guest.getUserAgent()
-    const nextUa = isGoogleAuthUrl(url)
-      ? firefoxUa
-      : // Only restore when the auth-host override is actually in place, so normal
-        // navigation never touches the session UA.
-        currentUa === firefoxUa
+    sameDocument: boolean
+  ): Promise<boolean> {
+    const identity = this.resolveGuestTabIdentity(guest, url)
+    // The WebContents UA carries no mobile identity: that needs metadata only CDP can send.
+    const webContentsUserAgent =
+      identity.kind === 'google-auth'
         ? identity.userAgent
-        : null
-    let authOverrideIssuedOverCdp = false
-    if (nextUa !== null && nextUa !== currentUa) {
-      // Why: WebContents.setUserAgent() during a redirect makes Chromium cancel the in-flight
-      // navigation (ERR_ABORTED) and replay the original request, which a POST-started OAuth chain
-      // cannot survive — the sign-in lands on a blank tab. CDP retargets navigator.userAgent without
-      // touching the navigation, and it outranks the WebContents UA from then on, so a guest that
-      // switches to it stays on it. The wire UA never depended on this write:
-      // The session request hook rewrites User-Agent for auth-host URLs on its own.
-      if (options.duringRedirect === true || overrideState !== undefined) {
-        if (this.canOverrideUserAgentOverCdp(guest)) {
-          authOverrideIssuedOverCdp = true
-          // Why: go through the viewport builder rather than writing nextUa raw, so both CDP writers
-          // resolve one identity for this URL — Firefox on auth hosts, the profile's clean base off
-          // them, any mobile preset preserved. Writing the session UA directly would put the
-          // unlaundered Electron token back on the wire.
-          void this.applyAuthUserAgentOverrideOverCdp(
-            guest,
-            (browserPageId ? this.viewportUaOverrideMobileByTabId.get(browserPageId) : undefined) ??
-              false,
-            url,
-            nextUa
-          )
-        }
-        // Why: with no debugger there is no way to retarget the identity without cancelling the
-        // redirect. A stale navigator.userAgent is recoverable; a dead navigation is not.
-      } else {
-        guest.setUserAgent(nextUa)
-      }
+        : getBrowserProcessUserAgentIdentity().userAgent
+    let presentedByWebContents = guest.getUserAgent()
+    if (!sameDocument && presentedByWebContents !== webContentsUserAgent) {
+      guest.setUserAgent(webContentsUserAgent)
+      presentedByWebContents = webContentsUserAgent
     }
-    // Why: gate on the DIRECT page id, not ownerTabId — a popup has no device-metrics override of
-    // its own, so inheriting the owner tab's preset UA would pair a mobile UA with a desktop viewport.
-    if (browserPageId && !authOverrideIssuedOverCdp) {
-      this.reapplyViewportUserAgentOverride(guest, browserPageId, url)
+    return this.writeTabIdentityOverride(guest, identity, presentedByWebContents)
+  }
+
+  /** Every other identity change (redirects, failed loads, preset changes) goes over CDP only. */
+  protected retargetTabIdentity(guest: Electron.WebContents, url: string): Promise<boolean> {
+    return this.writeTabIdentityOverride(
+      guest,
+      this.resolveGuestTabIdentity(guest, url),
+      guest.getUserAgent()
+    )
+  }
+
+  private resolveGuestTabIdentity(guest: Electron.WebContents, url: string): BrowserTabIdentity {
+    return resolveBrowserTabIdentity({
+      url,
+      mobile: this.hasMobileViewportApplied(guest.id),
+      processIdentity: getBrowserProcessUserAgentIdentity()
+    })
+  }
+
+  // Why clear rather than restate: any override without userAgentMetadata makes Chromium drop
+  // navigator.userAgentData and every sec-ch-ua header, so it stands only when the WebContents UA
+  // cannot present the identity itself.
+  private writeTabIdentityOverride(
+    guest: Electron.WebContents,
+    identity: BrowserTabIdentity,
+    presentedByWebContents: string
+  ): Promise<boolean> {
+    const override: CdpUserAgentOverride =
+      identity.kind === 'mobile'
+        ? { userAgent: identity.userAgent, userAgentMetadata: identity.userAgentMetadata }
+        : presentedByWebContents === identity.userAgent
+          ? { userAgent: '' }
+          : // Only reachable before a navigation start can rewrite the WebContents UA (a redirect
+            // off the auth host, a failed load); the next cross-document navigation clears it.
+            { userAgent: identity.userAgent }
+    if (override.userAgent === '' && !this.standingCdpUserAgentOverride(guest.id)) {
+      return Promise.resolve(true)
     }
+    // Why: with no debugger there is no way to retarget the identity without cancelling a redirect.
+    // A stale navigator.userAgent is recoverable; a dead navigation is not. The wire UA never
+    // depended on this write: the session request hook rewrites User-Agent on its own.
+    return this.writeCdpUserAgentOverride(guest, override)
+  }
+
+  /** The override Chromium holds or is about to hold; undefined when none stands. */
+  protected standingCdpUserAgentOverride(guestId: number): CdpUserAgentOverride | undefined {
+    const state = this.cdpUserAgentOverrideStateByGuestId.get(guestId)
+    const latestPending = state?.pending.at(-1)
+    const current =
+      latestPending && latestPending.sequence > (state?.confirmed?.sequence ?? -1)
+        ? latestPending
+        : state?.confirmed
+    return current && current.override.userAgent !== '' ? current.override : undefined
   }
 
   protected canOverrideUserAgentOverCdp(guest: Electron.WebContents): boolean {
@@ -150,39 +157,43 @@ export abstract class BrowserManagerNavigation extends BrowserManagerVisibility
     }
   }
 
-  protected applyAuthUserAgentOverrideOverCdp(
+  // Why no queue: debugger.sendCommand dispatches in call order over one channel, so the later-issued
+  // write wins. The sequence only keeps a failed or superseded write from being recorded as standing.
+  protected writeCdpUserAgentOverride(
     guest: Electron.WebContents,
-    mobile: boolean,
-    url: string,
-    userAgent: string
+    override: CdpUserAgentOverride
   ): Promise<boolean> {
     if (!this.canOverrideUserAgentOverCdp(guest)) {
       return Promise.resolve(false)
     }
-    const state = this.authUserAgentOverrideStateByGuestId.get(guest.id) ?? {
+    const state = this.cdpUserAgentOverrideStateByGuestId.get(guest.id) ?? {
       confirmed: null,
       nextSequence: 0,
       pending: []
     }
-    const operation = { sequence: ++state.nextSequence, userAgent }
+    const operation = { sequence: ++state.nextSequence, override }
     state.pending.push(operation)
-    this.authUserAgentOverrideStateByGuestId.set(guest.id, state)
-    return this.sendViewportUserAgentOverride(guest, mobile, url, userAgent).then(
-      () => this.settleAuthUserAgentOverride(guest.id, state, operation, true),
-      () => {
-        this.settleAuthUserAgentOverride(guest.id, state, operation, false)
+    this.cdpUserAgentOverrideStateByGuestId.set(guest.id, state)
+    return guest.debugger.sendCommand('Emulation.setUserAgentOverride', override).then(
+      () => this.settleCdpUserAgentOverride(guest.id, state, operation, true),
+      (error: unknown) => {
+        this.settleCdpUserAgentOverride(guest.id, state, operation, false)
+        console.warn('[browser-manager] failed to write the tab user agent override', {
+          guestWebContentsId: guest.id,
+          error: error instanceof Error ? error.message : String(error)
+        })
         return false
       }
     )
   }
 
-  protected settleAuthUserAgentOverride(
+  protected settleCdpUserAgentOverride(
     guestId: number,
-    state: AuthUserAgentOverrideState,
-    operation: AuthUserAgentOverrideOperation,
+    state: CdpUserAgentOverrideState,
+    operation: CdpUserAgentOverrideOperation,
     succeeded: boolean
   ): boolean {
-    if (this.authUserAgentOverrideStateByGuestId.get(guestId) !== state) {
+    if (this.cdpUserAgentOverrideStateByGuestId.get(guestId) !== state) {
       return false
     }
     if (succeeded && (state.confirmed?.sequence ?? -1) < operation.sequence) {
@@ -192,10 +203,13 @@ export abstract class BrowserManagerNavigation extends BrowserManagerVisibility
     if (pendingIndex !== -1) {
       state.pending.splice(pendingIndex, 1)
     }
-    if (state.confirmed === null && state.pending.length === 0) {
-      this.authUserAgentOverrideStateByGuestId.delete(guestId)
+    if (
+      (state.confirmed === null || state.confirmed.override.userAgent === '') &&
+      state.pending.length === 0
+    ) {
+      this.cdpUserAgentOverrideStateByGuestId.delete(guestId)
     }
-    return true
+    return succeeded
   }
 
   protected startPendingNavigation(guestId: number, url: string): void {
@@ -242,48 +256,6 @@ export abstract class BrowserManagerNavigation extends BrowserManagerVisibility
     return this.pendingNavigationByGuestId.get(guest.id)?.currentUrl ?? guest.getURL()
   }
 
-  // Why: Emulation.setUserAgentOverride is set once and stands across every later navigation,
-  // outranking setUserAgent for navigator.userAgent. A viewport preset applied before reaching an
-  // auth host would otherwise pin navigator.userAgent to the Chrome-shaped preset UA while the
-  // request header says Firefox — the two-layer disagreement this scope exists to remove.
-  protected reapplyViewportUserAgentOverride(
-    guest: Electron.WebContents,
-    browserTabId: string,
-    url: string
-  ): void {
-    const mobile = this.viewportUaOverrideMobileByTabId.get(browserTabId)
-    if (mobile === undefined) {
-      return
-    }
-    // Why: no queue needed — debugger.sendCommand dispatches in call order over one channel, so the
-    // later-issued write wins. What matters is that both writers resolve the SAME host, which they
-    // now do via the navigation target rather than the stale committed URL.
-    void this.sendViewportUserAgentOverride(guest, mobile, url).catch(() => {})
-  }
-
-  protected async sendViewportUserAgentOverride(
-    guest: Electron.WebContents,
-    mobile: boolean,
-    url?: string,
-    baseUserAgent?: string
-  ): Promise<void> {
-    if (guest.isDestroyed() || !guest.debugger.isAttached()) {
-      return
-    }
-    await guest.debugger.sendCommand(
-      'Emulation.setUserAgentOverride',
-      buildViewportUserAgentOverride({
-        url: url ?? this.resolveTabNavigationUrl(guest),
-        mobile,
-        // Why: the session UA is the profile's stable base identity. guest.getUserAgent() is not:
-        // applyGoogleAuthUserAgent leaves it pinned to the Firefox auth UA once a guest switches to
-        // the CDP override, so reading it back here would republish that identity on ordinary hosts.
-        baseUserAgent: baseUserAgent ?? getBrowserProcessUserAgentIdentity().userAgent,
-        googleAuthEnabled: getBrowserProcessUserAgentIdentity().mode === 'clean'
-      })
-    )
-  }
-
   /** Route guests own their own popup handler, so their denials arrive here instead. */
   reportRouteGuestPopupBlocked(input: { openerWebContentsId: number; url: string }): void {
     this.forwardOrQueuePopupEvent(input.openerWebContentsId, {
diff --git a/src/main/browser/browser-manager-registration.ts b/src/main/browser/browser-manager-registration.ts
index 816c0d61cb2..f6f7b41bbb9 100644
--- a/src/main/browser/browser-manager-registration.ts
+++ b/src/main/browser/browser-manager-registration.ts
@@ -46,7 +46,7 @@ export abstract class BrowserManagerRegistration extends BrowserManagerGuestPoli
     const previousWebContentsId = this.webContentsIdByTabId.get(browserTabId)
     if (previousWebContentsId !== undefined && previousWebContentsId !== webContentsId) {
       this.retireStaleGuestWebContents(previousWebContentsId)
-      this.viewportPresetActiveByTabId.delete(browserTabId)
+      this.viewportPresetByTabId.delete(browserTabId)
       this.viewportScrollStateByTabId.delete(browserTabId)
     }
     this.webContentsIdByTabId.set(browserTabId, webContentsId)
@@ -135,8 +135,7 @@ export abstract class BrowserManagerRegistration extends BrowserManagerGuestPoli
     this.worktreeIdByTabId.delete(browserTabId)
     // Why: drop the viewport-op chain so the Map doesn't retain a promise keyed to a destroyed guest.
     this.viewportOpsByTabId.delete(browserTabId)
-    this.viewportUaOverrideMobileByTabId.delete(browserTabId)
-    this.viewportPresetActiveByTabId.delete(browserTabId)
+    this.viewportPresetByTabId.delete(browserTabId)
     this.viewportScrollStateByTabId.delete(browserTabId)
     if (wcId !== undefined) {
       this.pendingNavigationByGuestId.delete(wcId)
@@ -171,7 +170,7 @@ export abstract class BrowserManagerRegistration extends BrowserManagerGuestPoli
     const previousWebContentsId = this.webContentsIdByTabId.get(browserPageId)
     if (previousWebContentsId !== undefined && previousWebContentsId !== webContentsId) {
       this.retireStaleGuestWebContents(previousWebContentsId)
-      this.viewportPresetActiveByTabId.delete(browserPageId)
+      this.viewportPresetByTabId.delete(browserPageId)
       this.viewportScrollStateByTabId.delete(browserPageId)
     }
     this.webContentsIdByTabId.set(browserPageId, webContentsId)
@@ -206,10 +205,9 @@ export abstract class BrowserManagerRegistration extends BrowserManagerGuestPoli
     this.pageInitiatedTabBudgetByRootGuestId.clear()
     this.worktreeIdByTabId.clear()
     this.sessionProfileIdByPageId.clear()
-    this.viewportUaOverrideMobileByTabId.clear()
-    this.viewportPresetActiveByTabId.clear()
+    this.viewportPresetByTabId.clear()
     this.viewportScrollStateByTabId.clear()
-    this.authUserAgentOverrideStateByGuestId.clear()
+    this.cdpUserAgentOverrideStateByGuestId.clear()
     this.pendingNavigationByGuestId.clear()
     this.pendingLoadFailuresByGuestId.clear()
     this.loadErrorsByGuestId.clear()
diff --git a/src/main/browser/browser-manager-state.ts b/src/main/browser/browser-manager-state.ts
index da7fa256b4e..411c67d6c37 100644
--- a/src/main/browser/browser-manager-state.ts
+++ b/src/main/browser/browser-manager-state.ts
@@ -9,7 +9,7 @@ import type { BrowserLoadError } from '../../shared/browser-workspace-types'
 import { resolveBrowserRouteGuestPopupOpener } from './browser-route-guest-popup-ownership'
 import type {
   ActiveDownload,
-  AuthUserAgentOverrideState,
+  CdpUserAgentOverrideState,
   PendingMainFrameNavigation,
   PendingPermissionEvent,
   PendingPopupEvent,
@@ -125,14 +125,11 @@ export abstract class BrowserManagerState extends BrowserManagerViewportScrollSt
   protected readonly sessionProfileIdByPageId = new Map<string, string | null>()
   // Why: serialize per-tab setViewportOverride so rapid toggles don't interleave CDP commands and leave emulation in a wrong state.
   protected readonly viewportOpsByTabId = new Map<string, Promise<unknown>>()
-  // Why: presence means the preset requires a CDP UA override (installed or in flight), so navigation
-  // can re-issue it against the target URL's identity.
-  protected readonly viewportUaOverrideMobileByTabId = new Map<string, boolean>()
   // Why: the confirmed CDP identity outranks getUserAgent; pending intent keeps rapid navigations
   // ordered without claiming a failed write was installed.
-  protected readonly authUserAgentOverrideStateByGuestId = new Map<
+  protected readonly cdpUserAgentOverrideStateByGuestId = new Map<
     number,
-    AuthUserAgentOverrideState
+    CdpUserAgentOverrideState
   >()
   // Why: the in-flight main-frame navigation target, held only until commit or failure — getURL()
   // still reports the outgoing page until then. See resolveTabNavigationUrl.
@@ -191,12 +188,15 @@ export abstract class BrowserManagerState extends BrowserManagerViewportScrollSt
     this.settingsResolver = resolver
   }
 
-  // Why: a debugger detach clears every CDP override Chromium holds, including the Google auth-host
-  // UA override, so the confirmed-override record must be dropped or the next auth navigation
-  // believes the identity is still installed and skips the write.
-  protected trackDebuggerDetachForAuthUserAgent(guest: Electron.WebContents): () => void {
+  // Why: a debugger detach clears every CDP override Chromium holds, including the UA override and
+  // device metrics, so both records must be dropped or navigation believes they still stand.
+  protected trackDebuggerDetachForCdpOverrides(guest: Electron.WebContents): () => void {
     const onDetach = (): void => {
-      this.authUserAgentOverrideStateByGuestId.delete(guest.id)
+      this.cdpUserAgentOverrideStateByGuestId.delete(guest.id)
+      const browserTabId = this.tabIdByWebContentsId.get(guest.id)
+      if (browserTabId) {
+        this.recordAppliedViewportOverride(browserTabId, guest.id, null)
+      }
     }
     try {
       guest.debugger.on('detach', onDetach)
diff --git a/src/main/browser/browser-manager-tab-identity.test.ts b/src/main/browser/browser-manager-tab-identity.test.ts
new file mode 100644
index 00000000000..d930f1d8ae1
--- /dev/null
+++ b/src/main/browser/browser-manager-tab-identity.test.ts
@@ -0,0 +1,488 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  appGetPathMock: vi.fn(() => '/downloads'),
+  shellOpenExternalMock: vi.fn(),
+  browserWindowFromWebContentsMock: vi.fn(),
+  menuBuildFromTemplateMock: vi.fn(),
+  guestOffMock: vi.fn(),
+  guestOnMock: vi.fn(),
+  guestSetBackgroundThrottlingMock: vi.fn(),
+  guestSetWindowOpenHandlerMock: vi.fn(),
+  guestOpenDevToolsMock: vi.fn(),
+  webContentsFromIdMock: vi.fn(),
+  screenGetCursorScreenPointMock: vi.fn(() => ({ x: 0, y: 0 })),
+  openPopupWithOriginBarMock: vi.fn(),
+  processUserAgentMode: 'clean',
+  processUserAgent: ''
+}))
+
+vi.mock('electron', () => ({
+  app: { getPath: mocks.appGetPathMock },
+  BrowserWindow: { fromWebContents: mocks.browserWindowFromWebContentsMock },
+  clipboard: { writeText: vi.fn() },
+  shell: { openExternal: mocks.shellOpenExternalMock },
+  Menu: { buildFromTemplate: mocks.menuBuildFromTemplateMock },
+  screen: { getCursorScreenPoint: mocks.screenGetCursorScreenPointMock },
+  webContents: { fromId: mocks.webContentsFromIdMock }
+}))
+vi.mock('./popup-origin-bar-window', () => ({
+  openPopupWithOriginBar: mocks.openPopupWithOriginBarMock
+}))
+vi.mock('./browser-process-user-agent', () => ({
+  getBrowserProcessUserAgentIdentity: () => ({
+    mode: mocks.processUserAgentMode,
+    userAgent: mocks.processUserAgent
+  })
+}))
+
+import { browserManager } from './browser-manager'
+import { googleAuthUserAgent } from './browser-google-auth-ua'
+import { resetBrowserManagerMocks, resetBrowserManagerState } from './browser-manager-test-harness'
+import {
+  createViewportGuestFactory,
+  flushViewportOps,
+  GUEST_CLEAN_UA,
+  GUEST_ELECTRON_UA,
+  type ViewportGuestHandle
+} from './browser-manager-viewport-test-fixtures'
+
+const makeGuest = createViewportGuestFactory(mocks)
+const guests = new Map<number, Record<string, unknown>>()
+const PRESETS = {
+  none: null,
+  desktop: { width: 1440, height: 900, deviceScaleFactor: 1, mobile: false },
+  mobile: { width: 375, height: 667, deviceScaleFactor: 2, mobile: true }
+} as const
+type Preset = keyof typeof PRESETS
+const MODES = [
+  ['clean', GUEST_CLEAN_UA],
+  ['native', GUEST_ELECTRON_UA]
+] as const
+const ORDINARY_URL = 'https://example.com/'
+const AUTH_URL = 'https://accounts.google.com/v3/signin/identifier'
+const APP_TOKENS = /Electron\/|orca\//i
+let nextGuestId = 7000
+
+type Observed = {
+  presented: string
+  standingOverride: Record<string, unknown> | null
+  requestIdentity: ReturnType<typeof browserManager.resolveBrowserGuestRequestUserAgent>
+}
+
+/** Opens a tab on `url` the way a real load does: did-start-navigation runs before any preset. */
+function openTab(url: string): { tab: string; id: number; handle: ViewportGuestHandle } {
+  const id = nextGuestId++
+  const tab = `tab-${id}`
+  const handle = makeGuest(id, url)
+  guests.set(id, handle.guest)
+  expect(browserManager.registerOffscreenGuest({ browserPageId: tab, webContentsId: id })).toBe(
+    true
+  )
+  navigate(url)
+  return { tab, id, handle }
+}
+
+function navigate(url: string, { inPlace = false } = {}): void {
+  const didStartNavigation = mocks.guestOnMock.mock.calls.findLast(
+    ([event]) => event === 'did-start-navigation'
+  )?.[1]
+  expect(didStartNavigation).toBeTypeOf('function')
+  didStartNavigation(null, url, inPlace, true)
+}
+
+function redirectTo(url: string): void {
+  const willRedirect = mocks.guestOnMock.mock.calls.findLast(
+    ([event]) => event === 'will-redirect'
+  )?.[1]
+  willRedirect({ preventDefault: vi.fn() }, url, false, true)
+}
+
+// A redirect target that fails: the one failed-load path whose restore could otherwise write the UA.
+function failLoad(url: string): void {
+  redirectTo(url)
+  const didFailLoad = mocks.guestOnMock.mock.calls.findLast(
+    ([event]) => event === 'did-fail-load'
+  )?.[1]
+  didFailLoad(null, -102, 'ERR_CONNECTION_REFUSED', url, true)
+}
+
+function failDeviceMetrics(handle: ViewportGuestHandle): void {
+  handle.debuggerSendCommand.mockImplementation((method: string) =>
+    method === 'Emulation.setDeviceMetricsOverride' ||
+    method === 'Emulation.clearDeviceMetricsOverride'
+      ? Promise.reject(new Error('Inspected target navigated or closed'))
+      : Promise.resolve(undefined)
+  )
+}
+
+function debuggerDetachHandler(handle: ViewportGuestHandle): () => void {
+  const debuggerApi = handle.guest.debugger
+  const on =
+    debuggerApi && typeof debuggerApi === 'object' && 'on' in debuggerApi ? debuggerApi.on : null
+  if (!vi.isMockFunction(on)) {
+    throw new Error('Expected a mocked debugger.on')
+  }
+  const handler: unknown = on.mock.calls.findLast(([event]) => event === 'detach')?.[1]
+  if (typeof handler !== 'function') {
+    throw new Error('Expected a debugger detach handler')
+  }
+  return () => handler()
+}
+
+async function observe(
+  { id, handle }: { id: number; handle: ViewportGuestHandle },
+  url: string
+): Promise<Observed> {
+  await flushViewportOps()
+  return {
+    presented: handle.presentedUserAgent(),
+    standingOverride: handle.standingUserAgentOverride(),
+    requestIdentity: browserManager.resolveBrowserGuestRequestUserAgent({
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the resolver reads no Session member.
+      session: handle.guest.session as Electron.Session,
+      url,
+      webContentsId: id
+    })
+  }
+}
+
+async function presentWith(url: string, preset: Preset): Promise<Observed> {
+  const opened = openTab(url)
+  const override = PRESETS[preset]
+  if (override) {
+    await browserManager.setViewportOverride(opened.tab, override)
+  }
+  return observe(opened, url)
+}
+
+// Why: Chromium drops navigator.userAgentData and every sec-ch-ua header for a UA override that
+// carries no userAgentMetadata, so only Firefox (which sends no hints) may stand without it.
+function expectClientHintsKept(observed: Observed): void {
+  const override = observed.standingOverride
+  if (override && override.userAgent !== googleAuthUserAgent()) {
+    expect(override.userAgentMetadata).toBeDefined()
+  }
+}
+
+describe('tab identity ownership', () => {
+  beforeEach(() => {
+    expect(process.env.ORCA_BACKGROUND_LAUNCH).toBe('1')
+    resetBrowserManagerMocks(mocks)
+    resetBrowserManagerState()
+    guests.clear()
+    mocks.webContentsFromIdMock.mockImplementation((id) => guests.get(id))
+  })
+  afterEach(() => {
+    browserManager.unregisterAll()
+    vi.restoreAllMocks()
+  })
+
+  describe.each(MODES)('in %s mode', (mode, processUserAgent) => {
+    beforeEach(() => {
+      mocks.processUserAgentMode = mode
+      mocks.processUserAgent = processUserAgent
+    })
+
+    it.each([ORDINARY_URL, AUTH_URL])(
+      'presents the same identity with a desktop preset as with none on %s',
+      async (url) => {
+        const none = await presentWith(url, 'none')
+        const desktop = await presentWith(url, 'desktop')
+        expect(desktop).toEqual(none)
+        expectClientHintsKept(desktop)
+        const expected =
+          mode === 'clean' && url === AUTH_URL ? googleAuthUserAgent() : processUserAgent
+        expect(desktop.presented).toBe(expected)
+        expect(desktop.requestIdentity.userAgent).toBe(expected)
+        expect(desktop.requestIdentity.kind).toBe(
+          expected === processUserAgent ? 'process' : 'google-auth'
+        )
+      }
+    )
+
+    it('presents the mobile identity with matching client hints on an ordinary host', async () => {
+      const observed = await presentWith(ORDINARY_URL, 'mobile')
+      expect(observed.presented).toContain('iPhone')
+      expect(observed.standingOverride).toMatchObject({
+        userAgentMetadata: expect.objectContaining({ mobile: true, platform: 'iOS' })
+      })
+      expect(observed.requestIdentity.kind).toBe('mobile')
+      expect(observed.requestIdentity.userAgent).toBe(observed.presented)
+    })
+
+    it('keeps the Google sign-in identity ahead of a mobile preset only in clean mode', async () => {
+      const observed = await presentWith(AUTH_URL, 'mobile')
+      expectClientHintsKept(observed)
+      if (mode === 'clean') {
+        expect(observed.presented).toBe(googleAuthUserAgent())
+        expect(observed.requestIdentity.kind).toBe('google-auth')
+      } else {
+        expect(observed.presented).toContain('iPhone')
+        expect(observed.requestIdentity.kind).toBe('mobile')
+      }
+    })
+
+    it.each(['desktop', 'none'] as const)(
+      'restores the process identity when switching from mobile to %s',
+      async (next) => {
+        const opened = openTab(ORDINARY_URL)
+        await browserManager.setViewportOverride(opened.tab, PRESETS.mobile)
+        expect(opened.handle.presentedUserAgent()).toContain('iPhone')
+
+        await browserManager.setViewportOverride(opened.tab, PRESETS[next])
+        const observed = await observe(opened, ORDINARY_URL)
+        expect(observed.presented).toBe(processUserAgent)
+        expect(observed.standingOverride).toBeNull()
+        expect(observed.requestIdentity).toEqual({ kind: 'process', userAgent: processUserAgent })
+      }
+    )
+  })
+
+  it('never puts the Electron or app tokens on a clean-mode tab under any preset', async () => {
+    mocks.processUserAgentMode = 'clean'
+    mocks.processUserAgent = GUEST_CLEAN_UA
+    for (const url of [ORDINARY_URL, AUTH_URL]) {
+      for (const preset of ['none', 'desktop', 'mobile'] as const) {
+        const observed = await presentWith(url, preset)
+        expect(observed.presented).not.toMatch(APP_TOKENS)
+        expect(observed.requestIdentity.userAgent).not.toMatch(APP_TOKENS)
+      }
+    }
+  })
+
+  // Why: Chromium rejects touch emulation with maxTouchPoints 0, so every step after it used to be
+  // skipped and the mobile UA outlived its preset. Identity is no longer a step after touch.
+  it('restores the process identity and reports the failure when touch emulation is rejected', async () => {
+    mocks.processUserAgentMode = 'clean'
+    mocks.processUserAgent = GUEST_CLEAN_UA
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const opened = openTab(ORDINARY_URL)
+    await browserManager.setViewportOverride(opened.tab, PRESETS.mobile)
+    // Rejects whatever the payload, so the test outlives a fix to the payload itself.
+    opened.handle.debuggerSendCommand.mockImplementation((method: string) =>
+      method === 'Emulation.setTouchEmulationEnabled'
+        ? Promise.reject(new Error('Touch points must be between 1 and 16'))
+        : Promise.resolve(undefined)
+    )
+
+    await expect(browserManager.setViewportOverride(opened.tab, PRESETS.desktop)).resolves.toBe(
+      false
+    )
+    const observed = await observe(opened, ORDINARY_URL)
+    expect(observed.presented).toBe(GUEST_CLEAN_UA)
+    expect(observed.standingOverride).toBeNull()
+    expect(warn).toHaveBeenCalledWith(
+      '[browser-manager] setViewportOverride: touch emulation failed',
+      expect.objectContaining({ error: 'Touch points must be between 1 and 16' })
+    )
+  })
+
+  // Why: identity follows the viewport Chromium holds, so a phone identity never stands on a desktop
+  // viewport. The renderer re-sends the preset on the next page load, which heals the tab.
+  it('keeps the process identity when a mobile preset cannot apply its device metrics', async () => {
+    mocks.processUserAgentMode = 'clean'
+    mocks.processUserAgent = GUEST_CLEAN_UA
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const opened = openTab(ORDINARY_URL)
+    failDeviceMetrics(opened.handle)
+
+    await expect(browserManager.setViewportOverride(opened.tab, PRESETS.mobile)).resolves.toBe(
+      false
+    )
+    const failed = await observe(opened, ORDINARY_URL)
+    expect(failed.presented).toBe(GUEST_CLEAN_UA)
+    expect(failed.standingOverride).toBeNull()
+    expect(failed.requestIdentity).toEqual({ kind: 'process', userAgent: GUEST_CLEAN_UA })
+    navigate('https://example.org/')
+    expect((await observe(opened, 'https://example.org/')).presented).toBe(GUEST_CLEAN_UA)
+
+    opened.handle.debuggerSendCommand.mockResolvedValue(undefined)
+    await expect(browserManager.setViewportOverride(opened.tab, PRESETS.mobile)).resolves.toBe(true)
+    expect((await observe(opened, 'https://example.org/')).requestIdentity.kind).toBe('mobile')
+  })
+
+  it.each(['desktop', 'none'] as const)(
+    'keeps the mobile identity while the phone viewport stands when switching to %s fails',
+    async (next) => {
+      mocks.processUserAgentMode = 'clean'
+      mocks.processUserAgent = GUEST_CLEAN_UA
+      vi.spyOn(console, 'warn').mockImplementation(() => {})
+      const opened = openTab(ORDINARY_URL)
+      await browserManager.setViewportOverride(opened.tab, PRESETS.mobile)
+      failDeviceMetrics(opened.handle)
+
+      await expect(browserManager.setViewportOverride(opened.tab, PRESETS[next])).resolves.toBe(
+        false
+      )
+      const failed = await observe(opened, ORDINARY_URL)
+      expect(failed.presented).toContain('iPhone')
+      expect(failed.requestIdentity.kind).toBe('mobile')
+      navigate('https://example.org/')
+      const reloaded = await observe(opened, 'https://example.org/')
+      expect(reloaded.presented).toContain('iPhone')
+      expect(reloaded.requestIdentity.kind).toBe('mobile')
+    }
+  )
+
+  // Why: a detach clears the device metrics along with the UA override, so the next page must not
+  // reinstall a phone identity on the desktop viewport that remains.
+  it('drops the mobile identity once a debugger detach clears the device metrics', async () => {
+    mocks.processUserAgentMode = 'clean'
+    mocks.processUserAgent = GUEST_CLEAN_UA
+    const opened = openTab(ORDINARY_URL)
+    await browserManager.setViewportOverride(opened.tab, PRESETS.mobile)
+    expect(opened.handle.presentedUserAgent()).toContain('iPhone')
+
+    debuggerDetachHandler(opened.handle)()
+    opened.handle.debuggerSendCommand.mockClear()
+    navigate('https://example.org/')
+    const observed = await observe(opened, 'https://example.org/')
+    expect(opened.handle.debuggerSendCommand).not.toHaveBeenCalledWith(
+      'Emulation.setUserAgentOverride',
+      expect.anything()
+    )
+    expect(observed.requestIdentity).toEqual({ kind: 'process', userAgent: GUEST_CLEAN_UA })
+  })
+
+  it('does not let a mid-apply debugger detach leave a mobile identity to reinstall', async () => {
+    mocks.processUserAgentMode = 'clean'
+    mocks.processUserAgent = GUEST_CLEAN_UA
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const opened = openTab(ORDINARY_URL)
+    const detach = debuggerDetachHandler(opened.handle)
+    opened.handle.debuggerSendCommand.mockImplementation((method: string) => {
+      if (method !== 'Emulation.setTouchEmulationEnabled') {
+        return Promise.resolve(undefined)
+      }
+      opened.handle.debuggerIsAttached.mockReturnValue(false)
+      detach()
+      return Promise.reject(new Error('Debugger is not attached'))
+    })
+
+    await expect(browserManager.setViewportOverride(opened.tab, PRESETS.mobile)).resolves.toBe(
+      false
+    )
+    // Another CDP client (the agent bridge) re-attaches before the preset is sent again.
+    opened.handle.debuggerIsAttached.mockReturnValue(true)
+    opened.handle.debuggerSendCommand.mockClear()
+    navigate('https://example.org/')
+    const observed = await observe(opened, 'https://example.org/')
+    expect(opened.handle.debuggerSendCommand).not.toHaveBeenCalledWith(
+      'Emulation.setUserAgentOverride',
+      expect.anything()
+    )
+    expect(observed.requestIdentity).toEqual({ kind: 'process', userAgent: GUEST_CLEAN_UA })
+  })
+
+  it('heals a mid-redirect process override on the next navigation', async () => {
+    mocks.processUserAgentMode = 'clean'
+    mocks.processUserAgent = GUEST_CLEAN_UA
+    const opened = openTab(AUTH_URL)
+    await browserManager.setViewportOverride(opened.tab, PRESETS.desktop)
+    const willRedirect = mocks.guestOnMock.mock.calls.findLast(
+      ([event]) => event === 'will-redirect'
+    )?.[1]
+    willRedirect({ preventDefault: vi.fn() }, ORDINARY_URL, false, true)
+    // The WebContents UA still says Firefox, so clearing here would expose it on an ordinary host.
+    expect((await observe(opened, ORDINARY_URL)).presented).toBe(GUEST_CLEAN_UA)
+
+    navigate('https://example.org/')
+    const healed = await observe(opened, 'https://example.org/')
+    expect(healed.presented).toBe(GUEST_CLEAN_UA)
+    expect(healed.standingOverride).toBeNull()
+  })
+
+  // Why a table over every entry point: Chromium cancels a redirect, and reloads a loading document,
+  // when the WebContents UA changes anywhere but a cross-document navigation start.
+  it.each([
+    ['a redirect', () => redirectTo(ORDINARY_URL)],
+    ['a failed load', () => failLoad(ORDINARY_URL)],
+    ['a desktop preset', (tab: string) => browserManager.setViewportOverride(tab, PRESETS.desktop)],
+    ['a mobile preset', (tab: string) => browserManager.setViewportOverride(tab, PRESETS.mobile)],
+    ['clearing a preset', (tab: string) => browserManager.setViewportOverride(tab, null)],
+    ['a same-document navigation', () => navigate(`${AUTH_URL}#step`, { inPlace: true })]
+  ])(
+    'writes the WebContents UA only at a cross-document navigation start, not on %s',
+    async (_label, act) => {
+      mocks.processUserAgentMode = 'clean'
+      mocks.processUserAgent = GUEST_CLEAN_UA
+      const opened = openTab(AUTH_URL)
+      expect(opened.handle.guest.setUserAgent).toHaveBeenCalledOnce()
+
+      await act(opened.tab)
+      await flushViewportOps()
+      expect(opened.handle.guest.setUserAgent).toHaveBeenCalledOnce()
+
+      navigate('https://example.org/')
+      // Synchronous: the write must land inside did-start-navigation, before any await.
+      expect(opened.handle.guest.setUserAgent).toHaveBeenCalledTimes(2)
+      expect(opened.handle.webContentsUserAgent()).toBe(GUEST_CLEAN_UA)
+    }
+  )
+
+  // Why: setUserAgent() while a document loads makes Chromium reload it, and an OAuth callback that
+  // strips its code with replaceState would be requested twice — the one-time code replayed.
+  it('leaves the WebContents UA alone on a same-document navigation', async () => {
+    mocks.processUserAgentMode = 'clean'
+    mocks.processUserAgent = GUEST_CLEAN_UA
+    const opened = openTab(AUTH_URL)
+    const willRedirect = mocks.guestOnMock.mock.calls.findLast(
+      ([event]) => event === 'will-redirect'
+    )?.[1]
+    willRedirect({ preventDefault: vi.fn() }, `${ORDINARY_URL}callback?code=1`, false, true)
+    await flushViewportOps()
+
+    navigate(`${ORDINARY_URL}callback`, { inPlace: true })
+    expect(opened.handle.webContentsUserAgent()).toBe(googleAuthUserAgent())
+    expect((await observe(opened, ORDINARY_URL)).presented).toBe(GUEST_CLEAN_UA)
+
+    navigate('https://example.org/')
+    expect(opened.handle.webContentsUserAgent()).toBe(GUEST_CLEAN_UA)
+  })
+
+  // Why: a failed navigation commits an error page that is still loading at did-fail-load, and
+  // setUserAgent() then makes Chromium reload it — the failed request replayed.
+  it('leaves the WebContents UA alone when a redirected navigation fails', async () => {
+    mocks.processUserAgentMode = 'clean'
+    mocks.processUserAgent = GUEST_CLEAN_UA
+    const opened = openTab(ORDINARY_URL)
+    navigate(`${ORDINARY_URL}start`)
+    const willRedirect = mocks.guestOnMock.mock.calls.findLast(
+      ([event]) => event === 'will-redirect'
+    )?.[1]
+    willRedirect({ preventDefault: vi.fn() }, AUTH_URL, false, true)
+    await flushViewportOps()
+
+    opened.handle.commitNavigationTo(AUTH_URL)
+    const didFailLoad = mocks.guestOnMock.mock.calls.findLast(
+      ([event]) => event === 'did-fail-load'
+    )?.[1]
+    didFailLoad(null, -102, 'ERR_CONNECTION_REFUSED', AUTH_URL, true)
+    expect(opened.handle.webContentsUserAgent()).toBe(GUEST_CLEAN_UA)
+    const observed = await observe(opened, AUTH_URL)
+    expect(observed.presented).toBe(googleAuthUserAgent())
+    expect(observed.requestIdentity.kind).toBe('google-auth')
+  })
+
+  // Why: a debugger that cannot attach (DevTools open on the guest) installs no mobile identity, so
+  // requests claiming one would disagree with the document's own navigator.userAgent.
+  it('keeps requests on the presented identity when a mobile preset cannot attach', async () => {
+    mocks.processUserAgentMode = 'clean'
+    mocks.processUserAgent = GUEST_CLEAN_UA
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const opened = openTab(ORDINARY_URL)
+    opened.handle.debuggerIsAttached.mockReturnValue(false)
+    opened.handle.debuggerAttach.mockImplementation(() => {
+      throw new Error('Another debugger is already attached')
+    })
+
+    await expect(browserManager.setViewportOverride(opened.tab, PRESETS.mobile)).resolves.toBe(
+      false
+    )
+    navigate('https://example.org/')
+    const observed = await observe(opened, 'https://example.org/')
+    expect(observed.presented).toBe(GUEST_CLEAN_UA)
+    expect(observed.requestIdentity).toEqual({ kind: 'process', userAgent: GUEST_CLEAN_UA })
+  })
+})
diff --git a/src/main/browser/browser-manager-types.ts b/src/main/browser/browser-manager-types.ts
index 3d3825d6ebe..302cf6468ed 100644
--- a/src/main/browser/browser-manager-types.ts
+++ b/src/main/browser/browser-manager-types.ts
@@ -1,4 +1,5 @@
 import { normalizeExternalBrowserUrl } from '../../shared/browser-url'
+import type { UserAgentMetadata } from './browser-tab-identity'
 import type {
   BrowserDownloadFinishedEvent,
   BrowserDownloadProgressEvent,
@@ -60,15 +61,21 @@ export type PendingMainFrameNavigation = {
   supersededUrls: string[]
 }
 
-export type AuthUserAgentOverrideOperation = {
-  sequence: number
+/** An Emulation.setUserAgentOverride payload; an empty userAgent clears the override. */
+export type CdpUserAgentOverride = {
   userAgent: string
+  userAgentMetadata?: UserAgentMetadata
 }
 
-export type AuthUserAgentOverrideState = {
-  confirmed: AuthUserAgentOverrideOperation | null
+export type CdpUserAgentOverrideOperation = {
+  sequence: number
+  override: CdpUserAgentOverride
+}
+
+export type CdpUserAgentOverrideState = {
+  confirmed: CdpUserAgentOverrideOperation | null
   nextSequence: number
-  pending: AuthUserAgentOverrideOperation[]
+  pending: CdpUserAgentOverrideOperation[]
 }
 
 export const SAFE_POPUP_WINDOW_OPTIONS = {
diff --git a/src/main/browser/browser-manager-viewport-crashed-guest.test.ts b/src/main/browser/browser-manager-viewport-crashed-guest.test.ts
new file mode 100644
index 00000000000..696be1a474b
--- /dev/null
+++ b/src/main/browser/browser-manager-viewport-crashed-guest.test.ts
@@ -0,0 +1,80 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  appGetPathMock: vi.fn(() => '/downloads'),
+  shellOpenExternalMock: vi.fn(),
+  browserWindowFromWebContentsMock: vi.fn(),
+  menuBuildFromTemplateMock: vi.fn(),
+  guestOffMock: vi.fn(),
+  guestOnMock: vi.fn(),
+  guestSetBackgroundThrottlingMock: vi.fn(),
+  guestSetWindowOpenHandlerMock: vi.fn(),
+  guestOpenDevToolsMock: vi.fn(),
+  webContentsFromIdMock: vi.fn(),
+  screenGetCursorScreenPointMock: vi.fn(() => ({ x: 0, y: 0 })),
+  openPopupWithOriginBarMock: vi.fn(),
+  processUserAgent:
+    'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36'
+}))
+
+vi.mock('electron', () => ({
+  app: { getPath: mocks.appGetPathMock },
+  BrowserWindow: { fromWebContents: mocks.browserWindowFromWebContentsMock },
+  clipboard: { writeText: vi.fn() },
+  shell: { openExternal: mocks.shellOpenExternalMock },
+  Menu: { buildFromTemplate: mocks.menuBuildFromTemplateMock },
+  screen: { getCursorScreenPoint: mocks.screenGetCursorScreenPointMock },
+  webContents: { fromId: mocks.webContentsFromIdMock }
+}))
+vi.mock('./popup-origin-bar-window', () => ({
+  openPopupWithOriginBar: mocks.openPopupWithOriginBarMock
+}))
+vi.mock('./browser-process-user-agent', () => ({
+  getBrowserProcessUserAgentIdentity: () => ({ mode: 'clean', userAgent: mocks.processUserAgent })
+}))
+
+import { browserManager } from './browser-manager'
+import {
+  rendererWebContentsId,
+  resetBrowserManagerMocks,
+  resetBrowserManagerState
+} from './browser-manager-test-harness'
+import { createViewportGuestFactory } from './browser-manager-viewport-test-fixtures'
+
+const makeGuest = createViewportGuestFactory(mocks)
+const PHONE = { width: 375, height: 667, deviceScaleFactor: 2, mobile: true } as const
+
+const metricsWrites = (sendCommand: ReturnType<typeof vi.fn>): unknown[][] =>
+  sendCommand.mock.calls.filter(([method]) => method === 'Emulation.setDeviceMetricsOverride')
+
+describe('browserManager viewport on a guest whose renderer crashed', () => {
+  beforeEach(() => {
+    resetBrowserManagerMocks(mocks)
+    resetBrowserManagerState()
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+  })
+
+  it('never resizes the dead guest, and applies the preset once the page reloads', async () => {
+    const { guest, debuggerSendCommand, setRendererCrashed } = makeGuest(42501)
+    mocks.webContentsFromIdMock.mockReturnValue(guest)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the viewport fixture implements every WebContents member these paths touch.
+    browserManager.attachGuestPolicies(guest as never)
+    browserManager.registerGuest({
+      browserPageId: 'tab-crashed',
+      webContentsId: 42501,
+      rendererWebContentsId
+    })
+
+    // Chromium would segfault the main process on this write (its view is gone with the renderer).
+    setRendererCrashed(true)
+    await expect(browserManager.setViewportOverride('tab-crashed', PHONE)).resolves.toBe(false)
+    expect(metricsWrites(debuggerSendCommand)).toEqual([])
+
+    // The reloaded page's dom-ready reapplies the store's preset.
+    setRendererCrashed(false)
+    await expect(browserManager.setViewportOverride('tab-crashed', PHONE)).resolves.toBe(true)
+    expect(metricsWrites(debuggerSendCommand)).toEqual([
+      ['Emulation.setDeviceMetricsOverride', PHONE]
+    ])
+  })
+})
diff --git a/src/main/browser/browser-manager-viewport-override.test.ts b/src/main/browser/browser-manager-viewport-override.test.ts
index 41835a6cd3e..03dd699aa0c 100644
--- a/src/main/browser/browser-manager-viewport-override.test.ts
+++ b/src/main/browser/browser-manager-viewport-override.test.ts
@@ -156,7 +156,8 @@ describe('browserManager', () => {
         if (mobile) {
           expect(userAgentOverride).toMatchObject({ userAgent: expect.stringContaining('iPhone') })
         } else {
-          expect(userAgentOverride).toEqual({ userAgent: GUEST_ELECTRON_UA })
+          // A desktop preset presents the process identity itself, so there is nothing to override.
+          expect(userAgentOverride).toBeUndefined()
         }
       }
     )
@@ -193,8 +194,8 @@ describe('browserManager', () => {
       }
     )
 
-    it('re-issues the standing UA override when navigating onto and back off an auth host', async () => {
-      const { guest, debuggerSendCommand } = makeGuest(4247)
+    it('keeps a desktop-preset tab on the right identity onto and back off an auth host', async () => {
+      const { guest, debuggerSendCommand, presentedUserAgent } = makeGuest(4247)
       webContentsFromIdMock.mockReturnValue(guest)
       browserManager.attachGuestPolicies(guest as never)
       browserManager.registerGuest({
@@ -214,30 +215,25 @@ describe('browserManager', () => {
         isMainFrame: boolean
       ) => void
 
-      // Case A: the desktop preset lands first, while the tab is still off the auth host.
+      // The desktop preset lands first, while the tab is still off the auth host.
       await browserManager.setViewportOverride('tab-auth-nav', {
         width: 1024,
         height: 768,
         deviceScaleFactor: 1,
         mobile: false
       })
-      expect(debuggerSendCommand).toHaveBeenLastCalledWith('Emulation.setUserAgentOverride', {
-        userAgent: GUEST_CLEAN_UA
-      })
+      expect(lastUserAgentOverride(debuggerSendCommand)).toBeUndefined()
+      expect(presentedUserAgent()).toBe(GUEST_CLEAN_UA)
 
-      // Navigating to the auth host must move the standing override to the Firefox identity.
-      debuggerSendCommand.mockClear()
       didStartNavigation(null, 'https://accounts.google.com/v3/signin/identifier', false, true)
       await flushViewportOps()
-      expect(debuggerSendCommand).toHaveBeenCalledWith('Emulation.setUserAgentOverride', {
-        userAgent: googleAuthUserAgent()
-      })
+      expect(presentedUserAgent()).toBe(googleAuthUserAgent())
 
-      // Leaving the auth host restores the clean Chrome-shaped preset UA.
-      debuggerSendCommand.mockClear()
+      // A redirect cannot rewrite the Firefox WebContents UA, so the override carries the process UA.
       willRedirect({ preventDefault: vi.fn() }, 'https://example.com/', false, true)
       await flushViewportOps()
-      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({ userAgent: GUEST_CLEAN_UA })
+      expect(guest.setUserAgent).toHaveBeenCalledTimes(1)
+      expect(presentedUserAgent()).toBe(GUEST_CLEAN_UA)
     })
 
     // Why: not an ordering race — debugger.sendCommand dispatches in call order over one channel, so
@@ -255,12 +251,13 @@ describe('browserManager', () => {
       return calls.at(-1)?.[1] as Record<string, unknown> | undefined
     }
 
-    // Why mobile: on the desktop branch the break is masked by coincidence — applyGoogleAuthUserAgent
-    // has already switched the WebContents UA to Firefox, and cleanElectronUserAgent passes a Firefox
-    // UA through untouched, so the stale-URL desktop path happens to emit Firefox anyway. The mobile
-    // branch derives a Chrome-shaped iPhone UA from that same base and exposes the real defect.
+    // Why mobile: a desktop preset installs no override at all, so only the mobile write can leave a
+    // Chrome-shaped UA standing on the auth host.
     it('does not leave the Chrome preset UA standing when a mobile preset lands mid-navigation onto an auth host', async () => {
-      const { guest, debuggerSendCommand } = makeGuest(4251, 'https://example.com/')
+      const { guest, debuggerSendCommand, presentedUserAgent } = makeGuest(
+        4251,
+        'https://example.com/'
+      )
       // Hold the preset's first CDP command open so the navigation lands inside its await window.
       let releaseMetrics = (): void => {}
       const metricsGate = new Promise<void>((resolve) => {
@@ -294,13 +291,18 @@ describe('browserManager', () => {
 
       // Without a shared chain + shared URL source, the preset resumes, reads getURL() as the
       // pre-navigation host, and pins the tab to the Chrome-shaped UA while it is on the auth host.
-      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({
-        userAgent: googleAuthUserAgent()
-      })
+      expect(presentedUserAgent()).toBe(googleAuthUserAgent())
+      expect(debuggerSendCommand).not.toHaveBeenCalledWith(
+        'Emulation.setUserAgentOverride',
+        expect.objectContaining({ userAgent: expect.stringContaining('iPhone') })
+      )
     })
 
     it('does not leave the Firefox UA standing when a preset lands mid-navigation off an auth host', async () => {
-      const { guest, debuggerSendCommand } = makeGuest(4252, 'https://accounts.google.com/')
+      const { guest, debuggerSendCommand, presentedUserAgent } = makeGuest(
+        4252,
+        'https://accounts.google.com/'
+      )
       webContentsFromIdMock.mockReturnValue(guest)
       browserManager.attachGuestPolicies(guest as never)
       browserManager.registerGuest({
@@ -347,11 +349,12 @@ describe('browserManager', () => {
 
       // Without the fix the resuming preset re-reads getURL() as the auth host and clobbers the
       // navigation's correct write, stranding the Firefox UA on a non-auth page.
-      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({ userAgent: GUEST_CLEAN_UA })
+      expect(presentedUserAgent()).toBe(GUEST_CLEAN_UA)
+      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({ userAgent: '' })
     })
 
     it('falls back to the committed URL once a navigation commits or fails', async () => {
-      const { guest, debuggerSendCommand, commitNavigationTo } = makeGuest(
+      const { guest, debuggerSendCommand, commitNavigationTo, presentedUserAgent } = makeGuest(
         4253,
         'https://example.com/'
       )
@@ -392,8 +395,9 @@ describe('browserManager', () => {
       didFailLoad(null, -3, 'Aborted', 'https://accounts.google.com/', true)
       await flushViewportOps()
 
-      expect(guest.setUserAgent).toHaveBeenLastCalledWith(GUEST_CLEAN_UA)
-      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({ userAgent: GUEST_CLEAN_UA })
+      // The restore goes over CDP: only did-start-navigation wrote the WebContents UA.
+      expect(guest.setUserAgent).toHaveBeenCalledOnce()
+      expect(presentedUserAgent()).toBe(GUEST_CLEAN_UA)
 
       // A later preset must also resolve the committed, non-auth URL.
       debuggerSendCommand.mockClear()
@@ -407,7 +411,6 @@ describe('browserManager', () => {
       didNavigate(null, 'https://accounts.google.com/signin')
       await flushViewportOps()
 
-      debuggerSendCommand.mockClear()
       await browserManager.setViewportOverride('tab-pending-cleared', {
         width: 1024,
         height: 768,
@@ -415,13 +418,14 @@ describe('browserManager', () => {
         mobile: false
       })
       await flushViewportOps()
-      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({
-        userAgent: googleAuthUserAgent()
-      })
+      expect(presentedUserAgent()).toBe(googleAuthUserAgent())
     })
 
     it('does not let a superseded navigation failure revert a newer target', async () => {
-      const { guest, debuggerSendCommand } = makeGuest(4255, 'https://example.com/')
+      const { guest, debuggerSendCommand, presentedUserAgent } = makeGuest(
+        4255,
+        'https://example.com/'
+      )
       webContentsFromIdMock.mockReturnValue(guest)
       browserManager.attachGuestPolicies(guest as never)
       browserManager.registerGuest({
@@ -460,20 +464,19 @@ describe('browserManager', () => {
       willRedirect({ preventDefault: vi.fn() }, 'https://accounts.google.com/same', false, true)
       didStartNavigation(null, 'https://accounts.google.com/same', false, true)
       await flushViewportOps()
-      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({
-        userAgent: googleAuthUserAgent()
-      })
+      expect(presentedUserAgent()).toBe(googleAuthUserAgent())
 
       debuggerSendCommand.mockClear()
       didFailLoad(null, -3, 'Aborted', 'https://accounts.google.com/same', true)
       await flushViewportOps()
 
-      // Why: the redirect path never writes the WebContents UA — that write cancels the navigation.
-      expect(guest.setUserAgent).not.toHaveBeenCalled()
+      // Only the direct navigation onto the auth host wrote the WebContents UA.
+      expect(guest.setUserAgent).toHaveBeenCalledOnce()
       expect(debuggerSendCommand).not.toHaveBeenCalledWith(
         'Emulation.setUserAgentOverride',
-        expect.objectContaining({ userAgent: GUEST_CLEAN_UA })
+        expect.anything()
       )
+      expect(presentedUserAgent()).toBe(googleAuthUserAgent())
     })
 
     it('switches identity for a server redirect and restores it if the redirect fails', async () => {
@@ -529,10 +532,11 @@ describe('browserManager', () => {
         userAgent: googleAuthUserAgent()
       })
 
+      // The WebContents UA never left the process identity, so restoring it clears the override.
       didFailLoad(null, -3, 'Aborted', 'https://accounts.google.com/redirected', true)
       await flushViewportOps()
       expect(guest.setUserAgent).not.toHaveBeenCalled()
-      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({ userAgent: GUEST_CLEAN_UA })
+      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({ userAgent: '' })
     })
 
     it('preserves the auth identity when a viewport preset is cleared after a redirect', async () => {
@@ -584,7 +588,11 @@ describe('browserManager', () => {
       })
       await browserManager.setViewportOverride('tab-mobile-popup-owner', MOBILE_VIEWPORT_OVERRIDE)
 
-      const { guest: popupGuest, debuggerSendCommand } = makeGuest(4264, 'https://mail.google.com/')
+      const {
+        guest: popupGuest,
+        debuggerSendCommand,
+        presentedUserAgent
+      } = makeGuest(4264, 'https://mail.google.com/')
       const popupOn = vi.fn()
       popupGuest.on = popupOn
       browserManager.attachGuestPolicies(popupGuest as never, {
@@ -607,11 +615,18 @@ describe('browserManager', () => {
       didStartNavigation(null, 'https://example.com/', false, true)
       await flushViewportOps()
 
-      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({ userAgent: GUEST_CLEAN_UA })
+      expect(presentedUserAgent()).toBe(GUEST_CLEAN_UA)
+      expect(debuggerSendCommand).not.toHaveBeenCalledWith(
+        'Emulation.setUserAgentOverride',
+        expect.objectContaining({ userAgent: expect.stringContaining('iPhone') })
+      )
     })
 
     it('reapplies a preset when navigation starts during its final UA write', async () => {
-      const { guest, debuggerSendCommand } = makeGuest(4257, 'https://example.com/')
+      const { guest, debuggerSendCommand, presentedUserAgent } = makeGuest(
+        4257,
+        'https://example.com/'
+      )
       let releaseFirstUa = (): void => {}
       const firstUaGate = new Promise<void>((resolve) => {
         releaseFirstUa = resolve
@@ -634,25 +649,26 @@ describe('browserManager', () => {
         ([event]) => event === 'did-start-navigation'
       )?.[1] as (event: unknown, url: string, isInPlace: boolean, isMainFrame: boolean) => void
 
-      const presetDone = browserManager.setViewportOverride('tab-final-apply-race', {
-        width: 1024,
-        height: 768,
-        deviceScaleFactor: 1,
-        mobile: false
-      })
+      const presetDone = browserManager.setViewportOverride(
+        'tab-final-apply-race',
+        MOBILE_VIEWPORT_OVERRIDE
+      )
       await flushViewportOps()
       didStartNavigation(null, 'https://accounts.google.com/', false, true)
       await flushViewportOps()
 
-      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({
-        userAgent: googleAuthUserAgent()
-      })
+      // The navigation's write is issued after the held mobile write, so it wins however they settle.
       releaseFirstUa()
       await presetDone
+      await flushViewportOps()
+      expect(presentedUserAgent()).toBe(googleAuthUserAgent())
     })
 
     it('does not reinstall a preset while its final UA clear is in flight', async () => {
-      const { guest, debuggerSendCommand } = makeGuest(4258, 'https://example.com/')
+      const { guest, debuggerSendCommand, presentedUserAgent } = makeGuest(
+        4258,
+        'https://example.com/'
+      )
       webContentsFromIdMock.mockReturnValue(guest)
       browserManager.attachGuestPolicies(guest as never)
       browserManager.registerGuest({
@@ -664,12 +680,7 @@ describe('browserManager', () => {
         ([event]) => event === 'did-start-navigation'
       )?.[1] as (event: unknown, url: string, isInPlace: boolean, isMainFrame: boolean) => void
 
-      await browserManager.setViewportOverride('tab-final-clear-race', {
-        width: 1024,
-        height: 768,
-        deviceScaleFactor: 1,
-        mobile: false
-      })
+      await browserManager.setViewportOverride('tab-final-clear-race', MOBILE_VIEWPORT_OVERRIDE)
       let releaseClearUa = (): void => {}
       const clearUaGate = new Promise<void>((resolve) => {
         releaseClearUa = resolve
@@ -686,19 +697,25 @@ describe('browserManager', () => {
       debuggerSendCommand.mockClear()
       didStartNavigation(null, 'https://accounts.google.com/', false, true)
       await flushViewportOps()
-      expect(debuggerSendCommand).not.toHaveBeenCalledWith('Emulation.setUserAgentOverride', {
-        userAgent: googleAuthUserAgent()
-      })
+      expect(debuggerSendCommand).not.toHaveBeenCalledWith(
+        'Emulation.setUserAgentOverride',
+        expect.objectContaining({ userAgent: expect.stringContaining('iPhone') })
+      )
 
       releaseClearUa()
       await clearDone
+      await flushViewportOps()
+      expect(presentedUserAgent()).toBe(googleAuthUserAgent())
     })
 
     // Why: a failed clear leaves the CDP override standing on the target. Dropping the tracking entry
     // first makes it untracked, so the navigation path can never correct it again and the tab carries
     // a Chrome-shaped navigator.userAgent onto the auth hosts — the exact failure this PR prevents.
     it('keeps tracking the standing override when the CDP clear fails', async () => {
-      const { guest, debuggerSendCommand } = makeGuest(4254, 'https://example.com/')
+      const { guest, debuggerSendCommand, presentedUserAgent } = makeGuest(
+        4254,
+        'https://example.com/'
+      )
       webContentsFromIdMock.mockReturnValue(guest)
       browserManager.attachGuestPolicies(guest as never)
       browserManager.registerGuest({
@@ -710,15 +727,10 @@ describe('browserManager', () => {
         ([event]) => event === 'did-start-navigation'
       )?.[1] as (event: unknown, url: string, isInPlace: boolean, isMainFrame: boolean) => void
 
-      await browserManager.setViewportOverride('tab-failed-clear', {
-        width: 1024,
-        height: 768,
-        deviceScaleFactor: 1,
-        mobile: false
-      })
+      await browserManager.setViewportOverride('tab-failed-clear', MOBILE_VIEWPORT_OVERRIDE)
       await flushViewportOps()
 
-      // The final UA clear fails after tracking was optimistically removed.
+      // The final UA clear fails, leaving the mobile override standing.
       debuggerSendCommand.mockImplementation(
         (method: string, params: { userAgent?: string } | undefined) =>
           method === 'Emulation.setUserAgentOverride' && params?.userAgent === ''
@@ -736,8 +748,9 @@ describe('browserManager', () => {
       didStartNavigation(null, 'https://accounts.google.com/v3/signin/identifier', false, true)
       await flushViewportOps()
       expect(debuggerSendCommand).toHaveBeenCalledWith('Emulation.setUserAgentOverride', {
-        userAgent: googleAuthUserAgent()
+        userAgent: ''
       })
+      expect(presentedUserAgent()).toBe(googleAuthUserAgent())
     })
 
     it('does not touch the UA override on navigation when no preset is standing', async () => {
@@ -774,12 +787,7 @@ describe('browserManager', () => {
         ([event]) => event === 'did-start-navigation'
       )?.[1] as (event: unknown, url: string, isInPlace: boolean, isMainFrame: boolean) => void
 
-      await browserManager.setViewportOverride('tab-cleared-preset', {
-        width: 1024,
-        height: 768,
-        deviceScaleFactor: 1,
-        mobile: false
-      })
+      await browserManager.setViewportOverride('tab-cleared-preset', MOBILE_VIEWPORT_OVERRIDE)
       await browserManager.setViewportOverride('tab-cleared-preset', null)
 
       debuggerSendCommand.mockClear()
@@ -791,7 +799,7 @@ describe('browserManager', () => {
       )
     })
 
-    it('reapplies the native process identity instead of the Google exception', async () => {
+    it('keeps a native-mode mobile preset off the Google exception on navigation', async () => {
       browserMocks.processUserAgentMode = 'native'
       browserMocks.processUserAgent = GUEST_ELECTRON_UA
       const { guest, debuggerSendCommand } = makeGuest(4250)
@@ -807,17 +815,13 @@ describe('browserManager', () => {
         ([event]) => event === 'did-start-navigation'
       )?.[1] as (event: unknown, url: string, isInPlace: boolean, isMainFrame: boolean) => void
 
-      await browserManager.setViewportOverride('tab-native-nav', {
-        width: 1024,
-        height: 768,
-        deviceScaleFactor: 1,
-        mobile: false
-      })
+      await browserManager.setViewportOverride('tab-native-nav', MOBILE_VIEWPORT_OVERRIDE)
       debuggerSendCommand.mockClear()
       didStartNavigation(null, 'https://accounts.google.com/', false, true)
       await flushViewportOps()
-      expect(debuggerSendCommand).toHaveBeenCalledWith('Emulation.setUserAgentOverride', {
-        userAgent: GUEST_ELECTRON_UA
+      expect(guest.setUserAgent).not.toHaveBeenCalled()
+      expect(lastUserAgentOverride(debuggerSendCommand)).toMatchObject({
+        userAgent: expect.stringContaining('iPhone')
       })
     })
 
@@ -836,12 +840,28 @@ describe('browserManager', () => {
 
       expect(debuggerSendCommand).toHaveBeenCalledWith('Emulation.clearDeviceMetricsOverride', {})
       expect(debuggerSendCommand).toHaveBeenCalledWith('Emulation.setTouchEmulationEnabled', {
-        enabled: false,
-        maxTouchPoints: 0
+        enabled: false
       })
-      expect(debuggerSendCommand).toHaveBeenCalledWith('Emulation.setUserAgentOverride', {
-        userAgent: ''
+      // Nothing overrode the identity, so there is nothing to clear.
+      expect(lastUserAgentOverride(debuggerSendCommand)).toBeUndefined()
+    })
+
+    it('clears the mobile identity for override=null', async () => {
+      const { guest, debuggerSendCommand, presentedUserAgent } = makeGuest(4344)
+      webContentsFromIdMock.mockReturnValue(guest)
+      browserManager.attachGuestPolicies(guest as never)
+      browserManager.registerGuest({
+        browserPageId: 'tab-clear-mobile',
+        webContentsId: guest.id as number,
+        rendererWebContentsId
       })
+
+      await browserManager.setViewportOverride('tab-clear-mobile', MOBILE_VIEWPORT_OVERRIDE)
+      await expect(browserManager.setViewportOverride('tab-clear-mobile', null)).resolves.toBe(true)
+      await flushViewportOps()
+
+      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({ userAgent: '' })
+      expect(presentedUserAgent()).toBe(GUEST_CLEAN_UA)
     })
 
     it('attaches the debugger if not already attached and does not detach after', async () => {
diff --git a/src/main/browser/browser-manager-viewport-ownership.test.ts b/src/main/browser/browser-manager-viewport-ownership.test.ts
index 8b4492f36fd..82984751011 100644
--- a/src/main/browser/browser-manager-viewport-ownership.test.ts
+++ b/src/main/browser/browser-manager-viewport-ownership.test.ts
@@ -50,16 +50,16 @@ const mobile = { width: 375, height: 667, deviceScaleFactor: 2, mobile: true }
 const desktop = { width: 1440, height: 900, deviceScaleFactor: 1, mobile: false }
 const guests = new Map<number, Record<string, unknown>>()
 const registeredGuests = readViewportStateMap('webContentsIdByTabId')
-const uaIntents = readViewportStateMap('viewportUaOverrideMobileByTabId')
-const presetIntents = readViewportStateMap('viewportPresetActiveByTabId')
+const presetIntents = readViewportStateMap('viewportPresetByTabId')
 const pendingOperations = readViewportStateMap('viewportOpsByTabId')
+const cdpUserAgentOverrides = readViewportStateMap('cdpUserAgentOverrideStateByGuestId')
 
 function readViewportStateMap(
   name:
     | 'webContentsIdByTabId'
-    | 'viewportUaOverrideMobileByTabId'
-    | 'viewportPresetActiveByTabId'
+    | 'viewportPresetByTabId'
     | 'viewportOpsByTabId'
+    | 'cdpUserAgentOverrideStateByGuestId'
 ): Map<unknown, unknown> {
   const value: unknown = browserManager[name]
   if (!(value instanceof Map)) {
@@ -116,7 +116,7 @@ describe('browser viewport operation ownership', () => {
     const result = browserManager.setViewportOverride('closed', mobile)
     await gate.entered
     browserManager.unregisterGuest('closed')
-    expect(uaIntents.size).toBe(0)
+    expect(presetIntents.size).toBe(0)
     const isDestroyed = handle.guest.isDestroyed
     expect(vi.isMockFunction(isDestroyed)).toBe(true)
     if (vi.isMockFunction(isDestroyed)) {
@@ -126,7 +126,7 @@ describe('browser viewport operation ownership', () => {
     await expect(result).resolves.toBe(false)
     expect(registeredGuests.size).toBe(0)
     expect(presetIntents.size).toBe(0)
-    expect(uaIntents.get('closed')).toBeUndefined()
+    expect(cdpUserAgentOverrides.size).toBe(0)
   })
 
   it('does not restore closed-tab UA intent after a failed clear', async () => {
@@ -143,7 +143,8 @@ describe('browser viewport operation ownership', () => {
     }
     gate.reject(new Error('Target closed'))
     await expect(result).resolves.toBe(false)
-    expect(uaIntents.get('clear-close')).toBeUndefined()
+    expect(presetIntents.get('clear-close')).toBeUndefined()
+    expect(cdpUserAgentOverrides.size).toBe(0)
   })
 
   it('preserves replacement desktop intent after an old clear fails', async () => {
@@ -155,14 +156,13 @@ describe('browser viewport operation ownership', () => {
     browserManager.unregisterGuest('replacement')
     register('replacement', 103)
     await expect(browserManager.setViewportOverride('replacement', desktop)).resolves.toBe(true)
-    expect(uaIntents.get('replacement')).toBe(false)
     gate.reject(new Error('Old target closed'))
     await expect(result).resolves.toBe(false)
     expect(registeredGuests.get('replacement')).toBe(103)
-    expect(uaIntents.get('replacement')).toBe(false)
     expect(presetIntents.get('replacement')).toEqual({
       guestWebContentsId: 103,
-      active: true
+      requested: desktop,
+      applied: desktop
     })
   })
 
@@ -177,11 +177,17 @@ describe('browser viewport operation ownership', () => {
     await browserManager.setViewportOverride('late-delete', mobile)
     gate.resolve()
     await expect(result).resolves.toBe(false)
-    expect(uaIntents.has('late-delete')).toBe(true)
+    expect(presetIntents.get('late-delete')).toEqual({
+      guestWebContentsId: 105,
+      requested: mobile,
+      applied: mobile
+    })
     expect(registeredGuests.get('late-delete')).toBe(105)
   })
 
-  it('same-owner clear failure still restores the legitimate earlier intent', async () => {
+  // The request is still "no preset"; what survives the failure is the record that the mobile
+  // override stands, which is what lets the next navigation clear it.
+  it('same-owner clear failure keeps the standing mobile override tracked', async () => {
     const handle = register('same-owner', 106)
     await browserManager.setViewportOverride('same-owner', mobile)
     const gate = pause(handle, 'Emulation.setUserAgentOverride')
@@ -189,7 +195,13 @@ describe('browser viewport operation ownership', () => {
     await gate.entered
     gate.reject(new Error('Protocol error'))
     await expect(result).resolves.toBe(false)
-    expect(uaIntents.get('same-owner')).toBe(true)
+    expect(presetIntents.get('same-owner')).toEqual({
+      guestWebContentsId: 106,
+      requested: null,
+      applied: null
+    })
+    expect(handle.presentedUserAgent()).toContain('iPhone')
+    expect(cdpUserAgentOverrides.has(106)).toBe(true)
   })
 
   it('old apply cannot overwrite a replacement guest desktop intent', async () => {
@@ -202,7 +214,15 @@ describe('browser viewport operation ownership', () => {
     await browserManager.setViewportOverride('late-apply', desktop)
     gate.resolve()
     await expect(pending).resolves.toBe(false)
-    expect(uaIntents.get('late-apply')).toBe(false)
+    expect(presetIntents.get('late-apply')).toEqual({
+      guestWebContentsId: 111,
+      requested: desktop,
+      applied: desktop
+    })
+    expect(old.debuggerSendCommand).not.toHaveBeenCalledWith(
+      'Emulation.setUserAgentOverride',
+      expect.anything()
+    )
   })
 
   it('an old guest cannot write UA intent after replacement in native process mode', async () => {
@@ -216,7 +236,11 @@ describe('browser viewport operation ownership', () => {
     register('native-replacement', 113)
     gate.resolve()
     await expect(pending).resolves.toBe(false)
-    expect(uaIntents.get('native-replacement')).toBeUndefined()
+    expect(presetIntents.get('native-replacement')).toBeUndefined()
+    expect(old.debuggerSendCommand).not.toHaveBeenCalledWith(
+      'Emulation.setUserAgentOverride',
+      expect.anything()
+    )
   })
 
   it('old queued operations cannot remove or join a replacement promise tail', async () => {
@@ -240,7 +264,12 @@ describe('browser viewport operation ownership', () => {
     await expect(replacementFirst).resolves.toBe(true)
     await expect(replacementSecond).resolves.toBe(true)
     expect(pendingOperations.size).toBe(0)
-    expect(uaIntents.get('queued-replacement')).toBe(true)
+    expect(presetIntents.get('queued-replacement')).toEqual({
+      guestWebContentsId: 115,
+      requested: mobile,
+      applied: mobile
+    })
+    expect(replacement.presentedUserAgent()).toContain('iPhone')
   })
 
   it('normal same-owner toggles preserve last-requested order and remove the promise tail', async () => {
@@ -252,6 +281,8 @@ describe('browser viewport operation ownership', () => {
     const third = browserManager.setViewportOverride('serialized', null)
     gate.resolve()
     expect(await Promise.all([first, second, third])).toEqual([true, true, true])
+    // Identity follows each viewport as it is applied, so the mobile UA stands only while the mobile
+    // metrics do and is cleared once the desktop metrics land.
     expect(handle.debuggerSendCommand.mock.calls.map(([method]) => method)).toEqual([
       'Emulation.setDeviceMetricsOverride',
       'Emulation.setTouchEmulationEnabled',
@@ -260,11 +291,15 @@ describe('browser viewport operation ownership', () => {
       'Emulation.setTouchEmulationEnabled',
       'Emulation.setUserAgentOverride',
       'Emulation.clearDeviceMetricsOverride',
-      'Emulation.setTouchEmulationEnabled',
-      'Emulation.setUserAgentOverride'
+      'Emulation.setTouchEmulationEnabled'
     ])
+    expect(handle.presentedUserAgent()).toBe(GUEST_CLEAN_UA)
     expect(pendingOperations.size).toBe(0)
-    expect(uaIntents.size).toBe(0)
+    expect(presetIntents.get('serialized')).toEqual({
+      guestWebContentsId: 116,
+      requested: null,
+      applied: null
+    })
   })
 
   it.each([false, true])(
@@ -276,13 +311,20 @@ describe('browser viewport operation ownership', () => {
       await expect(
         browserManager.setViewportOverride('native', mobileMode ? mobile : desktop)
       ).resolves.toBe(true)
-      expect(handle.debuggerSendCommand).toHaveBeenCalledWith(
-        'Emulation.setUserAgentOverride',
-        mobileMode
-          ? expect.objectContaining({ userAgent: expect.stringContaining('iPhone') })
-          : { userAgent: GUEST_ELECTRON_UA }
+      if (mobileMode) {
+        expect(handle.debuggerSendCommand).toHaveBeenCalledWith(
+          'Emulation.setUserAgentOverride',
+          expect.objectContaining({ userAgent: expect.stringContaining('iPhone') })
+        )
+      } else {
+        expect(handle.debuggerSendCommand).not.toHaveBeenCalledWith(
+          'Emulation.setUserAgentOverride',
+          expect.anything()
+        )
+      }
+      expect(handle.presentedUserAgent()).toEqual(
+        mobileMode ? expect.stringContaining('iPhone') : GUEST_ELECTRON_UA
       )
-      expect(uaIntents.get('native')).toBe(mobileMode)
     }
   )
 
@@ -304,7 +346,7 @@ describe('browser viewport operation ownership', () => {
     expect(await Promise.all(operations.map(({ pending }) => pending))).toEqual(
       Array(16).fill(false)
     )
-    expect(uaIntents.size).toBe(0)
+    expect(cdpUserAgentOverrides.size).toBe(0)
     expect(registeredGuests.size).toBe(0)
     expect(pendingOperations.size).toBe(0)
     expect(presetIntents.size).toBe(0)
diff --git a/src/main/browser/browser-manager-viewport-scroll-state.ts b/src/main/browser/browser-manager-viewport-scroll-state.ts
index 1f83534c856..533dc78f34d 100644
--- a/src/main/browser/browser-manager-viewport-scroll-state.ts
+++ b/src/main/browser/browser-manager-viewport-scroll-state.ts
@@ -1,5 +1,15 @@
 import { webContents } from 'electron'
-import type { BrowserViewportScrollState } from '../../shared/browser-workspace-types'
+import type {
+  BrowserViewportOverride,
+  BrowserViewportScrollState
+} from '../../shared/browser-workspace-types'
+
+type ViewportPresetState = {
+  guestWebContentsId: number
+  requested: BrowserViewportOverride | null
+  /** The preset's device metrics Chromium accepted for this guest; null when none stands. */
+  applied: BrowserViewportOverride | null
+}
 
 /**
  * Renderer routing plus the host-side viewport-preset geometry the wheel path needs to decide
@@ -7,12 +17,9 @@ import type { BrowserViewportScrollState } from '../../shared/browser-workspace-
  */
 export abstract class BrowserManagerViewportScrollState {
   protected readonly rendererWebContentsIdByTabId = new Map<string, number>()
-  // Why: host-side wheel panning follows the requested local viewport on the owning guest;
-  // replacement guests must not inherit a retired guest's state.
-  protected readonly viewportPresetActiveByTabId = new Map<
-    string,
-    { guestWebContentsId: number; active: boolean }
-  >()
+  // Why both: host-side wheel panning follows the requested preset, while the tab's identity follows
+  // the one Chromium actually applied. Replacement guests must not inherit a retired guest's preset.
+  protected readonly viewportPresetByTabId = new Map<string, ViewportPresetState>()
   protected readonly viewportScrollStateByTabId = new Map<string, BrowserViewportScrollState>()
 
   setViewportScrollState(
@@ -67,6 +74,17 @@ export abstract class BrowserManagerViewportScrollState {
     )
   }
 
+  protected recordAppliedViewportOverride(
+    browserTabId: string,
+    guestWebContentsId: number,
+    applied: BrowserViewportOverride | null
+  ): void {
+    const preset = this.viewportPresetByTabId.get(browserTabId)
+    if (preset?.guestWebContentsId === guestWebContentsId) {
+      this.viewportPresetByTabId.set(browserTabId, { ...preset, applied })
+    }
+  }
+
   protected resolveRendererForBrowserTab(browserTabId: string): Electron.WebContents | null {
     const rendererWebContentsId = this.rendererWebContentsIdByTabId.get(browserTabId)
     if (!rendererWebContentsId) {
diff --git a/src/main/browser/browser-manager-viewport-test-fixtures.ts b/src/main/browser/browser-manager-viewport-test-fixtures.ts
index b440a768b71..805988e7702 100644
--- a/src/main/browser/browser-manager-viewport-test-fixtures.ts
+++ b/src/main/browser/browser-manager-viewport-test-fixtures.ts
@@ -14,29 +14,77 @@ export async function flushViewportOps(): Promise<void> {
   }
 }
 
+// Why: mirrors Chromium, which rejects an out-of-range maxTouchPoints even when disabling touch.
+async function rejectInvalidTouchPoints(
+  method: string,
+  params?: { maxTouchPoints?: number }
+): Promise<undefined> {
+  const points = params?.maxTouchPoints
+  if (
+    method === 'Emulation.setTouchEmulationEnabled' &&
+    points !== undefined &&
+    (points < 1 || points > 16)
+  ) {
+    throw new Error('Touch points must be between 1 and 16')
+  }
+  return undefined
+}
+
 export type ViewportGuestHandle = {
   guest: Record<string, unknown>
   debuggerSendCommand: ReturnType<typeof vi.fn>
   debuggerIsAttached: ReturnType<typeof vi.fn>
   debuggerAttach: ReturnType<typeof vi.fn>
+  /** Flips what isCrashed() reports, as a renderer death and its reload do. */
+  setRendererCrashed: (crashed: boolean) => void
   setGuestUserAgent: (ua: string) => void
   commitNavigationTo: (nextUrl: string) => void
+  webContentsUserAgent: () => string
+  /** What navigator.userAgent reports: the latest applied CDP override, else the WebContents UA. */
+  presentedUserAgent: () => string
+  /** The CDP UA override Chromium holds, or null when none stands. */
+  standingUserAgentOverride: () => Record<string, unknown> | null
 }
 
 // Why: the guest wires the file's own hoisted mocks, which cannot be imported here.
+// Why the process identity: the session UA and app.userAgentFallback both carry it, so that is what a
+// real guest's getUserAgent() reports until something writes the WebContents UA.
 export function createViewportGuestFactory(
-  mocks: BrowserManagerMocks
+  mocks: BrowserManagerMocks & { processUserAgent?: string }
 ): (id: number, url?: string) => ViewportGuestHandle {
   return function makeGuest(id: number, url = 'https://example.com/'): ViewportGuestHandle {
-    const debuggerSendCommand = vi.fn().mockResolvedValue(undefined)
+    const debuggerSendCommand = vi.fn(rejectInvalidTouchPoints)
     const debuggerIsAttached = vi.fn(() => true)
     const debuggerAttach = vi.fn()
-    let currentUa = GUEST_ELECTRON_UA
+    let currentUa = mocks.processUserAgent ?? GUEST_ELECTRON_UA
+    let rendererCrashed = false
     // Why: getURL() reports the last COMMITTED url — it does not move at did-start-navigation.
     let committedUrl = url
+    // Chromium applies CDP commands in issue order, so a later-issued write wins however they settle,
+    // and a rejected write changes nothing. An empty userAgent clears the override.
+    let issuedUserAgentWrites = 0
+    let appliedUserAgentWrite = 0
+    let cdpOverride: Record<string, unknown> | null = null
+    const sendCommand = (method: string, params?: Record<string, unknown>): unknown => {
+      const result: unknown = debuggerSendCommand(method, params)
+      if (method === 'Emulation.setUserAgentOverride') {
+        const ordinal = ++issuedUserAgentWrites
+        void Promise.resolve(result).then(
+          () => {
+            if (ordinal > appliedUserAgentWrite) {
+              appliedUserAgentWrite = ordinal
+              cdpOverride = params?.userAgent ? params : null
+            }
+          },
+          () => {}
+        )
+      }
+      return result
+    }
     const guest = {
       id,
       isDestroyed: vi.fn(() => false),
+      isCrashed: vi.fn(() => rendererCrashed),
       getType: vi.fn(() => 'webview'),
       getURL: vi.fn(() => committedUrl),
       getUserAgent: vi.fn(() => currentUa),
@@ -53,7 +101,7 @@ export function createViewportGuestFactory(
       debugger: {
         isAttached: debuggerIsAttached,
         attach: debuggerAttach,
-        sendCommand: debuggerSendCommand,
+        sendCommand,
         on: vi.fn(),
         off: vi.fn()
       }
@@ -63,12 +111,19 @@ export function createViewportGuestFactory(
       debuggerSendCommand,
       debuggerIsAttached,
       debuggerAttach,
+      setRendererCrashed: (crashed: boolean) => {
+        rendererCrashed = crashed
+      },
       setGuestUserAgent: (ua: string) => {
         currentUa = ua
       },
       commitNavigationTo: (nextUrl: string) => {
         committedUrl = nextUrl
-      }
+      },
+      webContentsUserAgent: () => currentUa,
+      presentedUserAgent: () =>
+        typeof cdpOverride?.userAgent === 'string' ? cdpOverride.userAgent : currentUa,
+      standingUserAgentOverride: () => cdpOverride
     }
   }
 }
diff --git a/src/main/browser/browser-manager-viewport-touch-reset.test.ts b/src/main/browser/browser-manager-viewport-touch-reset.test.ts
new file mode 100644
index 00000000000..ebebd7dad7d
--- /dev/null
+++ b/src/main/browser/browser-manager-viewport-touch-reset.test.ts
@@ -0,0 +1,109 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  appGetPathMock: vi.fn(() => '/downloads'),
+  shellOpenExternalMock: vi.fn(),
+  browserWindowFromWebContentsMock: vi.fn(),
+  menuBuildFromTemplateMock: vi.fn(),
+  guestOffMock: vi.fn(),
+  guestOnMock: vi.fn(),
+  guestSetBackgroundThrottlingMock: vi.fn(),
+  guestSetWindowOpenHandlerMock: vi.fn(),
+  guestOpenDevToolsMock: vi.fn(),
+  webContentsFromIdMock: vi.fn(),
+  screenGetCursorScreenPointMock: vi.fn(() => ({ x: 0, y: 0 })),
+  openPopupWithOriginBarMock: vi.fn()
+}))
+
+vi.mock('electron', () => ({
+  app: { getPath: mocks.appGetPathMock },
+  BrowserWindow: { fromWebContents: mocks.browserWindowFromWebContentsMock },
+  clipboard: { writeText: vi.fn() },
+  shell: { openExternal: mocks.shellOpenExternalMock },
+  Menu: { buildFromTemplate: mocks.menuBuildFromTemplateMock },
+  screen: { getCursorScreenPoint: mocks.screenGetCursorScreenPointMock },
+  webContents: { fromId: mocks.webContentsFromIdMock }
+}))
+vi.mock('./popup-origin-bar-window', () => ({
+  openPopupWithOriginBar: mocks.openPopupWithOriginBarMock
+}))
+vi.mock('./browser-process-user-agent', () => ({
+  getBrowserProcessUserAgentIdentity: () => ({ mode: 'clean', userAgent: GUEST_CLEAN_UA })
+}))
+
+import { browserManager } from './browser-manager'
+import {
+  rendererWebContentsId,
+  resetBrowserManagerMocks,
+  resetBrowserManagerState
+} from './browser-manager-test-harness'
+import {
+  createViewportGuestFactory,
+  flushViewportOps,
+  GUEST_CLEAN_UA,
+  type ViewportGuestHandle
+} from './browser-manager-viewport-test-fixtures'
+
+const makeGuest = createViewportGuestFactory(mocks)
+const MOBILE = { width: 375, height: 667, deviceScaleFactor: 2, mobile: true } as const
+const LAPTOP = { width: 1024, height: 768, deviceScaleFactor: 1, mobile: false } as const
+
+function registerGuest(id: number, browserPageId: string): ViewportGuestHandle {
+  const handle = makeGuest(id)
+  mocks.webContentsFromIdMock.mockReturnValue(handle.guest)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the viewport fixture implements every WebContents member these paths touch.
+  browserManager.attachGuestPolicies(handle.guest as never)
+  browserManager.registerGuest({ browserPageId, webContentsId: id, rendererWebContentsId })
+  return handle
+}
+
+function userAgentWrites(
+  debuggerSendCommand: ViewportGuestHandle['debuggerSendCommand']
+): string[] {
+  return debuggerSendCommand.mock.calls.flatMap(([method, params]) =>
+    method === 'Emulation.setUserAgentOverride' && typeof params?.userAgent === 'string'
+      ? [params.userAgent]
+      : []
+  )
+}
+
+function startNavigation(url: string): void {
+  const didStartNavigation = mocks.guestOnMock.mock.calls.findLast(
+    ([event]) => event === 'did-start-navigation'
+  )?.[1]
+  expect(didStartNavigation).toBeTypeOf('function')
+  didStartNavigation(null, url, false, true)
+}
+
+// Regression for #22749: leaving a mobile preset must actually turn touch emulation off, or the
+// guest keeps (hover: none) / coarse pointer and loses every hover style.
+describe('browserManager viewport touch reset', () => {
+  beforeEach(() => {
+    resetBrowserManagerMocks(mocks)
+    resetBrowserManagerState()
+  })
+
+  it.each([
+    ['a desktop preset', LAPTOP],
+    ['no preset', null]
+  ])('disables touch emulation when switching from mobile to %s', async (_label, next) => {
+    const { debuggerSendCommand } = registerGuest(52001, 'tab-touch-reset')
+    await expect(browserManager.setViewportOverride('tab-touch-reset', MOBILE)).resolves.toBe(true)
+    debuggerSendCommand.mockClear()
+
+    await expect(browserManager.setViewportOverride('tab-touch-reset', next)).resolves.toBe(true)
+
+    expect(debuggerSendCommand).toHaveBeenCalledWith('Emulation.setTouchEmulationEnabled', {
+      enabled: false
+    })
+    const writes = userAgentWrites(debuggerSendCommand)
+    expect(writes.length).toBeGreaterThan(0)
+    expect(writes.at(-1)).not.toContain('iPhone')
+
+    // A later navigation must not re-install the mobile UA behind the switch.
+    debuggerSendCommand.mockClear()
+    startNavigation('https://example.com/next')
+    await flushViewportOps()
+    expect(userAgentWrites(debuggerSendCommand).some((ua) => ua.includes('iPhone'))).toBe(false)
+  })
+})
diff --git a/src/main/browser/browser-manager-viewport.ts b/src/main/browser/browser-manager-viewport.ts
index a4e263dcced..64e50e5ea48 100644
--- a/src/main/browser/browser-manager-viewport.ts
+++ b/src/main/browser/browser-manager-viewport.ts
@@ -5,9 +5,12 @@ import {
   type BrowserAnnotationViewportBridgeOptions
 } from '../../shared/browser-annotation-viewport-bridge'
 import type { BrowserViewportOverride } from '../../shared/browser-workspace-types'
-import { googleAuthUserAgent, isGoogleAuthUrl } from './browser-google-auth-ua'
 import { BrowserManagerDownloadLifecycle } from './browser-manager-download-lifecycle'
-import { getBrowserProcessUserAgentIdentity } from './browser-process-user-agent'
+import { sendGuestCdpCommand } from './guest-cdp-command'
+
+// Why no maxTouchPoints: Chromium rejects values outside 1..16 even when disabling, which left
+// touch emulation (and no-hover media features) on after leaving a mobile preset (#22749).
+const TOUCH_EMULATION_DISABLED = { enabled: false } as const
 
 export abstract class BrowserManagerViewport extends BrowserManagerDownloadLifecycle {
   // Why: guests are isolated from Orca's preload bridge, so main owns the devtools escape hatch after a tab→guest lookup.
@@ -39,11 +42,13 @@ export abstract class BrowserManagerViewport extends BrowserManagerDownloadLifec
     // Why: chain per-tab so rapid toggles don't interleave CDP commands and the last-requested override wins.
     const expectedWebContentsId = this.webContentsIdByTabId.get(browserTabId)
     if (expectedWebContentsId !== undefined) {
-      // Keep host panning available while CDP applies the requested dimensions. The guest id fence
-      // prevents this intent from leaking to a replacement guest; clearing the preset removes it.
-      this.viewportPresetActiveByTabId.set(browserTabId, {
+      // Record the request before CDP runs so host panning follows it at once. What is applied only
+      // moves once Chromium accepts it. The guest id fence keeps both off a replacement guest.
+      const previous = this.viewportPresetByTabId.get(browserTabId)
+      this.viewportPresetByTabId.set(browserTabId, {
         guestWebContentsId: expectedWebContentsId,
-        active: override !== null
+        requested: override,
+        applied: previous?.guestWebContentsId === expectedWebContentsId ? previous.applied : null
       })
     }
     // The renderer resizes the host before CDP completes; discard the old geometry until it
@@ -146,84 +151,59 @@ export abstract class BrowserManagerViewport extends BrowserManagerDownloadLifec
     }
 
     const dbg = guest.debugger
+    const metricsApplied = await this.runViewportEmulationStep(
+      browserTabId,
+      'device metrics',
+      () =>
+        override
+          ? sendGuestCdpCommand(guest, 'Emulation.setDeviceMetricsOverride', {
+              width: override.width,
+              height: override.height,
+              deviceScaleFactor: override.deviceScaleFactor,
+              mobile: override.mobile
+            })
+          : dbg.sendCommand('Emulation.clearDeviceMetricsOverride', {})
+    )
+    // Why record before any further await: a debugger detach clears the metrics, and its handler
+    // must land after this write, not be overwritten by it.
+    if (metricsApplied) {
+      this.recordAppliedViewportOverride(browserTabId, webContentsId, override)
+    }
+    const touchApplied = await this.runViewportEmulationStep(browserTabId, 'touch emulation', () =>
+      dbg.sendCommand(
+        'Emulation.setTouchEmulationEnabled',
+        override?.mobile ? { enabled: true, maxTouchPoints: 5 } : TOUCH_EMULATION_DISABLED
+      )
+    )
+    if (this.webContentsIdByTabId.get(browserTabId) !== webContentsId) {
+      return false
+    }
+    // Why: identity follows the device metrics Chromium actually holds, not the request, so a failed
+    // metrics write never pairs a phone identity with a desktop viewport, or the reverse.
+    const identityApplied = await this.runViewportEmulationStep(browserTabId, 'identity', () =>
+      this.retargetTabIdentity(guest, this.resolveTabNavigationUrl(guest))
+    )
+    return (
+      metricsApplied &&
+      touchApplied &&
+      identityApplied &&
+      this.webContentsIdByTabId.get(browserTabId) === webContentsId
+    )
+  }
+
+  private async runViewportEmulationStep(
+    browserTabId: string,
+    step: string,
+    send: () => Promise<unknown>
+  ): Promise<boolean> {
     try {
-      if (override) {
-        await dbg.sendCommand('Emulation.setDeviceMetricsOverride', {
-          width: override.width,
-          height: override.height,
-          deviceScaleFactor: override.deviceScaleFactor,
-          mobile: override.mobile
-        })
-        if (this.webContentsIdByTabId.get(browserTabId) === webContentsId) {
-          this.viewportPresetActiveByTabId.set(browserTabId, {
-            guestWebContentsId: webContentsId,
-            active: true
-          })
-        }
-        await dbg.sendCommand('Emulation.setTouchEmulationEnabled', {
-          enabled: override.mobile,
-          maxTouchPoints: override.mobile ? 5 : 0
-        })
-        if (this.webContentsIdByTabId.get(browserTabId) !== webContentsId) {
-          return false
-        }
-        // Navigation must see the preset while the final CDP write is in flight.
-        this.viewportUaOverrideMobileByTabId.set(browserTabId, override.mobile)
-        await this.sendViewportUserAgentOverride(guest, override.mobile)
-      } else {
-        await dbg.sendCommand('Emulation.clearDeviceMetricsOverride', {})
-        if (this.webContentsIdByTabId.get(browserTabId) === webContentsId) {
-          this.viewportPresetActiveByTabId.set(browserTabId, {
-            guestWebContentsId: webContentsId,
-            active: false
-          })
-        }
-        await dbg.sendCommand('Emulation.setTouchEmulationEnabled', {
-          enabled: false,
-          maxTouchPoints: 0
-        })
-        if (this.webContentsIdByTabId.get(browserTabId) !== webContentsId) {
-          return false
-        }
-        const trackedMobile = this.viewportUaOverrideMobileByTabId.get(browserTabId)
-        // A navigation after this point must not re-install the override behind the clear.
-        this.viewportUaOverrideMobileByTabId.delete(browserTabId)
-        try {
-          if (this.authUserAgentOverrideStateByGuestId.has(guest.id)) {
-            const url = this.resolveTabNavigationUrl(guest)
-            const identity = getBrowserProcessUserAgentIdentity()
-            // Firefox is delivered per-target and cannot reach workers; keep it clean-only to preserve
-            // one coherent identity per mode instead of pairing a Firefox document with native workers.
-            const restored = await this.applyAuthUserAgentOverrideOverCdp(
-              guest,
-              false,
-              url,
-              identity.mode === 'clean' && isGoogleAuthUrl(url)
-                ? googleAuthUserAgent()
-                : identity.userAgent
-            )
-            if (!restored) {
-              throw new Error('Failed to preserve auth user agent')
-            }
-          } else {
-            // Why: passing an empty string restores the session default UA.
-            await dbg.sendCommand('Emulation.setUserAgentOverride', { userAgent: '' })
-          }
-        } catch (error) {
-          if (
-            trackedMobile !== undefined &&
-            this.webContentsIdByTabId.get(browserTabId) === webContentsId
-          ) {
-            this.viewportUaOverrideMobileByTabId.set(browserTabId, trackedMobile)
-          }
-          throw error
-        }
-      }
-      if (this.webContentsIdByTabId.get(browserTabId) !== webContentsId) {
-        return false
-      }
-      return true
-    } catch {
+      // A step that reports its own failure resolves false rather than throwing.
+      return (await send()) !== false
+    } catch (error) {
+      console.warn(`[browser-manager] setViewportOverride: ${step} failed`, {
+        browserTabId,
+        error: error instanceof Error ? error.message : String(error)
+      })
       return false
     }
   }
diff --git a/src/main/browser/browser-route-webrtc-egress.electron.test.ts b/src/main/browser/browser-route-webrtc-egress.electron.test.ts
index 013a852e810..23463f2f84a 100644
--- a/src/main/browser/browser-route-webrtc-egress.electron.test.ts
+++ b/src/main/browser/browser-route-webrtc-egress.electron.test.ts
@@ -36,6 +36,12 @@ const dgram = require('node:dgram')
 const net = require('node:net')
 const os = require('node:os')
 const { writeFileSync } = require('node:fs')
+let phase = 'app-ready'
+
+function enterPhase(next) {
+  phase = next
+  console.error('[webrtc-egress] ' + phase)
+}
 
 function bind(socket, host) {
   return new Promise((resolve, reject) => {
@@ -71,19 +77,24 @@ async function probe() {
   const tcp = net.createServer((socket) => socket.destroy())
   const packets = []
   udp.on('message', (message) => packets.push(message.length))
+  enterPhase('bind-listeners')
   const [udpAddress, tcpAddress] = await Promise.all([
     bind(udp, '0.0.0.0'),
     listen(tcp, '127.0.0.1')
   ])
   const partition = 'persist:webrtc-egress-${protectedGuest}-' + Date.now()
   const routeSession = session.fromPartition(partition, { cache: false })
+  enterPhase('configure-proxy')
   await routeSession.setProxy({
     mode: 'fixed_servers',
     proxyRules: 'socks5://127.0.0.1:' + tcpAddress.port,
     proxyBypassRules: '<-loopback>'
   })
+  enterPhase('close-connections')
   await routeSession.closeAllConnections()
+  enterPhase('resolve-proxy')
   const resolvedProxy = await routeSession.resolveProxy('https://example.invalid/')
+  enterPhase('create-window')
   const window = new BrowserWindow({
     show: false,
     webPreferences: { partition, sandbox: true, nodeIntegration: false, contextIsolation: true }
@@ -92,6 +103,7 @@ async function probe() {
     window.webContents.setWebRTCIPHandlingPolicy('disable_non_proxied_udp')
   }
   const policy = window.webContents.getWebRTCIPHandlingPolicy()
+  enterPhase('load-page')
   await window.loadURL('data:text/html,<title>WebRTC egress probe</title>')
   const target = viewerAddress()
   const script = \`
@@ -100,15 +112,22 @@ async function probe() {
         iceServers: [{ urls: 'stun:\${target}:\${udpAddress.port}' }],
         iceCandidatePoolSize: 1
       })
+      globalThis.__webrtcEgressPeer = peer
       peer.createDataChannel('probe')
       const offer = await peer.createOffer()
       await peer.setLocalDescription(offer)
-      await new Promise(resolve => setTimeout(resolve, 3000))
-      peer.close()
     })()
   \`
+  enterPhase('renderer-webrtc')
   await window.webContents.executeJavaScript(script)
+  // Hidden renderer timers may be throttled; the packet observation clock belongs to the host.
+  enterPhase('observe-packets')
+  await new Promise((resolve) => setTimeout(resolve, 3000))
+  enterPhase('close-peer')
+  await window.webContents.executeJavaScript('globalThis.__webrtcEgressPeer.close()')
+  enterPhase('drain-packets')
   await new Promise((resolve) => setTimeout(resolve, 500))
+  enterPhase('cleanup')
   window.destroy()
   udp.close()
   tcp.close()
@@ -116,16 +135,22 @@ async function probe() {
 }
 
 async function run() {
-  const timeout = setTimeout(() => app.exit(2), 20000)
+  const timeout = setTimeout(() => {
+    writeFileSync(${JSON.stringify(resultPath)}, JSON.stringify({
+      error: 'WebRTC egress probe timed out', phase, protectedGuest: ${protectedGuest}
+    }))
+    app.exit(2)
+  }, 20000)
   await app.whenReady()
   const result = await probe()
+  enterPhase('write-result')
   writeFileSync(${JSON.stringify(resultPath)}, JSON.stringify(result))
   clearTimeout(timeout)
   app.quit()
 }
 
 run().catch((error) => {
-  writeFileSync(${JSON.stringify(resultPath)}, JSON.stringify({ error: String(error?.stack || error) }))
+  writeFileSync(${JSON.stringify(resultPath)}, JSON.stringify({ error: String(error?.stack || error), phase, protectedGuest: ${protectedGuest} }))
   app.exit(1)
 })
 `
diff --git a/src/main/browser/browser-screencast-debugger-command.ts b/src/main/browser/browser-screencast-debugger-command.ts
index 3a607e416ec..b32eef8d308 100644
--- a/src/main/browser/browser-screencast-debugger-command.ts
+++ b/src/main/browser/browser-screencast-debugger-command.ts
@@ -2,15 +2,22 @@ import type { WebContents } from 'electron'
 
 const DEBUGGER_COMMAND_TIMEOUT_MS = 8_000
 
-export async function sendDebuggerCommand(
+export function sendDebuggerCommand(
   dbg: WebContents['debugger'],
   method: string,
   params: Record<string, unknown> = {}
+): Promise<unknown> {
+  return runDebuggerCommandWithTimeout(method, () => dbg.sendCommand(method, params))
+}
+
+export async function runDebuggerCommandWithTimeout(
+  method: string,
+  send: () => Promise<unknown>
 ): Promise<unknown> {
   let timeout: ReturnType<typeof setTimeout> | null = null
   try {
     return await Promise.race([
-      Promise.resolve().then(() => dbg.sendCommand(method, params)),
+      Promise.resolve().then(send),
       new Promise<never>((_, reject) => {
         timeout = setTimeout(() => {
           reject(new Error(`Timed out while running ${method}.`))
diff --git a/src/main/browser/browser-screencast-device-metrics.ts b/src/main/browser/browser-screencast-device-metrics.ts
index ff805d14604..96037bd53ae 100644
--- a/src/main/browser/browser-screencast-device-metrics.ts
+++ b/src/main/browser/browser-screencast-device-metrics.ts
@@ -1,5 +1,9 @@
 import type { Debugger, WebContents } from 'electron'
-import { sendDebuggerCommand } from './browser-screencast-debugger-command'
+import {
+  runDebuggerCommandWithTimeout,
+  sendDebuggerCommand
+} from './browser-screencast-debugger-command'
+import { sendGuestCdpCommand } from './guest-cdp-command'
 import type { BrowserScreencastOptions } from './browser-screencast-stream-types'
 import { positiveInteger, positiveNumber } from './browser-screencast-viewport-fit'
 
@@ -15,6 +19,8 @@ export function createBrowserScreencastDeviceMetrics(
   options: BrowserScreencastOptions
 ): BrowserScreencastDeviceMetrics {
   let deviceMetricsOverridden = false
+  const sendViewportCommand = (method: string, params: Record<string, unknown>): Promise<unknown> =>
+    runDebuggerCommandWithTimeout(method, () => sendGuestCdpCommand(webContents, method, params))
 
   const clearDeviceMetricsOverride = async (): Promise<void> => {
     if (webContents.isDestroyed() || !dbg.isAttached()) {
@@ -38,13 +44,13 @@ export function createBrowserScreencastDeviceMetrics(
     // Why: Back/Forward and cross-process navigations can drop emulation while
     // the screencast remains attached. Reapply before fallback captures so the
     // page lays out at the client pane size, not the host BrowserView size.
-    await sendDebuggerCommand(dbg, 'Emulation.setDeviceMetricsOverride', {
+    await sendViewportCommand('Emulation.setDeviceMetricsOverride', {
       width: viewportWidth,
       height: viewportHeight,
       deviceScaleFactor,
       mobile: options.mobile === true
     })
-    await sendDebuggerCommand(dbg, 'Emulation.setVisibleSize', {
+    await sendViewportCommand('Emulation.setVisibleSize', {
       width: viewportWidth,
       height: viewportHeight
     }).catch(() => {})
diff --git a/src/main/browser/browser-screencast-lifecycle.test.ts b/src/main/browser/browser-screencast-lifecycle.test.ts
index 251b53fd469..fdf586b0ef8 100644
--- a/src/main/browser/browser-screencast-lifecycle.test.ts
+++ b/src/main/browser/browser-screencast-lifecycle.test.ts
@@ -21,7 +21,7 @@ function createWebContents() {
     attached = false
   })
   debuggerApi.sendCommand = vi.fn(async () => ({}))
-  return { isDestroyed: vi.fn(() => false), debugger: debuggerApi }
+  return { isDestroyed: vi.fn(() => false), isCrashed: vi.fn(() => false), debugger: debuggerApi }
 }
 
 describe('browser screencast lifecycle', () => {
diff --git a/src/main/browser/browser-screencast-snapshot-scaling.test.ts b/src/main/browser/browser-screencast-snapshot-scaling.test.ts
index 4358d618376..1398214f2dc 100644
--- a/src/main/browser/browser-screencast-snapshot-scaling.test.ts
+++ b/src/main/browser/browser-screencast-snapshot-scaling.test.ts
@@ -20,7 +20,12 @@ function createMockWebContents(capturePage: () => Promise<unknown>) {
     attached = false
   })
   dbg.sendCommand = vi.fn(async () => ({}))
-  return { isDestroyed: vi.fn(() => false), debugger: dbg, capturePage: vi.fn(capturePage) }
+  return {
+    isDestroyed: vi.fn(() => false),
+    isCrashed: vi.fn(() => false),
+    debugger: dbg,
+    capturePage: vi.fn(capturePage)
+  }
 }
 
 function createCapturedImage(width: number, height: number) {
diff --git a/src/main/browser/browser-screencast-web-contents-test-double.ts b/src/main/browser/browser-screencast-web-contents-test-double.ts
index 13811850c68..030eec63783 100644
--- a/src/main/browser/browser-screencast-web-contents-test-double.ts
+++ b/src/main/browser/browser-screencast-web-contents-test-double.ts
@@ -10,6 +10,7 @@ export type MockScreencastDebugger = EventEmitter & {
 
 export type MockScreencastWebContents = {
   isDestroyed: ReturnType<typeof vi.fn>
+  isCrashed: ReturnType<typeof vi.fn>
   debugger: MockScreencastDebugger
 }
 
@@ -29,6 +30,7 @@ export function createMockScreencastWebContents(): MockScreencastWebContents {
 
   return {
     isDestroyed: vi.fn(() => false),
+    isCrashed: vi.fn(() => false),
     debugger: dbg
   }
 }
diff --git a/src/main/browser/browser-session-registry-import-boundary.test.ts b/src/main/browser/browser-session-registry-import-boundary.test.ts
deleted file mode 100644
index 96950797c4a..00000000000
--- a/src/main/browser/browser-session-registry-import-boundary.test.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { expect, it } from 'vitest'
-
-it('keeps the cookie fixture registry outside the persistence barrel graph', () => {
-  const source = readFileSync(join(__dirname, 'browser-session-registry.ts'), 'utf8')
-
-  expect(source).toMatch(
-    /import\s*\{\s*getCanonicalUserDataPath\s*\}\s*from\s*['"]\.\.\/persistence\/loading-store\/user-data-path['"]/
-  )
-  expect(source).not.toMatch(/from\s*['"]\.\.\/persistence['"]/)
-})
diff --git a/src/main/browser/browser-session-registry.test.ts b/src/main/browser/browser-session-registry.test.ts
index 27965a56433..a3e84b290f0 100644
--- a/src/main/browser/browser-session-registry.test.ts
+++ b/src/main/browser/browser-session-registry.test.ts
@@ -556,7 +556,7 @@ describe('BrowserSessionRegistry', () => {
         { webRequest: { onBeforeSendHeaders } } as never,
         (request) =>
           request.currentUserAgent === googleAuthUserAgent()
-            ? { userAgent: googleAuthUserAgent() }
+            ? { kind: 'google-auth', userAgent: googleAuthUserAgent() }
             : undefined
       )
       expect(onBeforeSendHeaders).toHaveBeenCalledWith(
diff --git a/src/main/browser/browser-session-ua-cloudflare-live.electron.test.ts b/src/main/browser/browser-session-ua-cloudflare-live.electron.test.ts
index 05331ab5c65..c6cba96c6d7 100644
--- a/src/main/browser/browser-session-ua-cloudflare-live.electron.test.ts
+++ b/src/main/browser/browser-session-ua-cloudflare-live.electron.test.ts
@@ -252,10 +252,10 @@ async function run() {
   if (arm === 'branch') {
     installBrowserSessionUserAgentPolicy(sess, request => {
       if (request.resourceType !== 'mainFrame' && (request.currentUserAgent === firefoxUserAgent || request.effectiveUserAgent === firefoxUserAgent)) {
-        return { userAgent: firefoxUserAgent }
+        return { kind: 'google-auth', userAgent: firefoxUserAgent }
       }
       if (request.resourceType === 'mainFrame' && request.currentUserAgent === firefoxUserAgent) {
-        return { userAgent: cleanUserAgent }
+        return { kind: 'process', userAgent: cleanUserAgent }
       }
       return undefined
     })
diff --git a/src/main/browser/browser-session-ua-wire-probe-server.ts b/src/main/browser/browser-session-ua-wire-probe-server.ts
index d00117ad86b..6062ed3df91 100644
--- a/src/main/browser/browser-session-ua-wire-probe-server.ts
+++ b/src/main/browser/browser-session-ua-wire-probe-server.ts
@@ -156,7 +156,7 @@ function probePage(
   const dedicatedWorkerScriptText = crossContext
     ? `const dedicatedDone = message('dedicated-worker'); const dedicated = new Worker(${JSON.stringify(httpOrigin)} + '/dedicated-worker.js'); dedicated.onmessage = event => postMessage(event.data, '*')`
     : ''
-  return `<!doctype html><title>UA wire probe</title><script>
+  return `<!doctype html><title>UA wire probe</title><body><script>
   const identity = () => ({ userAgent: navigator.userAgent, userAgentData: navigator.userAgentData ? { brands: navigator.userAgentData.brands, mobile: navigator.userAgentData.mobile, platform: navigator.userAgentData.platform } : null })
   const report = context => fetch(${JSON.stringify(httpOrigin)} + '/report/' + context, { method: 'POST', body: JSON.stringify(identity()) })
   const fetchRoute = path => fetch(${JSON.stringify(httpOrigin)} + path).then(response => response.text())
@@ -181,7 +181,7 @@ function probePage(
     ])
     return true
   })()
-  </script>`
+  </script></body>`
 }
 function childPage(
   context: string,
diff --git a/src/main/browser/browser-session-ua.ts b/src/main/browser/browser-session-ua.ts
index 5b4d4735dcd..fc05fe357cc 100644
--- a/src/main/browser/browser-session-ua.ts
+++ b/src/main/browser/browser-session-ua.ts
@@ -1,5 +1,5 @@
 import type { Session } from 'electron'
-import type { ViewportUserAgentOverride } from './browser-viewport-user-agent'
+import type { BrowserTabIdentity, UserAgentMetadata } from './browser-tab-identity'
 export { cleanElectronUserAgent } from './browser-process-user-agent'
 import { getBrowserProcessUserAgentIdentity } from './browser-process-user-agent'
 
@@ -19,7 +19,7 @@ export type BrowserSessionRequestUserAgentResolver = (args: {
   webContentsId?: number
   currentUserAgent?: string
   effectiveUserAgent?: string
-}) => ViewportUserAgentOverride | undefined
+}) => BrowserTabIdentity | undefined
 
 function quoteClientHint(value: string): string {
   return `"${value.replace(/["\\]/g, '\\$&')}"`
@@ -33,7 +33,7 @@ function formatClientHintBrands(brands: { brand: string; version: string }[]): s
 
 function applyUserAgentMetadataHeaders(
   headers: Record<string, string>,
-  metadata: NonNullable<ViewportUserAgentOverride['userAgentMetadata']>
+  metadata: UserAgentMetadata
 ): void {
   const values: Record<string, string> = {
     'sec-ch-ua': formatClientHintBrands(metadata.brands),
@@ -101,15 +101,10 @@ export function installBrowserSessionUserAgentPolicy(
         callback({ requestHeaders: headers })
         return
       }
-      if (identity.userAgent) {
-        setUserAgentHeader(headers, identity.userAgent)
-      }
-      if (identity.userAgent === firefoxUa) {
+      setUserAgentHeader(headers, identity.userAgent)
+      if (identity.kind === 'google-auth') {
         stripClientHints(headers)
-        callback({ requestHeaders: headers })
-        return
-      }
-      if (identity.userAgentMetadata) {
+      } else if (identity.kind === 'mobile') {
         applyUserAgentMetadataHeaders(headers, identity.userAgentMetadata)
       }
       callback({ requestHeaders: headers })
diff --git a/src/main/browser/browser-tab-identity.test.ts b/src/main/browser/browser-tab-identity.test.ts
new file mode 100644
index 00000000000..520eae50819
--- /dev/null
+++ b/src/main/browser/browser-tab-identity.test.ts
@@ -0,0 +1,78 @@
+import { describe, expect, it } from 'vitest'
+
+import { googleAuthUserAgent } from './browser-google-auth-ua'
+import { resolveBrowserTabIdentity } from './browser-tab-identity'
+
+const CHROME_UA =
+  'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36'
+const NATIVE_UA =
+  'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Orca/1.0.0 Chrome/134.0.0.0 Electron/43.0.0 Safari/537.36'
+const clean = { mode: 'clean', userAgent: CHROME_UA } as const
+const native = { mode: 'native', userAgent: NATIVE_UA } as const
+const AUTH_URL = 'https://accounts.google.com/v3/signin/identifier'
+
+describe('resolveBrowserTabIdentity', () => {
+  it('presents Firefox on Google auth hosts in clean mode regardless of the preset', () => {
+    for (const mobile of [false, true]) {
+      expect(resolveBrowserTabIdentity({ url: AUTH_URL, mobile, processIdentity: clean })).toEqual({
+        kind: 'google-auth',
+        userAgent: googleAuthUserAgent()
+      })
+    }
+  })
+
+  it('leaves Google auth hosts on the native identity in native mode', () => {
+    expect(
+      resolveBrowserTabIdentity({ url: AUTH_URL, mobile: false, processIdentity: native })
+    ).toEqual({ kind: 'process', userAgent: NATIVE_UA })
+    expect(
+      resolveBrowserTabIdentity({ url: AUTH_URL, mobile: true, processIdentity: native }).kind
+    ).toBe('mobile')
+  })
+
+  it('presents the process identity itself off the auth hosts without a mobile preset', () => {
+    for (const processIdentity of [clean, native]) {
+      expect(
+        resolveBrowserTabIdentity({
+          url: 'https://myaccount.google.com/',
+          mobile: false,
+          processIdentity
+        })
+      ).toEqual({ kind: 'process', userAgent: processIdentity.userAgent })
+    }
+  })
+
+  it('splices the real Chrome major into the mobile UA and its client hints', () => {
+    const identity = resolveBrowserTabIdentity({
+      url: 'https://example.com/',
+      mobile: true,
+      processIdentity: clean
+    })
+    expect(identity.kind).toBe('mobile')
+    expect(identity.userAgent).toContain('iPhone')
+    expect(identity.userAgent).toContain('CriOS/134.0.0.0')
+    if (identity.kind === 'mobile') {
+      expect(identity.userAgentMetadata.mobile).toBe(true)
+      expect(identity.userAgentMetadata.platform).toBe('iOS')
+      expect(identity.userAgentMetadata.brands).toContainEqual({
+        brand: 'Google Chrome',
+        version: '134'
+      })
+    }
+  })
+
+  it('falls back to a known Chrome major when the process UA carries none', () => {
+    const identity = resolveBrowserTabIdentity({
+      url: 'https://example.com/',
+      mobile: true,
+      processIdentity: { mode: 'clean', userAgent: googleAuthUserAgent() }
+    })
+    expect(identity.userAgent).toContain('CriOS/134.0.0.0')
+  })
+
+  it('treats an unparseable URL as a non-auth host', () => {
+    expect(
+      resolveBrowserTabIdentity({ url: 'not a url', mobile: false, processIdentity: clean })
+    ).toEqual({ kind: 'process', userAgent: CHROME_UA })
+  })
+})
diff --git a/src/main/browser/browser-tab-identity.ts b/src/main/browser/browser-tab-identity.ts
new file mode 100644
index 00000000000..713b0310a4a
--- /dev/null
+++ b/src/main/browser/browser-tab-identity.ts
@@ -0,0 +1,90 @@
+// Why one owner: a tab's identity is read by the session request hook and written to the guest over
+// two layers (the WebContents UA and a CDP override that outranks it). When each layer derived it on
+// its own, a desktop viewport preset installed a CDP override with no userAgentMetadata, and Chromium
+// then drops navigator.userAgentData and every sec-ch-ua header for that tab — a Chrome UA with no
+// client hints, which bot checks read as a spoof. Every layer now asks this module instead.
+
+import type { BrowserProcessUserAgentIdentity } from './browser-process-user-agent'
+import { googleAuthUserAgent, isGoogleAuthUrl } from './browser-google-auth-ua'
+
+type UserAgentBrand = { brand: string; version: string }
+
+export type UserAgentMetadata = {
+  brands: UserAgentBrand[]
+  fullVersionList: UserAgentBrand[]
+  fullVersion: string
+  platform: string
+  platformVersion: string
+  architecture: string
+  model: string
+  mobile: boolean
+}
+
+export type BrowserTabIdentity =
+  /** The process identity, with its client hints left to Chromium. */
+  | { kind: 'process'; userAgent: string }
+  /** Firefox on Google's auth hosts; real Firefox sends no client hints. */
+  | { kind: 'google-auth'; userAgent: string }
+  | { kind: 'mobile'; userAgent: string; userAgentMetadata: UserAgentMetadata }
+
+export function googleAuthTabIdentity(): BrowserTabIdentity {
+  return { kind: 'google-auth', userAgent: googleAuthUserAgent() }
+}
+
+/**
+ * The identity a tab presents at `url`. Desktop presets and "no preset" are deliberately the same
+ * input: only a mobile preset changes who the tab claims to be.
+ */
+export function resolveBrowserTabIdentity(args: {
+  url: string
+  mobile: boolean
+  processIdentity: BrowserProcessUserAgentIdentity
+}): BrowserTabIdentity {
+  // Firefox is delivered per-target and cannot reach workers; keep it clean-only to preserve one
+  // coherent identity per mode instead of pairing a Firefox document with native workers.
+  if (args.processIdentity.mode === 'clean' && isGoogleAuthUrl(args.url)) {
+    return googleAuthTabIdentity()
+  }
+  if (args.mobile) {
+    return buildMobileTabIdentity(args.processIdentity.userAgent)
+  }
+  return { kind: 'process', userAgent: args.processIdentity.userAgent }
+}
+
+// Why: responsive sites UA-sniff; this is Chrome DevTools' default iPhone UA template with the real
+// Chrome major spliced in so the userAgentMetadata brands below agree with it.
+function buildMobileUserAgent(chromeMajor: string): string {
+  return `Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/${chromeMajor}.0.0.0 Mobile/15E148 Safari/604.1`
+}
+
+function extractChromeMajor(ua: string): string {
+  const match = ua.match(/Chrome\/(\d+)/)
+  return match ? match[1] : '134'
+}
+
+function buildMobileTabIdentity(processUserAgent: string): BrowserTabIdentity {
+  const chromeMajor = extractChromeMajor(processUserAgent)
+  // Why: userAgentMetadata must accompany the mobile UA so client hints match, or bot-detection flags the desktop-hint leak.
+  return {
+    kind: 'mobile',
+    userAgent: buildMobileUserAgent(chromeMajor),
+    userAgentMetadata: {
+      brands: [
+        { brand: 'Google Chrome', version: chromeMajor },
+        { brand: 'Chromium', version: chromeMajor },
+        { brand: 'Not/A)Brand', version: '24' }
+      ],
+      fullVersionList: [
+        { brand: 'Google Chrome', version: `${chromeMajor}.0.0.0` },
+        { brand: 'Chromium', version: `${chromeMajor}.0.0.0` },
+        { brand: 'Not/A)Brand', version: '24.0.0.0' }
+      ],
+      fullVersion: `${chromeMajor}.0.0.0`,
+      platform: 'iOS',
+      platformVersion: '17.0',
+      architecture: '',
+      model: 'iPhone',
+      mobile: true
+    }
+  }
+}
diff --git a/src/main/browser/browser-viewport-user-agent.test.ts b/src/main/browser/browser-viewport-user-agent.test.ts
deleted file mode 100644
index 1d069a209ad..00000000000
--- a/src/main/browser/browser-viewport-user-agent.test.ts
+++ /dev/null
@@ -1,66 +0,0 @@
-import { describe, expect, it } from 'vitest'
-
-import { googleAuthUserAgent } from './browser-google-auth-ua'
-import { buildViewportUserAgentOverride } from './browser-viewport-user-agent'
-
-const CHROME_UA =
-  'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36'
-
-describe('buildViewportUserAgentOverride', () => {
-  it('presents the Firefox UA on Google auth hosts regardless of the preset', () => {
-    for (const mobile of [false, true]) {
-      const override = buildViewportUserAgentOverride({
-        url: 'https://accounts.google.com/v3/signin/identifier',
-        mobile,
-        baseUserAgent: CHROME_UA
-      })
-      expect(override.userAgent).toBe(googleAuthUserAgent())
-      // Real Firefox emits no client hints, so Chrome brands would contradict the stripped headers.
-      expect(override.userAgentMetadata).toBeUndefined()
-    }
-  })
-
-  it('keeps the clean desktop UA off the auth hosts', () => {
-    const override = buildViewportUserAgentOverride({
-      url: 'https://myaccount.google.com/',
-      mobile: false,
-      baseUserAgent: CHROME_UA
-    })
-    expect(override.userAgent).toBe(CHROME_UA)
-    expect(override.userAgentMetadata).toBeUndefined()
-  })
-
-  it('splices the real Chrome major into the mobile UA and its client hints', () => {
-    const override = buildViewportUserAgentOverride({
-      url: 'https://example.com/',
-      mobile: true,
-      baseUserAgent: CHROME_UA
-    })
-    expect(override.userAgent).toContain('iPhone')
-    expect(override.userAgent).toContain('CriOS/134.0.0.0')
-    expect(override.userAgentMetadata?.mobile).toBe(true)
-    expect(override.userAgentMetadata?.platform).toBe('iOS')
-    expect(override.userAgentMetadata?.brands).toContainEqual({
-      brand: 'Google Chrome',
-      version: '134'
-    })
-  })
-
-  it('falls back to a known Chrome major when the base UA carries none', () => {
-    const override = buildViewportUserAgentOverride({
-      url: 'https://example.com/',
-      mobile: true,
-      baseUserAgent: googleAuthUserAgent()
-    })
-    expect(override.userAgent).toContain('CriOS/134.0.0.0')
-  })
-
-  it('treats an unparseable URL as a non-auth host', () => {
-    const override = buildViewportUserAgentOverride({
-      url: 'not a url',
-      mobile: false,
-      baseUserAgent: CHROME_UA
-    })
-    expect(override.userAgent).toBe(CHROME_UA)
-  })
-})
diff --git a/src/main/browser/browser-viewport-user-agent.ts b/src/main/browser/browser-viewport-user-agent.ts
deleted file mode 100644
index 31c06307b46..00000000000
--- a/src/main/browser/browser-viewport-user-agent.ts
+++ /dev/null
@@ -1,75 +0,0 @@
-// Why: a CDP Emulation.setUserAgentOverride outranks WebContents.setUserAgent for both
-// navigator.userAgent and the outgoing request header, and it stands across every later
-// navigation until explicitly cleared. So the viewport preset's UA is a third identity layer
-// that must agree with the auth-host Firefox switch, or applying a preset silently reintroduces
-// the exact UA mismatch this scope exists to remove.
-
-import { googleAuthUserAgent, isGoogleAuthUrl } from './browser-google-auth-ua'
-
-type UserAgentBrand = { brand: string; version: string }
-
-export type ViewportUserAgentOverride = {
-  userAgent: string
-  userAgentMetadata?: {
-    brands: UserAgentBrand[]
-    fullVersionList: UserAgentBrand[]
-    fullVersion: string
-    platform: string
-    platformVersion: string
-    architecture: string
-    model: string
-    mobile: boolean
-  }
-}
-
-// Why: responsive sites UA-sniff; this is Chrome DevTools' default iPhone UA template with the real
-// Chrome major spliced in so the userAgentMetadata brands below agree with it.
-function buildMobileUserAgent(chromeMajor: string): string {
-  return `Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/${chromeMajor}.0.0.0 Mobile/15E148 Safari/604.1`
-}
-
-function extractChromeMajor(ua: string): string {
-  const match = ua.match(/Chrome\/(\d+)/)
-  return match ? match[1] : '134'
-}
-
-export function buildViewportUserAgentOverride(args: {
-  url: string
-  mobile: boolean
-  baseUserAgent: string
-  googleAuthEnabled?: boolean
-}): ViewportUserAgentOverride {
-  if (args.googleAuthEnabled !== false && isGoogleAuthUrl(args.url)) {
-    // Why: match the header-level Firefox switch exactly, and send no userAgentMetadata — real
-    // Firefox emits no client hints, so Chrome brands here would contradict the stripped headers.
-    return { userAgent: googleAuthUserAgent() }
-  }
-  if (!args.mobile) {
-    // Why: desktop presets republish the session's clean identity, or a preset would put the
-    // Electron/app tokens back on the wire and a transplanted session gets revoked (STA-7147).
-    return { userAgent: args.baseUserAgent }
-  }
-  const chromeMajor = extractChromeMajor(args.baseUserAgent)
-  // Why: userAgentMetadata must accompany the mobile UA so client hints match, or bot-detection flags the desktop-hint leak.
-  return {
-    userAgent: buildMobileUserAgent(chromeMajor),
-    userAgentMetadata: {
-      brands: [
-        { brand: 'Google Chrome', version: chromeMajor },
-        { brand: 'Chromium', version: chromeMajor },
-        { brand: 'Not/A)Brand', version: '24' }
-      ],
-      fullVersionList: [
-        { brand: 'Google Chrome', version: `${chromeMajor}.0.0.0` },
-        { brand: 'Chromium', version: `${chromeMajor}.0.0.0` },
-        { brand: 'Not/A)Brand', version: '24.0.0.0' }
-      ],
-      fullVersion: `${chromeMajor}.0.0.0`,
-      platform: 'iOS',
-      platformVersion: '17.0',
-      architecture: '',
-      model: 'iPhone',
-      mobile: true
-    }
-  }
-}
diff --git a/src/main/browser/cdp-debugger-channel.ts b/src/main/browser/cdp-debugger-channel.ts
index f1cddbe20f1..b0c790138e8 100644
--- a/src/main/browser/cdp-debugger-channel.ts
+++ b/src/main/browser/cdp-debugger-channel.ts
@@ -3,6 +3,7 @@ import type { WebContents } from 'electron'
 import { acquireElectronDebugger, type ElectronDebuggerLease } from './electron-debugger-lease'
 import type { CdpClientResponseWriter } from './cdp-client-response-writer'
 import type { CdpSyntheticSessionRegistry } from './cdp-synthetic-session-registry'
+import { sendGuestCdpCommand } from './guest-cdp-command'
 
 /**
  * The IO boundary with webContents.debugger: lease-based attach, event fan-out to
@@ -86,10 +87,9 @@ export class CdpDebuggerChannel {
     params: Record<string, unknown>,
     sessionId?: string
   ): Promise<unknown> {
-    const command = sessionId
-      ? this.webContents.debugger.sendCommand(method, params, sessionId)
-      : this.webContents.debugger.sendCommand(method, params)
-    return Promise.resolve(command)
+    return sessionId
+      ? sendGuestCdpCommand(this.webContents, method, params, sessionId)
+      : sendGuestCdpCommand(this.webContents, method, params)
   }
 
   forwardCommand(
diff --git a/src/main/browser/cdp-debugger-lifecycle.ts b/src/main/browser/cdp-debugger-lifecycle.ts
index 225eb689dba..0880f9926a4 100644
--- a/src/main/browser/cdp-debugger-lifecycle.ts
+++ b/src/main/browser/cdp-debugger-lifecycle.ts
@@ -4,6 +4,7 @@ import type { CdpTabState } from './cdp-auxiliary-commands'
 import type { CdpCommandSender } from './snapshot-engine'
 import type { CdpBridgeState } from './cdp-bridge-state'
 import { createCdpDebuggerMessageListener } from './cdp-debugger-events'
+import { sendGuestCdpCommand } from './guest-cdp-command'
 
 export class CdpDebuggerLifecycle {
   constructor(private readonly bridgeState: CdpBridgeState) {}
@@ -83,7 +84,7 @@ export class CdpDebuggerLifecycle {
 
   makeCdpSender(guest: WebContents, sessionId?: string): CdpCommandSender {
     return (method: string, params?: Record<string, unknown>) => {
-      const command = guest.debugger.sendCommand(method, params, sessionId) as Promise<unknown>
+      const command = sendGuestCdpCommand(guest, method, params, sessionId)
       // Why: Electron's CDP sendCommand can hang on a stale debugger session, so a 10s timeout bounds the RPC.
       let timer: ReturnType<typeof setTimeout>
       return Promise.race([
diff --git a/src/main/browser/cdp-ws-proxy-test-harness.ts b/src/main/browser/cdp-ws-proxy-test-harness.ts
index c66a3cbf6b1..3f5765c18ab 100644
--- a/src/main/browser/cdp-ws-proxy-test-harness.ts
+++ b/src/main/browser/cdp-ws-proxy-test-harness.ts
@@ -25,6 +25,7 @@ export type MockWebContents = {
   webContents: {
     debugger: MockDebugger
     isDestroyed: () => boolean
+    isCrashed: () => boolean
     focus: Mock<() => void>
     printToPDF: Mock<() => Promise<Buffer>>
     reload: Mock<() => void>
@@ -72,6 +73,7 @@ export function createMockWebContents(): MockWebContents {
     webContents: {
       debugger: debuggerObj,
       isDestroyed: () => destroyed,
+      isCrashed: () => false,
       focus: vi.fn(),
       printToPDF: vi.fn(async () => Buffer.from('%PDF-test')),
       reload: vi.fn(),
diff --git a/src/main/browser/cdp-ws-proxy.test.ts b/src/main/browser/cdp-ws-proxy.test.ts
index f744998ab24..db8eb82a1f8 100644
--- a/src/main/browser/cdp-ws-proxy.test.ts
+++ b/src/main/browser/cdp-ws-proxy.test.ts
@@ -803,23 +803,4 @@ describe('CdpWsProxy', () => {
     expect(removedEvents).toEqual(expect.arrayContaining(['message', 'close']))
     offSpy.mockRestore()
   })
-
-  it('rejects inflight requests on stop', async () => {
-    let resolveCommand: (v: unknown) => void
-    mock.webContents.debugger.sendCommand.mockImplementation(
-      () =>
-        new Promise((r) => {
-          resolveCommand = r as (v: unknown) => void
-        })
-    )
-
-    const client = await connect(endpoint)
-    client.send(JSON.stringify({ id: 1, method: 'Page.enable', params: {} }))
-
-    await new Promise((r) => setTimeout(r, 10))
-    await proxy.stop()
-
-    resolveCommand!({})
-    client.close()
-  })
 })
diff --git a/src/main/browser/guest-cdp-command.test.ts b/src/main/browser/guest-cdp-command.test.ts
new file mode 100644
index 00000000000..3ad71959681
--- /dev/null
+++ b/src/main/browser/guest-cdp-command.test.ts
@@ -0,0 +1,57 @@
+import { describe, expect, it, vi } from 'vitest'
+import { BrowserError } from './browser-error'
+import { sendGuestCdpCommand } from './guest-cdp-command'
+
+function makeGuest(state: { crashed?: boolean; destroyed?: boolean } = {}) {
+  const sendCommand = vi.fn(async () => ({ ok: true }))
+  const guest = {
+    isDestroyed: vi.fn(() => state.destroyed ?? false),
+    isCrashed: vi.fn(() => {
+      if (state.destroyed) {
+        throw new Error('Object has been destroyed')
+      }
+      return state.crashed ?? false
+    }),
+    debugger: { sendCommand }
+  }
+  return { guest, sendCommand }
+}
+
+describe('sendGuestCdpCommand', () => {
+  it.each(['Emulation.setDeviceMetricsOverride', 'Emulation.setVisibleSize'])(
+    'refuses %s while the renderer is gone instead of letting Chromium crash the app',
+    async (method) => {
+      const { guest, sendCommand } = makeGuest({ crashed: true })
+      const sent = sendGuestCdpCommand(guest, method, { width: 375, height: 667 })
+      await expect(sent).rejects.toBeInstanceOf(BrowserError)
+      await expect(sent).rejects.toMatchObject({ code: 'browser_cdp_error' })
+      expect(sendCommand).not.toHaveBeenCalled()
+    }
+  )
+
+  it('refuses a resize on a destroyed guest without asking it whether it crashed', async () => {
+    const { guest, sendCommand } = makeGuest({ destroyed: true })
+    await expect(
+      sendGuestCdpCommand(guest, 'Emulation.setDeviceMetricsOverride', { width: 1, height: 1 })
+    ).rejects.toBeInstanceOf(BrowserError)
+    expect(sendCommand).not.toHaveBeenCalled()
+  })
+
+  it('still sends commands that do not resize the view to a crashed guest', async () => {
+    const { guest, sendCommand } = makeGuest({ crashed: true })
+    await expect(
+      sendGuestCdpCommand(guest, 'Emulation.setUserAgentOverride', { userAgent: 'x' })
+    ).resolves.toEqual({ ok: true })
+    expect(sendCommand).toHaveBeenCalledWith('Emulation.setUserAgentOverride', { userAgent: 'x' })
+  })
+
+  it('sends a resize to a live guest, and passes a session id only when one is given', async () => {
+    const { guest, sendCommand } = makeGuest()
+    await sendGuestCdpCommand(guest, 'Emulation.setVisibleSize', { width: 2, height: 3 })
+    await sendGuestCdpCommand(guest, 'DOM.enable', {}, 'iframe-session')
+    expect(sendCommand.mock.calls).toEqual([
+      ['Emulation.setVisibleSize', { width: 2, height: 3 }],
+      ['DOM.enable', {}, 'iframe-session']
+    ])
+  })
+})
diff --git a/src/main/browser/guest-cdp-command.ts b/src/main/browser/guest-cdp-command.ts
new file mode 100644
index 00000000000..ed7735df2d8
--- /dev/null
+++ b/src/main/browser/guest-cdp-command.ts
@@ -0,0 +1,42 @@
+import type { WebContents } from 'electron'
+import { BrowserError } from './browser-error'
+
+// Why: Chromium resizes the page's view for these without checking the view still exists
+// (WebContentsImpl::SetDeviceEmulationSize). A crashed renderer takes its view with it until the
+// reload builds a new one, so one of these sent in that gap segfaults Orca's main process.
+const VIEW_RESIZING_CDP_METHODS: ReadonlySet<string> = new Set([
+  'Emulation.setDeviceMetricsOverride',
+  'Emulation.setVisibleSize'
+])
+
+type GuestCdpTarget = Pick<WebContents, 'isDestroyed' | 'isCrashed'> & {
+  debugger: Pick<WebContents['debugger'], 'sendCommand'>
+}
+
+/**
+ * The gate for guest CDP commands: every viewport writer and every sender that forwards a caller's
+ * method (agent bridge, CDP proxy) goes through here, so none can hand Chromium a command that
+ * crashes the app while the guest's renderer is dead.
+ */
+export function sendGuestCdpCommand(
+  guest: GuestCdpTarget,
+  method: string,
+  params?: Record<string, unknown>,
+  sessionId?: string
+): Promise<unknown> {
+  // Why same task as the send: isCrashed() flips in the same Chromium task that drops the view,
+  // so checking right before sendCommand leaves no gap for the renderer to die in between.
+  if (VIEW_RESIZING_CDP_METHODS.has(method) && (guest.isDestroyed() || guest.isCrashed())) {
+    return Promise.reject(
+      new BrowserError(
+        'browser_cdp_error',
+        'The page crashed; its viewport can be changed again once it reloads.'
+      )
+    )
+  }
+  return Promise.resolve(
+    sessionId === undefined
+      ? guest.debugger.sendCommand(method, params)
+      : guest.debugger.sendCommand(method, params, sessionId)
+  )
+}
diff --git a/src/main/browser/offscreen-browser-backend-lifecycle.test.ts b/src/main/browser/offscreen-browser-backend-lifecycle.test.ts
index a3758d70516..381489963a3 100644
--- a/src/main/browser/offscreen-browser-backend-lifecycle.test.ts
+++ b/src/main/browser/offscreen-browser-backend-lifecycle.test.ts
@@ -90,18 +90,16 @@ describe('OffscreenBrowserBackend lifecycle', () => {
   beforeEach(() => {
     mocks.windows.length = 0
     mocks.finishLoads = true
-    mocks.BrowserWindow.mockImplementation(
-      function BrowserWindowMock(this: {
-        webContents: MockWebContents
-        isDestroyed: () => boolean
-        destroy: () => void
-      }) {
-        const window = new MockBrowserWindow()
-        this.webContents = window.webContents
-        this.isDestroyed = window.isDestroyed.bind(window)
-        this.destroy = window.destroy.bind(window)
-      }
-    )
+    mocks.BrowserWindow.mockImplementation(function BrowserWindowMock(this: {
+      webContents: MockWebContents
+      isDestroyed: () => boolean
+      destroy: () => void
+    }) {
+      const window = new MockBrowserWindow()
+      this.webContents = window.webContents
+      this.isDestroyed = window.isDestroyed.bind(window)
+      this.destroy = window.destroy.bind(window)
+    })
   })
 
   it('settles a pending load and removes its waiters when the page is destroyed', async () => {
diff --git a/src/main/claude-accounts/claude-account-service-api-parity.test.ts b/src/main/claude-accounts/claude-account-service-api-parity.test.ts
index 206ccbd82af..09ec7813ffe 100644
--- a/src/main/claude-accounts/claude-account-service-api-parity.test.ts
+++ b/src/main/claude-accounts/claude-account-service-api-parity.test.ts
@@ -1,28 +1,10 @@
 import { describe, expect, it, vi } from 'vitest'
 import type { ClaudeRateLimitAccountsState } from '../../shared/managed-account-types'
 import { ClaudeAccountService } from './service'
-import type { ClaudeAccountAddTarget, ClaudeAccountImportOptions } from './service'
+import type { ClaudeAccountAddTarget } from './service'
 
 vi.mock('electron', () => ({ app: { getPath: () => '/tmp/orca-claude-api-parity' } }))
 
-type PublicClaudeAccountService = {
-  listAccounts(): ClaudeRateLimitAccountsState
-  addAccount(target?: ClaudeAccountAddTarget): Promise<ClaudeRateLimitAccountsState>
-  addAccountFromConfigDir(
-    configDir: string,
-    options?: ClaudeAccountImportOptions
-  ): Promise<ClaudeRateLimitAccountsState>
-  reauthenticateAccount(accountId: string): Promise<ClaudeRateLimitAccountsState>
-  removeAccount(accountId: string): Promise<ClaudeRateLimitAccountsState>
-  selectAccount(accountId: string | null): Promise<ClaudeRateLimitAccountsState>
-  selectAccountForTarget(
-    accountId: string | null,
-    target?: { runtime?: 'host' | 'wsl'; wslDistro?: string | null }
-  ): Promise<ClaudeRateLimitAccountsState>
-  cancelPendingLogin(): boolean
-  getRuntimeConfigDir(target?: { runtime?: 'host' | 'wsl'; wslDistro?: string | null }): string
-}
-
 function createService(): ClaudeAccountService {
   const settings = {
     claudeManagedAccounts: [],
@@ -41,16 +23,7 @@ function deferred(): { promise: Promise<void>; resolve: () => void } {
   return { promise: new Promise<void>((done) => (resolve = done)), resolve }
 }
 
-describe('ClaudeAccountService API parity', () => {
-  it('keeps the exact runtime export and assignable public surface', async () => {
-    const runtimeExports = await import('./service')
-    const service: PublicClaudeAccountService = createService()
-
-    expect(Object.keys(runtimeExports)).toEqual(['ClaudeAccountService'])
-    expect(service.cancelPendingLogin()).toBe(false)
-    expect(service.getRuntimeConfigDir()).toBe('/tmp/claude')
-  })
-
+describe('ClaudeAccountService mutation serialization', () => {
   it('serializes mutations within one service', async () => {
     const service = createService()
     const first = deferred()
diff --git a/src/main/claude-accounts/keychain.ts b/src/main/claude-accounts/keychain.ts
index eca0e9af44d..aa4dcfa64db 100644
--- a/src/main/claude-accounts/keychain.ts
+++ b/src/main/claude-accounts/keychain.ts
@@ -1,18 +1,15 @@
-import { execFile } from 'node:child_process'
 import { createHash } from 'node:crypto'
 import { lstatSync, realpathSync } from 'node:fs'
 import { userInfo } from 'node:os'
 import { basename, dirname, join } from 'node:path'
+import {
+  deleteKeychainPassword,
+  readKeychainPassword,
+  writeKeychainPassword
+} from '../macos-keychain/generic-password'
 
 const ACTIVE_CLAUDE_SERVICE = 'Claude Code-credentials'
 const ORCA_CLAUDE_SERVICE = 'Orca Claude Code Managed Credentials'
-const KEYCHAIN_COMMAND_TIMEOUT_MS = 3_000
-
-type SecurityCommandResult = {
-  stdout: string
-  stderr: string
-}
-
 export async function readActiveClaudeKeychainCredentials(
   configDir?: string
 ): Promise<string | null> {
@@ -183,136 +180,3 @@ function getActiveClaudeServices(configDir?: string): string[] {
   const scoped = claudeConfigDirKeychainAliases(configDir).map((dir) => getActiveClaudeService(dir))
   return [...new Set([...scoped, ACTIVE_CLAUDE_SERVICE])]
 }
-
-async function readKeychainPassword(service: string, account: string): Promise<string | null> {
-  if (process.platform !== 'darwin') {
-    return null
-  }
-  try {
-    const { stdout } = await execSecurityCommand([
-      'find-generic-password',
-      '-s',
-      service,
-      '-a',
-      account,
-      '-w'
-    ])
-    if (stdout.trim()) {
-      return stdout.trim()
-    }
-    throw new Error(`Could not read macOS Keychain item ${service}/${account}.`)
-  } catch (error) {
-    if (isKeychainNotFoundError(error)) {
-      return null
-    }
-    throw error
-  }
-}
-
-async function writeKeychainPassword(
-  service: string,
-  account: string,
-  contents: string
-): Promise<void> {
-  if (process.platform !== 'darwin') {
-    return
-  }
-  await execSecurity(['add-generic-password', '-U', '-s', service, '-a', account, '-w', contents])
-}
-
-async function deleteKeychainPassword(
-  service: string,
-  account: string,
-  options?: { failOnAccessError?: boolean }
-): Promise<void> {
-  if (process.platform !== 'darwin') {
-    return
-  }
-  await execSecurity(['delete-generic-password', '-s', service, '-a', account], {
-    ignoreNotFound: true,
-    ignoreFailure: !options?.failOnAccessError
-  })
-}
-
-function execSecurity(
-  args: string[],
-  options?: { ignoreFailure?: boolean; ignoreNotFound?: boolean }
-): Promise<void> {
-  return execSecurityCommand(args).then(undefined, (error: unknown) => {
-    if (options?.ignoreNotFound && isKeychainNotFoundError(error)) {
-      return
-    }
-    if (!options?.ignoreFailure) {
-      throw error
-    }
-  })
-}
-
-function isKeychainNotFoundError(error: unknown): boolean {
-  const code =
-    error && typeof error === 'object' && 'code' in error
-      ? (error as { code?: unknown }).code
-      : undefined
-  const message =
-    error && typeof error === 'object'
-      ? `${String((error as { stderr?: unknown }).stderr ?? '')} ${String(
-          (error as { message?: unknown }).message ?? ''
-        )}`.toLowerCase()
-      : String(error).toLowerCase()
-  return code === 44 || message.includes('could not be found') || message.includes('not be found')
-}
-
-function execSecurityCommand(args: string[]): Promise<SecurityCommandResult> {
-  return new Promise((resolve, reject) => {
-    let settled = false
-    let child: ReturnType<typeof execFile> | undefined
-    const timer = setTimeout(() => {
-      if (settled) {
-        return
-      }
-      settled = true
-      child?.kill()
-      reject(
-        Object.assign(new Error(`security timed out after ${KEYCHAIN_COMMAND_TIMEOUT_MS}ms`), {
-          code: 'ETIMEDOUT',
-          stderr: ''
-        })
-      )
-    }, KEYCHAIN_COMMAND_TIMEOUT_MS)
-
-    const settle = (callback: () => void): void => {
-      if (settled) {
-        return
-      }
-      settled = true
-      clearTimeout(timer)
-      callback()
-    }
-
-    // Why: Node's execFile timeout only signals the `security` process; a
-    // stuck callback would otherwise leave auth/keychain operations pending.
-    try {
-      child = execFile(
-        'security',
-        args,
-        { timeout: KEYCHAIN_COMMAND_TIMEOUT_MS },
-        (error, stdout, stderr) => {
-          if (error) {
-            settle(() =>
-              reject(
-                Object.assign(error, {
-                  stdout: String(stdout),
-                  stderr: String(stderr)
-                })
-              )
-            )
-            return
-          }
-          settle(() => resolve({ stdout: String(stdout), stderr: String(stderr) }))
-        }
-      )
-    } catch (error) {
-      settle(() => reject(error))
-    }
-  })
-}
diff --git a/src/main/claude-usage/store.ts b/src/main/claude-usage/store.ts
index f5fd8ca3ce3..686b32ab827 100644
--- a/src/main/claude-usage/store.ts
+++ b/src/main/claude-usage/store.ts
@@ -1,3 +1,4 @@
+import { claudeTokenSessions } from '../usage/agent-token-usage'
 import { app } from 'electron'
 import { join } from 'node:path'
 import type {
@@ -79,6 +80,10 @@ export class ClaudeUsageStore extends UsageProviderStoreLifecycle<
 > {
   constructor(store: Pick<Store, 'getRepos' | 'getAllWorktreeMeta'>) {
     super(store, {
+      tokenUsage: {
+        provider: 'claude',
+        selectSessions: (state) => claudeTokenSessions(state.sessions)
+      },
       logTag: '[claude-usage]',
       resolveCacheFile: getClaudeUsageFile,
       createDefaultState: getDefaultState,
diff --git a/src/main/claude/__fixtures__/claude-adapter-capture-early-steer.jsonl b/src/main/claude/__fixtures__/claude-adapter-capture-early-steer.jsonl
new file mode 100644
index 00000000000..bff60192d74
--- /dev/null
+++ b/src/main/claude/__fixtures__/claude-adapter-capture-early-steer.jsonl
@@ -0,0 +1,68 @@
+{"at": 0, "kind": "meta", "scenario": "early-steer", "providerSessionId": "00000000-0000-4000-8000-00000000c1a0", "note": "Recorded through Orca adapter vs Claude CLI 2.1.280; scrubbed: session id, home/tmp paths."}
+{"at": 219, "kind": "frame", "frame": {"type": "system", "subtype": "hook_started", "hook_id": "e13780eb-2f2b-45e5-a9fd-e7868ef6d9e2", "hook_name": "SessionStart:startup", "hook_event": "SessionStart", "uuid": "308e42c2-3222-452b-bb5f-f8e41cf485a4", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 229, "kind": "frame", "frame": {"type": "system", "subtype": "hook_response", "hook_id": "e13780eb-2f2b-45e5-a9fd-e7868ef6d9e2", "hook_name": "SessionStart:startup", "hook_event": "SessionStart", "output": "\n", "stdout": "\n", "stderr": "", "exit_code": 0, "outcome": "success", "uuid": "8c37d862-0ba3-4e14-a746-68a29d137384", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 242, "kind": "dispatch", "clientMessageId": "client-A", "sentUuid": "c64cdf14-1349-4be1-b0a4-5613890d57bd", "text": "Use the Bash tool to run `sleep 8` two separate times, one call at a time, waiting for each. Then reply exactly: FIRST DONE", "outcome": {"state": "admitted"}}
+{"at": 244, "kind": "frame", "frame": {"type": "system", "subtype": "session_state_changed", "state": "running", "uuid": "052ca984-de90-4289-ac97-587d361f35dc", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 244, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "c64cdf14-1349-4be1-b0a4-5613890d57bd", "state": "queued", "uuid": "e32cf6db-6c39-49ad-87a6-ad8f392e00b1", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 244, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "c64cdf14-1349-4be1-b0a4-5613890d57bd", "state": "started", "uuid": "0c7a74e6-8f5e-43c4-9cf0-af6e3fac6e0f", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 259, "kind": "frame", "frame": {"type": "system", "subtype": "init", "cwd": "/tmp/scrubbed-cwd", "session_id": "00000000-0000-4000-8000-00000000c1a0", "tools": ["Task", "AskUserQuestion", "Bash", "CronCreate", "CronDelete", "CronList", "DesignSync", "Edit", "EnterPlanMode", "EnterWorktree", "ExitPlanMode", "ExitWorktree", "ListAgents", "NotebookEdit", "Read", "ReportFindings", "ScheduleWakeup", "SendMessage", "Skill", "TaskCreate", "TaskGet", "TaskList", "TaskStop", "TaskUpdate", "ToolSearch", "WebFetch", "WebSearch", "Workflow", "Write"], "mcp_servers": [], "model": "claude-opus-5-5[1m]", "permissionMode": "default", "slash_commands": ["deep-research", "design", "design-sync", "dataviz", "update-config", "verify", "debug", "code-review", "simplify", "batch", "fewer-permission-prompts", "doctor", "loop", "claude-api", "workflow-authoring", "run", "run-skill-generator", "agents", "auto-mode-setup", "autocompact", "clear", "color", "compact", "config", "output-style", "context", "effort", "fast", "heapdump", "init", "mcp", "model", "__remote-workflow", "workflow-launch-exec", "reload-plugins", "reload-skills", "rename", "security-review", "usage", "insights", "recap", "goal", "design-consent", "design-revoke", "list-agents", "team-onboarding"], "terminal_slash_commands": ["doctor", "color", "reload-plugins"], "apiKeySource": "none", "claude_code_version": "2.1.280", "output_style": "default", "agents": ["claude", "Explore", "general-purpose", "Plan", "statusline-setup"], "skills": ["deep-research", "design", "design-sync", "dataviz", "update-config", "verify", "debug", "code-review", "simplify", "batch", "fewer-permission-prompts", "doctor", "loop", "claude-api", "workflow-authoring", "run", "run-skill-generator"], "plugins": [{"name": "telemetry", "path": "builtin", "source": "telemetry@builtin"}], "capabilities": ["interrupt_receipt_v1", "interrupt_cancel_queued_v1", "msg_lifecycle_v1", "mcp_read_resource_v1", "mcp_tool_ui_meta_v1"], "analytics_disabled": false, "product_feedback_disabled": false, "uuid": "ff6bb8ec-afcb-4bb8-88a8-d75625377ab9", "memory_paths": {"auto": "/Users/user/scrubbed"}, "messaging_socket_path": "/tmp/scrubbed.sock", "fast_mode_state": "off", "fast_mode_disabled_reason": "sdk_opt_in_required"}}
+{"at": 261, "kind": "frame", "frame": {"type": "system", "subtype": "status", "status": "requesting", "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "9900a74e-78ff-48a6-b005-8b748a8f7a1d"}}
+{"at": 492, "kind": "dispatch", "clientMessageId": "client-B", "sentUuid": "3a4cf7ae-5121-45d4-8c99-76625c847c4e", "text": "Also say the word banana at the end of your reply.", "outcome": {"state": "admitted"}}
+{"at": 493, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "3a4cf7ae-5121-45d4-8c99-76625c847c4e", "state": "queued", "uuid": "2244a4b7-a832-418a-b6e9-be4657618f60", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 1342, "kind": "frame", "frame": {"type": "user", "message": {"role": "user", "content": [{"type": "text", "text": "Use the Bash tool to run `sleep 8` two separate times, one call at a time, waiting for each. Then reply exactly: FIRST DONE"}]}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "c64cdf14-1349-4be1-b0a4-5613890d57bd", "timestamp": "2026-09-28T12:50:50.211Z", "isReplay": true}}
+{"at": 1342, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_start", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsEi9RgiS61CeGuiyaP", "type": "message", "role": "assistant", "content": [], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 5242, "cache_read_input_tokens": 11514, "cache_creation": {"ephemeral_5m_input_tokens": 5242, "ephemeral_1h_input_tokens": 0}, "output_tokens": 16, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "25b0f48f-8de3-4e58-a53f-76cedc10c4e8", "ttft_ms": 1075, "user_message_uuid": "c64cdf14-1349-4be1-b0a4-5613890d57bd", "user_message_uuids": ["c64cdf14-1349-4be1-b0a4-5613890d57bd"]}}
+{"at": 1342, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_start", "index": 0, "content_block": {"type": "tool_use", "id": "toolu_01RL5fbYfvXaRva9PBe2C7Qn", "name": "Bash", "input": {}, "caller": {"type": "direct"}}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "54809bd1-bb5a-4fe7-9a04-1dc60e5a7163"}}
+{"at": 1342, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": ""}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "02a681bb-01c9-4dd3-b890-040e17bf4132"}}
+{"at": 2307, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "{\"com"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "0a1147d0-c168-405a-a4e4-79ad5266d3c2"}}
+{"at": 2307, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "mand\": \"s"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "1eabfcb6-b0c4-403a-9804-c55b013391ae"}}
+{"at": 2307, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "lee"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "20f34e40-6392-4e4a-9991-ad35ad6b1aaa"}}
+{"at": 2309, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "p 8\""}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "ec8ed822-0e8f-46c1-b7a0-c8ab4467baa9"}}
+{"at": 2330, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": ", \"descri"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "87881476-c659-4e82-945d-be15eaa45501"}}
+{"at": 2332, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "ption\": \""}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "e2502f3a-3cca-4741-9df5-dade6f4e4abb"}}
+{"at": 2332, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "Sl"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "dc28f0f9-22f5-47fc-a374-1369c6fda079"}}
+{"at": 2335, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "eep f"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "85345f83-b80d-4142-aa66-66b8640dca3b"}}
+{"at": 2340, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "or 8 "}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "5ce61d4a-abd9-47bd-9c7b-e01a6d566387"}}
+{"at": 2341, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "seconds\"}"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "21de6d37-199b-44d7-bfaa-4af1471a7235"}}
+{"at": 2343, "kind": "frame", "frame": {"type": "assistant", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsEi9RgiS61CeGuiyaP", "type": "message", "role": "assistant", "content": [{"type": "tool_use", "id": "toolu_01RL5fbYfvXaRva9PBe2C7Qn", "name": "Bash", "input": {"command": "sleep 8", "description": "Sleep for 8 seconds"}, "caller": {"type": "direct"}}], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 5242, "cache_read_input_tokens": 11514, "cache_creation": {"ephemeral_5m_input_tokens": 5242, "ephemeral_1h_input_tokens": 0}, "output_tokens": 16, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "3f3c0fff-9ca6-49f9-8b73-36e569af5a38", "timestamp": "2026-09-28T12:50:52.296Z", "request_id": "req_011CfVsEhBPEiAFbbAE18svX", "user_message_uuid": "c64cdf14-1349-4be1-b0a4-5613890d57bd", "user_message_uuids": ["c64cdf14-1349-4be1-b0a4-5613890d57bd"]}}
+{"at": 2347, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_stop", "index": 0}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "fa196eb6-011b-4fa7-831d-4ffe2582a3c7"}}
+{"at": 2375, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_delta", "delta": {"stop_reason": "tool_use", "stop_sequence": null, "stop_details": null, "container": null}, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 5242, "cache_read_input_tokens": 11514, "output_tokens": 82, "output_tokens_details": {"thinking_tokens": 0}}, "context_management": {"applied_edits": []}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "7b300bd2-eaa1-4cb7-a557-6908cbb6f2a6"}}
+{"at": 2380, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_stop"}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "c1573618-e6fb-4f22-8939-e7959440f18a"}}
+{"at": 5482, "kind": "frame", "frame": {"type": "system", "subtype": "task_started", "task_id": "bys65yjga", "tool_use_id": "toolu_01RL5fbYfvXaRva9PBe2C7Qn", "description": "Sleep for 8 seconds", "is_backgrounded": false, "task_type": "local_bash", "uuid": "6b741fb3-6edc-4c9e-a69a-81fc87ef1502", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 10493, "kind": "frame", "frame": {"type": "system", "subtype": "task_notification", "task_id": "bys65yjga", "tool_use_id": "toolu_01RL5fbYfvXaRva9PBe2C7Qn", "status": "completed", "output_file": "", "summary": "Sleep for 8 seconds", "uuid": "9b0edc57-cd0c-4f60-a72c-e359e1a7fabc", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 10496, "kind": "frame", "frame": {"type": "user", "message": {"role": "user", "content": [{"tool_use_id": "toolu_01RL5fbYfvXaRva9PBe2C7Qn", "type": "tool_result", "content": "(Bash completed with no output)", "is_error": false}]}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "2f7a468f-55f1-4434-8f68-70a077f74f6e", "timestamp": "2026-09-28T12:51:00.450Z", "tool_use_result": {"stdout": "", "stderr": "", "interrupted": false, "isImage": false, "noOutputExpected": false}}}
+{"at": 10499, "kind": "frame", "frame": {"type": "user", "message": {"role": "user", "content": [{"type": "text", "text": "Also say the word banana at the end of your reply."}]}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "3a4cf7ae-5121-45d4-8c99-76625c847c4e", "timestamp": "2026-09-28T12:50:50.448Z", "isReplay": true}}
+{"at": 10499, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "3a4cf7ae-5121-45d4-8c99-76625c847c4e", "state": "started", "uuid": "aca666d1-c3b3-451e-81d7-5aadfa246b42", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 10499, "kind": "frame", "frame": {"type": "system", "subtype": "status", "status": "requesting", "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "ee6f2da9-2514-4086-8bc4-1a5c01e5207b"}}
+{"at": 11452, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_start", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsFTNDFHDiwBZc8cKWk", "type": "message", "role": "assistant", "content": [], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 217, "cache_read_input_tokens": 16756, "cache_creation": {"ephemeral_5m_input_tokens": 217, "ephemeral_1h_input_tokens": 0}, "output_tokens": 16, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "571285ce-eda5-44b5-818c-db549ee9aef9", "ttft_ms": 949}}
+{"at": 11452, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_start", "index": 0, "content_block": {"type": "tool_use", "id": "toolu_01HG7iwC2HgvoxndbuytmJCM", "name": "Bash", "input": {}, "caller": {"type": "direct"}}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "6d6d5ecd-0889-4592-b514-d72c0a964cc9"}}
+{"at": 11453, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": ""}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "58339280-14b3-4f61-bd2b-726418d4b324"}}
+{"at": 11853, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "{\"comma"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "37c5f88b-3ef0-471c-89b1-a8dc6f3f61ad"}}
+{"at": 11866, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "nd\": \"s"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "f31aa8f4-903d-4a7d-aeff-41c16f4b487d"}}
+{"at": 11866, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "leep 8\""}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "b1b59a9c-cec2-4398-9e8e-e49f16ad712d"}}
+{"at": 11882, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": ", \"desc"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "25d130db-a0f9-43d2-b639-6a9064f1e00d"}}
+{"at": 11883, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "ription"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "e0b776a6-7cb3-4512-bacc-07fc84a1737e"}}
+{"at": 11883, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "\": \"Sle"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "54ec71a5-84ad-4f45-849f-cdbeae44d781"}}
+{"at": 11883, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "ep for "}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "667d1090-ceca-4c88-9864-447d6c95784e"}}
+{"at": 11883, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "8 secon"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "2047e8e3-feb9-484d-8a1a-c19f0afebd59"}}
+{"at": 11883, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "ds\"}"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "7d4f9da1-d974-4acf-84a5-d1f22068beec"}}
+{"at": 11884, "kind": "frame", "frame": {"type": "assistant", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsFTNDFHDiwBZc8cKWk", "type": "message", "role": "assistant", "content": [{"type": "tool_use", "id": "toolu_01HG7iwC2HgvoxndbuytmJCM", "name": "Bash", "input": {"command": "sleep 8", "description": "Sleep for 8 seconds"}, "caller": {"type": "direct"}}], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 217, "cache_read_input_tokens": 16756, "cache_creation": {"ephemeral_5m_input_tokens": 217, "ephemeral_1h_input_tokens": 0}, "output_tokens": 16, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "6c4c5b57-e219-4c0d-a90f-26cbae8a33df", "timestamp": "2026-09-28T12:51:01.838Z", "request_id": "req_011CfVsFSwuBKQ87EU42vew5"}}
+{"at": 11885, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_stop", "index": 0}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "df9289e5-af2a-4b85-8dc8-47df67725383"}}
+{"at": 11885, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_delta", "delta": {"stop_reason": "tool_use", "stop_sequence": null, "stop_details": null, "container": null}, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 217, "cache_read_input_tokens": 16756, "output_tokens": 82, "output_tokens_details": {"thinking_tokens": 0}}, "context_management": {"applied_edits": []}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "7ac75599-4149-466f-ab0b-4d4ef74a9c86"}}
+{"at": 11885, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_stop"}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "ea092344-1e27-4b3f-9145-e388a268a4a1"}}
+{"at": 14890, "kind": "frame", "frame": {"type": "system", "subtype": "task_started", "task_id": "bu917pf4q", "tool_use_id": "toolu_01HG7iwC2HgvoxndbuytmJCM", "description": "Sleep for 8 seconds", "is_backgrounded": false, "task_type": "local_bash", "uuid": "408f8301-dbd6-43cb-8f09-7f7d5f4325da", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 19903, "kind": "frame", "frame": {"type": "system", "subtype": "task_notification", "task_id": "bu917pf4q", "tool_use_id": "toolu_01HG7iwC2HgvoxndbuytmJCM", "status": "completed", "output_file": "", "summary": "Sleep for 8 seconds", "uuid": "55ee40ae-c83e-40de-ae7c-fb0659950b39", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 19906, "kind": "frame", "frame": {"type": "user", "message": {"role": "user", "content": [{"tool_use_id": "toolu_01HG7iwC2HgvoxndbuytmJCM", "type": "tool_result", "content": "(Bash completed with no output)", "is_error": false}]}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "ee783948-1a20-4797-b0ef-b191babd6a68", "timestamp": "2026-09-28T12:51:09.859Z", "tool_use_result": {"stdout": "", "stderr": "", "interrupted": false, "isImage": false, "noOutputExpected": false}}}
+{"at": 19908, "kind": "frame", "frame": {"type": "system", "subtype": "status", "status": "requesting", "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "dec2fc2c-f27f-44c2-bbda-01b112f803d6"}}
+{"at": 21540, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_start", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsGBuJTPMNVKzDFTw9k", "type": "message", "role": "assistant", "content": [], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 121, "cache_read_input_tokens": 16973, "cache_creation": {"ephemeral_5m_input_tokens": 121, "ephemeral_1h_input_tokens": 0}, "output_tokens": 11, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "14cb8df8-de6e-43e8-a0be-46c883c88501", "ttft_ms": 1627}}
+{"at": 21540, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_start", "index": 0, "content_block": {"type": "text", "text": ""}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "f346ec9e-fe33-4c2e-a611-b2da26f43f53"}}
+{"at": 21540, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "text_delta", "text": "FIRST DONE ban"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "6440a3c0-de10-4e9e-a898-7ef0ec79673c"}}
+{"at": 21540, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "text_delta", "text": "ana"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "7096cb35-c640-4698-b755-8aad289d6cef"}}
+{"at": 21556, "kind": "frame", "frame": {"type": "assistant", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsGBuJTPMNVKzDFTw9k", "type": "message", "role": "assistant", "content": [{"type": "text", "text": "FIRST DONE banana"}], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 121, "cache_read_input_tokens": 16973, "cache_creation": {"ephemeral_5m_input_tokens": 121, "ephemeral_1h_input_tokens": 0}, "output_tokens": 11, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "5c9408ee-fcd2-46e8-aca0-1e2e8563420c", "timestamp": "2026-09-28T12:51:11.495Z", "request_id": "req_011CfVsG9F4VXdbez6Yd6wis"}}
+{"at": 21556, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_stop", "index": 0}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "12aa2a40-1da6-45bc-bd9e-a1f999c144d2"}}
+{"at": 21556, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_delta", "delta": {"stop_reason": "end_turn", "stop_sequence": null, "stop_details": null, "container": null}, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 121, "cache_read_input_tokens": 16973, "output_tokens": 11, "output_tokens_details": {"thinking_tokens": 0}}, "context_management": {"applied_edits": []}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "fee3cade-9b96-4f0e-8657-b23a6c6f83ca"}}
+{"at": 21557, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_stop"}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "b39aedff-1723-46d2-8fbf-d62b2fe8f2ac"}}
+{"at": 21559, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "3a4cf7ae-5121-45d4-8c99-76625c847c4e", "state": "completed", "uuid": "5b6a0e7a-361d-42ae-983a-5ecc00d6ff8c", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 21562, "kind": "frame", "frame": {"duration_api_ms": 6682, "stop_reason": "end_turn", "session_id": "00000000-0000-4000-8000-00000000c1a0", "total_cost_usd": 0.045744599999999996, "usage": {"input_tokens": 6, "cache_creation_input_tokens": 5580, "cache_read_input_tokens": 45243, "output_tokens": 175, "output_tokens_details": {"thinking_tokens": 0}, "server_tool_use": {"web_search_requests": 0, "web_fetch_requests": 0}, "service_tier": "standard", "cache_creation": {"ephemeral_1h_input_tokens": 0, "ephemeral_5m_input_tokens": 5580}, "inference_geo": "not_available", "iterations": [], "speed": "standard"}, "modelUsage": {"claude-opus-5-5[1m]": {"inputTokens": 1219, "outputTokens": 196, "cacheReadInputTokens": 45243, "cacheCreationInputTokens": 5580, "webSearchRequests": 0, "costUSD": 0.045744599999999996, "contextWindow": 1000000, "maxOutputTokens": 128000, "thinkingTokens": 0, "canonicalModel": "claude-opus-5-5", "provider": "firstParty", "costBasis": "list"}}, "permission_denials": [], "terminal_reason": "completed", "fast_mode_state": "off", "fast_mode_disabled_reason": "sdk_opt_in_required", "subagent_stats": {"spawned": 0, "requested": {"background": 0, "foreground": 0, "unset": 0}, "started_in_background": 0, "max_depth": 0, "spawned_by_subagents": 0, "completed": 0, "failed": 0, "killed": {"parent": 0, "user": 0, "system": 0}, "refused": {"depth_limit": 0, "concurrency_limit": 0, "budget": 0}, "by_type": {}}, "is_error": false, "num_turns": 3, "subtype": "success", "api_error_status": null, "result": "FIRST DONE banana", "ttft_ms": 2096, "type": "result", "duration_ms": 21314, "uuid": "02543cfd-4942-47f9-82d7-0bd79a2ed93d", "ttft_stream_ms": 1096, "time_to_request_ms": 21, "first_content_frame_ms": 1096, "user_message_uuid": "c64cdf14-1349-4be1-b0a4-5613890d57bd", "user_message_uuids": ["c64cdf14-1349-4be1-b0a4-5613890d57bd", "3a4cf7ae-5121-45d4-8c99-76625c847c4e"], "request_sent_wall_ms": 1790599850221, "queued_turn_count": 0, "result_index": 0}}
+{"at": 21563, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "c64cdf14-1349-4be1-b0a4-5613890d57bd", "state": "completed", "uuid": "ef4b1bcb-e9cf-42f0-a0f9-b25a59a56efe", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 21563, "kind": "frame", "frame": {"type": "system", "subtype": "session_state_changed", "state": "idle", "uuid": "fce05c2c-6c43-4c7d-a347-ec3e378e3afc", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 24574, "kind": "end", "results": 1}
diff --git a/src/main/claude/__fixtures__/claude-adapter-capture-fold.jsonl b/src/main/claude/__fixtures__/claude-adapter-capture-fold.jsonl
new file mode 100644
index 00000000000..5bf4b2f863c
--- /dev/null
+++ b/src/main/claude/__fixtures__/claude-adapter-capture-fold.jsonl
@@ -0,0 +1,65 @@
+{"at": 1, "kind": "meta", "scenario": "fold", "providerSessionId": "00000000-0000-4000-8000-00000000c1a0", "note": "Recorded through Orca adapter vs Claude CLI 2.1.280; scrubbed: session id, home/tmp paths."}
+{"at": 242, "kind": "frame", "frame": {"type": "system", "subtype": "hook_started", "hook_id": "e8d2b9c8-d0d0-442f-9b86-580619257967", "hook_name": "SessionStart:startup", "hook_event": "SessionStart", "uuid": "fedf8819-07f0-41f5-bc48-24a71fa9940d", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 254, "kind": "frame", "frame": {"type": "system", "subtype": "hook_response", "hook_id": "e8d2b9c8-d0d0-442f-9b86-580619257967", "hook_name": "SessionStart:startup", "hook_event": "SessionStart", "output": "\n", "stdout": "\n", "stderr": "", "exit_code": 0, "outcome": "success", "uuid": "fed65947-fa85-4c2d-9bd6-1c01159922b4", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 269, "kind": "dispatch", "clientMessageId": "client-A", "sentUuid": "c1a5941b-1bd4-4729-8289-5a25b22ff5b2", "text": "Use the Bash tool to run `sleep 8` two separate times, one call at a time, waiting for each. Then reply exactly: FIRST DONE", "outcome": {"state": "admitted"}}
+{"at": 272, "kind": "frame", "frame": {"type": "system", "subtype": "session_state_changed", "state": "running", "uuid": "c36c2f2e-5c24-426d-819b-ea5f89862dae", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 272, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "c1a5941b-1bd4-4729-8289-5a25b22ff5b2", "state": "queued", "uuid": "65530cf1-9a29-4668-9a9f-91616c315809", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 272, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "c1a5941b-1bd4-4729-8289-5a25b22ff5b2", "state": "started", "uuid": "69d4df37-8379-4fce-bbf7-2a3a6854fbf2", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 287, "kind": "frame", "frame": {"type": "system", "subtype": "init", "cwd": "/tmp/scrubbed-cwd", "session_id": "00000000-0000-4000-8000-00000000c1a0", "tools": ["Task", "AskUserQuestion", "Bash", "CronCreate", "CronDelete", "CronList", "DesignSync", "Edit", "EnterPlanMode", "EnterWorktree", "ExitPlanMode", "ExitWorktree", "ListAgents", "NotebookEdit", "Read", "ReportFindings", "ScheduleWakeup", "SendMessage", "Skill", "TaskCreate", "TaskGet", "TaskList", "TaskStop", "TaskUpdate", "ToolSearch", "WebFetch", "WebSearch", "Workflow", "Write"], "mcp_servers": [], "model": "claude-opus-5-5[1m]", "permissionMode": "default", "slash_commands": ["deep-research", "design", "design-sync", "dataviz", "update-config", "verify", "debug", "code-review", "simplify", "batch", "fewer-permission-prompts", "doctor", "loop", "claude-api", "workflow-authoring", "run", "run-skill-generator", "agents", "auto-mode-setup", "autocompact", "clear", "color", "compact", "config", "output-style", "context", "effort", "fast", "heapdump", "init", "mcp", "model", "__remote-workflow", "workflow-launch-exec", "reload-plugins", "reload-skills", "rename", "security-review", "usage", "insights", "recap", "goal", "design-consent", "design-revoke", "list-agents", "team-onboarding"], "terminal_slash_commands": ["doctor", "color", "reload-plugins"], "apiKeySource": "none", "claude_code_version": "2.1.280", "output_style": "default", "agents": ["claude", "Explore", "general-purpose", "Plan", "statusline-setup"], "skills": ["deep-research", "design", "design-sync", "dataviz", "update-config", "verify", "debug", "code-review", "simplify", "batch", "fewer-permission-prompts", "doctor", "loop", "claude-api", "workflow-authoring", "run", "run-skill-generator"], "plugins": [{"name": "telemetry", "path": "builtin", "source": "telemetry@builtin"}], "capabilities": ["interrupt_receipt_v1", "interrupt_cancel_queued_v1", "msg_lifecycle_v1", "mcp_read_resource_v1", "mcp_tool_ui_meta_v1"], "analytics_disabled": false, "product_feedback_disabled": false, "uuid": "facd6d73-8d9e-4886-a6ab-f0873938128e", "memory_paths": {"auto": "/Users/user/scrubbed"}, "messaging_socket_path": "/tmp/scrubbed.sock", "fast_mode_state": "off", "fast_mode_disabled_reason": "sdk_opt_in_required"}}
+{"at": 289, "kind": "frame", "frame": {"type": "system", "subtype": "status", "status": "requesting", "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "d34f89ba-f2ef-4cbf-99a5-7d4d85c8d02a"}}
+{"at": 1527, "kind": "frame", "frame": {"type": "user", "message": {"role": "user", "content": [{"type": "text", "text": "Use the Bash tool to run `sleep 8` two separate times, one call at a time, waiting for each. Then reply exactly: FIRST DONE"}]}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "c1a5941b-1bd4-4729-8289-5a25b22ff5b2", "timestamp": "2026-09-28T12:50:24.512Z", "isReplay": true}}
+{"at": 1528, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_start", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsCqF1QKvUNMHjZNCWW", "type": "message", "role": "assistant", "content": [], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 16754, "cache_read_input_tokens": 0, "cache_creation": {"ephemeral_5m_input_tokens": 16754, "ephemeral_1h_input_tokens": 0}, "output_tokens": 16, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "ac67ce6c-da49-4c1d-bf6a-70e2474ab35f", "ttft_ms": 1230, "user_message_uuid": "c1a5941b-1bd4-4729-8289-5a25b22ff5b2", "user_message_uuids": ["c1a5941b-1bd4-4729-8289-5a25b22ff5b2"]}}
+{"at": 1528, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_start", "index": 0, "content_block": {"type": "tool_use", "id": "toolu_01GoyahVsaJSkqYZzb3ci9KQ", "name": "Bash", "input": {}, "caller": {"type": "direct"}}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "9e8e16c5-d002-4034-b955-3a8a00523ba4"}}
+{"at": 1528, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": ""}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "b21cf048-3dbe-4d71-9bb0-9c139be8fb12"}}
+{"at": 2612, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "{\"comma"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "2aa7968c-7244-47f1-8e0c-e660514037ee"}}
+{"at": 2613, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "nd\": \"s"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "588330dc-afca-4aa7-b90c-73df15fee7c0"}}
+{"at": 2613, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "leep 8\""}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "75c0ecc9-4a50-4d6f-9731-3fed7e81d265"}}
+{"at": 2613, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": ", \"desc"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "a773fa58-791c-414f-94f1-a4a04534bdd7"}}
+{"at": 2613, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "ription"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "9de26ee7-6320-467a-b226-83ec143378d7"}}
+{"at": 2613, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "\": \"Sle"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "e3871642-e9b2-4e35-890e-d8d3a7a81e1e"}}
+{"at": 2613, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "ep 8 se"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "7c1891c7-d7b2-48df-a26e-a7265389c8c7"}}
+{"at": 2613, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "conds\"}"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "9d9be75c-c078-4bda-8a3f-dea3967d5a06"}}
+{"at": 2615, "kind": "frame", "frame": {"type": "assistant", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsCqF1QKvUNMHjZNCWW", "type": "message", "role": "assistant", "content": [{"type": "tool_use", "id": "toolu_01GoyahVsaJSkqYZzb3ci9KQ", "name": "Bash", "input": {"command": "sleep 8", "description": "Sleep 8 seconds"}, "caller": {"type": "direct"}}], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 16754, "cache_read_input_tokens": 0, "cache_creation": {"ephemeral_5m_input_tokens": 16754, "ephemeral_1h_input_tokens": 0}, "output_tokens": 16, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "0788da30-2441-4b32-803e-9ff172725739", "timestamp": "2026-09-28T12:50:26.842Z", "request_id": "req_011CfVsCppDCm7ZivTRsAYEu", "user_message_uuid": "c1a5941b-1bd4-4729-8289-5a25b22ff5b2", "user_message_uuids": ["c1a5941b-1bd4-4729-8289-5a25b22ff5b2"]}}
+{"at": 2619, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_stop", "index": 0}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "40dac8c9-408f-4079-8d63-57e0f3b43ca1"}}
+{"at": 2620, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_delta", "delta": {"stop_reason": "tool_use", "stop_sequence": null, "stop_details": null, "container": null}, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 16754, "cache_read_input_tokens": 0, "output_tokens": 81, "output_tokens_details": {"thinking_tokens": 0}}, "context_management": {"applied_edits": []}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "6d1c0ce1-f7ad-463a-ab3d-f7745bce63f9"}}
+{"at": 2621, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_stop"}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "b79333a8-7abc-4a32-a31f-249b5fea5f10"}}
+{"at": 3640, "kind": "dispatch", "clientMessageId": "client-B", "sentUuid": "7ee6ab25-eafb-4869-85fd-97d058045906", "text": "Also say the word banana at the end of your reply.", "outcome": {"state": "admitted"}}
+{"at": 3640, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "7ee6ab25-eafb-4869-85fd-97d058045906", "state": "queued", "uuid": "6395adb0-b318-4284-a298-7b3d89d6b7d7", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 5732, "kind": "frame", "frame": {"type": "system", "subtype": "task_started", "task_id": "beu0xkswp", "tool_use_id": "toolu_01GoyahVsaJSkqYZzb3ci9KQ", "description": "Sleep 8 seconds", "is_backgrounded": false, "task_type": "local_bash", "uuid": "a35b1b34-5810-47dd-bc2c-a38d19077a74", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 10740, "kind": "frame", "frame": {"type": "system", "subtype": "task_notification", "task_id": "beu0xkswp", "tool_use_id": "toolu_01GoyahVsaJSkqYZzb3ci9KQ", "status": "completed", "output_file": "", "summary": "Sleep 8 seconds", "uuid": "3f757c35-2f6c-4b21-bdf4-f8b523809abb", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 10743, "kind": "frame", "frame": {"type": "user", "message": {"role": "user", "content": [{"tool_use_id": "toolu_01GoyahVsaJSkqYZzb3ci9KQ", "type": "tool_result", "content": "(Bash completed with no output)", "is_error": false}]}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "abbb0dbf-e102-4c66-ba3c-7808d634f675", "timestamp": "2026-09-28T12:50:34.971Z", "tool_use_result": {"stdout": "", "stderr": "", "interrupted": false, "isImage": false, "noOutputExpected": false}}}
+{"at": 10744, "kind": "frame", "frame": {"type": "user", "message": {"role": "user", "content": [{"type": "text", "text": "Also say the word banana at the end of your reply."}]}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "7ee6ab25-eafb-4869-85fd-97d058045906", "timestamp": "2026-09-28T12:50:27.869Z", "isReplay": true}}
+{"at": 10745, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "7ee6ab25-eafb-4869-85fd-97d058045906", "state": "started", "uuid": "30f94896-494d-4002-a1ce-680620e03d54", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 10745, "kind": "frame", "frame": {"type": "system", "subtype": "status", "status": "requesting", "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "bf42e496-1f7f-4095-8d94-19390bd59e50"}}
+{"at": 11584, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_start", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsDaaVReUJ6r3tdEQhr", "type": "message", "role": "assistant", "content": [], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 216, "cache_read_input_tokens": 16754, "cache_creation": {"ephemeral_5m_input_tokens": 216, "ephemeral_1h_input_tokens": 0}, "output_tokens": 16, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "79159e21-d876-467f-abac-86bfe7bf2457", "ttft_ms": 836}}
+{"at": 11584, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_start", "index": 0, "content_block": {"type": "tool_use", "id": "toolu_01MxJ1cYsSb1chARZ735hbRk", "name": "Bash", "input": {}, "caller": {"type": "direct"}}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "469a075b-ff35-42c8-b20e-fe4fd3ccf250"}}
+{"at": 11585, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": ""}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "1a0aeaf4-6b9e-441e-86ac-eac3c32204c4"}}
+{"at": 12071, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "{\"comma"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "6bb65599-1e9a-40d6-a769-e2b119fee09a"}}
+{"at": 12072, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "nd\": \"s"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "04387767-2ce4-42ec-b869-11406432effc"}}
+{"at": 12072, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "leep 8\""}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "ccc9d7c3-19a3-4691-a104-ae6b9c1b4dfa"}}
+{"at": 12072, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": ", \"desc"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "90f5078e-ff14-45a6-9377-257c4545bb5f"}}
+{"at": 12072, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "ription"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "8f04f554-0875-450a-bc0b-89cb339c864b"}}
+{"at": 12072, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "\": \"Sle"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "6610a44a-019f-4136-a214-e0fc8e06d67f"}}
+{"at": 12073, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "ep 8 se"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "5caedf82-9c9e-4e13-ac26-d869ce84e863"}}
+{"at": 12073, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "conds\"}"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "8151a90d-7bae-4805-b709-124001edee1d"}}
+{"at": 12073, "kind": "frame", "frame": {"type": "assistant", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsDaaVReUJ6r3tdEQhr", "type": "message", "role": "assistant", "content": [{"type": "tool_use", "id": "toolu_01MxJ1cYsSb1chARZ735hbRk", "name": "Bash", "input": {"command": "sleep 8", "description": "Sleep 8 seconds"}, "caller": {"type": "direct"}}], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 216, "cache_read_input_tokens": 16754, "cache_creation": {"ephemeral_5m_input_tokens": 216, "ephemeral_1h_input_tokens": 0}, "output_tokens": 16, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "6aaa7086-2892-4c73-a6b6-caef6cf1a2f5", "timestamp": "2026-09-28T12:50:36.299Z", "request_id": "req_011CfVsDa8gykAqKH3jsZE4P"}}
+{"at": 12074, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_stop", "index": 0}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "3a4aa6b1-647e-4228-94c5-decf6d567a2f"}}
+{"at": 12074, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_delta", "delta": {"stop_reason": "tool_use", "stop_sequence": null, "stop_details": null, "container": null}, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 216, "cache_read_input_tokens": 16754, "output_tokens": 81, "output_tokens_details": {"thinking_tokens": 0}}, "context_management": {"applied_edits": []}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "a09a8560-21b5-410c-9337-1abfb30caff1"}}
+{"at": 12074, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_stop"}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "90522211-133a-4a50-8ae9-21bdef5590d1"}}
+{"at": 15093, "kind": "frame", "frame": {"type": "system", "subtype": "task_started", "task_id": "btowzyjp1", "tool_use_id": "toolu_01MxJ1cYsSb1chARZ735hbRk", "description": "Sleep 8 seconds", "is_backgrounded": false, "task_type": "local_bash", "uuid": "c5aa424b-840a-43a2-9586-94feff2f1b97", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 20107, "kind": "frame", "frame": {"type": "system", "subtype": "task_notification", "task_id": "btowzyjp1", "tool_use_id": "toolu_01MxJ1cYsSb1chARZ735hbRk", "status": "completed", "output_file": "", "summary": "Sleep 8 seconds", "uuid": "9ad2b377-9339-4fe9-a2aa-ee9acdb41d08", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 20109, "kind": "frame", "frame": {"type": "user", "message": {"role": "user", "content": [{"tool_use_id": "toolu_01MxJ1cYsSb1chARZ735hbRk", "type": "tool_result", "content": "(Bash completed with no output)", "is_error": false}]}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "e3b1fa1e-6a3d-4156-a1fe-2146aeff2b1e", "timestamp": "2026-09-28T12:50:44.337Z", "tool_use_result": {"stdout": "", "stderr": "", "interrupted": false, "isImage": false, "noOutputExpected": false}}}
+{"at": 20110, "kind": "frame", "frame": {"type": "system", "subtype": "status", "status": "requesting", "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "990bcabe-2776-4b87-9ba9-788d3fff81cf"}}
+{"at": 21105, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_start", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsEGxMrQeN7Y4miT6gp", "type": "message", "role": "assistant", "content": [], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 120, "cache_read_input_tokens": 16970, "cache_creation": {"ephemeral_5m_input_tokens": 120, "ephemeral_1h_input_tokens": 0}, "output_tokens": 11, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "2d867ea9-894a-4dfa-a589-7a689402c6b2", "ttft_ms": 992}}
+{"at": 21105, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_start", "index": 0, "content_block": {"type": "text", "text": ""}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "ed2beb08-68a1-4159-953c-7a0b85729f4d"}}
+{"at": 21106, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "text_delta", "text": "FIRST DONE ban"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "581dc001-4ef8-4f1b-a741-0534f316d810"}}
+{"at": 21106, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "text_delta", "text": "ana"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "99a38535-8448-4953-b98e-f0740fc8e13a"}}
+{"at": 21117, "kind": "frame", "frame": {"type": "assistant", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsEGxMrQeN7Y4miT6gp", "type": "message", "role": "assistant", "content": [{"type": "text", "text": "FIRST DONE banana"}], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 120, "cache_read_input_tokens": 16970, "cache_creation": {"ephemeral_5m_input_tokens": 120, "ephemeral_1h_input_tokens": 0}, "output_tokens": 11, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "64e7945b-f3a9-409b-a58d-923a9c4a1f6a", "timestamp": "2026-09-28T12:50:45.334Z", "request_id": "req_011CfVsEGYJNniXhLXGpV5vr"}}
+{"at": 21117, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_stop", "index": 0}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "68da798f-ddd8-4af5-b012-ce4a10811bda"}}
+{"at": 21117, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_delta", "delta": {"stop_reason": "end_turn", "stop_sequence": null, "stop_details": null, "container": null}, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 120, "cache_read_input_tokens": 16970, "output_tokens": 11, "output_tokens_details": {"thinking_tokens": 0}}, "context_management": {"applied_edits": []}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "29e16ff5-ab3b-4406-843f-049ee48650cd"}}
+{"at": 21117, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_stop"}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "5b7d6bae-6827-48c9-8fab-e43e55949198"}}
+{"at": 21119, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "7ee6ab25-eafb-4869-85fd-97d058045906", "state": "completed", "uuid": "0e958675-6553-46b7-9d98-5b667248666d", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 21120, "kind": "frame", "frame": {"duration_api_ms": 6661, "stop_reason": "end_turn", "session_id": "00000000-0000-4000-8000-00000000c1a0", "total_cost_usd": 0.10095080000000002, "usage": {"input_tokens": 6, "cache_creation_input_tokens": 17090, "cache_read_input_tokens": 33724, "output_tokens": 173, "output_tokens_details": {"thinking_tokens": 0}, "server_tool_use": {"web_search_requests": 0, "web_fetch_requests": 0}, "service_tier": "standard", "cache_creation": {"ephemeral_1h_input_tokens": 0, "ephemeral_5m_input_tokens": 17090}, "inference_geo": "not_available", "iterations": [], "speed": "standard"}, "modelUsage": {"claude-opus-5-5[1m]": {"inputTokens": 1219, "outputTokens": 194, "cacheReadInputTokens": 33724, "cacheCreationInputTokens": 17090, "webSearchRequests": 0, "costUSD": 0.10095080000000002, "contextWindow": 1000000, "maxOutputTokens": 128000, "thinkingTokens": 0, "canonicalModel": "claude-opus-5-5", "provider": "firstParty", "costBasis": "list"}}, "permission_denials": [], "terminal_reason": "completed", "fast_mode_state": "off", "fast_mode_disabled_reason": "sdk_opt_in_required", "subagent_stats": {"spawned": 0, "requested": {"background": 0, "foreground": 0, "unset": 0}, "started_in_background": 0, "max_depth": 0, "spawned_by_subagents": 0, "completed": 0, "failed": 0, "killed": {"parent": 0, "user": 0, "system": 0}, "refused": {"depth_limit": 0, "concurrency_limit": 0, "budget": 0}, "by_type": {}}, "is_error": false, "num_turns": 3, "subtype": "success", "api_error_status": null, "result": "FIRST DONE banana", "ttft_ms": 2340, "type": "result", "duration_ms": 20846, "uuid": "408f97b8-b880-47f8-b778-f94e4e15cd92", "ttft_stream_ms": 1253, "time_to_request_ms": 24, "first_content_frame_ms": 1253, "user_message_uuid": "c1a5941b-1bd4-4729-8289-5a25b22ff5b2", "user_message_uuids": ["c1a5941b-1bd4-4729-8289-5a25b22ff5b2", "7ee6ab25-eafb-4869-85fd-97d058045906"], "request_sent_wall_ms": 1790599824526, "queued_turn_count": 0, "result_index": 0}}
+{"at": 21121, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "c1a5941b-1bd4-4729-8289-5a25b22ff5b2", "state": "completed", "uuid": "3b91d2ee-409f-45f5-a7be-aa7a45fb6ac5", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 21121, "kind": "frame", "frame": {"type": "system", "subtype": "session_state_changed", "state": "idle", "uuid": "4de40f8a-4b6c-4333-b1e6-ff528d249af9", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 24243, "kind": "end", "results": 1}
diff --git a/src/main/claude/__fixtures__/claude-adapter-capture-miss.jsonl b/src/main/claude/__fixtures__/claude-adapter-capture-miss.jsonl
new file mode 100644
index 00000000000..211f6e0eb8d
--- /dev/null
+++ b/src/main/claude/__fixtures__/claude-adapter-capture-miss.jsonl
@@ -0,0 +1,85 @@
+{"at": 1, "kind": "meta", "scenario": "miss", "providerSessionId": "00000000-0000-4000-8000-00000000c1a0", "note": "Recorded through Orca adapter vs Claude CLI 2.1.280; scrubbed: session id, home/tmp paths."}
+{"at": 228, "kind": "frame", "frame": {"type": "system", "subtype": "hook_started", "hook_id": "06af4bab-bef3-426b-96b7-733316a3b251", "hook_name": "SessionStart:startup", "hook_event": "SessionStart", "uuid": "9eb2ab97-dce5-430e-9db3-e7d9aa0e7f8d", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 239, "kind": "frame", "frame": {"type": "system", "subtype": "hook_response", "hook_id": "06af4bab-bef3-426b-96b7-733316a3b251", "hook_name": "SessionStart:startup", "hook_event": "SessionStart", "output": "\n", "stdout": "\n", "stderr": "", "exit_code": 0, "outcome": "success", "uuid": "e2266c8c-8e91-4893-9806-1286769a12fd", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 255, "kind": "dispatch", "clientMessageId": "client-A", "sentUuid": "712482eb-4c05-4f67-8888-a11843c2729f", "text": "Use the Bash tool to run `sleep 8` two separate times, one call at a time, waiting for each. Then reply exactly: FIRST DONE", "outcome": {"state": "admitted"}}
+{"at": 257, "kind": "frame", "frame": {"type": "system", "subtype": "session_state_changed", "state": "running", "uuid": "a6e277fb-d7fc-418a-88f2-2d893feea0d0", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 257, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "712482eb-4c05-4f67-8888-a11843c2729f", "state": "queued", "uuid": "57d845c0-8945-4528-82a5-8fbe83381714", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 258, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "712482eb-4c05-4f67-8888-a11843c2729f", "state": "started", "uuid": "a2a8821a-7b4a-4332-95da-765eb95c2745", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 273, "kind": "frame", "frame": {"type": "system", "subtype": "init", "cwd": "/tmp/scrubbed-cwd", "session_id": "00000000-0000-4000-8000-00000000c1a0", "tools": ["Task", "AskUserQuestion", "Bash", "CronCreate", "CronDelete", "CronList", "DesignSync", "Edit", "EnterPlanMode", "EnterWorktree", "ExitPlanMode", "ExitWorktree", "ListAgents", "NotebookEdit", "Read", "ReportFindings", "ScheduleWakeup", "SendMessage", "Skill", "TaskCreate", "TaskGet", "TaskList", "TaskStop", "TaskUpdate", "ToolSearch", "WebFetch", "WebSearch", "Workflow", "Write"], "mcp_servers": [], "model": "claude-opus-5-5[1m]", "permissionMode": "default", "slash_commands": ["deep-research", "design", "design-sync", "dataviz", "update-config", "verify", "debug", "code-review", "simplify", "batch", "fewer-permission-prompts", "doctor", "loop", "claude-api", "workflow-authoring", "run", "run-skill-generator", "agents", "auto-mode-setup", "autocompact", "clear", "color", "compact", "config", "output-style", "context", "effort", "fast", "heapdump", "init", "mcp", "model", "__remote-workflow", "workflow-launch-exec", "reload-plugins", "reload-skills", "rename", "security-review", "usage", "insights", "recap", "goal", "design-consent", "design-revoke", "list-agents", "team-onboarding"], "terminal_slash_commands": ["doctor", "color", "reload-plugins"], "apiKeySource": "none", "claude_code_version": "2.1.280", "output_style": "default", "agents": ["claude", "Explore", "general-purpose", "Plan", "statusline-setup"], "skills": ["deep-research", "design", "design-sync", "dataviz", "update-config", "verify", "debug", "code-review", "simplify", "batch", "fewer-permission-prompts", "doctor", "loop", "claude-api", "workflow-authoring", "run", "run-skill-generator"], "plugins": [{"name": "telemetry", "path": "builtin", "source": "telemetry@builtin"}], "capabilities": ["interrupt_receipt_v1", "interrupt_cancel_queued_v1", "msg_lifecycle_v1", "mcp_read_resource_v1", "mcp_tool_ui_meta_v1"], "analytics_disabled": false, "product_feedback_disabled": false, "uuid": "ea0c12f1-7e48-4001-a577-5e4abb2e9c5f", "memory_paths": {"auto": "/Users/user/scrubbed"}, "messaging_socket_path": "/tmp/scrubbed.sock", "fast_mode_state": "off", "fast_mode_disabled_reason": "sdk_opt_in_required"}}
+{"at": 275, "kind": "frame", "frame": {"type": "system", "subtype": "status", "status": "requesting", "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "85ed497a-5e78-4ac6-aa9c-2ebe37063403"}}
+{"at": 1303, "kind": "frame", "frame": {"type": "user", "message": {"role": "user", "content": [{"type": "text", "text": "Use the Bash tool to run `sleep 8` two separate times, one call at a time, waiting for each. Then reply exactly: FIRST DONE"}]}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "712482eb-4c05-4f67-8888-a11843c2729f", "timestamp": "2026-09-28T12:51:16.373Z", "isReplay": true}}
+{"at": 1303, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_start", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsGeUUTEuaYMdT2HtPQ", "type": "message", "role": "assistant", "content": [], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 5244, "cache_read_input_tokens": 11514, "cache_creation": {"ephemeral_5m_input_tokens": 5244, "ephemeral_1h_input_tokens": 0}, "output_tokens": 16, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "61853b4b-5722-4b7b-94d8-15304f575d2c", "ttft_ms": 1022, "user_message_uuid": "712482eb-4c05-4f67-8888-a11843c2729f", "user_message_uuids": ["712482eb-4c05-4f67-8888-a11843c2729f"]}}
+{"at": 1304, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_start", "index": 0, "content_block": {"type": "tool_use", "id": "toolu_016sNyp5R1LwYkaBUj9UKWYs", "name": "Bash", "input": {}, "caller": {"type": "direct"}}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "df0f12a2-35bb-424c-8f28-40e6fcc07960"}}
+{"at": 1304, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": ""}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "5bcd51ce-460b-4891-8978-332c44f66114"}}
+{"at": 2559, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "{\"comma"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "9744edc1-59cc-4c22-959a-8bfba7abc2ef"}}
+{"at": 2559, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "nd\": \"s"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "4b7645f6-f050-4271-91f0-544df1ff0931"}}
+{"at": 2559, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "leep 8\""}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "11acbd0f-fc8e-4642-8897-8815951dd4ee"}}
+{"at": 2637, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": ", \"desc"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "4d140c8b-47f3-44e4-aade-212f63e2b40a"}}
+{"at": 2637, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "ription"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "a51d0b53-c118-4de5-a848-aa4bdf7d86c7"}}
+{"at": 2649, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "\": \"Sle"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "a128c776-0a6a-4923-952f-3633f4b91239"}}
+{"at": 2649, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "ep for "}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "ddce72e4-cbcc-45f1-966d-dd873f59d687"}}
+{"at": 2650, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "8 secon"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "44392f6b-e3ac-4caa-8abe-ee1b99ba6783"}}
+{"at": 2650, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "ds\"}"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "a5bc170f-84ba-4ac7-b104-b36d95c69049"}}
+{"at": 2652, "kind": "frame", "frame": {"type": "assistant", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsGeUUTEuaYMdT2HtPQ", "type": "message", "role": "assistant", "content": [{"type": "tool_use", "id": "toolu_016sNyp5R1LwYkaBUj9UKWYs", "name": "Bash", "input": {"command": "sleep 8", "description": "Sleep for 8 seconds"}, "caller": {"type": "direct"}}], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 5244, "cache_read_input_tokens": 11514, "cache_creation": {"ephemeral_5m_input_tokens": 5244, "ephemeral_1h_input_tokens": 0}, "output_tokens": 16, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "4a86f704-4cdc-4561-840d-dee6e913ebf9", "timestamp": "2026-09-28T12:51:18.753Z", "request_id": "req_011CfVsGe1gx1SqtHypyjG4P", "user_message_uuid": "712482eb-4c05-4f67-8888-a11843c2729f", "user_message_uuids": ["712482eb-4c05-4f67-8888-a11843c2729f"]}}
+{"at": 2655, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_stop", "index": 0}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "f79e14ed-a3e2-4ebf-88bb-a45ed5ee6a78"}}
+{"at": 2657, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_delta", "delta": {"stop_reason": "tool_use", "stop_sequence": null, "stop_details": null, "container": null}, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 5244, "cache_read_input_tokens": 11514, "output_tokens": 82, "output_tokens_details": {"thinking_tokens": 0}}, "context_management": {"applied_edits": []}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "6b586bec-0544-4cdb-9fc5-fadae3c7d6ed"}}
+{"at": 2657, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_stop"}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "3c602652-b8a2-4b38-b54d-ecb1f99b1201"}}
+{"at": 5768, "kind": "frame", "frame": {"type": "system", "subtype": "task_started", "task_id": "bnnik2zr1", "tool_use_id": "toolu_016sNyp5R1LwYkaBUj9UKWYs", "description": "Sleep for 8 seconds", "is_backgrounded": false, "task_type": "local_bash", "uuid": "5213fad9-0ff9-4f01-b934-7f7155ba396b", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 10782, "kind": "frame", "frame": {"type": "system", "subtype": "task_notification", "task_id": "bnnik2zr1", "tool_use_id": "toolu_016sNyp5R1LwYkaBUj9UKWYs", "status": "completed", "output_file": "", "summary": "Sleep for 8 seconds", "uuid": "f37669e5-c402-43ac-823f-1a7f9005a834", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 10785, "kind": "frame", "frame": {"type": "user", "message": {"role": "user", "content": [{"tool_use_id": "toolu_016sNyp5R1LwYkaBUj9UKWYs", "type": "tool_result", "content": "(Bash completed with no output)", "is_error": false}]}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "12161028-12c4-470e-a82d-1f6f4ee64aba", "timestamp": "2026-09-28T12:51:26.887Z", "tool_use_result": {"stdout": "", "stderr": "", "interrupted": false, "isImage": false, "noOutputExpected": false}}}
+{"at": 10787, "kind": "frame", "frame": {"type": "system", "subtype": "status", "status": "requesting", "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "e0454575-2f1d-47c0-b9f3-4ecadbaaa122"}}
+{"at": 11596, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_start", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsHQJiVw1uJvCEPhMGa", "type": "message", "role": "assistant", "content": [], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 121, "cache_read_input_tokens": 16758, "cache_creation": {"ephemeral_5m_input_tokens": 121, "ephemeral_1h_input_tokens": 0}, "output_tokens": 16, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "834585ab-8f03-423d-ae43-825a12b9f45e", "ttft_ms": 805}}
+{"at": 11597, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_start", "index": 0, "content_block": {"type": "tool_use", "id": "toolu_01BiKvSfSEAwNM1DwshGhsT6", "name": "Bash", "input": {}, "caller": {"type": "direct"}}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "273975d6-06bf-4eff-87aa-dca1a6d39b5c"}}
+{"at": 11597, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": ""}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "2c9121cf-a472-476e-9626-05d4577ff349"}}
+{"at": 11950, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "{\"comma"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "c2cb4769-ee86-4eda-9af7-f75a89493101"}}
+{"at": 11950, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "nd\": \"s"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "8e70eae8-653c-40ad-8a12-f37068234009"}}
+{"at": 11950, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "leep 8\""}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "0135507b-0b6e-41fe-bd1c-17becb10430f"}}
+{"at": 12026, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": ", \"desc"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "94802121-d71b-4781-856c-f40f78498ebe"}}
+{"at": 12026, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "ription"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "ec03999d-3810-405e-b36a-58d8d0f4e4ac"}}
+{"at": 12026, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "\": \"Sle"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "2183a548-e1b7-48c5-a4d8-58ab6ae4acc9"}}
+{"at": 12026, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "ep for "}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "d8ffd37e-3d9d-46a4-b6e1-d52cb96a334d"}}
+{"at": 12026, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "8 secon"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "2c51be8c-ef09-42eb-a07b-c9083d3e349c"}}
+{"at": 12026, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "input_json_delta", "partial_json": "ds\"}"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "e4957303-3d3f-47b4-aaed-0ec6210e1e81"}}
+{"at": 12027, "kind": "frame", "frame": {"type": "assistant", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsHQJiVw1uJvCEPhMGa", "type": "message", "role": "assistant", "content": [{"type": "tool_use", "id": "toolu_01BiKvSfSEAwNM1DwshGhsT6", "name": "Bash", "input": {"command": "sleep 8", "description": "Sleep for 8 seconds"}, "caller": {"type": "direct"}}], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 121, "cache_read_input_tokens": 16758, "cache_creation": {"ephemeral_5m_input_tokens": 121, "ephemeral_1h_input_tokens": 0}, "output_tokens": 16, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "03e0a7fa-a83c-4688-9504-8b7fa5c9f6ff", "timestamp": "2026-09-28T12:51:28.129Z", "request_id": "req_011CfVsHPsQjwKL4424e8EfN"}}
+{"at": 12028, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_stop", "index": 0}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "56ad793f-dcd0-4f9d-9dcc-49c2054d18c7"}}
+{"at": 12036, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_delta", "delta": {"stop_reason": "tool_use", "stop_sequence": null, "stop_details": null, "container": null}, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 121, "cache_read_input_tokens": 16758, "output_tokens": 82, "output_tokens_details": {"thinking_tokens": 0}}, "context_management": {"applied_edits": []}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "98e98f29-79a1-4db9-9cd4-c4fe810eca7e"}}
+{"at": 12036, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_stop"}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "3629fbc7-6420-45ae-88be-cd9b779e721a"}}
+{"at": 15034, "kind": "frame", "frame": {"type": "system", "subtype": "task_started", "task_id": "buewgpxis", "tool_use_id": "toolu_01BiKvSfSEAwNM1DwshGhsT6", "description": "Sleep for 8 seconds", "is_backgrounded": false, "task_type": "local_bash", "uuid": "fa9ac561-8bf7-4035-9aa8-221e4cd91dfb", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 20045, "kind": "frame", "frame": {"type": "system", "subtype": "task_notification", "task_id": "buewgpxis", "tool_use_id": "toolu_01BiKvSfSEAwNM1DwshGhsT6", "status": "completed", "output_file": "", "summary": "Sleep for 8 seconds", "uuid": "230550ea-a7f7-4171-9080-901cfdd0d571", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 20047, "kind": "frame", "frame": {"type": "user", "message": {"role": "user", "content": [{"tool_use_id": "toolu_01BiKvSfSEAwNM1DwshGhsT6", "type": "tool_result", "content": "(Bash completed with no output)", "is_error": false}]}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "68545b22-4c1b-44df-a0ec-5876d2c19aee", "timestamp": "2026-09-28T12:51:36.149Z", "tool_use_result": {"stdout": "", "stderr": "", "interrupted": false, "isImage": false, "noOutputExpected": false}}}
+{"at": 20048, "kind": "frame", "frame": {"type": "system", "subtype": "status", "status": "requesting", "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "e14bc8d3-a5bf-4d52-b841-9b5632247863"}}
+{"at": 20123, "kind": "dispatch", "clientMessageId": "client-B", "sentUuid": "6f0204a5-a21a-47a4-9517-034cc4467b52", "text": "Also say the word banana at the end of your reply.", "outcome": {"state": "admitted"}}
+{"at": 20124, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "6f0204a5-a21a-47a4-9517-034cc4467b52", "state": "queued", "uuid": "87c94a31-75e5-400a-9551-ca24c36b9be5", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 21070, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_start", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsJ6bNbeN2V5Wbst25o", "type": "message", "role": "assistant", "content": [], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 17000, "cache_read_input_tokens": 0, "cache_creation": {"ephemeral_5m_input_tokens": 17000, "ephemeral_1h_input_tokens": 0}, "output_tokens": 9, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "02c04bc0-68be-4721-a24d-27e7fa4a93db", "ttft_ms": 1019}}
+{"at": 21071, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_start", "index": 0, "content_block": {"type": "text", "text": ""}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "c90f97b4-2cd4-482d-af20-cd921f5915ef"}}
+{"at": 21071, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "text_delta", "text": "FIRST DONE"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "059a395d-c0a0-4a06-b483-240c3aece7ff"}}
+{"at": 21082, "kind": "frame", "frame": {"type": "assistant", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsJ6bNbeN2V5Wbst25o", "type": "message", "role": "assistant", "content": [{"type": "text", "text": "FIRST DONE"}], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 17000, "cache_read_input_tokens": 0, "cache_creation": {"ephemeral_5m_input_tokens": 17000, "ephemeral_1h_input_tokens": 0}, "output_tokens": 9, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "fc532a8b-2d4d-4cb9-92a5-ea1c509a8019", "timestamp": "2026-09-28T12:51:37.173Z", "request_id": "req_011CfVsJ5eaEpxJgCRB1U4zr"}}
+{"at": 21082, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_stop", "index": 0}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "81e56773-385a-4016-a0ec-ce01d277b9d1"}}
+{"at": 21082, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_delta", "delta": {"stop_reason": "end_turn", "stop_sequence": null, "stop_details": null, "container": null}, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 17000, "cache_read_input_tokens": 0, "output_tokens": 9, "output_tokens_details": {"thinking_tokens": 0}}, "context_management": {"applied_edits": []}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "ea179db4-6487-4447-927e-ae75d31097a2"}}
+{"at": 21082, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_stop"}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "6de38f87-568d-4573-960c-a6143bc8ecda"}}
+{"at": 21085, "kind": "frame", "frame": {"duration_api_ms": 6803, "stop_reason": "end_turn", "session_id": "00000000-0000-4000-8000-00000000c1a0", "total_cost_usd": 0.1262354, "usage": {"input_tokens": 6, "cache_creation_input_tokens": 22365, "cache_read_input_tokens": 28272, "output_tokens": 173, "output_tokens_details": {"thinking_tokens": 0}, "server_tool_use": {"web_search_requests": 0, "web_fetch_requests": 0}, "service_tier": "standard", "cache_creation": {"ephemeral_1h_input_tokens": 0, "ephemeral_5m_input_tokens": 22365}, "inference_geo": "not_available", "iterations": [], "speed": "standard"}, "modelUsage": {"claude-opus-5-5[1m]": {"inputTokens": 1219, "outputTokens": 194, "cacheReadInputTokens": 28272, "cacheCreationInputTokens": 22365, "webSearchRequests": 0, "costUSD": 0.1262354, "contextWindow": 1000000, "maxOutputTokens": 128000, "thinkingTokens": 0, "canonicalModel": "claude-opus-5-5", "provider": "firstParty", "costBasis": "list"}}, "permission_denials": [], "terminal_reason": "completed", "fast_mode_state": "off", "fast_mode_disabled_reason": "sdk_opt_in_required", "subagent_stats": {"spawned": 0, "requested": {"background": 0, "foreground": 0, "unset": 0}, "started_in_background": 0, "max_depth": 0, "spawned_by_subagents": 0, "completed": 0, "failed": 0, "killed": {"parent": 0, "user": 0, "system": 0}, "refused": {"depth_limit": 0, "concurrency_limit": 0, "budget": 0}, "by_type": {}}, "is_error": false, "num_turns": 3, "subtype": "success", "api_error_status": null, "result": "FIRST DONE", "ttft_ms": 2391, "type": "result", "duration_ms": 20825, "uuid": "b82a7983-d7ea-496d-9cb7-735f1ffb3cda", "ttft_stream_ms": 1043, "time_to_request_ms": 22, "first_content_frame_ms": 1044, "user_message_uuid": "712482eb-4c05-4f67-8888-a11843c2729f", "user_message_uuids": ["712482eb-4c05-4f67-8888-a11843c2729f"], "request_sent_wall_ms": 1790599876383, "queued_turn_count": 0, "result_index": 0}}
+{"at": 21085, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "712482eb-4c05-4f67-8888-a11843c2729f", "state": "completed", "uuid": "acb703de-6b64-4496-b552-74ddb042d768", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 21085, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "6f0204a5-a21a-47a4-9517-034cc4467b52", "state": "started", "uuid": "77edaf35-52e5-42f1-a84a-f86dc68c96a4", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 21088, "kind": "frame", "frame": {"type": "system", "subtype": "init", "cwd": "/tmp/scrubbed-cwd", "session_id": "00000000-0000-4000-8000-00000000c1a0", "tools": ["Task", "AskUserQuestion", "Bash", "CronCreate", "CronDelete", "CronList", "DesignSync", "Edit", "EnterPlanMode", "EnterWorktree", "ExitPlanMode", "ExitWorktree", "ListAgents", "NotebookEdit", "Read", "ReportFindings", "ScheduleWakeup", "SendMessage", "Skill", "TaskCreate", "TaskGet", "TaskList", "TaskStop", "TaskUpdate", "ToolSearch", "WebFetch", "WebSearch", "Workflow", "Write"], "mcp_servers": [], "model": "claude-opus-5-5[1m]", "permissionMode": "default", "slash_commands": ["deep-research", "design", "design-sync", "dataviz", "update-config", "verify", "debug", "code-review", "simplify", "batch", "fewer-permission-prompts", "doctor", "loop", "claude-api", "workflow-authoring", "run", "run-skill-generator", "agents", "auto-mode-setup", "autocompact", "clear", "color", "compact", "config", "output-style", "context", "effort", "fast", "heapdump", "init", "mcp", "model", "__remote-workflow", "workflow-launch-exec", "reload-plugins", "reload-skills", "rename", "security-review", "usage", "insights", "recap", "goal", "design-consent", "design-revoke", "list-agents", "team-onboarding"], "terminal_slash_commands": ["doctor", "color", "reload-plugins"], "apiKeySource": "none", "claude_code_version": "2.1.280", "output_style": "default", "agents": ["claude", "Explore", "general-purpose", "Plan", "statusline-setup"], "skills": ["deep-research", "design", "design-sync", "dataviz", "update-config", "verify", "debug", "code-review", "simplify", "batch", "fewer-permission-prompts", "doctor", "loop", "claude-api", "workflow-authoring", "run", "run-skill-generator"], "plugins": [{"name": "telemetry", "path": "builtin", "source": "telemetry@builtin"}], "capabilities": ["interrupt_receipt_v1", "interrupt_cancel_queued_v1", "msg_lifecycle_v1", "mcp_read_resource_v1", "mcp_tool_ui_meta_v1"], "analytics_disabled": false, "product_feedback_disabled": false, "uuid": "f6af6108-710e-4208-8c3c-79b2a9fc14e4", "memory_paths": {"auto": "/Users/user/scrubbed"}, "messaging_socket_path": "/tmp/scrubbed.sock", "fast_mode_state": "off", "fast_mode_disabled_reason": "sdk_opt_in_required"}}
+{"at": 21088, "kind": "frame", "frame": {"type": "system", "subtype": "status", "status": "requesting", "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "7ff5bb60-79be-49cb-bd26-950fa9584ffe"}}
+{"at": 22022, "kind": "frame", "frame": {"type": "user", "message": {"role": "user", "content": [{"type": "text", "text": "Also say the word banana at the end of your reply."}]}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "6f0204a5-a21a-47a4-9517-034cc4467b52", "timestamp": "2026-09-28T12:51:37.189Z", "isReplay": true}}
+{"at": 22022, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_start", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsJAVHoszB7NSfdEtk4", "type": "message", "role": "assistant", "content": [], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 51, "cache_read_input_tokens": 17000, "cache_creation": {"ephemeral_5m_input_tokens": 51, "ephemeral_1h_input_tokens": 0}, "output_tokens": 7, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "30e634ea-7725-4e57-bba9-5b6ae1f44c1b", "ttft_ms": 927, "user_message_uuid": "6f0204a5-a21a-47a4-9517-034cc4467b52", "user_message_uuids": ["6f0204a5-a21a-47a4-9517-034cc4467b52"]}}
+{"at": 22023, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_start", "index": 0, "content_block": {"type": "thinking", "thinking": "", "signature": ""}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "8c52275c-f862-4c49-a1b5-4cb5dde934c8"}}
+{"at": 22469, "kind": "frame", "frame": {"type": "system", "subtype": "thinking_tokens", "estimated_tokens": 50, "estimated_tokens_delta": 50, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "91410a95-652d-4e88-8661-19ef21e01a22", "user_message_uuid": "6f0204a5-a21a-47a4-9517-034cc4467b52"}}
+{"at": 22469, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "thinking_delta", "thinking": "", "estimated_tokens": 50}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "ea150b67-dad7-4436-84c5-82d73a3ee3ac"}}
+{"at": 23097, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "thinking_delta", "thinking": "", "estimated_tokens": null}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "dcf3a66c-0505-4b70-985f-d5d431de68c5"}}
+{"at": 23097, "kind": "frame", "frame": {"type": "system", "subtype": "thinking_tokens", "estimated_tokens": 192, "estimated_tokens_delta": 142, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "411efdb6-1b14-40d5-b126-6251292c2898", "user_message_uuid": "6f0204a5-a21a-47a4-9517-034cc4467b52"}}
+{"at": 23097, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 0, "delta": {"type": "signature_delta", "signature": "CAQS9wUKEAgSGAI4AUIIdGhpbmtpbmcSDB/yUaKTcw1uKvgE2xoM//KByDA4fixole7KIjDLAtdDHZ4gV5AjYQGHGc1vQ+EwvB7yHUpWkhn/fsoZ0XTaERvUz6ZoVYhDH7TV/3EqlAW89rxYwkeD/V2vxPnz1iDOQvnSOBk08h5h6cd7CUNMyyM5UU/VtJ84BJDllyBTZLw8RCS/tuodap4P8NmO7I6wK6ZQ8d0hTfpyHsr7J4UfnD9RXhy2x5YdTX11OI8sQ7hxj9HkzhEJpJwRSytLRpclM3ATKwIv/ApihNhfYtbKApQSeIOlFArXz17Xm3RYMs3WjRzL8NMPmV0d5sirOCJ1xtAf3vLSi7awlvG45tpmkW3xaEZsVczOBSNhLPdzwEuHQrAZqx+5WE/b5cC9A2jfW3HgOSdmlmp1z0vYhdbvfu+ALKLUFmAz49QY8YINKNXLbZMUxY5IEDHrRUNjQIY2tJvJWi1SMNNaAvRh1dVBwRDdCXRkWt1Yt8U3iQ2g0dZnfeEGCrIETtzGnRZ5nY0ekGcVrU8QQCCiibceC0dSOmbpNOnDGjxpu3PdoBBoxjZB/Ys1I2td+KDsGwWi0KygWOH7xoa11fsLHvoBu+d0RaTCH64uX6s3bLkajeeCpX0nEt0PR0GT69Jst6J4JwiDTDjjK4LF87Sxm4tSnTzymEYXhk2M5EtdkOUmD5yeI4Qf0liMutVlLWISHzDsAj/t1i7dQtr76wHzrq0/1qdf4OJlFH0qLEM98ekpLOsESLLGryp0UIRIrMaJtpk8e/o9+uHgCP2IwxxEFaWb6PUvNvuI00K/C3dxTD9JQQrNZRdadsnj74/TR2qePDAXzb8vhDSm2b8umySGmHCPrTjBdC0O6riijl1pKqdjRS9yzFVInnZ00zUHpmT9ojVT3dKennDIfdN4ShxGTh5be81hF1pfm9GDC7HJGpG+Eth3qS8JTRQhDx43J4DKNA4XQYQ7CHIxOLET/s8e+qGLnlGCJl6K0h4YAQ=="}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "3b70c219-37e8-485d-a00c-48e3680cc14e"}}
+{"at": 23097, "kind": "frame", "frame": {"type": "assistant", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsJAVHoszB7NSfdEtk4", "type": "message", "role": "assistant", "content": [{"type": "thinking", "thinking": "", "signature": "CAQS9wUKEAgSGAI4AUIIdGhpbmtpbmcSDB/yUaKTcw1uKvgE2xoM//KByDA4fixole7KIjDLAtdDHZ4gV5AjYQGHGc1vQ+EwvB7yHUpWkhn/fsoZ0XTaERvUz6ZoVYhDH7TV/3EqlAW89rxYwkeD/V2vxPnz1iDOQvnSOBk08h5h6cd7CUNMyyM5UU/VtJ84BJDllyBTZLw8RCS/tuodap4P8NmO7I6wK6ZQ8d0hTfpyHsr7J4UfnD9RXhy2x5YdTX11OI8sQ7hxj9HkzhEJpJwRSytLRpclM3ATKwIv/ApihNhfYtbKApQSeIOlFArXz17Xm3RYMs3WjRzL8NMPmV0d5sirOCJ1xtAf3vLSi7awlvG45tpmkW3xaEZsVczOBSNhLPdzwEuHQrAZqx+5WE/b5cC9A2jfW3HgOSdmlmp1z0vYhdbvfu+ALKLUFmAz49QY8YINKNXLbZMUxY5IEDHrRUNjQIY2tJvJWi1SMNNaAvRh1dVBwRDdCXRkWt1Yt8U3iQ2g0dZnfeEGCrIETtzGnRZ5nY0ekGcVrU8QQCCiibceC0dSOmbpNOnDGjxpu3PdoBBoxjZB/Ys1I2td+KDsGwWi0KygWOH7xoa11fsLHvoBu+d0RaTCH64uX6s3bLkajeeCpX0nEt0PR0GT69Jst6J4JwiDTDjjK4LF87Sxm4tSnTzymEYXhk2M5EtdkOUmD5yeI4Qf0liMutVlLWISHzDsAj/t1i7dQtr76wHzrq0/1qdf4OJlFH0qLEM98ekpLOsESLLGryp0UIRIrMaJtpk8e/o9+uHgCP2IwxxEFaWb6PUvNvuI00K/C3dxTD9JQQrNZRdadsnj74/TR2qePDAXzb8vhDSm2b8umySGmHCPrTjBdC0O6riijl1pKqdjRS9yzFVInnZ00zUHpmT9ojVT3dKennDIfdN4ShxGTh5be81hF1pfm9GDC7HJGpG+Eth3qS8JTRQhDx43J4DKNA4XQYQ7CHIxOLET/s8e+qGLnlGCJl6K0h4YAQ=="}], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 51, "cache_read_input_tokens": 17000, "cache_creation": {"ephemeral_5m_input_tokens": 51, "ephemeral_1h_input_tokens": 0}, "output_tokens": 7, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "f59a0f60-bc42-4d2f-be93-2d89991bf482", "timestamp": "2026-09-28T12:51:39.200Z", "request_id": "req_011CfVsJA4Uy2C2Rx8uyY7H1", "user_message_uuid": "6f0204a5-a21a-47a4-9517-034cc4467b52", "user_message_uuids": ["6f0204a5-a21a-47a4-9517-034cc4467b52"]}}
+{"at": 23097, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_stop", "index": 0}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "0d8eff25-307b-4247-81e1-9a4575c7e07d"}}
+{"at": 23097, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_start", "index": 1, "content_block": {"type": "text", "text": ""}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "7328034f-41e4-4823-9bde-8df483de1ce5"}}
+{"at": 23098, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 1, "delta": {"type": "text_delta", "text": "FIRST DONE ban"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "e8f3de55-f311-4eac-baab-9db3fe5ec197"}}
+{"at": 23098, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_delta", "index": 1, "delta": {"type": "text_delta", "text": "ana"}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "b293546a-d0c5-4cdd-9884-5b155b845e96"}}
+{"at": 23098, "kind": "frame", "frame": {"type": "assistant", "message": {"model": "claude-opus-5-5", "id": "msg_011CfVsJAVHoszB7NSfdEtk4", "type": "message", "role": "assistant", "content": [{"type": "text", "text": "FIRST DONE banana"}], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 51, "cache_read_input_tokens": 17000, "cache_creation": {"ephemeral_5m_input_tokens": 51, "ephemeral_1h_input_tokens": 0}, "output_tokens": 7, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "31583f02-16b9-418d-89b3-269afb1dc2c0", "timestamp": "2026-09-28T12:51:39.201Z", "request_id": "req_011CfVsJA4Uy2C2Rx8uyY7H1"}}
+{"at": 23098, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "content_block_stop", "index": 1}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "f8047b07-9ca2-436f-a8e2-f05a17f14970"}}
+{"at": 23105, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_delta", "delta": {"stop_reason": "end_turn", "stop_sequence": null, "stop_details": null, "container": null}, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 51, "cache_read_input_tokens": 17000, "output_tokens": 65, "output_tokens_details": {"thinking_tokens": 54}}, "context_management": {"applied_edits": []}}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "372ebe0e-8f36-4567-8563-4aff3e059a3f"}}
+{"at": 23105, "kind": "frame", "frame": {"type": "stream_event", "event": {"type": "message_stop"}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "b11714ab-fe3d-44fb-991d-c62ae8a60507"}}
+{"at": 23107, "kind": "frame", "frame": {"duration_api_ms": 8819, "stop_reason": "end_turn", "session_id": "00000000-0000-4000-8000-00000000c1a0", "total_cost_usd": 0.1311984, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 51, "cache_read_input_tokens": 17000, "output_tokens": 65, "output_tokens_details": {"thinking_tokens": 54}, "server_tool_use": {"web_search_requests": 0, "web_fetch_requests": 0}, "service_tier": "standard", "cache_creation": {"ephemeral_1h_input_tokens": 0, "ephemeral_5m_input_tokens": 51}, "inference_geo": "not_available", "iterations": [], "speed": "standard"}, "modelUsage": {"claude-opus-5-5[1m]": {"inputTokens": 1221, "outputTokens": 259, "cacheReadInputTokens": 45272, "cacheCreationInputTokens": 22416, "webSearchRequests": 0, "costUSD": 0.1311984, "contextWindow": 1000000, "maxOutputTokens": 128000, "thinkingTokens": 54, "canonicalModel": "claude-opus-5-5", "provider": "firstParty", "costBasis": "list"}}, "permission_denials": [], "terminal_reason": "completed", "fast_mode_state": "off", "fast_mode_disabled_reason": "sdk_opt_in_required", "subagent_stats": {"spawned": 0, "requested": {"background": 0, "foreground": 0, "unset": 0}, "started_in_background": 0, "max_depth": 0, "spawned_by_subagents": 0, "completed": 0, "failed": 0, "killed": {"parent": 0, "user": 0, "system": 0}, "refused": {"depth_limit": 0, "concurrency_limit": 0, "budget": 0}, "by_type": {}}, "is_error": false, "num_turns": 1, "subtype": "success", "api_error_status": null, "result": "FIRST DONE banana", "ttft_ms": 2012, "type": "result", "duration_ms": 2021, "uuid": "572df995-0b87-436c-9966-5f3740c22820", "ttft_stream_ms": 937, "time_to_request_ms": 10, "first_content_frame_ms": 937, "user_message_uuid": "6f0204a5-a21a-47a4-9517-034cc4467b52", "user_message_uuids": ["6f0204a5-a21a-47a4-9517-034cc4467b52"], "request_sent_wall_ms": 1790599897198, "queued_turn_count": 0, "result_index": 1}}
+{"at": 23107, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "6f0204a5-a21a-47a4-9517-034cc4467b52", "state": "completed", "uuid": "bd6b5dbd-002f-4d5e-8311-7d747745ea00", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 23108, "kind": "frame", "frame": {"type": "system", "subtype": "session_state_changed", "state": "idle", "uuid": "c7642956-8764-404f-8b89-8eac3a91cb1e", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 26162, "kind": "end", "results": 2}
diff --git a/src/main/claude/__fixtures__/claude-hook-event-enums.json b/src/main/claude/__fixtures__/claude-hook-event-enums.json
new file mode 100644
index 00000000000..f4bedfc31df
--- /dev/null
+++ b/src/main/claude/__fixtures__/claude-hook-event-enums.json
@@ -0,0 +1,960 @@
+{
+  "source": "Read from cli.js of each @anthropic-ai/claude-code npm release. enums: the hook event enum; hooks keys outside it make 1.0.23-2.1.100 discard the whole user settings file. topLevelSettings: the settings schema's top-level keys, and whether it is strict, i.e. discards the whole file over any other key.",
+  "previousPublishedVersion": {
+    "1.0.23": "1.0.22",
+    "1.0.31": "1.0.30",
+    "1.0.41": "1.0.40",
+    "1.0.53": "1.0.52",
+    "1.0.62": "1.0.61",
+    "1.0.64": "1.0.63",
+    "1.0.85": "1.0.84",
+    "2.0.43": "2.0.42",
+    "2.0.45": "2.0.44",
+    "2.0.56": "2.0.55",
+    "2.1.33": "2.1.32",
+    "2.1.76": "2.1.75",
+    "2.1.78": "2.1.77"
+  },
+  "topLevelSettings": {
+    "1.0.48": {
+      "strict": false,
+      "keys": [
+        "apiKeyHelper",
+        "cleanupPeriodDays",
+        "env",
+        "includeCoAuthoredBy",
+        "permissions",
+        "model",
+        "enableAllProjectMcpServers",
+        "enabledMcpjsonServers",
+        "disabledMcpjsonServers",
+        "hooks",
+        "learnMode",
+        "forceLoginMethod"
+      ]
+    },
+    "1.0.49": {
+      "strict": true,
+      "keys": [
+        "apiKeyHelper",
+        "cleanupPeriodDays",
+        "env",
+        "includeCoAuthoredBy",
+        "permissions",
+        "model",
+        "enableAllProjectMcpServers",
+        "enabledMcpjsonServers",
+        "disabledMcpjsonServers",
+        "hooks",
+        "learnMode",
+        "forceLoginMethod"
+      ]
+    },
+    "1.0.50": {
+      "strict": true,
+      "keys": [
+        "apiKeyHelper",
+        "cleanupPeriodDays",
+        "env",
+        "includeCoAuthoredBy",
+        "permissions",
+        "model",
+        "enableAllProjectMcpServers",
+        "enabledMcpjsonServers",
+        "disabledMcpjsonServers",
+        "hooks",
+        "learnMode",
+        "forceLoginMethod"
+      ]
+    },
+    "1.0.51": {
+      "strict": true,
+      "keys": [
+        "apiKeyHelper",
+        "cleanupPeriodDays",
+        "env",
+        "includeCoAuthoredBy",
+        "permissions",
+        "model",
+        "enableAllProjectMcpServers",
+        "enabledMcpjsonServers",
+        "disabledMcpjsonServers",
+        "hooks",
+        "learnMode",
+        "forceLoginMethod"
+      ]
+    },
+    "1.0.52": {
+      "strict": true,
+      "keys": [
+        "apiKeyHelper",
+        "cleanupPeriodDays",
+        "env",
+        "includeCoAuthoredBy",
+        "permissions",
+        "model",
+        "enableAllProjectMcpServers",
+        "enabledMcpjsonServers",
+        "disabledMcpjsonServers",
+        "hooks",
+        "learnMode",
+        "forceLoginMethod"
+      ]
+    },
+    "1.0.53": {
+      "strict": true,
+      "keys": [
+        "apiKeyHelper",
+        "awsCredentialExport",
+        "awsAuthRefresh",
+        "cleanupPeriodDays",
+        "env",
+        "includeCoAuthoredBy",
+        "permissions",
+        "model",
+        "enableAllProjectMcpServers",
+        "enabledMcpjsonServers",
+        "disabledMcpjsonServers",
+        "hooks",
+        "learnMode",
+        "forceLoginMethod",
+        "otelHeadersHelper"
+      ]
+    },
+    "1.0.54": {
+      "strict": true,
+      "keys": [
+        "apiKeyHelper",
+        "awsCredentialExport",
+        "awsAuthRefresh",
+        "cleanupPeriodDays",
+        "env",
+        "includeCoAuthoredBy",
+        "permissions",
+        "model",
+        "enableAllProjectMcpServers",
+        "enabledMcpjsonServers",
+        "disabledMcpjsonServers",
+        "hooks",
+        "learnMode",
+        "forceLoginMethod",
+        "otelHeadersHelper"
+      ]
+    },
+    "1.0.58": {
+      "strict": true,
+      "keys": [
+        "apiKeyHelper",
+        "awsCredentialExport",
+        "awsAuthRefresh",
+        "cleanupPeriodDays",
+        "env",
+        "includeCoAuthoredBy",
+        "permissions",
+        "model",
+        "enableAllProjectMcpServers",
+        "enabledMcpjsonServers",
+        "disabledMcpjsonServers",
+        "hooks",
+        "learnMode",
+        "forceLoginMethod",
+        "otelHeadersHelper"
+      ]
+    },
+    "1.0.59": {
+      "strict": true,
+      "keys": [
+        "apiKeyHelper",
+        "awsCredentialExport",
+        "awsAuthRefresh",
+        "cleanupPeriodDays",
+        "env",
+        "includeCoAuthoredBy",
+        "permissions",
+        "model",
+        "enableAllProjectMcpServers",
+        "enabledMcpjsonServers",
+        "disabledMcpjsonServers",
+        "hooks",
+        "learnMode",
+        "forceLoginMethod",
+        "otelHeadersHelper"
+      ]
+    },
+    "1.0.60": {
+      "strict": true,
+      "keys": [
+        "apiKeyHelper",
+        "awsCredentialExport",
+        "awsAuthRefresh",
+        "cleanupPeriodDays",
+        "env",
+        "includeCoAuthoredBy",
+        "permissions",
+        "model",
+        "enableAllProjectMcpServers",
+        "enabledMcpjsonServers",
+        "disabledMcpjsonServers",
+        "hooks",
+        "learnMode",
+        "forceLoginMethod",
+        "otelHeadersHelper"
+      ]
+    },
+    "1.0.61": {
+      "strict": true,
+      "keys": [
+        "apiKeyHelper",
+        "awsCredentialExport",
+        "awsAuthRefresh",
+        "cleanupPeriodDays",
+        "env",
+        "includeCoAuthoredBy",
+        "permissions",
+        "model",
+        "enableAllProjectMcpServers",
+        "enabledMcpjsonServers",
+        "disabledMcpjsonServers",
+        "hooks",
+        "learnMode",
+        "forceLoginMethod",
+        "otelHeadersHelper"
+      ]
+    },
+    "1.0.62": {
+      "strict": true,
+      "keys": [
+        "apiKeyHelper",
+        "awsCredentialExport",
+        "awsAuthRefresh",
+        "cleanupPeriodDays",
+        "env",
+        "includeCoAuthoredBy",
+        "permissions",
+        "model",
+        "enableAllProjectMcpServers",
+        "enabledMcpjsonServers",
+        "disabledMcpjsonServers",
+        "hooks",
+        "learnMode",
+        "forceLoginMethod",
+        "otelHeadersHelper"
+      ]
+    },
+    "1.0.63": {
+      "strict": true,
+      "keys": [
+        "apiKeyHelper",
+        "awsCredentialExport",
+        "awsAuthRefresh",
+        "cleanupPeriodDays",
+        "env",
+        "includeCoAuthoredBy",
+        "permissions",
+        "model",
+        "enableAllProjectMcpServers",
+        "enabledMcpjsonServers",
+        "disabledMcpjsonServers",
+        "hooks",
+        "learnMode",
+        "forceLoginMethod",
+        "otelHeadersHelper",
+        "outputMode"
+      ]
+    },
+    "1.0.64": {
+      "strict": true,
+      "keys": [
+        "apiKeyHelper",
+        "awsCredentialExport",
+        "awsAuthRefresh",
+        "cleanupPeriodDays",
+        "env",
+        "includeCoAuthoredBy",
+        "permissions",
+        "model",
+        "enableAllProjectMcpServers",
+        "enabledMcpjsonServers",
+        "disabledMcpjsonServers",
+        "hooks",
+        "statusLine",
+        "learnMode",
+        "forceLoginMethod",
+        "otelHeadersHelper",
+        "outputMode",
+        "feedbackSurveyState"
+      ]
+    },
+    "1.0.65": {
+      "strict": true,
+      "keys": [
+        "$schema",
+        "apiKeyHelper",
+        "awsCredentialExport",
+        "awsAuthRefresh",
+        "cleanupPeriodDays",
+        "env",
+        "includeCoAuthoredBy",
+        "permissions",
+        "model",
+        "enableAllProjectMcpServers",
+        "enabledMcpjsonServers",
+        "disabledMcpjsonServers",
+        "hooks",
+        "statusLine",
+        "learnMode",
+        "forceLoginMethod",
+        "otelHeadersHelper",
+        "outputMode",
+        "feedbackSurveyState"
+      ]
+    },
+    "1.0.66": {
+      "strict": true,
+      "keys": [
+        "$schema",
+        "apiKeyHelper",
+        "awsCredentialExport",
+        "awsAuthRefresh",
+        "cleanupPeriodDays",
+        "env",
+        "includeCoAuthoredBy",
+        "permissions",
+        "model",
+        "enableAllProjectMcpServers",
+        "enabledMcpjsonServers",
+        "disabledMcpjsonServers",
+        "hooks",
+        "statusLine",
+        "learnMode",
+        "forceLoginMethod",
+        "otelHeadersHelper",
+        "outputMode"
+      ]
+    },
+    "1.0.67": {
+      "strict": false,
+      "keys": [
+        "$schema",
+        "apiKeyHelper",
+        "awsCredentialExport",
+        "awsAuthRefresh",
+        "cleanupPeriodDays",
+        "env",
+        "includeCoAuthoredBy",
+        "permissions",
+        "model",
+        "enableAllProjectMcpServers",
+        "enabledMcpjsonServers",
+        "disabledMcpjsonServers",
+        "hooks",
+        "statusLine",
+        "learnMode",
+        "forceLoginMethod",
+        "otelHeadersHelper",
+        "outputMode"
+      ]
+    }
+  },
+  "enums": {
+    "1.0.22": [
+      "PreTask",
+      "PreBash",
+      "PreGlob",
+      "PreGrep",
+      "PreRead",
+      "PreEdit",
+      "PreMultiEdit",
+      "PreWrite",
+      "PreNotebookRead",
+      "PreNotebookEdit",
+      "PreWebFetch",
+      "PreWebSearch"
+    ],
+    "1.0.23": ["PreToolUse", "PostToolUse", "Notification"],
+    "1.0.30": ["PreToolUse", "PostToolUse", "Notification"],
+    "1.0.31": ["PreToolUse", "PostToolUse", "Notification", "Stop"],
+    "1.0.40": ["PreToolUse", "PostToolUse", "Notification", "Stop"],
+    "1.0.41": ["PreToolUse", "PostToolUse", "Notification", "Stop", "SubagentStop"],
+    "1.0.48": ["PreToolUse", "PostToolUse", "Notification", "Stop", "SubagentStop", "PreCompact"],
+    "1.0.49": ["PreToolUse", "PostToolUse", "Notification", "Stop", "SubagentStop", "PreCompact"],
+    "1.0.50": ["PreToolUse", "PostToolUse", "Notification", "Stop", "SubagentStop", "PreCompact"],
+    "1.0.51": ["PreToolUse", "PostToolUse", "Notification", "Stop", "SubagentStop", "PreCompact"],
+    "1.0.52": ["PreToolUse", "PostToolUse", "Notification", "Stop", "SubagentStop", "PreCompact"],
+    "1.0.53": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "Stop",
+      "SubagentStop",
+      "PreCompact"
+    ],
+    "1.0.54": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "Stop",
+      "SubagentStop",
+      "PreCompact"
+    ],
+    "1.0.58": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "Stop",
+      "SubagentStop",
+      "PreCompact"
+    ],
+    "1.0.59": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "Stop",
+      "SubagentStop",
+      "PreCompact"
+    ],
+    "1.0.60": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "Stop",
+      "SubagentStop",
+      "PreCompact"
+    ],
+    "1.0.61": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "Stop",
+      "SubagentStop",
+      "PreCompact"
+    ],
+    "1.0.62": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "Stop",
+      "SubagentStop",
+      "PreCompact"
+    ],
+    "1.0.63": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "Stop",
+      "SubagentStop",
+      "PreCompact"
+    ],
+    "1.0.64": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "Stop",
+      "SubagentStop",
+      "PreCompact"
+    ],
+    "1.0.65": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "Stop",
+      "SubagentStop",
+      "PreCompact"
+    ],
+    "1.0.66": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "Stop",
+      "SubagentStop",
+      "PreCompact"
+    ],
+    "1.0.67": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "Stop",
+      "SubagentStop",
+      "PreCompact"
+    ],
+    "1.0.81": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "Stop",
+      "SubagentStop",
+      "PreCompact"
+    ],
+    "1.0.84": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "Stop",
+      "SubagentStop",
+      "PreCompact"
+    ],
+    "1.0.85": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "SubagentStop",
+      "PreCompact"
+    ],
+    "2.0.42": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "SubagentStop",
+      "PreCompact"
+    ],
+    "2.0.43": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact"
+    ],
+    "2.0.44": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact"
+    ],
+    "2.0.45": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PermissionRequest"
+    ],
+    "2.0.52": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PermissionRequest"
+    ],
+    "2.0.54": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PermissionRequest"
+    ],
+    "2.0.55": [
+      "PreToolUse",
+      "PostToolUse",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PermissionRequest"
+    ],
+    "2.0.56": [
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PermissionRequest"
+    ],
+    "2.0.60": [
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PermissionRequest"
+    ],
+    "2.0.76": [
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PermissionRequest"
+    ],
+    "2.1.32": [
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PermissionRequest",
+      "Setup"
+    ],
+    "2.1.33": [
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PermissionRequest",
+      "Setup",
+      "TeammateIdle",
+      "TaskCompleted"
+    ],
+    "2.1.75": [
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PermissionRequest",
+      "Setup",
+      "TeammateIdle",
+      "TaskCompleted",
+      "Elicitation",
+      "ElicitationResult",
+      "ConfigChange",
+      "WorktreeCreate",
+      "WorktreeRemove",
+      "InstructionsLoaded"
+    ],
+    "2.1.76": [
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PostCompact",
+      "PermissionRequest",
+      "Setup",
+      "TeammateIdle",
+      "TaskCompleted",
+      "Elicitation",
+      "ElicitationResult",
+      "ConfigChange",
+      "WorktreeCreate",
+      "WorktreeRemove",
+      "InstructionsLoaded"
+    ],
+    "2.1.77": [
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PostCompact",
+      "PermissionRequest",
+      "Setup",
+      "TeammateIdle",
+      "TaskCompleted",
+      "Elicitation",
+      "ElicitationResult",
+      "ConfigChange",
+      "WorktreeCreate",
+      "WorktreeRemove",
+      "InstructionsLoaded"
+    ],
+    "2.1.78": [
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "StopFailure",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PostCompact",
+      "PermissionRequest",
+      "Setup",
+      "TeammateIdle",
+      "TaskCompleted",
+      "Elicitation",
+      "ElicitationResult",
+      "ConfigChange",
+      "WorktreeCreate",
+      "WorktreeRemove",
+      "InstructionsLoaded"
+    ],
+    "2.1.84": [
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "StopFailure",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PostCompact",
+      "PermissionRequest",
+      "Setup",
+      "TeammateIdle",
+      "TaskCreated",
+      "TaskCompleted",
+      "Elicitation",
+      "ElicitationResult",
+      "ConfigChange",
+      "WorktreeCreate",
+      "WorktreeRemove",
+      "InstructionsLoaded",
+      "CwdChanged",
+      "FileChanged"
+    ],
+    "2.1.90": [
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "StopFailure",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PostCompact",
+      "PermissionRequest",
+      "PermissionDenied",
+      "Setup",
+      "TeammateIdle",
+      "TaskCreated",
+      "TaskCompleted",
+      "Elicitation",
+      "ElicitationResult",
+      "ConfigChange",
+      "WorktreeCreate",
+      "WorktreeRemove",
+      "InstructionsLoaded",
+      "CwdChanged",
+      "FileChanged"
+    ],
+    "2.1.97": [
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "StopFailure",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PostCompact",
+      "PermissionRequest",
+      "PermissionDenied",
+      "Setup",
+      "TeammateIdle",
+      "TaskCreated",
+      "TaskCompleted",
+      "Elicitation",
+      "ElicitationResult",
+      "ConfigChange",
+      "WorktreeCreate",
+      "WorktreeRemove",
+      "InstructionsLoaded",
+      "CwdChanged",
+      "FileChanged"
+    ],
+    "2.1.100": [
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "StopFailure",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PostCompact",
+      "PermissionRequest",
+      "PermissionDenied",
+      "Setup",
+      "TeammateIdle",
+      "TaskCreated",
+      "TaskCompleted",
+      "Elicitation",
+      "ElicitationResult",
+      "ConfigChange",
+      "WorktreeCreate",
+      "WorktreeRemove",
+      "InstructionsLoaded",
+      "CwdChanged",
+      "FileChanged"
+    ],
+    "2.1.101": [
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "StopFailure",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PostCompact",
+      "PermissionRequest",
+      "PermissionDenied",
+      "Setup",
+      "TeammateIdle",
+      "TaskCreated",
+      "TaskCompleted",
+      "Elicitation",
+      "ElicitationResult",
+      "ConfigChange",
+      "WorktreeCreate",
+      "WorktreeRemove",
+      "InstructionsLoaded",
+      "CwdChanged",
+      "FileChanged"
+    ],
+    "2.1.110": [
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "Notification",
+      "UserPromptSubmit",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "StopFailure",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PostCompact",
+      "PermissionRequest",
+      "PermissionDenied",
+      "Setup",
+      "TeammateIdle",
+      "TaskCreated",
+      "TaskCompleted",
+      "Elicitation",
+      "ElicitationResult",
+      "ConfigChange",
+      "WorktreeCreate",
+      "WorktreeRemove",
+      "InstructionsLoaded",
+      "CwdChanged",
+      "FileChanged"
+    ]
+  }
+}
diff --git a/src/main/claude/__fixtures__/claude-lifecycle-capture-auth-failed.jsonl b/src/main/claude/__fixtures__/claude-lifecycle-capture-auth-failed.jsonl
new file mode 100644
index 00000000000..38dd3136218
--- /dev/null
+++ b/src/main/claude/__fixtures__/claude-lifecycle-capture-auth-failed.jsonl
@@ -0,0 +1,12 @@
+{"at": 1, "kind": "meta", "scenario": "auth-failed", "providerSessionId": "00000000-0000-4000-8000-00000000c1a0", "note": "Recorded against Claude CLI 2.1.280 through the Agent SDK transport; scrubbed: session id, home paths, API request and message ids, initialize answer; stream_event frames dropped."}
+{"at": 288, "kind": "dispatch", "clientMessageId": "client-A", "sentUuid": "39446645-6ec0-4807-9e18-95ac04c13143", "text": "Reply with text only; do not use any tools. Reply with exactly: CONTROL-DONE"}
+{"at": 302, "kind": "frame", "frame": {"type": "system", "subtype": "session_state_changed", "state": "running", "uuid": "b8e8b60c-1592-4f05-a21a-853f6a1a5040", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 302, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "39446645-6ec0-4807-9e18-95ac04c13143", "state": "queued", "uuid": "17b4b010-4615-4bf0-9b63-7936336cd7c4", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 306, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "39446645-6ec0-4807-9e18-95ac04c13143", "state": "started", "uuid": "b1ed2141-c5a2-4c7e-8403-dbeb53d15be2", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 319, "kind": "frame", "frame": {"type": "system", "subtype": "init", "cwd": "/Users/user/scrubbed", "session_id": "00000000-0000-4000-8000-00000000c1a0", "tools": [], "mcp_servers": [], "model": "claude-opus-5-5[1m]", "permissionMode": "default", "slash_commands": [], "terminal_slash_commands": [], "apiKeySource": "none", "claude_code_version": "2.1.280", "output_style": "default", "agents": [], "skills": [], "plugins": [], "capabilities": ["interrupt_receipt_v1", "interrupt_cancel_queued_v1", "msg_lifecycle_v1", "mcp_read_resource_v1", "mcp_tool_ui_meta_v1"], "analytics_disabled": false, "product_feedback_disabled": false, "uuid": "61043fb2-ec0d-4652-9ab8-00483ac5f026", "fast_mode_state": "off", "fast_mode_disabled_reason": "sdk_opt_in_required"}}
+{"at": 321, "kind": "frame", "frame": {"type": "system", "subtype": "status", "status": "requesting", "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "ad41aad3-ab9d-4b3c-a9f2-8610044d9482"}}
+{"at": 342, "kind": "frame", "frame": {"type": "user", "message": {"role": "user", "content": [{"type": "text", "text": "Reply with text only; do not use any tools. Reply with exactly: CONTROL-DONE"}]}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "39446645-6ec0-4807-9e18-95ac04c13143", "timestamp": "2026-09-29T10:33:13.793Z", "isReplay": true}}
+{"at": 342, "kind": "frame", "frame": {"type": "assistant", "message": {"diagnostics": null, "id": "58f67b61-a560-4d83-b099-4f1b2e920de8", "container": null, "model": "<synthetic>", "role": "assistant", "stop_details": null, "stop_reason": "stop_sequence", "stop_sequence": "", "type": "message", "usage": {"output_tokens_details": null, "input_tokens": 0, "output_tokens": 0, "cache_creation_input_tokens": 0, "cache_read_input_tokens": 0, "server_tool_use": {"web_search_requests": 0, "web_fetch_requests": 0}, "service_tier": null, "cache_creation": {"ephemeral_1h_input_tokens": 0, "ephemeral_5m_input_tokens": 0}, "inference_geo": null, "iterations": null, "speed": null}, "content": [{"type": "text", "text": "Not logged in \u00b7 Please run /login"}], "context_management": null}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "6c5de4d1-e149-4201-b18b-b0021d4650f2", "timestamp": "2026-09-29T10:33:13.809Z", "error": "authentication_failed", "is_api_error_message": true, "user_message_uuid": "39446645-6ec0-4807-9e18-95ac04c13143", "user_message_uuids": ["39446645-6ec0-4807-9e18-95ac04c13143"]}}
+{"at": 346, "kind": "frame", "frame": {"duration_api_ms": 0, "stop_reason": "stop_sequence", "session_id": "00000000-0000-4000-8000-00000000c1a0", "total_cost_usd": 0, "usage": {"output_tokens_details": {"thinking_tokens": 0}, "input_tokens": 0, "cache_creation_input_tokens": 0, "cache_read_input_tokens": 0, "output_tokens": 0, "server_tool_use": {"web_search_requests": 0, "web_fetch_requests": 0}, "service_tier": "standard", "cache_creation": {"ephemeral_1h_input_tokens": 0, "ephemeral_5m_input_tokens": 0}, "inference_geo": "", "iterations": [], "speed": "standard"}, "modelUsage": {}, "permission_denials": [], "terminal_reason": "api_error", "fast_mode_state": "off", "fast_mode_disabled_reason": "sdk_opt_in_required", "subagent_stats": {"spawned": 0, "requested": {"background": 0, "foreground": 0, "unset": 0}, "started_in_background": 0, "max_depth": 0, "spawned_by_subagents": 0, "completed": 0, "failed": 0, "killed": {"parent": 0, "user": 0, "system": 0}, "refused": {"depth_limit": 0, "concurrency_limit": 0, "budget": 0}, "by_type": {}}, "is_error": true, "num_turns": 1, "subtype": "success", "api_error_status": null, "result": "Not logged in \u00b7 Please run /login", "type": "result", "duration_ms": 36, "uuid": "9736f712-8292-41be-bd62-305633c7e152", "user_message_uuid": "39446645-6ec0-4807-9e18-95ac04c13143", "user_message_uuids": ["39446645-6ec0-4807-9e18-95ac04c13143"], "queued_turn_count": 0, "result_index": 0}}
+{"at": 347, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "39446645-6ec0-4807-9e18-95ac04c13143", "state": "cancelled", "uuid": "64028711-21fb-4a47-99c9-8ae448e4c577", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 347, "kind": "frame", "frame": {"type": "system", "subtype": "session_state_changed", "state": "idle", "uuid": "081649ae-6232-43d6-b31b-6d1da6167020", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
diff --git a/src/main/claude/__fixtures__/claude-lifecycle-capture-batch-lead.jsonl b/src/main/claude/__fixtures__/claude-lifecycle-capture-batch-lead.jsonl
new file mode 100644
index 00000000000..50cab7abe66
--- /dev/null
+++ b/src/main/claude/__fixtures__/claude-lifecycle-capture-batch-lead.jsonl
@@ -0,0 +1,28 @@
+{"at": 15, "kind": "meta", "scenario": "batch-lead", "providerSessionId": "00000000-0000-4000-8000-00000000c1a0", "note": "Recorded against Claude CLI 2.1.280 through the Agent SDK transport; scrubbed: session id, home paths, API request and message ids, initialize answer; stream_event frames dropped."}
+{"at": 334, "kind": "frame", "frame": {"type": "system", "subtype": "hook_started", "hook_id": "adafe449-4ded-495b-a4db-b82589e901e6", "hook_name": "SessionStart:startup", "hook_event": "SessionStart", "uuid": "9d3d1c58-6d69-408a-ae73-73d5c9656e9f", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 376, "kind": "frame", "frame": {"type": "system", "subtype": "hook_response", "hook_id": "adafe449-4ded-495b-a4db-b82589e901e6", "hook_name": "SessionStart:startup", "hook_event": "SessionStart", "exit_code": 0, "outcome": "success", "uuid": "30ed6f57-a819-4c93-b4d3-7d76838c1950", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 410, "kind": "dispatch", "clientMessageId": "client-A", "sentUuid": "0e1f8935-c61a-480b-8877-72c10dd1adda", "text": "Reply with text only; do not use any tools. Write the numbers from one to two hundred in English words, one per line, lowercase, nothing else."}
+{"at": 413, "kind": "frame", "frame": {"type": "system", "subtype": "session_state_changed", "state": "running", "uuid": "2dfef2b1-c08e-4a66-94b9-c3bbbe8d6adb", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 413, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "0e1f8935-c61a-480b-8877-72c10dd1adda", "state": "queued", "uuid": "378fac6f-7ffb-417f-b9d3-4311c3d99d64", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 414, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "0e1f8935-c61a-480b-8877-72c10dd1adda", "state": "started", "uuid": "4bdc9a15-e613-42f3-a912-f6bcf8712999", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 474, "kind": "frame", "frame": {"type": "system", "subtype": "init", "cwd": "/Users/user/scrubbed", "session_id": "00000000-0000-4000-8000-00000000c1a0", "tools": [], "mcp_servers": [], "model": "claude-opus-5-5[1m]", "permissionMode": "default", "slash_commands": [], "terminal_slash_commands": [], "apiKeySource": "none", "claude_code_version": "2.1.280", "output_style": "default", "agents": [], "skills": [], "plugins": [], "capabilities": ["interrupt_receipt_v1", "interrupt_cancel_queued_v1", "msg_lifecycle_v1", "mcp_read_resource_v1", "mcp_tool_ui_meta_v1"], "analytics_disabled": false, "product_feedback_disabled": false, "uuid": "b3869f1d-27b1-488a-a8a1-bde1a52fbf84", "fast_mode_state": "off", "fast_mode_disabled_reason": "sdk_opt_in_required"}}
+{"at": 477, "kind": "frame", "frame": {"type": "system", "subtype": "status", "status": "requesting", "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "1e0b56e7-60ab-430d-910f-06c0337fb209"}}
+{"at": 1478, "kind": "frame", "frame": {"type": "user", "message": {"role": "user", "content": [{"type": "text", "text": "Reply with text only; do not use any tools. Write the numbers from one to two hundred in English words, one per line, lowercase, nothing else."}]}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "0e1f8935-c61a-480b-8877-72c10dd1adda", "timestamp": "2026-09-29T10:36:14.355Z", "isReplay": true}}
+{"at": 1478, "kind": "dispatch", "clientMessageId": "client-B", "sentUuid": "ff373ed9-cde2-4a49-b83f-09157a686ee8", "text": "Reply with text only; do not use any tools. Reply with exactly: B-DONE"}
+{"at": 1479, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "ff373ed9-cde2-4a49-b83f-09157a686ee8", "state": "queued", "uuid": "9438512a-5380-48da-8ddf-6adffc28cfbb", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 1479, "kind": "dispatch", "clientMessageId": "client-C", "sentUuid": "19ec4a51-3c43-4197-9305-f7e6e5ae96c5", "text": "Reply with text only; do not use any tools. Reply with exactly: C-DONE"}
+{"at": 1479, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "19ec4a51-3c43-4197-9305-f7e6e5ae96c5", "state": "queued", "uuid": "4f1b992a-26e8-43c5-af40-c3e5ef5707c8", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 1479, "kind": "control", "request": {"subtype": "cancel_async_message", "message_uuid": "ff373ed9-cde2-4a49-b83f-09157a686ee8"}}
+{"at": 1479, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "ff373ed9-cde2-4a49-b83f-09157a686ee8", "state": "cancelled", "uuid": "f52f03d1-df02-432c-8bb6-c94062877e6f", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 1479, "kind": "control-answer", "response": {"cancelled": true}}
+{"at": 10848, "kind": "frame", "frame": {"type": "assistant", "message": {"model": "claude-opus-5-5", "id": "msg_scrubbed02", "type": "message", "role": "assistant", "content": [{"type": "text", "text": "one\ntwo\nthree\nfour\nfive\nsix\nseven\neight\nnine\nten\neleven\ntwelve\nthirteen\nfourteen\nfifteen\nsixteen\nseventeen\neighteen\nnineteen\ntwenty\ntwenty-one\ntwenty-two\ntwenty-three\ntwenty-four\ntwenty-five\ntwenty-six\ntwenty-seven\ntwenty-eight\ntwenty-nine\nthirty\nthirty-one\nthirty-two\nthirty-three\nthirty-four\nthirty-five\nthirty-six\nthirty-seven\nthirty-eight\nthirty-nine\nforty\nforty-one\nforty-two\nforty-three\nforty-four\nforty-five\nforty-six\nforty-seven\nforty-eight\nforty-nine\nfifty\nfifty-one\nfifty-two\nfifty-three\nfifty-four\nfifty-five\nfifty-six\nfifty-seven\nfifty-eight\nfifty-nine\nsixty\nsixty-one\nsixty-two\nsixty-three\nsixty-four\nsixty-five\nsixty-six\nsixty-seven\nsixty-eight\nsixty-nine\nseventy\nseventy-one\nseventy-two\nseventy-three\nseventy-four\nseventy-five\nseventy-six\nseventy-seven\nseventy-eight\nseventy-nine\neighty\neighty-one\neighty-two\neighty-three\neighty-four\neighty-five\neighty-six\neighty-seven\neighty-eight\neighty-nine\nninety\nninety-one\nninety-two\nninety-three\nninety-four\nninety-five\nninety-six\nninety-seven\nninety-eight\nninety-nine\none hundred\none hundred one\none hundred two\none hundred three\none hundred four\none hundred five\none hundred six\none hundred seven\none hundred eight\none hundred nine\none hundred ten\none hundred eleven\none hundred twelve\none hundred thirteen\none hundred fourteen\none hundred fifteen\none hundred sixteen\none hundred seventeen\none hundred eighteen\none hundred nineteen\none hundred twenty\none hundred twenty-one\none hundred twenty-two\none hundred twenty-three\none hundred twenty-four\none hundred twenty-five\none hundred twenty-six\none hundred twenty-seven\none hundred twenty-eight\none hundred twenty-nine\none hundred thirty\none hundred thirty-one\none hundred thirty-two\none hundred thirty-three\none hundred thirty-four\none hundred thirty-five\none hundred thirty-six\none hundred thirty-seven\none hundred thirty-eight\none hundred thirty-nine\none hundred forty\none hundred forty-one\none hundred forty-two\none hundred forty-three\none hundred forty-four\none hundred forty-five\none hundred forty-six\none hundred forty-seven\none hundred forty-eight\none hundred forty-nine\none hundred fifty\none hundred fifty-one\none hundred fifty-two\none hundred fifty-three\none hundred fifty-four\none hundred fifty-five\none hundred fifty-six\none hundred fifty-seven\none hundred fifty-eight\none hundred fifty-nine\none hundred sixty\none hundred sixty-one\none hundred sixty-two\none hundred sixty-three\none hundred sixty-four\none hundred sixty-five\none hundred sixty-six\none hundred sixty-seven\none hundred sixty-eight\none hundred sixty-nine\none hundred seventy\none hundred seventy-one\none hundred seventy-two\none hundred seventy-three\none hundred seventy-four\none hundred seventy-five\none hundred seventy-six\none hundred seventy-seven\none hundred seventy-eight\none hundred seventy-nine\none hundred eighty\none hundred eighty-one\none hundred eighty-two\none hundred eighty-three\none hundred eighty-four\none hundred eighty-five\none hundred eighty-six\none hundred eighty-seven\none hundred eighty-eight\none hundred eighty-nine\none hundred ninety\none hundred ninety-one\none hundred ninety-two\none hundred ninety-three\none hundred ninety-four\none hundred ninety-five\none hundred ninety-six\none hundred ninety-seven\none hundred ninety-eight\none hundred ninety-nine\ntwo hundred"}], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 0, "cache_read_input_tokens": 23004, "cache_creation": {"ephemeral_5m_input_tokens": 0, "ephemeral_1h_input_tokens": 0}, "output_tokens": 8, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "89d623dc-6a78-46fc-9123-ee06e2d61a6b", "timestamp": "2026-09-29T10:36:24.740Z", "request_id": "req_scrubbed01", "user_message_uuid": "0e1f8935-c61a-480b-8877-72c10dd1adda", "user_message_uuids": ["0e1f8935-c61a-480b-8877-72c10dd1adda"]}}
+{"at": 10885, "kind": "frame", "frame": {"duration_api_ms": 11864, "stop_reason": "end_turn", "session_id": "00000000-0000-4000-8000-00000000c1a0", "total_cost_usd": 0.0398048, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 0, "cache_read_input_tokens": 23004, "output_tokens": 1497, "output_tokens_details": {"thinking_tokens": 0}, "server_tool_use": {"web_search_requests": 0, "web_fetch_requests": 0}, "service_tier": "standard", "cache_creation": {"ephemeral_1h_input_tokens": 0, "ephemeral_5m_input_tokens": 0}, "inference_geo": "not_available", "iterations": [{"input_tokens": 2, "output_tokens": 1497, "cache_read_input_tokens": 23004, "cache_creation_input_tokens": 0, "cache_creation": {"ephemeral_5m_input_tokens": 0, "ephemeral_1h_input_tokens": 0}, "type": "message"}], "speed": "standard"}, "modelUsage": {"claude-opus-5-5[1m]": {"inputTokens": 1211, "outputTokens": 1518, "cacheReadInputTokens": 23004, "cacheCreationInputTokens": 0, "webSearchRequests": 0, "costUSD": 0.0398048, "contextWindow": 1000000, "maxOutputTokens": 128000, "thinkingTokens": 0, "canonicalModel": "claude-opus-5-5", "provider": "firstParty", "costBasis": "list"}}, "permission_denials": [], "terminal_reason": "completed", "fast_mode_state": "off", "fast_mode_disabled_reason": "sdk_opt_in_required", "subagent_stats": {"spawned": 0, "requested": {"background": 0, "foreground": 0, "unset": 0}, "started_in_background": 0, "max_depth": 0, "spawned_by_subagents": 0, "completed": 0, "failed": 0, "killed": {"parent": 0, "user": 0, "system": 0}, "refused": {"depth_limit": 0, "concurrency_limit": 0, "budget": 0}, "by_type": {}}, "is_error": false, "num_turns": 1, "subtype": "success", "api_error_status": null, "result": "one\ntwo\nthree\nfour\nfive\nsix\nseven\neight\nnine\nten\neleven\ntwelve\nthirteen\nfourteen\nfifteen\nsixteen\nseventeen\neighteen\nnineteen\ntwenty\ntwenty-one\ntwenty-two\ntwenty-three\ntwenty-four\ntwenty-five\ntwenty-six\ntwenty-seven\ntwenty-eight\ntwenty-nine\nthirty\nthirty-one\nthirty-two\nthirty-three\nthirty-four\nthirty-five\nthirty-six\nthirty-seven\nthirty-eight\nthirty-nine\nforty\nforty-one\nforty-two\nforty-three\nforty-four\nforty-five\nforty-six\nforty-seven\nforty-eight\nforty-nine\nfifty\nfifty-one\nfifty-two\nfifty-three\nfifty-four\nfifty-five\nfifty-six\nfifty-seven\nfifty-eight\nfifty-nine\nsixty\nsixty-one\nsixty-two\nsixty-three\nsixty-four\nsixty-five\nsixty-six\nsixty-seven\nsixty-eight\nsixty-nine\nseventy\nseventy-one\nseventy-two\nseventy-three\nseventy-four\nseventy-five\nseventy-six\nseventy-seven\nseventy-eight\nseventy-nine\neighty\neighty-one\neighty-two\neighty-three\neighty-four\neighty-five\neighty-six\neighty-seven\neighty-eight\neighty-nine\nninety\nninety-one\nninety-two\nninety-three\nninety-four\nninety-five\nninety-six\nninety-seven\nninety-eight\nninety-nine\none hundred\none hundred one\none hundred two\none hundred three\none hundred four\none hundred five\none hundred six\none hundred seven\none hundred eight\none hundred nine\none hundred ten\none hundred eleven\none hundred twelve\none hundred thirteen\none hundred fourteen\none hundred fifteen\none hundred sixteen\none hundred seventeen\none hundred eighteen\none hundred nineteen\none hundred twenty\none hundred twenty-one\none hundred twenty-two\none hundred twenty-three\none hundred twenty-four\none hundred twenty-five\none hundred twenty-six\none hundred twenty-seven\none hundred twenty-eight\none hundred twenty-nine\none hundred thirty\none hundred thirty-one\none hundred thirty-two\none hundred thirty-three\none hundred thirty-four\none hundred thirty-five\none hundred thirty-six\none hundred thirty-seven\none hundred thirty-eight\none hundred thirty-nine\none hundred forty\none hundred forty-one\none hundred forty-two\none hundred forty-three\none hundred forty-four\none hundred forty-five\none hundred forty-six\none hundred forty-seven\none hundred forty-eight\none hundred forty-nine\none hundred fifty\none hundred fifty-one\none hundred fifty-two\none hundred fifty-three\none hundred fifty-four\none hundred fifty-five\none hundred fifty-six\none hundred fifty-seven\none hundred fifty-eight\none hundred fifty-nine\none hundred sixty\none hundred sixty-one\none hundred sixty-two\none hundred sixty-three\none hundred sixty-four\none hundred sixty-five\none hundred sixty-six\none hundred sixty-seven\none hundred sixty-eight\none hundred sixty-nine\none hundred seventy\none hundred seventy-one\none hundred seventy-two\none hundred seventy-three\none hundred seventy-four\none hundred seventy-five\none hundred seventy-six\none hundred seventy-seven\none hundred seventy-eight\none hundred seventy-nine\none hundred eighty\none hundred eighty-one\none hundred eighty-two\none hundred eighty-three\none hundred eighty-four\none hundred eighty-five\none hundred eighty-six\none hundred eighty-seven\none hundred eighty-eight\none hundred eighty-nine\none hundred ninety\none hundred ninety-one\none hundred ninety-two\none hundred ninety-three\none hundred ninety-four\none hundred ninety-five\none hundred ninety-six\none hundred ninety-seven\none hundred ninety-eight\none hundred ninety-nine\ntwo hundred", "ttft_ms": 10419, "type": "result", "duration_ms": 10453, "uuid": "922da184-ba96-4a9e-a133-27dd7f45818f", "ttft_stream_ms": 1063, "time_to_request_ms": 71, "first_content_frame_ms": 1063, "user_message_uuid": "0e1f8935-c61a-480b-8877-72c10dd1adda", "user_message_uuids": ["0e1f8935-c61a-480b-8877-72c10dd1adda"], "request_sent_wall_ms": 1790678174393, "queued_turn_count": 0, "result_index": 0}}
+{"at": 10886, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "0e1f8935-c61a-480b-8877-72c10dd1adda", "state": "completed", "uuid": "3df6d400-c72e-4521-92f4-cc286ab007b7", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 10886, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "19ec4a51-3c43-4197-9305-f7e6e5ae96c5", "state": "started", "uuid": "e7087639-8080-4803-b8e4-638cc31888e5", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 10904, "kind": "frame", "frame": {"type": "system", "subtype": "init", "cwd": "/Users/user/scrubbed", "session_id": "00000000-0000-4000-8000-00000000c1a0", "tools": [], "mcp_servers": [], "model": "claude-opus-5-5[1m]", "permissionMode": "default", "slash_commands": [], "terminal_slash_commands": [], "apiKeySource": "none", "claude_code_version": "2.1.280", "output_style": "default", "agents": [], "skills": [], "plugins": [], "capabilities": ["interrupt_receipt_v1", "interrupt_cancel_queued_v1", "msg_lifecycle_v1", "mcp_read_resource_v1", "mcp_tool_ui_meta_v1"], "analytics_disabled": false, "product_feedback_disabled": false, "uuid": "6fce32e9-e653-477f-b6b6-4d10267b2991", "fast_mode_state": "off", "fast_mode_disabled_reason": "sdk_opt_in_required"}}
+{"at": 10904, "kind": "frame", "frame": {"type": "system", "subtype": "status", "status": "requesting", "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "e546544b-76be-4d78-9094-9a8329a6a756"}}
+{"at": 12309, "kind": "frame", "frame": {"type": "user", "message": {"role": "user", "content": [{"type": "text", "text": "Reply with text only; do not use any tools. Reply with exactly: C-DONE"}]}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "19ec4a51-3c43-4197-9305-f7e6e5ae96c5", "timestamp": "2026-09-29T10:36:24.795Z", "isReplay": true}}
+{"at": 12310, "kind": "frame", "frame": {"type": "assistant", "message": {"model": "claude-opus-5-5", "id": "msg_scrubbed03", "type": "message", "role": "assistant", "content": [{"type": "text", "text": "C-DONE"}], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 4, "cache_creation_input_tokens": 9027, "cache_read_input_tokens": 15502, "cache_creation": {"ephemeral_5m_input_tokens": 0, "ephemeral_1h_input_tokens": 9027}, "output_tokens": 7, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "63316a0d-face-40ab-b7c5-a2f3c7aef73b", "timestamp": "2026-09-29T10:36:26.216Z", "request_id": "req_scrubbed02", "user_message_uuid": "19ec4a51-3c43-4197-9305-f7e6e5ae96c5", "user_message_uuids": ["19ec4a51-3c43-4197-9305-f7e6e5ae96c5"]}}
+{"at": 12331, "kind": "frame", "frame": {"duration_api_ms": 13267, "stop_reason": "end_turn", "session_id": "00000000-0000-4000-8000-00000000c1a0", "total_cost_usd": 0.11527720000000001, "usage": {"input_tokens": 4, "cache_creation_input_tokens": 9027, "cache_read_input_tokens": 15502, "output_tokens": 7, "output_tokens_details": {"thinking_tokens": 0}, "server_tool_use": {"web_search_requests": 0, "web_fetch_requests": 0}, "service_tier": "standard", "cache_creation": {"ephemeral_1h_input_tokens": 9027, "ephemeral_5m_input_tokens": 0}, "inference_geo": "not_available", "iterations": [{"input_tokens": 4, "output_tokens": 7, "cache_read_input_tokens": 15502, "cache_creation_input_tokens": 9027, "cache_creation": {"ephemeral_5m_input_tokens": 0, "ephemeral_1h_input_tokens": 9027}, "type": "message"}], "speed": "standard"}, "modelUsage": {"claude-opus-5-5[1m]": {"inputTokens": 1215, "outputTokens": 1525, "cacheReadInputTokens": 38506, "cacheCreationInputTokens": 9027, "webSearchRequests": 0, "costUSD": 0.11527720000000001, "contextWindow": 1000000, "maxOutputTokens": 128000, "thinkingTokens": 0, "canonicalModel": "claude-opus-5-5", "provider": "firstParty", "costBasis": "list"}}, "permission_denials": [], "terminal_reason": "completed", "fast_mode_state": "off", "fast_mode_disabled_reason": "sdk_opt_in_required", "subagent_stats": {"spawned": 0, "requested": {"background": 0, "foreground": 0, "unset": 0}, "started_in_background": 0, "max_depth": 0, "spawned_by_subagents": 0, "completed": 0, "failed": 0, "killed": {"parent": 0, "user": 0, "system": 0}, "refused": {"depth_limit": 0, "concurrency_limit": 0, "budget": 0}, "by_type": {}}, "is_error": false, "num_turns": 1, "subtype": "success", "api_error_status": null, "result": "C-DONE", "ttft_ms": 1424, "type": "result", "duration_ms": 1438, "uuid": "fb897d43-901b-4f47-a701-d4d5f4cf8562", "ttft_stream_ms": 1423, "time_to_request_ms": 23, "first_content_frame_ms": 1423, "user_message_uuid": "19ec4a51-3c43-4197-9305-f7e6e5ae96c5", "user_message_uuids": ["19ec4a51-3c43-4197-9305-f7e6e5ae96c5"], "request_sent_wall_ms": 1790678184816, "queued_turn_count": 0, "result_index": 1}}
+{"at": 12331, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "19ec4a51-3c43-4197-9305-f7e6e5ae96c5", "state": "completed", "uuid": "bccf83ae-642e-42f8-8a33-1448870fb137", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 12332, "kind": "frame", "frame": {"type": "system", "subtype": "session_state_changed", "state": "idle", "uuid": "5277a376-53d0-4a5d-b6f6-7669baccb91f", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
diff --git a/src/main/claude/__fixtures__/claude-lifecycle-capture-cancel-async.jsonl b/src/main/claude/__fixtures__/claude-lifecycle-capture-cancel-async.jsonl
new file mode 100644
index 00000000000..69284b8119d
--- /dev/null
+++ b/src/main/claude/__fixtures__/claude-lifecycle-capture-cancel-async.jsonl
@@ -0,0 +1,19 @@
+{"at": 0, "kind": "meta", "scenario": "cancel-async", "providerSessionId": "00000000-0000-4000-8000-00000000c1a0", "note": "Recorded against Claude CLI 2.1.280 through the Agent SDK transport; scrubbed: session id, home paths, API request and message ids, initialize answer; stream_event frames dropped."}
+{"at": 207, "kind": "frame", "frame": {"type": "system", "subtype": "hook_started", "hook_id": "6c03b0d7-8119-4015-bd43-9c83fa47119b", "hook_name": "SessionStart:startup", "hook_event": "SessionStart", "uuid": "ce5037b8-9e84-4b39-a598-cc4cea7123b4", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 225, "kind": "frame", "frame": {"type": "system", "subtype": "hook_response", "hook_id": "6c03b0d7-8119-4015-bd43-9c83fa47119b", "hook_name": "SessionStart:startup", "hook_event": "SessionStart", "exit_code": 0, "outcome": "success", "uuid": "93e4cdab-4976-4646-a5ce-9544936bfe6e", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 256, "kind": "dispatch", "clientMessageId": "client-A", "sentUuid": "f3cd976f-dc3f-4eca-8622-ebf4e5b1d679", "text": "Reply with text only; do not use any tools. Write the numbers from one to two hundred in English words, one per line, lowercase, nothing else."}
+{"at": 261, "kind": "frame", "frame": {"type": "system", "subtype": "session_state_changed", "state": "running", "uuid": "3746879b-3bb8-47f8-a371-9544bc5812a5", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 261, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "f3cd976f-dc3f-4eca-8622-ebf4e5b1d679", "state": "queued", "uuid": "a75f748a-f917-4f8a-afea-28f022859753", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 261, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "f3cd976f-dc3f-4eca-8622-ebf4e5b1d679", "state": "started", "uuid": "e204ce9a-ee8a-4b64-ba12-eff1d33c52d1", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 301, "kind": "frame", "frame": {"type": "system", "subtype": "init", "cwd": "/Users/user/scrubbed", "session_id": "00000000-0000-4000-8000-00000000c1a0", "tools": [], "mcp_servers": [], "model": "claude-opus-5-5[1m]", "permissionMode": "default", "slash_commands": [], "terminal_slash_commands": [], "apiKeySource": "none", "claude_code_version": "2.1.280", "output_style": "default", "agents": [], "skills": [], "plugins": [], "capabilities": ["interrupt_receipt_v1", "interrupt_cancel_queued_v1", "msg_lifecycle_v1", "mcp_read_resource_v1", "mcp_tool_ui_meta_v1"], "analytics_disabled": false, "product_feedback_disabled": false, "uuid": "dad169fc-bced-4e8f-a40f-f3ea0537c763", "fast_mode_state": "off", "fast_mode_disabled_reason": "sdk_opt_in_required"}}
+{"at": 302, "kind": "frame", "frame": {"type": "system", "subtype": "status", "status": "requesting", "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "f33c5acc-1608-453c-86a0-2568002a67d0"}}
+{"at": 1096, "kind": "frame", "frame": {"type": "user", "message": {"role": "user", "content": [{"type": "text", "text": "Reply with text only; do not use any tools. Write the numbers from one to two hundred in English words, one per line, lowercase, nothing else."}]}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "f3cd976f-dc3f-4eca-8622-ebf4e5b1d679", "timestamp": "2026-09-29T10:35:47.486Z", "isReplay": true}}
+{"at": 1097, "kind": "dispatch", "clientMessageId": "client-B", "sentUuid": "1ebf4091-6507-4b8b-838b-93c95875eded", "text": "Reply with text only; do not use any tools. Reply with exactly: B-DONE"}
+{"at": 1097, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "1ebf4091-6507-4b8b-838b-93c95875eded", "state": "queued", "uuid": "a021a2ec-59b0-4470-ab40-5c3af8b9dcb0", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 1097, "kind": "control", "request": {"subtype": "cancel_async_message", "message_uuid": "1ebf4091-6507-4b8b-838b-93c95875eded"}}
+{"at": 1098, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "1ebf4091-6507-4b8b-838b-93c95875eded", "state": "cancelled", "uuid": "75187135-edfc-4738-8890-3c5204d319f1", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 1098, "kind": "control-answer", "response": {"cancelled": true}}
+{"at": 10491, "kind": "frame", "frame": {"type": "assistant", "message": {"model": "claude-opus-5-5", "id": "msg_scrubbed02", "type": "message", "role": "assistant", "content": [{"type": "text", "text": "one\ntwo\nthree\nfour\nfive\nsix\nseven\neight\nnine\nten\neleven\ntwelve\nthirteen\nfourteen\nfifteen\nsixteen\nseventeen\neighteen\nnineteen\ntwenty\ntwenty-one\ntwenty-two\ntwenty-three\ntwenty-four\ntwenty-five\ntwenty-six\ntwenty-seven\ntwenty-eight\ntwenty-nine\nthirty\nthirty-one\nthirty-two\nthirty-three\nthirty-four\nthirty-five\nthirty-six\nthirty-seven\nthirty-eight\nthirty-nine\nforty\nforty-one\nforty-two\nforty-three\nforty-four\nforty-five\nforty-six\nforty-seven\nforty-eight\nforty-nine\nfifty\nfifty-one\nfifty-two\nfifty-three\nfifty-four\nfifty-five\nfifty-six\nfifty-seven\nfifty-eight\nfifty-nine\nsixty\nsixty-one\nsixty-two\nsixty-three\nsixty-four\nsixty-five\nsixty-six\nsixty-seven\nsixty-eight\nsixty-nine\nseventy\nseventy-one\nseventy-two\nseventy-three\nseventy-four\nseventy-five\nseventy-six\nseventy-seven\nseventy-eight\nseventy-nine\neighty\neighty-one\neighty-two\neighty-three\neighty-four\neighty-five\neighty-six\neighty-seven\neighty-eight\neighty-nine\nninety\nninety-one\nninety-two\nninety-three\nninety-four\nninety-five\nninety-six\nninety-seven\nninety-eight\nninety-nine\none hundred\none hundred one\none hundred two\none hundred three\none hundred four\none hundred five\none hundred six\none hundred seven\none hundred eight\none hundred nine\none hundred ten\none hundred eleven\none hundred twelve\none hundred thirteen\none hundred fourteen\none hundred fifteen\none hundred sixteen\none hundred seventeen\none hundred eighteen\none hundred nineteen\none hundred twenty\none hundred twenty-one\none hundred twenty-two\none hundred twenty-three\none hundred twenty-four\none hundred twenty-five\none hundred twenty-six\none hundred twenty-seven\none hundred twenty-eight\none hundred twenty-nine\none hundred thirty\none hundred thirty-one\none hundred thirty-two\none hundred thirty-three\none hundred thirty-four\none hundred thirty-five\none hundred thirty-six\none hundred thirty-seven\none hundred thirty-eight\none hundred thirty-nine\none hundred forty\none hundred forty-one\none hundred forty-two\none hundred forty-three\none hundred forty-four\none hundred forty-five\none hundred forty-six\none hundred forty-seven\none hundred forty-eight\none hundred forty-nine\none hundred fifty\none hundred fifty-one\none hundred fifty-two\none hundred fifty-three\none hundred fifty-four\none hundred fifty-five\none hundred fifty-six\none hundred fifty-seven\none hundred fifty-eight\none hundred fifty-nine\none hundred sixty\none hundred sixty-one\none hundred sixty-two\none hundred sixty-three\none hundred sixty-four\none hundred sixty-five\none hundred sixty-six\none hundred sixty-seven\none hundred sixty-eight\none hundred sixty-nine\none hundred seventy\none hundred seventy-one\none hundred seventy-two\none hundred seventy-three\none hundred seventy-four\none hundred seventy-five\none hundred seventy-six\none hundred seventy-seven\none hundred seventy-eight\none hundred seventy-nine\none hundred eighty\none hundred eighty-one\none hundred eighty-two\none hundred eighty-three\none hundred eighty-four\none hundred eighty-five\none hundred eighty-six\none hundred eighty-seven\none hundred eighty-eight\none hundred eighty-nine\none hundred ninety\none hundred ninety-one\none hundred ninety-two\none hundred ninety-three\none hundred ninety-four\none hundred ninety-five\none hundred ninety-six\none hundred ninety-seven\none hundred ninety-eight\none hundred ninety-nine\ntwo hundred"}], "container": null, "stop_reason": null, "stop_sequence": null, "stop_details": null, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 0, "cache_read_input_tokens": 23004, "cache_creation": {"ephemeral_5m_input_tokens": 0, "ephemeral_1h_input_tokens": 0}, "output_tokens": 8, "service_tier": "standard", "inference_geo": "not_available"}, "diagnostics": null, "context_management": null}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "16c7fded-8293-4480-a708-bae2361dc27c", "timestamp": "2026-09-29T10:35:57.675Z", "request_id": "req_scrubbed01", "user_message_uuid": "f3cd976f-dc3f-4eca-8622-ebf4e5b1d679", "user_message_uuids": ["f3cd976f-dc3f-4eca-8622-ebf4e5b1d679"]}}
+{"at": 10532, "kind": "frame", "frame": {"duration_api_ms": 12016, "stop_reason": "end_turn", "session_id": "00000000-0000-4000-8000-00000000c1a0", "total_cost_usd": 0.0398048, "usage": {"input_tokens": 2, "cache_creation_input_tokens": 0, "cache_read_input_tokens": 23004, "output_tokens": 1497, "output_tokens_details": {"thinking_tokens": 0}, "server_tool_use": {"web_search_requests": 0, "web_fetch_requests": 0}, "service_tier": "standard", "cache_creation": {"ephemeral_1h_input_tokens": 0, "ephemeral_5m_input_tokens": 0}, "inference_geo": "not_available", "iterations": [{"input_tokens": 2, "output_tokens": 1497, "cache_read_input_tokens": 23004, "cache_creation_input_tokens": 0, "cache_creation": {"ephemeral_5m_input_tokens": 0, "ephemeral_1h_input_tokens": 0}, "type": "message"}], "speed": "standard"}, "modelUsage": {"claude-opus-5-5[1m]": {"inputTokens": 1211, "outputTokens": 1518, "cacheReadInputTokens": 23004, "cacheCreationInputTokens": 0, "webSearchRequests": 0, "costUSD": 0.0398048, "contextWindow": 1000000, "maxOutputTokens": 128000, "thinkingTokens": 0, "canonicalModel": "claude-opus-5-5", "provider": "firstParty", "costBasis": "list"}}, "permission_denials": [], "terminal_reason": "completed", "fast_mode_state": "off", "fast_mode_disabled_reason": "sdk_opt_in_required", "subagent_stats": {"spawned": 0, "requested": {"background": 0, "foreground": 0, "unset": 0}, "started_in_background": 0, "max_depth": 0, "spawned_by_subagents": 0, "completed": 0, "failed": 0, "killed": {"parent": 0, "user": 0, "system": 0}, "refused": {"depth_limit": 0, "concurrency_limit": 0, "budget": 0}, "by_type": {}}, "is_error": false, "num_turns": 1, "subtype": "success", "api_error_status": null, "result": "one\ntwo\nthree\nfour\nfive\nsix\nseven\neight\nnine\nten\neleven\ntwelve\nthirteen\nfourteen\nfifteen\nsixteen\nseventeen\neighteen\nnineteen\ntwenty\ntwenty-one\ntwenty-two\ntwenty-three\ntwenty-four\ntwenty-five\ntwenty-six\ntwenty-seven\ntwenty-eight\ntwenty-nine\nthirty\nthirty-one\nthirty-two\nthirty-three\nthirty-four\nthirty-five\nthirty-six\nthirty-seven\nthirty-eight\nthirty-nine\nforty\nforty-one\nforty-two\nforty-three\nforty-four\nforty-five\nforty-six\nforty-seven\nforty-eight\nforty-nine\nfifty\nfifty-one\nfifty-two\nfifty-three\nfifty-four\nfifty-five\nfifty-six\nfifty-seven\nfifty-eight\nfifty-nine\nsixty\nsixty-one\nsixty-two\nsixty-three\nsixty-four\nsixty-five\nsixty-six\nsixty-seven\nsixty-eight\nsixty-nine\nseventy\nseventy-one\nseventy-two\nseventy-three\nseventy-four\nseventy-five\nseventy-six\nseventy-seven\nseventy-eight\nseventy-nine\neighty\neighty-one\neighty-two\neighty-three\neighty-four\neighty-five\neighty-six\neighty-seven\neighty-eight\neighty-nine\nninety\nninety-one\nninety-two\nninety-three\nninety-four\nninety-five\nninety-six\nninety-seven\nninety-eight\nninety-nine\none hundred\none hundred one\none hundred two\none hundred three\none hundred four\none hundred five\none hundred six\none hundred seven\none hundred eight\none hundred nine\none hundred ten\none hundred eleven\none hundred twelve\none hundred thirteen\none hundred fourteen\none hundred fifteen\none hundred sixteen\none hundred seventeen\none hundred eighteen\none hundred nineteen\none hundred twenty\none hundred twenty-one\none hundred twenty-two\none hundred twenty-three\none hundred twenty-four\none hundred twenty-five\none hundred twenty-six\none hundred twenty-seven\none hundred twenty-eight\none hundred twenty-nine\none hundred thirty\none hundred thirty-one\none hundred thirty-two\none hundred thirty-three\none hundred thirty-four\none hundred thirty-five\none hundred thirty-six\none hundred thirty-seven\none hundred thirty-eight\none hundred thirty-nine\none hundred forty\none hundred forty-one\none hundred forty-two\none hundred forty-three\none hundred forty-four\none hundred forty-five\none hundred forty-six\none hundred forty-seven\none hundred forty-eight\none hundred forty-nine\none hundred fifty\none hundred fifty-one\none hundred fifty-two\none hundred fifty-three\none hundred fifty-four\none hundred fifty-five\none hundred fifty-six\none hundred fifty-seven\none hundred fifty-eight\none hundred fifty-nine\none hundred sixty\none hundred sixty-one\none hundred sixty-two\none hundred sixty-three\none hundred sixty-four\none hundred sixty-five\none hundred sixty-six\none hundred sixty-seven\none hundred sixty-eight\none hundred sixty-nine\none hundred seventy\none hundred seventy-one\none hundred seventy-two\none hundred seventy-three\none hundred seventy-four\none hundred seventy-five\none hundred seventy-six\none hundred seventy-seven\none hundred seventy-eight\none hundred seventy-nine\none hundred eighty\none hundred eighty-one\none hundred eighty-two\none hundred eighty-three\none hundred eighty-four\none hundred eighty-five\none hundred eighty-six\none hundred eighty-seven\none hundred eighty-eight\none hundred eighty-nine\none hundred ninety\none hundred ninety-one\none hundred ninety-two\none hundred ninety-three\none hundred ninety-four\none hundred ninety-five\none hundred ninety-six\none hundred ninety-seven\none hundred ninety-eight\none hundred ninety-nine\ntwo hundred", "ttft_ms": 10214, "type": "result", "duration_ms": 10247, "uuid": "7aa2d6f4-d1dd-4749-ae09-7b0235246b51", "ttft_stream_ms": 834, "time_to_request_ms": 47, "first_content_frame_ms": 834, "user_message_uuid": "f3cd976f-dc3f-4eca-8622-ebf4e5b1d679", "user_message_uuids": ["f3cd976f-dc3f-4eca-8622-ebf4e5b1d679"], "request_sent_wall_ms": 1790678147508, "queued_turn_count": 0, "result_index": 0}}
+{"at": 10532, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "f3cd976f-dc3f-4eca-8622-ebf4e5b1d679", "state": "completed", "uuid": "28426f29-739b-48dc-94e8-63e85e197192", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 10533, "kind": "frame", "frame": {"type": "system", "subtype": "session_state_changed", "state": "idle", "uuid": "b8e0b928-4ded-4ba4-8a88-5a0c5517657a", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
diff --git a/src/main/claude/__fixtures__/claude-lifecycle-capture-interrupt-lost.jsonl b/src/main/claude/__fixtures__/claude-lifecycle-capture-interrupt-lost.jsonl
new file mode 100644
index 00000000000..35230188f88
--- /dev/null
+++ b/src/main/claude/__fixtures__/claude-lifecycle-capture-interrupt-lost.jsonl
@@ -0,0 +1,20 @@
+{"at": 3, "kind": "meta", "scenario": "interrupt-lost", "providerSessionId": "00000000-0000-4000-8000-00000000c1a0", "note": "Recorded against Claude CLI 2.1.280 through the Agent SDK transport; scrubbed: session id, home paths, API request and message ids, initialize answer; stream_event frames dropped."}
+{"at": 333, "kind": "frame", "frame": {"type": "system", "subtype": "hook_started", "hook_id": "1c957d67-f23b-4d51-969d-187cd2a57e59", "hook_name": "SessionStart:startup", "hook_event": "SessionStart", "uuid": "a8c39655-a598-42a7-943e-899b511643d9", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 362, "kind": "frame", "frame": {"type": "system", "subtype": "hook_response", "hook_id": "1c957d67-f23b-4d51-969d-187cd2a57e59", "hook_name": "SessionStart:startup", "hook_event": "SessionStart", "exit_code": 0, "outcome": "success", "uuid": "1bc17c32-c0d8-4c1d-ace0-03327bbcf13b", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 416, "kind": "dispatch", "clientMessageId": "client-A", "sentUuid": "d0649b29-11d5-45e7-9034-6fb789e78eda", "text": "Reply with text only; do not use any tools. Write the numbers from one to two hundred in English words, one per line, lowercase, nothing else."}
+{"at": 421, "kind": "frame", "frame": {"type": "system", "subtype": "session_state_changed", "state": "running", "uuid": "ef60bf56-2954-4f1a-bfaf-502f4cf7e5f9", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 421, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "d0649b29-11d5-45e7-9034-6fb789e78eda", "state": "queued", "uuid": "8f4de258-0da7-4ff7-a972-24c5d2b9e593", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 422, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "d0649b29-11d5-45e7-9034-6fb789e78eda", "state": "started", "uuid": "e70550c4-18ff-4795-9ddf-9dd267e82b9e", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 488, "kind": "frame", "frame": {"type": "system", "subtype": "init", "cwd": "/Users/user/scrubbed", "session_id": "00000000-0000-4000-8000-00000000c1a0", "tools": [], "mcp_servers": [], "model": "claude-opus-5-5[1m]", "permissionMode": "default", "slash_commands": [], "terminal_slash_commands": [], "apiKeySource": "none", "claude_code_version": "2.1.280", "output_style": "default", "agents": [], "skills": [], "plugins": [], "capabilities": ["interrupt_receipt_v1", "interrupt_cancel_queued_v1", "msg_lifecycle_v1", "mcp_read_resource_v1", "mcp_tool_ui_meta_v1"], "analytics_disabled": false, "product_feedback_disabled": false, "uuid": "31b93145-d113-4141-adb1-2174b07845cd", "fast_mode_state": "off", "fast_mode_disabled_reason": "sdk_opt_in_required"}}
+{"at": 490, "kind": "frame", "frame": {"type": "system", "subtype": "status", "status": "requesting", "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "38344e0c-d00c-40dd-9da2-6cd73d7ad800"}}
+{"at": 2520, "kind": "frame", "frame": {"type": "user", "message": {"role": "user", "content": [{"type": "text", "text": "Reply with text only; do not use any tools. Write the numbers from one to two hundred in English words, one per line, lowercase, nothing else."}]}, "session_id": "00000000-0000-4000-8000-00000000c1a0", "parent_tool_use_id": null, "uuid": "d0649b29-11d5-45e7-9034-6fb789e78eda", "timestamp": "2026-09-29T10:35:25.741Z", "isReplay": true}}
+{"at": 3136, "kind": "frame", "frame": {"type": "system", "subtype": "thinking_tokens", "estimated_tokens": 50, "estimated_tokens_delta": 50, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "d15945e1-6168-458e-9b2d-49f427327af2", "user_message_uuid": "d0649b29-11d5-45e7-9034-6fb789e78eda"}}
+{"at": 3137, "kind": "dispatch", "clientMessageId": "client-B", "sentUuid": "0ca6fc96-94c3-4462-9524-a8341729ab91", "text": "Reply with text only; do not use any tools. Reply with exactly: B-DONE"}
+{"at": 3137, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "0ca6fc96-94c3-4462-9524-a8341729ab91", "state": "queued", "uuid": "f6865348-9b42-410c-96e8-5bf01e1d68de", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 3137, "kind": "control", "request": {"subtype": "interrupt", "cancel_queued": true}}
+{"at": 3138, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "0ca6fc96-94c3-4462-9524-a8341729ab91", "state": "cancelled", "uuid": "d4cf2dfc-2530-4fa6-9f47-efab0874177a", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 3138, "kind": "control-answer", "response": {"still_queued": [], "cancelled": ["0ca6fc96-94c3-4462-9524-a8341729ab91"]}}
+{"at": 3139, "kind": "frame", "frame": {"type": "user", "message": {"role": "user", "content": [{"type": "text", "text": "[Request interrupted by user]"}]}, "parent_tool_use_id": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "uuid": "ce4fe796-391f-4acc-b37c-49b668682592", "timestamp": "2026-09-29T10:35:28.422Z"}}
+{"at": 3149, "kind": "frame", "frame": {"duration_api_ms": 2176, "stop_reason": null, "session_id": "00000000-0000-4000-8000-00000000c1a0", "total_cost_usd": 0.005256, "usage": {"output_tokens_details": {"thinking_tokens": 0}, "input_tokens": 0, "cache_creation_input_tokens": 0, "cache_read_input_tokens": 0, "output_tokens": 0, "server_tool_use": {"web_search_requests": 0, "web_fetch_requests": 0}, "service_tier": "standard", "cache_creation": {"ephemeral_1h_input_tokens": 0, "ephemeral_5m_input_tokens": 0}, "inference_geo": "", "iterations": [], "speed": "standard"}, "modelUsage": {"claude-opus-5-5[1m]": {"inputTokens": 1209, "outputTokens": 21, "cacheReadInputTokens": 0, "cacheCreationInputTokens": 0, "webSearchRequests": 0, "costUSD": 0.005256, "contextWindow": 1000000, "maxOutputTokens": 128000, "thinkingTokens": 0, "canonicalModel": "claude-opus-5-5", "provider": "firstParty", "costBasis": "list"}}, "permission_denials": [], "terminal_reason": "aborted_streaming", "fast_mode_state": "off", "fast_mode_disabled_reason": "sdk_opt_in_required", "subagent_stats": {"spawned": 0, "requested": {"background": 0, "foreground": 0, "unset": 0}, "started_in_background": 0, "max_depth": 0, "spawned_by_subagents": 0, "completed": 0, "failed": 0, "killed": {"parent": 0, "user": 0, "system": 0}, "refused": {"depth_limit": 0, "concurrency_limit": 0, "budget": 0}, "by_type": {}}, "is_error": true, "num_turns": 2, "subtype": "error_during_execution", "errors": ["[ede_diagnostic] result_type=user last_content_type=n/a stop_reason=null"], "user_message_uuid": "d0649b29-11d5-45e7-9034-6fb789e78eda", "type": "result", "duration_ms": 2717, "uuid": "9551c994-3a32-4f9a-b205-be27ae648b93", "user_message_uuids": ["d0649b29-11d5-45e7-9034-6fb789e78eda"], "queued_turn_count": 0, "result_index": 0}}
+{"at": 3150, "kind": "frame", "frame": {"type": "command_lifecycle", "command_uuid": "d0649b29-11d5-45e7-9034-6fb789e78eda", "state": "cancelled", "uuid": "24526d3c-00cc-488a-b899-239756190772", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
+{"at": 3150, "kind": "frame", "frame": {"type": "system", "subtype": "session_state_changed", "state": "idle", "uuid": "5de7c47b-2d4f-4f66-b301-d5e4de20e787", "session_id": "00000000-0000-4000-8000-00000000c1a0"}}
diff --git a/src/main/claude/claude-adapter-capture-replay.test.ts b/src/main/claude/claude-adapter-capture-replay.test.ts
new file mode 100644
index 00000000000..8e877a135a8
--- /dev/null
+++ b/src/main/claude/claude-adapter-capture-replay.test.ts
@@ -0,0 +1,233 @@
+// Verbatim replay of FULL captures recorded through Orca's own adapter against
+// the real CLI (`__fixtures__/claude-adapter-capture-*.jsonl`): every frame the
+// adapter saw — hook proof, per-cycle init, command_lifecycle, session-state,
+// stream events — in the recorded order, with the recorded dispatch points.
+// The oracle is the provider's own membership fact: each result's
+// `user_message_uuids` must equal the sends that settled into the turn that
+// result closed. Nothing here asserts design internals, so a rule change or a
+// CLI drift that breaks membership fails these tests whatever the mechanism.
+
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it, vi, type Mock } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalMessageItem
+} from '../../shared/agent-session-journal-types'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { readAgentJournalTurn } from '../../shared/agent-session-turn-record'
+import { ClaudeStructuredSessionAdapter } from './claude-structured-session-adapter'
+import type {
+  ClaudeLateDispatchOutcome,
+  ClaudeStructuredSessionAdapterDeps
+} from './claude-structured-session-state'
+import {
+  fakeClaude,
+  identityFor,
+  PROVIDER_SESSION_ID
+} from './claude-structured-session-test-support'
+
+type CapturedEvent =
+  | { at: number; kind: 'meta'; providerSessionId: string }
+  | { at: number; kind: 'frame'; frame: Record<string, unknown> }
+  | { at: number; kind: 'dispatch'; clientMessageId: string; sentUuid: string; text: string }
+  | { at: number; kind: 'end' }
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function decodeCapturedEvent(value: unknown): CapturedEvent {
+  if (!isRecord(value) || typeof value.at !== 'number' || typeof value.kind !== 'string') {
+    throw new Error('capture line is not a recorded event')
+  }
+  if (value.kind === 'meta' && typeof value.providerSessionId === 'string') {
+    return { at: value.at, kind: 'meta', providerSessionId: value.providerSessionId }
+  }
+  if (value.kind === 'frame' && isRecord(value.frame)) {
+    return { at: value.at, kind: 'frame', frame: value.frame }
+  }
+  if (
+    value.kind === 'dispatch' &&
+    typeof value.clientMessageId === 'string' &&
+    typeof value.sentUuid === 'string' &&
+    typeof value.text === 'string'
+  ) {
+    return {
+      at: value.at,
+      kind: 'dispatch',
+      clientMessageId: value.clientMessageId,
+      sentUuid: value.sentUuid,
+      text: value.text
+    }
+  }
+  if (value.kind === 'end') {
+    return { at: value.at, kind: 'end' }
+  }
+  throw new Error(`capture line has unknown kind: ${String(value.kind)}`)
+}
+
+function loadCapture(name: string): CapturedEvent[] {
+  const path = join(__dirname, '__fixtures__', `claude-adapter-capture-${name}.jsonl`)
+  return readFileSync(path, 'utf8')
+    .trim()
+    .split('\n')
+    .map((line) => decodeCapturedEvent(JSON.parse(line)))
+}
+
+type Replay = {
+  settled: Mock
+  /** Final revision per turn id, in first-open order. */
+  finalTurns: Map<string, NonNullable<ReturnType<typeof readAgentJournalTurn>>>
+  everInterrupted: boolean
+  /** Each result frame's `user_message_uuids`, mapped to live dispatch uuids. */
+  resultMemberships: string[][]
+  /** clientMessageId -> provider uuid its delivery settled under. */
+  settledUuids: Map<string, string>
+  /** Live dispatch uuid -> turn id its send landed in (turn open at settlement). */
+  liveUuidByClient: Map<string, string>
+}
+
+async function replayCapture(name: string): Promise<Replay> {
+  const capture = loadCapture(name)
+  let nowMs = 1_700_000_200_000
+  const finalTurns = new Map<string, NonNullable<ReturnType<typeof readAgentJournalTurn>>>()
+  let everInterrupted = false
+  const sink: StructuredAgentSessionEventSink = {
+    appendItem: (_identity, body: AgentJournalItemBody) => {
+      const turn = readAgentJournalTurn(body)
+      if (turn) {
+        finalTurns.set(turn.turnId, turn)
+        everInterrupted ||= turn.state === 'interrupted'
+      }
+    },
+    appendTombstone: () => {},
+    publish: () => {}
+  }
+  const settled = vi.fn<(input: { sessionId: string } & ClaudeLateDispatchOutcome) => void>()
+  // The capture supplies every frame, startup proof included.
+  const claude = fakeClaude({ initProof: 'none', replayUuid: null })
+  const deps: ClaudeStructuredSessionAdapterDeps = {
+    resolveLaunch: async () => ({
+      pathToClaudeCodeExecutable: 'claude',
+      options: {},
+      cwd: '/work/repo',
+      claudeConfigDir: '/accounts/claude',
+      providerSessionId: PROVIDER_SESSION_ID,
+      resumeLeafUuid: null,
+      resumesTranscript: false,
+      continuesChain: false
+    }),
+    openConnection: claude.openConnection,
+    readProcessStartTime: async () => 1,
+    now: () => nowMs,
+    persistHandle: async () => {},
+    onDispatchSettledLate: settled
+  }
+  const adapter = new ClaudeStructuredSessionAdapter(deps)
+  await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9', events: sink })
+
+  // Captured uuids -> the uuids the live dispatches mint during this replay.
+  const uuidMap = new Map<string, string>()
+  const capturedSessionId = capture.flatMap((event) =>
+    event.kind === 'meta' ? [event.providerSessionId] : []
+  )[0]
+  const mapFrame = (frame: Record<string, unknown>): Record<string, unknown> => {
+    let text = JSON.stringify(frame)
+    for (const [captured, live] of uuidMap) {
+      text = text.replaceAll(captured, live)
+    }
+    if (capturedSessionId) {
+      text = text.replaceAll(capturedSessionId, PROVIDER_SESSION_ID)
+    }
+    const mapped: unknown = JSON.parse(text)
+    if (!isRecord(mapped)) {
+      throw new Error('mapped frame is not a record')
+    }
+    return mapped
+  }
+  const resultMemberships: string[][] = []
+  let startedAwaited = false
+  for (const event of capture) {
+    nowMs = 1_700_000_200_000 + event.at
+    if (event.kind === 'dispatch') {
+      if (!startedAwaited) {
+        // The proof frames have been delivered by now; startup can settle.
+        await adapter.awaitStarted('session-1')
+        startedAwaited = true
+      }
+      const body: AgentJournalMessageItem = {
+        kind: 'message',
+        role: 'user',
+        blocks: [{ type: 'text', text: event.text }]
+      }
+      const before = new Set(uuidMap.values())
+      const outcome = await adapter.dispatch({
+        sessionId: 'session-1',
+        clientMessageId: event.clientMessageId,
+        body,
+        requestedAt: nowMs,
+        fence: 7
+      })
+      expect(outcome).toEqual({ state: 'admitted' })
+      const sent = claude.connections[0]!.sent.at(-1)?.uuid
+      if (typeof sent !== 'string' || before.has(sent)) {
+        throw new Error('replay could not read the dispatched uuid')
+      }
+      uuidMap.set(event.sentUuid, sent)
+    } else if (event.kind === 'frame') {
+      const frame = mapFrame(event.frame)
+      if (frame.type === 'result') {
+        const members = Array.isArray(frame.user_message_uuids) ? frame.user_message_uuids : []
+        resultMemberships.push(members.filter((m): m is string => typeof m === 'string'))
+      }
+      claude.connections[0]!.handlers.onMessage?.(frame)
+    }
+  }
+  const settledUuids = new Map<string, string>()
+  for (const [outcome] of settled.mock.calls) {
+    if ('providerIdentity' in outcome && outcome.providerIdentity.provider === 'claude') {
+      settledUuids.set(outcome.clientMessageId, outcome.providerIdentity.uuid)
+    }
+  }
+  const liveUuidByClient = new Map<string, string>()
+  for (const event of capture) {
+    if (event.kind === 'dispatch') {
+      liveUuidByClient.set(event.clientMessageId, uuidMap.get(event.sentUuid)!)
+    }
+  }
+  return { settled, finalTurns, everInterrupted, resultMemberships, settledUuids, liveUuidByClient }
+}
+
+describe.each(['fold', 'early-steer', 'miss'])('adapter capture replay: %s', (name) => {
+  it('keeps turn membership equal to each result’s user_message_uuids', async () => {
+    const replay = await replayCapture(name)
+
+    // One turn per result, each opened by that result's first member, and no
+    // turn ever marked interrupted (no capture interrupts one).
+    expect([...replay.finalTurns.keys()]).toEqual(
+      replay.resultMemberships.map((members) => members[0])
+    )
+    expect(replay.everInterrupted).toBe(false)
+    for (const turn of replay.finalTurns.values()) {
+      expect(turn.state).toBe('completed')
+    }
+
+    // Every send settled accepted under a provider uuid named by exactly the
+    // result whose turn it belongs to — the provider's membership fact.
+    const allMembers = new Set(replay.resultMemberships.flat())
+    for (const [clientMessageId, liveUuid] of replay.liveUuidByClient) {
+      expect(replay.settledUuids.get(clientMessageId)).toBe(liveUuid)
+      expect(allMembers.has(liveUuid)).toBe(true)
+    }
+    for (const [index, members] of replay.resultMemberships.entries()) {
+      for (const member of members) {
+        // A member of result i must not have opened any OTHER turn.
+        const owner = [...replay.finalTurns.keys()].indexOf(member)
+        if (owner !== -1) {
+          expect(owner).toBe(index)
+        }
+      }
+    }
+  })
+})
diff --git a/src/main/claude/claude-agent-sdk-control-requests.test.ts b/src/main/claude/claude-agent-sdk-control-requests.test.ts
index f76650d8151..01e822063e2 100644
--- a/src/main/claude/claude-agent-sdk-control-requests.test.ts
+++ b/src/main/claude/claude-agent-sdk-control-requests.test.ts
@@ -24,3 +24,29 @@ describe('createClaudeControlSurface stopTask', () => {
     expect(stopTask).toHaveBeenCalledTimes(2)
   })
 })
+
+/** A query exposing only the cancel method, as the surface reads nothing else for it. */
+function queryWithCancel(cancelAsyncMessage?: (uuid: string) => Promise<unknown>): Query {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: cancelAsyncMessage reads only this member.
+  return (cancelAsyncMessage ? { cancelAsyncMessage } : {}) as unknown as Query
+}
+
+describe('createClaudeControlSurface cancelAsyncMessage', () => {
+  it('reports a withdrawal only when the CLI answers cancelled: true', async () => {
+    // An older CLI answers with an empty success, which carries no `cancelled`.
+    const cancelAsyncMessage = vi
+      .fn<(uuid: string) => Promise<unknown>>()
+      .mockResolvedValueOnce(true)
+      .mockResolvedValueOnce(false)
+      .mockResolvedValueOnce(undefined)
+    const controls = createClaudeControlSurface(queryWithCancel(cancelAsyncMessage))
+
+    await expect(controls.cancelAsyncMessage('queued-1')).resolves.toBe(true)
+    await expect(controls.cancelAsyncMessage('queued-2')).resolves.toBe(false)
+    await expect(controls.cancelAsyncMessage('queued-3')).resolves.toBe(false)
+    expect(cancelAsyncMessage.mock.calls).toEqual([['queued-1'], ['queued-2'], ['queued-3']])
+    await expect(
+      createClaudeControlSurface(queryWithCancel()).cancelAsyncMessage('queued-4')
+    ).resolves.toBe(false)
+  })
+})
diff --git a/src/main/claude/claude-agent-sdk-control-requests.ts b/src/main/claude/claude-agent-sdk-control-requests.ts
index f165822c937..d3313147102 100644
--- a/src/main/claude/claude-agent-sdk-control-requests.ts
+++ b/src/main/claude/claude-agent-sdk-control-requests.ts
@@ -94,7 +94,8 @@ export type ClaudeControlSurface = {
   interrupt: (
     options?: ClaudeControlOptions & { cancelQueued?: boolean }
   ) => Promise<SDKControlInterruptResponse | undefined>
-  cancelAsyncMessage: (uuid: string, options?: ClaudeControlOptions) => Promise<void>
+  /** True only when the CLI confirms it withdrew that message before it ran. */
+  cancelAsyncMessage: (uuid: string, options?: ClaudeControlOptions) => Promise<boolean>
   setModel: (model: string | undefined, options?: ClaudeControlOptions) => Promise<void>
   setPermissionMode: (mode: PermissionMode, options?: ClaudeControlOptions) => Promise<void>
   applyFlagSettings: (
@@ -131,9 +132,9 @@ export function createClaudeControlSurface(query: Query): ClaudeControlSurface {
       const cancel = claudeQueryAsyncCanceller(query)
       return cancel
         ? runClaudeControl('cancel_async_message', () => cancel(uuid), options?.timeoutMs).then(
-            () => {}
+            (cancelled) => cancelled === true
           )
-        : Promise.resolve()
+        : Promise.resolve(false)
     },
     setModel: (model, options) =>
       runClaudeControl('set_model', () => query.setModel(model), options?.timeoutMs).then(() => {}),
diff --git a/src/main/claude/claude-agent-sdk-exit-proof.test.ts b/src/main/claude/claude-agent-sdk-exit-proof.test.ts
index 3f15f8e8fca..f9412a10488 100644
--- a/src/main/claude/claude-agent-sdk-exit-proof.test.ts
+++ b/src/main/claude/claude-agent-sdk-exit-proof.test.ts
@@ -432,8 +432,8 @@ describe('claude child tree reaper', () => {
     const child = mockChild()
     // Reap #1 completed and saw a descendant alive at its deadline; the root then
     // left on its own and the re-verification on a loaded host could not read the
-    // table. "Could not look" must not erase "was seen alive": the lease release
-    // gate is exactly the pair this distinguishes.
+    // table. "Could not look" must not erase "was seen alive": the report never
+    // calls a survivor gone.
     const terminateDescendants = vi
       .fn()
       .mockResolvedValueOnce('live')
diff --git a/src/main/claude/claude-agent-sdk-exit-proof.ts b/src/main/claude/claude-agent-sdk-exit-proof.ts
index 17533f87a70..883bf8efd6a 100644
--- a/src/main/claude/claude-agent-sdk-exit-proof.ts
+++ b/src/main/claude/claude-agent-sdk-exit-proof.ts
@@ -26,7 +26,7 @@ import {
 /**
  * A later reap may only raise the latched verdict. An observed exit is final, and
  * a descendant seen alive at a deadline is never forgotten by a later look that
- * could not read the table: the lease gate discriminates on exactly that pair.
+ * could not read the table, so the report never calls a survivor gone.
  */
 const TREE_VERDICT_TRUST: Record<DescendantTreeVerdict, number> = {
   unverifiable: 0,
@@ -89,8 +89,8 @@ export type ClaudeChildTreeReaper = {
   reap(): Promise<DescendantTreeVerdict>
   /**
    * `unverifiable` until a reap observes otherwise. `exited` is the only verdict
-   * that lets a close release the lease; `live` names a descendant that was seen
-   * still running, which no later caller may collapse into "unknown".
+   * that proves a close; `live` names a descendant that was seen still running,
+   * which no later caller may collapse into "unknown".
    */
   readonly treeVerdict: DescendantTreeVerdict
 }
diff --git a/src/main/claude/claude-agent-sdk-import-boundary.test.ts b/src/main/claude/claude-agent-sdk-import-boundary.test.ts
index f1a38466d41..421e4a9c719 100644
--- a/src/main/claude/claude-agent-sdk-import-boundary.test.ts
+++ b/src/main/claude/claude-agent-sdk-import-boundary.test.ts
@@ -1,5 +1,4 @@
-import { existsSync, readFileSync, statSync } from 'node:fs'
-import { dirname, join, relative, resolve } from 'node:path'
+import { resolve } from 'node:path'
 import { describe, expect, it } from 'vitest'
 import { spawnProcess } from '../../shared/child-process/run-process'
 
@@ -9,115 +8,14 @@ import { spawnProcess } from '../../shared/child-process/run-process'
  * A user who never leaves the terminal/TUI Claude path must not pay for the SDK:
  * importing it evaluates a package that rewrites
  * `process.env.NoDefaultCurrentDirectoryInExePath`, changing how Windows resolves
- * executables for every later subprocess, and a missing or incompatible install
- * would take normal runtime startup down with it. The ordinary
- * `OrcaRuntimeService` graph reaches the Claude transport module, so only a
- * deferred import keeps that boundary — and only a walk of the real import graph
- * keeps the next static import from quietly restoring it.
+ * executables for every later subprocess. Loading the structured runtime must not
+ * trip that rewrite, which is only true while the SDK stays behind a deferred
+ * import inside the session path.
  */
 const SDK_PACKAGE = '@anthropic-ai/claude-agent-sdk'
 const REPO_ROOT = resolve(__dirname, '..', '..', '..')
 
-/** The Electron main entry: everything the app loads before any session exists. */
-const ROOT = 'src/main/index.ts'
-/** Proof the walk goes all the way into the Claude transport rather than stopping short. */
-const TRANSPORT_MODULE = 'src/main/claude/claude-stream-json-connection.ts'
-
-/**
- * Static, value-carrying specifiers only, read statement by statement so a
- * multi-line `import { ... } from '...'` counts. `import type` is erased before
- * the module ever loads and a bare `import(...)` is the deferral this guards, so
- * neither is an edge the runtime traverses at load time.
- */
-const STATEMENT_START = /^\s*(?:import|export)\b/
-const TYPE_ONLY = /^\s*(?:import|export)\s+type\b/
-const FROM_SPECIFIER = /(?:^|\s)from\s*['"]([^'"]+)['"]/
-const SIDE_EFFECT_IMPORT = /^\s*import\s*['"]([^'"]+)['"]/
-/** An import statement never spans more lines than its longest specifier list. */
-const MAX_STATEMENT_LINES = 60
-
-function readSpecifiers(source: string): string[] {
-  const lines = source.split('\n')
-  const found: string[] = []
-  for (let index = 0; index < lines.length; index += 1) {
-    const first = lines[index] as string
-    if (!STATEMENT_START.test(first) || TYPE_ONLY.test(first)) {
-      continue
-    }
-    const sideEffect = SIDE_EFFECT_IMPORT.exec(first)
-    if (sideEffect) {
-      found.push(sideEffect[1] as string)
-      continue
-    }
-    for (let scan = index; scan < Math.min(lines.length, index + MAX_STATEMENT_LINES); scan += 1) {
-      if (scan > index && STATEMENT_START.test(lines[scan] as string)) {
-        break
-      }
-      const specifier = FROM_SPECIFIER.exec(lines[scan] as string)
-      if (specifier) {
-        found.push(specifier[1] as string)
-        break
-      }
-    }
-  }
-  return found
-}
-
-/** Resolve a relative specifier the way the bundler does; unresolvable means not a module. */
-function resolveRelative(fromFile: string, specifier: string): string | null {
-  const base = join(dirname(fromFile), specifier)
-  for (const candidate of [base, `${base}.ts`, `${base}.tsx`, join(base, 'index.ts')]) {
-    if (existsSync(candidate) && statSync(candidate).isFile()) {
-      return candidate
-    }
-  }
-  return null
-}
-
-function walkStaticImports(rootFile: string): { visited: Set<string>; sdkImporters: string[] } {
-  const visited = new Set<string>()
-  const sdkImporters: string[] = []
-  const queue = [resolve(REPO_ROOT, rootFile)]
-  while (queue.length > 0) {
-    const file = queue.pop() as string
-    const key = relative(REPO_ROOT, file).split('\\').join('/')
-    if (visited.has(key)) {
-      continue
-    }
-    visited.add(key)
-    for (const specifier of readSpecifiers(readFileSync(file, 'utf8'))) {
-      if (specifier === SDK_PACKAGE || specifier.startsWith(`${SDK_PACKAGE}/`)) {
-        sdkImporters.push(key)
-        continue
-      }
-      if (!specifier.startsWith('.')) {
-        continue
-      }
-      const target = resolveRelative(file, specifier)
-      if (target) {
-        queue.push(target)
-      }
-    }
-  }
-  return { visited, sdkImporters }
-}
-
 describe('claude agent SDK import boundary', () => {
-  const walk = walkStaticImports(ROOT)
-
-  it('walks a graph deep enough to reach the Claude transport', () => {
-    // Without this the guard passes for the wrong reason the moment the walk breaks.
-    expect(walk.visited.size).toBeGreaterThan(500)
-    expect([...walk.visited]).toContain(TRANSPORT_MODULE)
-  })
-
-  it('never reaches the SDK through a static import from the main entry', () => {
-    expect(
-      walk.sdkImporters,
-      `${SDK_PACKAGE} must stay behind the structured-Claude boundary. Load it with a deferred import inside the session path instead.`
-    ).toEqual([])
-  })
-
   it('leaves the Windows executable-search environment alone when the runtime loads', async () => {
     // A vitest file runs in its own fork, so this is a clean process; the ambient
     // value is cleared first because the developer's own shell may carry one.
diff --git a/src/main/claude/claude-agent-sdk-process-spawn.test.ts b/src/main/claude/claude-agent-sdk-process-spawn.test.ts
index cd3520cf6d5..1b6c192d433 100644
--- a/src/main/claude/claude-agent-sdk-process-spawn.test.ts
+++ b/src/main/claude/claude-agent-sdk-process-spawn.test.ts
@@ -4,14 +4,22 @@ import { describe, expect, it, vi } from 'vitest'
 import type { SpawnOptions as SdkSpawnOptions } from '@anthropic-ai/claude-agent-sdk'
 import { resolveSpawn, type spawnProcess } from '../../shared/child-process/run-process'
 import type { ProcessSpec } from '../../shared/child-process/process-spec'
+import type * as ProviderSupervisor from '../codex/codex-app-server-posix-supervisor'
+import { createProviderSpawnSpec } from '../codex/codex-app-server-posix-supervisor'
 import { createClaudeCodeProcessSpawn } from './claude-agent-sdk-process-spawn'
+import { proveClaudeChildExitWithReaper } from './claude-child-exit-proof-ladder'
+
+vi.mock('../codex/codex-app-server-posix-supervisor', async (importOriginal) => {
+  const actual = await importOriginal<typeof ProviderSupervisor>()
+  return { ...actual, createProviderSpawnSpec: vi.fn(actual.createProviderSpawnSpec) }
+})
 
 type FakeChild = EventEmitter & {
   pid: number
   stdin: PassThrough
   stdout: PassThrough
   stderr: PassThrough
-  kill: ReturnType<typeof vi.fn>
+  kill: ReturnType<typeof vi.fn<(signal?: NodeJS.Signals | number) => boolean>>
 }
 
 function fakeSpawn() {
@@ -20,7 +28,7 @@ function fakeSpawn() {
   child.stdin = new PassThrough()
   child.stdout = new PassThrough()
   child.stderr = new PassThrough()
-  child.kill = vi.fn(() => true)
+  child.kill = vi.fn((_signal?: NodeJS.Signals | number) => true)
   const specs: ProcessSpec[] = []
   const spawnImpl = ((spec: ProcessSpec) => {
     specs.push(spec)
@@ -43,7 +51,7 @@ function sdkOptions(overrides: Partial<SdkSpawnOptions> = {}): SdkSpawnOptions {
 describe('claude agent SDK process spawn', () => {
   it('routes the SDK spawn through Orca and retains the pid the lease adjudicates on', () => {
     const process = fakeSpawn()
-    const spawn = createClaudeCodeProcessSpawn(process.spawnImpl)
+    const spawn = createClaudeCodeProcessSpawn(process.spawnImpl, 'win32')
 
     expect(spawn.pid).toBeUndefined()
     expect(spawn.child).toBeNull()
@@ -52,15 +60,103 @@ describe('claude agent SDK process spawn', () => {
     expect(child).toBe(process.child)
     expect(spawn.child).toBe(process.child)
     expect(spawn.pid).toBe(4321)
+    // Windows has no supervisor: Claude itself is the child.
+    expect(spawn.supervised).toBe(false)
     expect(process.specs[0]).toEqual({
       program: '/usr/local/bin/claude',
       args: ['--output-format', 'stream-json'],
       cwd: '/work/repo',
       env: { PATH: '/usr/bin', CLAUDE_CONFIG_DIR: '/accounts/one' },
+      detached: false,
       stdio: ['pipe', 'pipe', 'pipe']
     })
   })
 
+  it.each(['darwin', 'linux'] as const)(
+    'starts Claude under the provider supervisor on %s, which is then the pid the lease records',
+    (platform) => {
+      const process = fakeSpawn()
+      const spawn = createClaudeCodeProcessSpawn(process.spawnImpl, platform)
+      spawn.spawn(sdkOptions())
+
+      const [spec] = process.specs
+      if (!spec) {
+        throw new Error('the spawner never built a spec')
+      }
+      expect(spawn.supervised).toBe(true)
+      expect(spawn.pid).toBe(4321)
+      expect(spec.program).toBe(globalThis.process.execPath)
+      expect(spec.args?.[0]).toBe('-e')
+      expect(spec.detached).toBe(true)
+      expect(spec.cwd).toBe('/work/repo')
+      const supervisorSpec = JSON.parse(
+        Buffer.from(String(spec.env?.ORCA_PROVIDER_SUPERVISOR_SPEC), 'base64').toString()
+      )
+      expect(supervisorSpec).toMatchObject({
+        command: '/usr/local/bin/claude',
+        args: ['--output-format', 'stream-json'],
+        cwd: '/work/repo',
+        ownerPid: globalThis.process.pid
+      })
+      // The supervisor passes its env to Claude minus its own two keys.
+      expect(spec.env).toMatchObject({ PATH: '/usr/bin', CLAUDE_CONFIG_DIR: '/accounts/one' })
+    }
+  )
+
+  it.each([
+    { platform: 'darwin', specSupervised: false },
+    { platform: 'win32', specSupervised: true }
+  ] as const)(
+    'stops Claude by the spawn spec\u2019s supervision on $platform, never the platform',
+    async ({ platform, specSupervised }) => {
+      const actual = await vi.importActual<typeof ProviderSupervisor>(
+        '../codex/codex-app-server-posix-supervisor'
+      )
+      vi.mocked(createProviderSpawnSpec).mockImplementationOnce((...args) => ({
+        ...actual.createProviderSpawnSpec(...args),
+        supervised: specSupervised
+      }))
+      const process = fakeSpawn()
+      const spawn = createClaudeCodeProcessSpawn(process.spawnImpl, platform)
+      spawn.spawn(sdkOptions())
+      expect(spawn.supervised).toBe(specSupervised)
+
+      let exited = false
+      let settle = (): void => {}
+      const exitPromise = new Promise<void>((resolve) => {
+        settle = resolve
+      })
+      // Claude leaves shortly after stdin ends, so the ladder never needs its forced rung.
+      process.child.stdin.on('finish', () =>
+        setTimeout(() => {
+          exited = true
+          settle()
+        }, 10)
+      )
+      const tree = {
+        capture: vi.fn(async () => {}),
+        reap: vi.fn(async () => 'exited' as const),
+        treeVerdict: 'exited' as const
+      }
+      await proveClaudeChildExitWithReaper(
+        {
+          child: process.child,
+          exitPromise,
+          exited: () => exited,
+          tree,
+          supervised: spawn.supervised
+        },
+        () => tree
+      )
+      // SIGTERM to an unsupervised Claude on Windows is TerminateProcess; a skipped one leaves it running.
+      if (specSupervised) {
+        expect(process.child.kill).toHaveBeenCalledWith('SIGTERM')
+      } else {
+        expect(process.child.kill).not.toHaveBeenCalled()
+      }
+    }
+  )
+
   it('keeps the child out of the SDK abort path so exit proof stays Orca-owned', () => {
     const process = fakeSpawn()
     const controller = new AbortController()
@@ -86,7 +182,7 @@ describe('claude agent SDK process spawn', () => {
 
   it('hands a Windows .cmd shim to Orca\u2019s argument encoder', () => {
     const process = fakeSpawn()
-    createClaudeCodeProcessSpawn(process.spawnImpl).spawn(
+    createClaudeCodeProcessSpawn(process.spawnImpl, 'win32').spawn(
       sdkOptions({
         command: 'C:\\Users\\dev\\AppData\\npm\\claude.cmd',
         args: ['--setting-sources=user,project,local', '--session-id', 'a b&c']
diff --git a/src/main/claude/claude-agent-sdk-process-spawn.ts b/src/main/claude/claude-agent-sdk-process-spawn.ts
index a2b1ad7f158..bbb4b295aad 100644
--- a/src/main/claude/claude-agent-sdk-process-spawn.ts
+++ b/src/main/claude/claude-agent-sdk-process-spawn.ts
@@ -1,5 +1,6 @@
 import type { SpawnOptions as ClaudeAgentSdkSpawnOptions } from '@anthropic-ai/claude-agent-sdk'
 import { spawnProcess } from '../../shared/child-process/run-process'
+import { createProviderSpawnSpec } from '../codex/codex-app-server-posix-supervisor'
 
 /** Derived rather than imported: only src/shared/child-process may name node:child_process. */
 type ClaudeCodeChild = ReturnType<typeof spawnProcess>
@@ -11,8 +12,13 @@ export type ClaudeCodeProcessSpawn = {
   spawn: (options: ClaudeAgentSdkSpawnOptions) => ClaudeCodeChild
   /** The retained child, so Orca keeps its own tree-kill and exit-proof ladder. Null until the SDK spawns. */
   readonly child: ClaudeCodeChild | null
-  /** Ownership proof: the durable lease adjudicates on this pid plus start time plus the spawn token. */
+  /**
+   * Ownership proof: the durable lease adjudicates on this pid plus start time plus the spawn
+   * token. On POSIX it is the provider supervisor's, which outlives Claude by construction.
+   */
   readonly pid: number | undefined
+  /** The spawn spec's verdict, so the close ladder never re-decides it. False until the SDK spawns. */
+  readonly supervised: boolean
   readonly stderrTail: string
 }
 
@@ -31,24 +37,41 @@ function definedEnv(env: Record<string, string | undefined>): Record<string, str
  *
  * Two independent reasons: the SDK's `SpawnedProcess` has no pid, and Orca's
  * spawner is the only path that encodes `.cmd` arguments safely on Windows.
+ *
+ * On POSIX Claude runs under the provider supervisor, so an Orca that dies stops
+ * it instead of leaving it to finish its turn, tools and edits included, with
+ * nobody watching. Windows has no supervisor and spawns Claude directly.
  */
 export function createClaudeCodeProcessSpawn(
-  spawnImpl: typeof spawnProcess = spawnProcess
+  spawnImpl: typeof spawnProcess = spawnProcess,
+  platform: NodeJS.Platform = process.platform
 ): ClaudeCodeProcessSpawn {
   let child: ClaudeCodeChild | null = null
   let stderrTail = ''
+  let supervised = false
   return {
     spawn: (options) => {
+      const spec = createProviderSpawnSpec(
+        {
+          command: options.command,
+          args: [...options.args],
+          ...(options.cwd === undefined ? {} : { cwd: options.cwd })
+        },
+        definedEnv(options.env),
+        platform
+      )
       // Why `options.signal` is dropped: it would let the SDK kill the child outside
       // Orca's ladder, and close() may never report an exit it did not observe.
       const spawned = spawnImpl({
-        program: options.command,
-        args: [...options.args],
-        ...(options.cwd === undefined ? {} : { cwd: options.cwd }),
-        env: definedEnv(options.env),
+        program: spec.program,
+        args: spec.args,
+        cwd: spec.cwd,
+        env: spec.env,
+        detached: spec.detached,
         stdio: ['pipe', 'pipe', 'pipe']
       })
       child = spawned
+      supervised = spec.supervised
       // The SDK drains stderr only for its own local spawn, so a custom spawner must:
       // otherwise the child blocks on a full pipe and exit errors lose their tail.
       spawned.stderr.setEncoding('utf8').on('data', (chunk: string) => {
@@ -62,6 +85,9 @@ export function createClaudeCodeProcessSpawn(
     get pid() {
       return child?.pid
     },
+    get supervised() {
+      return supervised
+    },
     get stderrTail() {
       return stderrTail
     }
diff --git a/src/main/claude/claude-api-retry-idle-sweep.test.ts b/src/main/claude/claude-api-retry-idle-sweep.test.ts
new file mode 100644
index 00000000000..fc5d234ec87
--- /dev/null
+++ b/src/main/claude/claude-api-retry-idle-sweep.test.ts
@@ -0,0 +1,132 @@
+// A Claude that keeps retrying a refused request is working, so the idle sweep must not stop it.
+// Every retry frame's publish is the activity the sweep reads, even though a run writes one row.
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+import { AgentSessionRecordStore } from '../runtime/agent-session-record-store'
+import type { StructuredAgentSessionAdapter } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { StructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-host'
+import { STRUCTURED_AGENT_SESSION_IDLE_MS } from '../native-chat/agent-session-wire/structured-agent-session-idle-sweep'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  resetHostTestOperationIds
+} from '../native-chat/agent-session-wire/structured-agent-session-host-test-data'
+import { createClaudeJournalTranslator } from './claude-structured-journal-translation'
+
+const SWEEP_MS = 5
+const RETRY_GAP_MS = 10 * 60_000
+
+let root: string
+let host: StructuredAgentSessionHost
+let sink: StructuredAgentSessionEventSink | null
+let closeSession: Mock<NonNullable<StructuredAgentSessionAdapter['closeSession']>>
+let clock: number
+
+function apiRetry(attempt: number): Record<string, unknown> {
+  return {
+    type: 'system',
+    subtype: 'api_retry',
+    attempt,
+    max_retries: 10,
+    retry_delay_ms: 600_000,
+    error_status: 429,
+    error: 'rate_limit',
+    session_id: 'provider-1',
+    uuid: `9b2f6a1e-0c4d-4e7a-8f3b-00000000000${attempt}`
+  }
+}
+
+/** Long enough for many sweep ticks, so "still open" means the sweep declined. */
+function waitOutSeveralSweeps(): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, SWEEP_MS * 20))
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-claude-retry-sweep-'))
+  resetHostTestOperationIds()
+  sink = null
+  clock = NOW
+  closeSession = vi.fn(async () => true)
+  const store = await AgentSessionRecordStore.open({
+    directory: join(root, 'store'),
+    hostId: 'local'
+  })
+  const adapter: StructuredAgentSessionAdapter = {
+    acquire: async ({ fence, spawnToken, events }) => {
+      sink = events ?? null
+      return {
+        process: { hostId: 'local', pid: 4242, processStartTimeMs: NOW - 1_000, spawnToken },
+        acquisitionGeneration: 'generation-1',
+        link: {
+          linkId: `link-${fence}`,
+          handle: { provider: 'codex', threadId: THREAD },
+          origin: 'created',
+          mintedAtFence: fence,
+          observedAt: NOW
+        }
+      }
+    },
+    closeSession,
+    releaseAcquisition: async () => true,
+    dispatch: async () => ({ state: 'admitted' }),
+    cancelTurn: async () => ({ cancelled: false }),
+    answerPrompt: async () => undefined,
+    setOption: async () => undefined
+  }
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter,
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-1',
+    idleSweep: { intervalMs: SWEEP_MS, idleMs: STRUCTURED_AGENT_SESSION_IDLE_MS },
+    now: () => clock
+  })
+})
+
+afterEach(async () => {
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('a Claude retrying a refused request', () => {
+  it('keeps the conversation open past the idle window while retry frames arrive', async () => {
+    expect(await host.attach({ callerKey: 'client-1' }, hostTestAttachParams(null))).toMatchObject({
+      ok: true
+    })
+    if (!sink) {
+      throw new Error('the host never handed the provider its event sink')
+    }
+    const translator = createClaudeJournalTranslator({ sink, fallbackIdPrefix: '1' })
+
+    // Five frames ten minutes apart: fifty minutes, well past the thirty-minute idle window.
+    for (let attempt = 1; attempt <= 5; attempt += 1) {
+      clock += RETRY_GAP_MS
+      translator.handle({ type: 'message', sessionId: SESSION, message: apiRetry(attempt) })
+      await waitOutSeveralSweeps()
+      expect(closeSession).not.toHaveBeenCalled()
+      expect(host.hasSession(SESSION)).toBe(true)
+    }
+
+    const items = host['sessions'].get(SESSION)?.journal.snapshot().items ?? []
+    const retryRows = items.filter(
+      (item) => item.body.kind === 'status' && item.body.failure?.kind === 'providerRetrying'
+    )
+    expect(retryRows).toHaveLength(1)
+    expect(retryRows[0]?.body).toMatchObject({
+      failure: { detail: { text: expect.stringContaining('"attempt":5') } }
+    })
+
+    // Once the frames stop, the same clock does let the sweep close it.
+    clock += STRUCTURED_AGENT_SESSION_IDLE_MS
+    await vi.waitFor(() => {
+      expect(closeSession).toHaveBeenCalledWith(SESSION)
+      expect(host.hasSession(SESSION)).toBe(false)
+    })
+  })
+})
diff --git a/src/main/claude/claude-api-retry-row.test.ts b/src/main/claude/claude-api-retry-row.test.ts
new file mode 100644
index 00000000000..becadff90d3
--- /dev/null
+++ b/src/main/claude/claude-api-retry-row.test.ts
@@ -0,0 +1,133 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentSessionJournalIdentity
+} from '../../shared/agent-session-journal-types'
+import { MAX_PROVIDER_DIAGNOSTIC_CHARS } from '../../shared/agent-session-failure'
+import { openAgentSessionJournal } from '../native-chat/agent-session-journal/journal-store-factory'
+import { createDeferredStructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { unhandledProviderFrameJournalItem } from '../native-chat/agent-session-wire/unhandled-provider-frame'
+import { createClaudeJournalTranslator } from './claude-structured-journal-translation'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: 'session-1',
+  workspaceId: 'workspace-1',
+  hostId: 'host-1',
+  agent: 'claude',
+  providerHandle: { kind: 'claude', sessionId: 'provider-1', leafUuid: 'leaf-1' }
+}
+
+/** A frame as Claude Code sends it while it retries a refused request. */
+function apiRetry(attempt: number, fields: Record<string, unknown> = {}): Record<string, unknown> {
+  return {
+    type: 'system',
+    subtype: 'api_retry',
+    attempt,
+    max_retries: 10,
+    retry_delay_ms: 622,
+    error_status: 429,
+    error: 'rate_limit',
+    session_id: 'provider-1',
+    uuid: `9b2f6a1e-0c4d-4e7a-8f3b-00000000000${attempt}`,
+    ...fields
+  }
+}
+
+let root = ''
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-claude-api-retry-'))
+})
+
+afterEach(async () => {
+  await rm(root, { recursive: true, force: true })
+})
+
+async function statusRowsFor(frames: Record<string, unknown>[]) {
+  const journal = await openAgentSessionJournal({
+    identity: IDENTITY,
+    journalDir: root,
+    now: () => 1_700_000_000_000,
+    mintEpoch: () => 'epoch-1'
+  })
+  const deferred = createDeferredStructuredAgentSessionEventSink()
+  deferred.bind({ journal, fence: 1, publish: vi.fn() })
+  const translator = createClaudeJournalTranslator({ sink: deferred.sink, fallbackIdPrefix: '1' })
+  for (const frame of frames) {
+    translator.handle({ type: 'message', sessionId: 'orca-session', message: frame })
+    await deferred.drained()
+  }
+  return journal
+    .snapshot()
+    .items.flatMap((item): Extract<AgentJournalItemBody, { kind: 'status' }>[] =>
+      item.body.kind === 'status' ? [item.body] : []
+    )
+}
+
+describe('a Claude api_retry frame', () => {
+  it('writes one sentence row per retry run, revised by each attempt, not the frame', async () => {
+    const rows = await statusRowsFor([apiRetry(1), apiRetry(2), apiRetry(3)])
+
+    expect(rows).toHaveLength(1)
+    const [row] = rows
+    expect(row).toMatchObject({
+      text: 'Claude is rate-limited and retrying.',
+      tone: 'warning',
+      failure: {
+        kind: 'providerRetrying',
+        retry: { error: 'rate_limit', status: 429 },
+        detail: { audience: 'log' }
+      }
+    })
+    expect(row).not.toHaveProperty('providerFrame')
+    // The latest attempt's frame, as the log detail.
+    expect(row.failure?.detail?.text).toContain('"attempt":3')
+  })
+
+  it('starts a new row when a later run starts over', async () => {
+    const rows = await statusRowsFor([apiRetry(1), apiRetry(2), apiRetry(1)])
+    expect(rows.map((row) => row.text)).toEqual([
+      'Claude is rate-limited and retrying.',
+      'Claude is rate-limited and retrying.'
+    ])
+  })
+
+  it('does not call a retry a rate limit unless the frame says so', async () => {
+    const rows = await statusRowsFor([
+      apiRetry(1, { error: 'overloaded', error_status: 529 }),
+      apiRetry(1, { error: 'server_error', error_status: 500 }),
+      apiRetry(1, { error: undefined, error_status: undefined }),
+      apiRetry(1, { error: 'something_new', error_status: 429 })
+    ])
+    expect(rows.map((row) => row.text)).toEqual([
+      'Claude hit a temporary problem and is retrying.',
+      'Claude hit a temporary problem and is retrying.',
+      'Claude hit a temporary problem and is retrying.',
+      'Claude is rate-limited and retrying.'
+    ])
+    expect(rows[0]?.failure).toMatchObject({ retry: { error: 'overloaded', status: 529 } })
+  })
+
+  it('caps the frame it keeps as the detail', async () => {
+    const [row] = await statusRowsFor([apiRetry(1, { padding: 'x'.repeat(5_000) })])
+    expect(row?.failure?.detail?.text.length).toBe(MAX_PROVIDER_DIAGNOSTIC_CHARS)
+  })
+
+  it('leaves a frame kind no one catalogued to the provider fallback, as before', async () => {
+    const unknown = {
+      type: 'system',
+      subtype: 'future_notice',
+      error: 'rate_limit',
+      session_id: 'provider-1',
+      uuid: 'future-1'
+    }
+    const rows = await statusRowsFor([unknown])
+    expect(rows).toEqual([
+      unhandledProviderFrameJournalItem('claude', 'message:system:future_notice', unknown)?.body
+    ])
+    expect(rows[0]).toMatchObject({ text: 'rate_limit', tone: 'error' })
+  })
+})
diff --git a/src/main/claude/claude-api-retry-row.ts b/src/main/claude/claude-api-retry-row.ts
new file mode 100644
index 00000000000..195e30461a7
--- /dev/null
+++ b/src/main/claude/claude-api-retry-row.ts
@@ -0,0 +1,39 @@
+// The one row a Claude `system/api_retry` frame writes: a sentence and a `providerRetrying` fact,
+// revised in place for every attempt of the same retry run.
+
+import {
+  agentSessionFailureFact,
+  providerDiagnostic,
+  readProviderRetry
+} from '../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../shared/agent-session-failure-words'
+import type { AgentJournalStatusItem } from '../../shared/agent-session-journal-types'
+import { TUI_AGENT_DISPLAY_NAMES } from '../../shared/tui-agent-display-names'
+
+export const CLAUDE_API_RETRY_FRAME_KIND = 'message:system:api_retry'
+
+export function claudeApiRetryRowBody(message: Record<string, unknown>): AgentJournalStatusItem {
+  const retry = readProviderRetry({ error: message.error, status: message.error_status })
+  const words = agentSessionFailureWords(
+    agentSessionFailureFact('providerRetrying', {
+      detail: providerDiagnostic(JSON.stringify(message), 'log'),
+      ...(retry ? { retry } : {})
+    }),
+    { surface: 'row', agentName: TUI_AGENT_DISPLAY_NAMES.claude }
+  )
+  return { kind: 'status', tone: 'warning', ...words }
+}
+
+/** Numbers retry runs: a frame whose attempt does not follow the last one starts a new run. */
+export function createClaudeApiRetryRuns(): (message: Record<string, unknown>) => number {
+  let run = 0
+  let lastAttempt: number | null = null
+  return (message) => {
+    const attempt = typeof message.attempt === 'number' ? message.attempt : null
+    if (attempt === null || lastAttempt === null || attempt <= lastAttempt) {
+      run += 1
+    }
+    lastAttempt = attempt
+    return run
+  }
+}
diff --git a/src/main/claude/claude-background-task-row-journal.test.ts b/src/main/claude/claude-background-task-row-journal.test.ts
index ecd23480605..736583d0324 100644
--- a/src/main/claude/claude-background-task-row-journal.test.ts
+++ b/src/main/claude/claude-background-task-row-journal.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../shared/agent-session-journal-types'
 import { describe, expect, it, vi } from 'vitest'
 import type {
   StructuredAgentSessionEventSink,
@@ -94,12 +95,16 @@ describe('Claude background task row journal', () => {
     }
     const resolver = new ClaudeBackgroundTaskIdentityResolver()
 
-    expect(writeClaudeBackgroundTaskRow(sink, resolver, 'task-1', task)).toEqual({
+    expect(
+      writeClaudeBackgroundTaskRow(sink, resolver, 'task-1', task, () => AGENT_JOURNAL_THREAD_SCOPE)
+    ).toEqual({
       accepted: false,
       reason: 'backpressure'
     })
     expect(task.lastSerialized).toBeNull()
-    expect(writeClaudeBackgroundTaskRow(sink, resolver, 'task-1', task)).toEqual({
+    expect(
+      writeClaudeBackgroundTaskRow(sink, resolver, 'task-1', task, () => AGENT_JOURNAL_THREAD_SCOPE)
+    ).toEqual({
       accepted: true
     })
     expect(task.lastSerialized).not.toBeNull()
@@ -130,7 +135,13 @@ describe('Claude background task row journal', () => {
     }
 
     expect(
-      writeClaudeBackgroundTaskRow(sink, new ClaudeBackgroundTaskIdentityResolver(), 'task-1', task)
+      writeClaudeBackgroundTaskRow(
+        sink,
+        new ClaudeBackgroundTaskIdentityResolver(),
+        'task-1',
+        task,
+        () => AGENT_JOURNAL_THREAD_SCOPE
+      )
     ).toEqual({ accepted: true })
     expect(calls).toEqual([
       {
@@ -153,7 +164,8 @@ describe('Claude background task row journal', () => {
         publish: vi.fn(),
         tryAppendResolvedItemAndPublish: appendAndPublish
       },
-      isForwardedParentTool: () => true
+      isForwardedParentTool: () => true,
+      turnScope: () => AGENT_JOURNAL_THREAD_SCOPE
     })
 
     rows.observe(START_BASH)
@@ -175,7 +187,8 @@ describe('Claude background task row journal', () => {
         publish: vi.fn(),
         tryAppendResolvedItemAndPublish: appendAndPublish
       },
-      isForwardedParentTool: () => true
+      isForwardedParentTool: () => true,
+      turnScope: () => AGENT_JOURNAL_THREAD_SCOPE
     })
 
     rows.observe({
@@ -203,7 +216,8 @@ describe('Claude background task row journal', () => {
         publish: vi.fn(),
         tryAppendResolvedItemAndPublish: appendAndPublish
       },
-      isForwardedParentTool: () => true
+      isForwardedParentTool: () => true,
+      turnScope: () => AGENT_JOURNAL_THREAD_SCOPE
     })
 
     expect(rows.observe(START_BASH)).toBe(true)
@@ -227,7 +241,8 @@ describe('Claude background task row journal', () => {
         tryAppendResolvedItemAndPublish: appendAndPublish
       },
       isForwardedParentTool: () => true,
-      onPersistenceFailure
+      onPersistenceFailure,
+      turnScope: () => AGENT_JOURNAL_THREAD_SCOPE
     })
 
     rows.observe(START_BASH)
@@ -249,7 +264,8 @@ describe('Claude background task row journal', () => {
         }))
       },
       isForwardedParentTool: () => true,
-      onPersistenceFailure
+      onPersistenceFailure,
+      turnScope: () => AGENT_JOURNAL_THREAD_SCOPE
     })
 
     for (let index = 0; index < 512; index += 1) {
@@ -287,7 +303,13 @@ describe('Claude background task row journal', () => {
     }
 
     expect(
-      writeClaudeBackgroundTaskRow(sink, new ClaudeBackgroundTaskIdentityResolver(), 'task-1', task)
+      writeClaudeBackgroundTaskRow(
+        sink,
+        new ClaudeBackgroundTaskIdentityResolver(),
+        'task-1',
+        task,
+        () => AGENT_JOURNAL_THREAD_SCOPE
+      )
     ).toEqual({ accepted: false, reason })
     expect(task.lastSerialized).toBeNull()
   })
diff --git a/src/main/claude/claude-background-task-row-journal.ts b/src/main/claude/claude-background-task-row-journal.ts
index a4779898204..956bc770f74 100644
--- a/src/main/claude/claude-background-task-row-journal.ts
+++ b/src/main/claude/claude-background-task-row-journal.ts
@@ -1,6 +1,7 @@
 import type {
   AgentJournalItemBody,
-  AgentJournalItemIdentity
+  AgentJournalItemIdentity,
+  AgentJournalTurnScope
 } from '../../shared/agent-session-journal-types'
 import { backgroundTaskFallbackText } from '../../shared/native-chat-background-task-row'
 import {
@@ -141,6 +142,8 @@ export function writeClaudeBackgroundTaskRow(
   identities: ClaudeBackgroundTaskIdentityResolver,
   id: string,
   row: ClaudeBackgroundTaskRow,
+  /** The turn the row belongs to, read once `beforeAppend` has opened it. */
+  turnScope: () => AgentJournalTurnScope,
   /** Runs before admission to preserve turn-before-row ordering; duplicate
    *  delivery skips it, and a retry reuses the turn the first attempt opened. */
   beforeAppend?: () => void,
@@ -157,7 +160,11 @@ export function writeClaudeBackgroundTaskRow(
   // recreated. Keep unresolved writes from distinct provider runs queued side
   // by using the provider's parent tool identity as the coalescing discriminator.
   const coalescingKey = JSON.stringify(['claude-background-task', id, row.toolUseId ?? null])
-  const appendOptions = { coalescingKey, ...(lifecycle ? { lifecycle: true } : {}) }
+  const appendOptions = {
+    coalescingKey,
+    turnScope: turnScope(),
+    ...(lifecycle ? { lifecycle: true } : {})
+  }
   const publishOptions = lifecycle ? { lifecycle: true } : {}
   const resolveIdentity = (journal: StructuredAgentSessionLifecycleJournal) =>
     identities.resolve(journal, id, row.toolUseId)
diff --git a/src/main/claude/claude-background-task-row-test-support.ts b/src/main/claude/claude-background-task-row-test-support.ts
index 450f4ebe292..af03378331b 100644
--- a/src/main/claude/claude-background-task-row-test-support.ts
+++ b/src/main/claude/claude-background-task-row-test-support.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../shared/agent-session-journal-types'
 // Shared fixtures and the sink harness the background-task row suites drive.
 //
 // Moved out of claude-background-task-rows.test.ts verbatim when that suite
@@ -85,7 +86,8 @@ export function harness(
     sink,
     isForwardedParentTool: (toolUseId) => forwardedTools.has(toolUseId),
     openOutputTurn: () => turnOpens.push(1),
-    now: () => (clock += 10)
+    now: () => (clock += 10),
+    turnScope: () => AGENT_JOURNAL_THREAD_SCOPE
   })
   const keys = (): string[] =>
     items.map((item) =>
diff --git a/src/main/claude/claude-background-task-row-writer.ts b/src/main/claude/claude-background-task-row-writer.ts
index bb973a1ae70..0415503b9c2 100644
--- a/src/main/claude/claude-background-task-row-writer.ts
+++ b/src/main/claude/claude-background-task-row-writer.ts
@@ -1,3 +1,4 @@
+import type { AgentJournalTurnScope } from '../../shared/agent-session-journal-types'
 import type {
   StructuredAgentSessionEventSink,
   StructuredAgentSessionSinkAdmission
@@ -19,6 +20,7 @@ export class ClaudeBackgroundTaskRowWriter {
 
   constructor(
     private readonly sink: StructuredAgentSessionEventSink,
+    private readonly turnScope: () => AgentJournalTurnScope,
     private readonly onPersistenceFailure?: (error: Error) => void
   ) {}
 
@@ -33,6 +35,7 @@ export class ClaudeBackgroundTaskRowWriter {
       this.identities,
       id,
       row,
+      this.turnScope,
       beforeAppend,
       lifecycle
     )
@@ -61,6 +64,7 @@ export class ClaudeBackgroundTaskRowWriter {
         this.identities,
         pending.id,
         pending.row,
+        this.turnScope,
         undefined,
         pending.lifecycle
       )
diff --git a/src/main/claude/claude-background-task-rows.ts b/src/main/claude/claude-background-task-rows.ts
index 64829d0493a..d6f50f3cfc0 100644
--- a/src/main/claude/claude-background-task-rows.ts
+++ b/src/main/claude/claude-background-task-rows.ts
@@ -1,6 +1,7 @@
 // One durable row per Claude background `task_id`, revised in place from the
 // lifecycle frames so a failed command prints once with the provider sentence.
 
+import type { AgentJournalTurnScope } from '../../shared/agent-session-journal-types'
 import { isSettledBackgroundTaskState } from '../../shared/native-chat-background-task-row'
 import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
 import { record, taskAliasId } from './claude-background-task-frames'
@@ -46,6 +47,8 @@ export type ClaudeBackgroundTaskRowsDeps = {
    *  output, so writing one must reopen a turn the provider resumed itself —
    *  otherwise the session renders the row while reporting idle. */
   openOutputTurn?: (frame: Record<string, unknown>, observedAt: number) => void
+  /** The turn a row written now belongs to: the open one, else the conversation. */
+  turnScope: () => AgentJournalTurnScope
   onPersistenceFailure?: (error: Error) => void
   now?: () => number
 }
@@ -60,7 +63,11 @@ export class ClaudeBackgroundTaskRows {
 
   constructor(private readonly deps: ClaudeBackgroundTaskRowsDeps) {
     this.now = deps.now ?? (() => Date.now())
-    this.writer = new ClaudeBackgroundTaskRowWriter(deps.sink, deps.onPersistenceFailure)
+    this.writer = new ClaudeBackgroundTaskRowWriter(
+      deps.sink,
+      deps.turnScope,
+      deps.onPersistenceFailure
+    )
     this.overflowTerminalRows = new ClaudeOverflowTerminalRows(
       this.ledgers,
       this.now,
diff --git a/src/main/claude/claude-can-use-tool-test-support.ts b/src/main/claude/claude-can-use-tool-test-support.ts
new file mode 100644
index 00000000000..cbf064a0933
--- /dev/null
+++ b/src/main/claude/claude-can-use-tool-test-support.ts
@@ -0,0 +1,30 @@
+// Invoking the fake connection's canUseTool permission callback, as the CLI would.
+
+import type { ClaudeStreamJsonConnectionHandlers } from './claude-stream-json-connection'
+import type { FakeConnection } from './claude-structured-session-test-support'
+
+export function invokeCanUseTool(
+  connection: FakeConnection,
+  toolName: string,
+  requestId: string,
+  toolUseID: string,
+  extra: {
+    input?: Record<string, unknown>
+    suggestions?: unknown[]
+    signal?: AbortSignal
+  } = {}
+): { promise: Promise<unknown>; settled: () => boolean } {
+  const options = {
+    requestId,
+    toolUseID,
+    signal: extra.signal ?? new AbortController().signal,
+    ...(extra.suggestions ? { suggestions: extra.suggestions } : {})
+  } as unknown as Parameters<NonNullable<ClaudeStreamJsonConnectionHandlers['canUseTool']>>[2]
+  let done = false
+  const promise = Promise.resolve(
+    connection.handlers.canUseTool?.(toolName, extra.input ?? {}, options)
+  ).finally(() => {
+    done = true
+  })
+  return { promise, settled: () => done }
+}
diff --git a/src/main/claude/claude-captured-compact-frames.test-fixture.ts b/src/main/claude/claude-captured-compact-frames.test-fixture.ts
new file mode 100644
index 00000000000..059ed560d6c
--- /dev/null
+++ b/src/main/claude/claude-captured-compact-frames.test-fixture.ts
@@ -0,0 +1,219 @@
+// Claude Code 2.1.283 (SDK 0.3.251) stream-json captures of `/compact`, driven through `query()` with
+// streaming input and cut to the protocol fields Orca reads. The session id and the summary text
+// are replaced, and every frame carried `session_id: CAPTURED_COMPACT_SESSION_ID`; frame order,
+// uuids and the relative clock (`at`, ms) are the captured ones.
+//
+// Verified from these frames: a finished and a stopped `/compact` both end in a `success` result
+// with no `terminal_reason`, naming the command's input in `user_message_uuid`. Only the finished
+// one carries a `compact_boundary`; the stopped one answers with a synthetic "Compaction canceled."
+// instead. `command_lifecycle` frames bracket every input.
+
+export type CapturedCompactEvent =
+  | { at: number; sent: { text: string; uuid: string } }
+  | { at: number; interrupt: true }
+  | { at: number; frame: Record<string, unknown> }
+
+export const CAPTURED_COMPACT_SESSION_ID = '00000000-0000-4000-8000-000000000001'
+
+const lifecycle = (commandUuid: string, state: string) => ({
+  type: 'command_lifecycle',
+  command_uuid: commandUuid,
+  state
+})
+
+/** A `/compact` left to finish, from its send to its result. */
+export const CAPTURED_COMPACT_SUCCEEDS: CapturedCompactEvent[] = [
+  { at: 1750, sent: { text: '/compact', uuid: '563c9bb2-241a-4946-a35b-0f9088fd05de' } },
+  { at: 1751, frame: lifecycle('968b34fc-76cc-41bc-adfc-34f8840637a0', 'completed') },
+  { at: 1753, frame: lifecycle('563c9bb2-241a-4946-a35b-0f9088fd05de', 'queued') },
+  { at: 1753, frame: lifecycle('563c9bb2-241a-4946-a35b-0f9088fd05de', 'started') },
+  {
+    at: 1757,
+    frame: {
+      type: 'system',
+      subtype: 'status',
+      status: 'compacting',
+      uuid: 'de45cbf4-0f29-4ad7-a2a4-f9d9d8847f88'
+    }
+  },
+  {
+    at: 6602,
+    frame: {
+      type: 'system',
+      subtype: 'status',
+      status: null,
+      compact_result: 'success',
+      uuid: 'c9cd62b1-02d9-48fc-bb07-1ccb4889c0af'
+    }
+  },
+  {
+    at: 6608,
+    frame: {
+      type: 'system',
+      subtype: 'init',
+      uuid: '9cebf016-94d0-43d5-a23b-acbd606efeae',
+      model: 'claude-opus-5-5[1m]'
+    }
+  },
+  {
+    at: 6609,
+    frame: {
+      type: 'system',
+      subtype: 'compact_boundary',
+      compact_metadata: {
+        trigger: 'manual',
+        pre_tokens: 13576,
+        post_tokens: 1011,
+        cumulative_dropped_tokens: 12565,
+        duration_ms: 4711
+      },
+      uuid: '1ed30bd1-8113-4c3d-b4ef-8020a2f80bfe'
+    }
+  },
+  {
+    at: 6609,
+    frame: {
+      type: 'user',
+      parent_tool_use_id: null,
+      isReplay: false,
+      isSynthetic: true,
+      uuid: '4fa68de9-8e28-40d1-a332-da8dba6edd14',
+      message: {
+        role: 'user',
+        content:
+          'This session is being continued from a previous conversation that ran out of context. [summary scrubbed]'
+      }
+    }
+  },
+  {
+    at: 6609,
+    frame: {
+      type: 'user',
+      parent_tool_use_id: null,
+      isReplay: true,
+      uuid: '302b225c-05fd-45a5-ac2d-0435f9b50845',
+      message: { role: 'user', content: '<local-command-stdout>Compacted</local-command-stdout>' }
+    }
+  },
+  {
+    at: 6609,
+    frame: {
+      type: 'result',
+      subtype: 'success',
+      is_error: false,
+      result: '',
+      user_message_uuid: '563c9bb2-241a-4946-a35b-0f9088fd05de',
+      uuid: 'd4c86a55-621b-40ae-9f26-612c842d3ca2'
+    }
+  }
+]
+
+/** A `/compact` interrupted 1.5 s in, then the next send and its own answer. */
+export const CAPTURED_COMPACT_STOPPED_THEN_SEND: CapturedCompactEvent[] = [
+  { at: 9663, sent: { text: '/compact', uuid: 'a4e04ce1-37ad-4d40-aaf8-e03a1bbbbc7d' } },
+  { at: 9664, frame: lifecycle('0be27e6d-49b7-4ee8-a784-744b3fb3b55c', 'completed') },
+  { at: 9664, frame: lifecycle('a4e04ce1-37ad-4d40-aaf8-e03a1bbbbc7d', 'queued') },
+  { at: 9665, frame: lifecycle('a4e04ce1-37ad-4d40-aaf8-e03a1bbbbc7d', 'started') },
+  {
+    at: 9666,
+    frame: {
+      type: 'system',
+      subtype: 'status',
+      status: 'compacting',
+      uuid: 'c85f1131-b4a5-424e-af6a-85e8bd98b2fc'
+    }
+  },
+  { at: 11166, interrupt: true },
+  {
+    at: 11168,
+    frame: {
+      type: 'system',
+      subtype: 'status',
+      status: null,
+      compact_result: 'failed',
+      compact_error: 'API Error: Request was aborted.',
+      uuid: '7fede6b2-afdf-4455-8c69-096ae3fa6f55'
+    }
+  },
+  {
+    at: 11170,
+    frame: {
+      type: 'system',
+      subtype: 'init',
+      uuid: '067d1daa-f0da-4ca0-a9de-bedaa72c606a',
+      model: 'claude-opus-5-5[1m]'
+    }
+  },
+  {
+    at: 11170,
+    frame: {
+      type: 'assistant',
+      parent_tool_use_id: null,
+      uuid: '0d252793-d95f-4c80-b4a1-7309614b7eeb',
+      message: {
+        id: '9c14e2f0-6480-4760-92f8-aa73e461bc47',
+        model: '<synthetic>',
+        role: 'assistant',
+        content: [{ type: 'text', text: 'Compaction canceled.' }]
+      }
+    }
+  },
+  {
+    at: 11170,
+    frame: {
+      type: 'result',
+      subtype: 'success',
+      is_error: false,
+      result: '',
+      user_message_uuid: 'a4e04ce1-37ad-4d40-aaf8-e03a1bbbbc7d',
+      uuid: '523a8c1d-5054-422e-b81e-f5f350d992fd'
+    }
+  },
+  {
+    at: 11170,
+    sent: {
+      text: 'Reply with the single word AFTERSTOP.',
+      uuid: '4178c081-0d9e-414f-a861-ea156efa1e7e'
+    }
+  },
+  { at: 11170, frame: lifecycle('a4e04ce1-37ad-4d40-aaf8-e03a1bbbbc7d', 'cancelled') },
+  { at: 11171, frame: lifecycle('4178c081-0d9e-414f-a861-ea156efa1e7e', 'queued') },
+  { at: 11171, frame: lifecycle('4178c081-0d9e-414f-a861-ea156efa1e7e', 'started') },
+  {
+    at: 11200,
+    frame: {
+      type: 'system',
+      subtype: 'init',
+      uuid: '1eedc4e5-d48c-4682-b593-144466641d13',
+      model: 'claude-opus-5-5[1m]'
+    }
+  },
+  {
+    at: 12778,
+    frame: {
+      type: 'assistant',
+      user_message_uuid: '4178c081-0d9e-414f-a861-ea156efa1e7e',
+      parent_tool_use_id: null,
+      uuid: '39969651-5abd-4dba-ae80-ab1299c07a47',
+      message: {
+        id: 'msg_011CfUXeXFfvAtj1PLLjB1H4',
+        model: 'claude-opus-5-5',
+        role: 'assistant',
+        content: [{ type: 'text', text: 'AFTERSTOP' }]
+      }
+    }
+  },
+  {
+    at: 12844,
+    frame: {
+      type: 'result',
+      subtype: 'success',
+      is_error: false,
+      terminal_reason: 'completed',
+      result: 'AFTERSTOP',
+      user_message_uuid: '4178c081-0d9e-414f-a861-ea156efa1e7e',
+      uuid: 'd9b4faaa-f9be-4d7b-9f81-a5106bd003f3'
+    }
+  },
+  { at: 12844, frame: lifecycle('4178c081-0d9e-414f-a861-ea156efa1e7e', 'completed') }
+]
diff --git a/src/main/claude/claude-captured-fold-steer-frames.test-fixture.ts b/src/main/claude/claude-captured-fold-steer-frames.test-fixture.ts
new file mode 100644
index 00000000000..8213b4bfa45
--- /dev/null
+++ b/src/main/claude/claude-captured-fold-steer-frames.test-fixture.ts
@@ -0,0 +1,275 @@
+// Claude CLI 2.1.280 stream-json captures of sends made while a turn is running
+// (`--replay-user-messages`), cut to the frames and fields the dispatch/turn path
+// reads. Ids, paths and prompts are replaced; the frame order and the relative
+// clock (`at`, ms after the first send) are the captured ones.
+//
+// The captured shape under test: a mid-turn send the CLI folds into the running
+// turn is replayed as a root user frame (`isReplay: true`, the client uuid) while
+// that turn is still open, and the turn's ONE result names every folded send in
+// `user_message_uuids`. A send the CLI runs later (miss) is replayed only when its
+// own turn starts, after the first result. A cancelled mid-turn send is never
+// replayed at all.
+
+import {
+  assistant,
+  assistantText,
+  assistantToolUse,
+  initFrame,
+  resultFrame,
+  sessionIdle,
+  taskFrame,
+  toolResult,
+  userReplay,
+  type CapturedFoldFrame,
+  type FoldCaptureIds
+} from './claude-fold-steer-frame-builders.test-fixture'
+
+export type { CapturedFoldFrame, FoldCaptureIds }
+
+export const FIRST_PROMPT = 'Run the sleep command three times, then reply: FIRST DONE'
+export const STEER_PROMPT = 'Also say the word banana at the end of your reply.'
+export const SECOND_STEER_PROMPT = 'And also say the word mango at the very end.'
+
+/** p2-fold-fresh: first send at 12, steer at 3878; one result names both sends. */
+export const FOLD_FRESH_SEND_AT = { first: 12, steer: 3_878 }
+export function foldFreshCapture({ sessionId, first, steer }: FoldCaptureIds): CapturedFoldFrame[] {
+  return [
+    initFrame(222, sessionId),
+    userReplay(2_094, sessionId, first, FIRST_PROMPT),
+    assistantToolUse(2_676, sessionId, 'reply-tool-1', 'toolu_sleep_1', [first]),
+    toolResult(7_890, sessionId, 'tool-result-1', 'toolu_sleep_1'),
+    userReplay(7_892, sessionId, steer, STEER_PROMPT),
+    assistantToolUse(9_725, sessionId, 'reply-tool-2', 'toolu_sleep_2'),
+    toolResult(14_740, sessionId, 'tool-result-2', 'toolu_sleep_2'),
+    assistantText(23_039, sessionId, 'reply-text-1', 'FIRST DONE banana'),
+    resultFrame(23_048, sessionId, 'result-1', {
+      userMessageUuids: [first, steer],
+      durationMs: 22_845,
+      numTurns: 4
+    }),
+    sessionIdle(23_049, sessionId)
+  ]
+}
+
+/** p2-fold-resumed: the same fold on a `--resume` session; steer at 4458. */
+export const FOLD_RESUMED_SEND_AT = { first: 12, steer: 4_458 }
+export function foldResumedCapture({
+  sessionId,
+  first,
+  steer
+}: FoldCaptureIds): CapturedFoldFrame[] {
+  return [
+    initFrame(218, sessionId),
+    userReplay(2_057, sessionId, first, FIRST_PROMPT),
+    assistant(
+      3_229,
+      sessionId,
+      'reply-thinking-1',
+      [{ type: 'thinking', thinking: 'plan' }],
+      [first]
+    ),
+    assistantToolUse(3_258, sessionId, 'reply-tool-1', 'toolu_sleep_1'),
+    toolResult(8_464, sessionId, 'tool-result-1', 'toolu_sleep_1'),
+    userReplay(8_467, sessionId, steer, STEER_PROMPT),
+    assistantToolUse(10_318, sessionId, 'reply-tool-2', 'toolu_sleep_2'),
+    toolResult(15_373, sessionId, 'tool-result-2', 'toolu_sleep_2'),
+    assistantText(23_587, sessionId, 'reply-text-1', 'FIRST DONE banana'),
+    resultFrame(23_628, sessionId, 'result-1', {
+      userMessageUuids: [first, steer],
+      durationMs: 23_367,
+      numTurns: 4
+    }),
+    sessionIdle(23_640, sessionId)
+  ]
+}
+
+/** p2-two-steers: steers at 3630 and 5031, both replayed back to back mid-turn. */
+export const TWO_STEERS_SEND_AT = { first: 31, steer: 3_630, secondSteer: 5_031 }
+export function twoSteersCapture({
+  sessionId,
+  first,
+  steer,
+  secondSteer
+}: Required<FoldCaptureIds>): CapturedFoldFrame[] {
+  return [
+    initFrame(351, sessionId),
+    userReplay(1_169, sessionId, first, FIRST_PROMPT),
+    assistantToolUse(2_412, sessionId, 'reply-tool-1', 'toolu_sleep_1', [first]),
+    toolResult(7_949, sessionId, 'tool-result-1', 'toolu_sleep_1'),
+    userReplay(7_963, sessionId, steer, STEER_PROMPT),
+    userReplay(7_967, sessionId, secondSteer, SECOND_STEER_PROMPT),
+    assistantToolUse(9_806, sessionId, 'reply-tool-2', 'toolu_sleep_2'),
+    toolResult(14_835, sessionId, 'tool-result-2', 'toolu_sleep_2'),
+    assistantText(22_210, sessionId, 'reply-text-1', 'FIRST DONE banana mango'),
+    resultFrame(22_317, sessionId, 'result-1', {
+      userMessageUuids: [first, steer, secondSteer],
+      durationMs: 21_859,
+      numTurns: 4
+    }),
+    sessionIdle(22_341, sessionId)
+  ]
+}
+
+/** p2-miss: the steer lands too late to fold — its replay trails the first
+ *  result, and it runs as its own turn with its own result. */
+export const MISS_SEND_AT = { first: 30, steer: 23_384 }
+export function missCapture({ sessionId, first, steer }: FoldCaptureIds): {
+  beforeSteerSend: CapturedFoldFrame[]
+  afterSteerSend: CapturedFoldFrame[]
+} {
+  return {
+    beforeSteerSend: [
+      initFrame(333, sessionId),
+      userReplay(2_118, sessionId, first, FIRST_PROMPT),
+      assistantToolUse(2_793, sessionId, 'reply-tool-1', 'toolu_sleep_1', [first]),
+      toolResult(8_258, sessionId, 'tool-result-1', 'toolu_sleep_1'),
+      assistantToolUse(11_019, sessionId, 'reply-tool-2', 'toolu_sleep_2'),
+      toolResult(15_961, sessionId, 'tool-result-2', 'toolu_sleep_2'),
+      assistantToolUse(18_362, sessionId, 'reply-tool-3', 'toolu_sleep_3'),
+      toolResult(23_375, sessionId, 'tool-result-3', 'toolu_sleep_3')
+    ],
+    afterSteerSend: [
+      assistantText(25_550, sessionId, 'reply-text-1', 'FIRST DONE'),
+      resultFrame(25_556, sessionId, 'result-1', {
+        userMessageUuids: [first],
+        durationMs: 25_241,
+        numTurns: 4
+      }),
+      initFrame(25_584, sessionId),
+      userReplay(28_703, sessionId, steer, STEER_PROMPT),
+      assistantText(29_239, sessionId, 'reply-text-2', 'banana'),
+      resultFrame(29_275, sessionId, 'result-2', {
+        userMessageUuids: [steer],
+        durationMs: 3_711,
+        numTurns: 1
+      }),
+      sessionIdle(29_306, sessionId)
+    ]
+  }
+}
+
+/** p2-cancel: the steer is cancelled while queued — no replay ever arrives, the
+ *  interrupt injects a synthetic user text with NO `isReplay`, and the error
+ *  result names only the first send. */
+export const CANCEL_SEND_AT = { first: 18, steer: 3_578 }
+export function cancelCapture({ sessionId, first, steer: _steer }: FoldCaptureIds): {
+  beforeSteerSend: CapturedFoldFrame[]
+  afterInterrupt: CapturedFoldFrame[]
+} {
+  return {
+    beforeSteerSend: [
+      initFrame(354, sessionId),
+      userReplay(1_329, sessionId, first, FIRST_PROMPT),
+      assistantToolUse(2_366, sessionId, 'reply-tool-1', 'toolu_sleep_1', [first])
+    ],
+    afterInterrupt: [
+      toolResult(
+        3_889,
+        sessionId,
+        'tool-result-1',
+        'toolu_sleep_1',
+        "The user doesn't want to proceed with this tool use.",
+        true
+      ),
+      {
+        at: 3_900,
+        frame: {
+          type: 'user',
+          session_id: sessionId,
+          parent_tool_use_id: null,
+          uuid: 'interrupt-notice-1',
+          message: {
+            role: 'user',
+            content: [{ type: 'text', text: '[Request interrupted by user for tool use]' }]
+          }
+        }
+      },
+      resultFrame(3_926, sessionId, 'result-1', {
+        userMessageUuids: [first],
+        durationMs: 3_573,
+        numTurns: 3,
+        subtype: 'error_during_execution',
+        isError: true,
+        terminalReason: 'aborted_tools'
+      }),
+      sessionIdle(3_941, sessionId)
+    ]
+  }
+}
+
+/** p3-early-steer: the steer is written BEFORE the first send's replay arrives
+ *  (send at 312, first replay at 1208) and the CLI still folds it — one init,
+ *  one turn, one result naming both sends. */
+export const EARLY_STEER_SEND_AT = { first: 11, steer: 312 }
+export function earlySteerCapture({
+  sessionId,
+  first,
+  steer
+}: FoldCaptureIds): CapturedFoldFrame[] {
+  return [
+    initFrame(205, sessionId),
+    userReplay(1_208, sessionId, first, FIRST_PROMPT),
+    assistantToolUse(2_190, sessionId, 'reply-tool-1', 'toolu_sleep_1', [first]),
+    toolResult(6_316, sessionId, 'tool-result-1', 'toolu_sleep_1'),
+    userReplay(6_318, sessionId, steer, STEER_PROMPT),
+    assistantText(7_336, sessionId, 'reply-text-1', 'FIRST DONE banana'),
+    resultFrame(7_340, sessionId, 'result-1', {
+      userMessageUuids: [first, steer],
+      durationMs: 7_155,
+      numTurns: 2
+    }),
+    sessionIdle(7_341, sessionId)
+  ]
+}
+
+/** p3-background-wake: after the turn's result, the finished background task
+ *  wakes the CLI — a NEW cycle: its own init, output with no user replay, and a
+ *  result that names no send at all (`user_message_uuids` absent). The task's
+ *  completion frames arrive BEFORE the wake's init. */
+export function backgroundWakeCapture({ sessionId, first }: FoldCaptureIds): {
+  firstTurn: CapturedFoldFrame[]
+  wake: CapturedFoldFrame[]
+} {
+  return {
+    firstTurn: [
+      initFrame(252, sessionId),
+      userReplay(1_193, sessionId, first, FIRST_PROMPT),
+      assistantToolUse(2_372, sessionId, 'reply-tool-1', 'toolu_bg_1', [first]),
+      taskFrame(2_530, sessionId, 'task_started', {
+        task_id: 'task_bg_1',
+        tool_use_id: 'toolu_bg_1',
+        description: 'Sleep then print marker',
+        is_backgrounded: true,
+        task_type: 'local_bash'
+      }),
+      toolResult(2_532, sessionId, 'tool-result-1', 'toolu_bg_1'),
+      assistantText(3_403, sessionId, 'reply-text-1', 'STARTED'),
+      resultFrame(3_406, sessionId, 'result-1', {
+        userMessageUuids: [first],
+        durationMs: 3_177,
+        numTurns: 2
+      }),
+      sessionIdle(3_407, sessionId)
+    ],
+    wake: [
+      taskFrame(17_547, sessionId, 'task_updated', {
+        task_id: 'task_bg_1',
+        patch: { status: 'completed' }
+      }),
+      taskFrame(17_547, sessionId, 'task_notification', {
+        task_id: 'task_bg_1',
+        tool_use_id: 'toolu_bg_1',
+        status: 'completed',
+        summary: 'Background command completed (exit code 0)'
+      }),
+      initFrame(17_626, sessionId),
+      assistantText(19_721, sessionId, 'wake-text-1', 'The background command finished.'),
+      resultFrame(19_729, sessionId, 'result-2', {
+        userMessageUuids: [],
+        durationMs: 2_105,
+        numTurns: 1
+      }),
+      sessionIdle(19_730, sessionId)
+    ]
+  }
+}
diff --git a/src/main/claude/claude-child-exit-proof-ladder.test.ts b/src/main/claude/claude-child-exit-proof-ladder.test.ts
new file mode 100644
index 00000000000..2d8da7f629d
--- /dev/null
+++ b/src/main/claude/claude-child-exit-proof-ladder.test.ts
@@ -0,0 +1,72 @@
+import { describe, expect, it, vi } from 'vitest'
+import { PROVIDER_SUPERVISOR_MAX_STOP_MS } from '../codex/codex-app-server-posix-supervisor'
+import type { ClaudeChildTreeReaper } from './claude-agent-sdk-exit-proof'
+import { proveClaudeChildExitWithReaper } from './claude-child-exit-proof-ladder'
+
+function fakeTree(): ClaudeChildTreeReaper & { reap: ReturnType<typeof vi.fn> } {
+  return {
+    capture: vi.fn(async () => {}),
+    refresh: vi.fn(async () => {}),
+    reap: vi.fn(async () => 'exited' as const),
+    treeVerdict: 'exited'
+  }
+}
+
+/** A root that leaves only once a SIGTERM has had `stopMs` to act, the way a supervisor does. */
+function rootStoppedBySigterm(stopMs: number) {
+  let exited = false
+  let settle = (): void => {}
+  const exitPromise = new Promise<void>((resolve) => {
+    settle = resolve
+  })
+  const kill = vi.fn((signal?: NodeJS.Signals | number) => {
+    if (signal === 'SIGTERM') {
+      setTimeout(() => {
+        exited = true
+        settle()
+      }, stopMs)
+    }
+    return true
+  })
+  const stdin = { end: vi.fn() }
+  return {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The ladder reads only pid, kill and stdin.end from its child.
+    child: { pid: 4321, kill, stdin } as unknown as Parameters<
+      typeof proveClaudeChildExitWithReaper
+    >[0]['child'],
+    kill,
+    stdin,
+    exitPromise,
+    exited: () => exited
+  }
+}
+
+describe('Claude child exit proof ladder', () => {
+  it('stops a supervised child with SIGTERM and waits out the supervisor stop before forcing', async () => {
+    // Slower than the unsupervised 1.5 s grace, still inside the supervisor's own bound.
+    const root = rootStoppedBySigterm(PROVIDER_SUPERVISOR_MAX_STOP_MS - 500)
+    const tree = fakeTree()
+
+    await expect(
+      proveClaudeChildExitWithReaper({ ...root, supervised: true, tree }, () => tree)
+    ).resolves.toBe(true)
+
+    expect(root.stdin.end).toHaveBeenCalled()
+    expect(root.kill).toHaveBeenCalledWith('SIGTERM')
+    // Forcing here would SIGKILL the supervisor mid-stop and orphan Claude in its own group.
+    expect(root.kill).not.toHaveBeenCalledWith('SIGKILL')
+    expect(tree.reap).not.toHaveBeenCalled()
+  }, 10_000)
+
+  it('never signals an unsupervised child for the graceful stop', async () => {
+    const root = rootStoppedBySigterm(0)
+    const tree = fakeTree()
+
+    await proveClaudeChildExitWithReaper({ ...root, tree }, () => tree)
+
+    // On Windows a direct SIGTERM is TerminateProcess: stdin end stays the only graceful rung.
+    expect(root.stdin.end).toHaveBeenCalled()
+    expect(root.kill).not.toHaveBeenCalledWith('SIGTERM')
+    expect(tree.reap).toHaveBeenCalled()
+  }, 10_000)
+})
diff --git a/src/main/claude/claude-child-exit-proof-ladder.ts b/src/main/claude/claude-child-exit-proof-ladder.ts
index 85ed629f1b9..37d4e47508d 100644
--- a/src/main/claude/claude-child-exit-proof-ladder.ts
+++ b/src/main/claude/claude-child-exit-proof-ladder.ts
@@ -1,8 +1,11 @@
 import type { SpawnedProcess } from '../../shared/child-process/run-process'
 import { waitForProcessExitUntil } from '../codex/codex-process-exit-deadline'
+import { PROVIDER_SUPERVISOR_MAX_STOP_MS } from '../codex/codex-app-server-posix-supervisor'
 import type { ClaudeChildTreeReaper } from './claude-agent-sdk-exit-proof'
 
-const GRACEFUL_EXIT_MS = 1_500
+export const GRACEFUL_EXIT_MS = 1_500
+// A signalled supervisor escalates on its own; forcing it sooner kills it and orphans Claude.
+export const SUPERVISED_GRACEFUL_EXIT_MS = PROVIDER_SUPERVISOR_MAX_STOP_MS + 500
 const FORCED_EXIT_MS = 1_000
 
 export type ClaudeChildExitProofInput = {
@@ -10,6 +13,8 @@ export type ClaudeChildExitProofInput = {
   exitPromise: Promise<void>
   exited: () => boolean
   tree?: ClaudeChildTreeReaper
+  /** The child is the POSIX provider supervisor: SIGTERM stops Claude, which reaps its tools. */
+  supervised?: boolean
 }
 
 export async function proveClaudeChildExitWithReaper(
@@ -17,16 +22,24 @@ export async function proveClaudeChildExitWithReaper(
   createTree: () => ClaudeChildTreeReaper
 ): Promise<boolean> {
   const tree = input.tree ?? createTree()
-  // Arm before stdin closes: only a live root can identify its descendants.
+  // Arm before the stop: only a live root can identify its descendants.
   await tree.capture()
   try {
     input.child.stdin?.end()
   } catch {
     // The reap below still owns the process.
   }
+  // Stdin end alone lets Claude finish its turn, tools and edits included; a close is a stop.
+  // Windows has no supervisor, and a direct SIGTERM there is TerminateProcess.
+  if (input.supervised && !input.exited()) {
+    input.child.kill('SIGTERM')
+  }
   let reaped = false
   if (!input.exited()) {
-    await waitForProcessExitUntil(input.exitPromise, GRACEFUL_EXIT_MS)
+    await waitForProcessExitUntil(
+      input.exitPromise,
+      input.supervised ? SUPERVISED_GRACEFUL_EXIT_MS : GRACEFUL_EXIT_MS
+    )
     if (!input.exited()) {
       reaped = true
       await tree.refresh?.()
diff --git a/src/main/claude/claude-child-root-termination.ts b/src/main/claude/claude-child-root-termination.ts
index bed422532e1..bba29919578 100644
--- a/src/main/claude/claude-child-root-termination.ts
+++ b/src/main/claude/claude-child-root-termination.ts
@@ -19,6 +19,9 @@ type RootTerminationInput = {
  * nothing. A probe here could only let an unreadable process table cost the tree
  * the one fallback that still works once every table read has failed.
  *
+ * On POSIX the root is the provider supervisor, killed only after its own stop had
+ * its whole bound; Claude, in its own group, is reached by the descendant kill.
+ *
  * False means no signal was sent, because the root had already left.
  */
 export function terminateClaudeRoot(input: RootTerminationInput): boolean {
diff --git a/src/main/claude/claude-command-lifecycle.test.ts b/src/main/claude/claude-command-lifecycle.test.ts
new file mode 100644
index 00000000000..c5570e476fd
--- /dev/null
+++ b/src/main/claude/claude-command-lifecycle.test.ts
@@ -0,0 +1,424 @@
+// Replays of real Claude CLI 2.1.280 sessions (`__fixtures__/claude-lifecycle-capture-*.jsonl`)
+// in which the CLI withdrew a queued send, interrupted a turn, or failed one. The recorded
+// frames are the script; at each recorded control request the test decides how Orca's side of
+// it went — the answer arriving, lost, or failing — and the CLI's own frames from while that
+// request was outstanding are delivered either way.
+
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import type { AgentJournalItemBody } from '../../shared/agent-session-journal-types'
+import { readAgentJournalTurn } from '../../shared/agent-session-turn-record'
+import { DISPATCH_REJECTED_CANCELLED } from '../../shared/structured-agent-session-dispatch-rejection'
+import { ClaudeControlRequestError } from './claude-agent-sdk-control-requests'
+import { ClaudeStructuredSessionAdapter } from './claude-structured-session-adapter'
+import type { ClaudeLateDispatchOutcome } from './claude-structured-session-state'
+import {
+  fakeClaude,
+  identityFor,
+  PROVIDER_SESSION_ID,
+  type FakeConnection
+} from './claude-structured-session-test-support'
+
+type CapturedEvent =
+  | { kind: 'meta'; providerSessionId: string }
+  | { kind: 'frame'; frame: Record<string, unknown> }
+  | { kind: 'dispatch'; clientMessageId: string; sentUuid: string; text: string }
+  | { kind: 'control'; request: Record<string, unknown> }
+  | { kind: 'control-answer'; response: Record<string, unknown> }
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function decodeCapturedEvent(value: unknown): CapturedEvent {
+  if (!isRecord(value)) {
+    throw new Error('capture line is not a recorded event')
+  }
+  if (value.kind === 'meta' && typeof value.providerSessionId === 'string') {
+    return { kind: 'meta', providerSessionId: value.providerSessionId }
+  }
+  if (value.kind === 'frame' && isRecord(value.frame)) {
+    return { kind: 'frame', frame: value.frame }
+  }
+  if (
+    value.kind === 'dispatch' &&
+    typeof value.clientMessageId === 'string' &&
+    typeof value.sentUuid === 'string' &&
+    typeof value.text === 'string'
+  ) {
+    return {
+      kind: 'dispatch',
+      clientMessageId: value.clientMessageId,
+      sentUuid: value.sentUuid,
+      text: value.text
+    }
+  }
+  if (value.kind === 'control' && isRecord(value.request)) {
+    return { kind: 'control', request: value.request }
+  }
+  if (value.kind === 'control-answer' && isRecord(value.response)) {
+    return { kind: 'control-answer', response: value.response }
+  }
+  throw new Error(`capture line has unknown kind: ${String(value.kind)}`)
+}
+
+function loadCapture(name: string): CapturedEvent[] {
+  const path = join(__dirname, '__fixtures__', `claude-lifecycle-capture-${name}.jsonl`)
+  return readFileSync(path, 'utf8')
+    .trim()
+    .split('\n')
+    .map((line) => decodeCapturedEvent(JSON.parse(line)))
+}
+
+type Settlement = { sessionId: string } & ClaudeLateDispatchOutcome
+
+type ControlPoint = {
+  request: Record<string, unknown>
+  /** The CLI's answer as recorded, mapped to this replay's uuids. */
+  answer: Record<string, unknown>
+  /** Delivers the frames the CLI emitted while the request was outstanding. */
+  deliverInFlight: () => void
+  adapter: ClaudeStructuredSessionAdapter
+  connection: FakeConnection
+  routes: ReturnType<typeof fakeClaude>['routes']
+  liveUuid: (clientMessageId: string) => string
+}
+
+async function replayCapture(
+  name: string,
+  options: {
+    /** What Orca did at the recorded control request; by default nothing (the CLI acted alone). */
+    atControl?: (point: ControlPoint) => Promise<void>
+    /** Drop these from the capture's init frames, as an older CLI would not advertise them. */
+    withoutCapabilities?: string[]
+    /** Leave out captured frames, to model a sequence the capture brackets. */
+    omitFrame?: (frame: Record<string, unknown>) => boolean
+    /** Frames to deliver right after a captured one, in the capture's own uuids. */
+    afterFrame?: (frame: Record<string, unknown>) => Record<string, unknown>[]
+    /** Stop after the control request settles; its tail answers the CLI's own control path. */
+    stopAfterControl?: boolean
+  } = {}
+) {
+  const capture = loadCapture(name)
+  const settlements: Settlement[] = []
+  const idles: string[] = []
+  const turnStates = new Map<string, string>()
+  // The capture supplies every frame, startup proof included.
+  const claude = fakeClaude({ initProof: 'none', replayUuid: null })
+  const adapter = new ClaudeStructuredSessionAdapter({
+    resolveLaunch: async () => ({
+      pathToClaudeCodeExecutable: 'claude',
+      options: {},
+      cwd: '/work/repo',
+      claudeConfigDir: '/accounts/claude',
+      providerSessionId: PROVIDER_SESSION_ID,
+      resumeLeafUuid: null,
+      resumesTranscript: false,
+      continuesChain: false
+    }),
+    openConnection: claude.openConnection,
+    readProcessStartTime: async () => 1,
+    now: () => 1_700_000_200_000,
+    persistHandle: async () => {},
+    onDispatchSettledLate: (settlement) => settlements.push(settlement),
+    onSessionIdle: ({ sessionId }) => idles.push(sessionId)
+  })
+  await adapter.acquire({
+    identity: identityFor(),
+    fence: 7,
+    spawnToken: 'spawn-9',
+    events: {
+      appendItem: (_identity, body: AgentJournalItemBody) => {
+        const turn = readAgentJournalTurn(body)
+        if (turn) {
+          turnStates.set(turn.turnId, turn.state)
+        }
+      },
+      appendTombstone: () => {},
+      publish: () => {}
+    }
+  })
+  const connection = claude.connections[0]!
+
+  // Captured uuids -> the uuids the live dispatches mint during this replay.
+  const uuidMap = new Map<string, string>()
+  const capturedSessionId = capture.flatMap((event) =>
+    event.kind === 'meta' ? [event.providerSessionId] : []
+  )[0]!
+  const mapUuids = (value: Record<string, unknown>): Record<string, unknown> => {
+    let text = JSON.stringify(value).replaceAll(capturedSessionId, PROVIDER_SESSION_ID)
+    for (const [captured, live] of uuidMap) {
+      text = text.replaceAll(captured, live)
+    }
+    const mapped: unknown = JSON.parse(text)
+    if (!isRecord(mapped)) {
+      throw new Error('mapped frame is not a record')
+    }
+    return mapped
+  }
+  const deliver = (frame: Record<string, unknown>): void => {
+    if (options.omitFrame?.(frame)) {
+      return
+    }
+    const mapped = mapUuids(frame)
+    if (Array.isArray(mapped.capabilities) && options.withoutCapabilities) {
+      mapped.capabilities = mapped.capabilities.filter(
+        (capability) => !options.withoutCapabilities!.includes(String(capability))
+      )
+    }
+    connection.handlers.onMessage?.(mapped)
+    for (const extra of options.afterFrame?.(frame) ?? []) {
+      connection.handlers.onMessage?.(mapUuids(extra))
+    }
+  }
+  const liveUuid = (clientMessageId: string): string => {
+    const dispatch = capture.find(
+      (event) => event.kind === 'dispatch' && event.clientMessageId === clientMessageId
+    )
+    return dispatch?.kind === 'dispatch' ? (uuidMap.get(dispatch.sentUuid) ?? '') : ''
+  }
+
+  let proofDelivered = false
+  for (let index = 0; index < capture.length; index++) {
+    const event = capture[index]!
+    if (event.kind === 'frame') {
+      deliver(event.frame)
+      proofDelivered = true
+    } else if (event.kind === 'dispatch') {
+      if (proofDelivered) {
+        await adapter.awaitStarted('session-1')
+      }
+      await expect(
+        adapter.dispatch({
+          sessionId: 'session-1',
+          clientMessageId: event.clientMessageId,
+          body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: event.text }] },
+          fence: 7
+        })
+      ).resolves.toEqual({ state: 'admitted' })
+      uuidMap.set(event.sentUuid, String(connection.sent.at(-1)!.uuid))
+    } else if (event.kind === 'control') {
+      const answerAt = capture.findIndex(
+        (candidate, at) => at > index && candidate.kind === 'control-answer'
+      )
+      if (answerAt === -1) {
+        throw new Error('capture recorded no answer for its control request')
+      }
+      const inFlight = capture.slice(index + 1, answerAt)
+      const answer = capture[answerAt]
+      let delivered = false
+      const deliverInFlight = (): void => {
+        if (!delivered) {
+          delivered = true
+          for (const frameEvent of inFlight) {
+            if (frameEvent.kind === 'frame') {
+              deliver(frameEvent.frame)
+            }
+          }
+        }
+      }
+      const atControl = options.atControl ?? (async (point) => point.deliverInFlight())
+      await atControl({
+        request: mapUuids(event.request),
+        answer: answer?.kind === 'control-answer' ? mapUuids(answer.response) : {},
+        deliverInFlight,
+        adapter,
+        connection,
+        routes: claude.routes,
+        liveUuid
+      })
+      deliverInFlight()
+      if (options.stopAfterControl) {
+        break
+      }
+      index = answerAt
+    }
+  }
+  const settlementsFor = (clientMessageId: string) =>
+    settlements
+      .filter((settlement) => settlement.clientMessageId === clientMessageId)
+      .map(({ sessionId: _sessionId, clientMessageId: _id, ...outcome }) => outcome)
+  return { settlementsFor, idles, turnStates, liveUuid, connection, adapter }
+}
+
+const WITHDRAWN = {
+  state: 'rejected',
+  reason: DISPATCH_REJECTED_CANCELLED,
+  rejection: { kind: 'cancelled' }
+}
+
+function acceptedAs(uuid: string) {
+  return { providerIdentity: { provider: 'claude', sessionId: PROVIDER_SESSION_ID, uuid } }
+}
+
+/** Orca's Stop with no turn named, as the chat sends it; the interrupt answers per `answer`. */
+function stopWithInterruptAnswer(answer: 'recorded' | 'lost') {
+  return async (point: ControlPoint): Promise<void> => {
+    point.routes.interrupt = () => {
+      point.deliverInFlight()
+      if (answer === 'lost') {
+        throw new ClaudeControlRequestError('interrupt', 'Control request timed out')
+      }
+      return point.answer
+    }
+    await point.adapter.cancelTurn({ sessionId: 'session-1', fence: 7 })
+  }
+}
+
+describe('a Stop whose interrupt cancelled a queued follow-up (cancel_queued)', () => {
+  it.each(['recorded', 'lost'] as const)(
+    'withdraws the follow-up once when the interrupt answer is %s, and leaves the stopped turn’s message accepted',
+    async (answer) => {
+      const replay = await replayCapture('interrupt-lost', {
+        atControl: stopWithInterruptAnswer(answer)
+      })
+
+      expect(replay.connection.calls.filter((call) => call.subtype === 'interrupt')).toEqual([
+        { subtype: 'interrupt', params: { cancelQueued: true } }
+      ])
+      expect(replay.settlementsFor('client-B')).toEqual([WITHDRAWN])
+      // The interrupted turn's own message was echoed first; its later `cancelled` changes nothing.
+      expect(replay.settlementsFor('client-A')).toEqual([acceptedAs(replay.liveUuid('client-A'))])
+    }
+  )
+
+  it('ignores a cancelled frame for a send it no longer holds, or never sent', async () => {
+    const replay = await replayCapture('interrupt-lost', {
+      atControl: stopWithInterruptAnswer('lost')
+    })
+    for (const commandUuid of [
+      replay.liveUuid('client-A'),
+      replay.liveUuid('client-B'),
+      '5a1b0c63-0000-4000-8000-000000000000'
+    ]) {
+      replay.connection.handlers.onMessage?.({
+        type: 'command_lifecycle',
+        command_uuid: commandUuid,
+        state: 'cancelled',
+        uuid: `lifecycle-${commandUuid}`,
+        session_id: PROVIDER_SESSION_ID
+      })
+    }
+
+    expect(replay.settlementsFor('client-A')).toEqual([acceptedAs(replay.liveUuid('client-A'))])
+    expect(replay.settlementsFor('client-B')).toEqual([WITHDRAWN])
+  })
+})
+
+describe('a Stop that withdraws the follow-up one at a time (no cancel_queued)', () => {
+  it.each([
+    [
+      'times out',
+      () => {
+        throw new ClaudeControlRequestError('cancel_async_message', 'Control request timed out')
+      }
+    ],
+    [
+      'errors',
+      () => {
+        throw new Error('Query closed before response received')
+      }
+    ],
+    ['answers false', () => false]
+  ] as const)(
+    'withdraws it from the CLI’s cancelled frame when cancel_async_message %s',
+    async (_label, answer) => {
+      const replay = await replayCapture('cancel-async', {
+        withoutCapabilities: ['interrupt_cancel_queued_v1'],
+        stopAfterControl: true,
+        atControl: async (point) => {
+          const queued = point.liveUuid('client-B')
+          point.routes.interrupt = () => ({ still_queued: [queued] })
+          point.routes.cancel_async_message = () => {
+            point.deliverInFlight()
+            return answer()
+          }
+          await point.adapter.cancelTurn({ sessionId: 'session-1', fence: 7 })
+        }
+      })
+
+      expect(replay.connection.calls.map((call) => call.subtype)).toContain('cancel_async_message')
+      expect(replay.settlementsFor('client-B')).toEqual([WITHDRAWN])
+      expect(replay.settlementsFor('client-A')).toEqual([acceptedAs(replay.liveUuid('client-A'))])
+    }
+  )
+})
+
+describe('a queued send the CLI withdraws without Orca hearing why', () => {
+  it('settles the withdrawn send from its own cancelled frame', async () => {
+    const replay = await replayCapture('cancel-async')
+
+    expect(replay.settlementsFor('client-B')).toEqual([WITHDRAWN])
+    expect(replay.settlementsFor('client-A')).toEqual([acceptedAs(replay.liveUuid('client-A'))])
+  })
+
+  it('withdraws only the batch lead; the send behind it runs as its own turn and is accepted', async () => {
+    const replay = await replayCapture('batch-lead')
+
+    expect(replay.settlementsFor('client-B')).toEqual([WITHDRAWN])
+    expect(replay.settlementsFor('client-A')).toEqual([acceptedAs(replay.liveUuid('client-A'))])
+    expect(replay.settlementsFor('client-C')).toEqual([acceptedAs(replay.liveUuid('client-C'))])
+    expect([...replay.turnStates.entries()]).toEqual([
+      [replay.liveUuid('client-A'), 'completed'],
+      [replay.liveUuid('client-C'), 'completed']
+    ])
+  })
+})
+
+describe('a send the CLI started, then cancelled', () => {
+  it('stays accepted when its turn failed after the echo', async () => {
+    const replay = await replayCapture('auth-failed')
+
+    expect(replay.settlementsFor('client-A')).toEqual([acceptedAs(replay.liveUuid('client-A'))])
+  })
+
+  it('is not read as withdrawn when the cancelled frame came before any echo', async () => {
+    // The auth-failed capture with the turn's output removed: started, then cancelled.
+    const replay = await replayCapture('auth-failed', {
+      omitFrame: (frame) =>
+        frame.type === 'user' || frame.type === 'assistant' || frame.type === 'result'
+    })
+
+    expect(replay.settlementsFor('client-A')).toEqual([])
+  })
+
+  it('stays started when a redelivered command re-emits queued before its cancelled frame', async () => {
+    const replay = await replayCapture('auth-failed', {
+      omitFrame: (frame) =>
+        frame.type === 'user' || frame.type === 'assistant' || frame.type === 'result',
+      afterFrame: (frame) =>
+        frame.type === 'command_lifecycle' && frame.state === 'started'
+          ? [{ ...frame, state: 'queued' }]
+          : []
+    })
+
+    expect(replay.settlementsFor('client-A')).toEqual([])
+  })
+})
+
+describe('the CLI reporting its session idle', () => {
+  it.each(['interrupt-lost', 'cancel-async', 'batch-lead', 'auth-failed'])(
+    'is reported once per idle frame (%s), never for running',
+    async (name) => {
+      const replay = await replayCapture(name)
+
+      expect(replay.idles).toEqual(['session-1'])
+    }
+  )
+
+  it('is not reported from a child the session no longer holds', async () => {
+    const replay = await replayCapture('auth-failed')
+    await replay.adapter.closeSession('session-1')
+
+    replay.connection.handlers.onMessage?.({
+      type: 'system',
+      subtype: 'session_state_changed',
+      state: 'idle',
+      uuid: 'late-idle',
+      session_id: PROVIDER_SESSION_ID
+    })
+
+    expect(replay.idles).toEqual(['session-1'])
+  })
+})
diff --git a/src/main/claude/claude-command-lifecycle.ts b/src/main/claude/claude-command-lifecycle.ts
new file mode 100644
index 00000000000..652a431d538
--- /dev/null
+++ b/src/main/claude/claude-command-lifecycle.ts
@@ -0,0 +1,33 @@
+// What Claude's per-command `command_lifecycle` frames (msg_lifecycle_v1) settle.
+//
+// `cancelled` is not by itself a withdrawal: a command the CLI already started also ends
+// `cancelled` when its turn is interrupted or fails (measured on 2.1.280). Only a command
+// cancelled before it started was withdrawn. That frame lands ahead of the control answer, so
+// it settles the send even when the interrupt or cancel_async_message answer is lost.
+
+import { settleCancelledClaudeDispatchWaiters } from './claude-structured-dispatch'
+import { readClaudeFrameString } from './claude-structured-init-proof'
+import type { ClaudeLateDispatchSettlement } from './claude-replay-turn-resolution'
+import type { ClaudeSession } from './claude-structured-session-state'
+
+export function observeClaudeCommandLifecycle(
+  session: ClaudeSession,
+  message: Record<string, unknown>,
+  onSettledLate?: ClaudeLateDispatchSettlement
+): void {
+  const commandUuid = readClaudeFrameString(message, 'command_uuid')
+  // An echoed send has left both lists, so nothing here can reach a delivered message.
+  const waiter = [...session.dispatchWaiters, ...session.retiredDispatchWaiters].find(
+    (candidate) => candidate.sentUuid === commandUuid
+  )
+  if (!waiter) {
+    return
+  }
+  const state = message.state
+  if (state === 'started' || (state === 'queued' && waiter.commandLifecycle !== 'started')) {
+    // Forward only: a redelivered command re-emits `queued`, but it has still started.
+    waiter.commandLifecycle = state
+  } else if (state === 'cancelled' && waiter.commandLifecycle !== 'started') {
+    settleCancelledClaudeDispatchWaiters(session, [waiter.sentUuid], onSettledLate)
+  }
+}
diff --git a/src/main/claude/claude-command-turn.test.ts b/src/main/claude/claude-command-turn.test.ts
new file mode 100644
index 00000000000..d777e8a423d
--- /dev/null
+++ b/src/main/claude/claude-command-turn.test.ts
@@ -0,0 +1,367 @@
+// A `/compact` as the Claude translator's open turn, driven by real captured frames: which of them
+// end the command, how, and what the timeline draws.
+
+import { describe, expect, it, vi } from 'vitest'
+import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity,
+  AgentJournalTurnScope
+} from '../../shared/agent-session-journal-types'
+import { readAgentJournalTurn } from '../../shared/agent-session-turn-record'
+import type {
+  StructuredAgentSessionEventSink,
+  StructuredAgentSessionRevisionJournal
+} from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import {
+  CAPTURED_COMPACT_SESSION_ID,
+  CAPTURED_COMPACT_STOPPED_THEN_SEND,
+  CAPTURED_COMPACT_SUCCEEDS,
+  type CapturedCompactEvent
+} from './claude-captured-compact-frames.test-fixture'
+import { createClaudeJournalTranslator } from './claude-structured-journal-translation'
+
+const COMMAND_IDENTITY: AgentJournalItemIdentity = {
+  provider: 'orca',
+  clientMessageId: 'command-turn:cmd-1'
+}
+const COMMAND_KEY = agentJournalItemKey(COMMAND_IDENTITY)
+const IN_COMMAND: AgentJournalTurnScope = { kind: 'turn', turnItemId: COMMAND_KEY }
+const RUNNING = {
+  kind: 'turn' as const,
+  turnId: 'compact:cmd-1',
+  state: 'running' as const,
+  userItemId: 'orca:submission:cmd-1',
+  requestedAt: 900,
+  startedAt: 1_000
+}
+
+type Row = { key: string; body: AgentJournalItemBody; turnScope?: AgentJournalTurnScope }
+
+/** A sink over a journal that holds the host's running command turn, revising rows in place. */
+function harness() {
+  const rows = new Map<string, Row>([[COMMAND_KEY, { key: COMMAND_KEY, body: RUNNING }]])
+  const writes: Row[] = []
+  const write = (
+    identity: AgentJournalItemIdentity,
+    body: AgentJournalItemBody,
+    turnScope?: AgentJournalTurnScope
+  ) => {
+    const row = { key: agentJournalItemKey(identity), body, ...(turnScope ? { turnScope } : {}) }
+    rows.set(row.key, row)
+    writes.push(row)
+  }
+  const journal: StructuredAgentSessionRevisionJournal = {
+    epoch: 'epoch-1',
+    itemBody: (itemId) => rows.get(itemId)?.body ?? null,
+    visitItems: (visit) => {
+      let sequence = 0
+      for (const row of rows.values()) {
+        visit(row.key, sequence++, row.body)
+      }
+    }
+  }
+  const revise: NonNullable<StructuredAgentSessionEventSink['tryReviseResolvedItem']> = (
+    _bytes,
+    resolve,
+    options
+  ) => {
+    const resolved = resolve(journal)
+    if (resolved) {
+      write(resolved.identity, resolved.body, options.turnScope)
+    }
+    return { accepted: true }
+  }
+  const sink: StructuredAgentSessionEventSink = {
+    appendItem: (identity, body, options) => write(identity, body, options.turnScope),
+    appendTombstone: vi.fn(),
+    publish: vi.fn(),
+    tryReviseResolvedItem: revise,
+    tryReviseResolvedItemAndPublish: revise
+  }
+  const translator = createClaudeJournalTranslator({ sink, fallbackIdPrefix: 'test' })
+  const frame = (message: Record<string, unknown>, extra: Record<string, unknown> = {}) =>
+    translator.handle({
+      type: 'message',
+      sessionId: 'orca-session',
+      message: { session_id: CAPTURED_COMPACT_SESSION_ID, ...message },
+      observedAt: 5_000,
+      ...extra
+    })
+  const begin = (sentUuid: string) =>
+    translator.beginCommand({
+      clientMessageId: 'cmd-1',
+      turnId: RUNNING.turnId,
+      identity: COMMAND_IDENTITY,
+      resultIdentity: { provider: 'orca', clientMessageId: 'command-result:cmd-1' },
+      running: RUNNING,
+      providerSessionId: CAPTURED_COMPACT_SESSION_ID,
+      sentUuid
+    })
+  /** Replays a capture as the adapter delivers it: `/compact` goes through `beginCommand`, and a
+   *  Stop marks the interrupt the way the cancel path does. */
+  const replay = (events: readonly CapturedCompactEvent[]) => {
+    for (const event of events) {
+      if ('sent' in event) {
+        if (event.sent.text === '/compact') {
+          begin(event.sent.uuid)
+        }
+      } else if ('interrupt' in event) {
+        translator.commandInterruptRequested(RUNNING.turnId)
+      } else {
+        frame(event.frame)
+      }
+    }
+  }
+  const commandTurn = () => readAgentJournalTurn(rows.get(COMMAND_KEY)?.body)
+  const drawn = () =>
+    [...rows.values()].filter((row) => row.key !== COMMAND_KEY && row.body.kind !== 'turn')
+  return { translator, rows, writes, frame, begin, replay, commandTurn, drawn }
+}
+
+describe('a captured /compact as the open Claude turn', () => {
+  it('ends a finished compaction as a success, drawing only the compaction separator', () => {
+    const { replay, commandTurn, drawn, translator } = harness()
+    replay(CAPTURED_COMPACT_SUCCEEDS)
+
+    expect(commandTurn()).toMatchObject({
+      turnId: RUNNING.turnId,
+      state: 'completed',
+      outcome: 'success',
+      userItemId: RUNNING.userItemId,
+      requestedAt: RUNNING.requestedAt,
+      startedAt: RUNNING.startedAt
+    })
+    // Not the continuation summary, not the command's echo, not a lifecycle opcode row.
+    expect(drawn()).toEqual([
+      {
+        key: agentJournalItemKey({ provider: 'orca', clientMessageId: 'command-result:cmd-1' }),
+        body: { kind: 'status', text: 'Context compacted', presentation: 'compaction' },
+        turnScope: IN_COMMAND
+      }
+    ])
+    expect(translator.commandTurnId).toBeNull()
+  })
+
+  it("ends a stopped compaction as the user's cancellation, then answers the next send in its own turn", () => {
+    const { replay, commandTurn, drawn, rows } = harness()
+    replay(CAPTURED_COMPACT_STOPPED_THEN_SEND)
+
+    // Claude's result for the stopped command is `success` like a finished one's.
+    expect(commandTurn()).toMatchObject({ state: 'interrupted', outcome: 'cancellation' })
+    const answer = drawn().find((row) => row.body.kind === 'message')
+    expect(answer?.body).toMatchObject({ role: 'assistant' })
+    expect(answer?.turnScope).not.toEqual(IN_COMMAND)
+    const answered = readAgentJournalTurn(
+      answer?.turnScope?.kind === 'turn' ? rows.get(answer.turnScope.turnItemId)?.body : undefined
+    )
+    expect(answered).toMatchObject({ state: 'completed', outcome: 'success' })
+    // "Compaction canceled." is the command's own output, and a stop earns no failure row.
+    expect(drawn().filter((row) => row.body.kind === 'status')).toEqual([])
+  })
+
+  it('reads a compaction with no boundary and no stop as a failure, with Claude’s reason', () => {
+    const { replay, commandTurn, drawn } = harness()
+    // The stopped capture without Orca's stop: Claude reported the compaction failed.
+    replay(CAPTURED_COMPACT_STOPPED_THEN_SEND.filter((event) => !('interrupt' in event)))
+
+    expect(commandTurn()).toMatchObject({ state: 'completed', outcome: 'failure' })
+    expect(
+      drawn().filter(
+        (row) => row.turnScope?.kind === 'turn' && row.turnScope.turnItemId === COMMAND_KEY
+      )
+    ).toEqual([
+      expect.objectContaining({
+        body: {
+          kind: 'status',
+          text: 'Compaction failed: API Error: Request was aborted.',
+          failure: {
+            kind: 'compactionFailed',
+            detail: { text: 'API Error: Request was aborted.', audience: 'person' }
+          },
+          tone: 'error'
+        }
+      })
+    ])
+  })
+
+  it('reads a stop that lands after the summary but before the boundary as a cancellation', () => {
+    const { replay, commandTurn, drawn } = harness()
+    // Only the boundary says the conversation was replaced; the status that precedes it does not.
+    replay(
+      CAPTURED_COMPACT_SUCCEEDS.flatMap((event): CapturedCompactEvent[] =>
+        'frame' in event && event.frame.subtype === 'compact_boundary'
+          ? []
+          : 'frame' in event && event.frame.compact_result === 'success'
+            ? [event, { at: event.at, interrupt: true }]
+            : [event]
+      )
+    )
+
+    expect(commandTurn()).toMatchObject({ state: 'interrupted', outcome: 'cancellation' })
+    expect(drawn().filter((row) => row.body.kind === 'status')).toEqual([])
+  })
+
+  it('leaves the command running at a result that names another input', () => {
+    const { begin, frame, commandTurn, translator } = harness()
+    begin('compact-input')
+    frame({ type: 'system', subtype: 'compact_boundary', uuid: 'boundary' })
+    frame({ type: 'result', subtype: 'success', is_error: false, user_message_uuid: 'earlier' })
+    expect(commandTurn()?.state).toBe('running')
+    expect(translator.commandTurnId).toBe(RUNNING.turnId)
+
+    frame({
+      type: 'result',
+      subtype: 'success',
+      is_error: false,
+      user_message_uuid: 'compact-input'
+    })
+    expect(commandTurn()).toMatchObject({ state: 'completed', outcome: 'success' })
+  })
+})
+
+describe('the command turn at each point the ordinary result path threads through', () => {
+  it('suppresses a provider reopen after a command that failed, as after any failed turn', () => {
+    const failed = harness()
+    failed.begin('compact-input')
+    failed.frame({ type: 'result', subtype: 'error_during_execution', is_error: true })
+    failed.frame({
+      type: 'assistant',
+      uuid: 'stray',
+      parent_tool_use_id: null,
+      message: { id: 'msg-stray', role: 'assistant', content: [{ type: 'text', text: 'hi' }] }
+    })
+    expect(failed.translator.currentTurnId).toBeNull()
+
+    const finished = harness()
+    finished.begin('compact-input')
+    finished.frame({ type: 'system', subtype: 'compact_boundary', uuid: 'boundary' })
+    finished.frame({ type: 'result', subtype: 'success', is_error: false })
+    finished.frame({
+      type: 'assistant',
+      uuid: 'resumed',
+      parent_tool_use_id: null,
+      message: { id: 'msg-resumed', role: 'assistant', content: [{ type: 'text', text: 'hi' }] }
+    })
+    expect(finished.translator.currentTurnId).not.toBeNull()
+  })
+
+  it("settles a child still working in the command's turn when the command ends", () => {
+    const { begin, frame, rows } = harness()
+    begin('compact-input')
+    frame({
+      type: 'system',
+      subtype: 'task_started',
+      task_id: 'task-1',
+      task_type: 'local_agent',
+      description: 'Map the lane'
+    })
+    frame({ type: 'result', subtype: 'success', is_error: false })
+    const group = rows.get(
+      agentJournalItemKey({
+        provider: 'orca',
+        clientMessageId: `claude-subagents:${CAPTURED_COMPACT_SESSION_ID}:${RUNNING.turnId}`
+      })
+    )
+    const agents =
+      group?.body.kind === 'message'
+        ? group.body.blocks.flatMap((block) =>
+            block.type === 'subagent-group' ? block.agents : []
+          )
+        : []
+    expect(agents).toEqual([expect.objectContaining({ state: 'unverifiable' })])
+  })
+
+  it("records the context window the command's result reports on the command's turn", () => {
+    const { begin, frame, commandTurn } = harness()
+    begin('compact-input')
+    frame({ type: 'system', subtype: 'init', model: 'claude-opus-5-5[1m]', uuid: 'init' })
+    frame({ type: 'system', subtype: 'compact_boundary', uuid: 'boundary' })
+    frame({
+      type: 'result',
+      subtype: 'success',
+      is_error: false,
+      modelUsage: { 'claude-opus-5-5[1m]': { contextWindow: 1_000_000 } }
+    })
+    expect(commandTurn()).toMatchObject({
+      state: 'completed',
+      contextUsage: { window: { tokens: 1_000_000 } }
+    })
+  })
+
+  it("reports a compaction Claude refused in Claude's own words, and one with none plainly", () => {
+    const worded = harness()
+    worded.begin('compact-input')
+    worded.frame({
+      type: 'system',
+      subtype: 'status',
+      compact_result: 'failed',
+      compact_error: 'Not enough messages to compact.'
+    })
+    worded.frame({ type: 'result', subtype: 'success', is_error: false })
+    expect(worded.commandTurn()).toMatchObject({ state: 'completed', outcome: 'failure' })
+    expect(worded.drawn().map((row) => row.body)).toEqual([
+      {
+        kind: 'status',
+        text: 'Compaction failed: Not enough messages to compact.',
+        failure: {
+          kind: 'compactionFailed',
+          detail: { text: 'Not enough messages to compact.', audience: 'person' }
+        },
+        tone: 'error'
+      }
+    ])
+
+    const unworded = harness()
+    unworded.begin('compact-input')
+    unworded.frame({ type: 'system', subtype: 'status', compact_result: 'failed' })
+    unworded.frame({ type: 'result', subtype: 'success', is_error: false })
+    expect(unworded.drawn().map((row) => row.body)).toEqual([
+      {
+        kind: 'status',
+        text: 'Compaction failed.',
+        failure: { kind: 'compactionFailed' },
+        tone: 'error'
+      }
+    ])
+  })
+
+  it('reports a result with no compaction and no failure as a compaction Claude never confirmed', () => {
+    const { begin, frame, commandTurn, drawn } = harness()
+    begin('compact-input')
+    frame({ type: 'result', subtype: 'success', is_error: false })
+    expect(commandTurn()).toMatchObject({ state: 'completed', outcome: 'failure' })
+    expect(drawn().map((row) => row.body)).toEqual([
+      {
+        kind: 'status',
+        text: 'Compaction completion is unconfirmed.',
+        failure: { kind: 'compactionUnconfirmed' },
+        tone: 'error'
+      }
+    ])
+  })
+
+  it('fails a command whose result ended in error', () => {
+    const { begin, frame, commandTurn } = harness()
+    begin('compact-input')
+    frame({ type: 'result', subtype: 'error_during_execution', is_error: true })
+    expect(commandTurn()).toMatchObject({ state: 'completed', outcome: 'failure' })
+  })
+
+  it("draws one error row, the provider's, for a command whose result is an error", () => {
+    const { begin, frame, drawn } = harness()
+    begin('compact-input')
+    frame({
+      type: 'result',
+      subtype: 'success',
+      is_error: true,
+      result: 'API Error: 529 upstream overloaded'
+    })
+    expect(drawn().filter((row) => row.body.kind === 'status')).toEqual([
+      expect.objectContaining({
+        body: expect.objectContaining({ text: 'API Error: 529 upstream overloaded' }),
+        turnScope: IN_COMMAND
+      })
+    ])
+  })
+})
diff --git a/src/main/claude/claude-command-turn.ts b/src/main/claude/claude-command-turn.ts
new file mode 100644
index 00000000000..be846dc7858
--- /dev/null
+++ b/src/main/claude/claude-command-turn.ts
@@ -0,0 +1,153 @@
+// A conversation command Claude runs as the session's open turn. The turn is the host's record, and
+// the command's own result ends it. Everything Claude writes for the command meanwhile — the
+// summary it continues from, the command's echo, a "Compaction canceled." — is the command's
+// output, never a reply, so none of it draws.
+
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity
+} from '../../shared/agent-session-journal-types'
+import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
+import { providerDiagnostic, type ProviderDiagnostic } from '../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../shared/agent-session-failure-words'
+import { TUI_AGENT_DISPLAY_NAMES } from '../../shared/tui-agent-display-names'
+import type { StructuredAgentSessionCommandRun } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import { structuredCompactionOutcome } from '../native-chat/agent-session-wire/structured-conversation-command-outcome'
+import { claudeText } from './claude-structured-item-translation'
+import { claudeResultFailure } from './claude-structured-provider-fallback'
+import type { ClaudeCurrentTurn, ClaudeTurnEnd } from './claude-turn-lifecycle-item'
+import { isRootClaudeFrame } from './claude-turn-opening'
+import type { ClaudeOpenTurn } from './claude-open-turn'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+
+export type ClaudeCommandTurn = {
+  identity: AgentJournalItemIdentity
+  resultIdentity: AgentJournalItemIdentity
+  /** The command input's uuid, which the result answering it names. */
+  sentUuid: string
+  compacted: boolean
+  /** Orca asked Claude to stop the command. */
+  interruptRequested: boolean
+  /** Claude reported the compaction failed, with its words for a person when it gave any. */
+  failed: { detail?: ProviderDiagnostic } | null
+}
+
+export type ClaudeCommandStart = StructuredAgentSessionCommandRun & {
+  providerSessionId: string
+  sentUuid: string
+}
+
+export function claudeCommandCurrentTurn(start: ClaudeCommandStart): ClaudeCurrentTurn {
+  const { running } = start
+  return {
+    sessionId: start.providerSessionId,
+    turnId: start.turnId,
+    startedAt: running.startedAt ?? Date.now(),
+    ...(running.requestedAt === undefined ? {} : { requestedAt: running.requestedAt }),
+    userItemId: running.userItemId ?? agentJournalItemKey(start.identity),
+    command: {
+      identity: start.identity,
+      resultIdentity: start.resultIdentity,
+      sentUuid: start.sentUuid,
+      compacted: false,
+      interruptRequested: false,
+      failed: null
+    }
+  }
+}
+
+/** Reads a running command's evidence off a frame. True for the command's own output, which
+ *  draws nothing. */
+export function observeClaudeCommandFrame(
+  command: ClaudeCommandTurn | null,
+  message: Record<string, unknown>
+): boolean {
+  if (!command) {
+    return false
+  }
+  if (message.type === 'system') {
+    // Only the boundary says the history was replaced; `compact_result: 'success'` precedes it.
+    if (message.subtype === 'compact_boundary') {
+      command.compacted = true
+    } else if (message.compact_result === 'failed') {
+      const words = claudeText(message.compact_error)
+      const detail = words === null ? undefined : providerDiagnostic(words, 'person')
+      command.failed = detail ? { detail } : {}
+    }
+    return false
+  }
+  return (
+    isRootClaudeFrame(message) &&
+    (message.type === 'user' || message.type === 'assistant' || message.type === 'stream_event')
+  )
+}
+
+/** The command's end from a root result, and the one row that reports it; null when the result
+ *  names another input. */
+export function claudeCommandEnd(
+  command: ClaudeCommandTurn,
+  message: Record<string, unknown>,
+  completedAt: number
+): { end: ClaudeTurnEnd; row: AgentJournalItemBody | null } | null {
+  const answers = claudeText(message.user_message_uuid)
+  if (answers !== null && answers !== command.sentUuid) {
+    return null
+  }
+  // A stopped `/compact` ends in the same success result as a finished one: only the provider's
+  // report of the compaction tells them apart.
+  const shown = claudeResultFailure(message)
+  const verdict = structuredCompactionOutcome({
+    compacted: command.compacted,
+    interruptRequested: command.interruptRequested,
+    failed: command.failed ?? (shown ? {} : null)
+  })
+  const durationMs = message.duration_ms
+  const end: ClaudeTurnEnd = {
+    state: verdict.outcome === 'cancellation' ? 'interrupted' : 'completed',
+    completedAt,
+    outcome: verdict.outcome,
+    ...(typeof durationMs === 'number' && Number.isFinite(durationMs) && durationMs >= 0
+      ? { durationMs }
+      : {})
+  }
+  if (verdict.outcome === 'success') {
+    return { end, row: { kind: 'status', text: 'Context compacted', presentation: 'compaction' } }
+  }
+  // An error result already draws its own row through the provider fallback.
+  return verdict.failure && !shown
+    ? {
+        end,
+        row: {
+          kind: 'status',
+          ...agentSessionFailureWords(verdict.failure, {
+            surface: 'row',
+            agentName: TUI_AGENT_DISPLAY_NAMES.claude
+          }),
+          tone: 'error'
+        }
+      }
+    : { end, row: null }
+}
+
+/** A root result, when a command is the open turn: the command's end, with its one result row
+ *  already written; `another-input` for a result that answers something else; null when no
+ *  command is open. */
+export function claudeCommandResultEnd(
+  turn: Pick<ClaudeOpenTurn, 'command' | 'turnScope'>,
+  sink: Pick<StructuredAgentSessionEventSink, 'appendItem'>,
+  message: Record<string, unknown>,
+  completedAt: number
+): ClaudeTurnEnd | 'another-input' | null {
+  const { command } = turn
+  if (!command) {
+    return null
+  }
+  const ended = claudeCommandEnd(command, message, completedAt)
+  if (!ended) {
+    return 'another-input'
+  }
+  if (ended.row) {
+    sink.appendItem(command.resultIdentity, ended.row, { turnScope: turn.turnScope })
+  }
+  return ended.end
+}
diff --git a/src/main/claude/claude-context-usage-restart.test.ts b/src/main/claude/claude-context-usage-restart.test.ts
index 58f883ab06d..cb0dff927c5 100644
--- a/src/main/claude/claude-context-usage-restart.test.ts
+++ b/src/main/claude/claude-context-usage-restart.test.ts
@@ -6,7 +6,7 @@ import { selectStructuredAgentContextUsage } from '../../shared/structured-agent
 import type { AgentSessionJournal } from '../native-chat/agent-session-journal/journal-store'
 import { createTrackedJournalOpener } from '../native-chat/agent-session-journal/journal-store-test-open'
 import { createDeferredStructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
-import { settleStaleSessionStateOnAcquire } from '../native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict'
+import { settleStaleStructuredAgentSessionState } from '../native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement'
 import { readAgentJournalTurn } from '../../shared/agent-session-turn-record'
 import { bindClaudeContextUsageCapture } from './claude-context-usage'
 import { createClaudeJournalTranslator } from './claude-structured-journal-translation'
@@ -212,11 +212,12 @@ describe('context usage across a restart', () => {
     // The child dies with turn-b running; nothing ends it from the provider side.
     crashed.release()
 
-    await settleStaleSessionStateOnAcquire({
+    await settleStaleStructuredAgentSessionState({
       journal,
       sessionId: 'orca-session',
       fence: 2,
-      acquisitionGeneration: 'next'
+      acquisitionGeneration: 'next',
+      deathEvidence: null
     })
     const turns = journal.snapshot().items.map((item) => readAgentJournalTurn(item.body)?.state)
     expect(turns).toContain('unverifiable')
@@ -233,11 +234,12 @@ describe('context usage across a restart', () => {
     // The write is queued while the host settles the turn behind the sink's back.
     live.detach()
     live.translator.handle(assistantFrame('reply-a2', 3_000, 30_000))
-    await settleStaleSessionStateOnAcquire({
+    await settleStaleStructuredAgentSessionState({
       journal,
       sessionId: 'orca-session',
       fence: 1,
-      acquisitionGeneration: 'next'
+      acquisitionGeneration: 'next',
+      deathEvidence: null
     })
     live.reattach()
     await live.settle()
diff --git a/src/main/claude/claude-context-usage-unloaded-turn.test.ts b/src/main/claude/claude-context-usage-unloaded-turn.test.ts
index 83d9248f648..b562c839efd 100644
--- a/src/main/claude/claude-context-usage-unloaded-turn.test.ts
+++ b/src/main/claude/claude-context-usage-unloaded-turn.test.ts
@@ -18,10 +18,8 @@ import { createTrackedJournalOpener } from '../native-chat/agent-session-journal
 import { readAgentSessionHistory } from '../native-chat/agent-session-wire/agent-session-history-page'
 import type { StructuredAgentSessionAdapter } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
 import { createDeferredStructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
-import {
-  readStructuredAgentSessionOptions,
-  type StructuredAgentSessionMutationContext
-} from '../native-chat/agent-session-wire/structured-agent-session-host-mutations'
+import type { StructuredAgentSessionMutationContext } from '../native-chat/agent-session-wire/structured-agent-session-host-mutations'
+import { readStructuredAgentSessionOptions } from '../native-chat/agent-session-wire/structured-agent-session-options-read'
 import {
   assistantFrame,
   initFrame,
@@ -85,6 +83,11 @@ function readOptions(
   journal: AgentSessionJournal,
   adapter: Partial<StructuredAgentSessionAdapter>
 ) {
+  const running = {
+    journal,
+    child: { fence: 1, generation: 'generation-1' },
+    params: { provider: 'claude' }
+  }
   // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the options read touches only these members.
   const context = {
     deps: {
@@ -95,7 +98,8 @@ function readOptions(
       store: { getRecord: () => undefined }
     },
     serialize: (_sessionId: string, task: () => Promise<unknown>) => task(),
-    requireSession: () => ({ journal, fence: 1 })
+    openConversation: async () => running,
+    conversation: async () => running
   } as unknown as StructuredAgentSessionMutationContext
   return readStructuredAgentSessionOptions(context, SESSION)
 }
diff --git a/src/main/claude/claude-context-usage.ts b/src/main/claude/claude-context-usage.ts
index 010620cf09d..43e1ef5c31e 100644
--- a/src/main/claude/claude-context-usage.ts
+++ b/src/main/claude/claude-context-usage.ts
@@ -10,7 +10,7 @@ import {
   type AgentSessionTokenUsage
 } from '../../shared/agent-session-context-usage'
 import type { ClaudeStreamJsonConnection } from './claude-stream-json-connection'
-import type { ClaudeJournalTranslator } from './claude-structured-journal-translation'
+import type { ClaudeJournalTranslator } from './claude-journal-translator-contract'
 
 /** A report later than this describes a context the user has likely moved past. */
 export const CLAUDE_CONTEXT_USAGE_TIMEOUT_MS = 5_000
diff --git a/src/main/claude/claude-fold-steer-frame-builders.test-fixture.ts b/src/main/claude/claude-fold-steer-frame-builders.test-fixture.ts
new file mode 100644
index 00000000000..efb5781bad8
--- /dev/null
+++ b/src/main/claude/claude-fold-steer-frame-builders.test-fixture.ts
@@ -0,0 +1,184 @@
+// The frame shapes the fold-steer captures are rebuilt from, keeping only the
+// fields the dispatch/turn path reads.
+
+export type CapturedFoldFrame = { at: number; frame: Record<string, unknown> }
+
+export type FoldCaptureIds = {
+  /** The provider session every frame names. */
+  sessionId: string
+  /** Client uuid of the turn-opening send; the CLI adopts it on the replay. */
+  first: string
+  /** Client uuid of the mid-turn send. */
+  steer: string
+  /** Client uuid of the second mid-turn send (two-steers only). */
+  secondSteer?: string
+}
+
+export function userReplay(
+  at: number,
+  sessionId: string,
+  uuid: string,
+  text: string
+): CapturedFoldFrame {
+  return {
+    at,
+    frame: {
+      type: 'user',
+      session_id: sessionId,
+      parent_tool_use_id: null,
+      uuid,
+      isReplay: true,
+      message: { role: 'user', content: [{ type: 'text', text }] }
+    }
+  }
+}
+
+export function assistant(
+  at: number,
+  sessionId: string,
+  uuid: string,
+  content: unknown[],
+  userMessageUuids?: string[]
+): CapturedFoldFrame {
+  return {
+    at,
+    frame: {
+      type: 'assistant',
+      session_id: sessionId,
+      parent_tool_use_id: null,
+      uuid,
+      message: { id: `msg-${uuid}`, role: 'assistant', content },
+      // Only the reply that directly answers a send carries the correlation.
+      ...(userMessageUuids && userMessageUuids.length > 0
+        ? { user_message_uuid: userMessageUuids[0], user_message_uuids: userMessageUuids }
+        : {})
+    }
+  }
+}
+
+export function assistantToolUse(
+  at: number,
+  sessionId: string,
+  uuid: string,
+  toolUseId: string,
+  userMessageUuids?: string[]
+): CapturedFoldFrame {
+  return assistant(
+    at,
+    sessionId,
+    uuid,
+    [{ type: 'tool_use', id: toolUseId, name: 'Bash', input: { command: 'sleep 5' } }],
+    userMessageUuids
+  )
+}
+
+export function assistantText(
+  at: number,
+  sessionId: string,
+  uuid: string,
+  text: string,
+  userMessageUuids?: string[]
+): CapturedFoldFrame {
+  return assistant(at, sessionId, uuid, [{ type: 'text', text }], userMessageUuids)
+}
+
+export function toolResult(
+  at: number,
+  sessionId: string,
+  uuid: string,
+  toolUseId: string,
+  content = '(Bash completed with no output)',
+  isError = false
+): CapturedFoldFrame {
+  return {
+    at,
+    frame: {
+      type: 'user',
+      session_id: sessionId,
+      parent_tool_use_id: null,
+      uuid,
+      message: {
+        role: 'user',
+        content: [{ type: 'tool_result', tool_use_id: toolUseId, content, is_error: isError }]
+      }
+    }
+  }
+}
+
+export function resultFrame(
+  at: number,
+  sessionId: string,
+  uuid: string,
+  fields: {
+    userMessageUuids: string[]
+    durationMs: number
+    numTurns: number
+    subtype?: string
+    isError?: boolean
+    terminalReason?: string
+  }
+): CapturedFoldFrame {
+  return {
+    at,
+    frame: {
+      type: 'result',
+      subtype: fields.subtype ?? 'success',
+      session_id: sessionId,
+      uuid,
+      is_error: fields.isError ?? false,
+      terminal_reason: fields.terminalReason ?? 'completed',
+      duration_ms: fields.durationMs,
+      num_turns: fields.numTurns,
+      result: 'FIRST DONE',
+      ...(fields.userMessageUuids.length > 0
+        ? {
+            user_message_uuid: fields.userMessageUuids[0],
+            user_message_uuids: fields.userMessageUuids
+          }
+        : {})
+    }
+  }
+}
+
+export function sessionIdle(at: number, sessionId: string): CapturedFoldFrame {
+  return {
+    at,
+    frame: {
+      type: 'system',
+      subtype: 'session_state_changed',
+      state: 'idle',
+      session_id: sessionId,
+      uuid: `ssc-idle-${at}`
+    }
+  }
+}
+
+/** Root `system/init`: the CLI starting a request cycle. Emitted at startup and
+ *  again for every later cycle — sequential turn, queued turn, background wake,
+ *  /compact (p3 captures). */
+export function initFrame(at: number, sessionId: string): CapturedFoldFrame {
+  return {
+    at,
+    frame: {
+      type: 'system',
+      subtype: 'init',
+      session_id: sessionId,
+      uuid: `init-${at}`,
+      model: 'claude-sonnet-5',
+      apiKeySource: 'none'
+    }
+  }
+}
+
+/** A root background-task system frame (`task_started`, `task_updated`, ...). */
+export function taskFrame(
+  at: number,
+  sessionId: string,
+  subtype: string,
+  fields: Record<string, unknown>
+): CapturedFoldFrame {
+  return {
+    at,
+    frame: { type: 'system', subtype, session_id: sessionId, uuid: `${subtype}-${at}`, ...fields }
+  }
+}
diff --git a/src/main/claude/claude-fold-steer-receipt.test.ts b/src/main/claude/claude-fold-steer-receipt.test.ts
new file mode 100644
index 00000000000..4726dc55d82
--- /dev/null
+++ b/src/main/claude/claude-fold-steer-receipt.test.ts
@@ -0,0 +1,622 @@
+// A send the CLI folds into the running request cycle: its adopted replay is a
+// delivery receipt, never a new turn boundary. The provider's own cycle state
+// decides — a root init announces each new cycle, and a result's
+// `user_message_uuids` names every send the cycle ran. The measured miss, a
+// lost result followed by a new cycle, and fresh replay uuids all keep the
+// replay-driven opener path. Captured orders
+// from Claude CLI 2.1.280 (`claude-captured-fold-steer-frames.test-fixture.ts`).
+
+import { describe, expect, it, vi, type Mock } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity,
+  AgentJournalMessageItem
+} from '../../shared/agent-session-journal-types'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { readAgentJournalTurn } from '../../shared/agent-session-turn-record'
+import { ClaudeStructuredSessionAdapter } from './claude-structured-session-adapter'
+import type {
+  ClaudeStructuredSessionAdapterDeps,
+  ClaudeStructuredSessionEvent
+} from './claude-structured-session-state'
+import type { ClaudeStructuredLaunch } from './claude-structured-launch-resolution'
+import {
+  fakeClaude,
+  identityFor,
+  PROVIDER_SESSION_ID
+} from './claude-structured-session-test-support'
+import {
+  assistantText,
+  initFrame,
+  resultFrame,
+  userReplay,
+  type CapturedFoldFrame
+} from './claude-fold-steer-frame-builders.test-fixture'
+import {
+  backgroundWakeCapture,
+  cancelCapture,
+  CANCEL_SEND_AT,
+  earlySteerCapture,
+  EARLY_STEER_SEND_AT,
+  FIRST_PROMPT,
+  foldFreshCapture,
+  FOLD_FRESH_SEND_AT,
+  foldResumedCapture,
+  FOLD_RESUMED_SEND_AT,
+  missCapture,
+  MISS_SEND_AT,
+  SECOND_STEER_PROMPT,
+  STEER_PROMPT,
+  twoSteersCapture,
+  TWO_STEERS_SEND_AT
+} from './claude-captured-fold-steer-frames.test-fixture'
+
+const T0 = 1_700_000_100_000
+
+type Rig = {
+  adapter: ClaudeStructuredSessionAdapter
+  claude: ReturnType<typeof fakeClaude>
+  events: ClaudeStructuredSessionEvent[]
+  settled: Mock
+  /** Every revision of every turn lifecycle row, in append order. */
+  turns: () => NonNullable<ReturnType<typeof readAgentJournalTurn>>[]
+  deliver: (captured: CapturedFoldFrame) => void
+  /** Dispatches at the captured send offset and returns the client uuid the CLI adopts. */
+  dispatchAt: (at: number, clientMessageId: string, text: string) => Promise<string>
+}
+
+async function riggedAdapter(
+  launch: Partial<ClaudeStructuredLaunch> = {},
+  claudeOptions: Parameters<typeof fakeClaude>[0] = {}
+): Promise<Rig> {
+  let nowMs = T0
+  const appended: { identity: AgentJournalItemIdentity; body: AgentJournalItemBody }[] = []
+  const sink: StructuredAgentSessionEventSink = {
+    appendItem: (identity, body) => appended.push({ identity, body }),
+    appendTombstone: () => {},
+    publish: () => {}
+  }
+  const events: ClaudeStructuredSessionEvent[] = []
+  const settled = vi.fn()
+  const claude = fakeClaude({ replayUuid: null, ...claudeOptions })
+  const deps: ClaudeStructuredSessionAdapterDeps = {
+    resolveLaunch: async () => ({
+      pathToClaudeCodeExecutable: 'claude',
+      options: {},
+      cwd: '/work/repo',
+      claudeConfigDir: '/accounts/claude',
+      providerSessionId: PROVIDER_SESSION_ID,
+      resumeLeafUuid: null,
+      resumesTranscript: false,
+      continuesChain: false,
+      ...launch
+    }),
+    onEvent: (event) => events.push(event),
+    openConnection: claude.openConnection,
+    readProcessStartTime: async () => T0 - 1_000,
+    now: () => nowMs,
+    persistHandle: async () => {},
+    onDispatchSettledLate: settled
+  }
+  const adapter = new ClaudeStructuredSessionAdapter(deps)
+  await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9', events: sink })
+  await adapter.awaitStarted('session-1')
+  return {
+    adapter,
+    claude,
+    events,
+    settled,
+    turns: () =>
+      appended.flatMap((item) => {
+        const turn = readAgentJournalTurn(item.body)
+        return turn ? [turn] : []
+      }),
+    deliver: (captured) => {
+      nowMs = T0 + captured.at
+      claude.connections[0]!.handlers.onMessage?.(captured.frame)
+    },
+    dispatchAt: async (at, clientMessageId, text) => {
+      nowMs = T0 + at
+      const body: AgentJournalMessageItem = {
+        kind: 'message',
+        role: 'user',
+        blocks: [{ type: 'text', text }]
+      }
+      const outcome = await adapter.dispatch({
+        sessionId: 'session-1',
+        clientMessageId,
+        body,
+        requestedAt: nowMs,
+        fence: 7
+      })
+      expect(outcome).toEqual({ state: 'admitted' })
+      const sentUuid = claude.connections[0]!.sent.at(-1)?.uuid
+      if (typeof sentUuid !== 'string') {
+        throw new Error('the fake connection recorded no sent uuid')
+      }
+      return sentUuid
+    }
+  }
+}
+
+function replayEventFor(events: ClaudeStructuredSessionEvent[], uuid: string) {
+  return events.find(
+    (event) =>
+      event.type === 'message' && event.message.type === 'user' && event.message.uuid === uuid
+  )
+}
+
+describe('Claude fold receipt for a mid-turn send (captured orders)', () => {
+  it('fold-fresh: the folded steer settles as a receipt inside the one turn it was sent during', async () => {
+    const rig = await riggedAdapter()
+    const first = await rig.dispatchAt(FOLD_FRESH_SEND_AT.first, 'client-first', FIRST_PROMPT)
+    const framesFor = (steerUuid: string) =>
+      foldFreshCapture({ sessionId: PROVIDER_SESSION_ID, first, steer: steerUuid })
+    for (const captured of framesFor('pending')) {
+      if (captured.at < FOLD_FRESH_SEND_AT.steer) {
+        rig.deliver(captured)
+      }
+    }
+    const steer = await rig.dispatchAt(FOLD_FRESH_SEND_AT.steer, 'client-steer', STEER_PROMPT)
+    for (const captured of framesFor(steer)) {
+      if (captured.at > FOLD_FRESH_SEND_AT.steer) {
+        rig.deliver(captured)
+      }
+    }
+
+    // ONE turn record for the whole run, never marked interrupted.
+    const turnIds = [...new Set(rig.turns().map((turn) => turn.turnId))]
+    expect(turnIds).toEqual([first])
+    expect(rig.turns().every((turn) => turn.state !== 'interrupted')).toBe(true)
+    // The settled duration is the single turn's, spanning both sends' work.
+    expect(rig.turns().at(-1)).toMatchObject({
+      turnId: first,
+      state: 'completed',
+      outcome: 'success',
+      startedAt: T0 + 2_094,
+      completedAt: T0 + 23_048,
+      durationMs: 22_845
+    })
+    // The steer's replay is a receipt: delivery settles under the steer's own
+    // provider identity, which is what attributes the user item inside the turn.
+    expect(rig.settled).toHaveBeenCalledWith({
+      sessionId: 'session-1',
+      clientMessageId: 'client-steer',
+      providerIdentity: { provider: 'claude', sessionId: PROVIDER_SESSION_ID, uuid: steer }
+    })
+    // And it opens no boundary: the replay event carries no startsTurn.
+    expect(replayEventFor(rig.events, steer)).not.toHaveProperty('startsTurn')
+    expect(replayEventFor(rig.events, first)).toMatchObject({ startsTurn: true })
+  })
+
+  it('session-start proof: a hook-frame startup proof with init only at the first cycle still folds', async () => {
+    // Live sessions prove the session from a SessionStart hook frame BEFORE
+    // system/init arrives (measured against the real CLI); nothing about the
+    // fold may depend on fields of the startup proof frame.
+    const rig = await riggedAdapter({}, { initProof: 'session-start' })
+    const first = await rig.dispatchAt(FOLD_FRESH_SEND_AT.first, 'client-first', FIRST_PROMPT)
+    const framesFor = (steerUuid: string) =>
+      foldFreshCapture({ sessionId: PROVIDER_SESSION_ID, first, steer: steerUuid })
+    for (const captured of framesFor('pending')) {
+      if (captured.at < FOLD_FRESH_SEND_AT.steer) {
+        rig.deliver(captured)
+      }
+    }
+    const steer = await rig.dispatchAt(FOLD_FRESH_SEND_AT.steer, 'client-steer', STEER_PROMPT)
+    for (const captured of framesFor(steer)) {
+      if (captured.at > FOLD_FRESH_SEND_AT.steer) {
+        rig.deliver(captured)
+      }
+    }
+
+    expect([...new Set(rig.turns().map((turn) => turn.turnId))]).toEqual([first])
+    expect(rig.turns().every((turn) => turn.state !== 'interrupted')).toBe(true)
+    expect(replayEventFor(rig.events, steer)).not.toHaveProperty('startsTurn')
+  })
+
+  it('fold-resumed: the receipt holds on a resumed provider session', async () => {
+    const rig = await riggedAdapter({
+      resumeLeafUuid: 'leaf-1',
+      resumesTranscript: true,
+      continuesChain: true
+    })
+    const first = await rig.dispatchAt(FOLD_RESUMED_SEND_AT.first, 'client-first', FIRST_PROMPT)
+    const framesFor = (steerUuid: string) =>
+      foldResumedCapture({ sessionId: PROVIDER_SESSION_ID, first, steer: steerUuid })
+    for (const captured of framesFor('pending')) {
+      if (captured.at < FOLD_RESUMED_SEND_AT.steer) {
+        rig.deliver(captured)
+      }
+    }
+    const steer = await rig.dispatchAt(FOLD_RESUMED_SEND_AT.steer, 'client-steer', STEER_PROMPT)
+    for (const captured of framesFor(steer)) {
+      if (captured.at > FOLD_RESUMED_SEND_AT.steer) {
+        rig.deliver(captured)
+      }
+    }
+    expect(rig.settled).toHaveBeenCalledWith({
+      sessionId: 'session-1',
+      clientMessageId: 'client-steer',
+      providerIdentity: { provider: 'claude', sessionId: PROVIDER_SESSION_ID, uuid: steer }
+    })
+
+    expect([...new Set(rig.turns().map((turn) => turn.turnId))]).toEqual([first])
+    expect(rig.turns().every((turn) => turn.state !== 'interrupted')).toBe(true)
+    expect(rig.turns().at(-1)).toMatchObject({
+      turnId: first,
+      state: 'completed',
+      durationMs: 23_367
+    })
+  })
+
+  it('two-steers: both folded sends settle individually inside the one turn', async () => {
+    const rig = await riggedAdapter()
+    const first = await rig.dispatchAt(TWO_STEERS_SEND_AT.first, 'client-first', FIRST_PROMPT)
+    const framesFor = (steerUuid: string, secondSteerUuid: string) =>
+      twoSteersCapture({
+        sessionId: PROVIDER_SESSION_ID,
+        first,
+        steer: steerUuid,
+        secondSteer: secondSteerUuid
+      })
+    for (const captured of framesFor('pending', 'pending-2')) {
+      if (captured.at < TWO_STEERS_SEND_AT.steer) {
+        rig.deliver(captured)
+      }
+    }
+    // Both steers go out mid-turn, before the next captured frame at 7949.
+    const steer = await rig.dispatchAt(TWO_STEERS_SEND_AT.steer, 'client-steer', STEER_PROMPT)
+    const secondSteer = await rig.dispatchAt(
+      TWO_STEERS_SEND_AT.secondSteer,
+      'client-steer-2',
+      SECOND_STEER_PROMPT
+    )
+    for (const captured of framesFor(steer, secondSteer)) {
+      if (captured.at > TWO_STEERS_SEND_AT.secondSteer) {
+        rig.deliver(captured)
+      }
+    }
+
+    expect([...new Set(rig.turns().map((turn) => turn.turnId))]).toEqual([first])
+    expect(rig.turns().every((turn) => turn.state !== 'interrupted')).toBe(true)
+    expect(rig.settled).toHaveBeenCalledWith({
+      sessionId: 'session-1',
+      clientMessageId: 'client-steer',
+      providerIdentity: { provider: 'claude', sessionId: PROVIDER_SESSION_ID, uuid: steer }
+    })
+    expect(rig.settled).toHaveBeenCalledWith({
+      sessionId: 'session-1',
+      clientMessageId: 'client-steer-2',
+      providerIdentity: { provider: 'claude', sessionId: PROVIDER_SESSION_ID, uuid: secondSteer }
+    })
+  })
+
+  it('early-steer: a steer written before the first replay arrives still folds into the one turn', async () => {
+    const rig = await riggedAdapter()
+    const first = await rig.dispatchAt(EARLY_STEER_SEND_AT.first, 'client-first', FIRST_PROMPT)
+    const framesFor = (steerUuid: string) =>
+      earlySteerCapture({ sessionId: PROVIDER_SESSION_ID, first, steer: steerUuid })
+    for (const captured of framesFor('pending')) {
+      if (captured.at < EARLY_STEER_SEND_AT.steer) {
+        rig.deliver(captured)
+      }
+    }
+    const steer = await rig.dispatchAt(EARLY_STEER_SEND_AT.steer, 'client-steer', STEER_PROMPT)
+    for (const captured of framesFor(steer)) {
+      if (captured.at > EARLY_STEER_SEND_AT.steer) {
+        rig.deliver(captured)
+      }
+    }
+
+    // No turn was open when the steer was written, and it still folded.
+    expect([...new Set(rig.turns().map((turn) => turn.turnId))]).toEqual([first])
+    expect(rig.turns().every((turn) => turn.state !== 'interrupted')).toBe(true)
+    expect(rig.turns().at(-1)).toMatchObject({
+      turnId: first,
+      state: 'completed',
+      durationMs: 7_155
+    })
+    expect(replayEventFor(rig.events, steer)).not.toHaveProperty('startsTurn')
+    expect(rig.settled).toHaveBeenCalledWith({
+      sessionId: 'session-1',
+      clientMessageId: 'client-steer',
+      providerIdentity: { provider: 'claude', sessionId: PROVIDER_SESSION_ID, uuid: steer }
+    })
+  })
+
+  it('background-wake: the wake cycle opens from its output and its result settles no waiter', async () => {
+    const rig = await riggedAdapter()
+    const first = await rig.dispatchAt(13, 'client-first', FIRST_PROMPT)
+    const { firstTurn, wake } = backgroundWakeCapture({
+      sessionId: PROVIDER_SESSION_ID,
+      first,
+      steer: 'unused'
+    })
+    for (const captured of [...firstTurn, ...wake]) {
+      rig.deliver(captured)
+    }
+
+    // The task's completion revises a live row ahead of the wake's init, and
+    // that provider output is what opens the wake turn.
+    const finalByTurn = new Map(rig.turns().map((turn) => [turn.turnId, turn]))
+    expect([...finalByTurn.keys()]).toEqual([first, 'task_updated-17547'])
+    expect(finalByTurn.get('task_updated-17547')).toMatchObject({ state: 'completed' })
+    // The wake result names no send; only the first send ever settled.
+    expect(rig.settled).toHaveBeenCalledTimes(1)
+  })
+
+  it('background-wake: a steer replayed after the wake cycle began work folds into the wake turn', async () => {
+    const rig = await riggedAdapter()
+    const first = await rig.dispatchAt(13, 'client-first', FIRST_PROMPT)
+    const { firstTurn, wake } = backgroundWakeCapture({
+      sessionId: PROVIDER_SESSION_ID,
+      first,
+      steer: 'pending'
+    })
+    const wakeResult = wake.findIndex((captured) => captured.frame.type === 'result')
+    for (const captured of [...firstTurn, ...wake.slice(0, wakeResult)]) {
+      rig.deliver(captured)
+    }
+    // Captured order up to the wake's output; the steer's replay is placed
+    // mid-cycle, where the CLI replays a send it folded (p3-early-steer).
+    const steer = await rig.dispatchAt(19_725, 'client-steer', STEER_PROMPT)
+    rig.deliver(userReplay(19_726, PROVIDER_SESSION_ID, steer, STEER_PROMPT))
+    for (const captured of wake.slice(wakeResult)) {
+      rig.deliver(captured)
+    }
+
+    expect([...new Set(rig.turns().map((turn) => turn.turnId))]).toEqual([
+      first,
+      'task_updated-17547'
+    ])
+    expect(rig.turns().every((turn) => turn.state !== 'interrupted')).toBe(true)
+    expect(replayEventFor(rig.events, steer)).not.toHaveProperty('startsTurn')
+    expect(rig.settled).toHaveBeenCalledWith({
+      sessionId: 'session-1',
+      clientMessageId: 'client-steer',
+      providerIdentity: { provider: 'claude', sessionId: PROVIDER_SESSION_ID, uuid: steer }
+    })
+  })
+
+  it('mid-turn auto-compaction emits no root init, so a steer after the boundary still folds', async () => {
+    // Measured (p4-autocompact, CLAUDE_CODE_AUTO_COMPACT_WINDOW forced): the
+    // boundary is `status compacting` + `compact_boundary` + a synthetic
+    // continuation user frame — and NO root init, so cycle work survives it.
+    const rig = await riggedAdapter()
+    const first = await rig.dispatchAt(14, 'client-first', FIRST_PROMPT)
+    rig.deliver(initFrame(234, PROVIDER_SESSION_ID))
+    rig.deliver(userReplay(2_437, PROVIDER_SESSION_ID, first, FIRST_PROMPT))
+    rig.deliver(assistantText(2_864, PROVIDER_SESSION_ID, 'reply-1', 'reading files'))
+    rig.deliver({
+      at: 11_518,
+      frame: {
+        type: 'system',
+        subtype: 'status',
+        status: 'compacting',
+        session_id: PROVIDER_SESSION_ID,
+        uuid: 'status-compacting-1'
+      }
+    })
+    rig.deliver({
+      at: 26_584,
+      frame: {
+        type: 'system',
+        subtype: 'compact_boundary',
+        session_id: PROVIDER_SESSION_ID,
+        uuid: 'compact-boundary-1',
+        compact_metadata: { trigger: 'auto', pre_tokens: 69_960, post_tokens: 9_311 }
+      }
+    })
+    rig.deliver({
+      at: 26_585,
+      frame: {
+        type: 'user',
+        session_id: PROVIDER_SESSION_ID,
+        parent_tool_use_id: null,
+        uuid: 'continuation-1',
+        isSynthetic: true,
+        message: {
+          role: 'user',
+          content: [{ type: 'text', text: 'This session is being continued.' }]
+        }
+      }
+    })
+    const steer = await rig.dispatchAt(26_987, 'client-steer', STEER_PROMPT)
+    rig.deliver(userReplay(34_601, PROVIDER_SESSION_ID, steer, STEER_PROMPT))
+    rig.deliver(assistantText(37_824, PROVIDER_SESSION_ID, 'reply-2', 'FIRST DONE banana'))
+    rig.deliver(
+      resultFrame(37_828, PROVIDER_SESSION_ID, 'result-1', {
+        userMessageUuids: [first, steer],
+        durationMs: 37_616,
+        numTurns: 6
+      })
+    )
+
+    expect([...new Set(rig.turns().map((turn) => turn.turnId))]).toEqual([first])
+    expect(rig.turns().every((turn) => turn.state !== 'interrupted')).toBe(true)
+    expect(replayEventFor(rig.events, steer)).not.toHaveProperty('startsTurn')
+    expect(rig.settled).toHaveBeenCalledWith({
+      sessionId: 'session-1',
+      clientMessageId: 'client-steer',
+      providerIdentity: { provider: 'claude', sessionId: PROVIDER_SESSION_ID, uuid: steer }
+    })
+  })
+
+  it('miss: a steer whose replay trails the result keeps the opener path and its own turn', async () => {
+    const rig = await riggedAdapter()
+    const first = await rig.dispatchAt(MISS_SEND_AT.first, 'client-first', FIRST_PROMPT)
+    const { beforeSteerSend } = missCapture({
+      sessionId: PROVIDER_SESSION_ID,
+      first,
+      steer: 'pending'
+    })
+    for (const captured of beforeSteerSend) {
+      rig.deliver(captured)
+    }
+    const steer = await rig.dispatchAt(MISS_SEND_AT.steer, 'client-steer', STEER_PROMPT)
+    for (const captured of missCapture({ sessionId: PROVIDER_SESSION_ID, first, steer })
+      .afterSteerSend) {
+      rig.deliver(captured)
+    }
+
+    // Two real turns: the first completed by its result — not interrupted —
+    // and the late steer's own turn opened by its replay.
+    expect([...new Set(rig.turns().map((turn) => turn.turnId))]).toEqual([first, steer])
+    expect(rig.turns().every((turn) => turn.state !== 'interrupted')).toBe(true)
+    const finalByTurn = new Map(rig.turns().map((turn) => [turn.turnId, turn]))
+    expect(finalByTurn.get(first)).toMatchObject({
+      state: 'completed',
+      completedAt: T0 + 25_556,
+      durationMs: 25_241
+    })
+    expect(finalByTurn.get(steer)).toMatchObject({
+      state: 'completed',
+      startedAt: T0 + 28_703,
+      completedAt: T0 + 29_275,
+      durationMs: 3_711
+    })
+    expect(replayEventFor(rig.events, steer)).toMatchObject({ startsTurn: true })
+  })
+
+  it('cancel: a cancelled steer settles nothing and the receipt path changes none of it', async () => {
+    const rig = await riggedAdapter()
+    const first = await rig.dispatchAt(CANCEL_SEND_AT.first, 'client-first', FIRST_PROMPT)
+    const { beforeSteerSend, afterInterrupt } = cancelCapture({
+      sessionId: PROVIDER_SESSION_ID,
+      first,
+      steer: 'never-replayed'
+    })
+    for (const captured of beforeSteerSend) {
+      rig.deliver(captured)
+    }
+    await rig.dispatchAt(CANCEL_SEND_AT.steer, 'client-steer', STEER_PROMPT)
+    for (const captured of afterInterrupt) {
+      rig.deliver(captured)
+    }
+
+    // One turn, ended by the interrupt's error result exactly as before.
+    expect([...new Set(rig.turns().map((turn) => turn.turnId))]).toEqual([first])
+    expect(rig.turns().at(-1)).toMatchObject({
+      turnId: first,
+      state: 'interrupted',
+      outcome: 'cancellation'
+    })
+    // The steer was never replayed and its result never named it: no settlement.
+    expect(rig.settled).not.toHaveBeenCalledWith(
+      expect.objectContaining({ clientMessageId: 'client-steer' })
+    )
+    // The interrupt's synthetic user text opens no turn either.
+    expect(replayEventFor(rig.events, 'interrupt-notice-1')).not.toHaveProperty('startsTurn')
+  })
+})
+
+describe('Claude fold receipt boundaries (synthetic orders)', () => {
+  it('lost result: a root init starts a cycle with no work yet, so the next adopted replay is a boundary', async () => {
+    const rig = await riggedAdapter()
+    const uuidA = await rig.dispatchAt(10, 'client-a', 'first prompt')
+    rig.deliver(userReplay(1_000, PROVIDER_SESSION_ID, uuidA, 'first prompt'))
+    const uuidB = await rig.dispatchAt(1_500, 'client-b', STEER_PROMPT)
+    // A's result never arrives, but the CLI announces its next request cycle:
+    // the open turn stops folding, so B's replay opens its own turn.
+    rig.deliver(initFrame(2_000, PROVIDER_SESSION_ID))
+    rig.deliver(userReplay(3_000, PROVIDER_SESSION_ID, uuidB, STEER_PROMPT))
+
+    expect([...new Set(rig.turns().map((turn) => turn.turnId))]).toEqual([uuidA, uuidB])
+    expect(replayEventFor(rig.events, uuidB)).toMatchObject({ startsTurn: true })
+  })
+
+  it('provider wake: an adopted replay during the live wake cycle folds into the wake turn', async () => {
+    // Cycle semantics: a wake is its own init-led cycle (p3-background-wake) and
+    // a replay the CLI emits mid-cycle was folded into that cycle (p3-early-steer).
+    const rig = await riggedAdapter()
+    const uuidA = await rig.dispatchAt(10, 'client-a', 'first prompt')
+    rig.deliver(userReplay(1_000, PROVIDER_SESSION_ID, uuidA, 'first prompt'))
+    rig.deliver(
+      resultFrame(2_000, PROVIDER_SESSION_ID, 'result-1', {
+        userMessageUuids: [uuidA],
+        durationMs: 1_990,
+        numTurns: 1
+      })
+    )
+    const uuidB = await rig.dispatchAt(2_500, 'client-b', STEER_PROMPT)
+    rig.deliver(initFrame(3_000, PROVIDER_SESSION_ID))
+    rig.deliver(assistantText(3_500, PROVIDER_SESSION_ID, 'provider-resumed-1', 'background done'))
+    rig.deliver(userReplay(4_000, PROVIDER_SESSION_ID, uuidB, STEER_PROMPT))
+
+    expect([...new Set(rig.turns().map((turn) => turn.turnId))]).toEqual([
+      uuidA,
+      'provider-resumed-1'
+    ])
+    expect(replayEventFor(rig.events, uuidB)).not.toHaveProperty('startsTurn')
+    expect(rig.settled).toHaveBeenCalledWith({
+      sessionId: 'session-1',
+      clientMessageId: 'client-b',
+      providerIdentity: { provider: 'claude', sessionId: PROVIDER_SESSION_ID, uuid: uuidB }
+    })
+  })
+
+  it('a fresh replay uuid with user_message_uuid correlation keeps the opener path, not a fold receipt', async () => {
+    const rig = await riggedAdapter()
+    const uuidA = await rig.dispatchAt(10, 'client-a', 'first prompt')
+    rig.deliver(userReplay(1_000, PROVIDER_SESSION_ID, uuidA, 'first prompt'))
+    const uuidB = await rig.dispatchAt(1_500, 'client-b', STEER_PROMPT)
+    // A replay that did not adopt the client uuid is not the measured fold
+    // shape, so it keeps the opener path it had before the receipt existed.
+    const fresh = userReplay(2_000, PROVIDER_SESSION_ID, 'fresh-turn-2', STEER_PROMPT)
+    rig.deliver({ ...fresh, frame: { ...fresh.frame, user_message_uuid: uuidB } })
+
+    expect([...new Set(rig.turns().map((turn) => turn.turnId))]).toEqual([uuidA, 'fresh-turn-2'])
+    expect(replayEventFor(rig.events, 'fresh-turn-2')).toMatchObject({ startsTurn: true })
+    expect(rig.settled).toHaveBeenCalledWith({
+      sessionId: 'session-1',
+      clientMessageId: 'client-b',
+      providerIdentity: { provider: 'claude', sessionId: PROVIDER_SESSION_ID, uuid: 'fresh-turn-2' }
+    })
+  })
+
+  it('plural result uuids: an unsettled folded waiter settles under its own uuid, never a shared result alias', async () => {
+    const rig = await riggedAdapter()
+    const uuidA = await rig.dispatchAt(10, 'client-a', 'first prompt')
+    rig.deliver(userReplay(1_000, PROVIDER_SESSION_ID, uuidA, 'first prompt'))
+    const uuidB = await rig.dispatchAt(1_500, 'client-b', STEER_PROMPT)
+    // B's replay never arrives; the folded turn's one result still names it.
+    rig.deliver(
+      resultFrame(5_000, PROVIDER_SESSION_ID, 'result-1', {
+        userMessageUuids: [uuidA, uuidB],
+        durationMs: 4_990,
+        numTurns: 2
+      })
+    )
+
+    expect(rig.settled).toHaveBeenCalledWith({
+      sessionId: 'session-1',
+      clientMessageId: 'client-b',
+      providerIdentity: { provider: 'claude', sessionId: PROVIDER_SESSION_ID, uuid: uuidB }
+    })
+    expect(rig.settled).not.toHaveBeenCalledWith(
+      expect.objectContaining({ providerIdentity: expect.objectContaining({ uuid: 'result-1' }) })
+    )
+    // The correlated result opened nothing and the one turn completed normally.
+    expect([...new Set(rig.turns().map((turn) => turn.turnId))]).toEqual([uuidA])
+    expect(rig.turns().at(-1)).toMatchObject({ turnId: uuidA, state: 'completed' })
+  })
+
+  it('plural result uuids: a result naming only settled sends does not claim an unnamed live waiter by queue order', async () => {
+    const rig = await riggedAdapter()
+    const uuidA = await rig.dispatchAt(10, 'client-a', 'first prompt')
+    rig.deliver(userReplay(1_000, PROVIDER_SESSION_ID, uuidA, 'first prompt'))
+    await rig.dispatchAt(1_500, 'client-b', STEER_PROMPT)
+    // A result that names only sends already settled must not fall back to
+    // queue order and claim B, the still-live waiter it did not name.
+    rig.deliver(
+      resultFrame(5_000, PROVIDER_SESSION_ID, 'result-1', {
+        userMessageUuids: [uuidA],
+        durationMs: 4_990,
+        numTurns: 1
+      })
+    )
+    expect(rig.settled).not.toHaveBeenCalledWith(
+      expect.objectContaining({ clientMessageId: 'client-b' })
+    )
+  })
+})
diff --git a/src/main/claude/claude-folder-trust-file.test.ts b/src/main/claude/claude-folder-trust-file.test.ts
new file mode 100644
index 00000000000..1c876be1457
--- /dev/null
+++ b/src/main/claude/claude-folder-trust-file.test.ts
@@ -0,0 +1,314 @@
+import {
+  chmodSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  utimesSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import {
+  applyClaudeFolderTrust,
+  grantClaudeFolderTrust,
+  grantClaudeWorkspaceTrust,
+  resolveClaudeGlobalConfigFile,
+  resolveLocalClaudeTrustConfig,
+  toClaudeTrustKey
+} from './claude-folder-trust-file'
+import type { ClaudeRuntimeAuthPreparation } from '../claude-accounts/runtime-auth/runtime-auth-types'
+
+let root: string
+
+beforeEach(() => {
+  root = realpathSync(mkdtempSync(join(tmpdir(), 'orca-claude-trust-')))
+})
+
+afterEach(() => {
+  rmSync(root, { recursive: true, force: true })
+})
+
+function writeConfig(file: string, value: unknown, mode = 0o600): void {
+  writeFileSync(file, JSON.stringify(value), { mode })
+  chmodSync(file, mode)
+}
+
+function readConfig(file: string): Record<string, unknown> {
+  return JSON.parse(readFileSync(file, 'utf-8'))
+}
+
+describe('toClaudeTrustKey', () => {
+  it('NFC-normalises so a decomposed path matches the key Claude looks up', () => {
+    const decomposed = '/tmp/cafe\u0301'
+    expect(toClaudeTrustKey(decomposed, 'posix')).toBe('/tmp/caf\u00e9')
+  })
+
+  it('uses forward slashes on Windows, as Claude does', () => {
+    expect(toClaudeTrustKey('C:\\Users\\me\\wt\\', 'win32')).toBe('C:/Users/me/wt/')
+    expect(toClaudeTrustKey('C:\\Users\\me\\.\\wt', 'win32')).toBe('C:/Users/me/wt')
+  })
+})
+
+describe('resolveClaudeGlobalConfigFile', () => {
+  const none = (): boolean => false
+
+  it('defaults to ~/.claude.json, never ~/.claude/.claude.json', () => {
+    expect(
+      resolveClaudeGlobalConfigFile({ env: {}, homeDir: '/home/u', style: 'posix', exists: none })
+    ).toBe('/home/u/.claude.json')
+  })
+
+  it('uses CLAUDE_CONFIG_DIR/.claude.json when set', () => {
+    expect(
+      resolveClaudeGlobalConfigFile({
+        env: { CLAUDE_CONFIG_DIR: '/cfg' },
+        homeDir: '/home/u',
+        style: 'posix',
+        exists: none
+      })
+    ).toBe('/cfg/.claude.json')
+  })
+
+  it('prefers the legacy .config.json in the config dir', () => {
+    expect(
+      resolveClaudeGlobalConfigFile({
+        env: {},
+        homeDir: '/home/u',
+        style: 'posix',
+        exists: (p) => p === '/home/u/.claude/.config.json'
+      })
+    ).toBe('/home/u/.claude/.config.json')
+  })
+
+  it('follows the custom-OAuth file suffix', () => {
+    expect(
+      resolveClaudeGlobalConfigFile({
+        env: { CLAUDE_CODE_CUSTOM_OAUTH_URL: 'https://x' },
+        homeDir: '/home/u',
+        style: 'posix',
+        exists: none
+      })
+    ).toBe('/home/u/.claude-custom-oauth.json')
+  })
+})
+
+describe('applyClaudeFolderTrust', () => {
+  it('is a no-op when the folder is already trusted', () => {
+    expect(
+      applyClaudeFolderTrust({ projects: { '/wt': { hasTrustDialogAccepted: true } } }, ['/wt'])
+    ).toEqual({ kind: 'unchanged' })
+  })
+
+  it('refuses a non-object projects map instead of replacing it', () => {
+    expect(applyClaudeFolderTrust({ projects: [] }, ['/wt'])).toEqual({ kind: 'refuse' })
+  })
+
+  it("keeps Claude's own fields on an existing untrusted entry", () => {
+    expect(
+      applyClaudeFolderTrust({ projects: { '/wt': { allowedTools: ['x'] } } }, ['/wt'])
+    ).toEqual({
+      kind: 'changed',
+      config: { projects: { '/wt': { allowedTools: ['x'], hasTrustDialogAccepted: true } } }
+    })
+  })
+})
+
+describe('grantClaudeFolderTrust', () => {
+  it('merges the key and keeps every other field', async () => {
+    const file = join(root, '.claude.json')
+    writeConfig(file, {
+      oauthAccount: { emailAddress: 'x' },
+      mcpServers: { a: {} },
+      projects: { '/elsewhere': { hasTrustDialogAccepted: true, allowedTools: [] } }
+    })
+    await expect(grantClaudeFolderTrust({ configFile: file, folderKeys: ['/wt'] })).resolves.toBe(
+      'granted'
+    )
+    expect(readConfig(file)).toEqual({
+      oauthAccount: { emailAddress: 'x' },
+      mcpServers: { a: {} },
+      projects: {
+        '/elsewhere': { hasTrustDialogAccepted: true, allowedTools: [] },
+        '/wt': { hasTrustDialogAccepted: true }
+      }
+    })
+  })
+
+  it('keeps an owner-only mode through the rewrite', async () => {
+    const file = join(root, '.claude.json')
+    writeConfig(file, {}, 0o600)
+    await grantClaudeFolderTrust({ configFile: file, folderKeys: ['/wt'] })
+    expect(statSync(file).mode & 0o777).toBe(0o600)
+  })
+
+  it('never creates a missing config file', async () => {
+    const file = join(root, '.claude.json')
+    await expect(grantClaudeFolderTrust({ configFile: file, folderKeys: ['/wt'] })).resolves.toBe(
+      'missing-config'
+    )
+    expect(existsSync(file)).toBe(false)
+  })
+
+  it('leaves a corrupt file byte-for-byte untouched', async () => {
+    const file = join(root, '.claude.json')
+    writeFileSync(file, '{"oauthAccount": ', { mode: 0o600 })
+    await expect(grantClaudeFolderTrust({ configFile: file, folderKeys: ['/wt'] })).resolves.toBe(
+      'unreadable'
+    )
+    expect(readFileSync(file, 'utf-8')).toBe('{"oauthAccount": ')
+  })
+
+  it('does nothing while Claude holds its lock, and leaves the lock in place', async () => {
+    const file = join(root, '.claude.json')
+    writeConfig(file, {})
+    const lockDir = `${file}.lock`
+    mkdirSync(lockDir)
+    const oldTime = new Date(Date.now() - 60_000)
+    // Why: a lock older than Claude's 10 s stale window must still not be broken by Orca.
+    utimesSync(lockDir, oldTime, oldTime)
+    await expect(grantClaudeFolderTrust({ configFile: file, folderKeys: ['/wt'] })).resolves.toBe(
+      'locked'
+    )
+    expect(readConfig(file)).toEqual({})
+    expect(existsSync(lockDir)).toBe(true)
+  })
+
+  it('updates a symlinked config through its target and keeps the link', async () => {
+    const target = join(root, 'dotfiles-claude.json')
+    const link = join(root, '.claude.json')
+    writeConfig(target, { theme: 'dark' })
+    symlinkSync(target, link)
+    await grantClaudeFolderTrust({ configFile: link, folderKeys: ['/wt'] })
+    expect(lstatSync(link).isSymbolicLink()).toBe(true)
+    expect(readConfig(target)).toEqual({
+      theme: 'dark',
+      projects: { '/wt': { hasTrustDialogAccepted: true } }
+    })
+  })
+
+  it('leaves the parent directory mode alone', async () => {
+    const home = join(root, 'home')
+    mkdirSync(home, { mode: 0o755 })
+    chmodSync(home, 0o755)
+    const file = join(home, '.claude.json')
+    writeConfig(file, {})
+    await grantClaudeFolderTrust({ configFile: file, folderKeys: ['/wt'] })
+    expect(statSync(home).mode & 0o777).toBe(0o755)
+  })
+
+  it('grants every folder of a launch burst instead of losing some to its own lock', async () => {
+    const file = join(root, '.claude.json')
+    writeConfig(file, {})
+    const keys = Array.from({ length: 12 }, (_, index) => `/wt-${index}`)
+    const outcomes = await Promise.all(
+      keys.map((key) => grantClaudeFolderTrust({ configFile: file, folderKeys: [key] }))
+    )
+    expect(outcomes).toEqual(keys.map(() => 'granted'))
+    expect(readConfig(file).projects).toEqual(
+      Object.fromEntries(keys.map((key) => [key, { hasTrustDialogAccepted: true }]))
+    )
+  })
+})
+
+describe('grantClaudeWorkspaceTrust', () => {
+  it('writes the given folder and its realpath form, whatever kind of folder it is', async () => {
+    const real = join(root, 'real-folder')
+    mkdirSync(real)
+    const link = join(root, 'linked-folder')
+    symlinkSync(real, link)
+    const file = join(root, '.claude.json')
+    writeConfig(file, {})
+    await expect(
+      grantClaudeWorkspaceTrust({ configFile: file, keyStyle: 'posix' }, link)
+    ).resolves.toBe('granted')
+    expect(readConfig(file)).toEqual({
+      projects: {
+        [link]: { hasTrustDialogAccepted: true },
+        [real]: { hasTrustDialogAccepted: true }
+      }
+    })
+  })
+
+  it('does not take the lock when the folder is already trusted', async () => {
+    const file = join(root, '.claude.json')
+    writeConfig(file, { projects: { [root]: { hasTrustDialogAccepted: true } } })
+    mkdirSync(`${file}.lock`)
+    await expect(
+      grantClaudeWorkspaceTrust({ configFile: file, keyStyle: 'posix' }, root)
+    ).resolves.toBe('unchanged')
+  })
+
+  it('maps a host path to the path Claude sees and skips one it cannot map', async () => {
+    const file = join(root, '.claude.json')
+    writeConfig(file, {})
+    await grantClaudeWorkspaceTrust(
+      { configFile: file, keyStyle: 'posix', toClaudePath: () => '/home/u/wt' },
+      join(root, 'missing')
+    )
+    expect(readConfig(file)).toEqual({
+      projects: { '/home/u/wt': { hasTrustDialogAccepted: true } }
+    })
+    await expect(
+      grantClaudeWorkspaceTrust(
+        { configFile: file, keyStyle: 'posix', toClaudePath: () => null },
+        join(root, 'other')
+      )
+    ).resolves.toBe('unchanged')
+  })
+})
+
+describe('resolveLocalClaudeTrustConfig', () => {
+  const wslAuth: ClaudeRuntimeAuthPreparation = {
+    configDir: '\\\\wsl.localhost\\Ubuntu\\home\\u\\.claude',
+    runtime: 'wsl',
+    wslDistro: 'Ubuntu',
+    wslLinuxConfigDir: '/home/u/.claude',
+    envPatch: {},
+    stripAuthEnv: true,
+    provenance: 'wsl:Ubuntu:system'
+  }
+
+  it('reads the final spawn env for a host launch', () => {
+    const target = resolveLocalClaudeTrustConfig({
+      workspacePath: '/repo/wt',
+      env: { CLAUDE_CONFIG_DIR: '/cfg', HOME: '/home/u' },
+      claudeAuth: null,
+      wslDistro: null
+    })
+    expect(target?.configFile).toBe(join('/cfg', '.claude.json'))
+  })
+
+  it("never writes the Windows host's file for a WSL launch it cannot map to the guest", () => {
+    for (const args of [
+      { claudeAuth: null, wslDistro: 'Ubuntu' },
+      { claudeAuth: { ...wslAuth, wslLinuxConfigDir: null }, wslDistro: 'Ubuntu' },
+      { claudeAuth: wslAuth, wslDistro: 'Ubuntu', workspacePath: 'C:\\repo\\wt' }
+    ]) {
+      expect(
+        resolveLocalClaudeTrustConfig({
+          workspacePath: '\\\\wsl.localhost\\Ubuntu\\home\\u\\wt',
+          env: { HOME: '/home/win' },
+          ...args
+        })
+      ).toBeNull()
+    }
+  })
+
+  it("targets the guest's own file and Linux keys for a WSL launch", () => {
+    const target = resolveLocalClaudeTrustConfig({
+      workspacePath: '\\\\wsl.localhost\\Ubuntu\\home\\u\\wt',
+      env: {},
+      claudeAuth: wslAuth,
+      wslDistro: 'Ubuntu'
+    })
+    expect(target?.keyStyle).toBe('posix')
+    expect(target?.toClaudePath?.('\\\\wsl.localhost\\Ubuntu\\home\\u\\wt')).toBe('/home/u/wt')
+  })
+})
diff --git a/src/main/claude/claude-folder-trust-file.ts b/src/main/claude/claude-folder-trust-file.ts
new file mode 100644
index 00000000000..ca35351eeb0
--- /dev/null
+++ b/src/main/claude/claude-folder-trust-file.ts
@@ -0,0 +1,306 @@
+import { randomUUID } from 'node:crypto'
+import {
+  chmodSync,
+  existsSync,
+  lstatSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from 'node:fs'
+import { dirname, join, posix, resolve, win32 } from 'node:path'
+import { homedir } from 'node:os'
+import { lock } from 'proper-lockfile'
+import { renameFileWithWindowsRetry } from '../codex-accounts/fs-utils'
+import { runKeyedSerializedOperation } from '../cli/keyed-promise-queue'
+import { parseWslUncPath } from '../../shared/wsl-paths'
+import type { ClaudeRuntimeAuthPreparation } from '../claude-accounts/runtime-auth/runtime-auth-types'
+
+export type ClaudeTrustPathStyle = 'posix' | 'win32'
+
+export type ClaudeFolderTrustOutcome =
+  | 'granted'
+  | 'unchanged'
+  | 'missing-config'
+  | 'locked'
+  | 'unreadable'
+
+type ClaudeConfigEnv = {
+  CLAUDE_CONFIG_DIR?: string
+  CLAUDE_CODE_CUSTOM_OAUTH_URL?: string
+}
+
+// Why: Orca must never break a lock — a held one means "skip and let Claude ask".
+// Large enough that proper-lockfile never judges it stale, small enough that its
+// half-stale refresh timer stays inside setTimeout's 32-bit range.
+const NEVER_STALE_MS = 2 ** 30
+const LOCK_RETRIES = { retries: 4, factor: 2, minTimeout: 50, maxTimeout: 250 }
+// Why: concurrent grants in one process retry the file lock in lockstep, so a launch burst
+// would lose most of them to `locked`; queue them so only Claude itself contends for the lock.
+const grantQueueByConfigFile = new Map<string, Promise<void>>()
+
+function pathApi(style: ClaudeTrustPathStyle): typeof posix {
+  return style === 'win32' ? win32 : posix
+}
+
+/** Claude looks up NFC `path.normalize` output, with `/` separators on Windows. */
+export function toClaudeTrustKey(folderPath: string, style: ClaudeTrustPathStyle): string {
+  const normalized = pathApi(style).normalize(folderPath.normalize('NFC'))
+  return style === 'win32' ? normalized.replaceAll('\\', '/') : normalized
+}
+
+/**
+ * Mirrors Claude Code's global config lookup: a legacy `<configDir>/.config.json`
+ * wins, otherwise `.claude.json` sits in `CLAUDE_CONFIG_DIR` or the home directory.
+ */
+export function resolveClaudeGlobalConfigFile(args: {
+  env: ClaudeConfigEnv
+  homeDir: string
+  style: ClaudeTrustPathStyle
+  exists: (filePath: string) => boolean
+}): string {
+  const { join } = pathApi(args.style)
+  const legacyDir = (args.env.CLAUDE_CONFIG_DIR ?? join(args.homeDir, '.claude')).normalize('NFC')
+  const legacyFile = join(legacyDir, '.config.json')
+  if (args.exists(legacyFile)) {
+    return legacyFile
+  }
+  const suffix = args.env.CLAUDE_CODE_CUSTOM_OAUTH_URL ? '-custom-oauth' : ''
+  return join(args.env.CLAUDE_CONFIG_DIR || args.homeDir, `.claude${suffix}.json`)
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+export type ClaudeFolderTrustChange =
+  | { kind: 'unchanged' }
+  | { kind: 'refuse' }
+  | { kind: 'changed'; config: Record<string, unknown> }
+
+export function applyClaudeFolderTrust(
+  config: Record<string, unknown>,
+  folderKeys: readonly string[]
+): ClaudeFolderTrustChange {
+  if (config.projects !== undefined && !isPlainObject(config.projects)) {
+    return { kind: 'refuse' }
+  }
+  const projects: Record<string, unknown> = { ...config.projects }
+  const alreadyTrusted = folderKeys.some((key) => {
+    const entry = projects[key]
+    return isPlainObject(entry) && entry.hasTrustDialogAccepted === true
+  })
+  if (alreadyTrusted) {
+    return { kind: 'unchanged' }
+  }
+  for (const key of folderKeys) {
+    const entry = projects[key]
+    projects[key] = isPlainObject(entry)
+      ? { ...entry, hasTrustDialogAccepted: true }
+      : { hasTrustDialogAccepted: true }
+  }
+  return { kind: 'changed', config: { ...config, projects } }
+}
+
+function isMissingFileError(error: unknown): boolean {
+  const code = error instanceof Error && 'code' in error ? error.code : undefined
+  return code === 'ENOENT' || code === 'ENOTDIR'
+}
+
+type ConfigTarget = { kind: 'file'; path: string } | { kind: 'missing' } | { kind: 'unreadable' }
+
+/** Resolves a symlinked config to its target so the rename keeps the link intact. */
+function resolveConfigTarget(configFile: string): ConfigTarget {
+  try {
+    const entry = lstatSync(configFile)
+    const path = entry.isSymbolicLink() ? realpathSync(configFile) : configFile
+    return statSync(path).isFile() ? { kind: 'file', path } : { kind: 'unreadable' }
+  } catch (error) {
+    return { kind: isMissingFileError(error) ? 'missing' : 'unreadable' }
+  }
+}
+
+/** Reads the config behind `target`, or says why it cannot be rewritten. */
+function readConfigAt(
+  target: ConfigTarget
+): { path: string; config: Record<string, unknown> } | 'missing-config' | 'unreadable' {
+  if (target.kind === 'missing') {
+    return 'missing-config'
+  }
+  if (target.kind === 'unreadable') {
+    return 'unreadable'
+  }
+  const config = readConfigObject(target.path)
+  return config ? { path: target.path, config } : 'unreadable'
+}
+
+function readConfigObject(target: string): Record<string, unknown> | null {
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(target, 'utf-8'))
+    return isPlainObject(parsed) ? parsed : null
+  } catch {
+    return null
+  }
+}
+
+function writeConfigAtomically(target: string, config: Record<string, unknown>): void {
+  const mode = statSync(target).mode & 0o777
+  const tmpPath = `${target}.orca-trust-${randomUUID()}.tmp`
+  try {
+    writeFileSync(tmpPath, `${JSON.stringify(config, null, 2)}\n`, { encoding: 'utf-8', mode })
+    if (process.platform !== 'win32') {
+      // Why: umask may narrow the requested mode; the replacement must match the original exactly.
+      chmodSync(tmpPath, mode)
+    }
+    renameFileWithWindowsRetry(tmpPath, target)
+  } catch (error) {
+    rmSync(tmpPath, { force: true })
+    throw error
+  }
+}
+
+/**
+ * Sets `projects[<folder>].hasTrustDialogAccepted` in Claude's global config. Never
+ * creates the file, never breaks Claude's lock, and never rewrites a file it could
+ * not read and parse.
+ */
+export function grantClaudeFolderTrust(args: {
+  configFile: string
+  folderKeys: readonly string[]
+}): Promise<ClaudeFolderTrustOutcome> {
+  return runKeyedSerializedOperation(grantQueueByConfigFile, args.configFile, () =>
+    grantClaudeFolderTrustNow(args)
+  )
+}
+
+async function grantClaudeFolderTrustNow(args: {
+  configFile: string
+  folderKeys: readonly string[]
+}): Promise<ClaudeFolderTrustOutcome> {
+  const probe = readConfigAt(resolveConfigTarget(args.configFile))
+  if (typeof probe === 'string') {
+    return probe
+  }
+  // Why: most launches need nothing, so skip Claude's lock unless a write is due.
+  const planned = applyClaudeFolderTrust(probe.config, args.folderKeys).kind
+  if (planned !== 'changed') {
+    return planned === 'refuse' ? 'unreadable' : 'unchanged'
+  }
+
+  let release: () => Promise<void>
+  try {
+    release = await lock(args.configFile, {
+      // Why: Claude locks the literal `<file>.lock`, not a realpath'd one.
+      lockfilePath: `${args.configFile}.lock`,
+      realpath: false,
+      stale: NEVER_STALE_MS,
+      retries: LOCK_RETRIES,
+      onCompromised: () => {}
+    })
+  } catch {
+    return 'locked'
+  }
+  try {
+    // Why: read → rename stays synchronous so Orca's own synchronous auth writer to
+    // this file cannot interleave and lose an update.
+    const current = readConfigAt(resolveConfigTarget(args.configFile))
+    if (typeof current === 'string') {
+      return current
+    }
+    const change = applyClaudeFolderTrust(current.config, args.folderKeys)
+    if (change.kind === 'refuse') {
+      return 'unreadable'
+    }
+    if (change.kind === 'unchanged') {
+      return 'unchanged'
+    }
+    writeConfigAtomically(current.path, change.config)
+    return 'granted'
+  } finally {
+    await release().catch(() => {})
+  }
+}
+
+/** Keys for `workspacePath` as Claude will see it: the given and realpath'd forms. */
+export function claudeTrustKeysForHostPath(
+  workspacePath: string,
+  keyStyle: ClaudeTrustPathStyle,
+  toClaudePath: (hostPath: string) => string | null = (hostPath) => hostPath
+): string[] {
+  const forms = [resolve(workspacePath)]
+  try {
+    forms.push(realpathSync.native(workspacePath))
+  } catch {
+    // The resolved form alone still matches an unsymlinked path.
+  }
+  const keys = new Set<string>()
+  for (const form of forms) {
+    const claudePath = toClaudePath(form)
+    if (claudePath) {
+      keys.add(toClaudeTrustKey(claudePath, keyStyle))
+    }
+  }
+  return [...keys]
+}
+
+export type ClaudeTrustConfigTarget = {
+  configFile: string
+  keyStyle: ClaudeTrustPathStyle
+  /** Maps a host-native path to the path the Claude process sees (WSL UNC → Linux). */
+  toClaudePath?: (hostPath: string) => string | null
+}
+
+/** The config file a local or WSL-guest Claude will read, or null when Orca cannot tell. */
+export function resolveLocalClaudeTrustConfig(args: {
+  workspacePath: string
+  /** The final spawn env layered over this process's env. */
+  env: Record<string, string | undefined>
+  claudeAuth: ClaudeRuntimeAuthPreparation | null
+  wslDistro: string | null
+}): ClaudeTrustConfigTarget | null {
+  const { claudeAuth } = args
+  if (claudeAuth?.runtime === 'wsl' || args.wslDistro || parseWslUncPath(args.workspacePath)) {
+    // Why: a WSL guest reads its own config, reachable only through the auth prep's UNC dir;
+    // without a guest config dir, the prep's `configDir` is the Windows host's own file.
+    if (
+      claudeAuth?.runtime !== 'wsl' ||
+      !claudeAuth.wslLinuxConfigDir ||
+      !parseWslUncPath(args.workspacePath)
+    ) {
+      return null
+    }
+    const legacyFile = join(claudeAuth.configDir, '.config.json')
+    return {
+      configFile: existsSync(legacyFile)
+        ? legacyFile
+        : claudeAuth.envPatch.CLAUDE_CONFIG_DIR
+          ? join(claudeAuth.configDir, '.claude.json')
+          : join(dirname(claudeAuth.configDir), '.claude.json'),
+      keyStyle: 'posix',
+      toClaudePath: (hostPath) => parseWslUncPath(hostPath)?.linuxPath ?? null
+    }
+  }
+  const style = process.platform === 'win32' ? 'win32' : 'posix'
+  const homeDir = (style === 'win32' ? args.env.USERPROFILE : args.env.HOME) || homedir()
+  return {
+    configFile: resolveClaudeGlobalConfigFile({
+      env: args.env,
+      homeDir,
+      style,
+      exists: existsSync
+    }),
+    keyStyle: style
+  }
+}
+
+/** Grants trust for `workspacePath` in the config `target` names. */
+export async function grantClaudeWorkspaceTrust(
+  target: ClaudeTrustConfigTarget,
+  workspacePath: string
+): Promise<ClaudeFolderTrustOutcome> {
+  const folderKeys = claudeTrustKeysForHostPath(workspacePath, target.keyStyle, target.toClaudePath)
+  return folderKeys.length === 0
+    ? 'unchanged'
+    : grantClaudeFolderTrust({ configFile: target.configFile, folderKeys })
+}
diff --git a/src/main/claude/claude-hook-event-install.test.ts b/src/main/claude/claude-hook-event-install.test.ts
new file mode 100644
index 00000000000..99af9a3fa53
--- /dev/null
+++ b/src/main/claude/claude-hook-event-install.test.ts
@@ -0,0 +1,187 @@
+import { describe, expect, it } from 'vitest'
+import type { HooksConfig } from '../agent-hooks/installer-utils'
+import fixture from './__fixtures__/claude-hook-event-enums.json'
+import { CLAUDE_HOOK_EVENT_FIRST_VERSIONS } from './claude-hook-event-versions'
+import { getClaudeManagedHookPlan } from './claude-managed-hook-events'
+import { applyManagedHooks } from './hook-settings'
+
+const SCRIPT_FILE_NAME = 'claude-hook.sh'
+const MANAGED_COMMAND = '/home/dev/.orca/agent-hooks/claude-hook.sh'
+const managedHook = { type: 'command' as const, command: MANAGED_COMMAND }
+const enums: Record<string, string[]> = fixture.enums
+const topLevelSettings: Record<string, { keys: string[] }> = fixture.topLevelSettings
+
+function install(config: HooksConfig, claudeVersion: string | undefined): HooksConfig {
+  return applyManagedHooks(
+    config,
+    managedHook,
+    SCRIPT_FILE_NAME,
+    getClaudeManagedHookPlan(claudeVersion)
+  )
+}
+
+function managedEvents(config: HooksConfig): string[] {
+  return Object.entries(config.hooks ?? {})
+    .filter(([, definitions]) =>
+      (definitions ?? []).some((definition) =>
+        (definition.hooks ?? []).some((hook) => hook.command === MANAGED_COMMAND)
+      )
+    )
+    .map(([event]) => event)
+    .sort()
+}
+
+const userHook = (event: string) => ({
+  hooks: [{ type: 'command' as const, command: `echo user-${event}` }]
+})
+
+// Why: the user owns every event, managed or not, plus the keys an invalid file would discard.
+function userOwnedSettings(): HooksConfig {
+  const events = [...Object.keys(CLAUDE_HOOK_EVENT_FIRST_VERSIONS), 'Notification']
+  return {
+    env: { CLAUDE_CODE_USE_BEDROCK: '1' },
+    permissions: { allow: ['Bash(git status)'] },
+    hooks: Object.fromEntries(events.map((event) => [event, [userHook(event)]]))
+  }
+}
+
+function expectUserSettingsKept(config: HooksConfig): void {
+  expect(config.env).toEqual({ CLAUDE_CODE_USE_BEDROCK: '1' })
+  expect(config.permissions).toEqual({ allow: ['Bash(git status)'] })
+  for (const [event, definitions] of Object.entries(userOwnedSettings().hooks ?? {})) {
+    expect(config.hooks?.[event], event).toContainEqual(definitions?.[0])
+  }
+}
+
+describe('Claude managed hook events by resolved version', () => {
+  it.each(Object.keys(enums))('writes only events Claude %s knows', (version) => {
+    const written = install({ hooks: {} }, version)
+    const unknown = Object.keys(written.hooks ?? {}).filter(
+      (event) => !enums[version].includes(event)
+    )
+    expect(unknown).toEqual([])
+  })
+
+  it.each(Object.keys(topLevelSettings))(
+    'writes statusLine only if Claude %s knows it',
+    (version) => {
+      const plan = getClaudeManagedHookPlan(version)
+      expect(plan.statusLine === 'install').toBe(
+        topLevelSettings[version].keys.includes('statusLine')
+      )
+    }
+  )
+
+  it('omits every event newer than an old Claude', () => {
+    expect(managedEvents(install({ hooks: {} }, '2.1.32 (Claude Code)'))).toEqual(
+      [
+        'PermissionRequest',
+        'PostToolUse',
+        'PostToolUseFailure',
+        'PreToolUse',
+        'SessionStart',
+        'Stop',
+        'SubagentStart',
+        'SubagentStop',
+        'UserPromptSubmit'
+      ].sort()
+    )
+  })
+
+  it.each([undefined, 'unknown'])(
+    'writes only the core lifecycle events when the version is %s',
+    (version) => {
+      expect(managedEvents(install({ hooks: {} }, version))).toEqual(
+        [
+          'PostToolUse',
+          'PreToolUse',
+          'SessionStart',
+          'Stop',
+          'SubagentStop',
+          'UserPromptSubmit'
+        ].sort()
+      )
+    }
+  )
+
+  it.each([undefined, 'unknown'])(
+    'leaves Orca entries a version-aware install wrote untouched when the version is %s',
+    (version) => {
+      const current = install(userOwnedSettings(), '2.1.261')
+      expect(JSON.stringify(install(current, version))).toBe(JSON.stringify(current))
+
+      // Why: even an entry from an older hook command stays byte-identical; only a known version may rewrite it.
+      const staleHook = {
+        type: 'command' as const,
+        command: '/old/.orca/agent-hooks/claude-hook.sh'
+      }
+      const stale = { hooks: { StopFailure: [{ hooks: [staleHook] }] } }
+      const written = install(stale, version)
+      expect(JSON.stringify(written.hooks?.StopFailure)).toBe(
+        JSON.stringify(stale.hooks.StopFailure)
+      )
+      expect(managedEvents(written)).toEqual(
+        [
+          'PostToolUse',
+          'PreToolUse',
+          'SessionStart',
+          'Stop',
+          'SubagentStop',
+          'UserPromptSubmit'
+        ].sort()
+      )
+    }
+  )
+
+  it('adds the newer events once the resolved Claude is upgraded', () => {
+    const old = install({ hooks: {} }, '2.1.77')
+    expect(old.hooks?.StopFailure).toBeUndefined()
+
+    const upgraded = install(old, '2.1.78')
+
+    expect(managedEvents(upgraded)).toContain('StopFailure')
+    expect(managedEvents(upgraded)).toContain('PostCompact')
+    expect(upgraded.hooks?.StopFailure).toEqual([{ hooks: [managedHook] }])
+  })
+
+  it('removes only Orca entries for events a downgraded Claude does not know', () => {
+    const current = install({ hooks: {} }, '2.1.261')
+    expect(managedEvents(current)).toContain('SessionEnd')
+
+    const downgraded = install(current, '2.1.32')
+
+    for (const event of ['StopFailure', 'PostCompact', 'TeammateIdle', 'SessionEnd']) {
+      expect(downgraded.hooks?.[event], event).toBeUndefined()
+    }
+  })
+
+  it('gates a known Claude older than the unresolved-version set by its own enum', () => {
+    expect(managedEvents(install({ hooks: {} }, '1.0.52'))).toEqual(
+      ['PostToolUse', 'PreToolUse', 'Stop', 'SubagentStop'].sort()
+    )
+    const downgraded = install(install({ hooks: {} }, '2.1.261'), '1.0.22')
+    expect(managedEvents(downgraded)).toEqual([])
+  })
+
+  it.each(['1.0.22', '1.0.52', '1.0.81', '2.1.32', '2.1.77', '2.1.78', '2.1.261', undefined])(
+    'keeps every user-written entry and setting when installing for %s',
+    (version) => {
+      const fresh = install(userOwnedSettings(), version)
+      expectUserSettingsKept(fresh)
+      // Why: a downgrade from the newest set is the path that removes Orca entries.
+      expectUserSettingsKept(install(install(userOwnedSettings(), '2.1.261'), version))
+    }
+  )
+
+  it('leaves a user value it cannot parse under an unknown event untouched', () => {
+    const settings: HooksConfig = JSON.parse('{"hooks":{"StopFailure":[],"PostCompact":"mine"}}')
+    const written = install(settings, '2.1.32')
+    expect(written.hooks?.StopFailure).toEqual([])
+    expect(written.hooks?.PostCompact).toBe('mine')
+  })
+
+  it('keeps SessionEnd behind its measured 2.1.261 floor', () => {
+    expect(install({ hooks: {} }, '2.1.260').hooks?.SessionEnd).toBeUndefined()
+    expect(install({ hooks: {} }, '2.1.261').hooks?.SessionEnd).toEqual([{ hooks: [managedHook] }])
+  })
+})
diff --git a/src/main/claude/claude-hook-event-versions.test.ts b/src/main/claude/claude-hook-event-versions.test.ts
new file mode 100644
index 00000000000..d27705a5f54
--- /dev/null
+++ b/src/main/claude/claude-hook-event-versions.test.ts
@@ -0,0 +1,111 @@
+import { describe, expect, it } from 'vitest'
+import { compareAppVersions } from '../../shared/app-version'
+import fixture from './__fixtures__/claude-hook-event-enums.json'
+import {
+  CLAUDE_HOOK_EVENT_FIRST_VERSIONS,
+  CLAUDE_STATUS_LINE_FIRST_VERSION,
+  claudeKnowsHookEvent,
+  claudeKnowsStatusLine,
+  parseClaudeCliVersion,
+  UNRESOLVED_CLAUDE_VERSION,
+  type ClaudeHookEventName
+} from './claude-hook-event-versions'
+
+const enums: Record<string, string[]> = fixture.enums
+const previousPublished: Record<string, string> = fixture.previousPublishedVersion
+const topLevelSettings: Record<string, { strict: boolean; keys: string[] }> =
+  fixture.topLevelSettings
+const versions = Object.keys(enums).sort(compareAppVersions)
+const isTableEvent = (name: string): name is ClaudeHookEventName =>
+  name in CLAUDE_HOOK_EVENT_FIRST_VERSIONS
+const tableEntries = Object.keys(CLAUDE_HOOK_EVENT_FIRST_VERSIONS)
+  .filter(isTableEvent)
+  .map((event): [ClaudeHookEventName, string] => [event, CLAUDE_HOOK_EVENT_FIRST_VERSIONS[event]])
+
+describe('Claude hook event version table', () => {
+  it.each(tableEntries)('pins %s to the first release whose enum knows it', (event, first) => {
+    expect(versions.find((version) => enums[version].includes(event))).toBe(first)
+    for (const version of versions) {
+      expect(enums[version].includes(event), `${event} in ${version}`).toBe(
+        compareAppVersions(version, first) >= 0
+      )
+    }
+    // Why: the release published just before `first` lacks the event, so the table is exact, not just safe.
+    const before = previousPublished[first]
+    expect(enums[before], `enum for ${before}`).toBeDefined()
+    expect(enums[before]).not.toContain(event)
+  })
+})
+
+describe('Claude statusLine version floor', () => {
+  it('pins statusLine to the first release whose settings schema knows it', () => {
+    for (const [version, schema] of Object.entries(topLevelSettings)) {
+      expect(schema.keys.includes('statusLine'), version).toBe(
+        compareAppVersions(version, CLAUDE_STATUS_LINE_FIRST_VERSION) >= 0
+      )
+    }
+    // Why: the release just before rejects the unknown key, so the floor is exact, not just safe.
+    const before = previousPublished[CLAUDE_STATUS_LINE_FIRST_VERSION]
+    expect(topLevelSettings[before].strict).toBe(true)
+    expect(topLevelSettings[before].keys).not.toContain('statusLine')
+  })
+
+  it.each([
+    ['1.0.63', false],
+    ['1.0.64 (Claude Code)', true],
+    [undefined, true]
+  ] as const)('%s knows statusLine: %s', (version, expected) => {
+    expect(claudeKnowsStatusLine(version)).toBe(expected)
+  })
+})
+
+describe('claudeKnowsHookEvent', () => {
+  it.each([
+    ['2.1.77', 'StopFailure', false],
+    ['2.1.78 (Claude Code)', 'StopFailure', true],
+    ['2.1.75', 'PostCompact', false],
+    ['2.1.76', 'PostCompact', true],
+    ['2.1.32', 'TeammateIdle', false],
+    ['2.0.55', 'PostToolUseFailure', false],
+    ['2.0.44', 'PermissionRequest', false],
+    ['2.0.42', 'SubagentStart', false],
+    ['1.0.84', 'SessionEnd', false],
+    ['1.0.61', 'SessionStart', false],
+    ['1.0.62', 'SessionStart', true],
+    ['1.0.52', 'UserPromptSubmit', false],
+    ['1.0.40', 'SubagentStop', false],
+    ['1.0.30', 'Stop', false],
+    ['1.0.22', 'PreToolUse', false]
+  ] as const)('%s knows %s: %s', (version, event, expected) => {
+    expect(claudeKnowsHookEvent(version, event)).toBe(expected)
+  })
+
+  it.each([undefined, null, 'unknown'])(
+    'grants an unresolved version (%s) only the events its assumed release knows',
+    (version) => {
+      const known = tableEntries
+        .filter(([event]) => claudeKnowsHookEvent(version, event))
+        .map(([event]) => event)
+      expect(known.sort()).toEqual(
+        [
+          'PostToolUse',
+          'PreToolUse',
+          'SessionStart',
+          'Stop',
+          'SubagentStop',
+          'UserPromptSubmit'
+        ].sort()
+      )
+      for (const event of known) {
+        expect(enums[UNRESOLVED_CLAUDE_VERSION]).toContain(event)
+      }
+    }
+  )
+})
+
+describe('parseClaudeCliVersion', () => {
+  it('extracts Claude Code version output', () => {
+    expect(parseClaudeCliVersion('2.1.261 (Claude Code)')).toBe('2.1.261')
+    expect(parseClaudeCliVersion('unknown')).toBeNull()
+  })
+})
diff --git a/src/main/claude/claude-hook-event-versions.ts b/src/main/claude/claude-hook-event-versions.ts
new file mode 100644
index 00000000000..5c9c28de66c
--- /dev/null
+++ b/src/main/claude/claude-hook-event-versions.ts
@@ -0,0 +1,86 @@
+import { hasReachedAppVersion, isValidAppVersion } from '../../shared/app-version'
+import { runProcess } from '../../shared/child-process/run-process'
+import path from 'node:path'
+
+// Why: Claude 1.0.23 through 2.1.100 validate `hooks` against a closed event enum and discard the
+// WHOLE settings.json (env, permissions, every user hook) on one unknown name, so an event may only
+// be written for a Claude that knows it. Values come from each release's packed enum, pinned by
+// __fixtures__/claude-hook-event-enums.json.
+export const CLAUDE_HOOK_EVENT_FIRST_VERSIONS = {
+  PreToolUse: '1.0.23',
+  PostToolUse: '1.0.23',
+  Stop: '1.0.31',
+  SubagentStop: '1.0.41',
+  UserPromptSubmit: '1.0.53',
+  SessionStart: '1.0.62',
+  SessionEnd: '1.0.85',
+  SubagentStart: '2.0.43',
+  PermissionRequest: '2.0.45',
+  PostToolUseFailure: '2.0.56',
+  TeammateIdle: '2.1.33',
+  PostCompact: '2.1.76',
+  StopFailure: '2.1.78'
+} as const
+
+// Why: 1.0.49 through 1.0.66 also discard the whole file over an unknown top-level key, and
+// `statusLine` joined their schema only in 1.0.64. Pinned by the same fixture's topLevelSettings.
+export const CLAUDE_STATUS_LINE_FIRST_VERSION = '1.0.64'
+
+// Why: an unresolved version gets what the first release accepting Orca's core lifecycle events and
+// statusLine knows, and nothing newer; a Claude older than that is gated only once its version resolves.
+export const UNRESOLVED_CLAUDE_VERSION = CLAUDE_STATUS_LINE_FIRST_VERSION
+
+export type ClaudeHookEventName = keyof typeof CLAUDE_HOOK_EVENT_FIRST_VERSIONS
+
+export function parseClaudeCliVersion(output: string | null | undefined): string | null {
+  const version = output?.match(/\b\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?\b/)?.[0]
+  return version && isValidAppVersion(version) ? version : null
+}
+
+export function claudeVersionReaches(version: string | null | undefined, floor: string): boolean {
+  const parsed = parseClaudeCliVersion(version)
+  return parsed !== null && hasReachedAppVersion(parsed, floor)
+}
+
+function claudeKnowsSince(version: string | null | undefined, firstVersion: string): boolean {
+  return hasReachedAppVersion(
+    parseClaudeCliVersion(version) ?? UNRESOLVED_CLAUDE_VERSION,
+    firstVersion
+  )
+}
+
+export function claudeKnowsHookEvent(
+  version: string | null | undefined,
+  eventName: ClaudeHookEventName
+): boolean {
+  return claudeKnowsSince(version, CLAUDE_HOOK_EVENT_FIRST_VERSIONS[eventName])
+}
+
+export function claudeKnowsStatusLine(version: string | null | undefined): boolean {
+  return claudeKnowsSince(version, CLAUDE_STATUS_LINE_FIRST_VERSION)
+}
+
+export async function probeClaudeCliVersion(executablePath: string): Promise<string | null> {
+  try {
+    const pathKey = process.platform === 'win32' && process.env.Path !== undefined ? 'Path' : 'PATH'
+    const executableDir = path.dirname(executablePath)
+    const inheritedPath = process.env[pathKey]
+    const result = await runProcess({
+      program: executablePath,
+      args: ['--version'],
+      // Why: version-manager launchers often use `#!/usr/bin/env node`; the resolved CLI's sibling
+      // runtime must remain reachable even when Electron started with a thinner PATH.
+      env: {
+        ...process.env,
+        [pathKey]: inheritedPath
+          ? `${executableDir}${path.delimiter}${inheritedPath}`
+          : executableDir
+      },
+      timeoutMs: 5_000,
+      maxOutputBytes: 4_096
+    })
+    return result.code === 0 ? parseClaudeCliVersion(`${result.stdout}\n${result.stderr}`) : null
+  } catch {
+    return null
+  }
+}
diff --git a/src/main/claude/claude-journal-translator-contract.ts b/src/main/claude/claude-journal-translator-contract.ts
index 7a7fc4291c7..45feeb84364 100644
--- a/src/main/claude/claude-journal-translator-contract.ts
+++ b/src/main/claude/claude-journal-translator-contract.ts
@@ -6,6 +6,7 @@ import type { ClaudeChildToolQueries } from './claude-child-tool-queries'
 import type { ClaudeContextReportPart, ClaudeContextReportTarget } from './claude-context-facts'
 import type { ClaudeJournalPrompts } from './claude-structured-journal-prompts'
 import type { ClaudeStructuredSessionEvent } from './claude-structured-session-state'
+import type { ClaudeCommandStart } from './claude-command-turn'
 
 export type ClaudeJournalTranslator = {
   handle: (event: ClaudeStructuredSessionEvent) => void
@@ -13,6 +14,18 @@ export type ClaudeJournalTranslator = {
   /** The open turn's provider id — the same id its journal row carries, and the one
    *  a client's Stop names. Sole owner: no reader keeps a copy to disagree with. */
   readonly currentTurnId: string | null
+  /** The open turn's id while it is a conversation command's. */
+  readonly commandTurnId: string | null
+  /** Makes the host's command turn the open one until the command's result ends it. */
+  beginCommand: (start: ClaudeCommandStart) => void
+  /** The command was never sent. */
+  forgetCommand: (turnId: string) => void
+  /** Orca asked Claude to stop the command `turnId` names. */
+  commandInterruptRequested: (turnId: string) => void
+  /** True while a turn is open and the provider's current request cycle has
+   *  done root work since its init — the state in which the CLI folds an
+   *  arriving send into the turn. */
+  readonly openTurnInLiveProviderCycle: boolean
   flush: () => void
   childToolOwner?: ClaudeChildToolQueries['childToolOwner']
   childActivity?: ClaudeChildToolQueries['childActivity']
diff --git a/src/main/claude/claude-journal-turn-scope.test.ts b/src/main/claude/claude-journal-turn-scope.test.ts
new file mode 100644
index 00000000000..fef833ced57
--- /dev/null
+++ b/src/main/claude/claude-journal-turn-scope.test.ts
@@ -0,0 +1,78 @@
+// Which turn a Claude row belongs to (B8): the root turn open when the row is written, whoever
+// produced it, and the conversation once that turn has ended.
+
+import { expect, it, vi } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity
+} from '../../shared/agent-session-journal-types'
+import type {
+  StructuredAgentSessionEventSink,
+  StructuredAgentSessionItemAppendOptions
+} from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { createClaudeJournalTranslator } from './claude-structured-journal-translation'
+
+function recorder() {
+  const writes: {
+    identity: AgentJournalItemIdentity
+    body: AgentJournalItemBody
+    options: StructuredAgentSessionItemAppendOptions
+  }[] = []
+  const sink: StructuredAgentSessionEventSink = {
+    appendItem: (identity, body, options) => writes.push({ identity, body, options }),
+    appendTombstone: vi.fn(),
+    publish: vi.fn()
+  }
+  const scopeOfProse = (text: string) =>
+    writes.findLast(
+      (write) =>
+        write.body.kind === 'message' &&
+        write.body.blocks.some((block) => block.type === 'text' && block.text === text)
+    )?.options.turnScope
+  return { sink, writes, scopeOfProse }
+}
+
+function frame(message: Record<string, unknown>, startsTurn = false) {
+  return {
+    type: 'message' as const,
+    sessionId: 'orca-session',
+    ...(startsTurn ? { startsTurn: true as const } : {}),
+    message: { session_id: 'claude-session', ...message }
+  }
+}
+
+function prose(uuid: string, text: string, parentToolUseId: string | null = null) {
+  return frame({
+    type: 'assistant',
+    uuid,
+    parent_tool_use_id: parentToolUseId,
+    message: { role: 'assistant', content: [{ type: 'text', text }] }
+  })
+}
+
+it("scopes the session's and a subagent's rows to the open turn, and a late one to none", () => {
+  const { sink, writes, scopeOfProse } = recorder()
+  const translator = createClaudeJournalTranslator({ sink, fallbackIdPrefix: 'test' })
+  translator.handle(
+    frame(
+      {
+        type: 'user',
+        uuid: 'user-1',
+        parent_tool_use_id: null,
+        message: { role: 'user', content: [{ type: 'text', text: 'go' }] }
+      },
+      true
+    )
+  )
+  translator.handle(prose('assistant-1', 'Working on it'))
+  translator.handle(prose('child-1', 'Child mid-turn', 'toolu_1'))
+  translator.handle(frame({ type: 'result', subtype: 'success', uuid: 'result-1', result: 'ok' }))
+  translator.handle(prose('child-2', 'Child after the turn', 'toolu_1'))
+
+  const turnRecord = writes.find((write) => write.body.kind === 'turn')
+  expect(turnRecord?.options.turnScope).toEqual({ kind: 'thread' })
+  const turnKey = expect.stringContaining('turn-lifecycle')
+  expect(scopeOfProse('Working on it')).toEqual({ kind: 'turn', turnItemId: turnKey })
+  expect(scopeOfProse('Child mid-turn')).toEqual({ kind: 'turn', turnItemId: turnKey })
+  expect(scopeOfProse('Child after the turn')).toEqual({ kind: 'thread' })
+})
diff --git a/src/main/claude/claude-managed-hook-events.ts b/src/main/claude/claude-managed-hook-events.ts
new file mode 100644
index 00000000000..dbbb8ae15a2
--- /dev/null
+++ b/src/main/claude/claude-managed-hook-events.ts
@@ -0,0 +1,124 @@
+import type { HookDefinition } from '../agent-hooks/installer-utils'
+import {
+  claudeKnowsHookEvent,
+  claudeKnowsStatusLine,
+  claudeVersionReaches,
+  parseClaudeCliVersion
+} from './claude-hook-event-versions'
+
+export const CLAUDE_EVENTS = [
+  // Why: SessionStart is the only event a resumed/idle session emits before the
+  // first prompt; without it the sidebar row can't exist until the user types (STA-3386).
+  {
+    eventName: 'SessionStart',
+    definition: { hooks: [{ type: 'command', command: '' }] }
+  },
+  {
+    eventName: 'UserPromptSubmit',
+    definition: { hooks: [{ type: 'command', command: '' }] }
+  },
+  {
+    eventName: 'Stop',
+    definition: { hooks: [{ type: 'command', command: '' }] }
+  },
+  // Why: OpenClaude skips normal Stop hooks after API/model errors and emits
+  // StopFailure instead; without this hook Orca leaves the turn spinning.
+  {
+    eventName: 'StopFailure',
+    definition: { hooks: [{ type: 'command', command: '' }] }
+  },
+  // Why: subagent/teammate lifecycle feeds the sidebar's child rows and keeps
+  // a pane 'working' while background children outlive the lead's turn.
+  // TeammateIdle parks turn-based teammates without trusting their permanently
+  // "running" background_tasks entry to gate the pane.
+  {
+    eventName: 'SubagentStart',
+    definition: { hooks: [{ type: 'command', command: '' }] }
+  },
+  {
+    eventName: 'SubagentStop',
+    definition: { hooks: [{ type: 'command', command: '' }] }
+  },
+  {
+    eventName: 'TeammateIdle',
+    definition: { hooks: [{ type: 'command', command: '' }] }
+  },
+  // Why: PreToolUse gives the dashboard a live readout of the in-flight tool
+  // (name + input preview) before it completes.
+  {
+    eventName: 'PreToolUse',
+    definition: { matcher: '*', hooks: [{ type: 'command', command: '' }] }
+  },
+  {
+    eventName: 'PostToolUse',
+    definition: { matcher: '*', hooks: [{ type: 'command', command: '' }] }
+  },
+  {
+    eventName: 'PostToolUseFailure',
+    definition: { matcher: '*', hooks: [{ type: 'command', command: '' }] }
+  },
+  {
+    eventName: 'PermissionRequest',
+    definition: { matcher: '*', hooks: [{ type: 'command', command: '' }] }
+  },
+  // Why: a manual /compact ends at an idle prompt without emitting Stop, so PostCompact is the only
+  // signal that can clear the pane (STA-2915). PreCompact is deliberately NOT registered: it fires
+  // before the compact is validated, and an aborted compact emits it alone — mapping it to 'working'
+  // would strand the pane exactly as this registration is meant to prevent (STA-4613).
+  {
+    eventName: 'PostCompact',
+    definition: { hooks: [{ type: 'command', command: '' }] }
+  }
+] as const
+
+const CLAUDE_SESSION_END_EVENT = {
+  eventName: 'SessionEnd',
+  // Why: Claude knows SessionEnd from 1.0.85, but 2.1.261 is the only version its delivery was measured on.
+  installFrom: '2.1.261',
+  definition: { hooks: [{ type: 'command', command: '' }] }
+} as const
+
+export const CLAUDE_MANAGED_EVENTS = [...CLAUDE_EVENTS, CLAUDE_SESSION_END_EVENT] as const
+
+export type ManagedHookEvent = {
+  eventName: string
+  definition: Omit<HookDefinition, 'hooks'>
+}
+
+export type ClaudeManagedHookPlan = {
+  install: readonly ManagedHookEvent[]
+  /** Events whose Orca entry must go; user entries under them always stay. */
+  retire: readonly ManagedHookEvent[]
+  /** Orca's statusLine usage feed; `retire` removes only Orca's own, `leave` never touches the slot. */
+  statusLine: 'install' | 'retire' | 'leave'
+}
+
+/** What to write for a Claude of this version; see claude-hook-event-versions.ts. */
+export function getClaudeManagedHookPlan(
+  claudeVersion: string | null | undefined
+): ClaudeManagedHookPlan {
+  const install = CLAUDE_MANAGED_EVENTS.filter(
+    (event) =>
+      claudeKnowsHookEvent(claudeVersion, event.eventName) &&
+      (!('installFrom' in event) || claudeVersionReaches(claudeVersion, event.installFrom))
+  )
+  // Why: an unresolved version (e.g. a probe timeout) is no evidence of an old Claude, so it must
+  // not strip entries an install that knew the version wrote; only a known version retires events.
+  const retire =
+    parseClaudeCliVersion(claudeVersion) === null
+      ? []
+      : CLAUDE_MANAGED_EVENTS.filter((event) => !install.includes(event))
+  return {
+    install,
+    retire,
+    statusLine: claudeKnowsStatusLine(claudeVersion) ? 'install' : 'retire'
+  }
+}
+
+// Why: OpenClaude reads its own settings file and accepts every event Orca writes. The statusline
+// usage feed is Claude-only — OpenClaude data would be misattributed to the Claude provider.
+export const OPENCLAUDE_MANAGED_HOOK_PLAN: ClaudeManagedHookPlan = {
+  install: CLAUDE_EVENTS,
+  retire: [CLAUDE_SESSION_END_EVENT],
+  statusLine: 'leave'
+}
diff --git a/src/main/claude/claude-model-catalog-probe.ts b/src/main/claude/claude-model-catalog-probe.ts
index 882f716c3c9..f3a2646107c 100644
--- a/src/main/claude/claude-model-catalog-probe.ts
+++ b/src/main/claude/claude-model-catalog-probe.ts
@@ -60,7 +60,7 @@ export function createClaudeModelCatalogProbe(
         ...(model.description ? { description: model.description } : {}),
         isDefault: model.isDefault === true,
         // No defaultEffort: the listing's thinking default is the commit-message generator's
-        // choice, not the effort Claude runs, and a live session's listing never names one.
+        // choice, not the effort Claude runs; the store keeps the one a live child reported.
         efforts: (model.thinkingLevels ?? []).map((level) => ({
           value: level.id,
           label: level.label
diff --git a/src/main/claude/claude-open-turn.ts b/src/main/claude/claude-open-turn.ts
index 08a7916a97b..864624fe59e 100644
--- a/src/main/claude/claude-open-turn.ts
+++ b/src/main/claude/claude-open-turn.ts
@@ -5,15 +5,21 @@
 // keeping a copy, so there is nothing to disagree with.
 
 import type { AgentSessionContextUsage } from '../../shared/agent-session-context-usage'
-import type { AgentJournalItemIdentity } from '../../shared/agent-session-journal-types'
+import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalItemIdentity,
+  type AgentJournalTurnScope
+} from '../../shared/agent-session-journal-types'
 import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
 import {
-  claudeTurnLifecycleIdentity,
+  claudeCurrentTurnIdentity,
   claudeTurnLifecycleItem,
   type ClaudeCurrentTurn,
   type ClaudeTurnEnd
 } from './claude-turn-lifecycle-item'
 import { writeClaudeTurnRow } from './claude-turn-row-revision'
+import type { ClaudeCommandTurn } from './claude-command-turn'
 import { createClaudeTurnOpener, type ClaudeTurnSource } from './claude-turn-opening'
 
 export type ClaudeOpenTurnDeps = {
@@ -30,6 +36,11 @@ export class ClaudeOpenTurn {
    *  failed: nothing would ever close the turn it opened, and the row would read
    *  working for the life of the session. Only an accepted send lifts it. */
   private reopenSuppressed = false
+  /** Whether the provider's current request cycle has done root work — a send
+   *  echo or model output — since its init. Output can open a turn ahead of its
+   *  cycle's init (a background task finishing), so membership is read from the
+   *  cycle's work, not from when the turn opened. */
+  private cycleWorkObserved = false
   private readonly opener: (
     frame: Record<string, unknown>,
     source: ClaudeTurnSource | null,
@@ -50,9 +61,21 @@ export class ClaudeOpenTurn {
 
   /** The open turn's row, where a fact about the running turn lands. */
   get identity(): AgentJournalItemIdentity | null {
-    return this.current
-      ? claudeTurnLifecycleIdentity(this.current.sessionId, this.current.turnId)
-      : null
+    return this.current ? claudeCurrentTurnIdentity(this.current) : null
+  }
+
+  /** The conversation command the open turn is, if it is one. */
+  get command(): ClaudeCommandTurn | null {
+    return this.current?.command ?? null
+  }
+
+  /** Which turn a row written now belongs to: the open one, or none. A subagent's rows too —
+   *  its work is its parent turn's. */
+  get turnScope(): AgentJournalTurnScope {
+    const identity = this.identity
+    return identity
+      ? { kind: 'turn', turnItemId: agentJournalItemKey(identity) }
+      : AGENT_JOURNAL_THREAD_SCOPE
   }
 
   get groupKey(): string | null {
@@ -63,6 +86,23 @@ export class ClaudeOpenTurn {
     return this.current !== null
   }
 
+  /** Whether a turn is open inside a provider request cycle that has already
+   *  done work — the state in which the CLI folds an arriving send into it. A
+   *  cycle's first send is its opener, never a fold. */
+  get openedInLiveProviderCycle(): boolean {
+    return this.current !== null && this.cycleWorkObserved
+  }
+
+  /** A root init frame: the CLI is starting a new request cycle. */
+  observeProviderCycleStart(): void {
+    this.cycleWorkObserved = false
+  }
+
+  /** A root send echo or model output inside the current request cycle. */
+  observeProviderCycleWork(): void {
+    this.cycleWorkObserved = true
+  }
+
   /** Open a turn, ending whichever one was still open. A new turn starting is the
    *  only end the previous one gets when its result never arrives; settling it
    *  later would sweep THIS turn. */
@@ -77,6 +117,32 @@ export class ClaudeOpenTurn {
     this.deps.sink.setActivity?.(null)
   }
 
+  /** A conversation command the host opened a turn for. Its row is the host's, already written,
+   *  so only an end is published; the command's result is what ends it. */
+  beginCommand(turn: ClaudeCurrentTurn): void {
+    this.deps.onOpen?.()
+    if (this.current) {
+      this.deps.settleChildren(this.groupKey)
+      this.publish(this.current, { state: 'interrupted', completedAt: turn.startedAt })
+    }
+    this.current = turn
+    this.deps.sink.setActivity?.(null)
+  }
+
+  /** Orca asked the provider to stop the command `turnId` names. */
+  commandInterruptRequested(turnId: string): void {
+    if (this.current?.command && this.current.turnId === turnId) {
+      this.current.command.interruptRequested = true
+    }
+  }
+
+  /** The command was never sent; its turn is the host's to settle. */
+  forgetCommand(turnId: string): void {
+    if (this.current?.command && this.current.turnId === turnId) {
+      this.current = null
+    }
+  }
+
   /** The provider produced, so a turn is running. Idempotent: every frame of one
    *  reply stays inside the turn its first frame opened. A subagent's output is
    *  its parent turn's work and never a turn of its own. */
@@ -91,6 +157,8 @@ export class ClaudeOpenTurn {
   /** End the open turn, if one is open, and clear the live activity line. The
    *  context facts the end brings ride the same revision. */
   settle(end: ClaudeTurnEnd, contextUsage?: AgentSessionContextUsage): void {
+    // Every settle is a provider cycle ending (result, idle, child exit).
+    this.cycleWorkObserved = false
     if (this.current) {
       this.publish(this.current, end, contextUsage)
       this.current = null
diff --git a/src/main/claude/claude-prompt-journaling.ts b/src/main/claude/claude-prompt-journaling.ts
deleted file mode 100644
index 99b163fe197..00000000000
--- a/src/main/claude/claude-prompt-journaling.ts
+++ /dev/null
@@ -1,46 +0,0 @@
-// Journaling an approval or question prompt, and remembering the rows it wrote
-// so a cancellation can tombstone exactly those.
-
-import type { AgentJournalItemIdentity } from '../../shared/agent-session-journal-types'
-import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
-import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
-import type { ClaudeStructuredSessionEvent } from './claude-structured-session-state'
-import {
-  claudeApprovalItem,
-  claudePromptIdentity,
-  claudeQuestionItems
-} from './claude-structured-prompt-items'
-
-export type ClaudePromptJournalDeps = {
-  sink: StructuredAgentSessionEventSink
-  bindPromptItemId?: (journalItemId: string, promptKey: string, questionId?: string) => void
-  /** Prompt key → the rows it wrote, owned by the translator so a cancel can sweep them. */
-  promptItems: Map<string, AgentJournalItemIdentity[]>
-}
-
-export function journalClaudePrompt(
-  deps: ClaudePromptJournalDeps,
-  event: Extract<ClaudeStructuredSessionEvent, { type: 'prompt' }>
-): void {
-  const identities: AgentJournalItemIdentity[] = []
-  if (event.prompt.kind === 'question') {
-    for (const question of claudeQuestionItems({
-      sessionId: event.sessionId,
-      prompt: event.prompt
-    })) {
-      identities.push(question.identity)
-      deps.sink.appendItem(question.identity, question.body)
-      deps.bindPromptItemId?.(agentJournalItemKey(question.identity), event.prompt.promptKey)
-    }
-  } else {
-    const identity = claudePromptIdentity({
-      sessionId: event.sessionId,
-      promptKey: event.prompt.promptKey
-    })
-    identities.push(identity)
-    deps.sink.appendItem(identity, claudeApprovalItem(event.prompt))
-    deps.bindPromptItemId?.(agentJournalItemKey(identity), event.prompt.promptKey)
-  }
-  deps.promptItems.set(event.prompt.promptKey, identities)
-  deps.sink.publish()
-}
diff --git a/src/main/claude/claude-prompt-registry.ts b/src/main/claude/claude-prompt-registry.ts
index 3437dba93dc..5cd2f6b1a7b 100644
--- a/src/main/claude/claude-prompt-registry.ts
+++ b/src/main/claude/claude-prompt-registry.ts
@@ -26,7 +26,6 @@ export type ClaudePendingPrompt = ClaudePromptPresentation & {
   input: Record<string, unknown>
   suggestions: PermissionUpdate[]
   questionIds: readonly string[]
-  answers: Map<string, string | readonly string[]>
   settle: ClaudePromptSettle
   turnId?: string | null
 }
@@ -43,13 +42,12 @@ export type ClaudePromptRegistration = ClaudePromptPresentation & {
 
 type PromptBinding = {
   address: string
-  questionId?: string
   turnId: string | null
 }
 
 export type ClaudePromptClaim = {
   readonly itemId: string
-  readonly found: { prompt: ClaudePendingPrompt; questionId?: string }
+  readonly found: { prompt: ClaudePendingPrompt }
 }
 
 type ClaudePromptCancellationObservation = {
@@ -111,7 +109,6 @@ export class ClaudePromptRegistry {
       ...(registration.matchedAskRule ? { matchedAskRule: registration.matchedAskRule } : {}),
       ...(registration.subject ? { subject: registration.subject } : {}),
       questionIds: questions.map(questionId),
-      answers: new Map(),
       settle: registration.settle,
       turnId: registration.turnId ?? null
     }
@@ -130,26 +127,18 @@ export class ClaudePromptRegistry {
     return true
   }
 
-  bindJournalItemId(
-    journalItemId: string,
-    promptKey: string,
-    questionIdForItem?: string,
-    turnId: string | null = null
-  ): void {
+  bindJournalItemId(journalItemId: string, promptKey: string, turnId: string | null = null): void {
     const prompt = this.prompts.get(promptKey)
     this.journalBindings.set(journalItemId, {
       address: promptKey,
-      ...(questionIdForItem ? { questionId: questionIdForItem } : {}),
       turnId: turnId ?? prompt?.turnId ?? null
     })
   }
 
-  find(itemId: string): { prompt: ClaudePendingPrompt; questionId?: string } | null {
+  find(itemId: string): { prompt: ClaudePendingPrompt } | null {
     const binding = this.journalBindings.get(itemId)
     const prompt = this.prompts.get(binding?.address ?? itemId)
-    return prompt
-      ? { prompt, ...(binding?.questionId ? { questionId: binding.questionId } : {}) }
-      : null
+    return prompt ? { prompt } : null
   }
 
   claim(itemId: string, kind?: 'approval' | 'question'): ClaudePromptClaim | null {
@@ -168,8 +157,7 @@ export class ClaudePromptRegistry {
     if (!binding || !prompt || binding.turnId !== turnId || this.claims.has(prompt)) {
       return null
     }
-    const found = { prompt, ...(binding.questionId ? { questionId: binding.questionId } : {}) }
-    const claim = { itemId, found }
+    const claim = { itemId, found: { prompt } }
     this.claims.set(prompt, claim)
     return claim
   }
diff --git a/src/main/claude/claude-provisional-row-corrections.test.ts b/src/main/claude/claude-provisional-row-corrections.test.ts
index d18a71a17fe..cb317c5ca86 100644
--- a/src/main/claude/claude-provisional-row-corrections.test.ts
+++ b/src/main/claude/claude-provisional-row-corrections.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../shared/agent-session-journal-types'
 import { describe, expect, it } from 'vitest'
 import type {
   AgentJournalItemBody,
@@ -38,6 +39,7 @@ function ledger(initial: Record<string, ClaudeSubagentLinkageVerdict> = {}) {
       : { kind: 'linked', linkage: { agentId: ref, providerParentRef: ref, producerKind: 'agent' } }
   }
   const corrections = new ClaudeProvisionalRowCorrections({
+    turnScope: () => AGENT_JOURNAL_THREAD_SCOPE,
     linkageFor: (ref) => verdicts.get(ref) ?? { kind: 'pending' },
     settledLinkageFor: (ref) => {
       const verdict = settledFor(ref)
@@ -71,9 +73,11 @@ function ledger(initial: Record<string, ClaudeSubagentLinkageVerdict> = {}) {
 }
 
 describe('ClaudeProvisionalRowCorrections', () => {
-  it("stamps the session's own rows with nothing and owes them nothing", () => {
+  it("stamps the session's own rows with no producer and owes them nothing", () => {
     const { corrections, rewrites } = ledger()
-    expect(corrections.stampFor(null)(identityOf('toolu_2'), RUNNING)).toEqual({})
+    expect(corrections.stampFor(null)(identityOf('toolu_2'), RUNNING)).toEqual({
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     expect(corrections.pending).toBe(0)
     corrections.retry()
     expect(rewrites).toEqual([])
diff --git a/src/main/claude/claude-provisional-row-corrections.ts b/src/main/claude/claude-provisional-row-corrections.ts
index a4b7d039902..92064e23f02 100644
--- a/src/main/claude/claude-provisional-row-corrections.ts
+++ b/src/main/claude/claude-provisional-row-corrections.ts
@@ -21,9 +21,11 @@ import { agentJournalLinkageFields } from '../../shared/agent-session-journal-pr
 import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
 import type {
   AgentJournalItemBody,
-  AgentJournalItemIdentity
+  AgentJournalItemIdentity,
+  AgentJournalProducerLinkage,
+  AgentJournalTurnScope
 } from '../../shared/agent-session-journal-types'
-import type { StructuredAgentSessionAppendOptions } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import type { StructuredAgentSessionItemAppendOptions } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
 import type { ClaudeSubagentLinkageSource } from './claude-subagent-linkage'
 
 /**
@@ -36,12 +38,7 @@ import type { ClaudeSubagentLinkageSource } from './claude-subagent-linkage'
 export type ClaudeRowStamp = (
   identity: AgentJournalItemIdentity,
   body: AgentJournalItemBody
-) => StructuredAgentSessionAppendOptions
-
-/** The session's own agent wrote this row: nothing is stamped, nothing is owed.
- *  Only for a site with no ledger to consult; a ledger-backed root write goes
- *  through `stampFor(null)`, which also supersedes anything owed to the row. */
-export const rootClaudeRowStamp: ClaudeRowStamp = () => ({})
+) => StructuredAgentSessionItemAppendOptions
 
 /** Corrections outstanding at once, across every producer. */
 const MAX_OUTSTANDING_CORRECTIONS = 256
@@ -57,17 +54,19 @@ type OutstandingCorrection = {
    *  a tool call and its result do — and a correction carrying the older body
    *  would revert the row it is only meant to re-attribute. */
   body: AgentJournalItemBody
-  stamped: StructuredAgentSessionAppendOptions
+  stamped: StructuredAgentSessionItemAppendOptions
 }
 
 export type ClaudeProvisionalRowCorrectionsDeps = ClaudeSubagentLinkageSource & {
+  /** The turn a row written now belongs to: the open root turn, whoever produced the row. */
+  turnScope: () => AgentJournalTurnScope
   /** Re-appends a row under its own identity, which revises it in place.
    *  Returns whether the write was ADMITTED: a sink under backpressure refuses,
    *  and a correction dropped on a refusal is an obligation nothing re-derives. */
   rewrite: (
     identity: AgentJournalItemIdentity,
     body: AgentJournalItemBody,
-    options: StructuredAgentSessionAppendOptions
+    options: StructuredAgentSessionItemAppendOptions
   ) => boolean
   publish: () => void
 }
@@ -92,12 +91,12 @@ export class ClaudeProvisionalRowCorrections {
     if (parentToolUseId === null) {
       return (identity) => {
         this.supersede(identity)
-        return {}
+        return { turnScope: this.deps.turnScope() }
       }
     }
     return (identity, body) => {
       const provisional = this.deps.linkageFor(parentToolUseId).kind === 'pending'
-      const options = this.stamp(parentToolUseId)
+      const options = { ...this.stamp(parentToolUseId), turnScope: this.deps.turnScope() }
       if (provisional) {
         this.remember(parentToolUseId, identity, body, options)
       } else {
@@ -160,7 +159,7 @@ export class ClaudeProvisionalRowCorrections {
     this.outstanding.delete(agentJournalItemKey(identity))
   }
 
-  private stamp(parentToolUseId: string): StructuredAgentSessionAppendOptions {
+  private stamp(parentToolUseId: string): ReturnType<typeof agentJournalLinkageFields> {
     return agentJournalLinkageFields(this.deps.settledLinkageFor(parentToolUseId).linkage)
   }
 
@@ -171,14 +170,16 @@ export class ClaudeProvisionalRowCorrections {
     if (sameLinkage(options, correction.stamped)) {
       return 'unchanged'
     }
-    return this.deps.rewrite(correction.identity, correction.body, options) ? 'wrote' : 'refused'
+    // A re-stamp revises the row, so its scope stays the one it was created with.
+    const restamped = { ...options, turnScope: correction.stamped.turnScope }
+    return this.deps.rewrite(correction.identity, correction.body, restamped) ? 'wrote' : 'refused'
   }
 
   private remember(
     ref: string,
     identity: AgentJournalItemIdentity,
     body: AgentJournalItemBody,
-    stamped: StructuredAgentSessionAppendOptions
+    stamped: StructuredAgentSessionItemAppendOptions
   ): void {
     if (this.givenUp.has(ref)) {
       return
@@ -233,8 +234,8 @@ export class ClaudeProvisionalRowCorrections {
 }
 
 function sameLinkage(
-  left: StructuredAgentSessionAppendOptions,
-  right: StructuredAgentSessionAppendOptions
+  left: AgentJournalProducerLinkage,
+  right: AgentJournalProducerLinkage
 ): boolean {
   return (
     left.agentId === right.agentId &&
diff --git a/src/main/claude/claude-real-cli-availability-test-support.ts b/src/main/claude/claude-real-cli-availability-test-support.ts
new file mode 100644
index 00000000000..faa322c456b
--- /dev/null
+++ b/src/main/claude/claude-real-cli-availability-test-support.ts
@@ -0,0 +1,64 @@
+// Whether a real, signed-in Claude CLI is present — the gate every real-CLI
+// suite skips on. Probed once per test process.
+
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import { runProcessSync, type ProcessResult } from '../../shared/child-process/run-process'
+import { withCliRuntimeOnPath } from '../../shared/node-cli-command-resolution'
+import { CLAUDE_AUTH_ENV_VARS } from '../claude-accounts/environment'
+import { resolveClaudeCommand } from '../codex-cli/command'
+
+export const realClaudeCommand = resolveClaudeCommand()
+
+// Why paired: the probe must run the CLI under the same node the structured launch gives it.
+function probeRealClaude(args: string[]): ProcessResult | null {
+  try {
+    return runProcessSync({
+      program: realClaudeCommand,
+      args,
+      env: withCliRuntimeOnPath(realClaudeCommand, process.env),
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeoutMs: 5_000
+    })
+  } catch {
+    return null
+  }
+}
+
+export const realClaudeAvailable = probeRealClaude(['--version'])?.code === 0
+
+/** The CLI's own account report — the only source of truth for where it writes that
+ *  is not derived from Orca's own path expressions. */
+export const realClaudeAuthStatus = (() => {
+  if (!realClaudeAvailable) {
+    return null
+  }
+  const result = probeRealClaude(['auth', 'status', '--json'])
+  if (!result || result.code !== 0) {
+    return null
+  }
+  try {
+    return JSON.parse(result.stdout) as { loggedIn?: boolean; projectsDirectory?: string }
+  } catch {
+    return null
+  }
+})()
+
+export const realClaudeAuthenticated = realClaudeAuthStatus?.loggedIn === true
+
+/** The config dir and env auth the availability probe above saw, for a real-CLI launch.
+ *  The connection strips an inherited CLAUDE_CONFIG_DIR and inherited auth vars, so
+ *  without these the child silently runs against ~/.claude whatever the probe checked. */
+export function realClaudeLaunchHome(): { claudeConfigDir: string; env: Record<string, string> } {
+  const env: Record<string, string> = {}
+  for (const key of CLAUDE_AUTH_ENV_VARS) {
+    const value = process.env[key]
+    if (value) {
+      env[key] = value
+    }
+  }
+  return {
+    claudeConfigDir: process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), '.claude'),
+    env
+  }
+}
diff --git a/src/main/claude/claude-replay-turn-resolution.ts b/src/main/claude/claude-replay-turn-resolution.ts
new file mode 100644
index 00000000000..9db40feac49
--- /dev/null
+++ b/src/main/claude/claude-replay-turn-resolution.ts
@@ -0,0 +1,227 @@
+// Which dispatch a provider frame settles, and whether it opens a turn.
+//
+// A replay or result is joined to its waiter by the client uuid Claude echoes.
+// A send Claude FOLDS into the running request cycle is replayed mid-cycle with
+// the client uuid adopted: once that cycle has done work, that replay is a
+// delivery receipt and opens no boundary. A `command_lifecycle` frame opens no turn; its
+// `cancelled` can settle a send the CLI withdrew (`claude-command-lifecycle.ts`).
+
+import { observeClaudeCommandLifecycle } from './claude-command-lifecycle'
+import { forgetRetiredWaiter } from './claude-structured-dispatch-waiters'
+import {
+  claudeHasReplayContent,
+  readClaudeMessageEnvelope
+} from './claude-structured-item-translation'
+import type {
+  ClaudeDispatchWaiter,
+  ClaudeLateDispatchOutcome,
+  ClaudeSession
+} from './claude-structured-session-state'
+import { readClaudeFrameString } from './claude-structured-init-proof'
+import { claudeDispatchContentKey } from './claude-structured-dispatch-content'
+
+/** Settles a provider-proven late outcome; replay rows independently reconcile acceptance. */
+export type ClaudeLateDispatchSettlement = (input: ClaudeLateDispatchOutcome) => void
+
+export type ClaudeReplayTurnOrigin = { requestedAt: number | null }
+
+export function resolveClaudeReplayTurn(
+  session: ClaudeSession,
+  message: Record<string, unknown>,
+  onSettledLate?: ClaudeLateDispatchSettlement
+): ClaudeReplayTurnOrigin | null {
+  if (message.type === 'command_lifecycle') {
+    observeClaudeCommandLifecycle(session, message, onSettledLate)
+    return null
+  }
+  const envelope = readClaudeMessageEnvelope(message)
+  const isUserReplay =
+    envelope?.role === 'user' &&
+    message.parent_tool_use_id === null &&
+    claudeHasReplayContent(envelope)
+  const isCompletedCommand = message.type === 'result'
+  if (
+    (!isUserReplay && !isCompletedCommand) ||
+    readClaudeFrameString(message, 'session_id') !== session.providerSessionId
+  ) {
+    return null
+  }
+  const uuid = readClaudeFrameString(message, 'uuid')
+  if (!uuid) {
+    return null
+  }
+
+  // Newer SDK frames carry the client uuid that caused a turn. A correlation
+  // value is authoritative: never fall back to queue order or content, since
+  // identical prompts may be in flight across a timeout boundary.
+  const userMessageUuid = readClaudeFrameString(message, 'user_message_uuid')
+  // A folded turn's result names every send it ran under `user_message_uuids`.
+  // Each member settles its own waiter under its own uuid — the result frame's
+  // uuid is never adopted as a shared alias for multiple submissions.
+  const resultUserMessageUuids = isCompletedCommand ? claudeResultUserMessageUuids(message) : []
+  for (const member of resultUserMessageUuids) {
+    if (member === userMessageUuid) {
+      continue
+    }
+    const live = session.dispatchWaiters.find((candidate) => candidate.sentUuid === member)
+    if (live) {
+      settleWaiter(session, live, member, onSettledLate)
+      continue
+    }
+    const late = session.retiredDispatchWaiters.find((candidate) => candidate.sentUuid === member)
+    if (late) {
+      forgetRetiredWaiter(session, late)
+      recoverLateIdentity(session, late, member, false, onSettledLate)
+    }
+  }
+  if (userMessageUuid) {
+    const exact = session.dispatchWaiters.find(
+      (candidate) => candidate.sentUuid === userMessageUuid
+    )
+    if (exact) {
+      const foldReceipt = isUserReplay && claudeReplayIsFoldReceipt(session, exact, uuid)
+      settleWaiter(session, exact, uuid, onSettledLate)
+      return isUserReplay && !foldReceipt ? { requestedAt: exact.requestedAt } : null
+    }
+    const retired = session.retiredDispatchWaiters.find(
+      (candidate) => candidate.sentUuid === userMessageUuid
+    )
+    if (retired) {
+      forgetRetiredWaiter(session, retired)
+      recoverLateIdentity(session, retired, uuid, isUserReplay, onSettledLate)
+      return null
+    }
+    return null
+  }
+  if (resultUserMessageUuids.length > 0) {
+    // The plural list is this result's complete correlation; queue order must
+    // not join anyone it did not name.
+    return null
+  }
+
+  const exact = session.dispatchWaiters.find((candidate) => candidate.sentUuid === uuid)
+  if (exact) {
+    const foldReceipt = isUserReplay && claudeReplayIsFoldReceipt(session, exact, uuid)
+    settleWaiter(session, exact, uuid, onSettledLate)
+    return isUserReplay && !foldReceipt ? { requestedAt: exact.requestedAt } : null
+  }
+  const retired = session.retiredDispatchWaiters.find((candidate) => candidate.sentUuid === uuid)
+  if (retired) {
+    forgetRetiredWaiter(session, retired)
+    recoverLateIdentity(session, retired, uuid, isUserReplay, onSettledLate)
+    return null
+  }
+
+  if (isUserReplay) {
+    // Compatibility CLIs may mint a new replay uuid instead of echoing the
+    // client uuid. Content is an acceptable join only when it is the sole
+    // candidate on one side of the timeout boundary; with active and retired
+    // candidates present, identical prompts are intentionally left unknown.
+    const replayContentKey = claudeDispatchContentKey(envelope.content)
+    if (!session.replayContentFallbackBlocked && session.retiredDispatchWaiters.length === 0) {
+      const compatible = session.dispatchWaiters.filter(
+        (candidate) => candidate.replayContentKey === replayContentKey
+      )
+      if (compatible.length === 1) {
+        const [candidate] = compatible
+        settleWaiter(session, candidate!, uuid, onSettledLate)
+        return { requestedAt: candidate!.requestedAt }
+      }
+    } else if (!session.replayContentFallbackBlocked && session.dispatchWaiters.length === 0) {
+      const lateCompatible = session.retiredDispatchWaiters.filter(
+        (candidate) => candidate.replayContentKey === replayContentKey
+      )
+      if (lateCompatible.length === 1) {
+        const [candidate] = lateCompatible
+        forgetRetiredWaiter(session, candidate!)
+        recoverLateIdentity(session, candidate!, uuid, true, onSettledLate)
+        return null
+      }
+    }
+    return null
+  }
+  const current = session.dispatchWaiters[0]
+  if (isCompletedCommand && !current?.acceptsResult) {
+    return null
+  }
+  // A legacy result has no dispatch correlation. Any retired waiter makes queue order ambiguous,
+  // even when the retired dispatch was an ordinary turn rather than a slash command.
+  if (isCompletedCommand && session.retiredDispatchWaiters.length > 0) {
+    return null
+  }
+  // Once an eviction occurred, a fresh result uuid cannot be joined to a waiter by queue order.
+  if (isCompletedCommand && session.replayContentFallbackBlocked) {
+    return null
+  }
+  const waiter = uuid ? session.dispatchWaiters.shift() : undefined
+  if (waiter && uuid) {
+    settleWaiter(session, waiter, uuid, onSettledLate)
+    return isUserReplay ? { requestedAt: waiter.requestedAt } : null
+  }
+  return null
+}
+
+/** The provider's own cycle state decides a fold: the CLI folds a send into the
+ *  request cycle that is running when the send arrives, and it replays a folded
+ *  send mid-cycle with the client uuid ADOPTED (measured: fold-fresh/-resumed,
+ *  two-steers, early-steer). So an adopted replay after the running cycle has
+ *  done work is a delivery receipt, not a turn boundary; a cycle's first send is
+ *  its opener. Adoption is the capability check, read off the frame itself: a
+ *  CLI that mints fresh replay uuids never qualifies. A new cycle announces
+ *  itself with a root init (per-turn, measured), so a lost result cannot leave a
+ *  stale turn swallowing the next turn's replay. */
+function claudeReplayIsFoldReceipt(
+  session: ClaudeSession,
+  waiter: ClaudeDispatchWaiter,
+  replayUuid: string
+): boolean {
+  return replayUuid === waiter.sentUuid && session.translator?.openTurnInLiveProviderCycle === true
+}
+
+function claudeResultUserMessageUuids(message: Record<string, unknown>): string[] {
+  const uuids = message.user_message_uuids
+  return Array.isArray(uuids)
+    ? uuids.filter((member): member is string => typeof member === 'string' && member.length > 0)
+    : []
+}
+
+function settleWaiter(
+  session: ClaudeSession,
+  waiter: ClaudeDispatchWaiter,
+  uuid: string,
+  onSettledLate?: ClaudeLateDispatchSettlement
+): void {
+  const index = session.dispatchWaiters.indexOf(waiter)
+  if (index !== -1) {
+    session.dispatchWaiters.splice(index, 1)
+  }
+  waiter.settledUuid = uuid
+  waiter.resolve(uuid)
+  // Dispatch returned on admission, so the replay is what settles delivery.
+  if (waiter.clientMessageId) {
+    onSettledLate?.({
+      clientMessageId: waiter.clientMessageId,
+      providerIdentity: { provider: 'claude', sessionId: session.providerSessionId, uuid }
+    })
+  }
+}
+
+function recoverLateIdentity(
+  session: ClaudeSession,
+  waiter: ClaudeDispatchWaiter,
+  uuid: string,
+  isUserReplay: boolean,
+  onSettledLate?: ClaudeLateDispatchSettlement
+): void {
+  if (!isUserReplay && !waiter.acceptsResult) {
+    return
+  }
+  // The provider acted on this dispatch, so the send it came from is delivered.
+  // A retired replay settles delivery only; it cannot reopen a turn.
+  if (waiter.clientMessageId) {
+    onSettledLate?.({
+      clientMessageId: waiter.clientMessageId,
+      providerIdentity: { provider: 'claude', sessionId: session.providerSessionId, uuid }
+    })
+  }
+}
diff --git a/src/main/claude/claude-result-journaling.ts b/src/main/claude/claude-result-journaling.ts
new file mode 100644
index 00000000000..14fd2e94eb6
--- /dev/null
+++ b/src/main/claude/claude-result-journaling.ts
@@ -0,0 +1,88 @@
+// Journaling ONE Claude `result` frame: the end of the root turn it settles, and the diagnostic
+// row a failed or unrecognised result leaves.
+//
+// Split out of the translator when that file reached its line budget; the translator still owns
+// the open turn and every collaborator this writes through.
+
+import type { ClaudeContextFacts } from './claude-context-facts'
+import { claudeCommandResultEnd } from './claude-command-turn'
+import type { ClaudeMessageJournalContext } from './claude-message-journaling'
+import type { ClaudeJournalPrompts } from './claude-structured-journal-prompts'
+import {
+  claudeProviderFrameKind,
+  claudeResultFailure,
+  isSettledClaudeResultKind
+} from './claude-structured-provider-fallback'
+import { claudeTurnEndForResult } from './claude-turn-lifecycle-item'
+import { claudeFrameParentRef, isRootClaudeFrame } from './claude-turn-opening'
+
+export type ClaudeResultJournalContext = Pick<
+  ClaudeMessageJournalContext,
+  | 'sink'
+  | 'streamedBlocks'
+  | 'streamedText'
+  | 'subagents'
+  | 'providerFallback'
+  | 'corrections'
+  | 'turn'
+> & {
+  prompts: ClaudeJournalPrompts
+  context: ClaudeContextFacts
+}
+
+export function journalClaudeResult(
+  {
+    sink,
+    streamedBlocks,
+    streamedText,
+    subagents,
+    providerFallback,
+    corrections,
+    turn,
+    prompts,
+    context
+  }: ClaudeResultJournalContext,
+  message: Record<string, unknown>,
+  observedAt: number
+): void {
+  // Every turn this translator opens is root by construction, so a nested
+  // result settles the child that produced it and never the turn. The
+  // diagnostic below still runs: a child's failure is reportable even when
+  // it ends no turn.
+  const settlesTurn = isRootClaudeFrame(message)
+  const commandEnd = settlesTurn ? claudeCommandResultEnd(turn, sink, message, observedAt) : null
+  if (commandEnd === 'another-input') {
+    return
+  }
+  // Read before the settle below closes it: the result reports that turn's end.
+  const endedTurnScope = turn.turnScope
+  if (settlesTurn) {
+    prompts.retryPendingCancellations()
+    turn.suppressReopenOnFailure(message.is_error === true)
+    // The turn is over however it ended, so a foreground child still
+    // reported as working will never be settled by an event.
+    subagents.settleTurn(turn.groupKey)
+    context.settle(message, commandEnd ?? claudeTurnEndForResult(message, observedAt))
+    // The turn is over. A block still awaiting its final keeps the text the
+    // flush above journaled, but its live state goes: an interrupted turn
+    // would otherwise retain that text for the life of the session.
+    streamedBlocks.clear()
+    streamedText.settle()
+  }
+  const kind = claudeProviderFrameKind(message)
+  const failure = claudeResultFailure(message)
+  if (failure || !isSettledClaudeResultKind(kind)) {
+    providerFallback.append(
+      kind,
+      message,
+      failure?.text,
+      undefined,
+      undefined,
+      // A result that settles no turn is a CHILD's result: this
+      // translator only ever opens root turns.
+      settlesTurn
+        ? () => ({ turnScope: endedTurnScope })
+        : corrections.stampFor(claudeFrameParentRef(message))
+    )
+  }
+}
diff --git a/src/main/claude/claude-session-end-hook-capability.test.ts b/src/main/claude/claude-session-end-hook-capability.test.ts
deleted file mode 100644
index 755cdcbe498..00000000000
--- a/src/main/claude/claude-session-end-hook-capability.test.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import {
-  CLAUDE_SESSION_END_CAPABILITY_FLOOR,
-  claudeVersionSupportsSessionEnd,
-  parseClaudeCliVersion
-} from './claude-session-end-hook-capability'
-
-describe('Claude SessionEnd hook version capability', () => {
-  it('records 2.1.261 as the measured floor', () => {
-    expect(CLAUDE_SESSION_END_CAPABILITY_FLOOR).toBe('2.1.261')
-  })
-
-  it('extracts Claude Code version output', () => {
-    expect(parseClaudeCliVersion('2.1.261 (Claude Code)')).toBe('2.1.261')
-  })
-
-  it.each([
-    ['2.1.260', false],
-    ['2.1.261', true],
-    ['2.2.0', true],
-    ['unknown', false],
-    [undefined, false]
-  ])('classifies %s as SessionEnd-capable: %s', (version, expected) => {
-    expect(claudeVersionSupportsSessionEnd(version)).toBe(expected)
-  })
-})
diff --git a/src/main/claude/claude-session-end-hook-capability.ts b/src/main/claude/claude-session-end-hook-capability.ts
deleted file mode 100644
index 1587c154e7b..00000000000
--- a/src/main/claude/claude-session-end-hook-capability.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-import { hasReachedAppVersion, isValidAppVersion } from '../../shared/app-version'
-import { runProcess } from '../../shared/child-process/run-process'
-import path from 'node:path'
-
-// 2.1.261 is the only version measured, not an established minimum.
-export const CLAUDE_SESSION_END_CAPABILITY_FLOOR = '2.1.261'
-
-export function parseClaudeCliVersion(output: string | null | undefined): string | null {
-  const version = output?.match(/\b\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?\b/)?.[0]
-  return version && isValidAppVersion(version) ? version : null
-}
-
-export function claudeVersionSupportsSessionEnd(version: string | null | undefined): boolean {
-  const parsed = parseClaudeCliVersion(version)
-  return parsed !== null && hasReachedAppVersion(parsed, CLAUDE_SESSION_END_CAPABILITY_FLOOR)
-}
-
-export async function probeClaudeCliVersion(executablePath: string): Promise<string | null> {
-  try {
-    const pathKey = process.platform === 'win32' && process.env.Path !== undefined ? 'Path' : 'PATH'
-    const executableDir = path.dirname(executablePath)
-    const inheritedPath = process.env[pathKey]
-    const result = await runProcess({
-      program: executablePath,
-      args: ['--version'],
-      // Why: version-manager launchers often use `#!/usr/bin/env node`; the resolved CLI's sibling
-      // runtime must remain reachable even when Electron started with a thinner PATH.
-      env: {
-        ...process.env,
-        [pathKey]: inheritedPath
-          ? `${executableDir}${path.delimiter}${inheritedPath}`
-          : executableDir
-      },
-      timeoutMs: 5_000,
-      maxOutputBytes: 4_096
-    })
-    return result.code === 0 ? parseClaudeCliVersion(`${result.stdout}\n${result.stderr}`) : null
-  } catch {
-    return null
-  }
-}
diff --git a/src/main/claude/claude-session-end-install.test.ts b/src/main/claude/claude-session-end-install.test.ts
deleted file mode 100644
index 46f374ca7ae..00000000000
--- a/src/main/claude/claude-session-end-install.test.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { applyManagedHooks } from './hook-settings'
-
-const SCRIPT_FILE_NAME = 'claude-hook.sh'
-const MANAGED_COMMAND = '/home/dev/.orca/agent-hooks/claude-hook.sh'
-const managedHook = { type: 'command' as const, command: MANAGED_COMMAND }
-
-describe('Claude SessionEnd managed hook capability', () => {
-  it('installs SessionEnd beside SessionStart for the measured capable version', () => {
-    const written = applyManagedHooks({ hooks: {} }, managedHook, SCRIPT_FILE_NAME, {
-      claudeVersion: '2.1.261 (Claude Code)'
-    })
-
-    expect(written.hooks?.SessionEnd?.[0]?.hooks?.[0]?.command).toBe(MANAGED_COMMAND)
-    expect(written.hooks?.SessionStart?.[0]?.hooks?.[0]?.command).toBe(MANAGED_COMMAND)
-  })
-
-  it.each(['2.1.260', 'unknown', undefined])(
-    'retains the legacy event set for an incapable or unverified host (%s)',
-    (claudeVersion) => {
-      const written = applyManagedHooks({ hooks: {} }, managedHook, SCRIPT_FILE_NAME, {
-        claudeVersion
-      })
-
-      expect(written.hooks?.SessionEnd).toBeUndefined()
-      expect(written.hooks?.SessionStart).toBeDefined()
-    }
-  )
-
-  it('removes only Orca SessionEnd during a capability downgrade', () => {
-    const capable = applyManagedHooks(
-      {
-        hooks: {
-          SessionEnd: [{ hooks: [{ type: 'command', command: 'echo user-session-end' }] }]
-        }
-      },
-      managedHook,
-      SCRIPT_FILE_NAME,
-      { claudeVersion: '2.1.261' }
-    )
-    const downgraded = applyManagedHooks(capable, managedHook, SCRIPT_FILE_NAME, {
-      claudeVersion: '2.1.260'
-    })
-
-    expect(downgraded.hooks?.SessionEnd).toEqual([
-      { hooks: [{ type: 'command', command: 'echo user-session-end' }] }
-    ])
-  })
-})
diff --git a/src/main/claude/claude-settings-schema-install.test.ts b/src/main/claude/claude-settings-schema-install.test.ts
new file mode 100644
index 00000000000..577e455b6a3
--- /dev/null
+++ b/src/main/claude/claude-settings-schema-install.test.ts
@@ -0,0 +1,59 @@
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import fixture from './__fixtures__/claude-hook-event-enums.json'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => '/tmp/userData'
+  }
+}))
+
+import { ClaudeHookService } from './hook-service'
+
+const enums: Record<string, string[]> = fixture.enums
+const topLevelSettings: Record<string, { strict: boolean; keys: string[] }> =
+  fixture.topLevelSettings
+const strictReleases = Object.keys(topLevelSettings).filter(
+  (version) => topLevelSettings[version].strict
+)
+
+// Why: checks the whole written file, so any new key Orca writes must pass each strict schema.
+describe('Claude settings written for a strict settings schema', () => {
+  let tmpHome: string
+  let settingsPath: string
+
+  beforeEach(() => {
+    tmpHome = mkdtempSync(join(tmpdir(), 'orca-claude-settings-schema-'))
+    settingsPath = join(tmpHome, '.claude', 'settings.json')
+    vi.stubEnv('HOME', tmpHome)
+    vi.stubEnv('USERPROFILE', tmpHome)
+  })
+
+  afterEach(() => {
+    vi.unstubAllEnvs()
+    rmSync(tmpHome, { recursive: true, force: true })
+  })
+
+  function expectAcceptedBy(version: string): void {
+    const written = JSON.parse(readFileSync(settingsPath, 'utf-8'))
+    const { keys } = topLevelSettings[version]
+    expect(Object.keys(written).filter((key) => !keys.includes(key))).toEqual([])
+    expect(
+      Object.keys(written.hooks ?? {}).filter((event) => !enums[version].includes(event))
+    ).toEqual([])
+  }
+
+  it.each(strictReleases)('a fresh install writes only what Claude %s accepts', (version) => {
+    new ClaudeHookService().install({ claudeVersion: version })
+    expectAcceptedBy(version)
+  })
+
+  it.each(strictReleases)('a downgrade to Claude %s leaves only what it accepts', (version) => {
+    const service = new ClaudeHookService()
+    service.install({ claudeVersion: '2.1.261' })
+    service.install({ claudeVersion: version })
+    expectAcceptedBy(version)
+  })
+})
diff --git a/src/main/claude/claude-status-line-install.test.ts b/src/main/claude/claude-status-line-install.test.ts
new file mode 100644
index 00000000000..3c7c9c6f83c
--- /dev/null
+++ b/src/main/claude/claude-status-line-install.test.ts
@@ -0,0 +1,75 @@
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => '/tmp/userData'
+  }
+}))
+
+import { ClaudeHookService } from './hook-service'
+
+const USER_STATUS_LINE = { type: 'command', command: '/usr/local/bin/my-statusline' }
+
+describe('Claude statusLine by resolved version', () => {
+  let tmpHome: string
+  let settingsPath: string
+
+  beforeEach(() => {
+    tmpHome = mkdtempSync(join(tmpdir(), 'orca-claude-statusline-version-'))
+    settingsPath = join(tmpHome, '.claude', 'settings.json')
+    vi.stubEnv('HOME', tmpHome)
+    vi.stubEnv('USERPROFILE', tmpHome)
+  })
+
+  afterEach(() => {
+    vi.unstubAllEnvs()
+    rmSync(tmpHome, { recursive: true, force: true })
+  })
+
+  const readSettings = () => JSON.parse(readFileSync(settingsPath, 'utf-8'))
+
+  it('writes no statusLine for a Claude whose settings schema rejects it', () => {
+    new ClaudeHookService().install({ claudeVersion: '1.0.63' })
+    expect(readSettings().statusLine).toBeUndefined()
+    expect(readSettings().hooks.SessionStart).toBeDefined()
+  })
+
+  it('removes Orca statusLine on a downgrade and re-adds it after the upgrade', () => {
+    const service = new ClaudeHookService()
+    service.install({ claudeVersion: '2.1.261' })
+    expect(readSettings().statusLine?.command).toContain('claude-statusline')
+
+    service.install({ claudeVersion: '1.0.63' })
+    expect(readSettings().statusLine).toBeUndefined()
+
+    // Why: Orca's own removal must not read as the user's opt-out on the next capable install.
+    service.install({ claudeVersion: '1.0.64' })
+    expect(readSettings().statusLine?.command).toContain('claude-statusline')
+  })
+
+  it('keeps the user opt-out across a downgrade and upgrade', () => {
+    const service = new ClaudeHookService()
+    service.install({ claudeVersion: '2.1.261' })
+    const { statusLine: _optedOut, ...rest } = readSettings()
+    writeFileSync(settingsPath, JSON.stringify(rest))
+
+    service.install({ claudeVersion: '1.0.63' })
+    service.install({ claudeVersion: '2.1.261' })
+    expect(readSettings().statusLine).toBeUndefined()
+  })
+
+  it('never removes a user statusLine for an old Claude', () => {
+    mkdirSync(join(tmpHome, '.claude'), { recursive: true })
+    writeFileSync(settingsPath, JSON.stringify({ statusLine: USER_STATUS_LINE }))
+    new ClaudeHookService().install({ claudeVersion: '1.0.63' })
+    expect(readSettings().statusLine).toEqual(USER_STATUS_LINE)
+  })
+
+  it('keeps installing the statusLine when the version is unresolved', () => {
+    new ClaudeHookService().install()
+    expect(readSettings().statusLine?.command).toContain('claude-statusline')
+  })
+})
diff --git a/src/main/claude/claude-stream-json-connection.test.ts b/src/main/claude/claude-stream-json-connection.test.ts
index 51ffa085163..e3682f03306 100644
--- a/src/main/claude/claude-stream-json-connection.test.ts
+++ b/src/main/claude/claude-stream-json-connection.test.ts
@@ -2,6 +2,7 @@ import { execFileSync } from 'node:child_process'
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
+import { providerDiagnosticOf } from '../../shared/agent-session-failure'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { spawnProcess, type SpawnedProcess } from '../../shared/child-process/run-process'
 import { hasLiveClaudePtys } from '../claude-accounts/live-pty-gate'
@@ -106,6 +107,18 @@ async function open(
   return connection
 }
 
+function launchedArgv(spec: ProcessSpec | undefined): string[] {
+  const supervised = spec?.env?.ORCA_PROVIDER_SUPERVISOR_SPEC
+  if (!supervised) {
+    return [spec?.program ?? '', ...(spec?.args ?? [])]
+  }
+  const launch: unknown = JSON.parse(Buffer.from(supervised, 'base64').toString())
+  if (!launch || typeof launch !== 'object' || !('command' in launch) || !('args' in launch)) {
+    return []
+  }
+  return [String(launch.command), ...(Array.isArray(launch.args) ? launch.args.map(String) : [])]
+}
+
 function childEnv(): Record<string, string | undefined> {
   return (spawned.at(-1)?.env ?? {}) as Record<string, string | undefined>
 }
@@ -163,9 +176,12 @@ describe('Claude stream-json connection', () => {
     // An inherited value wins over the SDK's default, so clear it to pin the default.
     vi.stubEnv('CLAUDE_CODE_ENTRYPOINT', undefined)
     vi.stubEnv('ORCA_CONNECTION_MARKER', 'inherited')
+    // An Orca launched inside another structured session inherits that session's id.
+    vi.stubEnv('ORCA_AGENT_SESSION_ID', 'a0b1c2d3-0000-4000-8000-00000000abcd')
     const scenario = scriptScenario([HOLD_OPEN])
     const connection = await open(
       launchFor(scenario, {
+        ORCA_AGENT_SESSION_ID: 'f7a1c0de-1111-4222-8333-444455556666',
         CLAUDE_CONFIG_DIR: '/accounts/managed/home',
         ANTHROPIC_AUTH_TOKEN: 'configured-token',
         ORCA_AGENT_SESSION_SPAWN_TOKEN: 'spawn-9',
@@ -184,6 +200,8 @@ describe('Claude stream-json connection', () => {
     expect(env.ANTHROPIC_AUTH_TOKEN).toBe('configured-token')
     expect(env.ORCA_AGENT_SESSION_SPAWN_TOKEN).toBe('spawn-9')
     expect(env.ORCA_CONNECTION_MARKER).toBe('inherited')
+    // The session's own id reaches the spawned child over the inherited one.
+    expect(env.ORCA_AGENT_SESSION_ID).toBe('f7a1c0de-1111-4222-8333-444455556666')
     expect(env.ANTHROPIC_API_KEY).toBeUndefined()
     expect(env.CLAUDE_CODE_CHILD_SESSION).toBeUndefined()
     expect(env.CLAUDE_CODE_SESSION_ID).toBeUndefined()
@@ -195,8 +213,9 @@ describe('Claude stream-json connection', () => {
     const report = await until(() => readReportSafely(scenario), 'the scripted CLI report')
     expect(report.argv[0]).toBe(FAKE_CLI)
     // The .mjs fixture makes the SDK run it under node; a real CLI path is the program
-    // itself. Either way the resolved path is what Orca's spawner is asked to execute.
-    expect([spawned.at(-1)?.program, ...(spawned.at(-1)?.args ?? [])]).toContain(FAKE_CLI)
+    // itself. Either way the resolved path is what Orca's spawner is asked to execute,
+    // through the POSIX supervisor's spec where there is one.
+    expect(launchedArgv(spawned.at(-1))).toContain(FAKE_CLI)
     expect(report.argv).toContain('--replay-user-messages')
     expect(report.argv).toContain(`--session-id=${SESSION_ID}`)
   })
@@ -592,6 +611,11 @@ describe('Claude stream-json connection', () => {
     await until(() => exit, 'the exit error')
     // The status and stderr are the only diagnostic a refused start leaves behind.
     expect((exit as unknown as Error).message).toMatch(/exited \(code 1\): claude: not signed in/)
+    // Kept apart from Orca's wording where it is composed, and marked as log text.
+    expect(providerDiagnosticOf(exit)).toEqual({
+      text: expect.stringMatching(/^\(code 1\)\n.*claude: not signed in/s),
+      audience: 'log'
+    })
     expect(connection.closed).toBe(true)
     // Stderr-triggered capture can win or lose the race with this real child's exit.
     const closed = await connection.close()
@@ -636,37 +660,63 @@ describe('Claude stream-json connection', () => {
     20_000
   )
 
-  it('settles a spawn error followed by close as processless and closes idempotently', async () => {
-    const scenario = scriptScenario([HOLD_OPEN])
-    const missingCli = join(scenario.cwd, 'claude-that-does-not-exist')
-    let fault: Error | null = null
-    let exit: Error | null = null
-    const connection = await open(
-      { ...launchFor(scenario), pathToClaudeCodeExecutable: missingCli },
-      {
-        onFault: (error) => {
-          fault = error
-        },
-        onExit: (error) => {
-          exit = error
+  it.skipIf(process.platform === 'win32')(
+    'reports a missing CLI under the supervisor as a root exit that names the spawn error',
+    async () => {
+      const scenario = scriptScenario([HOLD_OPEN])
+      const missingCli = join(scenario.cwd, 'claude-that-does-not-exist')
+      let exit: Error | null = null
+      const connection = await open(
+        { ...launchFor(scenario), pathToClaudeCodeExecutable: missingCli },
+        {
+          onExit: (error) => {
+            exit = error
+          }
         }
-      }
-    )
+      )
 
-    await until(
-      () => (connection.exitVerdict.root === 'processless' ? connection.exitVerdict : null),
-      'the processless spawn settlement'
-    )
-    expect(connection.pid).toBeUndefined()
-    expect(fault).toBeInstanceOf(Error)
-    expect(exit).toBeNull()
-    await expect(Promise.all([connection.close(), connection.close()])).resolves.toEqual([
-      true,
-      true
-    ])
-    await expect(connection.close()).resolves.toBe(true)
-    expect(connection.exitVerdict).toEqual({ root: 'processless', tree: 'exited' })
-  })
+      const reported = await until(() => exit, 'the supervised spawn failure')
+      // The supervisor spawned, so this is its exit; only its stderr can say why.
+      expect(reported.message).toMatch(/\(code 127\).*ENOENT/s)
+      // A first-hand root exit, which releases the lease like a processless start did.
+      expect(connection.exitVerdict.root).toBe('exited')
+    }
+  )
+
+  it.skipIf(process.platform !== 'win32')(
+    'settles a spawn error followed by close as processless and closes idempotently',
+    async () => {
+      const scenario = scriptScenario([HOLD_OPEN])
+      const missingCli = join(scenario.cwd, 'claude-that-does-not-exist')
+      let fault: Error | null = null
+      let exit: Error | null = null
+      const connection = await open(
+        { ...launchFor(scenario), pathToClaudeCodeExecutable: missingCli },
+        {
+          onFault: (error) => {
+            fault = error
+          },
+          onExit: (error) => {
+            exit = error
+          }
+        }
+      )
+
+      await until(
+        () => (connection.exitVerdict.root === 'processless' ? connection.exitVerdict : null),
+        'the processless spawn settlement'
+      )
+      expect(connection.pid).toBeUndefined()
+      expect(fault).toBeInstanceOf(Error)
+      expect(exit).toBeNull()
+      await expect(Promise.all([connection.close(), connection.close()])).resolves.toEqual([
+        true,
+        true
+      ])
+      await expect(connection.close()).resolves.toBe(true)
+      expect(connection.exitVerdict).toEqual({ root: 'processless', tree: 'exited' })
+    }
+  )
 
   it('does not treat a child error event as first-hand root exit proof', async () => {
     const scenario = scriptScenario([HOLD_OPEN])
diff --git a/src/main/claude/claude-stream-json-connection.ts b/src/main/claude/claude-stream-json-connection.ts
index 1a2a65bca34..6f67e04b36e 100644
--- a/src/main/claude/claude-stream-json-connection.ts
+++ b/src/main/claude/claude-stream-json-connection.ts
@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto'
+import { providerDiagnostic, withProviderDiagnostic } from '../../shared/agent-session-failure'
 import type * as ClaudeAgentSdk from '@anthropic-ai/claude-agent-sdk'
 import type { CanUseTool, OnUserDialog, SDKUserMessage } from '@anthropic-ai/claude-agent-sdk'
 import { spawnProcess } from '../../shared/child-process/run-process'
@@ -103,7 +104,12 @@ function exitError(stderrTail: string, status: ExitStatus | null, cause?: Error)
         ? ` (code ${status.code})`
         : ''
   const message = `claude stream-json exited${how}${detail ? `: ${detail}` : ''}`
-  return cause ? new Error(message, { cause }) : new Error(message)
+  // Written for a log, not a person: the chat keeps it behind Details.
+  const diagnostic = providerDiagnostic([how.trim(), detail].filter(Boolean).join('\n'), 'log')
+  return withProviderDiagnostic(
+    cause ? new Error(message, { cause }) : new Error(message),
+    diagnostic
+  )
 }
 
 export async function openClaudeStreamJsonConnection(
@@ -303,18 +309,24 @@ export async function openClaudeStreamJsonConnection(
     closePromise ??= (async () => {
       closing = true
       resumeReading()
-      // Arm the descendant proof before ending stdin. The SDK may exit the root
-      // immediately; a post-exit walk cannot recover descendants that reparented.
+      // Arm the descendant proof before the stop. The root may exit immediately;
+      // a post-exit walk cannot recover descendants that reparented.
       await (tree.refresh?.() ?? tree.capture())
       inbox.end()
       const proven = await proveClaudeChildExit({
         child,
         exitPromise,
         exited: rootSettled,
-        tree
+        tree,
+        supervised: spawner.supervised
       })
       inbox.fail(new Error('claude stream-json connection closed'))
       if (!proven) {
+        if (exited && tree.treeVerdict === 'live') {
+          console.warn('[claude-stream-json] root exited but a descendant survived the close:', {
+            pid: spawner.pid
+          })
+        }
         closePromise = null
         return false
       }
diff --git a/src/main/claude/claude-structured-acquisition-release.ts b/src/main/claude/claude-structured-acquisition-release.ts
index 6be06c86e93..3df76971df1 100644
--- a/src/main/claude/claude-structured-acquisition-release.ts
+++ b/src/main/claude/claude-structured-acquisition-release.ts
@@ -35,8 +35,8 @@ export async function releaseClaudeAcquisition(input: {
   const retriedProof = firstProof || (await exit.connection.close())
   if (retriedProof) {
     await input.onExitProven?.(input.sessionId, exit)
-    // Keep the first-hand exit evidence indexed until the tree proof succeeds;
-    // a failed close must be retryable and cannot look like an absent session.
+    // Only a proven close drops the exit here. An unknown one stays indexed so it is retryable and
+    // cannot look like an absent session; an observed root exit is dropped by its own settlement.
     input.exits.delete(input.sessionId)
     return true
   }
diff --git a/src/main/claude/claude-structured-auth-parity.test.ts b/src/main/claude/claude-structured-auth-parity.test.ts
index ddc69366aad..002240e4dd7 100644
--- a/src/main/claude/claude-structured-auth-parity.test.ts
+++ b/src/main/claude/claude-structured-auth-parity.test.ts
@@ -105,7 +105,10 @@ describe('claude structured auth parity with the terminal preflight', () => {
       resolverFor({ stripAuthEnv: true, overlay: { ANTHROPIC_API_KEY: 'sk-ant-CONFIGURED' } })({
         identity: IDENTITY
       })
-    ).rejects.toThrow(CLAUDE_AUTH_ENV_CONFLICT_MESSAGE)
+    ).rejects.toMatchObject({
+      message: CLAUDE_AUTH_ENV_CONFLICT_MESSAGE,
+      reason: 'managedAccountEnvOverride'
+    })
   })
 
   it('refuses an auth-like ANTHROPIC_CUSTOM_HEADERS override while a managed account is pinned', async () => {
@@ -114,7 +117,10 @@ describe('claude structured auth parity with the terminal preflight', () => {
         stripAuthEnv: true,
         overlay: { ANTHROPIC_CUSTOM_HEADERS: 'Authorization: Bearer sk-ant-CONFIGURED' }
       })({ identity: IDENTITY })
-    ).rejects.toThrow(CLAUDE_AUTH_ENV_CONFLICT_MESSAGE)
+    ).rejects.toMatchObject({
+      message: CLAUDE_AUTH_ENV_CONFLICT_MESSAGE,
+      reason: 'managedAccountEnvOverride'
+    })
   })
 
   it('still admits a non-auth env overlay under a managed account', async () => {
@@ -161,7 +167,10 @@ describe('claude structured auth parity with the terminal preflight', () => {
 
     await expect(
       resolverFor({ stripAuthEnv: true, authSwitchSettleTimeoutMs: 20 })({ identity: IDENTITY })
-    ).rejects.toThrow(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE)
+    ).rejects.toMatchObject({
+      message: CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE,
+      reason: 'accountSwitchInProgress'
+    })
   })
 
   it('waits a settling account switch out rather than refusing a resolved launch', async () => {
@@ -183,7 +192,10 @@ describe('claude structured auth parity with the terminal preflight', () => {
 
     await expect(
       adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
-    ).rejects.toThrow(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE)
+    ).rejects.toMatchObject({
+      message: CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE,
+      reason: 'accountSwitchInProgress'
+    })
     // Nothing was spawned, so the refusal must not have opened a connection.
     expect(claude.connections).toHaveLength(0)
   })
@@ -227,7 +239,10 @@ describe('claude structured auth parity with the terminal preflight', () => {
 
     await expect(
       adapter.acquire({ identity: identityFor(), fence: 8, spawnToken: 'spawn-10' })
-    ).rejects.toThrow(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE)
+    ).rejects.toMatchObject({
+      message: CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE,
+      reason: 'accountSwitchInProgress'
+    })
     // No replacement child was opened, so nothing is left running unowned.
     expect(claude.connections).toHaveLength(1)
     await adapter.closeAll()
diff --git a/src/main/claude/claude-structured-command-dispatch.ts b/src/main/claude/claude-structured-command-dispatch.ts
new file mode 100644
index 00000000000..3d03c18178c
--- /dev/null
+++ b/src/main/claude/claude-structured-command-dispatch.ts
@@ -0,0 +1,38 @@
+import { randomUUID } from 'node:crypto'
+import type {
+  AgentSessionCommandAdmission,
+  StructuredAgentSessionCommandRun
+} from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import { dispatchClaudeTurn } from './claude-structured-dispatch'
+import type { ClaudeSession } from './claude-structured-session-state'
+
+/** Sent like any message, so the slash-command waiter settles it on its result. The translator
+ *  makes the command's turn the open one before the send, and that same result ends it. */
+export async function dispatchClaudeCommand(
+  session: ClaudeSession,
+  command: StructuredAgentSessionCommandRun
+): Promise<AgentSessionCommandAdmission> {
+  const sentUuid = randomUUID()
+  session.translator?.beginCommand({
+    ...command,
+    providerSessionId: session.providerSessionId,
+    sentUuid
+  })
+  try {
+    const admission = await dispatchClaudeTurn(session, {
+      clientMessageId: command.clientMessageId,
+      body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: '/compact' }] },
+      ...(command.running.requestedAt === undefined
+        ? {}
+        : { requestedAt: command.running.requestedAt }),
+      sentUuid
+    })
+    if (admission.state === 'rejected') {
+      session.translator?.forgetCommand(command.turnId)
+    }
+    return admission
+  } catch (error) {
+    session.translator?.forgetCommand(command.turnId)
+    throw error
+  }
+}
diff --git a/src/main/claude/claude-structured-compaction.test.ts b/src/main/claude/claude-structured-compaction.test.ts
deleted file mode 100644
index 5255ce37ea1..00000000000
--- a/src/main/claude/claude-structured-compaction.test.ts
+++ /dev/null
@@ -1,66 +0,0 @@
-import { afterEach, describe, expect, it, vi } from 'vitest'
-import { StructuredSessionCompaction } from '../native-chat/agent-session-wire/structured-session-compaction'
-import { claudeUnwrittenUserMessageError } from './claude-agent-sdk-user-message-queue'
-import { compactClaudeSession, isClaudeCompactionContent } from './claude-structured-compaction'
-import { sessionFor } from './claude-structured-dispatch-test-support'
-
-afterEach(() => {
-  vi.useRealTimers()
-})
-
-describe('Claude compaction transcript content', () => {
-  it('keeps generated summaries and command echoes out of the transcript only during explicit compaction', async () => {
-    const tracker = new StructuredSessionCompaction()
-    const event = {
-      type: 'message' as const,
-      sessionId: 'orca-session',
-      message: {
-        type: 'user',
-        session_id: 'provider',
-        uuid: 'summary',
-        message: { role: 'user', content: 'generated compaction summary' }
-      }
-    }
-    expect(isClaudeCompactionContent(tracker, event)).toBe(false)
-    const completion = tracker.run('orca-session', 'provider', async () => ({}))
-    expect(isClaudeCompactionContent(tracker, event)).toBe(true)
-    expect(isClaudeCompactionContent(tracker, { ...event, sessionId: 'other' })).toBe(false)
-    expect(isClaudeCompactionContent(tracker, { ...event, message: { type: 'result' } })).toBe(
-      false
-    )
-    tracker.ended('orca-session')
-    await completion
-    expect(isClaudeCompactionContent(tracker, event)).toBe(false)
-  })
-
-  it('fails a provably unwritten command without waiting for the completion deadline', async () => {
-    vi.useFakeTimers()
-    const session = sessionFor(
-      vi.fn().mockRejectedValue(claudeUnwrittenUserMessageError(new Error('input closed')))
-    )
-    const pending = compactClaudeSession(session, new StructuredSessionCompaction(60_000), {
-      sessionId: 'orca-session',
-      fence: 1,
-      turnId: 'compact-1'
-    })
-
-    await vi.advanceTimersByTimeAsync(1)
-
-    await expect(pending).resolves.toEqual({ error: 'provider_write_failed: input closed' })
-  })
-
-  it('keeps waiting when the command write outcome is ambiguous', async () => {
-    vi.useFakeTimers()
-    const session = sessionFor(vi.fn().mockRejectedValue(new Error('input pump stopped')))
-    const pending = compactClaudeSession(session, new StructuredSessionCompaction(10), {
-      sessionId: 'orca-session',
-      fence: 1,
-      turnId: 'compact-1'
-    })
-    const rejection = expect(pending).rejects.toThrow('Compaction completion is unconfirmed.')
-
-    await vi.advanceTimersByTimeAsync(10)
-
-    await rejection
-  })
-})
diff --git a/src/main/claude/claude-structured-compaction.ts b/src/main/claude/claude-structured-compaction.ts
deleted file mode 100644
index 6c3155739c2..00000000000
--- a/src/main/claude/claude-structured-compaction.ts
+++ /dev/null
@@ -1,55 +0,0 @@
-import type { ClaudeSession, ClaudeStructuredSessionEvent } from './claude-structured-session-state'
-import type { StructuredSessionCompaction } from '../native-chat/agent-session-wire/structured-session-compaction'
-import { dispatchClaudeTurn } from './claude-structured-dispatch'
-import type { StructuredAgentSessionAdapter } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
-/** Compaction needs no ack deadline of its own: `compactions.run` keeps its own
- *  180s completion window and settles on Claude's terminal `result` frame, so
- *  the dispatch here only has to report a refusal to send. */
-export function compactClaudeSession(
-  session: ClaudeSession,
-  compactions: StructuredSessionCompaction,
-  input: Parameters<NonNullable<StructuredAgentSessionAdapter['compact']>>[0]
-): Promise<{ error?: string }> {
-  return compactions.run(
-    input.sessionId,
-    session.providerSessionId,
-    async () => {
-      const result = await dispatchClaudeTurn(session, {
-        body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: '/compact' }] }
-      })
-      if (result.state === 'rejected') {
-        return { error: result.reason }
-      }
-      return undefined
-    },
-    input.onLateResult,
-    input.turnId
-  )
-}
-
-export function observeClaudeCompaction(
-  compactions: StructuredSessionCompaction,
-  event: ClaudeStructuredSessionEvent,
-  translator: ClaudeSession['translator'] | undefined
-): void {
-  if (!isClaudeCompactionContent(compactions, event)) {
-    translator?.handle(event)
-  }
-  if (event.type === 'message') {
-    compactions.claude(event.sessionId, event.message)
-  }
-  if (event.type === 'ended') {
-    compactions.ended(event.sessionId)
-  }
-}
-
-export function isClaudeCompactionContent(
-  compactions: StructuredSessionCompaction,
-  event: ClaudeStructuredSessionEvent
-): boolean {
-  return (
-    event.type === 'message' &&
-    compactions.hasPending(event.sessionId) &&
-    ['user', 'assistant', 'stream_event'].includes(String(event.message.type))
-  )
-}
diff --git a/src/main/claude/claude-structured-control-actions.test.ts b/src/main/claude/claude-structured-control-actions.test.ts
index f92a04a8003..4ba08d3b642 100644
--- a/src/main/claude/claude-structured-control-actions.test.ts
+++ b/src/main/claude/claude-structured-control-actions.test.ts
@@ -6,7 +6,7 @@ import {
 } from './claude-structured-control-actions'
 import { dispatchClaudeTurn } from './claude-structured-dispatch'
 import { ClaudeControlRequestError } from './claude-stream-json-connection'
-import { ClaudePromptRegistry } from './claude-structured-prompt-replies'
+import { buildClaudePromptReply, ClaudePromptRegistry } from './claude-structured-prompt-replies'
 import type { ClaudeDispatchWaiter, ClaudeSession } from './claude-structured-session-state'
 import { ClaudeBackgroundTaskTracker } from './claude-background-task-tracker'
 import { sessionFor, userMessage } from './claude-structured-dispatch-test-support'
@@ -16,7 +16,7 @@ type InterruptResult = Awaited<ReturnType<ClaudeSession['connection']['interrupt
 function sessionWith(input: {
   capabilities?: string[]
   interrupt: (options?: { cancelQueued?: boolean; timeoutMs?: number }) => Promise<InterruptResult>
-  cancelAsyncMessage?: (uuid: string) => Promise<void>
+  cancelAsyncMessage?: (uuid: string) => Promise<boolean>
   prompts?: ClaudePromptRegistry
 }): {
   session: ClaudeSession
@@ -24,7 +24,7 @@ function sessionWith(input: {
   cancelAsyncMessage: ReturnType<typeof vi.fn>
 } {
   const interrupt = vi.fn(input.interrupt)
-  const cancelAsyncMessage = vi.fn(input.cancelAsyncMessage ?? (async () => {}))
+  const cancelAsyncMessage = vi.fn(input.cancelAsyncMessage ?? (async () => false))
   const session = sessionFor()
   session.capabilities = input.capabilities ?? []
   session.prompts = input.prompts ?? new ClaudePromptRegistry()
@@ -56,6 +56,53 @@ describe('cancelClaudeTurn', () => {
     expect(cancelAsyncMessage.mock.calls.map((call) => call[0])).toEqual(['queued-1', 'queued-2'])
   })
 
+  it('settles each still-queued send the CLI confirms it withdrew, and only those', async () => {
+    const { session, cancelAsyncMessage } = sessionWith({
+      capabilities: ['interrupt_receipt_v1'],
+      interrupt: async () => ({ still_queued: ['queued-1', 'queued-2', 'queued-3'] }),
+      // queued-2 already ran; queued-3's answer never arrived.
+      cancelAsyncMessage: async (uuid) => {
+        if (uuid === 'queued-3') {
+          throw new ClaudeControlRequestError('cancel_async_message', 'timed out')
+        }
+        return uuid === 'queued-1'
+      }
+    })
+    const resolutions = [vi.fn(), vi.fn(), vi.fn()]
+    session.dispatchWaiters = ['queued-1', 'queued-2', 'queued-3'].map(
+      (sentUuid, index): ClaudeDispatchWaiter => ({
+        acceptsResult: false,
+        clientMessageId: `client-${index + 1}`,
+        sentUuid,
+        dispatchSequence: index + 1,
+        requestedAt: null,
+        replayContentKey: `content-${index}`,
+        resolve: resolutions[index]!
+      })
+    )
+    const settled = vi.fn()
+
+    await expect(cancelClaudeTurn(session, 5_000, () => true, settled)).resolves.toEqual({
+      cancelled: true
+    })
+    expect(cancelAsyncMessage).toHaveBeenCalledTimes(3)
+    expect(settled.mock.calls).toEqual([
+      [
+        {
+          clientMessageId: 'client-1',
+          state: 'rejected',
+          reason: 'provider_cancelled_before_start',
+          rejection: { kind: 'cancelled' }
+        }
+      ]
+    ])
+    expect(resolutions[0]).toHaveBeenCalledWith(null)
+    expect(session.dispatchWaiters.map((waiter) => waiter.sentUuid)).toEqual([
+      'queued-2',
+      'queued-3'
+    ])
+  })
+
   it('settles every cancelled queued waiter when the CLI advertises the capability', async () => {
     const cancelled = Array.from({ length: 64 }, (_, index) => `queued-${index}`)
     const { session, interrupt, cancelAsyncMessage } = sessionWith({
@@ -85,7 +132,8 @@ describe('cancelClaudeTurn', () => {
     expect(settled).toHaveBeenNthCalledWith(1, {
       clientMessageId: 'client-0',
       state: 'rejected',
-      reason: 'provider_cancelled_before_start'
+      reason: 'provider_cancelled_before_start',
+      rejection: { kind: 'cancelled' }
     })
   })
 
@@ -118,7 +166,8 @@ describe('cancelClaudeTurn', () => {
     expect(settled).toHaveBeenCalledWith({
       clientMessageId: 'client-ambiguous',
       state: 'rejected',
-      reason: 'provider_cancelled_before_start'
+      reason: 'provider_cancelled_before_start',
+      rejection: { kind: 'cancelled' }
     })
   })
 
@@ -194,11 +243,16 @@ describe('answerClaudePrompt', () => {
     const resolvePrompt = vi.fn()
     session.translator = {
       handle: vi.fn(),
+      openTurnInLiveProviderCycle: false,
       journalPrompts: {
         cancel: vi.fn(() => ({ accepted: true as const })),
         resolve: resolvePrompt
       },
       currentTurnId: null,
+      commandTurnId: null,
+      beginCommand: vi.fn(),
+      forgetCommand: vi.fn(),
+      commandInterruptRequested: vi.fn(),
       flush: vi.fn(),
       contextActivity: 0,
       markContextActivity: vi.fn(),
@@ -214,7 +268,11 @@ describe('answerClaudePrompt', () => {
     if (!claim) {
       throw new Error('expected prompt claim')
     }
-    await answerClaudePrompt(session, claim, 'allow')
+    await answerClaudePrompt(
+      session,
+      claim,
+      buildClaudePromptReply(prompt, { kind: 'option', optionId: 'allow' })
+    )
 
     expect(settle).toHaveBeenCalledWith(
       expect.objectContaining({ behavior: 'allow', toolUseID: 'tool-1' })
diff --git a/src/main/claude/claude-structured-control-actions.ts b/src/main/claude/claude-structured-control-actions.ts
index 961b9aee7ba..8ec1aa2e9c4 100644
--- a/src/main/claude/claude-structured-control-actions.ts
+++ b/src/main/claude/claude-structured-control-actions.ts
@@ -1,9 +1,8 @@
-import { applyClaudePromptAnswer, type ClaudePromptClaim } from './claude-structured-prompt-replies'
+import type { PermissionResult } from '@anthropic-ai/claude-agent-sdk'
+import type { ClaudePromptClaim } from './claude-structured-prompt-replies'
 import { ClaudeControlRequestError } from './claude-stream-json-connection'
-import {
-  settleCancelledClaudeDispatchWaiters,
-  type ClaudeLateDispatchSettlement
-} from './claude-structured-dispatch'
+import { settleCancelledClaudeDispatchWaiters } from './claude-structured-dispatch'
+import type { ClaudeLateDispatchSettlement } from './claude-replay-turn-resolution'
 import type { ClaudeSession } from './claude-structured-session-state'
 
 const INTERRUPT_CANCEL_QUEUED_CAPABILITY = 'interrupt_cancel_queued_v1'
@@ -18,8 +17,9 @@ export type ClaudeTurnCancellationGuard = () => boolean
  * Interrupt the running turn, then make sure no queued async user message survives to spawn a
  * later unexpected turn. On a CLI advertising `interrupt_cancel_queued_v1` one round trip
  * cancels the queue alongside the abort; otherwise the interrupt receipt lists `still_queued`
- * uuids, and each is withdrawn best-effort with `cancel_async_message`. Older CLIs resolve no
- * receipt, so there is nothing to sweep.
+ * uuids, and each is withdrawn best-effort with `cancel_async_message`. Either way, every send
+ * the CLI confirms it withdrew settles as cancelled. Older CLIs resolve no receipt, so there is
+ * nothing to sweep.
  */
 export async function cancelClaudeTurn(
   session: ClaudeSession,
@@ -41,9 +41,13 @@ export async function cancelClaudeTurn(
     if (cancelQueued) {
       settleCancelledClaudeDispatchWaiters(session, receipt?.cancelled ?? [], onDispatchSettledLate)
     } else {
+      const withdrawn: string[] = []
       for (const uuid of receipt?.still_queued ?? []) {
-        await session.connection.cancelAsyncMessage(uuid, { timeoutMs }).catch(() => {})
+        if (await session.connection.cancelAsyncMessage(uuid, { timeoutMs }).catch(() => false)) {
+          withdrawn.push(uuid)
+        }
       }
+      settleCancelledClaudeDispatchWaiters(session, withdrawn, onDispatchSettledLate)
     }
     return { cancelled: true }
   } catch (error) {
@@ -83,17 +87,12 @@ export async function stopClaudeBackgroundTasks(
 export async function answerClaudePrompt(
   session: ClaudeSession,
   claim: ClaudePromptClaim,
-  optionId: string
+  reply: PermissionResult
 ): Promise<void> {
   if (!session.prompts.ownsClaim(claim)) {
     throw new Error(`claude is no longer waiting on ${claim.itemId}`)
   }
-  const response = applyClaudePromptAnswer(claim.found, optionId)
-  if (response === null) {
-    session.prompts.releaseClaim(claim)
-    return
-  }
   session.prompts.forget(claim.found.prompt)
-  claim.found.prompt.settle(response)
+  claim.found.prompt.settle(reply)
   session.translator?.journalPrompts.resolve(claim.found.prompt.promptKey)
 }
diff --git a/src/main/claude/claude-structured-conversation-stop.test.ts b/src/main/claude/claude-structured-conversation-stop.test.ts
new file mode 100644
index 00000000000..840125853ba
--- /dev/null
+++ b/src/main/claude/claude-structured-conversation-stop.test.ts
@@ -0,0 +1,101 @@
+// A Stop that names no turn, against the Claude adapter: the gap between writing a message and
+// Claude echoing it back is exactly where no turn id exists yet, and the interrupt must still land.
+
+import { describe, expect, it } from 'vitest'
+import { acquired, fakeClaude, USER_MESSAGE } from './claude-structured-session-test-support'
+
+function interrupts(claude: ReturnType<typeof fakeClaude>): number {
+  return claude.connections[0]!.calls.filter((call) => call.subtype === 'interrupt').length
+}
+
+async function written(claude: ReturnType<typeof fakeClaude>) {
+  const adapter = await acquired(claude)
+  // No replay: the message is written and Claude has not opened its turn.
+  await expect(
+    adapter.dispatch({
+      sessionId: 'session-1',
+      clientMessageId: 'client-1',
+      body: USER_MESSAGE,
+      fence: 7
+    })
+  ).resolves.toEqual({ state: 'admitted' })
+  return adapter
+}
+
+describe('Claude Stop that names no turn', () => {
+  it('interrupts a written message before its turn opens', async () => {
+    const claude = fakeClaude({ replayUuid: null })
+    const adapter = await written(claude)
+
+    await expect(adapter.cancelTurn({ sessionId: 'session-1', fence: 7 })).resolves.toEqual({
+      cancelled: true
+    })
+    expect(interrupts(claude)).toBe(1)
+  })
+
+  it('still refuses the placeholder a client used to name for that gap', async () => {
+    const claude = fakeClaude({ replayUuid: null })
+    const adapter = await written(claude)
+
+    await expect(
+      adapter.cancelTurn({ sessionId: 'session-1', turnId: 'turn-none', fence: 7 })
+    ).resolves.toEqual({ cancelled: false })
+    expect(interrupts(claude)).toBe(0)
+  })
+
+  it('interrupts a turn Claude opened on its own echo', async () => {
+    const claude = fakeClaude({ replayUuid: 'turn-T' })
+    const adapter = await written(claude)
+
+    await expect(adapter.cancelTurn({ sessionId: 'session-1', fence: 7 })).resolves.toEqual({
+      cancelled: true
+    })
+    expect(interrupts(claude)).toBe(1)
+  })
+
+  it('does nothing for another fence, or with nothing in flight', async () => {
+    const claude = fakeClaude({ replayUuid: null })
+    const adapter = await acquired(claude)
+
+    await expect(adapter.cancelTurn({ sessionId: 'session-1', fence: 7 })).resolves.toEqual({
+      cancelled: false
+    })
+    await adapter.dispatch({
+      sessionId: 'session-1',
+      clientMessageId: 'client-1',
+      body: USER_MESSAGE,
+      fence: 7
+    })
+    await expect(adapter.cancelTurn({ sessionId: 'session-1', fence: 6 })).resolves.toEqual({
+      cancelled: false
+    })
+    expect(interrupts(claude)).toBe(0)
+  })
+
+  it('ends a turn that opens while the interrupt is on its way once, and the next send lands', async () => {
+    const claude = fakeClaude({ replayUuid: null })
+    const adapter = await written(claude)
+    const connection = claude.connections[0]!
+    // The echo that opens the turn arrives after Orca wrote the interrupt, before Claude answers it.
+    claude.routes.interrupt = () => {
+      connection.handlers.onMessage?.({ ...connection.sent[0]!, uuid: 'turn-late' })
+      return undefined
+    }
+
+    await expect(adapter.cancelTurn({ sessionId: 'session-1', fence: 7 })).resolves.toEqual({
+      cancelled: true
+    })
+    expect(interrupts(claude)).toBe(1)
+
+    delete claude.routes.interrupt
+    await expect(
+      adapter.dispatch({
+        sessionId: 'session-1',
+        clientMessageId: 'client-2',
+        body: USER_MESSAGE,
+        fence: 7
+      })
+    ).resolves.toEqual({ state: 'admitted' })
+    expect(connection.sent).toHaveLength(2)
+  })
+})
diff --git a/src/main/claude/claude-structured-dispatch-admission.test.ts b/src/main/claude/claude-structured-dispatch-admission.test.ts
index 9a4d60a824c..c4578ca38d8 100644
--- a/src/main/claude/claude-structured-dispatch-admission.test.ts
+++ b/src/main/claude/claude-structured-dispatch-admission.test.ts
@@ -2,7 +2,8 @@
 // completes, and nothing about elapsed time ever puts a message in doubt.
 
 import { describe, expect, it, vi } from 'vitest'
-import { dispatchClaudeTurn, resolveClaudeReplayTurn } from './claude-structured-dispatch'
+import { dispatchClaudeTurn } from './claude-structured-dispatch'
+import { resolveClaudeReplayTurn } from './claude-replay-turn-resolution'
 import {
   childExited,
   sessionFor,
@@ -61,8 +62,9 @@ describe('Claude structured dispatch admission', () => {
         true
       )
 
-      // Queued while turn one is still running: Claude cannot echo it until that
-      // turn ends, so nothing about the wait is evidence of a delivery problem.
+      // Queued while turn one is still running: a fold is echoed mid-turn, a
+      // queued send only when its own turn starts — either way elapsed time is
+      // not evidence of a delivery problem.
       const queued = await dispatchClaudeTurn(session, {
         clientMessageId: 'client-2',
         body: userMessage([{ type: 'text', text: 'two' }])
@@ -139,7 +141,11 @@ describe('Claude structured dispatch admission', () => {
         clientMessageId: 'client-over-capacity',
         body: userMessage([{ type: 'text', text: 'one too many' }])
       })
-    ).resolves.toEqual({ state: 'rejected', reason: 'claude structured dispatch queue is full' })
+    ).resolves.toEqual({
+      state: 'rejected',
+      reason: 'claude structured dispatch queue is full',
+      rejection: { kind: 'queueFull' }
+    })
     expect(session.dispatchWaiters).toHaveLength(64)
     expect(session.connection.send).toHaveBeenCalledTimes(64)
   })
diff --git a/src/main/claude/claude-structured-dispatch-attachment-rejection.test.ts b/src/main/claude/claude-structured-dispatch-attachment-rejection.test.ts
new file mode 100644
index 00000000000..a23767c0968
--- /dev/null
+++ b/src/main/claude/claude-structured-dispatch-attachment-rejection.test.ts
@@ -0,0 +1,177 @@
+// What a person reads when Orca refuses a message's content before sending it.
+
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import { dispatchClaudeTurn } from './claude-structured-dispatch'
+import { sessionFor, userMessage } from './claude-structured-dispatch-test-support'
+
+describe('Claude structured dispatch attachment rejections', () => {
+  it('rejects more than twenty URL images before sending', async () => {
+    const session = sessionFor()
+    const body = userMessage(
+      Array.from({ length: 21 }, (_, index) => ({
+        type: 'image-ref' as const,
+        url: `https://example.test/${index}.png`
+      }))
+    )
+
+    await expect(
+      dispatchClaudeTurn(session, { clientMessageId: 'client-1', body })
+    ).resolves.toEqual({
+      state: 'rejected',
+      reason: 'Claude accepts at most 20 images in one message, so this message was not sent.',
+      rejection: { kind: 'attachmentInvalid', attachment: { reason: 'tooMany', limit: 20 } }
+    })
+    expect(session.connection.send).not.toHaveBeenCalled()
+  })
+
+  it('rejects local images whose aggregate size exceeds twenty MiB', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-claude-images-'))
+    try {
+      const paths = await Promise.all(
+        Array.from({ length: 5 }, async (_, index) => {
+          const path = join(directory, `${index}.png`)
+          await writeFile(path, Buffer.alloc(5 * 1024 * 1024))
+          return path
+        })
+      )
+      const session = sessionFor()
+      const body = userMessage(paths.map((path) => ({ type: 'image-ref' as const, path })))
+
+      await expect(
+        dispatchClaudeTurn(session, { clientMessageId: 'client-1', body })
+      ).resolves.toEqual({
+        state: 'rejected',
+        reason:
+          'The images on this message add up to more than 20 MB, so the message was not sent.',
+        rejection: {
+          kind: 'attachmentInvalid',
+          attachment: { reason: 'totalTooLarge', limit: 20 * 1024 * 1024 }
+        }
+      })
+      expect(session.connection.send).not.toHaveBeenCalled()
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  it('rejects a local image by actual bytes read beyond the per-image cap', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-claude-image-'))
+    try {
+      const path = join(directory, 'oversized.png')
+      await writeFile(path, Buffer.alloc(5 * 1024 * 1024 + 1))
+      const session = sessionFor()
+      const body = userMessage([{ type: 'image-ref', path }])
+
+      await expect(
+        dispatchClaudeTurn(session, { clientMessageId: 'client-1', body })
+      ).resolves.toEqual({
+        state: 'rejected',
+        reason: 'An image on this message is larger than 5 MB, so the message was not sent.',
+        rejection: {
+          kind: 'attachmentInvalid',
+          attachment: { reason: 'tooLarge', limit: 5 * 1024 * 1024 }
+        }
+      })
+      expect(session.connection.send).not.toHaveBeenCalled()
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  it('names an empty image as empty, not as too large', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-claude-image-'))
+    try {
+      const path = join(directory, 'empty.png')
+      await writeFile(path, Buffer.alloc(0))
+      const session = sessionFor()
+
+      await expect(
+        dispatchClaudeTurn(session, {
+          clientMessageId: 'client-1',
+          body: userMessage([{ type: 'image-ref', path }])
+        })
+      ).resolves.toEqual({
+        state: 'rejected',
+        reason: 'An image on this message is empty, so the message was not sent.',
+        rejection: { kind: 'attachmentInvalid', attachment: { reason: 'empty' } }
+      })
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  it('names an unsupported image type in words a person can act on', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-claude-image-'))
+    try {
+      const path = join(directory, 'picture.bmp')
+      await writeFile(path, Buffer.alloc(64))
+      const session = sessionFor()
+
+      await expect(
+        dispatchClaudeTurn(session, {
+          clientMessageId: 'client-1',
+          body: userMessage([{ type: 'image-ref', path }])
+        })
+      ).resolves.toEqual({
+        state: 'rejected',
+        reason:
+          'Claude accepts only PNG, JPEG, GIF, and WebP images, so this message was not sent.',
+        rejection: { kind: 'attachmentInvalid', attachment: { reason: 'unsupportedType' } }
+      })
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  it('does not blame an attachment for a message no Orca client sends', async () => {
+    const session = sessionFor()
+    await expect(
+      dispatchClaudeTurn(session, {
+        clientMessageId: 'client-1',
+        body: userMessage([{ type: 'text', text: '' }])
+      })
+    ).resolves.toEqual({
+      state: 'rejected',
+      reason: 'This message is empty, so it was not sent.',
+      rejection: { kind: 'emptyMessage' }
+    })
+    await expect(
+      dispatchClaudeTurn(session, {
+        clientMessageId: 'client-2',
+        body: { ...userMessage([{ type: 'text', text: 'hi' }]), role: 'assistant' }
+      })
+    ).resolves.toEqual({
+      state: 'rejected',
+      reason: "Orca ran into a problem, so this didn't go through. Try again.",
+      rejection: { kind: 'hostFault' }
+    })
+    expect(session.connection.send).not.toHaveBeenCalled()
+  })
+
+  it('rejects an attachment it cannot read with the generic sentence and no path', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const session = sessionFor()
+    const path = join(tmpdir(), 'orca-claude-image-missing', 'gone.png')
+
+    await expect(
+      dispatchClaudeTurn(session, {
+        clientMessageId: 'client-1',
+        body: userMessage([{ type: 'image-ref', path }])
+      })
+    ).resolves.toEqual({
+      state: 'rejected',
+      reason: "An attachment on this message couldn't be read, so the message was not sent.",
+      rejection: { kind: 'attachmentUnreadable' }
+    })
+    expect(session.connection.send).not.toHaveBeenCalled()
+    // The row drops the error, so the log is the only place left to find why.
+    expect(warn).toHaveBeenCalledWith(
+      '[claude-dispatch] attachment could not be read:',
+      expect.objectContaining({ code: 'ENOENT' })
+    )
+    warn.mockRestore()
+  })
+})
diff --git a/src/main/claude/claude-structured-dispatch-content.ts b/src/main/claude/claude-structured-dispatch-content.ts
index 7df84091b7c..035b0a59492 100644
--- a/src/main/claude/claude-structured-dispatch-content.ts
+++ b/src/main/claude/claude-structured-dispatch-content.ts
@@ -3,11 +3,63 @@ import { open } from 'node:fs/promises'
 import { extname } from 'node:path'
 import type { AgentJournalMessageItem } from '../../shared/agent-session-journal-types'
 import type { NativeChatBlock } from '../../shared/native-chat-types'
+import {
+  agentSessionFailureFact,
+  type AgentSessionAttachmentProblem,
+  type SubmissionRejectionFact
+} from '../../shared/agent-session-failure'
+import {
+  agentSessionFailureWords,
+  type AgentJournalDispatchRejection
+} from '../../shared/agent-session-failure-words'
+import { TUI_AGENT_DISPLAY_NAMES } from '../../shared/tui-agent-display-names'
 import { claudeRecord } from './claude-structured-item-translation'
 
-const MAX_IMAGE_BYTES = 5 * 1024 * 1024
+/** Orca refused the message's content, as opposed to failing to read an attachment. */
+export class ClaudeDispatchContentError extends Error {
+  /** What was wrong, typed where the check saw it; `message` stays for logs. */
+  readonly failure: SubmissionRejectionFact
+
+  constructor(message: string, failure: SubmissionRejectionFact) {
+    super(message)
+    this.name = 'ClaudeDispatchContentError'
+    this.failure = failure
+  }
+}
+
+function attachmentError(message: string, attachment: AgentSessionAttachmentProblem): Error {
+  return new ClaudeDispatchContentError(
+    message,
+    agentSessionFailureFact('attachmentInvalid', { attachment })
+  )
+}
+
+/** A message Claude rejected, in the words that name Claude and its legacy markers. */
+export function claudeDispatchRejection(
+  failure: SubmissionRejectionFact
+): AgentJournalDispatchRejection {
+  return agentSessionFailureWords(failure, {
+    surface: 'rejection',
+    agentName: TUI_AGENT_DISPLAY_NAMES.claude,
+    provider: 'claude'
+  })
+}
+
+/** Why a message whose content could not be built was not sent: Orca's own refusal of it, or an
+ *  attachment it could not read. Never the provider. */
+export function claudeDispatchContentRejection(error: unknown): AgentJournalDispatchRejection {
+  if (error instanceof ClaudeDispatchContentError) {
+    return claudeDispatchRejection(error.failure)
+  }
+  // The row says only that it could not be read; why belongs in the log.
+  console.warn('[claude-dispatch] attachment could not be read:', error)
+  return claudeDispatchRejection(agentSessionFailureFact('attachmentUnreadable'))
+}
+
+const BYTES_PER_MB = 1024 * 1024
+const MAX_IMAGE_BYTES = 5 * BYTES_PER_MB
 const MAX_IMAGE_COUNT = 20
-const MAX_TOTAL_IMAGE_BYTES = 20 * 1024 * 1024
+const MAX_TOTAL_IMAGE_BYTES = 20 * BYTES_PER_MB
 const MAX_REPLAY_CONTENT_KEY_BYTES = 256
 
 type ImageBudget = {
@@ -18,14 +70,17 @@ type ImageBudget = {
 export async function readClaudeImage(path: string, openImpl: typeof open = open): Promise<Buffer> {
   const file = await openImpl(path, 'r')
   try {
-    const invalidImage = (): Error =>
-      new Error(`Claude image must be a non-empty file no larger than ${MAX_IMAGE_BYTES} bytes`)
+    const tooLarge = (): Error =>
+      attachmentError(`Claude image must be no larger than ${MAX_IMAGE_BYTES} bytes`, {
+        reason: 'tooLarge',
+        limit: MAX_IMAGE_BYTES
+      })
     const info = await file.stat()
     if (!info.isFile()) {
-      throw new Error('Claude image must be a file')
+      throw attachmentError('Claude image must be a file', { reason: 'notAFile' })
     }
     if (info.size > MAX_IMAGE_BYTES) {
-      throw invalidImage()
+      throw tooLarge()
     }
     const buffer = Buffer.allocUnsafe(info.size + 1)
     let bytesRead = 0
@@ -39,8 +94,15 @@ export async function readClaudeImage(path: string, openImpl: typeof open = open
     // A file can grow after the initial stat and after the final read returns
     // zero. Prove the descriptor's size matches what was copied before sending.
     const finalInfo = await file.stat()
-    if (bytesRead === 0 || bytesRead > MAX_IMAGE_BYTES || finalInfo.size !== bytesRead) {
-      throw invalidImage()
+    if (bytesRead > MAX_IMAGE_BYTES) {
+      throw tooLarge()
+    }
+    if (finalInfo.size !== bytesRead) {
+      // Not the image's fault: it changed while Orca read it, so it reads as unreadable.
+      throw new Error('Claude image changed while it was read')
+    }
+    if (bytesRead === 0) {
+      throw attachmentError('Claude image must be a non-empty file', { reason: 'empty' })
     }
     return buffer.subarray(0, bytesRead)
   } finally {
@@ -62,22 +124,30 @@ async function imageContent(
 ): Promise<unknown> {
   budget.count += 1
   if (budget.count > MAX_IMAGE_COUNT) {
-    throw new Error(`Claude messages support at most ${MAX_IMAGE_COUNT} images`)
+    throw attachmentError(`Claude messages support at most ${MAX_IMAGE_COUNT} images`, {
+      reason: 'tooMany',
+      limit: MAX_IMAGE_COUNT
+    })
   }
   if (block.url) {
     return { type: 'image', source: { type: 'url', url: block.url } }
   }
   if (!block.path) {
-    throw new Error('image reference has neither a path nor a URL')
+    throw attachmentError('image reference has neither a path nor a URL', { reason: 'noSource' })
   }
   const data = await readClaudeImage(block.path)
   budget.localBytes += data.byteLength
   if (budget.localBytes > MAX_TOTAL_IMAGE_BYTES) {
-    throw new Error(`Claude images must total no more than ${MAX_TOTAL_IMAGE_BYTES} bytes`)
+    throw attachmentError(`Claude images must total no more than ${MAX_TOTAL_IMAGE_BYTES} bytes`, {
+      reason: 'totalTooLarge',
+      limit: MAX_TOTAL_IMAGE_BYTES
+    })
   }
   const mediaType = IMAGE_MIME_BY_EXTENSION[extname(block.path).toLowerCase()]
   if (!mediaType) {
-    throw new Error(`Claude does not support the image type ${extname(block.path)}`)
+    throw attachmentError(`Claude does not support the image type ${extname(block.path)}`, {
+      reason: 'unsupportedType'
+    })
   }
   return {
     type: 'image',
@@ -99,7 +169,11 @@ export async function claudeDispatchMessageContent(
   body: AgentJournalMessageItem
 ): Promise<unknown[]> {
   if (body.role !== 'user') {
-    throw new Error('Claude dispatch accepts only user messages')
+    // No Orca client sends one, so the fault is Orca's.
+    throw new ClaudeDispatchContentError(
+      'Claude dispatch accepts only user messages',
+      agentSessionFailureFact('hostFault')
+    )
   }
   const images: unknown[] = []
   const texts: string[] = []
@@ -115,7 +189,10 @@ export async function claudeDispatchMessageContent(
   // text blocks would silently discard every one but the last.
   const content = texts.length > 0 ? [...images, { type: 'text', text: texts.join('\n') }] : images
   if (content.length === 0) {
-    throw new Error('Claude dispatch requires text or an image')
+    throw new ClaudeDispatchContentError(
+      'Claude dispatch requires text or an image',
+      agentSessionFailureFact('emptyMessage')
+    )
   }
   return content
 }
diff --git a/src/main/claude/claude-structured-dispatch-test-support.ts b/src/main/claude/claude-structured-dispatch-test-support.ts
index a309bd9d0b9..5af0f17243b 100644
--- a/src/main/claude/claude-structured-dispatch-test-support.ts
+++ b/src/main/claude/claude-structured-dispatch-test-support.ts
@@ -5,7 +5,7 @@ import type { ClaudeSession } from './claude-structured-session-state'
 import { ClaudeBackgroundTaskTracker } from './claude-background-task-tracker'
 import { ClaudeChildWorkDecoder } from './claude-child-work-decoder'
 import { ClaudeSlashCommandCatalog } from './claude-slash-command-catalog'
-import { createClaudeSessionStartupGate } from './claude-structured-session-startup-gate'
+import { createClaudeSessionStartup } from './claude-structured-session-startup-state'
 
 export function sessionFor(send: Mock = vi.fn().mockResolvedValue(undefined)): ClaudeSession {
   return {
@@ -32,7 +32,7 @@ export function sessionFor(send: Mock = vi.fn().mockResolvedValue(undefined)): C
     capabilities: [],
     events: undefined,
     translator: null,
-    startup: { ...createClaudeSessionStartupGate(), state: 'proven' }
+    startup: { ...createClaudeSessionStartup(), state: 'proven' }
   }
 }
 
diff --git a/src/main/claude/claude-structured-dispatch-waiters.ts b/src/main/claude/claude-structured-dispatch-waiters.ts
index f3a3501ec8a..92b6a5048b2 100644
--- a/src/main/claude/claude-structured-dispatch-waiters.ts
+++ b/src/main/claude/claude-structured-dispatch-waiters.ts
@@ -10,11 +10,11 @@ export function forgetRetiredWaiter(session: ClaudeSession, waiter: ClaudeDispat
 }
 
 /**
- * A waiter with no deadline. The echo Claude sends is emitted when the provider
- * STARTS the turn, so a message queued behind a running turn cannot be echoed
- * until that turn ends — an interval bounded only by the previous turn. Elapsed
- * time is therefore not evidence about delivery, and nothing here expires.
- * Waiters are retired by process facts instead: a failed write, or child exit.
+ * A waiter with no deadline. A mid-turn send Claude folds into the running turn
+ * is replayed mid-turn; one it runs later is replayed only when its own turn
+ * starts — an interval bounded only by the previous turn. Elapsed time is
+ * therefore not evidence about delivery, and nothing here expires. Waiters are
+ * retired by process facts instead: a failed write, or child exit.
  */
 export function waitForReplay(
   session: ClaudeSession,
diff --git a/src/main/claude/claude-structured-dispatch.test.ts b/src/main/claude/claude-structured-dispatch.test.ts
index 1945ac3531d..92ae0253711 100644
--- a/src/main/claude/claude-structured-dispatch.test.ts
+++ b/src/main/claude/claude-structured-dispatch.test.ts
@@ -2,8 +2,9 @@ import { mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { describe, expect, it, vi } from 'vitest'
-import { dispatchClaudeTurn, resolveClaudeReplayTurn } from './claude-structured-dispatch'
-import { readClaudeImage } from './claude-structured-dispatch-content'
+import { dispatchClaudeTurn } from './claude-structured-dispatch'
+import { resolveClaudeReplayTurn } from './claude-replay-turn-resolution'
+import { ClaudeDispatchContentError, readClaudeImage } from './claude-structured-dispatch-content'
 import { claudeUnwrittenUserMessageError } from './claude-agent-sdk-user-message-queue'
 import type { ClaudeSession } from './claude-structured-session-state'
 import {
@@ -379,7 +380,11 @@ describe('Claude structured dispatch image limits', () => {
         clientMessageId: 'client-2',
         body: userMessage([{ type: 'text', text: 'two' }])
       })
-    ).resolves.toEqual({ state: 'rejected', reason: 'provider_write_failed: broken pipe' })
+    ).resolves.toEqual({
+      state: 'rejected',
+      reason: 'provider_write_failed',
+      rejection: { kind: 'writeFailed' }
+    })
     expect(session.dispatchWaiters).toEqual([firstWaiter])
 
     const firstUuid = (firstWaiter as { sentUuid?: string }).sentUuid
@@ -392,6 +397,7 @@ describe('Claude structured dispatch image limits', () => {
   })
 
   it('does not let a provably unwritten attempt block retry correlation', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
     const send = vi
       .fn()
       .mockRejectedValueOnce(claudeUnwrittenUserMessageError(new Error('broken pipe')))
@@ -401,7 +407,17 @@ describe('Claude structured dispatch image limits', () => {
 
     await expect(
       dispatchClaudeTurn(session, { clientMessageId: 'client-1', body })
-    ).resolves.toEqual({ state: 'rejected', reason: 'provider_write_failed: broken pipe' })
+    ).resolves.toEqual({
+      state: 'rejected',
+      reason: 'provider_write_failed',
+      rejection: { kind: 'writeFailed' }
+    })
+    // The row keeps only the marker; why the write failed goes to the log.
+    expect(warn).toHaveBeenCalledWith(
+      '[claude-dispatch] message could not be handed to Claude:',
+      expect.objectContaining({ message: expect.stringContaining('broken pipe') })
+    )
+    warn.mockRestore()
     expect(session.dispatchWaiters).toHaveLength(0)
     expect(session.retiredDispatchWaiters).toHaveLength(0)
 
@@ -684,66 +700,6 @@ describe('Claude structured dispatch image limits', () => {
     })
   })
 
-  it('rejects more than twenty URL images before sending', async () => {
-    const session = sessionFor()
-    const body = userMessage(
-      Array.from({ length: 21 }, (_, index) => ({
-        type: 'image-ref' as const,
-        url: `https://example.test/${index}.png`
-      }))
-    )
-
-    await expect(
-      dispatchClaudeTurn(session, { clientMessageId: 'client-1', body })
-    ).resolves.toEqual({ state: 'rejected', reason: 'Claude messages support at most 20 images' })
-    expect(session.connection.send).not.toHaveBeenCalled()
-  })
-
-  it('rejects local images whose aggregate size exceeds twenty MiB', async () => {
-    const directory = await mkdtemp(join(tmpdir(), 'orca-claude-images-'))
-    try {
-      const paths = await Promise.all(
-        Array.from({ length: 5 }, async (_, index) => {
-          const path = join(directory, `${index}.png`)
-          await writeFile(path, Buffer.alloc(5 * 1024 * 1024))
-          return path
-        })
-      )
-      const session = sessionFor()
-      const body = userMessage(paths.map((path) => ({ type: 'image-ref' as const, path })))
-
-      await expect(
-        dispatchClaudeTurn(session, { clientMessageId: 'client-1', body })
-      ).resolves.toEqual({
-        state: 'rejected',
-        reason: `Claude images must total no more than ${20 * 1024 * 1024} bytes`
-      })
-      expect(session.connection.send).not.toHaveBeenCalled()
-    } finally {
-      await rm(directory, { recursive: true, force: true })
-    }
-  })
-
-  it('rejects a local image by actual bytes read beyond the per-image cap', async () => {
-    const directory = await mkdtemp(join(tmpdir(), 'orca-claude-image-'))
-    try {
-      const path = join(directory, 'oversized.png')
-      await writeFile(path, Buffer.alloc(5 * 1024 * 1024 + 1))
-      const session = sessionFor()
-      const body = userMessage([{ type: 'image-ref', path }])
-
-      await expect(
-        dispatchClaudeTurn(session, { clientMessageId: 'client-1', body })
-      ).resolves.toEqual({
-        state: 'rejected',
-        reason: `Claude image must be a non-empty file no larger than ${5 * 1024 * 1024} bytes`
-      })
-      expect(session.connection.send).not.toHaveBeenCalled()
-    } finally {
-      await rm(directory, { recursive: true, force: true })
-    }
-  })
-
   it('allocates local image reads from the file size, not the maximum cap', async () => {
     const directory = await mkdtemp(join(tmpdir(), 'orca-claude-image-'))
     const allocUnsafe = vi.spyOn(Buffer, 'allocUnsafe')
@@ -821,8 +777,11 @@ describe('Claude structured dispatch image limits', () => {
       read,
       close: vi.fn().mockResolvedValue(undefined)
     } as never)
-    await expect(readClaudeImage('/controlled/growing.png', open)).rejects.toThrow(
-      `Claude image must be a non-empty file no larger than ${5 * 1024 * 1024} bytes`
+    // It changed while Orca read it: unreadable, never a limit the image did not break.
+    const rejected = await readClaudeImage('/controlled/growing.png', open).catch(
+      (error: unknown) => error
     )
+    expect(rejected).not.toBeInstanceOf(ClaudeDispatchContentError)
+    expect(rejected).toMatchObject({ message: 'Claude image changed while it was read' })
   })
 })
diff --git a/src/main/claude/claude-structured-dispatch.ts b/src/main/claude/claude-structured-dispatch.ts
index d93a8ecab0a..c208cceccdb 100644
--- a/src/main/claude/claude-structured-dispatch.ts
+++ b/src/main/claude/claude-structured-dispatch.ts
@@ -7,193 +7,31 @@ import {
 } from './claude-structured-dispatch-waiters'
 import type { AgentJournalMessageItem } from '../../shared/agent-session-journal-types'
 import type { AgentSessionDispatchOutcome } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
-import {
-  claudeHasReplayContent,
-  readClaudeMessageEnvelope
-} from './claude-structured-item-translation'
-import type {
-  ClaudeDispatchWaiter,
-  ClaudeLateDispatchOutcome,
-  ClaudeSession
-} from './claude-structured-session-state'
-import { readClaudeFrameString } from './claude-structured-init-proof'
+import type { ClaudeSession } from './claude-structured-session-state'
+import type { ClaudeLateDispatchSettlement } from './claude-replay-turn-resolution'
 import {
   claudeDispatchContentKey,
+  claudeDispatchContentRejection,
   claudeDispatchInvokesSlashCommand,
-  claudeDispatchMessageContent
+  claudeDispatchMessageContent,
+  claudeDispatchRejection
 } from './claude-structured-dispatch-content'
 import { dispatchWriteOutcomeUnknownReason } from '../native-chat/agent-session-journal/journal-dispatch-doubt-reasons'
-import {
-  DISPATCH_REJECTED_CANCELLED,
-  DISPATCH_REJECTED_QUEUE_FULL,
-  dispatchWriteFailureReason
-} from '../../shared/structured-agent-session-dispatch-rejection'
+import { DISPATCH_REJECTED_QUEUE_FULL } from '../../shared/structured-agent-session-dispatch-rejection'
+import { agentSessionFailureFact } from '../../shared/agent-session-failure'
+import type { AgentJournalDispatchRejection } from '../../shared/agent-session-failure-words'
 import {
   claudeUnwrittenUserMessageError,
   claudeUserMessageWasProvablyUnwritten
 } from './claude-agent-sdk-user-message-queue'
 import { AgentSessionPreDispatchError } from '../native-chat/agent-session-wire/structured-agent-session-operation-settlement'
 import {
-  claudeStartupFailureReason,
-  claudeStartupHoldsWrites,
-  failClaudeStartupGate,
-  holdClaudeStartupWrite
-} from './claude-structured-session-startup-gate'
+  claudeStartupFailureFact,
+  failClaudeStartup
+} from './claude-structured-session-startup-state'
 
 const MAX_ACTIVE_DISPATCH_WAITERS = 64
 
-/** Settles a provider-proven late outcome; replay rows independently reconcile acceptance. */
-export type ClaudeLateDispatchSettlement = (input: ClaudeLateDispatchOutcome) => void
-
-export type ClaudeReplayTurnOrigin = { requestedAt: number | null }
-
-export function resolveClaudeReplayTurn(
-  session: ClaudeSession,
-  message: Record<string, unknown>,
-  onSettledLate?: ClaudeLateDispatchSettlement
-): ClaudeReplayTurnOrigin | null {
-  const envelope = readClaudeMessageEnvelope(message)
-  const isUserReplay =
-    envelope?.role === 'user' &&
-    message.parent_tool_use_id === null &&
-    claudeHasReplayContent(envelope)
-  const isCompletedCommand = message.type === 'result'
-  if (
-    (!isUserReplay && !isCompletedCommand) ||
-    readClaudeFrameString(message, 'session_id') !== session.providerSessionId
-  ) {
-    return null
-  }
-  const uuid = readClaudeFrameString(message, 'uuid')
-  if (!uuid) {
-    return null
-  }
-
-  // Newer SDK frames carry the client uuid that caused a turn. A correlation
-  // value is authoritative: never fall back to queue order or content, since
-  // identical prompts may be in flight across a timeout boundary.
-  const userMessageUuid = readClaudeFrameString(message, 'user_message_uuid')
-  if (userMessageUuid) {
-    const exact = session.dispatchWaiters.find(
-      (candidate) => candidate.sentUuid === userMessageUuid
-    )
-    if (exact) {
-      settleWaiter(session, exact, uuid, onSettledLate)
-      return isUserReplay ? { requestedAt: exact.requestedAt } : null
-    }
-    const retired = session.retiredDispatchWaiters.find(
-      (candidate) => candidate.sentUuid === userMessageUuid
-    )
-    if (retired) {
-      forgetRetiredWaiter(session, retired)
-      recoverLateIdentity(session, retired, uuid, isUserReplay, onSettledLate)
-      return null
-    }
-    return null
-  }
-
-  const exact = session.dispatchWaiters.find((candidate) => candidate.sentUuid === uuid)
-  if (exact) {
-    settleWaiter(session, exact, uuid, onSettledLate)
-    return isUserReplay ? { requestedAt: exact.requestedAt } : null
-  }
-  const retired = session.retiredDispatchWaiters.find((candidate) => candidate.sentUuid === uuid)
-  if (retired) {
-    forgetRetiredWaiter(session, retired)
-    recoverLateIdentity(session, retired, uuid, isUserReplay, onSettledLate)
-    return null
-  }
-
-  if (isUserReplay) {
-    // Compatibility CLIs may mint a new replay uuid instead of echoing the
-    // client uuid. Content is an acceptable join only when it is the sole
-    // candidate on one side of the timeout boundary; with active and retired
-    // candidates present, identical prompts are intentionally left unknown.
-    const replayContentKey = claudeDispatchContentKey(envelope.content)
-    if (!session.replayContentFallbackBlocked && session.retiredDispatchWaiters.length === 0) {
-      const compatible = session.dispatchWaiters.filter(
-        (candidate) => candidate.replayContentKey === replayContentKey
-      )
-      if (compatible.length === 1) {
-        const [candidate] = compatible
-        settleWaiter(session, candidate!, uuid, onSettledLate)
-        return { requestedAt: candidate!.requestedAt }
-      }
-    } else if (!session.replayContentFallbackBlocked && session.dispatchWaiters.length === 0) {
-      const lateCompatible = session.retiredDispatchWaiters.filter(
-        (candidate) => candidate.replayContentKey === replayContentKey
-      )
-      if (lateCompatible.length === 1) {
-        const [candidate] = lateCompatible
-        forgetRetiredWaiter(session, candidate!)
-        recoverLateIdentity(session, candidate!, uuid, true, onSettledLate)
-        return null
-      }
-    }
-    return null
-  }
-  const current = session.dispatchWaiters[0]
-  if (isCompletedCommand && !current?.acceptsResult) {
-    return null
-  }
-  // A legacy result has no dispatch correlation. Any retired waiter makes queue order ambiguous,
-  // even when the retired dispatch was an ordinary turn rather than a slash command.
-  if (isCompletedCommand && session.retiredDispatchWaiters.length > 0) {
-    return null
-  }
-  // Once an eviction occurred, a fresh result uuid cannot be joined to a waiter by queue order.
-  if (isCompletedCommand && session.replayContentFallbackBlocked) {
-    return null
-  }
-  const waiter = uuid ? session.dispatchWaiters.shift() : undefined
-  if (waiter && uuid) {
-    settleWaiter(session, waiter, uuid, onSettledLate)
-    return isUserReplay ? { requestedAt: waiter.requestedAt } : null
-  }
-  return null
-}
-
-function settleWaiter(
-  session: ClaudeSession,
-  waiter: ClaudeDispatchWaiter,
-  uuid: string,
-  onSettledLate?: ClaudeLateDispatchSettlement
-): void {
-  const index = session.dispatchWaiters.indexOf(waiter)
-  if (index !== -1) {
-    session.dispatchWaiters.splice(index, 1)
-  }
-  waiter.settledUuid = uuid
-  waiter.resolve(uuid)
-  // Dispatch returned on admission, so the replay is what settles delivery.
-  if (waiter.clientMessageId) {
-    onSettledLate?.({
-      clientMessageId: waiter.clientMessageId,
-      providerIdentity: { provider: 'claude', sessionId: session.providerSessionId, uuid }
-    })
-  }
-}
-
-function recoverLateIdentity(
-  session: ClaudeSession,
-  waiter: ClaudeDispatchWaiter,
-  uuid: string,
-  isUserReplay: boolean,
-  onSettledLate?: ClaudeLateDispatchSettlement
-): void {
-  if (!isUserReplay && !waiter.acceptsResult) {
-    return
-  }
-  // The provider acted on this dispatch, so the send it came from is delivered.
-  // A retired replay settles delivery only; it cannot reopen a turn.
-  if (waiter.clientMessageId) {
-    onSettledLate?.({
-      clientMessageId: waiter.clientMessageId,
-      providerIdentity: { provider: 'claude', sessionId: session.providerSessionId, uuid }
-    })
-  }
-}
-
 export function settleCancelledClaudeDispatchWaiters(
   session: ClaudeSession,
   cancelledUuids: readonly string[],
@@ -216,7 +54,7 @@ export function settleCancelledClaudeDispatchWaiters(
       onSettledLate?.({
         clientMessageId: waiter.clientMessageId,
         state: 'rejected',
-        reason: DISPATCH_REJECTED_CANCELLED
+        ...claudeDispatchRejection(agentSessionFailureFact('cancelled'))
       })
     }
   }
@@ -226,36 +64,47 @@ export function settleCancelledClaudeDispatchWaiters(
  *  Retired rather than dropped: their identities stay joinable, bounded by
  *  `MAX_RETIRED_DISPATCH_WAITERS`. */
 export function retireClaudeDispatchWaiters(session: ClaudeSession): void {
-  failClaudeStartupGate(session, new Error('claude stream-json ended before startup completed'))
+  failClaudeStartup(session, new Error('claude stream-json ended before startup completed'))
   for (const waiter of session.dispatchWaiters.splice(0)) {
     retireWaiter(session, waiter)
     waiter.resolve(null)
   }
 }
 
+/** The row keeps only the marker released clients hide; why the write failed belongs in the log. */
+function claudeWriteFailureRejection(error: unknown): AgentJournalDispatchRejection {
+  console.warn('[claude-dispatch] message could not be handed to Claude:', error)
+  return claudeDispatchRejection(agentSessionFailureFact('writeFailed'))
+}
+
 export async function dispatchClaudeTurn(
   session: ClaudeSession,
-  input: { clientMessageId?: string; body: AgentJournalMessageItem; requestedAt?: number },
-  beforeDispatch?: () => Promise<void>,
-  onSettledLate?: ClaudeLateDispatchSettlement
+  input: {
+    clientMessageId?: string
+    body: AgentJournalMessageItem
+    requestedAt?: number
+    /** The frame's uuid, for a caller that correlates the provider's answer to it. */
+    sentUuid?: string
+  },
+  beforeDispatch?: () => Promise<void>
 ): Promise<AgentSessionDispatchOutcome> {
   let content: unknown[]
   try {
     content = await claudeDispatchMessageContent(input.body)
   } catch (error) {
-    return { state: 'rejected', reason: (error as Error).message }
+    return { state: 'rejected', ...claudeDispatchContentRejection(error) }
   }
   if (session.dispatchWaiters.length >= MAX_ACTIVE_DISPATCH_WAITERS) {
-    return { state: 'rejected', reason: DISPATCH_REJECTED_QUEUE_FULL }
+    return { state: 'rejected', ...claudeDispatchRejection(agentSessionFailureFact('queueFull')) }
   }
-  const startupFailure = claudeStartupFailureReason(session)
+  const startupFailure = claudeStartupFailureFact(session)
   if (startupFailure) {
-    return { state: 'rejected', reason: startupFailure }
+    return { state: 'rejected', ...claudeDispatchRejection(startupFailure) }
   }
   // Read the sent content, not the journal blocks: only the mapped trailing prompt decides
   // whether Claude runs a command, so the two cannot disagree about which frame settles this.
   const acceptsResult = claudeDispatchInvokesSlashCommand(content)
-  const sentUuid = randomUUID()
+  const sentUuid = input.sentUuid ?? randomUUID()
   const arm = () => {
     ++session.dispatchSequence
     // A context report asked for before this send may land after it and misstate the context.
@@ -276,14 +125,6 @@ export async function dispatchClaudeTurn(
     parent_tool_use_id: null,
     session_id: session.providerSessionId
   }
-  if (claudeStartupHoldsWrites(session)) {
-    return holdClaudeStartupWrite(session, {
-      message,
-      arm,
-      ...(beforeDispatch ? { beforeDispatch } : {}),
-      ...(onSettledLate ? { settleLate: onSettledLate } : {})
-    })
-  }
   const pending = { replay: beforeDispatch ? undefined : arm() }
   const authorize = beforeDispatch
     ? async () => {
@@ -304,7 +145,7 @@ export async function dispatchClaudeTurn(
       if (error instanceof AgentSessionPreDispatchError) {
         throw error
       }
-      return { state: 'rejected', reason: dispatchWriteFailureReason(error) }
+      return { state: 'rejected', ...claudeWriteFailureRejection(error) }
     }
     const waiter = replay.waiter
     if (waiter.settledUuid) {
@@ -322,7 +163,7 @@ export async function dispatchClaudeTurn(
       waiter.resolve(null)
       // The frame was never handed to the SDK's input pump, so this is not doubt:
       // the message provably did not happen, which is what `rejected` means.
-      return { state: 'rejected', reason: dispatchWriteFailureReason(error) }
+      return { state: 'rejected', ...claudeWriteFailureRejection(error) }
     }
     if (!waiter.retired) {
       retireWaiter(session, waiter)
@@ -332,6 +173,7 @@ export async function dispatchClaudeTurn(
   }
   // The write is the admission signal. Awaiting the echo here would block on the
   // turn already running, which is why the deadline this replaces kept declaring
-  // doubt about messages that were delivered. `settleWaiter` finishes the job.
+  // doubt about messages that were delivered. The replay resolution
+  // (`claude-replay-turn-resolution.ts`) finishes the job.
   return { state: 'admitted' }
 }
diff --git a/src/main/claude/claude-structured-effort-default-at-rest.test.ts b/src/main/claude/claude-structured-effort-default-at-rest.test.ts
new file mode 100644
index 00000000000..2175ef49e43
--- /dev/null
+++ b/src/main/claude/claude-structured-effort-default-at-rest.test.ts
@@ -0,0 +1,256 @@
+// A Claude chat at rest shows the effort its next start will run: a live child teaches the host
+// catalog what the CLI runs for each model when no effort is sent, and the resting read answers it.
+
+import { describe, expect, it } from 'vitest'
+import type { AgentSessionRecord } from '../../shared/agent-session-record'
+import { getAgentSessionOptionCatalog } from '../../shared/agent-session-option-catalog'
+import {
+  applyStructuredAgentSessionOptions,
+  createStructuredAgentSessionOptionState,
+  structuredAgentSessionOptionSnapshot
+} from '../../shared/structured-agent-session-options'
+import { createAgentModelCatalogService } from '../native-chat/agent-model-catalog/agent-model-catalog-service'
+import { agentModelCatalogFingerprintForRecord } from '../native-chat/agent-model-catalog/agent-model-catalog-fingerprint'
+import { AgentModelCatalogStore } from '../native-chat/agent-model-catalog/agent-model-catalog-store'
+import type { StructuredAgentSessionMutationContext } from '../native-chat/agent-session-wire/structured-agent-session-host-mutations'
+import { readStructuredAgentSessionOptions } from '../native-chat/agent-session-wire/structured-agent-session-options-read'
+import { nativeSessionOptionsFromReport } from '../native-chat/agent-session-wire/structured-agent-session-option-restoration'
+import {
+  ClaudeStructuredSessionAdapter,
+  type ClaudeStructuredSessionEvent
+} from './claude-structured-session-adapter'
+import {
+  PROVIDER_SESSION_ID,
+  fakeClaude,
+  identityFor,
+  recordingJournalSink
+} from './claude-structured-session-test-support'
+
+const SESSION = 'session-1'
+const ACCOUNT_HOME = '/accounts/claude'
+const EFFORTS = ['low', 'medium', 'high', 'xhigh', 'max']
+
+/** Claude Code 2.1.280's list_models rows: `default` resolves to the opus row. */
+const CATALOG = [
+  {
+    value: 'default',
+    resolvedModel: 'claude-opus-5-5[1m]',
+    displayName: 'Default (recommended)',
+    supportsEffort: true,
+    supportedEffortLevels: EFFORTS
+  },
+  {
+    value: 'opus[1m]',
+    resolvedModel: 'claude-opus-5-5[1m]',
+    displayName: 'Opus (1M context)',
+    supportsEffort: true,
+    supportedEffortLevels: EFFORTS
+  },
+  {
+    value: 'sonnet',
+    resolvedModel: 'claude-sonnet-5',
+    displayName: 'Sonnet',
+    supportsEffort: true,
+    supportedEffortLevels: EFFORTS
+  }
+]
+
+/** get_settings with nothing overriding the CLI's own default; an effort write moves both views. */
+function settingsWithNoOverride() {
+  const effective: { effortLevel?: string } = {}
+  const settings = {
+    effective,
+    sources: [],
+    applied: { model: 'claude-opus-5-5[1m]', effort: 'medium', advisor: null, ultracode: false }
+  }
+  const claude = fakeClaude({
+    initProof: 'session-start',
+    initModels: CATALOG,
+    settings,
+    routes: {
+      list_models: () => CATALOG,
+      apply_flag_settings: (params) => {
+        const written = params?.settings
+        const effort =
+          typeof written === 'object' && written !== null && 'effortLevel' in written
+            ? written.effortLevel
+            : undefined
+        if (typeof effort === 'string') {
+          effective.effortLevel = effort
+          settings.applied.effort = effort
+        }
+      }
+    }
+  })
+  return claude
+}
+
+async function startChild(
+  store: AgentModelCatalogStore,
+  options?: Record<string, string>,
+  events: ClaudeStructuredSessionEvent[] = []
+): Promise<ClaudeStructuredSessionAdapter> {
+  const adapter = new ClaudeStructuredSessionAdapter({
+    resolveLaunch: async () => ({
+      pathToClaudeCodeExecutable: 'claude',
+      options: {},
+      cwd: '/work/repo',
+      claudeConfigDir: ACCOUNT_HOME,
+      providerSessionId: PROVIDER_SESSION_ID,
+      resumeLeafUuid: null,
+      resumesTranscript: false,
+      continuesChain: false
+    }),
+    onEvent: (event) => events.push(event),
+    openConnection: settingsWithNoOverride().openConnection,
+    readProcessStartTime: async () => 1_700_000_000_000,
+    now: () => 1_700_000_000_500,
+    persistHandle: async () => {},
+    modelCatalog: store
+  })
+  await adapter.acquire({
+    identity: identityFor(SESSION),
+    fence: 7,
+    spawnToken: 'spawn-9',
+    events: recordingJournalSink(),
+    ...(options ? { options } : {})
+  })
+  await adapter.awaitStarted(SESSION)
+  return adapter
+}
+
+function restingRecord(options: Record<string, string>): AgentSessionRecord {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the resting read and the catalog key touch only these fields.
+  return {
+    provider: 'claude',
+    accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: ACCOUNT_HOME },
+    location: { wslDistro: null },
+    options
+  } as unknown as AgentSessionRecord
+}
+
+function catalogDefault(store: AgentModelCatalogStore, model: string): string | undefined {
+  const entry = store.get(agentModelCatalogFingerprintForRecord(restingRecord({})))
+  return entry?.models.find((row) => row.id === model)?.defaultEffort
+}
+
+/** The options a client reads for the chat once its child is gone. */
+function readAtRest(store: AgentModelCatalogStore, record: AgentSessionRecord) {
+  const modelCatalog = createAgentModelCatalogService({
+    store,
+    getRecord: () => record,
+    resolveAccountHome: async () => ({ variable: 'CLAUDE_CONFIG_DIR', path: ACCOUNT_HOME })
+  })
+  const resting = { child: null, params: { provider: 'claude' } }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the resting read touches only these members.
+  const context = {
+    deps: { adapter: {}, store: { getRecord: () => record }, modelCatalog },
+    serialize: (_sessionId: string, task: () => Promise<unknown>) => task(),
+    openConversation: async () => resting,
+    conversation: async () => resting
+  } as unknown as StructuredAgentSessionMutationContext
+  return readStructuredAgentSessionOptions(context, SESSION)
+}
+
+function pickerEffort(result: Awaited<ReturnType<typeof readAtRest>>) {
+  const seed = getAgentSessionOptionCatalog('claude')!
+  const state = applyStructuredAgentSessionOptions(
+    createStructuredAgentSessionOptionState('claude', seed),
+    seed,
+    result
+  )
+  const effort = structuredAgentSessionOptionSnapshot(state).find((row) => row.id === 'effort')
+  return effort?.kind.type === 'select' ? effort.kind.currentValue : undefined
+}
+
+describe('Claude effort default at rest', () => {
+  it("learns the model's default from a live child's applied effort", async () => {
+    const store = new AgentModelCatalogStore()
+    await startChild(store)
+
+    // Both rows run claude-opus-5-5[1m]; sonnet was not applied, so nothing is known of it.
+    expect(catalogDefault(store, 'opus[1m]')).toBe('medium')
+    expect(catalogDefault(store, 'sonnet')).toBeUndefined()
+  })
+
+  it('shows that default in the picker of a chat at rest', async () => {
+    const store = new AgentModelCatalogStore()
+    await startChild(store)
+
+    const result = await readAtRest(store, restingRecord({ model: 'opus[1m]' }))
+
+    expect(result.current).toMatchObject({ model: 'opus[1m]', effort: 'medium' })
+    expect(pickerEffort(result)).toBe('medium')
+  })
+
+  it("shows the user's pick at rest over the default", async () => {
+    const store = new AgentModelCatalogStore()
+    await startChild(store)
+
+    const result = await readAtRest(store, restingRecord({ model: 'opus[1m]', effort: 'max' }))
+
+    expect(result.current.effort).toBe('max')
+    expect(pickerEffort(result)).toBe('max')
+  })
+
+  it("never learns a user's pick as the default", async () => {
+    const store = new AgentModelCatalogStore()
+    const restored = await startChild(store, { model: 'opus[1m]', effort: 'high' })
+    await restored.readOptions({ sessionId: SESSION, fence: 7 })
+    expect(catalogDefault(store, 'opus[1m]')).toBeUndefined()
+
+    const other = new AgentModelCatalogStore()
+    const live = await startChild(other)
+    await live.setOption({ sessionId: SESSION, fence: 7, key: 'effort', value: 'xhigh' })
+    expect((await live.readOptions({ sessionId: SESSION, fence: 7 })).current.effort).toBe('xhigh')
+    expect(catalogDefault(other, 'opus[1m]')).toBe('medium')
+  })
+
+  it("leaves a Codex chat's unsaved effort blank at rest, as its live child does", async () => {
+    const store = new AgentModelCatalogStore()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the resting read and the catalog key touch only these fields.
+    const record = {
+      provider: 'codex',
+      accountHome: { variable: 'CODEX_HOME', path: '/accounts/codex' },
+      location: { wslDistro: null },
+      options: { model: 'gpt-5.5' }
+    } as unknown as AgentSessionRecord
+    store.recordSuccess(agentModelCatalogFingerprintForRecord(record), 'codex', {
+      models: [
+        {
+          id: 'gpt-5.5',
+          label: 'GPT-5.5',
+          isDefault: true,
+          defaultEffort: 'medium',
+          efforts: [
+            { value: 'medium', label: 'Medium' },
+            { value: 'high', label: 'High' }
+          ]
+        }
+      ],
+      fastModeTierByModel: new Map(),
+      origin: 'live-session'
+    })
+
+    const result = await readAtRest(store, record)
+
+    expect(result.current).toEqual({ model: 'gpt-5.5' })
+  })
+
+  it("never saves the applied effort as the chat's pick, yet shows it at rest", async () => {
+    const store = new AgentModelCatalogStore()
+    const events: ClaudeStructuredSessionEvent[] = []
+    await startChild(store, undefined, events)
+
+    const started = events.find((event) => event.type === 'started')
+    const reported = started?.type === 'started' ? started.reportedOptions : null
+    expect(reported).not.toHaveProperty('effort')
+    // The record the start persists names the listed row the catalog learned under.
+    const record = restingRecord(
+      nativeSessionOptionsFromReport({ reported: reported!, restoreSkipped: [] })
+    )
+    expect(record.options).toEqual({ model: 'opus[1m]' })
+    expect((await readAtRest(store, record)).current.effort).toBe('medium')
+    expect(record.options).toEqual({ model: 'opus[1m]' })
+  })
+})
diff --git a/src/main/claude/claude-structured-effort-reporting.test.ts b/src/main/claude/claude-structured-effort-reporting.test.ts
index 7cf59ee555b..2c319c86ee7 100644
--- a/src/main/claude/claude-structured-effort-reporting.test.ts
+++ b/src/main/claude/claude-structured-effort-reporting.test.ts
@@ -7,7 +7,7 @@ import {
 import { readClaudeSettingsEffort } from './claude-structured-session-options'
 import type { ClaudeSession } from './claude-structured-session-state'
 import type { ClaudeStructuredSessionEvent } from './claude-structured-session-adapter'
-import { acquired, fakeClaude } from './claude-structured-session-test-support'
+import { USER_MESSAGE, acquired, fakeClaude } from './claude-structured-session-test-support'
 
 /** Verbatim from Claude Code 2.1.258's get_settings response. */
 const REAL_SETTINGS = {
@@ -93,7 +93,14 @@ describe('Claude effort reporting', () => {
 
   it('keeps the init fixture free of an effort the real frame never sends', async () => {
     const events: ClaudeStructuredSessionEvent[] = []
-    await acquired(fakeClaude(), {}, events)
+    const adapter = await acquired(fakeClaude(), {}, events)
+    // Live: init arrives when the first command starts a cycle, not at startup.
+    await adapter.dispatch({
+      sessionId: 'session-1',
+      clientMessageId: 'seed-cycle',
+      body: USER_MESSAGE,
+      fence: 7
+    })
     const init = events.flatMap((event) =>
       event.type === 'message' && event.message.subtype === 'init' ? [event.message] : []
     )
diff --git a/src/main/claude/claude-structured-inbound-control.test.ts b/src/main/claude/claude-structured-inbound-control.test.ts
index 20d0b9dd06a..43c96ee8bea 100644
--- a/src/main/claude/claude-structured-inbound-control.test.ts
+++ b/src/main/claude/claude-structured-inbound-control.test.ts
@@ -41,10 +41,12 @@ function callbacksFor() {
 describe('Claude permission callbacks', () => {
   it('registers a decodable can_use_tool as a durable prompt and settles it from the registry', async () => {
     const control = callbacksFor()
+    const controller = new AbortController()
+    const removeListener = vi.spyOn(controller.signal, 'removeEventListener')
     const answered = control.canUseTool(
       'Bash',
       { command: 'git status' },
-      permissionOptions('perm-1', 'tool-1', new AbortController().signal, [
+      permissionOptions('perm-1', 'tool-1', controller.signal, [
         { type: 'addRules', rules: [], behavior: 'allow', destination: 'session' }
       ])
     )
@@ -63,6 +65,7 @@ describe('Claude permission callbacks', () => {
     // The prompt's settle is the SDK callback's own resolve — answering resolves this promise.
     found?.prompt.settle({ behavior: 'allow', toolUseID: 'tool-1' })
     await expect(answered).resolves.toEqual({ behavior: 'allow', toolUseID: 'tool-1' })
+    expect(removeListener).toHaveBeenCalledTimes(1)
   })
 
   it('keeps the SDK permission presentation and strips terminal escapes', async () => {
diff --git a/src/main/claude/claude-structured-inbound-control.ts b/src/main/claude/claude-structured-inbound-control.ts
index 8d2954f028f..b2bed91f1f4 100644
--- a/src/main/claude/claude-structured-inbound-control.ts
+++ b/src/main/claude/claude-structured-inbound-control.ts
@@ -56,6 +56,11 @@ export function buildClaudePermissionCallbacks(deps: ClaudePermissionCallbackDep
 } {
   const canUseTool: CanUseTool = (toolName, input, options) =>
     new Promise<PermissionResult | null>((resolve) => {
+      let cancel = (): void => {}
+      const settle = (response: PermissionResult | null): void => {
+        options.signal.removeEventListener('abort', cancel)
+        resolve(response)
+      }
       // Classify first so later permission-mode policy cannot swallow a plan proposal.
       const subject = claudePermissionSubject(toolName, input)
       const prompt = deps.prompts.register({
@@ -66,14 +71,14 @@ export function buildClaudePermissionCallbacks(deps: ClaudePermissionCallbackDep
         toolUseId: options.toolUseID,
         input,
         suggestions: options.suggestions ?? [],
-        settle: resolve,
+        settle,
         turnId: deps.currentTurnId?.() ?? null
       })
       if (!prompt) {
-        resolve(denySafeResult(options.toolUseID))
+        settle(denySafeResult(options.toolUseID))
         return
       }
-      const cancel = (): void => {
+      cancel = (): void => {
         if (deps.prompts.forgetIfPending(prompt)) {
           deps.emit({
             type: 'prompt-cancelled',
@@ -82,7 +87,7 @@ export function buildClaudePermissionCallbacks(deps: ClaudePermissionCallbackDep
           })
           // Null is the SDK's "no response written" sentinel: a cancelled request must not
           // be answered, only forgotten.
-          resolve(null)
+          settle(null)
         }
       }
       if (options.signal.aborted) {
diff --git a/src/main/claude/claude-structured-init-proof.ts b/src/main/claude/claude-structured-init-proof.ts
index c29cb2d4715..ae2ee5896a8 100644
--- a/src/main/claude/claude-structured-init-proof.ts
+++ b/src/main/claude/claude-structured-init-proof.ts
@@ -46,15 +46,25 @@ export function readClaudeModels(initialization: unknown): unknown[] {
     : []
 }
 
-/** CLI capabilities advertised on the initialize result or the yielded system/init frame. */
+/**
+ * The capabilities this CLI advertises: the first report given that names any, else `observed`.
+ * A SessionStart proof and the 2.1.280 initialize result name none, so only a turn's system/init
+ * may say what the binary supports, and a report naming none never retracts that.
+ */
 export function readClaudeCapabilities(
-  init: ClaudeInitObservation,
-  initialization: unknown
-): string[] {
-  const fromResult = isRecord(initialization) ? initialization.capabilities : undefined
-  const fromFrame = init.message.capabilities
-  const source = Array.isArray(fromResult) ? fromResult : Array.isArray(fromFrame) ? fromFrame : []
-  return source.filter((value): value is string => typeof value === 'string')
+  observed: readonly string[],
+  ...reports: unknown[]
+): readonly string[] {
+  for (const report of reports) {
+    const advertised = isRecord(report) ? report.capabilities : undefined
+    const capabilities = Array.isArray(advertised)
+      ? advertised.filter((value): value is string => typeof value === 'string')
+      : []
+    if (capabilities.length > 0) {
+      return capabilities
+    }
+  }
+  return observed
 }
 
 export function claudeInitializationAuthError(
@@ -64,7 +74,8 @@ export function claudeInitializationAuthError(
     isRecord(initialization) && isRecord(initialization.account) ? initialization.account : null
   return readClaudeFrameString(account ?? {}, 'tokenSource') === 'none'
     ? new AgentSessionAcquisitionRefusal(
-        'Claude is not signed in for the selected account. Sign in with the Claude CLI for this CLAUDE_CONFIG_DIR, then retry.'
+        'Claude is not signed in for the selected account. Sign in with the Claude CLI for this CLAUDE_CONFIG_DIR, then retry.',
+        'notSignedIn'
       )
     : null
 }
diff --git a/src/main/claude/claude-structured-journal-prompt-retry.test.ts b/src/main/claude/claude-structured-journal-prompt-retry.test.ts
index 491152668ed..d22362467e9 100644
--- a/src/main/claude/claude-structured-journal-prompt-retry.test.ts
+++ b/src/main/claude/claude-structured-journal-prompt-retry.test.ts
@@ -18,7 +18,6 @@ function approval(promptKey: string): ClaudePendingPrompt {
     input: { command: 'git status' },
     suggestions: [],
     questionIds: [],
-    answers: new Map(),
     settle: () => {}
   }
 }
diff --git a/src/main/claude/claude-structured-journal-prompts.ts b/src/main/claude/claude-structured-journal-prompts.ts
index 0d2509723f6..92301af106c 100644
--- a/src/main/claude/claude-structured-journal-prompts.ts
+++ b/src/main/claude/claude-structured-journal-prompts.ts
@@ -1,7 +1,8 @@
 import type {
   AgentJournalApprovalItem,
   AgentJournalItemIdentity,
-  AgentJournalQuestionItem
+  AgentJournalQuestionItem,
+  AgentJournalTurnScope
 } from '../../shared/agent-session-journal-types'
 import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
 import { cancelledJournalPromptBody } from '../native-chat/agent-session-journal/journal-prompt-body-bounds'
@@ -22,6 +23,7 @@ const ADMITTED = { accepted: true } as const
 type ClaudeJournalPrompt = {
   identity: AgentJournalItemIdentity
   body: AgentJournalApprovalItem | AgentJournalQuestionItem
+  turnScope: AgentJournalTurnScope
 }
 
 type ClaudeJournalPromptEntry = {
@@ -54,7 +56,9 @@ export class ClaudeJournalPrompts {
   constructor(
     private readonly deps: {
       sink: StructuredAgentSessionEventSink
-      bindPromptItemId?: (journalItemId: string, promptKey: string, questionId?: string) => void
+      /** The turn that raised the prompt: the open one, else the conversation. */
+      turnScope: () => AgentJournalTurnScope
+      bindPromptItemId?: (journalItemId: string, promptKey: string) => void
       questionItems?: (input: {
         sessionId: string
         prompt: Extract<ClaudeStructuredSessionEvent, { type: 'prompt' }>['prompt']
@@ -75,13 +79,14 @@ export class ClaudeJournalPrompts {
    */
   handle(event: Extract<ClaudeStructuredSessionEvent, { type: 'prompt' }>): void {
     const items: ClaudeJournalPrompt[] = []
+    const turnScope = this.deps.turnScope()
     if (event.prompt.kind === 'question') {
       for (const question of (this.deps.questionItems ?? claudeQuestionItems)({
         sessionId: event.sessionId,
         prompt: event.prompt
       })) {
-        items.push(question)
-        this.deps.sink.appendItem(question.identity, question.body)
+        items.push({ ...question, turnScope })
+        this.deps.sink.appendItem(question.identity, question.body, { turnScope })
         this.deps.bindPromptItemId?.(agentJournalItemKey(question.identity), event.prompt.promptKey)
       }
     } else {
@@ -90,8 +95,8 @@ export class ClaudeJournalPrompts {
         promptKey: event.prompt.promptKey
       })
       const body = claudeApprovalItem(event.prompt)
-      items.push({ identity, body })
-      this.deps.sink.appendItem(identity, body)
+      items.push({ identity, body, turnScope })
+      this.deps.sink.appendItem(identity, body, { turnScope })
       this.deps.bindPromptItemId?.(agentJournalItemKey(identity), event.prompt.promptKey)
     }
     this.deletePrompt(event.prompt.promptKey)
@@ -104,10 +109,11 @@ export class ClaudeJournalPrompts {
     if (items.length === 0) {
       return ADMITTED
     }
-    const mutations = items.map(({ identity, body }) => ({
+    const mutations = items.map(({ identity, body, turnScope }) => ({
       kind: 'item' as const,
       identity,
-      body: cancelledPromptBody(body)
+      body: cancelledPromptBody(body),
+      turnScope
     }))
     let admission: StructuredAgentSessionSinkAdmission
     if (this.deps.sink.tryAppendLifecycleBatch) {
@@ -129,9 +135,10 @@ export class ClaudeJournalPrompts {
         return ADMITTED
       }
       const body = cancelledPromptBody(item.body)
+      const options = { lifecycle: true, turnScope: item.turnScope }
       admission = this.deps.sink.tryAppendItem
-        ? this.deps.sink.tryAppendItem(item.identity, body, { lifecycle: true })
-        : (this.deps.sink.appendItem(item.identity, body, { lifecycle: true }), ADMITTED)
+        ? this.deps.sink.tryAppendItem(item.identity, body, options)
+        : (this.deps.sink.appendItem(item.identity, body, options), ADMITTED)
     } else {
       return { accepted: false, reason: 'failed' }
     }
diff --git a/src/main/claude/claude-structured-journal-translation-background-tasks.test.ts b/src/main/claude/claude-structured-journal-translation-background-tasks.test.ts
index 170f520e9ec..7b224e8c51a 100644
--- a/src/main/claude/claude-structured-journal-translation-background-tasks.test.ts
+++ b/src/main/claude/claude-structured-journal-translation-background-tasks.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../shared/agent-session-journal-types'
 import { describe, expect, it, vi } from 'vitest'
 import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
 import type {
@@ -201,7 +202,8 @@ describe('claude journal translation — background task rows', () => {
     deferred.bind(target)
     deferred.sink.appendItem(
       { provider: 'orca', clientMessageId: 'blocked-prefill' },
-      { kind: 'message', role: 'system', blocks: [{ type: 'text', text: 'prefill' }] }
+      { kind: 'message', role: 'system', blocks: [{ type: 'text', text: 'prefill' }] },
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await appendEntered.promise
     const notification = systemFrame({
diff --git a/src/main/claude/claude-structured-journal-translation-subagents.test.ts b/src/main/claude/claude-structured-journal-translation-subagents.test.ts
index d122d0af7a2..89df86122b8 100644
--- a/src/main/claude/claude-structured-journal-translation-subagents.test.ts
+++ b/src/main/claude/claude-structured-journal-translation-subagents.test.ts
@@ -529,7 +529,9 @@ describe('claude journal translation — which agent produced a row', () => {
       (entry) => orcaClientMessageId(entry.identity) === 'claude-tool:claude-session:toolu_bash'
     )
     expect(row?.body).toMatchObject({ kind: 'tool-call', state: 'completed' })
-    expect(row?.options).toEqual({})
+    expect(row?.options).toEqual({
+      turnScope: { kind: 'turn', turnItemId: expect.any(String) }
+    })
   })
 
   /** One streamed text block, as the SDK sends it: a message start, then deltas.
diff --git a/src/main/claude/claude-structured-journal-translation-turn-timing.test.ts b/src/main/claude/claude-structured-journal-translation-turn-timing.test.ts
index ad76cd2792b..ee0f4970f4d 100644
--- a/src/main/claude/claude-structured-journal-translation-turn-timing.test.ts
+++ b/src/main/claude/claude-structured-journal-translation-turn-timing.test.ts
@@ -161,7 +161,7 @@ describe('Claude structured turn timing', () => {
         state: 'running',
         startedAt: 1_000,
         userItemId: USER_1_KEY,
-        options: { observedAt: 1_000 }
+        options: { observedAt: 1_000, turnScope: { kind: 'thread' } }
       }
     ])
   })
@@ -194,7 +194,7 @@ describe('Claude structured turn timing', () => {
       startedAt: 1_000,
       completedAt: 4_500,
       userItemId: USER_1_KEY,
-      options: {}
+      options: { turnScope: { kind: 'thread' } }
     })
     expect(state.items.at(-1)?.identity).toEqual(state.items[0]?.identity)
   })
diff --git a/src/main/claude/claude-structured-journal-translation.test.ts b/src/main/claude/claude-structured-journal-translation.test.ts
index 574547ee731..d868b3816c4 100644
--- a/src/main/claude/claude-structured-journal-translation.test.ts
+++ b/src/main/claude/claude-structured-journal-translation.test.ts
@@ -869,7 +869,6 @@ function prompt(
   return {
     ...input,
     suggestions: [],
-    answers: new Map(),
     settle: () => {}
   }
 }
diff --git a/src/main/claude/claude-structured-journal-translation.ts b/src/main/claude/claude-structured-journal-translation.ts
index c18392e1aa9..8c8ff1470f4 100644
--- a/src/main/claude/claude-structured-journal-translation.ts
+++ b/src/main/claude/claude-structured-journal-translation.ts
@@ -9,9 +9,7 @@ import type { ClaudePromptRegistry } from './claude-structured-prompt-replies'
 import { claudeProviderFrameActivity } from '../native-chat/agent-session-wire/provider-frame-activity'
 import {
   claudeProviderFrameKind,
-  claudeResultFailure,
-  createClaudeProviderFrameFallback,
-  isSettledClaudeResultKind
+  createClaudeProviderFrameFallback
 } from './claude-structured-provider-fallback'
 import { taskFrameSentence } from './claude-background-task-frames'
 import { ClaudeBackgroundTaskRows } from './claude-background-task-rows'
@@ -26,19 +24,20 @@ import {
   claudeStreamTurnSource,
   isRootClaudeFrame
 } from './claude-turn-opening'
-import { claudeTurnEndForResult } from './claude-turn-lifecycle-item'
 import { ClaudeOpenTurn } from './claude-open-turn'
+import { claudeCommandCurrentTurn, observeClaudeCommandFrame } from './claude-command-turn'
 import { ClaudeContextFacts } from './claude-context-facts'
 import { claudeSessionStateEndsTurn } from './claude-session-state-turn-over'
 import { ClaudeJournalPrompts } from './claude-structured-journal-prompts'
 import { claudeChildToolQueries } from './claude-child-tool-queries'
 import { journalClaudeMessage, type ClaudeMessageJournalContext } from './claude-message-journaling'
+import { journalClaudeResult, type ClaudeResultJournalContext } from './claude-result-journaling'
 
 export type { ClaudeJournalTranslator } from './claude-journal-translator-contract'
 
 export type ClaudeJournalTranslatorDeps = {
   sink: StructuredAgentSessionEventSink
-  bindPromptItemId?: (journalItemId: string, promptKey: string, questionId?: string) => void
+  bindPromptItemId?: (journalItemId: string, promptKey: string) => void
   coalesceMs?: number
   schedule?: AgentSessionDeltaCoalescerDeps['schedule']
   fallbackIdPrefix?: string
@@ -56,8 +55,7 @@ export function createClaudeSessionJournalTranslator(
         sink,
         fallbackIdPrefix,
         ...(onBackgroundTaskJournalFailure ? { onBackgroundTaskJournalFailure } : {}),
-        bindPromptItemId: (itemId, promptKey, questionId) =>
-          prompts.bindJournalItemId(itemId, promptKey, questionId)
+        bindPromptItemId: (itemId, promptKey) => prompts.bindJournalItemId(itemId, promptKey)
       })
     : null
 }
@@ -66,7 +64,9 @@ export function createClaudeJournalTranslator(
   deps: ClaudeJournalTranslatorDeps
 ): ClaudeJournalTranslator {
   const tools = new Map<string, ClaudeToolUse>()
-  const prompts = new ClaudeJournalPrompts(deps)
+  // Every row joins the root turn open when it is written, whoever produced it.
+  const turnScope = () => turn.turnScope
+  const prompts = new ClaudeJournalPrompts({ ...deps, turnScope })
   const streamedBlocks = createClaudeStreamedBlockRegistry()
   const turn = new ClaudeOpenTurn({
     sink: deps.sink,
@@ -74,14 +74,13 @@ export function createClaudeJournalTranslator(
     onOpen: () => context.markActivity()
   })
   const context = new ClaudeContextFacts(turn, deps.sink)
-  const providerFallback = createClaudeProviderFrameFallback(
-    deps.sink,
-    deps.fallbackIdPrefix ?? 'acquisition'
-  )
+  const fallbackId = deps.fallbackIdPrefix ?? 'acquisition'
+  const providerFallback = createClaudeProviderFrameFallback(deps.sink, fallbackId, turnScope)
   const toolOrigins = new ClaudeToolOriginRegistry()
   const subagents = new ClaudeSubagentRoster({
     sink: deps.sink,
     currentGroupKey: () => turn.groupKey,
+    currentTurnScope: turnScope,
     isForwardedParentTool: (toolUseId) => toolOrigins.has(toolUseId),
     childOwnerRefOf: (toolUseId) => toolOrigins.childOwnerRef(toolUseId),
     // A settled group can receive no further announcement, so a correction
@@ -91,6 +90,7 @@ export function createClaudeJournalTranslator(
   const childQueries = claudeChildToolQueries({ tools, toolOrigins, linkage: subagents.linkage })
   const corrections = new ClaudeProvisionalRowCorrections({
     ...subagents.linkage,
+    turnScope,
     rewrite: (identity, body, options) => {
       // The admission-returning path, so a correction the sink refuses under
       // backpressure stays owed instead of vanishing. Sinks without it accept
@@ -111,6 +111,7 @@ export function createClaudeJournalTranslator(
     // turn, or the session shows the row while reading idle.
     openOutputTurn: (frame, observedAt) =>
       turn.ensureOpen(frame, claudeStreamTurnSource(frame), observedAt),
+    turnScope,
     ...(deps.onBackgroundTaskJournalFailure
       ? { onPersistenceFailure: deps.onBackgroundTaskJournalFailure }
       : {})
@@ -120,7 +121,8 @@ export function createClaudeJournalTranslator(
     ...(deps.schedule ? { schedule: deps.schedule } : {}),
     producer: subagents.linkage,
     persist: (identity, text, options) => {
-      deps.sink.appendItem(identity, claudeStreamingMessageBody(text), options)
+      const body = claudeStreamingMessageBody(text)
+      deps.sink.appendItem(identity, body, { ...options, turnScope: turnScope() })
       deps.sink.publish()
     }
   })
@@ -162,6 +164,8 @@ export function createClaudeJournalTranslator(
     turn
   }
 
+  const resultContext: ClaudeResultJournalContext = { ...messageContext, prompts, context }
+
   const handleMessage = (
     message: Record<string, unknown>,
     startsTurn: boolean,
@@ -185,6 +189,24 @@ export function createClaudeJournalTranslator(
       }
       if (event.type === 'message') {
         context.observe(event.message, event.observedAt ?? Date.now())
+        // A root init is the CLI starting a new request cycle (measured per turn,
+        // per queued turn, per background wake, per /compact); a send replayed
+        // after that cycle's first root work was folded into it. Task frames are
+        // not cycle work: they arrive between cycles too.
+        if (isRootClaudeFrame(event.message)) {
+          if (event.message.type === 'system' && event.message.subtype === 'init') {
+            turn.observeProviderCycleStart()
+          } else if (
+            event.startsTurn === true ||
+            event.message.type === 'assistant' ||
+            event.message.type === 'stream_event'
+          ) {
+            turn.observeProviderCycleWork()
+          }
+        }
+      }
+      if (event.type === 'message' && observeClaudeCommandFrame(turn.command, event.message)) {
+        return
       }
       if (event.type === 'message' && handleStream(event.message, event.observedAt ?? Date.now())) {
         return
@@ -204,41 +226,7 @@ export function createClaudeJournalTranslator(
         prompts.retryPendingCancellations()
         prompts.cancel(event.promptKey)
       } else if (event.type === 'message' && event.message.type === 'result') {
-        // Every turn this translator opens is root by construction, so a nested
-        // result settles the child that produced it and never the turn. The
-        // diagnostic below still runs: a child's failure is reportable even when
-        // it ends no turn.
-        const settlesTurn = isRootClaudeFrame(event.message)
-        if (settlesTurn) {
-          prompts.retryPendingCancellations()
-          turn.suppressReopenOnFailure(event.message.is_error === true)
-          // The turn is over however it ended, so a foreground child still
-          // reported as working will never be settled by an event.
-          subagents.settleTurn(turn.groupKey)
-          context.settle(
-            event.message,
-            claudeTurnEndForResult(event.message, event.observedAt ?? Date.now())
-          )
-          // The turn is over. A block still awaiting its final keeps the text the
-          // flush above journaled, but its live state goes: an interrupted turn
-          // would otherwise retain that text for the life of the session.
-          streamedBlocks.clear()
-          streamedText.settle()
-        }
-        const kind = claudeProviderFrameKind(event.message)
-        const failure = claudeResultFailure(event.message)
-        if (failure || !isSettledClaudeResultKind(kind)) {
-          providerFallback.append(
-            kind,
-            event.message,
-            failure?.text,
-            undefined,
-            undefined,
-            // A result that settles no turn is a CHILD's result: this
-            // translator only ever opens root turns.
-            settlesTurn ? undefined : corrections.stampFor(claudeFrameParentRef(event.message))
-          )
-        }
+        journalClaudeResult(resultContext, event.message, event.observedAt ?? Date.now())
       } else if (event.type === 'message') {
         const backgroundTaskCovered = backgroundTasks.observe(
           event.message,
@@ -282,6 +270,15 @@ export function createClaudeJournalTranslator(
     get currentTurnId() {
       return turn.id
     },
+    get commandTurnId() {
+      return turn.command ? turn.id : null
+    },
+    beginCommand: (start) => turn.beginCommand(claudeCommandCurrentTurn(start)),
+    forgetCommand: (turnId) => turn.forgetCommand(turnId),
+    commandInterruptRequested: (turnId) => turn.commandInterruptRequested(turnId),
+    get openTurnInLiveProviderCycle() {
+      return turn.openedInLiveProviderCycle
+    },
     flush: streamedText.flush,
     childToolOwner: childQueries.childToolOwner,
     childActivity: childQueries.childActivity,
diff --git a/src/main/claude/claude-structured-launch-resolution.test.ts b/src/main/claude/claude-structured-launch-resolution.test.ts
index c54d1a5179f..66fed64c323 100644
--- a/src/main/claude/claude-structured-launch-resolution.test.ts
+++ b/src/main/claude/claude-structured-launch-resolution.test.ts
@@ -161,6 +161,19 @@ describe('claude structured launch resolution', () => {
     expect(launch.options.sessionId).toBeUndefined()
   })
 
+  it('names the child by the Orca session id, over any id the configured overlay carries', async () => {
+    // The Orca-minted id, never the provider's: the provider id rotates on /clear.
+    const launch = await resolverFor(record(), () => ({
+      ORCA_AGENT_SESSION_ID: 'a0b1c2d3-0000-4000-8000-00000000abcd'
+    }))({ identity: IDENTITY })
+
+    expect(launch.env).toMatchObject({
+      ORCA_AGENT_SESSION_ID: SESSION_ID,
+      ORCA_CLI_COMMAND: expect.stringMatching(/^[^:;]*[\\/]cli[\\/]bin[\\/]orca-dev$/)
+    })
+    expect(launch.env?.ORCA_AGENT_SESSION_ID).not.toBe(launch.providerSessionId)
+  })
+
   it('forces session-state events on when the inherited overlay disables them', async () => {
     const launch = await resolverFor(record(), () => ({
       [CLAUDE_SESSION_STATE_EVENTS_ENV]: '0'
@@ -492,16 +505,17 @@ describe('claude structured launch resolution', () => {
 
       gate = WSL_ONLY_NORMALIZED
 
-      // Reacquire after the account state changed: refused before anything spawns.
-      await expect(resolve({ identity: identityAt('leaf-current') })).rejects.toBeInstanceOf(
-        AgentSessionPreSpawnError
-      )
+      // Reacquire after the account state changed: refused before anything spawns, naming the
+      // account shape a person can change.
+      const refused = resolve({ identity: identityAt('leaf-current') })
+      await expect(refused).rejects.toBeInstanceOf(AgentSessionPreSpawnError)
+      await expect(refused).rejects.toMatchObject({ reason: 'managedAccountUnsupported' })
     })
 
-    it('fails closed when the account state cannot be read', async () => {
-      await expect(
-        resolverWithGate(() => null)({ identity: identityAt('leaf-current') })
-      ).rejects.toBeInstanceOf(AgentSessionPreSpawnError)
+    it('fails closed when the account state cannot be read, naming no situation', async () => {
+      const refused = resolverWithGate(() => null)({ identity: identityAt('leaf-current') })
+      await expect(refused).rejects.toBeInstanceOf(AgentSessionPreSpawnError)
+      await expect(refused).rejects.toMatchObject({ reason: undefined })
     })
 
     it('keeps resolving when no gate is wired, so other embedders are unaffected', async () => {
diff --git a/src/main/claude/claude-structured-launch-resolution.ts b/src/main/claude/claude-structured-launch-resolution.ts
index a2b3d41bbfd..29703dfd8eb 100644
--- a/src/main/claude/claude-structured-launch-resolution.ts
+++ b/src/main/claude/claude-structured-launch-resolution.ts
@@ -8,7 +8,7 @@ import type { AgentSessionJournalIdentity } from '../../shared/agent-session-jou
 import { agentSessionProviderHandleChainHead } from '../../shared/agent-session-provider-handle'
 import { LOCAL_EXECUTION_HOST_ID } from '../../shared/execution-host'
 import { withCliRuntimeOnPath } from '../../shared/node-cli-command-resolution'
-import { structuredWorkerChildIdentityEnv } from '../runtime/structured-worker-child-identity-env'
+import { structuredSessionChildIdentityEnv } from '../runtime/structured-session-child-identity-env'
 import {
   CLAUDE_AUTH_ENV_CONFLICT_MESSAGE,
   CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE,
@@ -22,6 +22,7 @@ import {
 } from '../claude-accounts/live-pty-gate'
 import { AgentSessionPreSpawnError } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
 import {
+  hasWslBoundClaudeAccount,
   structuredClaudeMatchesActiveManagedAccount,
   type ClaudeManagedAccountGateSettings
 } from '../native-chat/claude-structured-managed-account-support'
@@ -172,7 +173,9 @@ export async function resolveClaudeStructuredInvocation(
   // Under a managed account the pinned credential is the only auth this launch may
   // use, so an explicit override is refused rather than silently beating the pin.
   if (auth.stripAuthEnv && hasClaudeAuthEnvConflict(overlay)) {
-    throw new Error(CLAUDE_AUTH_ENV_CONFLICT_MESSAGE)
+    throw new AgentSessionPreSpawnError(new Error(CLAUDE_AUTH_ENV_CONFLICT_MESSAGE), {
+      reason: 'managedAccountEnvOverride'
+    })
   }
   // Why the overlay merges onto the inherited env rather than replacing it: the child
   // still needs PATH and the rest of the shell environment, and withCliRuntimeOnPath
@@ -209,7 +212,9 @@ export async function assertClaudeAuthSwitchSettled(
   timeoutMs = CLAUDE_AUTH_SWITCH_SETTLE_TIMEOUT_MS
 ): Promise<void> {
   if (!(await whenClaudeAuthSwitchSettles(timeoutMs))) {
-    throw new Error(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE)
+    throw new AgentSessionPreSpawnError(new Error(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE), {
+      reason: 'accountSwitchInProgress'
+    })
   }
 }
 
@@ -247,12 +252,12 @@ export function createClaudeStructuredLaunchResolver(
     // Every acquisition, not just the first: the account state can change under a live session, and
     // a reacquire after an unexpected exit would otherwise spawn under whatever it has become.
     // Codex has no gate here — it resolves its account on a different path.
-    if (
-      deps.readManagedAccountGate &&
-      !structuredClaudeMatchesActiveManagedAccount(deps.readManagedAccountGate())
-    ) {
+    const gate = deps.readManagedAccountGate?.()
+    if (gate !== undefined && !structuredClaudeMatchesActiveManagedAccount(gate)) {
+      // Unreadable account state names no situation a person can act on, so only the log reads it.
       throw new AgentSessionPreSpawnError(
-        'structured Claude is not offered under the active managed Claude account'
+        'structured Claude is not offered under the active managed Claude account',
+        gate && hasWslBoundClaudeAccount(gate) ? { reason: 'managedAccountUnsupported' } : {}
       )
     }
     const head = agentSessionProviderHandleChainHead(record.providerHandleChain)
@@ -283,9 +288,8 @@ export function createClaudeStructuredLaunchResolver(
       (await deps.resolvePermissionMode?.()) ?? 'default'
     )
     const { command, env } = await resolveClaudeStructuredInvocation(deps, (base) =>
-      // Only a dispatched structured worker gets the orchestration identity and the Orca CLI on
-      // PATH; an ordinary chat session's env passes through untouched.
-      structuredWorkerChildIdentityEnv(record.sessionId, {
+      // Every structured session speaks orchestration as itself: its injected id and the Orca CLI.
+      structuredSessionChildIdentityEnv(record.sessionId, {
         ...base,
         // The turn translator relies on Claude's authoritative idle frame when no result arrives.
         [CLAUDE_SESSION_STATE_EVENTS_ENV]: '1'
diff --git a/src/main/claude/claude-structured-model-confirmation.test.ts b/src/main/claude/claude-structured-model-confirmation.test.ts
index 96d7e9daa39..f4034400cbf 100644
--- a/src/main/claude/claude-structured-model-confirmation.test.ts
+++ b/src/main/claude/claude-structured-model-confirmation.test.ts
@@ -1,7 +1,12 @@
 import { describe, expect, it } from 'vitest'
 import { setClaudeStructuredOption } from './claude-structured-options'
 import type { ClaudeSession } from './claude-structured-session-state'
-import { PROVIDER_SESSION_ID, acquired, fakeClaude } from './claude-structured-session-test-support'
+import {
+  PROVIDER_SESSION_ID,
+  USER_MESSAGE,
+  acquired,
+  fakeClaude
+} from './claude-structured-session-test-support'
 
 /** Verbatim rows from Claude Code 2.1.258's list_models response. */
 const CATALOG = [
@@ -147,6 +152,13 @@ describe('Claude model confirmation', () => {
       routes: { list_models: () => CATALOG }
     })
     const adapter = await acquired(claude)
+    // The model is confirmed by a cycle's init frame, so start one.
+    await adapter.dispatch({
+      sessionId: 'session-1',
+      clientMessageId: 'seed-cycle',
+      body: USER_MESSAGE,
+      fence: 7
+    })
 
     await adapter.setOption({ sessionId: 'session-1', key: 'effort', value: 'high', fence: 7 })
     await expect(adapter.readOptions({ sessionId: 'session-1', fence: 7 })).resolves.toMatchObject({
diff --git a/src/main/claude/claude-structured-options.test.ts b/src/main/claude/claude-structured-options.test.ts
index e02647f3625..a92149a2cdd 100644
--- a/src/main/claude/claude-structured-options.test.ts
+++ b/src/main/claude/claude-structured-options.test.ts
@@ -11,7 +11,7 @@ import {
 import { ClaudeBackgroundTaskTracker } from './claude-background-task-tracker'
 import { ClaudeChildWorkDecoder } from './claude-child-work-decoder'
 import { ClaudeSlashCommandCatalog } from './claude-slash-command-catalog'
-import { createClaudeSessionStartupGate } from './claude-structured-session-startup-gate'
+import { createClaudeSessionStartup } from './claude-structured-session-startup-state'
 import {
   claudeStructuredSessionOptionsFrom,
   observeClaudeFastModeFacts,
@@ -48,7 +48,7 @@ function sessionFor(setModel: ClaudeSession['connection']['setModel']): ClaudeSe
     capabilities: [],
     events: undefined,
     translator: null,
-    startup: { ...createClaudeSessionStartupGate(), state: 'proven' }
+    startup: { ...createClaudeSessionStartup(), state: 'proven' }
   }
 }
 
diff --git a/src/main/claude/claude-structured-options.ts b/src/main/claude/claude-structured-options.ts
index 0090cd2f039..2f0b7ac4b70 100644
--- a/src/main/claude/claude-structured-options.ts
+++ b/src/main/claude/claude-structured-options.ts
@@ -41,6 +41,13 @@ export function restoredClaudeStructuredSessionOptions(
   )
 }
 
+/** The keys `setClaudeStructuredOption` writes; a pick made at rest is checked against these. */
+const CLAUDE_STRUCTURED_OPTION_KEYS = new Set(['model', 'permissionMode', 'effort', 'fastMode'])
+
+export function isClaudeStructuredOptionKey(key: string): boolean {
+  return CLAUDE_STRUCTURED_OPTION_KEYS.has(key)
+}
+
 /** A client's write; the startup restore writes through `setClaudeStructuredOption` directly. */
 export function setClaudeStructuredSessionOption(
   session: ClaudeSession,
@@ -51,7 +58,8 @@ export function setClaudeStructuredSessionOption(
   if (session.startup.state !== 'proven') {
     return Promise.reject(
       new AgentSessionOptionRejectedError(
-        'Claude is still starting; options can be changed once it is ready.'
+        'Claude is still starting; options can be changed once it is ready.',
+        'providerStarting'
       )
     )
   }
diff --git a/src/main/claude/claude-structured-prompt-items.test.ts b/src/main/claude/claude-structured-prompt-items.test.ts
index 297bf405435..f032d4bcf8d 100644
--- a/src/main/claude/claude-structured-prompt-items.test.ts
+++ b/src/main/claude/claude-structured-prompt-items.test.ts
@@ -1,13 +1,11 @@
 import { describe, expect, it } from 'vitest'
 import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
-import { encodeAgentSessionQuestionAnswers } from '../../shared/agent-session-question-answer'
 import { cancelledJournalPromptBody } from '../native-chat/agent-session-journal/journal-prompt-body-bounds'
 import { MAX_JOURNAL_LIFECYCLE_BATCH_BYTES } from '../native-chat/agent-session-journal/journal-row-schema'
 import { MAX_TOOL_DETAIL_LENGTH } from '../../shared/native-chat-tool-summary'
 import { claudeApprovalItem, claudeQuestionItems } from './claude-structured-prompt-items'
 import {
-  applyClaudePromptAnswer,
-  encodeClaudeQuestionOptionId,
+  buildClaudePromptReply,
   type ClaudePendingPrompt
 } from './claude-structured-prompt-replies'
 
@@ -24,7 +22,6 @@ function approvalPrompt(
     input,
     suggestions: [],
     questionIds: [],
-    answers: new Map(),
     settle: () => {},
     ...presentation
   }
@@ -121,19 +118,21 @@ describe('Claude structured approval presentation', () => {
       }
     )
 
-    expect(applyClaudePromptAnswer({ prompt }, 'deny')).toEqual({
+    expect(buildClaudePromptReply(prompt, { kind: 'option', optionId: 'deny' })).toEqual({
       behavior: 'deny',
       message: 'User denied this action.',
       toolUseID: 'tool-approval'
     })
-    expect(applyClaudePromptAnswer({ prompt }, 'allowForSession')).toEqual({
-      behavior: 'allow',
-      updatedInput: { command: 'rm output.txt' },
-      updatedPermissions: [
-        { type: 'addRules', rules: [], behavior: 'allow', destination: 'session' }
-      ],
-      toolUseID: 'tool-approval'
-    })
+    expect(buildClaudePromptReply(prompt, { kind: 'option', optionId: 'allowForSession' })).toEqual(
+      {
+        behavior: 'allow',
+        updatedInput: { command: 'rm output.txt' },
+        updatedPermissions: [
+          { type: 'addRules', rules: [], behavior: 'allow', destination: 'session' }
+        ],
+        toolUseID: 'tool-approval'
+      }
+    )
   })
 
   it('asks Claude to revise a rejected plan while accepting legacy session replies', () => {
@@ -145,16 +144,18 @@ describe('Claude structured approval presentation', () => {
       }
     )
 
-    expect(applyClaudePromptAnswer({ prompt }, 'deny')).toEqual({
+    expect(buildClaudePromptReply(prompt, { kind: 'option', optionId: 'deny' })).toEqual({
       behavior: 'deny',
       message: 'The user asked you to keep planning. Revise the plan and call ExitPlanMode again.',
       toolUseID: 'tool-approval'
     })
-    expect(applyClaudePromptAnswer({ prompt }, 'allowForSession')).toEqual({
-      behavior: 'allow',
-      updatedInput: { plan: '# Release' },
-      toolUseID: 'tool-approval'
-    })
+    expect(buildClaudePromptReply(prompt, { kind: 'option', optionId: 'allowForSession' })).toEqual(
+      {
+        behavior: 'allow',
+        updatedInput: { plan: '# Release' },
+        toolUseID: 'tool-approval'
+      }
+    )
   })
 })
 
@@ -178,7 +179,6 @@ describe('Claude structured question addressing', () => {
       input: { questions },
       suggestions: [],
       questionIds: questions.map((question) => question.question),
-      answers: new Map(),
       settle: () => {}
     }
 
@@ -211,7 +211,6 @@ describe('Claude structured question addressing', () => {
       input: { questions: [{ question: questionId, options: [{ label }] }] },
       suggestions: [],
       questionIds: [questionId],
-      answers: new Map(),
       settle: () => {}
     }
 
@@ -219,7 +218,12 @@ describe('Claude structured question addressing', () => {
     expect(agentJournalItemKey(item.identity).length).toBeLessThan(512)
     expect(item.body.options[0]!.id.length).toBeLessThan(512)
     expect(item.body.freeTextQuestionId).toBe('q1')
-    expect(applyClaudePromptAnswer({ prompt }, item.body.options[0]!.id)).toMatchObject({
+    expect(
+      buildClaudePromptReply(prompt, {
+        kind: 'answers',
+        answers: [{ questionId: 'q1', optionIds: [item.body.options[0]!.id] }]
+      })
+    ).toMatchObject({
       updatedInput: { answers: { [questionId]: label } }
     })
   })
@@ -235,13 +239,15 @@ describe('Claude structured question addressing', () => {
       input: { questions: [{ question: questionId }] },
       suggestions: [],
       questionIds: [questionId],
-      answers: new Map(),
       settle: () => {}
     }
     const answer = 'https://example.test:8443/path'
 
     expect(
-      applyClaudePromptAnswer({ prompt }, encodeClaudeQuestionOptionId('q1', answer))
+      buildClaudePromptReply(prompt, {
+        kind: 'answers',
+        answers: [{ questionId: 'q1', optionIds: [], other: answer }]
+      })
     ).toMatchObject({
       updatedInput: { answers: { [questionId]: answer } }
     })
@@ -273,21 +279,20 @@ describe('Claude structured question addressing', () => {
       },
       suggestions: [],
       questionIds: [multiQuestion, singleQuestion, otherQuestion],
-      answers: new Map(),
       settle: () => {}
     }
     const item = claudeQuestionItems({ sessionId: 'session-1', prompt })[0]!
     const questions = item.body.questions!
-    const encoded = encodeAgentSessionQuestionAnswers([
+    const answers = [
       {
         questionId: 'q1',
         optionIds: [questions[0]!.options[0]!.id, questions[0]!.options[1]!.id]
       },
       { questionId: 'q2', optionIds: [questions[1]!.options[1]!.id] },
       { questionId: 'q3', optionIds: [], other: 'remote host' }
-    ])
+    ]
 
-    expect(applyClaudePromptAnswer({ prompt }, encoded)).toMatchObject({
+    expect(buildClaudePromptReply(prompt, { kind: 'answers', answers })).toMatchObject({
       updatedInput: {
         answers: {
           [multiQuestion]: ['frontend', 'backend'],
diff --git a/src/main/claude/claude-structured-prompt-ownership.test.ts b/src/main/claude/claude-structured-prompt-ownership.test.ts
index 7a06a58e881..31fd703088f 100644
--- a/src/main/claude/claude-structured-prompt-ownership.test.ts
+++ b/src/main/claude/claude-structured-prompt-ownership.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../shared/agent-session-journal-types'
 import { describe, expect, it, vi } from 'vitest'
 import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
 import type { AgentJournalItemBody } from '../../shared/agent-session-journal-types'
@@ -17,9 +18,9 @@ import {
   acquired,
   adapterFor,
   fakeClaude,
-  identityFor,
-  invokeCanUseTool
+  identityFor
 } from './claude-structured-session-test-support'
+import { invokeCanUseTool } from './claude-can-use-tool-test-support'
 
 function deferred(): { promise: Promise<void>; resolve: () => void } {
   let resolve = (): void => {}
@@ -120,7 +121,7 @@ describe('Claude live prompt ownership', () => {
       sessionId: 'session-1',
       itemId: 'journal-prompt',
       kind: 'approval',
-      optionId: 'allow',
+      response: { kind: 'option', optionId: 'allow' },
       fence: 7,
       commit: async () => {
         expect(answered.settled()).toBe(false)
@@ -185,7 +186,7 @@ describe('Claude live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: 'journal-prompt',
         kind: 'approval',
-        optionId: 'allow',
+        response: { kind: 'option', optionId: 'allow' },
         fence: 7,
         commit
       })
@@ -204,7 +205,7 @@ describe('Claude live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: 'journal-prompt',
         kind: 'approval',
-        optionId: 'allow',
+        response: { kind: 'option', optionId: 'allow' },
         fence: 7,
         commit
       })
@@ -269,7 +270,8 @@ describe('Claude live prompt ownership', () => {
       sessionId: 'session-1',
       clientMessageId: 'queued-message',
       state: 'rejected',
-      reason: 'provider_cancelled_before_start'
+      reason: 'provider_cancelled_before_start',
+      rejection: { kind: 'cancelled' }
     })
   })
 
@@ -340,7 +342,10 @@ describe('Claude live prompt ownership', () => {
   })
 
   it('drops resolved prompt bodies instead of retaining them for the session lifetime', () => {
-    const prompts = new ClaudeJournalPrompts({ sink: lifecycleRecorder().sink })
+    const prompts = new ClaudeJournalPrompts({
+      sink: lifecycleRecorder().sink,
+      turnScope: () => AGENT_JOURNAL_THREAD_SCOPE
+    })
 
     for (let index = 0; index < 128; index += 1) {
       const promptKey = `resolved-${index}`
@@ -356,7 +361,6 @@ describe('Claude live prompt ownership', () => {
           input: { command: 'git status' },
           suggestions: [],
           questionIds: [],
-          answers: new Map(),
           settle: vi.fn()
         }
       })
@@ -398,7 +402,7 @@ describe('Claude live prompt ownership', () => {
       sessionId: 'session-1',
       itemId: 'journal-prompt',
       kind: 'approval',
-      optionId: 'allow',
+      response: { kind: 'option', optionId: 'allow' },
       fence: 7,
       commit: async () => undefined
     })
@@ -557,7 +561,7 @@ describe('Claude live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: promptItemId,
         kind: 'approval',
-        optionId: 'allow',
+        response: { kind: 'option', optionId: 'allow' },
         fence: 7,
         commit
       })
@@ -610,7 +614,7 @@ describe('Claude live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: 'journal-prompt',
         kind: 'approval',
-        optionId: 'allow',
+        response: { kind: 'option', optionId: 'allow' },
         fence: 8,
         commit
       })
@@ -673,7 +677,8 @@ describe('Claude live prompt ownership', () => {
               }
             ]
           : []
-      }
+      },
+      turnScope: () => AGENT_JOURNAL_THREAD_SCOPE
     })
     const prompt: ClaudePendingPrompt = {
       requestId: 'grouped-request',
@@ -689,7 +694,6 @@ describe('Claude live prompt ownership', () => {
       },
       suggestions: [],
       questionIds: ['First?', 'Second?'],
-      answers: new Map(),
       settle: vi.fn()
     }
     prompts.handle({ type: 'prompt', sessionId: 'session-1', prompt })
@@ -715,7 +719,8 @@ describe('Claude live prompt ownership', () => {
           lifecycleAttempts += 1
           return backpressured ? { accepted: false, reason: 'backpressure' } : { accepted: true }
         }
-      }
+      },
+      turnScope: () => AGENT_JOURNAL_THREAD_SCOPE
     })
     const registerCancellation = (index: number): void => {
       const promptKey = `permission-${index}`
@@ -728,7 +733,6 @@ describe('Claude live prompt ownership', () => {
         input: { command: 'git status' },
         suggestions: [],
         questionIds: [],
-        answers: new Map(),
         settle: vi.fn()
       }
       prompts.handle({ type: 'prompt', sessionId: 'session-1', prompt })
diff --git a/src/main/claude/claude-structured-prompt-ownership.ts b/src/main/claude/claude-structured-prompt-ownership.ts
index e4c9de982d0..6d45e77bbbb 100644
--- a/src/main/claude/claude-structured-prompt-ownership.ts
+++ b/src/main/claude/claude-structured-prompt-ownership.ts
@@ -1,21 +1,19 @@
 import {
+  AgentSessionPromptAnswerRejectedError,
   AgentSessionPromptUnavailableError,
   type StructuredAgentSessionAdapter
 } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
-import type { StructuredSessionCompaction } from '../native-chat/agent-session-wire/structured-session-compaction'
 import { CLAUDE_DEFAULT_REQUEST_TIMEOUT_MS } from './claude-agent-sdk-control-requests'
 import {
   answerClaudePrompt,
   cancelClaudeTurn,
   supportsClaudeQueuedInterruptCancellation
 } from './claude-structured-control-actions'
-import type { ClaudeLateDispatchSettlement } from './claude-structured-dispatch'
+import type { ClaudeLateDispatchSettlement } from './claude-replay-turn-resolution'
+import { buildClaudePromptReply } from './claude-structured-prompt-replies'
 import type { ClaudeSession } from './claude-structured-session-state'
-import {
-  claudeStartupHoldsWrites,
-  rejectClaudeStartupWrites
-} from './claude-structured-session-startup-gate'
-import { DISPATCH_REJECTED_CANCELLED } from '../../shared/structured-agent-session-dispatch-rejection'
+import type { ClaudePendingPrompt } from './claude-prompt-registry'
+import type { PermissionResult } from '@anthropic-ai/claude-agent-sdk'
 
 /** Conservative user-facing window: below the 30s control deadline, trading
  * residual slow-pump risk for ensuring delivery bookkeeping cannot block Stop indefinitely. */
@@ -91,31 +89,54 @@ function waitForClaudeDispatchAdmission(
   })
 }
 
+/**
+ * A Stop that names no turn: the conversation asked to stop whatever this child has in flight.
+ * Claude's interrupt is session-scoped, so there is no turn identity to check — only that this is
+ * still the child the host judged, and that it has a turn open or a written message whose turn has
+ * not opened yet (the gap before its echo, which no client can name).
+ */
+function cancelClaudeConversation(
+  session: ClaudeSession,
+  sessions: Map<string, ClaudeSession>,
+  request: CancelInput,
+  timeoutMs: number | undefined,
+  onDispatchSettledLate: ClaudeLateDispatchSettlement | undefined
+): Promise<{ cancelled: boolean }> {
+  const acquisitionGeneration = session.acquisitionGeneration
+  const isCurrent = (): boolean =>
+    sessions.get(request.sessionId) === session &&
+    session.fence === request.fence &&
+    session.acquisitionGeneration === acquisitionGeneration &&
+    ((request.resolveLiveTurnId?.() ?? session.translator?.currentTurnId ?? null) !== null ||
+      session.dispatchWaiters.length > 0)
+  return cancelClaudeTurn(session, timeoutMs, isCurrent, onDispatchSettledLate)
+}
+
 export async function cancelClaudeStructuredTurn(input: {
   request: CancelInput
   sessions: Map<string, ClaudeSession>
-  compactions: StructuredSessionCompaction
   timeoutMs?: number
   admitPromptCancellation: (session: ClaudeSession, promptKey: string) => boolean
   onDispatchSettledLate?: ClaudeLateDispatchSettlement
 }): Promise<{ cancelled: boolean }> {
-  const { request, sessions, compactions, timeoutMs } = input
+  const { request, sessions, timeoutMs } = input
   const session = requireSession(sessions, request.sessionId)
   const acquisitionGeneration = session.acquisitionGeneration
   const prompt = request.prompt
-  // A held prompt was never written, so Stop withdraws it; the drain only writes what it still
-  // holds. Before startup lands nothing was written, so there is nothing to interrupt either.
-  let withdrewHeld = false
-  if (!prompt && claudeStartupHoldsWrites(session) && session.fence === request.fence) {
-    withdrewHeld = rejectClaudeStartupWrites(session, DISPATCH_REJECTED_CANCELLED)
-    if (session.startup.state === 'pending') {
-      return { cancelled: withdrewHeld }
-    }
+  // Before startup lands nothing was written, so there is nothing to interrupt.
+  if (!prompt && session.startup.state === 'pending') {
+    return { cancelled: false }
+  }
+  const requestedTurnId = request.turnId
+  if (requestedTurnId === undefined) {
+    return prompt
+      ? { cancelled: false }
+      : cancelClaudeConversation(session, sessions, request, timeoutMs, input.onDispatchSettledLate)
   }
   if (prompt && session.fence !== request.fence) {
     return { cancelled: false }
   }
-  const claim = prompt ? session.prompts.claimBound(prompt.itemId, request.turnId) : null
+  const claim = prompt ? session.prompts.claimBound(prompt.itemId, requestedTurnId) : null
   if (prompt && !claim) {
     return { cancelled: false }
   }
@@ -131,7 +152,7 @@ export async function cancelClaudeStructuredTurn(input: {
   // means nothing has published an identity this request can contradict.
   const ownsRequestedTurn = (): boolean => {
     const liveTurnId = request.resolveLiveTurnId?.() ?? session.translator?.currentTurnId ?? null
-    return liveTurnId === null ? session.dispatchSequence === 0 : liveTurnId === request.turnId
+    return liveTurnId === null ? session.dispatchSequence === 0 : liveTurnId === requestedTurnId
   }
   // The host supplies the durable latest submission; direct adapter callers fall back to
   // the current in-memory waiter so an unknown dispatch remains fenced without a latch.
@@ -149,7 +170,8 @@ export async function cancelClaudeStructuredTurn(input: {
   const dispatchAdmissionAllowsCancellation = (): boolean =>
     dispatchAdmissionIsCurrent() ||
     (Boolean(prompt) && supportsClaudeQueuedInterruptCancellation(session))
-  const compactionOwnsTurn = (): boolean => compactions.ownsTurn(request.sessionId, request.turnId)
+  const compactionOwnsTurn = (): boolean =>
+    session.translator !== null && session.translator.commandTurnId === requestedTurnId
   const currentDispatchHasRetiredWaiter = (): boolean =>
     session.retiredDispatchWaiters.some(
       (waiter) => waiter.dispatchSequence === session.dispatchSequence
@@ -171,7 +193,7 @@ export async function cancelClaudeStructuredTurn(input: {
     session.acquisitionGeneration === acquisitionGeneration &&
     (claim && prompt
       ? ownsRequestedTurn() &&
-        session.prompts.ownsBoundClaim(claim, prompt.itemId, request.turnId) &&
+        session.prompts.ownsBoundClaim(claim, prompt.itemId, requestedTurnId) &&
         (dispatchAdmissionAllowsCancellation() || dispatchAdmissionExpired)
       : compactionOwnsTurn() ||
         (ownsRequestedTurn() &&
@@ -181,7 +203,14 @@ export async function cancelClaudeStructuredTurn(input: {
     const result = await cancelClaudeTurn(
       session,
       timeoutMs,
-      isCurrent,
+      () => {
+        const current = isCurrent()
+        // Read with the result that ends it: a stopped command reports no compaction.
+        if (current && compactionOwnsTurn()) {
+          session.translator?.commandInterruptRequested(requestedTurnId)
+        }
+        return current
+      },
       input.onDispatchSettledLate
     )
     if (result.cancelled && claim && cancellationObserved) {
@@ -193,7 +222,7 @@ export async function cancelClaudeStructuredTurn(input: {
     } else if (claim) {
       session.prompts.releaseClaim(claim)
     }
-    return withdrewHeld ? { ...result, cancelled: true } : result
+    return result
   } catch (error) {
     if (claim && !interruptConfirmed) {
       session.prompts.releaseClaim(claim)
@@ -202,6 +231,19 @@ export async function cancelClaudeStructuredTurn(input: {
   }
 }
 
+function prepareClaudePromptReply(
+  prompt: ClaudePendingPrompt,
+  response: AnswerInput['response']
+): PermissionResult {
+  try {
+    return buildClaudePromptReply(prompt, response)
+  } catch (error) {
+    throw new AgentSessionPromptAnswerRejectedError(
+      error instanceof Error ? error.message : String(error)
+    )
+  }
+}
+
 export async function answerClaudeStructuredPrompt(input: {
   request: AnswerInput
   sessions: Map<string, ClaudeSession>
@@ -217,6 +259,7 @@ export async function answerClaudeStructuredPrompt(input: {
     throw new AgentSessionPromptUnavailableError(request.itemId)
   }
   try {
+    const reply = prepareClaudePromptReply(claim.found.prompt, request.response)
     await request.commit()
     if (
       sessions.get(request.sessionId) !== session ||
@@ -226,7 +269,7 @@ export async function answerClaudeStructuredPrompt(input: {
     ) {
       throw new AgentSessionPromptUnavailableError(request.itemId)
     }
-    await answerClaudePrompt(session, claim, request.optionId)
+    await answerClaudePrompt(session, claim, reply)
   } catch (error) {
     session.prompts.releaseClaim(claim)
     throw error
diff --git a/src/main/claude/claude-structured-prompt-replies.ts b/src/main/claude/claude-structured-prompt-replies.ts
index 96bc83d0876..3bb99e3638a 100644
--- a/src/main/claude/claude-structured-prompt-replies.ts
+++ b/src/main/claude/claude-structured-prompt-replies.ts
@@ -1,5 +1,8 @@
 import type { PermissionResult } from '@anthropic-ai/claude-agent-sdk'
-import { decodeAgentSessionQuestionAnswers } from '../../shared/agent-session-question-answer'
+import type {
+  AgentSessionPromptResponse,
+  AgentSessionQuestionAnswer
+} from '../../shared/agent-session-question-answer'
 import {
   claudePromptQuestions,
   isClaudePromptRecord,
@@ -22,12 +25,6 @@ function isClaudeApprovalDecision(optionId: string): optionId is ClaudeApprovalD
   return CLAUDE_APPROVAL_DECISIONS.some((decision) => decision === optionId)
 }
 
-function questionIdFromAddress(prompt: ClaudePendingPrompt, address: string): string | null {
-  const match = /^q([1-9]\d*)$/.exec(address)
-  const index = match ? Number(match[1]) - 1 : -1
-  return index >= 0 ? (prompt.questionIds[index] ?? null) : null
-}
-
 function questionAnswer(prompt: ClaudePendingPrompt, questionId: string, optionId: string): string {
   const decoded = decodeClaudeQuestionOptionId(optionId)
   if (!decoded) {
@@ -111,49 +108,8 @@ function approvalResponse(prompt: ClaudePendingPrompt, optionId: string): Permis
 
 function questionResponse(
   prompt: ClaudePendingPrompt,
-  optionId: string,
-  boundQuestionId?: string
-): PermissionResult | null {
-  const decoded = decodeClaudeQuestionOptionId(optionId)
-  const decodedQuestionId = decoded
-    ? (questionIdFromAddress(prompt, decoded.questionId) ??
-      (prompt.questionIds.includes(decoded.questionId) ? decoded.questionId : null))
-    : null
-  const selectedQuestionId =
-    boundQuestionId ??
-    decodedQuestionId ??
-    (prompt.questionIds.length === 1 ? prompt.questionIds[0] : null)
-  if (!selectedQuestionId || !prompt.questionIds.includes(selectedQuestionId)) {
-    throw new Error(`${optionId} does not name a question on Claude prompt ${prompt.promptKey}`)
-  }
-  const answer = questionAnswer(prompt, selectedQuestionId, optionId)
-  prompt.answers.set(selectedQuestionId, answer)
-  if (prompt.questionIds.some((id) => !prompt.answers.has(id))) {
-    return null
-  }
-  const answers: Record<string, string | readonly string[]> = {}
-  for (const id of prompt.questionIds) {
-    const answer = prompt.answers.get(id)
-    if (answer === undefined) {
-      return null
-    }
-    answers[id] = answer
-  }
-  return {
-    behavior: 'allow',
-    updatedInput: { ...prompt.input, answers },
-    toolUseID: prompt.toolUseId
-  }
-}
-
-function groupedQuestionResponse(
-  prompt: ClaudePendingPrompt,
-  optionId: string
-): PermissionResult | null {
-  const grouped = decodeAgentSessionQuestionAnswers(optionId)
-  if (!grouped) {
-    return null
-  }
+  grouped: readonly AgentSessionQuestionAnswer[]
+): PermissionResult {
   const questions = claudePromptQuestions(prompt.input)
   if (grouped.length !== prompt.questionIds.length) {
     throw new Error(`Grouped answer does not match Claude prompt ${prompt.promptKey}`)
@@ -191,15 +147,20 @@ function groupedQuestionResponse(
   }
 }
 
-export function applyClaudePromptAnswer(
-  found: { prompt: ClaudePendingPrompt; questionId?: string },
-  optionId: string
-): PermissionResult | null {
-  if (found.prompt.kind === 'approval') {
-    return approvalResponse(found.prompt, optionId)
+/** Builds Claude's reply without touching the prompt, so a reply that cannot be built refuses the
+ *  answer before anything is recorded. */
+export function buildClaudePromptReply(
+  prompt: ClaudePendingPrompt,
+  response: AgentSessionPromptResponse
+): PermissionResult {
+  if (prompt.kind === 'approval') {
+    if (response.kind !== 'option') {
+      throw new Error(`Claude prompt ${prompt.promptKey} takes a decision, not answers`)
+    }
+    return approvalResponse(prompt, response.optionId)
   }
-  return (
-    groupedQuestionResponse(found.prompt, optionId) ??
-    questionResponse(found.prompt, optionId, found.questionId)
-  )
+  if (response.kind !== 'answers') {
+    throw new Error(`Claude prompt ${prompt.promptKey} takes answers, not a decision`)
+  }
+  return questionResponse(prompt, response.answers)
 }
diff --git a/src/main/claude/claude-structured-provider-fallback.ts b/src/main/claude/claude-structured-provider-fallback.ts
index baa6cb83a52..cd5441d7ec1 100644
--- a/src/main/claude/claude-structured-provider-fallback.ts
+++ b/src/main/claude/claude-structured-provider-fallback.ts
@@ -1,3 +1,4 @@
+import type { AgentJournalTurnScope } from '../../shared/agent-session-journal-types'
 import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
 import {
   boundInlineText,
@@ -15,7 +16,12 @@ import {
   type ClaudeMessageEnvelope
 } from './claude-structured-item-translation'
 import { claudeResultOutcome } from './claude-result-outcome'
-import { rootClaudeRowStamp, type ClaudeRowStamp } from './claude-provisional-row-corrections'
+import type { ClaudeRowStamp } from './claude-provisional-row-corrections'
+import {
+  CLAUDE_API_RETRY_FRAME_KIND,
+  claudeApiRetryRowBody,
+  createClaudeApiRetryRuns
+} from './claude-api-retry-row'
 
 export function claudeProviderFrameKind(message: Record<string, unknown>): string {
   const type = claudeText(message.type) ?? 'unknown'
@@ -104,7 +110,9 @@ export function isModeledClaudeContent(value: unknown): boolean {
 
 export function createClaudeProviderFrameFallback(
   sink: StructuredAgentSessionEventSink,
-  acquisitionId: string
+  acquisitionId: string,
+  /** The frame's turn — the open one once `beforeAppend` ran — or the conversation. */
+  turnScope: () => AgentJournalTurnScope
 ): {
   /** `displayText` leads the row when Claude knows the sentence the frame itself does not name. */
   append: (
@@ -121,9 +129,23 @@ export function createClaudeProviderFrameFallback(
   ) => boolean
 } {
   let sequence = 0
+  const retryRun = createClaudeApiRetryRuns()
   return {
     append: (kind, payload, displayText, beforeAppend, options, stamp) => {
       sequence += 1
+      const retrying = kind === CLAUDE_API_RETRY_FRAME_KIND ? claudeRecord(payload) : null
+      if (retrying) {
+        beforeAppend?.()
+        // One row per retry run, revised by each attempt, never the frame as a row.
+        const identity = {
+          provider: 'orca',
+          clientMessageId: `provider-retry:claude:${acquisitionId}:${retryRun(retrying)}`
+        } as const
+        const body = claudeApiRetryRowBody(retrying)
+        sink.appendItem(identity, body, stamp?.(identity, body) ?? { turnScope: turnScope() })
+        sink.publish()
+        return true
+      }
       const translated = unhandledProviderFrameJournalItem(
         'claude',
         kind,
@@ -143,7 +165,7 @@ export function createClaudeProviderFrameFallback(
         clientMessageId: `provider-frame:claude:${acquisitionId}:${sequence}`
       } as const
       const body = bounded ? { ...translated.body, text: bounded } : translated.body
-      sink.appendItem(identity, body, (stamp ?? rootClaudeRowStamp)(identity, body))
+      sink.appendItem(identity, body, stamp?.(identity, body) ?? { turnScope: turnScope() })
       sink.publish()
       return true
     }
diff --git a/src/main/claude/claude-structured-queued-stop.test.ts b/src/main/claude/claude-structured-queued-stop.test.ts
new file mode 100644
index 00000000000..2dbc99bb82b
--- /dev/null
+++ b/src/main/claude/claude-structured-queued-stop.test.ts
@@ -0,0 +1,205 @@
+// A send Claude queued behind the running turn is dropped by Stop, so it must settle as withdrawn.
+// Orca's SessionStart hook proves most starts before the turn's system/init, which is the only
+// frame that says whether the CLI can cancel its queue.
+
+import { describe, expect, it, vi } from 'vitest'
+import type { AgentJournalItemBody } from '../../shared/agent-session-journal-types'
+import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
+import { readAgentJournalTurn } from '../../shared/agent-session-turn-record'
+import { DISPATCH_REJECTED_CANCELLED } from '../../shared/structured-agent-session-dispatch-rejection'
+import type { ClaudeStructuredSessionAdapterDeps } from './claude-structured-session-state'
+import { CLAUDE_DISPATCH_ADMISSION_TIMEOUT_MS } from './claude-structured-prompt-ownership'
+import {
+  PROVIDER_SESSION_ID,
+  USER_MESSAGE,
+  adapterFor,
+  fakeClaude,
+  identityFor,
+  type FakeConnection
+} from './claude-structured-session-test-support'
+
+// As Claude Code 2.1.280 advertises them on a turn's system/init frame.
+const CAPABILITIES = ['interrupt_receipt_v1', 'interrupt_cancel_queued_v1', 'msg_lifecycle_v1']
+
+type Settlement = Parameters<
+  NonNullable<ClaudeStructuredSessionAdapterDeps['onDispatchSettledLate']>
+>[0]
+
+/** Answers the way the real CLI does: cancel_queued cancels the queue, a plain interrupt keeps it. */
+function claudeCli(options: Parameters<typeof fakeClaude>[0] = {}) {
+  let queued: string[] = []
+  const claude = fakeClaude({
+    replayUuid: null,
+    ...options,
+    routes: {
+      interrupt: (params) =>
+        params?.cancelQueued
+          ? { still_queued: [], cancelled: queued.splice(0) }
+          : { still_queued: [...queued] },
+      cancel_async_message: (params) => {
+        const before = queued.length
+        queued = queued.filter((uuid) => uuid !== params?.uuid)
+        return queued.length < before
+      }
+    }
+  })
+  return { claude, queue: (uuid: string) => queued.push(uuid) }
+}
+
+function turnInit(capabilities?: string[]): Record<string, unknown> {
+  return {
+    type: 'system',
+    subtype: 'init',
+    session_id: PROVIDER_SESSION_ID,
+    uuid: 'turn-init',
+    model: 'claude-sonnet-5',
+    ...(capabilities ? { capabilities } : {})
+  }
+}
+
+async function acquired(
+  claude: ReturnType<typeof fakeClaude>,
+  settlements: Settlement[] = []
+): Promise<{
+  adapter: ReturnType<typeof adapterFor>
+  bodies: Map<string, AgentJournalItemBody>
+  connection: FakeConnection
+}> {
+  const bodies = new Map<string, AgentJournalItemBody>()
+  const adapter = adapterFor(claude, {}, [], [], undefined, undefined, undefined, (settlement) =>
+    settlements.push(settlement)
+  )
+  await adapter.acquire({
+    identity: identityFor(),
+    fence: 7,
+    spawnToken: 'spawn-9',
+    events: {
+      appendItem: (identity, body) => bodies.set(agentJournalItemKey(identity), body),
+      appendTombstone: (identity) => bodies.delete(agentJournalItemKey(identity)),
+      publish: vi.fn()
+    }
+  })
+  return { adapter, bodies, connection: claude.connections[0]! }
+}
+
+function runningTurnId(bodies: Map<string, AgentJournalItemBody>): string {
+  for (const body of bodies.values()) {
+    const turn = readAgentJournalTurn(body)
+    if (turn?.state === 'running') {
+      return turn.turnId
+    }
+  }
+  throw new Error('expected a running turn')
+}
+
+/** Sends A and opens its turn, queues B behind it, then Stops A as the host does. */
+async function stopWithQueuedFollowUp(
+  cli: ReturnType<typeof claudeCli>,
+  openTurn: (connection: FakeConnection) => void
+): Promise<{ interrupt: unknown; settlements: Settlement[] }> {
+  const settlements: Settlement[] = []
+  const { adapter, bodies, connection } = await acquired(cli.claude, settlements)
+  const send = (clientMessageId: string) =>
+    adapter.dispatch({ sessionId: 'session-1', clientMessageId, body: USER_MESSAGE, fence: 7 })
+  await send('client-a')
+  openTurn(connection)
+  // Claude adopts the client uuid for the echo that opens the turn.
+  connection.handlers.onMessage?.({
+    ...connection.sent.at(-1)!,
+    uuid: connection.sent.at(-1)!.uuid
+  })
+  await send('client-b')
+  cli.queue(String(connection.sent.at(-1)!.uuid))
+
+  vi.useFakeTimers()
+  try {
+    const stopped = adapter.cancelTurn({
+      sessionId: 'session-1',
+      turnId: runningTurnId(bodies),
+      fence: 7,
+      // The host reads B's handover from the journal, and it is still pending.
+      dispatchStatus: { state: 'pending', recovered: false }
+    })
+    await vi.advanceTimersByTimeAsync(CLAUDE_DISPATCH_ADMISSION_TIMEOUT_MS)
+    await expect(stopped).resolves.toEqual({ cancelled: true })
+  } finally {
+    vi.useRealTimers()
+  }
+  return {
+    interrupt: connection.calls.find((call) => call.subtype === 'interrupt')?.params,
+    settlements: settlements.filter((settlement) => settlement.clientMessageId === 'client-b')
+  }
+}
+
+const WITHDRAWN = [
+  {
+    sessionId: 'session-1',
+    clientMessageId: 'client-b',
+    state: 'rejected',
+    reason: DISPATCH_REJECTED_CANCELLED,
+    rejection: { kind: 'cancelled' }
+  }
+]
+
+describe('Stop with a follow-up Claude queued behind the running turn', () => {
+  it('withdraws it the same way whether system/init or a SessionStart hook proved the start', async () => {
+    const byInit = await stopWithQueuedFollowUp(
+      claudeCli({ initProof: 'init', capabilities: CAPABILITIES }),
+      () => {}
+    )
+    const bySessionStart = await stopWithQueuedFollowUp(
+      claudeCli({ initProof: 'session-start' }),
+      (connection) => connection.handlers.onMessage?.(turnInit(CAPABILITIES))
+    )
+
+    expect(byInit).toEqual({ interrupt: { cancelQueued: true }, settlements: WITHDRAWN })
+    expect(bySessionStart).toEqual(byInit)
+  })
+
+  it('keeps what a turn advertised when a later frame names nothing', async () => {
+    const result = await stopWithQueuedFollowUp(
+      claudeCli({ initProof: 'session-start' }),
+      (connection) => {
+        connection.handlers.onMessage?.(turnInit(CAPABILITIES))
+        connection.handlers.onMessage?.(turnInit())
+        connection.handlers.onMessage?.({
+          type: 'system',
+          subtype: 'hook_response',
+          hook_name: 'SessionStart:resume',
+          session_id: PROVIDER_SESSION_ID
+        })
+      }
+    )
+
+    expect(result).toEqual({ interrupt: { cancelQueued: true }, settlements: WITHDRAWN })
+  })
+
+  it('keeps what a turn advertised when the start is read after it', async () => {
+    const cli = claudeCli({ initProof: 'session-start' })
+    const open = cli.claude.openConnection
+    // The turn's init lands while startup still waits on get_settings, as a send that starts the
+    // agent allows.
+    cli.claude.openConnection = async (launch, handlers) => {
+      const connection = await open(launch, handlers)
+      const getSettings = connection.getSettings
+      connection.getSettings = async (options) => {
+        handlers?.onMessage?.(turnInit(CAPABILITIES))
+        return getSettings(options)
+      }
+      return connection
+    }
+
+    const result = await stopWithQueuedFollowUp(cli, () => {})
+
+    expect(result).toEqual({ interrupt: { cancelQueued: true }, settlements: WITHDRAWN })
+  })
+
+  it('settles a follow-up withdrawn one at a time on a CLI without cancel_queued', async () => {
+    const result = await stopWithQueuedFollowUp(
+      claudeCli({ initProof: 'init', capabilities: ['interrupt_receipt_v1'] }),
+      () => {}
+    )
+
+    expect(result).toEqual({ interrupt: {}, settlements: WITHDRAWN })
+  })
+})
diff --git a/src/main/claude/claude-structured-rate-limit-retry.test.ts b/src/main/claude/claude-structured-rate-limit-retry.test.ts
new file mode 100644
index 00000000000..d7b0d5277fc
--- /dev/null
+++ b/src/main/claude/claude-structured-rate-limit-retry.test.ts
@@ -0,0 +1,50 @@
+// Claude retrying a rate-limited request: the frames below follow Claude Code 2.1.280 against an
+// HTTP 429 stub, captured with `--replay-user-messages --include-partial-messages`. The CLI writes
+// only `api_retry` frames, and echoes the message only once a request gets through or is
+// interrupted, so no turn opens: the send itself is all that says the session is working.
+
+import { describe, expect, it, vi } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity
+} from '../../shared/agent-session-journal-types'
+import { readAgentJournalTurn } from '../../shared/agent-session-turn-record'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { createClaudeJournalTranslator } from './claude-structured-journal-translation'
+
+function apiRetry(attempt: number, observedAt: number) {
+  return {
+    type: 'message' as const,
+    sessionId: 'orca-session',
+    observedAt,
+    message: {
+      type: 'system',
+      subtype: 'api_retry',
+      attempt,
+      max_retries: 10,
+      retry_delay_ms: 1_000 * 2 ** (attempt - 1),
+      error_status: 429,
+      error: 'rate_limit',
+      uuid: `retry-${attempt}`,
+      session_id: 'claude-session'
+    }
+  }
+}
+
+describe('Claude retrying a rate-limited request', () => {
+  it('opens no turn while it retries', () => {
+    const appended: { identity: AgentJournalItemIdentity; body: AgentJournalItemBody }[] = []
+    const sink: StructuredAgentSessionEventSink = {
+      appendItem: (identity, body) => appended.push({ identity, body }),
+      appendTombstone: vi.fn(),
+      publish: vi.fn()
+    }
+    const translator = createClaudeJournalTranslator({ sink })
+
+    for (let attempt = 1; attempt <= 6; attempt += 1) {
+      translator.handle(apiRetry(attempt, 1_000 * attempt))
+    }
+
+    expect(appended.filter(({ body }) => readAgentJournalTurn(body) !== null)).toEqual([])
+  })
+})
diff --git a/src/main/claude/claude-structured-real-cli-fold.test.ts b/src/main/claude/claude-structured-real-cli-fold.test.ts
new file mode 100644
index 00000000000..5ce21d83f17
--- /dev/null
+++ b/src/main/claude/claude-structured-real-cli-fold.test.ts
@@ -0,0 +1,194 @@
+// The fold receipt against the real CLI: a message sent while a turn runs is
+// folded by the CLI into the running turn, and Orca must keep ONE turn row —
+// no interrupted marking, no second bar. Runs only where a signed-in Claude CLI
+// exists, like the rest of the real-CLI suite. Live sessions prove the session
+// from a SessionStart hook frame BEFORE system/init arrives, which is exactly
+// the path the fixture harness cannot fake end to end.
+
+import { randomUUID } from 'node:crypto'
+import { mkdtemp } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentSessionJournalIdentity
+} from '../../shared/agent-session-journal-types'
+import { readAgentJournalTurn } from '../../shared/agent-session-turn-record'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { CLAUDE_STRUCTURED_BASE_OPTIONS } from './claude-structured-launch-resolution'
+import {
+  ClaudeStructuredSessionAdapter,
+  type ClaudeStructuredSessionEvent
+} from './claude-structured-session-adapter'
+import {
+  realClaudeAuthenticated,
+  realClaudeAvailable,
+  realClaudeCommand,
+  realClaudeLaunchHome
+} from './claude-real-cli-availability-test-support'
+
+const SESSION_ID = 'real-cli-fold'
+// Pins the live proof order (SessionStart hook frame before system/init) and lets the
+// Bash steps run unprompted, whatever the config dir under test configures.
+const FOLD_SESSION_SETTINGS = JSON.stringify({
+  hooks: { SessionStart: [{ hooks: [{ type: 'command', command: 'echo' }] }] },
+  permissions: { allow: ['Bash(sleep:*)'] }
+})
+
+function identity(providerSessionId: string): AgentSessionJournalIdentity {
+  return {
+    sessionId: SESSION_ID,
+    workspaceId: 'real-cli-fold-workspace',
+    hostId: 'local',
+    agent: 'claude',
+    providerHandle: { kind: 'claude', sessionId: providerSessionId, leafUuid: null }
+  }
+}
+
+async function until(check: () => boolean, timeoutMs: number): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs
+  while (Date.now() < deadline) {
+    if (check()) {
+      return true
+    }
+    await new Promise((resolve) => setTimeout(resolve, 200))
+  }
+  return check()
+}
+
+describe.skipIf(!realClaudeAvailable)('Claude structured real CLI fold', () => {
+  it.skipIf(!realClaudeAuthenticated)(
+    'keeps one turn row when the CLI folds a mid-turn send',
+    async () => {
+      const providerSessionId = randomUUID()
+      const { claudeConfigDir, env } = realClaudeLaunchHome()
+      const cwd = await mkdtemp(join(tmpdir(), 'orca-real-fold-'))
+      const events: ClaudeStructuredSessionEvent[] = []
+      const turnRows: NonNullable<ReturnType<typeof readAgentJournalTurn>>[] = []
+      const sink: StructuredAgentSessionEventSink = {
+        appendItem: (_identity, body: AgentJournalItemBody) => {
+          const turn = readAgentJournalTurn(body)
+          if (turn) {
+            turnRows.push(turn)
+          }
+        },
+        appendTombstone: () => {},
+        publish: () => {}
+      }
+      const settled = vi.fn()
+      const adapter = new ClaudeStructuredSessionAdapter({
+        resolveLaunch: async () => ({
+          pathToClaudeCodeExecutable: realClaudeCommand,
+          options: {
+            ...CLAUDE_STRUCTURED_BASE_OPTIONS,
+            extraArgs: {
+              ...CLAUDE_STRUCTURED_BASE_OPTIONS.extraArgs,
+              settings: FOLD_SESSION_SETTINGS
+            },
+            sessionId: providerSessionId
+          },
+          cwd,
+          env,
+          claudeConfigDir,
+          providerSessionId,
+          resumeLeafUuid: null,
+          resumesTranscript: false,
+          continuesChain: false
+        }),
+        onEvent: (event) => events.push(event),
+        onDispatchSettledLate: settled,
+        readProcessStartTime: async () => 1
+      })
+      try {
+        await adapter.acquire({
+          identity: identity(providerSessionId),
+          fence: 1,
+          spawnToken: 'real-cli-fold',
+          events: sink
+        })
+        await adapter.awaitStarted(SESSION_ID)
+        // Startup proved from the SessionStart hook frame, with no init yet.
+        expect(
+          events.some(
+            (event) =>
+              event.type === 'message' &&
+              event.message.type === 'system' &&
+              event.message.subtype === 'init'
+          )
+        ).toBe(false)
+
+        await expect(
+          adapter.dispatch({
+            sessionId: SESSION_ID,
+            clientMessageId: 'client-A',
+            body: {
+              kind: 'message',
+              role: 'user',
+              blocks: [
+                {
+                  type: 'text',
+                  text: 'Use the Bash tool to run `sleep 8` two separate times, one call at a time, waiting for each. Then reply exactly: FIRST DONE'
+                }
+              ]
+            },
+            requestedAt: Date.now(),
+            fence: 1
+          })
+        ).resolves.toEqual({ state: 'admitted' })
+
+        // Wait for A's replay to open the turn, then send B mid-turn: the first
+        // `sleep 8` guarantees the CLI is still inside A's request cycle.
+        expect(
+          await until(
+            () => events.some((event) => event.type === 'message' && event.startsTurn === true),
+            30_000
+          )
+        ).toBe(true)
+        await new Promise((resolve) => setTimeout(resolve, 2_000))
+        await expect(
+          adapter.dispatch({
+            sessionId: SESSION_ID,
+            clientMessageId: 'client-B',
+            body: {
+              kind: 'message',
+              role: 'user',
+              blocks: [{ type: 'text', text: 'Also say the word banana at the end of your reply.' }]
+            },
+            requestedAt: Date.now(),
+            fence: 1
+          })
+        ).resolves.toEqual({ state: 'admitted' })
+
+        const results = () =>
+          events.flatMap((event) =>
+            event.type === 'message' && event.message.type === 'result' ? [event.message] : []
+          )
+        expect(await until(() => results().length > 0, 90_000)).toBe(true)
+
+        // The CLI folded: one result names both sends. (If this ever reports a
+        // lone send, the steer raced past the fold window — a miss, not a fold.)
+        const named = results().flatMap((message) =>
+          Array.isArray(message.user_message_uuids) ? [message.user_message_uuids] : []
+        )
+        expect(named[0]).toHaveLength(2)
+
+        // ONE turn for the whole run: never interrupted, and B settled accepted
+        // into it under its own adopted uuid.
+        expect(turnRows.every((turn) => turn.state !== 'interrupted')).toBe(true)
+        expect([...new Set(turnRows.map((turn) => turn.turnId))]).toHaveLength(1)
+        expect(turnRows.at(-1)).toMatchObject({ state: 'completed' })
+        expect(settled).toHaveBeenCalledWith(
+          expect.objectContaining({
+            sessionId: SESSION_ID,
+            clientMessageId: 'client-B',
+            providerIdentity: expect.objectContaining({ provider: 'claude' })
+          })
+        )
+      } finally {
+        await adapter.closeAll()
+      }
+    },
+    150_000
+  )
+})
diff --git a/src/main/claude/claude-structured-real-cli.test.ts b/src/main/claude/claude-structured-real-cli.test.ts
index 4181dab43c7..73bec7986c8 100644
--- a/src/main/claude/claude-structured-real-cli.test.ts
+++ b/src/main/claude/claude-structured-real-cli.test.ts
@@ -1,55 +1,31 @@
-import { spawnSync } from 'node:child_process'
 import { randomUUID } from 'node:crypto'
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { homedir, tmpdir } from 'node:os'
 import { basename, join, relative } from 'node:path'
 import { describe, expect, it } from 'vitest'
 import type { AgentSessionJournalIdentity } from '../../shared/agent-session-journal-types'
-import { resolveClaudeCommand } from '../codex-cli/command'
 import { resolveSessionFilePath } from '../native-chat/session-file-resolver'
-import { getSpawnArgsForWindows } from '../win32-utils'
 import { CLAUDE_STRUCTURED_BASE_OPTIONS } from './claude-structured-launch-resolution'
+import {
+  realClaudeAuthenticated,
+  realClaudeAuthStatus,
+  realClaudeAvailable,
+  realClaudeCommand
+} from './claude-real-cli-availability-test-support'
 import {
   ClaudeStructuredSessionAdapter,
   type ClaudeStructuredSessionEvent
 } from './claude-structured-session-adapter'
+import type { ClaudeStructuredSessionAdapterDeps } from './claude-structured-session-state'
 
-const command = resolveClaudeCommand()
-const versionLaunch = getSpawnArgsForWindows(command, ['--version'])
-const realClaudeAvailable =
-  spawnSync(versionLaunch.spawnCmd, versionLaunch.spawnArgs, {
-    stdio: 'ignore',
-    windowsHide: true,
-    timeout: 5_000
-  }).status === 0
-const authStatusLaunch = getSpawnArgsForWindows(command, ['auth', 'status', '--json'])
-/** The CLI's own account report — the only source of truth for where it writes that
- *  is not derived from Orca's own path expressions. */
-const realClaudeAuthStatus = (() => {
-  if (!realClaudeAvailable) {
-    return null
-  }
-  const result = spawnSync(authStatusLaunch.spawnCmd, authStatusLaunch.spawnArgs, {
-    encoding: 'utf8',
-    windowsHide: true,
-    timeout: 5_000
-  })
-  if (result.status !== 0) {
-    return null
-  }
-  try {
-    return JSON.parse(result.stdout) as { loggedIn?: boolean; projectsDirectory?: string }
-  } catch {
-    return null
-  }
-})()
-const realClaudeAuthenticated = realClaudeAuthStatus?.loggedIn === true
+const command = realClaudeCommand
 
 function realAdapter(
   providerSessionId: string,
   claudeConfigDir: string,
   events: ClaudeStructuredSessionEvent[] = [],
-  cwd = process.cwd()
+  cwd = process.cwd(),
+  onDispatchSettledLate?: ClaudeStructuredSessionAdapterDeps['onDispatchSettledLate']
 ): ClaudeStructuredSessionAdapter {
   const adapter = new ClaudeStructuredSessionAdapter({
     resolveLaunch: async () => ({
@@ -63,6 +39,7 @@ function realAdapter(
       continuesChain: false
     }),
     onEvent: (event) => events.push(event),
+    ...(onDispatchSettledLate ? { onDispatchSettledLate } : {}),
     readProcessStartTime: async () => 1,
     now: () => 2
   })
@@ -70,7 +47,7 @@ function realAdapter(
   const acquire = adapter.acquire
   adapter.acquire = async (input) => {
     const acquisition = await acquire(input)
-    await adapter.drainStartup(input.identity.sessionId)
+    await adapter.awaitStarted(input.identity.sessionId)
     return acquisition
   }
   return adapter
@@ -302,6 +279,161 @@ describe.skipIf(!realClaudeAvailable)('Claude structured real CLI handshake', ()
     90_000
   )
 
+  // The window a Stop naming no turn exists for: Orca has written the message, and Claude has not
+  // started its reply, so no turn id exists. Only the live binary can say the interrupt lands there.
+  it.skipIf(!realClaudeAuthenticated)(
+    'stops a message interrupted before its reply starts, and takes the next one',
+    async () => {
+      const providerSessionId = randomUUID()
+      const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), '.claude')
+      const events: ClaudeStructuredSessionEvent[] = []
+      const adapter = realAdapter(providerSessionId, claudeConfigDir, events)
+      const frames = (from: number) =>
+        events.slice(from).flatMap((event) => (event.type === 'message' ? [event.message] : []))
+      const replyStarted = (from: number) =>
+        frames(from).some(
+          (frame) =>
+            frame.type === 'stream_event' &&
+            typeof frame.event === 'object' &&
+            frame.event !== null &&
+            'type' in frame.event &&
+            frame.event.type === 'message_start'
+        )
+      const result = async (from: number) => {
+        const deadline = Date.now() + 60_000
+        for (;;) {
+          const found = frames(from).find((frame) => frame.type === 'result')
+          if (found || Date.now() >= deadline) {
+            return found
+          }
+          await new Promise((resolve) => setTimeout(resolve, 100))
+        }
+      }
+      const send = (clientMessageId: string, text: string) =>
+        adapter.dispatch({
+          sessionId: 'real-cli-handshake',
+          clientMessageId,
+          body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text }] },
+          fence: 1
+        })
+
+      try {
+        await adapter.acquire({
+          identity: identity(providerSessionId),
+          fence: 1,
+          spawnToken: 'real-cli-stop'
+        })
+        const first = events.length
+        await expect(
+          send('real-cli-stop-1', 'Count from 1 to 300, one number per line, and nothing else.')
+        ).resolves.toEqual({ state: 'admitted' })
+        const startedBeforeStop = replyStarted(first)
+
+        await expect(
+          adapter.cancelTurn({ sessionId: 'real-cli-handshake', fence: 1 })
+        ).resolves.toEqual({
+          cancelled: true
+        })
+        const stopped = await result(first)
+
+        expect(startedBeforeStop).toBe(false)
+        // Claude 2.1.280 echoes the message, then ends that turn as interrupted without replying.
+        expect(stopped).toMatchObject({ subtype: 'error_during_execution' })
+        expect(replyStarted(first)).toBe(false)
+
+        const second = events.length
+        await expect(send('real-cli-stop-2', 'Reply with the single word ok.')).resolves.toEqual({
+          state: 'admitted'
+        })
+        await expect(result(second)).resolves.toMatchObject({ subtype: 'success' })
+      } finally {
+        await adapter.closeAll()
+      }
+    },
+    150_000
+  )
+
+  // Orca installs a SessionStart hook, so its frame proves most real starts before the turn's
+  // system/init, the only frame that says this CLI can cancel what it queued.
+  it.skipIf(!realClaudeAuthenticated)(
+    'withdraws a follow-up queued behind a turn that is stopped, behind a SessionStart hook',
+    async () => {
+      const providerSessionId = randomUUID()
+      const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), '.claude')
+      const cwd = await mkdtemp(join(tmpdir(), 'orca-queued-stop-'))
+      await mkdir(join(cwd, '.claude'), { recursive: true })
+      await writeFile(
+        join(cwd, '.claude', 'settings.json'),
+        JSON.stringify({
+          hooks: { SessionStart: [{ hooks: [{ type: 'command', command: 'true' }] }] }
+        })
+      )
+      const events: ClaudeStructuredSessionEvent[] = []
+      const settlements: unknown[] = []
+      const adapter = realAdapter(providerSessionId, claudeConfigDir, events, cwd, (settlement) =>
+        settlements.push(settlement)
+      )
+      const send = (clientMessageId: string, text: string) =>
+        adapter.dispatch({
+          sessionId: 'real-cli-handshake',
+          clientMessageId,
+          body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text }] },
+          fence: 1
+        })
+      const waitFor = async (found: () => boolean): Promise<boolean> => {
+        const deadline = Date.now() + 60_000
+        while (!found() && Date.now() < deadline) {
+          await new Promise((resolve) => setTimeout(resolve, 100))
+        }
+        return found()
+      }
+
+      try {
+        await adapter.acquire({
+          identity: identity(providerSessionId),
+          fence: 1,
+          spawnToken: 'real-cli-queued-stop'
+        })
+        await send('real-cli-queued-stop-a', 'Count from 1 to 400, one number per line.')
+        // A's reply is streaming, so the next send queues behind its turn.
+        await expect(
+          waitFor(() =>
+            events.some(
+              (event) =>
+                event.type === 'message' &&
+                event.message.type === 'stream_event' &&
+                JSON.stringify(event.message).includes('text_delta')
+            )
+          )
+        ).resolves.toBe(true)
+        await send('real-cli-queued-stop-b', 'Say the word banana.')
+
+        await expect(
+          adapter.cancelTurn({
+            sessionId: 'real-cli-handshake',
+            turnId: 'turn-a',
+            fence: 1,
+            resolveLiveTurnId: () => 'turn-a',
+            // What the host reads for B: handed over, not yet answered.
+            dispatchStatus: { state: 'pending', recovered: false }
+          })
+        ).resolves.toEqual({ cancelled: true })
+
+        expect(settlements).toContainEqual({
+          sessionId: 'real-cli-handshake',
+          clientMessageId: 'real-cli-queued-stop-b',
+          state: 'rejected',
+          reason: 'provider_cancelled_before_start',
+          rejection: { kind: 'cancelled' }
+        })
+      } finally {
+        await adapter.closeAll()
+        await rm(cwd, { recursive: true, force: true })
+      }
+    },
+    150_000
+  )
+
   it('turns a real silent unauthenticated startup into sign-in guidance', async () => {
     const claudeConfigDir = await mkdtemp(join(tmpdir(), 'orca-claude-no-auth-'))
     const providerSessionId = randomUUID()
diff --git a/src/main/claude/claude-structured-requested-stop.test.ts b/src/main/claude/claude-structured-requested-stop.test.ts
new file mode 100644
index 00000000000..993109f4a37
--- /dev/null
+++ b/src/main/claude/claude-structured-requested-stop.test.ts
@@ -0,0 +1,90 @@
+import { describe, expect, it } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity
+} from '../../shared/agent-session-journal-types'
+import { readAgentJournalTurn } from '../../shared/agent-session-turn-record'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import type { ClaudeStructuredSessionEvent } from './claude-structured-session-state'
+import {
+  PROVIDER_SESSION_ID,
+  USER_MESSAGE,
+  adapterFor,
+  fakeClaude,
+  identityFor
+} from './claude-structured-session-test-support'
+
+function journalSink() {
+  const items: { identity: AgentJournalItemIdentity; body: AgentJournalItemBody }[] = []
+  const sink: StructuredAgentSessionEventSink = {
+    appendItem: (identity, body) => items.push({ identity, body }),
+    appendTombstone: () => {},
+    publish: () => {}
+  }
+  return { sink, items }
+}
+
+function frame(type: 'assistant' | 'user', uuid: string, content: unknown[]) {
+  return {
+    type,
+    uuid,
+    session_id: PROVIDER_SESSION_ID,
+    parent_tool_use_id: null,
+    message: { role: type, content }
+  }
+}
+
+describe('a requested stop of a structured Claude chat', () => {
+  it('reads interrupted, not failed or crashed, through the frames the stop makes Claude emit', async () => {
+    const claude = fakeClaude({ replayUuid: 'turn-1' })
+    const events: ClaudeStructuredSessionEvent[] = []
+    const adapter = adapterFor(claude, {}, events)
+    const journal = journalSink()
+    await adapter.acquire({
+      identity: identityFor(),
+      fence: 7,
+      spawnToken: 'spawn-9',
+      events: journal.sink
+    })
+    await adapter.dispatch({
+      sessionId: 'session-1',
+      clientMessageId: 'client-1',
+      body: USER_MESSAGE,
+      fence: 7
+    })
+    const connection = claude.connections[0]!
+    connection.handlers.onMessage?.(
+      frame('assistant', 'assistant-1', [
+        { type: 'tool_use', id: 'tool-1', name: 'Bash', input: { command: 'sleep 120' } }
+      ])
+    )
+    // What Claude 2.1.283 emitted within 35 ms of the supervised SIGTERM mid-tool, recorded
+    // against the real CLI: the killed tool's result, a status frame, and no `result` frame.
+    connection.close = async () => {
+      connection.handlers.onMessage?.(
+        frame('user', 'user-2', [
+          { type: 'tool_result', tool_use_id: 'tool-1', is_error: true, content: 'Exit code 137' }
+        ])
+      )
+      connection.handlers.onMessage?.({
+        type: 'system',
+        subtype: 'status',
+        uuid: 'status-1',
+        session_id: PROVIDER_SESSION_ID
+      })
+      connection.closed = true
+      return true
+    }
+
+    await expect(adapter.closeSession('session-1')).resolves.toBe(true)
+
+    const turns = journal.items.flatMap((item) => {
+      const turn = readAgentJournalTurn(item.body)
+      return turn ? [turn] : []
+    })
+    expect(turns.at(-1)).toMatchObject({ turnId: 'turn-1', state: 'interrupted' })
+    const ended = events.filter((event) => event.type === 'ended')
+    expect(ended).toEqual([expect.objectContaining({ reason: 'claude session closed' })])
+    expect(ended[0]).not.toHaveProperty('cause')
+  })
+})
diff --git a/src/main/claude/claude-structured-session-acquisition-processless.test.ts b/src/main/claude/claude-structured-session-acquisition-processless.test.ts
index 85de77bbbd8..eb4babdb9ac 100644
--- a/src/main/claude/claude-structured-session-acquisition-processless.test.ts
+++ b/src/main/claude/claude-structured-session-acquisition-processless.test.ts
@@ -37,7 +37,7 @@ describe('Claude structured processless acquisition', () => {
         getContextUsage: async () => ({}),
         supportedModels: async () => [],
         interrupt: async () => undefined,
-        cancelAsyncMessage: async () => {},
+        cancelAsyncMessage: async () => false,
         setModel: async () => {},
         setPermissionMode: async () => {},
         applyFlagSettings: async () => {},
diff --git a/src/main/claude/claude-structured-session-acquisition.ts b/src/main/claude/claude-structured-session-acquisition.ts
index b2efed691ee..b4adbfccfa5 100644
--- a/src/main/claude/claude-structured-session-acquisition.ts
+++ b/src/main/claude/claude-structured-session-acquisition.ts
@@ -7,8 +7,13 @@ import { CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE } from '../claude-accounts/envir
 import { isClaudeAuthSwitchInProgress } from '../claude-accounts/live-pty-gate'
 import { openClaudeStreamJsonConnection } from './claude-stream-json-connection'
 import { buildClaudePermissionCallbacks } from './claude-structured-inbound-control'
-import { resolveClaudeReplayTurn } from './claude-structured-dispatch'
-import { readClaudeFrameString, readClaudeInit } from './claude-structured-init-proof'
+import { resolveClaudeReplayTurn } from './claude-replay-turn-resolution'
+import { claudeSessionStateEndsTurn } from './claude-session-state-turn-over'
+import {
+  readClaudeCapabilities,
+  readClaudeFrameString,
+  readClaudeInit
+} from './claude-structured-init-proof'
 import { claudeConfigDirEnvPatch } from './claude-config-dir-pin'
 import { CLAUDE_SPAWN_TOKEN_ENV, claudeProcessIdentity } from './claude-structured-owner-identity'
 import { ClaudePromptRegistry } from './claude-structured-prompt-replies'
@@ -30,6 +35,7 @@ import {
   type ClaudeAcquireCallbacks
 } from './claude-structured-session-state'
 import { resolveClaudeAcquisitionError } from './claude-structured-session-close'
+import { withObservedProviderExit } from '../native-chat/agent-session-wire/structured-agent-session-failure-text'
 import { readClaudeTranscriptEntryUuid } from './claude-transcript-entry-uuid'
 import { persistClaudeTurnResumePoint } from './claude-structured-resume-point'
 import { withAgentSessionCreatePhase } from '../observability/agent-session-instrumentation'
@@ -58,7 +64,9 @@ export async function acquireClaudeSession({
   // A managed-account switch is mid-swap of the pinned credential home; refuse here,
   // before this acquisition cancels the previous attempt and closes the live session.
   if (isClaudeAuthSwitchInProgress()) {
-    throw new AgentSessionPreSpawnError(new Error(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE))
+    throw new AgentSessionPreSpawnError(new Error(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE), {
+      reason: 'accountSwitchInProgress'
+    })
   }
   const sessionId = input.identity.sessionId
   const prompts = new ClaudePromptRegistry()
@@ -98,6 +106,9 @@ export async function acquireClaudeSession({
         liveSession.reportedOptions.model = init.model
         liveSession.reportedModelMutation = liveSession.optionMutationSequence
       }
+      if (liveSession) {
+        liveSession.capabilities = readClaudeCapabilities(liveSession.capabilities, init.message)
+      }
     }
     observedLeafUuid = readClaudeTranscriptEntryUuid(message) ?? observedLeafUuid
     if (liveSession) {
@@ -107,10 +118,17 @@ export async function acquireClaudeSession({
       if (message.type === 'result' && sessions.get(sessionId) === liveSession) {
         persistClaudeTurnResumePoint(sessionId, liveSession, deps)
       }
+      // The CLI idles only once its queue drains, so it holds none of this session's sends.
+      if (claudeSessionStateEndsTurn(message) && sessions.get(sessionId) === liveSession) {
+        deps.onSessionIdle?.({ sessionId })
+      }
     }
+    // Settled after the turn this echo opens is emitted: a send read as answered before its turn
+    // lands reads as nothing running, and Stop and Working blink off in between.
+    const settlements: (() => void)[] = []
     const turnOrigin = liveSession
       ? resolveClaudeReplayTurn(liveSession, message, (settlement) =>
-          deps.onDispatchSettledLate?.({ sessionId, ...settlement })
+          settlements.push(() => deps.onDispatchSettledLate?.({ sessionId, ...settlement }))
         )
       : null
     const startsTurn = turnOrigin !== null
@@ -128,6 +146,9 @@ export async function acquireClaudeSession({
         ...observedAt
       })
     )
+    for (const settle of settlements) {
+      settle()
+    }
   }
   const { canUseTool, onUserDialog } = buildClaudePermissionCallbacks({
     sessionId,
@@ -178,6 +199,8 @@ export async function acquireClaudeSession({
             initProof.reject(error)
           },
           onExit: (error) => {
+            // The child exited on its own; marked in place, as the fault report may hold this error.
+            withObservedProviderExit(error)
             childEnded ??= error
             initProof.reject(error)
             callbacks.handleExit(sessionId, attempt, error)
@@ -248,30 +271,34 @@ export async function acquireClaudeSession({
         event()
       }
     })
-    session.startup.settled = settleClaudeSessionStartup({
-      session,
-      facts: readClaudeStartupFacts({
-        connection,
-        initProof,
-        sessionId,
-        providerSessionId: launch.providerSessionId,
-        resumesTranscript: launch.resumesTranscript,
-        inputOptions: input.options,
-        requestTimeoutMs: deps.requestTimeoutMs,
-        emit
-      }),
-      isCurrent: () => sessions.get(sessionId) === session,
-      requestTimeoutMs: deps.requestTimeoutMs,
-      fault: (error) => callbacks.handleExit(sessionId, attempt, error),
-      onStarted: (options) =>
-        emit({
-          type: 'started',
+    // Whichever comes first: the start landing or faulting, or the child being ended.
+    session.startup.settled = Promise.race([
+      session.startup.settled,
+      settleClaudeSessionStartup({
+        session,
+        facts: readClaudeStartupFacts({
+          connection,
+          initProof,
           sessionId,
-          fence: input.fence,
-          acquisitionGeneration: session.acquisitionGeneration,
-          ...options
-        })
-    })
+          providerSessionId: launch.providerSessionId,
+          resumesTranscript: launch.resumesTranscript,
+          inputOptions: input.options,
+          requestTimeoutMs: deps.requestTimeoutMs,
+          emit
+        }),
+        isCurrent: () => sessions.get(sessionId) === session,
+        requestTimeoutMs: deps.requestTimeoutMs,
+        fault: (error) => callbacks.handleExit(sessionId, attempt, error),
+        onStarted: (options) =>
+          emit({
+            type: 'started',
+            sessionId,
+            fence: input.fence,
+            acquisitionGeneration: session.acquisitionGeneration,
+            ...options
+          })
+      })
+    ])
     // A child whose exit already reached `handleExit` is not handed over as live: the create
     // fails with the CLI's own diagnostic, as one that died before publish does.
     if (sessions.get(sessionId) !== session) {
diff --git a/src/main/claude/claude-structured-session-adapter-turns.test.ts b/src/main/claude/claude-structured-session-adapter-turns.test.ts
index caafee6a94b..d410861464a 100644
--- a/src/main/claude/claude-structured-session-adapter-turns.test.ts
+++ b/src/main/claude/claude-structured-session-adapter-turns.test.ts
@@ -68,7 +68,11 @@ describe('ClaudeStructuredSessionAdapter turns and controls', () => {
         body: USER_MESSAGE,
         fence: 7
       })
-    ).resolves.toEqual({ state: 'rejected', reason: 'provider_write_failed: broken pipe' })
+    ).resolves.toEqual({
+      state: 'rejected',
+      reason: 'provider_write_failed',
+      rejection: { kind: 'writeFailed' }
+    })
   })
 
   it('requires an acknowledged interrupt and supports controlled options', async () => {
@@ -219,6 +223,13 @@ describe('ClaudeStructuredSessionAdapter turns and controls', () => {
       }
     })
     const adapter = await acquired(claude)
+    // The model is reported by a cycle's init frame, so start one.
+    await adapter.dispatch({
+      sessionId: 'session-1',
+      clientMessageId: 'seed-cycle',
+      body: USER_MESSAGE,
+      fence: 7
+    })
 
     await expect(adapter.readOptions({ sessionId: 'session-1', fence: 7 })).resolves.toEqual({
       models: [
@@ -247,6 +258,13 @@ describe('ClaudeStructuredSessionAdapter turns and controls', () => {
       }
     })
     const adapter = await acquired(claude)
+    // The custom model only reports on the first cycle's init frame.
+    await adapter.dispatch({
+      sessionId: 'session-1',
+      clientMessageId: 'seed-cycle',
+      body: USER_MESSAGE,
+      fence: 7
+    })
     const result = await adapter.readOptions({ sessionId: 'session-1', fence: 7 })
 
     expect(result.models.map((model) => model.id)).toEqual([
diff --git a/src/main/claude/claude-structured-session-adapter.test.ts b/src/main/claude/claude-structured-session-adapter.test.ts
index a879878436a..ee14b6b525a 100644
--- a/src/main/claude/claude-structured-session-adapter.test.ts
+++ b/src/main/claude/claude-structured-session-adapter.test.ts
@@ -3,12 +3,12 @@ import { join } from 'node:path'
 import { describe, expect, it, vi } from 'vitest'
 import {
   AgentSessionAcquisitionExitUnprovenError,
-  AgentSessionAcquisitionRootExitObservedError
+  AgentSessionAcquisitionRootExitObservedError,
+  AgentSessionPromptAnswerRejectedError
 } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
 import type { ClaudeStreamJsonConnection } from './claude-stream-json-connection'
 import { ClaudeControlRequestError } from './claude-stream-json-connection'
 import { CLAUDE_SPAWN_TOKEN_ENV } from './claude-structured-owner-identity'
-import { encodeClaudeQuestionOptionId } from './claude-structured-prompt-replies'
 import type {
   ClaudeStructuredSessionAdapter,
   ClaudeStructuredSessionEvent
@@ -18,12 +18,12 @@ import {
   adapterFor,
   fakeClaude,
   identityFor,
-  invokeCanUseTool,
   PROVIDER_SESSION_ID,
   tick,
   USER_MESSAGE,
   type FakeConnection
 } from './claude-structured-session-test-support'
+import { invokeCanUseTool } from './claude-can-use-tool-test-support'
 
 describe('ClaudeStructuredSessionAdapter.acquire', () => {
   it('pins the account and proves init without treating the system-frame uuid as a chain leaf', async () => {
@@ -62,7 +62,8 @@ describe('ClaudeStructuredSessionAdapter.acquire', () => {
       mintedAtFence: 7,
       observedAt: 1_700_000_000_500
     })
-    expect(events[0]).toMatchObject({ type: 'message', message: { subtype: 'init' } })
+    // Live proof order: the SessionStart hook frame arrives before any init.
+    expect(events[0]).toMatchObject({ type: 'message', message: { subtype: 'hook_started' } })
   })
 
   it('restores persisted model and effort before publishing a reacquired session', async () => {
@@ -344,7 +345,10 @@ describe('ClaudeStructuredSessionAdapter.acquire', () => {
       session_id: 'foreign-provider-session'
     })
     await Promise.resolve()
-    expect(events.filter((event) => event.type === 'message')).toHaveLength(1)
+    // Startup hook proof + the first cycle's init are admitted; nothing foreign is.
+    expect(
+      events.flatMap((event) => (event.type === 'message' ? [event.message.subtype] : []))
+    ).toEqual(['hook_started', 'hook_response', 'init'])
     expect(settled).not.toHaveBeenCalled()
 
     connection.handlers.onMessage?.({
@@ -556,21 +560,18 @@ describe('ClaudeStructuredSessionAdapter acquisition cleanup', () => {
       .catch((error: unknown) => error)
   }
 
-  it('releases on a first-hand root exit while still carrying the CLI diagnostic', async () => {
-    // The root's pid and start time are the lease's identity, and they are
-    // provably dead: latching the session would strand a signed-out user.
-    const error = await failedStart({ root: 'exited', tree: 'unverifiable' })
+  // The root's pid and start time are the lease's identity, and they are provably dead: latching
+  // the session would strand a signed-out user. The lease follows the root, so a descendant seen
+  // alive does not hold the session either.
+  it.each(['unverifiable', 'live'] as const)(
+    'releases on a first-hand root exit with its tree %s while still carrying the CLI diagnostic',
+    async (tree) => {
+      const error = await failedStart({ root: 'exited', tree })
 
-    expect(error).toBeInstanceOf(AgentSessionAcquisitionRootExitObservedError)
-    expect((error as Error).message).toBe('claude stream-json exited (code 1): not logged in')
-  })
-
-  it('never releases while a descendant was observed alive', async () => {
-    const error = await failedStart({ root: 'exited', tree: 'live' })
-
-    expect(error).toBeInstanceOf(AgentSessionAcquisitionExitUnprovenError)
-    expect(error).not.toBeInstanceOf(AgentSessionAcquisitionRootExitObservedError)
-  })
+      expect(error).toBeInstanceOf(AgentSessionAcquisitionRootExitObservedError)
+      expect((error as Error).message).toBe('claude stream-json exited (code 1): not logged in')
+    }
+  )
 
   it('never releases for a root Orca never saw leave', async () => {
     const error = await failedStart({ root: 'live', tree: 'unverifiable' })
@@ -590,27 +591,19 @@ describe('ClaudeStructuredSessionAdapter acquisition cleanup', () => {
     return { adapter, connection }
   }
 
-  it('classifies cleanup after a first-hand exit removed the session as a root exit, never as proven', async () => {
-    // The host may still be committing or proving the lease when the child dies;
-    // its cleanup must find the exit the ladder observed, not an absence.
-    const { adapter, connection } = await exitedAfterPublish({
-      root: 'exited',
-      tree: 'unverifiable'
-    })
-    const error = await adapter.releaseAcquisition({ sessionId: 'session-1' }).catch((e) => e)
+  // The host may still be committing or proving the lease when the child dies; its cleanup must
+  // find the exit the ladder observed, not an absence.
+  it.each(['unverifiable', 'live'] as const)(
+    'classifies cleanup after a first-hand exit with its tree %s as a root exit, never as proven',
+    async (tree) => {
+      const { adapter, connection } = await exitedAfterPublish({ root: 'exited', tree })
+      const error = await adapter.releaseAcquisition({ sessionId: 'session-1' }).catch((e) => e)
 
-    expect(error).toBeInstanceOf(AgentSessionAcquisitionRootExitObservedError)
-    expect((error as Error).message).toBe('claude stream-json exited (code 1): crashed')
-    expect(connection.closeCount).toBe(2)
-  })
-
-  it('never releases after an exit that left a descendant observed alive', async () => {
-    const { adapter } = await exitedAfterPublish({ root: 'exited', tree: 'live' })
-    const error = await adapter.releaseAcquisition({ sessionId: 'session-1' }).catch((e) => e)
-
-    expect(error).toBeInstanceOf(AgentSessionAcquisitionExitUnprovenError)
-    expect(error).not.toBeInstanceOf(AgentSessionAcquisitionRootExitObservedError)
-  })
+      expect(error).toBeInstanceOf(AgentSessionAcquisitionRootExitObservedError)
+      expect((error as Error).message).toBe('claude stream-json exited (code 1): crashed')
+      expect(connection.closeCount).toBe(2)
+    }
+  )
 
   it('forgets a retained exit once the session is acquired again', async () => {
     const options: Parameters<typeof fakeClaude>[0] = {}
@@ -780,7 +773,7 @@ describe('ClaudeStructuredSessionAdapter prompts', () => {
       sessionId: 'session-1',
       itemId: 'journal-approval',
       kind: 'approval',
-      optionId: 'allowForSession',
+      response: { kind: 'option', optionId: 'allowForSession' },
       fence: 7,
       commit: async () => undefined
     })
@@ -793,7 +786,7 @@ describe('ClaudeStructuredSessionAdapter prompts', () => {
     })
   })
 
-  it('collects every AskUserQuestion card before settling the one callback', async () => {
+  it('settles the one AskUserQuestion callback from structured answers, including a long typed answer', async () => {
     const claude = fakeClaude()
     const adapter = await acquired(claude)
     const answered = invokeCanUseTool(
@@ -810,34 +803,68 @@ describe('ClaudeStructuredSessionAdapter prompts', () => {
         }
       }
     )
-    adapter.bindPromptItemId('session-1', 'journal-q1', 'question-1', 'Library?')
-    adapter.bindPromptItemId('session-1', 'journal-q2', 'question-1', 'Ship now?')
+    adapter.bindPromptItemId('session-1', 'journal-question', 'question-1')
+    const typed = 'Wait for the capture to finish first. '.repeat(60)
 
     await adapter.answerPrompt({
       sessionId: 'session-1',
-      itemId: 'journal-q1',
+      itemId: 'journal-question',
       kind: 'question',
-      optionId: encodeClaudeQuestionOptionId('Library?', 'Luxon'),
-      fence: 7,
-      commit: async () => undefined
-    })
-    await tick()
-    expect(answered.settled()).toBe(false)
-    await adapter.answerPrompt({
-      sessionId: 'session-1',
-      itemId: 'journal-q2',
-      kind: 'question',
-      optionId: encodeClaudeQuestionOptionId('Ship now?', 'Yes'),
+      response: {
+        kind: 'answers',
+        answers: [
+          { questionId: 'q1', optionIds: ['q1:choice-1'] },
+          { questionId: 'q2', optionIds: [], other: typed }
+        ]
+      },
       fence: 7,
       commit: async () => undefined
     })
     await expect(answered.promise).resolves.toMatchObject({
       behavior: 'allow',
-      updatedInput: { answers: { 'Library?': 'Luxon', 'Ship now?': 'Yes' } },
+      updatedInput: { answers: { 'Library?': 'Luxon', 'Ship now?': typed.trim() } },
       toolUseID: 'tool-question'
     })
   })
 
+  it('refuses answers Claude cannot take before the journal commits them', async () => {
+    const claude = fakeClaude()
+    const adapter = await acquired(claude)
+    const answered = invokeCanUseTool(
+      claude.connections[0],
+      'AskUserQuestion',
+      'question-1',
+      'tool-question',
+      { input: { questions: [{ question: 'Library?', options: [{ label: 'Luxon' }] }] } }
+    )
+    adapter.bindPromptItemId('session-1', 'journal-question', 'question-1')
+    const commit = vi.fn(async () => undefined)
+
+    await expect(
+      adapter.answerPrompt({
+        sessionId: 'session-1',
+        itemId: 'journal-question',
+        kind: 'question',
+        response: { kind: 'option', optionId: 'allow' },
+        fence: 7,
+        commit
+      })
+    ).rejects.toBeInstanceOf(AgentSessionPromptAnswerRejectedError)
+    expect(commit).not.toHaveBeenCalled()
+
+    await adapter.answerPrompt({
+      sessionId: 'session-1',
+      itemId: 'journal-question',
+      kind: 'question',
+      response: { kind: 'answers', answers: [{ questionId: 'q1', optionIds: ['q1:choice-1'] }] },
+      fence: 7,
+      commit
+    })
+    await expect(answered.promise).resolves.toMatchObject({
+      updatedInput: { answers: { 'Library?': 'Luxon' } }
+    })
+  })
+
   it('leaves a prompt cancelled and unanswerable once the SDK abort signal fires', async () => {
     const claude = fakeClaude()
     const events: ClaudeStructuredSessionEvent[] = []
@@ -859,7 +886,7 @@ describe('ClaudeStructuredSessionAdapter prompts', () => {
         sessionId: 'session-1',
         itemId: 'journal-9',
         kind: 'approval',
-        optionId: 'allow',
+        response: { kind: 'option', optionId: 'allow' },
         fence: 7,
         commit: async () => undefined
       })
diff --git a/src/main/claude/claude-structured-session-adapter.ts b/src/main/claude/claude-structured-session-adapter.ts
index 835757dc730..64d3c67c227 100644
--- a/src/main/claude/claude-structured-session-adapter.ts
+++ b/src/main/claude/claude-structured-session-adapter.ts
@@ -1,4 +1,5 @@
-import { compactClaudeSession, observeClaudeCompaction } from './claude-structured-compaction'
+import type { SubmissionRejectionFact } from '../../shared/agent-session-failure'
+import { dispatchClaudeCommand } from './claude-structured-command-dispatch'
 import type {
   AgentSessionAcquisition,
   StructuredAgentSessionAcquireInput,
@@ -6,13 +7,15 @@ import type {
 } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
 import { stopClaudeBackgroundTasks } from './claude-structured-control-actions'
 import { dispatchClaudeTurn } from './claude-structured-dispatch'
-import { StructuredSessionCompaction } from '../native-chat/agent-session-wire/structured-session-compaction'
 import { releaseClaudeAcquisition } from './claude-structured-acquisition-release'
 import { acquireClaudeSession } from './claude-structured-session-acquisition'
 import { supportsClaudeStructuredLocation } from './claude-structured-location-support'
 import { setClaudeStructuredSessionOption } from './claude-structured-options'
 import { readClaudeStructuredSessionOptions } from './claude-structured-session-options'
-import { claudeStartupSettledWithin } from './claude-structured-session-startup-gate'
+import {
+  claudeStartupFailureFact,
+  claudeStartupSettledWithin
+} from './claude-structured-session-startup-state'
 import { CLAUDE_DEFAULT_REQUEST_TIMEOUT_MS } from './claude-agent-sdk-control-requests'
 import {
   ClaudeAcquisitionRegistry,
@@ -51,7 +54,6 @@ function backgroundTaskState(session: ClaudeSession): AgentSessionBackgroundTask
 }
 
 export class ClaudeStructuredSessionAdapter implements StructuredAgentSessionAdapter {
-  private readonly compactions = new StructuredSessionCompaction()
   private readonly sessions = new Map<string, ClaudeSession>()
   private readonly acquisitions = new ClaudeAcquisitionRegistry()
   private readonly exits = new Map<string, ClaudeSessionExit>()
@@ -109,15 +111,22 @@ export class ClaudeStructuredSessionAdapter implements StructuredAgentSessionAda
   }
 
   /** Resolves once every first-hand exit observed so far has published its
-   *  lifecycle event — or has failed its tree proof and stayed indexed for a
-   *  retry. Publication trails observation by the close ladder and the
+   *  lifecycle event — or, with neither its tree proven gone nor its root's exit
+   *  observed, stayed indexed for a retry. Publication trails observation by the close ladder and the
    *  transcript cursor write, so nothing outside can otherwise tell the two
    *  apart without guessing at wall-clock. */
   drainObservedExits = (): Promise<void> => drainClaudeObservedExits(this.exits)
 
-  /** Resolves once a published session's startup has landed or faulted it. */
-  drainStartup = (sessionId: string): Promise<void> =>
-    this.sessions.get(sessionId)?.startup.settled ?? Promise.resolve()
+  /** Resolves once a published session's startup has landed, faulted, or been ended by a close;
+   *  with the reason when it did not land. */
+  awaitStarted = async (sessionId: string): Promise<void | SubmissionRejectionFact> => {
+    const session = this.sessions.get(sessionId)
+    if (!session) {
+      return
+    }
+    await session.startup.settled
+    return claudeStartupFailureFact(session) ?? undefined
+  }
 
   /** Restart reconciliation reads the transcript a resume replays; these maps track liveness. */
   providerHistoryWindow: NonNullable<StructuredAgentSessionAdapter['providerHistoryWindow']> = (
@@ -145,7 +154,7 @@ export class ClaudeStructuredSessionAdapter implements StructuredAgentSessionAda
     if (event.type === 'message' && session?.commands.observe(event.message)) {
       session.events?.publish()
     }
-    observeClaudeCompaction(this.compactions, event, session?.translator)
+    session?.translator?.handle(event)
     this.deps.onEvent?.(event)
     if (backgroundTasksChanged) {
       this.deps.onBackgroundTasksChanged?.(
@@ -169,34 +178,25 @@ export class ClaudeStructuredSessionAdapter implements StructuredAgentSessionAda
     }
   }
 
-  bindPromptItemId(
-    sessionId: string,
-    journalItemId: string,
-    promptKey: string,
-    questionId?: string
-  ): void {
+  bindPromptItemId(sessionId: string, journalItemId: string, promptKey: string): void {
     const session = this.sessions.get(sessionId)
     session?.prompts.bindJournalItemId(
       journalItemId,
       promptKey,
-      questionId,
       session.translator?.currentTurnId ?? null
     )
   }
 
   dispatch: StructuredAgentSessionAdapter['dispatch'] = (input) =>
-    dispatchClaudeTurn(this.session(input.sessionId), input, input.beforeDispatch, (settlement) =>
-      this.deps.onDispatchSettledLate?.({ sessionId: input.sessionId, ...settlement })
-    )
+    dispatchClaudeTurn(this.session(input.sessionId), input, input.beforeDispatch)
 
   compact: NonNullable<StructuredAgentSessionAdapter['compact']> = (input) =>
-    compactClaudeSession(this.session(input.sessionId), this.compactions, input)
+    dispatchClaudeCommand(this.session(input.sessionId), input.command)
 
   cancelTurn: StructuredAgentSessionAdapter['cancelTurn'] = (request) =>
     cancelClaudeStructuredTurn({
       request,
       sessions: this.sessions,
-      compactions: this.compactions,
       admitPromptCancellation: (session, promptKey) =>
         admitClaudePromptCancellation(session, promptKey),
       onDispatchSettledLate: (settlement) =>
@@ -242,7 +242,8 @@ export class ClaudeStructuredSessionAdapter implements StructuredAgentSessionAda
     )
   readOptions = (input: { sessionId: string; fence: number }) =>
     readClaudeStructuredSessionOptions(this.session(input.sessionId), this.deps.requestTimeoutMs)
-  recordsContextUsage = (sessionId: string): boolean => this.sessions.has(sessionId)
+  // Provider-level: a session at rest still reports the usage its journal recorded.
+  recordsContextUsage = (): boolean => true
 
   readOptionRestoreFailures = (sessionId: string): readonly string[] => [
     ...(this.sessions.get(sessionId)?.restoreSkippedOptions ?? [])
diff --git a/src/main/claude/claude-structured-session-close.ts b/src/main/claude/claude-structured-session-close.ts
index f0bba7ae2b0..f49b6a8d88f 100644
--- a/src/main/claude/claude-structured-session-close.ts
+++ b/src/main/claude/claude-structured-session-close.ts
@@ -12,19 +12,19 @@ import {
   AgentSessionPreSpawnError
 } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
 import type { ClaudeStreamJsonConnection } from './claude-stream-json-connection'
-import type { ClaudeJournalTranslator } from './claude-structured-journal-translation'
+import type { ClaudeJournalTranslator } from './claude-journal-translator-contract'
 import type { ClaudePromptRegistry } from './claude-structured-prompt-replies'
 import type { AgentSessionBackgroundTaskState } from '../../shared/agent-session-wire'
 import { closeProcessRegistry } from '../../shared/child-process/close-process-registry'
 import { retireClaudeDispatchWaiters } from './claude-structured-dispatch'
 import { settledClaudeTurnEndLeaf } from './claude-structured-resume-point'
 
-/** The root's own exit was seen first-hand; only its descendants went unverified. */
+/** The root's own exit was seen first-hand. The lease follows the root, so a descendant
+ *  left unverified or seen alive does not hold it. */
 export function claudeRootExitObserved(
   connection: ClaudeStreamJsonConnection | null | undefined
 ): boolean {
-  const verdict = connection?.exitVerdict
-  return verdict?.root === 'exited' && verdict.tree === 'unverifiable'
+  return connection?.exitVerdict.root === 'exited'
 }
 
 export function claudeAcquisitionCleanupError(
diff --git a/src/main/claude/claude-structured-session-exit-blame.test.ts b/src/main/claude/claude-structured-session-exit-blame.test.ts
new file mode 100644
index 00000000000..79430131e15
--- /dev/null
+++ b/src/main/claude/claude-structured-session-exit-blame.test.ts
@@ -0,0 +1,66 @@
+// After a Claude start lands, only the child's own exit says Claude stopped; a fault on Orca's
+// side that makes Orca close the child is Orca's.
+
+import { describe, expect, it, vi } from 'vitest'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import type { ClaudeStructuredSessionEvent } from './claude-structured-session-adapter'
+import {
+  adapterFor,
+  fakeClaude,
+  identityFor,
+  PROVIDER_SESSION_ID
+} from './claude-structured-session-test-support'
+
+async function startedClaude(sink: StructuredAgentSessionEventSink) {
+  const claude = fakeClaude()
+  const events: ClaudeStructuredSessionEvent[] = []
+  const adapter = adapterFor(claude, {}, events)
+  await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9', events: sink })
+  const ended = async () => {
+    await vi.waitFor(() => expect(events.some((event) => event.type === 'ended')).toBe(true))
+    return events.find((event) => event.type === 'ended')
+  }
+  return { connection: claude.connections[0], ended }
+}
+
+describe('what a started Claude session says ended it', () => {
+  it('says Claude stopped when the child exits on its own', async () => {
+    const { connection, ended } = await startedClaude({
+      appendItem: () => {},
+      appendTombstone: () => {},
+      publish: () => {}
+    })
+
+    connection.handlers.onExit?.(new Error('claude stream-json exited (code 1): killed'))
+
+    expect(await ended()).toMatchObject({
+      cause: 'unexpected-exit',
+      failure: { kind: 'providerExited' }
+    })
+  })
+
+  it('blames Orca when a journal fault makes Orca close the child', async () => {
+    const { connection, ended } = await startedClaude({
+      appendItem: () => {},
+      appendTombstone: () => {},
+      publish: () => {},
+      tryAppendResolvedItemAndPublish: () => ({ accepted: false, reason: 'failed' })
+    })
+
+    connection.handlers.onMessage?.({
+      type: 'system',
+      subtype: 'task_notification',
+      session_id: PROVIDER_SESSION_ID,
+      task_id: 'task-1',
+      status: 'failed',
+      summary: 'failed'
+    })
+
+    expect(await ended()).toMatchObject({
+      reason: 'claude background task journal sink failed',
+      cause: 'unexpected-exit',
+      failure: { kind: 'hostFault' }
+    })
+    expect(connection.closeCount).toBeGreaterThanOrEqual(1)
+  })
+})
diff --git a/src/main/claude/claude-structured-session-exit-lifecycle.ts b/src/main/claude/claude-structured-session-exit-lifecycle.ts
index fdcfed379c5..854646490a8 100644
--- a/src/main/claude/claude-structured-session-exit-lifecycle.ts
+++ b/src/main/claude/claude-structured-session-exit-lifecycle.ts
@@ -1,9 +1,14 @@
+import { agentSessionFailureFact, providerDiagnosticOf } from '../../shared/agent-session-failure'
+import {
+  providerExitObserved,
+  providerStartupFailureFact
+} from '../native-chat/agent-session-wire/structured-agent-session-failure-text'
 import { settledClaudeTurnEndLeaf } from './claude-structured-resume-point'
 import {
   claudeRootExitObserved,
   settleClaudeExitedSession
 } from './claude-structured-session-close'
-import { failClaudeStartupGate } from './claude-structured-session-startup-gate'
+import { failClaudeStartup } from './claude-structured-session-startup-state'
 import type {
   ClaudeAcquisitionAttempt,
   ClaudeSession,
@@ -32,7 +37,9 @@ export function observeClaudeSessionExit(
     return
   }
   lifecycle.sessions.delete(sessionId)
-  failClaudeStartupGate(session, error)
+  // Not marked here: startup and journal faults end the session this way too. The child's own
+  // exit arrives already marked by the connection's exit callback.
+  failClaudeStartup(session, error)
   // Re-enter the provider's close ladder before publishing lifecycle recovery.
   // An exit callback is root evidence only; the retained tree proof must run
   // before the host releases and reacquires this exact child.
@@ -55,7 +62,8 @@ export function observeClaudeSessionExit(
     .catch(() => undefined)
 }
 
-/** Lifecycle recovery is published only after the child tree proof is true. */
+/** Lifecycle recovery is published only after the close ladder ran and proved the tree gone or
+ *  observed the root's own exit. */
 export function settleClaudeUnexpectedExit(
   lifecycle: ClaudeExitLifecycle,
   sessionId: string,
@@ -84,6 +92,16 @@ export function settleClaudeUnexpectedExit(
       type: 'ended',
       sessionId,
       reason: exit.error.message,
+      // A start that never landed says why it failed. After it landed, only the child's own exit
+      // blames the provider; an Orca fault that closed it is Orca's.
+      failure:
+        exit.session.startup.state !== 'proven'
+          ? providerStartupFailureFact(exit.session.startup.failure ?? exit.error)
+          : providerExitObserved(exit.error)
+            ? agentSessionFailureFact('providerExited', {
+                detail: providerDiagnosticOf(exit.error)
+              })
+            : agentSessionFailureFact('hostFault'),
       cause: 'unexpected-exit',
       fence: exit.session.fence,
       acquisitionGeneration: exit.session.acquisitionGeneration,
diff --git a/src/main/claude/claude-structured-session-journal-control.ts b/src/main/claude/claude-structured-session-journal-control.ts
index 9a4d3611435..9e3ee0289cf 100644
--- a/src/main/claude/claude-structured-session-journal-control.ts
+++ b/src/main/claude/claude-structured-session-journal-control.ts
@@ -4,7 +4,7 @@ import {
 } from './claude-context-usage'
 import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
 import type { ClaudeStreamJsonConnection } from './claude-stream-json-connection'
-import type { ClaudeJournalTranslator } from './claude-structured-journal-translation'
+import type { ClaudeJournalTranslator } from './claude-journal-translator-contract'
 import type { ClaudeInitProof } from './claude-structured-session-startup'
 import type {
   ClaudeAcquisitionAttempt,
diff --git a/src/main/claude/claude-structured-session-options.ts b/src/main/claude/claude-structured-session-options.ts
index f50923162e5..f4c59148241 100644
--- a/src/main/claude/claude-structured-session-options.ts
+++ b/src/main/claude/claude-structured-session-options.ts
@@ -223,15 +223,37 @@ export function claudeCatalogAdmitsModel(models: readonly ListedModel[], modelId
   )
 }
 
-function wireClaudeModels(models: readonly ListedModel[]): AgentSessionOptionsResult['models'] {
-  return models.map((entry) => ({
+type WireClaudeModel = AgentSessionOptionsResult['models'][number]
+
+function wireClaudeModel(entry: ListedModel): WireClaudeModel {
+  return {
     id: entry.id,
     label: entry.label,
     ...(entry.description ? { description: entry.description } : {}),
     isDefault: entry.isDefault,
     efforts: entry.efforts,
     ...(entry.supportsFastMode !== undefined ? { supportsFastMode: entry.supportsFastMode } : {})
-  }))
+  }
+}
+
+function wireClaudeModels(models: readonly ListedModel[]): WireClaudeModel[] {
+  return models.map(wireClaudeModel)
+}
+
+/** The listing, with what the CLI runs when no effort is sent on each model the child applies —
+ *  a default only a running child knows, and only while this session has no effort pick. */
+function catalogClaudeModels(session: ClaudeSession, discovered: ListedModel[]): WireClaudeModel[] {
+  const applied = session.options.has('effort') ? undefined : session.appliedOptions
+  return discovered.map((listed) => {
+    const model = wireClaudeModel(listed)
+    const effort = applied?.effort
+    const runsApplied =
+      applied?.model !== undefined &&
+      (listed.id === applied.model || listed.resolvedModel === applied.model)
+    return effort && runsApplied && model.efforts.some((choice) => choice.value === effort)
+      ? { ...model, defaultEffort: effort }
+      : model
+  })
 }
 
 /** Write a provider-listed catalog through to the host store. Account-level
@@ -243,7 +265,7 @@ function writeClaudeCatalogThrough(session: ClaudeSession, discovered: ListedMod
   }
   const support = claudeFastModeSupport(discovered, undefined)
   session.catalogAccess.store.recordSuccess(session.catalogAccess.fingerprint, 'claude', {
-    models: wireClaudeModels(discovered),
+    models: catalogClaudeModels(session, discovered),
     ...(support ? { fastModeSupport: support } : {}),
     fastModeTierByModel: new Map(),
     origin: 'live-session'
diff --git a/src/main/claude/claude-structured-session-publication.ts b/src/main/claude/claude-structured-session-publication.ts
index d64273f9b8b..c685c2cd2ae 100644
--- a/src/main/claude/claude-structured-session-publication.ts
+++ b/src/main/claude/claude-structured-session-publication.ts
@@ -1,12 +1,12 @@
 import type { AgentSessionAcquisition } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
 import { claudeProviderHandleLink } from './claude-structured-owner-identity'
 import type { ClaudePromptRegistry } from './claude-structured-prompt-replies'
-import type { ClaudeJournalTranslator } from './claude-structured-journal-translation'
+import type { ClaudeJournalTranslator } from './claude-journal-translator-contract'
 import type { ClaudeSession } from './claude-structured-session-state'
 import { ClaudeBackgroundTaskTracker } from './claude-background-task-tracker'
 import { ClaudeChildWorkDecoder } from './claude-child-work-decoder'
 import { ClaudeSlashCommandCatalog } from './claude-slash-command-catalog'
-import { createClaudeSessionStartupGate } from './claude-structured-session-startup-gate'
+import { createClaudeSessionStartup } from './claude-structured-session-startup-state'
 
 /** The session as published at spawn: nothing the CLI reports at init is assumed yet. */
 export function createClaudeSessionPublication(input: {
@@ -67,7 +67,7 @@ export function createClaudeSessionPublication(input: {
       translator: input.translator,
       events: input.events,
       ...(input.unbindReadingControl ? { unbindReadingControl: input.unbindReadingControl } : {}),
-      startup: createClaudeSessionStartupGate()
+      startup: createClaudeSessionStartup()
     }
   }
 }
diff --git a/src/main/claude/claude-structured-session-reading-control.test.ts b/src/main/claude/claude-structured-session-reading-control.test.ts
index 1084c2c8626..7677462303e 100644
--- a/src/main/claude/claude-structured-session-reading-control.test.ts
+++ b/src/main/claude/claude-structured-session-reading-control.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../shared/agent-session-journal-types'
 import { describe, expect, it, vi } from 'vitest'
 import {
   createDeferredStructuredAgentSessionEventSink,
@@ -236,7 +237,8 @@ describe('Claude structured reading control', () => {
     const resumeReading = vi.spyOn(claude.connections[0], 'resumeReading')
     deferred.sink.appendItem(
       { provider: 'orca', clientMessageId: 'blocked-prefill' },
-      { kind: 'message', role: 'system', blocks: [{ type: 'text', text: 'prefill' }] }
+      { kind: 'message', role: 'system', blocks: [{ type: 'text', text: 'prefill' }] },
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await appendEntered.promise
     const notification = {
diff --git a/src/main/claude/claude-structured-session-recovery.test.ts b/src/main/claude/claude-structured-session-recovery.test.ts
index ef8e0c65469..71a7ac9ce31 100644
--- a/src/main/claude/claude-structured-session-recovery.test.ts
+++ b/src/main/claude/claude-structured-session-recovery.test.ts
@@ -9,10 +9,10 @@ import {
   adapterFor,
   fakeClaude,
   identityFor,
-  invokeCanUseTool,
   PROVIDER_SESSION_ID,
   tick
 } from './claude-structured-session-test-support'
+import { invokeCanUseTool } from './claude-can-use-tool-test-support'
 
 describe('ClaudeStructuredSessionAdapter close and exit recovery', () => {
   it('shares concurrent close finalization and emits lifecycle once', async () => {
@@ -338,7 +338,7 @@ describe('ClaudeStructuredSessionAdapter close and exit recovery', () => {
       spawnToken: 'spawn-9',
       events: journalSink
     })
-    await adapter.drainStartup('session-1')
+    await adapter.awaitStarted('session-1')
     const first = claude.connections[0]
     const oldPrompt = invokeCanUseTool(first, 'Bash', 'permission-retained', 'tool-retained')
     const oldSession = (
@@ -417,6 +417,7 @@ describe('ClaudeStructuredSessionAdapter close and exit recovery', () => {
         type: 'ended',
         sessionId: 'session-1',
         reason: 'crashed before replacement',
+        failure: { kind: 'providerExited' },
         cause: 'unexpected-exit',
         fence: 7,
         acquisitionGeneration: firstAcquisition.acquisitionGeneration,
diff --git a/src/main/claude/claude-structured-session-startup-gate.ts b/src/main/claude/claude-structured-session-startup-gate.ts
deleted file mode 100644
index 0df78936191..00000000000
--- a/src/main/claude/claude-structured-session-startup-gate.ts
+++ /dev/null
@@ -1,172 +0,0 @@
-// A Claude session is published once its child is spawned, before the CLI has answered
-// initialize. Prompts sent in that window are held here and written, in order, once startup
-// lands (init facts read and saved options restored), so a first turn never runs under
-// defaults the restore was about to replace. A held prompt was never written, so a startup
-// that fails rejects it rather than leaving its delivery in doubt.
-
-import type { AgentSessionDispatchOutcome } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
-import { AgentSessionPreDispatchError } from '../native-chat/agent-session-wire/structured-agent-session-operation-settlement'
-import { dispatchWriteFailureReason } from '../../shared/structured-agent-session-dispatch-rejection'
-import { providerStartupFailureRejection } from '../native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement'
-import { claudeUserMessageWasProvablyUnwritten } from './claude-agent-sdk-user-message-queue'
-import {
-  forgetRetiredWaiter,
-  forgetWaiter,
-  retireWaiter
-} from './claude-structured-dispatch-waiters'
-import type {
-  ClaudeDispatchWaiter,
-  ClaudeLateDispatchOutcome,
-  ClaudeSession
-} from './claude-structured-session-state'
-
-type ClaudeStartupHeldWrite = {
-  waiter: ClaudeDispatchWaiter
-  message: Record<string, unknown>
-  settleLate?: (outcome: ClaudeLateDispatchOutcome) => void
-}
-
-export type ClaudeSessionStartupGate = {
-  state: 'pending' | 'proven' | 'failed'
-  held: ClaudeStartupHeldWrite[]
-  /** Held prompts are still being written; later prompts must queue behind them. */
-  draining: boolean
-  failure: Error | null
-  /** Resolves once startup has landed or faulted the session; never rejects. */
-  settled: Promise<void>
-}
-
-export function createClaudeSessionStartupGate(): ClaudeSessionStartupGate {
-  return { state: 'pending', held: [], draining: false, failure: null, settled: Promise.resolve() }
-}
-
-export function claudeStartupFailureReason(session: ClaudeSession): string | null {
-  return session.startup.state === 'failed'
-    ? providerStartupFailureRejection(session.startup.failure ?? undefined)
-    : null
-}
-
-/** Resolves when startup lands or `timeoutMs` passes; a stuck start then refuses the write as before. */
-export function claudeStartupSettledWithin(
-  session: ClaudeSession | undefined,
-  timeoutMs: number
-): Promise<void> {
-  if (session?.startup.state !== 'pending') {
-    return Promise.resolve()
-  }
-  let timer: ReturnType<typeof setTimeout> | undefined
-  return Promise.race([
-    session.startup.settled,
-    new Promise<void>((resolve) => {
-      timer = setTimeout(resolve, timeoutMs)
-    })
-  ]).finally(() => clearTimeout(timer))
-}
-
-export function claudeStartupHoldsWrites(session: ClaudeSession): boolean {
-  return session.startup.state === 'pending' || session.startup.draining
-}
-
-/** Admits a prompt while startup is pending; it is written when `openClaudeStartupGate` runs. */
-export async function holdClaudeStartupWrite(
-  session: ClaudeSession,
-  input: {
-    message: Record<string, unknown>
-    arm: () => { waiter: ClaudeDispatchWaiter }
-    beforeDispatch?: () => Promise<void>
-    settleLate?: (outcome: ClaudeLateDispatchOutcome) => void
-  }
-): Promise<AgentSessionDispatchOutcome> {
-  if (input.beforeDispatch) {
-    try {
-      await input.beforeDispatch()
-    } catch (error) {
-      if (error instanceof AgentSessionPreDispatchError) {
-        throw error
-      }
-      return { state: 'rejected', reason: dispatchWriteFailureReason(error) }
-    }
-  }
-  // Startup may have failed while the admission barrier ran.
-  const failed = claudeStartupFailureReason(session)
-  if (failed) {
-    return { state: 'rejected', reason: failed }
-  }
-  const { waiter } = input.arm()
-  session.startup.held.push({
-    waiter,
-    message: input.message,
-    ...(input.settleLate ? { settleLate: input.settleLate } : {})
-  })
-  // Startup finished writing what it held while the barrier ran; nothing else would drain this.
-  if (!claudeStartupHoldsWrites(session)) {
-    void drainClaudeStartupWrites(session)
-  }
-  return { state: 'admitted' }
-}
-
-export async function openClaudeStartupGate(session: ClaudeSession): Promise<void> {
-  const gate = session.startup
-  if (gate.state !== 'pending') {
-    return
-  }
-  gate.state = 'proven'
-  await drainClaudeStartupWrites(session)
-}
-
-async function drainClaudeStartupWrites(session: ClaudeSession): Promise<void> {
-  const gate = session.startup
-  gate.draining = true
-  try {
-    for (let held = gate.held.shift(); held; held = gate.held.shift()) {
-      await writeHeld(session, held)
-    }
-  } finally {
-    gate.draining = false
-  }
-}
-
-async function writeHeld(session: ClaudeSession, held: ClaudeStartupHeldWrite): Promise<void> {
-  try {
-    await session.connection.send(held.message)
-  } catch (error) {
-    if (held.waiter.settledUuid) {
-      return
-    }
-    if (claudeUserMessageWasProvablyUnwritten(error)) {
-      rejectHeld(session, held, dispatchWriteFailureReason(error))
-      return
-    }
-    // Possibly written: only a replay or the child's exit can settle it now.
-    retireWaiter(session, held.waiter)
-    held.waiter.resolve(null)
-  }
-}
-
-function rejectHeld(session: ClaudeSession, held: ClaudeStartupHeldWrite, reason: string): void {
-  forgetWaiter(session, held.waiter)
-  forgetRetiredWaiter(session, held.waiter)
-  held.waiter.resolve(null)
-  if (held.waiter.clientMessageId) {
-    held.settleLate?.({ clientMessageId: held.waiter.clientMessageId, state: 'rejected', reason })
-  }
-}
-
-/** Rejects every held prompt with `reason`; true when any was held. */
-export function rejectClaudeStartupWrites(session: ClaudeSession, reason: string): boolean {
-  const held = session.startup.held.splice(0)
-  for (const entry of held) {
-    rejectHeld(session, entry, reason)
-  }
-  return held.length > 0
-}
-
-/** Startup cannot land any more; nothing held was written, so all of it is rejected. */
-export function failClaudeStartupGate(session: ClaudeSession, error: Error): void {
-  const gate = session.startup
-  if (gate.state === 'pending') {
-    gate.state = 'failed'
-    gate.failure = error
-  }
-  rejectClaudeStartupWrites(session, providerStartupFailureRejection(error))
-}
diff --git a/src/main/claude/claude-structured-session-startup-state.ts b/src/main/claude/claude-structured-session-startup-state.ts
new file mode 100644
index 00000000000..cf44bd984ab
--- /dev/null
+++ b/src/main/claude/claude-structured-session-startup-state.ts
@@ -0,0 +1,59 @@
+// Where a Claude start stands. A session is published once its child is spawned, before the CLI
+// has answered initialize. Nothing is written to it until startup lands (init facts read and saved
+// options restored): the host's delivery loop waits on `settled` before it hands a message over,
+// so a first turn never runs under defaults the restore was about to replace.
+
+import type { SubmissionRejectionFact } from '../../shared/agent-session-failure'
+import { providerStartupFailureFact } from '../native-chat/agent-session-wire/structured-agent-session-failure-text'
+import type { ClaudeSession } from './claude-structured-session-state'
+
+export type ClaudeSessionStartup = {
+  state: 'pending' | 'proven' | 'failed'
+  failure: Error | null
+  /** Resolves once startup has landed or faulted, or the child exited or was closed; never
+   *  rejects. A close must end it: the delivery loop waits here, and a start Stop cut short
+   *  would otherwise hold that loop forever. */
+  settled: Promise<void>
+  end: () => void
+}
+
+export function createClaudeSessionStartup(): ClaudeSessionStartup {
+  let end: () => void = () => undefined
+  const ended = new Promise<void>((resolve) => {
+    end = resolve
+  })
+  return { state: 'pending', failure: null, settled: ended, end }
+}
+
+export function claudeStartupFailureFact(session: ClaudeSession): SubmissionRejectionFact | null {
+  return session.startup.state === 'failed'
+    ? providerStartupFailureFact(session.startup.failure ?? undefined)
+    : null
+}
+
+/** Resolves when startup lands or `timeoutMs` passes; a stuck start then refuses the write as before. */
+export function claudeStartupSettledWithin(
+  session: ClaudeSession | undefined,
+  timeoutMs: number
+): Promise<void> {
+  if (session?.startup.state !== 'pending') {
+    return Promise.resolve()
+  }
+  let timer: ReturnType<typeof setTimeout> | undefined
+  return Promise.race([
+    session.startup.settled,
+    new Promise<void>((resolve) => {
+      timer = setTimeout(resolve, timeoutMs)
+    })
+  ]).finally(() => clearTimeout(timer))
+}
+
+/** Startup cannot land any more: the child exited, was closed, or its start faulted. */
+export function failClaudeStartup(session: ClaudeSession, error: Error): void {
+  const startup = session.startup
+  if (startup.state === 'pending') {
+    startup.state = 'failed'
+    startup.failure = error
+  }
+  startup.end()
+}
diff --git a/src/main/claude/claude-structured-session-startup.test.ts b/src/main/claude/claude-structured-session-startup.test.ts
index a106c172c45..ceb9e9cdf6d 100644
--- a/src/main/claude/claude-structured-session-startup.test.ts
+++ b/src/main/claude/claude-structured-session-startup.test.ts
@@ -55,7 +55,7 @@ describe('Claude structured session publishes before the CLI answers initialize'
     expect(adapter.readCommands('session-1')).toBeUndefined()
 
     await vi.advanceTimersByTimeAsync(SLOW_INIT_MS)
-    await adapter.drainStartup('session-1')
+    await adapter.awaitStarted('session-1')
 
     expect(events.find((event) => event.type === 'options')).toMatchObject({
       models: [{ value: 'claude-sonnet' }]
@@ -65,7 +65,7 @@ describe('Claude structured session publishes before the CLI answers initialize'
     await adapter.closeAll()
   })
 
-  it('reports `started` once saved options are restored, before any held prompt is written', async () => {
+  it('reports `started` once saved options are restored, having written no prompt of its own', async () => {
     const claude = fakeClaude({ initDelayMs: SLOW_INIT_MS, initModel: 'claude-opus-9' })
     const { adapter, events } = startingAdapter(claude)
     const order: string[] = []
@@ -74,11 +74,10 @@ describe('Claude structured session publishes before the CLI answers initialize'
       return undefined
     }
     await adapter.acquire({ ...ACQUIRE, options: { model: 'opus' } })
-    await adapter.dispatch(PROMPT)
     expect(events.some((event) => event.type === 'started')).toBe(false)
 
     await vi.advanceTimersByTimeAsync(SLOW_INIT_MS)
-    await adapter.drainStartup('session-1')
+    await adapter.awaitStarted('session-1')
 
     const startedAt = events.findIndex((event) => event.type === 'started')
     expect(events[startedAt]).toEqual({
@@ -90,9 +89,9 @@ describe('Claude structured session publishes before the CLI answers initialize'
       reportedOptions: expect.objectContaining({ model: 'opus' }),
       restoreSkippedOptions: []
     })
-    // The restore wrote the saved model before `started`, and the held prompt only after it.
+    // The restore wrote the saved model before `started`; no message waits inside the adapter.
     expect(order).toEqual(['set_model'])
-    expect(claude.connections[0].sent).toHaveLength(1)
+    expect(claude.connections[0].sent).toEqual([])
     expect(events.slice(0, startedAt).some((event) => event.type === 'options')).toBe(true)
     await adapter.closeAll()
   })
@@ -133,52 +132,37 @@ describe('Claude structured session publishes before the CLI answers initialize'
     await adapter.closeAll()
   })
 
-  it('holds a prompt sent before init and writes it once startup lands', async () => {
+  // The host's delivery loop waits here before it hands a message over, so the adapter no longer
+  // holds prompts of its own: nothing is written until startup lands because nothing is sent.
+  it('resolves awaitStarted only once startup lands', async () => {
     const claude = fakeClaude({ initDelayMs: SLOW_INIT_MS })
     const { adapter } = startingAdapter(claude)
     await adapter.acquire(ACQUIRE)
-
-    await expect(adapter.dispatch(PROMPT)).resolves.toEqual({ state: 'admitted' })
-    expect(claude.connections[0].sent).toEqual([])
-
-    await vi.advanceTimersByTimeAsync(SLOW_INIT_MS)
-    await adapter.drainStartup('session-1')
-
-    expect(claude.connections[0].sent).toHaveLength(1)
-    expect(claude.connections[0].sent[0]).toMatchObject({ type: 'user' })
-    await adapter.closeAll()
-  })
-
-  it('writes a prompt whose admission barrier was still running when startup landed', async () => {
-    const claude = fakeClaude({ initDelayMs: SLOW_INIT_MS })
-    const { adapter } = startingAdapter(claude)
-    await adapter.acquire(ACQUIRE)
-    let passBarrier = (): void => {}
-    const barrier = new Promise<void>((resolve) => {
-      passBarrier = resolve
+    let started = false
+    const waited = adapter.awaitStarted('session-1').then(() => {
+      started = true
     })
 
-    const dispatched = adapter.dispatch({ ...PROMPT, beforeDispatch: () => barrier })
-    await vi.advanceTimersByTimeAsync(SLOW_INIT_MS)
-    await adapter.drainStartup('session-1')
-    passBarrier()
+    await vi.advanceTimersByTimeAsync(SLOW_INIT_MS - 1)
+    expect(started).toBe(false)
+    await vi.advanceTimersByTimeAsync(1)
+    await waited
 
-    await expect(dispatched).resolves.toEqual({ state: 'admitted' })
-    expect(claude.connections[0].sent.filter((message) => message.type === 'user')).toHaveLength(1)
+    await expect(adapter.dispatch(PROMPT)).resolves.toEqual({ state: 'admitted' })
+    expect(claude.connections[0].sent).toEqual([expect.objectContaining({ type: 'user' })])
     await adapter.closeAll()
   })
 
-  it('ends the session with the exit reason when the CLI dies before init, and rejects held prompts', async () => {
+  it('ends the session with the exit reason when the CLI dies before init', async () => {
     const claude = fakeClaude({
       initDelayMs: SLOW_INIT_MS,
       exitBeforeInit: 'claude stream-json exited (code 1): stderr says no'
     })
-    const { adapter, events, late } = startingAdapter(claude)
+    const { adapter, events } = startingAdapter(claude)
     await adapter.acquire(ACQUIRE)
-    await adapter.dispatch(PROMPT)
 
     await vi.advanceTimersByTimeAsync(SLOW_INIT_MS)
-    await adapter.drainStartup('session-1')
+    await adapter.awaitStarted('session-1')
     await adapter.drainObservedExits()
 
     expect(events.find((event) => event.type === 'ended')).toMatchObject({
@@ -186,9 +170,6 @@ describe('Claude structured session publishes before the CLI answers initialize'
       cause: 'unexpected-exit',
       startupUnproven: true
     })
-    expect(late).toEqual([
-      expect.objectContaining({ clientMessageId: 'client-1', state: 'rejected' })
-    ])
     expect(claude.connections[0].sent).toEqual([])
     expect(claude.connections[0].closeCount).toBe(1)
   })
@@ -203,11 +184,10 @@ describe('Claude structured session publishes before the CLI answers initialize'
     await adapter.acquire(ACQUIRE)
 
     await vi.advanceTimersByTimeAsync(SLOW_INIT_MS)
-    await adapter.drainStartup('session-1')
+    await adapter.awaitStarted('session-1')
     await adapter.drainObservedExits()
 
-    // A failed start is released on the same evidence a failed create is; a proven-live
-    // descendant would have answered `tree: 'live'` instead.
+    // A failed start is released on the same evidence a failed create is.
     expect(events.find((event) => event.type === 'ended')).toMatchObject({
       cause: 'unexpected-exit',
       startupUnproven: true
@@ -218,7 +198,7 @@ describe('Claude structured session publishes before the CLI answers initialize'
     const claude = fakeClaude({ initAccount: { apiProvider: 'firstParty', tokenSource: 'none' } })
     const { adapter, events } = startingAdapter(claude)
     await adapter.acquire(ACQUIRE)
-    await adapter.drainStartup('session-1')
+    await adapter.awaitStarted('session-1')
     await adapter.drainObservedExits()
 
     expect(events.find((event) => event.type === 'ended')).toMatchObject({
@@ -227,82 +207,41 @@ describe('Claude structured session publishes before the CLI answers initialize'
     })
   })
 
-  it('closes a session stopped before init without faulting it or writing held prompts', async () => {
-    const claude = fakeClaude({ initDelayMs: SLOW_INIT_MS })
-    const { adapter, events, late } = startingAdapter(claude)
+  // A Stop that closes a child still starting must end the wait the host's delivery loop is in,
+  // though initialize never answers; otherwise every later send joins a loop that never moves.
+  it('ends the wait on a start closed before init, without faulting it', async () => {
+    const claude = fakeClaude({ initDelayMs: 10 * SLOW_INIT_MS })
+    const { adapter, events } = startingAdapter(claude)
     await adapter.acquire(ACQUIRE)
-    await adapter.dispatch(PROMPT)
+    let ended = false
+    const waited = adapter.awaitStarted('session-1').then(() => {
+      ended = true
+    })
 
     await expect(adapter.closeSession('session-1')).resolves.toBe(true)
-    await vi.advanceTimersByTimeAsync(SLOW_INIT_MS)
-    await adapter.drainStartup('session-1')
+    await vi.advanceTimersByTimeAsync(0)
+    await waited
 
+    expect(ended).toBe(true)
     const connection = claude.connections[0]
     expect(connection.closeCount).toBe(1)
     expect(connection.sent).toEqual([])
     expect(connection.calls.map(({ subtype }) => subtype)).not.toContain('get_settings')
-    expect(late).toEqual([
-      expect.objectContaining({ clientMessageId: 'client-1', state: 'rejected' })
-    ])
     expect(events.some((event) => event.type === 'ended' && event.startupUnproven)).toBe(false)
     expect(events.some((event) => event.type === 'started')).toBe(false)
   })
 
-  it('withdraws a held prompt when the turn is cancelled before init', async () => {
+  it('interrupts nothing when Stop lands before init: nothing was written', async () => {
     const claude = fakeClaude({ initDelayMs: SLOW_INIT_MS })
-    const { adapter, late } = startingAdapter(claude)
+    const { adapter } = startingAdapter(claude)
     await adapter.acquire(ACQUIRE)
-    await adapter.dispatch(PROMPT)
 
     await expect(
       adapter.cancelTurn({ sessionId: 'session-1', turnId: 'turn-1', fence: 7 })
-    ).resolves.toEqual({ cancelled: true })
-    await vi.advanceTimersByTimeAsync(SLOW_INIT_MS)
-    await adapter.drainStartup('session-1')
+    ).resolves.toEqual({ cancelled: false })
 
+    expect(claude.connections[0].calls.map(({ subtype }) => subtype)).not.toContain('interrupt')
     expect(claude.connections[0].sent).toEqual([])
-    expect(late).toEqual([
-      expect.objectContaining({ clientMessageId: 'client-1', state: 'rejected' })
-    ])
-    await adapter.closeAll()
-  })
-
-  it('withdraws the prompts still held when Stop lands while startup is writing them', async () => {
-    const claude = fakeClaude({ initDelayMs: SLOW_INIT_MS })
-    const { adapter, late } = startingAdapter(claude)
-    await adapter.acquire(ACQUIRE)
-    const connection = claude.connections[0]
-    const send = connection.send
-    let landFirstWrite = (): void => {}
-    const firstWrite = new Promise<void>((resolve) => {
-      landFirstWrite = resolve
-    })
-    let writes = 0
-    connection.send = async (message, beforeDispatch) => {
-      writes += 1
-      if (writes === 1) {
-        await firstWrite
-      }
-      return send(message, beforeDispatch)
-    }
-    await adapter.dispatch(PROMPT)
-    await adapter.dispatch({ ...PROMPT, clientMessageId: 'client-2' })
-
-    await vi.advanceTimersByTimeAsync(SLOW_INIT_MS)
-    // Startup has landed and is writing the first held prompt.
-    expect(writes).toBe(1)
-    const cancelled = adapter.cancelTurn({ sessionId: 'session-1', turnId: 'turn-1', fence: 7 })
-    await vi.advanceTimersByTimeAsync(0)
-    landFirstWrite()
-    await vi.advanceTimersByTimeAsync(5_000)
-    await adapter.drainStartup('session-1')
-
-    expect(connection.sent.filter((message) => message.type === 'user')).toHaveLength(1)
-    expect(late).toContainEqual(
-      expect.objectContaining({ clientMessageId: 'client-2', state: 'rejected' })
-    )
-    // Stop withdrew something, so it answers as a cancel whatever the interrupt made of the turn.
-    await expect(cancelled).resolves.toEqual({ cancelled: true })
     await adapter.closeAll()
   })
 })
diff --git a/src/main/claude/claude-structured-session-startup.ts b/src/main/claude/claude-structured-session-startup.ts
index aa1f9a02ecc..ce14a64dd2c 100644
--- a/src/main/claude/claude-structured-session-startup.ts
+++ b/src/main/claude/claude-structured-session-startup.ts
@@ -26,10 +26,7 @@ import {
   observeClaudeSettingsApplied,
   readClaudeSettingsEffort
 } from './claude-structured-session-options'
-import {
-  failClaudeStartupGate,
-  openClaudeStartupGate
-} from './claude-structured-session-startup-gate'
+import { failClaudeStartup } from './claude-structured-session-startup-state'
 import type { ClaudeSession, ClaudeStructuredSessionEvent } from './claude-structured-session-state'
 
 export type ClaudeInitProof = {
@@ -141,7 +138,7 @@ function applyClaudeStartupFacts(session: ClaudeSession, facts: ClaudeStartupFac
   session.fastModeState ??= published.fastModeState
   session.fastModeDisabledReason ??= published.fastModeDisabledReason
   session.options = prepared.options
-  session.capabilities = readClaudeCapabilities(init, initialization)
+  session.capabilities = readClaudeCapabilities(session.capabilities, initialization, init.message)
   // A catalog frame that streamed in after publish is newer than the initialize answer.
   if (session.commands.commands === undefined) {
     session.commands = new ClaudeSlashCommandCatalog(init.message, initialization)
@@ -163,8 +160,8 @@ function claudeStartedReportedOptions(
   return persisted
 }
 
-/** Applies startup facts to the published session, restores saved options, then releases
- *  held prompts. Any failure faults the session so the user sees why it never started. */
+/** Applies startup facts to the published session and restores saved options; only then does the
+ *  session take input. Any failure faults the session so the user sees why it never started. */
 export async function settleClaudeSessionStartup(input: {
   session: ClaudeSession
   facts: Promise<ClaudeStartupFacts>
@@ -179,7 +176,7 @@ export async function settleClaudeSessionStartup(input: {
     if (input.isCurrent()) {
       return false
     }
-    failClaudeStartupGate(session, new Error('claude session closed before startup completed'))
+    failClaudeStartup(session, new Error('claude session closed before startup completed'))
     return true
   }
   try {
@@ -198,13 +195,15 @@ export async function settleClaudeSessionStartup(input: {
         ),
         restoreSkippedOptions: [...session.restoreSkippedOptions]
       })
-      await openClaudeStartupGate(session)
+      if (session.startup.state === 'pending') {
+        session.startup.state = 'proven'
+      }
     }
   } catch (caught) {
     const error = caught instanceof Error ? caught : new Error(String(caught))
     // A close or exit that already ended startup owns how the session ends.
     const endedElsewhere = session.startup.state !== 'pending'
-    failClaudeStartupGate(session, error)
+    failClaudeStartup(session, error)
     if (!endedElsewhere && input.isCurrent()) {
       input.fault(error)
     }
diff --git a/src/main/claude/claude-structured-session-state.ts b/src/main/claude/claude-structured-session-state.ts
index 7d99aff577b..b40aaba81c4 100644
--- a/src/main/claude/claude-structured-session-state.ts
+++ b/src/main/claude/claude-structured-session-state.ts
@@ -1,3 +1,5 @@
+import type { AgentJournalDispatchRejection } from '../../shared/agent-session-failure-words'
+import type { SubmissionRejectionFact } from '../../shared/agent-session-failure'
 import type {
   AgentJournalItemIdentity,
   AgentSessionJournalIdentity
@@ -9,7 +11,7 @@ import type {
   openClaudeStreamJsonConnection
 } from './claude-stream-json-connection'
 import type { ClaudeStructuredLaunch } from './claude-structured-launch-resolution'
-import type { ClaudeJournalTranslator } from './claude-structured-journal-translation'
+import type { ClaudeJournalTranslator } from './claude-journal-translator-contract'
 import type { ClaudePendingPrompt, ClaudePromptRegistry } from './claude-structured-prompt-replies'
 import { cancelProcessAcquisition } from '../../shared/child-process/cancel-process-acquisition'
 import { randomUUID } from 'node:crypto'
@@ -25,7 +27,7 @@ import type { AgentChildWorkEvidence } from '../../shared/agent-status-child-wor
 import type { ClaudeBackgroundTaskTracker } from './claude-background-task-tracker'
 import type { ClaudeChildWorkDecoder } from './claude-child-work-decoder'
 import type { ClaudeSlashCommandCatalog } from './claude-slash-command-catalog'
-import type { ClaudeSessionStartupGate } from './claude-structured-session-startup-gate'
+import type { ClaudeSessionStartup } from './claude-structured-session-startup-state'
 
 export type ClaudeAuthDiagnostic = {
   apiKeySourceConfigured: boolean
@@ -40,7 +42,9 @@ export type ClaudeStructuredSessionEvent =
       type: 'message'
       sessionId: string
       message: Record<string, unknown>
-      /** Present only when this replay acknowledged Orca's in-flight dispatch. */
+      /** Present only when this replay acknowledged Orca's in-flight dispatch
+       *  AND opens a turn; a replay folded into the running turn settles
+       *  delivery without one. */
       startsTurn?: true
       /** Submission instant of the dispatch this replay acknowledged; the origin
        *  of the turn it opens. Absent when the host cannot name a send. */
@@ -66,11 +70,11 @@ export type ClaudeStructuredSessionEvent =
       type: 'ended'
       sessionId: string
       reason: string
+      failure?: SubmissionRejectionFact
       /** Present for first-hand child exits so the host can fence recovery. */
       cause?: 'unexpected-exit' | 'requested-close'
       fence?: number
       acquisitionGeneration?: string
-      settlementRetryRequired?: boolean
       /** Host clock when the end was observed. */
       observedAt?: number
       /** The child ended before proving startup, so reacquiring would repeat the same start. */
@@ -82,7 +86,7 @@ export type ClaudeLateDispatchOutcome =
       clientMessageId: string
       providerIdentity: AgentJournalItemIdentity
     }
-  | { clientMessageId: string; state: 'rejected'; reason: string }
+  | ({ clientMessageId: string; state: 'rejected' } & AgentJournalDispatchRejection)
 
 export type ClaudeStructuredSessionAdapterDeps = {
   resolveLaunch: (input: {
@@ -91,6 +95,8 @@ export type ClaudeStructuredSessionAdapterDeps = {
   onEvent?: (event: ClaudeStructuredSessionEvent) => void
   /** Direct settlement path for provider-proven late dispatch outcomes. */
   onDispatchSettledLate?: (input: { sessionId: string } & ClaudeLateDispatchOutcome) => void
+  /** The CLI reported `session_state_changed idle`, which it sends only once its queue drains. */
+  onSessionIdle?: (input: { sessionId: string }) => void
   onBackgroundTasksChanged?: (
     sessionId: string,
     state: AgentSessionBackgroundTaskState | null
@@ -135,6 +141,8 @@ export type ClaudeDispatchWaiter = {
   settledUuid?: string
   /** The write failed or the child died, but a replay may still name it. */
   retired?: boolean
+  /** The CLI's last non-terminal `command_lifecycle` state for this send; in memory only. */
+  commandLifecycle?: 'queued' | 'started'
   /** Bounded digest/summary for compatibility CLIs that mint UUIDs. */
   replayContentKey: string
 }
@@ -196,7 +204,7 @@ export type ClaudeSession = {
   events: StructuredAgentSessionEventSink | undefined
   unbindReadingControl?: () => void
   /** Published at spawn; init facts, option restore and queued prompts land when startup does. */
-  startup: ClaudeSessionStartupGate
+  startup: ClaudeSessionStartup
 }
 
 export function mintClaudeAcquisitionGeneration(deps: ClaudeStructuredSessionAdapterDeps): string {
@@ -210,7 +218,7 @@ export function mintClaudeAcquisitionGeneration(deps: ClaudeStructuredSessionAda
  */
 export type ClaudeSessionExit = {
   connection: ClaudeStreamJsonConnection
-  /** Full session identity retained until its child tree is proven gone. */
+  /** Full session identity retained until the exit settles. */
   session: ClaudeSession
   error: Error
   /** The exit path's first proof attempt; retries must observe this result. */
diff --git a/src/main/claude/claude-structured-session-test-support.ts b/src/main/claude/claude-structured-session-test-support.ts
index 023e0ba46b7..0380d5ac12f 100644
--- a/src/main/claude/claude-structured-session-test-support.ts
+++ b/src/main/claude/claude-structured-session-test-support.ts
@@ -51,6 +51,9 @@ export function fakeClaude(
     initSessionId?: string
     initUuid?: string
     initModel?: string
+    /** 'session-start' (default) mirrors live: a SessionStart hook frame proves the
+     *  session and system/init arrives only when the first command starts a cycle.
+     *  'init' emits init at startup — an UNMEASURED shape, opt-in only. */
     initProof?: 'init' | 'session-start' | 'none'
     initAccount?: unknown
     initCommands?: unknown
@@ -81,6 +84,22 @@ export function fakeClaude(
     return route ? route(params) : undefined
   }
   const openConnection: typeof openClaudeStreamJsonConnection = async (launch, handlers = {}) => {
+    let cycleInitEmitted = false
+    // Keys mirror the real system/init frame, which carries `model` but no
+    // effort of any kind: the current effort only comes back from get_settings.
+    // Never add a field the CLI does not send.
+    const emitCycleInit = (): void => {
+      cycleInitEmitted = true
+      handlers.onMessage?.({
+        type: 'system',
+        subtype: 'init',
+        session_id: options.initSessionId ?? PROVIDER_SESSION_ID,
+        uuid: options.initUuid ?? 'init-uuid',
+        model: options.initModel ?? 'claude-sonnet-5',
+        apiKeySource: 'none',
+        ...(options.capabilities ? { capabilities: options.capabilities } : {})
+      })
+    }
     const connection: FakeConnection = {
       launch,
       handlers,
@@ -102,7 +121,13 @@ export function fakeClaude(
           // The SDK rejects pending control requests once the transport ends.
           throw new Error('Query closed before response received')
         }
-        if (options.initProof === 'session-start') {
+        if (options.initProof === 'init') {
+          // UNMEASURED startup shape, kept only as an explicit opt-in: live
+          // sessions prove startup with a SessionStart hook frame instead.
+          emitCycleInit()
+        } else if (options.initProof !== 'none') {
+          // The live proof order (measured through Orca's adapter): SessionStart
+          // hook frames arrive first; system/init only when a cycle starts.
           handlers.onMessage?.({
             type: 'system',
             subtype: 'hook_started',
@@ -110,22 +135,19 @@ export function fakeClaude(
             session_id: options.initSessionId ?? PROVIDER_SESSION_ID,
             uuid: options.initUuid ?? 'init-uuid'
           })
-        } else if (options.initProof !== 'none') {
-          // Keys mirror the real system/init frame, which carries `model` but no
-          // effort of any kind: the current effort only comes back from
-          // get_settings. Never add a field the CLI does not send.
           handlers.onMessage?.({
             type: 'system',
-            subtype: 'init',
+            subtype: 'hook_response',
+            hook_name: 'SessionStart:startup',
             session_id: options.initSessionId ?? PROVIDER_SESSION_ID,
-            uuid: options.initUuid ?? 'init-uuid',
-            model: options.initModel ?? 'claude-sonnet-5',
-            apiKeySource: 'none',
-            ...(options.capabilities ? { capabilities: options.capabilities } : {})
+            uuid: 'hook-response-uuid'
           })
         }
         return {
           models: options.initModels ?? [{ value: 'claude-sonnet', displayName: 'Sonnet' }],
+          // Capabilities ride the initialize result, where startup facts read
+          // them regardless of when the first init frame arrives.
+          ...(options.capabilities ? { capabilities: options.capabilities } : {}),
           ...(options.initCommands === undefined ? {} : { commands: options.initCommands }),
           ...(options.initAccount === undefined ? {} : { account: options.initAccount })
         }
@@ -173,7 +195,7 @@ export function fakeClaude(
       },
       cancelAsyncMessage: async (uuid) => {
         connection.calls.push({ subtype: 'cancel_async_message', params: { uuid } })
-        routed('cancel_async_message', { uuid })
+        return routed('cancel_async_message', { uuid }) === true
       },
       stopTask: async (taskId) => {
         connection.calls.push({ subtype: 'stop_task', params: { taskId } })
@@ -184,6 +206,11 @@ export function fakeClaude(
           await beforeDispatch()
         }
         connection.sent.push(message)
+        // Live: the first command starts a request cycle, whose init precedes
+        // the replay. Later cycles are the test's own frames.
+        if (message.type === 'user' && !cycleInitEmitted && options.initProof !== 'none') {
+          emitCycleInit()
+        }
         if (message.type === 'user' && options.replayUuid !== null) {
           const configuredReplayUuid = options.replayUuids
             ? options.replayUuids[replayIndex++]
@@ -220,7 +247,7 @@ export function adapterFor(
   const acquire = adapter.acquire
   adapter.acquire = async (input) => {
     const acquisition = await acquire(input)
-    await adapter.drainStartup(input.identity.sessionId)
+    await adapter.awaitStarted(input.identity.sessionId)
     return acquisition
   }
   return adapter
@@ -297,29 +324,3 @@ export function recordingJournalSink(): StructuredAgentSessionEventSink {
 export function tick(): Promise<void> {
   return new Promise((resolve) => setImmediate(resolve))
 }
-
-export function invokeCanUseTool(
-  connection: FakeConnection,
-  toolName: string,
-  requestId: string,
-  toolUseID: string,
-  extra: {
-    input?: Record<string, unknown>
-    suggestions?: unknown[]
-    signal?: AbortSignal
-  } = {}
-): { promise: Promise<unknown>; settled: () => boolean } {
-  const options = {
-    requestId,
-    toolUseID,
-    signal: extra.signal ?? new AbortController().signal,
-    ...(extra.suggestions ? { suggestions: extra.suggestions } : {})
-  } as unknown as Parameters<NonNullable<ClaudeStreamJsonConnectionHandlers['canUseTool']>>[2]
-  let done = false
-  const promise = Promise.resolve(
-    connection.handlers.canUseTool?.(toolName, extra.input ?? {}, options)
-  ).finally(() => {
-    done = true
-  })
-  return { promise, settled: () => done }
-}
diff --git a/src/main/claude/claude-subagent-group-row.ts b/src/main/claude/claude-subagent-group-row.ts
index ab44350606e..8be89d15e19 100644
--- a/src/main/claude/claude-subagent-group-row.ts
+++ b/src/main/claude/claude-subagent-group-row.ts
@@ -46,7 +46,7 @@ export function writeClaudeSubagentGroupRow(
   group: RosterGroup
 ): void {
   const agents = [...group.entries.values()].map((tracked) => tracked.entry)
-  const options = { coalescingKey: `claude-subagents:${group.groupId}` }
+  const options = { coalescingKey: `claude-subagents:${group.groupId}`, turnScope: group.turnScope }
   if (agents.length === 0) {
     // The row's last child turned out not to be a subagent. An empty roster is
     // not a roster of nothing, so the row goes rather than reading "Ran 0".
diff --git a/src/main/claude/claude-subagent-roster-state.ts b/src/main/claude/claude-subagent-roster-state.ts
index f7fc3374661..dcaa72c3000 100644
--- a/src/main/claude/claude-subagent-roster-state.ts
+++ b/src/main/claude/claude-subagent-roster-state.ts
@@ -1,4 +1,7 @@
-import type { AgentJournalItemIdentity } from '../../shared/agent-session-journal-types'
+import type {
+  AgentJournalItemIdentity,
+  AgentJournalTurnScope
+} from '../../shared/agent-session-journal-types'
 import type { NativeChatSubagentEntry } from '../../shared/native-chat-types'
 import type { ClaudeSubagentTaskFrame } from './claude-subagent-task-frames'
 
@@ -22,6 +25,8 @@ export type TrackedEntry = {
 export type RosterGroup = {
   groupId: string
   identity: AgentJournalItemIdentity
+  /** The spawning turn's scope: the row reports its children beside that turn's work. */
+  turnScope: AgentJournalTurnScope
   /** Insertion order is the display order; the map holds the state. */
   entries: Map<string, TrackedEntry>
   /** Lifetime admissions bound retained labels even when entries are removed. */
diff --git a/src/main/claude/claude-subagent-roster.test.ts b/src/main/claude/claude-subagent-roster.test.ts
index da1f16d0a0e..0d5747d2f4f 100644
--- a/src/main/claude/claude-subagent-roster.test.ts
+++ b/src/main/claude/claude-subagent-roster.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../shared/agent-session-journal-types'
 import { describe, expect, it, vi } from 'vitest'
 import type {
   AgentJournalItemBody,
@@ -43,6 +44,7 @@ function harness(groupKey: string | null = TURN_1) {
   const roster = new ClaudeSubagentRoster({
     sink,
     currentGroupKey: () => key,
+    currentTurnScope: () => AGENT_JOURNAL_THREAD_SCOPE,
     now: () => (clock += 1)
   })
   const roles = (): NativeChatSubagentEntry[] => agentsOf(items.at(-1)?.body)
@@ -464,7 +466,11 @@ describe('ClaudeSubagentRoster — through the real sink queue', () => {
         published += 1
       }
     })
-    const roster = new ClaudeSubagentRoster({ sink: deferred.sink, currentGroupKey: () => TURN_1 })
+    const roster = new ClaudeSubagentRoster({
+      sink: deferred.sink,
+      currentGroupKey: () => TURN_1,
+      currentTurnScope: () => AGENT_JOURNAL_THREAD_SCOPE
+    })
 
     // The first append is in flight while the rest are submitted, so a publish
     // sharing the row's coalescing key would evict them.
diff --git a/src/main/claude/claude-subagent-roster.ts b/src/main/claude/claude-subagent-roster.ts
index d45a17e15e9..be6274ce054 100644
--- a/src/main/claude/claude-subagent-roster.ts
+++ b/src/main/claude/claude-subagent-roster.ts
@@ -11,6 +11,7 @@
 // child on every resume. Outcomes latch within an invocation; a new spawn
 // alias can reopen it, and authoritative evidence can correct lost contact.
 
+import type { AgentJournalTurnScope } from '../../shared/agent-session-journal-types'
 import {
   canReplaceSubagentState,
   isTerminalSubagentState
@@ -46,6 +47,8 @@ export type ClaudeSubagentRosterDeps = {
   sink: StructuredAgentSessionEventSink
   /** The turn that owns children spawned right now; null outside any turn. */
   currentGroupKey: () => string | null
+  /** That turn's scope, which the roster row it spawns belongs to. */
+  currentTurnScope: () => AgentJournalTurnScope
   /** Whether a tool id was forwarded at the TOP level. A child parented to one
    *  was spawned by a call the transcript shows, so its announcement is still
    *  expected; a child parented to anything else names an id that only ever
@@ -364,6 +367,7 @@ export class ClaudeSubagentRoster {
     const group: RosterGroup = {
       groupId,
       identity: claudeSubagentGroupIdentity(groupId),
+      turnScope: this.deps.currentTurnScope(),
       entries: new Map(),
       admittedEntries: 0,
       claimedLabels: new Set(),
diff --git a/src/main/claude/claude-supervised-stop-real-cli.test.ts b/src/main/claude/claude-supervised-stop-real-cli.test.ts
new file mode 100644
index 00000000000..82432e3fd6e
--- /dev/null
+++ b/src/main/claude/claude-supervised-stop-real-cli.test.ts
@@ -0,0 +1,244 @@
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { homedir, tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { randomUUID } from 'node:crypto'
+import { afterEach, describe, expect, it } from 'vitest'
+import { runProcess } from '../../shared/child-process/run-process'
+import { resolveSessionFilePath } from '../native-chat/session-file-resolver'
+import { SUPERVISED_GRACEFUL_EXIT_MS } from './claude-child-exit-proof-ladder'
+import {
+  openClaudeStreamJsonConnection,
+  type ClaudeStreamJsonConnection
+} from './claude-stream-json-connection'
+import {
+  CLAUDE_STRUCTURED_BASE_OPTIONS,
+  claudeStructuredPermissionOptions
+} from './claude-structured-launch-resolution'
+
+// Opt-in only: spends a real (haiku) turn per case. Run it in an isolated HOME with
+// ORCA_REAL_CLAUDE_BIN set, and ORCA_REAL_CLAUDE_SETTINGS when auth lives in a settings file.
+const CLAUDE_BIN = process.env.ORCA_REAL_CLAUDE_BIN ?? ''
+const enabled =
+  process.env.ORCA_REAL_CLAUDE_SUPERVISED_STOP === '1' &&
+  process.platform !== 'win32' &&
+  CLAUDE_BIN.length > 0
+const FRAMES_OUT = process.env.ORCA_REAL_CLAUDE_FRAMES_OUT
+const TOOL_MARKER = 'orca_supervised_stop_probe'
+const TOOL_PROMPT = `Use the Bash tool to run exactly this command, with no timeout argument, and nothing else: python3 -c "import time; time.sleep(120)  # ${TOOL_MARKER}"`
+
+type Frame = { at: number; message: Record<string, unknown> }
+type Row = { pid: number; ppid: number; command: string }
+
+const recordedPids = new Set<number>()
+const tempDirs: string[] = []
+const connections: ClaudeStreamJsonConnection[] = []
+
+function alive(pid: number): boolean {
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (error) {
+    return !(error instanceof Error && 'code' in error && error.code === 'ESRCH')
+  }
+}
+
+async function processTable(): Promise<Row[]> {
+  const result = await runProcess({ program: 'ps', args: ['-axo', 'pid=,ppid=,command='] })
+  return result.stdout.split('\n').flatMap((line) => {
+    const match = /^\s*(\d+)\s+(\d+)\s+(.*)$/.exec(line)
+    return match ? [{ pid: Number(match[1]), ppid: Number(match[2]), command: match[3] }] : []
+  })
+}
+
+async function descendantsOf(rootPid: number): Promise<Row[]> {
+  const rows = await processTable()
+  const found: Row[] = []
+  const frontier = [rootPid]
+  while (frontier.length > 0) {
+    const parent = frontier.pop()
+    for (const row of rows.filter((candidate) => candidate.ppid === parent)) {
+      found.push(row)
+      frontier.push(row.pid)
+    }
+  }
+  return found
+}
+
+async function until<T>(read: () => Promise<T | null> | T | null, what: string, ms = 90_000) {
+  const deadline = Date.now() + ms
+  for (;;) {
+    const value = await read()
+    if (value !== null) {
+      return value
+    }
+    if (Date.now() >= deadline) {
+      throw new Error(`timed out waiting for ${what}`)
+    }
+    await new Promise((resolve) => setTimeout(resolve, 250))
+  }
+}
+
+async function open(sessionId: string, cwd: string, resume: boolean, frames: Frame[]) {
+  const settings = process.env.ORCA_REAL_CLAUDE_SETTINGS
+  const permission = claudeStructuredPermissionOptions('bypassPermissions')
+  const connection = await openClaudeStreamJsonConnection(
+    {
+      pathToClaudeCodeExecutable: CLAUDE_BIN,
+      options: {
+        ...CLAUDE_STRUCTURED_BASE_OPTIONS,
+        model: 'haiku',
+        extraArgs: {
+          ...CLAUDE_STRUCTURED_BASE_OPTIONS.extraArgs,
+          ...permission.extraArgs,
+          ...(settings ? { settings } : {})
+        },
+        ...(resume ? { resume: sessionId } : { sessionId })
+      },
+      cwd
+    },
+    { onMessage: (message) => frames.push({ at: Date.now(), message }) }
+  )
+  connections.push(connection)
+  recordedPids.add(connection.pid!)
+  return connection
+}
+
+function userMessage(text: string): Record<string, unknown> {
+  return {
+    type: 'user',
+    message: { role: 'user', content: [{ type: 'text', text }] },
+    parent_tool_use_id: null,
+    session_id: ''
+  }
+}
+
+async function transcriptLines(sessionId: string): Promise<string> {
+  const configDir = process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), '.claude')
+  const path = await until(
+    () =>
+      resolveSessionFilePath('claude', sessionId, {
+        claudeProjectsDir: join(configDir, 'projects')
+      }),
+    'the transcript',
+    15_000
+  )
+  return readFileSync(path, 'utf8')
+}
+
+function expectLineAtomic(contents: string): void {
+  expect(contents.length).toBeGreaterThan(0)
+  expect(contents.endsWith('\n')).toBe(true)
+  for (const line of contents.split('\n').filter((entry) => entry.trim())) {
+    expect(() => JSON.parse(line)).not.toThrow()
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null
+}
+
+function summarize(frames: Frame[], since: number): string[] {
+  return frames
+    .filter((frame) => frame.at >= since)
+    .map(({ at, message }) => {
+      const inner = isRecord(message.message) ? message.message.content : undefined
+      const blocks = (Array.isArray(inner) ? inner : [])
+        .filter(isRecord)
+        .map((block) =>
+          block.type === 'tool_result'
+            ? `tool_result(is_error=${String(block.is_error)}:${JSON.stringify(block.content).slice(0, 80)})`
+            : String(block.type)
+        )
+      return `+${at - since}ms ${String(message.type)}/${String(message.subtype ?? '')}${
+        message.type === 'result' ? `(is_error=${String(message.is_error)})` : ''
+      } ${blocks.join(',')}`.trim()
+    })
+}
+
+async function resumeAndAsk(sessionId: string, cwd: string): Promise<void> {
+  const frames: Frame[] = []
+  const resumed = await open(sessionId, cwd, true, frames)
+  await resumed.send(userMessage('In one short line: what command did I ask you to run?'))
+  const result = await until(
+    () => frames.find((frame) => frame.message.type === 'result')?.message ?? null,
+    'the resumed turn result'
+  )
+  expect(result.subtype).toBe('success')
+  await expect(resumed.close()).resolves.toBe(true)
+}
+
+type StopCase = 'close mid-tool' | 'SIGTERM to the supervisor mid-tool' | 'close while idle'
+
+afterEach(async () => {
+  for (const pid of recordedPids) {
+    if (alive(pid)) {
+      process.kill(pid, 'SIGKILL')
+    }
+  }
+  recordedPids.clear()
+  connections.splice(0)
+  for (const dir of tempDirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+describe.runIf(enabled)('real Claude stopped through the POSIX supervisor', () => {
+  it.each<StopCase>(['close mid-tool', 'SIGTERM to the supervisor mid-tool', 'close while idle'])(
+    '%s: stops Claude and its tool, keeps the transcript line-atomic, and resumes',
+    async (stopCase) => {
+      const cwd = mkdtempSync(join(tmpdir(), 'orca-real-claude-stop-'))
+      tempDirs.push(cwd)
+      const sessionId = randomUUID()
+      const frames: Frame[] = []
+      const connection = await open(sessionId, cwd, false, frames)
+      const supervisor = connection.pid!
+      const midTool = stopCase !== 'close while idle'
+      await connection.send(userMessage(midTool ? TOOL_PROMPT : 'Reply with the single word: ok'))
+      const descendants = midTool
+        ? await until(async () => {
+            const rows = await descendantsOf(supervisor)
+            return rows.some((row) => row.command.includes(TOOL_MARKER)) ? rows : null
+          }, 'the Bash tool').catch((error: unknown) => {
+            console.log('[no tool] frames so far:', summarize(frames, 0))
+            throw error
+          })
+        : await until(
+            async () =>
+              frames.some((frame) => frame.message.type === 'result')
+                ? await descendantsOf(supervisor)
+                : null,
+            'the idle turn'
+          )
+      for (const row of descendants) {
+        recordedPids.add(row.pid)
+      }
+
+      const signalledAt = Date.now()
+      if (stopCase === 'SIGTERM to the supervisor mid-tool') {
+        process.kill(supervisor, 'SIGTERM')
+      } else {
+        await expect(connection.close()).resolves.toBe(true)
+      }
+      const gone = await until(
+        () => ([supervisor, ...descendants.map((row) => row.pid)].some(alive) ? null : true),
+        'the supervisor, Claude and its tools to exit',
+        SUPERVISED_GRACEFUL_EXIT_MS + 2_000
+      )
+      const stoppedMs = Date.now() - signalledAt
+      const after = summarize(frames, signalledAt)
+      console.log(`[${stopCase}] stopped in ${stoppedMs} ms; frames after the stop:`, after)
+      if (FRAMES_OUT) {
+        writeFileSync(
+          `${FRAMES_OUT}.${stopCase.replaceAll(' ', '-')}.json`,
+          JSON.stringify({ stoppedMs, after }, null, 2)
+        )
+      }
+      expect(gone).toBe(true)
+
+      expectLineAtomic(await transcriptLines(sessionId))
+      await resumeAndAsk(sessionId, cwd)
+      expectLineAtomic(await transcriptLines(sessionId))
+    },
+    180_000
+  )
+})
diff --git a/src/main/claude/claude-supervised-stop.integration.test.ts b/src/main/claude/claude-supervised-stop.integration.test.ts
new file mode 100644
index 00000000000..d0a5f9ea0cc
--- /dev/null
+++ b/src/main/claude/claude-supervised-stop.integration.test.ts
@@ -0,0 +1,225 @@
+import { spawn, type ChildProcess } from 'node:child_process'
+import { existsSync, mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import type { SpawnOptions as SdkSpawnOptions } from '@anthropic-ai/claude-agent-sdk'
+import { spawnProcess } from '../../shared/child-process/run-process'
+import type { ProcessSpec } from '../../shared/child-process/process-spec'
+import {
+  PROVIDER_SIGTERM_GRACE_MS,
+  PROVIDER_STDIN_END_GRACE_MS,
+  PROVIDER_SUPERVISOR_MAX_STOP_MS
+} from '../codex/codex-app-server-posix-supervisor'
+import { proveClaudeChildExit } from './claude-agent-sdk-exit-proof'
+import { createClaudeCodeProcessSpawn } from './claude-agent-sdk-process-spawn'
+
+// Stands in for Claude mid-turn: stdin end does not stop it, the way EOF lets the real CLI finish
+// its turn. Its tool leads its own group, as the CLI's Bash tool shells do, and only Claude's own
+// SIGTERM handler reaps it. The daemon double-forks out of the tree before anything looks.
+const FAKE_CLAUDE = String.raw`
+  const { spawn } = require('node:child_process')
+  const { writeFileSync } = require('node:fs')
+  process.stdin.resume()
+  process.stdout.on('error', () => {})
+  const tool = spawn(process.execPath, ['-e', 'setInterval(() => {}, 60000)'], {
+    detached: true,
+    stdio: 'ignore'
+  })
+  const forker = spawn(
+    process.execPath,
+    ['-e', "const d = require('node:child_process').spawn(process.execPath, ['-e', 'setInterval(() => {}, 60000)'], { detached: true, stdio: 'ignore' }); d.unref(); process.stdout.write(String(d.pid))"],
+    { stdio: ['ignore', 'pipe', 'ignore'] }
+  )
+  let daemon = ''
+  forker.stdout.on('data', (chunk) => { daemon += chunk })
+  forker.once('exit', () => {
+    process.stdout.write(JSON.stringify({ claude: process.pid, tool: tool.pid, daemon: Number(daemon) }) + '\n')
+  })
+  process.on('SIGTERM', () => {
+    if (process.env.ORCA_TEST_CLAUDE_IGNORES_SIGTERM) return
+    try { process.kill(-tool.pid, 'SIGKILL') } catch {}
+    writeFileSync(process.env.ORCA_TEST_SIGTERM_MARKER, 'reaped')
+    process.exit(143)
+  })
+  setInterval(() => {}, 60000)
+`
+
+// Stands in for Orca's main: starts exactly the spec Claude's spawner built, then can be SIGKILLed.
+const OWNER = String.raw`
+  const { spawn } = require('node:child_process')
+  const spec = JSON.parse(process.env.ORCA_TEST_SPAWN_SPEC)
+  const env = { ...spec.env }
+  if (env.ORCA_PROVIDER_SUPERVISOR_SPEC) {
+    const supervisor = JSON.parse(Buffer.from(env.ORCA_PROVIDER_SUPERVISOR_SPEC, 'base64').toString())
+    supervisor.ownerPid = process.pid
+    env.ORCA_PROVIDER_SUPERVISOR_SPEC = Buffer.from(JSON.stringify(supervisor)).toString('base64')
+  }
+  const child = spawn(spec.program, spec.args, {
+    cwd: spec.cwd,
+    env,
+    detached: spec.detached,
+    stdio: ['pipe', 'pipe', 'ignore']
+  })
+  process.stdout.write(JSON.stringify({ root: child.pid }) + '\n')
+  child.stdout.pipe(process.stdout)
+  setInterval(() => {}, 60000)
+`
+
+const recordedPids = new Set<number>()
+const tempDirs: string[] = []
+
+function alive(pid: number): boolean {
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (error) {
+    return !(error instanceof Error && 'code' in error && error.code === 'ESRCH')
+  }
+}
+
+async function waitFor(predicate: () => boolean, timeoutMs: number): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs
+  while (!predicate()) {
+    if (Date.now() >= deadline) {
+      return false
+    }
+    await new Promise((resolve) => setTimeout(resolve, 25))
+  }
+  return true
+}
+
+function readPids(child: ChildProcess, keys: readonly string[]): Promise<Record<string, number>> {
+  return new Promise((resolve, reject) => {
+    const pids: Record<string, number> = {}
+    let buffered = ''
+    const timeout = setTimeout(() => reject(new Error(`no ${keys.join('/')} pids`)), 10_000)
+    const onData = (chunk: Buffer): void => {
+      buffered += chunk.toString()
+      const lines = buffered.split('\n')
+      buffered = lines.pop() ?? ''
+      for (const line of lines) {
+        const parsed: unknown = JSON.parse(line)
+        for (const [key, pid] of Object.entries(parsed ?? {})) {
+          if (typeof pid === 'number' && pid > 0) {
+            pids[key] = pid
+            recordedPids.add(pid)
+          }
+        }
+      }
+      if (keys.every((key) => key in pids)) {
+        clearTimeout(timeout)
+        child.stdout!.off('data', onData)
+        child.stdout!.resume()
+        resolve(pids)
+      }
+    }
+    child.stdout!.on('data', onData)
+  })
+}
+
+function sdkOptions(env: Record<string, string>): SdkSpawnOptions {
+  const dir = mkdtempSync(join(tmpdir(), 'orca-claude-supervised-'))
+  tempDirs.push(dir)
+  return {
+    command: process.execPath,
+    args: ['-e', FAKE_CLAUDE],
+    cwd: dir,
+    env: {
+      ...process.env,
+      ORCA_TEST_SIGTERM_MARKER: join(dir, 'sigterm-reap'),
+      ...env
+    },
+    signal: new AbortController().signal
+  }
+}
+
+/** Claude spawned through Orca's own spawner and stopped by Orca's own close ladder. */
+async function spawnClaude(env: Record<string, string> = {}) {
+  const spawner = createClaudeCodeProcessSpawn(spawnProcess)
+  const options = sdkOptions(env)
+  const child = spawner.spawn(options)
+  recordedPids.add(child.pid!)
+  let exited = false
+  const exit = new Promise<{ code: number | null; signal: NodeJS.Signals | null }>((resolve) =>
+    child.once('exit', (code, signal) => {
+      exited = true
+      resolve({ code, signal })
+    })
+  )
+  const pids = await readPids(child, ['claude', 'tool', 'daemon'])
+  const close = (): Promise<boolean> =>
+    proveClaudeChildExit({
+      child,
+      exitPromise: exit.then(() => undefined),
+      exited: () => exited,
+      supervised: spawner.supervised
+    })
+  return { child, exit, pids, close, marker: String(options.env.ORCA_TEST_SIGTERM_MARKER) }
+}
+
+afterEach(() => {
+  for (const pid of recordedPids) {
+    if (alive(pid)) {
+      process.kill(pid, 'SIGKILL')
+    }
+  }
+  recordedPids.clear()
+  for (const dir of tempDirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+describe.runIf(process.platform !== 'win32')('Claude under the POSIX provider supervisor', () => {
+  it('stops a mid-turn Claude on close instead of letting stdin end finish its turn', async () => {
+    const { child, exit, pids, close, marker } = await spawnClaude()
+    expect(child.pid).not.toBe(pids.claude)
+
+    const startedAt = Date.now()
+    await expect(close()).resolves.toBe(true)
+
+    // Claude's own SIGTERM reap ran at once, not after the supervisor's stdin-end grace.
+    expect(Date.now() - startedAt).toBeLessThan(PROVIDER_STDIN_END_GRACE_MS)
+    expect(existsSync(marker)).toBe(true)
+    await expect(exit).resolves.toEqual({ code: null, signal: 'SIGTERM' })
+    expect(alive(pids.claude)).toBe(false)
+    expect(alive(pids.tool)).toBe(false)
+  })
+
+  it('lets the supervisor escalate a Claude that ignores SIGTERM, and exits only after it', async () => {
+    const { exit, pids, close } = await spawnClaude({ ORCA_TEST_CLAUDE_IGNORES_SIGTERM: '1' })
+
+    const startedAt = Date.now()
+    await expect(close()).resolves.toBe(true)
+
+    const elapsed = Date.now() - startedAt
+    expect(elapsed).toBeGreaterThanOrEqual(PROVIDER_SIGTERM_GRACE_MS)
+    expect(elapsed).toBeLessThan(PROVIDER_SUPERVISOR_MAX_STOP_MS + 1_000)
+    // The supervisor's own SIGTERM stop finished the job; nothing forced the supervisor itself.
+    await expect(exit).resolves.toEqual({ code: null, signal: 'SIGTERM' })
+    expect(alive(pids.claude)).toBe(false)
+  })
+
+  it("stops Claude and its tool when Orca's main dies, and leaves a daemon that left its tree alone", async () => {
+    const specs: ProcessSpec[] = []
+    createClaudeCodeProcessSpawn((spec) => {
+      specs.push(spec)
+      return spawnProcess({ program: 'true' })
+    }).spawn(sdkOptions({}))
+    const owner = spawn(process.execPath, ['-e', OWNER], {
+      env: { ...process.env, ORCA_TEST_SPAWN_SPEC: JSON.stringify(specs[0]) },
+      stdio: ['ignore', 'pipe', 'ignore']
+    })
+    recordedPids.add(owner.pid!)
+    const pids = await readPids(owner, ['root', 'claude', 'tool', 'daemon'])
+
+    owner.kill('SIGKILL')
+
+    expect(await waitFor(() => !alive(pids.claude), PROVIDER_SUPERVISOR_MAX_STOP_MS)).toBe(true)
+    expect(await waitFor(() => !alive(pids.root), PROVIDER_SUPERVISOR_MAX_STOP_MS)).toBe(true)
+    // In its own group, so only Claude's SIGTERM handler could have reaped it.
+    expect(alive(pids.tool)).toBe(false)
+    // Not the conversation's writer: nothing proves it orphaned, so the stop never reaches it.
+    expect(alive(pids.daemon)).toBe(true)
+  })
+})
diff --git a/src/main/claude/claude-turn-lifecycle-item.ts b/src/main/claude/claude-turn-lifecycle-item.ts
index 2a31b49afdb..be7150531fe 100644
--- a/src/main/claude/claude-turn-lifecycle-item.ts
+++ b/src/main/claude/claude-turn-lifecycle-item.ts
@@ -7,6 +7,7 @@ import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key
 import { agentJournalTurnBody } from '../../shared/agent-session-turn-record'
 import type { StructuredAgentSessionAppendOptions } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
 import { claudeResultOutcome } from './claude-result-outcome'
+import type { ClaudeCommandTurn } from './claude-command-turn'
 
 export type ClaudeCurrentTurn = {
   sessionId: string
@@ -18,6 +19,13 @@ export type ClaudeCurrentTurn = {
   /** Provider key of the user echo, or the lifecycle row itself when provider
    *  output opened a turn with no user row to receive its timing. */
   userItemId: string
+  /** Present when the turn is the host's record of a conversation command. */
+  command?: ClaudeCommandTurn
+}
+
+/** The row a turn's lifecycle lives on: the host's record for a command, else the lane's own. */
+export function claudeCurrentTurnIdentity(turn: ClaudeCurrentTurn): AgentJournalItemIdentity {
+  return turn.command?.identity ?? claudeTurnLifecycleIdentity(turn.sessionId, turn.turnId)
 }
 
 export type ClaudeTurnEnd = {
@@ -84,7 +92,7 @@ export function claudeTurnLifecycleItem(
   // already carried, because both are built from the same open turn.
   const requested = requestedAt === undefined ? {} : { requestedAt }
   return {
-    identity: claudeTurnLifecycleIdentity(sessionId, turnId),
+    identity: claudeCurrentTurnIdentity(turn),
     body: agentJournalTurnBody(
       end
         ? {
diff --git a/src/main/claude/claude-turn-ownership.test.ts b/src/main/claude/claude-turn-ownership.test.ts
index 338a6937716..c1915d9bf94 100644
--- a/src/main/claude/claude-turn-ownership.test.ts
+++ b/src/main/claude/claude-turn-ownership.test.ts
@@ -6,7 +6,6 @@ import type { AgentJournalItemBody } from '../../shared/agent-session-journal-ty
 import { readAgentJournalTurn } from '../../shared/agent-session-turn-record'
 import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
 import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
-import { StructuredSessionCompaction } from '../native-chat/agent-session-wire/structured-session-compaction'
 import {
   CLAUDE_DISPATCH_ADMISSION_TIMEOUT_MS,
   cancelClaudeStructuredTurn
@@ -96,8 +95,13 @@ function sessionHoldingTurn(turnId: string | null): ReturnType<typeof sessionFor
   session.dispatchSequence = 1
   session.translator = {
     handle: vi.fn(),
+    openTurnInLiveProviderCycle: false,
     journalPrompts: { cancel: vi.fn(), resolve: vi.fn() },
     currentTurnId: turnId,
+    commandTurnId: null,
+    beginCommand: vi.fn(),
+    forgetCommand: vi.fn(),
+    commandInterruptRequested: vi.fn(),
     flush: vi.fn(),
     contextActivity: 0,
     markContextActivity: vi.fn(),
@@ -118,7 +122,6 @@ function cancellationOf(
   return cancelClaudeStructuredTurn({
     request,
     sessions: new Map([['session-1', session]]),
-    compactions: new StructuredSessionCompaction(),
     admitPromptCancellation: () => true
   })
 }
@@ -277,8 +280,13 @@ describe('Claude turn ownership', () => {
       session.dispatchSequence = 1
       session.translator = {
         handle: vi.fn(),
+        openTurnInLiveProviderCycle: false,
         journalPrompts: { cancel: vi.fn(), resolve: vi.fn() },
         currentTurnId: 'turn-1',
+        commandTurnId: null,
+        beginCommand: vi.fn(),
+        forgetCommand: vi.fn(),
+        commandInterruptRequested: vi.fn(),
         flush: vi.fn(),
         contextActivity: 0,
         markContextActivity: vi.fn(),
@@ -306,7 +314,6 @@ describe('Claude turn ownership', () => {
       const cancellation = cancelClaudeStructuredTurn({
         request: { sessionId: 'session-1', turnId: 'turn-1', fence: 1 },
         sessions: new Map([['session-1', session]]),
-        compactions: new StructuredSessionCompaction(),
         admitPromptCancellation: () => true
       })
       await vi.advanceTimersByTimeAsync(100)
diff --git a/src/main/claude/claude-turn-row-revision.ts b/src/main/claude/claude-turn-row-revision.ts
index 1bee6bd0162..1b684ba89aa 100644
--- a/src/main/claude/claude-turn-row-revision.ts
+++ b/src/main/claude/claude-turn-row-revision.ts
@@ -14,9 +14,10 @@ import {
   agentJournalItemKey,
   parseAgentJournalItemKey
 } from '../../shared/agent-session-journal-item-key'
-import type {
-  AgentJournalItemIdentity,
-  AgentJournalTurnItem
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalItemIdentity,
+  type AgentJournalTurnItem
 } from '../../shared/agent-session-journal-types'
 import { readAgentJournalTurn } from '../../shared/agent-session-turn-record'
 import { estimateStructuredAgentSessionItemBytes } from '../native-chat/agent-session-wire/structured-agent-session-event-sink-estimate'
@@ -149,7 +150,7 @@ function findTurnRow(
 export type ClaudeTurnRowDelivery = {
   /** False only for a writer that publishes each write itself right after queueing it. */
   publish: boolean
-  options?: StructuredAgentSessionRevisionOptions
+  options?: Omit<StructuredAgentSessionRevisionOptions, 'turnScope'>
 }
 
 /**
@@ -161,8 +162,10 @@ export function writeClaudeTurnRow(
   sink: StructuredAgentSessionEventSink,
   target: ClaudeTurnRowTarget,
   write: ClaudeTurnRowWrite,
-  { publish, options = {} }: ClaudeTurnRowDelivery
+  { publish, options: delivery = {} }: ClaudeTurnRowDelivery
 ): void {
+  // A turn record belongs to no turn.
+  const options = { ...delivery, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   const revise = publish ? sink.tryReviseResolvedItemAndPublish : sink.tryReviseResolvedItem
   if (!revise) {
     if (write.lifecycle && 'identity' in target) {
diff --git a/src/main/claude/compact-status-registration.test.ts b/src/main/claude/compact-status-registration.test.ts
index 2c54cc8db62..225a52423c3 100644
--- a/src/main/claude/compact-status-registration.test.ts
+++ b/src/main/claude/compact-status-registration.test.ts
@@ -12,7 +12,9 @@ import {
 import { seedClaudeSubagentRosterFromSnapshots } from '../../shared/agent-hook-listener/providers/claude-roster-state'
 import type { AgentHookEventPayload } from '../../shared/agent-hook-listener/listener-event'
 import { makePaneKey } from '../../shared/stable-pane-id'
-import { applyManagedHooks, CLAUDE_EVENTS } from './hook-settings'
+import { CLAUDE_HOOK_EVENT_FIRST_VERSIONS } from './claude-hook-event-versions'
+import { CLAUDE_EVENTS, getClaudeManagedHookPlan } from './claude-managed-hook-events'
+import { applyManagedHooks } from './hook-settings'
 
 const PANE_KEY = makePaneKey('compact-registration', '11111111-1111-4111-8111-111111111111')
 const TURN_PROMPT_ID = '22222222-2222-4222-8222-222222222222'
@@ -108,7 +110,8 @@ describe('Claude compact hook registration', () => {
     const written = applyManagedHooks(
       { hooks: {} },
       { type: 'command', command: 'orca-claude-hook' },
-      'claude-hook.sh'
+      'claude-hook.sh',
+      getClaudeManagedHookPlan(CLAUDE_HOOK_EVENT_FIRST_VERSIONS.PostCompact)
     )
     const postCompact = written.hooks?.PostCompact ?? []
     expect(
diff --git a/src/main/claude/hook-script.ts b/src/main/claude/hook-script.ts
index efbe71fc9e3..e02fe374701 100644
--- a/src/main/claude/hook-script.ts
+++ b/src/main/claude/hook-script.ts
@@ -1,6 +1,7 @@
 /** The managed Claude-compatible hook script, built for local, POSIX-remote and Windows targets.
  *  Split from hook-service.ts so the service owns install/status and this owns script text,
  *  mirroring the same split under src/main/cursor/. */
+import type { AgentHookSource } from '../../shared/agent-hook-relay'
 import { buildWindowsAgentHookCurlPostCommand } from '../agent-hooks/installer-utils'
 import { buildPosixAgentHookPostCommand } from '../agent-hooks/hook-post-command'
 import {
@@ -18,10 +19,12 @@ import {
 export function getManagedScript(
   target: 'local' | 'posix' = 'local',
   options: {
+    source?: AgentHookSource
     skipWhenDevinImportsClaude?: boolean
     skipWhenGrokImportsClaude?: boolean
   } = {}
 ): string {
+  const source = options.source ?? 'claude'
   if (target === 'local' && process.platform === 'win32') {
     return [
       '@echo off',
@@ -46,7 +49,7 @@ export function getManagedScript(
           ]
         : []),
       // Why: use curl.exe to avoid an extra PowerShell startup per hook.
-      buildWindowsAgentHookCurlPostCommand('claude'),
+      buildWindowsAgentHookCurlPostCommand(source),
       'exit /b 0',
       ...buildWindowsHookStdinDrainEpilogue(),
       ''
@@ -59,7 +62,7 @@ export function getManagedScript(
     'printf "{}\\n"',
     ...buildPosixHookPayloadCapture(),
     ...(options.skipWhenGrokImportsClaude ? buildPosixGrokReplayGuardLines() : []),
-    ...buildPosixHookSpoolLines('claude'),
+    ...buildPosixHookSpoolLines(source),
     ...(options.skipWhenDevinImportsClaude
       ? [
           // Why: Devin imports .claude hooks by default; skip Orca's managed hook there so status posts stay attributed to Devin.
@@ -84,7 +87,7 @@ export function getManagedScript(
     '  exit 0',
     'fi',
     // Why: keep full hook JSON off the command line and avoid IDS-friendly URL-encoded paths.
-    ...buildPosixAgentHookPostCommand('claude').map((line, index, lines) =>
+    ...buildPosixAgentHookPostCommand(source).map((line, index, lines) =>
       index === lines.length - 1 ? `${line} >/dev/null 2>&1 || spool_hook_event` : line
     ),
     'exit 0',
diff --git a/src/main/claude/hook-service.test.ts b/src/main/claude/hook-service.test.ts
index 2a07aff4c8a..c9191d42dbd 100644
--- a/src/main/claude/hook-service.test.ts
+++ b/src/main/claude/hook-service.test.ts
@@ -27,11 +27,8 @@ import type { SFTPWrapper } from 'ssh2'
 import { createManagedCommandMatcher, WINDOWS_CMD_SAFE_PATH } from '../agent-hooks/installer-utils'
 import { WINDOWS_HOOK_STDIN_DRAIN_LABEL } from '../agent-hooks/hook-stdin-contract'
 import { ClaudeHookService } from './hook-service'
-import {
-  CLAUDE_EVENTS,
-  getWindowsManagedLifecycleHook,
-  OPENCLAUDE_HOOK_SETTINGS
-} from './hook-settings'
+import { CLAUDE_EVENTS } from './claude-managed-hook-events'
+import { getWindowsManagedLifecycleHook, OPENCLAUDE_HOOK_SETTINGS } from './hook-settings'
 
 const CLAUDE_SCRIPT_FILE_NAME = process.platform === 'win32' ? 'claude-hook.cmd' : 'claude-hook.sh'
 const STATUSLINE_SCRIPT_FILE_NAME =
@@ -43,6 +40,9 @@ const isOpenClaudeManagedCommand = createManagedCommandMatcher(OPENCLAUDE_SCRIPT
 
 type TestHook = { command: string; args?: string[] }
 
+// Why: the managed event set follows the resolved Claude; this one knows every event Orca writes.
+const CURRENT_CLAUDE = { claudeVersion: '2.1.261 (Claude Code)' }
+
 function hasManagedCommand(hook: TestHook, matcher: (command: string | undefined) => boolean) {
   return matcher(hook.command) || hook.args?.some(matcher) === true
 }
@@ -217,7 +217,7 @@ describe('ClaudeHookService.install', () => {
         })
       )
 
-      const status = new ClaudeHookService().install()
+      const status = new ClaudeHookService().install(CURRENT_CLAUDE)
       expect(status.state).toBe('installed')
 
       const legacy = JSON.parse(readFileSync(legacyPath, 'utf-8'))
@@ -275,6 +275,48 @@ describe('ClaudeHookService.install', () => {
     }
   })
 
+  it('writes only the events an old resolved Claude knows and reports that as installed', () => {
+    const tmpHome = mkdtempSync(join(tmpdir(), 'orca-claude-old-version-'))
+    vi.stubEnv('HOME', tmpHome)
+    vi.stubEnv('USERPROFILE', tmpHome)
+    try {
+      const service = new ClaudeHookService()
+      expect(service.install({ claudeVersion: '2.1.32' }).state).toBe('installed')
+
+      const settings = JSON.parse(readFileSync(join(tmpHome, '.claude', 'settings.json'), 'utf-8'))
+      for (const event of ['StopFailure', 'PostCompact', 'TeammateIdle', 'SessionEnd']) {
+        expect(settings.hooks[event], event).toBeUndefined()
+      }
+      expect(settings.hooks.SubagentStart).toBeDefined()
+      // Why: a reader without the version still sees a complete install of the universal set.
+      expect(service.getStatus().state).toBe('installed')
+    } finally {
+      vi.unstubAllEnvs()
+      rmSync(tmpHome, { recursive: true, force: true })
+    }
+  })
+
+  it('keeps newer Orca events and reports installed when a later probe cannot resolve the version', () => {
+    const tmpHome = mkdtempSync(join(tmpdir(), 'orca-claude-unknown-version-'))
+    vi.stubEnv('HOME', tmpHome)
+    vi.stubEnv('USERPROFILE', tmpHome)
+    try {
+      const service = new ClaudeHookService()
+      const settingsPath = join(tmpHome, '.claude', 'settings.json')
+      expect(service.install(CURRENT_CLAUDE).state).toBe('installed')
+      const known = JSON.parse(readFileSync(settingsPath, 'utf-8'))
+
+      expect(service.install().state).toBe('installed')
+
+      const unknown = JSON.parse(readFileSync(settingsPath, 'utf-8'))
+      expect(unknown.hooks).toEqual(known.hooks)
+      expect(service.getStatus().state).toBe('installed')
+    } finally {
+      vi.unstubAllEnvs()
+      rmSync(tmpHome, { recursive: true, force: true })
+    }
+  })
+
   it('installs the managed statusLine command and forwards rate_limits posts', () => {
     const tmpHome = mkdtempSync(join(tmpdir(), 'orca-claude-statusline-'))
     vi.stubEnv('HOME', tmpHome)
@@ -458,7 +500,7 @@ describe('ClaudeHookService.install', () => {
         return
       }
       try {
-        expect(new ClaudeHookService().install().state).toBe('installed')
+        expect(new ClaudeHookService().install(CURRENT_CLAUDE).state).toBe('installed')
 
         const settings = JSON.parse(
           readFileSync(join(tmpHome, '.claude', 'settings.json'), 'utf-8')
@@ -472,7 +514,7 @@ describe('ClaudeHookService.install', () => {
         }
         // Why: the whole point of #18875 — no interpreter is started to reach the script.
         expect(JSON.stringify(settings.hooks)).not.toMatch(/powershell|EncodedCommand/i)
-        expect(new ClaudeHookService().getStatus().state).toBe('installed')
+        expect(new ClaudeHookService().getStatus(CURRENT_CLAUDE).state).toBe('installed')
       } finally {
         vi.unstubAllEnvs()
         rmSync(tmpHome, { recursive: true, force: true })
@@ -681,7 +723,7 @@ describe('ClaudeHookService.installRemote', () => {
   it('writes Claude settings + managed script under the remote $HOME', async () => {
     const svc = new ClaudeHookService()
     const { sftp, fs } = createFakeSftp()
-    const status = await svc.installRemote(sftp, '/home/dev')
+    const status = await svc.installRemote(sftp, '/home/dev', CURRENT_CLAUDE)
     expect(status.state).toBe('installed')
     expect(status.configPath).toBe('/home/dev/.claude/settings.json')
     const settings = fs.files.get('/home/dev/.claude/settings.json')
@@ -732,6 +774,25 @@ describe('ClaudeHookService.installRemote', () => {
     expect(fs.files.get('/home/dev/.orca/agent-hooks/claude-statusline.sh')).toBeUndefined()
   })
 
+  it('writes only the events the remote Claude knows, adding newer ones once it upgrades', async () => {
+    const svc = new ClaudeHookService()
+    const { sftp, fs } = createFakeSftp()
+    const settingsPath = '/home/dev/.claude/settings.json'
+    const userStop = { hooks: [{ type: 'command', command: '/usr/local/bin/my-user-hook' }] }
+    fs.files.set(settingsPath, JSON.stringify({ env: { A: '1' }, hooks: { Stop: [userStop] } }))
+
+    await svc.installRemote(sftp, '/home/dev', { claudeVersion: '2.1.77' })
+    const old = JSON.parse(fs.files.get(settingsPath)!)
+    expect(old.hooks.StopFailure).toBeUndefined()
+    expect(old.hooks.PostCompact).toBeDefined()
+
+    await svc.installRemote(sftp, '/home/dev', { claudeVersion: '2.1.78' })
+    const upgraded = JSON.parse(fs.files.get(settingsPath)!)
+    expect(upgraded.hooks.StopFailure[0].hooks[0].command).toContain('claude-hook.sh')
+    expect(upgraded.hooks.Stop[0]).toEqual(userStop)
+    expect(upgraded.env).toEqual({ A: '1' })
+  })
+
   it('reports parse error when remote settings.json cannot be parsed', async () => {
     const svc = new ClaudeHookService()
     const { sftp, fs } = createFakeSftp()
diff --git a/src/main/claude/hook-service.ts b/src/main/claude/hook-service.ts
index 73e7add40dc..bc27b56075e 100644
--- a/src/main/claude/hook-service.ts
+++ b/src/main/claude/hook-service.ts
@@ -1,4 +1,5 @@
 import { existsSync, rmSync, writeFileSync } from 'node:fs'
+import type { AgentHookSource } from '../../shared/agent-hook-relay'
 import type { SFTPWrapper } from 'ssh2'
 import type { AgentHookInstallState, AgentHookInstallStatus } from '../../shared/agent-hook-types'
 import {
@@ -21,7 +22,6 @@ import { getManagedStatusLineScript } from './statusline-script'
 import {
   applyManagedHooks,
   applyManagedStatusLine,
-  CLAUDE_EVENTS,
   CLAUDE_HOOK_SETTINGS,
   getManagedScriptFileName,
   getConfigPath,
@@ -40,11 +40,19 @@ import {
   removeManagedStatusLine,
   type ClaudeCompatibleHookSettings
 } from './hook-settings'
+import {
+  getClaudeManagedHookPlan,
+  OPENCLAUDE_MANAGED_HOOK_PLAN,
+  type ClaudeManagedHookPlan
+} from './claude-managed-hook-events'
 
 type ClaudeHookServiceOptions = {
   agent: AgentHookInstallStatus['agent']
   displayName: string
   settings: ClaudeCompatibleHookSettings
+  source?: AgentHookSource
+  /** A Claude-compatible CLI with its own settings file writes a fixed plan, not Claude's version table. */
+  hookPlan?: ClaudeManagedHookPlan
 }
 
 type ClaudeHookInstallOptions = {
@@ -64,7 +72,15 @@ export class ClaudeHookService {
     this.options = options
   }
 
-  getStatus(): AgentHookInstallStatus {
+  // Why: Claude's settings loader rejects events newer than the running CLI, so its plan follows the
+  // resolved version; OpenClaude and Qoder read their own settings files.
+  private managedHookPlan(options: ClaudeHookInstallOptions): ClaudeManagedHookPlan {
+    return this.options.agent === 'claude'
+      ? getClaudeManagedHookPlan(options.claudeVersion)
+      : (this.options.hookPlan ?? OPENCLAUDE_MANAGED_HOOK_PLAN)
+  }
+
+  getStatus(options: ClaudeHookInstallOptions = {}): AgentHookInstallStatus {
     const configPath = getConfigPath(this.options.settings)
     const scriptPath = getManagedScriptPath(this.options.settings)
     const config = readHooksJson(configPath)
@@ -82,7 +98,7 @@ export class ClaudeHookService {
     const expectedHook = getManagedLifecycleHook(scriptPath, this.options.settings)
     const missing: string[] = []
     let presentCount = 0
-    for (const event of CLAUDE_EVENTS) {
+    for (const event of this.managedHookPlan(options).install) {
       const definitions = Array.isArray(config.hooks?.[event.eventName])
         ? config.hooks![event.eventName]!
         : []
@@ -115,6 +131,7 @@ export class ClaudeHookService {
     await refreshManagedScriptIfPresent(
       getManagedScriptPath(this.options.settings),
       getManagedScript('local', {
+        source: this.options.source,
         skipWhenDevinImportsClaude: this.options.agent === 'claude',
         skipWhenGrokImportsClaude: this.options.agent === 'claude'
       })
@@ -141,25 +158,28 @@ export class ClaudeHookService {
     }
 
     const hook = getManagedLifecycleHook(scriptPath, this.options.settings)
+    const plan = this.managedHookPlan(options)
     let nextConfig = applyManagedHooks(
       config,
       hook,
       getManagedScriptFileName(this.options.settings),
-      this.options.agent === 'claude' ? options : undefined
+      plan
     )
     writeManagedScript(
       scriptPath,
       getManagedScript('local', {
+        source: this.options.source,
         skipWhenDevinImportsClaude: this.options.agent === 'claude',
         skipWhenGrokImportsClaude: this.options.agent === 'claude'
       })
     )
-    // Why: the statusline usage feed is Claude-only — OpenClaude data would be misattributed to the Claude provider.
-    if (this.options.agent === 'claude') {
+    if (plan.statusLine === 'install') {
       nextConfig = this.installManagedStatusLine(nextConfig)
+    } else if (plan.statusLine === 'retire') {
+      nextConfig = this.retireManagedStatusLine(nextConfig)
     }
     writeHooksJson(configPath, nextConfig)
-    return this.getStatus()
+    return this.getStatus(options)
   }
 
   // Why: the statusline feed is opportunistic (usage display, not agent status); a user who deleted the
@@ -186,6 +206,23 @@ export class ClaudeHookService {
     return next
   }
 
+  // Why: a Claude that predates statusLine discards the whole settings file over Orca's; dropping the
+  // marker with it keeps an upgrade from reading the removal as the user's opt-out.
+  private retireManagedStatusLine(config: HooksConfig): HooksConfig {
+    const { config: next, changed } = removeManagedStatusLine(
+      config,
+      getStatusLineScriptFileName(this.options.settings)
+    )
+    if (changed) {
+      try {
+        rmSync(getStatusLineInstallMarkerPath(this.options.settings), { force: true })
+      } catch {
+        // Best-effort: a stale marker only means one upgrade skips re-adding the statusline.
+      }
+    }
+    return next
+  }
+
   // Why: install the Claude hook on the remote box (via SFTP); POSIX-only by design (Windows-remote deferred).
   async installRemote(
     sftp: SFTPWrapper,
@@ -215,7 +252,7 @@ export class ClaudeHookService {
         config,
         hook,
         remoteScriptFileName,
-        this.options.agent === 'claude' ? options : undefined
+        this.managedHookPlan(options)
       )
 
       // Why: write scripts before settings to avoid settings pointing to missing scripts.
@@ -224,6 +261,7 @@ export class ClaudeHookService {
         sftp,
         remoteScriptPath,
         getManagedScript('posix', {
+          source: this.options.source,
           skipWhenDevinImportsClaude: this.options.agent === 'claude',
           skipWhenGrokImportsClaude: this.options.agent === 'claude'
         })
diff --git a/src/main/claude/hook-settings.ts b/src/main/claude/hook-settings.ts
index 92ffa9606a2..381e4d26b6f 100644
--- a/src/main/claude/hook-settings.ts
+++ b/src/main/claude/hook-settings.ts
@@ -6,22 +6,23 @@ import {
   getSharedManagedScriptPath,
   isPlainObject,
   MANAGED_HOOK_TIMEOUT_SECONDS,
-  quotePowerShellString,
   removeManagedCommands,
   wrapWindowsPowerShellEncodedCommand,
   type HookCommandConfig,
   type HookDefinition,
   type HooksConfig
 } from '../agent-hooks/installer-utils'
+import { quotePowerShellLiteral } from '../../shared/powershell-native-argument'
 import { wrapRuntimeHomeHookCommand } from '../agent-hooks/runtime-home-hook-command'
 import { wrapWindowsDirectCmdHookCommand } from '../agent-hooks/windows-direct-cmd-hook-command'
 import { isGitBashAvailable } from '../git-bash'
-import { claudeVersionSupportsSessionEnd } from './claude-session-end-hook-capability'
+import type { ClaudeManagedHookPlan } from './claude-managed-hook-events'
 
 export type ClaudeCompatibleHookSettings = {
-  configDirName: '.claude' | '.openclaude'
-  scriptBaseName: 'claude-hook' | 'openclaude-hook'
+  configDirName: '.claude' | '.openclaude' | '.qoder' | '.codebuddy'
+  scriptBaseName: 'claude-hook' | 'openclaude-hook' | 'qoder-hook' | 'codebuddy-hook'
   usesWindowsCompatLauncher: boolean
+  windowsHookShell?: 'powershell'
 }
 
 export const CLAUDE_HOOK_SETTINGS: ClaudeCompatibleHookSettings = {
@@ -36,81 +37,6 @@ export const OPENCLAUDE_HOOK_SETTINGS: ClaudeCompatibleHookSettings = {
   usesWindowsCompatLauncher: false
 }
 
-export const CLAUDE_EVENTS = [
-  // Why: SessionStart is the only event a resumed/idle session emits before the
-  // first prompt; without it the sidebar row can't exist until the user types (STA-3386).
-  {
-    eventName: 'SessionStart',
-    definition: { hooks: [{ type: 'command', command: '' }] }
-  },
-  {
-    eventName: 'UserPromptSubmit',
-    definition: { hooks: [{ type: 'command', command: '' }] }
-  },
-  {
-    eventName: 'Stop',
-    definition: { hooks: [{ type: 'command', command: '' }] }
-  },
-  // Why: OpenClaude skips normal Stop hooks after API/model errors and emits
-  // StopFailure instead; without this hook Orca leaves the turn spinning.
-  {
-    eventName: 'StopFailure',
-    definition: { hooks: [{ type: 'command', command: '' }] }
-  },
-  // Why: subagent/teammate lifecycle feeds the sidebar's child rows and keeps
-  // a pane 'working' while background children outlive the lead's turn.
-  // TeammateIdle parks turn-based teammates without trusting their permanently
-  // "running" background_tasks entry to gate the pane.
-  // Older Claude builds ignore unregistered event names (StopFailure precedent).
-  {
-    eventName: 'SubagentStart',
-    definition: { hooks: [{ type: 'command', command: '' }] }
-  },
-  {
-    eventName: 'SubagentStop',
-    definition: { hooks: [{ type: 'command', command: '' }] }
-  },
-  {
-    eventName: 'TeammateIdle',
-    definition: { hooks: [{ type: 'command', command: '' }] }
-  },
-  // Why: PreToolUse gives the dashboard a live readout of the in-flight tool
-  // (name + input preview) before it completes.
-  {
-    eventName: 'PreToolUse',
-    definition: { matcher: '*', hooks: [{ type: 'command', command: '' }] }
-  },
-  {
-    eventName: 'PostToolUse',
-    definition: { matcher: '*', hooks: [{ type: 'command', command: '' }] }
-  },
-  {
-    eventName: 'PostToolUseFailure',
-    definition: { matcher: '*', hooks: [{ type: 'command', command: '' }] }
-  },
-  {
-    eventName: 'PermissionRequest',
-    definition: { matcher: '*', hooks: [{ type: 'command', command: '' }] }
-  },
-  // Why: a manual /compact ends at an idle prompt without emitting Stop, so PostCompact is the only
-  // signal that can clear the pane (STA-2915). PreCompact is deliberately NOT registered: it fires
-  // before the compact is validated, and an aborted compact emits it alone — mapping it to 'working'
-  // would strand the pane exactly as this registration is meant to prevent (STA-4613).
-  {
-    eventName: 'PostCompact',
-    definition: { hooks: [{ type: 'command', command: '' }] }
-  }
-] as const
-
-const CLAUDE_SESSION_END_EVENT = {
-  eventName: 'SessionEnd',
-  definition: { hooks: [{ type: 'command', command: '' }] }
-} as const
-
-export type ApplyManagedClaudeHooksOptions = {
-  claudeVersion?: string
-}
-
 export function getConfigPath(settings = CLAUDE_HOOK_SETTINGS): string {
   return join(homedir(), settings.configDirName, 'settings.json')
 }
@@ -171,6 +97,14 @@ export function getManagedLifecycleHook(
   if (process.platform !== 'win32' || !settings.usesWindowsCompatLauncher) {
     return buildManagedCommandHook(getManagedCommand(scriptPath, { neutralJsonWhenMissing: true }))
   }
+  if (settings.windowsHookShell === 'powershell') {
+    return {
+      type: 'command',
+      command: getWindowsPowerShellLifecycleCommand(scriptPath),
+      shell: 'powershell',
+      timeout: MANAGED_HOOK_TIMEOUT_SECONDS
+    }
+  }
   return getWindowsManagedLifecycleHook(scriptPath, options)
 }
 
@@ -190,19 +124,21 @@ export function getWindowsManagedLifecycleHook(
   if (directCommand) {
     return { type: 'command', command: directCommand, timeout: MANAGED_HOOK_TIMEOUT_SECONDS }
   }
+  return {
+    type: 'command',
+    command: wrapWindowsPowerShellEncodedCommand(getWindowsPowerShellLifecycleCommand(scriptPath)),
+    timeout: MANAGED_HOOK_TIMEOUT_SECONDS
+  }
+}
+
+function getWindowsPowerShellLifecycleCommand(scriptPath: string): string {
   const scriptFileName = win32.basename(scriptPath)
-  // Why: runtime profile resolution keeps the managed entry portable across users (STA-3348).
-  const quotedRelativePath = quotePowerShellString(`.orca\\agent-hooks\\${scriptFileName}`)
-  // Why: compat consumers require neutral JSON even when the managed script is missing (#14818).
-  const innerCommand =
+  const quotedRelativePath = quotePowerShellLiteral(`.orca\\agent-hooks\\${scriptFileName}`)
+  return (
     `$scriptPath = Join-Path $env:USERPROFILE ${quotedRelativePath}; ` +
     'if (Test-Path -LiteralPath $scriptPath -PathType Leaf) { & $scriptPath; exit $LASTEXITCODE }; ' +
     "[Console]::In.ReadToEnd() | Out-Null; Write-Output '{}'; exit 0"
-  return {
-    type: 'command',
-    command: wrapWindowsPowerShellEncodedCommand(innerCommand),
-    timeout: MANAGED_HOOK_TIMEOUT_SECONDS
-  }
+  )
 }
 
 export function hasSameManagedHookInvocation(
@@ -211,6 +147,7 @@ export function hasSameManagedHookInvocation(
 ): boolean {
   return (
     actual.command === expected.command &&
+    actual.shell === expected.shell &&
     JSON.stringify(actual.args ?? []) === JSON.stringify(expected.args ?? [])
   )
 }
@@ -222,31 +159,29 @@ export function getRemoteManagedCommand(scriptPath: string): string {
 export function applyManagedHooks(
   config: HooksConfig,
   hook: HookCommandConfig,
-  scriptFileName = getManagedScriptFileName(),
-  options: ApplyManagedClaudeHooksOptions = {}
+  scriptFileName: string,
+  plan: ClaudeManagedHookPlan
 ): HooksConfig {
   const nextHooks = { ...config.hooks }
   const isManagedCommand = createManagedCommandMatcher(scriptFileName)
-  const sessionEndCapable = claudeVersionSupportsSessionEnd(options.claudeVersion)
-  const events = sessionEndCapable ? [...CLAUDE_EVENTS, CLAUDE_SESSION_END_EVENT] : CLAUDE_EVENTS
 
-  for (const event of events) {
-    const current = Array.isArray(nextHooks[event.eventName]) ? nextHooks[event.eventName] : []
-    const cleaned = removeManagedCommands(current, isManagedCommand)
-    const definition: HookDefinition = {
-      ...event.definition,
-      hooks: [hook]
-    }
+  for (const event of plan.install) {
+    const current = nextHooks[event.eventName]
+    const cleaned = Array.isArray(current) ? removeManagedCommands(current, isManagedCommand) : []
+    const definition: HookDefinition = { ...event.definition, hooks: [hook] }
     nextHooks[event.eventName] = [...cleaned, definition]
   }
 
-  if (!sessionEndCapable) {
-    const current = Array.isArray(nextHooks.SessionEnd) ? nextHooks.SessionEnd : []
+  for (const event of plan.retire) {
+    const current = nextHooks[event.eventName]
+    if (!Array.isArray(current) || current.length === 0) {
+      continue
+    }
     const cleaned = removeManagedCommands(current, isManagedCommand)
     if (cleaned.length === 0) {
-      delete nextHooks.SessionEnd
+      delete nextHooks[event.eventName]
     } else {
-      nextHooks.SessionEnd = cleaned
+      nextHooks[event.eventName] = cleaned
     }
   }
 
diff --git a/src/main/cli/cli-privileged-processes.test.ts b/src/main/cli/cli-privileged-processes.test.ts
index e391df0bc6b..16d59af2df9 100644
--- a/src/main/cli/cli-privileged-processes.test.ts
+++ b/src/main/cli/cli-privileged-processes.test.ts
@@ -4,7 +4,11 @@ const runProcessMock = vi.hoisted(() => vi.fn())
 
 vi.mock('../../shared/child-process/run-process', () => ({ runProcess: runProcessMock }))
 
-import { runMacPrivilegedCommand, runWindowsPathCommand } from './cli-privileged-processes'
+import {
+  runMacPrivilegedCommand,
+  runWindowsPathCommand,
+  writeWindowsUserPath
+} from './cli-privileged-processes'
 
 describe('Windows CLI PATH process boundary', () => {
   beforeEach(() => runProcessMock.mockReset())
@@ -55,6 +59,21 @@ describe('Windows CLI PATH process boundary', () => {
       stderr: 'UnauthorizedAccessException'
     })
   })
+
+  it('doubles typographic single quotes in the PATH literal', async () => {
+    runProcessMock.mockResolvedValue({
+      code: 0,
+      signal: null,
+      stdout: '',
+      stderr: '',
+      timedOut: false
+    })
+
+    await writeWindowsUserPath('C:\\O\u2019Brien\\bin')
+    expect(runProcessMock.mock.calls[0][0].args.at(-1)).toBe(
+      "[Environment]::SetEnvironmentVariable('Path', 'C:\\O\u2019\u2019Brien\\bin', 'User')"
+    )
+  })
 })
 
 describe('macOS CLI privileged process boundary', () => {
diff --git a/src/main/cli/cli-privileged-processes.ts b/src/main/cli/cli-privileged-processes.ts
index 70e9e3cfb70..89acc2542e0 100644
--- a/src/main/cli/cli-privileged-processes.ts
+++ b/src/main/cli/cli-privileged-processes.ts
@@ -1,4 +1,5 @@
 import { runProcess } from '../../shared/child-process/run-process'
+import { quotePowerShellLiteral } from '../../shared/powershell-native-argument'
 import { WINDOWS_PATH_WRITE_TIMEOUT_MS } from './cli-install-constants'
 
 export async function runMacPrivilegedCommand(command: string): Promise<void> {
@@ -21,7 +22,7 @@ export async function writeWindowsUserPath(value: string): Promise<void> {
   await runWindowsPathCommand([
     '-NoProfile',
     '-Command',
-    `[Environment]::SetEnvironmentVariable('Path', ${quotePowerShell(value)}, 'User')`
+    `[Environment]::SetEnvironmentVariable('Path', ${quotePowerShellLiteral(value)}, 'User')`
   ])
 }
 
@@ -49,7 +50,3 @@ function processFailure(
   Object.assign(error, { code: result.code, stderr: result.stderr })
   return error
 }
-
-function quotePowerShell(value: string): string {
-  return `'${value.replaceAll("'", "''")}'`
-}
diff --git a/src/main/cli/orca-cli-child-path.ts b/src/main/cli/orca-cli-child-path.ts
index f053e54c3d5..2a8136c367f 100644
--- a/src/main/cli/orca-cli-child-path.ts
+++ b/src/main/cli/orca-cli-child-path.ts
@@ -17,6 +17,8 @@ import { delimiter, join } from 'node:path'
 import { readInheritedPath } from '../ipc/pty/host-env/path'
 import { resolvePathEnvKey } from '../pty/windows-environment-path'
 import { ensureLinuxTerminalOrcaCliShimDir } from './linux-terminal-orca-cli-shim'
+import { getBundledLauncherPath } from './bundled-cli-launcher-path'
+import { DEV_COMMAND_NAME } from './cli-install-constants'
 
 export type OrcaCliChildPathOptions = {
   isPackaged: boolean
@@ -26,11 +28,16 @@ export type OrcaCliChildPathOptions = {
   platform?: NodeJS.Platform
 }
 
-/** Mutates `env` in place, prepending the directory that makes bare `orca` this app's CLI. */
+/**
+ * Mutates `env` in place, prepending the directory that makes bare `orca` this app's CLI. Returns
+ * the absolute launcher in that directory, or null when none was prepended: a child whose shell
+ * rebuilds PATH (a login shell reordering it behind a global install) can still name this app's
+ * CLI by path.
+ */
 export function prependOrcaCliDirToChildPath(
   env: Record<string, string>,
   opts: OrcaCliChildPathOptions
-): void {
+): string | null {
   const platform = opts.platform ?? process.platform
   // Why: matches node:path's `delimiter` for the running platform, but stays correct when a test
   // drives a foreign platform through the seam.
@@ -43,6 +50,7 @@ export function prependOrcaCliDirToChildPath(
     env[resolvePathEnvKey(env, platform)] = inheritedPath
       ? `${devCliBin}${pathDelimiter}${inheritedPath}`
       : devCliBin
+    return join(devCliBin, platform === 'win32' ? `${DEV_COMMAND_NAME}.cmd` : DEV_COMMAND_NAME)
   } else if (platform === 'linux') {
     // Why: bare-`orca` shim scoped to Orca PTYs — Linux CLI installs as `orca-ide` to avoid shadowing GNOME's /usr/bin/orca screen reader (stablyai/orca#7904).
     const shimDir = ensureLinuxTerminalOrcaCliShimDir({ userDataPath: opts.userDataPath })
@@ -51,6 +59,7 @@ export function prependOrcaCliDirToChildPath(
         .split(pathDelimiter)
         .filter((entry) => entry.length > 0 && entry !== shimDir)
       env.PATH = [shimDir, ...inheritedEntries].join(pathDelimiter)
+      return join(shimDir, 'orca')
     }
   } else if (opts.resourcesPath && (platform === 'darwin' || platform === 'win32')) {
     // Why: global CLI registration is optional, but agents in Orca-managed PTYs must always reach this app's bundled CLI.
@@ -59,5 +68,8 @@ export function prependOrcaCliDirToChildPath(
     env[resolvePathEnvKey(env, platform)] = inheritedPath
       ? `${bundledCliBin}${pathDelimiter}${inheritedPath}`
       : bundledCliBin
+    // Why the native launcher on Windows: `orca.cmd` refuses message bodies cmd.exe would mangle.
+    return getBundledLauncherPath(platform, opts.resourcesPath)
   }
+  return null
 }
diff --git a/src/main/cli/wsl-cli-powershell-boundary.test.ts b/src/main/cli/wsl-cli-powershell-boundary.test.ts
index ddfdabe9ad3..500d1a29f8f 100644
--- a/src/main/cli/wsl-cli-powershell-boundary.test.ts
+++ b/src/main/cli/wsl-cli-powershell-boundary.test.ts
@@ -1,9 +1,10 @@
 import { spawnSync } from 'node:child_process'
-import { mkdir, mkdtemp, writeFile } from 'node:fs/promises'
+import { mkdir, mkdtemp, realpath, writeFile } from 'node:fs/promises'
 import { removeTree } from '../../shared/windows-transient-lock-removal'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { describe, expect, it } from 'vitest'
+import { runProcessSync } from '../../shared/child-process/run-process'
 import { buildWslBridgeScript, buildWslLauncher } from './wsl-cli-scripts'
 
 const FORWARDED_ARGS = [
@@ -32,6 +33,58 @@ const FORWARDED_ARGS = [
 ]
 
 describe('WSL CLI PowerShell boundary', () => {
+  it.skipIf(process.platform === 'win32')(
+    'forwards the distro as one argument and omits it when absent',
+    async () => {
+      const root = await mkdtemp(join(tmpdir(), 'orca-wsl-launcher-argv-'))
+      try {
+        const launcherPath = join(root, 'launcher.sh')
+        const expectedCwd = await realpath(root)
+        await writeFile(launcherPath, buildWslLauncher('C:\\Orca\\orca.exe', '/bridge.ps1'))
+        await writeFile(join(root, 'wslpath'), '#!/bin/bash\nprintf "%s" "$2"\n', {
+          mode: 0o700
+        })
+        await writeFile(join(root, 'powershell.exe'), '#!/bin/bash\nprintf "%s\\0" "$@"\n', {
+          mode: 0o700
+        })
+        for (const distro of [undefined, '', 'Ubuntu Work']) {
+          const env: NodeJS.ProcessEnv = {
+            ...process.env,
+            PATH: `${root}:${process.env.PATH ?? ''}`
+          }
+          delete env.WSL_DISTRO_NAME
+          if (distro !== undefined) {
+            env.WSL_DISTRO_NAME = distro
+          }
+          const result = runProcessSync({
+            program: '/bin/bash',
+            args: [launcherPath, 'account', 'add', '--agent', 'codex'],
+            env,
+            cwd: root
+          })
+          expect(result.code).toBe(0)
+          expect(result.stdout.split('\0').slice(0, -1)).toEqual([
+            '-NoProfile',
+            '-ExecutionPolicy',
+            'Bypass',
+            '-File',
+            '/bridge.ps1',
+            'C:\\Orca\\orca.exe',
+            '-WslCwd',
+            expectedCwd,
+            ...(distro ? ['-WslDistro', distro] : []),
+            'account',
+            'add',
+            '--agent',
+            'codex'
+          ])
+        }
+      } finally {
+        await removeTree(root)
+      }
+    }
+  )
+
   it('keeps forwarded argv outside PowerShell parsing', () => {
     const launcher = buildWslLauncher('C:\\Program Files\\Orca\\orca.exe')
     const bridge = buildWslBridgeScript()
@@ -58,21 +111,33 @@ describe('WSL CLI PowerShell boundary', () => {
         await writeFile(bridgePath, buildWslBridgeScript(), 'utf8')
         await writeFile(
           targetPath,
-          'process.stdout.write(JSON.stringify({ argv: process.argv.slice(2), cwd: process.env.ORCA_CLI_CWD ?? null }))\n',
+          'process.stdout.write(JSON.stringify({ argv: process.argv.slice(2), cwd: process.env.ORCA_CLI_CWD ?? null, distro: process.env.ORCA_CLI_WSL_DISTRO ?? null }))\n',
           'utf8'
         )
         const invocations = [
+          {
+            bridgeArgs: [
+              process.execPath,
+              '-WslCwd',
+              wslCwd,
+              '-WslDistro',
+              'Ubuntu Work',
+              targetPath,
+              ...FORWARDED_ARGS
+            ],
+            expected: { argv: FORWARDED_ARGS, cwd: wslCwd, distro: 'Ubuntu Work' }
+          },
           {
             bridgeArgs: [process.execPath, '-WslCwd', wslCwd, targetPath, ...FORWARDED_ARGS],
-            expected: { argv: FORWARDED_ARGS, cwd: wslCwd }
+            expected: { argv: FORWARDED_ARGS, cwd: wslCwd, distro: null }
           },
           {
             bridgeArgs: [process.execPath, '-WslCwd', wslCwd, targetPath],
-            expected: { argv: [], cwd: wslCwd }
+            expected: { argv: [], cwd: wslCwd, distro: null }
           },
           {
             bridgeArgs: [process.execPath, targetPath, ...FORWARDED_ARGS],
-            expected: { argv: FORWARDED_ARGS, cwd: null }
+            expected: { argv: FORWARDED_ARGS, cwd: null, distro: null }
           }
         ]
         for (const { bridgeArgs, expected } of invocations) {
@@ -87,7 +152,16 @@ describe('WSL CLI PowerShell boundary', () => {
               bridgePath,
               ...bridgeArgs
             ],
-            { encoding: 'utf8', env: { ...process.env, ORCA_CLI_CWD: 'stale' } }
+            {
+              encoding: 'utf8',
+              windowsHide: true,
+              env: {
+                ...process.env,
+                ORCA_CLI_CWD: 'stale',
+                ORCA_CLI_WSL_DISTRO: 'stale-distro',
+                WSL_DISTRO_NAME: 'wrong-distro'
+              }
+            }
           )
 
           expect(result.error).toBeUndefined()
@@ -109,7 +183,7 @@ describe('WSL CLI PowerShell boundary', () => {
             '-e',
             'process.exit(23)'
           ],
-          { encoding: 'utf8' }
+          { encoding: 'utf8', windowsHide: true }
         )
         expect(exitResult.error).toBeUndefined()
         expect(exitResult.status).toBe(23)
@@ -118,4 +192,61 @@ describe('WSL CLI PowerShell boundary', () => {
       }
     }
   )
+
+  it.skipIf(process.platform !== 'win32')(
+    'pins a non-ASCII app identity and the dev launcher env through Windows PowerShell 5.1',
+    async () => {
+      const root = await mkdtemp(join(tmpdir(), 'orca-wsl-managed-bridge-'))
+      const userDataPath = join(root, "张三's O\u2019Brien Orca")
+      const cliEntryPath = join(root, 'cli \u2018entry\u2019.cjs')
+      const bridgePath = join(root, 'orca-wsl-bridge.ps1')
+      try {
+        await writeFile(bridgePath, buildWslBridgeScript({ userDataPath, cliEntryPath }), 'utf8')
+        await writeFile(
+          cliEntryPath,
+          'console.error("to stderr"); const e = process.env; console.log(JSON.stringify({ argv: process.argv.slice(2), owner: e.ORCA_USER_DATA_PATH, app: e.ORCA_APP_EXECUTABLE, nodeOptions: e.NODE_OPTIONS ?? null, stashed: e.ORCA_NODE_OPTIONS, cliDir: e.ORCA_WSL_CLI_DIR ?? null }))\n',
+          'utf8'
+        )
+        const result = spawnSync(
+          'powershell.exe',
+          [
+            '-NoProfile',
+            '-NonInteractive',
+            '-ExecutionPolicy',
+            'Bypass',
+            '-File',
+            bridgePath,
+            process.execPath,
+            '-WslCwd',
+            root,
+            ...FORWARDED_ARGS
+          ],
+          {
+            encoding: 'utf8',
+            windowsHide: true,
+            env: {
+              ...process.env,
+              ORCA_APP_EXECUTABLE: '',
+              NODE_OPTIONS: '--max-old-space-size=4096',
+              ORCA_WSL_CLI_DIR: 'C:\\guest-only'
+            }
+          }
+        )
+
+        expect(result.error).toBeUndefined()
+        expect(result.status, result.stderr).toBe(0)
+        expect(result.stderr).toContain('to stderr')
+        expect(JSON.parse(result.stdout.trim())).toEqual({
+          argv: FORWARDED_ARGS,
+          owner: userDataPath,
+          app: process.execPath,
+          nodeOptions: null,
+          stashed: '--max-old-space-size=4096',
+          cliDir: null
+        })
+      } finally {
+        await removeTree(root)
+      }
+    }
+  )
 })
diff --git a/src/main/cli/wsl-cli-scripts.ts b/src/main/cli/wsl-cli-scripts.ts
index 8875a81d18e..3f4e4156433 100644
--- a/src/main/cli/wsl-cli-scripts.ts
+++ b/src/main/cli/wsl-cli-scripts.ts
@@ -1,9 +1,44 @@
+import { quotePowerShellLiteral } from '../../shared/powershell-native-argument'
+
 const MANAGED_MARKER = '# Orca managed WSL CLI launcher'
 const BRIDGE_MANAGED_MARKER = '# Orca managed WSL CLI PowerShell bridge'
 
+const FIND_INTEROP_POWERSHELL = `if command -v powershell.exe >/dev/null 2>&1; then
+  ORCA_POWERSHELL=powershell.exe
+elif [ -x /mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe ]; then
+  ORCA_POWERSHELL=/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe
+else
+  echo "Orca WSL CLI requires Windows interop and could not find powershell.exe." >&2
+  exit 1
+fi`
+
 export function buildWslLauncher(
   windowsLauncherPath: string,
   bridgePath = '${XDG_DATA_HOME:-$HOME/.local/share}/orca/orca-wsl-bridge.ps1'
+): string {
+  return buildLauncher(windowsLauncherPath, quoteShell(bridgePath), FIND_INTEROP_POWERSHELL)
+}
+
+/** Launcher that finds its bridge beside itself and PowerShell by Windows path, independent of guest PATH. */
+export function buildColocatedWslLauncher(
+  windowsLauncherPath: string,
+  windowsPowerShellPath: string
+): string {
+  return buildLauncher(
+    windowsLauncherPath,
+    '"$(dirname -- "$0")/orca-wsl-bridge.ps1"',
+    `ORCA_POWERSHELL=$(wslpath -u ${quoteShell(windowsPowerShellPath)})
+if [ ! -x "$ORCA_POWERSHELL" ]; then
+  echo "Orca WSL CLI requires Windows interop and access to $ORCA_POWERSHELL." >&2
+  exit 1
+fi`
+  )
+}
+
+function buildLauncher(
+  windowsLauncherPath: string,
+  bridgePathExpression: string,
+  resolvePowerShell: string
 ): string {
   const encodedTarget = Buffer.from(windowsLauncherPath, 'utf8').toString('base64')
   return `#!/usr/bin/env bash
@@ -11,15 +46,8 @@ set -euo pipefail
 ${MANAGED_MARKER}
 # ORCA_WIN_LAUNCHER_B64=${encodedTarget}
 ORCA_WIN_LAUNCHER=${quoteShell(windowsLauncherPath)}
-ORCA_BRIDGE_PS1=${quoteShell(bridgePath)}
-if command -v powershell.exe >/dev/null 2>&1; then
-  ORCA_POWERSHELL=powershell.exe
-elif [ -x /mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe ]; then
-  ORCA_POWERSHELL=/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe
-else
-  echo "Orca WSL CLI requires Windows interop and could not find powershell.exe." >&2
-  exit 1
-fi
+ORCA_BRIDGE_PS1=${bridgePathExpression}
+${resolvePowerShell}
 # Why: a shell can outlive a deleted worktree; keep explicit CLI selectors and
 # help usable, and repair cwd before any WSL interop tool tries to resolve it.
 ORCA_WSL_CWD=$(pwd -P 2>/dev/null) || {
@@ -28,12 +56,28 @@ ORCA_WSL_CWD=$(pwd -P 2>/dev/null) || {
 }
 ORCA_BRIDGE_PS1_WIN=$(wslpath -w "$ORCA_BRIDGE_PS1")
 ORCA_WSL_CWD_WIN=$(wslpath -w "$ORCA_WSL_CWD")
+if [ -n "\${WSL_DISTRO_NAME:-}" ]; then
+  set -- -WslDistro "$WSL_DISTRO_NAME" "$@"
+fi
 exec "$ORCA_POWERSHELL" -NoProfile -ExecutionPolicy Bypass -File "$ORCA_BRIDGE_PS1_WIN" "$ORCA_WIN_LAUNCHER" -WslCwd "$ORCA_WSL_CWD_WIN" "$@"
 `
 }
 
-export function buildWslBridgeScript(): string {
-  return `${BRIDGE_MANAGED_MARKER}
+/** `app` pins the bridge to one Orca instance; the guest-registered bridge omits it. */
+export function buildWslBridgeScript(app?: {
+  userDataPath: string
+  cliEntryPath?: string
+}): string {
+  const setAppEnv = app
+    ? [
+        `$env:ORCA_USER_DATA_PATH = ${quotePowerShellLiteral(app.userDataPath)}`,
+        // Why: WSLENV /p maps this guest-only dir back; an app the CLI starts must not inherit it.
+        'Remove-Item Env:ORCA_WSL_CLI_DIR -ErrorAction SilentlyContinue',
+        ...(app.cliEntryPath ? buildDevCliEnv(app.cliEntryPath) : [])
+      ]
+    : []
+  // Why the BOM: PowerShell 5.1 reads BOM-less scripts as ANSI, garbling non-ASCII embedded paths.
+  return `${app ? '\uFEFF' : ''}${BRIDGE_MANAGED_MARKER}
 function ConvertTo-NativeCommandLineArgument {
   param([AllowEmptyString()][string]$Value)
 
@@ -71,6 +115,7 @@ try {
   }
   [string]$OrcaLauncher = $args[0]
   [string]$WslCwd = ''
+  [string]$WslDistro = ''
   [int]$ForwardArgStart = 1
   if ($args.Count -ge 2 -and $args[1] -eq '-WslCwd') {
     if ($args.Count -lt 3) {
@@ -79,6 +124,13 @@ try {
     $WslCwd = $args[2]
     $ForwardArgStart = 3
   }
+  if ($ForwardArgStart -eq 3 -and $args.Count -ge 4 -and $args[3] -eq '-WslDistro') {
+    if ($args.Count -lt 5) {
+      throw 'Invalid Orca WSL CLI bridge invocation.'
+    }
+    $WslDistro = $args[4]
+    $ForwardArgStart = 5
+  }
   [string[]]$ForwardArgs = @()
   if ($args.Count -gt $ForwardArgStart) {
     $ForwardArgs = @($args[$ForwardArgStart..($args.Count - 1)])
@@ -88,12 +140,18 @@ try {
   } else {
     $env:ORCA_CLI_CWD = $WslCwd
   }
+  # Do not let an inherited Windows environment choose the caller's account location.
+  if ([string]::IsNullOrEmpty($WslDistro)) {
+    Remove-Item Env:ORCA_CLI_WSL_DISTRO -ErrorAction SilentlyContinue
+  } else {
+    $env:ORCA_CLI_WSL_DISTRO = $WslDistro
+  }
   $LauncherDirectory = Split-Path -Parent $OrcaLauncher
   Push-Location -LiteralPath $LauncherDirectory
   # Why: Windows PowerShell 5.1 cannot losslessly splat strings to native argv.
   $StartInfo = [System.Diagnostics.ProcessStartInfo]::new()
   $StartInfo.FileName = $OrcaLauncher
-  $StartInfo.Arguments = (($ForwardArgs | ForEach-Object {
+${bridgeLines(setAppEnv)}  $StartInfo.Arguments = (($ForwardArgs | ForEach-Object {
     ConvertTo-NativeCommandLineArgument $_
   }) -join ' ')
   $StartInfo.UseShellExecute = $false
@@ -119,6 +177,22 @@ exit $exitCode
 `
 }
 
+/** Runs the dev CLI directly (its .cmd launcher adds a cmd.exe quoting boundary) with that launcher's env. */
+function buildDevCliEnv(cliEntryPath: string): string[] {
+  return [
+    "$env:ELECTRON_RUN_AS_NODE = '1'",
+    "if (-not $env:ORCA_APP_EXECUTABLE) { $env:ORCA_APP_EXECUTABLE = $OrcaLauncher; $env:ORCA_APP_EXECUTABLE_NEEDS_APP_ROOT = '1' }",
+    '$env:ORCA_NODE_OPTIONS = $env:NODE_OPTIONS',
+    '$env:ORCA_NODE_REPL_EXTERNAL_MODULE = $env:NODE_REPL_EXTERNAL_MODULE',
+    'Remove-Item Env:NODE_OPTIONS, Env:NODE_REPL_EXTERNAL_MODULE -ErrorAction SilentlyContinue',
+    `$ForwardArgs = @(${quotePowerShellLiteral(cliEntryPath)}) + $ForwardArgs`
+  ]
+}
+
+function bridgeLines(lines: readonly string[]): string {
+  return lines.map((line) => `  ${line}\n`).join('')
+}
+
 export function getBridgePathFromCommandPath(commandPath: string): string {
   // Why: both the current Linux command and the legacy pre-rename command
   // share one WSL bridge under ~/.local/share/orca.
diff --git a/src/main/cli/wsl-managed-cli.test.ts b/src/main/cli/wsl-managed-cli.test.ts
new file mode 100644
index 00000000000..23e764f5a5b
--- /dev/null
+++ b/src/main/cli/wsl-managed-cli.test.ts
@@ -0,0 +1,68 @@
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { installFakeAppEnvironment } from '../../../config/scripts/vitest-host-ports-setup'
+import { getManagedWslCliDir } from './wsl-managed-cli'
+
+const roots: string[] = []
+afterEach(() => {
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), 'orca-managed-wsl-'))
+  roots.push(root)
+  const resourcesPath = join(root, 'resources with spaces')
+  mkdirSync(join(resourcesPath, 'bin'), { recursive: true })
+  writeFileSync(join(resourcesPath, 'bin', 'orca.exe'), 'fixture')
+  return { isPackaged: true, resourcesPath, userDataPath: join(root, 'user data') }
+}
+
+describe('managed WSL CLI provisioning', () => {
+  it('reuses a complete tree, repairs missing files, and isolates app identities and updates', () => {
+    const host = fixture()
+    const directory = getManagedWslCliDir(host) ?? ''
+    const launcher = join(directory, 'orca-ide')
+    const modified = statSync(launcher).mtimeMs
+    expect(getManagedWslCliDir(host)).toBe(directory)
+    expect(statSync(launcher).mtimeMs).toBe(modified)
+    rmSync(launcher)
+    expect(getManagedWslCliDir(host)).toBe(directory)
+    expect(readFileSync(launcher, 'utf8')).toContain('resources with spaces')
+    const second = { ...host, userDataPath: join(host.userDataPath, 'second') }
+    expect(getManagedWslCliDir(second)).not.toBe(directory)
+    const update = fixture()
+    expect(getManagedWslCliDir({ ...update, userDataPath: host.userDataPath })).not.toBe(directory)
+  })
+
+  it('provides nothing when the packaged CLI runtime is missing', () => {
+    const host = fixture()
+    rmSync(join(host.resourcesPath, 'bin', 'orca.exe'))
+    expect(getManagedWslCliDir(host)).toBeNull()
+  })
+
+  it('provides nothing when user data cannot hold the CLI', () => {
+    const host = fixture()
+    writeFileSync(host.userDataPath, 'a file, not a directory')
+    expect(getManagedWslCliDir(host)).toBeNull()
+  })
+
+  it('runs the development CLI directly with the dev launcher env', () => {
+    const host = fixture()
+    const appPath = host.resourcesPath
+    const cliEntryPath = join(appPath, 'out', 'cli', 'index.js')
+    mkdirSync(join(appPath, 'out', 'cli'), { recursive: true })
+    writeFileSync(cliEntryPath, 'fixture')
+    installFakeAppEnvironment({ getPath: () => host.userDataPath, getAppPath: () => appPath })
+    const directory = getManagedWslCliDir({ ...host, isPackaged: false }) ?? ''
+    expect(readFileSync(join(directory, 'orca-dev'), 'utf8')).toContain(process.execPath)
+    const bridge = readFileSync(join(directory, 'orca-wsl-bridge.ps1'), 'utf8')
+    expect(bridge.startsWith('\uFEFF')).toBe(true)
+    expect(bridge).toContain(host.userDataPath)
+    expect(bridge).toContain(cliEntryPath)
+    expect(bridge).toContain('$env:ORCA_APP_EXECUTABLE_NEEDS_APP_ROOT')
+    expect(bridge).toContain('Remove-Item Env:NODE_OPTIONS')
+  })
+})
diff --git a/src/main/cli/wsl-managed-cli.ts b/src/main/cli/wsl-managed-cli.ts
new file mode 100644
index 00000000000..2e3c478b9a9
--- /dev/null
+++ b/src/main/cli/wsl-managed-cli.ts
@@ -0,0 +1,53 @@
+import { createHash } from 'node:crypto'
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { getAppEnvironment } from '../../shared/app-environment'
+import { windowsPowerShellPath } from '../../shared/child-process/windows-system-binary'
+import { writeShellWrapperFiles } from '../shell-wrapper-file-writer'
+import { getBundledLauncherPath, LINUX_CLI_COMMAND_NAME } from './bundled-cli-launcher-path'
+import { DEV_COMMAND_NAME } from './cli-install-constants'
+import { buildColocatedWslLauncher, buildWslBridgeScript } from './wsl-cli-scripts'
+
+/** Packaged builds share `orca-ide` with guest registration; dev builds get their own name. */
+export function getWslCliCommandName(isPackaged: boolean): string {
+  return isPackaged ? LINUX_CLI_COMMAND_NAME : DEV_COMMAND_NAME
+}
+
+let warnedMissingRuntime = false
+
+/**
+ * Directory holding this app's WSL launcher and bridge, or null when the CLI runtime is
+ * missing or unwritable. Content-addressed like shell-ready wrappers: builds sharing userData
+ * never overwrite each other, and a present file is complete because each one lands by rename.
+ */
+export function getManagedWslCliDir(opts: {
+  isPackaged: boolean
+  userDataPath: string
+  resourcesPath?: string
+}): string | null {
+  const cliEntryPath = opts.isPackaged
+    ? undefined
+    : join(getAppEnvironment().getAppPath(), 'out', 'cli', 'index.js')
+  const launcherPath = opts.isPackaged
+    ? opts.resourcesPath && getBundledLauncherPath('win32', opts.resourcesPath)
+    : process.execPath
+  if (!launcherPath || !existsSync(cliEntryPath ?? launcherPath)) {
+    if (!warnedMissingRuntime) {
+      warnedMissingRuntime = true
+      console.warn('[WSL CLI] Orca CLI runtime is missing; WSL terminals will not provide it.')
+    }
+    return null
+  }
+  const launcher = buildColocatedWslLauncher(launcherPath, windowsPowerShellPath())
+  const bridge = buildWslBridgeScript({ userDataPath: opts.userDataPath, cliEntryPath })
+  const digest = createHash('sha256').update(launcher).update(bridge).digest('hex').slice(0, 20)
+  const directory = join(opts.userDataPath, 'wsl-managed-cli', digest)
+  const files = [
+    [join(directory, getWslCliCommandName(opts.isPackaged)), launcher],
+    [join(directory, 'orca-wsl-bridge.ps1'), bridge]
+  ] as const
+  const ready =
+    files.every(([path]) => existsSync(path)) ||
+    writeShellWrapperFiles(files, '[WSL CLI]', 'WSL terminals will start without the Orca CLI')
+  return ready ? directory : null
+}
diff --git a/src/main/cli/wsl-managed-cli.wsl.test.ts b/src/main/cli/wsl-managed-cli.wsl.test.ts
new file mode 100644
index 00000000000..c7738397d77
--- /dev/null
+++ b/src/main/cli/wsl-managed-cli.wsl.test.ts
@@ -0,0 +1,142 @@
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { expect, it } from 'vitest'
+import { runProcess } from '../../shared/child-process/run-process'
+import { removeTree } from '../../shared/windows-transient-lock-removal'
+import { buildWslExecArgs } from '../../shared/wsl-login-shell-command'
+import { installFakeAppEnvironment } from '../../../config/scripts/vitest-host-ports-setup'
+import { addOrcaWslInteropEnv } from '../pty/wsl-orca-env'
+import { getManagedWslCliDir } from './wsl-managed-cli'
+import { buildLocalShellReadyWrapperFiles } from '../providers/local-pty-shell-ready-wrapper-fileset'
+
+// Explicit opt-in: never require a developer's WSL installation for unit tests.
+const enabled = process.platform === 'win32' && process.env.ORCA_TEST_MANAGED_WSL === '1'
+const FIXTURE_CLI =
+  'if(process.argv.includes("--exit"))process.exit(23); console.error("bridge stderr"); console.log(JSON.stringify({argv:process.argv.slice(2),owner:process.env.ORCA_USER_DATA_PATH,handle:process.env.ORCA_TERMINAL_HANDLE}))'
+
+async function withManagedCli(
+  run: (fixture: {
+    env: Record<string, string>
+    guestRoot: string
+    root: string
+    userDataPath: string
+    wsl: (args: string[], input?: string) => ReturnType<typeof runProcess>
+  }) => Promise<void>
+): Promise<void> {
+  const root = mkdtempSync(join(tmpdir(), "orca WSL's managed CLI "))
+  const distro = process.env.ORCA_TEST_WSL_DISTRO || undefined
+  const userDataPath = join(root, 'user data 张三 O\u2019Brien')
+  const env: Record<string, string> = { ORCA_BACKGROUND_LAUNCH: '1' }
+  for (const [key, value] of Object.entries(process.env)) {
+    if (value !== undefined) {
+      env[key] = value
+    }
+  }
+  const wsl = (args: string[], input?: string) =>
+    runProcess({
+      program: 'wsl.exe',
+      args: buildWslExecArgs(distro, args),
+      env,
+      cwd: root,
+      input,
+      timeoutMs: 30_000
+    })
+  const snapshot = () =>
+    wsl([
+      'sh',
+      '-c',
+      'for file in "$HOME/.profile" "$HOME/.bashrc" "$HOME/.bash_profile" "$HOME/.zshrc" "$HOME/.zprofile" "$HOME/.zshenv" "$HOME/.local/bin/orca" "$HOME/.local/bin/orca-ide" "$HOME/.local/bin/orca-dev" "$HOME/.local/share/orca/orca-wsl-bridge.ps1"; do if [ -f "$file" ]; then sha256sum "$file"; fi; done; printf "PATH=%s\\n" "$PATH"'
+    ])
+  try {
+    const before = await snapshot()
+    expect(before.code, before.stderr).toBe(0)
+    mkdirSync(join(root, 'out', 'cli'), { recursive: true })
+    writeFileSync(join(root, 'out', 'cli', 'index.js'), FIXTURE_CLI)
+    for (const [path, content] of buildLocalShellReadyWrapperFiles(join(root, 'wrapper'))) {
+      mkdirSync(dirname(path), { recursive: true })
+      writeFileSync(path, content)
+    }
+    const translated = await wsl(['wslpath', '-u', root])
+    expect(translated.code, translated.stderr).toBe(0)
+    installFakeAppEnvironment({ getPath: () => userDataPath, getAppPath: () => root })
+    const directory = getManagedWslCliDir({ isPackaged: false, userDataPath })
+    expect(directory).not.toBeNull()
+    Object.assign(env, {
+      ORCA_WSL_CLI_DIR: directory ?? '',
+      ORCA_CLI_COMMAND: 'orca-dev',
+      ORCA_TERMINAL_HANDLE: 'term_managed_fixture'
+    })
+    addOrcaWslInteropEnv(env)
+    await run({ env, guestRoot: translated.stdout.trim(), root, userDataPath, wsl })
+    expect((await snapshot()).stdout).toBe(before.stdout)
+  } finally {
+    await removeTree(root)
+  }
+}
+
+it.skipIf(!enabled)(
+  'executes the managed bridge after bash startup resets PATH, without guest registration',
+  () =>
+    withManagedCli(async ({ env, guestRoot, root, userDataPath, wsl }) => {
+      writeFileSync(join(root, '.bash_profile'), 'export PATH=/usr/bin:/bin\n')
+      const shell = (command: string) =>
+        wsl([
+          'env',
+          `HOME=${guestRoot}`,
+          'PATH=/usr/bin:/bin',
+          'bash',
+          '--rcfile',
+          `${guestRoot}/wrapper/bash/rcfile`,
+          '-ic',
+          command
+        ])
+
+      const result = await shell('orca-dev "two words" "literal $" | cat')
+      expect(result.code, result.stderr).toBe(0)
+      expect(result.stderr).toContain('bridge stderr')
+      expect(result.stdout).toContain('"argv":["two words","literal $"]')
+      expect(result.stdout).toContain(JSON.stringify(userDataPath))
+      expect(result.stdout).toContain('"handle":"term_managed_fixture"')
+      expect((await shell('orca-dev --exit')).code).toBe(23)
+
+      env.ORCA_WSL_CLI_DIR = join(root, 'missing-cli')
+      // An unusable CLI warns but never blocks the shell.
+      const missing = await shell('echo SHELL_CONTINUED')
+      expect(missing.code).toBe(0)
+      expect(missing.stdout).toContain('SHELL_CONTINUED')
+      expect(missing.stderr).toContain('Check WSL Windows-drive mount options')
+    }),
+  90_000
+)
+
+// Why a PTY: the zsh restore runs from the first-prompt hook, which `zsh -c` never reaches.
+it.skipIf(!enabled)(
+  'executes the managed bridge from an interactive zsh after .zshrc resets PATH',
+  (ctx) =>
+    withManagedCli(async ({ guestRoot, root, userDataPath, wsl }) => {
+      if ((await wsl(['sh', '-c', 'command -v zsh && command -v script'])).code !== 0) {
+        ctx.skip()
+      }
+      writeFileSync(join(root, '.zshrc'), 'export PATH=/usr/bin:/bin\n')
+      const result = await wsl(
+        [
+          'env',
+          `HOME=${guestRoot}`,
+          'PATH=/usr/bin:/bin',
+          `ZDOTDIR=${guestRoot}/wrapper/zsh`,
+          'script',
+          '-qec',
+          'zsh -l',
+          '/dev/null'
+        ],
+        `orca-dev "two words" > "$HOME/zsh-out"; print -r -- "path=$PATH" >> "$HOME/zsh-out"; exit\n`
+      )
+      expect(result.code, result.stderr).toBe(0)
+      const output = await wsl(['cat', `${guestRoot}/zsh-out`])
+      expect(output.stdout).toContain('"argv":["two words"]')
+      expect(output.stdout).toContain(JSON.stringify(userDataPath))
+      expect(output.stdout).toMatch(/path=\/mnt\/.*wsl-managed-cli\/[0-9a-f]{20}:\/usr\/bin:\/bin/)
+    }),
+  90_000
+)
diff --git a/src/main/codebuddy/hook-service.test.ts b/src/main/codebuddy/hook-service.test.ts
new file mode 100644
index 00000000000..e20ae46e39c
--- /dev/null
+++ b/src/main/codebuddy/hook-service.test.ts
@@ -0,0 +1,47 @@
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import type * as OsModule from 'node:os'
+import { join } from 'node:path'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+const sandbox = vi.hoisted(() => ({ home: '' }))
+vi.mock('node:os', async (importOriginal) => ({
+  ...(await importOriginal<typeof OsModule>()),
+  homedir: () => sandbox.home
+}))
+vi.mock('electron', () => ({ app: { getPath: () => sandbox.home } }))
+import { codebuddyHookService, CODEBUDDY_HOOK_EVENTS } from './hook-service'
+
+beforeAll(() => {
+  sandbox.home = mkdtempSync(join(tmpdir(), 'orca-codebuddy-test-'))
+  mkdirSync(join(sandbox.home, '.codebuddy'))
+})
+afterAll(() => rmSync(sandbox.home, { recursive: true, force: true }))
+
+describe('CodeBuddy managed hooks', () => {
+  it('preserves user configuration through repeated install and removal', () => {
+    const path = join(sandbox.home, '.codebuddy', 'settings.json')
+    const userHook = { hooks: [{ type: 'command', command: 'echo user-hook' }] }
+    const settings = {
+      model: 'custom',
+      hooks: { Stop: [userHook] },
+      statusLine: { command: 'user-status' }
+    }
+    writeFileSync(path, JSON.stringify(settings))
+    expect(codebuddyHookService.install().state).toBe('installed')
+    expect(codebuddyHookService.install().state).toBe('installed')
+    const installed = JSON.parse(readFileSync(path, 'utf8'))
+    for (const event of CODEBUDDY_HOOK_EVENTS) {
+      expect(installed.hooks[event]).toHaveLength(event === 'Stop' ? 2 : 1)
+    }
+    expect(installed.statusLine).toEqual(settings.statusLine)
+    expect(codebuddyHookService.remove().state).toBe('not_installed')
+    expect(JSON.parse(readFileSync(path, 'utf8'))).toMatchObject(settings)
+  })
+
+  it('leaves malformed user settings untouched', () => {
+    const path = join(sandbox.home, '.codebuddy', 'settings.json')
+    writeFileSync(path, '{broken')
+    expect(codebuddyHookService.install().state).toBe('error')
+    expect(readFileSync(path, 'utf8')).toBe('{broken')
+  })
+})
diff --git a/src/main/codebuddy/hook-service.ts b/src/main/codebuddy/hook-service.ts
new file mode 100644
index 00000000000..1a7c9619a34
--- /dev/null
+++ b/src/main/codebuddy/hook-service.ts
@@ -0,0 +1,34 @@
+import type { ClaudeManagedHookPlan } from '../claude/claude-managed-hook-events'
+import { ClaudeHookService } from '../claude/hook-service'
+
+export const CODEBUDDY_HOOK_EVENTS = [
+  'SessionStart',
+  'SessionEnd',
+  'UserPromptSubmit',
+  'PreToolUse',
+  'PostToolUse',
+  'PostToolUseFailure',
+  'PermissionRequest',
+  'Stop',
+  'StopFailure',
+  'Notification'
+] as const
+
+export const CODEBUDDY_MANAGED_HOOK_PLAN: ClaudeManagedHookPlan = {
+  install: CODEBUDDY_HOOK_EVENTS.map((eventName) => ({ eventName, definition: {} })),
+  retire: [],
+  statusLine: 'leave'
+}
+
+export const codebuddyHookService = new ClaudeHookService({
+  agent: 'codebuddy',
+  source: 'codebuddy',
+  displayName: 'CodeBuddy',
+  settings: {
+    configDirName: '.codebuddy',
+    scriptBaseName: 'codebuddy-hook',
+    usesWindowsCompatLauncher: true,
+    windowsHookShell: 'powershell'
+  },
+  hookPlan: CODEBUDDY_MANAGED_HOOK_PLAN
+})
diff --git a/src/main/codex-accounts/async-file-rename.test.ts b/src/main/codex-accounts/async-file-rename.test.ts
new file mode 100644
index 00000000000..a453378a78d
--- /dev/null
+++ b/src/main/codex-accounts/async-file-rename.test.ts
@@ -0,0 +1,87 @@
+import { mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
+import type * as NodeFsPromises from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, expect, it, vi } from 'vitest'
+import { writeFileDurable, writeFileDurableIfCurrent } from '../durable-file-write'
+
+const rename = vi.hoisted(() => vi.fn())
+vi.mock('node:fs/promises', async (importOriginal) => {
+  const actual = await importOriginal<typeof NodeFsPromises>()
+  rename.mockImplementation(actual.rename)
+  return { ...actual, rename }
+})
+
+const platform = process.platform
+const roots: string[] = []
+afterEach(() => {
+  Object.defineProperty(process, 'platform', { value: platform })
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+  rename.mockClear()
+  vi.restoreAllMocks()
+})
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), 'orca-async-rename-'))
+  roots.push(root)
+  const target = join(root, 'state.json')
+  const temporary = join(root, 'temporary.json')
+  writeFileSync(target, 'old')
+  return { root, target, temporary }
+}
+
+it.each(['EPERM', 'EACCES', 'EBUSY'])(
+  'retries a transient Windows %s without blocking the event loop',
+  async (code) => {
+    const { target, temporary } = fixture()
+    Object.defineProperty(process, 'platform', { value: 'win32' })
+    rename.mockRejectedValueOnce(Object.assign(new Error('file busy'), { code }))
+    let ticked = false
+    const timer = setTimeout(() => {
+      ticked = true
+    }, 0)
+    try {
+      await writeFileDurable(temporary, target, 'new')
+      expect(readFileSync(target, 'utf8')).toBe('new')
+      expect(rename).toHaveBeenCalledTimes(2)
+      expect(ticked).toBe(true)
+    } finally {
+      clearTimeout(timer)
+    }
+  }
+)
+
+it.each([
+  ['win32', 'EPERM', 6],
+  ['win32', 'ENOSPC', 1],
+  ['linux', 'EBUSY', 1]
+] as const)('bounds %s %s failures and preserves the old file', async (host, code, attempts) => {
+  const { root, target, temporary } = fixture()
+  Object.defineProperty(process, 'platform', { value: host })
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    rename.mockRejectedValueOnce(Object.assign(new Error('injected file failure'), { code }))
+  }
+  await expect(writeFileDurable(temporary, target, 'new')).rejects.toThrow('injected file failure')
+  expect(rename).toHaveBeenCalledTimes(attempts)
+  expect(readFileSync(target, 'utf8')).toBe('old')
+  expect(readdirSync(root)).toEqual(['state.json'])
+})
+
+it('does not publish a superseded snapshot after a Windows retry delay', async () => {
+  const { root, target, temporary } = fixture()
+  Object.defineProperty(process, 'platform', { value: 'win32' })
+  let current = true
+  rename.mockImplementationOnce(async () => {
+    current = false
+    writeFileSync(target, 'newer snapshot')
+    throw Object.assign(new Error('busy'), { code: 'EBUSY' })
+  })
+  await expect(
+    writeFileDurableIfCurrent(temporary, target, 'stale snapshot', () => current)
+  ).resolves.toBe(false)
+  expect(rename).toHaveBeenCalledOnce()
+  expect(readFileSync(target, 'utf8')).toBe('newer snapshot')
+  expect(readdirSync(root)).toEqual(['state.json'])
+})
diff --git a/src/main/codex-accounts/codex-account-selection.ts b/src/main/codex-accounts/codex-account-selection.ts
index ad97d80696b..24785e79dc1 100644
--- a/src/main/codex-accounts/codex-account-selection.ts
+++ b/src/main/codex-accounts/codex-account-selection.ts
@@ -28,7 +28,7 @@ type CodexAccountSelectionDependencies = {
   lifecycle: CodexAccountServiceLifecycle
   resolveSystemDefault: () => CodexSystemDefaultIdentity
   removeManagedHome: (candidatePath: string, expectedAccountId: string) => void
-  discardResetAttempts: (accountId: string) => void
+  discardResetAttempts: (accountId: string) => Promise<void>
 }
 
 export class CodexAccountSelection {
@@ -83,10 +83,13 @@ export class CodexAccountSelection {
     }
 
     this.dependencies.removeManagedHome(account.managedHomePath, account.id)
-    // Why: a removed account can no longer appear in the switcher dropdown,
-    // so purge its cached usage to avoid stale entries.
     this.dependencies.rateLimits.evictInactiveCodexCache(accountId)
-    this.dependencies.discardResetAttempts(accountId)
+    try {
+      await this.dependencies.discardResetAttempts(accountId)
+    } catch (error) {
+      // Removal already succeeded; retain the ledger's safety guards if cleanup fails.
+      console.warn('[codex-accounts] Removed account, but credit ledger cleanup failed:', error)
+    }
     const accountTarget = getCodexSelectionTargetForAccount(account)
     this.startQuotaRefresh(
       getSelectedCodexAccountIdForTarget(settings, accountTarget) === accountId
diff --git a/src/main/codex-accounts/codex-reset-credit-coordinator.ts b/src/main/codex-accounts/codex-reset-credit-coordinator.ts
index 5d6233d46eb..cd0c8ad8569 100644
--- a/src/main/codex-accounts/codex-reset-credit-coordinator.ts
+++ b/src/main/codex-accounts/codex-reset-credit-coordinator.ts
@@ -171,8 +171,8 @@ export class CodexResetCreditCoordinator {
     })
   }
 
-  discardForRemovedAccount(accountId: string): void {
-    this.ledger.discardForRemovedAccount(accountId)
+  discardForRemovedAccount(accountId: string): Promise<void> {
+    return this.ledger.discardForRemovedAccount(accountId)
   }
 
   private startAttempt(
@@ -182,6 +182,9 @@ export class CodexResetCreditCoordinator {
   ): Promise<CodexResetCreditConsumeResult> {
     const promise = this.dependencies.serializeMutation(
       async (): Promise<CodexResetCreditConsumeResult> => {
+        if (this.ledger.error) {
+          throw this.ledger.error
+        }
         const isFresh = attempt.state === 'fresh'
         let validation: { managedHomePath: string; rateLimits: RateLimitState }
         try {
@@ -204,7 +207,7 @@ export class CodexResetCreditCoordinator {
           throw error
         }
         if (isFresh) {
-          this.ledger.markProviderPending(idempotencyKey, attempt)
+          await this.ledger.markProviderPending(idempotencyKey, attempt)
         }
         const { outcome, state } =
           await this.dependencies.rateLimits.consumeCodexRateLimitResetCredit({
@@ -220,7 +223,7 @@ export class CodexResetCreditCoordinator {
           codex: this.dependencies.getSnapshot(),
           rateLimits: state
         }
-        this.ledger.markSettled(idempotencyKey, attempt, outcome)
+        await this.ledger.markSettled(idempotencyKey, attempt, outcome)
         return result
       }
     )
diff --git a/src/main/codex-accounts/codex-reset-credit-ledger.test.ts b/src/main/codex-accounts/codex-reset-credit-ledger.test.ts
new file mode 100644
index 00000000000..32f13e33d78
--- /dev/null
+++ b/src/main/codex-accounts/codex-reset-credit-ledger.test.ts
@@ -0,0 +1,131 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { CodexResetCreditAttemptLedger } from '../../shared/codex-reset-credit-attempt-ledger'
+import type { CodexResetCreditExpectedScope } from '../../shared/codex-reset-credit-scope'
+import { ProfileStateWriterError } from '../persistence/profile-state/profile-state-writer-errors'
+import { CodexResetCreditLedger } from './codex-reset-credit-ledger'
+
+function scope(accountId: string): CodexResetCreditExpectedScope {
+  return {
+    target: { runtime: 'host', wslDistro: null },
+    accountId,
+    accountRevision: 1,
+    offerRevision: 'offer-1'
+  }
+}
+
+function setup() {
+  let durable: CodexResetCreditAttemptLedger = { version: 1, attempts: [] }
+  const barrier = vi.fn(async () => {})
+  const store = {
+    getCodexResetCreditAttemptLedger: () => structuredClone(durable),
+    replaceCodexResetCreditAttemptLedgerAndFlush: vi.fn(
+      async (next: CodexResetCreditAttemptLedger) => {
+        await barrier()
+        durable = structuredClone(next)
+      }
+    )
+  }
+  return { ledger: new CodexResetCreditLedger(store), store, barrier }
+}
+
+describe('async reset-credit ledger', () => {
+  it('serializes replacement construction so concurrent account writes survive', async () => {
+    const { ledger, store, barrier } = setup()
+    const gate = Promise.withResolvers<void>()
+    barrier.mockImplementationOnce(() => gate.promise)
+    const first = ledger.createFresh('first', scope('account-1'))
+    const second = ledger.createFresh('second', scope('account-2'))
+    const pendingFirst = ledger.markProviderPending('first', first)
+    const pendingSecond = ledger.markProviderPending('second', second)
+    await vi.waitFor(() => expect(barrier).toHaveBeenCalledOnce())
+    expect(first.state).toBe('fresh')
+    expect(second.state).toBe('fresh')
+    expect(store.getCodexResetCreditAttemptLedger().attempts).toEqual([])
+
+    gate.resolve()
+    await Promise.all([pendingFirst, pendingSecond])
+    expect(store.getCodexResetCreditAttemptLedger().attempts).toMatchObject([
+      { idempotencyKey: 'first', state: 'providerPending' },
+      { idempotencyKey: 'second', state: 'providerPending' }
+    ])
+    expect(ledger.getUnresolvedKey(first.accountScopeKey)).toBe('first')
+    expect(ledger.getUnresolvedKey(second.accountScopeKey)).toBe('second')
+  })
+
+  it('keeps pending guards until settlement commits and can retry a known failure', async () => {
+    const { ledger, store, barrier } = setup()
+    const attempt = ledger.createFresh('first', scope('account-1'))
+    await ledger.markProviderPending('first', attempt)
+    const gate = Promise.withResolvers<void>()
+    barrier.mockImplementationOnce(() => gate.promise)
+    const settled = ledger.markSettled('first', attempt, 'reset')
+    const rejected = expect(settled).rejects.toThrow('disk full')
+    await vi.waitFor(() => expect(barrier).toHaveBeenCalledTimes(2))
+    expect(attempt.state).toBe('providerPending')
+    expect(ledger.getUnresolvedKey(attempt.accountScopeKey)).toBe('first')
+
+    gate.reject(new Error('disk full'))
+    await rejected
+    expect(attempt.state).toBe('providerPending')
+    expect(store.getCodexResetCreditAttemptLedger().attempts[0]?.state).toBe('providerPending')
+    expect(ledger.error).toBeNull()
+    await ledger.markSettled('first', attempt, 'alreadyRedeemed')
+    expect(attempt.settledOutcome).toBe('alreadyRedeemed')
+    expect(ledger.getUnresolvedKey(attempt.accountScopeKey)).toBeUndefined()
+  })
+
+  it('waits for queued writes before removing an account and retains other accounts', async () => {
+    const { ledger, store, barrier } = setup()
+    const first = ledger.createFresh('first', scope('account-1'))
+    const second = ledger.createFresh('second', scope('account-2'))
+    await ledger.markProviderPending('first', first)
+    const gate = Promise.withResolvers<void>()
+    barrier.mockImplementationOnce(() => gate.promise)
+    const pendingSecond = ledger.markProviderPending('second', second)
+    const removed = ledger.discardForRemovedAccount('account-1')
+    await vi.waitFor(() => expect(barrier).toHaveBeenCalledTimes(2))
+    expect(ledger.get('first')).toBe(first)
+
+    gate.resolve()
+    await Promise.all([pendingSecond, removed])
+    expect(store.getCodexResetCreditAttemptLedger().attempts).toMatchObject([
+      { idempotencyKey: 'second', state: 'providerPending' }
+    ])
+    expect(ledger.get('first')).toBeUndefined()
+    expect(ledger.getUnresolvedKey(first.accountScopeKey)).toBeUndefined()
+    expect(ledger.get('second')).toBe(second)
+  })
+
+  it('retains the removed account guard when its async durability barrier fails', async () => {
+    const { ledger, barrier } = setup()
+    const attempt = ledger.createFresh('first', scope('account-1'))
+    await ledger.markProviderPending('first', attempt)
+    barrier.mockRejectedValueOnce(new Error('disk full'))
+    await expect(ledger.discardForRemovedAccount('account-1')).rejects.toThrow('disk full')
+    expect(ledger.get('first')).toBe(attempt)
+    expect(ledger.getUnresolvedKey(attempt.accountScopeKey)).toBe('first')
+  })
+
+  it('fails queued and future mutations closed when a commit outcome is unknown', async () => {
+    const { ledger, store, barrier } = setup()
+    const attempt = ledger.createFresh('first', scope('account-1'))
+    const second = ledger.createFresh('second', scope('account-2'))
+    const gate = Promise.withResolvers<void>()
+    barrier.mockImplementationOnce(() => gate.promise)
+    const pending = ledger.markProviderPending('first', attempt)
+    const queued = ledger.markProviderPending('second', second)
+    const rejected = expect(pending).rejects.toThrow('worker stopped')
+    const blocked = expect(queued).rejects.toThrow('durability is unknown')
+    await vi.waitFor(() => expect(barrier).toHaveBeenCalledOnce())
+    gate.reject(new ProfileStateWriterError('worker-exit', 'worker stopped', 'indeterminate'))
+    await Promise.all([rejected, blocked])
+
+    ledger.releaseFresh('first', attempt)
+    expect(ledger.get('first')).toBe(attempt)
+    expect(ledger.getClaimedKey(attempt.scopeKey)).toBe('first')
+    expect(store.replaceCodexResetCreditAttemptLedgerAndFlush).toHaveBeenCalledOnce()
+    await expect(ledger.discardForRemovedAccount('account-1')).rejects.toThrow(
+      'durability is unknown'
+    )
+  })
+})
diff --git a/src/main/codex-accounts/codex-reset-credit-ledger.ts b/src/main/codex-accounts/codex-reset-credit-ledger.ts
index 625731f7d38..77590bcfe36 100644
--- a/src/main/codex-accounts/codex-reset-credit-ledger.ts
+++ b/src/main/codex-accounts/codex-reset-credit-ledger.ts
@@ -9,6 +9,7 @@ import type {
   RateLimitRuntimeTarget
 } from '../../shared/rate-limit-types'
 import type { Store } from '../persistence'
+import { profileStateWriterFailureOutcome } from '../persistence/profile-state/profile-state-writer-errors'
 
 export type CodexResetCreditAttempt = {
   expectedScope: CodexResetCreditExpectedScope
@@ -45,14 +46,20 @@ export class CodexResetCreditLedger {
   private readonly attemptKeyByOffer = new Map<string, string>()
   private readonly unresolvedKeyByAccountScope = new Map<string, string>()
   private durableLedger: CodexResetCreditAttemptLedger | null = null
-  private loadError: Error | null = null
+  private stateError: Error | null = null
+  private mutationQueue: Promise<void> = Promise.resolve()
 
-  constructor(private readonly store: Store) {
+  constructor(
+    private readonly store: Pick<
+      Store,
+      'getCodexResetCreditAttemptLedger' | 'replaceCodexResetCreditAttemptLedgerAndFlush'
+    >
+  ) {
     this.hydrate()
   }
 
   get error(): Error | null {
-    return this.loadError
+    return this.stateError
   }
 
   get(idempotencyKey: string): CodexResetCreditAttempt | undefined {
@@ -114,32 +121,40 @@ export class CodexResetCreditLedger {
     )
   }
 
-  markProviderPending(idempotencyKey: string, attempt: CodexResetCreditAttempt): void {
-    this.persist({ idempotencyKey, expectedScope: attempt.expectedScope, state: 'providerPending' })
-    attempt.state = 'providerPending'
-    this.unresolvedKeyByAccountScope.set(attempt.accountScopeKey, idempotencyKey)
+  markProviderPending(idempotencyKey: string, attempt: CodexResetCreditAttempt): Promise<void> {
+    return this.serializeMutation(async () => {
+      await this.persist({
+        idempotencyKey,
+        expectedScope: attempt.expectedScope,
+        state: 'providerPending'
+      })
+      attempt.state = 'providerPending'
+      this.unresolvedKeyByAccountScope.set(attempt.accountScopeKey, idempotencyKey)
+    })
   }
 
   markSettled(
     idempotencyKey: string,
     attempt: CodexResetCreditAttempt,
     outcome: CodexRateLimitResetOutcome
-  ): void {
-    this.persist({
-      idempotencyKey,
-      expectedScope: attempt.expectedScope,
-      state: 'settled',
-      outcome
+  ): Promise<void> {
+    return this.serializeMutation(async () => {
+      await this.persist({
+        idempotencyKey,
+        expectedScope: attempt.expectedScope,
+        state: 'settled',
+        outcome
+      })
+      attempt.state = 'settled'
+      attempt.settledOutcome = outcome
+      if (this.unresolvedKeyByAccountScope.get(attempt.accountScopeKey) === idempotencyKey) {
+        this.unresolvedKeyByAccountScope.delete(attempt.accountScopeKey)
+      }
     })
-    attempt.state = 'settled'
-    attempt.settledOutcome = outcome
-    if (this.unresolvedKeyByAccountScope.get(attempt.accountScopeKey) === idempotencyKey) {
-      this.unresolvedKeyByAccountScope.delete(attempt.accountScopeKey)
-    }
   }
 
   releaseFresh(idempotencyKey: string, attempt: CodexResetCreditAttempt): void {
-    if (attempt.state !== 'fresh') {
+    if (attempt.state !== 'fresh' || this.stateError) {
       return
     }
     this.attemptsByKey.delete(idempotencyKey)
@@ -151,7 +166,11 @@ export class CodexResetCreditLedger {
   // Why: a removed account's managed home is gone, so its unresolved providerPending
   // attempt can never validate or be replayed; drop it so a target-scoped default reset
   // is not wedged forever by hasPendingResetForTarget matching the orphan.
-  discardForRemovedAccount(accountId: string): void {
+  discardForRemovedAccount(accountId: string): Promise<void> {
+    return this.serializeMutation(() => this.discardAccountAttempts(accountId))
+  }
+
+  private async discardAccountAttempts(accountId: string): Promise<void> {
     const staleAttempts = [...this.attemptsByKey].filter(
       ([, attempt]) => attempt.expectedScope.accountId === accountId
     )
@@ -167,7 +186,7 @@ export class CodexResetCreditLedger {
         const nextLedger: CodexResetCreditAttemptLedger = { version: 1, attempts }
         // Persist first so a failed durability barrier leaves the in-memory
         // fail-closed guards aligned with the ledger that will reload.
-        this.store.replaceCodexResetCreditAttemptLedgerAndFlush(nextLedger)
+        await this.store.replaceCodexResetCreditAttemptLedgerAndFlush(nextLedger)
         this.durableLedger = structuredClone(nextLedger)
       }
     }
@@ -202,14 +221,34 @@ export class CodexResetCreditLedger {
         }
       }
     } catch (error) {
-      this.loadError =
+      this.stateError =
         error instanceof Error ? error : new Error('Codex reset-credit attempt ledger is corrupt')
     }
   }
 
-  private persist(nextAttempt: DurableCodexResetCreditAttempt): void {
+  private serializeMutation(operation: () => Promise<void>): Promise<void> {
+    const next = this.mutationQueue.then(async () => {
+      if (this.stateError) {
+        throw this.stateError
+      }
+      try {
+        await operation()
+      } catch (error) {
+        if (profileStateWriterFailureOutcome(error) === 'indeterminate') {
+          this.stateError = new Error('Codex reset-credit attempt durability is unknown', {
+            cause: error
+          })
+        }
+        throw error
+      }
+    })
+    this.mutationQueue = next.catch(() => {})
+    return next
+  }
+
+  private async persist(nextAttempt: DurableCodexResetCreditAttempt): Promise<void> {
     if (!this.durableLedger) {
-      throw this.loadError ?? new Error('Codex reset-credit attempt ledger is unavailable')
+      throw this.stateError ?? new Error('Codex reset-credit attempt ledger is unavailable')
     }
     const index = this.durableLedger.attempts.findIndex(
       (attempt) => attempt.idempotencyKey === nextAttempt.idempotencyKey
@@ -221,7 +260,7 @@ export class CodexResetCreditLedger {
       attempts[index] = nextAttempt
     }
     const nextLedger: CodexResetCreditAttemptLedger = { version: 1, attempts }
-    this.store.replaceCodexResetCreditAttemptLedgerAndFlush(nextLedger)
+    await this.store.replaceCodexResetCreditAttemptLedgerAndFlush(nextLedger)
     this.durableLedger = structuredClone(nextLedger)
   }
 }
diff --git a/src/main/codex-accounts/fs-utils.ts b/src/main/codex-accounts/fs-utils.ts
index e0610cc79c7..295dfac9b66 100644
--- a/src/main/codex-accounts/fs-utils.ts
+++ b/src/main/codex-accounts/fs-utils.ts
@@ -1,6 +1,8 @@
 import { randomUUID } from 'node:crypto'
 import { copyFileSync, existsSync, linkSync, renameSync, rmSync, writeFileSync } from 'node:fs'
+import { rename } from 'node:fs/promises'
 import { dirname } from 'node:path'
+import { setTimeout } from 'node:timers/promises'
 import { grantDirAcl, isPermissionError } from '../win32-utils'
 import { nodeFileContentsEqualSync } from '../../shared/node-file-content-equality'
 
@@ -168,7 +170,7 @@ function assertHardLinkPublicationSupported(sourcePath: string, targetPath: stri
   }
 }
 
-function publishFileWithoutOverwrite(sourcePath: string, targetPath: string): boolean {
+export function publishFileWithoutOverwrite(sourcePath: string, targetPath: string): boolean {
   try {
     linkSync(sourcePath, targetPath)
     return true
@@ -201,19 +203,38 @@ export function renameFileWithWindowsRetry(source: string, target: string): void
   runFileOperationWithWindowsRetry(() => renameSync(source, target))
 }
 
+export async function renameFileWithWindowsRetryAsync(
+  source: string,
+  target: string,
+  isCurrent: () => boolean = () => true
+): Promise<boolean> {
+  for (let attempt = 1; ; attempt++) {
+    if (!isCurrent()) {
+      return false
+    }
+    try {
+      await rename(source, target)
+      return true
+    } catch (error) {
+      if (!shouldRetryFileOperation(error, attempt)) {
+        throw error
+      }
+      await setTimeout(attempt * 50)
+    }
+  }
+}
+
 export function copyFileWithWindowsRetry(source: string, target: string): void {
   runFileOperationWithWindowsRetry(() => copyFileSync(source, target))
 }
 
 function runFileOperationWithWindowsRetry(operation: () => void): void {
-  const maxAttempts = process.platform === 'win32' ? 6 : 1
-  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+  for (let attempt = 1; ; attempt++) {
     try {
       operation()
       return
     } catch (error) {
-      const code = (error as NodeJS.ErrnoException).code
-      if (attempt < maxAttempts && (code === 'EPERM' || code === 'EACCES' || code === 'EBUSY')) {
+      if (shouldRetryFileOperation(error, attempt)) {
         sleepSync(attempt * 50)
         continue
       }
@@ -222,6 +243,16 @@ function runFileOperationWithWindowsRetry(operation: () => void): void {
   }
 }
 
+function shouldRetryFileOperation(error: unknown, attempt: number): boolean {
+  return (
+    process.platform === 'win32' &&
+    attempt < 6 &&
+    error instanceof Error &&
+    'code' in error &&
+    (error.code === 'EPERM' || error.code === 'EACCES' || error.code === 'EBUSY')
+  )
+}
+
 // Why: writeFileAtomically is a sync API called from sync paths, so the retry
 // backoff must park the thread instead of burning CPU in a Date.now() loop.
 const sleepBuffer = new Int32Array(new SharedArrayBuffer(4))
diff --git a/src/main/codex-accounts/managed-codex-auth-readiness.test.ts b/src/main/codex-accounts/managed-codex-auth-readiness.test.ts
index e6354826366..0fbf93adadb 100644
--- a/src/main/codex-accounts/managed-codex-auth-readiness.test.ts
+++ b/src/main/codex-accounts/managed-codex-auth-readiness.test.ts
@@ -220,22 +220,6 @@ describe('waitForManagedCodexAuthReady', () => {
     chmodSync(join(fixture.home, 'auth.json'), 0o000)
     expect(readStoredCodexCredentialState(join(fixture.home, 'auth.json'))).toBe('unreadable')
   })
-
-  it('does not gate system, WSL, or unmanaged custom homes', async () => {
-    const fixture = createFixture()
-    await waitForManagedCodexAuthReady({
-      ...fixture.args,
-      codexHomePath: join(fixture.root, 'custom-home')
-    })
-    await waitForManagedCodexAuthReady({
-      ...fixture.args,
-      target: { runtime: 'wsl', wslDistro: 'Ubuntu' }
-    })
-    await waitForManagedCodexAuthReady({
-      ...fixture.args,
-      codexHomePath: null
-    })
-  })
 })
 
 function createFixture(): {
diff --git a/src/main/codex-accounts/runtime-home-read-only-launch-resolution.test.ts b/src/main/codex-accounts/runtime-home-read-only-launch-resolution.test.ts
index 05deffd4fc2..7a86af57f04 100644
--- a/src/main/codex-accounts/runtime-home-read-only-launch-resolution.test.ts
+++ b/src/main/codex-accounts/runtime-home-read-only-launch-resolution.test.ts
@@ -289,8 +289,7 @@ describe('resolveHostCodexHomePathForLaunchReadOnly', () => {
       resolveStructuredCodexAccountHomePath({
         launchEnv: {},
         resolveLaunchHome: (input) =>
-          service.resolveHostCodexHomePathForLaunchReadOnly(input.launchEnv),
-        workspacePath: ''
+          service.resolveHostCodexHomePathForLaunchReadOnly(input.launchEnv)
       })
     ).resolves.toBe(getSystemCodexHomePath())
   })
diff --git a/src/main/codex-accounts/runtime-home-service-per-account-migration.test.ts b/src/main/codex-accounts/runtime-home-service-per-account-migration.test.ts
index 53736a11beb..4a7ad01e1b5 100644
--- a/src/main/codex-accounts/runtime-home-service-per-account-migration.test.ts
+++ b/src/main/codex-accounts/runtime-home-service-per-account-migration.test.ts
@@ -6,6 +6,7 @@ import type { GlobalSettings } from '../../shared/global-settings-types'
 import type { CodexManagedAccount } from '../../shared/managed-account-types'
 import type * as NodeOs from 'node:os'
 import { readHookTrustEntries } from '../codex/config-toml-trust'
+import { writeCodexStateDbBackfillStatus } from '../codex/codex-state-db-test-fixture'
 
 const testState = { userData: '', home: '' }
 const previousEnv: Record<string, string | undefined> = {}
@@ -15,6 +16,17 @@ vi.mock('node:os', async () => {
   const actual = await vi.importActual<typeof NodeOs>('node:os')
   return { ...actual, homedir: () => testState.home }
 })
+// Why: selecting an account starts the history bridge, which would otherwise
+// spawn the real `codex app-server` on these fixture homes.
+vi.mock('../codex/codex-account-session-index-heal', () => ({
+  createCodexAccountStateDb: async () => false,
+  healCodexAccountSessionIndex: async () => ({
+    outcome: 'up-to-date',
+    healedThreads: 0,
+    missingThreads: 0,
+    failedThreads: 0
+  })
+}))
 
 beforeEach(() => {
   vi.resetModules()
@@ -212,6 +224,8 @@ describe('CodexRuntimeHomeService per-account takeover composition', () => {
     const siblingRollout = join('2026', '07', '21', 'rollout-2026-07-21T10-00-00-bbbb.jsonl')
     writeRollout(systemHome(), systemRollout, '{"session":"real-home"}\n')
     writeRollout(accountOne.managedHomePath, siblingRollout, '{"session":"account-one"}\n')
+    // Why: history is linked only once Codex has indexed the new home (#20669).
+    writeCodexStateDbBackfillStatus(accountTwo.managedHomePath, 'complete')
     const { settings, store } = createStore([accountOne, accountTwo], accountOne.id)
     const { CodexRuntimeHomeService } = await import('./runtime-home-service')
     const bridge = await import('../codex/codex-account-session-bridge')
diff --git a/src/main/codex-accounts/service-account-selection-and-removal.test.ts b/src/main/codex-accounts/service-account-selection-and-removal.test.ts
index a2d7d9a4bb7..861859223ea 100644
--- a/src/main/codex-accounts/service-account-selection-and-removal.test.ts
+++ b/src/main/codex-accounts/service-account-selection-and-removal.test.ts
@@ -215,47 +215,67 @@ describe('CodexAccountService config sync', () => {
     })
   })
 
-  it('removes an account and cleans up managed home', async () => {
-    const managedHomePath = createManagedHome(
-      testState.userDataDir,
-      'account-1',
-      '',
-      '{"account":"managed"}\n'
-    )
-    const settings = createSettings({
-      codexManagedAccounts: [
-        {
-          id: 'account-1',
-          email: 'user@example.com',
-          managedHomePath,
-          providerAccountId: null,
-          workspaceLabel: null,
-          workspaceAccountId: null,
-          createdAt: 1,
-          updatedAt: 1,
-          lastAuthenticatedAt: 1
-        }
-      ],
-      activeCodexManagedAccountId: 'account-1'
-    })
-    const store = createStore(settings)
-    const rateLimits = createRateLimits()
-    const runtimeHome = createRuntimeHome()
+  it.each(['healthy', 'unreadable'])(
+    'removes an account with a %s credit ledger',
+    async (ledger) => {
+      const managedHomePath = createManagedHome(
+        testState.userDataDir,
+        'account-1',
+        '',
+        '{"account":"managed"}\n'
+      )
+      const settings = createSettings({
+        codexManagedAccounts: [
+          {
+            id: 'account-1',
+            email: 'user@example.com',
+            managedHomePath,
+            providerAccountId: null,
+            workspaceLabel: null,
+            workspaceAccountId: null,
+            createdAt: 1,
+            updatedAt: 1,
+            lastAuthenticatedAt: 1
+          }
+        ],
+        activeCodexManagedAccountId: 'account-1'
+      })
+      const store = createStore(settings)
+      const rateLimits = createRateLimits()
+      const runtimeHome = createRuntimeHome()
 
-    const { CodexAccountService } = await import('./service')
-    const service = new CodexAccountService(
-      store as never,
-      rateLimits as never,
-      runtimeHome as never
-    )
+      const ledgerError = new Error('credit ledger unreadable')
+      if (ledger === 'unreadable') {
+        store.getCodexResetCreditAttemptLedger.mockImplementation(() => {
+          throw ledgerError
+        })
+      }
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
 
-    const result = await service.removeAccount('account-1')
+      const { CodexAccountService } = await import('./service')
+      const service = new CodexAccountService(
+        store as never,
+        rateLimits as never,
+        runtimeHome as never
+      )
 
-    expect(result.accounts).toHaveLength(0)
-    expect(result.activeAccountId).toBe(null)
-    expect(existsSync(managedHomePath)).toBe(false)
-    expect(runtimeHome.syncForCurrentSelection).toHaveBeenCalled()
-  })
+      const result = await service.removeAccount('account-1')
+
+      expect(result.accounts).toHaveLength(0)
+      expect(result.activeAccountId).toBe(null)
+      expect(existsSync(managedHomePath)).toBe(false)
+      expect(runtimeHome.syncForCurrentSelection).toHaveBeenCalled()
+      expect(rateLimits.evictInactiveCodexCache).toHaveBeenCalledWith('account-1')
+      if (ledger === 'unreadable') {
+        expect(warn).toHaveBeenCalledWith(
+          '[codex-accounts] Removed account, but credit ledger cleanup failed:',
+          expect.any(Error)
+        )
+        expect(store.replaceCodexResetCreditAttemptLedgerAndFlush).not.toHaveBeenCalled()
+      }
+      warn.mockRestore()
+    }
+  )
 
   it('refuses to remove a managed home owned by a different account', async () => {
     const otherAccountHome = createManagedHome(
diff --git a/src/main/codex-accounts/service-reset-credit-durability.test.ts b/src/main/codex-accounts/service-reset-credit-durability.test.ts
index ac6cd8f2ef7..e524bda2aeb 100644
--- a/src/main/codex-accounts/service-reset-credit-durability.test.ts
+++ b/src/main/codex-accounts/service-reset-credit-durability.test.ts
@@ -146,9 +146,22 @@ describe('CodexAccountService config sync', () => {
       account,
       limits
     })!
+    const store = createStore(settings)
+    const persist = store.replaceCodexResetCreditAttemptLedgerAndFlush.getMockImplementation()!
+    const pendingCommit = Promise.withResolvers<void>()
+    const settledCommit = Promise.withResolvers<void>()
+    store.replaceCodexResetCreditAttemptLedgerAndFlush
+      .mockImplementationOnce(async (ledger) => {
+        await pendingCommit.promise
+        await persist(ledger)
+      })
+      .mockImplementationOnce(async (ledger) => {
+        await settledCommit.promise
+        await persist(ledger)
+      })
     const { CodexAccountService } = await import('./service')
     const service = new CodexAccountService(
-      createStore(settings) as never,
+      store as never,
       rateLimits as never,
       createRuntimeHome() as never
     )
@@ -157,9 +170,20 @@ describe('CodexAccountService config sync', () => {
     const first = service.consumeRateLimitResetCredit(idempotencyKey, expectedScope)
     const second = service.consumeRateLimitResetCredit(idempotencyKey, expectedScope)
     expect(second).toBe(first)
+    await vi.waitFor(() =>
+      expect(store.replaceCodexResetCreditAttemptLedgerAndFlush).toHaveBeenCalledOnce()
+    )
+    expect(consume).not.toHaveBeenCalled()
+    pendingCommit.resolve()
     await vi.waitFor(() => expect(consume).toHaveBeenCalledOnce())
     const selectingNextAccount = service.selectAccount(nextAccount.id)
     finishConsume?.({ outcome: 'reset', state })
+    await vi.waitFor(() =>
+      expect(store.replaceCodexResetCreditAttemptLedgerAndFlush).toHaveBeenCalledTimes(2)
+    )
+    expect(service.listAccounts().activeAccountId).toBe(account.id)
+    expect(store.getCodexResetCreditAttemptLedger().attempts[0]?.state).toBe('providerPending')
+    settledCommit.resolve()
 
     const resetResults = await Promise.all([first, second])
     expect(resetResults).toMatchObject([
@@ -406,9 +430,10 @@ describe('CodexAccountService config sync', () => {
     const limits = createResetCreditLimits()
     const state = createResetRateLimitState(limits)
     const store = createStore(settings)
-    store.replaceCodexResetCreditAttemptLedgerAndFlush.mockImplementationOnce(() => {
-      throw new Error('disk full')
-    })
+    const pendingCommit = Promise.withResolvers<void>()
+    store.replaceCodexResetCreditAttemptLedgerAndFlush.mockImplementationOnce(
+      () => pendingCommit.promise
+    )
     const consume = vi.fn()
     const expectedScope = buildCodexResetCreditExpectedScope({
       target: state.codexTarget,
@@ -426,9 +451,15 @@ describe('CodexAccountService config sync', () => {
       createRuntimeHome() as never
     )
 
-    await expect(
+    const rejected = expect(
       service.consumeRateLimitResetCredit('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb', expectedScope)
     ).rejects.toThrow('disk full')
+    await vi.waitFor(() =>
+      expect(store.replaceCodexResetCreditAttemptLedgerAndFlush).toHaveBeenCalledOnce()
+    )
+    expect(consume).not.toHaveBeenCalled()
+    pendingCommit.reject(new Error('disk full'))
+    await rejected
     expect(consume).not.toHaveBeenCalled()
     expect(store.getCodexResetCreditAttemptLedger().attempts).toEqual([])
   })
@@ -453,11 +484,11 @@ describe('CodexAccountService config sync', () => {
     const state = createResetRateLimitState(limits)
     const store = createStore(settings)
     const persist = store.replaceCodexResetCreditAttemptLedgerAndFlush.getMockImplementation()!
-    store.replaceCodexResetCreditAttemptLedgerAndFlush.mockImplementation((ledger) => {
+    store.replaceCodexResetCreditAttemptLedgerAndFlush.mockImplementation(async (ledger) => {
       if (ledger.attempts[0]?.state === 'settled') {
         throw new Error('settle disk full')
       }
-      persist(ledger)
+      return persist(ledger)
     })
     const expectedScope = buildCodexResetCreditExpectedScope({
       target: state.codexTarget,
diff --git a/src/main/codex-accounts/service-reset-credit-home-ownership.test.ts b/src/main/codex-accounts/service-reset-credit-home-ownership.test.ts
index b5c534be417..eebc256a8c6 100644
--- a/src/main/codex-accounts/service-reset-credit-home-ownership.test.ts
+++ b/src/main/codex-accounts/service-reset-credit-home-ownership.test.ts
@@ -145,7 +145,7 @@ describe('Codex reset-credit managed-home ownership', () => {
           }
         ]
       }
-      fixture.store.replaceCodexResetCreditAttemptLedgerAndFlush(pendingLedger)
+      await fixture.store.replaceCodexResetCreditAttemptLedgerAndFlush(pendingLedger)
       makeHomeUnsafe(fixture.managedHomePath)
 
       const settingsBefore = structuredClone(fixture.store.getSettings())
diff --git a/src/main/codex-accounts/service-reset-credit-target-routing.test.ts b/src/main/codex-accounts/service-reset-credit-target-routing.test.ts
index ebfe4e3ac1c..1485794c5f9 100644
--- a/src/main/codex-accounts/service-reset-credit-target-routing.test.ts
+++ b/src/main/codex-accounts/service-reset-credit-target-routing.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it, vi } from 'vitest'
+import { existsSync } from 'node:fs'
 import { buildCodexResetCreditExpectedScope } from '../../shared/codex-reset-credit-scope'
 import {
   createManagedHome,
@@ -329,7 +330,7 @@ describe('CodexAccountService config sync', () => {
       limits
     })!
     const store = createStore(settings)
-    store.replaceCodexResetCreditAttemptLedgerAndFlush({
+    await store.replaceCodexResetCreditAttemptLedgerAndFlush({
       version: 1,
       attempts: [
         {
@@ -379,7 +380,7 @@ describe('CodexAccountService config sync', () => {
       limits
     })!
     const store = createStore(settings)
-    store.replaceCodexResetCreditAttemptLedgerAndFlush({
+    await store.replaceCodexResetCreditAttemptLedgerAndFlush({
       version: 1,
       attempts: [
         {
@@ -414,7 +415,7 @@ describe('CodexAccountService config sync', () => {
     expect(store.getCodexResetCreditAttemptLedger().attempts).toEqual([])
   })
 
-  it('keeps reset attempts fail-closed when removal cannot persist their purge', async () => {
+  it('reports account removal while keeping reset attempts guarded after a failed purge', async () => {
     const managedHomePath = createManagedHome(testState.userDataDir, 'account-1')
     const account = {
       id: 'account-1',
@@ -438,7 +439,7 @@ describe('CodexAccountService config sync', () => {
       limits
     })!
     const store = createStore(settings)
-    store.replaceCodexResetCreditAttemptLedgerAndFlush({
+    await store.replaceCodexResetCreditAttemptLedgerAndFlush({
       version: 1,
       attempts: [
         {
@@ -459,11 +460,17 @@ describe('CodexAccountService config sync', () => {
       } as never,
       createRuntimeHome() as never
     )
-    vi.spyOn(store, 'replaceCodexResetCreditAttemptLedgerAndFlush').mockImplementationOnce(() => {
-      throw new Error('disk full')
-    })
+    const failure = new Error('disk full')
+    const warning = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    vi.spyOn(store, 'replaceCodexResetCreditAttemptLedgerAndFlush').mockRejectedValueOnce(failure)
 
-    await expect(service.removeAccount('account-1')).rejects.toThrow('disk full')
+    await expect(service.removeAccount('account-1')).resolves.toMatchObject({ accounts: [] })
+    expect(store.getSettings().codexManagedAccounts).toEqual([])
+    expect(existsSync(managedHomePath)).toBe(false)
+    expect(warning).toHaveBeenCalledWith(
+      '[codex-accounts] Removed account, but credit ledger cleanup failed:',
+      failure
+    )
     await expect(service.consumeCurrentRateLimitResetCredit()).rejects.toThrow('unknown outcome')
     expect(consume).not.toHaveBeenCalled()
   })
diff --git a/src/main/codex-accounts/service-test-harness.ts b/src/main/codex-accounts/service-test-harness.ts
index 4587788ec67..8b81cb2125f 100644
--- a/src/main/codex-accounts/service-test-harness.ts
+++ b/src/main/codex-accounts/service-test-harness.ts
@@ -56,9 +56,11 @@ export function createStore(settings: GlobalSettings) {
       return settings
     }),
     getCodexResetCreditAttemptLedger: vi.fn(() => structuredClone(resetLedger)),
-    replaceCodexResetCreditAttemptLedgerAndFlush: vi.fn((next: CodexResetCreditAttemptLedger) => {
-      resetLedger = structuredClone(next)
-    })
+    replaceCodexResetCreditAttemptLedgerAndFlush: vi.fn(
+      async (next: CodexResetCreditAttemptLedger) => {
+        resetLedger = structuredClone(next)
+      }
+    )
   }
 }
 
diff --git a/src/main/codex-cli/codex-home-process-lock.ts b/src/main/codex-cli/codex-home-process-lock.ts
index ef91a5705d9..63b64deaf8e 100644
--- a/src/main/codex-cli/codex-home-process-lock.ts
+++ b/src/main/codex-cli/codex-home-process-lock.ts
@@ -17,12 +17,15 @@ export function resolveCodexHomeProcessLockKey(codexHomePath?: string | null): s
 
 export function resolveCodexHomeProcessLockKeyForSpawnEnv(
   env: NodeJS.ProcessEnv | undefined,
-  wslDistro?: string | null
+  wslDistro?: string | null,
+  commandEnv?: Record<string, string>
 ): string {
   if (wslDistro) {
     // buildWslLauncherEnv forwards only explicit values that differ from the
     // host process; all other cases use the distro user's default home.
-    const codexHome = env?.CODEX_HOME !== process.env.CODEX_HOME ? (env?.CODEX_HOME ?? null) : null
+    const codexHome =
+      commandEnv?.CODEX_HOME ??
+      (env?.CODEX_HOME !== process.env.CODEX_HOME ? (env?.CODEX_HOME ?? null) : null)
     // Why: WSL spawns carry a Linux CODEX_HOME; key it through the same UNC
     // normalization the probe's \\wsl$ home path uses so both lanes collide.
     // Without an explicit home the distro default is unknowable from the host;
diff --git a/src/main/codex-usage/codex-session-file-discovery.ts b/src/main/codex-usage/codex-session-file-discovery.ts
index 946f9f1838c..bf2595fc340 100644
--- a/src/main/codex-usage/codex-session-file-discovery.ts
+++ b/src/main/codex-usage/codex-session-file-discovery.ts
@@ -138,8 +138,9 @@ async function getCodexSessionFileAliasKey(filePath: string): Promise<string> {
 
 async function getPhysicalFileAliasKey(filePath: string): Promise<string> {
   try {
-    const fileStat = await stat(filePath)
-    if (fileStat.ino !== 0) {
+    // Windows file IDs can exceed the precision of JavaScript numbers.
+    const fileStat = await stat(filePath, { bigint: true })
+    if (fileStat.ino !== 0n) {
       return `${fileStat.dev}:${fileStat.ino}`
     }
   } catch {}
diff --git a/src/main/codex-usage/scanner-file-identity.test.ts b/src/main/codex-usage/scanner-file-identity.test.ts
new file mode 100644
index 00000000000..f0d85076457
--- /dev/null
+++ b/src/main/codex-usage/scanner-file-identity.test.ts
@@ -0,0 +1,183 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { linkSync, mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
+import type { PathLike } from 'node:fs'
+import type * as FsPromises from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+const fixture = vi.hoisted(() => ({
+  root: '',
+  identities: new Map<string, { dev: bigint; ino: bigint }>(),
+  statErrors: new Set<string>(),
+  realpathErrors: new Set<string>()
+}))
+
+vi.mock('node:fs/promises', async () => {
+  const actual = await vi.importActual<typeof FsPromises>('node:fs/promises')
+  return {
+    ...actual,
+    stat: async (filePath: PathLike, options?: { bigint?: boolean }) => {
+      const path = String(filePath)
+      if (fixture.statErrors.has(path)) {
+        throw new Error('Fixture stat unavailable')
+      }
+      const identity = fixture.identities.get(path)
+      if (options?.bigint) {
+        const stats = await actual.stat(filePath, { bigint: true })
+        return identity ? Object.assign(stats, identity) : stats
+      }
+      const stats = await actual.stat(filePath)
+      return identity
+        ? Object.assign(stats, { dev: Number(identity.dev), ino: Number(identity.ino) })
+        : stats
+    },
+    realpath: async (filePath: PathLike) => {
+      if (fixture.realpathErrors.has(String(filePath))) {
+        throw new Error('Fixture realpath unavailable')
+      }
+      return actual.realpath(filePath)
+    }
+  }
+})
+
+vi.mock('../codex/codex-home-paths', () => ({
+  getOrcaManagedCodexHomePath: () => join(fixture.root, 'runtime'),
+  getSystemCodexHomePath: () => join(fixture.root, 'system')
+}))
+
+vi.mock('../codex/codex-account-home-discovery', () => ({
+  getCodexAccountHomeSessionDirectories: () => []
+}))
+
+vi.mock('../codex/codex-session-bridge', () => ({
+  getLegacyCopiedCodexSessionBridgeScanPreference: () => null
+}))
+
+import { listCodexSessionFiles } from './codex-session-file-discovery'
+import { scanCodexUsageFiles } from './scanner'
+
+function writeSession(name: string, tokens = 10): string {
+  const filePath = join(fixture.root, 'runtime', 'sessions', `${name}.jsonl`)
+  const records = [
+    { type: 'session_meta', payload: { id: name, cwd: fixture.root } },
+    {
+      timestamp: '2026-09-20T12:00:00.000Z',
+      type: 'event_msg',
+      payload: {
+        type: 'token_count',
+        info: {
+          model: 'gpt-5-codex',
+          last_token_usage: { input_tokens: tokens, total_tokens: tokens }
+        }
+      }
+    }
+  ]
+  writeFileSync(filePath, `${records.map((record) => JSON.stringify(record)).join('\n')}\n`)
+  return filePath
+}
+
+beforeEach(() => {
+  fixture.root = mkdtempSync(join(tmpdir(), 'orca-codex-file-identity-'))
+  mkdirSync(join(fixture.root, 'runtime', 'sessions'), { recursive: true })
+  fixture.identities.clear()
+  fixture.statErrors.clear()
+  fixture.realpathErrors.clear()
+})
+
+afterEach(() => {
+  rmSync(fixture.root, { recursive: true, force: true })
+})
+
+describe('Codex session physical file identity', () => {
+  it('keeps adjacent large inode IDs distinct when numeric stats would round them together', async () => {
+    const first = writeSession('first')
+    const second = writeSession('second')
+    const firstIno = 2n ** 53n
+    const secondIno = firstIno + 1n
+    expect(Number(firstIno)).toBe(Number(secondIno))
+    fixture.identities.set(first, { dev: 1n, ino: firstIno })
+    fixture.identities.set(second, { dev: 1n, ino: secondIno })
+
+    expect(await listCodexSessionFiles()).toEqual([first, second])
+  })
+
+  it('keeps the device part of the identity exact too', async () => {
+    const first = writeSession('first')
+    const second = writeSession('second')
+    fixture.identities.set(first, { dev: 2n ** 53n, ino: 7n })
+    fixture.identities.set(second, { dev: 2n ** 53n + 1n, ino: 7n })
+
+    expect(await listCodexSessionFiles()).toEqual([first, second])
+  })
+
+  it('counts both distinct sessions and preserves numeric timestamps, sizes and cache reuse', async () => {
+    const first = writeSession('first', 10)
+    const second = writeSession('second', 20)
+    fixture.identities.set(first, { dev: 1n, ino: 2n ** 53n })
+    fixture.identities.set(second, { dev: 1n, ino: 2n ** 53n + 1n })
+
+    const result = await scanCodexUsageFiles([], [])
+    expect(result.dailyAggregates.reduce((total, row) => total + row.totalTokens, 0)).toBe(30)
+    expect(result.sessions).toHaveLength(2)
+    const actual = await vi.importActual<typeof FsPromises>('node:fs/promises')
+    for (const file of result.processedFiles) {
+      const stats = await actual.stat(file.path)
+      expect(file.mtimeMs).toBe(stats.mtimeMs)
+      expect(file.size).toBe(stats.size)
+    }
+    const cached = await scanCodexUsageFiles([], result.processedFiles)
+    expect(cached.dailyAggregates).toEqual(result.dailyAggregates)
+    expect(cached.processedFiles[0]).toBe(result.processedFiles[0])
+    expect(cached.processedFiles[1]).toBe(result.processedFiles[1])
+  })
+
+  it('deduplicates real hardlink aliases across session homes', async () => {
+    const original = writeSession('original')
+    mkdirSync(join(fixture.root, 'system', 'sessions'), { recursive: true })
+    const alias = join(fixture.root, 'system', 'sessions', 'alias.jsonl')
+    linkSync(original, alias)
+
+    expect(await listCodexSessionFiles()).toEqual([original, alias].sort().slice(0, 1))
+    const result = await scanCodexUsageFiles([], [])
+    expect(result.dailyAggregates.reduce((total, row) => total + row.totalTokens, 0)).toBe(10)
+  })
+
+  it('does not collapse distinct zero-inode files', async () => {
+    const first = writeSession('first')
+    const second = writeSession('second')
+    fixture.identities.set(first, { dev: 1n, ino: 0n })
+    fixture.identities.set(second, { dev: 1n, ino: 0n })
+
+    expect(await listCodexSessionFiles()).toEqual([first, second])
+  })
+
+  it.each(['zero inode', 'stat failure'])('deduplicates canonical paths after %s', async (mode) => {
+    const original = writeSession('original')
+    symlinkSync(
+      join(fixture.root, 'runtime'),
+      join(fixture.root, 'system'),
+      process.platform === 'win32' ? 'junction' : 'dir'
+    )
+    const alias = join(fixture.root, 'system', 'sessions', 'original.jsonl')
+    for (const path of [original, alias]) {
+      if (mode === 'zero inode') {
+        fixture.identities.set(path, { dev: 1n, ino: 0n })
+      } else {
+        fixture.statErrors.add(path)
+      }
+    }
+
+    expect(await listCodexSessionFiles()).toEqual([original, alias].sort().slice(0, 1))
+  })
+
+  it('preserves path spelling when both stat and realpath are unavailable', async () => {
+    const first = writeSession('MiXeD-first')
+    const second = writeSession('MiXeD-second')
+    for (const path of [first, second]) {
+      fixture.statErrors.add(path)
+      fixture.realpathErrors.add(path)
+    }
+
+    expect(await listCodexSessionFiles()).toEqual([first, second])
+  })
+})
diff --git a/src/main/codex-usage/store.ts b/src/main/codex-usage/store.ts
index f11121f5d0d..7e91fb3945a 100644
--- a/src/main/codex-usage/store.ts
+++ b/src/main/codex-usage/store.ts
@@ -1,3 +1,4 @@
+import { codexOpenCodeTokenSessions } from '../usage/agent-token-usage'
 import { app } from 'electron'
 import { join } from 'node:path'
 import type {
@@ -84,6 +85,10 @@ export class CodexUsageStore extends UsageProviderStoreLifecycle<
 > {
   constructor(store: Pick<Store, 'getRepos' | 'getAllWorktreeMeta'>) {
     super(store, {
+      tokenUsage: {
+        provider: 'codex',
+        selectSessions: (state) => codexOpenCodeTokenSessions(state.sessions)
+      },
       logTag: '[codex-usage]',
       resolveCacheFile: getCodexUsageFile,
       createDefaultState: getDefaultState,
diff --git a/src/main/codex/__fixtures__/codex-app-server-turn-endings.jsonl b/src/main/codex/__fixtures__/codex-app-server-turn-endings.jsonl
new file mode 100644
index 00000000000..7889b24d113
--- /dev/null
+++ b/src/main/codex/__fixtures__/codex-app-server-turn-endings.jsonl
@@ -0,0 +1,172 @@
+{"case":"0.141.0-bad-model","t":371,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000001","status":{"type":"active"}}}
+{"case":"0.141.0-bad-model","t":371,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000001","turn":{"id":"00000000-0000-7000-8000-000000000002","status":"inProgress"}}}
+{"case":"0.141.0-bad-model","t":1745,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000001","turnId":"00000000-0000-7000-8000-000000000002","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000003","clientId":null,"content":[]}}}
+{"case":"0.141.0-bad-model","t":1745,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000001","turnId":"00000000-0000-7000-8000-000000000002","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000003","clientId":null,"content":[]}}}
+{"case":"0.141.0-bad-model","t":2831,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000001","status":{"type":"systemError"}}}
+{"case":"0.141.0-bad-model","t":2831,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000001","turnId":"00000000-0000-7000-8000-000000000002","willRetry":false,"error":{"message":"{\"type\":\"error\",\"status\":400,\"error\":{\"type\":\"invalid_request_error\",\"message\":\"The 'gpt-qa-nonexistent' model is not supported when using Codex with a ChatGPT account.\"}}","codexErrorInfo":"other"}}}
+{"case":"0.141.0-bad-model","t":2831,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000001","turn":{"id":"00000000-0000-7000-8000-000000000002","status":"failed","error":{"message":"{\"type\":\"error\",\"status\":400,\"error\":{\"type\":\"invalid_request_error\",\"message\":\"The 'gpt-qa-nonexistent' model is not supported when using Codex with a ChatGPT account.\"}}","codexErrorInfo":"other"},"durationMs":2488}}}
+{"case":"0.141.0-bad-turn-cwd","t":1458,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000004","status":{"type":"active"}}}
+{"case":"0.141.0-bad-turn-cwd","t":1458,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000004","turn":{"id":"00000000-0000-7000-8000-000000000005","status":"inProgress"}}}
+{"case":"0.141.0-bad-turn-cwd","t":5792,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000004","turnId":"00000000-0000-7000-8000-000000000005","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000006","clientId":null,"content":[]}}}
+{"case":"0.141.0-bad-turn-cwd","t":5792,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000004","turnId":"00000000-0000-7000-8000-000000000005","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000006","clientId":null,"content":[]}}}
+{"case":"0.141.0-bad-turn-cwd","t":7645,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000004","turnId":"00000000-0000-7000-8000-000000000005","item":{"type":"agentMessage","id":"msg_1","text":""}}}
+{"case":"0.141.0-bad-turn-cwd","t":7938,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000004","turnId":"00000000-0000-7000-8000-000000000005","item":{"type":"agentMessage","id":"msg_1","text":"pong"}}}
+{"case":"0.141.0-bad-turn-cwd","t":7959,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000004","status":{"type":"idle"}}}
+{"case":"0.141.0-bad-turn-cwd","t":7959,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000004","turn":{"id":"00000000-0000-7000-8000-000000000005","status":"completed","durationMs":6532}}}
+{"case":"0.141.0-compact-overloaded","t":582,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000007","status":{"type":"active"}}}
+{"case":"0.141.0-compact-overloaded","t":582,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000007","turn":{"id":"00000000-0000-7000-8000-000000000008","status":"inProgress"}}}
+{"case":"0.141.0-compact-overloaded","t":2940,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000007","turnId":"00000000-0000-7000-8000-000000000008","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000009","clientId":null,"content":[]}}}
+{"case":"0.141.0-compact-overloaded","t":2940,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000007","turnId":"00000000-0000-7000-8000-000000000008","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000009","clientId":null,"content":[]}}}
+{"case":"0.141.0-compact-overloaded","t":3011,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000007","turnId":"00000000-0000-7000-8000-000000000008","item":{"type":"agentMessage","id":"msg_ok","text":"pong"}}}
+{"case":"0.141.0-compact-overloaded","t":3011,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000007","turnId":"00000000-0000-7000-8000-000000000008","item":{"type":"agentMessage","id":"msg_ok","text":"pong"}}}
+{"case":"0.141.0-compact-overloaded","t":3017,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000007","status":{"type":"idle"}}}
+{"case":"0.141.0-compact-overloaded","t":3017,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000007","turn":{"id":"00000000-0000-7000-8000-000000000008","status":"completed","durationMs":2474}}}
+{"case":"0.141.0-compact-overloaded","t":3076,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000007","status":{"type":"active"}}}
+{"case":"0.141.0-compact-overloaded","t":3076,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000007","turn":{"id":"00000000-0000-7000-8000-000000000010","status":"inProgress"}}}
+{"case":"0.141.0-compact-overloaded","t":3081,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000007","turnId":"00000000-0000-7000-8000-000000000010","item":{"type":"contextCompaction","id":"00000000-0000-7000-8000-000000000011"}}}
+{"case":"0.141.0-compact-overloaded","t":3684,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000007","turnId":"00000000-0000-7000-8000-000000000010","willRetry":true,"error":{"message":"Reconnecting... 1/2","codexErrorInfo":{"responseStreamDisconnected":{"httpStatusCode":null}},"additionalDetails":"Selected model is at capacity. Please try a different model."}}}
+{"case":"0.141.0-compact-overloaded","t":4508,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000007","turnId":"00000000-0000-7000-8000-000000000010","willRetry":true,"error":{"message":"Reconnecting... 2/2","codexErrorInfo":{"responseStreamDisconnected":{"httpStatusCode":null}},"additionalDetails":"Selected model is at capacity. Please try a different model."}}}
+{"case":"0.141.0-compact-overloaded","t":5511,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000007","status":{"type":"systemError"}}}
+{"case":"0.141.0-compact-overloaded","t":5511,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000007","turnId":"00000000-0000-7000-8000-000000000010","willRetry":false,"error":{"message":"Selected model is at capacity. Please try a different model.","codexErrorInfo":"serverOverloaded"}}}
+{"case":"0.141.0-compact-overloaded","t":5511,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000007","turn":{"id":"00000000-0000-7000-8000-000000000010","status":"failed","error":{"message":"Selected model is at capacity. Please try a different model.","codexErrorInfo":"serverOverloaded"},"durationMs":2435}}}
+{"case":"0.141.0-conn-refused","t":588,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000012","status":{"type":"active"}}}
+{"case":"0.141.0-conn-refused","t":588,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000012","turn":{"id":"00000000-0000-7000-8000-000000000013","status":"inProgress"}}}
+{"case":"0.141.0-conn-refused","t":700,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000012","turnId":"00000000-0000-7000-8000-000000000013","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000014","clientId":null,"content":[]}}}
+{"case":"0.141.0-conn-refused","t":700,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000012","turnId":"00000000-0000-7000-8000-000000000013","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000014","clientId":null,"content":[]}}}
+{"case":"0.141.0-conn-refused","t":1354,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000012","turnId":"00000000-0000-7000-8000-000000000013","willRetry":true,"error":{"message":"Reconnecting... 1/2","codexErrorInfo":{"responseStreamDisconnected":{"httpStatusCode":null}},"additionalDetails":"stream disconnected before completion: error sending request for url (http://127.0.0.1:9/v1/responses)"}}}
+{"case":"0.141.0-conn-refused","t":2134,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000012","turnId":"00000000-0000-7000-8000-000000000013","willRetry":true,"error":{"message":"Reconnecting... 2/2","codexErrorInfo":{"responseStreamDisconnected":{"httpStatusCode":null}},"additionalDetails":"stream disconnected before completion: error sending request for url (http://127.0.0.1:9/v1/responses)"}}}
+{"case":"0.141.0-conn-refused","t":3116,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000012","status":{"type":"systemError"}}}
+{"case":"0.141.0-conn-refused","t":3116,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000012","turnId":"00000000-0000-7000-8000-000000000013","willRetry":false,"error":{"message":"stream disconnected before completion: error sending request for url (http://127.0.0.1:9/v1/responses)","codexErrorInfo":"other"}}}
+{"case":"0.141.0-conn-refused","t":3116,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000012","turn":{"id":"00000000-0000-7000-8000-000000000013","status":"failed","error":{"message":"stream disconnected before completion: error sending request for url (http://127.0.0.1:9/v1/responses)","codexErrorInfo":"other"},"durationMs":2556}}}
+{"case":"0.141.0-control","t":487,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000015","status":{"type":"active"}}}
+{"case":"0.141.0-control","t":487,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000015","turn":{"id":"00000000-0000-7000-8000-000000000016","status":"inProgress"}}}
+{"case":"0.141.0-control","t":2657,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000015","turnId":"00000000-0000-7000-8000-000000000016","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000017","clientId":null,"content":[]}}}
+{"case":"0.141.0-control","t":2657,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000015","turnId":"00000000-0000-7000-8000-000000000016","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000017","clientId":null,"content":[]}}}
+{"case":"0.141.0-control","t":4651,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000015","turnId":"00000000-0000-7000-8000-000000000016","item":{"type":"agentMessage","id":"msg_2","text":""}}}
+{"case":"0.141.0-control","t":4661,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000015","turnId":"00000000-0000-7000-8000-000000000016","item":{"type":"agentMessage","id":"msg_2","text":"pong"}}}
+{"case":"0.141.0-control","t":4811,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000015","status":{"type":"idle"}}}
+{"case":"0.141.0-control","t":4811,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000015","turn":{"id":"00000000-0000-7000-8000-000000000016","status":"completed","durationMs":4351}}}
+{"case":"0.141.0-interrupt","t":670,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000018","status":{"type":"active"}}}
+{"case":"0.141.0-interrupt","t":670,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000018","turn":{"id":"00000000-0000-7000-8000-000000000019","status":"inProgress"}}}
+{"case":"0.141.0-interrupt","t":2618,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000018","turnId":"00000000-0000-7000-8000-000000000019","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000020","clientId":null,"content":[]}}}
+{"case":"0.141.0-interrupt","t":2618,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000018","turnId":"00000000-0000-7000-8000-000000000019","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000020","clientId":null,"content":[]}}}
+{"case":"0.141.0-interrupt","t":4153,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000018","turnId":"00000000-0000-7000-8000-000000000019","item":{"type":"agentMessage","id":"msg_3","text":""}}}
+{"case":"0.141.0-interrupt","t":5669,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000018","status":{"type":"idle"}}}
+{"case":"0.141.0-interrupt","t":5669,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000018","turn":{"id":"00000000-0000-7000-8000-000000000019","status":"interrupted","durationMs":5027}}}
+{"case":"0.141.0-model-too-new-a","t":1276,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000021","status":{"type":"active"}}}
+{"case":"0.141.0-model-too-new-a","t":1276,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000021","turn":{"id":"00000000-0000-7000-8000-000000000022","status":"inProgress"}}}
+{"case":"0.141.0-model-too-new-a","t":6105,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000021","turnId":"00000000-0000-7000-8000-000000000022","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000023","clientId":null,"content":[]}}}
+{"case":"0.141.0-model-too-new-a","t":6105,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000021","turnId":"00000000-0000-7000-8000-000000000022","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000023","clientId":null,"content":[]}}}
+{"case":"0.141.0-model-too-new-a","t":7424,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000021","status":{"type":"systemError"}}}
+{"case":"0.141.0-model-too-new-a","t":7424,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000021","turnId":"00000000-0000-7000-8000-000000000022","willRetry":false,"error":{"message":"{\"type\":\"error\",\"status\":400,\"error\":{\"type\":\"invalid_request_error\",\"message\":\"The 'gpt-6-astra' model requires a newer version of Codex. Please upgrade to the latest app or CLI and try again.\"}}","codexErrorInfo":"other"}}}
+{"case":"0.141.0-model-too-new-a","t":7424,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000021","turn":{"id":"00000000-0000-7000-8000-000000000022","status":"failed","error":{"message":"{\"type\":\"error\",\"status\":400,\"error\":{\"type\":\"invalid_request_error\",\"message\":\"The 'gpt-6-astra' model requires a newer version of Codex. Please upgrade to the latest app or CLI and try again.\"}}","codexErrorInfo":"other"},"durationMs":6195}}}
+{"case":"0.141.0-model-too-new-b","t":387,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000024","status":{"type":"active"}}}
+{"case":"0.141.0-model-too-new-b","t":387,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000024","turn":{"id":"00000000-0000-7000-8000-000000000025","status":"inProgress"}}}
+{"case":"0.141.0-model-too-new-b","t":1162,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000024","turnId":"00000000-0000-7000-8000-000000000025","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000026","clientId":null,"content":[]}}}
+{"case":"0.141.0-model-too-new-b","t":1162,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000024","turnId":"00000000-0000-7000-8000-000000000025","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000026","clientId":null,"content":[]}}}
+{"case":"0.141.0-model-too-new-b","t":1993,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000024","status":{"type":"systemError"}}}
+{"case":"0.141.0-model-too-new-b","t":1993,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000024","turnId":"00000000-0000-7000-8000-000000000025","willRetry":false,"error":{"message":"{\"type\":\"error\",\"status\":400,\"error\":{\"type\":\"invalid_request_error\",\"message\":\"The 'gpt-6-astra' model requires a newer version of Codex. Please upgrade to the latest app or CLI and try again.\"}}","codexErrorInfo":"other"}}}
+{"case":"0.141.0-model-too-new-b","t":1993,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000024","turn":{"id":"00000000-0000-7000-8000-000000000025","status":"failed","error":{"message":"{\"type\":\"error\",\"status\":400,\"error\":{\"type\":\"invalid_request_error\",\"message\":\"The 'gpt-6-astra' model requires a newer version of Codex. Please upgrade to the latest app or CLI and try again.\"}}","codexErrorInfo":"other"},"durationMs":1633}}}
+{"case":"0.141.0-overloaded-503","t":407,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000027","status":{"type":"active"}}}
+{"case":"0.141.0-overloaded-503","t":407,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000027","turn":{"id":"00000000-0000-7000-8000-000000000028","status":"inProgress"}}}
+{"case":"0.141.0-overloaded-503","t":574,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000027","turnId":"00000000-0000-7000-8000-000000000028","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000029","clientId":null,"content":[]}}}
+{"case":"0.141.0-overloaded-503","t":574,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000027","turnId":"00000000-0000-7000-8000-000000000028","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000029","clientId":null,"content":[]}}}
+{"case":"0.141.0-overloaded-503","t":1296,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000027","status":{"type":"systemError"}}}
+{"case":"0.141.0-overloaded-503","t":1296,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000027","turnId":"00000000-0000-7000-8000-000000000028","willRetry":false,"error":{"message":"Selected model is at capacity. Please try a different model.","codexErrorInfo":"serverOverloaded"}}}
+{"case":"0.141.0-overloaded-503","t":1296,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000027","turn":{"id":"00000000-0000-7000-8000-000000000028","status":"failed","error":{"message":"Selected model is at capacity. Please try a different model.","codexErrorInfo":"serverOverloaded"},"durationMs":921}}}
+{"case":"0.141.0-overloaded-sse","t":510,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000030","status":{"type":"active"}}}
+{"case":"0.141.0-overloaded-sse","t":510,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000030","turn":{"id":"00000000-0000-7000-8000-000000000031","status":"inProgress"}}}
+{"case":"0.141.0-overloaded-sse","t":611,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000030","turnId":"00000000-0000-7000-8000-000000000031","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000032","clientId":null,"content":[]}}}
+{"case":"0.141.0-overloaded-sse","t":611,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000030","turnId":"00000000-0000-7000-8000-000000000031","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000032","clientId":null,"content":[]}}}
+{"case":"0.141.0-overloaded-sse","t":695,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000030","status":{"type":"systemError"}}}
+{"case":"0.141.0-overloaded-sse","t":695,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000030","turnId":"00000000-0000-7000-8000-000000000031","willRetry":false,"error":{"message":"Selected model is at capacity. Please try a different model.","codexErrorInfo":"serverOverloaded"}}}
+{"case":"0.141.0-overloaded-sse","t":695,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000030","turn":{"id":"00000000-0000-7000-8000-000000000031","status":"failed","error":{"message":"Selected model is at capacity. Please try a different model.","codexErrorInfo":"serverOverloaded"},"durationMs":213}}}
+{"case":"0.141.0-stream-drop","t":510,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000033","status":{"type":"active"}}}
+{"case":"0.141.0-stream-drop","t":510,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000033","turn":{"id":"00000000-0000-7000-8000-000000000034","status":"inProgress"}}}
+{"case":"0.141.0-stream-drop","t":621,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000033","turnId":"00000000-0000-7000-8000-000000000034","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000035","clientId":null,"content":[]}}}
+{"case":"0.141.0-stream-drop","t":621,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000033","turnId":"00000000-0000-7000-8000-000000000034","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000035","clientId":null,"content":[]}}}
+{"case":"0.141.0-stream-drop","t":740,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000033","turnId":"00000000-0000-7000-8000-000000000034","willRetry":true,"error":{"message":"Reconnecting... 1/2","codexErrorInfo":{"responseStreamDisconnected":{"httpStatusCode":null}},"additionalDetails":"stream disconnected before completion: stream closed before response.completed"}}}
+{"case":"0.141.0-stream-drop","t":942,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000033","turnId":"00000000-0000-7000-8000-000000000034","willRetry":true,"error":{"message":"Reconnecting... 2/2","codexErrorInfo":{"responseStreamDisconnected":{"httpStatusCode":null}},"additionalDetails":"stream disconnected before completion: stream closed before response.completed"}}}
+{"case":"0.141.0-stream-drop","t":1320,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000033","status":{"type":"systemError"}}}
+{"case":"0.141.0-stream-drop","t":1320,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000033","turnId":"00000000-0000-7000-8000-000000000034","willRetry":false,"error":{"message":"stream disconnected before completion: stream closed before response.completed","codexErrorInfo":"other"}}}
+{"case":"0.141.0-stream-drop","t":1320,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000033","turn":{"id":"00000000-0000-7000-8000-000000000034","status":"failed","error":{"message":"stream disconnected before completion: stream closed before response.completed","codexErrorInfo":"other"},"durationMs":838}}}
+{"case":"0.158.0-bad-model","t":1232,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000036","status":{"type":"active"}}}
+{"case":"0.158.0-bad-model","t":1232,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000036","turn":{"id":"00000000-0000-7000-8000-000000000037","status":"inProgress"}}}
+{"case":"0.158.0-bad-model","t":7177,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000036","turnId":"00000000-0000-7000-8000-000000000037","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000038","clientId":null,"content":[]}}}
+{"case":"0.158.0-bad-model","t":7215,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000036","turnId":"00000000-0000-7000-8000-000000000037","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000038","clientId":null,"content":[]}}}
+{"case":"0.158.0-bad-model","t":8236,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000036","status":{"type":"systemError"}}}
+{"case":"0.158.0-bad-model","t":8236,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000036","turnId":"00000000-0000-7000-8000-000000000037","willRetry":false,"error":{"message":"{\"type\":\"error\",\"status\":400,\"error\":{\"type\":\"invalid_request_error\",\"message\":\"The 'gpt-qa-nonexistent' model is not supported when using Codex with a ChatGPT account.\"}}","codexErrorInfo":"other"}}}
+{"case":"0.158.0-bad-model","t":8257,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000036","turn":{"id":"00000000-0000-7000-8000-000000000037","status":"failed","error":{"message":"{\"type\":\"error\",\"status\":400,\"error\":{\"type\":\"invalid_request_error\",\"message\":\"The 'gpt-qa-nonexistent' model is not supported when using Codex with a ChatGPT account.\"}}","codexErrorInfo":"other"},"durationMs":7576}}}
+{"case":"0.158.0-bad-turn-cwd","t":4437,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000039","status":{"type":"active"}}}
+{"case":"0.158.0-bad-turn-cwd","t":4438,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000039","turn":{"id":"00000000-0000-7000-8000-000000000040","status":"inProgress"}}}
+{"case":"0.158.0-bad-turn-cwd","t":7840,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000039","turnId":"00000000-0000-7000-8000-000000000040","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000041","clientId":null,"content":[]}}}
+{"case":"0.158.0-bad-turn-cwd","t":7851,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000039","turnId":"00000000-0000-7000-8000-000000000040","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000041","clientId":null,"content":[]}}}
+{"case":"0.158.0-bad-turn-cwd","t":9220,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000039","turnId":"00000000-0000-7000-8000-000000000040","item":{"type":"agentMessage","id":"msg_4","text":""}}}
+{"case":"0.158.0-bad-turn-cwd","t":9421,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000039","turnId":"00000000-0000-7000-8000-000000000040","item":{"type":"agentMessage","id":"msg_4","text":"pong"}}}
+{"case":"0.158.0-bad-turn-cwd","t":9566,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000039","status":{"type":"idle"}}}
+{"case":"0.158.0-bad-turn-cwd","t":9566,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000039","turn":{"id":"00000000-0000-7000-8000-000000000040","status":"completed","durationMs":5172}}}
+{"case":"0.158.0-compact-overloaded","t":943,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000042","status":{"type":"active"}}}
+{"case":"0.158.0-compact-overloaded","t":944,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000042","turn":{"id":"00000000-0000-7000-8000-000000000043","status":"inProgress"}}}
+{"case":"0.158.0-compact-overloaded","t":5760,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000042","turnId":"00000000-0000-7000-8000-000000000043","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000044","clientId":null,"content":[]}}}
+{"case":"0.158.0-compact-overloaded","t":5765,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000042","turnId":"00000000-0000-7000-8000-000000000043","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000044","clientId":null,"content":[]}}}
+{"case":"0.158.0-compact-overloaded","t":5770,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000042","turnId":"00000000-0000-7000-8000-000000000043","item":{"type":"agentMessage","id":"msg_ok","text":"pong"}}}
+{"case":"0.158.0-compact-overloaded","t":5771,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000042","turnId":"00000000-0000-7000-8000-000000000043","item":{"type":"agentMessage","id":"msg_ok","text":"pong"}}}
+{"case":"0.158.0-compact-overloaded","t":5795,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000042","status":{"type":"idle"}}}
+{"case":"0.158.0-compact-overloaded","t":5795,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000042","turn":{"id":"00000000-0000-7000-8000-000000000043","status":"completed","durationMs":4899}}}
+{"case":"0.158.0-compact-overloaded","t":5820,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000042","status":{"type":"active"}}}
+{"case":"0.158.0-compact-overloaded","t":5820,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000042","turn":{"id":"00000000-0000-7000-8000-000000000045","status":"inProgress"}}}
+{"case":"0.158.0-compact-overloaded","t":5821,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000042","turnId":"00000000-0000-7000-8000-000000000045","item":{"type":"contextCompaction","id":"00000000-0000-7000-8000-000000000046"}}}
+{"case":"0.158.0-compact-overloaded","t":6421,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000042","turnId":"00000000-0000-7000-8000-000000000045","willRetry":true,"error":{"message":"Reconnecting... 1/2","codexErrorInfo":{"responseStreamDisconnected":{"httpStatusCode":null}},"additionalDetails":"Selected model is at capacity. Please try a different model."}}}
+{"case":"0.158.0-compact-overloaded","t":7232,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000042","turnId":"00000000-0000-7000-8000-000000000045","willRetry":true,"error":{"message":"Reconnecting... 2/2","codexErrorInfo":{"responseStreamDisconnected":{"httpStatusCode":null}},"additionalDetails":"Selected model is at capacity. Please try a different model."}}}
+{"case":"0.158.0-compact-overloaded","t":8204,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000042","status":{"type":"systemError"}}}
+{"case":"0.158.0-compact-overloaded","t":8204,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000042","turnId":"00000000-0000-7000-8000-000000000045","willRetry":false,"error":{"message":"Selected model is at capacity. Please try a different model.","codexErrorInfo":"serverOverloaded"}}}
+{"case":"0.158.0-compact-overloaded","t":8207,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000042","turn":{"id":"00000000-0000-7000-8000-000000000045","status":"failed","error":{"message":"Selected model is at capacity. Please try a different model.","codexErrorInfo":"serverOverloaded"},"durationMs":2388}}}
+{"case":"0.158.0-conn-refused","t":1343,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000047","status":{"type":"active"}}}
+{"case":"0.158.0-conn-refused","t":1343,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000047","turn":{"id":"00000000-0000-7000-8000-000000000048","status":"inProgress"}}}
+{"case":"0.158.0-conn-refused","t":2002,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000047","turnId":"00000000-0000-7000-8000-000000000048","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000049","clientId":null,"content":[]}}}
+{"case":"0.158.0-conn-refused","t":2013,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000047","turnId":"00000000-0000-7000-8000-000000000048","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000049","clientId":null,"content":[]}}}
+{"case":"0.158.0-conn-refused","t":2616,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000047","turnId":"00000000-0000-7000-8000-000000000048","willRetry":true,"error":{"message":"Reconnecting... waiting for network","codexErrorInfo":{"responseStreamDisconnected":{"httpStatusCode":null}},"additionalDetails":"Connection failed: error sending request"}}}
+{"case":"0.158.0-conn-refused","t":8185,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000047","turnId":"00000000-0000-7000-8000-000000000048","willRetry":true,"error":{"message":"Reconnecting... waiting for network","codexErrorInfo":{"responseStreamDisconnected":{"httpStatusCode":null}},"additionalDetails":"Connection failed: error sending request"}}}
+{"case":"0.158.0-conn-refused","t":18778,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000047","turnId":"00000000-0000-7000-8000-000000000048","willRetry":true,"error":{"message":"Reconnecting... waiting for network","codexErrorInfo":{"responseStreamDisconnected":{"httpStatusCode":null}},"additionalDetails":"Connection failed: error sending request"}}}
+{"case":"0.158.0-conn-refused","t":39406,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000047","turnId":"00000000-0000-7000-8000-000000000048","willRetry":true,"error":{"message":"Reconnecting... waiting for network","codexErrorInfo":{"responseStreamDisconnected":{"httpStatusCode":null}},"additionalDetails":"Connection failed: error sending request"}}}
+{"case":"0.158.0-conn-refused","t":79975,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000047","turnId":"00000000-0000-7000-8000-000000000048","willRetry":true,"error":{"message":"Reconnecting... waiting for network","codexErrorInfo":{"responseStreamDisconnected":{"httpStatusCode":null}},"additionalDetails":"Connection failed: error sending request"}}}
+{"case":"0.158.0-conn-refused","t":140587,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000047","turnId":"00000000-0000-7000-8000-000000000048","willRetry":true,"error":{"message":"Reconnecting... waiting for network","codexErrorInfo":{"responseStreamDisconnected":{"httpStatusCode":null}},"additionalDetails":"Connection failed: error sending request"}}}
+{"case":"0.158.0-conn-refused","t":201225,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000047","turnId":"00000000-0000-7000-8000-000000000048","willRetry":true,"error":{"message":"Reconnecting... waiting for network","codexErrorInfo":{"responseStreamDisconnected":{"httpStatusCode":null}},"additionalDetails":"Connection failed: error sending request"}}}
+{"case":"0.158.0-control","t":3620,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000050","status":{"type":"active"}}}
+{"case":"0.158.0-control","t":3621,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000050","turn":{"id":"00000000-0000-7000-8000-000000000051","status":"inProgress"}}}
+{"case":"0.158.0-control","t":5019,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000050","turnId":"00000000-0000-7000-8000-000000000051","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000052","clientId":null,"content":[]}}}
+{"case":"0.158.0-control","t":5254,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000050","turnId":"00000000-0000-7000-8000-000000000051","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000052","clientId":null,"content":[]}}}
+{"case":"0.158.0-control","t":7276,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000050","turnId":"00000000-0000-7000-8000-000000000051","item":{"type":"agentMessage","id":"msg_5","text":""}}}
+{"case":"0.158.0-control","t":7480,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000050","turnId":"00000000-0000-7000-8000-000000000051","item":{"type":"agentMessage","id":"msg_5","text":"pong"}}}
+{"case":"0.158.0-control","t":7659,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000050","status":{"type":"idle"}}}
+{"case":"0.158.0-control","t":7659,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000050","turn":{"id":"00000000-0000-7000-8000-000000000051","status":"completed","durationMs":4520}}}
+{"case":"0.158.0-interrupt","t":929,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000053","status":{"type":"active"}}}
+{"case":"0.158.0-interrupt","t":929,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000053","turn":{"id":"00000000-0000-7000-8000-000000000054","status":"inProgress"}}}
+{"case":"0.158.0-interrupt","t":2320,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000053","turnId":"00000000-0000-7000-8000-000000000054","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000055","clientId":null,"content":[]}}}
+{"case":"0.158.0-interrupt","t":2325,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000053","turnId":"00000000-0000-7000-8000-000000000054","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000055","clientId":null,"content":[]}}}
+{"case":"0.158.0-interrupt","t":4063,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000053","turnId":"00000000-0000-7000-8000-000000000054","item":{"type":"agentMessage","id":"msg_6","text":""}}}
+{"case":"0.158.0-interrupt","t":5582,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000053","status":{"type":"idle"}}}
+{"case":"0.158.0-interrupt","t":5582,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000053","turn":{"id":"00000000-0000-7000-8000-000000000054","status":"interrupted","durationMs":4711}}}
+{"case":"0.158.0-overloaded-503","t":455,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000056","status":{"type":"active"}}}
+{"case":"0.158.0-overloaded-503","t":455,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000056","turn":{"id":"00000000-0000-7000-8000-000000000057","status":"inProgress"}}}
+{"case":"0.158.0-overloaded-503","t":1114,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000056","turnId":"00000000-0000-7000-8000-000000000057","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000058","clientId":null,"content":[]}}}
+{"case":"0.158.0-overloaded-503","t":1131,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000056","turnId":"00000000-0000-7000-8000-000000000057","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000058","clientId":null,"content":[]}}}
+{"case":"0.158.0-overloaded-503","t":1722,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000056","status":{"type":"systemError"}}}
+{"case":"0.158.0-overloaded-503","t":1722,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000056","turnId":"00000000-0000-7000-8000-000000000057","willRetry":false,"error":{"message":"Selected model is at capacity. Please try a different model.","codexErrorInfo":"serverOverloaded"}}}
+{"case":"0.158.0-overloaded-503","t":1753,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000056","turn":{"id":"00000000-0000-7000-8000-000000000057","status":"failed","error":{"message":"Selected model is at capacity. Please try a different model.","codexErrorInfo":"serverOverloaded"},"durationMs":1302}}}
+{"case":"0.158.0-overloaded-sse","t":944,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000059","status":{"type":"active"}}}
+{"case":"0.158.0-overloaded-sse","t":944,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000059","turn":{"id":"00000000-0000-7000-8000-000000000060","status":"inProgress"}}}
+{"case":"0.158.0-overloaded-sse","t":1196,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000059","turnId":"00000000-0000-7000-8000-000000000060","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000061","clientId":null,"content":[]}}}
+{"case":"0.158.0-overloaded-sse","t":1199,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000059","turnId":"00000000-0000-7000-8000-000000000060","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000061","clientId":null,"content":[]}}}
+{"case":"0.158.0-overloaded-sse","t":1204,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000059","status":{"type":"systemError"}}}
+{"case":"0.158.0-overloaded-sse","t":1204,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000059","turnId":"00000000-0000-7000-8000-000000000060","willRetry":false,"error":{"message":"Selected model is at capacity. Please try a different model.","codexErrorInfo":"serverOverloaded"}}}
+{"case":"0.158.0-overloaded-sse","t":1206,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000059","turn":{"id":"00000000-0000-7000-8000-000000000060","status":"failed","error":{"message":"Selected model is at capacity. Please try a different model.","codexErrorInfo":"serverOverloaded"},"durationMs":481}}}
+{"case":"0.158.0-stream-drop","t":1136,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000062","status":{"type":"active"}}}
+{"case":"0.158.0-stream-drop","t":1136,"method":"turn/started","params":{"threadId":"00000000-0000-7000-8000-000000000062","turn":{"id":"00000000-0000-7000-8000-000000000063","status":"inProgress"}}}
+{"case":"0.158.0-stream-drop","t":1721,"method":"item/started","params":{"threadId":"00000000-0000-7000-8000-000000000062","turnId":"00000000-0000-7000-8000-000000000063","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000064","clientId":null,"content":[]}}}
+{"case":"0.158.0-stream-drop","t":1733,"method":"item/completed","params":{"threadId":"00000000-0000-7000-8000-000000000062","turnId":"00000000-0000-7000-8000-000000000063","item":{"type":"userMessage","id":"00000000-0000-7000-8000-000000000064","clientId":null,"content":[]}}}
+{"case":"0.158.0-stream-drop","t":1738,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000062","turnId":"00000000-0000-7000-8000-000000000063","willRetry":true,"error":{"message":"Reconnecting... 1/2","codexErrorInfo":{"responseStreamDisconnected":{"httpStatusCode":null}},"additionalDetails":"stream disconnected before completion: stream closed before response.completed"}}}
+{"case":"0.158.0-stream-drop","t":1959,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000062","turnId":"00000000-0000-7000-8000-000000000063","willRetry":true,"error":{"message":"Reconnecting... 2/2","codexErrorInfo":{"responseStreamDisconnected":{"httpStatusCode":null}},"additionalDetails":"stream disconnected before completion: stream closed before response.completed"}}}
+{"case":"0.158.0-stream-drop","t":2514,"method":"thread/status/changed","params":{"threadId":"00000000-0000-7000-8000-000000000062","status":{"type":"systemError"}}}
+{"case":"0.158.0-stream-drop","t":2514,"method":"error","params":{"threadId":"00000000-0000-7000-8000-000000000062","turnId":"00000000-0000-7000-8000-000000000063","willRetry":false,"error":{"message":"stream disconnected before completion: stream closed before response.completed","codexErrorInfo":"other"}}}
+{"case":"0.158.0-stream-drop","t":2546,"method":"turn/completed","params":{"threadId":"00000000-0000-7000-8000-000000000062","turn":{"id":"00000000-0000-7000-8000-000000000063","status":"failed","error":{"message":"stream disconnected before completion: stream closed before response.completed","codexErrorInfo":"other"},"durationMs":1761}}}
diff --git a/src/main/codex/codex-account-session-bridge.test.ts b/src/main/codex/codex-account-session-bridge.test.ts
index 7cebd37c1f4..3befa013473 100644
--- a/src/main/codex/codex-account-session-bridge.test.ts
+++ b/src/main/codex/codex-account-session-bridge.test.ts
@@ -1,14 +1,31 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import {
   _internals,
   bridgeCodexSessionsIntoAccountHome,
-  startCodexAccountSessionBridgeInBackground
+  startCodexAccountSessionBridgeInBackground,
+  stopCodexAccountSessionBridges
 } from './codex-account-session-bridge'
+import { writeCodexStateDbBackfillStatus } from './codex-state-db-test-fixture'
+import SyncDatabase from '../sqlite/sync-database'
 
 let workspaceRoot: string
+const healIndexStub = vi.fn(async () => ({
+  outcome: 'up-to-date' as const,
+  healedThreads: 0,
+  missingThreads: 0,
+  failedThreads: 0
+}))
 
 function writeRollout(homePath: string, relativePath: string, contents: string): string {
   const filePath = join(homePath, 'sessions', relativePath)
@@ -21,12 +38,25 @@ function rolloutPath(homePath: string, relativePath: string): string {
   return join(homePath, 'sessions', relativePath)
 }
 
-const ROLLOUT_A = join('2026', '07', '20', 'rollout-2026-07-20T10-00-00-aaaa.jsonl')
-const ROLLOUT_B = join('2026', '07', '21', 'rollout-2026-07-21T10-00-00-bbbb.jsonl')
+const THREAD_A = '019a0000-0000-7000-8000-00000000000a'
+const THREAD_B = '019a0000-0000-7000-8000-00000000000b'
+const ROLLOUT_A = join(
+  '2026',
+  '07',
+  '20',
+  'rollout-2026-07-20T10-00-00-019a0000-0000-7000-8000-00000000000a.jsonl'
+)
+const ROLLOUT_B = join(
+  '2026',
+  '07',
+  '21',
+  'rollout-2026-07-21T10-00-00-019a0000-0000-7000-8000-00000000000b.jsonl'
+)
 
 beforeEach(() => {
   workspaceRoot = mkdtempSync(join(tmpdir(), 'codex-account-session-bridge-'))
   _internals.resetBackgroundBridgeTasks()
+  healIndexStub.mockClear()
 })
 
 afterEach(() => {
@@ -47,7 +77,14 @@ describe('bridgeCodexSessionsIntoAccountHome', () => {
       options: { batchSize: 1, yieldMs: 0 }
     })
 
-    expect(summary).toEqual({ scannedFiles: 2, linkedFiles: 2 })
+    expect(summary).toEqual({
+      scannedFiles: 2,
+      linkedFiles: 2,
+      bridgedThreads: new Map([
+        [THREAD_A, '2026-07-20T10-00-00'],
+        [THREAD_B, '2026-07-21T10-00-00']
+      ])
+    })
     expect(readFileSync(rolloutPath(targetHome, ROLLOUT_A), 'utf-8')).toBe('system session\n')
     expect(readFileSync(rolloutPath(targetHome, ROLLOUT_B), 'utf-8')).toBe('account a session\n')
   })
@@ -97,7 +134,11 @@ describe('bridgeCodexSessionsIntoAccountHome', () => {
       sourceCodexHomePaths: [systemHome]
     })
 
-    expect(second).toEqual({ scannedFiles: 1, linkedFiles: 0 })
+    expect(second).toEqual({
+      scannedFiles: 1,
+      linkedFiles: 0,
+      bridgedThreads: new Map([[THREAD_A, '2026-07-20T10-00-00']])
+    })
   })
 
   it('never links a home into itself or scans a duplicate source twice', async () => {
@@ -109,7 +150,27 @@ describe('bridgeCodexSessionsIntoAccountHome', () => {
       sourceCodexHomePaths: [targetHome, targetHome]
     })
 
-    expect(summary).toEqual({ scannedFiles: 0, linkedFiles: 0 })
+    expect(summary).toEqual({ scannedFiles: 0, linkedFiles: 0, bridgedThreads: new Map() })
+  })
+
+  it('does not hand a rollout it failed to link to the index heal', async () => {
+    const systemHome = join(workspaceRoot, 'system')
+    const targetHome = join(workspaceRoot, 'account')
+    writeRollout(systemHome, ROLLOUT_A, 'session\n')
+    writeRollout(systemHome, ROLLOUT_B, 'session\n')
+    // A file where the target's day directory belongs makes that one link fail.
+    mkdirSync(join(targetHome, 'sessions', '2026', '07'), { recursive: true })
+    writeFileSync(join(targetHome, 'sessions', '2026', '07', '20'), 'not a directory')
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    const summary = await bridgeCodexSessionsIntoAccountHome({
+      targetCodexHomePath: targetHome,
+      sourceCodexHomePaths: [systemHome]
+    })
+
+    warn.mockRestore()
+    expect(summary.linkedFiles).toBe(1)
+    expect(summary.bridgedThreads).toEqual(new Map([[THREAD_B, '2026-07-21T10-00-00']]))
   })
 
   it('skips a source home that has no sessions tree', async () => {
@@ -119,24 +180,35 @@ describe('bridgeCodexSessionsIntoAccountHome', () => {
       sourceCodexHomePaths: [join(workspaceRoot, 'missing')]
     })
 
-    expect(summary).toEqual({ scannedFiles: 0, linkedFiles: 0 })
+    expect(summary).toEqual({ scannedFiles: 0, linkedFiles: 0, bridgedThreads: new Map() })
   })
 })
 
+type BridgeDependencies = NonNullable<
+  Parameters<typeof startCodexAccountSessionBridgeInBackground>[1]
+>
+
+// Why: the real steps spawn `codex app-server`; their behavior is covered separately.
+function startBridge(
+  targetCodexHomePath: string,
+  sourceCodexHomePaths: string[],
+  dependencies: BridgeDependencies = {}
+): Promise<void> {
+  return startCodexAccountSessionBridgeInBackground(
+    { targetCodexHomePath, sourceCodexHomePaths },
+    { createStateDb: async () => false, healIndex: healIndexStub, ...dependencies }
+  )
+}
+
 describe('startCodexAccountSessionBridgeInBackground', () => {
   it('shares one in-flight task per target home', () => {
     const systemHome = join(workspaceRoot, 'system')
     const targetHome = join(workspaceRoot, 'account')
     writeRollout(systemHome, ROLLOUT_A, 'session\n')
+    writeCodexStateDbBackfillStatus(targetHome, 'complete')
 
-    const first = startCodexAccountSessionBridgeInBackground({
-      targetCodexHomePath: targetHome,
-      sourceCodexHomePaths: [systemHome]
-    })
-    const second = startCodexAccountSessionBridgeInBackground({
-      targetCodexHomePath: targetHome,
-      sourceCodexHomePaths: [systemHome]
-    })
+    const first = startBridge(targetHome, [systemHome])
+    const second = startBridge(targetHome, [systemHome])
 
     expect(second).toBe(first)
     return first
@@ -147,19 +219,203 @@ describe('startCodexAccountSessionBridgeInBackground', () => {
     const firstTarget = join(workspaceRoot, 'account-a')
     const secondTarget = join(workspaceRoot, 'account-b')
     writeRollout(systemHome, ROLLOUT_A, 'session\n')
+    writeCodexStateDbBackfillStatus(firstTarget, 'complete')
+    writeCodexStateDbBackfillStatus(secondTarget, 'complete')
 
     await Promise.all([
-      startCodexAccountSessionBridgeInBackground({
-        targetCodexHomePath: firstTarget,
-        sourceCodexHomePaths: [systemHome]
-      }),
-      startCodexAccountSessionBridgeInBackground({
-        targetCodexHomePath: secondTarget,
-        sourceCodexHomePaths: [systemHome]
-      })
+      startBridge(firstTarget, [systemHome]),
+      startBridge(secondTarget, [systemHome])
     ])
 
     expect(readFileSync(rolloutPath(firstTarget, ROLLOUT_A), 'utf-8')).toBe('session\n')
     expect(readFileSync(rolloutPath(secondTarget, ROLLOUT_A), 'utf-8')).toBe('session\n')
   })
+
+  // #20669: rollouts present when Codex first creates its state DB force a
+  // blocking backfill that times out the first TUI launch.
+  it('lets Codex index a new home before linking history into it', async () => {
+    const systemHome = join(workspaceRoot, 'system')
+    const targetHome = join(workspaceRoot, 'account')
+    writeRollout(systemHome, ROLLOUT_A, 'session\n')
+    const createStateDb = vi.fn(async (home: string) => {
+      expect(existsSync(rolloutPath(home, ROLLOUT_A))).toBe(false)
+      writeCodexStateDbBackfillStatus(home, 'complete')
+      return true
+    })
+
+    await startBridge(targetHome, [systemHome], { createStateDb })
+
+    expect(createStateDb).toHaveBeenCalledWith(targetHome)
+    expect(readFileSync(rolloutPath(targetHome, ROLLOUT_A), 'utf-8')).toBe('session\n')
+  })
+
+  // Why: an older Codex keeps no state DB, and `sqlite_home` keeps it outside
+  // the home; either way every launch must keep linking new history.
+  it('keeps linking new history on later launches when no state DB lives in the home', async () => {
+    const systemHome = join(workspaceRoot, 'system')
+    const targetHome = join(workspaceRoot, 'account')
+    writeRollout(systemHome, ROLLOUT_A, 'first\n')
+    const createStateDb = vi.fn(async () => true)
+
+    await startBridge(targetHome, [systemHome], { createStateDb })
+    writeRollout(systemHome, ROLLOUT_B, 'second\n')
+    await startBridge(targetHome, [systemHome], { createStateDb })
+
+    expect(readFileSync(rolloutPath(targetHome, ROLLOUT_A), 'utf-8')).toBe('first\n')
+    expect(readFileSync(rolloutPath(targetHome, ROLLOUT_B), 'utf-8')).toBe('second\n')
+    // Only the empty home needed Codex to run first.
+    expect(createStateDb).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not start Codex on an empty home when no source has history', async () => {
+    const createStateDb = vi.fn(async () => true)
+
+    await startBridge(join(workspaceRoot, 'account'), [join(workspaceRoot, 'system')], {
+      createStateDb
+    })
+
+    expect(createStateDb).not.toHaveBeenCalled()
+  })
+
+  it('does not link history when Codex could not create the state DB', async () => {
+    const systemHome = join(workspaceRoot, 'system')
+    const targetHome = join(workspaceRoot, 'account')
+    writeRollout(systemHome, ROLLOUT_A, 'session\n')
+
+    await startBridge(targetHome, [systemHome], { createStateDb: async () => false })
+
+    expect(existsSync(rolloutPath(targetHome, ROLLOUT_A))).toBe(false)
+    expect(healIndexStub).not.toHaveBeenCalled()
+  })
+
+  it('bridges compressed-only history into a new home and indexes it', async () => {
+    const systemHome = join(workspaceRoot, 'system')
+    const targetHome = join(workspaceRoot, 'account')
+    const compressed = `${ROLLOUT_A}.zst`
+    writeRollout(systemHome, compressed, 'compressed\n')
+    const createStateDb = vi.fn(async (home: string) => {
+      writeCodexStateDbBackfillStatus(home, 'complete')
+      return true
+    })
+
+    await startBridge(targetHome, [systemHome], { createStateDb })
+
+    expect(readFileSync(rolloutPath(targetHome, compressed), 'utf-8')).toBe('compressed\n')
+    expect(healIndexStub).toHaveBeenCalledWith(
+      targetHome,
+      new Map([[THREAD_A, '2026-07-20T10-00-00']]),
+      {
+        shouldStop: expect.any(Function)
+      }
+    )
+  })
+
+  it('skips linking into a state DB that predates backfill tracking', async () => {
+    const systemHome = join(workspaceRoot, 'system')
+    const targetHome = join(workspaceRoot, 'account')
+    writeRollout(systemHome, ROLLOUT_A, 'session\n')
+    mkdirSync(targetHome, { recursive: true })
+    new SyncDatabase(join(targetHome, 'state_5.sqlite')).close()
+
+    await startBridge(targetHome, [systemHome])
+
+    expect(existsSync(rolloutPath(targetHome, ROLLOUT_A))).toBe(false)
+  })
+
+  it('skips linking while Codex is still indexing the home', async () => {
+    const systemHome = join(workspaceRoot, 'system')
+    const targetHome = join(workspaceRoot, 'account')
+    writeRollout(systemHome, ROLLOUT_A, 'session\n')
+    writeCodexStateDbBackfillStatus(targetHome, 'running')
+
+    await startBridge(targetHome, [systemHome])
+
+    expect(existsSync(rolloutPath(targetHome, ROLLOUT_A))).toBe(false)
+    expect(healIndexStub).not.toHaveBeenCalled()
+  })
+
+  it('reports why it skips a home whose state DB cannot be read', async () => {
+    const systemHome = join(workspaceRoot, 'system')
+    const targetHome = join(workspaceRoot, 'account')
+    writeRollout(systemHome, ROLLOUT_A, 'session\n')
+    mkdirSync(targetHome, { recursive: true })
+    writeFileSync(join(targetHome, 'state_5.sqlite'), 'not a sqlite database')
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    await startBridge(targetHome, [systemHome])
+
+    expect(existsSync(rolloutPath(targetHome, ROLLOUT_A))).toBe(false)
+    expect(warn).toHaveBeenCalledWith(
+      expect.stringContaining('Codex state DB is unreadable'),
+      expect.any(String)
+    )
+    warn.mockRestore()
+  })
+
+  it('indexes the bridged threads once linking finishes', async () => {
+    const systemHome = join(workspaceRoot, 'system')
+    const targetHome = join(workspaceRoot, 'account')
+    writeRollout(systemHome, ROLLOUT_A, 'session\n')
+    writeCodexStateDbBackfillStatus(targetHome, 'complete')
+
+    await startBridge(targetHome, [systemHome])
+
+    expect(healIndexStub).toHaveBeenCalledWith(
+      targetHome,
+      new Map([[THREAD_A, '2026-07-20T10-00-00']]),
+      {
+        shouldStop: expect.any(Function)
+      }
+    )
+  })
+
+  it('links nothing when the app quits while Codex creates the state DB', async () => {
+    const systemHome = join(workspaceRoot, 'system')
+    const targetHome = join(workspaceRoot, 'account')
+    writeRollout(systemHome, ROLLOUT_A, 'session\n')
+
+    await startBridge(targetHome, [systemHome], {
+      createStateDb: async (home) => {
+        writeCodexStateDbBackfillStatus(home, 'complete')
+        stopCodexAccountSessionBridges()
+        return true
+      }
+    })
+
+    expect(existsSync(rolloutPath(targetHome, ROLLOUT_A))).toBe(false)
+    expect(healIndexStub).not.toHaveBeenCalled()
+  })
+
+  it('does not start Codex on a new home after the app quits', async () => {
+    const systemHome = join(workspaceRoot, 'system')
+    writeRollout(systemHome, ROLLOUT_A, 'session\n')
+    const createStateDb = vi.fn(async () => true)
+    stopCodexAccountSessionBridges()
+
+    await startBridge(join(workspaceRoot, 'account'), [systemHome], { createStateDb })
+
+    expect(createStateDb).not.toHaveBeenCalled()
+  })
+
+  it('stops indexing and starts no new bridge once the app quits', async () => {
+    const systemHome = join(workspaceRoot, 'system')
+    const targetHome = join(workspaceRoot, 'account')
+    const laterTarget = join(workspaceRoot, 'later-account')
+    writeRollout(systemHome, ROLLOUT_A, 'session\n')
+    writeCodexStateDbBackfillStatus(targetHome, 'complete')
+    writeCodexStateDbBackfillStatus(laterTarget, 'complete')
+    let shouldStop: (() => boolean) | undefined
+
+    await startBridge(targetHome, [systemHome], {
+      healIndex: async (_home, _threads, options) => {
+        shouldStop = options?.shouldStop
+        stopCodexAccountSessionBridges()
+        return { outcome: 'stopped', healedThreads: 0, missingThreads: 0, failedThreads: 0 }
+      }
+    })
+    await startBridge(laterTarget, [systemHome])
+
+    expect(shouldStop?.()).toBe(true)
+    expect(existsSync(rolloutPath(laterTarget, ROLLOUT_A))).toBe(false)
+  })
 })
diff --git a/src/main/codex/codex-account-session-bridge.ts b/src/main/codex/codex-account-session-bridge.ts
index 72096103aa1..bb6110a8651 100644
--- a/src/main/codex/codex-account-session-bridge.ts
+++ b/src/main/codex/codex-account-session-bridge.ts
@@ -3,7 +3,17 @@ import { dirname, join, relative } from 'node:path'
 import { normalizeRuntimePathForComparison } from '../../shared/cross-platform-path'
 import { listCodexSessionRolloutFilesIncrementally } from './codex-session-file-listing'
 import type { CodexSessionBridgeIncrementalOptions } from './codex-session-file-listing'
+import {
+  createCodexAccountStateDb,
+  healCodexAccountSessionIndex
+} from './codex-account-session-index-heal'
+import { parseCodexRolloutThreadId } from './codex-session-index-heal-state'
 import { linkCodexSessionFile } from './codex-session-link'
+import {
+  countCodexSessionFilesUpTo,
+  findNewestCodexStateDbPath,
+  readCodexStateDbBackfillStatus
+} from './codex-state-db'
 
 /**
  * Bridges Codex history between Orca-managed Codex homes.
@@ -19,24 +29,99 @@ import { linkCodexSessionFile } from './codex-session-link'
 export type CodexAccountSessionBridgeSummary = {
   scannedFiles: number
   linkedFiles: number
+  /** Thread id -> rollout timestamp for every rollout present in the target home via this bridge. */
+  bridgedThreads: Map<string, string>
 }
 
 const backgroundBridgeTasksByTargetHome = new Map<string, Promise<void>>()
+let stopping = false
+
+type BackgroundBridgeDependencies = {
+  createStateDb: typeof createCodexAccountStateDb
+  healIndex: typeof healCodexAccountSessionIndex
+}
+
+const defaultBackgroundBridgeDependencies: BackgroundBridgeDependencies = {
+  createStateDb: createCodexAccountStateDb,
+  healIndex: healCodexAccountSessionIndex
+}
+
+/**
+ * Why: Codex indexes every rollout present when it first creates a home's state
+ * DB, and the TUI gives up waiting after 30s. Linking history into a fresh home
+ * first turns its first launch into a minutes-long backfill (#20669), so an
+ * empty home gets its state DB before any history; the heal indexes it afterwards.
+ */
+async function isReadyForBridgedHistory(
+  targetCodexHomePath: string,
+  sourceCodexHomePaths: readonly string[],
+  dependencies: BackgroundBridgeDependencies
+): Promise<boolean> {
+  if (
+    !findNewestCodexStateDbPath(targetCodexHomePath) &&
+    !hasSessionRollouts(targetCodexHomePath)
+  ) {
+    if (
+      !sourceCodexHomePaths.some(hasSessionRollouts) ||
+      !(await dependencies.createStateDb(targetCodexHomePath))
+    ) {
+      return false
+    }
+  }
+  const status = readCodexStateDbBackfillStatus(targetCodexHomePath)
+  if (status.kind === 'unreadable') {
+    // Why: contention clears by the next launch; corruption would skip every launch, so surface it.
+    console.warn(
+      '[codex-account-session-bridge] Skipping history bridge; Codex state DB is unreadable:',
+      status.error
+    )
+    return false
+  }
+  // Why: no DB in a home that has history means Codex keeps it elsewhere
+  // (`sqlite_home`) or keeps none, so linking cannot stall a launch here.
+  // `not-tracked` is a pre-backfill schema that Codex migrates to `pending`.
+  return status.kind === 'complete' || status.kind === 'missing'
+}
+
+function hasSessionRollouts(codexHomePath: string): boolean {
+  return countCodexSessionFilesUpTo(join(codexHomePath, 'sessions'), 1) > 0
+}
 
 /**
  * Starts one background bridge per target home, sharing in-flight work.
  */
-export function startCodexAccountSessionBridgeInBackground(args: {
-  targetCodexHomePath: string
-  sourceCodexHomePaths: readonly string[]
-  options?: CodexSessionBridgeIncrementalOptions
-}): Promise<void> {
+export function startCodexAccountSessionBridgeInBackground(
+  args: {
+    targetCodexHomePath: string
+    sourceCodexHomePaths: readonly string[]
+    options?: CodexSessionBridgeIncrementalOptions
+  },
+  dependenciesOverride: Partial<BackgroundBridgeDependencies> = {}
+): Promise<void> {
+  if (stopping) {
+    return Promise.resolve()
+  }
   const key = normalizeRuntimePathForComparison(args.targetCodexHomePath)
   const inFlight = backgroundBridgeTasksByTargetHome.get(key)
   if (inFlight) {
     return inFlight
   }
-  const task = bridgeCodexSessionsIntoAccountHome(args)
+  const dependencies = { ...defaultBackgroundBridgeDependencies, ...dependenciesOverride }
+  const task = isReadyForBridgedHistory(
+    args.targetCodexHomePath,
+    args.sourceCodexHomePaths,
+    dependencies
+  )
+    .then(async (ready) => {
+      // Why: skip rather than feed a running backfill; the next launch retries.
+      if (!ready || stopping) {
+        return
+      }
+      const summary = await bridgeCodexSessionsIntoAccountHome(args)
+      await dependencies.healIndex(args.targetCodexHomePath, summary.bridgedThreads, {
+        shouldStop: () => stopping
+      })
+    })
     .catch((error: unknown) => {
       console.warn('[codex-account-session-bridge] Background session bridge failed:', error)
     })
@@ -50,6 +135,11 @@ export function startCodexAccountSessionBridgeInBackground(args: {
   return task
 }
 
+/** Stops background bridges at quit; links and index reads made so far are kept. */
+export function stopCodexAccountSessionBridges(): void {
+  stopping = true
+}
+
 /**
  * Mirrors every source home's rollouts into the target home's sessions tree.
  */
@@ -58,7 +148,11 @@ export async function bridgeCodexSessionsIntoAccountHome(args: {
   sourceCodexHomePaths: readonly string[]
   options?: CodexSessionBridgeIncrementalOptions
 }): Promise<CodexAccountSessionBridgeSummary> {
-  const summary: CodexAccountSessionBridgeSummary = { scannedFiles: 0, linkedFiles: 0 }
+  const summary: CodexAccountSessionBridgeSummary = {
+    scannedFiles: 0,
+    linkedFiles: 0,
+    bridgedThreads: new Map()
+  }
   const targetSessionsRoot = join(args.targetCodexHomePath, 'sessions')
   for (const sourceHomePath of dedupeSourceHomes(
     args.sourceCodexHomePaths,
@@ -73,9 +167,18 @@ export async function bridgeCodexSessionsIntoAccountHome(args: {
       args.options ?? {}
     )) {
       summary.scannedFiles += 1
-      if (bridgeRolloutIntoAccountHome(sourceSessionsRoot, targetSessionsRoot, sourceFilePath)) {
+      const result = bridgeRolloutIntoAccountHome(
+        sourceSessionsRoot,
+        targetSessionsRoot,
+        sourceFilePath
+      )
+      if (result === 'linked') {
         summary.linkedFiles += 1
       }
+      const rollout = parseCodexRolloutThreadId(sourceFilePath)
+      if (result !== 'failed' && rollout) {
+        summary.bridgedThreads.set(rollout.threadId, rollout.rolloutStamp)
+      }
     }
   }
   return summary
@@ -88,20 +191,20 @@ function bridgeRolloutIntoAccountHome(
   sourceSessionsRoot: string,
   targetSessionsRoot: string,
   sourceFilePath: string
-): boolean {
+): 'linked' | 'existing' | 'failed' {
   const targetFilePath = join(targetSessionsRoot, relative(sourceSessionsRoot, sourceFilePath))
   // Why: rollout names carry the session UUID, so an existing target path is the
   // same conversation already bridged (often the same inode) — never a conflict.
   if (existsSync(targetFilePath)) {
-    return false
+    return 'existing'
   }
   try {
     mkdirSync(dirname(targetFilePath), { recursive: true })
   } catch (error) {
     console.warn('[codex-account-session-bridge] Failed to create session directory:', error)
-    return false
+    return 'failed'
   }
-  return linkCodexSessionFile(sourceFilePath, targetFilePath)
+  return linkCodexSessionFile(sourceFilePath, targetFilePath) ? 'linked' : 'failed'
 }
 
 /**
@@ -127,5 +230,6 @@ function dedupeSourceHomes(
 export const _internals = {
   resetBackgroundBridgeTasks: (): void => {
     backgroundBridgeTasksByTargetHome.clear()
+    stopping = false
   }
 }
diff --git a/src/main/codex/codex-account-session-index-heal.test.ts b/src/main/codex/codex-account-session-index-heal.test.ts
new file mode 100644
index 00000000000..fbb5fae404c
--- /dev/null
+++ b/src/main/codex/codex-account-session-index-heal.test.ts
@@ -0,0 +1,306 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  _internals,
+  createCodexAccountStateDb,
+  healCodexAccountSessionIndex
+} from './codex-account-session-index-heal'
+import {
+  CodexAppServerUnsupportedError,
+  type CodexAppServerInvocation,
+  type CodexAppServerRpc
+} from './codex-app-server-session'
+
+const HOME = '/codex-accounts/account-1/home'
+
+// Why: fails closed if a regression bypasses the fake session — never the real codex or ~/.codex.
+function buildInvocation(): CodexAppServerInvocation {
+  return {
+    command: '/nonexistent/orca-test-codex',
+    args: ['app-server'],
+    cliPath: null,
+    env: { CODEX_HOME: join(tmpdir(), 'orca-test-nonexistent-codex-home') },
+    timeoutMs: 1_000
+  }
+}
+
+/** Runs the heal body against a fake app-server that answers thread/read. */
+function fakeAppServer(onRead: (threadId: string) => void = () => {}) {
+  const readThreadIds: string[] = []
+  const runSession = vi.fn(
+    async (
+      _invocation: CodexAppServerInvocation,
+      body: (rpc: CodexAppServerRpc) => Promise<void>
+    ): Promise<void> => {
+      await body({
+        request: async (method, params) => {
+          expect(method).toBe('thread/read')
+          const threadId = String(params?.threadId)
+          readThreadIds.push(threadId)
+          onRead(threadId)
+          return {}
+        },
+        notify: () => {}
+      })
+    }
+  )
+  return { runSession, readThreadIds }
+}
+
+/** Bridged threads keyed by id, all from the same rollout timestamp. */
+function bridged(...threadIds: string[]): Map<string, string> {
+  return new Map(threadIds.map((threadId) => [threadId, '2026-07-20T10-00-00']))
+}
+
+beforeEach(() => {
+  _internals.resetFailedThreads()
+})
+
+describe('healCodexAccountSessionIndex', () => {
+  it('reads only bridged threads missing from the Codex index', async () => {
+    const { runSession, readThreadIds } = fakeAppServer()
+
+    const summary = await healCodexAccountSessionIndex(HOME, bridged('a', 'b', 'c'), {
+      readIndexedThreadIds: () => new Set(['b']),
+      buildInvocation,
+      runSession
+    })
+
+    expect(readThreadIds.sort()).toEqual(['a', 'c'])
+    expect(summary).toEqual({
+      outcome: 'completed',
+      healedThreads: 2,
+      missingThreads: 0,
+      failedThreads: 0
+    })
+  })
+
+  it('reads the most recent bridged rollouts first', async () => {
+    const { runSession, readThreadIds } = fakeAppServer()
+
+    await healCodexAccountSessionIndex(
+      HOME,
+      new Map([
+        ['middle', '2026-08-01T09-00-00'],
+        ['oldest', '2025-12-31T23-59-59'],
+        ['newest', '2026-09-28T01-46-16']
+      ]),
+      { readIndexedThreadIds: () => new Set(), buildInvocation, runSession, readConcurrency: 1 }
+    )
+
+    expect(readThreadIds).toEqual(['newest', 'middle', 'oldest'])
+  })
+
+  it('does not start Codex when every bridged thread is already indexed', async () => {
+    const { runSession } = fakeAppServer()
+
+    const summary = await healCodexAccountSessionIndex(HOME, bridged('a'), {
+      readIndexedThreadIds: () => new Set(['a']),
+      buildInvocation,
+      runSession
+    })
+
+    expect(summary.outcome).toBe('up-to-date')
+    expect(runSession).not.toHaveBeenCalled()
+  })
+
+  it('does not start Codex when its index cannot be read', async () => {
+    const { runSession } = fakeAppServer()
+
+    const summary = await healCodexAccountSessionIndex(HOME, bridged('a'), {
+      readIndexedThreadIds: () => null,
+      buildInvocation,
+      runSession
+    })
+
+    expect(summary.outcome).toBe('no-index')
+    expect(runSession).not.toHaveBeenCalled()
+  })
+
+  it('does not start Codex once the app is quitting', async () => {
+    const { runSession } = fakeAppServer()
+
+    const summary = await healCodexAccountSessionIndex(HOME, bridged('a'), {
+      readIndexedThreadIds: () => new Set(),
+      buildInvocation,
+      runSession,
+      shouldStop: () => true
+    })
+
+    expect(summary.outcome).toBe('stopped')
+    expect(runSession).not.toHaveBeenCalled()
+  })
+
+  it('stops retrying a thread Codex refuses to index until Orca restarts', async () => {
+    const { runSession, readThreadIds } = fakeAppServer((threadId) => {
+      if (threadId === 'broken') {
+        throw new Error('codex app-server thread/read failed: invalid rollout')
+      }
+    })
+    const dependencies = {
+      readIndexedThreadIds: () => new Set<string>(),
+      buildInvocation,
+      runSession
+    }
+
+    const first = await healCodexAccountSessionIndex(HOME, bridged('broken'), dependencies)
+    const second = await healCodexAccountSessionIndex(HOME, bridged('broken'), dependencies)
+
+    expect(first).toEqual({
+      outcome: 'completed',
+      healedThreads: 0,
+      missingThreads: 0,
+      failedThreads: 1
+    })
+    expect(second.outcome).toBe('up-to-date')
+    expect(readThreadIds).toEqual(['broken'])
+  })
+
+  it('remembers a refused thread only for the home that refused it', async () => {
+    const { runSession, readThreadIds } = fakeAppServer((threadId) => {
+      if (readThreadIds.length === 1) {
+        throw new Error(`codex app-server thread/read failed: invalid rollout ${threadId}`)
+      }
+    })
+    const dependencies = {
+      readIndexedThreadIds: () => new Set<string>(),
+      buildInvocation,
+      runSession
+    }
+
+    await healCodexAccountSessionIndex(HOME, bridged('shared'), dependencies)
+    const other = await healCodexAccountSessionIndex(
+      '/codex-accounts/account-2/home',
+      bridged('shared'),
+      dependencies
+    )
+
+    expect(other.healedThreads).toBe(1)
+    expect(readThreadIds).toEqual(['shared', 'shared'])
+  })
+
+  it('counts a rollout Codex cannot find as missing and does not reread it', async () => {
+    const { runSession, readThreadIds } = fakeAppServer(() => {
+      throw new Error('codex app-server thread/read failed: no rollout found for thread id gone')
+    })
+    const options = { readIndexedThreadIds: () => new Set<string>(), buildInvocation, runSession }
+
+    const first = await healCodexAccountSessionIndex(HOME, bridged('gone'), options)
+    const second = await healCodexAccountSessionIndex(HOME, bridged('gone'), options)
+
+    expect(first).toEqual({
+      outcome: 'completed',
+      healedThreads: 0,
+      missingThreads: 1,
+      failedThreads: 0
+    })
+    expect(second.outcome).toBe('up-to-date')
+    expect(readThreadIds).toEqual(['gone'])
+  })
+
+  it('retries a thread on the next pass when the app-server session fails', async () => {
+    const failing = vi.fn(async () => {
+      throw new Error('codex app-server exited before responding')
+    })
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const readIndexedThreadIds = (): Set<string> => new Set()
+
+    const first = await healCodexAccountSessionIndex(HOME, bridged('a'), {
+      readIndexedThreadIds,
+      buildInvocation,
+      runSession: failing
+    })
+    const { runSession, readThreadIds } = fakeAppServer()
+    const second = await healCodexAccountSessionIndex(HOME, bridged('a'), {
+      readIndexedThreadIds,
+      buildInvocation,
+      runSession
+    })
+
+    expect(first.outcome).toBe('aborted')
+    expect(second.outcome).toBe('completed')
+    expect(readThreadIds).toEqual(['a'])
+    warn.mockRestore()
+  })
+
+  it('reports a session that fails during quit as stopped, not unsupported', async () => {
+    let stopping = false
+    const summary = await healCodexAccountSessionIndex(HOME, bridged('a'), {
+      readIndexedThreadIds: () => new Set(),
+      buildInvocation,
+      runSession: async () => {
+        stopping = true
+        throw new CodexAppServerUnsupportedError('app-server killed during quit')
+      },
+      shouldStop: () => stopping
+    })
+
+    expect(summary.outcome).toBe('stopped')
+  })
+
+  it('aborts rather than writing off a thread while a live Codex holds the database', async () => {
+    const { runSession } = fakeAppServer(() => {
+      throw new Error('codex app-server thread/read failed: database is locked')
+    })
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    const summary = await healCodexAccountSessionIndex(HOME, bridged('a'), {
+      readIndexedThreadIds: () => new Set(),
+      buildInvocation,
+      runSession
+    })
+
+    expect(summary).toEqual({
+      outcome: 'aborted',
+      healedThreads: 0,
+      missingThreads: 0,
+      failedThreads: 0
+    })
+    warn.mockRestore()
+  })
+})
+
+describe('createCodexAccountStateDb', () => {
+  it('starts Codex on the home without sending any request', async () => {
+    const { runSession, readThreadIds } = fakeAppServer()
+    const invocations: string[] = []
+
+    const created = await createCodexAccountStateDb(HOME, {
+      buildInvocation: (home, timeoutMs) => {
+        invocations.push(home)
+        return { ...buildInvocation(), timeoutMs }
+      },
+      runSession
+    })
+
+    expect(created).toBe(true)
+    expect(invocations).toEqual([HOME])
+    expect(readThreadIds).toEqual([])
+  })
+
+  it('treats a Codex without app-server as having no state DB to stall', async () => {
+    const created = await createCodexAccountStateDb(HOME, {
+      buildInvocation,
+      runSession: async () => {
+        throw new CodexAppServerUnsupportedError('unknown subcommand app-server')
+      }
+    })
+
+    expect(created).toBe(true)
+  })
+
+  it('reports failure when Codex could not start', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    const created = await createCodexAccountStateDb(HOME, {
+      buildInvocation,
+      runSession: async () => {
+        throw new Error('spawn codex ENOENT')
+      }
+    })
+
+    expect(created).toBe(false)
+    warn.mockRestore()
+  })
+})
diff --git a/src/main/codex/codex-account-session-index-heal.ts b/src/main/codex/codex-account-session-index-heal.ts
new file mode 100644
index 00000000000..1af87e34407
--- /dev/null
+++ b/src/main/codex/codex-account-session-index-heal.ts
@@ -0,0 +1,122 @@
+import { normalizeRuntimePathForComparison } from '../../shared/cross-platform-path'
+import {
+  isCodexAppServerUnsupportedError,
+  runCodexAppServerSession
+} from './codex-app-server-session'
+import {
+  buildNativeHealInvocation,
+  readCodexThreadsForIndexHeal,
+  type CodexSessionIndexHealOptions,
+  type CodexThreadReadPassOutcome
+} from './codex-session-index-heal'
+import { readIndexedCodexThreadIds } from './codex-state-db'
+
+// Why: Codex indexes a home's rollouts only once, when it first creates the
+// state DB, and the /resume picker's "All" view lists only indexed threads.
+// History bridged in afterwards needs `thread/read`, Codex's lazy-indexing
+// path, to become visible there (#20669).
+
+export type CodexAccountSessionIndexHealSummary = {
+  outcome: CodexThreadReadPassOutcome | 'up-to-date' | 'no-index'
+  healedThreads: number
+  missingThreads: number
+  failedThreads: number
+}
+
+export type CodexAccountSessionIndexHealOptions = CodexSessionIndexHealOptions & {
+  readIndexedThreadIds?: (codexHomePath: string) => Set<string> | null
+}
+
+// Why: app-server finishes state DB startup before it answers `initialize`,
+// which takes ~100ms on an empty home.
+const STATE_DB_CREATE_TIMEOUT_MS = 15_000
+
+// Why: a just-linked rollout Codex refuses or cannot find fails the same way on
+// every read; skip it until Orca restarts instead of respawning app-server each launch.
+const failedThreadIdsByHome = new Map<string, Set<string>>()
+
+/**
+ * Starts Codex once on an empty home so it creates and indexes its state DB
+ * before any history is bridged in. False when Codex could not start.
+ */
+export async function createCodexAccountStateDb(
+  codexHomePath: string,
+  options: Pick<CodexSessionIndexHealOptions, 'buildInvocation' | 'runSession'> = {}
+): Promise<boolean> {
+  const buildInvocation = options.buildInvocation ?? buildNativeHealInvocation
+  const runSession = options.runSession ?? runCodexAppServerSession
+  try {
+    await runSession(buildInvocation(codexHomePath, STATE_DB_CREATE_TIMEOUT_MS), async () => {})
+    return true
+  } catch (error) {
+    // Why: a Codex without app-server predates the state DB, so linking cannot stall it.
+    if (isCodexAppServerUnsupportedError(error)) {
+      return true
+    }
+    console.warn('[codex-account-session-index-heal] Failed to create Codex state DB:', error)
+    return false
+  }
+}
+
+/**
+ * Indexes the bridged threads Codex has not indexed yet, newest rollout first.
+ * Diffing against the state DB on every pass makes an interrupted heal resume
+ * on the next launch.
+ */
+export async function healCodexAccountSessionIndex(
+  codexHomePath: string,
+  bridgedThreads: ReadonlyMap<string, string>,
+  options: CodexAccountSessionIndexHealOptions = {}
+): Promise<CodexAccountSessionIndexHealSummary> {
+  const summary: CodexAccountSessionIndexHealSummary = {
+    outcome: 'up-to-date',
+    healedThreads: 0,
+    missingThreads: 0,
+    failedThreads: 0
+  }
+  if (bridgedThreads.size === 0) {
+    return summary
+  }
+  // Why: with no DB in the home, Codex keeps none (older CLI) or uses a
+  // `sqlite_home` shared by every Orca home, which already indexes these threads.
+  const indexed = (options.readIndexedThreadIds ?? readIndexedCodexThreadIds)(codexHomePath)
+  if (!indexed) {
+    return { ...summary, outcome: 'no-index' }
+  }
+  const homeKey = normalizeRuntimePathForComparison(codexHomePath)
+  const failed = failedThreadIdsByHome.get(homeKey) ?? new Set<string>()
+  failedThreadIdsByHome.set(homeKey, failed)
+  // Why: a large history takes minutes to index, and /resume hides unindexed
+  // threads once a directory has any indexed one, so recent work goes first.
+  const pending = [...bridgedThreads]
+    .filter(([threadId]) => !indexed.has(threadId) && !failed.has(threadId))
+    .sort(([, left], [, right]) => (left < right ? 1 : left > right ? -1 : 0))
+    .map(([threadId]) => ({ threadId }))
+  if (pending.length === 0) {
+    return summary
+  }
+  summary.outcome = await readCodexThreadsForIndexHeal(
+    codexHomePath,
+    pending,
+    ({ threadId }, outcome) => {
+      if (outcome === 'healed') {
+        summary.healedThreads += 1
+        return
+      }
+      failed.add(threadId)
+      if (outcome === 'missing') {
+        summary.missingThreads += 1
+      } else {
+        summary.failedThreads += 1
+      }
+    },
+    options
+  )
+  return summary
+}
+
+export const _internals = {
+  resetFailedThreads: (): void => {
+    failedThreadIdsByHome.clear()
+  }
+}
diff --git a/src/main/codex/codex-app-server-connection-types.ts b/src/main/codex/codex-app-server-connection-types.ts
index 5c3c2f425a2..df3f40ac39a 100644
--- a/src/main/codex/codex-app-server-connection-types.ts
+++ b/src/main/codex/codex-app-server-connection-types.ts
@@ -9,6 +9,8 @@ export type CodexAppServerConnectionHandlers = {
   onServerRequest?: (request: CodexAppServerServerRequest) => void
   onUnhandledFrame?: (kind: string, payload: unknown) => void
   onExit?: (error: Error) => void
+  /** Awaited once the child has a pid and before the handshake; a rejection reaps the child. */
+  onSpawned?: (pid: number) => Promise<void>
 }
 
 export type CodexAppServerConnection = {
diff --git a/src/main/codex/codex-app-server-connection.test.ts b/src/main/codex/codex-app-server-connection.test.ts
index d67f2ebecc6..3d95e7ce380 100644
--- a/src/main/codex/codex-app-server-connection.test.ts
+++ b/src/main/codex/codex-app-server-connection.test.ts
@@ -2,6 +2,7 @@ import { EventEmitter } from 'node:events'
 import { realpathSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { PassThrough } from 'node:stream'
+import { providerDiagnosticOf } from '../../shared/agent-session-failure'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { spawnProcess } from '../../shared/child-process/run-process'
 import {
@@ -10,12 +11,17 @@ import {
   type CodexAppServerConnection,
   type CodexAppServerConnectionHandlers
 } from './codex-app-server-connection'
+import { PROVIDER_SUPERVISOR_MAX_STOP_MS } from './codex-app-server-posix-supervisor'
 import { isCodexAppServerUnsupportedError } from './codex-app-server-session'
 
+// close() waits out the supervisor's own stop before forcing the tree.
+const GRACEFUL_EXIT_MS = process.platform === 'win32' ? 1_500 : PROVIDER_SUPERVISOR_MAX_STOP_MS
+
 const originalCodexHome = process.env.CODEX_HOME
 
 afterEach(() => {
   vi.useRealTimers()
+  vi.restoreAllMocks()
   if (originalCodexHome === undefined) {
     delete process.env.CODEX_HOME
   } else {
@@ -182,6 +188,45 @@ describe('openCodexAppServerConnection', () => {
     await connection.close()
   })
 
+  it('reports the spawned pid before it sends the handshake', async () => {
+    const { child, spawnImpl, written } = stubChild()
+    answerInitialize(child)
+    const writtenAtSpawn: number[] = []
+
+    const connection = await openCodexAppServerConnection(
+      { command: 'codex', args: ['app-server'] },
+      {
+        onSpawned: async (pid) => {
+          writtenAtSpawn.push(written.length)
+          expect(pid).toBe(child.pid)
+        }
+      },
+      spawnImpl
+    )
+
+    // The owner is durable before initialize, so a crash mid-handshake leaves it stoppable.
+    expect(writtenAtSpawn).toEqual([0])
+    expect(written[0]).toMatchObject({ method: 'initialize' })
+    await connection.close()
+  })
+
+  it('reaps the child and never handshakes when its spawn cannot be recorded', async () => {
+    const { spawnImpl, written } = stubChild()
+
+    await expect(
+      openCodexAppServerConnection(
+        { command: 'codex', args: ['app-server'] },
+        {
+          onSpawned: async () => {
+            throw new Error('agent_session_checkpoint_stale')
+          }
+        },
+        spawnImpl
+      )
+    ).rejects.toThrow('agent_session_checkpoint_stale')
+    expect(written).toEqual([])
+  })
+
   it('completes the handshake and keeps the child alive across calls', async () => {
     const notifications: { method: string; params: unknown }[] = []
     const connection = await openFakeServer({
@@ -254,6 +299,9 @@ describe('openCodexAppServerConnection', () => {
 
     expect(isCodexAppServerRequestError(refusal)).toBe(true)
     expect((refusal as Error).message).toContain('bad params')
+    // Codex's own words, apart from Orca's prefix, for a person to read.
+    expect(providerDiagnosticOf(refusal)).toEqual({ text: 'bad params', audience: 'person' })
+    expect(providerDiagnosticOf(missing)).toBeUndefined()
     expect(isCodexAppServerUnsupportedError(missing)).toBe(true)
     expect(isCodexAppServerRequestError(missing)).toBe(false)
     await connection.close()
@@ -293,13 +341,42 @@ describe('openCodexAppServerConnection', () => {
     )
 
     child.stdout.write(`${JSON.stringify({ id: 'late-string-id', result: { value: 1 } })}\n`)
-    child.stdout.write(`${JSON.stringify({ id: 999, result: { value: 2 } })}\n`)
+    child.stdout.write(`${JSON.stringify({ id: null, error: { message: 'parse error' } })}\n`)
     await vi.waitFor(() => expect(frames).toHaveLength(2))
 
-    expect(frames.map((frame) => frame.kind)).toEqual(['frame:unclassified', 'response:unmatched'])
+    expect(frames.map((frame) => frame.kind)).toEqual(['frame:unclassified', 'frame:unclassified'])
     await connection.close()
   })
 
+  it('logs a reply to a timed-out request instead of surfacing it as a frame', async () => {
+    vi.useFakeTimers()
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const { child, spawnImpl, written } = stubChild()
+    answerInitialize(child)
+    const frames: string[] = []
+    const connection = await openCodexAppServerConnection(
+      { command: 'codex', args: ['app-server'] },
+      { onUnhandledFrame: (kind) => frames.push(kind) },
+      spawnImpl
+    )
+
+    const slow = rejection(connection.request('turn/interrupt', undefined, { timeoutMs: 50 }))
+    await vi.advanceTimersByTimeAsync(60)
+    expect((await slow).name).toBe('CodexAppServerTimeoutError')
+    const id = Number(written.find((frame) => frame.method === 'turn/interrupt')?.id)
+    child.stdout.write(`${JSON.stringify({ id, result: {} })}\n`)
+    child.stdout.write(`${JSON.stringify({ id: 999, error: { message: 'no such request' } })}\n`)
+    await vi.waitFor(() => expect(warn).toHaveBeenCalledTimes(2))
+
+    expect(frames).toEqual([])
+    expect(warn.mock.calls.map((call) => call[0])).toEqual([
+      `[codex-app-server] late reply to turn/interrupt after timeout (id ${id})`,
+      '[codex-app-server] reply with no waiting request (id 999)'
+    ])
+    expect(warn.mock.calls[1][1]).toBe('no such request')
+    await vi.advanceTimersByTimeAsync(0)
+  })
+
   it('fails in-flight requests and reports an unexpected exit once', async () => {
     const { child, spawnImpl } = stubChild({ exitOnStdinEnd: false })
     answerInitialize(child)
@@ -349,7 +426,7 @@ describe('openCodexAppServerConnection', () => {
       openCodexAppServerConnection({ command: 'codex', args: ['app-server'] }, {}, spawnImpl)
     )
 
-    await vi.advanceTimersByTimeAsync(5_000)
+    await vi.advanceTimersByTimeAsync(GRACEFUL_EXIT_MS + 3_500)
     const error = (await opening) as Error & { connection?: CodexAppServerConnection }
 
     expect(error.name).toBe('CodexAppServerHandshakeExitUnprovenError')
@@ -391,7 +468,7 @@ describe('openCodexAppServerConnection', () => {
     })
 
     const closing = connection.close()
-    await vi.advanceTimersByTimeAsync(2_000)
+    await vi.advanceTimersByTimeAsync(GRACEFUL_EXIT_MS + 500)
     await closing
 
     await vi.waitFor(() => expect(child.kill).toHaveBeenCalledWith('SIGKILL'))
@@ -425,7 +502,7 @@ describe('openCodexAppServerConnection', () => {
 
     const first = connection.close()
     const second = connection.close()
-    await vi.advanceTimersByTimeAsync(4_100)
+    await vi.advanceTimersByTimeAsync(GRACEFUL_EXIT_MS + 2_600)
 
     await expect(Promise.all([first, second])).resolves.toEqual([true, true])
     expect(child.kill.mock.calls.map(([signal]) => signal)).toEqual(['SIGSTOP', 'SIGKILL'])
@@ -442,7 +519,7 @@ describe('openCodexAppServerConnection', () => {
     )
 
     const first = connection.close()
-    await vi.advanceTimersByTimeAsync(5_000)
+    await vi.advanceTimersByTimeAsync(GRACEFUL_EXIT_MS + 3_500)
     await expect(first).resolves.toBe(false)
     child.emit('exit', 0, null)
 
@@ -536,6 +613,36 @@ describe('openCodexAppServerConnection', () => {
     await connection.close()
   })
 
+  it('delivers a notification beyond the daemon wire limit whole, never as an oversized frame', async () => {
+    const { child, spawnImpl } = stubChild()
+    answerInitialize(child)
+    const frames: string[] = []
+    const deltas: unknown[] = []
+    const connection = await openCodexAppServerConnection(
+      { command: 'codex', args: ['app-server'] },
+      {
+        onUnhandledFrame: (kind) => frames.push(kind),
+        onNotification: (method, params) => {
+          if (method === 'item/commandExecution/outputDelta') {
+            deltas.push(params)
+          }
+        }
+      },
+      spawnImpl
+    )
+
+    const params = { threadId: 'thread-1', itemId: 'exec-1', delta: '' }
+    params.delta = 'x'.repeat(16 * 1024 * 1024 + 1)
+    child.stdout.write(
+      `${JSON.stringify({ method: 'item/commandExecution/outputDelta', params })}\n`
+    )
+
+    await vi.waitFor(() => expect(deltas).toEqual([params]))
+    expect(frames).toEqual([])
+    expect(connection.closed).toBe(false)
+    await connection.close()
+  })
+
   it('keeps malformed and non-object JSON non-fatal and processes the next record', async () => {
     const { child, spawnImpl } = stubChild()
     answerInitialize(child)
diff --git a/src/main/codex/codex-app-server-connection.ts b/src/main/codex/codex-app-server-connection.ts
index 4bfd9a15169..3e7d16ea1bb 100644
--- a/src/main/codex/codex-app-server-connection.ts
+++ b/src/main/codex/codex-app-server-connection.ts
@@ -1,11 +1,13 @@
 import { spawnProcess } from '../../shared/child-process/run-process'
 import { RetryableProcessExitProof } from '../../shared/child-process/retryable-process-exit-proof'
-import { createProviderSpawnSpec } from './codex-app-server-posix-supervisor'
+import {
+  createProviderSpawnSpec,
+  PROVIDER_SUPERVISOR_MAX_STOP_MS
+} from './codex-app-server-posix-supervisor'
 import { buildCodexAppServerExitError } from './codex-app-server-exit-error'
 import { initializeCodexAppServerConnection } from './codex-app-server-handshake'
 import { CodexAppServerHandshakeExitUnprovenError } from './codex-app-server-handshake-exit-proof'
 import { terminateCodexAppServerProcessTree } from './codex-app-server-process-teardown'
-import { CODEX_SPAWN_TOKEN_ENV } from './codex-structured-owner-identity'
 import { waitForProcessExitUntil } from './codex-process-exit-deadline'
 import {
   CodexAppServerTimeoutError,
@@ -44,7 +46,7 @@ export type CodexAppServerLaunch = {
 }
 
 const DEFAULT_REQUEST_TIMEOUT_MS = 30_000
-const GRACEFUL_EXIT_MS = 1_500
+export const GRACEFUL_EXIT_MS = 1_500
 const FORCED_EXIT_MS = 1_000
 const STDERR_TAIL_MAX_BYTES = 8192
 
@@ -64,12 +66,11 @@ export async function openCodexAppServerConnection(
   }
   const spawnSpec = createProviderSpawnSpec(launch, childEnv, process.platform)
   const child = spawnImpl(spawnSpec)
-  const spawnToken = launch.env?.[CODEX_SPAWN_TOKEN_ENV]
 
   function terminateProcessTree(): Promise<boolean> {
     // The supervisor and provider own separate POSIX groups so the supervisor can prove the
     // provider group empty before relaying its exit. Forced wrapper teardown uses descendant proof.
-    return terminateCodexAppServerProcessTree(child, spawnToken)
+    return terminateCodexAppServerProcessTree(child)
   }
 
   let stderrTail = ''
@@ -212,7 +213,7 @@ export async function openCodexAppServerConnection(
       // Why: per request, not per session — a chat session outlives every call,
       // so only the individual call can carry a deadline.
       const timer = setTimeout(() => {
-        dispatcher.deletePending(id)
+        dispatcher.timeOutPending(id)
         reject(new CodexAppServerTimeoutError(`codex app-server ${method} exceeded ${timeoutMs}ms`))
       }, timeoutMs)
       dispatcher.addPending(id, { method, resolve, reject, timer })
@@ -249,7 +250,11 @@ export async function openCodexAppServerConnection(
         // Already destroyed; the reap below still runs.
       }
       if (!exited) {
-        await waitForProcessExitUntil(exitPromise, GRACEFUL_EXIT_MS)
+        // The POSIX supervisor stops its own provider group; forcing it any sooner can orphan it.
+        await waitForProcessExitUntil(
+          exitPromise,
+          process.platform === 'win32' ? GRACEFUL_EXIT_MS : PROVIDER_SUPERVISOR_MAX_STOP_MS
+        )
         if (!exited) {
           const treeExited = await terminateProcessTree()
           if (!treeExited) {
@@ -280,13 +285,20 @@ export async function openCodexAppServerConnection(
     close
   }
 
+  let handshaking = false
   try {
+    // A spawn that failed has no pid; the handshake below reports why.
+    if (child.pid !== undefined) {
+      await handlers.onSpawned?.(child.pid)
+    }
+    handshaking = true
     await initializeCodexAppServerConnection(connection)
   } catch (error) {
     if ((await close()) !== true) {
       throw new CodexAppServerHandshakeExitUnprovenError(connection, error)
     }
-    throw error instanceof CodexAppServerUnsupportedError ||
+    throw !handshaking ||
+      error instanceof CodexAppServerUnsupportedError ||
       error instanceof CodexAppServerTimeoutError
       ? error
       : buildExitError(error instanceof Error ? error : new Error(String(error)))
diff --git a/src/main/codex/codex-app-server-exit-error.test.ts b/src/main/codex/codex-app-server-exit-error.test.ts
new file mode 100644
index 00000000000..63ec9a63743
--- /dev/null
+++ b/src/main/codex/codex-app-server-exit-error.test.ts
@@ -0,0 +1,20 @@
+import { describe, expect, it } from 'vitest'
+import { providerDiagnosticOf } from '../../shared/agent-session-failure'
+import { buildCodexAppServerExitError } from './codex-app-server-exit-error'
+
+describe('buildCodexAppServerExitError', () => {
+  it("keeps the stderr tail apart from Orca's wording, as log text", () => {
+    const error = buildCodexAppServerExitError('  thread panicked at main.rs:4  ')
+    expect(error.message).toBe('codex app-server connection ended: thread panicked at main.rs:4')
+    expect(providerDiagnosticOf(error)).toEqual({
+      text: 'thread panicked at main.rs:4',
+      audience: 'log'
+    })
+  })
+
+  it('carries no diagnostic when a cause, not the stderr, explains the end', () => {
+    const error = buildCodexAppServerExitError('ignored', new Error('spawn codex ENOENT'))
+    expect(providerDiagnosticOf(error)).toBeUndefined()
+    expect(providerDiagnosticOf(buildCodexAppServerExitError(''))).toBeUndefined()
+  })
+})
diff --git a/src/main/codex/codex-app-server-exit-error.ts b/src/main/codex/codex-app-server-exit-error.ts
index 85d8bc7dd6e..8812e6698a0 100644
--- a/src/main/codex/codex-app-server-exit-error.ts
+++ b/src/main/codex/codex-app-server-exit-error.ts
@@ -2,6 +2,7 @@
 // stderr tail is the only evidence: a CLI without the subcommand is a durable
 // capability fact, and anything else is this run's crash.
 
+import { providerDiagnostic, withProviderDiagnostic } from '../../shared/agent-session-failure'
 import { stderrIndicatesMissingAppServer } from './codex-app-server-capability-signal'
 import { CodexAppServerUnsupportedError } from './codex-app-server-session'
 
@@ -9,11 +10,17 @@ const EXIT_DETAIL_MAX_CHARS = 400
 
 export function buildCodexAppServerExitError(stderrTail: string, cause?: Error): Error {
   const tail = stderrTail.trim().slice(0, EXIT_DETAIL_MAX_CHARS)
+  // The tail is Codex's own stderr: a log, kept behind Details.
+  const diagnostic = providerDiagnostic(tail, 'log')
   if (stderrIndicatesMissingAppServer(stderrTail)) {
-    return new CodexAppServerUnsupportedError(
-      `codex CLI does not support the app-server subcommand: ${tail}`
+    return withProviderDiagnostic(
+      new CodexAppServerUnsupportedError(
+        `codex CLI does not support the app-server subcommand: ${tail}`
+      ),
+      diagnostic
     )
   }
   const detail = cause ? `: ${cause.message}` : tail ? `: ${tail}` : ''
-  return new Error(`codex app-server connection ended${detail}`)
+  const error = new Error(`codex app-server connection ended${detail}`)
+  return cause ? error : withProviderDiagnostic(error, diagnostic)
 }
diff --git a/src/main/codex/codex-app-server-posix-supervisor.integration.test.ts b/src/main/codex/codex-app-server-posix-supervisor.integration.test.ts
new file mode 100644
index 00000000000..846afaa973f
--- /dev/null
+++ b/src/main/codex/codex-app-server-posix-supervisor.integration.test.ts
@@ -0,0 +1,355 @@
+import { spawn, type ChildProcess } from 'node:child_process'
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  POSIX_PROVIDER_SUPERVISOR_SCRIPT,
+  PROVIDER_SIGTERM_GRACE_MS,
+  PROVIDER_STDIN_END_GRACE_MS,
+  PROVIDER_SUPERVISOR_MAX_STOP_MS,
+  supervisedPosixLaunch,
+  type ProviderSupervisorOptions
+} from './codex-app-server-posix-supervisor'
+
+// The provider leads its own group; its grandchild shares that group and ignores SIGTERM.
+const PROVIDER = String.raw`
+  const { spawn } = require('node:child_process')
+  if (process.env.ORCA_TEST_PROVIDER_IGNORES_SIGTERM) process.on('SIGTERM', () => {})
+  if (process.env.ORCA_TEST_PROVIDER_SIGNAL_FILE) {
+    process.on('SIGTERM', () => {
+      require('node:fs').writeFileSync(process.env.ORCA_TEST_PROVIDER_SIGNAL_FILE, 'SIGTERM')
+      process.exit(0)
+    })
+  }
+  process.stdout.on('error', () => {})
+  const grandchild = spawn(
+    process.execPath,
+    ['-e', "process.on('SIGTERM', () => {}); process.stdout.write('armed'); setInterval(() => {}, 60000)"],
+    { stdio: ['ignore', 'pipe', 'ignore'] }
+  )
+  grandchild.stdout.once('data', () => {
+    process.stdout.write(JSON.stringify({ provider: process.pid, grandchild: grandchild.pid }) + '\n')
+    if (process.env.ORCA_TEST_PROVIDER_STREAMS_OUTPUT) setInterval(() => process.stdout.write('.'), 2)
+  })
+  setInterval(() => {}, 60000)
+`
+
+// Exits the moment its stdin ends, as Codex does on a normal close.
+const EXITS_ON_STDIN_END_PROVIDER = String.raw`
+  process.stdin.on('end', () => process.exit(0)).resume()
+  process.stdout.write(JSON.stringify({ provider: process.pid }) + '\n')
+`
+
+// Ignores stdin end and SIGTERM, recording when SIGTERM arrived, so only SIGKILL ends it.
+const RECORDS_SIGTERM_PROVIDER = String.raw`
+  process.on('SIGTERM', () => {
+    require('node:fs').writeFileSync(process.env.ORCA_TEST_PROVIDER_SIGNAL_FILE, String(Date.now()))
+  })
+  process.stdout.write(JSON.stringify({ provider: process.pid }) + '\n')
+  setInterval(() => {}, 60000)
+`
+
+// Stands in for Orca: launches the supervisor as its own child, then can be killed outright. A
+// second child holds the supervisor's stdin open, so only the parent-death watch can notice.
+// A clean-quit owner has no holder and exits normally on SIGUSR2, the way Orca quits.
+const OWNER = String.raw`
+  const { spawn } = require('node:child_process')
+  const quitsCleanly = Boolean(process.env.ORCA_TEST_OWNER_QUITS_CLEANLY)
+  if (quitsCleanly) process.on('SIGUSR2', () => process.exit(0))
+  const spec = JSON.parse(Buffer.from(process.env.ORCA_PROVIDER_SUPERVISOR_SPEC, 'base64').toString())
+  spec.ownerPid = process.pid
+  const supervisor = spawn(process.execPath, ['-e', process.env.ORCA_TEST_SUPERVISOR_SCRIPT], {
+    env: { ...process.env, ORCA_PROVIDER_SUPERVISOR_SPEC: Buffer.from(JSON.stringify(spec)).toString('base64') },
+    stdio: ['pipe', 'pipe', 'ignore'],
+    detached: true
+  })
+  const holder = quitsCleanly
+    ? null
+    : spawn(process.execPath, ['-e', 'setInterval(() => {}, 60000)'], {
+        stdio: ['ignore', supervisor.stdin, 'ignore']
+      })
+  process.stdout.write(JSON.stringify({ supervisor: supervisor.pid, ...(holder && { holder: holder.pid }) }) + '\n')
+  supervisor.stdout.pipe(process.stdout)
+  setInterval(() => {}, 60000)
+`
+
+// Preloaded into the supervisor: signals it the instant its provider exists, the spawn window.
+const SIGNAL_AFTER_SPAWN_PRELOAD = String.raw`
+  const childProcess = require('node:child_process')
+  const spawn = childProcess.spawn
+  childProcess.spawn = (...args) => {
+    const child = spawn(...args)
+    require('node:fs').writeFileSync(process.env.ORCA_TEST_PROVIDER_PID_FILE, String(child.pid))
+    process.kill(process.pid, 'SIGTERM')
+    return child
+  }
+`
+
+const recordedPids = new Set<number>()
+const tempDirs: string[] = []
+
+function tempDir(): string {
+  const dir = mkdtempSync(join(tmpdir(), 'orca-supervisor-'))
+  tempDirs.push(dir)
+  return dir
+}
+
+function alive(pid: number): boolean {
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (error) {
+    return !(error instanceof Error && 'code' in error && error.code === 'ESRCH')
+  }
+}
+
+async function waitFor(predicate: () => boolean, timeoutMs: number): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs
+  while (!predicate()) {
+    if (Date.now() >= deadline) {
+      return false
+    }
+    await new Promise((resolve) => setTimeout(resolve, 25))
+  }
+  return true
+}
+
+function readPids(child: ChildProcess, keys: readonly string[]): Promise<Record<string, number>> {
+  return new Promise((resolve, reject) => {
+    const pids: Record<string, number> = {}
+    let buffered = ''
+    const timeout = setTimeout(() => reject(new Error(`no ${keys.join('/')} pids`)), 10_000)
+    const onData = (chunk: Buffer): void => {
+      buffered += chunk.toString()
+      const lines = buffered.split('\n')
+      buffered = lines.pop() ?? ''
+      for (const line of lines) {
+        const parsed: unknown = JSON.parse(line)
+        for (const [key, pid] of Object.entries(parsed ?? {})) {
+          if (typeof pid === 'number') {
+            pids[key] = pid
+            recordedPids.add(pid)
+          }
+        }
+      }
+      if (keys.every((key) => key in pids)) {
+        clearTimeout(timeout)
+        // Later output is not pids; the stream keeps flowing without a listener.
+        child.stdout!.off('data', onData)
+        resolve(pids)
+      }
+    }
+    child.stdout!.on('data', onData)
+  })
+}
+
+function launchSupervisor(
+  options: ProviderSupervisorOptions,
+  env: Record<string, string> = {},
+  provider: { command: string; args: string[] } = {
+    command: process.execPath,
+    args: ['-e', PROVIDER]
+  },
+  nodeArgs: string[] = []
+): { supervisor: ChildProcess; exit: Promise<{ code: number | null; signal: string | null }> } {
+  const launch = supervisedPosixLaunch(provider, { ...process.env, ...env }, options)
+  const supervisor = spawn(launch.command, [...nodeArgs, ...launch.args], {
+    env: launch.env,
+    stdio: ['pipe', 'pipe', 'ignore'],
+    detached: true
+  })
+  recordedPids.add(supervisor.pid!)
+  const exit = new Promise<{ code: number | null; signal: string | null }>((resolve) =>
+    supervisor.once('exit', (code, signal) => resolve({ code, signal }))
+  )
+  return { supervisor, exit }
+}
+
+async function launchUnderOwner(
+  options: ProviderSupervisorOptions,
+  env: Record<string, string> = {}
+): Promise<{ owner: ChildProcess; pids: Record<string, number> }> {
+  const launch = supervisedPosixLaunch(
+    { command: process.execPath, args: ['-e', PROVIDER] },
+    { ...process.env, ...env },
+    options
+  )
+  const owner = spawn(process.execPath, ['-e', OWNER], {
+    env: { ...launch.env, ORCA_TEST_SUPERVISOR_SCRIPT: POSIX_PROVIDER_SUPERVISOR_SCRIPT },
+    stdio: ['ignore', 'pipe', 'ignore']
+  })
+  recordedPids.add(owner.pid!)
+  const pids = await readPids(owner, ['supervisor', 'provider', 'grandchild'])
+  return { owner, pids }
+}
+
+afterEach(() => {
+  for (const pid of recordedPids) {
+    if (alive(pid)) {
+      process.kill(pid, 'SIGKILL')
+    }
+  }
+  recordedPids.clear()
+  for (const dir of tempDirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+describe.runIf(process.platform !== 'win32')('POSIX provider supervisor processes', () => {
+  it('reaps the provider group on SIGTERM and exits only after the group is gone', async () => {
+    const { supervisor, exit } = launchSupervisor({ sigtermGraceMs: 300 })
+    const { provider, grandchild } = await readPids(supervisor, ['provider', 'grandchild'])
+
+    let groupAliveAtExit: boolean | null = null
+    void exit.then(() => {
+      groupAliveAtExit = alive(-provider)
+    })
+    supervisor.kill('SIGTERM')
+
+    await expect(exit).resolves.toEqual({ code: null, signal: 'SIGTERM' })
+    expect(groupAliveAtExit).toBe(false)
+    expect(alive(provider)).toBe(false)
+    expect(alive(grandchild)).toBe(false)
+  })
+
+  it('escalates a SIGTERM-ignoring provider to SIGKILL after the grace from the spec', async () => {
+    const graceMs = 200
+    const { supervisor, exit } = launchSupervisor(
+      { sigtermGraceMs: graceMs },
+      { ORCA_TEST_PROVIDER_IGNORES_SIGTERM: '1' }
+    )
+    const { provider, grandchild } = await readPids(supervisor, ['provider', 'grandchild'])
+
+    const signalledAt = Date.now()
+    supervisor.kill('SIGTERM')
+    const exited = await Promise.race([exit, new Promise((resolve) => setTimeout(resolve, 5_000))])
+
+    expect(exited).toEqual({ code: null, signal: 'SIGTERM' })
+    expect(Date.now() - signalledAt).toBeGreaterThanOrEqual(graceMs)
+    expect(Date.now() - signalledAt).toBeLessThan(PROVIDER_SIGTERM_GRACE_MS)
+    expect(alive(provider)).toBe(false)
+    expect(alive(grandchild)).toBe(false)
+  })
+
+  it('reaps a provider spawned in the instant before a stop arrives', async () => {
+    const dir = tempDir()
+    const preload = join(dir, 'signal-after-spawn.js')
+    const pidFile = join(dir, 'provider-pid')
+    writeFileSync(preload, SIGNAL_AFTER_SPAWN_PRELOAD)
+    const { exit } = launchSupervisor(
+      { sigtermGraceMs: 300 },
+      { ORCA_TEST_PROVIDER_PID_FILE: pidFile },
+      { command: process.execPath, args: ['-e', 'setInterval(() => {}, 60000)'] },
+      ['--require', preload]
+    )
+
+    await expect(exit).resolves.toEqual({ code: null, signal: 'SIGTERM' })
+    const provider = Number(readFileSync(pidFile, 'utf8'))
+    recordedPids.add(provider)
+    expect(await waitFor(() => !alive(provider), 3_000)).toBe(true)
+  })
+
+  it('never spawns the provider when its owner is not its parent at start', async () => {
+    const marker = join(tempDir(), 'provider-started')
+    const { exit } = launchSupervisor(
+      { ownerPid: process.pid === 1 ? 2 : 1 },
+      {},
+      { command: 'touch', args: [marker] }
+    )
+
+    await expect(exit).resolves.toEqual({ code: 1, signal: null })
+    await new Promise((resolve) => setTimeout(resolve, 200))
+    expect(existsSync(marker)).toBe(false)
+  })
+
+  it.each([
+    ['', {}],
+    // Output after the owner's death meets a closed pipe, which must not end the supervisor first.
+    [' while the provider is writing output', { ORCA_TEST_PROVIDER_STREAMS_OUTPUT: '1' }]
+  ])('reaps the provider group when its owner dies%s', async (_, env) => {
+    const graceMs = 300
+    const { owner, pids } = await launchUnderOwner({ sigtermGraceMs: graceMs }, env)
+
+    const killedAt = Date.now()
+    owner.kill('SIGKILL')
+
+    expect(await waitFor(() => !alive(-pids.provider), 3_000)).toBe(true)
+    // The grandchild ignores SIGTERM, so the group lasts until the grace ends in SIGKILL.
+    expect(Date.now() - killedAt).toBeGreaterThanOrEqual(graceMs)
+    expect(await waitFor(() => !alive(pids.supervisor), 3_000)).toBe(true)
+    expect(alive(pids.grandchild)).toBe(false)
+  })
+
+  it('closes a provider that exits on stdin end without waiting out any grace', async () => {
+    const { supervisor, exit } = launchSupervisor(
+      {},
+      {},
+      {
+        command: process.execPath,
+        args: ['-e', EXITS_ON_STDIN_END_PROVIDER]
+      }
+    )
+    const { provider } = await readPids(supervisor, ['provider'])
+
+    const endedAt = Date.now()
+    supervisor.stdin!.end()
+
+    await expect(exit).resolves.toEqual({ code: 0, signal: null })
+    expect(Date.now() - endedAt).toBeLessThan(PROVIDER_STDIN_END_GRACE_MS)
+    expect(alive(provider)).toBe(false)
+  })
+
+  it('gives a provider 1 s after stdin end, then 3 s after SIGTERM before SIGKILL', async () => {
+    const signalFile = join(tempDir(), 'provider-sigterm-at')
+    const { supervisor, exit } = launchSupervisor(
+      {},
+      { ORCA_TEST_PROVIDER_SIGNAL_FILE: signalFile },
+      { command: process.execPath, args: ['-e', RECORDS_SIGTERM_PROVIDER] }
+    )
+    const { provider } = await readPids(supervisor, ['provider'])
+
+    const endedAt = Date.now()
+    supervisor.stdin!.end()
+    const exited = await exit
+    const exitedAt = Date.now()
+    const signalledAt = Number(readFileSync(signalFile, 'utf8'))
+
+    expect(exited).toEqual({ code: 137, signal: null })
+    // Timers may fire a tick early against another process's clock.
+    expect(signalledAt - endedAt).toBeGreaterThanOrEqual(1_000 - 20)
+    expect(exitedAt - signalledAt).toBeGreaterThanOrEqual(3_000 - 20)
+    expect(exitedAt - endedAt).toBeLessThan(PROVIDER_SUPERVISOR_MAX_STOP_MS + 1_000)
+    expect(alive(provider)).toBe(false)
+  })
+
+  it('reaps the provider group and exits when its owner quits cleanly', async () => {
+    const { owner, pids } = await launchUnderOwner(
+      { sigtermGraceMs: 300 },
+      { ORCA_TEST_OWNER_QUITS_CLEANLY: '1' }
+    )
+    const ownerExit = new Promise((resolve) =>
+      owner.once('exit', (code, signal) => resolve({ code, signal }))
+    )
+
+    owner.kill('SIGUSR2')
+
+    await expect(ownerExit).resolves.toEqual({ code: 0, signal: null })
+    expect(await waitFor(() => !alive(-pids.provider), 3_000)).toBe(true)
+    expect(await waitFor(() => !alive(pids.supervisor), 3_000)).toBe(true)
+    expect(alive(pids.grandchild)).toBe(false)
+  })
+
+  it('asks the provider to stop with SIGTERM when its owner dies', async () => {
+    const signalFile = join(tempDir(), 'provider-signal')
+    const { owner, pids } = await launchUnderOwner(
+      { sigtermGraceMs: 300 },
+      { ORCA_TEST_PROVIDER_SIGNAL_FILE: signalFile }
+    )
+
+    owner.kill('SIGKILL')
+
+    expect(await waitFor(() => !alive(-pids.provider), 3_000)).toBe(true)
+    expect(existsSync(signalFile) && readFileSync(signalFile, 'utf8')).toBe('SIGTERM')
+  })
+})
diff --git a/src/main/codex/codex-app-server-posix-supervisor.test.ts b/src/main/codex/codex-app-server-posix-supervisor.test.ts
index f51157a443c..6dbe03e5b2a 100644
--- a/src/main/codex/codex-app-server-posix-supervisor.test.ts
+++ b/src/main/codex/codex-app-server-posix-supervisor.test.ts
@@ -3,6 +3,8 @@ import type { CodexAppServerLaunch } from './codex-app-server-connection'
 import {
   createProviderSpawnSpec,
   POSIX_PROVIDER_SUPERVISOR_SCRIPT,
+  PROVIDER_SIGTERM_GRACE_MS,
+  PROVIDER_STDIN_END_GRACE_MS,
   supervisedPosixLaunch
 } from './codex-app-server-posix-supervisor'
 
@@ -27,7 +29,10 @@ describe('structured provider supervision', () => {
       expect.objectContaining({
         command: '/opt/codex',
         args: ['app-server', '--flag'],
-        cwd: '/work/repo'
+        cwd: '/work/repo',
+        ownerPid: process.pid,
+        stdinEndGraceMs: PROVIDER_STDIN_END_GRACE_MS,
+        sigtermGraceMs: PROVIDER_SIGTERM_GRACE_MS
       })
     )
     expect(
@@ -38,7 +43,7 @@ describe('structured provider supervision', () => {
     )
     expect(POSIX_PROVIDER_SUPERVISOR_SCRIPT).toContain('delete childEnv.ELECTRON_RUN_AS_NODE')
     expect(spec.env.ELECTRON_RUN_AS_NODE).toBe('1')
-    expect(POSIX_PROVIDER_SUPERVISOR_SCRIPT).toContain('process.ppid !== originalParent')
+    expect(POSIX_PROVIDER_SUPERVISOR_SCRIPT).toContain('process.ppid !== spec.ownerPid')
     expect(POSIX_PROVIDER_SUPERVISOR_SCRIPT).toContain(
       "process.stdin.once('close', scheduleOwnerShutdown)"
     )
@@ -49,13 +54,26 @@ describe('structured provider supervision', () => {
     expect(POSIX_PROVIDER_SUPERVISOR_SCRIPT).not.toContain('process.ppid === 1')
   })
 
+  it('refuses a grace longer than recovery waits before SIGKILL', () => {
+    const stdinEnd = (stdinEndGraceMs: number) => () =>
+      supervisedPosixLaunch(launch, {}, { stdinEndGraceMs })
+    const sigterm = (sigtermGraceMs: number) => () =>
+      supervisedPosixLaunch(launch, {}, { sigtermGraceMs })
+
+    expect(stdinEnd(PROVIDER_STDIN_END_GRACE_MS)).not.toThrow()
+    expect(stdinEnd(PROVIDER_STDIN_END_GRACE_MS + 1)).toThrow(RangeError)
+    expect(sigterm(PROVIDER_SIGTERM_GRACE_MS)).not.toThrow()
+    expect(sigterm(PROVIDER_SIGTERM_GRACE_MS + 1)).toThrow(RangeError)
+  })
+
   it('uses direct provider spawning on Windows because the job owns the tree', () => {
     expect(createProviderSpawnSpec(launch, { PATH: '/bin' }, 'win32')).toEqual({
       program: '/opt/codex',
       args: ['app-server', '--flag'],
       env: { PATH: '/bin' },
       cwd: '/work/repo',
-      detached: false
+      detached: false,
+      supervised: false
     })
   })
 })
diff --git a/src/main/codex/codex-app-server-posix-supervisor.ts b/src/main/codex/codex-app-server-posix-supervisor.ts
index f83ba6f374b..21dd56aeb5b 100644
--- a/src/main/codex/codex-app-server-posix-supervisor.ts
+++ b/src/main/codex/codex-app-server-posix-supervisor.ts
@@ -1,9 +1,33 @@
 import type { CodexAppServerLaunch } from './codex-app-server-connection'
 
+/** Time the provider gets to exit on its own after its stdin ends, before SIGTERM. */
+export const PROVIDER_STDIN_END_GRACE_MS = 1_000
+/** Time the provider group gets to flush and exit after SIGTERM, before SIGKILL. */
+export const PROVIDER_SIGTERM_GRACE_MS = 3_000
+/**
+ * How long the supervisor waits for a SIGKILLed group to disappear. A killed process never runs
+ * again, so this only covers the kernel finishing the kill; waiting forever could hang close or
+ * recovery on a process stuck in the kernel, such as one blocked on a hung network drive.
+ */
+export const PROVIDER_GROUP_REAP_TIMEOUT_MS = 1_500
+/**
+ * Longest a supervisor can take to stop once asked (stdin end, grace, SIGTERM, grace, SIGKILL,
+ * reap); a SIGKILL sooner can orphan its group. The graces are also the largest a spec may carry.
+ */
+export const PROVIDER_SUPERVISOR_MAX_STOP_MS =
+  PROVIDER_STDIN_END_GRACE_MS + PROVIDER_SIGTERM_GRACE_MS + PROVIDER_GROUP_REAP_TIMEOUT_MS
+
 /** Inline supervisor source kept dependency-free for the spawned Node child. */
 export const POSIX_PROVIDER_SUPERVISOR_SCRIPT = `
 const { spawn } = require('node:child_process')
 const spec = JSON.parse(Buffer.from(process.env.ORCA_PROVIDER_SUPERVISOR_SPEC, 'base64').toString())
+// A detached supervisor is reparented when its owner exits. The new parent may
+// be PID 1 or a platform subreaper, so any other parent means no live owner.
+const ownerGone = () => process.ppid !== spec.ownerPid
+// Registered before the spawn, so a stop that lands while the provider starts still reaps it.
+for (const signal of ['SIGTERM', 'SIGINT', 'SIGHUP']) process.on(signal, () => stopProviderGroup(signal))
+// Orca can die before this runs; spawning then would start a provider nothing watches.
+if (ownerGone()) process.exit(1)
 const childEnv = { ...process.env }
 delete childEnv.ORCA_PROVIDER_SUPERVISOR_SPEC
 delete childEnv.ELECTRON_RUN_AS_NODE
@@ -13,7 +37,6 @@ const child = spawn(spec.command, spec.args, {
   stdio: ['pipe', 'pipe', 'pipe'],
   detached: true
 })
-const originalParent = process.ppid
 let timer
 let ownerShutdownTimer
 let settling = false
@@ -26,29 +49,47 @@ const providerGroupExists = () => {
     return Boolean(error && error.code !== 'ESRCH')
   }
 }
-const reapOwnedProviderGroup = async () => {
-  if (!child.pid) return false
-  try { process.kill(-child.pid, 'SIGKILL') } catch (error) {
-    if (error && error.code !== 'ESRCH') return false
-  }
-  const deadline = Date.now() + 1500
+const waitForProviderGroupExit = async (timeoutMs) => {
+  const deadline = Date.now() + timeoutMs
   while (providerGroupExists()) {
     if (Date.now() >= deadline) return false
     await new Promise((resolve) => setTimeout(resolve, 25))
   }
   return true
 }
-const terminateOwnedGroup = () => {
+const reapOwnedProviderGroup = async () => {
+  if (!child.pid) return false
+  try { process.kill(-child.pid, 'SIGKILL') } catch (error) {
+    if (error && error.code !== 'ESRCH') return false
+  }
+  return waitForProviderGroupExit(${PROVIDER_GROUP_REAP_TIMEOUT_MS})
+}
+const finishWithProviderOutcome = (code, signal) => {
+  if (!signal) return process.exit(code ?? 1)
+  // Re-raise with the default action; this supervisor's own handler would swallow it.
+  process.removeAllListeners(signal)
+  process.kill(process.pid, signal)
+}
+// Every stop is the same: SIGTERM the group, SIGKILL it after its grace, and exit only once it is
+// gone. Whoever stops this pid judges the provider by it, so a dead supervisor means a dead group.
+const stopProviderGroup = (receivedSignal) => {
   if (settling) return
   settling = true
   clearInterval(timer)
-  void reapOwnedProviderGroup().then((reaped) => process.exit(reaped ? 137 : 1))
+  if (ownerShutdownTimer) clearTimeout(ownerShutdownTimer)
+  try { process.kill(-child.pid, 'SIGTERM') } catch {}
+  void waitForProviderGroupExit(spec.sigtermGraceMs)
+    .then((exited) => exited || reapOwnedProviderGroup())
+    .then((reaped) => {
+      if (!reaped) return process.exit(1)
+      finishWithProviderOutcome(137, receivedSignal)
+    })
 }
 const scheduleOwnerShutdown = () => {
   if (settling || ownerShutdownTimer) return
   // A normal close ends the provider's stdin first; allow it to flush and
   // exit before forcing the group, while still bounding an orphaned child.
-  ownerShutdownTimer = setTimeout(terminateOwnedGroup, 1250)
+  ownerShutdownTimer = setTimeout(() => stopProviderGroup(null), spec.stdinEndGraceMs)
   ownerShutdownTimer.unref()
 }
 process.stdin.once('end', scheduleOwnerShutdown)
@@ -56,10 +97,9 @@ process.stdin.once('close', scheduleOwnerShutdown)
 process.stdin.pipe(child.stdin)
 child.stdout.pipe(process.stdout)
 child.stderr.pipe(process.stderr)
-for (const stream of [process.stdin, child.stdin, child.stdout, child.stderr]) stream.on('error', () => {})
-const finishWithProviderOutcome = (code, signal) => {
-  if (!signal) return process.exit(code ?? 1)
-  process.kill(process.pid, signal)
+// A dead owner's stdout pipe raises EPIPE; unhandled, it would end this pid before the group.
+for (const stream of [process.stdin, process.stdout, process.stderr, child.stdin, child.stdout, child.stderr]) {
+  stream.on('error', () => {})
 }
 const reapProviderExit = async (code, signal) => {
   if (settling) return
@@ -70,33 +110,54 @@ const reapProviderExit = async (code, signal) => {
   finishWithProviderOutcome(code, signal)
 }
 timer = setInterval(() => {
-  // A detached supervisor is reparented when its owner exits. The new parent
-  // may be PID 1 or a platform subreaper, so any parent change is proof that
-  // this process group no longer has a live Orca owner.
-  if (process.ppid !== originalParent) {
-    terminateOwnedGroup()
-  }
+  if (ownerGone()) stopProviderGroup(null)
 }, 100)
 timer.unref()
-child.once('error', () => {
+child.once('error', (error) => {
   clearInterval(timer)
-  process.exit(127)
+  // The owner sees only this pid's exit; stderr is where a missing provider binary can say so.
+  process.stderr.write(String(error && error.message) + '\\n', () => process.exit(127))
 })
 child.once('exit', (code, signal) => {
   void reapProviderExit(code, signal)
 })
 `
 
+export type ProviderSupervisorOptions = {
+  cwd?: string
+  /** The process the supervisor serves; it must be the supervisor's parent. */
+  ownerPid?: number
+  stdinEndGraceMs?: number
+  sigtermGraceMs?: number
+}
+
+// A longer grace than the max stop allows would let recovery or close SIGKILL mid-stop.
+function assertGraceWithin(name: string, graceMs: number, maxMs: number): void {
+  if (!(graceMs >= 0 && graceMs <= maxMs)) {
+    throw new RangeError(`Provider supervisor ${name} grace ${graceMs} ms is outside 0-${maxMs} ms`)
+  }
+}
+
 export function supervisedPosixLaunch(
   launch: CodexAppServerLaunch,
   childEnv: NodeJS.ProcessEnv,
-  cwd = launch.cwd ?? process.cwd()
+  {
+    cwd = launch.cwd ?? process.cwd(),
+    ownerPid = process.pid,
+    stdinEndGraceMs = PROVIDER_STDIN_END_GRACE_MS,
+    sigtermGraceMs = PROVIDER_SIGTERM_GRACE_MS
+  }: ProviderSupervisorOptions = {}
 ): { command: string; args: string[]; env: NodeJS.ProcessEnv } {
+  assertGraceWithin('stdin-end', stdinEndGraceMs, PROVIDER_STDIN_END_GRACE_MS)
+  assertGraceWithin('SIGTERM', sigtermGraceMs, PROVIDER_SIGTERM_GRACE_MS)
   const supervisorSpec = Buffer.from(
     JSON.stringify({
       command: launch.command,
       args: launch.args,
-      cwd
+      cwd,
+      ownerPid,
+      stdinEndGraceMs,
+      sigtermGraceMs
     })
   ).toString('base64')
   return {
@@ -116,13 +177,22 @@ export function createProviderSpawnSpec(
   launch: CodexAppServerLaunch,
   childEnv: NodeJS.ProcessEnv,
   platform: NodeJS.Platform
-): { program: string; args: string[]; env: NodeJS.ProcessEnv; cwd: string; detached: boolean } {
-  const supervised = platform === 'win32' ? null : supervisedPosixLaunch(launch, childEnv)
+): {
+  program: string
+  args: string[]
+  env: NodeJS.ProcessEnv
+  cwd: string
+  detached: boolean
+  /** The child is the supervisor, whose SIGTERM stops the provider and then itself. */
+  supervised: boolean
+} {
+  const supervisor = platform === 'win32' ? null : supervisedPosixLaunch(launch, childEnv)
   return {
-    program: supervised?.command ?? launch.command,
-    args: supervised?.args ?? launch.args,
-    env: supervised?.env ?? childEnv,
+    program: supervisor?.command ?? launch.command,
+    args: supervisor?.args ?? launch.args,
+    env: supervisor?.env ?? childEnv,
     cwd: launch.cwd ?? process.cwd(),
-    detached: platform !== 'win32'
+    detached: platform !== 'win32',
+    supervised: supervisor !== null
   }
 }
diff --git a/src/main/codex/codex-app-server-process-teardown.test.ts b/src/main/codex/codex-app-server-process-teardown.test.ts
index cec8f91d081..295d780718d 100644
--- a/src/main/codex/codex-app-server-process-teardown.test.ts
+++ b/src/main/codex/codex-app-server-process-teardown.test.ts
@@ -26,7 +26,7 @@ describe('terminateCodexAppServerProcessTree', () => {
     const release = Promise.withResolvers<void>()
     const terminateWindowsTree = vi.fn(() => release.promise)
 
-    const teardown = terminateCodexAppServerProcessTree(target, undefined, {
+    const teardown = terminateCodexAppServerProcessTree(target, {
       platform: 'win32',
       terminateWindowsTree
     })
@@ -38,52 +38,12 @@ describe('terminateCodexAppServerProcessTree', () => {
     expect(target.kill).toHaveBeenCalledWith('SIGKILL')
   })
 
-  it('kills exact Linux spawn-token PIDs before the recorded wrapper', async () => {
-    const target = child()
-    const findSpawnTokenProcesses = vi
-      .fn<() => Promise<number[] | null>>()
-      .mockResolvedValueOnce([1234, 2345, 3456])
-      .mockResolvedValueOnce([1234])
-      .mockResolvedValueOnce([1234])
-    const signalPid = vi.fn()
-
-    await expect(
-      terminateCodexAppServerProcessTree(target, 'spawn-1', {
-        platform: 'linux',
-        findSpawnTokenProcesses,
-        signalPid,
-        isPidPresent: () => false,
-        wait: async () => undefined
-      })
-    ).resolves.toBe(true)
-
-    expect(signalPid.mock.calls).toEqual([
-      [2345, 'SIGKILL'],
-      [3456, 'SIGKILL']
-    ])
-    expect(target.kill).toHaveBeenCalledTimes(1)
-    expect(target.kill).toHaveBeenCalledWith('SIGKILL')
-  })
-
-  it('keeps the wrapper reachable when Linux cannot prove descendant exit', async () => {
-    const target = child()
-
-    await expect(
-      terminateCodexAppServerProcessTree(target, 'spawn-1', {
-        platform: 'linux',
-        findSpawnTokenProcesses: async () => null
-      })
-    ).resolves.toBe(false)
-
-    expect(target.kill).not.toHaveBeenCalled()
-  })
-
   it('waits for an owned POSIX snapshot before killing the wrapper', async () => {
     const target = child()
     const snapshot = { rootPgid: 1234, descendants: [], capturedAtMs: 1 }
     const release = Promise.withResolvers<boolean>()
 
-    const teardown = terminateCodexAppServerProcessTree(target, undefined, {
+    const teardown = terminateCodexAppServerProcessTree(target, {
       platform: 'darwin',
       captureDescendants: async () => snapshot,
       terminateDescendants: () => release.promise
@@ -102,7 +62,7 @@ describe('terminateCodexAppServerProcessTree', () => {
     const signalProcessGroup = vi.fn()
 
     await expect(
-      terminateCodexAppServerProcessTree(target, undefined, {
+      terminateCodexAppServerProcessTree(target, {
         platform: 'darwin',
         dedicatedProcessGroup: true,
         captureDescendants,
@@ -119,7 +79,7 @@ describe('terminateCodexAppServerProcessTree', () => {
     const target = child()
 
     await expect(
-      terminateCodexAppServerProcessTree(target, undefined, {
+      terminateCodexAppServerProcessTree(target, {
         platform: 'linux',
         dedicatedProcessGroup: true,
         signalProcessGroup: () => {
@@ -142,7 +102,7 @@ describe('terminateCodexAppServerProcessTree', () => {
     const target = { pid: UNREACHABLE_PGID, kill: vi.fn(() => true) as ChildProcess['kill'] }
 
     await expect(
-      terminateCodexAppServerProcessTree(target, undefined, {
+      terminateCodexAppServerProcessTree(target, {
         platform: 'darwin',
         captureDescendants: async () => ({
           rootPgid: UNREACHABLE_PGID,
@@ -162,7 +122,7 @@ describe('terminateCodexAppServerProcessTree', () => {
     const signalProcessGroup = vi.fn()
 
     await expect(
-      terminateCodexAppServerProcessTree(target, undefined, {
+      terminateCodexAppServerProcessTree(target, {
         platform: 'darwin',
         captureDescendants: async () => ({ rootPgid: 1234, descendants: [], capturedAtMs: 1 }),
         terminateDescendants: async () => true,
@@ -191,7 +151,7 @@ describe('terminateCodexAppServerProcessTree', () => {
 
     const results = await Promise.all(
       targets.map((target) =>
-        terminateCodexAppServerProcessTree(target, undefined, {
+        terminateCodexAppServerProcessTree(target, {
           platform: 'linux',
           dedicatedProcessGroup: true,
           captureDescendants,
diff --git a/src/main/codex/codex-app-server-process-teardown.ts b/src/main/codex/codex-app-server-process-teardown.ts
index 5a9c6e3574b..10e625bef7e 100644
--- a/src/main/codex/codex-app-server-process-teardown.ts
+++ b/src/main/codex/codex-app-server-process-teardown.ts
@@ -2,11 +2,8 @@ import type { ChildProcessHandle } from '../../shared/child-process/run-process'
 import { captureDescendantSnapshot, type DescendantSnapshot } from '../pty-descendant-termination'
 import { terminateDescendantSnapshotAndWait } from '../pty-descendant-exit-verification'
 import { terminateWindowsProcessTree } from '../windows-process-tree-kill'
-import { findAgentSessionSpawnTokenProcesses } from '../runtime/agent-session-spawn-token-process-scan'
 import { recordSelfInitiatedTreeKill } from '../crash-reporting/self-initiated-tree-kill-log'
 
-const TOKEN_PROCESS_EXIT_TIMEOUT_MS = 3_500
-const TOKEN_PROCESS_POLL_MS = 25
 const activeTeardowns = new WeakMap<object, Promise<boolean>>()
 
 type TeardownChild = Pick<ChildProcessHandle, 'pid' | 'kill'>
@@ -14,16 +11,10 @@ type TeardownChild = Pick<ChildProcessHandle, 'pid' | 'kill'>
 export type CodexAppServerProcessTeardownDeps = {
   platform?: NodeJS.Platform
   dedicatedProcessGroup?: boolean
-  /** Diagnostic/recovery injection only; never used by the primary teardown. */
-  findSpawnTokenProcesses?: (spawnToken: string) => Promise<number[] | null>
   captureDescendants?: (rootPid: number) => Promise<DescendantSnapshot | null>
   terminateDescendants?: (snapshot: DescendantSnapshot) => Promise<boolean>
   terminateWindowsTree?: (rootPid: number, deps?: { site?: string }) => Promise<void>
-  signalPid?: (pid: number, signal: NodeJS.Signals) => void
   signalProcessGroup?: (pgid: number, signal: NodeJS.Signals) => void
-  isPidPresent?: (pid: number) => boolean
-  wait?: (ms: number) => Promise<void>
-  now?: () => number
 }
 
 function terminateDedicatedPosixGroup(
@@ -47,70 +38,11 @@ function terminateDedicatedPosixGroup(
   return true
 }
 
-function sendSignal(pid: number, signal: NodeJS.Signals): void {
-  try {
-    process.kill(pid, signal)
-  } catch {
-    // An already-gone exact PID is the desired outcome.
-  }
-}
-
-function isPidPresent(pid: number): boolean {
-  try {
-    process.kill(pid, 0)
-    return true
-  } catch (error) {
-    return (error as NodeJS.ErrnoException).code !== 'ESRCH'
-  }
-}
-
-async function diagnosticTokenFallback(
-  rootPid: number,
-  spawnToken: string,
-  deps: CodexAppServerProcessTeardownDeps
-): Promise<boolean> {
-  const find = deps.findSpawnTokenProcesses ?? findAgentSessionSpawnTokenProcesses
-  const signal = deps.signalPid ?? sendSignal
-  const pidPresent = deps.isPidPresent ?? isPidPresent
-  const delay =
-    deps.wait ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)))
-  const now = deps.now ?? Date.now
-  const deadline = now() + TOKEN_PROCESS_EXIT_TIMEOUT_MS
-  const signalled = new Set<number>()
-  while (now() < deadline) {
-    const pids = await find(spawnToken).catch(() => null)
-    if (pids === null) {
-      return false
-    }
-    for (const pid of pids.filter((candidate) => candidate !== rootPid)) {
-      signalled.add(pid)
-      signal(pid, 'SIGKILL')
-    }
-    if ([...signalled].every((pid) => !pidPresent(pid))) {
-      return true
-    }
-    await delay(TOKEN_PROCESS_POLL_MS)
-  }
-  return false
-}
-
 async function terminatePosixTree(
   child: TeardownChild,
   rootPid: number,
-  _spawnToken: string | undefined,
   deps: CodexAppServerProcessTeardownDeps
 ): Promise<boolean> {
-  // Kept only for explicit recovery callers/tests. Production always follows
-  // the dedicated process-group path below; token enumeration is evidence,
-  // never the owner of orphan-reaping decisions.
-  if (_spawnToken && deps.findSpawnTokenProcesses) {
-    const reaped = await diagnosticTokenFallback(rootPid, _spawnToken, deps)
-    if (reaped) {
-      child.kill('SIGKILL')
-      return true
-    }
-    return false
-  }
   child.kill('SIGSTOP')
   const capture = deps.captureDescendants ?? captureDescendantSnapshot
   const snapshot = await capture(rootPid).catch(() => null)
@@ -158,7 +90,6 @@ async function terminatePosixTree(
 /** Stops every process owned by one app-server launch before releasing its wrapper. */
 async function terminateOnce(
   child: TeardownChild,
-  spawnToken: string | undefined,
   deps: CodexAppServerProcessTeardownDeps
 ): Promise<boolean> {
   const rootPid = child.pid
@@ -176,12 +107,11 @@ async function terminateOnce(
   if (deps.dedicatedProcessGroup) {
     return terminateDedicatedPosixGroup(rootPid, deps)
   }
-  return terminatePosixTree(child, rootPid, spawnToken, deps)
+  return terminatePosixTree(child, rootPid, deps)
 }
 
 export function terminateCodexAppServerProcessTree(
   child: TeardownChild,
-  spawnToken?: string,
   deps: CodexAppServerProcessTeardownDeps = {}
 ): Promise<boolean> {
   const key = child as object
@@ -189,7 +119,7 @@ export function terminateCodexAppServerProcessTree(
   if (active) {
     return active
   }
-  const attempt = terminateOnce(child, spawnToken, deps).catch(() => false)
+  const attempt = terminateOnce(child, deps).catch(() => false)
   activeTeardowns.set(key, attempt)
   void attempt.then(() => {
     if (activeTeardowns.get(key) === attempt) {
diff --git a/src/main/codex/codex-app-server-record-dispatch.ts b/src/main/codex/codex-app-server-record-dispatch.ts
index e76f2509399..cbac80f3643 100644
--- a/src/main/codex/codex-app-server-record-dispatch.ts
+++ b/src/main/codex/codex-app-server-record-dispatch.ts
@@ -10,6 +10,7 @@ import {
 import { classifyJsonRpcPrefix } from './codex-app-server-record-prefix'
 
 const OVERSIZED_REQUEST_ERROR_CODE = -32001
+const MAX_REMEMBERED_TIMEOUTS = 64
 
 export type CodexPendingRequest = {
   method: string
@@ -25,11 +26,26 @@ export function createCodexAppServerRecordDispatcher(input: {
 }): {
   addPending: (id: number, waiter: CodexPendingRequest) => void
   deletePending: (id: number) => void
+  timeOutPending: (id: number) => void
   failPending: (error: Error) => void
   dispatch: (message: Record<string, unknown>) => void
   rejectOversized: (rejected: NdjsonRejectedRecord & { kind: 'line-too-long' }) => void
 } {
   const pending = new Map<number, CodexPendingRequest>()
+  const timedOutMethods = new Map<number, string>()
+
+  const timeOutPending = (id: number): void => {
+    const waiter = pending.get(id)
+    if (!waiter) {
+      return
+    }
+    pending.delete(id)
+    timedOutMethods.set(id, waiter.method)
+    const oldest = timedOutMethods.keys().next()
+    if (timedOutMethods.size > MAX_REMEMBERED_TIMEOUTS && !oldest.done) {
+      timedOutMethods.delete(oldest.value)
+    }
+  }
 
   const failPending = (error: Error): void => {
     for (const waiter of pending.values()) {
@@ -72,7 +88,17 @@ export function createCodexAppServerRecordDispatcher(input: {
     }
     const waiter = pending.get(message.id)
     if (!waiter) {
-      input.handlers.onUnhandledFrame?.('response:unmatched', message)
+      // Transport diagnostics, not conversation: only the request that gave up could have
+      // interpreted this reply, and it already reported its own outcome.
+      const timedOutMethod = timedOutMethods.get(message.id)
+      timedOutMethods.delete(message.id)
+      const error = isAppServerRecord(message.error) ? message.error.message : undefined
+      console.warn(
+        timedOutMethod
+          ? `[codex-app-server] late reply to ${timedOutMethod} after timeout (id ${message.id})`
+          : `[codex-app-server] reply with no waiting request (id ${message.id})`,
+        ...(typeof error === 'string' ? [error] : [])
+      )
       return
     }
     pending.delete(message.id)
@@ -88,7 +114,8 @@ export function createCodexAppServerRecordDispatcher(input: {
           : new CodexAppServerRequestError(
               waiter.method,
               typeof error.code === 'number' ? error.code : null,
-              `codex app-server ${waiter.method} failed: ${detail}`
+              `codex app-server ${waiter.method} failed: ${detail}`,
+              typeof error.message === 'string' ? error.message : undefined
             )
       )
       return
@@ -159,6 +186,7 @@ export function createCodexAppServerRecordDispatcher(input: {
   return {
     addPending: (id, waiter) => pending.set(id, waiter),
     deletePending: (id) => pending.delete(id),
+    timeOutPending,
     failPending,
     dispatch,
     rejectOversized
diff --git a/src/main/codex/codex-app-server-request-error.ts b/src/main/codex/codex-app-server-request-error.ts
index 0dbefaca965..0e7cc719017 100644
--- a/src/main/codex/codex-app-server-request-error.ts
+++ b/src/main/codex/codex-app-server-request-error.ts
@@ -1,12 +1,23 @@
+import { providerDiagnostic, type ProviderDiagnostic } from '../../shared/agent-session-failure'
+
 /** Codex answered the call and refused it, rather than timing out or exiting. */
 export class CodexAppServerRequestError extends Error {
+  /** Codex's own `error.message`, kept apart from the Orca text around it. */
+  readonly providerDiagnostic?: ProviderDiagnostic
+
   constructor(
     readonly method: string,
     readonly code: number | null,
-    message: string
+    message: string,
+    providerMessage?: string
   ) {
     super(message)
     this.name = 'CodexAppServerRequestError'
+    const diagnostic =
+      providerMessage === undefined ? undefined : providerDiagnostic(providerMessage, 'person')
+    if (diagnostic) {
+      this.providerDiagnostic = diagnostic
+    }
   }
 }
 
diff --git a/src/main/codex/codex-background-command-tracker.ts b/src/main/codex/codex-background-command-tracker.ts
index 844134881ad..922743f1a83 100644
--- a/src/main/codex/codex-background-command-tracker.ts
+++ b/src/main/codex/codex-background-command-tracker.ts
@@ -1,15 +1,20 @@
 import type { AgentSessionBackgroundTask } from '../../shared/agent-session-wire'
 import type { CodexBackgroundTaskEvent } from './codex-background-task-frames'
-import { codexCommandOutlivesTurn } from './codex-command-lifecycle'
 import { readRecord, readString } from './codex-item-field-readers'
 import { readCodexThreadItem } from './codex-structured-item-translation'
 import { MAX_CODEX_ITEM_STREAM_METADATA_BYTES } from './codex-item-stream-retention'
+import type { CodexAbandonedCommand } from './codex-prompt-registry'
 
 const MAX_SETTLED_COMMANDS = 128
 const MAX_DESCRIPTION_CHARS = 512
 
 type Command = { threadId: string; task: AgentSessionBackgroundTask; bytes: number }
 
+/** A command process starting, or ending: it exited, its thread closed, or the session ended. */
+export type CodexBackgroundCommandChange =
+  | { type: 'started'; threadId: string; task: AgentSessionBackgroundTask }
+  | { type: 'ended'; threadId: string; taskId: string }
+
 /** The label's reserved share of the description. Reserved, not merely capped:
  *  a label free to spend the whole budget clips away the command it qualifies,
  *  leaving a command row naming an agent and no command — the failure this
@@ -65,28 +70,17 @@ export class CodexBackgroundCommandTracker {
     )
   }
 
-  observe(event: CodexBackgroundTaskEvent): void {
+  observe(event: CodexBackgroundTaskEvent): CodexBackgroundCommandChange | null {
     const parsed = this.parse(event)
     if (!parsed || this.settled.has(parsed.key)) {
-      return
+      return null
     }
     const { key, command, completed } = parsed
-    const existing = this.commands.get(key)
     if (completed) {
-      if (existing) {
-        this.liveBytes -= existing.bytes
-        this.commands.delete(key)
-      }
-      const bytes = Buffer.byteLength(key, 'utf8') + 256
-      if (this.liveBytes + bytes <= this.maxMetadataBytes) {
-        this.settled.set(key, bytes)
-        this.settledBytes += bytes
-      }
-      this.trimSettled()
-      return
+      return this.end(key)
     }
-    if (existing) {
-      return
+    if (this.commands.has(key)) {
+      return null
     }
     if (this.liveBytes + command.bytes > this.maxMetadataBytes) {
       throw new Error('Codex command metadata was not admitted before observation')
@@ -94,6 +88,19 @@ export class CodexBackgroundCommandTracker {
     this.commands.set(key, command)
     this.liveBytes += command.bytes
     this.trimSettled()
+    return { type: 'started', threadId: command.threadId, task: command.task }
+  }
+
+  /** The thread closed: Codex stops its processes first, so none of them can report an exit. */
+  endThread(threadId: string): CodexBackgroundCommandChange[] {
+    return [...this.commands]
+      .filter(([, command]) => command.threadId === threadId)
+      .flatMap(([key]) => this.end(key) ?? [])
+  }
+
+  /** Its approval went unanswered until its turn ended, so its process never started. */
+  endUnapproved(command: CodexAbandonedCommand): CodexBackgroundCommandChange | null {
+    return this.end(JSON.stringify([command.threadId, command.itemId]))
   }
 
   tasks(
@@ -113,11 +120,45 @@ export class CodexBackgroundCommandTracker {
       })
   }
 
-  clear(): void {
+  /** The live commands one thread launched, as the strip would publish them. */
+  threadTasks(threadId: string): AgentSessionBackgroundTask[] {
+    return [...this.commands.values()]
+      .filter((command) => command.threadId === threadId)
+      .map((command) => command.task)
+  }
+
+  /** The session ended, and every command with it. */
+  clear(): CodexBackgroundCommandChange[] {
+    const ended = [...this.commands.values()].map(
+      ({ threadId, task }): CodexBackgroundCommandChange => ({
+        type: 'ended',
+        threadId,
+        taskId: task.id
+      })
+    )
     this.commands.clear()
     this.settled.clear()
     this.liveBytes = 0
     this.settledBytes = 0
+    return ended
+  }
+
+  /** Retires the key so a replayed frame cannot start the command again. */
+  private end(key: string): CodexBackgroundCommandChange | null {
+    const existing = this.commands.get(key)
+    if (existing) {
+      this.liveBytes -= existing.bytes
+      this.commands.delete(key)
+    }
+    const bytes = Buffer.byteLength(key, 'utf8') + 256
+    if (this.liveBytes + bytes <= this.maxMetadataBytes) {
+      this.settled.set(key, bytes)
+      this.settledBytes += bytes
+    }
+    this.trimSettled()
+    return existing
+      ? { type: 'ended', threadId: existing.threadId, taskId: existing.task.id }
+      : null
   }
 
   private trimSettled(): void {
@@ -140,8 +181,10 @@ export class CodexBackgroundCommandTracker {
     if (event.method !== 'item/started' && event.method !== 'item/completed') {
       return null
     }
+    // Any command may outlive its turn; `source` says only how Codex launched it. A stdin write
+    // starts no process: it reaches one already tracked.
     const item = readCodexThreadItem(readRecord(event.params).item)
-    if (!item || !codexCommandOutlivesTurn(item)) {
+    if (item?.type !== 'commandExecution' || item.source === 'unifiedExecInteraction') {
       return null
     }
     const key = JSON.stringify([event.threadId, item.id])
diff --git a/src/main/codex/codex-background-task-frames.ts b/src/main/codex/codex-background-task-frames.ts
index a2e7a7e2151..f01863956b6 100644
--- a/src/main/codex/codex-background-task-frames.ts
+++ b/src/main/codex/codex-background-task-frames.ts
@@ -15,6 +15,8 @@ export type CodexBackgroundTaskFrame =
       agentThreadId: string
       label: string | null
       parentTurnId: string | null | undefined
+      /** The reporting thread, for a `started` activity: the agent that spawned the child. */
+      spawnerThreadId: string | undefined
     }
   | {
       kind: 'turn'
@@ -22,6 +24,11 @@ export type CodexBackgroundTaskFrame =
       turnId: string
       state: NativeChatSubagentState
     }
+  | {
+      /** A child thread that closed: it ran its last turn, and Codex never said how it went. */
+      kind: 'thread-closed'
+      threadId: string
+    }
 
 export type CodexBackgroundTaskEvent = {
   method: string
@@ -29,10 +36,29 @@ export type CodexBackgroundTaskEvent = {
   params: unknown
 }
 
+/**
+ * The one way Codex ends a child's turn without `turn/completed`: a closed thread ran its last
+ * turn and Codex never said how it went. A turn-ending `error` is not one — Codex follows it with
+ * a failed `turn/completed` for the same turn, which is that turn's end and carries the duration
+ * and receipt time the error does not.
+ */
+function readCodexChildThreadClosed(
+  event: CodexBackgroundTaskEvent
+): CodexBackgroundTaskFrame | null {
+  return event.method === 'thread/closed'
+    ? { kind: 'thread-closed', threadId: event.threadId }
+    : null
+}
+
 export function readCodexBackgroundTaskFrame(
   event: CodexBackgroundTaskEvent,
   primaryThreadId: string
 ): CodexBackgroundTaskFrame | null {
+  // The session's own turn ends through the journal's turn boundaries, never here.
+  const ending = event.threadId === primaryThreadId ? null : readCodexChildThreadClosed(event)
+  if (ending) {
+    return ending
+  }
   if (event.method === 'turn/started' || event.method === 'turn/completed') {
     const turnId = readCodexTurnId(event.params)
     if (turnId === null) {
@@ -67,6 +93,8 @@ export function readCodexBackgroundTaskFrame(
     parentTurnId:
       activity.kind === 'started' || activity.kind === 'interacted'
         ? readCodexTurnId(event.params)
-        : undefined
+        : undefined,
+    // Only `started` names the spawner: other kinds ride whichever agent acted.
+    spawnerThreadId: activity.kind === 'started' ? event.threadId : undefined
   }
 }
diff --git a/src/main/codex/codex-background-task-tracker.ts b/src/main/codex/codex-background-task-tracker.ts
index a972b7bb4c1..6429a84d4fd 100644
--- a/src/main/codex/codex-background-task-tracker.ts
+++ b/src/main/codex/codex-background-task-tracker.ts
@@ -2,25 +2,50 @@ import type {
   AgentSessionBackgroundTask,
   AgentSessionBackgroundTaskState
 } from '../../shared/agent-session-wire'
+import type { AgentChildWorkEvidence } from '../../shared/agent-status-child-work-evidence'
 import {
   readCodexBackgroundTaskFrame,
   type CodexBackgroundTaskEvent
 } from './codex-background-task-frames'
 import { CodexSubagentExecutions } from './codex-subagent-executions'
 import { CodexBackgroundCommandTracker } from './codex-background-command-tracker'
+import { CodexChildWorkEvidence } from './codex-child-work-evidence'
+import type { CodexAbandonedCommand } from './codex-prompt-registry'
+import type { CodexStructuredSessionAdapterDeps } from './codex-structured-session-state'
 import { boundSubagentField } from './codex-subagent-group-body'
 
+/** Where a session's child-work evidence goes, and the host clock that stamps it. */
+export type CodexChildWorkSink = {
+  deliver: (evidence: AgentChildWorkEvidence[]) => void
+  now: () => number
+}
+
+export function codexChildWorkSink(
+  sessionId: string,
+  deps: Pick<CodexStructuredSessionAdapterDeps, 'onChildWorkEvidence' | 'now'>
+): CodexChildWorkSink {
+  return {
+    deliver: (evidence) => deps.onChildWorkEvidence?.(sessionId, evidence),
+    now: () => deps.now?.() ?? Date.now()
+  }
+}
+
 /** Projects the same child execution facts the durable roster consumes. */
 export class CodexBackgroundTaskTracker {
   private publishedFingerprint = '[]'
   private publishedState: AgentSessionBackgroundTaskState | null = null
   private readonly commands: CodexBackgroundCommandTracker
+  private readonly childWork: CodexChildWorkEvidence
 
   constructor(
     private readonly primaryThreadId: string,
-    private readonly executions = new CodexSubagentExecutions()
+    private readonly executions = new CodexSubagentExecutions(),
+    private readonly childWorkSink?: CodexChildWorkSink
   ) {
     this.commands = new CodexBackgroundCommandTracker(primaryThreadId)
+    this.childWork = new CodexChildWorkEvidence(primaryThreadId, executions, (threadId) =>
+      this.commands.threadTasks(threadId)
+    )
   }
 
   get state(): AgentSessionBackgroundTaskState | null {
@@ -32,20 +57,38 @@ export class CodexBackgroundTaskTracker {
     return this.commands.canObserve(event)
   }
 
-  observe(event: CodexBackgroundTaskEvent): boolean {
+  /** `unapproved`: commands whose approval the journal dropped with this frame's turn ending. */
+  observe(
+    event: CodexBackgroundTaskEvent,
+    unapproved: readonly CodexAbandonedCommand[] = []
+  ): boolean {
     const itemEvent = event.method === 'item/started' || event.method === 'item/completed'
-    if (itemEvent) {
-      this.commands.observe(event)
-    }
+    const command = itemEvent ? this.commands.observe(event) : null
+    const commands = [
+      ...unapproved.flatMap((abandoned) => this.commands.endUnapproved(abandoned) ?? []),
+      ...(event.method === 'thread/closed'
+        ? this.commands.endThread(event.threadId)
+        : command
+          ? [command]
+          : [])
+    ]
     const frame = readCodexBackgroundTaskFrame(event, this.primaryThreadId)
-    if (!frame) {
-      return itemEvent ? this.refresh() : false
-    }
-    if (frame.kind === 'subagent') {
-      this.executions.register(frame.agentThreadId, frame.label, frame.parentTurnId)
-    } else if (frame.threadId !== this.primaryThreadId) {
+    if (frame?.kind === 'subagent') {
+      this.executions.register(
+        frame.agentThreadId,
+        frame.label,
+        frame.parentTurnId,
+        frame.spawnerThreadId
+      )
+    } else if (frame?.kind === 'thread-closed') {
+      this.executions.closeThread(frame.threadId)
+    } else if (frame && frame.threadId !== this.primaryThreadId) {
       this.executions.observeTurn(frame.threadId, frame.turnId, frame.state)
     }
+    this.childWork.observe(event, frame, commands)
+    if (!frame) {
+      return itemEvent || commands.length > 0 ? this.refresh() : false
+    }
     // A primary-turn frame only prompts a republish: turn end reveals children,
     // it never settles them. Codex `spawn_agent` children keep reporting well
     // past their parent turn, so nothing here may sweep the roster.
@@ -54,10 +97,25 @@ export class CodexBackgroundTaskTracker {
 
   clear(): boolean {
     this.executions.clear()
-    this.commands.clear()
+    this.childWork.clear(this.commands.clear())
     return this.refresh()
   }
 
+  /** Everything the frames observed since the last drain said about the session's child work. */
+  drainChildWorkEvidence(observedAt: number): AgentChildWorkEvidence[] {
+    return this.childWork.drain(observedAt)
+  }
+
+  /** Hand the pending evidence to the host. Callers run this after the journal wrote the frame
+   *  and the parent's own row republished, so a child record never lands ahead of either. */
+  publishChildWork(): void {
+    // Drained even with no sink, so undelivered evidence never accumulates.
+    const evidence = this.drainChildWorkEvidence(this.childWorkSink?.now() ?? Date.now())
+    if (evidence.length > 0) {
+      this.childWorkSink?.deliver(evidence)
+    }
+  }
+
   private tasks(): AgentSessionBackgroundTask[] {
     const children = this.executions.workingChildren()
     const agents: AgentSessionBackgroundTask[] = children.map((child, index) => ({
diff --git a/src/main/codex/codex-child-work-evidence.test.ts b/src/main/codex/codex-child-work-evidence.test.ts
new file mode 100644
index 00000000000..5b1b1bc29b4
--- /dev/null
+++ b/src/main/codex/codex-child-work-evidence.test.ts
@@ -0,0 +1,617 @@
+import { describe, expect, it } from 'vitest'
+import { createAgentChildWorkAdmission } from '../../shared/agent-status-child-work-admission'
+import type { AgentChildWorkRecord } from '../../shared/agent-status-child-work'
+import type { AgentChildWorkEvidence } from '../../shared/agent-status-child-work-evidence'
+import { reconcileAgentChildWorkEvidence } from '../../shared/agent-status-child-work-reconciliation'
+import {
+  agentChildWorkOwnedLiveness,
+  deriveAgentChildDisplayState
+} from '../../shared/agent-status-child-work-display'
+import { projectAgentChildWorkViews } from '../../shared/agent-status-child-work-view'
+import { createAgentStatusStore } from '../../shared/agent-status-store'
+import { makeStructuredAgentStatusSubject } from '../../shared/agent-status-subject'
+import type { CodexBackgroundTaskEvent } from './codex-background-task-frames'
+import { CodexBackgroundTaskTracker } from './codex-background-task-tracker'
+
+const PRIMARY = 'thread-parent'
+const PARENT_TURN = 'turn-parent'
+const CHILD = 'thread-child'
+const parent = makeStructuredAgentStatusSubject(
+  {
+    executionHostId: 'local',
+    wslDistro: null,
+    workspaceId: 'workspace-1',
+    workspaceKind: 'folder'
+  },
+  'session-1'
+)
+
+function turn(
+  method: 'turn/started' | 'turn/completed',
+  threadId: string,
+  turnId: string,
+  status = 'completed'
+): CodexBackgroundTaskEvent {
+  return { method, threadId, params: { threadId, turn: { id: turnId, status } } }
+}
+
+function spawned(
+  child = CHILD,
+  reporter = PRIMARY,
+  name = 'audit_build'
+): CodexBackgroundTaskEvent {
+  return {
+    method: 'item/started',
+    threadId: reporter,
+    params: {
+      threadId: reporter,
+      turnId: PARENT_TURN,
+      item: {
+        type: 'subAgentActivity',
+        id: `activity-${child}`,
+        kind: 'started',
+        agentThreadId: child,
+        agentPath: `/root/${name}`
+      }
+    }
+  }
+}
+
+function item(
+  method: 'item/started' | 'item/completed',
+  threadId: string,
+  turnId: string,
+  fields: Record<string, unknown>
+): CodexBackgroundTaskEvent {
+  return { method, threadId, params: { threadId, turnId, item: fields } }
+}
+
+function shell(id: string, command: string, status = 'inProgress', source = 'agent') {
+  return { type: 'commandExecution', id, command, source, status }
+}
+
+function harness() {
+  const tracker = new CodexBackgroundTaskTracker(PRIMARY)
+  const store = createAgentStatusStore({ epoch: 'epoch-1', mode: 'authority' })
+  expect(store.applyMutation({ parent: { subject: parent } })).not.toBeNull()
+  let minted = 0
+  const admission = createAgentChildWorkAdmission(store, {
+    mintChildWorkId: () => `child-${++minted}`
+  })
+  let clock = 1_000
+  const log: AgentChildWorkEvidence[][] = []
+  const send = (...events: CodexBackgroundTaskEvent[]): void => {
+    for (const event of events) {
+      tracker.observe(event)
+      clock += 10
+      const evidence = tracker.drainChildWorkEvidence(clock)
+      log.push(evidence)
+      reconcileAgentChildWorkEvidence({ store, admission, parent, provider: 'codex', evidence })
+    }
+  }
+  const records = (): AgentChildWorkRecord[] => store.getChildren(parent)
+  const byKind = (kind: AgentChildWorkRecord['kind']) =>
+    records().filter((record) => record.kind === kind)
+  const display = (childWorkId: string) => {
+    const children = records()
+    const views = projectAgentChildWorkViews(
+      children,
+      children.flatMap((child) => store.getAliasesForChild(child.childWorkId))
+    )
+    const view = views.find((candidate) => candidate.id === childWorkId)
+    return view && deriveAgentChildDisplayState(view, agentChildWorkOwnedLiveness(views, view.id))
+  }
+  return { tracker, store, send, records, byKind, display, log }
+}
+
+/** A child spawned by the parent turn and running its first turn. */
+function runningChild() {
+  const run = harness()
+  run.send(turn('turn/started', PRIMARY, PARENT_TURN), spawned(), turn('turn/started', CHILD, 'c1'))
+  return run
+}
+
+describe('Codex child-work evidence', () => {
+  it('records a spawned child by its thread, with its turn as the run', () => {
+    const { records, store, log, send } = runningChild()
+    // Codex delivers the announcement a second time, on `item/completed`.
+    send({ ...spawned(), method: 'item/completed' })
+    expect(records()).toEqual([
+      expect.objectContaining({
+        kind: 'agent',
+        membership: 'live',
+        state: 'working',
+        residency: 'background',
+        description: 'audit_build',
+        invocation: { invocationId: 'c1', generation: 1 },
+        stoppable: false
+      })
+    ])
+    const aliases = store.getAliasesForChild(records()[0]!.childWorkId)
+    expect(aliases.map(({ aliasKind, alias }) => [aliasKind, alias])).toEqual([
+      ['thread_id', CHILD],
+      ['turn_id', 'c1']
+    ])
+    // The host hears the child once.
+    expect(log.flat().filter((edge) => edge.type === 'live')).toHaveLength(1)
+  })
+
+  it('makes no record for a child whose turn began before its announcement, until it lands', () => {
+    const { send, records } = harness()
+    send(turn('turn/started', PRIMARY, PARENT_TURN), turn('turn/started', CHILD, 'c1'))
+    expect(records()).toEqual([])
+    send(spawned())
+    expect(records()).toEqual([expect.objectContaining({ membership: 'live', state: 'working' })])
+  })
+
+  it.each([
+    ['completed', 'succeeded'],
+    ['interrupted', 'cancelled'],
+    ['failed', 'failed'],
+    ['somethingNew', 'unknown']
+  ])('settles a child whose own turn ended %s as %s', (status, outcome) => {
+    const { send, tracker, records } = runningChild()
+    send(turn('turn/completed', CHILD, 'c1', status))
+    expect(records()).toEqual([
+      expect.objectContaining({ membership: 'settled', state: 'done', outcome })
+    ])
+    // Today's strip drops the child the moment its turn ends; only the record keeps its ending.
+    expect(tracker.state).toBeNull()
+  })
+
+  const childError = (turnId: string, willRetry: boolean): CodexBackgroundTaskEvent => ({
+    method: 'error',
+    threadId: CHILD,
+    params: { threadId: CHILD, turnId, willRetry, error: { message: 'boom' } }
+  })
+  const childClosed: CodexBackgroundTaskEvent = {
+    method: 'thread/closed',
+    threadId: CHILD,
+    params: { threadId: CHILD }
+  }
+
+  it('keeps a child working through an error Codex will not retry, and settles it on the failed turn/completed that follows', () => {
+    const { send, tracker, records } = runningChild()
+    send(childError('c1', false))
+    expect(records()).toEqual([expect.objectContaining({ membership: 'live' })])
+    expect(tracker.state?.tasks).toHaveLength(1)
+    send(turn('turn/completed', CHILD, 'c1', 'failed'))
+    expect(records()).toEqual([
+      expect.objectContaining({ membership: 'settled', state: 'done', outcome: 'failed' })
+    ])
+    expect(tracker.state).toBeNull()
+  })
+
+  it('settles a working child whose thread closed with no turn/completed, in the strip and the record together', () => {
+    const { send, tracker, records } = runningChild()
+    expect(tracker.state?.tasks).toHaveLength(1)
+    send(childClosed)
+    expect(records()).toEqual([
+      expect.objectContaining({ membership: 'settled', state: 'done', outcome: 'unknown' })
+    ])
+    expect(tracker.state).toBeNull()
+    // The first ending a turn gets stands.
+    send(turn('turn/completed', CHILD, 'c1', 'completed'))
+    expect(records()).toEqual([expect.objectContaining({ outcome: 'unknown' })])
+  })
+
+  it('keeps a child working through a retried error and a systemError status: its turn runs on', () => {
+    const { send, tracker, records } = runningChild()
+    send(childError('c1', true), {
+      method: 'thread/status/changed',
+      threadId: CHILD,
+      params: { threadId: CHILD, status: { type: 'systemError' } }
+    })
+    expect(records()).toEqual([expect.objectContaining({ membership: 'live', state: 'working' })])
+    expect(tracker.state?.tasks).toHaveLength(1)
+  })
+
+  it('never settles a child on its PARENT turn ending: children outlive the turn', () => {
+    const { send, records } = runningChild()
+    send(turn('turn/completed', PRIMARY, PARENT_TURN))
+    expect(records()).toEqual([expect.objectContaining({ membership: 'live', state: 'working' })])
+  })
+
+  it('reopens the same record for a follow-up turn on a finished child, as a new run', () => {
+    const { send, records } = runningChild()
+    send(turn('turn/completed', CHILD, 'c1'))
+    const [finished] = records()
+    send(turn('turn/started', CHILD, 'c2'))
+    expect(records()).toEqual([
+      expect.objectContaining({
+        childWorkId: finished!.childWorkId,
+        membership: 'live',
+        state: 'working',
+        invocation: { invocationId: 'c2', generation: 2 },
+        previousInvocations: [
+          expect.objectContaining({
+            fence: { invocationId: 'c1', generation: 1 },
+            outcome: 'succeeded'
+          })
+        ]
+      })
+    ])
+    // A late ending of the first run neither ends nor restarts the second.
+    send(turn('turn/completed', CHILD, 'c1', 'failed'))
+    expect(records()).toEqual([
+      expect.objectContaining({
+        membership: 'live',
+        invocation: { invocationId: 'c2', generation: 2 }
+      })
+    ])
+    send(turn('turn/completed', CHILD, 'c2', 'interrupted'))
+    expect(records()).toEqual([
+      expect.objectContaining({
+        childWorkId: finished!.childWorkId,
+        membership: 'settled',
+        outcome: 'cancelled'
+      })
+    ])
+  })
+
+  it('says which tool the child has open, the way a CLI row names a Codex shell', () => {
+    const { send, byKind } = runningChild()
+    send(item('item/started', CHILD, 'c1', shell('cmd-1', 'npm test')))
+    expect(byKind('agent')[0]?.operation).toEqual({
+      toolName: 'Bash',
+      input: 'npm test',
+      basis: 'open',
+      observedAt: 1_040
+    })
+    send(
+      item('item/started', CHILD, 'c1', {
+        type: 'mcpToolCall',
+        id: 'mcp-1',
+        server: 'github',
+        tool: 'search_issues',
+        arguments: { query: 'flaky' },
+        status: 'inProgress'
+      })
+    )
+    expect(byKind('agent')[0]?.operation).toMatchObject({
+      toolName: 'mcp__github__search_issues',
+      input: 'flaky'
+    })
+    // The newer call ends first: the child is still running the older one, since it opened.
+    send(
+      item('item/completed', CHILD, 'c1', { type: 'mcpToolCall', id: 'mcp-1', status: 'completed' })
+    )
+    expect(byKind('agent')[0]?.operation).toEqual({
+      toolName: 'Bash',
+      input: 'npm test',
+      basis: 'open',
+      observedAt: 1_040
+    })
+    send(item('item/completed', CHILD, 'c1', shell('cmd-1', 'npm test', 'completed')))
+    expect(byKind('agent')[0]?.operation).toBeUndefined()
+  })
+
+  it('names a unified-exec shell as the open call until its process exits', () => {
+    const { send, byKind } = runningChild()
+    // Codex runs every agent shell through unified exec, not only the ones that outlive a turn.
+    send(
+      item(
+        'item/started',
+        CHILD,
+        'c1',
+        shell('exec-1', 'npm test', 'inProgress', 'unifiedExecStartup')
+      )
+    )
+    expect(byKind('agent')[0]?.operation).toMatchObject({ toolName: 'Bash', input: 'npm test' })
+    send(
+      item(
+        'item/completed',
+        CHILD,
+        'c1',
+        shell('exec-1', 'npm test', 'completed', 'unifiedExecStartup')
+      )
+    )
+    expect(byKind('agent')[0]?.operation).toBeUndefined()
+    // An approved command starts on the approval path and completes from unified exec.
+    send(item('item/started', CHILD, 'c1', shell('exec-2', 'touch ~/marker')))
+    expect(byKind('agent')[0]?.operation).toMatchObject({
+      toolName: 'Bash',
+      input: 'touch ~/marker'
+    })
+    send(
+      item(
+        'item/completed',
+        CHILD,
+        'c1',
+        shell('exec-2', 'touch ~/marker', 'completed', 'unifiedExecStartup')
+      )
+    )
+    expect(byKind('agent')[0]?.operation).toBeUndefined()
+  })
+
+  it("never carries a run's open call into the next run when its ending was lost", () => {
+    const { send, byKind } = runningChild()
+    send(item('item/started', CHILD, 'c1', shell('cmd-1', 'npm test')))
+    send(turn('turn/started', CHILD, 'c2'))
+    expect(byKind('agent')[0]).toMatchObject({ invocation: { invocationId: 'c2', generation: 2 } })
+    expect(byKind('agent')[0]?.operation).toBeUndefined()
+  })
+
+  it('keeps what the child said last, and its usage, through to how it ended', () => {
+    const { send, byKind } = runningChild()
+    send(
+      item('item/completed', CHILD, 'c1', {
+        type: 'agentMessage',
+        id: 'msg-1',
+        text: 'Two tests\nflake on CI'
+      }),
+      {
+        method: 'thread/tokenUsage/updated',
+        threadId: CHILD,
+        params: { threadId: CHILD, tokenUsage: { total: { totalTokens: 4_200 } } }
+      }
+    )
+    expect(byKind('agent')[0]).toMatchObject({
+      lastMessage: 'Two tests flake on CI',
+      totalTokens: 4_200
+    })
+    send(turn('turn/completed', CHILD, 'c1'))
+    expect(byKind('agent')[0]).toMatchObject({
+      membership: 'settled',
+      outcome: 'succeeded',
+      lastMessage: 'Two tests flake on CI',
+      totalTokens: 4_200
+    })
+    // A new run has said nothing yet.
+    send(turn('turn/started', CHILD, 'c2'))
+    expect(byKind('agent')[0]).not.toHaveProperty('lastMessage')
+  })
+
+  it('files a message whose frame names no turn under the run that said it, never the next', () => {
+    const { send, byKind } = runningChild()
+    send({
+      method: 'item/completed',
+      threadId: CHILD,
+      params: { threadId: CHILD, item: { type: 'agentMessage', id: 'msg-1', text: 'Done' } }
+    })
+    expect(byKind('agent')[0]?.lastMessage).toBe('Done')
+    send(turn('turn/completed', CHILD, 'c1'), turn('turn/started', CHILD, 'c2'))
+    send(turn('turn/completed', CHILD, 'c2'))
+    expect(byKind('agent')[0]).toMatchObject({ outcome: 'succeeded' })
+    expect(byKind('agent')[0]).not.toHaveProperty('lastMessage')
+  })
+
+  it('reads a child waiting on the user from its own thread status', () => {
+    const { send, byKind } = runningChild()
+    const status = (status: unknown): CodexBackgroundTaskEvent => ({
+      method: 'thread/status/changed',
+      threadId: CHILD,
+      params: { threadId: CHILD, status }
+    })
+    send(status({ type: 'active', activeFlags: ['waitingOnApproval'] }))
+    expect(byKind('agent')[0]?.state).toBe('waiting')
+    send(status({ type: 'active', activeFlags: [] }))
+    expect(byKind('agent')[0]?.state).toBe('working')
+    send(status({ type: 'active', activeFlags: ['waitingOnUserInput'] }))
+    send(turn('turn/completed', CHILD, 'c1'))
+    send(turn('turn/started', CHILD, 'c2'))
+    // The wait ended with the turn that asked.
+    expect(byKind('agent')[0]?.state).toBe('working')
+  })
+
+  it('records a command from its start until its process exits, then removes it', () => {
+    const { send, byKind, display } = runningChild()
+    send(
+      item(
+        'item/started',
+        CHILD,
+        'c1',
+        shell('exec-1', 'npm run dev', 'inProgress', 'unifiedExecStartup')
+      )
+    )
+    const [agent] = byKind('agent')
+    // While the child's turn runs, the command is also the tool it has open.
+    expect(agent?.operation).toMatchObject({ toolName: 'Bash', input: 'npm run dev' })
+    expect(byKind('command')).toEqual([
+      expect.objectContaining({
+        membership: 'live',
+        description: 'npm run dev',
+        residency: 'background',
+        parentChildWorkId: agent!.childWorkId,
+        firstObservedAt: 1_040
+      })
+    ])
+    send(turn('turn/completed', CHILD, 'c1'))
+    expect(byKind('agent')[0]).toMatchObject({ membership: 'settled', outcome: 'succeeded' })
+    expect(byKind('command')).toEqual([expect.objectContaining({ membership: 'live' })])
+    expect(display(agent!.childWorkId)).toBe('monitoring')
+    send(
+      item('item/completed', CHILD, 'c1', {
+        ...shell('exec-1', 'npm run dev', 'completed', 'unifiedExecStartup'),
+        exitCode: 1
+      })
+    )
+    expect(byKind('command')).toEqual([])
+    expect(display(agent!.childWorkId)).toBe('done')
+  })
+
+  it('records an approved command while it runs, whatever source Codex starts it with', () => {
+    const { send, tracker, byKind, display } = runningChild()
+    // The approval path starts the item as `agent`; unified exec reports its exit.
+    send(item('item/started', CHILD, 'c1', shell('exec-2', 'npm run dev')))
+    const [agent] = byKind('agent')
+    expect(byKind('command')).toEqual([
+      expect.objectContaining({ membership: 'live', parentChildWorkId: agent!.childWorkId })
+    ])
+    send(turn('turn/completed', CHILD, 'c1'))
+    expect(display(agent!.childWorkId)).toBe('monitoring')
+    expect(tracker.state?.tasks).toEqual([expect.objectContaining({ kind: 'command' })])
+    send(
+      item(
+        'item/completed',
+        CHILD,
+        'c1',
+        shell('exec-2', 'npm run dev', 'completed', 'unifiedExecStartup')
+      )
+    )
+    expect(byKind('command')).toEqual([])
+    expect(display(agent!.childWorkId)).toBe('done')
+    expect(tracker.state).toBeNull()
+  })
+
+  it("removes a closed thread's running commands: Codex stops them and never reports their exit", () => {
+    const { send, tracker, byKind, display } = runningChild()
+    send(
+      item(
+        'item/started',
+        CHILD,
+        'c1',
+        shell('exec-1', 'npm run dev', 'inProgress', 'unifiedExecStartup')
+      ),
+      turn('turn/completed', CHILD, 'c1'),
+      turn('turn/completed', PRIMARY, PARENT_TURN)
+    )
+    const [agent] = byKind('agent')
+    expect(display(agent!.childWorkId)).toBe('monitoring')
+    send({ method: 'thread/closed', threadId: CHILD, params: { threadId: CHILD } })
+    expect(byKind('command')).toEqual([])
+    expect(display(agent!.childWorkId)).toBe('done')
+    expect(tracker.state).toBeNull()
+    // The exit Codex could not deliver starts nothing if it ever arrives.
+    send(
+      item(
+        'item/completed',
+        CHILD,
+        'c1',
+        shell('exec-1', 'npm run dev', 'completed', 'unifiedExecStartup')
+      )
+    )
+    expect(byKind('command')).toEqual([])
+  })
+
+  it("names the owner of a command launched before the host held its child's record", () => {
+    const { send, byKind } = harness()
+    send(
+      turn('turn/started', PRIMARY, PARENT_TURN),
+      turn('turn/started', CHILD, 'c1'),
+      item(
+        'item/started',
+        CHILD,
+        'c1',
+        shell('exec-1', 'tail -f log', 'inProgress', 'unifiedExecStartup')
+      )
+    )
+    expect(byKind('command')).toEqual([
+      expect.not.objectContaining({ parentChildWorkId: expect.anything() })
+    ])
+    send(spawned())
+    expect(byKind('command')).toEqual([
+      expect.objectContaining({
+        description: 'tail -f log',
+        parentChildWorkId: byKind('agent')[0]?.childWorkId
+      })
+    ])
+  })
+
+  it("records the session's own command with no owner from its start", () => {
+    const { send, byKind } = harness()
+    send(
+      turn('turn/started', PRIMARY, PARENT_TURN),
+      item(
+        'item/started',
+        PRIMARY,
+        PARENT_TURN,
+        shell('exec-9', 'sleep 90', 'inProgress', 'unifiedExecStartup')
+      )
+    )
+    expect(byKind('command')).toEqual([
+      expect.objectContaining({ membership: 'live', description: 'sleep 90' })
+    ])
+    expect(byKind('command')[0]).not.toHaveProperty('parentChildWorkId')
+    send(turn('turn/completed', PRIMARY, PARENT_TURN))
+    expect(byKind('command')).toEqual([expect.objectContaining({ membership: 'live' })])
+  })
+
+  it('leaves no record behind a finished shell, so none displaces a finished child', () => {
+    const { send, byKind, records, log } = runningChild()
+    send(turn('turn/completed', CHILD, 'c1'))
+    const before = log.length
+    // Codex runs every shell, however short, the way it runs one left running.
+    for (let index = 0; index < 40; index += 1) {
+      const id = `exec-${index}`
+      send(
+        item('item/started', PRIMARY, PARENT_TURN, {
+          ...shell(id, 'rg foo', 'inProgress', 'unifiedExecStartup'),
+          durationMs: 0
+        })
+      )
+      expect(byKind('command')).toEqual([expect.objectContaining({ description: 'rg foo' })])
+      send(
+        item('item/completed', PRIMARY, PARENT_TURN, {
+          ...shell(id, 'rg foo', 'completed', 'unifiedExecStartup'),
+          exitCode: 0
+        })
+      )
+      expect(byKind('command')).toEqual([])
+    }
+    send(turn('turn/completed', PRIMARY, PARENT_TURN))
+    expect(records()).toEqual([
+      expect.objectContaining({ kind: 'agent', membership: 'settled', outcome: 'succeeded' })
+    ])
+    // One edge when each shell starts and one when it exits, as the strip republishes today.
+    expect(
+      log
+        .slice(before)
+        .flat()
+        .map((edge) => edge.type)
+    ).toEqual(Array.from({ length: 40 }, () => ['live', 'removed']).flat())
+  })
+
+  it('names the child that spawned a nested child as its owner', () => {
+    const { send, byKind } = runningChild()
+    send(
+      spawned('thread-grandchild', CHILD, 'lint'),
+      turn('turn/started', 'thread-grandchild', 'g1')
+    )
+    const nested = byKind('agent').find((record) => record.description === 'lint')
+    const owner = byKind('agent').find((record) => record.description === 'audit_build')
+    expect(nested?.parentChildWorkId).toBe(owner?.childWorkId)
+  })
+
+  it('holds no evidence for a session with nowhere to deliver it', () => {
+    const tracker = new CodexBackgroundTaskTracker(PRIMARY)
+    tracker.observe(spawned())
+    tracker.observe(turn('turn/started', CHILD, 'c1'))
+    tracker.publishChildWork()
+    expect(tracker.drainChildWorkEvidence(1)).toEqual([])
+  })
+
+  it('settles every live child with no reported outcome, and removes every command, when the provider session ends', () => {
+    const { send, tracker, records, store } = runningChild()
+    send(
+      item(
+        'item/started',
+        PRIMARY,
+        PARENT_TURN,
+        shell('exec-1', 'npm run dev', 'inProgress', 'unifiedExecStartup')
+      ),
+      turn('turn/completed', PRIMARY, PARENT_TURN)
+    )
+    expect(records()).toHaveLength(2)
+    tracker.clear()
+    const evidence = tracker.drainChildWorkEvidence(9_000)
+    expect(evidence).toEqual([
+      {
+        type: 'removed',
+        observedAt: 9_000,
+        handle: { idKind: 'task_id', id: 'codex-command:primary:exec-1' }
+      },
+      { type: 'session-ended', observedAt: 9_000 }
+    ])
+    reconcileAgentChildWorkEvidence({
+      store,
+      admission: createAgentChildWorkAdmission(store, { mintChildWorkId: () => 'unused' }),
+      parent,
+      provider: 'codex',
+      evidence
+    })
+    expect(records()).toEqual([
+      expect.objectContaining({ kind: 'agent', membership: 'settled', outcome: 'unknown' })
+    ])
+  })
+})
diff --git a/src/main/codex/codex-child-work-evidence.ts b/src/main/codex/codex-child-work-evidence.ts
new file mode 100644
index 00000000000..93bda7a54a1
--- /dev/null
+++ b/src/main/codex/codex-child-work-evidence.ts
@@ -0,0 +1,312 @@
+// Codex child threads, and the commands they leave running, decoded into child-work evidence for
+// the host's records.
+//
+// The background-task tracker already follows which child exists, which turn it runs and how that
+// turn ended (the executions), and which command process is still running (the command tracker).
+// A command is a record from its process start until it stops, and then its record goes: the
+// tracker says when, and this module only mirrors it. This module keeps what only the records
+// read — the tool a child has open, what it said last, its usage, whether it waits on the user —
+// and after each frame re-derives the whole observation of the child that frame was about. Edges
+// are stamped with the host clock when drained, after the journal handled the frame, so the host
+// never holds a record ahead of the frame's own rows. A parent turn ending is never evidence here:
+// Codex children outlive the turn that spawned them, so only a child's own turn, or the session,
+// ends it.
+
+import type { AgentSessionBackgroundTask } from '../../shared/agent-session-wire'
+import type {
+  AgentChildWorkEvidence,
+  AgentChildWorkLiveObservation
+} from '../../shared/agent-status-child-work-evidence'
+import type { CodexBackgroundCommandChange } from './codex-background-command-tracker'
+import type {
+  CodexBackgroundTaskEvent,
+  CodexBackgroundTaskFrame
+} from './codex-background-task-frames'
+import {
+  codexChildMessageText,
+  codexChildToolCall,
+  codexChildTurnOutcome,
+  codexToolCallEnded,
+  type CodexChildToolCall
+} from './codex-child-work-translation'
+import { readRecord } from './codex-item-field-readers'
+import { readCodexThreadItem } from './codex-structured-item-translation'
+import { codexThreadWaitsOnUser, readCodexTurnId } from './codex-structured-thread-facts'
+import { CODEX_TOKEN_USAGE_METHOD, readCodexThreadTokenTotal } from './codex-subagent-activity'
+import type { CodexExecutionChild, CodexSubagentExecutions } from './codex-subagent-executions'
+
+/** The executions' own child bound. */
+const MAX_CHILD_FACTS = 128
+const MAX_OPEN_CALLS_PER_CHILD = 16
+const CHILD_FRAME_METHODS: ReadonlySet<string> = new Set([
+  'item/started',
+  'item/completed',
+  'thread/status/changed',
+  CODEX_TOKEN_USAGE_METHOD
+])
+
+/** A tool call a child has started and not finished. `openedAt` is the host clock of the first
+ *  drain that carried it, so a later edge keeps the time the call opened. */
+type OpenCall = CodexChildToolCall & { turnId: string | null; openedAt?: number }
+
+type ChildFacts = {
+  openCalls: Map<string, OpenCall>
+  lastMessage?: { turnId: string | null; text: string }
+  totalTokens?: number
+  waiting: boolean
+  /** The last observation handed to the host, so an unchanged re-derivation sends nothing. */
+  published?: string
+}
+
+export type CodexPendingChildWork = (observedAt: number) => AgentChildWorkEvidence
+
+/** Evidence from a run only counts for that run: a fact recorded under another turn is stale. */
+function ofTurn<T extends { turnId: string | null }>(fact: T | undefined, turnId: string) {
+  return fact?.turnId === turnId ? fact : undefined
+}
+
+function commandLive(task: AgentSessionBackgroundTask, ownerId: string | null) {
+  return (observedAt: number): AgentChildWorkEvidence => ({
+    type: 'live',
+    observedAt,
+    child: {
+      handle: { idKind: 'task_id', id: task.id },
+      kind: 'command',
+      // Its own process, not a turn's: no turn ending may settle it.
+      residency: 'background',
+      state: 'working',
+      ...(task.description ? { description: task.description } : {}),
+      ...(ownerId !== null ? { ownerId } : {}),
+      stoppable: false
+    }
+  })
+}
+
+export class CodexChildWorkEvidence {
+  private readonly facts = new Map<string, ChildFacts>()
+  private pending: CodexPendingChildWork[] = []
+
+  constructor(
+    private readonly primaryThreadId: string,
+    private readonly executions: CodexSubagentExecutions,
+    private readonly liveCommands: (threadId: string) => readonly AgentSessionBackgroundTask[]
+  ) {}
+
+  /** After the tracker applied the frame: which command processes it saw start or stop, and the
+   *  child the frame is about. */
+  observe(
+    event: CodexBackgroundTaskEvent,
+    frame: CodexBackgroundTaskFrame | null,
+    commands: readonly CodexBackgroundCommandChange[]
+  ): void {
+    this.queueCommands(commands)
+    const threadId = this.childThread(event, frame)
+    if (threadId === null) {
+      return
+    }
+    const facts = this.factsFor(threadId)
+    if (facts && event.threadId === threadId) {
+      this.record(facts, event)
+    }
+    this.queueChild(threadId)
+  }
+
+  /** The provider session is gone, with the commands it ended: no child it still ran can report
+   *  its own ending. */
+  clear(commands: readonly CodexBackgroundCommandChange[]): void {
+    this.facts.clear()
+    this.queueCommands(commands)
+    this.pending.push((observedAt) => ({ type: 'session-ended', observedAt }))
+  }
+
+  drain(observedAt: number): AgentChildWorkEvidence[] {
+    const pending = this.pending
+    this.pending = []
+    return pending.map((edge) => edge(observedAt))
+  }
+
+  private childThread(
+    event: CodexBackgroundTaskEvent,
+    frame: CodexBackgroundTaskFrame | null
+  ): string | null {
+    const threadId =
+      frame?.kind === 'subagent'
+        ? frame.agentThreadId
+        : frame || CHILD_FRAME_METHODS.has(event.method)
+          ? event.threadId
+          : null
+    return threadId === this.primaryThreadId ? null : threadId
+  }
+
+  /** A command belongs to the child thread that launched it; the session's own agent is no owner.
+   *  A stopped command leaves no record: it has nothing left to report. */
+  private queueCommands(commands: readonly CodexBackgroundCommandChange[]): void {
+    for (const command of commands) {
+      if (command.type === 'started') {
+        const ownerId = command.threadId === this.primaryThreadId ? null : command.threadId
+        this.pending.push(commandLive(command.task, ownerId))
+        continue
+      }
+      const { taskId } = command
+      this.pending.push((observedAt) => ({
+        type: 'removed',
+        observedAt,
+        handle: { idKind: 'task_id', id: taskId }
+      }))
+    }
+  }
+
+  private record(facts: ChildFacts, event: CodexBackgroundTaskEvent): void {
+    if (event.method === CODEX_TOKEN_USAGE_METHOD) {
+      facts.totalTokens = readCodexThreadTokenTotal(event.params)?.totalTokens ?? facts.totalTokens
+      return
+    }
+    if (event.method === 'thread/status/changed') {
+      facts.waiting = codexThreadWaitsOnUser(event.params)
+      return
+    }
+    // Every Codex agent shell is unified exec: it is the open call until its process exits.
+    const item = readCodexThreadItem(readRecord(event.params).item)
+    if (!item) {
+      return
+    }
+    // A frame that names no turn belongs to the one the child is running.
+    const turnId =
+      readCodexTurnId(event.params) ??
+      this.executions.find(event.threadId)?.execution?.turnId ??
+      null
+    const text = event.method === 'item/completed' ? codexChildMessageText(item) : undefined
+    if (text) {
+      facts.lastMessage = { turnId, text }
+    }
+    // An end closes the call by id alone: its closing frame need not restate what it ran.
+    if (codexToolCallEnded(event.method, item)) {
+      facts.openCalls.delete(item.id)
+      return
+    }
+    const call = codexChildToolCall(item)
+    if (call && !facts.openCalls.has(item.id)) {
+      facts.openCalls.set(item.id, { ...call, turnId })
+      for (const stale of [...facts.openCalls.keys()].slice(0, -MAX_OPEN_CALLS_PER_CHILD)) {
+        facts.openCalls.delete(stale)
+      }
+    }
+  }
+
+  /** Re-derive the child's observation and hand it on when it changed. A child the provider has
+   *  not announced, or that never ran a turn, is no record. */
+  private queueChild(threadId: string): void {
+    const child = this.executions.find(threadId)
+    const facts = this.facts.get(threadId)
+    if (!child?.registered || !child.execution || !facts) {
+      return
+    }
+    const { turnId, state } = child.execution
+    if (state !== 'working') {
+      // The turn is over, and so is every call it had open.
+      facts.openCalls.clear()
+      facts.waiting = false
+      const lastMessage = ofTurn(facts.lastMessage, turnId)?.text
+      const { totalTokens } = facts
+      const outcome = codexChildTurnOutcome(state)
+      this.publish(facts, JSON.stringify(['ended', turnId, state]), (observedAt) => ({
+        type: 'ended',
+        observedAt,
+        handle: { idKind: 'thread_id', id: threadId, runId: turnId },
+        outcome,
+        ...(lastMessage ? { lastMessage } : {}),
+        ...(totalTokens !== undefined ? { totalTokens } : {})
+      }))
+      return
+    }
+    for (const [itemId, call] of facts.openCalls) {
+      if (!ofTurn(call, turnId)) {
+        facts.openCalls.delete(itemId)
+      }
+    }
+    const observation = this.liveAgent(threadId, child, facts, turnId)
+    const openCall = [...facts.openCalls].at(-1)
+    const announced = facts.published !== undefined
+    this.publish(facts, JSON.stringify(['live', observation, openCall?.[0]]), (observedAt) => {
+      if (!openCall) {
+        return { type: 'live', observedAt, child: { ...observation, operation: null } }
+      }
+      const [, call] = openCall
+      call.openedAt ??= observedAt
+      const operation = {
+        toolName: call.toolName,
+        ...(call.input ? { input: call.input } : {}),
+        basis: 'open' as const,
+        observedAt: call.openedAt
+      }
+      return { type: 'live', observedAt, child: { ...observation, operation } }
+    })
+    if (!announced) {
+      this.requeueOwnedBy(threadId)
+    }
+  }
+
+  private liveAgent(
+    threadId: string,
+    child: Readonly<CodexExecutionChild>,
+    facts: ChildFacts,
+    turnId: string
+  ): AgentChildWorkLiveObservation {
+    const lastMessage = ofTurn(facts.lastMessage, turnId)?.text
+    const spawner = child.spawnerThreadId
+    return {
+      handle: { idKind: 'thread_id', id: threadId, runId: turnId },
+      kind: 'agent',
+      // A spawned child may outlive the turn that spawned it.
+      residency: 'background',
+      state: facts.waiting ? 'waiting' : 'working',
+      // The agent path's last segment is the child's only label; today's row shows it there.
+      ...(child.label ? { description: child.label } : {}),
+      ...(facts.totalTokens !== undefined ? { totalTokens: facts.totalTokens } : {}),
+      ...(lastMessage ? { lastMessage } : {}),
+      ...(spawner && spawner !== this.primaryThreadId ? { ownerId: spawner } : {}),
+      stoppable: false
+    }
+  }
+
+  private publish(facts: ChildFacts, fingerprint: string, edge: CodexPendingChildWork): void {
+    if (facts.published !== fingerprint) {
+      facts.published = fingerprint
+      this.pending.push(edge)
+    }
+  }
+
+  /** Work a child launched before the host held its record was admitted with no owner; now that
+   *  the owner is recorded, say again whose it is. */
+  private requeueOwnedBy(threadId: string): void {
+    for (const task of this.liveCommands(threadId)) {
+      this.pending.push(commandLive(task, threadId))
+    }
+    for (const spawned of this.executions.workingChildren()) {
+      const facts = this.facts.get(spawned.agentThreadId)
+      if (spawned.spawnerThreadId === threadId && facts?.published !== undefined) {
+        facts.published = undefined
+        this.queueChild(spawned.agentThreadId)
+      }
+    }
+  }
+
+  private factsFor(threadId: string): ChildFacts | undefined {
+    const existing = this.facts.get(threadId)
+    if (existing) {
+      return existing
+    }
+    if (this.facts.size >= MAX_CHILD_FACTS) {
+      const idle = [...this.facts.keys()].find(
+        (id) => this.executions.find(id)?.execution?.state !== 'working'
+      )
+      if (idle === undefined) {
+        return undefined
+      }
+      this.facts.delete(idle)
+    }
+    const facts: ChildFacts = { openCalls: new Map(), waiting: false }
+    this.facts.set(threadId, facts)
+    return facts
+  }
+}
diff --git a/src/main/codex/codex-child-work-translation.ts b/src/main/codex/codex-child-work-translation.ts
new file mode 100644
index 00000000000..2763ac53b1c
--- /dev/null
+++ b/src/main/codex/codex-child-work-translation.ts
@@ -0,0 +1,88 @@
+// Codex items and statuses, read in the child-work vocabulary.
+//
+// A tool is named the way Codex names it to its own hooks (`Bash`, `apply_patch`,
+// `mcp__server__tool`), so a structured Codex child running a shell reads exactly as a Codex
+// CLI agent running one does.
+
+import type { AgentChildWorkOutcome } from '../../shared/agent-status-child-work'
+import type { NativeChatSubagentState } from '../../shared/native-chat-types'
+import {
+  deriveFallbackToolInputPreview,
+  deriveToolInputPreview
+} from '../../shared/agent-hook-listener/tool-input-preview'
+import { readRecord, readString, readTextContent } from './codex-item-field-readers'
+import type { CodexThreadItem } from './codex-structured-item-translation'
+
+/** Raw provider text kept for a record; admission folds it to its own one-line bound. */
+export const CODEX_CHILD_WORK_TEXT_MAX_CHARS = 2_048
+
+export type CodexChildToolCall = { toolName: string; input?: string }
+
+function bounded(text: string | null | undefined): string | undefined {
+  return text ? text.slice(0, CODEX_CHILD_WORK_TEXT_MAX_CHARS) : undefined
+}
+
+function withInput(toolName: string, input: string | undefined): CodexChildToolCall {
+  const preview = bounded(input)
+  return preview ? { toolName, input: preview } : { toolName }
+}
+
+function firstChangePath(changes: unknown): string | undefined {
+  const [first] = Array.isArray(changes) ? changes : []
+  return readString(readRecord(first), 'path') ?? undefined
+}
+
+/** The tool a thread item runs, or null for an item that is not a tool call (a message, a
+ *  thought, a plan). */
+export function codexChildToolCall(item: CodexThreadItem): CodexChildToolCall | null {
+  switch (item.type) {
+    case 'commandExecution':
+      return withInput('Bash', deriveToolInputPreview('Bash', { command: item.command }))
+    case 'fileChange':
+      return withInput('apply_patch', firstChangePath(item.changes))
+    case 'mcpToolCall': {
+      const server = readString(item, 'server')
+      const tool = readString(item, 'tool')
+      if (!tool) {
+        return null
+      }
+      return withInput(
+        server ? `mcp__${server}__${tool}` : tool,
+        deriveFallbackToolInputPreview(item.arguments)
+      )
+    }
+    case 'webSearch':
+      return withInput('web_search', readString(item, 'query') ?? undefined)
+    default:
+      return null
+  }
+}
+
+/** Whether an item frame says the call is over, whatever frame carried it. */
+export function codexToolCallEnded(method: string, item: CodexThreadItem): boolean {
+  const status = readString(item, 'status')
+  return method === 'item/completed' || (status !== null && status !== 'inProgress')
+}
+
+/** What a child said: an assistant message's text. */
+export function codexChildMessageText(item: CodexThreadItem): string | undefined {
+  return item.type === 'agentMessage'
+    ? bounded(readString(item, 'text') ?? readTextContent(item, 'content'))
+    : undefined
+}
+
+/** A child turn's ending. Codex states three; anything else is an ending nobody classified. */
+export function codexChildTurnOutcome(state: NativeChatSubagentState): AgentChildWorkOutcome {
+  switch (state) {
+    case 'completed':
+      return 'succeeded'
+    case 'failed':
+      return 'failed'
+    case 'stopped':
+      return 'cancelled'
+    case 'unverifiable':
+    case 'working':
+    case 'idle':
+      return 'unknown'
+  }
+}
diff --git a/src/main/codex/codex-command-turn-claim.test.ts b/src/main/codex/codex-command-turn-claim.test.ts
new file mode 100644
index 00000000000..078060497f2
--- /dev/null
+++ b/src/main/codex/codex-command-turn-claim.test.ts
@@ -0,0 +1,375 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity,
+  AgentJournalTurnScope
+} from '../../shared/agent-session-journal-types'
+import { readAgentJournalTurn } from '../../shared/agent-session-turn-record'
+import type {
+  StructuredAgentSessionEventSink,
+  StructuredAgentSessionRevisionJournal,
+  StructuredAgentSessionSinkAdmission
+} from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { createCodexJournalTranslator } from './codex-structured-journal-translation'
+import type { CodexStructuredSessionEvent } from './codex-structured-session-adapter'
+
+const SESSION = 'session-1'
+const THREAD = 'thread-1'
+const PROVIDER_TURN = 'compact-turn'
+const COMMAND_TURN_IDENTITY: AgentJournalItemIdentity = {
+  provider: 'orca',
+  clientMessageId: 'command-turn:cmd-1'
+}
+const COMMAND_TURN_KEY = agentJournalItemKey(COMMAND_TURN_IDENTITY)
+const RUNNING = {
+  kind: 'turn' as const,
+  turnId: 'compact:cmd-1',
+  state: 'running' as const,
+  userItemId: 'orca:submission:cmd-1',
+  requestedAt: 1,
+  startedAt: 1
+}
+const COMMAND = {
+  clientMessageId: 'cmd-1',
+  turnId: RUNNING.turnId,
+  identity: COMMAND_TURN_IDENTITY,
+  resultIdentity: { provider: 'orca' as const, clientMessageId: 'command-result:cmd-1' },
+  running: RUNNING
+}
+const ACCEPTED: StructuredAgentSessionSinkAdmission = { accepted: true }
+
+type Written = { key: string; body: AgentJournalItemBody; turnScope?: AgentJournalTurnScope }
+
+/** Records every write with the scope it states; the journal holds the running command turn. */
+function recorder(refuseRevisions = 0) {
+  const writes: Written[] = []
+  const record = (
+    identity: AgentJournalItemIdentity,
+    body: AgentJournalItemBody,
+    turnScope?: AgentJournalTurnScope
+  ) => writes.push({ key: agentJournalItemKey(identity), body, turnScope })
+  const commandTurn: AgentJournalItemBody = RUNNING
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the claim resolver reads only `itemBody`.
+  const journal = {
+    itemBody: (itemId: string) => (itemId === COMMAND_TURN_KEY ? commandTurn : null)
+  } as unknown as StructuredAgentSessionRevisionJournal
+  let refusals = refuseRevisions
+  const sink: StructuredAgentSessionEventSink = {
+    appendItem: (identity, body, options) => record(identity, body, options.turnScope),
+    appendTombstone: () => {},
+    publish: () => {},
+    tryPublish: () => ACCEPTED,
+    tryAppendItem: (identity, body, options) => {
+      record(identity, body, options.turnScope)
+      return ACCEPTED
+    },
+    appendLifecycleBatch: (_settlementId, mutations) => {
+      for (const mutation of mutations) {
+        if (mutation.kind === 'item') {
+          record(mutation.identity, mutation.body, mutation.turnScope)
+        }
+      }
+    },
+    tryReviseResolvedItemAndPublish: (_bytes, resolve, options) => {
+      if (refusals > 0) {
+        refusals -= 1
+        return { accepted: false, reason: 'backpressure' }
+      }
+      const resolved = resolve(journal)
+      if (resolved) {
+        record(resolved.identity, resolved.body, options.turnScope)
+      }
+      return ACCEPTED
+    }
+  }
+  return { sink, writes }
+}
+
+/** Codex names the thread inside every notification's params too. */
+function notification(
+  method: string,
+  params: Record<string, unknown>
+): CodexStructuredSessionEvent {
+  return {
+    type: 'notification',
+    sessionId: SESSION,
+    threadId: THREAD,
+    method,
+    params: { threadId: THREAD, ...params }
+  }
+}
+
+function harness(refuseRevisions = 0) {
+  const tap = recorder(refuseRevisions)
+  const translator = createCodexJournalTranslator({
+    sink: tap.sink,
+    sessionId: SESSION,
+    primaryThreadId: () => THREAD
+  })
+  return {
+    ...tap,
+    translator,
+    emit: (event: CodexStructuredSessionEvent) => translator.handle(event)
+  }
+}
+
+const codexTurnRecords = (writes: readonly Written[]) =>
+  writes.filter((write) => write.key !== COMMAND_TURN_KEY && readAgentJournalTurn(write.body))
+
+/** The command turn's newest body, as the journal would hold it. */
+const commandTurn = (writes: readonly Written[]) =>
+  readAgentJournalTurn(writes.findLast((write) => write.key === COMMAND_TURN_KEY)?.body)
+
+const resultRows = (writes: readonly Written[]) =>
+  writes.filter((write) => write.body.kind === 'status')
+
+describe('a Codex turn a conversation command claims', () => {
+  it('is the command turn: writes no root turn, scopes its content there, and ends it', () => {
+    const { writes, translator, emit } = harness()
+    translator.beginCommand(COMMAND)
+
+    emit(notification('turn/started', { turn: { id: PROVIDER_TURN } }))
+    // The claim is persisted on the command turn: nothing else re-derives it later.
+    expect(commandTurn(writes)).toMatchObject({ state: 'running', providerTurnId: PROVIDER_TURN })
+    emit(
+      notification('item/completed', {
+        turnId: PROVIDER_TURN,
+        item: { type: 'agentMessage', id: 'summary', text: 'Summary of the conversation.' }
+      })
+    )
+    emit(
+      notification('item/completed', {
+        turnId: PROVIDER_TURN,
+        item: { type: 'contextCompaction', id: 'compaction' }
+      })
+    )
+    emit(notification('turn/completed', { turn: { id: PROVIDER_TURN, status: 'completed' } }))
+
+    expect(codexTurnRecords(writes)).toEqual([])
+    const scope = { kind: 'turn', turnItemId: COMMAND_TURN_KEY }
+    const summary = writes.find(
+      (write) => write.body.kind === 'message' && write.body.role === 'assistant'
+    )
+    expect(summary?.turnScope).toEqual(scope)
+    // Codex's own marker is the command's result row.
+    expect(resultRows(writes)).toEqual([
+      expect.objectContaining({
+        body: { kind: 'status', text: 'Context compacted', presentation: 'compaction' },
+        turnScope: scope
+      })
+    ])
+    expect(commandTurn(writes)).toMatchObject({
+      state: 'completed',
+      outcome: 'success',
+      providerTurnId: PROVIDER_TURN,
+      userItemId: RUNNING.userItemId,
+      requestedAt: RUNNING.requestedAt
+    })
+  })
+
+  it('reads an interrupted turn as the command cancelled, with no result row', () => {
+    const { writes, translator, emit } = harness()
+    translator.beginCommand(COMMAND)
+    emit(notification('turn/started', { turn: { id: PROVIDER_TURN } }))
+    emit(notification('turn/completed', { turn: { id: PROVIDER_TURN, status: 'interrupted' } }))
+
+    expect(commandTurn(writes)).toMatchObject({ state: 'interrupted', outcome: 'cancellation' })
+    expect(resultRows(writes)).toEqual([])
+  })
+
+  it('reads a turn that completed without compacting as a failure, with the reason', () => {
+    const { writes, translator, emit } = harness()
+    translator.beginCommand(COMMAND)
+    emit(notification('turn/started', { turn: { id: PROVIDER_TURN } }))
+    emit(
+      notification('turn/completed', {
+        turn: { id: PROVIDER_TURN, status: 'failed', error: { message: 'Unavailable' } }
+      })
+    )
+
+    expect(commandTurn(writes)).toMatchObject({ state: 'completed', outcome: 'failure' })
+    expect(resultRows(writes).map((write) => write.body)).toEqual([
+      {
+        kind: 'status',
+        text: 'Compaction failed: Unavailable.',
+        failure: {
+          kind: 'compactionFailed',
+          detail: { text: 'Unavailable', audience: 'person' }
+        },
+        tone: 'error'
+      }
+    ])
+  })
+
+  it('says only that the compaction failed when a turn that did not complete gave no words', () => {
+    const { writes, translator, emit } = harness()
+    translator.beginCommand(COMMAND)
+    emit(notification('turn/started', { turn: { id: PROVIDER_TURN } }))
+    emit(notification('turn/completed', { turn: { id: PROVIDER_TURN, status: 'failed' } }))
+
+    expect(commandTurn(writes)).toMatchObject({ state: 'completed', outcome: 'failure' })
+    expect(resultRows(writes).map((write) => write.body)).toEqual([
+      {
+        kind: 'status',
+        text: 'Compaction failed.',
+        failure: { kind: 'compactionFailed' },
+        tone: 'error'
+      }
+    ])
+  })
+
+  it('reports a turn that completed without Codex reporting a compaction as unconfirmed', () => {
+    const { writes, translator, emit } = harness()
+    translator.beginCommand(COMMAND)
+    emit(notification('turn/started', { turn: { id: PROVIDER_TURN } }))
+    emit(notification('turn/completed', { turn: { id: PROVIDER_TURN, status: 'completed' } }))
+
+    expect(commandTurn(writes)).toMatchObject({ state: 'completed', outcome: 'failure' })
+    expect(resultRows(writes).map((write) => write.body)).toEqual([
+      {
+        kind: 'status',
+        text: 'Compaction completion is unconfirmed.',
+        failure: { kind: 'compactionUnconfirmed' },
+        tone: 'error'
+      }
+    ])
+  })
+
+  it('ends a compaction Codex failed with an error once, however late its completion', () => {
+    const { writes, translator, emit } = harness()
+    translator.beginCommand(COMMAND)
+    emit(notification('turn/started', { turn: { id: PROVIDER_TURN } }))
+    emit(
+      notification('error', {
+        turnId: PROVIDER_TURN,
+        willRetry: false,
+        error: { message: 'Unavailable' }
+      })
+    )
+    // The error is a row; only the completion ends the turn.
+    expect(commandTurn(writes)).toMatchObject({ state: 'running' })
+    // Codex still completes the turn it failed, as status failed.
+    emit(
+      notification('turn/completed', {
+        turn: { id: PROVIDER_TURN, status: 'failed', error: { message: 'Unavailable' } }
+      })
+    )
+
+    expect(codexTurnRecords(writes)).toEqual([])
+    expect(commandTurn(writes)).toMatchObject({ state: 'completed', outcome: 'failure' })
+    expect(
+      writes.filter(
+        (write) => write.key === COMMAND_TURN_KEY && readAgentJournalTurn(write.body)?.completedAt
+      )
+    ).toHaveLength(1)
+    // Codex's own error row, in the command's turn; the completion adds none.
+    expect(resultRows(writes)).toEqual([
+      expect.objectContaining({
+        body: expect.objectContaining({ kind: 'status', text: 'Unavailable', tone: 'error' }),
+        turnScope: { kind: 'turn', turnItemId: COMMAND_TURN_KEY }
+      })
+    ])
+  })
+
+  it("ends a captured failed compaction on its completion, below one row of Codex's own", () => {
+    // A real app-server's compaction turn: two retried stream errors, the turn-ending error, then
+    // the failed completion.
+    const captured: { case: string; t: number; method: string; params: object }[] = readFileSync(
+      join(__dirname, '__fixtures__', 'codex-app-server-turn-endings.jsonl'),
+      'utf8'
+    )
+      .split('\n')
+      .filter((line) => line.length > 0)
+      .map((line) => JSON.parse(line))
+      .filter((frame) => frame.case === '0.158.0-compact-overloaded')
+    const compactionTurn = captured.findLastIndex((frame) => frame.method === 'turn/started')
+    const { writes, translator, emit } = harness()
+    translator.beginCommand(COMMAND)
+    for (const frame of captured.slice(compactionTurn)) {
+      emit({
+        type: 'notification',
+        sessionId: SESSION,
+        threadId: THREAD,
+        method: frame.method,
+        params: { ...frame.params, threadId: THREAD },
+        observedAt: frame.t
+      })
+    }
+
+    expect(codexTurnRecords(writes)).toEqual([])
+    const completion = captured.at(-1)!
+    expect(completion.method).toBe('turn/completed')
+    expect(commandTurn(writes)).toMatchObject({
+      state: 'completed',
+      outcome: 'failure',
+      completedAt: completion.t
+    })
+    // Every row is one of Codex's frames, inside the command's turn; the completion adds none.
+    const scope = { kind: 'turn', turnItemId: COMMAND_TURN_KEY }
+    const rows = resultRows(writes)
+    expect(rows.map((write) => write.key)).not.toContain(
+      agentJournalItemKey(COMMAND.resultIdentity)
+    )
+    expect(rows.map((write) => write.turnScope)).toEqual(rows.map(() => scope))
+    expect(
+      rows.some(
+        (write) =>
+          write.body.kind === 'status' &&
+          write.body.tone === 'error' &&
+          write.body.text.includes('Selected model is at capacity')
+      )
+    ).toBe(true)
+  })
+
+  it('leaves the next turn to write its own record after a failed compaction', () => {
+    const { writes, translator, emit } = harness()
+    translator.beginCommand(COMMAND)
+    emit(notification('turn/started', { turn: { id: PROVIDER_TURN } }))
+    emit(
+      notification('error', { turnId: PROVIDER_TURN, willRetry: false, error: { message: 'x' } })
+    )
+    emit(notification('turn/completed', { turn: { id: PROVIDER_TURN, status: 'failed' } }))
+    emit(notification('turn/started', { turn: { id: 'ordinary' } }))
+    emit(notification('turn/completed', { turn: { id: 'ordinary', status: 'completed' } }))
+
+    expect(
+      codexTurnRecords(writes).map((write) => readAgentJournalTurn(write.body)?.turnId)
+    ).toEqual(['ordinary', 'ordinary'])
+  })
+
+  it('names no provider turn for a Stop until Codex opens one, then the one it opened', () => {
+    const { translator, emit } = harness()
+    translator.beginCommand(COMMAND)
+    expect(translator.commandProviderTurnId(COMMAND.turnId)).toBeUndefined()
+    emit(notification('turn/started', { turn: { id: PROVIDER_TURN } }))
+    expect(translator.commandProviderTurnId(COMMAND.turnId)).toBe(PROVIDER_TURN)
+    expect(translator.commandProviderTurnId('ordinary')).toBe('ordinary')
+  })
+
+  it('claims the same provider turn when the refused start is retried', () => {
+    const { writes, translator, emit } = harness(1)
+    translator.beginCommand(COMMAND)
+    const started = notification('turn/started', { turn: { id: PROVIDER_TURN } })
+
+    expect(emit(started)).toEqual({ accepted: false, reason: 'backpressure' })
+    expect(emit(started)).toEqual(ACCEPTED)
+
+    expect(codexTurnRecords(writes)).toEqual([])
+    expect(commandTurn(writes)).toMatchObject({ providerTurnId: PROVIDER_TURN })
+    expect(translator.commandProviderTurnId(COMMAND.turnId)).toBe(PROVIDER_TURN)
+  })
+
+  it('leaves a primary turn no command claims to write its own record', () => {
+    const { writes, translator, emit } = harness()
+    translator.beginCommand(COMMAND)
+    translator.forgetCommand(COMMAND.turnId)
+    emit(notification('turn/started', { turn: { id: 'ordinary' } }))
+    emit(notification('turn/completed', { turn: { id: 'ordinary', status: 'completed' } }))
+    expect(
+      codexTurnRecords(writes).map((write) => readAgentJournalTurn(write.body)?.state)
+    ).toEqual(['running', 'completed'])
+  })
+})
diff --git a/src/main/codex/codex-command-turn-claim.ts b/src/main/codex/codex-command-turn-claim.ts
new file mode 100644
index 00000000000..e1278a8b5c4
--- /dev/null
+++ b/src/main/codex/codex-command-turn-claim.ts
@@ -0,0 +1,32 @@
+import { parseAgentJournalItemKey } from '../../shared/agent-session-journal-item-key'
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../shared/agent-session-journal-types'
+import type {
+  StructuredAgentSessionEventSink,
+  StructuredAgentSessionSinkAdmission
+} from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+
+const CLAIM_BYTES = 4_096
+
+/** Records on the command's turn which provider turn carried it out. Persisted because nothing
+ *  else re-derives it once the command settles, and a rewind has to place that turn's rows. */
+export function recordCodexCommandTurnClaim(
+  sink: StructuredAgentSessionEventSink,
+  commandTurnItemId: string,
+  providerTurnId: string
+): StructuredAgentSessionSinkAdmission {
+  const identity = parseAgentJournalItemKey(commandTurnItemId)
+  if (!identity || !sink.tryReviseResolvedItemAndPublish) {
+    return { accepted: true }
+  }
+  return sink.tryReviseResolvedItemAndPublish(
+    CLAIM_BYTES,
+    (journal) => {
+      const body = journal.itemBody(commandTurnItemId)
+      // Settled already — by the host, or by a child's death — leaves nothing to annotate.
+      return body?.kind === 'turn' && body.state === 'running'
+        ? { identity, body: { ...body, providerTurnId } }
+        : null
+    },
+    { lifecycle: true, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+  )
+}
diff --git a/src/main/codex/codex-config-mirror-mcp-ownership.test.ts b/src/main/codex/codex-config-mirror-mcp-ownership.test.ts
new file mode 100644
index 00000000000..85121996a06
--- /dev/null
+++ b/src/main/codex/codex-config-mirror-mcp-ownership.test.ts
@@ -0,0 +1,159 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  syncSystemConfigIntoManagedCodexHome,
+  syncSystemConfigIntoLegacySharedCodexHome
+} from './codex-config-mirror'
+
+let root: string
+let runtimeHomePath: string
+let systemHomePath: string
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'orca-mcp-ownership-'))
+  runtimeHomePath = join(root, 'runtime')
+  systemHomePath = join(root, 'system')
+  mkdirSync(runtimeHomePath)
+  mkdirSync(systemHomePath)
+})
+
+afterEach(() => rmSync(root, { recursive: true, force: true }))
+
+describe('canonical MCP ownership during config mirroring', () => {
+  it('does not duplicate a server defined inline in the canonical MCP table', () => {
+    writeFileSync(
+      join(runtimeHomePath, 'config.toml'),
+      '[mcp_servers.shared]\ncommand = "runtime"\n'
+    )
+    writeFileSync(
+      join(systemHomePath, 'config.toml'),
+      '[mcp_servers]\nshared = { command = "system" }\n'
+    )
+
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+
+    const runtimeConfig = readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')
+    expect(runtimeConfig).toContain('shared = { command = "system" }')
+    expect(runtimeConfig).not.toContain('[mcp_servers.shared]')
+  })
+
+  it('preserves deletion after a canonical inline server is rewritten by the runtime', () => {
+    writeFileSync(
+      join(runtimeHomePath, 'config.toml'),
+      '[mcp_servers.shared]\ncommand = "runtime"\n'
+    )
+    writeFileSync(
+      join(systemHomePath, 'config.toml'),
+      '[mcp_servers]\nshared = { command = "system" }\n'
+    )
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+    writeFileSync(
+      join(runtimeHomePath, 'config.toml'),
+      '[mcp_servers.shared]\ncommand = "system"\n[mcp_servers.runtime_only]\ncommand = "runtime"\n'
+    )
+    writeFileSync(join(systemHomePath, 'config.toml'), 'model = "system"\n')
+
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+
+    const runtimeConfig = readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')
+    expect(runtimeConfig).not.toContain('[mcp_servers.shared]')
+    expect(runtimeConfig).toContain('[mcp_servers.runtime_only]')
+  })
+
+  it('honors a closed canonical MCP root and its later removal', () => {
+    writeFileSync(
+      join(runtimeHomePath, 'config.toml'),
+      '[mcp_servers.runtime_only]\ncommand = "runtime"\n'
+    )
+    writeFileSync(
+      join(systemHomePath, 'config.toml'),
+      'mcp_servers = { shared = { enabled = false } }\n'
+    )
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+    expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).not.toContain(
+      '[mcp_servers.'
+    )
+    expect(
+      JSON.parse(
+        readFileSync(join(runtimeHomePath, '.orca-config-settings-baseline.json'), 'utf-8')
+      )
+    ).toMatchObject({ mcpServerRoot: true })
+    writeFileSync(join(runtimeHomePath, 'config.toml'), '[mcp_servers.shared]\nenabled = false\n')
+    writeFileSync(join(systemHomePath, 'config.toml'), 'model = "system"\n')
+
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+
+    expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).not.toContain(
+      '[mcp_servers.'
+    )
+  })
+})
+
+describe('MCP ownership migration', () => {
+  it.each([1, 2, 3])(
+    'keeps pre-ownership baseline version %s canonical for one pass',
+    (version) => {
+      writeFileSync(
+        join(runtimeHomePath, 'config.toml'),
+        '[mcp_servers.removed]\ncommand = "old"\n'
+      )
+      writeFileSync(join(systemHomePath, 'config.toml'), 'model = "system"\n')
+      writeFileSync(
+        join(runtimeHomePath, '.orca-config-settings-baseline.json'),
+        JSON.stringify({ version, settings: {} })
+      )
+
+      syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+
+      expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).not.toContain(
+        '[mcp_servers.'
+      )
+      expect(
+        JSON.parse(
+          readFileSync(join(runtimeHomePath, '.orca-config-settings-baseline.json'), 'utf-8')
+        )
+      ).toMatchObject({ mcpServers: [] })
+      writeFileSync(join(runtimeHomePath, 'config.toml'), '[mcp_servers.added]\ncommand = "new"\n')
+
+      syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+
+      expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).toContain(
+        '[mcp_servers.added]'
+      )
+    }
+  )
+
+  it('keeps the retained shared home one-way without an ownership baseline', () => {
+    writeFileSync(join(runtimeHomePath, 'config.toml'), '[mcp_servers.removed]\ncommand = "old"\n')
+    writeFileSync(join(systemHomePath, 'config.toml'), 'model = "system"\n')
+
+    syncSystemConfigIntoLegacySharedCodexHome({ runtimeHomePath, systemHomePath })
+
+    expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).not.toContain(
+      '[mcp_servers.'
+    )
+  })
+
+  it('tracks commented CRLF names so their later removal remains authoritative', () => {
+    writeFileSync(
+      join(runtimeHomePath, 'config.toml'),
+      '[mcp_servers.shared]\ncommand = "runtime"\n'
+    )
+    writeFileSync(
+      join(systemHomePath, 'config.toml'),
+      '[mcp_servers.shared] # see [docs]\r\ncommand = "system"\r\n'
+    )
+
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+    expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).not.toContain('"runtime"')
+    writeFileSync(join(systemHomePath, 'config.toml'), 'model = "system"\n')
+
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+
+    expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).not.toContain(
+      '[mcp_servers.shared]'
+    )
+  })
+})
diff --git a/src/main/codex/codex-config-mirror.test.ts b/src/main/codex/codex-config-mirror.test.ts
index 2469a2be724..74db1cd9c05 100644
--- a/src/main/codex/codex-config-mirror.test.ts
+++ b/src/main/codex/codex-config-mirror.test.ts
@@ -52,6 +52,10 @@ function getRuntimeConfigPath(): string {
   return join(userDataDir, 'codex-runtime-home', 'home', 'config.toml')
 }
 
+function getRuntimeBaselinePath(): string {
+  return join(userDataDir, 'codex-runtime-home', 'home', '.orca-config-settings-baseline.json')
+}
+
 beforeEach(() => {
   fakeHomeDir = mkdtempSync(join(tmpdir(), 'orca-codex-config-home-'))
   userDataDir = mkdtempSync(join(tmpdir(), 'orca-codex-config-user-data-'))
@@ -364,6 +368,96 @@ describe('syncSystemConfigIntoManagedCodexHome', () => {
     expect(runtimeConfig.match(/\[projects\."\/repo"\]/g)?.length).toBe(1)
   })
 
+  it('preserves runtime-only MCP servers and nested descendants with system precedence', () => {
+    mkdirSync(join(userDataDir, 'codex-runtime-home', 'home'), { recursive: true })
+    writeFileSync(
+      getRuntimeConfigPath(),
+      [
+        '[mcp_servers.runtime_only]',
+        'command = "runtime-command"',
+        '',
+        '[mcp_servers.runtime_only.env]',
+        'MODE = "runtime"',
+        '',
+        '[mcp_servers.shared]',
+        'command = "runtime-shared"',
+        ''
+      ].join('\n'),
+      'utf-8'
+    )
+    writeFileSync(
+      getSystemConfigPath(),
+      [
+        '[mcp_servers."shared"]',
+        'command = "system-shared"',
+        '',
+        '[mcp_servers.system_only]',
+        'command = "system-only"',
+        ''
+      ].join('\n'),
+      'utf-8'
+    )
+
+    syncSystemConfigIntoManagedCodexHome()
+
+    const runtimeConfig = readFileSync(getRuntimeConfigPath(), 'utf-8')
+    expect(runtimeConfig).toContain('[mcp_servers.runtime_only]')
+    expect(runtimeConfig).toContain('[mcp_servers.runtime_only.env]')
+    expect(runtimeConfig).toContain('MODE = "runtime"')
+    expect(runtimeConfig).toContain('command = "system-shared"')
+    expect(runtimeConfig).not.toContain('runtime-shared')
+    expect(runtimeConfig.match(/\[mcp_servers\.(?:shared|"shared")\]/g)).toHaveLength(1)
+    expect(runtimeConfig).toContain('[mcp_servers.system_only]')
+    expect(JSON.parse(readFileSync(getRuntimeBaselinePath(), 'utf-8'))).toMatchObject({
+      mcpServers: ['shared', 'system_only']
+    })
+  })
+
+  it('revokes a previously mirrored MCP server when the system source deletes it', () => {
+    mkdirSync(join(userDataDir, 'codex-runtime-home', 'home'), { recursive: true })
+    writeFileSync(getRuntimeConfigPath(), '[mcp_servers.revoked]\ncommand = "run"\n', 'utf-8')
+    writeFileSync(getSystemConfigPath(), '[mcp_servers.revoked]\ncommand = "run"\n', 'utf-8')
+
+    syncSystemConfigIntoManagedCodexHome()
+    writeFileSync(getSystemConfigPath(), 'model = "system"\n', 'utf-8')
+    syncSystemConfigIntoManagedCodexHome()
+
+    expect(readFileSync(getRuntimeConfigPath(), 'utf-8')).not.toContain('[mcp_servers.revoked]')
+  })
+
+  it('keeps runtime-only MCP additions after a source refresh and remains byte-idempotent', () => {
+    mkdirSync(join(userDataDir, 'codex-runtime-home', 'home'), { recursive: true })
+    writeFileSync(getRuntimeConfigPath(), '[mcp_servers.runtime_only]\ncommand = "run"\n', 'utf-8')
+    writeFileSync(getSystemConfigPath(), 'model = "system"\n', 'utf-8')
+
+    syncSystemConfigIntoManagedCodexHome()
+    const first = readFileSync(getRuntimeConfigPath(), 'utf-8')
+    syncSystemConfigIntoManagedCodexHome()
+
+    expect(readFileSync(getRuntimeConfigPath(), 'utf-8')).toBe(first)
+    expect(readFileSync(getRuntimeConfigPath(), 'utf-8')).toContain('[mcp_servers.runtime_only]')
+  })
+
+  it('keeps an explicit system MCP disable canonical', () => {
+    mkdirSync(join(userDataDir, 'codex-runtime-home', 'home'), { recursive: true })
+    writeFileSync(
+      getRuntimeConfigPath(),
+      '[mcp_servers.blocked]\ncommand = "runtime"\nenabled = true\n',
+      'utf-8'
+    )
+    writeFileSync(
+      getSystemConfigPath(),
+      '[mcp_servers."blocked"]\ncommand = "system"\nenabled = false\n',
+      'utf-8'
+    )
+
+    syncSystemConfigIntoManagedCodexHome()
+
+    const runtimeConfig = readFileSync(getRuntimeConfigPath(), 'utf-8')
+    expect(runtimeConfig).toContain('enabled = false')
+    expect(runtimeConfig).not.toContain('enabled = true')
+  })
+
   it('deduplicates basic and literal project headers by decoded Windows path', () => {
     mkdirSync(join(userDataDir, 'codex-runtime-home', 'home'), { recursive: true })
     writeFileSync(
diff --git a/src/main/codex/codex-config-mirror.ts b/src/main/codex/codex-config-mirror.ts
index af6f010da18..275e350328a 100644
--- a/src/main/codex/codex-config-mirror.ts
+++ b/src/main/codex/codex-config-mirror.ts
@@ -1,3 +1,4 @@
+import { readMcpServerTomlOwnership } from './config-toml-mcp-servers'
 import { dirname, join } from 'node:path'
 import { observeAgentStateFile } from './codex-path-observation'
 import {
@@ -21,6 +22,7 @@ import { preserveRuntimeConflictValues } from './codex-config-settings-preservat
 import { applyCodexDaemonSocketGuard } from './codex-daemon-socket-path-guard'
 import {
   deduplicateProjectTomlSections,
+  getMcpServerTomlSectionName,
   getProjectTrustLevel,
   getRevocationTomlSectionHeaderKey,
   getTomlSectionHeaderKey,
@@ -109,7 +111,9 @@ function mirrorSystemConfigIntoManagedCodexHome(homes: CodexSettingsPromotionHom
     ),
     // Why: this pass made the runtime's marketplace and plugin tables canonical,
     // so a later source config that lacks one is a removal, not an addition.
-    mirroredRegistrations: true
+    mirroredRegistrations: true,
+    mirroredMcpServers: mirrorResult.mirroredMcpServerNames,
+    mirroredMcpServerRoot: mirrorResult.mirroredMcpServerRoot
   })
   return true
 }
@@ -167,11 +171,14 @@ export function syncSystemConfigIntoLegacySharedCodexHome(
   let mirroredRuntimeConfig = runtimeConfigBeforeMirror ?? ''
   if (rawSystemConfig.trim() !== '') {
     const sourceConfigDir = resolveCodexConfigMirrorSourceDirectory(homes.systemHomePath)
+    // The retired home has no ownership baseline; its entire MCP root stays canonical.
     mirroredRuntimeConfig =
       runtimeConfigBeforeMirror !== null
         ? mergeSystemCodexConfigIntoRuntime(
             runtimeConfigBeforeMirror,
-            prepareSystemConfigForRuntimeMirror(rawSystemConfig, sourceConfigDir)
+            prepareSystemConfigForRuntimeMirror(rawSystemConfig, sourceConfigDir),
+            new Set(),
+            true
           )
         : prepareSystemConfigForFreshRuntimeMirror(rawSystemConfig, sourceConfigDir)
   }
@@ -191,7 +198,12 @@ export function syncSystemConfigIntoLegacySharedCodexHome(
 type CodexConfigMirrorResult =
   | { status: 'skipped-missing-source' }
   | { status: 'refused-indeterminate'; error: unknown }
-  | { status: 'mirrored'; preservedConflictKeys: ReadonlySet<string> }
+  | {
+      status: 'mirrored'
+      preservedConflictKeys: ReadonlySet<string>
+      mirroredMcpServerNames: ReadonlySet<string>
+      mirroredMcpServerRoot: boolean
+    }
 
 function syncSystemConfigIntoManagedCodexHomeUnsafe(
   { runtimeHomePath, systemHomePath, systemConfigDir }: CodexSettingsPromotionHomes,
@@ -225,34 +237,55 @@ function syncSystemConfigIntoManagedCodexHomeUnsafe(
     )
     return runtimeConfigExists
       ? { status: 'skipped-missing-source' }
-      : { status: 'mirrored', preservedConflictKeys: new Set() }
+      : {
+          status: 'mirrored',
+          preservedConflictKeys: new Set(),
+          mirroredMcpServerNames: new Set(),
+          mirroredMcpServerRoot: false
+        }
   }
 
   const sourceConfigDir = resolveCodexConfigMirrorSourceDirectory(systemHomePath, systemConfigDir)
   if (!runtimeConfigExists) {
-    writeFileAtomically(
-      runtimeConfigPath,
-      applyCodexDaemonSocketGuard(
-        prepareSystemConfigForFreshRuntimeMirror(rawSystemConfig, sourceConfigDir),
-        runtimeHomePath
-      )
+    const freshRuntimeConfig = applyCodexDaemonSocketGuard(
+      prepareSystemConfigForFreshRuntimeMirror(rawSystemConfig, sourceConfigDir),
+      runtimeHomePath
     )
-    return { status: 'mirrored', preservedConflictKeys: new Set() }
+    const ownership = readMcpServerTomlOwnership(freshRuntimeConfig)
+    writeFileAtomically(runtimeConfigPath, freshRuntimeConfig)
+    return {
+      status: 'mirrored',
+      preservedConflictKeys: new Set(),
+      mirroredMcpServerNames: ownership.names,
+      mirroredMcpServerRoot: ownership.ownsRoot
+    }
   }
 
   const systemConfig = prepareSystemConfigForRuntimeMirror(rawSystemConfig, sourceConfigDir)
+  const { names: mirroredMcpServerNames, ownsRoot: mirroredMcpServerRoot } =
+    readMcpServerTomlOwnership(systemConfig)
   // Why: reuse the bytes already observed above rather than re-reading. A second
   // read could succeed where the first failed and re-open the gap this closes.
   const runtimeConfig = runtimeConfigObservation.value
   const preserved = preserveRuntimeConflictValues(
-    mergeSystemCodexConfigIntoRuntime(runtimeConfig, systemConfig),
+    mergeSystemCodexConfigIntoRuntime(
+      runtimeConfig,
+      systemConfig,
+      promotionPlan.mirroredMcpServers,
+      promotionPlan.mirroredMcpServerRoot
+    ),
     promotionPlan.runtimeValuesToPreserve
   )
   const nextRuntimeConfig = applyCodexDaemonSocketGuard(preserved.content, runtimeHomePath)
   if (nextRuntimeConfig !== runtimeConfig) {
     writeFileAtomically(runtimeConfigPath, nextRuntimeConfig)
   }
-  return { status: 'mirrored', preservedConflictKeys: preserved.keys }
+  return {
+    status: 'mirrored',
+    preservedConflictKeys: preserved.keys,
+    mirroredMcpServerNames,
+    mirroredMcpServerRoot
+  }
 }
 
 export function resolveCodexConfigMirrorSourceDirectory(
@@ -284,7 +317,12 @@ export function prepareSystemConfigForFreshRuntimeMirror(
   return stripRuntimeOwnedTomlSections(prepareSystemConfigForRuntimeMirror(config, systemConfigDir))
 }
 
-function mergeSystemCodexConfigIntoRuntime(runtimeConfig: string, systemConfig: string): string {
+function mergeSystemCodexConfigIntoRuntime(
+  runtimeConfig: string,
+  systemConfig: string,
+  mirroredMcpServerNames: ReadonlySet<string> = new Set(),
+  mirroredMcpServerRoot = false
+): string {
   const runtimeSections = deduplicateProjectTomlSections(getTomlSections(runtimeConfig))
   const runtimeProjectHeaders = new Set(
     runtimeSections
@@ -307,6 +345,7 @@ function mergeSystemCodexConfigIntoRuntime(runtimeConfig: string, systemConfig:
       .filter((section) => getProjectTrustLevel(section.block) === 'trusted')
       .map((section) => getTomlSectionHeaderKey(section.header))
   )
+  const systemMcpServers = readMcpServerTomlOwnership(systemConfig)
   // Why: ordinary Codex settings should mirror ~/.codex exactly; runtime hook
   // trust and project trust are written under Orca's managed CODEX_HOME and
   // must survive the copy unless the user explicitly revoked project trust in
@@ -314,7 +353,19 @@ function mergeSystemCodexConfigIntoRuntime(runtimeConfig: string, systemConfig:
   return joinTomlBlocks([
     stripRuntimeOwnedTomlSections(systemConfig, runtimeProjectHeaders),
     ...runtimeSections
-      .filter((section) => isRuntimePreservedTomlSection(section.header))
+      .filter((section) => {
+        if (isRuntimePreservedTomlSection(section.header)) {
+          return true
+        }
+        const mcpServerName = getMcpServerTomlSectionName(section.header)
+        return (
+          mcpServerName !== null &&
+          !systemMcpServers.ownsRoot &&
+          !mirroredMcpServerRoot &&
+          !systemMcpServers.names.has(mcpServerName) &&
+          !mirroredMcpServerNames.has(mcpServerName)
+        )
+      })
       .filter(
         (section) =>
           !isRuntimeProjectTomlSection(section.header) ||
diff --git a/src/main/codex/codex-home-paths.ts b/src/main/codex/codex-home-paths.ts
index b265245f92d..c76aee5c1ea 100644
--- a/src/main/codex/codex-home-paths.ts
+++ b/src/main/codex/codex-home-paths.ts
@@ -47,6 +47,14 @@ export function getOrcaManagedCodexHomePath(): string {
   return managedHomePath
 }
 
+/** Config files an Orca-launched local Codex reads trust from, in the hook installer's lock order. */
+export function getLocalCodexTrustConfigFiles(): string[] {
+  return [
+    join(getOrcaManagedCodexHomePath(), 'config.toml'),
+    join(getSystemCodexHomePath(), 'config.toml')
+  ]
+}
+
 export function getCodexSessionBackfillStateDirPath(): string {
   return join(getOrcaUserDataPath(), 'codex-session-backfill')
 }
diff --git a/src/main/codex/codex-hook-legacy-cleanup.ts b/src/main/codex/codex-hook-legacy-cleanup.ts
index d2b5c3b586c..415aabf6155 100644
--- a/src/main/codex/codex-hook-legacy-cleanup.ts
+++ b/src/main/codex/codex-hook-legacy-cleanup.ts
@@ -8,6 +8,10 @@ import {
   writeHooksJson
 } from '../agent-hooks/installer-utils'
 import { resolveHooksJsonWritePath } from '../agent-hooks/hook-config-write-path'
+import {
+  isAgentStatusHooksEnabledForAgent,
+  type AgentStatusHooksSettings
+} from '../../shared/agent-status-hooks-setting'
 import { writeFileAtomically } from '../codex-accounts/fs-utils'
 import { findManagedTomlBlocks } from '../agent-hooks/managed-toml-ownership'
 import { writeConfigAtomically, type CodexTrustEntry } from './config-toml-trust'
@@ -42,6 +46,17 @@ export function setSystemCodexHomeHookSweepSuppressed(gate: () => boolean): void
   systemCodexHomeHookSweepSuppressed = gate
 }
 
+// Why per agent: Codex turned off must re-arm the sweep exactly like the global switch off,
+// or its remove() leaves Orca's entry in the real ~/.codex.
+export function shouldSuppressSystemCodexHomeHookSweep(args: {
+  isHostSystemDefaultRealHome: boolean
+  settings: AgentStatusHooksSettings
+}): boolean {
+  return (
+    args.isHostSystemDefaultRealHome && isAgentStatusHooksEnabledForAgent(args.settings, 'codex')
+  )
+}
+
 function getLegacyCodexProfileTomlPath(): string {
   return join(getSystemCodexHomePath(), `${LEGACY_ORCA_PROFILE_NAME}.config.toml`)
 }
diff --git a/src/main/codex/codex-hook-sweep-per-agent-opt-out.test.ts b/src/main/codex/codex-hook-sweep-per-agent-opt-out.test.ts
new file mode 100644
index 00000000000..780f0dbbf80
--- /dev/null
+++ b/src/main/codex/codex-hook-sweep-per-agent-opt-out.test.ts
@@ -0,0 +1,132 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import type * as Os from 'node:os'
+import { join } from 'node:path'
+import { wrapPosixHookCommand } from '../agent-hooks/installer-utils'
+import type { GlobalSettings } from '../../shared/global-settings-types'
+import { setupCodexHookHomes } from './hook-service-test-harness'
+
+const { getPathMock, homedirMock } = vi.hoisted(() => ({
+  getPathMock: vi.fn<(name: string) => string>(),
+  homedirMock: vi.fn<() => string>()
+}))
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: getPathMock
+  }
+}))
+
+vi.mock('os', async (importOriginal) => {
+  const actual = await importOriginal<typeof Os>()
+  return {
+    ...actual,
+    homedir: homedirMock
+  }
+})
+
+import { CodexHookService } from './hook-service'
+import {
+  setSystemCodexHomeHookSweepSuppressed,
+  shouldSuppressSystemCodexHomeHookSweep
+} from './codex-hook-legacy-cleanup'
+
+const homes = setupCodexHookHomes(homedirMock, getPathMock)
+
+type HookSettings = Pick<GlobalSettings, 'agentStatusHooksEnabled' | 'disabledTuiAgents'>
+
+const CODEX_OFF: HookSettings = { agentStatusHooksEnabled: true, disabledTuiAgents: ['codex'] }
+const ALL_ON: HookSettings = { agentStatusHooksEnabled: true, disabledTuiAgents: [] }
+const OTHER_OFF: HookSettings = { agentStatusHooksEnabled: true, disabledTuiAgents: ['claude'] }
+const GLOBAL_OFF: HookSettings = { agentStatusHooksEnabled: false, disabledTuiAgents: [] }
+
+function orcaEntryCommand(): string {
+  const scriptPath = join(
+    homes.userDataDir,
+    'agent-hooks',
+    process.platform === 'win32' ? 'codex-hook.cmd' : 'codex-hook.sh'
+  )
+  return process.platform === 'win32' ? scriptPath : wrapPosixHookCommand(scriptPath)
+}
+
+function seedRealHomeHooks(): string {
+  const systemCodexHome = join(homes.tmpHome, '.codex')
+  const systemHooksPath = join(systemCodexHome, 'hooks.json')
+  mkdirSync(systemCodexHome, { recursive: true })
+  writeFileSync(
+    systemHooksPath,
+    `${JSON.stringify({
+      hooks: {
+        Stop: [
+          { hooks: [{ type: 'command', command: 'user-hook' }] },
+          { hooks: [{ type: 'command', command: orcaEntryCommand() }] }
+        ]
+      }
+    })}\n`,
+    'utf-8'
+  )
+  return systemHooksPath
+}
+
+function realHomeStopHooks(systemHooksPath: string): unknown {
+  return JSON.parse(readFileSync(systemHooksPath, 'utf-8')).hooks.Stop
+}
+
+describe('system ~/.codex sweep gate', () => {
+  afterEach(() => {
+    setSystemCodexHomeHookSweepSuppressed(() => false)
+  })
+
+  it.each([
+    { label: 'Codex turned off', settings: CODEX_OFF, suppressed: false },
+    { label: 'the global switch off', settings: GLOBAL_OFF, suppressed: false },
+    { label: 'every agent on', settings: ALL_ON, suppressed: true },
+    { label: 'another agent turned off', settings: OTHER_OFF, suppressed: true }
+  ])('on the real-home lane with $label, suppressed=$suppressed', ({ settings, suppressed }) => {
+    expect(
+      shouldSuppressSystemCodexHomeHookSweep({ isHostSystemDefaultRealHome: true, settings })
+    ).toBe(suppressed)
+  })
+
+  it('never suppresses off the real-home lane', () => {
+    expect(
+      shouldSuppressSystemCodexHomeHookSweep({
+        isHostSystemDefaultRealHome: false,
+        settings: ALL_ON
+      })
+    ).toBe(false)
+  })
+
+  it('turning Codex off removes the Orca entry from the real ~/.codex and keeps user hooks', async () => {
+    const systemHooksPath = seedRealHomeHooks()
+    setSystemCodexHomeHookSweepSuppressed(() =>
+      shouldSuppressSystemCodexHomeHookSweep({
+        isHostSystemDefaultRealHome: true,
+        settings: CODEX_OFF
+      })
+    )
+
+    await new CodexHookService().remove()
+
+    expect(realHomeStopHooks(systemHooksPath)).toEqual([
+      { hooks: [{ type: 'command', command: 'user-hook' }] }
+    ])
+  })
+
+  it('leaves the real-home entry in place while Codex hooks are on', async () => {
+    const systemHooksPath = seedRealHomeHooks()
+    setSystemCodexHomeHookSweepSuppressed(() =>
+      shouldSuppressSystemCodexHomeHookSweep({
+        isHostSystemDefaultRealHome: true,
+        settings: ALL_ON
+      })
+    )
+
+    await new CodexHookService().remove()
+
+    expect(realHomeStopHooks(systemHooksPath)).toEqual([
+      { hooks: [{ type: 'command', command: 'user-hook' }] },
+      { hooks: [{ type: 'command', command: orcaEntryCommand() }] }
+    ])
+  })
+})
diff --git a/src/main/codex/codex-index-heal-binary-contract.test.ts b/src/main/codex/codex-index-heal-binary-contract.test.ts
index 5580fc02d1d..8954f618a6a 100644
--- a/src/main/codex/codex-index-heal-binary-contract.test.ts
+++ b/src/main/codex/codex-index-heal-binary-contract.test.ts
@@ -3,10 +3,12 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { promisify } from 'node:util'
+import { zstdCompressSync } from 'node:zlib'
 import { afterEach, beforeAll, describe, expect, it } from 'vitest'
+import { CODEX_SHORT_LIVED_PROBE_APP_SERVER_ARGS } from '../codex-cli/codex-read-only-app-server-args'
 import SyncDatabase from '../sqlite/sync-database'
 import { runCodexAppServerSession, type CodexAppServerRpc } from './codex-app-server-session'
-import { findNewestCodexStateDbPath } from './codex-state-db'
+import { findNewestCodexStateDbPath, readCodexStateDbBackfillStatus } from './codex-state-db'
 
 // Why this file exists: every other index-heal test drives a stub app-server and
 // asserts "healed" as "the `thread/read` call did not error". That pins Orca's half
@@ -17,7 +19,7 @@ import { findNewestCodexStateDbPath } from './codex-state-db'
 // real-binary backstop, built to the same shape as the Git binary compatibility
 // contract in src/shared/git-binary-compatibility.test.ts.
 //
-// Keep it narrow. It pins the four arms that ablation established Orca relies on,
+// Keep it narrow. It pins the arms that ablation established Orca relies on,
 // and deliberately asserts nothing else about the app-server, so an unrelated Codex
 // release does not redden it into being disabled.
 
@@ -83,11 +85,18 @@ describeCodexContract(
       mkdirSync(join(home, 'sessions'), { recursive: true })
       // An app-server session over an empty sessions tree is what stamps the backfill complete.
       await runAppServerSession(home, async () => undefined)
+      // Why: the account bridge links history only after this no-request session stamps it.
+      expect(readCodexStateDbBackfillStatus(home).kind).toBe('complete')
       expect(readThreadRows(home)).toEqual([])
       return home
     }
 
-    function writeRollout(home: string, threadId: string, stamp: string): void {
+    function writeRollout(
+      home: string,
+      threadId: string,
+      stamp: string,
+      options: { compressed?: boolean } = {}
+    ): void {
       const dayDir = join(home, 'sessions', '2026', '08', '29')
       mkdirSync(dayDir, { recursive: true })
       const meta = {
@@ -112,10 +121,13 @@ describeCodexContract(
         type: 'event_msg',
         payload: { type: 'user_message', message: 'index-heal contract fixture' }
       }
-      writeFileSync(
-        join(dayDir, `rollout-${stamp}-${threadId}.jsonl`),
-        `${JSON.stringify(meta)}\n${JSON.stringify(userMessage)}\n`
-      )
+      const contents = `${JSON.stringify(meta)}\n${JSON.stringify(userMessage)}\n`
+      const fileName = `rollout-${stamp}-${threadId}.jsonl`
+      if (options.compressed) {
+        writeFileSync(join(dayDir, `${fileName}.zst`), zstdCompressSync(contents))
+      } else {
+        writeFileSync(join(dayDir, fileName), contents)
+      }
     }
 
     // Why reuse runCodexAppServerSession rather than a local JSON-RPC client: it is the
@@ -128,7 +140,8 @@ describeCodexContract(
       return runCodexAppServerSession(
         {
           command: binary!,
-          args: ['app-server'],
+          // Why: the heal and account state-DB creation launch with these exact args.
+          args: [...CODEX_SHORT_LIVED_PROBE_APP_SERVER_ARGS],
           cliPath: binary!,
           env: { CODEX_HOME: home },
           timeoutMs: SESSION_TIMEOUT_MS
@@ -171,6 +184,19 @@ describeCodexContract(
       expect(readThreadRows(home)).toEqual([{ id: threadId, archived: 0 }])
     })
 
+    // Why: the account bridge links `.jsonl.zst` history and heals it with the same read.
+    it('indexes a compressed-only rollout on read', async () => {
+      const home = await createBackfilledCodexHome()
+      const threadId = '01a04f62-715e-7830-9371-50db585caa74'
+      writeRollout(home, threadId, '2026-08-29T17-00-00', { compressed: true })
+
+      await runAppServerSession(home, async (rpc) => {
+        await rpc.request('thread/read', { threadId })
+      })
+
+      expect(readThreadRows(home)).toEqual([{ id: threadId, archived: 0 }])
+    })
+
     it('leaves an already-indexed thread as a single row', async () => {
       const home = await createBackfilledCodexHome()
       const threadId = '01a04f62-715e-7830-9371-50db585caa72'
diff --git a/src/main/codex/codex-journal-command-turn.ts b/src/main/codex/codex-journal-command-turn.ts
new file mode 100644
index 00000000000..90e2f556b84
--- /dev/null
+++ b/src/main/codex/codex-journal-command-turn.ts
@@ -0,0 +1,165 @@
+// The conversation command a Codex child is running. Codex carries a command out as a turn of its
+// own; that turn writes no record, its rows join the command's turn, and its end is the command's.
+// Held by the child's translator, so it ends with the child and nothing has to release it.
+
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalTurnScope
+} from '../../shared/agent-session-journal-types'
+import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
+import { agentJournalTurnBody } from '../../shared/agent-session-turn-record'
+import { providerDiagnostic } from '../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../shared/agent-session-failure-words'
+import { TUI_AGENT_DISPLAY_NAMES } from '../../shared/tui-agent-display-names'
+import type { JournalLifecycleMutationInput } from '../native-chat/agent-session-journal/journal-row-builders'
+import type { StructuredAgentSessionCommandRun } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import { structuredCompactionOutcome } from '../native-chat/agent-session-wire/structured-conversation-command-outcome'
+import { readCodexJournalRecord } from './codex-structured-journal-translation-values'
+import { readCodexTurnId } from './codex-structured-thread-facts'
+
+type CarriedCommand = {
+  command: StructuredAgentSessionCommandRun
+  compacted: boolean
+  /** Codex's own error row already says why the command failed. */
+  failureShown: boolean
+}
+
+export class CodexJournalCommandTurn {
+  /** Sent, and not yet carried by a provider turn. */
+  private awaiting: StructuredAgentSessionCommandRun | null = null
+  private readonly carried = new Map<string, CarriedCommand>()
+
+  /** Before Orca sends the command: the next primary turn to start carries it out. */
+  begin(command: StructuredAgentSessionCommandRun): void {
+    this.awaiting = command
+  }
+
+  /** The command was never taken. */
+  forget(turnId: string): void {
+    if (this.awaiting?.turnId === turnId) {
+      this.awaiting = null
+    }
+  }
+
+  /** The command the primary turn `providerTurnId` carries out. Idempotent per provider turn, so a
+   *  refused frame's retry gets the same answer. */
+  claim(providerTurnId: string): StructuredAgentSessionCommandRun | null {
+    const carried = this.carried.get(providerTurnId)
+    if (carried || !this.awaiting) {
+      return carried?.command ?? null
+    }
+    const command = this.awaiting
+    this.awaiting = null
+    this.carried.set(providerTurnId, { command, compacted: false, failureShown: false })
+    return command
+  }
+
+  isCarrying(providerTurnId: string): boolean {
+    return this.carried.has(providerTurnId)
+  }
+
+  scopeFor(providerTurnId: string): AgentJournalTurnScope | null {
+    const carried = this.carried.get(providerTurnId)
+    return carried
+      ? { kind: 'turn', turnItemId: agentJournalItemKey(carried.command.identity) }
+      : null
+  }
+
+  /** The provider turn a Stop on `turnId` interrupts: none while the command has not started one. */
+  providerTurnId(turnId: string): string | undefined {
+    if (this.awaiting?.turnId === turnId) {
+      return undefined
+    }
+    for (const [providerTurnId, { command }] of this.carried) {
+      if (command.turnId === turnId) {
+        return providerTurnId
+      }
+    }
+    return turnId
+  }
+
+  /** Codex reported the compaction, in the turn carrying the command. */
+  compacted(providerTurnId: string): void {
+    const carried = this.carried.get(providerTurnId)
+    if (carried) {
+      carried.compacted = true
+    }
+  }
+
+  /** The command's end, for the batch that settles the provider turn carrying it. */
+  end(
+    providerTurnId: string,
+    ended: {
+      status: string | null
+      error: string | null
+      completedAt: number
+    }
+  ): JournalLifecycleMutationInput[] {
+    const carried = this.carried.get(providerTurnId)
+    if (!carried) {
+      return []
+    }
+    const { command } = carried
+    const detail = ended.error === null ? undefined : providerDiagnostic(ended.error, 'person')
+    const verdict = structuredCompactionOutcome({
+      compacted: carried.compacted,
+      // Codex reports the user's stop as the turn's own status.
+      interruptRequested: ended.status === 'interrupted',
+      // A turn that did not complete failed, not merely went unconfirmed.
+      failed: ended.status !== 'completed' || detail ? (detail ? { detail } : {}) : null
+    })
+    const turnScope = { kind: 'turn' as const, turnItemId: agentJournalItemKey(command.identity) }
+    return [
+      // A success already drew Codex's own compaction marker inside the command's turn.
+      ...(verdict.failure && !carried.failureShown
+        ? [
+            {
+              kind: 'item' as const,
+              identity: command.resultIdentity,
+              body: {
+                kind: 'status' as const,
+                ...agentSessionFailureWords(verdict.failure, {
+                  surface: 'row',
+                  agentName: TUI_AGENT_DISPLAY_NAMES.codex
+                }),
+                tone: 'error' as const
+              },
+              turnScope
+            }
+          ]
+        : []),
+      {
+        kind: 'item',
+        identity: command.identity,
+        body: agentJournalTurnBody({
+          ...command.running,
+          providerTurnId,
+          state: verdict.outcome === 'cancellation' ? 'interrupted' : 'completed',
+          outcome: verdict.outcome,
+          completedAt: ended.completedAt
+        }),
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      }
+    ]
+  }
+
+  /** Codex's `error` frame, already a row in the turn it names. A turn-ending one says why the
+   *  command failed, so the failed completion that follows it adds no second row. */
+  errorShown(params: unknown): void {
+    const providerTurnId = readCodexTurnId(params)
+    const carried = providerTurnId ? this.carried.get(providerTurnId) : undefined
+    // A stream error Codex is about to retry ends nothing.
+    if (carried && readCodexJournalRecord(params).willRetry !== true) {
+      carried.failureShown = true
+    }
+  }
+
+  settled(providerTurnId: string): void {
+    this.carried.delete(providerTurnId)
+  }
+
+  clear(): void {
+    this.awaiting = null
+    this.carried.clear()
+  }
+}
diff --git a/src/main/codex/codex-journal-turn-scopes.ts b/src/main/codex/codex-journal-turn-scopes.ts
new file mode 100644
index 00000000000..eb49f243bf4
--- /dev/null
+++ b/src/main/codex/codex-journal-turn-scopes.ts
@@ -0,0 +1,45 @@
+// Which turn a Codex row belongs to, stated when the row is written.
+//
+// A primary-thread row belongs to the turn it names: that turn's lifecycle record, or the
+// conversation command that claimed it. A child thread has turns of its own that the timeline
+// does not draw, so its rows belong to the primary turn running when they arrive — the work the
+// user is watching — or to no turn once the primary is idle.
+
+import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalTurnScope
+} from '../../shared/agent-session-journal-types'
+import { codexTurnLifecycleIdentity } from './codex-structured-journal-translation-turns'
+
+export class CodexJournalTurnScopes {
+  constructor(
+    private readonly deps: {
+      /** Without it no turn record is keyed, so every row reads as the thread's. */
+      sessionId: string | undefined
+      primaryThreadId: () => string | null
+      activeTurn: (threadId: string) => string | null
+      /** The command turn's scope, for a primary turn carrying a conversation command. */
+      commandScope: (turnId: string) => AgentJournalTurnScope | null
+    }
+  ) {}
+
+  scopeFor(threadId: string, turnId: string | null): AgentJournalTurnScope {
+    const primary = this.deps.primaryThreadId()
+    const primaryTurnId =
+      primary === null ? null : threadId === primary ? turnId : this.deps.activeTurn(primary)
+    if (primaryTurnId === null) {
+      return AGENT_JOURNAL_THREAD_SCOPE
+    }
+    const { sessionId } = this.deps
+    return (
+      this.deps.commandScope(primaryTurnId) ??
+      (sessionId === undefined
+        ? AGENT_JOURNAL_THREAD_SCOPE
+        : {
+            kind: 'turn',
+            turnItemId: agentJournalItemKey(codexTurnLifecycleIdentity(sessionId, primaryTurnId))
+          })
+    )
+  }
+}
diff --git a/src/main/codex/codex-persistent-command-retention.test.ts b/src/main/codex/codex-persistent-command-retention.test.ts
index 498d5b186ef..fa6aef48ae9 100644
--- a/src/main/codex/codex-persistent-command-retention.test.ts
+++ b/src/main/codex/codex-persistent-command-retention.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../shared/agent-session-journal-types'
 import { describe, expect, it, vi } from 'vitest'
 import type { AgentJournalItemBody } from '../../shared/agent-session-journal-types'
 import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
@@ -45,7 +46,7 @@ function fixture(maxMetadataBytes?: number) {
     {
       sink,
       maxMetadataBytes,
-      linkageFor: () => ({}),
+      attributionFor: () => ({ turnScope: AGENT_JOURNAL_THREAD_SCOPE }),
       schedule: (run) => {
         scheduled.add(run)
         return () => {
@@ -71,14 +72,15 @@ describe('persistent command retention', () => {
     items.streams.flush()
     const originalJoin = Array.prototype.join
     let retainedJoins = 0
-    const spy = vi
-      .spyOn(Array.prototype, 'join')
-      .mockImplementation(function (this: unknown[], separator) {
-        if (this[0] === 'retained-prefix') {
-          retainedJoins += 1
-        }
-        return originalJoin.call(this, separator)
-      })
+    const spy = vi.spyOn(Array.prototype, 'join').mockImplementation(function (
+      this: unknown[],
+      separator
+    ) {
+      if (this[0] === 'retained-prefix') {
+        retainedJoins += 1
+      }
+      return originalJoin.call(this, separator)
+    })
     try {
       for (let index = 0; index < 100; index += 1) {
         items.streams.flush()
@@ -118,7 +120,7 @@ describe('persistent command retention', () => {
           sink,
           streams: items.streams,
           activeItems: items.activeItems,
-          linkageFor: () => ({})
+          attributionFor: () => ({ turnScope: AGENT_JOURNAL_THREAD_SCOPE })
         })
       ).toEqual({ accepted: true })
     }
@@ -214,7 +216,7 @@ describe('persistent command retention', () => {
         sink,
         streams: items.streams,
         activeItems: items.activeItems,
-        linkageFor: () => ({})
+        attributionFor: () => ({ turnScope: AGENT_JOURNAL_THREAD_SCOPE })
       })
     ).toEqual({ accepted: true })
     expect(items.activeItems.size).toBe(1)
diff --git a/src/main/codex/codex-prompt-registry-retention.test.ts b/src/main/codex/codex-prompt-registry-retention.test.ts
index 78e10cbcc77..4757d731dcf 100644
--- a/src/main/codex/codex-prompt-registry-retention.test.ts
+++ b/src/main/codex/codex-prompt-registry-retention.test.ts
@@ -108,3 +108,22 @@ describe('Codex prompt claim lifetime', () => {
     expect(prompt.deref()).toBeUndefined()
   })
 })
+
+describe('Codex abandoned command approvals', () => {
+  it("reports only a command's own approval that its turn ended unanswered, once", () => {
+    const registry = new CodexPromptRegistry()
+    const ask = (id: number, method: string, params: Record<string, string>) =>
+      registry.register({ id, method, params: { threadId: 'thread', turnId: 'turn', ...params } })
+    ask(1, 'item/commandExecution/requestApproval', { itemId: 'unanswered' })
+    const answered = ask(2, 'item/commandExecution/requestApproval', { itemId: 'answered' })
+    ask(3, 'item/commandExecution/requestApproval', { itemId: 'parent', approvalId: 'sub' })
+    ask(4, 'item/fileChange/requestApproval', { itemId: 'patch' })
+    if (!answered) {
+      throw new Error('Fixture prompt was refused')
+    }
+    registry.forget(answered)
+    registry.clearTurn('thread', 'turn')
+    expect(registry.takeAbandonedCommands()).toEqual([{ threadId: 'thread', itemId: 'unanswered' }])
+    expect(registry.takeAbandonedCommands()).toEqual([])
+  })
+})
diff --git a/src/main/codex/codex-prompt-registry.ts b/src/main/codex/codex-prompt-registry.ts
index 059f8a7a0d3..eda1fa0bf30 100644
--- a/src/main/codex/codex-prompt-registry.ts
+++ b/src/main/codex/codex-prompt-registry.ts
@@ -31,6 +31,9 @@ export type CodexPendingPrompt = {
   answers: Map<string, string>
 }
 
+export type CodexAbandonedCommand = { threadId: string; itemId: string }
+const NO_ABANDONED_COMMANDS: readonly CodexAbandonedCommand[] = []
+
 export type CodexPromptClaim = {
   readonly itemId: string
   readonly prompt: CodexPendingPrompt
@@ -54,6 +57,7 @@ export class CodexPromptRegistry {
   private readonly journalItemIds = new Map<string, string>()
   private readonly boundPrompts = new Map<string, CodexPendingPrompt>()
   private readonly claims = new Map<CodexPendingPrompt, CodexPromptClaim>()
+  private abandonedCommands: CodexAbandonedCommand[] = []
 
   get sizes(): { prompts: number; journalBindings: number } {
     return { prompts: this.byAddress.size, journalBindings: this.journalItemIds.size }
@@ -232,14 +236,33 @@ export class CodexPromptRegistry {
     )
     for (const prompt of prompts) {
       this.forget(prompt)
+      // Codex abandons a turn's unanswered prompts: a command still awaiting approval never ran.
+      // An `approvalId` asks for a subcommand, not the item's own command.
+      if (
+        prompt.method === CODEX_COMMAND_APPROVAL_METHOD &&
+        prompt.promptKey === prompt.codexItemId
+      ) {
+        this.abandonedCommands.push({ threadId: prompt.threadId, itemId: prompt.codexItemId })
+      }
     }
   }
 
+  /** The commands whose approval a turn ended without, since the last call. */
+  takeAbandonedCommands(): readonly CodexAbandonedCommand[] {
+    if (this.abandonedCommands.length === 0) {
+      return NO_ABANDONED_COMMANDS
+    }
+    const taken = this.abandonedCommands
+    this.abandonedCommands = []
+    return taken
+  }
+
   clear(): void {
     this.byAddress.clear()
     this.journalItemIds.clear()
     this.boundPrompts.clear()
     this.claims.clear()
+    this.abandonedCommands = []
   }
 
   private address(threadId: string, promptKey: string): string {
diff --git a/src/main/codex/codex-requested-close-turn-timing.test.ts b/src/main/codex/codex-requested-close-turn-timing.test.ts
index fbf50badaef..a7baf6a14b5 100644
--- a/src/main/codex/codex-requested-close-turn-timing.test.ts
+++ b/src/main/codex/codex-requested-close-turn-timing.test.ts
@@ -1,4 +1,5 @@
 import { createCodexDispatchEchoes } from './codex-structured-dispatch-echo'
+import { createCodexTurnOpenWaits } from './codex-structured-turn-open-wait'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { AgentJournalItemBody } from '../../shared/agent-session-journal-types'
 import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
@@ -72,6 +73,7 @@ describe('requested-close durable turn timing', () => {
         reportedOptions: {},
         fastModeTierByModel: new Map(),
         dispatchEchoes: createCodexDispatchEchoes(),
+        turnOpenWaits: createCodexTurnOpenWaits(),
         translator
       }
       const sessions = new Map([['session-1', session]])
diff --git a/src/main/codex/codex-server-request-disposition.test.ts b/src/main/codex/codex-server-request-disposition.test.ts
index 371927513bc..ec3a193af6c 100644
--- a/src/main/codex/codex-server-request-disposition.test.ts
+++ b/src/main/codex/codex-server-request-disposition.test.ts
@@ -2,7 +2,6 @@ import { describe, expect, it, vi } from 'vitest'
 import {
   CODEX_ATTESTATION_METHOD,
   CODEX_AUTH_TOKEN_REFRESH_METHOD,
-  CODEX_BLOCKING_SERVER_REQUEST_METHODS,
   CODEX_DYNAMIC_TOOL_CALL_METHOD,
   CODEX_LEGACY_APPLY_PATCH_APPROVAL_METHOD,
   CODEX_LEGACY_EXEC_APPROVAL_METHOD,
@@ -95,23 +94,6 @@ describe('Codex blocking server request dispositions', () => {
     )
   })
 
-  it('enumerates every server request in the negotiated stable schema', () => {
-    expect(new Set(CODEX_BLOCKING_SERVER_REQUEST_METHODS)).toEqual(
-      new Set([
-        CODEX_COMMAND_APPROVAL_METHOD,
-        CODEX_FILE_CHANGE_APPROVAL_METHOD,
-        CODEX_USER_INPUT_METHOD,
-        CODEX_MCP_ELICITATION_METHOD,
-        CODEX_PERMISSIONS_APPROVAL_METHOD,
-        CODEX_DYNAMIC_TOOL_CALL_METHOD,
-        CODEX_AUTH_TOKEN_REFRESH_METHOD,
-        CODEX_ATTESTATION_METHOD,
-        CODEX_LEGACY_APPLY_PATCH_APPROVAL_METHOD,
-        CODEX_LEGACY_EXEC_APPROVAL_METHOD
-      ])
-    )
-  })
-
   it('bounds the future-method fallback to one explicit rejection', () => {
     const { registry, connection } = harness()
 
diff --git a/src/main/codex/codex-server-request-disposition.ts b/src/main/codex/codex-server-request-disposition.ts
index 4e358da86b1..438bbfcc92b 100644
--- a/src/main/codex/codex-server-request-disposition.ts
+++ b/src/main/codex/codex-server-request-disposition.ts
@@ -18,19 +18,6 @@ export const CODEX_ATTESTATION_METHOD = 'attestation/generate'
 export const CODEX_LEGACY_APPLY_PATCH_APPROVAL_METHOD = 'applyPatchApproval'
 export const CODEX_LEGACY_EXEC_APPROVAL_METHOD = 'execCommandApproval'
 
-export const CODEX_BLOCKING_SERVER_REQUEST_METHODS = [
-  CODEX_COMMAND_APPROVAL_METHOD,
-  CODEX_FILE_CHANGE_APPROVAL_METHOD,
-  CODEX_USER_INPUT_METHOD,
-  CODEX_MCP_ELICITATION_METHOD,
-  CODEX_PERMISSIONS_APPROVAL_METHOD,
-  CODEX_DYNAMIC_TOOL_CALL_METHOD,
-  CODEX_AUTH_TOKEN_REFRESH_METHOD,
-  CODEX_ATTESTATION_METHOD,
-  CODEX_LEGACY_APPLY_PATCH_APPROVAL_METHOD,
-  CODEX_LEGACY_EXEC_APPROVAL_METHOD
-] as const
-
 export type CodexServerRequestDisposition =
   | { kind: 'prompt'; prompt: CodexPendingPrompt }
   | { kind: 'responded'; method: string }
diff --git a/src/main/codex/codex-session-index-heal-state.ts b/src/main/codex/codex-session-index-heal-state.ts
index 0a5fd0499c1..ab62b77669d 100644
--- a/src/main/codex/codex-session-index-heal-state.ts
+++ b/src/main/codex/codex-session-index-heal-state.ts
@@ -22,7 +22,7 @@ const HEAL_UNSUPPORTED_RETRY_INTERVAL_MS = 24 * 60 * 60 * 1000
 const HEAL_FAILED_THREAD_RETRY_INTERVAL_MS = 24 * 60 * 60 * 1000
 
 const CODEX_ROLLOUT_THREAD_ID_PATTERN =
-  /^rollout-(.+)-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$/i
+  /^rollout-(.+)-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl(?:\.zst)?$/i
 
 export type CodexSessionIndexHealPaths = {
   auditLogPath: string
@@ -70,11 +70,11 @@ export async function collectPendingHealThreads(
     if (!isPathInsideOrEqual(paths.systemSessionsRoot, line.target)) {
       continue
     }
-    const match = CODEX_ROLLOUT_THREAD_ID_PATTERN.exec(lastPathSegment(line.target))
-    if (!match) {
+    const rollout = parseCodexRolloutThreadId(line.target)
+    if (!rollout) {
       continue
     }
-    const threadId = match[2].toLowerCase()
+    const { threadId } = rollout
     const auditRecordId = typeof line.recordId === 'string' ? line.recordId : null
     if (
       auditRecordId
@@ -88,13 +88,21 @@ export async function collectPendingHealThreads(
       pendingByThreadId.delete(threadId)
       continue
     }
-    pendingByThreadId.set(threadId, { threadId, rolloutStamp: match[1], auditRecordId })
+    pendingByThreadId.set(threadId, { threadId, rolloutStamp: rollout.rolloutStamp, auditRecordId })
   }
   return [...pendingByThreadId.values()].sort((left, right) =>
     left.rolloutStamp < right.rolloutStamp ? 1 : left.rolloutStamp > right.rolloutStamp ? -1 : 0
   )
 }
 
+/** Thread id (lower-cased) and timestamp segment encoded in a rollout file name. */
+export function parseCodexRolloutThreadId(
+  filePath: string
+): { threadId: string; rolloutStamp: string } | null {
+  const match = CODEX_ROLLOUT_THREAD_ID_PATTERN.exec(lastPathSegment(filePath))
+  return match ? { threadId: match[2].toLowerCase(), rolloutStamp: match[1] } : null
+}
+
 function lastPathSegment(filePath: string): string {
   return filePath.split(/[\\/]/).at(-1) ?? ''
 }
diff --git a/src/main/codex/codex-session-index-heal.test.ts b/src/main/codex/codex-session-index-heal.test.ts
index 20051fe1058..1be3d047207 100644
--- a/src/main/codex/codex-session-index-heal.test.ts
+++ b/src/main/codex/codex-session-index-heal.test.ts
@@ -10,10 +10,12 @@ import {
 } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
+import { CODEX_SHORT_LIVED_PROBE_APP_SERVER_ARGS } from '../codex-cli/codex-read-only-app-server-args'
 import type { CodexAppServerInvocation } from './codex-app-server-session'
 import { createCodexSessionBackfillAuditWriter } from './codex-session-backfill-audit'
 import { CODEX_SESSION_INDEX_HEAL_VERSION } from './codex-session-index-heal-state'
 import {
+  buildNativeHealInvocation,
   runCodexSessionIndexHeal,
   type CodexSessionIndexHealPaths
 } from './codex-session-index-heal'
@@ -340,6 +342,7 @@ describe('runCodexSessionIndexHeal', () => {
     const marker = JSON.parse(readFileSync(rig.paths.healMarkerPath, 'utf-8')) as {
       retryableFailureAt: number
     }
+    expect(marker.retryableFailureAt).toEqual(expect.any(Number))
     marker.retryableFailureAt = 0
     writeFileSync(rig.paths.healMarkerPath, `${JSON.stringify(marker)}\n`, 'utf-8')
     const retried = await runCodexSessionIndexHeal(rig.paths, {
@@ -490,6 +493,25 @@ describe('runCodexSessionIndexHeal', () => {
     expect(resumed.healedThreads + summary.healedThreads).toBe(4)
   })
 
+  it('writes no completion marker when stop flips inside the last batch', async () => {
+    const rig = createHealRig({
+      auditedThreads: [
+        { stamp: '2026-07-02T10-00-00', id: threadId('2') },
+        { stamp: '2026-07-01T10-00-00', id: threadId('1') }
+      ]
+    })
+
+    const summary = await runCodexSessionIndexHeal(rig.paths, {
+      buildInvocation: rig.buildInvocation,
+      readConcurrency: 1,
+      interBatchDelayMs: 0,
+      shouldStop: () => rig.readLog().threadIds.length > 0
+    })
+
+    expect(summary).toMatchObject({ outcome: 'stopped', healedThreads: 1 })
+    expect(existsSync(rig.paths.healMarkerPath)).toBe(false)
+  })
+
   it('does not spawn another server when stop flips during the inter-batch delay', async () => {
     const rig = createHealRig({
       auditedThreads: [
@@ -777,3 +799,14 @@ describe('runCodexSessionIndexHeal', () => {
     warnSpy.mockRestore()
   })
 })
+
+describe('buildNativeHealInvocation', () => {
+  it('starts a read-only, plugin-free app-server pinned to the given home', () => {
+    const invocation = buildNativeHealInvocation('/codex-home', 1_000)
+
+    for (const arg of CODEX_SHORT_LIVED_PROBE_APP_SERVER_ARGS) {
+      expect(invocation.args).toContain(arg)
+    }
+    expect(invocation.env).toEqual({ CODEX_HOME: '/codex-home' })
+  })
+})
diff --git a/src/main/codex/codex-session-index-heal.ts b/src/main/codex/codex-session-index-heal.ts
index 12747312646..364263f2f47 100644
--- a/src/main/codex/codex-session-index-heal.ts
+++ b/src/main/codex/codex-session-index-heal.ts
@@ -1,6 +1,7 @@
 import { dirname, join } from 'node:path'
 import { resolveCodexCommand } from '../codex-cli/command'
 import { isTransientSqliteContention } from '../sqlite/sqlite-read-failure'
+import { CODEX_SHORT_LIVED_PROBE_APP_SERVER_ARGS } from '../codex-cli/codex-read-only-app-server-args'
 import { getSpawnArgsForWindows } from '../win32-utils'
 import { getCodexSessionBackfillStateDirPath } from './codex-home-paths'
 import { resolveCodexSessionBackfillPaths } from './codex-session-backfill'
@@ -17,7 +18,8 @@ import {
 import {
   isCodexAppServerUnsupportedError,
   runCodexAppServerSession,
-  type CodexAppServerInvocation
+  type CodexAppServerInvocation,
+  type CodexAppServerRpc
 } from './codex-app-server-session'
 
 export type { CodexSessionIndexHealPaths } from './codex-session-index-heal-state'
@@ -49,12 +51,20 @@ export type CodexSessionIndexHealSummary = {
 export type CodexSessionIndexHealOptions = {
   /** Polled between reads and batches; true stops promptly, progress is kept. */
   shouldStop?: () => boolean
-  buildInvocation?: (systemCodexHomePath: string, timeoutMs: number) => CodexAppServerInvocation
+  buildInvocation?: (codexHomePath: string, timeoutMs: number) => CodexAppServerInvocation
+  runSession?: (
+    invocation: CodexAppServerInvocation,
+    body: (rpc: CodexAppServerRpc) => Promise<void>
+  ) => Promise<void>
   readsPerServerSession?: number
   readConcurrency?: number
   interBatchDelayMs?: number
 }
 
+export type CodexThreadReadOutcome = HealLedgerOutcome
+
+export type CodexThreadReadPassOutcome = 'completed' | 'stopped' | 'unsupported' | 'aborted'
+
 let backgroundHealTask: Promise<CodexSessionIndexHealSummary | null> | null = null
 
 export function resolveCodexSessionIndexHealPaths(
@@ -132,69 +142,30 @@ export async function runCodexSessionIndexHeal(
     return summary
   }
 
-  const systemCodexHomePath = dirname(paths.systemSessionsRoot)
-  const buildInvocation = options.buildInvocation ?? buildNativeHealInvocation
-  const readsPerServerSession = resolveHealWorkLimit(
-    options.readsPerServerSession,
-    HEAL_READS_PER_SERVER_SESSION
-  )
-  const readConcurrency = resolveHealWorkLimit(options.readConcurrency, HEAL_READ_CONCURRENCY)
-  const interBatchDelayMs = options.interBatchDelayMs ?? HEAL_INTER_BATCH_DELAY_MS
   const shouldStop = options.shouldStop ?? ((): boolean => false)
-
-  for (let offset = 0; offset < pending.length; offset += readsPerServerSession) {
-    if (shouldStop()) {
-      summary.outcome = 'stopped'
-      return summary
-    }
-    if (offset > 0 && interBatchDelayMs > 0) {
-      await new Promise((resolve) => setTimeout(resolve, interBatchDelayMs))
-      if (shouldStop()) {
-        // Why: opt-out can happen during the throttle delay; do not spawn a
-        // real-home app-server after the lane has been disabled.
-        summary.outcome = 'stopped'
-        return summary
+  const outcome = await readCodexThreadsForIndexHeal(
+    dirname(paths.systemSessionsRoot),
+    pending,
+    (thread, readOutcome) => {
+      if (readOutcome === 'healed') {
+        summary.healedThreads += 1
+      } else if (readOutcome === 'missing') {
+        // The backfilled rollout was deleted after the audit was written.
+        summary.missingThreads += 1
+      } else {
+        summary.failedThreads += 1
       }
-    }
-    const batch = pending.slice(offset, offset + readsPerServerSession)
-    const timeoutMs = HEAL_BATCH_TIMEOUT_BASE_MS + HEAL_BATCH_TIMEOUT_PER_READ_MS * batch.length
-    try {
-      await runCodexAppServerSession(
-        buildInvocation(systemCodexHomePath, timeoutMs),
-        async (rpc) => {
-          let nextIndex = 0
-          const worker = async (): Promise<void> => {
-            while (nextIndex < batch.length && !shouldStop()) {
-              const thread = batch[nextIndex]
-              nextIndex += 1
-              await healOneThread(rpc, thread, paths, summary)
-            }
-          }
-          await Promise.all(Array.from({ length: readConcurrency }, () => worker()))
-        }
-      )
-    } catch (error) {
-      if (isCodexAppServerUnsupportedError(error)) {
-        if (shouldStop()) {
-          summary.outcome = 'stopped'
-          return summary
-        }
-        // Why: no retry churn on old CLIs — remember unsupported and re-probe
-        // after the retry interval or a version bump; nothing is marked healed.
-        writeHealMarker(paths, auditBytes, summary, { unsupportedAt: Date.now() })
-        summary.outcome = 'unsupported'
-        return summary
-      }
-      // Transport failure (timeout, early exit, spawn error): unprocessed ids
-      // were never appended to the ledger, so the next pass resumes them.
-      console.warn('[codex-session-index-heal] Heal batch aborted:', error)
-      summary.outcome = 'aborted'
-      return summary
-    }
+      recordHealOutcome(paths, thread, readOutcome)
+    },
+    options
+  )
+  if (outcome === 'unsupported') {
+    // Why: no retry churn on old CLIs — remember unsupported and re-probe
+    // after the retry interval or a version bump; nothing is marked healed.
+    writeHealMarker(paths, auditBytes, summary, { unsupportedAt: Date.now() })
   }
-
-  if (shouldStop()) {
-    summary.outcome = 'stopped'
+  if (outcome !== 'completed' || shouldStop()) {
+    summary.outcome = outcome === 'completed' ? 'stopped' : outcome
     return summary
   }
   writeHealMarker(
@@ -206,16 +177,76 @@ export async function runCodexSessionIndexHeal(
   return summary
 }
 
-async function healOneThread(
-  rpc: { request: (method: string, params?: Record<string, unknown>) => Promise<unknown> },
-  thread: PendingHealThread,
-  paths: CodexSessionIndexHealPaths,
-  summary: CodexSessionIndexHealSummary
-): Promise<void> {
+/**
+ * Drives `thread/read` over `threads` in bounded app-server batches, reporting
+ * each settled read. Transport failures and sqlite contention abort the pass
+ * without reporting, so the caller's next pass retries those threads.
+ */
+export async function readCodexThreadsForIndexHeal<T extends { threadId: string }>(
+  codexHomePath: string,
+  threads: readonly T[],
+  onOutcome: (thread: T, outcome: CodexThreadReadOutcome) => void,
+  options: CodexSessionIndexHealOptions = {}
+): Promise<CodexThreadReadPassOutcome> {
+  const buildInvocation = options.buildInvocation ?? buildNativeHealInvocation
+  const runSession = options.runSession ?? runCodexAppServerSession
+  const readsPerServerSession = resolveHealWorkLimit(
+    options.readsPerServerSession,
+    HEAL_READS_PER_SERVER_SESSION
+  )
+  const readConcurrency = resolveHealWorkLimit(options.readConcurrency, HEAL_READ_CONCURRENCY)
+  const interBatchDelayMs = options.interBatchDelayMs ?? HEAL_INTER_BATCH_DELAY_MS
+  const shouldStop = options.shouldStop ?? ((): boolean => false)
+
+  for (let offset = 0; offset < threads.length; offset += readsPerServerSession) {
+    if (shouldStop()) {
+      return 'stopped'
+    }
+    if (offset > 0 && interBatchDelayMs > 0) {
+      await new Promise((resolve) => setTimeout(resolve, interBatchDelayMs))
+      if (shouldStop()) {
+        // Why: opt-out can happen during the throttle delay; do not spawn an
+        // app-server after the lane has been disabled.
+        return 'stopped'
+      }
+    }
+    const batch = threads.slice(offset, offset + readsPerServerSession)
+    const timeoutMs = HEAL_BATCH_TIMEOUT_BASE_MS + HEAL_BATCH_TIMEOUT_PER_READ_MS * batch.length
+    try {
+      await runSession(buildInvocation(codexHomePath, timeoutMs), async (rpc) => {
+        let nextIndex = 0
+        const worker = async (): Promise<void> => {
+          while (nextIndex < batch.length && !shouldStop()) {
+            const thread = batch[nextIndex]
+            nextIndex += 1
+            onOutcome(thread, await readOneThread(rpc, thread.threadId))
+          }
+        }
+        await Promise.all(Array.from({ length: readConcurrency }, () => worker()))
+      })
+    } catch (error) {
+      if (shouldStop()) {
+        return 'stopped'
+      }
+      if (isCodexAppServerUnsupportedError(error)) {
+        return 'unsupported'
+      }
+      // Transport failure (timeout, early exit, spawn error): unprocessed ids
+      // were never reported, so the next pass resumes them.
+      console.warn('[codex-session-index-heal] Heal batch aborted:', error)
+      return 'aborted'
+    }
+  }
+  return 'completed'
+}
+
+async function readOneThread(
+  rpc: CodexAppServerRpc,
+  threadId: string
+): Promise<CodexThreadReadOutcome> {
   try {
-    await rpc.request('thread/read', { threadId: thread.threadId })
-    summary.healedThreads += 1
-    recordHealOutcome(paths, thread, 'healed')
+    await rpc.request('thread/read', { threadId })
+    return 'healed'
   } catch (error) {
     if (isCodexAppServerUnsupportedError(error)) {
       throw error
@@ -223,22 +254,18 @@ async function healOneThread(
     const message = error instanceof Error ? error.message : String(error)
     if (!message.startsWith('codex app-server thread/read failed')) {
       // Not an RPC-level response: the server died or timed out. Abort the
-      // batch without recording, so the id is retried on the next pass.
+      // batch without reporting, so the id is retried on the next pass.
       throw error
     }
     if (/no rollout found/i.test(message)) {
-      // The backfilled rollout was deleted after the audit was written.
-      summary.missingThreads += 1
-      recordHealOutcome(paths, thread, 'missing')
-      return
+      return 'missing'
     }
     if (isTransientSqliteContention(message)) {
-      // Why: an active Codex process can briefly own sqlite; leave the id off
-      // the ledger and abort this pass so a later startup resumes it.
+      // Why: an active Codex process can briefly own sqlite; leave the id
+      // unreported and abort this pass so a later startup resumes it.
       throw error
     }
-    summary.failedThreads += 1
-    recordHealOutcome(paths, thread, 'failed')
+    return 'failed'
   }
 }
 
@@ -259,20 +286,23 @@ function resolveHealWorkLimit(value: number | undefined, maximum: number): numbe
   return Math.min(Math.floor(value), maximum)
 }
 
-function buildNativeHealInvocation(
-  systemCodexHomePath: string,
+export function buildNativeHealInvocation(
+  codexHomePath: string,
   timeoutMs: number
 ): CodexAppServerInvocation {
   const command = resolveCodexCommand()
-  const { spawnCmd, spawnArgs } = getSpawnArgsForWindows(command, ['app-server'])
+  // Why: each session is torn down after one batch, so plugin startup could
+  // leave marketplace clones running; indexing needs neither plugins nor tools.
+  const { spawnCmd, spawnArgs } = getSpawnArgsForWindows(command, [
+    ...CODEX_SHORT_LIVED_PROBE_APP_SERVER_ARGS
+  ])
   return {
     command: spawnCmd,
     args: spawnArgs,
     cliPath: command,
-    // Why: pin the real home explicitly — nested Orca launches can inherit a
-    // managed CODEX_HOME from the daemon environment, which would index the
-    // wrong sqlite DB.
-    env: { CODEX_HOME: systemCodexHomePath },
+    // Why: pin the home explicitly — nested Orca launches can inherit a managed
+    // CODEX_HOME from the daemon environment, which would index the wrong sqlite DB.
+    env: { CODEX_HOME: codexHomePath },
     timeoutMs
   }
 }
diff --git a/src/main/codex/codex-state-db-test-fixture.ts b/src/main/codex/codex-state-db-test-fixture.ts
new file mode 100644
index 00000000000..e84f0328c3b
--- /dev/null
+++ b/src/main/codex/codex-state-db-test-fixture.ts
@@ -0,0 +1,14 @@
+import { mkdirSync } from 'node:fs'
+import { join } from 'node:path'
+import SyncDatabase from '../sqlite/sync-database'
+
+/** Writes a Codex state DB whose startup backfill reports `status`. */
+export function writeCodexStateDbBackfillStatus(codexHomePath: string, status: string): void {
+  mkdirSync(codexHomePath, { recursive: true })
+  const db = new SyncDatabase(join(codexHomePath, 'state_5.sqlite'))
+  db.exec(
+    'CREATE TABLE backfill_state (id INTEGER PRIMARY KEY, status TEXT NOT NULL); ' +
+      `INSERT INTO backfill_state (id, status) VALUES (1, '${status}')`
+  )
+  db.close()
+}
diff --git a/src/main/codex/codex-state-db.test.ts b/src/main/codex/codex-state-db.test.ts
index 7cf0ac88ac5..a89a556b807 100644
--- a/src/main/codex/codex-state-db.test.ts
+++ b/src/main/codex/codex-state-db.test.ts
@@ -1,12 +1,13 @@
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { afterEach, describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import SyncDatabase from '../sqlite/sync-database'
 import {
   findNewestCodexStateDbPath,
   isCodexStateDbBackfillPending,
-  readCodexStateDbBackfillStatus
+  readCodexStateDbBackfillStatus,
+  readIndexedCodexThreadIds
 } from './codex-state-db'
 
 const temporaryHomes: string[] = []
@@ -67,6 +68,19 @@ describe('Codex state DB backfill status', () => {
     expect(isCodexStateDbBackfillPending(home)).toBe(true)
   })
 
+  it('counts compressed rollouts, which Codex also backfills', async () => {
+    const home = await createHome()
+    const sessions = join(home, 'sessions', '2026', '08', '04')
+    await mkdir(sessions, { recursive: true })
+    await Promise.all(
+      Array.from({ length: 100 }, (_, index) =>
+        writeFile(join(sessions, `rollout-${index}.jsonl.zst`), '')
+      )
+    )
+
+    expect(isCodexStateDbBackfillPending(home)).toBe(true)
+  })
+
   it('does not call a complete backfill pending', async () => {
     const home = await createHome()
     createBackfillDb(home, 5, 'complete')
@@ -74,3 +88,27 @@ describe('Codex state DB backfill status', () => {
     expect(isCodexStateDbBackfillPending(home)).toBe(false)
   })
 })
+
+describe('readIndexedCodexThreadIds', () => {
+  it('returns lower-cased thread ids from the newest state DB', async () => {
+    const home = await createHome()
+    const path = createBackfillDb(home, 5, 'complete')
+    const db = new SyncDatabase(path)
+    db.exec(
+      "CREATE TABLE threads (id TEXT PRIMARY KEY); INSERT INTO threads (id) VALUES ('ABC'), ('def')"
+    )
+    db.close()
+
+    expect(readIndexedCodexThreadIds(home)).toEqual(new Set(['abc', 'def']))
+  })
+
+  it('returns null when there is no state DB or no threads table', async () => {
+    const home = await createHome()
+    expect(readIndexedCodexThreadIds(home)).toBeNull()
+
+    createBackfillDb(home, 5, 'complete')
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    expect(readIndexedCodexThreadIds(home)).toBeNull()
+    warn.mockRestore()
+  })
+})
diff --git a/src/main/codex/codex-state-db.ts b/src/main/codex/codex-state-db.ts
index e2b437aea3a..ae8ff3eb046 100644
--- a/src/main/codex/codex-state-db.ts
+++ b/src/main/codex/codex-state-db.ts
@@ -71,6 +71,37 @@ export function readCodexStateDbBackfillStatus(codexHomePath: string): CodexStat
   }
 }
 
+/**
+ * Lower-cased thread ids already in Codex's state DB, or null when the DB is
+ * missing or unreadable. Read-only; never creates or mutates Codex's database.
+ */
+export function readIndexedCodexThreadIds(codexHomePath: string): Set<string> | null {
+  const stateDbPath = findNewestCodexStateDbPath(codexHomePath)
+  if (!stateDbPath) {
+    return null
+  }
+  let db: SyncDatabase | null = null
+  try {
+    db = new SyncDatabase(stateDbPath, { readonly: true, fileMustExist: true })
+    const ids = new Set<string>()
+    for (const row of db.prepare('SELECT id FROM threads').all()) {
+      if (typeof row.id === 'string') {
+        ids.add(row.id.toLowerCase())
+      }
+    }
+    return ids
+  } catch (error) {
+    console.warn('[codex-state-db] Failed to read indexed Codex threads:', error)
+    return null
+  } finally {
+    try {
+      db?.close()
+    } catch {
+      // A close failure cannot change the read-only result already collected.
+    }
+  }
+}
+
 export function countCodexSessionFilesUpTo(sessionsRoot: string, limit: number): number {
   let count = 0
   const pendingDirectories = [sessionsRoot]
@@ -85,7 +116,11 @@ export function countCodexSessionFilesUpTo(sessionsRoot: string, limit: number):
     for (const entry of entries) {
       if (entry.isDirectory()) {
         pendingDirectories.push(join(directory, entry.name))
-      } else if (entry.isFile() && entry.name.endsWith('.jsonl')) {
+      } else if (
+        entry.isFile() &&
+        // Why: Codex's startup backfill parses compressed rollouts too.
+        (entry.name.endsWith('.jsonl') || entry.name.endsWith('.jsonl.zst'))
+      ) {
         count += 1
         if (count >= limit) {
           break
diff --git a/src/main/codex/codex-structured-child-environment.test.ts b/src/main/codex/codex-structured-child-environment.test.ts
index 201efc0b0c5..4dcd49e9645 100644
--- a/src/main/codex/codex-structured-child-environment.test.ts
+++ b/src/main/codex/codex-structured-child-environment.test.ts
@@ -1,7 +1,7 @@
-import { describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { openCodexAppServerConnection } from './codex-app-server-connection'
 import { CODEX_SPAWN_TOKEN_ENV } from './codex-structured-owner-identity'
 import { buildCodexStructuredChildEnvironment } from './codex-structured-child-environment'
-import { ORCA_STRUCTURED_SESSION_ENV } from '../../shared/structured-session-marker'
 import {
   mintStructuredWorkerHandle,
   mintStructuredWorkerPaneKey,
@@ -9,6 +9,10 @@ import {
   structuredWorkerProcessIncarnation
 } from '../runtime/structured-worker-identity'
 
+const DEV_CLI_BIN_FIRST = /^[^:;]*[\\/]cli[\\/]bin[:;]/
+// The dev launcher by absolute path: a login shell's profile cannot reorder it behind a global.
+const DEV_CLI_LAUNCHER = /^[^:;]*[\\/]cli[\\/]bin[\\/]orca-dev$/
+
 describe('buildCodexStructuredChildEnvironment', () => {
   it('keeps shell exports while pinned launch values win', () => {
     expect(
@@ -28,11 +32,16 @@ describe('buildCodexStructuredChildEnvironment', () => {
       EXAMPLE_GATEWAY_TOKEN: 'shell-exported',
       CODEX_HOME: '/pinned/home',
       [CODEX_SPAWN_TOKEN_ENV]: 'spawn-token',
-      [ORCA_STRUCTURED_SESSION_ENV]: '1'
+      ORCA_AGENT_SESSION_ID: 'session-not-a-worker',
+      ORCA_STRUCTURED_SESSION: '1',
+      ORCA_CLI_COMMAND: expect.stringMatching(DEV_CLI_LAUNCHER),
+      ORCA_USER_DATA_PATH: expect.any(String),
+      // The test host is unpackaged, so this app's CLI is the dev launcher dir, first on PATH.
+      PATH: expect.stringMatching(DEV_CLI_BIN_FIRST)
     })
   })
 
-  it('adds the orchestration handle only for a registered structured worker', () => {
+  it('names every session by its id, and adds the handle only for a registered worker', () => {
     const launch = {
       command: 'codex',
       args: ['app-server'],
@@ -44,8 +53,12 @@ describe('buildCodexStructuredChildEnvironment', () => {
     const sessionId = 'a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d'
     expect(buildCodexStructuredChildEnvironment(launch, 'spawn-token', sessionId)).toEqual({
       [CODEX_SPAWN_TOKEN_ENV]: 'spawn-token',
-      // No identity yet, so the child carries only the refuse-rather-than-guess marker.
-      [ORCA_STRUCTURED_SESSION_ENV]: '1'
+      // Not a worker, so no handle: the id alone names this chat as a caller.
+      ORCA_AGENT_SESSION_ID: sessionId,
+      ORCA_STRUCTURED_SESSION: '1',
+      ORCA_CLI_COMMAND: expect.stringMatching(DEV_CLI_LAUNCHER),
+      ORCA_USER_DATA_PATH: expect.any(String),
+      PATH: expect.stringMatching(DEV_CLI_BIN_FIRST)
     })
 
     const handle = mintStructuredWorkerHandle()
@@ -61,7 +74,8 @@ describe('buildCodexStructuredChildEnvironment', () => {
     try {
       const env = buildCodexStructuredChildEnvironment(launch, 'spawn-token', sessionId)
       expect(env.ORCA_TERMINAL_HANDLE).toBe(handle)
-      expect(env.ORCA_CLI_COMMAND).toBe('orca')
+      expect(env.ORCA_AGENT_SESSION_ID).toBe(sessionId)
+      expect(env.ORCA_CLI_COMMAND).toMatch(DEV_CLI_LAUNCHER)
       // A pane key here would leak into hook-emitted agent statuses, which assume a PTY leaf.
       expect(env.ORCA_PANE_KEY).toBeUndefined()
     } finally {
@@ -69,3 +83,62 @@ describe('buildCodexStructuredChildEnvironment', () => {
     }
   })
 })
+
+/** A real child speaking Codex's JSONL framing, answering with the environment it was spawned with. */
+const ENV_REPORTING_APP_SERVER = String.raw`
+  const readline = require('node:readline')
+  const send = (payload) => process.stdout.write(JSON.stringify(payload) + '\n')
+  readline.createInterface({ input: process.stdin }).on('line', (line) => {
+    const message = JSON.parse(line)
+    if (message.method === 'initialize') return send({ id: message.id, result: {} })
+    if (message.method === 'test/env') {
+      return send({
+        id: message.id,
+        result: {
+          sessionId: process.env.ORCA_AGENT_SESSION_ID ?? null,
+          cliCommand: process.env.ORCA_CLI_COMMAND ?? null,
+          path: process.env.PATH ?? process.env.Path ?? null
+        }
+      })
+    }
+  })
+`
+
+describe('the spawned Codex child', () => {
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+
+  it("runs with its own session id and this app's CLI, over an id inherited by Orca itself", async () => {
+    // The builder's output is an overlay on process.env, so only the spawned child proves the id
+    // survives the merge — an Orca launched inside another session inherits that session's id.
+    vi.stubEnv('ORCA_AGENT_SESSION_ID', 'a0b1c2d3-0000-4000-8000-00000000abcd')
+    const sessionId = 'a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d'
+    const env = buildCodexStructuredChildEnvironment(
+      {
+        command: process.execPath,
+        args: ['-e', ENV_REPORTING_APP_SERVER],
+        cwd: process.cwd(),
+        codexHome: null,
+        resumeThreadId: null,
+        env: {}
+      },
+      'spawn-token',
+      sessionId
+    )
+    const connection = await openCodexAppServerConnection({
+      command: process.execPath,
+      args: ['-e', ENV_REPORTING_APP_SERVER],
+      env
+    })
+    try {
+      await expect(connection.request('test/env')).resolves.toEqual({
+        sessionId,
+        cliCommand: expect.stringMatching(DEV_CLI_LAUNCHER),
+        path: expect.stringMatching(DEV_CLI_BIN_FIRST)
+      })
+    } finally {
+      await connection.close()
+    }
+  })
+})
diff --git a/src/main/codex/codex-structured-child-environment.ts b/src/main/codex/codex-structured-child-environment.ts
index 72bf17a1bce..38ea91abe26 100644
--- a/src/main/codex/codex-structured-child-environment.ts
+++ b/src/main/codex/codex-structured-child-environment.ts
@@ -1,6 +1,6 @@
 import type { CodexStructuredLaunch } from './codex-structured-session-state'
 import { CODEX_SPAWN_TOKEN_ENV } from './codex-structured-owner-identity'
-import { structuredWorkerChildIdentityEnv } from '../runtime/structured-worker-child-identity-env'
+import { structuredSessionChildIdentityEnv } from '../runtime/structured-session-child-identity-env'
 
 export function buildCodexStructuredChildEnvironment(
   launch: CodexStructuredLaunch,
@@ -8,9 +8,8 @@ export function buildCodexStructuredChildEnvironment(
   sessionId: string
 ): Record<string, string> {
   return {
-    // Only a dispatched structured worker gets the orchestration identity and the Orca CLI on
-    // PATH; an ordinary chat session's env passes through untouched.
-    ...structuredWorkerChildIdentityEnv(sessionId, {
+    // Every structured session speaks orchestration as itself: its injected id and the Orca CLI.
+    ...structuredSessionChildIdentityEnv(sessionId, {
       ...launch.env,
       ...(launch.codexHome ? { CODEX_HOME: launch.codexHome } : {})
     }),
diff --git a/src/main/codex/codex-structured-child-work-producer.test.ts b/src/main/codex/codex-structured-child-work-producer.test.ts
new file mode 100644
index 00000000000..611b7f75b57
--- /dev/null
+++ b/src/main/codex/codex-structured-child-work-producer.test.ts
@@ -0,0 +1,530 @@
+// A Codex session's frames, through the real adapter, into the host's child records: the order the
+// host receives them in, and whether the parent row the records imply is today's row.
+
+import { describe, expect, it } from 'vitest'
+import {
+  foldAgentLeadStatus,
+  type AgentLeadStatusResolution
+} from '../../shared/agent-lead-status-fold'
+import { createAgentChildWorkAdmission } from '../../shared/agent-status-child-work-admission'
+import type { AgentChildWorkRecord } from '../../shared/agent-status-child-work'
+import { agentChildWorkLiveness } from '../../shared/agent-status-child-work-liveness'
+import { reconcileAgentChildWorkEvidence } from '../../shared/agent-status-child-work-reconciliation'
+import {
+  agentChildWorkOwnedLiveness,
+  deriveAgentChildDisplayState
+} from '../../shared/agent-status-child-work-display'
+import { projectAgentChildWorkViews } from '../../shared/agent-status-child-work-view'
+import { createAgentStatusStore } from '../../shared/agent-status-store'
+import { agentJournalLinkageFields } from '../../shared/agent-session-journal-producer'
+import type {
+  AgentJournalItemBody,
+  AgentJournalProducerLinkage
+} from '../../shared/agent-session-journal-types'
+import { makeStructuredAgentStatusSubject } from '../../shared/agent-status-subject'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { fakeCodex, identityFor, THREAD_ID } from './codex-structured-session-adapter-fixture'
+import { CodexStructuredSessionAdapter } from './codex-structured-session-adapter'
+
+const parent = makeStructuredAgentStatusSubject(
+  {
+    executionHostId: 'local',
+    wslDistro: null,
+    workspaceId: 'workspace-1',
+    workspaceKind: 'folder'
+  },
+  'session-1'
+)
+const REVIEWER = 'thread-reviewer'
+const TESTER = 'thread-tester'
+const LINTER = 'thread-linter'
+
+type Frame = { method: string; params: Record<string, unknown> }
+type Delivery = { kind: 'journal' | 'legacy' | 'evidence'; detail: string }
+type Liveness = ReturnType<typeof agentChildWorkLiveness>
+/** What the records and today's strip each said when the journal wrote or published a row. */
+type JournalMoment = { recorded: Liveness; legacy: Liveness }
+
+const turn = (
+  method: 'turn/started' | 'turn/completed',
+  threadId: string,
+  id: string,
+  status = 'completed'
+): Frame => ({
+  method,
+  params: { threadId, turn: { id, status } }
+})
+const spawned = (child: string, name: string, parentTurn: string): Frame => ({
+  method: 'item/started',
+  params: {
+    threadId: THREAD_ID,
+    turnId: parentTurn,
+    item: {
+      type: 'subAgentActivity',
+      id: `spawn-${child}`,
+      kind: 'started',
+      agentThreadId: child,
+      agentPath: `/root/${name}`
+    }
+  }
+})
+const item = (
+  method: 'item/started' | 'item/completed',
+  threadId: string,
+  turnId: string,
+  fields: Record<string, unknown>
+): Frame => ({
+  method,
+  params: { threadId, turnId, item: fields }
+})
+const status = (threadId: string, activeFlags: string[]): Frame => ({
+  method: 'thread/status/changed',
+  params: { threadId, status: { type: 'active', activeFlags } }
+})
+
+async function producer() {
+  const codex = fakeCodex()
+  const store = createAgentStatusStore({ epoch: 'epoch-1', mode: 'authority' })
+  expect(store.applyMutation({ parent: { subject: parent } })).not.toBeNull()
+  let minted = 0
+  const admission = createAgentChildWorkAdmission(store, {
+    mintChildWorkId: () => `child-${++minted}`
+  })
+  const deliveries: Delivery[] = []
+  const moments: JournalMoment[] = []
+  const records = (): AgentChildWorkRecord[] => store.getChildren(parent)
+  const recordedLiveness = () =>
+    agentChildWorkLiveness(records().filter((record) => record.membership === 'live'))
+  // Each journal write publishes the parent's row, so the records must imply its state right then.
+  const moment = () =>
+    moments.push({
+      recorded: recordedLiveness(),
+      legacy: agentChildWorkLiveness(adapter.backgroundTaskState('session-1')?.tasks)
+    })
+  const adapter = new CodexStructuredSessionAdapter({
+    resolveLaunch: async () => ({
+      command: 'codex',
+      args: ['app-server'],
+      cwd: '/work/repo',
+      codexHome: null,
+      resumeThreadId: null
+    }),
+    openConnection: codex.openConnection,
+    readProcessStartTime: async () => 1_700_000_000_000,
+    now: () => 1_700_000_000_500,
+    onBackgroundTasksChanged: (_sessionId, state) =>
+      deliveries.push({ kind: 'legacy', detail: String(state?.tasks?.length ?? 0) }),
+    onChildWorkEvidence: (sessionId, evidence) => {
+      expect(sessionId).toBe('session-1')
+      deliveries.push({ kind: 'evidence', detail: evidence.map((edge) => edge.type).join(',') })
+      reconcileAgentChildWorkEvidence({ store, admission, parent, provider: 'codex', evidence })
+    }
+  })
+  const rows: { body: AgentJournalItemBody; linkage: AgentJournalProducerLinkage }[] = []
+  const journal: StructuredAgentSessionEventSink = {
+    appendItem: (identity, body, options) => {
+      deliveries.push({ kind: 'journal', detail: JSON.stringify(identity) })
+      rows.push({ body, linkage: agentJournalLinkageFields(options) })
+      moment()
+    },
+    appendTombstone: () => {},
+    publish: moment
+  }
+  await adapter.acquire({
+    identity: identityFor('session-1'),
+    fence: 7,
+    spawnToken: 'spawn-9',
+    events: journal
+  })
+  const send = (frame: Frame): Delivery[] => {
+    const from = deliveries.length
+    codex.connections[0]!.handlers.onNotification?.(frame.method, frame.params)
+    return deliveries.slice(from)
+  }
+  /** The journal moments one frame produced. */
+  const momentsOf = (frame: Frame): JournalMoment[] => {
+    const from = moments.length
+    send(frame)
+    return moments.slice(from)
+  }
+  const byDescription = (description: string) =>
+    records().find((record) => record.description === description)
+  const display = (description: string) => {
+    const children = records()
+    const views = projectAgentChildWorkViews(
+      children,
+      children.flatMap((child) => store.getAliasesForChild(child.childWorkId))
+    )
+    const view = views.find((candidate) => candidate.description === description)
+    return view && deriveAgentChildDisplayState(view, agentChildWorkOwnedLiveness(views, view.id))
+  }
+  /** The producer stamp on the newest journal row that carries this text. */
+  const stampOf = (text: string) =>
+    rows.findLast((row) => JSON.stringify(row.body).includes(text))?.linkage
+  return {
+    adapter,
+    codex,
+    send,
+    momentsOf,
+    records,
+    recordedLiveness,
+    byDescription,
+    display,
+    stampOf
+  }
+}
+
+const fold = (
+  leadState: 'working' | 'done',
+  childWorkLiveness: Liveness
+): AgentLeadStatusResolution => foldAgentLeadStatus({ leadState, childWorkLiveness })
+/** The strip has no word for a child waiting on a human: to it, that child is working. */
+const asStrip = (liveness: Liveness): Liveness => (liveness === 'waiting' ? 'working' : liveness)
+const shellFrame = (
+  method: 'item/started' | 'item/completed',
+  threadId: string,
+  turnId: string,
+  id: string,
+  command: string,
+  source = 'unifiedExecStartup'
+): Frame =>
+  item(method, threadId, turnId, {
+    type: 'commandExecution',
+    id,
+    command,
+    source,
+    status: method === 'item/started' ? 'inProgress' : 'completed',
+    ...(method === 'item/completed' ? { exitCode: 0 } : {})
+  })
+
+describe('Codex structured child-work producer', () => {
+  it('delivers evidence only after the journal wrote the frame and the legacy row republished', async () => {
+    const { send, records } = await producer()
+    send(turn('turn/started', THREAD_ID, 'p1'))
+    send(turn('turn/started', REVIEWER, 'r1'))
+    const deliveries = send(spawned(REVIEWER, 'review', 'p1'))
+    const kinds = deliveries.map((delivery) => delivery.kind)
+    // The frame's own rows, then the parent's republished row, and only then its children.
+    expect(kinds.filter((kind) => kind === 'journal').length).toBeGreaterThan(0)
+    expect(kinds.slice(kinds.indexOf('legacy'))).toEqual(['legacy', 'evidence'])
+    expect(records()).toEqual([
+      expect.objectContaining({ description: 'review', membership: 'live' })
+    ])
+  })
+
+  it('records the parent state today reads, at every journal write, while adding outcome and activity', async () => {
+    const { adapter, momentsOf, records, recordedLiveness, byDescription, display } =
+      await producer()
+    const steps: {
+      frame: Frame
+      lead: 'working' | 'done'
+      childWaits?: true
+      check?: () => void
+    }[] = [
+      { frame: turn('turn/started', THREAD_ID, 'p1'), lead: 'working' },
+      // Codex reports the child's turn before its announcement.
+      {
+        frame: turn('turn/started', REVIEWER, 'r1'),
+        lead: 'working',
+        check: () => expect(records()).toEqual([])
+      },
+      { frame: spawned(REVIEWER, 'review', 'p1'), lead: 'working' },
+      // An approved command: Codex starts it on the approval path and reports its exit from
+      // unified exec.
+      {
+        frame: shellFrame('item/started', REVIEWER, 'r1', 'cmd-1', 'npm test', 'agent'),
+        lead: 'working',
+        check: () => {
+          expect(byDescription('review')?.operation).toMatchObject({
+            toolName: 'Bash',
+            input: 'npm test',
+            basis: 'open'
+          })
+          expect(byDescription('npm test')).toMatchObject({
+            membership: 'live',
+            parentChildWorkId: byDescription('review')?.childWorkId
+          })
+        }
+      },
+      // The child starts a dev server it will leave running past its own turn.
+      {
+        frame: shellFrame('item/started', REVIEWER, 'r1', 'exec-1', 'npm run dev'),
+        lead: 'working',
+        check: () =>
+          expect(byDescription('npm run dev')).toMatchObject({
+            membership: 'live',
+            parentChildWorkId: byDescription('review')?.childWorkId
+          })
+      },
+      {
+        frame: shellFrame('item/completed', REVIEWER, 'r1', 'cmd-1', 'npm test'),
+        lead: 'working',
+        check: () => {
+          // A finished command leaves nothing behind.
+          expect(byDescription('npm test')).toBeUndefined()
+          // The dev server is still the child's open call while its turn runs.
+          expect(byDescription('review')?.operation).toMatchObject({
+            toolName: 'Bash',
+            input: 'npm run dev'
+          })
+        }
+      },
+      {
+        frame: item('item/completed', REVIEWER, 'r1', {
+          type: 'agentMessage',
+          id: 'msg-1',
+          text: 'Dev server is up'
+        }),
+        lead: 'working'
+      },
+      // The parent's turn ends first; its child keeps running.
+      {
+        frame: turn('turn/completed', THREAD_ID, 'p1'),
+        lead: 'done',
+        check: () =>
+          expect(byDescription('review')).toMatchObject({ membership: 'live', state: 'working' })
+      },
+      // The legacy task list carries no child state, so only the records can say a child waits,
+      // and the shared fold ranks that wait above the parent's own state.
+      {
+        frame: status(REVIEWER, ['waitingOnApproval']),
+        lead: 'done',
+        childWaits: true,
+        check: () => {
+          expect(byDescription('review')?.state).toBe('waiting')
+          expect(agentChildWorkLiveness(adapter.backgroundTaskState('session-1')?.tasks)).toBe(
+            'working'
+          )
+        }
+      },
+      { frame: status(REVIEWER, []), lead: 'done' },
+      {
+        frame: turn('turn/completed', REVIEWER, 'r1'),
+        lead: 'done',
+        check: () => {
+          expect(byDescription('review')).toMatchObject({
+            membership: 'settled',
+            outcome: 'succeeded',
+            lastMessage: 'Dev server is up'
+          })
+          expect(byDescription('npm run dev')).toMatchObject({
+            membership: 'live',
+            parentChildWorkId: byDescription('review')?.childWorkId
+          })
+          // Finished, but a shell it launched still runs: the CLI parent rule reads monitoring.
+          expect(display('review')).toBe('monitoring')
+        }
+      },
+      { frame: turn('turn/started', THREAD_ID, 'p2'), lead: 'working' },
+      // The parent asks the finished child a follow-up: the same record, a new run.
+      {
+        frame: turn('turn/started', REVIEWER, 'r2'),
+        lead: 'working',
+        check: () =>
+          expect(byDescription('review')).toMatchObject({
+            childWorkId: 'child-1',
+            membership: 'live',
+            invocation: { invocationId: 'r2', generation: 2 },
+            previousInvocations: [expect.objectContaining({ outcome: 'succeeded' })]
+          })
+      },
+      { frame: spawned(TESTER, 'test', 'p2'), lead: 'working' },
+      { frame: turn('turn/started', TESTER, 't1'), lead: 'working' },
+      { frame: spawned(LINTER, 'lint', 'p2'), lead: 'working' },
+      { frame: turn('turn/started', LINTER, 'l1'), lead: 'working' },
+      // Codex ends this child's turn with an error it will not retry, then a failed completion.
+      {
+        frame: {
+          method: 'error',
+          params: { threadId: LINTER, turnId: 'l1', willRetry: false, error: { message: 'boom' } }
+        },
+        lead: 'working',
+        check: () => expect(byDescription('lint')).toMatchObject({ membership: 'live' })
+      },
+      {
+        frame: turn('turn/completed', LINTER, 'l1', 'failed'),
+        lead: 'working',
+        check: () =>
+          expect(byDescription('lint')).toMatchObject({ membership: 'settled', outcome: 'failed' })
+      },
+      {
+        frame: turn('turn/completed', REVIEWER, 'r2', 'interrupted'),
+        lead: 'working',
+        check: () =>
+          expect(byDescription('review')).toMatchObject({
+            membership: 'settled',
+            outcome: 'cancelled'
+          })
+      },
+      { frame: turn('turn/completed', THREAD_ID, 'p2'), lead: 'done' },
+      {
+        frame: turn('turn/completed', TESTER, 't1', 'failed'),
+        lead: 'done',
+        check: () =>
+          expect(byDescription('test')).toMatchObject({ membership: 'settled', outcome: 'failed' })
+      },
+      {
+        frame: shellFrame('item/completed', REVIEWER, 'r1', 'exec-1', 'npm run dev'),
+        lead: 'done',
+        check: () => {
+          expect(byDescription('npm run dev')).toBeUndefined()
+          expect(display('review')).toBe('interrupted')
+        }
+      }
+    ]
+    let journalMoments = 0
+    for (const [index, step] of steps.entries()) {
+      const frameMoments = momentsOf(step.frame)
+      journalMoments += frameMoments.length
+      for (const [at, { recorded, legacy }] of frameMoments.entries()) {
+        expect({ index, at, parent: fold(step.lead, asStrip(recorded)) }).toEqual({
+          index,
+          at,
+          parent: fold(step.lead, legacy)
+        })
+      }
+      const legacy = agentChildWorkLiveness(adapter.backgroundTaskState('session-1')?.tasks)
+      const recorded = recordedLiveness()
+      const expected = step.childWaits ? 'waiting' : legacy
+      expect({ index, parent: fold(step.lead, recorded) }).toEqual({
+        index,
+        parent: fold(step.lead, expected)
+      })
+      expect({ index, liveness: recorded }).toEqual({ index, liveness: expected })
+      step.check?.()
+    }
+    expect(journalMoments).toBeGreaterThan(steps.length)
+    const settled = records()
+    await adapter.closeSession('session-1')
+    // Every child had already ended; closing the session changes none of what they said.
+    expect(records()).toEqual(settled)
+    expect(
+      records().map(({ description, membership, outcome }) => ({
+        description,
+        membership,
+        outcome
+      }))
+    ).toEqual([
+      { description: 'review', membership: 'settled', outcome: 'cancelled' },
+      { description: 'test', membership: 'settled', outcome: 'failed' },
+      { description: 'lint', membership: 'settled', outcome: 'failed' }
+    ])
+    expect(adapter.backgroundTaskState('session-1')).toBeUndefined()
+  })
+
+  it("never reads done while the main agent's own shell runs past its turn", async () => {
+    const { momentsOf, send, recordedLiveness } = await producer()
+    send(turn('turn/started', THREAD_ID, 'p1'))
+    send(shellFrame('item/started', THREAD_ID, 'p1', 'exec-dev', 'npm run dev'))
+    const monitoring = { stateName: 'working', workingMode: 'monitoring' }
+    // The turn ends with the dev server running: straight to monitoring, never done in between.
+    const turnEnd = momentsOf(turn('turn/completed', THREAD_ID, 'p1'))
+    expect(turnEnd.length).toBeGreaterThan(0)
+    for (const { recorded } of turnEnd) {
+      expect(fold('done', recorded)).toEqual(monitoring)
+    }
+    expect(fold('done', recordedLiveness())).toEqual(monitoring)
+    momentsOf(shellFrame('item/completed', THREAD_ID, 'p1', 'exec-dev', 'npm run dev'))
+    expect(fold('done', recordedLiveness())).toEqual({ stateName: 'done' })
+  })
+
+  it('ends an approval left unanswered when its turn ends: Codex never ran the command', async () => {
+    const { adapter, codex, send, records, recordedLiveness, display, byDescription } =
+      await producer()
+    const approve = (threadId: string, turnId: string, itemId: string, command: string) => {
+      // The approval path starts the item before it asks, and drops the question at turn end.
+      send(shellFrame('item/started', threadId, turnId, itemId, command, 'agent'))
+      codex.connections[0]!.handlers.onServerRequest?.({
+        id: `approval-${itemId}`,
+        method: 'item/commandExecution/requestApproval',
+        params: { itemId, threadId, turnId }
+      })
+    }
+    send(turn('turn/started', THREAD_ID, 'p1'))
+    send(turn('turn/started', REVIEWER, 'r1'))
+    send(spawned(REVIEWER, 'review', 'p1'))
+    approve(REVIEWER, 'r1', 'call-child', 'npm run e2e')
+    approve(THREAD_ID, 'p1', 'call-main', 'npm run dev')
+    expect(records().filter((record) => record.kind === 'command')).toHaveLength(2)
+    // The user stops the child, then the main agent, each at its approval.
+    send(turn('turn/completed', REVIEWER, 'r1', 'interrupted'))
+    expect(byDescription('npm run e2e')).toBeUndefined()
+    expect(display('review')).toBe('interrupted')
+    send(turn('turn/completed', THREAD_ID, 'p1', 'interrupted'))
+    expect(byDescription('npm run dev')).toBeUndefined()
+    expect(adapter.backgroundTaskState('session-1')).toBeNull()
+    expect(fold('done', recordedLiveness())).toEqual({ stateName: 'done' })
+  })
+
+  it('keeps an answered approval running past its turn', async () => {
+    const { adapter, codex, send, byDescription } = await producer()
+    send(turn('turn/started', THREAD_ID, 'p1'))
+    send(shellFrame('item/started', THREAD_ID, 'p1', 'call-1', 'npm run dev', 'agent'))
+    codex.connections[0]!.handlers.onServerRequest?.({
+      id: 'approval-1',
+      method: 'item/commandExecution/requestApproval',
+      params: { itemId: 'call-1', threadId: THREAD_ID, turnId: 'p1' }
+    })
+    await adapter.answerPrompt({
+      sessionId: 'session-1',
+      itemId: 'call-1',
+      kind: 'approval',
+      response: { kind: 'option', optionId: 'accept' },
+      fence: 7,
+      commit: async () => {}
+    })
+    send(turn('turn/completed', THREAD_ID, 'p1'))
+    expect(byDescription('npm run dev')).toMatchObject({ membership: 'live' })
+    expect(adapter.backgroundTaskState('session-1')?.tasks).toEqual([
+      expect.objectContaining({ kind: 'command', description: 'npm run dev' })
+    ])
+  })
+
+  it("numbers a child's runs as the journal does: a row's attempt is its record's generation", async () => {
+    const { send, byDescription, stampOf } = await producer()
+    const says = (turnId: string, text: string) =>
+      item('item/completed', REVIEWER, turnId, { type: 'agentMessage', id: `msg-${text}`, text })
+    // The journal stamps a child row with its run only once it is past the first.
+    const runs = (text: string) => {
+      const stamp = stampOf(text)
+      return {
+        agentId: stamp?.agentId,
+        attempt: stamp ? (stamp.attempt ?? 1) : undefined,
+        generation: byDescription('review')?.invocation.generation
+      }
+    }
+    send(turn('turn/started', THREAD_ID, 'p1'))
+    // Codex reports the child's first turn before the spawn that announces it.
+    send(turn('turn/started', REVIEWER, 'r1'))
+    send(spawned(REVIEWER, 'review', 'p1'))
+    send(says('r1', 'run 1'))
+    expect(runs('run 1')).toEqual({ agentId: REVIEWER, attempt: 1, generation: 1 })
+    send(turn('turn/completed', REVIEWER, 'r1'))
+    // Each follow-up the parent sends is the child's next run, on both sides.
+    for (const run of [2, 3]) {
+      send(turn('turn/started', REVIEWER, `r${run}`))
+      send(says(`r${run}`, `run ${run}`))
+      expect(runs(`run ${run}`)).toEqual({ agentId: REVIEWER, attempt: run, generation: run })
+      send(turn('turn/completed', REVIEWER, `r${run}`))
+    }
+  })
+
+  it('settles a live child with no reported outcome when the provider exits unexpectedly', async () => {
+    const { codex, send, records } = await producer()
+    send(turn('turn/started', THREAD_ID, 'p1'))
+    send(spawned(REVIEWER, 'review', 'p1'))
+    send(turn('turn/started', REVIEWER, 'r1'))
+    expect(records()).toEqual([
+      expect.objectContaining({ description: 'review', membership: 'live', state: 'working' })
+    ])
+    codex.connections[0]!.handlers.onExit?.(new Error('provider exited'))
+    expect(records()).toEqual([
+      expect.objectContaining({
+        description: 'review',
+        membership: 'settled',
+        state: 'done',
+        outcome: 'unknown'
+      })
+    ])
+  })
+})
diff --git a/src/main/codex/codex-structured-compaction-refusal.test.ts b/src/main/codex/codex-structured-compaction-refusal.test.ts
new file mode 100644
index 00000000000..fa8800f9605
--- /dev/null
+++ b/src/main/codex/codex-structured-compaction-refusal.test.ts
@@ -0,0 +1,42 @@
+// A compaction Codex refuses up front keeps Codex's own words for the chat's failure row.
+
+import { describe, expect, it } from 'vitest'
+import { structuredAgentSessionCommandTurn } from '../native-chat/agent-session-wire/structured-agent-session-command-turn'
+import { CodexAppServerRequestError } from './codex-app-server-connection'
+import { acquired, fakeCodex } from './codex-structured-session-adapter-fixture'
+
+describe('Codex compaction refused at the request', () => {
+  it("carries Codex's message as the detail, apart from Orca's wrapper", async () => {
+    const codex = fakeCodex({
+      'thread/compact/start': () => {
+        throw new CodexAppServerRequestError(
+          'thread/compact/start',
+          -32600,
+          'codex app-server thread/compact/start failed: thread has nothing to compact',
+          'thread has nothing to compact'
+        )
+      }
+    })
+    const adapter = await acquired(codex)
+    const turn = structuredAgentSessionCommandTurn('cmd-1')
+
+    await expect(
+      adapter.compact({
+        sessionId: 'session-1',
+        fence: 7,
+        command: {
+          clientMessageId: 'cmd-1',
+          ...turn,
+          running: { kind: 'turn', turnId: turn.turnId, state: 'running' }
+        }
+      })
+    ).resolves.toEqual({
+      state: 'rejected',
+      reason: 'The provider did not accept this message: thread has nothing to compact.',
+      rejection: {
+        kind: 'providerRejected',
+        detail: { text: 'thread has nothing to compact', audience: 'person' }
+      }
+    })
+  })
+})
diff --git a/src/main/codex/codex-structured-conversation-stop.test.ts b/src/main/codex/codex-structured-conversation-stop.test.ts
new file mode 100644
index 00000000000..5d8a9c5627f
--- /dev/null
+++ b/src/main/codex/codex-structured-conversation-stop.test.ts
@@ -0,0 +1,100 @@
+// A Codex Stop that names no turn. The fake keeps Codex 0.157's turn bookkeeping: it answers
+// `turn/start` before it opens the turn, and refuses an interrupt until then.
+
+import { describe, expect, it, vi } from 'vitest'
+import { structuredAgentSessionCommandTurn } from '../native-chat/agent-session-wire/structured-agent-session-command-turn'
+import {
+  CODEX_TEST_THREAD_ID,
+  codexTurnLifecycleRig
+} from './codex-structured-dispatch-test-support'
+
+type Rig = Awaited<ReturnType<typeof codexTurnLifecycleRig>>
+
+async function openedTurn(rig: Rig): Promise<void> {
+  const sending = rig.send('client-1')
+  await vi.waitFor(() => expect(rig.turns.turnId).toBe('turn-1'))
+  rig.turns.start()
+  await sending
+}
+
+const stop = (rig: Rig, resolveLiveTurnId?: () => string | null) =>
+  rig.adapter.cancelTurn({
+    sessionId: 'session-1',
+    fence: 7,
+    ...(resolveLiveTurnId ? { resolveLiveTurnId } : {})
+  })
+
+describe('a Codex Stop that names no turn', () => {
+  it('interrupts the turn Codex opened when the journal shows none yet', async () => {
+    const rig = await codexTurnLifecycleRig()
+    await openedTurn(rig)
+
+    await expect(stop(rig, () => null)).resolves.toEqual({ cancelled: true })
+    expect(rig.interrupts().map((call) => call.params?.turnId)).toEqual(['turn-1'])
+  })
+
+  it('interrupts no turn that already ended', async () => {
+    const rig = await codexTurnLifecycleRig()
+    await openedTurn(rig)
+    rig.turns.end('completed')
+
+    await expect(stop(rig)).resolves.toEqual({ cancelled: false })
+    expect(rig.interrupts()).toEqual([])
+  })
+
+  it("names the journal's turn over the one it saw open, and carries Codex's refusal", async () => {
+    const rig = await codexTurnLifecycleRig()
+    await openedTurn(rig)
+
+    await expect(stop(rig, () => 'turn-journal')).resolves.toEqual({
+      cancelled: false,
+      refusal: {
+        detail: {
+          text: 'expected active turn id turn-journal but found turn-1',
+          audience: 'person'
+        }
+      }
+    })
+    expect(rig.interrupts().map((call) => call.params?.turnId)).toEqual(['turn-journal'])
+  })
+
+  it('interrupts nothing for another fence', async () => {
+    const rig = await codexTurnLifecycleRig()
+    await openedTurn(rig)
+
+    await expect(rig.adapter.cancelTurn({ sessionId: 'session-1', fence: 6 })).resolves.toEqual({
+      cancelled: false
+    })
+    expect(rig.interrupts()).toEqual([])
+  })
+
+  it('interrupts no earlier turn while a compaction the journal shows has not started', async () => {
+    const rig = await codexTurnLifecycleRig()
+    await openedTurn(rig)
+    rig.turns.end('completed')
+    const turn = structuredAgentSessionCommandTurn('operation-1')
+    const compaction = rig.adapter.compact({
+      sessionId: 'session-1',
+      fence: 7,
+      command: {
+        clientMessageId: 'operation-1',
+        ...turn,
+        running: { kind: 'turn', turnId: turn.turnId, state: 'running' }
+      }
+    })
+    await vi.waitFor(() =>
+      expect(rig.codex.connections[0]!.calls.at(-1)?.method).toBe('thread/compact/start')
+    )
+
+    await expect(stop(rig, () => turn.turnId)).resolves.toEqual({ cancelled: false })
+    expect(rig.interrupts()).toEqual([])
+
+    rig.notify('turn/started', { threadId: CODEX_TEST_THREAD_ID, turn: { id: 'turn-compact' } })
+    rig.notify('thread/compacted', { threadId: CODEX_TEST_THREAD_ID })
+    rig.notify('turn/completed', {
+      threadId: CODEX_TEST_THREAD_ID,
+      turn: { id: 'turn-compact', status: 'completed' }
+    })
+    await expect(compaction).resolves.toEqual({ state: 'accepted', providerIdentity: null })
+  })
+})
diff --git a/src/main/codex/codex-structured-dispatch-admission.test.ts b/src/main/codex/codex-structured-dispatch-admission.test.ts
index 5fc811b9382..b3c8a3fefeb 100644
--- a/src/main/codex/codex-structured-dispatch-admission.test.ts
+++ b/src/main/codex/codex-structured-dispatch-admission.test.ts
@@ -7,6 +7,7 @@ import {
   acquiredCodexAdapter,
   echoUserMessage,
   fakeCodexAppServer,
+  openAfterTurnStarts,
   startTurn,
   CODEX_TEST_THREAD_ID,
   CODEX_TEST_USER_MESSAGE,
@@ -140,7 +141,12 @@ describe('codex dispatch admission', () => {
     const { CodexAppServerRequestError } = await import('./codex-app-server-connection')
     const codex = fakeCodexAppServer({
       'turn/start': () => {
-        throw new CodexAppServerRequestError('turn/start', -32602, 'thread not found')
+        throw new CodexAppServerRequestError(
+          'turn/start',
+          -32602,
+          'codex app-server turn/start failed: thread not found',
+          'thread not found'
+        )
       }
     })
     const settlements: LateSettlement[] = []
@@ -148,9 +154,14 @@ describe('codex dispatch admission', () => {
     const connection = codex.connections[0]!
     startTurn(connection, 'turn-1')
 
+    // Codex's own words reach the sentence and the fact; Orca's prefix reaches neither.
     expect(await send(adapter, 'client-1')).toEqual({
       state: 'rejected',
-      reason: 'thread not found'
+      reason: 'The provider did not accept this message: thread not found.',
+      rejection: {
+        kind: 'providerRejected',
+        detail: { text: 'thread not found', audience: 'person' }
+      }
     })
 
     // A refused write is disarmed, so a later echo of that id settles nothing.
@@ -205,8 +216,9 @@ describe('codex dispatch admission', () => {
     await expect(send(adapter, 'client-unknown', 1_700_000_000_100)).rejects.toThrow(
       'request timed out after write'
     )
-    await send(adapter, 'client-later', 1_700_000_000_400)
-    startTurn(connection, 'turn-later')
+    const later = send(adapter, 'client-later', 1_700_000_000_400)
+    await openAfterTurnStarts(connection, 2, () => startTurn(connection, 'turn-later'))
+    await later
     echoUserMessage(connection, {
       turnId: 'turn-later',
       itemId: 'item-later',
@@ -269,9 +281,10 @@ describe('codex dispatch admission', () => {
     const adapter = await acquiredCodexAdapter({ codex, settlements, sink: recorded.sink })
     const connection = codex.connections[0]!
 
-    await send(adapter, 'client-opening', 1_700_000_000_600)
-    await send(adapter, 'client-queued', 1_700_000_000_200)
-    startTurn(connection, 'turn-1')
+    const opening = send(adapter, 'client-opening', 1_700_000_000_600)
+    const queued = send(adapter, 'client-queued', 1_700_000_000_200)
+    await openAfterTurnStarts(connection, 2, () => startTurn(connection, 'turn-1'))
+    await Promise.all([opening, queued])
     await send(adapter, 'client-mid-turn', 1_700_000_000_100)
 
     echoUserMessage(connection, {
@@ -315,8 +328,9 @@ describe('codex dispatch admission', () => {
     const adapter = await acquiredCodexAdapter({ codex, settlements, sink: recorded.sink })
     const connection = codex.connections[0]!
 
-    await send(adapter, 'client-late-echo', 1_700_000_000_100)
-    startTurn(connection, 'turn-1')
+    const sending = send(adapter, 'client-late-echo', 1_700_000_000_100)
+    await openAfterTurnStarts(connection, 1, () => startTurn(connection, 'turn-1'))
+    await sending
     connection.handlers.onNotification?.('turn/completed', {
       threadId: CODEX_TEST_THREAD_ID,
       turn: { id: 'turn-1' }
@@ -347,7 +361,8 @@ describe('codex dispatch admission', () => {
     }
     expect(await send(adapter, 'client-overflow')).toEqual({
       state: 'rejected',
-      reason: 'codex structured dispatch queue is full'
+      reason: 'codex structured dispatch queue is full',
+      rejection: { kind: 'queueFull' }
     })
 
     echoUserMessage(connection, { turnId: 'turn-1', itemId: 'item-u0', clientId: 'client-0' })
diff --git a/src/main/codex/codex-structured-dispatch-echo.test.ts b/src/main/codex/codex-structured-dispatch-echo.test.ts
index 94826c1df12..a6791e5e788 100644
--- a/src/main/codex/codex-structured-dispatch-echo.test.ts
+++ b/src/main/codex/codex-structured-dispatch-echo.test.ts
@@ -126,3 +126,44 @@ describe('readCodexDispatchEcho', () => {
     ).toBeNull()
   })
 })
+
+describe('the turn Codex answered a send into but has not opened', () => {
+  const NONE_OPEN = new Set<string>()
+
+  it('is the turn the latest armed send was answered into', () => {
+    const echoes = createCodexDispatchEchoes()
+    echoes.arm('client-1')
+    echoes.bindTurn('client-1', 'thread-1', 'turn-1')
+    echoes.arm('client-2')
+    echoes.bindTurn('client-2', 'thread-1', 'turn-2')
+
+    expect(echoes.answeredUnopenedTurn('thread-1', NONE_OPEN)).toBe('turn-2')
+  })
+
+  it('is none once Codex opened that turn', () => {
+    const echoes = createCodexDispatchEchoes()
+    echoes.arm('client-1')
+    echoes.bindTurn('client-1', 'thread-1', 'turn-1')
+
+    expect(echoes.answeredUnopenedTurn('thread-1', new Set(['turn-1']))).toBeNull()
+  })
+
+  it('is none once that turn ended, even with its send still armed for an echo', () => {
+    const echoes = createCodexDispatchEchoes()
+    echoes.arm('client-1')
+    echoes.bindTurn('client-1', 'thread-1', 'turn-1')
+    // A completed end leaves its unechoed send armed.
+    expect(echoes.endTurn('thread-1', 'turn-1', { status: 'completed' })).toEqual([])
+
+    expect(echoes.answeredUnopenedTurn('thread-1', NONE_OPEN)).toBeNull()
+  })
+
+  it('is none for a send not yet answered, or answered on another thread', () => {
+    const echoes = createCodexDispatchEchoes()
+    echoes.arm('client-1')
+    echoes.arm('client-2')
+    echoes.bindTurn('client-2', 'thread-2', 'turn-2')
+
+    expect(echoes.answeredUnopenedTurn('thread-1', NONE_OPEN)).toBeNull()
+  })
+})
diff --git a/src/main/codex/codex-structured-dispatch-echo.ts b/src/main/codex/codex-structured-dispatch-echo.ts
index 4ecfcf2da01..0d3794b5136 100644
--- a/src/main/codex/codex-structured-dispatch-echo.ts
+++ b/src/main/codex/codex-structured-dispatch-echo.ts
@@ -1,8 +1,17 @@
+import type { ProviderDiagnostic } from '../../shared/agent-session-failure'
 import type { AgentJournalItemIdentity } from '../../shared/agent-session-journal-types'
 
-/** Sends awaiting their echo. A send whose echo never arrives is
- *  retired by the journal's pending-submission recovery on exit, not from here. */
+/** Sends awaiting their echo. One bound to a turn that ended without taking it settles from that
+ *  end; any other whose echo never arrives is retired by the journal's recovery on exit. */
 export const MAX_CODEX_PENDING_DISPATCH_ECHOES = 256
+/** Turn ends kept for an answer read after the turn it names had already ended. */
+export const MAX_CODEX_RECORDED_TURN_ENDS = 64
+
+/** How a primary-thread turn ended, as Codex reported it. */
+export type CodexTurnEnd =
+  | { status: 'completed' }
+  | { status: 'interrupted' }
+  | { status: 'failed'; detail?: ProviderDiagnostic }
 
 export type CodexDispatchRequestOrigin = {
   requestedAt: number
@@ -24,6 +33,19 @@ export type CodexDispatchEchoes = {
   settle: (clientMessageId: string) => boolean
   /** Drops an armed send whose write never reached the provider. */
   disarm: (clientMessageId: string) => void
+  /**
+   * Binds a send to the turn Codex answered it into. Returns that turn's end when the answer is
+   * read after it; a send that end settles is no longer armed.
+   */
+  bindTurn: (clientMessageId: string, threadId: string, turnId: string) => CodexTurnEnd | null
+  /** The turn the latest armed send was answered into that is neither in `openTurnIds` nor ended:
+   *  one Codex has picked for the send but not opened. */
+  answeredUnopenedTurn: (threadId: string, openTurnIds: ReadonlySet<string>) => string | null
+  /**
+   * Records a turn's end and returns the sends bound to it that it settles: all of them unless it
+   * completed, which echoes its pending input first, so one it never echoed waits for recovery.
+   */
+  endTurn: (threadId: string, turnId: string, end: CodexTurnEnd) => string[]
   /** Submission origin for this exact send, retained until its echo settles it. */
   requestOrigin: (clientMessageId: string) => CodexDispatchRequestOrigin | null
   /** Highest causal sequence assigned to a dispatch in this session. */
@@ -33,8 +55,14 @@ export type CodexDispatchEchoes = {
 }
 
 export function createCodexDispatchEchoes(): CodexDispatchEchoes {
-  const armed = new Map<string, { requestedAt: number | null; sequence: number }>()
+  const armed = new Map<
+    string,
+    { requestedAt: number | null; sequence: number; turn?: { threadId: string; turnId: string } }
+  >()
+  const endedTurns = new Map<string, CodexTurnEnd>()
   let nextSequence = 0
+  const turnKey = (threadId: string, turnId: string): string => JSON.stringify([threadId, turnId])
+  const settles = (end: CodexTurnEnd): boolean => end.status !== 'completed'
   return {
     arm(clientMessageId, requestedAt) {
       const existing = armed.get(clientMessageId)
@@ -52,6 +80,51 @@ export function createCodexDispatchEchoes(): CodexDispatchEchoes {
     },
     settle: (clientMessageId) => armed.delete(clientMessageId),
     disarm: (clientMessageId) => void armed.delete(clientMessageId),
+    bindTurn: (clientMessageId, threadId, turnId) => {
+      const entry = armed.get(clientMessageId)
+      if (!entry) {
+        return null
+      }
+      entry.turn = { threadId, turnId }
+      const end = endedTurns.get(turnKey(threadId, turnId)) ?? null
+      if (end && settles(end)) {
+        armed.delete(clientMessageId)
+      }
+      return end
+    },
+    answeredUnopenedTurn: (threadId, openTurnIds) => {
+      const answered = [...armed.values()].flatMap(({ turn }) =>
+        turn?.threadId === threadId &&
+        !openTurnIds.has(turn.turnId) &&
+        !endedTurns.has(turnKey(threadId, turn.turnId))
+          ? [turn.turnId]
+          : []
+      )
+      return answered.at(-1) ?? null
+    },
+    endTurn: (threadId, turnId, end) => {
+      const turn = turnKey(threadId, turnId)
+      endedTurns.delete(turn)
+      endedTurns.set(turn, end)
+      for (const oldest of endedTurns.keys()) {
+        if (endedTurns.size <= MAX_CODEX_RECORDED_TURN_ENDS) {
+          break
+        }
+        endedTurns.delete(oldest)
+      }
+      if (!settles(end)) {
+        return []
+      }
+      const settled = [...armed].flatMap(([clientMessageId, entry]) =>
+        entry.turn && turnKey(entry.turn.threadId, entry.turn.turnId) === turn
+          ? [clientMessageId]
+          : []
+      )
+      for (const clientMessageId of settled) {
+        armed.delete(clientMessageId)
+      }
+      return settled
+    },
     requestOrigin: (clientMessageId) => {
       const origin = armed.get(clientMessageId)
       return origin?.requestedAt === null || origin === undefined
@@ -61,6 +134,7 @@ export function createCodexDispatchEchoes(): CodexDispatchEchoes {
     latestSequence: () => nextSequence - 1,
     clear: () => {
       armed.clear()
+      endedTurns.clear()
       nextSequence = 0
     },
     get size() {
diff --git a/src/main/codex/codex-structured-dispatch-test-support.ts b/src/main/codex/codex-structured-dispatch-test-support.ts
index 42efd57bab4..86f19349ee2 100644
--- a/src/main/codex/codex-structured-dispatch-test-support.ts
+++ b/src/main/codex/codex-structured-dispatch-test-support.ts
@@ -1,5 +1,5 @@
+import { expect, vi } from 'vitest'
 import type {
-  AgentJournalItemIdentity,
   AgentJournalMessageItem,
   AgentSessionJournalIdentity
 } from '../../shared/agent-session-journal-types'
@@ -11,6 +11,7 @@ import type {
 } from './codex-app-server-connection'
 import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
 import { CodexStructuredSessionAdapter } from './codex-structured-session-adapter'
+import { codexTurnLifecycleFake } from './codex-turn-lifecycle-fake'
 import type { CodexStructuredSessionAdapterDeps } from './codex-structured-session-state'
 
 export const CODEX_TEST_THREAD_ID = 'thread-abc'
@@ -30,11 +31,9 @@ type FakeConnection = Omit<CodexAppServerConnection, 'closed'> & {
   calls: { method: string; params?: Record<string, unknown> }[]
 }
 
-export type LateSettlement = {
-  sessionId: string
-  clientMessageId: string
-  providerIdentity: AgentJournalItemIdentity
-}
+export type LateSettlement = Parameters<
+  NonNullable<CodexStructuredSessionAdapterDeps['onDispatchSettledLate']>
+>[0]
 
 /** A `codex app-server` whose turn traffic the test drives by hand. */
 export function fakeCodexAppServer(routes: Record<string, CodexTestRoute> = {}): {
@@ -86,6 +85,7 @@ export async function acquiredCodexAdapter(input: {
   settlements: LateSettlement[]
   sink?: StructuredAgentSessionEventSink
   captureTurnProcesses?: CodexStructuredSessionAdapterDeps['captureTurnProcesses']
+  requestTimeoutMs?: number
 }): Promise<CodexStructuredSessionAdapter> {
   const adapter = new CodexStructuredSessionAdapter({
     resolveLaunch: async () => ({
@@ -98,8 +98,11 @@ export async function acquiredCodexAdapter(input: {
     openConnection: input.codex.openConnection,
     readProcessStartTime: async () => 1_700_000_000_000,
     captureTurnProcesses: input.captureTurnProcesses ?? (async () => null),
+    // A Stop must never reach for real processes on this machine under the fake pid.
+    terminateTurnProcesses: async () => true,
     now: () => 1_700_000_000_500,
-    onDispatchSettledLate: (settlement) => input.settlements.push(settlement)
+    onDispatchSettledLate: (settlement) => input.settlements.push(settlement),
+    ...(input.requestTimeoutMs === undefined ? {} : { requestTimeoutMs: input.requestTimeoutMs })
   })
   const identity: AgentSessionJournalIdentity = {
     sessionId: 'session-1',
@@ -133,9 +136,50 @@ export function echoUserMessage(
   })
 }
 
-export function startTurn(connection: FakeConnection, turnId: string): void {
+export function startTurn(connection: Pick<FakeConnection, 'handlers'>, turnId: string): void {
   connection.handlers.onNotification?.('turn/started', {
     threadId: CODEX_TEST_THREAD_ID,
     turn: { id: turnId }
   })
 }
+
+/** Runs `open` once `count` sends reached Codex, which opens a turn only after it answers. */
+export async function openAfterTurnStarts(
+  connection: Pick<FakeConnection, 'calls'>,
+  count: number,
+  open: () => void
+): Promise<void> {
+  await vi.waitFor(() =>
+    expect(connection.calls.filter((call) => call.method === 'turn/start')).toHaveLength(count)
+  )
+  open()
+}
+
+/** An acquired adapter over a fake Codex that keeps Codex's own turn bookkeeping. */
+export async function codexTurnLifecycleRig(options: { requestTimeoutMs?: number } = {}) {
+  const codex = fakeCodexAppServer()
+  const notify = (method: string, params: unknown): void =>
+    codex.connections.at(-1)?.handlers.onNotification?.(method, params)
+  const turns = codexTurnLifecycleFake(CODEX_TEST_THREAD_ID, () => notify)
+  Object.assign(codex.routes, turns.routes)
+  const settlements: LateSettlement[] = []
+  const adapter = await acquiredCodexAdapter({ codex, settlements, ...options })
+  const send = (clientMessageId: string) =>
+    adapter.dispatch({
+      sessionId: 'session-1',
+      clientMessageId,
+      body: CODEX_TEST_USER_MESSAGE,
+      fence: 7
+    })
+  const interrupts = () =>
+    codex.connections[0]!.calls.filter((call) => call.method === 'turn/interrupt')
+  return { codex, turns, adapter, send, settlements, notify, interrupts }
+}
+
+/** The promise's value, or `held` when it has not settled `withinMs` after every earlier task. */
+export function settledWithin<T>(promise: Promise<T>, withinMs = 50): Promise<T | 'held'> {
+  return Promise.race([
+    promise,
+    new Promise<'held'>((resolve) => setTimeout(() => resolve('held'), withinMs))
+  ])
+}
diff --git a/src/main/codex/codex-structured-fast-mode.test.ts b/src/main/codex/codex-structured-fast-mode.test.ts
index 3029bff280b..73f279bd2c0 100644
--- a/src/main/codex/codex-structured-fast-mode.test.ts
+++ b/src/main/codex/codex-structured-fast-mode.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it, vi } from 'vitest'
 import {
   USER_MESSAGE,
   adapterFor,
+  answerWithOpenedTurn,
   fakeCodex,
   identityFor,
   type Route
@@ -19,9 +20,9 @@ describe('Codex structured Fast mode dispatch', () => {
           }
         ],
         nextCursor: null
-      }),
-      'turn/start': () => ({ turn: { id: 'turn-fast' } })
+      })
     })
+    codex.routes['turn/start'] = answerWithOpenedTurn(codex, 'turn-fast')
     const adapter = adapterFor(codex)
     await adapter.acquire({
       identity: identityFor('session-1'),
@@ -43,7 +44,8 @@ describe('Codex structured Fast mode dispatch', () => {
   })
 
   it('uses Standard on the first turn after acquisition with Fast explicitly off', async () => {
-    const codex = fakeCodex({ 'turn/start': () => ({ turn: { id: 'turn-standard' } }) })
+    const codex = fakeCodex()
+    codex.routes['turn/start'] = answerWithOpenedTurn(codex, 'turn-standard')
     const adapter = adapterFor(codex)
     await adapter.acquire({
       identity: identityFor('session-1'),
@@ -91,10 +93,8 @@ describe('Codex structured Fast mode dispatch', () => {
         ],
         nextCursor: null
       }))
-      const codex = fakeCodex({
-        'model/list': listModels,
-        'turn/start': () => ({ turn: { id: 'turn-recovered' } })
-      })
+      const codex = fakeCodex({ 'model/list': listModels })
+      codex.routes['turn/start'] = answerWithOpenedTurn(codex, 'turn-recovered')
       const adapter = adapterFor(codex)
       await expect(
         adapter.acquire({
diff --git a/src/main/codex/codex-structured-item-stream-contracts.ts b/src/main/codex/codex-structured-item-stream-contracts.ts
index ebbd05731d4..733a81455c3 100644
--- a/src/main/codex/codex-structured-item-stream-contracts.ts
+++ b/src/main/codex/codex-structured-item-stream-contracts.ts
@@ -2,7 +2,7 @@ import type { AgentJournalItemIdentity } from '../../shared/agent-session-journa
 import type { AgentSessionDeltaCoalescerDeps } from '../native-chat/agent-session-wire/agent-session-delta-coalescer'
 import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
 import type { codexJournalItem, CodexThreadItem } from './codex-structured-item-translation'
-import type { CodexRowLinkage } from './codex-subagent-linkage'
+import type { CodexRowAttribution } from './codex-subagent-linkage'
 
 export type CodexItemStreamDeps = {
   sink: StructuredAgentSessionEventSink
@@ -13,7 +13,7 @@ export type CodexItemStreamDeps = {
     turnId: string | null,
     item: CodexThreadItem
   ) => AgentJournalItemIdentity
-  linkageFor: CodexRowLinkage
+  attributionFor: CodexRowAttribution
   coalesceMs?: number
   maxRetainedBytes?: number
   maxTotalRetainedBytes?: number
diff --git a/src/main/codex/codex-structured-item-streams.ts b/src/main/codex/codex-structured-item-streams.ts
index 03085bf6913..306fcf27619 100644
--- a/src/main/codex/codex-structured-item-streams.ts
+++ b/src/main/codex/codex-structured-item-streams.ts
@@ -1,4 +1,8 @@
 import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalRowAttribution
+} from '../../shared/agent-session-journal-types'
 import { createAgentSessionDeltaCoalescer } from '../native-chat/agent-session-wire/agent-session-delta-coalescer'
 import { CodexItemStreamRetention } from './codex-item-stream-retention'
 import { appendCodexItemAndPublish } from './codex-structured-journal-sink'
@@ -51,12 +55,14 @@ export function createCodexStructuredItemStreams(
   const states = new CodexItemStreamRetention(deps.maxMetadataBytes)
   const checkpointLengths = new Map<string, number>()
   const pendingCheckpoints = new Set<string>()
-  // Which thread and turn produced each stream, resolved to linkage per append
+  // Which thread and turn produced each stream, resolved to its attribution per append
   // so a parent learned after the first checkpoint still reaches the row.
   const producers = new Map<string, { threadId: string; turnId: string | null }>()
-  const linkageOf = (key: string) => {
+  const attributionOf = (key: string): AgentJournalRowAttribution => {
     const producer = producers.get(key)
-    return producer ? deps.linkageFor(producer.threadId, producer.turnId) : {}
+    return producer
+      ? deps.attributionFor(producer.threadId, producer.turnId)
+      : { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   }
   // Patch updates are authoritative item snapshots. Keep the latest rejected
   // snapshot until the journal admits it; unlike streamed deltas, there is no
@@ -114,7 +120,7 @@ export function createCodexStructuredItemStreams(
     }
     return appendCodexItemAndPublish(deps.sink, state.identity, translated.body, {
       coalescingKey: `checkpoint:${agentJournalItemKey(state.identity)}`,
-      ...linkageOf(key)
+      ...attributionOf(key)
     }).accepted
   }
 
@@ -191,7 +197,7 @@ export function createCodexStructuredItemStreams(
       deps.sink,
       pending.identity,
       pending.body,
-      linkageOf(key)
+      attributionOf(key)
     )
     if (!admission.accepted) {
       return admission
diff --git a/src/main/codex/codex-structured-journal-compactions.test.ts b/src/main/codex/codex-structured-journal-compactions.test.ts
index b86cea2725d..4da87a0c75f 100644
--- a/src/main/codex/codex-structured-journal-compactions.test.ts
+++ b/src/main/codex/codex-structured-journal-compactions.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../shared/agent-session-journal-types'
 import { describe, expect, it } from 'vitest'
 import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
 import type { AgentJournalItemBody } from '../../shared/agent-session-journal-types'
@@ -82,7 +83,7 @@ describe('compaction provider generation compatibility', () => {
       if (stage === 'append' && reject) {
         return { accepted: false, reason: 'backpressure' }
       }
-      sink.appendItem(identity, body)
+      sink.appendItem(identity, body, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
       return { accepted: true }
     }
     sink.tryPublish = () => {
diff --git a/src/main/codex/codex-structured-journal-compactions.ts b/src/main/codex/codex-structured-journal-compactions.ts
index 9aa2e8f4cf1..61743c1996c 100644
--- a/src/main/codex/codex-structured-journal-compactions.ts
+++ b/src/main/codex/codex-structured-journal-compactions.ts
@@ -1,5 +1,4 @@
 import { createHash } from 'node:crypto'
-import { isCodexCompactionComplete } from '../native-chat/agent-session-wire/structured-session-compaction'
 import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
 import {
   CODEX_JOURNAL_ADMITTED,
@@ -8,7 +7,16 @@ import {
 import { MAX_CODEX_GENERIC_TURN_BUCKETS } from './codex-structured-journal-limits'
 import { appendCodexLifecycleItem, publishCodexLifecycle } from './codex-structured-journal-sink'
 import { readCodexTurnId } from './codex-structured-thread-facts'
-import type { CodexRowLinkage } from './codex-subagent-linkage'
+import { readRecord } from './codex-item-field-readers'
+import type { CodexRowAttribution } from './codex-subagent-linkage'
+
+function isCodexCompactionComplete(method: string, params: unknown): boolean {
+  return (
+    method === 'thread/compacted' ||
+    (method === 'item/completed' &&
+      readRecord(readRecord(params).item).type === 'contextCompaction')
+  )
+}
 
 export class CodexJournalCompactions {
   private readonly turns = new Map<string, 'item' | 'legacy'>()
@@ -16,7 +24,9 @@ export class CodexJournalCompactions {
   constructor(
     private readonly sink: StructuredAgentSessionEventSink,
     private readonly activeTurn: (threadId: string) => string | null,
-    private readonly linkageFor: CodexRowLinkage
+    private readonly attributionFor: CodexRowAttribution,
+    /** Evidence for a conversation command the turn carries; its marker is the command's result. */
+    private readonly compacted: (turnId: string) => void
   ) {}
 
   handle(event: {
@@ -31,6 +41,7 @@ export class CodexJournalCompactions {
     if (!turnId) {
       return null
     }
+    this.compacted(turnId)
     // Collapse compactions within a thread/turn; the canonical item replaces its legacy fallback.
     const key = createHash('sha256')
       .update(JSON.stringify([event.threadId, turnId]))
@@ -44,7 +55,7 @@ export class CodexJournalCompactions {
       this.sink,
       { provider: 'orca', clientMessageId: `codex-compaction:${key}` },
       { kind: 'status', text: 'Context compacted', presentation: 'compaction' },
-      this.linkageFor(event.threadId, turnId)
+      this.attributionFor(event.threadId, turnId)
     )
     if (!admission.accepted) {
       return admission
diff --git a/src/main/codex/codex-structured-journal-contracts.ts b/src/main/codex/codex-structured-journal-contracts.ts
index 28b5583a9b4..74cf5013aff 100644
--- a/src/main/codex/codex-structured-journal-contracts.ts
+++ b/src/main/codex/codex-structured-journal-contracts.ts
@@ -4,6 +4,7 @@ import type { AgentSessionDeltaCoalescerDeps } from '../native-chat/agent-sessio
 import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
 import type { CodexStructuredSessionEvent } from './codex-structured-session-adapter'
 import type { CodexSubagentExecutions } from './codex-subagent-executions'
+import type { StructuredAgentSessionCommandRun } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
 
 export type CodexJournalTranslatorDeps = {
   sink: StructuredAgentSessionEventSink
@@ -34,6 +35,13 @@ export type CodexJournalTranslatorDeps = {
 
 export type CodexJournalTranslator = {
   handle: (event: CodexStructuredSessionEvent) => CodexJournalTranslationAdmission
+  /** Before Orca sends a conversation command: the next primary turn carries it out, and that
+   *  turn's end is the command's. */
+  beginCommand: (command: StructuredAgentSessionCommandRun) => void
+  /** The command was never taken. */
+  forgetCommand: (turnId: string) => void
+  /** The provider turn a Stop naming `turnId` interrupts; undefined while a command has none. */
+  commandProviderTurnId: (turnId: string) => string | undefined
   cancelPrompt: (journalItemId: string) => CodexJournalTranslationAdmission
   restoreThread: (
     threadId: string,
diff --git a/src/main/codex/codex-structured-journal-generic-frames.ts b/src/main/codex/codex-structured-journal-generic-frames.ts
index 7d9f54462fc..a8b400a6d93 100644
--- a/src/main/codex/codex-structured-journal-generic-frames.ts
+++ b/src/main/codex/codex-structured-journal-generic-frames.ts
@@ -12,7 +12,8 @@ import {
   MAX_CODEX_GENERIC_TURN_BUCKETS
 } from './codex-structured-journal-limits'
 import { readCodexTurnId } from './codex-structured-thread-facts'
-import type { CodexRowLinkage } from './codex-subagent-linkage'
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../shared/agent-session-journal-types'
+import type { CodexRowAttribution } from './codex-subagent-linkage'
 
 const OVERFLOW_BUCKET = '__codex-generic-overflow__'
 /** `producer` is absent only on the overflow bucket, which pools every thread's
@@ -59,7 +60,7 @@ export class CodexJournalGenericFrames {
 
   constructor(
     private readonly deps: Pick<CodexJournalTranslatorDeps, 'sink' | 'schedule' | 'coalesceMs'> & {
-      linkageFor: CodexRowLinkage
+      attributionFor: CodexRowAttribution
     },
     private readonly activeTurn: (threadId: string) => string | null
   ) {
@@ -102,10 +103,10 @@ export class CodexJournalGenericFrames {
       provider: 'orca' as const,
       clientMessageId: `provider-frame:codex:${this.fallbackSequence}`
     }
-    const linkage = this.deps.linkageFor(threadId, frameTurnId)
+    const attribution = this.deps.attributionFor(threadId, frameTurnId)
     const admission = this.deps.sink.tryAppendItem
-      ? this.deps.sink.tryAppendItem(identity, translated.body, linkage)
-      : (this.deps.sink.appendItem(identity, translated.body, linkage), CODEX_JOURNAL_ADMITTED)
+      ? this.deps.sink.tryAppendItem(identity, translated.body, attribution)
+      : (this.deps.sink.appendItem(identity, translated.body, attribution), CODEX_JOURNAL_ADMITTED)
     if (!admission.accepted) {
       this.fallbackSequence -= 1
       return admission
@@ -139,11 +140,12 @@ export class CodexJournalGenericFrames {
         provider: 'orca' as const,
         clientMessageId: `provider-frame-suppressed:codex:${bucket}`
       }
+      // A summary across evicted turns names no producer and belongs to no turn.
       const options = {
         coalescingKey: `provider-frame-suppressed:codex:${bucket}`,
         ...(summary.producer
-          ? this.deps.linkageFor(summary.producer.threadId, summary.producer.turnId)
-          : {})
+          ? this.deps.attributionFor(summary.producer.threadId, summary.producer.turnId)
+          : { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
       }
       const admission = this.deps.sink.tryAppendItem
         ? this.deps.sink.tryAppendItem(identity, { kind: 'status', text }, options)
diff --git a/src/main/codex/codex-structured-journal-goal-admission.test.ts b/src/main/codex/codex-structured-journal-goal-admission.test.ts
index b0a9e50ba2c..f2a3a9b166c 100644
--- a/src/main/codex/codex-structured-journal-goal-admission.test.ts
+++ b/src/main/codex/codex-structured-journal-goal-admission.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../shared/agent-session-journal-types'
 import { describe, expect, it } from 'vitest'
 import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
 import type {
@@ -137,7 +138,7 @@ describe('codex goal lifecycle admission', () => {
       appendTombstone: () => {},
       publish: () => {}
     } satisfies StructuredAgentSessionEventSink
-    const goals = new CodexJournalGoals(sink, () => ({}))
+    const goals = new CodexJournalGoals(sink, () => ({ turnScope: AGENT_JOURNAL_THREAD_SCOPE }))
     const update = (goal: Record<string, unknown> = {}) =>
       goals.handle({ threadId: THREAD, method: 'thread/goal/updated', params: goalFrame(goal) })
     const clear = () =>
@@ -178,7 +179,7 @@ describe('codex goal lifecycle admission', () => {
       appendTombstone: () => {},
       publish: () => {}
     } satisfies StructuredAgentSessionEventSink
-    const goals = new CodexJournalGoals(sink, () => ({}))
+    const goals = new CodexJournalGoals(sink, () => ({ turnScope: AGENT_JOURNAL_THREAD_SCOPE }))
     const send = (threadId: string) =>
       goals.handle({ threadId, method: 'thread/goal/updated', params: goalFrame() })
 
@@ -211,7 +212,7 @@ describe('codex goal lifecycle admission', () => {
       appendTombstone: () => {},
       publish: () => {}
     } satisfies StructuredAgentSessionEventSink
-    const goals = new CodexJournalGoals(sink, () => ({}))
+    const goals = new CodexJournalGoals(sink, () => ({ turnScope: AGENT_JOURNAL_THREAD_SCOPE }))
     const event = { threadId: THREAD, method: 'thread/goal/updated', params: goalFrame() }
 
     goals.handle(event)
diff --git a/src/main/codex/codex-structured-journal-goal-resume.test.ts b/src/main/codex/codex-structured-journal-goal-resume.test.ts
index 4609a06fb0d..6df0ba01575 100644
--- a/src/main/codex/codex-structured-journal-goal-resume.test.ts
+++ b/src/main/codex/codex-structured-journal-goal-resume.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../shared/agent-session-journal-types'
 import { describe, expect, it } from 'vitest'
 import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
 import type {
@@ -130,7 +131,9 @@ describe('codex goal lifecycle resume', () => {
   it('does not append a cleared snapshot when the journal has no prior goal occurrence', async () => {
     const journal = goalJournal()
     journal.unbind()
-    const resumed = new CodexJournalGoals(journal.sink, () => ({}))
+    const resumed = new CodexJournalGoals(journal.sink, () => ({
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    }))
 
     expect(
       resumed.handle({
@@ -151,7 +154,9 @@ describe('codex goal lifecycle resume', () => {
 
   it('does not revisit durable history for accounting-only updates', async () => {
     const journal = goalJournal()
-    const goals = new CodexJournalGoals(journal.sink, () => ({}))
+    const goals = new CodexJournalGoals(journal.sink, () => ({
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    }))
     goals.handle({ threadId: THREAD, method: 'thread/goal/updated', params: goalFrame() })
     await journal.drained()
     const visits = journal.visits()
@@ -176,7 +181,9 @@ describe('codex goal lifecycle resume', () => {
 
   it('rebuilds dedupe state after the journal epoch is replaced', async () => {
     const journal = goalJournal()
-    const goals = new CodexJournalGoals(journal.sink, () => ({}))
+    const goals = new CodexJournalGoals(journal.sink, () => ({
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    }))
     const event = { threadId: THREAD, method: 'thread/goal/updated', params: goalFrame() }
 
     goals.handle(event)
@@ -198,7 +205,9 @@ describe('codex goal lifecycle resume', () => {
   it('visits a large journal once per epoch when thread churn exceeds the transient LRU', async () => {
     const journal = goalJournal()
     journal.seedProviderItems(10_000)
-    const goals = new CodexJournalGoals(journal.sink, () => ({}))
+    const goals = new CodexJournalGoals(journal.sink, () => ({
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    }))
     const threadCount = MAX_CODEX_GOAL_THREADS + 1
     const sendRound = () => {
       for (let index = 0; index < threadCount; index += 1) {
@@ -227,7 +236,9 @@ describe('codex goal lifecycle resume', () => {
     const journal = goalJournal()
     journal.seedProviderItems(10_000)
     journal.unbind()
-    const goals = new CodexJournalGoals(journal.sink, () => ({}))
+    const goals = new CodexJournalGoals(journal.sink, () => ({
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    }))
 
     for (let index = 0; index < MAX_CODEX_GOAL_THREADS; index += 1) {
       goals.handle({
@@ -249,7 +260,9 @@ describe('codex goal lifecycle resume', () => {
 
   it('retries a journal-derived transition after lifecycle backpressure', async () => {
     const journal = goalJournal({ watermarks: { maxLifecycleQueuedOperations: 1 } })
-    const goals = new CodexJournalGoals(journal.sink, () => ({}))
+    const goals = new CodexJournalGoals(journal.sink, () => ({
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    }))
     journal.unbind()
 
     expect(
@@ -317,7 +330,9 @@ describe('codex goal lifecycle resume', () => {
       })
     }
 
-    const prior = new CodexJournalGoals(journal.sink, () => ({}))
+    const prior = new CodexJournalGoals(journal.sink, () => ({
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    }))
     for (const state of scenario.beforeResume) {
       send(prior, state)
     }
@@ -329,7 +344,9 @@ describe('codex goal lifecycle resume', () => {
     prior.dispose()
     journal.unbind()
 
-    const resumed = new CodexJournalGoals(journal.sink, () => ({}))
+    const resumed = new CodexJournalGoals(journal.sink, () => ({
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    }))
     resumed.handle({
       threadId: THREAD,
       method: scenario.resumed.method,
diff --git a/src/main/codex/codex-structured-journal-goal-revision.test.ts b/src/main/codex/codex-structured-journal-goal-revision.test.ts
index e6f96ad5503..2fbe33ab901 100644
--- a/src/main/codex/codex-structured-journal-goal-revision.test.ts
+++ b/src/main/codex/codex-structured-journal-goal-revision.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../shared/agent-session-journal-types'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -93,10 +94,10 @@ describe('codex goal accounting revisions', () => {
     await journal.appendItem(
       { provider: 'orca', clientMessageId: 'earlier' },
       { kind: 'status', text: 'Context compacted' },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     const { sink, drained, subscribe, published } = journalSink(journal)
-    const goals = new CodexJournalGoals(sink, () => ({}))
+    const goals = new CodexJournalGoals(sink, () => ({ turnScope: AGENT_JOURNAL_THREAD_SCOPE }))
 
     goals.handle({ threadId: THREAD, method: 'thread/goal/updated', params: goalFrame() })
     await drained()
@@ -104,7 +105,7 @@ describe('codex goal accounting revisions', () => {
     await journal.appendItem(
       { provider: 'orca', clientMessageId: 'later' },
       { kind: 'status', text: 'Something after the goal' },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     subscribe()
 
@@ -160,14 +161,18 @@ describe('codex goal accounting revisions', () => {
     root = await mkdtemp(join(tmpdir(), 'orca-goal-resume-revision-'))
     const journal = await journals.open({ identity: IDENTITY, journalDir: root })
     const first = journalSink(journal)
-    const prior = new CodexJournalGoals(first.sink, () => ({}))
+    const prior = new CodexJournalGoals(first.sink, () => ({
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    }))
     prior.handle({ threadId: THREAD, method: 'thread/goal/updated', params: goalFrame() })
     await first.drained()
     prior.dispose()
     const [created] = journal.snapshot().items
 
     const second = journalSink(journal)
-    const resumed = new CodexJournalGoals(second.sink, () => ({}))
+    const resumed = new CodexJournalGoals(second.sink, () => ({
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    }))
     // Only a few seconds more: a resume snapshot still refreshes, since no live tick follows.
     const snapshot = goalFrame({ timeUsedSeconds: 3, updatedAt: 1789067991 })
     resumed.handle({ threadId: THREAD, method: 'thread/goal/updated', params: snapshot })
diff --git a/src/main/codex/codex-structured-journal-goal-rows.test.ts b/src/main/codex/codex-structured-journal-goal-rows.test.ts
index ff234c7d5fb..053376e30e0 100644
--- a/src/main/codex/codex-structured-journal-goal-rows.test.ts
+++ b/src/main/codex/codex-structured-journal-goal-rows.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../shared/agent-session-journal-types'
 import { describe, expect, it, vi } from 'vitest'
 import type { AgentJournalItemBody } from '../../shared/agent-session-journal-types'
 import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
@@ -35,8 +36,11 @@ function frames(): {
     },
     publish: vi.fn()
   } as unknown as StructuredAgentSessionEventSink
-  const goals = new CodexJournalGoals(sink, () => ({}))
-  const generic = new CodexJournalGenericFrames({ sink, linkageFor: () => ({}) }, () => null)
+  const goals = new CodexJournalGoals(sink, () => ({ turnScope: AGENT_JOURNAL_THREAD_SCOPE }))
+  const generic = new CodexJournalGenericFrames(
+    { sink, attributionFor: () => ({ turnScope: AGENT_JOURNAL_THREAD_SCOPE }) },
+    () => null
+  )
   return {
     rows,
     frames: {
diff --git a/src/main/codex/codex-structured-journal-goals.ts b/src/main/codex/codex-structured-journal-goals.ts
index 681a483c12f..d73b163765e 100644
--- a/src/main/codex/codex-structured-journal-goals.ts
+++ b/src/main/codex/codex-structured-journal-goals.ts
@@ -24,7 +24,7 @@ import {
 } from './codex-structured-journal-contracts'
 import { MAX_CODEX_GOAL_THREADS } from './codex-structured-journal-limits'
 import { appendCodexLifecycleTransition } from './codex-structured-journal-sink'
-import type { CodexRowLinkage } from './codex-subagent-linkage'
+import type { CodexRowAttribution } from './codex-subagent-linkage'
 
 type GoalAccounting = { key: string; timeUsedSeconds: number; tokenBudget: number | null }
 
@@ -70,7 +70,7 @@ export class CodexJournalGoals {
 
   constructor(
     private readonly sink: StructuredAgentSessionEventSink,
-    private readonly linkageFor: CodexRowLinkage
+    private readonly attributionFor: CodexRowAttribution
   ) {}
 
   handle(event: {
@@ -132,7 +132,7 @@ export class CodexJournalGoals {
           event.method === 'thread/goal/cleared'
         ),
       // A goal belongs to its thread, not to one run of it, so no turn is named.
-      this.linkageFor(event.threadId, null)
+      this.attributionFor(event.threadId, null)
     )
     if (!admission.accepted) {
       return admission
diff --git a/src/main/codex/codex-structured-journal-items.ts b/src/main/codex/codex-structured-journal-items.ts
index 6717f3edabe..4e6ebe8e5e0 100644
--- a/src/main/codex/codex-structured-journal-items.ts
+++ b/src/main/codex/codex-structured-journal-items.ts
@@ -1,7 +1,7 @@
 import type {
   AgentJournalItemBody,
   AgentJournalItemIdentity,
-  AgentJournalProducerLinkage
+  AgentJournalRowAttribution
 } from '../../shared/agent-session-journal-types'
 import { requiresTerminalSettlement } from '../native-chat/agent-session-journal/journal-terminal-settlement'
 import {
@@ -31,7 +31,7 @@ import type { CodexActiveJournalItem } from './codex-structured-journal-settleme
 import { readCodexJournalString } from './codex-structured-journal-translation-values'
 import { readCodexTurnId } from './codex-structured-thread-facts'
 import { readCodexDispatchEcho } from './codex-structured-dispatch-echo'
-import type { CodexRowLinkage } from './codex-subagent-linkage'
+import type { CodexRowAttribution } from './codex-subagent-linkage'
 
 export class CodexJournalItems {
   readonly ordinals = new CodexTurnOrdinals()
@@ -44,7 +44,7 @@ export class CodexJournalItems {
     private readonly deps: Pick<
       CodexJournalTranslatorDeps,
       'sink' | 'coalesceMs' | 'maxRetainedBytes' | 'schedule'
-    > & { maxMetadataBytes?: number; linkageFor: CodexRowLinkage },
+    > & { maxMetadataBytes?: number; attributionFor: CodexRowAttribution },
     private readonly activeTurn: (threadId: string) => string | null,
     private readonly suppress: (threadId: string, turnId: string) => void
   ) {
@@ -56,7 +56,7 @@ export class CodexJournalItems {
       maxMetadataBytes: deps.maxMetadataBytes,
       turnIdFor: (threadId, params) => readCodexTurnId(params) ?? this.activeTurn(threadId),
       identityFor: (threadId, turnId, item) => this.identityFor(threadId, turnId, item),
-      linkageFor: deps.linkageFor
+      attributionFor: deps.attributionFor
     })
   }
 
@@ -122,7 +122,7 @@ export class CodexJournalItems {
       event.method,
       identity,
       translated,
-      this.deps.linkageFor(event.threadId, turnId)
+      this.deps.attributionFor(event.threadId, turnId)
     )
     if (!admission.accepted) {
       return { handled: true, admission }
@@ -151,17 +151,22 @@ export class CodexJournalItems {
     method: string,
     identity: AgentJournalItemIdentity,
     translated: ReturnType<typeof codexJournalItem>,
-    linkage: AgentJournalProducerLinkage
+    attribution: AgentJournalRowAttribution
   ): CodexJournalTranslationAdmission {
     if (!translated.body) {
       return CODEX_JOURNAL_ADMITTED
     }
     if (method === 'item/completed') {
-      const admission = appendCodexLifecycleItem(this.deps.sink, identity, translated.body, linkage)
+      const admission = appendCodexLifecycleItem(
+        this.deps.sink,
+        identity,
+        translated.body,
+        attribution
+      )
       return admission.accepted ? publishCodexLifecycle(this.deps.sink) : admission
     }
     const options = requiresTerminalSettlement(translated.body) ? { lifecycle: true } : {}
-    const appendOptions = { ...options, ...linkage }
+    const appendOptions = { ...options, ...attribution }
     const admission = this.deps.sink.tryAppendItem
       ? this.deps.sink.tryAppendItem(identity, translated.body, appendOptions)
       : (this.deps.sink.appendItem(identity, translated.body, appendOptions),
@@ -235,7 +240,7 @@ export class CodexJournalItems {
             this.deps.sink,
             evicted.identity,
             evictedActiveBody(translated),
-            this.deps.linkageFor(evicted.threadId, evicted.turnId)
+            this.deps.attributionFor(evicted.threadId, evicted.turnId)
           )
           if (!admission.accepted) {
             return admission
diff --git a/src/main/codex/codex-structured-journal-prompts.ts b/src/main/codex/codex-structured-journal-prompts.ts
index 96c58f9b8b7..9c145915fe5 100644
--- a/src/main/codex/codex-structured-journal-prompts.ts
+++ b/src/main/codex/codex-structured-journal-prompts.ts
@@ -20,7 +20,7 @@ import {
 } from './codex-structured-journal-sink'
 import type { CodexPendingJournalPrompt } from './codex-structured-journal-settlement'
 import { readCodexTurnId } from './codex-structured-thread-facts'
-import type { CodexRowLinkage } from './codex-subagent-linkage'
+import type { CodexRowAttribution } from './codex-subagent-linkage'
 import { journalLifecycleItemMutation } from '../native-chat/agent-session-journal/journal-row-builders'
 
 type CodexGroupedPendingJournalPrompt = CodexPendingJournalPrompt & { promptKey: string }
@@ -30,7 +30,7 @@ export class CodexJournalPrompts {
 
   constructor(
     private readonly deps: Pick<CodexJournalTranslatorDeps, 'sink' | 'bindPromptItemId'> & {
-      linkageFor: CodexRowLinkage
+      attributionFor: CodexRowAttribution
     },
     private readonly detailFor: (threadId: string, itemId: string) => string | null,
     private readonly activeTurn: (threadId: string) => string | null
@@ -118,7 +118,7 @@ export class CodexJournalPrompts {
     )
     const mutations = group.flatMap(([, prompt]) => {
       const body = cancelledJournalPromptBody(prompt.body)
-      const producer = this.deps.linkageFor(prompt.threadId, prompt.turnId)
+      const producer = this.deps.attributionFor(prompt.threadId, prompt.turnId)
       return body ? [journalLifecycleItemMutation(producer, prompt.identity, body)] : []
     })
     const admission = appendCodexLifecycleMutations(
@@ -152,7 +152,7 @@ export class CodexJournalPrompts {
       )}:${encodeURIComponent(event.promptKey)}`,
       items,
       // A child's approval arrives on the child's own thread, so it names the asker.
-      this.deps.linkageFor(event.threadId, turnId)
+      this.deps.attributionFor(event.threadId, turnId)
     )
   }
 
@@ -170,7 +170,7 @@ export class CodexJournalPrompts {
             this.deps.sink,
             evicted.identity,
             cancelled,
-            this.deps.linkageFor(evicted.threadId, evicted.turnId)
+            this.deps.attributionFor(evicted.threadId, evicted.turnId)
           )
           if (!admission.accepted) {
             return admission
diff --git a/src/main/codex/codex-structured-journal-provider-verdicts.ts b/src/main/codex/codex-structured-journal-provider-verdicts.ts
deleted file mode 100644
index c8685dfedab..00000000000
--- a/src/main/codex/codex-structured-journal-provider-verdicts.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-// What Codex's own verdict frames mean beyond the row they print.
-//
-// Both are decoration to the transcript and load-bearing to the session's state,
-// which is why they are read here rather than left to the generic-frame fallback.
-
-import { codexThreadStoppedRunning, readCodexErrorWillRetry } from './codex-structured-thread-facts'
-
-export type CodexProviderVerdict =
-  /**
-   * Codex ended this turn with a fault.
-   *
-   * The app server emits `error` ONLY for a failure that affects turn status, and
-   * hardcodes `willRetry: false` there; a stream error it is about to retry carries
-   * `willRetry: true` and ends nothing. `turn/completed` may never follow, so this
-   * frame is the turn's only end — without it the running lifecycle row is a latch
-   * nothing re-derives and the chat reads working for the life of the session.
-   */
-  | 'turn-failed'
-  /**
-   * Codex reports the thread is no longer running.
-   *
-   * This settles no OPEN turn: the app server clears `running` on every error,
-   * including the ones it says do not affect turn status, so a turn still open
-   * here is still running and `turn/completed` is its end. What it does settle is
-   * a send whose dispatch was never answered — a timed-out dispatch is recorded
-   * as unverified delivery, reads as work still owed, and nothing else in a live
-   * session re-derives it.
-   */
-  | 'thread-stopped-running'
-  | null
-
-export function readCodexProviderVerdict(method: string, params: unknown): CodexProviderVerdict {
-  if (method === 'error') {
-    return readCodexErrorWillRetry(params) ? null : 'turn-failed'
-  }
-  if (method === 'thread/status/changed') {
-    return codexThreadStoppedRunning(params) ? 'thread-stopped-running' : null
-  }
-  return null
-}
diff --git a/src/main/codex/codex-structured-journal-restore-turn-grouping.test.ts b/src/main/codex/codex-structured-journal-restore-turn-grouping.test.ts
new file mode 100644
index 00000000000..7c636545daf
--- /dev/null
+++ b/src/main/codex/codex-structured-journal-restore-turn-grouping.test.ts
@@ -0,0 +1,113 @@
+import { describe, expect, it } from 'vitest'
+import type { AgentJournalRenderItem } from '../../shared/agent-session-journal-types'
+import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
+import { nativeChatTurnFold } from '../../shared/native-chat-turn-fold'
+import { nativeChatTurnMembership } from '../../shared/native-chat-turn-membership'
+import type { NativeChatMessage } from '../../shared/native-chat-types'
+import { projectStructuredItemToNativeChat } from '../../shared/structured-agent-session-projection'
+import { selectStructuredAgentTurnBars } from '../../shared/structured-agent-session-turn-timing'
+import { JournalDerivedTurnScope } from '../native-chat/agent-session-journal/journal-derived-turn-scope'
+import { createCodexJournalTranslator } from './codex-structured-journal-translation'
+
+const THREAD_ID = 'thread-abc'
+
+function historicalTurn(index: number): Record<string, unknown> {
+  const id = `turn-${index}`
+  return {
+    id,
+    status: 'completed',
+    startedAt: 1_700_000_000 + index * 100,
+    completedAt: 1_700_000_050 + index * 100,
+    items: [
+      {
+        type: 'userMessage',
+        id: `user-${index}`,
+        content: [{ type: 'text', text: `ask ${index}` }]
+      },
+      { type: 'agentMessage', id: `interim-${index}`, text: `looking ${index}` },
+      { type: 'agentMessage', id: `answer-${index}`, text: `answer ${index}` }
+    ]
+  }
+}
+
+/** What the journal hands a reader after a restore: rows in append order. With `statesScope`, each
+ *  row carries the turn scope the journal gives a row the translator writes without one. */
+function restoredJournal(turnCount: number, statesScope: boolean): AgentJournalRenderItem[] {
+  const items: AgentJournalRenderItem[] = []
+  const derived = new JournalDerivedTurnScope()
+  const translator = createCodexJournalTranslator({
+    sink: {
+      appendItem: (identity, body, options) => {
+        const sequence = items.length + 1
+        const itemId = agentJournalItemKey(identity)
+        const turnScope = options.turnScope ?? derived.scopeFor(body)
+        derived.observe(itemId, true, undefined, body)
+        items.push({
+          itemId,
+          revision: 1,
+          body,
+          sequence,
+          observedAt: sequence,
+          ...(statesScope ? { turnScope } : {})
+        })
+      },
+      appendTombstone: () => {},
+      publish: () => {}
+    },
+    sessionId: 'session-1',
+    primaryThreadId: () => THREAD_ID
+  })
+  const turns = Array.from({ length: turnCount }, (_, index) => historicalTurn(index + 1))
+  expect(translator.restoreThread(THREAD_ID, { turns })).toEqual({ accepted: true })
+  return items
+}
+
+describe('grouping a Codex thread restored from full history', () => {
+  it.each([
+    ['states each row’s turn', true],
+    ['states no scope', false]
+  ])(
+    'keeps each turn with its own rows and folds each to its own answer on a host that %s',
+    (_host, statesScope) => {
+      const items = restoredJournal(3, statesScope)
+      const bars = selectStructuredAgentTurnBars(items, [], null)
+      const messages = items
+        .map(projectStructuredItemToNativeChat)
+        .filter((message): message is NativeChatMessage => message !== null)
+      const { turnKeys } = nativeChatTurnMembership(messages, { items, submissions: [] })
+      const opener = (index: number): string => `codex:${THREAD_ID}:turn-${index}:0`
+
+      expect(messages.map((message, index) => [message.role, turnKeys[index]])).toEqual([
+        ['user', opener(1)],
+        ['assistant', opener(1)],
+        ['assistant', opener(1)],
+        ['user', opener(2)],
+        ['assistant', opener(2)],
+        ['assistant', opener(2)],
+        ['user', opener(3)],
+        ['assistant', opener(3)],
+        ['assistant', opener(3)]
+      ])
+      expect([...bars.settledTurns.keys()]).toEqual([opener(1), opener(2), opener(3)])
+
+      const { foldedRows } = nativeChatTurnFold({
+        rows: messages.map((message, index) => ({
+          turnKey: turnKeys[index],
+          role: message.role,
+          rendersProse: true,
+          outlivesTurn: false,
+          reportsFailure: false,
+          reportsCompaction: false
+        })),
+        settledTurnKeys: new Set(bars.settledTurns.keys()),
+        expandedTurnKeys: new Set()
+      })
+      const visible = messages.filter((_, index) => !foldedRows.has(index))
+      expect(visible.map((message) => message.blocks)).toEqual(
+        ['ask 1', 'answer 1', 'ask 2', 'answer 2', 'ask 3', 'answer 3'].map((text) => [
+          { type: 'text', text }
+        ])
+      )
+    }
+  )
+})
diff --git a/src/main/codex/codex-structured-journal-settlement.ts b/src/main/codex/codex-structured-journal-settlement.ts
index e2164b9498d..a3f4c7f5599 100644
--- a/src/main/codex/codex-structured-journal-settlement.ts
+++ b/src/main/codex/codex-structured-journal-settlement.ts
@@ -1,7 +1,8 @@
-import type {
-  AgentJournalItemBody,
-  AgentJournalItemIdentity,
-  AgentJournalTurnLifecycle
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalItemBody,
+  type AgentJournalItemIdentity,
+  type AgentJournalTurnLifecycle
 } from '../../shared/agent-session-journal-types'
 import {
   journalLifecycleItemMutation,
@@ -26,7 +27,7 @@ import {
   codexTurnLifecycleIdentity
 } from './codex-structured-journal-translation-turns'
 import { appendCodexLifecycleMutations } from './codex-structured-journal-sink'
-import type { CodexRowLinkage } from './codex-subagent-linkage'
+import type { CodexRowAttribution } from './codex-subagent-linkage'
 
 export type CodexActiveJournalItem = {
   threadId: string
@@ -53,9 +54,10 @@ export function settleCodexJournalSession(input: {
   currentTurnIds: ReadonlyMap<string, ReadonlySet<string>>
   primaryThreadId: string | null
   ordinals: CodexTurnOrdinals
-  /** Terminal lifecycle for a turn the provider left running when it ended. */
-  settledTurnLifecycle: (threadId: string, turnId: string) => AgentJournalTurnLifecycle
-  linkageFor: CodexRowLinkage
+  /** Terminal lifecycle for a turn the provider left running when it ended; null for a turn a
+   *  conversation command claimed, whose record the host settles. */
+  settledTurnLifecycle: (threadId: string, turnId: string) => AgentJournalTurnLifecycle | null
+  attributionFor: CodexRowAttribution
 }): StructuredAgentSessionSinkAdmission {
   // Rows from every thread settle in this one batch, so each names its own producer.
   const mutations: JournalLifecycleMutationInput[] = []
@@ -67,13 +69,13 @@ export function settleCodexJournalSession(input: {
       : codexJournalItem(active.item)
     const body = interruptedBody(translated.body)
     if (body) {
-      mutations.push(settledRow(input.linkageFor, active, body))
+      mutations.push(settledRow(input.attributionFor, active, body))
     }
   }
   for (const prompt of input.pendingPrompts.values()) {
     const body = cancelledJournalPromptBody(prompt.body)
     if (body) {
-      mutations.push(settledRow(input.linkageFor, prompt, body))
+      mutations.push(settledRow(input.attributionFor, prompt, body))
     }
   }
   for (const [threadId, turnIds] of input.currentTurnIds) {
@@ -81,11 +83,15 @@ export function settleCodexJournalSession(input: {
       continue
     }
     for (const turnId of turnIds) {
-      mutations.push({
-        kind: 'item',
-        identity: codexTurnLifecycleIdentity(input.event.sessionId, turnId),
-        body: codexTurnLifecycleBody(input.settledTurnLifecycle(threadId, turnId))
-      })
+      const turnLifecycle = input.settledTurnLifecycle(threadId, turnId)
+      if (turnLifecycle) {
+        mutations.push({
+          kind: 'item',
+          identity: codexTurnLifecycleIdentity(input.event.sessionId, turnId),
+          body: codexTurnLifecycleBody(turnLifecycle),
+          turnScope: AGENT_JOURNAL_THREAD_SCOPE
+        })
+      }
       turnOrdinalsToForget.push({ threadId, turnId })
     }
   }
@@ -114,7 +120,9 @@ export function settleCodexJournalTurn(input: {
   activeItems: Map<string, CodexActiveJournalItem>
   pendingPrompts?: Map<string, CodexPendingJournalPrompt>
   clearPromptTurn?: (threadId: string, turnId: string) => void
-  linkageFor: CodexRowLinkage
+  attributionFor: CodexRowAttribution
+  /** The end of a conversation command the turn carried, which settles with it. */
+  commandEnd?: readonly JournalLifecycleMutationInput[]
 }): StructuredAgentSessionSinkAdmission {
   const mutations: JournalLifecycleMutationInput[] = []
   const activeItemsToForget: { key: string; threadId: string; itemId: string }[] = []
@@ -133,7 +141,7 @@ export function settleCodexJournalTurn(input: {
       : codexJournalItem(active.item)
     const body = interruptedBody(translated.body)
     if (body) {
-      mutations.push(settledRow(input.linkageFor, active, body))
+      mutations.push(settledRow(input.attributionFor, active, body))
     }
     activeItemsToForget.push({ key, threadId: active.threadId, itemId: active.item.id })
   }
@@ -143,7 +151,7 @@ export function settleCodexJournalTurn(input: {
     }
     const body = cancelledJournalPromptBody(prompt.body)
     if (body) {
-      mutations.push(settledRow(input.linkageFor, prompt, body))
+      mutations.push(settledRow(input.attributionFor, prompt, body))
     }
     pendingPromptsToForget.push(key)
   }
@@ -152,9 +160,11 @@ export function settleCodexJournalTurn(input: {
     mutations.push({
       kind: 'item',
       identity: codexTurnLifecycleIdentity(input.sessionId, input.turnId),
-      body: codexTurnLifecycleBody(input.turnLifecycle)
+      body: codexTurnLifecycleBody(input.turnLifecycle),
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
     })
   }
+  mutations.push(...(input.commandEnd ?? []))
   const admission = appendCodexLifecycleMutations(
     input.sink,
     `turn-completed:${input.sessionId}:${input.threadId}:${input.turnId}`,
@@ -174,89 +184,13 @@ export function settleCodexJournalTurn(input: {
   return ADMITTED
 }
 
-/** Settle streamed items whose terminal notification was rejected as oversized. */
-export function settleCodexOversizedNotification(input: {
-  sessionId: string
-  threadId: string
-  method: string
-  sink: StructuredAgentSessionEventSink
-  streams: CodexStructuredItemStreams
-  activeItems: Map<string, CodexActiveJournalItem>
-  linkageFor: CodexRowLinkage
-}): StructuredAgentSessionSinkAdmission {
-  const itemType = oversizedStreamItemType(input.method)
-  if (!itemType) {
-    return ADMITTED
-  }
-  const mutations: JournalLifecycleMutationInput[] = []
-  const activeItemsToForget: { key: string; threadId: string; itemId: string }[] = []
-  for (const [key, active] of input.activeItems) {
-    if (active.threadId !== input.threadId || active.item.type !== itemType) {
-      continue
-    }
-    const streamed = input.streams.snapshot(active.threadId, active.item.id)
-    const translated = streamed
-      ? codexStreamingJournalItem(active.item, streamed.text)
-      : codexJournalItem(active.item)
-    const body = interruptedBody(translated.body)
-    if (body) {
-      mutations.push(settledRow(input.linkageFor, active, body))
-    }
-    activeItemsToForget.push({ key, threadId: active.threadId, itemId: active.item.id })
-  }
-  if (mutations.length === 0) {
-    return ADMITTED
-  }
-  const admission = appendCodexLifecycleMutations(
-    input.sink,
-    `oversized-notification:${input.sessionId}:${input.threadId}:${input.method}`,
-    mutations
-  )
-  if (!admission.accepted) {
-    return admission
-  }
-  for (const active of activeItemsToForget) {
-    input.streams.forget(active.threadId, active.itemId)
-    input.activeItems.delete(active.key)
-  }
-  return ADMITTED
-}
-
-function oversizedStreamItemType(method: string): CodexThreadItem['type'] | null {
-  if (method === 'item/agentMessage/delta') {
-    return 'agentMessage'
-  }
-  if (method === 'item/plan/delta') {
-    return 'plan'
-  }
-  if (
-    method === 'command/exec/outputDelta' ||
-    method === 'process/outputDelta' ||
-    method === 'item/commandExecution/outputDelta' ||
-    method === 'item/commandExecution/terminalInteraction'
-  ) {
-    return 'commandExecution'
-  }
-  if (method === 'item/fileChange/outputDelta' || method === 'item/fileChange/patchUpdated') {
-    return 'fileChange'
-  }
-  if (
-    method === 'item/reasoning/summaryTextDelta' ||
-    method === 'item/reasoning/summaryPartAdded' ||
-    method === 'item/reasoning/textDelta'
-  ) {
-    return 'reasoning'
-  }
-  return null
-}
-
 /** A settled item or prompt, naming its producer: the settlement can be the row's first write. */
 function settledRow(
-  linkageFor: CodexRowLinkage,
+  attributionFor: CodexRowAttribution,
   row: { threadId: string; turnId: string | null; identity: AgentJournalItemIdentity },
   body: AgentJournalItemBody
 ): JournalLifecycleMutationInput {
-  return journalLifecycleItemMutation(linkageFor(row.threadId, row.turnId), row.identity, body)
+  return journalLifecycleItemMutation(attributionFor(row.threadId, row.turnId), row.identity, body)
 }
 
 function interruptedBody(body: AgentJournalItemBody | null): AgentJournalItemBody | null {
diff --git a/src/main/codex/codex-structured-journal-sink.ts b/src/main/codex/codex-structured-journal-sink.ts
index 95a27702365..0823e5679cf 100644
--- a/src/main/codex/codex-structured-journal-sink.ts
+++ b/src/main/codex/codex-structured-journal-sink.ts
@@ -1,10 +1,10 @@
 import type {
   AgentJournalItemBody,
   AgentJournalItemIdentity,
-  AgentJournalProducerLinkage
+  AgentJournalRowAttribution
 } from '../../shared/agent-session-journal-types'
 import type {
-  StructuredAgentSessionAppendOptions,
+  StructuredAgentSessionItemAppendOptions,
   StructuredAgentSessionEventSink,
   StructuredAgentSessionLifecycleIdentityResolver,
   StructuredAgentSessionSinkAdmission
@@ -35,7 +35,11 @@ export function appendCodexLifecycleMutations(
     } else {
       for (const mutation of chunk) {
         if (mutation.kind === 'item') {
-          const options = { lifecycle: true, ...mutation.linkage }
+          const options = {
+            lifecycle: true,
+            ...mutation.linkage,
+            turnScope: mutation.turnScope
+          }
           if (sink.tryAppendItem) {
             admission = sink.tryAppendItem(mutation.identity, mutation.body, options)
             if (!admission.accepted) {
@@ -74,7 +78,7 @@ export function appendCodexItemAndPublish(
   sink: StructuredAgentSessionEventSink,
   identity: AgentJournalItemIdentity,
   body: AgentJournalItemBody,
-  options: StructuredAgentSessionAppendOptions
+  options: StructuredAgentSessionItemAppendOptions
 ): StructuredAgentSessionSinkAdmission {
   const admission = sink.tryAppendItem
     ? sink.tryAppendItem(identity, body, options)
@@ -95,9 +99,9 @@ export function appendCodexLifecycleItem(
   sink: StructuredAgentSessionEventSink,
   identity: AgentJournalItemIdentity,
   body: AgentJournalItemBody,
-  linkage: AgentJournalProducerLinkage
+  attribution: AgentJournalRowAttribution
 ): CodexJournalTranslationAdmission {
-  const options = { lifecycle: true, ...linkage }
+  const options = { lifecycle: true, ...attribution }
   if (sink.tryAppendItem) {
     return criticalAdmission(sink.tryAppendItem(identity, body, options))
   }
@@ -110,14 +114,14 @@ export function appendCodexLifecycleTransition(
   identitySizeBound: AgentJournalItemIdentity,
   body: AgentJournalItemBody,
   resolveIdentity: StructuredAgentSessionLifecycleIdentityResolver,
-  linkage: AgentJournalProducerLinkage
+  attribution: AgentJournalRowAttribution
 ): CodexJournalTranslationAdmission {
   if (sink.tryAppendLifecycleTransition) {
     return criticalAdmission(
-      sink.tryAppendLifecycleTransition(identitySizeBound, body, resolveIdentity, linkage)
+      sink.tryAppendLifecycleTransition(identitySizeBound, body, resolveIdentity, attribution)
     )
   }
-  const admission = appendCodexLifecycleItem(sink, identitySizeBound, body, linkage)
+  const admission = appendCodexLifecycleItem(sink, identitySizeBound, body, attribution)
   return admission.accepted ? publishCodexLifecycle(sink) : admission
 }
 
@@ -136,7 +140,7 @@ export function admitCodexLifecycleItems(
   sink: StructuredAgentSessionEventSink,
   settlementId: string,
   items: readonly Pick<CodexPendingJournalPrompt, 'identity' | 'body'>[],
-  linkage: AgentJournalProducerLinkage
+  attribution: AgentJournalRowAttribution
 ): CodexJournalTranslationAdmission {
   if (items.length === 0) {
     return { accepted: false, reason: 'untranslated' }
@@ -145,14 +149,14 @@ export function admitCodexLifecycleItems(
     const admission = criticalAdmission(
       sink.tryAppendLifecycleBatch(
         settlementId,
-        items.map((item) => journalLifecycleItemMutation(linkage, item.identity, item.body)),
+        items.map((item) => journalLifecycleItemMutation(attribution, item.identity, item.body)),
         { lifecycle: true }
       )
     )
     return admission.accepted ? publishCodexLifecycle(sink) : admission
   }
   for (const item of items) {
-    const admission = appendCodexLifecycleItem(sink, item.identity, item.body, linkage)
+    const admission = appendCodexLifecycleItem(sink, item.identity, item.body, attribution)
     if (!admission.accepted) {
       return admission
     }
diff --git a/src/main/codex/codex-structured-journal-subagent-readers.test.ts b/src/main/codex/codex-structured-journal-subagent-readers.test.ts
index 117f204e963..7b7266345e7 100644
--- a/src/main/codex/codex-structured-journal-subagent-readers.test.ts
+++ b/src/main/codex/codex-structured-journal-subagent-readers.test.ts
@@ -9,7 +9,7 @@ import { join } from 'node:path'
 import { afterEach, describe, expect, it } from 'vitest'
 import type { AgentJournalRenderItem } from '../../shared/agent-session-journal-types'
 import { selectStructuredAgentTurnActivity } from '../../shared/native-chat-turn-activity'
-import { latestStructuredAgentSessionAssistantMessage } from '../../shared/structured-agent-session-projection'
+import { latestStructuredAgentSessionAssistantMessage } from '../../shared/structured-agent-session-latest-request'
 import {
   isStructuredAgentSessionThinking,
   statusStructuredAgentSessionToolCall
diff --git a/src/main/codex/codex-structured-journal-translation-frames.ts b/src/main/codex/codex-structured-journal-translation-frames.ts
deleted file mode 100644
index f94c10bfe66..00000000000
--- a/src/main/codex/codex-structured-journal-translation-frames.ts
+++ /dev/null
@@ -1,68 +0,0 @@
-/**
- * The translator's provider-frame arms.
- *
- * Each returns null for a frame it does not own, which is the translator's
- * signal to keep looking. Split out so the translator reads as routing rather
- * than as the shape checks each arm performs.
- */
-
-import type { CodexStructuredSessionEvent } from './codex-structured-session-adapter'
-import type { CodexJournalItems } from './codex-structured-journal-items'
-import type { CodexJournalTranslationAdmission } from './codex-structured-journal-contracts'
-import { settleCodexOversizedNotification } from './codex-structured-journal-settlement'
-import {
-  readCodexJournalRecord,
-  readCodexJournalString
-} from './codex-structured-journal-translation-values'
-
-type OversizedInput = Parameters<typeof settleCodexOversizedNotification>[0]
-
-/** A notification the transport refused to carry whole: settle whatever it
- *  opened rather than leaving the item mid-flight. */
-export function settleCodexOversizedNotificationFrame(input: {
-  sessionId: string
-  threadId: string
-  kind: string
-  payload: unknown
-  sink: OversizedInput['sink']
-  streams: OversizedInput['streams']
-  activeItems: OversizedInput['activeItems']
-  linkageFor: OversizedInput['linkageFor']
-}): CodexJournalTranslationAdmission | null {
-  if (input.kind !== 'frame:oversized-notification') {
-    return null
-  }
-  const method = readCodexJournalString(readCodexJournalRecord(input.payload), 'method')
-  return method
-    ? settleCodexOversizedNotification({
-        sessionId: input.sessionId,
-        threadId: input.threadId,
-        method,
-        sink: input.sink,
-        streams: input.streams,
-        activeItems: input.activeItems,
-        linkageFor: input.linkageFor
-      })
-    : null
-}
-
-export function createCodexOversizedNotificationSettler(
-  deps: { sink: OversizedInput['sink']; linkageFor: OversizedInput['linkageFor'] },
-  items: Pick<CodexJournalItems, 'streams' | 'activeItems'>
-) {
-  return settleOversizedNotification
-
-  /** Settles the item a notification the transport refused to carry left
-   *  mid-flight; null when the frame is not one. */
-  function settleOversizedNotification(
-    event: Extract<CodexStructuredSessionEvent, { type: 'provider-frame' }>
-  ): CodexJournalTranslationAdmission | null {
-    return settleCodexOversizedNotificationFrame({
-      ...event,
-      sink: deps.sink,
-      streams: items.streams,
-      activeItems: items.activeItems,
-      linkageFor: deps.linkageFor
-    })
-  }
-}
diff --git a/src/main/codex/codex-structured-journal-translation-restore.ts b/src/main/codex/codex-structured-journal-translation-restore.ts
index 7005c10a43b..5dc68d6f764 100644
--- a/src/main/codex/codex-structured-journal-translation-restore.ts
+++ b/src/main/codex/codex-structured-journal-translation-restore.ts
@@ -59,6 +59,17 @@ export function restoreCodexJournalThread(input: {
     if (!turnId) {
       continue
     }
+    // Ahead of the turn's items, as the live path writes it: readers credit every
+    // row to the nearest turn record before it.
+    const lifecycle = input.restoreTurnLifecycle
+      ? historicalTurnLifecycle(input.threadId, turn)
+      : null
+    if (lifecycle) {
+      const admission = input.restoreTurnLifecycle?.(lifecycle) ?? { accepted: true }
+      if (!admission.accepted) {
+        return admission
+      }
+    }
     input.currentTurnIds.set(input.threadId, new Set([turnId]))
     for (const item of Array.isArray(turn.items) ? turn.items : []) {
       const admission = input.handleItem({
@@ -72,15 +83,6 @@ export function restoreCodexJournalThread(input: {
     }
     input.currentTurnIds.delete(input.threadId)
     input.ordinals.forgetTurn(input.threadId, turnId)
-    const lifecycle = input.restoreTurnLifecycle
-      ? historicalTurnLifecycle(input.threadId, turn)
-      : null
-    if (lifecycle) {
-      const admission = input.restoreTurnLifecycle?.(lifecycle) ?? { accepted: true }
-      if (!admission.accepted) {
-        return admission
-      }
-    }
   }
   input.flush()
   return { accepted: true }
diff --git a/src/main/codex/codex-structured-journal-translation-settlement.test.ts b/src/main/codex/codex-structured-journal-translation-settlement.test.ts
index ab0e602e955..344d99e03b4 100644
--- a/src/main/codex/codex-structured-journal-translation-settlement.test.ts
+++ b/src/main/codex/codex-structured-journal-translation-settlement.test.ts
@@ -551,7 +551,8 @@ describe('codex journal translation', () => {
               userItemId: `codex:${THREAD_ID}:${TURN_ID}:0`,
               startedAt: expect.any(Number),
               completedAt: expect.any(Number)
-            }
+            },
+            turnScope: { kind: 'thread' }
           }
         ]
       }
diff --git a/src/main/codex/codex-structured-journal-translation-streams.test.ts b/src/main/codex/codex-structured-journal-translation-streams.test.ts
index 8a924a9d78a..ce6fd220132 100644
--- a/src/main/codex/codex-structured-journal-translation-streams.test.ts
+++ b/src/main/codex/codex-structured-journal-translation-streams.test.ts
@@ -215,55 +215,6 @@ describe('codex journal translation', () => {
     ).toEqual(['notification:future/notification', 'request:future/request', 'frame:unclassified'])
   })
 
-  it('terminalizes the active streamed item when an oversized notification is rejected', () => {
-    const { translator, tap } = translatorWith()
-    translator.handle(TURN_STARTED)
-    translator.handle(
-      notification('item/started', {
-        item: {
-          type: 'commandExecution',
-          id: 'exec-oversized',
-          command: 'run',
-          status: 'inProgress'
-        }
-      })
-    )
-    const admission = translator.handle({
-      type: 'provider-frame',
-      sessionId: SESSION_ID,
-      threadId: THREAD_ID,
-      kind: 'frame:oversized-notification',
-      payload: {
-        reason: 'record-too-large',
-        observedBytes: 20 * 1024 * 1024,
-        maxBytes: 16 * 1024 * 1024,
-        classification: 'notification',
-        method: 'item/commandExecution/outputDelta'
-      }
-    })
-
-    expect(admission).toEqual({ accepted: true })
-    expect(tap.rows).toEqual([
-      expect.objectContaining({
-        body: expect.objectContaining({ kind: 'tool-call', state: 'running' })
-      }),
-      expect.objectContaining({
-        body: expect.objectContaining({ kind: 'tool-call', state: 'failed' })
-      }),
-      expect.objectContaining({
-        body: expect.objectContaining({
-          kind: 'status',
-          providerFrame: expect.objectContaining({ kind: 'frame:oversized-notification' })
-        })
-      })
-    ])
-    const diagnostic = tap.rows[2]?.body
-    expect(
-      diagnostic?.kind === 'status' ? diagnostic.providerFrame?.payload.byteLength : 0
-    ).toBeGreaterThan(0)
-    expect(JSON.stringify(diagnostic)).toContain('record-too-large')
-  })
-
   it('admits suppressed diagnostics before settling a completed turn', () => {
     const tap = recorder()
     let rejectSuppression = true
diff --git a/src/main/codex/codex-structured-journal-translation-turn-boundaries.ts b/src/main/codex/codex-structured-journal-translation-turn-boundaries.ts
index d4881de1897..a853ca2bfd8 100644
--- a/src/main/codex/codex-structured-journal-translation-turn-boundaries.ts
+++ b/src/main/codex/codex-structured-journal-translation-turn-boundaries.ts
@@ -2,7 +2,10 @@ import type {
   AgentJournalTurnLifecycle,
   AgentJournalTurnOutcome
 } from '../../shared/agent-session-journal-types'
-import { agentJournalSubmissionKey } from '../../shared/agent-session-journal-item-key'
+import {
+  agentJournalItemKey,
+  agentJournalSubmissionKey
+} from '../../shared/agent-session-journal-item-key'
 import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
 import {
   CODEX_JOURNAL_ADMITTED,
@@ -27,7 +30,10 @@ import {
   readCodexTurnId,
   readCodexTurnStatus
 } from './codex-structured-thread-facts'
-import type { CodexRowLinkage } from './codex-subagent-linkage'
+import type { CodexRowAttribution } from './codex-subagent-linkage'
+import type { CodexJournalCommandTurn } from './codex-journal-command-turn'
+import { readRecord, readString } from './codex-item-field-readers'
+import { recordCodexCommandTurnClaim } from './codex-command-turn-claim'
 
 type TurnBoundaryEvent = {
   sessionId: string
@@ -37,6 +43,14 @@ type TurnBoundaryEvent = {
   dispatchSequenceAtReceipt?: number
 }
 
+type TurnTerminal = {
+  state: 'completed' | 'interrupted'
+  completedAt: number
+  /** Null when Codex named no verdict, or when the host inferred this end itself. */
+  outcome?: AgentJournalTurnOutcome | null
+  durationMs?: number | null
+}
+
 /** Opens and settles the durable lifecycle row for each primary-thread turn. */
 export class CodexJournalTurnBoundaries {
   private readonly recentTurns = new CodexJournalRecentTurns()
@@ -51,7 +65,8 @@ export class CodexJournalTurnBoundaries {
       clearPromptTurn?: (threadId: string, turnId: string) => void
       flushSuppression: () => CodexJournalTranslationAdmission
       resetActivity: (threadId: string) => void
-      linkageFor: CodexRowLinkage
+      attributionFor: CodexRowAttribution
+      commands: CodexJournalCommandTurn
       now?: () => number
     }
   ) {}
@@ -65,15 +80,20 @@ export class CodexJournalTurnBoundaries {
       return { accepted: false, reason: 'backpressure' }
     }
     const startedAt = this.receiptTime(event)
-    const admission = publishCodexTurnLifecycle({
-      sink: this.deps.sink,
-      primaryThreadId: this.deps.primaryThreadId(),
-      sessionId: event.sessionId,
-      threadId: event.threadId,
-      turnId,
-      state: 'running',
-      startedAt
-    })
+    const command =
+      event.threadId === this.deps.primaryThreadId() ? this.deps.commands.claim(turnId) : null
+    // The command's turn is the record: this turn writes none, and its rows join the command's.
+    const admission = command
+      ? recordCodexCommandTurnClaim(this.deps.sink, agentJournalItemKey(command.identity), turnId)
+      : publishCodexTurnLifecycle({
+          sink: this.deps.sink,
+          primaryThreadId: this.deps.primaryThreadId(),
+          sessionId: event.sessionId,
+          threadId: event.threadId,
+          turnId,
+          state: 'running',
+          startedAt
+        })
     if (admission.accepted) {
       this.deps.activeTurns.remember(
         event.threadId,
@@ -132,6 +152,8 @@ export class CodexJournalTurnBoundaries {
     return admission
   }
 
+  /** Codex ends every turn with exactly one `turn/completed`, a failed one after
+   *  its `error` frame included, so this is the only live end. */
   complete(event: TurnBoundaryEvent): CodexJournalTranslationAdmission {
     const suppressionAdmission = this.deps.flushSuppression()
     if (!suppressionAdmission.accepted) {
@@ -146,15 +168,20 @@ export class CodexJournalTurnBoundaries {
     // turn boundary is no evidence contact was lost. Only `settleSession` may
     // write `unverifiable`.
     const status = readCodexTurnStatus(event.params)
-    const turnLifecycle =
-      event.threadId === this.deps.primaryThreadId()
-        ? this.settled(event.threadId, turnId, {
-            state: codexTurnLifecycleState(status),
-            outcome: codexTurnOutcome(status),
-            completedAt: this.receiptTime(event),
-            durationMs: readCodexTurnDurationMs(event.params)
-          })
-        : null
+    const completedAt = this.receiptTime(event)
+    const commandEnd = this.deps.commands.end(turnId, {
+      status,
+      error: readString(readRecord(readRecord(readRecord(event.params).turn).error), 'message'),
+      completedAt
+    })
+    const turnLifecycle = this.ownsRecord(event.threadId, turnId)
+      ? this.settled(event.threadId, turnId, {
+          state: codexTurnLifecycleState(status),
+          outcome: codexTurnOutcome(status),
+          completedAt,
+          durationMs: readCodexTurnDurationMs(event.params)
+        })
+      : null
     const requestOrigin = this.deps.activeTurns.requestOrigin(event.threadId, turnId)
     const latestDispatchSequence = this.deps.activeTurns.latestDispatchSequence(
       event.threadId,
@@ -170,69 +197,8 @@ export class CodexJournalTurnBoundaries {
       activeItems: this.deps.items.activeItems,
       pendingPrompts: this.deps.pendingPrompts,
       ...(this.deps.clearPromptTurn ? { clearPromptTurn: this.deps.clearPromptTurn } : {}),
-      linkageFor: this.deps.linkageFor
-    })
-    if (admission.accepted) {
-      if (turnLifecycle) {
-        this.recentTurns.remember(
-          event.threadId,
-          turnLifecycle,
-          requestOrigin,
-          latestDispatchSequence
-        )
-      }
-      this.deps.items.ordinals.forgetTurn(event.threadId, turnId)
-      this.deps.activeTurns.forget(event.threadId, turnId)
-      this.deps.resetActivity(event.threadId)
-    }
-    return admission
-  }
-
-  /**
-   * Settles the turn a terminal `error` names.
-   *
-   * Codex reports a fault that ended a turn as an `error` notification carrying
-   * that turn's id, and `turn/completed` may never follow it — the app server
-   * marks the thread not-running off the error alone. Without this the running
-   * lifecycle row is a latch nothing re-derives, and the chat reads "Working"
-   * for the life of the session. A retrying stream error is NOT a turn end and
-   * never reaches here.
-   */
-  fail(event: TurnBoundaryEvent): CodexJournalTranslationAdmission {
-    const suppressionAdmission = this.deps.flushSuppression()
-    if (!suppressionAdmission.accepted) {
-      return suppressionAdmission
-    }
-    const turnId = readCodexTurnId(event.params) ?? this.deps.activeTurns.current(event.threadId)
-    // An error naming an already-settled turn is not a second end: its terminal
-    // row holds the start and duration this one could not reconstruct.
-    if (!turnId || !this.deps.activeTurns.isActive(event.threadId, turnId)) {
-      return CODEX_JOURNAL_ADMITTED
-    }
-    const turnLifecycle =
-      event.threadId === this.deps.primaryThreadId()
-        ? this.settled(event.threadId, turnId, {
-            state: 'completed',
-            outcome: 'failure',
-            completedAt: this.receiptTime(event)
-          })
-        : null
-    const requestOrigin = this.deps.activeTurns.requestOrigin(event.threadId, turnId)
-    const latestDispatchSequence = this.deps.activeTurns.latestDispatchSequence(
-      event.threadId,
-      turnId
-    )
-    const admission = settleCodexJournalTurn({
-      sink: this.deps.sink,
-      sessionId: event.sessionId,
-      threadId: event.threadId,
-      turnId,
-      turnLifecycle,
-      streams: this.deps.items.streams,
-      activeItems: this.deps.items.activeItems,
-      pendingPrompts: this.deps.pendingPrompts,
-      ...(this.deps.clearPromptTurn ? { clearPromptTurn: this.deps.clearPromptTurn } : {}),
-      linkageFor: this.deps.linkageFor
+      attributionFor: this.deps.attributionFor,
+      commandEnd
     })
     if (admission.accepted) {
       if (turnLifecycle) {
@@ -245,6 +211,7 @@ export class CodexJournalTurnBoundaries {
       }
       this.deps.items.ordinals.forgetTurn(event.threadId, turnId)
       this.deps.activeTurns.forget(event.threadId, turnId)
+      this.deps.commands.settled(turnId)
       this.deps.resetActivity(event.threadId)
     }
     return admission
@@ -252,17 +219,7 @@ export class CodexJournalTurnBoundaries {
 
   /** Terminal lifecycle for a remembered turn; `startedAt` is absent when the start was never seen.
    *  The verdict travels as one record so a caller cannot supply the state and drop the outcome. */
-  settled(
-    threadId: string,
-    turnId: string,
-    terminal: {
-      state: 'completed' | 'interrupted'
-      completedAt: number
-      /** Null when Codex named no verdict, or when the host inferred this end itself. */
-      outcome?: AgentJournalTurnOutcome | null
-      durationMs?: number | null
-    }
-  ): AgentJournalTurnLifecycle {
+  settled(threadId: string, turnId: string, terminal: TurnTerminal): AgentJournalTurnLifecycle {
     const startedAt = this.deps.activeTurns.startedAt(threadId, turnId)
     // Carried forward from the exact echoed send that was attributed to this turn.
     const requestOrigin = this.deps.activeTurns.requestOrigin(threadId, turnId)
@@ -278,9 +235,15 @@ export class CodexJournalTurnBoundaries {
     }
   }
 
+  /** Whether this translator writes the turn's record: a primary turn no command claimed. */
+  ownsRecord(threadId: string, turnId: string): boolean {
+    return threadId === this.deps.primaryThreadId() && !this.deps.commands.isCarrying(turnId)
+  }
+
   clear(): void {
     this.deps.activeTurns.clear()
     this.recentTurns.clear()
+    this.deps.commands.clear()
   }
 
   private receiptTime(event: TurnBoundaryEvent): number {
diff --git a/src/main/codex/codex-structured-journal-translation-turn-lifecycle.test.ts b/src/main/codex/codex-structured-journal-translation-turn-lifecycle.test.ts
index 6fc1e88d184..6fb589caf4e 100644
--- a/src/main/codex/codex-structured-journal-translation-turn-lifecycle.test.ts
+++ b/src/main/codex/codex-structured-journal-translation-turn-lifecycle.test.ts
@@ -346,7 +346,7 @@ describe('codex turn lifecycle rows', () => {
     const lifecycle = reduced(tap.rows).find((row) => row.key === LIFECYCLE_KEY)
     expect(lifecycle?.body).toMatchObject({
       kind: 'turn',
-      state: 'interrupted',
+      state: 'completed',
       outcome: 'failure',
       requestedAt: 900
     })
@@ -381,17 +381,17 @@ describe('codex turn lifecycle rows', () => {
   })
 
   // `TurnStatus` in the app-server protocol is `completed | interrupted | failed |
-  // inProgress`, and every one of those collapses to the same terminal lifecycle
-  // arm. `outcome` is what keeps a Codex failure distinguishable from a stop, and
-  // a status this build cannot place stays unknown rather than borrowing one.
+  // inProgress`. Only `interrupted` is a stop; every other end completed the
+  // turn, and `outcome` says how. A status this build cannot place stays unknown
+  // rather than borrowing a verdict.
   it.each([
-    ['interrupted', 'cancellation'],
-    ['failed', 'failure'],
-    ['cancelled', undefined],
-    ['inProgress', undefined]
+    ['interrupted', 'interrupted', 'cancellation'],
+    ['failed', 'completed', 'failure'],
+    ['someFutureStatus', 'completed', undefined],
+    ['inProgress', 'completed', undefined]
   ] as const)(
-    'maps a %s turn status to an interrupted lifecycle with outcome %s',
-    (status, outcome) => {
+    'maps a %s turn status to a %s lifecycle with outcome %s',
+    (status, state, outcome) => {
       const tap = recorder()
       const translator = translatorFor(tap)
 
@@ -405,7 +405,7 @@ describe('codex turn lifecycle rows', () => {
           body: {
             kind: 'turn',
             turnId: TURN_ID,
-            state: 'interrupted',
+            state,
             ...(outcome ? { outcome } : {}),
             userItemId: USER_ITEM_ID,
             startedAt: 1_000,
@@ -512,14 +512,29 @@ describe('codex turn lifecycle rows', () => {
             completedAt: 1_700_000_101,
             items: []
           },
+          {
+            id: 'turn-failed',
+            status: 'failed',
+            startedAt: 1_700_000_150,
+            completedAt: 1_700_000_152,
+            durationMs: 2_400,
+            items: []
+          },
+          {
+            id: 'turn-unplaced',
+            status: 'someFutureStatus',
+            startedAt: 1_700_000_170,
+            completedAt: 1_700_000_171,
+            items: []
+          },
           { id: 'turn-open', status: 'inProgress', startedAt: 1_700_000_200, items: [] },
           { id: 'turn-untimed', status: 'completed', items: [] }
         ]
       })
     ).toEqual({ accepted: true })
 
+    // Each record precedes its turn's items, the order the live path writes.
     expect(tap.rows).toEqual([
-      expect.objectContaining({ body: expect.objectContaining({ kind: 'message' }) }),
       {
         key: 'legacy:codex:session-1:turn-lifecycle%3Aturn-done',
         body: {
@@ -533,6 +548,7 @@ describe('codex turn lifecycle rows', () => {
           durationMs: 41_900
         }
       },
+      expect.objectContaining({ body: expect.objectContaining({ kind: 'message' }) }),
       {
         key: 'legacy:codex:session-1:turn-lifecycle%3Aturn-cut',
         body: {
@@ -544,6 +560,32 @@ describe('codex turn lifecycle rows', () => {
           startedAt: 1_700_000_100_000,
           completedAt: 1_700_000_101_000
         }
+      },
+      {
+        // The same shape a live failed completion writes.
+        key: 'legacy:codex:session-1:turn-lifecycle%3Aturn-failed',
+        body: {
+          kind: 'turn',
+          turnId: 'turn-failed',
+          state: 'completed',
+          outcome: 'failure',
+          userItemId: 'codex:thread-abc:turn-failed:0',
+          startedAt: 1_700_000_150_000,
+          completedAt: 1_700_000_152_000,
+          durationMs: 2_400
+        }
+      },
+      {
+        // Ended, but not a status this build can place: no verdict, never a clean finish.
+        key: 'legacy:codex:session-1:turn-lifecycle%3Aturn-unplaced',
+        body: {
+          kind: 'turn',
+          turnId: 'turn-unplaced',
+          state: 'completed',
+          userItemId: 'codex:thread-abc:turn-unplaced:0',
+          startedAt: 1_700_000_170_000,
+          completedAt: 1_700_000_171_000
+        }
       }
     ])
     expect(tap.tombstones).toEqual([])
diff --git a/src/main/codex/codex-structured-journal-translation-turn-settles-once.test.ts b/src/main/codex/codex-structured-journal-translation-turn-settles-once.test.ts
new file mode 100644
index 00000000000..77638a7d1ea
--- /dev/null
+++ b/src/main/codex/codex-structured-journal-translation-turn-settles-once.test.ts
@@ -0,0 +1,299 @@
+import { describe, expect, it } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity
+} from '../../shared/agent-session-journal-types'
+import {
+  agentJournalItemKey,
+  agentJournalSubmissionKey
+} from '../../shared/agent-session-journal-item-key'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { createCodexJournalTranslator } from './codex-structured-journal-translation'
+import type { CodexStructuredSessionEvent } from './codex-structured-session-adapter'
+
+const SESSION_ID = 'session-1'
+const THREAD_ID = 'thread-abc'
+const TURN_ID = 'turn-1'
+const NEXT_TURN_ID = 'turn-2'
+const CLIENT_MESSAGE_ID = 'client-1'
+
+type Row = { key: string; body: AgentJournalItemBody }
+
+function recorder() {
+  const rows: Row[] = []
+  let refuseTerminal = 0
+  const sink: StructuredAgentSessionEventSink = {
+    appendItem: (identity: AgentJournalItemIdentity, body) =>
+      rows.push({ key: agentJournalItemKey(identity), body }),
+    tryAppendItem: (identity: AgentJournalItemIdentity, body) => {
+      if (body.kind === 'turn' && body.state !== 'running' && refuseTerminal > 0) {
+        refuseTerminal -= 1
+        return { accepted: false, reason: 'backpressure' }
+      }
+      rows.push({ key: agentJournalItemKey(identity), body })
+      return { accepted: true }
+    },
+    appendTombstone: () => {},
+    publish: () => {}
+  }
+  return {
+    sink,
+    rows,
+    refuseNextTerminalWrite: () => {
+      refuseTerminal += 1
+    }
+  }
+}
+
+function notification(method: string, params: unknown, observedAt: number) {
+  return {
+    type: 'notification',
+    sessionId: SESSION_ID,
+    threadId: THREAD_ID,
+    method,
+    params,
+    observedAt
+  } satisfies CodexStructuredSessionEvent
+}
+
+function translator(tap: ReturnType<typeof recorder>) {
+  return createCodexJournalTranslator({
+    sink: tap.sink,
+    sessionId: SESSION_ID,
+    primaryThreadId: () => THREAD_ID,
+    dispatchRequestOrigin: () => ({ requestedAt: 900, sequence: 0 })
+  })
+}
+
+/** Every lifecycle write for a turn, in order: what a reader could observe. */
+function turnWrites(rows: readonly Row[], turnId: string) {
+  return rows.flatMap((row) =>
+    row.body.kind === 'turn' && row.body.turnId === turnId ? [row.body] : []
+  )
+}
+
+function terminalWrites(rows: readonly Row[], turnId: string) {
+  return turnWrites(rows, turnId).filter((body) => body.state !== 'running')
+}
+
+/** The body the journal reducer keeps for a turn's lifecycle row. */
+function settledRecord(rows: readonly Row[], turnId: string) {
+  return rows
+    .map((row) => row.body)
+    .findLast((body) => body.kind === 'turn' && body.turnId === turnId)
+}
+
+/** Codex's frames for a turn that fails: the error, then the failed completion. */
+function runFailedTurn(handle: (event: CodexStructuredSessionEvent) => unknown) {
+  handle(notification('turn/started', { turn: { id: TURN_ID } }, 1_000))
+  handle(
+    notification(
+      'item/started',
+      {
+        turnId: TURN_ID,
+        turn: { id: TURN_ID },
+        item: { type: 'userMessage', id: 'user-1', clientId: CLIENT_MESSAGE_ID }
+      },
+      1_100
+    )
+  )
+  handle(
+    notification(
+      'item/completed',
+      {
+        turnId: TURN_ID,
+        item: { type: 'agentMessage', id: 'agent-1', text: 'Checking the build' }
+      },
+      1_500
+    )
+  )
+  handle(
+    notification(
+      'error',
+      {
+        threadId: THREAD_ID,
+        turnId: TURN_ID,
+        willRetry: false,
+        error: { message: 'stream disconnected before completion' }
+      },
+      2_000
+    )
+  )
+  handle(
+    notification(
+      'turn/completed',
+      { turn: { id: TURN_ID, status: 'failed', durationMs: 1_100 } },
+      2_100
+    )
+  )
+}
+
+describe('a Codex turn ends once, on its completion', () => {
+  it('records the failed completion Codex sends after the error, with the start this host saw', () => {
+    const tap = recorder()
+    const codex = translator(tap)
+
+    runFailedTurn((event) => codex.handle(event))
+
+    expect(terminalWrites(tap.rows, TURN_ID)).toHaveLength(1)
+    expect(settledRecord(tap.rows, TURN_ID)).toEqual({
+      kind: 'turn',
+      turnId: TURN_ID,
+      state: 'completed',
+      outcome: 'failure',
+      userItemId: agentJournalSubmissionKey(CLIENT_MESSAGE_ID),
+      startedAt: 1_000,
+      requestedAt: 900,
+      completedAt: 2_100,
+      durationMs: 1_100
+    })
+    expect(
+      tap.rows.filter((row) => row.body.kind === 'status' && row.body.tone === 'error')
+    ).toHaveLength(1)
+  })
+
+  it('records an exit between the error and the completion as interrupted, with no verdict', () => {
+    // Orca records only an end it observed. The exit is that end; the failure
+    // Codex would have named arrives only in the completion, which never came.
+    const tap = recorder()
+    const codex = translator(tap)
+    const events: CodexStructuredSessionEvent[] = []
+    runFailedTurn((event) => events.push(event))
+
+    for (const event of events.slice(0, -1)) {
+      codex.handle(event)
+    }
+    codex.handle({
+      type: 'ended',
+      sessionId: SESSION_ID,
+      reason: 'lost child',
+      cause: 'unexpected-exit',
+      fence: 1,
+      acquisitionGeneration: 'generation-1',
+      observedAt: 2_050
+    })
+
+    expect(terminalWrites(tap.rows, TURN_ID)).toEqual([
+      {
+        kind: 'turn',
+        turnId: TURN_ID,
+        state: 'interrupted',
+        userItemId: agentJournalSubmissionKey(CLIENT_MESSAGE_ID),
+        startedAt: 1_000,
+        requestedAt: 900,
+        completedAt: 2_050
+      }
+    ])
+    expect(
+      tap.rows.filter((row) => row.body.kind === 'status' && row.body.tone === 'error')
+    ).toHaveLength(1)
+  })
+
+  it('revises the still-open turn with a send Codex echoes between the error and the completion', () => {
+    // Codex records a failed turn's pending input after its `error` frame and
+    // before `turn/completed`, so the echo belongs to a turn that is still open.
+    const tap = recorder()
+    const codex = translator(tap)
+    const events: CodexStructuredSessionEvent[] = []
+    runFailedTurn((event) => events.push(event))
+    const [started, echo, reply, error, completion] = events
+
+    for (const event of [started, reply, error, echo, completion]) {
+      if (event) {
+        codex.handle(event)
+      }
+    }
+
+    expect(turnWrites(tap.rows, TURN_ID).map((body) => body.state)).toEqual([
+      'running',
+      'running',
+      'completed'
+    ])
+    expect(settledRecord(tap.rows, TURN_ID)).toMatchObject({
+      outcome: 'failure',
+      userItemId: agentJournalSubmissionKey(CLIENT_MESSAGE_ID),
+      requestedAt: 900,
+      startedAt: 1_000,
+      durationMs: 1_100
+    })
+  })
+
+  it('settles once when the sink refuses the completion and its retry lands', () => {
+    // A refused frame is Orca's only redelivery of a completion, and a refused
+    // end changes nothing, so the retry settles the turn exactly once.
+    const tap = recorder()
+    const codex = translator(tap)
+    const completion = notification(
+      'turn/completed',
+      { turn: { id: TURN_ID, status: 'completed', durationMs: 900 } },
+      2_000
+    )
+
+    codex.handle(notification('turn/started', { turn: { id: TURN_ID } }, 1_000))
+    tap.refuseNextTerminalWrite()
+    expect(codex.handle(completion)).toEqual({ accepted: false, reason: 'backpressure' })
+    expect(codex.handle(completion)).toEqual({ accepted: true })
+
+    expect(terminalWrites(tap.rows, TURN_ID)).toEqual([
+      expect.objectContaining({
+        state: 'completed',
+        outcome: 'success',
+        startedAt: 1_000,
+        completedAt: 2_000,
+        durationMs: 900
+      })
+    ])
+  })
+
+  it('settles an ordinary turn exactly as before', () => {
+    const tap = recorder()
+    const codex = translator(tap)
+
+    codex.handle(notification('turn/started', { turn: { id: TURN_ID } }, 1_000))
+    codex.handle(
+      notification(
+        'turn/completed',
+        { turn: { id: TURN_ID, status: 'completed', durationMs: 3_250 } },
+        4_500
+      )
+    )
+
+    expect(terminalWrites(tap.rows, TURN_ID)).toEqual([
+      {
+        kind: 'turn',
+        turnId: TURN_ID,
+        state: 'completed',
+        outcome: 'success',
+        userItemId: `codex:${THREAD_ID}:${TURN_ID}:0`,
+        startedAt: 1_000,
+        completedAt: 4_500,
+        durationMs: 3_250
+      }
+    ])
+  })
+
+  it('settles the next turn on its own after a failed one', () => {
+    const tap = recorder()
+    const codex = translator(tap)
+
+    runFailedTurn((event) => codex.handle(event))
+    const failed = settledRecord(tap.rows, TURN_ID)
+    codex.handle(notification('turn/started', { turn: { id: NEXT_TURN_ID } }, 3_000))
+    codex.handle(
+      notification(
+        'turn/completed',
+        { turn: { id: NEXT_TURN_ID, status: 'completed', durationMs: 1_000 } },
+        4_000
+      )
+    )
+
+    expect(settledRecord(tap.rows, TURN_ID)).toEqual(failed)
+    expect(terminalWrites(tap.rows, NEXT_TURN_ID)).toHaveLength(1)
+    expect(settledRecord(tap.rows, NEXT_TURN_ID)).toMatchObject({
+      state: 'completed',
+      outcome: 'success',
+      startedAt: 3_000,
+      completedAt: 4_000
+    })
+  })
+})
diff --git a/src/main/codex/codex-structured-journal-translation-turn-state.ts b/src/main/codex/codex-structured-journal-translation-turn-state.ts
index ec1cff041db..4c1e739705d 100644
--- a/src/main/codex/codex-structured-journal-translation-turn-state.ts
+++ b/src/main/codex/codex-structured-journal-translation-turn-state.ts
@@ -57,12 +57,6 @@ export class CodexJournalActiveTurns {
     return [...(this.byThread.get(threadId) ?? [])].at(-1) ?? null
   }
 
-  /** Whether this turn is still open here. A terminal row already written carries
-   *  the turn's start and duration, so a later end must not overwrite it. */
-  isActive(threadId: string, turnId: string): boolean {
-    return this.byThread.get(threadId)?.has(turnId) === true
-  }
-
   startedAt(threadId: string, turnId: string): number | undefined {
     return this.startedAtByTurn.get(this.turnKey(threadId, turnId))
   }
@@ -167,7 +161,7 @@ type RecentTurn = {
   bytes: number
 }
 
-/** Bounded terminal lifecycle window for exact echoes that arrive after completion. */
+/** Bounded terminal lifecycle window: exact echoes that arrive after completion revise it. */
 export class CodexJournalRecentTurns {
   private readonly turns = new Map<string, RecentTurn>()
   private retainedBytes = 0
diff --git a/src/main/codex/codex-structured-journal-translation-turns.ts b/src/main/codex/codex-structured-journal-translation-turns.ts
index 8678c175599..349233a32d1 100644
--- a/src/main/codex/codex-structured-journal-translation-turns.ts
+++ b/src/main/codex/codex-structured-journal-translation-turns.ts
@@ -1,9 +1,10 @@
-import type {
-  AgentJournalItemIdentity,
-  AgentJournalTurnItem,
-  AgentJournalTurnLifecycle,
-  AgentJournalTurnLifecycleState,
-  AgentJournalTurnOutcome
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalItemIdentity,
+  type AgentJournalTurnItem,
+  type AgentJournalTurnLifecycle,
+  type AgentJournalTurnLifecycleState,
+  type AgentJournalTurnOutcome
 } from '../../shared/agent-session-journal-types'
 import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
 import { agentJournalTurnBody } from '../../shared/agent-session-turn-record'
@@ -43,12 +44,12 @@ export function codexTurnLifecycleBody(
   return agentJournalTurnBody(turnLifecycle)
 }
 
-/** Maps a `turn/completed` status; a missing one is a clean finish. A terminal
- *  `error` also ends a turn and names its own outcome rather than coming here. */
+/** Maps a `turn/completed` status, live or restored. Only `interrupted` is a stop;
+ *  a failed turn completed, and `codexTurnOutcome` says it failed. */
 export function codexTurnLifecycleState(
   status: string | null
 ): Extract<AgentJournalTurnLifecycleState, 'completed' | 'interrupted'> {
-  return status === null || status === 'completed' ? 'completed' : 'interrupted'
+  return status === 'interrupted' ? 'interrupted' : 'completed'
 }
 
 /**
@@ -109,6 +110,7 @@ export function publishCodexTurnLifecycle(input: {
   // The running row's `ts` is the host's turn-start receipt so clients can anchor a live counter.
   const appendOptions = {
     lifecycle: true,
+    turnScope: AGENT_JOURNAL_THREAD_SCOPE,
     ...(input.state === 'running' && input.startedAt !== undefined
       ? { observedAt: input.startedAt }
       : {})
diff --git a/src/main/codex/codex-structured-journal-translation-writers.ts b/src/main/codex/codex-structured-journal-translation-writers.ts
index c4fba2c1370..b13a7212142 100644
--- a/src/main/codex/codex-structured-journal-translation-writers.ts
+++ b/src/main/codex/codex-structured-journal-translation-writers.ts
@@ -1,6 +1,6 @@
 // The translator's writers, built once. Split out so the translator reads as
 // routing, and so one place shows that every writer is handed the same
-// producer resolver: the roster's, which knows each child thread.
+// row attribution: the roster's producer, which knows each child thread, and the turn scope.
 
 import { CodexJournalCompactions } from './codex-structured-journal-compactions'
 import type { CodexJournalTranslatorDeps } from './codex-structured-journal-contracts'
@@ -8,38 +8,55 @@ import { CodexJournalGenericFrames } from './codex-structured-journal-generic-fr
 import { CodexJournalGoals } from './codex-structured-journal-goals'
 import { CodexJournalItems } from './codex-structured-journal-items'
 import { CodexJournalPrompts } from './codex-structured-journal-prompts'
-import { createCodexOversizedNotificationSettler } from './codex-structured-journal-translation-frames'
 import { CodexJournalActiveTurns } from './codex-structured-journal-translation-turn-state'
+import { CodexJournalTurnScopes } from './codex-journal-turn-scopes'
+import { CodexJournalCommandTurn } from './codex-journal-command-turn'
 import { CodexSubagentRoster } from './codex-subagent-roster'
+import type { CodexRowAttribution } from './codex-subagent-linkage'
 
 export function createCodexJournalTranslatorWriters(deps: CodexJournalTranslatorDeps) {
   const activeTurns = new CodexJournalActiveTurns()
   const activeTurn = (threadId: string): string | null => activeTurns.current(threadId)
+  const primaryThreadId = (): string | null => deps.primaryThreadId?.() ?? null
+  const commands = new CodexJournalCommandTurn()
+  const turnScopes = new CodexJournalTurnScopes({
+    sessionId: deps.sessionId,
+    primaryThreadId,
+    activeTurn,
+    commandScope: (turnId) => commands.scopeFor(turnId)
+  })
   const subagents = new CodexSubagentRoster({
     sink: deps.sink,
-    primaryThreadId: () => deps.primaryThreadId?.() ?? null,
+    primaryThreadId,
     activeTurn,
+    turnScopeFor: (threadId, turnId) => turnScopes.scopeFor(threadId, turnId),
     ...(deps.subagentExecutions ? { executions: deps.subagentExecutions } : {})
   })
   const { linkageFor } = subagents.linkage
-  const producerDeps = { ...deps, linkageFor }
+  const attributionFor: CodexRowAttribution = (threadId, turnId) => ({
+    ...linkageFor(threadId, turnId),
+    turnScope: turnScopes.scopeFor(threadId, turnId)
+  })
+  const producerDeps = { ...deps, attributionFor }
   const genericFrames = new CodexJournalGenericFrames(producerDeps, activeTurn)
   const items = new CodexJournalItems(producerDeps, activeTurn, (threadId, turnId) =>
     genericFrames.suppress(threadId, turnId)
   )
   return {
     activeTurns,
+    commands,
     subagents,
-    linkageFor,
+    attributionFor,
     genericFrames,
     items,
-    compactions: new CodexJournalCompactions(deps.sink, activeTurn, linkageFor),
-    goals: new CodexJournalGoals(deps.sink, linkageFor),
+    compactions: new CodexJournalCompactions(deps.sink, activeTurn, attributionFor, (turnId) =>
+      commands.compacted(turnId)
+    ),
+    goals: new CodexJournalGoals(deps.sink, attributionFor),
     prompts: new CodexJournalPrompts(
       producerDeps,
       (threadId, itemId) => items.detailFor(threadId, itemId),
       activeTurn
-    ),
-    settleOversizedNotification: createCodexOversizedNotificationSettler(producerDeps, items)
+    )
   }
 }
diff --git a/src/main/codex/codex-structured-journal-translation.test.ts b/src/main/codex/codex-structured-journal-translation.test.ts
index d902b7b4725..676d9054ed7 100644
--- a/src/main/codex/codex-structured-journal-translation.test.ts
+++ b/src/main/codex/codex-structured-journal-translation.test.ts
@@ -287,7 +287,7 @@ describe('codex journal translation', () => {
     ).toBe('idle')
   })
 
-  describe('a terminal error ends the turn it names', () => {
+  describe('a turn-ending error is a row on the turn it names, and the completion ends it', () => {
     function statusOf(rows: readonly Row[]) {
       return projectStructuredAgentSessionStatus(
         reduced(rows).map((row, sequence) => ({
@@ -308,7 +308,11 @@ describe('codex journal translation', () => {
       })
     }
 
-    it('settles the turn and keeps the provider sentence as its own row', () => {
+    const FAILED_COMPLETION = notification('turn/completed', {
+      turn: { id: TURN_ID, status: 'failed', durationMs: 2_400 }
+    })
+
+    it('keeps the turn working through the error, and the failed completion settles it', () => {
       const tap = recorder()
       const translator = createCodexJournalTranslator({
         sink: tap.sink,
@@ -316,17 +320,21 @@ describe('codex journal translation', () => {
       })
 
       translator.handle(TURN_STARTED)
-      expect(statusOf(tap.rows)).toBe('working')
-
       translator.handle(errorNotification({ turnId: TURN_ID, willRetry: false }))
 
+      expect(statusOf(tap.rows)).toBe('working')
+      expect(tap.rows.filter((row) => row.body.kind === 'turn')).toHaveLength(1)
+
+      translator.handle(FAILED_COMPLETION)
+
       expect(statusOf(tap.rows)).toBe('idle')
       expect(reduced(tap.rows).map((row) => row.body)).toContainEqual(
         expect.objectContaining({
           kind: 'turn',
           turnId: TURN_ID,
           state: 'completed',
-          outcome: 'failure'
+          outcome: 'failure',
+          durationMs: 2_400
         })
       )
       // The message the user reads is still a row of its own.
@@ -353,7 +361,7 @@ describe('codex journal translation', () => {
       expect(tap.rows.filter((row) => row.body.kind === 'turn')).toHaveLength(1)
     })
 
-    it('does not overwrite the terminal row of a turn that already completed', () => {
+    it('writes only its row for an error after the turn completed', () => {
       const tap = recorder()
       const translator = createCodexJournalTranslator({
         sink: tap.sink,
@@ -361,21 +369,16 @@ describe('codex journal translation', () => {
       })
 
       translator.handle(TURN_STARTED)
-      translator.handle(
-        notification('turn/completed', {
-          turn: { id: TURN_ID, status: 'failed', durationMs: 4_000 }
-        })
-      )
+      translator.handle(FAILED_COMPLETION)
       const settled = reduced(tap.rows).find((row) => row.body.kind === 'turn')?.body
 
       translator.handle(errorNotification({ turnId: TURN_ID, willRetry: false }))
 
-      // The completion carries the duration a late error could not reconstruct.
       expect(reduced(tap.rows).find((row) => row.body.kind === 'turn')?.body).toEqual(settled)
       expect(statusOf(tap.rows)).toBe('idle')
     })
 
-    it('settles the running turn when the error names no turn', () => {
+    it('settles nothing when the error names no turn', () => {
       const tap = recorder()
       const translator = createCodexJournalTranslator({
         sink: tap.sink,
@@ -385,21 +388,8 @@ describe('codex journal translation', () => {
       translator.handle(TURN_STARTED)
       translator.handle(errorNotification({ willRetry: false }))
 
-      expect(statusOf(tap.rows)).toBe('idle')
-    })
-
-    it('does not reopen a running row when the completion arrives after the error', () => {
-      const tap = recorder()
-      const translator = createCodexJournalTranslator({
-        sink: tap.sink,
-        primaryThreadId: () => THREAD_ID
-      })
-
-      translator.handle(TURN_STARTED)
-      translator.handle(errorNotification({ turnId: TURN_ID, willRetry: false }))
-      translator.handle(notification('turn/completed', { turn: { id: TURN_ID, status: 'failed' } }))
-
-      expect(statusOf(tap.rows)).toBe('idle')
+      expect(statusOf(tap.rows)).toBe('working')
+      expect(tap.rows.filter((row) => row.body.kind === 'turn')).toHaveLength(1)
     })
   })
 
@@ -446,14 +436,12 @@ describe('codex journal translation', () => {
       expect(stopped).toEqual([])
     })
 
-    it('releases after systemError arrives before the terminal error notification', () => {
+    it('releases after the failed completion that follows systemError and the error', () => {
       const stopped: string[] = []
       const { translator } = translatorReporting(stopped)
 
       translator.handle(TURN_STARTED)
       translator.handle(statusChanged('systemError'))
-      expect(stopped).toEqual([])
-
       translator.handle(
         notification('error', {
           turnId: TURN_ID,
@@ -461,6 +449,9 @@ describe('codex journal translation', () => {
           error: { message: 'fatal' }
         })
       )
+      expect(stopped).toEqual([])
+
+      translator.handle(notification('turn/completed', { turn: { id: TURN_ID, status: 'failed' } }))
 
       expect(stopped).toEqual([THREAD_ID])
     })
diff --git a/src/main/codex/codex-structured-journal-translation.ts b/src/main/codex/codex-structured-journal-translation.ts
index fb90cb73128..8e05506509a 100644
--- a/src/main/codex/codex-structured-journal-translation.ts
+++ b/src/main/codex/codex-structured-journal-translation.ts
@@ -11,9 +11,8 @@ import { restoreCodexJournalThread } from './codex-structured-journal-translatio
 import { CodexJournalTurnBoundaries } from './codex-structured-journal-translation-turn-boundaries'
 import { createCodexJournalTranslatorWriters } from './codex-structured-journal-translation-writers'
 import { publishCodexTurnLifecycle } from './codex-structured-journal-translation-turns'
-import { readCodexProviderVerdict } from './codex-structured-journal-provider-verdicts'
 import { createCodexThreadItemRouter } from './codex-structured-journal-thread-item-routing'
-import { readCodexTurnId } from './codex-structured-thread-facts'
+import { codexThreadStoppedRunning, readCodexTurnId } from './codex-structured-thread-facts'
 import type { CodexStructuredSessionEvent } from './codex-structured-session-adapter'
 
 export type {
@@ -38,14 +37,14 @@ export function createCodexJournalTranslator(
 ): CodexJournalTranslator {
   const {
     activeTurns,
+    commands,
     subagents,
-    linkageFor,
+    attributionFor,
     genericFrames,
     items,
     compactions,
     goals,
-    prompts,
-    settleOversizedNotification
+    prompts
   } = createCodexJournalTranslatorWriters(deps)
   const flushStreams = (): CodexJournalTranslationAdmission =>
     items.streams.flush() ? CODEX_JOURNAL_ADMITTED : { accepted: false, reason: 'backpressure' }
@@ -65,7 +64,8 @@ export function createCodexJournalTranslator(
     ...(deps.clearPromptTurn ? { clearPromptTurn: deps.clearPromptTurn } : {}),
     flushSuppression: () => genericFrames.flush(),
     resetActivity,
-    linkageFor,
+    attributionFor,
+    commands,
     ...(deps.now ? { now: deps.now } : {})
   })
   let primaryThreadStoppedRunning = false
@@ -160,11 +160,13 @@ export function createCodexJournalTranslator(
           // The host saw the child go, not what Codex made of the turn, so the row
           // carries no outcome: the end is observed, the verdict is unknown.
           settledTurnLifecycle: (threadId, turnId) =>
-            turnBoundaries.settled(threadId, turnId, {
-              state: 'interrupted',
-              completedAt: event.observedAt ?? deps.now?.() ?? Date.now()
-            }),
-          linkageFor
+            turnBoundaries.ownsRecord(threadId, turnId)
+              ? turnBoundaries.settled(threadId, turnId, {
+                  state: 'interrupted',
+                  completedAt: event.observedAt ?? deps.now?.() ?? Date.now()
+                })
+              : null,
+          attributionFor
         })
         if (!admission.accepted) {
           return admission
@@ -205,10 +207,6 @@ export function createCodexJournalTranslator(
         )
       }
       if (event.type === 'provider-frame') {
-        const settlement = settleOversizedNotification(event)
-        if (settlement && !settlement.accepted) {
-          return settlement
-        }
         return genericFrames.appendUnhandled(event.kind, event.payload, event.threadId)
       }
       if (event.method === 'turn/started' || event.method === 'turn/completed') {
@@ -249,30 +247,32 @@ export function createCodexJournalTranslator(
           return publishActivity(event, routed)
         }
       }
-      const verdict = readCodexProviderVerdict(event.method, event.params)
+      // A thread that stopped running settles no open turn: Codex clears `running`
+      // on every error, and an open turn ends on its `turn/completed`. It releases
+      // a send whose dispatch was never answered, which nothing else re-derives live.
       if (
-        verdict === 'thread-stopped-running' &&
+        event.method === 'thread/status/changed' &&
+        codexThreadStoppedRunning(event.params) &&
         event.threadId === (deps.primaryThreadId?.() ?? null)
       ) {
         primaryThreadStoppedRunning = true
         reportPrimaryThreadStoppedRunning()
       }
-      // The row carries the provider's sentence and is written first, so it lands
-      // inside the turn this same frame is about to end.
+      // A turn-ending `error` is a row inside the turn it names; the failed
+      // `turn/completed` Codex sends after it is that turn's end.
       const unhandled = genericFrames.appendUnhandled(
         `notification:${event.method}`,
         event.params,
         event.threadId
       )
-      if (unhandled.accepted && verdict === 'turn-failed') {
-        const failed = turnBoundaries.fail(event)
-        if (!failed.accepted) {
-          return failed
-        }
-        reportPrimaryThreadStoppedRunning()
+      if (unhandled.accepted && event.method === 'error') {
+        commands.errorShown(event.params)
       }
       return publishActivity(event, unhandled)
     },
+    beginCommand: (command) => commands.begin(command),
+    forgetCommand: (turnId) => commands.forget(turnId),
+    commandProviderTurnId: (turnId) => commands.providerTurnId(turnId),
     cancelPrompt: (journalItemId) => prompts.cancel(journalItemId),
     resolvePrompt: (journalItemId) => prompts.resolve(journalItemId),
     flush: () => {
diff --git a/src/main/codex/codex-structured-journal-turn-endings-replay.test.ts b/src/main/codex/codex-structured-journal-turn-endings-replay.test.ts
new file mode 100644
index 00000000000..d1de7e74766
--- /dev/null
+++ b/src/main/codex/codex-structured-journal-turn-endings-replay.test.ts
@@ -0,0 +1,206 @@
+// Real `codex app-server` frame orders, replayed through the translator.
+//
+// The fixture is trimmed from captures of the real binary on 0.141.0 (the oldest
+// version Orca exercises) and 0.158.0, with only the upstream provider faked:
+// statuses, `willRetry`, the provider's sentence and `durationMs`, at the host
+// receipt time `t` each frame arrived. Ids are replaced with synthetic ones.
+
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity
+} from '../../shared/agent-session-journal-types'
+import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { createCodexJournalTranslator } from './codex-structured-journal-translation'
+import {
+  readCodexThreadId,
+  readCodexTurnDurationMs,
+  readCodexTurnId,
+  readCodexTurnStatus
+} from './codex-structured-thread-facts'
+
+const SESSION_ID = 'session-1'
+
+type CapturedFrame = { case: string; t: number; method: string; params: Record<string, unknown> }
+type Row = { key: string; body: AgentJournalItemBody }
+
+const FRAMES: CapturedFrame[] = readFileSync(
+  join(__dirname, '__fixtures__', 'codex-app-server-turn-endings.jsonl'),
+  'utf8'
+)
+  .split('\n')
+  .filter((line) => line.length > 0)
+  .map((line) => JSON.parse(line))
+
+function framesOf(name: string): CapturedFrame[] {
+  const frames = FRAMES.filter((frame) => frame.case === name)
+  expect(frames.length).toBeGreaterThan(0)
+  return frames
+}
+
+/** Replays a case's frames, or only its first `count`. */
+function replay(name: string, count = Number.POSITIVE_INFINITY) {
+  const frames = framesOf(name).slice(0, count)
+  const threadId = readCodexThreadId(frames[0]?.params) ?? ''
+  const rows: Row[] = []
+  const sink: StructuredAgentSessionEventSink = {
+    appendItem: (identity: AgentJournalItemIdentity, body) =>
+      rows.push({ key: agentJournalItemKey(identity), body }),
+    appendTombstone: () => {},
+    publish: () => {}
+  }
+  const translator = createCodexJournalTranslator({
+    sink,
+    sessionId: SESSION_ID,
+    primaryThreadId: () => threadId
+  })
+  for (const frame of frames) {
+    expect(
+      translator.handle({
+        type: 'notification',
+        sessionId: SESSION_ID,
+        threadId,
+        method: frame.method,
+        params: frame.params,
+        observedAt: frame.t
+      })
+    ).toEqual({ accepted: true })
+  }
+  return { frames, rows, translator }
+}
+
+function turnWrites(rows: readonly Row[], turnId: string) {
+  return rows
+    .map((row) => row.body)
+    .filter((body) => body.kind === 'turn' && body.turnId === turnId)
+}
+
+function terminalWrites(rows: readonly Row[], turnId: string) {
+  return turnWrites(rows, turnId).filter((body) => body.kind === 'turn' && body.state !== 'running')
+}
+
+function receipt(frames: readonly CapturedFrame[], method: string, turnId: string): number {
+  const frame = frames.find(
+    (entry) => entry.method === method && readCodexTurnId(entry.params) === turnId
+  )
+  if (!frame) {
+    throw new Error(`no ${method} for ${turnId}`)
+  }
+  return frame.t
+}
+
+function completion(frames: readonly CapturedFrame[], turnId: string) {
+  const frame = frames.find(
+    (entry) => entry.method === 'turn/completed' && readCodexTurnId(entry.params) === turnId
+  )
+  return frame
+    ? {
+        t: frame.t,
+        status: readCodexTurnStatus(frame.params),
+        durationMs: readCodexTurnDurationMs(frame.params)
+      }
+    : null
+}
+
+const VERDICT: Record<string, { state: string; outcome: string }> = {
+  completed: { state: 'completed', outcome: 'success' },
+  failed: { state: 'completed', outcome: 'failure' },
+  interrupted: { state: 'interrupted', outcome: 'cancellation' }
+}
+
+const ENDED_CASES = [...new Set(FRAMES.map((frame) => frame.case))].filter(
+  (name) => name !== '0.158.0-conn-refused'
+)
+
+describe('captured Codex turns end once, on their own completion', () => {
+  it.each(ENDED_CASES)('%s', (name) => {
+    const { frames, rows } = replay(name)
+    const turnIds = frames
+      .filter((frame) => frame.method === 'turn/started')
+      .map((frame) => readCodexTurnId(frame.params) ?? '')
+
+    expect(turnIds.length).toBeGreaterThan(0)
+    for (const turnId of turnIds) {
+      const end = completion(frames, turnId)
+      expect(end).not.toBeNull()
+      if (!end) {
+        continue
+      }
+      const verdict = VERDICT[end.status ?? '']
+      expect(verdict).toBeDefined()
+      // One terminal write per turn, and it is Codex's own completion: its time,
+      // its duration and its verdict, with the start this host saw.
+      expect(terminalWrites(rows, turnId)).toEqual([
+        expect.objectContaining({
+          state: verdict?.state,
+          outcome: verdict?.outcome,
+          startedAt: receipt(frames, 'turn/started', turnId),
+          completedAt: end.t,
+          durationMs: end.durationMs
+        })
+      ])
+    }
+  })
+
+  it('keeps every failed turn working through its error until the completion', () => {
+    for (const name of ENDED_CASES) {
+      const frames = framesOf(name)
+      const failedTurns = frames
+        .filter((frame) => frame.method === 'error' && frame.params.willRetry === false)
+        .map((frame) => readCodexTurnId(frame.params) ?? '')
+      for (const turnId of failedTurns) {
+        const errorAt = frames.findIndex(
+          (frame) =>
+            frame.method === 'error' &&
+            frame.params.willRetry === false &&
+            readCodexTurnId(frame.params) === turnId
+        )
+        // Through the error, the turn is open; the completion right after it ends it.
+        expect(terminalWrites(replay(name, errorAt + 1).rows, turnId)).toEqual([])
+        expect(terminalWrites(replay(name).rows, turnId)).toHaveLength(1)
+      }
+    }
+  })
+
+  it('keeps a turn Codex is still retrying on 0.158.0 running, and the exit sweep ends it', () => {
+    const { frames, rows, translator } = replay('0.158.0-conn-refused')
+    const turnId =
+      readCodexTurnId(frames.find((frame) => frame.method === 'turn/started')?.params) ?? ''
+    const retries = frames.filter((frame) => frame.method === 'error')
+
+    // Seven "Reconnecting... waiting for network" frames over four minutes, all
+    // willRetry, and no completion: the turn is genuinely still open.
+    expect(retries).toHaveLength(7)
+    expect(retries.every((frame) => frame.params.willRetry === true)).toBe(true)
+    expect(turnWrites(rows, turnId)).toEqual([
+      expect.objectContaining({
+        state: 'running',
+        startedAt: receipt(frames, 'turn/started', turnId)
+      })
+    ])
+
+    translator.handle({
+      type: 'ended',
+      sessionId: SESSION_ID,
+      reason: 'lost child',
+      cause: 'unexpected-exit',
+      fence: 1,
+      acquisitionGeneration: 'generation-1',
+      observedAt: 250_000
+    })
+
+    expect(terminalWrites(rows, turnId)).toEqual([
+      {
+        kind: 'turn',
+        turnId,
+        state: 'interrupted',
+        userItemId: `codex:${readCodexThreadId(frames[0]?.params)}:${turnId}:0`,
+        startedAt: receipt(frames, 'turn/started', turnId),
+        completedAt: 250_000
+      }
+    ])
+  })
+})
diff --git a/src/main/codex/codex-structured-journal-turn-settles-once-journal.test.ts b/src/main/codex/codex-structured-journal-turn-settles-once-journal.test.ts
new file mode 100644
index 00000000000..4e3caaa8bc0
--- /dev/null
+++ b/src/main/codex/codex-structured-journal-turn-settles-once-journal.test.ts
@@ -0,0 +1,149 @@
+// A failed Codex turn through the real path its record takes:
+// translator → deferred sink queue → on-disk journal → the shared turn-timing reader.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { readAgentJournalTurn } from '../../shared/agent-session-turn-record'
+import {
+  completedStructuredAgentTurnSeconds,
+  selectStructuredAgentRunningTurnTiming
+} from '../../shared/structured-agent-session-turn-timing'
+import { openAgentSessionJournal } from '../native-chat/agent-session-journal/journal-store-factory'
+import { createDeferredStructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { createCodexJournalTranslator } from './codex-structured-journal-translation'
+
+const SESSION = 'session-codex-failed-turn'
+const THREAD = 'thread-abc'
+const TURN = 'turn-1'
+
+const cleanups: (() => Promise<void>)[] = []
+afterEach(async () => {
+  for (const cleanup of cleanups.splice(0)) {
+    await cleanup()
+  }
+})
+
+async function session() {
+  const root = await mkdtemp(join(tmpdir(), 'orca-codex-failed-turn-'))
+  const journal = await openAgentSessionJournal({
+    identity: {
+      sessionId: SESSION,
+      workspaceId: 'workspace-1',
+      hostId: 'local',
+      agent: 'codex',
+      providerHandle: { kind: 'codex', threadId: THREAD }
+    },
+    journalDir: root,
+    now: () => 1_000
+  })
+  const deferred = createDeferredStructuredAgentSessionEventSink()
+  deferred.bind({ journal, fence: 1, publish: () => {} })
+  cleanups.push(async () => {
+    deferred.close()
+    await journal.close()
+    await rm(root, { recursive: true, force: true })
+  })
+  const translator = createCodexJournalTranslator({
+    sink: deferred.sink,
+    sessionId: SESSION,
+    primaryThreadId: () => THREAD,
+    schedule: (run) => {
+      run()
+      return () => {}
+    }
+  })
+  const on = (method: string, params: Record<string, unknown>, observedAt: number) =>
+    translator.handle({
+      type: 'notification',
+      sessionId: SESSION,
+      threadId: THREAD,
+      method,
+      params: { threadId: THREAD, ...params },
+      observedAt
+    })
+  return {
+    on,
+    drained: () => deferred.drained(),
+    items: async () => {
+      await deferred.drained()
+      return journal.snapshot().items
+    }
+  }
+}
+
+function turnRecord(rows: Awaited<ReturnType<Awaited<ReturnType<typeof session>>['items']>>) {
+  return rows
+    .map((item) => readAgentJournalTurn(item.body))
+    .findLast((record) => record?.turnId === TURN)
+}
+
+describe('a failed Codex turn in the journal', () => {
+  it('keeps the failed completion, its duration and the start, when it lands while the error is still queued', async () => {
+    const { on, drained, items } = await session()
+    on('turn/started', { turn: { id: TURN } }, 1_000)
+    on(
+      'item/completed',
+      { turnId: TURN, item: { type: 'agentMessage', id: 'agent-1', text: 'Checking the build' } },
+      1_500
+    )
+    await drained()
+
+    // Codex writes both frames back to back; the error's status row is still being
+    // written when the failed completion arrives.
+    on(
+      'error',
+      { turnId: TURN, willRetry: false, error: { message: 'stream disconnected' } },
+      3_000
+    )
+    on('turn/completed', { turn: { id: TURN, status: 'failed', durationMs: 1_900 } }, 3_100)
+
+    const rows = await items()
+    expect(turnRecord(rows)).toMatchObject({
+      state: 'completed',
+      outcome: 'failure',
+      startedAt: 1_000,
+      completedAt: 3_100,
+      durationMs: 1_900
+    })
+    // "Worked for" under the turn's message reads Codex's own duration.
+    expect(
+      completedStructuredAgentTurnSeconds(selectStructuredAgentRunningTurnTiming(rows, TURN))
+    ).toBe(1)
+  })
+
+  // Codex ends a turn once, so a second completion is not expected. If one came,
+  // the settlement id keeps the first record, whether it is still queued or written.
+  it.each([
+    ['still queued', false],
+    ['already written', true]
+  ] as const)(
+    'keeps the first completion when a second one arrives while the first is %s',
+    async (_label, drainFirst) => {
+      const { on, drained, items } = await session()
+      on('turn/started', { turn: { id: TURN } }, 1_000)
+      await drained()
+
+      // The reply's row is being written, so the first completion waits behind it.
+      on(
+        'item/completed',
+        { turnId: TURN, item: { type: 'agentMessage', id: 'agent-1', text: 'Done' } },
+        1_900
+      )
+      on('turn/completed', { turn: { id: TURN, status: 'completed', durationMs: 900 } }, 2_000)
+      if (drainFirst) {
+        await drained()
+      }
+      on('turn/completed', { turn: { id: TURN, status: 'failed' } }, 3_000)
+
+      expect(turnRecord(await items())).toMatchObject({
+        state: 'completed',
+        outcome: 'success',
+        startedAt: 1_000,
+        completedAt: 2_000,
+        durationMs: 900
+      })
+    }
+  )
+})
diff --git a/src/main/codex/codex-structured-launch-resolution.test.ts b/src/main/codex/codex-structured-launch-resolution.test.ts
index 60aab5ed1db..36ab39e3bab 100644
--- a/src/main/codex/codex-structured-launch-resolution.test.ts
+++ b/src/main/codex/codex-structured-launch-resolution.test.ts
@@ -180,6 +180,16 @@ describe('codex structured launch resolution', () => {
     })
   })
 
+  // A thread opened on the configured default and then given a turn on the saved model reads to
+  // Codex as a model switch, and it injects the saved model's whole prompt a second time.
+  it('opens the thread on the model the record saved', async () => {
+    const launch = await resolverFor(
+      record({ options: { model: 'gpt-chosen', effort: 'high', fastMode: 'false' } })
+    )({ identity: IDENTITY })
+
+    expect(launch.model).toBe('gpt-chosen')
+  })
+
   // The configured CLI arguments are a terminal concern: a durable record written before they
   // stopped being read must not smuggle one back into app-server's argv.
   it("ignores the record's durable launch arguments", async () => {
diff --git a/src/main/codex/codex-structured-launch-resolution.ts b/src/main/codex/codex-structured-launch-resolution.ts
index 8a3fe002cb1..ebfdb27200a 100644
--- a/src/main/codex/codex-structured-launch-resolution.ts
+++ b/src/main/codex/codex-structured-launch-resolution.ts
@@ -94,6 +94,8 @@ export function createCodexStructuredLaunchResolver(
     const permissionPolicy = deps.resolvePermissionPolicy?.()
     const head = agentSessionProviderHandleChainHead(record.providerHandleChain)
     const resumeThreadId = head?.handle.provider === 'codex' ? head.handle.threadId : null
+    // The same saved options every turn sends, so the thread and its turns name one model.
+    const model = record.options?.model
     return {
       command,
       args: ['app-server'],
@@ -107,6 +109,7 @@ export function createCodexStructuredLaunchResolver(
       // forked or adopted head names a conversation Codex held.
       ...(resumeThreadId && head?.origin === 'created' ? { supersedeIfUnsaved: true } : {}),
       ...(permissionPolicy ? { permissionPolicy } : {}),
+      ...(model ? { model } : {}),
       ...(resumeThreadId
         ? {
             resumePath: await (deps.resolveRollout ?? resolvePinnedCodexRolloutProof)(
diff --git a/src/main/codex/codex-structured-owner-identity.ts b/src/main/codex/codex-structured-owner-identity.ts
index 44f25ea4724..805a767e620 100644
--- a/src/main/codex/codex-structured-owner-identity.ts
+++ b/src/main/codex/codex-structured-owner-identity.ts
@@ -17,6 +17,32 @@ export const CODEX_SPAWN_TOKEN_ENV = 'ORCA_AGENT_SESSION_SPAWN_TOKEN'
 
 const START_TIME_READ_ATTEMPTS = 3
 
+/**
+ * The child's identity, read once. The real connection reports its spawn before the handshake, and
+ * `onSpawned` makes it durable there, so a crash mid-start leaves an owner recovery can stop; a
+ * connection that reports no spawn is identified once it is open.
+ */
+export function codexSpawnedProcessIdentity(
+  input: {
+    identity: AgentSessionJournalIdentity
+    spawnToken: string
+    onSpawned?: (process: AgentSessionProcessIdentity) => Promise<void>
+  },
+  readStartTime?: (pid: number) => Promise<number | null>
+): {
+  onSpawned: (pid: number) => Promise<void>
+  read: (pid: number | undefined) => Promise<AgentSessionProcessIdentity>
+} {
+  let spawned: Promise<AgentSessionProcessIdentity> | undefined
+  return {
+    onSpawned: async (pid) => {
+      spawned = codexProcessIdentity({ ...input, pid }, readStartTime)
+      await input.onSpawned?.(await spawned)
+    },
+    read: (pid) => spawned ?? codexProcessIdentity({ ...input, pid }, readStartTime)
+  }
+}
+
 export async function codexProcessIdentity(
   input: {
     identity: AgentSessionJournalIdentity
diff --git a/src/main/codex/codex-structured-prompt-ownership.test.ts b/src/main/codex/codex-structured-prompt-ownership.test.ts
index cfb77e628a7..7dd048dd08a 100644
--- a/src/main/codex/codex-structured-prompt-ownership.test.ts
+++ b/src/main/codex/codex-structured-prompt-ownership.test.ts
@@ -159,7 +159,7 @@ describe('Codex live prompt ownership', () => {
       sessionId: 'session-1',
       itemId: 'journal-prompt',
       kind: 'approval',
-      optionId: 'accept',
+      response: { kind: 'option', optionId: 'accept' },
       fence: 7,
       commit: async () => {
         expect(codex.connections[0]?.replies).toEqual([])
@@ -210,7 +210,7 @@ describe('Codex live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: 'journal-prompt',
         kind: 'approval',
-        optionId: 'accept',
+        response: { kind: 'option', optionId: 'accept' },
         fence: 7,
         commit
       })
@@ -224,7 +224,7 @@ describe('Codex live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: 'journal-prompt',
         kind: 'approval',
-        optionId: 'accept',
+        response: { kind: 'option', optionId: 'accept' },
         fence: 7,
         commit
       })
@@ -237,7 +237,7 @@ describe('Codex live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: 'journal-prompt',
         kind: 'approval',
-        optionId: 'accept',
+        response: { kind: 'option', optionId: 'accept' },
         fence: 8,
         commit
       })
@@ -261,12 +261,12 @@ describe('Codex live prompt ownership', () => {
         fence: 7,
         prompt: { itemId: 'journal-prompt' }
       })
-    ).resolves.toEqual({ cancelled: false })
+    ).resolves.toEqual({ cancelled: false, refusal: {} })
     await adapter.answerPrompt({
       sessionId: 'session-1',
       itemId: 'journal-prompt',
       kind: 'approval',
-      optionId: 'decline',
+      response: { kind: 'option', optionId: 'decline' },
       fence: 7,
       commit: async () => undefined
     })
@@ -382,7 +382,7 @@ describe('Codex live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: siblingItemId,
         kind: 'question',
-        optionId: 'no',
+        response: { kind: 'answers', answers: [{ questionId: 'q2', optionIds: [], other: 'no' }] },
         fence: 7,
         commit: async () => undefined
       })
@@ -497,7 +497,7 @@ describe('Codex live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: promptItemId,
         kind: 'approval',
-        optionId: 'accept',
+        response: { kind: 'option', optionId: 'accept' },
         fence: 7,
         commit
       })
@@ -545,7 +545,7 @@ describe('Codex live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: promptItemId,
         kind: 'approval',
-        optionId: 'accept',
+        response: { kind: 'option', optionId: 'accept' },
         fence: 7,
         commit
       })
@@ -587,7 +587,7 @@ describe('Codex live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: promptItemId,
         kind: 'approval',
-        optionId: 'accept',
+        response: { kind: 'option', optionId: 'accept' },
         fence: 7,
         commit
       })
diff --git a/src/main/codex/codex-structured-prompt-ownership.ts b/src/main/codex/codex-structured-prompt-ownership.ts
index 28d060d955f..ff42a105fc6 100644
--- a/src/main/codex/codex-structured-prompt-ownership.ts
+++ b/src/main/codex/codex-structured-prompt-ownership.ts
@@ -1,28 +1,91 @@
 import {
+  AgentSessionPromptAnswerRejectedError,
   AgentSessionPromptUnavailableError,
+  type AgentSessionCancelOutcome,
   type StructuredAgentSessionAdapter
 } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
-import type { StructuredSessionCompaction } from '../native-chat/agent-session-wire/structured-session-compaction'
-import { answerCodexPrompt } from './codex-structured-prompt-replies'
+import {
+  answerCodexPrompt,
+  prepareCodexPromptAnswer,
+  type CodexPendingPrompt,
+  type CodexPreparedAnswer
+} from './codex-structured-prompt-replies'
 import { requireLiveCodexSession, type CodexSession } from './codex-structured-session-state'
 import type { CodexStructuredTurnCancellation } from './codex-structured-turn-cancellation'
 
 type CancelInput = Parameters<StructuredAgentSessionAdapter['cancelTurn']>[0]
 type AnswerInput = Parameters<StructuredAgentSessionAdapter['answerPrompt']>[0]
 
-export async function cancelCodexStructuredTurn(input: {
-  request: CancelInput
-  sessions: Map<string, CodexSession>
-  compactions: StructuredSessionCompaction
-  cancellation: CodexStructuredTurnCancellation
-}): Promise<{ cancelled: boolean }> {
-  const { request, sessions, compactions, cancellation } = input
-  const session = requireLiveCodexSession(sessions, request.sessionId)
-  const turnId = compactions.providerTurnId(request.sessionId, request.turnId)
+/** A command's Stop interrupts the provider turn carrying it; any other turn is its own. */
+function providerTurnId(session: CodexSession, turnId: string): string | undefined {
+  return session.translator ? session.translator.commandProviderTurnId(turnId) : turnId
+}
+
+/** How long a Stop waits for Codex to open the turn it answered a send into. Under the quit
+ *  path's eviction budget, which a close or quit queued behind the Stop spends. */
+export const CODEX_STOP_TURN_OPEN_WAIT_MS = 5_000
+
+/**
+ * A Stop that names no turn: interrupt the turn the journal shows, or else the one Codex reported
+ * started and not yet ended, which the journal can trail by a publish, or else the one Codex
+ * answered a send into, once it opens.
+ */
+async function cancelCodexConversation(
+  input: Parameters<typeof cancelCodexStructuredTurn>[0],
+  session: CodexSession
+): Promise<AgentSessionCancelOutcome> {
+  const { request, sessions, cancellation } = input
+  const liveTurnId = request.resolveLiveTurnId?.() ?? null
+  // A turn the journal shows that Codex has not started yet (a compaction's) has nothing to stop.
+  const turnId =
+    liveTurnId === null
+      ? ([...(session.activeTurnIds ?? [])].at(-1) ?? (await openedAnsweredTurn(session)))
+      : providerTurnId(session, liveTurnId)
   if (!turnId) {
     return { cancelled: false }
   }
+  const acquisitionGeneration = session.acquisitionGeneration
+  return cancellation.cancel(
+    session,
+    session.threadId,
+    turnId,
+    () =>
+      sessions.get(request.sessionId) === session &&
+      !session.ended &&
+      session.fence === request.fence &&
+      session.acquisitionGeneration === acquisitionGeneration
+  )
+}
+
+/** The turn Codex answered a send into and has not opened yet, once it opens; null when it ends,
+ *  the thread stops running or the child exits first, or the wait runs out. */
+async function openedAnsweredTurn(session: CodexSession): Promise<string | null> {
+  const openTurnIds = session.activeTurnIds ?? new Set<string>()
+  const answered = session.dispatchEchoes.answeredUnopenedTurn(session.threadId, openTurnIds)
+  if (!answered) {
+    return null
+  }
+  // Codex refuses an interrupt before it opens the turn.
+  await session.turnOpenWaits.wait(answered, CODEX_STOP_TURN_OPEN_WAIT_MS)
+  return session.activeTurnIds?.has(answered) ? answered : null
+}
+
+export async function cancelCodexStructuredTurn(input: {
+  request: CancelInput
+  sessions: Map<string, CodexSession>
+  cancellation: CodexStructuredTurnCancellation
+}): Promise<AgentSessionCancelOutcome> {
+  const { request, sessions, cancellation } = input
+  const session = requireLiveCodexSession(sessions, request.sessionId)
   const prompt = request.prompt
+  const requestedTurnId = request.turnId
+  if (requestedTurnId === undefined) {
+    return prompt ? { cancelled: false } : cancelCodexConversation(input, session)
+  }
+  const turnId = providerTurnId(session, requestedTurnId)
+  if (!turnId) {
+    return { cancelled: false }
+  }
   if (!prompt) {
     return cancellation.cancel(session, session.threadId, turnId)
   }
@@ -43,7 +106,7 @@ export async function cancelCodexStructuredTurn(input: {
     !session.ended &&
     session.fence === request.fence &&
     session.acquisitionGeneration === acquisitionGeneration &&
-    compactions.providerTurnId(request.sessionId, request.turnId) === turnId &&
+    providerTurnId(session, requestedTurnId) === turnId &&
     session.prompts.ownsBoundClaim(claim, prompt.itemId, claim.prompt.threadId, promptTurnId)
   let interruptConfirmed = false
   try {
@@ -69,6 +132,19 @@ export async function cancelCodexStructuredTurn(input: {
   }
 }
 
+function prepareCodexAnswer(
+  prompt: CodexPendingPrompt,
+  response: AnswerInput['response']
+): CodexPreparedAnswer {
+  try {
+    return prepareCodexPromptAnswer(prompt, response)
+  } catch (error) {
+    throw new AgentSessionPromptAnswerRejectedError(
+      error instanceof Error ? error.message : String(error)
+    )
+  }
+}
+
 export async function answerCodexStructuredPrompt(input: {
   request: AnswerInput
   sessions: Map<string, CodexSession>
@@ -84,6 +160,7 @@ export async function answerCodexStructuredPrompt(input: {
     throw new AgentSessionPromptUnavailableError(request.itemId)
   }
   try {
+    const prepared = prepareCodexAnswer(claim.prompt, request.response)
     await request.commit()
     if (
       sessions.get(request.sessionId) !== session ||
@@ -95,7 +172,7 @@ export async function answerCodexStructuredPrompt(input: {
       throw new AgentSessionPromptUnavailableError(request.itemId)
     }
     session.translator?.resolvePrompt(request.itemId)
-    answerCodexPrompt(session.prompts, session.connection, claim, request.optionId)
+    answerCodexPrompt(session.prompts, session.connection, claim, prepared)
   } catch (error) {
     session.prompts.releaseClaim(claim)
     throw error
diff --git a/src/main/codex/codex-structured-prompt-replies.test.ts b/src/main/codex/codex-structured-prompt-replies.test.ts
index e575f27632b..9f17a3efb4c 100644
--- a/src/main/codex/codex-structured-prompt-replies.test.ts
+++ b/src/main/codex/codex-structured-prompt-replies.test.ts
@@ -1,8 +1,11 @@
 import { describe, expect, it } from 'vitest'
 import { AGENT_SESSION_ID_MAX_LENGTH } from '../../shared/agent-session-wire'
+import type { AgentSessionPromptResponse } from '../../shared/agent-session-question-answer'
 import {
   applyCodexPromptAnswer,
   CodexPromptRegistry,
+  prepareCodexPromptAnswer,
+  type CodexPendingPrompt,
   MAX_CODEX_PROMPT_REGISTRY_BYTES,
   MAX_CODEX_PROMPT_REGISTRY_ENTRIES,
   codexJournalPromptIdPart,
@@ -11,6 +14,29 @@ import {
   encodeCodexQuestionOptionId
 } from './codex-structured-prompt-replies'
 
+function picked(optionId: string): AgentSessionPromptResponse {
+  return { kind: 'answers', answers: [{ questionId: 'q1', optionIds: [optionId] }] }
+}
+
+function typed(questionId: string, other: string): AgentSessionPromptResponse {
+  return { kind: 'answers', answers: [{ questionId, optionIds: [], other }] }
+}
+
+function registered(prompt: CodexPendingPrompt | null): CodexPendingPrompt {
+  if (!prompt) {
+    throw new Error('expected the request to register')
+  }
+  return prompt
+}
+
+function answer(
+  prompt: CodexPendingPrompt | null,
+  response: AgentSessionPromptResponse
+): Record<string, unknown> | null {
+  const live = registered(prompt)
+  return applyCodexPromptAnswer(live, prepareCodexPromptAnswer(live, response))
+}
+
 function userInputRequest(questionIds: string[]): {
   id: number
   method: string
@@ -59,7 +85,7 @@ describe('codex question option ids', () => {
 
     expect(Buffer.byteLength(optionId, 'utf8')).toBeLessThan(1024)
     expect(codexJournalPromptIdPart(longQuestionId)).not.toBe(longQuestionId)
-    expect(applyCodexPromptAnswer(prompt as NonNullable<typeof prompt>, optionId)).toEqual({
+    expect(answer(prompt, picked(optionId))).toEqual({
       answers: { [longQuestionId]: { answers: [longAnswer] } }
     })
   })
@@ -219,11 +245,11 @@ describe('CodexPromptRegistry', () => {
 })
 
 describe('applyCodexPromptAnswer', () => {
-  it('accepts a bare answer only when the request has one question', () => {
+  it('answers the lone question of a single-question request with typed text', () => {
     const registry = new CodexPromptRegistry()
     const single = registry.register(userInputRequest(['q1']))
 
-    expect(applyCodexPromptAnswer(single as NonNullable<typeof single>, 'sure')).toEqual({
+    expect(answer(single, typed('q1', 'sure'))).toEqual({
       answers: { q1: { answers: ['sure'] } }
     })
   })
@@ -232,29 +258,32 @@ describe('applyCodexPromptAnswer', () => {
     const registry = new CodexPromptRegistry()
     const many = registry.register(userInputRequest(['q1', 'q2']))
 
-    expect(() => applyCodexPromptAnswer(many as NonNullable<typeof many>, 'sure')).toThrow(
-      'does not name a question'
-    )
-    expect(() =>
-      applyCodexPromptAnswer(
-        many as NonNullable<typeof many>,
-        encodeCodexQuestionOptionId('q3', 'sure')
-      )
-    ).toThrow('does not name a question')
+    expect(() => answer(many, picked('sure'))).toThrow('does not name a question')
+    expect(() => answer(many, typed('q3', 'sure'))).toThrow('does not name a question')
   })
 
   it('keeps the last answer when a question is answered twice', () => {
     const registry = new CodexPromptRegistry()
     const single = registry.register(userInputRequest(['q1']))
-    const prompt = single as NonNullable<typeof single>
 
-    applyCodexPromptAnswer(prompt, encodeCodexQuestionOptionId('q1', 'first'))
+    answer(single, typed('q1', 'first'))
 
-    expect(applyCodexPromptAnswer(prompt, encodeCodexQuestionOptionId('q1', 'second'))).toEqual({
+    expect(answer(single, typed('q1', 'second'))).toEqual({
       answers: { q1: { answers: ['second'] } }
     })
   })
 
+  it('refuses an answer over the registry bound before recording anything', () => {
+    const registry = new CodexPromptRegistry()
+    const single = registry.register(userInputRequest(['q1']))
+    const live = registered(single)
+
+    expect(() => prepareCodexPromptAnswer(live, typed('q1', 'x'.repeat(64 * 1024 + 1)))).toThrow(
+      'exceeds bounded registry state'
+    )
+    expect(live.answers.size).toBe(0)
+  })
+
   it('refuses question and option collections that exceed bounded live state', () => {
     const registry = new CodexPromptRegistry()
     const tooManyQuestions = registry.register(
diff --git a/src/main/codex/codex-structured-prompt-replies.ts b/src/main/codex/codex-structured-prompt-replies.ts
index 6e742bf827c..d4301d8f27c 100644
--- a/src/main/codex/codex-structured-prompt-replies.ts
+++ b/src/main/codex/codex-structured-prompt-replies.ts
@@ -1,3 +1,4 @@
+import type { AgentSessionPromptResponse } from '../../shared/agent-session-question-answer'
 import type { CodexAppServerConnection } from './codex-app-server-connection'
 import { CODEX_PROMPT_MAX_ANSWER_BYTES } from './codex-prompt-registry-bounds'
 import {
@@ -55,35 +56,61 @@ export function decodeCodexQuestionOptionId(
   }
 }
 
+/** One answer, checked against the prompt but not yet recorded on it. */
+export type CodexPreparedAnswer =
+  | { kind: 'decision'; decision: CodexApprovalDecision }
+  | { kind: 'answer'; questionId: string; answer: string }
+
+/** Validates a client's choice against the prompt without recording it, so an answer Codex
+ *  cannot take is refused before the journal commits it. */
+export function prepareCodexPromptAnswer(
+  prompt: CodexPendingPrompt,
+  response: AgentSessionPromptResponse
+): CodexPreparedAnswer {
+  if (prompt.method !== CODEX_USER_INPUT_METHOD) {
+    if (response.kind !== 'option' || !isCodexApprovalDecision(response.optionId)) {
+      throw new Error(`Codex item ${prompt.codexItemId} takes an approval decision`)
+    }
+    return { kind: 'decision', decision: response.optionId }
+  }
+  // Each Codex question is its own journal item, so an answer names exactly one question.
+  const entry =
+    response.kind === 'answers' && response.answers.length === 1 ? response.answers[0] : null
+  if (!entry) {
+    throw new Error(`Codex item ${prompt.codexItemId} takes one question answer`)
+  }
+  const optionId = entry.optionIds[0]
+  const decoded =
+    optionId === undefined
+      ? { questionId: entry.questionId, answer: entry.other?.trim() ?? '' }
+      : (prompt.optionAnswers.get(optionId) ?? decodeCodexQuestionOptionId(optionId))
+  const questionId =
+    (decoded?.questionId
+      ? (prompt.questionIdAliases.get(decoded.questionId) ?? decoded.questionId)
+      : null) ?? (prompt.questionIds.length === 1 ? prompt.questionIds[0] : null)
+  const answer = decoded?.answer ?? optionId ?? ''
+  if (!questionId || !prompt.questionIds.includes(questionId)) {
+    throw new Error(`The answer does not name a question on Codex item ${prompt.codexItemId}`)
+  }
+  if (Buffer.byteLength(answer, 'utf8') > CODEX_PROMPT_MAX_ANSWER_BYTES) {
+    throw new Error('codex prompt answer exceeds bounded registry state')
+  }
+  return { kind: 'answer', questionId, answer }
+}
+
 /**
- * Records one answer and returns the reply payload once the request is fully
+ * Records one prepared answer and returns the reply payload once the request is fully
  * answered. A multi-question user-input request stays pending until every
  * question has an answer, because Codex takes one reply for all of them.
  */
 export function applyCodexPromptAnswer(
   prompt: CodexPendingPrompt,
-  optionId: string
+  prepared: CodexPreparedAnswer
 ): Record<string, unknown> | null {
-  if (prompt.method !== CODEX_USER_INPUT_METHOD) {
-    if (!isCodexApprovalDecision(optionId)) {
-      throw new Error(`${optionId} is not a Codex approval decision`)
-    }
-    return { decision: optionId }
+  if (prepared.kind === 'decision') {
+    return { decision: prepared.decision }
   }
-  const mapped = prompt.optionAnswers.get(optionId)
-  const decoded = mapped ?? decodeCodexQuestionOptionId(optionId)
-  const questionId =
-    (decoded?.questionId
-      ? (prompt.questionIdAliases.get(decoded.questionId) ?? decoded.questionId)
-      : null) ?? (prompt.questionIds.length === 1 ? prompt.questionIds[0] : null)
-  const answer = decoded?.answer ?? optionId
-  if (!questionId || !prompt.questionIds.includes(questionId)) {
-    throw new Error(`${optionId} does not name a question on Codex item ${prompt.codexItemId}`)
-  }
-  if (Buffer.byteLength(answer, 'utf8') > CODEX_PROMPT_MAX_ANSWER_BYTES) {
-    throw new Error('codex prompt answer exceeds bounded registry state')
-  }
-  prompt.answers.set(questionId, answer)
+  prompt.answers.set(prepared.questionId, prepared.answer)
   if (prompt.questionIds.some((id) => !prompt.answers.has(id))) {
     return null
   }
@@ -104,13 +131,13 @@ export function answerCodexPrompt(
   registry: CodexPromptRegistry,
   connection: Pick<CodexAppServerConnection, 'respond'>,
   claim: CodexPromptClaim,
-  optionId: string
+  prepared: CodexPreparedAnswer
 ): void {
   if (!registry.ownsClaim(claim)) {
     throw new Error(`codex app-server is no longer waiting on ${claim.itemId}`)
   }
   const prompt = claim.prompt
-  const reply = applyCodexPromptAnswer(prompt, optionId)
+  const reply = applyCodexPromptAnswer(prompt, prepared)
   if (reply === null) {
     registry.releaseClaim(claim)
     return
diff --git a/src/main/codex/codex-structured-provider-events.ts b/src/main/codex/codex-structured-provider-events.ts
index 06563cad748..5dc608fbb59 100644
--- a/src/main/codex/codex-structured-provider-events.ts
+++ b/src/main/codex/codex-structured-provider-events.ts
@@ -24,6 +24,7 @@ export function translateCodexNotification(input: {
 }): CodexJournalTranslationAdmission {
   const { sessionId, session, method, params, observedAt, dispatchSequenceAtReceipt } = input
   codexRewind.observeCodexRewindActivity(session, method, params)
+  session.turnOpenWaits.observe(session.threadId, method, params)
   if (input.turnCancellation.handleNotification(sessionId, session, method, params, observedAt)) {
     return { accepted: true }
   }
diff --git a/src/main/codex/codex-structured-question-order.test.ts b/src/main/codex/codex-structured-question-order.test.ts
new file mode 100644
index 00000000000..59a36dbdf67
--- /dev/null
+++ b/src/main/codex/codex-structured-question-order.test.ts
@@ -0,0 +1,260 @@
+// A Codex ask with several questions, driven from the real host journal through
+// the client's session reducer to the rows the transcript list draws.
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-session-mutation-envelope'
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalRenderItem
+} from '../../shared/agent-session-journal-types'
+import {
+  EMPTY_STRUCTURED_AGENT_SESSION,
+  reduceStructuredAgentSession,
+  type StructuredAgentSessionState
+} from '../../shared/structured-agent-session-reducer'
+import { projectStructuredAgentSessionMessages } from '../../shared/structured-agent-session-message-projection'
+import { projectNativeChatTranscriptMessages } from '../../shared/native-chat-transcript-projection'
+import { AgentSessionRecordStore } from '../runtime/agent-session-record-store'
+import { CodexJournalPrompts } from './codex-structured-journal-prompts'
+import { CODEX_USER_INPUT_METHOD } from './codex-structured-prompt-replies'
+import type { StructuredAgentSessionAdapter } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { StructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-host'
+import {
+  HOST_TEST_NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from '../native-chat/agent-session-wire/structured-agent-session-host-test-data'
+import {
+  projectStructuredQuestionMessages,
+  structuredQuestionTranscript
+} from '../../renderer/src/components/native-chat/structured-agent-question-projection'
+
+const CALLER = { callerKey: 'client-1' }
+
+type Asked = readonly { id: string; question: string }[]
+
+// Codex's question ids are the model's own words, so their text order is not
+// the order it asked in. These two asks spell the two orders live QA saw.
+const ASKED: Asked = [
+  { id: 'scope', question: 'Which files are in scope?' },
+  { id: 'priority', question: 'What matters most?' },
+  { id: 'deadline', question: 'When is it due?' }
+]
+const ASKED_OUT_OF_ORDER: Asked = [
+  { id: 'format', question: 'Which format?' },
+  { id: 'audience', question: 'Who reads it?' },
+  { id: 'length', question: 'How long?' }
+]
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let sink: StructuredAgentSessionEventSink | null
+let client: StructuredAgentSessionState
+let clock: number
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-codex-question-order-'))
+  resetHostTestOperationIds()
+  sink = null
+  clock = HOST_TEST_NOW
+  const adapter: StructuredAgentSessionAdapter = {
+    acquire: vi.fn<StructuredAgentSessionAdapter['acquire']>(async ({ fence, events }) => {
+      sink = events ?? null
+      return {
+        process: {
+          hostId: 'local',
+          pid: 4242,
+          processStartTimeMs: 1_700_000_000_000,
+          spawnToken: store.getRecord(SESSION)?.lease.reservedSpawnToken ?? 'spawn-a'
+        },
+        link: {
+          linkId: `link-${fence}`,
+          handle: { provider: 'codex', threadId: THREAD },
+          origin: 'created',
+          mintedAtFence: fence,
+          observedAt: HOST_TEST_NOW
+        }
+      }
+    }),
+    releaseAcquisition: vi.fn(async () => true),
+    dispatch: vi.fn(),
+    cancelTurn: vi.fn(async () => ({ cancelled: true })),
+    answerPrompt: vi.fn(async ({ commit }) => commit()),
+    setOption: vi.fn(async () => undefined)
+  }
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter,
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-a',
+    // Every write lands on its own millisecond, as it does live.
+    now: () => (clock += 1)
+  })
+  expect((await host.attach(CALLER, hostTestAttachParams(null))).ok).toBe(true)
+  const page = await host.history({ sessionId: SESSION, direction: 'tail' })
+  if (!page.ok) {
+    throw new Error('no history page')
+  }
+  client = reduceStructuredAgentSession(EMPTY_STRUCTURED_AGENT_SESSION, {
+    type: 'history-page',
+    page: page.page
+  })
+  host.subscribe({
+    id: 'client',
+    sessionId: SESSION,
+    cursor: page.page.liveCursor ?? page.page.window.nextCursor,
+    emit: (event) => {
+      client = reduceStructuredAgentSession(client, { type: 'event', event })
+    }
+  })
+})
+
+afterEach(async () => {
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+function codexPrompts(): CodexJournalPrompts {
+  if (!sink) {
+    throw new Error('session was never acquired')
+  }
+  return new CodexJournalPrompts(
+    { sink, attributionFor: () => ({ turnScope: AGENT_JOURNAL_THREAD_SCOPE }) },
+    () => null,
+    () => 'turn-1'
+  )
+}
+
+async function ask(prompts: CodexJournalPrompts, asked: Asked = ASKED): Promise<void> {
+  prompts.handle({
+    threadId: THREAD,
+    method: CODEX_USER_INPUT_METHOD,
+    codexItemId: 'codex-item-1',
+    promptKey: '7',
+    params: {
+      threadId: THREAD,
+      turnId: 'turn-1',
+      questions: asked.map((question) => ({
+        ...question,
+        options: [
+          { label: 'Yes', description: '' },
+          { label: 'No', description: '' }
+        ]
+      }))
+    }
+  })
+  await host.flushStreamedEvents(SESSION)
+}
+
+function questionItem(question: string): AgentJournalRenderItem {
+  const item = client.items.find(
+    (candidate) => candidate.body.kind === 'question' && candidate.body.question === question
+  )
+  if (!item || item.body.kind !== 'question') {
+    throw new Error(`no journal item for ${question}`)
+  }
+  return item
+}
+
+async function answer(question: string): Promise<void> {
+  const item = questionItem(question)
+  if (item.body.kind !== 'question') {
+    return
+  }
+  const fields = {
+    itemId: item.itemId,
+    expectedRevision: item.revision,
+    optionId: item.body.options[0]!.id
+  }
+  const result = await host.respondToPrompt(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: store.getRecord(SESSION)?.lease.runtimeFence ?? 1,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.respondTo:question',
+        sessionId: SESSION,
+        fields
+      })
+    },
+    kind: 'question',
+    ...fields
+  })
+  expect(result.ok).toBe(true)
+  await host.flushStreamedEvents(SESSION)
+}
+
+/** The prompt rows the transcript list draws, top to bottom, as the questions each one shows. */
+function drawnPromptRows(): string[][] {
+  const { receipts } = structuredQuestionTranscript(client.items)
+  // The desktop list's projection: its comparator adds only a rank for rows the host never writes.
+  const rows = projectNativeChatTranscriptMessages(
+    projectStructuredAgentSessionMessages(
+      client.items,
+      [],
+      client.submissions,
+      projectStructuredQuestionMessages
+    )
+  )
+  return rows.flatMap((row) => {
+    const prompt = receipts.get(row.id)
+    if (!prompt || prompt.kind !== 'question') {
+      return []
+    }
+    const questions = prompt.questions?.length ? prompt.questions : [prompt]
+    return [questions.map(({ question }) => `${question} (${prompt.resolution.state})`)]
+  })
+}
+
+describe('a Codex ask with several questions', () => {
+  it('keeps the pending rest of the ask below the question already answered', async () => {
+    await ask(codexPrompts())
+    await answer(ASKED[0]!.question)
+
+    expect(drawnPromptRows()).toEqual([
+      ['Which files are in scope? (resolved)'],
+      ['What matters most? (pending)', 'When is it due? (pending)']
+    ])
+  })
+
+  it('draws every answered question in the order Codex asked it', async () => {
+    await ask(codexPrompts())
+    for (const { question } of ASKED) {
+      await answer(question)
+    }
+
+    expect(drawnPromptRows()).toEqual([
+      ['Which files are in scope? (resolved)'],
+      ['What matters most? (resolved)'],
+      ['When is it due? (resolved)']
+    ])
+    // Mobile draws the shared projection in journal order, one row per question.
+    expect(
+      projectStructuredAgentSessionMessages(client.items, [], client.submissions).map(
+        ({ blocks }) => (blocks[0]?.type === 'text' ? blocks[0].text.split('\n')[0] : null)
+      )
+    ).toEqual(ASKED.map(({ question }) => question))
+  })
+
+  it('draws a cancelled ask in the order Codex asked it', async () => {
+    const prompts = codexPrompts()
+    await ask(prompts, ASKED_OUT_OF_ORDER)
+    prompts.cancel(questionItem(ASKED_OUT_OF_ORDER[0]!.question).itemId)
+    await host.flushStreamedEvents(SESSION)
+
+    expect(drawnPromptRows()).toEqual([
+      ['Which format? (cancelled)'],
+      ['Who reads it? (cancelled)'],
+      ['How long? (cancelled)']
+    ])
+  })
+})
diff --git a/src/main/codex/codex-structured-rewind.test.ts b/src/main/codex/codex-structured-rewind.test.ts
index 64ebff43e38..a5f34cc98fd 100644
--- a/src/main/codex/codex-structured-rewind.test.ts
+++ b/src/main/codex/codex-structured-rewind.test.ts
@@ -204,11 +204,10 @@ describe('Codex rewind', () => {
       }
       return original(method)
     })
-    const onReverted = vi.fn()
-    expect(
-      await rewindCodexSession(session, { fence: 2, beforeTurnId: 'drop', onReverted })
-    ).toEqual({ ok: false, reason: 'history-limit' })
-    expect(onReverted).not.toHaveBeenCalled()
+    expect(await rewindCodexSession(session, { fence: 2, beforeTurnId: 'drop' })).toEqual({
+      ok: false,
+      reason: 'history-limit'
+    })
     expect(request.mock.calls.some(([method]) => method === 'thread/revert')).toBe(false)
   })
   it('refuses a missing target before mutation', async () => {
diff --git a/src/main/codex/codex-structured-rewind.ts b/src/main/codex/codex-structured-rewind.ts
index e5913b37be5..b222694422d 100644
--- a/src/main/codex/codex-structured-rewind.ts
+++ b/src/main/codex/codex-structured-rewind.ts
@@ -280,7 +280,6 @@ export async function rewindCodexSession(
   if (record(reply.thread).id !== session.threadId) {
     throw new Error('agent_session_rewind:foreign-thread')
   }
-  await input.onReverted?.()
   const items = await verifyCodexRevertedHistory(session, reply, input.beforeTurnId, timeoutMs)
   if (
     items.length !== expectedItems.size ||
diff --git a/src/main/codex/codex-structured-session-acquire.ts b/src/main/codex/codex-structured-session-acquire.ts
index 2ce13d21250..e765955d53c 100644
--- a/src/main/codex/codex-structured-session-acquire.ts
+++ b/src/main/codex/codex-structured-session-acquire.ts
@@ -8,12 +8,15 @@ import {
   closeFailedCodexAcquisition,
   stopSupersededCodexAcquisition
 } from './codex-structured-acquisition-lifecycle'
-import { CodexBackgroundTaskTracker } from './codex-background-task-tracker'
+import { CodexBackgroundTaskTracker, codexChildWorkSink } from './codex-background-task-tracker'
 import { CodexSubagentExecutions } from './codex-subagent-executions'
 import { createCodexDispatchEchoes } from './codex-structured-dispatch-echo'
 import { createCodexJournalTranslator } from './codex-structured-journal-translation'
 import { openCodexAppServerConnection } from './codex-app-server-connection'
-import { codexProcessIdentity, codexProviderHandleLink } from './codex-structured-owner-identity'
+import {
+  codexProviderHandleLink,
+  codexSpawnedProcessIdentity
+} from './codex-structured-owner-identity'
 import { buildCodexStructuredChildEnvironment } from './codex-structured-child-environment'
 import { openCodexThread } from './codex-structured-thread-open'
 import {
@@ -30,6 +33,7 @@ import {
   reportedCodexThreadOptions
 } from './codex-structured-fast-mode'
 import {
+  assertCodexConnectionOpen,
   codexSessionLifecycle,
   mintCodexAcquisitionGeneration,
   type CodexAcquisitionRegistry,
@@ -38,9 +42,12 @@ import {
   type CodexStructuredSessionAdapterDeps
 } from './codex-structured-session-state'
 import type { CodexStructuredTurnCancellation } from './codex-structured-turn-cancellation'
+import type { CodexStructuredSessionTeardown } from './codex-structured-session-teardown'
 import type { CodexStructuredNotificationRetry } from './codex-structured-notification-retry'
 import type { deliverCodexServerRequest } from './codex-structured-provider-events'
 
+const TURN_BOUNDARIES: ReadonlySet<string> = new Set(['turn/started', 'turn/completed'])
+
 export async function acquireCodexStructuredSession(input: {
   input: StructuredAgentSessionAcquireInput
   deps: CodexStructuredSessionAdapterDeps
@@ -59,12 +66,7 @@ export async function acquireCodexStructuredSession(input: {
     request: Parameters<typeof deliverCodexServerRequest>[2]
   ) => void
   handleUnhandledFrame: (sessionId: string, kind: string, payload: unknown) => void
-  forceCloseUnexpected: (
-    sessionId: string,
-    fence: number,
-    acquisitionGeneration: string,
-    reason: Error
-  ) => Promise<boolean>
+  forceCloseUnexpected: CodexStructuredSessionTeardown['forceCloseUnexpected']
 }): Promise<AgentSessionAcquisition> {
   const {
     input: acquireInput,
@@ -106,6 +108,7 @@ export async function acquireCodexStructuredSession(input: {
       })
     : null
   const open = deps.openConnection ?? openCodexAppServerConnection
+  const spawnIdentity = codexSpawnedProcessIdentity(acquireInput, deps.readProcessStartTime)
   try {
     await stopSupersededCodexAcquisition({
       sessionId,
@@ -134,7 +137,7 @@ export async function acquireCodexStructuredSession(input: {
       {
         onNotification: (method, params) => {
           // Stamped at receipt, ahead of any pre-publication buffering or retry.
-          const observedAt = isCodexTurnBoundary(method) ? (deps.now?.() ?? Date.now()) : undefined
+          const observedAt = TURN_BOUNDARIES.has(method) ? (deps.now?.() ?? Date.now()) : undefined
           const dispatchSequenceAtReceipt =
             method === 'turn/started' ? dispatchEchoes.latestSequence() : undefined
           input.deliver(
@@ -165,6 +168,7 @@ export async function acquireCodexStructuredSession(input: {
             () => input.handleUnhandledFrame(sessionId, kind, payload),
             Buffer.byteLength(JSON.stringify(payload ?? null), 'utf8')
           ),
+        onSpawned: spawnIdentity.onSpawned,
         onExit: (error) => {
           try {
             handleCodexSessionExit({
@@ -198,14 +202,11 @@ export async function acquireCodexStructuredSession(input: {
     primaryThreadId = opened.threadId
     const restoreAdmission = translator?.restoreThread(opened.threadId, opened.thread ?? {})
     if (restoreAdmission && !restoreAdmission.accepted) {
-      throw new AgentSessionAcquisitionRefusal(
+      throw AgentSessionAcquisitionRefusal.historyTooLarge(
         'Codex thread history exceeds the bounded restore queue; history was not partially imported.'
       )
     }
-    const process = await codexProcessIdentity(
-      { ...acquireInput, pid: connection.pid },
-      deps.readProcessStartTime
-    )
+    const process = await spawnIdentity.read(connection.pid)
     acquisitions.assertCurrent(sessionId, attempt)
     const acquired: AgentSessionAcquisition = {
       process,
@@ -220,9 +221,7 @@ export async function acquireCodexStructuredSession(input: {
       }),
       acquisitionGeneration: mintCodexAcquisitionGeneration(deps)
     }
-    if (connection.closed) {
-      throw new Error(`codex app-server for session ${sessionId} exited while being acquired`)
-    }
+    assertCodexConnectionOpen(connection, sessionId)
     acquisitions.assertCurrent(sessionId, attempt)
     const options = restoredCodexSessionOptions(acquireInput.options)
     const catalogAccess = codexAcquireCatalogAccess(deps, launch)
@@ -234,10 +233,10 @@ export async function acquireCodexStructuredSession(input: {
       timeoutMs: deps.requestTimeoutMs
     })
     acquisitions.assertCurrent(sessionId, attempt)
-    if (connection.closed) {
-      throw new Error(`codex app-server for session ${sessionId} exited while being acquired`)
-    }
+    assertCodexConnectionOpen(connection, sessionId)
     acquisitions.deleteIfCurrent(sessionId, attempt)
+    // Where this session's child work goes: the host's records, after each frame is journaled.
+    const sink = codexChildWorkSink(sessionId, deps)
     const session: CodexSession = {
       connection,
       ...codexSessionLifecycle(acquireInput.fence, acquired.acquisitionGeneration as string),
@@ -252,7 +251,7 @@ export async function acquireCodexStructuredSession(input: {
       ...(catalogAccess ? { catalogAccess } : {}),
       dispatchEchoes,
       translator,
-      backgroundTasks: new CodexBackgroundTaskTracker(opened.threadId, subagentExecutions),
+      backgroundTasks: new CodexBackgroundTaskTracker(opened.threadId, subagentExecutions, sink),
       forceCloseUnexpected: (reason) =>
         input.forceCloseUnexpected(
           sessionId,
@@ -297,7 +296,3 @@ export async function acquireCodexStructuredSession(input: {
     attempt.finish()
   }
 }
-
-function isCodexTurnBoundary(method: string): boolean {
-  return method === 'turn/started' || method === 'turn/completed'
-}
diff --git a/src/main/codex/codex-structured-session-adapter-fixture.ts b/src/main/codex/codex-structured-session-adapter-fixture.ts
index 3f2d32ee2eb..27e6eadb6c5 100644
--- a/src/main/codex/codex-structured-session-adapter-fixture.ts
+++ b/src/main/codex/codex-structured-session-adapter-fixture.ts
@@ -89,6 +89,19 @@ export function fakeCodex(routes: Record<string, Route> = {}): {
   return { connections, openConnection, routes }
 }
 
+/** A `turn/start` route for a Codex that opened the turn before its answer was read. */
+export function answerWithOpenedTurn(
+  codex: Pick<ReturnType<typeof fakeCodex>, 'connections'>,
+  turnId: string
+): Route {
+  return () => {
+    codex.connections
+      .at(-1)
+      ?.handlers.onNotification?.('turn/started', { threadId: THREAD_ID, turn: { id: turnId } })
+    return { turn: { id: turnId } }
+  }
+}
+
 export function adapterFor(
   codex: ReturnType<typeof fakeCodex>,
   launch: Partial<CodexStructuredLaunch> = {},
diff --git a/src/main/codex/codex-structured-session-adapter-lifecycle.test.ts b/src/main/codex/codex-structured-session-adapter-lifecycle.test.ts
index fc458304dc8..bcfd2f733f0 100644
--- a/src/main/codex/codex-structured-session-adapter-lifecycle.test.ts
+++ b/src/main/codex/codex-structured-session-adapter-lifecycle.test.ts
@@ -152,7 +152,7 @@ describe('CodexStructuredSessionAdapter lifecycle', () => {
         sessionId: 'session-2',
         itemId: 'codex-item-1',
         kind: 'approval',
-        optionId: 'accept',
+        response: { kind: 'option', optionId: 'accept' },
         fence: 1,
         commit: async () => undefined
       })
@@ -181,6 +181,7 @@ describe('CodexStructuredSessionAdapter lifecycle', () => {
       type: 'ended',
       sessionId: 'session-1',
       reason: 'codex app-server connection ended',
+      failure: { kind: 'providerExited' },
       cause: 'unexpected-exit',
       fence: 7,
       acquisitionGeneration: 'generation-1',
diff --git a/src/main/codex/codex-structured-session-adapter.test.ts b/src/main/codex/codex-structured-session-adapter.test.ts
index f17003f7e40..70b2ecd7147 100644
--- a/src/main/codex/codex-structured-session-adapter.test.ts
+++ b/src/main/codex/codex-structured-session-adapter.test.ts
@@ -1,12 +1,11 @@
 import { describe, expect, it, vi } from 'vitest'
+import { AgentSessionPromptAnswerRejectedError } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
 import {
   CodexAppServerRequestError,
   type openCodexAppServerConnection
 } from './codex-app-server-connection'
 import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
 import { CODEX_SPAWN_TOKEN_ENV } from './codex-structured-owner-identity'
-import { ORCA_STRUCTURED_SESSION_ENV } from '../../shared/structured-session-marker'
-import { encodeCodexQuestionOptionId } from './codex-structured-prompt-replies'
 import {
   CodexStructuredSessionAdapter,
   type CodexStructuredLaunch,
@@ -17,6 +16,7 @@ import {
   USER_MESSAGE,
   acquired,
   adapterFor,
+  answerWithOpenedTurn,
   fakeCodex,
   identityFor
 } from './codex-structured-session-adapter-fixture'
@@ -35,7 +35,12 @@ describe('CodexStructuredSessionAdapter.acquire', () => {
     expect(codex.connections[0].launch.env).toEqual({
       [CODEX_SPAWN_TOKEN_ENV]: 'spawn-9',
       CODEX_HOME: '/codex/home',
-      [ORCA_STRUCTURED_SESSION_ENV]: '1'
+      ORCA_AGENT_SESSION_ID: 'session-1',
+      ORCA_STRUCTURED_SESSION: '1',
+      ORCA_CLI_COMMAND: expect.stringMatching(/^[^:;]*[\\/]cli[\\/]bin[\\/]orca-dev$/),
+      ORCA_USER_DATA_PATH: expect.any(String),
+      // The test host is unpackaged, so this app's CLI is the dev launcher dir, first on PATH.
+      PATH: expect.stringMatching(/^[^:;]*[\\/]cli[\\/]bin[:;]/)
     })
     expect(codex.connections[0].launch.cwd).toBe('/work/repo')
     expect(codex.connections[0].calls[0]).toEqual({
@@ -58,6 +63,20 @@ describe('CodexStructuredSessionAdapter.acquire', () => {
     expect(acquisition.acquisitionGeneration).toBe('generation-1')
   })
 
+  // A thread opened on Codex's configured default and then given a turn on the chosen model
+  // reads to Codex as a model switch, and it injects the chosen model's whole prompt again.
+  it('opens the thread on the model the session chose, not on the configured default', async () => {
+    const codex = fakeCodex()
+    const adapter = adapterFor(codex, { model: 'gpt-chosen' })
+
+    await adapter.acquire({ identity: identityFor('session-1'), fence: 7, spawnToken: 'spawn-9' })
+
+    expect(codex.connections[0].calls[0]).toEqual({
+      method: 'thread/start',
+      params: { cwd: '/work/repo', model: 'gpt-chosen' }
+    })
+  })
+
   it('resumes the thread the durable handle chain names, not the client one', async () => {
     const codex = fakeCodex()
     const adapter = adapterFor(codex, {
@@ -174,7 +193,7 @@ describe('CodexStructuredSessionAdapter.acquire', () => {
       sessionId: 'session-1',
       itemId: 'codex-item-early',
       kind: 'approval',
-      optionId: 'accept',
+      response: { kind: 'option', optionId: 'accept' },
       fence: 7,
       commit: async () => undefined
     })
@@ -353,7 +372,8 @@ describe('CodexStructuredSessionAdapter.acquire', () => {
 
 describe('CodexStructuredSessionAdapter.dispatch', () => {
   it('admits a send as soon as Codex owns it', async () => {
-    const codex = fakeCodex({ 'turn/start': () => ({ turn: { id: 'turn-1' } }) })
+    const codex = fakeCodex()
+    codex.routes['turn/start'] = answerWithOpenedTurn(codex, 'turn-1')
     const adapter = await acquired(codex)
 
     const outcome = await adapter.dispatch({
@@ -452,7 +472,12 @@ describe('CodexStructuredSessionAdapter.dispatch', () => {
         body: USER_MESSAGE,
         fence: 7
       })
-    ).toEqual({ state: 'rejected', reason: 'turn already running' })
+    ).toEqual({
+      // Built without Codex's own words, so nothing is quoted and no detail is invented.
+      state: 'rejected',
+      reason: 'The provider did not accept this message.',
+      rejection: { kind: 'providerRejected' }
+    })
   })
 
   it('rethrows a dead child so the wire settles the submission unknown', async () => {
@@ -489,9 +514,9 @@ describe('CodexStructuredSessionAdapter.dispatch', () => {
           }
         ],
         nextCursor: null
-      }),
-      'turn/start': () => ({ turn: { id: 'turn-1' } })
+      })
     })
+    codex.routes['turn/start'] = answerWithOpenedTurn(codex, 'turn-1')
     const adapter = await acquired(codex)
 
     await adapter.setOption({ sessionId: 'session-1', key: 'model', value: 'gpt-5', fence: 7 })
@@ -535,7 +560,7 @@ describe('CodexStructuredSessionAdapter prompts', () => {
       sessionId: 'session-1',
       itemId: 'codex:thread-abc:turn-1:3',
       kind: 'approval',
-      optionId: 'accept',
+      response: { kind: 'option', optionId: 'accept' },
       fence: 7,
       commit: async () => undefined
     })
@@ -548,7 +573,7 @@ describe('CodexStructuredSessionAdapter prompts', () => {
         sessionId: 'session-1',
         itemId: 'codex:thread-abc:turn-1:3',
         kind: 'approval',
-        optionId: 'decline',
+        response: { kind: 'option', optionId: 'decline' },
         fence: 7,
         commit: async () => undefined
       })
@@ -589,7 +614,7 @@ describe('CodexStructuredSessionAdapter prompts', () => {
         sessionId: 'session-1',
         itemId: 'codex-item-1',
         kind: 'approval',
-        optionId: 'accept',
+        response: { kind: 'option', optionId: 'accept' },
         fence: 7,
         commit: async () => undefined
       })
@@ -676,7 +701,7 @@ describe('CodexStructuredSessionAdapter prompts', () => {
         sessionId: 'session-1',
         itemId,
         kind: 'approval',
-        optionId,
+        response: { kind: 'option', optionId },
         fence: 7,
         commit: async () => undefined
       })
@@ -697,17 +722,20 @@ describe('CodexStructuredSessionAdapter prompts', () => {
     const adapter = await acquired(codex)
 
     askApproval(codex)
+    const commit = vi.fn(async () => undefined)
 
     await expect(
       adapter.answerPrompt({
         sessionId: 'session-1',
         itemId: 'codex-item-1',
         kind: 'approval',
-        optionId: 'yolo',
+        response: { kind: 'option', optionId: 'yolo' },
         fence: 7,
-        commit: async () => undefined
+        commit
       })
-    ).rejects.toThrow('is not a Codex approval decision')
+    ).rejects.toThrow(AgentSessionPromptAnswerRejectedError)
+    // Refused before the journal records an answer the agent never receives.
+    expect(commit).not.toHaveBeenCalled()
     expect(codex.connections[0].replies).toEqual([])
   })
 
@@ -732,7 +760,7 @@ describe('CodexStructuredSessionAdapter prompts', () => {
       sessionId: 'session-1',
       itemId: 'codex-item-2',
       kind: 'question',
-      optionId: encodeCodexQuestionOptionId('q1', 'yes'),
+      response: { kind: 'answers', answers: [{ questionId: 'q1', optionIds: [], other: 'yes' }] },
       fence: 7,
       commit: async () => undefined
     })
@@ -742,7 +770,7 @@ describe('CodexStructuredSessionAdapter prompts', () => {
       sessionId: 'session-1',
       itemId: 'codex-item-2',
       kind: 'question',
-      optionId: encodeCodexQuestionOptionId('q2', 'no'),
+      response: { kind: 'answers', answers: [{ questionId: 'q2', optionIds: [], other: 'no' }] },
       fence: 7,
       commit: async () => undefined
     })
@@ -778,7 +806,7 @@ describe('CodexStructuredSessionAdapter prompts', () => {
         sessionId: 'session-1',
         itemId: 'codex-item-gone',
         kind: 'approval',
-        optionId: 'accept',
+        response: { kind: 'option', optionId: 'accept' },
         fence: 7,
         commit: async () => undefined
       })
diff --git a/src/main/codex/codex-structured-session-adapter.ts b/src/main/codex/codex-structured-session-adapter.ts
index b9affd8bd00..82f927e0e86 100644
--- a/src/main/codex/codex-structured-session-adapter.ts
+++ b/src/main/codex/codex-structured-session-adapter.ts
@@ -3,7 +3,6 @@ import type {
   AgentJournalMessageItem,
   AgentSessionJournalIdentity
 } from '../../shared/agent-session-journal-types'
-import { StructuredSessionCompaction } from '../native-chat/agent-session-wire/structured-session-compaction'
 import { isCodexAppServerRequestError } from './codex-app-server-connection'
 import type {
   AgentSessionAcquisition,
@@ -14,6 +13,7 @@ import type {
 } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
 import type { CodexJournalTranslationAdmission } from './codex-structured-journal-translation'
 import { dispatchCodexTurn, isCodexTurnOptionKey } from './codex-structured-turn-start'
+import { agentSessionFailureFact, providerDiagnosticOf } from '../../shared/agent-session-failure'
 import { supportsCodexStructuredLocation } from './codex-structured-location-support'
 import { CodexStructuredSessionTeardown } from './codex-structured-session-teardown'
 import {
@@ -34,6 +34,10 @@ import {
   translateCodexNotification
 } from './codex-structured-provider-events'
 import { CodexStructuredTurnCancellation } from './codex-structured-turn-cancellation'
+import {
+  codexDispatchRejection,
+  settleCodexSendsInEndedTurn
+} from './codex-structured-turn-end-settlement'
 import { createCodexStructuredNotificationRetry } from './codex-structured-notification-retry'
 import { acquireCodexStructuredSession } from './codex-structured-session-acquire'
 import { changeCodexThreadGoal } from './codex-structured-thread-goal'
@@ -49,7 +53,6 @@ export type {
 } from './codex-structured-session-state'
 
 export class CodexStructuredSessionAdapter implements StructuredAgentSessionAdapter {
-  private readonly compactions = new StructuredSessionCompaction()
   private readonly sessions = new Map<string, CodexSession>()
   private readonly acquisitions = new CodexAcquisitionRegistry()
   private readonly turnCancellation: CodexStructuredTurnCancellation
@@ -153,15 +156,17 @@ export class CodexStructuredSessionAdapter implements StructuredAgentSessionAdap
       return admission
     }
     if (event.type === 'notification') {
-      this.compactions.codex(event.sessionId, event.method, event.params)
+      // Only an admitted turn end settles; a refused one settles on the retry that lands.
+      settleCodexSendsInEndedTurn(session, event.method, event.params, (settlement) =>
+        this.deps.onDispatchSettledLate?.({ sessionId: event.sessionId, ...settlement })
+      )
       // After the admission check, so a refused frame is observed by the strip
       // only on the retry that also reaches the journal.
-      if (session.backgroundTasks.observe(event)) {
+      if (session.backgroundTasks.observe(event, session.prompts.takeAbandonedCommands())) {
         this.deps.onBackgroundTasksChanged?.(event.sessionId, session.backgroundTasks.state)
       }
-    }
-    if (event.type === 'ended') {
-      this.compactions.ended(event.sessionId)
+      // After the journal and the parent's republished row, never ahead of either.
+      session.backgroundTasks.publishChildWork()
     }
     this.deps.onEvent?.(event)
     return admission
@@ -229,7 +234,6 @@ export class CodexStructuredSessionAdapter implements StructuredAgentSessionAdap
     cancelCodexStructuredTurn({
       request,
       sessions: this.sessions,
-      compactions: this.compactions,
       cancellation: this.turnCancellation
     })
 
@@ -244,29 +248,31 @@ export class CodexStructuredSessionAdapter implements StructuredAgentSessionAdap
   recoverRewind: NonNullable<StructuredAgentSessionAdapter['recoverRewind']> = (input) =>
     codexRewind.recoverCodexRewind(this.session(input.sessionId), input, this.deps.requestTimeoutMs)
 
-  compact: NonNullable<StructuredAgentSessionAdapter['compact']> = (input) => {
+  /** The ack is Codex's receipt; the translator ends the command's turn from the turn it opens. */
+  compact: NonNullable<StructuredAgentSessionAdapter['compact']> = async (input) => {
     const session = this.session(input.sessionId)
-    return this.compactions.run(
-      input.sessionId,
-      session.threadId,
-      async () => {
-        await this.turnCancellation.captureBaseline(session)
-        return session.connection
-          .request(
-            'thread/compact/start',
-            { threadId: session.threadId },
-            { timeoutMs: this.deps.requestTimeoutMs }
+    session.translator?.beginCommand(input.command)
+    try {
+      await this.turnCancellation.captureBaseline(session)
+      await session.connection.request(
+        'thread/compact/start',
+        { threadId: session.threadId },
+        { timeoutMs: this.deps.requestTimeoutMs }
+      )
+      return { state: 'accepted', providerIdentity: null }
+    } catch (error) {
+      session.translator?.forgetCommand(input.command.turnId)
+      if (isCodexAppServerRequestError(error)) {
+        // Codex's own words, when it gave any, are the one part of the error a person can use.
+        return {
+          state: 'rejected',
+          ...codexDispatchRejection(
+            agentSessionFailureFact('providerRejected', { detail: providerDiagnosticOf(error) })
           )
-          .catch((error) => {
-            if (isCodexAppServerRequestError(error)) {
-              return { error: error.message }
-            }
-            throw error
-          })
-      },
-      input.onLateResult,
-      input.turnId
-    )
+        }
+      }
+      throw error
+    }
   }
 
   changeThreadGoal: NonNullable<StructuredAgentSessionAdapter['changeThreadGoal']> = (input) =>
@@ -277,7 +283,8 @@ export class CodexStructuredSessionAdapter implements StructuredAgentSessionAdap
       this.deps.requestTimeoutMs
     )
 
-  supportsThreadGoal = (sessionId: string): boolean => this.sessions.has(sessionId)
+  // Provider-level: a goal change at rest starts the agent first.
+  supportsThreadGoal = (): boolean => true
 
   answerPrompt: StructuredAgentSessionAdapter['answerPrompt'] = (request) =>
     answerCodexStructuredPrompt({ request, sessions: this.sessions })
diff --git a/src/main/codex/codex-structured-session-cancel.test.ts b/src/main/codex/codex-structured-session-cancel.test.ts
index 1ac807a5ccd..2d6c50adae4 100644
--- a/src/main/codex/codex-structured-session-cancel.test.ts
+++ b/src/main/codex/codex-structured-session-cancel.test.ts
@@ -142,14 +142,14 @@ describe('CodexStructuredSessionAdapter.cancelTurn', () => {
         turnId: 'turn-1',
         fence: 7
       })
-    ).resolves.toEqual({ cancelled: false })
+    ).resolves.toEqual({ cancelled: false, refusal: {} })
     await expect(
       (await acquired(absent)).cancelTurn({
         sessionId: 'session-1',
         turnId: 'turn-1',
         fence: 7
       })
-    ).resolves.toEqual({ cancelled: false })
+    ).resolves.toEqual({ cancelled: false, refusal: {} })
   })
 
   it('rethrows an unsettled interrupt so the turn is not shown as cancelled', async () => {
@@ -228,14 +228,22 @@ describe('CodexStructuredSessionAdapter.cancelTurn', () => {
 
     await expect(
       adapter.cancelTurn({ sessionId: 'session-1', turnId: 'turn-1', fence: 7 })
-    ).resolves.toEqual({ cancelled: false })
+    ).resolves.toEqual({ cancelled: false, unconfirmed: true })
     expect(events).toContainEqual(expect.objectContaining({ method: 'turn/completed' }))
   })
 
   it('accepts an immediate resend after verified interruption', async () => {
     let nextTurn = 0
     const codex = fakeCodex()
-    codex.routes['turn/start'] = () => ({ turn: { id: `turn-${++nextTurn}` } })
+    codex.routes['turn/start'] = () => {
+      // Codex opens each turn it answers; a send's dispatch waits for that.
+      const turnId = `turn-${++nextTurn}`
+      codex.connections[0].handlers.onNotification?.('turn/started', {
+        threadId: THREAD_ID,
+        turn: { id: turnId }
+      })
+      return { turn: { id: turnId } }
+    }
     codex.routes['turn/interrupt'] = () => {
       completeTurn(codex)
       return {}
diff --git a/src/main/codex/codex-structured-session-close.test.ts b/src/main/codex/codex-structured-session-close.test.ts
index 17f3aecf671..9d80a0fa982 100644
--- a/src/main/codex/codex-structured-session-close.test.ts
+++ b/src/main/codex/codex-structured-session-close.test.ts
@@ -1,4 +1,5 @@
 import { createCodexDispatchEchoes } from './codex-structured-dispatch-echo'
+import { createCodexTurnOpenWaits } from './codex-structured-turn-open-wait'
 import { describe, expect, it, vi } from 'vitest'
 import type { AgentSessionJournalIdentity } from '../../shared/agent-session-journal-types'
 import type {
@@ -76,7 +77,7 @@ function claudeAdapterStub(): StructuredAgentSessionAdapter {
 }
 
 describe('Codex structured session close lifecycle', () => {
-  it('forwards a one-shot exit when lifecycle admission is rejected', () => {
+  function backpressuredSession(requestedClose: boolean) {
     const connection: CodexAppServerConnection = {
       pid: 4321,
       closed: true,
@@ -87,7 +88,6 @@ describe('Codex structured session close lifecycle', () => {
       close: async () => true
     }
     const prompts = new CodexPromptRegistry()
-    const clearPrompts = vi.spyOn(prompts, 'clear')
     const translator = {
       handle: vi.fn().mockReturnValueOnce({ accepted: false, reason: 'backpressure' as const }),
       dispose: vi.fn()
@@ -96,7 +96,7 @@ describe('Codex structured session close lifecycle', () => {
       connection,
       backgroundTasks: new CodexBackgroundTaskTracker('thread-1'),
       ended: false,
-      requestedClose: false,
+      requestedClose,
       fence: 7,
       acquisitionGeneration: 'generation-1',
       threadId: THREAD,
@@ -106,9 +106,15 @@ describe('Codex structured session close lifecycle', () => {
       reportedOptions: {},
       fastModeTierByModel: new Map(),
       dispatchEchoes: createCodexDispatchEchoes(),
+      turnOpenWaits: createCodexTurnOpenWaits(),
       translator
     }
-    const sessions = new Map([['session-1', session]])
+    return { connection, prompts, translator, session, sessions: new Map([['session-1', session]]) }
+  }
+
+  it('forwards a one-shot exit when lifecycle admission is rejected', () => {
+    const { connection, prompts, translator, session, sessions } = backpressuredSession(false)
+    const clearPrompts = vi.spyOn(prompts, 'clear')
     const onEvent = vi.fn()
 
     expect(
@@ -125,13 +131,33 @@ describe('Codex structured session close lifecycle', () => {
     expect(clearPrompts).toHaveBeenCalledOnce()
     expect(onEvent).toHaveBeenCalledOnce()
     expect(translator.dispose).toHaveBeenCalledOnce()
-    expect(onEvent.mock.calls[0]?.[0]).toMatchObject({
-      cause: 'unexpected-exit',
-      settlementRetryRequired: true
-    })
+    expect(onEvent.mock.calls[0]?.[0]).toMatchObject({ cause: 'unexpected-exit' })
     expect(translator.handle).toHaveBeenCalledOnce()
   })
 
+  it("ends a Stop's wait for its turn to open when a requested close cannot publish its end yet", async () => {
+    const { connection, prompts, session, sessions } = backpressuredSession(true)
+    let released = false
+    void session.turnOpenWaits.wait('turn-1', 60_000).then(() => {
+      released = true
+    })
+
+    expect(
+      handleCodexSessionExit({
+        sessions,
+        sessionId: 'session-1',
+        connection,
+        error: new Error('codex session closed'),
+        closedByOrca: true,
+        prompts
+      })
+    ).toBe(false)
+    await Promise.resolve()
+    // Left for the retry, but the child is gone: nothing waits on a turn it would open.
+    expect(session.ended).toBe(false)
+    expect(released).toBe(true)
+  })
+
   it('mints a distinct child generation even when acquisitions share one fence', async () => {
     const { adapter } = adapterFixture()
     const input = { identity: identity('session-1'), fence: 7, spawnToken: 'spawn-1' }
diff --git a/src/main/codex/codex-structured-session-close.ts b/src/main/codex/codex-structured-session-close.ts
index 1ed8dcd385c..5bf973308b1 100644
--- a/src/main/codex/codex-structured-session-close.ts
+++ b/src/main/codex/codex-structured-session-close.ts
@@ -1,3 +1,4 @@
+import { agentSessionFailureFact, providerDiagnosticOf } from '../../shared/agent-session-failure'
 import type { CodexAppServerConnection } from './codex-app-server-connection-types'
 import { closeProcessRegistry } from '../../shared/child-process/close-process-registry'
 import {
@@ -14,6 +15,9 @@ export function handleCodexSessionExit(input: {
   sessionId: string
   connection: CodexAppServerConnection | null
   error: Error
+  /** Set by Orca's own close. Absent only from the connection's onExit, which the connection
+   *  withholds while Orca is closing the child. */
+  closedByOrca?: true
   prompts?: CodexSession['prompts']
   allowFailedSettlement?: boolean
   onEvent?: (event: CodexStructuredSessionEvent) => void
@@ -25,26 +29,28 @@ export function handleCodexSessionExit(input: {
     return false
   }
   session.exitObservedAt ??= Date.now()
+  // Before the admission check: the child is gone whether or not its end was admitted.
+  session.turnOpenWaits.releaseAll()
   const event: StructuredAgentSessionEndedEvent = {
     type: 'ended',
     sessionId: input.sessionId,
     reason: input.error.message,
+    // Only the child's own exit blames Codex; a close Orca made, for any reason, is Orca's.
+    failure: input.closedByOrca
+      ? agentSessionFailureFact('hostFault')
+      : agentSessionFailureFact('providerExited', { detail: providerDiagnosticOf(input.error) }),
     cause: session.requestedClose ? 'requested-close' : 'unexpected-exit',
     fence: session.fence,
     acquisitionGeneration: session.acquisitionGeneration,
     observedAt: session.exitObservedAt
   } as const
-  // A synchronous sink rejection (usually backpressure) is handed to host
-  // recovery, which appends the bounded fallback before reacquisition.
+  // A synchronous sink rejection (usually backpressure) leaves the terminal rows to the host's
+  // exit settlement, which writes its own bounded fallback.
   const admission = session.translator?.handle(event) ?? { accepted: true }
-  if (!admission.accepted) {
-    // The connection invokes onExit exactly once. Forward a flagged event so
-    // host recovery can append its no-new-blob fallback even when admission is
-    // backpressured; waiting for a second callback would strand the lease.
-    if (event.cause !== 'unexpected-exit' && !input.allowFailedSettlement) {
-      return false
-    }
-    event.settlementRetryRequired = true
+  // The connection invokes onExit exactly once, so an unexpected exit is forwarded even when
+  // admission is backpressured; waiting for a second callback would strand the lease.
+  if (!admission.accepted && event.cause !== 'unexpected-exit' && !input.allowFailedSettlement) {
+    return false
   }
   session.ended = true
   // Nothing can echo for this child any more; the journal's pending-submission
@@ -52,6 +58,8 @@ export function handleCodexSessionExit(input: {
   session.dispatchEchoes.clear()
   session.backgroundTasks.clear()
   input.onBackgroundTasksChanged?.(input.sessionId, null)
+  // Every close path funnels here, so the session's children end with it on each one.
+  session.backgroundTasks.publishChildWork()
   session.unbindReadingControl?.()
   input.onEvent?.(event)
   session.prompts.clear()
@@ -97,6 +105,7 @@ export async function closeCodexPublishedSession(
       sessionId,
       connection: session.connection,
       error: options?.unexpectedReason ?? new Error('codex session closed'),
+      closedByOrca: true,
       prompts: session.prompts,
       ...(options?.allowFailedSettlement ? { allowFailedSettlement: true } : {}),
       ...(onEvent ? { onEvent } : {})
diff --git a/src/main/codex/codex-structured-session-exit-blame.test.ts b/src/main/codex/codex-structured-session-exit-blame.test.ts
new file mode 100644
index 00000000000..591f0e61ae8
--- /dev/null
+++ b/src/main/codex/codex-structured-session-exit-blame.test.ts
@@ -0,0 +1,68 @@
+// Only the Codex app-server child's own exit says Codex stopped; a close Orca made — a journal
+// sink that could not take a frame, a forced close — is Orca's.
+
+import { describe, expect, it, vi } from 'vitest'
+import { agentSessionFailureWords } from '../../shared/agent-session-failure-words'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { adapterFor, fakeCodex, identityFor } from './codex-structured-session-adapter-fixture'
+import type { CodexStructuredSessionEvent } from './codex-structured-session-state'
+
+function sink(overrides: Partial<StructuredAgentSessionEventSink> = {}) {
+  return { appendItem: vi.fn(), appendTombstone: vi.fn(), publish: vi.fn(), ...overrides }
+}
+
+async function startedCodex(events: StructuredAgentSessionEventSink) {
+  const codex = fakeCodex()
+  const emitted: CodexStructuredSessionEvent[] = []
+  const adapter = adapterFor(codex, {}, emitted)
+  await adapter.acquire({ identity: identityFor('session-1'), fence: 7, spawnToken: 's', events })
+  const ended = async () => {
+    await vi.waitFor(() => expect(emitted.some((event) => event.type === 'ended')).toBe(true))
+    return emitted.filter((event) => event.type === 'ended')
+  }
+  return { adapter, connection: codex.connections[0], ended }
+}
+
+describe('what a started Codex session says ended it', () => {
+  it('says Codex stopped when the child exits on its own', async () => {
+    const { connection, ended } = await startedCodex(sink())
+
+    connection.handlers.onExit?.(new Error('codex app-server connection ended: killed'))
+
+    const [event] = await ended()
+    expect(event).toMatchObject({ cause: 'unexpected-exit', failure: { kind: 'providerExited' } })
+    const failure = event && 'failure' in event ? event.failure : undefined
+    expect(
+      failure && agentSessionFailureWords(failure, { surface: 'row', agentName: 'Codex' }).text
+    ).toBe(
+      'Codex stopped while this response was in progress. You can continue in this conversation.'
+    )
+  })
+
+  it('blames Orca when a journal sink failure makes Orca close the child', async () => {
+    const { connection, ended } = await startedCodex(
+      sink({ tryAppendItem: () => ({ accepted: false, reason: 'failed' }) })
+    )
+
+    connection.handlers.onUnhandledFrame?.('frame:invalid-json', '{')
+
+    expect(await ended()).toMatchObject([
+      {
+        reason: 'Codex provider frame frame:invalid-json could not be durably recorded (failed)',
+        cause: 'unexpected-exit',
+        failure: { kind: 'hostFault' }
+      }
+    ])
+    expect(connection.closeCount).toBe(1)
+  })
+
+  it('blames Orca for a forced close', async () => {
+    const { adapter, ended } = await startedCodex(sink())
+
+    await expect(adapter.forceCloseSession('session-1')).resolves.toBe(true)
+
+    expect(await ended()).toMatchObject([
+      { cause: 'unexpected-exit', failure: { kind: 'hostFault' } }
+    ])
+  })
+})
diff --git a/src/main/codex/codex-structured-session-options-catalog.test.ts b/src/main/codex/codex-structured-session-options-catalog.test.ts
index a9fd420eb0a..aac9e2946cf 100644
--- a/src/main/codex/codex-structured-session-options-catalog.test.ts
+++ b/src/main/codex/codex-structured-session-options-catalog.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it, vi } from 'vitest'
 import { createCodexDispatchEchoes } from './codex-structured-dispatch-echo'
+import { createCodexTurnOpenWaits } from './codex-structured-turn-open-wait'
 import type { CodexAppServerConnection } from './codex-app-server-connection'
 import { CodexAcquisitionWindow } from './codex-structured-acquisition-window'
 import {
@@ -62,6 +63,7 @@ function storeSession(
     reportedOptions: { model: 'gpt-live', effort: 'high' },
     fastModeTierByModel: new Map(),
     dispatchEchoes: createCodexDispatchEchoes(),
+    turnOpenWaits: createCodexTurnOpenWaits(),
     translator: null,
     catalogAccess: { store, fingerprint: FINGERPRINT, accountHomePath: '/homes/a' }
   }
diff --git a/src/main/codex/codex-structured-session-options.test.ts b/src/main/codex/codex-structured-session-options.test.ts
index 47ed8b50e3a..d99ecc0305e 100644
--- a/src/main/codex/codex-structured-session-options.test.ts
+++ b/src/main/codex/codex-structured-session-options.test.ts
@@ -1,4 +1,5 @@
 import { createCodexDispatchEchoes } from './codex-structured-dispatch-echo'
+import { createCodexTurnOpenWaits } from './codex-structured-turn-open-wait'
 import { describe, expect, it, vi } from 'vitest'
 import type { CodexAppServerConnection } from './codex-app-server-connection'
 import { CodexAcquisitionWindow } from './codex-structured-acquisition-window'
@@ -36,6 +37,7 @@ function optionSession(request: CodexAppServerConnection['request']): CodexSessi
     reportedOptions: { model: 'gpt-live', effort: 'high' },
     fastModeTierByModel: new Map(),
     dispatchEchoes: createCodexDispatchEchoes(),
+    turnOpenWaits: createCodexTurnOpenWaits(),
     translator: null
   }
 }
diff --git a/src/main/codex/codex-structured-session-state.ts b/src/main/codex/codex-structured-session-state.ts
index b5e4796d21d..627e33dbfa9 100644
--- a/src/main/codex/codex-structured-session-state.ts
+++ b/src/main/codex/codex-structured-session-state.ts
@@ -3,14 +3,20 @@ import type {
   AgentSessionJournalIdentity
 } from '../../shared/agent-session-journal-types'
 import { randomUUID } from 'node:crypto'
+import type { AgentJournalDispatchRejection } from '../../shared/agent-session-failure-words'
 import { cancelProcessAcquisition } from '../../shared/child-process/cancel-process-acquisition'
 import type {
   CodexAppServerConnection,
   openCodexAppServerConnection
 } from './codex-app-server-connection'
 import { CodexAcquisitionWindow } from './codex-structured-acquisition-window'
+import {
+  createCodexTurnOpenWaits,
+  type CodexTurnOpenWaits
+} from './codex-structured-turn-open-wait'
 import type { CodexDispatchEchoes } from './codex-structured-dispatch-echo'
 import type { AgentSessionBackgroundTaskState } from '../../shared/agent-session-wire'
+import type { AgentChildWorkEvidence } from '../../shared/agent-status-child-work-evidence'
 import type { CodexBackgroundTaskTracker } from './codex-background-task-tracker'
 import type { CodexJournalTranslator } from './codex-structured-journal-translation'
 import type { CodexTurnProcessSnapshot } from './codex-structured-turn-processes'
@@ -34,6 +40,8 @@ export type CodexStructuredLaunch = {
    *  rollout for it, start a new thread in its place. Never set for a thread a resume proved. */
   supersedeIfUnsaved?: boolean
   permissionPolicy?: CodexStructuredPermissionPolicy
+  /** The model the session chose; the thread opens on it so its first turn is not a switch. */
+  model?: string
   env?: Record<string, string>
 }
 
@@ -75,12 +83,16 @@ export type CodexStructuredSessionAdapterDeps = {
     sessionId: string,
     state: AgentSessionBackgroundTaskState | null
   ) => void
-  /** Identity for a send admitted earlier, once Codex echoes the user message. */
-  onDispatchSettledLate?: (input: {
-    sessionId: string
-    clientMessageId: string
-    providerIdentity: AgentJournalItemIdentity
-  }) => void
+  /** What the session's child work did, delivered after the journal handled the frame. */
+  onChildWorkEvidence?: (sessionId: string, evidence: AgentChildWorkEvidence[]) => void
+  /** A send admitted earlier: its identity once Codex echoes it, or its rejection when the turn
+   *  Codex answered it into ended without taking it. */
+  onDispatchSettledLate?: (
+    input: { sessionId: string; clientMessageId: string } & (
+      | { providerIdentity: AgentJournalItemIdentity }
+      | ({ state: 'rejected' } & AgentJournalDispatchRejection)
+    )
+  ) => void
   /** Codex reported its thread not running with no turn open: a send whose
    *  dispatch was never answered is owed nothing after this. */
   onPrimaryThreadStoppedRunning?: (input: { sessionId: string }) => void
@@ -110,7 +122,11 @@ export type CodexSession = {
   threadId: string
   historyPath: string | null
   historyMode?: 'legacy' | 'paginated'
+  /** Primary-thread turns Codex reported started and not yet ended, as read off the wire: what
+   *  rewind waits out and what a Stop naming no turn interrupts when the journal shows none. */
   activeTurnIds?: Set<string>
+  /** Stops waiting for the turn Codex answered a send into to open. */
+  turnOpenWaits: CodexTurnOpenWaits
   dispatchPending?: boolean
   prompts: CodexAcquisitionWindow['prompts']
   options: Map<string, string>
@@ -141,8 +157,27 @@ export function mintCodexAcquisitionGeneration(deps: CodexStructuredSessionAdapt
 export function codexSessionLifecycle(
   fence: number,
   acquisitionGeneration: string
-): Pick<CodexSession, 'ended' | 'requestedClose' | 'fence' | 'acquisitionGeneration'> {
-  return { ended: false, requestedClose: false, fence, acquisitionGeneration }
+): Pick<
+  CodexSession,
+  'ended' | 'requestedClose' | 'fence' | 'acquisitionGeneration' | 'turnOpenWaits'
+> {
+  return {
+    ended: false,
+    requestedClose: false,
+    fence,
+    acquisitionGeneration,
+    turnOpenWaits: createCodexTurnOpenWaits()
+  }
+}
+
+/** A child that exited while being acquired never becomes the session's. */
+export function assertCodexConnectionOpen(
+  connection: Pick<CodexAppServerConnection, 'closed'>,
+  sessionId: string
+): void {
+  if (connection.closed) {
+    throw new Error(`codex app-server for session ${sessionId} exited while being acquired`)
+  }
 }
 
 export function requireLiveCodexSession(
diff --git a/src/main/codex/codex-structured-thread-facts.ts b/src/main/codex/codex-structured-thread-facts.ts
index 7422d7e44ff..f2a42e6d3db 100644
--- a/src/main/codex/codex-structured-thread-facts.ts
+++ b/src/main/codex/codex-structured-thread-facts.ts
@@ -47,6 +47,11 @@ export function readCodexTurnStatus(payload: unknown): string | null {
   return nonEmptyString(record(root.turn)?.status) ?? nonEmptyString(root.status)
 }
 
+/** A failed `turn/completed` carries Codex's reason as `turn.error.message`. */
+export function readCodexTurnErrorMessage(payload: unknown): string | null {
+  return nonEmptyString(record(record(record(payload)?.turn)?.error)?.message)
+}
+
 /** Codex's own turn duration, already in milliseconds; absent or malformed reads as null. */
 export function readCodexTurnDurationMs(payload: unknown): number | null {
   const root = record(payload)
@@ -57,12 +62,6 @@ export function readCodexTurnDurationMs(payload: unknown): number | null {
   return typeof value === 'number' && Number.isFinite(value) && value >= 0 ? value : null
 }
 
-/** `error` carries `willRetry`: Codex sets it on a stream error it is about to
- *  retry, and omits it (false) on one that ended the turn the frame names. */
-export function readCodexErrorWillRetry(payload: unknown): boolean {
-  return record(payload)?.willRetry === true
-}
-
 /** `thread/status/changed` carries a TAGGED status (`{status:{type}}`), never a
  *  bare string. `idle` and `systemError` are the two arms that mean the thread
  *  is not running; `active` and `notLoaded` are not. */
@@ -70,3 +69,13 @@ export function codexThreadStoppedRunning(payload: unknown): boolean {
   const type = record(record(payload)?.status)?.type
   return type === 'idle' || type === 'systemError'
 }
+
+/** An `active` thread flags each request it has open on the user (an approval, a question). */
+export function codexThreadWaitsOnUser(payload: unknown): boolean {
+  const status = record(record(payload)?.status)
+  const flags = status?.type === 'active' ? status.activeFlags : null
+  return (
+    Array.isArray(flags) &&
+    flags.some((flag) => flag === 'waitingOnApproval' || flag === 'waitingOnUserInput')
+  )
+}
diff --git a/src/main/codex/codex-structured-thread-open.test.ts b/src/main/codex/codex-structured-thread-open.test.ts
index b819a0dc6b2..fede869a83c 100644
--- a/src/main/codex/codex-structured-thread-open.test.ts
+++ b/src/main/codex/codex-structured-thread-open.test.ts
@@ -261,6 +261,29 @@ describe('openCodexThread', () => {
       )
     })
 
+    it('opens the replacement thread on the chosen model', async () => {
+      const request = codexWithoutRollout()
+
+      await openCodexThread(
+        connectionFor(request),
+        {
+          cwd: '/workspace',
+          resumeThreadId: 'thread-unsaved',
+          supersedeIfUnsaved: true,
+          model: 'gpt-chosen'
+        },
+        2_000
+      )
+
+      // A resume keeps the thread's own saved model, provider and effort, which naming one skips.
+      expect(request.mock.calls[0]?.[1]).not.toHaveProperty('model')
+      expect(request).toHaveBeenLastCalledWith(
+        'thread/start',
+        { cwd: '/workspace', model: 'gpt-chosen' },
+        { timeoutMs: 2_000 }
+      )
+    })
+
     it('keeps the resume failure for a thread a resume already proved', async () => {
       const request = codexWithoutRollout()
 
diff --git a/src/main/codex/codex-structured-thread-open.ts b/src/main/codex/codex-structured-thread-open.ts
index 83cd710e136..0f8b530d624 100644
--- a/src/main/codex/codex-structured-thread-open.ts
+++ b/src/main/codex/codex-structured-thread-open.ts
@@ -90,14 +90,18 @@ export async function openCodexThread(
     resumePath?: string | null
     supersedeIfUnsaved?: boolean
     permissionPolicy?: CodexStructuredPermissionPolicy
+    /** Why: Codex renders a thread's base instructions for its opening model; a first turn on
+     *  another model reads as a mid-conversation switch and injects a second full prompt. */
+    model?: string
   },
   timeoutMs: number | undefined
 ): Promise<CodexOpenedThread> {
   const resumeThreadId = launch.resumeThreadId
+  const threadSettings = { cwd: launch.cwd, ...launch.permissionPolicy }
   const startThread = (): Promise<unknown> =>
     connection.request(
       'thread/start',
-      { cwd: launch.cwd, ...launch.permissionPolicy },
+      { ...threadSettings, ...(launch.model ? { model: launch.model } : {}) },
       { timeoutMs }
     )
   let supersededThreadId: string | undefined
@@ -105,10 +109,10 @@ export async function openCodexThread(
   if (!resumeThreadId) {
     opened = await startThread()
   } else {
+    // No model: naming one makes Codex skip the thread's saved model, provider and effort.
     const resumeParams = {
       threadId: resumeThreadId,
-      cwd: launch.cwd,
-      ...launch.permissionPolicy,
+      ...threadSettings,
       ...(launch.resumePath ? { path: launch.resumePath } : {})
     }
     try {
diff --git a/src/main/codex/codex-structured-turn-cancellation.ts b/src/main/codex/codex-structured-turn-cancellation.ts
index 4418da81057..524ab252e4f 100644
--- a/src/main/codex/codex-structured-turn-cancellation.ts
+++ b/src/main/codex/codex-structured-turn-cancellation.ts
@@ -3,6 +3,8 @@ import {
   type CodexAppServerConnection
 } from './codex-app-server-connection'
 import { isCodexAppServerUnsupportedError } from './codex-app-server-session'
+import { providerDiagnosticOf } from '../../shared/agent-session-failure'
+import type { AgentSessionCancelOutcome } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
 import type {
   CodexSession,
   CodexStructuredSessionAdapterDeps,
@@ -91,7 +93,7 @@ export class CodexStructuredTurnCancellation {
     turnId: string,
     isCurrent: () => boolean = () => true,
     onConfirmed?: () => CodexJournalTranslationAdmission
-  ): Promise<{ cancelled: boolean }> {
+  ): Promise<AgentSessionCancelOutcome> {
     const state = this.state(session)
     const key = turnKey(threadId, turnId)
     state.blockedCompletions.add(key)
@@ -151,7 +153,14 @@ export class CodexStructuredTurnCancellation {
     // A failed cancellation must not permanently divert the provider's later
     // completion for this turn. Let the normal completion path settle it.
     this.releaseCompletion(session, key)
-    return { cancelled: false }
+    if (acknowledged) {
+      return { cancelled: false, unconfirmed: true }
+    }
+    if (!requestError) {
+      return { cancelled: false }
+    }
+    const detail = providerDiagnosticOf(requestError)
+    return { cancelled: false, refusal: detail ? { detail } : {} }
   }
 
   private capture(pid: number | undefined): Promise<CodexTurnProcessSnapshot | null> {
diff --git a/src/main/codex/codex-structured-turn-end-settlement.test.ts b/src/main/codex/codex-structured-turn-end-settlement.test.ts
new file mode 100644
index 00000000000..38cc648f79d
--- /dev/null
+++ b/src/main/codex/codex-structured-turn-end-settlement.test.ts
@@ -0,0 +1,321 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { AgentJournalItemBody } from '../../shared/agent-session-journal-types'
+import { classifyDispatchRejection } from '../../shared/structured-agent-session-dispatch-rejection'
+import { createCodexDispatchEchoes } from './codex-structured-dispatch-echo'
+import {
+  acquiredCodexAdapter,
+  CODEX_TEST_THREAD_ID,
+  CODEX_TEST_USER_MESSAGE,
+  fakeCodexAppServer,
+  type LateSettlement
+} from './codex-structured-dispatch-test-support'
+import { codexTurnLifecycleFake } from './codex-turn-lifecycle-fake'
+
+async function turnEndRig() {
+  const codex = fakeCodexAppServer()
+  const turns = codexTurnLifecycleFake(CODEX_TEST_THREAD_ID, () => {
+    const handlers = codex.connections.at(-1)?.handlers
+    return (method, params) => handlers?.onNotification?.(method, params)
+  })
+  Object.assign(codex.routes, turns.routes)
+  const settlements: LateSettlement[] = []
+  const bodies: AgentJournalItemBody[] = []
+  const adapter = await acquiredCodexAdapter({
+    codex,
+    settlements,
+    sink: {
+      appendItem: (_identity, body) => bodies.push(body),
+      appendTombstone: () => {},
+      publish: () => {}
+    }
+  })
+  const send = (clientMessageId: string) =>
+    adapter.dispatch({
+      sessionId: 'session-1',
+      clientMessageId,
+      body: CODEX_TEST_USER_MESSAGE,
+      fence: 7
+    })
+  // Codex answers a cold send before it opens the turn.
+  const sendAndOpen = async (clientMessageId: string) => {
+    const sending = send(clientMessageId)
+    await vi.waitFor(() => expect(turns.turnId).not.toBeNull())
+    turns.start()
+    return sending
+  }
+  const settledIds = () => settlements.map(({ clientMessageId }) => clientMessageId)
+  const categoryOf = (settlement: LateSettlement | undefined) =>
+    settlement && 'state' in settlement ? classifyDispatchRejection(settlement).category : null
+  return { codex, turns, adapter, send, sendAndOpen, settlements, settledIds, categoryOf, bodies }
+}
+
+describe('a Codex send its turn ended without echoing', () => {
+  it('is withdrawn when the turn is interrupted, once', async () => {
+    const rig = await turnEndRig()
+    await expect(rig.sendAndOpen('client-1')).resolves.toEqual({ state: 'admitted' })
+
+    rig.turns.end('interrupted')
+
+    expect(rig.settlements).toEqual([
+      expect.objectContaining({
+        sessionId: 'session-1',
+        clientMessageId: 'client-1',
+        state: 'rejected'
+      })
+    ])
+    expect(rig.categoryOf(rig.settlements[0])).toBe('withdrawn')
+  })
+
+  it('is rejected in Codex words when its failed turn ends without echoing it', async () => {
+    const rig = await turnEndRig()
+    await rig.sendAndOpen('client-1')
+
+    rig.codex.connections[0]!.handlers.onNotification?.('error', {
+      threadId: CODEX_TEST_THREAD_ID,
+      turnId: 'turn-1',
+      willRetry: false,
+      error: { message: 'usage limit reached' }
+    })
+    rig.turns.end('failed', 'usage limit reached')
+
+    expect(rig.settlements).toEqual([
+      expect.objectContaining({
+        clientMessageId: 'client-1',
+        state: 'rejected',
+        rejection: {
+          kind: 'providerRejected',
+          detail: { text: 'usage limit reached', audience: 'person' }
+        }
+      })
+    ])
+  })
+
+  it('is accepted when Codex records it after the error that fails its turn', async () => {
+    const rig = await turnEndRig()
+    await rig.sendAndOpen('client-1')
+    rig.turns.echo('client-1')
+    await rig.send('client-2')
+
+    // A failed turn keeps its steered input: Codex records it after the error, before the end.
+    rig.codex.connections[0]!.handlers.onNotification?.('error', {
+      threadId: CODEX_TEST_THREAD_ID,
+      turnId: 'turn-1',
+      willRetry: false,
+      error: { message: 'usage limit reached' }
+    })
+    rig.turns.echo('client-2')
+    rig.turns.end('failed', 'usage limit reached')
+
+    expect(rig.settlements).toEqual([
+      expect.objectContaining({ clientMessageId: 'client-1', providerIdentity: expect.anything() }),
+      expect.objectContaining({
+        clientMessageId: 'client-2',
+        providerIdentity: expect.objectContaining({ turnId: 'turn-1' })
+      })
+    ])
+  })
+
+  it('stays pending, still armed, when its turn completes without echoing it', async () => {
+    const rig = await turnEndRig()
+    await rig.sendAndOpen('client-1')
+
+    rig.turns.end('completed')
+    expect(rig.settlements).toEqual([])
+
+    // Codex echoes before a completed end; this late one only proves the send is still armed.
+    rig.turns.echo('client-1')
+    expect(rig.settlements).toEqual([
+      expect.objectContaining({
+        clientMessageId: 'client-1',
+        providerIdentity: expect.objectContaining({ turnId: 'turn-1' })
+      })
+    ])
+  })
+
+  it('accepts a send its turn echoed, with its key, exactly once', async () => {
+    const rig = await turnEndRig()
+    await rig.sendAndOpen('client-1')
+    rig.turns.echo('client-1')
+
+    rig.turns.end('interrupted')
+
+    expect(rig.settlements).toEqual([
+      {
+        sessionId: 'session-1',
+        clientMessageId: 'client-1',
+        providerIdentity: {
+          provider: 'codex',
+          threadId: CODEX_TEST_THREAD_ID,
+          turnId: 'turn-1',
+          ordinal: 0
+        }
+      }
+    ])
+  })
+
+  it('ignores an echo that arrives after the withdrawal', async () => {
+    const rig = await turnEndRig()
+    await rig.sendAndOpen('client-1')
+    rig.turns.end('interrupted')
+
+    rig.turns.echo('client-1')
+
+    expect(rig.settledIds()).toEqual(['client-1'])
+    expect(rig.categoryOf(rig.settlements[0])).toBe('withdrawn')
+  })
+
+  it('settles each of two sends steered into one interrupted turn once', async () => {
+    const rig = await turnEndRig()
+    await rig.sendAndOpen('client-1')
+    await rig.send('client-2')
+    expect(rig.turns.turnId).toBe('turn-1')
+
+    rig.turns.end('interrupted')
+
+    expect(rig.settledIds().sort()).toEqual(['client-1', 'client-2'])
+  })
+
+  it('settles a send whose answer arrived after turn/started when the turn is interrupted', async () => {
+    const rig = await turnEndRig()
+    const release = rig.turns.holdNextAnswer()
+    const sending = rig.send('client-1')
+    await vi.waitFor(() => expect(rig.turns.turnId).toBe('turn-1'))
+    rig.turns.start()
+    release()
+    await expect(sending).resolves.toEqual({ state: 'admitted' })
+
+    rig.turns.end('interrupted')
+
+    expect(rig.settledIds()).toEqual(['client-1'])
+  })
+
+  it('settles a send by the recorded end of a turn that finished before its answer arrived', async () => {
+    const rig = await turnEndRig()
+    const release = rig.turns.holdNextAnswer()
+    const sending = rig.send('client-1')
+    await vi.waitFor(() => expect(rig.turns.turnId).toBe('turn-1'))
+    rig.turns.start()
+    rig.turns.end('interrupted')
+    const rowsAtEnd = rig.bodies.filter((body) => body.kind === 'turn').length
+    release()
+
+    const outcome = await sending
+    expect(outcome.state === 'rejected' && classifyDispatchRejection(outcome).category).toBe(
+      'withdrawn'
+    )
+    expect(rig.settlements).toEqual([])
+    // The answer opens nothing: the turn keeps its terminal row.
+    expect(rig.bodies.filter((body) => body.kind === 'turn')).toHaveLength(rowsAtEnd)
+    expect(rig.bodies.findLast((body) => body.kind === 'turn')).toMatchObject({
+      state: 'interrupted'
+    })
+  })
+
+  it('rejects a send in Codex words by the recorded end of a failed turn that finished before its answer', async () => {
+    const rig = await turnEndRig()
+    const release = rig.turns.holdNextAnswer()
+    const sending = rig.send('client-1')
+    await vi.waitFor(() => expect(rig.turns.turnId).toBe('turn-1'))
+    rig.turns.start()
+    rig.turns.end('failed', 'usage limit reached')
+    release()
+
+    await expect(sending).resolves.toMatchObject({
+      state: 'rejected',
+      rejection: {
+        kind: 'providerRejected',
+        detail: { text: 'usage limit reached', audience: 'person' }
+      }
+    })
+    // Settled once, by the answer: a late echo is no longer owed anything.
+    rig.turns.echo('client-1')
+    expect(rig.settlements).toEqual([])
+  })
+
+  it('leaves a send pending, still armed, when its answer is read after its turn completed', async () => {
+    const rig = await turnEndRig()
+    const release = rig.turns.holdNextAnswer()
+    const sending = rig.send('client-1')
+    await vi.waitFor(() => expect(rig.turns.turnId).toBe('turn-1'))
+    rig.turns.start()
+    rig.turns.end('completed')
+    release()
+
+    await expect(sending).resolves.toEqual({ state: 'admitted' })
+    expect(rig.settlements).toEqual([])
+    rig.turns.echo('client-1')
+    expect(rig.settledIds()).toEqual(['client-1'])
+    expect(rig.settlements[0]).toHaveProperty('providerIdentity')
+  })
+
+  it('leaves a send whose answer timed out to its echo', async () => {
+    const rig = await turnEndRig()
+    rig.codex.routes['turn/start'] = () => {
+      throw new Error('codex app-server turn/start exceeded 30000ms')
+    }
+    await expect(rig.send('client-1')).rejects.toThrow('exceeded')
+
+    rig.codex.connections[0]!.handlers.onNotification?.('turn/started', {
+      threadId: CODEX_TEST_THREAD_ID,
+      turn: { id: 'turn-9' }
+    })
+    rig.codex.connections[0]!.handlers.onNotification?.('item/completed', {
+      threadId: CODEX_TEST_THREAD_ID,
+      turn: { id: 'turn-9' },
+      item: { type: 'userMessage', id: 'item-9', clientId: 'client-1', content: [] }
+    })
+
+    expect(rig.settlements).toEqual([
+      expect.objectContaining({
+        clientMessageId: 'client-1',
+        providerIdentity: expect.objectContaining({ turnId: 'turn-9' })
+      })
+    ])
+  })
+
+  it('ignores a turn end on a child thread', async () => {
+    const rig = await turnEndRig()
+    await rig.sendAndOpen('client-1')
+
+    rig.codex.connections[0]!.handlers.onNotification?.('turn/completed', {
+      threadId: 'thread-child',
+      turn: { id: 'turn-1', status: 'interrupted' }
+    })
+
+    expect(rig.settlements).toEqual([])
+  })
+})
+
+describe('a send bound to a turn', () => {
+  it('dies with the settlement its turn end makes', () => {
+    const echoes = createCodexDispatchEchoes()
+    echoes.arm('client-1')
+    echoes.bindTurn('client-1', 'thread-1', 'turn-1')
+
+    expect(echoes.endTurn('thread-1', 'turn-1', { status: 'interrupted' })).toEqual(['client-1'])
+    expect(echoes.size).toBe(0)
+    expect(echoes.settle('client-1')).toBe(false)
+  })
+
+  it('dies with its child, which forgets recorded turn ends too', () => {
+    const echoes = createCodexDispatchEchoes()
+    echoes.arm('client-1')
+    echoes.bindTurn('client-1', 'thread-1', 'turn-1')
+    echoes.endTurn('thread-2', 'turn-2', { status: 'interrupted' })
+
+    echoes.clear()
+
+    expect(echoes.size).toBe(0)
+    echoes.arm('client-2')
+    expect(echoes.bindTurn('client-2', 'thread-2', 'turn-2')).toBeNull()
+  })
+
+  it('is matched by thread as well as turn id', () => {
+    const echoes = createCodexDispatchEchoes()
+    echoes.arm('client-1')
+    echoes.bindTurn('client-1', 'thread-1', 'turn-1')
+
+    expect(echoes.endTurn('thread-2', 'turn-1', { status: 'interrupted' })).toEqual([])
+    expect(echoes.size).toBe(1)
+  })
+})
diff --git a/src/main/codex/codex-structured-turn-end-settlement.ts b/src/main/codex/codex-structured-turn-end-settlement.ts
new file mode 100644
index 00000000000..5187aabf45a
--- /dev/null
+++ b/src/main/codex/codex-structured-turn-end-settlement.ts
@@ -0,0 +1,96 @@
+// A send Codex answered into a turn that then ended without echoing it. Codex clears
+// a turn's pending input when it is interrupted, so that send never reached the model
+// and is withdrawn, as a Stop's host-side withdrawal is. Any other end records pending
+// input before `turn/completed`, a failed turn after its `error` frame, so only that
+// frame settles: a failed turn that never echoed the send refused it, in Codex's words,
+// and a completed one leaves it pending for the journal's recovery on exit.
+
+import {
+  agentSessionFailureFact,
+  providerDiagnostic,
+  type ProviderDiagnostic,
+  type SubmissionRejectionFact
+} from '../../shared/agent-session-failure'
+import {
+  agentSessionFailureWords,
+  type AgentJournalDispatchRejection
+} from '../../shared/agent-session-failure-words'
+import type { CodexTurnEnd } from './codex-structured-dispatch-echo'
+import type { CodexSession } from './codex-structured-session-state'
+import {
+  readCodexThreadId,
+  readCodexTurnErrorMessage,
+  readCodexTurnId,
+  readCodexTurnStatus
+} from './codex-structured-thread-facts'
+import { TUI_AGENT_DISPLAY_NAMES } from '../../shared/tui-agent-display-names'
+
+/** A message Codex rejected, in the words that name Codex and its legacy markers. */
+export function codexDispatchRejection(
+  failure: SubmissionRejectionFact
+): AgentJournalDispatchRejection {
+  return agentSessionFailureWords(failure, {
+    surface: 'rejection',
+    agentName: TUI_AGENT_DISPLAY_NAMES.codex,
+    provider: 'codex'
+  })
+}
+
+export type CodexTurnEndSettlement = {
+  clientMessageId: string
+  state: 'rejected'
+} & AgentJournalDispatchRejection
+
+function errorDetail(params: unknown): ProviderDiagnostic | undefined {
+  const message = readCodexTurnErrorMessage(params)
+  return message ? providerDiagnostic(message, 'person') : undefined
+}
+
+/** The end a primary-thread notification reports for its turn, or null for any other frame. */
+export function readCodexTurnEnd(method: string, params: unknown): CodexTurnEnd | null {
+  if (method !== 'turn/completed') {
+    return null
+  }
+  const status = readCodexTurnStatus(params)
+  if (status === 'interrupted') {
+    return { status: 'interrupted' }
+  }
+  if (status === 'failed') {
+    const detail = errorDetail(params)
+    return { status: 'failed', ...(detail ? { detail } : {}) }
+  }
+  return { status: 'completed' }
+}
+
+/** How an ended turn settles a send it never echoed; null leaves the send to its echo. */
+export function codexTurnEndRejection(end: CodexTurnEnd): AgentJournalDispatchRejection | null {
+  if (end.status === 'interrupted') {
+    return agentSessionFailureWords(agentSessionFailureFact('cancelled'), { surface: 'rejection' })
+  }
+  if (end.status === 'failed') {
+    return codexDispatchRejection(
+      agentSessionFailureFact('providerRejected', end.detail ? { detail: end.detail } : {})
+    )
+  }
+  return null
+}
+
+/** Settles the sends bound to the turn this admitted notification ended. */
+export function settleCodexSendsInEndedTurn(
+  session: Pick<CodexSession, 'threadId' | 'dispatchEchoes'>,
+  method: string,
+  params: unknown,
+  settle: (settlement: CodexTurnEndSettlement) => void
+): void {
+  const turnId = readCodexTurnId(params)
+  const end = readCodexTurnEnd(method, params)
+  if (!turnId || !end || (readCodexThreadId(params) ?? session.threadId) !== session.threadId) {
+    return
+  }
+  const rejection = codexTurnEndRejection(end)
+  for (const clientMessageId of session.dispatchEchoes.endTurn(session.threadId, turnId, end)) {
+    if (rejection) {
+      settle({ clientMessageId, state: 'rejected', ...rejection })
+    }
+  }
+}
diff --git a/src/main/codex/codex-structured-turn-open-wait.test.ts b/src/main/codex/codex-structured-turn-open-wait.test.ts
new file mode 100644
index 00000000000..125be2bba0b
--- /dev/null
+++ b/src/main/codex/codex-structured-turn-open-wait.test.ts
@@ -0,0 +1,147 @@
+// A Codex Stop that names no turn, sent after Codex answered a cold send and before it opened that
+// turn, waits for the turn to open, or provably not to, and never the send itself. The fake keeps
+// Codex 0.157's turn bookkeeping: it answers before it opens the turn, and refuses an interrupt
+// until then.
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  CODEX_TEST_THREAD_ID,
+  codexTurnLifecycleRig,
+  settledWithin
+} from './codex-structured-dispatch-test-support'
+import { CODEX_STOP_TURN_OPEN_WAIT_MS } from './codex-structured-prompt-ownership'
+
+type Rig = Awaited<ReturnType<typeof codexTurnLifecycleRig>>
+
+const ADMITTED = { state: 'admitted' }
+const REFUSED = { cancelled: false }
+
+const stop = (rig: Rig) => rig.adapter.cancelTurn({ sessionId: 'session-1', fence: 7 })
+
+/** A cold send Codex answered into `turn-1` and has not opened. */
+async function answeredColdSend(rig: Rig): Promise<void> {
+  const sending = rig.send('client-1')
+  await vi.waitFor(() => expect(rig.turns.turnId).toBe('turn-1'))
+  // The send is not held for the turn to open: its handover ends at the answer.
+  expect(await settledWithin(sending)).toEqual(ADMITTED)
+}
+
+/** A Stop sent in the window, which Codex would refuse if it reached Codex now. */
+async function waitingStop(rig: Rig) {
+  await answeredColdSend(rig)
+  const stopping = stop(rig)
+  expect(await settledWithin(stopping)).toBe('held')
+  expect(rig.interrupts()).toEqual([])
+  // Wrapped: an async function returning the promise itself would wait for it.
+  return { stopping }
+}
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('a Codex send answered before its turn opens', () => {
+  it('is admitted at the answer when no Stop is pending', async () => {
+    const rig = await codexTurnLifecycleRig()
+
+    await answeredColdSend(rig)
+
+    expect(rig.turns.turnId).toBe('turn-1')
+  })
+})
+
+describe("a no-turn Stop in the window between Codex's answer and its turn opening", () => {
+  it('waits for the turn to open, then stops it', async () => {
+    const rig = await codexTurnLifecycleRig()
+    const { stopping } = await waitingStop(rig)
+
+    rig.turns.start()
+
+    expect(await settledWithin(stopping)).toEqual({ cancelled: true })
+    expect(rig.interrupts().map((call) => call.params?.turnId)).toEqual(['turn-1'])
+    expect(rig.turns.turnId).toBeNull()
+  })
+
+  it('does not wait when Codex opened the turn before its answer was read', async () => {
+    const rig = await codexTurnLifecycleRig()
+    const release = rig.turns.holdNextAnswer()
+    const sending = rig.send('client-1')
+    await vi.waitFor(() => expect(rig.turns.turnId).toBe('turn-1'))
+    rig.turns.start()
+    release()
+    await sending
+
+    expect(await settledWithin(stop(rig))).toEqual({ cancelled: true })
+  })
+
+  it('does not wait for a send Codex steered into the running turn', async () => {
+    const rig = await codexTurnLifecycleRig()
+    await answeredColdSend(rig)
+    rig.turns.start()
+    expect(await settledWithin(rig.send('client-2'))).toEqual(ADMITTED)
+
+    expect(await settledWithin(stop(rig))).toEqual({ cancelled: true })
+    expect(rig.interrupts().map((call) => call.params?.turnId)).toEqual(['turn-1'])
+  })
+
+  it('stops nothing when the turn ends without opening', async () => {
+    const rig = await codexTurnLifecycleRig()
+    const { stopping } = await waitingStop(rig)
+
+    rig.turns.end('interrupted')
+
+    expect(await settledWithin(stopping)).toEqual(REFUSED)
+    expect(rig.interrupts()).toEqual([])
+  })
+
+  it.each(['idle', 'systemError'])(
+    'stops nothing when Codex reports the thread %s',
+    async (type) => {
+      const rig = await codexTurnLifecycleRig()
+      const { stopping } = await waitingStop(rig)
+
+      rig.notify('thread/status/changed', { threadId: CODEX_TEST_THREAD_ID, status: { type } })
+
+      expect(await settledWithin(stopping)).toEqual(REFUSED)
+      expect(rig.interrupts()).toEqual([])
+    }
+  )
+
+  it('keeps waiting when a child thread stops running', async () => {
+    const rig = await codexTurnLifecycleRig()
+    const { stopping } = await waitingStop(rig)
+
+    rig.notify('thread/status/changed', { threadId: 'thread-child', status: { type: 'idle' } })
+
+    expect(await settledWithin(stopping)).toBe('held')
+    rig.turns.start()
+    expect(await settledWithin(stopping)).toEqual({ cancelled: true })
+  })
+
+  it('stops nothing when the child exits', async () => {
+    const rig = await codexTurnLifecycleRig()
+    const { stopping } = await waitingStop(rig)
+
+    rig.codex.connections[0]!.handlers.onExit?.(new Error('codex app-server exited'))
+
+    expect(await settledWithin(stopping)).toEqual(REFUSED)
+    expect(rig.interrupts()).toEqual([])
+  })
+
+  it('stops nothing once its bound runs out', async () => {
+    const rig = await codexTurnLifecycleRig()
+    await answeredColdSend(rig)
+    vi.useFakeTimers()
+    let outcome: unknown = 'held'
+    void stop(rig).then((value) => {
+      outcome = value
+    })
+
+    await vi.advanceTimersByTimeAsync(CODEX_STOP_TURN_OPEN_WAIT_MS - 1)
+    expect(outcome).toBe('held')
+    await vi.advanceTimersByTimeAsync(1)
+
+    expect(outcome).toEqual(REFUSED)
+    expect(rig.interrupts()).toEqual([])
+  })
+})
diff --git a/src/main/codex/codex-structured-turn-open-wait.ts b/src/main/codex/codex-structured-turn-open-wait.ts
new file mode 100644
index 00000000000..63e37294005
--- /dev/null
+++ b/src/main/codex/codex-structured-turn-open-wait.ts
@@ -0,0 +1,54 @@
+// A Stop's wait for the turn Codex answered a send into to open, or provably not to: it ended,
+// the thread stopped running, or the child is gone. Held in memory only.
+
+import {
+  codexThreadStoppedRunning,
+  readCodexThreadId,
+  readCodexTurnId
+} from './codex-structured-thread-facts'
+
+export type CodexTurnOpenWaits = {
+  /** Resolves once `turnId` opens or can no longer, and after `withinMs` at the latest. */
+  wait: (turnId: string, withinMs: number) => Promise<void>
+  /** Ends the waits a notification on the session's own thread answers. */
+  observe: (threadId: string, method: string, params: unknown) => void
+  /** Ends every wait: the child that would open their turns is gone. */
+  releaseAll: () => void
+}
+
+export function createCodexTurnOpenWaits(): CodexTurnOpenWaits {
+  const waits = new Map<() => void, string>()
+  const release = (turnId?: string): void => {
+    for (const [endWait, waitedTurnId] of waits) {
+      if (turnId === undefined || waitedTurnId === turnId) {
+        endWait()
+      }
+    }
+  }
+  return {
+    wait: (turnId, withinMs) =>
+      new Promise<void>((resolve) => {
+        const endWait = (): void => {
+          clearTimeout(bound)
+          waits.delete(endWait)
+          resolve()
+        }
+        const bound = setTimeout(endWait, withinMs)
+        waits.set(endWait, turnId)
+      }),
+    observe: (threadId, method, params) => {
+      if ((readCodexThreadId(params) ?? threadId) !== threadId) {
+        return
+      }
+      if (method === 'thread/status/changed' && codexThreadStoppedRunning(params)) {
+        release()
+        return
+      }
+      const turnId = readCodexTurnId(params)
+      if (turnId && (method === 'turn/started' || method === 'turn/completed')) {
+        release(turnId)
+      }
+    },
+    releaseAll: () => release()
+  }
+}
diff --git a/src/main/codex/codex-structured-turn-start.ts b/src/main/codex/codex-structured-turn-start.ts
index 2d22ce42f3e..825a6c3c375 100644
--- a/src/main/codex/codex-structured-turn-start.ts
+++ b/src/main/codex/codex-structured-turn-start.ts
@@ -1,3 +1,4 @@
+import { agentSessionFailureFact, providerDiagnosticOf } from '../../shared/agent-session-failure'
 import type { AgentJournalMessageItem } from '../../shared/agent-session-journal-types'
 import type { NativeChatBlock } from '../../shared/native-chat-types'
 import type { AgentSessionDispatchOutcome } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
@@ -7,7 +8,11 @@ import {
 } from './codex-app-server-connection'
 import { isCodexAppServerUnsupportedError } from './codex-app-server-session'
 import type { CodexDispatchEchoes } from './codex-structured-dispatch-echo'
-import { DISPATCH_REJECTED_CODEX_QUEUE_FULL } from '../../shared/structured-agent-session-dispatch-rejection'
+import { readCodexTurnId } from './codex-structured-thread-facts'
+import {
+  codexDispatchRejection,
+  codexTurnEndRejection
+} from './codex-structured-turn-end-settlement'
 import { decodeStructuredAgentSessionOptionValue } from '../../shared/structured-agent-session-option-codec'
 
 // Writing a Codex turn and learning which message landed where, which are not
@@ -15,7 +20,8 @@ import { decodeStructuredAgentSessionOptionValue } from '../../shared/structured
 // message issued while a turn is running is COALESCED into that turn: the same
 // turn id comes back, no second `turn/started` fires, and the user message is
 // echoed only when the running turn reaches it. So the response proves
-// admission and nothing about identity, which the echo settles later.
+// admission and nothing about identity, which the echo settles later. The turn
+// it names is kept with the send, so that turn's end can settle it.
 
 /** Keys Codex accepts as per-turn overrides. An unlisted key would otherwise
  *  become an arbitrary client-controlled `turn/start` parameter. Permission posture is owned by
@@ -86,7 +92,8 @@ function codexTurnOptions(host: CodexTurnHost): Record<string, string> {
 
 /**
  * Hands one submission to Codex. False means the bounded correlation window
- * refused it before the write; otherwise resolves when Codex has taken it.
+ * refused it before the write; otherwise resolves with the turn Codex answered
+ * it into, or null when the answer named none.
  */
 export async function startCodexTurn(
   host: CodexTurnHost,
@@ -96,13 +103,13 @@ export async function startCodexTurn(
     requestedAt?: number
     timeoutMs?: number
   }
-): Promise<boolean> {
+): Promise<{ turnId: string | null } | false> {
   // Armed before the write: the echo and `turn/started` can both land while the
   // response is in flight, and the start must snapshot this send in its frontier.
   if (!host.dispatchEchoes.arm(input.clientMessageId, input.requestedAt)) {
     return false
   }
-  await host.connection.request(
+  const answer = await host.connection.request(
     'turn/start',
     {
       threadId: host.threadId,
@@ -112,7 +119,7 @@ export async function startCodexTurn(
     },
     { timeoutMs: input.timeoutMs }
   )
-  return true
+  return { turnId: readCodexTurnId(answer) }
 }
 
 /**
@@ -126,19 +133,32 @@ export async function dispatchCodexTurn(
   input: { clientMessageId: string; body: AgentJournalMessageItem; requestedAt?: number },
   timeoutMs: number | undefined
 ): Promise<AgentSessionDispatchOutcome> {
+  let answer: { turnId: string | null } | false
   try {
-    if (!(await startCodexTurn(session, { ...input, timeoutMs }))) {
-      return { state: 'rejected', reason: DISPATCH_REJECTED_CODEX_QUEUE_FULL }
-    }
+    answer = await startCodexTurn(session, { ...input, timeoutMs })
   } catch (error) {
     if (isCodexAppServerRequestError(error) || isCodexAppServerUnsupportedError(error)) {
       // Codex answered and declined, so no echo for this write can arrive.
       session.dispatchEchoes.disarm(input.clientMessageId)
-      return { state: 'rejected', reason: (error as Error).message }
+      // Codex's own words, when it gave any, are the one part of the error a person can use.
+      return {
+        state: 'rejected',
+        ...codexDispatchRejection(
+          agentSessionFailureFact('providerRejected', { detail: providerDiagnosticOf(error) })
+        )
+      }
     }
     // A timeout or transport failure can happen after the frame was written.
     // Keep the correlation armed so a later echo can prove delivery.
     throw error
   }
-  return { state: 'admitted' }
+  if (!answer) {
+    return { state: 'rejected', ...codexDispatchRejection(agentSessionFailureFact('queueFull')) }
+  }
+  // An answer read after the turn it names already ended is settled by that end.
+  const endedFirst = answer.turnId
+    ? session.dispatchEchoes.bindTurn(input.clientMessageId, session.threadId, answer.turnId)
+    : null
+  const rejection = endedFirst ? codexTurnEndRejection(endedFirst) : null
+  return rejection ? { state: 'rejected', ...rejection } : { state: 'admitted' }
 }
diff --git a/src/main/codex/codex-subagent-executions.ts b/src/main/codex/codex-subagent-executions.ts
index 0f74babe734..87d9327c70c 100644
--- a/src/main/codex/codex-subagent-executions.ts
+++ b/src/main/codex/codex-subagent-executions.ts
@@ -94,6 +94,15 @@ export class CodexSubagentExecutions {
     return { child, execution }
   }
 
+  /** The child's thread closed with no `turn/completed`: the turn it was running ended, and how
+   *  it went is unknown. A child running none has nothing to end. */
+  closeThread(agentThreadId: string): void {
+    const current = this.children.get(agentThreadId)?.execution
+    if (current?.state === 'working') {
+      this.observeTurn(agentThreadId, current.turnId, 'unverifiable')
+    }
+  }
+
   /** Survives the child's turn, so a row outliving that turn can still name it. */
   label(agentThreadId: string): string | null {
     return this.children.get(agentThreadId)?.label ?? null
@@ -109,6 +118,11 @@ export class CodexSubagentExecutions {
     return this.children.get(agentThreadId)?.turnOrdinals.get(turnId) ?? null
   }
 
+  /** The child as last observed, without creating one. */
+  find(agentThreadId: string): Readonly<CodexExecutionChild> | undefined {
+    return this.children.get(agentThreadId)
+  }
+
   workingChildren(): CodexExecutionChild[] {
     return [...this.children.values()].filter(
       (child) => child.registered && child.execution?.state === 'working'
diff --git a/src/main/codex/codex-subagent-linkage.ts b/src/main/codex/codex-subagent-linkage.ts
index 59d57a8e4c0..52f6bdc2611 100644
--- a/src/main/codex/codex-subagent-linkage.ts
+++ b/src/main/codex/codex-subagent-linkage.ts
@@ -8,15 +8,18 @@
 // run are learned from the roster's executions, and a later revision of the
 // row picks them up when they arrive.
 
-import type { AgentJournalProducerLinkage } from '../../shared/agent-session-journal-types'
+import type {
+  AgentJournalProducerLinkage,
+  AgentJournalRowAttribution
+} from '../../shared/agent-session-journal-types'
 import type { CodexSubagentExecutions } from './codex-subagent-executions'
 
-/** Linkage for a row one thread produced, within one of that thread's turns
- *  (null outside any). Every Codex write site resolves through this. */
-export type CodexRowLinkage = (
+/** Who produced a row one thread wrote within one of that thread's turns (null outside any),
+ *  and which turn the row belongs to. Every Codex write site resolves through this. */
+export type CodexRowAttribution = (
   threadId: string,
   turnId: string | null
-) => AgentJournalProducerLinkage
+) => AgentJournalRowAttribution
 
 export class CodexSubagentLinkage {
   constructor(
@@ -26,7 +29,7 @@ export class CodexSubagentLinkage {
     }
   ) {}
 
-  linkageFor: CodexRowLinkage = (threadId, turnId) => {
+  linkageFor = (threadId: string, turnId: string | null): AgentJournalProducerLinkage => {
     const primary = this.deps.primaryThreadId()
     // An unknown primary means the session's thread is still opening, and no
     // turn has run that could have spawned a child.
diff --git a/src/main/codex/codex-subagent-roster-state.ts b/src/main/codex/codex-subagent-roster-state.ts
new file mode 100644
index 00000000000..02c79411b79
--- /dev/null
+++ b/src/main/codex/codex-subagent-roster-state.ts
@@ -0,0 +1,36 @@
+// One spawn group's roster state, and the ids its journal row is keyed on.
+
+import type {
+  AgentJournalItemIdentity,
+  AgentJournalTurnScope
+} from '../../shared/agent-session-journal-types'
+import type { NativeChatSubagentEntry } from '../../shared/native-chat-types'
+
+/** The turn a group belongs to when Codex reports activity outside any turn.
+ *  Mirrors the generic-frame bucket name so the two read alike in the journal. */
+export type RosterGroup = {
+  groupId: string
+  identity: AgentJournalItemIdentity
+  /** The spawning turn's scope: the row reports its children beside that turn's work. */
+  turnScope: AgentJournalTurnScope
+  /** Insertion order is the display order; the map holds the state. */
+  entries: Map<string, NativeChatSubagentEntry>
+  executionTurns: Map<string, string | null>
+  /** Times each label has been claimed, so a repeat gets an ordinal suffix. */
+  labelCounts: Map<string, number>
+  /** Last body written, so an idempotent replay writes no new revision. */
+  lastSerialized: string | null
+}
+
+/** Group identity: the parent turn that spawned the children. `agentPath` is a
+ *  tree rooted at the parent thread, so every child of one turn shares a row
+ *  no matter which thread's stream carried its activity item. */
+export function codexSubagentGroupId(threadId: string, turnId: string | null): string {
+  return `${threadId}:${turnId ?? 'outside-turn'}`
+}
+
+/** Durable journal identity for the group's row — stable across revisions and
+ *  across a restart, so replay finds the same row instead of appending a new one. */
+export function codexSubagentGroupIdentity(groupId: string): AgentJournalItemIdentity {
+  return { provider: 'orca', clientMessageId: `codex-subagents:${groupId}` }
+}
diff --git a/src/main/codex/codex-subagent-roster.test.ts b/src/main/codex/codex-subagent-roster.test.ts
index 9d3e2c690c4..dcaecb0e3e5 100644
--- a/src/main/codex/codex-subagent-roster.test.ts
+++ b/src/main/codex/codex-subagent-roster.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../shared/agent-session-journal-types'
 import { describe, expect, it } from 'vitest'
 import { isAdmissibleAgentJournalItemBody } from '../../shared/agent-session-journal-schemas'
 import type {
@@ -43,6 +44,7 @@ function createHarness(options: { threadId?: string | null } = {}): {
     tryPublish: () => ({ accepted: true })
   }
   const roster = new CodexSubagentRoster({
+    turnScopeFor: () => AGENT_JOURNAL_THREAD_SCOPE,
     sink,
     primaryThreadId: () => (options.threadId === undefined ? THREAD : options.threadId),
     activeTurn: () => TURN,
@@ -138,6 +140,7 @@ function createCoalescingHarness(): {
     }
   }
   const roster = new CodexSubagentRoster({
+    turnScopeFor: () => AGENT_JOURNAL_THREAD_SCOPE,
     sink,
     primaryThreadId: () => THREAD,
     activeTurn: () => TURN,
@@ -668,6 +671,7 @@ describe('CodexSubagentRoster', () => {
       const published: number[] = []
       const refusal = { accepted: false, reason: 'backpressure' } as const
       const roster = new CodexSubagentRoster({
+        turnScopeFor: () => AGENT_JOURNAL_THREAD_SCOPE,
         sink: {
           appendItem: () => {},
           appendTombstone: () => {},
@@ -721,6 +725,7 @@ describe('CodexSubagentRoster', () => {
     const appended: Appended[] = []
     const published: number[] = []
     const roster = new CodexSubagentRoster({
+      turnScopeFor: () => AGENT_JOURNAL_THREAD_SCOPE,
       sink: {
         appendItem: () => {},
         appendTombstone: () => {},
@@ -765,6 +770,7 @@ describe('CodexSubagentRoster', () => {
 
   it('propagates sink backpressure instead of reporting the row as written', () => {
     const roster = new CodexSubagentRoster({
+      turnScopeFor: () => AGENT_JOURNAL_THREAD_SCOPE,
       sink: {
         appendItem: () => {},
         appendTombstone: () => {},
diff --git a/src/main/codex/codex-subagent-roster.ts b/src/main/codex/codex-subagent-roster.ts
index 99b37e9c772..db02ac7f454 100644
--- a/src/main/codex/codex-subagent-roster.ts
+++ b/src/main/codex/codex-subagent-roster.ts
@@ -13,12 +13,9 @@
 // thread, and a real turn id is assumed freshly minted per turn. Seeding from
 // the journal is the fix.
 
-import type { AgentJournalItemIdentity } from '../../shared/agent-session-journal-types'
+import type { AgentJournalTurnScope } from '../../shared/agent-session-journal-types'
 import { isTerminalSubagentState } from '../../shared/native-chat-subagent-summary'
-import type {
-  NativeChatSubagentEntry,
-  NativeChatSubagentState
-} from '../../shared/native-chat-types'
+import type { NativeChatSubagentState } from '../../shared/native-chat-types'
 import type {
   StructuredAgentSessionEventSink,
   StructuredAgentSessionSinkAdmission
@@ -40,6 +37,12 @@ import { readCodexTurnId } from './codex-structured-thread-facts'
 import { codexSubagentGroupBody } from './codex-subagent-group-body'
 import { CodexSubagentLinkage } from './codex-subagent-linkage'
 export { codexSubagentGroupBody } from './codex-subagent-group-body'
+export { codexSubagentGroupId, codexSubagentGroupIdentity } from './codex-subagent-roster-state'
+import {
+  codexSubagentGroupId,
+  codexSubagentGroupIdentity,
+  type RosterGroup
+} from './codex-subagent-roster-state'
 import type { CodexThreadItem } from './codex-structured-item-translation'
 import {
   MAX_CODEX_SUBAGENT_GROUPS,
@@ -49,38 +52,12 @@ import {
 
 const ADMITTED: StructuredAgentSessionSinkAdmission = { accepted: true }
 
-/** The turn a group belongs to when Codex reports activity outside any turn.
- *  Mirrors the generic-frame bucket name so the two read alike in the journal. */
-type RosterGroup = {
-  groupId: string
-  identity: AgentJournalItemIdentity
-  /** Insertion order is the display order; the map holds the state. */
-  entries: Map<string, NativeChatSubagentEntry>
-  executionTurns: Map<string, string | null>
-  /** Times each label has been claimed, so a repeat gets an ordinal suffix. */
-  labelCounts: Map<string, number>
-  /** Last body written, so an idempotent replay writes no new revision. */
-  lastSerialized: string | null
-}
-
-/** Group identity: the parent turn that spawned the children. `agentPath` is a
- *  tree rooted at the parent thread, so every child of one turn shares a row
- *  no matter which thread's stream carried its activity item. */
-export function codexSubagentGroupId(threadId: string, turnId: string | null): string {
-  return `${threadId}:${turnId ?? 'outside-turn'}`
-}
-
-/** Durable journal identity for the group's row — stable across revisions and
- *  across a restart, so replay finds the same row instead of appending a new one. */
-export function codexSubagentGroupIdentity(groupId: string): AgentJournalItemIdentity {
-  return { provider: 'orca', clientMessageId: `codex-subagents:${groupId}` }
-}
-
 export type CodexSubagentRosterDeps = {
   sink: StructuredAgentSessionEventSink
   /** The thread that owns the agent tree; falls back to the event's thread. */
   primaryThreadId: () => string | null
   activeTurn: (threadId: string) => string | null
+  turnScopeFor: (threadId: string, turnId: string | null) => AgentJournalTurnScope
   now?: () => number
   executions?: CodexSubagentExecutions
 }
@@ -280,6 +257,7 @@ export class CodexSubagentRoster {
     const group: RosterGroup = {
       groupId,
       identity: codexSubagentGroupIdentity(groupId),
+      turnScope: this.deps.turnScopeFor(ownerThreadId, ownerTurnId),
       entries: new Map(),
       executionTurns: new Map(),
       labelCounts: new Map(),
@@ -361,7 +339,10 @@ export class CodexSubagentRoster {
     // The publish must NOT reuse that key: the queue coalesces by key alone,
     // with no op-kind check, so a publish carrying it would splice out the
     // still-queued append and the row would never reach the journal.
-    const options = { coalescingKey: `codex-subagents:${group.groupId}` }
+    const options = {
+      coalescingKey: `codex-subagents:${group.groupId}`,
+      turnScope: group.turnScope
+    }
     const admission = this.deps.sink.tryAppendItem
       ? this.deps.sink.tryAppendItem(group.identity, body, options)
       : (this.deps.sink.appendItem(group.identity, body, options), ADMITTED)
diff --git a/src/main/codex/codex-trust-config-concurrent-launch.test.ts b/src/main/codex/codex-trust-config-concurrent-launch.test.ts
index d08d7a54969..0159ce608d9 100644
--- a/src/main/codex/codex-trust-config-concurrent-launch.test.ts
+++ b/src/main/codex/codex-trust-config-concurrent-launch.test.ts
@@ -25,6 +25,7 @@ const { CodexAppServerUnsupportedError } = await import('./codex-app-server-clie
 const { codexAppServerCapabilityCache } = await import('./codex-app-server-capability-cache')
 const { _internals, grantManagedCodexHookTrust } = await import('./codex-hook-trust-grant')
 const { markCodexProjectTrusted } = await import('../agent-trust-presets')
+const { getLocalCodexTrustConfigFiles } = await import('./codex-home-paths')
 const { setCodexTrustGrantTelemetry } = await import('./codex-trust-grant-telemetry')
 const {
   computeTrustKey,
@@ -207,7 +208,7 @@ describe('two Codex pane launches against one config.toml', () => {
       // Let the grant capture config.toml and start its session.
       await tick()
       await tick()
-      const marked = markCodexProjectTrusted(workspace)
+      const marked = markCodexProjectTrusted(workspace, getLocalCodexTrustConfigFiles())
       await tick()
       // The lane must hold the preset write back until rollback has run.
       expect(readFileSync(tomlPath, 'utf-8')).not.toContain('trust_level')
@@ -397,7 +398,7 @@ describe('reentrancy under concurrency', () => {
       // write nested inside both.
       const outcome = await runExclusivelyForCodexTrustConfig(tomlPath, () =>
         runExclusivelyForCodexTrustConfig(systemToml, async () => {
-          await markCodexProjectTrusted(workspace)
+          await markCodexProjectTrusted(workspace, getLocalCodexTrustConfigFiles())
           return grantManagedCodexHookTrust(buildPlan(entries))
         })
       )
diff --git a/src/main/codex/codex-trust-grant-main-thread-boundary.test.ts b/src/main/codex/codex-trust-grant-main-thread-boundary.test.ts
deleted file mode 100644
index 4b88d95991c..00000000000
--- a/src/main/codex/codex-trust-grant-main-thread-boundary.test.ts
+++ /dev/null
@@ -1,60 +0,0 @@
-import { existsSync, readFileSync, readdirSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-/**
- * Ratchet for stablyai/orca#16441.
- *
- * Codex hook trust used to be granted by blocking the Electron main thread on
- * `spawnSync` of a bundled ELECTRON_RUN_AS_NODE entry, for the whole
- * app-server deadline: 15s native, 35s WSL, ~45s on the three-session real-home
- * path. The window showed "Not Responding" during cold start and pane launch.
- *
- * The subprocess only ever existed to donate an event loop to a deliberately
- * blocked parent, so this guards the shape of the fix rather than one call
- * site: nothing on the trust-grant lane may start a child process
- * synchronously, and the forked entry must stay gone.
- */
-const CODEX_DIR = __dirname
-
-const SYNC_SPAWN_PATTERN = /\b(?:spawnSync|execSync|execFileSync|runProcessSync)\s*[(<]/
-
-/** Drop comments so the prose explaining the old idiom is not an offender. */
-function codeText(contents: string): string {
-  return contents
-    .split('\n')
-    .filter((line) => !/^\s*(?:\/\/|\/\*|\*)/.test(line))
-    .join('\n')
-}
-
-function listCodexSourceFiles(): string[] {
-  return readdirSync(CODEX_DIR).filter((name) => name.endsWith('.ts') && !name.endsWith('.test.ts'))
-}
-
-describe('codex trust grant main-thread boundary', () => {
-  it('starts no child process synchronously anywhere in the codex module', () => {
-    const offenders = listCodexSourceFiles().filter((name) =>
-      SYNC_SPAWN_PATTERN.test(codeText(readFileSync(join(CODEX_DIR, name), 'utf8')))
-    )
-    expect(offenders).toEqual([])
-  })
-
-  it('keeps the forked grant entry and its blocking bridge deleted', () => {
-    for (const name of [
-      'codex-app-server-grant-bridge.ts',
-      'codex-app-server-grant-entry.ts',
-      'codex-app-server-grant-envelope.ts'
-    ]) {
-      expect(existsSync(join(CODEX_DIR, name))).toBe(false)
-    }
-  })
-
-  it('keeps the trust-grant lane on async entry points', () => {
-    const grant = readFileSync(join(CODEX_DIR, 'codex-hook-trust-grant.ts'), 'utf8')
-    expect(grant).toContain('export async function grantManagedCodexHookTrust(')
-    const host = readFileSync(join(CODEX_DIR, 'codex-trust-grant-host.ts'), 'utf8')
-    expect(host).toContain('export async function resolveCodexTrustGrantHost(')
-    const realHome = readFileSync(join(CODEX_DIR, 'codex-real-home-hook-install.ts'), 'utf8')
-    expect(realHome).toContain('}): Promise<RealHomeCodexHookLane> {')
-  })
-})
diff --git a/src/main/codex/codex-turn-lifecycle-fake.ts b/src/main/codex/codex-turn-lifecycle-fake.ts
new file mode 100644
index 00000000000..4ed2507640b
--- /dev/null
+++ b/src/main/codex/codex-turn-lifecycle-fake.ts
@@ -0,0 +1,112 @@
+// Codex 0.157's turn bookkeeping as `turn/start` and `turn/interrupt` see it, for
+// tests. From app-server `turn_processor.rs`: `turn/start` picks the turn before it
+// answers, a send while a turn is open is steered into it under the same id with no
+// second `turn/started`, and `turn_interrupt_inner` refuses with -32600 until the
+// turn has started. The answer can be held, so a test can deliver it after the
+// turn's own frames, as the wire allows.
+
+import { CodexAppServerRequestError } from './codex-app-server-connection'
+
+type Notify = (method: string, params: unknown) => void
+
+export type CodexTurnLifecycleFake = {
+  routes: {
+    'turn/start': () => unknown
+    'turn/interrupt': (params: Record<string, unknown> | undefined) => unknown
+  }
+  /** The next `turn/start` answer waits until the returned release runs. */
+  holdNextAnswer: () => () => void
+  /** Codex emits `turn/started` for the turn it picked last. */
+  start: () => void
+  /** Codex ends the picked or running turn on its own. */
+  end: (status: 'completed' | 'interrupted' | 'failed', errorMessage?: string) => void
+  /** Codex echoes a user message it recorded in the current turn. */
+  echo: (clientId: string) => void
+  readonly turnId: string | null
+}
+
+function refusal(message: string): CodexAppServerRequestError {
+  return new CodexAppServerRequestError(
+    'turn/interrupt',
+    -32600,
+    `codex app-server turn/interrupt failed: ${message}`,
+    message
+  )
+}
+
+export function codexTurnLifecycleFake(
+  threadId: string,
+  notify: () => Notify
+): CodexTurnLifecycleFake {
+  let minted = 0
+  let echoes = 0
+  let picked: string | null = null
+  let active: string | null = null
+  let lastTurn: string | null = null
+  let held: Promise<void> | null = null
+  const finish = (turnId: string, status: string, errorMessage?: string): void => {
+    picked = null
+    active = null
+    notify()('turn/completed', {
+      threadId,
+      turn: { id: turnId, status, ...(errorMessage ? { error: { message: errorMessage } } : {}) }
+    })
+  }
+  return {
+    routes: {
+      'turn/start': () => {
+        const turnId = active ?? picked ?? `turn-${++minted}`
+        picked ??= active ? null : turnId
+        lastTurn = turnId
+        const answer = { turn: { id: turnId, status: 'inProgress' } }
+        const wait = held
+        held = null
+        return wait ? wait.then(() => answer) : answer
+      },
+      'turn/interrupt': (params) => {
+        const turnId = params?.turnId
+        if (!active) {
+          throw refusal('no active turn to interrupt')
+        }
+        if (active !== turnId) {
+          throw refusal(`expected active turn id ${String(turnId)} but found ${active}`)
+        }
+        // Codex answers the interrupt once the turn has aborted.
+        finish(active, 'interrupted')
+        return {}
+      }
+    },
+    holdNextAnswer: () => {
+      let release!: () => void
+      held = new Promise<void>((resolve) => {
+        release = resolve
+      })
+      return () => release()
+    },
+    start: () => {
+      if (!picked) {
+        throw new Error('no picked turn to start')
+      }
+      active = picked
+      notify()('turn/started', { threadId, turn: { id: active, status: 'inProgress' } })
+    },
+    end: (status, errorMessage) => {
+      const turnId = active ?? picked
+      if (!turnId) {
+        throw new Error('no turn to end')
+      }
+      finish(turnId, status, errorMessage)
+    },
+    echo: (clientId) => {
+      const turnId = active ?? picked ?? lastTurn
+      notify()('item/completed', {
+        threadId,
+        turn: { id: turnId },
+        item: { type: 'userMessage', id: `item-user-${++echoes}`, clientId, content: [] }
+      })
+    },
+    get turnId() {
+      return active ?? picked
+    }
+  }
+}
diff --git a/src/main/codex/config-settings-baseline.ts b/src/main/codex/config-settings-baseline.ts
index 5cc26e361b9..d6c44909ef8 100644
--- a/src/main/codex/config-settings-baseline.ts
+++ b/src/main/codex/config-settings-baseline.ts
@@ -21,6 +21,9 @@ export type CodexSettingsBaseline = {
    * table reads as an addition rather than as a canonical removal.
    */
   registrations: ReadonlyMap<string, ReadonlyMap<string, string>>
+  /** MCP server names the last mirror copied from the canonical source. */
+  mcpServers: ReadonlySet<string>
+  mcpServerRoot: boolean
 }
 
 type StoredSettingsBaseline = {
@@ -28,6 +31,8 @@ type StoredSettingsBaseline = {
   settings: Record<string, string | null>
   conflicts?: Record<string, CodexSettingsConflict>
   registrations?: Record<string, Record<string, string>>
+  mcpServers?: string[]
+  mcpServerRoot?: boolean
 }
 
 /**
@@ -81,7 +86,14 @@ function readParsedCodexSettingsBaseline(
         conflicts.set(key, conflict)
       }
     }
-    return { settings, conflicts, registrations: readStoredRegistrations(parsed.registrations) }
+    return {
+      settings,
+      conflicts,
+      registrations: readStoredRegistrations(parsed.registrations),
+      mcpServers: readStoredMcpServers(parsed.mcpServers),
+      // Older mirrors owned the whole MCP root; retain that removal policy for one pass.
+      mcpServerRoot: parsed.mcpServers === undefined || parsed.mcpServerRoot === true
+    }
   } catch (error) {
     // Why: invalid baseline state is still `null` — resetting it is the intent,
     // and only a read that FAILED must be preserved.
@@ -89,6 +101,10 @@ function readParsedCodexSettingsBaseline(
   }
 }
 
+function readStoredMcpServers(stored: string[] | undefined): ReadonlySet<string> {
+  return new Set((stored ?? []).filter((name): name is string => typeof name === 'string'))
+}
+
 function readStoredRegistrations(
   stored: Record<string, Record<string, string>> | undefined
 ): Map<string, ReadonlyMap<string, string>> {
@@ -124,7 +140,8 @@ export function writeCodexSettingsBaseline(
 ): void {
   const file: StoredSettingsBaseline = {
     version: 3,
-    settings: Object.fromEntries(baseline.settings)
+    settings: Object.fromEntries(baseline.settings),
+    mcpServers: [...baseline.mcpServers]
   }
   if (baseline.conflicts.size > 0) {
     file.conflicts = Object.fromEntries(baseline.conflicts)
@@ -134,6 +151,9 @@ export function writeCodexSettingsBaseline(
       [...baseline.registrations].map(([key, fields]) => [key, Object.fromEntries(fields)])
     )
   }
+  if (baseline.mcpServerRoot) {
+    file.mcpServerRoot = true
+  }
   const baselinePath = getCodexSettingsBaselinePath(runtimeHomePath)
   const serialized = `${JSON.stringify(file, null, 2)}\n`
   let existing: string | null = null
diff --git a/src/main/codex/config-settings-promotion.ts b/src/main/codex/config-settings-promotion.ts
index 52f4d6eefcd..56e499a6c18 100644
--- a/src/main/codex/config-settings-promotion.ts
+++ b/src/main/codex/config-settings-promotion.ts
@@ -37,6 +37,9 @@ export type CodexSettingsBaselineSnapshotOptions = {
    * mirrored would read a source config that never had them as a removal.
    */
   mirroredRegistrations?: boolean
+  /** Names copied from the canonical source in this mirror pass. */
+  mirroredMcpServers?: ReadonlySet<string>
+  mirroredMcpServerRoot?: boolean
 }
 
 /**
@@ -71,7 +74,9 @@ export function snapshotCodexRuntimeSettingsBaseline(
       conflicts,
       registrations: options.mirroredRegistrations
         ? readCodexRegistrationBaseline(runtimeConfig)
-        : new Map()
+        : new Map(),
+      mcpServers: options.mirroredMcpServers ?? new Set(),
+      mcpServerRoot: options.mirroredMcpServerRoot ?? false
     })
   } catch (error) {
     console.warn('[codex-settings-promotion] failed to snapshot settings baseline', error)
@@ -88,6 +93,9 @@ export type CodexSettingsPromotionHomes = {
 export type CodexSettingsPromotionPlan = {
   conflicts: ReadonlyMap<string, CodexSettingsConflict>
   runtimeValuesToPreserve: ReadonlyMap<string, string | null>
+  /** MCP names the previous mirror copied from the canonical source. */
+  mirroredMcpServers: ReadonlySet<string>
+  mirroredMcpServerRoot: boolean
 }
 
 function getHostPromotionHomes(): CodexSettingsPromotionHomes {
@@ -142,6 +150,8 @@ function promoteCodexRuntimeSettingsToSystemUnsafe(
     throw new Error('Codex settings baseline could not be read')
   }
   const baseline = baselineObservation.kind === 'present' ? baselineObservation.baseline : null
+  const mirroredMcpServers = baseline?.mcpServers ?? new Set<string>()
+  const mirroredMcpServerRoot = baseline?.mcpServerRoot ?? false
   const updates = new Map<string, string>()
   const conflicts = new Map<string, CodexSettingsConflict>()
   const runtimeValuesToPreserve = new Map<string, string | null>()
@@ -160,7 +170,7 @@ function promoteCodexRuntimeSettingsToSystemUnsafe(
   // canonical is an addition, never a removal it must honor. Scalars still need a
   // real baseline, so they stay gated above.
   if (updates.size === 0 && !hasCodexRegistrationEntries(runtimeTomlObservation.value)) {
-    return { conflicts, runtimeValuesToPreserve }
+    return { conflicts, runtimeValuesToPreserve, mirroredMcpServers, mirroredMcpServerRoot }
   }
   // Why: a fresh host has no ~/.codex; create it owner-only (holds auth.json) or the atomic write ENOENTs and the mirror wipes it.
   mkdirSync(systemHomePath, { recursive: true, mode: 0o700 })
@@ -202,17 +212,17 @@ function promoteCodexRuntimeSettingsToSystemUnsafe(
     )
   )
   if (nextContent === systemContent) {
-    return { conflicts, runtimeValuesToPreserve }
+    return { conflicts, runtimeValuesToPreserve, mirroredMcpServers, mirroredMcpServerRoot }
   }
   if (targetExists && parseWslUncPath(writeTarget.path)) {
     // Why: \\wsl$ 9P symlink metadata is unreliable; write through the existing file to preserve the WSL-side inode.
     writeFileSync(writeTarget.path, nextContent, 'utf-8')
-    return { conflicts, runtimeValuesToPreserve }
+    return { conflicts, runtimeValuesToPreserve, mirroredMcpServers, mirroredMcpServerRoot }
   }
   writeFileAtomically(writeTarget.path, nextContent, {
     mode: writeTarget.mode
   })
-  return { conflicts, runtimeValuesToPreserve }
+  return { conflicts, runtimeValuesToPreserve, mirroredMcpServers, mirroredMcpServerRoot }
 }
 
 type PromotionCollectionContext = {
@@ -264,7 +274,12 @@ function getComparableRaw(value: TopLevelSettingValue | undefined): string | nul
 }
 
 function emptyPromotionPlan(): CodexSettingsPromotionPlan {
-  return { conflicts: new Map(), runtimeValuesToPreserve: new Map() }
+  return {
+    conflicts: new Map(),
+    runtimeValuesToPreserve: new Map(),
+    mirroredMcpServers: new Set(),
+    mirroredMcpServerRoot: false
+  }
 }
 
 // Why: follow an existing dotfile-manager symlink and carry its mode forward so an atomic write can't widen a 0600 config.
diff --git a/src/main/codex/config-toml-line-scan.ts b/src/main/codex/config-toml-line-scan.ts
index 98d096167fe..0e983aac2dd 100644
--- a/src/main/codex/config-toml-line-scan.ts
+++ b/src/main/codex/config-toml-line-scan.ts
@@ -95,8 +95,18 @@ export function updateTomlLineScanState(state: TomlLineScanState, line: string):
 }
 
 export function getTomlTableHeader(line: string): string | null {
-  const match = /^(\s*\[\[?.+\]\]?\s*)(?:#.*)?$/.exec(line)
-  return match?.[1] ?? null
+  let index = 0
+  while (index < line.length && line[index] !== '#') {
+    if (line[index] === '"') {
+      index = skipTomlBasicString(line, index + 1)
+    } else if (line[index] === "'") {
+      index = skipTomlLiteralString(line, index + 1)
+    } else {
+      index++
+    }
+  }
+  const header = line.slice(0, index).trimEnd()
+  return /^\s*\[\[?.+\]\]?$/.test(header) ? header : null
 }
 
 export function parseTomlSingleLineStringValue(
diff --git a/src/main/codex/config-toml-mcp-servers.test.ts b/src/main/codex/config-toml-mcp-servers.test.ts
new file mode 100644
index 00000000000..e1d57770074
--- /dev/null
+++ b/src/main/codex/config-toml-mcp-servers.test.ts
@@ -0,0 +1,67 @@
+import { describe, expect, it } from 'vitest'
+import { readMcpServerTomlOwnership } from './config-toml-mcp-servers'
+import { getTomlTableHeader } from './config-toml-line-scan'
+
+describe('MCP server TOML ownership', () => {
+  it.each([
+    '[mcp_servers."server.with.dot"]\ncommand = "agent"',
+    '[mcp_servers]\n"server.with.dot" = { command = "agent" }',
+    'mcp_servers."server.with.dot".command = "agent"',
+    '[mcp_servers."server.with.dot".env]\nMODE = "fixture"',
+    '[mcp_servers."server.with.dot"] # see [docs]\ncommand = "agent"',
+    '[mcp_servers."server.with.dot"] # server\r\ncommand = "agent"\r\n',
+    '[[mcp_servers."server.with.dot"]] # array\r\ncommand = "agent"'
+  ])('recognizes the decoded server name in %s', (config) => {
+    expect(readMcpServerTomlOwnership(config)).toEqual({
+      names: new Set(['server.with.dot']),
+      ownsRoot: false
+    })
+  })
+
+  it('treats a root assignment as ownership of the whole closed table', () => {
+    expect(readMcpServerTomlOwnership('"mcp_servers" = { shared = { enabled = false } }')).toEqual({
+      names: new Set(),
+      ownsRoot: true
+    })
+  })
+
+  it.each([
+    '[profile] # comment\r\nmcp_servers = { foo = {} }\r\n',
+    '[profile] # see [docs]\nmcp_servers = { foo = {} }\n',
+    '[not valid]\nmcp_servers = { foo = {} }\n'
+  ])('does not treat a nested assignment as a canonical root in %s', (config) => {
+    expect(readMcpServerTomlOwnership(config)).toEqual({ names: new Set(), ownsRoot: false })
+  })
+
+  it('ignores apparent keys in strings, arrays and unrelated tables', () => {
+    const config = [
+      'description = """',
+      '[mcp_servers.fake]',
+      'mcp_servers = {}',
+      '"""',
+      'args = [',
+      '"mcp_servers.quoted = {}",',
+      ']',
+      '[profile]',
+      'mcp_servers = {}',
+      '[mcp_servers.real]',
+      'command = "agent"'
+    ].join('\n')
+    expect(readMcpServerTomlOwnership(config)).toEqual({
+      names: new Set(['real']),
+      ownsRoot: false
+    })
+  })
+})
+
+describe('commented TOML headers', () => {
+  it.each<[string, string | null]>([
+    ['[mcp_servers."name#with]bracket"] # see [docs]\r', '[mcp_servers."name#with]bracket"]'],
+    ['[[mcp_servers.name]] # comment\r', '[[mcp_servers.name]]'],
+    ["[mcp_servers.'literal#name'] # comment", "[mcp_servers.'literal#name']"],
+    ['# [mcp_servers.fake]', null],
+    ['command = "[mcp_servers.fake]"', null]
+  ])('recognizes the structural header in %s', (line, header) => {
+    expect(getTomlTableHeader(line)).toBe(header)
+  })
+})
diff --git a/src/main/codex/config-toml-mcp-servers.ts b/src/main/codex/config-toml-mcp-servers.ts
new file mode 100644
index 00000000000..12a492a7c88
--- /dev/null
+++ b/src/main/codex/config-toml-mcp-servers.ts
@@ -0,0 +1,42 @@
+import { parseTomlKeyPath, parseTomlTableHeaderPath } from './config-toml-key-path'
+import {
+  createTomlLineScanState,
+  getTomlTableHeader,
+  isTomlStructuralLine,
+  updateTomlLineScanState
+} from './config-toml-line-scan'
+
+/** Canonical inline root assignments own the whole table, which TOML forbids extending. */
+export function readMcpServerTomlOwnership(config: string): {
+  names: ReadonlySet<string>
+  ownsRoot: boolean
+} {
+  const names = new Set<string>()
+  let ownsRoot = false
+  let tablePath: string[] | null = []
+  let state = createTomlLineScanState()
+  for (const line of config.split('\n')) {
+    if (isTomlStructuralLine(state)) {
+      const header = getTomlTableHeader(line)
+      if (header) {
+        tablePath = parseTomlTableHeaderPath(header)?.segments ?? null
+        if (tablePath?.[0] === 'mcp_servers' && tablePath[1] !== undefined) {
+          names.add(tablePath[1])
+        }
+      } else {
+        const key = parseTomlKeyPath(line)
+        const path =
+          tablePath && key && line[key.end] === '=' ? [...tablePath, ...key.segments] : []
+        if (path[0] === 'mcp_servers') {
+          if (path[1] === undefined) {
+            ownsRoot = true
+          } else {
+            names.add(path[1])
+          }
+        }
+      }
+    }
+    state = updateTomlLineScanState(state, line)
+  }
+  return { names, ownsRoot }
+}
diff --git a/src/main/codex/config-toml-runtime-owned-sections.ts b/src/main/codex/config-toml-runtime-owned-sections.ts
index 0ff9ab19f6e..fee0cfdf643 100644
--- a/src/main/codex/config-toml-runtime-owned-sections.ts
+++ b/src/main/codex/config-toml-runtime-owned-sections.ts
@@ -5,6 +5,7 @@ import {
   isTomlStructuralLine,
   updateTomlLineScanState
 } from './config-toml-line-scan'
+import { parseTomlTableHeaderPath } from './config-toml-key-path'
 import {
   normalizeCodexProjectPathForLookup,
   normalizeCodexProjectPathForRevocationLookup,
@@ -91,6 +92,17 @@ export function isRuntimeProjectTomlSection(header: string): boolean {
   return parseCodexProjectHeaderPath(header) !== null
 }
 
+const CODEX_MCP_SERVER_TABLE_ROOT = 'mcp_servers'
+
+/** Returns the decoded MCP server name for an owner table or nested descendant. */
+export function getMcpServerTomlSectionName(header: string): string | null {
+  const table = parseTomlTableHeaderPath(header)
+  if (!table || table.isArray || table.segments[0] !== CODEX_MCP_SERVER_TABLE_ROOT) {
+    return null
+  }
+  return table.segments[1] ?? null
+}
+
 export function getTomlSectionHeaderKey(header: string): string {
   const projectPath = parseCodexProjectHeaderPath(header)
   return projectPath === null
diff --git a/src/main/codex/config-toml-trust-api-parity.test.ts b/src/main/codex/config-toml-trust-stale-writes.test.ts
similarity index 59%
rename from src/main/codex/config-toml-trust-api-parity.test.ts
rename to src/main/codex/config-toml-trust-stale-writes.test.ts
index d20cde89b8e..6a8fb8398de 100644
--- a/src/main/codex/config-toml-trust-api-parity.test.ts
+++ b/src/main/codex/config-toml-trust-stale-writes.test.ts
@@ -1,12 +1,6 @@
-import { afterEach, describe, expect, expectTypeOf, it } from 'vitest'
+import { afterEach, describe, expect, it } from 'vitest'
 import { chmodSync, readFileSync, readdirSync, statSync } from 'node:fs'
 import * as trustApi from './config-toml-trust'
-import type {
-  CodexEventLabel,
-  CodexHookTrustState,
-  CodexProjectTrustLevel,
-  CodexTrustEntry
-} from './config-toml-trust'
 import {
   createTrustConfigFixture,
   removeTrustConfigFixture
@@ -20,42 +14,6 @@ afterEach(() => {
   }
 })
 
-describe('config-toml-trust public API', () => {
-  it('retains the exact runtime export surface', () => {
-    expect(Object.keys(trustApi).sort()).toEqual(
-      [
-        'codexHookSourcePathsEqual',
-        'computeTrustKey',
-        'computeTrustedHash',
-        'escapeTomlString',
-        'getCodexExplicitHomeHookSourcePath',
-        'normalizeCodexHookSourcePath',
-        'normalizeCodexProjectPathForLookup',
-        'normalizeCodexProjectPathForRevocationLookup',
-        'normalizeHookTrustKeyForLookup',
-        'parseCodexProjectHeaderPath',
-        'parseTrustKey',
-        'readHookTrustEntries',
-        'readHookTrustEntriesFromContent',
-        'removeHookTrustEntries',
-        'removeHookTrustEntriesFromContent',
-        'upsertHookTrustEntries',
-        'upsertHookTrustEntriesInContent',
-        'upsertProjectTrustLevel',
-        'upsertProjectTrustLevelInContent',
-        'writeConfigAtomically'
-      ].sort()
-    )
-  })
-
-  it('retains the public type contracts', () => {
-    expectTypeOf<'stop' | 'session_start'>().toMatchTypeOf<CodexEventLabel>()
-    expectTypeOf<CodexProjectTrustLevel>().toEqualTypeOf<'trusted' | 'untrusted'>()
-    expectTypeOf<CodexTrustEntry>().toHaveProperty('sourcePath').toEqualTypeOf<string>()
-    expectTypeOf<CodexHookTrustState['enabled']>().toEqualTypeOf<boolean | undefined>()
-  })
-})
-
 describe('config.toml partial and stale writes', () => {
   it('preserves a truncated malformed prefix while appending trust', () => {
     const partial = ['model = "gpt-5"', '[mcp_servers.partial', 'command = "still-user-data'].join(
diff --git a/src/main/codex/hook-service-wsl-runtime.test.ts b/src/main/codex/hook-service-wsl-runtime.test.ts
index ba03d835231..c052ad2f158 100644
--- a/src/main/codex/hook-service-wsl-runtime.test.ts
+++ b/src/main/codex/hook-service-wsl-runtime.test.ts
@@ -29,17 +29,6 @@ type HooksConfig = {
   hooks: Record<string, { hooks?: { command?: string }[] }[]>
 }
 
-const managedEvents = [
-  'SessionStart',
-  'UserPromptSubmit',
-  'PreToolUse',
-  'PermissionRequest',
-  'PostToolUse',
-  'SubagentStart',
-  'SubagentStop',
-  'Stop'
-] as const
-
 let tempRoots: string[] = []
 
 afterEach(() => {
@@ -511,7 +500,6 @@ describe('Codex WSL runtime hook install', () => {
     expect((await _internals.installManagedHooksIntoWslRuntime(plan)).state).toBe('installed')
 
     const installed = JSON.parse(readFileSync(plan.configPath, 'utf-8')) as HooksConfig
-    expect(Object.keys(installed.hooks).sort()).toEqual([...managedEvents].sort())
     const managedCommand = installed.hooks.UserPromptSubmit[0]?.hooks?.[0]?.command
     expect(managedCommand).toBe(expectedManagedCommand(plan.commandScriptPath))
     expect(installed.hooks.UserPromptSubmit[1]?.hooks?.[0]?.command).toBe(userCommand)
diff --git a/src/main/crash-reporting/gpu-crash-diagnostics.test.ts b/src/main/crash-reporting/gpu-crash-diagnostics.test.ts
index 1982facd5f3..09c4d3d7658 100644
--- a/src/main/crash-reporting/gpu-crash-diagnostics.test.ts
+++ b/src/main/crash-reporting/gpu-crash-diagnostics.test.ts
@@ -1,5 +1,3 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
 import { describe, expect, it, vi } from 'vitest'
 import { buildGpuCrashDiagnostics, GpuCrashDiagnosticsRecorder } from './gpu-crash-diagnostics'
 
@@ -223,29 +221,3 @@ describe('GpuCrashDiagnosticsRecorder', () => {
     expect(recordBreadcrumb).toHaveBeenCalledWith({ gpuInfoLevel: 'unavailable' })
   })
 })
-
-describe('GPU crash diagnostics production wiring', () => {
-  it('starts diagnostics without delaying safe-graphics fallback', () => {
-    const source = readFileSync(
-      join(__dirname, '..', 'startup', 'main-process-preflight.ts'),
-      'utf8'
-    )
-    const listenerSource = readFileSync(
-      join(__dirname, '..', 'startup', 'main-process-ready-runtime.ts'),
-      'utf8'
-    )
-    const listenerStart = listenerSource.indexOf("  app.on('child-process-gone'")
-    expect(listenerStart).toBeGreaterThan(0)
-    const listener = listenerSource.slice(
-      listenerStart,
-      listenerSource.indexOf('\n  })', listenerStart)
-    )
-    expect(source).toMatch(
-      /recordBreadcrumb: \(data\) =>\s*recordDurableCrashBreadcrumb\('gpu_crash_hardware', data\)/
-    )
-    expect(listener).toMatch(
-      /const crashedAt = performance\.now\(\)[\s\S]*?void state\.gpuCrashDiagnostics\?\.record\(\)[\s\S]*?void handleGpuChildCrash\(details\.reason, details\.exitCode \?\? null, crashedAt\)/
-    )
-    expect(listener).not.toMatch(/state\.gpuCrashDiagnostics\?\.record\(\)[\s\S]*?\.then\(/)
-  })
-})
diff --git a/src/main/crash-reporting/gpu-crash-fallback-field-sessions.test.ts b/src/main/crash-reporting/gpu-crash-fallback-field-sessions.test.ts
index 43441250708..4454bc48457 100644
--- a/src/main/crash-reporting/gpu-crash-fallback-field-sessions.test.ts
+++ b/src/main/crash-reporting/gpu-crash-fallback-field-sessions.test.ts
@@ -1,55 +1,9 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
 import { describe, expect, it } from 'vitest'
 import {
   DEFAULT_GPU_CRASH_FALLBACK_THRESHOLD,
   DEFAULT_GPU_CRASH_FALLBACK_WINDOW_MS,
-  GpuCrashFallbackTracker,
-  isGpuFallbackCrashCandidate
+  GpuCrashFallbackTracker
 } from './gpu-crash-fallback-decision'
-import { shouldRecordProcessGoneCrash } from './process-gone-classification'
-
-/**
- * Replays the win32 GPU-child deaths from the 1.4.190 'crashed' renderer cluster
- * through the production decision path, so the reason no host was ever offered
- * Safe Graphics Mode is pinned rather than argued about.
- *
- * Each session below is one crash report's `Recent activity`; a breadcrumb's
- * `suppressedSinceLast=N` means N further identical GPU deaths were coalesced
- * into it, so the session saw N+1 GPU crashes.
- */
-
-type FieldSession = {
-  /** Crash-report id from the field bundle. */
-  report: string
-  /** GPU child crash times, ms since main-process start. */
-  gpuCrashesMsSinceLaunch: number[]
-}
-
-// crashed.txt: every win32 report in the cluster. Times are (breadcrumb ts -
-// mainProcessStartedAt); coalesced repeats are placed inside the same second,
-// which is the only interval the emitted breadcrumb pins them to.
-const CRASHED_CLUSTER_SESSIONS: FieldSession[] = [
-  // 23:36:54.200 - 23:36:49.931, suppressedSinceLast=1 -> 2 crashes
-  { report: 'db1f1ee2', gpuCrashesMsSinceLaunch: [4_269, 4_800] },
-  // 02:58:25.287 - 02:58:20.749, no suppression -> 1 crash
-  { report: '66cc54d8', gpuCrashesMsSinceLaunch: [4_538] },
-  // 21:47:05.776 - 21:46:59.584, suppressedSinceLast=1 -> 2 crashes
-  { report: '1f5564de', gpuCrashesMsSinceLaunch: [6_192, 6_240] },
-  // 00:17:17.840 - 00:17:15.732, no suppression -> 1 crash
-  { report: '96d8c63b', gpuCrashesMsSinceLaunch: [2_108] }
-]
-
-/** Ready-phase `child-process-gone` listener body — the wiring these claims rest on. */
-function readChildProcessGoneListener(): string {
-  const source = readFileSync(
-    join(__dirname, '..', 'startup', 'main-process-ready-runtime.ts'),
-    'utf8'
-  )
-  const start = source.indexOf("  app.on('child-process-gone'")
-  expect(start).toBeGreaterThan(0)
-  return source.slice(start, source.indexOf('\n  })', start))
-}
 
 function newTracker(): GpuCrashFallbackTracker {
   return new GpuCrashFallbackTracker({
@@ -58,73 +12,7 @@ function newTracker(): GpuCrashFallbackTracker {
   })
 }
 
-const FIELD_GPU_EVENT = {
-  source: 'child',
-  processType: 'GPU',
-  serviceName: 'GPU',
-  reason: 'crashed',
-  expectedTeardown: 'none'
-} as const
-
 describe('1.4.190 win32 GPU-child crash cluster', () => {
-  it('does not let process_gone_suppressed gate the fallback candidate check', () => {
-    // The GPU death is suppressed as recoverable churn (no user-facing report)...
-    expect(
-      shouldRecordProcessGoneCrash({
-        ...FIELD_GPU_EVENT,
-        platform: 'win32',
-        exitCode: -2147483645
-      })
-    ).toBe(false)
-    // ...but the fallback path reads the raw child-process-gone event, so the
-    // suppression cannot hide a broken driver from recovery.
-    expect(
-      isGpuFallbackCrashCandidate({
-        platform: 'win32',
-        processType: 'GPU',
-        reason: 'crashed'
-      })
-    ).toBe(true)
-    // Both assertions above still pass if the candidate check is moved behind the
-    // suppressed-report path, so pin that nothing branches ahead of it in index.ts.
-    const listener = readChildProcessGoneListener()
-    const guardStart = listener.indexOf('isGpuFallbackCrashCandidate(')
-    expect(guardStart).toBeGreaterThan(0)
-    expect(listener.slice(0, guardStart).match(/\bif\s*\(/g) ?? []).toHaveLength(1)
-    expect(listener).toMatch(
-      /isGpuFallbackCrashCandidate\([\s\S]*?state\.gpuCrashDiagnostics\?\.record\(\)[\s\S]*?handleGpuChildCrash\(/
-    )
-    // The `if (` count alone still allows `recorded && isGpuFallbackCrashCandidate(...)`, which
-    // re-couples recovery to the suppression decision, so pin the guard to that check alone.
-    const recoveryGuard = listener.slice(
-      listener.lastIndexOf('if (', guardStart),
-      listener.indexOf('handleGpuChildCrash(')
-    )
-    expect(recoveryGuard).not.toMatch(/&&|\|\|/)
-  })
-
-  it('never reaches the burst threshold in any observed cluster session', () => {
-    const outcomes = CRASHED_CLUSTER_SESSIONS.map((session) => {
-      // Each launch constructs a fresh tracker (src/main/index.ts), so evidence
-      // does not survive the relaunch these users performed after every crash.
-      const tracker = newTracker()
-      const engaged = session.gpuCrashesMsSinceLaunch.some(
-        (at) => tracker.recordGpuCrash(at).shouldEngageFallback
-      )
-      return {
-        report: session.report,
-        gpuCrashes: session.gpuCrashesMsSinceLaunch.length,
-        engagedSafeGraphicsPrompt: engaged
-      }
-    })
-    expect(outcomes).toEqual([
-      { report: 'db1f1ee2', gpuCrashes: 2, engagedSafeGraphicsPrompt: false },
-      { report: '66cc54d8', gpuCrashes: 1, engagedSafeGraphicsPrompt: false },
-      { report: '1f5564de', gpuCrashes: 2, engagedSafeGraphicsPrompt: false },
-      { report: '96d8c63b', gpuCrashes: 1, engagedSafeGraphicsPrompt: false }
-    ])
-  })
-
   it('engages on the session that did reach three crashes (field launch 51b9e93c)', () => {
     // oom.txt, win32: GPU crashed/exitCode=34 with suppressedSinceLast=2, then
     // `gpu_fallback_engaged (crashesInWindow=3)` and `gpu_fallback_restart_deferred`.
diff --git a/src/main/crash-reporting/gpu-fallback-recovered-launch.test.ts b/src/main/crash-reporting/gpu-fallback-recovered-launch.test.ts
index 23707754ff8..dd918ba9397 100644
--- a/src/main/crash-reporting/gpu-fallback-recovered-launch.test.ts
+++ b/src/main/crash-reporting/gpu-fallback-recovered-launch.test.ts
@@ -1,5 +1,3 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { showMessageBoxMock } = vi.hoisted(() => ({
@@ -105,22 +103,3 @@ describe('handleGpuFallbackRecoveredLaunch', () => {
     expect(handlers.restartWithHardware).not.toHaveBeenCalled()
   })
 })
-
-describe('recovered safe-graphics production wiring', () => {
-  it('prompts only after the recovered window is shown and persists both consent states', () => {
-    const windowSource = readFileSync(
-      join(__dirname, '..', 'startup', 'main-window-controller.ts'),
-      'utf8'
-    )
-    const lifecycleSource = readFileSync(
-      join(__dirname, '..', 'startup', 'gpu-lifecycle.ts'),
-      'utf8'
-    )
-    expect(windowSource).toMatch(
-      /window\.once\('show',[\s\S]*?presentGpuFallbackRecoveredLaunchPrompt\(window\)/
-    )
-    expect(lifecycleSource).toMatch(
-      /persistMarker:[\s\S]*?userConfirmed: false[\s\S]*?confirmMarker:[\s\S]*?userConfirmed: true/
-    )
-  })
-})
diff --git a/src/main/cursor-accounts/status.ts b/src/main/cursor-accounts/status.ts
new file mode 100644
index 00000000000..e2104c36c38
--- /dev/null
+++ b/src/main/cursor-accounts/status.ts
@@ -0,0 +1,32 @@
+import type { CursorAccountStatus } from '../../shared/rate-limit-types'
+import { readCursorAuthSession } from '../rate-limits/cursor-auth'
+import { isCursorSessionTokenExpired } from '../rate-limits/cursor-session-token'
+
+function signedOut(error: string | null): CursorAccountStatus {
+  return {
+    signedIn: false,
+    email: null,
+    displayName: null,
+    credentialSource: null,
+    planType: null,
+    tokenFresh: false,
+    error
+  }
+}
+
+export async function getCursorAccountStatus(): Promise<CursorAccountStatus> {
+  const readResult = await readCursorAuthSession()
+  if (readResult.status !== 'ok') {
+    return signedOut(readResult.status === 'error' ? readResult.error : null)
+  }
+  const session = readResult.session
+  return {
+    signedIn: true,
+    email: session.email,
+    displayName: session.displayName,
+    credentialSource: session.source,
+    planType: session.membershipType,
+    tokenFresh: !isCursorSessionTokenExpired(session.token),
+    error: null
+  }
+}
diff --git a/src/main/daemon/__fixtures__/freebuff-serialize-baseline.json b/src/main/daemon/__fixtures__/freebuff-serialize-baseline.json
new file mode 100644
index 00000000000..1f35b2abaa0
--- /dev/null
+++ b/src/main/daemon/__fixtures__/freebuff-serialize-baseline.json
@@ -0,0 +1,30 @@
+{
+  "freebuff-lifecycle": [
+    "none/false/2/31:22f0e3d90d75ceaf6fd95853c0b772074e441596caadcea8d133b64bad5db0f6",
+    "none/true/2/31:22f0e3d90d75ceaf6fd95853c0b772074e441596caadcea8d133b64bad5db0f6",
+    "shrink/false/1/29:b5d123b659e7cdd5a3d8c6031529a032d60311b1073e46717d2cbed8d46b6ba4",
+    "shrink/false/2/32:c3408d293abaa4e25303a4d1acf1ea2f096a35ff685e548f98aec777355d10a5",
+    "shrink/false/2/34:6c1dd1d115eb1c2af110cfa30ce84649b206ff48c76bcbcdfa31877d1b918140",
+    "shrink/true/1/29:b5d123b659e7cdd5a3d8c6031529a032d60311b1073e46717d2cbed8d46b6ba4",
+    "shrink/true/2/32:c3408d293abaa4e25303a4d1acf1ea2f096a35ff685e548f98aec777355d10a5",
+    "shrink/true/2/34:6c1dd1d115eb1c2af110cfa30ce84649b206ff48c76bcbcdfa31877d1b918140",
+    "shrink-grow/false/2/33:407f38549bb5be0a2545ba448d21940a201f1cca92e8117e42f3b30907d7d486",
+    "shrink-grow/true/2/33:407f38549bb5be0a2545ba448d21940a201f1cca92e8117e42f3b30907d7d486",
+    "jitter/false/2/34:adbbc27204f00658207075d10787b1ae8d929226d70a5321e029635193dc432b",
+    "jitter/true/2/34:adbbc27204f00658207075d10787b1ae8d929226d70a5321e029635193dc432b"
+  ],
+  "freebuff-login": [
+    "shrink-grow/false/1/21:92981723de5526414b99435b93b94ec87341b90acc7fea71b492e3ea6ae0d445",
+    "shrink-grow/false/1/23:92981723de5526414b99435b93b94ec87341b90acc7fea71b492e3ea6ae0d445",
+    "shrink-grow/false/2/33:f8c02c8afab034cc4fdcaa06b97764a32f6432d0c6d5f47b5f675fe6fd4cf67c",
+    "shrink-grow/true/1/21:44734d78cecaf5ae6203125b92dde9b61816b626efd6b643f78ce3f41c8b1b2d",
+    "shrink-grow/true/1/23:44734d78cecaf5ae6203125b92dde9b61816b626efd6b643f78ce3f41c8b1b2d",
+    "shrink-grow/true/2/33:f8c02c8afab034cc4fdcaa06b97764a32f6432d0c6d5f47b5f675fe6fd4cf67c",
+    "jitter/false/1/11:073b9a35e7a854d650d63f00dcc126f89656fab0f39951de83ff50fd564faab9",
+    "jitter/false/1/21:a046fe007dfe1161435083c3ed3448b4e74fa2203d692db99353b8df3c45f9a1",
+    "jitter/true/1/11:073b9a35e7a854d650d63f00dcc126f89656fab0f39951de83ff50fd564faab9",
+    "jitter/true/1/21:719241163ae1c3629c6a6e0739bb66324f620b8e285d176853d06d0ae26a6c00"
+  ],
+  "freebuff-ready": [],
+  "freebuff-trust": []
+}
diff --git a/src/main/daemon/daemon-entry.ts b/src/main/daemon/daemon-entry.ts
index 9f8d878eddb..8d409a9dc87 100644
--- a/src/main/daemon/daemon-entry.ts
+++ b/src/main/daemon/daemon-entry.ts
@@ -28,6 +28,7 @@ import { readCurrentDaemonReadyIdentity } from './daemon-ready-identity'
 import { publishDaemonPidFile } from './daemon-spawner'
 import { isNativePtyException } from './daemon-native-pty-exception'
 import { startDaemonScopeDeathWatch } from './daemon-scope-death-watch'
+import { isWindowsProcessTableAvailable } from '../windows/windows-process-table'
 
 export type ParsedDaemonArgs = {
   socketPath: string
@@ -334,6 +335,13 @@ async function main(): Promise<void> {
   daemonLog.log('ready')
 
   warmWindowsConptyOnce()
+  // Whether the addon loads is fixed for this process, and a detached daemon has
+  // no stderr, so the module's own warn cannot report it here. Both answers, so a
+  // bundle can tell "native" from "never asked" (#16905). Loading it now also pays
+  // the dlopen off the first teardown.
+  if (process.platform === 'win32') {
+    daemonLog.log('windows-process-table', { native: isWindowsProcessTableAvailable() })
+  }
 }
 
 // Only auto-run when executed directly (not imported for testing, or for the build guard's
diff --git a/src/main/daemon/daemon-foreground-confirmation-protocol.test.ts b/src/main/daemon/daemon-foreground-confirmation-protocol.test.ts
index 142d1706f9c..e0c4d5230ea 100644
--- a/src/main/daemon/daemon-foreground-confirmation-protocol.test.ts
+++ b/src/main/daemon/daemon-foreground-confirmation-protocol.test.ts
@@ -3,7 +3,7 @@ import { PREVIOUS_DAEMON_PROTOCOL_VERSIONS, PROTOCOL_VERSION } from './types'
 
 describe('foreground-confirmation daemon protocol', () => {
   it('rejects daemons from before the fresh-confirmation RPC', () => {
-    expect(PROTOCOL_VERSION).toBe(36)
+    expect(PROTOCOL_VERSION).toBe(37)
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(19)
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(22)
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(23)
@@ -19,5 +19,6 @@ describe('foreground-confirmation daemon protocol', () => {
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(33)
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(34)
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(35)
+    expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(36)
   })
 })
diff --git a/src/main/daemon/daemon-host-manifest.ts b/src/main/daemon/daemon-host-manifest.ts
new file mode 100644
index 00000000000..83d6d4984da
--- /dev/null
+++ b/src/main/daemon/daemon-host-manifest.ts
@@ -0,0 +1,162 @@
+import { cpSync, existsSync, mkdirSync } from 'node:fs'
+import { dirname, join, win32 as winPath } from 'node:path'
+
+// What the relocated host is made of: which files are mirrored, where each lands,
+// and which of a package's files are runtime rather than bulk. The lifecycle
+// around it -- when to materialize, what keeps a host valid, pruning -- is in
+// daemon-host-relocation.ts.
+
+/**
+ * The host exe keeps the app exe's own file name, so the relocated image is a byte-for-byte,
+ * name-included copy of a signed binary — nothing for EDR to read as a renamed image (MITRE T1036).
+ * Survival comes from the path (see daemon-host-relocation.ts). The one name-sensitive updater path is the
+ * no-PowerShell `taskkill /IM` fallback, where the daemon is killed and terminals cold-restore —
+ * the documented pre-relocation outcome, not a failure.
+ */
+export const daemonHostExeName = (execPath: string): string => winPath.basename(execPath)
+
+// V8 snapshots + ICU data the Electron bootstrap reads even under ELECTRON_RUN_AS_NODE; siblings of Orca.exe.
+const RUNTIME_DATA_FILES = ['icudtl.dat', 'snapshot_blob.bin', 'v8_context_snapshot.bin']
+
+/**
+ * Everything `require('@vscode/windows-process-tree')` walks, package-relative.
+ *
+ * One list, read three times: the copy plan mirrors the package containing them,
+ * materialization refuses to start without them, and a materialized host is only
+ * valid while it still has them. Keeping those three in one place is what stops
+ * "what we copy" and "what we accept" from drifting apart -- drift there means a
+ * host that is copied, published, refused, and copied again on every launch.
+ */
+export const WINDOWS_PROCESS_TREE_REQUIRED = [
+  'package.json',
+  'lib/index.js',
+  'build/Release/windows_process_tree.node'
+] as const
+
+export type CopyOp = {
+  sourcePath: string
+  /** Destination path relative to the host root, posix-separated. */
+  destRel: string
+  kind: 'file' | 'dir'
+  /** When true, a missing source is skipped rather than failing the copy. */
+  optional?: boolean
+  /** Per-source-path predicate for dir copies: return false to skip a path. */
+  filter?: (sourcePath: string) => boolean
+}
+
+export type DaemonHostSources = {
+  appDir: string
+  execPath: string
+  resourcesPath: string
+  entrySourcePath: string
+  entryRelPath: string
+  /** The addon's package; without it the daemon forks a shell per poll (#16905). */
+  windowsProcessTreeDir: string
+}
+
+/** A required file, a directory on the way to one, or anything in lib/ (index.js requires its siblings). */
+function isRuntimeProcessTreePath(packageRel: string): boolean {
+  return (
+    packageRel === '' ||
+    packageRel.startsWith('lib/') ||
+    WINDOWS_PROCESS_TREE_REQUIRED.some(
+      (required) => required === packageRel || required.startsWith(`${packageRel}/`)
+    )
+  )
+}
+
+// win32 path semantics so Windows paths decompose correctly off-win32 in cross-platform unit tests; production runs on win32 only.
+export function toPosixRelative(fromDir: string, absPath: string): string {
+  return winPath.relative(fromDir, absPath).split(winPath.sep).join('/')
+}
+
+export function destPath(root: string, destRel: string): string {
+  return join(root, ...destRel.split('/'))
+}
+
+// Drop node-pty's .pdb symbols and non-host-arch prebuilds (its bulk); keyed on host arch so a future win32-arm64 build keeps the prebuild it needs.
+const HOST_WIN_PREBUILD_DIR = `win32-${process.arch}`.toLowerCase()
+
+function isRuntimeNodePtyPath(sourcePath: string): boolean {
+  const p = sourcePath.toLowerCase()
+  if (p.endsWith('.pdb')) {
+    return false
+  }
+  // Keep only the host arch's win32 prebuild; drop any other win32-<arch> dir.
+  const prebuild = p.match(/prebuilds[\\/](win32-[^\\/]+)/)
+  return !prebuild || prebuild[1] === HOST_WIN_PREBUILD_DIR
+}
+
+/**
+ * The ordered copy plan. Every destRel mirrors the source's win-unpacked relative path so require()
+ * and node-pty's loader resolve the mirror identically to the packaged app. Pure so tests can assert layout.
+ */
+export function buildDaemonHostManifest(sources: DaemonHostSources): CopyOp[] {
+  const { appDir, execPath, resourcesPath, entrySourcePath, entryRelPath } = sources
+  const ops: CopyOp[] = []
+
+  // Host exe (verbatim name) + V8/ICU blobs at dest root. Top-level DLLs omitted: GPU/media libs a windowless run-as-node host never loads (~48MB saved).
+  ops.push({ sourcePath: execPath, destRel: daemonHostExeName(execPath), kind: 'file' })
+  for (const name of RUNTIME_DATA_FILES) {
+    ops.push({ sourcePath: join(appDir, name), destRel: name, kind: 'file', optional: true })
+  }
+
+  // Daemon bundle: entry + sibling chunks/ + out/package.json (CJS/ESM loader resolution), mirrored verbatim.
+  ops.push({ sourcePath: entrySourcePath, destRel: entryRelPath, kind: 'file' })
+  const chunksDir = join(winPath.dirname(entrySourcePath), 'chunks')
+  ops.push({
+    sourcePath: chunksDir,
+    destRel: toPosixRelative(appDir, chunksDir),
+    kind: 'dir',
+    optional: true
+  })
+  const pkgJson = join(resourcesPath, 'app.asar.unpacked', 'out', 'package.json')
+  ops.push({
+    sourcePath: pkgJson,
+    destRel: toPosixRelative(appDir, pkgJson),
+    kind: 'file',
+    optional: true
+  })
+
+  // @vscode/windows-process-tree, mirrored so the daemon's require() resolves it; without it every snapshot forks a powershell.exe (#16905).
+  // Filtered to the runtime files: the installed package is ~25MB of gyp intermediates (.obj/.pdb) around a ~150KB addon.
+  const { windowsProcessTreeDir } = sources
+  ops.push({
+    sourcePath: windowsProcessTreeDir,
+    destRel: toPosixRelative(appDir, windowsProcessTreeDir),
+    kind: 'dir',
+    filter: (sourcePath) =>
+      isRuntimeProcessTreePath(toPosixRelative(windowsProcessTreeDir, sourcePath))
+  })
+  // node-pty tree, mirrored so require('node-pty') resolves it; filtered to drop unused .pdb/other-arch prebuilds.
+  const nodePtyDir = join(resourcesPath, 'node_modules', 'node-pty')
+  ops.push({
+    sourcePath: nodePtyDir,
+    destRel: toPosixRelative(appDir, nodePtyDir),
+    kind: 'dir',
+    filter: isRuntimeNodePtyPath
+  })
+
+  return ops
+}
+
+export function executeManifest(ops: CopyOp[], stagingRoot: string): void {
+  for (const op of ops) {
+    if (!existsSync(op.sourcePath)) {
+      if (op.optional) {
+        continue
+      }
+      throw new Error(`daemon-host relocation: missing required input ${op.sourcePath}`)
+    }
+    const dest = destPath(stagingRoot, op.destRel)
+    mkdirSync(dirname(dest), { recursive: true })
+    const { filter } = op
+    // Dereference symlinks so the copy holds no link back into the install dir.
+    cpSync(op.sourcePath, dest, {
+      recursive: op.kind === 'dir',
+      dereference: true,
+      force: true,
+      ...(filter ? { filter: (src: string) => filter(src) } : {})
+    })
+  }
+}
diff --git a/src/main/daemon/daemon-host-relocation.test.ts b/src/main/daemon/daemon-host-relocation.test.ts
index e899a67ed43..7b81bdcfa1e 100644
--- a/src/main/daemon/daemon-host-relocation.test.ts
+++ b/src/main/daemon/daemon-host-relocation.test.ts
@@ -5,12 +5,14 @@ import {
   mkdtempSync,
   readFileSync,
   readdirSync,
+  realpathSync,
   renameSync,
   rmSync,
   utimesSync,
   writeFileSync
 } from 'node:fs'
 import os from 'node:os'
+import { createRequire } from 'node:module'
 import { basename, dirname, join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
@@ -37,8 +39,8 @@ function installHostApp(): void {
   } as AppEnvironment)
 }
 
+import { buildDaemonHostManifest } from './daemon-host-manifest'
 import {
-  buildDaemonHostManifest,
   collectPinnedDaemonVersions,
   getRelocatedDaemonHost,
   materializeRelocatedDaemonHost,
@@ -88,8 +90,35 @@ function buildInstallFixture(root: string): void {
     mkdirSync(join(prebuildsRoot, arch), { recursive: true })
     writeFileSync(join(prebuildsRoot, arch, 'pty.node'), `${arch}-prebuild`)
   }
+  const processTreeDir = join(root, 'resources', 'node_modules', '@vscode', 'windows-process-tree')
+  mkdirSync(join(processTreeDir, 'build', 'Release'), { recursive: true })
+  mkdirSync(join(processTreeDir, 'lib'), { recursive: true })
+  mkdirSync(join(processTreeDir, 'src'), { recursive: true })
+  writeFileSync(join(processTreeDir, 'package.json'), '{"main":"lib/index.js"}')
+  writeFileSync(join(processTreeDir, 'lib', 'index.js'), 'module.exports = {}')
+  writeFileSync(
+    join(processTreeDir, 'build', 'Release', 'windows_process_tree.node'),
+    'process-tree-native'
+  )
+  writeFileSync(join(processTreeDir, 'build', 'Release', 'windows_process_tree.pdb'), 'symbols')
+  writeFileSync(join(processTreeDir, 'src', 'process.cc'), 'source')
+  writeFileSync(join(processTreeDir, 'lib', 'promises.js'), 'require("./index")')
+  mkdirSync(join(processTreeDir, 'build', 'Release', 'obj'), { recursive: true })
+  writeFileSync(join(processTreeDir, 'build', 'Release', 'obj', 'addon.obj'), 'intermediate')
 }
 
+const PROCESS_TREE_DIR_REL = join('resources', 'node_modules', '@vscode', 'windows-process-tree')
+
+const PROCESS_TREE_ADDON_REL = join(
+  'resources',
+  'node_modules',
+  '@vscode',
+  'windows-process-tree',
+  'build',
+  'Release',
+  'windows_process_tree.node'
+)
+
 // The win32 prebuild dir the running host arch loads vs. the one that is pruned.
 const HOST_PREBUILD = `win32-${process.arch}`
 const OTHER_PREBUILD = HOST_PREBUILD === 'win32-arm64' ? 'win32-x64' : 'win32-arm64'
@@ -139,7 +168,8 @@ describe('buildDaemonHostManifest', () => {
       execPath: 'C:\\app\\Orca.exe',
       resourcesPath: 'C:\\app\\resources',
       entrySourcePath: 'C:\\app\\resources\\app.asar.unpacked\\out\\main\\daemon-entry.js',
-      entryRelPath: 'resources/app.asar.unpacked/out/main/daemon-entry.js'
+      entryRelPath: 'resources/app.asar.unpacked/out/main/daemon-entry.js',
+      windowsProcessTreeDir: 'C:\\app\\resources\\node_modules\\@vscode\\windows-process-tree'
     })
     const byDest = new Map(ops.map((op) => [op.destRel, op]))
     // The host exe keeps the source basename: a verbatim, signature-preserving copy with no
@@ -147,6 +177,9 @@ describe('buildDaemonHostManifest', () => {
     expect(byDest.get('Orca.exe')?.kind).toBe('file')
     const exeOp = ops.find((op) => op.sourcePath === 'C:\\app\\Orca.exe')
     expect(exeOp?.destRel).toBe('Orca.exe')
+    // Without this op the relocated daemon cannot resolve the native process
+    // table and falls back to a powershell.exe scan per snapshot (#16905).
+    expect(byDest.get('resources/node_modules/@vscode/windows-process-tree')?.kind).toBe('dir')
     // V8/ICU data blobs are read by the Electron bootstrap and kept.
     expect(byDest.has('icudtl.dat')).toBe(true)
     // GPU/graphics DLLs are never loaded by the windowless host, so not copied.
@@ -201,6 +234,34 @@ describe('materializeRelocatedDaemonHost', () => {
     const marker = JSON.parse(readFileSync(join(dest, '.materialized.json'), 'utf8'))
     expect(marker.version).toBe('9.9.9')
     expect(marker.entryRelPath).toBe('resources/app.asar.unpacked/out/main/daemon-entry.js')
+    // The whole package is mirrored, so require() finds every hop it walks.
+    const processTreeDest = join(
+      dest,
+      'resources',
+      'node_modules',
+      '@vscode',
+      'windows-process-tree'
+    )
+    expect(existsSync(join(processTreeDest, 'build', 'Release', 'windows_process_tree.node'))).toBe(
+      true
+    )
+    expect(existsSync(join(processTreeDest, 'lib', 'index.js'))).toBe(true)
+    expect(existsSync(join(processTreeDest, 'lib', 'promises.js'))).toBe(true)
+    // Build intermediates are ~25MB of the installed package; the loader never reads them.
+    expect(existsSync(join(processTreeDest, 'build', 'Release', 'windows_process_tree.pdb'))).toBe(
+      false
+    )
+    expect(existsSync(join(processTreeDest, 'build', 'Release', 'obj'))).toBe(false)
+    expect(existsSync(join(processTreeDest, 'src'))).toBe(false)
+    // The loader requires the BARE package, so resolution runs through the copied
+    // package.json's `main`. Asserting the .node subpath instead would still pass
+    // with package.json dropped from the filter, while the daemon's own require
+    // failed and it silently went back to the CIM scan.
+    expect(
+      createRequire(
+        join(dest, 'resources', 'app.asar.unpacked', 'out', 'main', 'chunks', 'a.js')
+      ).resolve('@vscode/windows-process-tree')
+    ).toBe(realpathSync(join(processTreeDest, 'lib', 'index.js')))
   })
 
   it('copies the exe verbatim: same file name and same bytes as the install-dir exe', () => {
@@ -225,6 +286,71 @@ describe('materializeRelocatedDaemonHost', () => {
     expect(getRelocatedDaemonHost()?.execPath).toBe(join(dest, 'Orca Nightly.exe'))
   })
 
+  it.each([
+    ['the binary', PROCESS_TREE_ADDON_REL],
+    ['package.json', join(PROCESS_TREE_DIR_REL, 'package.json')],
+    ['lib/index.js', join(PROCESS_TREE_DIR_REL, 'lib', 'index.js')]
+  ])('refuses a mirror that lost %s', (_label, relativePath) => {
+    // Any one of them missing means require() cannot reach the addon, and a host
+    // that cannot load it runs anyway -- forking a shell per snapshot (#16905).
+    materializeRelocatedDaemonHost()
+    const dest = join(localAppDataDir, 'Orca', 'daemon-host', '9.9.9')
+    expect(getRelocatedDaemonHost()).not.toBeNull()
+
+    rmSync(join(dest, relativePath))
+
+    expect(getRelocatedDaemonHost()).toBeNull()
+  })
+
+  it('rematerializes a host whose copied addon went missing', () => {
+    materializeRelocatedDaemonHost()
+    const dest = join(localAppDataDir, 'Orca', 'daemon-host', '9.9.9')
+    const relocatedAddon = join(dest, PROCESS_TREE_ADDON_REL)
+
+    rmSync(relocatedAddon)
+    // A sentinel proves the host was rebuilt rather than reused.
+    const sentinel = join(dest, 'sentinel.txt')
+    writeFileSync(sentinel, 'remove')
+
+    expect(materializeRelocatedDaemonHost()).not.toBeNull()
+    expect(readFileSync(relocatedAddon, 'utf8')).toBe('process-tree-native')
+    expect(existsSync(sentinel)).toBe(false)
+  })
+
+  it('does not read the install dir to decide an existing host is still good', () => {
+    // Relocation exists to outlive the install dir, so validity cannot depend on
+    // it: an updater mid-copy would otherwise condemn an intact host. A real
+    // upgrade changes the version keying this directory, which already forces a
+    // rebuild, and nothing else in the mirror is source-verified either.
+    materializeRelocatedDaemonHost()
+    const dest = join(localAppDataDir, 'Orca', 'daemon-host', '9.9.9')
+    const sentinel = join(dest, 'sentinel.txt')
+    writeFileSync(sentinel, 'keep')
+
+    rmSync(join(installDir, 'resources', 'node_modules', '@vscode'), {
+      recursive: true,
+      force: true
+    })
+
+    expect(getRelocatedDaemonHost()).not.toBeNull()
+    expect(existsSync(sentinel)).toBe(true)
+  })
+
+  it.each([
+    ['the binary', PROCESS_TREE_ADDON_REL],
+    ['package.json', join(PROCESS_TREE_DIR_REL, 'package.json')],
+    ['lib/index.js', join(PROCESS_TREE_DIR_REL, 'lib', 'index.js')]
+  ])('refuses to copy anything when the install lost %s', (_label, relativePath) => {
+    // Each of these would be accepted by the copy plan and then refused by the
+    // mirror check, which is a ~260MB copy per launch to reach a verdict the
+    // source could have given for free. Sharing one list is what prevents that.
+    rmSync(join(installDir, relativePath))
+
+    expect(materializeRelocatedDaemonHost()).toBeNull()
+    // Not even the host root: the source is checked before any directory is made.
+    expect(existsSync(join(localAppDataDir, 'Orca', 'daemon-host'))).toBe(false)
+  })
+
   it('is idempotent: a valid marker short-circuits without recopying', () => {
     materializeRelocatedDaemonHost()
     const dest = join(localAppDataDir, 'Orca', 'daemon-host', '9.9.9')
@@ -278,6 +404,13 @@ describe('getRelocatedDaemonHost', () => {
       join(dest, 'resources', 'app.asar.unpacked', 'out', 'main', 'daemon-entry.js'),
       'e'
     )
+    // The process-table files too, or this passes because the mirror has no addon
+    // and never exercises the version comparison it is named for.
+    mkdirSync(join(dest, PROCESS_TREE_DIR_REL, 'lib'), { recursive: true })
+    mkdirSync(dirname(join(dest, PROCESS_TREE_ADDON_REL)), { recursive: true })
+    writeFileSync(join(dest, PROCESS_TREE_DIR_REL, 'package.json'), '{}')
+    writeFileSync(join(dest, PROCESS_TREE_DIR_REL, 'lib', 'index.js'), 'm')
+    writeFileSync(join(dest, PROCESS_TREE_ADDON_REL), 'n')
     writeFileSync(
       join(dest, '.materialized.json'),
       JSON.stringify({
diff --git a/src/main/daemon/daemon-host-relocation.ts b/src/main/daemon/daemon-host-relocation.ts
index 13aab9fd8f9..51fed83530a 100644
--- a/src/main/daemon/daemon-host-relocation.ts
+++ b/src/main/daemon/daemon-host-relocation.ts
@@ -1,6 +1,5 @@
 import { randomBytes } from 'node:crypto'
 import {
-  cpSync,
   existsSync,
   mkdirSync,
   readFileSync,
@@ -9,8 +8,17 @@ import {
   rmSync,
   writeFileSync
 } from 'node:fs'
-import { dirname, join, win32 as winPath } from 'node:path'
+import { join, win32 as winPath } from 'node:path'
 import { getAppEnvironment } from '../../shared/app-environment'
+import {
+  buildDaemonHostManifest,
+  daemonHostExeName,
+  destPath,
+  executeManifest,
+  toPosixRelative,
+  WINDOWS_PROCESS_TREE_REQUIRED,
+  type DaemonHostSources
+} from './daemon-host-manifest'
 import type { ProcessLivenessVerdict } from './daemon-incarnation-evidence-types'
 import { parseDaemonPidFile } from './daemon-pid-file-parse'
 import { quarantineCorruptDaemonPidRecord } from './daemon-pid-record-quarantine'
@@ -41,52 +49,12 @@ const MARKER_NAME = '.materialized.json'
 // LOCAL appData (not roaming) so OneDrive/roaming never syncs this ~260MB runtime. Shared with NSIS uninstall (config/nsis/orca-installer-hooks.nsh) — keep in sync.
 const LOCAL_HOST_ROOT_NAME = 'Orca'
 
-/**
- * The host exe keeps the app exe's own file name, so the relocated image is a byte-for-byte,
- * name-included copy of a signed binary — nothing for EDR to read as a renamed image (MITRE T1036).
- * Survival comes from the path (see the module header). The one name-sensitive updater path is the
- * no-PowerShell `taskkill /IM` fallback, where the daemon is killed and terminals cold-restore —
- * the documented pre-relocation outcome, not a failure.
- */
-const daemonHostExeName = (execPath: string): string => winPath.basename(execPath)
-
-// V8 snapshots + ICU data the Electron bootstrap reads even under ELECTRON_RUN_AS_NODE; siblings of Orca.exe.
-const RUNTIME_DATA_FILES = ['icudtl.dat', 'snapshot_blob.bin', 'v8_context_snapshot.bin']
-
-type CopyOp = {
-  sourcePath: string
-  /** Destination path relative to the host root, posix-separated. */
-  destRel: string
-  kind: 'file' | 'dir'
-  /** When true, a missing source is skipped rather than failing the copy. */
-  optional?: boolean
-  /** Per-source-path predicate for dir copies: return false to skip a path. */
-  filter?: (sourcePath: string) => boolean
-}
-
-type DaemonHostSources = {
-  appDir: string
-  execPath: string
-  resourcesPath: string
-  entrySourcePath: string
-  entryRelPath: string
-}
-
 type MaterializeMarker = {
   version: string
   completedAt: string
   entryRelPath: string
 }
 
-// win32 path semantics so Windows paths decompose correctly off-win32 in cross-platform unit tests; production runs on win32 only.
-function toPosixRelative(fromDir: string, absPath: string): string {
-  return winPath.relative(fromDir, absPath).split(winPath.sep).join('/')
-}
-
-function destPath(root: string, destRel: string): string {
-  return join(root, ...destRel.split('/'))
-}
-
 // Mirror getDaemonEntryPath()'s resolution order so the copied entry is the exact file the in-dir fork would run.
 function resolveEntrySourcePath(resourcesPath: string): string {
   const unpackedRoot = join(resourcesPath, 'app.asar.unpacked')
@@ -132,83 +100,8 @@ function collectDaemonHostSources(): DaemonHostSources | null {
     execPath,
     resourcesPath,
     entrySourcePath,
-    entryRelPath: toPosixRelative(appDir, entrySourcePath)
-  }
-}
-
-// Drop node-pty's .pdb symbols and non-host-arch prebuilds (its bulk); keyed on host arch so a future win32-arm64 build keeps the prebuild it needs.
-const HOST_WIN_PREBUILD_DIR = `win32-${process.arch}`.toLowerCase()
-function isRuntimeNodePtyPath(sourcePath: string): boolean {
-  const p = sourcePath.toLowerCase()
-  if (p.endsWith('.pdb')) {
-    return false
-  }
-  // Keep only the host arch's win32 prebuild; drop any other win32-<arch> dir.
-  const prebuild = p.match(/prebuilds[\\/](win32-[^\\/]+)/)
-  return !prebuild || prebuild[1] === HOST_WIN_PREBUILD_DIR
-}
-
-/**
- * The ordered copy plan. Every destRel mirrors the source's win-unpacked relative path so require()
- * and node-pty's loader resolve the mirror identically to the packaged app. Pure so tests can assert layout.
- */
-export function buildDaemonHostManifest(sources: DaemonHostSources): CopyOp[] {
-  const { appDir, execPath, resourcesPath, entrySourcePath, entryRelPath } = sources
-  const ops: CopyOp[] = []
-
-  // Host exe (verbatim name) + V8/ICU blobs at dest root. Top-level DLLs omitted: GPU/media libs a windowless run-as-node host never loads (~48MB saved).
-  ops.push({ sourcePath: execPath, destRel: daemonHostExeName(execPath), kind: 'file' })
-  for (const name of RUNTIME_DATA_FILES) {
-    ops.push({ sourcePath: join(appDir, name), destRel: name, kind: 'file', optional: true })
-  }
-
-  // Daemon bundle: entry + sibling chunks/ + out/package.json (CJS/ESM loader resolution), mirrored verbatim.
-  ops.push({ sourcePath: entrySourcePath, destRel: entryRelPath, kind: 'file' })
-  const chunksDir = join(winPath.dirname(entrySourcePath), 'chunks')
-  ops.push({
-    sourcePath: chunksDir,
-    destRel: toPosixRelative(appDir, chunksDir),
-    kind: 'dir',
-    optional: true
-  })
-  const pkgJson = join(resourcesPath, 'app.asar.unpacked', 'out', 'package.json')
-  ops.push({
-    sourcePath: pkgJson,
-    destRel: toPosixRelative(appDir, pkgJson),
-    kind: 'file',
-    optional: true
-  })
-
-  // node-pty tree, mirrored so require('node-pty') resolves it; filtered to drop unused .pdb/other-arch prebuilds.
-  const nodePtyDir = join(resourcesPath, 'node_modules', 'node-pty')
-  ops.push({
-    sourcePath: nodePtyDir,
-    destRel: toPosixRelative(appDir, nodePtyDir),
-    kind: 'dir',
-    filter: isRuntimeNodePtyPath
-  })
-
-  return ops
-}
-
-function executeManifest(ops: CopyOp[], stagingRoot: string): void {
-  for (const op of ops) {
-    if (!existsSync(op.sourcePath)) {
-      if (op.optional) {
-        continue
-      }
-      throw new Error(`daemon-host relocation: missing required input ${op.sourcePath}`)
-    }
-    const dest = destPath(stagingRoot, op.destRel)
-    mkdirSync(dirname(dest), { recursive: true })
-    const { filter } = op
-    // Dereference symlinks so the copy holds no link back into the install dir.
-    cpSync(op.sourcePath, dest, {
-      recursive: op.kind === 'dir',
-      dereference: true,
-      force: true,
-      ...(filter ? { filter: (src: string) => filter(src) } : {})
-    })
+    entryRelPath: toPosixRelative(appDir, entrySourcePath),
+    windowsProcessTreeDir: join(resourcesPath, 'node_modules', '@vscode', 'windows-process-tree')
   }
 }
 
@@ -230,6 +123,17 @@ function readMarker(dir: string): MaterializeMarker | null {
   return null
 }
 
+function processTreeRelDir(sources: DaemonHostSources): string {
+  return toPosixRelative(sources.appDir, sources.windowsProcessTreeDir)
+}
+
+/** True when any file require() needs is absent from a copy of the package. */
+function missingProcessTreeFiles(packageDir: string): boolean {
+  return WINDOWS_PROCESS_TREE_REQUIRED.some(
+    (relative) => !existsSync(join(packageDir, ...relative.split('/')))
+  )
+}
+
 function hostRootDir(): string {
   // Prefer LOCAL appData (see LOCAL_HOST_ROOT_NAME); fall back to userData only if LOCALAPPDATA is unset.
   const localAppData = process.env.LOCALAPPDATA
@@ -260,6 +164,13 @@ export function getRelocatedDaemonHost(): RelocatedDaemonHost | null {
   if (!existsSync(execPath) || !existsSync(entryPath)) {
     return null
   }
+  // A mirror the daemon cannot load the addon from still runs -- it just forks a
+  // shell per snapshot (#16905) -- so treat it as unmaterialized and rebuild. Hosts
+  // from before this shipped have none of these files. Checked in the mirror, never
+  // in the install dir, which is the thing relocation exists to outlive.
+  if (missingProcessTreeFiles(destPath(dest, processTreeRelDir(sources)))) {
+    return null
+  }
   return { execPath, entryPath }
 }
 
@@ -276,6 +187,12 @@ export function materializeRelocatedDaemonHost(): RelocatedDaemonHost | null {
   if (!sources) {
     return null
   }
+  // Checked against the source before copying: the mirror check below would refuse
+  // the result anyway, and re-copying ~260MB on every launch to reach that verdict
+  // is the loop this shares its list with the copy plan to prevent.
+  if (missingProcessTreeFiles(sources.windowsProcessTreeDir)) {
+    return null
+  }
   const version = getAppEnvironment().getVersion()
   const root = hostRootDir()
   const dest = join(root, version)
diff --git a/src/main/daemon/daemon-launch-paths.ts b/src/main/daemon/daemon-launch-paths.ts
index 049800daff4..532bc75c574 100644
--- a/src/main/daemon/daemon-launch-paths.ts
+++ b/src/main/daemon/daemon-launch-paths.ts
@@ -60,7 +60,10 @@ export function probeDaemonSocket(
   socketPath: string,
   timeoutMs = DAEMON_SOCKET_PROBE_TIMEOUT_MS
 ): Promise<boolean> {
-  const { promise, resolve } = Promise.withResolvers<boolean>()
+  let resolve!: (alive: boolean) => void
+  const promise = new Promise<boolean>((settle) => {
+    resolve = settle
+  })
   if (process.platform !== 'win32' && !existsSync(socketPath)) {
     resolve(false)
     return promise
diff --git a/src/main/daemon/daemon-process-identity-query.ts b/src/main/daemon/daemon-process-identity-query.ts
index 479aa821ecf..d4eee6b1b84 100644
--- a/src/main/daemon/daemon-process-identity-query.ts
+++ b/src/main/daemon/daemon-process-identity-query.ts
@@ -16,22 +16,26 @@ export type PsProcessIdentity = {
   startedAtMs: number | null
 }
 
-function parsePsProcessIdentity(output: string): PsProcessIdentity {
+function parsePsProcessIdentity(output: string, utc = false): PsProcessIdentity {
   // BSD ps formats lstart as a fixed-width 24-character timestamp.
-  const startedAtMs = Date.parse(output.slice(0, 24))
+  const startedAtMs = Date.parse(output.slice(0, 24) + (utc ? ' UTC' : ''))
   return {
     commandLine: output.slice(24).trim(),
     startedAtMs: Number.isFinite(startedAtMs) ? startedAtMs : null
   }
 }
 
-export function getPsProcessIdentity(pid: number): PsProcessIdentity | null {
+export function getPsProcessIdentity(
+  pid: number,
+  options?: { utc?: boolean }
+): PsProcessIdentity | null {
   try {
     const output = execFileSync('ps', ['-p', String(pid), '-o', 'lstart=', '-o', 'command='], {
       encoding: 'utf8',
-      timeout: 2_000
+      timeout: 2_000,
+      ...(options?.utc ? { env: { ...process.env, TZ: 'UTC', LC_ALL: 'C' } } : {})
     })
-    return parsePsProcessIdentity(output)
+    return parsePsProcessIdentity(output, options?.utc)
   } catch {
     return null
   }
diff --git a/src/main/daemon/daemon-process-identity-time-zone.test.ts b/src/main/daemon/daemon-process-identity-time-zone.test.ts
new file mode 100644
index 00000000000..aee3e4f4420
--- /dev/null
+++ b/src/main/daemon/daemon-process-identity-time-zone.test.ts
@@ -0,0 +1,32 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import { getPsProcessIdentity } from './daemon-process-identity-query'
+
+const { execFileSync } = vi.hoisted(() => ({ execFileSync: vi.fn() }))
+vi.mock('node:child_process', () => ({ execFileSync, execFile: vi.fn() }))
+
+afterEach(() => {
+  vi.unstubAllEnvs()
+  vi.clearAllMocks()
+})
+
+it.each(['America/Los_Angeles', 'America/New_York', 'UTC'])(
+  'keeps the autumn clock transition unambiguous under %s',
+  (timezone) => {
+    vi.stubEnv('TZ', timezone)
+    execFileSync.mockReturnValue('Sun Nov  1 09:30:00 2026 /path/to/orca\n')
+    expect(getPsProcessIdentity(42, { utc: true })).toEqual({
+      startedAtMs: Date.parse('2026-11-01T09:30:00Z'),
+      commandLine: '/path/to/orca'
+    })
+    expect(execFileSync).toHaveBeenCalledWith(
+      'ps',
+      ['-p', '42', '-o', 'lstart=', '-o', 'command='],
+      expect.objectContaining({ env: expect.objectContaining({ TZ: 'UTC', LC_ALL: 'C' }) })
+    )
+  }
+)
+
+it('treats an unreadable UTC process start as unknown', () => {
+  execFileSync.mockReturnValue('                        /path/to/orca\n')
+  expect(getPsProcessIdentity(42, { utc: true })?.startedAtMs).toBeNull()
+})
diff --git a/src/main/daemon/daemon-protocol-version.test.ts b/src/main/daemon/daemon-protocol-version.test.ts
index dfe84947ff5..b909c4c8fc8 100644
--- a/src/main/daemon/daemon-protocol-version.test.ts
+++ b/src/main/daemon/daemon-protocol-version.test.ts
@@ -3,6 +3,7 @@ import {
   AGENT_SESSION_CLAIM_DAEMON_PROTOCOL_VERSION,
   AGENT_SESSION_CREATE_OPERATION_DAEMON_PROTOCOL_VERSION,
   ASYNC_CWD_VALIDATION_DAEMON_PROTOCOL_VERSION,
+  CODEX_NO_DAEMON_SHELL_LAUNCH_DAEMON_PROTOCOL_VERSION,
   CODEX_SHELL_LAUNCH_PREFLIGHT_DAEMON_PROTOCOL_VERSION,
   COMPLETION_PROCESS_INSPECTION_PROTOCOL_VERSION,
   CONTENT_ADDRESSED_SHELL_WRAPPER_DAEMON_PROTOCOL_VERSION,
@@ -19,7 +20,8 @@ import {
 
 describe('daemon protocol version', () => {
   it('ships bounded history transfer after the 2031-unsubscribe fact', () => {
-    expect(PROTOCOL_VERSION).toBe(36)
+    expect(PROTOCOL_VERSION).toBe(37)
+    expect(CODEX_NO_DAEMON_SHELL_LAUNCH_DAEMON_PROTOCOL_VERSION).toBe(37)
     expect(CONTENT_ADDRESSED_SHELL_WRAPPER_DAEMON_PROTOCOL_VERSION).toBe(36)
     expect(ASYNC_CWD_VALIDATION_DAEMON_PROTOCOL_VERSION).toBe(35)
     expect(CODEX_SHELL_LAUNCH_PREFLIGHT_DAEMON_PROTOCOL_VERSION).toBe(34)
@@ -33,7 +35,7 @@ describe('daemon protocol version', () => {
     expect(AGENT_SESSION_CLAIM_DAEMON_PROTOCOL_VERSION).toBe(26)
     expect(AGENT_SESSION_CREATE_OPERATION_DAEMON_PROTOCOL_VERSION).toBe(26)
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toEqual(
-      Array.from({ length: 35 }, (_, index) => index + 1)
+      Array.from({ length: 36 }, (_, index) => index + 1)
     )
   })
 
diff --git a/src/main/daemon/daemon-protocol-version.ts b/src/main/daemon/daemon-protocol-version.ts
index bae2ae972dc..9c0ed0128fc 100644
--- a/src/main/daemon/daemon-protocol-version.ts
+++ b/src/main/daemon/daemon-protocol-version.ts
@@ -1,6 +1,7 @@
 // Why: daemons survive app updates, so wire behavior must be version-gated.
-// v36 launches shells from content-addressed wrapper trees; older owners stay attachable.
-export const PROTOCOL_VERSION = 36
+// v37 runs Codex without the shared background server at the shell launch boundary; older owners stay attachable.
+export const PROTOCOL_VERSION = 37
+export const CODEX_NO_DAEMON_SHELL_LAUNCH_DAEMON_PROTOCOL_VERSION = 37
 export const CONTENT_ADDRESSED_SHELL_WRAPPER_DAEMON_PROTOCOL_VERSION = 36
 export const ASYNC_CWD_VALIDATION_DAEMON_PROTOCOL_VERSION = 35
 export const CODEX_SHELL_LAUNCH_PREFLIGHT_DAEMON_PROTOCOL_VERSION = 34
@@ -30,7 +31,7 @@ export const CLEAN_DISCONNECT_PROTOCOL_VERSION = 24
 export const MODE_2031_UNSUBSCRIBE_FACT_PROTOCOL_VERSION = 29
 export const PREVIOUS_DAEMON_PROTOCOL_VERSIONS = [
   1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27,
-  28, 29, 30, 31, 32, 33, 34, 35
+  28, 29, 30, 31, 32, 33, 34, 35, 36
 ] as const
 
 export function supportsPtyStartupIngress(protocolVersion: number): boolean {
diff --git a/src/main/daemon/daemon-pty-buffer-snapshots.ts b/src/main/daemon/daemon-pty-buffer-snapshots.ts
index f640483a39f..0bfb6cd44c9 100644
--- a/src/main/daemon/daemon-pty-buffer-snapshots.ts
+++ b/src/main/daemon/daemon-pty-buffer-snapshots.ts
@@ -184,6 +184,11 @@ export abstract class DaemonPtyBufferSnapshots extends DaemonPtySessionControl {
     this.markSessionDirty(id)
   }
 
+  async resetInputModes(id: string): Promise<void> {
+    await this.client.request('resetInputModes', { sessionId: id })
+    this.markSessionDirty(id)
+  }
+
   acknowledgeDataEvent(_id: string, _charCount: number): void {
     // No flow control for daemon-backed terminals
   }
diff --git a/src/main/daemon/daemon-pty-router.ts b/src/main/daemon/daemon-pty-router.ts
index 2fbfd17a039..c3330e61826 100644
--- a/src/main/daemon/daemon-pty-router.ts
+++ b/src/main/daemon/daemon-pty-router.ts
@@ -162,6 +162,10 @@ export class DaemonPtyRouter implements IPtyProvider {
     await this.adapterFor(id).clearBuffer(id)
   }
 
+  async resetInputModes(id: string): Promise<void> {
+    await this.adapterFor(id).resetInputModes(id)
+  }
+
   async closeStartupQueryAuthority(id: string): Promise<number> {
     return (await this.adapterFor(id).closeStartupQueryAuthority?.(id)) ?? 0
   }
diff --git a/src/main/daemon/daemon-pty-spawn-preparations.ts b/src/main/daemon/daemon-pty-spawn-preparations.ts
index 633f0d1c7f5..af52051a483 100644
--- a/src/main/daemon/daemon-pty-spawn-preparations.ts
+++ b/src/main/daemon/daemon-pty-spawn-preparations.ts
@@ -33,7 +33,14 @@ export class DaemonPtySpawnPreparations {
       clientId,
       requestId
     }
-    this.cancellationByPreparation.set(preparation, Promise.withResolvers<void>())
+    let resolveCancellation!: () => void
+    const cancellation = new Promise<void>((resolve) => {
+      resolveCancellation = resolve
+    })
+    this.cancellationByPreparation.set(preparation, {
+      promise: cancellation,
+      resolve: resolveCancellation
+    })
     if (Number.isSafeInteger(cancelAfterMs) && Number(cancelAfterMs) > 0) {
       preparation.cancelTimer = setTimeout(
         () => this.cancelPreparation(preparation),
diff --git a/src/main/daemon/daemon-pty-spawn-result.ts b/src/main/daemon/daemon-pty-spawn-result.ts
index 5e799230fa1..afc7315abcd 100644
--- a/src/main/daemon/daemon-pty-spawn-result.ts
+++ b/src/main/daemon/daemon-pty-spawn-result.ts
@@ -289,7 +289,7 @@ export abstract class DaemonPtySpawnResult extends DaemonPtySpawnRequest {
     const snapshotPrefix = reattachSnapshot.scrollbackAnsi + reattachSnapshot.rehydrateSequences
     const snapshotFrame = reattachSnapshot.snapshotAnsi
     const snapshotPayload = snapshotPrefix + snapshotFrame
-    // Why kitty flags ride beside the payload, not inside it: the snapshot reaches renderer xterms where POST_REPLAY_REATTACH_RESET's kitty reset must win (terminal-query-authority.md §kitty).
+    // Why kitty flags ride beside the payload, not inside it: renderers re-assert them in the replay epilogue, after the payload's screen switches (terminal-query-authority.md §kitty).
     // Why known `0` is no longer dropped: the pane tracker must be able to tell
     // "the app negotiated nothing" from "this reattach proved nothing".
     const kittyKeyboardFlags = parseTerminalKittyKeyboardFlags(
diff --git a/src/main/daemon/daemon-request-router.ts b/src/main/daemon/daemon-request-router.ts
index ae007366dd0..9bd0d7963b6 100644
--- a/src/main/daemon/daemon-request-router.ts
+++ b/src/main/daemon/daemon-request-router.ts
@@ -129,6 +129,9 @@ export class DaemonRequestRouter {
       case 'clearScrollback':
         this.options.host.clearScrollback(request.payload.sessionId)
         return {}
+      case 'resetInputModes':
+        this.options.host.resetInputModes(request.payload.sessionId)
+        return {}
       case 'listSessions':
         return { sessions: this.options.host.listSessions() }
       case 'shutdownIfIdle':
diff --git a/src/main/daemon/daemon-server.test.ts b/src/main/daemon/daemon-server.test.ts
index ef89b3ef3b0..3479b4eea45 100644
--- a/src/main/daemon/daemon-server.test.ts
+++ b/src/main/daemon/daemon-server.test.ts
@@ -437,23 +437,6 @@ describe('DaemonServer', () => {
       expect(['healthy', 'unhealthy', 'unknown']).toContain(result.health)
     })
 
-    it('handles write (fire-and-forget)', async () => {
-      await startServer()
-      const c = await connectClient()
-
-      await c.request('createOrAttach', {
-        sessionId: 'test-session',
-        cols: 80,
-        rows: 24
-      })
-
-      // Should not throw
-      c.notify('write', { sessionId: 'test-session', data: 'ls\n' })
-
-      // Give the server time to process
-      await new Promise((r) => setTimeout(r, 50))
-    })
-
     it('handles resize', async () => {
       await startServer()
       const c = await connectClient()
diff --git a/src/main/daemon/daemon-zsh-shell-ready-wrapper-spec.ts b/src/main/daemon/daemon-zsh-shell-ready-wrapper-spec.ts
index 70ea670966c..88e8af0b805 100644
--- a/src/main/daemon/daemon-zsh-shell-ready-wrapper-spec.ts
+++ b/src/main/daemon/daemon-zsh-shell-ready-wrapper-spec.ts
@@ -11,10 +11,10 @@ export function getDaemonZshWrapperSpec(): ZshStartupHookSpec {
     overlayRestoreComment:
       "# Why: ~/.zshrc can export the user's default OpenCode config after spawn.",
     restores: {
+      managedWslCli: false,
       agentTeamsPath: true,
       remoteCliBinDir: false,
-      codexHome: true,
-      codexLaunchPreflight: true
+      codexHome: true
     }
   }
 }
diff --git a/src/main/daemon/degraded-daemon-pty-provider.test.ts b/src/main/daemon/degraded-daemon-pty-provider.test.ts
index f2e86abab28..363e9125b26 100644
--- a/src/main/daemon/degraded-daemon-pty-provider.test.ts
+++ b/src/main/daemon/degraded-daemon-pty-provider.test.ts
@@ -50,6 +50,7 @@ function createProvider(
     getCwd: vi.fn(async () => ''),
     getInitialCwd: vi.fn(async () => ''),
     clearBuffer: vi.fn(async () => {}),
+    resetInputModes: vi.fn(async () => {}),
     acknowledgeDataEvent: vi.fn(),
     hasChildProcesses: vi.fn(async () => false),
     getForegroundProcess: vi.fn(async () => null),
diff --git a/src/main/daemon/degraded-daemon-pty-provider.ts b/src/main/daemon/degraded-daemon-pty-provider.ts
index 2b50424ae83..6db8c80ac87 100644
--- a/src/main/daemon/degraded-daemon-pty-provider.ts
+++ b/src/main/daemon/degraded-daemon-pty-provider.ts
@@ -168,6 +168,7 @@ export class DegradedDaemonPtyProvider implements IPtyProvider {
   }
 
   clearBuffer = (id: string): Promise<void> => this.providerFor(id).clearBuffer(id)
+  resetInputModes = (id: string): Promise<void> => this.providerFor(id).resetInputModes(id)
 
   async closeStartupQueryAuthority(id: string): Promise<number> {
     return (await this.providerFor(id).closeStartupQueryAuthority?.(id)) ?? 0
diff --git a/src/main/daemon/node-pty-error-hints.test.ts b/src/main/daemon/node-pty-error-hints.test.ts
index f43951f05a6..361d8b73ba1 100644
--- a/src/main/daemon/node-pty-error-hints.test.ts
+++ b/src/main/daemon/node-pty-error-hints.test.ts
@@ -1,22 +1,12 @@
 import { describe, expect, it } from 'vitest'
+import {
+  LEGACY_PTY_ALLOCATION_HINT,
+  LEGACY_TERMINAL_PROCESS_LIMIT_HINT,
+  PTY_ALLOCATION_HINT,
+  TERMINAL_PROCESS_LIMIT_HINT
+} from '../../shared/terminal-spawn-error-copy'
 import { addNodePtyRecoveryHint, parseNodePtyDiagnostic } from './node-pty-error-hints'
 
-const PTY_ALLOCATION_HINT = [
-  'Your system cannot allocate any more pty devices.',
-  '',
-  'Orca requires a pty device to launch a new terminal. This error is usually due to having too many terminal windows or terminal sessions open, either in Orca or another program.',
-  '',
-  'Free up some pty devices and try again.'
-].join('\n')
-
-const TERMINAL_PROCESS_LIMIT_HINT = [
-  'Your system cannot start another terminal process.',
-  '',
-  'This is usually due to having too many terminal sessions or other processes running.',
-  '',
-  'Close unused terminals or quit unused processes and try again.'
-].join('\n')
-
 describe('node-pty diagnostic error hints', () => {
   it('parses the native step and errno without dropping the original message', () => {
     const message =
@@ -32,46 +22,71 @@ describe('node-pty diagnostic error hints', () => {
     const message =
       "node-pty: open_slave failed: EMFILE (errno 24, Too many open files) - slave='/dev/ttys003'"
 
-    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT} ${message}`)
+    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT}\n${message}`)
   })
 
   it('hints when the system cannot allocate a pty master', () => {
     const message =
       'node-pty: posix_openpt failed: ENFILE (errno 23, Too many open files in system)'
 
-    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT} ${message}`)
+    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT}\n${message}`)
   })
 
   it('hints when macOS cannot configure a pty master device', () => {
     const message = 'node-pty: posix_openpt failed: errno (errno 6, Device not configured)'
 
-    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT} ${message}`)
+    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT}\n${message}`)
   })
 
   it('hints local wrapped spawn errors from pty allocation failures', () => {
     const message =
       'Failed to spawn shell "/bin/zsh": node-pty: open_slave failed: EMFILE (errno 24, Too many open files) - slave=\'/dev/ttys003\' (shell: /bin/zsh, cwd: /tmp, arch: arm64, platform: darwin 25.0.0, orca: 1.4.178). If this persists, please file an issue.'
 
-    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT} ${message}`)
+    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT}\n${message}`)
+  })
+
+  it('keeps the whole recovery action on the first line', () => {
+    const message =
+      'Failed to spawn shell "/bin/zsh": node-pty: posix_openpt failed: errno (errno 6, Device not configured) (shell: /bin/zsh). If this persists, please file an issue.'
+
+    expect(addNodePtyRecoveryHint(message).split('\n')[0]).toBe(PTY_ALLOCATION_HINT)
   })
 
   it('hints unstructured openpty allocation failures', () => {
     const message = 'Failed to spawn shell "/bin/bash": openpty(3) failed.'
 
-    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT} ${message}`)
+    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT}\n${message}`)
   })
 
   it('hints when posix_spawn reports the per-user process limit', () => {
     const message =
       "node-pty: posix_spawn failed: EAGAIN (errno 35, Resource temporarily unavailable) - helper='/tmp/node-pty/spawn-helper'"
 
-    expect(addNodePtyRecoveryHint(message)).toBe(`${TERMINAL_PROCESS_LIMIT_HINT} ${message}`)
+    expect(addNodePtyRecoveryHint(message)).toBe(`${TERMINAL_PROCESS_LIMIT_HINT}\n${message}`)
   })
 
   it('does not duplicate an existing recovery hint', () => {
     const message =
       "node-pty: open_slave failed: EMFILE (errno 24, Too many open files) - slave='/dev/ttys003'"
-    const hinted = `${PTY_ALLOCATION_HINT} ${message}`
+    const hinted = `${PTY_ALLOCATION_HINT}\n${message}`
+
+    expect(addNodePtyRecoveryHint(hinted)).toBe(hinted)
+  })
+
+  it('does not duplicate hints from an older remote host', () => {
+    const ptyError = 'node-pty: open_slave failed: EMFILE (errno 24, Too many open files)'
+    const processError = 'node-pty: posix_spawn failed: EAGAIN (errno 35, Resource unavailable)'
+
+    expect(addNodePtyRecoveryHint(`${LEGACY_PTY_ALLOCATION_HINT} ${ptyError}`)).toBe(
+      `${LEGACY_PTY_ALLOCATION_HINT} ${ptyError}`
+    )
+    expect(addNodePtyRecoveryHint(`${LEGACY_TERMINAL_PROCESS_LIMIT_HINT} ${processError}`)).toBe(
+      `${LEGACY_TERMINAL_PROCESS_LIMIT_HINT} ${processError}`
+    )
+  })
+
+  it('does not duplicate a legacy hint on unstructured openpty failures', () => {
+    const hinted = `${LEGACY_PTY_ALLOCATION_HINT} Failed to spawn shell "/bin/bash": openpty(3) failed.`
 
     expect(addNodePtyRecoveryHint(hinted)).toBe(hinted)
   })
diff --git a/src/main/daemon/node-pty-error-hints.ts b/src/main/daemon/node-pty-error-hints.ts
index 022fb98c5be..182beb41a79 100644
--- a/src/main/daemon/node-pty-error-hints.ts
+++ b/src/main/daemon/node-pty-error-hints.ts
@@ -1,3 +1,10 @@
+import {
+  LEGACY_PTY_ALLOCATION_HINT,
+  LEGACY_TERMINAL_PROCESS_LIMIT_HINT,
+  PTY_ALLOCATION_HINT,
+  TERMINAL_PROCESS_LIMIT_HINT
+} from '../../shared/terminal-spawn-error-copy'
+
 export type NodePtyDiagnostic = {
   step: string
   errno: number
@@ -25,22 +32,6 @@ const RESOURCE_EXHAUSTION_ERRNOS = new Set([
   35 // EAGAIN on macOS
 ])
 
-const PTY_ALLOCATION_HINT = [
-  'Your system cannot allocate any more pty devices.',
-  '',
-  'Orca requires a pty device to launch a new terminal. This error is usually due to having too many terminal windows or terminal sessions open, either in Orca or another program.',
-  '',
-  'Free up some pty devices and try again.'
-].join('\n')
-
-const TERMINAL_PROCESS_LIMIT_HINT = [
-  'Your system cannot start another terminal process.',
-  '',
-  'This is usually due to having too many terminal sessions or other processes running.',
-  '',
-  'Close unused terminals or quit unused processes and try again.'
-].join('\n')
-
 export function parseNodePtyDiagnostic(message: string): NodePtyDiagnostic | null {
   const match =
     NODE_PTY_DIAGNOSTIC_RE.exec(message) ?? NODE_PTY_DIAGNOSTIC_ANYWHERE_RE.exec(message)
@@ -70,18 +61,30 @@ export function getNodePtyRecoveryHint(diagnostic: NodePtyDiagnostic): string |
   return null
 }
 
+function hasPtyAllocationHint(message: string): boolean {
+  return message.startsWith(PTY_ALLOCATION_HINT) || message.startsWith(LEGACY_PTY_ALLOCATION_HINT)
+}
+
 export function addNodePtyRecoveryHint(message: string): string {
   const diagnostic = parseNodePtyDiagnostic(message)
   if (!diagnostic) {
-    if (GENERIC_PTY_ALLOCATION_RE.test(message) && !message.startsWith(PTY_ALLOCATION_HINT)) {
-      return `${PTY_ALLOCATION_HINT} ${message}`
+    if (GENERIC_PTY_ALLOCATION_RE.test(message) && !hasPtyAllocationHint(message)) {
+      return `${PTY_ALLOCATION_HINT}\n${message}`
     }
     return message
   }
 
   const hint = getNodePtyRecoveryHint(diagnostic)
-  if (hint && message.startsWith(hint)) {
+  if (
+    !hint ||
+    message.startsWith(hint) ||
+    (hint === PTY_ALLOCATION_HINT && hasPtyAllocationHint(message)) ||
+    (hint === TERMINAL_PROCESS_LIMIT_HINT && message.startsWith(LEGACY_TERMINAL_PROCESS_LIMIT_HINT))
+  ) {
     return message
   }
-  return hint ? `${hint} ${message}` : message
+  // Older clients need both stale-daemon markers before their first-line IPC truncation.
+  const separator =
+    hint === PTY_ALLOCATION_HINT || hint === TERMINAL_PROCESS_LIMIT_HINT ? '\n' : ' '
+  return `${hint}${separator}${message}`
 }
diff --git a/src/main/daemon/process-boundary-ground.test.ts b/src/main/daemon/process-boundary-ground.test.ts
index dfdf5262edd..5cefaa0694b 100644
--- a/src/main/daemon/process-boundary-ground.test.ts
+++ b/src/main/daemon/process-boundary-ground.test.ts
@@ -142,7 +142,7 @@ describe('process boundary ground at a proven crash', () => {
     barrier.accept({ data, rawStartSeq: 0, rawEndSeq: data.length, transformed: false })
 
     await vi.waitFor(() => expect(released).toHaveLength(3))
-    expect(released[1]).toBe(PROCESS_BOUNDARY_GROUND)
+    expect(released[1]).toBe(`\x1b]133;D;137\x07${PROCESS_BOUNDARY_GROUND}`)
     expect(released[2]).toBe('\x1b[?2004h$ ')
     expect(barrier.getOwner()).toBe('shell')
     const snapshot = live.getSnapshot()
@@ -155,4 +155,19 @@ describe('process boundary ground at a proven crash', () => {
     }
     expect(live.getBufferTailLines(24).slice(0, 2)).toEqual(['$ tui', '$ '])
   })
+
+  it('pauses on an escape boundary so a mid-proof snapshot has no open OSC', () => {
+    const live = emulator(DAEMON_SESSION_SCROLLBACK_ROWS)
+    const barrier = new TerminalShellRecoveryBarrier({
+      confirmShellForeground: () => new Promise(() => {}),
+      release: (emission) => write(live, emission.data),
+      isAlive: () => true
+    })
+
+    const data = `\x1b[?1049h${DEAD_PROCESS_ARMS}TUI\x1b]133;D;137\x07$ `
+    barrier.accept({ data, rawStartSeq: 0, rawEndSeq: data.length, transformed: false })
+
+    expect(live.getSnapshot().pendingEscapeTailAnsi).toBeUndefined()
+    barrier.dispose()
+  })
 })
diff --git a/src/main/daemon/pty-subprocess-env-inheritance.test.ts b/src/main/daemon/pty-subprocess-env-inheritance.test.ts
index f6f6cb3a056..636b53d70a1 100644
--- a/src/main/daemon/pty-subprocess-env-inheritance.test.ts
+++ b/src/main/daemon/pty-subprocess-env-inheritance.test.ts
@@ -125,11 +125,13 @@ describe('createPtySubprocess', () => {
     const saved = {
       ORCA_PANE_KEY: process.env.ORCA_PANE_KEY,
       ORCA_TAB_ID: process.env.ORCA_TAB_ID,
-      ORCA_WORKTREE_ID: process.env.ORCA_WORKTREE_ID
+      ORCA_WORKTREE_ID: process.env.ORCA_WORKTREE_ID,
+      ORCA_WSL_CLI_DIR: process.env.ORCA_WSL_CLI_DIR
     }
     process.env.ORCA_PANE_KEY = 'parent-tab:parent-leaf'
     process.env.ORCA_TAB_ID = 'parent-tab'
     process.env.ORCA_WORKTREE_ID = 'parent-worktree'
+    process.env.ORCA_WSL_CLI_DIR = 'C:/parent/wsl-managed-cli'
 
     try {
       await createPtySubprocess({ sessionId: 'test', cols: 80, rows: 24 })
@@ -147,6 +149,7 @@ describe('createPtySubprocess', () => {
     expect(env.ORCA_PANE_KEY).toBeUndefined()
     expect(env.ORCA_TAB_ID).toBeUndefined()
     expect(env.ORCA_WORKTREE_ID).toBeUndefined()
+    expect(env.ORCA_WSL_CLI_DIR).toBeUndefined()
   })
 
   it('preserves explicit child Orca pane identity over parent env', async () => {
diff --git a/src/main/daemon/pty-subprocess-spawn-file-foreground.test.ts b/src/main/daemon/pty-subprocess-spawn-file-foreground.test.ts
new file mode 100644
index 00000000000..94e352ce695
--- /dev/null
+++ b/src/main/daemon/pty-subprocess-spawn-file-foreground.test.ts
@@ -0,0 +1,280 @@
+import type { IPty } from 'node-pty'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { ProcessTableRow } from '../../shared/process-table-snapshot'
+import type * as SnapshotReader from '../../shared/process-table-snapshot-reader'
+import { createDaemonPtySubprocessHandle } from './pty-subprocess/subprocess-handle'
+import { resolveSpawnFileForegroundFromRows } from './pty-subprocess/spawn-file-foreground-process'
+import { inspectTerminalHostProcess } from './terminal-host-process-inspection'
+import { Session } from './session'
+const { readSnapshot, readFresh, readStrict, members, readWindows, resolveWindows } = vi.hoisted(
+  () => ({
+    readSnapshot: vi.fn(),
+    readFresh: vi.fn(),
+    readStrict: vi.fn(),
+    members: vi.fn(),
+    readWindows: vi.fn(),
+    resolveWindows: vi.fn()
+  })
+)
+vi.mock('../../shared/process-table-snapshot-reader', async (importOriginal) => ({
+  ...(await importOriginal<typeof SnapshotReader>()),
+  getProcessTableSnapshot: readSnapshot,
+  getFreshProcessTableSnapshot: readFresh,
+  getStrictProcessTableSnapshotWithAge: readStrict
+}))
+vi.mock('../providers/windows-pty-job-membership', () => ({
+  readWindowsPtyJobProcessIds: members,
+  isWindowsPtyJobReadable: () => true
+}))
+vi.mock('../windows/windows-process-table', () => ({
+  readWindowsProcessIdentityTable: readWindows,
+  readWindowsProcessIdentityTableFresh: readWindows
+}))
+vi.mock('../providers/windows-agent-foreground-process', () => ({
+  shouldInspectWindowsAgentForeground: () => true,
+  resolveWindowsAgentForegroundProcessWithAvailability: resolveWindows
+}))
+
+function table(command: string | null, loginWrapper = false): ProcessTableRow[] {
+  const tpgid = command === null ? (loginWrapper ? 101 : 100) : 102
+  const root: ProcessTableRow = {
+    pid: 100,
+    ppid: 1,
+    pgid: 100,
+    tpgid,
+    tty: 'ttys004',
+    startTime: 'Thu Sep  3 16:02:01 2026',
+    stat: tpgid === 100 ? 'Ss+' : 'Ss',
+    command: loginWrapper ? '"/Applications/Orca shell login" -fp user' : '/bin/zsh'
+  }
+  return [
+    root,
+    ...(loginWrapper
+      ? [
+          {
+            ...root,
+            pid: 101,
+            ppid: 100,
+            pgid: 101,
+            stat: command === null ? 'S+' : 'S',
+            command: '-zsh'
+          }
+        ]
+      : []),
+    ...(command === null
+      ? []
+      : [{ ...root, pid: 102, ppid: loginWrapper ? 101 : 100, pgid: 102, stat: 'S+', command }])
+  ]
+}
+
+function createHandle(loginWrapper = false) {
+  const proc: IPty & { processNameIsSpawnFile: true } = {
+    pid: 100,
+    cols: 80,
+    rows: 24,
+    handleFlowControl: false,
+    process: loginWrapper ? '/Applications/Orca shell login' : '/bin/zsh',
+    processNameIsSpawnFile: true,
+    onData: () => ({ dispose() {} }),
+    onExit: () => ({ dispose() {} }),
+    write() {},
+    resize() {},
+    clear() {},
+    kill() {},
+    pause() {},
+    resume() {}
+  }
+  return createDaemonPtySubprocessHandle({
+    process: proc,
+    shellPath: '/bin/zsh',
+    spawnCwd: '/tmp',
+    env: {},
+    startupCommandDeliveredInShellArgs: false,
+    reportsChildExitStatus: true,
+    sessionId: 'static-name',
+    startupAgentRecognition: null
+  })
+}
+
+async function inspect(handle: ReturnType<typeof createHandle>) {
+  const session = new Session({
+    sessionId: 'static-name',
+    subprocess: handle,
+    shellReadySupported: false,
+    cols: 80,
+    rows: 24,
+    scrollback: 10
+  })
+  try {
+    return await inspectTerminalHostProcess({
+      sessionId: session.sessionId,
+      session,
+      authorityGeneration: 'generation',
+      nextObservationEpoch: () => 1
+    })
+  } finally {
+    session.dispose()
+  }
+}
+
+afterEach(() => {
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+  vi.resetAllMocks()
+})
+
+describe.each(['linux', 'darwin'] as const)('static spawn-file foreground on %s', (platform) => {
+  it.each(['vim', 'sleep', 'node', 'npm', 'node /usr/bin/claude'])(
+    'resolves %s in both the synchronous tracker and host inspection',
+    async (command) => {
+      vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+      const rows = table(command, platform === 'darwin')
+      readSnapshot.mockResolvedValue(rows)
+      readFresh.mockResolvedValue(rows)
+      readStrict.mockResolvedValue({ rows, capturedAgeMs: 0 })
+      const handle = createHandle(platform === 'darwin')
+      const expected = command.includes('claude') ? 'claude' : command
+      expect(handle.processNameIsSpawnFile).toBe(true)
+      expect(await handle.confirmForegroundProcess?.()).toBe(expected)
+      expect(handle.getForegroundProcess()).toBe(expected)
+      expect(await inspect(createHandle(platform === 'darwin'))).toMatchObject({
+        foregroundProcess: expected,
+        hasChildProcesses: true
+      })
+      expect(readStrict).toHaveBeenCalledTimes(1)
+    }
+  )
+
+  it('observes a command ending and returns to an idle login shell', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+    const handle = createHandle(true)
+    readFresh.mockResolvedValue(table('vim', true))
+    expect(await handle.confirmForegroundProcess?.()).toBe('vim')
+    const rows = table(null, true)
+    readFresh.mockResolvedValue(rows)
+    readSnapshot.mockResolvedValue(rows)
+    readStrict.mockResolvedValue({ rows, capturedAgeMs: 0 })
+    expect(await handle.confirmForegroundProcess?.()).toBe('zsh')
+    const inspection = await inspect(handle)
+    expect(inspection).toMatchObject({
+      foregroundProcess: null,
+      hasChildProcesses: false,
+      childProcessEvidence: 'no-children'
+    })
+  })
+
+  it('does not interpret a failed process read as a childless shell', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+    readFresh.mockRejectedValue(new Error('unreadable'))
+    readSnapshot.mockRejectedValue(new Error('unreadable'))
+    readStrict.mockRejectedValue(new Error('unreadable'))
+    const handle = createHandle()
+    expect(await handle.confirmForegroundProcess?.()).toBeNull()
+    const inspection = await inspect(handle)
+    expect(inspection).toMatchObject({
+      hasChildProcesses: true,
+      childProcessEvidence: 'unverifiable',
+      foregroundProcessEvidence: { verdict: 'unverifiable' }
+    })
+  })
+
+  it('retains ordinary foreground names across a failed background refresh', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+    vi.useFakeTimers({ toFake: ['Date'] })
+    vi.setSystemTime(100_000)
+    readSnapshot.mockResolvedValue(table('vim'))
+    const handle = createHandle()
+    expect(handle.getForegroundProcess()).toBe('zsh')
+    await vi.waitFor(() => expect(handle.getForegroundProcess()).toBe('vim'))
+    readSnapshot.mockRejectedValue(new Error('unreadable'))
+    vi.setSystemTime(102_000)
+    expect(handle.getForegroundProcess()).toBe('vim')
+    await vi.waitFor(() => expect(readSnapshot).toHaveBeenCalledTimes(2))
+    expect(handle.getForegroundProcess()).toBe('vim')
+    handle.dispose()
+  })
+
+  it.each(['T', 'S'])(
+    'keeps the close guard live when the shell is foreground and a child has state %s',
+    async (stat) => {
+      vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+      const rows = table(null, platform === 'darwin')
+      rows.push({ ...rows[0], pid: 102, ppid: rows.at(-1)!.pid, pgid: 102, stat, command: 'vim' })
+      readSnapshot.mockResolvedValue(rows)
+      readStrict.mockResolvedValue({ rows, capturedAgeMs: 0 })
+      const inspection = await inspect(createHandle(platform === 'darwin'))
+      expect(inspection).toMatchObject({
+        foregroundProcess: null,
+        hasChildProcesses: true,
+        childProcessEvidence: 'children'
+      })
+    }
+  )
+})
+
+it('ignores stopped/background children and another terminal beneath the same root', () => {
+  const rows = table(null)
+  rows.push({ ...rows[0], pid: 102, ppid: 100, pgid: 102, stat: 'T', command: 'vim' })
+  rows.push({ ...rows[0], pid: 103, ppid: 100, tty: 'ttys009', command: 'claude' })
+  expect(resolveSpawnFileForegroundFromRows(rows, 100)).toEqual({
+    available: true,
+    processName: 'zsh'
+  })
+  expect(resolveSpawnFileForegroundFromRows(rows, 999)).toEqual({
+    available: false,
+    processName: null
+  })
+})
+
+it('uses Windows job membership and the native process table for ordinary children', async () => {
+  vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+  resolveWindows.mockResolvedValue({ available: true, processName: null })
+  members.mockReturnValue(new Set([100, 102]))
+  readWindows.mockResolvedValue([
+    { pid: 100, ppid: 1, name: 'pwsh.exe' },
+    { pid: 102, ppid: 100, name: 'vim.exe' }
+  ])
+  readStrict.mockRejectedValue(new Error('POSIX evidence unavailable'))
+  const handle = createHandle()
+  expect(await handle.confirmForegroundProcess?.()).toBe('vim.exe')
+  expect(await inspect(handle)).toMatchObject({
+    foregroundProcess: 'vim.exe',
+    hasChildProcesses: true
+  })
+})
+
+it('keeps missing Windows job membership unverifiable', async () => {
+  vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+  resolveWindows.mockResolvedValue({ available: true, processName: null })
+  members.mockReturnValue(null)
+  readStrict.mockRejectedValue(new Error('POSIX evidence unavailable'))
+  expect(await inspect(createHandle())).toMatchObject({
+    foregroundProcess: null,
+    hasChildProcesses: true,
+    childProcessEvidence: 'unverifiable'
+  })
+})
+
+it('reports an idle Windows shell only when the owned job contains the shell alone', async () => {
+  vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+  resolveWindows.mockResolvedValue({ available: true, processName: null })
+  members.mockReturnValue(new Set([100]))
+  readStrict.mockRejectedValue(new Error('POSIX evidence unavailable'))
+  expect(await inspect(createHandle())).toMatchObject({ hasChildProcesses: false })
+  expect(readWindows).not.toHaveBeenCalled()
+})
+
+it('keeps the Windows close guard live when a shell descendant is selected above another job', async () => {
+  vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+  resolveWindows.mockResolvedValue({ available: true, processName: null })
+  members.mockReturnValue(new Set([100, 102, 103, 104]))
+  readWindows.mockResolvedValue([
+    { pid: 100, ppid: 1, name: 'pwsh.exe' },
+    { pid: 102, ppid: 100, name: 'vim.exe' },
+    { pid: 103, ppid: 100, name: 'cmd.exe' },
+    { pid: 104, ppid: 103, name: 'pwsh.exe' }
+  ])
+  readStrict.mockRejectedValue(new Error('POSIX evidence unavailable'))
+  const inspection = await inspect(createHandle())
+  expect(inspection).toMatchObject({ hasChildProcesses: true, childProcessEvidence: 'children' })
+})
diff --git a/src/main/daemon/pty-subprocess.ts b/src/main/daemon/pty-subprocess.ts
index 329d1ce5d6b..1b5bc3d1102 100644
--- a/src/main/daemon/pty-subprocess.ts
+++ b/src/main/daemon/pty-subprocess.ts
@@ -84,7 +84,7 @@ export async function createPtySubprocess(opts: PtySubprocessOptions): Promise<S
 
   let spawned: SpawnedDaemonPty
   try {
-    spawned = spawnNativeDaemonPty({
+    spawned = await spawnNativeDaemonPty({
       shellPath: launch.shellPath,
       shellArgs: launch.shellArgs,
       spawnCwd: launch.spawnCwd,
diff --git a/src/main/daemon/pty-subprocess/bun-pty-job-control.integration.test.ts b/src/main/daemon/pty-subprocess/bun-pty-job-control.integration.test.ts
new file mode 100644
index 00000000000..2791f8f363b
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-job-control.integration.test.ts
@@ -0,0 +1,210 @@
+import { existsSync, mkdtempSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { runProcess } from '../../../shared/child-process/run-process'
+import { orcadBunRuntimeFilename } from '../../../shared/orcad-artifacts'
+import { removeTreeSync } from '../../../shared/windows-transient-lock-removal'
+
+const runtimePath =
+  process.env.BUN_EXECUTABLE ??
+  resolve(__dirname, '../../../../out/orcad', orcadBunRuntimeFilename(process.platform))
+
+describe.skipIf(
+  process.platform === 'win32' || !existsSync(runtimePath) || !existsSync('/bin/bash')
+)('Bun terminal user job control', () => {
+  // Bash re-raises SIGHUP; Zsh exits with the signal number.
+  for (const [shell, expectedExitCode] of [
+    ['/bin/bash', 129],
+    ['/bin/zsh', 1]
+  ] as const) {
+    it.skipIf(!existsSync(shell))(
+      `gracefully closes an interactive ${shell} before the daemon force-kill deadline`,
+      async () => {
+        const directory = mkdtempSync(join(tmpdir(), 'orca-bun-shell-hangup-'))
+        try {
+          const entry = join(directory, 'shell-hangup.cjs')
+          writeFileSync(
+            entry,
+            `
+const {spawnBunPty} = require(${JSON.stringify(join(__dirname, 'bun-pty-process.ts'))})
+const {createDaemonPtySubprocessHandle} = require(${JSON.stringify(join(__dirname, 'subprocess-handle.ts'))})
+const {SessionTerminationController} = require(${JSON.stringify(join(__dirname, '../session-termination-controller.ts'))})
+const {existsSync} = require('node:fs')
+const {join} = require('node:path')
+const cwd = ${JSON.stringify(directory)}
+const ready = join(cwd, 'ready'), cleanup = join(cwd, 'hangup-cleanup')
+const shell = ${JSON.stringify(shell)}
+const env = {...process.env,PS1:'',ORCA_TEST_READY:ready,ORCA_TEST_CLEANUP:cleanup}
+const proc = spawnBunPty({file:shell,args:shell.endsWith('/bash')?['--noprofile','--norc','-i']:['-f','-i'],cwd,env,cols:80,rows:24})
+const subprocess = createDaemonPtySubprocessHandle({process:proc,shellPath:shell,spawnCwd:cwd,env,startupCommandDeliveredInShellArgs:false,reportsChildExitStatus:true,sessionId:'shell-hangup',startupAgentRecognition:null})
+let exited = false, forced = false, exitCode, elapsedMs, startedAt
+const forceKill = subprocess.forceKill
+subprocess.forceKill = () => {forced = true;forceKill()}
+const controller = new SessionTerminationController({sessionId:'shell-hangup',subprocess,launchAgent:null,isExited:()=>exited,releaseProducerPause:()=>proc.resume()})
+subprocess.onExit(code => {
+  exited = true
+  exitCode = code
+  elapsedMs = Date.now() - startedAt
+  controller.markPhysicalExit()
+  controller.cancelForceKillFallback()
+})
+const waitFor = async predicate => {
+  const deadline = Date.now() + 8000
+  while (!predicate()) {
+    if (Date.now() >= deadline) throw new Error('Timed out waiting for shell hangup')
+    await Bun.sleep(10)
+  }
+}
+;(async()=>{
+  try {
+    // Observe normal hangup cleanup without replacing the shell's SIGHUP handler.
+    proc.write(${JSON.stringify('trap \'printf cleaned > "$ORCA_TEST_CLEANUP"\' EXIT; printf ready > "$ORCA_TEST_READY"\r')})
+    await waitFor(() => existsSync(ready))
+    startedAt = Date.now()
+    controller.kill()
+    await waitFor(() => exited)
+    let reaped = false
+    try {process.kill(proc.pid, 0)} catch (error) {if(error.code==='ESRCH')reaped=true;else throw error}
+    console.log(JSON.stringify({cleaned:existsSync(cleanup),forced,exitCode,elapsedMs,reaped}))
+  } finally {
+    controller.cancelForceKillFallback()
+    if (!exited) {
+      subprocess.forceKill()
+      await waitFor(() => exited)
+    }
+    controller.disposeSubprocessHandle()
+  }
+})().catch(error => {console.error(error);process.exitCode=1})
+`
+          )
+          const result = await runProcess({
+            program: runtimePath,
+            args: [entry],
+            timeoutMs: 25_000
+          })
+          expect(result.timedOut).toBe(false)
+          expect(result.code, result.stderr).toBe(0)
+          const evidence = JSON.parse(result.stdout)
+          expect(evidence).toEqual({
+            cleaned: true,
+            forced: false,
+            exitCode: expectedExitCode,
+            elapsedMs: expect.any(Number),
+            reaped: true
+          })
+          expect(evidence.elapsedMs).toBeLessThan(5_000)
+        } finally {
+          removeTreeSync(directory)
+        }
+      }
+    )
+  }
+
+  it('keeps a real Ctrl-Z job suspended while pausing and resuming a background producer', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-bun-job-control-'))
+    try {
+      writeFileSync(join(directory, 'producer.cjs'), 'setInterval(()=>console.log("flow-tick"),10)')
+      writeFileSync(
+        join(directory, 'sleeper.sh'),
+        'printf \'%s\' "$$" > sleeper-ready\nexec sleep 30\n'
+      )
+      const entry = join(directory, 'job-control.cjs')
+      writeFileSync(
+        entry,
+        `
+const {spawnBunPty} = require(${JSON.stringify(join(__dirname, 'bun-pty-process.ts'))})
+const {readPosixPtyProcessTable,forceKillPosixPtyProcessGroups} = require(${JSON.stringify(join(__dirname, '../../pty/posix-pty-process-groups.ts'))})
+const {existsSync,readFileSync} = require('node:fs')
+const ready = ${JSON.stringify(join(directory, 'sleeper-ready'))}
+const signals = []
+const proc = spawnBunPty({
+  file:'/bin/bash', args:['--noprofile','--norc','-i'], cwd:${JSON.stringify(directory)},
+  env:{...process.env,PS1:'',ORCA_TEST_RUNTIME:process.execPath},cols:80,rows:24
+}, {signalProcessGroup:(pgid,signal)=>{process.kill(-pgid,signal);signals.push([pgid,signal])}})
+let output = '', exited = false
+proc.onData(data => output += data)
+proc.onExit(() => {exited = true})
+const isAlive = pid => {
+  try {process.kill(pid, 0);return true}
+  catch (error) {if(error.code==='ESRCH')return false;throw error}
+}
+const rows = async () => {
+  const table = (await readPosixPtyProcessTable(proc.pid)).trim().split(/\\r?\\n/).map(row => {
+    const [pid,pgid,tty,state] = row.trim().split(/\\s+/)
+    return {pid:Number(pid),pgid:Number(pgid),tty,state}
+  }).filter(row => row.pid > 0 && row.state)
+  const root = table.find(row => row.pid === proc.pid)
+  // BusyBox discovery returns all processes; this probe owns only its shell's terminal.
+  return root ? table.filter(row => row.tty === root.tty) : []
+}
+const waitFor = async predicate => {
+  const deadline = Date.now() + 8000
+  while (Date.now() < deadline) {
+    const value = await predicate()
+    if (value) return value
+    await Bun.sleep(20)
+  }
+  throw new Error('Timed out waiting for terminal process state')
+}
+;(async()=>{
+  try {
+    proc.write('/bin/bash sleeper.sh\\r')
+    // A forked PID can appear before Bash gives its group the foreground terminal.
+    const sleeperPid = await waitFor(() => existsSync(ready) && Number(readFileSync(ready, 'utf8')))
+    const sleeper = await waitFor(async () => (await rows()).find(row => row.pid === sleeperPid))
+    proc.write('\\x1a')
+    await waitFor(async () => (await rows()).some(row => row.pid === sleeper.pid && row.state.startsWith('T')))
+    proc.write(${JSON.stringify('"$ORCA_TEST_RUNTIME" producer.cjs &\r')})
+    await waitFor(() => output.split('flow-tick').length > 5)
+    proc.pause()
+    await waitFor(() => signals.filter(([,signal]) => signal === 'SIGSTOP').length >= 2)
+    await Bun.sleep(100)
+    const pausedLength = output.length
+    await Bun.sleep(100)
+    const producerPaused = pausedLength === output.length
+    proc.resume()
+    await waitFor(() => signals.some(([,signal]) => signal === 'SIGCONT'))
+    await waitFor(() => output.length > pausedLength)
+    const sleeperAfter = (await rows()).find(row => row.pid === sleeper.pid)
+    console.log(JSON.stringify({producerPaused,producerResumed:true,userJobStopped:sleeperAfter?.state.startsWith('T')===true,userJobSignalled:signals.some(([pgid])=>pgid===sleeper.pgid)}))
+  } finally {
+    let ownedPids = []
+    try {
+      proc.resume()
+      const ownedRows = await rows()
+      ownedPids = ownedRows.map(row => row.pid)
+      const root = ownedRows.find(row => row.pid === proc.pid)
+      if (!root) throw new Error('Cleanup could not find the owned shell')
+      // Keep Bash running until it reaps its jobs; container PID 1 may not reap orphans.
+      forceKillPosixPtyProcessGroups(proc.pid, () => {throw new Error('Cleanup lost terminal ownership')}, {
+        signalProcessGroup: pgid => {if (pgid !== root.pgid) process.kill(-pgid, 'SIGKILL')}
+      })
+      process.kill(proc.pid, 'SIGCONT')
+      await waitFor(() => ownedPids.every(pid => pid === proc.pid || !isAlive(pid)))
+    } finally {
+      try {
+        forceKillPosixPtyProcessGroups(proc.pid, () => proc.kill('SIGKILL'))
+        await waitFor(() => exited && ownedPids.every(pid => !isAlive(pid)))
+      } finally {
+        proc.destroy()
+      }
+    }
+  }
+})().catch(error => {console.error(error);process.exitCode=1})
+`
+      )
+      const result = await runProcess({ program: runtimePath, args: [entry], timeoutMs: 25_000 })
+      expect(result.timedOut).toBe(false)
+      expect(result.code, result.stderr).toBe(0)
+      expect(JSON.parse(result.stdout)).toEqual({
+        producerPaused: true,
+        producerResumed: true,
+        userJobStopped: true,
+        userJobSignalled: false
+      })
+    } finally {
+      removeTreeSync(directory)
+    }
+  })
+})
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process-capabilities.ts b/src/main/daemon/pty-subprocess/bun-pty-process-capabilities.ts
new file mode 100644
index 00000000000..8d236ab5aa8
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process-capabilities.ts
@@ -0,0 +1,27 @@
+import type { BunRuntime } from './bun-pty-process-contract'
+
+function currentRuntime(): unknown {
+  return 'Bun' in globalThis ? globalThis.Bun : undefined
+}
+
+function isBunRuntime(runtime: unknown): runtime is BunRuntime {
+  return (
+    typeof runtime === 'object' &&
+    runtime !== null &&
+    'spawn' in runtime &&
+    typeof runtime.spawn === 'function' &&
+    'Terminal' in runtime &&
+    typeof runtime.Terminal === 'function'
+  )
+}
+
+export function canUseBunPty(runtime: unknown = currentRuntime()): boolean {
+  return isBunRuntime(runtime)
+}
+
+export function resolveBunRuntime(runtime: unknown = currentRuntime()): BunRuntime {
+  if (!isBunRuntime(runtime)) {
+    throw new Error('Bun terminal runtime is unavailable')
+  }
+  return runtime
+}
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process-contract.ts b/src/main/daemon/pty-subprocess/bun-pty-process-contract.ts
new file mode 100644
index 00000000000..b43dd57a659
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process-contract.ts
@@ -0,0 +1,72 @@
+import type * as pty from 'node-pty'
+import type { JobTerminationOutcome } from '../../windows/windows-pty-job'
+import type { WindowsBunPtyJob } from './windows-bun-pty-job'
+import type { createWindowsBunPtyLaunch } from './windows-bun-pty-launch'
+
+export type BunTerminal = {
+  closed: boolean
+  write(data: string | ArrayBufferView): number
+  resize(cols: number, rows: number): void
+  close(): void
+}
+
+export type BunSubprocess = {
+  pid: number
+  terminal: BunTerminal
+  exited: Promise<number>
+  signalCode?: string | null
+  kill(signal?: string | number): void
+}
+
+export type BunTerminalOptions = {
+  cols: number
+  rows: number
+  name: string
+  data(terminal: BunTerminal, data: Uint8Array<ArrayBuffer>): void
+  exit?(terminal: BunTerminal, exitCode: number, signal: string | null): void
+  drain?(terminal: BunTerminal): void
+}
+
+export type BunRuntime = {
+  Terminal: new (options: BunTerminalOptions) => BunTerminal
+  spawn(
+    command: string[],
+    options: {
+      cwd: string
+      env: Record<string, string>
+      terminal: BunTerminal | BunTerminalOptions
+      windowsVerbatimArguments?: boolean
+      onExit?(process: BunSubprocess, exitCode: number, signalCode: string | null): void
+    }
+  ): BunSubprocess
+}
+
+export type BunPtyProcess = pty.IPty & {
+  destroy(): void
+  processNameIsSpawnFile?: true
+  jobRootProcessIsWrapper?: true
+  shellProcessId?: number
+  waitForSpawn?(): Promise<void>
+  terminateOwnedTree?(): JobTerminationOutcome
+  listOwnedProcessIds?(): readonly number[] | null
+  signalProcess?(signal: string): void
+}
+
+export type BunPtySpawnArgs = {
+  file: string
+  args: string[]
+  cwd: string
+  env: Record<string, string>
+  cols: number
+  rows: number
+}
+
+export type SpawnBunPtyDeps = {
+  platform?: NodeJS.Platform
+  runtime?: BunRuntime
+  assignHostJob?: () => boolean
+  createJob?: (pid: number) => WindowsBunPtyJob | null
+  createWindowsLaunch?: typeof createWindowsBunPtyLaunch
+  readProcessTable?: () => string
+  signalProcessGroup?: (pgid: number, signal: NodeJS.Signals) => void
+}
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process-flow-control.test.ts b/src/main/daemon/pty-subprocess/bun-pty-process-flow-control.test.ts
new file mode 100644
index 00000000000..5c4a438238b
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process-flow-control.test.ts
@@ -0,0 +1,387 @@
+import { constants } from 'node:os'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createBunPtyProducerFlowControl } from './bun-pty-process-flow-control'
+
+const TABLE = '4321 4321 pts/test T\n4322 4322 pts/test'
+const settled = (): Promise<void> => new Promise((resolve) => setImmediate(resolve))
+
+function createHarness() {
+  let exited = false
+  const reads: { resolve: (table: string) => void; signal: AbortSignal }[] = []
+  const readProcessTableAsync = vi.fn(
+    (signal: AbortSignal) =>
+      new Promise<string>((resolve) => {
+        reads.push({ resolve, signal })
+      })
+  )
+  const signalProcessGroup = vi.fn<(pgid: number, signal: NodeJS.Signals) => void>()
+  const kill = vi.fn()
+  const flow = createBunPtyProducerFlowControl({
+    platform: 'linux',
+    processHandle: { pid: 4321, kill, terminal: { closed: false, close() {} } },
+    windowsJob: null,
+    isExited: () => exited,
+    readProcessTable: () => TABLE,
+    readProcessTableAsync,
+    signalProcessGroup
+  })
+  return {
+    flow,
+    reads,
+    kill,
+    readProcessTableAsync,
+    signalProcessGroup,
+    exit: () => {
+      exited = true
+    }
+  }
+}
+
+afterEach(() => vi.useRealTimers())
+
+describe('asynchronous POSIX producer flow control', () => {
+  it.each(['S', 'R', ''])(
+    'leaves jobs running unless the shell is observed stopped (state %s)',
+    async (state) => {
+      const harness = createHarness()
+      harness.flow.pause()
+      expect(harness.kill.mock.calls).toEqual([[constants.signals.SIGSTOP]])
+      expect(harness.readProcessTableAsync).not.toHaveBeenCalled()
+      await settled()
+      harness.reads[0].resolve(TABLE.replace('pts/test T', `pts/test ${state}`))
+      await settled()
+      expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+      harness.flow.resume()
+      await settled()
+      harness.reads[1].resolve(TABLE)
+      await settled()
+      expect(harness.kill.mock.calls).toEqual([
+        [constants.signals.SIGSTOP],
+        [constants.signals.SIGCONT]
+      ])
+      expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+    }
+  )
+
+  it('does not attempt a group pause after the owned shell cannot be stopped', async () => {
+    const harness = createHarness()
+    harness.kill.mockImplementationOnce(() => {
+      throw Object.assign(new Error('denied'), { code: 'EPERM' })
+    })
+    harness.flow.pause()
+    await settled()
+    harness.flow.resume()
+    await settled()
+    expect(harness.kill.mock.calls).toEqual([[constants.signals.SIGSTOP]])
+    expect(harness.readProcessTableAsync).not.toHaveBeenCalled()
+    expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+  })
+
+  it('retries a failed resume lookup without another caller resume or stale group signals', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createHarness()
+    harness.flow.pause()
+    await settled()
+    harness.reads[0].resolve(TABLE)
+    await settled()
+    harness.readProcessTableAsync.mockRejectedValueOnce(new Error('temporary ps failure'))
+    harness.flow.resume()
+    await settled()
+    expect(harness.signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP']
+    ])
+    expect(harness.kill.mock.calls).toEqual([[constants.signals.SIGSTOP]])
+
+    await vi.advanceTimersByTimeAsync(1_000)
+    expect(harness.readProcessTableAsync).toHaveBeenCalledTimes(3)
+    harness.reads[1].resolve('4321 4321 pts/test T\n4322 4322 pts/other\n4323 4323 pts/test')
+    await settled()
+    expect(harness.signalProcessGroup.mock.calls.slice(2)).toEqual([[4321, 'SIGCONT']])
+    await vi.advanceTimersByTimeAsync(5_000)
+    expect(harness.readProcessTableAsync).toHaveBeenCalledTimes(3)
+  })
+
+  it.each(['pause', 'shutdown', 'exit'] as const)(
+    'cancels a scheduled resume retry after %s',
+    async (action) => {
+      vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+      const harness = createHarness()
+      harness.flow.pause()
+      await settled()
+      harness.reads[0].resolve(TABLE)
+      await settled()
+      harness.readProcessTableAsync.mockRejectedValueOnce(new Error('temporary ps failure'))
+      harness.flow.resume()
+      await settled()
+      expect(vi.getTimerCount()).toBe(1)
+      if (action === 'pause') {
+        harness.flow.pause()
+        await settled()
+        harness.reads[1].resolve(TABLE)
+        await settled()
+      } else {
+        if (action === 'exit') {
+          harness.exit()
+        }
+        harness.flow.resumeForShutdown()
+      }
+      expect(vi.getTimerCount()).toBe(0)
+      const signals = harness.signalProcessGroup.mock.calls.length
+      await vi.advanceTimersByTimeAsync(5_000)
+      expect(harness.signalProcessGroup).toHaveBeenCalledTimes(signals)
+      expect(harness.readProcessTableAsync).toHaveBeenCalledTimes(action === 'pause' ? 3 : 2)
+    }
+  )
+
+  it('bounds retries while discovery stays unavailable and resumes after it recovers', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createHarness()
+    harness.flow.pause()
+    await settled()
+    harness.reads[0].resolve(TABLE)
+    await settled()
+    harness.readProcessTableAsync.mockRejectedValue(new Error('ps unavailable'))
+    harness.flow.resume()
+    await settled()
+    await vi.advanceTimersByTimeAsync(2_000)
+    expect(harness.readProcessTableAsync).toHaveBeenCalledTimes(6)
+    expect(vi.getTimerCount()).toBe(1)
+    expect(harness.kill.mock.calls).toEqual([[constants.signals.SIGSTOP]])
+    expect(harness.signalProcessGroup).toHaveBeenCalledTimes(2)
+    harness.readProcessTableAsync.mockResolvedValue(TABLE)
+    await vi.advanceTimersByTimeAsync(500)
+    expect(harness.signalProcessGroup).toHaveBeenLastCalledWith(4321, 'SIGCONT')
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('resumes a root-only suspension when process group discovery is unavailable throughout', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createHarness()
+    harness.readProcessTableAsync.mockRejectedValue(new Error('ps unavailable'))
+    harness.flow.pause()
+    await settled()
+    harness.flow.resume()
+    await settled()
+    expect(harness.kill.mock.calls).toEqual([
+      [constants.signals.SIGSTOP],
+      [constants.signals.SIGCONT]
+    ])
+    expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('reapplies pause after a partial resume and keeps the shell stopped until all jobs resume', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createHarness()
+    const table = `${TABLE}\n4323 4323 pts/test`
+    let denyOnce = true
+    harness.signalProcessGroup.mockImplementation((pgid, signal) => {
+      if (pgid === 4323 && signal === 'SIGCONT' && denyOnce) {
+        denyOnce = false
+        throw Object.assign(new Error('denied'), { code: 'EPERM' })
+      }
+    })
+    harness.flow.pause()
+    await settled()
+    harness.reads[0].resolve(table)
+    await settled()
+    harness.flow.resume()
+    await settled()
+    harness.reads[1].resolve(table)
+    await settled()
+    expect(harness.signalProcessGroup.mock.calls.slice(3)).toEqual([
+      [4322, 'SIGCONT'],
+      [4323, 'SIGCONT']
+    ])
+    expect(vi.getTimerCount()).toBe(1)
+    harness.flow.pause()
+    await settled()
+    harness.reads[2].resolve(table)
+    await settled()
+    expect(harness.signalProcessGroup.mock.calls.slice(5)).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP'],
+      [4323, 'SIGSTOP']
+    ])
+    expect(vi.getTimerCount()).toBe(0)
+    harness.flow.resume()
+    await settled()
+    harness.reads[3].resolve(table)
+    await settled()
+    expect(harness.signalProcessGroup.mock.calls.slice(8)).toEqual([
+      [4322, 'SIGCONT'],
+      [4323, 'SIGCONT'],
+      [4321, 'SIGCONT']
+    ])
+  })
+
+  it('does not delay the shell resume for a job group that already exited', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createHarness()
+    harness.flow.pause()
+    await settled()
+    harness.reads[0].resolve(TABLE)
+    await settled()
+    harness.signalProcessGroup.mockImplementationOnce(() => {
+      throw Object.assign(new Error('gone'), { code: 'ESRCH' })
+    })
+    harness.flow.resume()
+    await settled()
+    harness.reads[1].resolve(TABLE)
+    await settled()
+    expect(harness.signalProcessGroup).toHaveBeenLastCalledWith(4321, 'SIGCONT')
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('coalesces repeated pressure changes while discovery is pending', async () => {
+    const harness = createHarness()
+    harness.flow.pause()
+    await settled()
+    for (let i = 0; i < 1_000; i += 1) {
+      harness.flow.resume()
+      harness.flow.pause()
+    }
+    harness.flow.resume()
+    await settled()
+    expect(harness.readProcessTableAsync).toHaveBeenCalledOnce()
+    expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+
+    harness.reads[0].resolve(TABLE)
+    await settled()
+    expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+    expect(harness.kill.mock.calls).toEqual([
+      [constants.signals.SIGSTOP],
+      [constants.signals.SIGCONT]
+    ])
+
+    for (let i = 0; i < 20; i += 1) {
+      harness.flow.pause()
+      await settled()
+      harness.reads[2 * i + 1].resolve(TABLE)
+      await settled()
+      harness.flow.resume()
+      await settled()
+      harness.reads[2 * i + 2].resolve(TABLE)
+      await settled()
+    }
+    expect(harness.readProcessTableAsync).toHaveBeenCalledTimes(41)
+    expect(harness.signalProcessGroup).toHaveBeenCalledTimes(80)
+    expect(harness.signalProcessGroup).toHaveBeenLastCalledWith(4321, 'SIGCONT')
+  })
+
+  it('revalidates group ownership when resuming after a process id is reused', async () => {
+    const harness = createHarness()
+    harness.flow.pause()
+    await settled()
+    harness.reads[0].resolve(TABLE)
+    await settled()
+    harness.flow.resume()
+    await settled()
+    harness.reads[1].resolve('4321 4321 pts/test T\n4322 4322 pts/other\n4323 4323 pts/test')
+    await settled()
+
+    expect(harness.signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP'],
+      [4321, 'SIGCONT']
+    ])
+  })
+
+  it('does not resume a still-paused session when pressure returns during a resume scan', async () => {
+    const harness = createHarness()
+    harness.flow.pause()
+    await settled()
+    harness.reads[0].resolve(TABLE)
+    await settled()
+    harness.flow.resume()
+    await settled()
+    harness.flow.pause()
+    harness.reads[1].resolve(TABLE)
+    await settled()
+    expect(harness.signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP']
+    ])
+
+    harness.flow.resume()
+    await settled()
+    harness.reads[2].resolve(TABLE)
+    await settled()
+    expect(harness.signalProcessGroup).toHaveBeenLastCalledWith(4321, 'SIGCONT')
+  })
+
+  it.each(['shutdown', 'exit'] as const)('ignores a late scan after %s', async (action) => {
+    const harness = createHarness()
+    harness.flow.pause()
+    await settled()
+    if (action === 'shutdown') {
+      harness.flow.resumeForShutdown()
+      expect(harness.reads[0].signal.aborted).toBe(true)
+    } else {
+      harness.exit()
+    }
+    harness.reads[0].resolve(TABLE)
+    await settled()
+    expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+    expect(harness.kill.mock.calls).toEqual(
+      action === 'shutdown'
+        ? [[constants.signals.SIGSTOP], [constants.signals.SIGCONT]]
+        : [[constants.signals.SIGSTOP]]
+    )
+  })
+
+  it('releases stopped groups before shutdown while an asynchronous resume is pending', async () => {
+    const harness = createHarness()
+    harness.flow.pause()
+    await settled()
+    harness.reads[0].resolve(TABLE)
+    await settled()
+    harness.flow.resume()
+    await settled()
+    harness.flow.resumeForShutdown()
+    expect(harness.reads[1].signal.aborted).toBe(true)
+    expect(harness.signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP'],
+      [4322, 'SIGCONT'],
+      [4321, 'SIGCONT']
+    ])
+    harness.reads[1].resolve(TABLE)
+    await settled()
+    expect(harness.signalProcessGroup).toHaveBeenCalledTimes(4)
+  })
+
+  it('automatically retries a partially failed resume of a partially stopped tree', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createHarness()
+    const table = `${TABLE}\n4323 4323 pts/test S`
+    harness.signalProcessGroup.mockImplementation((pgid, signal) => {
+      if (pgid === 4323 && signal === 'SIGSTOP') {
+        throw new Error('temporary stop failure')
+      }
+    })
+    harness.flow.pause()
+    await settled()
+    harness.reads[0].resolve(table)
+    await settled()
+    harness.signalProcessGroup.mockImplementationOnce(() => {
+      throw Object.assign(new Error('denied'), { code: 'EPERM' })
+    })
+    harness.flow.resume()
+    await settled()
+    harness.reads[1].resolve(table)
+    await settled()
+    await vi.advanceTimersByTimeAsync(500)
+    harness.reads[2].resolve(table)
+    await settled()
+    expect(harness.signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP'],
+      [4323, 'SIGSTOP'],
+      [4322, 'SIGCONT'],
+      [4322, 'SIGCONT'],
+      [4321, 'SIGCONT']
+    ])
+  })
+})
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process-flow-control.ts b/src/main/daemon/pty-subprocess/bun-pty-process-flow-control.ts
new file mode 100644
index 00000000000..5b7dfd7a313
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process-flow-control.ts
@@ -0,0 +1,185 @@
+import { constants } from 'node:os'
+import type { WindowsBunPtyJob } from './windows-bun-pty-job'
+import { isPosixPtyRootStopped, readPosixPtyProcessTable } from '../../pty/posix-pty-process-groups'
+
+import { createBunPtyProcessSuspension } from './bun-pty-process-suspension'
+
+const TRANSITION_RETRY_MS = 500
+
+type BunPtyProcessHandle = Readonly<{
+  pid: number
+  kill(signal?: string | number): void
+  terminal: Readonly<{ closed: boolean; close(): void }>
+}>
+
+export type BunPtyProducerFlowControl = Readonly<{
+  pause(): void
+  resume(): void
+  resumeForShutdown(): void
+}>
+
+export function createBunPtyProducerFlowControl(
+  options: Readonly<{
+    platform: NodeJS.Platform
+    processHandle: BunPtyProcessHandle
+    windowsJob: WindowsBunPtyJob | null
+    isExited: () => boolean
+    readProcessTable?: () => string
+    readProcessTableAsync?: (signal: AbortSignal) => Promise<string>
+    signalProcessGroup?: (pgid: number, signal: NodeJS.Signals) => void
+  }>
+): BunPtyProducerFlowControl {
+  let state: 'running' | 'paused' | 'uncertain' = 'running'
+  let pauseRequested = false
+  let shuttingDown = false
+  let pendingRead: AbortController | undefined
+  let transitionRetry: ReturnType<typeof setTimeout> | undefined
+  let pauseDenied = false
+  const signalRoot = (signal: 'SIGSTOP' | 'SIGCONT'): void => {
+    // The runtime's named STOP/CONT signals are not portable across POSIX platforms.
+    options.processHandle.kill(constants.signals[signal])
+  }
+
+  const suspension = createBunPtyProcessSuspension({
+    pid: options.processHandle.pid,
+    platform: options.platform,
+    signalRoot,
+    readProcessTable: options.readProcessTable,
+    signalProcessGroup: options.signalProcessGroup
+  })
+  const pausePermanentlyDenied = (error: unknown): boolean =>
+    error instanceof Error && 'code' in error && (error.code === 'EPERM' || error.code === 'EACCES')
+
+  const clearTransitionRetry = (): void => {
+    clearTimeout(transitionRetry)
+    transitionRetry = undefined
+  }
+
+  const needsTransition = (): boolean =>
+    !shuttingDown && !options.isExited() && state !== (pauseRequested ? 'paused' : 'running')
+
+  const retryTransition = (): void => {
+    if (!needsTransition() || transitionRetry) {
+      return
+    }
+    // Callers send transitions once; retain the obligation until fresh ownership confirms every group.
+    transitionRetry = setTimeout(() => {
+      transitionRetry = undefined
+      reconcile()
+    }, TRANSITION_RETRY_MS)
+    transitionRetry.unref?.()
+  }
+
+  const reconcile = (): void => {
+    if (!needsTransition() || pendingRead) {
+      return
+    }
+    if (options.platform === 'win32') {
+      const succeeded = pauseRequested ? options.windowsJob?.pause() : options.windowsJob?.resume()
+      state = succeeded ? (pauseRequested ? 'paused' : 'running') : 'uncertain'
+      if (pauseRequested && !succeeded) {
+        pauseRequested = false
+      }
+      retryTransition()
+      return
+    }
+    if (pauseRequested && state === 'running') {
+      try {
+        signalRoot('SIGSTOP')
+        state = 'uncertain'
+      } catch (error) {
+        if (pausePermanentlyDenied(error)) {
+          pauseDenied = true
+          pauseRequested = false
+        }
+        retryTransition()
+        return
+      }
+    }
+    const controller = new AbortController()
+    pendingRead = controller
+    // Process groups change as the shell runs jobs; revalidate them without blocking PTY output.
+    void Promise.resolve()
+      .then(() =>
+        options.readProcessTableAsync
+          ? options.readProcessTableAsync(controller.signal)
+          : options.readProcessTable
+            ? options.readProcessTable()
+            : readPosixPtyProcessTable(options.processHandle.pid, controller.signal)
+      )
+      .catch(() => '')
+      .then((table) => {
+        pendingRead = undefined
+        if (!needsTransition()) {
+          return
+        }
+        const nextPaused = pauseRequested
+        // Partial signals require a fresh transition even if the requested state changes again.
+        state = 'uncertain'
+        if (nextPaused) {
+          // Signal delivery is asynchronous; prove the shell stopped before suspending its jobs.
+          if (!isPosixPtyRootStopped(table, options.processHandle.pid)) {
+            retryTransition()
+            return
+          }
+          suspension.signal('SIGSTOP', table, true)
+        } else if (suspension.hasStoppedGroups()) {
+          suspension.signal('SIGCONT', table, true)
+        } else {
+          signalRoot('SIGCONT')
+        }
+        state = nextPaused ? 'paused' : 'running'
+      })
+      .catch((error) => {
+        if (pauseRequested && pausePermanentlyDenied(error)) {
+          pauseDenied = true
+          pauseRequested = false
+          reconcile()
+        } else {
+          retryTransition()
+        }
+      })
+  }
+
+  return {
+    pause() {
+      if (shuttingDown || options.isExited() || pauseDenied) {
+        return
+      }
+      clearTransitionRetry()
+      pauseRequested = true
+      reconcile()
+    },
+    resume() {
+      clearTransitionRetry()
+      pauseDenied = false
+      pauseRequested = false
+      reconcile()
+    },
+    resumeForShutdown() {
+      clearTransitionRetry()
+      shuttingDown = true
+      if (options.platform === 'win32') {
+        if (!options.isExited()) {
+          options.windowsJob?.resume()
+        }
+        state = 'running'
+        return
+      }
+      pendingRead?.abort()
+      try {
+        if (!options.isExited() && state !== 'running') {
+          // Teardown must release stopped jobs before the root receives its exit signal.
+          if (suspension.hasStoppedGroups()) {
+            suspension.signal('SIGCONT')
+          } else {
+            signalRoot('SIGCONT')
+          }
+        }
+      } catch {
+        // A failed resume must not prevent the caller from terminating the PTY.
+      }
+      state = 'running'
+    }
+  }
+}
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process-pause-retry.test.ts b/src/main/daemon/pty-subprocess/bun-pty-process-pause-retry.test.ts
new file mode 100644
index 00000000000..cbda02305ea
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process-pause-retry.test.ts
@@ -0,0 +1,128 @@
+import { constants } from 'node:os'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createBunPtyProducerFlowControl } from './bun-pty-process-flow-control'
+
+const TABLE = '4321 4321 pts/test T\n4322 4322 pts/test S'
+const settled = (): Promise<void> => new Promise((resolve) => setImmediate(resolve))
+
+function createHarness() {
+  let exited = false
+  const kill = vi.fn()
+  const signalProcessGroup = vi.fn()
+  const readProcessTableAsync = vi.fn<(signal: AbortSignal) => Promise<string>>()
+  const flow = createBunPtyProducerFlowControl({
+    platform: 'linux',
+    processHandle: { pid: 4321, kill, terminal: { closed: false, close() {} } },
+    windowsJob: null,
+    isExited: () => exited,
+    readProcessTableAsync,
+    signalProcessGroup
+  })
+  return { flow, kill, readProcessTableAsync, signalProcessGroup, exit: () => (exited = true) }
+}
+
+afterEach(() => vi.useRealTimers())
+
+describe('Bun producer pause retry', () => {
+  it('retries a failed root suspension before attempting any group signals', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createHarness()
+    harness.kill.mockImplementationOnce(() => {
+      throw new Error('temporary signal rejection')
+    })
+    harness.readProcessTableAsync.mockResolvedValue(TABLE)
+    harness.flow.pause()
+    await settled()
+    expect(harness.readProcessTableAsync).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(500)
+    expect(harness.kill.mock.calls).toEqual([
+      [constants.signals.SIGSTOP],
+      [constants.signals.SIGSTOP]
+    ])
+    expect(harness.signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP']
+    ])
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('keeps ownership discovery pending when the stopped root has no controlling tty', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createHarness()
+    harness.readProcessTableAsync.mockResolvedValueOnce('4321 4321 ? T').mockResolvedValue(TABLE)
+    harness.flow.pause()
+    await settled()
+    expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(500)
+    expect(harness.signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP']
+    ])
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it.each(['lookup failure', 'shell still running'])(
+    'eventually stops jobs after a transient %s without another pause request',
+    async (failure) => {
+      vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+      const harness = createHarness()
+      if (failure === 'lookup failure') {
+        harness.readProcessTableAsync.mockRejectedValueOnce(new Error('ps timed out'))
+      } else {
+        harness.readProcessTableAsync.mockResolvedValueOnce(TABLE.replace('test T', 'test S'))
+      }
+      harness.readProcessTableAsync.mockResolvedValue(TABLE)
+      harness.flow.pause()
+      await settled()
+      expect(harness.kill.mock.calls).toEqual([[constants.signals.SIGSTOP]])
+      expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+      await vi.advanceTimersByTimeAsync(499)
+      expect(harness.readProcessTableAsync).toHaveBeenCalledOnce()
+      await vi.advanceTimersByTimeAsync(1)
+      expect(harness.signalProcessGroup.mock.calls).toEqual([
+        [4321, 'SIGSTOP'],
+        [4322, 'SIGSTOP']
+      ])
+      expect(vi.getTimerCount()).toBe(0)
+      harness.flow.resume()
+      await settled()
+      expect(harness.signalProcessGroup.mock.calls.slice(2)).toEqual([
+        [4322, 'SIGCONT'],
+        [4321, 'SIGCONT']
+      ])
+    }
+  )
+
+  it.each(['resume', 'shutdown', 'exit'] as const)(
+    'bounds failed pause probes and cancels them after %s',
+    async (action) => {
+      vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+      const harness = createHarness()
+      harness.readProcessTableAsync.mockRejectedValue(new Error('ps unavailable'))
+      harness.flow.pause()
+      await settled()
+      await vi.advanceTimersByTimeAsync(2_000)
+      expect(harness.readProcessTableAsync).toHaveBeenCalledTimes(5)
+      expect(vi.getTimerCount()).toBe(1)
+      expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+      if (action === 'resume') {
+        harness.flow.resume()
+      } else {
+        if (action === 'exit') {
+          harness.exit()
+        }
+        harness.flow.resumeForShutdown()
+      }
+      await settled()
+      const reads = harness.readProcessTableAsync.mock.calls.length
+      await vi.advanceTimersByTimeAsync(5_000)
+      expect(harness.readProcessTableAsync).toHaveBeenCalledTimes(reads)
+      expect(vi.getTimerCount()).toBe(0)
+      expect(harness.kill.mock.calls).toEqual(
+        action === 'exit'
+          ? [[constants.signals.SIGSTOP]]
+          : [[constants.signals.SIGSTOP], [constants.signals.SIGCONT]]
+      )
+    }
+  )
+})
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process-runtime.ts b/src/main/daemon/pty-subprocess/bun-pty-process-runtime.ts
new file mode 100644
index 00000000000..b6409795043
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process-runtime.ts
@@ -0,0 +1,311 @@
+import { constants } from 'node:os'
+import {
+  assignCurrentProcessToBunPtyHostJob,
+  createWindowsBunPtyJob,
+  type WindowsBunPtyJob
+} from './windows-bun-pty-job'
+import { createWindowsBunPtyLaunch, type WindowsBunPtyLaunch } from './windows-bun-pty-launch'
+import type {
+  BunPtyProcess,
+  BunPtySpawnArgs,
+  BunSubprocess,
+  BunTerminal,
+  BunTerminalOptions,
+  SpawnBunPtyDeps
+} from './bun-pty-process-contract'
+import { resolveBunRuntime } from './bun-pty-process-capabilities'
+import { createBunPtyProducerFlowControl } from './bun-pty-process-flow-control'
+
+export function spawnBunPty(args: BunPtySpawnArgs, deps: SpawnBunPtyDeps = {}): BunPtyProcess {
+  const runtime = resolveBunRuntime(deps.runtime)
+
+  const platform = deps.platform ?? process.platform
+  let processHandle: BunSubprocess
+  let windowsLaunch: WindowsBunPtyLaunch | null = null
+  let windowsJob: WindowsBunPtyJob | null = null
+  let windowsTerminal: BunTerminal | null = null
+  let processExitCode: number | undefined
+  let terminalFinished = false
+  let clearInFlight: Promise<number> | null = null
+  const dataListeners = new Set<(data: string) => void>()
+  const exitListeners = new Set<(event: { exitCode: number; signal?: number }) => void>()
+  const decoder = new TextDecoder()
+  let pendingData = ''
+  let exited = false
+  let exitCode = 0
+  let exitSignal: number | undefined
+  // Keep a closed Bun native handle from escaping as a daemon RPC failure.
+  let terminalUnavailable = false
+  let appliedCols = args.cols
+  let appliedRows = args.rows
+
+  const emitData = (data: string): void => {
+    if (dataListeners.size === 0) {
+      pendingData = (pendingData + data).slice(-512 * 1024)
+      return
+    }
+    for (const listener of dataListeners) {
+      listener(data)
+    }
+  }
+  const onProcessExit = (code: number): void => {
+    processExitCode = code
+    windowsLaunch?.dispose()
+    if (!windowsTerminal || terminalFinished) {
+      emitExit(code)
+      return
+    }
+    // ConPTY closes off-thread; retain listeners until its final frame reaches EOF.
+    if (!windowsTerminal.closed) {
+      windowsTerminal.close()
+    }
+  }
+
+  const emitExit = (code: number): void => {
+    if (exited) {
+      return
+    }
+    exited = true
+    producerFlowControl.resumeForShutdown()
+    windowsLaunch?.readShellProcessId()
+    exitCode = code
+    exitSignal = Object.entries(constants.signals).find(
+      ([name]) => name === processHandle.signalCode
+    )?.[1]
+    const pending = decoder.decode()
+    if (pending) {
+      emitData(pending)
+    }
+    for (const dispose of [
+      () => (processHandle.terminal.closed ? undefined : processHandle.terminal.close()),
+      () => windowsJob?.close()
+    ]) {
+      try {
+        dispose()
+      } catch (error) {
+        console.warn('[daemon/pty] PTY cleanup failed:', error)
+      }
+    }
+    for (const listener of exitListeners) {
+      listener({ exitCode: code, ...(exitSignal === undefined ? {} : { signal: exitSignal }) })
+    }
+    dataListeners.clear()
+    exitListeners.clear()
+  }
+
+  if (platform === 'win32') {
+    if (!(deps.assignHostJob ?? assignCurrentProcessToBunPtyHostJob)()) {
+      throw new Error('Windows Bun PTY host crash ownership is unavailable')
+    }
+    windowsLaunch = (deps.createWindowsLaunch ?? createWindowsBunPtyLaunch)(args)
+  }
+  try {
+    const terminalOptions: BunTerminalOptions = {
+      cols: args.cols,
+      rows: args.rows,
+      name: args.env.TERM ?? 'xterm-256color',
+      data: (_terminal, data) => {
+        const decoded = decoder.decode(data, { stream: true })
+        if (decoded) {
+          emitData(decoded)
+        }
+      },
+      exit() {
+        terminalFinished = true
+        if (processExitCode !== undefined) {
+          emitExit(processExitCode)
+        }
+      }
+    }
+    // Inline Bun terminals cannot be reused by the Windows clear command.
+    if (windowsLaunch) {
+      windowsTerminal = new runtime.Terminal(terminalOptions)
+    }
+    processHandle = runtime.spawn(windowsLaunch?.command ?? [args.file, ...args.args], {
+      cwd: args.cwd,
+      env: windowsLaunch?.env ?? args.env,
+      ...(windowsLaunch
+        ? {
+            windowsVerbatimArguments: windowsLaunch.windowsVerbatimArguments
+          }
+        : {}),
+      terminal: windowsTerminal ?? terminalOptions
+    })
+  } catch (error) {
+    windowsTerminal?.close()
+    windowsLaunch?.dispose()
+    throw error
+  }
+  if (windowsLaunch) {
+    try {
+      windowsJob = (deps.createJob ?? createWindowsBunPtyJob)(processHandle.pid)
+      if (!windowsJob) {
+        throw new Error('Windows Bun PTY job ownership is unavailable')
+      }
+      windowsLaunch.release()
+    } catch (error) {
+      windowsJob?.terminate()
+      try {
+        processHandle.kill('SIGTERM')
+      } catch {
+        // The failed gate release still owns cleanup through the job when available.
+      }
+      if (!processHandle.terminal.closed) {
+        processHandle.terminal.close()
+      }
+      windowsJob?.close()
+      windowsLaunch.dispose()
+      // A running gate can temporarily lock its private working directory on Windows.
+      const disposeLaunch = (): void => windowsLaunch?.dispose()
+      void processHandle.exited.then(disposeLaunch, disposeLaunch)
+      throw error
+    }
+  }
+  void processHandle.exited.then(onProcessExit, () => onProcessExit(1))
+
+  const producerFlowControl = createBunPtyProducerFlowControl({
+    platform,
+    processHandle,
+    windowsJob,
+    isExited: () => exited,
+    ...(deps.readProcessTable ? { readProcessTable: deps.readProcessTable } : {}),
+    ...(deps.signalProcessGroup ? { signalProcessGroup: deps.signalProcessGroup } : {})
+  })
+
+  const windowsCapabilities = windowsJob
+    ? {
+        waitForSpawn: () => windowsLaunch?.waitForSpawn(processHandle.exited) ?? Promise.resolve(),
+        terminateOwnedTree: () => windowsJob?.terminate() ?? 'unavailable',
+        listOwnedProcessIds: () => windowsJob?.listProcessIds() ?? null,
+        jobRootProcessIsWrapper: true as const,
+        signalProcess(signal: string) {
+          if (signal === 'SIGWINCH') {
+            return
+          }
+          if (windowsJob?.terminate() === 'terminated') {
+            return
+          }
+          try {
+            processHandle.kill(signal)
+          } finally {
+            if (!processHandle.terminal.closed) {
+              processHandle.terminal.close()
+            }
+          }
+        }
+      }
+    : {}
+
+  const clearCapability = windowsLaunch
+    ? {
+        clear() {
+          if (exited || clearInFlight) {
+            return
+          }
+          try {
+            const clearProcess = runtime.spawn(windowsLaunch.clearCommand, {
+              cwd: args.cwd,
+              env: args.env,
+              terminal: processHandle.terminal,
+              windowsVerbatimArguments: true
+            })
+            clearInFlight = clearProcess.exited
+            const settled = (): void => {
+              clearInFlight = null
+            }
+            void clearInFlight.then(settled, settled)
+          } catch {
+            clearInFlight = null
+          }
+        }
+      }
+    : {}
+
+  const terminate = (signal: string): void => {
+    producerFlowControl.resumeForShutdown()
+    const treeTerminated = windowsJob?.terminate() === 'terminated'
+    try {
+      processHandle.kill(signal)
+    } catch (error) {
+      if (!treeTerminated) {
+        throw error
+      }
+    }
+  }
+
+  return {
+    pid: processHandle.pid,
+    get shellProcessId() {
+      return windowsLaunch?.readShellProcessId()
+    },
+    handleFlowControl: false,
+    processNameIsSpawnFile: true,
+    clear() {},
+    process: args.file,
+    get cols() {
+      return appliedCols
+    },
+    get rows() {
+      return appliedRows
+    },
+    onData(listener) {
+      if (pendingData) {
+        const data = pendingData
+        pendingData = ''
+        listener(data)
+      }
+      if (exited) {
+        return { dispose() {} }
+      }
+      dataListeners.add(listener)
+      return { dispose: () => dataListeners.delete(listener) }
+    },
+    onExit(listener) {
+      if (exited) {
+        listener({ exitCode, ...(exitSignal === undefined ? {} : { signal: exitSignal }) })
+        return { dispose() {} }
+      }
+      exitListeners.add(listener)
+      return { dispose: () => exitListeners.delete(listener) }
+    },
+    write(data) {
+      if (exited || terminalUnavailable || processHandle.terminal.closed) {
+        return
+      }
+      try {
+        processHandle.terminal.write(data)
+      } catch {
+        terminalUnavailable = true
+      }
+    },
+    resize(cols, rows) {
+      if (exited || terminalUnavailable || processHandle.terminal.closed) {
+        return
+      }
+      try {
+        processHandle.terminal.resize(cols, rows)
+        appliedCols = cols
+        appliedRows = rows
+      } catch {
+        terminalUnavailable = true
+      }
+    },
+    ...clearCapability,
+    ...producerFlowControl,
+    ...windowsCapabilities,
+    // Interactive POSIX shells ignore SIGTERM.
+    kill(signal = platform === 'win32' ? 'SIGTERM' : 'SIGHUP') {
+      if (!exited) {
+        terminate(signal)
+      }
+    },
+    destroy() {
+      if (!exited) {
+        terminate(platform === 'win32' ? 'SIGTERM' : 'SIGHUP')
+      }
+      if (!processHandle.terminal.closed) {
+        processHandle.terminal.close()
+      }
+    }
+  }
+}
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process-suspension.test.ts b/src/main/daemon/pty-subprocess/bun-pty-process-suspension.test.ts
new file mode 100644
index 00000000000..da7bf0c09e3
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process-suspension.test.ts
@@ -0,0 +1,214 @@
+import { constants } from 'node:os'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createBunPtyProducerFlowControl } from './bun-pty-process-flow-control'
+
+const TABLE = '4321 4321 pts/test T\n4322 4322 pts/test S\n4323 4323 pts/test T'
+const settled = (): Promise<void> => new Promise((resolve) => setImmediate(resolve))
+
+function harness(platform: NodeJS.Platform = 'linux') {
+  let exited = false
+  const kill = vi.fn()
+  const signalProcessGroup = vi.fn()
+  const readProcessTableAsync = vi.fn(async () => TABLE)
+  const windowsJob = {
+    listProcessIds: () => [],
+    pause: vi.fn(() => true),
+    resume: vi.fn(() => true),
+    terminate: () => 'terminated' as const,
+    close() {}
+  }
+  const flow = createBunPtyProducerFlowControl({
+    platform,
+    processHandle: { pid: 4321, kill, terminal: { closed: false, close() {} } },
+    windowsJob,
+    isExited: () => exited,
+    readProcessTable: () => TABLE,
+    readProcessTableAsync,
+    signalProcessGroup
+  })
+  return {
+    flow,
+    kill,
+    signalProcessGroup,
+    readProcessTableAsync,
+    windowsJob,
+    exit: () => (exited = true)
+  }
+}
+
+afterEach(() => vi.useRealTimers())
+
+describe('flow-control suspension ownership', () => {
+  it.each(['resume', 'shutdown'] as const)(
+    'preserves a Ctrl-Z stopped job during %s',
+    async (action) => {
+      const h = harness()
+      h.flow.pause()
+      await settled()
+      h.readProcessTableAsync.mockResolvedValue(TABLE.replace('4322 pts/test S', '4322 pts/test T'))
+      if (action === 'resume') {
+        h.flow.resume()
+      } else {
+        h.flow.resumeForShutdown()
+      }
+      await settled()
+      expect(h.signalProcessGroup.mock.calls).toEqual([
+        [4321, 'SIGSTOP'],
+        [4322, 'SIGSTOP'],
+        [4322, 'SIGCONT'],
+        [4321, 'SIGCONT']
+      ])
+    }
+  )
+
+  it('does not resume a group it already released when another group needs a retry', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const h = harness()
+    h.readProcessTableAsync.mockResolvedValue(TABLE.replace('4323 pts/test T', '4323 pts/test S'))
+    let failed = false
+    h.signalProcessGroup.mockImplementation((pgid, signal) => {
+      if (pgid === 4323 && signal === 'SIGCONT' && !failed) {
+        failed = true
+        throw new Error('temporary resume failure')
+      }
+    })
+    h.flow.pause()
+    await settled()
+    h.flow.resume()
+    await settled()
+    // The user can suspend a job again after its first successful resume.
+    h.readProcessTableAsync.mockResolvedValue(TABLE.replace('4322 pts/test S', '4322 pts/test T'))
+    await vi.advanceTimersByTimeAsync(500)
+    expect(
+      h.signalProcessGroup.mock.calls.filter(
+        ([pid, signal]) => pid === 4322 && signal === 'SIGCONT'
+      )
+    ).toHaveLength(1)
+    expect(h.signalProcessGroup).toHaveBeenLastCalledWith(4321, 'SIGCONT')
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it.each(['EPERM', 'EACCES'])('does not retry a root pause denied with %s', async (code) => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const h = harness()
+    h.kill.mockImplementationOnce(() => {
+      throw Object.assign(new Error('denied'), { code })
+    })
+    h.flow.pause()
+    await settled()
+    h.flow.pause()
+    await vi.advanceTimersByTimeAsync(30_000)
+    expect(h.kill.mock.calls).toEqual([[constants.signals.SIGSTOP]])
+    expect(h.readProcessTableAsync).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+    h.flow.resume()
+    h.flow.pause()
+    await settled()
+    expect(h.kill).toHaveBeenCalledTimes(2)
+    h.flow.resumeForShutdown()
+  })
+
+  it('rolls back acquired stops after a denied job pause without repeatedly scanning or resuming the denied job', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const h = harness()
+    h.readProcessTableAsync.mockResolvedValue(`${TABLE}\n4324 4324 pts/test S`)
+    h.signalProcessGroup.mockImplementation((pgid, signal) => {
+      if (pgid === 4324 && signal === 'SIGSTOP') {
+        throw Object.assign(new Error('denied'), { code: 'EPERM' })
+      }
+    })
+    h.flow.pause()
+    await settled()
+    await vi.advanceTimersByTimeAsync(30_000)
+    expect(h.signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP'],
+      [4324, 'SIGSTOP'],
+      [4322, 'SIGCONT'],
+      [4321, 'SIGCONT']
+    ])
+    expect(h.readProcessTableAsync).toHaveBeenCalledTimes(2)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('retains the resume obligation when rollback after a denied pause also fails', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const h = harness()
+    let failed = false
+    h.signalProcessGroup.mockImplementation((pgid, signal) => {
+      if (pgid === 4322 && signal === 'SIGSTOP') {
+        throw Object.assign(new Error('denied'), { code: 'EPERM' })
+      }
+      if (pgid === 4321 && signal === 'SIGCONT' && !failed) {
+        failed = true
+        throw Object.assign(new Error('resume denied'), { code: 'EPERM' })
+      }
+    })
+    h.flow.pause()
+    await settled()
+    expect(vi.getTimerCount()).toBe(1)
+    await vi.advanceTimersByTimeAsync(500)
+    expect(h.signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP'],
+      [4321, 'SIGCONT'],
+      [4321, 'SIGCONT']
+    ])
+    expect(vi.getTimerCount()).toBe(0)
+  })
+})
+
+describe('Windows resume retries', () => {
+  it('releases a failed partial pause without repeatedly attempting the denied pause', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const h = harness('win32')
+    h.windowsJob.pause.mockReturnValueOnce(false)
+    h.windowsJob.resume.mockReturnValueOnce(false)
+    h.flow.pause()
+    await vi.advanceTimersByTimeAsync(500)
+    expect(h.windowsJob.resume).toHaveBeenCalledOnce()
+    await vi.advanceTimersByTimeAsync(500)
+    expect(h.windowsJob.resume).toHaveBeenCalledTimes(2)
+    expect(h.windowsJob.pause).toHaveBeenCalledOnce()
+    expect(vi.getTimerCount()).toBe(0)
+    h.flow.pause()
+    expect(h.windowsJob.pause).toHaveBeenCalledTimes(2)
+    h.flow.resumeForShutdown()
+  })
+
+  it('retries a failed resume without another caller transition', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const h = harness('win32')
+    h.windowsJob.resume.mockReturnValueOnce(false)
+    h.flow.pause()
+    h.flow.resume()
+    expect(h.windowsJob.resume).toHaveBeenCalledOnce()
+    await vi.advanceTimersByTimeAsync(500)
+    expect(h.windowsJob.resume).toHaveBeenCalledTimes(2)
+    expect(vi.getTimerCount()).toBe(0)
+    expect(h.readProcessTableAsync).not.toHaveBeenCalled()
+  })
+
+  it.each(['pause', 'shutdown', 'exit'] as const)(
+    'cancels stale resume retries after %s',
+    async (action) => {
+      vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+      const h = harness('win32')
+      h.windowsJob.resume.mockReturnValue(false)
+      h.flow.pause()
+      h.flow.resume()
+      if (action === 'pause') {
+        h.flow.pause()
+      } else {
+        if (action === 'exit') {
+          h.exit()
+        }
+        h.flow.resumeForShutdown()
+      }
+      const resumes = h.windowsJob.resume.mock.calls.length
+      await vi.advanceTimersByTimeAsync(5_000)
+      expect(h.windowsJob.resume).toHaveBeenCalledTimes(resumes)
+      expect(vi.getTimerCount()).toBe(0)
+    }
+  )
+})
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process-suspension.ts b/src/main/daemon/pty-subprocess/bun-pty-process-suspension.ts
new file mode 100644
index 00000000000..3fc20931d5c
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process-suspension.ts
@@ -0,0 +1,78 @@
+import {
+  getPosixPtyStoppedJobGroups,
+  signalPosixPtyProcessGroups
+} from '../../pty/posix-pty-process-groups'
+
+export function createBunPtyProcessSuspension(options: {
+  pid: number
+  platform: NodeJS.Platform
+  signalRoot: (signal: 'SIGSTOP' | 'SIGCONT') => void
+  readProcessTable?: () => string
+  signalProcessGroup?: (pgid: number, signal: NodeJS.Signals) => void
+}) {
+  const stoppedGroups = new Set<number>()
+  return {
+    hasStoppedGroups: () => stoppedGroups.size > 0,
+    signal(signal: 'SIGSTOP' | 'SIGCONT', table?: string, requireGroups = false): void {
+      const alreadyStopped =
+        signal === 'SIGSTOP' && table !== undefined
+          ? getPosixPtyStoppedJobGroups(table, options.pid)
+          : new Set<number>()
+      let resumeFailed = false
+      signalPosixPtyProcessGroups(
+        options.pid,
+        signal,
+        () => {
+          if (requireGroups) {
+            throw new Error('Paused PTY group ownership is unavailable')
+          }
+          options.signalRoot(signal)
+        },
+        {
+          platform: options.platform,
+          ...(table !== undefined
+            ? { readProcessTable: () => table }
+            : options.readProcessTable
+              ? { readProcessTable: options.readProcessTable }
+              : {}),
+          signalProcessGroup(pgid) {
+            if (
+              signal === 'SIGSTOP'
+                ? alreadyStopped.has(pgid) && !stoppedGroups.has(pgid)
+                : !stoppedGroups.has(pgid)
+            ) {
+              return
+            }
+            // Keep the shell stopped until every preceding job group has resumed.
+            if (signal === 'SIGCONT' && requireGroups && resumeFailed) {
+              throw new Error('An earlier PTY group could not be resumed')
+            }
+            try {
+              if (options.signalProcessGroup) {
+                options.signalProcessGroup(pgid, signal)
+              } else {
+                process.kill(-pgid, signal)
+              }
+            } catch (error) {
+              const gone = error instanceof Error && 'code' in error && error.code === 'ESRCH'
+              if (gone) {
+                stoppedGroups.delete(pgid)
+              }
+              resumeFailed = !gone
+              throw error
+            }
+            if (signal === 'SIGSTOP') {
+              stoppedGroups.add(pgid)
+            } else {
+              stoppedGroups.delete(pgid)
+            }
+          }
+        }
+      )
+      if (signal === 'SIGCONT') {
+        // A fresh successful scan also retires groups that no longer belong to this terminal.
+        stoppedGroups.clear()
+      }
+    }
+  }
+}
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process.integration.test.ts b/src/main/daemon/pty-subprocess/bun-pty-process.integration.test.ts
new file mode 100644
index 00000000000..1c4f0436d6f
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process.integration.test.ts
@@ -0,0 +1,298 @@
+import { existsSync, mkdtempSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { runProcess, runProcessSync } from '../../../shared/child-process/run-process'
+import { orcadBunRuntimeFilename } from '../../../shared/orcad-artifacts'
+import { ORCAD_BUN_VERSION } from '../../../shared/orcad-bun-runtime'
+import { removeTreeSync } from '../../../shared/windows-transient-lock-removal'
+
+const runtimePath =
+  process.env.BUN_EXECUTABLE ??
+  resolve(__dirname, '../../../../out/orcad', orcadBunRuntimeFilename(process.platform))
+
+async function runTerminalScript(script: string): Promise<unknown> {
+  expect(runProcessSync({ program: runtimePath, args: ['--version'] }).stdout.trim()).toBe(
+    ORCAD_BUN_VERSION
+  )
+  const directory = mkdtempSync(join(tmpdir(), 'orca-bun-terminal-'))
+  try {
+    const entry = join(directory, 'terminal.cjs')
+    writeFileSync(
+      entry,
+      [
+        `const {spawnBunPty} = require(${JSON.stringify(join(__dirname, 'bun-pty-process.ts'))})`,
+        `const args = {file: process.execPath, cwd: ${JSON.stringify(directory)}, env: process.env, cols: 80, rows: 24}`,
+        script
+      ].join('\n')
+    )
+    const result = await runProcess({ program: runtimePath, args: [entry], timeoutMs: 30_000 })
+    expect(result.timedOut).toBe(false)
+    expect(result.code, result.stderr).toBe(0)
+    return JSON.parse(result.stdout)
+  } finally {
+    removeTreeSync(directory)
+  }
+}
+
+describe.skipIf(!existsSync(runtimePath) || process.platform === 'win32')(
+  'real Bun terminal',
+  () => {
+    it('drains multi-byte output before publishing process exit and applies resize', async () => {
+      const result = await runTerminalScript(`
+      const expected = '⌘状態'.repeat(200_000)
+      const proc = spawnBunPty({...args, args: ['-e', 'process.stdout.write("⌘状態".repeat(200000));process.exitCode=17']})
+      let output = ''
+      proc.resize(103, 37)
+      proc.onData(data => output += data)
+      proc.onExit(event => {
+        console.log(JSON.stringify({event, exact: output === expected, cols:proc.cols, rows:proc.rows}))
+        proc.destroy()
+      })
+    `)
+      expect(result).toEqual({ event: { exitCode: 17 }, exact: true, cols: 103, rows: 37 })
+    })
+
+    it('receives the real shell identity from a gated Bun subprocess', async () => {
+      const result = await runTerminalScript(`
+      const {createWindowsBunPtyLaunch} = require(${JSON.stringify(join(__dirname, 'windows-bun-pty-launch.ts'))})
+      const proc = spawnBunPty({...args,args:['-e','setTimeout(()=>{process.exitCode=17},100)']}, {
+        platform:'win32', assignHostJob:()=>true,
+        createJob:()=>({listProcessIds:()=>[], pause:()=>true,resume:()=>true,terminate:()=> 'terminated',close(){}}),
+        createWindowsLaunch:launch => createWindowsBunPtyLaunch(launch, {
+          runtimePath:process.execPath,workerPath:${JSON.stringify(join(__dirname, 'windows-bun-pty-gate-entry.ts'))}
+        })
+      })
+      proc.onExit(event => {
+        console.log(JSON.stringify({event, shellIdentified:proc.shellProcessId>0 && proc.shellProcessId!==proc.pid}))
+        proc.destroy()
+      })
+    `)
+      expect(result).toEqual({ event: { exitCode: 17 }, shellIdentified: true })
+    })
+
+    it('reports signal termination distinctly from an ordinary exit', async () => {
+      const result = await runTerminalScript(`
+      const proc = spawnBunPty({...args,args:['-e', 'console.log("ready");setInterval(()=>{},1000)']})
+      proc.onData(() => proc.kill('SIGTERM'))
+      proc.onExit(event => { console.log(JSON.stringify(event));proc.destroy() })
+    `)
+      expect(result).toEqual({ exitCode: 143, signal: 15 })
+    })
+
+    it('pauses and resumes the owned process when process discovery is unavailable', async () => {
+      const result = await runTerminalScript(`
+      const expected = 'ready' + 'x'.repeat(1024 * 1024)
+      const continueOutput = require('node:path').join(args.cwd, 'continue-output')
+      const proc = spawnBunPty({...args,env:{...args.env,ORCA_TEST_CONTINUE:continueOutput},args:['-e','process.stdout.write("ready");const timer=setInterval(()=>{if(!require("node:fs").existsSync(process.env.ORCA_TEST_CONTINUE))return;clearInterval(timer);process.stdout.write("x".repeat(1024*1024))},1)']},{readProcessTable:()=>''})
+      let output = '', paused = false, stable = false
+      proc.onData(data => {
+        output += data
+        if (paused) return
+        paused = true
+        proc.pause()
+        setTimeout(() => {
+          const settled = output.length
+          require('node:fs').writeFileSync(continueOutput, 'continue')
+          setTimeout(() => { stable = output.length === settled;proc.resume() }, 150)
+        }, 150)
+      })
+      proc.onExit(event => {
+        console.log(JSON.stringify({event,stable,exact:output===expected}))
+        proc.destroy()
+      })
+    `)
+      expect(result).toEqual({ event: { exitCode: 0 }, stable: true, exact: true })
+    })
+
+    it.skipIf(!existsSync('/bin/bash')).each([
+      [false, 0],
+      [false, 100],
+      [true, 0],
+      [true, 100]
+    ] as const)(
+      'stops foreground and background floods without losing output (resume failure: %s, signal gap: %sms)',
+      async (rejectFirstResume, stopSignalGapMs) => {
+        const result = await runTerminalScript(`
+      const expected = 16 * 1024 * 1024
+      const {join} = require('node:path')
+      const {writeFileSync,existsSync} = require('node:fs')
+      const producer = join(args.cwd, 'producer.cjs')
+      const backgroundReady = join(args.cwd, 'background-ready')
+      const foregroundReady = join(args.cwd, 'foreground-ready')
+      const go = join(args.cwd, 'go')
+      const continueOutput = join(args.cwd, 'continue-output')
+      writeFileSync(producer, [
+        'const {writeFileSync,existsSync}=require("node:fs")',
+        'writeFileSync(process.argv[2],"ready")',
+        'const deadline=setTimeout(()=>process.exit(97),10000)',
+        'const ready=setInterval(()=>{if(!existsSync(process.argv[3]))return;clearInterval(ready);process.stdout.write("x".repeat(65536));const continued=setInterval(()=>{if(!existsSync(process.argv[4]))return;clearInterval(continued);clearTimeout(deadline);let count=1;const timer=setInterval(()=>{process.stdout.write("x".repeat(65536));if(++count===128)clearInterval(timer)},1)},1)},1)'
+      ].join(';'))
+      const groups = new Set()
+      let bytes = 0, paused = false, settledBytes = 0, stable = false, verifying = false, rejectedResume = false
+      const proc = spawnBunPty({
+        ...args, file:'/bin/bash',
+        args:['--noprofile','--norc','-i','-c','exec 2>/dev/null; "$ORCA_TEST_RUNTIME" "$ORCA_TEST_PRODUCER" "$ORCA_TEST_BACKGROUND_READY" "$ORCA_TEST_GO" "$ORCA_TEST_CONTINUE" & "$ORCA_TEST_RUNTIME" "$ORCA_TEST_PRODUCER" "$ORCA_TEST_FOREGROUND_READY" "$ORCA_TEST_GO" "$ORCA_TEST_CONTINUE"; wait'],
+        env:{...args.env,ORCA_TEST_RUNTIME:process.execPath,ORCA_TEST_PRODUCER:producer,ORCA_TEST_BACKGROUND_READY:backgroundReady,ORCA_TEST_FOREGROUND_READY:foregroundReady,ORCA_TEST_GO:go,ORCA_TEST_CONTINUE:continueOutput}
+      },{signalProcessGroup:(pgid,signal)=>{
+        if (signal === 'SIGCONT' && ${rejectFirstResume} && !rejectedResume) {
+          rejectedResume = true
+          throw Object.assign(new Error('transient resume failure'), {code:'EPERM'})
+        }
+        process.kill(-pgid,signal)
+        if (signal === 'SIGSTOP') {
+          groups.add(pgid)
+          // Give Bash time to react between signals; stopping its jobs first can end its wait.
+          Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ${stopSignalGapMs})
+        }
+        if (groups.size < 3 || verifying) return
+        verifying = true
+        writeFileSync(continueOutput, 'continue')
+        setTimeout(() => {
+          settledBytes = bytes
+          setTimeout(() => { stable = bytes === settledBytes;proc.resume() }, 150)
+        },150)
+      }})
+      const ready = setInterval(() => {
+        if (!existsSync(backgroundReady) || !existsSync(foregroundReady)) return
+        clearInterval(ready)
+        writeFileSync(go, 'go')
+      }, 5)
+      let beats = 0
+      const heartbeat = setInterval(() => beats++, 5)
+      proc.onData(data => {
+        bytes += data.length
+        // Drain both initial writes before measuring whether stopped producers emit more.
+        if (!paused && bytes === 2 * 65536) {
+          paused = true
+          proc.pause()
+        }
+      })
+      proc.onExit(event => {
+        clearInterval(ready)
+        clearInterval(heartbeat)
+        console.log(JSON.stringify({event,stable,exact:bytes===expected,pausedBeforeExit:settledBytes<expected,responsive:beats>10,jobControlGroups:groups.size>=3,rejectedResume}))
+        proc.destroy()
+      })
+    `)
+        expect(result).toEqual({
+          event: { exitCode: 0 },
+          stable: true,
+          exact: true,
+          pausedBeforeExit: true,
+          responsive: true,
+          jobControlGroups: true,
+          rejectedResume: rejectFirstResume
+        })
+      }
+    )
+  }
+)
+
+describe.skipIf(!existsSync(runtimePath) || process.platform !== 'win32')(
+  'native Windows Bun terminal',
+  () => {
+    it('falls back after actual shell spawn rejection and cleans each private launch directory', async () => {
+      const result = await runTerminalScript(`
+      const {spawnNativeDaemonPty} = require(${JSON.stringify(join(__dirname, 'native-pty-spawn.ts'))})
+      const {createWindowsBunPtyLaunch} = require(${JSON.stringify(join(__dirname, 'windows-bun-pty-launch.ts'))})
+      const {existsSync} = require('node:fs')
+      const {dirname,join} = require('node:path')
+      const directories = []
+      const attempts = [join(args.cwd,'missing-pwsh.exe'),join(args.cwd,'missing-powershell.exe'),process.execPath].map(shellPath=>({
+        shellPath,shellArgs:['-e','process.exitCode=17'],effectiveCwd:args.cwd,validationCwd:args.cwd,startupCommandDeliveredInShellArgs:true
+      }))
+      spawnNativeDaemonPty({
+        shellPath:attempts[0].shellPath,shellArgs:attempts[0].shellArgs,spawnCwd:args.cwd,
+        env:args.env,cols:80,rows:24,windowsFallbackAttempts:attempts
+      }, {canUseBunPty:()=>true, spawnBunPty:options=>spawnBunPty(options, {
+        createWindowsLaunch:launchArgs=>{
+          const launch = createWindowsBunPtyLaunch(launchArgs, {
+            runtimePath:process.execPath,workerPath:${JSON.stringify(join(__dirname, 'windows-bun-pty-gate-entry.ts'))}
+          })
+          directories.push(dirname(launch.command.at(-1)))
+          return launch
+        }
+      })}).then(({process:proc,shellPath})=>{
+        proc.onExit(event=>{
+          console.log(JSON.stringify({event,fallback:shellPath===process.execPath,attempts:directories.length,cleaned:directories.every(path=>!existsSync(path))}))
+          proc.destroy()
+        })
+      }).catch(error=>{console.error(error);process.exitCode=1})
+    `)
+      expect(result).toEqual({
+        event: { exitCode: 17 },
+        fallback: true,
+        attempts: 3,
+        cleaned: true
+      })
+    }, 35_000)
+
+    it('enumerates and suspends a native job with more than 64 processes', async () => {
+      const result = await runTerminalScript(`
+      const {createWindowsBunPtyLaunch} = require(${JSON.stringify(join(__dirname, 'windows-bun-pty-launch.ts'))})
+      const script = 'for(let i=0;i<65;i++)Bun.spawn([process.execPath,"-e","setInterval(()=>{},1000)"],{stdin:"ignore",stdout:"ignore",stderr:"ignore"});setInterval(()=>console.log("tick"),10)'
+      const proc = spawnBunPty({...args,args:['-e',script]}, {
+        createWindowsLaunch:launch => createWindowsBunPtyLaunch(launch, {
+          runtimePath:process.execPath,workerPath:${JSON.stringify(join(__dirname, 'windows-bun-pty-gate-entry.ts'))}
+        })
+      })
+      let bytes=0,started=false,evidence
+      proc.onData(data=>{
+        bytes+=data.length
+        if(started || !data.includes('tick'))return
+        const members=proc.listOwnedProcessIds()
+        if(!members || members.length<67)return
+        started=true
+        proc.pause()
+        setTimeout(()=>{
+          const pausedBytes=bytes
+          setTimeout(()=>{
+            const stopped=bytes===pausedBytes
+            proc.resume()
+            setTimeout(()=>{
+              evidence={members:members.length,stopped,resumed:bytes>pausedBytes}
+              proc.kill()
+            },150)
+          },150)
+        },150)
+      })
+      proc.onExit(()=>{
+        console.log(JSON.stringify(evidence))
+        proc.destroy()
+      })
+    `)
+      expect(result).toEqual({ members: 67, stopped: true, resumed: true })
+    }, 35_000)
+
+    it('opens ConPTY without IPC and identifies the shell inside its job', async () => {
+      const result = await runTerminalScript(`
+      const {createWindowsBunPtyLaunch} = require(${JSON.stringify(join(__dirname, 'windows-bun-pty-launch.ts'))})
+      const proc = spawnBunPty({...args,args:['-e','console.log("ready");setInterval(()=>{},1000)']}, {
+        createWindowsLaunch:launch => createWindowsBunPtyLaunch(launch, {
+          runtimePath:process.execPath,workerPath:${JSON.stringify(join(__dirname, 'windows-bun-pty-gate-entry.ts'))}
+        })
+      })
+      let output = '', evidence
+      proc.onData(data => output += data)
+      const timer = setInterval(() => {
+        const shell = proc.shellProcessId
+        const members = proc.listOwnedProcessIds()
+        if (!output.includes('ready') || !shell || !members?.includes(shell)) return
+        clearInterval(timer)
+        evidence = {distinctShell:shell!==proc.pid, gateOwned:members.includes(proc.pid), shellOwned:true}
+        proc.kill()
+      }, 10)
+      proc.onExit(event => {
+        clearInterval(timer)
+        console.log(JSON.stringify({evidence, exited:event.exitCode!==undefined}))
+        proc.destroy()
+      })
+    `)
+      expect(result).toEqual({
+        evidence: { distinctShell: true, gateOwned: true, shellOwned: true },
+        exited: true
+      })
+    })
+  }
+)
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process.test.ts b/src/main/daemon/pty-subprocess/bun-pty-process.test.ts
new file mode 100644
index 00000000000..6726524f53d
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process.test.ts
@@ -0,0 +1,652 @@
+import { constants } from 'node:os'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { canUseBunPty, spawnBunPty } from './bun-pty-process'
+import type { BunRuntime, BunTerminalOptions } from './bun-pty-process-contract'
+import { readWindowsPtyJobProcessIds } from '../../providers/windows-pty-job-membership'
+import * as posixPtyGroups from '../../pty/posix-pty-process-groups'
+
+type FakeTerminal = {
+  closed: boolean
+  write(data: string | ArrayBufferView): number
+  resize(cols: number, rows: number): void
+  close(): void
+}
+
+let testRuntime: NonNullable<Parameters<typeof spawnBunPty>[1]>['runtime']
+
+function createBunHarness({ closeImmediately = true } = {}) {
+  let resolveExit: (code: number) => void = () => {}
+  let windowsTerminalOptions: BunTerminalOptions | undefined
+  const terminal: FakeTerminal = {
+    closed: false,
+    write: vi.fn(() => 1),
+    resize: vi.fn(),
+    close: vi.fn(function (this: FakeTerminal) {
+      this.closed = true
+      if (closeImmediately) {
+        windowsTerminalOptions?.exit?.(terminal, 0, null)
+      }
+    })
+  }
+  const processHandle = {
+    pid: 4321,
+    terminal,
+    kill: vi.fn(),
+    exited: new Promise<number>((resolve) => {
+      resolveExit = resolve
+    })
+  }
+  const spawn = vi.fn(
+    (_command: string[], _options: Parameters<BunRuntime['spawn']>[1]) => processHandle
+  )
+  testRuntime = {
+    Terminal: class {
+      closed = false
+      write = terminal.write
+      resize = terminal.resize
+      close = terminal.close
+      constructor(options: BunTerminalOptions) {
+        windowsTerminalOptions = options
+        return terminal
+      }
+    },
+    spawn
+  }
+  const emitData = (data: Uint8Array<ArrayBuffer>): void => {
+    const options = spawn.mock.calls[0]?.[1]
+    const callbacks =
+      windowsTerminalOptions ??
+      (options && 'data' in options.terminal ? options.terminal : undefined)
+    if (!callbacks) {
+      throw new Error('missing terminal callbacks')
+    }
+    callbacks.data(terminal, data)
+  }
+  return {
+    processHandle,
+    resolveExit,
+    spawn,
+    terminal,
+    emitData,
+    finishTerminal: () => windowsTerminalOptions?.exit?.(terminal, 0, null)
+  }
+}
+
+function spawn(deps?: Parameters<typeof spawnBunPty>[1]) {
+  return spawnBunPty(
+    {
+      file: '/bin/sh',
+      args: ['-l'],
+      cwd: '/tmp',
+      env: { TERM: 'xterm-256color' },
+      cols: 80,
+      rows: 24
+    },
+    { platform: 'linux', runtime: testRuntime, ...deps }
+  )
+}
+
+afterEach(() => {
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+  testRuntime = undefined
+})
+
+describe('Bun.Terminal PTY adapter', () => {
+  it('cancels a pending ownership lookup on natural exit without delivering a late stop', async () => {
+    const harness = createBunHarness()
+    let finishRead: (table: string) => void = () => {}
+    const read = vi.spyOn(posixPtyGroups, 'readPosixPtyProcessTable').mockImplementation(
+      () =>
+        new Promise<string>((resolve) => {
+          finishRead = resolve
+        })
+    )
+    const signalProcessGroup = vi.fn()
+    const proc = spawn({ signalProcessGroup })
+    proc.pause()
+    await new Promise<void>((resolve) => setImmediate(resolve))
+    const signal = read.mock.calls[0][1]
+    expect(signal?.aborted).toBe(false)
+    harness.resolveExit(0)
+    await harness.processHandle.exited
+    expect(signal?.aborted).toBe(true)
+    finishRead('4321 4321 pts/test T\n4322 4322 pts/test')
+    await new Promise<void>((resolve) => setImmediate(resolve))
+    expect(signalProcessGroup).not.toHaveBeenCalled()
+    expect(harness.processHandle.kill.mock.calls).toEqual([[constants.signals.SIGSTOP]])
+  })
+
+  it('cancels a queued resume retry immediately on natural exit', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createBunHarness()
+    const read = vi
+      .spyOn(posixPtyGroups, 'readPosixPtyProcessTable')
+      .mockResolvedValueOnce('4321 4321 pts/test T\n4322 4322 pts/test')
+      .mockRejectedValueOnce(new Error('temporary ps failure'))
+    const signalProcessGroup = vi.fn()
+    const proc = spawn({ signalProcessGroup })
+    proc.pause()
+    await new Promise<void>((resolve) => setImmediate(resolve))
+    proc.resume()
+    await new Promise<void>((resolve) => setImmediate(resolve))
+    expect(vi.getTimerCount()).toBe(1)
+    harness.resolveExit(0)
+    await harness.processHandle.exited
+    expect(vi.getTimerCount()).toBe(0)
+    await vi.advanceTimersByTimeAsync(5_000)
+    expect(read).toHaveBeenCalledTimes(2)
+    expect(signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP']
+    ])
+    expect(harness.processHandle.kill.mock.calls).toEqual([[constants.signals.SIGSTOP]])
+  })
+
+  it('exposes initial and successfully applied dimensions for terminal inspection', () => {
+    const harness = createBunHarness()
+    const proc = spawn()
+    expect({ cols: proc.cols, rows: proc.rows }).toEqual({ cols: 80, rows: 24 })
+    proc.resize(103, 37)
+    expect(harness.terminal.resize).toHaveBeenCalledWith(103, 37)
+    expect({ cols: proc.cols, rows: proc.rows }).toEqual({ cols: 103, rows: 37 })
+  })
+
+  it.each(['closed', 'exited', 'failed'] as const)(
+    'retains last applied dimensions when resize is %s',
+    async (reason) => {
+      const harness = createBunHarness()
+      const proc = spawn()
+      proc.resize(103, 37)
+      if (reason === 'closed') {
+        harness.terminal.closed = true
+      }
+      if (reason === 'exited') {
+        harness.resolveExit(0)
+        await harness.processHandle.exited
+      }
+      if (reason === 'failed') {
+        vi.mocked(harness.terminal.resize).mockImplementationOnce(() => {
+          throw new Error('closed')
+        })
+      }
+      proc.resize(120, 40)
+      expect({ cols: proc.cols, rows: proc.rows }).toEqual({ cols: 103, rows: 37 })
+    }
+  )
+
+  it('requires Bun.Terminal as well as Bun.spawn', () => {
+    const spawn = vi.fn()
+    expect(canUseBunPty({ spawn })).toBe(false)
+    expect(canUseBunPty({ Terminal: class {}, spawn })).toBe(true)
+  })
+
+  it('streams split UTF-8 and reports exit to current and late listeners', async () => {
+    const harness = createBunHarness()
+    const proc = spawn()
+    const onData = vi.fn()
+    const onExit = vi.fn()
+    proc.onData(onData)
+    proc.onExit(onExit)
+
+    const bytes = new TextEncoder().encode('⌘状')
+    harness.emitData(bytes.slice(0, 2))
+    expect(onData).not.toHaveBeenCalled()
+    harness.emitData(bytes.slice(2))
+    expect(onData).toHaveBeenCalledWith('⌘状')
+
+    harness.resolveExit(7)
+    await harness.processHandle.exited
+    await Promise.resolve()
+    expect(onExit).toHaveBeenCalledWith({ exitCode: 7 })
+
+    const lateExit = vi.fn()
+    proc.onExit(lateExit)
+    expect(lateExit).toHaveBeenCalledWith({ exitCode: 7 })
+  })
+
+  it('preserves output arriving before the first data listener', () => {
+    const harness = createBunHarness()
+    const proc = spawn()
+    harness.emitData(new TextEncoder().encode('startup output'))
+    const listener = vi.fn()
+    proc.onData(listener)
+    expect(listener).toHaveBeenCalledWith('startup output')
+  })
+
+  it('preserves signal termination and never signals the exited handle during disposal', async () => {
+    const harness = createBunHarness()
+    const proc = spawn()
+    Object.assign(harness.processHandle, { signalCode: 'SIGTERM' })
+    harness.resolveExit(143)
+    await harness.processHandle.exited
+    await Promise.resolve()
+    const listener = vi.fn()
+    proc.onExit(listener)
+    proc.destroy()
+    expect(listener).toHaveBeenCalledWith({ exitCode: 143, signal: 15 })
+    expect(harness.processHandle.kill).not.toHaveBeenCalled()
+    expect(harness.terminal.close).toHaveBeenCalledOnce()
+  })
+
+  it('disposes data and exit listeners without retaining them', async () => {
+    const harness = createBunHarness()
+    const proc = spawn()
+    const onData = vi.fn()
+    const onExit = vi.fn()
+    const dataSubscription = proc.onData(onData)
+    const exitSubscription = proc.onExit(onExit)
+
+    dataSubscription.dispose()
+    exitSubscription.dispose()
+    harness.emitData(new TextEncoder().encode('ignored'))
+    harness.resolveExit(0)
+    await harness.processHandle.exited
+    await Promise.resolve()
+
+    expect(onData).not.toHaveBeenCalled()
+    expect(onExit).not.toHaveBeenCalled()
+  })
+
+  it.each(['darwin', 'linux'] as const)(
+    'forwards input, resize, hangup, explicit signals, and destroy on %s',
+    (platform) => {
+      const harness = createBunHarness()
+      const proc = spawn({ platform })
+
+      proc.write('hello')
+      proc.resize(120, 40)
+      proc.kill()
+      proc.kill('SIGTERM')
+      proc.kill('SIGINT')
+      proc.kill('SIGKILL')
+      proc.destroy()
+
+      expect(harness.terminal.write).toHaveBeenCalledWith('hello')
+      expect(harness.terminal.resize).toHaveBeenCalledWith(120, 40)
+      expect(harness.processHandle.kill.mock.calls).toEqual([
+        ['SIGHUP'],
+        ['SIGTERM'],
+        ['SIGINT'],
+        ['SIGKILL'],
+        ['SIGHUP']
+      ])
+      expect(harness.terminal.close).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('destroys a still-running process even if its terminal has already closed', () => {
+    const harness = createBunHarness()
+    const proc = spawn()
+    harness.terminal.closed = true
+    proc.destroy()
+    expect(harness.processHandle.kill).toHaveBeenCalledWith('SIGHUP')
+    expect(harness.terminal.close).not.toHaveBeenCalled()
+  })
+
+  it('contains a native terminal write failure and suppresses later writes', () => {
+    const harness = createBunHarness()
+    harness.terminal.write = vi.fn(() => {
+      throw new Error('terminal closed')
+    })
+    const proc = spawn()
+
+    expect(() => proc.write('first')).not.toThrow()
+    proc.write('second')
+
+    expect(harness.terminal.write).toHaveBeenCalledOnce()
+  })
+
+  it('contains a native terminal resize failure and suppresses later resizes', () => {
+    const harness = createBunHarness()
+    harness.terminal.resize = vi.fn(() => {
+      throw new Error('terminal closed')
+    })
+    const proc = spawn()
+
+    expect(() => proc.resize(120, 40)).not.toThrow()
+    proc.resize(100, 30)
+
+    expect(harness.terminal.resize).toHaveBeenCalledOnce()
+  })
+
+  it('pauses and resumes the POSIX producer process group once per transition', async () => {
+    createBunHarness()
+    const signalProcessGroup = vi.fn()
+    const proc = spawn({
+      readProcessTable: () => ' 4321 4321 pts/test T\n 4322 4322 pts/test',
+      signalProcessGroup
+    })
+
+    proc.pause()
+    proc.pause()
+    await vi.waitFor(() => expect(signalProcessGroup).toHaveBeenCalledTimes(2))
+    proc.resume()
+    proc.resume()
+    await vi.waitFor(() => expect(signalProcessGroup).toHaveBeenCalledTimes(4))
+
+    expect(signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP'],
+      [4322, 'SIGCONT'],
+      [4321, 'SIGCONT']
+    ])
+  })
+
+  it('resumes a paused process group before graceful shutdown', async () => {
+    const harness = createBunHarness()
+    const signalProcessGroup = vi.fn()
+    const proc = spawn({
+      readProcessTable: () => ' 4321 4321 pts/test T\n 4322 4322 pts/test',
+      signalProcessGroup
+    })
+
+    proc.pause()
+    await vi.waitFor(() => expect(signalProcessGroup).toHaveBeenCalledTimes(2))
+    proc.kill()
+
+    expect(signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP'],
+      [4322, 'SIGCONT'],
+      [4321, 'SIGCONT']
+    ])
+    expect(harness.processHandle.kill).toHaveBeenCalledWith('SIGHUP')
+  })
+
+  it('falls back to Bun process signals when group signaling is unavailable', async () => {
+    const harness = createBunHarness()
+    vi.spyOn(process, 'kill').mockImplementation(() => {
+      throw Object.assign(new Error('not supported'), { code: 'EINVAL' })
+    })
+    const proc = spawn({ readProcessTable: () => '' })
+
+    proc.pause()
+    await vi.waitFor(() =>
+      expect(harness.processHandle.kill).toHaveBeenCalledWith(constants.signals.SIGSTOP)
+    )
+    proc.resume()
+    await vi.waitFor(() =>
+      expect(harness.processHandle.kill).toHaveBeenCalledWith(constants.signals.SIGCONT)
+    )
+
+    expect(harness.processHandle.kill.mock.calls).toEqual([
+      [constants.signals.SIGSTOP],
+      [constants.signals.SIGCONT]
+    ])
+  })
+
+  it('gates a Windows shell behind exact job ownership and exposes owned capabilities', async () => {
+    const harness = createBunHarness({ closeImmediately: false })
+    const assignHostJob = vi.fn(() => true)
+    const release = vi.fn()
+    const dispose = vi.fn()
+    const waitForSpawn = vi.fn(async () => {})
+    let reportedShellPid: number | undefined
+    const job = {
+      listProcessIds: vi.fn(() => [4321, 4322]),
+      pause: vi.fn(() => true),
+      resume: vi.fn(() => true),
+      terminate: vi.fn(() => 'terminated' as const),
+      close: vi.fn()
+    }
+    const createJob = vi.fn(() => job)
+    const createWindowsLaunch = vi.fn(() => ({
+      command: ['cmd.exe', '/d /c launch.cmd'],
+      clearCommand: ['cmd.exe', '/d /c clear.cmd'],
+      env: { TERM: 'xterm-256color', ORCA_BUN_PTY_JOB_GATE: 'gate' },
+      windowsVerbatimArguments: true as const,
+      release,
+      dispose,
+      waitForSpawn,
+      readShellProcessId: () => reportedShellPid
+    }))
+    const proc = spawn({
+      platform: 'win32',
+      assignHostJob,
+      createJob,
+      createWindowsLaunch
+    })
+
+    expect(harness.spawn.mock.calls[0]?.[0]).toEqual(['cmd.exe', '/d /c launch.cmd'])
+    expect(harness.spawn.mock.calls[0]?.[1]).toMatchObject({
+      windowsVerbatimArguments: true,
+      env: { ORCA_BUN_PTY_JOB_GATE: 'gate' },
+      terminal: harness.terminal
+    })
+    expect(assignHostJob.mock.invocationCallOrder[0]).toBeLessThan(
+      harness.spawn.mock.invocationCallOrder[0]
+    )
+    expect(createJob).toHaveBeenCalledWith(4321)
+    expect(createJob.mock.invocationCallOrder[0]).toBeLessThan(release.mock.invocationCallOrder[0])
+    await proc.waitForSpawn?.()
+    expect(waitForSpawn).toHaveBeenCalledWith(harness.processHandle.exited)
+
+    proc.pause()
+    proc.pause()
+    proc.resume()
+    proc.resume()
+    expect(job.pause).toHaveBeenCalledOnce()
+    expect(job.resume).toHaveBeenCalledOnce()
+    expect(proc.jobRootProcessIsWrapper).toBe(true)
+    expect(readWindowsPtyJobProcessIds(proc)).toBeNull()
+    expect(harness.spawn.mock.calls[0]?.[1]).not.toHaveProperty('ipc')
+    reportedShellPid = 4322
+    expect(proc.shellProcessId).toBe(4322)
+    expect(readWindowsPtyJobProcessIds(proc)).toEqual(new Set([4322]))
+    job.listProcessIds.mockReturnValueOnce([4321, 4323])
+    expect(readWindowsPtyJobProcessIds(proc)).toBeNull()
+    expect(proc.shellProcessId).toBe(4322)
+    expect(proc.listOwnedProcessIds?.()).toEqual([4321, 4322])
+    expect(proc.terminateOwnedTree?.()).toBe('terminated')
+
+    job.terminate.mockClear()
+    proc.signalProcess?.('SIGINT')
+    expect(job.terminate).toHaveBeenCalledOnce()
+    expect(harness.processHandle.kill).not.toHaveBeenCalled()
+
+    proc.clear()
+    proc.clear()
+    expect(harness.spawn.mock.calls[1]?.[0]).toEqual(['cmd.exe', '/d /c clear.cmd'])
+    expect(harness.spawn.mock.calls[1]?.[1]).toMatchObject({
+      terminal: harness.terminal,
+      windowsVerbatimArguments: true
+    })
+    expect(harness.spawn).toHaveBeenCalledTimes(2)
+
+    const lastOutput = vi.fn()
+    const onExit = vi.fn()
+    proc.onData(lastOutput)
+    proc.onExit(onExit)
+    harness.resolveExit(0)
+    await harness.processHandle.exited
+    await Promise.resolve()
+    expect(onExit).not.toHaveBeenCalled()
+    expect(job.close).not.toHaveBeenCalled()
+    harness.emitData(new TextEncoder().encode('final ConPTY frame'))
+    harness.finishTerminal()
+    expect(lastOutput).toHaveBeenCalledWith('final ConPTY frame')
+    expect(onExit).toHaveBeenCalledOnce()
+    expect(job.close).toHaveBeenCalledOnce()
+    expect(dispose).toHaveBeenCalledOnce()
+    expect(job.resume).toHaveBeenCalledOnce()
+    job.resume.mockImplementation(() => {
+      throw new Error('job already closed')
+    })
+    expect(() => {
+      proc.pause()
+      proc.resume()
+      proc.kill()
+      proc.destroy()
+    }).not.toThrow()
+    expect(job.resume).toHaveBeenCalledOnce()
+  })
+
+  it('does not release a Windows gate without exact job ownership', async () => {
+    const harness = createBunHarness()
+    const release = vi.fn()
+    const dispose = vi.fn()
+
+    expect(() =>
+      spawn({
+        platform: 'win32',
+        assignHostJob: () => true,
+        createJob: () => null,
+        createWindowsLaunch: () => ({
+          command: ['cmd.exe', '/d /c launch.cmd'],
+          clearCommand: ['cmd.exe', '/d /c clear.cmd'],
+          env: {},
+          windowsVerbatimArguments: true,
+          waitForSpawn: async () => {},
+          readShellProcessId: () => undefined,
+          release,
+          dispose
+        })
+      })
+    ).toThrow('Windows Bun PTY job ownership is unavailable')
+
+    expect(release).not.toHaveBeenCalled()
+    expect(harness.processHandle.kill).toHaveBeenCalledWith('SIGTERM')
+    expect(harness.terminal.close).toHaveBeenCalledOnce()
+    expect(dispose).toHaveBeenCalledOnce()
+    harness.resolveExit(1)
+    await harness.processHandle.exited
+    expect(dispose).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not spawn a Windows PTY without host crash ownership', () => {
+    const harness = createBunHarness()
+    const createWindowsLaunch = vi.fn()
+
+    expect(() =>
+      spawn({
+        platform: 'win32',
+        assignHostJob: () => false,
+        createWindowsLaunch
+      })
+    ).toThrow('Windows Bun PTY host crash ownership is unavailable')
+
+    expect(createWindowsLaunch).not.toHaveBeenCalled()
+    expect(harness.spawn).not.toHaveBeenCalled()
+  })
+
+  it('preserves a Windows PTY after a failed suspension and allows a retry', () => {
+    const harness = createBunHarness()
+    const job = {
+      listProcessIds: vi.fn(() => [4321]),
+      pause: vi.fn(() => true).mockReturnValueOnce(false),
+      resume: vi.fn(() => true),
+      terminate: vi.fn(() => 'terminated' as const),
+      close: vi.fn()
+    }
+    const proc = spawn({
+      platform: 'win32',
+      assignHostJob: () => true,
+      createJob: () => job,
+      createWindowsLaunch: () => ({
+        command: ['cmd.exe', '/d /c launch.cmd'],
+        clearCommand: ['cmd.exe', '/d /c clear.cmd'],
+        env: {},
+        windowsVerbatimArguments: true,
+        waitForSpawn: async () => {},
+        readShellProcessId: () => undefined,
+        release: vi.fn(),
+        dispose: vi.fn()
+      })
+    })
+
+    proc.pause()
+    proc.write('still usable')
+    proc.pause()
+    proc.resume()
+
+    expect(job.pause).toHaveBeenCalledTimes(2)
+    expect(job.resume).toHaveBeenCalledOnce()
+    expect(job.terminate).not.toHaveBeenCalled()
+    expect(harness.terminal.close).not.toHaveBeenCalled()
+    expect(harness.terminal.write).toHaveBeenCalledWith('still usable')
+
+    proc.kill()
+    proc.kill('SIGKILL')
+    proc.destroy()
+    expect(harness.processHandle.kill.mock.calls).toEqual([['SIGTERM'], ['SIGKILL'], ['SIGTERM']])
+    expect(job.terminate).toHaveBeenCalledTimes(3)
+    expect(harness.terminal.close).toHaveBeenCalledOnce()
+  })
+
+  it('delivers Windows exit after cleanup failures', async () => {
+    const harness = createBunHarness()
+    const cleanupError = new Error('job close failed')
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const proc = spawn({
+      platform: 'win32',
+      assignHostJob: () => true,
+      createJob: () => ({
+        listProcessIds: vi.fn(() => []),
+        pause: vi.fn(() => true),
+        resume: vi.fn(() => true),
+        terminate: vi.fn(() => 'terminated' as const),
+        close: vi.fn(() => {
+          throw cleanupError
+        })
+      }),
+      createWindowsLaunch: () => ({
+        command: ['cmd.exe', '/d /c launch.cmd'],
+        clearCommand: ['cmd.exe', '/d /c clear.cmd'],
+        env: {},
+        windowsVerbatimArguments: true,
+        waitForSpawn: async () => {},
+        readShellProcessId: () => undefined,
+        release: vi.fn(),
+        dispose: vi.fn()
+      })
+    })
+    const onExit = vi.fn()
+    proc.onExit(onExit)
+
+    harness.resolveExit(9)
+    await harness.processHandle.exited
+    await Promise.resolve()
+
+    expect(onExit).toHaveBeenCalledWith({ exitCode: 9 })
+    expect(warn).toHaveBeenCalledWith('[daemon/pty] PTY cleanup failed:', cleanupError)
+  })
+
+  it('terminates and closes Windows job state when gate release fails', () => {
+    const harness = createBunHarness()
+    const dispose = vi.fn()
+    const job = {
+      listProcessIds: vi.fn(() => [4321]),
+      pause: vi.fn(() => true),
+      resume: vi.fn(() => true),
+      terminate: vi.fn(() => 'terminated' as const),
+      close: vi.fn()
+    }
+
+    expect(() =>
+      spawn({
+        platform: 'win32',
+        assignHostJob: () => true,
+        createJob: () => job,
+        createWindowsLaunch: () => ({
+          command: ['cmd.exe', '/d /c launch.cmd'],
+          clearCommand: ['cmd.exe', '/d /c clear.cmd'],
+          env: {},
+          windowsVerbatimArguments: true,
+          waitForSpawn: async () => {},
+          readShellProcessId: () => undefined,
+          release() {
+            throw new Error('gate release failed')
+          },
+          dispose
+        })
+      })
+    ).toThrow('gate release failed')
+
+    expect(job.terminate).toHaveBeenCalledOnce()
+    expect(job.close).toHaveBeenCalledOnce()
+    expect(harness.processHandle.kill).toHaveBeenCalledWith('SIGTERM')
+    expect(harness.terminal.close).toHaveBeenCalledOnce()
+    expect(dispose).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process.ts b/src/main/daemon/pty-subprocess/bun-pty-process.ts
new file mode 100644
index 00000000000..b8d68b65ad4
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process.ts
@@ -0,0 +1,2 @@
+export { canUseBunPty } from './bun-pty-process-capabilities'
+export { spawnBunPty } from './bun-pty-process-runtime'
diff --git a/src/main/daemon/pty-subprocess/foreground-process-tracker.ts b/src/main/daemon/pty-subprocess/foreground-process-tracker.ts
index 8726dc87281..7a96877c204 100644
--- a/src/main/daemon/pty-subprocess/foreground-process-tracker.ts
+++ b/src/main/daemon/pty-subprocess/foreground-process-tracker.ts
@@ -1,6 +1,6 @@
 import type * as pty from 'node-pty'
+import { ptyShellProcessId } from '../../windows/windows-pty-job'
 import { getAgentForegroundContextPaths } from '../../providers/agent-foreground-context-paths'
-import { resolveAgentForegroundProcessWithAvailability } from '../../providers/agent-foreground-process'
 import { confirmPtyShellForeground } from './pty-shell-foreground-confirmation'
 import {
   judgeCachedAgentJobEvidence,
@@ -24,6 +24,11 @@ import {
 import { isShellProcess } from '../../../shared/shell-process-detection'
 import { resolveFallbackForegroundProcess } from './foreground-fallback-process'
 import { parsePtySessionId } from '../pty-session-id'
+import {
+  ptyProcessNameIsSpawnFile,
+  createPtyForegroundResolver,
+  shouldCachePtyForeground
+} from './spawn-file-foreground-process'
 
 const FOREGROUND_AGENT_CACHE_TTL_MS = 1000
 const SHELL_FOREGROUND_REFRESH_RETRY_MS = 5_000
@@ -52,6 +57,8 @@ export function createPtyForegroundProcessTracker(args: {
   isDead: () => boolean
 }): PtyForegroundProcessTracker {
   const proc = args.process
+  const staticName = ptyProcessNameIsSpawnFile(proc)
+  const resolveForeground = createPtyForegroundResolver(proc)
   let lastOutputAt = 0
   // `pid` anchors the identity to the row that proved it (null when ambiguous).
   let cachedAgentForeground: CachedAgentForeground | null = null
@@ -69,16 +76,12 @@ export function createPtyForegroundProcessTracker(args: {
   let foregroundRefreshInFlight = false
   let lastForegroundRefreshStartedAt = 0
   const getFallbackProcess = (): string | null =>
-    resolveFallbackForegroundProcess(proc.process, args.shellPath)
+    resolveFallbackForegroundProcess(staticName ? args.shellPath : proc.process, args.shellPath)
   const getActiveStartupAgent = (
     now = Date.now()
   ): { processName: string; expiresAt: number } | null => {
-    if (!startupAgentForeground) {
-      return null
-    }
-    if (now > startupAgentForeground.expiresAt) {
+    if (startupAgentForeground && now > startupAgentForeground.expiresAt) {
       startupAgentForeground = null
-      return null
     }
     return startupAgentForeground
   }
@@ -138,7 +141,7 @@ export function createPtyForegroundProcessTracker(args: {
       }
     }
     const anchor = cachedAgentForeground
-    void resolveAgentForegroundProcessWithAvailability(proc.pid, fallbackProcess, {
+    void resolveForeground(proc.pid, fallbackProcess, {
       contextPaths,
       ...(anchor?.pid != null
         ? { anchorProcessId: anchor.pid, anchorProcessName: anchor.processName }
@@ -148,13 +151,13 @@ export function createPtyForegroundProcessTracker(args: {
         if (args.isDead() || !available) {
           return
         }
-        if (!processName || !recognizeAgentProcess(processName)) {
+        if (!shouldCachePtyForeground(processName, staticName)) {
           if (process.platform === 'win32' && fallbackIsShell && cachedAgentForeground !== null) {
             // Job, not console: needs no console attachment, so no fork (#10857).
             const verdict = judgeCachedAgentJobEvidence({
               jobProcessIds: readWindowsPtyJobProcessIds(proc),
               jobSupported: isWindowsPtyJobReadable(),
-              shellPid: proc.pid,
+              shellPid: ptyShellProcessId(proc) ?? proc.pid,
               anchorProcessId: cachedAgentForeground.pid,
               identityAgeMs: Date.now() - cachedAgentForeground.refreshedAt
             })
@@ -248,7 +251,8 @@ export function createPtyForegroundProcessTracker(args: {
         if (
           cachedAgentForeground &&
           fallbackProcess !== null &&
-          (isAgentForegroundWrapperProcess(fallbackProcess) ||
+          (staticName ||
+            isAgentForegroundWrapperProcess(fallbackProcess) ||
             inspectOuterWrapper ||
             (process.platform === 'win32' && isShellProcess(fallbackProcess)))
         ) {
@@ -279,33 +283,30 @@ export function createPtyForegroundProcessTracker(args: {
         ) {
           return fallbackProcess
         }
-        const resolution = await resolveAgentForegroundProcessWithAvailability(
-          proc.pid,
-          fallbackProcess,
-          {
-            contextPaths,
-            fresh: true,
-            ...(process.platform === 'win32'
-              ? {
-                  forceProcessScan: true,
-                  readWindowsConsoleAttachedProcessIds: () =>
-                    readWindowsConsoleAttachedProcessIds(proc.pid)
-                }
-              : {})
-          }
-        )
+        const resolution = await resolveForeground(proc.pid, fallbackProcess, {
+          contextPaths,
+          fresh: true,
+          ...(process.platform === 'win32'
+            ? {
+                forceProcessScan: true,
+                readWindowsConsoleAttachedProcessIds: () =>
+                  readWindowsConsoleAttachedProcessIds(proc.pid)
+              }
+            : {})
+        })
         if (args.isDead() || !resolution.available) {
           return null
         }
-        const recognized = recognizeAgentProcess(resolution.processName)
-        if (recognized) {
+        const processName =
+          recognizeAgentProcess(resolution.processName)?.processName ?? resolution.processName
+        if (shouldCachePtyForeground(processName, staticName)) {
           cachedAgentForeground = {
-            processName: recognized.processName,
+            processName,
             pid: resolution.processId ?? null,
             refreshedAt: Date.now()
           }
           startupAgentForeground = null
-          return recognized.processName
+          return cachedAgentForeground.processName
         }
         cachedAgentForeground = null
         startupAgentForeground = null
diff --git a/src/main/daemon/pty-subprocess/native-pty-spawn-bun.test.ts b/src/main/daemon/pty-subprocess/native-pty-spawn-bun.test.ts
new file mode 100644
index 00000000000..26a3fcda7dc
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/native-pty-spawn-bun.test.ts
@@ -0,0 +1,109 @@
+import { describe, expect, it, vi } from 'vitest'
+
+const { nodePtyFactory, wrapShellSpawnMock } = vi.hoisted(() => ({
+  nodePtyFactory: vi.fn(() => ({ spawn: vi.fn() })),
+  wrapShellSpawnMock: vi.fn((file: string, args: string[]) => ({ file, args }))
+}))
+
+vi.mock('node-pty', nodePtyFactory)
+vi.mock('../../providers/macos-tcc-login-shell', () => ({
+  hostReportsChildExitStatus: (file: string) => file !== '/usr/bin/login',
+  wrapShellSpawnForMacosTccAttribution: wrapShellSpawnMock
+}))
+
+import { spawnNativeDaemonPty } from './native-pty-spawn'
+
+describe('native PTY runtime selection', () => {
+  it('spawns with Bun.Terminal without loading node-pty', async () => {
+    const dispose = vi.fn()
+    const spawnBunPty = vi.fn(() => ({
+      pid: 9876,
+      cols: 80,
+      rows: 24,
+      process: '/bin/zsh',
+      handleFlowControl: false,
+      onData: vi.fn(() => ({ dispose })),
+      onExit: vi.fn(() => ({ dispose })),
+      write: vi.fn(),
+      resize: vi.fn(),
+      clear: vi.fn(),
+      kill: vi.fn(),
+      destroy: vi.fn(),
+      pause: vi.fn(),
+      resume: vi.fn()
+    }))
+
+    const result = await spawnNativeDaemonPty(
+      {
+        shellPath: '/bin/zsh',
+        shellArgs: ['-l'],
+        spawnCwd: '/tmp',
+        env: { TERM: 'xterm-256color' },
+        cols: 80,
+        rows: 24,
+        windowsFallbackAttempts: []
+      },
+      { canUseBunPty: () => true, spawnBunPty }
+    )
+
+    expect(result.process.pid).toBe(9876)
+    expect(spawnBunPty).toHaveBeenCalledOnce()
+    expect(nodePtyFactory).not.toHaveBeenCalled()
+  })
+
+  it('applies the macOS login wrapper before selecting the Bun PTY runtime', async () => {
+    const platform = Object.getOwnPropertyDescriptor(process, 'platform')
+    const spawnBunPty = vi.fn(() => ({
+      pid: 9877,
+      cols: 80,
+      rows: 24,
+      process: '/usr/bin/login',
+      handleFlowControl: false,
+      onData: vi.fn(() => ({ dispose: vi.fn() })),
+      onExit: vi.fn(() => ({ dispose: vi.fn() })),
+      write: vi.fn(),
+      resize: vi.fn(),
+      clear: vi.fn(),
+      kill: vi.fn(),
+      destroy: vi.fn(),
+      pause: vi.fn(),
+      resume: vi.fn()
+    }))
+    const onMacosTccSpawnStrategy = vi.fn()
+    wrapShellSpawnMock.mockReturnValueOnce({
+      file: '/usr/bin/login',
+      args: ['-flpq', 'tester', '/bin/zsh', '-l']
+    })
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'darwin' })
+
+    try {
+      const result = await spawnNativeDaemonPty(
+        {
+          shellPath: '/bin/zsh',
+          shellArgs: ['-l'],
+          spawnCwd: '/tmp',
+          env: { TERM: 'xterm-256color' },
+          cols: 80,
+          rows: 24,
+          windowsFallbackAttempts: [],
+          onMacosTccSpawnStrategy
+        },
+        { canUseBunPty: () => true, spawnBunPty }
+      )
+
+      expect(result.process.pid).toBe(9877)
+      expect(spawnBunPty).toHaveBeenCalledWith(
+        expect.objectContaining({
+          file: '/usr/bin/login',
+          args: ['-flpq', 'tester', '/bin/zsh', '-l']
+        })
+      )
+      expect(result.reportsChildExitStatus).toBe(false)
+      expect(onMacosTccSpawnStrategy).toHaveBeenCalledWith('wrapped')
+    } finally {
+      if (platform) {
+        Object.defineProperty(process, 'platform', platform)
+      }
+    }
+  })
+})
diff --git a/src/main/daemon/pty-subprocess/native-pty-spawn-windows.test.ts b/src/main/daemon/pty-subprocess/native-pty-spawn-windows.test.ts
new file mode 100644
index 00000000000..8d6f7117d08
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/native-pty-spawn-windows.test.ts
@@ -0,0 +1,124 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { spawnNativeDaemonPty } from './native-pty-spawn'
+import { WindowsBunPtySpawnUnconfirmedError } from './windows-bun-pty-spawn-receipt'
+
+const attempts = ['pwsh.exe', 'powershell.exe', 'cmd.exe'].map((shellPath) => ({
+  shellPath,
+  shellArgs: [shellPath === 'cmd.exe' ? '/K' : '-NoExit'],
+  effectiveCwd: 'C:\\work',
+  validationCwd: 'C:\\work',
+  startupCommandDeliveredInShellArgs: true
+}))
+const args = {
+  shellPath: attempts[0]!.shellPath,
+  shellArgs: attempts[0]!.shellArgs,
+  spawnCwd: 'C:\\work',
+  env: {},
+  cols: 80,
+  rows: 24,
+  windowsFallbackAttempts: attempts
+}
+
+function createProcess(waitForSpawn: () => Promise<void>) {
+  return {
+    pid: 9876,
+    cols: 80,
+    rows: 24,
+    process: 'gate',
+    handleFlowControl: false,
+    onData: vi.fn(() => ({ dispose: vi.fn() })),
+    onExit: vi.fn(() => ({ dispose: vi.fn() })),
+    write: vi.fn(),
+    resize: vi.fn(),
+    clear: vi.fn(),
+    kill: vi.fn(),
+    destroy: vi.fn(),
+    pause: vi.fn(),
+    resume: vi.fn(),
+    waitForSpawn
+  }
+}
+
+describe('Windows Bun shell fallback after gated spawn', () => {
+  const platform = Object.getOwnPropertyDescriptor(process, 'platform')!
+  beforeEach(() => {
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+  })
+  afterEach(() => {
+    Object.defineProperty(process, 'platform', platform)
+    vi.restoreAllMocks()
+  })
+
+  it('walks both fallback shells when gate wrappers start but their actual shells fail', async () => {
+    const spawnBunPty = vi.fn(({ file }: { file: string }) =>
+      createProcess(async () => {
+        await Promise.resolve()
+        if (file !== 'cmd.exe') {
+          throw new Error(`spawn ${file} EACCES`)
+        }
+      })
+    )
+    const result = await spawnNativeDaemonPty(args, { canUseBunPty: () => true, spawnBunPty })
+    expect(spawnBunPty.mock.calls.map(([args]) => args.file)).toEqual([
+      'pwsh.exe',
+      'powershell.exe',
+      'cmd.exe'
+    ])
+    expect(result.shellPath).toBe('cmd.exe')
+    expect(result.startupCommandDeliveredInShellArgs).toBe(true)
+    expect(spawnBunPty.mock.results[0]!.value.destroy).toHaveBeenCalledOnce()
+    expect(spawnBunPty.mock.results[1]!.value.destroy).toHaveBeenCalledOnce()
+    expect(spawnBunPty.mock.results[2]!.value.destroy).not.toHaveBeenCalled()
+  })
+
+  it('does not report a wrapper as a working shell before its actual spawn is confirmed', async () => {
+    let confirm!: () => void
+    const confirmation = new Promise<void>((resolve) => {
+      confirm = resolve
+    })
+    const finished = vi.fn()
+    const spawnBunPty = vi.fn(() => createProcess(() => confirmation))
+    const result = spawnNativeDaemonPty(args, { canUseBunPty: () => true, spawnBunPty }).then(
+      finished
+    )
+    await Promise.resolve()
+    expect(finished).not.toHaveBeenCalled()
+    confirm()
+    await result
+    expect(finished).toHaveBeenCalledOnce()
+  })
+
+  it('destroys an unconfirmed gate on cancellation without starting a fallback shell', async () => {
+    const controller = new AbortController()
+    const proc = createProcess(() => new Promise(() => {}))
+    const spawnBunPty = vi.fn(() => proc)
+    const result = spawnNativeDaemonPty(
+      { ...args, signal: controller.signal },
+      { canUseBunPty: () => true, spawnBunPty }
+    )
+    controller.abort(new Error('spawn canceled'))
+    await expect(result).rejects.toThrow('spawn canceled')
+    expect(proc.destroy).toHaveBeenCalledOnce()
+    expect(spawnBunPty).toHaveBeenCalledOnce()
+  })
+
+  it.each([0, 1])(
+    'stops at an ambiguous attempt %s to avoid running its startup command twice',
+    async (ambiguousIndex) => {
+      const spawnBunPty = vi.fn(({ file }: { file: string }) =>
+        createProcess(async () => {
+          if (file === attempts[ambiguousIndex]!.shellPath) {
+            throw new WindowsBunPtySpawnUnconfirmedError('missing receipt')
+          }
+          throw new Error('spawn ENOENT')
+        })
+      )
+      await expect(
+        spawnNativeDaemonPty(args, { canUseBunPty: () => true, spawnBunPty })
+      ).rejects.toBeInstanceOf(WindowsBunPtySpawnUnconfirmedError)
+      expect(spawnBunPty).toHaveBeenCalledTimes(ambiguousIndex + 1)
+      expect(spawnBunPty.mock.results.at(-1)!.value.destroy).toHaveBeenCalledOnce()
+    }
+  )
+})
diff --git a/src/main/daemon/pty-subprocess/native-pty-spawn.ts b/src/main/daemon/pty-subprocess/native-pty-spawn.ts
index e0332ba9921..e89e8a5aac4 100644
--- a/src/main/daemon/pty-subprocess/native-pty-spawn.ts
+++ b/src/main/daemon/pty-subprocess/native-pty-spawn.ts
@@ -1,4 +1,5 @@
-import * as pty from 'node-pty'
+import type * as pty from 'node-pty'
+import { waitForPromiseWithSignal } from '../../../shared/abort-signal-reason'
 import {
   hostReportsChildExitStatus,
   wrapShellSpawnForMacosTccAttribution
@@ -6,6 +7,12 @@ import {
 import type { WindowsShellSpawnAttempt } from '../../providers/windows-shell-fallback-chain'
 import { assignHostProcessToKillOnCloseJob } from '../../windows/windows-pty-job'
 
+import { canUseBunPty, spawnBunPty } from './bun-pty-process'
+import { WindowsBunPtySpawnUnconfirmedError } from './windows-bun-pty-spawn-receipt'
+
+async function loadNodePty(): Promise<typeof pty> {
+  return import('node-pty')
+}
 export type SpawnedDaemonPty = {
   process: pty.IPty
   shellPath: string
@@ -15,25 +22,66 @@ export type SpawnedDaemonPty = {
   reportsChildExitStatus: boolean
 }
 
+type NativePtyRuntime = {
+  canUseBunPty: typeof canUseBunPty
+  spawnBunPty: typeof spawnBunPty
+}
+
 /** Walks the Windows PowerShell -> cmd.exe fallback chain when ConPTY rejects the primary shell. */
-export function spawnNativeDaemonPty(args: {
-  shellPath: string
-  shellArgs: string[]
-  spawnCwd: string
-  env: Record<string, string>
-  cols: number
-  rows: number
-  windowsFallbackAttempts: WindowsShellSpawnAttempt[]
-  onMacosTccSpawnStrategy?: (strategy: 'wrapped' | 'direct') => void
-}): SpawnedDaemonPty {
+export async function spawnNativeDaemonPty(
+  args: {
+    shellPath: string
+    shellArgs: string[]
+    spawnCwd: string
+    env: Record<string, string>
+    cols: number
+    rows: number
+    windowsFallbackAttempts: WindowsShellSpawnAttempt[]
+    signal?: AbortSignal
+    onMacosTccSpawnStrategy?: (strategy: 'wrapped' | 'direct') => void
+  },
+  runtime: NativePtyRuntime = { canUseBunPty, spawnBunPty }
+): Promise<SpawnedDaemonPty> {
   let reportsChildExitStatus = true
-  const spawnAt = (shellPath: string, shellArgs: string[], cwd: string): pty.IPty => {
+  const spawnAt = async (
+    shellPath: string,
+    shellArgs: string[],
+    cwd: string
+  ): Promise<pty.IPty> => {
+    args.signal?.throwIfAborted()
     const wrapped = wrapShellSpawnForMacosTccAttribution(shellPath, shellArgs, args.env)
+    reportsChildExitStatus = hostReportsChildExitStatus(wrapped.file)
+    if (runtime.canUseBunPty()) {
+      const proc = runtime.spawnBunPty({
+        file: wrapped.file,
+        args: wrapped.args,
+        cwd,
+        env: args.env,
+        cols: args.cols,
+        rows: args.rows
+      })
+      try {
+        if (proc.waitForSpawn) {
+          await waitForPromiseWithSignal(proc.waitForSpawn(), args.signal)
+        }
+        args.signal?.throwIfAborted()
+      } catch (error) {
+        try {
+          proc.destroy()
+        } catch (cleanupError) {
+          console.warn('[daemon/pty] Failed shell launch cleanup failed:', cleanupError)
+        }
+        throw error
+      }
+      args.onMacosTccSpawnStrategy?.(wrapped.file === shellPath ? 'direct' : 'wrapped')
+      return proc
+    }
+    const nodePty = await loadNodePty()
     // Why: children inherit job membership, so the host job must exist before the first Windows PTY.
     if (process.platform === 'win32') {
       assignHostProcessToKillOnCloseJob()
     }
-    const proc = pty.spawn(wrapped.file, wrapped.args, {
+    const proc = nodePty.spawn(wrapped.file, wrapped.args, {
       name: args.env.TERM ?? 'xterm-256color',
       cols: args.cols,
       rows: args.rows,
@@ -48,7 +96,7 @@ export function spawnNativeDaemonPty(args: {
   }
 
   try {
-    const process_ = spawnAt(args.shellPath, args.shellArgs, args.spawnCwd)
+    const process_ = await spawnAt(args.shellPath, args.shellArgs, args.spawnCwd)
     return {
       process: process_,
       shellPath: args.shellPath,
@@ -56,12 +104,13 @@ export function spawnNativeDaemonPty(args: {
       reportsChildExitStatus
     }
   } catch (primaryErr) {
-    if (process.platform !== 'win32') {
+    args.signal?.throwIfAborted()
+    if (process.platform !== 'win32' || primaryErr instanceof WindowsBunPtySpawnUnconfirmedError) {
       throw primaryErr
     }
     for (const attempt of args.windowsFallbackAttempts.slice(1)) {
       try {
-        const process = spawnAt(attempt.shellPath, attempt.shellArgs, attempt.effectiveCwd)
+        const process = await spawnAt(attempt.shellPath, attempt.shellArgs, attempt.effectiveCwd)
         const message = primaryErr instanceof Error ? primaryErr.message : String(primaryErr)
         console.warn(
           `[daemon/pty] Primary shell "${args.shellPath}" failed (${message}), fell back to "${attempt.shellPath}"`
@@ -73,7 +122,11 @@ export function spawnNativeDaemonPty(args: {
           startupCommandDeliveredInShellArgs: attempt.startupCommandDeliveredInShellArgs,
           reportsChildExitStatus
         }
-      } catch {
+      } catch (error) {
+        args.signal?.throwIfAborted()
+        if (error instanceof WindowsBunPtySpawnUnconfirmedError) {
+          throw error
+        }
         // This fallback shell also failed -- try the next link in the chain.
       }
     }
diff --git a/src/main/daemon/pty-subprocess/pty-shell-foreground-confirmation.ts b/src/main/daemon/pty-subprocess/pty-shell-foreground-confirmation.ts
index 2fdd75e3518..978da1ac67f 100644
--- a/src/main/daemon/pty-subprocess/pty-shell-foreground-confirmation.ts
+++ b/src/main/daemon/pty-subprocess/pty-shell-foreground-confirmation.ts
@@ -1,4 +1,5 @@
 import type * as pty from 'node-pty'
+import { ptyShellProcessId } from '../../windows/windows-pty-job'
 import { confirmShellForegroundProcess } from '../../providers/agent-foreground-process'
 import { readWindowsPtyJobProcessIds } from '../../providers/windows-pty-job-membership'
 
@@ -7,14 +8,14 @@ import { readWindowsPtyJobProcessIds } from '../../providers/windows-pty-job-mem
  *  never cached state. */
 export async function confirmPtyShellForeground(args: {
   process: pty.IPty
-  shellPath: string
+  shellPath: string | undefined
   isDead: () => boolean
 }): Promise<boolean> {
   if (args.isDead() || !args.process.pid) {
     return false
   }
   const confirmed = await confirmShellForegroundProcess(
-    args.process.pid,
+    ptyShellProcessId(args.process),
     args.shellPath,
     process.platform === 'win32'
       ? { readWindowsPtyJobProcessIds: () => readWindowsPtyJobProcessIds(args.process) }
diff --git a/src/main/daemon/pty-subprocess/shell-launch-plan.ts b/src/main/daemon/pty-subprocess/shell-launch-plan.ts
index b50ef12baac..0c10f1493a5 100644
--- a/src/main/daemon/pty-subprocess/shell-launch-plan.ts
+++ b/src/main/daemon/pty-subprocess/shell-launch-plan.ts
@@ -206,7 +206,8 @@ export function createPtyShellLaunchPlan(
         hasStartupCommand: Boolean(opts.command),
         waitsForShellReady,
         emitsStartupIdentity: waitsForShellReady
-      })
+      }),
+      { hasStartupCommand: Boolean(opts.command) }
     )
     Object.assign(env, shellLaunch.env)
     shellArgs =
diff --git a/src/main/daemon/pty-subprocess/spawn-environment.ts b/src/main/daemon/pty-subprocess/spawn-environment.ts
index 129747d4a0d..a063ffb3dd6 100644
--- a/src/main/daemon/pty-subprocess/spawn-environment.ts
+++ b/src/main/daemon/pty-subprocess/spawn-environment.ts
@@ -1,3 +1,5 @@
+import { getLegacyOpenCodeEnvKeysToDelete } from '../../opencode/legacy-shared-config-dir'
+import { restoreOrStripOverlayEnv } from '../../../shared/agent-overlay-env'
 import { delimiter } from 'node:path'
 import { dropInheritedOrcaFishHistory } from '../../fish-history-session'
 import { removeAppImageRuntimeEnv } from '../../pty/appimage-terminal-env'
@@ -21,6 +23,7 @@ import {
   expandWindowsEnvironmentVariables,
   expandWindowsPathEnvironmentVariables
 } from '../../../shared/windows-environment-expansion'
+import { applyScrubSafeAgentEnvAliases } from '../../../shared/agent-hook-scrub-safe-env'
 import type { TuiAgent } from '../../../shared/tui-agent'
 import type { PtySubprocessOptions } from '../pty-subprocess'
 
@@ -28,7 +31,9 @@ const PANE_IDENTITY_ENV_KEYS = [
   'ORCA_PANE_KEY',
   'ORCA_TAB_ID',
   'ORCA_WORKTREE_ID',
-  'ORCA_AGENT_LAUNCH_TOKEN'
+  'ORCA_AGENT_LAUNCH_TOKEN',
+  // Not identity but equally per-spawn: an inherited copy names another launch's CLI.
+  'ORCA_WSL_CLI_DIR'
 ] as const
 const WINDOWS_PATH_ENV_KEY_RE = /^path$/i
 
@@ -50,11 +55,33 @@ function deleteRequestedDaemonEnvKeys(
   env: Record<string, string>,
   keys: readonly string[] | undefined
 ): void {
+  const userDataPath = process.env.ORCA_USER_DATA_PATH
+  if (userDataPath) {
+    for (const key of getLegacyOpenCodeEnvKeysToDelete(env, userDataPath, {})) {
+      delete env[key]
+    }
+  }
   // Why: persistent daemon state can differ from Electron; delete CODEX_HOME only when its Orca overlay owns it.
   const deleteOrcaOwnedCodexHome =
     keys?.includes('ORCA_CODEX_HOME') === true &&
     env.ORCA_CODEX_HOME !== undefined &&
     env.CODEX_HOME === env.ORCA_CODEX_HOME
+  // A merged caller config can supersede the daemon's recorded overlay source.
+  if (
+    keys?.includes('ORCA_OPENCODE_CONFIG_DIR') &&
+    (env.OPENCODE_CONFIG_DIR === undefined ||
+      env.OPENCODE_CONFIG_DIR === env.ORCA_OPENCODE_CONFIG_DIR)
+  ) {
+    restoreOrStripOverlayEnv(
+      env,
+      {
+        primary: 'OPENCODE_CONFIG_DIR',
+        overlay: 'ORCA_OPENCODE_CONFIG_DIR',
+        source: 'ORCA_OPENCODE_SOURCE_CONFIG_DIR'
+      },
+      {}
+    )
+  }
   for (const key of keys ?? []) {
     delete env[key]
   }
@@ -169,6 +196,9 @@ export function createDaemonPtyEnvironment(opts: PtySubprocessOptions): Record<s
   delete env.ELECTRON_RUN_AS_NODE
   removeAppImageRuntimeEnv(env)
   removeInheritedNoColor(env)
+  // Why last: the aliases mirror pane identity AFTER every strip above has settled, so an
+  // alias can never outlive the value it mirrors.
+  applyScrubSafeAgentEnvAliases(env)
   env.LANG ??= 'en_US.UTF-8'
   return env
 }
diff --git a/src/main/daemon/pty-subprocess/spawn-file-child-processes.ts b/src/main/daemon/pty-subprocess/spawn-file-child-processes.ts
new file mode 100644
index 00000000000..be70254dc12
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/spawn-file-child-processes.ts
@@ -0,0 +1,50 @@
+import type { IPty } from 'node-pty'
+import {
+  getCommandTokenPathBasename,
+  getFirstCommandToken
+} from '../../../shared/command-token-scanner'
+import {
+  collectDescendantsFromIndex,
+  getProcessTableIndex
+} from '../../../shared/process-table-index'
+import type { ProcessTableRow } from '../../../shared/process-table-snapshot'
+import type { PtyChildProcessVerdict } from '../../../shared/terminal-process-inspection'
+import { readWindowsPtyJobProcessIds } from '../../providers/windows-pty-job-membership'
+
+function executableName(command: string): string {
+  return getCommandTokenPathBasename(getFirstCommandToken(command)).replace(/^-/, '')
+}
+
+export function inspectSpawnFileChildProcessesFromRows(
+  rows: readonly ProcessTableRow[],
+  rootPid: number,
+  shellName: string | null
+): PtyChildProcessVerdict {
+  const index = getProcessTableIndex(rows)
+  const root = index.byPid.get(rootPid)
+  if (!root || !shellName || !root.tty || root.tty === '?') {
+    return 'unverifiable'
+  }
+  const tree = [{ ...root, depth: 0 }, ...collectDescendantsFromIndex(index, rootPid)]
+  const shell = tree
+    .filter((row) => executableName(row.command) === shellName && !row.stat.includes('Z'))
+    .sort((left, right) => left.depth - right.depth)[0]
+  if (!shell) {
+    return 'unverifiable'
+  }
+  // The macOS login wrapper and its spawned shell are launch plumbing, not user jobs.
+  const launchChain = new Set([rootPid])
+  let ancestor: ProcessTableRow | undefined = shell
+  while (ancestor && !launchChain.has(ancestor.pid)) {
+    launchChain.add(ancestor.pid)
+    ancestor = index.byPid.get(ancestor.ppid)
+  }
+  return tree.some((row) => !launchChain.has(row.pid) && !row.stat.includes('Z'))
+    ? 'children'
+    : 'no-children'
+}
+
+export function inspectSpawnFileWindowsChildProcesses(proc: IPty): PtyChildProcessVerdict {
+  const members = readWindowsPtyJobProcessIds(proc)
+  return members === null ? 'unverifiable' : members.size > 1 ? 'children' : 'no-children'
+}
diff --git a/src/main/daemon/pty-subprocess/spawn-file-foreground-process.ts b/src/main/daemon/pty-subprocess/spawn-file-foreground-process.ts
new file mode 100644
index 00000000000..b5763f238b1
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/spawn-file-foreground-process.ts
@@ -0,0 +1,125 @@
+import type { IPty } from 'node-pty'
+import { isShellProcess } from '../../../shared/shell-process-detection'
+import {
+  getCommandTokenPathBasename,
+  getFirstCommandToken
+} from '../../../shared/command-token-scanner'
+import {
+  collectDescendantsFromIndex,
+  getProcessTableIndex
+} from '../../../shared/process-table-index'
+import type { ProcessTableRow } from '../../../shared/process-table-snapshot'
+import {
+  getFreshProcessTableSnapshot,
+  getProcessTableSnapshot
+} from '../../../shared/process-table-snapshot-reader'
+import { selectForegroundProcessCandidate } from '../../../shared/foreground-process-selection'
+import { resolveOuterWrapperForegroundProcess } from '../../../shared/foreground-wrapper-agent'
+import { recognizeAgentProcess } from '../../../shared/agent-process-recognition'
+import {
+  resolveAgentForegroundProcessWithAvailability,
+  type AgentForegroundProcessResolution,
+  type AgentForegroundResolutionOptions
+} from '../../providers/agent-foreground-process'
+import { readWindowsPtyJobProcessIds } from '../../providers/windows-pty-job-membership'
+import { ptyShellProcessId } from '../../windows/windows-pty-job'
+import {
+  readWindowsProcessIdentityTable,
+  readWindowsProcessIdentityTableFresh
+} from '../../windows/windows-process-table'
+
+export function ptyProcessNameIsSpawnFile(proc: IPty): boolean {
+  return 'processNameIsSpawnFile' in proc && proc.processNameIsSpawnFile === true
+}
+
+export function createPtyForegroundResolver(
+  proc: IPty
+): typeof resolveAgentForegroundProcessWithAvailability {
+  return ptyProcessNameIsSpawnFile(proc)
+    ? (_pid, fallback, options) => resolveSpawnFileForegroundProcess(proc, fallback, options)
+    : resolveAgentForegroundProcessWithAvailability
+}
+
+export function shouldCachePtyForeground(name: string | null, staticName: boolean): name is string {
+  return (
+    name !== null && (recognizeAgentProcess(name) !== null || (staticName && !isShellProcess(name)))
+  )
+}
+
+export function resolveSpawnFileForegroundFromRows(
+  rows: readonly ProcessTableRow[],
+  rootPid: number
+): AgentForegroundProcessResolution {
+  const index = getProcessTableIndex(rows)
+  const root = index.byPid.get(rootPid)
+  if (!root || !root.tpgid || root.tpgid < 0 || !root.tty || root.tty === '?') {
+    return { available: false, processName: null }
+  }
+  const tree = [{ ...root, depth: 0 }, ...collectDescendantsFromIndex(index, rootPid)]
+  const candidates = tree
+    .filter((row) => row.pgid === root.tpgid && row.tty === root.tty && !/[TZ]/.test(row.stat))
+    .sort((left, right) => right.depth - left.depth)
+  const foreground = candidates[0]
+  if (!foreground) {
+    return { available: false, processName: null }
+  }
+  const name = getCommandTokenPathBasename(getFirstCommandToken(foreground.command)).replace(
+    /^-/,
+    ''
+  )
+  const selected = selectForegroundProcessCandidate(candidates, tree)
+  return {
+    available: name.length > 0,
+    processName: selected
+      ? resolveOuterWrapperForegroundProcess(selected.recognized, selected.candidate, tree)
+      : recognizeAgentProcess(name)
+        ? null
+        : name || null
+  }
+}
+
+export async function resolveSpawnFileForegroundProcess(
+  proc: IPty,
+  fallbackProcess: string | null,
+  options: AgentForegroundResolutionOptions = {}
+): Promise<AgentForegroundProcessResolution> {
+  try {
+    if (process.platform !== 'win32') {
+      const rows = options.fresh
+        ? await getFreshProcessTableSnapshot()
+        : await getProcessTableSnapshot()
+      return resolveSpawnFileForegroundFromRows(rows, proc.pid)
+    }
+    const resolution = await resolveAgentForegroundProcessWithAvailability(
+      proc.pid,
+      fallbackProcess,
+      options
+    )
+    if (!resolution.available || recognizeAgentProcess(resolution.processName)) {
+      return resolution
+    }
+    const members = readWindowsPtyJobProcessIds(proc)
+    const shellPid = ptyShellProcessId(proc)
+    if (!members || shellPid === undefined) {
+      return { available: false, processName: null }
+    }
+    if (members.size === 1) {
+      return { available: true, processName: fallbackProcess }
+    }
+    const rows = options.fresh
+      ? await readWindowsProcessIdentityTableFresh()
+      : await readWindowsProcessIdentityTable()
+    const candidate = collectDescendantsFromIndex(getProcessTableIndex(rows), shellPid)
+      .filter((row) => members.has(row.pid))
+      .sort((left, right) => right.depth - left.depth)[0]
+    // Only the agent resolver can grant an identity after ambiguity and console checks.
+    if (candidate && recognizeAgentProcess(candidate.name)) {
+      return resolution
+    }
+    return candidate
+      ? { available: true, processName: candidate.name, processId: candidate.pid }
+      : { available: false, processName: null }
+  } catch {
+    return { available: false, processName: null }
+  }
+}
diff --git a/src/main/daemon/pty-subprocess/spawn-file-foreground-rejected-agents.test.ts b/src/main/daemon/pty-subprocess/spawn-file-foreground-rejected-agents.test.ts
new file mode 100644
index 00000000000..d79dc806e5a
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/spawn-file-foreground-rejected-agents.test.ts
@@ -0,0 +1,134 @@
+import type { IPty } from 'node-pty'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ProcessTableRow } from '../../../shared/process-table-snapshot'
+import { __setWindowsProcessTreeLoaderForTests } from '../../windows/windows-process-table'
+import {
+  resolveSpawnFileForegroundFromRows,
+  resolveSpawnFileForegroundProcess
+} from './spawn-file-foreground-process'
+
+const { members } = vi.hoisted(() => ({ members: vi.fn() }))
+vi.mock('../../providers/windows-pty-job-membership', () => ({
+  readWindowsPtyJobProcessIds: members
+}))
+
+const proc: IPty = {
+  pid: 100,
+  cols: 80,
+  rows: 24,
+  handleFlowControl: false,
+  process: 'powershell.exe',
+  onData: () => ({ dispose() {} }),
+  onExit: () => ({ dispose() {} }),
+  write() {},
+  resize() {},
+  clear() {},
+  kill() {},
+  pause() {},
+  resume() {}
+}
+
+const root: ProcessTableRow = {
+  pid: 100,
+  ppid: 1,
+  pgid: 100,
+  tpgid: 101,
+  tty: 'pts/test',
+  stat: 'S',
+  startTime: 'shell-start',
+  command: '/bin/zsh'
+}
+
+beforeEach(() => members.mockReturnValue(new Set([100, 101, 102])))
+afterEach(() => {
+  __setWindowsProcessTreeLoaderForTests()
+  vi.restoreAllMocks()
+  vi.clearAllMocks()
+})
+
+describe('POSIX static-name agent selection', () => {
+  it('does not pick a rejected sibling agent by its executable basename', () => {
+    expect(
+      resolveSpawnFileForegroundFromRows(
+        [
+          root,
+          { ...root, pid: 101, ppid: 100, pgid: 101, stat: 'S+', command: 'claude' },
+          { ...root, pid: 102, ppid: 100, pgid: 101, stat: 'S+', command: 'codex' }
+        ],
+        100
+      )
+    ).toEqual({ available: true, processName: null })
+  })
+
+  it('does not promote a headless one-shot agent from its executable basename', () => {
+    expect(
+      resolveSpawnFileForegroundFromRows(
+        [
+          root,
+          { ...root, pid: 101, ppid: 100, pgid: 101, stat: 'S+', command: 'claude -p "review"' }
+        ],
+        100
+      )
+    ).toEqual({ available: true, processName: null })
+  })
+
+  it.each(['vim', 'npm', 'sleep'])('retains the ordinary %s name', (command) => {
+    expect(
+      resolveSpawnFileForegroundFromRows(
+        [root, { ...root, pid: 101, ppid: 100, pgid: 101, stat: 'S+', command }],
+        100
+      )
+    ).toEqual({ available: true, processName: command })
+  })
+})
+
+describe('Windows static-name agent selection', () => {
+  function installRows(names: string[]): void {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+    const rows = [
+      { pid: process.pid, ppid: 0, name: 'vitest.exe', commandLine: 'vitest' },
+      { pid: 100, ppid: 1, name: 'powershell.exe', commandLine: 'powershell.exe' },
+      ...names.map((name, index) => ({ pid: 101 + index, ppid: 100, name, commandLine: name }))
+    ]
+    __setWindowsProcessTreeLoaderForTests(() => ({
+      ProcessDataFlag: { None: 0, Memory: 1, CommandLine: 2, CreationTime: 4 },
+      getAllProcesses: (callback) => callback(rows)
+    }))
+  }
+
+  it('does not re-admit a detached agent through owned job membership', async () => {
+    installRows(['droid.exe'])
+    const consoleMembers = vi.fn(async () => new Set([100, 999]))
+    expect(
+      await resolveSpawnFileForegroundProcess(proc, 'powershell.exe', {
+        fresh: true,
+        readWindowsConsoleAttachedProcessIds: consoleMembers
+      })
+    ).toEqual({ available: true, processName: 'powershell.exe' })
+    expect(consoleMembers).toHaveBeenCalledOnce()
+  })
+
+  it('does not choose a rejected sibling agent from the identity table', async () => {
+    installRows(['claude.exe', 'codex.exe'])
+    expect(
+      await resolveSpawnFileForegroundProcess(proc, 'powershell.exe', { fresh: true })
+    ).toEqual({ available: true, processName: 'powershell.exe' })
+  })
+
+  it('retains a positively authorized agent', async () => {
+    installRows(['droid.exe'])
+    expect(
+      await resolveSpawnFileForegroundProcess(proc, 'powershell.exe', {
+        fresh: true,
+        readWindowsConsoleAttachedProcessIds: async () => new Set([100, 101])
+      })
+    ).toEqual({ available: true, processName: 'droid', processId: 101 })
+  })
+
+  it('retains an ordinary executable from the identity table', async () => {
+    installRows(['vim.exe'])
+    expect(
+      await resolveSpawnFileForegroundProcess(proc, 'powershell.exe', { fresh: true })
+    ).toEqual({ available: true, processName: 'vim.exe', processId: 101 })
+  })
+})
diff --git a/src/main/daemon/pty-subprocess/spawn-preflight-bun.test.ts b/src/main/daemon/pty-subprocess/spawn-preflight-bun.test.ts
new file mode 100644
index 00000000000..d40b30e2b32
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/spawn-preflight-bun.test.ts
@@ -0,0 +1,41 @@
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+
+const fixture = vi.hoisted((): { shellPid?: number } => ({}))
+vi.mock('./bun-pty-process', () => ({
+  canUseBunPty: () => true,
+  spawnBunPty: () => ({
+    pid: 41,
+    get shellProcessId() {
+      return fixture.shellPid
+    },
+    onExit(callback: (event: { exitCode: number }) => void) {
+      queueMicrotask(() => callback({ exitCode: 0 }))
+      return { dispose() {} }
+    }
+  })
+}))
+
+import { runPtySpawnHealthProbe } from './spawn-preflight'
+
+beforeEach(() =>
+  vi.stubGlobal(
+    'process',
+    Object.create(process, {
+      platform: { value: 'win32' }
+    })
+  )
+)
+afterEach(() => vi.unstubAllGlobals())
+
+it.each([undefined, 41, 0])(
+  'refuses successful gate exit without shell identity %s',
+  async (pid) => {
+    fixture.shellPid = pid
+    await expect(runPtySpawnHealthProbe()).rejects.toThrow('could not identify the Windows shell')
+  }
+)
+
+it('accepts successful exit with the separate original shell identity', async () => {
+  fixture.shellPid = 42
+  await expect(runPtySpawnHealthProbe()).resolves.toBeUndefined()
+})
diff --git a/src/main/daemon/pty-subprocess/spawn-preflight.ts b/src/main/daemon/pty-subprocess/spawn-preflight.ts
index facaf0a69bd..404f5b258f0 100644
--- a/src/main/daemon/pty-subprocess/spawn-preflight.ts
+++ b/src/main/daemon/pty-subprocess/spawn-preflight.ts
@@ -1,6 +1,7 @@
-import * as pty from 'node-pty'
+import type * as pty from 'node-pty'
 import { statSync } from 'node:fs'
 import { release } from 'node:os'
+import { getCmdExePath } from '../../../shared/windows-batch-spawn'
 import {
   ensureNodePtySpawnHelperExecutable,
   getNodePtySpawnHelperCandidates,
@@ -10,9 +11,14 @@ import {
 import { resolveSafePtyDefaultCwd } from '../../providers/pty-default-cwd'
 import { TerminalAttachCanceledError } from '../daemon-errors'
 import { DaemonProtocolError } from '../types'
+import { canUseBunPty, spawnBunPty } from './bun-pty-process'
 
 const PTY_SPAWN_HEALTH_TIMEOUT_MS = 4_000
 
+async function loadNodePty(): Promise<typeof pty> {
+  return import('node-pty')
+}
+
 function daemonEnvironmentDiagSuffix(): string {
   const orca = process.env.ORCA_APP_VERSION?.trim() || '0.0.0-dev'
   const systemVersion =
@@ -79,7 +85,7 @@ function preflightDaemonCwd(): void {
 }
 
 function preflightMacNodePtySpawnEnvironment(): void {
-  if (process.platform !== 'darwin') {
+  if (process.platform !== 'darwin' || canUseBunPty()) {
     return
   }
   let candidates: string[]
@@ -119,7 +125,9 @@ export async function preflightPtySpawn(args: {
   sessionId: string
   signal?: AbortSignal
 }): Promise<void> {
-  ensureNodePtySpawnHelperExecutable()
+  if (!canUseBunPty()) {
+    ensureNodePtySpawnHelperExecutable()
+  }
   preflightUnixPtySpawnEnvironment()
   try {
     if (process.platform === 'win32') {
@@ -154,21 +162,34 @@ export function formatPtySpawnError(err: unknown, shellPath: string, spawnCwd: s
   return formatted
 }
 
-export function runPtySpawnHealthProbe(): Promise<void> {
+export async function runPtySpawnHealthProbe(): Promise<void> {
+  const requiresShellIdentity = process.platform === 'win32' && canUseBunPty()
   const cwd = isExistingDirectory(process.env.ORCA_USER_DATA_PATH)
     ? process.env.ORCA_USER_DATA_PATH
     : resolveSafePtyDefaultCwd()
+  const command =
+    process.platform === 'win32'
+      ? { file: getCmdExePath(), args: ['/d', '/c', 'exit', '0'] }
+      : { file: '/bin/sh', args: ['-c', 'exit 0'] }
   let proc: pty.IPty
   try {
-    proc = pty.spawn('/bin/sh', ['-c', 'exit 0'], {
-      name: 'xterm-256color',
-      cols: 2,
-      rows: 1,
-      cwd,
-      env: { ...process.env, TERM: 'xterm-256color' }
-    })
+    const env: Record<string, string> = { TERM: 'xterm-256color' }
+    for (const [key, value] of Object.entries(process.env)) {
+      if (value !== undefined) {
+        env[key] = value
+      }
+    }
+    proc = canUseBunPty()
+      ? spawnBunPty({ ...command, cols: 2, rows: 1, cwd, env })
+      : (await loadNodePty()).spawn(command.file, command.args, {
+          name: 'xterm-256color',
+          cols: 2,
+          rows: 1,
+          cwd,
+          env
+        })
   } catch (err) {
-    throw formatPtySpawnError(err, '/bin/sh', cwd)
+    throw formatPtySpawnError(err, command.file, cwd)
   }
 
   return new Promise<void>((resolve, reject) => {
@@ -201,7 +222,18 @@ export function runPtySpawnHealthProbe(): Promise<void> {
     }, PTY_SPAWN_HEALTH_TIMEOUT_MS)
     exitDisposable = proc.onExit(({ exitCode }) => {
       if (exitCode === 0) {
-        finish()
+        const shellPid = 'shellProcessId' in proc ? proc.shellProcessId : undefined
+        if (
+          requiresShellIdentity &&
+          (typeof shellPid !== 'number' ||
+            !Number.isSafeInteger(shellPid) ||
+            shellPid <= 0 ||
+            shellPid === proc.pid)
+        ) {
+          finish(new Error('PTY spawn health check could not identify the Windows shell'))
+        } else {
+          finish()
+        }
       } else {
         finish(new Error(`PTY spawn health check exited with code ${exitCode}`))
       }
@@ -210,10 +242,10 @@ export function runPtySpawnHealthProbe(): Promise<void> {
 }
 
 export function preflightPtySpawnHealth(): boolean {
-  if (process.platform === 'win32') {
+  if (process.platform === 'win32' && !canUseBunPty()) {
     return false
   }
-  if (process.platform === 'darwin') {
+  if (!canUseBunPty()) {
     ensureNodePtySpawnHelperExecutable()
   }
   preflightUnixPtySpawnEnvironment()
diff --git a/src/main/daemon/pty-subprocess/subprocess-handle.ts b/src/main/daemon/pty-subprocess/subprocess-handle.ts
index 5d7ef163424..56b739bfccc 100644
--- a/src/main/daemon/pty-subprocess/subprocess-handle.ts
+++ b/src/main/daemon/pty-subprocess/subprocess-handle.ts
@@ -9,8 +9,13 @@ import { isValidPtySize } from '../daemon-pty-size'
 import type { SubprocessHandle } from '../session-subprocess-handle'
 import { createPtyForegroundProcessTracker } from './foreground-process-tracker'
 import { PtyPreListenerEvents } from './pre-listener-events'
+import { ptyProcessNameIsSpawnFile } from './spawn-file-foreground-process'
+import { inspectSpawnFileWindowsChildProcesses } from './spawn-file-child-processes'
 
-type DisposableNativePty = pty.IPty & { destroy?: () => void }
+type DisposableNativePty = pty.IPty & {
+  destroy?: () => void
+  signalProcess?: (signal: string) => void
+}
 
 export function createDaemonPtySubprocessHandle(args: {
   process: pty.IPty
@@ -26,7 +31,7 @@ export function createDaemonPtySubprocessHandle(args: {
   const reportsChildExitStatus = args.reportsChildExitStatus
   const proc = args.process
   // node-pty exposes destroy at runtime but omits it from IPty.
-  const nativeProc = proc as DisposableNativePty
+  const nativeProc: DisposableNativePty = proc
   const events = new PtyPreListenerEvents()
   let dead = false
   // I/O failure is not exit evidence; keep termination and producer flow control available.
@@ -64,6 +69,10 @@ export function createDaemonPtySubprocessHandle(args: {
   const slavePath = readPtySlavePath(proc)
   return {
     pid: proc.pid,
+    processNameIsSpawnFile: ptyProcessNameIsSpawnFile(proc),
+    ...(process.platform === 'win32'
+      ? { inspectChildProcesses: () => inspectSpawnFileWindowsChildProcesses(proc) }
+      : {}),
     shellPath: args.shellPath,
     shellCwd: args.spawnCwd,
     shellPathEnv: args.env.PATH,
@@ -166,6 +175,14 @@ export function createDaemonPtySubprocessHandle(args: {
       if (dead) {
         return
       }
+      if (nativeProc.signalProcess) {
+        try {
+          nativeProc.signalProcess(sig)
+        } catch {
+          /* The process may have exited. */
+        }
+        return
+      }
       const signalRootPid = (): void => {
         try {
           process.kill(proc.pid, sig)
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-gate-entry.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-gate-entry.ts
new file mode 100644
index 00000000000..9c17da7fa18
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-gate-entry.ts
@@ -0,0 +1,21 @@
+import { unlinkSync } from 'node:fs'
+import { readWindowsBunPtyGateRequest, runWindowsBunPtyGate } from './windows-bun-pty-gate'
+
+async function main(): Promise<void> {
+  const requestPath = process.argv[2]
+  if (!requestPath) {
+    throw new Error('Windows PTY gate request path is required')
+  }
+  const request = readWindowsBunPtyGateRequest(requestPath)
+  // Arguments can contain agent prompts; do not retain them for the shell's lifetime.
+  unlinkSync(requestPath)
+  process.exitCode = await runWindowsBunPtyGate(request)
+}
+
+void main().catch((error: unknown) => {
+  console.error(
+    '[pty] Windows job gate failed:',
+    error instanceof Error ? error.message : String(error)
+  )
+  process.exitCode = 1
+})
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-gate.integration.test.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-gate.integration.test.ts
new file mode 100644
index 00000000000..bb1c3d88a47
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-gate.integration.test.ts
@@ -0,0 +1,89 @@
+import { build } from 'esbuild'
+import { existsSync, mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { runProcess, runProcessSync } from '../../../shared/child-process/run-process'
+import { orcadBunRuntimeFilename } from '../../../shared/orcad-artifacts'
+import { ORCAD_BUN_VERSION } from '../../../shared/orcad-bun-runtime'
+import { createWindowsBunPtyLaunch } from './windows-bun-pty-launch'
+
+const runtimePath =
+  process.env.BUN_EXECUTABLE ??
+  resolve(__dirname, '../../../../out/orcad', orcadBunRuntimeFilename(process.platform))
+const available = existsSync(runtimePath)
+
+describe.skipIf(!available)('bundled Windows job gate under Bun', () => {
+  it('executes the worker with real Bun flags and preserves long executable argv', async () => {
+    expect(runProcessSync({ program: runtimePath, args: ['--version'] }).stdout.trim()).toBe(
+      ORCAD_BUN_VERSION
+    )
+    const directory = mkdtempSync(join(tmpdir(), 'orca-gate-contract-'))
+    const workerPath = join(directory, 'windows-bun-pty-gate-entry.js')
+    try {
+      await build({
+        entryPoints: [join(__dirname, 'windows-bun-pty-gate-entry.ts')],
+        bundle: true,
+        platform: 'node',
+        format: 'cjs',
+        outfile: workerPath,
+        logLevel: 'silent'
+      })
+      const argv = ['x'.repeat(16000), 'a b', 'quote"', '%value%&!', '状態', '']
+      const env = Object.fromEntries(
+        Object.entries(process.env).filter(
+          (entry): entry is [string, string] => entry[1] !== undefined
+        )
+      )
+      const launch = createWindowsBunPtyLaunch(
+        {
+          file: runtimePath,
+          args: ['-e', 'console.log(JSON.stringify(process.argv.slice(1)))', ...argv],
+          cwd: directory,
+          env
+        },
+        { runtimePath, workerPath }
+      )
+      try {
+        launch.release()
+        const result = await runProcess({
+          program: launch.command[0]!,
+          args: launch.command.slice(1),
+          cwd: directory,
+          env: launch.env,
+          timeoutMs: 10_000
+        })
+        expect(result.timedOut).toBe(false)
+        expect(result.code, result.stderr).toBe(0)
+        expect(JSON.parse(result.stdout)).toEqual(argv)
+        await expect(launch.waitForSpawn(Promise.resolve(result.code!))).resolves.toBeUndefined()
+        expect(existsSync(launch.command.at(-1)!)).toBe(false)
+      } finally {
+        launch.dispose()
+      }
+      const failedLaunch = createWindowsBunPtyLaunch(
+        { file: join(directory, 'missing-shell.exe'), args: [], cwd: directory, env },
+        { runtimePath, workerPath }
+      )
+      try {
+        failedLaunch.release()
+        const result = await runProcess({
+          program: failedLaunch.command[0]!,
+          args: failedLaunch.command.slice(1),
+          cwd: directory,
+          env: failedLaunch.env,
+          timeoutMs: 10_000
+        })
+        expect(result.timedOut).toBe(false)
+        expect(result.code).toBe(1)
+        await expect(failedLaunch.waitForSpawn(Promise.resolve(1))).rejects.toThrow(
+          /missing-shell|ENOENT|not found/
+        )
+      } finally {
+        failedLaunch.dispose()
+      }
+    } finally {
+      rmSync(directory, { recursive: true, force: true })
+    }
+  }, 15_000)
+})
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-gate.test.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-gate.test.ts
new file mode 100644
index 00000000000..a87870f80d5
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-gate.test.ts
@@ -0,0 +1,150 @@
+import { EventEmitter } from 'node:events'
+import { describe, expect, it, vi } from 'vitest'
+import type { spawnProcess } from '../../../shared/child-process/run-process'
+import { runWindowsBunPtyGate, type WindowsBunPtyGateRequest } from './windows-bun-pty-gate'
+
+const request: WindowsBunPtyGateRequest = {
+  file: 'C:\\Program Files\\PowerShell\\7\\pwsh.exe',
+  args: ['-NoLogo', '-NoExit', '-Command', 'A'.repeat(16000)],
+  cwd: 'C:\\work',
+  gatePath: 'gate',
+  shellPidPath: 'shell.pid',
+  runtimeOptions: {}
+}
+
+describe('Windows Bun PTY job gate worker', () => {
+  it.each(['exit', 'error'] as const)(
+    'ignores Windows console interrupts only while supervising a child (%s)',
+    async (outcome) => {
+      const platform = vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+      const previousListeners = process.listeners('SIGINT')
+      const child = new EventEmitter()
+      try {
+        const result = runWindowsBunPtyGate(request, {
+          waitForGate: async () => {},
+          reportSpawnError: vi.fn(),
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: this fixture exposes only the child events the gate consumes.
+          spawn: () => child as ReturnType<typeof spawnProcess>
+        })
+        expect(process.listeners('SIGINT')).toHaveLength(previousListeners.length + 1)
+        await Promise.resolve()
+        if (outcome === 'exit') {
+          child.emit('exit', 17)
+          await expect(result).resolves.toBe(17)
+        } else {
+          child.emit('error', new Error('spawn denied'))
+          await expect(result).rejects.toThrow('spawn denied')
+        }
+        expect(process.listeners('SIGINT')).toEqual(previousListeners)
+      } finally {
+        platform.mockRestore()
+      }
+    }
+  )
+
+  it('does not spawn before assignment and propagates the child exit code', async () => {
+    let release!: () => void
+    const waitForGate = vi.fn(
+      () =>
+        new Promise<void>((resolve) => {
+          release = resolve
+        })
+    )
+    const child = Object.assign(new EventEmitter(), { pid: 1234 })
+    const reportShellPid = vi.fn()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: this fixture exposes only the child events and pid the gate consumes.
+    const spawn = vi.fn(() => child as ReturnType<typeof spawnProcess>)
+    const result = runWindowsBunPtyGate(request, {
+      waitForGate,
+      spawn,
+      reportShellPid,
+      env: { TERM: 'xterm-256color' }
+    })
+    await Promise.resolve()
+    expect(spawn).not.toHaveBeenCalled()
+    release()
+    await Promise.resolve()
+    expect(spawn).toHaveBeenCalledWith(
+      expect.objectContaining({
+        program: request.file,
+        args: request.args,
+        cwd: request.cwd,
+        stdio: 'inherit'
+      })
+    )
+    expect(reportShellPid).not.toHaveBeenCalled()
+    child.emit('spawn')
+    expect(reportShellPid).toHaveBeenCalledWith(1234)
+    child.emit('exit', 17)
+    await expect(result).resolves.toBe(17)
+  })
+
+  it('never starts a child after a failed job gate', async () => {
+    const spawn = vi.fn()
+    await expect(
+      runWindowsBunPtyGate(request, {
+        waitForGate: async () => {
+          throw new Error('gate missing')
+        },
+        reportSpawnError: vi.fn(),
+        spawn
+      })
+    ).rejects.toThrow('gate missing')
+    expect(spawn).not.toHaveBeenCalled()
+  })
+
+  it('keeps supervising the shell when its identity receipt cannot be published', async () => {
+    const child = Object.assign(new EventEmitter(), { pid: 1234 })
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const reportSpawnError = vi.fn()
+    const result = runWindowsBunPtyGate(request, {
+      waitForGate: async () => {},
+      reportSpawnError,
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the fixture exposes only the child events and pid consumed by the gate.
+      spawn: () => child as ReturnType<typeof spawnProcess>,
+      reportShellPid() {
+        throw new Error('receipt denied')
+      }
+    })
+    await Promise.resolve()
+    child.emit('spawn')
+    expect(warn).toHaveBeenCalledOnce()
+    child.emit('exit', 17)
+    await expect(result).resolves.toBe(17)
+    expect(reportSpawnError).not.toHaveBeenCalled()
+    warn.mockRestore()
+  })
+
+  it('reports a child spawn error instead of a successful wrapper exit', async () => {
+    const child = new EventEmitter()
+    const reportSpawnError = vi.fn()
+    const result = runWindowsBunPtyGate(request, {
+      waitForGate: async () => {},
+      reportSpawnError,
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: this fixture exposes the error/exit events the gate consumes.
+      spawn: () => child as ReturnType<typeof spawnProcess>
+    })
+    await Promise.resolve()
+    child.emit('error', new Error('spawn denied'))
+    await expect(result).rejects.toThrow('spawn denied')
+    expect(reportSpawnError).toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'spawn denied' })
+    )
+  })
+
+  it('reports synchronous native spawn rejection without requiring a child event', async () => {
+    const reportSpawnError = vi.fn()
+    await expect(
+      runWindowsBunPtyGate(request, {
+        waitForGate: async () => {},
+        spawn: () => {
+          throw new Error('invalid executable')
+        },
+        reportSpawnError
+      })
+    ).rejects.toThrow('invalid executable')
+    expect(reportSpawnError).toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'invalid executable' })
+    )
+  })
+})
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-gate.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-gate.ts
new file mode 100644
index 00000000000..384038c98f7
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-gate.ts
@@ -0,0 +1,172 @@
+import { readFileSync, statSync, unlinkSync } from 'node:fs'
+import { setTimeout as delay } from 'node:timers/promises'
+import { win32 } from 'node:path'
+import { spawnProcess, type ProcessSpec } from '../../../shared/child-process/run-process'
+import {
+  publishWindowsBunPtyShellPid,
+  publishWindowsBunPtySpawnError
+} from './windows-bun-pty-spawn-receipt'
+
+export const WINDOWS_BUN_PTY_GATE_ENV = 'ORCA_BUN_PTY_JOB_GATE'
+export const WINDOWS_BUN_PTY_RUNTIME_OPTION_KEYS = ['NODE_OPTIONS', 'BUN_OPTIONS'] as const
+
+export type WindowsBunPtyGateRequest = {
+  file: string
+  args: string[]
+  cwd: string
+  gatePath: string
+  shellPidPath: string
+  runtimeOptions: Partial<Record<(typeof WINDOWS_BUN_PTY_RUNTIME_OPTION_KEYS)[number], string>>
+}
+
+export function readWindowsBunPtyGateRequest(path: string): WindowsBunPtyGateRequest {
+  if (statSync(path).size > 1024 * 1024) {
+    throw new Error('Windows PTY gate request exceeds its size limit')
+  }
+  let value: unknown
+  try {
+    value = JSON.parse(readFileSync(path, 'utf8'))
+  } catch {
+    throw new Error('Invalid Windows PTY gate request')
+  }
+  const request = value
+  if (
+    typeof request !== 'object' ||
+    request === null ||
+    !('file' in request) ||
+    typeof request.file !== 'string' ||
+    !request.file ||
+    !('args' in request) ||
+    !Array.isArray(request.args) ||
+    !request.args.every((arg): arg is string => typeof arg === 'string') ||
+    !('cwd' in request) ||
+    typeof request.cwd !== 'string' ||
+    !request.cwd ||
+    !('gatePath' in request) ||
+    typeof request.gatePath !== 'string' ||
+    !request.gatePath ||
+    !('shellPidPath' in request) ||
+    typeof request.shellPidPath !== 'string' ||
+    !request.shellPidPath ||
+    !('runtimeOptions' in request) ||
+    typeof request.runtimeOptions !== 'object' ||
+    request.runtimeOptions === null ||
+    Array.isArray(request.runtimeOptions)
+  ) {
+    throw new Error('Invalid Windows PTY gate request')
+  }
+  const runtimeOptions: WindowsBunPtyGateRequest['runtimeOptions'] = {}
+  for (const [key, value] of Object.entries(request.runtimeOptions)) {
+    if ((key !== 'NODE_OPTIONS' && key !== 'BUN_OPTIONS') || typeof value !== 'string') {
+      throw new Error('Invalid Windows PTY gate request')
+    }
+    runtimeOptions[key] = value
+  }
+  return {
+    file: request.file,
+    args: request.args,
+    cwd: request.cwd,
+    gatePath: request.gatePath,
+    shellPidPath: request.shellPidPath,
+    runtimeOptions
+  }
+}
+
+export async function waitForWindowsBunPtyJobGate(gatePath: string): Promise<void> {
+  const deadline = Date.now() + 30_000
+  while (true) {
+    try {
+      unlinkSync(gatePath)
+      return
+    } catch (error) {
+      if (
+        typeof error !== 'object' ||
+        error === null ||
+        !('code' in error) ||
+        error.code !== 'ENOENT'
+      ) {
+        throw error
+      }
+    }
+    if (Date.now() >= deadline) {
+      throw new Error('Windows PTY job assignment timed out')
+    }
+    await delay(5)
+  }
+}
+
+export function windowsBunPtyChildSpec(
+  request: WindowsBunPtyGateRequest,
+  inheritedEnv: NodeJS.ProcessEnv
+): ProcessSpec {
+  const env: NodeJS.ProcessEnv = { ...inheritedEnv, ...request.runtimeOptions }
+  delete env[WINDOWS_BUN_PTY_GATE_ENV]
+  delete env.ORCA_BUN_PTY_CHILD_COMMAND
+  return {
+    program: request.file,
+    args: request.args,
+    cwd: request.cwd,
+    env,
+    stdio: 'inherit',
+    // cmd owns the command text following /K or /C; it must not receive CRT argv escaping.
+    ...(win32.basename(request.file).toLowerCase() === 'cmd.exe'
+      ? { windowsVerbatimArguments: true }
+      : {})
+  }
+}
+
+export async function runWindowsBunPtyGate(
+  request: WindowsBunPtyGateRequest,
+  deps: {
+    waitForGate?: (gatePath: string) => Promise<void>
+    spawn?: typeof spawnProcess
+    env?: NodeJS.ProcessEnv
+    reportShellPid?: (pid: number) => void
+    reportSpawnError?: (error: unknown) => void
+  } = {}
+): Promise<number> {
+  let spawned = false
+  // Preserve supervision when Ctrl-C reaches the entire Windows console.
+  const ignoreInterrupt = (): void => {}
+  if (process.platform === 'win32') {
+    process.on('SIGINT', ignoreInterrupt)
+  }
+  try {
+    await (deps.waitForGate ?? waitForWindowsBunPtyJobGate)(request.gatePath)
+    return await new Promise<number>((resolve, reject) => {
+      const child = (deps.spawn ?? spawnProcess)(
+        windowsBunPtyChildSpec(request, deps.env ?? process.env)
+      )
+      child.once('spawn', () => {
+        spawned = true
+        if (child.pid !== undefined) {
+          const report =
+            deps.reportShellPid ??
+            ((pid) => publishWindowsBunPtyShellPid(request.shellPidPath, pid))
+          try {
+            report(child.pid)
+          } catch (error) {
+            // Keep supervising the shell; absent identity must remain unverifiable.
+            console.warn('[pty] Failed to publish Windows shell identity:', error)
+          }
+        }
+      })
+      child.once('error', reject)
+      child.once('exit', (code) => resolve(code ?? 1))
+    })
+  } catch (error) {
+    if (!spawned) {
+      try {
+        const report =
+          deps.reportSpawnError ??
+          ((error) => publishWindowsBunPtySpawnError(request.shellPidPath, error))
+        report(error)
+      } catch (receiptError) {
+        console.warn('[pty] Failed to publish Windows shell spawn error:', receiptError)
+      }
+    }
+    throw error
+  } finally {
+    process.off('SIGINT', ignoreInterrupt)
+  }
+}
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-job.test.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-job.test.ts
new file mode 100644
index 00000000000..ccc3ebc6d1a
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-job.test.ts
@@ -0,0 +1,158 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  __resetWindowsBunPtyJobForTests,
+  assignCurrentProcessToBunPtyHostJob,
+  createWindowsBunPtyJob,
+  type WindowsBunPtyJobNative
+} from './windows-bun-pty-job'
+
+function createNative(overrides: Partial<WindowsBunPtyJobNative> = {}): WindowsBunPtyJobNative {
+  return {
+    createJob: vi.fn(() => 7),
+    configureJob: vi.fn(() => true),
+    currentProcess: vi.fn(() => 99),
+    openProcess: vi.fn((_access, pid) => 1_000 + pid),
+    assignProcess: vi.fn(() => true),
+    isProcessInJob: vi.fn(() => true),
+    queryProcessIds: vi.fn(() => [11]),
+    suspendProcess: vi.fn(() => true),
+    resumeProcess: vi.fn(() => true),
+    terminateJob: vi.fn(() => true),
+    closeHandle: vi.fn(),
+    ...overrides
+  }
+}
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  __resetWindowsBunPtyJobForTests()
+})
+
+describe('Windows Bun PTY job ownership', () => {
+  it('assigns the daemon to one kill-on-close host job', () => {
+    const native = createNative()
+
+    expect(assignCurrentProcessToBunPtyHostJob(native)).toBe(true)
+    expect(assignCurrentProcessToBunPtyHostJob(native)).toBe(true)
+
+    expect(native.createJob).toHaveBeenCalledOnce()
+    expect(native.configureJob).toHaveBeenCalledWith(7, 0x2800)
+    expect(native.assignProcess).toHaveBeenCalledWith(7, 99)
+  })
+
+  it('closes a rejected host job and caches the unavailable result', () => {
+    const native = createNative({ assignProcess: vi.fn(() => false) })
+
+    expect(assignCurrentProcessToBunPtyHostJob(native)).toBe(false)
+    expect(assignCurrentProcessToBunPtyHostJob(native)).toBe(false)
+
+    expect(native.createJob).toHaveBeenCalledOnce()
+    expect(native.closeHandle).toHaveBeenCalledWith(7)
+  })
+
+  it('assigns the gated PTY root before exposing the job', () => {
+    const native = createNative()
+
+    const job = createWindowsBunPtyJob(11, native)
+
+    expect(job).not.toBeNull()
+    expect(native.configureJob).toHaveBeenCalledWith(7, 0)
+    expect(native.openProcess).toHaveBeenCalledWith(0x1901, 11)
+    expect(native.assignProcess).toHaveBeenCalledWith(7, 1011)
+    expect(native.closeHandle).toHaveBeenCalledWith(1011)
+  })
+
+  it('suspends children that appear during the ownership fence and resumes exact handles', () => {
+    const queryProcessIds = vi
+      .fn<() => readonly number[] | null>()
+      .mockReturnValueOnce([11, 12])
+      .mockReturnValueOnce([11, 12, 13])
+      .mockReturnValueOnce([11, 12, 13])
+      .mockReturnValue([11, 12, 13])
+    const native = createNative({ queryProcessIds })
+    const job = createWindowsBunPtyJob(11, native)!
+    vi.mocked(native.closeHandle).mockClear()
+
+    expect(job.pause()).toBe(true)
+    expect(native.suspendProcess).toHaveBeenCalledWith(1011)
+    expect(native.suspendProcess).toHaveBeenCalledWith(1012)
+    expect(native.suspendProcess).toHaveBeenCalledWith(1013)
+    expect(job.resume()).toBe(true)
+
+    expect(native.resumeProcess).toHaveBeenCalledWith(1011)
+    expect(native.resumeProcess).toHaveBeenCalledWith(1012)
+    expect(native.resumeProcess).toHaveBeenCalledWith(1013)
+    expect(native.closeHandle).toHaveBeenCalledWith(1011)
+    expect(native.closeHandle).toHaveBeenCalledWith(1012)
+    expect(native.closeHandle).toHaveBeenCalledWith(1013)
+  })
+
+  it('never suspends a PID whose opened handle is outside the owned job', () => {
+    const native = createNative({
+      queryProcessIds: vi.fn(() => [11, 12]),
+      isProcessInJob: vi.fn((process) => process !== 1012)
+    })
+    const job = createWindowsBunPtyJob(11, native)!
+
+    expect(job.pause()).toBe(false)
+
+    expect(native.suspendProcess).toHaveBeenCalledWith(1011)
+    expect(native.suspendProcess).not.toHaveBeenCalledWith(1012)
+    expect(native.resumeProcess).toHaveBeenCalledWith(1011)
+    expect(native.closeHandle).toHaveBeenCalledWith(1012)
+  })
+
+  it('terminates a paused tree without resuming it first', () => {
+    const native = createNative({ queryProcessIds: vi.fn(() => [11]) })
+    const job = createWindowsBunPtyJob(11, native)!
+
+    expect(job.pause()).toBe(true)
+    expect(job.terminate()).toBe('terminated')
+    job.close()
+
+    expect(native.terminateJob).toHaveBeenCalledWith(7)
+    expect(native.resumeProcess).not.toHaveBeenCalled()
+    expect(native.closeHandle).toHaveBeenCalledWith(1011)
+    expect(native.closeHandle).toHaveBeenCalledWith(7)
+  })
+
+  it('retains an exact handle when resume fails so a later retry can recover it', () => {
+    const resumeProcess = vi.fn().mockReturnValueOnce(false).mockReturnValueOnce(true)
+    const native = createNative({ resumeProcess })
+    const job = createWindowsBunPtyJob(11, native)!
+    vi.mocked(native.closeHandle).mockClear()
+
+    expect(job.pause()).toBe(true)
+    expect(job.resume()).toBe(false)
+    expect(native.closeHandle).not.toHaveBeenCalledWith(1011)
+    expect(job.resume()).toBe(true)
+    expect(native.closeHandle).toHaveBeenCalledWith(1011)
+  })
+
+  it('keeps breakaway denied when forced termination needs kill-on-close', () => {
+    const native = createNative({
+      resumeProcess: vi.fn(() => false),
+      terminateJob: vi.fn(() => false)
+    })
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const job = createWindowsBunPtyJob(11, native)!
+    expect(job.pause()).toBe(true)
+    job.close()
+    expect(native.configureJob).toHaveBeenLastCalledWith(7, 0x2000)
+  })
+
+  it('terminates a still-suspended tree instead of abandoning it during close', () => {
+    const native = createNative({ resumeProcess: vi.fn(() => false) })
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const job = createWindowsBunPtyJob(11, native)!
+    vi.mocked(native.closeHandle).mockClear()
+
+    expect(job.pause()).toBe(true)
+    job.close()
+
+    expect(native.terminateJob).toHaveBeenCalledWith(7)
+    expect(native.closeHandle).toHaveBeenCalledWith(1011)
+    expect(native.closeHandle).toHaveBeenCalledWith(7)
+    expect(warn).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-job.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-job.ts
new file mode 100644
index 00000000000..5f0a7065c85
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-job.ts
@@ -0,0 +1,218 @@
+import type { JobTerminationOutcome } from '../../windows/windows-pty-job'
+import {
+  __resetWindowsBunPtyNativeForTests,
+  loadWindowsBunPtyJobNative,
+  type WindowsBunPtyJobNative,
+  type WindowsNativeHandle
+} from './windows-bun-pty-native'
+
+export type { WindowsBunPtyJobNative } from './windows-bun-pty-native'
+
+export type WindowsBunPtyJob = {
+  listProcessIds(): readonly number[] | null
+  pause(): boolean
+  resume(): boolean
+  terminate(): JobTerminationOutcome
+  close(): void
+}
+
+const JOB_OBJECT_LIMIT_BREAKAWAY_OK = 0x0000_0800
+const JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE = 0x0000_2000
+const PROCESS_TERMINATE = 0x0001
+const PROCESS_SET_QUOTA = 0x0100
+const PROCESS_SUSPEND_RESUME = 0x0800
+const PROCESS_QUERY_LIMITED_INFORMATION = 0x1000
+const MAX_SUSPEND_PASSES = 8
+
+let hostJobAssigned: boolean | null = null
+
+export function assignCurrentProcessToBunPtyHostJob(
+  native: WindowsBunPtyJobNative | null = loadWindowsBunPtyJobNative()
+): boolean {
+  if (hostJobAssigned !== null) {
+    return hostJobAssigned
+  }
+  if (!native) {
+    hostJobAssigned = false
+    return false
+  }
+  const job = native.createJob()
+  if (
+    job === null ||
+    !native.configureJob(job, JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE | JOB_OBJECT_LIMIT_BREAKAWAY_OK) ||
+    !native.assignProcess(job, native.currentProcess())
+  ) {
+    if (job !== null) {
+      native.closeHandle(job)
+    }
+    hostJobAssigned = false
+    return false
+  }
+  // The host job deliberately lives until Windows closes it during process teardown.
+  hostJobAssigned = true
+  return true
+}
+
+class BunPtyJob implements WindowsBunPtyJob {
+  private readonly suspended = new Map<number, WindowsNativeHandle>()
+  private closed = false
+  private fullySuspended = false
+  private terminated = false
+
+  constructor(
+    private readonly rootPid: number,
+    private readonly handle: WindowsNativeHandle,
+    private readonly native: WindowsBunPtyJobNative
+  ) {}
+
+  listProcessIds(): readonly number[] | null {
+    return this.closed ? null : this.native.queryProcessIds(this.handle)
+  }
+
+  pause(): boolean {
+    if (this.closed || this.terminated) {
+      return false
+    }
+    if (this.fullySuspended) {
+      return true
+    }
+    if (this.suspended.size > 0 && !this.resume()) {
+      return false
+    }
+    for (let pass = 0; pass < MAX_SUSPEND_PASSES; pass += 1) {
+      const pids = this.listProcessIds()
+      if (!pids) {
+        this.resume()
+        return false
+      }
+      const ordered = [...pids].sort((left, right) => {
+        if (left === this.rootPid) {
+          return -1
+        }
+        if (right === this.rootPid) {
+          return 1
+        }
+        return left - right
+      })
+      let progressed = false
+      for (const pid of ordered) {
+        if (this.suspended.has(pid)) {
+          continue
+        }
+        const process = this.native.openProcess(
+          PROCESS_SUSPEND_RESUME | PROCESS_QUERY_LIMITED_INFORMATION,
+          pid
+        )
+        if (process === null) {
+          continue
+        }
+        if (!this.native.isProcessInJob(process, this.handle)) {
+          this.native.closeHandle(process)
+          continue
+        }
+        if (!this.native.suspendProcess(process)) {
+          this.native.closeHandle(process)
+          continue
+        }
+        this.suspended.set(pid, process)
+        progressed = true
+      }
+      const remaining = this.listProcessIds()
+      if (remaining && remaining.every((pid) => this.suspended.has(pid))) {
+        this.fullySuspended = true
+        return true
+      }
+      if (!remaining || !progressed) {
+        this.resume()
+        return false
+      }
+    }
+    this.resume()
+    return false
+  }
+
+  resume(): boolean {
+    this.fullySuspended = false
+    const ownedPids = this.terminated ? [] : this.listProcessIds()
+    for (const [pid, process] of this.suspended) {
+      const processExited = ownedPids !== null && !ownedPids.includes(pid)
+      if (!this.terminated && !processExited && !this.native.resumeProcess(process)) {
+        continue
+      }
+      this.native.closeHandle(process)
+      this.suspended.delete(pid)
+    }
+    return this.suspended.size === 0
+  }
+
+  terminate(): JobTerminationOutcome {
+    if (this.closed) {
+      return this.terminated ? 'terminated' : 'unavailable'
+    }
+    if (!this.terminated) {
+      this.terminated = this.native.terminateJob(this.handle)
+    }
+    if (this.terminated) {
+      this.resume()
+      return 'terminated'
+    }
+    return 'unavailable'
+  }
+
+  close(): void {
+    if (this.closed) {
+      return
+    }
+    if (!this.resume()) {
+      console.warn(
+        '[daemon/pty] Could not resume a Windows PTY tree during cleanup; terminating it'
+      )
+      this.terminated = this.native.terminateJob(this.handle)
+      if (!this.terminated) {
+        this.terminated = this.native.configureJob(this.handle, JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE)
+      }
+      this.resume()
+    }
+    this.native.closeHandle(this.handle)
+    this.closed = true
+  }
+}
+
+export function createWindowsBunPtyJob(
+  rootPid: number,
+  native: WindowsBunPtyJobNative | null = loadWindowsBunPtyJobNative()
+): WindowsBunPtyJob | null {
+  if (!native || !Number.isInteger(rootPid) || rootPid <= 0) {
+    return null
+  }
+  const job = native.createJob()
+  if (job === null || !native.configureJob(job, 0)) {
+    if (job !== null) {
+      native.closeHandle(job)
+    }
+    return null
+  }
+  const process = native.openProcess(
+    PROCESS_SET_QUOTA |
+      PROCESS_TERMINATE |
+      PROCESS_SUSPEND_RESUME |
+      PROCESS_QUERY_LIMITED_INFORMATION,
+    rootPid
+  )
+  if (process === null) {
+    native.closeHandle(job)
+    return null
+  }
+  const assigned = native.assignProcess(job, process)
+  native.closeHandle(process)
+  if (!assigned) {
+    native.closeHandle(job)
+    return null
+  }
+  return new BunPtyJob(rootPid, job, native)
+}
+
+export function __resetWindowsBunPtyJobForTests(): void {
+  __resetWindowsBunPtyNativeForTests()
+  hostJobAssigned = null
+}
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-launch.test.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-launch.test.ts
new file mode 100644
index 00000000000..1f4df4ef749
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-launch.test.ts
@@ -0,0 +1,157 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { createWindowsBunPtyLaunch, resolveWindowsBunPtyGateEntry } from './windows-bun-pty-launch'
+import { readWindowsBunPtyGateRequest, windowsBunPtyChildSpec } from './windows-bun-pty-gate'
+import { publishWindowsBunPtyShellPid } from './windows-bun-pty-spawn-receipt'
+
+const workerPath = join(__dirname, 'windows-bun-pty-launch.test.ts')
+
+describe('Windows Bun PTY gated launch', () => {
+  it('reads only the atomic shell receipt and retains its first identity through cleanup', () => {
+    const launch = createWindowsBunPtyLaunch(
+      { file: 'shell.exe', args: [], env: {} },
+      { workerPath }
+    )
+    const { shellPidPath } = readWindowsBunPtyGateRequest(launch.command.at(-1)!)
+    try {
+      expect(launch.readShellProcessId()).toBeUndefined()
+      writeFileSync(`${shellPidPath}.pending`, '12')
+      expect(launch.readShellProcessId()).toBeUndefined()
+      writeFileSync(shellPidPath, 'not a PID')
+      expect(launch.readShellProcessId()).toBeUndefined()
+      for (const receipt of ['0', '-123', '4294967296', '123\n456', '1e3', '12.3']) {
+        writeFileSync(shellPidPath, receipt)
+        expect(launch.readShellProcessId()).toBeUndefined()
+      }
+      writeFileSync(shellPidPath, '1234')
+      expect(launch.readShellProcessId()).toBe(1234)
+      writeFileSync(shellPidPath, '5678')
+      expect(launch.readShellProcessId()).toBe(1234)
+    } finally {
+      launch.dispose()
+    }
+    expect(launch.readShellProcessId()).toBe(1234)
+  })
+
+  it('publishes a complete PID and leaves no intermediate receipt', () => {
+    const launch = createWindowsBunPtyLaunch(
+      { file: 'shell.exe', args: [], env: {} },
+      { workerPath }
+    )
+    const { shellPidPath } = readWindowsBunPtyGateRequest(launch.command.at(-1)!)
+    try {
+      publishWindowsBunPtyShellPid(shellPidPath, 1234)
+      expect(launch.readShellProcessId()).toBe(1234)
+      expect(existsSync(`${shellPidPath}.pending`)).toBe(false)
+    } finally {
+      launch.dispose()
+    }
+  })
+
+  it('preserves long executable argv without cmd interpretation and releases only once', () => {
+    const file = 'C:\\状 態\\%tool%&shell.exe'
+    const args = ['a b', 'c"d', 'e%F%g', 'h&i', 'j^k', 'bang!', 'line\nbreak', 'x'.repeat(16000)]
+    const launch = createWindowsBunPtyLaunch(
+      { file, args, cwd: 'C:\\work tree', env: { TERM: 'xterm-256color' } },
+      { workerPath }
+    )
+    const gate = launch.env.ORCA_BUN_PTY_JOB_GATE
+    const directory = dirname(gate)
+    try {
+      const request = readWindowsBunPtyGateRequest(launch.command.at(-1)!)
+      expect(request).toMatchObject({ file, args, cwd: 'C:\\work tree', gatePath: gate })
+      const child = windowsBunPtyChildSpec(request, launch.env)
+      expect(child.program).toBe(file)
+      expect(child.args).toEqual(args)
+      expect(child.windowsVerbatimArguments).toBeUndefined()
+      expect(child.stdio).toBe('inherit')
+      expect(child.env).not.toHaveProperty('ORCA_BUN_PTY_JOB_GATE')
+      expect(launch.windowsVerbatimArguments).toBe(false)
+      expect(launch.command).toContain('--no-env-file')
+      expect(launch.command).toContain(`--config=${join(directory, 'bunfig.toml')}`)
+      expect(launch.command).toContain(`--cwd=${directory}`)
+      expect(launch.command.join(' ').length).toBeLessThan(8191)
+      const clear = readFileSync(join(directory, 'clear.cmd'))
+      expect(clear.includes(Buffer.from('\x1b[3J\x1b[2J\x1b[H'))).toBe(true)
+      expect(existsSync(gate)).toBe(false)
+      launch.release()
+      launch.release()
+      expect(existsSync(gate)).toBe(true)
+    } finally {
+      launch.dispose()
+      launch.dispose()
+    }
+    expect(existsSync(directory)).toBe(false)
+  })
+
+  it.each(['/K', '/k', '/C', '/c'])(
+    'preserves direct cmd %s command text without CRT escaping',
+    (commandSwitch) => {
+      const file = 'C:\\Windows\\System32\\CMD.EXE'
+      const args = [commandSwitch, 'chcp 65001 > nul & echo 状態%VALUE%!']
+      const launch = createWindowsBunPtyLaunch({ file, args, env: {} }, { workerPath })
+      try {
+        const child = windowsBunPtyChildSpec(
+          readWindowsBunPtyGateRequest(launch.command.at(-1)!),
+          launch.env
+        )
+        expect(child.program).toBe(file)
+        expect(child.args).toEqual(args)
+        expect(child.windowsVerbatimArguments).toBe(true)
+      } finally {
+        launch.dispose()
+      }
+    }
+  )
+
+  it('withholds runtime preload options from the gate while preserving the shell environment', () => {
+    const env = {
+      NODE_OPTIONS: '--require C:\\workspace\\hook.js',
+      BUN_OPTIONS: '--preload hook.js',
+      TERM: 'xterm-256color'
+    }
+    const launch = createWindowsBunPtyLaunch({ file: 'shell.exe', args: [], env }, { workerPath })
+    try {
+      expect(launch.env).not.toHaveProperty('NODE_OPTIONS')
+      expect(launch.env).not.toHaveProperty('BUN_OPTIONS')
+      expect(
+        windowsBunPtyChildSpec(readWindowsBunPtyGateRequest(launch.command.at(-1)!), launch.env).env
+      ).toEqual(env)
+    } finally {
+      launch.dispose()
+    }
+  })
+
+  it('fails before launch when the gate entry is missing', () => {
+    expect(() =>
+      createWindowsBunPtyLaunch(
+        { file: 'shell.exe', args: [], env: {} },
+        { workerPath: join(workerPath, 'missing') }
+      )
+    ).toThrow('Windows PTY gate entry not found')
+  })
+
+  it('rejects a cmd-unsafe line break before creating launch state', () => {
+    expect(() =>
+      createWindowsBunPtyLaunch(
+        { file: 'C:\\Windows\\System32\\cmd.exe', args: ['/c', 'first\nsecond'], env: {} },
+        { workerPath }
+      )
+    ).toThrow('cmd.exe cannot receive an argument containing a line break')
+  })
+
+  it('resolves adjacent, factored-chunk, and unpacked desktop layouts', () => {
+    const name = 'windows-bun-pty-gate-entry.js'
+    expect(resolveWindowsBunPtyGateEntry('/orcad', () => true)).toBe(join('/orcad', name))
+    expect(
+      resolveWindowsBunPtyGateEntry(
+        '/app/out/main/chunks',
+        (path) => path === join('/app/out/main', name)
+      )
+    ).toBe(join('/app/out/main', name))
+    expect(resolveWindowsBunPtyGateEntry('/resources/app.asar/out/main', () => true)).toBe(
+      join('/resources/app.asar.unpacked/out/main', name)
+    )
+  })
+})
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-launch.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-launch.ts
new file mode 100644
index 00000000000..dda83ad021a
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-launch.ts
@@ -0,0 +1,159 @@
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, win32 } from 'node:path'
+import {
+  buildWindowsCmdShimCommandLine,
+  validateWindowsCmdArguments
+} from '../../../shared/child-process/windows-command-line'
+import { getCmdExePath } from '../../../shared/windows-batch-spawn'
+import {
+  WINDOWS_BUN_PTY_GATE_ENV,
+  WINDOWS_BUN_PTY_RUNTIME_OPTION_KEYS,
+  type WindowsBunPtyGateRequest
+} from './windows-bun-pty-gate'
+import {
+  readWindowsBunPtySpawnReceipt,
+  waitForWindowsBunPtySpawn,
+  type WindowsBunPtySpawnReceipt
+} from './windows-bun-pty-spawn-receipt'
+
+const CLEAR_SEQUENCE = '\x1b[3J\x1b[2J\x1b[H'
+const CLEANUP_MAX_RETRIES = 5
+const CLEANUP_RETRY_DELAY_MS = 50
+
+export function resolveWindowsBunPtyGateEntry(
+  runtimeDir = __dirname,
+  pathExists: (path: string) => boolean = existsSync
+): string {
+  const directory = runtimeDir.replace(/app\.asar(?=[\\/]|$)/, 'app.asar.unpacked')
+  const candidates = [
+    join(directory, 'windows-bun-pty-gate-entry.js'),
+    join(directory, '..', 'windows-bun-pty-gate-entry.js')
+  ]
+  return candidates.find(pathExists) ?? candidates[0]!
+}
+
+function removeLaunchDirectory(directory: string): boolean {
+  try {
+    rmSync(directory, {
+      recursive: true,
+      force: true,
+      maxRetries: CLEANUP_MAX_RETRIES,
+      retryDelay: CLEANUP_RETRY_DELAY_MS
+    })
+    return true
+  } catch (error) {
+    console.warn(`[pty] failed to remove Windows Bun launch directory ${directory}:`, error)
+    return false
+  }
+}
+
+export type WindowsBunPtyLaunch = {
+  command: string[]
+  clearCommand: string[]
+  env: Record<string, string>
+  windowsVerbatimArguments: boolean
+  readShellProcessId(): number | undefined
+  waitForSpawn(wrapperExited: Promise<number>): Promise<void>
+  release(): void
+  dispose(): void
+}
+
+export function createWindowsBunPtyLaunch(
+  args: {
+    file: string
+    args: string[]
+    env: Record<string, string>
+    cwd?: string
+  },
+  deps: { workerPath?: string; runtimePath?: string } = {}
+): WindowsBunPtyLaunch {
+  if (win32.basename(args.file).toLowerCase() === 'cmd.exe') {
+    validateWindowsCmdArguments([args.file, ...args.args])
+  }
+  const workerPath = deps.workerPath ?? resolveWindowsBunPtyGateEntry()
+  if (!existsSync(workerPath)) {
+    throw new Error(`Windows PTY gate entry not found: ${workerPath}`)
+  }
+  const directory = mkdtempSync(join(tmpdir(), 'orca-bun-pty-'))
+  const gatePath = join(directory, 'job-assigned')
+  const requestPath = join(directory, 'request.json')
+  const shellPidPath = join(directory, 'shell.pid')
+  const configPath = join(directory, 'bunfig.toml')
+  const clearPath = join(directory, 'clear.cmd')
+  const cmdExe = getCmdExePath()
+  let released = false
+  let disposed = false
+  let spawnReceipt: WindowsBunPtySpawnReceipt | undefined
+  const readSpawnReceipt = (): WindowsBunPtySpawnReceipt | undefined => {
+    if (!disposed) {
+      spawnReceipt ??= readWindowsBunPtySpawnReceipt(shellPidPath)
+    }
+    return spawnReceipt
+  }
+  const env: Record<string, string> = { ...args.env, [WINDOWS_BUN_PTY_GATE_ENV]: gatePath }
+  const runtimeOptions: WindowsBunPtyGateRequest['runtimeOptions'] = {}
+  for (const key of WINDOWS_BUN_PTY_RUNTIME_OPTION_KEYS) {
+    if (env[key] !== undefined) {
+      runtimeOptions[key] = env[key]
+    }
+    delete env[key]
+  }
+
+  try {
+    writeFileSync(
+      requestPath,
+      JSON.stringify({
+        file: args.file,
+        args: args.args,
+        cwd: args.cwd ?? process.cwd(),
+        gatePath,
+        shellPidPath,
+        runtimeOptions
+      } satisfies WindowsBunPtyGateRequest),
+      { encoding: 'utf8', flag: 'wx', mode: 0o600 }
+    )
+    writeFileSync(configPath, '', { flag: 'wx', mode: 0o600 })
+    writeFileSync(clearPath, `@echo off\r\n<nul set /p "=${CLEAR_SEQUENCE}"\r\n`, {
+      encoding: 'ascii',
+      flag: 'wx'
+    })
+  } catch (error) {
+    removeLaunchDirectory(directory)
+    throw error
+  }
+
+  return {
+    // Run outside the workspace so its bunfig/.env/preloads cannot execute before job assignment.
+    command: [
+      deps.runtimePath ?? process.execPath,
+      '--no-env-file',
+      `--config=${configPath}`,
+      `--cwd=${directory}`,
+      workerPath,
+      requestPath
+    ],
+    clearCommand: [cmdExe, buildWindowsCmdShimCommandLine(clearPath, [])],
+    env,
+    windowsVerbatimArguments: false,
+    readShellProcessId() {
+      const receipt = readSpawnReceipt()
+      return receipt && 'pid' in receipt ? receipt.pid : undefined
+    },
+    waitForSpawn: (wrapperExited) => waitForWindowsBunPtySpawn(readSpawnReceipt, wrapperExited),
+    release() {
+      if (released) {
+        return
+      }
+      writeFileSync(gatePath, '', { flag: 'wx' })
+      released = true
+    },
+    dispose() {
+      if (disposed) {
+        return
+      }
+      readSpawnReceipt()
+      disposed = removeLaunchDirectory(directory)
+    }
+  }
+}
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-native.test.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-native.test.ts
new file mode 100644
index 00000000000..de6ff4ee264
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-native.test.ts
@@ -0,0 +1,53 @@
+import { describe, expect, it, vi } from 'vitest'
+import { queryWindowsBunPtyProcessIds } from './windows-bun-pty-native'
+
+function writeProcessList(bytes: Uint8Array, pids: number[]): boolean {
+  const capacity = (bytes.byteLength - 8) / 8
+  const view = new DataView(bytes.buffer)
+  view.setUint32(0, pids.length, true)
+  view.setUint32(4, Math.min(pids.length, capacity), true)
+  pids
+    .slice(0, capacity)
+    .forEach((pid, index) => view.setBigUint64(8 + index * 8, BigInt(pid), true))
+  return pids.length <= capacity
+}
+
+describe('Windows Bun job process enumeration', () => {
+  it.each([false, true])(
+    'grows an incomplete process list when the native call returns %s',
+    (result) => {
+      const pids = Array.from({ length: 257 }, (_, index) => index + 1)
+      const query = vi.fn((bytes: Uint8Array) => writeProcessList(bytes, pids) || result)
+      expect(queryWindowsBunPtyProcessIds(query)).toEqual(pids)
+      expect(query.mock.calls.map(([bytes]) => (bytes.byteLength - 8) / 8)).toEqual([64, 256, 1024])
+    }
+  )
+
+  it('does not mistake a failed native query for an empty job', () => {
+    const query = vi.fn(() => false)
+    expect(queryWindowsBunPtyProcessIds(query)).toBeNull()
+    expect(query).toHaveBeenCalledOnce()
+  })
+
+  it('returns an empty list only when the native query succeeds', () => {
+    expect(queryWindowsBunPtyProcessIds(() => true)).toEqual([])
+  })
+
+  it('bounds growth when a process tree exceeds the inventory limit', () => {
+    const query = vi.fn((bytes: Uint8Array) => {
+      new DataView(bytes.buffer).setUint32(0, 20_000, true)
+      return false
+    })
+    expect(queryWindowsBunPtyProcessIds(query)).toBeNull()
+    expect(query).toHaveBeenCalledTimes(5)
+  })
+
+  it.each([0, 0x1_0000_0000])(
+    'refuses invalid PID %s without reporting partial ownership',
+    (pid) => {
+      expect(
+        queryWindowsBunPtyProcessIds((bytes) => writeProcessList(bytes, [1234, pid]))
+      ).toBeNull()
+    }
+  )
+})
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-native.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-native.ts
new file mode 100644
index 00000000000..c9d72e9bf9d
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-native.ts
@@ -0,0 +1,176 @@
+import { createRequire } from 'node:module'
+
+export type WindowsNativeHandle = number | bigint
+type NativePointer = number | bigint
+
+export type WindowsBunPtyJobNative = {
+  createJob(): WindowsNativeHandle | null
+  configureJob(job: WindowsNativeHandle, flags: number): boolean
+  currentProcess(): WindowsNativeHandle
+  openProcess(access: number, pid: number): WindowsNativeHandle | null
+  assignProcess(job: WindowsNativeHandle, process: WindowsNativeHandle): boolean
+  isProcessInJob(process: WindowsNativeHandle, job: WindowsNativeHandle): boolean
+  queryProcessIds(job: WindowsNativeHandle): readonly number[] | null
+  suspendProcess(process: WindowsNativeHandle): boolean
+  resumeProcess(process: WindowsNativeHandle): boolean
+  terminateJob(job: WindowsNativeHandle): boolean
+  closeHandle(handle: WindowsNativeHandle): void
+}
+
+type FfiFunction = { args: readonly string[]; returns: string }
+type FfiLibrary<T> = { symbols: T }
+type BunFfi = {
+  dlopen<T>(name: string, symbols: Record<string, FfiFunction>): FfiLibrary<T>
+  ptr(view: ArrayBufferView): NativePointer
+}
+
+type Kernel32 = {
+  CreateJobObjectW(attributes: null, name: null): WindowsNativeHandle | null
+  SetInformationJobObject(
+    job: WindowsNativeHandle,
+    infoClass: number,
+    info: NativePointer,
+    infoLength: number
+  ): number
+  GetCurrentProcess(): WindowsNativeHandle
+  OpenProcess(access: number, inherit: number, pid: number): WindowsNativeHandle | null
+  AssignProcessToJobObject(job: WindowsNativeHandle, process: WindowsNativeHandle): number
+  IsProcessInJob(
+    process: WindowsNativeHandle,
+    job: WindowsNativeHandle,
+    result: NativePointer
+  ): number
+  QueryInformationJobObject(
+    job: WindowsNativeHandle,
+    infoClass: number,
+    info: NativePointer,
+    infoLength: number,
+    returnLength: null
+  ): number
+  TerminateJobObject(job: WindowsNativeHandle, exitCode: number): number
+  CloseHandle(handle: WindowsNativeHandle): number
+}
+
+type Ntdll = {
+  NtSuspendProcess(process: WindowsNativeHandle): number
+  NtResumeProcess(process: WindowsNativeHandle): number
+}
+
+const requireFromMain = createRequire(__filename)
+const JOB_OBJECT_EXTENDED_LIMIT_INFORMATION = 9
+const JOB_OBJECT_BASIC_PROCESS_ID_LIST = 3
+const JOB_LIMIT_FLAGS_OFFSET = 16
+const JOB_EXTENDED_LIMITS_BYTES = 144
+const MAX_JOB_PROCESS_IDS = 16_384
+
+export function queryWindowsBunPtyProcessIds(
+  query: (buffer: Uint8Array) => boolean
+): readonly number[] | null {
+  for (let capacity = 64; capacity <= MAX_JOB_PROCESS_IDS; capacity *= 4) {
+    const bytes = new Uint8Array(8 + capacity * 8)
+    const queried = query(bytes)
+    const view = new DataView(bytes.buffer)
+    const assigned = view.getUint32(0, true)
+    const count = view.getUint32(4, true)
+    // These output counts survive the FFI boundary; thread-local GetLastError may not.
+    if (assigned > count) {
+      continue
+    }
+    if (!queried || count > capacity) {
+      return null
+    }
+    const pids: number[] = []
+    for (let index = 0; index < count; index += 1) {
+      const pid = Number(view.getBigUint64(8 + index * 8, true))
+      if (!Number.isSafeInteger(pid) || pid <= 0 || pid > 0xffff_ffff) {
+        return null
+      }
+      pids.push(pid)
+    }
+    return pids
+  }
+  return null
+}
+
+let cachedNative: WindowsBunPtyJobNative | null | undefined
+
+export function loadWindowsBunPtyJobNative(): WindowsBunPtyJobNative | null {
+  if (cachedNative !== undefined) {
+    return cachedNative
+  }
+  if (process.platform !== 'win32') {
+    cachedNative = null
+    return cachedNative
+  }
+  try {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the pinned Bun runtime supplies these FFI exports; loading failures refuse job ownership.
+    const ffi = requireFromMain('bun:ffi') as BunFfi
+    const kernel = ffi.dlopen<Kernel32>('kernel32.dll', {
+      CreateJobObjectW: { args: ['ptr', 'ptr'], returns: 'ptr' },
+      SetInformationJobObject: { args: ['ptr', 'u32', 'ptr', 'u32'], returns: 'i32' },
+      GetCurrentProcess: { args: [], returns: 'ptr' },
+      OpenProcess: { args: ['u32', 'i32', 'u32'], returns: 'ptr' },
+      AssignProcessToJobObject: { args: ['ptr', 'ptr'], returns: 'i32' },
+      IsProcessInJob: { args: ['ptr', 'ptr', 'ptr'], returns: 'i32' },
+      QueryInformationJobObject: {
+        args: ['ptr', 'u32', 'ptr', 'u32', 'ptr'],
+        returns: 'i32'
+      },
+      TerminateJobObject: { args: ['ptr', 'u32'], returns: 'i32' },
+      CloseHandle: { args: ['ptr'], returns: 'i32' }
+    })
+    const ntdll = ffi.dlopen<Ntdll>('ntdll.dll', {
+      NtSuspendProcess: { args: ['ptr'], returns: 'i32' },
+      NtResumeProcess: { args: ['ptr'], returns: 'i32' }
+    })
+    const { symbols } = kernel
+    cachedNative = {
+      createJob: () => symbols.CreateJobObjectW(null, null),
+      configureJob(job, flags) {
+        const limits = new Uint8Array(JOB_EXTENDED_LIMITS_BYTES)
+        new DataView(limits.buffer).setUint32(JOB_LIMIT_FLAGS_OFFSET, flags, true)
+        return (
+          symbols.SetInformationJobObject(
+            job,
+            JOB_OBJECT_EXTENDED_LIMIT_INFORMATION,
+            ffi.ptr(limits),
+            limits.byteLength
+          ) !== 0
+        )
+      },
+      currentProcess: () => symbols.GetCurrentProcess(),
+      openProcess: (access, pid) => symbols.OpenProcess(access, 0, pid),
+      assignProcess: (job, process) => symbols.AssignProcessToJobObject(job, process) !== 0,
+      isProcessInJob(process, job) {
+        const result = new Uint32Array(1)
+        return symbols.IsProcessInJob(process, job, ffi.ptr(result)) !== 0 && result[0] !== 0
+      },
+      queryProcessIds(job) {
+        return queryWindowsBunPtyProcessIds(
+          (bytes) =>
+            symbols.QueryInformationJobObject(
+              job,
+              JOB_OBJECT_BASIC_PROCESS_ID_LIST,
+              ffi.ptr(bytes),
+              bytes.byteLength,
+              null
+            ) !== 0
+        )
+      },
+      suspendProcess: (process) => ntdll.symbols.NtSuspendProcess(process) >= 0,
+      resumeProcess: (process) => ntdll.symbols.NtResumeProcess(process) >= 0,
+      terminateJob: (job) => symbols.TerminateJobObject(job, 1) !== 0,
+      closeHandle: (handle) => {
+        symbols.CloseHandle(handle)
+      }
+    }
+    return cachedNative
+  } catch {
+    cachedNative = null
+    return cachedNative
+  }
+}
+
+export function __resetWindowsBunPtyNativeForTests(): void {
+  cachedNative = undefined
+}
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-spawn-receipt.test.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-spawn-receipt.test.ts
new file mode 100644
index 00000000000..56824521921
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-spawn-receipt.test.ts
@@ -0,0 +1,90 @@
+import { existsSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createWindowsBunPtyLaunch } from './windows-bun-pty-launch'
+import { readWindowsBunPtyGateRequest } from './windows-bun-pty-gate'
+import {
+  publishWindowsBunPtyShellPid,
+  publishWindowsBunPtySpawnError,
+  WindowsBunPtySpawnUnconfirmedError
+} from './windows-bun-pty-spawn-receipt'
+
+const workerPath = join(__dirname, 'windows-bun-pty-spawn-receipt.test.ts')
+const neverExits = new Promise<number>(() => {})
+
+describe('Windows Bun shell spawn confirmation', () => {
+  afterEach(() => vi.useRealTimers())
+
+  it('waits for the actual shell and preserves successful immediate exit through cleanup', async () => {
+    const launch = createWindowsBunPtyLaunch(
+      { file: 'shell.exe', args: [], env: {} },
+      { workerPath }
+    )
+    const { shellPidPath } = readWindowsBunPtyGateRequest(launch.command.at(-1)!)
+    const ready = vi.fn()
+    let exit!: (code: number) => void
+    const exited = new Promise<number>((resolve) => {
+      exit = resolve
+    })
+    const waiting = launch.waitForSpawn(exited).then(ready)
+    try {
+      await Promise.resolve()
+      expect(ready).not.toHaveBeenCalled()
+      publishWindowsBunPtyShellPid(shellPidPath, 1234)
+      exit(17)
+      launch.dispose()
+      await waiting
+      expect(ready).toHaveBeenCalledOnce()
+      expect(launch.readShellProcessId()).toBe(1234)
+      expect(existsSync(dirname(shellPidPath))).toBe(false)
+    } finally {
+      launch.dispose()
+    }
+  })
+
+  it('preserves a definite spawn error through cleanup so the caller can retry another shell', async () => {
+    const launch = createWindowsBunPtyLaunch(
+      { file: 'shell.exe', args: [], env: {} },
+      { workerPath }
+    )
+    const { shellPidPath } = readWindowsBunPtyGateRequest(launch.command.at(-1)!)
+    try {
+      publishWindowsBunPtySpawnError(shellPidPath, new Error('spawn ENOENT'))
+      expect(existsSync(`${shellPidPath}.error.pending`)).toBe(false)
+      launch.dispose()
+      await expect(launch.waitForSpawn(Promise.resolve(1))).rejects.toThrow('spawn ENOENT')
+    } finally {
+      launch.dispose()
+    }
+  })
+
+  it('refuses to retry an exited gate without a receipt because its shell may have run', async () => {
+    const launch = createWindowsBunPtyLaunch(
+      { file: 'shell.exe', args: [], env: {} },
+      { workerPath }
+    )
+    try {
+      await expect(launch.waitForSpawn(Promise.resolve(0))).rejects.toBeInstanceOf(
+        WindowsBunPtySpawnUnconfirmedError
+      )
+    } finally {
+      launch.dispose()
+    }
+  })
+
+  it('bounds the wait for a live gate that never publishes its shell identity', async () => {
+    vi.useFakeTimers({ toFake: ['Date'] })
+    const launch = createWindowsBunPtyLaunch(
+      { file: 'shell.exe', args: [], env: {} },
+      { workerPath }
+    )
+    try {
+      const waiting = launch.waitForSpawn(neverExits)
+      const assertion = expect(waiting).rejects.toBeInstanceOf(WindowsBunPtySpawnUnconfirmedError)
+      vi.setSystemTime(Date.now() + 30_001)
+      await assertion
+    } finally {
+      launch.dispose()
+    }
+  })
+})
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-spawn-receipt.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-spawn-receipt.ts
new file mode 100644
index 00000000000..43d193b76af
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-spawn-receipt.ts
@@ -0,0 +1,66 @@
+import { readFileSync, renameSync, writeFileSync } from 'node:fs'
+import { setTimeout as delay } from 'node:timers/promises'
+
+export type WindowsBunPtySpawnReceipt = { pid: number } | { error: string }
+
+export class WindowsBunPtySpawnUnconfirmedError extends Error {}
+
+function publishReceipt(path: string, value: string): void {
+  const pending = `${path}.pending`
+  writeFileSync(pending, value, { flag: 'wx', mode: 0o600 })
+  // ConPTY cannot inherit Bun IPC; publish the receipt atomically.
+  renameSync(pending, path)
+}
+
+export function publishWindowsBunPtyShellPid(path: string, pid: number): void {
+  publishReceipt(path, String(pid))
+}
+
+export function publishWindowsBunPtySpawnError(path: string, error: unknown): void {
+  publishReceipt(`${path}.error`, error instanceof Error ? error.message : String(error))
+}
+
+export function readWindowsBunPtySpawnReceipt(path: string): WindowsBunPtySpawnReceipt | undefined {
+  try {
+    const receipt = readFileSync(path, 'utf8')
+    const pid = Number(receipt)
+    if (/^[1-9][0-9]{0,9}$/.test(receipt) && Number.isSafeInteger(pid) && pid <= 0xffff_ffff) {
+      return { pid }
+    }
+  } catch {
+    // Missing or unreadable identity never proves the shell failed to spawn.
+  }
+  try {
+    return { error: readFileSync(`${path}.error`, 'utf8') }
+  } catch {
+    return undefined
+  }
+}
+
+export async function waitForWindowsBunPtySpawn(
+  readReceipt: () => WindowsBunPtySpawnReceipt | undefined,
+  wrapperExited: Promise<number>
+): Promise<void> {
+  let ended = false
+  const markEnded = (): void => {
+    ended = true
+  }
+  void wrapperExited.then(markEnded, markEnded)
+  const deadline = Date.now() + 30_000
+  while (true) {
+    const receipt = readReceipt()
+    if (receipt) {
+      if ('pid' in receipt) {
+        return
+      }
+      if (ended) {
+        throw new Error(receipt.error)
+      }
+    }
+    if (ended || Date.now() >= deadline) {
+      // An unreported shell may already have run a startup command; never retry it.
+      throw new WindowsBunPtySpawnUnconfirmedError('Windows shell spawn could not be confirmed')
+    }
+    await delay(5)
+  }
+}
diff --git a/src/main/daemon/serialize-grid-transcript-replay.test.ts b/src/main/daemon/serialize-grid-transcript-replay.test.ts
index 7bd60cf0205..cbe9b5db2c0 100644
--- a/src/main/daemon/serialize-grid-transcript-replay.test.ts
+++ b/src/main/daemon/serialize-grid-transcript-replay.test.ts
@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto'
 import { existsSync, readdirSync, readFileSync } from 'node:fs'
 import { basename, join } from 'node:path'
 import { describe, expect, it } from 'vitest'
@@ -27,9 +28,50 @@ const OLD_ADDON_PATH = process.env.ORCA_OLD_SERIALIZE_ADDON
 const SEEDS = Math.max(1, Number(process.env.SERIALIZE_TRANSCRIPT_SEEDS) || 2)
 
 // Checkpoints (default seeds) whose new replay diverges exactly as the previous
-// build's did — pre-existing upstream limitations, not regressions (verified
-// with ORCA_OLD_SERIALIZE_ADDON). Shrink when one is fixed.
-const KNOWN_PREEXISTING_I2_FAILURES: Record<string, number> = { less: 6, nano: 2, opencode: 5 }
+// build's did — pre-existing serializer limitations, not regressions (verified
+// with ORCA_OLD_SERIALIZE_ADDON): the live SGR pen leaks into the alt buffer, and
+// an alt buffer first entered after a shrink keeps hidden scrollback. Shrink when one is fixed.
+const KNOWN_PREEXISTING_I2_FAILURES: Record<string, number> = {
+  less: 6,
+  nano: 2,
+  opencode: 5,
+  // Shrink leaves the cursor one column short; also present in the pre-Qoder serializer.
+  'qoder-no-account': 2,
+  'qoder-ready': 2,
+  // Codex 0.157 header border restores with an extra attribute bit (STA-8628 fixtures).
+  'codex-0157-config-override-embedded-warning': 22,
+  'codex-0157-effort-override-embedded-warning': 4,
+  'codex-0157-no-daemon-effort-override': 16,
+  'codex-0157-plain-ready': 18,
+  // Fresh-home 0.157/0.158 captures: the live pen's true-colour fg/bg leaks onto restored cells.
+  'codex-0157-fresh-home-daemon-install': 48,
+  'codex-0158-fresh-home-greeting': 9,
+  'codex-0158-model-announcement-dialog': 8,
+  // Codex 0.157/0.158 startup-dialog captures: the same live-pen true-colour leak onto restored cells.
+  'codex-0157-update-available-dialog': 26,
+  'codex-0158-update-available-dialog': 8,
+  'codex-0157-hooks-review-dialog': 24,
+  'codex-0158-hooks-review-dialog': 8,
+  'codex-0157-model-retired-dialog': 22,
+  'codex-0158-model-retired-dialog': 6,
+  // Same extra dim bit on the 0.157/0.158 header row (STA-8834 fixtures).
+  'codex-0-157-1-update-dialog': 16,
+  'codex-0-158-0-approval': 12,
+  'codex-0-158-0-timed-turn': 20,
+  'codex-0-158-0-trustprompt': 36,
+  'claude-dialog-trust-workspace-answered': 13,
+  // DSH-TUI's whale intro paints whole rows of 24-bit background, and every one of this
+  // transcript's divergences is the same shape: `visible-grid row=0`, a true-colour
+  // background that the round trip does not restore to default. Verified as upstream, not a
+  // regression, by replaying it against the previous build
+  // (`build-serialize-addon-at-ref.mjs --ref origin/main`): I1 and I3 both hold.
+  'dsh-tui-ready-no-key': 10
+}
+
+// Exact resize checkpoints and full GridDiff hashes from base 6835b9b4e3ea, not this branch.
+const FREEBUFF_BASELINE: Record<string, readonly string[]> = JSON.parse(
+  readFileSync(join(__dirname, '__fixtures__/freebuff-serialize-baseline.json'), 'utf8')
+)
 
 type Transcript = { name: string; data: string; cols: number; rows: number }
 type Schedule = 'none' | 'shrink' | 'shrink-grow' | 'jitter'
@@ -122,6 +164,7 @@ describe('serialize round trip over captured PTY transcripts', () => {
     async (_name, transcript) => {
       const counts: Partial<Record<Verdict | 'checks', number>> = {}
       const blocking: string[] = []
+      const failureSignatures: string[] = []
       for (const schedule of SCHEDULES) {
         for (const conpty of [false, true]) {
           for (let seed = 1; seed <= SEEDS; seed++) {
@@ -136,6 +179,14 @@ describe('serialize round trip over captured PTY transcripts', () => {
                   `  ${transcript.name} ${schedule} conpty=${conpty} seed=${seed}: ${d.stage} row=${d.row} ${JSON.stringify(d.expected)?.slice(0, 160)} -> ${JSON.stringify(d.actual)?.slice(0, 160)}`
                 )
               }
+              if (check.gridDiff.new) {
+                const signature = createHash('sha256')
+                  .update(JSON.stringify(check.gridDiff.new))
+                  .digest('hex')
+                failureSignatures.push(
+                  `${schedule}/${conpty}/${seed}/${check.stepIndex}:${signature}`
+                )
+              }
               for (const verdict of verdicts(check, serializers.length > 1)) {
                 counts[verdict] = (counts[verdict] ?? 0) + 1
                 if (verdict === 'i1-bytes-differ' || verdict === 'regression') {
@@ -152,7 +203,9 @@ describe('serialize round trip over captured PTY transcripts', () => {
         console.log(`${transcript.name} ${JSON.stringify(counts)}`)
       }
       expect(blocking).toEqual([])
-      if (!OLD_ADDON_PATH && SEEDS === 2) {
+      if (SEEDS === 2 && transcript.name.startsWith('freebuff-')) {
+        expect(failureSignatures).toEqual(FREEBUFF_BASELINE[transcript.name] ?? [])
+      } else if (!OLD_ADDON_PATH && SEEDS === 2) {
         expect(counts['new-fail'] ?? 0).toBe(KNOWN_PREEXISTING_I2_FAILURES[transcript.name] ?? 0)
       }
     },
diff --git a/src/main/daemon/session-output-plane.ts b/src/main/daemon/session-output-plane.ts
index 507ca01a927..04b3f773bda 100644
--- a/src/main/daemon/session-output-plane.ts
+++ b/src/main/daemon/session-output-plane.ts
@@ -125,6 +125,16 @@ export class SessionOutputPlane {
     })
   }
 
+  /** Grounds the emulator and the cold-restore records without a client
+   *  broadcast; attached renderers ground themselves (Reset Terminal). */
+  applyInputModeGround(ground: string): void {
+    if (this.disposed) {
+      return
+    }
+    this.emulator.write(ground)
+    this.record({ kind: 'output', data: ground })
+  }
+
   isCursorOnEmptyPromptLine(): boolean {
     return this.emulator.isCursorOnEmptyPromptLine()
   }
diff --git a/src/main/daemon/session-reset-input-modes.test.ts b/src/main/daemon/session-reset-input-modes.test.ts
new file mode 100644
index 00000000000..ea1aa7e7351
--- /dev/null
+++ b/src/main/daemon/session-reset-input-modes.test.ts
@@ -0,0 +1,89 @@
+import { describe, expect, it, vi } from 'vitest'
+import { Session } from './session'
+import type { SubprocessHandle } from './session-subprocess-handle'
+
+function createSession() {
+  let onData: ((data: string) => void) | null = null
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Session reads only these members.
+  const handle = {
+    pid: 999,
+    getForegroundProcess: () => null,
+    confirmShellForeground: vi.fn(async () => false),
+    write: () => {},
+    resize: () => {},
+    pause: () => {},
+    resume: () => {},
+    kill: () => {},
+    forceKill: () => {},
+    signal: () => {},
+    terminateOwnedTree: () => 'unavailable' as const,
+    onData(cb: (data: string) => void) {
+      onData = cb
+    },
+    onExit() {},
+    dispose: () => {}
+  } as unknown as SubprocessHandle
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the omitted options are optional.
+  const session = new Session({
+    sessionId: 'reset',
+    cols: 80,
+    rows: 24,
+    subprocess: handle,
+    shellReadySupported: false
+  } as never)
+  const received: string[] = []
+  session.attachClient({ onData: (data: string) => received.push(data), onExit: () => {} })
+  return { session, received, emit: (data: string) => onData?.(data) }
+}
+
+async function readModes(session: Session) {
+  await session.settleShellOwnershipConfirmation()
+  return session.getSnapshot()!.modes
+}
+
+describe('Session.resetInputModes', () => {
+  it('grounds modes an app left armed without a command end, and the next snapshot carries it', async () => {
+    const { session, received, emit } = createSession()
+    // A crashed app's arming with no OSC 133;D the barrier could ground at.
+    emit('prompt$ app\r\n\x1b[>31u\x1b[?1000h\x1b[?1006h\x1b[?2004h\x1b[?1h')
+    const armed = await readModes(session)
+    expect(armed).toMatchObject({
+      kittyKeyboardFlags: 31,
+      mouseTracking: true,
+      bracketedPaste: true
+    })
+    session.takePendingOutput(false)
+    const broadcast = received.length
+
+    session.resetInputModes()
+
+    expect(await readModes(session)).toMatchObject({
+      kittyKeyboardFlags: 0,
+      mouseTracking: false,
+      sgrMouseMode: false,
+      bracketedPaste: false,
+      applicationCursor: false,
+      alternateScreen: false
+    })
+    // Clients ground themselves; a zero-raw span here would be dropped or duplicated.
+    expect(received).toHaveLength(broadcast)
+    const records = session.takePendingOutput(false)!.records
+    expect(records).toEqual([{ kind: 'output', data: expect.stringContaining('\x1b[<99u') }])
+    session.dispose()
+  })
+
+  it('keeps focus reporting the terminal host armed for the pane', async () => {
+    const { session, emit } = createSession()
+    // ConPTY arms ?1004h before any shell marker.
+    emit('\x1b[?1004hprompt$ ')
+    await readModes(session)
+    session.takePendingOutput(false)
+
+    session.resetInputModes()
+
+    const [record] = session.takePendingOutput(false)!.records
+    expect(record).toMatchObject({ kind: 'output' })
+    expect(record?.kind === 'output' && record.data).not.toContain('\x1b[?1004l')
+    session.dispose()
+  })
+})
diff --git a/src/main/daemon/session-subprocess-handle.ts b/src/main/daemon/session-subprocess-handle.ts
index 9268686d78e..be336c998f2 100644
--- a/src/main/daemon/session-subprocess-handle.ts
+++ b/src/main/daemon/session-subprocess-handle.ts
@@ -1,9 +1,12 @@
+import type { PtyChildProcessVerdict } from '../../shared/terminal-process-inspection'
 import type { TerminalExitCause } from '../../shared/terminal-exit-cause'
 
 import type { JobTerminationOutcome } from '../windows/windows-pty-job'
 
 export type SubprocessHandle = {
   pid: number
+  processNameIsSpawnFile?: boolean
+  inspectChildProcesses?(): PtyChildProcessVerdict
   /** Live foreground process name of the PTY (node-pty's `.process`), e.g.
    *  'claude' / 'codex' / 'zsh'. Null once the child has exited. */
   getForegroundProcess(options?: { rawFallback?: boolean }): string | null
diff --git a/src/main/daemon/session.ts b/src/main/daemon/session.ts
index a52e40a8678..7d113665292 100644
--- a/src/main/daemon/session.ts
+++ b/src/main/daemon/session.ts
@@ -4,10 +4,7 @@ import { createSessionOutputPipeline } from './session-output-pipeline'
 import { SessionProducerPause } from './session-producer-pause'
 import { SessionShellReadyBarrier } from './session-shell-ready-barrier'
 import type { TerminalShellRecoveryBarrier } from './terminal-shell-recovery-barrier'
-import {
-  SessionTerminationController,
-  IMMEDIATE_KILL_PHYSICAL_EXIT_TIMEOUT_MS
-} from './session-termination-controller'
+import { SessionTerminationController } from './session-termination-controller'
 import type { SubprocessHandle } from './session-subprocess-handle'
 import type { JobTerminationOutcome } from '../windows/windows-pty-job'
 import type { SessionOptions } from './session-options'
@@ -21,6 +18,7 @@ import type {
   TakePendingOutputResult,
   TerminalSnapshot
 } from './types'
+import type { PtyChildProcessVerdict } from '../../shared/terminal-process-inspection'
 import type { TerminalExitCause } from '../../shared/terminal-exit-cause'
 
 export class Session {
@@ -29,6 +27,7 @@ export class Session {
   readonly terminalHandle: string | null
   readonly launchAgent: TuiAgent | null
   readonly wslDistro: string | null
+  readonly processNameIsSpawnFile: boolean
   private _state: SessionState = 'running'
   private _exitCode: number | null = null
   private _disposed = false
@@ -47,6 +46,7 @@ export class Session {
     this.launchAgent = opts.launchAgent ?? null
     this.wslDistro = opts.wslDistro ?? null
     this.subprocess = opts.subprocess
+    this.processNameIsSpawnFile = opts.subprocess.processNameIsSpawnFile === true
     this.onSessionExit = opts.onExit
     const pipeline = createSessionOutputPipeline({
       cols: opts.cols,
@@ -146,13 +146,9 @@ export class Session {
 
     // Daemon POSIX PTYs need the local provider's cooked-echo containment (#13137).
     // DA1/CPR stay immediate unless an echo-risk reply is already held (#13892, #15559).
-    if (this.startupIngress.answerLiveQueryReply(data)) {
-      return
-    }
-
-    // Why: keep queuing during the post-ready flush-gate window ('ready' but not yet flushed); a
-    // direct write would race fresh input ahead of the buffered startup command.
-    if (this.shellReady.tryEnqueue(data)) {
+    // Why the queue: keep queuing during the post-ready flush-gate window ('ready' but not yet
+    // flushed); a direct write would race fresh input ahead of the buffered startup command.
+    if (this.startupIngress.answerLiveQueryReply(data) || this.shellReady.tryEnqueue(data)) {
       return
     }
 
@@ -195,9 +191,7 @@ export class Session {
     this.termination.scheduleForceDisposeFallback()
   }
 
-  async forceKillAndWaitForExit(
-    timeoutMs = IMMEDIATE_KILL_PHYSICAL_EXIT_TIMEOUT_MS
-  ): Promise<void> {
+  async forceKillAndWaitForExit(timeoutMs?: number): Promise<void> {
     await this.termination.forceKillAndWaitForExit(timeoutMs)
   }
 
@@ -253,6 +247,10 @@ export class Session {
     return this.output.getCwd()
   }
 
+  inspectChildProcesses(): PtyChildProcessVerdict {
+    return this.subprocess.inspectChildProcesses?.() ?? 'unverifiable'
+  }
+
   getForegroundProcess(options?: { rawFallback?: boolean }): string | null {
     return this.subprocess.getForegroundProcess(options)
   }
@@ -275,6 +273,10 @@ export class Session {
     this.output.clearScrollback(this.subprocess, this.shellReady.isGatingWrites)
   }
 
+  resetInputModes(): void {
+    this.output.applyInputModeGround(this.recoveryBarrier.groundInputModes())
+  }
+
   prepareForFinalSnapshot(): string {
     const held = this.shellReady.releaseHeldBytes()
     this.startupIngress.snapshotBarrier()
diff --git a/src/main/daemon/shell-ready.ts b/src/main/daemon/shell-ready.ts
index 5208f9ced6b..1f0a84b3a0c 100644
--- a/src/main/daemon/shell-ready.ts
+++ b/src/main/daemon/shell-ready.ts
@@ -126,7 +126,8 @@ const UNWRAPPED: ShellLaunchConfig = {
  */
 export function getShellLaunchConfig(
   shellPath: string,
-  features: readonly ShellStartupFeature[]
+  features: readonly ShellStartupFeature[],
+  options: { hasStartupCommand?: boolean } = {}
 ): ShellLaunchConfig {
   const shellName = pathWin32.basename(basename(shellPath)).toLowerCase()
 
@@ -177,17 +178,18 @@ export function getShellLaunchConfig(
     }
   }
 
-  // Why: mirrors local-pty-shell-ready.ts; markerless fish stays unwrapped. The
-  // selection is baked into the init command, so fish needs no feature env var.
-  if (shellName === 'fish' && features.includes('ready')) {
+  // Why: mirrors local-pty-shell-ready.ts; markerless fish stays unwrapped unless a
+  // startup command (e.g. Orca's Codex launch) needs the codex wrapper. The selection
+  // is baked into the init command, so fish needs no feature env var.
+  if (shellName === 'fish' && (features.includes('ready') || options.hasStartupCommand)) {
     return {
       args: [
         '-l',
         '-C',
-        `${getFishShellReadyInitCommand(SHELL_READY_MARKER)}\n${getFishCodexShellLaunchPreflight()}`
+        `${getFishShellReadyInitCommand(SHELL_READY_MARKER, features.includes('ready'))}\n${getFishCodexShellLaunchPreflight()}`
       ],
       env: {},
-      supportsReadyMarker: true
+      supportsReadyMarker: features.includes('ready')
     }
   }
 
diff --git a/src/main/daemon/terminal-armed-input-modes.ts b/src/main/daemon/terminal-armed-input-modes.ts
index e2ba02a2ca2..ca0e37a6410 100644
--- a/src/main/daemon/terminal-armed-input-modes.ts
+++ b/src/main/daemon/terminal-armed-input-modes.ts
@@ -8,7 +8,7 @@ const HOST_ARMABLE_MODE = 1004
 type ModeKey = number | 'kitty-main' | 'kitty-alt'
 // host: HOST_ARMABLE_MODE armed before any marker or by a prompt a 133;C proved; the ground keeps it.
 // prompt: armed outside a command, unproven until C.
-// command: armed after C; still on at 133;D, it triggers the ground.
+// command: armed after C; still on at any 133;D, it triggers the ground until disarmed.
 // stale: anything else still on; the ground clears it without it ever triggering.
 type ModeOwner = 'host' | 'prompt' | 'command' | 'stale'
 // Matches xterm.js's eviction limit, so the model drops the same entries.
@@ -104,13 +104,14 @@ export class TerminalArmedInputModes {
     this.enableOwner = 'prompt'
   }
 
-  /** OSC 133;D: true when the command left a mode it armed. Demoting makes it one-shot. */
+  /** OSC 133;D: true when a command's mode is still on. Not demoted: a nested shell's
+   *  stray D gets a refuted proof, and the app's real D must still trigger. */
   markCommandEnd(): boolean {
     let left = false
     for (const [key, owner] of this.owners) {
-      if (owner === 'command' || owner === 'prompt') {
-        // The other screen's kitty flags stay parked in xterm and reach no input.
-        left ||= owner === 'command' && (typeof key === 'number' || key === this.kittyKey())
+      // The other screen's kitty flags stay parked in xterm and reach no input.
+      left ||= owner === 'command' && (typeof key === 'number' || key === this.kittyKey())
+      if (owner === 'prompt') {
         this.owners.set(key, 'stale')
       }
     }
diff --git a/src/main/daemon/terminal-attach-cancellation.test.ts b/src/main/daemon/terminal-attach-cancellation.test.ts
new file mode 100644
index 00000000000..1c9fa0a1ea3
--- /dev/null
+++ b/src/main/daemon/terminal-attach-cancellation.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it, vi } from 'vitest'
+import { waitForTerminalAttachOperation } from './terminal-attach-cancellation'
+
+describe('terminal attach cancellation', () => {
+  it('removes cancellation listeners when the operation settles first', async () => {
+    const controller = new AbortController()
+    const removeListener = vi.spyOn(controller.signal, 'removeEventListener')
+
+    await expect(
+      waitForTerminalAttachOperation(Promise.resolve('ready'), controller.signal, 'session-1')
+    ).resolves.toBe('ready')
+
+    expect(removeListener).toHaveBeenCalledTimes(1)
+  })
+
+  it('preserves operation-first ordering when settlement and abort share a turn', async () => {
+    const controller = new AbortController()
+    const operation = Promise.withResolvers<string>()
+    const waiting = waitForTerminalAttachOperation(
+      operation.promise,
+      controller.signal,
+      'session-3'
+    )
+    operation.resolve('ready')
+    controller.abort()
+    await expect(waiting).resolves.toBe('ready')
+  })
+
+  it('rejects promptly on cancellation while the operation remains pending', async () => {
+    const controller = new AbortController()
+    const operation = new Promise<void>(() => {})
+    const waiting = waitForTerminalAttachOperation(operation, controller.signal, 'session-2')
+
+    controller.abort()
+
+    await expect(waiting).rejects.toMatchObject({ name: 'TerminalAttachCanceledError' })
+  })
+})
diff --git a/src/main/daemon/terminal-attach-cancellation.ts b/src/main/daemon/terminal-attach-cancellation.ts
index 9e87cbdb1bc..21c037d91d3 100644
--- a/src/main/daemon/terminal-attach-cancellation.ts
+++ b/src/main/daemon/terminal-attach-cancellation.ts
@@ -1,17 +1,17 @@
 import { TerminalAttachCanceledError } from './daemon-errors'
+import { PromiseSettlementWaiters } from '../../shared/promise-settlement-waiters'
 
-/** Never resolves; only rejects, so it can bound a wait without settling it. */
-export function rejectOnAbort(signal: AbortSignal | undefined, sessionId: string): Promise<never> {
+export function waitForTerminalAttachOperation<T>(
+  operation: Promise<T>,
+  signal: AbortSignal | undefined,
+  sessionId: string
+): Promise<T> {
   if (!signal) {
-    return new Promise<never>(() => {})
+    return operation
   }
-  return new Promise<never>((_resolve, reject) => {
-    if (signal.aborted) {
-      reject(new TerminalAttachCanceledError(sessionId))
-      return
-    }
-    signal.addEventListener('abort', () => reject(new TerminalAttachCanceledError(sessionId)), {
-      once: true
-    })
+  return new PromiseSettlementWaiters(operation).wait({
+    signal,
+    abortInMicrotask: true,
+    createAbortError: () => new TerminalAttachCanceledError(sessionId)
   })
 }
diff --git a/src/main/daemon/terminal-descendant-shutdown.test.ts b/src/main/daemon/terminal-descendant-shutdown.test.ts
index 52258d0a650..c47727f3f90 100644
--- a/src/main/daemon/terminal-descendant-shutdown.test.ts
+++ b/src/main/daemon/terminal-descendant-shutdown.test.ts
@@ -28,9 +28,10 @@ describe('terminal shutdown process-table batching', () => {
         startedAt: 'Mon Jul 13 12:54:47 2026'
       }
     ]).flat()
+    // Each scan is stamped when it starts, after the walks that produced the snapshots.
     readProcessTable
-      .mockResolvedValueOnce({ rows, capturedAtMs: Date.now() })
-      .mockResolvedValue({ rows: [], capturedAtMs: Date.now() })
+      .mockImplementationOnce(async () => ({ rows, capturedAtMs: Date.now() + 1 }))
+      .mockImplementation(async () => ({ rows: [], capturedAtMs: Date.now() + 1 }))
     const shutdowns = Array.from({ length: 20 }, (_, index) => {
       const rootPid = 100 + index
       const snapshot = collectDescendantRows(rootPid, [
diff --git a/src/main/daemon/terminal-history-log-encode-allocation.test.ts b/src/main/daemon/terminal-history-log-encode-allocation.test.ts
new file mode 100644
index 00000000000..00d7a320810
--- /dev/null
+++ b/src/main/daemon/terminal-history-log-encode-allocation.test.ts
@@ -0,0 +1,85 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { decodeTerminalHistoryLog, encodeLogBatch, encodeLogHeader } from './terminal-history-log'
+import type { PendingOutputRecord } from './types'
+
+afterEach(() => vi.restoreAllMocks())
+
+describe('terminal history batch encoding', () => {
+  it('preserves released bytes for empty, Unicode, resize and clear records', () => {
+    const records: PendingOutputRecord[] = [
+      { kind: 'output', data: '' },
+      { kind: 'output', data: 'Aé🐳\ud800\u0000\x1b[31m' },
+      { kind: 'resize', cols: -1, rows: 65536 },
+      { kind: 'resize', cols: 80.9, rows: 24.9 },
+      { kind: 'clear' }
+    ]
+    const encoded = encodeLogBatch(0x1_ffff_ffff, records)
+    expect(encoded.toString('hex')).toBe(
+      '0104000000ffffffff0200000000021000000041c3a9f09f90b3efbfbd001b5b33316d03040000000000ffff0304000000500018000400000000'
+    )
+    expect(decodeTerminalHistoryLog(Buffer.concat([encodeLogHeader(3), encoded]))).toEqual({
+      generation: 3,
+      truncatedTail: false,
+      batches: [
+        {
+          seq: 0xffff_ffff,
+          records: [
+            { kind: 'output', data: '' },
+            { kind: 'output', data: 'Aé🐳\ufffd\u0000\x1b[31m' },
+            { kind: 'resize', cols: 0, rows: 65535 },
+            { kind: 'resize', cols: 80, rows: 24 },
+            { kind: 'clear' }
+          ]
+        }
+      ]
+    })
+    expect(encodeLogBatch(-1, []).toString('hex')).toBe('0104000000ffffffff')
+  })
+
+  it('encodes a 4 MiB checkpoint increment without intermediate framed buffers', () => {
+    const records: PendingOutputRecord[] = Array.from({ length: 1024 }, () => ({
+      kind: 'output',
+      data: 'x'.repeat(4096)
+    }))
+    const alloc = vi.spyOn(Buffer, 'alloc')
+    const allocUnsafe = vi.spyOn(Buffer, 'allocUnsafe')
+    const from = vi.spyOn(Buffer, 'from')
+    const concat = vi.spyOn(Buffer, 'concat')
+
+    const encoded = encodeLogBatch(17, records)
+    const observed = {
+      alloc: alloc.mock.calls.length,
+      allocUnsafe: allocUnsafe.mock.calls.length,
+      from: from.mock.calls.length,
+      concat: concat.mock.calls.length,
+      concatBytes: concat.mock.results.reduce(
+        (bytes, result) =>
+          result.type === 'return' && Buffer.isBuffer(result.value)
+            ? bytes + result.value.length
+            : bytes,
+        0
+      )
+    }
+    vi.restoreAllMocks()
+    console.info(
+      JSON.stringify({ records: records.length, encodedBytes: encoded.length, ...observed })
+    )
+
+    expect(encoded.length).toBe(9 + 1024 * (5 + 4096))
+    expect(decodeTerminalHistoryLog(Buffer.concat([encodeLogHeader(0), encoded]))?.batches).toEqual(
+      [{ seq: 17, records }]
+    )
+    expect(observed).toEqual({ alloc: 0, allocUnsafe: 1, from: 1024, concat: 0, concatBytes: 0 })
+  })
+
+  it('keeps UTF-16 replacement local to each output record', () => {
+    const encoded = encodeLogBatch(1, [
+      { kind: 'output', data: '\ud800' },
+      { kind: 'output', data: '\udc00' },
+      { kind: 'output', data: '\ud800\udc00' }
+    ])
+    expect(encoded.toString('hex')).toBe(
+      '0104000000010000000203000000efbfbd0203000000efbfbd0204000000f0908080'
+    )
+  })
+})
diff --git a/src/main/daemon/terminal-history-log.ts b/src/main/daemon/terminal-history-log.ts
index 8f5fdd07c8d..35bdf5c2921 100644
--- a/src/main/daemon/terminal-history-log.ts
+++ b/src/main/daemon/terminal-history-log.ts
@@ -61,20 +61,43 @@ export function decodeLogHeader(buffer: Buffer): number | null {
 }
 
 export function encodeLogBatch(seq: number, records: PendingOutputRecord[]): Buffer {
-  const frames: Buffer[] = [encodeFrame(FRAME_BATCH, encodeSeqPayload(seq))]
+  let byteLength = 9
+  const outputPayloads: Buffer[] = []
   for (const record of records) {
     if (record.kind === 'output') {
-      frames.push(encodeFrame(FRAME_OUTPUT, Buffer.from(record.data, 'utf8')))
-    } else if (record.kind === 'resize') {
-      const payload = Buffer.alloc(4)
-      payload.writeUInt16LE(clampU16(record.cols), 0)
-      payload.writeUInt16LE(clampU16(record.rows), 2)
-      frames.push(encodeFrame(FRAME_RESIZE, payload))
+      const payload = Buffer.from(record.data, 'utf8')
+      outputPayloads.push(payload)
+      byteLength += 5 + payload.length
     } else {
-      frames.push(encodeFrame(FRAME_CLEAR, Buffer.alloc(0)))
+      byteLength += record.kind === 'resize' ? 9 : 5
     }
   }
-  return Buffer.concat(frames)
+  const batch = Buffer.allocUnsafe(byteLength)
+  batch.writeUInt8(FRAME_BATCH, 0)
+  batch.writeUInt32LE(4, 1)
+  batch.writeUInt32LE(seq >>> 0, 5)
+  let offset = 9
+  let outputIndex = 0
+  for (const record of records) {
+    if (record.kind === 'output') {
+      batch.writeUInt8(FRAME_OUTPUT, offset)
+      const payload = outputPayloads[outputIndex++]
+      batch.writeUInt32LE(payload.length, offset + 1)
+      payload.copy(batch, offset + 5)
+      offset += 5 + payload.length
+    } else if (record.kind === 'resize') {
+      batch.writeUInt8(FRAME_RESIZE, offset)
+      batch.writeUInt32LE(4, offset + 1)
+      batch.writeUInt16LE(clampU16(record.cols), offset + 5)
+      batch.writeUInt16LE(clampU16(record.rows), offset + 7)
+      offset += 9
+    } else {
+      batch.writeUInt8(FRAME_CLEAR, offset)
+      batch.writeUInt32LE(0, offset + 1)
+      offset += 5
+    }
+  }
+  return batch
 }
 
 /** Returns null for missing magic / unknown format version — callers fall
@@ -150,19 +173,6 @@ export function decodeTerminalHistoryLog(buffer: Buffer): TerminalHistoryLogCont
   return { generation, batches, truncatedTail }
 }
 
-function encodeFrame(kind: number, payload: Buffer): Buffer {
-  const header = Buffer.alloc(5)
-  header.writeUInt8(kind, 0)
-  header.writeUInt32LE(payload.length, 1)
-  return Buffer.concat([header, payload])
-}
-
-function encodeSeqPayload(seq: number): Buffer {
-  const payload = Buffer.alloc(4)
-  payload.writeUInt32LE(seq >>> 0, 0)
-  return payload
-}
-
 function clampU16(value: number): number {
   return Math.max(0, Math.min(0xffff, Math.floor(value)))
 }
diff --git a/src/main/daemon/terminal-history-permission-repair.ts b/src/main/daemon/terminal-history-permission-repair.ts
index 7cb8414026e..ffb4ea852cc 100644
--- a/src/main/daemon/terminal-history-permission-repair.ts
+++ b/src/main/daemon/terminal-history-permission-repair.ts
@@ -116,7 +116,10 @@ export function scheduleTerminalHistoryPermissionRepair(basePath: string): Promi
     }
     scheduledBasePaths.delete(oldest.value)
   }
-  const { promise, resolve: settle } = Promise.withResolvers<boolean>()
+  let settle!: (repaired: boolean) => void
+  const promise = new Promise<boolean>((resolve) => {
+    settle = resolve
+  })
   const timer = setTimeout(() => {
     repairTerminalHistoryPermissions(key).then(settle, () => settle(false))
   }, REPAIR_START_DELAY_MS)
diff --git a/src/main/daemon/terminal-host-process-inspection.ts b/src/main/daemon/terminal-host-process-inspection.ts
index 2f9fb1491d9..e149179c1aa 100644
--- a/src/main/daemon/terminal-host-process-inspection.ts
+++ b/src/main/daemon/terminal-host-process-inspection.ts
@@ -1,11 +1,14 @@
 import { isShellProcess } from '../../shared/agent-detection'
 import { recognizeAgentProcess } from '../../shared/agent-process-recognition'
+import type { PtyChildProcessVerdict } from '../../shared/terminal-process-inspection'
 import type { RemoteForegroundEvidence } from '../../shared/foreground-process-evidence'
 import { getCheapProcessTableSnapshot } from '../../shared/cheap-process-table-snapshot-reader'
 import { getStrictProcessTableSnapshotWithAge } from '../../shared/process-table-snapshot-reader'
 import { resolveRemoteForegroundEvidence } from '../providers/agent-foreground-process'
 import { buildPaneProcessFingerprint } from '../providers/posix-pane-foreground-fingerprint'
 import type { Session } from './session'
+import { resolveSpawnFileForegroundFromRows } from './pty-subprocess/spawn-file-foreground-process'
+import { inspectSpawnFileChildProcessesFromRows } from './pty-subprocess/spawn-file-child-processes'
 import {
   clearSteadyStateAnchor,
   getSteadyStateAnchor,
@@ -16,6 +19,7 @@ import { SessionNotFoundError } from './types'
 export type TerminalHostProcessInspection = {
   foregroundProcess: string | null
   hasChildProcesses: boolean
+  childProcessEvidence?: PtyChildProcessVerdict
   foregroundProcessEvidence?: RemoteForegroundEvidence
 }
 
@@ -76,13 +80,32 @@ export async function inspectTerminalHostProcess(args: {
   }
   args.onTier?.('full')
 
-  const foregroundProcess = session.getForegroundProcess()
+  let foregroundProcess = session.getForegroundProcess()
+  let childProcessEvidence: PtyChildProcessVerdict | undefined = session.processNameIsSpawnFile
+    ? 'unverifiable'
+    : undefined
+  if (session.processNameIsSpawnFile && process.platform === 'win32' && incarnationMatches) {
+    foregroundProcess = await session.confirmForegroundProcess()
+    childProcessEvidence = session.inspectChildProcesses()
+  }
   let evidence: RemoteForegroundEvidence
   if (!incarnationMatches) {
     evidence = unverifiableEvidence(args, session, 'incarnation_mismatch')
   } else {
     try {
       const snapshot = await getStrictProcessTableSnapshotWithAge()
+      if (session.processNameIsSpawnFile && process.platform !== 'win32') {
+        const observed = resolveSpawnFileForegroundFromRows(snapshot.rows, session.pid)
+        foregroundProcess = observed.available ? observed.processName : foregroundProcess
+        childProcessEvidence = inspectSpawnFileChildProcessesFromRows(
+          snapshot.rows,
+          session.pid,
+          session.getForegroundProcess({ rawFallback: true })
+        )
+        if (observed.available && observed.processName && !isShellProcess(observed.processName)) {
+          childProcessEvidence = 'children'
+        }
+      }
       evidence = resolveRemoteForegroundEvidence(
         { rootPid: session.pid, fallbackProcess: foregroundProcess },
         {
@@ -110,7 +133,11 @@ export async function inspectTerminalHostProcess(args: {
       evidence.verdict === 'live'
         ? (evidence.processName ?? ordinaryForeground)
         : foregroundProcess,
-    hasChildProcesses: nonShellForeground,
+    hasChildProcesses:
+      childProcessEvidence === undefined
+        ? nonShellForeground
+        : childProcessEvidence !== 'no-children',
+    ...(childProcessEvidence === undefined ? {} : { childProcessEvidence }),
     foregroundProcessEvidence: evidence
   }
 }
diff --git a/src/main/daemon/terminal-host-session-create.ts b/src/main/daemon/terminal-host-session-create.ts
index 7a8dbe379cc..15e86a70a72 100644
--- a/src/main/daemon/terminal-host-session-create.ts
+++ b/src/main/daemon/terminal-host-session-create.ts
@@ -12,7 +12,7 @@ import type { TerminalHostTombstones } from './terminal-host-tombstones'
 import type { TerminalSessionTeardown } from './terminal-session-teardown'
 import { resolveDaemonSessionScrollbackRows } from './daemon-session-scrollback-window'
 import { TerminalAttachCanceledError } from './daemon-errors'
-import { rejectOnAbort } from './terminal-attach-cancellation'
+import { waitForTerminalAttachOperation } from './terminal-attach-cancellation'
 import { SessionNotFoundError } from './types'
 import { resolveWslSessionContext } from './wsl-session-context'
 
@@ -47,10 +47,11 @@ export async function createOrAttachTerminalSession(
     // reaches this a beat after the attach that retired it, and refusing surfaced the raw
     // SessionNotFoundError to the user. Windows makes it the common case, where the plain-shell
     // sweep holds the claim across an OS identity probe and taskkill (#18046).
-    await Promise.race([
+    await waitForTerminalAttachOperation(
       deps.sessionTeardown.settle(opts.sessionId),
-      rejectOnAbort(opts.cancelSignal, opts.sessionId)
-    ])
+      opts.cancelSignal,
+      opts.sessionId
+    )
     deps.assertCreateAllowed()
     existing = deps.sessions.get(opts.sessionId)
     // Unkillable child, or a fresh teardown claimed it while we waited: still nobody's to recreate.
diff --git a/src/main/daemon/terminal-host.ts b/src/main/daemon/terminal-host.ts
index 8ccfe31b707..d5669618c7a 100644
--- a/src/main/daemon/terminal-host.ts
+++ b/src/main/daemon/terminal-host.ts
@@ -21,7 +21,7 @@ import { TerminalHostTombstones } from './terminal-host-tombstones'
 import { listLiveTerminalHostSessions } from './terminal-host-session-listing'
 import { createOrAttachTerminalSession } from './terminal-host-session-create'
 import { TerminalAttachCanceledError } from './daemon-errors'
-import { rejectOnAbort } from './terminal-attach-cancellation'
+import { waitForTerminalAttachOperation } from './terminal-attach-cancellation'
 import { randomUUID } from 'node:crypto'
 import { pruneRetiredPtyIncarnations } from '../../shared/retired-pty-incarnations'
 import {
@@ -84,7 +84,7 @@ export class TerminalHost {
       // Why: the create ahead of us can be stuck on an unreachable share for
       // minutes. Waiting unconditionally is what let one dead path strand every
       // later create and attach for the session, so a canceled caller leaves.
-      await Promise.race([inFlight, rejectOnAbort(opts.cancelSignal, opts.sessionId)])
+      await waitForTerminalAttachOperation(inFlight, opts.cancelSignal, opts.sessionId)
       this.assertCreateOrAttachAllowed(opts)
     }
     this.assertCreateOrAttachAllowed(opts)
@@ -277,6 +277,10 @@ export class TerminalHost {
     getAliveTerminalHostSession(this.sessions, sessionId).clearScrollback()
   }
 
+  resetInputModes(sessionId: string): void {
+    getAliveTerminalHostSession(this.sessions, sessionId).resetInputModes()
+  }
+
   // Why: null-not-throw — checkpoint is best-effort against a session that may have just exited.
   getSnapshot(sessionId: string, opts: { scrollbackRows?: number } = {}): TerminalSnapshot | null {
     return getTerminalHostSnapshot(this.sessions.get(sessionId), opts)
diff --git a/src/main/daemon/terminal-mode-rehydrate-sequences.ts b/src/main/daemon/terminal-mode-rehydrate-sequences.ts
index ac4e34897b6..8537de08961 100644
--- a/src/main/daemon/terminal-mode-rehydrate-sequences.ts
+++ b/src/main/daemon/terminal-mode-rehydrate-sequences.ts
@@ -1,11 +1,9 @@
 import type { TerminalModes } from './types'
 import { RESET_GRAPHIC_RENDITION } from '../../shared/terminal-mode-reset-profiles'
 
-// Why no kitty flags here: rehydrateSequences feeds renderer xterms, and
-// POST_REPLAY_REATTACH_RESET's deliberate kitty reset (stale CSI-u Ctrl+C
-// hazard) must stay authoritative. modes.kittyKeyboardFlags exists for
-// emulator re-seed parity only; a re-seeded emulator answers ?0u and
-// protocol-conformant programs re-push.
+// Why no kitty flags here: renderers re-assert the snapshot's kitty flags
+// (carried beside the payload) in their replay epilogue, after these screen
+// switches. A re-seeded emulator uses modes.kittyKeyboardFlags directly.
 export function buildRehydrateSequences(modes: TerminalModes): string {
   const seqs: string[] = []
   if (modes.alternateScreen) {
diff --git a/src/main/daemon/terminal-shell-armed-input-mode-recovery.test.ts b/src/main/daemon/terminal-shell-armed-input-mode-recovery.test.ts
index fef4d762c69..630fe21d0bf 100644
--- a/src/main/daemon/terminal-shell-armed-input-mode-recovery.test.ts
+++ b/src/main/daemon/terminal-shell-armed-input-mode-recovery.test.ts
@@ -50,14 +50,14 @@ describe('armed input modes arm the unclean-death trigger', () => {
     expect(triggers(scanner, chunk)).toBe(false)
   })
 
-  it('stays one-shot until a fresh enable', () => {
+  it('re-triggers at every D until the mode is disarmed', () => {
     const scanner = new TerminalShellLifecycleScanner()
 
     expect(triggers(scanner, `${COMMAND_START}\x1b[?1004hRUN${COMMAND_DONE}`)).toBe(true)
-    // A refuted proof leaves ?1004 armed; later prompts must not pause again.
-    expect(triggers(scanner, `$ ${COMMAND_START}ls${COMMAND_DONE}`)).toBe(false)
-    expect(triggers(scanner, `$ ${COMMAND_START}ls${COMMAND_DONE}`)).toBe(false)
-    expect(triggers(scanner, `$ ${COMMAND_START}\x1b[?1000hRUN${COMMAND_DONE}`)).toBe(true)
+    // A refuted proof leaves ?1004 armed and command-owned; each later D re-asks.
+    expect(triggers(scanner, `$ ${COMMAND_START}ls${COMMAND_DONE}`)).toBe(true)
+    expect(triggers(scanner, `$ ${COMMAND_START}ls${COMMAND_DONE}`)).toBe(true)
+    expect(triggers(scanner, `\x1b[?1004l$ ${COMMAND_START}ls${COMMAND_DONE}`)).toBe(false)
   })
 
   it('treats modes the prompt armed before the command started as shell-owned', () => {
@@ -342,6 +342,25 @@ describe('Session grounds a proven normal-buffer death', () => {
     expect(snapshot?.snapshotAnsi).toContain('\x1b[?1004h')
   })
 
+  it("grounds an agent's modes when it dies after nested shells' refuted Ds", async () => {
+    const leak = { data: `${COMMAND_START}nested\r\n${COMMAND_DONE}`, confirm: false }
+    const { snapshot, records, proofs } = await runSteps([
+      { data: `${PROMPT_START}$ ${COMMAND_START}\x1b[>1u\x1b[?1003hAGENT` },
+      ...Array.from({ length: 5 }, () => leak),
+      { data: `EXIT\r\n${COMMAND_DONE}${PROMPT_START}$ `, confirm: true },
+      { data: `${COMMAND_START}ls\r\n${COMMAND_DONE}${PROMPT_START}$ ` }
+    ])
+
+    // The confirmed ground disarms the modes: the next prompt opens no episode.
+    expect(proofs).toBe(6)
+    expect(
+      records.some(
+        (record) => record.kind === 'output' && record.data.includes(PROCESS_BOUNDARY_GROUND)
+      )
+    ).toBe(true)
+    expect(snapshot?.modes.mouseTrackingMode).toBe('none')
+  })
+
   it('flushes without the ground when the proof is refuted', async () => {
     const { snapshot, records } = await runNormalBufferDeath(false)
 
diff --git a/src/main/daemon/terminal-shell-lifecycle-scanner.test.ts b/src/main/daemon/terminal-shell-lifecycle-scanner.test.ts
index 7d5136d9050..48e1658bef1 100644
--- a/src/main/daemon/terminal-shell-lifecycle-scanner.test.ts
+++ b/src/main/daemon/terminal-shell-lifecycle-scanner.test.ts
@@ -14,6 +14,7 @@ describe('TerminalShellLifecycleScanner', () => {
       const events = scanner.scan(chunk)
 
       expect(events.uncleanDeathTriggerEnd).toBe(chunk.indexOf('shell-marker'))
+      expect(events.uncleanDeathTriggerStart).toBe(chunk.indexOf('\x1b]133;D'))
       expect(chunk.slice(events.uncleanDeathTriggerEnd)).toBe('shell-marker')
       expect(scanner.isAlternateScreenActive).toBe(true)
       expect(scanner.owner).toBeUndefined()
@@ -45,6 +46,7 @@ describe('TerminalShellLifecycleScanner', () => {
       const events = scanner.scan('37\x07tail')
 
       expect(events.uncleanDeathTriggerEnd).toBe('37\x07'.length)
+      expect(events.uncleanDeathTriggerStart).toBe(0)
       expect('37\x07tail'.slice(events.uncleanDeathTriggerEnd)).toBe('tail')
       expect(scanner.owner).toBeUndefined()
     })
@@ -268,18 +270,19 @@ describe('TerminalShellLifecycleScanner', () => {
 })
 
 describe('unclean trigger arming', () => {
-  it('fires once per alternate-screen occupancy and re-arms only on a fresh entry', () => {
+  it('fires at every D while the alternate screen stays up, and never once it is left', () => {
     const scanner = new TerminalShellLifecycleScanner()
+    const prompt = '\x1b]133;C\x07ls\r\n\x1b]133;D;0\x07'
 
     expect(scanner.scan('\x1b[?1049hTUI\x1b]133;D;137\x07').uncleanDeathTriggerEnd).toBeDefined()
-    // Refuted path: no reset scanned, alt still active — a later prompt's D must not re-trigger.
-    const second = scanner.scan('\x1b]133;C\x07ls\r\n\x1b]133;D;0\x07')
-    expect(second.uncleanDeathTriggerEnd).toBeUndefined()
-    expect(second.cleanExitCandidate).toBeUndefined()
+    // Refuted path: no reset scanned, so each later D re-asks — one may be the TUI's real death.
+    for (let index = 0; index < 5; index += 1) {
+      expect(scanner.scan(prompt).uncleanDeathTriggerEnd).toBeDefined()
+    }
     expect(scanner.isAlternateScreenActive).toBe(true)
 
-    expect(
-      scanner.scan('\x1b]133;C\x07\x1b[?1049hAGAIN\x1b]133;D;9\x07').uncleanDeathTriggerEnd
-    ).toBeDefined()
+    const left = scanner.scan(`\x1b[?1049l${prompt}`)
+    expect(left.uncleanDeathTriggerEnd).toBeUndefined()
+    expect(scanner.scan(prompt).uncleanDeathTriggerEnd).toBeUndefined()
   })
 })
diff --git a/src/main/daemon/terminal-shell-lifecycle-scanner.ts b/src/main/daemon/terminal-shell-lifecycle-scanner.ts
index f62ab47cfd3..f93f9c4df66 100644
--- a/src/main/daemon/terminal-shell-lifecycle-scanner.ts
+++ b/src/main/daemon/terminal-shell-lifecycle-scanner.ts
@@ -34,6 +34,8 @@ export type ShellLifecycleScanEvents = {
    * and after this index were NOT consumed; the caller re-feeds them.
    */
   uncleanDeathTriggerEnd?: number
+  /** Where that OSC 133;D begins in the chunk; 0 when it began in an earlier one. */
+  uncleanDeathTriggerStart?: number
   /** An OSC 133;D closed a command that had entered the alternate screen and left it cleanly. */
   cleanExitCandidate?: { generation: number }
 }
@@ -54,11 +56,6 @@ export class TerminalShellLifecycleScanner {
   private altActive = false
   private commandEnteredAlternateScreen = false
   private readonly inputModes = new TerminalArmedInputModes()
-  // Why one-shot: a refuted proof leaves the alt screen up (no reset was ever
-  // scanned), and without disarming every later prompt's D would re-open a full
-  // pause-and-inspect episode. Only a fresh alternate-screen enable re-arms; input
-  // modes are one-shot by markCommandEnd's demotion.
-  private uncleanTriggerArmed = false
 
   get owner(): TerminalOwner | undefined {
     return this.ownerState
@@ -97,7 +94,6 @@ export class TerminalShellLifecycleScanner {
       // this a mirror seeded mid-TUI never arms its unclean-death trigger and
       // the whole occupancy loses recovery.
       this.altActive = opts.alternateScreen
-      this.uncleanTriggerArmed = opts.alternateScreen
       this.commandEnteredAlternateScreen = opts.alternateScreen
     }
   }
@@ -123,7 +119,6 @@ export class TerminalShellLifecycleScanner {
         this.inputModes.reset()
         this.altActive = false
         this.commandEnteredAlternateScreen = false
-        this.uncleanTriggerArmed = false
         continue
       }
       if (oscPayload !== undefined) {
@@ -142,13 +137,12 @@ export class TerminalShellLifecycleScanner {
         }
         // An alternate screen or a command's input mode still up at command-finished
         // means the app died without its own teardown; the caller must repair first.
-        const leftInputModes = this.inputModes.markCommandEnd()
-        const uncleanDeath = (this.uncleanTriggerArmed && this.altActive) || leftInputModes
+        // Every D re-asks: a refuted one may be a nested shell's while the app lives.
+        const uncleanDeath = this.inputModes.markCommandEnd() || this.altActive
         const cleanExit = !uncleanDeath && this.commandEnteredAlternateScreen && !this.altActive
         this.revoke()
         this.commandEnteredAlternateScreen = false
         if (uncleanDeath) {
-          this.uncleanTriggerArmed = false
           this.scanTail = ''
           // Why the clamp: a complete OSC can never sit wholly inside the
           // carried tail (extractScanTail keeps incomplete ones only), so this
@@ -158,6 +152,7 @@ export class TerminalShellLifecycleScanner {
             0,
             match.index + match[0].length - previousTailLength
           )
+          events.uncleanDeathTriggerStart = Math.max(0, match.index - previousTailLength)
           return events
         }
         if (cleanExit) {
@@ -195,7 +190,6 @@ export class TerminalShellLifecycleScanner {
           this.altActive = enabled
           if (enabled) {
             this.commandEnteredAlternateScreen = true
-            this.uncleanTriggerArmed = true
           }
         }
       }
diff --git a/src/main/daemon/terminal-shell-recovery-barrier.test.ts b/src/main/daemon/terminal-shell-recovery-barrier.test.ts
index 7cea4ed314e..dead64c9bec 100644
--- a/src/main/daemon/terminal-shell-recovery-barrier.test.ts
+++ b/src/main/daemon/terminal-shell-recovery-barrier.test.ts
@@ -4,6 +4,10 @@ import { TerminalShellRecoveryBarrier } from './terminal-shell-recovery-barrier'
 import type { PtyIngressEmission } from '../../shared/pty-startup-ingress'
 
 const TRIGGER = '\x1b[?1049hTUI\x1b]133;D;137\x07'
+// The barrier holds the whole D mark; the ground rides on it.
+const MARK = '\x1b]133;D;137\x07'
+const HEAD = TRIGGER.slice(0, -MARK.length)
+const GROUNDED = `${MARK}${PROCESS_BOUNDARY_GROUND}`
 
 function passthrough(data: string, rawStartSeq = 0): PtyIngressEmission {
   return { data, rawStartSeq, rawEndSeq: rawStartSeq + data.length, transformed: false }
@@ -47,14 +51,14 @@ describe('TerminalShellRecoveryBarrier', () => {
     barrier.accept(passthrough(`${TRIGGER}SHELL-PROMPT`, 100))
     expect(confirm).toHaveBeenCalledTimes(1)
     expect(released).toEqual([
-      { data: TRIGGER, rawStartSeq: 100, rawEndSeq: 100 + TRIGGER.length, transformed: false }
+      { data: HEAD, rawStartSeq: 100, rawEndSeq: 100 + HEAD.length, transformed: false }
     ])
 
     resolveConfirm?.(true)
     await vi.waitFor(() => expect(released).toHaveLength(3))
     expect(released[1]).toEqual({
-      data: PROCESS_BOUNDARY_GROUND,
-      rawStartSeq: 100 + TRIGGER.length,
+      data: GROUNDED,
+      rawStartSeq: 100 + HEAD.length,
       rawEndSeq: 100 + TRIGGER.length,
       transformed: true
     })
@@ -80,12 +84,7 @@ describe('TerminalShellRecoveryBarrier', () => {
 
     resolveConfirm?.(true)
     await vi.waitFor(() => expect(released).toHaveLength(4))
-    expect(released.map((emission) => emission.data)).toEqual([
-      TRIGGER,
-      PROCESS_BOUNDARY_GROUND,
-      'late-1',
-      'late-2'
-    ])
+    expect(released.map((emission) => emission.data)).toEqual([HEAD, GROUNDED, 'late-1', 'late-2'])
   })
 
   it('flushes unmodified with no injection when the proof is refuted', async () => {
@@ -97,8 +96,8 @@ describe('TerminalShellRecoveryBarrier', () => {
     barrier.accept(passthrough(`${TRIGGER}nested-shell`))
     resolveConfirm?.(false)
 
-    await vi.waitFor(() => expect(released).toHaveLength(2))
-    expect(released.map((emission) => emission.data)).toEqual([TRIGGER, 'nested-shell'])
+    await vi.waitFor(() => expect(released).toHaveLength(3))
+    expect(released.map((emission) => emission.data)).toEqual([HEAD, MARK, 'nested-shell'])
     expect(barrier.getOwner()).toBeUndefined()
   })
 
@@ -110,12 +109,12 @@ describe('TerminalShellRecoveryBarrier', () => {
     })
 
     barrier.accept(passthrough(`${TRIGGER}prompt`))
-    await vi.waitFor(() => expect(released).toHaveLength(2))
-    expect(released.map((emission) => emission.data)).toEqual([TRIGGER, 'prompt'])
+    await vi.waitFor(() => expect(released).toHaveLength(3))
+    expect(released.map((emission) => emission.data)).toEqual([HEAD, MARK, 'prompt'])
 
     resolveConfirm?.(true)
     await new Promise((resolve) => setTimeout(resolve, 5))
-    expect(released).toHaveLength(2)
+    expect(released).toHaveLength(3)
     expect(barrier.getOwner()).toBeUndefined()
   })
 
@@ -128,7 +127,7 @@ describe('TerminalShellRecoveryBarrier', () => {
     barrier.accept(passthrough(TRIGGER))
     barrier.accept(passthrough('0123456789'))
 
-    expect(released.map((emission) => emission.data)).toEqual([TRIGGER, '0123456789'])
+    expect(released.map((emission) => emission.data)).toEqual([HEAD, MARK, '0123456789'])
     expect(barrier.getOwner()).toBeUndefined()
   })
 
@@ -144,8 +143,8 @@ describe('TerminalShellRecoveryBarrier', () => {
     alive = false
     resolveConfirm?.(true)
 
-    await vi.waitFor(() => expect(released).toHaveLength(2))
-    expect(released.map((emission) => emission.data)).toEqual([TRIGGER, 'prompt'])
+    await vi.waitFor(() => expect(released).toHaveLength(3))
+    expect(released.map((emission) => emission.data)).toEqual([HEAD, MARK, 'prompt'])
     expect(barrier.getOwner()).toBeUndefined()
   })
 
@@ -165,11 +164,11 @@ describe('TerminalShellRecoveryBarrier', () => {
 
     await vi.waitFor(() =>
       expect(released.map((emission) => emission.data)).toEqual([
-        TRIGGER,
-        PROCESS_BOUNDARY_GROUND,
+        HEAD,
+        GROUNDED,
         'first-prompt',
-        '\x1b[?1049hAGAIN\x1b]133;D;9\x07',
-        PROCESS_BOUNDARY_GROUND,
+        '\x1b[?1049hAGAIN',
+        `\x1b]133;D;9\x07${PROCESS_BOUNDARY_GROUND}`,
         'second-prompt'
       ])
     )
@@ -274,13 +273,12 @@ describe('TerminalShellRecoveryBarrier', () => {
     await vi.waitFor(() =>
       expect(released.map((emission) => emission.data)).toEqual([
         head,
-        '37\x07',
-        PROCESS_BOUNDARY_GROUND,
+        `37\x07${PROCESS_BOUNDARY_GROUND}`,
         'PROMPT'
       ])
     )
     expect(released[1]).toMatchObject({ rawStartSeq: head.length, rawEndSeq: head.length + 3 })
-    expect(released[3]).toMatchObject({
+    expect(released[2]).toMatchObject({
       rawStartSeq: head.length + 3,
       rawEndSeq: head.length + tail.length
     })
@@ -308,34 +306,71 @@ describe('TerminalShellRecoveryBarrier', () => {
 
     await settled
     await vi.waitFor(() =>
-      expect(released.map((emission) => emission.data)).toEqual([
-        TRIGGER,
-        PROCESS_BOUNDARY_GROUND,
-        'after-poison'
-      ])
+      expect(released.map((emission) => emission.data)).toEqual([HEAD, GROUNDED, 'after-poison'])
     )
     await expect(barrier.idle()).resolves.toBeUndefined()
   })
 
-  it('opens at most one episode per alternate-screen occupancy after a refuted proof', async () => {
+  it('asks at every D of a live TUI and releases every byte, in order, unmodified', async () => {
     const { barrier, released, confirm } = createBarrier({ confirm: async () => false })
-
-    barrier.accept(passthrough(`${TRIGGER}prompt`))
-    await vi.waitFor(() => expect(released).toHaveLength(2))
-    expect(confirm).toHaveBeenCalledTimes(1)
-
-    // Why: the refuted path never scans a reset, so alt stays active — later
-    // ordinary prompts must not each re-open a pause-and-inspect episode.
+    const leak = '\x1b]133;C\x07nested\x1b]133;D;0\x07'
+    const sent = [`\x1b[?1049h\x1b[?1003hTUI${leak}frame`]
     for (let index = 0; index < 5; index += 1) {
-      const prompt = passthrough(`\x1b]133;C\x07ls\r\n\x1b]133;D;0\x07`)
-      barrier.accept(prompt)
-      expect(released.at(-1)).toBe(prompt)
+      sent.push(`${leak}frame${index}`)
     }
-    expect(confirm).toHaveBeenCalledTimes(1)
 
-    // A fresh alternate-screen entry re-arms recovery.
-    barrier.accept(passthrough(`\x1b]133;C\x07\x1b[?1049hAGAIN\x1b]133;D;9\x07`))
-    expect(confirm).toHaveBeenCalledTimes(2)
+    let seq = 0
+    for (const data of sent) {
+      barrier.accept(passthrough(data, seq))
+      seq += data.length
+    }
+    await vi.waitFor(() => expect(confirm).toHaveBeenCalledTimes(6))
+    await barrier.idle()
+
+    expect(released.map((emission) => emission.data).join('')).toBe(sent.join(''))
+    expect(released.every((emission) => !emission.transformed)).toBe(true)
+    expect(barrier.getOwner()).toBeUndefined()
+  })
+
+  it("grounds a TUI that dies after many nested shells' Ds were refuted", async () => {
+    let dead = false
+    const { barrier, released, confirm } = createBarrier({ confirm: async () => dead })
+    const leak = '\x1b]133;C\x07nested\x1b]133;D;0\x07'
+
+    barrier.accept(passthrough(`\x1b[?1049hTUI${leak.repeat(5)}`))
+    await vi.waitFor(() => expect(confirm).toHaveBeenCalledTimes(5))
+    await barrier.idle()
+    dead = true
+    barrier.accept(passthrough('\x1b]133;D;137\x07prompt'))
+
+    await vi.waitFor(() => expect(barrier.getOwner()).toBe('shell'))
+    expect(released.slice(-2).map((emission) => emission.data)).toEqual([GROUNDED, 'prompt'])
+    // Grounded once: the next prompt opens no episode.
+    barrier.accept(passthrough('\x1b]133;C\x07ls\x1b]133;D;0\x07'))
+    expect(confirm).toHaveBeenCalledTimes(6)
+  })
+
+  it('grounds a real death D that arrives while a stray D is still being proven', async () => {
+    const proofs: ((confirmed: boolean) => void)[] = []
+    const { barrier, released, confirm } = createBarrier({
+      confirm: () => new Promise((resolve) => void proofs.push(resolve))
+    })
+    const leak = '\x1b[?1049h\x1b[?1003hTUI\x1b]133;C\x07nested\x1b]133;D;0\x07'
+
+    barrier.accept(passthrough(leak, 0))
+    barrier.accept(passthrough('frame\x1b]133;D;137\x07prompt', leak.length))
+    proofs[0]?.(false)
+    await vi.waitFor(() => expect(confirm).toHaveBeenCalledTimes(2))
+    proofs[1]?.(true)
+
+    await vi.waitFor(() => expect(barrier.getOwner()).toBe('shell'))
+    expect(released.map((emission) => emission.data)).toEqual([
+      leak.slice(0, -'\x1b]133;D;0\x07'.length),
+      '\x1b]133;D;0\x07',
+      'frame',
+      GROUNDED,
+      'prompt'
+    ])
   })
 
   it('bounds awaitProofSettled by its own deadline when a clean-exit proof hangs', async () => {
@@ -359,7 +394,7 @@ describe('TerminalShellRecoveryBarrier', () => {
     const barrier = new TerminalShellRecoveryBarrier({
       confirmShellForeground: confirm,
       release: (emission) => {
-        if (!headThrown && emission.data === TRIGGER) {
+        if (!headThrown && emission.data === HEAD) {
           headThrown = true
           throw new Error('client transport died mid-broadcast')
         }
@@ -373,10 +408,7 @@ describe('TerminalShellRecoveryBarrier', () => {
     resolveConfirm?.(true)
 
     await vi.waitFor(() =>
-      expect(released.map((emission) => emission.data)).toEqual([
-        PROCESS_BOUNDARY_GROUND,
-        'SHELL-PROMPT'
-      ])
+      expect(released.map((emission) => emission.data)).toEqual([GROUNDED, 'SHELL-PROMPT'])
     )
     expect(barrier.getOwner()).toBe('shell')
   })
@@ -385,11 +417,11 @@ describe('TerminalShellRecoveryBarrier', () => {
     const { barrier, released } = createBarrier({ confirm: () => new Promise(() => {}) })
 
     barrier.accept(passthrough(`${TRIGGER}prompt`))
-    expect(released.map((emission) => emission.data)).toEqual([TRIGGER])
+    expect(released.map((emission) => emission.data)).toEqual([HEAD])
 
     barrier.flushPending()
 
-    expect(released.map((emission) => emission.data)).toEqual([TRIGGER, 'prompt'])
+    expect(released.map((emission) => emission.data)).toEqual([HEAD, MARK, 'prompt'])
     expect(barrier.getOwner()).toBeUndefined()
   })
 
@@ -398,8 +430,50 @@ describe('TerminalShellRecoveryBarrier', () => {
     barrier.accept(passthrough(`${TRIGGER}prompt`))
     barrier.dispose()
 
-    expect(released.map((emission) => emission.data)).toEqual([TRIGGER])
+    expect(released.map((emission) => emission.data)).toEqual([HEAD])
     barrier.accept(passthrough('after-dispose'))
     expect(released).toHaveLength(1)
   })
+
+  it('carries the ground on an ESC-backslash terminator split from its ESC', async () => {
+    const { barrier, released } = createBarrier()
+    const head = '\x1b[?1049hTUI\x1b]133;D;137\x1b'
+    barrier.accept(passthrough(head, 0))
+    barrier.accept(passthrough('\\PROMPT', head.length))
+
+    await vi.waitFor(() => expect(barrier.getOwner()).toBe('shell'))
+    expect(released).toEqual([
+      passthrough(head, 0),
+      {
+        data: `\\${PROCESS_BOUNDARY_GROUND}`,
+        rawStartSeq: head.length,
+        rawEndSeq: head.length + 1,
+        transformed: true
+      },
+      passthrough('PROMPT', head.length + 1)
+    ])
+  })
+
+  it.each([
+    ['confirmed', async () => true],
+    ['refuted', async () => false],
+    ['timed out', () => new Promise<boolean>(() => {})]
+  ])('covers at least one raw unit with every emission when %s', async (_, confirm) => {
+    const { barrier, released } = createBarrier({ confirm, maxPendingMs: 20 })
+    const stream = [`${TRIGGER}p1`, '\x1b[?1049h\x1b]133;D;1\x1b', '\\p2', `${TRIGGER}`, 'p3']
+    let seq = 0
+    for (const data of stream) {
+      barrier.accept(passthrough(data, seq))
+      seq += data.length
+    }
+    await vi.waitFor(() => expect(released.at(-1)?.rawEndSeq).toBe(seq))
+
+    expect(released.every((emission) => emission.rawEndSeq > emission.rawStartSeq)).toBe(true)
+    const raw = released.map((emission) =>
+      emission.transformed
+        ? emission.data.slice(0, emission.rawEndSeq - emission.rawStartSeq)
+        : emission.data
+    )
+    expect(raw.join('')).toBe(stream.join(''))
+  })
 })
diff --git a/src/main/daemon/terminal-shell-recovery-barrier.ts b/src/main/daemon/terminal-shell-recovery-barrier.ts
index 69149835216..d8a29d4b4b4 100644
--- a/src/main/daemon/terminal-shell-recovery-barrier.ts
+++ b/src/main/daemon/terminal-shell-recovery-barrier.ts
@@ -7,6 +7,9 @@ import type { TerminalOwner } from '../../shared/terminal-owner'
 // flood or hang means the trigger misfired, so bail out and flush unmodified.
 const MAX_QUEUED_BYTES = 262_144
 const MAX_PENDING_MS = 750
+// Why bounded: the grounded mark is one indivisible span, and the relay never
+// sends a span wider than its 16K source frame.
+const MAX_HELD_MARK_CHARS = 4096
 
 export type TerminalShellRecoveryBarrierOptions = {
   /** Fresh execution-host proof that the spawned shell owns the PTY foreground. */
@@ -22,13 +25,17 @@ export type TerminalShellRecoveryBarrierOptions = {
  * Ordered output barrier for dead-TUI mode recovery. Sits between startup
  * ingress and the output plane. When a shell-integration command-done marker
  * (OSC 133;D) arrives while the alternate screen is still active, the stream
- * pauses at that exact byte boundary, the execution host proves the shell owns
- * the PTY foreground, and on proof a mode reset is injected as in-stream output
- * so every downstream consumer (host emulator, mirrors, attached renderers,
+ * holds that marker, the execution host proves the shell owns the PTY
+ * foreground, and on proof a mode reset is injected as in-stream output so
+ * every downstream consumer (host emulator, mirrors, attached renderers,
  * history) converges — and the queued shell prompt then paints onto the normal
- * buffer instead of the discarded alternate screen. Any failure (refuted proof,
- * timeout, overflow, death, disposal) flushes the queue unmodified, preserving
- * incumbent behavior. Clean alternate-screen exits prove ownership without
+ * buffer instead of the discarded alternate screen. Holding the whole marker
+ * keeps a mid-proof snapshot on an escape boundary. The reset rides on it so
+ * every emission covers at least one raw unit: a zero-raw span is never sent by
+ * credit-windowed delivery (SSH relay), and its seq would not rise above a
+ * mid-proof snapshot, so snapshot-seq dedup would drop it. Any failure (refuted
+ * proof, timeout, overflow, death, disposal) flushes the queue unmodified,
+ * preserving incumbent behavior. Clean alternate-screen exits prove ownership without
  * pausing: the model needs no correction, only snapshot metadata.
  */
 export class TerminalShellRecoveryBarrier {
@@ -43,7 +50,6 @@ export class TerminalShellRecoveryBarrier {
   private queuedBytes = 0
   private pending = false
   private pendingGeneration = 0
-  private pendingRawSeq = 0
   private pendingEpisode = 0
   private bailTimer: ReturnType<typeof setTimeout> | null = null
   private idleWaiters: (() => void)[] = []
@@ -80,6 +86,13 @@ export class TerminalShellRecoveryBarrier {
     return this.scanner.owner
   }
 
+  /** Reset Terminal: grounds the lifecycle model now and returns the bytes for
+   *  the host's other models. Not released downstream: a zero-raw span is dropped
+   *  by credit-windowed delivery and snapshot-seq dedup, so each client grounds itself. */
+  groundInputModes(): string {
+    return this.scanner.groundProcessBoundary()
+  }
+
   /** Answers a paired runtime's ownership question from the barrier's settled
    *  state. The barrier scans bytes before any consumer receives them, so its
    *  verdict is never behind the caller's parse position — a fresh process
@@ -187,12 +200,16 @@ export class TerminalShellRecoveryBarrier {
       this.releaseDownstream(emission)
       return
     }
+    // end >= 1 keeps the held mark inside this emission's raw span.
     const splittable =
-      !emission.transformed && emission.rawEndSeq - emission.rawStartSeq === emission.data.length
+      end >= 1 &&
+      !emission.transformed &&
+      emission.rawEndSeq - emission.rawStartSeq === emission.data.length
     if (!splittable) {
       // Why skip the episode: the raw-seq boundary inside a transformed emission
-      // cannot be reconstructed, so release everything and keep the scanner
-      // honest about the remainder — incumbent behavior for this rare corner.
+      // (or a mark ending outside this one) cannot be reconstructed, so release
+      // everything and keep the scanner honest about the remainder — incumbent
+      // behavior for this rare corner.
       try {
         this.releaseDownstream(emission)
       } catch {
@@ -202,20 +219,29 @@ export class TerminalShellRecoveryBarrier {
       this.consumeForStateOnly(emission.data.slice(end))
       return
     }
+    const start = Math.max(events.uncleanDeathTriggerStart ?? 0, end - MAX_HELD_MARK_CHARS)
+    const markSeq = emission.rawStartSeq + start
     const splitSeq = emission.rawStartSeq + end
-    try {
-      this.releaseDownstream({
-        data: emission.data.slice(0, end),
-        rawStartSeq: emission.rawStartSeq,
-        rawEndSeq: splitSeq,
-        transformed: false
-      })
-    } catch {
-      // Why swallowed: the emulator and records already took the head inside
-      // emit before a client's broadcast threw; aborting here would cost the
-      // post-boundary prompt its entire recovery episode.
+    if (start > 0) {
+      try {
+        this.releaseDownstream({
+          data: emission.data.slice(0, start),
+          rawStartSeq: emission.rawStartSeq,
+          rawEndSeq: markSeq,
+          transformed: false
+        })
+      } catch {
+        // Why swallowed: the emulator and records already took the head inside
+        // emit before a client's broadcast threw; aborting here would cost the
+        // post-boundary prompt its entire recovery episode.
+      }
     }
-    this.enterPending(splitSeq)
+    this.enterPending({
+      data: emission.data.slice(start, end),
+      rawStartSeq: markSeq,
+      rawEndSeq: splitSeq,
+      transformed: false
+    })
     if (end < emission.data.length) {
       this.enqueue({
         data: emission.data.slice(end),
@@ -240,14 +266,15 @@ export class TerminalShellRecoveryBarrier {
     }
   }
 
-  private enterPending(rawSeq: number): void {
+  /** Opens an episode holding `mark` as the queue head, already scanned. */
+  private enterPending(mark: PtyIngressEmission): void {
     this.pending = true
     this.pendingEpisode += 1
     this.pendingGeneration = this.scanner.generation
-    this.pendingRawSeq = rawSeq
     const episode = this.pendingEpisode
     this.bailTimer = setTimeout(() => this.finishPending(episode, false), this.maxPendingMs)
     this.bailTimer.unref?.()
+    this.enqueue(mark)
     // Why the guard: the callback is injected; a synchronous throw must not
     // escape after pending flipped true and strand the episode until the bail.
     let proof: Promise<boolean>
@@ -279,21 +306,9 @@ export class TerminalShellRecoveryBarrier {
     this.queue = []
     this.queuedBytes = 0
     try {
-      if (confirmed && this.isAlive()) {
-        // Scanned before release so alt-state stays honest.
-        const ground = this.scanner.groundProcessBoundary()
-        try {
-          this.releaseDownstream({
-            data: ground,
-            rawStartSeq: this.pendingRawSeq,
-            rawEndSeq: this.pendingRawSeq,
-            transformed: true
-          })
-        } catch {
-          // Why swallowed: a throwing downstream client must not strand the
-          // queued prompt bytes below.
-        }
-        this.scanner.trySetOwner(this.pendingGeneration)
+      const mark = queued.shift()
+      if (mark) {
+        this.releaseMark(mark, confirmed && this.isAlive())
       }
       for (let index = 0; index < queued.length; index += 1) {
         if (this.disposed) {
@@ -318,6 +333,27 @@ export class TerminalShellRecoveryBarrier {
     }
   }
 
+  private releaseMark(mark: PtyIngressEmission, grounded: boolean): void {
+    try {
+      this.releaseDownstream(
+        grounded
+          ? {
+              ...mark,
+              // Scanned before release so alt-state stays honest.
+              data: mark.data + this.scanner.groundProcessBoundary(),
+              transformed: true
+            }
+          : mark
+      )
+    } catch {
+      // Why swallowed: a throwing downstream client must not strand the
+      // queued prompt bytes behind it.
+    }
+    if (grounded) {
+      this.scanner.trySetOwner(this.pendingGeneration)
+    }
+  }
+
   private enqueue(emission: PtyIngressEmission): void {
     this.queue.push(emission)
     this.queuedBytes += emission.data.length
diff --git a/src/main/daemon/types.ts b/src/main/daemon/types.ts
index d8d88fab033..2ef4dfeb117 100644
--- a/src/main/daemon/types.ts
+++ b/src/main/daemon/types.ts
@@ -206,9 +206,10 @@ export type GetCwdRequest = {
   }
 }
 
-export type ClearScrollbackRequest = {
+// Why resetInputModes is a type, not a clear flag: an older daemon rejects it instead of clearing.
+export type TerminalBufferActionRequest = {
   id: string
-  type: 'clearScrollback'
+  type: 'clearScrollback' | 'resetInputModes'
   payload: {
     sessionId: string
   }
@@ -321,7 +322,7 @@ export type DaemonRequest =
   | InspectProcessRequest
   | ConfirmForegroundProcessRequest
   | ConfirmShellForegroundRequest
-  | ClearScrollbackRequest
+  | TerminalBufferActionRequest
   | ShutdownRequest
   | PingRequest
   | SystemResolverHealthRequest
diff --git a/src/main/daemon/windows-conpty-warmup.test.ts b/src/main/daemon/windows-conpty-warmup.test.ts
index 1ab19b0c97e..a10d054926c 100644
--- a/src/main/daemon/windows-conpty-warmup.test.ts
+++ b/src/main/daemon/windows-conpty-warmup.test.ts
@@ -1,6 +1,11 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import type * as pty from 'node-pty'
 import { warmWindowsConptyOnce } from './windows-conpty-warmup'
+import { assignHostProcessToKillOnCloseJob } from '../windows/windows-pty-job'
+
+vi.mock('../windows/windows-pty-job', () => ({
+  assignHostProcessToKillOnCloseJob: vi.fn(() => true)
+}))
 
 function setPlatform(platform: NodeJS.Platform): () => void {
   const original = process.platform
@@ -17,6 +22,7 @@ afterEach(() => {
   restorePlatform?.()
   restorePlatform = null
   vi.restoreAllMocks()
+  vi.clearAllMocks()
 })
 
 function makeFakePty(): { proc: pty.IPty; fireExit: () => void } {
@@ -41,6 +47,7 @@ describe('warmWindowsConptyOnce', () => {
     await flushImmediates()
 
     expect(spawnPty).not.toHaveBeenCalled()
+    expect(assignHostProcessToKillOnCloseJob).not.toHaveBeenCalled()
   })
 
   it('spawns a short-lived cmd.exe with the bundled ConPTY on Windows', async () => {
@@ -52,6 +59,7 @@ describe('warmWindowsConptyOnce', () => {
     await flushImmediates()
 
     expect(spawnPty).toHaveBeenCalledTimes(1)
+    expect(assignHostProcessToKillOnCloseJob).toHaveBeenCalledBefore(vi.mocked(spawnPty))
     const [file, args, options] = vi.mocked(spawnPty).mock.calls[0]
     expect(String(file).toLowerCase()).toContain('cmd')
     expect(args).toEqual(['/c', 'exit'])
diff --git a/src/main/daemon/windows-conpty-warmup.ts b/src/main/daemon/windows-conpty-warmup.ts
index aea1c50b2db..98c3144380c 100644
--- a/src/main/daemon/windows-conpty-warmup.ts
+++ b/src/main/daemon/windows-conpty-warmup.ts
@@ -1,7 +1,36 @@
 import os from 'node:os'
-import * as pty from 'node-pty'
+import type * as pty from 'node-pty'
+import { createRequire } from 'node:module'
+import { canUseBunPty, spawnBunPty } from './pty-subprocess/bun-pty-process'
+import { assignHostProcessToKillOnCloseJob } from '../windows/windows-pty-job'
 
 const WARMUP_KILL_TIMEOUT_MS = 10_000
+const requireFromMain = createRequire(__filename)
+
+const spawnWarmupPty: typeof pty.spawn = (file, args, options) => {
+  if (canUseBunPty()) {
+    if (!Array.isArray(args)) {
+      throw new Error('Bun PTY requires argument arrays')
+    }
+    const env: Record<string, string> = {}
+    for (const [key, value] of Object.entries(options.env ?? process.env)) {
+      if (value !== undefined) {
+        env[key] = value
+      }
+    }
+    return spawnBunPty({
+      file,
+      args,
+      cwd: options.cwd ?? os.homedir(),
+      env,
+      cols: options.cols ?? 2,
+      rows: options.rows ?? 1
+    })
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: node-pty's installed package implements the declared spawn contract.
+  const nodePty = requireFromMain('node-pty') as typeof pty
+  return nodePty.spawn(file, args, options)
+}
 
 /**
  * Pays the one-time cost of the first ConPTY spawn (conpty native module
@@ -9,7 +38,7 @@ const WARMUP_KILL_TIMEOUT_MS = 10_000
  * those binaries) at daemon boot instead of on the user's first terminal.
  * Measured ~2.7s on a Windows dev profile for the first spawn vs ~70ms after.
  */
-export function warmWindowsConptyOnce(spawnPty: typeof pty.spawn = pty.spawn): void {
+export function warmWindowsConptyOnce(spawnPty: typeof pty.spawn = spawnWarmupPty): void {
   if (process.platform !== 'win32') {
     return
   }
@@ -17,6 +46,10 @@ export function warmWindowsConptyOnce(spawnPty: typeof pty.spawn = pty.spawn): v
   // real spawn arriving first simply does the warming itself.
   setImmediate(() => {
     try {
+      // Warm-up children must die with the daemon, even before its first real terminal.
+      if (!canUseBunPty()) {
+        assignHostProcessToKillOnCloseJob()
+      }
       const proc = spawnPty(process.env.COMSPEC || 'cmd.exe', ['/c', 'exit'], {
         name: 'xterm-256color',
         cols: 2,
diff --git a/src/main/dsh/dsh-home-patch.test.ts b/src/main/dsh/dsh-home-patch.test.ts
new file mode 100644
index 00000000000..53ab8986715
--- /dev/null
+++ b/src/main/dsh/dsh-home-patch.test.ts
@@ -0,0 +1,147 @@
+import { describe, expect, it } from 'vitest'
+import {
+  applyManagedDshPatch,
+  findManagedDshPatchRegion,
+  readManagedDshHooksConfigPath,
+  removeManagedDshPatch
+} from './dsh-home-patch'
+
+const HOOKS_PATH = '/home/dev/.orca/agent-hooks/dsh-hooks.json'
+
+/** applyManagedDshPatch returns null only for files it refuses to edit; these cases expect an edit. */
+function applyOrFail(text: string, hooksPath = HOOKS_PATH): string {
+  const next = applyManagedDshPatch(text, hooksPath)
+  if (next === null) {
+    throw new Error('expected the patch file to be editable')
+  }
+  return next
+}
+
+// The body DSH writes into a freshly initialized patch file.
+const PRISTINE = [
+  '# Your patch layer for this dsh profile, applied after every bundle layer:',
+  '# a top-level YAML array of loader patch entries (id-targeted config',
+  '# overrides, disables, and insert lists; `!!js` expressions allowed).',
+  '[]',
+  ''
+].join('\n')
+
+const USER_ROWS = ['- id: llm-deepseek', '  config:', "    apiKeyEnv: 'MY_KEY'", ''].join('\n')
+
+describe('applyManagedDshPatch', () => {
+  it('creates the managed block in an empty file', () => {
+    const text = applyOrFail('')
+    expect(readManagedDshHooksConfigPath(text)).toBe(HOOKS_PATH)
+    expect(text).toContain("name: '@deepseek-ai/dsh-hooks-claude-code'")
+    expect(text.endsWith('\n')).toBe(true)
+  })
+
+  it('replaces the empty flow sequence DSH ships, keeping its comments', () => {
+    const text = applyOrFail(PRISTINE)
+    // `- item` after `[]` is a YAML parse error, so the `[]` token has to go.
+    expect(text).not.toMatch(/^\[]$/m)
+    expect(text).toContain('# Your patch layer for this dsh profile')
+    expect(readManagedDshHooksConfigPath(text)).toBe(HOOKS_PATH)
+  })
+
+  it('appends after user rows without touching them', () => {
+    const text = applyOrFail(USER_ROWS)
+    expect(text.startsWith(USER_ROWS.trimEnd())).toBe(true)
+    expect(readManagedDshHooksConfigPath(text)).toBe(HOOKS_PATH)
+  })
+
+  it('rewrites its own block in place rather than stacking copies', () => {
+    const once = applyOrFail(USER_ROWS, '/old/path.json')
+    const twice = applyOrFail(once)
+    expect(twice.match(/orca-managed-dsh-hooks \(managed by Orca/g)).toHaveLength(1)
+    expect(readManagedDshHooksConfigPath(twice)).toBe(HOOKS_PATH)
+    expect(twice).not.toContain('/old/path.json')
+  })
+
+  it('is idempotent', () => {
+    const once = applyOrFail(PRISTINE)
+    expect(applyOrFail(once)).toBe(once)
+  })
+
+  it('treats `[] # comment` as the empty document it is, keeping the comment', () => {
+    // The exact-match check missed this and appended `- insert:` after the flow sequence.
+    const text = '[] # keep empty\n'
+    const next = applyOrFail(text)
+    expect(next).not.toMatch(/^\s*\[]/m)
+    expect(next).toContain('# keep empty')
+    expect(readManagedDshHooksConfigPath(next)).toBe(HOOKS_PATH)
+  })
+
+  it.each([
+    '- id: llm-deepseek\n  config: {}\n', // block sequence — editable
+    '\n',
+    '# only a comment\n'
+  ])('still edits %j', (text) => {
+    expect(applyManagedDshPatch(text, HOOKS_PATH)).not.toBeNull()
+  })
+
+  it.each(['[{ id: llm-deepseek }]\n', '[\n  { id: a },\n  { id: b }\n]\n'])(
+    'refuses to append after the non-empty flow sequence %j',
+    (text) => {
+      // YAML forbids a block entry after a flow sequence: appending would leave DSH unable
+      // to parse the user's own layer either, so there is no safe in-place edit.
+      expect(applyManagedDshPatch(text, HOOKS_PATH)).toBeNull()
+    }
+  )
+
+  it('quotes a path containing a single quote', () => {
+    const awkward = "/home/o'brien/.orca/agent-hooks/dsh-hooks.json"
+    expect(readManagedDshHooksConfigPath(applyOrFail('', awkward))).toBe(awkward)
+  })
+})
+
+describe('removeManagedDshPatch', () => {
+  it('restores the empty flow sequence when nothing else remains', () => {
+    const installed = applyOrFail(PRISTINE)
+    const { text, changed } = removeManagedDshPatch(installed)
+    expect(changed).toBe(true)
+    // Without this the file would come back as an unparseable empty document.
+    expect(text.trimEnd().endsWith('[]')).toBe(true)
+    expect(text).toContain('# Your patch layer for this dsh profile')
+  })
+
+  it('leaves user rows alone and adds no [] when they remain', () => {
+    const installed = applyOrFail(USER_ROWS)
+    const { text } = removeManagedDshPatch(installed)
+    expect(text.trimEnd()).toBe(USER_ROWS.trimEnd())
+  })
+
+  it('reports no change when the file carries no managed block', () => {
+    expect(removeManagedDshPatch(USER_ROWS)).toEqual({ text: USER_ROWS, changed: false })
+  })
+})
+
+describe('findManagedDshPatchRegion', () => {
+  const ORPHAN_START = '# >>> orca-managed-dsh-hooks (managed by Orca; do not edit) >>>'
+
+  it('fails closed on a truncated region rather than guessing its extent', () => {
+    // Splicing a guessed end marker would delete the user rows that follow.
+    const truncated = `${ORPHAN_START}\n${USER_ROWS}`
+    expect(findManagedDshPatchRegion(truncated)).toBeNull()
+    expect(removeManagedDshPatch(truncated).changed).toBe(false)
+  })
+
+  it('never pairs an orphan start with a later block\u2019s end', () => {
+    // The data-loss shape: an interrupted write leaves an orphan start above the user's
+    // rows, and the next install appends a complete block below them. Pairing the orphan
+    // with the new end marker would make the region cover the user's rows, so install
+    // (rewrite) and remove (strip) would both delete them.
+    const truncated = `${ORPHAN_START}\n${USER_ROWS}`
+    const installed = applyOrFail(truncated)
+    expect(installed).toContain('apiKeyEnv')
+
+    const region = findManagedDshPatchRegion(installed)
+    expect(region).not.toBeNull()
+    const covered = installed.split('\n').slice(region?.startLine ?? 0, (region?.endLine ?? 0) + 1)
+    expect(covered.join('\n')).not.toContain('apiKeyEnv')
+
+    // Both mutating paths must leave the user's rows intact, twice over.
+    expect(applyOrFail(installed)).toContain('apiKeyEnv')
+    expect(removeManagedDshPatch(installed).text).toContain('apiKeyEnv')
+  })
+})
diff --git a/src/main/dsh/dsh-home-patch.ts b/src/main/dsh/dsh-home-patch.ts
new file mode 100644
index 00000000000..723d030e214
--- /dev/null
+++ b/src/main/dsh/dsh-home-patch.ts
@@ -0,0 +1,195 @@
+/**
+ * Orca's managed block inside `$DSH_HOME/cordis.patch.yml`.
+ *
+ * That file is a hand-editable top-level YAML sequence of loader patch entries, and no
+ * YAML library is vendored in the main process, so Orca manages only its own
+ * marker-delimited region: install rewrites the region, remove strips it, and everything
+ * outside the markers is copied through byte for byte. Appending sequence entries to a
+ * block sequence is always valid YAML, so the region can live at the end of any file.
+ *
+ * The one shape that is not append-safe is an empty *flow* sequence (`[]`), which is what
+ * DSH writes into a freshly initialized patch file. `- item` after `[]` is a parse error,
+ * so that token is dropped when the managed block is added and restored when it is the
+ * last thing removed — otherwise the file would come back as an unparseable empty
+ * document.
+ */
+
+const START_MARKER = '# >>> orca-managed-dsh-hooks (managed by Orca; do not edit) >>>'
+const END_MARKER = '# <<< orca-managed-dsh-hooks <<<'
+
+/** The loader row id Orca owns. A patch row is addressed by id, so this must be stable. */
+const MANAGED_ROW_ID = 'orca-agent-hooks'
+
+const EMPTY_FLOW_SEQUENCE = '[]'
+
+export type ManagedDshPatchRegion = { startLine: number; endLine: number }
+
+function splitLines(text: string): string[] {
+  return text.split('\n')
+}
+
+/** Locate the managed region, or null when the file carries none. */
+export function findManagedDshPatchRegion(text: string): ManagedDshPatchRegion | null {
+  // Why the NEAREST preceding start, not the first one: an interrupted write can leave an
+  // orphan start marker with no end. Pairing that orphan with a LATER block's end marker
+  // makes the region swallow every row in between — so the next install (which rewrites the
+  // region) or remove (which strips it) would delete the user's own rows. Walking forward
+  // and resetting the candidate on each start keeps an orphan un-paired, which leaves it as
+  // an inert comment line rather than a deletion range.
+  let startLine = -1
+  for (const [index, line] of splitLines(text).entries()) {
+    const trimmed = line.trim()
+    if (trimmed === START_MARKER) {
+      startLine = index
+    } else if (trimmed === END_MARKER && startLine !== -1) {
+      return { startLine, endLine: index }
+    }
+  }
+  return null
+}
+
+function buildManagedBlock(managedHooksPath: string): string[] {
+  return [
+    START_MARKER,
+    '- insert:',
+    `    - id: ${MANAGED_ROW_ID}`,
+    "      name: '@deepseek-ai/dsh-hooks-claude-code'",
+    '      config:',
+    `        configPath: ${quoteYamlScalar(managedHooksPath)}`,
+    END_MARKER
+  ]
+}
+
+/** Single-quoted YAML scalar: the only escape inside one is a doubled quote. */
+function quoteYamlScalar(value: string): string {
+  return `'${value.replaceAll("'", "''")}'`
+}
+
+function unquoteYamlScalar(value: string): string {
+  const trimmed = value.trim()
+  if (trimmed.startsWith("'") && trimmed.endsWith("'") && trimmed.length >= 2) {
+    return trimmed.slice(1, -1).replaceAll("''", "'")
+  }
+  if (trimmed.startsWith('"') && trimmed.endsWith('"') && trimmed.length >= 2) {
+    return trimmed.slice(1, -1)
+  }
+  return trimmed
+}
+
+/** The `configPath` Orca's managed region currently points at, if any. */
+export function readManagedDshHooksConfigPath(text: string): string | undefined {
+  const region = findManagedDshPatchRegion(text)
+  if (!region) {
+    return undefined
+  }
+  for (const line of splitLines(text).slice(region.startLine + 1, region.endLine)) {
+    const match = /^\s*configPath:\s*(.+?)\s*$/.exec(line)
+    if (match) {
+      return unquoteYamlScalar(match[1])
+    }
+  }
+  return undefined
+}
+
+function stripRegion(lines: string[], region: ManagedDshPatchRegion): string[] {
+  return [...lines.slice(0, region.startLine), ...lines.slice(region.endLine + 1)]
+}
+
+function isBlank(line: string): boolean {
+  return line.trim().length === 0
+}
+
+function isComment(line: string): boolean {
+  return line.trim().startsWith('#')
+}
+
+function documentBody(lines: readonly string[]): readonly string[] {
+  return lines.filter((line) => !isBlank(line) && !isComment(line))
+}
+
+/** Strips a trailing `# …` so `[] # keep empty` reads as the empty sequence it is. */
+function withoutTrailingComment(line: string): string {
+  const hash = line.indexOf('#')
+  return (hash === -1 ? line : line.slice(0, hash)).trim()
+}
+
+/** True when the body is the empty flow sequence, with or without a trailing comment. */
+function isEmptyFlowDocument(lines: readonly string[]): boolean {
+  const body = documentBody(lines)
+  return body.length === 1 && withoutTrailingComment(body[0]) === EMPTY_FLOW_SEQUENCE
+}
+
+/**
+ * True when Orca cannot append its block to this file: the body is a NON-EMPTY flow
+ * sequence (`[a, b]`, or one spread over lines).
+ *
+ * Why it matters: YAML forbids a block entry after a flow sequence, so appending Orca's
+ * `- insert:` would produce a file DSH cannot parse — losing the user's own patch layer as
+ * well as Orca's hooks. There is no safe in-place edit, so install refuses instead.
+ *
+ * Exported because status has to report the same refusal on every read, not just on the
+ * install that first hit it.
+ */
+export function isDshPatchFileUnappendable(text: string): boolean {
+  const lines = splitLines(text)
+  const body = documentBody(lines)
+  return body.length > 0 && body[0].trimStart().startsWith('[') && !isEmptyFlowDocument(lines)
+}
+
+function withoutTrailingBlanks(lines: readonly string[]): readonly string[] {
+  const end = lines.findLastIndex((line) => !isBlank(line))
+  return lines.slice(0, end + 1)
+}
+
+function joinPreservingTrailingNewline(lines: readonly string[]): string {
+  const text = lines.join('\n')
+  return text.endsWith('\n') || text.length === 0 ? text : `${text}\n`
+}
+
+/**
+ * Install (or refresh) Orca's managed region so the DSH hook bridge reads
+ * `managedHooksPath`. Everything outside the markers is preserved.
+ *
+ * Returns null when the file cannot be edited safely — see isNonEmptyFlowDocument. The
+ * caller reports that; it must never write a file DSH would then fail to parse.
+ */
+export function applyManagedDshPatch(text: string, managedHooksPath: string): string | null {
+  const lines = splitLines(text)
+  const block = buildManagedBlock(managedHooksPath)
+  const region = findManagedDshPatchRegion(text)
+  if (region) {
+    return joinPreservingTrailingNewline([
+      ...lines.slice(0, region.startLine),
+      ...block,
+      ...lines.slice(region.endLine + 1)
+    ])
+  }
+  if (isDshPatchFileUnappendable(text)) {
+    return null
+  }
+  // Why dropped: `- item` after `[]` is a parse error, and an empty sequence has nothing to
+  // preserve. Only the token goes — a trailing comment on that line stays.
+  const kept = isEmptyFlowDocument(lines)
+    ? lines.map((line) =>
+        withoutTrailingComment(line) === EMPTY_FLOW_SEQUENCE
+          ? line.slice(line.indexOf(EMPTY_FLOW_SEQUENCE) + EMPTY_FLOW_SEQUENCE.length)
+          : line
+      )
+    : lines
+  return joinPreservingTrailingNewline([...withoutTrailingBlanks(kept), ...block])
+}
+
+/** Strip Orca's managed region, restoring `[]` when nothing else is left. */
+export function removeManagedDshPatch(text: string): { text: string; changed: boolean } {
+  const region = findManagedDshPatchRegion(text)
+  if (!region) {
+    return { text, changed: false }
+  }
+  const kept = withoutTrailingBlanks(stripRegion(splitLines(text), region))
+  // Why restore `[]`: a document of comments alone is not a valid entry list, so removing
+  // Orca's block must not leave DSH a file it cannot parse.
+  const body = kept.every((line) => isBlank(line) || isComment(line))
+    ? [...kept, EMPTY_FLOW_SEQUENCE]
+    : kept
+  return { text: joinPreservingTrailingNewline(body), changed: true }
+}
diff --git a/src/main/dsh/hook-service.test.ts b/src/main/dsh/hook-service.test.ts
new file mode 100644
index 00000000000..331ecd97888
--- /dev/null
+++ b/src/main/dsh/hook-service.test.ts
@@ -0,0 +1,200 @@
+import {
+  chmodSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { DshHookService } from './hook-service'
+import { DSH_HOOK_EVENTS } from './hook-settings'
+
+// Why: getSharedManagedScriptPath() writes under homedir()/.orca and the patch layer
+// resolves via DSH_HOME ?? ~/.dsh. Point the home env at a temp dir and clear DSH_HOME so
+// install/remove never touches the real ~/.orca or a developer's own DSH home.
+// Why both names: os.homedir() reads $HOME on POSIX and %USERPROFILE% on Windows, and this
+// file asserts the Windows script name too — setting only HOME would let a Windows run edit
+// the developer's real home.
+let home: string
+let originalHome: string | undefined
+let originalUserProfile: string | undefined
+let originalDshHome: string | undefined
+
+beforeEach(() => {
+  home = mkdtempSync(join(tmpdir(), 'orca-dsh-hook-'))
+  originalHome = process.env.HOME
+  originalUserProfile = process.env.USERPROFILE
+  originalDshHome = process.env.DSH_HOME
+  process.env.HOME = home
+  process.env.USERPROFILE = home
+  delete process.env.DSH_HOME
+})
+
+afterEach(() => {
+  if (originalHome === undefined) {
+    delete process.env.HOME
+  } else {
+    process.env.HOME = originalHome
+  }
+  if (originalUserProfile === undefined) {
+    delete process.env.USERPROFILE
+  } else {
+    process.env.USERPROFILE = originalUserProfile
+  }
+  if (originalDshHome === undefined) {
+    delete process.env.DSH_HOME
+  } else {
+    process.env.DSH_HOME = originalDshHome
+  }
+  rmSync(home, { recursive: true, force: true })
+})
+
+const configPath = (): string => join(home, '.dsh', 'cordis.patch.yml')
+const managedHooksPath = (): string => join(home, '.orca', 'agent-hooks', 'dsh-hooks.json')
+const scriptPath = (): string =>
+  join(home, '.orca', 'agent-hooks', process.platform === 'win32' ? 'dsh-hook.cmd' : 'dsh-hook.sh')
+
+function readManagedHooks(): { hooks: Record<string, unknown[]> } {
+  const parsed: { hooks: Record<string, unknown[]> } = JSON.parse(
+    readFileSync(managedHooksPath(), 'utf-8')
+  )
+  return parsed
+}
+
+describe('DshHookService', () => {
+  it('reports not_installed before install, with no DSH home on disk', () => {
+    expect(new DshHookService().getStatus().state).toBe('not_installed')
+  })
+
+  it('installs the patch block, the managed hooks file, and the script', () => {
+    const status = new DshHookService().install()
+    expect(status.state).toBe('installed')
+    expect(status.managedHooksPresent).toBe(true)
+    expect(status.configPath).toBe(configPath())
+
+    const patch = readFileSync(configPath(), 'utf-8')
+    expect(patch).toContain("name: '@deepseek-ai/dsh-hooks-claude-code'")
+    expect(patch).toContain(`configPath: '${managedHooksPath()}'`)
+
+    // Exactly the events DSH's bridge can fire — registering more would register nothing
+    // for them and leave the status permanently `partial`.
+    expect(Object.keys(readManagedHooks().hooks).sort()).toEqual([...DSH_HOOK_EVENTS].sort())
+    expect(readFileSync(scriptPath(), 'utf-8').length).toBeGreaterThan(0)
+  })
+
+  it('posts to the dsh hook route', () => {
+    new DshHookService().install()
+    expect(readFileSync(scriptPath(), 'utf-8')).toContain('/hook/dsh')
+  })
+
+  it('restores the pane identity DSH scrubs before anything reads it', () => {
+    // DSH drops env names containing KEY/TOKEN, so the script has to recover ORCA_PANE_KEY
+    // and ORCA_AGENT_LAUNCH_TOKEN from their aliases before the guard or the spool run.
+    new DshHookService().install()
+    const script = readFileSync(scriptPath(), 'utf-8')
+    const restoreAt = script.indexOf('ORCA_AGENT_PANE')
+    const guardAt = script.indexOf('ORCA_AGENT_HOOK_PORT')
+    expect(restoreAt).toBeGreaterThan(-1)
+    expect(script).toContain('ORCA_AGENT_LAUNCH')
+    expect(restoreAt).toBeLessThan(guardAt)
+  })
+
+  it('is idempotent', () => {
+    const service = new DshHookService()
+    service.install()
+    const first = readFileSync(configPath(), 'utf-8')
+    expect(service.install().state).toBe('installed')
+    expect(readFileSync(configPath(), 'utf-8')).toBe(first)
+  })
+
+  it('preserves an existing user patch layer through install and remove', () => {
+    const userRows = ['- id: llm-deepseek', '  config:', '    thinking: disabled', ''].join('\n')
+    mkdirSync(join(home, '.dsh'), { recursive: true })
+    writeFileSync(configPath(), userRows, 'utf-8')
+
+    const service = new DshHookService()
+    expect(service.install().state).toBe('installed')
+    expect(readFileSync(configPath(), 'utf-8')).toContain('thinking: disabled')
+
+    expect(service.remove().state).toBe('not_installed')
+    expect(readFileSync(configPath(), 'utf-8').trimEnd()).toBe(userRows.trimEnd())
+  })
+
+  it('removes the managed hooks file along with the block', () => {
+    const service = new DshHookService()
+    service.install()
+    service.remove()
+    expect(() => readFileSync(managedHooksPath(), 'utf-8')).toThrow()
+    expect(service.getStatus().state).toBe('not_installed')
+  })
+
+  it('reports partial when an event loses its managed hook', () => {
+    const service = new DshHookService()
+    service.install()
+    const managed = readManagedHooks()
+    delete managed.hooks.Stop
+    writeFileSync(managedHooksPath(), JSON.stringify(managed, null, 2), 'utf-8')
+
+    const status = service.getStatus()
+    expect(status.state).toBe('partial')
+    expect(status.detail).toContain('Stop')
+  })
+
+  it('reports not_installed when the block points somewhere else', () => {
+    const service = new DshHookService()
+    service.install()
+    writeFileSync(
+      configPath(),
+      readFileSync(configPath(), 'utf-8').replace(managedHooksPath(), '/somewhere/else.json'),
+      'utf-8'
+    )
+    const status = service.getStatus()
+    expect(status.state).toBe('not_installed')
+    expect(status.detail).toContain('/somewhere/else.json')
+  })
+
+  // Why POSIX-only: on Windows chmod toggles the read-only attribute, so `mode & 0o777`
+  // reads 0o666 for any writable file and the assertion cannot mean what it says.
+  it.skipIf(process.platform === 'win32')('keeps an owner-only patch file owner-only', () => {
+    // CWE-732: the temp+rename replacement must not widen the file to the umask default.
+    const userRows = '- id: llm-deepseek\n  config: {}\n'
+    mkdirSync(join(home, '.dsh'), { recursive: true })
+    writeFileSync(configPath(), userRows, 'utf-8')
+    chmodSync(configPath(), 0o600)
+
+    expect(new DshHookService().install().state).toBe('installed')
+    expect(statSync(configPath()).mode & 0o777).toBe(0o600)
+  })
+
+  it('refuses a flow-style patch file instead of corrupting it', () => {
+    // Appending a block entry after `[…]` is invalid YAML — DSH would then fail to load the
+    // user's own layer as well as Orca's hooks, so install must change nothing.
+    const flow = '[{ id: llm-deepseek }]\n'
+    mkdirSync(join(home, '.dsh'), { recursive: true })
+    writeFileSync(configPath(), flow, 'utf-8')
+
+    const service = new DshHookService()
+    const installed = service.install()
+    expect(installed.state).toBe('error')
+    expect(installed.detail).toContain('flow-style sequence')
+    expect(readFileSync(configPath(), 'utf-8')).toBe(flow)
+
+    // Why re-read: a later status poll must keep saying why, not decay to a bare
+    // `not_installed` that gives the user nothing to act on.
+    const polled = service.getStatus()
+    expect(polled.state).toBe('error')
+    expect(polled.detail).toContain('flow-style sequence')
+  })
+
+  it('honours DSH_HOME', () => {
+    const dshHome = join(home, 'custom-dsh-home')
+    process.env.DSH_HOME = dshHome
+    const status = new DshHookService().install()
+    expect(status.configPath).toBe(join(dshHome, 'cordis.patch.yml'))
+    expect(status.state).toBe('installed')
+  })
+})
diff --git a/src/main/dsh/hook-service.ts b/src/main/dsh/hook-service.ts
new file mode 100644
index 00000000000..0767f686f24
--- /dev/null
+++ b/src/main/dsh/hook-service.ts
@@ -0,0 +1,253 @@
+import { mkdirSync, readFileSync, rmSync } from 'node:fs'
+import { dirname } from 'node:path'
+import type { SFTPWrapper } from 'ssh2'
+
+import type { AgentHookInstallState, AgentHookInstallStatus } from '../../shared/agent-hook-types'
+import { isDefinitiveAbsence } from '../../shared/definitive-filesystem-absence'
+import {
+  buildWindowsAgentHookCurlPostCommand,
+  writeHooksJson,
+  writeManagedScript
+} from '../agent-hooks/installer-utils'
+import { refreshManagedScriptIfPresent } from '../agent-hooks/managed-hook-script-refresh'
+import {
+  readTextFileRemote,
+  writeManagedScriptRemote,
+  writeTextFileRemoteAtomic
+} from '../agent-hooks/installer-utils-remote'
+import {
+  buildPosixHookPayloadCapture,
+  buildPosixHookSpoolLines,
+  buildWindowsHookEnvironmentGuardLines,
+  buildWindowsHookStdinDrainEpilogue
+} from '../agent-hooks/hook-stdin-contract'
+import { buildPosixAgentHookPostCommand } from '../agent-hooks/hook-post-command'
+import {
+  applyManagedDshPatch,
+  isDshPatchFileUnappendable,
+  readManagedDshHooksConfigPath,
+  removeManagedDshPatch
+} from './dsh-home-patch'
+import {
+  buildDshManagedHooksFile,
+  DSH_HOOK_EVENTS,
+  getDshConfigPath,
+  getDshManagedCommand,
+  getDshManagedCommandMatcher,
+  getDshManagedHooksPath,
+  getDshManagedScriptPath,
+  getDshRemoteConfigPath,
+  getDshRemoteManagedCommand,
+  getDshRemoteManagedHooksPath,
+  readManagedDshHookEvents
+} from './hook-settings'
+
+function getManagedScript(target: 'local' | 'posix' = 'local'): string {
+  if (target === 'local' && process.platform === 'win32') {
+    return [
+      '@echo off',
+      'setlocal',
+      // Why: same scrub as POSIX — restore the canonical names from their aliases first.
+      'if not defined ORCA_PANE_KEY if defined ORCA_AGENT_PANE set "ORCA_PANE_KEY=%ORCA_AGENT_PANE%"',
+      'if not defined ORCA_AGENT_LAUNCH_TOKEN if defined ORCA_AGENT_LAUNCH set "ORCA_AGENT_LAUNCH_TOKEN=%ORCA_AGENT_LAUNCH%"',
+      'if defined ORCA_AGENT_HOOK_ENDPOINT if exist "%ORCA_AGENT_HOOK_ENDPOINT%" call "%ORCA_AGENT_HOOK_ENDPOINT%" 2>nul',
+      ...buildWindowsHookEnvironmentGuardLines(),
+      buildWindowsAgentHookCurlPostCommand('dsh'),
+      'exit /b 0',
+      ...buildWindowsHookStdinDrainEpilogue(),
+      ''
+    ].join('\r\n')
+  }
+
+  return [
+    '#!/bin/sh',
+    // Why first: DSH's shell executor drops every env var whose NAME contains KEY, TOKEN,
+    // SECRET or PASSWORD before the hook starts, which takes ORCA_PANE_KEY and
+    // ORCA_AGENT_LAUNCH_TOKEN with it. Orca mirrors both onto scrub-safe aliases at spawn
+    // (see agent-hook-scrub-safe-env.ts); restore the canonical names from them so every
+    // line below — including the shared spool and post builders — is unchanged.
+    ': "${ORCA_PANE_KEY:=${ORCA_AGENT_PANE:-}}"',
+    ': "${ORCA_AGENT_LAUNCH_TOKEN:=${ORCA_AGENT_LAUNCH:-}}"',
+    'export ORCA_PANE_KEY ORCA_AGENT_LAUNCH_TOKEN',
+    ...buildPosixHookPayloadCapture(),
+    ...buildPosixHookSpoolLines('dsh'),
+    // Why: the endpoint file holds the live port/token; a PTY that outlived an Orca
+    // restart carries stale env, so source it to reach the new server.
+    'if [ -n "$ORCA_AGENT_HOOK_ENDPOINT" ] && [ -r "$ORCA_AGENT_HOOK_ENDPOINT" ]; then',
+    '  . "$ORCA_AGENT_HOOK_ENDPOINT" 2>/dev/null || :',
+    'fi',
+    'if [ -z "$ORCA_AGENT_HOOK_PORT" ] || [ -z "$ORCA_AGENT_HOOK_TOKEN" ] || [ -z "$ORCA_PANE_KEY" ]; then',
+    '  spool_hook_event',
+    '  exit 0',
+    'fi',
+    ...buildPosixAgentHookPostCommand('dsh').map((line, index, lines) =>
+      index === lines.length - 1 ? `${line} >/dev/null 2>&1 || spool_hook_event` : line
+    ),
+    'exit 0',
+    ''
+  ].join('\n')
+}
+
+/** '' when the file is absent (both are created lazily), null when it exists but cannot be read. */
+function readTextOrAbsent(path: string): string | null {
+  try {
+    return readFileSync(path, 'utf-8')
+  } catch (error) {
+    return isDefinitiveAbsence(error) ? '' : null
+  }
+}
+
+/** null for anything that is not parseable JSON; the caller reads that as "no events". */
+function parseJsonOrNull(text: string): unknown {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return null
+  }
+}
+
+function writePatchText(configPath: string, text: string): void {
+  mkdirSync(dirname(configPath), { recursive: true })
+  // Why writeHooksJson: it owns the temp+rename and the rolling .bak this file needs too.
+  // Why preserveMode: an owner-only patch file must not widen to the umask default on rewrite.
+  writeHooksJson(configPath, {}, { serialized: text, preserveMode: true })
+}
+
+/** Why one constant: status has to say exactly what install said, on every later read. */
+const FLOW_STYLE_DETAIL =
+  'The DSH home patch is a flow-style sequence ([…]); rewrite it as a block sequence (one `- ` entry per line) so Orca can add its hooks without breaking it'
+
+function status(
+  configPath: string,
+  state: AgentHookInstallState,
+  detail: string | null,
+  managedHooksPresent = false
+): AgentHookInstallStatus {
+  return { agent: 'dsh', state, configPath, managedHooksPresent, detail }
+}
+
+function buildStatus(
+  patchText: string,
+  managedHooksPath: string,
+  managedText: string | null,
+  configPath: string
+): AgentHookInstallStatus {
+  if (managedText === null) {
+    return status(configPath, 'error', 'Could not read Orca managed hooks file')
+  }
+  // Why before the pointer check: a refused file carries no managed region, so the pointer
+  // path would report a bare `not_installed` and drop the one detail that says why.
+  if (isDshPatchFileUnappendable(patchText)) {
+    return status(configPath, 'error', FLOW_STYLE_DETAIL)
+  }
+  const pointer = readManagedDshHooksConfigPath(patchText)
+  if (pointer !== managedHooksPath) {
+    return status(
+      configPath,
+      'not_installed',
+      pointer === undefined
+        ? null
+        : `The Orca patch block points at ${pointer}, not the Orca managed hooks file`
+    )
+  }
+  const present = readManagedDshHookEvents(
+    parseJsonOrNull(managedText),
+    getDshManagedCommandMatcher()
+  )
+  const missing = DSH_HOOK_EVENTS.filter((event) => !present.has(event))
+  if (missing.length === 0) {
+    return status(configPath, 'installed', null, true)
+  }
+  // Why the split: nothing present is an uninstalled agent; some present is a broken install,
+  // and naming the gap is the only way a user can tell those apart.
+  return present.size === 0
+    ? status(configPath, 'not_installed', null)
+    : status(configPath, 'partial', `Managed hook missing for events: ${missing.join(', ')}`, true)
+}
+
+/** Installs Orca's status hooks into DSH. See `docs/reference/dsh-harness-integration.md`
+ *  for the profile/patch-layer model and the env-scrub finding the aliases work around. */
+export class DshHookService {
+  async refreshManagedScripts(): Promise<void> {
+    await refreshManagedScriptIfPresent(getDshManagedScriptPath(), getManagedScript())
+  }
+
+  getStatus(): AgentHookInstallStatus {
+    const configPath = getDshConfigPath()
+    const patchText = readTextOrAbsent(configPath)
+    if (patchText === null) {
+      return status(configPath, 'error', 'Could not read the DSH home patch file')
+    }
+    const managedHooksPath = getDshManagedHooksPath()
+    return buildStatus(patchText, managedHooksPath, readTextOrAbsent(managedHooksPath), configPath)
+  }
+
+  install(): AgentHookInstallStatus {
+    const configPath = getDshConfigPath()
+    const patchText = readTextOrAbsent(configPath)
+    if (patchText === null) {
+      return status(configPath, 'error', 'Could not read the DSH home patch file')
+    }
+    const scriptPath = getDshManagedScriptPath()
+    const managedHooksPath = getDshManagedHooksPath()
+    // Write the script and the managed hooks file first so the patch layer never points at
+    // files that do not exist yet — a bridge that cannot read its config runs no hooks.
+    writeManagedScript(scriptPath, getManagedScript())
+    writeHooksJson(
+      managedHooksPath,
+      { hooks: {} },
+      { serialized: buildDshManagedHooksFile(getDshManagedCommand(scriptPath)) }
+    )
+    const nextText = applyManagedDshPatch(patchText, managedHooksPath)
+    if (nextText === null) {
+      // Why refuse rather than edit: YAML forbids a block entry after a flow sequence, so
+      // appending here would leave DSH unable to parse the user's own patch layer either.
+      return status(configPath, 'error', FLOW_STYLE_DETAIL)
+    }
+    if (nextText !== patchText) {
+      writePatchText(configPath, nextText)
+    }
+    return this.getStatus()
+  }
+
+  /** Install on an SSH execution host, where DSH's shell contract is always POSIX. */
+  async installRemote(sftp: SFTPWrapper, remoteHome: string): Promise<AgentHookInstallStatus> {
+    const remoteConfigPath = getDshRemoteConfigPath(remoteHome)
+    const remoteScriptPath = `${remoteHome.replace(/\/$/, '')}/.orca/agent-hooks/dsh-hook.sh`
+    const remoteManagedHooksPath = getDshRemoteManagedHooksPath(remoteHome)
+    try {
+      const body = (await readTextFileRemote(sftp, remoteConfigPath)) ?? ''
+      await writeManagedScriptRemote(sftp, remoteScriptPath, getManagedScript('posix'))
+      await writeTextFileRemoteAtomic(
+        sftp,
+        remoteManagedHooksPath,
+        buildDshManagedHooksFile(getDshRemoteManagedCommand(remoteScriptPath))
+      )
+      const nextText = applyManagedDshPatch(body, remoteManagedHooksPath)
+      if (nextText === null) {
+        return status(remoteConfigPath, 'error', FLOW_STYLE_DETAIL)
+      }
+      await writeTextFileRemoteAtomic(sftp, remoteConfigPath, nextText)
+      return status(remoteConfigPath, 'installed', null, true)
+    } catch (err) {
+      return status(remoteConfigPath, 'error', err instanceof Error ? err.message : String(err))
+    }
+  }
+
+  remove(): AgentHookInstallStatus {
+    const configPath = getDshConfigPath()
+    const patchText = readTextOrAbsent(configPath)
+    if (patchText === null) {
+      return status(configPath, 'error', 'Could not read the DSH home patch file')
+    }
+    const { text: nextText, changed } = removeManagedDshPatch(patchText)
+    if (changed) {
+      writePatchText(configPath, nextText)
+    }
+    // Why force: the file is Orca's own and may already be gone; its absence is the goal.
+    rmSync(getDshManagedHooksPath(), { force: true })
+    return this.getStatus()
+  }
+}
+
+export const dshHookService = new DshHookService()
diff --git a/src/main/dsh/hook-settings.ts b/src/main/dsh/hook-settings.ts
new file mode 100644
index 00000000000..8ccbb8a9283
--- /dev/null
+++ b/src/main/dsh/hook-settings.ts
@@ -0,0 +1,110 @@
+import { homedir } from 'node:os'
+import { join, posix as pathPosix } from 'node:path'
+import {
+  buildManagedCommandHook,
+  createManagedCommandMatcher,
+  getSharedManagedScriptPath,
+  wrapPosixHookCommand,
+  wrapWindowsHookCommand,
+  type HookDefinition
+} from '../agent-hooks/installer-utils'
+import { readManagedHookEventsFromJson } from '../agent-hooks/managed-hooks-json-events'
+
+const DSH_SCRIPT_BASE = 'dsh-hook'
+
+/**
+ * The events DeepSeek Harness's own Claude-Code hook bridge
+ * (`@deepseek-ai/dsh-hooks-claude-code`) can fire. This is a strict subset of Claude's:
+ * the bridge documents no `Notification`, no `PermissionRequest` and no `SessionEnd`,
+ * and registering an unsupported event name makes it register nothing for that event.
+ * `normalizeDshEvent` is written against exactly this list.
+ */
+export const DSH_HOOK_EVENTS = [
+  'SessionStart',
+  'UserPromptSubmit',
+  'PreToolUse',
+  'PostToolUse',
+  'Stop'
+] as const
+
+export const DSH_MANAGED_HOOKS_FILE_NAME = 'dsh-hooks.json'
+
+/** `$DSH_HOME`, matching the launcher's own `DSH_HOME ?? ~/.dsh` resolution. */
+export function getDshHome(): string {
+  return process.env.DSH_HOME?.trim() || join(homedir(), '.dsh')
+}
+
+/**
+ * The home-level patch layer.
+ *
+ * Why here and not in a profile: DSH composes every profile as bundle patches, then the
+ * profile's own `cordis.patch.yml`, then this file. Installing one layer above every
+ * profile means a pane the user started themselves — any profile, including one Orca
+ * never launched — still reports status, and Orca never edits a profile the user owns.
+ */
+export function getDshConfigPath(): string {
+  return join(getDshHome(), 'cordis.patch.yml')
+}
+
+export function getDshRemoteConfigPath(remoteHome: string): string {
+  // Why: a remote $DSH_HOME is unknown over SFTP; default matches the launcher's own resolution.
+  return pathPosix.join(remoteHome.replace(/\/$/, ''), '.dsh', 'cordis.patch.yml')
+}
+
+export function getDshManagedScriptFileName(): string {
+  return process.platform === 'win32' ? `${DSH_SCRIPT_BASE}.cmd` : `${DSH_SCRIPT_BASE}.sh`
+}
+
+export function getDshManagedScriptPath(): string {
+  return getSharedManagedScriptPath(getDshManagedScriptFileName())
+}
+
+export function getDshManagedHooksPath(): string {
+  return getSharedManagedScriptPath(DSH_MANAGED_HOOKS_FILE_NAME)
+}
+
+export function getDshRemoteManagedHooksPath(remoteHome: string): string {
+  return pathPosix.join(
+    remoteHome.replace(/\/$/, ''),
+    '.orca',
+    'agent-hooks',
+    DSH_MANAGED_HOOKS_FILE_NAME
+  )
+}
+
+export function getDshManagedCommand(scriptPath: string): string {
+  // Why: DSH runs hooks through `ctx.shell`, which the base profile binds to bash
+  // everywhere except Windows, where it binds to PowerShell — the same split these two
+  // wrappers already encode.
+  return process.platform === 'win32'
+    ? wrapWindowsHookCommand(scriptPath)
+    : wrapPosixHookCommand(scriptPath)
+}
+
+export function getDshRemoteManagedCommand(scriptPath: string): string {
+  return wrapPosixHookCommand(scriptPath)
+}
+
+export function getDshManagedCommandMatcher(): (command: string | undefined) => boolean {
+  return createManagedCommandMatcher(getDshManagedScriptFileName())
+}
+
+/**
+ * The managed hooks file is Orca's outright: DSH has no user-owned `hooks.json`
+ * convention of its own, and the bridge reads whatever single path it is pointed at. So
+ * generate it wholesale rather than merging into someone's file.
+ */
+export function buildDshManagedHooksFile(command: string): string {
+  const hooks: Record<string, HookDefinition[]> = {}
+  for (const event of DSH_HOOK_EVENTS) {
+    hooks[event] = [{ hooks: [buildManagedCommandHook(command)] }]
+  }
+  return `${JSON.stringify({ hooks }, null, 2)}\n`
+}
+
+export function readManagedDshHookEvents(
+  parsed: unknown,
+  isManagedCommand: (command: string | undefined) => boolean
+): Set<string> {
+  return readManagedHookEventsFromJson(parsed, DSH_HOOK_EVENTS, isManagedCommand)
+}
diff --git a/src/main/durable-file-write-syscall-proof.test.ts b/src/main/durable-file-write-syscall-proof.test.ts
index bf18d6c0092..34563b0196a 100644
--- a/src/main/durable-file-write-syscall-proof.test.ts
+++ b/src/main/durable-file-write-syscall-proof.test.ts
@@ -1,6 +1,15 @@
 // Empirical proof that the durable write fsyncs the file, and the directory where the platform
 // allows it. Counted at the module boundary rather than inferred from reading the implementation.
-import { closeSync, fsyncSync, mkdtempSync, openSync, readFileSync, rmSync } from 'node:fs'
+import {
+  closeSync,
+  existsSync,
+  fsyncSync,
+  mkdtempSync,
+  openSync,
+  readFileSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
 import type * as NodeFs from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -9,23 +18,57 @@ import { expect, it, vi } from 'vitest'
 /** Why the rename is recorded too: an fsync moved after the rename still fsyncs a file, so a
  *  fsync-only log reads identically for the correct and the broken order. The rename is the boundary
  *  the ordering is defined against, so it has to appear in the same sequence. */
-const syscalls: ('fsync:file' | 'fsync:directory' | 'rename')[] = []
+const syscalls: ('fsync:file' | 'fsync:directory' | 'rename' | 'link')[] = []
 
 vi.mock('node:fs', async () => {
   const actual = await vi.importActual<typeof NodeFs>('node:fs')
   return {
     ...actual,
     fsyncSync: (fd: number) => {
+      actual.fsyncSync(fd)
       syscalls.push(actual.fstatSync(fd).isDirectory() ? 'fsync:directory' : 'fsync:file')
-      return actual.fsyncSync(fd)
     },
     renameSync: (from: NodeFs.PathLike, to: NodeFs.PathLike) => {
+      actual.renameSync(from, to)
       syscalls.push('rename')
-      return actual.renameSync(from, to)
+    },
+    linkSync: (from: NodeFs.PathLike, to: NodeFs.PathLike) => {
+      actual.linkSync(from, to)
+      syscalls.push('link')
     }
   }
 })
 
+it('publishes a new file durably and cannot replace an existing destination', async () => {
+  const { publishFileDurableSync } = await import('./durable-file-write')
+  const dir = mkdtempSync(join(tmpdir(), 'orca-publish-fsync-'))
+  try {
+    const supported = directoryFsyncSupported(dir)
+    const staged = join(dir, 'staged')
+    const target = join(dir, 'target')
+    writeFileSync(staged, 'first')
+    const fd = openSync(staged, 'r+')
+    try {
+      fsyncSync(fd)
+    } finally {
+      closeSync(fd)
+    }
+    syscalls.length = 0
+    expect(publishFileDurableSync(staged, target)).toBe(true)
+    expect(syscalls).toEqual(supported ? ['link', 'fsync:directory'] : ['link'])
+    expect(existsSync(staged)).toBe(false)
+    expect(readFileSync(target, 'utf8')).toBe('first')
+    writeFileSync(staged, 'second')
+    syscalls.length = 0
+    expect(publishFileDurableSync(staged, target)).toBe(false)
+    expect(readFileSync(target, 'utf8')).toBe('first')
+    expect(readFileSync(staged, 'utf8')).toBe('second')
+    expect(syscalls).toEqual([])
+  } finally {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
 /** Windows cannot open a directory for fsync, and some filesystems reject it; probe rather than
  *  assume, so the expectation tracks the real platform instead of a hardcoded OS list. */
 function directoryFsyncSupported(directory: string): boolean {
diff --git a/src/main/durable-file-write.ts b/src/main/durable-file-write.ts
index 83b0eabc5ed..05e849327b7 100644
--- a/src/main/durable-file-write.ts
+++ b/src/main/durable-file-write.ts
@@ -4,9 +4,13 @@
 // hour's loss; fsync stops it from happening.
 
 import { closeSync, fsyncSync, openSync, rmSync, writeFileSync } from 'node:fs'
-import { copyFile, open, readdir, rename, rm, stat } from 'node:fs/promises'
+import { copyFile, open, readdir, rm, stat } from 'node:fs/promises'
 import { basename, dirname, join } from 'node:path'
-import { renameFileWithWindowsRetry } from './codex-accounts/fs-utils'
+import {
+  publishFileWithoutOverwrite,
+  renameFileWithWindowsRetry,
+  renameFileWithWindowsRetryAsync
+} from './codex-accounts/fs-utils'
 
 /**
  * fsync a directory so a rename within it is durable. Best-effort by design: Windows cannot open a
@@ -43,12 +47,28 @@ function syncDirectorySync(directory: string): void {
   }
 }
 
+/** Rename an already-fsynced file and make the containing directory durable. */
+export function renameDurableSync(tmpPath: string, finalPath: string): void {
+  renameFileWithWindowsRetry(tmpPath, finalPath)
+  syncDirectorySync(dirname(finalPath))
+}
+
+/** Publish an already-fsynced file without replacing a concurrently created destination. */
+export function publishFileDurableSync(tmpPath: string, finalPath: string): boolean {
+  if (!publishFileWithoutOverwrite(tmpPath, finalPath)) {
+    return false
+  }
+  syncDirectorySync(dirname(finalPath))
+  rmSync(tmpPath)
+  return true
+}
+
 /**
  * Rename and then fsync the containing directory. For callers that already fsynced the temp file
  * themselves and need the rename made durable.
  */
 export async function renameDurable(tmpPath: string, finalPath: string): Promise<void> {
-  await rename(tmpPath, finalPath)
+  await renameFileWithWindowsRetryAsync(tmpPath, finalPath)
   await syncDirectory(dirname(finalPath))
 }
 
@@ -96,7 +116,7 @@ export async function copyFileDurable(sourcePath: string, finalPath: string): Pr
     } finally {
       await handle.close()
     }
-    await rename(tmpPath, finalPath)
+    await renameFileWithWindowsRetryAsync(tmpPath, finalPath)
     renamed = true
     await syncDirectory(dirname(finalPath))
     return true
@@ -132,10 +152,9 @@ export async function writeFileDurableIfCurrent(
   try {
     // Why: fsync BEFORE rename. A rename that lands first can expose a zero-length file.
     await writeTempFileDurable(tmpPath, payload)
-    if (!isCurrent()) {
+    if (!(await renameFileWithWindowsRetryAsync(tmpPath, finalPath, isCurrent))) {
       return false
     }
-    await rename(tmpPath, finalPath)
     renamed = true
     await syncDirectory(dirname(finalPath))
     return true
@@ -202,9 +221,8 @@ export function writeFileDurableSync(
     } finally {
       closeSync(fd)
     }
-    renameFileWithWindowsRetry(tmpPath, finalPath)
+    renameDurableSync(tmpPath, finalPath)
     renamed = true
-    syncDirectorySync(dirname(finalPath))
   } finally {
     if (!renamed) {
       rmSync(tmpPath, { force: true })
diff --git a/src/main/execution-host-workspace-trust.test.ts b/src/main/execution-host-workspace-trust.test.ts
new file mode 100644
index 00000000000..6fdb942b57b
--- /dev/null
+++ b/src/main/execution-host-workspace-trust.test.ts
@@ -0,0 +1,210 @@
+import {
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, sep } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as Os from 'node:os'
+import type { AgentTrustPreset } from './agent-trust-presets'
+import { linkGitWorktree, workspaceTrustWritten } from './workspace-trust-test-fixtures'
+
+const state = vi.hoisted(() => ({ home: '' }))
+
+vi.mock('node:os', async (importOriginal) => {
+  const actual = await importOriginal<typeof Os>()
+  return { ...actual, homedir: () => state.home }
+})
+
+import {
+  AGENT_TRUST_INHERITS_FROM_A_HOME,
+  applyWorkspaceTrustOnThisHost,
+  type WorkspaceTrustHost
+} from './execution-host-workspace-trust'
+
+const PRESETS: readonly AgentTrustPreset[] = [
+  'claude',
+  'codex',
+  'cursor',
+  'copilot',
+  'qoder',
+  'antigravity'
+]
+// Why these three: each accepts trust from any ancestor folder, so trust on a home covers it all.
+const INHERITING_PRESETS: readonly AgentTrustPreset[] = ['claude', 'copilot', 'qoder']
+const EXACT_OR_SELF_LIMITING_PRESETS: readonly AgentTrustPreset[] = [
+  'codex',
+  'cursor',
+  'antigravity'
+]
+
+let root: string
+
+beforeEach(() => {
+  root = realpathSync(mkdtempSync(join(tmpdir(), 'orca-host-trust-')))
+  state.home = join(root, 'home', 'me')
+  mkdirSync(state.home, { recursive: true })
+  writeFileSync(join(state.home, '.claude.json'), '{}')
+})
+
+afterEach(() => {
+  rmSync(root, { recursive: true, force: true })
+})
+
+function thisHost(overrides: Partial<WorkspaceTrustHost> = {}): () => WorkspaceTrustHost {
+  return () => ({
+    homes: [state.home],
+    claudeConfig: () => ({ configFile: join(state.home, '.claude.json'), keyStyle: 'posix' }),
+    codexConfigFiles: () => [join(state.home, '.codex', 'config.toml')],
+    deadlineMs: 1_500,
+    ...overrides
+  })
+}
+
+function trustWritten(preset: AgentTrustPreset): boolean {
+  return workspaceTrustWritten(state.home, preset)
+}
+
+describe('applyWorkspaceTrustOnThisHost', () => {
+  it.each(PRESETS)('writes %s trust for an ordinary project folder', async (preset) => {
+    const workspace = join(root, 'projects', 'app')
+    mkdirSync(workspace, { recursive: true })
+    await applyWorkspaceTrustOnThisHost(preset, workspace, thisHost())
+    expect(trustWritten(preset)).toBe(true)
+  })
+
+  const tooBroad: [string, () => { workspace: string; homes?: string[] }][] = [
+    ['the home', () => ({ workspace: state.home })],
+    ['a folder containing the home', () => ({ workspace: join(root, 'home') })],
+    ['a filesystem root', () => ({ workspace: '/' })],
+    [
+      'a symlink to the home',
+      () => {
+        symlinkSync(state.home, join(root, 'home-link'), 'junction')
+        return { workspace: join(root, 'home-link') }
+      }
+    ],
+    [
+      // Why a missing segment: realpath fails there, and join() would collapse the `..` itself.
+      'a missing path that resolves to the home through ..',
+      () => ({ workspace: [state.home, 'missing', '..'].join(sep) })
+    ],
+    [
+      'the home, when the host names it through a symlink',
+      () => {
+        symlinkSync(state.home, join(root, 'home-link'), 'junction')
+        return { workspace: state.home, homes: [join(root, 'home-link')] }
+      }
+    ]
+  ]
+  describe.each(tooBroad)('for %s', (_label, arrange) => {
+    it.each(INHERITING_PRESETS)('writes no %s trust', async (preset) => {
+      const { workspace, homes } = arrange()
+      await applyWorkspaceTrustOnThisHost(
+        preset,
+        workspace,
+        thisHost(homes ? { homes } : undefined)
+      )
+      expect(trustWritten(preset)).toBe(false)
+    })
+  })
+
+  it('guards exactly the agents that inherit trust from a home', () => {
+    expect(PRESETS.filter((preset) => AGENT_TRUST_INHERITS_FROM_A_HOME[preset])).toEqual(
+      INHERITING_PRESETS
+    )
+  })
+
+  it.each(EXACT_OR_SELF_LIMITING_PRESETS)(
+    'trusts a home folder workspace for %s, whose trust there covers only the home',
+    async (preset) => {
+      await applyWorkspaceTrustOnThisHost(preset, state.home, thisHost())
+      expect(trustWritten(preset)).toBe(true)
+    }
+  )
+
+  it('trusts a home folder workspace for Codex under the key Codex looks up', async () => {
+    await applyWorkspaceTrustOnThisHost('codex', state.home, thisHost())
+    expect(readFileSync(join(state.home, '.codex', 'config.toml'), 'utf-8')).toContain(
+      `[projects."${state.home}"]`
+    )
+  })
+
+  it('trusts a Codex worktree whose main checkout is the home, as Codex would on "Yes"', async () => {
+    const worktree = join(root, 'worktrees', 'feature')
+    linkGitWorktree(state.home, worktree)
+    await applyWorkspaceTrustOnThisHost('codex', worktree, thisHost())
+    expect(readFileSync(join(state.home, '.codex', 'config.toml'), 'utf-8')).toContain(
+      `[projects."${state.home}"]`
+    )
+  })
+
+  it.each(PRESETS.filter((preset) => preset !== 'codex'))(
+    'trusts a worktree whose main checkout is the home for %s, which stores the worktree path',
+    async (preset) => {
+      const worktree = join(root, 'worktrees', 'feature')
+      linkGitWorktree(state.home, worktree)
+      await applyWorkspaceTrustOnThisHost(preset, worktree, thisHost())
+      expect(trustWritten(preset)).toBe(true)
+    }
+  )
+
+  it('trusts the exact subfolder Codex starts in, inside a folder that is not a repo', async () => {
+    const subfolder = join(root, 'notes', 'sub')
+    mkdirSync(subfolder, { recursive: true })
+    await applyWorkspaceTrustOnThisHost('codex', subfolder, thisHost())
+    expect(readFileSync(join(state.home, '.codex', 'config.toml'), 'utf-8')).toContain(
+      `[projects."${subfolder}"]`
+    )
+  })
+
+  it("trusts a worktree's main checkout for Codex when that checkout is not a home", async () => {
+    const mainCheckout = join(root, 'repo')
+    const worktree = join(root, 'worktrees', 'feature')
+    linkGitWorktree(mainCheckout, worktree)
+    await applyWorkspaceTrustOnThisHost('codex', worktree, thisHost())
+    const written = readFileSync(join(state.home, '.codex', 'config.toml'), 'utf-8')
+    expect(written).toContain(`[projects."${mainCheckout}"]`)
+    expect(written).not.toContain(`[projects."${worktree}"]`)
+  })
+
+  it.each(INHERITING_PRESETS)('writes no %s trust when the host knows no home', async (preset) => {
+    const workspace = join(root, 'projects', 'app')
+    mkdirSync(workspace, { recursive: true })
+    await applyWorkspaceTrustOnThisHost(
+      preset,
+      workspace,
+      thisHost({ homes: [null, '', undefined] })
+    )
+    expect(trustWritten(preset)).toBe(false)
+  })
+
+  it('contains a host description or writer that throws, so the launch proceeds', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const workspace = join(root, 'projects', 'app')
+    mkdirSync(workspace, { recursive: true })
+    await expect(
+      applyWorkspaceTrustOnThisHost('claude', workspace, () => {
+        throw new Error('homedir unavailable')
+      })
+    ).resolves.toBeUndefined()
+    await expect(
+      applyWorkspaceTrustOnThisHost(
+        'codex',
+        workspace,
+        thisHost({
+          codexConfigFiles: () => {
+            throw new Error('userData unavailable')
+          }
+        })
+      )
+    ).resolves.toBeUndefined()
+    expect(warn).toHaveBeenCalledTimes(2)
+    warn.mockRestore()
+  })
+})
diff --git a/src/main/execution-host-workspace-trust.ts b/src/main/execution-host-workspace-trust.ts
new file mode 100644
index 00000000000..5664e63d634
--- /dev/null
+++ b/src/main/execution-host-workspace-trust.ts
@@ -0,0 +1,142 @@
+import { realpathSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { markQoderWorkspaceTrusted } from './qoder/workspace-trust'
+import {
+  type AgentTrustPreset,
+  markAntigravityWorkspaceTrusted,
+  markCodexProjectTrusted,
+  markCopilotFolderTrusted,
+  markCursorWorkspaceTrusted,
+  resolveCodexProjectTrustRoot
+} from './agent-trust-presets'
+import { awaitAgentTrustWriteWithinDeadline } from './agent-trust-write-deadline'
+import {
+  type ClaudeTrustConfigTarget,
+  grantClaudeWorkspaceTrust
+} from './claude/claude-folder-trust-file'
+import { isTooBroadToPreTrust } from '../shared/home-or-filesystem-root'
+
+/**
+ * What the host that runs the agent knows about where that agent reads trust. Relay-safe:
+ * main describes this machine or a WSL guest, the SSH relay describes its own host.
+ */
+export type WorkspaceTrustHost = {
+  /** Homes the agent may read trust under; with none known, an agent that inherits trust writes nothing. */
+  homes: readonly (string | null | undefined)[]
+  /** The config Claude reads on this host, or null when this host cannot tell. */
+  claudeConfig: () => ClaudeTrustConfigTarget | null
+  /** Every config.toml the launched Codex may read, in the hook installer's lock order. */
+  codexConfigFiles: () => readonly string[]
+  deadlineMs: number
+}
+
+/**
+ * Whether trust on a home or a disk root would also trust the folders below it, per each agent's
+ * own lookup; such trust is never pre-written. Claude walks up parent folders (to the repo root,
+ * else the disk root); Copilot and Qoder accept any trusted ancestor. Codex matches its start
+ * folder or that folder's repo root, Antigravity the exact folder, and Cursor never inherits from
+ * a home, a folder above one or a shallow path.
+ */
+export const AGENT_TRUST_INHERITS_FROM_A_HOME: Record<AgentTrustPreset, boolean> = {
+  claude: true,
+  codex: false,
+  cursor: false,
+  copilot: true,
+  qoder: true,
+  antigravity: false
+}
+
+/**
+ * Agents whose lookup keys on the folder they start in, so Orca trusts that folder, not the
+ * workspace root, even outside any workspace. Codex checks its start folder, then that folder's
+ * repo root; a non-git workspace root above the start folder is neither.
+ */
+export const AGENT_TRUST_KEYED_BY_START_FOLDER: Record<AgentTrustPreset, boolean> = {
+  claude: false,
+  codex: true,
+  cursor: false,
+  copilot: false,
+  qoder: false,
+  antigravity: false
+}
+
+// Why resolve() too: Claude stores it, and it collapses `..` even where realpath fails.
+function withResolvedForm(path: string): string[] {
+  try {
+    return [path, resolve(path), realpathSync.native(path)]
+  } catch {
+    return [path, resolve(path)]
+  }
+}
+
+/** The path the preset's writer stores: Codex trusts a linked worktree's main checkout. */
+function storedTrustPath(preset: AgentTrustPreset, workspacePath: string): string {
+  return preset === 'codex' ? resolveCodexProjectTrustRoot(workspacePath) : workspacePath
+}
+
+/**
+ * Whether trust stored for `storedPath` would cover a home: it is a root, a home or a folder
+ * above one. Both sides are compared given and resolved, since the writers store the realpath.
+ */
+function wouldTrustAHome(storedPath: string, homes: readonly string[]): boolean {
+  const homeForms = homes.flatMap(withResolvedForm)
+  return withResolvedForm(storedPath).some((form) => isTooBroadToPreTrust(form, homeForms))
+}
+
+async function writePreset(
+  preset: AgentTrustPreset,
+  storedPath: string,
+  host: WorkspaceTrustHost
+): Promise<void> {
+  switch (preset) {
+    case 'claude': {
+      const target = host.claudeConfig()
+      if (target) {
+        await grantClaudeWorkspaceTrust(target, storedPath)
+      }
+      return
+    }
+    case 'codex':
+      return markCodexProjectTrusted(storedPath, host.codexConfigFiles())
+    case 'cursor':
+      return markCursorWorkspaceTrusted(storedPath)
+    case 'copilot':
+      return markCopilotFolderTrusted(storedPath)
+    case 'qoder':
+      return markQoderWorkspaceTrusted(storedPath)
+    case 'antigravity':
+      return markAntigravityWorkspaceTrusted(storedPath)
+  }
+}
+
+/**
+ * The one place a preset's trust is written, on the host that runs the agent. For an agent that
+ * inherits trust from a home, refuses when the path the writer would store covers a home. Never
+ * throws or waits past the host's deadline: any failure or miss means the agent asks.
+ */
+export async function applyWorkspaceTrustOnThisHost(
+  preset: AgentTrustPreset,
+  workspacePath: string,
+  describeHost: () => WorkspaceTrustHost
+): Promise<void> {
+  try {
+    const host = describeHost()
+    const storedPath = storedTrustPath(preset, workspacePath)
+    if (AGENT_TRUST_INHERITS_FROM_A_HOME[preset]) {
+      const homes = host.homes.filter((home): home is string => Boolean(home))
+      if (homes.length === 0 || wouldTrustAHome(storedPath, homes)) {
+        return
+      }
+    }
+    await awaitAgentTrustWriteWithinDeadline(writePreset(preset, storedPath, host), {
+      preset,
+      workspacePath,
+      deadlineMs: host.deadlineMs
+    })
+  } catch (error) {
+    console.warn(
+      `[agent-trust] ${preset} trust for ${workspacePath} failed; the agent will ask`,
+      error
+    )
+  }
+}
diff --git a/src/main/git-bash.test.ts b/src/main/git-bash.test.ts
index 367c07cbe54..bd4633b019f 100644
--- a/src/main/git-bash.test.ts
+++ b/src/main/git-bash.test.ts
@@ -169,4 +169,66 @@ describe('Git Bash path discovery', () => {
     )
     expect(isGitForWindowsBashLauncherPath('bash.exe')).toBe(false)
   })
+
+  it('identifies a launcher in an install folder named anything else', () => {
+    // Layout confirmed against a real Git 2.x install: bin, cmd, mingw64, usr, git-bash.exe.
+    const renamedInstall = (path: string): boolean =>
+      [
+        'C:\\Tools\\Git-2.55\\bin\\bash.exe',
+        'C:\\Tools\\Git-2.55\\usr\\bin\\bash.exe',
+        'C:\\Tools\\Git-2.55\\cmd\\git.exe',
+        'C:\\Tools\\Git-2.55\\git-bash.exe'
+      ].includes(path)
+    expect(
+      isGitForWindowsBashLauncherPath('C:\\Tools\\Git-2.55\\bin\\bash.exe', {
+        exists: renamedInstall
+      })
+    ).toBe(true)
+    expect(
+      isGitForWindowsBashLauncherPath('C:\\Users\\a\\scoop\\apps\\git\\current\\bin\\bash.exe', {
+        exists: (path) => path.startsWith('C:\\Users\\a\\scoop\\apps\\git\\current\\')
+      })
+    ).toBe(true)
+  })
+
+  // Each marker is individually necessary, so dropping one from the predicate cannot stay green.
+  it.each([
+    ['usr\\bin\\bash.exe', 'C:\\Tools\\Git-2.55\\usr\\bin\\bash.exe'],
+    ['cmd\\git.exe', 'C:\\Tools\\Git-2.55\\cmd\\git.exe'],
+    ['git-bash.exe', 'C:\\Tools\\Git-2.55\\git-bash.exe']
+  ])('refuses a renamed install root missing only %s', (_label, missingMarker) => {
+    expect(
+      isGitForWindowsBashLauncherPath('C:\\Tools\\Git-2.55\\bin\\bash.exe', {
+        exists: (path) => path !== missingMarker
+      })
+    ).toBe(false)
+  })
+
+  it('refuses a bash that is not a Git for Windows launcher, even where every path exists', () => {
+    const everythingExists = (): boolean => true
+    // A directly launched MSYS bash: no install root sits inside `usr`, so the markers cannot be met.
+    expect(
+      isGitForWindowsBashLauncherPath('C:\\Program Files\\Git\\usr\\bin\\bash.exe', {
+        exists: (path) => !path.includes('\\usr\\usr\\') && !path.includes('\\usr\\cmd\\')
+      })
+    ).toBe(false)
+    // Observed on a real Cygwin root: none of the three markers is present, nor bin\bash.exe itself.
+    const observedCygwinRoot = ['C:\\cygwin64\\etc', 'C:\\cygwin64\\var']
+    expect(
+      isGitForWindowsBashLauncherPath('C:\\cygwin64\\bin\\bash.exe', {
+        exists: (path) => observedCygwinRoot.includes(path)
+      })
+    ).toBe(false)
+    // A Cygwin root carrying a bash at both marker positions is still refused: `git-bash.exe` is Git
+    // for Windows' own launcher, and no Cygwin package installs one.
+    expect(
+      isGitForWindowsBashLauncherPath('C:\\cygwin64\\bin\\bash.exe', {
+        exists: (path) => path.endsWith('bin\\bash.exe') || path.endsWith('cmd\\git.exe')
+      })
+    ).toBe(false)
+    expect(
+      isGitForWindowsBashLauncherPath('C:\\Tools\\sh\\bash.exe', { exists: everythingExists })
+    ).toBe(false)
+    expect(isGitForWindowsBashLauncherPath('bash.exe', { exists: everythingExists })).toBe(false)
+  })
 })
diff --git a/src/main/git-bash.ts b/src/main/git-bash.ts
index 40866325ae7..a57edcaee4d 100644
--- a/src/main/git-bash.ts
+++ b/src/main/git-bash.ts
@@ -114,10 +114,46 @@ export function isGitForWindowsBashPath(shellPath: string): boolean {
   return /(?:^|\\)(?:git|portablegit)(?:\\usr)?\\bin\\bash\.exe$/.test(normalized)
 }
 
-/** Git for Windows' `bin\bash.exe` is a launcher: it runs `..\usr\bin\bash.exe` as a child and waits. */
-export function isGitForWindowsBashLauncherPath(shellPath: string): boolean {
-  return /(?:^|\\)(?:git|portablegit)\\bin\\bash\.exe$/.test(
-    pathWin32.normalize(shellPath).toLowerCase()
+/**
+ * Files only a Git for Windows install root carries. `usr\bin\bash.exe` is the launcher's own
+ * hand-off target, and the other two separate that root from a Cygwin or MSYS2 one: neither ships a
+ * `cmd\` directory, and `git-bash.exe` is Git for Windows' own launcher rather than an upstream git
+ * binary, so no Cygwin package can put it here. All three confirmed present on a real Git 2.x
+ * install and absent from a real Cygwin root.
+ */
+const GIT_FOR_WINDOWS_ROOT_MARKERS = [
+  ['usr', 'bin', 'bash.exe'],
+  ['cmd', 'git.exe'],
+  ['git-bash.exe']
+] as const
+
+/**
+ * Git for Windows' `bin\bash.exe` is a launcher: it runs `..\usr\bin\bash.exe` as a child and waits.
+ *
+ * The installer's folder is named `Git`, but a user-chosen install directory, an unzipped
+ * PortableGit, and Scoop's `apps\git\current` are equally real, so a folder this does not recognize
+ * falls back to the install layout instead of denying the hand-off.
+ */
+export function isGitForWindowsBashLauncherPath(
+  shellPath: string,
+  options: Pick<GitBashPathOptions, 'exists'> = {}
+): boolean {
+  const normalized = pathWin32.normalize(shellPath)
+  if (/(?:^|\\)(?:git|portablegit)\\bin\\bash\.exe$/.test(normalized.toLowerCase())) {
+    return true
+  }
+  const binDirectory = pathWin32.dirname(normalized)
+  if (
+    pathWin32.basename(normalized).toLowerCase() !== 'bash.exe' ||
+    pathWin32.basename(binDirectory).toLowerCase() !== 'bin'
+  ) {
+    return false
+  }
+  // `usr\bin\bash.exe` lands here too, and is refused because no install root sits inside `usr`.
+  const installRoot = pathWin32.dirname(binDirectory)
+  const exists = options.exists ?? existsSync
+  return GIT_FOR_WINDOWS_ROOT_MARKERS.every((marker) =>
+    exists(pathWin32.join(installRoot, ...marker))
   )
 }
 
diff --git a/src/main/git/repo-api-parity.test.ts b/src/main/git/repo-api-parity.test.ts
deleted file mode 100644
index 9143b7bf65f..00000000000
--- a/src/main/git/repo-api-parity.test.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import * as repo from './repo'
-
-describe('repo public API parity', () => {
-  it('keeps the historical runtime export surface', () => {
-    expect(Object.keys(repo).sort()).toEqual(
-      [
-        'DEFAULT_BASE_REF_PROBES',
-        'buildSearchBaseRefsArgv',
-        'getBaseRefDefault',
-        'getBranchConflictKind',
-        'getDefaultBaseRef',
-        'getDefaultRemote',
-        'getGitRepoRoot',
-        'getLinkedWorktreeMainRepoRoot',
-        'getRecentDriftSubjects',
-        'getRemoteCommitUrl',
-        'getRemoteCount',
-        'getRemoteDrift',
-        'getRemoteFileUrl',
-        'getRemoteUrl',
-        'getRepoName',
-        'isForEachRefExcludeUnsupportedError',
-        'isGitRepo',
-        'mergeBaseRefSearchResultGroups',
-        'normalizeGitRepoRootForInputPath',
-        'normalizeRefSearchQuery',
-        'parseAndFilterSearchRefDetails',
-        'parseRemoteCount',
-        'resolveDefaultBaseRefViaExec',
-        'resolveDefaultBaseRefWithLocalGit',
-        'searchBaseRefDetails',
-        'searchBaseRefs'
-      ].sort()
-    )
-  })
-})
diff --git a/src/main/git/status-read-coalescing.test.ts b/src/main/git/status-read-coalescing.test.ts
index e0170f8d6a5..e7d755e7cfa 100644
--- a/src/main/git/status-read-coalescing.test.ts
+++ b/src/main/git/status-read-coalescing.test.ts
@@ -1,7 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as BoundedFileReader from '../../shared/node-bounded-file-reader'
-import type * as NodeFs from 'node:fs'
-import path from 'node:path'
 import {
   createBoundedFileReaderModuleMock,
   createFsPromisesModuleMock,
@@ -92,62 +90,6 @@ describe('getStatus', () => {
     expect(addOptions?.preferWslDirectGit).toBeUndefined()
   })
 
-  it('benchmarks concurrent status burst subprocess pressure', async () => {
-    const benchPath = process.env.ORCA_GIT_STATUS_COALESCING_BENCH_JSON
-    if (!benchPath) {
-      return
-    }
-
-    readFileMock.mockResolvedValue('gitdir: /repo/.git/worktrees/feature\n')
-    existsSyncMock.mockReturnValue(false)
-    gitExecFileAsyncMock.mockImplementation((args: string[]) => {
-      if (args.includes('status')) {
-        return Promise.resolve({ stdout: '' })
-      }
-      if (args.includes('--numstat')) {
-        return Promise.resolve({ stdout: '' })
-      }
-      return Promise.resolve({ stdout: '' })
-    })
-
-    const runBurst = async (withSignals: boolean): Promise<number> => {
-      gitExecFileAsyncMock.mockClear()
-      await Promise.all(
-        Array.from({ length: 10 }, () =>
-          getStatus('/repo', withSignals ? { signal: new AbortController().signal } : {})
-        )
-      )
-      return gitExecFileAsyncMock.mock.calls.filter(([args]) =>
-        (args as string[]).includes('status')
-      ).length
-    }
-
-    const startedAt = performance.now()
-    const unsignalledStatusCommandCalls = await runBurst(false)
-    const signalledStatusCommandCalls = await runBurst(true)
-    const durationMs = performance.now() - startedAt
-    const { mkdirSync, writeFileSync } = await vi.importActual<typeof NodeFs>('fs')
-    mkdirSync(path.dirname(benchPath), { recursive: true })
-    writeFileSync(
-      benchPath,
-      JSON.stringify({
-        scenario: 'git-status-concurrent-burst',
-        concurrentCalls: 10,
-        unsignalledStatusCommandCalls,
-        signalledStatusCommandCalls,
-        statusArgs: [
-          '-c',
-          'core.quotePath=false',
-          'status',
-          '--porcelain=v2',
-          '--branch',
-          '--untracked-files=all'
-        ],
-        durationMs
-      })
-    )
-  })
-
   it('coalesces identical in-flight status reads without caching after settle', async () => {
     readFileMock.mockResolvedValue('gitdir: /repo/.git/worktrees/feature\n')
     existsSyncMock.mockReturnValue(false)
diff --git a/src/main/git/upstream.test.ts b/src/main/git/upstream.test.ts
index b7644ad5543..1c4c45e0911 100644
--- a/src/main/git/upstream.test.ts
+++ b/src/main/git/upstream.test.ts
@@ -1,6 +1,4 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type * as NodeFs from 'node:fs'
-import path from 'node:path'
 
 const { gitExecFileAsyncMock } = vi.hoisted(() => ({
   gitExecFileAsyncMock: vi.fn()
@@ -25,54 +23,7 @@ describe('getUpstreamStatus', () => {
     invalidateGitUpstreamStatusReads()
   })
 
-  it('benchmarks concurrent upstream Git command pressure', async () => {
-    const benchPath = process.env.ORCA_GIT_UPSTREAM_COALESCING_BENCH_JSON
-    if (!benchPath) {
-      return
-    }
-    gitExecFileAsyncMock.mockImplementation((args: string[]) => {
-      if (args[0] === 'symbolic-ref') {
-        return Promise.resolve({ stdout: 'main\n' })
-      }
-      if (args[0] === 'rev-parse') {
-        return Promise.resolve({ stdout: 'origin/main\n' })
-      }
-      if (args[0] === 'rev-list') {
-        return Promise.resolve({ stdout: '2\t3\n' })
-      }
-      if (args[0] === 'log') {
-        return Promise.resolve({ stdout: '+ abc123 remote work\n' })
-      }
-      throw new Error(`unexpected git args: ${args.join(' ')}`)
-    })
-
-    await Promise.all(Array.from({ length: 10 }, () => getUpstreamStatus('/repo')))
-
-    const commands = gitExecFileAsyncMock.mock.calls.map(([args, options]) => ({ args, options }))
-    const commandCounts = Object.fromEntries(
-      ['symbolic-ref', 'rev-parse', 'rev-list', 'log'].map((command) => [
-        command,
-        commands.filter(({ args }) => args[0] === command).length
-      ])
-    )
-    const { mkdirSync, writeFileSync } = await vi.importActual<typeof NodeFs>('node:fs')
-    mkdirSync(path.dirname(benchPath), { recursive: true })
-    writeFileSync(
-      benchPath,
-      JSON.stringify({
-        scenario: 'local-git-upstream-concurrent-burst',
-        concurrentCalls: 10,
-        physicalGitCalls: commands.length,
-        commandCounts,
-        commandChain: ['symbolic-ref', 'rev-parse', 'rev-list', 'log'].map((command) =>
-          commands.find(({ args }) => args[0] === command)
-        )
-      })
-    )
-  })
-
-  // Why: the benchmark above only runs under an env var, so this is the CI-enforced
-  // guard that the native/WSL path actually coalesces rather than fanning out.
+  // Why: the CI-enforced guard that the native/WSL path actually coalesces rather than fanning out.
   it('shares one physical read across ten identical native callers', async () => {
     let resolveSymbolicRef = (): void => {}
     const symbolicRefGate = new Promise<void>((resolve) => {
diff --git a/src/main/git/worktree-create-preparation-real-git.test.ts b/src/main/git/worktree-create-preparation-real-git.test.ts
index 19c023a2403..08795fcab1f 100644
--- a/src/main/git/worktree-create-preparation-real-git.test.ts
+++ b/src/main/git/worktree-create-preparation-real-git.test.ts
@@ -55,6 +55,137 @@ afterEach(async () => {
 })
 
 describe('prepared worktree creation with real Git', () => {
+  it.each([false, true])(
+    'attaches the prepared HEAD and runs the hook (base advanced: %s)',
+    async (advanceBase) => {
+      const { repoPath, root } = await createRepo()
+      const preparedPath = join(root, 'prepared checkout')
+      const finalPath = join(root, 'final checkout')
+      const hooksPath = join(root, 'hooks')
+      await mkdir(hooksPath)
+      await writeFile(
+        join(hooksPath, 'post-checkout'),
+        '#!/bin/sh\nprintf \'%s\\n\' "$@" >> checkout-hook.txt\ngit symbolic-ref --short HEAD >> checkout-hook.txt\n',
+        { mode: 0o755 }
+      )
+      git(repoPath, ['config', 'core.hooksPath', hooksPath])
+      git(repoPath, ['config', 'branch.autoSetupMerge', 'always'])
+      await prepareWorktreeCreateCheckout(
+        repoPath,
+        preparedPath,
+        'main',
+        createWorktreePreparationLockReason('attach-with-hook')
+      )
+      expect(existsSync(join(preparedPath, 'checkout-hook.txt'))).toBe(false)
+      if (advanceBase) {
+        await writeFile(join(repoPath, 'version.txt'), 'advanced\n')
+        git(repoPath, ['commit', '--quiet', '-am', 'advance base'])
+      }
+      const targetHead = git(repoPath, ['rev-parse', 'HEAD'])
+      await finalizePreparedWorktree(repoPath, preparedPath, finalPath, 'feature/attached', 'main')
+
+      expect(git(finalPath, ['rev-parse', 'HEAD'])).toBe(targetHead)
+      expect(git(finalPath, ['symbolic-ref', '--short', 'HEAD'])).toBe('feature/attached')
+      expect(
+        git(finalPath, ['for-each-ref', '--format=%(upstream)', 'refs/heads/feature/attached'])
+      ).toBe('')
+      expect(await readFile(join(finalPath, 'checkout-hook.txt'), 'utf8')).toBe(
+        `${targetHead}\n${targetHead}\n1\nfeature/attached\n`
+      )
+      await rm(join(finalPath, 'checkout-hook.txt'))
+      expect(await readFile(join(finalPath, 'version.txt'), 'utf8')).toBe(
+        advanceBase ? 'advanced\n' : 'one\n'
+      )
+      expect(git(finalPath, ['status', '--porcelain'])).toBe('')
+    }
+  )
+
+  it('never publishes a branch at a HEAD changed before attachment', async () => {
+    const { repoPath, root } = await createRepo()
+    const preparedPath = join(root, 'prepared-race')
+    const finalPath = join(root, 'final-race')
+    await prepareWorktreeCreateCheckout(
+      repoPath,
+      preparedPath,
+      'main',
+      createWorktreePreparationLockReason('head-race')
+    )
+    const expectedHead = git(repoPath, ['rev-parse', 'HEAD'])
+    git(repoPath, ['checkout', '--quiet', '-b', 'other'])
+    await writeFile(join(repoPath, 'version.txt'), 'other\n')
+    git(repoPath, ['commit', '--quiet', '-am', 'other commit'])
+    const otherHead = git(repoPath, ['rev-parse', 'HEAD'])
+    git(repoPath, ['checkout', '--quiet', 'main'])
+
+    const original = gitRunner.gitExecFileAsync
+    const spy = vi.spyOn(gitRunner, 'gitExecFileAsync').mockImplementation((args, options) => {
+      if (args.includes('checkout') || args.includes('switch')) {
+        git(finalPath, ['reset', '--hard', otherHead])
+      }
+      return original(args, options)
+    })
+    try {
+      await finalizePreparedWorktree(repoPath, preparedPath, finalPath, 'feature/race', 'main')
+    } finally {
+      spy.mockRestore()
+    }
+    expect(git(repoPath, ['rev-parse', 'main'])).toBe(expectedHead)
+    expect(git(finalPath, ['rev-parse', 'HEAD'])).toBe(expectedHead)
+    expect(git(finalPath, ['symbolic-ref', '--short', 'HEAD'])).toBe('feature/race')
+    expect(await readFile(join(finalPath, 'version.txt'), 'utf8')).toBe('one\n')
+  })
+
+  it('accepts a commit made by the post-checkout hook during attachment', async () => {
+    const { repoPath, root } = await createRepo()
+    const preparedPath = join(root, 'prepared-hook-commit')
+    const finalPath = join(root, 'final-hook-commit')
+    const hooksPath = join(root, 'hooks')
+    await mkdir(hooksPath)
+    await writeFile(
+      join(hooksPath, 'post-checkout'),
+      '#!/bin/sh\nprintf "invoked\\n" >> hook-invocations.txt\ngit add hook-invocations.txt\ngit commit --quiet -m "hook commit"\n',
+      { mode: 0o755 }
+    )
+    git(repoPath, ['config', 'core.hooksPath', hooksPath])
+    await prepareWorktreeCreateCheckout(
+      repoPath,
+      preparedPath,
+      'main',
+      createWorktreePreparationLockReason('hook-commit')
+    )
+    const baseHead = git(repoPath, ['rev-parse', 'HEAD'])
+
+    await finalizePreparedWorktree(repoPath, preparedPath, finalPath, 'feature/hook-commit', 'main')
+
+    expect(git(finalPath, ['symbolic-ref', '--short', 'HEAD'])).toBe('feature/hook-commit')
+    expect(git(finalPath, ['rev-parse', 'HEAD^'])).toBe(baseHead)
+    expect(git(finalPath, ['show', '-s', '--format=%s', 'HEAD'])).toBe('hook commit')
+    expect(await readFile(join(finalPath, 'hook-invocations.txt'), 'utf8')).toBe('invoked\n')
+    expect(git(finalPath, ['status', '--porcelain'])).toBe('')
+  })
+
+  it('cleans up a branch when post-checkout rejects the attachment', async () => {
+    const { repoPath, root } = await createRepo()
+    const preparedPath = join(root, 'prepared-hook-failure')
+    const finalPath = join(root, 'final-hook-failure')
+    const hooksPath = join(root, 'hooks')
+    await mkdir(hooksPath)
+    await writeFile(join(hooksPath, 'post-checkout'), '#!/bin/sh\nexit 1\n', { mode: 0o755 })
+    git(repoPath, ['config', 'core.hooksPath', hooksPath])
+    await prepareWorktreeCreateCheckout(
+      repoPath,
+      preparedPath,
+      'main',
+      createWorktreePreparationLockReason('hook-failure')
+    )
+
+    await expect(
+      finalizePreparedWorktree(repoPath, preparedPath, finalPath, 'feature/hook-failure', 'main')
+    ).rejects.toThrow()
+    expect(existsSync(finalPath)).toBe(false)
+    expect(git(repoPath, ['branch', '--list', 'feature/hook-failure'])).toBe('')
+  })
+
   it('retains preparation ownership when the removal command cannot start', async () => {
     const fixture = await createRepo()
     const repoPath = await realpath(fixture.repoPath)
@@ -65,7 +196,7 @@ describe('prepared worktree creation with real Git', () => {
     await prepareWorktreeCreateCheckout(repoPath, preparedPath, 'main', lockReason)
     const original = gitRunner.gitExecFileAsync
     const spy = vi.spyOn(gitRunner, 'gitExecFileAsync').mockImplementation((args, options) => {
-      if (args.includes('remove') && args.includes(preparedPath)) {
+      if (args.includes('remove') && args.some((arg) => areWorktreePathsEqual(arg, preparedPath))) {
         return Promise.reject(new Error('injected removal launch failure'))
       }
       return original(args, options)
@@ -113,7 +244,7 @@ describe('prepared worktree creation with real Git', () => {
     const spy = vi
       .spyOn(gitRunner, 'gitExecFileAsync')
       .mockImplementation(async (args, options) => {
-        if (args.includes('remove') && args.includes(stalePath)) {
+        if (args.includes('remove') && args.some((arg) => areWorktreePathsEqual(arg, stalePath))) {
           markRemovalStarted()
           await removalGate
         }
@@ -145,7 +276,8 @@ describe('prepared worktree creation with real Git', () => {
       expect(existsSync(stalePath)).toBe(false)
       const remaining = await listWorktrees(repoPath, { includeCreatePreparations: true })
       expect(remaining).toHaveLength(2)
-      expect(remaining.map((w) => w.path)).toEqual(expect.arrayContaining([repoPath, finalPath]))
+      expect(remaining.some((w) => areWorktreePathsEqual(w.path, repoPath))).toBe(true)
+      expect(remaining.some((w) => areWorktreePathsEqual(w.path, finalPath))).toBe(true)
       expect(hasPendingStalePreparationCleanup()).toBe(false)
     } finally {
       releaseRemoval()
diff --git a/src/main/gitea/client-scan-invalidation.test.ts b/src/main/gitea/client-scan-invalidation.test.ts
new file mode 100644
index 00000000000..b93bf4e1824
--- /dev/null
+++ b/src/main/gitea/client-scan-invalidation.test.ts
@@ -0,0 +1,169 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('../git/runner', () => ({
+  gitExecFileAsync: vi.fn(async () => ({
+    stdout: 'https://git.example.com/team/repo.git\n',
+    stderr: ''
+  }))
+}))
+vi.mock('../providers/ssh-git-dispatch', () => ({
+  getSSHGitProvider: vi.fn(() => undefined),
+  getSSHGitProviderGeneration: () => 0
+}))
+vi.mock('../source-control/pull-request-template', () => ({
+  readHostedPullRequestTemplate: vi.fn(async () => '')
+}))
+
+import {
+  getGiteaPullRequestForBranch,
+  getGiteaPullRequestForBranchOrThrow,
+  getGiteaRepoSlug,
+  invalidateGiteaPullRequestScanForRepo
+} from './client'
+import { createGiteaPullRequest } from './pull-request-creation'
+import { _resetGiteaRepoRefCache } from './repository-ref'
+import { _resetGiteaPullRequestScanCache } from './pull-request-scan-cache'
+
+const branch = 'feature/gitea'
+const pullRequest = {
+  number: 7,
+  title: 'Add Gitea',
+  state: 'open',
+  html_url: 'https://git.example.com/team/repo/pulls/7',
+  head: { ref: branch }
+}
+
+function createReview() {
+  return createGiteaPullRequest(
+    '/repo',
+    { provider: 'gitea', base: 'main', head: branch, title: 'Add Gitea', body: '' },
+    'local'
+  )
+}
+
+describe('Gitea scan invalidation after creation', () => {
+  beforeEach(() => {
+    vi.stubEnv('ORCA_GITEA_TOKEN', 'test-token')
+    vi.stubEnv('ORCA_GITEA_API_BASE_URL', '')
+    _resetGiteaRepoRefCache()
+    _resetGiteaPullRequestScanCache()
+  })
+
+  afterEach(() => {
+    _resetGiteaRepoRefCache()
+    _resetGiteaPullRequestScanCache()
+    vi.unstubAllGlobals()
+    vi.unstubAllEnvs()
+  })
+
+  it('refreshes cached misses in both modes after a successful create and coalesces readers', async () => {
+    let created = false
+    let listCalls = 0
+    let createCalls = 0
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async (url: URL, init?: RequestInit) => {
+        expect(url.pathname).toBe('/api/v1/repos/team/repo/pulls')
+        if (init?.method === 'POST') {
+          createCalls++
+          created = true
+          return Response.json(pullRequest)
+        }
+        listCalls++
+        return Response.json(created ? [pullRequest] : [])
+      })
+    )
+
+    expect(await getGiteaPullRequestForBranch('/repo', branch)).toBeNull()
+    expect(await getGiteaPullRequestForBranchOrThrow('/repo', branch)).toBeNull()
+    expect(listCalls).toBe(2)
+    expect(await createReview()).toMatchObject({ ok: true, number: 7 })
+
+    const refreshed = await Promise.all([
+      getGiteaPullRequestForBranchOrThrow('/repo', branch),
+      getGiteaPullRequestForBranchOrThrow('/repo', branch),
+      getGiteaPullRequestForBranch('/repo', branch),
+      getGiteaPullRequestForBranch('/repo', branch)
+    ])
+    expect(refreshed.map((review) => review?.number)).toEqual([7, 7, 7, 7])
+    expect(listCalls).toBe(4)
+    expect(createCalls).toBe(1)
+    expect(await getGiteaPullRequestForBranchOrThrow('/repo', branch)).toMatchObject({ number: 7 })
+    expect(listCalls).toBe(4)
+  })
+
+  it('retires a strict miss when a create attempt recovers an existing pull request', async () => {
+    let attempted = false
+    let listCalls = 0
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async (_url: URL, init?: RequestInit) => {
+        if (init?.method === 'POST') {
+          attempted = true
+          return Response.json({ message: 'already exists' }, { status: 409 })
+        }
+        listCalls++
+        return Response.json(attempted ? [pullRequest] : [])
+      })
+    )
+
+    expect(await getGiteaPullRequestForBranchOrThrow('/repo', branch)).toBeNull()
+    expect(await createReview()).toMatchObject({
+      ok: false,
+      code: 'already_exists',
+      existingReview: { number: 7 }
+    })
+    expect(await getGiteaPullRequestForBranchOrThrow('/repo', branch)).toMatchObject({ number: 7 })
+    expect(listCalls).toBe(3)
+  })
+
+  it.each(['before', 'after'] as const)(
+    'keeps fresh strict results when a pre-invalidation scan finishes %s its replacement',
+    async (completionOrder) => {
+      const oldResponse = Promise.withResolvers<Response>()
+      const freshResponse = Promise.withResolvers<Response>()
+      const oldStarted = Promise.withResolvers<void>()
+      const fetchMock = vi
+        .fn()
+        .mockImplementationOnce(() => {
+          oldStarted.resolve()
+          return oldResponse.promise
+        })
+        .mockImplementationOnce(() => freshResponse.promise)
+      vi.stubGlobal('fetch', fetchMock)
+
+      const stale = getGiteaPullRequestForBranchOrThrow('/repo', branch)
+      await oldStarted.promise
+      const repo = await getGiteaRepoSlug('/repo')
+      if (!repo) {
+        throw new Error('Expected test repository')
+      }
+      invalidateGiteaPullRequestScanForRepo(repo)
+      const fresh = getGiteaPullRequestForBranchOrThrow('/repo', branch)
+      const concurrent = getGiteaPullRequestForBranchOrThrow('/repo', branch)
+      try {
+        await new Promise<void>((resolve) => setImmediate(resolve))
+        expect(fetchMock).toHaveBeenCalledTimes(2)
+        if (completionOrder === 'before') {
+          oldResponse.resolve(Response.json([]))
+          expect(await stale).toBeNull()
+        }
+        freshResponse.resolve(Response.json([pullRequest]))
+        expect(await fresh).toMatchObject({ number: 7 })
+        expect(await concurrent).toMatchObject({ number: 7 })
+        if (completionOrder === 'after') {
+          oldResponse.resolve(Response.json([]))
+          expect(await stale).toBeNull()
+        }
+        expect(await getGiteaPullRequestForBranchOrThrow('/repo', branch)).toMatchObject({
+          number: 7
+        })
+        expect(fetchMock).toHaveBeenCalledTimes(2)
+      } finally {
+        oldResponse.resolve(Response.json([]))
+        freshResponse.resolve(Response.json([pullRequest]))
+        await Promise.all([stale, fresh, concurrent])
+      }
+    }
+  )
+})
diff --git a/src/main/gitea/client.ts b/src/main/gitea/client.ts
index ba9e7c3ed8f..ba768bb8131 100644
--- a/src/main/gitea/client.ts
+++ b/src/main/gitea/client.ts
@@ -131,7 +131,9 @@ function giteaPullRequestScanKey(repo: GiteaRepoRef): string {
 /** Invalidate the shared /pulls scan after Orca itself creates a PR so the
  *  next worktree-card refresh sees it instead of a cached miss. */
 export function invalidateGiteaPullRequestScanForRepo(repo: GiteaRepoRef): void {
-  invalidateGiteaPullRequestScan(giteaPullRequestScanKey(repo))
+  const repoKey = giteaPullRequestScanKey(repo)
+  invalidateGiteaPullRequestScan(repoKey)
+  invalidateGiteaPullRequestScan(`${repoKey}::strict`)
 }
 
 async function getCommitStatus(
diff --git a/src/main/github/work-item-details-api-parity.test.ts b/src/main/github/work-item-details-api-parity.test.ts
deleted file mode 100644
index 187680f64cd..00000000000
--- a/src/main/github/work-item-details-api-parity.test.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-import { describe, expect, expectTypeOf, it } from 'vitest'
-import type { GitHubPRFile, GitHubPRFileContents } from '../../shared/github/pull-request-types'
-import type { GitHubWorkItemDetails } from '../../shared/github/work-item-types'
-import type { IssueSourcePreference } from '../../shared/repo-types'
-import type { LocalGitExecOptions } from './gh-utils'
-import type { GitHubApiRepository } from './github-api-repository'
-import * as workItemDetails from './work-item-details'
-
-type GetWorkItemDetails = (
-  repoPath: string,
-  number: number,
-  type?: 'issue' | 'pr',
-  connectionId?: string | null,
-  localGitOptions?: LocalGitExecOptions,
-  preference?: IssueSourcePreference
-) => Promise<GitHubWorkItemDetails | null>
-
-type GetPRFileContents = (args: {
-  repoPath: string
-  connectionId?: string | null
-  localGitOptions?: LocalGitExecOptions
-  prRepo?: GitHubApiRepository | null
-  prNumber: number
-  path: string
-  oldPath?: string
-  status: GitHubPRFile['status']
-  headSha: string
-  baseSha: string
-}) => Promise<GitHubPRFileContents>
-
-describe('work-item-details public API parity', () => {
-  it('retains only the established runtime exports and call signatures', () => {
-    expect(Object.keys(workItemDetails).sort()).toEqual(['getPRFileContents', 'getWorkItemDetails'])
-    expectTypeOf(workItemDetails.getWorkItemDetails).toEqualTypeOf<GetWorkItemDetails>()
-    expectTypeOf(workItemDetails.getPRFileContents).toEqualTypeOf<GetPRFileContents>()
-  })
-})
diff --git a/src/main/global-fetch-call-site-audit.test.ts b/src/main/global-fetch-call-site-audit.test.ts
index 0c2133f320e..907092515f5 100644
--- a/src/main/global-fetch-call-site-audit.test.ts
+++ b/src/main/global-fetch-call-site-audit.test.ts
@@ -23,6 +23,7 @@ const AUDITED_GLOBAL_FETCH_LINES = new Map<string, number>([
   ['main/orca-profiles/profile-cloud-client.ts', 1],
   ['main/orca-profiles/profile-cloud-org-members-client.ts', 1],
   ['main/rate-limits/codex-fetcher.ts', 3],
+  ['main/rate-limits/zcode-usage-fetcher.ts', 1],
   ['main/runtime/push/push-gateway-client.ts', 1],
   ['main/runtime/relay/relay-http-client.ts', 2],
   ['main/runtime/relay/relay-region-catalog-fetch.ts', 1],
diff --git a/src/main/headless-automation-dispatcher-source-boundary.test.ts b/src/main/headless-automation-dispatcher-source-boundary.test.ts
deleted file mode 100644
index 5f7a10fedec..00000000000
--- a/src/main/headless-automation-dispatcher-source-boundary.test.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-const source = readFileSync(join(__dirname, 'startup', 'main-process-automations.ts'), 'utf8')
-
-function sourceBetween(startPattern: string, endPattern: string): string {
-  const start = source.indexOf(startPattern)
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = source.indexOf(endPattern, start + startPattern.length)
-  expect(end).toBeGreaterThan(start)
-  return source.slice(start, end)
-}
-
-describe('headless automation dispatcher source boundaries', () => {
-  it('creates new-per-run workspaces from the resolved run target repo', () => {
-    const createArgsSection = sourceBetween('buildHeadlessAutomationWorktreeCreateArgs({', '})')
-
-    expect(createArgsSection).toContain('repo: target.repo')
-    expect(createArgsSection).not.toContain('automation.sourceContext')
-  })
-})
diff --git a/src/main/hermes/hermes-config-comment-boundaries.test.ts b/src/main/hermes/hermes-config-comment-boundaries.test.ts
new file mode 100644
index 00000000000..b28ad582ed9
--- /dev/null
+++ b/src/main/hermes/hermes-config-comment-boundaries.test.ts
@@ -0,0 +1,90 @@
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import { parseDocument } from 'yaml'
+import { createManagedHookLocalFilesystem } from '../agent-hooks/managed-hook-local-filesystem'
+import { disablePlugin, enablePlugin, updateConfigContent } from './hermes-config-yaml'
+import { HermesHookService } from './hook-service'
+
+const fixtures = [
+  ...['  ', '    '].flatMap((indent) =>
+    [true, false].map((retained) => ({
+      name: `trailing list comment (${indent.length} spaces, retained: ${retained})`,
+      list: `${indent}# list head\n${retained ? `${indent}- keep\n` : ''}${indent}- orca-status # managed entry\n${indent}# list tail\n`,
+      suffix: '  custom: "off"\nmodel: "001"\n'
+    }))
+  ),
+  {
+    name: 'comment before the next root setting',
+    list: '    - keep\n    - orca-status # managed entry\n',
+    suffix: '# Operator notes\nmodel: "001"\n'
+  },
+  {
+    name: 'comment before the next plugin setting',
+    list: '    - keep\n    - orca-status # managed entry\n',
+    suffix: '  # Plugin notes\n  custom: "off"\nmodel: "001"\n'
+  },
+  {
+    name: 'comment at the end of the document',
+    list: '    - keep\n    - orca-status # managed entry\n',
+    suffix: '# End notes\n'
+  },
+  {
+    name: 'leading comment on the first retained entry',
+    list: '    # lead\n    - orca-status\n    # between\n    - keep\n',
+    suffix: 'model: "001"\n'
+  }
+]
+
+describe.each(['\n', '\r\n'])('Hermes comment boundaries (%j)', (eol) => {
+  describe.each(['install', 'remove'])('%s', (operation) => {
+    it.each(fixtures)('preserves $name exactly once through the service', async (fixture) => {
+      const key = operation === 'install' ? 'disabled' : 'enabled'
+      const enabled = operation === 'install' ? '  enabled: [orca-status]\n' : ''
+      const input = `plugins:\n${enabled}  ${key}:\n${fixture.list}${fixture.suffix}`.replaceAll(
+        '\n',
+        eol
+      )
+      const updater = operation === 'install' ? enablePlugin : disablePlugin
+      const result = updateConfigContent(input, updater)
+      expect(result.detail).toBeUndefined()
+      const output = result.content ?? ''
+      const parsed = parseDocument(output)
+      expect(parsed.errors).toEqual([])
+      expect(parsed.warnings).toEqual([])
+      expect(parsed.toJS()).toEqual(updater(parseDocument(input).toJS()))
+      for (const comment of input.match(/#[^\r\n]*/g) ?? []) {
+        expect(output.split(comment)).toHaveLength(2)
+      }
+      expect(output.endsWith(fixture.suffix.replaceAll('\n', eol))).toBe(true)
+      expect(updateConfigContent(output, updater).content).toBe(output)
+      if (eol === '\r\n') {
+        expect(output.replaceAll(eol, '')).not.toContain('\n')
+      }
+
+      const root = mkdtempSync(join(tmpdir(), 'orca-hermes-comments-'))
+      const home = join(root, '.hermes')
+      mkdirSync(home)
+      const path = join(home, 'config.yaml')
+      vi.stubEnv('HERMES_HOME', home)
+      try {
+        writeFileSync(path, input)
+        const service = new HermesHookService()
+        const status = operation === 'install' ? service.install() : service.remove()
+        expect(status.state).toBe(operation === 'install' ? 'installed' : 'not_installed')
+        expect(readFileSync(path, 'utf8')).toBe(output)
+        expect(readFileSync(`${path}.bak`, 'utf8')).toBe(input)
+        if (operation === 'install') {
+          writeFileSync(path, input)
+          const remote = await service.installRemote(createManagedHookLocalFilesystem(), root)
+          expect(remote.state).toBe('installed')
+          expect(readFileSync(path, 'utf8')).toBe(output)
+        }
+      } finally {
+        vi.unstubAllEnvs()
+        rmSync(root, { recursive: true, force: true })
+      }
+    })
+  })
+})
diff --git a/src/main/hermes/hermes-config-document.test.ts b/src/main/hermes/hermes-config-document.test.ts
new file mode 100644
index 00000000000..744b6c23f6f
--- /dev/null
+++ b/src/main/hermes/hermes-config-document.test.ts
@@ -0,0 +1,166 @@
+import { describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { disablePlugin, enablePlugin, updateConfigContent } from './hermes-config-yaml'
+
+const fixture = [
+  '# Operator documentation',
+  'model: "001" # keep quoted',
+  'prompt: |',
+  '  First line',
+  '  Second line',
+  'defaults: &defaults',
+  '  temperature: 0.25 # setting',
+  'other: *defaults',
+  '',
+  'plugins:',
+  '  enabled:',
+  '    - "zeta" # last alphabetically',
+  '    - alpha # first occurrence',
+  '    - alpha # duplicate belongs to user',
+  '  disabled: [orca-status, blocked] # disabled choices',
+  '  custom: "off" # unrelated plugin setting',
+  '# End documentation',
+  ''
+].join('\n')
+
+describe('Hermes YAML document edits', () => {
+  it.each(['\n', '\r\n'])('preserves comments and values through install/remove (%j)', (eol) => {
+    const initial = fixture.replaceAll('\n', eol)
+    const installed = updateConfigContent(initial, enablePlugin)
+    expect(installed.detail).toBeUndefined()
+    expect(installed.content).not.toBeNull()
+    const enabled = installed.content ?? ''
+    expect(parse(enabled)).toEqual({
+      ...parse(initial),
+      plugins: {
+        enabled: ['zeta', 'alpha', 'alpha', 'orca-status'],
+        disabled: ['blocked'],
+        custom: 'off'
+      }
+    })
+    const removed = updateConfigContent(enabled, disablePlugin).content ?? ''
+    expect(parse(removed)).toEqual({
+      ...parse(initial),
+      plugins: { enabled: ['zeta', 'alpha', 'alpha'], disabled: ['blocked'], custom: 'off' }
+    })
+    for (const output of [enabled, removed]) {
+      for (const comment of initial.match(/#[^\r\n]*/g) ?? []) {
+        expect(output).toContain(comment)
+      }
+      expect(output).toContain('model: "001" # keep quoted')
+      expect(output).toContain(`prompt: |${eol}  First line${eol}  Second line`)
+      expect(output).toContain('&defaults')
+      expect(output).toContain('*defaults')
+      if (eol === '\r\n') {
+        expect(output.replaceAll('\r\n', '')).not.toContain('\n')
+      }
+    }
+  })
+
+  it.each([
+    '# existing\r\nplugins:\r\n  enabled: [zeta, orca-status, alpha, alpha]\r\n',
+    'plugins: &plugins\n  enabled: [orca-status]\nother: *plugins\n'
+  ])('returns exact bytes for a semantic no-op', (input) => {
+    expect(updateConfigContent(input, enablePlugin)).toEqual({ content: input })
+  })
+
+  it.each(['# no plugins\nmodel: test\n', 'plugins:\n  disabled: [blocked]\n'])(
+    'does not add absent lists when removing',
+    (input) => expect(updateConfigContent(input, disablePlugin)).toEqual({ content: input })
+  )
+
+  it('retains comments attached to removed Orca entries', () => {
+    const input =
+      'plugins:\n  enabled:\n    # keep this note\n    - orca-status # managed entry\n    - other\n'
+    const output = updateConfigContent(input, disablePlugin).content ?? ''
+    expect(parse(output).plugins.enabled).toEqual(['other'])
+    expect(output).toContain('# keep this note')
+    expect(output).toContain('# managed entry')
+    expect(output.match(/# keep this note/g)).toHaveLength(1)
+  })
+
+  it.each([
+    'plugins: [',
+    'plugins: {}\nplugins: {}\n',
+    '- invalid root\n',
+    'plugins: unexpected\n',
+    'plugins:\n  enabled: not-a-list\n',
+    'plugins:\n  enabled: [123]\n',
+    'plugins:\n  disabled: not-a-list\n',
+    'plugins: !custom {}\n',
+    'defaults: &defaults {plugins: {enabled: [other]}}\n<<: *defaults\n',
+    'defaults: &defaults {enabled: [other]}\nplugins:\n  <<: *defaults\n',
+    'plugins: &plugins\n  enabled: [other]\nother: *plugins\n',
+    'plugins:\n  enabled: &enabled [other]\nother: *enabled\n',
+    'enabled: &enabled [other]\nplugins:\n  enabled: *enabled\n',
+    'plugins:\n  enabled: [*missing]\n'
+  ])('refuses an unsafe update without a replacement (%s)', (input) => {
+    const output = updateConfigContent(input, enablePlugin)
+    expect(output.content).toBeNull()
+    expect(output.detail).toBeTruthy()
+  })
+
+  it('keeps folded scalars, quoted strings and long lines in a real update', () => {
+    const input = `# header\nprompt: >-\n  First line\n  Second line\nquoted: 'off'\nlong: ${'word '
+      .repeat(30)
+      .trimEnd()}\nplugins: {enabled: [other]}\n`
+    const output = updateConfigContent(input, enablePlugin).content ?? ''
+    expect(output).toContain('prompt: >-\n  First line\n  Second line\n')
+    expect(output).toContain("quoted: 'off'")
+    expect(output).toContain(`long: ${'word '.repeat(30).trimEnd()}\n`)
+    expect(parse(output)).toEqual({
+      ...parse(input),
+      plugins: { enabled: ['other', 'orca-status'] }
+    })
+  })
+
+  it.each(['\n', '\r\n'])(
+    'leaves unrelated source bytes intact with unusual indentation (%j)',
+    (eol) => {
+      const prefix =
+        'model:    "001" # spacing\nprompt: >-\n    First\n    Second\n\n# plugins\nplugins:\n    custom: |-\n        Unrelated\n        text\n'.replaceAll(
+          '\n',
+          eol
+        )
+      const input = `${prefix}    enabled: [other] # choices${eol}# ending${eol}`
+      const installed = updateConfigContent(input, enablePlugin).content ?? ''
+      expect(installed.startsWith(prefix)).toBe(true)
+      expect(installed.endsWith(`# ending${eol}`)).toBe(true)
+      const removed = updateConfigContent(installed, disablePlugin).content ?? ''
+      expect(removed.startsWith(prefix)).toBe(true)
+      expect(parse(removed)).toEqual(parse(input))
+    }
+  )
+
+  it.each([
+    'model: "001"',
+    'model: "001"\n# end\n...\n',
+    '{model: "001"}\n',
+    'plugins: {} # empty\n',
+    'plugins: {custom: "off",} # flow\n',
+    'plugins:\n    custom: >-\n        First\n        Second\n# end\n'
+  ])('inserts missing plugin keys without losing other values (%s)', (input) => {
+    const installed = updateConfigContent(input, enablePlugin)
+    expect(installed.detail).toBeUndefined()
+    const output = installed.content ?? ''
+    const parsed = parse(input)
+    expect(parse(output)).toEqual({
+      ...parsed,
+      plugins: { ...parsed.plugins, enabled: ['orca-status'] }
+    })
+    for (const comment of input.match(/#[^\r\n]*/g) ?? []) {
+      expect(output).toContain(comment)
+    }
+    if (input.includes('First')) {
+      expect(output).toContain('custom: >-\n        First\n        Second\n')
+    }
+  })
+
+  it.each(['', '# empty document\n', 'null\n'])('enables a plugin in an empty config', (input) => {
+    const output = updateConfigContent(input, enablePlugin).content ?? ''
+    expect(parse(output)).toEqual({ plugins: { enabled: ['orca-status'] } })
+    if (input.includes('#')) {
+      expect(output).toContain('# empty document')
+    }
+  })
+})
diff --git a/src/main/hermes/hermes-config-document.ts b/src/main/hermes/hermes-config-document.ts
new file mode 100644
index 00000000000..71fe4ade608
--- /dev/null
+++ b/src/main/hermes/hermes-config-document.ts
@@ -0,0 +1,141 @@
+import { isDeepStrictEqual } from 'node:util'
+import { isAlias, isMap, isNode, isScalar, isSeq, parseDocument, visit } from 'yaml'
+import type { Document, YAMLMap, YAMLSeq } from 'yaml'
+import type { HermesConfig } from './hermes-config-yaml'
+import { applyHermesPluginSourceEdits } from './hermes-config-source-edits'
+
+function preserveRemovedComments(sequence: YAMLSeq, removed: unknown[], first: unknown): void {
+  const comments = removed.flatMap((node) =>
+    isNode(node)
+      ? [node === first && !sequence.flow ? null : node.commentBefore, node.comment].filter(
+          (text) => text != null
+        )
+      : []
+  )
+  if (comments.length > 0) {
+    sequence.comment = [sequence.comment, ...comments].filter((text) => text != null).join('\n')
+  }
+}
+
+function updateStringSequence(plugins: YAMLMap, key: string, values: unknown): void {
+  if (values === undefined) {
+    return
+  }
+  if (!Array.isArray(values) || values.some((value) => typeof value !== 'string')) {
+    throw new Error(`Hermes plugins.${key} must be a string list`)
+  }
+  const sequence = plugins.get(key, true)
+  if (sequence === undefined) {
+    plugins.set(key, values)
+    return
+  }
+  if (!isSeq(sequence)) {
+    throw new Error(`Hermes plugins.${key} must be a string list`)
+  }
+  const remaining = [...values]
+  const removed: unknown[] = []
+  const first = sequence.items[0]
+  sequence.items = sequence.items.filter((item) => {
+    if (!isScalar(item) || typeof item.value !== 'string') {
+      throw new Error(`Hermes plugins.${key} must contain plain string entries`)
+    }
+    const index = remaining.indexOf(item.value)
+    if (index === -1) {
+      removed.push(item)
+      return false
+    }
+    remaining.splice(index, 1)
+    return true
+  })
+  preserveRemovedComments(sequence, removed, first)
+  for (const value of remaining) {
+    sequence.add(value)
+  }
+}
+
+export function updateHermesPluginDocument(
+  content: string,
+  next: HermesConfig
+): { content: string | null; detail?: string } {
+  try {
+    const document: Document = parseDocument(content)
+    if (document.errors.length > 0 || document.warnings.length > 0) {
+      throw new Error(
+        [...document.errors, ...document.warnings].map((item) => item.message).join('; ')
+      )
+    }
+    if (isScalar(document.contents) && document.contents.value === null) {
+      const previous = document.contents
+      document.contents = document.createNode({})
+      document.contents.commentBefore = previous.commentBefore
+      document.contents.comment = previous.comment
+    }
+    if (document.contents === null) {
+      document.contents = document.createNode({})
+    }
+    if (!isMap(document.contents)) {
+      throw new Error('Hermes config.yaml root must be a mapping')
+    }
+    if (document.contents.anchor) {
+      throw new Error('Cannot safely edit an anchored Hermes root')
+    }
+    if (document.contents.has('<<')) {
+      throw new Error('Cannot safely edit a merged Hermes root')
+    }
+
+    let plugins = document.get('plugins', true)
+    if (plugins === undefined) {
+      document.set('plugins', document.createNode({}))
+      plugins = document.get('plugins', true)
+    }
+    if (!isMap(plugins)) {
+      throw new Error('Hermes plugins must be a plain mapping')
+    }
+    // Aliases into a changed subtree could silently change unrelated settings.
+    visit(plugins, {
+      Node: (_key, node) => {
+        if (isAlias(node) || node.anchor || node.tag) {
+          throw new Error('Cannot safely edit Hermes plugins with anchors, aliases or tags')
+        }
+      },
+      Pair: (_key, pair) => {
+        if (isScalar(pair.key) && pair.key.value === '<<') {
+          throw new Error('Cannot safely edit Hermes plugins with YAML merge keys')
+        }
+      }
+    })
+    for (const key of ['enabled', 'disabled']) {
+      const existing = plugins.get(key, true)
+      if (
+        existing !== undefined &&
+        (!isSeq(existing) ||
+          existing.items.some((item) => !isScalar(item) || typeof item.value !== 'string'))
+      ) {
+        throw new Error(`Hermes plugins.${key} must be a string list`)
+      }
+    }
+    const nextPlugins = next.plugins
+    if (typeof nextPlugins !== 'object' || nextPlugins === null) {
+      throw new Error('Hermes plugins must be a mapping')
+    }
+    if ('enabled' in nextPlugins) {
+      updateStringSequence(plugins, 'enabled', nextPlugins.enabled)
+    }
+    if ('disabled' in nextPlugins) {
+      updateStringSequence(plugins, 'disabled', nextPlugins.disabled)
+    }
+    const output = applyHermesPluginSourceEdits(content, document)
+    // Re-parse to reject edits that would change any unrelated alias-resolved value.
+    const verified = parseDocument(output)
+    if (
+      verified.errors.length > 0 ||
+      verified.warnings.length > 0 ||
+      !isDeepStrictEqual(verified.toJS(), next)
+    ) {
+      throw new Error('Hermes plugin update would change unrelated configuration')
+    }
+    return { content: output }
+  } catch (error) {
+    return { content: null, detail: error instanceof Error ? error.message : String(error) }
+  }
+}
diff --git a/src/main/hermes/hermes-config-flow-insertion.test.ts b/src/main/hermes/hermes-config-flow-insertion.test.ts
new file mode 100644
index 00000000000..f00c76c8f9e
--- /dev/null
+++ b/src/main/hermes/hermes-config-flow-insertion.test.ts
@@ -0,0 +1,184 @@
+import { describe, expect, it } from 'vitest'
+import { isMap, parseDocument } from 'yaml'
+import { enablePlugin, updateConfigContent } from './hermes-config-yaml'
+
+const pluginEntries = [
+  { name: 'empty', text: ' # empty,\n', expected: {} },
+  { name: 'nonempty', text: 'custom: keep # note\n', expected: { custom: 'keep' } },
+  {
+    name: 'trailing comma',
+    text: 'custom: keep, # separator,\n',
+    expected: { custom: 'keep' }
+  },
+  {
+    name: 'comment comma',
+    text: 'custom: keep # no separator,\n',
+    expected: { custom: 'keep' }
+  },
+  {
+    name: 'nested commas',
+    text: 'custom: {names: ["a,", b,],} # nested,\n',
+    expected: { custom: { names: ['a,', 'b'] } }
+  },
+  {
+    name: 'explicit entry key',
+    text: '? custom : keep # explicit,\n',
+    expected: { custom: 'keep' }
+  }
+]
+
+const contexts = [
+  { name: 'block root', prefix: 'plugins: {', suffix: '} # outside' },
+  {
+    name: 'indented block root',
+    prefix: '    model: "001" # before\n    plugins: {',
+    suffix: '    } # outside\n    prompt: |-\n      Keep this text',
+    settings: { model: '001', prompt: 'Keep this text' }
+  },
+  { name: 'explicit plugins key', prefix: '? "plugins"\n: {', suffix: '} # outside' },
+  {
+    name: 'indented explicit plugins key',
+    prefix: '    ? plugins\n    : {',
+    suffix: '    } # outside'
+  },
+  { name: 'flow on next line', prefix: 'plugins:\n    {', suffix: '} # outside' },
+  {
+    name: 'nested in root flow',
+    prefix: '{model: "001", plugins: {',
+    suffix: '}, extra: [one, two,]} # outside',
+    settings: { model: '001', extra: ['one', 'two'] }
+  }
+]
+
+function expectInsertion(source: string, expected: unknown, eol: string): string {
+  const original = parseDocument(source)
+  expect(original.errors).toEqual([])
+  expect(original.warnings).toEqual([])
+  const plugins = original.get('plugins', true)
+  const parent = isMap(plugins) ? plugins : original.contents
+  if (!isMap(parent) || !parent.range) {
+    throw new Error('Fixture must contain a ranged mapping')
+  }
+  const position = parent.range[1] - 1
+  const result = updateConfigContent(source, enablePlugin)
+  expect(result.detail).toBeUndefined()
+  const output = result.content ?? ''
+  const document = parseDocument(output)
+  expect(document.errors).toEqual([])
+  expect(document.warnings).toEqual([])
+  expect(document.toJS()).toEqual(expected)
+  expect(output.startsWith(source.slice(0, position))).toBe(true)
+  expect(output.endsWith(source.slice(position))).toBe(true)
+  expect(updateConfigContent(output, enablePlugin)).toEqual({ content: output })
+  if (eol === '\r\n') {
+    expect(output.replaceAll(eol, '')).not.toContain('\n')
+  }
+  return output
+}
+
+describe.each(['\n', '\r\n'])('Hermes flow insertion indentation (%j)', (eol) => {
+  describe.each([false, true])('final newline = %j', (finalNewline) => {
+    describe.each(contexts)('$name', ({ prefix, suffix, settings }) => {
+      it.each(pluginEntries)('$name plugin map', ({ text, expected }) => {
+        const source = `${prefix}${text}${suffix}${finalNewline ? '\n' : ''}`.replaceAll('\n', eol)
+        expectInsertion(
+          source,
+          { ...settings, plugins: { ...expected, enabled: ['orca-status'] } },
+          eol
+        )
+      })
+    })
+
+    it.each([
+      { name: 'empty root', text: '{ # empty,\n}', expected: {} },
+      { name: 'nonempty root', text: '{model: "001" # note,\n}', expected: { model: '001' } },
+      {
+        name: 'indented root with nested trailing comma',
+        text: '    {model: {names: ["a,", b,],}, # separator,\n}',
+        expected: { model: { names: ['a,', 'b'] } }
+      }
+    ])('$name flow map', ({ text, expected }) => {
+      const source = `${text}${finalNewline ? '\n' : ''}`.replaceAll('\n', eol)
+      expectInsertion(source, { ...expected, plugins: { enabled: ['orca-status'] } }, eol)
+    })
+  })
+})
+
+describe.each(['\n', '\r\n'])('Hermes flow insertion with tab separation (%j)', (eol) => {
+  it.each(pluginEntries.slice(0, 3))('$name map after a tab', ({ text, expected }) => {
+    const source = `plugins: {${text}\t}`.replaceAll('\n', eol)
+    expectInsertion(source, { plugins: { ...expected, enabled: ['orca-status'] } }, eol)
+  })
+
+  it.each([
+    {
+      name: 'minimal tab',
+      source: 'plugins: {custom: keep # note\n\t}',
+      padding: '\n '
+    },
+    {
+      name: 'deeper escaped quoted key',
+      source: '    "plu\\u0067ins": {custom: keep # note\n    \t}',
+      padding: '\n     '
+    },
+    {
+      name: 'mixed spaces and tabs below required indentation',
+      source: '    plugins: {custom: keep # note\n    \t  \t }',
+      padding: '\n     '
+    },
+    {
+      name: 'whitespace-only closing line',
+      source: 'plugins: {custom: keep # note\n\t \t  }',
+      padding: '\n '
+    },
+    {
+      name: 'sufficient spaces before a tab',
+      source: 'plugins: {custom: keep # note\n \t}',
+      padding: ''
+    },
+    {
+      name: 'deeper sufficient spaces before mixed separation',
+      source: '    plugins: {custom: keep # note\n     \t \t}',
+      padding: ''
+    },
+    {
+      name: 'root flow with zero required indentation',
+      source: '    {plugins: {custom: keep # note\n\t}}',
+      padding: ''
+    },
+    {
+      name: 'tab after content on the same line',
+      source: 'plugins: {custom: keep\t}',
+      padding: ''
+    },
+    {
+      name: 'explicit plugins key',
+      source: '? "plugins"\n: {custom: keep # note\n\t}',
+      padding: '\n '
+    },
+    {
+      name: 'deeper split explicit key',
+      source: '    ?\n        "plugins"\n    : {custom: keep # note\n    \t}',
+      padding: '\n     '
+    }
+  ])('preserves source around $name', ({ source: input, padding }) => {
+    const source = input.replaceAll('\n', eol)
+    const output = expectInsertion(
+      source,
+      { plugins: { custom: 'keep', enabled: ['orca-status'] } },
+      eol
+    )
+    const insertion = `${padding}, enabled: [ orca-status ]`.replaceAll('\n', eol)
+    expect(output).toBe(source.replace('}', `${insertion}}`))
+  })
+
+  it('rejects an unrelated value change after repairing tab-separated insertion', () => {
+    const source = 'model: "001"\nplugins: {custom: keep # note\n\t}'.replaceAll('\n', eol)
+    expect(
+      updateConfigContent(source, (config) => ({ ...enablePlugin(config), model: 'changed' }))
+    ).toEqual({
+      content: null,
+      detail: 'Hermes plugin update would change unrelated configuration'
+    })
+  })
+})
diff --git a/src/main/hermes/hermes-config-preservation.test.ts b/src/main/hermes/hermes-config-preservation.test.ts
new file mode 100644
index 00000000000..9756f7a3230
--- /dev/null
+++ b/src/main/hermes/hermes-config-preservation.test.ts
@@ -0,0 +1,202 @@
+import {
+  chmodSync,
+  existsSync,
+  linkSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  utimesSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { parse } from 'yaml'
+import { HermesHookService } from './hook-service'
+
+const configured =
+  '# Operator comments\r\nmodel: "fixture"\r\nplugins:\r\n  enabled: [orca-status]\r\n'
+const initial =
+  '# Recovery notes\nmodel: "001"\nprompt: |\n  First\n  Second\nplugins:\n  enabled: [other] # choices\n'
+
+describe('Hermes config preservation on disk', () => {
+  let directory: string
+  let configPath: string
+  const service = new HermesHookService()
+
+  beforeEach(() => {
+    directory = mkdtempSync(join(tmpdir(), 'orca-hermes-config-'))
+    configPath = join(directory, 'config.yaml')
+    vi.stubEnv('HERMES_HOME', directory)
+  })
+
+  afterEach(() => {
+    vi.unstubAllEnvs()
+    rmSync(directory, { recursive: true, force: true })
+  })
+
+  it('leaves unchanged bytes, inode, timestamp, mode and backup untouched', () => {
+    writeFileSync(configPath, configured, { mode: 0o600 })
+    writeFileSync(`${configPath}.bak`, 'previous recovery point', { mode: 0o600 })
+    utimesSync(configPath, 1_600_000_000, 1_600_000_000)
+    const before = statSync(configPath)
+    const backup = statSync(`${configPath}.bak`)
+    expect(service.install().state).toBe('installed')
+    expect(readFileSync(configPath, 'utf8')).toBe(configured)
+    const after = statSync(configPath)
+    expect([after.ino, after.mtimeMs, after.mode]).toEqual([
+      before.ino,
+      before.mtimeMs,
+      before.mode
+    ])
+    expect(statSync(`${configPath}.bak`)).toEqual(backup)
+    expect(readFileSync(`${configPath}.bak`, 'utf8')).toBe('previous recovery point')
+  })
+
+  it('does not create a backup on a no-op', () => {
+    writeFileSync(configPath, configured)
+    service.install()
+    expect(existsSync(`${configPath}.bak`)).toBe(false)
+  })
+
+  it('does not create a config when removing an absent integration', () => {
+    expect(service.remove().state).toBe('not_installed')
+    expect(readdirSync(directory)).toEqual([])
+  })
+
+  it('preserves comments and multiline values through real install and removal', () => {
+    writeFileSync(configPath, initial)
+    expect(service.install().state).toBe('installed')
+    const installed = readFileSync(configPath, 'utf8')
+    expect(parse(installed).plugins.enabled).toEqual(['other', 'orca-status'])
+    expect(readFileSync(`${configPath}.bak`, 'utf8')).toBe(initial)
+    expect(service.remove().state).toBe('not_installed')
+    const removed = readFileSync(configPath, 'utf8')
+    for (const output of [installed, removed]) {
+      expect(output).toContain('# Recovery notes')
+      expect(output).toContain('# choices')
+      expect(output).toContain('model: "001"')
+      expect(output).toContain('prompt: |\n  First\n  Second\n')
+    }
+    expect(parse(removed)).toEqual(parse(initial))
+    expect(readFileSync(`${configPath}.bak`, 'utf8')).toBe(installed)
+  })
+
+  it.skipIf(process.platform === 'win32').each([
+    [0o600, 0o022],
+    [0o600, 0],
+    [0o640, 0o077],
+    [0o640, 0]
+  ])('preserves mode %i with umask %i and a byte-exact backup', (mode, mask) => {
+    writeFileSync(configPath, initial)
+    chmodSync(configPath, mode)
+    const previous = process.umask(mask)
+    try {
+      expect(service.install().state).toBe('installed')
+    } finally {
+      process.umask(previous)
+    }
+    expect(statSync(configPath).mode & 0o777).toBe(mode)
+    expect(statSync(`${configPath}.bak`).mode & 0o777).toBe(mode)
+    expect(readFileSync(`${configPath}.bak`, 'utf8')).toBe(initial)
+    expect(readdirSync(directory).sort()).toEqual(['config.yaml', 'config.yaml.bak', 'plugins'])
+  })
+
+  it.skipIf(process.platform === 'win32')(
+    'creates a private new config with permissive umask',
+    () => {
+      const previous = process.umask(0)
+      try {
+        expect(service.install().state).toBe('installed')
+      } finally {
+        process.umask(previous)
+      }
+      expect(statSync(configPath).mode & 0o777).toBe(0o600)
+      expect(existsSync(`${configPath}.bak`)).toBe(false)
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')('keeps the config symlink and updates its target', () => {
+    const target = join(directory, 'dotfiles.yaml')
+    writeFileSync(target, initial, { mode: 0o600 })
+    symlinkSync(target, configPath)
+    expect(service.install().state).toBe('installed')
+    expect(lstatSync(configPath).isSymbolicLink()).toBe(true)
+    expect(parse(readFileSync(target, 'utf8')).plugins.enabled).toContain('orca-status')
+    expect(readFileSync(`${target}.bak`, 'utf8')).toBe(initial)
+  })
+
+  it.skipIf(process.platform === 'win32')('refuses a dangling config symlink', () => {
+    symlinkSync(join(directory, 'missing.yaml'), configPath)
+    expect(() => service.install()).toThrow()
+    expect(lstatSync(configPath).isSymbolicLink()).toBe(true)
+    expect(readdirSync(directory)).toEqual(['config.yaml'])
+  })
+
+  it.skipIf(process.platform === 'win32')(
+    'refuses a symlinked backup without touching its target',
+    () => {
+      writeFileSync(configPath, initial)
+      const target = join(directory, 'unrelated')
+      writeFileSync(target, 'preserve me')
+      symlinkSync(target, `${configPath}.bak`)
+      expect(() => service.install()).toThrow('Refusing to overwrite symlinked backup')
+      expect(readFileSync(configPath, 'utf8')).toBe(initial)
+      expect(readFileSync(target, 'utf8')).toBe('preserve me')
+      expect(readdirSync(directory).some((name) => name.endsWith('.tmp'))).toBe(false)
+    }
+  )
+
+  it('replaces a hard-linked backup without changing the unrelated inode', () => {
+    writeFileSync(configPath, initial)
+    const target = join(directory, 'unrelated')
+    writeFileSync(target, 'preserve me')
+    linkSync(target, `${configPath}.bak`)
+    expect(service.install().state).toBe('installed')
+    expect(readFileSync(target, 'utf8')).toBe('preserve me')
+    expect(readFileSync(`${configPath}.bak`, 'utf8')).toBe(initial)
+  })
+
+  it('keeps the config and cleans temporary files when backup publication fails', () => {
+    writeFileSync(configPath, initial)
+    mkdirSync(`${configPath}.bak`)
+    expect(() => service.install()).toThrow()
+    expect(readFileSync(configPath, 'utf8')).toBe(initial)
+    expect(readdirSync(directory).some((name) => name.endsWith('.tmp'))).toBe(false)
+  })
+
+  it('keeps installed plugin files if removal cannot back up the config', () => {
+    expect(service.install().state).toBe('installed')
+    const before = readFileSync(configPath, 'utf8')
+    mkdirSync(`${configPath}.bak`)
+    expect(() => service.remove()).toThrow()
+    expect(readFileSync(configPath, 'utf8')).toBe(before)
+    expect(existsSync(join(directory, 'plugins', 'orca-status', '__init__.py'))).toBe(true)
+    expect(readdirSync(directory).some((name) => name.endsWith('.tmp'))).toBe(false)
+  })
+
+  it('refuses alias-bearing removal before deleting installed plugin files', () => {
+    expect(service.install().state).toBe('installed')
+    const input = 'plugins:\n  enabled: &enabled [orca-status, other]\ncopy: *enabled\n'
+    writeFileSync(configPath, input)
+    expect(service.remove().state).toBe('error')
+    expect(readFileSync(configPath, 'utf8')).toBe(input)
+    expect(existsSync(join(directory, 'plugins', 'orca-status', '__init__.py'))).toBe(true)
+    expect(existsSync(`${configPath}.bak`)).toBe(false)
+  })
+
+  it.each(['plugins: [', 'plugins: unexpected\n', 'plugins:\n  enabled: not-a-list\n'])(
+    'does not install files or rewrite unexpected YAML (%s)',
+    (input) => {
+      writeFileSync(configPath, input)
+      expect(service.install().state).toBe('error')
+      expect(readFileSync(configPath, 'utf8')).toBe(input)
+      expect(readdirSync(directory)).toEqual(['config.yaml'])
+    }
+  )
+})
diff --git a/src/main/hermes/hermes-config-remote-adapter.test.ts b/src/main/hermes/hermes-config-remote-adapter.test.ts
new file mode 100644
index 00000000000..3005d9ef9dd
--- /dev/null
+++ b/src/main/hermes/hermes-config-remote-adapter.test.ts
@@ -0,0 +1,118 @@
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { createManagedHookLocalFilesystem } from '../agent-hooks/managed-hook-local-filesystem'
+import { HermesHookService } from './hook-service'
+
+describe('Hermes remote installer through a local filesystem adapter (no SSH)', () => {
+  let directory: string
+  let configPath: string
+  const service = new HermesHookService()
+
+  beforeEach(() => {
+    directory = mkdtempSync(join(tmpdir(), 'orca-hermes-remote-adapter-'))
+    mkdirSync(join(directory, '.hermes'))
+    configPath = join(directory, '.hermes', 'config.yaml')
+  })
+  afterEach(() => rmSync(directory, { recursive: true, force: true }))
+
+  it('does not rewrite a configured CRLF file or an existing backup', async () => {
+    const initial = '# operator notes\r\nplugins:\r\n  enabled: [zeta, orca-status, alpha]\r\n'
+    writeFileSync(configPath, initial)
+    writeFileSync(`${configPath}.bak`, 'recovery point')
+    const before = statSync(configPath)
+    expect((await service.installRemote(createManagedHookLocalFilesystem(), directory)).state).toBe(
+      'installed'
+    )
+    expect(readFileSync(configPath, 'utf8')).toBe(initial)
+    const after = statSync(configPath)
+    expect([after.ino, after.mtimeMs, after.mode]).toEqual([
+      before.ino,
+      before.mtimeMs,
+      before.mode
+    ])
+    expect(readFileSync(`${configPath}.bak`, 'utf8')).toBe('recovery point')
+  })
+
+  it.each(['\n', '\r\n'])(
+    'preserves comments and parsed values during real install (%j)',
+    async (eol) => {
+      const input =
+        '# notes\nmodel: "001"\nprompt: |\n  First\n  Second\nplugins:\n  enabled: [other]\n'.replaceAll(
+          '\n',
+          eol
+        )
+      writeFileSync(configPath, input)
+      const filesystem = createManagedHookLocalFilesystem()
+      expect((await service.installRemote(filesystem, directory)).state).toBe('installed')
+      const installed = readFileSync(configPath, 'utf8')
+      expect(installed).toContain('# notes')
+      expect(installed).toContain(`prompt: |${eol}  First${eol}  Second`)
+      expect(parse(installed)).toEqual({
+        ...parse(input),
+        plugins: { enabled: ['other', 'orca-status'] }
+      })
+      const before = statSync(configPath)
+      expect((await service.installRemote(filesystem, directory)).state).toBe('installed')
+      expect(statSync(configPath).ino).toBe(before.ino)
+      expect(existsSync(`${configPath}.bak`)).toBe(false)
+    }
+  )
+
+  it.skipIf(process.platform === 'win32').each([0o600, 0o640])(
+    'preserves mode %i despite umask',
+    async (mode) => {
+      writeFileSync(configPath, 'model: fixture\n')
+      chmodSync(configPath, mode)
+      const previous = process.umask(0o077)
+      try {
+        expect(
+          (await service.installRemote(createManagedHookLocalFilesystem(), directory)).state
+        ).toBe('installed')
+      } finally {
+        process.umask(previous)
+      }
+      expect(statSync(configPath).mode & 0o777).toBe(mode)
+    }
+  )
+
+  it.each(['plugins: [', 'plugins: unexpected\n', 'plugins:\n  enabled: [123]\n'])(
+    'refuses unsafe YAML before writing plugin files (%s)',
+    async (input) => {
+      writeFileSync(configPath, input)
+      expect(
+        (await service.installRemote(createManagedHookLocalFilesystem(), directory)).state
+      ).toBe('error')
+      expect(readFileSync(configPath, 'utf8')).toBe(input)
+      expect(readdirSync(join(directory, '.hermes'))).toEqual(['config.yaml'])
+    }
+  )
+
+  it('keeps the config and cleans staged files when remote rename fails', async () => {
+    writeFileSync(configPath, 'model: fixture\n')
+    const filesystem = createManagedHookLocalFilesystem()
+    const rename = filesystem.ext_openssh_rename.bind(filesystem)
+    filesystem.ext_openssh_rename = (source, destination, callback) => {
+      if (destination === configPath) {
+        callback(new Error('fixture rename refusal'))
+      } else {
+        rename(source, destination, callback)
+      }
+    }
+    expect((await service.installRemote(filesystem, directory)).state).toBe('error')
+    expect(readFileSync(configPath, 'utf8')).toBe('model: fixture\n')
+    expect(readdirSync(join(directory, '.hermes')).sort()).toEqual(['config.yaml', 'plugins'])
+  })
+})
diff --git a/src/main/hermes/hermes-config-source-edits.test.ts b/src/main/hermes/hermes-config-source-edits.test.ts
new file mode 100644
index 00000000000..01bc0a06f27
--- /dev/null
+++ b/src/main/hermes/hermes-config-source-edits.test.ts
@@ -0,0 +1,123 @@
+import { describe, expect, it } from 'vitest'
+import { parseDocument } from 'yaml'
+import { disablePlugin, enablePlugin, updateConfigContent } from './hermes-config-yaml'
+
+describe.each(['\n', '\r\n'])('Hermes source edit boundaries (%j)', (eol) => {
+  describe.each([
+    {
+      operation: 'remove',
+      key: 'enabled',
+      updater: disablePlugin,
+      expected: { enabled: [] }
+    },
+    {
+      operation: 'install',
+      key: 'disabled',
+      updater: enablePlugin,
+      expected: { disabled: [], enabled: ['orca-status'] }
+    }
+  ])('$operation with an emptied block list', ({ key, updater, expected }) => {
+    it('replaces a minimal indentless list without a final newline', () => {
+      const input = `plugins:${eol}  ${key}:${eol}  - orca-status`
+      const result = updateConfigContent(input, updater)
+      expect(result.detail).toBeUndefined()
+      const document = parseDocument(result.content ?? '')
+      expect(document.errors).toEqual([])
+      expect(document.warnings).toEqual([])
+      expect(document.toJS()).toEqual({ plugins: expected })
+    })
+
+    it.each([
+      ['indentless', '  ', '  '],
+      ['deeper indentless', '    ', '    '],
+      ['indented', '  ', '    ']
+    ])('preserves comments and unrelated settings (%s)', (_name, keyIndent, listIndent) => {
+      const prefix = [
+        'model:    "001" # untouched spacing',
+        'plugins:',
+        `${keyIndent}"${key}": # list note`,
+        `${listIndent}# first choice`,
+        ''
+      ].join(eol)
+      const custom = `${keyIndent}custom: 'off' # plugin setting${eol}`
+      const suffix = ['prompt: |-', '  First', '  Second', ''].join(eol)
+      const input = `${prefix}${listIndent}- orca-status # managed choice${eol}${custom}${suffix}`
+      const result = updateConfigContent(input, updater)
+      expect(result.detail).toBeUndefined()
+      const output = result.content ?? ''
+      const document = parseDocument(output)
+      expect(document.errors).toEqual([])
+      expect(document.warnings).toEqual([])
+      expect(document.toJS()).toEqual({
+        model: '001',
+        plugins: { ...expected, custom: 'off' },
+        prompt: 'First\nSecond'
+      })
+      expect(output.startsWith(prefix)).toBe(true)
+      expect(output).toContain(custom)
+      expect(output.endsWith(suffix)).toBe(true)
+      expect(output.match(/# managed choice/g)).toHaveLength(1)
+      if (eol === '\r\n') {
+        expect(output.replaceAll(eol, '')).not.toContain('\n')
+      }
+    })
+  })
+
+  it.each([
+    {
+      name: 'plugin trailing comma before a comment',
+      input: 'plugins: {custom: keep, # retain this comment\n  }\n',
+      expected: { plugins: { custom: 'keep', enabled: ['orca-status'] } }
+    },
+    {
+      name: 'root trailing comma before a comment',
+      input: '{model: "001", # retain this comment\n}\n',
+      expected: { model: '001', plugins: { enabled: ['orca-status'] } }
+    },
+    {
+      name: 'plugin trailing comma before several comments',
+      input: 'plugins: {custom: "keep # ,", # first\n  # last\n  } # outside\n',
+      expected: { plugins: { custom: 'keep # ,', enabled: ['orca-status'] } }
+    },
+    {
+      name: 'root trailing comma after a nested map',
+      input: '{model: {name: "001",}, # first\n # last\n}\n',
+      expected: { model: { name: '001' }, plugins: { enabled: ['orca-status'] } }
+    },
+    {
+      name: 'plugin comment ending in a comma without a separator',
+      input: 'plugins: {custom: keep # this comma is only a comment ,\n  }\n',
+      expected: { plugins: { custom: 'keep', enabled: ['orca-status'] } }
+    },
+    {
+      name: 'root comment ending in a comma without a separator',
+      input: '{model: "001" # this comma is only a comment ,\n}\n',
+      expected: { model: '001', plugins: { enabled: ['orca-status'] } }
+    },
+    {
+      name: 'earlier plugin separator without a trailing comma',
+      input: 'plugins: {custom: keep, extra: "off" # last value\n  }\n',
+      expected: { plugins: { custom: 'keep', extra: 'off', enabled: ['orca-status'] } }
+    },
+    {
+      name: 'nested sequence comma without a mapping separator',
+      input: 'plugins: {custom: [one, two,] # nested comma only\n  }\n',
+      expected: { plugins: { custom: ['one', 'two'], enabled: ['orca-status'] } }
+    }
+  ])('inserts entries with $name', ({ input, expected }) => {
+    const source = input.replaceAll('\n', eol)
+    const result = updateConfigContent(source, enablePlugin)
+    expect(result.detail).toBeUndefined()
+    const output = result.content ?? ''
+    const document = parseDocument(output)
+    expect(document.errors).toEqual([])
+    expect(document.warnings).toEqual([])
+    expect(document.toJS()).toEqual(expected)
+    const closingBrace = source.lastIndexOf('}')
+    expect(output.startsWith(source.slice(0, closingBrace))).toBe(true)
+    expect(output.endsWith(source.slice(closingBrace))).toBe(true)
+    if (eol === '\r\n') {
+      expect(output.replaceAll(eol, '')).not.toContain('\n')
+    }
+  })
+})
diff --git a/src/main/hermes/hermes-config-source-edits.ts b/src/main/hermes/hermes-config-source-edits.ts
new file mode 100644
index 00000000000..17b770e8abd
--- /dev/null
+++ b/src/main/hermes/hermes-config-source-edits.ts
@@ -0,0 +1,158 @@
+import { isDeepStrictEqual } from 'node:util'
+import { Document, isMap, isNode, isSeq, parseDocument } from 'yaml'
+import type { Node, YAMLMap, YAMLSeq } from 'yaml'
+
+type SourceEdit = { start: number; end: number; text: string }
+
+function columnAt(source: string, offset: number): number {
+  return offset - source.lastIndexOf('\n', offset - 1) - 1
+}
+
+function indentFragment(fragment: string, difference: number): string {
+  return fragment.replace(
+    /\n( *)(?=\S)/g,
+    (_match, spaces: string) => `\n${' '.repeat(Math.max(0, spaces.length + difference))}`
+  )
+}
+
+function requireRange(node: unknown): [number, number, number] {
+  if (!isNode(node) || !node.range) {
+    throw new Error('Missing Hermes YAML source range')
+  }
+  return node.range
+}
+
+function insertPair(
+  source: string,
+  printed: string,
+  parent: YAMLMap,
+  updated: YAMLMap,
+  key: string,
+  enclosing: YAMLMap = parent
+): SourceEdit {
+  const pair = updated.items.find((item) => isNode(item.key) && item.key.toJSON() === key)
+  if (!pair) {
+    throw new Error(`Missing Hermes YAML key: ${key}`)
+  }
+  const keyRange = requireRange(pair.key)
+  const valueRange = requireRange(pair.value)
+  const parentRange = requireRange(parent)
+  if (parent.flow) {
+    const position = parentRange[1] - 1
+    if (source[position] !== '}') {
+      throw new Error('Unexpected Hermes flow mapping boundary')
+    }
+    const tail =
+      parent.srcToken?.type === 'flow-collection' ? parent.srcToken.items.at(-1) : undefined
+    const trailingComma =
+      tail?.key === undefined &&
+      tail?.sep === undefined &&
+      tail?.value === undefined &&
+      tail?.start.some((token) => token.type === 'comma')
+    const separator = parent.items.length > 0 && !trailingComma ? ', ' : ' '
+    // A flow closing brace may be outdented farther than an inserted entry or comma.
+    const minimumColumn = enclosing.flow ? 0 : columnAt(source, requireRange(enclosing)[0]) + 1
+    const column = columnAt(source, position)
+    const linePrefix = source.slice(position - column, position)
+    const spacesBeforeTab = /^( *)\t[ \t]*$/.exec(linePrefix)?.[1]?.length
+    // Tabs are separation, so insufficient leading spaces require a fresh indented line.
+    const padding =
+      spacesBeforeTab !== undefined && spacesBeforeTab < minimumColumn
+        ? `\n${' '.repeat(minimumColumn)}`
+        : ' '.repeat(Math.max(0, minimumColumn - column))
+    return {
+      start: position,
+      end: position,
+      text: padding + separator + printed.slice(keyRange[0], valueRange[1])
+    }
+  }
+  const column = columnAt(source, parentRange[0])
+  const fragment = printed.slice(keyRange[0], valueRange[2])
+  const prefix = parentRange[1] > 0 && source[parentRange[1] - 1] !== '\n' ? '\n' : ''
+  const text = `${prefix}${' '.repeat(column)}${indentFragment(fragment, column - columnAt(printed, keyRange[0]))}`
+  return {
+    start: parentRange[1],
+    end: parentRange[1],
+    text: text.endsWith('\n') ? text : `${text}\n`
+  }
+}
+
+export function applyHermesPluginSourceEdits(source: string, document: Document): string {
+  const printed = document.toString({ lineWidth: 0 })
+  const original = parseDocument(source, { keepSourceTokens: true })
+  const updated = parseDocument(printed)
+  if (!isMap(original.contents)) {
+    return source.includes('\r\n') ? printed.replaceAll('\n', '\r\n') : printed
+  }
+  if (!isMap(updated.contents)) {
+    throw new Error('Missing updated Hermes mapping')
+  }
+  const plugins = original.get('plugins', true)
+  const updatedPlugins = updated.get('plugins', true)
+  if (!isMap(updatedPlugins)) {
+    throw new Error('Missing updated Hermes plugins')
+  }
+  const edits: SourceEdit[] = []
+  if (plugins === undefined) {
+    edits.push(insertPair(source, printed, original.contents, updated.contents, 'plugins'))
+  } else {
+    if (!isMap(plugins)) {
+      throw new Error('Unexpected Hermes plugins mapping')
+    }
+    for (const key of ['enabled', 'disabled']) {
+      const previous = plugins.get(key, true)
+      const next = updatedPlugins.get(key, true)
+      if (!isNode(next)) {
+        continue
+      }
+      if (previous === undefined) {
+        edits.push(insertPair(source, printed, plugins, updatedPlugins, key, original.contents))
+      } else if (isNode(previous) && !isDeepStrictEqual(previous.toJSON(), next.toJSON())) {
+        const edited = document.createNode(document.getIn(['plugins', key], true))
+        if (!isSeq(edited)) {
+          throw new Error('Missing edited Hermes plugin list')
+        }
+        edits.push(replaceNode(source, plugins, previous, edited))
+      }
+    }
+  }
+  const newline = source.includes('\r\n') ? '\r\n' : '\n'
+  let result = source
+  for (const edit of edits.sort((a, b) => b.start - a.start)) {
+    result =
+      result.slice(0, edit.start) + edit.text.replaceAll('\n', newline) + result.slice(edit.end)
+  }
+  return result
+}
+
+function replaceNode(source: string, parent: YAMLMap, previous: Node, next: YAMLSeq): SourceEdit {
+  const before = requireRange(previous)
+  // YAML ranges can include the next key's indentation after a trailing comment.
+  const trailingIndent =
+    /(?:^|\n)([ \t]+)$/.exec(source.slice(before[0], before[2]))?.[1].length ?? 0
+  const end = before[2] - trailingIndent
+  // Printing only this list keeps neighboring comments out of its replacement.
+  const isolated = new Document()
+  const sequence = next.clone()
+  if (!isSeq(sequence)) {
+    throw new Error('Missing cloned Hermes plugin list')
+  }
+  isolated.contents = sequence
+  // The original leading comment remains outside the replaced source range.
+  isolated.contents.commentBefore = undefined
+  let fragment = isolated.toString({ lineWidth: 0 })
+  if (!source.slice(before[0], end).endsWith('\n') && !next.comment) {
+    fragment = fragment.replace(/\n$/, '')
+  }
+  const column = columnAt(source, before[0])
+  // Empty flow lists cannot use a block sequence's indentless position.
+  const replacementColumn =
+    isSeq(previous) && !previous.flow && (next.flow || next.items.length === 0)
+      ? Math.max(column, columnAt(source, requireRange(parent)[0]) + 2)
+      : column
+  return {
+    start: before[0],
+    end,
+    text: ' '.repeat(replacementColumn - column) + indentFragment(fragment, replacementColumn)
+  }
+}
diff --git a/src/main/hermes/hermes-config-yaml.ts b/src/main/hermes/hermes-config-yaml.ts
index 9641359c3dd..c1fbdea9886 100644
--- a/src/main/hermes/hermes-config-yaml.ts
+++ b/src/main/hermes/hermes-config-yaml.ts
@@ -1,6 +1,8 @@
-import { parse, stringify } from 'yaml'
+import { isDeepStrictEqual } from 'node:util'
+import { parse } from 'yaml'
 
 import { HERMES_PLUGIN_NAME } from './hermes-managed-plugin-source'
+import { updateHermesPluginDocument } from './hermes-config-document'
 
 export type HermesConfig = Record<string, unknown>
 
@@ -41,16 +43,14 @@ export function parseHermesConfig(content: string | null): ConfigParseResult {
   }
 }
 
-export function serializeHermesConfig(config: HermesConfig): string {
-  return `${stringify(config, { lineWidth: 0 }).trimEnd()}\n`
-}
-
 export function enablePlugin(config: HermesConfig): HermesConfig {
   const next: HermesConfig = { ...config }
   const plugins = isRecord(next.plugins) ? { ...next.plugins } : {}
   const enabled = asStringArray(plugins.enabled) ?? []
   const disabled = asStringArray(plugins.disabled)
-  plugins.enabled = Array.from(new Set([...enabled, HERMES_PLUGIN_NAME])).sort()
+  plugins.enabled = enabled.includes(HERMES_PLUGIN_NAME)
+    ? enabled
+    : [...enabled, HERMES_PLUGIN_NAME]
   if (disabled === null) {
     // Why: Hermes treats a malformed disabled list as empty. Normalize it here
     // so Orca's install status matches what the real Hermes loader will do.
@@ -70,7 +70,7 @@ export function disablePlugin(config: HermesConfig): HermesConfig {
   }
   const plugins = { ...next.plugins }
   const enabled = asStringArray(plugins.enabled)
-  if (enabled !== null) {
+  if (enabled !== null && plugins.enabled !== undefined) {
     plugins.enabled = enabled.filter((name) => name !== HERMES_PLUGIN_NAME)
   }
   next.plugins = plugins
@@ -85,7 +85,11 @@ export function updateConfigContent(
   if (!parsed.ok) {
     return { content: null, detail: parsed.detail }
   }
-  return { content: serializeHermesConfig(updater(parsed.config)) }
+  const next = updater(parsed.config)
+  if (isDeepStrictEqual(parsed.config, next)) {
+    return { content: content ?? '' }
+  }
+  return updateHermesPluginDocument(content ?? '', next)
 }
 
 export function getConfigEnablement(config: HermesConfig): {
diff --git a/src/main/hermes/hermes-home-filesystem.ts b/src/main/hermes/hermes-home-filesystem.ts
index 7cd7a48a863..9ff322d5bfa 100644
--- a/src/main/hermes/hermes-home-filesystem.ts
+++ b/src/main/hermes/hermes-home-filesystem.ts
@@ -1,18 +1,11 @@
-import { randomUUID } from 'node:crypto'
-import {
-  copyFileSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  unlinkSync,
-  writeFileSync
-} from 'node:fs'
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { dirname, join } from 'node:path'
+import { join } from 'node:path'
 
 import type { ConfigParseResult, HermesConfig } from './hermes-config-yaml'
-import { parseHermesConfig, serializeHermesConfig } from './hermes-config-yaml'
+import { parseHermesConfig } from './hermes-config-yaml'
+import { resolveHooksJsonWritePath } from '../agent-hooks/hook-config-write-path'
+import { writeHooksJson } from '../agent-hooks/installer-utils'
 import {
   HERMES_PLUGIN_MARKER,
   HERMES_PLUGIN_NAME,
@@ -41,43 +34,19 @@ function getInitPath(pluginDir = getPluginDir()): string {
   return join(pluginDir, '__init__.py')
 }
 
-export function readConfigFile(configPath: string): ConfigParseResult {
-  if (!existsSync(configPath)) {
-    return { ok: true, config: {} }
-  }
-  return parseHermesConfig(readFileSync(configPath, 'utf-8'))
+type ConfigFileReadResult =
+  | { ok: true; config: HermesConfig; content: string }
+  | Extract<ConfigParseResult, { ok: false }>
+
+export function readConfigFile(configPath: string): ConfigFileReadResult {
+  const readPath = resolveHooksJsonWritePath(configPath)
+  const content = existsSync(readPath) ? readFileSync(readPath, 'utf-8') : ''
+  const parsed = parseHermesConfig(content)
+  return parsed.ok ? { ...parsed, content } : parsed
 }
 
-export function writeConfigFile(configPath: string, config: HermesConfig): void {
-  const dir = dirname(configPath)
-  mkdirSync(dir, { recursive: true })
-  const serialized = serializeHermesConfig(config)
-  if (existsSync(configPath)) {
-    try {
-      if (readFileSync(configPath, 'utf-8') === serialized) {
-        return
-      }
-    } catch {
-      // Fall through to the atomic write path.
-    }
-  }
-
-  const tmpPath = join(dir, `.${Date.now()}-${randomUUID()}.tmp`)
-  try {
-    writeFileSync(tmpPath, serialized, 'utf-8')
-    if (existsSync(configPath)) {
-      copyFileSync(configPath, `${configPath}.bak`)
-    }
-    renameSync(tmpPath, configPath)
-  } finally {
-    if (existsSync(tmpPath)) {
-      try {
-        unlinkSync(tmpPath)
-      } catch {
-        // best effort
-      }
-    }
-  }
+export function writeConfigFile(configPath: string, content: string): void {
+  writeHooksJson(configPath, {}, { serialized: content, preserveMode: true, defaultMode: 0o600 })
 }
 
 export function getPluginFilesState(pluginDir = getPluginDir()): {
diff --git a/src/main/hermes/hook-service.test.ts b/src/main/hermes/hook-service.test.ts
index 4180caf616e..3158b551480 100644
--- a/src/main/hermes/hook-service.test.ts
+++ b/src/main/hermes/hook-service.test.ts
@@ -74,7 +74,7 @@ describe('HermesHookService', () => {
     expect(config.plugins.disabled).toEqual([])
   })
 
-  it('normalizes malformed plugin lists during install', () => {
+  it('refuses malformed plugin lists during install', () => {
     writeFileSync(
       join(homeDir, 'config.yaml'),
       ['plugins:', '  enabled: "not-a-list"', '  disabled: "not-a-list"', ''].join('\n'),
@@ -83,12 +83,12 @@ describe('HermesHookService', () => {
 
     const status = new HermesHookService().install()
 
-    expect(status.state).toBe('installed')
+    expect(status.state).toBe('error')
     const config = parse(readFileSync(join(homeDir, 'config.yaml'), 'utf-8')) as {
       plugins: { enabled: string[]; disabled: string[] }
     }
-    expect(config.plugins.enabled).toEqual([_internals.HERMES_PLUGIN_NAME])
-    expect(config.plugins.disabled).toEqual([])
+    expect(config.plugins.enabled).toBe('not-a-list')
+    expect(config.plugins.disabled).toBe('not-a-list')
   })
 
   it('reports partial when the plugin exists but is not enabled', () => {
diff --git a/src/main/hermes/hook-service.ts b/src/main/hermes/hook-service.ts
index 6b1b141f721..6b6d6ec8873 100644
--- a/src/main/hermes/hook-service.ts
+++ b/src/main/hermes/hook-service.ts
@@ -96,8 +96,20 @@ export class HermesHookService {
       }
     }
 
+    const next = updateConfigContent(parsed.content, enablePlugin)
+    if (next.content === null) {
+      return {
+        agent: 'hermes',
+        state: 'error',
+        configPath,
+        managedHooksPresent: getPluginFilesState().managed,
+        detail: `Could not update Hermes config.yaml: ${next.detail ?? 'unknown error'}`
+      }
+    }
     writePluginFiles()
-    writeConfigFile(configPath, enablePlugin(parsed.config))
+    if (next.content !== parsed.content) {
+      writeConfigFile(configPath, next.content)
+    }
     return this.getStatus()
   }
 
@@ -150,11 +162,23 @@ export class HermesHookService {
         detail: `Could not parse Hermes config.yaml: ${parsed.detail}`
       }
     }
+    const next = updateConfigContent(parsed.content, disablePlugin)
+    if (next.content === null) {
+      return {
+        agent: 'hermes',
+        state: 'error',
+        configPath,
+        managedHooksPresent: getPluginFilesState().managed,
+        detail: `Could not update Hermes config.yaml: ${next.detail ?? 'unknown error'}`
+      }
+    }
+    if (next.content !== parsed.content) {
+      writeConfigFile(configPath, next.content)
+    }
     const pluginDir = getPluginDir()
     if (getPluginFilesState(pluginDir).managed) {
       rmSync(pluginDir, { recursive: true, force: true })
     }
-    writeConfigFile(configPath, disablePlugin(parsed.config))
     return this.getStatus()
   }
 }
diff --git a/src/main/index.ts b/src/main/index.ts
index 522e59b908f..bd02d96abcc 100644
--- a/src/main/index.ts
+++ b/src/main/index.ts
@@ -1,6 +1,7 @@
-import { app, type BrowserWindow } from 'electron'
+import { app, clipboard, dialog, type BrowserWindow } from 'electron'
 import { parseSkillShareId } from '../shared/skill-share-link'
 import { createMacAppActivationHandler } from './window/macos-app-activation'
+import { isBackgroundLaunch } from './window/foreground-activation-policy'
 import {
   focusExistingWindow as focusExistingWindowAction,
   setMainWindowOpener
@@ -13,6 +14,18 @@ import { initializeMainProcessReady } from './startup/main-process-ready'
 import { installMainProcessQuitHandlers } from './startup/main-process-quit'
 import { shouldActivateDesktopForSecondInstance } from './startup/single-instance-lock'
 import { resolveOpenedMarkdownDocuments } from './startup/os-opened-markdown-files'
+import {
+  formatProfileStateStartupFailure,
+  isDivergedProfileStateFailure,
+  profileStateStartupFailureClass
+} from './persistence/profile-state/profile-state-startup-failure'
+import { recordDurableCrashBreadcrumb } from './crash-reporting/durable-crash-breadcrumb'
+import {
+  chooseProfileStateCopy,
+  presentProfileStateStartupRecoveryDialog,
+  readProfileStateCopySavedTimes
+} from './persistence/profile-state/profile-state-startup-recovery-dialog'
+import { profileStateDesktopRecoveryArgs } from './startup/profile-state-recovery-preflight'
 
 function openMainWindow(options: { revealOnDidFinishLoad?: boolean } = {}): BrowserWindow {
   return openMainWindowController(options)
@@ -107,9 +120,55 @@ if (preflightReady) {
   registerMainProcessIpcHandlers()
   installMainProcessQuitHandlers()
   void app.whenReady().then(async () => {
-    await initializeMainProcessReady({
-      openMainWindow,
-      handleMacAppActivation
-    })
+    try {
+      await initializeMainProcessReady({
+        openMainWindow,
+        handleMacAppActivation
+      })
+    } catch (error) {
+      const message =
+        formatProfileStateStartupFailure(error) ??
+        `Orca could not finish starting: ${error instanceof Error ? error.message : String(error)}`
+      const failureClass = profileStateStartupFailureClass(error)
+      if (failureClass !== undefined) {
+        recordDurableCrashBreadcrumb('profile_state_startup_failed', {
+          failure_class: failureClass
+        })
+      }
+      console.error(`[profile-state] ${message}`)
+      if (!state.isServeMode && !isBackgroundLaunch()) {
+        try {
+          if (isDivergedProfileStateFailure(error)) {
+            const userDataPath = app.getPath('userData')
+            const choice = await chooseProfileStateCopy({
+              ...readProfileStateCopySavedTimes(userDataPath),
+              showMessageBox: (options) => dialog.showMessageBox(options)
+            })
+            if (choice !== undefined) {
+              // Recovery needs both profile locks, which only a fresh process can own safely.
+              app.relaunch({
+                args: profileStateDesktopRecoveryArgs(process.argv, {
+                  userDataPath,
+                  selector: { kind: choice }
+                })
+              })
+            }
+            app.exit(1)
+            return
+          }
+          await presentProfileStateStartupRecoveryDialog({
+            message,
+            ...(failureClass === 'recovery-required' || failureClass === 'ambiguous-authority'
+              ? { recoveryCommand: 'orca profile state exports' }
+              : {}),
+            showMessageBox: (options) => dialog.showMessageBox(options),
+            copyToClipboard: (text) => clipboard.writeText(text)
+          })
+        } catch (dialogError) {
+          console.warn('[profile-state] Recovery dialog failed; exiting safely:', dialogError)
+        }
+      }
+      app.exit(1)
+    }
   })
 }
diff --git a/src/main/ipc/agent-trust.ts b/src/main/ipc/agent-trust.ts
deleted file mode 100644
index 34f39570ccb..00000000000
--- a/src/main/ipc/agent-trust.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-import { ipcMain } from 'electron'
-import {
-  type AgentTrustPreset,
-  markAntigravityWorkspaceTrusted,
-  markCodexProjectTrusted,
-  markCopilotFolderTrusted,
-  markCursorWorkspaceTrusted
-} from '../agent-trust-presets'
-import { markRemoteAgentWorkspaceTrusted } from '../remote-agent-trust-presets'
-
-/**
- * Why: cursor-agent, GitHub Copilot CLI, and Codex gate first-launch in an
- * unfamiliar directory behind a "Do you trust this folder?" menu that consumes
- * keystrokes (numbered options / single-letter shortcuts). Orca's draft-URL
- * paste flow needs the input box, not the menu, so before Orca spawns the
- * agent it asks main to write the same trust artifacts the agents write
- * after the user accepts. Best-effort: any IO error is swallowed so a failed
- * trust write never blocks the workspace from opening.
- */
-export function registerAgentTrustHandlers(): void {
-  ipcMain.removeHandler('agentTrust:markTrusted')
-  ipcMain.handle(
-    'agentTrust:markTrusted',
-    async (
-      _event,
-      args: { preset: AgentTrustPreset; workspacePath: string; connectionId?: string }
-    ): Promise<void> => {
-      if (!args || typeof args.workspacePath !== 'string' || !args.workspacePath) {
-        return
-      }
-      try {
-        const connectionId = typeof args.connectionId === 'string' ? args.connectionId.trim() : ''
-        if (connectionId) {
-          // Why: SSH-launched agents read trust artifacts from the remote
-          // user's home, not from this desktop process.
-          await markRemoteAgentWorkspaceTrusted({
-            preset: args.preset,
-            connectionId,
-            workspacePath: args.workspacePath
-          })
-        } else if (args.preset === 'cursor') {
-          markCursorWorkspaceTrusted(args.workspacePath)
-        } else if (args.preset === 'copilot') {
-          markCopilotFolderTrusted(args.workspacePath)
-        } else if (args.preset === 'codex') {
-          markCodexProjectTrusted(args.workspacePath)
-        } else if (args.preset === 'antigravity') {
-          markAntigravityWorkspaceTrusted(args.workspacePath)
-        }
-      } catch {
-        // Best-effort: see Why above. The user can still accept the trust
-        // prompt manually if writing the artifact fails.
-      }
-    }
-  )
-}
diff --git a/src/main/ipc/ai-vault-scan-coalescing.test.ts b/src/main/ipc/ai-vault-scan-coalescing.test.ts
index 8a8ad0a3665..0efbea4d1ee 100644
--- a/src/main/ipc/ai-vault-scan-coalescing.test.ts
+++ b/src/main/ipc/ai-vault-scan-coalescing.test.ts
@@ -1,3 +1,4 @@
+import { EventEmitter } from 'node:events'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { AiVaultListResult } from '../../shared/ai-vault-types'
 import type { IFilesystemProvider } from '../providers/types'
@@ -121,37 +122,44 @@ describe('Agent Session History scan coalescing', () => {
     await expect(second).resolves.toMatchObject({ sessions: [], issues: [] })
   })
 
-  it('keeps a shared multi-window scan alive when one window cancels', async () => {
-    let resolveRelay: ((result: AiVaultListResult) => void) | undefined
-    mocks.requestActiveSshAiVaultSessionList.mockImplementation(
-      () =>
-        new Promise((resolve) => {
-          resolveRelay = resolve
-        })
-    )
-    registerAiVaultHandlers()
-    const list = ipcHandler('aiVault:listSessions')
-    const cancel = ipcHandler('aiVault:cancelListSessions')
-    const firstEvent = { sender: { id: 1 } }
-    const secondEvent = { sender: { id: 2 } }
-    const first = list(firstEvent, {
-      executionHostScope: 'ssh:dev-box',
-      requestToken: 'scan'
-    }) as Promise<AiVaultListResult>
-    const second = list(secondEvent, {
-      executionHostScope: 'ssh:dev-box',
-      requestToken: 'scan'
-    }) as Promise<AiVaultListResult>
-    await vi.waitFor(() => expect(resolveRelay).toBeDefined())
+  it.each(['cancel', 'destroyed', 'render-process-gone', 'did-navigate'])(
+    'keeps a shared multi-window scan alive when one window emits %s',
+    async (eventName) => {
+      let resolveRelay: ((result: AiVaultListResult) => void) | undefined
+      mocks.requestActiveSshAiVaultSessionList.mockImplementation(
+        () =>
+          new Promise((resolve) => {
+            resolveRelay = resolve
+          })
+      )
+      registerAiVaultHandlers()
+      const list = ipcHandler('aiVault:listSessions')
+      const cancel = ipcHandler('aiVault:cancelListSessions')
+      const firstEvent = { sender: Object.assign(new EventEmitter(), { id: 1 }) }
+      const secondEvent = { sender: Object.assign(new EventEmitter(), { id: 2 }) }
+      const first = list(firstEvent, {
+        executionHostScope: 'ssh:dev-box',
+        requestToken: 'scan'
+      }) as Promise<AiVaultListResult>
+      const second = list(secondEvent, {
+        executionHostScope: 'ssh:dev-box',
+        requestToken: 'scan'
+      }) as Promise<AiVaultListResult>
+      await vi.waitFor(() => expect(resolveRelay).toBeDefined())
 
-    cancel(firstEvent, { requestToken: 'scan' })
+      if (eventName === 'cancel') {
+        cancel(firstEvent, { requestToken: 'scan' })
+      } else {
+        firstEvent.sender.emit(eventName)
+      }
 
-    // Electron logs every rejected handler, so a cancelled scan resolves instead.
-    await expect(first).resolves.toMatchObject({ cancelled: true, sessions: [], issues: [] })
-    expect(mocks.requestActiveSshAiVaultSessionList).toHaveBeenCalledTimes(1)
-    resolveRelay?.(EMPTY_RESULT)
-    await expect(second).resolves.toEqual(EMPTY_RESULT)
-  })
+      // Electron logs every rejected handler, so a cancelled scan resolves instead.
+      await expect(first).resolves.toMatchObject({ cancelled: true, sessions: [], issues: [] })
+      expect(mocks.requestActiveSshAiVaultSessionList).toHaveBeenCalledTimes(1)
+      resolveRelay?.(EMPTY_RESULT)
+      await expect(second).resolves.toEqual(EMPTY_RESULT)
+    }
+  )
 
   it('reports a real scan failure as a host issue rather than cancellation', async () => {
     mocks.requestActiveSshAiVaultSessionList.mockRejectedValue(new Error('relay socket closed'))
@@ -162,7 +170,7 @@ describe('Agent Session History scan coalescing', () => {
     // SSH host legs convert unexpected throws into scan issues so an `all`
     // multi-host list still returns the other hosts' sessions.
     const result = await list(
-      { sender: { id: 1 } },
+      { sender: Object.assign(new EventEmitter(), { id: 1 }) },
       { executionHostScope: 'ssh:dev-box', requestToken: 'scan' }
     )
     expect(result).toMatchObject({
@@ -180,7 +188,7 @@ describe('Agent Session History scan coalescing', () => {
     // The local leg degrades like the SSH legs above: a rejection reaches the
     // renderer as a raw string painted over the list instead of an issue row.
     const result = await list(
-      { sender: { id: 1 } },
+      { sender: Object.assign(new EventEmitter(), { id: 1 }) },
       { executionHostScope: 'local', requestToken: 'scan' }
     )
     expect(result).toMatchObject({
@@ -190,6 +198,68 @@ describe('Agent Session History scan coalescing', () => {
     expect(result).not.toHaveProperty('cancelled')
   })
 
+  it('aborts local and SSH all-host legs only after the last renderer leaves', async () => {
+    const scanSignals: AbortSignal[] = []
+    const waitForAbort = (signal: AbortSignal): Promise<AiVaultListResult> => {
+      scanSignals.push(signal)
+      return new Promise((resolve) => {
+        signal.addEventListener('abort', () => resolve(EMPTY_RESULT), { once: true })
+      })
+    }
+    mocks.scanAiVaultSessionsInWorker.mockImplementation((_args, signal: AbortSignal) =>
+      waitForAbort(signal)
+    )
+    mocks.requestActiveSshAiVaultSessionList.mockImplementation(
+      (_targetId, _params, options: { signal: AbortSignal }) => waitForAbort(options.signal)
+    )
+    let resolveRuntime: ((result: AiVaultListResult) => void) | undefined
+    mocks.scanRuntimeAiVaultSessions.mockImplementation(
+      () =>
+        new Promise((resolve) => {
+          resolveRuntime = resolve
+        })
+    )
+    registerRuntimeHost()
+    const list = ipcHandler('aiVault:listSessions')
+    const firstEvent = { sender: Object.assign(new EventEmitter(), { id: 1 }) }
+    const secondEvent = { sender: Object.assign(new EventEmitter(), { id: 2 }) }
+    const first = list(firstEvent, { executionHostScope: 'all', requestToken: 'scan' })
+    const second = list(secondEvent, { executionHostScope: 'all', requestToken: 'scan' })
+    await vi.waitFor(() => expect(scanSignals).toHaveLength(2))
+    await vi.waitFor(() => expect(resolveRuntime).toBeDefined())
+
+    firstEvent.sender.emit('did-navigate')
+    await expect(first).resolves.toMatchObject({ cancelled: true })
+    expect(scanSignals.every((signal) => !signal.aborted)).toBe(true)
+    secondEvent.sender.emit('render-process-gone')
+    await expect(second).resolves.toMatchObject({ cancelled: true })
+    expect(scanSignals.every((signal) => signal.aborted)).toBe(true)
+    for (const event of [firstEvent, secondEvent]) {
+      expect(event.sender.eventNames()).toEqual([])
+    }
+    // Runtime RPC cannot be canceled; its late result remains safely observed.
+    resolveRuntime?.(EMPTY_RESULT)
+  })
+
+  it('does not start an abandoned scan after ownership initialization completes', async () => {
+    let finishOwnership: (() => void) | undefined
+    registerAiVaultHandlers({
+      ensureStructuredSessionOwnership: () =>
+        new Promise<void>((resolve) => {
+          finishOwnership = resolve
+        })
+    })
+    const event = { sender: Object.assign(new EventEmitter(), { id: 1 }) }
+    const pending = ipcHandler('aiVault:listSessions')(event, { requestToken: 'scan' })
+
+    event.sender.emit('did-navigate')
+    finishOwnership?.()
+
+    await expect(pending).resolves.toMatchObject({ cancelled: true })
+    expect(mocks.scanAiVaultSessionsInWorker).not.toHaveBeenCalled()
+    expect(event.sender.eventNames()).toEqual([])
+  })
+
   it('re-joins a preempted same-scope caller onto the forced refresh', async () => {
     const signals: AbortSignal[] = []
     let resolveForced: ((result: AiVaultListResult) => void) | undefined
diff --git a/src/main/ipc/ai-vault.test.ts b/src/main/ipc/ai-vault.test.ts
index 17f282e54be..b9f5661e19c 100644
--- a/src/main/ipc/ai-vault.test.ts
+++ b/src/main/ipc/ai-vault.test.ts
@@ -1,3 +1,4 @@
+import { EventEmitter } from 'node:events'
 import { homedir } from 'node:os'
 import { join, sep } from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
@@ -488,20 +489,17 @@ describe('listAiVaultSessions host routing', () => {
         })
     )
     registerAiVaultHandlers()
-    const event = { sender: { id: 7 } }
+    const event = { sender: Object.assign(new EventEmitter(), { id: 7 }) }
     const pending = getIpcHandler('aiVault:listSessions')(event, {
       executionHostScope: 'ssh:dev-box',
       requestToken: 'scan-1'
     })
     await vi.waitFor(() => expect(relaySignal).toBeDefined())
 
-    await getIpcHandler('aiVault:cancelListSessions')(event, {
-      requestToken: 'scan-1'
-    })
+    await getIpcHandler('aiVault:cancelListSessions')(event, { requestToken: 'scan-1' })
 
     expect(relaySignal?.aborted).toBe(true)
-    // Resolved, not rejected: Electron logs every rejected handler, and a
-    // superseded scan is normal control flow rather than a failure.
+    // Superseded scans resolve because Electron logs every rejected handler.
     await expect(pending).resolves.toMatchObject({ cancelled: true, sessions: [] })
   })
 })
diff --git a/src/main/ipc/cursor-accounts.ts b/src/main/ipc/cursor-accounts.ts
new file mode 100644
index 00000000000..78273dfb1cb
--- /dev/null
+++ b/src/main/ipc/cursor-accounts.ts
@@ -0,0 +1,6 @@
+import { ipcMain } from 'electron'
+import { getCursorAccountStatus } from '../cursor-accounts/status'
+
+export function registerCursorAccountHandlers(): void {
+  ipcMain.handle('cursorAccounts:getStatus', () => getCursorAccountStatus())
+}
diff --git a/src/main/ipc/desktop-renderer-runtime-capabilities.ts b/src/main/ipc/desktop-renderer-runtime-capabilities.ts
index 63ba9b1d0b1..0bcfd1bd686 100644
--- a/src/main/ipc/desktop-renderer-runtime-capabilities.ts
+++ b/src/main/ipc/desktop-renderer-runtime-capabilities.ts
@@ -1,5 +1,6 @@
 import {
   AGENT_LAUNCH_RUNTIME_CAPABILITY,
+  AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
   AGENT_SESSION_BACKGROUND_TASK_ROW_STOP_CAPABILITY,
   AGENT_SESSION_BACKGROUND_TASK_STOP_CAPABILITY,
   AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY,
@@ -25,6 +26,7 @@ import {
 export const DESKTOP_RENDERER_RUNTIME_CLIENT_CAPABILITIES: readonly RuntimeCapability[] = [
   AGENT_SESSION_BACKGROUND_TASK_STOP_CAPABILITY,
   AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY,
+  AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
   AGENT_SESSION_TURN_ITEM_CAPABILITY,
   AGENT_SESSION_BACKGROUND_TASK_ROW_STOP_CAPABILITY,
   STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
diff --git a/src/main/ipc/emulator-frame-stream-socket-lifetime.test.ts b/src/main/ipc/emulator-frame-stream-socket-lifetime.test.ts
new file mode 100644
index 00000000000..e09b897af93
--- /dev/null
+++ b/src/main/ipc/emulator-frame-stream-socket-lifetime.test.ts
@@ -0,0 +1,71 @@
+import { EventEmitter, once } from 'node:events'
+import { createServer, type Server } from 'node:http'
+import type { Socket } from 'node:net'
+import { afterEach, expect, it, vi } from 'vitest'
+
+const handlers = new Map<string, (event: unknown, args: unknown) => unknown>()
+vi.mock('electron', () => ({
+  ipcMain: {
+    handle: (channel: string, handler: (event: unknown, args: unknown) => unknown) => {
+      handlers.set(channel, handler)
+    }
+  },
+  BrowserWindow: { fromWebContents: () => ({}) }
+}))
+
+import { registerEmulatorFrameStreamHandlers } from './emulator-frame-stream'
+
+class Owner extends EventEmitter {
+  isDestroyed = (): boolean => false
+  send = (): void => {
+    this.emit('frame-received')
+  }
+}
+
+let server: Server | null = null
+let owner: Owner | null = null
+
+afterEach(async () => {
+  owner?.emit('destroyed')
+  owner = null
+  if (server) {
+    server.closeAllConnections()
+    await new Promise<void>((resolve) => server?.close(() => resolve()))
+    server = null
+  }
+})
+
+it.each(['did-navigate', 'render-process-gone', 'destroyed'])(
+  'closes the live MJPEG HTTP socket after %s',
+  async (goneEvent) => {
+    registerEmulatorFrameStreamHandlers()
+    const sockets = new Set<Socket>()
+    const httpServer = createServer((_request, response) => {
+      response.writeHead(200, { 'content-type': 'application/octet-stream' })
+      response.write(Buffer.from([0xff, 0xd8, 0x01, 0x02, 0xff, 0xd9]))
+    })
+    server = httpServer
+    httpServer.on('connection', (socket) => {
+      sockets.add(socket)
+      socket.once('close', () => sockets.delete(socket))
+    })
+    await new Promise<void>((resolve) => httpServer.listen(0, '127.0.0.1', resolve))
+    const address = httpServer.address()
+    if (!address || typeof address === 'string') {
+      throw new Error('Expected TCP address')
+    }
+    const sender = new Owner()
+    owner = sender
+    const frameReceived = once(sender, 'frame-received')
+    handlers.get('emulator:frameStreamStart')?.(
+      { sender },
+      { streamUrl: `http://127.0.0.1:${address.port}/stream.mjpeg` }
+    )
+    await frameReceived
+    expect(sockets.size).toBe(1)
+    const closed = Promise.all(Array.from(sockets, (socket) => once(socket, 'close')))
+    sender.emit(goneEvent)
+    await closed
+    expect(sockets.size).toBe(0)
+  }
+)
diff --git a/src/main/ipc/emulator-frame-stream.ts b/src/main/ipc/emulator-frame-stream.ts
index 4cf8eee1a5b..9a806704154 100644
--- a/src/main/ipc/emulator-frame-stream.ts
+++ b/src/main/ipc/emulator-frame-stream.ts
@@ -1,11 +1,11 @@
-import { BrowserWindow, ipcMain, type WebContents } from 'electron'
+import { BrowserWindow, ipcMain } from 'electron'
 import { randomUUID } from 'node:crypto'
 import { MjpegFrameStream } from '../emulator/mjpeg-frame-stream'
+import { abortWhenRendererGone } from './renderer-lifetime-abort'
 
 type FrameStreamSession = {
-  owner: WebContents
   stream: MjpegFrameStream
-  onOwnerDestroyed: () => void
+  disposeLifetime: () => void
 }
 
 const sessions = new Map<string, FrameStreamSession>()
@@ -15,11 +15,9 @@ function stopFrameStream(streamId: string): void {
   if (!session) {
     return
   }
-  session.stream.stop()
-  // Why: `.once('destroyed')` self-removes only when that event fires (window
-  // close), so an explicit stop must drop it or each show/hide cycle leaks one.
-  session.owner.removeListener('destroyed', session.onOwnerDestroyed)
   sessions.delete(streamId)
+  session.disposeLifetime()
+  session.stream.stop()
 }
 
 function frameToArrayBuffer(frame: Buffer<ArrayBufferLike>): ArrayBuffer {
@@ -45,12 +43,12 @@ export function registerEmulatorFrameStreamHandlers(): void {
         args.streamUrl,
         {
           onError: (message) => {
-            if (!owner.isDestroyed()) {
+            if (sessions.has(streamId) && !owner.isDestroyed()) {
               owner.send('emulator:frameStreamError', { streamId, message })
             }
           },
           onFrame: (frame) => {
-            if (!owner.isDestroyed()) {
+            if (sessions.has(streamId) && !owner.isDestroyed()) {
               owner.send('emulator:frameStreamFrame', {
                 streamId,
                 bytes: frameToArrayBuffer(frame)
@@ -61,10 +59,22 @@ export function registerEmulatorFrameStreamHandlers(): void {
         args.streamKey
       )
 
-      const onOwnerDestroyed = (): void => stopFrameStream(streamId)
-      sessions.set(streamId, { owner, stream, onOwnerDestroyed })
-      owner.once('destroyed', onOwnerDestroyed)
-      stream.start()
+      const lifetime = abortWhenRendererGone(owner)
+      const onRendererGone = (): void => stopFrameStream(streamId)
+      sessions.set(streamId, {
+        stream,
+        disposeLifetime: () => {
+          lifetime.signal.removeEventListener('abort', onRendererGone)
+          lifetime.dispose()
+        }
+      })
+      lifetime.signal.addEventListener('abort', onRendererGone, { once: true })
+      try {
+        stream.start()
+      } catch (error) {
+        stopFrameStream(streamId)
+        throw error
+      }
       return { streamId }
     }
   )
diff --git a/src/main/ipc/emulator-renderer-lifetime.test.ts b/src/main/ipc/emulator-renderer-lifetime.test.ts
new file mode 100644
index 00000000000..ecaa54b20ce
--- /dev/null
+++ b/src/main/ipc/emulator-renderer-lifetime.test.ts
@@ -0,0 +1,233 @@
+import { EventEmitter } from 'node:events'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import type { MjpegFrameStreamCallbacks } from '../emulator/mjpeg-frame-stream'
+import type { ScrcpyVideoSubscriber } from '../emulator/scrcpy-video-registry'
+
+const mocks = vi.hoisted(() => ({
+  handlers: new Map<string, (event: unknown, args: unknown) => unknown>(),
+  frameCallbacks: new Set<MjpegFrameStreamCallbacks>(),
+  videoSubscribers: new Set<ScrcpyVideoSubscriber>(),
+  frameStarts: vi.fn(),
+  frameStops: vi.fn(),
+  videoStarts: vi.fn(),
+  videoStops: vi.fn()
+}))
+
+vi.mock('electron', () => ({
+  ipcMain: {
+    handle: (channel: string, handler: (event: unknown, args: unknown) => unknown) => {
+      mocks.handlers.set(channel, handler)
+    }
+  },
+  BrowserWindow: { fromWebContents: () => ({}) }
+}))
+vi.mock('../emulator/mjpeg-frame-stream', () => ({
+  MjpegFrameStream: class {
+    constructor(
+      _url: string,
+      private callbacks: MjpegFrameStreamCallbacks
+    ) {}
+    start(): void {
+      mocks.frameStarts()
+      mocks.frameCallbacks.add(this.callbacks)
+    }
+    stop(): void {
+      mocks.frameStops()
+      mocks.frameCallbacks.delete(this.callbacks)
+    }
+  }
+}))
+vi.mock('../emulator/scrcpy-video-registry', () => ({
+  scrcpyVideoRegistry: {
+    subscribe: (_deviceId: string, subscriber: ScrcpyVideoSubscriber) => {
+      mocks.videoStarts()
+      mocks.videoSubscribers.add(subscriber)
+      return () => {
+        mocks.videoStops()
+        mocks.videoSubscribers.delete(subscriber)
+      }
+    }
+  }
+}))
+vi.mock('../emulator/emulator-probe', () => ({ emulatorProbe: () => {} }))
+
+import { registerEmulatorFrameStreamHandlers } from './emulator-frame-stream'
+import { registerEmulatorVideoStreamHandlers } from './emulator-video-stream'
+
+class Owner extends EventEmitter {
+  send = vi.fn()
+  isDestroyed = (): boolean => false
+}
+
+const owners: Owner[] = []
+const goneEvents = ['did-navigate', 'render-process-gone', 'destroyed'] as const
+
+function owner(): Owner {
+  const sender = new Owner()
+  owners.push(sender)
+  return sender
+}
+
+function start(sender: Owner, kind: 'frame' | 'video'): string {
+  const result = mocks.handlers.get(`emulator:${kind}StreamStart`)?.(
+    { sender },
+    kind === 'frame'
+      ? { streamUrl: 'http://127.0.0.1:0/stream.mjpeg' }
+      : { deviceId: 'emulator-5554' }
+  )
+  if (!result || typeof result !== 'object' || !('streamId' in result)) {
+    throw new Error('Missing stream result')
+  }
+  if (typeof result.streamId !== 'string') {
+    throw new Error('Missing stream id')
+  }
+  return result.streamId
+}
+
+function sendFrames(): void {
+  for (const callbacks of mocks.frameCallbacks) {
+    callbacks.onFrame(Buffer.from([0xff, 0xd8, 0xff, 0xd9]))
+  }
+  for (const subscriber of mocks.videoSubscribers) {
+    subscriber({
+      type: 'frame',
+      frame: { config: false, keyFrame: true, pts: '0', bytes: new ArrayBuffer(4) }
+    })
+  }
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.clearAllMocks()
+  registerEmulatorFrameStreamHandlers()
+  registerEmulatorVideoStreamHandlers()
+})
+
+afterEach(() => {
+  for (const sender of owners.splice(0)) {
+    sender.emit('destroyed')
+  }
+  vi.clearAllTimers()
+  vi.useRealTimers()
+  mocks.frameCallbacks.clear()
+  mocks.videoSubscribers.clear()
+})
+
+it.each(goneEvents)('stops both live streams on %s and leaves no per-frame delivery', (event) => {
+  const sender = owner()
+  start(sender, 'frame')
+  start(sender, 'video')
+  vi.runOnlyPendingTimers()
+  sendFrames()
+  expect(sender.send).toHaveBeenCalledTimes(2)
+
+  sender.emit(event)
+  expect(mocks.frameCallbacks.size).toBe(0)
+  expect(mocks.videoSubscribers.size).toBe(0)
+  expect(mocks.frameStops).toHaveBeenCalledTimes(1)
+  expect(mocks.videoStops).toHaveBeenCalledTimes(1)
+  sendFrames()
+  expect(sender.send).toHaveBeenCalledTimes(2)
+  for (const gone of goneEvents) {
+    expect(sender.listenerCount(gone)).toBe(0)
+  }
+})
+
+it.each(goneEvents)('does not start deferred video work after %s', (event) => {
+  const sender = owner()
+  start(sender, 'video')
+  sender.emit(event)
+  vi.runOnlyPendingTimers()
+  expect(mocks.videoStarts).not.toHaveBeenCalled()
+  expect(mocks.videoSubscribers.size).toBe(0)
+})
+
+it('keeps only the current document streams after repeated reloads', () => {
+  const sender = owner()
+  for (let cycle = 0; cycle < 15; cycle++) {
+    start(sender, 'frame')
+    start(sender, 'video')
+    vi.runOnlyPendingTimers()
+    sender.emit('did-navigate')
+  }
+  start(sender, 'frame')
+  start(sender, 'video')
+  vi.runOnlyPendingTimers()
+  expect(mocks.frameCallbacks.size).toBe(1)
+  expect(mocks.videoSubscribers.size).toBe(1)
+  sendFrames()
+  expect(sender.send).toHaveBeenCalledTimes(2)
+})
+
+it('keeps streams through same-document or prevented navigation and releases on explicit stop', () => {
+  const sender = owner()
+  const frameId = start(sender, 'frame')
+  const videoId = start(sender, 'video')
+  vi.runOnlyPendingTimers()
+  sender.emit('did-start-navigation')
+  sender.emit('did-navigate-in-page')
+  sendFrames()
+  expect(sender.send).toHaveBeenCalledTimes(2)
+  mocks.handlers.get('emulator:frameStreamStop')?.({ sender }, { streamId: frameId })
+  mocks.handlers.get('emulator:videoStreamStop')?.({ sender }, { streamId: videoId })
+  expect(mocks.frameCallbacks.size).toBe(0)
+  expect(mocks.videoSubscribers.size).toBe(0)
+  for (const event of goneEvents) {
+    expect(sender.listenerCount(event)).toBe(0)
+  }
+})
+
+it('releases a failed frame-stream start without retaining renderer listeners', () => {
+  const sender = owner()
+  mocks.frameStarts.mockImplementationOnce(() => {
+    throw new Error('Stream unavailable')
+  })
+  expect(() => start(sender, 'frame')).toThrow('Stream unavailable')
+  expect(mocks.frameStops).toHaveBeenCalledTimes(1)
+  for (const event of goneEvents) {
+    expect(sender.listenerCount(event)).toBe(0)
+  }
+})
+
+it('keeps another renderer streams live when the first document reloads', () => {
+  const first = owner()
+  const second = owner()
+  for (const sender of [first, second]) {
+    start(sender, 'frame')
+    start(sender, 'video')
+  }
+  vi.runOnlyPendingTimers()
+  first.emit('did-navigate')
+  sendFrames()
+  expect(first.send).not.toHaveBeenCalled()
+  expect(second.send).toHaveBeenCalledTimes(2)
+  expect(mocks.frameCallbacks.size).toBe(1)
+  expect(mocks.videoSubscribers.size).toBe(1)
+})
+
+it.each([...goneEvents, 'explicit stop'] as const)(
+  'suppresses retired frame callbacks after %s while keeping current stream errors',
+  (event) => {
+    const sender = owner()
+    const streamId = start(sender, 'frame')
+    const callbacks = [...mocks.frameCallbacks][0]
+    callbacks.onError('active failure')
+    expect(sender.send).toHaveBeenCalledWith('emulator:frameStreamError', {
+      streamId,
+      message: 'active failure'
+    })
+    sender.send.mockClear()
+    mocks.frameStops.mockImplementationOnce(() => callbacks.onError('stop failure'))
+    if (event === 'explicit stop') {
+      mocks.handlers.get('emulator:frameStreamStop')?.({ sender }, { streamId })
+    } else {
+      sender.emit(event)
+    }
+    start(sender, 'frame')
+    callbacks.onError('late failure')
+    callbacks.onFrame(Buffer.from([0xff, 0xd8, 0xff, 0xd9]))
+    expect(sender.send).not.toHaveBeenCalled()
+    sendFrames()
+    expect(sender.send).toHaveBeenCalledOnce()
+  }
+)
diff --git a/src/main/ipc/emulator-video-stream.ts b/src/main/ipc/emulator-video-stream.ts
index 8bfe8367103..f6aeb8f2f75 100644
--- a/src/main/ipc/emulator-video-stream.ts
+++ b/src/main/ipc/emulator-video-stream.ts
@@ -2,6 +2,7 @@ import { BrowserWindow, ipcMain, type WebContents } from 'electron'
 import { randomUUID } from 'node:crypto'
 import { scrcpyVideoRegistry } from '../emulator/scrcpy-video-registry'
 import { emulatorProbe } from '../emulator/emulator-probe'
+import { abortWhenRendererGone } from './renderer-lifetime-abort'
 
 // Bridges the main-process scrcpy video registry to renderer subscribers. The
 // renderer calls emulator:videoStreamStart with a deviceId; meta + H.264 access
@@ -11,7 +12,8 @@ export function registerEmulatorVideoStreamHandlers(): void {
   type Subscription = {
     owner: WebContents
     unsubscribe: () => void
-    onOwnerDestroyed: () => void
+    disposeLifetime: () => void
+    startTimer: ReturnType<typeof setTimeout> | null
   }
   const subscriptions = new Map<string, Subscription>()
 
@@ -20,11 +22,12 @@ export function registerEmulatorVideoStreamHandlers(): void {
     if (!subscription || (owner && subscription.owner !== owner)) {
       return
     }
-    subscription.unsubscribe()
-    // Why: `.once('destroyed')` self-removes only when that event fires (window
-    // close), so an explicit stop must drop it or each show/hide cycle leaks one.
-    subscription.owner.removeListener('destroyed', subscription.onOwnerDestroyed)
     subscriptions.delete(streamId)
+    if (subscription.startTimer !== null) {
+      clearTimeout(subscription.startTimer)
+    }
+    subscription.disposeLifetime()
+    subscription.unsubscribe()
   }
 
   ipcMain.handle(
@@ -44,14 +47,21 @@ export function registerEmulatorVideoStreamHandlers(): void {
         throw new Error('Video stream id is already in use by another renderer')
       }
       stopSubscription(streamId, owner)
-      const onOwnerDestroyed = (): void => stopSubscription(streamId, owner)
+      const lifetime = abortWhenRendererGone(owner)
+      const onRendererGone = (): void => stopSubscription(streamId, owner)
       const pendingSubscription: Subscription = {
         owner,
         unsubscribe: () => {},
-        onOwnerDestroyed
+        disposeLifetime: () => {
+          lifetime.signal.removeEventListener('abort', onRendererGone)
+          lifetime.dispose()
+        },
+        startTimer: null
       }
       subscriptions.set(streamId, pendingSubscription)
-      setTimeout(() => {
+      lifetime.signal.addEventListener('abort', onRendererGone, { once: true })
+      pendingSubscription.startTimer = setTimeout(() => {
+        pendingSubscription.startTimer = null
         if (owner.isDestroyed() || subscriptions.get(streamId) !== pendingSubscription) {
           return
         }
@@ -75,7 +85,6 @@ export function registerEmulatorVideoStreamHandlers(): void {
         })
         pendingSubscription.unsubscribe = unsubscribe
       }, 0)
-      owner.once('destroyed', onOwnerDestroyed)
       return { streamId }
     }
   )
diff --git a/src/main/ipc/filesystem-allowed-roots.ts b/src/main/ipc/filesystem-allowed-roots.ts
index fb4e9854c2e..115e038218d 100644
--- a/src/main/ipc/filesystem-allowed-roots.ts
+++ b/src/main/ipc/filesystem-allowed-roots.ts
@@ -1,4 +1,4 @@
-import { resolve } from 'node:path'
+import { isAbsolute, resolve } from 'node:path'
 import type { Store } from '../persistence'
 import { computeWorkspaceRoot, getWorktreePathSettings } from './worktree-logic'
 import {
@@ -14,13 +14,13 @@ import {
 import type { FolderWorkspace } from '../../shared/folder-workspace-types'
 import type { ProjectGroup } from '../../shared/project-group-types'
 import type { Repo } from '../../shared/repo-types'
+import { hasRemoteFilesystemOwner } from './remote-filesystem-owner'
 
 type FolderScopeStore = Pick<Store, 'getRepos'> &
   Partial<Pick<Store, 'getProjectGroups' | 'getFolderWorkspaces'>>
 
-// Why: SSH repo paths are remote-host paths; treating them as local roots could authorize unrelated local folders or probe SSH-only paths.
 function filterLocalRepos(repos: readonly Repo[]): Repo[] {
-  return repos.filter((repo) => !repo.connectionId)
+  return repos.filter((repo) => !hasRemoteFilesystemOwner(repo))
 }
 
 export function getLocalRepos(store: Store) {
@@ -30,11 +30,11 @@ export function getLocalRepos(store: Store) {
 function isRemoteOnlyFolderScope(
   folderPath: string,
   projectGroupId: string,
-  connectionId: string | null | undefined,
+  hasRemoteOwner: boolean,
   childGroupIndex: ProjectGroupChildIndex,
   repos: readonly Repo[]
 ): boolean {
-  if (connectionId) {
+  if (hasRemoteOwner) {
     return true
   }
   const groupIds = collectProjectGroupSubtreeIds(childGroupIndex, projectGroupId)
@@ -45,7 +45,7 @@ function isRemoteOnlyFolderScope(
       isPathInsideOrEqual(folderPath, repo.path)
     ) {
       // One local candidate settles the scope without scanning the remaining repositories.
-      if (!repo.connectionId) {
+      if (!hasRemoteFilesystemOwner(repo)) {
         return false
       }
       hasRemoteCandidate = true
@@ -54,15 +54,21 @@ function isRemoteOnlyFolderScope(
   return hasRemoteCandidate
 }
 
-function getFolderWorkspaceConnectionId(
+/**
+ * Deliberately stricter than `resolveFolderWorkspaceHost`, which lets the workspace's own
+ * `executionHostId` pin win: a workspace pinned `local` under a group carrying only a legacy
+ * `connectionId` dispatches locally but is denied here. Letting the pin win would hand out a root
+ * the store refuses today, so authorization keeps the fail-closed read of either field.
+ */
+function hasRemoteFolderWorkspaceOwner(
   workspace: FolderWorkspace,
   projectGroups: readonly ProjectGroup[]
-): string | null {
-  return (
-    workspace.connectionId ??
-    projectGroups.find((group) => group.id === workspace.projectGroupId)?.connectionId ??
-    null
-  )
+): boolean {
+  const group = projectGroups.find((group) => group.id === workspace.projectGroupId)
+  return hasRemoteFilesystemOwner({
+    connectionId: workspace.connectionId ?? group?.connectionId,
+    executionHostId: workspace.executionHostId ?? group?.executionHostId
+  })
 }
 
 function getLocalFolderScopeRoots(store: Store, repos: readonly Repo[]): string[] {
@@ -77,7 +83,7 @@ function getLocalFolderScopeRoots(store: Store, repos: readonly Repo[]): string[
       !isRemoteOnlyFolderScope(
         group.parentPath,
         group.id,
-        group.connectionId,
+        hasRemoteFilesystemOwner(group),
         childGroupIndex,
         repos
       )
@@ -90,7 +96,7 @@ function getLocalFolderScopeRoots(store: Store, repos: readonly Repo[]): string[
       !isRemoteOnlyFolderScope(
         workspace.folderPath,
         workspace.projectGroupId,
-        getFolderWorkspaceConnectionId(workspace, projectGroups),
+        hasRemoteFolderWorkspaceOwner(workspace, projectGroups),
         childGroupIndex,
         repos
       )
@@ -101,6 +107,28 @@ function getLocalFolderScopeRoots(store: Store, repos: readonly Repo[]): string[
   return roots
 }
 
+/** The single path implementation that both judges and resolves a local root. */
+type HostPathResolver = {
+  isAbsolute: (value: string) => boolean
+  resolve: (value: string) => string
+}
+
+/**
+ * The allowed root a `workspaceDir` with no local repo to anchor it may contribute, or `null`.
+ *
+ * The predicate has to be the host's own, not `isRuntimePathAbsolute`: that helper accepts either
+ * flavour, so on POSIX it calls `C:\ws` absolute while this `resolve` reads the same string as a
+ * relative name and anchors the root under the main-process cwd — authorizing an unrelated local
+ * tree. Pairing both here keeps them from diverging again; `hostPath` is injectable so the
+ * flavour matrix can run POSIX and Windows without the test choosing on `process.platform`.
+ */
+export function resolveUnanchoredWorkspaceRoot(
+  workspaceDir: string,
+  hostPath: HostPathResolver = { isAbsolute, resolve }
+): string | null {
+  return hostPath.isAbsolute(workspaceDir) ? hostPath.resolve(workspaceDir) : null
+}
+
 export function getAllowedRoots(store: Store): string[] {
   // Why one read: `getRepos` rehydrates every repo, and this runs twice per filesystem IPC.
   const repos = store.getRepos()
@@ -112,7 +140,10 @@ export function getAllowedRoots(store: Store): string[] {
   ]
   if (settings.workspaceDir) {
     if (localRepos.length === 0) {
-      roots.push(resolve(settings.workspaceDir))
+      const unanchoredRoot = resolveUnanchoredWorkspaceRoot(settings.workspaceDir)
+      if (unanchoredRoot) {
+        roots.push(unanchoredRoot)
+      }
     } else {
       const projectRuntimeByRepoId = resolveLocalProjectRuntimesForRepos(store, localRepos)
       for (const repo of localRepos) {
diff --git a/src/main/ipc/filesystem-auth.ts b/src/main/ipc/filesystem-auth.ts
index 894e39945c1..6110ea7baf2 100644
--- a/src/main/ipc/filesystem-auth.ts
+++ b/src/main/ipc/filesystem-auth.ts
@@ -183,7 +183,7 @@ async function isPathAllowedIncludingRegisteredWorktrees(
     return true
   }
 
-  if (isRegisteredWorktreePath(targetPath)) {
+  if (isRegisteredWorktreePath(targetPath, store)) {
     return true
   }
 
@@ -198,7 +198,9 @@ async function isPathAllowedIncludingRegisteredWorktrees(
     return true
   }
 
-  if (await isPathAllowedByCanonicalRegisteredRoot(targetPath, options.canonicalSourcePath)) {
+  if (
+    await isPathAllowedByCanonicalRegisteredRoot(targetPath, options.canonicalSourcePath, store)
+  ) {
     return true
   }
 
@@ -206,8 +208,8 @@ async function isPathAllowedIncludingRegisteredWorktrees(
 
   // Why: linked worktrees are already git-trusted; reuse the cached root index so reads don't spawn `git worktree list` each time.
   return (
-    isRegisteredWorktreePath(targetPath) ||
-    (await isPathAllowedByCanonicalRegisteredRoot(targetPath, options.canonicalSourcePath))
+    isRegisteredWorktreePath(targetPath, store) ||
+    (await isPathAllowedByCanonicalRegisteredRoot(targetPath, options.canonicalSourcePath, store))
   )
 }
 
diff --git a/src/main/ipc/filesystem-canonical-owner.test.ts b/src/main/ipc/filesystem-canonical-owner.test.ts
new file mode 100644
index 00000000000..ec4888a3f52
--- /dev/null
+++ b/src/main/ipc/filesystem-canonical-owner.test.ts
@@ -0,0 +1,369 @@
+import { join, posix, resolve, win32 } from 'node:path'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Store } from '../persistence'
+import type { Repo } from '../../shared/repo-types'
+import type { ProjectGroup } from '../../shared/project-group-types'
+import type { FolderWorkspace } from '../../shared/folder-workspace-types'
+import { resolveFolderWorkspaceHost } from '../../shared/folder-workspace-execution-host'
+import {
+  getAllowedRoots,
+  getLocalRepos,
+  resolveUnanchoredWorkspaceRoot
+} from './filesystem-allowed-roots'
+import { isPathAllowed } from './filesystem-auth'
+import {
+  __resetCreatedWorktreeRootsForTests,
+  invalidateAuthorizedRootsCache,
+  isRegisteredWorktreePath,
+  rebuildAuthorizedRootsCache,
+  registerCreatedWorktreeRoot,
+  registerWorktreeRootsForRepo
+} from './registered-worktree-roots-cache'
+
+const mocks = vi.hoisted(() => ({
+  graph: vi.fn(),
+  stat: vi.fn(),
+  realpath: vi.fn(),
+  workspaceRoot: vi.fn(),
+  pathSettings: vi.fn(),
+  projectRuntimes: vi.fn()
+}))
+vi.mock('node:fs/promises', () => ({ stat: mocks.stat, realpath: mocks.realpath }))
+vi.mock('../repo-worktrees', () => ({ listRepoWorktreeGraph: mocks.graph, isRepoRoot: vi.fn() }))
+vi.mock('./worktree-logic', () => ({
+  computeWorkspaceRoot: mocks.workspaceRoot,
+  getWorktreePathSettings: mocks.pathSettings
+}))
+vi.mock('../project-runtime-git-options', () => ({
+  getWorktreeMirrorDistroForRuntime: vi.fn(),
+  resolveLocalProjectRuntimesForRepos: mocks.projectRuntimes
+}))
+
+/**
+ * Widened past `Repo['executionHostId']` on purpose: the union names the stamps Orca writes, while a
+ * store carries whatever an older build, a hand-edited catalog or a partial migration left behind.
+ * Those are exactly the stamps authorization has to place, so the matrix must be able to build them.
+ */
+type Owner = { connectionId?: string | null; executionHostId?: string | null }
+const root = resolve('/owner-fixture')
+const linked = resolve('/linked-fixture')
+function repo(owner: Owner = {}, overrides: Partial<Repo> = {}): Repo {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only `executionHostId` leaves the union, and only to the malformed stamps above; every other field is a checked `Repo` field.
+  return {
+    id: 'repo',
+    path: root,
+    displayName: 'repo',
+    badgeColor: '#000',
+    addedAt: 0,
+    ...owner,
+    ...overrides
+  } as Repo
+}
+function group(owner: Owner = {}, overrides: Partial<ProjectGroup> = {}): ProjectGroup {
+  return {
+    id: 'group',
+    name: 'group',
+    parentPath: root,
+    parentGroupId: null,
+    createdFrom: 'manual',
+    tabOrder: 0,
+    isCollapsed: false,
+    color: null,
+    createdAt: 0,
+    updatedAt: 0,
+    ...owner,
+    ...overrides
+  }
+}
+function folder(owner: Owner = {}): FolderWorkspace {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: same widened stamp as `repo`; all other fields are checked `FolderWorkspace` fields.
+  return {
+    id: 'folder',
+    projectGroupId: 'group',
+    name: 'folder',
+    folderPath: root,
+    linkedTask: null,
+    comment: '',
+    isArchived: false,
+    isUnread: false,
+    isPinned: false,
+    sortOrder: 0,
+    lastActivityAt: 0,
+    createdAt: 0,
+    updatedAt: 0,
+    ...owner
+  } as FolderWorkspace
+}
+function storeFor(
+  repos: Repo[] = [],
+  groups: ProjectGroup[] = [],
+  folders: FolderWorkspace[] = [],
+  settings: { workspaceDir?: string } = {}
+): Store {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Authorization reads only these catalog and settings methods; fixtures omit workspaceDir unless the case is about it.
+  return {
+    getRepos: () => repos,
+    getProjectGroups: () => groups,
+    getFolderWorkspaces: () => folders,
+    getSettings: () => settings
+  } as Store
+}
+
+const deniedOwners: { name: string; owner: Owner }[] = [
+  { name: 'canonical SSH', owner: { executionHostId: 'ssh:host-a' } },
+  { name: 'encoded canonical SSH', owner: { executionHostId: 'ssh:host%20a' } },
+  { name: 'legacy SSH', owner: { connectionId: 'host-a' } },
+  {
+    name: 'explicit local with legacy SSH',
+    owner: { executionHostId: 'local', connectionId: 'host-a' }
+  },
+  {
+    name: 'runtime with legacy SSH',
+    owner: { executionHostId: 'runtime:env', connectionId: 'host-a' }
+  },
+  // Host ids the shared parser rejects. Each must fail closed: an owner we cannot place is not
+  // evidence of a local one, and a bare `getSshTargetIdForExecutionHost` answers null for all five.
+  { name: 'empty SSH target', owner: { executionHostId: 'ssh:' } },
+  { name: 'undecodable SSH target', owner: { executionHostId: 'ssh:%zz' } },
+  { name: 'alias-delimiter SSH target', owner: { executionHostId: 'ssh:host-a|alias' } },
+  { name: 'wrong-case SSH prefix', owner: { executionHostId: 'SSH:host-a' } },
+  { name: 'unknown host kind', owner: { executionHostId: 'relay:host-a' } }
+]
+const allowedOwners: { name: string; owner: Owner }[] = [
+  { name: 'unscoped local', owner: {} },
+  { name: 'explicit local', owner: { executionHostId: 'local' } },
+  { name: 'blank host stamp', owner: { executionHostId: '  ' } },
+  { name: 'own-store runtime', owner: { executionHostId: 'runtime:env' } }
+]
+
+beforeEach(() => {
+  invalidateAuthorizedRootsCache()
+  __resetCreatedWorktreeRootsForTests()
+  vi.clearAllMocks()
+  mocks.graph.mockResolvedValue([])
+  mocks.stat.mockResolvedValue({})
+  mocks.realpath.mockImplementation(async (path: string) => path)
+  mocks.projectRuntimes.mockReturnValue(new Map())
+  mocks.pathSettings.mockImplementation(
+    (_repo: Repo, settings: { workspaceDir: string }) => settings
+  )
+  mocks.workspaceRoot.mockImplementation(
+    (_repoPath: string, settings: { workspaceDir: string }) => settings.workspaceDir
+  )
+})
+
+describe.each(deniedOwners)('$name fixture matrix', ({ owner }) => {
+  it.each([
+    ['repo root', () => storeFor([repo(owner)])],
+    ['group scope', () => storeFor([], [group(owner)])],
+    ['folder scope', () => storeFor([], [], [folder(owner)])],
+    ['folder inheriting the group', () => storeFor([], [group(owner)], [folder()])],
+    [
+      'local-looking group and folder over a remote child repo',
+      () => storeFor([repo(owner, { path: join(root, 'child') })], [group()], [folder()])
+    ]
+  ])('denies the %s', (_case, build) => {
+    expect(isPathAllowed(join(root, 'file'), build())).toBe(false)
+  })
+})
+
+describe.each(deniedOwners)('$name filesystem ownership', ({ owner }) => {
+  it('does not grant a repository root or register linked roots', async () => {
+    const store = storeFor([repo(owner)])
+    expect(getLocalRepos(store)).toEqual([])
+    expect(isPathAllowed(join(root, 'file'), store)).toBe(false)
+    registerWorktreeRootsForRepo(store, 'repo', [linked])
+    registerCreatedWorktreeRoot(store, 'repo', linked)
+    expect(isRegisteredWorktreePath(linked, store)).toBe(false)
+    await rebuildAuthorizedRootsCache(store)
+    expect(isRegisteredWorktreePath(root, store)).toBe(false)
+    expect(mocks.graph).not.toHaveBeenCalled()
+    expect(mocks.stat).not.toHaveBeenCalled()
+  })
+
+  it.each(['group', 'folder', 'inherited group'] as const)(
+    'does not grant an empty %s scope',
+    (kind) => {
+      const store = storeFor(
+        [],
+        kind !== 'folder' ? [group(owner)] : [],
+        kind === 'folder' ? [folder(owner)] : kind === 'inherited group' ? [folder()] : []
+      )
+      expect(getAllowedRoots(store)).toEqual([])
+      expect(isPathAllowed(join(root, 'file'), store)).toBe(false)
+    }
+  )
+
+  it('does not infer a local group or folder from a remote child repo', () => {
+    const store = storeFor(
+      [repo(owner, { path: join(root, 'child'), projectGroupId: 'nested' })],
+      [group(), group({}, { id: 'nested', parentGroupId: 'group', parentPath: null })],
+      [folder()]
+    )
+    expect(getAllowedRoots(store)).toEqual([])
+    expect(isPathAllowed(join(root, 'file'), store)).toBe(false)
+  })
+})
+
+describe.each(allowedOwners)('$name filesystem ownership', ({ owner }) => {
+  it('preserves repo, group, folder and recovered worktree roots', () => {
+    for (const store of [
+      storeFor([repo(owner)]),
+      storeFor([], [group(owner)]),
+      storeFor([], [], [folder(owner)])
+    ]) {
+      expect(getAllowedRoots(store)).toEqual([root])
+      expect(isPathAllowed(join(root, 'file'), store)).toBe(true)
+    }
+    const store = storeFor([repo(owner)])
+    registerWorktreeRootsForRepo(store, 'repo', [root])
+    registerCreatedWorktreeRoot(store, 'repo', linked)
+    invalidateAuthorizedRootsCache()
+    expect(isRegisteredWorktreePath(linked, store)).toBe(true)
+    expect(mocks.graph).not.toHaveBeenCalled()
+    expect(mocks.stat).not.toHaveBeenCalled()
+  })
+})
+
+it('preserves an unpinned mixed local and SSH folder scope', () => {
+  const store = storeFor(
+    [
+      repo({ executionHostId: 'ssh:host-a' }, { path: join(root, 'remote') }),
+      repo({}, { id: 'local', path: join(root, 'local') })
+    ],
+    [group()],
+    [folder()]
+  )
+  expect(getAllowedRoots(store)).toEqual([join(root, 'local'), root, root])
+})
+
+it('keeps an explicit SSH folder scope remote even with a local candidate', () => {
+  const store = storeFor(
+    [repo({}, { path: join(root, 'local') })],
+    [group({ executionHostId: 'ssh:host-a' })],
+    [folder()]
+  )
+  expect(getAllowedRoots(store)).toEqual([join(root, 'local')])
+  expect(isPathAllowed(join(root, 'file'), store)).toBe(false)
+})
+
+it('preserves explicit local folder overrides and the legacy empty connection override', () => {
+  expect(
+    getAllowedRoots(
+      storeFor(
+        [],
+        [group({ executionHostId: 'ssh:host-a' })],
+        [folder({ executionHostId: 'local' })]
+      )
+    )
+  ).toEqual([root])
+  expect(
+    getAllowedRoots(
+      storeFor([], [group({ connectionId: 'host-a' })], [folder({ connectionId: '' })])
+    )
+  ).toEqual([root])
+})
+
+it('denies a workspace pinned local under a group carrying only a legacy connection', () => {
+  const pinnedFolder = folder({ executionHostId: 'local' })
+  const legacyGroup = group({ connectionId: 'host-a' })
+  const store = storeFor([], [legacyGroup], [pinnedFolder])
+  expect(getAllowedRoots(store)).toEqual([])
+  expect(isPathAllowed(join(root, 'file'), store)).toBe(false)
+  // Dispatch reads the same row as local; authorization is deliberately the stricter of the two,
+  // because agreeing would grant a root this store refuses today.
+  expect(
+    resolveFolderWorkspaceHost(
+      { folderWorkspaces: [pinnedFolder], projectGroups: [legacyGroup], repos: [] },
+      'folder'
+    )
+  ).toEqual({ kind: 'local' })
+  // The mirrored row needs no such note: the workspace's own legacy connection is remote on both sides.
+  const mirrored = storeFor(
+    [],
+    [group({ executionHostId: 'local' }, { parentPath: null })],
+    [folder({ connectionId: 'host-a' })]
+  )
+  expect(getAllowedRoots(mirrored)).toEqual([])
+  expect(isPathAllowed(join(root, 'file'), mirrored)).toBe(false)
+})
+
+it('still grants a local directory that happens to share an SSH repo path', () => {
+  const store = storeFor([
+    repo({ executionHostId: 'ssh:host-a' }),
+    repo({}, { id: 'mine', path: root })
+  ])
+  expect(getAllowedRoots(store)).toEqual([root])
+  expect(isPathAllowed(join(root, 'file'), store)).toBe(true)
+})
+
+describe('workspace-directory fallback', () => {
+  const workspaceDir = resolve('/ws-fixture')
+
+  it('does not widen past the roots a local repo of its own would grant', () => {
+    const local = getAllowedRoots(storeFor([repo()], [], [], { workspaceDir }))
+    const sshOnly = getAllowedRoots(
+      storeFor([repo({ executionHostId: 'ssh:host-a' })], [], [], { workspaceDir })
+    )
+    expect(local).toEqual([root, workspaceDir])
+    // The SSH repo's own path is gone; nothing beyond the fallback the same config already granted.
+    expect(sshOnly).toEqual([workspaceDir])
+    expect(
+      isPathAllowed(
+        join(root, 'file'),
+        storeFor([repo({ connectionId: 'host-a' })], [], [], { workspaceDir })
+      )
+    ).toBe(false)
+  })
+
+  it('grants a workspace directory this host reads as absolute, with no local repo', () => {
+    expect(getAllowedRoots(storeFor([], [], [], { workspaceDir: '/ws-fixture' }))).toEqual([
+      resolve('/ws-fixture')
+    ])
+  })
+
+  it.each([
+    ['bare name', 'orca-ws'],
+    ['parent traversal', '..'],
+    ['relative traversal', '../orca-ws']
+  ])('grants nothing for a repo-relative %s with no repo to anchor it', (_case, dir) => {
+    // `resolve` would anchor these to the main-process cwd, granting an unrelated tree.
+    expect(getAllowedRoots(storeFor([], [], [], { workspaceDir: dir }))).toEqual([])
+    expect(
+      getAllowedRoots(
+        storeFor([repo({ executionHostId: 'ssh:host-a' })], [], [], {
+          workspaceDir: dir
+        })
+      )
+    ).toEqual([])
+  })
+
+  // Why guarded rather than injected: this is the end-to-end claim that the foreign-flavour string
+  // never reaches `resolve`, so it has to run against the real host path module — and on Windows the
+  // same string is a legitimate root. The flavour matrix below covers both hosts unguarded.
+  it.skipIf(process.platform === 'win32')(
+    'does not anchor a Windows-style workspace directory under the POSIX main-process cwd',
+    () => {
+      const store = storeFor([], [], [], { workspaceDir: 'C:\\workspaces' })
+      expect(getAllowedRoots(store)).toEqual([])
+      // The cross-platform predicate used to grant exactly this: `<cwd>/C:\workspaces`.
+      expect(isPathAllowed(join(resolve('C:\\workspaces'), 'file'), store)).toBe(false)
+    }
+  )
+
+  it.each([
+    ['POSIX absolute on POSIX', posix, '/orca-ws', true],
+    ['relative on POSIX', posix, '../orca-ws', false],
+    ['Windows drive on POSIX', posix, 'C:\\orca-ws', false],
+    ['Windows UNC on POSIX', posix, '\\\\wsl$\\Ubuntu\\home\\me\\ws', false],
+    ['POSIX absolute on Windows', win32, '/orca-ws', true],
+    ['relative on Windows', win32, '..\\orca-ws', false],
+    ['Windows drive on Windows', win32, 'C:\\orca-ws', true],
+    ['Windows UNC on Windows', win32, '\\\\wsl$\\Ubuntu\\home\\me\\ws', true]
+  ])(
+    'grants an unanchored %s workspace directory only when that host reads it as absolute',
+    (_case, hostPath, dir, granted) => {
+      expect(resolveUnanchoredWorkspaceRoot(dir, hostPath) !== null).toBe(granted)
+    }
+  )
+})
diff --git a/src/main/ipc/filesystem-download-lifetime.test.ts b/src/main/ipc/filesystem-download-lifetime.test.ts
new file mode 100644
index 00000000000..037c3329be3
--- /dev/null
+++ b/src/main/ipc/filesystem-download-lifetime.test.ts
@@ -0,0 +1,342 @@
+import { EventEmitter } from 'node:events'
+import { resolve } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Store } from '../persistence'
+
+const mocks = vi.hoisted(() => ({
+  handlers: new Map<string, (...args: unknown[]) => Promise<unknown>>(),
+  showSaveDialog: vi.fn(),
+  stat: vi.fn(),
+  open: vi.fn(),
+  rename: vi.fn(),
+  rm: vi.fn()
+}))
+vi.mock('electron', () => ({
+  BrowserWindow: { fromWebContents: () => null },
+  dialog: { showSaveDialog: mocks.showSaveDialog },
+  ipcMain: {
+    handle: (name: string, handler: (...args: unknown[]) => Promise<unknown>) =>
+      mocks.handlers.set(name, handler)
+  }
+}))
+vi.mock('node:fs/promises', () => ({ ...mocks, writeFile: vi.fn() }))
+vi.mock('./filesystem-download-folder', () => ({
+  registerFilesystemDownloadFolderHandlers: vi.fn()
+}))
+vi.mock('../providers/ssh-filesystem-dispatch', () => ({ requireSshFilesystemProvider: vi.fn() }))
+
+import { createFilesystemHandlerContext } from './filesystem/filesystem-handler-context'
+import { registerFilesystemDownloadHandlers } from './filesystem/filesystem-download-handlers'
+import { DOWNLOAD_SESSION_TTL_MS } from './filesystem/filesystem-download-promotion'
+
+const destination = resolve('fake-downloads', 'file.txt')
+const lifetimeEvents = ['destroyed', 'render-process-gone', 'did-navigate'] as const
+const senders: EventEmitter[] = []
+let context: ReturnType<typeof createFilesystemHandlerContext>
+
+function makeSender(id = 1) {
+  const sender = Object.assign(new EventEmitter(), { id, isDestroyed: vi.fn(() => false) })
+  sender.setMaxListeners(0)
+  senders.push(sender)
+  return sender
+}
+
+function makeHandle() {
+  return { close: vi.fn(async () => {}), writeFile: vi.fn(async () => {}) }
+}
+
+function invoke(name: string, sender: ReturnType<typeof makeSender>, args: unknown) {
+  const handler = mocks.handlers.get(`fs:${name}`)
+  if (!handler) {
+    throw new Error(`Missing handler: ${name}`)
+  }
+  return handler({ sender }, args)
+}
+
+async function start(sender: ReturnType<typeof makeSender>) {
+  const result = await invoke('startDownloadedFile', sender, { suggestedName: 'file.txt' })
+  if (
+    !result ||
+    typeof result !== 'object' ||
+    !('transferId' in result) ||
+    typeof result.transferId !== 'string'
+  ) {
+    throw new Error('Download did not start')
+  }
+  return result.transferId
+}
+
+function expectNoListeners(sender: ReturnType<typeof makeSender>) {
+  for (const event of lifetimeEvents) {
+    expect(sender.listenerCount(event)).toBe(0)
+  }
+}
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  vi.useFakeTimers()
+  mocks.handlers.clear()
+  mocks.showSaveDialog.mockResolvedValue({ canceled: false, filePath: destination })
+  mocks.stat.mockRejectedValue(Object.assign(new Error('missing'), { code: 'ENOENT' }))
+  mocks.open.mockImplementation(async () => makeHandle())
+  mocks.rename.mockResolvedValue(undefined)
+  mocks.rm.mockResolvedValue(undefined)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Download handlers never access the store; unrelated handlers are not registered.
+  const store = {} as Store
+  const cancellations = { begin: () => null, finish: () => {}, cancel: () => {} }
+  context = createFilesystemHandlerContext(store, undefined, cancellations, cancellations)
+  registerFilesystemDownloadHandlers(context)
+})
+
+afterEach(async () => {
+  await Promise.all(
+    [...context.downloadSessions.keys()].map((id) => context.closeDownloadSession(id, true))
+  )
+  for (const sender of senders.splice(0)) {
+    sender.removeAllListeners()
+  }
+  vi.clearAllTimers()
+  vi.useRealTimers()
+})
+
+describe('chunked download renderer ownership', () => {
+  it('releases all renderer listeners after twenty alternating finish and cancel calls', async () => {
+    const sender = makeSender()
+    for (let index = 0; index < 20; index += 1) {
+      const transferId = await start(sender)
+      await invoke(index % 2 ? 'finishDownloadedFile' : 'cancelDownloadedFile', sender, {
+        transferId
+      })
+    }
+    expect(context.downloadSessions.size).toBe(0)
+    expectNoListeners(sender)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('does not open a dialog for an already destroyed renderer', async () => {
+    const sender = makeSender()
+    sender.isDestroyed.mockReturnValue(true)
+    await expect(
+      invoke('startDownloadedFile', sender, { suggestedName: 'file.txt' })
+    ).resolves.toEqual({ canceled: true })
+    expect(mocks.showSaveDialog).not.toHaveBeenCalled()
+    expectNoListeners(sender)
+  })
+
+  it.each(
+    lifetimeEvents.flatMap((event) =>
+      (['dialog', 'stat', 'open'] as const).map((phase) => ({ event, phase }))
+    )
+  )('cancels pending $phase work after $event', async ({ event, phase }) => {
+    const sender = makeSender()
+    const held = Promise.withResolvers<unknown>()
+    const operation =
+      phase === 'dialog' ? mocks.showSaveDialog : phase === 'stat' ? mocks.stat : mocks.open
+    const callsBefore = operation.mock.calls.length
+    const opensBefore = mocks.open.mock.calls.length
+    operation.mockReturnValueOnce(held.promise)
+    const pending = invoke('startDownloadedFile', sender, { suggestedName: 'file.txt' })
+    await vi.waitFor(() => expect(operation).toHaveBeenCalledTimes(callsBefore + 1))
+    sender.emit(event)
+    expectNoListeners(sender)
+    const handle = makeHandle()
+    held.resolve(
+      phase === 'dialog'
+        ? { canceled: false, filePath: destination }
+        : phase === 'stat'
+          ? { isDirectory: () => false }
+          : handle
+    )
+    await expect(pending).resolves.toEqual({ canceled: true })
+    expect(context.downloadSessions.size).toBe(0)
+    expect(handle.close).toHaveBeenCalledTimes(phase === 'open' ? 1 : 0)
+    expect(mocks.open).toHaveBeenCalledTimes(opensBefore + (phase === 'open' ? 1 : 0))
+    if (phase === 'open') {
+      expect(mocks.rm).toHaveBeenCalledWith(mocks.open.mock.calls.at(-1)?.[0], { force: true })
+    }
+    expectNoListeners(sender)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it.each(['dialog', 'stat', 'open'] as const)(
+    'releases ownership when %s rejects',
+    async (phase) => {
+      const sender = makeSender()
+      const error = new Error(`${phase} failed`)
+      const operation =
+        phase === 'dialog' ? mocks.showSaveDialog : phase === 'stat' ? mocks.stat : mocks.open
+      operation.mockRejectedValueOnce(error)
+      await expect(
+        invoke('startDownloadedFile', sender, { suggestedName: 'file.txt' })
+      ).rejects.toBe(error)
+      expectNoListeners(sender)
+      expect(context.downloadSessions.size).toBe(0)
+      expect(vi.getTimerCount()).toBe(0)
+    }
+  )
+
+  it('releases ownership when the user cancels the dialog', async () => {
+    const sender = makeSender()
+    mocks.showSaveDialog.mockResolvedValueOnce({ canceled: true })
+    await expect(
+      invoke('startDownloadedFile', sender, { suggestedName: 'file.txt' })
+    ).resolves.toEqual({ canceled: true })
+    expectNoListeners(sender)
+    expect(mocks.open).not.toHaveBeenCalled()
+  })
+
+  it.each(lifetimeEvents)(
+    'closes only live sessions owned by the renderer on %s',
+    async (event) => {
+      const first = makeSender(1),
+        second = makeSender(2)
+      const handles = [makeHandle(), makeHandle(), makeHandle()]
+      for (const handle of handles) {
+        mocks.open.mockResolvedValueOnce(handle)
+      }
+      const firstId = await start(first),
+        secondId = await start(first),
+        otherId = await start(second)
+      first.emit(event)
+      await vi.waitFor(() => expect(mocks.rm).toHaveBeenCalledTimes(2))
+      expect([...context.downloadSessions.keys()]).toEqual([otherId])
+      expect(handles[0].close).toHaveBeenCalledOnce()
+      expect(handles[1].close).toHaveBeenCalledOnce()
+      expect(handles[2].close).not.toHaveBeenCalled()
+      expectNoListeners(first)
+      await invoke('cancelDownloadedFile', first, { transferId: firstId })
+      await invoke('cancelDownloadedFile', first, { transferId: secondId })
+      expect(handles[0].close).toHaveBeenCalledOnce()
+      expect(handles[1].close).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('keeps a concurrent session owned after its sibling finishes', async () => {
+    const sender = makeSender(),
+      firstHandle = makeHandle(),
+      secondHandle = makeHandle()
+    mocks.open.mockResolvedValueOnce(firstHandle).mockResolvedValueOnce(secondHandle)
+    const firstId = await start(sender),
+      secondId = await start(sender)
+    await invoke('finishDownloadedFile', sender, { transferId: firstId })
+    sender.emit('destroyed')
+    await vi.waitFor(() => expect(secondHandle.close).toHaveBeenCalledOnce())
+    expect(context.downloadSessions.has(secondId)).toBe(false)
+    expect(firstHandle.close).toHaveBeenCalledOnce()
+    expectNoListeners(sender)
+  })
+
+  it.each(['did-start-navigation', 'did-navigate-in-page'])(
+    'keeps a live document transfer across %s',
+    async (event) => {
+      const sender = makeSender(),
+        transferId = await start(sender)
+      sender.emit(event)
+      expect(context.downloadSessions.has(transferId)).toBe(true)
+      await invoke('appendDownloadedFileChunk', sender, {
+        transferId,
+        contentBase64: Buffer.from('bytes').toString('base64')
+      })
+      const handle = context.downloadSessions.get(transferId)?.handle
+      expect(handle?.writeFile).toHaveBeenCalledWith(Buffer.from('bytes'))
+    }
+  )
+
+  it('does not cancel a replacement sender with the same numeric id', async () => {
+    const oldSender = makeSender(7),
+      replacement = makeSender(7)
+    await start(oldSender)
+    const current = await start(replacement)
+    oldSender.emit('destroyed')
+    expect(context.downloadSessions.has(current)).toBe(true)
+    expect(context.downloadSessions.size).toBe(1)
+    expectNoListeners(oldSender)
+  })
+
+  it('does not let a late old-document open affect a replacement download', async () => {
+    const sender = makeSender(),
+      late = makeHandle(),
+      current = makeHandle()
+    const held = Promise.withResolvers<ReturnType<typeof makeHandle>>()
+    mocks.open.mockReturnValueOnce(held.promise).mockResolvedValueOnce(current)
+    const pending = invoke('startDownloadedFile', sender, { suggestedName: 'file.txt' })
+    await vi.waitFor(() => expect(mocks.open).toHaveBeenCalledOnce())
+    sender.emit('did-navigate')
+    const transferId = await start(sender)
+    held.resolve(late)
+    await expect(pending).resolves.toEqual({ canceled: true })
+    expect([...context.downloadSessions.keys()]).toEqual([transferId])
+    expect(late.close).toHaveBeenCalledOnce()
+    expect(current.close).not.toHaveBeenCalled()
+    await invoke('finishDownloadedFile', sender, { transferId })
+    expect(current.close).toHaveBeenCalledOnce()
+    expectNoListeners(sender)
+  })
+
+  it('cleans a late temporary path even if handle close and removal both fail', async () => {
+    const sender = makeSender(),
+      handle = makeHandle()
+    const held = Promise.withResolvers<ReturnType<typeof makeHandle>>()
+    handle.close.mockRejectedValueOnce(new Error('close failed'))
+    mocks.open.mockReturnValueOnce(held.promise)
+    mocks.rm.mockRejectedValueOnce(new Error('remove failed'))
+    const pending = invoke('startDownloadedFile', sender, { suggestedName: 'file.txt' })
+    await vi.waitFor(() => expect(mocks.open).toHaveBeenCalledOnce())
+    sender.emit('destroyed')
+    held.resolve(handle)
+    await expect(pending).resolves.toEqual({ canceled: true })
+    expectNoListeners(sender)
+    expect(handle.close).toHaveBeenCalledOnce()
+    expect(mocks.rm).toHaveBeenCalledExactlyOnceWith(mocks.open.mock.calls[0][0], { force: true })
+    expect(context.downloadSessions.size).toBe(0)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('releases owner listeners before waiting for a canceled handle to close', async () => {
+    const sender = makeSender(),
+      handle = makeHandle(),
+      held = Promise.withResolvers<void>()
+    handle.close.mockReturnValueOnce(held.promise)
+    mocks.open.mockResolvedValueOnce(handle)
+    const transferId = await start(sender)
+    const pending = invoke('cancelDownloadedFile', sender, { transferId })
+    try {
+      expectNoListeners(sender)
+      expect(context.downloadSessions.size).toBe(0)
+      sender.emit('destroyed')
+      expect(handle.close).toHaveBeenCalledOnce()
+    } finally {
+      held.resolve()
+      await pending
+    }
+  })
+
+  it('releases ownership on timeout and does not close again after later owner events', async () => {
+    const sender = makeSender(),
+      handle = makeHandle()
+    mocks.open.mockResolvedValueOnce(handle)
+    await start(sender)
+    await vi.advanceTimersByTimeAsync(DOWNLOAD_SESSION_TTL_MS)
+    expectNoListeners(sender)
+    expect(context.downloadSessions.size).toBe(0)
+    expect(handle.close).toHaveBeenCalledOnce()
+    expect(mocks.rm).toHaveBeenCalledOnce()
+    sender.emit('destroyed')
+    expect(handle.close).toHaveBeenCalledOnce()
+  })
+
+  it('keeps ownership cleanup when promotion fails or handle close rejects', async () => {
+    const sender = makeSender(),
+      handle = makeHandle()
+    handle.close.mockRejectedValueOnce(new Error('close failed'))
+    mocks.open.mockResolvedValueOnce(handle)
+    mocks.rename.mockRejectedValueOnce(new Error('promotion failed'))
+    const transferId = await start(sender)
+    await expect(invoke('finishDownloadedFile', sender, { transferId })).rejects.toThrow(
+      'promotion failed'
+    )
+    expectNoListeners(sender)
+    expect(mocks.rm).toHaveBeenCalledOnce()
+    expect(handle.close).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/ipc/filesystem-download-transfers.test.ts b/src/main/ipc/filesystem-download-transfers.test.ts
index 9d031ff4d39..227372c567d 100644
--- a/src/main/ipc/filesystem-download-transfers.test.ts
+++ b/src/main/ipc/filesystem-download-transfers.test.ts
@@ -261,10 +261,9 @@ describe('registerFilesystemHandlers', () => {
     statMock.mockRejectedValue(Object.assign(new Error('missing'), { code: 'ENOENT' }))
     registerFilesystemHandlers(store as never)
 
-    const started = await handlers.get('fs:startDownloadedFile')!(
-      { sender: {} },
-      { suggestedName: 'report.pdf' }
-    )
+    const started = await handlers.get('fs:startDownloadedFile')!(folderDownloadEvent, {
+      suggestedName: 'report.pdf'
+    })
     expect(started).toMatchObject({
       canceled: false,
       destinationPath: '/downloads/report.pdf'
@@ -300,10 +299,9 @@ describe('registerFilesystemHandlers', () => {
     statMock.mockRejectedValue(Object.assign(new Error('missing'), { code: 'ENOENT' }))
     registerFilesystemHandlers(store as never)
 
-    const started = await handlers.get('fs:startDownloadedFile')!(
-      { sender: {} },
-      { suggestedName: 'report.pdf' }
-    )
+    const started = await handlers.get('fs:startDownloadedFile')!(folderDownloadEvent, {
+      suggestedName: 'report.pdf'
+    })
     if (!started || typeof started !== 'object' || !('transferId' in started)) {
       throw new Error('download did not start')
     }
diff --git a/src/main/ipc/filesystem-git-status-staging.test.ts b/src/main/ipc/filesystem-git-status-staging.test.ts
index 5cc1b4e9540..b86a75b2314 100644
--- a/src/main/ipc/filesystem-git-status-staging.test.ts
+++ b/src/main/ipc/filesystem-git-status-staging.test.ts
@@ -1,3 +1,4 @@
+import { EventEmitter } from 'node:events'
 import path from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import {
@@ -305,42 +306,51 @@ describe('registerFilesystemHandlers', () => {
     })
   })
 
-  it('aborts tokenized local status without crossing renderer boundaries', async () => {
-    registerWorktreeRootsForRepo(store as never, 'repo-1', [REPO_PATH, WORKTREE_FEATURE_PATH])
-    const statusSignals: AbortSignal[] = []
-    getStatusMock.mockImplementation(
-      (_worktreePath: string, options: { signal?: AbortSignal }) =>
-        new Promise((_resolve, reject) => {
-          if (options.signal) {
-            statusSignals.push(options.signal)
-            options.signal.addEventListener('abort', () => reject(new Error('aborted')), {
-              once: true
-            })
-          }
-        })
-    )
-    registerFilesystemHandlers(store as never)
+  it.each(['cancel', 'did-navigate', 'render-process-gone', 'destroyed'])(
+    'aborts tokenized local status on %s without crossing renderer boundaries',
+    async (eventName) => {
+      registerWorktreeRootsForRepo(store as never, 'repo-1', [REPO_PATH, WORKTREE_FEATURE_PATH])
+      const statusSignals: AbortSignal[] = []
+      getStatusMock.mockImplementation(
+        (_worktreePath: string, options: { signal?: AbortSignal }) =>
+          new Promise((_resolve, reject) => {
+            if (options.signal) {
+              statusSignals.push(options.signal)
+              options.signal.addEventListener('abort', () => reject(new Error('aborted')), {
+                once: true
+              })
+            }
+          })
+      )
+      registerFilesystemHandlers(store as never)
 
-    const firstEvent = { sender: { id: 7 } }
-    const secondEvent = { sender: { id: 8 } }
-    const firstRequest = handlers.get('git:status')!(firstEvent, {
-      worktreePath: WORKTREE_FEATURE_PATH,
-      requestToken: 'status-1'
-    }) as Promise<unknown>
-    const secondRequest = handlers.get('git:status')!(secondEvent, {
-      worktreePath: WORKTREE_FEATURE_PATH,
-      requestToken: 'status-1'
-    }) as Promise<unknown>
-    await vi.waitFor(() => expect(statusSignals).toHaveLength(2))
-    await handlers.get('git:cancelStatus')!(firstEvent, { requestToken: 'status-1' })
+      const firstEvent = { sender: Object.assign(new EventEmitter(), { id: 7 }) }
+      const secondEvent = { sender: Object.assign(new EventEmitter(), { id: 8 }) }
+      const firstRequest = handlers.get('git:status')!(firstEvent, {
+        worktreePath: WORKTREE_FEATURE_PATH,
+        requestToken: 'status-1'
+      }) as Promise<unknown>
+      const secondRequest = handlers.get('git:status')!(secondEvent, {
+        worktreePath: WORKTREE_FEATURE_PATH,
+        requestToken: 'status-1'
+      }) as Promise<unknown>
+      await vi.waitFor(() => expect(statusSignals).toHaveLength(2))
+      if (eventName === 'cancel') {
+        await handlers.get('git:cancelStatus')!(firstEvent, { requestToken: 'status-1' })
+      } else {
+        firstEvent.sender.emit(eventName)
+      }
 
-    expect(statusSignals[0]?.aborted).toBe(true)
-    expect(statusSignals[1]?.aborted).toBe(false)
-    await expect(firstRequest).rejects.toThrow('aborted')
+      expect(statusSignals[0]?.aborted).toBe(true)
+      expect(statusSignals[1]?.aborted).toBe(false)
+      await expect(firstRequest).rejects.toThrow('aborted')
 
-    await handlers.get('git:cancelStatus')!(secondEvent, { requestToken: 'status-1' })
-    await expect(secondRequest).rejects.toThrow('aborted')
-  })
+      await handlers.get('git:cancelStatus')!(secondEvent, { requestToken: 'status-1' })
+      await expect(secondRequest).rejects.toThrow('aborted')
+      expect(firstEvent.sender.eventNames()).toEqual([])
+      expect(secondEvent.sender.eventNames()).toEqual([])
+    }
+  )
 
   it('checks ignored paths through local and SSH git providers', async () => {
     registerWorktreeRootsForRepo(store as never, 'repo-1', [REPO_PATH, WORKTREE_FEATURE_PATH])
diff --git a/src/main/ipc/filesystem-import-local-rollback.test.ts b/src/main/ipc/filesystem-import-local-rollback.test.ts
new file mode 100644
index 00000000000..364c6c88eee
--- /dev/null
+++ b/src/main/ipc/filesystem-import-local-rollback.test.ts
@@ -0,0 +1,254 @@
+import { constants } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { Readable, Writable } from 'node:stream'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { lstatMock, mkdirMock, openMock, readdirMock, rmMock, unlinkMock } = vi.hoisted(() => ({
+  lstatMock: vi.fn(),
+  mkdirMock: vi.fn(),
+  openMock: vi.fn(),
+  readdirMock: vi.fn(),
+  rmMock: vi.fn(),
+  unlinkMock: vi.fn()
+}))
+
+vi.mock('./filesystem-auth', () => ({ authorizeExternalPath: vi.fn() }))
+vi.mock('node:fs/promises', () => ({
+  lstat: lstatMock,
+  mkdir: mkdirMock,
+  open: openMock,
+  readdir: readdirMock,
+  rm: rmMock,
+  unlink: unlinkMock
+}))
+
+import { importOneSource } from './filesystem-import-local'
+import { recursiveCopyDir } from './filesystem-import-local-tree-copy'
+
+type EntryKind = 'directory' | 'file' | 'symlink' | 'unsupported'
+
+function statFor(kind: EntryKind) {
+  return {
+    size: 7,
+    ino: 1,
+    dev: 1,
+    isDirectory: () => kind === 'directory',
+    isFile: () => kind === 'file',
+    isSymbolicLink: () => kind === 'symlink'
+  }
+}
+
+const source = resolve('import-fixture', 'incoming')
+const destination = resolve('import-fixture', 'folder-workspace')
+const target = join(destination, 'incoming')
+const stats = new Map<string, ReturnType<typeof statFor>>()
+const entries = new Map<string, { name: string; kind: EntryKind }[]>()
+
+function addEntry(parent: string, name: string, kind: EntryKind): string {
+  const path = join(parent, name)
+  stats.set(path, statFor(kind))
+  entries.set(parent, [...(entries.get(parent) ?? []), { name, kind }])
+  return path
+}
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  stats.clear()
+  entries.clear()
+  stats.set(source, statFor('directory'))
+  lstatMock.mockImplementation(async (path: string) => {
+    const stat = stats.get(path)
+    if (stat) {
+      return stat
+    }
+    throw Object.assign(new Error('missing'), { code: 'ENOENT' })
+  })
+  readdirMock.mockImplementation(async (path: string) =>
+    (entries.get(path) ?? []).map(({ name, kind }) => ({ name, ...statFor(kind) }))
+  )
+  mkdirMock.mockResolvedValue(undefined)
+  rmMock.mockResolvedValue(undefined)
+  unlinkMock.mockResolvedValue(undefined)
+  openMock.mockRejectedValue(new Error('unexpected file copy'))
+})
+
+describe('local directory import rollback ownership', () => {
+  it.each(['EEXIST', 'EACCES', 'EPERM'])(
+    'does not remove output after root mkdir %s',
+    async (code) => {
+      mkdirMock.mockRejectedValue(Object.assign(new Error(code), { code }))
+
+      expect(await importOneSource(source, destination, new Set())).toEqual({
+        sourcePath: source,
+        status: 'failed',
+        reason: code
+      })
+      expect(mkdirMock).toHaveBeenCalledExactlyOnceWith(target, { recursive: false })
+      expect(rmMock).not.toHaveBeenCalled()
+      expect(openMock).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['existing', 'reserved'])(
+    'preserves a late conflict after deconflicting a %s name',
+    async (conflict) => {
+      const reserved = new Set<string>()
+      if (conflict === 'existing') {
+        stats.set(target, statFor('directory'))
+      } else {
+        reserved.add('incoming')
+      }
+      mkdirMock.mockRejectedValue(Object.assign(new Error('late conflict'), { code: 'EEXIST' }))
+
+      expect(await importOneSource(source, destination, reserved)).toMatchObject({
+        status: 'failed'
+      })
+      expect(mkdirMock).toHaveBeenCalledExactlyOnceWith(join(destination, 'incoming copy'), {
+        recursive: false
+      })
+      expect(rmMock).not.toHaveBeenCalled()
+    }
+  )
+
+  it('cleans its directory when reading it fails after creation', async () => {
+    readdirMock.mockResolvedValueOnce([]).mockRejectedValueOnce(new Error('source unreadable'))
+
+    expect(await importOneSource(source, destination, new Set())).toMatchObject({
+      status: 'failed',
+      reason: 'source unreadable'
+    })
+    expect(rmMock).toHaveBeenCalledExactlyOnceWith(target, { recursive: true, force: true })
+  })
+
+  it('keeps the copy error when best-effort cleanup also fails', async () => {
+    addEntry(source, 'lost.txt', 'file')
+    openMock.mockRejectedValue(new Error('source changed'))
+    rmMock.mockRejectedValue(new Error('cleanup denied'))
+
+    expect(await importOneSource(source, destination, new Set())).toMatchObject({
+      status: 'failed',
+      reason: 'source changed'
+    })
+    expect(rmMock).toHaveBeenCalledExactlyOnceWith(target, { recursive: true, force: true })
+  })
+
+  it('rolls back the owned root once when a nested mkdir fails', async () => {
+    addEntry(source, 'child', 'directory')
+    mkdirMock.mockResolvedValueOnce(undefined).mockRejectedValueOnce(new Error('nested conflict'))
+
+    expect(await importOneSource(source, destination, new Set())).toMatchObject({
+      status: 'failed',
+      reason: 'nested conflict'
+    })
+    expect(mkdirMock.mock.calls).toEqual([
+      [target, { recursive: false }],
+      [join(target, 'child'), { recursive: false }]
+    ])
+    expect(rmMock).toHaveBeenCalledExactlyOnceWith(target, { recursive: true, force: true })
+  })
+
+  it.each(['symlink', 'unsupported', 'missing'])(
+    'rolls back the owned root once when a nested entry becomes %s',
+    async (kind) => {
+      const child = addEntry(source, 'child', 'directory')
+      const file = addEntry(child, 'changed.txt', 'file')
+      if (kind === 'missing') {
+        stats.delete(file)
+      } else {
+        stats.set(file, statFor(kind === 'symlink' ? 'symlink' : 'unsupported'))
+      }
+
+      expect(await importOneSource(source, destination, new Set())).toMatchObject({
+        status: 'failed'
+      })
+      expect(mkdirMock).toHaveBeenCalledTimes(2)
+      expect(rmMock).toHaveBeenCalledExactlyOnceWith(target, { recursive: true, force: true })
+      expect(openMock).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['top-level', 'nested'])(
+    'skips a %s symlink before creating output',
+    async (location) => {
+      if (location === 'top-level') {
+        stats.set(source, statFor('symlink'))
+      } else {
+        addEntry(addEntry(source, 'child', 'directory'), 'link', 'symlink')
+      }
+
+      expect(await importOneSource(source, destination, new Set())).toMatchObject({
+        status: 'skipped',
+        reason: 'symlink'
+      })
+      expect(mkdirMock).not.toHaveBeenCalled()
+      expect(rmMock).not.toHaveBeenCalled()
+    }
+  )
+
+  it('copies nested files with exclusive destinations and preserves rename metadata', async () => {
+    const file = addEntry(addEntry(source, 'child', 'directory'), 'data.txt', 'file')
+    const renamedTarget = join(destination, 'incoming copy')
+    const chunks: Buffer[] = []
+    const closeSource = vi.fn().mockResolvedValue(undefined)
+    const closeDestination = vi.fn().mockResolvedValue(undefined)
+    openMock.mockImplementation(async (_path: string, flags: unknown) => {
+      if (flags === 'wx') {
+        return {
+          createWriteStream: () =>
+            new Writable({
+              write(chunk, _encoding, callback) {
+                chunks.push(Buffer.from(chunk))
+                callback()
+              }
+            }),
+          close: closeDestination
+        }
+      }
+      return {
+        stat: async () => statFor('file'),
+        createReadStream: () => Readable.from([Buffer.from('payload')]),
+        close: closeSource
+      }
+    })
+
+    expect(await importOneSource(source, destination, new Set(['incoming']))).toEqual({
+      sourcePath: source,
+      status: 'imported',
+      destPath: renamedTarget,
+      kind: 'directory',
+      renamed: true
+    })
+    expect(mkdirMock.mock.calls).toEqual([
+      [renamedTarget, { recursive: false }],
+      [join(renamedTarget, 'child'), { recursive: false }]
+    ])
+    expect(openMock.mock.calls).toEqual([
+      [file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0)],
+      [join(renamedTarget, 'child', 'data.txt'), 'wx']
+    ])
+    expect(Buffer.concat(chunks).toString()).toBe('payload')
+    expect(closeSource).toHaveBeenCalledOnce()
+    expect(closeDestination).toHaveBeenCalledOnce()
+    expect(rmMock).not.toHaveBeenCalled()
+    expect(unlinkMock).not.toHaveBeenCalled()
+  })
+
+  it('leaves directory cleanup out of a top-level file failure', async () => {
+    stats.set(source, statFor('file'))
+
+    expect(await importOneSource(source, destination, new Set())).toMatchObject({
+      status: 'failed'
+    })
+    expect(mkdirMock).not.toHaveBeenCalled()
+    expect(rmMock).not.toHaveBeenCalled()
+    expect(unlinkMock).not.toHaveBeenCalled()
+  })
+
+  it('cleans an owned root when the copy helper is called directly', async () => {
+    const failure = new Error('read failed')
+    readdirMock.mockRejectedValue(failure)
+
+    await expect(recursiveCopyDir(source, target)).rejects.toBe(failure)
+    expect(rmMock).toHaveBeenCalledExactlyOnceWith(target, { recursive: true, force: true })
+  })
+})
diff --git a/src/main/ipc/filesystem-import-local-tree-copy.ts b/src/main/ipc/filesystem-import-local-tree-copy.ts
index f2eb3492377..06d68368ce9 100644
--- a/src/main/ipc/filesystem-import-local-tree-copy.ts
+++ b/src/main/ipc/filesystem-import-local-tree-copy.ts
@@ -1,5 +1,5 @@
 import { constants } from 'node:fs'
-import { lstat, mkdir, open, readdir, unlink } from 'node:fs/promises'
+import { lstat, mkdir, open, readdir, rm, unlink } from 'node:fs/promises'
 import { basename, join } from 'node:path'
 import { pipeline } from 'node:stream/promises'
 
@@ -23,13 +23,18 @@ export async function preScanForSymlinks(dirPath: string): Promise<boolean> {
   return false
 }
 
-/**
- * Recursively copy a directory and all its contents. Uses copyFile for
- * individual files to leverage native OS copy primitives instead of
- * buffering entire files into memory.
- */
 export async function recursiveCopyDir(srcDir: string, destDir: string): Promise<void> {
+  // A failed exclusive mkdir gives us no ownership to roll back.
   await mkdir(destDir, { recursive: false })
+  try {
+    await copyDirectoryContents(srcDir, destDir)
+  } catch (error) {
+    await rm(destDir, { recursive: true, force: true }).catch(() => {})
+    throw error
+  }
+}
+
+async function copyDirectoryContents(srcDir: string, destDir: string): Promise<void> {
   const entries = await readdir(srcDir, { withFileTypes: true })
   for (const entry of entries) {
     const srcPath = join(srcDir, entry.name)
@@ -39,7 +44,8 @@ export async function recursiveCopyDir(srcDir: string, destDir: string): Promise
       throw new Error(`Symlink not allowed in '${entry.name}'`)
     }
     if (statResult.isDirectory()) {
-      await recursiveCopyDir(srcPath, dstPath)
+      await mkdir(dstPath, { recursive: false })
+      await copyDirectoryContents(srcPath, dstPath)
       continue
     }
     if (!statResult.isFile()) {
diff --git a/src/main/ipc/filesystem-import-local.ts b/src/main/ipc/filesystem-import-local.ts
index 1df2b3f2fb3..c77d841a53d 100644
--- a/src/main/ipc/filesystem-import-local.ts
+++ b/src/main/ipc/filesystem-import-local.ts
@@ -1,4 +1,4 @@
-import { lstat, rm } from 'node:fs/promises'
+import { lstat } from 'node:fs/promises'
 import { basename, join, resolve } from 'node:path'
 import { authorizeExternalPath } from './filesystem-auth'
 import { isENOENT } from './filesystem-path-containment'
@@ -82,9 +82,6 @@ export async function importOneSource(
       ? recursiveCopyDir(resolvedSource, destPath)
       : copyLocalFileNoFollow(resolvedSource, destPath))
   } catch (error) {
-    if (isDir) {
-      await rm(destPath, { recursive: true, force: true }).catch(() => {})
-    }
     return {
       sourcePath,
       status: 'failed',
diff --git a/src/main/ipc/filesystem-markdown-document-listing.test.ts b/src/main/ipc/filesystem-markdown-document-listing.test.ts
index d70d46c48e1..be94530352d 100644
--- a/src/main/ipc/filesystem-markdown-document-listing.test.ts
+++ b/src/main/ipc/filesystem-markdown-document-listing.test.ts
@@ -1,15 +1,28 @@
 import path from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as MarkdownDocumentsModule from './markdown-documents'
 import {
   handlers,
   store,
-  dirEntry,
   WORKTREE_FEATURE_PATH,
   readdirMock,
   getSshFilesystemProviderMock,
   resetFilesystemIpcMocks
 } from './filesystem-test-harness'
 
+const { listMarkdownDocumentsMock, localOptionsMock } = vi.hoisted(() => ({
+  listMarkdownDocumentsMock: vi.fn(),
+  localOptionsMock: vi.fn()
+}))
+
+vi.mock('./markdown-documents', async (importOriginal) => ({
+  ...(await importOriginal<typeof MarkdownDocumentsModule>()),
+  listMarkdownDocuments: listMarkdownDocumentsMock
+}))
+vi.mock('./local-worktree-runtime-options', () => ({
+  getLocalGitOptionsForRegisteredWorktree: localOptionsMock
+}))
+
 vi.mock('electron', async () => (await import('./filesystem-test-harness')).electronMock)
 vi.mock('fs/promises', async () => (await import('./filesystem-test-harness')).fsPromisesMock)
 vi.mock(
@@ -64,95 +77,39 @@ import { invalidateAuthorizedRootsCache } from './registered-worktree-roots-cach
 describe('registerFilesystemHandlers', () => {
   beforeEach(() => {
     resetFilesystemIpcMocks()
+    listMarkdownDocumentsMock.mockReset().mockResolvedValue([])
+    localOptionsMock.mockReset().mockReturnValue({})
     // Reset module-level auth cache so each test starts with a fresh dirty
     // flag — prevents stale worktree data from a prior test's cache rebuild.
     invalidateAuthorizedRootsCache()
   })
 
-  it('lists markdown documents recursively for a registered worktree', async () => {
-    readdirMock.mockImplementation(async (dirPath: string) => {
-      if (dirPath === WORKTREE_FEATURE_PATH) {
-        return [
-          dirEntry({ name: 'README.md', file: true }),
-          dirEntry({ name: 'docs', directory: true }),
-          dirEntry({ name: 'script.ts', file: true })
-        ]
-      }
-      if (dirPath === path.join(WORKTREE_FEATURE_PATH, 'docs')) {
-        return [
-          dirEntry({ name: 'Guide.MDX', file: true }),
-          dirEntry({ name: 'notes.markdown', file: true })
-        ]
-      }
-      return []
-    })
-
+  it('lists local documents through the bundled discovery path after authorization', async () => {
+    const documents = [{ filePath: path.join(WORKTREE_FEATURE_PATH, 'README.md') }]
+    listMarkdownDocumentsMock.mockResolvedValue(documents)
     registerFilesystemHandlers(store as never)
 
     await expect(
-      handlers.get('fs:listMarkdownDocuments')!(null, {
-        rootPath: WORKTREE_FEATURE_PATH
-      })
-    ).resolves.toEqual([
-      {
-        filePath: path.join(WORKTREE_FEATURE_PATH, 'docs', 'Guide.MDX'),
-        relativePath: 'docs/Guide.MDX',
-        basename: 'Guide.MDX',
-        name: 'Guide'
-      },
-      {
-        filePath: path.join(WORKTREE_FEATURE_PATH, 'docs', 'notes.markdown'),
-        relativePath: 'docs/notes.markdown',
-        basename: 'notes.markdown',
-        name: 'notes'
-      },
-      {
-        filePath: path.join(WORKTREE_FEATURE_PATH, 'README.md'),
-        relativePath: 'README.md',
-        basename: 'README.md',
-        name: 'README'
-      }
-    ])
+      handlers.get('fs:listMarkdownDocuments')!(null, { rootPath: WORKTREE_FEATURE_PATH })
+    ).resolves.toBe(documents)
+    expect(localOptionsMock).toHaveBeenCalledWith(
+      store,
+      WORKTREE_FEATURE_PATH,
+      WORKTREE_FEATURE_PATH
+    )
+    expect(listMarkdownDocumentsMock).toHaveBeenCalledWith(WORKTREE_FEATURE_PATH, {})
+    expect(readdirMock).not.toHaveBeenCalled()
   })
 
-  it('skips ignored and symlinked directories when listing markdown documents', async () => {
-    readdirMock.mockImplementation(async (dirPath: string) => {
-      if (dirPath === WORKTREE_FEATURE_PATH) {
-        return [
-          dirEntry({ name: '.git', directory: true }),
-          dirEntry({ name: '.hidden', directory: true }),
-          dirEntry({ name: '.github', directory: true }),
-          dirEntry({ name: 'node_modules', directory: true }),
-          dirEntry({ name: 'linked-docs', directory: true, symlink: true }),
-          dirEntry({ name: 'visible.md', file: true })
-        ]
-      }
-      if (dirPath === path.join(WORKTREE_FEATURE_PATH, '.github')) {
-        return [dirEntry({ name: 'CONTRIBUTING.md', file: true })]
-      }
-      throw new Error(`Unexpected readdir: ${dirPath}`)
-    })
-
+  it('passes the workspace runtime distro into document discovery', async () => {
+    localOptionsMock.mockReturnValue({ wslDistro: 'Ubuntu' })
     registerFilesystemHandlers(store as never)
 
-    await expect(
-      handlers.get('fs:listMarkdownDocuments')!(null, {
-        rootPath: WORKTREE_FEATURE_PATH
-      })
-    ).resolves.toEqual([
-      {
-        filePath: path.join(WORKTREE_FEATURE_PATH, '.github', 'CONTRIBUTING.md'),
-        relativePath: '.github/CONTRIBUTING.md',
-        basename: 'CONTRIBUTING.md',
-        name: 'CONTRIBUTING'
-      },
-      {
-        filePath: path.join(WORKTREE_FEATURE_PATH, 'visible.md'),
-        relativePath: 'visible.md',
-        basename: 'visible.md',
-        name: 'visible'
-      }
-    ])
+    await handlers.get('fs:listMarkdownDocuments')!(null, { rootPath: WORKTREE_FEATURE_PATH })
+
+    expect(listMarkdownDocumentsMock).toHaveBeenCalledWith(WORKTREE_FEATURE_PATH, {
+      wslDistro: 'Ubuntu'
+    })
   })
 
   it('rejects markdown document listing for authorized but unregistered roots', async () => {
@@ -165,6 +122,7 @@ describe('registerFilesystemHandlers', () => {
     ).rejects.toThrow('Access denied: unknown repository or worktree path')
 
     expect(readdirMock).not.toHaveBeenCalled()
+    expect(listMarkdownDocumentsMock).not.toHaveBeenCalled()
   })
 
   it('lists remote markdown documents through the SSH filesystem provider', async () => {
@@ -196,5 +154,7 @@ describe('registerFilesystemHandlers', () => {
         name: 'README'
       }
     ])
+    expect(listMarkdownDocumentsMock).not.toHaveBeenCalled()
+    expect(localOptionsMock).not.toHaveBeenCalled()
   })
 })
diff --git a/src/main/ipc/filesystem-pull-request-linked-issue-lifetime.test.ts b/src/main/ipc/filesystem-pull-request-linked-issue-lifetime.test.ts
new file mode 100644
index 00000000000..e71ea22f7ba
--- /dev/null
+++ b/src/main/ipc/filesystem-pull-request-linked-issue-lifetime.test.ts
@@ -0,0 +1,189 @@
+import { setImmediate as nextTurn } from 'node:timers/promises'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  handlers,
+  store,
+  WORKTREE_FEATURE_PATH,
+  resolveCommitMessageSettingsMock,
+  generatePullRequestFieldsFromContextMock,
+  getPullRequestDraftContextMock,
+  resolveHostedReviewBodyForGenerationMock,
+  loadPullRequestLinkedIssueMock,
+  getSshGitProviderMock,
+  resetFilesystemIpcMocks
+} from './filesystem-test-harness'
+
+const linkedLookup = vi.hoisted(() => ({ run: (): Promise<null> => Promise.resolve(null) }))
+
+vi.mock('electron', async () => (await import('./filesystem-test-harness')).electronMock)
+vi.mock('fs/promises', async () => (await import('./filesystem-test-harness')).fsPromisesMock)
+vi.mock(
+  '../wsl-unc-delete',
+  async () => (await import('./filesystem-test-harness')).wslUncDeleteMock
+)
+vi.mock(
+  '../crash-reporting/crash-breadcrumb-store',
+  async () => (await import('./filesystem-test-harness')).crashBreadcrumbMock
+)
+vi.mock(
+  '../local-downloaded-folder-promotion',
+  async () => (await import('./filesystem-test-harness')).folderPromotionMock
+)
+vi.mock(
+  '../git/status',
+  async () => (await import('./filesystem-test-harness')).gitStatusModuleMock
+)
+vi.mock(
+  '../git/check-ignored-paths',
+  async () => (await import('./filesystem-test-harness')).gitIgnoredPathsMock
+)
+vi.mock('../git/worktree', async () => (await import('./filesystem-test-harness')).gitWorktreeMock)
+vi.mock(
+  '../providers/ssh-filesystem-dispatch',
+  async () => (await import('./filesystem-test-harness')).sshFilesystemDispatchMock
+)
+vi.mock(
+  '../providers/ssh-git-dispatch',
+  async () => (await import('./filesystem-test-harness')).sshGitDispatchMock
+)
+vi.mock(
+  '../text-generation/commit-message-text-generation',
+  async () => (await import('./filesystem-test-harness')).textGenerationModuleMock
+)
+vi.mock(
+  '../text-generation/pull-request-context',
+  async () => (await import('./filesystem-test-harness')).pullRequestContextMock
+)
+vi.mock(
+  '../source-control/pull-request-template',
+  async () => (await import('./filesystem-test-harness')).pullRequestTemplateMock
+)
+vi.mock('../source-control/pull-request-linked-issue', async () => {
+  const { loadPullRequestLinkedIssueMock } = await import('./filesystem-test-harness')
+  return {
+    loadPullRequestLinkedIssue: (...args: unknown[]) => {
+      loadPullRequestLinkedIssueMock(...args)
+      // A vi.fn return observer would itself handle the rejection under test.
+      return linkedLookup.run()
+    }
+  }
+})
+
+import { registerFilesystemHandlers } from './filesystem'
+import { invalidateAuthorizedRootsCache } from './registered-worktree-roots-cache'
+
+describe.each(['local', 'SSH'])('PR linked-issue lifetime on %s', (host) => {
+  const draftContext = {
+    base: 'main',
+    branch: 'feature/ai',
+    branchChangedByPreparation: false,
+    commitSummary: 'a1b2c3d Add generation',
+    changeSummary: 'README.md | 2 +-',
+    patch: '+hello',
+    currentTitle: '',
+    currentBody: '',
+    currentDraft: false
+  }
+  const request = {
+    base: 'main',
+    title: '',
+    body: '',
+    draft: false,
+    worktreePath: host === 'SSH' ? '/remote/repo' : WORKTREE_FEATURE_PATH,
+    ...(host === 'SSH' ? { connectionId: 'conn-1' } : {})
+  }
+
+  beforeEach(() => {
+    resetFilesystemIpcMocks()
+    linkedLookup.run = () => Promise.resolve(null)
+    invalidateAuthorizedRootsCache()
+    resolveCommitMessageSettingsMock.mockReturnValue({
+      ok: true,
+      params: { agentId: 'codex', model: 'gpt-5.4-mini' }
+    })
+    resolveHostedReviewBodyForGenerationMock.mockResolvedValue('')
+    getPullRequestDraftContextMock.mockResolvedValue(draftContext)
+    getSshGitProviderMock.mockReturnValue({
+      exec: vi.fn(),
+      executeCommitMessagePlan: vi.fn()
+    })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The existing IPC harness provides every Store member reached by this handler.
+    registerFilesystemHandlers(store as never)
+  })
+
+  it.each(['no changes', 'context error', 'template error'])(
+    'observes a late lookup rejection after %s',
+    async (outcome) => {
+      const issue = Promise.withResolvers<null>()
+      linkedLookup.run = () => issue.promise
+      const preparationError = new Error('branch preparation failed')
+      if (outcome === 'no changes') {
+        getPullRequestDraftContextMock.mockResolvedValue(null)
+      } else if (outcome === 'context error') {
+        getPullRequestDraftContextMock.mockRejectedValue(preparationError)
+      } else {
+        resolveHostedReviewBodyForGenerationMock.mockRejectedValue(preparationError)
+      }
+      const unhandled = vi.fn()
+      process.on('unhandledRejection', unhandled)
+      try {
+        await expect(
+          handlers.get('git:generatePullRequestFields')!(null, request)
+        ).resolves.toEqual({
+          success: false,
+          error:
+            outcome === 'no changes' ? 'No branch changes to summarize.' : preparationError.message
+        })
+        expect(loadPullRequestLinkedIssueMock).toHaveBeenCalledTimes(1)
+        issue.reject(new Error('Timed out waiting for a GitLab operation slot.'))
+        await nextTurn()
+        expect(unhandled).not.toHaveBeenCalled()
+        expect(generatePullRequestFieldsFromContextMock).not.toHaveBeenCalled()
+      } finally {
+        void issue.promise.catch(() => undefined)
+        process.off('unhandledRejection', unhandled)
+      }
+    }
+  )
+
+  it('observes a lookup rejection while preparation is pending and preserves the later error', async () => {
+    const issue = Promise.withResolvers<null>()
+    const preparation = Promise.withResolvers<typeof draftContext>()
+    const failure = new Error('lookup admission failed')
+    linkedLookup.run = () => issue.promise
+    getPullRequestDraftContextMock.mockReturnValue(preparation.promise)
+    const unhandled = vi.fn()
+    process.on('unhandledRejection', unhandled)
+    const result = Promise.resolve(
+      handlers.get('git:generatePullRequestFields')!(null, request)
+    ).catch((error: unknown) => error)
+    try {
+      await nextTurn()
+      expect(getPullRequestDraftContextMock).toHaveBeenCalledTimes(1)
+      issue.reject(failure)
+      await nextTurn()
+      expect(unhandled).not.toHaveBeenCalled()
+      preparation.resolve(draftContext)
+      expect(await result).toBe(failure)
+      expect(generatePullRequestFieldsFromContextMock).not.toHaveBeenCalled()
+    } finally {
+      issue.resolve(null)
+      preparation.resolve(draftContext)
+      await result
+      process.off('unhandledRejection', unhandled)
+    }
+  })
+
+  it('still rejects the caller when preparation succeeds but the lookup fails', async () => {
+    const issue = Promise.withResolvers<null>()
+    const failure = new Error('lookup failed')
+    linkedLookup.run = () => issue.promise
+    const result = Promise.resolve(
+      handlers.get('git:generatePullRequestFields')!(null, request)
+    ).catch((error: unknown) => error)
+    await nextTurn()
+    issue.reject(failure)
+    expect(await result).toBe(failure)
+    expect(generatePullRequestFieldsFromContextMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/ipc/filesystem-watcher-canonical-root-paths.test.ts b/src/main/ipc/filesystem-watcher-canonical-root-paths.test.ts
index 45c14d485e0..9aa42e3107e 100644
--- a/src/main/ipc/filesystem-watcher-canonical-root-paths.test.ts
+++ b/src/main/ipc/filesystem-watcher-canonical-root-paths.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 /*
  * macOS FSEvents reports OS-canonical paths (symlinks resolved, on-disk
  * casing). Before the rewrite at the watcher boundary those events reached the
@@ -80,7 +81,7 @@ describe('local filesystem watcher canonical root paths', () => {
       return { unsubscribe: vi.fn() } as never
     })
     const sendMock = vi.fn()
-    const sender = { isDestroyed: () => false, send: sendMock, once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1, sendMock)
     await handlers['fs:watchWorktree']({ sender }, { worktreePath })
     watcherCallback!(null, events)
     await vi.waitFor(
diff --git a/src/main/ipc/filesystem-watcher-document-lifetime.test.ts b/src/main/ipc/filesystem-watcher-document-lifetime.test.ts
new file mode 100644
index 00000000000..9bc42d1ef73
--- /dev/null
+++ b/src/main/ipc/filesystem-watcher-document-lifetime.test.ts
@@ -0,0 +1,299 @@
+import { EventEmitter } from 'node:events'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createDebouncedBatch } from './filesystem-watcher-batch-control'
+
+type WatchArgs = { worktreePath: string; connectionId?: string }
+class Sender extends EventEmitter {
+  constructor(readonly id: number) {
+    super()
+  }
+  isDestroyed = () => false
+  send = vi.fn()
+}
+const { handleMock, watchRemote, createLocal, getProvider } = vi.hoisted(() => ({
+  handleMock: vi.fn(),
+  watchRemote: vi.fn(),
+  createLocal: vi.fn(),
+  getProvider: vi.fn()
+}))
+vi.mock('electron', () => ({ ipcMain: { handle: handleMock } }))
+vi.mock('node:fs/promises', () => ({ stat: async () => ({ isDirectory: () => true }) }))
+vi.mock('./filesystem-watcher-local-events', () => ({
+  createLocalWatcher: createLocal,
+  scheduleLocalBatchFlush: vi.fn()
+}))
+vi.mock('./parcel-watcher-process', () => ({ disposeWatcherProcess: vi.fn() }))
+vi.mock('../providers/ssh-filesystem-dispatch', () => ({
+  getSshFilesystemProvider: getProvider,
+  onSshFilesystemProviderRegistered: () => () => {}
+}))
+import {
+  REMOTE_WATCH_RETRY_MS,
+  watcherLifecycleState as state
+} from './filesystem-watcher-lifecycle-state'
+import { getLocalWatcherRoot, getRemoteWatcherKey } from './filesystem-watcher-paths'
+import { reinstallRemoteWatchersForConnection } from './filesystem-watcher-remote-controller'
+import { reinstallRemoteWatchersForConnectionCore } from './filesystem-watcher-remote-provider-rearm'
+import {
+  registerFilesystemWatcherHandlers,
+  closeAllWatchers,
+  closeLocalWatcherForWorktreePath,
+  closeRemoteWatcherForWorktreePath,
+  restoreLocalWatcherAfterFailedRemoval,
+  restoreRemoteWatcherAfterFailedRemoval
+} from './filesystem-watcher'
+
+const handlers = new Map<string, (event: { sender: Sender }, args: WatchArgs) => Promise<void>>()
+function invoke(channel: string, sender: Sender, args: WatchArgs): Promise<void> {
+  const handler = handlers.get(channel)
+  if (!handler) {
+    throw new Error(`Missing ${channel}`)
+  }
+  return handler({ sender }, args)
+}
+const watch = (sender: Sender, args: WatchArgs) => invoke('fs:watchWorktree', sender, args)
+const unwatch = (sender: Sender, args: WatchArgs) => invoke('fs:unwatchWorktree', sender, args)
+function deferred<T>() {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((done) => {
+    resolve = done
+  })
+  return { promise, resolve }
+}
+function localRoot(unsubscribe = vi.fn(async () => {})) {
+  return {
+    subscription: { unsubscribe },
+    listeners: new Map(),
+    batch: createDebouncedBatch(),
+    rootPath: '/folder'
+  }
+}
+
+beforeEach(async () => {
+  await closeAllWatchers()
+  vi.clearAllMocks()
+  createLocal.mockImplementation(async () => localRoot())
+  watchRemote.mockImplementation(async () => vi.fn())
+  getProvider.mockReturnValue({ watch: watchRemote })
+  handleMock.mockImplementation((channel, handler) => handlers.set(channel, handler))
+  registerFilesystemWatcherHandlers()
+})
+afterEach(async () => {
+  await closeAllWatchers()
+  vi.useRealTimers()
+})
+
+describe('filesystem watcher renderer document ownership', () => {
+  it.each(['did-navigate', 'render-process-gone'])(
+    'releases installed local and SSH roots on %s without closing sibling owners',
+    async (event) => {
+      const sender = new Sender(1)
+      const sibling = new Sender(2)
+      const local = { worktreePath: '/folder' }
+      const remote = { ...local, connectionId: 'ssh' }
+      const root = localRoot()
+      const remoteClose = vi.fn()
+      createLocal.mockResolvedValue(root)
+      watchRemote.mockResolvedValue(remoteClose)
+      await watch(sender, local)
+      await watch(sender, remote)
+      await watch(sibling, local)
+      await watch(sibling, remote)
+      sender.emit(event)
+      await Promise.resolve()
+      expect(root.subscription.unsubscribe).not.toHaveBeenCalled()
+      expect(remoteClose).not.toHaveBeenCalled()
+      expect([...root.listeners.keys()]).toEqual([2])
+      expect([...state.desiredRemoteWatchers.values()][0].listeners.size).toBe(1)
+      sibling.emit(event)
+      await Promise.resolve()
+      expect(root.subscription.unsubscribe).toHaveBeenCalledTimes(1)
+      expect(remoteClose).toHaveBeenCalledTimes(1)
+      expect(state.watchedRoots.size).toBe(0)
+      expect(state.remoteWatchers.size).toBe(0)
+      expect(state.desiredRemoteWatchers.size).toBe(0)
+      expect(sender.eventNames()).toEqual([])
+      expect(sibling.eventNames()).toEqual([])
+    }
+  )
+
+  it('keeps same-document and blocked navigations alive, and removes lifecycle listeners at shutdown', async () => {
+    const sender = new Sender(1)
+    for (let cycle = 0; cycle < 3; cycle++) {
+      await watch(sender, { worktreePath: '/folder' })
+      sender.emit('did-start-navigation')
+      sender.emit('did-navigate-in-page')
+      expect(state.watchedRoots.size).toBe(1)
+      for (const event of ['destroyed', 'did-navigate', 'render-process-gone']) {
+        expect(sender.listenerCount(event)).toBe(1)
+      }
+      await closeAllWatchers()
+      expect(sender.eventNames()).toEqual([])
+    }
+  })
+
+  it.each(['local', 'ssh'])(
+    'does not revive a cancelled %s setup for a joiner whose document reloaded',
+    async (kind) => {
+      const sender = new Sender(1)
+      const joiner = new Sender(2)
+      const args = { worktreePath: '/folder', ...(kind === 'ssh' ? { connectionId: 'ssh' } : {}) }
+      const install = deferred<ReturnType<typeof localRoot> & (() => void)>()
+      const setup = kind === 'ssh' ? watchRemote : createLocal
+      setup.mockReturnValueOnce(install.promise)
+      const first = watch(sender, args)
+      await vi.waitFor(() => expect(setup).toHaveBeenCalledTimes(1))
+      await unwatch(sender, args)
+      await Promise.resolve()
+      const key =
+        kind === 'ssh' ? getRemoteWatcherKey('ssh', '/folder') : getLocalWatcherRoot('/folder').key
+      const token =
+        kind === 'ssh'
+          ? state.inFlightRemoteInstalls.get(key)
+          : state.inFlightLocalInstalls.get(key)
+      expect(token?.abortController.signal.aborted).toBe(true)
+      const pendingJoiner = watch(joiner, args)
+      joiner.emit('did-navigate')
+      const fresh = watch(joiner, { ...args, worktreePath: '/fresh' })
+      const closeLate = vi.fn(async () => {})
+      install.resolve(Object.assign(closeLate, localRoot(closeLate)))
+      await Promise.all([first, pendingJoiner, fresh])
+      expect(setup.mock.calls.filter(([path]) => path === '/folder')).toHaveLength(1)
+      expect(closeLate).toHaveBeenCalledTimes(1)
+      expect(kind === 'ssh' ? state.remoteWatchers.has(key) : state.watchedRoots.has(key)).toBe(
+        false
+      )
+      expect(setup).toHaveBeenCalledTimes(2)
+    }
+  )
+
+  it.each(['local', 'ssh'])(
+    'aborts pending %s setup on renderer crash and discards late success',
+    async (kind) => {
+      const sender = new Sender(1)
+      const setup = kind === 'ssh' ? watchRemote : createLocal
+      const install = deferred<ReturnType<typeof localRoot> & (() => void)>()
+      setup.mockReturnValueOnce(install.promise)
+      const pending = watch(sender, {
+        worktreePath: '/folder',
+        ...(kind === 'ssh' ? { connectionId: 'ssh' } : {})
+      })
+      await vi.waitFor(() => expect(setup).toHaveBeenCalledTimes(1))
+      const token = [
+        ...(kind === 'ssh' ? state.inFlightRemoteInstalls : state.inFlightLocalInstalls).values()
+      ][0]
+      sender.emit('render-process-gone')
+      await Promise.resolve()
+      expect(token.abortController.signal.aborted).toBe(true)
+      const closeLate = vi.fn(async () => {})
+      install.resolve(Object.assign(closeLate, localRoot(closeLate)))
+      await pending
+      expect(closeLate).toHaveBeenCalledTimes(1)
+      expect(state.watchedRoots.size + state.remoteWatchers.size).toBe(0)
+    }
+  )
+
+  it('does not re-arm stale SSH handler or retry snapshots after reload', async () => {
+    vi.useFakeTimers()
+    const sender = new Sender(1)
+    const args = { worktreePath: '/folder', connectionId: 'ssh' }
+    watchRemote.mockRejectedValueOnce(new Error('temporary unavailable'))
+    await watch(sender, args)
+    const retry = deferred<() => void>()
+    watchRemote.mockReturnValueOnce(retry.promise)
+    await vi.advanceTimersByTimeAsync(REMOTE_WATCH_RETRY_MS)
+    expect(watchRemote).toHaveBeenCalledTimes(2)
+    sender.emit('did-navigate')
+    // A fresh document can ask for the same root while the old retry is settling.
+    const fresh = watch(sender, args)
+    retry.resolve(vi.fn())
+    await fresh
+    expect(state.pendingRemoteWatcherRetries.size).toBe(0)
+    expect(state.remoteWatcherResyncStates.size).toBe(0)
+    expect(watchRemote).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not re-arm an old provider snapshot into the same WebContents after replacement', async () => {
+    const sender = new Sender(1)
+    const args = { worktreePath: '/folder', connectionId: 'ssh' }
+    await watch(sender, args)
+    const pending = deferred<'unavailable'>()
+    const dependencies = {
+      install: vi.fn(() => pending.promise),
+      requestResync: vi.fn(),
+      scheduleRetry: vi.fn(),
+      scheduleDormant: vi.fn()
+    }
+    reinstallRemoteWatchersForConnectionCore('ssh', dependencies)
+    sender.emit('did-navigate')
+    await watch(sender, args)
+    pending.resolve('unavailable')
+    await pending.promise
+    await Promise.resolve()
+    expect(dependencies.scheduleRetry).not.toHaveBeenCalled()
+    expect(dependencies.requestResync).not.toHaveBeenCalled()
+    expect(dependencies.scheduleDormant).not.toHaveBeenCalled()
+  })
+
+  it.each(['local', 'ssh'])(
+    'does not restore a replaced sibling document after an awaited %s removal recovery',
+    async (kind) => {
+      const first = new Sender(1)
+      const sibling = new Sender(2)
+      const args = { worktreePath: '/folder', ...(kind === 'ssh' ? { connectionId: 'ssh' } : {}) }
+      await watch(first, args)
+      await watch(sibling, args)
+      await (kind === 'ssh'
+        ? closeRemoteWatcherForWorktreePath('ssh', '/folder')
+        : closeLocalWatcherForWorktreePath('/folder'))
+      const install = deferred<ReturnType<typeof localRoot> & (() => void)>()
+      const setup = kind === 'ssh' ? watchRemote : createLocal
+      setup.mockReturnValueOnce(install.promise)
+      const restore =
+        kind === 'ssh'
+          ? restoreRemoteWatcherAfterFailedRemoval('ssh', '/folder')
+          : restoreLocalWatcherAfterFailedRemoval('/folder')
+      await vi.waitFor(() => expect(setup).toHaveBeenCalledTimes(2))
+      sibling.emit('did-navigate')
+      install.resolve(Object.assign(vi.fn(), localRoot()))
+      await restore
+      expect(sibling.send).not.toHaveBeenCalled()
+      expect(first.send).toHaveBeenCalledTimes(1)
+      const roots = kind === 'ssh' ? state.remoteWatchers : state.watchedRoots
+      expect([...roots.values()][0].listeners.size).toBe(1)
+    }
+  )
+
+  it('retains zero roots and listeners across 15 reloads and a renderer crash', async () => {
+    const sender = new Sender(1)
+    const closeLocal = vi.fn(async () => {})
+    const closeRemote = vi.fn()
+    createLocal.mockImplementation(async () => localRoot(closeLocal))
+    watchRemote.mockResolvedValue(closeRemote)
+    for (let generation = 0; generation < 16; generation++) {
+      await watch(sender, { worktreePath: `/folder-${generation}` })
+      await watch(sender, { worktreePath: `/folder-${generation}`, connectionId: 'ssh' })
+      sender.emit(generation === 15 ? 'render-process-gone' : 'did-navigate')
+      await Promise.resolve()
+      expect(
+        state.watchedRoots.size + state.remoteWatchers.size + state.desiredRemoteWatchers.size
+      ).toBe(0)
+      expect(sender.eventNames()).toEqual([])
+    }
+    expect(closeLocal).toHaveBeenCalledTimes(16)
+    expect(closeRemote).toHaveBeenCalledTimes(16)
+  })
+
+  it('clears desired SSH roots while no provider is available and does not re-arm them on reconnect', async () => {
+    const sender = new Sender(1)
+    getProvider.mockReturnValue(undefined)
+    await watch(sender, { worktreePath: '/folder', connectionId: 'ssh' })
+    expect(state.pendingRemoteWatcherRetries.size).toBe(1)
+    sender.emit('render-process-gone')
+    getProvider.mockReturnValue({ watch: watchRemote })
+    reinstallRemoteWatchersForConnection('ssh')
+    expect(state.pendingRemoteWatcherRetries.size).toBe(0)
+    expect(state.desiredRemoteWatchers.size).toBe(0)
+    expect(watchRemote).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/ipc/filesystem-watcher-dormant-rearm.test.ts b/src/main/ipc/filesystem-watcher-dormant-rearm.test.ts
index 7d27d4ca780..c4931cd7cb2 100644
--- a/src/main/ipc/filesystem-watcher-dormant-rearm.test.ts
+++ b/src/main/ipc/filesystem-watcher-dormant-rearm.test.ts
@@ -1,3 +1,4 @@
+import { senderEvents } from './filesystem-watcher-test-sender'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { handleMock, getSshFilesystemProviderMock, providerRegistrationListeners } = vi.hoisted(
@@ -36,10 +37,11 @@ const DORMANT_FIRST_MS = 60_000
 function createSender(id: number): {
   isDestroyed: () => boolean
   send: ReturnType<typeof vi.fn>
+  removeListener: ReturnType<typeof vi.fn>
   once: ReturnType<typeof vi.fn>
   id: number
 } {
-  return { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id }
+  return { isDestroyed: () => false, send: vi.fn(), ...senderEvents(), id }
 }
 
 describe('remote filesystem watcher dormant re-arm', () => {
diff --git a/src/main/ipc/filesystem-watcher-handlers.ts b/src/main/ipc/filesystem-watcher-handlers.ts
index bac74f63589..39f9ef0c184 100644
--- a/src/main/ipc/filesystem-watcher-handlers.ts
+++ b/src/main/ipc/filesystem-watcher-handlers.ts
@@ -1,10 +1,12 @@
 import { ipcMain } from 'electron'
+import { isCurrentWatcherSender } from './filesystem-watcher-sender-lifetime'
 import { onSshFilesystemProviderRegistered } from '../providers/ssh-filesystem-dispatch'
 import { watcherLifecycleState } from './filesystem-watcher-lifecycle-state'
 import { getRemoteWatcherKey } from './filesystem-watcher-paths'
 import {
   cancelInFlightRemoteInstallIfUnowned,
   forgetDesiredRemoteWatcher,
+  registerWatcherSenderCleanup,
   releaseRemoteWatchListener
 } from './filesystem-watcher-listener-lifecycle'
 import {
@@ -30,6 +32,7 @@ export function registerFilesystemWatcherHandlers(): void {
   ipcMain.handle(
     'fs:watchWorktree',
     async (event, args: { worktreePath: string; connectionId?: string }): Promise<void> => {
+      const senderSignal = registerWatcherSenderCleanup(event.sender)
       if (args.connectionId) {
         // Why: a real new watch reopens the subsystem after closeAllWatchers latched it shut (also resets tests between cases).
         watcherLifecycleState.remoteWatchersClosed = false
@@ -42,6 +45,9 @@ export function registerFilesystemWatcherHandlers(): void {
           args.connectionId,
           args.worktreePath
         )
+        if (!isCurrentWatcherSender(event.sender, senderSignal)) {
+          return
+        }
         if (result === 'capacity') {
           // Why straight to the dormant backoff: the cap is full until some other root is released,
           // which a 1 Hz reinstall cannot bring about — it only adds relay load per refused root.
diff --git a/src/main/ipc/filesystem-watcher-large-batch.test.ts b/src/main/ipc/filesystem-watcher-large-batch.test.ts
index 3d71581595e..240ca629042 100644
--- a/src/main/ipc/filesystem-watcher-large-batch.test.ts
+++ b/src/main/ipc/filesystem-watcher-large-batch.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 import { join, resolve } from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
@@ -68,10 +69,7 @@ describe('local filesystem watcher large batches', () => {
       return { unsubscribe: vi.fn() } as never
     })
 
-    await handlers['fs:watchWorktree'](
-      { sender: { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 } },
-      { worktreePath }
-    )
+    await handlers['fs:watchWorktree']({ sender: createWatcherSender(1) }, { worktreePath })
 
     const events = Array.from({ length: 200_000 }, (_, index): WatcherEvent => ({
       type: 'delete',
@@ -92,7 +90,7 @@ describe('local filesystem watcher large batches', () => {
       return { unsubscribe: vi.fn() } as never
     })
     const worktreePath = resolve('/tmp/repo')
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath })
     watcherCallback?.(
@@ -124,7 +122,7 @@ describe('local filesystem watcher large batches', () => {
     })
     const worktreePath = resolve('/tmp/repo')
     const filePath = join(worktreePath, 'a.ts')
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath })
     watcherCallback?.(null, [{ type: 'update', path: filePath }])
@@ -152,7 +150,7 @@ describe('local filesystem watcher large batches', () => {
       return { unsubscribe: vi.fn() } as never
     })
     const worktreePath = resolve('/tmp/repo')
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath })
     // Step under the trailing window so only the max wait can force a flush.
diff --git a/src/main/ipc/filesystem-watcher-lifecycle-state.ts b/src/main/ipc/filesystem-watcher-lifecycle-state.ts
index 7d6a120c0a7..feef5d40373 100644
--- a/src/main/ipc/filesystem-watcher-lifecycle-state.ts
+++ b/src/main/ipc/filesystem-watcher-lifecycle-state.ts
@@ -65,7 +65,7 @@ export const watcherLifecycleState = {
   watchedRoots: new Map<string, WatchedRoot>(),
   unwatchableRoots: new Set<string>(),
   // Why: key cleanup by sender WebContents (not per root) to avoid MaxListeners warnings when a workspace has many worktrees open.
-  senderCleanupRegistered: new Set<number>(),
+  senderLifetimes: new Map<number, { signal: AbortSignal; dispose: () => void }>(),
   pendingTeardowns: new Map<string, ReturnType<typeof setTimeout>>(),
   // Why: @parcel/watcher unsubscribe does native async work that sender-destroy can start before shutdown, so will-quit must still await it.
   pendingLocalUnsubscribes: new Set<Promise<void>>(),
diff --git a/src/main/ipc/filesystem-watcher-listener-lifecycle.ts b/src/main/ipc/filesystem-watcher-listener-lifecycle.ts
index 713305069e3..c2dd5f3dc77 100644
--- a/src/main/ipc/filesystem-watcher-listener-lifecycle.ts
+++ b/src/main/ipc/filesystem-watcher-listener-lifecycle.ts
@@ -8,6 +8,7 @@ import {
   watcherLifecycleState
 } from './filesystem-watcher-lifecycle-state'
 import { cancelLocalBatchFlush } from './filesystem-watcher-batch-control'
+import { captureWatcherSenderLifetime } from './filesystem-watcher-sender-lifetime'
 
 export function rememberUnwatchableRoot(rootKey: string): void {
   const { unwatchableRoots } = watcherLifecycleState
@@ -172,13 +173,8 @@ export function releaseRemoteWatchListener(key: string, senderId: number): void
   watcherLifecycleState.remoteWatchers.delete(key)
 }
 
-export function registerWatcherSenderCleanup(sender: WebContents): void {
-  if (watcherLifecycleState.senderCleanupRegistered.has(sender.id)) {
-    return
-  }
-  watcherLifecycleState.senderCleanupRegistered.add(sender.id)
-  sender.once('destroyed', () => {
-    watcherLifecycleState.senderCleanupRegistered.delete(sender.id)
+export function registerWatcherSenderCleanup(sender: WebContents): AbortSignal {
+  return captureWatcherSenderLifetime(sender, () => {
     cleanupLocalWatchersForSender(sender.id)
     cleanupRemoteWatchersForSender(sender.id)
   })
@@ -215,6 +211,9 @@ function cleanupRemoteWatchersForSender(senderId: number): void {
   for (const key of Array.from(watcherLifecycleState.desiredRemoteWatchers.keys())) {
     forgetDesiredRemoteWatcher(key, senderId)
   }
+  for (const resync of watcherLifecycleState.remoteWatcherResyncStates.values()) {
+    resync.listeners.delete(senderId)
+  }
   for (const [key, suspended] of watcherLifecycleState.suspendedRemoteWatcherListeners) {
     suspended.listeners.delete(senderId)
     if (suspended.listeners.size === 0) {
diff --git a/src/main/ipc/filesystem-watcher-local-events.test.ts b/src/main/ipc/filesystem-watcher-local-events.test.ts
index b5ec3eab939..343ee2bc3ad 100644
--- a/src/main/ipc/filesystem-watcher-local-events.test.ts
+++ b/src/main/ipc/filesystem-watcher-local-events.test.ts
@@ -336,7 +336,7 @@ describe('local filesystem watcher flush serialization', () => {
     // Why real timers: fake-timers' refresh() revives a cleared handle, but Node's is a no-op — the bug only shows on real Timeouts.
     vi.useRealTimers()
     statMock.mockResolvedValue({ isDirectory: () => true })
-    const listener = { ...sender, id: 7, once: vi.fn() }
+    const listener = { ...sender, id: 7, removeListener: vi.fn(), once: vi.fn() }
     try {
       await subscribeLocalWatcher('/repo', listener as never)
       watcherCallback?.(null, [{ type: 'delete', path: '/repo/file.ts' }])
diff --git a/src/main/ipc/filesystem-watcher-local-install.ts b/src/main/ipc/filesystem-watcher-local-install.ts
index 27cfc6dafcf..806ab75b82d 100644
--- a/src/main/ipc/filesystem-watcher-local-install.ts
+++ b/src/main/ipc/filesystem-watcher-local-install.ts
@@ -27,48 +27,50 @@ export async function installLocalWatcher(
 ): Promise<LocalWatcherInstallResult> {
   let root: WatchedRoot
   try {
-    const s = await stat(rootPath)
-    if (!s.isDirectory()) {
-      console.warn(`[filesystem-watcher] not a directory: ${rootKey}`)
+    try {
+      const s = await stat(rootPath)
+      if (!s.isDirectory()) {
+        console.warn(`[filesystem-watcher] not a directory: ${rootKey}`)
+        rememberUnwatchableRoot(rootKey)
+        return 'unavailable'
+      }
+    } catch {
+      console.warn(`[filesystem-watcher] cannot stat root: ${rootKey}`)
       rememberUnwatchableRoot(rootKey)
       return 'unavailable'
     }
-  } catch {
-    console.warn(`[filesystem-watcher] cannot stat root: ${rootKey}`)
-    rememberUnwatchableRoot(rootKey)
-    return 'unavailable'
-  }
 
-  try {
-    // Why: WSL paths use one snapshot subprocess inside the distro so `wsl --shutdown` can kill it; native Windows uses @parcel/watcher.
-    root = isWslPath(worktreePath)
-      ? await createWslWatcher(
-          rootKey,
-          worktreePath,
-          {
-            ignoreDirs: WATCHER_IGNORE_DIRS,
-            scheduleBatchFlush: scheduleLocalBatchFlush,
-            watchedRoots: watcherLifecycleState.watchedRoots
-          },
-          cancelToken.abortController.signal
-        )
-      : await createLocalWatcher(rootKey, rootPath, cancelToken.abortController.signal)
-  } catch (error) {
-    // Why: setup can fail after its child misses the exit deadline; retain that owner even when the renderer-facing error is swallowed.
-    retainLocalWatcherPhysicalFailure(rootKey, error)
-    if (cancelToken.cancelled) {
-      if (isWatcherProcessFailure(error) && error.code === 'process_unavailable') {
-        throw error
+    try {
+      // Why: WSL paths use one snapshot subprocess inside the distro so `wsl --shutdown` can kill it; native Windows uses @parcel/watcher.
+      root = isWslPath(worktreePath)
+        ? await createWslWatcher(
+            rootKey,
+            worktreePath,
+            {
+              ignoreDirs: WATCHER_IGNORE_DIRS,
+              scheduleBatchFlush: scheduleLocalBatchFlush,
+              watchedRoots: watcherLifecycleState.watchedRoots
+            },
+            cancelToken.abortController.signal
+          )
+        : await createLocalWatcher(rootKey, rootPath, cancelToken.abortController.signal)
+    } catch (error) {
+      // Why: setup can fail after its child misses the exit deadline; retain that owner even when the renderer-facing error is swallowed.
+      retainLocalWatcherPhysicalFailure(rootKey, error)
+      if (cancelToken.cancelled) {
+        if (isWatcherProcessFailure(error) && error.code === 'process_unavailable') {
+          throw error
+        }
+        return 'cancelled'
       }
-      return 'cancelled'
+      // Why: capacity is transient — allow retry once another child exits instead of caching this root as permanently failed.
+      if (error instanceof WatcherChildCapacityError) {
+        scheduleCapacityRetry(cancelToken.listeners)
+        return 'capacity'
+      }
+      rememberUnwatchableRoot(rootKey)
+      return 'unavailable'
     }
-    // Why: capacity is transient — allow retry once another child exits instead of caching this root as permanently failed.
-    if (error instanceof WatcherChildCapacityError) {
-      scheduleCapacityRetry(cancelToken.listeners)
-      return 'capacity'
-    }
-    rememberUnwatchableRoot(rootKey)
-    return 'unavailable'
   } finally {
     if (watcherLifecycleState.inFlightLocalInstalls.get(rootKey) === cancelToken) {
       watcherLifecycleState.inFlightLocalInstalls.delete(rootKey)
diff --git a/src/main/ipc/filesystem-watcher-local-removal.ts b/src/main/ipc/filesystem-watcher-local-removal.ts
index a3d4b6ff558..78f015f7b94 100644
--- a/src/main/ipc/filesystem-watcher-local-removal.ts
+++ b/src/main/ipc/filesystem-watcher-local-removal.ts
@@ -1,3 +1,4 @@
+import { isCurrentWatcherSender } from './filesystem-watcher-sender-lifetime'
 import type { WebContents } from 'electron'
 import type { FsChangedPayload } from '../../shared/filesystem-entry-types'
 import {
@@ -10,6 +11,7 @@ import { getLocalWatcherRoot } from './filesystem-watcher-paths'
 import { watcherLifecycleState } from './filesystem-watcher-lifecycle-state'
 import {
   abandonLocalUnsubscribes,
+  registerWatcherSenderCleanup,
   clearLocalCapacityRetry,
   trackDetachedLocalUnsubscribe
 } from './filesystem-watcher-listener-lifecycle'
@@ -124,29 +126,40 @@ export async function restoreLocalWatcherAfterFailedRemoval(worktreePath: string
     return
   }
   watcherLifecycleState.suspendedLocalWatcherListeners.delete(rootKey)
-  const failures: unknown[] = []
-  const failedListeners = new Map<number, WebContents>()
-  for (const sender of suspended.listeners.values()) {
-    if (sender.isDestroyed()) {
+  const failures: { sender: WebContents; signal: AbortSignal; error: unknown }[] = []
+  const owners = Array.from(suspended.listeners.values(), (sender) => ({
+    sender,
+    signal: registerWatcherSenderCleanup(sender)
+  }))
+  for (const { sender, signal } of owners) {
+    if (!isCurrentWatcherSender(sender, signal)) {
       continue
     }
     try {
-      await subscribeLocalWatcher(suspended.worktreePath, sender)
+      await subscribeLocalWatcher(suspended.worktreePath, sender, undefined, signal)
+      if (!isCurrentWatcherSender(sender, signal)) {
+        continue
+      }
       sender.send('fs:changed', {
         worktreePath: suspended.worktreePath,
         events: [{ kind: 'overflow', absolutePath: suspended.worktreePath }]
       } satisfies FsChangedPayload)
     } catch (error) {
-      failures.push(error)
-      failedListeners.set(sender.id, sender)
+      if (!isCurrentWatcherSender(sender, signal)) {
+        continue
+      }
+      failures.push({ sender, signal, error })
     }
   }
-  if (failures.length > 0) {
+  const liveFailures = failures.filter(({ sender, signal }) =>
+    isCurrentWatcherSender(sender, signal)
+  )
+  if (liveFailures.length > 0) {
     watcherLifecycleState.suspendedLocalWatcherListeners.set(rootKey, {
       worktreePath: suspended.worktreePath,
-      listeners: failedListeners
+      listeners: new Map(liveFailures.map(({ sender }) => [sender.id, sender]))
     })
-    throw failures[0]
+    throw liveFailures[0].error
   }
 }
 
diff --git a/src/main/ipc/filesystem-watcher-local-subscription.ts b/src/main/ipc/filesystem-watcher-local-subscription.ts
index e888893dbf4..c667210078a 100644
--- a/src/main/ipc/filesystem-watcher-local-subscription.ts
+++ b/src/main/ipc/filesystem-watcher-local-subscription.ts
@@ -11,21 +11,25 @@ import {
   addLocalWatchListener,
   clearLocalCapacityRetry,
   rememberUnwatchableRoot,
+  registerWatcherSenderCleanup,
   takeLocalCapacityRetryListeners,
   trackDetachedLocalUnsubscribe
 } from './filesystem-watcher-listener-lifecycle'
 import { cancelLocalBatchFlush } from './filesystem-watcher-batch-control'
 import { scheduleLocalCapacityRetry } from './filesystem-watcher-local-capacity'
 import { installLocalWatcher } from './filesystem-watcher-local-install'
+import { isCurrentWatcherSender } from './filesystem-watcher-sender-lifetime'
 
 // ── Subscribe / Unsubscribe ──────────────────────────────────────────
 
 export async function subscribeLocalWatcher(
   worktreePath: string,
   sender: WebContents,
-  generation = watcherLifecycleState.localWatcherLifecycleGeneration
+  generation = watcherLifecycleState.localWatcherLifecycleGeneration,
+  senderSignal = registerWatcherSenderCleanup(sender)
 ): Promise<void> {
   if (
+    !isCurrentWatcherSender(sender, senderSignal) ||
     watcherLifecycleState.localWatchersClosed ||
     generation !== watcherLifecycleState.localWatcherLifecycleGeneration
   ) {
@@ -33,7 +37,7 @@ export async function subscribeLocalWatcher(
   }
   const finishInstall = beginWatcherInstall(worktreePath)
   try {
-    await subscribeWhileRemovalAllowed(worktreePath, sender, generation)
+    await subscribeWhileRemovalAllowed(worktreePath, sender, generation, senderSignal)
   } finally {
     finishInstall()
   }
@@ -42,9 +46,11 @@ export async function subscribeLocalWatcher(
 async function subscribeWhileRemovalAllowed(
   worktreePath: string,
   sender: WebContents,
-  generation: number
+  generation: number,
+  senderSignal: AbortSignal
 ): Promise<void> {
   if (
+    !isCurrentWatcherSender(sender, senderSignal) ||
     watcherLifecycleState.localWatchersClosed ||
     generation !== watcherLifecycleState.localWatcherLifecycleGeneration
   ) {
@@ -70,6 +76,9 @@ async function subscribeWhileRemovalAllowed(
     watcherLifecycleState.pendingTeardowns.delete(rootKey)
   }
   const capacityRetryListeners = takeLocalCapacityRetryListeners(rootKey)
+  const retrySignals = new Map(
+    capacityRetryListeners.map((listener) => [listener.id, registerWatcherSenderCleanup(listener)])
+  )
 
   if (root) {
     for (const listener of capacityRetryListeners) {
@@ -91,6 +100,10 @@ async function subscribeWhileRemovalAllowed(
       }
     }
     const result = await pendingInstall
+    const liveCapacityListeners = capacityRetryListeners.filter((listener) =>
+      isCurrentWatcherSender(listener, retrySignals.get(listener.id)!)
+    )
+    const senderIsCurrent = isCurrentWatcherSender(sender, senderSignal)
     if (
       result === 'cancelled' &&
       !canJoinInstall &&
@@ -102,33 +115,42 @@ async function subscribeWhileRemovalAllowed(
         watcherLifecycleState.pendingLocalInstallPromises.delete(rootKey)
       }
       const retryListeners = new Map(
-        capacityRetryListeners.map((listener) => [listener.id, listener])
+        liveCapacityListeners.map((listener) => [listener.id, listener])
       )
-      retryListeners.set(sender.id, sender)
+      if (senderIsCurrent) {
+        retryListeners.set(sender.id, sender)
+      }
       for (const listener of retryListeners.values()) {
         if (!listener.isDestroyed()) {
-          await subscribeWhileRemovalAllowed(worktreePath, listener, generation)
+          await subscribeWhileRemovalAllowed(
+            worktreePath,
+            listener,
+            generation,
+            listener === sender ? senderSignal : retrySignals.get(listener.id)!
+          )
         }
       }
       return
     }
     if (!inFlight) {
       if (result === 'installed') {
-        for (const listener of capacityRetryListeners) {
+        for (const listener of liveCapacityListeners) {
           addLocalWatchListener(rootKey, listener)
         }
       } else if (result === 'capacity') {
         const retryListeners = new Map(
-          capacityRetryListeners.map((listener) => [listener.id, listener])
+          liveCapacityListeners.map((listener) => [listener.id, listener])
         )
-        retryListeners.set(sender.id, sender)
+        if (senderIsCurrent) {
+          retryListeners.set(sender.id, sender)
+        }
         scheduleLocalCapacityRetry(rootKey, worktreePath, retryListeners, subscribeLocalWatcher)
       }
     }
     if (
       result === 'installed' &&
       watcherLifecycleState.watchedRoots.has(rootKey) &&
-      !sender.isDestroyed() &&
+      senderIsCurrent &&
       (!inFlight || inFlight.listeners.has(sender.id))
     ) {
       addLocalWatchListener(rootKey, sender)
diff --git a/src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts b/src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts
index eb161c1ba30..da8b92dbcf8 100644
--- a/src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts
+++ b/src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as ParcelWatcherProcess from './parcel-watcher-process'
 
@@ -85,6 +86,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     const sender = {
       isDestroyed: () => false,
       send: vi.fn(),
+      removeListener: vi.fn(),
       once: vi.fn((event: string, callback: () => void) => {
         if (event === 'destroyed') {
           destroyedCallbacks.push(callback)
@@ -124,7 +126,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
       watcherCallback = callback as typeof watcherCallback
       return { unsubscribe: unsubscribeMock } as never
     })
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
     watcherCallback(new Error('root disappeared'), [])
@@ -157,6 +159,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     const sender = {
       isDestroyed: () => false,
       send: vi.fn(),
+      removeListener: vi.fn(),
       once: vi.fn((event: string, callback: () => void) => {
         if (event === 'destroyed') {
           destroyedCallbacks.push(callback)
@@ -197,18 +200,8 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
           subscribeResolvers.push(resolve as (subscription: { unsubscribe: () => void }) => void)
         })
     )
-    const senderOne = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 1
-    }
-    const senderTwo = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 2
-    }
+    const senderOne = createWatcherSender(1)
+    const senderTwo = createWatcherSender(2)
 
     const watchOne = handlers['fs:watchWorktree'](
       { sender: senderOne },
@@ -248,12 +241,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     vi.mocked(stat).mockResolvedValue({ isDirectory: () => true } as never)
     const unsubscribeMock = vi.fn()
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: unsubscribeMock } as never)
-    const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 1
-    }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
 
@@ -274,12 +262,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     vi.mocked(stat).mockResolvedValue({ isDirectory: () => true } as never)
     const unsubscribeMock = vi.fn()
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: unsubscribeMock } as never)
-    const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 1
-    }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
     await closeLocalWatcherForWorktreePath('/tmp/repo')
@@ -294,12 +277,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     vi.mocked(stat).mockResolvedValue({ isDirectory: () => true } as never)
     const unsubscribeMock = vi.fn()
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: unsubscribeMock } as never)
-    const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 1
-    }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: watchPath })
     await closeLocalWatcherForWorktreePath(closePath)
@@ -323,12 +301,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
         watcherCallback = callback as typeof watcherCallback
         return { unsubscribe: unsubscribeMock } as never
       })
-      const sender = {
-        isDestroyed: () => false,
-        send: vi.fn(),
-        once: vi.fn(),
-        id: 1
-      }
+      const sender = createWatcherSender(1)
 
       await handlers['fs:watchWorktree']({ sender }, { worktreePath: watchPath })
       watcherCallback(null, [{ type: 'update', path: `${watchPath}\\file.txt` }])
@@ -349,7 +322,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     const terminationError = new Error('watcher child did not exit')
     const unsubscribeMock = vi.fn().mockRejectedValue(terminationError)
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: unsubscribeMock } as never)
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
 
@@ -372,6 +345,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     const sender = {
       isDestroyed: () => false,
       send: vi.fn(),
+      removeListener: vi.fn(),
       once: vi.fn((event: string, callback: () => void) => {
         if (event === 'destroyed') {
           destroyedCallbacks.push(callback)
@@ -413,6 +387,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     const sender = {
       isDestroyed: () => false,
       send: vi.fn(),
+      removeListener: vi.fn(),
       once: vi.fn((event: string, callback: () => void) => {
         if (event === 'destroyed') {
           destroyedCallbacks.push(callback)
@@ -448,7 +423,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
       watcherCallback = callback as typeof watcherCallback
       return { unsubscribe }
     })
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
 
     watcherCallback(terminationError, [])
@@ -478,7 +453,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
           hooks?.signal?.addEventListener('abort', () => reject(terminationError), { once: true })
         })
     )
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const watchPromise = handlers['fs:watchWorktree'](
       { sender },
       { worktreePath: '/tmp/repo' }
@@ -499,12 +474,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     vi.mocked(stat).mockResolvedValue({ isDirectory: () => true } as never)
     const unsubscribeMock = vi.fn()
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: unsubscribeMock } as never)
-    const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 1
-    }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
 
@@ -532,12 +502,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
           resolveSubscribe = resolve as typeof resolveSubscribe
         })
     )
-    const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 1
-    }
+    const sender = createWatcherSender(1)
 
     const watchPromise = handlers['fs:watchWorktree'](
       { sender },
@@ -581,8 +546,8 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
         replacementCallback = callback
         return { unsubscribe: replacementUnsubscribe }
       })
-    const firstSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const replacementSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const firstSender = createWatcherSender(1)
+    const replacementSender = createWatcherSender(2)
 
     const firstWatch = handlers['fs:watchWorktree'](
       { sender: firstSender },
@@ -629,9 +594,9 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
       .mockImplementationOnce(install as never)
       .mockImplementationOnce(install as never)
     const lateUnsubscribe = vi.fn()
-    const firstSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const joinerSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
-    const reopenSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 3 }
+    const firstSender = createWatcherSender(1)
+    const joinerSender = createWatcherSender(2)
+    const reopenSender = createWatcherSender(3)
     const first = handlers['fs:watchWorktree'](
       { sender: firstSender },
       { worktreePath: '/tmp/repo' }
@@ -675,12 +640,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
           resolveSubscribe = resolve as typeof resolveSubscribe
         })
     )
-    const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 1
-    }
+    const sender = createWatcherSender(1)
 
     const watchPromise = handlers['fs:watchWorktree'](
       { sender },
@@ -708,12 +668,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     vi.mocked(subscribeParcelWatcher)
       .mockResolvedValueOnce({ unsubscribe: firstUnsubscribe } as never)
       .mockResolvedValueOnce({ unsubscribe: replacementUnsubscribe } as never)
-    const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 1
-    }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
     await closeLocalWatcherForWorktreePath('/tmp/repo')
@@ -731,7 +686,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     vi.mocked(stat).mockResolvedValue({ isDirectory: () => true } as never)
     const firstUnsubscribe = vi.fn()
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: firstUnsubscribe } as never)
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
     await closeLocalWatcherForWorktreePath('/tmp/repo')
@@ -751,6 +706,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     const sender = {
       isDestroyed: () => false,
       send: vi.fn(),
+      removeListener: vi.fn(),
       once: vi.fn((event: string, callback: () => void) => {
         if (event === 'destroyed') {
           destroyedCallbacks.push(callback)
@@ -779,12 +735,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
           resolveSubscribe = resolve as typeof resolveSubscribe
         })
     )
-    const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 1
-    }
+    const sender = createWatcherSender(1)
 
     const watchPromise = handlers['fs:watchWorktree'](
       { sender },
diff --git a/src/main/ipc/filesystem-watcher-native-capacity.test.ts b/src/main/ipc/filesystem-watcher-native-capacity.test.ts
index 670b7eb2af3..9d291f7a9ee 100644
--- a/src/main/ipc/filesystem-watcher-native-capacity.test.ts
+++ b/src/main/ipc/filesystem-watcher-native-capacity.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { handleMock, statMock, subscribeViaWatcherProcessMock, disposeWatcherProcessMock } =
@@ -71,7 +72,7 @@ describe('native filesystem watcher capacity recovery', () => {
     subscribeViaWatcherProcessMock
       .mockRejectedValueOnce(new WatcherChildCapacityError())
       .mockResolvedValueOnce({ unsubscribe })
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const args = { worktreePath: '/tmp/native-capacity-root' }
 
     await handlers['fs:watchWorktree']({ sender }, args)
@@ -86,7 +87,7 @@ describe('native filesystem watcher capacity recovery', () => {
   it('cancels the native capacity wait when its renderer unwatches', async () => {
     const releases = fillWatcherChildCapacity()
     subscribeViaWatcherProcessMock.mockRejectedValue(new WatcherChildCapacityError())
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const args = { worktreePath: '/tmp/native-capacity-root' }
 
     await handlers['fs:watchWorktree']({ sender }, args)
diff --git a/src/main/ipc/filesystem-watcher-real.test.ts b/src/main/ipc/filesystem-watcher-real.test.ts
index 7c9556e7ba4..f884e596f72 100644
--- a/src/main/ipc/filesystem-watcher-real.test.ts
+++ b/src/main/ipc/filesystem-watcher-real.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 /*
  * Real (unmocked) @parcel/watcher integration test.
  *
@@ -76,15 +77,6 @@ describe('filesystem-watcher real @parcel/watcher integration', () => {
     vi.clearAllMocks()
   })
 
-  // Why: a clear, separate failure mode — if the native addon is missing from
-  // the bundle the watcher silently no-ops (doInstallLocalWatcher swallows the
-  // import error), so the wiring assertion below would time out with a vague
-  // message. This makes "addon absent" distinct from "wiring broken".
-  it('loads the real @parcel/watcher native addon', async () => {
-    const watcher = await import('@parcel/watcher')
-    expect(typeof watcher.subscribe).toBe('function')
-  })
-
   // Why: this integration targets the Linux native watcher path described
   // above; macOS developer sandboxes can load the addon while suppressing
   // subscribe callbacks, which makes this an environment check instead.
@@ -95,12 +87,7 @@ describe('filesystem-watcher real @parcel/watcher integration', () => {
       // tmpdir() returns /var, so compare canonical paths instead of aliases.
       tempDir = await realpath(await mkdtemp(join(tmpdir(), 'orca-fswatch-real-')))
       const sendMock = vi.fn()
-      const sender = {
-        isDestroyed: () => false,
-        send: sendMock,
-        once: vi.fn(),
-        id: 1
-      }
+      const sender = createWatcherSender(1, sendMock)
 
       // Subscribe resolves only after the native watcher is installed.
       await handlers['fs:watchWorktree']({ sender }, { worktreePath: tempDir })
@@ -139,7 +126,7 @@ describe('filesystem-watcher real @parcel/watcher integration', () => {
     await mkdir(join(root.realRoot, 'src'), { recursive: true })
 
     const sendMock = vi.fn()
-    const sender = { isDestroyed: () => false, send: sendMock, once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1, sendMock)
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: root.aliasRoot })
 
     const expectedPath = join(root.aliasRoot, 'src', 'agent-edit.ts')
diff --git a/src/main/ipc/filesystem-watcher-remote-batch.test.ts b/src/main/ipc/filesystem-watcher-remote-batch.test.ts
index de1f4fb3d37..fc4566b97c9 100644
--- a/src/main/ipc/filesystem-watcher-remote-batch.test.ts
+++ b/src/main/ipc/filesystem-watcher-remote-batch.test.ts
@@ -1,3 +1,4 @@
+import { senderEvents } from './filesystem-watcher-test-sender'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { FsChangeEvent } from '../../shared/filesystem-entry-types'
 
@@ -34,7 +35,13 @@ describe('remote filesystem watcher batching', () => {
   const watchCallbacks: WatchCallback[] = []
 
   function makeSender(overrides: Partial<{ isDestroyed: () => boolean }> = {}) {
-    return { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1, ...overrides }
+    return {
+      isDestroyed: () => false,
+      send: vi.fn(),
+      ...senderEvents(),
+      id: 1,
+      ...overrides
+    }
   }
 
   beforeEach(async () => {
diff --git a/src/main/ipc/filesystem-watcher-remote-cancellation.test.ts b/src/main/ipc/filesystem-watcher-remote-cancellation.test.ts
index 60e25db9040..26140876bb5 100644
--- a/src/main/ipc/filesystem-watcher-remote-cancellation.test.ts
+++ b/src/main/ipc/filesystem-watcher-remote-cancellation.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { handleMock, getSshFilesystemProviderMock } = vi.hoisted(() => ({
@@ -50,8 +51,8 @@ describe('remote filesystem watcher cancellation', () => {
     )
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
     const args = { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
-    const senderOne = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1)
+    const senderTwo = createWatcherSender(2)
     const first = handlers['fs:watchWorktree']({ sender: senderOne }, args) as Promise<unknown>
     const second = handlers['fs:watchWorktree']({ sender: senderTwo }, args) as Promise<unknown>
 
@@ -101,8 +102,8 @@ describe('remote filesystem watcher cancellation', () => {
       })
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
     const args = { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
-    const firstSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const secondSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const firstSender = createWatcherSender(1)
+    const secondSender = createWatcherSender(2)
     const first = handlers['fs:watchWorktree']({ sender: firstSender }, args) as Promise<unknown>
 
     await Promise.resolve()
@@ -136,6 +137,7 @@ describe('remote filesystem watcher cancellation', () => {
     const destroyedSender = {
       isDestroyed: () => false,
       send: vi.fn(),
+      removeListener: vi.fn(),
       once: vi.fn((event: string, callback: () => void) => {
         if (event === 'destroyed') {
           destroyedCallbacks.push(callback)
@@ -156,7 +158,7 @@ describe('remote filesystem watcher cancellation', () => {
     installs.get('/destroyed')?.resolve(vi.fn())
     await destroyedWatch
 
-    const shutdownSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const shutdownSender = createWatcherSender(2)
     const shutdownArgs = { worktreePath: '/shutdown', connectionId: 'conn-1' }
     const shutdownWatch = handlers['fs:watchWorktree'](
       { sender: shutdownSender },
@@ -182,8 +184,8 @@ describe('remote filesystem watcher cancellation', () => {
     )
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
     const args = { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
-    const senderOne = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1)
+    const senderTwo = createWatcherSender(2)
     const first = handlers['fs:watchWorktree']({ sender: senderOne }, args) as Promise<unknown>
 
     await Promise.resolve()
@@ -216,8 +218,8 @@ describe('remote filesystem watcher cancellation', () => {
     )
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
     const args = { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
-    const firstSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const secondSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const firstSender = createWatcherSender(1)
+    const secondSender = createWatcherSender(2)
     const first = handlers['fs:watchWorktree']({ sender: firstSender }, args) as Promise<unknown>
 
     await Promise.resolve()
@@ -259,9 +261,9 @@ describe('remote filesystem watcher cancellation', () => {
     const args = { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
     const reopenArgs = { worktreePath: '/home/me/other', connectionId: 'conn-1' }
     const lateUnwatch = vi.fn()
-    const firstSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const joinerSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
-    const reopenSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 3 }
+    const firstSender = createWatcherSender(1)
+    const joinerSender = createWatcherSender(2)
+    const reopenSender = createWatcherSender(3)
     const first = handlers['fs:watchWorktree']({ sender: firstSender }, args) as Promise<unknown>
 
     await Promise.resolve()
diff --git a/src/main/ipc/filesystem-watcher-remote-capacity.test.ts b/src/main/ipc/filesystem-watcher-remote-capacity.test.ts
index 97a8f82bf33..f67083f845d 100644
--- a/src/main/ipc/filesystem-watcher-remote-capacity.test.ts
+++ b/src/main/ipc/filesystem-watcher-remote-capacity.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { handleMock, getSshFilesystemProviderMock } = vi.hoisted(() => ({
@@ -58,7 +59,7 @@ describe('remote filesystem watcher capacity refusals', () => {
       throw new Error(WATCH_ROOT_CAPACITY_REFUSAL_MESSAGE)
     })
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const args = { worktreePath: '/home/me/repos/one', connectionId: 'conn-capacity' }
 
     await handlers['fs:watchWorktree']({ sender }, args)
@@ -78,7 +79,7 @@ describe('remote filesystem watcher capacity refusals', () => {
       throw new Error('Relay channel lost')
     })
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const sender = createWatcherSender(2)
     const args = { worktreePath: '/home/me/repos/two', connectionId: 'conn-unavailable' }
 
     await handlers['fs:watchWorktree']({ sender }, args)
diff --git a/src/main/ipc/filesystem-watcher-remote-controller.ts b/src/main/ipc/filesystem-watcher-remote-controller.ts
index 1b6953cd292..8a4f4cc2e91 100644
--- a/src/main/ipc/filesystem-watcher-remote-controller.ts
+++ b/src/main/ipc/filesystem-watcher-remote-controller.ts
@@ -1,6 +1,7 @@
 import type { WebContents } from 'electron'
 import type { RemoteWatcherInstallToken } from './filesystem-watcher-lifecycle-state'
 import { watcherLifecycleState } from './filesystem-watcher-lifecycle-state'
+import { registerWatcherSenderCleanup } from './filesystem-watcher-listener-lifecycle'
 import {
   installRemoteWatcherCore,
   type RemoteWatcherTerminalErrorHandler
@@ -14,14 +15,16 @@ export function installRemoteWatcher(
   sender: WebContents,
   connectionId: string,
   worktreePath: string,
-  generation = watcherLifecycleState.remoteWatcherLifecycleGeneration
+  generation = watcherLifecycleState.remoteWatcherLifecycleGeneration,
+  senderSignal = registerWatcherSenderCleanup(sender)
 ) {
   return installRemoteWatcherCore(
     sender,
     connectionId,
     worktreePath,
     handleRemoteWatcherTerminalError,
-    generation
+    generation,
+    senderSignal
   )
 }
 
diff --git a/src/main/ipc/filesystem-watcher-remote-dormant.ts b/src/main/ipc/filesystem-watcher-remote-dormant.ts
index 7c168114f51..11783f7bb57 100644
--- a/src/main/ipc/filesystem-watcher-remote-dormant.ts
+++ b/src/main/ipc/filesystem-watcher-remote-dormant.ts
@@ -1,3 +1,5 @@
+import { isCurrentWatcherSender } from './filesystem-watcher-sender-lifetime'
+import { registerWatcherSenderCleanup } from './filesystem-watcher-listener-lifecycle'
 import { getSshFilesystemProvider } from '../providers/ssh-filesystem-dispatch'
 import { isWatcherRemovalInProgressError } from './watcher-removal-gate'
 import type {
@@ -74,6 +76,7 @@ async function rearmDormantRemoteWatcher(
   }
 
   const listeners = Array.from(desired.listeners.values())
+  const signals = listeners.map(registerWatcherSenderCleanup)
   let results: Awaited<ReturnType<InstallRemoteWatcher>>[]
   try {
     results = await Promise.all(
@@ -84,6 +87,9 @@ async function rearmDormantRemoteWatcher(
       // Why: removal owns the key now and either forgets the intent or restores the watch itself.
       return
     }
+    if (!listeners.some((listener, index) => isCurrentWatcherSender(listener, signals[index]))) {
+      return
+    }
     scheduleDormantRemoteWatcherRearmCore(
       connectionId,
       worktreePath,
@@ -92,10 +98,16 @@ async function rearmDormantRemoteWatcher(
     )
     return
   }
+  if (!listeners.some((listener, index) => isCurrentWatcherSender(listener, signals[index]))) {
+    return
+  }
   dependencies.requestResync(
     key,
     worktreePath,
-    listeners.filter((_, index) => results[index] === 'installed')
+    listeners.filter(
+      (listener, index) =>
+        results[index] === 'installed' && isCurrentWatcherSender(listener, signals[index])
+    )
   )
   // Why: 'cancelled' means shutdown or the last listener left, so only a refusal stays dormant.
   if (results.some((result) => result === 'unavailable' || result === 'capacity')) {
diff --git a/src/main/ipc/filesystem-watcher-remote-install.ts b/src/main/ipc/filesystem-watcher-remote-install.ts
index 3ab5babbd91..b1a6bab61fa 100644
--- a/src/main/ipc/filesystem-watcher-remote-install.ts
+++ b/src/main/ipc/filesystem-watcher-remote-install.ts
@@ -15,6 +15,7 @@ import type {
 } from './filesystem-watcher-lifecycle-state'
 import { watcherLifecycleState } from './filesystem-watcher-lifecycle-state'
 import { getRemoteWatcherKey } from './filesystem-watcher-paths'
+import { isCurrentWatcherSender } from './filesystem-watcher-sender-lifetime'
 import {
   addInFlightRemoteInstallListener,
   addRemoteWatchListener,
@@ -34,10 +35,12 @@ export async function installRemoteWatcherCore(
   connectionId: string,
   worktreePath: string,
   onTerminalError: RemoteWatcherTerminalErrorHandler,
-  generation = watcherLifecycleState.remoteWatcherLifecycleGeneration
+  generation = watcherLifecycleState.remoteWatcherLifecycleGeneration,
+  senderSignal = registerWatcherSenderCleanup(sender)
 ): Promise<RemoteWatcherInstallResult> {
   // Why: refuse installs racing in after teardown (or a waiter from an earlier lifecycle) so provider.watch() isn't called post-shutdown.
   if (
+    !isCurrentWatcherSender(sender, senderSignal) ||
     watcherLifecycleState.remoteWatchersClosed ||
     generation !== watcherLifecycleState.remoteWatcherLifecycleGeneration
   ) {
@@ -50,7 +53,8 @@ export async function installRemoteWatcherCore(
       connectionId,
       worktreePath,
       onTerminalError,
-      generation
+      generation,
+      senderSignal
     )
   } finally {
     finishInstall()
@@ -62,7 +66,8 @@ async function installRemoteWatcherWhileRemovalAllowed(
   connectionId: string,
   worktreePath: string,
   onTerminalError: RemoteWatcherTerminalErrorHandler,
-  generation: number
+  generation: number,
+  senderSignal: AbortSignal
 ): Promise<RemoteWatcherInstallResult> {
   const provider = getSshFilesystemProvider(connectionId)
   if (!provider || sender.isDestroyed()) {
@@ -85,6 +90,9 @@ async function installRemoteWatcherWhileRemovalAllowed(
       addInFlightRemoteInstallListener(inFlight, sender)
     }
     const result = await pendingInstall
+    if (!isCurrentWatcherSender(sender, senderSignal)) {
+      return 'cancelled'
+    }
     if (
       result === 'installed' &&
       watcherLifecycleState.remoteWatchers.has(key) &&
@@ -108,7 +116,8 @@ async function installRemoteWatcherWhileRemovalAllowed(
         connectionId,
         worktreePath,
         onTerminalError,
-        generation
+        generation,
+        senderSignal
       )
     }
     return result
diff --git a/src/main/ipc/filesystem-watcher-remote-provider-rearm.ts b/src/main/ipc/filesystem-watcher-remote-provider-rearm.ts
index 3cc657c4086..5c55c537f07 100644
--- a/src/main/ipc/filesystem-watcher-remote-provider-rearm.ts
+++ b/src/main/ipc/filesystem-watcher-remote-provider-rearm.ts
@@ -1,3 +1,4 @@
+import { isCurrentWatcherSender } from './filesystem-watcher-sender-lifetime'
 import type { WebContents } from 'electron'
 import { isWatcherRemovalInProgressError } from './watcher-removal-gate'
 import type {
@@ -5,7 +6,10 @@ import type {
   RequestRemoteWatcherResync
 } from './filesystem-watcher-remote-retry'
 import { watcherLifecycleState } from './filesystem-watcher-lifecycle-state'
-import { clearDormantRemoteWatcher } from './filesystem-watcher-listener-lifecycle'
+import {
+  clearDormantRemoteWatcher,
+  registerWatcherSenderCleanup
+} from './filesystem-watcher-listener-lifecycle'
 
 type ScheduleRemoteWatcherRetry = (
   sender: WebContents,
@@ -79,24 +83,33 @@ export function reinstallRemoteWatchersForConnectionCore(
     watcherLifecycleState.loggedUnavailableRemoteWatchers.delete(key)
 
     const listeners = Array.from(desired.listeners.values())
+    const signals = listeners.map(registerWatcherSenderCleanup)
+    const liveListeners = () =>
+      listeners.filter((listener, index) => isCurrentWatcherSender(listener, signals[index]))
     void Promise.all(
       listeners.map((listener) =>
         dependencies.install(listener, desired.connectionId, desired.worktreePath)
       )
     )
       .then((results) => {
+        if (liveListeners().length === 0) {
+          return
+        }
         // Why: events between the transport dropping and this reinstall are gone for good.
         dependencies.requestResync(
           key,
           desired.worktreePath,
-          listeners.filter((_, index) => results[index] === 'installed')
+          listeners.filter(
+            (listener, index) =>
+              results[index] === 'installed' && isCurrentWatcherSender(listener, signals[index])
+          )
         )
         if (results.some((result) => result === 'capacity')) {
           dependencies.scheduleDormant(desired.connectionId, desired.worktreePath)
           return
         }
         if (results.some((result) => result === 'unavailable')) {
-          for (const listener of listeners) {
+          for (const listener of liveListeners()) {
             dependencies.scheduleRetry(
               listener,
               desired.connectionId,
@@ -111,7 +124,7 @@ export function reinstallRemoteWatchersForConnectionCore(
         if (isWatcherRemovalInProgressError(error)) {
           return
         }
-        for (const listener of listeners) {
+        for (const listener of liveListeners()) {
           dependencies.scheduleRetry(
             listener,
             desired.connectionId,
diff --git a/src/main/ipc/filesystem-watcher-remote-rearm.test.ts b/src/main/ipc/filesystem-watcher-remote-rearm.test.ts
index 0eecfbd82e9..056b10579a7 100644
--- a/src/main/ipc/filesystem-watcher-remote-rearm.test.ts
+++ b/src/main/ipc/filesystem-watcher-remote-rearm.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { handleMock, getSshFilesystemProviderMock, providerRegistrationListeners } = vi.hoisted(
@@ -51,8 +52,8 @@ describe('remote filesystem watcher re-arm', () => {
   it('still resyncs when a fresh watch beat the failed reinstall to the retry slot', async () => {
     vi.useFakeTimers()
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    const senderOne = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1)
+    const senderTwo = createWatcherSender(2)
     const args = { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
     getSshFilesystemProviderMock.mockReturnValue({ watch: vi.fn().mockResolvedValue(vi.fn()) })
 
diff --git a/src/main/ipc/filesystem-watcher-remote-removal.ts b/src/main/ipc/filesystem-watcher-remote-removal.ts
index 0e9c741851a..a6c7f2a6636 100644
--- a/src/main/ipc/filesystem-watcher-remote-removal.ts
+++ b/src/main/ipc/filesystem-watcher-remote-removal.ts
@@ -1,3 +1,4 @@
+import { isCurrentWatcherSender } from './filesystem-watcher-sender-lifetime'
 import type { WebContents } from 'electron'
 import type { FsChangedPayload } from '../../shared/filesystem-entry-types'
 import { getSshFilesystemProvider } from '../providers/ssh-filesystem-dispatch'
@@ -5,6 +6,7 @@ import { watcherLifecycleState } from './filesystem-watcher-lifecycle-state'
 import { getRemoteWatcherKey } from './filesystem-watcher-paths'
 import {
   clearDormantRemoteWatcher,
+  registerWatcherSenderCleanup,
   clearRemoteWatcherResync
 } from './filesystem-watcher-listener-lifecycle'
 import {
@@ -71,11 +73,18 @@ export async function restoreRemoteWatcherAfterFailedRemoval(
     return
   }
   watcherLifecycleState.suspendedRemoteWatcherListeners.delete(key)
-  for (const sender of suspended.listeners.values()) {
-    if (sender.isDestroyed()) {
+  const owners = Array.from(suspended.listeners.values(), (sender) => ({
+    sender,
+    signal: registerWatcherSenderCleanup(sender)
+  }))
+  for (const { sender, signal } of owners) {
+    if (!isCurrentWatcherSender(sender, signal)) {
+      continue
+    }
+    const result = await installRemoteWatcher(sender, connectionId, worktreePath, undefined, signal)
+    if (!isCurrentWatcherSender(sender, signal)) {
       continue
     }
-    const result = await installRemoteWatcher(sender, connectionId, worktreePath)
     if (result === 'capacity') {
       scheduleDormantRemoteWatcherRearm(connectionId, worktreePath)
     } else if (result === 'unavailable') {
diff --git a/src/main/ipc/filesystem-watcher-remote-retry.ts b/src/main/ipc/filesystem-watcher-remote-retry.ts
index d73f9ed4db4..02c797e9c75 100644
--- a/src/main/ipc/filesystem-watcher-remote-retry.ts
+++ b/src/main/ipc/filesystem-watcher-remote-retry.ts
@@ -1,3 +1,4 @@
+import { isCurrentWatcherSender } from './filesystem-watcher-sender-lifetime'
 import type { WebContents } from 'electron'
 import type { FsChangedPayload } from '../../shared/filesystem-entry-types'
 import { isWatcherRemovalInProgressError } from './watcher-removal-gate'
@@ -8,7 +9,10 @@ import {
   watcherLifecycleState
 } from './filesystem-watcher-lifecycle-state'
 import { getRemoteWatcherKey } from './filesystem-watcher-paths'
-import { clearRemoteWatcherResync } from './filesystem-watcher-listener-lifecycle'
+import {
+  clearRemoteWatcherResync,
+  registerWatcherSenderCleanup
+} from './filesystem-watcher-listener-lifecycle'
 import { isCurrentDesiredRemoteWatcher } from './filesystem-watcher-remote-desired'
 
 export type InstallRemoteWatcher = (
@@ -44,6 +48,9 @@ export function scheduleRemoteWatcherRetryCore(
   resyncOnInstall = false
 ): void {
   const key = getRemoteWatcherKey(connectionId, worktreePath)
+  if (watcherLifecycleState.remoteWatchersClosed || !isCurrentDesiredRemoteWatcher(key, sender)) {
+    return
+  }
   const existingRetry = watcherLifecycleState.pendingRemoteWatcherRetryListeners.get(key)
   if (existingRetry) {
     if (!sender.isDestroyed()) {
@@ -89,15 +96,24 @@ export function scheduleRemoteWatcherRetryCore(
     const listeners = Array.from(retry.listeners.values()).filter(
       (listener) => !listener.isDestroyed() && isCurrentDesiredRemoteWatcher(key, listener)
     )
+    const signals = listeners.map(registerWatcherSenderCleanup)
+    const liveListeners = () =>
+      listeners.filter((listener, index) => isCurrentWatcherSender(listener, signals[index]))
     void Promise.all(
       listeners.map((listener) => dependencies.install(listener, connectionId, worktreePath))
     )
       .then((results) => {
+        if (liveListeners().length === 0) {
+          return
+        }
         if (retry.resyncOnInstall) {
           dependencies.requestResync(
             key,
             worktreePath,
-            listeners.filter((_, index) => results[index] === 'installed')
+            listeners.filter(
+              (listener, index) =>
+                results[index] === 'installed' && isCurrentWatcherSender(listener, signals[index])
+            )
           )
         }
         // Why capacity leaves the fast window: the relay is refusing on a full watch-root cap, and a
@@ -108,7 +124,7 @@ export function scheduleRemoteWatcherRetryCore(
         }
         // Why: don't re-arm on 'cancelled' (renderer stopped watching) — it would fire a stale overflow when the 60s window expires.
         if (results.some((result) => result === 'unavailable')) {
-          for (const listener of listeners) {
+          for (const listener of liveListeners()) {
             scheduleRemoteWatcherRetryCore(
               listener,
               connectionId,
@@ -124,7 +140,7 @@ export function scheduleRemoteWatcherRetryCore(
         if (isWatcherRemovalInProgressError(error)) {
           return
         }
-        for (const listener of listeners) {
+        for (const listener of liveListeners()) {
           scheduleRemoteWatcherRetryCore(
             listener,
             connectionId,
diff --git a/src/main/ipc/filesystem-watcher-removal-deadline.test.ts b/src/main/ipc/filesystem-watcher-removal-deadline.test.ts
index 9eabdb8964e..ca1e731c99a 100644
--- a/src/main/ipc/filesystem-watcher-removal-deadline.test.ts
+++ b/src/main/ipc/filesystem-watcher-removal-deadline.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as ParcelWatcherProcess from './parcel-watcher-process'
 
@@ -84,12 +85,7 @@ describe('local filesystem watcher removal deadline', () => {
       // subscribe that ignores the abort signal exercises the deadline rather than the cancel path.
       // Once, so the wedge cannot leak into the next test.
       vi.mocked(subscribeViaWatcherProcess).mockImplementationOnce(() => new Promise(() => {}))
-      const sender = {
-        isDestroyed: () => false,
-        send: vi.fn(),
-        once: vi.fn(),
-        id: 1
-      }
+      const sender = createWatcherSender(1)
 
       const watchPromise = handlers['fs:watchWorktree'](
         { sender },
@@ -132,7 +128,7 @@ describe('local filesystem watcher removal deadline', () => {
         })
     )
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: unsubscribeMock } as never)
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
 
@@ -160,12 +156,7 @@ describe('local filesystem watcher removal deadline', () => {
     try {
       vi.mocked(stat).mockResolvedValue({ isDirectory: () => true } as never)
       vi.mocked(subscribeViaWatcherProcess).mockImplementationOnce(() => new Promise(() => {}))
-      const sender = {
-        isDestroyed: () => false,
-        send: vi.fn(),
-        once: vi.fn(),
-        id: 1
-      }
+      const sender = createWatcherSender(1)
 
       const watchPromise = handlers['fs:watchWorktree'](
         { sender },
@@ -209,7 +200,7 @@ describe('local filesystem watcher removal deadline', () => {
         })
     )
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: unsubscribeMock } as never)
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
 
     vi.useFakeTimers()
diff --git a/src/main/ipc/filesystem-watcher-sender-lifetime.ts b/src/main/ipc/filesystem-watcher-sender-lifetime.ts
new file mode 100644
index 00000000000..b72948471b1
--- /dev/null
+++ b/src/main/ipc/filesystem-watcher-sender-lifetime.ts
@@ -0,0 +1,36 @@
+import type { WebContents } from 'electron'
+import { abortWhenRendererGone } from './renderer-lifetime-abort'
+import { watcherLifecycleState } from './filesystem-watcher-lifecycle-state'
+
+export function captureWatcherSenderLifetime(
+  sender: WebContents,
+  cleanup: () => void
+): AbortSignal {
+  const existing = watcherLifecycleState.senderLifetimes.get(sender.id)
+  if (existing) {
+    return existing.signal
+  }
+  if (sender.isDestroyed()) {
+    return AbortSignal.abort()
+  }
+  const lifetime = abortWhenRendererGone(sender)
+  watcherLifecycleState.senderLifetimes.set(sender.id, lifetime)
+  lifetime.signal.addEventListener(
+    'abort',
+    () => {
+      lifetime.dispose()
+      watcherLifecycleState.senderLifetimes.delete(sender.id)
+      cleanup()
+    },
+    { once: true }
+  )
+  return lifetime.signal
+}
+
+export function isCurrentWatcherSender(sender: WebContents, signal: AbortSignal): boolean {
+  return (
+    !sender.isDestroyed() &&
+    !signal.aborted &&
+    watcherLifecycleState.senderLifetimes.get(sender.id)?.signal === signal
+  )
+}
diff --git a/src/main/ipc/filesystem-watcher-shutdown.ts b/src/main/ipc/filesystem-watcher-shutdown.ts
index 9f9cd2de353..31a57ecab10 100644
--- a/src/main/ipc/filesystem-watcher-shutdown.ts
+++ b/src/main/ipc/filesystem-watcher-shutdown.ts
@@ -8,7 +8,10 @@ export async function closeAllWatchers(): Promise<void> {
   // Why: drop the intent with the rest of the state, but keep the provider-registration
   // subscription — a new fs:watchWorktree reopens the subsystem and still needs the re-arm hook.
   watcherLifecycleState.desiredRemoteWatchers.clear()
-  watcherLifecycleState.senderCleanupRegistered.clear()
+  for (const lifetime of watcherLifecycleState.senderLifetimes.values()) {
+    lifetime.dispose()
+  }
+  watcherLifecycleState.senderLifetimes.clear()
   watcherLifecycleState.unwatchableRoots.clear()
   watcherLifecycleState.suspendedLocalWatcherListeners.clear()
   watcherLifecycleState.suspendedRemoteWatcherListeners.clear()
diff --git a/src/main/ipc/filesystem-watcher-terminal-resync.test.ts b/src/main/ipc/filesystem-watcher-terminal-resync.test.ts
index 31e87d7a4c9..e8a81d1a7ff 100644
--- a/src/main/ipc/filesystem-watcher-terminal-resync.test.ts
+++ b/src/main/ipc/filesystem-watcher-terminal-resync.test.ts
@@ -41,6 +41,7 @@ const OVERFLOW_PAYLOAD = {
 type MockSender = {
   isDestroyed: () => boolean
   send: ReturnType<typeof vi.fn>
+  removeListener: ReturnType<typeof vi.fn>
   once: ReturnType<typeof vi.fn>
   id: number
   destroy: () => void
@@ -52,6 +53,7 @@ function createSender(id: number): MockSender {
   return {
     isDestroyed: () => destroyed,
     send: vi.fn(),
+    removeListener: vi.fn(),
     once: vi.fn((event: string, handler: () => void) => {
       if (event === 'destroyed') {
         destroyedHandlers.push(handler)
diff --git a/src/main/ipc/filesystem-watcher-test-sender.ts b/src/main/ipc/filesystem-watcher-test-sender.ts
new file mode 100644
index 00000000000..4ff5a5bbcc1
--- /dev/null
+++ b/src/main/ipc/filesystem-watcher-test-sender.ts
@@ -0,0 +1,18 @@
+import { vi, type Mock } from 'vitest'
+
+type SenderEvents = { once: Mock; removeListener: Mock }
+
+export function senderEvents(): SenderEvents {
+  return { once: vi.fn(), removeListener: vi.fn() }
+}
+
+export function createWatcherSender(
+  id: number,
+  send: Mock = vi.fn()
+): SenderEvents & {
+  id: number
+  isDestroyed: () => boolean
+  send: Mock
+} {
+  return { id, isDestroyed: () => false, send, ...senderEvents() }
+}
diff --git a/src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts b/src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts
index 3473caa8a73..78274bbe028 100644
--- a/src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts
+++ b/src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts
@@ -1,3 +1,5 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
+import { statSync } from 'node:fs'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { handleMock } = vi.hoisted(() => ({
@@ -29,6 +31,7 @@ vi.mock('../providers/ssh-filesystem-dispatch', () => ({
 
 import { closeAllWatchers, registerFilesystemWatcherHandlers } from './filesystem-watcher'
 import { stat } from 'node:fs/promises'
+import { watcherLifecycleState } from './filesystem-watcher-lifecycle-state'
 
 type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
@@ -48,15 +51,31 @@ describe('filesystem watcher unwatchable root cache', () => {
     await closeAllWatchers()
   })
 
+  it('releases the install record when the root is a file', async () => {
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const sender = createWatcherSender(1)
+    vi.mocked(stat).mockResolvedValue(statSync(new URL(import.meta.url)))
+    try {
+      await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/not-directory' })
+      expect(watcherLifecycleState.inFlightLocalInstalls.size).toBe(0)
+      expect(watcherLifecycleState.pendingLocalInstallPromises.size).toBe(0)
+    } finally {
+      warnSpy.mockRestore()
+      await closeAllWatchers()
+    }
+  })
+
   it('evicts oldest failed local roots while suppressing recent retries', async () => {
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     vi.mocked(stat).mockRejectedValue(new Error('missing'))
 
     for (let i = 0; i < 257; i += 1) {
       await handlers['fs:watchWorktree']({ sender }, { worktreePath: `/tmp/missing-${i}` })
     }
     expect(stat).toHaveBeenCalledTimes(257)
+    expect(watcherLifecycleState.inFlightLocalInstalls.size).toBe(0)
+    expect(watcherLifecycleState.pendingLocalInstallPromises.size).toBe(0)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/missing-0' })
     expect(stat).toHaveBeenCalledTimes(258)
diff --git a/src/main/ipc/filesystem-watcher.test.ts b/src/main/ipc/filesystem-watcher.test.ts
index 2d9181d1155..db6fcf206e5 100644
--- a/src/main/ipc/filesystem-watcher.test.ts
+++ b/src/main/ipc/filesystem-watcher.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { handleMock, getSshFilesystemProviderMock, providerRegistrationListeners } = vi.hoisted(
@@ -106,7 +107,7 @@ describe('registerFilesystemWatcherHandlers', () => {
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: vi.fn() } as never)
 
     await handlers['fs:watchWorktree'](
-      { sender: { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 } },
+      { sender: createWatcherSender(1) },
       { worktreePath: 'C:\\repo' }
     )
 
@@ -140,7 +141,7 @@ describe('registerFilesystemWatcherHandlers', () => {
         rootPath: worktreePath
       }
     })
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const args = { worktreePath: '\\\\wsl.localhost\\Ubuntu\\home\\me\\repo' }
 
     await expect(handlers['fs:watchWorktree']({ sender }, args)).resolves.toBeUndefined()
@@ -162,7 +163,7 @@ describe('registerFilesystemWatcherHandlers', () => {
       reserveWatcherChild()
     )
     vi.mocked(createWslWatcher).mockRejectedValue(new WatcherChildCapacityError())
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const args = { worktreePath: '\\\\wsl.localhost\\Ubuntu\\home\\me\\repo' }
 
     await handlers['fs:watchWorktree']({ sender }, args)
@@ -178,7 +179,7 @@ describe('registerFilesystemWatcherHandlers', () => {
   it('rejects installs during destructive removal and allows a retry afterward', async () => {
     vi.mocked(stat).mockResolvedValue({ isDirectory: () => true } as never)
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: vi.fn() } as never)
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const removal = acquireWatcherRemovalGate('/repo')
     await removal.ready
 
@@ -201,12 +202,12 @@ describe('registerFilesystemWatcherHandlers', () => {
 
     await expect(
       handlers['fs:watchWorktree'](
-        { sender: { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 } },
+        { sender: createWatcherSender(1) },
         { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
       )
     ).resolves.toBeUndefined()
     await handlers['fs:watchWorktree'](
-      { sender: { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 } },
+      { sender: createWatcherSender(1) },
       { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
     )
 
@@ -226,7 +227,7 @@ describe('registerFilesystemWatcherHandlers', () => {
     vi.useFakeTimers()
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
     const sendMock = vi.fn()
-    const sender = { isDestroyed: () => false, send: sendMock, once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1, sendMock)
     const unwatchMock = vi.fn()
     const watchMock = vi.fn().mockResolvedValue(unwatchMock)
     getSshFilesystemProviderMock.mockReturnValueOnce(undefined)
@@ -261,7 +262,7 @@ describe('registerFilesystemWatcherHandlers', () => {
     vi.useFakeTimers()
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
     const sendMock = vi.fn()
-    const sender = { isDestroyed: () => false, send: sendMock, once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1, sendMock)
     const unwatchMock = vi.fn()
     const retryWatchMock = vi.fn().mockResolvedValue(unwatchMock)
     getSshFilesystemProviderMock
@@ -299,7 +300,7 @@ describe('registerFilesystemWatcherHandlers', () => {
     getSshFilesystemProviderMock.mockReturnValueOnce(undefined)
 
     await handlers['fs:watchWorktree'](
-      { sender: { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 } },
+      { sender: createWatcherSender(1) },
       { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
     )
 
@@ -315,8 +316,8 @@ describe('registerFilesystemWatcherHandlers', () => {
   it('retries all live renderer owners after a terminal relay watch failure', async () => {
     vi.useFakeTimers()
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    const senderOne = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1)
+    const senderTwo = createWatcherSender(2)
     const watchMock = vi.fn().mockResolvedValue(vi.fn())
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
 
@@ -354,7 +355,7 @@ describe('registerFilesystemWatcherHandlers', () => {
   })
 
   it('reinstalls an SSH worktree watch when the provider is re-registered after a reconnect', async () => {
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const staleUnwatch = vi.fn()
     const watchMock = vi.fn().mockResolvedValue(staleUnwatch)
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
@@ -390,7 +391,7 @@ describe('registerFilesystemWatcherHandlers', () => {
 
   it('re-arms an SSH watch whose first install found no provider yet', async () => {
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     // A connect slower than the retry window leaves the renderer subscribed with nothing installed.
     getSshFilesystemProviderMock.mockReturnValue(undefined)
 
@@ -411,7 +412,7 @@ describe('registerFilesystemWatcherHandlers', () => {
   it('resyncs after a reconnect whose reinstall only succeeded on a retry', async () => {
     vi.useFakeTimers()
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     getSshFilesystemProviderMock.mockReturnValue({ watch: vi.fn().mockResolvedValue(vi.fn()) })
 
     await handlers['fs:watchWorktree'](
@@ -440,7 +441,7 @@ describe('registerFilesystemWatcherHandlers', () => {
   })
 
   it('does not resurrect an SSH watch the renderer already unwatched', async () => {
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const watchMock = vi.fn().mockResolvedValue(vi.fn())
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
 
@@ -462,7 +463,7 @@ describe('registerFilesystemWatcherHandlers', () => {
   })
 
   it('leaves watches on other connections untouched when one provider re-registers', async () => {
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const watchMock = vi.fn().mockResolvedValue(vi.fn())
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
 
@@ -480,8 +481,8 @@ describe('registerFilesystemWatcherHandlers', () => {
   })
 
   it('reinstalls one shared watch when several senders share a re-registered connection', async () => {
-    const senderOne = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1)
+    const senderTwo = createWatcherSender(2)
     const watchMock = vi.fn().mockResolvedValue(vi.fn())
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
 
@@ -515,8 +516,11 @@ describe('registerFilesystemWatcherHandlers', () => {
     const sender = {
       isDestroyed: () => destroyed,
       send: vi.fn(),
-      once: vi.fn((_event: string, handler: () => void) => {
-        destroyHandlers.push(handler)
+      removeListener: vi.fn(),
+      once: vi.fn((event: string, handler: () => void) => {
+        if (event === 'destroyed') {
+          destroyHandlers.push(handler)
+        }
       }),
       id: 1
     }
@@ -545,8 +549,8 @@ describe('registerFilesystemWatcherHandlers', () => {
   it('shares SSH worktree watchers across renderer senders until the last unwatch', async () => {
     const sendOne = vi.fn()
     const sendTwo = vi.fn()
-    const senderOne = { isDestroyed: () => false, send: sendOne, once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: sendTwo, once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1, sendOne)
+    const senderTwo = createWatcherSender(2, sendTwo)
     const unwatchMock = vi.fn()
     const watchMock = vi.fn().mockResolvedValue(unwatchMock)
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
@@ -590,7 +594,7 @@ describe('registerFilesystemWatcherHandlers', () => {
     const provider = { watch: vi.fn().mockResolvedValue(vi.fn()), closeWatch }
     getSshFilesystemProviderMock.mockReturnValue(provider)
     await handlers['fs:watchWorktree'](
-      { sender: { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 } },
+      { sender: createWatcherSender(1) },
       { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
     )
 
@@ -615,7 +619,7 @@ describe('registerFilesystemWatcherHandlers', () => {
       .mockResolvedValueOnce(replacementUnwatch)
     const closeWatch = vi.fn().mockResolvedValue(undefined)
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock, closeWatch })
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree'](
       { sender },
@@ -642,7 +646,7 @@ describe('registerFilesystemWatcherHandlers', () => {
     const watchMock = vi.fn().mockResolvedValue(vi.fn())
     const closeWatch = vi.fn().mockResolvedValue(undefined)
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock, closeWatch })
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree'](
       { sender },
@@ -666,7 +670,7 @@ describe('registerFilesystemWatcherHandlers', () => {
     const watchMock = vi.fn().mockResolvedValue(firstUnwatch)
     const closeWatch = vi.fn().mockResolvedValue(undefined)
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock, closeWatch })
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const args = { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
 
     await handlers['fs:watchWorktree']({ sender }, args)
@@ -685,14 +689,12 @@ describe('registerFilesystemWatcherHandlers', () => {
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock, closeWatch })
     const destroyedCallbacks: (() => void)[] = []
     const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
+      ...createWatcherSender(1),
       once: vi.fn((event: string, callback: () => void) => {
         if (event === 'destroyed') {
           destroyedCallbacks.push(callback)
         }
-      }),
-      id: 1
+      })
     }
     const args = { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
 
@@ -709,8 +711,8 @@ describe('registerFilesystemWatcherHandlers', () => {
   it('preserves remote event routing when acknowledged teardown rejects', async () => {
     const sendOne = vi.fn()
     const sendTwo = vi.fn()
-    const senderOne = { isDestroyed: () => false, send: sendOne, once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: sendTwo, once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1, sendOne)
+    const senderTwo = createWatcherSender(2, sendTwo)
     const watchMock = vi.fn().mockResolvedValue(vi.fn())
     const closeWatch = vi
       .fn()
@@ -747,8 +749,8 @@ describe('registerFilesystemWatcherHandlers', () => {
   it('dedupes concurrent pending SSH worktree watcher installs', async () => {
     const sendOne = vi.fn()
     const sendTwo = vi.fn()
-    const senderOne = { isDestroyed: () => false, send: sendOne, once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: sendTwo, once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1, sendOne)
+    const senderTwo = createWatcherSender(2, sendTwo)
     const unwatchMock = vi.fn()
     let resolveWatch: (unwatch: () => void) => void = () => {}
     const watchPromise = new Promise<() => void>((resolve) => {
@@ -791,8 +793,8 @@ describe('registerFilesystemWatcherHandlers', () => {
   it('keeps a pending SSH watcher install alive when only one pending sender unwatches', async () => {
     const sendOne = vi.fn()
     const sendTwo = vi.fn()
-    const senderOne = { isDestroyed: () => false, send: sendOne, once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: sendTwo, once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1, sendOne)
+    const senderTwo = createWatcherSender(2, sendTwo)
     const unwatchMock = vi.fn()
     let resolveWatch: (unwatch: () => void) => void = () => {}
     const watchPromise = new Promise<() => void>((resolve) => {
@@ -833,14 +835,12 @@ describe('registerFilesystemWatcherHandlers', () => {
   it('unsubscribes if the sender is destroyed while an SSH watcher is opening', async () => {
     const destroyedCallbacks: (() => void)[] = []
     const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
+      ...createWatcherSender(1),
       once: vi.fn((event: string, callback: () => void) => {
         if (event === 'destroyed') {
           destroyedCallbacks.push(callback)
         }
-      }),
-      id: 1
+      })
     }
     const unwatchMock = vi.fn()
     let resolveWatch: (unwatch: () => void) => void = () => {}
@@ -871,8 +871,8 @@ describe('registerFilesystemWatcherHandlers', () => {
 
   it('revives a pending SSH watcher install when a new sender joins after cancellation', async () => {
     const args = { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
-    const senderOne = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1)
+    const senderTwo = createWatcherSender(2)
     const unwatchMock = vi.fn()
     let resolveWatch!: (unwatch: () => void) => void
     const watchMock = vi.fn().mockReturnValue(
@@ -907,14 +907,12 @@ describe('registerFilesystemWatcherHandlers', () => {
   it('registers one destroyed listener for many SSH worktree watches', async () => {
     const destroyedCallbacks: (() => void)[] = []
     const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
+      ...createWatcherSender(99),
       once: vi.fn((event: string, callback: () => void) => {
         if (event === 'destroyed') {
           destroyedCallbacks.push(callback)
         }
-      }),
-      id: 99
+      })
     }
     const unwatchMock = vi.fn()
     const watchMock = vi.fn().mockResolvedValue(unwatchMock)
@@ -929,7 +927,7 @@ describe('registerFilesystemWatcherHandlers', () => {
 
     // Why: WebContents warns after 10 listeners. The cleanup work still covers
     // every remote watch by scanning the shared remote watcher registry.
-    expect(sender.once).toHaveBeenCalledTimes(1)
+    expect(sender.once).toHaveBeenCalledTimes(3)
     expect(destroyedCallbacks).toHaveLength(1)
 
     destroyedCallbacks[0]()
diff --git a/src/main/ipc/filesystem.test.ts b/src/main/ipc/filesystem.test.ts
index fe1568dbf72..2d452fe4ee6 100644
--- a/src/main/ipc/filesystem.test.ts
+++ b/src/main/ipc/filesystem.test.ts
@@ -1,3 +1,4 @@
+import { EventEmitter } from 'node:events'
 import path from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import {
@@ -608,38 +609,50 @@ describe('registerFilesystemHandlers', () => {
   // Why #7721: without a cancel path, every workspace switch left the previous
   // workspace's full-tree SSH scan running, stacking scans on the relay until
   // interactive fs.readDir/fs.stat starved past their 30s timeout.
-  it('fs:cancelListFiles aborts an in-flight SSH listing by request token (#7721)', async () => {
-    let capturedSignal: AbortSignal | undefined
-    const listFilesMock = vi.fn(
-      (_rootPath: string, options: { signal?: AbortSignal }) =>
-        new Promise<string[]>((_resolve, reject) => {
-          capturedSignal = options.signal
-          options.signal?.addEventListener('abort', () => reject(new Error('listing cancelled')), {
-            once: true
+  it.each(['cancel', 'did-navigate', 'render-process-gone', 'destroyed'])(
+    'aborts an in-flight SSH file listing on %s (#7721)',
+    async (eventName) => {
+      let capturedSignal: AbortSignal | undefined
+      const listFilesMock = vi.fn(
+        (_rootPath: string, options: { signal?: AbortSignal }) =>
+          new Promise<string[]>((_resolve, reject) => {
+            capturedSignal = options.signal
+            options.signal?.addEventListener(
+              'abort',
+              () => reject(new Error('listing cancelled')),
+              {
+                once: true
+              }
+            )
           })
-        })
-    )
-    getSshFilesystemProviderMock.mockReturnValue({ listFiles: listFilesMock })
+      )
+      getSshFilesystemProviderMock.mockReturnValue({ listFiles: listFilesMock })
 
-    registerFilesystemHandlers(store as never)
+      registerFilesystemHandlers(store as never)
 
-    // Why: cancellation keys are scoped to the issuing webContents, so the
-    // cancel must come from the same sender as the listing request.
-    const senderEvent = { sender: { id: 7 } }
-    const pending = handlers.get('fs:listFiles')!(senderEvent, {
-      rootPath: '/home/user/repo',
-      connectionId: 'conn-1',
-      requestToken: 'token-1'
-    }) as Promise<string[]>
+      // Why: cancellation keys are scoped to the issuing webContents, so the
+      // cancel must come from the same sender as the listing request.
+      const senderEvent = { sender: Object.assign(new EventEmitter(), { id: 7 }) }
+      const pending = handlers.get('fs:listFiles')!(senderEvent, {
+        rootPath: '/home/user/repo',
+        connectionId: 'conn-1',
+        requestToken: 'token-1'
+      }) as Promise<string[]>
 
-    expect(capturedSignal?.aborted).toBe(false)
-    await handlers.get('fs:cancelListFiles')!(senderEvent, { requestToken: 'token-1' })
-    expect(capturedSignal?.aborted).toBe(true)
-    await expect(pending).rejects.toThrow('listing cancelled')
+      expect(capturedSignal?.aborted).toBe(false)
+      if (eventName === 'cancel') {
+        await handlers.get('fs:cancelListFiles')!(senderEvent, { requestToken: 'token-1' })
+      } else {
+        senderEvent.sender.emit(eventName)
+      }
+      expect(capturedSignal?.aborted).toBe(true)
+      await expect(pending).rejects.toThrow('listing cancelled')
+      expect(senderEvent.sender.eventNames()).toEqual([])
 
-    // Unknown or already-settled tokens are a no-op, not an error.
-    expect(() =>
-      handlers.get('fs:cancelListFiles')!(senderEvent, { requestToken: 'unknown' })
-    ).not.toThrow()
-  })
+      // Unknown or already-settled tokens are a no-op, not an error.
+      expect(() =>
+        handlers.get('fs:cancelListFiles')!(senderEvent, { requestToken: 'unknown' })
+      ).not.toThrow()
+    }
+  )
 })
diff --git a/src/main/ipc/filesystem/filesystem-download-handlers.ts b/src/main/ipc/filesystem/filesystem-download-handlers.ts
index 6b73df909da..b542b235a48 100644
--- a/src/main/ipc/filesystem/filesystem-download-handlers.ts
+++ b/src/main/ipc/filesystem/filesystem-download-handlers.ts
@@ -5,6 +5,7 @@ import { getRuntimePathBasename } from '../../../shared/cross-platform-path'
 import { requireSshFilesystemProvider } from '../../providers/ssh-filesystem-dispatch'
 import { sanitizeLocalDownloadFilename } from '../../local-download-filename'
 import { registerFilesystemDownloadFolderHandlers } from '../filesystem-download-folder'
+import { abortWhenRendererGone } from '../renderer-lifetime-abort'
 import type { FilesystemHandlerContext } from './filesystem-handler-context'
 import {
   cleanupLocalTransferPath,
@@ -24,7 +25,7 @@ function validateRequiredString(value: unknown, label: string): string {
 }
 
 export function registerFilesystemDownloadHandlers(context: FilesystemHandlerContext): void {
-  const { downloadSessions, closeDownloadSession, cleanupDownloadSessionsForSender } = context
+  const { downloadSessions, closeDownloadSession } = context
 
   ipcMain.handle(
     'fs:downloadFile',
@@ -122,21 +123,42 @@ export function registerFilesystemDownloadHandlers(context: FilesystemHandlerCon
       const suggestedName = sanitizeLocalDownloadFilename(
         validateRequiredString(args?.suggestedName, 'suggestedName')
       )
-      const parentWindow = BrowserWindow.fromWebContents(event.sender) ?? undefined
-      const dialogResult = parentWindow
-        ? await dialog.showSaveDialog(parentWindow, { defaultPath: suggestedName })
-        : await dialog.showSaveDialog({ defaultPath: suggestedName })
-      if (dialogResult.canceled || !dialogResult.filePath) {
+      if (event.sender.isDestroyed()) {
         return { canceled: true }
       }
-
-      const destinationPath = dialogResult.filePath
-      const { existed } = await inspectDownloadDestination(destinationPath)
-      const tempPath = createSiblingTransferPath(destinationPath, 'download')
+      const lifetime = abortWhenRendererGone(event.sender)
       const transferId = randomUUID()
+      const disposeRendererLifetime = (): void => {
+        lifetime.signal.removeEventListener('abort', onRendererGone)
+        lifetime.dispose()
+      }
+      const onRendererGone = (): void => {
+        disposeRendererLifetime()
+        void closeDownloadSession(transferId, true)
+      }
+      lifetime.signal.addEventListener('abort', onRendererGone, { once: true })
+      let admitted = false
+      let tempPath: string | null = null
+      let handle: Awaited<ReturnType<typeof open>> | null = null
       try {
-        const handle = await open(tempPath, 'wx')
-        const senderId = typeof event.sender.id === 'number' ? event.sender.id : Number.NaN
+        const parentWindow = BrowserWindow.fromWebContents(event.sender) ?? undefined
+        const dialogResult = parentWindow
+          ? await dialog.showSaveDialog(parentWindow, { defaultPath: suggestedName })
+          : await dialog.showSaveDialog({ defaultPath: suggestedName })
+        if (lifetime.signal.aborted || dialogResult.canceled || !dialogResult.filePath) {
+          return { canceled: true }
+        }
+
+        const destinationPath = dialogResult.filePath
+        const { existed } = await inspectDownloadDestination(destinationPath)
+        if (lifetime.signal.aborted) {
+          return { canceled: true }
+        }
+        tempPath = createSiblingTransferPath(destinationPath, 'download')
+        handle = await open(tempPath, 'wx')
+        if (lifetime.signal.aborted) {
+          return { canceled: true }
+        }
         const cleanupTimer = setTimeout(() => {
           void closeDownloadSession(transferId, true)
         }, DOWNLOAD_SESSION_TTL_MS)
@@ -149,13 +171,16 @@ export function registerFilesystemDownloadHandlers(context: FilesystemHandlerCon
           destinationExisted: existed,
           handle,
           cleanupTimer,
-          senderId
+          disposeRendererLifetime
         })
-        event.sender.once?.('destroyed', () => cleanupDownloadSessionsForSender(senderId))
+        admitted = true
         return { canceled: false, transferId, destinationPath }
-      } catch (error) {
-        await cleanupLocalTransferPath(tempPath)
-        throw error
+      } finally {
+        if (!admitted) {
+          disposeRendererLifetime()
+          await handle?.close().catch(() => {})
+          await cleanupLocalTransferPath(tempPath)
+        }
       }
     }
   )
diff --git a/src/main/ipc/filesystem/filesystem-git-pull-request-generation-handlers.ts b/src/main/ipc/filesystem/filesystem-git-pull-request-generation-handlers.ts
index 1c16a119b3b..2361bbb4f4c 100644
--- a/src/main/ipc/filesystem/filesystem-git-pull-request-generation-handlers.ts
+++ b/src/main/ipc/filesystem/filesystem-git-pull-request-generation-handlers.ts
@@ -89,6 +89,8 @@ export function registerFilesystemGitPullRequestGenerationHandlers(
           repoPath: args.worktreePath,
           connectionId: args.connectionId
         })
+        // Preparation can return before this lookup settles; retain its error for the later await.
+        void linkedIssueDetailsPromise.catch(() => undefined)
         let context: Awaited<ReturnType<typeof getPullRequestDraftContext>>
         try {
           const currentBody = await resolveHostedReviewBodyForGeneration({
@@ -151,6 +153,8 @@ export function registerFilesystemGitPullRequestGenerationHandlers(
         connectionId: args.connectionId,
         localGitOptions: gitOptions
       })
+      // Preparation can return before this lookup settles; retain its error for the later await.
+      void linkedIssueDetailsPromise.catch(() => undefined)
       let context: Awaited<ReturnType<typeof getPullRequestDraftContext>>
       try {
         const currentBody = await resolveHostedReviewBodyForGeneration({
diff --git a/src/main/ipc/filesystem/filesystem-handler-context.ts b/src/main/ipc/filesystem/filesystem-handler-context.ts
index 02488931e1e..231034d9a91 100644
--- a/src/main/ipc/filesystem/filesystem-handler-context.ts
+++ b/src/main/ipc/filesystem/filesystem-handler-context.ts
@@ -11,7 +11,7 @@ export type DownloadSession = {
   destinationExisted: boolean
   handle: FileHandle
   cleanupTimer: ReturnType<typeof setTimeout>
-  senderId: number
+  disposeRendererLifetime: () => void
 }
 
 export type FilesystemHandlerContext = {
@@ -25,7 +25,6 @@ export type FilesystemHandlerContext = {
     transferId: string,
     cleanupTemp: boolean
   ) => Promise<DownloadSession | null>
-  cleanupDownloadSessionsForSender: (senderId: number) => void
 }
 
 export function createFilesystemHandlerContext(
@@ -46,6 +45,7 @@ export function createFilesystemHandlerContext(
       return null
     }
     downloadSessions.delete(transferId)
+    session.disposeRendererLifetime()
     clearTimeout(session.cleanupTimer)
     await session.handle.close().catch(() => {})
     if (cleanupTemp) {
@@ -54,14 +54,6 @@ export function createFilesystemHandlerContext(
     return session
   }
 
-  const cleanupDownloadSessionsForSender = (senderId: number): void => {
-    for (const [transferId, session] of Array.from(downloadSessions)) {
-      if (session.senderId === senderId) {
-        void closeDownloadSession(transferId, true)
-      }
-    }
-  }
-
   return {
     store,
     commitMessageAgentEnv,
@@ -69,7 +61,6 @@ export function createFilesystemHandlerContext(
     downloadSessions,
     listFilesCancellations,
     gitStatusCancellations,
-    closeDownloadSession,
-    cleanupDownloadSessionsForSender
+    closeDownloadSession
   }
 }
diff --git a/src/main/ipc/filesystem/filesystem-read-handlers.ts b/src/main/ipc/filesystem/filesystem-read-handlers.ts
index 2850ba659b4..1d9fe681fee 100644
--- a/src/main/ipc/filesystem/filesystem-read-handlers.ts
+++ b/src/main/ipc/filesystem/filesystem-read-handlers.ts
@@ -13,6 +13,7 @@ import { resolveRegisteredWorktreePath } from '../registered-worktree-roots-cach
 import { resolveAuthorizedPath } from '../filesystem-auth'
 import { isENOENT } from '../filesystem-path-containment'
 import { listMarkdownDocuments, markdownDocumentsFromRelativePaths } from '../markdown-documents'
+import { getLocalGitOptionsForRegisteredWorktree } from '../local-worktree-runtime-options'
 import { recordCrashBreadcrumb } from '../../crash-reporting/crash-breadcrumb-store'
 import { buildReadDirErrorBreadcrumb, type ReadDirThrowSite } from '../readdir-error-diagnostics'
 import type { FilesystemHandlerContext } from './filesystem-handler-context'
@@ -131,7 +132,10 @@ export function registerFilesystemReadHandlers(context: FilesystemHandlerContext
         return markdownDocumentsFromRelativePaths(args.rootPath, relativePaths)
       }
       const rootPath = await resolveRegisteredWorktreePath(args.rootPath, store)
-      return listMarkdownDocuments(rootPath)
+      return listMarkdownDocuments(
+        rootPath,
+        getLocalGitOptionsForRegisteredWorktree(store, args.rootPath, rootPath)
+      )
     }
   )
 
diff --git a/src/main/ipc/folder-repo-git-upgrade-lifetime.test.ts b/src/main/ipc/folder-repo-git-upgrade-lifetime.test.ts
new file mode 100644
index 00000000000..8205381f997
--- /dev/null
+++ b/src/main/ipc/folder-repo-git-upgrade-lifetime.test.ts
@@ -0,0 +1,225 @@
+import { join } from 'node:path'
+import type { BrowserWindow } from 'electron'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Repo } from '../../shared/repo-types'
+import type { Store } from '../persistence'
+
+const fake = vi.hoisted(() => ({
+  stat: vi.fn(),
+  git: vi.fn(),
+  root: vi.fn(),
+  prepare: vi.fn(),
+  invalidate: vi.fn(),
+  reposChanged: vi.fn(),
+  worktreesChanged: vi.fn(),
+  unsubscribe: vi.fn()
+}))
+vi.mock('node:fs/promises', () => ({ stat: fake.stat }))
+vi.mock('node:fs', () => ({ realpathSync: (path: string) => path }))
+vi.mock('../git/repo', () => ({ isGitRepo: fake.git, getGitRepoRoot: fake.root }))
+vi.mock('../worktree-root-preparation', () => ({ prepareLocalWorktreeRootForRepo: fake.prepare }))
+vi.mock('./registered-worktree-roots-cache', () => ({
+  invalidateAuthorizedRootsCache: fake.invalidate
+}))
+vi.mock('./repos/repos-changed-notification', () => ({ notifyReposChanged: fake.reposChanged }))
+vi.mock('./worktree-remote', () => ({ notifyWorktreesChanged: fake.worktreesChanged }))
+vi.mock('./worktree-base-directory-poller', () => ({
+  WORKTREE_BASE_BACKSTOP_TICKS: 15,
+  WORKTREE_BASE_POLL_INTERVAL_MS: 2000,
+  createWorktreePollerWindowVisibility: () => ({
+    isWindowVisible: () => true,
+    onWindowBecameVisible: () => fake.unsubscribe
+  })
+}))
+
+import {
+  startFolderRepoGitUpgradeWatch,
+  stopFolderRepoGitUpgradeWatch
+} from './folder-repo-git-upgrade'
+import { wakeFolderRepoGitUpgradeWatch } from './folder-repo-git-upgrade-wake'
+
+const marker = { mtimeMs: 1, ctimeMs: 1, ino: 1 }
+const root = join('mock', 'folder')
+function folder(path = root): Repo {
+  return { id: path, path, kind: 'folder', displayName: 'Folder', addedAt: 0, badgeColor: 'blue' }
+}
+function deferred<T>() {
+  let resolve: (value: T) => void = () => {}
+  let reject: (error: Error) => void = () => {}
+  const promise = new Promise<T>((yes, no) => {
+    resolve = yes
+    reject = no
+  })
+  return { promise, resolve, reject }
+}
+function begin(repos = [folder()], meta: ReturnType<Store['getAllWorktreeMeta']> = {}) {
+  const store = {
+    getRepos: () => repos,
+    getRepo: (id: string) => repos.find((repo) => repo.id === id),
+    getAllWorktreeMeta: () => meta,
+    updateRepo: vi.fn((id: string, patch: Partial<Repo>) => {
+      const repo = repos.find((row) => row.id === id)
+      return repo ? Object.assign(repo, patch) : null
+    })
+  }
+  const window = { isDestroyed: () => false }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Every Store method reachable by this poller is supplied; root preparation is mocked.
+  const storeFixture = store as unknown as Store
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Visibility and notifiers are mocked; only isDestroyed is read on this window.
+  const windowFixture = window as BrowserWindow
+  startFolderRepoGitUpgradeWatch(storeFixture, windowFixture, { pollIntervalMs: 25 })
+  return { store, window }
+}
+async function flush(): Promise<void> {
+  for (let index = 0; index < 10; index++) {
+    await Promise.resolve()
+  }
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.resetAllMocks()
+  fake.stat.mockResolvedValue(marker)
+  fake.git.mockReturnValue(true)
+  fake.root.mockImplementation((path: string) => path)
+  fake.prepare.mockResolvedValue(undefined)
+})
+afterEach(() => {
+  stopFolderRepoGitUpgradeWatch()
+  vi.useRealTimers()
+})
+
+describe('folder repo upgrade poll lifetime', () => {
+  it('does not start Git checks or mutations when a marker arrives after stop', async () => {
+    const pending = deferred<typeof marker>()
+    fake.stat.mockReturnValue(pending.promise)
+    const { store } = begin()
+    await vi.advanceTimersByTimeAsync(25)
+    expect(fake.stat).toHaveBeenCalledTimes(1)
+    stopFolderRepoGitUpgradeWatch()
+    pending.resolve(marker)
+    await flush()
+    expect(fake.git).not.toHaveBeenCalled()
+    expect(fake.root).not.toHaveBeenCalled()
+    expect(store.updateRepo).not.toHaveBeenCalled()
+    expect(fake.prepare).not.toHaveBeenCalled()
+    expect(fake.invalidate).not.toHaveBeenCalled()
+    expect(fake.reposChanged).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('stops the remaining folder scan when a pending marker fails after stop', async () => {
+    const pending = deferred<typeof marker>()
+    fake.stat.mockReturnValue(pending.promise)
+    begin([folder(), folder(join('mock', 'other'))])
+    await vi.advanceTimersByTimeAsync(25)
+    stopFolderRepoGitUpgradeWatch()
+    pending.reject(new Error('ENOENT'))
+    await flush()
+    expect(fake.stat).toHaveBeenCalledTimes(1)
+    expect(fake.git).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('does not restore a rejected marker after its owner stops', async () => {
+    fake.git.mockImplementationOnce(() => {
+      stopFolderRepoGitUpgradeWatch()
+      return false
+    })
+    begin()
+    await vi.advanceTimersByTimeAsync(25)
+    expect(fake.git).toHaveBeenCalledTimes(1)
+    begin()
+    await vi.advanceTimersByTimeAsync(25)
+    expect(fake.git).toHaveBeenCalledTimes(2)
+    expect(fake.prepare).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not prune a replacement watcher cache when earlier preparation finishes', async () => {
+    const pending = deferred<void>()
+    fake.prepare.mockReturnValueOnce(pending.promise)
+    begin()
+    await vi.advanceTimersByTimeAsync(25)
+    expect(fake.prepare).toHaveBeenCalledTimes(1)
+    stopFolderRepoGitUpgradeWatch()
+    fake.git.mockReturnValue(false)
+    begin([folder(join('mock', 'replacement'))])
+    await vi.advanceTimersByTimeAsync(25)
+    expect(fake.git).toHaveBeenCalledTimes(2)
+    pending.resolve()
+    await flush()
+    await vi.advanceTimersByTimeAsync(50)
+    expect(fake.git).toHaveBeenCalledTimes(2)
+    expect(fake.reposChanged).not.toHaveBeenCalled()
+    expect(fake.invalidate).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps active upgrade preparation, cache invalidation and notifications', async () => {
+    const { store, window } = begin()
+    await vi.advanceTimersByTimeAsync(25)
+    expect(store.updateRepo).toHaveBeenCalledWith(root, {
+      kind: 'git',
+      folderUpgradeGitRootPath: root,
+      externalWorktreeVisibility: 'hide'
+    })
+    expect(fake.prepare).toHaveBeenCalledTimes(1)
+    expect(fake.invalidate).toHaveBeenCalledTimes(1)
+    expect(fake.reposChanged).toHaveBeenCalledWith(window)
+    expect(fake.worktreesChanged).toHaveBeenCalledWith(window, root)
+  })
+
+  it('retries a missing marker and dedupes stable rejected markers', async () => {
+    fake.stat.mockRejectedValueOnce(new Error('ENOENT'))
+    fake.git.mockReturnValue(false)
+    begin()
+    await vi.advanceTimersByTimeAsync(100)
+    expect(fake.stat).toHaveBeenCalledTimes(4)
+    expect(fake.git).toHaveBeenCalledTimes(1)
+    fake.stat.mockResolvedValue({ ...marker, mtimeMs: 2 })
+    await vi.advanceTimersByTimeAsync(25)
+    expect(fake.git).toHaveBeenCalledTimes(2)
+  })
+
+  it('still excludes SSH, WSL, nonlocal execution hosts and git projects', async () => {
+    begin([
+      { ...folder(), connectionId: 'ssh' },
+      folder(String.raw`\\wsl$\Ubuntu\home\project`),
+      { ...folder(), executionHostId: 'runtime:other' },
+      { ...folder(), kind: 'git' }
+    ])
+    await vi.advanceTimersByTimeAsync(25)
+    expect(fake.stat).not.toHaveBeenCalled()
+    expect(fake.git).not.toHaveBeenCalled()
+  })
+
+  it('does not upgrade a project with extra folder workspaces', async () => {
+    const { store } = begin([folder()], {
+      [`${root}::${root}::workspace:extra`]: {
+        displayName: 'Extra',
+        comment: '',
+        linkedIssue: null,
+        linkedPR: null,
+        linkedLinearIssue: null,
+        isArchived: false,
+        isUnread: false,
+        isPinned: false,
+        sortOrder: 0,
+        lastActivityAt: 0
+      }
+    })
+    await vi.advanceTimersByTimeAsync(25)
+    expect(fake.stat).toHaveBeenCalledTimes(1)
+    expect(fake.git).not.toHaveBeenCalled()
+    expect(store.updateRepo).not.toHaveBeenCalled()
+  })
+
+  it('releases timer, wake and visibility ownership on stop', async () => {
+    begin()
+    stopFolderRepoGitUpgradeWatch()
+    wakeFolderRepoGitUpgradeWatch()
+    await vi.advanceTimersByTimeAsync(1000)
+    expect(fake.unsubscribe).toHaveBeenCalledTimes(1)
+    expect(fake.stat).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+})
diff --git a/src/main/ipc/folder-repo-git-upgrade.ts b/src/main/ipc/folder-repo-git-upgrade.ts
index e393ae56158..8a0a6130c0e 100644
--- a/src/main/ipc/folder-repo-git-upgrade.ts
+++ b/src/main/ipc/folder-repo-git-upgrade.ts
@@ -164,10 +164,17 @@ async function pollOnce(watch: UpgradeWatch): Promise<void> {
     const key = normalizeRuntimePathForComparison(repo.path)
     liveKeys.add(key)
     const signature = await readGitMarkerSignature(repo.path)
+    if (watch.disposed) {
+      return
+    }
     if (signature === null || rejectedMarkers.get(key) === signature) {
       continue
     }
-    if ((await upgradeFolderRepo(watch, repo.id)) === 'rejected') {
+    const result = await upgradeFolderRepo(watch, repo.id)
+    if (watch.disposed) {
+      return
+    }
+    if (result === 'rejected') {
       rejectedMarkers.set(key, signature)
     }
   }
diff --git a/src/main/ipc/freebuff-detection.test.ts b/src/main/ipc/freebuff-detection.test.ts
new file mode 100644
index 00000000000..6c74e6409b5
--- /dev/null
+++ b/src/main/ipc/freebuff-detection.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it } from 'vitest'
+import {
+  getTuiAgentDetectionProbeCommands,
+  KNOWN_TUI_AGENT_DETECTION_COMMANDS,
+  resolveDetectedTuiAgentIds
+} from './tui-agent-detection-commands'
+
+describe('Freebuff detection', () => {
+  it.each(['darwin', 'linux', 'win32', 'wsl'] as const)(
+    'detects Freebuff independently of Codebuff on %s',
+    (runtime) => {
+      expect(
+        getTuiAgentDetectionProbeCommands(KNOWN_TUI_AGENT_DETECTION_COMMANDS, runtime)
+      ).toContain('freebuff')
+      expect(
+        resolveDetectedTuiAgentIds(
+          KNOWN_TUI_AGENT_DETECTION_COMMANDS,
+          new Set(['freebuff']),
+          runtime
+        )
+      ).toEqual(['freebuff'])
+      expect(
+        resolveDetectedTuiAgentIds(
+          KNOWN_TUI_AGENT_DETECTION_COMMANDS,
+          new Set(['codebuff']),
+          runtime
+        )
+      ).toEqual(['codebuff'])
+      expect(
+        resolveDetectedTuiAgentIds(
+          KNOWN_TUI_AGENT_DETECTION_COMMANDS,
+          new Set(['freebuff', 'codebuff']),
+          runtime
+        )
+      ).toEqual(expect.arrayContaining(['freebuff', 'codebuff']))
+    }
+  )
+})
diff --git a/src/main/ipc/github-ipc-channel-parity.test.ts b/src/main/ipc/github-ipc-channel-parity.test.ts
deleted file mode 100644
index 1746890199a..00000000000
--- a/src/main/ipc/github-ipc-channel-parity.test.ts
+++ /dev/null
@@ -1,110 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-
-const mocks = await vi.hoisted(async () => {
-  const { createGitHubIpcMocks } = await import('./github-ipc-module-mocks')
-  return createGitHubIpcMocks()
-})
-
-vi.mock('electron', () => mocks.electron)
-vi.mock('../github/client', () => mocks.client)
-vi.mock('../github/work-item-details', () => mocks.workItemDetails)
-vi.mock('../github/pr-refresh-coordinator', () => mocks.prRefresh)
-vi.mock('../telemetry/client', () => mocks.telemetry)
-vi.mock('../telemetry/cohort-classifier', () => mocks.cohort)
-vi.mock('./ui', () => mocks.ui)
-
-import * as github from './github'
-import { createGitHubIpcHarness } from './github-ipc-test-harness'
-
-const EXPECTED_GITHUB_IPC_CHANNELS = [
-  'gh:prForBranch',
-  'gh:refreshPRNow',
-  'gh:enqueuePRRefresh',
-  'gh:reportVisiblePRRefreshCandidates',
-  'gh:issue',
-  'gh:listIssues',
-  'gh:createIssue',
-  'gh:listWorkItems',
-  'gh:countWorkItems',
-  'gh:workItem',
-  'gh:workItemByOwnerRepo',
-  'gh:workItemDetails',
-  'gh:notifyWorkItemMutated',
-  'gh:prFileContents',
-  'gh:repoSlug',
-  'gh:repoUpstream',
-  'gh:prChecks',
-  'gh:prCheckDetails',
-  'gh:prComments',
-  'gh:setPRCommentReaction',
-  'gh:resolveReviewThread',
-  'gh:setPRFileViewed',
-  'gh:addPRReviewCommentReply',
-  'gh:addPRReviewComment',
-  'gh:updatePRTitle',
-  'gh:mergePR',
-  'gh:setPRAutoMerge',
-  'gh:updatePRState',
-  'gh:markPRReadyForReview',
-  'gh:rerunPRChecks',
-  'gh:requestPRReviewers',
-  'gh:removePRReviewers',
-  'gh:updateIssue',
-  'gh:addIssueComment',
-  'gh:listLabels',
-  'gh:listAssignableUsers',
-  'gh:viewer',
-  'gh:checkOrcaStarred',
-  'gh:starOrca',
-  'gh:rateLimit',
-  'gh:diagnoseAuth',
-  'gh:listBindableAccounts',
-  'gh:validateAccountBinding',
-  'gh:listAccessibleProjects',
-  'gh:resolveProjectRef',
-  'gh:listProjectViews',
-  'gh:getProjectViewTable',
-  'gh:projectWorkItemDetailsBySlug',
-  'gh:updateProjectItemField',
-  'gh:clearProjectItemField',
-  'gh:updateIssueBySlug',
-  'gh:updatePullRequestBySlug',
-  'gh:addIssueCommentBySlug',
-  'gh:updateIssueCommentBySlug',
-  'gh:deleteIssueCommentBySlug',
-  'gh:listLabelsBySlug',
-  'gh:listAssignableUsersBySlug',
-  'gh:listIssueTypesBySlug',
-  'gh:updateIssueTypeBySlug'
-] as const
-
-describe('GitHub IPC channel parity', () => {
-  const harness = createGitHubIpcHarness(mocks)
-
-  beforeEach(harness.reset)
-
-  it('preserves the facade and fixed IPC channel contract', () => {
-    github.registerGitHubHandlers(harness.store as never, harness.stats as never)
-
-    // The preload facade now composes the two GitHub bridge owners; inspect
-    // both owners so the channel census remains tied to the actual invokes.
-    const preloadSource = [
-      '../../preload/api/gh-bridge-pull-requests-and-work-items.ts',
-      '../../preload/api/gh-bridge-mutations-and-projects.ts'
-    ]
-      .map((relativePath) => readFileSync(new URL(relativePath, import.meta.url), 'utf8'))
-      .join('\n')
-    const exposedChannels = [...preloadSource.matchAll(/ipcRenderer\.invoke\('(gh:[^']+)'/g)].map(
-      (match) => match[1]
-    )
-    const registeredChannels = mocks.electron.ipcMain.handle.mock.calls.map(
-      ([channel]) => channel as string
-    )
-
-    expect(Object.keys(github)).toEqual(['registerGitHubHandlers'])
-    expect(new Set(registeredChannels).size).toBe(registeredChannels.length)
-    expect(registeredChannels).toEqual(EXPECTED_GITHUB_IPC_CHANNELS)
-    expect(registeredChannels.toSorted()).toEqual([...new Set(exposedChannels)].toSorted())
-  })
-})
diff --git a/src/main/ipc/github-star-telemetry.test.ts b/src/main/ipc/github-star-telemetry.test.ts
index 30be879cef8..9dd9a1c1e91 100644
--- a/src/main/ipc/github-star-telemetry.test.ts
+++ b/src/main/ipc/github-star-telemetry.test.ts
@@ -55,31 +55,6 @@ describe('registerGitHubHandlers', () => {
     })
   })
 
-  it('accepts every app star source for success telemetry', async () => {
-    starOrcaMock.mockResolvedValue(true)
-
-    registerGitHubHandlers(store as never, stats as never)
-
-    for (const source of [
-      'star_nag',
-      'agent_value_moment',
-      'onboarding_completed',
-      'settings',
-      'landing'
-    ] as const) {
-      await expect(handlers['gh:starOrca'](null, source)).resolves.toBe(true)
-    }
-
-    expect(trackMock).toHaveBeenCalledTimes(5)
-    expect(trackMock.mock.calls.map(([, props]) => props)).toEqual([
-      { source: 'star_nag', nth_repo_added: undefined },
-      { source: 'agent_value_moment', nth_repo_added: undefined },
-      { source: 'onboarding_completed', nth_repo_added: undefined },
-      { source: 'settings', nth_repo_added: undefined },
-      { source: 'landing', nth_repo_added: undefined }
-    ])
-  })
-
   it('does not emit app_starred_orca when the star action returns false', async () => {
     starOrcaMock.mockResolvedValue(false)
 
diff --git a/src/main/ipc/hooks/register-worktree-hook-check-handler.ts b/src/main/ipc/hooks/register-worktree-hook-check-handler.ts
index 6b64dbe6a6f..443f3b108db 100644
--- a/src/main/ipc/hooks/register-worktree-hook-check-handler.ts
+++ b/src/main/ipc/hooks/register-worktree-hook-check-handler.ts
@@ -1,3 +1,4 @@
+import { getStoredRepoSshConnectionId } from '../../repo-execution-host'
 import { ipcMain } from 'electron'
 import type { ExecutionHostId } from '../../../shared/execution-host'
 import { isFolderRepo } from '../../../shared/repo-kind'
@@ -29,8 +30,9 @@ export function registerWorktreeHookCheckHandler(context: WorktreeIpcContext): v
         return { status: 'ok', hasHooks: false, hooks: null, mayNeedUpdate: false }
       }
 
-      if (repo.connectionId) {
-        const fsProvider = getSshFilesystemProvider(repo.connectionId)
+      const connectionId = getStoredRepoSshConnectionId(repo)
+      if (connectionId) {
+        const fsProvider = getSshFilesystemProvider(connectionId)
         if (!fsProvider) {
           return { status: 'error', hasHooks: false, hooks: null, mayNeedUpdate: false }
         }
diff --git a/src/main/ipc/hooks/register-worktree-hook-file-handlers.ts b/src/main/ipc/hooks/register-worktree-hook-file-handlers.ts
index 1ddf379f784..ca1bfbcfb78 100644
--- a/src/main/ipc/hooks/register-worktree-hook-file-handlers.ts
+++ b/src/main/ipc/hooks/register-worktree-hook-file-handlers.ts
@@ -1,3 +1,4 @@
+import { getStoredRepoSshConnectionId } from '../../repo-execution-host'
 import { getLocalProjectWorktreeGitOptions } from '../../project-runtime-git-options'
 import { ipcMain } from 'electron'
 import type { ExecutionHostId } from '../../../shared/execution-host'
@@ -32,9 +33,10 @@ export function registerWorktreeHookFileHandlers(context: WorktreeIpcContext): v
           source: 'none' as const
         }
       }
-      if (repo.connectionId) {
+      const connectionId = getStoredRepoSshConnectionId(repo)
+      if (connectionId) {
         const issueCommandPath = joinWorktreeRelativePath(repo.path, '.orca/issue-command')
-        const fsProvider = getSshFilesystemProvider(repo.connectionId)
+        const fsProvider = getSshFilesystemProvider(connectionId)
         if (!fsProvider) {
           return {
             status: 'error',
@@ -92,9 +94,10 @@ export function registerWorktreeHookFileHandlers(context: WorktreeIpcContext): v
       if (!repo || isFolderRepo(repo)) {
         return
       }
-      if (repo.connectionId) {
+      const connectionId = getStoredRepoSshConnectionId(repo)
+      if (connectionId) {
         const issueCommandPath = joinWorktreeRelativePath(repo.path, '.orca/issue-command')
-        const fsProvider = getSshFilesystemProvider(repo.connectionId)
+        const fsProvider = getSshFilesystemProvider(connectionId)
         if (!fsProvider) {
           throw new Error(
             'Remote filesystem unavailable. Reconnect the SSH target before retrying.'
@@ -110,7 +113,7 @@ export function registerWorktreeHookFileHandlers(context: WorktreeIpcContext): v
           return
         }
         await fsProvider.createDir(joinWorktreeRelativePath(repo.path, '.orca'))
-        if (await isIssueCommandIgnoredByGit(repo.path, repo.connectionId)) {
+        if (await isIssueCommandIgnoredByGit(repo.path, connectionId)) {
           await fsProvider.writeFile(issueCommandPath, `${trimmed}\n`)
           return
         }
diff --git a/src/main/ipc/hooks/register-worktree-hook-inspection-handler.ts b/src/main/ipc/hooks/register-worktree-hook-inspection-handler.ts
index 36dcfbc1288..6df6e79dbb8 100644
--- a/src/main/ipc/hooks/register-worktree-hook-inspection-handler.ts
+++ b/src/main/ipc/hooks/register-worktree-hook-inspection-handler.ts
@@ -1,3 +1,4 @@
+import { getStoredRepoSshConnectionId } from '../../repo-execution-host'
 import { ipcMain } from 'electron'
 import type { ExecutionHostId } from '../../../shared/execution-host'
 import { isFolderRepo } from '../../../shared/repo-kind'
@@ -23,8 +24,9 @@ export function registerWorktreeHookInspectionHandler(context: WorktreeIpcContex
       return inspectSetupScriptImportCandidates(
         async (relativePath) => {
           const filePath = joinWorktreeRelativePath(repo.path, relativePath)
-          if (repo.connectionId) {
-            const fsProvider = getSshFilesystemProvider(repo.connectionId)
+          const connectionId = getStoredRepoSshConnectionId(repo)
+          if (connectionId) {
+            const fsProvider = getSshFilesystemProvider(connectionId)
             if (!fsProvider) {
               return null
             }
@@ -48,8 +50,9 @@ export function registerWorktreeHookInspectionHandler(context: WorktreeIpcContex
         {
           fileExists: async (relativePath) => {
             const filePath = joinWorktreeRelativePath(repo.path, relativePath)
-            if (repo.connectionId) {
-              const fsProvider = getSshFilesystemProvider(repo.connectionId)
+            const connectionId = getStoredRepoSshConnectionId(repo)
+            if (connectionId) {
+              const fsProvider = getSshFilesystemProvider(connectionId)
               if (!fsProvider) {
                 return false
               }
diff --git a/src/main/ipc/hooks/worktree-hook-execution-host.test.ts b/src/main/ipc/hooks/worktree-hook-execution-host.test.ts
new file mode 100644
index 00000000000..181d5a441d5
--- /dev/null
+++ b/src/main/ipc/hooks/worktree-hook-execution-host.test.ts
@@ -0,0 +1,251 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Repo } from '../../../shared/repo-types'
+import { hydrateRepo } from '../../persistence/tracking-repos/repo-hydration'
+
+const mocks = vi.hoisted(() => ({
+  handlers: new Map<string, (event: unknown, args: unknown) => unknown>(),
+  hasHooks: vi.fn(),
+  loadHooks: vi.fn(),
+  effectiveHooks: vi.fn(),
+  localRead: vi.fn(),
+  localWrite: vi.fn(),
+  localFileRead: vi.fn(),
+  localStat: vi.fn(),
+  remoteRead: vi.fn(),
+  remoteWrite: vi.fn(),
+  remoteStat: vi.fn(),
+  remoteMkdir: vi.fn(),
+  provider: vi.fn(),
+  ignored: vi.fn()
+}))
+vi.mock('electron', () => ({
+  ipcMain: {
+    handle: (channel: string, handler: (event: unknown, args: unknown) => unknown) =>
+      mocks.handlers.set(channel, handler)
+  }
+}))
+vi.mock('../../hooks', () => ({
+  hasHooksFile: mocks.hasHooks,
+  loadHooks: mocks.loadHooks,
+  getEffectiveHooks: mocks.effectiveHooks,
+  hasUnrecognizedOrcaYamlKeys: () => false,
+  parseOrcaYaml: () => ({ issueCommand: 'shared' })
+}))
+vi.mock('../../issue-command-file', () => ({
+  readIssueCommand: mocks.localRead,
+  writeIssueCommand: mocks.localWrite,
+  isIssueCommandIgnoredByGit: mocks.ignored
+}))
+vi.mock('../../project-runtime-git-options', () => ({
+  getLocalProjectWorktreeGitOptions: () => ({})
+}))
+vi.mock('../../providers/ssh-filesystem-dispatch', () => ({
+  getSshFilesystemProvider: mocks.provider
+}))
+vi.mock('node:fs/promises', () => ({ readFile: mocks.localFileRead, stat: mocks.localStat }))
+vi.mock('../../../shared/setup-script-imports', () => ({
+  inspectSetupScriptImportCandidates: async (
+    read: (path: string) => Promise<unknown>,
+    options?: { fileExists: (path: string) => Promise<boolean> }
+  ) => {
+    await read('setup.sh')
+    await options?.fileExists('package.json')
+    return []
+  }
+}))
+vi.mock('../../effective-hook-config', () => ({
+  getEffectiveSetupRunPolicy: () => 'manual',
+  getDefaultTabCommandTrustContent: () => undefined
+}))
+import { RuntimeRepositoryHooksCommands } from '../../runtime/runtime-repository-hooks-commands'
+import { RuntimeRepositoryIssueCommand } from '../../runtime/runtime-repository-issue-command'
+import { getRepoExecutionHostId } from '../../../shared/execution-host'
+import { registerWorktreeHookCheckHandler } from './register-worktree-hook-check-handler'
+import { registerWorktreeHookFileHandlers } from './register-worktree-hook-file-handlers'
+import { registerWorktreeHookInspectionHandler } from './register-worktree-hook-inspection-handler'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.handlers.clear()
+  mocks.remoteRead.mockResolvedValue({ content: 'remote command', isBinary: false })
+  mocks.remoteWrite.mockResolvedValue(undefined)
+  mocks.remoteMkdir.mockResolvedValue(undefined)
+  mocks.remoteStat.mockResolvedValue({ type: 'file' })
+  mocks.ignored.mockResolvedValue(true)
+  mocks.localRead.mockResolvedValue({ localContent: 'wrong host' })
+  mocks.localWrite.mockResolvedValue(undefined)
+  mocks.localFileRead.mockResolvedValue('wrong host')
+  mocks.localStat.mockResolvedValue({ isDirectory: () => false })
+  mocks.hasHooks.mockReturnValue(false)
+  mocks.provider.mockReturnValue({
+    readFile: mocks.remoteRead,
+    writeFile: mocks.remoteWrite,
+    createDir: mocks.remoteMkdir,
+    stat: mocks.remoteStat
+  })
+})
+
+const owners = [
+  { label: 'legacy SSH', fields: { connectionId: 'host-a' }, target: 'host-a' },
+  { label: 'canonical SSH', fields: { executionHostId: 'ssh:host-a' }, target: 'host-a' },
+  {
+    label: 'canonical SSH over stale legacy target',
+    fields: { executionHostId: 'ssh:host-a', connectionId: 'stale' },
+    target: 'host-a'
+  },
+  { label: 'local', fields: {}, target: null },
+  {
+    label: 'explicit local over stale legacy target',
+    fields: { executionHostId: 'local', connectionId: 'stale' },
+    target: null
+  },
+  { label: 'own-store runtime stamp', fields: { executionHostId: 'runtime:env' }, target: null },
+  {
+    label: 'runtime stamp with nested legacy target',
+    fields: { executionHostId: 'runtime:env', connectionId: 'nested' },
+    target: null
+  }
+] as const satisfies readonly {
+  label: string
+  fields: Pick<Repo, 'connectionId' | 'executionHostId'>
+  target: string | null
+}[]
+
+const channels = [
+  'hooks:check',
+  'hooks:readIssueCommand',
+  'hooks:writeIssueCommand',
+  'hooks:inspectSetupScriptImports'
+] as const
+
+function register(repo: Repo): void {
+  const context = { store: { getRepos: () => [repo], getRepo: () => repo } }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: These adapters only read the provided store accessors.
+  registerWorktreeHookCheckHandler(context as never)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: These adapters only read the provided store accessors.
+  registerWorktreeHookFileHandlers(context as never)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: These adapters only read the provided store accessors.
+  registerWorktreeHookInspectionHandler(context as never)
+}
+
+function makeRepo(fields: Pick<Repo, 'connectionId' | 'executionHostId'>): Repo {
+  return hydrateRepo(
+    {
+      id: 'repo',
+      path: '/remote/fixture',
+      displayName: 'fixture',
+      badgeColor: '#000',
+      addedAt: 0,
+      ...fields
+    },
+    new Map()
+  )
+}
+
+function expectRoute(target: string | null): void {
+  const localCalls = [
+    mocks.hasHooks,
+    mocks.localRead,
+    mocks.localWrite,
+    mocks.localFileRead,
+    mocks.localStat,
+    mocks.effectiveHooks
+  ]
+  if (target) {
+    expect(mocks.provider).toHaveBeenCalledWith(target)
+    for (const [connectionId] of mocks.provider.mock.calls) {
+      expect(connectionId).toBe(target)
+    }
+    for (const method of localCalls) {
+      expect(method).not.toHaveBeenCalled()
+    }
+  } else {
+    expect(mocks.provider).not.toHaveBeenCalled()
+    expect(localCalls.some((method) => method.mock.calls.length > 0)).toBe(true)
+    expect(mocks.remoteRead).not.toHaveBeenCalled()
+    expect(mocks.remoteWrite).not.toHaveBeenCalled()
+    expect(mocks.remoteStat).not.toHaveBeenCalled()
+  }
+}
+
+describe.each(owners)('desktop hooks: $label', ({ fields, target }) => {
+  it.each(channels)('routes %s to the stored owner', async (channel) => {
+    const repo = makeRepo(fields)
+    register(repo)
+    await mocks.handlers.get(channel)!(null, {
+      repoId: repo.id,
+      hostId: getRepoExecutionHostId(repo),
+      content: 'save'
+    })
+    expectRoute(target)
+    if (channel === 'hooks:writeIssueCommand' && target) {
+      expect(mocks.ignored).toHaveBeenCalledWith(repo.path, target)
+      expect(mocks.remoteWrite).toHaveBeenCalledWith(
+        '/remote/fixture/.orca/issue-command',
+        'save\n'
+      )
+    }
+  })
+})
+
+describe.each(owners)('runtime hooks: $label', ({ fields, target }) => {
+  it.each(['get', 'check', 'inspect', 'read', 'write'] as const)(
+    'routes %s to the stored owner',
+    async (method) => {
+      const repo = makeRepo(fields)
+      const hooks = new RuntimeRepositoryHooksCommands({ resolveRepo: async () => repo })
+      const issue = new RuntimeRepositoryIssueCommand({
+        resolveRepo: async () => repo,
+        getLocalGitArgs: () => []
+      })
+      if (method === 'get') {
+        await hooks.getRepoHooks(repo.id)
+      } else if (method === 'check') {
+        await hooks.checkRepoHooks(repo.id)
+      } else if (method === 'inspect') {
+        await hooks.inspectRepoSetupScriptImports(repo.id)
+      } else if (method === 'read') {
+        await issue.read(repo.id)
+      } else {
+        await issue.write(repo.id, 'save')
+      }
+      expectRoute(target)
+      if (method === 'write' && target) {
+        expect(mocks.ignored).toHaveBeenCalledWith(repo.path, target)
+        expect(mocks.remoteWrite).toHaveBeenCalledWith(
+          '/remote/fixture/.orca/issue-command',
+          'save\n'
+        )
+      }
+    }
+  )
+})
+
+it('refuses an unreachable canonical SSH write without touching local files', async () => {
+  const repo = makeRepo({ executionHostId: 'ssh:host-a' })
+  register(repo)
+  mocks.provider.mockReturnValue(null)
+  await expect(
+    mocks.handlers.get('hooks:writeIssueCommand')!(null, {
+      repoId: repo.id,
+      hostId: 'ssh:host-a',
+      content: 'save'
+    })
+  ).rejects.toThrow('Remote filesystem unavailable')
+  expect(mocks.localWrite).not.toHaveBeenCalled()
+})
+
+it.each(channels)('keeps folder repositories out of %s', async (channel) => {
+  const repo = { ...makeRepo({ executionHostId: 'ssh:host-a' }), kind: 'folder' as const }
+  register(repo)
+  await mocks.handlers.get(channel)!(null, {
+    repoId: repo.id,
+    hostId: 'ssh:host-a',
+    content: 'save'
+  })
+  expect(mocks.provider).not.toHaveBeenCalled()
+  expect(mocks.hasHooks).not.toHaveBeenCalled()
+  expect(mocks.localRead).not.toHaveBeenCalled()
+  expect(mocks.localWrite).not.toHaveBeenCalled()
+  expect(mocks.localFileRead).not.toHaveBeenCalled()
+})
diff --git a/src/main/ipc/markdown-documents-ripgrep-real.test.ts b/src/main/ipc/markdown-documents-ripgrep-real.test.ts
new file mode 100644
index 00000000000..373a6502c81
--- /dev/null
+++ b/src/main/ipc/markdown-documents-ripgrep-real.test.ts
@@ -0,0 +1,114 @@
+import { mkdir, mkdtemp, rm, symlink, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { basename, dirname, extname, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { resetBundledRipgrepPathCacheForTests } from '../ripgrep/bundled-ripgrep-path'
+import { listMarkdownDocuments } from './markdown-documents'
+
+describe('Markdown listing with bundled ripgrep', () => {
+  let root: string
+
+  beforeEach(async () => {
+    root = await mkdtemp(join(tmpdir(), 'orca Markdown 日本語 '))
+    resetBundledRipgrepPathCacheForTests()
+  })
+
+  afterEach(async () => {
+    vi.unstubAllEnvs()
+    resetBundledRipgrepPathCacheForTests()
+    await rm(root, { recursive: true, force: true })
+  })
+
+  async function put(relativePath: string, content = 'document'): Promise<void> {
+    const filePath = join(root, relativePath)
+    await mkdir(dirname(filePath), { recursive: true })
+    await writeFile(filePath, content)
+  }
+
+  it('preserves Markdown visibility independently of ignore files and rg configuration', async () => {
+    const included = [
+      'README.md',
+      'Guide.MDX',
+      'docs/Notes.MARKDOWN',
+      '.hidden.md',
+      'docs/.hidden.mdx',
+      '.github/CONTRIBUTING.md',
+      'docs/.github/nested/guide.md',
+      '.github/normal/.hidden.md',
+      'ignored-git/readme.md',
+      'ignored-rg/readme.md',
+      'ignored-dot/readme.md',
+      'space folder/日本語 document.md',
+      'uppercase/NODE_MODULES/visible.md'
+    ]
+    const excluded = [
+      'plain.txt',
+      '.md',
+      'docs/.MDX',
+      '.git/hidden.md',
+      'node_modules/hidden.md',
+      'docs/node_modules/hidden.md',
+      '.hidden/hidden.md',
+      '.hidden/.github/hidden.md',
+      '.github/.hidden/hidden.md',
+      '.github/node_modules/hidden.md',
+      '.github/.md/hidden.md',
+      '.github.txt/hidden.md',
+      'docs/.md/hidden.md'
+    ]
+    for (const filePath of [...included, ...excluded]) {
+      await put(filePath)
+    }
+    await put('.gitignore', 'ignored-git/\n')
+    await put('.rgignore', 'ignored-rg/\n')
+    await put('.ignore', 'ignored-dot/\n')
+    await put('rg-config', '--glob=!*.md\n')
+    vi.stubEnv('RIPGREP_CONFIG_PATH', join(root, 'rg-config'))
+
+    expect(await listMarkdownDocuments(root)).toEqual(
+      included
+        .sort((left, right) => left.localeCompare(right))
+        .map((relativePath) => ({
+          filePath: join(root, relativePath),
+          relativePath,
+          basename: basename(relativePath),
+          name: basename(relativePath, extname(relativePath))
+        }))
+    )
+  })
+
+  it('does not follow directory links or file links', async () => {
+    await put('docs/original.md')
+    await symlink(
+      join(root, 'docs'),
+      join(root, 'linked-docs'),
+      process.platform === 'win32' ? 'junction' : 'dir'
+    )
+    // File symlinks require privileges that Windows test runners may not have.
+    if (process.platform !== 'win32') {
+      await symlink(join(root, 'docs/original.md'), join(root, 'linked.md'))
+      await symlink(join(root, 'missing.md'), join(root, 'broken.md'))
+    }
+    expect((await listMarkdownDocuments(root)).map((document) => document.relativePath)).toEqual([
+      'docs/original.md'
+    ])
+  })
+
+  it.skipIf(process.platform === 'win32')('preserves line breaks in filenames', async () => {
+    const names = ['line\nbreak.md', 'carriage\rreturn.MDX', 'nested\nfolder/文書.md']
+    for (const name of names) {
+      await put(name)
+    }
+    expect((await listMarkdownDocuments(root)).map((document) => document.relativePath)).toEqual(
+      names.sort((left, right) => left.localeCompare(right))
+    )
+  })
+
+  it('returns an empty list for an empty ordinary folder', async () => {
+    await expect(listMarkdownDocuments(root)).resolves.toEqual([])
+  })
+
+  it('rejects a missing root rather than treating it as an empty folder', async () => {
+    await expect(listMarkdownDocuments(join(root, 'missing'))).rejects.toThrow()
+  })
+})
diff --git a/src/main/ipc/markdown-documents-ripgrep.test.ts b/src/main/ipc/markdown-documents-ripgrep.test.ts
new file mode 100644
index 00000000000..daee482bae1
--- /dev/null
+++ b/src/main/ipc/markdown-documents-ripgrep.test.ts
@@ -0,0 +1,146 @@
+import { EventEmitter } from 'node:events'
+import { PassThrough } from 'node:stream'
+import { resolve } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { spawnMock } = vi.hoisted(() => ({ spawnMock: vi.fn() }))
+vi.mock('../ripgrep/bundled-ripgrep-spawn', () => ({ spawnBundledRipgrep: spawnMock }))
+
+import { listMarkdownDocuments } from './markdown-documents'
+
+class ListingProcess extends EventEmitter {
+  stdout = new PassThrough()
+  stderr = new PassThrough()
+  pid: number | undefined = 123
+  kill = vi.fn(() => true)
+}
+
+const root = resolve('/workspace/docs')
+const originalPlatform = process.platform
+let child: ListingProcess
+
+beforeEach(() => {
+  child = new ListingProcess()
+  spawnMock.mockReset().mockReturnValue(child)
+})
+afterEach(() => {
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+  Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
+})
+
+describe('Markdown document ripgrep lifecycle', () => {
+  it('decodes split Unicode and NUL records without splitting newline filenames', async () => {
+    const result = listMarkdownDocuments(root)
+    const bytes = Buffer.from('./日本語\nnotes.MDX\0./.md\0./script.ts\0./README.md\0')
+    for (const byte of bytes) {
+      child.stdout.write(Buffer.from([byte]))
+    }
+    child.emit('close', 0, null)
+
+    expect((await result).map((doc) => doc.basename).sort()).toEqual([
+      'README.md',
+      '日本語\nnotes.MDX'
+    ])
+    expect(child.kill).not.toHaveBeenCalled()
+    expect(child.stdout.listenerCount('data')).toBe(0)
+    expect(child.listenerCount('close')).toBe(0)
+  })
+
+  it('accepts an empty listing', async () => {
+    const result = listMarkdownDocuments(root)
+    child.emit('close', 1, null)
+    await expect(result).resolves.toEqual([])
+  })
+
+  it('rejects an unreadable subtree even after receiving valid documents', async () => {
+    const result = listMarkdownDocuments(root)
+    child.stdout.write('./README.md\0')
+    child.stderr.write('Permission denied')
+    child.emit('close', 2, null)
+    await expect(result).rejects.toThrow('Permission denied')
+  })
+
+  it('rejects a truncated final path instead of returning partial documents', async () => {
+    const result = listMarkdownDocuments(root)
+    child.stdout.write('./README.md\0./unfinished.md')
+    child.emit('close', 0, null)
+    await expect(result).rejects.toThrow('Incomplete path')
+  })
+
+  it.each(['../escape.md', '/outside.md', './dir/../escape.md'])(
+    'rejects a path outside the relative listing protocol: %s',
+    async (path) => {
+      const result = listMarkdownDocuments(root)
+      child.stdout.write(`${path}\0`)
+      await expect(result).rejects.toThrow('Invalid path')
+      expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+    }
+  )
+
+  it('rejects an oversized unfinished record without retaining the process', async () => {
+    const result = listMarkdownDocuments(root)
+    child.stdout.write(`./${'a'.repeat(1024 * 1024)}`)
+    await expect(result).rejects.toThrow('path exceeds')
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('rejects a spawn failure and does not signal a missing process', async () => {
+    const result = listMarkdownDocuments(root)
+    child.pid = undefined
+    child.emit('error', Object.assign(new Error('missing bundled binary'), { code: 'ENOENT' }))
+    await expect(result).rejects.toThrow('missing bundled binary')
+    expect(child.kill).not.toHaveBeenCalled()
+  })
+
+  it('rejects synchronous spawn failures', async () => {
+    spawnMock.mockImplementation(() => {
+      throw new Error('spawn refused')
+    })
+    await expect(listMarkdownDocuments(root)).rejects.toThrow('spawn refused')
+  })
+
+  it('times out, kills the child and releases listeners even if close never arrives', async () => {
+    vi.useFakeTimers()
+    const result = listMarkdownDocuments(root)
+    const rejected = expect(result).rejects.toThrow('timed out')
+    child.stdout.write('./README.md\0')
+    await vi.advanceTimersByTimeAsync(15_000)
+    await rejected
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+    expect(child.stdout.listenerCount('data')).toBe(0)
+    expect(child.stderr.listenerCount('data')).toBe(0)
+    expect(child.listenerCount('close')).toBe(0)
+    expect(vi.getTimerCount()).toBe(0)
+    expect(() => child.emit('error', new Error('late error'))).not.toThrow()
+    expect(() => child.stdout.emit('error', new Error('late pipe error'))).not.toThrow()
+  })
+
+  it('rejects stdout failure instead of returning an incomplete set', async () => {
+    const result = listMarkdownDocuments(root)
+    child.stdout.emit('error', new Error('broken pipe'))
+    await expect(result).rejects.toThrow('broken pipe')
+  })
+
+  it('does not confuse an unreachable WSL cwd with no matching documents', async () => {
+    const result = listMarkdownDocuments(root, { wslDistro: 'Ubuntu' })
+    child.emit('close', 97, null)
+    await expect(result).rejects.toThrow('Search root is not reachable')
+  })
+
+  it.each([
+    { path: root, options: { wslDistro: 'Ubuntu' }, distro: 'Ubuntu' },
+    { path: '\\\\wsl.localhost\\Debian\\home\\repo', options: {}, distro: 'Debian' }
+  ])('selects the Linux binary for $distro', async ({ path, options, distro }) => {
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    const result = listMarkdownDocuments(path, options)
+    expect(spawnMock).toHaveBeenCalledWith(expect.any(Array), {
+      cwd: path,
+      wslDistro: options.wslDistro,
+      wslDistroForOutput: distro,
+      stdio: ['ignore', 'pipe', 'pipe']
+    })
+    child.emit('close', 1, null)
+    await result
+  })
+})
diff --git a/src/main/ipc/markdown-documents.ts b/src/main/ipc/markdown-documents.ts
index 38466da6087..3977999b9af 100644
--- a/src/main/ipc/markdown-documents.ts
+++ b/src/main/ipc/markdown-documents.ts
@@ -1,6 +1,11 @@
-import { readdir } from 'node:fs/promises'
 import { basename as pathBasename, extname, isAbsolute, join, relative, resolve } from 'node:path'
 import type { MarkdownDocument } from '../../shared/filesystem-entry-types'
+import { spawnBundledRipgrep } from '../ripgrep/bundled-ripgrep-spawn'
+import { parseWslPath } from '../wsl'
+import {
+  isRipgrepMissingCwdExit,
+  ripgrepMissingCwdError
+} from '../../shared/ripgrep-process-availability'
 
 function normalizeRelativePath(path: string): string {
   return path.replace(/[\\/]+/g, '/').replace(/^\/+/, '')
@@ -88,34 +93,132 @@ export function markdownDocumentsFromRelativePaths(
     .sort((a, b) => a.relativePath.localeCompare(b.relativePath))
 }
 
-export async function listMarkdownDocuments(rootPath: string): Promise<MarkdownDocument[]> {
-  const documents: MarkdownDocument[] = []
+const MARKDOWN_LISTING_TIMEOUT_MS = 15_000
+const MAX_MARKDOWN_PATH_BYTES = 1024 * 1024
 
-  async function visitDirectory(dirPath: string): Promise<void> {
-    const entries = await readdir(dirPath, { withFileTypes: true })
-    for (const entry of entries) {
-      if (entry.isSymbolicLink()) {
-        continue
+export async function listMarkdownDocuments(
+  rootPath: string,
+  options: { wslDistro?: string } = {}
+): Promise<MarkdownDocument[]> {
+  const child = spawnBundledRipgrep(
+    [
+      '--files',
+      '--hidden',
+      '--no-ignore',
+      '--no-config',
+      '--null',
+      '--path-separator',
+      '/',
+      // Directory-only globs preserve hidden Markdown files without traversing hidden folders.
+      '--glob',
+      '**',
+      '--glob',
+      '!**/.*/',
+      '--glob',
+      '**/.github/',
+      '--glob',
+      '!**/node_modules/',
+      '.'
+    ],
+    {
+      cwd: rootPath,
+      wslDistro: options.wslDistro,
+      wslDistroForOutput: parseWslPath(rootPath)?.distro ?? options.wslDistro,
+      stdio: ['ignore', 'pipe', 'pipe']
+    }
+  )
+
+  return new Promise((resolveListing, reject) => {
+    const documents: MarkdownDocument[] = []
+    let carry = ''
+    let stderr = ''
+    let settled = false
+    const finish = (error?: Error): void => {
+      if (settled) {
+        return
       }
-
-      const entryPath = join(dirPath, entry.name)
-      if (entry.isDirectory()) {
-        if (entry.name === '.git' || entry.name === 'node_modules') {
-          continue
+      settled = true
+      clearTimeout(timer)
+      child.stdout?.off('data', onData)
+      child.stderr?.off('data', onStderr)
+      child.stdout?.off('error', onError)
+      child.stderr?.off('error', onError)
+      child.off('close', onClose)
+      child.off('error', onError)
+      // A spawn or pipe error can arrive after a timeout has already settled the listing.
+      child.on('error', ignoreLateError)
+      child.stdout?.on('error', ignoreLateError)
+      child.stderr?.on('error', ignoreLateError)
+      carry = ''
+      if (error) {
+        if (child.pid !== undefined) {
+          try {
+            child.kill('SIGKILL')
+          } catch {
+            // The process may have exited before the timeout or stream error arrived.
+          }
         }
-        if (entry.name.startsWith('.') && entry.name !== '.github') {
-          continue
-        }
-        await visitDirectory(entryPath)
-        continue
-      }
-
-      if (entry.isFile() && isMarkdownDocumentName(entry.name)) {
-        documents.push(markdownDocumentFromFilePath(rootPath, entryPath))
+        documents.length = 0
+        child.stdout?.resume()
+        child.stderr?.resume()
+        reject(error)
+      } else {
+        resolveListing(documents.sort((a, b) => a.relativePath.localeCompare(b.relativePath)))
       }
     }
-  }
-
-  await visitDirectory(rootPath)
-  return documents.sort((a, b) => a.relativePath.localeCompare(b.relativePath))
+    const onError = (error: Error): void => finish(error)
+    const onStderr = (chunk: string): void => {
+      stderr = (stderr + chunk).slice(0, 4096)
+    }
+    const onData = (chunk: string): void => {
+      carry += chunk
+      let start = 0
+      let end: number
+      while ((end = carry.indexOf('\0', start)) !== -1) {
+        const path = carry.slice(start, end)
+        if (Buffer.byteLength(path) > MAX_MARKDOWN_PATH_BYTES) {
+          finish(new Error('Markdown document path exceeds the listing limit'))
+          return
+        }
+        if (!path.startsWith('./') || path.split('/').includes('..')) {
+          finish(new Error('Invalid path in Markdown document listing'))
+          return
+        }
+        if (isMarkdownDocumentName(path)) {
+          documents.push(markdownDocumentFromFilePath(rootPath, join(rootPath, path.slice(2))))
+        }
+        start = end + 1
+      }
+      carry = carry.slice(start)
+      if (Buffer.byteLength(carry) > MAX_MARKDOWN_PATH_BYTES) {
+        finish(new Error('Markdown document path exceeds the listing limit'))
+      }
+    }
+    const onClose = (code: number | null, signal: NodeJS.Signals | null): void => {
+      if (isRipgrepMissingCwdExit(code)) {
+        finish(ripgrepMissingCwdError(rootPath))
+      } else if (signal || (code !== 0 && code !== 1)) {
+        finish(new Error(`Markdown document listing failed (${signal ?? code}): ${stderr.trim()}`))
+      } else if (carry) {
+        finish(new Error('Incomplete path in Markdown document listing'))
+      } else {
+        finish()
+      }
+    }
+    const timer = setTimeout(
+      () => finish(new Error('Markdown document listing timed out')),
+      MARKDOWN_LISTING_TIMEOUT_MS
+    )
+    timer.unref?.()
+    child.stdout?.setEncoding('utf8')
+    child.stderr?.setEncoding('utf8')
+    child.stdout?.on('data', onData)
+    child.stderr?.on('data', onStderr)
+    child.stdout?.on('error', onError)
+    child.stderr?.on('error', onError)
+    child.once('error', onError)
+    child.once('close', onClose)
+  })
 }
+
+function ignoreLateError(): void {}
diff --git a/src/main/ipc/native-chat-renderer-lifetime.test.ts b/src/main/ipc/native-chat-renderer-lifetime.test.ts
new file mode 100644
index 00000000000..c35be09cf4e
--- /dev/null
+++ b/src/main/ipc/native-chat-renderer-lifetime.test.ts
@@ -0,0 +1,184 @@
+import { EventEmitter } from 'node:events'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import type {
+  NativeChatTranscriptSubscription,
+  SubscribeNativeChatTranscriptArgs
+} from '../native-chat/transcript-watch-contract'
+
+const mocks = vi.hoisted(() => ({
+  listeners: new Map<string, (event: unknown, args: unknown) => void>(),
+  subscribe:
+    vi.fn<
+      (
+        args: SubscribeNativeChatTranscriptArgs,
+        signal?: AbortSignal
+      ) => Promise<NativeChatTranscriptSubscription>
+    >()
+}))
+
+vi.mock('electron', () => ({
+  ipcMain: {
+    handle: vi.fn(),
+    on: (channel: string, listener: (event: unknown, args: unknown) => void) => {
+      mocks.listeners.set(channel, listener)
+    }
+  }
+}))
+vi.mock('../native-chat/transcript-watch', () => ({
+  subscribeNativeChatTranscript: mocks.subscribe
+}))
+vi.mock('../native-chat/transcript-read-cache', () => ({ clearNativeChatTranscriptCache: vi.fn() }))
+
+import {
+  _getNativeChatPendingSubscriptionCountForTest,
+  _getNativeChatSenderCleanupCountForTest,
+  clearNativeChatSubscriptions,
+  registerNativeChatHandlers
+} from './native-chat'
+
+class Sender extends EventEmitter {
+  send = vi.fn()
+  isDestroyed = (): boolean => false
+  constructor(readonly id: number) {
+    super()
+  }
+}
+
+const live = new Set<SubscribeNativeChatTranscriptArgs>()
+const goneEvents = ['did-navigate', 'render-process-gone', 'destroyed'] as const
+
+function subscribe(sender: Sender, subscriptionId: string): void {
+  mocks.listeners.get('nativeChat:subscribe')?.(
+    { sender },
+    { subscriptionId, agent: 'claude', sessionId: 'one-agent-session' }
+  )
+}
+
+function emitAppend(): void {
+  for (const args of live) {
+    args.onAppend([])
+  }
+}
+
+function pendingSetup() {
+  let resolve: (subscription: NativeChatTranscriptSubscription) => void = () => {}
+  const promise = new Promise<NativeChatTranscriptSubscription>((settle) => {
+    resolve = settle
+  })
+  const unsubscribe = vi.fn()
+  return { promise, resolve: () => resolve({ watching: true, unsubscribe }), unsubscribe }
+}
+
+beforeEach(() => {
+  clearNativeChatSubscriptions()
+  live.clear()
+  mocks.subscribe.mockReset().mockImplementation(async (args) => {
+    live.add(args)
+    return { watching: true, unsubscribe: () => void live.delete(args) }
+  })
+  registerNativeChatHandlers()
+})
+
+afterEach(() => {
+  clearNativeChatSubscriptions()
+})
+
+it.each(goneEvents)('releases every live viewer subscription after %s', async (event) => {
+  const sender = new Sender(1)
+  subscribe(sender, 'pane-a')
+  subscribe(sender, 'pane-b')
+  await Promise.resolve()
+  expect(live.size).toBe(2)
+  emitAppend()
+  expect(sender.send).toHaveBeenCalledTimes(2)
+
+  sender.emit(event)
+  expect(live.size).toBe(0)
+  expect(_getNativeChatSenderCleanupCountForTest()).toBe(0)
+  emitAppend()
+  expect(sender.send).toHaveBeenCalledTimes(2)
+  for (const gone of goneEvents) {
+    expect(sender.listenerCount(gone)).toBe(0)
+  }
+})
+
+it.each(goneEvents)('aborts pending setup and closes a late watcher after %s', async (event) => {
+  const pending = pendingSetup()
+  mocks.subscribe.mockReturnValueOnce(pending.promise)
+  const sender = new Sender(2)
+  subscribe(sender, 'pending')
+  const signal = mocks.subscribe.mock.calls[0]?.[1]
+  expect(signal?.aborted).toBe(false)
+
+  sender.emit(event)
+  expect(signal?.aborted).toBe(true)
+  expect(_getNativeChatPendingSubscriptionCountForTest()).toBe(0)
+  pending.resolve()
+  await Promise.resolve()
+  expect(pending.unsubscribe).toHaveBeenCalledOnce()
+})
+
+it('does not publish callbacks from a replaced document into its replacement', async () => {
+  const pending = pendingSetup()
+  mocks.subscribe.mockReturnValueOnce(pending.promise)
+  const sender = new Sender(3)
+  subscribe(sender, 'same-id')
+  const oldArgs = mocks.subscribe.mock.calls[0]?.[0]
+  if (!oldArgs) {
+    throw new Error('Subscription was not started')
+  }
+  sender.emit('did-navigate')
+  subscribe(sender, 'same-id')
+  await Promise.resolve()
+  oldArgs.onTranscriptPending?.()
+  oldArgs.onInitialSnapshot?.([], false, 0)
+  oldArgs.onReplace?.([], false, 0)
+  oldArgs.onAppend([])
+  expect(sender.send).not.toHaveBeenCalled()
+  pending.resolve()
+  await Promise.resolve()
+  expect(pending.unsubscribe).toHaveBeenCalledOnce()
+  emitAppend()
+  expect(sender.send).toHaveBeenCalledOnce()
+})
+
+it('retains only the current watcher after repeated reloads', async () => {
+  const sender = new Sender(4)
+  for (let cycle = 0; cycle < 15; cycle++) {
+    subscribe(sender, `old-${cycle}`)
+    await Promise.resolve()
+    sender.emit('did-navigate')
+  }
+  subscribe(sender, 'current')
+  await Promise.resolve()
+  expect(live.size).toBe(1)
+  emitAppend()
+  expect(sender.send).toHaveBeenCalledOnce()
+  for (const event of goneEvents) {
+    expect(sender.listenerCount(event)).toBe(1)
+  }
+})
+
+it('preserves another viewer of the same agent session when one renderer reloads', async () => {
+  const first = new Sender(5)
+  const second = new Sender(6)
+  subscribe(first, 'shared-session')
+  subscribe(second, 'shared-session')
+  await Promise.resolve()
+  first.emit('did-navigate')
+  emitAppend()
+  expect(live.size).toBe(1)
+  expect(first.send).not.toHaveBeenCalled()
+  expect(second.send).toHaveBeenCalledOnce()
+})
+
+it('preserves subscriptions through same-document and prevented navigation', async () => {
+  const sender = new Sender(7)
+  subscribe(sender, 'current')
+  await Promise.resolve()
+  sender.emit('did-start-navigation')
+  sender.emit('did-navigate-in-page')
+  emitAppend()
+  expect(live.size).toBe(1)
+  expect(sender.send).toHaveBeenCalledOnce()
+})
diff --git a/src/main/ipc/native-chat-renderer-watcher-cleanup.test.ts b/src/main/ipc/native-chat-renderer-watcher-cleanup.test.ts
new file mode 100644
index 00000000000..a2cd6bb69ac
--- /dev/null
+++ b/src/main/ipc/native-chat-renderer-watcher-cleanup.test.ts
@@ -0,0 +1,62 @@
+import { EventEmitter } from 'node:events'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+
+const listeners = new Map<string, (event: unknown, args: unknown) => void>()
+vi.mock('electron', () => ({
+  ipcMain: {
+    handle: vi.fn(),
+    on: (channel: string, listener: (event: unknown, args: unknown) => void) => {
+      listeners.set(channel, listener)
+    }
+  }
+}))
+
+import { clearNativeChatSubscriptions, registerNativeChatHandlers } from './native-chat'
+import { getActiveNativeChatWatcherCount } from '../native-chat/transcript-watcher-count'
+
+let transcriptDirectory = ''
+let transcriptPath = ''
+
+beforeEach(async () => {
+  clearNativeChatSubscriptions()
+  registerNativeChatHandlers()
+  transcriptDirectory = await mkdtemp(join(tmpdir(), 'orca-native-chat-renderer-lifetime-'))
+  transcriptPath = join(transcriptDirectory, 'session.jsonl')
+  await writeFile(
+    transcriptPath,
+    `${JSON.stringify({
+      type: 'user',
+      uuid: 'message-1',
+      timestamp: '2026-09-25T00:00:00.000Z',
+      message: { role: 'user', content: 'Viewer fixture' }
+    })}\n`
+  )
+})
+
+afterEach(async () => {
+  clearNativeChatSubscriptions()
+  await rm(transcriptDirectory, { recursive: true, force: true })
+})
+
+it.each(['did-navigate', 'render-process-gone', 'destroyed'])(
+  'releases the installed transcript watcher on %s',
+  async (event) => {
+    const sender = Object.assign(new EventEmitter(), {
+      id: 1,
+      isDestroyed: () => false,
+      send: vi.fn()
+    })
+    const before = getActiveNativeChatWatcherCount()
+    listeners.get('nativeChat:subscribe')?.(
+      { sender },
+      { subscriptionId: 'view', agent: 'claude', sessionId: 'session', transcriptPath }
+    )
+    await vi.waitFor(() => expect(sender.send).toHaveBeenCalled())
+    expect(getActiveNativeChatWatcherCount()).toBe(before + 1)
+    sender.emit(event)
+    expect(getActiveNativeChatWatcherCount()).toBe(before)
+  }
+)
diff --git a/src/main/ipc/native-chat-subscribe-lifecycle.test.ts b/src/main/ipc/native-chat-subscribe-lifecycle.test.ts
index 1c90227cfd2..071a3c6ddb6 100644
--- a/src/main/ipc/native-chat-subscribe-lifecycle.test.ts
+++ b/src/main/ipc/native-chat-subscribe-lifecycle.test.ts
@@ -1,3 +1,4 @@
+import { EventEmitter } from 'node:events'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { NativeChatTurnLifecycle } from '../../shared/native-chat-types'
 
@@ -48,6 +49,7 @@ type SenderHarness = {
     id: number
     isDestroyed: () => boolean
     once: (event: string, callback: () => void) => void
+    removeListener: (event: string, callback: () => void) => void
     send: ReturnType<typeof vi.fn>
   }
 }
@@ -78,23 +80,18 @@ function deferredSubscription(): DeferredSubscription {
 
 function createSender(id: number): SenderHarness {
   let destroyed = false
-  const destroyedCallbacks: (() => void)[] = []
+  const events = new EventEmitter()
   return {
     destroy: () => {
       destroyed = true
-      for (const callback of destroyedCallbacks) {
-        callback()
-      }
+      events.emit('destroyed')
     },
-    registeredCleanupCount: () => destroyedCallbacks.length,
+    registeredCleanupCount: () => events.listenerCount('destroyed'),
     sender: {
       id,
       isDestroyed: () => destroyed,
-      once: (event, callback) => {
-        if (event === 'destroyed') {
-          destroyedCallbacks.push(callback)
-        }
-      },
+      once: (event, callback) => void events.once(event, callback),
+      removeListener: (event, callback) => void events.removeListener(event, callback),
       send: vi.fn()
     }
   }
diff --git a/src/main/ipc/native-chat.test.ts b/src/main/ipc/native-chat.test.ts
index 680dd315339..4892990c4ac 100644
--- a/src/main/ipc/native-chat.test.ts
+++ b/src/main/ipc/native-chat.test.ts
@@ -1,3 +1,4 @@
+import { EventEmitter } from 'node:events'
 import { appendFile, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -188,17 +189,11 @@ describe('nativeChat:readSession handler', () => {
     expect(subscribe).toBeDefined()
 
     const sent: { channel: string; payload: unknown }[] = []
-    let destroyedCb: (() => void) | undefined
-    const sender = {
+    const sender = Object.assign(new EventEmitter(), {
       id: 1,
       isDestroyed: () => false,
-      once: (event: string, cb: () => void) => {
-        if (event === 'destroyed') {
-          destroyedCb = cb
-        }
-      },
       send: (channel: string, payload: unknown) => sent.push({ channel, payload })
-    }
+    })
 
     const previousHome = process.env.HOME
     process.env.HOME = root
@@ -241,8 +236,8 @@ describe('nativeChat:readSession handler', () => {
       expect(appendedIds()).toContain('a-1')
 
       // Destroyed window tears down the watcher without error.
-      expect(destroyedCb).toBeDefined()
-      destroyedCb!()
+      expect(sender.listenerCount('destroyed')).toBe(1)
+      sender.emit('destroyed')
     } finally {
       if (previousHome === undefined) {
         delete process.env.HOME
@@ -264,17 +259,11 @@ describe('nativeChat:readSession handler', () => {
     expect(subscribe).toBeDefined()
 
     const sent: { channel: string; payload: unknown }[] = []
-    let destroyedCb: (() => void) | undefined
-    const sender = {
+    const sender = Object.assign(new EventEmitter(), {
       id: 7,
       isDestroyed: () => false,
-      once: (event: string, cb: () => void) => {
-        if (event === 'destroyed') {
-          destroyedCb = cb
-        }
-      },
       send: (channel: string, payload: unknown) => sent.push({ channel, payload })
-    }
+    })
 
     const previousHome = process.env.HOME
     process.env.HOME = root
@@ -290,7 +279,7 @@ describe('nativeChat:readSession handler', () => {
         }
       })
 
-      destroyedCb!()
+      sender.emit('destroyed')
     } finally {
       if (previousHome === undefined) {
         delete process.env.HOME
@@ -322,17 +311,11 @@ describe('nativeChat:readSession handler', () => {
     expect(subscribe).toBeDefined()
 
     let destroyed = false
-    let destroyedCb: (() => void) | undefined
-    const sender = {
+    const sender = Object.assign(new EventEmitter(), {
       id: 41,
       isDestroyed: () => destroyed,
-      once: (event: string, cb: () => void) => {
-        if (event === 'destroyed') {
-          destroyedCb = cb
-        }
-      },
       send: vi.fn()
-    }
+    })
 
     const previousHome = process.env.HOME
     process.env.HOME = root
@@ -346,9 +329,9 @@ describe('nativeChat:readSession handler', () => {
         }
       )
 
-      expect(destroyedCb).toBeDefined()
+      expect(sender.listenerCount('destroyed')).toBe(1)
       destroyed = true
-      destroyedCb!()
+      sender.emit('destroyed')
 
       await waitFor(() => _getNativeChatSenderCleanupCountForTest() === 0)
       expect(sender.send).not.toHaveBeenCalled()
diff --git a/src/main/ipc/native-chat.ts b/src/main/ipc/native-chat.ts
index f94424b67f6..9e5058282ef 100644
--- a/src/main/ipc/native-chat.ts
+++ b/src/main/ipc/native-chat.ts
@@ -12,6 +12,7 @@ import {
   type NativeChatTranscriptSubscription,
   type SubscribeNativeChatTranscriptArgs
 } from '../native-chat/transcript-watch'
+import { abortWhenRendererGone } from './renderer-lifetime-abort'
 
 // Re-export so existing test imports of `clearNativeChatTranscriptCache` from
 // this module keep working after the cache moved to transcript-read-cache.ts.
@@ -89,14 +90,12 @@ type PendingSubscription = {
   controller: AbortController
 }
 
-// Why: live subscriptions are keyed by (webContents.id, subscriptionId) so the
-// same renderer can watch several panes, and a destroyed window tears down all
-// of its watchers — strict teardown to avoid fd leaks (plan U4 risk).
+// A renderer document owns its viewers; replacement, crash, or destruction releases them.
 const liveSubscriptions = new Map<number, Map<string, LiveSubscription>>()
 // Why: unsubscribe and renderer destruction must invalidate async watcher setup
 // before it can publish a late subscription into the live map.
 const pendingSubscriptions = new Map<number, Map<string, PendingSubscription>>()
-const senderCleanupRegistered = new Set<number>()
+const senderLifetimes = new Map<number, ReturnType<typeof abortWhenRendererGone>>()
 
 function teardownSubscription(senderId: number, subscriptionId: string): void {
   const pendingBySubId = pendingSubscriptions.get(senderId)
@@ -118,8 +117,9 @@ function teardownSubscription(senderId: number, subscriptionId: string): void {
 }
 
 function teardownAllForSender(senderId: number): void {
-  // The destroyed event can arrive before async subscription setup stores a watcher.
-  senderCleanupRegistered.delete(senderId)
+  const lifetime = senderLifetimes.get(senderId)
+  senderLifetimes.delete(senderId)
+  lifetime?.dispose()
   for (const pending of pendingSubscriptions.get(senderId)?.values() ?? []) {
     pending.controller.abort()
   }
@@ -134,13 +134,22 @@ function teardownAllForSender(senderId: number): void {
   liveSubscriptions.delete(senderId)
 }
 
-function registerSenderCleanup(sender: WebContents): void {
-  if (senderCleanupRegistered.has(sender.id)) {
-    return
+function registerSenderCleanup(sender: WebContents): AbortSignal {
+  const existing = senderLifetimes.get(sender.id)
+  if (existing) {
+    return existing.signal
   }
-  senderCleanupRegistered.add(sender.id)
-  // Strict teardown: a closed/reloaded window releases every watcher it owns.
-  sender.once('destroyed', () => teardownAllForSender(sender.id))
+  const lifetime = abortWhenRendererGone(sender)
+  const onRendererGone = (): void => teardownAllForSender(sender.id)
+  senderLifetimes.set(sender.id, {
+    signal: lifetime.signal,
+    dispose: () => {
+      lifetime.signal.removeEventListener('abort', onRendererGone)
+      lifetime.dispose()
+    }
+  })
+  lifetime.signal.addEventListener('abort', onRendererGone, { once: true })
+  return lifetime.signal
 }
 
 function beginPendingSubscription(senderId: number, subscriptionId: string): PendingSubscription {
@@ -177,7 +186,9 @@ async function handleSubscribe(event: IpcMainEvent, args: NativeChatSubscribeArg
   const limit = args.limit && args.limit > 0 ? Math.floor(args.limit) : DESKTOP_READ_WINDOW
   // Replace any prior subscription under the same id (session change/resubscribe).
   const pending = beginPendingSubscription(sender.id, subscriptionId)
-  registerSenderCleanup(sender)
+  const rendererSignal = registerSenderCleanup(sender)
+  const canPublish = (): boolean =>
+    !sender.isDestroyed() && !rendererSignal.aborted && !pending.controller.signal.aborted
 
   const subscribeArgs: SubscribeNativeChatTranscriptArgs = {
     agent,
@@ -185,7 +196,7 @@ async function handleSubscribe(event: IpcMainEvent, args: NativeChatSubscribeArg
     transcriptPath,
     initialLimit: limit,
     onTranscriptPending: () => {
-      if (sender.isDestroyed()) {
+      if (!canPublish()) {
         return
       }
       // `pending` marks a window with no transcript behind it yet; clients that
@@ -197,7 +208,7 @@ async function handleSubscribe(event: IpcMainEvent, args: NativeChatSubscribeArg
       sender.send('nativeChat:appended', payload)
     },
     onInitialSnapshot: (messages, hasMore, _beforeOffset, error, lifecycle) => {
-      if (sender.isDestroyed()) {
+      if (!canPublish()) {
         return
       }
       // Forward an initial-drain error so a watching client's first frame carries it
@@ -215,7 +226,7 @@ async function handleSubscribe(event: IpcMainEvent, args: NativeChatSubscribeArg
       sender.send('nativeChat:appended', payload)
     },
     onReplace: (messages, hasMore, _beforeOffset, lifecycle) => {
-      if (sender.isDestroyed()) {
+      if (!canPublish()) {
         return
       }
       sender.send('nativeChat:appended', {
@@ -229,7 +240,7 @@ async function handleSubscribe(event: IpcMainEvent, args: NativeChatSubscribeArg
       } satisfies NativeChatAppendedPayload)
     },
     onAppend: (messages, lifecycle) => {
-      if (sender.isDestroyed()) {
+      if (!canPublish()) {
         return
       }
       const payload: NativeChatAppendedPayload = {
@@ -254,7 +265,7 @@ async function handleSubscribe(event: IpcMainEvent, args: NativeChatSubscribeArg
   // Why: unmount, destruction, or a newer same-id subscribe can invalidate setup
   // while path resolution is pending; only the owning generation may publish its watcher.
   const stillCurrent = takePendingSubscription(sender.id, subscriptionId, pending)
-  if (sender.isDestroyed() || !stillCurrent) {
+  if (!canPublish() || !stillCurrent) {
     subscription.unsubscribe()
     return
   }
@@ -266,7 +277,7 @@ async function handleSubscribe(event: IpcMainEvent, args: NativeChatSubscribeArg
   }
   bySubId.set(subscriptionId, { subscription })
   liveSubscriptions.set(sender.id, bySubId)
-  if (!subscription.watching && !sender.isDestroyed()) {
+  if (!subscription.watching && canPublish()) {
     const payload: NativeChatAppendedPayload = {
       subscriptionId,
       frame: {
@@ -282,16 +293,19 @@ async function handleSubscribe(event: IpcMainEvent, args: NativeChatSubscribeArg
 
 /** Test-only: drop all live and pending transcript subscriptions between runs. */
 export function clearNativeChatSubscriptions(): void {
-  const senderIds = new Set([...liveSubscriptions.keys(), ...pendingSubscriptions.keys()])
+  const senderIds = new Set([
+    ...senderLifetimes.keys(),
+    ...liveSubscriptions.keys(),
+    ...pendingSubscriptions.keys()
+  ])
   for (const senderId of senderIds) {
     teardownAllForSender(senderId)
   }
   pendingSubscriptions.clear()
-  senderCleanupRegistered.clear()
 }
 
 export function _getNativeChatSenderCleanupCountForTest(): number {
-  return senderCleanupRegistered.size
+  return senderLifetimes.size
 }
 
 export function _getNativeChatPendingSubscriptionCountForTest(): number {
diff --git a/src/main/ipc/notebook.ts b/src/main/ipc/notebook.ts
index cb7f4e564b5..70f8224011b 100644
--- a/src/main/ipc/notebook.ts
+++ b/src/main/ipc/notebook.ts
@@ -49,11 +49,13 @@ export function registerNotebookHandlers(store: Store): void {
     'notebook:listPythonEnvironments',
     async (
       _event,
-      args: { filePath: string; rootPath: string | null }
+      args: { filePath: string; rootPath: string | null; runWorkspaceInterpreters: boolean }
     ): Promise<PythonEnvironments> => {
       await resolveAuthorizedPath(args.filePath, store)
       // Why the unresolved path: rootPath is in the same (possibly symlinked) form, e.g. /tmp.
-      return listPythonEnvironments(args.filePath, args.rootPath)
+      return listPythonEnvironments(args.filePath, args.rootPath, {
+        runWorkspaceInterpreters: args.runWorkspaceInterpreters === true
+      })
     }
   )
 
diff --git a/src/main/ipc/notification-options.ts b/src/main/ipc/notification-options.ts
index a19f6044a46..24d43545e13 100644
--- a/src/main/ipc/notification-options.ts
+++ b/src/main/ipc/notification-options.ts
@@ -76,7 +76,10 @@ function formatAgentNotificationStatusText(args: NotificationDispatchRequest): s
   if (args.agentState === 'working') {
     return translateMain('notifications.agentStatus.working', 'working')
   }
-  return args.agentState === 'done' && args.agentInterrupted
+  if (args.agentState === 'done' && args.agentTurnOutcome === 'failure') {
+    return translateMain('notifications.agentStatus.failed', 'failed')
+  }
+  return args.agentState === 'done' && args.agentTurnOutcome === 'cancellation'
     ? translateMain('notifications.agentStatus.stopped', 'stopped')
     : translateMain('notifications.agentStatus.finished', 'finished')
 }
@@ -104,7 +107,7 @@ function hasAgentNotificationSnapshot(args: NotificationDispatchRequest): boolea
     args.agentToolName ||
     args.agentToolInput ||
     args.agentLastAssistantMessage ||
-    args.agentInterrupted
+    args.agentTurnOutcome !== undefined
   )
 }
 
diff --git a/src/main/ipc/notifications-message-formatting.test.ts b/src/main/ipc/notifications-message-formatting.test.ts
index abf41bfae3c..3d519293f3c 100644
--- a/src/main/ipc/notifications-message-formatting.test.ts
+++ b/src/main/ipc/notifications-message-formatting.test.ts
@@ -217,7 +217,7 @@ describe('registerNotificationHandlers', () => {
           worktreeLabel: 'feat/notis',
           agentType: 'claude',
           agentState: 'done',
-          agentInterrupted: true,
+          agentTurnOutcome: 'cancellation',
           agentLastAssistantMessage: 'Stopped by user.'
         }
       )
@@ -316,7 +316,12 @@ describe('registerNotificationHandlers', () => {
     )
   })
 
-  it('reports an interrupted finish as stopped', async () => {
+  it.each([
+    { agentTurnOutcome: 'cancellation', word: 'stopped' },
+    { agentTurnOutcome: 'failure', word: 'failed' },
+    { agentTurnOutcome: 'success', word: 'finished' },
+    { agentTurnOutcome: undefined, word: 'finished' }
+  ] as const)('words a $agentTurnOutcome finish as $word', async ({ agentTurnOutcome, word }) => {
     registerNotificationHandlers({
       getSettings: () => ({
         notifications: {
@@ -336,14 +341,40 @@ describe('registerNotificationHandlers', () => {
         worktreeLabel: 'feat/notis',
         agentType: 'claude',
         agentState: 'done',
-        agentInterrupted: true
+        ...(agentTurnOutcome ? { agentTurnOutcome } : {})
       }
     )
 
     expect(notificationCtorMock).toHaveBeenCalledWith(
       expectedNativeNotificationOptions({
-        title: 'feat/notis - Claude stopped',
-        body: 'Claude stopped.'
+        title: `feat/notis - Claude ${word}`,
+        body: `Claude ${word}.`
+      })
+    )
+  })
+
+  it('counts a success verdict alone as an agent snapshot', async () => {
+    registerNotificationHandlers({
+      getSettings: () => ({
+        notifications: {
+          enabled: true,
+          agentTaskComplete: true,
+          terminalBell: false,
+          suppressWhenFocused: true
+        }
+      })
+    } as never)
+
+    const handler = getDispatchHandler()
+    await handler(
+      {},
+      { source: 'agent-task-complete', worktreeLabel: 'feat/notis', agentTurnOutcome: 'success' }
+    )
+
+    expect(notificationCtorMock).toHaveBeenCalledWith(
+      expectedNativeNotificationOptions({
+        title: 'feat/notis - Agent finished',
+        body: 'Agent finished.'
       })
     )
   })
diff --git a/src/main/ipc/orca-profile-project-transfer-args.ts b/src/main/ipc/orca-profile-project-transfer-args.ts
new file mode 100644
index 00000000000..c2882baf6c4
--- /dev/null
+++ b/src/main/ipc/orca-profile-project-transfer-args.ts
@@ -0,0 +1,25 @@
+import type { TransferOrcaProfileProjectArgs } from '../../shared/orca-profiles'
+
+export function transferProjectArgsFromUnknown(args: unknown): TransferOrcaProfileProjectArgs {
+  if (
+    typeof args !== 'object' ||
+    args === null ||
+    !('sourceProfileId' in args) ||
+    typeof args.sourceProfileId !== 'string' ||
+    !('targetProfileId' in args) ||
+    typeof args.targetProfileId !== 'string' ||
+    !('repoId' in args) ||
+    typeof args.repoId !== 'string' ||
+    !('mode' in args) ||
+    (args.mode !== 'move' && args.mode !== 'copy')
+  ) {
+    throw new Error('invalid_orca_profile_project_transfer')
+  }
+  const sourceProfileId = args.sourceProfileId.trim()
+  const targetProfileId = args.targetProfileId.trim()
+  const repoId = args.repoId.trim()
+  if (!sourceProfileId || !targetProfileId || !repoId) {
+    throw new Error('invalid_orca_profile_project_transfer')
+  }
+  return { sourceProfileId, targetProfileId, repoId, mode: args.mode }
+}
diff --git a/src/main/ipc/orca-profiles-switch-persistence.test.ts b/src/main/ipc/orca-profiles-switch-persistence.test.ts
new file mode 100644
index 00000000000..e948d4054e7
--- /dev/null
+++ b/src/main/ipc/orca-profiles-switch-persistence.test.ts
@@ -0,0 +1,115 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it, vi } from 'vitest'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from '../persistence/loading-store/profile-state-maintenance-fixture'
+import { registerOrcaProfileHandlers } from './orca-profiles'
+
+const { handlers, quit, select } = vi.hoisted(() => ({
+  handlers: new Map<string, (event: unknown, args: unknown) => Promise<unknown>>(),
+  quit: vi.fn(),
+  select: vi.fn()
+}))
+vi.mock('electron', () => ({
+  app: { quit },
+  ipcMain: {
+    handle: (channel: string, handler: (event: unknown, args: unknown) => Promise<unknown>) => {
+      handlers.set(channel, handler)
+    }
+  }
+}))
+vi.mock('../app-relaunch', () => ({ relaunchApp: vi.fn() }))
+vi.mock('../orca-profiles/profile-index-store', () => ({
+  getOrcaProfileListState: () => ({ activeProfileId: 'source', profiles: [] }),
+  setActiveOrcaProfile: select,
+  createLocalOrcaProfile: vi.fn(),
+  seedNewOrcaProfileTelemetryConsent: vi.fn()
+}))
+vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+describe('plain profile switch persistence', () => {
+  it('preserves shutdown changes when quit starts during the switch checkpoint', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    store.upsertSshRemotePtyLease({ targetId: 'remote', ptyId: 'pty', state: 'attached' })
+    await store.flushPendingOrThrowAsync()
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const hold = async (write: () => Promise<void>) => {
+      started.resolve()
+      await release.promise
+      await write()
+    }
+    const selective = authority.writeSerializedDomains.bind(authority)
+    const complete = authority.writeCompleteSerializedDomains.bind(authority)
+    vi.spyOn(authority, 'writeSerializedDomains').mockImplementationOnce((domains) =>
+      hold(() => selective(domains))
+    )
+    vi.spyOn(authority, 'writeCompleteSerializedDomains').mockImplementationOnce((domains) =>
+      hold(() => complete(domains))
+    )
+    store.updateSettings({ theme: 'dark' })
+    registerOrcaProfileHandlers(store)
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const switching = handlers
+      .get('orcaProfiles:switch')?.(
+        { sender: { isDestroyed: () => false, send: vi.fn() } },
+        { profileId: 'target' }
+      )
+      .catch((error: unknown) => error)
+    await started.promise
+    store.markSshRemotePtyLeasesForShutdown('remote', 'detached')
+    const final = store.flushFinalOrThrowAsync()
+    release.resolve()
+    await final
+    await expect(switching).resolves.toEqual({ status: 'relaunching' })
+    expect(readState()).toMatchObject({
+      settings: { theme: 'dark' },
+      sshRemotePtyLeases: [expect.objectContaining({ state: 'detached' })]
+    })
+  })
+
+  it('admits pre-relaunch writes and includes SSH detach in the final source checkpoint', async () => {
+    const { store, readState, dataFile } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    store.upsertSshRemotePtyLease({ targetId: 'remote', ptyId: 'pty', state: 'attached' })
+    await store.flushPendingOrThrowAsync()
+    const cleanupSaved = vi.fn()
+    let final: Promise<void> | undefined
+    quit.mockImplementation(() => {
+      store.markSshRemotePtyLeasesForShutdown('remote', 'detached')
+      final = store.flushFinalOrThrowAsync({ exportJsonCompatibility: true })
+    })
+    registerOrcaProfileHandlers(store, {
+      onBeforeRelaunch: async () => {
+        store.updateSettings({ theme: 'light' })
+        await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+        cleanupSaved()
+      }
+    })
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const switchProfile = handlers.get('orcaProfiles:switch')
+    expect(switchProfile).toBeDefined()
+    await switchProfile?.(
+      { sender: { isDestroyed: () => false, send: vi.fn() } },
+      { profileId: 'target' }
+    )
+    await vi.advanceTimersByTimeAsync(150)
+    expect(final).toBeDefined()
+    await final
+    expect(select).toHaveBeenCalledWith('target')
+    expect(cleanupSaved).toHaveBeenCalledOnce()
+    expect(readState()).toMatchObject({
+      settings: { theme: 'light' },
+      sshRemotePtyLeases: [expect.objectContaining({ state: 'detached' })]
+    })
+    expect(JSON.parse(readFileSync(dataFile, 'utf8'))).toEqual(readState())
+  })
+})
diff --git a/src/main/ipc/orca-profiles.test.ts b/src/main/ipc/orca-profiles.test.ts
index 215b559327d..2a8b24851d3 100644
--- a/src/main/ipc/orca-profiles.test.ts
+++ b/src/main/ipc/orca-profiles.test.ts
@@ -1,4 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as ProfileStoragePaths from '../orca-profiles/profile-storage-paths'
 
 const {
   handlers,
@@ -11,7 +12,8 @@ const {
   getOrcaProfileListStateMock,
   seedNewOrcaProfileTelemetryConsentMock,
   setActiveOrcaProfileMock,
-  transferOrcaProfileProjectMock
+  transferOrcaProfileProjectMock,
+  hasOrcaProfileStateDatabaseMock
 } = vi.hoisted(() => ({
   handlers: new Map<string, (_event: unknown, args?: unknown) => unknown>(),
   appExitMock: vi.fn(),
@@ -23,7 +25,8 @@ const {
   getOrcaProfileListStateMock: vi.fn(),
   seedNewOrcaProfileTelemetryConsentMock: vi.fn(),
   setActiveOrcaProfileMock: vi.fn(),
-  transferOrcaProfileProjectMock: vi.fn()
+  transferOrcaProfileProjectMock: vi.fn(),
+  hasOrcaProfileStateDatabaseMock: vi.fn()
 }))
 
 vi.mock('electron', () => ({
@@ -54,21 +57,36 @@ vi.mock('../orca-profiles/profile-index-store', () => ({
   setActiveOrcaProfile: setActiveOrcaProfileMock
 }))
 
-function makeStoreMock(flushPendingOrThrowAsync = vi.fn()): {
-  flushPendingOrThrowAsync: typeof flushPendingOrThrowAsync
-  freezeWrites: ReturnType<typeof vi.fn>
-  getSettings: () => Record<string, never>
-} {
-  return { flushPendingOrThrowAsync, freezeWrites: vi.fn(), getSettings: () => ({}) }
+function makeStoreMock(flushPendingOrThrowAsync = vi.fn()) {
+  const freezeWrites = vi.fn()
+  const resumeMaintenance = vi.fn(async () => {})
+  return {
+    flushPendingOrThrowAsync,
+    freezeWrites,
+    resumeMaintenance,
+    beginProfileMaintenance: vi.fn(async (options: unknown) => {
+      await flushPendingOrThrowAsync(options)
+      freezeWrites()
+      return { resume: resumeMaintenance }
+    }),
+    getSettings: () => ({})
+  }
 }
 
 vi.mock('../orca-profiles/profile-project-transfer', () => ({
   transferOrcaProfileProject: transferOrcaProfileProjectMock
 }))
 
+vi.mock('../orca-profiles/profile-storage-paths', async (importOriginal) => ({
+  ...(await importOriginal<typeof ProfileStoragePaths>()),
+  hasOrcaProfileStateDatabase: hasOrcaProfileStateDatabaseMock
+}))
+
 import { registerOrcaProfileHandlers } from './orca-profiles'
 import { installFakeAppEnvironment } from '../../../config/scripts/vitest-host-ports-setup'
 
+const ipcEvent = { sender: { isDestroyed: () => false, send: vi.fn() } }
+
 describe('registerOrcaProfileHandlers', () => {
   beforeEach(() => {
     // Why the port and per-test: userData resolves through AppEnvironment now, and
@@ -76,6 +94,7 @@ describe('registerOrcaProfileHandlers', () => {
     installFakeAppEnvironment({ getPath: () => '/tmp/orca-user-data' })
     vi.useFakeTimers()
     handlers.clear()
+    ipcEvent.sender.send.mockClear()
     appExitMock.mockReset()
     appQuitMock.mockReset()
     appRelaunchMock.mockReset()
@@ -87,6 +106,7 @@ describe('registerOrcaProfileHandlers', () => {
     seedNewOrcaProfileTelemetryConsentMock.mockReset()
     setActiveOrcaProfileMock.mockReset()
     transferOrcaProfileProjectMock.mockReset()
+    hasOrcaProfileStateDatabaseMock.mockReset().mockReturnValue(false)
   })
 
   afterEach(() => {
@@ -107,12 +127,12 @@ describe('registerOrcaProfileHandlers', () => {
 
     registerOrcaProfileHandlers(makeStoreMock() as never)
 
-    await expect(Promise.resolve(handlers.get('orcaProfiles:list')?.(null))).resolves.toEqual({
+    await expect(Promise.resolve(handlers.get('orcaProfiles:list')?.(ipcEvent))).resolves.toEqual({
       ...listState,
       multiProfileUi: false
     })
     await expect(
-      Promise.resolve(handlers.get('orcaProfiles:createLocal')?.(null, { name: 'Work' }))
+      Promise.resolve(handlers.get('orcaProfiles:createLocal')?.(ipcEvent, { name: 'Work' }))
     ).resolves.toBe(createState)
     expect(createLocalOrcaProfileMock).toHaveBeenCalledWith({ name: 'Work' })
   })
@@ -127,11 +147,13 @@ describe('registerOrcaProfileHandlers', () => {
       })
       registerOrcaProfileHandlers(makeStoreMock() as never)
 
-      await expect(Promise.resolve(handlers.get('orcaProfiles:list')?.(null))).resolves.toEqual({
-        activeProfileId: 'local-default',
-        profiles: [],
-        multiProfileUi: true
-      })
+      await expect(Promise.resolve(handlers.get('orcaProfiles:list')?.(ipcEvent))).resolves.toEqual(
+        {
+          activeProfileId: 'local-default',
+          profiles: [],
+          multiProfileUi: true
+        }
+      )
     } finally {
       if (previous === undefined) {
         delete process.env.ORCA_MULTI_PROFILE_UI
@@ -155,7 +177,7 @@ describe('registerOrcaProfileHandlers', () => {
     registerOrcaProfileHandlers(makeStoreMock(flush) as never, { onBeforeRelaunch })
 
     const resultPromise = Promise.resolve(
-      handlers.get('orcaProfiles:switch')?.(null, { profileId: 'local-work' })
+      handlers.get('orcaProfiles:switch')?.(ipcEvent, { profileId: 'local-work' })
     )
 
     await expect(resultPromise).resolves.toEqual({ status: 'relaunching' })
@@ -189,7 +211,7 @@ describe('registerOrcaProfileHandlers', () => {
     registerOrcaProfileHandlers(makeStoreMock(flush) as never)
 
     await expect(
-      Promise.resolve(handlers.get('orcaProfiles:switch')?.(null, { profileId: 'local-work' }))
+      Promise.resolve(handlers.get('orcaProfiles:switch')?.(ipcEvent, { profileId: 'local-work' }))
     ).rejects.toThrow('flush_failed')
 
     expect(setActiveOrcaProfileMock).not.toHaveBeenCalled()
@@ -206,10 +228,10 @@ describe('registerOrcaProfileHandlers', () => {
     registerOrcaProfileHandlers(makeStoreMock(flush) as never, { onBeforeRelaunch })
 
     const switchProfile = Promise.resolve(
-      handlers.get('orcaProfiles:switch')?.(null, { profileId: 'local-work' })
+      handlers.get('orcaProfiles:switch')?.(ipcEvent, { profileId: 'local-work' })
     )
     const rejection = expect(switchProfile).rejects.toThrow('orca_profile_persistence_timeout')
-    await vi.advanceTimersByTimeAsync(20_000)
+    await vi.advanceTimersByTimeAsync(60_000)
     await rejection
 
     expect(setActiveOrcaProfileMock).not.toHaveBeenCalled()
@@ -225,7 +247,9 @@ describe('registerOrcaProfileHandlers', () => {
     registerOrcaProfileHandlers(makeStoreMock() as never)
 
     await expect(
-      Promise.resolve(handlers.get('orcaProfiles:switch')?.(null, { profileId: 'local-default' }))
+      Promise.resolve(
+        handlers.get('orcaProfiles:switch')?.(ipcEvent, { profileId: 'local-default' })
+      )
     ).resolves.toEqual({ status: 'already-active' })
 
     expect(setActiveOrcaProfileMock).not.toHaveBeenCalled()
@@ -236,7 +260,7 @@ describe('registerOrcaProfileHandlers', () => {
     registerOrcaProfileHandlers(makeStoreMock() as never)
 
     await expect(
-      Promise.resolve(handlers.get('orcaProfiles:switch')?.(null, { profileId: ' ' }))
+      Promise.resolve(handlers.get('orcaProfiles:switch')?.(ipcEvent, { profileId: ' ' }))
     ).rejects.toThrow('invalid_orca_profile_id')
   })
 
@@ -260,7 +284,7 @@ describe('registerOrcaProfileHandlers', () => {
 
     await expect(
       Promise.resolve(
-        handlers.get('orcaProfiles:transferProject')?.(null, {
+        handlers.get('orcaProfiles:transferProject')?.(ipcEvent, {
           sourceProfileId: ' personal ',
           targetProfileId: ' work ',
           repoId: ' repo-1 ',
@@ -302,7 +326,7 @@ describe('registerOrcaProfileHandlers', () => {
 
     await expect(
       Promise.resolve(
-        handlers.get('orcaProfiles:transferProject')?.(null, {
+        handlers.get('orcaProfiles:transferProject')?.(ipcEvent, {
           sourceProfileId: 'personal',
           targetProfileId: 'work',
           repoId: 'repo-1',
@@ -328,11 +352,56 @@ describe('registerOrcaProfileHandlers', () => {
     await vi.advanceTimersByTimeAsync(150)
 
     expect(appRelaunchMock).toHaveBeenCalledOnce()
+    expect(ipcEvent.sender.send).toHaveBeenCalledWith('app:restart-committed')
     expect(relaunchAppMock).toHaveBeenCalledWith('profile-transfer')
     expect(appQuitMock).toHaveBeenCalledOnce()
     expect(appExitMock).not.toHaveBeenCalled()
   })
 
+  it('relaunches the closed source when a completed move cannot update the profile index', async () => {
+    const store = makeStoreMock()
+    getOrcaProfileListStateMock.mockReturnValue({ activeProfileId: 'personal', profiles: [] })
+    transferOrcaProfileProjectMock.mockReturnValue({ status: 'transferred', mode: 'move' })
+    setActiveOrcaProfileMock.mockImplementationOnce(() => {
+      throw new Error('profile index disk full')
+    })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This fixture supplies every Store operation exercised by these IPC handlers.
+    registerOrcaProfileHandlers(store as never)
+
+    await expect(
+      handlers.get('orcaProfiles:transferProject')?.(ipcEvent, {
+        sourceProfileId: 'personal',
+        targetProfileId: 'work',
+        repoId: 'repo-1',
+        mode: 'move'
+      })
+    ).rejects.toThrow('profile index disk full')
+
+    expect(store.freezeWrites).toHaveBeenCalledOnce()
+    expect(store.resumeMaintenance).not.toHaveBeenCalled()
+    expect(ipcEvent.sender.send).toHaveBeenCalledWith('app:restart-committed')
+    await vi.advanceTimersByTimeAsync(150)
+    expect(relaunchAppMock).toHaveBeenCalledWith('profile-transfer')
+    expect(appQuitMock).toHaveBeenCalledOnce()
+  })
+
+  it('keeps the active profile writable during a transfer between inactive profiles', async () => {
+    const store = makeStoreMock()
+    getOrcaProfileListStateMock.mockReturnValue({ activeProfileId: 'active', profiles: [] })
+    transferOrcaProfileProjectMock.mockReturnValue({ status: 'transferred', mode: 'copy' })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This fixture supplies the Store operations exercised by the handlers.
+    registerOrcaProfileHandlers(store as never)
+    await handlers.get('orcaProfiles:transferProject')?.(ipcEvent, {
+      sourceProfileId: 'personal',
+      targetProfileId: 'work',
+      repoId: 'repo-1',
+      mode: 'copy'
+    })
+    expect(store.beginProfileMaintenance).not.toHaveBeenCalled()
+    expect(store.freezeWrites).not.toHaveBeenCalled()
+    expect(store.flushPendingOrThrowAsync).toHaveBeenCalledBefore(transferOrcaProfileProjectMock)
+  })
+
   it('rejects transfers that would mutate the active target profile offline', async () => {
     getOrcaProfileListStateMock.mockReturnValue({
       activeProfileId: 'work',
@@ -342,7 +411,7 @@ describe('registerOrcaProfileHandlers', () => {
 
     await expect(
       Promise.resolve(
-        handlers.get('orcaProfiles:transferProject')?.(null, {
+        handlers.get('orcaProfiles:transferProject')?.(ipcEvent, {
           sourceProfileId: 'personal',
           targetProfileId: 'work',
           repoId: 'repo-1',
@@ -353,4 +422,84 @@ describe('registerOrcaProfileHandlers', () => {
 
     expect(transferOrcaProfileProjectMock).not.toHaveBeenCalled()
   })
+
+  it('freezes a newly migrated source after transfer failure and reopens its current profile', async () => {
+    const store = makeStoreMock()
+    const onBeforeRelaunch = vi.fn()
+    getOrcaProfileListStateMock.mockReturnValue({ activeProfileId: 'personal', profiles: [] })
+    transferOrcaProfileProjectMock.mockImplementation(() => {
+      hasOrcaProfileStateDatabaseMock.mockReturnValue(true)
+      throw new Error('source commit interrupted')
+    })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This fixture supplies every Store operation exercised by these IPC handlers.
+    registerOrcaProfileHandlers(store as never, { onBeforeRelaunch })
+
+    await expect(
+      Promise.resolve(
+        handlers.get('orcaProfiles:transferProject')?.(ipcEvent, {
+          sourceProfileId: 'personal',
+          targetProfileId: 'work',
+          repoId: 'repo-1',
+          mode: 'move'
+        })
+      )
+    ).rejects.toThrow('source commit interrupted')
+
+    expect(store.flushPendingOrThrowAsync).toHaveBeenCalledBefore(transferOrcaProfileProjectMock)
+    expect(store.freezeWrites).toHaveBeenCalledOnce()
+    expect(store.freezeWrites).toHaveBeenCalledBefore(onBeforeRelaunch)
+    expect(setActiveOrcaProfileMock).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(150)
+    expect(ipcEvent.sender.send).toHaveBeenCalledWith('app:restart-committed')
+    expect(relaunchAppMock).toHaveBeenCalledWith('profile-transfer')
+    expect(appQuitMock).toHaveBeenCalledOnce()
+  })
+
+  it('keeps an active JSON source writable after validation fails without a migration', async () => {
+    const store = makeStoreMock()
+    const onBeforeRelaunch = vi.fn()
+    getOrcaProfileListStateMock.mockReturnValue({ activeProfileId: 'personal', profiles: [] })
+    transferOrcaProfileProjectMock.mockImplementation(() => {
+      throw new Error('unknown_source_repo')
+    })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This fixture supplies every Store operation exercised by these IPC handlers.
+    registerOrcaProfileHandlers(store as never, { onBeforeRelaunch })
+
+    await expect(
+      Promise.resolve(
+        handlers.get('orcaProfiles:transferProject')?.(ipcEvent, {
+          sourceProfileId: 'personal',
+          targetProfileId: 'work',
+          repoId: 'repo-1',
+          mode: 'move'
+        })
+      )
+    ).rejects.toThrow('unknown_source_repo')
+
+    expect(store.resumeMaintenance).toHaveBeenCalledOnce()
+    expect(onBeforeRelaunch).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(150)
+    expect(relaunchAppMock).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    null,
+    {},
+    { sourceProfileId: 4 },
+    {
+      sourceProfileId: 'personal',
+      targetProfileId: 'work',
+      repoId: 'repo-1',
+      mode: 'invalid'
+    }
+  ])('rejects malformed transfer arguments before disk work: %j', async (args) => {
+    const store = makeStoreMock()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This fixture supplies every Store operation exercised by these IPC handlers.
+    registerOrcaProfileHandlers(store as never)
+    await expect(
+      Promise.resolve(handlers.get('orcaProfiles:transferProject')?.(ipcEvent, args))
+    ).rejects.toThrow('invalid_orca_profile_project_transfer')
+    expect(store.flushPendingOrThrowAsync).not.toHaveBeenCalled()
+    expect(transferOrcaProfileProjectMock).not.toHaveBeenCalled()
+  })
 })
diff --git a/src/main/ipc/orca-profiles.ts b/src/main/ipc/orca-profiles.ts
index 480c6f350f9..694841e544e 100644
--- a/src/main/ipc/orca-profiles.ts
+++ b/src/main/ipc/orca-profiles.ts
@@ -1,4 +1,4 @@
-import { app, ipcMain } from 'electron'
+import { app, ipcMain, type WebContents } from 'electron'
 import type { Store } from '../persistence'
 import { relaunchApp, type AppRelaunchReason } from '../app-relaunch'
 import type {
@@ -33,8 +33,12 @@ import {
 import { getProfileUserDataPath } from '../orca-profiles/profile-storage-paths'
 import { isMultiProfileUiEnabled } from '../orca-profiles/profile-ui-scope'
 import { transferOrcaProfileProject } from '../orca-profiles/profile-project-transfer'
+import { transferActiveProfileProject } from '../orca-profiles/profile-active-transfer'
 import { findOrcaProfileProjectsByPath } from '../orca-profiles/profile-project-presence'
-import { flushActiveProfileBeforeFileMutation } from '../orca-profiles/profile-persistence-deadline'
+import {
+  flushActiveProfileBeforeFileMutation,
+  flushActiveProfileBeforeRelaunch
+} from '../orca-profiles/profile-persistence-deadline'
 import { normalizeExecutionHostId } from '../../shared/execution-host'
 import {
   createCloudLinkedOrcaProfile,
@@ -47,6 +51,7 @@ import {
 import { registerOrcaProfileOrgMemberHandlers } from './orca-profile-org-members-handlers'
 import { onOrcaCloudSessionInvalidated } from '../orca-profiles/profile-cloud-session-invalidation'
 import { broadcastOrcaProfileAuthStatusChanged } from './orca-profile-auth-status-broadcast'
+import { transferProjectArgsFromUnknown } from './orca-profile-project-transfer-args'
 
 type RegisterOrcaProfileHandlersOptions = {
   onBeforeRelaunch?: () => void | Promise<void>
@@ -55,40 +60,16 @@ type RegisterOrcaProfileHandlersOptions = {
 }
 
 function profileIdFromArgs(args: unknown): string {
-  if (
-    !args ||
-    typeof args !== 'object' ||
-    typeof (args as SwitchOrcaProfileArgs).profileId !== 'string'
-  ) {
-    throw new Error('invalid_orca_profile_id')
-  }
-  const profileId = (args as SwitchOrcaProfileArgs).profileId.trim()
+  const profileId =
+    args && typeof args === 'object' && 'profileId' in args && typeof args.profileId === 'string'
+      ? args.profileId.trim()
+      : ''
   if (!profileId) {
     throw new Error('invalid_orca_profile_id')
   }
   return profileId
 }
 
-function transferProjectArgsFromUnknown(args: unknown): TransferOrcaProfileProjectArgs {
-  if (!args || typeof args !== 'object') {
-    throw new Error('invalid_orca_profile_project_transfer')
-  }
-  const candidate = args as TransferOrcaProfileProjectArgs
-  const sourceProfileId = candidate.sourceProfileId?.trim()
-  const targetProfileId = candidate.targetProfileId?.trim()
-  const repoId = candidate.repoId?.trim()
-  const mode = candidate.mode
-  if (!sourceProfileId || !targetProfileId || !repoId || (mode !== 'move' && mode !== 'copy')) {
-    throw new Error('invalid_orca_profile_project_transfer')
-  }
-  return {
-    sourceProfileId,
-    targetProfileId,
-    repoId,
-    mode
-  }
-}
-
 function findProjectsByPathArgsFromUnknown(args: unknown): FindOrcaProfileProjectsByPathArgs {
   if (!args || typeof args !== 'object') {
     throw new Error('invalid_orca_profile_project_path')
@@ -157,7 +138,12 @@ async function runBeforeProfileRelaunch(
   }
 }
 
-function scheduleProfileRelaunch(reason: Extract<AppRelaunchReason, `profile-${string}`>): void {
+type ProfileRelaunchReason = Extract<AppRelaunchReason, `profile-${string}`>
+
+function scheduleProfileRelaunch(reason: ProfileRelaunchReason, sender: WebContents): void {
+  if (!sender.isDestroyed()) {
+    sender.send('app:restart-committed')
+  }
   setTimeout(() => {
     relaunchApp(reason)
     // Why: app.quit() (not app.exit) so before-quit/will-quit still run —
@@ -197,7 +183,7 @@ export function registerOrcaProfileHandlers(
 
   ipcMain.handle(
     'orcaProfiles:switch',
-    async (_event, args: SwitchOrcaProfileArgs): Promise<SwitchOrcaProfileResult> => {
+    async (event, args: SwitchOrcaProfileArgs): Promise<SwitchOrcaProfileResult> => {
       const profileId = profileIdFromArgs(args)
       const current = getOrcaProfileListState()
       if (profileId === current.activeProfileId) {
@@ -217,11 +203,12 @@ export function registerOrcaProfileHandlers(
       }
       // Why: the current profile must be persisted before the global index
       // points startup at the target profile.
-      await flushActiveProfileBeforeFileMutation(store)
-      await runBeforeProfileRelaunch(options.onBeforeRelaunch)
+      // Switching leaves source files intact; relaunch cleanup still needs its live writer.
+      await flushActiveProfileBeforeRelaunch(store)
       setActiveOrcaProfile(profileId)
+      await runBeforeProfileRelaunch(options.onBeforeRelaunch)
 
-      scheduleProfileRelaunch('profile-switch')
+      scheduleProfileRelaunch('profile-switch', event.sender)
 
       return { status: 'relaunching' }
     }
@@ -230,7 +217,7 @@ export function registerOrcaProfileHandlers(
   ipcMain.handle(
     'orcaProfiles:transferProject',
     async (
-      _event,
+      event,
       rawArgs: TransferOrcaProfileProjectArgs
     ): Promise<TransferOrcaProfileProjectResult> => {
       const args = transferProjectArgsFromUnknown(rawArgs)
@@ -241,19 +228,37 @@ export function registerOrcaProfileHandlers(
       if (args.mode === 'move' && args.sourceProfileId === current.activeProfileId) {
         // Why: transfer before any relaunch side effect so a duplicate-target
         // or validation failure cannot strand the app in a quitting state.
-        await flushActiveProfileBeforeFileMutation(store)
-        const result = transferOrcaProfileProject(args, getProfileUserDataPath())
+        const result = await transferActiveProfileProject(
+          args,
+          getProfileUserDataPath(),
+          store,
+          async () => {
+            await runBeforeProfileRelaunch(options.onBeforeRelaunch)
+            scheduleProfileRelaunch('profile-transfer', event.sender)
+          }
+        )
         if (result.status === 'transferred') {
-          store.freezeWrites()
           await runBeforeProfileRelaunch(options.onBeforeRelaunch)
-          setActiveOrcaProfile(args.targetProfileId)
-          scheduleProfileRelaunch('profile-transfer')
+          try {
+            setActiveOrcaProfile(args.targetProfileId)
+          } finally {
+            // The source has already changed and its writer cannot resume.
+            scheduleProfileRelaunch('profile-transfer', event.sender)
+          }
           return { ...result, willRelaunch: true }
         }
         return result
       }
-      await flushActiveProfileBeforeFileMutation(store)
-      return transferOrcaProfileProject(args, getProfileUserDataPath())
+      if (args.sourceProfileId !== current.activeProfileId) {
+        await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+        return transferOrcaProfileProject(args, getProfileUserDataPath())
+      }
+      const maintenance = await flushActiveProfileBeforeFileMutation(store)
+      try {
+        return transferOrcaProfileProject(args, getProfileUserDataPath())
+      } finally {
+        await maintenance.resume()
+      }
     }
   )
 
diff --git a/src/main/ipc/parcel-watcher-in-process-fallback.ts b/src/main/ipc/parcel-watcher-in-process-fallback.ts
index bcd2812d35d..1807ba603a5 100644
--- a/src/main/ipc/parcel-watcher-in-process-fallback.ts
+++ b/src/main/ipc/parcel-watcher-in-process-fallback.ts
@@ -1,4 +1,5 @@
 import type * as ParcelWatcher from '@parcel/watcher'
+import { loadParcelWatcher } from './parcel-watcher-module-loader'
 import { createWatcherProcessEventDeliveryQueue } from './parcel-watcher-event-delivery'
 import { WatcherProcessFailure } from './parcel-watcher-process-failure'
 import type {
@@ -64,7 +65,7 @@ export async function subscribeWithInProcessWatcher(
   try {
     // Why: setup ownership starts before module loading; an abort or timeout
     // during the import must settle the caller just like one during the crawl.
-    watcher = await Promise.race([import('@parcel/watcher'), cancellation])
+    watcher = await Promise.race([loadParcelWatcher(), cancellation])
   } catch (error) {
     clearPendingControls()
     throw error
diff --git a/src/main/ipc/parcel-watcher-module-loader.test.ts b/src/main/ipc/parcel-watcher-module-loader.test.ts
new file mode 100644
index 00000000000..98e5eada431
--- /dev/null
+++ b/src/main/ipc/parcel-watcher-module-loader.test.ts
@@ -0,0 +1,42 @@
+import { beforeEach, expect, it, vi } from 'vitest'
+import { loadParcelWatcher } from './parcel-watcher-module-loader'
+
+const state = vi.hoisted((): { named: unknown; fallback: unknown } => ({
+  named: undefined,
+  fallback: undefined
+}))
+vi.mock('@parcel/watcher', () => ({
+  get subscribe() {
+    return state.named
+  },
+  get default() {
+    return state.fallback
+  }
+}))
+beforeEach(() => {
+  state.named = undefined
+  state.fallback = undefined
+})
+
+it('uses named exports when the runtime exposes them', async () => {
+  const subscribe = vi.fn()
+  state.named = subscribe
+  state.fallback = { subscribe: vi.fn() }
+  expect((await loadParcelWatcher()).subscribe).toBe(subscribe)
+})
+
+it('loads the full CommonJS default when a packaged wrapper has no named exports', async () => {
+  const subscribe = vi.fn()
+  const getEventsSince = vi.fn()
+  state.fallback = { subscribe, getEventsSince }
+  expect(await loadParcelWatcher()).toBe(state.fallback)
+  expect((await loadParcelWatcher()).getEventsSince).toBe(getEventsSince)
+})
+
+it.each([undefined, null, {}, { subscribe: false }])(
+  'rejects invalid watcher exports (%j)',
+  async (fallback) => {
+    state.fallback = fallback
+    await expect(loadParcelWatcher()).rejects.toThrow('parcel_watcher_module_invalid')
+  }
+)
diff --git a/src/main/ipc/parcel-watcher-module-loader.ts b/src/main/ipc/parcel-watcher-module-loader.ts
new file mode 100644
index 00000000000..28a501363b5
--- /dev/null
+++ b/src/main/ipc/parcel-watcher-module-loader.ts
@@ -0,0 +1,11 @@
+import type * as ParcelWatcher from '@parcel/watcher'
+
+/** Native loading stays in the watcher child, across named and CommonJS exports. */
+export async function loadParcelWatcher(): Promise<typeof ParcelWatcher> {
+  const loaded = await import('@parcel/watcher')
+  const watcher = typeof loaded.subscribe === 'function' ? loaded : loaded.default
+  if (!watcher || typeof watcher.subscribe !== 'function') {
+    throw new Error('parcel_watcher_module_invalid')
+  }
+  return watcher
+}
diff --git a/src/main/ipc/parcel-watcher-process-entry.ts b/src/main/ipc/parcel-watcher-process-entry.ts
index ad0e79d6b97..0de05010f47 100644
--- a/src/main/ipc/parcel-watcher-process-entry.ts
+++ b/src/main/ipc/parcel-watcher-process-entry.ts
@@ -8,6 +8,7 @@ import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import type * as ParcelWatcher from '@parcel/watcher'
+import { loadParcelWatcher } from './parcel-watcher-module-loader'
 import { startShallowWatcher } from './parcel-watcher-shallow-subscription'
 import { detectShallowWatchDelivery } from './shallow-watch-delivery-probe'
 import {
@@ -46,7 +47,7 @@ async function startCanary(getStableActivityRevision: () => number | null): Prom
   let lastEventAt = 0
   try {
     canaryDir = configuredCanaryDir ?? mkdtempSync(join(tmpdir(), 'orca-watcher-canary-'))
-    const watcher = await import('@parcel/watcher')
+    const watcher = await loadParcelWatcher()
     // Why: pin the Windows backend like the main subscriptions do, so the
     // canary never probes for Watchman.
     const opts = (
@@ -211,7 +212,7 @@ function main(): void {
               send({ op: 'watch-error', id, message: errorMessage(error) })
             )
           }
-          const watcher = await import('@parcel/watcher')
+          const watcher = await loadParcelWatcher()
           return await watcher.subscribe(
             dir,
             (err, events) => {
diff --git a/src/main/ipc/pty-controller-process-inventory.test.ts b/src/main/ipc/pty-controller-process-inventory.test.ts
index e89d888978a..004735c61cb 100644
--- a/src/main/ipc/pty-controller-process-inventory.test.ts
+++ b/src/main/ipc/pty-controller-process-inventory.test.ts
@@ -47,7 +47,16 @@ vi.mock('node-pty', () => ({
 }))
 
 vi.mock('../opencode/hook-service', () => ({
-  openCodeHookService: { buildPtyEnv: () => ({}), clearPty: vi.fn() }
+  openCodeHookService: {
+    buildPtyEnv: () => ({}),
+    refreshLegacySharedPlugin: vi.fn(),
+    clearPty: vi.fn()
+  },
+  openCode2HookService: {
+    buildPtyEnv: () => ({}),
+    refreshLegacySharedPlugin: vi.fn(),
+    clearPty: vi.fn()
+  }
 }))
 
 vi.mock('../pi/titlebar-extension-service', () => ({
diff --git a/src/main/ipc/pty-daemon-spawn-agent-home-env.test.ts b/src/main/ipc/pty-daemon-spawn-agent-home-env.test.ts
index f73f11e7f93..48cff20c9dd 100644
--- a/src/main/ipc/pty-daemon-spawn-agent-home-env.test.ts
+++ b/src/main/ipc/pty-daemon-spawn-agent-home-env.test.ts
@@ -173,13 +173,13 @@ describe('registerPtyHandlers', () => {
         expect(spawnOptions.envToDelete ?? []).not.toContain('ORCA_CODEX_HOME')
         expect(spawnOptions.envToDelete).toContain('REMOVE_ME')
       })
-      it('prepares Codex project trust before a daemon-backed interactive launch', async () => {
+      it('prepares Codex launch state before a daemon-backed interactive launch', async () => {
         const workspacePath = '/repo/worktrees/new-feature'
         const resolveHome = vi.fn(
           (
             _target?: { runtime?: 'host' | 'wsl'; wslDistro?: string | null },
             _launchEnv?: NodeJS.ProcessEnv,
-            _launchContext?: { workspacePath?: string; launchAgent?: TuiAgent }
+            _launchContext?: { unavailableManagedHomePath?: string }
           ) => null
         )
 
@@ -191,7 +191,6 @@ describe('registerPtyHandlers', () => {
         })
 
         expect(resolveHome.mock.calls[0]?.[0]).toEqual({ runtime: 'host' })
-        expect(resolveHome.mock.calls[0]?.[2]).toEqual({ workspacePath, launchAgent: 'codex' })
       })
       it('injects explicit proxy settings on the daemon path', async () => {
         const env = await daemonSpawnAndGetEnv({}, undefined, () => ({
@@ -413,6 +412,17 @@ describe('registerPtyHandlers', () => {
           ])
         )
       })
+      it('strips an inherited agent session id', async () => {
+        // Why: a daemon forked by an Orca launched inside a structured session inherits its id,
+        // and every daemon pane would present that session as its orchestration caller.
+        const inherited = await daemonSpawnAndGetOptions(undefined, undefined, undefined, {
+          ORCA_AGENT_SESSION_ID: 'a0b1c2d3-0000-4000-8000-00000000abcd',
+          ORCA_STRUCTURED_SESSION: '1'
+        })
+        expect(inherited.envToDelete).toEqual(
+          expect.arrayContaining(['ORCA_AGENT_SESSION_ID', 'ORCA_STRUCTURED_SESSION'])
+        )
+      })
       it('preserves an explicitly requested Claude child-session stamp', async () => {
         // Why: only inherited values are poison; a caller deliberately spawning a
         // nested Claude child passes the stamp in args.env and must keep it.
diff --git a/src/main/ipc/pty-daemon-ssh-lease-lifecycle.test.ts b/src/main/ipc/pty-daemon-ssh-lease-lifecycle.test.ts
index 128f163c5b3..5ae2adb49d7 100644
--- a/src/main/ipc/pty-daemon-ssh-lease-lifecycle.test.ts
+++ b/src/main/ipc/pty-daemon-ssh-lease-lifecycle.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it, vi } from 'vitest'
 import { openCodeClearPtyMock, piClearPtyMock } from './pty-ipc-mock-registry'
 import { setupPtyIpcSuite } from './pty-ipc-test-harness'
+import { TerminalIntentionalStops } from '../runtime/terminal-intentional-stops'
 import {
   SSH_PTY_IDENTITY_MISMATCH_ERROR,
   SSH_SESSION_EXPIRED_ERROR
@@ -359,7 +360,8 @@ describe('registerPtyHandlers', () => {
         const exitListeners = new Set<(payload: { id: string; code: number }) => void>()
         const runtime = {
           setPtyController: vi.fn(),
-          onPtyExit: vi.fn()
+          onPtyExit: vi.fn(),
+          intentionalPtyStops: new TerminalIntentionalStops()
         }
         setLocalPtyProvider({
           spawn: vi.fn(),
@@ -393,15 +395,14 @@ describe('registerPtyHandlers', () => {
         handlers.clear()
         registerPtyHandlers(mainWindow as never, runtime as never)
         const controller = runtime.setPtyController.mock.calls[0]?.[0] as {
-          markReversibleStops: (ptyIds: readonly string[]) => () => void
           stopAndWait: (ptyId: string) => Promise<boolean>
         }
-        const release = controller.markReversibleStops(['local-pty'])
+        const settleStop = runtime.intentionalPtyStops.mark('local-pty', 'reversible', null)
 
         const stopPromise = controller.stopAndWait('local-pty')
         await vi.advanceTimersByTimeAsync(1_200)
         await expect(stopPromise).resolves.toBe(true)
-        release()
+        settleStop(true)
 
         expect(
           mainWindow.webContents.send.mock.calls.filter((call) => call[0] === 'pty:exit')
diff --git a/src/main/ipc/pty-dead-owner-respawn.test.ts b/src/main/ipc/pty-dead-owner-respawn.test.ts
index 4669d7e5528..7a72c0d53b4 100644
--- a/src/main/ipc/pty-dead-owner-respawn.test.ts
+++ b/src/main/ipc/pty-dead-owner-respawn.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it, vi } from 'vitest'
+import { withDurableRuntimeStore } from '../runtime/runtime-durable-store-fixture'
 import { setupPtyIpcSuite } from './pty-ipc-test-harness'
 import { SessionNotFoundError } from '../daemon/daemon-errors'
 import { makePaneKey } from '../../shared/stable-pane-id'
@@ -102,7 +103,7 @@ describe('registerPtyHandlers', () => {
       },
       terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-proven-absent-owner' }
     }
-    const store = {
+    const store = withDurableRuntimeStore({
       getWorkspaceSession: vi.fn(() => session),
       setWorkspaceSession: vi.fn((next) => {
         session = next
@@ -113,7 +114,7 @@ describe('registerPtyHandlers', () => {
       getFolderWorkspaces: vi.fn(() => []),
       getProjectGroups: vi.fn(() => []),
       getRepos: vi.fn(() => [])
-    }
+    })
     const runtime = {
       setPtyController: vi.fn(),
       resolveTerminalPane: vi.fn(() => {
@@ -226,7 +227,7 @@ describe('registerPtyHandlers', () => {
       },
       terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-probe-blip-owner' }
     }
-    const store = {
+    const store = withDurableRuntimeStore({
       getWorkspaceSession: vi.fn(() => session),
       setWorkspaceSession: vi.fn((next) => {
         session = next
@@ -237,7 +238,7 @@ describe('registerPtyHandlers', () => {
       getFolderWorkspaces: vi.fn(() => []),
       getProjectGroups: vi.fn(() => []),
       getRepos: vi.fn(() => [])
-    }
+    })
     const runtime = {
       setPtyController: vi.fn(),
       resolveTerminalPane: vi.fn(() => {
@@ -350,7 +351,7 @@ describe('registerPtyHandlers', () => {
       },
       terminalPtyIncarnationsByPaneKey: {}
     }
-    const store = {
+    const store = withDurableRuntimeStore({
       getWorkspaceSession: vi.fn(() => session),
       setWorkspaceSession: vi.fn((next) => {
         session = next
@@ -361,7 +362,7 @@ describe('registerPtyHandlers', () => {
       getFolderWorkspaces: vi.fn(() => []),
       getProjectGroups: vi.fn(() => []),
       getRepos: vi.fn(() => [])
-    }
+    })
     let runtimeOwnsPane = true
     const runtime = {
       setPtyController: vi.fn(),
diff --git a/src/main/ipc/pty-ipc-daemon-provider-fixtures.ts b/src/main/ipc/pty-ipc-daemon-provider-fixtures.ts
index 4c74a7a82e9..6d43b0dec35 100644
--- a/src/main/ipc/pty-ipc-daemon-provider-fixtures.ts
+++ b/src/main/ipc/pty-ipc-daemon-provider-fixtures.ts
@@ -96,7 +96,7 @@ export function createDaemonActiveProviderFixtures(ctx: {
     getSelectedCodexHomePath?: (
       target?: { runtime?: 'host' | 'wsl'; wslDistro?: string | null },
       launchEnv?: NodeJS.ProcessEnv,
-      launchContext?: { workspacePath?: string; launchAgent?: TuiAgent }
+      launchContext?: { unavailableManagedHomePath?: string }
     ) => string | null,
     getSettings?: () => {
       httpProxyUrl?: string
@@ -157,7 +157,7 @@ export function createDaemonActiveProviderFixtures(ctx: {
     getSelectedCodexHomePath?: (
       target?: { runtime?: 'host' | 'wsl'; wslDistro?: string | null },
       launchEnv?: NodeJS.ProcessEnv,
-      launchContext?: { workspacePath?: string; launchAgent?: TuiAgent }
+      launchContext?: { unavailableManagedHomePath?: string }
     ) => string | null,
     getSettings?: () => {
       httpProxyUrl?: string
diff --git a/src/main/ipc/pty-ipc-mock-registry.ts b/src/main/ipc/pty-ipc-mock-registry.ts
index 71b77621b75..f49978843d5 100644
--- a/src/main/ipc/pty-ipc-mock-registry.ts
+++ b/src/main/ipc/pty-ipc-mock-registry.ts
@@ -108,12 +108,14 @@ export const childProcessModuleMock = (original: Record<string, unknown>) => ({
 export const openCodeHookServiceModuleMock = () => ({
   openCodeHookService: {
     buildPtyEnv: openCodeBuildPtyEnvMock,
+    refreshLegacySharedPlugin: vi.fn<() => void>(),
     clearPty: openCodeClearPtyMock
   },
   // Separate mock per variant: assembly.ts picks the service by variant, and a shared
   // mock would hide a regression that hands an OpenCode 2 pane the v1 plugin.
   openCode2HookService: {
     buildPtyEnv: openCode2BuildPtyEnvMock,
+    refreshLegacySharedPlugin: vi.fn<() => void>(),
     clearPty: openCodeClearPtyMock
   }
 })
diff --git a/src/main/ipc/pty-ipc-spawn-drivers.ts b/src/main/ipc/pty-ipc-spawn-drivers.ts
index 46a19ab9e92..dde291ce072 100644
--- a/src/main/ipc/pty-ipc-spawn-drivers.ts
+++ b/src/main/ipc/pty-ipc-spawn-drivers.ts
@@ -29,7 +29,7 @@ export function createPtyIpcSpawnDrivers(ctx: {
     getSelectedCodexHomePath?: (
       target?: { runtime?: 'host' | 'wsl'; wslDistro?: string | null },
       launchEnv?: NodeJS.ProcessEnv,
-      launchContext?: { workspacePath?: string; launchAgent?: TuiAgent }
+      launchContext?: { unavailableManagedHomePath?: string }
     ) => string | null,
     getSettings?: () => {
       agentStatusHooksEnabled?: boolean
diff --git a/src/main/ipc/pty-pane-reservation-settlement.test.ts b/src/main/ipc/pty-pane-reservation-settlement.test.ts
index b6aba0855e6..30ef457a81d 100644
--- a/src/main/ipc/pty-pane-reservation-settlement.test.ts
+++ b/src/main/ipc/pty-pane-reservation-settlement.test.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime/runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import { spawnMock, registerPtyMock } from './pty-ipc-mock-registry'
 import { setupPtyIpcSuite } from './pty-ipc-test-harness'
@@ -112,7 +113,7 @@ describe('registerPtyHandlers', () => {
       },
       terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-dead-ssh-owner' }
     }
-    const store = {
+    const store = withDurableRuntimeStore({
       getWorkspaceSession: vi.fn((requestedHostId?: string) => {
         expect(requestedHostId).toBe(hostId)
         return session
@@ -128,7 +129,7 @@ describe('registerPtyHandlers', () => {
       removeSshRemotePtyLease: vi.fn(),
       markSshRemotePtyLease: vi.fn(),
       clearSshRemotePtyKillIntent: vi.fn()
-    }
+    })
     const runtime = {
       setPtyController: vi.fn(),
       resolveTerminalPane: vi.fn(() => {
diff --git a/src/main/ipc/pty-pane-restart-replace.test.ts b/src/main/ipc/pty-pane-restart-replace.test.ts
index e8e91ea7d45..50558a0f870 100644
--- a/src/main/ipc/pty-pane-restart-replace.test.ts
+++ b/src/main/ipc/pty-pane-restart-replace.test.ts
@@ -3,6 +3,7 @@ import { setupPtyIpcSuite, type PtyIpcSuiteFixtures } from './pty-ipc-test-harne
 import { SessionNotFoundError } from '../daemon/daemon-errors'
 import { makePaneKey } from '../../shared/stable-pane-id'
 import { registerPtyHandlers, setLocalPtyProvider } from './pty'
+import { TerminalIntentionalStops } from '../runtime/terminal-intentional-stops'
 
 vi.mock('electron', () => import('./pty-ipc-mock-registry').then((m) => m.electronModuleMock()))
 vi.mock('fs', () => import('./pty-ipc-mock-registry').then((m) => m.fsModuleMock()))
@@ -137,6 +138,7 @@ function installRestartHarness(
       session = next
     }),
     flushOrThrow: vi.fn(),
+    runDurableMutation: vi.fn(async <T>(mutate: () => { value: T }) => mutate().value),
     persistPtyBinding: vi.fn(),
     getFolderWorkspace: vi.fn(() => undefined),
     getFolderWorkspaces: vi.fn(() => []),
@@ -160,7 +162,8 @@ function installRestartHarness(
     seedHeadlessTerminal: vi.fn(),
     onPtySpawned: vi.fn(),
     onPtyExit: vi.fn(),
-    onPtyData: vi.fn()
+    onPtyData: vi.fn(),
+    intentionalPtyStops: new TerminalIntentionalStops()
   }
   return { providerSpawn, shutdown, store, runtime, control }
 }
diff --git a/src/main/ipc/pty-persisted-incarnation-repair.test.ts b/src/main/ipc/pty-persisted-incarnation-repair.test.ts
index 743963d0189..c057d6ec5d2 100644
--- a/src/main/ipc/pty-persisted-incarnation-repair.test.ts
+++ b/src/main/ipc/pty-persisted-incarnation-repair.test.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime/runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import { statSyncMock } from './pty-ipc-mock-registry'
 import { setupPtyIpcSuite } from './pty-ipc-test-harness'
@@ -272,7 +273,7 @@ describe('registerPtyHandlers', () => {
         },
         terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-dead-persisted-owner' }
       }
-      const store = {
+      const store = withDurableRuntimeStore({
         getWorkspaceSession: vi.fn(() => session),
         setWorkspaceSession: vi.fn((next) => {
           session = next
@@ -293,7 +294,7 @@ describe('registerPtyHandlers', () => {
         ]),
         getProjectGroups: vi.fn(() => []),
         getRepos: vi.fn(() => [])
-      }
+      })
       const runtime = {
         setPtyController: vi.fn(),
         resolveTerminalPane: vi.fn(() => {
@@ -434,7 +435,7 @@ describe('registerPtyHandlers', () => {
       },
       terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-unproven-owner' }
     }
-    const store = {
+    const store = withDurableRuntimeStore({
       getWorkspaceSession: vi.fn(() => session),
       setWorkspaceSession: vi.fn((next) => {
         session = next
@@ -445,7 +446,7 @@ describe('registerPtyHandlers', () => {
       getFolderWorkspaces: vi.fn(() => []),
       getProjectGroups: vi.fn(() => []),
       getRepos: vi.fn(() => [])
-    }
+    })
     const runtime = {
       setPtyController: vi.fn(),
       resolveTerminalPane: vi.fn(() => {
diff --git a/src/main/ipc/pty-reset-input-modes.test.ts b/src/main/ipc/pty-reset-input-modes.test.ts
new file mode 100644
index 00000000000..55fa628078d
--- /dev/null
+++ b/src/main/ipc/pty-reset-input-modes.test.ts
@@ -0,0 +1,106 @@
+import { describe, expect, it, vi } from 'vitest'
+import { onMock } from './pty-ipc-mock-registry'
+import { setupPtyIpcSuite } from './pty-ipc-test-harness'
+import { registerPtyHandlers } from './pty'
+
+vi.mock('electron', () => import('./pty-ipc-mock-registry').then((m) => m.electronModuleMock()))
+vi.mock('fs', () => import('./pty-ipc-mock-registry').then((m) => m.fsModuleMock()))
+vi.mock('node-pty', () => import('./pty-ipc-mock-registry').then((m) => m.nodePtyModuleMock()))
+vi.mock('node:child_process', async (importOriginal) =>
+  (await import('./pty-ipc-mock-registry')).childProcessModuleMock(await importOriginal())
+)
+vi.mock('../opencode/hook-service', () =>
+  import('./pty-ipc-mock-registry').then((m) => m.openCodeHookServiceModuleMock())
+)
+vi.mock('../mimo/hook-service', () =>
+  import('./pty-ipc-mock-registry').then((m) => m.mimoHookServiceModuleMock())
+)
+vi.mock('../agent-hooks/server', () =>
+  import('./pty-ipc-mock-registry').then((m) => m.agentHookServerModuleMock())
+)
+vi.mock('../pi/titlebar-extension-service', () =>
+  import('./pty-ipc-mock-registry').then((m) => m.piTitlebarExtensionModuleMock())
+)
+vi.mock('../pwsh', () => import('./pty-ipc-mock-registry').then((m) => m.pwshModuleMock()))
+vi.mock('../wsl', async (importOriginal) =>
+  (await import('./pty-ipc-mock-registry')).wslModuleMock(await importOriginal())
+)
+vi.mock('../telemetry/client', () =>
+  import('./pty-ipc-mock-registry').then((m) => m.telemetryClientModuleMock())
+)
+vi.mock('../telemetry/classify-error', () =>
+  import('./pty-ipc-mock-registry').then((m) => m.classifyErrorModuleMock())
+)
+vi.mock('../cli/linux-terminal-orca-cli-shim', () =>
+  import('./pty-ipc-mock-registry').then((m) => m.linuxCliShimModuleMock())
+)
+vi.mock('../memory/pty-registry', () =>
+  import('./pty-ipc-mock-registry').then((m) => m.ptyRegistryModuleMock())
+)
+vi.mock('../agent-hooks/migration-unsupported-pty-state', () =>
+  import('./pty-ipc-mock-registry').then((m) => m.migrationUnsupportedPtyModuleMock())
+)
+vi.mock('../codex/codex-pane-account-registry', () =>
+  import('./pty-ipc-mock-registry').then((m) => m.codexPaneAccountRegistryModuleMock())
+)
+vi.mock('../codex/codex-state-db-backfill-recovery', () =>
+  import('./pty-ipc-mock-registry').then((m) => m.codexBackfillRecoveryModuleMock())
+)
+
+describe('Reset Terminal main-side entry points', () => {
+  const { handlers, mainWindow, installDaemonTestProvider } = setupPtyIpcSuite()
+
+  function setup() {
+    const resetInputModes = vi.fn(async () => {})
+    installDaemonTestProvider({ resetInputModes })
+    let controller: { resetInputModes: (ptyId: string) => Promise<void> } | undefined
+    const runtime = {
+      setPtyController: vi.fn((next) => {
+        controller = next
+      }),
+      resetHeadlessTerminalInputModes: vi.fn(async () => {})
+    }
+    handlers.clear()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: registration reads only these members.
+    registerPtyHandlers(mainWindow as never, runtime as never)
+    return { resetInputModes, runtime, controller: controller! }
+  }
+
+  it('grounds the provider and the headless model from the pane IPC', () => {
+    const { resetInputModes, runtime } = setup()
+    const listener = onMock.mock.calls.findLast(
+      (entry: unknown[]) => entry[0] === 'pty:resetInputModes'
+    )?.[1]
+    if (typeof listener !== 'function') {
+      throw new Error('missing pty:resetInputModes listener')
+    }
+
+    listener(null, { id: 'pty-1' })
+
+    expect(resetInputModes).toHaveBeenCalledWith('pty-1')
+    expect(runtime.resetHeadlessTerminalInputModes).toHaveBeenCalledWith('pty-1')
+    // The pane grounded itself before sending; echoing back would ground it twice.
+    expect(mainWindow.webContents.send).not.toHaveBeenCalledWith(
+      'pty:resetInputModes:request',
+      expect.anything()
+    )
+  })
+
+  it("grounds the host window's pane and the provider for a runtime-initiated reset", async () => {
+    const { resetInputModes, controller } = setup()
+
+    await controller.resetInputModes('pty-1')
+
+    expect(mainWindow.webContents.send).toHaveBeenCalledWith('pty:resetInputModes:request', {
+      ptyId: 'pty-1'
+    })
+    expect(resetInputModes).toHaveBeenCalledWith('pty-1')
+  })
+
+  it('swallows an older host rejecting the request', async () => {
+    const { resetInputModes, controller } = setup()
+    resetInputModes.mockRejectedValueOnce(new Error('Unknown request type: resetInputModes'))
+
+    await expect(controller.resetInputModes('pty-1')).resolves.toBeUndefined()
+  })
+})
diff --git a/src/main/ipc/pty-serializer-settlement-mapping.test.ts b/src/main/ipc/pty-serializer-settlement-mapping.test.ts
index 47082d6e745..70e358a8014 100644
--- a/src/main/ipc/pty-serializer-settlement-mapping.test.ts
+++ b/src/main/ipc/pty-serializer-settlement-mapping.test.ts
@@ -3,6 +3,7 @@ import { spawnMock, openCodeClearPtyMock, piClearPtyMock } from './pty-ipc-mock-
 import { setupPtyIpcSuite } from './pty-ipc-test-harness'
 import { makePaneKey } from '../../shared/stable-pane-id'
 import { OrcaRuntimeService } from '../runtime/orca-runtime'
+import type * as WslManagedCliModule from '../cli/wsl-managed-cli'
 import {
   SSH_PTY_IDENTITY_MISMATCH_ERROR,
   SSH_SESSION_EXPIRED_ERROR
@@ -46,6 +47,13 @@ vi.mock('../telemetry/client', () =>
 vi.mock('../telemetry/classify-error', () =>
   import('./pty-ipc-mock-registry').then((m) => m.classifyErrorModuleMock())
 )
+const managedWslCliDir = vi.hoisted(() =>
+  vi.fn((): string | null => 'C:\\orca-user-data\\wsl-managed-cli\\hash')
+)
+vi.mock('../cli/wsl-managed-cli', async (importOriginal) => ({
+  ...(await importOriginal<typeof WslManagedCliModule>()),
+  getManagedWslCliDir: managedWslCliDir
+}))
 vi.mock('../cli/linux-terminal-orca-cli-shim', () =>
   import('./pty-ipc-mock-registry').then((m) => m.linuxCliShimModuleMock())
 )
@@ -248,7 +256,10 @@ describe('registerPtyHandlers', () => {
         })
       ).rejects.toThrow(/ORCA_TERMINAL_SESSION_STATE_SAVE_FAILED/)
 
-      expect(remoteShutdown).toHaveBeenCalledWith(appPtyId, { immediate: true })
+      expect(remoteShutdown).toHaveBeenCalledWith(appPtyId, {
+        immediate: true,
+        expectedIncarnationId: incarnationId
+      })
       expect(store.upsertSshRemotePtyLease).not.toHaveBeenCalled()
       expect(store.removeSshRemotePtyLease).not.toHaveBeenCalled()
       expect(openCodeClearPtyMock).toHaveBeenCalledWith(appPtyId)
@@ -455,12 +466,13 @@ describe('registerPtyHandlers', () => {
     await handlers.get('pty:spawn')!(null, {
       cols: 80,
       rows: 24,
-      env: { ORCA_TERMINAL_HANDLE: 'term_untrusted' }
+      env: { ORCA_TERMINAL_HANDLE: 'term_untrusted', ORCA_WSL_CLI_DIR: 'C:\\stale' }
     })
 
     const spawnCall = spawnMock.mock.calls.at(-1)!
     const env = spawnCall[2].env as Record<string, string>
     expect(env.ORCA_TERMINAL_HANDLE).toBe('term_trusted')
+    expect(env.ORCA_WSL_CLI_DIR).toBeUndefined()
     expect(runtime.preAllocateHandleForPty).toHaveBeenCalledWith(expect.any(String))
   })
   it('forwards the trusted Orca terminal handle into managed WSL terminals', async () => {
@@ -497,11 +509,13 @@ describe('registerPtyHandlers', () => {
     expect(env.ORCA_TERMINAL_HANDLE).toBe('term_wsl')
     expect(env.ORCA_USER_DATA_PATH).toBe('/tmp/orca-user-data')
     expect(env.ORCA_CLI_COMMAND).toBe('orca-ide')
+    expect(env.ORCA_WSL_CLI_DIR).toBe('C:\\orca-user-data\\wsl-managed-cli\\hash')
     expect(env.WSLENV?.split(':')).toEqual(
       expect.arrayContaining([
         'ORCA_TERMINAL_HANDLE/u',
         'ORCA_USER_DATA_PATH/p',
         'ORCA_CLI_COMMAND/u',
+        'ORCA_WSL_CLI_DIR/p',
         'ORCA_AGENT_HOOK_PORT/u',
         'ORCA_AGENT_HOOK_TOKEN/u',
         // Why: bare WSL shells no longer create ~/.omp; only status extension is exported (#10196).
@@ -513,7 +527,8 @@ describe('registerPtyHandlers', () => {
       expect.arrayContaining(['ORCA_OMP_SOURCE_AGENT_DIR/p'])
     )
   })
-  it('forces managed ORCA_USER_DATA_PATH for WSL spawns even when the caller provides a stale root', async () => {
+  it('forces managed WSL env over stale caller values, even when CLI setup fails', async () => {
+    managedWslCliDir.mockReturnValueOnce(null)
     const platform = Object.getOwnPropertyDescriptor(process, 'platform')
     Object.defineProperty(process, 'platform', {
       configurable: true,
@@ -534,7 +549,8 @@ describe('registerPtyHandlers', () => {
         rows: 24,
         shellOverride: 'wsl.exe',
         env: {
-          ORCA_USER_DATA_PATH: '/tmp/stale-orca-user-data'
+          ORCA_USER_DATA_PATH: '/tmp/stale-orca-user-data',
+          ORCA_WSL_CLI_DIR: '/tmp/stale-wsl-cli'
         }
       })
     } finally {
@@ -547,5 +563,6 @@ describe('registerPtyHandlers', () => {
     const env = spawnCall[2].env as Record<string, string>
     expect(spawnCall[0]).toBe('wsl.exe')
     expect(env.ORCA_USER_DATA_PATH).toBe('/tmp/orca-user-data')
+    expect(env.ORCA_WSL_CLI_DIR).toBeUndefined()
   })
 })
diff --git a/src/main/ipc/pty-spawn-env-agent-overlays.test.ts b/src/main/ipc/pty-spawn-env-agent-overlays.test.ts
index 1595835801f..4c7204f1980 100644
--- a/src/main/ipc/pty-spawn-env-agent-overlays.test.ts
+++ b/src/main/ipc/pty-spawn-env-agent-overlays.test.ts
@@ -9,7 +9,6 @@ import {
 } from './pty-ipc-mock-registry'
 import { posixOnlyIt } from './pty-ipc-test-constants'
 import { setupPtyIpcSuite } from './pty-ipc-test-harness'
-import type { TuiAgent } from '../../shared/tui-agent'
 import { SETUP_AGENT_SEQUENCE_STARTUP_COMMAND_ENV } from '../../shared/setup-agent-sequencing'
 
 vi.mock('electron', () => import('./pty-ipc-mock-registry').then((m) => m.electronModuleMock()))
@@ -60,13 +59,13 @@ describe('registerPtyHandlers', () => {
   const { spawnAndGetEnv } = setupPtyIpcSuite()
 
   describe('spawn environment', () => {
-    it('prepares Codex launch state for the workspace before spawning an interactive tab', async () => {
+    it('prepares Codex launch state before spawning an interactive tab', async () => {
       const workspacePath = '/repo/worktrees/new-feature'
       const resolveHome = vi.fn(
         (
           _target?: { runtime?: 'host' | 'wsl'; wslDistro?: string | null },
           _launchEnv?: NodeJS.ProcessEnv,
-          _launchContext?: { workspacePath?: string; launchAgent?: TuiAgent }
+          _launchContext?: { unavailableManagedHomePath?: string }
         ) => null
       )
 
@@ -82,7 +81,6 @@ describe('registerPtyHandlers', () => {
       )
 
       expect(resolveHome.mock.calls[0]?.[0]).toEqual({ runtime: 'host' })
-      expect(resolveHome.mock.calls[0]?.[2]).toEqual({ workspacePath, launchAgent: 'codex' })
       expect(resolveHome.mock.invocationCallOrder[0]).toBeLessThan(
         spawnMock.mock.invocationCallOrder[0]!
       )
diff --git a/src/main/ipc/pty-spawn-env-terminal-basics.test.ts b/src/main/ipc/pty-spawn-env-terminal-basics.test.ts
index c36fa3e40f5..bed6953e2b1 100644
--- a/src/main/ipc/pty-spawn-env-terminal-basics.test.ts
+++ b/src/main/ipc/pty-spawn-env-terminal-basics.test.ts
@@ -351,6 +351,16 @@ describe('registerPtyHandlers', () => {
       expect(env.CLAUDE_CODE_SESSION_ID).toBeUndefined()
       expect(env.CLAUDE_CODE_BRIDGE_SESSION_ID).toBeUndefined()
     })
+    it('strips an inherited agent session id so a pane never claims that session', async () => {
+      // Why: an Orca launched inside a structured session inherits its id; every pane would then
+      // present that session as its orchestration caller instead of its own terminal.
+      const env = await spawnAndGetEnv(undefined, {
+        ORCA_AGENT_SESSION_ID: 'a0b1c2d3-0000-4000-8000-00000000abcd',
+        ORCA_STRUCTURED_SESSION: '1'
+      })
+      expect(env.ORCA_AGENT_SESSION_ID).toBeUndefined()
+      expect(env.ORCA_STRUCTURED_SESSION).toBeUndefined()
+    })
     it('keeps an explicitly requested Claude child-session stamp on a local spawn', async () => {
       const env = await spawnAndGetEnv(
         { CLAUDE_CODE_CHILD_SESSION: '1' },
diff --git a/src/main/ipc/pty-ssh-undelivered-kill.test.ts b/src/main/ipc/pty-ssh-undelivered-kill.test.ts
index d59d7d8543a..2d92ffa1859 100644
--- a/src/main/ipc/pty-ssh-undelivered-kill.test.ts
+++ b/src/main/ipc/pty-ssh-undelivered-kill.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it, vi } from 'vitest'
 import { setupPtyIpcSuite } from './pty-ipc-test-harness'
+import { TerminalIntentionalStops } from '../runtime/terminal-intentional-stops'
 import { SSH_SESSION_EXPIRED_ERROR } from '../providers/ssh-pty-errors'
 import {
   registerPtyHandlers,
@@ -79,7 +80,8 @@ function installController(handlers: Map<string, never>) {
     setPtyController: vi.fn(),
     markPtyStopRequested: vi.fn(),
     markPtyLivenessUnverifiable: vi.fn(),
-    onPtyExit: vi.fn()
+    onPtyExit: vi.fn(),
+    intentionalPtyStops: new TerminalIntentionalStops()
   }
   handlers.clear()
   return { runtime }
@@ -91,7 +93,7 @@ describe('undelivered SSH stops', () => {
   function install(store: ReturnType<typeof createKillStore>): {
     kill: (ptyId: string) => boolean
     stopAndWait: (ptyId: string, opts?: { keepHistory?: boolean }) => Promise<boolean>
-    markReversibleStops: (ptyIds: readonly string[]) => () => void
+    recordUnconfirmedStop: (ptyId: string) => boolean
     runtime: ReturnType<typeof installController>['runtime']
   } {
     const { runtime } = installController(handlers as never)
@@ -103,15 +105,16 @@ describe('undelivered SSH stops', () => {
       undefined,
       store as never
     )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: registerPtyHandlers installs the runtime PTY controller, which implements these members.
     const controller = runtime.setPtyController.mock.calls[0]?.[0] as {
       kill: (ptyId: string) => boolean
       stopAndWait: (ptyId: string, opts?: { keepHistory?: boolean }) => Promise<boolean>
-      markReversibleStops: (ptyIds: readonly string[]) => () => void
+      recordUnconfirmedStop: (ptyId: string) => boolean
     }
     return {
       kill: controller.kill,
       stopAndWait: controller.stopAndWait,
-      markReversibleStops: controller.markReversibleStops,
+      recordUnconfirmedStop: controller.recordUnconfirmedStop,
       runtime
     }
   }
@@ -298,15 +301,41 @@ describe('undelivered SSH stops', () => {
     )
     setPtyOwnership(SCOPED_PTY_ID, 'ssh-1')
     restorePtyIncarnation(SCOPED_PTY_ID, 'inc-f')
-    const { kill, markReversibleStops } = install(store)
-    const release = markReversibleStops([SCOPED_PTY_ID])
+    const { kill, runtime } = install(store)
+    const settleStop = runtime.intentionalPtyStops.mark(SCOPED_PTY_ID, 'reversible', null)
 
     try {
       kill(SCOPED_PTY_ID)
       await new Promise((resolve) => setTimeout(resolve, 0))
       expect(store.recordSshRemotePtyKillIntent).not.toHaveBeenCalled()
     } finally {
-      release()
+      settleStop(false)
+      unregisterSshPtyProvider('ssh-1')
+      deletePtyOwnership(SCOPED_PTY_ID)
+    }
+  })
+
+  it('records nothing while a reversible stop owns the PTY and a restart stop joins it', async () => {
+    const store = createKillStore()
+    registerSshPtyProvider(
+      'ssh-1',
+      sshProviderStub(async () => {
+        throw new Error('socket closed')
+      })
+    )
+    setPtyOwnership(SCOPED_PTY_ID, 'ssh-1')
+    restorePtyIncarnation(SCOPED_PTY_ID, 'inc-f')
+    const { kill, runtime } = install(store)
+    const settleSleep = runtime.intentionalPtyStops.mark(SCOPED_PTY_ID, 'reversible', null)
+    const settleRestart = runtime.intentionalPtyStops.mark(SCOPED_PTY_ID, 'replaced', null)
+
+    try {
+      kill(SCOPED_PTY_ID)
+      await new Promise((resolve) => setTimeout(resolve, 0))
+      expect(store.recordSshRemotePtyKillIntent).not.toHaveBeenCalled()
+    } finally {
+      settleRestart(false)
+      settleSleep(false)
       unregisterSshPtyProvider('ssh-1')
       deletePtyOwnership(SCOPED_PTY_ID)
     }
@@ -327,8 +356,8 @@ describe('undelivered SSH stops', () => {
     }
   })
 
-  // No incarnation means no fence, and an unfenced order can only be discarded or guessed at.
-  it('records nothing when the PTY incarnation was never learned', async () => {
+  // A legacy id with no incarnation has no fence, and an unfenced order can only be guessed at.
+  it('records nothing for a legacy id whose PTY incarnation was never learned', async () => {
     const store = createKillStore()
     registerSshPtyProvider(
       'ssh-1',
@@ -348,4 +377,82 @@ describe('undelivered SSH stops', () => {
       deletePtyOwnership('ssh:ssh-1@@pty-8')
     }
   })
+
+  // A `pty2:` id is epoch-scoped, so it names one process even when the incarnation was never
+  // learned: an offline close across a relaunch still owes the kill.
+  it('records the stop for an epoch-scoped id whose incarnation was never learned', () => {
+    const store = createKillStore()
+    const ptyId = 'ssh:ssh-1@@pty2:epoch-a:4'
+    setPtyOwnership(ptyId, 'ssh-1')
+    const { kill } = install(store)
+
+    try {
+      expect(kill(ptyId)).toBe(false)
+      expect(store.recordSshRemotePtyKillIntent).toHaveBeenCalledWith('ssh-1', 'pty2:epoch-a:4', {
+        requestedAt: expect.any(Number),
+        attempts: 0
+      })
+    } finally {
+      deletePtyOwnership(ptyId)
+    }
+  })
+
+  // One recorder: the explicit-close receipt promises the retry for an epoch-scoped id too.
+  it("records an explicit close's unconfirmed stop for an epoch-scoped id with no incarnation", () => {
+    const store = createKillStore()
+    const ptyId = 'ssh:ssh-1@@pty2:epoch-b:5'
+    setPtyOwnership(ptyId, 'ssh-1')
+    const { recordUnconfirmedStop } = install(store)
+
+    try {
+      expect(recordUnconfirmedStop(ptyId)).toBe(true)
+      expect(store.recordSshRemotePtyKillIntent).toHaveBeenCalledTimes(1)
+      expect(store.recordSshRemotePtyKillIntent).toHaveBeenCalledWith('ssh-1', 'pty2:epoch-b:5', {
+        requestedAt: expect.any(Number),
+        attempts: 0
+      })
+    } finally {
+      deletePtyOwnership(ptyId)
+    }
+  })
+
+  // An explicit close records its order when the stop goes unconfirmed, before the follow-up kill,
+  // so its receipt can promise the reconnect retry from the record itself.
+  it("records an explicit close's unconfirmed stop and says so", () => {
+    const store = createKillStore()
+    setPtyOwnership(SCOPED_PTY_ID, 'ssh-1')
+    restorePtyIncarnation(SCOPED_PTY_ID, 'inc-g')
+    const { recordUnconfirmedStop } = install(store)
+
+    try {
+      expect(recordUnconfirmedStop(SCOPED_PTY_ID)).toBe(true)
+      expect(store.recordSshRemotePtyKillIntent).toHaveBeenCalledWith(
+        'ssh-1',
+        'pty-7',
+        expect.objectContaining({ incarnationId: 'inc-g', attempts: 0 })
+      )
+    } finally {
+      deletePtyOwnership(SCOPED_PTY_ID)
+    }
+  })
+
+  it('reports no recorded order for a local or reversibly stopped PTY', () => {
+    const store = createKillStore()
+    setPtyOwnership('local-pty', null)
+    restorePtyIncarnation('local-pty', 'inc-h')
+    setPtyOwnership(SCOPED_PTY_ID, 'ssh-1')
+    restorePtyIncarnation(SCOPED_PTY_ID, 'inc-i')
+    const { recordUnconfirmedStop, runtime } = install(store)
+    const settleStop = runtime.intentionalPtyStops.mark(SCOPED_PTY_ID, 'reversible', null)
+
+    try {
+      expect(recordUnconfirmedStop('local-pty')).toBe(false)
+      expect(recordUnconfirmedStop(SCOPED_PTY_ID)).toBe(false)
+      expect(store.recordSshRemotePtyKillIntent).not.toHaveBeenCalled()
+    } finally {
+      settleStop(false)
+      deletePtyOwnership('local-pty')
+      deletePtyOwnership(SCOPED_PTY_ID)
+    }
+  })
 })
diff --git a/src/main/ipc/pty/delivery/accept.ts b/src/main/ipc/pty/delivery/accept.ts
index 0582bed3353..979a50d3008 100644
--- a/src/main/ipc/pty/delivery/accept.ts
+++ b/src/main/ipc/pty/delivery/accept.ts
@@ -36,7 +36,7 @@ export function acceptPtyDataForRenderer(
   const preservesSeq = !payload.transformed && rawLength === payload.data.length
   const startSeq = typeof outputSeq === 'number' ? Math.max(0, outputSeq - rawLength) : undefined
   const projectionId = projection?.identity.projectionSemanticsId
-  if (session.mainWindow.isDestroyed()) {
+  if (!session.mainWindow || session.mainWindow.isDestroyed()) {
     if (projectionId) {
       session.sshOutputIntake?.transferProjections([projectionId], 'renderer-destroyed')
     }
diff --git a/src/main/ipc/pty/delivery/accounting.ts b/src/main/ipc/pty/delivery/accounting.ts
index eddc49be3f2..16fc3520f86 100644
--- a/src/main/ipc/pty/delivery/accounting.ts
+++ b/src/main/ipc/pty/delivery/accounting.ts
@@ -132,7 +132,11 @@ export function clearDeliveryResyncProbe(session: PtyIpcSession): void {
 }
 
 export function requestDeliveryResyncForGatedPty(session: PtyIpcSession): void {
-  if (session.deliveryResyncOutstandingRequestId !== null || session.mainWindow.isDestroyed()) {
+  if (
+    session.deliveryResyncOutstandingRequestId !== null ||
+    !session.mainWindow ||
+    session.mainWindow.isDestroyed()
+  ) {
     return
   }
   session.deliveryResyncRequestSerial += 1
diff --git a/src/main/ipc/pty/delivery/debug-snapshot.ts b/src/main/ipc/pty/delivery/debug-snapshot.ts
index facc04e4e74..3388ef153f7 100644
--- a/src/main/ipc/pty/delivery/debug-snapshot.ts
+++ b/src/main/ipc/pty/delivery/debug-snapshot.ts
@@ -46,13 +46,14 @@ export function buildMainDeliveryDiagnostics(session: PtyIpcSession): PtyMainDel
     })
   }
   perPty.sort((a, b) => b.inFlightChars + b.pendingChars - (a.inFlightChars + a.pendingChars))
-  const windowAlive = !session.mainWindow.isDestroyed()
+  const { mainWindow } = session
+  const windowAlive = mainWindow && !mainWindow.isDestroyed()
   return {
     appVersion: getAppEnvironment().getVersion(),
     mainUptimeMs: Math.round(process.uptime() * 1000),
-    windowFocused: windowAlive ? session.mainWindow.isFocused() : null,
-    windowVisible: windowAlive ? session.mainWindow.isVisible() : null,
-    windowMinimized: windowAlive ? session.mainWindow.isMinimized() : null,
+    windowFocused: windowAlive ? mainWindow.isFocused() : null,
+    windowVisible: windowAlive ? mainWindow.isVisible() : null,
+    windowMinimized: windowAlive ? mainWindow.isMinimized() : null,
     msSinceLastPowerSuspend: lastPowerSuspendAtMs === null ? null : now - lastPowerSuspendAtMs,
     msSinceLastPowerResume: lastPowerResumeAtMs === null ? null : now - lastPowerResumeAtMs,
     perPty: perPty.slice(0, DELIVERY_DIAGNOSTICS_MAX_PTYS),
diff --git a/src/main/ipc/pty/delivery/exit.ts b/src/main/ipc/pty/delivery/exit.ts
index 9aba356b3c3..ad144b4d587 100644
--- a/src/main/ipc/pty/delivery/exit.ts
+++ b/src/main/ipc/pty/delivery/exit.ts
@@ -7,57 +7,8 @@ import { allocatePtyLifecycleSequence } from '../host-env/types'
 import { makePtyDataPayload, sendPtyDataToRenderer } from './payload'
 import { getRendererInFlightCharsForPty } from './accounting'
 import { clearFlushTimerIfIdle } from './flush'
-import { ptyIncarnationById } from '../provider/ownership-state'
 import type { PtyIpcSession } from '../session'
 
-export type ReplacedPtyStop = {
-  incarnationId: string | undefined
-  expiryTimer?: NodeJS.Timeout
-}
-
-/** Labels the exit of a PTY that main stops so a new process can take its pane. Settle with
- *  whether the stop succeeded; a failed stop leaves no label behind. */
-export function markReplacedPtyStop(
-  session: PtyIpcSession,
-  id: string
-): (stopped: boolean) => void {
-  clearTimeout(session.replacedPtyStopsById.get(id)?.expiryTimer)
-  const mark: ReplacedPtyStop = { incarnationId: ptyIncarnationById.get(id) }
-  session.replacedPtyStopsById.set(id, mark)
-  return (stopped) => {
-    if (session.replacedPtyStopsById.get(id) !== mark) {
-      return
-    }
-    if (!stopped) {
-      session.replacedPtyStopsById.delete(id)
-      return
-    }
-    // Why a window: an SSH exit can reach the renderer after the stop settles; bound it like a synthetic kill.
-    mark.expiryTimer = setTimeout(() => {
-      if (session.replacedPtyStopsById.get(id) === mark) {
-        session.replacedPtyStopsById.delete(id)
-      }
-    }, SYNTHETIC_KILL_EXIT_DUPLICATE_WINDOW_MS)
-    mark.expiryTimer.unref?.()
-  }
-}
-
-function consumeReplacedPtyStop(
-  session: PtyIpcSession,
-  payload: { id: string; incarnationId?: string }
-): boolean {
-  const mark = session.replacedPtyStopsById.get(payload.id)
-  if (
-    !mark ||
-    (mark.incarnationId && payload.incarnationId && mark.incarnationId !== payload.incarnationId)
-  ) {
-    return false
-  }
-  clearTimeout(mark.expiryTimer)
-  session.replacedPtyStopsById.delete(payload.id)
-  return true
-}
-
 export function rememberSyntheticKillExit(
   session: PtyIpcSession,
   id: string,
@@ -105,7 +56,7 @@ export function preparePtyExitForRenderer(
   session: PtyIpcSession,
   payload: { id: string; code: number; incarnationId?: string }
 ): (() => void) | null {
-  if (session.mainWindow.isDestroyed()) {
+  if (!session.mainWindow || session.mainWindow.isDestroyed()) {
     session.sshOutputIntake?.transferPtyProjections(payload.id, 'renderer-destroyed')
     return () => {}
   }
@@ -171,7 +122,7 @@ export function finalizePtyExitForRenderer(
   session: PtyIpcSession,
   payload: { id: string; code: number; incarnationId?: string }
 ): void {
-  if (session.mainWindow.isDestroyed()) {
+  if (!session.mainWindow || session.mainWindow.isDestroyed()) {
     session.rendererCreditBeforeExitByPty.delete(payload.id)
     return
   }
@@ -202,12 +153,12 @@ export function finalizePtyExitForRenderer(
       session.schedulePendingDataAfterCreditReport(true)
     }
   }
+  const intentionalStops =
+    session.runtime?.intentionalPtyStops?.claimExit(payload.id, payload.incarnationId) ?? []
   session.mainWindow.webContents.send('pty:exit', {
     ...payload,
-    ...(session.reversibleStopOwnersByPtyId.has(payload.id)
-      ? { preserveRendererBinding: true }
-      : {}),
-    ...(consumeReplacedPtyStop(session, payload) ? { replacedByRestart: true } : {})
+    ...(intentionalStops.includes('reversible') ? { preserveRendererBinding: true } : {}),
+    ...(intentionalStops.includes('replaced') ? { replacedByRestart: true } : {})
   })
 }
 
@@ -229,7 +180,7 @@ export function sendPtyExitToRenderer(
 }
 
 export function sendPtySpawnedToRenderer(session: PtyIpcSession, id: string): void {
-  if (!session.mainWindow.isDestroyed()) {
+  if (session.mainWindow && !session.mainWindow.isDestroyed()) {
     session.mainWindow.webContents.send('pty:spawned', { id })
   }
 }
diff --git a/src/main/ipc/pty/delivery/flush.ts b/src/main/ipc/pty/delivery/flush.ts
index 038d955a932..ffe3c3014e8 100644
--- a/src/main/ipc/pty/delivery/flush.ts
+++ b/src/main/ipc/pty/delivery/flush.ts
@@ -50,13 +50,17 @@ export function clearDispatcherReadyWatchdog(session: PtyIpcSession): void {
 
 export function armDispatcherReadyWatchdog(session: PtyIpcSession): void {
   clearDispatcherReadyWatchdog(session)
-  if (session.mainWindow.isDestroyed()) {
+  if (!session.mainWindow || session.mainWindow.isDestroyed()) {
     return
   }
   // Why: one-shot self-heal — force the gate open if the reloaded page never signals ready, so a dropped handshake can't hold it forever. Unref'd so it can't keep the process alive.
   session.dispatcherReadyWatchdogTimer = setTimeout(() => {
     session.dispatcherReadyWatchdogTimer = null
-    if (session.rendererPtyDispatcherReady || session.mainWindow.isDestroyed()) {
+    if (
+      session.rendererPtyDispatcherReady ||
+      !session.mainWindow ||
+      session.mainWindow.isDestroyed()
+    ) {
       return
     }
     session.rendererPtyDispatcherReady = true
@@ -77,7 +81,7 @@ export function clearFlushTimerIfIdle(session: PtyIpcSession): void {
 
 export function flushPendingData(session: PtyIpcSession): void {
   session.flushTimer = null
-  if (session.mainWindow.isDestroyed()) {
+  if (!session.mainWindow || session.mainWindow.isDestroyed()) {
     // Why release now: bookkeeping is being wiped, so no future drain can resume these producers — local shells would wedge.
     session.producerFlowControl.releaseAll()
     session.clearDeliveryResyncProbe()
diff --git a/src/main/ipc/pty/delivery/lifecycle-reset.ts b/src/main/ipc/pty/delivery/lifecycle-reset.ts
index 961c09188a1..475ddcadc0e 100644
--- a/src/main/ipc/pty/delivery/lifecycle-reset.ts
+++ b/src/main/ipc/pty/delivery/lifecycle-reset.ts
@@ -1,4 +1,4 @@
-import type { WebContents } from 'electron'
+import type { PtyRendererDelivery } from '../session'
 import {
   didFinishLoadHandler,
   didFinishLoadWebContents,
@@ -60,9 +60,14 @@ export function clearRendererLifecycleResetHandlers(): void {
   setRendererLifecycleResetState({ contents: null, handler: null, navigation: null })
 }
 
-export function registerRendererLifecycleResetHandlers(webContents: WebContents): void {
+export function registerRendererLifecycleResetHandlers(
+  webContents?: PtyRendererDelivery['webContents']
+): void {
   clearRendererLifecycleResetHandlers()
   markRendererPtysHiddenForRendererLifecycleReset()
+  if (!webContents) {
+    return
+  }
   const handler = markRendererPtysHiddenForRendererLifecycleReset
   const navigationHandler = (details: { isMainFrame: boolean; isSameDocument: boolean }) => {
     if (!details.isMainFrame || details.isSameDocument) {
diff --git a/src/main/ipc/pty/delivery/payload.ts b/src/main/ipc/pty/delivery/payload.ts
index 119bb173ed7..8be6dfd11dd 100644
--- a/src/main/ipc/pty/delivery/payload.ts
+++ b/src/main/ipc/pty/delivery/payload.ts
@@ -38,7 +38,7 @@ export function sendModelRestoreNeededMarker(
   reason: PtyModelRestoreReason,
   markerSeq: number | undefined
 ): boolean {
-  if (session.mainWindow.isDestroyed()) {
+  if (!session.mainWindow || session.mainWindow.isDestroyed()) {
     return false
   }
   try {
@@ -61,6 +61,12 @@ export function sendPtyDataToRenderer(
   payload: PtyDataPayload,
   projectionAdmissionIds?: readonly string[]
 ): { sent: boolean; projectionsTransferred: boolean } {
+  if (!session.mainWindow) {
+    if (projectionAdmissionIds) {
+      session.sshOutputIntake?.transferProjections(projectionAdmissionIds, 'renderer-destroyed')
+    }
+    return { sent: false, projectionsTransferred: projectionAdmissionIds !== undefined }
+  }
   const charCount = getPtyPayloadCharCount(payload)
   const accounting = session.rendererDeliveryAccountingByPty.get(id)
   const hadAccounting = accounting !== undefined
diff --git a/src/main/ipc/pty/host-env/assembly.ts b/src/main/ipc/pty/host-env/assembly.ts
index dedd44e70e3..7d825062903 100644
--- a/src/main/ipc/pty/host-env/assembly.ts
+++ b/src/main/ipc/pty/host-env/assembly.ts
@@ -1,16 +1,21 @@
 import { resolveSetupAgentSequenceLaunchCommand } from '../../../../shared/setup-agent-sequencing'
-import { isOpenCode2LaunchCommand } from '../../../../shared/opencode-launch-command'
+import { selectOpenCodeHookAgent } from '../../../../shared/opencode-launch-command'
 import {
   detectExplicitPiAgentKindFromCommand,
   isPiCompatibleAgentType
 } from '../../../../shared/pi-agent-kind'
 import { applyTerminalGitCredentialPromptGuard } from '../../terminal-git-credential-guard'
 import { openCode2HookService, openCodeHookService } from '../../../opencode/hook-service'
+import {
+  OPENCODE_CONFIG_DIR_ENV_KEYS,
+  isOpenCodeLegacySharedConfigDir
+} from '../../../opencode/legacy-shared-config-dir'
 import { mimoCodeHookService } from '../../../mimo/hook-service'
 import { agentHookServer } from '../../../agent-hooks/server'
 import { wslHookRelayManager } from '../../../agent-hooks/wsl-hook-relay-manager'
 import { piTitlebarExtensionService } from '../../../pi/titlebar-extension-service'
 import { prependOrcaCliDirToChildPath } from '../../../cli/orca-cli-child-path'
+import { getManagedWslCliDir, getWslCliCommandName } from '../../../cli/wsl-managed-cli'
 import { stripLegacyTerminalShimEnv } from '../../../pty/legacy-terminal-shim-dir'
 import { mergePersistedWindowsPath } from '../../../pty/windows-environment-path'
 import { resolveCodexShellLaunchPreflightCommand } from '../../../pty/codex-shell-launch-preflight'
@@ -44,15 +49,31 @@ export function buildPtyHostEnv(
   mergePersistedWindowsPath(baseEnv)
   Object.assign(baseEnv, buildConfiguredProxyEnv(opts.networkProxySettings))
 
-  // Why: local path's baseEnv includes process.env but the daemon path doesn't (fork inheritance, not IPC); check both sources so guards stay in lock-step across spawn paths.
-  const preexistingOpenCodeConfigDir = resolveOpenCodeSourceConfigDir(baseEnv)
+  // Why: pre-1.4.209 panes exported Orca's retired shared hooks dir; inheriting it hides the user's global OpenCode config.
+  const isLegacyOpenCodeHooksDir = (dir: string | undefined): boolean =>
+    isOpenCodeLegacySharedConfigDir(dir, opts.userDataPath)
+  const inheritedOpenCodeEnv: NodeJS.ProcessEnv = {}
+  for (const key of OPENCODE_CONFIG_DIR_ENV_KEYS) {
+    if (isLegacyOpenCodeHooksDir(baseEnv[key])) {
+      delete baseEnv[key]
+    }
+    if (!isLegacyOpenCodeHooksDir(process.env[key])) {
+      inheritedOpenCodeEnv[key] = process.env[key]
+    }
+  }
+  // A daemon or sibling shell can retain a retired path that main no longer sees.
+  openCodeHookService.refreshLegacySharedPlugin()
+  openCode2HookService.refreshLegacySharedPlugin()
+  const resolvedOpenCodeConfigDir = resolveOpenCodeSourceConfigDir(baseEnv, inheritedOpenCodeEnv)
+  const preexistingOpenCodeConfigDir = isLegacyOpenCodeHooksDir(resolvedOpenCodeConfigDir)
+    ? undefined
+    : resolvedOpenCodeConfigDir
   const launchCommandHint = resolveSetupAgentSequenceLaunchCommand(baseEnv, opts.launchCommand)
-  // Typed launches do not carry the picker identity; infer the beta binary so
-  // it receives the OpenCode 2 hook endpoint and isolated plugin overlay.
-  const openCodeAgent =
-    opts.launchAgent === 'opencode2' || isOpenCode2LaunchCommand(launchCommandHint)
-      ? 'opencode2'
-      : 'opencode'
+  const openCodeAgent = selectOpenCodeHookAgent(
+    opts.launchAgent,
+    launchCommandHint,
+    (agent) => opts.agentStatusHooksEnabled && isTuiAgentEnabled(agent, opts.disabledTuiAgents)
+  )
   const explicitPiAgentKind = isPiCompatibleAgentType(opts.launchAgent)
     ? opts.launchAgent
     : opts.launchAgent === undefined
@@ -87,12 +108,26 @@ export function buildPtyHostEnv(
       ? resolvePiAgentSourceDir(baseEnv, 'prime-agent')
       : resolveScopedPiAgentSourceDir(baseEnv, 'prime-agent')
 
-  if (opts.agentStatusHooksEnabled) {
+  restoreOrStripOverlayEnv(
+    baseEnv,
+    {
+      primary: 'OPENCODE_CONFIG_DIR',
+      overlay: 'ORCA_OPENCODE_CONFIG_DIR',
+      source: 'ORCA_OPENCODE_SOURCE_CONFIG_DIR',
+      preserveExplicitPrimary: true
+    },
+    inheritedOpenCodeEnv
+  )
+  delete baseEnv.ORCA_OPENCODE_AGENT
+  if (openCodeAgent) {
     // Why: OPENCODE_CONFIG_DIR is a single path, not a colon-list; mirror the user's value into an overlay so their plugins and Orca's status plugin coexist. See docs/opencode-config-dir-collision.md.
     const openCodeStatusService =
       openCodeAgent === 'opencode2' ? openCode2HookService : openCodeHookService
     baseEnv.ORCA_OPENCODE_AGENT = openCodeAgent
-    Object.assign(baseEnv, openCodeStatusService.buildPtyEnv(id, preexistingOpenCodeConfigDir))
+    // WSL owns its config writes; only the guest overlay may enter a WSL pane.
+    if (!opts.isWsl) {
+      Object.assign(baseEnv, openCodeStatusService.buildPtyEnv(id, preexistingOpenCodeConfigDir))
+    }
     if (baseEnv.OPENCODE_CONFIG_DIR) {
       // Why: ~/.zshrc can re-export the user's default after spawn; shell-ready wrappers restore this PTY-scoped value.
       baseEnv.ORCA_OPENCODE_CONFIG_DIR = baseEnv.OPENCODE_CONFIG_DIR
@@ -103,6 +138,8 @@ export function buildPtyHostEnv(
         delete baseEnv.ORCA_OPENCODE_SOURCE_CONFIG_DIR
       }
     }
+  }
+  if (opts.agentStatusHooksEnabled) {
     if (isMimoLaunchCommand(launchCommandHint)) {
       const preexistingMimocodeHome = resolveMimocodeSourceHome(baseEnv)
       Object.assign(baseEnv, mimoCodeHookService.buildPtyEnv(id, preexistingMimocodeHome))
@@ -116,11 +153,6 @@ export function buildPtyHostEnv(
       }
     }
   } else {
-    restoreOrStripOverlayEnv(baseEnv, {
-      primary: 'OPENCODE_CONFIG_DIR',
-      overlay: 'ORCA_OPENCODE_CONFIG_DIR',
-      source: 'ORCA_OPENCODE_SOURCE_CONFIG_DIR'
-    })
     restoreOrStripOverlayEnv(baseEnv, {
       primary: 'MIMOCODE_HOME',
       overlay: 'ORCA_MIMOCODE_HOME',
@@ -147,13 +179,15 @@ export function buildPtyHostEnv(
         baseEnv.ORCA_AGENT_HOOK_ENDPOINT = guestEndpoint
       }
       // Why: OpenCode loads its status plugin from a guest config overlay, so point OPENCODE_CONFIG_DIR at the guest dir the relay materialized.
-      const opencodeOverlayDir = wslHookRelayManager.getOpenCodeOverlayDir(distro, openCodeAgent)
+      const opencodeOverlayDir = openCodeAgent
+        ? wslHookRelayManager.getOpenCodeOverlayDir(distro, openCodeAgent)
+        : null
       if (opencodeOverlayDir) {
         baseEnv.OPENCODE_CONFIG_DIR = opencodeOverlayDir
         baseEnv.ORCA_OPENCODE_CONFIG_DIR = opencodeOverlayDir
         delete baseEnv.ORCA_OPENCODE_SOURCE_CONFIG_DIR
       } else {
-        // Why: relay not connected yet (or older guest bundle) — never cross the Windows overlay path into WSL; drop it so in-guest OpenCode uses its own config (pre-fix behavior, no status but no regression).
+        // Only guest overlays belong in WSL; otherwise let OpenCode use its guest config.
         delete baseEnv.OPENCODE_CONFIG_DIR
         delete baseEnv.ORCA_OPENCODE_CONFIG_DIR
         delete baseEnv.ORCA_OPENCODE_SOURCE_CONFIG_DIR
@@ -252,7 +286,8 @@ export function buildPtyHostEnv(
     // Why: user startup files may re-export CODEX_HOME; shell-ready wrappers restore this runtime home before Codex launches.
     baseEnv.ORCA_CODEX_HOME = opts.selectedCodexHomePath
     const preflightCommand = resolveCodexShellLaunchPreflightCommand({
-      hooksEnabled: opts.codexStatusHooksEnabled ?? opts.agentStatusHooksEnabled,
+      hooksEnabled:
+        opts.agentStatusHooksEnabled && isTuiAgentEnabled('codex', opts.disabledTuiAgents),
       isPackaged: opts.isPackaged,
       isWsl: opts.isWsl,
       managedHomePath: opts.selectedCodexHomePath,
@@ -271,11 +306,17 @@ export function buildPtyHostEnv(
     delete baseEnv.ORCA_CODEX_LAUNCH_PREFLIGHT
   }
 
+  // Why: an inherited copy (e.g. Orca launched from a WSL pane) names another launch's CLI.
+  delete baseEnv.ORCA_WSL_CLI_DIR
   // Why: WSL shells need the managed userData root for shell-ready wrappers; dev-mode terminals need the same export so `orca` targets the live dev instance.
   if (opts.isWsl) {
     baseEnv.ORCA_USER_DATA_PATH = opts.userDataPath
     // Why: managed WSL registration uses `orca-ide`; exposing that literal scopes agent guidance to WSL without a bare-orca shim.
-    baseEnv.ORCA_CLI_COMMAND = opts.isPackaged ? 'orca-ide' : 'orca-dev'
+    baseEnv.ORCA_CLI_COMMAND = getWslCliCommandName(opts.isPackaged)
+    const managedCliDir = getManagedWslCliDir(opts)
+    if (managedCliDir) {
+      baseEnv.ORCA_WSL_CLI_DIR = managedCliDir
+    }
   } else {
     if (!opts.isPackaged) {
       baseEnv.ORCA_USER_DATA_PATH ??= opts.userDataPath
@@ -293,7 +334,7 @@ export function buildPtyHostEnv(
     baseEnv.BROWSER === undefined &&
     process.env.BROWSER === undefined
   ) {
-    const cliCommand = opts.isWsl ? (opts.isPackaged ? 'orca-ide' : 'orca-dev') : 'orca'
+    const cliCommand = opts.isWsl ? getWslCliCommandName(opts.isPackaged) : 'orca'
     baseEnv.BROWSER = `${cliCommand} open-url --url %s`
   }
 
diff --git a/src/main/ipc/pty/host-env/codex-home.ts b/src/main/ipc/pty/host-env/codex-home.ts
index 7abde336181..fbc0db2a04d 100644
--- a/src/main/ipc/pty/host-env/codex-home.ts
+++ b/src/main/ipc/pty/host-env/codex-home.ts
@@ -1,7 +1,5 @@
 import { normalizeRuntimePathForComparison } from '../../../../shared/cross-platform-path'
 import type { GlobalSettings } from '../../../../shared/global-settings-types'
-import { isTuiAgentEnabled } from '../../../../shared/tui-agent-selection'
-import { isAgentStatusHooksEnabled } from '../../../agent-hooks/managed-agent-hook-controls'
 import {
   isCodexHomeAuthReadyForLaunch,
   waitForManagedCodexAuthReady
@@ -31,12 +29,6 @@ export function shouldSkipCodexHomeEnvForWindowsShell(
   return isWslShellName(shellPath) || (typeof cwd === 'string' && parseWslPath(cwd) !== null)
 }
 
-export function isCodexStatusHooksEnabled(settings: GlobalSettings | undefined): boolean {
-  return (
-    isAgentStatusHooksEnabled(settings) && isTuiAgentEnabled('codex', settings?.disabledTuiAgents)
-  )
-}
-
 // Why: with the real-home flag ON, a host system-default launch resolves to a
 // null managed home. Signal the env builder to strip a nested-Orca-inherited
 // override instead of injecting one, so Codex runs on the user's own ~/.codex.
diff --git a/src/main/ipc/pty/host-env/codex-resume.ts b/src/main/ipc/pty/host-env/codex-resume.ts
index 62e199e09c3..a7118cb08b8 100644
--- a/src/main/ipc/pty/host-env/codex-resume.ts
+++ b/src/main/ipc/pty/host-env/codex-resume.ts
@@ -30,7 +30,6 @@ export type PrepareCodexResumeHomeArgs = {
   providerSession?: AgentProviderSessionMetadata
   target: CodexAccountSelectionTarget
   launchEnv?: NodeJS.ProcessEnv
-  workspacePath?: string
 }
 
 export function prepareCodexResumeHome(
@@ -49,8 +48,7 @@ export function prepareCodexResumeHome(
     preparation: prepareCodexSessionResume({
       providerSession,
       target: args.target,
-      launchEnv: args.launchEnv,
-      workspacePath: args.workspacePath
+      launchEnv: args.launchEnv
     })
   }
 }
diff --git a/src/main/ipc/pty/host-env/fresh-spawn-routing.ts b/src/main/ipc/pty/host-env/fresh-spawn-routing.ts
index 64034d544c2..e03c29e79bc 100644
--- a/src/main/ipc/pty/host-env/fresh-spawn-routing.ts
+++ b/src/main/ipc/pty/host-env/fresh-spawn-routing.ts
@@ -49,8 +49,14 @@ export function beginPtySpawnForWorktree(
     }
   } catch (error) {
     // Why: worktree ID and cwd can be different roots; release earlier admissions before rejecting.
-    finishes.toReversed().forEach((finish) => finish())
+    for (let index = finishes.length - 1; index >= 0; index -= 1) {
+      finishes[index]!()
+    }
     throw error
   }
-  return () => finishes.toReversed().forEach((finish) => finish())
+  return () => {
+    for (let index = finishes.length - 1; index >= 0; index -= 1) {
+      finishes[index]!()
+    }
+  }
 }
diff --git a/src/main/ipc/pty/host-env/opencode-hook-installation.test.ts b/src/main/ipc/pty/host-env/opencode-hook-installation.test.ts
new file mode 100644
index 00000000000..8a9114eb942
--- /dev/null
+++ b/src/main/ipc/pty/host-env/opencode-hook-installation.test.ts
@@ -0,0 +1,495 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  createDaemonPtyEnvironment,
+  rescrubDaemonPtyEnvironment
+} from '../../../daemon/pty-subprocess/spawn-environment'
+import { getInheritedAgentHookEnvKeysToDelete } from './pi-agent'
+import { buildPtyHostEnv } from './assembly'
+import type { BuildPtyHostEnvOptions } from './types'
+
+const fixture = vi.hoisted(() => ({ userData: '', guestOverlay: '' }))
+vi.mock('../../../../shared/app-environment', () => ({
+  getAppEnvironment: () => ({ getPath: () => fixture.userData })
+}))
+vi.mock('../../../agent-hooks/server', () => ({
+  agentHookServer: { buildPtyEnv: () => ({ ORCA_AGENT_HOOK_PORT: '12345' }) }
+}))
+vi.mock('../../../agent-hooks/wsl-hook-relay-manager', () => ({
+  wslHookRelayManager: {
+    ensureForDistro: vi.fn(),
+    getGuestEndpointFilePath: () => '/guest/endpoint.json',
+    getOpenCodeOverlayDir: () => fixture.guestOverlay,
+    getGuestAgentPath: () => null
+  }
+}))
+vi.mock('../../../pi/titlebar-extension-service', () => ({
+  piTitlebarExtensionService: { buildPtyEnv: () => ({}), buildFreshOmpEnv: () => ({}) }
+}))
+vi.mock('../../../cli/orca-cli-child-path', () => ({ prependOrcaCliDirToChildPath: () => {} }))
+vi.mock('../../../cli/wsl-managed-cli', () => ({
+  getManagedWslCliDir: () => undefined,
+  getWslCliCommandName: () => 'orca-ide'
+}))
+
+let root: string
+let config: string
+let custom: string
+let options: BuildPtyHostEnvOptions
+const plugin = (dir: string, agent: string) => join(dir, 'plugins', `orca-${agent}-status.js`)
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'orca-opencode-disabled-'))
+  const home = join(root, 'home')
+  const xdg = join(root, 'xdg')
+  mkdirSync(home)
+  fixture.userData = join(root, 'user-data')
+  fixture.guestOverlay = join(root, 'guest-overlay')
+  config = join(xdg, 'opencode')
+  custom = join(root, 'custom')
+  mkdirSync(join(custom, 'plugins'), { recursive: true })
+  writeFileSync(join(custom, 'opencode.json'), '{"model":"fixture"}')
+  writeFileSync(join(custom, 'plugins', 'user.js'), '// user plugin')
+  vi.stubEnv('HOME', home)
+  vi.stubEnv('USERPROFILE', home)
+  vi.stubEnv('XDG_CONFIG_HOME', xdg)
+  for (const key of [
+    'OPENCODE_CONFIG_DIR',
+    'ORCA_OPENCODE_CONFIG_DIR',
+    'ORCA_OPENCODE_SOURCE_CONFIG_DIR',
+    'ORCA_OPENCODE_AGENT',
+    'ZDOTDIR'
+  ]) {
+    vi.stubEnv(key, undefined)
+  }
+  options = {
+    isPackaged: true,
+    userDataPath: fixture.userData,
+    selectedCodexHomePath: null,
+    agentStatusHooksEnabled: true
+  }
+})
+afterEach(() => {
+  vi.unstubAllEnvs()
+  rmSync(root, { recursive: true, force: true })
+})
+
+describe('OpenCode installation uses the current enabled agents', () => {
+  const combinations = [
+    { disabled: [], fallback: 'opencode' },
+    { disabled: ['opencode'], fallback: 'opencode2' },
+    { disabled: ['opencode2'], fallback: 'opencode' },
+    { disabled: ['opencode', 'opencode2'], fallback: undefined }
+  ]
+  for (const { disabled, fallback } of combinations) {
+    it.each(['default', 'custom'])(`bare %s config with disabled ${disabled.join(',')}`, (kind) => {
+      const env = buildPtyHostEnv(
+        'pane',
+        kind === 'custom' ? { OPENCODE_CONFIG_DIR: custom } : {},
+        {
+          ...options,
+          disabledTuiAgents: disabled
+        }
+      )
+      expect(env.ORCA_OPENCODE_AGENT).toBe(fallback)
+      const selected = env.OPENCODE_CONFIG_DIR ?? config
+      for (const agent of ['opencode', 'opencode2']) {
+        expect(existsSync(plugin(selected, agent))).toBe(agent === fallback)
+      }
+      if (kind === 'custom') {
+        expect(readFileSync(join(selected, 'plugins', 'user.js'), 'utf8')).toBe('// user plugin')
+        expect(readFileSync(join(selected, 'opencode.json'), 'utf8')).toBe('{"model":"fixture"}')
+        expect(existsSync(plugin(custom, 'opencode'))).toBe(false)
+      }
+    })
+    it.each(['opencode', 'opencode2'] as const)(
+      `explicit %s with disabled ${disabled.join(',')}`,
+      (agent) => {
+        for (const selection of [
+          { launchCommand: `${agent} --session fixture` },
+          { launchAgent: agent }
+        ]) {
+          const env = buildPtyHostEnv(
+            'pane',
+            {},
+            { ...options, ...selection, disabledTuiAgents: disabled }
+          )
+          const selected = disabled.includes(agent) ? undefined : agent
+          expect(env.ORCA_OPENCODE_AGENT).toBe(selected)
+          expect(existsSync(plugin(config, agent))).toBe(selected === agent)
+          expect(existsSync(plugin(config, agent === 'opencode' ? 'opencode2' : 'opencode'))).toBe(
+            false
+          )
+        }
+      }
+    )
+  }
+
+  it('reads enable/disable changes on the same services without deleting installed files', () => {
+    buildPtyHostEnv('first', {}, options)
+    const installed = plugin(config, 'opencode')
+    writeFileSync(installed, '// already installed sentinel')
+    const env = buildPtyHostEnv('second', {}, { ...options, disabledTuiAgents: ['opencode'] })
+    expect(env.ORCA_OPENCODE_AGENT).toBe('opencode2')
+    expect(readFileSync(installed, 'utf8')).toBe('// already installed sentinel')
+    buildPtyHostEnv('third', {}, options)
+    expect(readFileSync(installed, 'utf8')).toContain('/hook/opencode')
+  })
+
+  it.each([true, false])(
+    'restores inherited source and clears markers with hooks %s',
+    (enabled) => {
+      const first = buildPtyHostEnv('first', { OPENCODE_CONFIG_DIR: custom }, options)
+      const original = readFileSync(plugin(first.OPENCODE_CONFIG_DIR, 'opencode'), 'utf8')
+      const env = buildPtyHostEnv(
+        'second',
+        { ...first },
+        {
+          ...options,
+          agentStatusHooksEnabled: enabled,
+          disabledTuiAgents: ['opencode', 'opencode2']
+        }
+      )
+      expect(env.OPENCODE_CONFIG_DIR).toBe(custom)
+      expect(env.ORCA_OPENCODE_CONFIG_DIR).toBeUndefined()
+      expect(env.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBeUndefined()
+      expect(env.ORCA_OPENCODE_AGENT).toBeUndefined()
+      expect(readFileSync(plugin(first.OPENCODE_CONFIG_DIR, 'opencode'), 'utf8')).toBe(original)
+      expect(env.ORCA_AGENT_HOOK_PORT).toBe(enabled ? '12345' : undefined)
+    }
+  )
+
+  it('drops an inherited overlay without a source and preserves an unrelated explicit config', () => {
+    for (const primary of [fixture.guestOverlay, custom]) {
+      const env = buildPtyHostEnv(
+        'pane',
+        {
+          OPENCODE_CONFIG_DIR: primary,
+          ORCA_OPENCODE_CONFIG_DIR: fixture.guestOverlay,
+          ORCA_OPENCODE_AGENT: 'opencode'
+        },
+        { ...options, disabledTuiAgents: ['opencode', 'opencode2'] }
+      )
+      expect(env.OPENCODE_CONFIG_DIR).toBe(primary === custom ? custom : undefined)
+      expect(env.ORCA_OPENCODE_AGENT).toBeUndefined()
+    }
+  })
+
+  it('does not write a native plugin for WSL or inject a disabled guest overlay', () => {
+    const enabled = buildPtyHostEnv(
+      'wsl-enabled',
+      {},
+      { ...options, isWsl: true, launchAgent: 'opencode2' }
+    )
+    expect(enabled.OPENCODE_CONFIG_DIR).toBe(fixture.guestOverlay)
+    expect(existsSync(config)).toBe(false)
+    const disabled = buildPtyHostEnv(
+      'wsl-disabled',
+      {},
+      {
+        ...options,
+        isWsl: true,
+        disabledTuiAgents: ['opencode', 'opencode2']
+      }
+    )
+    expect(disabled.OPENCODE_CONFIG_DIR).toBeUndefined()
+    expect(disabled.ORCA_AGENT_HOOK_ENDPOINT).toBe('/guest/endpoint.json')
+    expect(existsSync(config)).toBe(false)
+  })
+})
+
+it.each(['source', 'no-source', 'user-config'])(
+  'carries sparse host cleanup into daemon %s env',
+  (kind) => {
+    const prepared = buildPtyHostEnv(
+      'daemon-pane',
+      {},
+      {
+        ...options,
+        disabledTuiAgents: ['opencode', 'opencode2']
+      }
+    )
+    vi.stubEnv('OPENCODE_CONFIG_DIR', kind === 'user-config' ? custom : fixture.guestOverlay)
+    vi.stubEnv('ORCA_OPENCODE_CONFIG_DIR', fixture.guestOverlay)
+    vi.stubEnv('ORCA_OPENCODE_AGENT', 'opencode')
+    if (kind === 'source') {
+      vi.stubEnv('ORCA_OPENCODE_SOURCE_CONFIG_DIR', custom)
+    }
+    const result = createDaemonPtyEnvironment({
+      sessionId: 'fixture',
+      cols: 80,
+      rows: 24,
+      env: prepared,
+      envToDelete: getInheritedAgentHookEnvKeysToDelete(prepared)
+    })
+    expect(result.OPENCODE_CONFIG_DIR).toBe(kind === 'no-source' ? undefined : custom)
+    expect(result.ORCA_OPENCODE_AGENT).toBeUndefined()
+    expect(result.ORCA_OPENCODE_CONFIG_DIR).toBeUndefined()
+    expect(result.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBeUndefined()
+  }
+)
+
+it.each([
+  { primary: 'overlay', source: true, explicit: true, expected: 'current' },
+  { primary: 'current', source: true, explicit: false, expected: 'current' },
+  { primary: 'overlay', source: true, explicit: false, expected: 'previous' },
+  { primary: 'absent', source: true, explicit: false, expected: 'previous' },
+  { primary: 'overlay', source: false, explicit: false, expected: undefined },
+  { primary: 'overlay', source: false, explicit: true, expected: 'current' },
+  { primary: 'absent', source: false, explicit: false, expected: undefined }
+])('daemon config precedence: $primary, source $source, explicit $explicit', (scenario) => {
+  const prepared = buildPtyHostEnv(
+    'daemon-pane',
+    scenario.explicit ? { OPENCODE_CONFIG_DIR: custom } : {},
+    { ...options, disabledTuiAgents: ['opencode', 'opencode2'] }
+  )
+  const previous = join(root, 'previous')
+  mkdirSync(previous)
+  writeFileSync(join(previous, 'opencode.json'), '{"model":"previous"}')
+  vi.stubEnv(
+    'OPENCODE_CONFIG_DIR',
+    scenario.primary === 'absent'
+      ? undefined
+      : scenario.primary === 'current'
+        ? custom
+        : fixture.guestOverlay
+  )
+  vi.stubEnv('ORCA_OPENCODE_CONFIG_DIR', fixture.guestOverlay)
+  vi.stubEnv('ORCA_OPENCODE_SOURCE_CONFIG_DIR', scenario.source ? previous : undefined)
+  vi.stubEnv('ORCA_OPENCODE_AGENT', 'opencode')
+  const request = {
+    sessionId: 'fixture',
+    cols: 80,
+    rows: 24,
+    env: prepared,
+    envToDelete: getInheritedAgentHookEnvKeysToDelete(prepared)
+  }
+  const result = createDaemonPtyEnvironment(request)
+  rescrubDaemonPtyEnvironment(result, request)
+  if (scenario.expected) {
+    expect(readFileSync(join(result.OPENCODE_CONFIG_DIR, 'opencode.json'), 'utf8')).toBe(
+      scenario.expected === 'current' ? '{"model":"fixture"}' : '{"model":"previous"}'
+    )
+  } else {
+    expect(result.OPENCODE_CONFIG_DIR).toBeUndefined()
+  }
+  expect(result.ORCA_OPENCODE_CONFIG_DIR).toBeUndefined()
+  expect(result.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBeUndefined()
+  expect(result.ORCA_OPENCODE_AGENT).toBeUndefined()
+})
+
+it.each(['opencode', 'opencode2'] as const)(
+  'keeps the freshly selected %s overlay through a stale daemon',
+  (agent) => {
+    const prepared = buildPtyHostEnv(
+      'pane',
+      { OPENCODE_CONFIG_DIR: custom },
+      {
+        ...options,
+        launchAgent: agent
+      }
+    )
+    vi.stubEnv('OPENCODE_CONFIG_DIR', fixture.guestOverlay)
+    vi.stubEnv('ORCA_OPENCODE_CONFIG_DIR', fixture.guestOverlay)
+    vi.stubEnv('ORCA_OPENCODE_SOURCE_CONFIG_DIR', join(root, 'stale-source'))
+    const result = createDaemonPtyEnvironment({
+      sessionId: 'fixture',
+      cols: 80,
+      rows: 24,
+      env: prepared,
+      envToDelete: getInheritedAgentHookEnvKeysToDelete(prepared)
+    })
+    expect(readFileSync(join(result.OPENCODE_CONFIG_DIR, 'opencode.json'), 'utf8')).toBe(
+      '{"model":"fixture"}'
+    )
+    expect(existsSync(plugin(result.OPENCODE_CONFIG_DIR, agent))).toBe(true)
+    expect(result.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBe(custom)
+    expect(result.ORCA_OPENCODE_AGENT).toBe(agent)
+  }
+)
+
+it.each([true, false])(
+  'preserves explicit host config over inherited markers with hooks %s',
+  (enabled) => {
+    const stale = join(root, 'stale-source')
+    mkdirSync(stale)
+    writeFileSync(join(stale, 'opencode.json'), '{"model":"stale"}')
+    for (const inheritedFromProcess of [true, false]) {
+      const markers = {
+        ORCA_OPENCODE_CONFIG_DIR: join(root, 'old-overlay'),
+        ORCA_OPENCODE_SOURCE_CONFIG_DIR: stale
+      }
+      for (const [key, value] of Object.entries(markers)) {
+        vi.stubEnv(key, inheritedFromProcess ? value : undefined)
+      }
+      const env = buildPtyHostEnv(
+        'explicit-config',
+        {
+          ...(inheritedFromProcess ? {} : markers),
+          OPENCODE_CONFIG_DIR: custom
+        },
+        { ...options, agentStatusHooksEnabled: enabled }
+      )
+      expect(readFileSync(join(env.OPENCODE_CONFIG_DIR, 'opencode.json'), 'utf8')).toBe(
+        '{"model":"fixture"}'
+      )
+      expect(env.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBe(enabled ? custom : undefined)
+      expect(existsSync(plugin(stale, 'opencode'))).toBe(false)
+    }
+  }
+)
+
+it.each([true, false])(
+  'drops host config for disabled WSL variants with explicit primary %s',
+  (explicit) => {
+    const overlay = 'C:\\Users\\fixture\\Orca\\opencode-overlays\\old'
+    const source = 'C:\\Users\\fixture\\config\\opencode'
+    vi.stubEnv('ORCA_OPENCODE_CONFIG_DIR', overlay)
+    vi.stubEnv('ORCA_OPENCODE_SOURCE_CONFIG_DIR', source)
+    const env = buildPtyHostEnv(
+      'wsl-disabled-inherited',
+      {
+        OPENCODE_CONFIG_DIR: explicit ? source : overlay,
+        ORCA_OPENCODE_CONFIG_DIR: overlay,
+        ORCA_OPENCODE_SOURCE_CONFIG_DIR: source
+      },
+      { ...options, isWsl: true, disabledTuiAgents: ['opencode', 'opencode2'] }
+    )
+    expect(env.OPENCODE_CONFIG_DIR).toBeUndefined()
+    expect(env.ORCA_OPENCODE_CONFIG_DIR).toBeUndefined()
+    expect(env.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBeUndefined()
+    expect(env.ORCA_OPENCODE_AGENT).toBeUndefined()
+    expect(env.ORCA_AGENT_HOOK_ENDPOINT).toBe('/guest/endpoint.json')
+    expect(existsSync(config)).toBe(false)
+  }
+)
+
+// Why: pre-1.4.209 panes exported Orca's retired <userData>/opencode-hooks/shared dir. OpenCode 2
+// treats OPENCODE_CONFIG_DIR as the only config dir, so inheriting it loaded a stale plugin and hid
+// the user's global config.
+describe.each([
+  { name: 'marked', marked: true },
+  { name: 'unmarked', marked: false }
+])('inherited retired shared hooks dir ($name)', ({ marked }) => {
+  it.each([
+    { agent: 'opencode', hooksDir: 'opencode-hooks' },
+    { agent: 'opencode', hooksDir: 'opencode2-hooks' },
+    { agent: 'opencode2', hooksDir: 'opencode-hooks' },
+    { agent: 'opencode2', hooksDir: 'opencode2-hooks' }
+  ] as const)('drops $hooksDir for $agent panes', ({ agent, hooksDir }) => {
+    const legacy = join(fixture.userData, hooksDir, 'shared')
+    mkdirSync(join(legacy, 'plugins'), { recursive: true })
+    const env = buildPtyHostEnv(
+      'pane',
+      marked
+        ? { OPENCODE_CONFIG_DIR: legacy, ORCA_OPENCODE_CONFIG_DIR: legacy }
+        : { OPENCODE_CONFIG_DIR: legacy },
+      { ...options, launchAgent: agent }
+    )
+    expect(env.OPENCODE_CONFIG_DIR).toBeUndefined()
+    expect(env.ORCA_OPENCODE_CONFIG_DIR).toBeUndefined()
+    expect(env.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBeUndefined()
+    expect(existsSync(plugin(config, agent))).toBe(true)
+    expect(existsSync(join(fixture.userData, `${agent}-config-overlays`))).toBe(false)
+  })
+})
+
+it('keeps a user config dir that merely sits beside the retired hooks dir', () => {
+  const neighbour = join(fixture.userData, 'opencode-hooks', 'mine')
+  mkdirSync(neighbour, { recursive: true })
+  const env = buildPtyHostEnv('pane', { OPENCODE_CONFIG_DIR: neighbour }, options)
+  expect(env.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBe(neighbour)
+  expect(env.OPENCODE_CONFIG_DIR).not.toBeUndefined()
+})
+
+it.each(['explicit', 'inherited'])('refreshes the %s stale plugin with hooks off', (source) => {
+  const legacy = join(fixture.userData, 'opencode-hooks', 'shared')
+  const stalePlugin = join(legacy, 'plugins', 'orca-opencode-status.js')
+  mkdirSync(join(legacy, 'plugins'), { recursive: true })
+  writeFileSync(stalePlugin, 'export default { id: "orca-opencode-status", server() {} }\n')
+  if (source === 'inherited') {
+    vi.stubEnv('OPENCODE_CONFIG_DIR', legacy)
+  }
+  const env = buildPtyHostEnv(
+    'pane',
+    source === 'explicit' ? { OPENCODE_CONFIG_DIR: legacy } : {},
+    { ...options, agentStatusHooksEnabled: false }
+  )
+  expect(env.OPENCODE_CONFIG_DIR).toBeUndefined()
+  expect(readFileSync(stalePlugin, 'utf8')).toContain('setup')
+})
+
+it.each([true, false])('strips daemon-inherited retired paths (known to main: %s)', (known) => {
+  const legacy = join(fixture.userData, 'opencode-hooks', 'shared')
+  if (known) {
+    vi.stubEnv('OPENCODE_CONFIG_DIR', legacy)
+  }
+  const env = buildPtyHostEnv('pane', {}, { ...options, agentStatusHooksEnabled: false })
+  vi.stubEnv('ORCA_USER_DATA_PATH', fixture.userData)
+  vi.stubEnv('OPENCODE_CONFIG_DIR', legacy)
+  const request = { sessionId: 'pane', cols: 80, rows: 24, cwd: root, env }
+  const result = createDaemonPtyEnvironment(request)
+  expect(result.OPENCODE_CONFIG_DIR).toBeUndefined()
+  result.OPENCODE_CONFIG_DIR = legacy
+  rescrubDaemonPtyEnvironment(result, request)
+  expect(result.OPENCODE_CONFIG_DIR).toBeUndefined()
+})
+
+it('preserves explicit user config over a retired daemon-inherited path', () => {
+  vi.stubEnv('ORCA_USER_DATA_PATH', fixture.userData)
+  vi.stubEnv('OPENCODE_CONFIG_DIR', join(fixture.userData, 'opencode-hooks', 'shared'))
+  const env = { OPENCODE_CONFIG_DIR: custom }
+  const result = createDaemonPtyEnvironment({
+    sessionId: 'pane',
+    cols: 80,
+    rows: 24,
+    cwd: root,
+    env
+  })
+  expect(result.OPENCODE_CONFIG_DIR).toBe(custom)
+})
+
+it('does not restore a retired source from process.env with hooks disabled', () => {
+  vi.stubEnv('ORCA_OPENCODE_SOURCE_CONFIG_DIR', join(fixture.userData, 'opencode-hooks', 'shared'))
+  const env = buildPtyHostEnv('pane', {}, { ...options, agentStatusHooksEnabled: false })
+  expect(env.OPENCODE_CONFIG_DIR).toBeUndefined()
+})
+
+it.each([true, false])(
+  'preserves explicit config with a retired parent source (hooks: %s)',
+  (enabled) => {
+    vi.stubEnv(
+      'ORCA_OPENCODE_SOURCE_CONFIG_DIR',
+      join(fixture.userData, 'opencode-hooks', 'shared')
+    )
+    const env = buildPtyHostEnv(
+      'pane',
+      { OPENCODE_CONFIG_DIR: custom },
+      { ...options, agentStatusHooksEnabled: enabled }
+    )
+    if (enabled) {
+      expect(env.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBe(custom)
+      expect(readFileSync(join(env.OPENCODE_CONFIG_DIR, 'opencode.json'), 'utf8')).toBe(
+        '{"model":"fixture"}'
+      )
+    } else {
+      expect(env.OPENCODE_CONFIG_DIR).toBe(custom)
+    }
+  }
+)
+
+it('repairs both legacy variants without main inheriting any retired path or enabling hooks', () => {
+  for (const agent of ['opencode', 'opencode2']) {
+    const path = plugin(join(fixture.userData, `${agent}-hooks`, 'shared'), agent)
+    mkdirSync(join(path, '..'), { recursive: true })
+    writeFileSync(path, '// old plugin')
+  }
+  buildPtyHostEnv('pane', {}, { ...options, agentStatusHooksEnabled: false })
+  for (const agent of ['opencode', 'opencode2']) {
+    expect(
+      readFileSync(plugin(join(fixture.userData, `${agent}-hooks`, 'shared'), agent), 'utf8')
+    ).toContain('setup')
+  }
+})
diff --git a/src/main/ipc/pty/host-env/pi-agent.ts b/src/main/ipc/pty/host-env/pi-agent.ts
index 545d04d063d..caf18e3e1aa 100644
--- a/src/main/ipc/pty/host-env/pi-agent.ts
+++ b/src/main/ipc/pty/host-env/pi-agent.ts
@@ -8,7 +8,11 @@ import {
   type PiAgentKind
 } from '../../../../shared/pi-agent-kind'
 import { readSessionShellStartupEnvVar } from '../../../pty/shell-startup-env'
-import { AGENT_HOOK_RUNTIME_ENV_KEYS, CLAUDE_CHILD_SESSION_STAMP_ENV_KEYS } from './spawn-env-keys'
+import {
+  AGENT_HOOK_RUNTIME_ENV_KEYS,
+  CLAUDE_CHILD_SESSION_STAMP_ENV_KEYS,
+  ORCA_AGENT_SESSION_CALLER_ENV_KEYS
+} from './spawn-env-keys'
 
 export function readEnvWithProcessFallback(
   baseEnv: Record<string, string>,
@@ -130,37 +134,27 @@ export function getInheritedAgentHookEnvKeysToDelete(
 ): string[] {
   const env = spawnEnv ?? {}
   // Why: providers merge process.env after cleanup; delete stale hook keys without dropping fresh coordinates buildPtyHostEnv set.
-  return AGENT_HOOK_RUNTIME_ENV_KEYS.filter((key) => env[key] === undefined)
+  return [
+    ...AGENT_HOOK_RUNTIME_ENV_KEYS,
+    'ORCA_OPENCODE_AGENT',
+    'ORCA_OPENCODE_CONFIG_DIR',
+    'ORCA_OPENCODE_SOURCE_CONFIG_DIR'
+  ].filter((key) => env[key] === undefined)
 }
 
-export function getInheritedClaudeSessionStampEnvKeysToDelete(
+export function getInheritedAgentSessionStampEnvKeysToDelete(
   spawnEnv: Record<string, string> | undefined
 ): string[] {
   const env = spawnEnv ?? {}
-  // Why: strip only values inherited from the pty host; a caller that explicitly
-  // provides a stamp (deliberately spawning a nested Claude child) keeps it.
-  return CLAUDE_CHILD_SESSION_STAMP_ENV_KEYS.filter((key) => env[key] === undefined)
+  // Why: a caller that explicitly provides a Claude stamp (a nested Claude child) keeps it; no
+  // terminal is a structured session, so the session caller keys always go.
+  return [
+    ...CLAUDE_CHILD_SESSION_STAMP_ENV_KEYS.filter((key) => env[key] === undefined),
+    ...ORCA_AGENT_SESSION_CALLER_ENV_KEYS
+  ]
 }
 
-// Why: a nested terminal can inherit prior OpenCode/Pi/OMP overlay env; restore the user's recorded source dir, else strip only Orca-owned values.
-export function restoreOrStripOverlayEnv(
-  baseEnv: Record<string, string>,
-  keys: {
-    primary: string
-    overlay: string
-    source: string
-  }
-): void {
-  const sourceValue = baseEnv[keys.source] ?? process.env[keys.source]
-  const overlayValue = baseEnv[keys.overlay] ?? process.env[keys.overlay]
-  if (sourceValue) {
-    baseEnv[keys.primary] = sourceValue
-  } else if (overlayValue && baseEnv[keys.primary] === overlayValue) {
-    delete baseEnv[keys.primary]
-  }
-  delete baseEnv[keys.overlay]
-  delete baseEnv[keys.source]
-}
+export { restoreOrStripOverlayEnv } from '../../../../shared/agent-overlay-env'
 
 export function isMimoLaunchCommand(launchCommand: string | undefined): boolean {
   const binary = getCommandTokenPathBasename(getFirstCommandToken(launchCommand ?? ''))
@@ -183,16 +177,20 @@ export function resolveMimocodeSourceHome(baseEnv: Record<string, string>): stri
 }
 
 export function resolveOpenCodeSourceConfigDir(
-  baseEnv: Record<string, string>
+  baseEnv: Record<string, string>,
+  inheritedEnv: NodeJS.ProcessEnv = process.env
 ): string | undefined {
+  const configDir = baseEnv.OPENCODE_CONFIG_DIR ?? inheritedEnv.OPENCODE_CONFIG_DIR
+  const orcaConfigDir = baseEnv.ORCA_OPENCODE_CONFIG_DIR ?? inheritedEnv.ORCA_OPENCODE_CONFIG_DIR
+  if (configDir && orcaConfigDir && configDir !== orcaConfigDir) {
+    return configDir
+  }
   const sourceDir =
-    baseEnv.ORCA_OPENCODE_SOURCE_CONFIG_DIR ?? process.env.ORCA_OPENCODE_SOURCE_CONFIG_DIR
+    baseEnv.ORCA_OPENCODE_SOURCE_CONFIG_DIR ?? inheritedEnv.ORCA_OPENCODE_SOURCE_CONFIG_DIR
   if (sourceDir) {
     return sourceDir
   }
 
-  const configDir = baseEnv.OPENCODE_CONFIG_DIR ?? process.env.OPENCODE_CONFIG_DIR
-  const orcaConfigDir = baseEnv.ORCA_OPENCODE_CONFIG_DIR ?? process.env.ORCA_OPENCODE_CONFIG_DIR
   // Why: with no recorded source dir, an inherited OPENCODE_CONFIG_DIR is Orca-owned, not user config; treating it as user config makes child Orcas mirror the hook dir.
   if (configDir && orcaConfigDir && configDir === orcaConfigDir) {
     return undefined
diff --git a/src/main/ipc/pty/host-env/spawn-env-keys.ts b/src/main/ipc/pty/host-env/spawn-env-keys.ts
index cabbde7b0ec..ed070c7d043 100644
--- a/src/main/ipc/pty/host-env/spawn-env-keys.ts
+++ b/src/main/ipc/pty/host-env/spawn-env-keys.ts
@@ -1,3 +1,6 @@
+import { ORCA_AGENT_SESSION_ID_ENV } from '../../../../shared/agent-session-caller-env'
+import { ORCA_STRUCTURED_SESSION_ENV } from '../../../../shared/structured-session-marker'
+
 export const AGENT_HOOK_RUNTIME_ENV_KEYS = [
   'ORCA_AGENT_HOOK_PORT',
   'ORCA_AGENT_HOOK_TOKEN',
@@ -15,3 +18,9 @@ export const CLAUDE_CHILD_SESSION_STAMP_ENV_KEYS = [
   'CLAUDE_CODE_SESSION_ID',
   'CLAUDE_CODE_BRIDGE_SESSION_ID'
 ] as const
+
+// Why: Orca writes these only into a structured session's own spawn, so an inherited value means a pty host launched from inside one — every pane would claim that session as its orchestration caller.
+export const ORCA_AGENT_SESSION_CALLER_ENV_KEYS = [
+  ORCA_AGENT_SESSION_ID_ENV,
+  ORCA_STRUCTURED_SESSION_ENV
+] as const
diff --git a/src/main/ipc/pty/host-env/types.ts b/src/main/ipc/pty/host-env/types.ts
index 37ef0614a50..20981d0cce4 100644
--- a/src/main/ipc/pty/host-env/types.ts
+++ b/src/main/ipc/pty/host-env/types.ts
@@ -29,7 +29,6 @@ export type BuildPtyHostEnvOptions = {
   agentStatusHooksEnabled: boolean
   /** Per-agent opt-out; disabled agents must not receive managed extensions. */
   disabledTuiAgents?: Iterable<unknown> | null
-  codexStatusHooksEnabled?: boolean
   networkProxySettings?: NetworkProxySettings
   /** Headless paired runtimes hand browser launches to the client-hosted Orca browser. */
   routeBrowserOpensToClient?: boolean
@@ -38,8 +37,6 @@ export type BuildPtyHostEnvOptions = {
 }
 
 export type CodexHomeLaunchContext = {
-  workspacePath?: string
-  launchAgent?: TuiAgent
   unavailableManagedHomePath?: string
 }
 
@@ -56,7 +53,6 @@ export type PrepareCodexSessionResume = (args: {
   providerSession: AgentProviderSessionMetadata
   target: CodexAccountSelectionTarget
   launchEnv?: NodeJS.ProcessEnv
-  workspacePath?: string
 }) => Promise<CodexSessionResumePreparation | null>
 
 export type CodexHomePtySpawnedLifecycleArgs = {
diff --git a/src/main/ipc/pty/ipc/renderer-kill.ts b/src/main/ipc/pty/ipc/renderer-kill.ts
index 8f73e72aa59..10a0ffa476e 100644
--- a/src/main/ipc/pty/ipc/renderer-kill.ts
+++ b/src/main/ipc/pty/ipc/renderer-kill.ts
@@ -1,10 +1,11 @@
 import { getPtyIpc } from '../../pty-host-bindings'
 import type { Store } from '../../../persistence'
 import type { OrcaRuntimeService } from '../../../runtime/orca-runtime'
+import type { TerminalIntentionalStopKind } from '../../../runtime/terminal-intentional-stops'
 import type { IPtyProvider } from '../../../providers/types'
 import { parseAppSshPtyId } from '../../../providers/ssh-pty-id'
 import { SSH_PROVIDER_UNREGISTERED_REASON } from '../../../../shared/pty-liveness-verdict'
-import { ptyOwnership } from '../provider/ownership-state'
+import { ptyIncarnationById, ptyOwnership } from '../provider/ownership-state'
 import { getProviderForPty, sshProviders, tryGetProviderForPty } from '../provider/registry'
 import { finishPtyShutdown, isPtyAlreadyGoneError } from '../provider/liveness'
 import { recordUndeliveredSshPtyKill } from '../runtime/undelivered-ssh-kill'
@@ -31,27 +32,49 @@ export function installPtyKillIpcHandler(deps: PtyKillIpcDeps): void {
   )
 }
 
-/** Stops a pane's PTY for the spawn replacing it. `markReplaced` labels the exit so the renderer
- *  reads it as a handoff, not the pane dying; a failed stop removes the label with nothing sent. */
-export async function stopReplacedPanePty(
-  deps: PtyKillIpcDeps,
-  id: string,
-  markReplaced: (id: string) => (stopped: boolean) => void
-): Promise<void> {
-  const settle = markReplaced(id)
-  try {
-    await stopRendererOwnedPty(deps, { id })
-  } catch (err) {
-    settle(false)
-    throw err
-  }
-  settle(true)
+/** Stops a pane's PTY for the spawn replacing it. The stop register labels the exit so the
+ *  renderer reads it as a handoff, not the pane dying; a failed stop leaves no label. */
+export async function stopReplacedPanePty(deps: PtyKillIpcDeps, id: string): Promise<void> {
+  await stopRendererOwnedPtyAs(deps, { id }, 'replaced')
 }
 
 /** Stops a renderer-owned PTY and settles only once its shutdown has been observed or synthesized. */
 export async function stopRendererOwnedPty(
   deps: PtyKillIpcDeps,
   args: { id: string; keepHistory?: boolean }
+): Promise<void> {
+  // Why: only hibernation passes keepHistory, and its exit must keep the pane's wake binding.
+  await stopRendererOwnedPtyAs(deps, args, args?.keepHistory === true ? 'reversible' : null)
+}
+
+async function stopRendererOwnedPtyAs(
+  deps: PtyKillIpcDeps,
+  args: { id: string; keepHistory?: boolean },
+  intentionalStop: TerminalIntentionalStopKind | null
+): Promise<void> {
+  if (typeof args?.id !== 'string' || !args.id || args.id.startsWith('remote:')) {
+    // Why: runtime terminal handles belong to terminal.close; unowned PTY routing could target the local provider.
+    throw new Error('Invalid PTY provider id')
+  }
+  const settleStop = intentionalStop
+    ? deps.runtime?.intentionalPtyStops?.mark(
+        args.id,
+        intentionalStop,
+        ptyIncarnationById.get(args.id) ?? null
+      )
+    : undefined
+  let stopped = false
+  try {
+    await stopRendererOwnedPtyProcess(deps, args)
+    stopped = true
+  } finally {
+    settleStop?.(stopped)
+  }
+}
+
+async function stopRendererOwnedPtyProcess(
+  deps: PtyKillIpcDeps,
+  args: { id: string; keepHistory?: boolean }
 ): Promise<void> {
   const {
     store,
@@ -61,10 +84,6 @@ export async function stopRendererOwnedPty(
     rememberSyntheticKillExit,
     sendPtyExitToRenderer
   } = deps
-  if (typeof args?.id !== 'string' || !args.id || args.id.startsWith('remote:')) {
-    // Why: runtime terminal handles belong to terminal.close; unowned PTY routing could target the local provider.
-    throw new Error('Invalid PTY provider id')
-  }
   runtime?.markPtyStopRequested?.(args.id)
   const ownedConnectionId = ptyOwnership.get(args.id)
   const parsedSshId = ownedConnectionId === undefined ? parseAppSshPtyId(args.id) : null
diff --git a/src/main/ipc/pty/ipc/resize-visibility.ts b/src/main/ipc/pty/ipc/resize-visibility.ts
index d3326a2df6e..62e74738b72 100644
--- a/src/main/ipc/pty/ipc/resize-visibility.ts
+++ b/src/main/ipc/pty/ipc/resize-visibility.ts
@@ -180,7 +180,7 @@ export function installPtyResizeVisibilityIpc(session: PtyIpcSession): void {
   ipcMain.removeAllListeners('pty:rendererDispatcherReady')
   ipcMain.on('pty:rendererDispatcherReady', (event) => {
     // Why: the reconcile below destructively clears delivery accounting, so a straggler handshake from a dying window must not reset the new window.
-    if (!isMainWindowPtyIpcEvent(event, mainWindow, mainWindow.webContents)) {
+    if (!isMainWindowPtyIpcEvent(event, mainWindow)) {
       return
     }
     // Why: a handshake while the gate is already open means a page load whose lifecycle reset was missed; clear the dead page's stale accounting so it can't permanently gate survivors.
@@ -322,4 +322,13 @@ export function installPtyResizeVisibilityIpc(session: PtyIpcSession): void {
       .catch(() => {})
     runtime?.clearHeadlessTerminalBuffer(args.id).catch(() => {})
   })
+
+  ipcMain.removeAllListeners('pty:resetInputModes')
+  ipcMain.on('pty:resetInputModes', (_event, args: { id: string }) => {
+    // Why: an older daemon or relay rejects the request; its model keeps the modes until reattach.
+    tryGetProviderForPty(args.id)
+      ?.resetInputModes(args.id)
+      .catch(() => {})
+    runtime?.resetHeadlessTerminalInputModes(args.id).catch(() => {})
+  })
 }
diff --git a/src/main/ipc/pty/ipc/serialize-buffer.ts b/src/main/ipc/pty/ipc/serialize-buffer.ts
index d7b5d35d642..1c314875745 100644
--- a/src/main/ipc/pty/ipc/serialize-buffer.ts
+++ b/src/main/ipc/pty/ipc/serialize-buffer.ts
@@ -39,7 +39,7 @@ export function installPtySerializeBufferIpc(session: PtyIpcSession): void {
     ) => {
       // Why: the snapshot seeds terminal restore state, so only the main window may settle it.
       if (
-        !isMainWindowPtyIpcEvent(event, session.mainWindow, session.mainWindow.webContents) ||
+        !isMainWindowPtyIpcEvent(event, session.mainWindow) ||
         typeof args?.requestId !== 'string'
       ) {
         return
@@ -88,7 +88,8 @@ export function requestSerializedBuffer(
   ptyId: string,
   opts?: { scrollbackRows?: number }
 ): Promise<SerializeResult> {
-  if (session.mainWindow.isDestroyed()) {
+  const { mainWindow } = session
+  if (!mainWindow || mainWindow.isDestroyed()) {
     return Promise.resolve(null)
   }
 
@@ -106,6 +107,6 @@ export function requestSerializedBuffer(
     if (opts) {
       payload.opts = opts
     }
-    session.mainWindow.webContents.send('pty:serializeBuffer:request', payload)
+    mainWindow.webContents.send('pty:serializeBuffer:request', payload)
   })
 }
diff --git a/src/main/ipc/pty/ipc/spawn-commit-persist.ts b/src/main/ipc/pty/ipc/spawn-commit-persist.ts
index 7aaa90bf9b8..46fd8e714bb 100644
--- a/src/main/ipc/pty/ipc/spawn-commit-persist.ts
+++ b/src/main/ipc/pty/ipc/spawn-commit-persist.ts
@@ -1,29 +1,25 @@
 import { toSshExecutionHostId } from '../../../../shared/execution-host'
-import { markNativeWindowsConptyPty } from '../../../runtime/terminal-model-query-authority'
 import { closeStartupQueryAuthorityForPty, getRelayPtyId } from '../provider/registry'
 import { createTerminalSessionStateSaveFailureMessage } from '../../../../shared/terminal-session-state-save-failure'
 import { recordCodexPaneAccountForSpawn } from '../host-env/codex-home'
 import { persistAdmittedStablePaneBinding } from '../pane/stable-owner'
+import { claimSshPaneLease } from '../pane/ssh-pane-lease-claim'
 import {
   pendingByPaneKey,
   pendingPtyIdBySerializerGeneration,
   rendererSerializerReadiness
 } from '../pane/serializer-state'
-import { ptyOwnership, ptyIncarnationById, deletePtyOwnership } from '../provider/ownership-state'
+import { ptyOwnership, ptyIncarnationById } from '../provider/ownership-state'
 import { ptySizes } from '../delivery/visibility-state'
 import { resolveCommittedPtySize, type PtyGrid } from '../delivery/attached-pty-size'
-import { clearProviderPtyState } from '../provider/state-cleanup'
+import { discardUnpersistedPtySpawn } from '../pane/spawn-registration'
 import { spawnCommitBindingOrigin } from '../../../persistence/loading-store/pty-binding-span'
 import type { PtyIpcSpawnState } from './spawn-state'
 
-export async function persistPtyIpcSpawnCommit(ctx: PtyIpcSpawnState): Promise<{
-  rendererPreSignaled: boolean
-  rendererAlreadyRegistered: boolean
-  committedSize: PtyGrid
-}> {
+export async function persistPtyIpcSpawnCommit(ctx: PtyIpcSpawnState): Promise<PtyGrid> {
   const args = ctx.args
   try {
-    ctx.stablePaneBindingPersisted = persistAdmittedStablePaneBinding({
+    ctx.stablePaneBindingPersisted = await persistAdmittedStablePaneBinding({
       store: ctx.deps.store,
       owner: ctx.stablePaneOwner,
       result: ctx.result,
@@ -36,10 +32,62 @@ export async function persistPtyIpcSpawnCommit(ctx: PtyIpcSpawnState): Promise<{
       throw error
     }
     console.error('[pty] failed to persist PTY binding after attach:', error)
-    throw Object.assign(new Error(createTerminalSessionStateSaveFailureMessage()), {
+    throw Object.assign(new Error(createTerminalSessionStateSaveFailureMessage(error)), {
       agentSessionOperationOutcome: 'unknown' as const
     })
   }
+  const committedSize = resolveCommittedPtySize({
+    result: ctx.result,
+    requested: { cols: args.cols, rows: args.rows },
+    cachedBeforeAttach: ctx.sessionSizeBeforeAttach
+  })
+  const relayResultId = getRelayPtyId(args.connectionId, ctx.result.id)
+  // Persist the binding before acknowledging spawn so the renderer debounce cannot orphan history.
+  if (
+    ctx.deps.store &&
+    typeof args.worktreeId === 'string' &&
+    typeof args.tabId === 'string' &&
+    ctx.validatedLeafId !== null &&
+    !ctx.stablePaneBindingPersisted
+  ) {
+    try {
+      const binding = {
+        worktreeId: args.worktreeId,
+        tabId: args.tabId,
+        leafId: ctx.validatedLeafId,
+        ptyId: ctx.result.id,
+        ...(ctx.result.incarnationId ? { incarnationId: ctx.result.incarnationId } : {}),
+        ...(ctx.cwd ? { startupCwd: ctx.cwd } : {}),
+        origin: spawnCommitBindingOrigin(ctx.result)
+      }
+      const persisted = args.connectionId
+        ? await ctx.deps.store.persistPtyBinding(binding, toSshExecutionHostId(args.connectionId))
+        : await ctx.deps.store.persistPtyBinding(binding)
+      if (persisted === false) {
+        throw new Error('terminal_pane_owner_changed')
+      }
+    } catch (err) {
+      console.error('[pty] failed to persist PTY binding after spawn:', err)
+      await discardUnpersistedPtySpawn(ctx.provider, ctx.result, () => {
+        if (args.connectionId && ctx.deps.store) {
+          ctx.deps.store.removeSshRemotePtyLease(args.connectionId, relayResultId)
+        }
+      })
+      if (err instanceof Error && err.message === 'terminal_pane_owner_changed') {
+        throw err
+      }
+      throw Object.assign(new Error(createTerminalSessionStateSaveFailureMessage(err)), {
+        agentSessionOperationOutcome: 'unknown' as const
+      })
+    }
+  }
+  return committedSize
+}
+
+export function publishPtyIpcSpawnCommit(ctx: PtyIpcSpawnState, committedSize: PtyGrid): void {
+  const args = ctx.args
+  // Why here: every IPC spawn that survives its binding save publishes once through this point.
+  ctx.deps.runtime?.noteTerminalSpawnCommit?.(ctx.result)
   ctx.spawnTiming.log(ctx.result.id, {
     daemon: ctx.isDaemonHostSpawn,
     reattach: ctx.result.isReattach ?? false
@@ -59,7 +107,7 @@ export async function persistPtyIpcSpawnCommit(ctx: PtyIpcSpawnState): Promise<{
     ptyIncarnationById.set(ctx.result.id, ctx.result.incarnationId)
   }
   if (ctx.initiallyHidden) {
-    // Why marked synchronously here: provider data events dispatch on later tasks, so this still lands ahead of the first byte's delivery decision (idempotent if already marked pre-spawn).
+    // Refresh the pre-spawn hidden mark only after this incarnation survives its save.
     ctx.deps.transitionSpawnHiddenRendererPtyDeliveryState(ctx.result.id, true)
     if (ctx.preSpawnHiddenMarkId !== null && ctx.preSpawnHiddenMarkId !== ctx.result.id) {
       // Defense: never strand a mark on an id the provider renamed.
@@ -69,88 +117,24 @@ export async function persistPtyIpcSpawnCommit(ctx: PtyIpcSpawnState): Promise<{
     ctx.deps.syncPtyBackgroundedDelivery(ctx.result.id, 'spawn')
     closeStartupQueryAuthorityForPty(ctx.result.id)
   }
-  // Why: record the native-Windows-ConPTY determination before the headless seed so the emulator's DA1 override exists from byte zero.
-  if (ctx.nativeWindowsConptySpawn) {
-    markNativeWindowsConptyPty(ctx.result.id)
-  }
-  const relayResultId = getRelayPtyId(args.connectionId, ctx.result.id)
-  if (ctx.deps.store && args.connectionId) {
-    // Why: remote PTYs live in the SSH relay grace window after Orca detaches; persist IDs immediately so reconnect reattaches instead of spawning a fresh shell.
-    ctx.deps.store.upsertSshRemotePtyLease({
-      targetId: args.connectionId,
-      ptyId: relayResultId,
-      ...(typeof args.worktreeId === 'string' ? { worktreeId: args.worktreeId } : {}),
-      ...(typeof args.tabId === 'string' ? { tabId: args.tabId } : {}),
-      ...(ctx.validatedLeafId ? { leafId: ctx.validatedLeafId } : {}),
-      state: 'attached',
-      lastAttachedAt: Date.now()
-    })
-  }
   if (ctx.preAllocatedHandle && !ctx.stablePaneOwner?.handle) {
     if (ctx.deps.runtime?.registerPreAllocatedHandleForPty) {
       ctx.deps.runtime.registerPreAllocatedHandleForPty(ctx.result.id, ctx.preAllocatedHandle)
       ctx.agentTeamsLeaderHandle = null
     }
   }
-  const committedSize = resolveCommittedPtySize({
-    result: ctx.result,
-    requested: { cols: args.cols, rows: args.rows },
-    cachedBeforeAttach: ctx.sessionSizeBeforeAttach
-  })
   ptySizes.set(ctx.result.id, committedSize)
   if (ctx.effectiveSessionAppId !== undefined && ctx.effectiveSessionAppId !== ctx.result.id) {
     ptySizes.delete(ctx.effectiveSessionAppId)
   }
-  // Why: patch the load-bearing ptyId binding synchronously so a force-quit in the renderer's ~450 ms debounce window can't orphan daemon history or an SSH relay lease (Issue #217).
-  if (
-    ctx.deps.store &&
-    typeof args.worktreeId === 'string' &&
-    typeof args.tabId === 'string' &&
-    ctx.validatedLeafId !== null &&
-    !ctx.stablePaneBindingPersisted
-  ) {
-    try {
-      const binding = {
-        worktreeId: args.worktreeId,
-        tabId: args.tabId,
-        leafId: ctx.validatedLeafId,
-        ptyId: ctx.result.id,
-        ...(ctx.result.incarnationId ? { incarnationId: ctx.result.incarnationId } : {}),
-        ...(ctx.cwd ? { startupCwd: ctx.cwd } : {}),
-        origin: spawnCommitBindingOrigin(ctx.result)
-      }
-      if (args.connectionId) {
-        ctx.deps.store.persistPtyBinding(binding, toSshExecutionHostId(args.connectionId))
-      } else {
-        ctx.deps.store.persistPtyBinding(binding)
-      }
-    } catch (err) {
-      console.error('[pty] failed to persist PTY binding after spawn:', err)
-      if (!ctx.result.isReattach) {
-        try {
-          await ctx.provider.shutdown(ctx.result.id, { immediate: true })
-        } catch (shutdownErr) {
-          console.warn('[pty] failed to clean up PTY after persistence failure:', shutdownErr)
-        }
-        clearProviderPtyState(ctx.result.id)
-        deletePtyOwnership(ctx.result.id)
-      }
-      if (!ctx.result.isReattach && args.connectionId && ctx.deps.store) {
-        ctx.deps.store.removeSshRemotePtyLease(args.connectionId, relayResultId)
-      }
-      throw Object.assign(new Error(createTerminalSessionStateSaveFailureMessage()), {
-        agentSessionOperationOutcome: 'unknown' as const
-      })
-    }
-  }
-  // Why here and not at the upsert: this path leases before it binds, so supersession fenced on the
-  // pane's binding still named the predecessor and bailed on every reconnect — one more reattachable
-  // lease, and one more `pty.attach`, per reconnect forever. Runs after whichever binding write this
-  // commit made, so the lease/binding order no longer decides.
-  if (ctx.deps.store && args.connectionId && ctx.validatedLeafId !== null) {
-    ctx.deps.store.supersedeSshRemotePtyLeasesForBoundPane(args.connectionId, ctx.validatedLeafId)
-  }
-  // Why: when the renderer has declared it will own the serializer for this paneKey, suppress the daemon-snapshot seed so its hydration path is sole authority (keyed on paneKey since the ptyId isn't known yet). See docs/mobile-prefer-renderer-scrollback.md.
+  claimSshPaneLease({
+    store: ctx.deps.store,
+    connectionId: args.connectionId,
+    ptyId: ctx.result.id,
+    worktreeId: args.worktreeId,
+    tabId: args.tabId,
+    leafId: ctx.validatedLeafId ?? undefined
+  })
   const rendererPreSignaled = ctx.validatedPaneKey
     ? pendingByPaneKey.has(ctx.validatedPaneKey)
     : false
@@ -166,5 +150,4 @@ export async function persistPtyIpcSpawnCommit(ctx: PtyIpcSpawnState): Promise<{
       pendingPtyIdBySerializerGeneration.set(pending.gen, ctx.result.id)
     }
   }
-  return { rendererPreSignaled, rendererAlreadyRegistered, committedSize }
 }
diff --git a/src/main/ipc/pty/ipc/spawn-commit-run-facts.test.ts b/src/main/ipc/pty/ipc/spawn-commit-run-facts.test.ts
new file mode 100644
index 00000000000..40cd636896a
--- /dev/null
+++ b/src/main/ipc/pty/ipc/spawn-commit-run-facts.test.ts
@@ -0,0 +1,79 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeWithRuntimeId } from '../../../runtime/orca-runtime-runtime-id'
+import { TerminalIntentionalStops } from '../../../runtime/terminal-intentional-stops'
+import { TerminalRunFactsRegister } from '../../../runtime/terminal-run-facts'
+import { ptySizes } from '../delivery/visibility-state'
+import { ptyIncarnationById, ptyOwnership } from '../provider/ownership-state'
+import { commitPtyIpcSpawn } from './spawn-commit'
+import { createPtyIpcSpawnState } from './spawn-state'
+import type { PtySpawnIpcDeps } from './spawn-types'
+
+const PTY_ID = 'orca-ipc-pty-run-facts'
+const INCARNATION_ID = 'inc-ipc-run-facts'
+
+async function commit(persistPtyBinding: ReturnType<typeof vi.fn>) {
+  const facts = new TerminalRunFactsRegister()
+  const stops = new TerminalIntentionalStops()
+  stops.mark(PTY_ID, 'reversible', null)(true)
+  const runtime = {
+    terminalRunFacts: facts,
+    intentionalPtyStops: stops,
+    // Why the real method: the case under test is what the runtime does with each commit.
+    noteTerminalSpawnCommit: OrcaRuntimeWithRuntimeId.prototype.noteTerminalSpawnCommit,
+    registerPreAllocatedHandleForPty: vi.fn(),
+    registerPty: vi.fn(),
+    cancelPendingPtyRegistration: vi.fn(),
+    reflowHeadlessTerminalToPtyGrid: vi.fn(),
+    seedHeadlessTerminal: vi.fn(),
+    noteTerminalSpawnCommand: vi.fn()
+  }
+  const ports = {
+    runtime,
+    store: { persistPtyBinding },
+    options: {},
+    sendPtySpawnedToRenderer: vi.fn()
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the commit reads only the ports above, and the store only for its binding save.
+  const deps = ports as unknown as PtySpawnIpcDeps
+  const ctx = createPtyIpcSpawnState(deps, {
+    worktreeId: 'wt-1',
+    tabId: 'tab-1',
+    leafId: 'leaf-1',
+    cols: 120,
+    rows: 40
+  })
+  ctx.validatedLeafId = 'leaf-1'
+  ctx.provider = { ...ctx.provider, shutdown: vi.fn().mockResolvedValue(undefined) }
+  ctx.result = { id: PTY_ID, incarnationId: INCARNATION_ID }
+  const outcome = await commitPtyIpcSpawn(ctx).then(
+    () => 'committed',
+    () => 'discarded'
+  )
+  return { outcome, facts, stops }
+}
+
+describe('renderer spawn commit: run facts', () => {
+  afterEach(() => {
+    ptySizes.delete(PTY_ID)
+    ptyOwnership.delete(PTY_ID)
+    ptyIncarnationById.delete(PTY_ID)
+  })
+
+  it('records a committed spawn and lets it supersede a landed stop no exit pinned', async () => {
+    const { outcome, facts, stops } = await commit(vi.fn().mockResolvedValue(true))
+
+    expect(outcome).toBe('committed')
+    expect(facts.read(PTY_ID, INCARNATION_ID).freshSpawn).toBe(true)
+    expect(stops.claimExit(PTY_ID, INCARNATION_ID)).toEqual([])
+  })
+
+  it('records nothing for a spawn discarded because its binding save failed', async () => {
+    const persistPtyBinding = vi.fn().mockRejectedValue(new Error('disk full'))
+    const { outcome, facts, stops } = await commit(persistPtyBinding)
+
+    expect(outcome).toBe('discarded')
+    expect(persistPtyBinding).toHaveBeenCalledOnce()
+    expect(facts.read(PTY_ID, INCARNATION_ID).freshSpawn).toBe(false)
+    expect(stops.claimExit(PTY_ID, INCARNATION_ID)).toEqual(['reversible'])
+  })
+})
diff --git a/src/main/ipc/pty/ipc/spawn-commit-ssh-lease-cardinality.test.ts b/src/main/ipc/pty/ipc/spawn-commit-ssh-lease-cardinality.test.ts
index 6266faf0c02..aa726fdc685 100644
--- a/src/main/ipc/pty/ipc/spawn-commit-ssh-lease-cardinality.test.ts
+++ b/src/main/ipc/pty/ipc/spawn-commit-ssh-lease-cardinality.test.ts
@@ -9,7 +9,7 @@ import { toAppSshPtyId } from '../../../providers/ssh-pty-id'
 import { toSshExecutionHostId } from '../../../../shared/execution-host'
 import type { PtySpawnIpcArgs, PtySpawnIpcDeps } from './spawn-types'
 import { createPtyIpcSpawnState } from './spawn-state'
-import { persistPtyIpcSpawnCommit } from './spawn-commit-persist'
+import { persistPtyIpcSpawnCommit, publishPtyIpcSpawnCommit } from './spawn-commit-persist'
 
 vi.mock('electron', () => ({
   app: { getPath: () => testState.dir },
@@ -20,15 +20,7 @@ const TARGET = 'ssh-1'
 const WORKTREE = 'repo1::/worktree'
 const TAB = 'tab-1'
 
-/**
- * Drives the shipped IPC spawn commit rather than the store primitives it calls.
- *
- * The store-level suite could not catch this: it exercised bind-then-upsert, and this path does the
- * opposite — it writes the lease row first so a force-quit in the renderer's debounce window cannot
- * strand a running remote shell without one, then binds the pane. Supersession is fenced on the
- * pane's binding, so under this real order it bailed on the predecessor every time and never re-ran,
- * and each reconnect left one more reattachable lease for `reattachKnownPtys` to `pty.attach`.
- */
+/** Exercises the shipped binding-then-publication order so reconnects retire earlier leases. */
 async function commitSshSpawn(
   store: ReturnType<typeof createStore>,
   args: { relayPtyId: string; leafId: string }
@@ -45,7 +37,7 @@ async function commitSshSpawn(
   const ctx = createPtyIpcSpawnState(deps, spawnArgs)
   ctx.result = { id: toAppSshPtyId(TARGET, args.relayPtyId) }
   ctx.validatedLeafId = args.leafId
-  await persistPtyIpcSpawnCommit(ctx)
+  publishPtyIpcSpawnCommit(ctx, await persistPtyIpcSpawnCommit(ctx))
 }
 
 /** One pane's layout, so the two host partitions can be given different bindings for one leaf. */
@@ -150,7 +142,7 @@ describe('the IPC spawn commit keeps one reattachable lease per SSH pane', () =>
       state: 'attached'
     })
     expect(bulkReattachPtyIds(store)).toEqual(['pty2:aaa:1', 'pty2:bbb:1'])
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: WORKTREE,
       tabId: TAB,
       leafId: TEST_LEAF_1,
@@ -226,7 +218,7 @@ describe('the IPC spawn commit keeps one reattachable lease per SSH pane', () =>
     })
     // Production's writer for an SSH pane binding, and the whole point: it updates ONLY the host
     // partition, so `local` is left naming the predecessor until the renderer republishes.
-    store.persistPtyBinding(
+    await store.persistPtyBinding(
       { worktreeId: WORKTREE, tabId: TAB, leafId: TEST_LEAF_1, ptyId: successor },
       hostId
     )
diff --git a/src/main/ipc/pty/ipc/spawn-commit.ts b/src/main/ipc/pty/ipc/spawn-commit.ts
index 90b700f24b2..77491c9fb11 100644
--- a/src/main/ipc/pty/ipc/spawn-commit.ts
+++ b/src/main/ipc/pty/ipc/spawn-commit.ts
@@ -4,13 +4,7 @@ import { markClaudePtySpawned } from '../../../claude-accounts/live-pty-gate'
 import { registerPty } from '../../../memory/pty-registry'
 import type { PtySpawnResult } from '../../../providers/types'
 import { clearMigrationUnsupportedPtysForPaneKey } from '../../../agent-hooks/migration-unsupported-pty-state'
-import { track } from '../../../telemetry/client'
-import { getCohortAtEmit } from '../../../telemetry/cohort-classifier'
-import {
-  agentKindSchema,
-  launchSourceSchema,
-  requestKindSchema
-} from '../../../../shared/telemetry-events'
+import { recordPtySpawnTelemetry } from '../pane/spawn-telemetry'
 import {
   shouldSkipCodexHomeEnvForWindowsShell,
   codexReattachedHomeRouteField
@@ -23,65 +17,22 @@ import {
   admitRendererAgentLaunchAuthority
 } from '../pane/launch-authority'
 import type { PtyIpcSpawnState } from './spawn-state'
-import { persistPtyIpcSpawnCommit } from './spawn-commit-persist'
+import { persistPtyIpcSpawnCommit, publishPtyIpcSpawnCommit } from './spawn-commit-persist'
+import { admitPtyReattachOwnership, registerPersistedPtySpawn } from '../pane/spawn-registration'
 import { reflowHeadlessTerminalToCommittedGrid } from '../delivery/attached-pty-size'
+import { seedHeadlessTerminalFromSpawnResult } from '../pane/terminal-spawn-restore'
+import { markNativeWindowsConptyPty } from '../../../runtime/terminal-model-query-authority'
 
 export async function commitPtyIpcSpawn(ctx: PtyIpcSpawnState): Promise<PtySpawnResult> {
   const args = ctx.args
-  const { rendererPreSignaled, rendererAlreadyRegistered, committedSize } =
-    await persistPtyIpcSpawnCommit(ctx)
-
-  // Why: seed the headless emulator before registerPty so concurrent live PTY data lands on top of the seed, not replacing it (mobile keeps the daemon-restored scrollback).
-  // Skip when the renderer will be authoritative — its xterm buffer is richer than the daemon snapshot.
-  if (ctx.deps.runtime && !rendererPreSignaled && !rendererAlreadyRegistered) {
-    const snapshotSeedSize =
-      typeof ctx.result.snapshotCols === 'number' && typeof ctx.result.snapshotRows === 'number'
-        ? { cols: ctx.result.snapshotCols, rows: ctx.result.snapshotRows }
-        : undefined
-    if (typeof ctx.result.snapshot === 'string' && ctx.result.snapshot.length > 0) {
-      // Why kitty flags ride seed metadata: the snapshot omits them, but the re-seeded emulator must answer hidden `CSI ? u` with the running app's flags (terminal-query-authority.md).
-      ctx.deps.runtime.seedHeadlessTerminal(ctx.result.id, ctx.result.snapshot, snapshotSeedSize, {
-        ...(typeof ctx.result.snapshotKittyKeyboardFlags === 'number'
-          ? { kittyKeyboardFlags: ctx.result.snapshotKittyKeyboardFlags }
-          : {}),
-        ...(ctx.result.snapshotTerminalOwner
-          ? { terminalOwner: ctx.result.snapshotTerminalOwner }
-          : {})
-      })
-    } else if (
-      ctx.result.coldRestore &&
-      typeof ctx.result.coldRestore.scrollback === 'string' &&
-      ctx.result.coldRestore.scrollback.length > 0
-    ) {
-      const coldRestoreSeedSize =
-        typeof ctx.result.coldRestore.cols === 'number' &&
-        typeof ctx.result.coldRestore.rows === 'number'
-          ? { cols: ctx.result.coldRestore.cols, rows: ctx.result.coldRestore.rows }
-          : undefined
-      ctx.deps.runtime.seedHeadlessTerminal(
-        ctx.result.id,
-        ctx.result.coldRestore.scrollback,
-        coldRestoreSeedSize,
-        {
-          cwd: ctx.result.coldRestore.cwd,
-          oscLinks: ctx.result.coldRestore.oscLinks,
-          preferProviderIfExisting: true
-        }
-      )
-    } else if (typeof ctx.result.replay === 'string' && ctx.result.replay.length > 0) {
-      // Why: relay reattach replay is the only restore main never ingests; skip this seed and park-reveal would replace it with a suffix fragment.
-      ctx.deps.runtime.seedHeadlessTerminal(ctx.result.id, ctx.result.replay)
-    }
+  admitPtyReattachOwnership(ctx.deps.runtime, ctx.result, args.connectionId)
+  if (ctx.nativeWindowsConptySpawn) {
+    markNativeWindowsConptyPty(ctx.result.id)
   }
-  // Why after the seed: a seed skips an existing model, and live bytes may have lazily created
-  // one at the 80x24 default before the spawn reply revealed the session's real grid.
-  reflowHeadlessTerminalToCommittedGrid({
-    result: ctx.result,
-    committedSize,
-    reflowHeadlessTerminalToPtyGrid: ctx.deps.runtime?.reflowHeadlessTerminalToPtyGrid?.bind(
-      ctx.deps.runtime
-    )
-  })
+  // Seed before the first disk await so live output appends to the restored history.
+  seedHeadlessTerminalFromSpawnResult(ctx.deps.runtime, ctx.result, ctx.validatedPaneKey)
+  seedTerminalRestoreRecordsFromSpawnResult(ctx.deps.runtime, ctx.result)
+  const committedSize = await persistPtyIpcSpawnCommit(ctx)
   if (
     typeof args.worktreeId === 'string' &&
     args.worktreeId.length > 0 &&
@@ -101,7 +52,9 @@ export async function commitPtyIpcSpawn(ctx: PtyIpcSpawnState): Promise<PtySpawn
       launchAgent: ctx.result.launchAgent,
       incarnationId: ctx.result.incarnationId
     })
-    ctx.deps.runtime?.registerPty(
+    const rejectedRegistration = registerPersistedPtySpawn(
+      ctx.deps.runtime,
+      ctx.deps.store,
       ctx.result.id,
       args.worktreeId,
       args.connectionId ?? null,
@@ -123,6 +76,21 @@ export async function commitPtyIpcSpawn(ctx: PtyIpcSpawnState): Promise<PtySpawn
         ? shouldSkipCodexHomeEnvForWindowsShell(ctx.effectiveShellOverride, ctx.cwd)
         : undefined
     )
+    if (rejectedRegistration) {
+      await rejectedRegistration.catch((error: unknown) => {
+        if (!(error instanceof Error) || error.message !== 'agent_session_exited_during_start') {
+          throw error
+        }
+      })
+      ctx.deps.runtime?.cancelPendingPtyRegistration?.(ctx.result.id, ctx.result.incarnationId)
+      ctx.pendingRegistrationPtyId = null
+      // The renderer drains this incarnation's buffered output and exit without publishing it live.
+      return resolvePaneSpawnReservation(
+        ctx.paneSpawnReservationKey,
+        ctx.paneSpawnReservation,
+        ctx.result
+      )
+    }
     ctx.pendingRegistrationPtyId = null
   } else if (ctx.pendingRegistrationPtyId) {
     ctx.deps.runtime?.cancelPendingPtyRegistration?.(
@@ -131,6 +99,15 @@ export async function commitPtyIpcSpawn(ctx: PtyIpcSpawnState): Promise<PtySpawn
     )
     ctx.pendingRegistrationPtyId = null
   }
+  publishPtyIpcSpawnCommit(ctx, committedSize)
+  // Admission must precede reflow: a replaced spawn cannot resize its successor's model.
+  reflowHeadlessTerminalToCommittedGrid({
+    result: ctx.result,
+    committedSize,
+    reflowHeadlessTerminalToPtyGrid: ctx.deps.runtime?.reflowHeadlessTerminalToPtyGrid?.bind(
+      ctx.deps.runtime
+    )
+  })
   // Why: seed after registerPty binds the worktree — including on
   // desktop, where the renderer-authority gate above skips the emulator
   // seed but the list/read records still live main-side.
@@ -201,17 +178,7 @@ export async function commitPtyIpcSpawn(ctx: PtyIpcSpawnState): Promise<PtySpawn
   }
   // Why: telemetry-plan.md§Agent launch semantics — fire agent_started only after spawn resolved; safeParse each field so a spoofed IPC payload can't poison the event (missing required field skips it).
   if (args.telemetry && !ctx.stablePaneOwner) {
-    const agentKindParse = agentKindSchema.safeParse(args.telemetry.agent_kind)
-    const launchSourceParse = launchSourceSchema.safeParse(args.telemetry.launch_source)
-    const requestKindParse = requestKindSchema.safeParse(args.telemetry.request_kind)
-    if (agentKindParse.success && launchSourceParse.success && requestKindParse.success) {
-      track('agent_started', {
-        agent_kind: agentKindParse.data,
-        launch_source: launchSourceParse.data,
-        request_kind: requestKindParse.data,
-        ...getCohortAtEmit()
-      })
-    }
+    recordPtySpawnTelemetry(args.telemetry)
   }
   const response = {
     ...ctx.result,
diff --git a/src/main/ipc/pty/ipc/spawn-env-codex.ts b/src/main/ipc/pty/ipc/spawn-env-codex.ts
index 50173f93c3d..b69bc65fed2 100644
--- a/src/main/ipc/pty/ipc/spawn-env-codex.ts
+++ b/src/main/ipc/pty/ipc/spawn-env-codex.ts
@@ -13,7 +13,6 @@ import {
   resolveCodexHomeAfterManagedAuthReadiness,
   shouldSkipCodexHomeEnvForWindowsShell,
   shouldStripInheritedOrcaCodexHome,
-  isCodexStatusHooksEnabled,
   codexHomePathsEqual
 } from '../host-env/codex-home'
 import { promoteAgentTeamsShimPath } from '../host-env/path'
@@ -40,8 +39,7 @@ export async function assemblePtyIpcSpawnCodexEnv(ctx: PtyIpcSpawnState): Promis
         launchAgent: args.launchAgent,
         providerSession: args.resumeProviderSession,
         target: ctx.codexSelectionTarget,
-        launchEnv: ctx.baseEnv,
-        workspacePath: ctx.cwd
+        launchEnv: ctx.baseEnv
       })
   ctx.codexResumeLaunch = codexResumePreparation
     ? await ctx.deps.resolveCodexResumeLaunch(args.command, codexResumePreparation)
@@ -57,10 +55,7 @@ export async function assemblePtyIpcSpawnCodexEnv(ctx: PtyIpcSpawnState): Promis
   // pre-strip env — only the daemon branch below re-derives this from baseEnv.
   ctx.env = ctx.baseEnv
   const selectLaunchCodexHome = async (): Promise<string | null> =>
-    (await ctx.deps.getSelectedCodexHomePath?.(ctx.codexSelectionTarget, ctx.baseEnv, {
-      workspacePath: ctx.cwd,
-      launchAgent: isTuiAgent(args.launchAgent) ? args.launchAgent : undefined
-    })) ?? null
+    (await ctx.deps.getSelectedCodexHomePath?.(ctx.codexSelectionTarget, ctx.baseEnv)) ?? null
   ctx.selectedCodexHomePath =
     !ctx.preAdoptedStablePane && !args.connectionId
       ? getCompatibleSelectedCodexHomePath(
@@ -84,17 +79,12 @@ export async function assemblePtyIpcSpawnCodexEnv(ctx: PtyIpcSpawnState): Promis
       resolveCurrent: async () =>
         getCompatibleSelectedCodexHomePath(
           ctx.codexSelectionTarget,
-          (await ctx.deps.getSelectedCodexHomePath?.(ctx.codexSelectionTarget, ctx.baseEnv, {
-            workspacePath: ctx.cwd,
-            launchAgent: 'codex'
-          })) ?? null
+          (await ctx.deps.getSelectedCodexHomePath?.(ctx.codexSelectionTarget, ctx.baseEnv)) ?? null
         ),
       resolveAfterUnavailable: async (unavailableManagedHomePath) =>
         getCompatibleSelectedCodexHomePath(
           ctx.codexSelectionTarget,
           (await ctx.deps.getSelectedCodexHomePath?.(ctx.codexSelectionTarget, ctx.baseEnv, {
-            workspacePath: ctx.cwd,
-            launchAgent: 'codex',
             unavailableManagedHomePath
           })) ?? null
         )
@@ -152,7 +142,6 @@ export async function assemblePtyIpcSpawnCodexEnv(ctx: PtyIpcSpawnState): Promis
         wslDistro: ctx.codexSelectionTarget.runtime === 'wsl' ? ctx.expectedWslDistro : null,
         agentStatusHooksEnabled: isAgentStatusHooksEnabled(ptySettings),
         disabledTuiAgents: ptySettings?.disabledTuiAgents,
-        codexStatusHooksEnabled: isCodexStatusHooksEnabled(ptySettings),
         networkProxySettings: ptySettings,
         routeBrowserOpensToClient: ctx.deps.runtime?.shouldRelayTerminalBrowserOpens?.(),
         deferGitConfigGuardToDaemon:
diff --git a/src/main/ipc/pty/ipc/spawn-options.ts b/src/main/ipc/pty/ipc/spawn-options.ts
index a2adf48771b..4d0d47eaf2e 100644
--- a/src/main/ipc/pty/ipc/spawn-options.ts
+++ b/src/main/ipc/pty/ipc/spawn-options.ts
@@ -1,3 +1,5 @@
+import { getAppEnvironment } from '../../../../shared/app-environment'
+import { getLegacyOpenCodeEnvKeysToDelete } from '../../../opencode/legacy-shared-config-dir'
 import { isTuiAgent } from '../../../../shared/tui-agent-config'
 import { CLAUDE_AUTH_ENV_VARS } from '../../../claude-accounts/environment'
 import { LEGACY_TERMINAL_SHIM_REMOTE_ENV_KEYS } from '../../../pty/legacy-terminal-shim-dir'
@@ -7,7 +9,7 @@ import {
   mergePtyEnvDeletions,
   removeCodexHomeDeletionRequests,
   getInheritedAgentHookEnvKeysToDelete,
-  getInheritedClaudeSessionStampEnvKeysToDelete
+  getInheritedAgentSessionStampEnvKeysToDelete
 } from '../host-env/pi-agent'
 import { promoteAgentTeamsShimPath, deleteRequestedEnvKeys } from '../host-env/path'
 import { beginPtySpawnForWorktree } from '../host-env/fresh-spawn-routing'
@@ -22,6 +24,7 @@ import { shouldSeedPreAttachPtySize } from '../delivery/attached-pty-size'
 import { getStartupTerminalIngressIntent } from '../../terminal-startup-color-query-replies'
 import { resolveConfiguredTerminalShellArgs } from '../configured-terminal-shell-args'
 import type { PtyIpcSpawnState } from './spawn-state'
+import { applyAgentWorkspaceTrustToSpawn } from '../../../agent-workspace-trust-spawn'
 
 /** Carries deletions to provider-owned environments, including persistent older daemons. */
 export async function buildPtyIpcSpawnOptions(
@@ -43,7 +46,11 @@ export async function buildPtyIpcSpawnOptions(
     // Why: disable old hosts without removing ORCA_REAL_* while their Windows shim remains on PATH.
     ctx.isDaemonHostSpawn || args.connectionId ? LEGACY_TERMINAL_SHIM_REMOTE_ENV_KEYS : [],
     ctx.isDaemonHostSpawn ? getInheritedAgentHookEnvKeysToDelete(ctx.spawnEnv) : [],
-    getInheritedClaudeSessionStampEnvKeysToDelete(ctx.spawnEnv),
+    // The daemon must judge its own inherited value; main may have a different config.
+    !args.connectionId && !ctx.isDaemonHostSpawn
+      ? getLegacyOpenCodeEnvKeysToDelete(ctx.spawnEnv, getAppEnvironment().getPath('userData'))
+      : [],
+    getInheritedAgentSessionStampEnvKeysToDelete(ctx.spawnEnv),
     ctx.skipCodexHomeEnv ? CODEX_HOME_ENV_KEYS : [],
     // Why: the persistent daemon compares its own merged CODEX_HOME pair;
     // main cannot safely decide ownership for a process it may not parent.
@@ -86,6 +93,22 @@ export async function buildPtyIpcSpawnOptions(
   if (args.worktreeId !== undefined) {
     ctx.spawnOptions.worktreeId = args.worktreeId
   }
+  const trustWrite = applyAgentWorkspaceTrustToSpawn({
+    launchAgent: args.launchAgent,
+    worktreeId: args.worktreeId,
+    cwd: ctx.cwd,
+    store: ctx.deps.store,
+    isFreshLaunch: !ctx.preAdoptedStablePane && ctx.launchCommand !== undefined,
+    settings: ctx.deps.getSettings?.(),
+    env: ctx.spawnEnv,
+    claudeAuth: ctx.claudeAuth,
+    wslDistro: ctx.expectedWslDistro,
+    connectionId: args.connectionId ?? null,
+    spawnOptions: ctx.spawnOptions
+  })
+  if (trustWrite) {
+    await trustWrite
+  }
   if (ctx.reservationPaneKey) {
     ctx.spawnOptions.paneKey = ctx.reservationPaneKey
   }
diff --git a/src/main/ipc/pty/ipc/spawn-types.ts b/src/main/ipc/pty/ipc/spawn-types.ts
index e14b469d1fb..d1f340be17d 100644
--- a/src/main/ipc/pty/ipc/spawn-types.ts
+++ b/src/main/ipc/pty/ipc/spawn-types.ts
@@ -104,7 +104,6 @@ export type PtySpawnIpcDeps = {
     providerSession?: AgentProviderSessionMetadata
     target: CodexAccountSelectionTarget
     launchEnv?: NodeJS.ProcessEnv
-    workspacePath?: string
   }) => PreparedCodexResumeHome | null
   noCodexResumeLaunch: (command: string | undefined) => CodexResumeLaunch
   resolveCodexResumeLaunch: (
diff --git a/src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts b/src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts
index ceeb5127b7d..4afd2b008f1 100644
--- a/src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts
+++ b/src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts
@@ -68,7 +68,7 @@ describe('chunked pty write yield', () => {
     }) as typeof setImmediate)
 
     const outcome = await Promise.race([
-      createWriteInput()({ id: PTY_ID, data: THREE_CHUNK_INPUT }),
+      createWriteInput()({ inputKind: 'driving', id: PTY_ID, data: THREE_CHUNK_INPUT }),
       afterImmediateTurns(50)
     ])
 
@@ -88,6 +88,7 @@ describe('chunked pty write yield', () => {
     const immediate = vi.spyOn(globalThis, 'setImmediate')
 
     const outcome = createWriteInput()({
+      inputKind: 'driving',
       id: PTY_ID,
       data: 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES)
     })
diff --git a/src/main/ipc/pty/ipc/write-input-user-input.test.ts b/src/main/ipc/pty/ipc/write-input-user-input.test.ts
new file mode 100644
index 00000000000..d4f20f00a68
--- /dev/null
+++ b/src/main/ipc/pty/ipc/write-input-user-input.test.ts
@@ -0,0 +1,63 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { TerminalRunFactsRegister } from '../../../runtime/terminal-run-facts'
+import { ptyOwnership } from '../provider/ownership-state'
+import { createPtyWriteInput } from './write-input'
+
+const PTY_ID = 'pty-user-input'
+
+const { provider } = vi.hoisted(() => ({
+  provider: { write: vi.fn(), hasPty: vi.fn(() => true) }
+}))
+
+vi.mock('../provider/registry', () => ({
+  tryGetProviderForPty: (id: string) => (id === PTY_ID ? provider : undefined)
+}))
+
+function createWriteInput(facts: TerminalRunFactsRegister) {
+  const runtime = { getDriver: () => ({ kind: 'desktop' }), terminalRunFacts: facts }
+  const mainWindow = { isDestroyed: () => false, webContents: { send: vi.fn() } }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: write input reads only getDriver and terminalRunFacts from the runtime, and isDestroyed/webContents from the window.
+  return createPtyWriteInput({ mainWindow: mainWindow as never, runtime: runtime as never })
+}
+
+beforeEach(() => {
+  ptyOwnership.set(PTY_ID, null)
+  provider.write.mockReset()
+})
+
+afterEach(() => {
+  ptyOwnership.delete(PTY_ID)
+})
+
+describe('renderer PTY writes: input kind', () => {
+  it.each(['writePtyInput', 'writePtyInputAccepted'] as const)(
+    '%s records driving input before the provider write',
+    async (writer) => {
+      const facts = new TerminalRunFactsRegister()
+      facts.recordSpawnCommit({ id: PTY_ID, incarnationId: 'inc-1' })
+      const recordedAtWrite: (number | null)[] = []
+      provider.write.mockImplementation(() => {
+        recordedAtWrite.push(facts.read(PTY_ID, 'inc-1').firstUserInputAt)
+      })
+
+      await createWriteInput(facts)[writer]({ id: PTY_ID, data: 'exit\r', inputKind: 'driving' })
+
+      expect(recordedAtWrite).toEqual([expect.any(Number)])
+    }
+  )
+
+  it.each([
+    ['a launch write', 'launch', 'echo startup\r'],
+    ['a query reply', 'query-reply', '\x1b[3;4R'],
+    ['a driving write that is only a reply', 'driving', '\x1b[3;4R'],
+    ['a driving write that is only focus reports', 'driving', '\x1b[I\x1b[O']
+  ] as const)('records nothing for %s', async (_label, inputKind, data) => {
+    const facts = new TerminalRunFactsRegister()
+    facts.recordSpawnCommit({ id: PTY_ID, incarnationId: 'inc-1' })
+
+    await createWriteInput(facts).writePtyInput({ id: PTY_ID, data, inputKind })
+
+    expect(provider.write).toHaveBeenCalledOnce()
+    expect(facts.read(PTY_ID, 'inc-1').firstUserInputAt).toBeNull()
+  })
+})
diff --git a/src/main/ipc/pty/ipc/write-input.ts b/src/main/ipc/pty/ipc/write-input.ts
index c7348ddfaef..2f8ea72cd9b 100644
--- a/src/main/ipc/pty/ipc/write-input.ts
+++ b/src/main/ipc/pty/ipc/write-input.ts
@@ -1,4 +1,5 @@
-import type { BrowserWindow, IpcMainEvent, IpcMainInvokeEvent, WebContents } from 'electron'
+import type { IpcMainEvent, IpcMainInvokeEvent } from 'electron'
+import type { PtyRendererDelivery } from '../session'
 import type { OrcaRuntimeService } from '../../../runtime/orca-runtime'
 import type { IPtyProvider } from '../../../providers/types'
 import { isPtyWriteUnavailableError } from '../../../providers/pty-write-unavailable-error'
@@ -8,41 +9,42 @@ import {
 } from '../../../../shared/terminal-input'
 import { ptyOwnership } from '../provider/ownership-state'
 import { tryGetProviderForPty } from '../provider/registry'
+import type { TerminalInputKind } from '../../../../shared/terminal-input-kind'
 import { interactiveOutputCharsByPty, lastInputAtByPty } from '../delivery/visibility-state'
 
 export function isMainWindowPtyIpcEvent(
   event: IpcMainEvent | IpcMainInvokeEvent,
-  mainWindow: BrowserWindow,
-  mainWebContents: WebContents
+  mainWindow: PtyRendererDelivery | undefined
 ): boolean {
+  const mainWebContents = mainWindow?.webContents
   return (
+    !!mainWindow &&
+    !!mainWebContents &&
     event.sender === mainWebContents &&
     !mainWindow.isDestroyed() &&
     !(typeof mainWebContents.isDestroyed === 'function' && mainWebContents.isDestroyed())
   )
 }
 
-export type PtyWritePayload = { id: string; data: string }
+export type PtyWritePayload = { id: string; data: string; inputKind: TerminalInputKind }
 export type PtyViewportClaimPayload = { id: string; cols: number; rows: number }
 
 export function createPtyWriteInput(deps: {
-  mainWindow: BrowserWindow
+  mainWindow?: PtyRendererDelivery
   runtime?: OrcaRuntimeService
 }): {
   writePtyInput: (args: PtyWritePayload) => boolean | Promise<boolean>
   writePtyInputAccepted: (args: PtyWritePayload) => boolean | Promise<boolean>
   isPtyWritePayload: (value: unknown) => value is PtyWritePayload
   isPtyViewportClaimPayload: (value: unknown) => value is PtyViewportClaimPayload
-  isPtyWriteEventFromMainWindow: (
-    event: IpcMainEvent | IpcMainInvokeEvent,
-    mainWebContents: WebContents
-  ) => boolean
+  isPtyWriteEventFromMainWindow: (event: IpcMainEvent | IpcMainInvokeEvent) => boolean
 } {
   const { mainWindow, runtime } = deps
 
   const reportUnavailablePtyWrite = (id: string, error: unknown): void => {
     if (
       !isPtyWriteUnavailableError(error) ||
+      !mainWindow ||
       mainWindow.isDestroyed() ||
       (typeof mainWindow.webContents.isDestroyed === 'function' &&
         mainWindow.webContents.isDestroyed())
@@ -144,10 +146,14 @@ export function createPtyWriteInput(deps: {
     (value as { cols: number }).cols > 0 &&
     (value as { rows: number }).rows > 0
 
-  const isPtyWriteEventFromMainWindow = (
-    event: IpcMainEvent | IpcMainInvokeEvent,
-    mainWebContents: WebContents
-  ): boolean => isMainWindowPtyIpcEvent(event, mainWindow, mainWebContents)
+  const isPtyWriteEventFromMainWindow = (event: IpcMainEvent | IpcMainInvokeEvent): boolean =>
+    isMainWindowPtyIpcEvent(event, mainWindow)
+
+  const noteRendererPtyInput = (args: PtyWritePayload): void => {
+    lastInputAtByPty.set(args.id, performance.now())
+    interactiveOutputCharsByPty.set(args.id, 0)
+    runtime?.terminalRunFacts?.recordInput(args.id, args.inputKind, args.data)
+  }
 
   const writePtyInput = (args: PtyWritePayload): boolean | Promise<boolean> => {
     // Why: mobile-presence-lock defense-in-depth — the renderer's onData guard can let one keystroke slip during the state-flip lag, so catch it server-side. See docs/mobile-presence-lock.md.
@@ -159,9 +165,7 @@ export function createPtyWriteInput(deps: {
       return false
     }
     try {
-      const now = performance.now()
-      lastInputAtByPty.set(args.id, now)
-      interactiveOutputCharsByPty.set(args.id, 0)
+      noteRendererPtyInput(args)
       return writePtyProviderInput(provider, args.id, args.data)
     } catch {
       return false
@@ -181,9 +185,7 @@ export function createPtyWriteInput(deps: {
       return false
     }
     try {
-      const now = performance.now()
-      lastInputAtByPty.set(args.id, now)
-      interactiveOutputCharsByPty.set(args.id, 0)
+      noteRendererPtyInput(args)
       return writePtyProviderInput(provider, args.id, args.data)
     } catch {
       return false
diff --git a/src/main/ipc/pty/ipc/write.ts b/src/main/ipc/pty/ipc/write.ts
index 62adcd02113..04065921d07 100644
--- a/src/main/ipc/pty/ipc/write.ts
+++ b/src/main/ipc/pty/ipc/write.ts
@@ -1,14 +1,14 @@
-import type { BrowserWindow } from 'electron'
+import type { PtyRendererDelivery } from '../session'
 import { getPtyIpc } from '../../pty-host-bindings'
 import type { OrcaRuntimeService } from '../../../runtime/orca-runtime'
 import { createPtyWriteInput } from './write-input'
 
 export function installPtyWriteIpcHandlers(deps: {
-  mainWindow: BrowserWindow
+  mainWindow?: PtyRendererDelivery
   runtime?: OrcaRuntimeService
 }): void {
   const ipcMain = getPtyIpc()
-  const { mainWindow, runtime } = deps
+  const { runtime } = deps
   const {
     writePtyInput,
     writePtyInputAccepted,
@@ -20,7 +20,7 @@ export function installPtyWriteIpcHandlers(deps: {
   const hostViewportClaimTails = new Map<string, Promise<boolean>>()
 
   ipcMain.on('pty:write', (event, args: unknown) => {
-    if (!isPtyWriteEventFromMainWindow(event, mainWindow.webContents) || !isPtyWritePayload(args)) {
+    if (!isPtyWriteEventFromMainWindow(event) || !isPtyWritePayload(args)) {
       return
     }
     const claimTail = hostViewportClaimTails.get(args.id)
@@ -31,7 +31,7 @@ export function installPtyWriteIpcHandlers(deps: {
     writePtyInput(args)
   })
   ipcMain.handle('pty:writeAccepted', (event, args: unknown): boolean | Promise<boolean> => {
-    if (!isPtyWriteEventFromMainWindow(event, mainWindow.webContents) || !isPtyWritePayload(args)) {
+    if (!isPtyWriteEventFromMainWindow(event) || !isPtyWritePayload(args)) {
       return false
     }
     const claimTail = hostViewportClaimTails.get(args.id)
@@ -42,11 +42,7 @@ export function installPtyWriteIpcHandlers(deps: {
 
   ipcMain.removeAllListeners('pty:claimViewport')
   ipcMain.on('pty:claimViewport', (event, args: unknown) => {
-    if (
-      !isPtyWriteEventFromMainWindow(event, mainWindow.webContents) ||
-      !runtime ||
-      !isPtyViewportClaimPayload(args)
-    ) {
+    if (!isPtyWriteEventFromMainWindow(event) || !runtime || !isPtyViewportClaimPayload(args)) {
       return
     }
     const prior = hostViewportClaimTails.get(args.id)
diff --git a/src/main/ipc/pty/opencode-legacy-spawn-deletions.test.ts b/src/main/ipc/pty/opencode-legacy-spawn-deletions.test.ts
new file mode 100644
index 00000000000..1c7203ab046
--- /dev/null
+++ b/src/main/ipc/pty/opencode-legacy-spawn-deletions.test.ts
@@ -0,0 +1,64 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { join } from 'node:path'
+import { createDaemonPtyEnvironment } from '../../daemon/pty-subprocess/spawn-environment'
+import { getAppEnvironment } from '../../../shared/app-environment'
+import { buildPtyIpcSpawnOptions } from './ipc/spawn-options'
+import { createPtyIpcSpawnState } from './ipc/spawn-state'
+import type { PtySpawnIpcDeps } from './ipc/spawn-types'
+import { buildRuntimePtySpawnOptions } from './runtime/spawn-options'
+import { createRuntimePtySpawnState } from './runtime/spawn-state'
+import type { PtyRuntimeControllerDeps } from './runtime/controller-deps'
+
+afterEach(() => vi.unstubAllEnvs())
+
+describe.each(['renderer', 'runtime'])('%s retired OpenCode environment deletion', (route) => {
+  it.each([
+    { connectionId: undefined, daemon: false, explicit: undefined, deleted: true },
+    { connectionId: undefined, daemon: true, explicit: undefined, deleted: false },
+    { connectionId: undefined, daemon: true, explicit: '/user/config', deleted: false },
+    { connectionId: 'ssh-host', daemon: false, explicit: undefined, deleted: false }
+  ])(
+    'respects explicit=$explicit, daemon=$daemon, and connection=$connectionId',
+    async ({ connectionId, daemon, explicit, deleted }) => {
+      const legacy = join(getAppEnvironment().getPath('userData'), 'opencode-hooks', 'shared')
+      vi.stubEnv('OPENCODE_CONFIG_DIR', legacy)
+      const args = { cols: 80, rows: 24, connectionId }
+      const env: Record<string, string> = explicit ? { OPENCODE_CONFIG_DIR: explicit } : {}
+      let deletions: string[] | undefined
+      if (route === 'renderer') {
+        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: this option-only path reads no required dependency methods with no worktree or hidden pane.
+        const ctx = createPtyIpcSpawnState({} as PtySpawnIpcDeps, args)
+        ctx.env = env
+        ctx.isDaemonHostSpawn = daemon
+        await buildPtyIpcSpawnOptions(ctx)
+        deletions = ctx.spawnOptions.envToDelete
+        ctx.finishTerminalInstall()
+      } else {
+        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: this option-only path reads no required dependency methods with no worktree or hidden pane.
+        const ctx = createRuntimePtySpawnState({} as PtyRuntimeControllerDeps, args)
+        ctx.env = env
+        ctx.isDaemonHostSpawn = daemon
+        await buildRuntimePtySpawnOptions(ctx)
+        deletions = ctx.spawnOptions.envToDelete
+        ctx.finishTerminalInstall()
+      }
+      expect(deletions?.includes('OPENCODE_CONFIG_DIR') ?? false).toBe(deleted)
+      expect(env.OPENCODE_CONFIG_DIR).toBe(explicit)
+      if (daemon) {
+        vi.stubEnv('ORCA_USER_DATA_PATH', getAppEnvironment().getPath('userData'))
+        for (const inherited of [legacy, '/daemon/user-config']) {
+          vi.stubEnv('OPENCODE_CONFIG_DIR', inherited)
+          const request = { sessionId: 'pane', cols: 80, rows: 24, env, envToDelete: deletions }
+          const result = createDaemonPtyEnvironment(request)
+          expect(result.OPENCODE_CONFIG_DIR).toBe(
+            explicit ?? (inherited === legacy ? undefined : inherited)
+          )
+          expect(
+            createDaemonPtyEnvironment({ ...request, envToDelete: ['OPENCODE_CONFIG_DIR'] })
+              .OPENCODE_CONFIG_DIR
+          ).toBeUndefined()
+        }
+      }
+    }
+  )
+})
diff --git a/src/main/ipc/pty/pane/spawn-registration.ts b/src/main/ipc/pty/pane/spawn-registration.ts
new file mode 100644
index 00000000000..d96154f7df8
--- /dev/null
+++ b/src/main/ipc/pty/pane/spawn-registration.ts
@@ -0,0 +1,81 @@
+import type { Store } from '../../../persistence'
+import type { OrcaRuntimeService } from '../../../runtime/orca-runtime'
+import type { IPtyProvider, PtySpawnResult } from '../../../providers/types'
+import { isCurrentPtyExit, ptyIncarnationById, ptyOwnership } from '../provider/ownership-state'
+import { clearProviderPtyState } from '../provider/state-cleanup'
+import { retirePersistedStablePaneOwner } from './stable-owner'
+
+export function admitPtyReattachOwnership(
+  runtime: OrcaRuntimeService | undefined,
+  result: PtySpawnResult,
+  connectionId: string | null | undefined
+): void {
+  if (!result.isReattach && result.agentSessionEnsure?.disposition !== 'adopted') {
+    return
+  }
+  runtime?.assertPtyRegistrationAllowed?.(result.id, result.incarnationId)
+  // A failed local save must not strand a live process already admitted by its host.
+  ptyOwnership.set(result.id, connectionId ?? ptyOwnership.get(result.id) ?? null)
+  if (result.incarnationId) {
+    ptyIncarnationById.set(result.id, result.incarnationId)
+  }
+}
+
+export async function discardUnpersistedPtySpawn(
+  provider: IPtyProvider,
+  result: PtySpawnResult,
+  onDiscarded?: () => void
+): Promise<void> {
+  if (
+    result.isReattach ||
+    result.agentSessionEnsure?.disposition === 'adopted' ||
+    !isCurrentPtyExit(result)
+  ) {
+    return
+  }
+  try {
+    await provider.shutdown(result.id, {
+      immediate: true,
+      ...(result.incarnationId ? { expectedIncarnationId: result.incarnationId } : {})
+    })
+  } catch (error) {
+    console.warn('[pty] failed to clean up PTY after persistence failure:', error)
+  }
+  // A replacement may arrive while the execution host finishes shutting down the predecessor.
+  if (isCurrentPtyExit(result)) {
+    clearProviderPtyState(result.id)
+    ptyOwnership.delete(result.id)
+    onDiscarded?.()
+  }
+}
+
+// Successful registration must not yield before the remaining spawn publication.
+export function registerPersistedPtySpawn(
+  runtime: OrcaRuntimeService | undefined,
+  store: Store | undefined,
+  ...args: Parameters<OrcaRuntimeService['registerPty']>
+): Promise<never> | undefined {
+  try {
+    runtime?.registerPty(...args)
+  } catch (error) {
+    const [ptyId, worktreeId, connectionId, binding] = args
+    // An exit during the binding write precedes runtime surface registration.
+    if (
+      error instanceof Error &&
+      error.message === 'agent_session_exited_during_start' &&
+      runtime?.getPtyLivenessVerdict?.(ptyId)?.status === 'exited' &&
+      binding
+    ) {
+      return retirePersistedStablePaneOwner(
+        store,
+        { ...binding, ptyId, persistedIncarnationId: binding.incarnationId },
+        worktreeId,
+        connectionId
+      ).then(() => {
+        throw error
+      })
+    }
+    throw error
+  }
+  return undefined
+}
diff --git a/src/main/ipc/pty/pane/spawn-telemetry.ts b/src/main/ipc/pty/pane/spawn-telemetry.ts
new file mode 100644
index 00000000000..ccd3c3d582d
--- /dev/null
+++ b/src/main/ipc/pty/pane/spawn-telemetry.ts
@@ -0,0 +1,24 @@
+import { track } from '../../../telemetry/client'
+import { getCohortAtEmit } from '../../../telemetry/cohort-classifier'
+import {
+  agentKindSchema,
+  launchSourceSchema,
+  requestKindSchema
+} from '../../../../shared/telemetry-events'
+import type { PtySpawnIpcArgs } from '../ipc/spawn-types'
+
+export function recordPtySpawnTelemetry(
+  telemetry: NonNullable<PtySpawnIpcArgs['telemetry']>
+): void {
+  const agentKind = agentKindSchema.safeParse(telemetry.agent_kind)
+  const launchSource = launchSourceSchema.safeParse(telemetry.launch_source)
+  const requestKind = requestKindSchema.safeParse(telemetry.request_kind)
+  if (agentKind.success && launchSource.success && requestKind.success) {
+    track('agent_started', {
+      agent_kind: agentKind.data,
+      launch_source: launchSource.data,
+      request_kind: requestKind.data,
+      ...getCohortAtEmit()
+    })
+  }
+}
diff --git a/src/main/ipc/pty/pane/stable-owner.ts b/src/main/ipc/pty/pane/stable-owner.ts
index 5d25e11f57c..83ebdd50364 100644
--- a/src/main/ipc/pty/pane/stable-owner.ts
+++ b/src/main/ipc/pty/pane/stable-owner.ts
@@ -1,3 +1,5 @@
+import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from '../../../persistence/restoring-sessions/workspace-session-write-rollback'
+import { cloneWorkspaceSessionState } from '../../../persistence/restoring-sessions/session-owner-fields'
 import { toSshExecutionHostId } from '../../../../shared/execution-host'
 import { makePaneKey, parsePaneKey } from '../../../../shared/stable-pane-id'
 import { UNVERIFIED_PROCESS_EXIT_CODE } from '../../../../shared/terminal-exit-cause'
@@ -98,8 +100,7 @@ export function resolveStablePaneOwner(
   }
   const registeredConnectionId = ptyOwnership.get(ptyId)
   const parsedSshId = registeredConnectionId === undefined ? parseAppSshPtyId(ptyId) : null
-  const ownerConnectionId = registeredConnectionId ?? parsedSshId?.connectionId ?? null
-  if (ownerConnectionId !== (connectionId ?? null)) {
+  if ((registeredConnectionId ?? parsedSshId?.connectionId ?? null) !== (connectionId ?? null)) {
     throw new Error('terminal_pane_owner_host_mismatch')
   }
   const runtimeIncarnationId = ptyIncarnationById.get(ptyId)
@@ -121,41 +122,50 @@ export function resolveStablePaneOwner(
   }
 }
 
-export function retirePersistedStablePaneOwner(
+export async function retirePersistedStablePaneOwner(
   store: Store | undefined,
   owner: StablePaneOwner,
   worktreeId: string,
   connectionId: string | null | undefined
-): boolean {
+): Promise<boolean> {
   if (!store) {
     return false
   }
-  const paneKey = makePaneKey(owner.tabId, owner.leafId)
-  const hostId = connectionId ? toSshExecutionHostId(connectionId) : undefined
-  const current = resolvePersistedStablePaneOwner(store, paneKey, worktreeId, connectionId)
-  if (!current) {
-    // Why: persistence already dropped this pane binding (an earlier stop retired it while the
-    // runtime kept history), so there is nothing left to clear — that is a completed retirement,
-    // not a competing owner. Reporting failure here strands the pane after its PTY is proven dead.
-    return true
-  }
-  if (current.ptyId !== owner.ptyId || current.incarnationId !== owner.persistedIncarnationId) {
-    return false
-  }
-  const session = store.getWorkspaceSession(hostId)
-  const retired = retireTerminalSurfaceFromPersistence(session, {
-    worktreeId,
-    parentTabId: owner.tabId,
-    leafId: owner.leafId,
-    ptyId: owner.ptyId,
-    ...(current.incarnationId ? { incarnationId: current.incarnationId } : {})
+  return store.runDurableMutation(() => {
+    const paneKey = makePaneKey(owner.tabId, owner.leafId)
+    const hostId = connectionId ? toSshExecutionHostId(connectionId) : undefined
+    const current = resolvePersistedStablePaneOwner(store, paneKey, worktreeId, connectionId)
+    if (!current) {
+      // A renderer removal may still be waiting for its debounced write.
+      return { value: true, persist: 'if-dirty' }
+    }
+    if (current.ptyId !== owner.ptyId || current.incarnationId !== owner.persistedIncarnationId) {
+      return { value: false, persist: false }
+    }
+    const session = cloneWorkspaceSessionState(store.getWorkspaceSession(hostId))
+    const retired = retireTerminalSurfaceFromPersistence(session, {
+      worktreeId,
+      parentTabId: owner.tabId,
+      leafId: owner.leafId,
+      ptyId: owner.ptyId,
+      ...(current.incarnationId ? { incarnationId: current.incarnationId } : {})
+    })
+    if (retired === session) {
+      return { value: false, persist: false }
+    }
+    store.setWorkspaceSession(retired, hostId)
+    const staged = cloneWorkspaceSessionState(store.getWorkspaceSession(hostId))
+    return {
+      value: true,
+      rollback: () => {
+        const current = store.getWorkspaceSession(hostId)
+        const rolledBack = rollbackWorkspaceSessionAfterFailedAsyncWrite(session, staged, current)
+        if (rolledBack !== current) {
+          store.setWorkspaceSession(rolledBack, hostId)
+        }
+      }
+    }
   })
-  if (retired === session) {
-    return false
-  }
-  store.setWorkspaceSession(retired, hostId)
-  store.flushOrThrow()
-  return true
 }
 
 export type StablePaneSpawnContext = {
@@ -181,19 +191,19 @@ export function stablePanePersistenceFence(
     : undefined
 }
 
-export function persistAdmittedStablePaneBinding(args: {
+export async function persistAdmittedStablePaneBinding(args: {
   store: Store | undefined
   owner: StablePaneOwner | null
   result: PtySpawnResult
   worktreeId: string | undefined
   startupCwd: string | undefined
   connectionId: string | null | undefined
-}): boolean {
+}): Promise<boolean> {
   const expectedBinding = stablePanePersistenceFence(args.owner)
   if (!args.store || !args.owner || !args.worktreeId || !expectedBinding) {
     return false
   }
-  const persisted = args.store.persistPtyBinding(
+  const persisted = await args.store.persistPtyBinding(
     {
       worktreeId: args.worktreeId,
       tabId: args.owner.tabId,
@@ -270,7 +280,7 @@ export async function attachStablePaneOwner(
     ptyOwnership.delete(owner.ptyId)
     if (
       args.worktreeId &&
-      !retirePersistedStablePaneOwner(args.store, owner, args.worktreeId, args.connectionId)
+      !(await retirePersistedStablePaneOwner(args.store, owner, args.worktreeId, args.connectionId))
     ) {
       throw new Error('terminal_pane_owner_changed')
     }
diff --git a/src/main/ipc/pty/pane/stable-pane-absence-death-certificate.test.ts b/src/main/ipc/pty/pane/stable-pane-absence-death-certificate.test.ts
index 972f479b492..390bcdd451a 100644
--- a/src/main/ipc/pty/pane/stable-pane-absence-death-certificate.test.ts
+++ b/src/main/ipc/pty/pane/stable-pane-absence-death-certificate.test.ts
@@ -9,6 +9,7 @@
 // same rule here, and pin that the marked half — the one refusal the relay backed with a pid probe
 // — still earns the certificate, so a genuinely dead PTY is not left `unverifiable` forever.
 import { describe, expect, it, vi } from 'vitest'
+import { withDurableRuntimeStore } from '../../../runtime/runtime-durable-store-fixture'
 import { getDefaultWorkspaceSession } from '../../../../shared/constants'
 import { makePaneKey } from '../../../../shared/stable-pane-id'
 import { SSH_EXIT_UNCONFIRMED_REASON } from '../../../../shared/pty-liveness-verdict'
@@ -54,7 +55,8 @@ function paneStore(): { store: Store; read: () => WorkspaceSessionState } {
   } as unknown as WorkspaceSessionState
   return {
     read: () => session,
-    store: {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This fixture supplies the persistence methods used by stable-pane retirement and exit bookkeeping.
+    store: withDurableRuntimeStore({
       getWorkspaceSession: () => session,
       setWorkspaceSession: (next: WorkspaceSessionState) => {
         session = next
@@ -75,7 +77,7 @@ function paneStore(): { store: Store; read: () => WorkspaceSessionState } {
       removeWorktreeMeta: () => {},
       getSettings: () => ({ workspaceDir: '/tmp/workspaces' }),
       getProjects: () => []
-    } as unknown as Store
+    }) as unknown as Store
   }
 }
 
diff --git a/src/main/ipc/pty/pane/stable-pane-relay-absence-respawn.test.ts b/src/main/ipc/pty/pane/stable-pane-relay-absence-respawn.test.ts
index e68bcf6ec99..ce3c578cfa0 100644
--- a/src/main/ipc/pty/pane/stable-pane-relay-absence-respawn.test.ts
+++ b/src/main/ipc/pty/pane/stable-pane-relay-absence-respawn.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it, vi } from 'vitest'
+import { withDurableRuntimeStore } from '../../../runtime/runtime-durable-store-fixture'
 import type { WorkspaceSessionState } from '../../../../shared/workspace-session-state-types'
 import { TerminalSessionOwnerUnverifiedError } from '../../../daemon/daemon-errors'
 import {
@@ -70,13 +71,14 @@ function sessionStore(leaves: string[]): { store: Store; read: () => WorkspaceSe
   } as unknown as WorkspaceSessionState
   return {
     read: () => session,
-    store: {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This fixture supplies every persistence method used by stable-pane retirement.
+    store: withDurableRuntimeStore({
       getWorkspaceSession: () => session,
       setWorkspaceSession: (next: WorkspaceSessionState) => {
         session = next
       },
       flushOrThrow: () => {}
-    } as unknown as Store
+    }) as unknown as Store
   }
 }
 
diff --git a/src/main/ipc/pty/pane/terminal-spawn-restore.ts b/src/main/ipc/pty/pane/terminal-spawn-restore.ts
new file mode 100644
index 00000000000..cbe3d337ae3
--- /dev/null
+++ b/src/main/ipc/pty/pane/terminal-spawn-restore.ts
@@ -0,0 +1,46 @@
+import type { PtySpawnResult } from '../../../providers/types'
+import type { OrcaRuntimeService } from '../../../runtime/orca-runtime'
+import { pendingByPaneKey, rendererSerializerReadiness } from './serializer-state'
+
+export function seedHeadlessTerminalFromSpawnResult(
+  runtime: OrcaRuntimeService | undefined,
+  result: PtySpawnResult,
+  paneKey: string | null
+): void {
+  // A mounted renderer owns richer history than the provider snapshot.
+  if (
+    !runtime ||
+    (paneKey && pendingByPaneKey.has(paneKey)) ||
+    (result.isReattach === true && rendererSerializerReadiness.has(result.id))
+  ) {
+    return
+  }
+  if (typeof result.snapshot === 'string' && result.snapshot.length > 0) {
+    const size =
+      typeof result.snapshotCols === 'number' && typeof result.snapshotRows === 'number'
+        ? { cols: result.snapshotCols, rows: result.snapshotRows }
+        : undefined
+    runtime.seedHeadlessTerminal(result.id, result.snapshot, size, {
+      ...(typeof result.snapshotKittyKeyboardFlags === 'number'
+        ? { kittyKeyboardFlags: result.snapshotKittyKeyboardFlags }
+        : {}),
+      ...(result.snapshotTerminalOwner ? { terminalOwner: result.snapshotTerminalOwner } : {})
+    })
+  } else if (
+    result.coldRestore &&
+    typeof result.coldRestore.scrollback === 'string' &&
+    result.coldRestore.scrollback.length > 0
+  ) {
+    const size =
+      typeof result.coldRestore.cols === 'number' && typeof result.coldRestore.rows === 'number'
+        ? { cols: result.coldRestore.cols, rows: result.coldRestore.rows }
+        : undefined
+    runtime.seedHeadlessTerminal(result.id, result.coldRestore.scrollback, size, {
+      cwd: result.coldRestore.cwd,
+      oscLinks: result.coldRestore.oscLinks,
+      preferProviderIfExisting: true
+    })
+  } else if (typeof result.replay === 'string' && result.replay.length > 0) {
+    runtime.seedHeadlessTerminal(result.id, result.replay)
+  }
+}
diff --git a/src/main/ipc/pty/provider/bind-listeners.ts b/src/main/ipc/pty/provider/bind-listeners.ts
index 935d7f60432..31bacec82f7 100644
--- a/src/main/ipc/pty/provider/bind-listeners.ts
+++ b/src/main/ipc/pty/provider/bind-listeners.ts
@@ -28,6 +28,7 @@ export function bindProviderListeners(session: PtyIpcSession): void {
   setLocalWriteUnavailableUnsub(
     localProvider.onWriteUnavailable?.((payload) => {
       if (
+        !session.mainWindow ||
         session.mainWindow.isDestroyed() ||
         (typeof session.mainWindow.webContents.isDestroyed === 'function' &&
           session.mainWindow.webContents.isDestroyed())
diff --git a/src/main/ipc/pty/provider/listener-lifecycle.ts b/src/main/ipc/pty/provider/listener-lifecycle.ts
index 2b31257234e..815749582f8 100644
--- a/src/main/ipc/pty/provider/listener-lifecycle.ts
+++ b/src/main/ipc/pty/provider/listener-lifecycle.ts
@@ -1,4 +1,4 @@
-import type { WebContents } from 'electron'
+import type { PtyRendererDelivery } from '../session'
 
 // Why: localProvider.onData/onExit return unsubscribe functions. Without
 // storing and calling these on re-registration, macOS app re-activation
@@ -9,13 +9,13 @@ export let localExitUnsub: (() => void) | null = null
 export let localBackgroundStreamUnsub: (() => void) | null = null
 export let localWriteUnavailableUnsub: (() => void) | null = null
 export let didFinishLoadHandler: (() => void) | null = null
-export let didFinishLoadWebContents: WebContents | null = null
-export let rendererLifecycleResetWebContents: WebContents | null = null
+export let didFinishLoadWebContents: PtyRendererDelivery['webContents'] | null = null
+export let rendererLifecycleResetWebContents: PtyRendererDelivery['webContents'] | null = null
 export let rendererLifecycleResetHandler: (() => void) | null = null
 // Why: the hidden-delivery gate registries mirror renderer state; a reload/crash destroys owners without unregistering, so they reset when the renderer is replaced (drop memory preserved).
 export let rendererGateResetLoadHandler: (() => void) | null = null
 export let rendererGateResetGoneHandler: (() => void) | null = null
-export let rendererGateResetWebContents: WebContents | null = null
+export let rendererGateResetWebContents: PtyRendererDelivery['webContents'] | null = null
 // Why: the backgrounded-delivery dedupe map lives in the registerPtyHandlers closure but teardown funnels through module-scope clearProviderPtyState.
 // Why null-init + wrapper fn: see delivery/debug.ts — rolldown const-folds `export let fn = noop` bridges (STA-5661).
 let clearBackgroundedDeliverySyncForPtyImpl: ((id: string) => void) | null = null
@@ -72,14 +72,14 @@ export function setLocalWriteUnavailableUnsub(fn: (() => void) | null): void {
 
 export function setDidFinishLoadHandler(
   handler: (() => void) | null,
-  contents: WebContents | null
+  contents: PtyRendererDelivery['webContents'] | null
 ): void {
   didFinishLoadHandler = handler
   didFinishLoadWebContents = contents
 }
 
 export function setRendererLifecycleResetState(args: {
-  contents: WebContents | null
+  contents: PtyRendererDelivery['webContents'] | null
   handler: (() => void) | null
   navigation: ((details: RendererNavigationDetails) => void) | null
 }): void {
@@ -89,7 +89,7 @@ export function setRendererLifecycleResetState(args: {
 }
 
 export function setRendererGateResetState(args: {
-  contents: WebContents | null
+  contents: PtyRendererDelivery['webContents'] | null
   load: (() => void) | null
   gone: (() => void) | null
 }): void {
diff --git a/src/main/ipc/pty/provider/local-configure.ts b/src/main/ipc/pty/provider/local-configure.ts
index bf07eddf0bb..310a15f0ae2 100644
--- a/src/main/ipc/pty/provider/local-configure.ts
+++ b/src/main/ipc/pty/provider/local-configure.ts
@@ -14,7 +14,6 @@ import { markClaudePtyExited } from '../../../claude-accounts/live-pty-gate'
 import { buildPtyHostEnv } from '../host-env/assembly'
 import {
   getCompatibleSelectedCodexHomePath,
-  isCodexStatusHooksEnabled,
   shouldStripInheritedOrcaCodexHome
 } from '../host-env/codex-home'
 import type { GetSelectedCodexHomePath } from '../host-env/types'
@@ -50,10 +49,7 @@ export function configureLocalPtyProvider(args: {
         codexSelectionTarget,
         ctx?.codexHomePathOverride
           ? ctx.codexHomePathOverride.value
-          : ((await getSelectedCodexHomePath?.(codexSelectionTarget, baseEnv, {
-              workspacePath: ctx?.cwd,
-              launchAgent: ctx?.launchAgent
-            })) ?? null)
+          : ((await getSelectedCodexHomePath?.(codexSelectionTarget, baseEnv)) ?? null)
       )
       const skipCodexHomeEnv = ctx?.isWsl === true && !selectedCodexHomePath
       const ptySettings = getSettings?.()
@@ -89,7 +85,6 @@ export function configureLocalPtyProvider(args: {
         wslDistro: ctx?.wslDistro ?? null,
         agentStatusHooksEnabled: isAgentStatusHooksEnabled(ptySettings),
         disabledTuiAgents: ptySettings?.disabledTuiAgents,
-        codexStatusHooksEnabled: isCodexStatusHooksEnabled(ptySettings),
         networkProxySettings: ptySettings,
         routeBrowserOpensToClient: runtime?.shouldRelayTerminalBrowserOpens?.()
       })
diff --git a/src/main/ipc/pty/pty-spawn-shell-override-parity.test.ts b/src/main/ipc/pty/pty-spawn-shell-override-parity.test.ts
deleted file mode 100644
index 67bee9ca700..00000000000
--- a/src/main/ipc/pty/pty-spawn-shell-override-parity.test.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-/**
- * The two spawn preflights are twins: one serves renderer/IPC spawns, the other serves runtime
- * spawns (`terminal.create` from the CLI, headless serve, and paired remote environments). They
- * had drifted — the runtime twin passed a literal `undefined` for the caller's shell, so on a
- * Windows host a runtime-created terminal could only ever be the host's default shell. A caller
- * asking for cmd or PowerShell had to send it as `command`, which the provider TYPES into that
- * default shell: the pty stayed the default shell with the requested one running inside it, and
- * leaving that child dropped the caller's handle back onto a prompt it never asked for.
- *
- * Source-level because the functional seam is a whole spawn pipeline; what actually regressed is
- * one twin silently not reading a field the other reads.
- */
-const PREFLIGHTS = ['ipc', 'runtime'] as const
-
-describe.each(PREFLIGHTS)('%s pty spawn preflight', (lane) => {
-  const source = readFileSync(join(__dirname, lane, 'spawn-preflight.ts'), 'utf8')
-
-  it("resolves Windows terminal runtime options from the caller's requested shell", () => {
-    expect(source).toContain('requestedShellOverride: args.shellOverride')
-    expect(source).not.toContain('requestedShellOverride: undefined')
-  })
-})
diff --git a/src/main/ipc/pty/register-handlers.ts b/src/main/ipc/pty/register-handlers.ts
index 7794a8ef60a..5c7c897474a 100644
--- a/src/main/ipc/pty/register-handlers.ts
+++ b/src/main/ipc/pty/register-handlers.ts
@@ -1,4 +1,3 @@
-import type { BrowserWindow } from 'electron'
 import { getAppEnvironment } from '../../../shared/app-environment'
 import type { OrcaRuntimeService } from '../../runtime/orca-runtime'
 import type { Store } from '../../persistence'
@@ -18,7 +17,6 @@ import {
   stopReplacedPanePty,
   type PtyKillIpcDeps
 } from './ipc/renderer-kill'
-import { markReplacedPtyStop } from './delivery/exit'
 import { installPtyWriteIpcHandlers } from './ipc/write'
 import { installPtySpawnIpcHandler } from './ipc/spawn'
 import { installPtyRuntimeController } from './runtime/controller'
@@ -48,7 +46,7 @@ import {
   clearRendererGateResetHandlers,
   clearDidFinishLoadHandler
 } from './delivery/lifecycle-reset'
-import { createPtyIpcSession, type PtyIpcSessionOptions } from './session'
+import { createPtyIpcSession, type PtyIpcSessionOptions, type PtyRendererDelivery } from './session'
 import { wirePtyIpcSession } from './delivery/wire-session'
 import { configureLocalPtyProvider } from './provider/local-configure'
 import { bindProviderListeners } from './provider/bind-listeners'
@@ -67,7 +65,7 @@ import {
 import { ensureLinuxTerminalOrcaCliShimDir } from '../../cli/linux-terminal-orca-cli-shim'
 
 export function registerPtyHandlers(
-  mainWindow: BrowserWindow,
+  mainWindow?: PtyRendererDelivery,
   runtime?: OrcaRuntimeService,
   getSelectedCodexHomePath?: GetSelectedCodexHomePath,
   getSettings?: () => GlobalSettings,
@@ -92,7 +90,7 @@ export function registerPtyHandlers(
   setInvalidatePendingPtyDrainPolicy(() => {})
   // Why: neutralize rebind at the same moment as drain so a daemon replace in this window cannot attach the old accept/exit closures.
   setRebindProviderListeners(() => {})
-  registerRendererLifecycleResetHandlers(mainWindow.webContents)
+  registerRendererLifecycleResetHandlers(mainWindow?.webContents)
 
   const getLocalPtyStartupPromise = (connectionId?: string | null): Promise<void> | undefined => {
     if (connectionId) {
@@ -169,17 +167,19 @@ export function registerPtyHandlers(
     // Why: the daemon pacer must not keep throttling ptys whose hidden marks died with the renderer; the fresh renderer's sync re-marks the still-hidden ones.
     session.resyncBackgroundedDeliveriesAfterGateReset()
   }
-  setRendererGateResetState({
-    contents: mainWindow.webContents,
-    load: resetRendererPtyDeliveryGateState,
-    gone: resetRendererPtyDeliveryGateState
-  })
-  mainWindow.webContents.on('did-finish-load', resetRendererPtyDeliveryGateState)
-  mainWindow.webContents.on('render-process-gone', resetRendererPtyDeliveryGateState)
+  if (mainWindow) {
+    setRendererGateResetState({
+      contents: mainWindow.webContents,
+      load: resetRendererPtyDeliveryGateState,
+      gone: resetRendererPtyDeliveryGateState
+    })
+    mainWindow.webContents.on('did-finish-load', resetRendererPtyDeliveryGateState)
+    mainWindow.webContents.on('render-process-gone', resetRendererPtyDeliveryGateState)
+  }
 
   // Why: only LocalPtyProvider PTYs (main-process) can be orphaned on reload; daemon sessions survive by design and cleanup would kill them.
   clearDidFinishLoadHandler()
-  if (localProvider instanceof LocalPtyProvider) {
+  if (mainWindow && localProvider instanceof LocalPtyProvider) {
     const lp = localProvider
     const finishLoadHandler = () => {
       // Why: always advance to keep the generation monotonic, but skip the sweep on crash/freeze-recovery reload — it would kill live local PTYs before session restore (#5787).
@@ -236,7 +236,6 @@ export function registerPtyHandlers(
     options,
     trustedTerminalHandleEnv: session.trustedTerminalHandleEnv,
     retiredRejectedPtyIds: session.retiredRejectedPtyIds,
-    reversibleStopOwnersByPtyId: session.reversibleStopOwnersByPtyId,
     mainWindow,
     transitionSpawnHiddenRendererPtyDeliveryState:
       session.transitionSpawnHiddenRendererPtyDeliveryState,
@@ -274,8 +273,7 @@ export function registerPtyHandlers(
     trustedTerminalHandleEnv: session.trustedTerminalHandleEnv,
     sendPtySpawnedToRenderer: session.sendPtySpawnedToRenderer,
     syncPtyBackgroundedDelivery: session.syncPtyBackgroundedDelivery,
-    stopReplacedPty: (id) =>
-      stopReplacedPanePty(killDeps, id, (ptyId) => markReplacedPtyStop(session, ptyId))
+    stopReplacedPty: (id) => stopReplacedPanePty(killDeps, id)
   })
   installPtyWriteIpcHandlers({ mainWindow, runtime })
   installPtyResizeVisibilityIpc(session)
diff --git a/src/main/ipc/pty/register-headless-runtime.test.ts b/src/main/ipc/pty/register-headless-runtime.test.ts
index 7063ec2454d..a1b6f723483 100644
--- a/src/main/ipc/pty/register-headless-runtime.test.ts
+++ b/src/main/ipc/pty/register-headless-runtime.test.ts
@@ -33,6 +33,7 @@ describe('registerHeadlessPtyRuntime', () => {
 
     expect(events).toEqual(['handlers', 'hydrate'])
     expect(registerHandlersMock).toHaveBeenCalledOnce()
+    expect(registerHandlersMock.mock.calls[0]?.[0]).toBeUndefined()
     expect(hydrateMock).toHaveBeenCalledWith(store)
 
     resolveHydration()
diff --git a/src/main/ipc/pty/register-headless-runtime.ts b/src/main/ipc/pty/register-headless-runtime.ts
index 2212fbfac3a..424cb40facd 100644
--- a/src/main/ipc/pty/register-headless-runtime.ts
+++ b/src/main/ipc/pty/register-headless-runtime.ts
@@ -1,4 +1,3 @@
-import type { BrowserWindow } from 'electron'
 import type { OrcaRuntimeService } from '../../runtime/orca-runtime'
 import type { Store } from '../../persistence'
 import type { GlobalSettings } from '../../../shared/global-settings-types'
@@ -23,21 +22,8 @@ export function registerHeadlessPtyRuntime(
     onPtyExit?: (id: string, exitSequence: number) => void
   }
 ): Promise<void> {
-  // Why: headless `orca serve` has no renderer window but still needs the same PTY handlers so remote clients can drive terminals.
-  // Why a fake rather than null: `registerPtyHandlers` takes a non-null BrowserWindow. `isDestroyed: () => true`
-  // is what makes that safe — every renderer-liveness guard reads it and skips, so no send is ever attempted.
-  // Keep `webContents.isDestroyed` in step with it: guards check both, and a missing method reads as "alive".
-  const headlessWindow = {
-    isDestroyed: () => true,
-    webContents: {
-      isDestroyed: () => true,
-      send: () => {},
-      on: () => {},
-      removeListener: () => {}
-    }
-  } as unknown as BrowserWindow
   registerPtyHandlers(
-    headlessWindow,
+    undefined,
     runtime,
     getSelectedCodexHomePath,
     getSettings,
diff --git a/src/main/ipc/pty/register-without-renderer.test.ts b/src/main/ipc/pty/register-without-renderer.test.ts
new file mode 100644
index 00000000000..a5d19f020fc
--- /dev/null
+++ b/src/main/ipc/pty/register-without-renderer.test.ts
@@ -0,0 +1,231 @@
+import { EventEmitter } from 'node:events'
+import { describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeService } from '../../runtime/orca-runtime'
+import { setupPtyIpcSuite } from '../pty-ipc-test-harness'
+import {
+  getLocalPtyProvider,
+  getPtyRendererDeliveryDebugSnapshot,
+  registerPtyHandlers,
+  registerSshPtyProvider,
+  setPtyOwnership,
+  unregisterSshPtyProvider
+} from '../pty'
+import { registerHeadlessPtyRuntime } from './register-headless-runtime'
+import { onMock } from '../pty-ipc-mock-registry'
+
+vi.mock('electron', () => import('../pty-ipc-mock-registry').then((m) => m.electronModuleMock()))
+vi.mock('fs', () => import('../pty-ipc-mock-registry').then((m) => m.fsModuleMock()))
+vi.mock('node-pty', () => import('../pty-ipc-mock-registry').then((m) => m.nodePtyModuleMock()))
+vi.mock('node:child_process', async (importOriginal) =>
+  (await import('../pty-ipc-mock-registry')).childProcessModuleMock(await importOriginal())
+)
+vi.mock('../../opencode/hook-service', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.openCodeHookServiceModuleMock())
+)
+vi.mock('../../mimo/hook-service', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.mimoHookServiceModuleMock())
+)
+vi.mock('../../agent-hooks/server', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.agentHookServerModuleMock())
+)
+vi.mock('../../pi/titlebar-extension-service', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.piTitlebarExtensionModuleMock())
+)
+vi.mock('../../pwsh', () => import('../pty-ipc-mock-registry').then((m) => m.pwshModuleMock()))
+vi.mock('../../wsl', async (importOriginal) =>
+  (await import('../pty-ipc-mock-registry')).wslModuleMock(await importOriginal())
+)
+vi.mock('../../telemetry/client', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.telemetryClientModuleMock())
+)
+vi.mock('../../telemetry/classify-error', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.classifyErrorModuleMock())
+)
+vi.mock('../../cli/linux-terminal-orca-cli-shim', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.linuxCliShimModuleMock())
+)
+vi.mock('../../memory/pty-registry', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.ptyRegistryModuleMock())
+)
+vi.mock('../../agent-hooks/migration-unsupported-pty-state', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.migrationUnsupportedPtyModuleMock())
+)
+vi.mock('../../codex/codex-pane-account-registry', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.codexPaneAccountRegistryModuleMock())
+)
+vi.mock('../../codex/codex-state-db-backfill-recovery', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.codexBackfillRecoveryModuleMock())
+)
+
+describe('PTY registration without renderer delivery', () => {
+  const {
+    handlers,
+    mainWindow,
+    mainWindowIpcEvent,
+    installObservableDaemonTestProvider,
+    getPtyWriteListener
+  } = setupPtyIpcSuite()
+
+  it('keeps daemon output and exits flowing to the runtime without renderer work', async () => {
+    vi.useFakeTimers()
+    const daemon = installObservableDaemonTestProvider()
+    const runtime = new OrcaRuntimeService()
+    const setController = vi.spyOn(runtime, 'setPtyController')
+    const onData = vi.spyOn(runtime, 'onPtyData').mockReturnValue(6)
+    const onExit = vi.spyOn(runtime, 'onPtyExit').mockImplementation(() => {})
+    const onLifecycleExit = vi.fn()
+    setPtyOwnership('daemon-pty', null)
+    const initialTimerCount = vi.getTimerCount()
+
+    await registerHeadlessPtyRuntime(
+      runtime,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      { onPtyExit: onLifecycleExit }
+    )
+    const controller = setController.mock.calls[0]?.[0]
+    expect(controller).toBeDefined()
+    expect(vi.getTimerCount()).toBe(initialTimerCount)
+    daemon.emitData('daemon-pty', 'output')
+    daemon.emitDataGap('daemon-pty', 3)
+    daemon.emitExit('daemon-pty', 0)
+
+    expect(onData).toHaveBeenCalledWith('daemon-pty', 'output', expect.any(Number), 6, undefined)
+    expect(onExit).toHaveBeenCalledWith('daemon-pty', 0, undefined, { providerExitObserved: true })
+    expect(onLifecycleExit).toHaveBeenCalledWith('daemon-pty', expect.any(Number))
+    await expect(controller?.serializeBuffer?.('daemon-pty')).resolves.toBeNull()
+    expect(getPtyRendererDeliveryDebugSnapshot()).toMatchObject({
+      pendingChars: 0,
+      rendererInFlightChars: 0,
+      flushScheduled: false,
+      diagnostics: { windowFocused: null, windowVisible: null, windowMinimized: null }
+    })
+    expect(mainWindow.webContents.on).not.toHaveBeenCalled()
+    expect(mainWindow.webContents.send).not.toHaveBeenCalled()
+    expect(daemon.pauseProducer).not.toHaveBeenCalled()
+  })
+
+  it('routes local and SSH control to their providers, including attach and buffer snapshots', async () => {
+    const remote = installObservableDaemonTestProvider()
+    const remoteProvider = getLocalPtyProvider()
+    registerSshPtyProvider('ssh-a', remoteProvider)
+    const local = installObservableDaemonTestProvider()
+    const localProvider = getLocalPtyProvider()
+    const localClear = vi.spyOn(localProvider, 'clearBuffer')
+    const remoteClear = vi.spyOn(remoteProvider, 'clearBuffer')
+    const attach = vi.spyOn(localProvider, 'attach').mockResolvedValue({})
+    const runtime = new OrcaRuntimeService()
+    const setController = vi.spyOn(runtime, 'setPtyController')
+    const remoteId = 'ssh:ssh-a@@remote-pty'
+    local.getBufferSnapshot.mockResolvedValue({ data: 'local history', cols: 80, rows: 24 })
+    remote.getBufferSnapshot.mockResolvedValue({ data: 'remote history', cols: 100, rows: 30 })
+    await registerHeadlessPtyRuntime(runtime)
+    const controller = setController.mock.calls[0]?.[0]
+    if (!controller) {
+      throw new Error('missing runtime PTY controller')
+    }
+
+    expect(controller.write('daemon-pty', 'local input', 'driving')).toBe(true)
+    expect(controller.write(remoteId, 'remote input', 'driving')).toBe(true)
+    await controller.clearBuffer?.('daemon-pty')
+    await controller.clearBuffer?.(remoteId)
+    await expect(controller.attach?.('daemon-pty')).resolves.toBe(true)
+    await expect(controller.attach?.(remoteId)).resolves.toBe(false)
+    await expect(controller.serializeProviderBuffer?.('daemon-pty')).resolves.toMatchObject({
+      data: 'local history'
+    })
+    await expect(controller.serializeProviderBuffer?.(remoteId)).resolves.toMatchObject({
+      data: 'remote history'
+    })
+    expect(local.write).toHaveBeenCalledExactlyOnceWith('daemon-pty', 'local input')
+    expect(remote.write).toHaveBeenCalledExactlyOnceWith(remoteId, 'remote input')
+    expect(localClear).toHaveBeenCalledExactlyOnceWith('daemon-pty')
+    expect(remoteClear).toHaveBeenCalledExactlyOnceWith(remoteId)
+    expect(attach).toHaveBeenCalledExactlyOnceWith('daemon-pty')
+
+    unregisterSshPtyProvider('ssh-a')
+    expect(controller.write(remoteId, 'disconnected input', 'driving')).toBe(false)
+    await expect(controller.probePtyLiveness?.(remoteId)).resolves.toBeNull()
+    expect(local.write).toHaveBeenCalledTimes(1)
+  })
+
+  it('rejects renderer input when no renderer owns the registration', async () => {
+    const daemon = installObservableDaemonTestProvider()
+    const runtime = new OrcaRuntimeService()
+    setPtyOwnership('daemon-pty', null)
+    await registerHeadlessPtyRuntime(runtime)
+
+    getPtyWriteListener()(mainWindowIpcEvent, { id: 'daemon-pty', data: 'untrusted' })
+    expect(
+      handlers.get('pty:writeAccepted')?.(mainWindowIpcEvent, {
+        id: 'daemon-pty',
+        data: 'untrusted'
+      })
+    ).toBe(false)
+    expect(daemon.write).not.toHaveBeenCalled()
+    expect(mainWindow.webContents.send).not.toHaveBeenCalled()
+  })
+
+  it('detaches desktop lifecycle listeners and restores delivery after headless re-registration', async () => {
+    vi.useFakeTimers()
+    const daemon = installObservableDaemonTestProvider()
+    const provider = getLocalPtyProvider()
+    const subscribe = vi.mocked(provider.onData).getMockImplementation()
+    if (!subscribe) {
+      throw new Error('missing daemon data subscription')
+    }
+    const unsubscribe = vi.fn()
+    const onDataSubscribe = vi.spyOn(provider, 'onData').mockImplementation((listener) => {
+      const dispose = subscribe(listener)
+      return () => {
+        unsubscribe()
+        dispose()
+      }
+    })
+    const runtime = new OrcaRuntimeService()
+    const onData = vi.spyOn(runtime, 'onPtyData').mockReturnValue(6)
+    const rendererEvents = new EventEmitter()
+    mainWindow.webContents.on.mockImplementation((event, listener) =>
+      rendererEvents.on(event, listener)
+    )
+    mainWindow.webContents.removeListener.mockImplementation((event, listener) =>
+      rendererEvents.removeListener(event, listener)
+    )
+    const renderer = {
+      ...mainWindow,
+      webContents: Object.assign(mainWindow.webContents, { id: 1 })
+    }
+    registerPtyHandlers(renderer, runtime)
+    expect(rendererEvents.listenerCount('did-finish-load')).toBe(1)
+    expect(rendererEvents.listenerCount('render-process-gone')).toBe(2)
+
+    await registerHeadlessPtyRuntime(runtime)
+    expect(rendererEvents.eventNames()).toEqual([])
+    expect(onDataSubscribe).toHaveBeenCalledTimes(2)
+    expect(unsubscribe).toHaveBeenCalledOnce()
+    mainWindow.webContents.send.mockClear()
+    daemon.emitData('daemon-pty', 'output')
+    vi.advanceTimersByTime(20)
+    expect(onData).toHaveBeenCalledTimes(1)
+    expect(mainWindow.webContents.send).not.toHaveBeenCalled()
+
+    registerPtyHandlers(renderer, runtime)
+    expect(unsubscribe).toHaveBeenCalledTimes(2)
+    const ready = onMock.mock.calls.findLast(
+      ([channel]) => channel === 'pty:rendererDispatcherReady'
+    )?.[1]
+    ready(mainWindowIpcEvent)
+    daemon.emitData('daemon-pty', 'output')
+    vi.advanceTimersByTime(20)
+    expect(onData).toHaveBeenCalledTimes(2)
+    expect(rendererEvents.listenerCount('did-finish-load')).toBe(1)
+    expect(rendererEvents.listenerCount('render-process-gone')).toBe(2)
+    expect(mainWindow.webContents.send).toHaveBeenCalledWith(
+      'pty:data',
+      expect.objectContaining({ id: 'daemon-pty', data: 'output' })
+    )
+  })
+})
diff --git a/src/main/ipc/pty/runtime/controller-deps.ts b/src/main/ipc/pty/runtime/controller-deps.ts
index db55b637e57..a2dcc21bada 100644
--- a/src/main/ipc/pty/runtime/controller-deps.ts
+++ b/src/main/ipc/pty/runtime/controller-deps.ts
@@ -1,4 +1,4 @@
-import type { BrowserWindow } from 'electron'
+import type { PtyRendererDelivery } from '../session'
 import type { OrcaRuntimeService } from '../../../runtime/orca-runtime'
 import type { Store } from '../../../persistence'
 import type { IPtyProvider } from '../../../providers/types'
@@ -31,7 +31,6 @@ export type PtyRuntimeControllerDeps = {
     providerSession?: AgentProviderSessionMetadata
     target: CodexAccountSelectionTarget
     launchEnv?: NodeJS.ProcessEnv
-    workspacePath?: string
   }) => PreparedCodexResumeHome | null
   resolveCodexResumeLaunch: (
     command: string | undefined,
@@ -82,8 +81,7 @@ export type PtyRuntimeControllerDeps = {
   }
   trustedTerminalHandleEnv: Set<string>
   retiredRejectedPtyIds: Map<string, NodeJS.Timeout>
-  reversibleStopOwnersByPtyId: Map<string, number>
-  mainWindow: BrowserWindow
+  mainWindow?: PtyRendererDelivery
   transitionSpawnHiddenRendererPtyDeliveryState?: (id: string, hidden: boolean) => void
   syncPtyBackgroundedDelivery?: (id: string, caller: string) => void
 }
diff --git a/src/main/ipc/pty/runtime/controller.ts b/src/main/ipc/pty/runtime/controller.ts
index 8512bc7c16b..4013e06e37f 100644
--- a/src/main/ipc/pty/runtime/controller.ts
+++ b/src/main/ipc/pty/runtime/controller.ts
@@ -4,13 +4,13 @@ import type { PtyRuntimeControllerDeps } from './controller-deps'
 import { spawnPtyFromRuntimeController } from './spawn'
 import {
   killPtyFromRuntimeController,
-  markReversibleStopsFromRuntimeController,
   retireRejectedPtyFromRuntimeController,
   stopAndWaitPtyFromRuntimeController
 } from './kill'
 import {
   attachPtyFromRuntimeController,
   clearBufferFromRuntimeController,
+  resetInputModesFromRuntimeController,
   confirmForegroundProcessFromRuntimeController,
   confirmShellForegroundFromRuntimeController,
   getCwdFromRuntimeController,
@@ -27,6 +27,7 @@ import {
   waitForRendererSerializerFromRuntimeController,
   writePtyFromRuntimeController
 } from './operations'
+import { recordUnconfirmedExplicitSshStop } from './undelivered-ssh-kill'
 import { supportsForegroundProcessEvidenceFromRuntimeController } from './foreground-process-evidence-capability'
 import {
   listProcessesFromRuntimeController,
@@ -44,9 +45,9 @@ export function installPtyRuntimeController(deps: PtyRuntimeControllerDeps): voi
     },
     adoptStablePane,
     spawn: async (args) => spawnPtyFromRuntimeController(deps, args),
-    write: (ptyId, data) => writePtyFromRuntimeController(ptyId, data),
-    writeWithSettlement: (ptyId, data) =>
-      writePtyFromRuntimeController(ptyId, data, { waitForSettlement: true }),
+    write: (ptyId, data, inputKind) => writePtyFromRuntimeController(deps, ptyId, data, inputKind),
+    writeWithSettlement: (ptyId, data, inputKind) =>
+      writePtyFromRuntimeController(deps, ptyId, data, inputKind, { waitForSettlement: true }),
     probePtyLiveness: (ptyId) => probePtyLivenessFromRuntimeController(deps, ptyId),
     // Why: subscriber-driven ingestion for daemon sessions no renderer pane
     // ever attached. Local daemon sessions only — SSH panes have their own
@@ -56,8 +57,13 @@ export function installPtyRuntimeController(deps: PtyRuntimeControllerDeps): voi
     kill: (ptyId) => killPtyFromRuntimeController(deps, ptyId),
     retireRejectedPty: (ptyId, stopConfirmed) =>
       retireRejectedPtyFromRuntimeController(deps, ptyId, stopConfirmed),
-    markReversibleStops: (ptyIds) => markReversibleStopsFromRuntimeController(deps, ptyIds),
     stopAndWait: (ptyId, opts) => stopAndWaitPtyFromRuntimeController(deps, ptyId, opts),
+    recordUnconfirmedStop: (ptyId) =>
+      recordUnconfirmedExplicitSshStop({
+        store: deps.store,
+        ptyId,
+        reversible: runtime?.intentionalPtyStops?.isReversibleStopInFlight(ptyId) ?? false
+      }),
     getForegroundProcess: (ptyId) => getForegroundProcessFromRuntimeController(ptyId),
     inspectProcess: (ptyId, options) => inspectProcessFromRuntimeController(ptyId, options),
     confirmForegroundProcess: (ptyId) => confirmForegroundProcessFromRuntimeController(ptyId),
@@ -65,6 +71,7 @@ export function installPtyRuntimeController(deps: PtyRuntimeControllerDeps): voi
     getCwd: (ptyId) => getCwdFromRuntimeController(ptyId),
     hasChildProcesses: (ptyId) => hasChildProcessesFromRuntimeController(ptyId),
     clearBuffer: (ptyId) => clearBufferFromRuntimeController(deps, ptyId),
+    resetInputModes: (ptyId) => resetInputModesFromRuntimeController(deps, ptyId),
     hasPty: (ptyId) => hasPtyFromRuntimeController(deps, ptyId),
     listProcesses: (connectionId, opts) =>
       listProcessesFromRuntimeController(deps, connectionId, opts),
diff --git a/src/main/ipc/pty/runtime/kill.ts b/src/main/ipc/pty/runtime/kill.ts
index 98bdc1e97ae..edbd12b0b18 100644
--- a/src/main/ipc/pty/runtime/kill.ts
+++ b/src/main/ipc/pty/runtime/kill.ts
@@ -19,8 +19,7 @@ export function killPtyFromRuntimeController(
     rememberSyntheticKillExit,
     sendPtyExitToRenderer,
     finishPtyShutdown,
-    retiredRejectedPtyIds,
-    reversibleStopOwnersByPtyId
+    retiredRejectedPtyIds
   } = deps
   runtime?.markPtyStopRequested?.(ptyId)
   let connectionId: string | null | undefined = ptyOwnership.get(ptyId)
@@ -31,7 +30,7 @@ export function killPtyFromRuntimeController(
       store,
       ptyId,
       connectionId,
-      reversible: reversibleStopOwnersByPtyId.has(ptyId),
+      reversible: runtime?.intentionalPtyStops?.isReversibleStopInFlight(ptyId) ?? false,
       incarnationId
     })
   }
@@ -184,31 +183,6 @@ export function retireRejectedPtyFromRuntimeController(
   })
 }
 
-export function markReversibleStopsFromRuntimeController(
-  deps: PtyRuntimeControllerDeps,
-  ptyIds: readonly string[]
-): () => void {
-  const { reversibleStopOwnersByPtyId } = deps
-  for (const ptyId of ptyIds) {
-    reversibleStopOwnersByPtyId.set(ptyId, (reversibleStopOwnersByPtyId.get(ptyId) ?? 0) + 1)
-  }
-  let released = false
-  return () => {
-    if (released) {
-      return
-    }
-    released = true
-    for (const ptyId of ptyIds) {
-      const owners = (reversibleStopOwnersByPtyId.get(ptyId) ?? 0) - 1
-      if (owners > 0) {
-        reversibleStopOwnersByPtyId.set(ptyId, owners)
-      } else {
-        reversibleStopOwnersByPtyId.delete(ptyId)
-      }
-    }
-  }
-}
-
 /**
  * Deliberately records no undelivered-stop intent, unlike `killPtyFromRuntimeController`.
  *
diff --git a/src/main/ipc/pty/runtime/operations.ts b/src/main/ipc/pty/runtime/operations.ts
index 703fa009b7d..c555c0b3102 100644
--- a/src/main/ipc/pty/runtime/operations.ts
+++ b/src/main/ipc/pty/runtime/operations.ts
@@ -12,16 +12,28 @@ import {
   writeUnverifiable,
   type WriteSettlement
 } from '../../../../shared/pty-write-settlement'
+import type { TerminalInputKind } from '../../../../shared/terminal-input-kind'
+
+type RuntimeWriteDeps = Pick<PtyRuntimeControllerDeps, 'runtime'>
 
-export function writePtyFromRuntimeController(ptyId: string, data: string): boolean
 export function writePtyFromRuntimeController(
+  deps: RuntimeWriteDeps,
   ptyId: string,
   data: string,
+  inputKind: TerminalInputKind
+): boolean
+export function writePtyFromRuntimeController(
+  deps: RuntimeWriteDeps,
+  ptyId: string,
+  data: string,
+  inputKind: TerminalInputKind,
   options: { waitForSettlement: true }
 ): WriteSettlement | Promise<WriteSettlement>
 export function writePtyFromRuntimeController(
+  deps: RuntimeWriteDeps,
   ptyId: string,
   data: string,
+  inputKind: TerminalInputKind,
   options?: { waitForSettlement: true }
 ): boolean | WriteSettlement | Promise<WriteSettlement> {
   let provider: IPtyProvider
@@ -36,6 +48,7 @@ export function writePtyFromRuntimeController(
     if (!provider.writeWithSettlement) {
       return writeRefused('provider_cannot_settle')
     }
+    deps.runtime?.terminalRunFacts?.recordInput(ptyId, inputKind, data)
     try {
       return provider.writeWithSettlement(ptyId, data)
     } catch {
@@ -43,6 +56,7 @@ export function writePtyFromRuntimeController(
       return writeUnverifiable('provider_threw_after_handoff', true)
     }
   }
+  deps.runtime?.terminalRunFacts?.recordInput(ptyId, inputKind, data)
   try {
     return provider.write(ptyId, data) !== false
   } catch {
@@ -169,7 +183,9 @@ export async function clearBufferFromRuntimeController(
   ptyId: string
 ): Promise<void> {
   // Why: desktop xterm and daemon/SSH providers hold separate buffers; clear both so mobile resubscribe can't resurrect cleared history.
-  deps.mainWindow.webContents.send('pty:clearBuffer:request', { ptyId })
+  if (deps.mainWindow && !deps.mainWindow.isDestroyed()) {
+    deps.mainWindow.webContents.send('pty:clearBuffer:request', { ptyId })
+  }
   try {
     await getProviderForPty(ptyId).clearBuffer(ptyId)
   } catch {
@@ -177,6 +193,21 @@ export async function clearBufferFromRuntimeController(
   }
 }
 
+export async function resetInputModesFromRuntimeController(
+  deps: PtyRuntimeControllerDeps,
+  ptyId: string
+): Promise<void> {
+  // Why: a remote client's reset must also ground this host window's view of the pane.
+  if (deps.mainWindow && !deps.mainWindow.isDestroyed()) {
+    deps.mainWindow.webContents.send('pty:resetInputModes:request', { ptyId })
+  }
+  try {
+    await getProviderForPty(ptyId).resetInputModes(ptyId)
+  } catch {
+    /* best effort: an older daemon or relay rejects the request */
+  }
+}
+
 const settledLocalPtyProviderStartups = new WeakSet<Promise<void>>()
 const watchedLocalPtyProviderStartups = new WeakSet<Promise<void>>()
 
diff --git a/src/main/ipc/pty/runtime/spawn-commit-run-facts.test.ts b/src/main/ipc/pty/runtime/spawn-commit-run-facts.test.ts
new file mode 100644
index 00000000000..5701b9f82c9
--- /dev/null
+++ b/src/main/ipc/pty/runtime/spawn-commit-run-facts.test.ts
@@ -0,0 +1,147 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeWithRuntimeId } from '../../../runtime/orca-runtime-runtime-id'
+import { TerminalIntentionalStops } from '../../../runtime/terminal-intentional-stops'
+import { TerminalRunFactsRegister } from '../../../runtime/terminal-run-facts'
+import { ptySizes } from '../delivery/visibility-state'
+import { ptyIncarnationById, ptyOwnership } from '../provider/ownership-state'
+import { commitRuntimePtySpawn } from './spawn-commit'
+import { createRuntimePtySpawnState, type RuntimePtySpawnArgs } from './spawn-state'
+import type { PtyRuntimeControllerDeps } from './controller-deps'
+
+const PTY_ID = 'orca-pty-run-facts'
+const INCARNATION_ID = 'inc-run-facts'
+
+const ADOPTED = {
+  disposition: 'adopted',
+  owner: {
+    claim: { kind: 'terminal' },
+    generation: 'g1',
+    phase: 'live',
+    ptyId: PTY_ID,
+    surface: { worktreeId: 'wt-1', tabId: 'tab-1', leafId: 'leaf-1', terminalHandle: 'h1' }
+  }
+}
+
+async function commit(
+  result: Record<string, unknown>,
+  facts = new TerminalRunFactsRegister(),
+  intentionalPtyStops = new TerminalIntentionalStops(),
+  prepare?: (ctx: ReturnType<typeof createRuntimePtySpawnState>) => void
+) {
+  const runtime = {
+    terminalRunFacts: facts,
+    intentionalPtyStops,
+    // Why the real method: the case under test is what the runtime does with each commit.
+    noteTerminalSpawnCommit: OrcaRuntimeWithRuntimeId.prototype.noteTerminalSpawnCommit,
+    registerPreAllocatedHandleForPty: vi.fn(),
+    registerPty: vi.fn(),
+    cancelPendingPtyRegistration: vi.fn(),
+    reflowHeadlessTerminalToPtyGrid: vi.fn(),
+    seedHeadlessTerminal: vi.fn(),
+    noteTerminalSpawnCommand: vi.fn()
+  }
+  const ports = { runtime, store: undefined, options: {}, sendPtySpawnedToRenderer: vi.fn() }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the commit reads only the ports above; store-less deps skip every persistence branch.
+  const deps = ports as unknown as PtyRuntimeControllerDeps
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a worktree-less spawn needs only its grid.
+  const args = { cols: 120, rows: 40 } as unknown as RuntimePtySpawnArgs
+  const ctx = createRuntimePtySpawnState(deps, args)
+  const spawned = { id: PTY_ID, incarnationId: INCARNATION_ID, ...result }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: each case sets the spawn-result fields the commit reads.
+  ctx.result = spawned as unknown as typeof ctx.result
+  prepare?.(ctx)
+  await commitRuntimePtySpawn(ctx)
+  return facts.read(PTY_ID, INCARNATION_ID)
+}
+
+describe('runtime spawn commit: run facts', () => {
+  afterEach(() => {
+    ptySizes.delete(PTY_ID)
+    ptyOwnership.delete(PTY_ID)
+    ptyIncarnationById.delete(PTY_ID)
+  })
+
+  it('records a new process as a fresh spawn', async () => {
+    expect((await commit({})).freshSpawn).toBe(true)
+  })
+
+  it('never reads an SSH adoption that omits isReattach as fresh', async () => {
+    expect((await commit({ agentSessionEnsure: ADOPTED })).freshSpawn).toBe(false)
+  })
+
+  it('never reads a cold restore as fresh', async () => {
+    const coldRestore = { scrollback: 'prior output', cwd: '/tmp' }
+
+    expect((await commit({ coldRestore })).freshSpawn).toBe(false)
+  })
+
+  it('keeps a process run facts when the same incarnation commits again', async () => {
+    const facts = new TerminalRunFactsRegister()
+    await commit({}, facts)
+    facts.recordInput(PTY_ID, 'driving', 'ls\r', 100)
+
+    expect(await commit({ isReattach: true }, facts)).toEqual({
+      freshSpawn: true,
+      firstUserInputAt: 100
+    })
+  })
+
+  it.each([
+    { spawn: 'new process', result: {} },
+    { spawn: 'adoption', result: { agentSessionEnsure: ADOPTED } }
+  ])('lets a committed $spawn supersede a landed stop that no exit pinned', async ({ result }) => {
+    const stops = new TerminalIntentionalStops()
+    stops.mark(PTY_ID, 'reversible', null)(true)
+
+    await commit(result, new TerminalRunFactsRegister(), stops)
+
+    expect(stops.claimExit(PTY_ID, INCARNATION_ID)).toEqual([])
+  })
+
+  it('records nothing for a spawn discarded because its binding save failed', async () => {
+    const facts = new TerminalRunFactsRegister()
+    const stops = new TerminalIntentionalStops()
+    stops.mark(PTY_ID, 'reversible', null)(true)
+    const persistPtyBinding = vi.fn().mockRejectedValue(new Error('disk full'))
+
+    await expect(
+      commit({}, facts, stops, (ctx) => {
+        ctx.provider = { ...ctx.provider, shutdown: vi.fn().mockResolvedValue(undefined) }
+        ctx.hostSessionBinding = {
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the commit calls only persistPtyBinding on this store.
+          store: { persistPtyBinding } as unknown as NonNullable<
+            typeof ctx.hostSessionBinding
+          >['store'],
+          worktreeId: 'wt-1',
+          tabId: 'tab-1',
+          leafId: 'leaf-1'
+        }
+      })
+    ).rejects.toThrow()
+
+    expect(persistPtyBinding).toHaveBeenCalledOnce()
+    expect(facts.read(PTY_ID, INCARNATION_ID).freshSpawn).toBe(false)
+    expect(stops.claimExit(PTY_ID, INCARNATION_ID)).toEqual(['reversible'])
+  })
+
+  it.each([
+    { spawn: 'new process', result: {} },
+    { spawn: 'adoption', result: { agentSessionEnsure: ADOPTED } }
+  ])('records nothing for a $spawn that exited during start', async ({ result }) => {
+    const facts = new TerminalRunFactsRegister()
+    const stops = new TerminalIntentionalStops()
+    stops.mark(PTY_ID, 'reversible', null)(true)
+
+    await expect(
+      commit(result, facts, stops, (ctx) => {
+        ctx.args.worktreeId = 'wt-1'
+        ctx.deps.runtime!.registerPty = vi.fn(() => {
+          throw new Error('agent_session_exited_during_start')
+        })
+      })
+    ).rejects.toThrow('agent_session_exited_during_start')
+
+    expect(facts.read(PTY_ID, INCARNATION_ID).freshSpawn).toBe(false)
+    expect(stops.claimExit(PTY_ID, INCARNATION_ID)).toEqual(['reversible'])
+  })
+})
diff --git a/src/main/ipc/pty/runtime/spawn-commit.ts b/src/main/ipc/pty/runtime/spawn-commit.ts
index 09d41460263..f326200cabc 100644
--- a/src/main/ipc/pty/runtime/spawn-commit.ts
+++ b/src/main/ipc/pty/runtime/spawn-commit.ts
@@ -1,5 +1,5 @@
 import { isValidTerminalTabId } from '../../../../shared/terminal-tab-id'
-import { ptyOwnership, ptyIncarnationById, deletePtyOwnership } from '../provider/ownership-state'
+import { ptyOwnership, ptyIncarnationById } from '../provider/ownership-state'
 import { ptySizes } from '../delivery/visibility-state'
 import { commitRuntimePtySize } from './spawn-commit-pty-size'
 import {
@@ -16,13 +16,8 @@ import {
   rendererSerializerReadiness
 } from '../pane/serializer-state'
 import { seedTerminalRestoreRecordsFromSpawnResult } from '../pane/agent-session-owners'
-import { track } from '../../../telemetry/client'
-import { getCohortAtEmit } from '../../../telemetry/cohort-classifier'
-import {
-  agentKindSchema,
-  launchSourceSchema,
-  requestKindSchema
-} from '../../../../shared/telemetry-events'
+import { seedHeadlessTerminalFromSpawnResult } from '../pane/terminal-spawn-restore'
+import { recordPtySpawnTelemetry } from '../pane/spawn-telemetry'
 import { persistAdmittedStablePaneBinding } from '../pane/stable-owner'
 import { claimSshPaneLease } from '../pane/ssh-pane-lease-claim'
 import {
@@ -31,17 +26,34 @@ import {
 } from '../../../runtime/terminal-model-query-authority'
 import { toSshExecutionHostId } from '../../../../shared/execution-host'
 import { createTerminalSessionStateSaveFailureMessage } from '../../../../shared/terminal-session-state-save-failure'
-import { clearProviderPtyState } from '../provider/state-cleanup'
 import { resolvePaneSpawnReservation } from '../pane/spawn-reservation'
 import { admitProviderReattachLaunchIdentity } from '../pane/launch-authority'
 import { spawnCommitBindingOrigin } from '../../../persistence/loading-store/pty-binding-span'
 import type { RuntimePtySpawnState } from './spawn-state'
+import {
+  admitPtyReattachOwnership,
+  discardUnpersistedPtySpawn,
+  registerPersistedPtySpawn
+} from '../pane/spawn-registration'
 
 export async function commitRuntimePtySpawn(ctx: RuntimePtySpawnState) {
   const args = ctx.args
+  admitPtyReattachOwnership(ctx.deps.runtime, ctx.result, args.connectionId)
   const providerReattachLaunchIdentity = admitProviderReattachLaunchIdentity(ctx.result)
+  if (
+    isNativeWindowsLocalPtySpawn({
+      connectionId: args.connectionId,
+      cwd: args.cwd,
+      shellOverride: ctx.daemonShellOverride
+    })
+  ) {
+    markNativeWindowsConptyPty(ctx.result.id)
+  }
+  // Seed before the first disk await so live output appends to the restored history.
+  seedHeadlessTerminalFromSpawnResult(ctx.deps.runtime, ctx.result, ctx.spawnIdentityPaneKey)
+  seedTerminalRestoreRecordsFromSpawnResult(ctx.deps.runtime, ctx.result)
   try {
-    ctx.stablePaneBindingPersisted = persistAdmittedStablePaneBinding({
+    ctx.stablePaneBindingPersisted = await persistAdmittedStablePaneBinding({
       store: ctx.hostSessionBinding?.store,
       owner: ctx.stablePaneOwner,
       result: ctx.result,
@@ -54,7 +66,7 @@ export async function commitRuntimePtySpawn(ctx: RuntimePtySpawnState) {
       throw error
     }
     console.error('[pty] failed to persist runtime PTY binding after attach:', error)
-    throw Object.assign(new Error(createTerminalSessionStateSaveFailureMessage()), {
+    throw Object.assign(new Error(createTerminalSessionStateSaveFailureMessage(error)), {
       agentSessionOperationOutcome: 'unknown' as const
     })
   }
@@ -63,12 +75,9 @@ export async function commitRuntimePtySpawn(ctx: RuntimePtySpawnState) {
     // reply omits isReattach; derive it once so the size commit and the reservation agree.
     const adoptedResult = { ...ctx.result, isReattach: true }
     const owner = ctx.result.agentSessionEnsure.owner
-    ptyOwnership.set(ctx.result.id, args.connectionId ?? ptyOwnership.get(ctx.result.id) ?? null)
-    ctx.deps.runtime?.registerPreAllocatedHandleForPty(ctx.result.id, owner.surface.terminalHandle)
-    if (ctx.result.incarnationId) {
-      ptyIncarnationById.set(ctx.result.id, ctx.result.incarnationId)
-    }
-    ctx.deps.runtime?.registerPty(
+    const rejectedRegistration = registerPersistedPtySpawn(
+      ctx.deps.runtime,
+      ctx.hostSessionBinding?.store ?? ctx.deps.store,
       ctx.result.id,
       owner.surface.worktreeId,
       args.connectionId ?? null,
@@ -80,6 +89,19 @@ export async function commitRuntimePtySpawn(ctx: RuntimePtySpawnState) {
         ...(providerReattachLaunchIdentity ? { providerReattachLaunchIdentity } : {})
       }
     )
+    if (rejectedRegistration) {
+      await rejectedRegistration
+    }
+    // Why here: an adoption returns before the commit site below.
+    ctx.deps.runtime?.noteTerminalSpawnCommit?.(
+      ctx.result,
+      ctx.hostSessionBinding?.expectedSourceBinding
+    )
+    ptyOwnership.set(ctx.result.id, args.connectionId ?? ptyOwnership.get(ctx.result.id) ?? null)
+    ctx.deps.runtime?.registerPreAllocatedHandleForPty(ctx.result.id, owner.surface.terminalHandle)
+    if (ctx.result.incarnationId) {
+      ptyIncarnationById.set(ctx.result.id, ctx.result.incarnationId)
+    }
     if (!args.connectionId) {
       ctx.deps.options?.onCodexHomePtySpawned?.({
         id: ctx.result.id,
@@ -108,95 +130,41 @@ export async function commitRuntimePtySpawn(ctx: RuntimePtySpawnState) {
       agentSessionEnsure: ctx.result.agentSessionEnsure
     }
   }
-  ptyOwnership.set(ctx.result.id, args.connectionId ?? null)
-  if (ctx.result.incarnationId) {
-    ptyIncarnationById.set(ctx.result.id, ctx.result.incarnationId)
-  }
-  // Why: record the native-Windows-local-PTY determination before any byte reaches the emulator, so its ConPTY DA1 override exists from byte zero.
-  if (
-    isNativeWindowsLocalPtySpawn({
-      connectionId: args.connectionId,
-      cwd: args.cwd,
-      shellOverride: ctx.daemonShellOverride
-    })
-  ) {
-    markNativeWindowsConptyPty(ctx.result.id)
-  }
-  const persistSshLease = (): void =>
-    claimSshPaneLease({
-      store: ctx.deps.store,
-      connectionId: args.connectionId,
-      ptyId: ctx.result.id,
-      worktreeId: args.worktreeId,
-      tabId: args.tabId,
-      leafId: args.leafId
-    })
-  if (!ctx.hostSessionBinding) {
-    persistSshLease()
-  }
-  commitRuntimePtySize(ctx, ctx.result)
-  if (ctx.effectiveSessionAppId !== undefined && ctx.effectiveSessionAppId !== ctx.result.id) {
-    ptySizes.delete(ctx.effectiveSessionAppId)
-  }
-  recordCodexPaneAccountForSpawn({
-    ptyId: ctx.result.id,
-    isDaemonHostSpawn: ctx.isDaemonHostSpawn,
-    isReattach: ctx.result.isReattach === true,
-    pinnedByResume: ctx.codexResumeHomeSelected,
-    launchCodexHomePath: ctx.selectedCodexHomePath,
-    launchEnv: args.env,
-    target: ctx.codexSelectionTarget,
-    settings: ctx.deps.getSettings?.()
-  })
   if (ctx.hostSessionBinding && !ctx.stablePaneBindingPersisted) {
     try {
+      const { store, worktreeId, tabId, leafId, expectedSourceBinding } = ctx.hostSessionBinding
       const binding = {
-        worktreeId: ctx.hostSessionBinding.worktreeId,
-        tabId: ctx.hostSessionBinding.tabId,
-        leafId: ctx.hostSessionBinding.leafId,
+        worktreeId,
+        tabId,
+        leafId,
         ptyId: ctx.result.id,
         hostAdmittedMembership: true,
         ...(ctx.result.incarnationId ? { incarnationId: ctx.result.incarnationId } : {}),
         ...(ctx.cwd ? { startupCwd: ctx.cwd } : {}),
-        ...(ctx.hostSessionBinding.expectedSourceBinding
-          ? { expectedSourceBinding: ctx.hostSessionBinding.expectedSourceBinding }
-          : {}),
-        origin: spawnCommitBindingOrigin(ctx.result, ctx.hostSessionBinding.expectedSourceBinding)
+        ...(expectedSourceBinding ? { expectedSourceBinding } : {}),
+        origin: spawnCommitBindingOrigin(ctx.result, expectedSourceBinding)
       }
       const persisted = args.connectionId
-        ? ctx.hostSessionBinding.store.persistPtyBinding(
-            binding,
-            toSshExecutionHostId(args.connectionId)
-          )
-        : ctx.hostSessionBinding.store.persistPtyBinding(binding)
+        ? await store.persistPtyBinding(binding, toSshExecutionHostId(args.connectionId))
+        : await store.persistPtyBinding(binding)
       if (persisted === false) {
         throw new Error('terminal_split_source_not_found')
       }
     } catch (err) {
       console.error('[pty] failed to persist runtime PTY binding after spawn:', err)
-      if (!ctx.result.isReattach) {
-        deletePtyOwnership(ctx.result.id)
-        try {
-          await ctx.provider.shutdown(ctx.result.id, { immediate: true })
-        } catch (shutdownErr) {
-          console.warn('[pty] failed to clean up PTY after persistence failure:', shutdownErr)
-        }
-        clearProviderPtyState(ctx.result.id)
-      }
+      await discardUnpersistedPtySpawn(ctx.provider, ctx.result)
       if (err instanceof Error && err.message === 'terminal_split_source_not_found') {
         throw err
       }
-      throw Object.assign(new Error(createTerminalSessionStateSaveFailureMessage()), {
+      throw Object.assign(new Error(createTerminalSessionStateSaveFailureMessage(err)), {
         agentSessionOperationOutcome: 'unknown' as const
       })
     }
-    persistSshLease()
-  }
-  if (args.preAllocatedHandle && !ctx.stablePaneOwner?.handle) {
-    ctx.deps.runtime?.registerPreAllocatedHandleForPty(ctx.result.id, args.preAllocatedHandle)
   }
   if (args.worktreeId) {
-    ctx.deps.runtime?.registerPty(
+    const rejectedRegistration = registerPersistedPtySpawn(
+      ctx.deps.runtime,
+      ctx.hostSessionBinding?.store ?? ctx.deps.store,
       ctx.result.id,
       args.worktreeId,
       args.connectionId ?? null,
@@ -217,10 +185,48 @@ export async function commitRuntimePtySpawn(ctx: RuntimePtySpawnState) {
         ? shouldSkipCodexHomeEnvForWindowsShell(ctx.daemonShellOverride, ctx.cwd)
         : undefined
     )
+    if (rejectedRegistration) {
+      await rejectedRegistration
+    }
   } else {
     // Why: non-worktree PTYs have no later surface-registration phase to clear admission intent.
     ctx.deps.runtime?.cancelPendingPtyRegistration?.(ctx.result.id, ctx.result.incarnationId)
   }
+  // Why after registration: a spawn discarded for a failed save or rejected for exiting during
+  // start must not record facts or end a stop.
+  ctx.deps.runtime?.noteTerminalSpawnCommit?.(
+    ctx.result,
+    ctx.hostSessionBinding?.expectedSourceBinding
+  )
+  if (args.preAllocatedHandle && !ctx.stablePaneOwner?.handle) {
+    ctx.deps.runtime?.registerPreAllocatedHandleForPty(ctx.result.id, args.preAllocatedHandle)
+  }
+  ptyOwnership.set(ctx.result.id, args.connectionId ?? null)
+  if (ctx.result.incarnationId) {
+    ptyIncarnationById.set(ctx.result.id, ctx.result.incarnationId)
+  }
+  claimSshPaneLease({
+    store: ctx.deps.store,
+    connectionId: args.connectionId,
+    ptyId: ctx.result.id,
+    worktreeId: args.worktreeId,
+    tabId: args.tabId,
+    leafId: args.leafId
+  })
+  commitRuntimePtySize(ctx, ctx.result)
+  if (ctx.effectiveSessionAppId !== undefined && ctx.effectiveSessionAppId !== ctx.result.id) {
+    ptySizes.delete(ctx.effectiveSessionAppId)
+  }
+  recordCodexPaneAccountForSpawn({
+    ptyId: ctx.result.id,
+    isDaemonHostSpawn: ctx.isDaemonHostSpawn,
+    isReattach: ctx.result.isReattach === true,
+    pinnedByResume: ctx.codexResumeHomeSelected,
+    launchCodexHomePath: ctx.selectedCodexHomePath,
+    launchEnv: args.env,
+    target: ctx.codexSelectionTarget,
+    settings: ctx.deps.getSettings?.()
+  })
   // Why: runtime-controller creates (headless serve, CLI, splits) adopt surviving daemon sessions too; without this seed their records stay blank.
   seedTerminalRestoreRecordsFromSpawnResult(ctx.deps.runtime, ctx.result)
   // Why: arms main's per-PTY Command Code output detector from the launch command (renderer startupCommand parity).
@@ -231,17 +237,7 @@ export async function commitRuntimePtySpawn(ctx: RuntimePtySpawnState) {
     markClaudePtySpawned(ctx.result.id)
   }
   if (args.telemetry && !ctx.stablePaneOwner) {
-    const agentKindParse = agentKindSchema.safeParse(args.telemetry.agent_kind)
-    const launchSourceParse = launchSourceSchema.safeParse(args.telemetry.launch_source)
-    const requestKindParse = requestKindSchema.safeParse(args.telemetry.request_kind)
-    if (agentKindParse.success && launchSourceParse.success && requestKindParse.success) {
-      track('agent_started', {
-        agent_kind: agentKindParse.data,
-        launch_source: launchSourceParse.data,
-        request_kind: requestKindParse.data,
-        ...getCohortAtEmit()
-      })
-    }
+    recordPtySpawnTelemetry(args.telemetry)
   }
   // Why: runtime-owned CLI PTYs bypass the renderer pty:spawn handler; record paneKey here too since hook titles and cache cleanup need this reverse lookup.
   const paneKey = rememberPaneKeyForPty(ctx.result.id, ctx.env?.ORCA_PANE_KEY)
diff --git a/src/main/ipc/pty/runtime/spawn-options.ts b/src/main/ipc/pty/runtime/spawn-options.ts
index 67c633560e9..3b50025a556 100644
--- a/src/main/ipc/pty/runtime/spawn-options.ts
+++ b/src/main/ipc/pty/runtime/spawn-options.ts
@@ -1,3 +1,5 @@
+import { getAppEnvironment } from '../../../../shared/app-environment'
+import { getLegacyOpenCodeEnvKeysToDelete } from '../../../opencode/legacy-shared-config-dir'
 import type { IPtyProvider, PtySpawnResult } from '../../../providers/types'
 import { LocalPtyProvider } from '../../../providers/local-pty-provider'
 import { makePaneKey, isTerminalLeafId } from '../../../../shared/stable-pane-id'
@@ -9,7 +11,7 @@ import {
   mergePtyEnvDeletions,
   removeCodexHomeDeletionRequests,
   getInheritedAgentHookEnvKeysToDelete,
-  getInheritedClaudeSessionStampEnvKeysToDelete
+  getInheritedAgentSessionStampEnvKeysToDelete
 } from '../host-env/pi-agent'
 import { promoteAgentTeamsShimPath, deleteRequestedEnvKeys } from '../host-env/path'
 import {
@@ -29,6 +31,7 @@ import {
   paneSpawnReservationsByOwnerKey
 } from '../pane/spawn-reservation'
 import type { RuntimePtySpawnState } from './spawn-state'
+import { applyAgentWorkspaceTrustToSpawn } from '../../../agent-workspace-trust-spawn'
 
 /** Headless spawns need the same host-side environment isolation as desktop spawns. */
 export async function buildRuntimePtySpawnOptions(
@@ -72,8 +75,12 @@ export async function buildRuntimePtySpawnOptions(
     // Why: disable old hosts without removing ORCA_REAL_* while their Windows shim remains on PATH.
     ctx.isDaemonHostSpawn || args.connectionId ? LEGACY_TERMINAL_SHIM_REMOTE_ENV_KEYS : [],
     ctx.isDaemonHostSpawn ? getInheritedAgentHookEnvKeysToDelete(ctx.env) : [],
+    // The daemon must judge its own inherited value; main may have a different config.
+    !args.connectionId && !ctx.isDaemonHostSpawn
+      ? getLegacyOpenCodeEnvKeysToDelete(ctx.env, getAppEnvironment().getPath('userData'))
+      : [],
     // Why: ungated, unlike the agent-hook keys — the local provider and the relay host also spread their own process.env into every spawn.
-    getInheritedClaudeSessionStampEnvKeysToDelete(ctx.env)
+    getInheritedAgentSessionStampEnvKeysToDelete(ctx.env)
   )
   if (ctx.skipCodexHomeEnv) {
     ctx.spawnOptions.envToDelete = mergePtyEnvDeletions(
@@ -107,6 +114,22 @@ export async function buildRuntimePtySpawnOptions(
   if (args.worktreeId !== undefined) {
     ctx.spawnOptions.worktreeId = args.worktreeId
   }
+  const trustWrite = applyAgentWorkspaceTrustToSpawn({
+    launchAgent: args.launchAgent,
+    worktreeId: args.worktreeId,
+    cwd: ctx.cwd,
+    store: ctx.deps.store,
+    isFreshLaunch: !ctx.preAdoptedStablePane && ctx.launchCommand !== undefined,
+    settings: ctx.deps.getSettings?.(),
+    env: ctx.env,
+    claudeAuth: ctx.claudeAuth,
+    wslDistro: ctx.expectedWslDistro,
+    connectionId: args.connectionId ?? null,
+    spawnOptions: ctx.spawnOptions
+  })
+  if (trustWrite) {
+    await trustWrite
+  }
   ctx.hadSessionSizeBeforeAttach =
     ctx.effectiveSessionAppId !== undefined ? ptySizes.has(ctx.effectiveSessionAppId) : false
   ctx.sessionSizeBeforeAttach =
diff --git a/src/main/ipc/pty/runtime/spawn-preflight-requested-shell.test.ts b/src/main/ipc/pty/runtime/spawn-preflight-requested-shell.test.ts
index 46f16081efa..a299327fc3f 100644
--- a/src/main/ipc/pty/runtime/spawn-preflight-requested-shell.test.ts
+++ b/src/main/ipc/pty/runtime/spawn-preflight-requested-shell.test.ts
@@ -43,7 +43,6 @@ function makeDeps(): PtyRuntimeControllerDeps {
     finishPtyShutdown,
     trustedTerminalHandleEnv: new Set(),
     retiredRejectedPtyIds: new Map(),
-    reversibleStopOwnersByPtyId: new Map(),
     // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only `operations.ts` (write/clearBuffer) reads `mainWindow`; the spawn preflight and option build never touch it, and a real BrowserWindow cannot exist in vitest.
     mainWindow: {} as BrowserWindow
   }
diff --git a/src/main/ipc/pty/runtime/spawn-preflight.ts b/src/main/ipc/pty/runtime/spawn-preflight.ts
index 2bd10feaab6..484f9166e4b 100644
--- a/src/main/ipc/pty/runtime/spawn-preflight.ts
+++ b/src/main/ipc/pty/runtime/spawn-preflight.ts
@@ -12,7 +12,6 @@ import {
   resolveCodexHomeAfterManagedAuthReadiness,
   shouldSkipCodexHomeEnvForWindowsShell,
   shouldStripInheritedOrcaCodexHome,
-  isCodexStatusHooksEnabled,
   codexHomePathsEqual
 } from '../host-env/codex-home'
 import { promoteAgentTeamsShimPath } from '../host-env/path'
@@ -137,8 +136,7 @@ export async function prepareRuntimePtySpawn(
         launchAgent: args.launchAgent,
         providerSession: args.resumeProviderSession,
         target: ctx.codexSelectionTarget,
-        launchEnv: args.env,
-        workspacePath: ctx.cwd
+        launchEnv: args.env
       })
   const codexResumeLaunch = codexResumePreparation
     ? await ctx.deps.resolveCodexResumeLaunch(args.command, codexResumePreparation)
@@ -188,10 +186,7 @@ export async function prepareRuntimePtySpawn(
     ctx.env = { ...ctx.env, ORCA_TERMINAL_HANDLE: args.preAllocatedHandle }
   }
   const selectLaunchCodexHome = async (): Promise<string | null> =>
-    (await ctx.deps.getSelectedCodexHomePath?.(ctx.codexSelectionTarget, ctx.env, {
-      workspacePath: ctx.cwd,
-      launchAgent: isTuiAgent(args.launchAgent) ? args.launchAgent : undefined
-    })) ?? null
+    (await ctx.deps.getSelectedCodexHomePath?.(ctx.codexSelectionTarget, ctx.env)) ?? null
   ctx.selectedCodexHomePath =
     !ctx.preAdoptedStablePane && !args.connectionId
       ? getCompatibleSelectedCodexHomePath(
@@ -219,17 +214,12 @@ export async function prepareRuntimePtySpawn(
       resolveCurrent: async () =>
         getCompatibleSelectedCodexHomePath(
           ctx.codexSelectionTarget,
-          (await ctx.deps.getSelectedCodexHomePath?.(ctx.codexSelectionTarget, ctx.env, {
-            workspacePath: ctx.cwd,
-            launchAgent: 'codex'
-          })) ?? null
+          (await ctx.deps.getSelectedCodexHomePath?.(ctx.codexSelectionTarget, ctx.env)) ?? null
         ),
       resolveAfterUnavailable: async (unavailableManagedHomePath) =>
         getCompatibleSelectedCodexHomePath(
           ctx.codexSelectionTarget,
           (await ctx.deps.getSelectedCodexHomePath?.(ctx.codexSelectionTarget, ctx.env, {
-            workspacePath: ctx.cwd,
-            launchAgent: 'codex',
             unavailableManagedHomePath
           })) ?? null
         )
@@ -286,7 +276,6 @@ export async function prepareRuntimePtySpawn(
         wslDistro: ctx.codexSelectionTarget.runtime === 'wsl' ? ctx.expectedWslDistro : null,
         agentStatusHooksEnabled: isAgentStatusHooksEnabled(ptySettings),
         disabledTuiAgents: ptySettings?.disabledTuiAgents,
-        codexStatusHooksEnabled: isCodexStatusHooksEnabled(ptySettings),
         networkProxySettings: ptySettings,
         routeBrowserOpensToClient: ctx.deps.runtime?.shouldRelayTerminalBrowserOpens?.(),
         deferGitConfigGuardToDaemon:
diff --git a/src/main/ipc/pty/runtime/undelivered-ssh-kill.ts b/src/main/ipc/pty/runtime/undelivered-ssh-kill.ts
index e41b1629097..45b80ea1f9e 100644
--- a/src/main/ipc/pty/runtime/undelivered-ssh-kill.ts
+++ b/src/main/ipc/pty/runtime/undelivered-ssh-kill.ts
@@ -1,6 +1,8 @@
 import type { Store } from '../../../persistence'
-import { ptyIncarnationById } from '../provider/ownership-state'
+import { parseAppSshPtyId } from '../../../providers/ssh-pty-id'
+import { ptyIncarnationById, ptyOwnership } from '../provider/ownership-state'
 import { getRelayPtyId } from '../provider/registry'
+import { isEpochScopedRelayPtyId } from '../../../../shared/ssh-pending-pty-kill'
 
 export type UndeliveredSshPtyKill = {
   store: Store | undefined
@@ -25,29 +27,43 @@ export type UndeliveredSshPtyKill = {
  *  - **reversible**: see above.
  *  - **no `connectionId`**: a local PTY's owner is this process, so a failed kill has no later host
  *    to ask; there is nothing to replay against.
- *  - **no incarnation**: the replay fence is the host-minted PTY incarnation, and a relay renumbers
- *    from `pty-1` on every start. An order we could never safely aim can only be discarded later,
- *    or worse, guessed at.
+ *  - **no incarnation on a legacy id**: a legacy relay renumbers from `pty-1` on every start, so
+ *    without the host-minted incarnation the order could never be safely aimed. A `pty2:` id is
+ *    epoch-scoped and names one process, so it is recorded without one.
  *  - **an id naming another connection**: `getRelayPtyId` throws on those, and this runs inside
  *    promise `.catch` handlers where that would surface as an unhandled rejection. */
-export function recordUndeliveredSshPtyKill(args: UndeliveredSshPtyKill): void {
+export function recordUndeliveredSshPtyKill(args: UndeliveredSshPtyKill): boolean {
   const { store, ptyId, connectionId } = args
   if (!store || !connectionId || args.reversible) {
-    return
-  }
-  const incarnationId = args.incarnationId ?? ptyIncarnationById.get(ptyId)
-  if (!incarnationId) {
-    return
+    return false
   }
   let relayPtyId: string
   try {
     relayPtyId = getRelayPtyId(connectionId, ptyId)
   } catch {
-    return
+    return false
+  }
+  const incarnationId = args.incarnationId ?? ptyIncarnationById.get(ptyId)
+  if (!incarnationId && !isEpochScopedRelayPtyId(relayPtyId)) {
+    return false
   }
   store.recordSshRemotePtyKillIntent(connectionId, relayPtyId, {
     requestedAt: args.now ?? Date.now(),
-    incarnationId,
+    ...(incarnationId ? { incarnationId } : {}),
     attempts: 0
   })
+  return true
+}
+
+/** Records the replay order for an explicit close whose stop went unconfirmed, before its follow-up
+ *  kill is sent, so the close receipt can promise the retry only when an order really exists. */
+export function recordUnconfirmedExplicitSshStop(args: {
+  store: Store | undefined
+  ptyId: string
+  reversible: boolean
+}): boolean {
+  return recordUndeliveredSshPtyKill({
+    ...args,
+    connectionId: ptyOwnership.get(args.ptyId) ?? parseAppSshPtyId(args.ptyId)?.connectionId
+  })
 }
diff --git a/src/main/ipc/pty/session.ts b/src/main/ipc/pty/session.ts
index 30c6735cde2..be666fc6248 100644
--- a/src/main/ipc/pty/session.ts
+++ b/src/main/ipc/pty/session.ts
@@ -1,4 +1,4 @@
-import type { BrowserWindow } from 'electron'
+import type { BrowserWindow, WebContents } from 'electron'
 import type { OrcaRuntimeService } from '../../runtime/orca-runtime'
 import type { Store } from '../../persistence'
 import type { GlobalSettings } from '../../../shared/global-settings-types'
@@ -10,7 +10,6 @@ import type {
   PtyRendererDeliveryStateReport
 } from '../../../shared/pty-renderer-delivery-health'
 import type { PtyRendererDeliveryDebugSnapshot } from './delivery/debug'
-import type { ReplacedPtyStop } from './delivery/exit'
 import { PtyProducerFlowController } from '../pty-producer-flow-control'
 import { PtyPendingDataDrainQueue, type PendingPtyData } from '../pty-pending-data-drain-queue'
 import type { SshPtyOutputIntake } from '../ssh-pty-output-intake'
@@ -58,8 +57,15 @@ export type PtyIpcSessionOptions = {
   onPtyExit?: (id: string, exitSequence: number) => void
 }
 
+export type PtyRendererDelivery = Pick<
+  BrowserWindow,
+  'isDestroyed' | 'isFocused' | 'isVisible' | 'isMinimized'
+> & {
+  webContents: Pick<WebContents, 'id' | 'isDestroyed' | 'send' | 'on' | 'removeListener'>
+}
+
 export type PtyIpcSession = {
-  mainWindow: BrowserWindow
+  mainWindow?: PtyRendererDelivery
   runtime?: OrcaRuntimeService
   store?: Store
   getSettings?: () => GlobalSettings
@@ -101,8 +107,6 @@ export type PtyIpcSession = {
     string,
     { cleanupTimer: NodeJS.Timeout; incarnationId: string | undefined }
   >
-  reversibleStopOwnersByPtyId: Map<string, number>
-  replacedPtyStopsById: Map<string, ReplacedPtyStop>
   retiredRejectedPtyIds: Map<string, NodeJS.Timeout>
   pendingSerializeRequests: Map<
     string,
@@ -182,7 +186,7 @@ const unsetSessionFn = (): never => {
 }
 
 export function createPtyIpcSession(args: {
-  mainWindow: BrowserWindow
+  mainWindow?: PtyRendererDelivery
   runtime?: OrcaRuntimeService
   store?: Store
   getSettings?: () => GlobalSettings
@@ -231,8 +235,6 @@ export function createPtyIpcSession(args: {
     sourceCreditPendingPtys: new Set(),
     backgroundedDeliverySyncByPty: new Map(),
     syntheticKillExitPtyIds: new Map(),
-    reversibleStopOwnersByPtyId: new Map(),
-    replacedPtyStopsById: new Map(),
     retiredRejectedPtyIds: new Map(),
     pendingSerializeRequests: new Map(),
     canSendPtyDataToRenderer: unsetSessionFn,
diff --git a/src/main/ipc/pty/spawn-options-agent-workspace-trust.test.ts b/src/main/ipc/pty/spawn-options-agent-workspace-trust.test.ts
new file mode 100644
index 00000000000..3a8096c5309
--- /dev/null
+++ b/src/main/ipc/pty/spawn-options-agent-workspace-trust.test.ts
@@ -0,0 +1,176 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ClaudeRuntimeAuthPreparation } from '../../claude-accounts/runtime-auth/runtime-auth-types'
+import { getDefaultSettings } from '../../../shared/constants'
+import type { TuiAgent } from '../../../shared/tui-agent'
+
+const applyAgentWorkspaceTrust = vi.hoisted(() =>
+  vi.fn<(preset: string, path: string, context: unknown) => Promise<object>>(async () => ({}))
+)
+vi.mock('../../agent-workspace-trust', () => ({ applyAgentWorkspaceTrust }))
+
+import { buildPtyIpcSpawnOptions } from './ipc/spawn-options'
+import { createPtyIpcSpawnState, type PtyIpcSpawnState } from './ipc/spawn-state'
+import type { AdoptStablePaneResult, PtySpawnIpcDeps } from './ipc/spawn-types'
+import { buildRuntimePtySpawnOptions } from './runtime/spawn-options'
+import { createRuntimePtySpawnState } from './runtime/spawn-state'
+import type { PtyRuntimeControllerDeps } from './runtime/controller-deps'
+
+type BuildInput = {
+  worktreeId?: string
+  cwd?: string
+  connectionId?: string
+  launchAgent?: TuiAgent
+  command?: string
+  restored?: boolean
+  claudeAuth?: ClaudeRuntimeAuthPreparation | null
+  wslDistro?: string | null
+}
+
+const RESTORED_PANE: AdoptStablePaneResult = {
+  result: { id: 'pty-restored' },
+  owner: { tabId: 'tab-1', leafId: 'leaf-1', ptyId: 'pty-restored' }
+}
+
+function notReachedByOptionBuilding(): never {
+  throw new Error('spawn option building must not call this dependency')
+}
+
+function makeDeps(): PtySpawnIpcDeps & PtyRuntimeControllerDeps {
+  return {
+    getSettings: () => ({ ...getDefaultSettings('/tmp'), agentWorkspaceTrustEnabled: true }),
+    getLocalPtyStartupPromise: notReachedByOptionBuilding,
+    getLocalPtyProviderStartupPromise: notReachedByOptionBuilding,
+    adoptStablePane: notReachedByOptionBuilding,
+    assertFolderWorkspacePtyPathUsable: notReachedByOptionBuilding,
+    resolvePtySpawnStartupCwd: notReachedByOptionBuilding,
+    localStartupCwdDirectoryExists: notReachedByOptionBuilding,
+    prepareCodexResumeHome: notReachedByOptionBuilding,
+    noCodexResumeLaunch: notReachedByOptionBuilding,
+    resolveCodexResumeLaunch: notReachedByOptionBuilding,
+    reconcileSharedRuntimeResumeHome: notReachedByOptionBuilding,
+    stripSequencedStartupResumeArgv: notReachedByOptionBuilding,
+    transitionSpawnHiddenRendererPtyDeliveryState: notReachedByOptionBuilding,
+    trustedTerminalHandleEnv: new Set(),
+    sendPtySpawnedToRenderer: notReachedByOptionBuilding,
+    syncPtyBackgroundedDelivery: notReachedByOptionBuilding,
+    stopReplacedPty: notReachedByOptionBuilding,
+    requestSerializedBuffer: notReachedByOptionBuilding,
+    shutdownProviderAndDetectExit: notReachedByOptionBuilding,
+    rememberSyntheticKillExit: notReachedByOptionBuilding,
+    rememberRetiredRejectedPty: notReachedByOptionBuilding,
+    sendPtyExitToRenderer: notReachedByOptionBuilding,
+    finishPtyShutdown: notReachedByOptionBuilding,
+    retiredRejectedPtyIds: new Map()
+  }
+}
+
+/** What preflight and env assembly leave for the option builders; both spawn states share it. */
+function seed(
+  ctx: Pick<
+    PtyIpcSpawnState,
+    'env' | 'cwd' | 'launchCommand' | 'claudeAuth' | 'expectedWslDistro' | 'preAdoptedStablePane'
+  >,
+  input: BuildInput
+): void {
+  ctx.env = { CLAUDE_CONFIG_DIR: '/cfg' }
+  ctx.cwd = input.cwd
+  ctx.launchCommand = input.command
+  ctx.claudeAuth = input.claudeAuth ?? null
+  ctx.expectedWslDistro = input.wslDistro ?? null
+  ctx.preAdoptedStablePane = input.restored ? RESTORED_PANE : null
+}
+
+async function build(route: 'renderer' | 'runtime', input: BuildInput) {
+  const args = {
+    cols: 80,
+    rows: 24,
+    worktreeId: input.worktreeId ?? 'repo-1::/repo/wt',
+    connectionId: input.connectionId,
+    launchAgent: input.launchAgent,
+    command: input.command
+  }
+  if (route === 'renderer') {
+    const ctx = createPtyIpcSpawnState(makeDeps(), args)
+    seed(ctx, input)
+    await buildPtyIpcSpawnOptions(ctx)
+    ctx.finishTerminalInstall()
+    return ctx.spawnOptions
+  }
+  const ctx = createRuntimePtySpawnState(makeDeps(), args)
+  seed(ctx, input)
+  await buildRuntimePtySpawnOptions(ctx)
+  ctx.finishTerminalInstall()
+  return ctx.spawnOptions
+}
+
+beforeEach(() => {
+  applyAgentWorkspaceTrust.mockReset()
+  applyAgentWorkspaceTrust.mockResolvedValue({})
+})
+
+describe.each(['renderer', 'runtime'] as const)('%s spawn builder agent trust', (route) => {
+  it('pre-trusts the workspace for a fresh agent launch with the final spawn context', async () => {
+    await build(route, {
+      launchAgent: 'codex',
+      command: 'codex',
+      wslDistro: 'Ubuntu'
+    })
+    expect(applyAgentWorkspaceTrust).toHaveBeenCalledWith('codex', '/repo/wt', {
+      env: expect.objectContaining({ CLAUDE_CONFIG_DIR: '/cfg' }),
+      claudeAuth: null,
+      wslDistro: 'Ubuntu',
+      connectionId: null
+    })
+  })
+
+  it('trusts Codex in a floating terminal at the resolved folder it starts in', async () => {
+    await build(route, {
+      worktreeId: 'global-floating-terminal',
+      cwd: '/Users/me',
+      launchAgent: 'codex',
+      command: 'codex'
+    })
+    expect(applyAgentWorkspaceTrust).toHaveBeenCalledWith('codex', '/Users/me', expect.anything())
+  })
+
+  it('holds the spawn until the trust write settles', async () => {
+    let settleTrust = (): void => {}
+    applyAgentWorkspaceTrust.mockReturnValueOnce(
+      new Promise((resolve) => {
+        settleTrust = () => resolve({})
+      })
+    )
+    let built = false
+    const building = build(route, { launchAgent: 'claude', command: 'claude' }).then(() => {
+      built = true
+    })
+    await new Promise((resolve) => setTimeout(resolve, 0))
+    expect(built).toBe(false)
+    settleTrust()
+    await building
+    expect(built).toBe(true)
+  })
+
+  it('keys on the declared agent even when setup sequencing rewrote the command', async () => {
+    await build(route, { launchAgent: 'claude', command: 'sh /tmp/orca-setup-runner.sh' })
+    expect(applyAgentWorkspaceTrust).toHaveBeenCalledWith('claude', '/repo/wt', expect.anything())
+  })
+
+  it('never re-runs trust for a restored pane or a spawn with no launch command', async () => {
+    await build(route, { launchAgent: 'claude', command: 'claude', restored: true })
+    await build(route, { launchAgent: 'claude' })
+    expect(applyAgentWorkspaceTrust).not.toHaveBeenCalled()
+  })
+
+  it('forwards the relay trust field on an SSH agent spawn', async () => {
+    applyAgentWorkspaceTrust.mockResolvedValueOnce({
+      agentWorkspaceTrust: { workspacePath: '/repo/wt' }
+    })
+    const options = await build(route, {
+      connectionId: 'ssh-1',
+      launchAgent: 'codex',
+      command: 'codex'
+    })
+    expect(options.agentWorkspaceTrust).toEqual({ workspacePath: '/repo/wt' })
+  })
+})
diff --git a/src/main/ipc/register-core-handlers/register-core-handlers.test.ts b/src/main/ipc/register-core-handlers/register-core-handlers.test.ts
index 0d4f04046b0..56067ebc3e9 100644
--- a/src/main/ipc/register-core-handlers/register-core-handlers.test.ts
+++ b/src/main/ipc/register-core-handlers/register-core-handlers.test.ts
@@ -34,10 +34,10 @@ const {
   registerOrcaProfileHandlersMock,
   registerCodexAccountHandlersMock,
   registerAgentHookHandlersMock,
-  registerAgentTrustHandlersMock,
   registerClaudeAccountHandlersMock,
   registerMiniMaxCredentialsHandlersMock,
   registerGrokAccountHandlersMock,
+  registerCursorAccountHandlersMock,
   registerClipboardHandlersMock,
   setTrustedClipboardRendererWebContentsIdMock,
   registerUpdaterHandlersMock,
@@ -101,10 +101,10 @@ const {
   registerOrcaProfileHandlersMock: vi.fn(),
   registerCodexAccountHandlersMock: vi.fn(),
   registerAgentHookHandlersMock: vi.fn(),
-  registerAgentTrustHandlersMock: vi.fn(),
   registerClaudeAccountHandlersMock: vi.fn(),
   registerMiniMaxCredentialsHandlersMock: vi.fn(),
   registerGrokAccountHandlersMock: vi.fn(),
+  registerCursorAccountHandlersMock: vi.fn(),
   registerClipboardHandlersMock: vi.fn(),
   setTrustedClipboardRendererWebContentsIdMock: vi.fn(),
   registerUpdaterHandlersMock: vi.fn(),
@@ -328,10 +328,6 @@ vi.mock('../agent-hooks', () => ({
   registerAgentHookHandlers: registerAgentHookHandlersMock
 }))
 
-vi.mock('../agent-trust', () => ({
-  registerAgentTrustHandlers: registerAgentTrustHandlersMock
-}))
-
 vi.mock('../claude-accounts', () => ({
   registerClaudeAccountHandlers: registerClaudeAccountHandlersMock
 }))
@@ -344,6 +340,10 @@ vi.mock('../grok-accounts', () => ({
   registerGrokAccountHandlers: registerGrokAccountHandlersMock
 }))
 
+vi.mock('../cursor-accounts', () => ({
+  registerCursorAccountHandlers: registerCursorAccountHandlersMock
+}))
+
 vi.mock('../../window/attach-main-window-services', () => ({
   registerUpdaterHandlers: registerUpdaterHandlersMock
 }))
@@ -432,7 +432,6 @@ describe('registerCoreHandlers', () => {
     registerOrcaProfileHandlersMock.mockReset()
     registerCodexAccountHandlersMock.mockReset()
     registerAgentHookHandlersMock.mockReset()
-    registerAgentTrustHandlersMock.mockReset()
     registerClaudeAccountHandlersMock.mockReset()
     registerMiniMaxCredentialsHandlersMock.mockReset()
     registerClipboardHandlersMock.mockReset()
@@ -528,6 +527,7 @@ describe('registerCoreHandlers', () => {
     expect(registerClaudeAccountHandlersMock).toHaveBeenCalledWith(claudeAccounts)
     expect(registerMiniMaxCredentialsHandlersMock).toHaveBeenCalledWith(rateLimits)
     expect(registerGrokAccountHandlersMock).toHaveBeenCalled()
+    expect(registerCursorAccountHandlersMock).toHaveBeenCalled()
     expect(registerRateLimitHandlersMock).toHaveBeenCalledWith(rateLimits, codexAccounts)
     expect(registerGitHubHandlersMock).toHaveBeenCalledWith(store, stats)
     expect(registerLinearHandlersMock).toHaveBeenCalled()
@@ -552,7 +552,7 @@ describe('registerCoreHandlers', () => {
     expect(registerLocalhostWorktreeLabelHandlersMock).toHaveBeenCalledWith(store)
     expect(registerTelemetryHandlersMock).toHaveBeenCalledWith(store)
     expect(registerOrcaProfileHandlersMock).toHaveBeenCalledWith(store, { onBeforeRelaunch })
-    expect(registerSessionHandlersMock).toHaveBeenCalledWith(store)
+    expect(registerSessionHandlersMock).toHaveBeenCalledWith(store, runtime)
     expect(registerUIHandlersMock).toHaveBeenCalledWith(store, {
       isDashboardPopoutRenderer: isDashboardPopoutRendererMock
     })
diff --git a/src/main/ipc/register-core-handlers/register-core-handlers.ts b/src/main/ipc/register-core-handlers/register-core-handlers.ts
index 0b329335755..e23373c803c 100644
--- a/src/main/ipc/register-core-handlers/register-core-handlers.ts
+++ b/src/main/ipc/register-core-handlers/register-core-handlers.ts
@@ -60,10 +60,10 @@ import { registerCodexAccountHandlers } from '../codex-accounts'
 import { registerAgentHookHandlers } from '../agent-hooks'
 import { registerCodexConfigSyncHandlers } from '../codex-config-sync'
 import { getPtyIdForPaneKey } from '../pty'
-import { registerAgentTrustHandlers } from '../agent-trust'
 import { registerClaudeAccountHandlers } from '../claude-accounts'
 import { registerMiniMaxCredentialsHandlers } from '../minimax-credentials'
 import { registerGrokAccountHandlers } from '../grok-accounts'
+import { registerCursorAccountHandlers } from '../cursor-accounts'
 import { registerUpdaterHandlers } from '../../window/attach-main-window-services'
 import {
   registerClipboardHandlers,
@@ -148,10 +148,10 @@ export function registerCoreHandlers(
   registerCodexAccountHandlers(codexAccounts, () => store.getSettings())
   registerAgentHookHandlers(runtime, { getPtyIdForPaneKey })
   registerCodexConfigSyncHandlers(codexAccounts.runtimeHomeService)
-  registerAgentTrustHandlers()
   registerClaudeAccountHandlers(claudeAccounts)
   registerMiniMaxCredentialsHandlers(rateLimits)
   registerGrokAccountHandlers()
+  registerCursorAccountHandlers()
   registerRateLimitHandlers(rateLimits, codexAccounts)
   registerGitHubHandlers(store, stats)
   registerGitLabHandlers(store)
@@ -202,7 +202,7 @@ export function registerCoreHandlers(
   registerBrowserHandlers()
   registerShellHandlers(store)
   registerPetHandlers()
-  registerSessionHandlers(store)
+  registerSessionHandlers(store, runtime)
   registerUIHandlers(store, { isDashboardPopoutRenderer })
   registerEmulatorFrameStreamHandlers()
   registerEmulatorVideoStreamHandlers()
diff --git a/src/main/ipc/registered-worktree-root-owner.ts b/src/main/ipc/registered-worktree-root-owner.ts
new file mode 100644
index 00000000000..37b1ed25e38
--- /dev/null
+++ b/src/main/ipc/registered-worktree-root-owner.ts
@@ -0,0 +1,35 @@
+import { resolve } from 'node:path'
+import { getRepoExecutionHostId } from '../../shared/execution-host'
+import type { Repo } from '../../shared/repo-types'
+import { hasRemoteFilesystemOwner } from './remote-filesystem-owner'
+
+export function getWorktreeRootOwnerKey(repo: Repo): string {
+  return JSON.stringify([repo.id, resolve(repo.path), getRepoExecutionHostId(repo)])
+}
+
+// Why the shared predicate: an unplaceable host stamp must not register roots either — the same
+// allow-list, reached through `git worktree list` instead of the repo path.
+export function getLocalWorktreeRootOwners(repos: readonly Repo[]): Map<string, Repo> {
+  return new Map(
+    repos
+      .filter((repo) => !hasRemoteFilesystemOwner(repo))
+      .map((repo) => [getWorktreeRootOwnerKey(repo), repo])
+  )
+}
+
+export function resolveWorktreeRootOwner(
+  repos: readonly Repo[],
+  repo: Repo | string,
+  owners: ReadonlyMap<string, Repo>
+): string | undefined {
+  // ID-only callers are safe only when the entire catalog has one matching row.
+  if (typeof repo === 'string') {
+    const matches = repos.filter((candidate) => candidate.id === repo)
+    if (matches.length !== 1) {
+      return undefined
+    }
+    repo = matches[0]
+  }
+  const key = getWorktreeRootOwnerKey(repo)
+  return !repo.connectionId && owners.has(key) ? key : undefined
+}
diff --git a/src/main/ipc/registered-worktree-root-ownership.test.ts b/src/main/ipc/registered-worktree-root-ownership.test.ts
new file mode 100644
index 00000000000..c03f923d7ec
--- /dev/null
+++ b/src/main/ipc/registered-worktree-root-ownership.test.ts
@@ -0,0 +1,294 @@
+import { join, resolve } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Store } from '../persistence'
+import type { Repo } from '../../shared/repo-types'
+
+const mocks = vi.hoisted(() => ({ graph: vi.fn(), stat: vi.fn(), realpath: vi.fn() }))
+vi.mock('node:fs', () => ({ realpathSync: (path: string) => path, statSync: mocks.stat }))
+vi.mock('node:fs/promises', () => ({ stat: mocks.stat, realpath: mocks.realpath }))
+vi.mock('../repo-worktrees', () => ({
+  listRepoWorktreeGraph: mocks.graph,
+  isRepoRoot: vi.fn(() => false)
+}))
+vi.mock('./worktree-logic', () => ({
+  computeWorkspaceRoot: vi.fn(),
+  getWorktreePathSettings: vi.fn()
+}))
+vi.mock('../project-runtime-git-options', () => ({
+  getWorktreeMirrorDistroForRuntime: vi.fn(),
+  resolveLocalProjectRuntimesForRepos: vi.fn()
+}))
+import { resolveAuthorizedPath } from './filesystem-auth'
+import {
+  __resetCreatedWorktreeRootsForTests,
+  invalidateAuthorizedRootsCache,
+  rebuildAuthorizedRootsCache,
+  registerCreatedWorktreeRoot,
+  registerWorktreeRootsForRepo
+} from './registered-worktree-roots-cache'
+
+const root = resolve('/registry-review-repo')
+const linked = resolve('/registry-review-linked')
+const canonical = resolve('/registry-review-canonical')
+const replacement = resolve('/registry-review-replacement')
+const local: Repo = { id: 'owner', path: root, displayName: 'repo', badgeColor: '#000', addedAt: 0 }
+function fixture(repos: Repo[]): Store {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The actual authorization APIs only read these four store methods; filesystem and graph boundaries are mocked.
+  return {
+    getRepos: () => repos,
+    getProjectGroups: () => [],
+    getFolderWorkspaces: () => [],
+    getSettings: () => ({})
+  } as unknown as Store
+}
+function deferred<T>() {
+  let resolvePromise!: (value: T) => void
+  let rejectPromise!: (error: unknown) => void
+  const promise = new Promise<T>((resolve, reject) => {
+    resolvePromise = resolve
+    rejectPromise = reject
+  })
+  return { promise, resolve: resolvePromise, reject: rejectPromise }
+}
+async function deferredAlias(store: Store) {
+  const normalization = deferred<string>()
+  mocks.realpath.mockImplementation((path: string) => {
+    if (path === linked) {
+      return normalization.promise
+    }
+    if (path === join(linked, 'file')) {
+      return Promise.resolve(join(canonical, 'file'))
+    }
+    return Promise.resolve(path)
+  })
+  const authorization = resolveAuthorizedPath(join(linked, 'file'), store)
+  await vi.waitFor(() => expect(mocks.realpath).toHaveBeenCalledWith(linked))
+  return { authorization, normalization }
+}
+async function expectDenied(path: string, store: Store) {
+  await expect(resolveAuthorizedPath(path, store)).rejects.toThrow('Access denied')
+}
+beforeEach(() => {
+  invalidateAuthorizedRootsCache()
+  __resetCreatedWorktreeRootsForTests()
+  vi.resetAllMocks()
+  mocks.graph.mockResolvedValue([])
+  mocks.stat.mockResolvedValue({})
+  mocks.realpath.mockImplementation(async (path: string) => path)
+})
+afterEach(() => vi.useRealTimers())
+
+describe('canonical alias publication respects current registration', () => {
+  it.each(['canonical', 'legacy'] as const)(
+    'retires an in-flight alias after %s SSH ownership',
+    async (hostEncoding) => {
+      const repos = [{ ...local }]
+      const store = fixture(repos)
+      registerWorktreeRootsForRepo(store, local.id, [linked])
+      const { authorization, normalization } = await deferredAlias(store)
+      repos[0] =
+        hostEncoding === 'canonical'
+          ? { ...local, executionHostId: 'ssh:remote' }
+          : { ...local, connectionId: 'remote' }
+      invalidateAuthorizedRootsCache()
+      normalization.resolve(canonical)
+      await expect(authorization).rejects.toThrow('Access denied')
+      await expectDenied(join(canonical, 'later'), store)
+    }
+  )
+  it('does not let an obsolete alias outlive a replacement listing', async () => {
+    const store = fixture([local])
+    registerWorktreeRootsForRepo(store, local.id, [linked])
+    const { authorization, normalization } = await deferredAlias(store)
+    registerWorktreeRootsForRepo(store, local.id, [replacement])
+    normalization.resolve(canonical)
+    await expect(authorization).rejects.toThrow('Access denied')
+    await expectDenied(join(canonical, 'later'), store)
+    await expect(resolveAuthorizedPath(join(replacement, 'file'), store)).resolves.toBe(
+      join(replacement, 'file')
+    )
+  })
+  it('does not cache an alias from an invalidated listing', async () => {
+    const store = fixture([local])
+    registerWorktreeRootsForRepo(store, local.id, [linked])
+    const { authorization, normalization } = await deferredAlias(store)
+    invalidateAuthorizedRootsCache()
+    normalization.resolve(canonical)
+    await expect(authorization).rejects.toThrow('Access denied')
+    await expectDenied(join(canonical, 'later'), store)
+  })
+  it('retains a completed alias while its original owner remains local', async () => {
+    const store = fixture([local])
+    registerWorktreeRootsForRepo(store, local.id, [linked])
+    const { authorization, normalization } = await deferredAlias(store)
+    normalization.resolve(canonical)
+    await expect(authorization).resolves.toBe(join(canonical, 'file'))
+    await expect(resolveAuthorizedPath(join(canonical, 'later'), store)).resolves.toBe(
+      join(canonical, 'later')
+    )
+  })
+})
+
+describe('recovered grant ownership and prune completion', () => {
+  it('does not apply old ENOENT evidence to a renewed recovered grant', async () => {
+    const probe = deferred<object>()
+    mocks.stat.mockReturnValueOnce(probe.promise)
+    const store = fixture([local])
+    registerCreatedWorktreeRoot(store, local.id, linked)
+    const rebuilding = rebuildAuthorizedRootsCache(store)
+    await vi.waitFor(() => expect(mocks.stat).toHaveBeenCalledWith(linked))
+    registerCreatedWorktreeRoot(store, local.id, linked)
+    probe.reject(Object.assign(new Error('old absence'), { code: 'ENOENT' }))
+    await rebuilding
+    await expect(resolveAuthorizedPath(join(linked, 'file'), store)).resolves.toBe(
+      join(linked, 'file')
+    )
+  })
+  it.each([false, true])(
+    'retires recovered roots after same-ID local path replacement (invalidate=%s)',
+    async (invalidate) => {
+      const repos = [{ ...local }]
+      const store = fixture(repos)
+      registerCreatedWorktreeRoot(store, local.id, linked)
+      repos[0] = { ...local, path: replacement }
+      if (invalidate) {
+        invalidateAuthorizedRootsCache()
+      }
+      await expectDenied(join(linked, 'file'), store)
+    }
+  )
+  it.each(['listed', 'created'] as const)(
+    'rejects ambiguous %s registration for one ID and two local paths',
+    async (kind) => {
+      const store = fixture([local, { ...local, path: replacement }])
+      if (kind === 'listed') {
+        registerWorktreeRootsForRepo(store, local.id, [linked])
+      } else {
+        registerCreatedWorktreeRoot(store, local.id, linked)
+      }
+      await expectDenied(join(linked, 'file'), store)
+    }
+  )
+  it('preserves a still-local recovered root across ordinary invalidation', async () => {
+    const store = fixture([local])
+    registerCreatedWorktreeRoot(store, local.id, linked)
+    invalidateAuthorizedRootsCache()
+    await expect(resolveAuthorizedPath(join(linked, 'file'), store)).resolves.toBe(
+      join(linked, 'file')
+    )
+  })
+  it('preserves a recovered root when its filesystem probe returns EIO', async () => {
+    const store = fixture([local])
+    registerCreatedWorktreeRoot(store, local.id, linked)
+    mocks.stat.mockRejectedValue(Object.assign(new Error('unavailable'), { code: 'EIO' }))
+    await rebuildAuthorizedRootsCache(store)
+    await expect(resolveAuthorizedPath(join(linked, 'file'), store)).resolves.toBe(
+      join(linked, 'file')
+    )
+  })
+  it('preserves a recovered root on timeout and after late ENOENT', async () => {
+    vi.useFakeTimers()
+    const probe = deferred<object>()
+    mocks.stat.mockReturnValueOnce(probe.promise)
+    const store = fixture([local])
+    registerCreatedWorktreeRoot(store, local.id, linked)
+    const rebuilding = rebuildAuthorizedRootsCache(store)
+    await vi.advanceTimersByTimeAsync(1_001)
+    await rebuilding
+    probe.reject(Object.assign(new Error('late absence'), { code: 'ENOENT' }))
+    await Promise.resolve()
+    await expect(resolveAuthorizedPath(join(linked, 'file'), store)).resolves.toBe(
+      join(linked, 'file')
+    )
+  })
+  it('keeps the newer registration when an older graph listing completes', async () => {
+    const graph = deferred<{ path: string }[]>()
+    mocks.graph.mockReturnValueOnce(graph.promise)
+    const store = fixture([local])
+    const rebuilding = rebuildAuthorizedRootsCache(store)
+    expect(mocks.graph).toHaveBeenCalledOnce()
+    registerWorktreeRootsForRepo(store, local.id, [replacement])
+    graph.resolve([{ path: linked }])
+    await rebuilding
+    await expectDenied(join(linked, 'file'), store)
+    await expect(resolveAuthorizedPath(join(replacement, 'file'), store)).resolves.toBe(
+      join(replacement, 'file')
+    )
+  })
+})
+
+describe('qualified registration', () => {
+  it.each(['listed', 'created'] as const)(
+    'keeps legitimate %s roots with overlapping local and SSH IDs',
+    async (kind) => {
+      const remote: Repo = { ...local, executionHostId: 'ssh:remote' }
+      const store = fixture([local, remote])
+      if (kind === 'listed') {
+        registerWorktreeRootsForRepo(store, local, [linked])
+        registerWorktreeRootsForRepo(store, remote, [replacement])
+      } else {
+        registerCreatedWorktreeRoot(store, local, linked)
+        registerCreatedWorktreeRoot(store, remote, replacement)
+      }
+      await expect(resolveAuthorizedPath(join(linked, 'file'), store)).resolves.toBe(
+        join(linked, 'file')
+      )
+      await expectDenied(join(replacement, 'file'), store)
+    }
+  )
+  it('preserves a root still owned by another qualified local repository', async () => {
+    const second = { ...local, path: replacement }
+    const repos = [local, second]
+    const store = fixture(repos)
+    registerCreatedWorktreeRoot(store, local, linked)
+    registerCreatedWorktreeRoot(store, second, linked)
+    repos[0] = { ...local, executionHostId: 'ssh:remote' }
+    invalidateAuthorizedRootsCache()
+    await expect(resolveAuthorizedPath(join(linked, 'file'), store)).resolves.toBe(
+      join(linked, 'file')
+    )
+  })
+  it('keeps recovered roots across harmless display metadata changes', async () => {
+    const repos = [{ ...local }]
+    const store = fixture(repos)
+    registerCreatedWorktreeRoot(store, local, linked)
+    repos[0] = { ...local, displayName: 'Renamed' }
+    invalidateAuthorizedRootsCache()
+    await expect(resolveAuthorizedPath(join(linked, 'file'), store)).resolves.toBe(
+      join(linked, 'file')
+    )
+    expect(mocks.graph).not.toHaveBeenCalled()
+    expect(mocks.stat).not.toHaveBeenCalled()
+  })
+  it('preserves own-store runtime roots but retires a changed runtime identity', async () => {
+    const runtime: Repo = { ...local, executionHostId: 'runtime:a' }
+    const repos = [runtime]
+    const store = fixture(repos)
+    registerCreatedWorktreeRoot(store, runtime, linked)
+    await expect(resolveAuthorizedPath(join(linked, 'file'), store)).resolves.toBe(
+      join(linked, 'file')
+    )
+    repos[0] = { ...runtime, executionHostId: 'runtime:b' }
+    await expectDenied(join(linked, 'file'), store)
+  })
+  it.each(['canonical', 'legacy'] as const)(
+    'discards obsolete %s SSH graph results',
+    async (hostEncoding) => {
+      const graph = deferred<{ path: string }[]>()
+      mocks.graph.mockReturnValueOnce(graph.promise)
+      const repos = [{ ...local }]
+      const store = fixture(repos)
+      const rebuilding = rebuildAuthorizedRootsCache(store)
+      repos[0] =
+        hostEncoding === 'canonical'
+          ? { ...local, executionHostId: 'ssh:remote' }
+          : { ...local, connectionId: 'remote' }
+      invalidateAuthorizedRootsCache()
+      graph.resolve([{ path: linked }])
+      await rebuilding
+      await expectDenied(join(linked, 'file'), store)
+      expect(mocks.graph).toHaveBeenCalledOnce()
+      expect(mocks.stat).not.toHaveBeenCalled()
+    }
+  )
+})
diff --git a/src/main/ipc/registered-worktree-root-probes.ts b/src/main/ipc/registered-worktree-root-probes.ts
new file mode 100644
index 00000000000..ca295f02dd1
--- /dev/null
+++ b/src/main/ipc/registered-worktree-root-probes.ts
@@ -0,0 +1,70 @@
+import { stat } from 'node:fs/promises'
+import { resolve } from 'node:path'
+import { withTimeout } from '../../shared/promise-timeout-fallback'
+import type { Repo } from '../../shared/repo-types'
+import { getErrorCode } from '../git/worktree-operation-options'
+import { listRepoWorktreeGraph } from '../repo-worktrees'
+
+const CREATED_WORKTREE_ROOT_PROBE_TIMEOUT_MS = 1_000
+const AUTHORIZED_ROOTS_REBUILD_CONCURRENCY = 8
+
+type ListedRoots = { roots: Set<string>; listingFailed: boolean }
+
+export async function listWorktreeRootsWithConcurrency(
+  repos: readonly Repo[]
+): Promise<ListedRoots[]> {
+  const results: ListedRoots[] = []
+  let nextIndex = 0
+  await Promise.all(
+    Array.from(
+      { length: Math.min(AUTHORIZED_ROOTS_REBUILD_CONCURRENCY, repos.length) },
+      async () => {
+        while (nextIndex < repos.length) {
+          const index = nextIndex++
+          const repo = repos[index]
+          const roots = new Set([resolve(repo.path)])
+          let listingFailed = false
+          try {
+            for (const worktree of await listRepoWorktreeGraph(repo)) {
+              roots.add(resolve(worktree.path))
+            }
+          } catch (error) {
+            console.warn(
+              `[filesystem-auth] skipping repo ${repo.path} during cache rebuild:`,
+              error
+            )
+            listingFailed = true
+          }
+          results[index] = { roots, listingFailed }
+        }
+      }
+    )
+  )
+  return results
+}
+
+/** An unavailable mount is not evidence that a recovered worktree disappeared. */
+export async function pruneCreatedWorktreeRoots(
+  recoveredRoots: ReadonlySet<string>,
+  listed: ListedRoots
+): Promise<Set<string>> {
+  const recovered = new Set(recoveredRoots)
+  if (!listed.listingFailed) {
+    await Promise.all(
+      [...recovered].map(async (root) => {
+        if (listed.roots.has(root) || (await isRootGoneFromDisk(root))) {
+          recovered.delete(root)
+        }
+      })
+    )
+  }
+  return recovered
+}
+
+async function isRootGoneFromDisk(targetPath: string): Promise<boolean> {
+  const probe = stat(targetPath).then(
+    () => false,
+    (error: unknown) => getErrorCode(error) === 'ENOENT'
+  )
+  return withTimeout(probe, CREATED_WORKTREE_ROOT_PROBE_TIMEOUT_MS, false)
+}
diff --git a/src/main/ipc/registered-worktree-root-refresh.test.ts b/src/main/ipc/registered-worktree-root-refresh.test.ts
new file mode 100644
index 00000000000..f33221adb05
--- /dev/null
+++ b/src/main/ipc/registered-worktree-root-refresh.test.ts
@@ -0,0 +1,128 @@
+import { join, resolve } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Store } from '../persistence'
+import type { Repo } from '../../shared/repo-types'
+
+const mocks = vi.hoisted(() => ({ graph: vi.fn(), stat: vi.fn(), realpath: vi.fn() }))
+vi.mock('node:fs', () => ({ realpathSync: (path: string) => path, statSync: mocks.stat }))
+vi.mock('node:fs/promises', () => ({ stat: mocks.stat, realpath: mocks.realpath }))
+vi.mock('../repo-worktrees', () => ({
+  listRepoWorktreeGraph: mocks.graph,
+  isRepoRoot: vi.fn(() => false)
+}))
+vi.mock('./worktree-logic', () => ({
+  computeWorkspaceRoot: vi.fn(),
+  getWorktreePathSettings: vi.fn()
+}))
+vi.mock('../project-runtime-git-options', () => ({
+  getWorktreeMirrorDistroForRuntime: vi.fn(),
+  resolveLocalProjectRuntimesForRepos: vi.fn()
+}))
+import { resolveAuthorizedPath } from './filesystem-auth'
+import {
+  __resetCreatedWorktreeRootsForTests,
+  invalidateAuthorizedRootsCache,
+  rebuildAuthorizedRootsCache,
+  registerWorktreeRootsForRepo
+} from './registered-worktree-roots-cache'
+
+const root = resolve('/registry-review-repo')
+const linked = resolve('/registry-review-linked')
+const replacement = resolve('/registry-review-replacement')
+const local: Repo = { id: 'owner', path: root, displayName: 'repo', badgeColor: '#000', addedAt: 0 }
+function fixture(repos: Repo[]): Store {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The actual authorization APIs only read these four store methods; filesystem and graph boundaries are mocked.
+  return {
+    getRepos: () => repos,
+    getProjectGroups: () => [],
+    getFolderWorkspaces: () => [],
+    getSettings: () => ({})
+  } as unknown as Store
+}
+function deferred<T>() {
+  let resolvePromise!: (value: T) => void
+  let rejectPromise!: (error: unknown) => void
+  const promise = new Promise<T>((resolve, reject) => {
+    resolvePromise = resolve
+    rejectPromise = reject
+  })
+  return { promise, resolve: resolvePromise, reject: rejectPromise }
+}
+beforeEach(() => {
+  invalidateAuthorizedRootsCache()
+  __resetCreatedWorktreeRootsForTests()
+  vi.resetAllMocks()
+  mocks.graph.mockResolvedValue([])
+  mocks.stat.mockResolvedValue({})
+  mocks.realpath.mockImplementation(async (path: string) => path)
+})
+afterEach(() => vi.useRealTimers())
+
+describe('current request follows a superseded rebuild', () => {
+  it('rebuilds the current local catalog before deciding a request that joined obsolete work', async () => {
+    const graph = deferred<{ path: string }[]>()
+    mocks.graph.mockReturnValueOnce(graph.promise)
+    const repos = [{ ...local }]
+    const store = fixture(repos)
+    const first = resolveAuthorizedPath(join(linked, 'file'), store)
+    const firstResult = first.then(
+      (value) => ({ value }),
+      (error) => ({ error })
+    )
+    await vi.waitFor(() => expect(mocks.graph).toHaveBeenCalledOnce())
+    repos[0] = { ...local, path: replacement }
+    invalidateAuthorizedRootsCache()
+    mocks.graph.mockResolvedValue([{ path: linked }])
+    const current = resolveAuthorizedPath(join(linked, 'file'), store)
+    const currentResult = current.then(
+      (value) => ({ value }),
+      (error) => ({ error })
+    )
+    await Promise.resolve()
+    await Promise.resolve()
+    await Promise.resolve()
+    graph.resolve([])
+    const [, result] = await Promise.all([firstResult, currentResult])
+    expect(result).toEqual({ value: join(linked, 'file') })
+    expect(mocks.graph).toHaveBeenCalledTimes(2)
+  })
+})
+
+it.each([1, 64, 256])('records catalog work for %s cold-rebuild repositories', async (count) => {
+  let pathReads = 0
+  const repos: Repo[] = Array.from({ length: count }, (_, i) => ({
+    id: `repo-${i}`,
+    get path() {
+      pathReads++
+      return resolve(`/review-repo-${i}`)
+    },
+    displayName: 'repo',
+    badgeColor: '#000',
+    addedAt: 0
+  }))
+  const store = fixture(repos)
+  const getRepos = vi.spyOn(store, 'getRepos')
+  await rebuildAuthorizedRootsCache(store)
+  expect(mocks.graph).toHaveBeenCalledTimes(count)
+  expect(getRepos.mock.calls.length).toBeLessThanOrEqual(3)
+  expect(pathReads).toBeLessThanOrEqual(4 * count)
+})
+it('records catalog work for one warm linked-file authorization', async () => {
+  const repo: Repo = {
+    id: 'repo',
+    path: resolve('/review-repo'),
+    displayName: 'repo',
+    badgeColor: '#000',
+    addedAt: 0
+  }
+  const store = fixture([repo])
+  const getRepos = vi.spyOn(store, 'getRepos')
+  const linked = resolve('/review-linked')
+  registerWorktreeRootsForRepo(store, repo.id, [linked])
+  getRepos.mockClear()
+  await expect(resolveAuthorizedPath(resolve(linked, 'file'), store)).resolves.toBe(
+    resolve(linked, 'file')
+  )
+  expect(mocks.graph).not.toHaveBeenCalled()
+  expect(getRepos.mock.calls.length).toBeLessThanOrEqual(3)
+})
diff --git a/src/main/ipc/registered-worktree-roots-cache.ts b/src/main/ipc/registered-worktree-roots-cache.ts
index ad8c40535cf..30d89fce2dd 100644
--- a/src/main/ipc/registered-worktree-roots-cache.ts
+++ b/src/main/ipc/registered-worktree-roots-cache.ts
@@ -1,313 +1,244 @@
-import { stat } from 'node:fs/promises'
 import { resolve } from 'node:path'
-import { withTimeout } from '../../shared/promise-timeout-fallback'
-import { getErrorCode } from '../git/worktree-operation-options'
+import type { Repo } from '../../shared/repo-types'
 import type { Store } from '../persistence'
-import { isRepoRoot, listRepoWorktreeGraph } from '../repo-worktrees'
-import { getLocalRepos } from './filesystem-allowed-roots'
+import {
+  listWorktreeRootsWithConcurrency,
+  pruneCreatedWorktreeRoots
+} from './registered-worktree-root-probes'
 import { isDescendantOrEqual, normalizeExistingPath } from './filesystem-path-containment'
+import {
+  getLocalWorktreeRootOwners,
+  resolveWorktreeRootOwner
+} from './registered-worktree-root-owner'
+
+type RegisteredOwner = {
+  repoId: string
+  listed: Set<string> | null
+  recovered: Set<string>
+  aliases: Set<string>
+  revision: number
+  dirty: boolean
+}
 
 const registeredWorktreeRoots = new Set<string>()
-const registeredWorktreeRootsByRepo = new Map<string, Set<string>>()
-/**
- * Roots Git confirmed by direct read while `git worktree list` could not see them.
- *
- * Why a layer of its own: everything in `registeredWorktreeRootsByRepo` is derived from the listing,
- * so a rebuild recomputes it from the very listing that failed and would re-deny a worktree the
- * create just recovered. This layer survives rebuilds and is pruned only on evidence (#16520).
- */
-const createdWorktreeRootsByRepo = new Map<string, Set<string>>()
-/** A recovered create is rare (Git's listing must be broken); cap the layer so it can never grow unbounded. */
-const CREATED_WORKTREE_ROOTS_MAX = 64
-/** The prune runs inside filesystem-auth resolution, so a hung mount must not stall it. */
-const CREATED_WORKTREE_ROOT_PROBE_TIMEOUT_MS = 1_000
-const registeredWorktreeRootRepoIds = new Set<string>()
+const registeredOwners = new Map<string, RegisteredOwner>()
 const registeredWorktreeRootsRevisionByRepo = new Map<string, number>()
-let registeredWorktreeRootsRevisionSequence = 0
-let registeredWorktreeRootsBaseRevision = 0
+const CREATED_WORKTREE_ROOTS_MAX = 64
+let revisionSequence = 0
+let baseRevision = 0
+let invalidationGeneration = 0
+let registryStore: Store | null = null
+let currentOwners = new Map<string, Repo>()
 let registeredWorktreeRootsDirty = true
 let registeredWorktreeRootsRefresh: Promise<void> | null = null
-const AUTHORIZED_ROOTS_REBUILD_CONCURRENCY = 8
+
+function advanceOwner(owner: RegisteredOwner): void {
+  owner.revision = ++revisionSequence
+  owner.aliases.clear()
+  registeredWorktreeRootsRevisionByRepo.set(owner.repoId, owner.revision)
+}
+
+function synchronizeOwners(store: Store): Repo[] {
+  const repos = store.getRepos()
+  const owners = getLocalWorktreeRootOwners(repos)
+  if (registryStore !== store) {
+    registeredOwners.clear()
+    registryStore = store
+    invalidationGeneration++
+  }
+  let changed = currentOwners.size !== owners.size
+  for (const [key, owner] of registeredOwners) {
+    if (!owners.has(key)) {
+      advanceOwner(owner)
+      registeredOwners.delete(key)
+      changed = true
+    }
+  }
+  for (const [key, repo] of owners) {
+    if (!registeredOwners.has(key)) {
+      registeredOwners.set(key, {
+        repoId: repo.id,
+        listed: null,
+        recovered: new Set(),
+        aliases: new Set(),
+        revision: ++revisionSequence,
+        dirty: true
+      })
+      changed = true
+    }
+  }
+  currentOwners = owners
+  if (changed) {
+    refreshRegisteredWorktreeRoots()
+  }
+  registeredWorktreeRootsDirty = [...registeredOwners.values()].some((owner) => owner.dirty)
+  return repos
+}
 
 export function invalidateAuthorizedRootsCache(): void {
-  registeredWorktreeRootsDirty = true
-  // Why: dirty roots can't be trusted for auth short-circuits; fresh worktrees:list seeds safe per-repo roots before a full rebuild.
-  registeredWorktreeRoots.clear()
-  registeredWorktreeRootsByRepo.clear()
-  registeredWorktreeRootRepoIds.clear()
-  // The recovered layer is deliberately not cleared: repo mutations are frequent, and dropping it here
-  // would re-deny a recovered worktree every time an unrelated repo is added or removed.
+  invalidationGeneration++
+  for (const owner of registeredOwners.values()) {
+    owner.listed = null
+    owner.dirty = true
+    advanceOwner(owner)
+  }
   refreshRegisteredWorktreeRoots()
-  registeredWorktreeRootsBaseRevision = ++registeredWorktreeRootsRevisionSequence
+  registeredWorktreeRootsDirty = true
+  baseRevision = ++revisionSequence
   registeredWorktreeRootsRevisionByRepo.clear()
 }
 
 export async function rebuildAuthorizedRootsCache(store: Store): Promise<void> {
-  // Why: bounded parallelism keeps the Windows speedup without one git process per repo.
-  // Why no realpath here: canonicalizing every root on invalidation would trigger macOS TCC prompts; handlers still canonicalize the target before any operation.
-  const repos = getLocalRepos(store)
-  const perProjectResults = await mapWithConcurrency(
-    repos,
-    AUTHORIZED_ROOTS_REBUILD_CONCURRENCY,
-    async (repo) => {
-      const roots: string[] = []
-      try {
-        roots.push(resolve(repo.path))
-
-        for (const worktree of await listRepoWorktreeGraph(repo)) {
-          roots.push(resolve(worktree.path))
-        }
-      } catch (error) {
-        // Why: one inaccessible repo (EACCES/EIO) must not break the whole rebuild and disable File Explorer/Quick Open for the rest; skip it.
-        console.warn(`[filesystem-auth] skipping repo ${repo.path} during cache rebuild:`, error)
-        return { repoId: repo.id, roots, listingFailed: true }
-      }
-      return { repoId: repo.id, roots, listingFailed: false }
-    }
-  )
-  await pruneCreatedWorktreeRoots(perProjectResults, new Set(repos.map((repo) => repo.id)))
-
-  registeredWorktreeRoots.clear()
-  registeredWorktreeRootsByRepo.clear()
-  registeredWorktreeRootRepoIds.clear()
-  for (const { repoId, roots } of perProjectResults) {
-    const normalizedRoots = new Set<string>()
-    for (const root of roots) {
-      normalizedRoots.add(root)
-      registeredWorktreeRoots.add(root)
-    }
-    registeredWorktreeRootsByRepo.set(repoId, normalizedRoots)
-    registeredWorktreeRootRepoIds.add(repoId)
-  }
-  for (const roots of createdWorktreeRootsByRepo.values()) {
-    for (const root of roots) {
-      registeredWorktreeRoots.add(root)
-    }
-  }
-  registeredWorktreeRootsDirty = false
-  registeredWorktreeRootsBaseRevision = ++registeredWorktreeRootsRevisionSequence
-  registeredWorktreeRootsRevisionByRepo.clear()
-}
-
-/**
- * Retire recovered roots on evidence: the listing can see the worktree again, or it is gone from disk.
- *
- * Nothing is retired for want of evidence. A repo whose listing threw is left untouched, and so is a
- * root whose probe hangs or errors for any reason but ENOENT — a dead mount fails the listing and the
- * probe alike, and pruning on that would revoke the worktree in the very outage this layer exists for.
- */
-async function pruneCreatedWorktreeRoots(
-  results: readonly { repoId: string; roots: string[]; listingFailed: boolean }[],
-  localRepoIds: Set<string>
-): Promise<void> {
-  const listedByRepo = new Map(
-    results.filter((result) => !result.listingFailed).map((r) => [r.repoId, new Set(r.roots)])
-  )
-  const probes: Promise<void>[] = []
-  for (const [repoId, roots] of createdWorktreeRootsByRepo) {
-    if (!localRepoIds.has(repoId)) {
-      createdWorktreeRootsByRepo.delete(repoId)
-      continue
-    }
-    const listed = listedByRepo.get(repoId)
-    if (!listed) {
-      continue
-    }
-    for (const root of roots) {
-      if (listed.has(root)) {
-        roots.delete(root)
-        continue
-      }
-      // Probe in parallel: a repo may hold up to CREATED_WORKTREE_ROOTS_MAX roots, and serial
-      // timeouts would multiply into a rebuild stall of their own.
-      probes.push(
-        isRootGoneFromDisk(root).then((gone) => {
-          if (gone) {
-            roots.delete(root)
-          }
-        })
-      )
-    }
-  }
-  await Promise.all(probes)
-  for (const [repoId, roots] of createdWorktreeRootsByRepo) {
-    if (roots.size === 0) {
-      createdWorktreeRootsByRepo.delete(repoId)
-    }
-  }
-}
-
-/** Only a definitive ENOENT counts as removal; the timeout unblocks the rebuild but cannot cancel the syscall. */
-async function isRootGoneFromDisk(targetPath: string): Promise<boolean> {
-  const probe = stat(targetPath).then(
-    () => false,
-    (error: unknown) => getErrorCode(error) === 'ENOENT'
-  )
-  return withTimeout(probe, CREATED_WORKTREE_ROOT_PROBE_TIMEOUT_MS, false)
-}
-
-async function mapWithConcurrency<T, R>(
-  items: readonly T[],
-  maxConcurrent: number,
-  mapper: (item: T) => Promise<R>
-): Promise<R[]> {
-  const results: R[] = []
-  let nextIndex = 0
-  const workerCount = Math.min(maxConcurrent, items.length)
-  await Promise.all(
-    Array.from({ length: workerCount }, async () => {
-      while (nextIndex < items.length) {
-        const index = nextIndex
-        nextIndex += 1
-        results[index] = await mapper(items[index])
+  synchronizeOwners(store)
+  const generation = invalidationGeneration
+  const pending = [...currentOwners].map(([key, repo]) => ({
+    key,
+    repo,
+    owner: registeredOwners.get(key),
+    revision: registeredOwners.get(key)?.revision
+  }))
+  const listings = await listWorktreeRootsWithConcurrency(pending.map((entry) => entry.repo))
+  const results = pending.map((entry, index) => ({ ...entry, ...listings[index] }))
+  const isCurrent = (entry: (typeof pending)[number]): boolean =>
+    generation === invalidationGeneration &&
+    registeredOwners.get(entry.key) === entry.owner &&
+    entry.owner?.revision === entry.revision
+  synchronizeOwners(store)
+  const pruned = await Promise.all(
+    results.map(async (entry) => {
+      if (!entry.owner || !isCurrent(entry)) {
+        return null
       }
+      const recovered = await pruneCreatedWorktreeRoots(entry.owner.recovered, entry)
+      return { ...entry, recovered }
     })
   )
-  return results
+  synchronizeOwners(store)
+  for (const entry of pruned) {
+    // A fresh create or ownership change makes both the graph and absence probes obsolete.
+    if (!entry || !entry.owner || !isCurrent(entry)) {
+      continue
+    }
+    entry.owner.listed = entry.roots
+    entry.owner.dirty = false
+    entry.owner.recovered = entry.recovered
+    advanceOwner(entry.owner)
+  }
+  refreshRegisteredWorktreeRoots()
+  registeredWorktreeRootsDirty = [...registeredOwners.values()].some((owner) => owner.dirty)
 }
 
 export function registerWorktreeRootsForRepo(
   store: Store,
-  repoId: string,
+  repo: Repo | string,
   worktreeRoots: string[]
 ): void {
-  const localRepoIds = new Set(getLocalRepos(store).map((repo) => repo.id))
-  for (const registeredRepoId of registeredWorktreeRootsByRepo.keys()) {
-    if (!localRepoIds.has(registeredRepoId)) {
-      registeredWorktreeRootsByRepo.delete(registeredRepoId)
-      registeredWorktreeRootRepoIds.delete(registeredRepoId)
-      registeredWorktreeRootsRevisionByRepo.set(
-        registeredRepoId,
-        ++registeredWorktreeRootsRevisionSequence
-      )
-    }
-  }
-
-  if (!localRepoIds.has(repoId)) {
-    refreshRegisteredWorktreeRoots()
-    registeredWorktreeRootsDirty = !allLocalRepoRootsRegistered(localRepoIds)
+  const repos = synchronizeOwners(store)
+  const key = resolveWorktreeRootOwner(repos, repo, currentOwners)
+  const owner = key === undefined ? undefined : registeredOwners.get(key)
+  if (!owner) {
     return
   }
-
-  registeredWorktreeRootsByRepo.set(repoId, new Set(worktreeRoots.map((root) => resolve(root))))
-  registeredWorktreeRootRepoIds.add(repoId)
-  registeredWorktreeRootsRevisionByRepo.set(repoId, ++registeredWorktreeRootsRevisionSequence)
+  owner.listed = new Set(worktreeRoots.map((root) => resolve(root)))
+  owner.dirty = false
+  advanceOwner(owner)
   refreshRegisteredWorktreeRoots()
-  registeredWorktreeRootsDirty = !allLocalRepoRootsRegistered(localRepoIds)
+  registeredWorktreeRootsDirty = [...registeredOwners.values()].some((entry) => entry.dirty)
 }
 
-/**
- * Authorize one worktree root that Git confirmed by direct read but could not list.
- *
- * Why not `registerWorktreeRootsForRepo`: that replaces the repo's set, and a create recovered without
- * a listing has no full set to put there. The root goes in the recovered layer instead, so the next
- * rebuild cannot drop it while Git's listing is still broken (#16520).
- */
+/** Preserve directly confirmed creates when an unavailable listing cannot name them. */
 export function registerCreatedWorktreeRoot(
   store: Store,
-  repoId: string,
+  repo: Repo | string,
   worktreeRoot: string
 ): void {
-  const localRepoIds = new Set(getLocalRepos(store).map((repo) => repo.id))
-  if (!localRepoIds.has(repoId)) {
+  const repos = synchronizeOwners(store)
+  const key = resolveWorktreeRootOwner(repos, repo, currentOwners)
+  const owner = key === undefined ? undefined : registeredOwners.get(key)
+  if (!owner) {
     return
   }
-  const roots = createdWorktreeRootsByRepo.get(repoId) ?? new Set<string>()
   const root = resolve(worktreeRoot)
-  if (!roots.has(root) && roots.size >= CREATED_WORKTREE_ROOTS_MAX) {
-    // Refuse rather than evict: dropping an already-authorized root denies a worktree the user is
-    // using, while declining this one only leaves the new create as unauthorized as it is today.
+  if (!owner.recovered.has(root) && owner.recovered.size >= CREATED_WORKTREE_ROOTS_MAX) {
     console.warn(
-      `[filesystem-auth] recovered-root layer full for repo ${repoId}; not authorizing ${root}`
+      `[filesystem-auth] recovered-root layer full for repo ${owner.repoId}; not authorizing ${root}`
     )
     return
   }
-  roots.add(root)
-  createdWorktreeRootsByRepo.set(repoId, roots)
-  registeredWorktreeRootsRevisionByRepo.set(repoId, ++registeredWorktreeRootsRevisionSequence)
+  owner.recovered.add(root)
+  owner.dirty = true
+  advanceOwner(owner)
   refreshRegisteredWorktreeRoots()
   registeredWorktreeRootsDirty = true
 }
 
-/** The recovered layer outlives cache invalidation by design, so suites need an explicit reset. */
 export function __resetCreatedWorktreeRootsForTests(): void {
-  createdWorktreeRootsByRepo.clear()
+  for (const owner of registeredOwners.values()) {
+    owner.recovered.clear()
+    advanceOwner(owner)
+  }
   refreshRegisteredWorktreeRoots()
 }
 
 export function getRegisteredWorktreeRootsRevision(repoId: string): number {
-  return registeredWorktreeRootsRevisionByRepo.get(repoId) ?? registeredWorktreeRootsBaseRevision
+  return registeredWorktreeRootsRevisionByRepo.get(repoId) ?? baseRevision
 }
 
 export async function ensureAuthorizedRootsCache(store: Store): Promise<void> {
-  if (!registeredWorktreeRootsDirty) {
-    return
+  synchronizeOwners(store)
+  // Follow one superseded refresh; continuous catalog churn must not pin authorization forever.
+  for (let attempt = 0; registeredWorktreeRootsDirty && attempt < 2; attempt++) {
+    if (!registeredWorktreeRootsRefresh) {
+      registeredWorktreeRootsRefresh = rebuildAuthorizedRootsCache(store).finally(() => {
+        registeredWorktreeRootsRefresh = null
+      })
+    }
+    await registeredWorktreeRootsRefresh
   }
-  if (!registeredWorktreeRootsRefresh) {
-    registeredWorktreeRootsRefresh = rebuildAuthorizedRootsCache(store).finally(() => {
-      registeredWorktreeRootsRefresh = null
-    })
-  }
-  await registeredWorktreeRootsRefresh
 }
 
-/**
- * Resolve and verify that a worktree path belongs to a registered repo.
- *
- * Why not resolveAuthorizedPath: linked worktrees can live outside repo/workspace roots; git trusts exact `git worktree list` registration, not containment.
- */
 export async function resolveRegisteredWorktreePath(
   worktreePath: string,
   store: Store
 ): Promise<string> {
-  // Reject malformed paths (null byte) early to prevent probing via realpath.
   if (!worktreePath || worktreePath.includes('\0')) {
     throw new Error('Access denied: invalid worktree path')
   }
-
+  synchronizeOwners(store)
   const resolvedTarget = resolve(worktreePath)
-  if (registeredWorktreeRoots.has(resolvedTarget) || isRepoRoot(store.getRepos(), resolvedTarget)) {
+  if (
+    registeredWorktreeRoots.has(resolvedTarget) ||
+    [...currentOwners.values()].some((repo) => resolve(repo.path) === resolvedTarget)
+  ) {
     return resolvedTarget
   }
-
-  if (registeredWorktreeRootsDirty) {
-    await ensureAuthorizedRootsCache(store)
-  }
-
+  await ensureAuthorizedRootsCache(store)
   if (registeredWorktreeRoots.has(resolvedTarget)) {
     return resolvedTarget
   }
-
-  // Resolve symlinks only after the cheap registered-root check: on macOS realpath() can trigger TCC prompts.
   const normalizedTarget = await normalizeExistingPath(resolvedTarget)
+  synchronizeOwners(store)
   if (registeredWorktreeRoots.has(normalizedTarget)) {
     return normalizedTarget
   }
-
   throw new Error('Access denied: unknown repository or worktree path')
 }
 
 function refreshRegisteredWorktreeRoots(): void {
   registeredWorktreeRoots.clear()
-  for (const byRepo of [registeredWorktreeRootsByRepo, createdWorktreeRootsByRepo]) {
-    for (const roots of byRepo.values()) {
-      for (const root of roots) {
-        registeredWorktreeRoots.add(root)
+  for (const owner of registeredOwners.values()) {
+    for (const roots of [owner.listed, owner.recovered, owner.aliases]) {
+      if (roots) {
+        for (const root of roots) {
+          registeredWorktreeRoots.add(root)
+        }
       }
     }
   }
 }
 
-function allLocalRepoRootsRegistered(localRepoIds: Set<string>): boolean {
-  for (const repoId of localRepoIds) {
-    if (!registeredWorktreeRootRepoIds.has(repoId)) {
-      return false
-    }
-  }
-  return true
-}
-
-export function isRegisteredWorktreePath(targetPath: string): boolean {
+export function isRegisteredWorktreePath(targetPath: string, store: Store): boolean {
+  synchronizeOwners(store)
   for (const root of registeredWorktreeRoots) {
     if (isDescendantOrEqual(targetPath, root)) {
       return true
@@ -318,31 +249,49 @@ export function isRegisteredWorktreePath(targetPath: string): boolean {
 
 export async function isPathAllowedByCanonicalRegisteredRoot(
   targetPath: string,
-  sourcePath: string | undefined
+  sourcePath: string | undefined,
+  store: Store
 ): Promise<boolean> {
   if (!sourcePath) {
     return false
   }
+  synchronizeOwners(store)
   const textualRoot = findRegisteredWorktreeRoot(sourcePath)
   if (!textualRoot) {
     return false
   }
+  const generation = invalidationGeneration
+  const owners = [...registeredOwners.values()]
+    .filter(
+      (owner) =>
+        owner.listed?.has(textualRoot) ||
+        owner.recovered.has(textualRoot) ||
+        owner.aliases.has(textualRoot)
+    )
+    .map((owner) => ({ owner, revision: owner.revision }))
   const canonicalRoot = await normalizeExistingPath(textualRoot)
-  if (!isDescendantOrEqual(targetPath, canonicalRoot)) {
+  synchronizeOwners(store)
+  if (generation !== invalidationGeneration || !isDescendantOrEqual(targetPath, canonicalRoot)) {
     return false
   }
-  // Why: #1524 stopped realpath'ing every root (macOS privacy prompts); cache only the actively-accessed root so /var→/private/var aliases resolve.
-  registeredWorktreeRoots.add(canonicalRoot)
-  return true
+  let allowed = false
+  for (const { owner, revision } of owners) {
+    if (owner.revision !== revision) {
+      continue
+    }
+    owner.aliases.add(canonicalRoot)
+    allowed = true
+  }
+  if (allowed) {
+    registeredWorktreeRoots.add(canonicalRoot)
+  }
+  return allowed
 }
 
 function findRegisteredWorktreeRoot(targetPath: string): string | null {
   let bestRoot: string | null = null
   for (const root of registeredWorktreeRoots) {
-    if (!isDescendantOrEqual(targetPath, root)) {
-      continue
-    }
-    if (!bestRoot || root.length > bestRoot.length) {
+    if (isDescendantOrEqual(targetPath, root) && (!bestRoot || root.length > bestRoot.length)) {
       bestRoot = root
     }
   }
diff --git a/src/main/ipc/remote-filesystem-owner.ts b/src/main/ipc/remote-filesystem-owner.ts
new file mode 100644
index 00000000000..9fc17f83bad
--- /dev/null
+++ b/src/main/ipc/remote-filesystem-owner.ts
@@ -0,0 +1,25 @@
+import { parseExecutionHostId } from '../../shared/execution-host'
+
+/**
+ * Whether another machine holds this row's files, so its path must not authorize local reads.
+ *
+ * Fails closed on a stamp the parser rejects — empty `ssh:`, a bad escape, an embedded `|` (refused
+ * so an alias cannot be rebound), an unknown prefix. `getSshTargetIdForExecutionHost` answers null
+ * for all of them, and in an allow-list "cannot place this owner" must not read as "this machine".
+ * A `runtime:` stamp stays local: on a repo row it names the store's own runtime, never a peer.
+ */
+export function hasRemoteFilesystemOwner(scope: {
+  connectionId?: string | null
+  executionHostId?: string | null
+}): boolean {
+  // Keep legacy exclusions, including runtime rows whose connection belongs to that runtime.
+  if (scope.connectionId) {
+    return true
+  }
+  const stampedHostId = scope.executionHostId?.trim()
+  if (!stampedHostId) {
+    return false
+  }
+  const host = parseExecutionHostId(stampedHostId)
+  return host === null || host.kind === 'ssh'
+}
diff --git a/src/main/ipc/remote-workspace-relay-sync.ts b/src/main/ipc/remote-workspace-relay-sync.ts
index b4dcab5a0bf..42852224090 100644
--- a/src/main/ipc/remote-workspace-relay-sync.ts
+++ b/src/main/ipc/remote-workspace-relay-sync.ts
@@ -2,7 +2,8 @@ import type {
   RemoteWorkspaceObservedPatchResult,
   RemoteWorkspaceObservedSnapshot,
   RemoteWorkspacePatchResult,
-  RemoteWorkspaceSession
+  RemoteWorkspaceSession,
+  RemoteWorkspaceSnapshot
 } from '../../shared/remote-workspace-types'
 import type { SshTarget } from '../../shared/ssh-types'
 import { getActiveMultiplexer } from './ssh'
@@ -18,9 +19,11 @@ import {
   remoteWorkspaceSessionMatchesSnapshot
 } from './remote-workspace-snapshot-normalization'
 
-export async function getRemoteSnapshot(
-  target: SshTarget
-): Promise<RemoteWorkspaceObservedSnapshot | null> {
+// Keep comparison and cache mutation together in the response continuation.
+export async function readRemoteSnapshot<Result>(
+  target: SshTarget,
+  receive: (snapshot: RemoteWorkspaceSnapshot) => Result
+): Promise<Result | null> {
   const mux = getActiveMultiplexer(target.id)
   if (!mux) {
     return null
@@ -28,8 +31,7 @@ export async function getRemoteSnapshot(
   const namespace = getRemoteWorkspaceNamespace(target)
   try {
     const raw = await mux.request('workspace.get', { namespace })
-    const snapshot = normalizeSnapshot(raw, namespace)
-    return rememberRemoteWorkspaceSnapshot(target.id, snapshot)
+    return receive(normalizeSnapshot(raw, namespace))
   } catch (err) {
     if ((err as { code?: unknown })?.code === -32601) {
       return null
@@ -38,6 +40,14 @@ export async function getRemoteSnapshot(
   }
 }
 
+export function getRemoteSnapshot(
+  target: SshTarget
+): Promise<RemoteWorkspaceObservedSnapshot | null> {
+  return readRemoteSnapshot(target, (snapshot) =>
+    rememberRemoteWorkspaceSnapshot(target.id, snapshot)
+  )
+}
+
 function observePatchResult(
   targetId: string,
   result: RemoteWorkspacePatchResult
diff --git a/src/main/ipc/remote-workspace-snapshot-cache.ts b/src/main/ipc/remote-workspace-snapshot-cache.ts
index 36be88e633a..2f9e26c5e81 100644
--- a/src/main/ipc/remote-workspace-snapshot-cache.ts
+++ b/src/main/ipc/remote-workspace-snapshot-cache.ts
@@ -17,11 +17,12 @@ type RemoteWorkspaceSnapshotCacheEntry = {
 
 const latestSnapshotByTargetId = new Map<string, RemoteWorkspaceSnapshotCacheEntry>()
 
-function snapshotsAreIdentical(
-  previous: RemoteWorkspaceObservedSnapshot,
+export function remoteWorkspaceSnapshotsAreIdentical(
+  previous: RemoteWorkspaceSnapshot | undefined,
   next: RemoteWorkspaceSnapshot
 ): boolean {
   return (
+    previous !== undefined &&
     previous.namespace === next.namespace &&
     previous.revision === next.revision &&
     previous.updatedAt === next.updatedAt &&
@@ -59,7 +60,7 @@ export function rememberRemoteWorkspaceSnapshot(
   // observations do not revoke an in-flight upload authority.
   const normalizedSnapshot = normalizeSnapshot(snapshot, snapshot.namespace)
   const current = latestSnapshotByTargetId.get(targetId)
-  if (current && snapshotsAreIdentical(current.snapshot, normalizedSnapshot)) {
+  if (current && remoteWorkspaceSnapshotsAreIdentical(current.snapshot, normalizedSnapshot)) {
     // Re-reading an unchanged revision is not a new host observation. Keep the
     // token (and the contiguous local-patch authorization window) stable so a
     // polling read cannot invalidate an upload that is already in flight.
diff --git a/src/main/ipc/remote-workspace-stale-resync.test.ts b/src/main/ipc/remote-workspace-stale-resync.test.ts
index 2c7ceece9d4..07950563a94 100644
--- a/src/main/ipc/remote-workspace-stale-resync.test.ts
+++ b/src/main/ipc/remote-workspace-stale-resync.test.ts
@@ -1,9 +1,13 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { Store } from '../persistence'
+import { SshChannelMultiplexer } from '../ssh/ssh-channel-multiplexer'
+import { encodeJsonRpcFrame } from '../ssh/relay-protocol'
 import {
   REMOTE_WORKSPACE_STALE_NOTIFICATION,
+  REMOTE_WORKSPACE_CHANGED_NOTIFICATION,
   type RemoteWorkspaceChangedEvent,
-  type RemoteWorkspaceSession
+  type RemoteWorkspaceSession,
+  type RemoteWorkspaceSnapshot
 } from '../../shared/remote-workspace-types'
 
 const { getActiveMultiplexerMock, getSshConnectionStoreMock } = vi.hoisted(() => ({
@@ -29,6 +33,13 @@ import {
   handleRemoteWorkspaceNotification,
   registerRemoteWorkspaceHandlers
 } from './remote-workspace'
+import {
+  getCachedRemoteWorkspaceSnapshot,
+  rememberLocallyPatchedRemoteWorkspaceSnapshot,
+  rememberRemoteWorkspaceSnapshot
+} from './remote-workspace-snapshot-cache'
+import { isRemoteWorkspaceResyncInFlight } from './remote-workspace-stale-resync'
+import { CLIENT_ID } from './remote-workspace-client-identity'
 
 function session(activeTabId: string): RemoteWorkspaceSession {
   return {
@@ -41,6 +52,16 @@ function session(activeTabId: string): RemoteWorkspaceSession {
   }
 }
 
+function snapshot(revision: number, tabId: string): RemoteWorkspaceSnapshot {
+  return {
+    namespace: 'target-1',
+    revision,
+    updatedAt: revision,
+    schemaVersion: 1,
+    session: session(tabId)
+  }
+}
+
 describe('workspace.stale resync', () => {
   const sent: RemoteWorkspaceChangedEvent[] = []
   const request = vi.fn()
@@ -150,4 +171,271 @@ describe('workspace.stale resync', () => {
     await Promise.resolve()
     expect(sent).toHaveLength(1)
   })
+
+  it.each(['own', 'peer'] as const)(
+    'checks a %s snapshot against the own patch reply received during its pending read',
+    async (source) => {
+      rememberRemoteWorkspaceSnapshot('target-1', snapshot(1, 'tab-before-patch'))
+      const ownSnapshot = snapshot(2, 'tab-from-own-patch')
+      const readSnapshot = source === 'own' ? ownSnapshot : snapshot(3, 'tab-from-peer')
+      request.mockResolvedValue(readSnapshot)
+      let releaseRead: ((value: RemoteWorkspaceSnapshot) => void) | undefined
+      request.mockImplementationOnce(
+        () =>
+          new Promise<RemoteWorkspaceSnapshot>((resolve) => {
+            releaseRead = resolve
+          })
+      )
+
+      handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+        namespace: 'target-1'
+      })
+      expect(request).toHaveBeenCalledTimes(1)
+      expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(true)
+
+      // The relay publishes the stale marker before returning this client's patch reply.
+      rememberLocallyPatchedRemoteWorkspaceSnapshot('target-1', ownSnapshot)
+      releaseRead?.(readSnapshot)
+      await vi.waitFor(() => expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false))
+
+      expect(sent.map((event) => event.snapshot.session.activeTabId)).toEqual(
+        source === 'own' ? [] : ['tab-from-peer']
+      )
+    }
+  )
+
+  it('delivers a peer snapshot cached by a stale-revision patch reply during the read', async () => {
+    rememberRemoteWorkspaceSnapshot('target-1', snapshot(1, 'tab-before-peer'))
+    const peerSnapshot = snapshot(2, 'tab-from-peer')
+    let releaseRead: ((value: RemoteWorkspaceSnapshot) => void) | undefined
+    request.mockImplementationOnce(
+      () =>
+        new Promise<RemoteWorkspaceSnapshot>((resolve) => {
+          releaseRead = resolve
+        })
+    )
+
+    handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+      namespace: 'target-1'
+    })
+    // A rejected local patch caches the peer snapshot, but the renderer only records a conflict.
+    rememberRemoteWorkspaceSnapshot('target-1', peerSnapshot)
+    releaseRead?.(peerSnapshot)
+    await vi.waitFor(() => expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false))
+
+    expect(sent.map((event) => event.snapshot.session.activeTabId)).toEqual(['tab-from-peer'])
+    expect(request).toHaveBeenCalledTimes(1)
+  })
+
+  it('suppresses an own reply already acknowledged before the marker', async () => {
+    const ownSnapshot = snapshot(2, 'tab-from-own-patch')
+    rememberLocallyPatchedRemoteWorkspaceSnapshot('target-1', ownSnapshot)
+    request.mockResolvedValue(ownSnapshot)
+
+    handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+      namespace: 'target-1'
+    })
+    await vi.waitFor(() => expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false))
+
+    expect(sent).toEqual([])
+  })
+
+  it('still reads a queued peer change after suppressing the own echo', async () => {
+    const ownSnapshot = snapshot(2, 'tab-from-own-patch')
+    let releaseRead: ((value: RemoteWorkspaceSnapshot) => void) | undefined
+    request.mockImplementationOnce(
+      () =>
+        new Promise<RemoteWorkspaceSnapshot>((resolve) => {
+          releaseRead = resolve
+        })
+    )
+    request.mockResolvedValue(snapshot(3, 'tab-from-peer'))
+
+    for (let index = 0; index < 2; index += 1) {
+      handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+        namespace: 'target-1'
+      })
+    }
+
+    rememberLocallyPatchedRemoteWorkspaceSnapshot('target-1', ownSnapshot)
+    releaseRead?.(ownSnapshot)
+    await vi.waitFor(() => expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false))
+
+    expect(request).toHaveBeenCalledTimes(2)
+    expect(sent.map((event) => event.snapshot.session.activeTabId)).toEqual(['tab-from-peer'])
+  })
+
+  it('keeps an own acknowledgement from suppressing another target', async () => {
+    const releases: ((value: RemoteWorkspaceSnapshot) => void)[] = []
+    request.mockImplementation(
+      () => new Promise<RemoteWorkspaceSnapshot>((resolve) => releases.push(resolve))
+    )
+    for (const targetId of ['target-1', 'target-2']) {
+      handleRemoteWorkspaceNotification(targetId, REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+        namespace: 'target-1'
+      })
+    }
+    const ownSnapshot = snapshot(2, 'same-tab')
+    rememberLocallyPatchedRemoteWorkspaceSnapshot('target-1', ownSnapshot)
+    releases[0]?.(ownSnapshot)
+    releases[1]?.(ownSnapshot)
+    await vi.waitFor(() => {
+      expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false)
+      expect(isRemoteWorkspaceResyncInFlight('target-2')).toBe(false)
+    })
+
+    expect(sent.map((event) => event.targetId)).toEqual(['target-2'])
+  })
+
+  it('does not deliver a captured read after a same-token own acknowledgement advances the cache', async () => {
+    rememberRemoteWorkspaceSnapshot('target-1', snapshot(1, 'initial-tab'))
+    request.mockResolvedValue(snapshot(3, 'newer-own-tab'))
+    let releaseRead: ((value: RemoteWorkspaceSnapshot) => void) | undefined
+    request.mockImplementationOnce(
+      () =>
+        new Promise<RemoteWorkspaceSnapshot>((resolve) => {
+          releaseRead = resolve
+        })
+    )
+    handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+      namespace: 'target-1'
+    })
+
+    releaseRead?.(snapshot(2, 'peer-tab'))
+    queueMicrotask(() => {
+      rememberLocallyPatchedRemoteWorkspaceSnapshot('target-1', snapshot(3, 'newer-own-tab'))
+    })
+    await vi.waitFor(() => expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false))
+
+    expect(getCachedRemoteWorkspaceSnapshot('target-1')?.revision).toBe(3)
+    expect(sent.map((event) => event.snapshot.revision)).toEqual([])
+    expect(request).toHaveBeenCalledTimes(2)
+  })
+
+  it.each([
+    { source: 'peer', order: 'response-first' },
+    { source: 'peer', order: 'notification-first' },
+    { source: 'own', order: 'response-first' },
+    { source: 'own', order: 'notification-first' }
+  ])(
+    'never publishes an older read after a newer $source notification ($order)',
+    async ({ source, order }) => {
+      let receive: ((data: Buffer) => void) | undefined
+      const mux = new SshChannelMultiplexer({
+        write: () => {},
+        onData: (callback) => {
+          receive = callback
+        },
+        onClose: () => {}
+      })
+      const read = vi.spyOn(mux, 'request')
+      getActiveMultiplexerMock.mockReturnValue(mux)
+      mux.onNotification((method, params) =>
+        handleRemoteWorkspaceNotification('target-1', method, params)
+      )
+      const initial = rememberRemoteWorkspaceSnapshot('target-1', snapshot(2, 'initial-tab'))
+      const sourceClientId = source === 'own' ? CLIENT_ID : 'peer-client'
+      try {
+        handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+          namespace: 'target-1'
+        })
+        const reply = { jsonrpc: '2.0', id: 1, result: snapshot(2, 'older-read') } as const
+        const changed = {
+          jsonrpc: '2.0',
+          method: REMOTE_WORKSPACE_CHANGED_NOTIFICATION,
+          params: { snapshot: snapshot(3, 'newer-source'), sourceClientId }
+        } as const
+        const messages = order === 'response-first' ? [reply, changed] : [changed, reply]
+        receive?.(
+          Buffer.concat(messages.map((message, index) => encodeJsonRpcFrame(message, index + 1, 0)))
+        )
+        if (source === 'own') {
+          expect(getCachedRemoteWorkspaceSnapshot('target-1')?.hostObservationToken).toBe(
+            initial.hostObservationToken
+          )
+        }
+        await new Promise((resolve) => setImmediate(resolve))
+        expect(getCachedRemoteWorkspaceSnapshot('target-1')?.revision).toBe(3)
+        expect(sent.map((event) => event.snapshot.revision)).toEqual([3])
+        await vi.waitFor(() => expect(read).toHaveBeenCalledTimes(2))
+        receive?.(
+          encodeJsonRpcFrame({ jsonrpc: '2.0', id: 2, result: snapshot(3, 'newer-source') }, 3, 0)
+        )
+        await vi.waitFor(() => expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false))
+        expect(sent.map((event) => event.snapshot.revision)).toEqual([3])
+        expect(sent[0].sourceClientId).toBe(sourceClientId)
+      } finally {
+        mux.dispose()
+      }
+    }
+  )
+
+  it.each([2, 3])(
+    'does not deliver a captured read after peer revision %i replaces it',
+    async (peerRevision) => {
+      rememberRemoteWorkspaceSnapshot('target-1', snapshot(1, 'initial-tab'))
+      const peer = snapshot(peerRevision, 'newer-peer')
+      request.mockResolvedValue(peer)
+      let releaseRead: ((value: RemoteWorkspaceSnapshot) => void) | undefined
+      request.mockImplementationOnce(
+        () =>
+          new Promise<RemoteWorkspaceSnapshot>((resolve) => {
+            releaseRead = resolve
+          })
+      )
+      handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+        namespace: 'target-1'
+      })
+
+      releaseRead?.(snapshot(2, 'older-read'))
+      queueMicrotask(() => {
+        handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_CHANGED_NOTIFICATION, {
+          snapshot: peer,
+          sourceClientId: 'peer-client'
+        })
+      })
+      await vi.waitFor(() => expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false))
+
+      expect(getCachedRemoteWorkspaceSnapshot('target-1')?.session.activeTabId).toBe('newer-peer')
+      expect(sent.map((event) => event.snapshot.session.activeTabId)).toEqual(['newer-peer'])
+      expect(request).toHaveBeenCalledTimes(2)
+    }
+  )
+
+  it('accepts a relay reset after rereading a response that raced a host change', async () => {
+    rememberRemoteWorkspaceSnapshot('target-1', snapshot(40, 'before-reset'))
+    request.mockResolvedValue(snapshot(1, 'after-reset'))
+    let releaseRead: ((value: RemoteWorkspaceSnapshot) => void) | undefined
+    request.mockImplementationOnce(
+      () =>
+        new Promise<RemoteWorkspaceSnapshot>((resolve) => {
+          releaseRead = resolve
+        })
+    )
+    handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+      namespace: 'target-1'
+    })
+    handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_CHANGED_NOTIFICATION, {
+      snapshot: snapshot(41, 'last-before-reset'),
+      sourceClientId: 'peer-client'
+    })
+    releaseRead?.(snapshot(1, 'after-reset'))
+    await vi.waitFor(() => expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false))
+
+    expect(getCachedRemoteWorkspaceSnapshot('target-1')?.revision).toBe(1)
+    expect(sent.map((event) => event.snapshot.revision)).toEqual([41, 1])
+    expect(request).toHaveBeenCalledTimes(2)
+  })
+
+  it('still accepts a lower revision after a relay reset', async () => {
+    rememberRemoteWorkspaceSnapshot('target-1', snapshot(40, 'before-reset'))
+    request.mockResolvedValue(snapshot(1, 'after-reset'))
+    handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+      namespace: 'target-1'
+    })
+    await vi.waitFor(() => expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false))
+    expect(getCachedRemoteWorkspaceSnapshot('target-1')?.revision).toBe(1)
+    expect(sent.map((event) => event.snapshot.session.activeTabId)).toEqual(['after-reset'])
+    expect(request).toHaveBeenCalledTimes(1)
+  })
 })
diff --git a/src/main/ipc/remote-workspace-stale-resync.ts b/src/main/ipc/remote-workspace-stale-resync.ts
index 38c96977e97..93f25722df2 100644
--- a/src/main/ipc/remote-workspace-stale-resync.ts
+++ b/src/main/ipc/remote-workspace-stale-resync.ts
@@ -1,7 +1,11 @@
 import type { RemoteWorkspaceObservedSnapshot } from '../../shared/remote-workspace-types'
 import type { SshTarget } from '../../shared/ssh-types'
-import { getRemoteSnapshot } from './remote-workspace-relay-sync'
-import { getCachedRemoteWorkspaceSnapshot } from './remote-workspace-snapshot-cache'
+import { readRemoteSnapshot } from './remote-workspace-relay-sync'
+import {
+  getCachedRemoteWorkspaceSnapshot,
+  remoteWorkspaceSnapshotsAreIdentical,
+  rememberRemoteWorkspaceSnapshot
+} from './remote-workspace-snapshot-cache'
 import { remoteWorkspaceSessionMatchesSnapshot } from './remote-workspace-snapshot-normalization'
 
 type PendingResync = { promise: Promise<void>; requeued: boolean }
@@ -39,17 +43,48 @@ export function resyncStaleRemoteWorkspace(
     try {
       do {
         pending.requeued = false
-        const previous = getCachedRemoteWorkspaceSnapshot(target.id)
-        const snapshot = await getRemoteSnapshot(target)
-        if (!snapshot) {
-          return
+        const cachedBeforeRead = getCachedRemoteWorkspaceSnapshot(target.id)
+        const observation = await readRemoteSnapshot(target, (snapshot) => {
+          // An own patch reply can update the cache while this read is pending.
+          const previous = getCachedRemoteWorkspaceSnapshot(target.id)
+          const changedDuringRead = cachedBeforeRead
+            ? !remoteWorkspaceSnapshotsAreIdentical(previous, cachedBeforeRead)
+            : previous !== undefined
+          if (changedDuringRead) {
+            if (!remoteWorkspaceSnapshotsAreIdentical(previous, snapshot)) {
+              // Reread a conflicting observation; revision comparisons would reject valid relay resets.
+              pending.requeued = true
+              return null
+            }
+            // Only a same-token own ack proves the renderer has this; a stale-revision reply caches undelivered peer state.
+            if (
+              !cachedBeforeRead ||
+              previous?.hostObservationToken === cachedBeforeRead.hostObservationToken
+            ) {
+              return null
+            }
+          }
+          return {
+            unchanged:
+              !changedDuringRead &&
+              remoteWorkspaceSessionMatchesSnapshot(previous, snapshot.session),
+            snapshot: rememberRemoteWorkspaceSnapshot(target.id, snapshot)
+          }
+        })
+        if (!observation) {
+          continue
         }
         // Suppress the echo: our own patch response already cached this session, and re-publishing it
         // makes the renderer rehydrate a state it authored.
-        if (remoteWorkspaceSessionMatchesSnapshot(previous, snapshot.session)) {
+        if (observation.unchanged) {
           continue
         }
-        deliver(snapshot)
+        const latest = getCachedRemoteWorkspaceSnapshot(target.id)
+        if (!remoteWorkspaceSnapshotsAreIdentical(latest, observation.snapshot)) {
+          pending.requeued = true
+          continue
+        }
+        deliver(observation.snapshot)
       } while (pending.requeued)
     } catch (error) {
       onError(error)
diff --git a/src/main/ipc/runtime-environment-cli-removal-routing.test.ts b/src/main/ipc/runtime-environment-cli-removal-routing.test.ts
new file mode 100644
index 00000000000..d0dd7de03e2
--- /dev/null
+++ b/src/main/ipc/runtime-environment-cli-removal-routing.test.ts
@@ -0,0 +1,180 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { encodePairingOffer } from '../../shared/pairing'
+import { REMOTE_RUNTIME_SHARED_CONTROL_CAPABILITY } from '../../shared/protocol-version'
+import type { RemoteRuntimeSubscription } from '../../shared/remote-runtime-client'
+import {
+  addEnvironmentFromPairingCode,
+  getEnvironmentStorePath,
+  removeEnvironment
+} from '../../shared/runtime-environment-store'
+import {
+  getPreferredPairingOffer,
+  type KnownRuntimeEnvironment
+} from '../../shared/runtime-environments'
+import type { RuntimeRpcResponse } from '../../shared/runtime-rpc-envelope'
+import {
+  applyRuntimeEnvironmentCapabilityVerdict,
+  captureRuntimeEnvironmentCapabilityEvidence,
+  resetRuntimeEnvironmentCapabilityEvidence,
+  runtimeEnvironmentCapabilityOutcome
+} from './runtime-environment-capability-evidence'
+
+type ResponseCallbacks = {
+  onResponse: (response: RuntimeRpcResponse<unknown>) => void
+}
+
+const { subscribeMock, supportsMock } = vi.hoisted(() => ({
+  subscribeMock: vi.fn(),
+  supportsMock: vi.fn()
+}))
+
+vi.mock('electron', () => ({ BrowserWindow: { getAllWindows: () => [] } }))
+vi.mock('../../shared/remote-runtime-client', async (importOriginal) => ({
+  ...(await importOriginal()),
+  subscribeRemoteRuntimeRequest: subscribeMock
+}))
+vi.mock('./runtime-environment-shared-control-support', async (importOriginal) => ({
+  ...(await importOriginal()),
+  supportsSharedControl: supportsMock
+}))
+
+import { createRuntimeEnvironmentStatusOwner } from './runtime-environment-status-owner'
+import { subscribeRuntimeEnvironment } from './runtime-environment-transport-routing'
+
+let userDataPath: string
+
+beforeEach(() => {
+  userDataPath = mkdtempSync(join(tmpdir(), 'orca-cli-removal-routing-'))
+  resetRuntimeEnvironmentCapabilityEvidence()
+  subscribeMock.mockReset()
+  supportsMock.mockReset()
+})
+
+afterEach(() => {
+  rmSync(userDataPath, { recursive: true, force: true })
+})
+
+describe('runtime responses the app can no longer attribute to a saved server', () => {
+  it('keeps verifying status after the store stops resolving the environment', () => {
+    const environment = seedEnvironment()
+    const transport = {
+      isReady: () => false,
+      request: vi.fn(),
+      establish: vi.fn(),
+      pause: vi.fn()
+    }
+    const owner = createRuntimeEnvironmentStatusOwner(userDataPath, environment, transport)
+    removeEnvironment(userDataPath, environment.id)
+
+    // A throw here escapes `void verify()` as an unhandled rejection and skips settleWaiters(),
+    // hanging every refresh() caller until its own 15s timeout.
+    expect(() => owner.acceptVerified(statusResponse())).not.toThrow()
+    // Teardown for a removed environment belongs to the removal watcher, not to a status reader.
+    expect(transport.establish).toHaveBeenCalledOnce()
+    owner.dispose()
+  })
+
+  it.each([
+    ['direct subscription', 'browser.screencast'],
+    ['support-routed subscription on a host without shared control', 'files.watch']
+  ])('forwards a %s response after `orca environment rm`', async (_label, method) => {
+    const { deliver, onEvent, environment } = await subscribed(method)
+    // Mirrors the CLI: it edits the store without telling the running app.
+    removeEnvironment(userDataPath, environment.id)
+    const response = {
+      id: method,
+      ok: true as const,
+      result: {},
+      _meta: { runtimeId: 'r' }
+    }
+
+    expect(() => deliver(response)).not.toThrow()
+    expect(onEvent).toHaveBeenCalledWith({ type: 'response', response })
+  })
+
+  it.each([
+    ['direct subscription', 'browser.screencast'],
+    ['support-routed subscription on a host without shared control', 'files.watch']
+  ])('forwards a %s response when the store file is unreadable', async (_label, method) => {
+    const { deliver, onEvent } = await subscribed(method)
+    // Any store failure is fatal on this path, not just a removal: a half-written or
+    // ACL-hardened settings file reaches the same unguarded socket callback.
+    writeFileSync(getEnvironmentStorePath(userDataPath), '{not json')
+    const response = {
+      id: method,
+      ok: true as const,
+      result: {},
+      _meta: { runtimeId: 'r' }
+    }
+
+    expect(() => deliver(response)).not.toThrow()
+    expect(onEvent).toHaveBeenCalledWith({ type: 'response', response })
+  })
+})
+
+function statusResponse() {
+  return {
+    id: 'status.get',
+    ok: true as const,
+    result: {
+      runtimeId: 'r',
+      rendererGraphEpoch: 1,
+      graphStatus: 'ready' as const,
+      authoritativeWindowId: 1,
+      liveTabCount: 0,
+      liveLeafCount: 0,
+      capabilities: [REMOTE_RUNTIME_SHARED_CONTROL_CAPABILITY]
+    },
+    _meta: { runtimeId: 'r' }
+  }
+}
+
+async function subscribed(method: string) {
+  const environment = seedEnvironment()
+  supportsMock.mockResolvedValue(absentOutcome(environment))
+  let callbacks: ResponseCallbacks | null = null
+  subscribeMock.mockImplementation(
+    async (_pairing, _method, _params, _timeoutMs, received: ResponseCallbacks) => {
+      callbacks = received
+      return { close: () => {} } satisfies Partial<RemoteRuntimeSubscription>
+    }
+  )
+  const onEvent = vi.fn()
+  await subscribeRuntimeEnvironment(userDataPath, environment.id, method, {}, 1000, {
+    onEvent,
+    onClose: () => {}
+  })
+  return {
+    deliver: (response: RuntimeRpcResponse<unknown>) => callbacks?.onResponse(response),
+    onEvent,
+    environment
+  }
+}
+
+function seedEnvironment(): KnownRuntimeEnvironment {
+  return addEnvironmentFromPairingCode(userDataPath, {
+    name: 'dev box',
+    pairingCode: encodePairingOffer({
+      v: 2,
+      endpoint: 'ws://127.0.0.1:6768',
+      deviceToken: 'device-token',
+      publicKeyB64: Buffer.from(new Uint8Array(32).fill(1)).toString('base64')
+    })
+  })
+}
+
+function absentOutcome(environment: KnownRuntimeEnvironment) {
+  const evidence = captureRuntimeEnvironmentCapabilityEvidence(
+    environment.id,
+    getPreferredPairingOffer(environment)
+  )
+  applyRuntimeEnvironmentCapabilityVerdict({
+    evidence,
+    verdict: 'absent',
+    runtimeId: 'r'
+  })
+  return runtimeEnvironmentCapabilityOutcome(evidence, 'absent', 'r')
+}
diff --git a/src/main/ipc/runtime-environment-status-owner.ts b/src/main/ipc/runtime-environment-status-owner.ts
index 4ac3c067f74..26b5264ef9f 100644
--- a/src/main/ipc/runtime-environment-status-owner.ts
+++ b/src/main/ipc/runtime-environment-status-owner.ts
@@ -8,7 +8,7 @@ import {
   getPreferredPairingOffer,
   type KnownRuntimeEnvironment
 } from '../../shared/runtime-environments'
-import { markEnvironmentUsed } from '../../shared/runtime-environment-store'
+import { recordRuntimeEnvironmentUsage } from './runtime-environment-usage-record'
 import { RuntimeHostStatusOwner } from '../../shared/runtime-host-status-owner'
 import {
   RUNTIME_HOST_STATUS_CHANNEL,
@@ -61,7 +61,7 @@ export function createRuntimeEnvironmentStatusOwner(
         runtimeId: response._meta.runtimeId
       })
       if (accepted && active && !isRuntimeEnvironmentManuallyDisconnected(environment.id)) {
-        markEnvironmentUsed(userDataPath, environment.id, {
+        recordRuntimeEnvironmentUsage(userDataPath, environment.id, {
           runtimeId: response._meta.runtimeId,
           pairedDeviceId: response.result.pairedDeviceId
         })
diff --git a/src/main/ipc/runtime-environment-support-routing.ts b/src/main/ipc/runtime-environment-support-routing.ts
index 9566b2fc1b7..f81d045a568 100644
--- a/src/main/ipc/runtime-environment-support-routing.ts
+++ b/src/main/ipc/runtime-environment-support-routing.ts
@@ -7,6 +7,7 @@ import type {
 import type { KnownRuntimeEnvironment } from '../../shared/runtime-environments'
 import { getPreferredPairingOffer } from '../../shared/runtime-environments'
 import { markEnvironmentUsed, resolveEnvironment } from '../../shared/runtime-environment-store'
+import { recordRuntimeEnvironmentUsage } from './runtime-environment-usage-record'
 import { ELECTRON_REMOTE_RUNTIME_CLIENT_CAPABILITIES } from '../../shared/protocol-version'
 import {
   subscribeRemoteRuntimeRequest,
@@ -262,7 +263,7 @@ function subscriptionCallbacks(
   return {
     onResponse: (response: RuntimeRpcResponse<unknown>) => {
       if (response.ok && shouldMarkUsed()) {
-        markEnvironmentUsed(args.userDataPath, args.environment.id, {
+        recordRuntimeEnvironmentUsage(args.userDataPath, args.environment.id, {
           runtimeId: response._meta.runtimeId
         })
       }
diff --git a/src/main/ipc/runtime-environment-transport-routing.ts b/src/main/ipc/runtime-environment-transport-routing.ts
index f39962c20cb..327f1428ea7 100644
--- a/src/main/ipc/runtime-environment-transport-routing.ts
+++ b/src/main/ipc/runtime-environment-transport-routing.ts
@@ -1,6 +1,7 @@
 import { getPreferredPairingOffer } from '../../shared/runtime-environments'
 import { ELECTRON_REMOTE_RUNTIME_CLIENT_CAPABILITIES } from '../../shared/protocol-version'
 import { resolveEnvironment, markEnvironmentUsed } from '../../shared/runtime-environment-store'
+import { recordRuntimeEnvironmentUsage } from './runtime-environment-usage-record'
 import { isOrchestrationMutation } from '../../shared/orchestration-rpc-contract'
 import type {
   RuntimeOrchestrationEnvelope,
@@ -195,7 +196,7 @@ export async function subscribeRuntimeEnvironment(
       return
     }
     markedUsed = true
-    markEnvironmentUsed(userDataPath, environment.id, { runtimeId })
+    recordRuntimeEnvironmentUsage(userDataPath, environment.id, { runtimeId })
   }
   const callbacksWithMarkUsed = {
     onResponse: (response: RuntimeRpcResponse<unknown>) => {
diff --git a/src/main/ipc/runtime-environment-usage-record.ts b/src/main/ipc/runtime-environment-usage-record.ts
new file mode 100644
index 00000000000..af56ede3a30
--- /dev/null
+++ b/src/main/ipc/runtime-environment-usage-record.ts
@@ -0,0 +1,26 @@
+import { markEnvironmentUsed } from '../../shared/runtime-environment-store'
+
+/**
+ * Records `lastUsedAt` for callers that cannot report a failure to anyone.
+ *
+ * Why: subscription frames arrive on a websocket callback with no promise to reject and no
+ * caller to observe the result, so a throw from the store unwinds into the socket emitter and
+ * kills the main process. `orca environment rm` makes that routine — it edits the store behind
+ * the running app's back, so every later response resolves an environment that is gone. Usage
+ * bookkeeping has no consumer, so nothing here is worth an exception. Awaited request paths keep
+ * calling `markEnvironmentUsed` directly: there the rejection is observable and correct.
+ */
+export function recordRuntimeEnvironmentUsage(
+  userDataPath: string,
+  selector: string,
+  args: { runtimeId?: string | null; pairedDeviceId?: string } = {}
+): void {
+  try {
+    markEnvironmentUsed(userDataPath, selector, args)
+  } catch (error) {
+    console.warn(
+      `Skipped last-used bookkeeping for runtime environment ${selector}:`,
+      error instanceof Error ? error.message : error
+    )
+  }
+}
diff --git a/src/main/ipc/sender-scoped-request-cancellation.test.ts b/src/main/ipc/sender-scoped-request-cancellation.test.ts
new file mode 100644
index 00000000000..e8bfc6b8d6b
--- /dev/null
+++ b/src/main/ipc/sender-scoped-request-cancellation.test.ts
@@ -0,0 +1,148 @@
+import { EventEmitter } from 'node:events'
+import type { IpcMainInvokeEvent } from 'electron'
+import { describe, expect, it } from 'vitest'
+import { createSenderScopedRequestCancellations } from './sender-scoped-request-cancellation'
+
+function requestEvent(id = 1) {
+  const sender = Object.assign(new EventEmitter(), { id })
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The registry only reads sender.id and its EventEmitter lifetime methods.
+  const event = { sender } as unknown as IpcMainInvokeEvent
+  return { sender, event }
+}
+
+const lifetimeEvents = ['destroyed', 'render-process-gone', 'did-navigate'] as const
+
+describe('sender-scoped request lifetime', () => {
+  it.each(lifetimeEvents)(
+    'aborts every owned request on %s and preserves another sender',
+    (name) => {
+      const registry = createSenderScopedRequestCancellations()
+      const first = requestEvent(1)
+      const second = requestEvent(2)
+      const firstRequests = ['one', 'two'].map((token) => registry.begin(first.event, token))
+      const secondRequest = registry.begin(second.event, 'one')
+
+      first.sender.emit(name)
+
+      expect(firstRequests.map((request) => request?.signal.aborted)).toEqual([true, true])
+      expect(secondRequest?.signal.aborted).toBe(false)
+      for (const eventName of lifetimeEvents) {
+        expect(first.sender.listenerCount(eventName)).toBe(0)
+      }
+      registry.finish(second.event, 'one', secondRequest)
+    }
+  )
+
+  it('keeps only one set of lifecycle listeners for concurrent requests', () => {
+    const registry = createSenderScopedRequestCancellations()
+    const { event, sender } = requestEvent()
+    const controllers = Array.from({ length: 100 }, (_, index) => registry.begin(event, `${index}`))
+
+    for (const name of lifetimeEvents) {
+      expect(sender.listenerCount(name)).toBe(1)
+    }
+    controllers.forEach((controller, index) => registry.finish(event, `${index}`, controller))
+    for (const name of lifetimeEvents) {
+      expect(sender.listenerCount(name)).toBe(0)
+    }
+    expect(controllers.some((controller) => controller?.signal.aborted)).toBe(false)
+  })
+
+  it('does not accumulate live requests across repeated document replacements', () => {
+    const registry = createSenderScopedRequestCancellations()
+    const { event, sender } = requestEvent()
+    const controllers: AbortController[] = []
+    for (let generation = 0; generation < 16; generation++) {
+      if (generation > 0) {
+        sender.emit('did-navigate')
+      }
+      for (let request = 0; request < 100; request++) {
+        const controller = registry.begin(event, `${generation}:${request}`)
+        if (controller) {
+          controllers.push(controller)
+        }
+      }
+    }
+
+    expect(controllers.filter((controller) => !controller.signal.aborted)).toHaveLength(100)
+    for (const name of lifetimeEvents) {
+      expect(sender.listenerCount(name)).toBe(1)
+    }
+    sender.emit('destroyed')
+    expect(controllers.every((controller) => controller.signal.aborted)).toBe(true)
+  })
+
+  it('preserves requests across same-document or prevented navigation', () => {
+    const registry = createSenderScopedRequestCancellations()
+    const { event, sender } = requestEvent()
+    const controller = registry.begin(event, 'one')
+
+    sender.emit('did-start-navigation')
+    sender.emit('will-navigate', { defaultPrevented: true })
+    sender.emit('did-navigate-in-page')
+
+    expect(controller?.signal.aborted).toBe(false)
+    registry.finish(event, 'one', controller)
+  })
+
+  it('keeps the replacement when an old request finishes late', () => {
+    const registry = createSenderScopedRequestCancellations()
+    const { event, sender } = requestEvent()
+    const old = registry.begin(event, 'one')
+    const replacement = registry.begin(event, 'one')
+    expect(old?.signal.aborted).toBe(true)
+
+    registry.finish(event, 'one', old)
+    registry.cancel(event, 'one')
+
+    expect(replacement?.signal.aborted).toBe(true)
+    registry.finish(event, 'one', replacement)
+    for (const name of lifetimeEvents) {
+      expect(sender.listenerCount(name)).toBe(0)
+    }
+  })
+
+  it('does not let a prior document finish remove the current document owner', () => {
+    const registry = createSenderScopedRequestCancellations()
+    const { event, sender } = requestEvent()
+    const old = registry.begin(event, 'one')
+    sender.emit('did-navigate')
+    const current = registry.begin(event, 'one')
+
+    registry.finish(event, 'one', old)
+    expect(current?.signal.aborted).toBe(false)
+    sender.emit('render-process-gone')
+
+    expect(current?.signal.aborted).toBe(true)
+  })
+
+  it('allows synchronous finish callbacks while aborting the owner', () => {
+    const registry = createSenderScopedRequestCancellations()
+    const { event, sender } = requestEvent()
+    const first = registry.begin(event, 'one')
+    const second = registry.begin(event, 'two')
+    first?.signal.addEventListener('abort', () => registry.finish(event, 'one', first))
+    second?.signal.addEventListener('abort', () => registry.finish(event, 'two', second))
+
+    sender.emit('destroyed')
+
+    expect(first?.signal.aborted).toBe(true)
+    expect(second?.signal.aborted).toBe(true)
+    for (const name of lifetimeEvents) {
+      expect(sender.listenerCount(name)).toBe(0)
+    }
+  })
+
+  it('preserves the no-token opt-out and ignores unknown cancellation', () => {
+    const registry = createSenderScopedRequestCancellations()
+    const { event, sender } = requestEvent()
+
+    expect(registry.begin(event, undefined)).toBeNull()
+    expect(registry.begin(event, '')).toBeNull()
+    registry.finish(event, undefined, null)
+    registry.cancel(event, 'unknown')
+    for (const name of lifetimeEvents) {
+      expect(sender.listenerCount(name)).toBe(0)
+    }
+  })
+})
diff --git a/src/main/ipc/sender-scoped-request-cancellation.ts b/src/main/ipc/sender-scoped-request-cancellation.ts
index 9700be9c3da..229bc33c7fd 100644
--- a/src/main/ipc/sender-scoped-request-cancellation.ts
+++ b/src/main/ipc/sender-scoped-request-cancellation.ts
@@ -1,4 +1,5 @@
 import type { IpcMainInvokeEvent } from 'electron'
+import { abortWhenRendererGone } from './renderer-lifetime-abort'
 
 export type SenderScopedRequestCancellations = {
   /** Registers a cancellable request; aborts any previous request that reused the token. */
@@ -13,38 +14,67 @@ export type SenderScopedRequestCancellations = {
   cancel: (event: IpcMainInvokeEvent, requestToken: string) => void
 }
 
-/**
- * Registry for renderer-cancellable IPC requests. Keys are scoped to the
- * issuing webContents so one window's token can never cancel another window's
- * request, and reusing a token aborts the previous request before the new one
- * registers.
- */
+type SenderRequests = {
+  controllers: Map<string, AbortController>
+  lifetime: ReturnType<typeof abortWhenRendererGone>
+}
+
+/** Requests belong to the issuing document; one window cannot cancel another's work. */
 export function createSenderScopedRequestCancellations(): SenderScopedRequestCancellations {
-  const controllers = new Map<string, AbortController>()
-  const keyFor = (event: IpcMainInvokeEvent, requestToken: string): string =>
-    `${event.sender.id}\0${requestToken}`
+  const senders = new Map<number, SenderRequests>()
+  const release = (senderId: number, requests: SenderRequests): void => {
+    if (senders.get(senderId) === requests) {
+      senders.delete(senderId)
+    }
+    requests.lifetime.dispose()
+  }
+  const requestsFor = (event: IpcMainInvokeEvent): SenderRequests => {
+    const senderId = event.sender.id
+    let requests = senders.get(senderId)
+    if (!requests) {
+      const lifetime = abortWhenRendererGone(event.sender)
+      const owned: SenderRequests = { controllers: new Map(), lifetime }
+      senders.set(senderId, owned)
+      lifetime.signal.addEventListener(
+        'abort',
+        () => {
+          // Detach before abort callbacks can finish old requests or register new ones.
+          release(senderId, owned)
+          for (const controller of owned.controllers.values()) {
+            controller.abort()
+          }
+          owned.controllers.clear()
+        },
+        { once: true }
+      )
+      requests = owned
+    }
+    return requests
+  }
   return {
     begin: (event, requestToken) => {
       if (!requestToken) {
         return null
       }
-      const key = keyFor(event, requestToken)
-      controllers.get(key)?.abort()
+      senders.get(event.sender.id)?.controllers.get(requestToken)?.abort()
       const controller = new AbortController()
-      controllers.set(key, controller)
+      requestsFor(event).controllers.set(requestToken, controller)
       return controller
     },
     finish: (event, requestToken, controller) => {
       if (!requestToken || !controller) {
         return
       }
-      const key = keyFor(event, requestToken)
-      if (controllers.get(key) === controller) {
-        controllers.delete(key)
+      const requests = senders.get(event.sender.id)
+      if (requests?.controllers.get(requestToken) === controller) {
+        requests.controllers.delete(requestToken)
+        if (requests.controllers.size === 0) {
+          release(event.sender.id, requests)
+        }
       }
     },
     cancel: (event, requestToken) => {
-      controllers.get(keyFor(event, requestToken))?.abort()
+      senders.get(event.sender.id)?.controllers.get(requestToken)?.abort()
     }
   }
 }
diff --git a/src/main/ipc/session.ts b/src/main/ipc/session.ts
index 9fdfd8214b2..f1f0c1b14e1 100644
--- a/src/main/ipc/session.ts
+++ b/src/main/ipc/session.ts
@@ -1,11 +1,13 @@
 import { ipcMain } from 'electron'
 import type { Store } from '../persistence'
+import type { OrcaRuntimeService } from '../runtime/orca-runtime'
+import { parseTerminalSurfaceCloseTarget } from '../../shared/terminal-surface-close-target'
 import type {
   WorkspaceSessionPatch,
   WorkspaceSessionState
 } from '../../shared/workspace-session-state-types'
 
-export function registerSessionHandlers(store: Store): void {
+export function registerSessionHandlers(store: Store, runtime: OrcaRuntimeService): void {
   // Why: hostId is an optional second arg so an older renderer that invokes
   // these channels without it keeps reading/writing the 'local' partition
   // exactly as before. Channel names stay stable.
@@ -28,20 +30,42 @@ export function registerSessionHandlers(store: Store): void {
     store.patchWorkspaceSession(args, hostId)
   })
 
+  // Why: a renderer save cannot shrink membership main owns, so each close commits it explicitly.
+  ipcMain.handle(
+    'session:close-terminal-surface',
+    (_event, args: { worktreeId?: unknown; target?: unknown; reason?: unknown } | undefined) => {
+      const target = parseTerminalSurfaceCloseTarget(args?.target)
+      if (typeof args?.worktreeId !== 'string' || !target) {
+        throw new Error('invalid_terminal_surface')
+      }
+      // Why only these two: main alone closes a tab for its process exit.
+      return runtime.closeTerminalSurfaceFromRenderer({
+        worktreeId: args.worktreeId,
+        target,
+        reason: args.reason === 'cleanup' ? 'cleanup' : 'user'
+      })
+    }
+  )
+
   ipcMain.handle('session:flush', () => {
     // Why: durable lifecycle RPCs must propagate disk failures instead of
     // returning success through Store.flush(), which intentionally only logs.
-    store.flushOrThrow()
+    return store.flushPendingOrThrowAsync()
   })
 
-  // Synchronous variant for the renderer's beforeunload handler.
-  // sendSync blocks the renderer until this returns, guaranteeing the
-  // data (including terminal scrollback buffers) is persisted to disk
-  // before the window closes — regardless of before-quit ordering.
+  // Older renderers block on the reply; main remains free to await the writer.
   ipcMain.on('session:set-sync', (event, args: WorkspaceSessionState, hostId?: string | null) => {
-    store.setWorkspaceSession(args, hostId)
-    store.flush()
-    event.returnValue = true
+    void (async () => {
+      try {
+        store.setWorkspaceSession(args, hostId)
+        await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+      } catch (error) {
+        console.error('[persistence] Failed to flush legacy session checkpoint:', error)
+      } finally {
+        // This legacy response has always been best effort, including on disk errors.
+        event.returnValue = true
+      }
+    })()
   })
 
   ipcMain.on(
diff --git a/src/main/ipc/settings.ts b/src/main/ipc/settings.ts
index f3c1b8aeaf8..d2a79ef1885 100644
--- a/src/main/ipc/settings.ts
+++ b/src/main/ipc/settings.ts
@@ -12,6 +12,7 @@ import { SETTINGS_CHANGED_WHITELIST, type SettingsChangedKey } from '../../share
 import type { AgentAwakeService } from '../agent-awake-service'
 import { sanitizeFloatingWorkspaceDirectorySetting } from './floating-workspace-directory'
 import { applyAgentStatusHooksEnabled } from '../agent-hooks/managed-agent-hook-controls'
+import { isAgentStatusHooksEnabledForAgent } from '../../shared/agent-status-hooks-setting'
 import { recordManagedHookInstallFailure } from '../agent-hooks/install-telemetry'
 import { applyElectronProxySettings } from '../network/proxy-settings'
 import { applyBrowserSessionProxies } from '../browser/browser-session-proxy'
@@ -242,13 +243,7 @@ export function registerSettingsHandlers(
           userInitiated: true,
           shouldHydrateShellPath: app.isPackaged,
           onInstallError: recordManagedHookInstallFailure,
-          shouldContinue: (agent) => {
-            const settings = store.getSettings()
-            return (
-              settings.agentStatusHooksEnabled !== false &&
-              !settings.disabledTuiAgents.includes(agent)
-            )
-          }
+          shouldContinue: (agent) => isAgentStatusHooksEnabledForAgent(store.getSettings(), agent)
         })
       } catch (error) {
         console.warn('[settings] failed to reconcile managed agent hooks:', error)
diff --git a/src/main/ipc/shallow-watch-delivery-probe-lifetime.test.ts b/src/main/ipc/shallow-watch-delivery-probe-lifetime.test.ts
new file mode 100644
index 00000000000..6ca70330518
--- /dev/null
+++ b/src/main/ipc/shallow-watch-delivery-probe-lifetime.test.ts
@@ -0,0 +1,145 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const h = vi.hoisted(() => ({
+  watch: vi.fn(),
+  mkdir: vi.fn(),
+  write: vi.fn(),
+  remove: vi.fn(),
+  close: vi.fn(),
+  on: vi.fn(),
+  deliver: () => {},
+  fail: () => {}
+}))
+
+vi.mock('node:fs', () => ({ watch: h.watch }))
+vi.mock('node:fs/promises', () => ({
+  mkdtemp: h.mkdir,
+  writeFile: h.write,
+  rm: h.remove
+}))
+
+import {
+  detectShallowWatchDelivery,
+  measureShallowWatchDelivery,
+  resetShallowWatchDeliveryProbeForTests
+} from './shallow-watch-delivery-probe'
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.resetAllMocks()
+  resetShallowWatchDeliveryProbeForTests()
+  h.deliver = () => {}
+  h.fail = () => {}
+  h.mkdir.mockResolvedValue('/fake-shallow-probe')
+  h.write.mockResolvedValue(undefined)
+  h.remove.mockResolvedValue(undefined)
+  h.on.mockImplementation((_event: string, callback: () => void) => {
+    h.fail = callback
+  })
+  h.watch.mockImplementation((_path: string, _options: unknown, callback: () => void) => {
+    h.deliver = callback
+    return { on: h.on, close: h.close }
+  })
+})
+
+afterEach(() => {
+  vi.clearAllTimers()
+  vi.useRealTimers()
+  resetShallowWatchDeliveryProbeForTests()
+})
+
+function expectReleased(): void {
+  expect(h.close).toHaveBeenCalledOnce()
+  expect(vi.getTimerCount()).toBe(0)
+  expect(h.remove).toHaveBeenCalledExactlyOnceWith('/fake-shallow-probe', {
+    recursive: true,
+    force: true
+  })
+}
+
+describe('shallow probe resource ownership', () => {
+  it.each([1, 2])('closes the watcher and clears the timer when write %i fails', async (write) => {
+    if (write === 2) {
+      h.write.mockResolvedValueOnce(undefined)
+    }
+    h.write.mockRejectedValueOnce(new Error('ENOSPC'))
+
+    await expect(measureShallowWatchDelivery()).resolves.toBe(false)
+
+    expect(h.write).toHaveBeenCalledTimes(write)
+    expectReleased()
+    expect(h.close.mock.invocationCallOrder[0]).toBeLessThan(h.remove.mock.invocationCallOrder[0])
+  })
+
+  it('releases resources after successful delivery', async () => {
+    h.write.mockImplementation(async () => h.deliver())
+
+    await expect(measureShallowWatchDelivery()).resolves.toBe(true)
+
+    expect(h.write).toHaveBeenCalledTimes(2)
+    expectReleased()
+  })
+
+  it('releases resources after the delivery deadline', async () => {
+    const result = measureShallowWatchDelivery(20)
+    await vi.advanceTimersByTimeAsync(20)
+
+    await expect(result).resolves.toBe(false)
+    expectReleased()
+  })
+
+  it('releases resources when the watcher reports an error', async () => {
+    h.write.mockImplementation(async () => h.fail())
+
+    await expect(measureShallowWatchDelivery()).resolves.toBe(false)
+    expectReleased()
+  })
+
+  it.each(['delivery', 'write failure'])(
+    'preserves false fallback when close throws after %s',
+    async (outcome) => {
+      h.close.mockImplementation(() => {
+        throw new Error('close failed')
+      })
+      if (outcome === 'delivery') {
+        h.write.mockImplementation(async () => h.deliver())
+      } else {
+        h.write.mockRejectedValueOnce(new Error('write failed'))
+      }
+
+      await expect(measureShallowWatchDelivery()).resolves.toBe(false)
+      expectReleased()
+    }
+  )
+
+  it('removes the directory when watcher creation fails', async () => {
+    h.watch.mockImplementation(() => {
+      throw new Error('EMFILE')
+    })
+
+    await expect(measureShallowWatchDelivery()).resolves.toBe(false)
+
+    expect(h.close).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+    expect(h.remove).toHaveBeenCalledOnce()
+  })
+
+  it('keeps successful delivery when temporary-directory removal fails', async () => {
+    h.write.mockImplementation(async () => h.deliver())
+    h.remove.mockRejectedValue(new Error('cleanup failed'))
+
+    await expect(measureShallowWatchDelivery()).resolves.toBe(true)
+    expectReleased()
+  })
+
+  it('caches a failed probe once per process after releasing its resources', async () => {
+    h.write.mockRejectedValueOnce(new Error('write failed'))
+
+    await expect(detectShallowWatchDelivery()).resolves.toBe(false)
+    await expect(detectShallowWatchDelivery()).resolves.toBe(false)
+
+    expect(h.watch).toHaveBeenCalledOnce()
+    expect(h.write).toHaveBeenCalledOnce()
+    expectReleased()
+  })
+})
diff --git a/src/main/ipc/shallow-watch-delivery-probe.ts b/src/main/ipc/shallow-watch-delivery-probe.ts
index ed32ff39ab1..09970e4c082 100644
--- a/src/main/ipc/shallow-watch-delivery-probe.ts
+++ b/src/main/ipc/shallow-watch-delivery-probe.ts
@@ -19,17 +19,22 @@ export async function measureShallowWatchDelivery(timeoutMs = PROBE_TIMEOUT_MS):
     directory = await mkdtemp(join(tmpdir(), 'orca-shallow-probe-'))
     const { promise, resolve } = Promise.withResolvers<boolean>()
     const watcher = watch(directory, { persistent: false }, () => resolve(true))
-    watcher.on('error', () => resolve(false))
-    // Deliberately not unref'd: this one-shot must resolve even if the child
-    // has no other pending work at probe time.
-    const timer = setTimeout(() => resolve(false), timeoutMs)
-    // Two writes: some backends coalesce the creation of the first entry.
-    await writeFile(join(directory, 'probe'), '1')
-    await writeFile(join(directory, 'probe'), '2')
-    const delivered = await promise
-    clearTimeout(timer)
-    watcher.close()
-    return delivered
+    let timer: ReturnType<typeof setTimeout> | undefined
+    try {
+      watcher.on('error', () => resolve(false))
+      // Deliberately not unref'd: this one-shot must resolve even if the child
+      // has no other pending work at probe time.
+      timer = setTimeout(() => resolve(false), timeoutMs)
+      // Two writes: some backends coalesce the creation of the first entry.
+      await writeFile(join(directory, 'probe'), '1')
+      await writeFile(join(directory, 'probe'), '2')
+      return await promise
+    } finally {
+      if (timer !== undefined) {
+        clearTimeout(timer)
+      }
+      watcher.close()
+    }
   } catch {
     return false
   } finally {
diff --git a/src/main/ipc/speech-worker-exit-lifetime.test.ts b/src/main/ipc/speech-worker-exit-lifetime.test.ts
new file mode 100644
index 00000000000..dc0cfb4a210
--- /dev/null
+++ b/src/main/ipc/speech-worker-exit-lifetime.test.ts
@@ -0,0 +1,288 @@
+import { EventEmitter } from 'node:events'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Store } from '../persistence'
+import type { ModelManager } from '../speech/model-manager'
+import type { SttService } from '../speech/stt-service'
+import type { RuntimeStore } from '../runtime/runtime-store-contract'
+
+type SpeechHandler = (
+  event: { sender: { id: number } },
+  modelOrSession: string,
+  hotwords?: string[],
+  sessionId?: string
+) => Promise<void>
+
+type TestWorker = EventEmitter & {
+  emitStoppedOnStop: boolean
+  postMessage: (message: { type: string }) => void
+}
+
+const environment = vi.hoisted(
+  (): {
+    handlers: Map<string, SpeechHandler>
+    window: TestWindow | null
+    service: SttService | null
+    workers: TestWorker[]
+    readyOnInit: boolean
+  } => ({
+    handlers: new Map<string, SpeechHandler>(),
+    window: null,
+    service: null,
+    workers: [],
+    readyOnInit: true
+  })
+)
+
+vi.mock('electron', () => ({
+  ipcMain: {
+    handle: (name: string, callback: SpeechHandler) => environment.handlers.set(name, callback)
+  },
+  BrowserWindow: { fromWebContents: () => environment.window },
+  systemPreferences: {
+    getMediaAccessStatus: () => 'granted',
+    askForMediaAccess: async () => true
+  }
+}))
+vi.mock('../speech/speech-runtime-service', () => ({
+  getSpeechModelManager: () => ({ getModelState: async () => ({ status: 'ready' }) }),
+  getSpeechSttService: () => environment.service
+}))
+vi.mock('../speech/openai-api-key-store', () => ({
+  readOpenAiSpeechApiKey: vi.fn(),
+  clearOpenAiSpeechApiKey: vi.fn(),
+  hasOpenAiSpeechApiKey: () => false,
+  saveOpenAiSpeechApiKey: vi.fn()
+}))
+vi.mock('../speech/model-catalog', () => ({
+  SPEECH_MODEL_CATALOG: [],
+  getCatalogModel: () => ({
+    id: 'test-model',
+    provider: 'local',
+    type: 'transducer',
+    streaming: true,
+    sampleRate: 16000,
+    files: []
+  })
+}))
+vi.mock('../speech/stt-worker-paths', () => ({
+  getSttWorkerPath: () => 'unused-worker',
+  getSherpaModulePath: () => 'unused-module'
+}))
+vi.mock('node:worker_threads', async () => {
+  const { EventEmitter: WorkerEvents } = await import('node:events')
+  return {
+    Worker: class extends WorkerEvents implements TestWorker {
+      emitStoppedOnStop = true
+      constructor() {
+        super()
+        environment.workers.push(this)
+      }
+      postMessage(message: { type: string }): void {
+        if (message.type === 'init' && environment.readyOnInit) {
+          queueMicrotask(() => this.emit('message', { type: 'ready' }))
+        }
+        if (message.type === 'stop' && this.emitStoppedOnStop) {
+          queueMicrotask(() => this.emit('message', { type: 'stopped' }))
+        }
+      }
+      async terminate(): Promise<number> {
+        this.emit('exit', 0)
+        return 0
+      }
+    }
+  }
+})
+
+import { registerSpeechHandlers } from './speech'
+import { SttService as SpeechService } from '../speech/stt-service'
+import { RuntimeMobileDictationController } from '../runtime/runtime-mobile-dictation-controller'
+
+class TestWindow extends EventEmitter {
+  destroyed = false
+  webContents = { send: vi.fn() }
+  isDestroyed(): boolean {
+    return this.destroyed
+  }
+}
+
+function handler(name: string): SpeechHandler {
+  const callback = environment.handlers.get(name)
+  if (!callback) {
+    throw new Error(`Missing handler: ${name}`)
+  }
+  return callback
+}
+
+function worker(): TestWorker {
+  const current = environment.workers.at(-1)
+  if (!current) {
+    throw new Error('No worker created')
+  }
+  return current
+}
+
+function service(): SttService {
+  if (!environment.service) {
+    throw new Error('No service created')
+  }
+  return environment.service
+}
+
+const sender = { sender: { id: 9 } }
+const start = (session = 'one'): Promise<void> =>
+  handler('speech:startDictation')(sender, 'test-model', undefined, session)
+const stop = (session = 'one'): Promise<void> => handler('speech:stopDictation')(sender, session)
+
+describe('speech worker exit ownership', () => {
+  let window: TestWindow
+  beforeEach(() => {
+    environment.handlers.clear()
+    environment.workers = []
+    environment.readyOnInit = true
+    window = new TestWindow()
+    environment.window = window
+    const modelManager: Pick<ModelManager, 'getModelState' | 'getModelDir'> = {
+      getModelState: async () => ({ id: 'test-model', status: 'ready' as const }),
+      getModelDir: () => 'unused-model'
+    }
+    environment.service = new SpeechService(
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Local startup reads only these two model-manager methods.
+      modelManager as ModelManager
+    )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Mocked runtime accessors do not read the store.
+    registerSpeechHandlers({} as Store)
+  })
+  afterEach(async () => {
+    window.destroyed = true
+    window.emit('closed')
+    await Promise.resolve()
+    await Promise.resolve()
+    await service().prepareModelForDeletion('test-model')
+  })
+
+  it.each([0, 1])('releases the window listener after unexpected exit code %i', async (code) => {
+    for (let cycle = 0; cycle < 15; cycle++) {
+      await start(String(cycle))
+      expect(window.listenerCount('closed')).toBe(1)
+      const current = worker()
+      current.emit('exit', code)
+      expect(service().isActive()).toBe(false)
+      expect(window.listenerCount('closed')).toBe(0)
+      expect(current.listenerCount('message')).toBe(0)
+      expect(current.listenerCount('error')).toBe(0)
+      expect(current.listenerCount('exit')).toBe(0)
+      await stop(String(cycle))
+    }
+    expect(
+      window.webContents.send.mock.calls.filter(([name]) => name === 'speech:stopped')
+    ).toHaveLength(15)
+  })
+
+  it('does not duplicate the in-flight stop notification', async () => {
+    await start()
+    worker().emitStoppedOnStop = false
+    const pendingStop = stop()
+    worker().emit('exit', 1)
+    await pendingStop
+    expect(window.listenerCount('closed')).toBe(0)
+    expect(
+      window.webContents.send.mock.calls.filter(([name]) => name === 'speech:stopped')
+    ).toHaveLength(1)
+  })
+
+  it('keeps a normal stop reusable and ignores a later idle-worker exit', async () => {
+    await start()
+    const current = worker()
+    await stop()
+    expect(window.listenerCount('closed')).toBe(0)
+    await start('two')
+    expect(worker()).toBe(current)
+    await stop('two')
+    current.emit('exit', 0)
+    expect(
+      window.webContents.send.mock.calls.filter(([name]) => name === 'speech:stopped')
+    ).toHaveLength(2)
+  })
+
+  it('cleans a failed startup and allows a new session', async () => {
+    environment.readyOnInit = false
+    const pendingStart = start()
+    const rejected = expect(pendingStart).rejects.toThrow('Speech worker exited before ready: 1')
+    await Promise.resolve()
+    worker().emit('exit', 1)
+    await rejected
+    expect(window.listenerCount('closed')).toBe(0)
+    environment.readyOnInit = true
+    await start('two')
+    expect(service().isActive()).toBe(true)
+    await stop('two')
+  })
+
+  it('preserves error delivery and listener cleanup', async () => {
+    await start()
+    const current = worker()
+    current.emit('error', new Error('synthetic failure'))
+    await vi.waitFor(() => expect(window.listenerCount('closed')).toBe(0))
+    expect(window.webContents.send).toHaveBeenCalledWith('speech:error', {
+      error: 'Error: synthetic failure',
+      sessionId: 'one'
+    })
+    current.emit('exit', 1)
+    expect(service().isActive()).toBe(false)
+  })
+
+  it('preserves startup cancellation without duplicate stopped events', async () => {
+    environment.readyOnInit = false
+    const pendingStart = start()
+    const rejected = expect(pendingStart).rejects.toThrow('Speech worker exited before ready: 1')
+    await Promise.resolve()
+    worker().emitStoppedOnStop = false
+    const pendingStop = stop()
+    worker().emit('exit', 1)
+    await Promise.all([pendingStop, rejected])
+    expect(window.listenerCount('closed')).toBe(0)
+    expect(
+      window.webContents.send.mock.calls.filter(([name]) => name === 'speech:stopped')
+    ).toHaveLength(1)
+  })
+
+  it('preserves mobile partial text and completion after worker exit', async () => {
+    const store = { getSettings: () => ({ voice: { enabled: true, sttModel: 'test-model' } }) }
+    const controller = new RuntimeMobileDictationController(
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The controller reads settings; mocked speech accessors ignore the rest of the store.
+      () => store as RuntimeStore
+    )
+    const params = { dictationId: 'mobile', clientId: 'client', connectionId: 'connection' }
+    await controller.start(params)
+    worker().emit('message', { type: 'partial', text: 'keep these words' })
+    worker().emit('exit', 0)
+    await expect(controller.finish(params)).resolves.toEqual({
+      dictationId: 'mobile',
+      text: 'keep these words'
+    })
+    expect(service().isActive()).toBe(false)
+  })
+
+  it('clears old ownership before notifying a sink that immediately starts again', async () => {
+    let restarted: Promise<void> | undefined
+    await service().startDictation(
+      'test-model',
+      (event) => {
+        if (event.type === 'stopped') {
+          restarted = service().startDictation('test-model', vi.fn(), undefined, 'replacement')
+        }
+      },
+      undefined,
+      'original'
+    )
+    const retired = worker()
+    retired.emit('exit', 0)
+    expect(restarted).toBeDefined()
+    await restarted
+    expect(worker()).not.toBe(retired)
+    retired.emit('exit', 0)
+    retired.emit('message', { type: 'stopped' })
+    expect(service().isActive()).toBe(true)
+    await service().stopDictation('replacement')
+  })
+})
diff --git a/src/main/ipc/ssh-connection-state-callbacks.ts b/src/main/ipc/ssh-connection-state-callbacks.ts
index e42b164cae8..5daa25ed2b1 100644
--- a/src/main/ipc/ssh-connection-state-callbacks.ts
+++ b/src/main/ipc/ssh-connection-state-callbacks.ts
@@ -120,9 +120,9 @@ export function handleSshConnectionStateChange(targetId: string, state: SshConne
 
 export function createSshConnectionCallbacks(): SshConnectionCallbacks {
   return {
-    onCredentialRequest: (targetId, kind, detail, signal) => {
+    onCredentialRequest: (targetId, kind, detail, echo, signal) => {
       credentialRequestedForTarget.add(targetId)
-      return requestCredential(getCurrentMainWindow, targetId, kind, detail, signal)
+      return requestCredential(getCurrentMainWindow, targetId, kind, detail, echo, signal)
     },
     onStateChange: handleSshConnectionStateChange
   }
diff --git a/src/main/ipc/ssh-host-partition-session-export.test.ts b/src/main/ipc/ssh-host-partition-session-export.test.ts
index 39a85658ae0..1ec5167f866 100644
--- a/src/main/ipc/ssh-host-partition-session-export.test.ts
+++ b/src/main/ipc/ssh-host-partition-session-export.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 /**
  * What the remote-workspace export publishes when the renderer omits `session`, against the real
  * `Store`.
@@ -10,7 +11,7 @@
  * Drives the real `Store` rather than a `getWorkspaceSession` fake: the whole defect is which
  * partition the read reaches, and a fake answers whatever the test tells it to.
  */
-import { mkdtempSync, realpathSync } from 'node:fs'
+import { mkdtempSync, realpathSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
@@ -105,12 +106,13 @@ function runtimeAuthoredTab(): TerminalTab {
   }
 }
 
-const stores: InstanceType<typeof Store>[] = []
+const directories: string[] = []
 let hostSnapshot: RemoteWorkspaceSnapshot
 
-afterEach(() => {
-  for (const store of stores.splice(0)) {
-    store.flush()
+afterEach(async () => {
+  await closeTestStores()
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
   }
   vi.restoreAllMocks()
 })
@@ -162,8 +164,8 @@ beforeEach(() => {
  *  local blob still carries the worktree key with an empty list. */
 function createStrandedStore(): InstanceType<typeof Store> {
   const dir = realpathSync(mkdtempSync(join(tmpdir(), 'orca-ssh-partition-export-')))
-  const store = new Store({ dataFile: join(dir, 'orca-data.json') })
-  stores.push(store)
+  directories.push(dir)
+  const store = createSqliteTestStore(Store, { dataFile: join(dir, 'orca-data.json') })
   store.addRepo(remoteRepo(REPO_ID, '/remote/checkout', TARGET_ID))
   // A second populated SSH partition: the fallback has to reach the publishing target's own
   // partition, not merely "some" partition that happens to hold tabs.
diff --git a/src/main/ipc/ssh-passphrase.test.ts b/src/main/ipc/ssh-passphrase.test.ts
index 560ddd6d6f3..f3d2a65f9ed 100644
--- a/src/main/ipc/ssh-passphrase.test.ts
+++ b/src/main/ipc/ssh-passphrase.test.ts
@@ -25,6 +25,7 @@ describe('SSH credential requests', () => {
       'target-1',
       'keyboard-interactive',
       'Duo response',
+      undefined,
       controller.signal
     )
     const request = vi.mocked(window.webContents.send).mock.calls[0][1] as { requestId: string }
diff --git a/src/main/ipc/ssh-passphrase.ts b/src/main/ipc/ssh-passphrase.ts
index 6de7d483bcd..abebfa3a3ae 100644
--- a/src/main/ipc/ssh-passphrase.ts
+++ b/src/main/ipc/ssh-passphrase.ts
@@ -18,6 +18,7 @@ export function requestCredential(
   targetId: string,
   kind: SshCredentialKind,
   detail: string,
+  echo?: boolean,
   signal?: AbortSignal
 ): Promise<string | null> {
   const requestId = randomUUID()
@@ -43,7 +44,7 @@ export function requestCredential(
 
   const win = getMainWindow()
   if (win && !win.isDestroyed()) {
-    win.webContents.send('ssh:credential-request', { requestId, targetId, kind, detail })
+    win.webContents.send('ssh:credential-request', { requestId, targetId, kind, detail, echo })
   } else {
     finish(null)
   }
diff --git a/src/main/ipc/telemetry.test.ts b/src/main/ipc/telemetry.test.ts
index 9b28270551a..b49e1882e98 100644
--- a/src/main/ipc/telemetry.test.ts
+++ b/src/main/ipc/telemetry.test.ts
@@ -161,6 +161,7 @@ describe('telemetry IPC handlers', () => {
       bucket_source: 'crossed_now'
     })
     handler({}, 'daemon_audit_eligibility', {})
+    handler({}, 'agent_token_usage', {})
     expect(trackMock).not.toHaveBeenCalled()
     expect(getCohortAtEmitMock).not.toHaveBeenCalled()
   })
diff --git a/src/main/ipc/telemetry.ts b/src/main/ipc/telemetry.ts
index 767ebed598f..ad954b20ce1 100644
--- a/src/main/ipc/telemetry.ts
+++ b/src/main/ipc/telemetry.ts
@@ -23,6 +23,7 @@ import type { EventName, EventProps, OptInVia } from '../../shared/telemetry-eve
 let storeRef: Store | null = null
 
 const MAIN_OWNED_TELEMETRY_EVENTS = new Set<EventName>([
+  'agent_token_usage',
   'app_starred_orca',
   'daemon_adopted',
   'daemon_audit_eligibility',
diff --git a/src/main/ipc/terminal-render-desync-evidence.ts b/src/main/ipc/terminal-render-desync-evidence.ts
index 9ea82246539..dc536faf1f8 100644
--- a/src/main/ipc/terminal-render-desync-evidence.ts
+++ b/src/main/ipc/terminal-render-desync-evidence.ts
@@ -1,9 +1,10 @@
 import { mkdir, readdir, rm, stat, writeFile } from 'node:fs/promises'
 import path from 'node:path'
 import { app, ipcMain } from 'electron'
-import type {
-  WriteTerminalRenderDesyncEvidenceArgs,
-  WriteTerminalRenderDesyncEvidenceResult
+import {
+  TERMINAL_RENDER_DESYNC_CAPTURE_ID_PATTERN,
+  type WriteTerminalRenderDesyncEvidenceArgs,
+  type WriteTerminalRenderDesyncEvidenceResult
 } from '../../shared/terminal-render-desync-evidence'
 import { isTrustedUIRenderer } from './ui'
 
@@ -12,7 +13,6 @@ const MAX_PNG_DATA_URL_BYTES = 40 * 1024 * 1024
 const MAX_METADATA_BYTES = 1024 * 1024
 const MAX_CAPTURE_DIRECTORIES = 4
 const MAX_EVIDENCE_BYTES = 96 * 1024 * 1024
-const CAPTURE_ID_PATTERN = /^[a-zA-Z0-9_-]{1,120}$/
 const PNG_DATA_URL_PREFIX = 'data:image/png;base64,'
 let evidenceWriteQueue = Promise.resolve()
 
@@ -41,7 +41,7 @@ export async function writeTerminalRenderDesyncEvidence(
   userDataPath: string,
   args: WriteTerminalRenderDesyncEvidenceArgs
 ): Promise<WriteTerminalRenderDesyncEvidenceResult> {
-  if (!CAPTURE_ID_PATTERN.test(args.captureId)) {
+  if (!TERMINAL_RENDER_DESYNC_CAPTURE_ID_PATTERN.test(args.captureId)) {
     throw new Error('Invalid render-desync capture id')
   }
   if (args.phase !== 'corrupt' && args.phase !== 'healed') {
diff --git a/src/main/ipc/worktree-head-identity-reader.ts b/src/main/ipc/worktree-head-identity-reader.ts
index 64459403341..37471496999 100644
--- a/src/main/ipc/worktree-head-identity-reader.ts
+++ b/src/main/ipc/worktree-head-identity-reader.ts
@@ -310,6 +310,12 @@ export async function readGitCommonHeadIdentities(
         cache.entries.delete(name)
       }
     }
+    // Failed entries may have no cached identity; retire their retry markers on the same evidence.
+    for (const name of cache.unverified) {
+      if (!present.has(name)) {
+        cache.unverified.delete(name)
+      }
+    }
   }
   if (entryNames === null || scope.all || scope.listing) {
     await relist()
diff --git a/src/main/ipc/worktree-head-identity-retirement.test.ts b/src/main/ipc/worktree-head-identity-retirement.test.ts
new file mode 100644
index 00000000000..71830e7f312
--- /dev/null
+++ b/src/main/ipc/worktree-head-identity-retirement.test.ts
@@ -0,0 +1,264 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { join } from 'node:path'
+
+const fake = vi.hoisted(() => ({
+  files: new Map<string, string>(),
+  failures: new Set<string>(),
+  names: new Set<string>(),
+  readFile: vi.fn<(path: string) => Promise<string>>(),
+  readdir: vi.fn<() => Promise<{ name: string; isDirectory: () => boolean }[]>>()
+}))
+vi.mock('node:fs/promises', () => ({ readFile: fake.readFile, readdir: fake.readdir }))
+vi.mock('./worktree-remote', () => ({ notifyWorktreeHeadIdentitiesChanged: vi.fn() }))
+
+import {
+  createWorktreeHeadIdentityCache,
+  readGitCommonHeadIdentities
+} from './worktree-head-identity-reader'
+import {
+  createWorktreeHeadIdentityRefreshState,
+  disposeWorktreeHeadIdentityRefreshState,
+  refreshWorktreeHeadIdentities
+} from './worktree-head-identity-refresh'
+import {
+  FULL_HEAD_IDENTITY_SCOPE,
+  headIdentityScopeForEntry,
+  LISTING_HEAD_IDENTITY_SCOPE,
+  PRIMARY_HEAD_IDENTITY_SCOPE
+} from './worktree-head-identity-scope'
+
+const COMMON = join('/mock', 'project', '.git')
+const OID = 'a'.repeat(40)
+const NEW_OID = 'b'.repeat(40)
+const entryFile = (name: string, file: string): string => join(COMMON, 'worktrees', name, file)
+const worktreePath = (name: string): string => join('/mock', name)
+
+function addEntry(name: string, oid = OID): void {
+  fake.names.add(name)
+  fake.files.set(entryFile(name, 'gitdir'), join(worktreePath(name), '.git'))
+  fake.files.set(entryFile(name, 'HEAD'), oid)
+}
+
+function fsError(code: string): Error {
+  return Object.assign(new Error(`synthetic ${code}`), { code })
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.setSystemTime(1_000_000)
+  vi.resetAllMocks()
+  fake.files.clear()
+  fake.failures.clear()
+  fake.names.clear()
+  fake.files.set(join(COMMON, 'HEAD'), OID)
+  fake.readdir.mockImplementation(async () =>
+    [...fake.names].map((name) => ({ name, isDirectory: () => true }))
+  )
+  fake.readFile.mockImplementation(async (path) => {
+    if (fake.failures.has(path)) {
+      throw fsError('EIO')
+    }
+    const value = fake.files.get(path)
+    if (value === undefined) {
+      throw fsError('ENOENT')
+    }
+    return value
+  })
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('head identity failed-entry retirement', () => {
+  it.each([true, false])(
+    'retires removed failure markers with a prior identity: %s',
+    async (seed) => {
+      const name = 'wt-e\u0301'
+      addEntry(name)
+      const cache = createWorktreeHeadIdentityCache()
+      if (seed) {
+        await readGitCommonHeadIdentities(COMMON, cache)
+      }
+      fake.failures.add(entryFile(name, 'HEAD'))
+      const failed = await readGitCommonHeadIdentities(COMMON, cache)
+      expect(failed.complete).toBe(false)
+      expect(cache.unverified.has(name)).toBe(true)
+      expect(cache.entries.has(name)).toBe(seed)
+      fake.names.delete(name)
+
+      const recovered = await readGitCommonHeadIdentities(
+        COMMON,
+        cache,
+        LISTING_HEAD_IDENTITY_SCOPE
+      )
+
+      expect(recovered.complete).toBe(true)
+      expect(cache.unverified.size).toBe(0)
+      expect(cache.entries.size).toBe(0)
+      expect(recovered.identities.map((identity) => identity.worktreePath)).toEqual([
+        join('/mock', 'project')
+      ])
+    }
+  )
+
+  it.each(['EIO', 'ENOTDIR'])(
+    'preserves failure markers when the listing rejects with %s',
+    async (code) => {
+      addEntry('pending')
+      const cache = createWorktreeHeadIdentityCache()
+      await readGitCommonHeadIdentities(COMMON, cache)
+      fake.failures.add(entryFile('pending', 'HEAD'))
+      await readGitCommonHeadIdentities(COMMON, cache)
+      fake.names.delete('pending')
+      fake.readdir.mockRejectedValue(fsError(code))
+
+      const result = await readGitCommonHeadIdentities(COMMON, cache, LISTING_HEAD_IDENTITY_SCOPE)
+
+      expect(result.complete).toBe(false)
+      expect(cache.unverified.has('pending')).toBe(true)
+      expect(cache.entries.get('pending')?.head).toBe(OID)
+      expect(cache.entryNames).toBeNull()
+    }
+  )
+
+  it('retires failures when the worktrees directory is confirmed absent', async () => {
+    addEntry('removed')
+    const cache = createWorktreeHeadIdentityCache()
+    fake.failures.add(entryFile('removed', 'HEAD'))
+    await readGitCommonHeadIdentities(COMMON, cache)
+    fake.readdir.mockRejectedValue(fsError('ENOENT'))
+
+    const result = await readGitCommonHeadIdentities(COMMON, cache, FULL_HEAD_IDENTITY_SCOPE)
+
+    expect(result.complete).toBe(true)
+    expect(cache.unverified.size).toBe(0)
+    expect(cache.entryNames).toEqual([])
+  })
+
+  it('keeps a listed failed entry retryable and preserves its last verified identity', async () => {
+    addEntry('pending')
+    const cache = createWorktreeHeadIdentityCache()
+    await readGitCommonHeadIdentities(COMMON, cache)
+    fake.failures.add(entryFile('pending', 'HEAD'))
+    await readGitCommonHeadIdentities(COMMON, cache)
+
+    const stillFailed = await readGitCommonHeadIdentities(
+      COMMON,
+      cache,
+      LISTING_HEAD_IDENTITY_SCOPE
+    )
+
+    expect(stillFailed.complete).toBe(false)
+    expect(cache.unverified.has('pending')).toBe(true)
+    expect(cache.entries.get('pending')?.head).toBe(OID)
+    fake.failures.clear()
+    fake.files.set(entryFile('pending', 'HEAD'), NEW_OID)
+    const recovered = await readGitCommonHeadIdentities(COMMON, cache, PRIMARY_HEAD_IDENTITY_SCOPE)
+    expect(recovered.complete).toBe(true)
+    expect(cache.entries.get('pending')?.head).toBe(NEW_OID)
+    expect(cache.unverified.size).toBe(0)
+  })
+
+  it('removes only failure markers absent from the successful listing', async () => {
+    addEntry('removed')
+    addEntry('pending')
+    const cache = createWorktreeHeadIdentityCache()
+    fake.failures.add(entryFile('removed', 'gitdir'))
+    fake.failures.add(entryFile('pending', 'gitdir'))
+    await readGitCommonHeadIdentities(COMMON, cache)
+    fake.names.delete('removed')
+
+    const result = await readGitCommonHeadIdentities(COMMON, cache, LISTING_HEAD_IDENTITY_SCOPE)
+
+    expect(result.complete).toBe(false)
+    expect([...cache.unverified]).toEqual(['pending'])
+  })
+
+  it('reads a reused admin-entry name after its failed predecessor was removed', async () => {
+    addEntry('reused')
+    const cache = createWorktreeHeadIdentityCache()
+    fake.failures.add(entryFile('reused', 'HEAD'))
+    await readGitCommonHeadIdentities(COMMON, cache)
+    fake.names.delete('reused')
+    await readGitCommonHeadIdentities(COMMON, cache, LISTING_HEAD_IDENTITY_SCOPE)
+    fake.failures.clear()
+    addEntry('reused', NEW_OID)
+
+    const result = await readGitCommonHeadIdentities(
+      COMMON,
+      cache,
+      headIdentityScopeForEntry('reused')
+    )
+
+    expect(result.complete).toBe(true)
+    expect(cache.entries.get('reused')?.head).toBe(NEW_OID)
+  })
+
+  it('does not retain historical failures after twenty confirmed removals', async () => {
+    const cache = createWorktreeHeadIdentityCache()
+    for (let index = 0; index < 20; index++) {
+      const name = `removed-${index}`
+      addEntry(name)
+      fake.failures.add(entryFile(name, 'HEAD'))
+      await readGitCommonHeadIdentities(COMMON, cache, FULL_HEAD_IDENTITY_SCOPE)
+      fake.names.delete(name)
+      await readGitCommonHeadIdentities(COMMON, cache, LISTING_HEAD_IDENTITY_SCOPE)
+    }
+
+    expect(cache.unverified.size).toBe(0)
+    expect((await readGitCommonHeadIdentities(COMMON, cache)).complete).toBe(true)
+  })
+
+  it('keeps retirement scoped to the cache that received a successful listing', async () => {
+    addEntry('pending')
+    fake.failures.add(entryFile('pending', 'HEAD'))
+    const first = createWorktreeHeadIdentityCache()
+    const second = createWorktreeHeadIdentityCache()
+    await readGitCommonHeadIdentities(COMMON, first)
+    await readGitCommonHeadIdentities(COMMON, second)
+    fake.names.clear()
+
+    await readGitCommonHeadIdentities(COMMON, first, LISTING_HEAD_IDENTITY_SCOPE)
+
+    expect(first.unverified.size).toBe(0)
+    expect([...second.unverified]).toEqual(['pending'])
+  })
+
+  it('restores scoped refresh costs and drops retired baseline rows after recovery', async () => {
+    for (let index = 0; index < 8; index++) {
+      addEntry(`live-${index}`)
+    }
+    addEntry('retired')
+    const state = createWorktreeHeadIdentityRefreshState()
+    const host: Parameters<typeof refreshWorktreeHeadIdentities>[0] = {
+      path: COMMON,
+      repos: new Map([['repo', {}]]),
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Refresh reads only isDestroyed; the window notifier is mocked.
+      mainWindow: { isDestroyed: () => false } as never,
+      disposed: false
+    }
+    try {
+      await refreshWorktreeHeadIdentities(host, state, false)
+      fake.failures.add(entryFile('retired', 'HEAD'))
+      await refreshWorktreeHeadIdentities(host, state, true, headIdentityScopeForEntry('retired'))
+      fake.names.delete('retired')
+      vi.setSystemTime(1_061_000)
+      await refreshWorktreeHeadIdentities(host, state, false, FULL_HEAD_IDENTITY_SCOPE)
+      fake.readFile.mockClear()
+      fake.readdir.mockClear()
+
+      for (let index = 0; index < 4; index++) {
+        await refreshWorktreeHeadIdentities(host, state, true, headIdentityScopeForEntry('live-0'))
+      }
+
+      expect(fake.readFile).toHaveBeenCalledTimes(8)
+      expect(fake.readdir).not.toHaveBeenCalled()
+      expect(state.cache.unverified.size).toBe(0)
+      expect(state.baseline?.size).toBe(9)
+      expect(state.baseline?.has(worktreePath('retired'))).toBe(false)
+    } finally {
+      disposeWorktreeHeadIdentityRefreshState(state)
+    }
+  })
+})
diff --git a/src/main/ipc/worktree-remote.ts b/src/main/ipc/worktree-remote.ts
index ec77b7e900f..ce11df4f4f0 100644
--- a/src/main/ipc/worktree-remote.ts
+++ b/src/main/ipc/worktree-remote.ts
@@ -74,7 +74,7 @@ import {
 import { requireSshGitProvider } from '../providers/ssh-git-dispatch'
 import { getSshFilesystemProvider } from '../providers/ssh-filesystem-dispatch'
 import type { SshGitProvider } from '../providers/ssh-git-provider'
-import { TUI_AGENT_CONFIG, isTuiAgent } from '../../shared/tui-agent-config'
+import { isTuiAgent } from '../../shared/tui-agent-config'
 import { isWindowsAbsolutePathLike } from '../../shared/cross-platform-path'
 import { runWorktreeChangeInvalidators } from './worktree-change-invalidators'
 import {
@@ -152,11 +152,6 @@ import {
 import { createSequencedSetupAgentCommands } from '../../shared/setup-agent-sequencing'
 import { shouldWaitForSetupBeforeAgentStartup } from '../../shared/setup-agent-startup-policy'
 import { createWorktreeCreateTimingRecorder } from '../worktree-create-timing'
-import {
-  markCodexProjectTrusted,
-  markCopilotFolderTrusted,
-  markCursorWorkspaceTrusted
-} from '../agent-trust-presets'
 import {
   getLocalProjectGitExecOptions,
   getLocalProjectWorktreeGitOptions,
@@ -435,20 +430,6 @@ async function spawnLocalStartupAndSetupTerminals(args: {
 
   try {
     // Why: only after `git worktree add` + metadata registration is the path safe for a runtime PTY to boot the agent while setup runs alongside.
-    if (isTuiAgent(createdWithAgent)) {
-      const preset = TUI_AGENT_CONFIG[createdWithAgent].preflightTrust
-      try {
-        if (preset === 'cursor') {
-          markCursorWorkspaceTrusted(worktree.path)
-        } else if (preset === 'copilot') {
-          markCopilotFolderTrusted(worktree.path)
-        } else if (preset === 'codex') {
-          markCodexProjectTrusted(worktree.path)
-        }
-      } catch {
-        // Best-effort: launch still proceeds and the agent can ask interactively.
-      }
-    }
     const terminal = await runtime.createTerminal(`id:${worktree.id}`, {
       command: sequencedStartup.command,
       ...(setup ? { claudeAgentTeamsSourceCommand: startup.command } : {}),
@@ -2741,7 +2722,8 @@ async function performLocalWorktreeCreate(
             branch: branchName,
             baseBranch,
             refreshLocalBaseRef: settings.refreshLocalBaseRefOnWorktreeCreate,
-            options: preparedWorktreeOptions
+            options: preparedWorktreeOptions,
+            timing
           })
           timing.recordPreparedCheckout(
             prepared.status === 'hit'
@@ -2754,6 +2736,9 @@ async function performLocalWorktreeCreate(
             rearm.fire = prepared.rearm
             return prepared.result
           }
+          if (prepared.rearm) {
+            rearm.fire = prepared.rearm
+          }
         } else {
           timing.recordPreparedCheckout({
             status: 'miss',
@@ -2940,14 +2925,14 @@ async function performLocalWorktreeCreate(
   // Why gated: registration replaces the repo's root set, so registering a create recovered without
   // a listing would revoke filesystem access to every worktree that listing would have named.
   if (listingComplete) {
-    registerWorktreeRootsForRepo(store, repo.id, [
+    registerWorktreeRootsForRepo(store, repo, [
       repo.path,
       ...gitWorktrees.map((worktree) => worktree.path)
     ])
   } else {
     // Recovered without a listing: authorize just the new root, or the create the user just made
     // is rejected by filesystem/git-status IPC until a full scan repopulates the cache.
-    registerCreatedWorktreeRoot(store, repo.id, created.path)
+    registerCreatedWorktreeRoot(store, repo, created.path)
   }
 
   // Why: link user-configured shared paths (e.g. `node_modules`, `.env`) before setup runs so setup scripts see them in place.
diff --git a/src/main/ipc/worktrees-authoritative-local-metadata-pruning.test.ts b/src/main/ipc/worktrees-authoritative-local-metadata-pruning.test.ts
index d7549def4ed..fdeea389d61 100644
--- a/src/main/ipc/worktrees-authoritative-local-metadata-pruning.test.ts
+++ b/src/main/ipc/worktrees-authoritative-local-metadata-pruning.test.ts
@@ -319,7 +319,10 @@ describe('authoritative local worktree metadata pruning integration', () => {
 
       expect(store.removeWorktreeLineage).not.toHaveBeenCalled()
       // Only the detected listing re-derives; its fresh re-scan is what registers the roots.
-      expect(isRegisteredWorktreePath(REPO_PATH)).toBe(channel === 'worktrees:listDetected')
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture supplies the local repository rows read by this registry check.
+      expect(isRegisteredWorktreePath(REPO_PATH, store as never)).toBe(
+        channel === 'worktrees:listDetected'
+      )
     }
   )
 
@@ -357,7 +360,8 @@ describe('authoritative local worktree metadata pruning integration', () => {
     await pending
 
     expect(store.removeWorktreeLineage).not.toHaveBeenCalled()
-    expect(isRegisteredWorktreePath(newPath)).toBe(true)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture supplies the local repository rows read by this registry check.
+    expect(isRegisteredWorktreePath(newPath, store as never)).toBe(true)
   })
 
   it.each(['scan generation', 'caller request'] as const)(
@@ -406,7 +410,8 @@ describe('authoritative local worktree metadata pruning integration', () => {
 
       expect(store.pruneSessionlessMissingLocalWorktreeMetadataForRepo).not.toHaveBeenCalled()
       expect(store.removeWorktreeLineage).not.toHaveBeenCalled()
-      expect(isRegisteredWorktreePath(REPO_PATH)).toBe(false)
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture supplies the local repository rows read by this registry check.
+      expect(isRegisteredWorktreePath(REPO_PATH, store as never)).toBe(false)
       expect(pruneCleanupScanSnapshotsMock).not.toHaveBeenCalled()
       expect(pruneSpaceAnalysisSnapshotsMock).not.toHaveBeenCalled()
     }
@@ -454,7 +459,8 @@ describe('authoritative local worktree metadata pruning integration', () => {
 
     expect(store.pruneSessionlessMissingLocalWorktreeMetadataForRepo).toHaveBeenCalledTimes(1)
     expect(store.removeWorktreeLineage).not.toHaveBeenCalled()
-    expect(isRegisteredWorktreePath(newPath)).toBe(true)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture supplies the local repository rows read by this registry check.
+    expect(isRegisteredWorktreePath(newPath, store as never)).toBe(true)
   })
 
   it('does not capture or prune on an initial WSL scan', async () => {
diff --git a/src/main/ipc/worktrees-canonical-ssh-listing.test.ts b/src/main/ipc/worktrees-canonical-ssh-listing.test.ts
new file mode 100644
index 00000000000..31a2b43a968
--- /dev/null
+++ b/src/main/ipc/worktrees-canonical-ssh-listing.test.ts
@@ -0,0 +1,230 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { hydrateRepo } from '../persistence/tracking-repos/repo-hydration'
+import type { Repo } from '../../shared/repo-types'
+import {
+  getSshProviderAuthority,
+  resetSshProviderAuthorities,
+  rotateSshProviderAuthority
+} from '../ssh/ssh-provider-authority'
+
+const mocks = vi.hoisted(() => ({
+  handlers: new Map<string, (event: unknown, args?: unknown) => unknown>(),
+  provider: vi.fn(),
+  remoteList: vi.fn(),
+  git: vi.fn(),
+  roots: vi.fn(),
+  rootsRevision: vi.fn(),
+  pruneLineage: vi.fn()
+}))
+vi.mock('electron', () => ({
+  ipcMain: {
+    handle: (channel: string, handler: (event: unknown, args?: unknown) => unknown) =>
+      mocks.handlers.set(channel, handler)
+  },
+  app: { getPath: () => '/test' }
+}))
+vi.mock('../git/runner', async (original) => ({
+  ...(await original<Record<string, unknown>>()),
+  gitExecFileAsync: mocks.git
+}))
+vi.mock('../providers/ssh-git-dispatch', () => ({
+  getSshGitProvider: mocks.provider,
+  getSshGitProviderGeneration: () => 1
+}))
+vi.mock('../project-runtime-git-options', () => ({ getLocalProjectWorktreeGitOptions: () => ({}) }))
+vi.mock('./registered-worktree-roots-cache', () => ({
+  getRegisteredWorktreeRootsRevision: mocks.rootsRevision,
+  registerWorktreeRootsForRepo: mocks.roots
+}))
+vi.mock('../worktree-lineage-pruning', () => ({
+  pruneLineageForMissingRepoWorktrees: mocks.pruneLineage
+}))
+vi.mock('./worktrees/listing/authoritative-local-worktree-metadata-pruning', () => ({
+  pruneMetadataMissingFromAuthoritativeLocalScan: vi.fn()
+}))
+import { registerDetectedWorktreeHandlers } from './worktrees/listing/register-detected-worktree-handlers'
+import { registerWorktreeCatalogHandlers } from './worktrees/listing/register-worktree-catalog-handlers'
+import { registerHostCatalogHandlers } from './worktrees/listing/register-host-catalog-handlers'
+import {
+  __resetDetectedWorktreeScanCacheForTests,
+  __getDetectedWorktreeScanCacheStatsForTests,
+  invalidateDetectedWorktreeScanCache,
+  listDetectedGitWorktrees,
+  rememberLocalWorktreeRoots
+} from './worktrees/listing/detected-worktree-scan-cache'
+
+const path = '/remote/repository'
+const rows = [{ path, head: 'abc', branch: 'main', isBare: false, isMainWorktree: true }]
+const channels = ['legacyDetected', 'hostDetected', 'list', 'listAll', 'known'] as const
+function fixture(fields: Pick<Repo, 'connectionId' | 'executionHostId'>) {
+  const repo = hydrateRepo(
+    { id: 'repo', path, displayName: 'repo', badgeColor: '#000', addedAt: 0, ...fields },
+    new Map()
+  )
+  const store = {
+    getRepo: () => repo,
+    getRepos: () => [repo],
+    getProjects: () => [],
+    getSettings: () => ({}),
+    getAllWorktreeMeta: () => ({}),
+    getProjectHostSetups: () => [],
+    getWorktreeMeta: () => undefined,
+    setWorktreeMeta: vi.fn(),
+    getAllWorktreeLineage: () => ({}),
+    getAllWorkspaceLineage: () => ({}),
+    removeWorktreeLineage: vi.fn(),
+    captureNativeLocalWorktreeMetadataScanExpectation: () => undefined
+  }
+  const context = {
+    store,
+    detectedWorktreeCancellations: {
+      begin: () => new AbortController(),
+      finish: () => {},
+      cancel: () => {}
+    }
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: These handlers only use this store and request cancellation surface.
+  registerDetectedWorktreeHandlers(context as never)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Catalog listing uses only the supplied store accessors.
+  registerWorktreeCatalogHandlers(context as never)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Known-host reading uses only the supplied store accessors.
+  registerHostCatalogHandlers(context as never)
+  return { repo, store }
+}
+function invoke(channel: (typeof channels)[number]) {
+  const hostArgs = {
+    repoId: 'repo',
+    executionHostId: 'ssh:host-a',
+    providerRequestId: 'request',
+    expectedAuthority: getSshProviderAuthority('host-a')
+  }
+  if (channel === 'legacyDetected') {
+    return mocks.handlers.get('worktrees:listDetected')!(null, { repoId: 'repo' })
+  }
+  if (channel === 'hostDetected') {
+    return mocks.handlers.get('worktrees:listDetected')!(null, hostArgs)
+  }
+  if (channel === 'known') {
+    return mocks.handlers.get('worktrees:listKnownForExecutionHost')!(null, hostArgs)
+  }
+  return mocks.handlers.get(`worktrees:${channel}`)!(null, { repoId: 'repo' })
+}
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.handlers.clear()
+  __resetDetectedWorktreeScanCacheForTests()
+  resetSshProviderAuthorities()
+  mocks.provider.mockReturnValue({ listWorktrees: mocks.remoteList })
+  mocks.remoteList.mockResolvedValue(rows)
+  mocks.rootsRevision.mockReturnValue(1)
+  mocks.git.mockRejectedValue(new Error('unexpected local Git'))
+})
+
+describe.each([
+  { hostEncoding: 'canonical', fields: { executionHostId: 'ssh:host-a' as const } },
+  { hostEncoding: 'legacy', fields: { connectionId: 'host-a' } }
+])('$hostEncoding SSH listing', ({ fields }) => {
+  it.each(channels)('keeps %s on the direct SSH boundary', async (channel) => {
+    fixture(fields)
+    const result = await invoke(channel)
+    if (channel === 'known') {
+      expect(result).toMatchObject({ status: 'complete', result: { authoritative: false } })
+      expect(mocks.remoteList).not.toHaveBeenCalled()
+    } else {
+      expect(mocks.remoteList).toHaveBeenCalledTimes(1)
+      expect(mocks.remoteList.mock.calls[0][0]).toBe(path)
+      if (channel === 'hostDetected') {
+        expect(result).toMatchObject({ status: 'complete', result: { authoritative: true } })
+      } else if (channel === 'legacyDetected') {
+        expect(result).toMatchObject({ authoritative: true })
+      } else {
+        expect(result).toHaveLength(1)
+        expect(mocks.pruneLineage).toHaveBeenCalledTimes(1)
+      }
+    }
+    expect(mocks.git).not.toHaveBeenCalled()
+    expect(mocks.roots).not.toHaveBeenCalled()
+    expect(__getDetectedWorktreeScanCacheStatsForTests()).toEqual({ cacheSize: 0, inFlightSize: 0 })
+  })
+
+  it('reports disconnection without replaying an authoritative local-cache answer', async () => {
+    fixture(fields)
+    await invoke('legacyDetected')
+    mocks.provider.mockReturnValue(undefined)
+    expect(await invoke('legacyDetected')).toMatchObject({ authoritative: false })
+    expect(mocks.git).not.toHaveBeenCalled()
+  })
+
+  it('rejects a legacy listing after provider authority rotates', async () => {
+    fixture(fields)
+    let finish = (_rows: typeof rows): void => {}
+    mocks.remoteList.mockReturnValue(
+      new Promise<typeof rows>((resolve) => {
+        finish = resolve
+      })
+    )
+    const pending = invoke('legacyDetected')
+    await Promise.resolve()
+    rotateSshProviderAuthority('host-a')
+    finish(rows)
+    expect(await pending).toMatchObject({ authoritative: false })
+    expect(mocks.roots).not.toHaveBeenCalled()
+    expect(mocks.pruneLineage).not.toHaveBeenCalled()
+  })
+
+  it('bypasses local cache when the lower scan entry point is called directly', async () => {
+    const { repo, store } = fixture(fields)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Remote scan bypass only needs the mocked Git options and provider.
+    await listDetectedGitWorktrees(store as never, repo)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Remote scan bypass only needs the mocked Git options and provider.
+    await listDetectedGitWorktrees(store as never, repo)
+    expect(mocks.remoteList).toHaveBeenCalledTimes(2)
+    expect(__getDetectedWorktreeScanCacheStatsForTests()).toEqual({ cacheSize: 0, inFlightSize: 0 })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: A remote row must return before reading the store.
+    rememberLocalWorktreeRoots(store as never, repo, rows)
+    expect(mocks.roots).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    ['list', 'mutation'],
+    ['listAll', 'mutation'],
+    ['list', 'roots revision'],
+    ['listAll', 'roots revision']
+  ] as const)('preserves lineage when %s is overtaken by a %s', async (channel, change) => {
+    const { repo } = fixture(fields)
+    let finish = (_rows: typeof rows): void => {}
+    mocks.remoteList.mockReturnValue(
+      new Promise<typeof rows>((resolve) => {
+        finish = resolve
+      })
+    )
+    const pending = invoke(channel)
+    expect(mocks.remoteList).toHaveBeenCalledTimes(1)
+    if (change === 'mutation') {
+      invalidateDetectedWorktreeScanCache(repo.id)
+    } else {
+      mocks.rootsRevision.mockReturnValue(2)
+    }
+    finish(rows)
+    expect(await pending).toHaveLength(1)
+    expect(mocks.pruneLineage).not.toHaveBeenCalled()
+    expect(mocks.roots).not.toHaveBeenCalled()
+  })
+})
+
+it.each([undefined, 'nested'])(
+  'keeps runtime rows out of local cache and root registration: %s',
+  async (connectionId) => {
+    const { repo, store } = fixture({ executionHostId: 'runtime:env', connectionId })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Runtime scan must reject before any listing or store side effects.
+    await expect(listDetectedGitWorktrees(store as never, repo)).rejects.toThrow(
+      'not reachable from this process'
+    )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: A nonlocal row must return before reading the store.
+    rememberLocalWorktreeRoots(store as never, repo, rows)
+    expect(mocks.provider).not.toHaveBeenCalled()
+    expect(mocks.git).not.toHaveBeenCalled()
+    expect(mocks.roots).not.toHaveBeenCalled()
+    expect(__getDetectedWorktreeScanCacheStatsForTests()).toEqual({ cacheSize: 0, inFlightSize: 0 })
+  }
+)
diff --git a/src/main/ipc/worktrees-removal-recovery.test.ts b/src/main/ipc/worktrees-removal-recovery.test.ts
index cfe962cc09a..d3231d50bd8 100644
--- a/src/main/ipc/worktrees-removal-recovery.test.ts
+++ b/src/main/ipc/worktrees-removal-recovery.test.ts
@@ -279,6 +279,60 @@ describe('registerWorktreeHandlers', () => {
     })
   })
 
+  it.each(['unproven', 'removal-fails'] as const)(
+    'keeps desktop orphan cleanup retryable when the directory is %s',
+    async (mode) => {
+      const parentDir = await mkdtemp(join(tmpdir(), 'orca-ipc-orphan-retention-'))
+      const repoPath = join(parentDir, 'repo')
+      const orphanPath = join(parentDir, 'orphan')
+      const worktreeId = `repo-1::${orphanPath}`
+      await mkdir(orphanPath, { recursive: true })
+      if (mode === 'removal-fails') {
+        const adminPath = join(repoPath, '.git', 'worktrees', 'orphan')
+        await mkdir(adminPath, { recursive: true })
+        await writeFile(join(orphanPath, '.git'), `gitdir: ${adminPath}\n`)
+        await writeFile(join(adminPath, 'gitdir'), `${join(orphanPath, '.git')}\n`)
+      }
+      const repo = { id: 'repo-1', path: repoPath, displayName: 'repo', badgeColor: '', addedAt: 0 }
+      store.getRepos.mockReturnValue([repo])
+      store.getRepo.mockReturnValue(repo)
+      mockKnownFeatureWorktree(orphanPath, repoPath)
+      getEffectiveHooksMock.mockReturnValue(null)
+      removeWorktreeMock.mockRejectedValue(
+        Object.assign(new Error('Git remove failed'), {
+          stderr: `fatal: '${orphanPath}' is not a working tree`
+        })
+      )
+      const finish = vi.fn().mockResolvedValue(undefined)
+      runtimeStub.acquireFileWatcherRemoval.mockResolvedValue({ finish })
+      const removePath = vi
+        .spyOn(localWorktreeFilesystem, 'removeLocalWorktreePath')
+        .mockRejectedValue(new Error('injected removal failure'))
+      try {
+        await expect(handlers['worktrees:remove'](null, { worktreeId })).rejects.toThrow(
+          'Worktree is no longer registered with Git but its directory remains.'
+        )
+        await expect(lstat(orphanPath)).resolves.toBeTruthy()
+        expect(store.removeWorktreeMeta).not.toHaveBeenCalled()
+        expect(gitExecFileAsyncMock).not.toHaveBeenCalledWith(
+          ['worktree', 'prune'],
+          expect.anything()
+        )
+        expect(finish).toHaveBeenCalledWith(false)
+        expect(removePath).toHaveBeenCalledTimes(mode === 'removal-fails' ? 1 : 0)
+        await rm(orphanPath, { recursive: true, force: true })
+        await expect(handlers['worktrees:remove'](null, { worktreeId })).resolves.toEqual({
+          catalogVersion: anyCatalogVersion
+        })
+        expect(store.removeWorktreeMeta).toHaveBeenCalledWith(worktreeId, 'local')
+        expect(finish).toHaveBeenLastCalledWith(true)
+      } finally {
+        removePath.mockRestore()
+        await rm(parentDir, { recursive: true, force: true })
+      }
+    }
+  )
+
   it('recovers forced Windows long-path worktree removal through local deletion and prune', async () => {
     setPlatform('win32')
     const parentDir = await mkdtemp(join(tmpdir(), 'orca-ipc-long-path-'))
diff --git a/src/main/ipc/worktrees-ssh-provider-authority.test.ts b/src/main/ipc/worktrees-ssh-provider-authority.test.ts
index 8c2d6b0edd7..8d14755ab18 100644
--- a/src/main/ipc/worktrees-ssh-provider-authority.test.ts
+++ b/src/main/ipc/worktrees-ssh-provider-authority.test.ts
@@ -264,51 +264,59 @@ describe('registerWorktreeHandlers', () => {
     expect(store.removeWorktreeLineage).not.toHaveBeenCalled()
   })
 
-  it('cancels an SSH provider request by sender-scoped provider request ID', async () => {
-    let providerSignal: AbortSignal | undefined
-    const provider = {
-      listWorktrees: vi.fn(
-        (_repoPath: string, options?: { signal?: AbortSignal }) =>
-          new Promise<GitWorktreeInfo[]>((_resolve, reject) => {
-            providerSignal = options?.signal
-            providerSignal?.addEventListener(
-              'abort',
-              () => reject(new DOMException('Canceled', 'AbortError')),
-              { once: true }
-            )
-          })
-      )
-    }
-    const sshRepo = {
-      id: 'repo-1',
-      path: '/remote/repo',
-      displayName: 'repo',
-      badgeColor: '#000',
-      addedAt: 0,
-      connectionId: 'target-a'
-    }
-    store.getRepos.mockReturnValue([sshRepo])
-    getSshGitProviderMock.mockReturnValue(provider)
+  it.each(['cancel', 'did-navigate', 'render-process-gone', 'destroyed'])(
+    'cancels an SSH provider request on %s',
+    async (eventName) => {
+      let providerSignal: AbortSignal | undefined
+      const provider = {
+        listWorktrees: vi.fn(
+          (_repoPath: string, options?: { signal?: AbortSignal }) =>
+            new Promise<GitWorktreeInfo[]>((_resolve, reject) => {
+              providerSignal = options?.signal
+              providerSignal?.addEventListener(
+                'abort',
+                () => reject(new DOMException('Canceled', 'AbortError')),
+                { once: true }
+              )
+            })
+        )
+      }
+      const sshRepo = {
+        id: 'repo-1',
+        path: '/remote/repo',
+        displayName: 'repo',
+        badgeColor: '#000',
+        addedAt: 0,
+        connectionId: 'target-a'
+      }
+      store.getRepos.mockReturnValue([sshRepo])
+      getSshGitProviderMock.mockReturnValue(provider)
 
-    const pending = handlers['worktrees:listDetected'](ipcEvent, {
-      providerRequestId: 'request-1' as ProviderRequestId,
-      repoId: sshRepo.id,
-      executionHostId: toSshExecutionHostId('target-a'),
-      expectedAuthority: getSshProviderAuthority('target-a')
-    })
-    await Promise.resolve()
-    handlers['worktrees:cancelListDetected'](ipcEvent, {
-      providerRequestId: 'request-1' as ProviderRequestId
-    })
+      const pending = handlers['worktrees:listDetected'](ipcEvent, {
+        providerRequestId: 'request-1' as ProviderRequestId,
+        repoId: sshRepo.id,
+        executionHostId: toSshExecutionHostId('target-a'),
+        expectedAuthority: getSshProviderAuthority('target-a')
+      })
+      await Promise.resolve()
+      if (eventName === 'cancel') {
+        handlers['worktrees:cancelListDetected'](ipcEvent, {
+          providerRequestId: 'request-1' as ProviderRequestId
+        })
+      } else {
+        ipcEvent.sender.emit(eventName)
+      }
 
-    expect(providerSignal?.aborted).toBe(true)
-    await expect(pending).resolves.toMatchObject({
-      status: 'canceled',
-      providerRequestId: 'request-1'
-    })
-    expect(store.setWorktreeMeta).not.toHaveBeenCalled()
-    expect(store.removeWorktreeLineage).not.toHaveBeenCalled()
-  })
+      expect(providerSignal?.aborted).toBe(true)
+      await expect(pending).resolves.toMatchObject({
+        status: 'canceled',
+        providerRequestId: 'request-1'
+      })
+      expect(store.setWorktreeMeta).not.toHaveBeenCalled()
+      expect(store.removeWorktreeLineage).not.toHaveBeenCalled()
+      expect(ipcEvent.sender.eventNames()).toEqual([])
+    }
+  )
 
   it('settles a noncooperative SSH provider at the main-owned deadline and cleans up', async () => {
     vi.useFakeTimers()
diff --git a/src/main/ipc/worktrees-test-ipc-surface.ts b/src/main/ipc/worktrees-test-ipc-surface.ts
index 7df4f6cda0a..985107b067e 100644
--- a/src/main/ipc/worktrees-test-ipc-surface.ts
+++ b/src/main/ipc/worktrees-test-ipc-surface.ts
@@ -1,3 +1,4 @@
+import { EventEmitter } from 'node:events'
 import { type Mock, vi } from 'vitest'
 import type { WorktreeMeta } from '../../shared/worktree/meta-types'
 
@@ -50,7 +51,7 @@ export const mainWindow: TestMainWindow = {
     send: vi.fn()
   }
 }
-export const ipcEvent = { sender: { id: 1 } }
+export const ipcEvent = { sender: Object.assign(new EventEmitter(), { id: 1 }) }
 export const store: TestStore = {
   getProfileStorageDirectory: vi.fn(() => '/profile-a'),
   getRepos: vi.fn(),
diff --git a/src/main/ipc/worktrees/listing/detected-provider-listing.ts b/src/main/ipc/worktrees/listing/detected-provider-listing.ts
index 84243189b0b..975cb5eeb78 100644
--- a/src/main/ipc/worktrees/listing/detected-provider-listing.ts
+++ b/src/main/ipc/worktrees/listing/detected-provider-listing.ts
@@ -1,3 +1,7 @@
+import {
+  getRepoExecutionHostId,
+  getSshTargetIdForExecutionHost
+} from '../../../../shared/execution-host'
 import type { Store } from '../../../persistence/loading-store/store'
 import type { Repo } from '../../../../shared/repo-types'
 import { getSshGitProvider } from '../../../providers/ssh-git-dispatch'
@@ -61,9 +65,11 @@ export async function listDetectedWorktreesForCapturedRepo(
   store: Store,
   repo: Repo,
   isCurrent: () => boolean,
-  capturedProvider = repo.connectionId ? getSshGitProvider(repo.connectionId) : undefined,
+  capturedProvider?: SshGitProvider,
   providerAbort?: { signal: AbortSignal; status: () => 'canceled' | 'timed-out' }
 ): Promise<DetectedWorktreeListResult | { providerAbortStatus: 'canceled' | 'timed-out' } | null> {
+  const connectionId = getSshTargetIdForExecutionHost(getRepoExecutionHostId(repo))
+  const provider = capturedProvider ?? (connectionId ? getSshGitProvider(connectionId) : undefined)
   const abortedResult = () =>
     providerAbort?.signal.aborted
       ? ({ providerAbortStatus: providerAbort.status() } as const)
@@ -105,7 +111,7 @@ export async function listDetectedWorktreesForCapturedRepo(
         )
       }
     }
-    if (repo.connectionId && !capturedProvider) {
+    if (connectionId && !provider) {
       const aborted = abortedResult()
       if (aborted) {
         return aborted
@@ -124,8 +130,8 @@ export async function listDetectedWorktreesForCapturedRepo(
     }
     const scan = await scanUntilNotOvertaken(
       repo.id,
-      repo.connectionId && capturedProvider
-        ? () => listSshWorktreesWithMutationWitness(capturedProvider, repo, providerAbort?.signal)
+      connectionId && provider
+        ? () => listSshWorktreesWithMutationWitness(provider, repo, providerAbort?.signal)
         : () => listDetectedGitWorktrees(store, repo),
       () => isCurrent() && !providerAbort?.signal.aborted
     )
@@ -197,7 +203,7 @@ export async function listDetectedWorktreesForCapturedRepo(
     // Why: retention alone leaves inert rows with no explanation; the cause rides with the listing.
     const unavailableReason = describeWorktreeScanFailure(err)
     const failureKind = classifyWorktreeScanFailure(unavailableReason)
-    if (repo.connectionId) {
+    if (connectionId) {
       const worktrees = listDisconnectedSshWorktrees(store, repo, sshWorktreeMetaIndex())
       return {
         repoId: repo.id,
diff --git a/src/main/ipc/worktrees/listing/detected-scan-failure-authority.test.ts b/src/main/ipc/worktrees/listing/detected-scan-failure-authority.test.ts
index 4e436b8dcf1..5c600a0f8ff 100644
--- a/src/main/ipc/worktrees/listing/detected-scan-failure-authority.test.ts
+++ b/src/main/ipc/worktrees/listing/detected-scan-failure-authority.test.ts
@@ -56,8 +56,10 @@ function wslHostFailure(): Error {
   })
 }
 
+const store = createStore()
+
 async function listDetected(): Promise<DetectedWorktreeListResult> {
-  const result = await listDetectedWorktreesForCapturedRepo(createStore(), repo, () => true)
+  const result = await listDetectedWorktreesForCapturedRepo(store, repo, () => true)
   return result as DetectedWorktreeListResult
 }
 
@@ -81,7 +83,7 @@ describe('detected worktree listing authority', () => {
     // Why: the retained rows must carry the cause, or the user sees inert worktrees with no explanation.
     expect(result.unavailableReason).toContain('Command failed: wsl.exe')
     // The destructive halves of a fresh scan must not run against a listing that failed.
-    expect(isRegisteredWorktreePath(REPO_PATH)).toBe(false)
+    expect(isRegisteredWorktreePath(REPO_PATH, store)).toBe(false)
     expect(removeWorktreeLineage).not.toHaveBeenCalled()
   })
 
@@ -118,7 +120,7 @@ describe('detected worktree listing authority', () => {
 
     expect(result.authoritative).toBe(false)
     expect(result.unavailableReason).toContain('No such file or directory')
-    expect(isRegisteredWorktreePath(REPO_PATH)).toBe(false)
+    expect(isRegisteredWorktreePath(REPO_PATH, store)).toBe(false)
     expect(removeWorktreeLineage).not.toHaveBeenCalled()
   })
 
@@ -136,7 +138,7 @@ describe('detected worktree listing authority', () => {
     expect(result.source).toBe('git')
     expect(result.worktrees).toEqual([])
     expect(result.unavailableReason).toBeUndefined()
-    expect(isRegisteredWorktreePath(REPO_PATH)).toBe(true)
+    expect(isRegisteredWorktreePath(REPO_PATH, store)).toBe(true)
   })
 
   it('keeps an empty listing authoritative when the repo path is gone', async () => {
@@ -161,6 +163,6 @@ describe('detected worktree listing authority', () => {
 
     expect(result.authoritative).toBe(true)
     expect(result.worktrees.map((worktree) => worktree.path)).toEqual([REPO_PATH])
-    expect(isRegisteredWorktreePath(REPO_PATH)).toBe(true)
+    expect(isRegisteredWorktreePath(REPO_PATH, store)).toBe(true)
   })
 })
diff --git a/src/main/ipc/worktrees/listing/detected-worktree-scan-cache.ts b/src/main/ipc/worktrees/listing/detected-worktree-scan-cache.ts
index 4ed0b88ffce..dad44c64a69 100644
--- a/src/main/ipc/worktrees/listing/detected-worktree-scan-cache.ts
+++ b/src/main/ipc/worktrees/listing/detected-worktree-scan-cache.ts
@@ -1,3 +1,4 @@
+import { getRepoExecutionHostId, LOCAL_EXECUTION_HOST_ID } from '../../../../shared/execution-host'
 import type { GitWorktreeInfo } from '../../../../shared/worktree/types'
 import type { Store } from '../../../persistence/loading-store/store'
 import type { Repo } from '../../../../shared/repo-types'
@@ -119,7 +120,7 @@ export async function listDetectedGitWorktrees(
   repo: Repo
 ): Promise<DetectedWorktreeScanResult> {
   const localWorktreeGitOptions = getLocalProjectWorktreeGitOptions(store, repo)
-  if (repo.connectionId || isFolderRepo(repo)) {
+  if (getRepoExecutionHostId(repo) !== LOCAL_EXECUTION_HOST_ID || isFolderRepo(repo)) {
     const generation = getLocalWorktreeScanGeneration(repo.id)
     return {
       gitWorktrees: await listRepoWorktreesForDetectedScan(repo, localWorktreeGitOptions),
@@ -295,11 +296,11 @@ export function rememberLocalWorktreeRoots(
   repo: Repo,
   gitWorktrees: GitWorktreeInfo[]
 ): void {
-  if (repo.connectionId) {
+  if (getRepoExecutionHostId(repo) !== LOCAL_EXECUTION_HOST_ID) {
     return
   }
   // Why: reuse the `git worktree list` result so later git/file IPC validation skips a second scan that can trigger macOS folder-permission prompts.
-  registerWorktreeRootsForRepo(store, repo.id, [
+  registerWorktreeRootsForRepo(store, repo, [
     repo.path,
     ...gitWorktrees.map((worktree) => worktree.path)
   ])
diff --git a/src/main/ipc/worktrees/listing/host-qualified-worktree-listing.ts b/src/main/ipc/worktrees/listing/host-qualified-worktree-listing.ts
index 3026a1b0652..57800d63bab 100644
--- a/src/main/ipc/worktrees/listing/host-qualified-worktree-listing.ts
+++ b/src/main/ipc/worktrees/listing/host-qualified-worktree-listing.ts
@@ -1,3 +1,9 @@
+import {
+  getRepoExecutionHostId,
+  getSshTargetIdForExecutionHost,
+  parseExecutionHostId,
+  LOCAL_EXECUTION_HOST_ID
+} from '../../../../shared/execution-host'
 import type { Store } from '../../../persistence/loading-store/store'
 import { PROVIDER_REQUEST_ID_MAX_UTF8_BYTES } from '../../../../shared/detected-worktree-provider-contract'
 import type {
@@ -5,7 +11,6 @@ import type {
   HostQualifiedDetectedWorktreeResult,
   DirectSshDetectedWorktreeRequest
 } from '../../../../shared/detected-worktree-provider-contract'
-import { parseExecutionHostId, LOCAL_EXECUTION_HOST_ID } from '../../../../shared/execution-host'
 import { isCurrentSshProviderAuthority } from '../../../ssh/ssh-provider-authority'
 import { getSshGitProvider } from '../../../providers/ssh-git-dispatch'
 import {
@@ -63,9 +68,10 @@ export async function listHostQualifiedDetectedWorktrees(
   if (!repo) {
     return rejected('ambiguous-owner')
   }
+  const connectionId = getSshTargetIdForExecutionHost(getRepoExecutionHostId(repo))
   if (
-    (parsedHost.kind === 'local' && repo.connectionId) ||
-    (parsedHost.kind === 'ssh' && repo.connectionId !== parsedHost.targetId)
+    (parsedHost.kind === 'local' && connectionId) ||
+    (parsedHost.kind === 'ssh' && connectionId !== parsedHost.targetId)
   ) {
     return rejected('rejected')
   }
@@ -75,8 +81,8 @@ export async function listHostQualifiedDetectedWorktrees(
       return false
     }
     if (
-      (parsedHost.kind === 'local' && repo.connectionId) ||
-      (parsedHost.kind === 'ssh' && repo.connectionId !== parsedHost.targetId)
+      (parsedHost.kind === 'local' && connectionId) ||
+      (parsedHost.kind === 'ssh' && connectionId !== parsedHost.targetId)
     ) {
       return false
     }
diff --git a/src/main/ipc/worktrees/listing/register-detected-worktree-handlers.ts b/src/main/ipc/worktrees/listing/register-detected-worktree-handlers.ts
index 66e8e85a4a5..442a70985c8 100644
--- a/src/main/ipc/worktrees/listing/register-detected-worktree-handlers.ts
+++ b/src/main/ipc/worktrees/listing/register-detected-worktree-handlers.ts
@@ -5,7 +5,11 @@ import type {
   DirectSshDetectedWorktreeRequest,
   ProviderRequestId
 } from '../../../../shared/detected-worktree-provider-contract'
-import { parseExecutionHostId } from '../../../../shared/execution-host'
+import {
+  parseExecutionHostId,
+  getRepoExecutionHostId,
+  getSshTargetIdForExecutionHost
+} from '../../../../shared/execution-host'
 import {
   registerSshProviderRequestAbort,
   getSshProviderAuthority,
@@ -99,17 +103,16 @@ export function registerDetectedWorktreeHandlers(context: WorktreeIpcContext): v
           worktrees: []
         }
       }
-      const provider = repo.connectionId ? getSshGitProvider(repo.connectionId) : undefined
-      const authority = repo.connectionId
-        ? { ...getSshProviderAuthority(repo.connectionId) }
-        : undefined
+      const connectionId = getSshTargetIdForExecutionHost(getRepoExecutionHostId(repo))
+      const provider = connectionId ? getSshGitProvider(connectionId) : undefined
+      const authority = connectionId ? { ...getSshProviderAuthority(connectionId) } : undefined
       const result = await listDetectedWorktreesForCapturedRepo(
         store,
         repo,
         () =>
           isCapturedRepoCurrent(store, repo) &&
-          (!repo.connectionId ||
-            (getSshGitProvider(repo.connectionId) === provider &&
+          (!connectionId ||
+            (getSshGitProvider(connectionId) === provider &&
               authority !== undefined &&
               isCurrentSshProviderAuthority(authority))),
         provider
diff --git a/src/main/ipc/worktrees/listing/register-host-catalog-handlers.ts b/src/main/ipc/worktrees/listing/register-host-catalog-handlers.ts
index 4467506e790..ac231a4c697 100644
--- a/src/main/ipc/worktrees/listing/register-host-catalog-handlers.ts
+++ b/src/main/ipc/worktrees/listing/register-host-catalog-handlers.ts
@@ -1,3 +1,8 @@
+import {
+  getRepoExecutionHostId,
+  getSshTargetIdForExecutionHost,
+  parseExecutionHostId
+} from '../../../../shared/execution-host'
 import { ipcMain } from 'electron'
 import type {
   ListKnownWorktreesForExecutionHostArgs,
@@ -5,7 +10,6 @@ import type {
   ForgetRemovedWorktreesForExecutionHostArgs,
   ForgetRemovedWorktreesForExecutionHostResult
 } from '../../../../shared/detected-worktree-provider-contract'
-import { parseExecutionHostId } from '../../../../shared/execution-host'
 import type { DetectedWorktree } from '../../../../shared/worktree/types'
 import { isFolderRepo } from '../../../../shared/repo-kind'
 import { projectResolvedWorktreeLineage } from '../../../../shared/resolved-worktree-lineage'
@@ -47,7 +51,10 @@ export function registerHostCatalogHandlers(context: WorktreeIpcContext): void {
       // Why: findExactRepoOwner repeats this same all-candidates-owned check, and getRepos() re-hydrates the
       // whole catalog, so a separate pass here is pure cost.
       const repo = findExactRepoOwner(store, requestedRepoId, requestedExecutionHostId)
-      if (!repo || repo.connectionId !== parsedHost.targetId) {
+      if (
+        !repo ||
+        getSshTargetIdForExecutionHost(getRepoExecutionHostId(repo)) !== parsedHost.targetId
+      ) {
         return rejected()
       }
       const complete = (worktrees: DetectedWorktree[]): HostQualifiedKnownWorktreeResult => ({
diff --git a/src/main/ipc/worktrees/listing/register-worktree-catalog-handlers.ts b/src/main/ipc/worktrees/listing/register-worktree-catalog-handlers.ts
index 4f3055c63a2..89de29f30e8 100644
--- a/src/main/ipc/worktrees/listing/register-worktree-catalog-handlers.ts
+++ b/src/main/ipc/worktrees/listing/register-worktree-catalog-handlers.ts
@@ -1,6 +1,10 @@
 import { ipcMain } from 'electron'
 import { isFolderRepo } from '../../../../shared/repo-kind'
-import { getRepoExecutionHostId, type ExecutionHostId } from '../../../../shared/execution-host'
+import {
+  getRepoExecutionHostId,
+  getSshTargetIdForExecutionHost,
+  type ExecutionHostId
+} from '../../../../shared/execution-host'
 import { getSshGitProvider } from '../../../providers/ssh-git-dispatch'
 import { EMPTY_RETIRED_NAME_REGISTRY } from '../../../../shared/worktree/retired-name-registry'
 import { getRetiredNameRegistryForRepo } from '../../../worktree-name-retirement'
@@ -28,6 +32,8 @@ import {
   readAllWorktreeMetaForRepo
 } from '../../../persistence/host-qualified-worktree-meta'
 import type { WorktreeMeta } from '../../../../shared/worktree/meta-types'
+import { getLocalWorktreeScanGeneration } from '../../../local-worktree-scan-generation'
+import { getRegisteredWorktreeRootsRevision } from '../../registered-worktree-roots-cache'
 
 const WORKTREE_LIST_ALL_CONCURRENCY = 8
 
@@ -89,6 +95,7 @@ export function registerWorktreeCatalogHandlers(context: WorktreeIpcContext): vo
 
     // Why: each local repo listing can spawn `git worktree list`; cap fan-out so large fleets don't start unbounded subprocesses.
     const results = await mapWithConcurrency(repos, WORKTREE_LIST_ALL_CONCURRENCY, async (repo) => {
+      const connectionId = getSshTargetIdForExecutionHost(getRepoExecutionHostId(repo))
       try {
         let gitWorktrees
         let freshScan = true
@@ -97,18 +104,22 @@ export function registerWorktreeCatalogHandlers(context: WorktreeIpcContext): vo
         let hygieneDue: boolean | undefined
         if (isFolderRepo(repo)) {
           return listVisibleFolderWorkspaces(store, repo)
-        } else if (repo.connectionId) {
-          const provider = getSshGitProvider(repo.connectionId)
+        } else if (connectionId) {
+          const provider = getSshGitProvider(connectionId)
           if (!provider) {
             warnOnce(
               loggedUnavailableSshGitProviders,
-              `${repo.connectionId}:${repo.id}`,
-              `[worktrees] SSH git provider unavailable; skipping worktree list for repo "${repo.displayName}" (${repo.id}) at ${repo.path} on connection ${repo.connectionId}`
+              `${connectionId}:${repo.id}`,
+              `[worktrees] SSH git provider unavailable; skipping worktree list for repo "${repo.displayName}" (${repo.id}) at ${repo.path} on connection ${connectionId}`
             )
             return listDisconnectedSshWorktrees(store, repo, sshMetaIndexForRepo(repo))
           }
-          loggedUnavailableSshGitProviders.delete(`${repo.connectionId}:${repo.id}`)
+          loggedUnavailableSshGitProviders.delete(`${connectionId}:${repo.id}`)
           try {
+            sideEffectToken = {
+              generation: getLocalWorktreeScanGeneration(repo.id),
+              authorizedRootsRevision: getRegisteredWorktreeRootsRevision(repo.id)
+            }
             gitWorktrees = await provider.listWorktrees(repo.path)
           } catch (err) {
             warnOnce(
@@ -177,8 +188,9 @@ export function registerWorktreeCatalogHandlers(context: WorktreeIpcContext): vo
     if (!repo) {
       return []
     }
-    const allMeta = repo.connectionId ? readAllWorktreeMetaForRepo(store, repo) : undefined
-    const sshWorktreeMetaIndex = repo.connectionId
+    const connectionId = getSshTargetIdForExecutionHost(getRepoExecutionHostId(repo))
+    const allMeta = connectionId ? readAllWorktreeMetaForRepo(store, repo) : undefined
+    const sshWorktreeMetaIndex = connectionId
       ? createSshWorktreeMetaIndex(Object.entries(allMeta ?? {}))
       : new Map()
 
@@ -190,18 +202,22 @@ export function registerWorktreeCatalogHandlers(context: WorktreeIpcContext): vo
       let hygieneDue: boolean | undefined
       if (isFolderRepo(repo)) {
         return listVisibleFolderWorkspaces(store, repo)
-      } else if (repo.connectionId) {
-        const provider = getSshGitProvider(repo.connectionId)
+      } else if (connectionId) {
+        const provider = getSshGitProvider(connectionId)
         if (!provider) {
           warnOnce(
             loggedUnavailableSshGitProviders,
-            `${repo.connectionId}:${repo.id}`,
-            `[worktrees] SSH git provider unavailable; skipping worktree list for repo "${repo.displayName}" (${repo.id}) at ${repo.path} on connection ${repo.connectionId}`
+            `${connectionId}:${repo.id}`,
+            `[worktrees] SSH git provider unavailable; skipping worktree list for repo "${repo.displayName}" (${repo.id}) at ${repo.path} on connection ${connectionId}`
           )
           return listDisconnectedSshWorktrees(store, repo, sshWorktreeMetaIndex)
         }
-        loggedUnavailableSshGitProviders.delete(`${repo.connectionId}:${repo.id}`)
+        loggedUnavailableSshGitProviders.delete(`${connectionId}:${repo.id}`)
         try {
+          sideEffectToken = {
+            generation: getLocalWorktreeScanGeneration(repo.id),
+            authorizedRootsRevision: getRegisteredWorktreeRootsRevision(repo.id)
+          }
           gitWorktrees = await provider.listWorktrees(repo.path)
         } catch (err) {
           warnOnce(
diff --git a/src/main/ipc/worktrees/metadata/workspace-lineage-candidate-scan.test.ts b/src/main/ipc/worktrees/metadata/workspace-lineage-candidate-scan.test.ts
new file mode 100644
index 00000000000..e3ccee07086
--- /dev/null
+++ b/src/main/ipc/worktrees/metadata/workspace-lineage-candidate-scan.test.ts
@@ -0,0 +1,158 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { Repo } from '../../../../shared/repo-types'
+import type { FolderWorkspace } from '../../../../shared/folder-workspace-types'
+import type { ProjectGroup } from '../../../../shared/project-group-types'
+import { createLineageResolutionContext } from './lineage-owner-resolution'
+import { getFolderLineageCandidateRepos } from './workspace-lineage-filtering'
+
+vi.mock('../../worktree-logic', () => ({ parseWorktreeId: vi.fn() }))
+
+function repo(id: string, fields: Partial<Repo> = {}): Repo {
+  return { id, path: `/root/${id}`, displayName: id, badgeColor: '#000', addedAt: 0, ...fields }
+}
+
+function group(id = 'group', fields: Partial<ProjectGroup> = {}): ProjectGroup {
+  return {
+    id,
+    name: id,
+    parentPath: null,
+    parentGroupId: null,
+    createdFrom: 'manual',
+    tabOrder: 0,
+    isCollapsed: false,
+    color: null,
+    createdAt: 0,
+    updatedAt: 0,
+    ...fields
+  }
+}
+
+function folder(fields: Partial<FolderWorkspace> = {}): FolderWorkspace {
+  return {
+    id: 'folder',
+    projectGroupId: 'group',
+    name: 'folder',
+    folderPath: '/root',
+    linkedTask: null,
+    comment: '',
+    isArchived: false,
+    isUnread: false,
+    isPinned: false,
+    sortOrder: 0,
+    lastActivityAt: 0,
+    createdAt: 0,
+    updatedAt: 0,
+    ...fields
+  }
+}
+
+function context(repos: Repo[], groups = [group()]) {
+  const store = {
+    getRepos: () => repos,
+    getFolderWorkspaces: () => [],
+    getProjectGroups: () => groups
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Context construction only reads these three store catalogs.
+  return createLineageResolutionContext(store as never)
+}
+
+describe('folder lineage candidate lookup', () => {
+  it('reads grouped target membership once across a large path-candidate list', () => {
+    let targetReads = 0
+    const grouped = Array.from({ length: 300 }, (_, index): Repo => ({
+      ...repo(`grouped-${index}`, { projectGroupId: 'group', path: `/elsewhere/${index}` }),
+      get connectionId() {
+        targetReads += 1
+        return null
+      }
+    }))
+    const candidates = Array.from({ length: 1_000 }, (_, index) => repo(`path-${index}`))
+    const result = getFolderLineageCandidateRepos(context([...grouped, ...candidates]), folder())
+
+    expect(result).toEqual([...grouped, ...candidates])
+    expect(targetReads).toBe(300)
+  })
+
+  it('preserves descendant-group priority, path boundaries and local/SSH membership', () => {
+    const entries = [
+      repo('path-a', { connectionId: 'a' }),
+      repo('group-b', { projectGroupId: 'nested', path: '/elsewhere', connectionId: 'b' }),
+      repo('local-null', { connectionId: null }),
+      repo('group-local', { projectGroupId: 'group' }),
+      repo('path-b', { connectionId: 'b' }),
+      repo('local-absent'),
+      repo('sibling', { path: '/root-other/repo', connectionId: 'b' }),
+      repo('root', { path: '/root', connectionId: 'b' })
+    ]
+    const snapshot = structuredClone(entries)
+    const result = getFolderLineageCandidateRepos(
+      context(entries, [group(), group('nested', { parentGroupId: 'group' })]),
+      folder()
+    )
+
+    expect(result.map((entry) => entry.id)).toEqual([
+      'group-b',
+      'group-local',
+      'local-null',
+      'path-b',
+      'local-absent',
+      'root'
+    ])
+    expect(result[0]).toBe(entries[1])
+    expect(entries).toEqual(snapshot)
+  })
+
+  it.each([
+    { folderTarget: 'a', groupTarget: 'b', expected: ['grouped', 'a'] },
+    { folderTarget: null, groupTarget: 'b', expected: ['grouped', 'b'] },
+    { folderTarget: undefined, groupTarget: undefined, expected: ['grouped', 'local'] }
+  ])(
+    'keeps explicit target precedence: $folderTarget / $groupTarget',
+    ({ folderTarget, groupTarget, expected }) => {
+      const entries = [
+        repo('a', { connectionId: 'a' }),
+        repo('b', { connectionId: 'b' }),
+        repo('local'),
+        repo('grouped', { projectGroupId: 'group', path: '/outside' })
+      ]
+      expect(
+        getFolderLineageCandidateRepos(
+          context(entries, [group('group', { connectionId: groupTarget })]),
+          folder({ connectionId: folderTarget })
+        ).map((entry) => entry.id)
+      ).toEqual(expected)
+    }
+  )
+
+  it('keeps every contained target when the folder has no grouped repositories', () => {
+    const entries = [
+      repo('local'),
+      repo('remote', { connectionId: 'a' }),
+      repo('outside', { path: '/elsewhere' })
+    ]
+    expect(getFolderLineageCandidateRepos(context(entries), folder())).toEqual(entries.slice(0, 2))
+  })
+
+  it('does not read grouped targets when there are no path candidates', () => {
+    let targetReads = 0
+    const grouped: Repo = {
+      ...repo('grouped', { projectGroupId: 'group' }),
+      get connectionId() {
+        targetReads += 1
+        return 'a'
+      }
+    }
+    expect(getFolderLineageCandidateRepos(context([grouped]), folder())).toEqual([grouped])
+    expect(targetReads).toBe(0)
+  })
+
+  it('rebuilds target membership after a later change in the same context', () => {
+    const grouped = repo('grouped', { projectGroupId: 'group', connectionId: 'a' })
+    const a = repo('a', { connectionId: 'a' })
+    const b = repo('b', { connectionId: 'b' })
+    const current = context([grouped, a, b])
+    expect(getFolderLineageCandidateRepos(current, folder())).toEqual([grouped, a])
+    grouped.connectionId = 'b'
+    expect(getFolderLineageCandidateRepos(current, folder())).toEqual([grouped, b])
+  })
+})
diff --git a/src/main/ipc/worktrees/metadata/workspace-lineage-filtering.ts b/src/main/ipc/worktrees/metadata/workspace-lineage-filtering.ts
index 3106812418c..c478b59b81a 100644
--- a/src/main/ipc/worktrees/metadata/workspace-lineage-filtering.ts
+++ b/src/main/ipc/worktrees/metadata/workspace-lineage-filtering.ts
@@ -36,18 +36,20 @@ export function getFolderLineageCandidateRepos(
   )
   const group = context.groupsById.get(folder.projectGroupId)?.[0]
   const connectionId = folder.connectionId ?? group?.connectionId ?? null
-  return connectionId
-    ? [...grouped, ...pathRepos.filter((repo) => (repo.connectionId ?? null) === connectionId)]
-    : grouped.length > 0
-      ? [
-          ...grouped,
-          ...pathRepos.filter((repo) =>
-            new Set(grouped.map((candidate) => candidate.connectionId ?? null)).has(
-              repo.connectionId ?? null
-            )
-          )
-        ]
-      : pathRepos
+  if (connectionId) {
+    return [...grouped, ...pathRepos.filter((repo) => (repo.connectionId ?? null) === connectionId)]
+  }
+  if (grouped.length === 0) {
+    return pathRepos
+  }
+  if (pathRepos.length === 0) {
+    return grouped
+  }
+  const groupedConnectionIds = new Set(grouped.map((repo) => repo.connectionId ?? null))
+  return [
+    ...grouped,
+    ...pathRepos.filter((repo) => groupedConnectionIds.has(repo.connectionId ?? null))
+  ]
 }
 
 export function resolveFolderLineageOwner(
diff --git a/src/main/ipc/worktrees/removal/remove-registered-local-worktree.ts b/src/main/ipc/worktrees/removal/remove-registered-local-worktree.ts
index c22e6b0ad96..5a36199c8e3 100644
--- a/src/main/ipc/worktrees/removal/remove-registered-local-worktree.ts
+++ b/src/main/ipc/worktrees/removal/remove-registered-local-worktree.ts
@@ -11,17 +11,10 @@ import {
 } from '../../../git/worktree'
 import { gitExecFileAsync } from '../../../git/runner'
 import { getWorktreeSharedLinkPaths } from '../../../git/worktree-shared-directories'
-import {
-  getLocalWorktreePathAccess,
-  removeLocalWorktreePath,
-  toLocalWorktreeRuntimePath
-} from '../../../local-worktree-filesystem'
+import { cleanupLocalOrphanedWorktreeDirectory } from '../../../local-orphaned-worktree-cleanup'
 import { recoverLocalWindowsWorktreeRemoval } from '../../../local-worktree-removal-recovery'
 import { withWorktreeRemoveStageSpan } from '../../../observability/instrumentation'
-import {
-  canSafelyRemoveOrphanedWorktreeDirectory,
-  findRegisteredDeletableWorktree
-} from '../../../worktree-removal-safety'
+import { findRegisteredDeletableWorktree } from '../../../worktree-removal-safety'
 import { CLIENT_REMOVAL_HOME } from '../../../worktree-removal-home-guard'
 import {
   cleanupUnusedWorktreePushTargetRemote,
@@ -162,25 +155,12 @@ export async function removeRegisteredLocalWorktree(
         console.warn(
           `[worktrees] Orphaned worktree detected at ${canonicalWorktreePath}, cleaning up`
         )
-        const access = getLocalWorktreePathAccess(localWorktreeGitOptions)
-        if (
-          await canSafelyRemoveOrphanedWorktreeDirectory(
-            toLocalWorktreeRuntimePath(canonicalWorktreePath, localWorktreeGitOptions),
-            toLocalWorktreeRuntimePath(repo.path, localWorktreeGitOptions),
-            CLIENT_REMOVAL_HOME,
-            access.statPath,
-            access.readPath
-          )
-        ) {
-          await runtime.closeFileWatchersForRemoval(canonicalWorktreePath)
-          await removeLocalWorktreePath(canonicalWorktreePath, localWorktreeGitOptions).catch(
-            () => {}
-          )
-        } else {
-          console.warn(
-            `[worktrees] Refusing recursive cleanup for unproven worktree directory: ${canonicalWorktreePath}`
-          )
-        }
+        await cleanupLocalOrphanedWorktreeDirectory(
+          repo.path,
+          canonicalWorktreePath,
+          localWorktreeGitOptions,
+          (path) => runtime.closeFileWatchersForRemoval(path)
+        )
         // Why: remove failed so git still tracks it (.git/worktrees/<name>); prune or the stale entry keeps its branch locked.
         await gitExecFileAsync(['worktree', 'prune'], {
           cwd: repo.path,
diff --git a/src/main/kimi/hook-service-config-delete-race.test.ts b/src/main/kimi/hook-service-config-delete-race.test.ts
new file mode 100644
index 00000000000..6a801cef4c0
--- /dev/null
+++ b/src/main/kimi/hook-service-config-delete-race.test.ts
@@ -0,0 +1,91 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as NodeFs from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+const deleteRace = vi.hoisted((): { path: string | null; code: string } => ({
+  path: null,
+  code: 'ENOENT'
+}))
+
+// Why: simulates the config file (or an ancestor directory) vanishing between
+// writeConfigToml's existsSync check and its statSync mode read — e.g. a
+// concurrent uninstall, user delete, or a directory replaced by a file.
+vi.mock('node:fs', async (importOriginal) => {
+  const actual = await importOriginal<typeof NodeFs>()
+  const statSync = (
+    target: NodeFs.PathLike,
+    options?: NodeFs.StatSyncOptions
+  ): NodeFs.Stats | NodeFs.BigIntStats | undefined => {
+    if (typeof target === 'string' && target === deleteRace.path) {
+      throw Object.assign(new Error(`${deleteRace.code}: simulated race`), {
+        code: deleteRace.code
+      })
+    }
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: forwarding actual.statSync's own overload signature.
+    return actual.statSync(target, options as NodeFs.StatSyncOptions)
+  }
+  const patched = { ...actual, statSync }
+  return { ...patched, default: patched }
+})
+
+const fs = await vi.importActual<typeof NodeFs>('node:fs')
+const { KimiHookService } = await import('./hook-service')
+const { KIMI_HOOK_EVENTS } = await import('./kimi-hook-config-toml')
+
+let home: string
+let originalHome: string | undefined
+let originalKimiHome: string | undefined
+let originalUserProfile: string | undefined
+
+const configPath = (): string => join(home, '.kimi-code', 'config.toml')
+
+beforeEach(() => {
+  home = fs.mkdtempSync(join(tmpdir(), 'orca-kimi-hook-delete-race-'))
+  originalHome = process.env.HOME
+  originalKimiHome = process.env.KIMI_CODE_HOME
+  originalUserProfile = process.env.USERPROFILE
+  process.env.HOME = home
+  process.env.KIMI_CODE_HOME = join(home, '.kimi-code')
+  process.env.USERPROFILE = home
+})
+
+afterEach(() => {
+  deleteRace.path = null
+  deleteRace.code = 'ENOENT'
+  if (originalHome === undefined) {
+    delete process.env.HOME
+  } else {
+    process.env.HOME = originalHome
+  }
+  if (originalKimiHome === undefined) {
+    delete process.env.KIMI_CODE_HOME
+  } else {
+    process.env.KIMI_CODE_HOME = originalKimiHome
+  }
+  if (originalUserProfile === undefined) {
+    delete process.env.USERPROFILE
+  } else {
+    process.env.USERPROFILE = originalUserProfile
+  }
+  fs.rmSync(home, { recursive: true, force: true })
+})
+
+describe('KimiHookService config delete race', () => {
+  it.each(['ENOENT', 'ENOTDIR'])(
+    'still writes the config when the mode stat fails with %s',
+    (code) => {
+      fs.mkdirSync(join(home, '.kimi-code'), { recursive: true })
+      fs.writeFileSync(configPath(), 'api_key = "fixture-only"\n')
+      deleteRace.path = configPath()
+      deleteRace.code = code
+
+      expect(() => new KimiHookService().install()).not.toThrow()
+
+      const config = fs.readFileSync(configPath(), 'utf-8')
+      for (const event of KIMI_HOOK_EVENTS) {
+        expect(config).toContain(`event = "${event}"`)
+      }
+    }
+  )
+})
diff --git a/src/main/kimi/hook-service-mode-read-failure.test.ts b/src/main/kimi/hook-service-mode-read-failure.test.ts
new file mode 100644
index 00000000000..4e82137e832
--- /dev/null
+++ b/src/main/kimi/hook-service-mode-read-failure.test.ts
@@ -0,0 +1,70 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as NodeFs from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+const modeReadFailure = vi.hoisted((): { path: string | null } => ({ path: null }))
+
+vi.mock('node:fs', async (importOriginal) => {
+  const actual = await importOriginal<typeof NodeFs>()
+  const statSync = (target: NodeFs.PathLike): NodeFs.Stats | NodeFs.BigIntStats => {
+    if (typeof target === 'string' && target === modeReadFailure.path) {
+      throw new Error('mode unavailable')
+    }
+    return actual.statSync(target)
+  }
+  const patched = { ...actual, statSync }
+  return { ...patched, default: patched }
+})
+
+const fs = await vi.importActual<typeof NodeFs>('node:fs')
+const { KimiHookService } = await import('./hook-service')
+
+let home: string
+let originalHome: string | undefined
+let originalKimiHome: string | undefined
+let originalUserProfile: string | undefined
+
+const configPath = (): string => join(home, '.kimi-code', 'config.toml')
+
+beforeEach(() => {
+  home = fs.mkdtempSync(join(tmpdir(), 'orca-kimi-hook-mode-read-'))
+  originalHome = process.env.HOME
+  originalKimiHome = process.env.KIMI_CODE_HOME
+  originalUserProfile = process.env.USERPROFILE
+  process.env.HOME = home
+  process.env.KIMI_CODE_HOME = join(home, '.kimi-code')
+  process.env.USERPROFILE = home
+})
+
+afterEach(() => {
+  modeReadFailure.path = null
+  if (originalHome === undefined) {
+    delete process.env.HOME
+  } else {
+    process.env.HOME = originalHome
+  }
+  if (originalKimiHome === undefined) {
+    delete process.env.KIMI_CODE_HOME
+  } else {
+    process.env.KIMI_CODE_HOME = originalKimiHome
+  }
+  if (originalUserProfile === undefined) {
+    delete process.env.USERPROFILE
+  } else {
+    process.env.USERPROFILE = originalUserProfile
+  }
+  fs.rmSync(home, { recursive: true, force: true })
+})
+
+describe('KimiHookService config mode preservation', () => {
+  it('does not replace an existing config when its mode cannot be read', () => {
+    fs.mkdirSync(join(home, '.kimi-code'), { recursive: true })
+    const original = 'api_key = "fixture-only"\n'
+    fs.writeFileSync(configPath(), original)
+    modeReadFailure.path = configPath()
+
+    expect(() => new KimiHookService().install()).toThrow('mode unavailable')
+    expect(fs.readFileSync(configPath(), 'utf-8')).toBe(original)
+  })
+})
diff --git a/src/main/kimi/hook-service.test.ts b/src/main/kimi/hook-service.test.ts
index 24a77444e19..a88c68f3d04 100644
--- a/src/main/kimi/hook-service.test.ts
+++ b/src/main/kimi/hook-service.test.ts
@@ -1,4 +1,13 @@
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import {
+  chmodSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
@@ -8,17 +17,20 @@ import { KIMI_HOOK_EVENTS } from './kimi-hook-config-toml'
 // Why: getSharedManagedScriptPath() writes the managed script under
 // homedir()/.orca, and getKimiHome() honors KIMI_CODE_HOME. Point both at a
 // temp dir so the local install/remove cycle never touches the real ~/.orca or
-// ~/.kimi-code. os.homedir() resolves $HOME on POSIX (verified at write time).
+// ~/.kimi-code. os.homedir() resolves HOME on POSIX and USERPROFILE on Windows.
 let home: string
 let originalHome: string | undefined
 let originalKimiHome: string | undefined
+let originalUserProfile: string | undefined
 
 beforeEach(() => {
   home = mkdtempSync(join(tmpdir(), 'orca-kimi-hook-'))
   originalHome = process.env.HOME
   originalKimiHome = process.env.KIMI_CODE_HOME
+  originalUserProfile = process.env.USERPROFILE
   process.env.HOME = home
   process.env.KIMI_CODE_HOME = join(home, '.kimi-code')
+  process.env.USERPROFILE = home
 })
 
 afterEach(() => {
@@ -32,11 +44,17 @@ afterEach(() => {
   } else {
     process.env.KIMI_CODE_HOME = originalKimiHome
   }
+  if (originalUserProfile === undefined) {
+    delete process.env.USERPROFILE
+  } else {
+    process.env.USERPROFILE = originalUserProfile
+  }
   rmSync(home, { recursive: true, force: true })
 })
 
 const configPath = (): string => join(home, '.kimi-code', 'config.toml')
 const scriptPath = (): string => join(home, '.orca', 'agent-hooks', 'kimi-hook.sh')
+const supportsPosixFileModes = process.platform !== 'win32'
 
 describe('KimiHookService', () => {
   it('reports not_installed before install', () => {
@@ -89,4 +107,41 @@ describe('KimiHookService', () => {
     const afterRemove = readFileSync(configPath(), 'utf-8')
     expect(afterRemove).toBe(userConfig)
   })
+
+  it.skipIf(!supportsPosixFileModes)(
+    'preserves an existing config mode while installing and removing hooks',
+    () => {
+      mkdirSync(join(home, '.kimi-code'), { recursive: true })
+      writeFileSync(configPath(), 'api_key = "sk-secret"\n')
+      const existingMode = 0o640
+      chmodSync(configPath(), existingMode)
+
+      const service = new KimiHookService()
+      const originalUmask = process.umask(0o077)
+      try {
+        service.install()
+        expect(statSync(configPath()).mode & 0o777).toBe(existingMode)
+        expect(statSync(`${configPath()}.bak`).mode & 0o777).toBe(existingMode)
+        expect(
+          readdirSync(join(home, '.kimi-code')).filter((name) => name.endsWith('.tmp'))
+        ).toEqual([])
+
+        service.remove()
+        expect(statSync(configPath()).mode & 0o777).toBe(existingMode)
+      } finally {
+        process.umask(originalUmask)
+      }
+    }
+  )
+
+  it.skipIf(!supportsPosixFileModes)('creates a new config with an owner-only mode', () => {
+    const originalUmask = process.umask(0o022)
+    try {
+      new KimiHookService().install()
+
+      expect(statSync(configPath()).mode & 0o777).toBe(0o600)
+    } finally {
+      process.umask(originalUmask)
+    }
+  })
 })
diff --git a/src/main/kimi/hook-service.ts b/src/main/kimi/hook-service.ts
index 21fee64d276..f4f4dfbe534 100644
--- a/src/main/kimi/hook-service.ts
+++ b/src/main/kimi/hook-service.ts
@@ -1,9 +1,11 @@
 import {
   copyFileSync,
+  chmodSync,
   existsSync,
   mkdirSync,
   readFileSync,
   renameSync,
+  statSync,
   unlinkSync,
   writeFileSync
 } from 'node:fs'
@@ -12,6 +14,7 @@ import { dirname, join, posix as pathPosix } from 'node:path'
 import { randomUUID } from 'node:crypto'
 import type { SFTPWrapper } from 'ssh2'
 import type { AgentHookInstallState, AgentHookInstallStatus } from '../../shared/agent-hook-types'
+import { isDefinitiveAbsence } from '../../shared/definitive-filesystem-absence'
 import {
   createManagedCommandMatcher,
   getSharedManagedScriptPath,
@@ -137,6 +140,8 @@ function readConfigToml(configPath: string): string | null {
 function writeConfigToml(configPath: string, text: string): void {
   const dir = dirname(configPath)
   mkdirSync(dir, { recursive: true })
+  // Why: renameSync replaces the inode, so the temp mode becomes the config mode.
+  let mode = 0o600
   if (existsSync(configPath)) {
     try {
       if (readFileSync(configPath, 'utf-8') === text) {
@@ -145,10 +150,19 @@ function writeConfigToml(configPath: string, text: string): void {
     } catch {
       // Fall through to the atomic write path.
     }
+    try {
+      mode = statSync(configPath).mode & 0o777
+    } catch (error) {
+      // Why: file was deleted between the existsSync check and here — nothing to preserve.
+      if (!isDefinitiveAbsence(error)) {
+        throw error
+      }
+    }
   }
   const tmpPath = join(dir, `.${Date.now()}-${randomUUID()}.tmp`)
   try {
-    writeFileSync(tmpPath, text, 'utf-8')
+    writeFileSync(tmpPath, text, { encoding: 'utf-8', mode: 0o600 })
+    chmodSync(tmpPath, mode)
     if (existsSync(configPath)) {
       copyFileSync(configPath, `${configPath}.bak`)
     }
diff --git a/src/main/lazy-worker-thread-host.ts b/src/main/lazy-worker-thread-host.ts
index 01f15eb1c66..2de02689afc 100644
--- a/src/main/lazy-worker-thread-host.ts
+++ b/src/main/lazy-worker-thread-host.ts
@@ -1,6 +1,12 @@
 import type { Worker } from 'node:worker_threads'
 
-export type WorkerThreadFactory = () => Worker
+export type WorkerRequestTransport = Pick<Worker, 'unref' | 'postMessage' | 'terminate'> & {
+  on(...args: Parameters<Worker['on']>): unknown
+  off(...args: Parameters<Worker['off']>): unknown
+  removeAllListeners(): unknown
+}
+
+export type WorkerThreadFactory = () => WorkerRequestTransport
 
 /**
  * Owns the lifetime of one lazily-spawned worker thread: spawn on demand,
@@ -10,7 +16,7 @@ export type WorkerThreadFactory = () => Worker
  * queued calls closed instead of moving the work back onto the main thread.
  */
 export class LazyWorkerThreadHost<TResponse> {
-  private worker: Worker | null = null
+  private worker: WorkerRequestTransport | null = null
   private idleTimer: NodeJS.Timeout | null = null
   private cleanupListeners: (() => void) | null = null
   private reportedUnavailable = false
@@ -29,12 +35,12 @@ export class LazyWorkerThreadHost<TResponse> {
     }
   ) {}
 
-  get current(): Worker | null {
+  get current(): WorkerRequestTransport | null {
     return this.worker
   }
 
   /** The live worker, spawning one if needed; null when no worker can be had. */
-  ensure(): Worker | null {
+  ensure(): WorkerRequestTransport | null {
     if (this.worker) {
       return this.worker
     }
diff --git a/src/main/lib/html-to-pdf.test.ts b/src/main/lib/html-to-pdf.test.ts
new file mode 100644
index 00000000000..03ead7c66f1
--- /dev/null
+++ b/src/main/lib/html-to-pdf.test.ts
@@ -0,0 +1,315 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { join } from 'node:path'
+
+const fake = vi.hoisted(() => ({
+  files: new Map<string, string>(),
+  handlers: new Map<string, (...args: unknown[]) => void>(),
+  write: vi.fn<(path: string, html: string, options: unknown) => Promise<void>>(),
+  unlink: vi.fn<(path: string) => Promise<void>>(),
+  construct: vi.fn<(options: unknown) => void>(),
+  load: vi.fn<(path: string) => Promise<void>>(),
+  images: vi.fn<(script: string, userGesture: boolean) => Promise<void>>(),
+  print: vi.fn<(options: unknown) => Promise<Buffer>>(),
+  isDestroyed: vi.fn<() => boolean>(),
+  destroy: vi.fn<() => void>(),
+  uuid: vi.fn<() => string>()
+}))
+
+vi.mock('electron', () => ({
+  app: { getPath: () => '/mock-export-temp' },
+  BrowserWindow: class {
+    constructor(options: unknown) {
+      fake.construct(options)
+    }
+    webContents = {
+      once: (event: string, listener: (...args: unknown[]) => void) => {
+        fake.handlers.set(event, listener)
+      },
+      executeJavaScript: fake.images,
+      printToPDF: fake.print
+    }
+    loadFile = fake.load
+    isDestroyed = fake.isDestroyed
+    destroy = fake.destroy
+  }
+}))
+vi.mock('node:fs/promises', () => ({ writeFile: fake.write, unlink: fake.unlink }))
+vi.mock('node:crypto', () => ({ randomUUID: fake.uuid }))
+
+import { ExportTimeoutError, htmlToPdf } from './html-to-pdf'
+
+const HTML = '<p>synthetic export</p>'
+const TEMP_PATH = join('/mock-export-temp', 'orca-export-test-export.html')
+const PDF = Buffer.from('synthetic PDF buffer')
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.resetAllMocks()
+  fake.files.clear()
+  fake.handlers.clear()
+  fake.uuid.mockReturnValue('test-export')
+  fake.write.mockImplementation(async (path, html) => {
+    fake.files.set(path, html)
+  })
+  fake.unlink.mockImplementation(async (path) => {
+    fake.files.delete(path)
+  })
+  fake.load.mockImplementation(async () => {
+    fake.handlers.get('did-finish-load')?.()
+  })
+  fake.images.mockResolvedValue()
+  fake.print.mockResolvedValue(PDF)
+  fake.isDestroyed.mockReturnValue(false)
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('htmlToPdf resource ownership', () => {
+  it('removes the temporary document when window construction throws', async () => {
+    const error = new Error('window construction failed')
+    fake.construct.mockImplementation(() => {
+      throw error
+    })
+
+    await expect(htmlToPdf(HTML)).rejects.toBe(error)
+
+    expect(fake.write).toHaveBeenCalledWith(TEMP_PATH, HTML, { encoding: 'utf-8', flag: 'wx' })
+    expect(fake.unlink).toHaveBeenCalledExactlyOnceWith(TEMP_PATH)
+    expect(fake.files.size).toBe(0)
+    expect(fake.destroy).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('removes a partial document when writing rejects', async () => {
+    const error = new Error('disk full')
+    fake.write.mockImplementation(async (path) => {
+      fake.files.set(path, '<partial')
+      throw error
+    })
+
+    await expect(htmlToPdf(HTML)).rejects.toBe(error)
+
+    expect(fake.files.size).toBe(0)
+    expect(fake.unlink).toHaveBeenCalledExactlyOnceWith(TEMP_PATH)
+    expect(fake.construct).not.toHaveBeenCalled()
+  })
+
+  it('preserves the write error when no file exists and cleanup also rejects', async () => {
+    const error = new Error('write denied')
+    fake.write.mockRejectedValue(error)
+    fake.unlink.mockRejectedValue(new Error('ENOENT'))
+
+    await expect(htmlToPdf(HTML)).rejects.toBe(error)
+
+    expect(fake.unlink).toHaveBeenCalledExactlyOnceWith(TEMP_PATH)
+    expect(fake.construct).not.toHaveBeenCalled()
+  })
+
+  it('preserves the construction error when best-effort cleanup fails', async () => {
+    const error = new Error('window construction failed')
+    fake.construct.mockImplementation(() => {
+      throw error
+    })
+    fake.unlink.mockRejectedValue(new Error('unlink denied'))
+
+    await expect(htmlToPdf(HTML)).rejects.toBe(error)
+
+    expect(fake.unlink).toHaveBeenCalledExactlyOnceWith(TEMP_PATH)
+    expect(fake.files.size).toBe(1)
+  })
+
+  it('does not accumulate temporary documents across repeated failed exports', async () => {
+    fake.construct.mockImplementation(() => {
+      throw new Error('window construction failed')
+    })
+    for (let index = 0; index < 10; index++) {
+      fake.uuid.mockReturnValue(`export-${index}`)
+      await expect(htmlToPdf(HTML)).rejects.toThrow('window construction failed')
+    }
+
+    expect(fake.files.size).toBe(0)
+    expect(fake.unlink).toHaveBeenCalledTimes(10)
+  })
+
+  it('keeps window security, print settings and the returned PDF unchanged', async () => {
+    await expect(htmlToPdf(HTML)).resolves.toBe(PDF)
+
+    expect(fake.construct).toHaveBeenCalledExactlyOnceWith({
+      show: false,
+      webPreferences: {
+        sandbox: true,
+        contextIsolation: true,
+        nodeIntegration: false,
+        javascript: true
+      }
+    })
+    expect(fake.load).toHaveBeenCalledExactlyOnceWith(TEMP_PATH)
+    expect(fake.images).toHaveBeenCalledWith(expect.stringContaining('document.images'), true)
+    expect(fake.print).toHaveBeenCalledExactlyOnceWith({
+      printBackground: true,
+      pageSize: 'A4',
+      margins: { top: 0.75, bottom: 0.75, left: 0.75, right: 0.75 }
+    })
+    expect(fake.destroy).toHaveBeenCalledOnce()
+    expect(fake.unlink).toHaveBeenCalledExactlyOnceWith(TEMP_PATH)
+    expect(fake.files.size).toBe(0)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('waits for images before printing', async () => {
+    const images = Promise.withResolvers<void>()
+    fake.images.mockReturnValue(images.promise)
+    const result = htmlToPdf(HTML)
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(fake.images).toHaveBeenCalledOnce()
+    expect(fake.print).not.toHaveBeenCalled()
+    expect(fake.unlink).not.toHaveBeenCalled()
+
+    images.resolve()
+    await expect(result).resolves.toBe(PDF)
+    expect(fake.print).toHaveBeenCalledOnce()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it.each(['images', 'print'] as const)('cleans up after %s failure', async (stage) => {
+    const error = new Error(`${stage} failed`)
+    fake[stage].mockRejectedValue(error)
+
+    await expect(htmlToPdf(HTML)).rejects.toBe(error)
+
+    expect(fake.destroy).toHaveBeenCalledOnce()
+    expect(fake.files.size).toBe(0)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('cleans up after a load rejection', async () => {
+    const error = new Error('load failed')
+    fake.load.mockRejectedValue(error)
+
+    await expect(htmlToPdf(HTML)).rejects.toBe(error)
+
+    expect(fake.destroy).toHaveBeenCalledOnce()
+    expect(fake.files.size).toBe(0)
+    expect(fake.images).not.toHaveBeenCalled()
+  })
+
+  it('keeps the render timeout type and clears its resources', async () => {
+    const images = Promise.withResolvers<void>()
+    fake.images.mockReturnValue(images.promise)
+    const result = expect(htmlToPdf(HTML)).rejects.toBeInstanceOf(ExportTimeoutError)
+    await vi.advanceTimersByTimeAsync(60_000)
+    await result
+
+    expect(fake.destroy).toHaveBeenCalledOnce()
+    expect(fake.files.size).toBe(0)
+    expect(vi.getTimerCount()).toBe(0)
+    images.reject(new Error('late renderer failure'))
+    await Promise.resolve()
+  })
+
+  it('does not destroy an already-destroyed window again', async () => {
+    fake.isDestroyed.mockReturnValue(true)
+
+    await expect(htmlToPdf(HTML)).resolves.toBe(PDF)
+
+    expect(fake.destroy).not.toHaveBeenCalled()
+    expect(fake.files.size).toBe(0)
+  })
+
+  it('still removes the document if window destruction throws', async () => {
+    const error = new Error('window destruction failed')
+    fake.destroy.mockImplementation(() => {
+      throw error
+    })
+
+    await expect(htmlToPdf(HTML)).rejects.toBe(error)
+
+    expect(fake.unlink).toHaveBeenCalledExactlyOnceWith(TEMP_PATH)
+    expect(fake.files.size).toBe(0)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('keeps a successful export successful when best-effort cleanup rejects', async () => {
+    fake.unlink.mockRejectedValue(new Error('unlink denied'))
+
+    await expect(htmlToPdf(HTML)).resolves.toBe(PDF)
+
+    expect(fake.destroy).toHaveBeenCalledOnce()
+    expect(fake.unlink).toHaveBeenCalledExactlyOnceWith(TEMP_PATH)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+  it('leaves a pre-existing file at the temp path in place instead of deleting it', async () => {
+    const error = Object.assign(new Error('file already exists'), { code: 'EEXIST' })
+    fake.files.set(TEMP_PATH, 'FILE THIS EXPORT DID NOT CREATE')
+    fake.write.mockRejectedValue(error)
+
+    await expect(htmlToPdf(HTML)).rejects.toBe(error)
+
+    expect(fake.unlink).not.toHaveBeenCalled()
+    expect(fake.files.get(TEMP_PATH)).toBe('FILE THIS EXPORT DID NOT CREATE')
+    expect(fake.construct).not.toHaveBeenCalled()
+  })
+
+  it('times out and cleans up when loading never settles', async () => {
+    fake.load.mockReturnValue(new Promise<void>(() => {}))
+
+    const result = expect(htmlToPdf(HTML)).rejects.toBeInstanceOf(ExportTimeoutError)
+    await vi.advanceTimersByTimeAsync(60_000)
+    await result
+
+    expect(fake.images).not.toHaveBeenCalled()
+    expect(fake.destroy).toHaveBeenCalledOnce()
+    expect(fake.unlink).toHaveBeenCalledExactlyOnceWith(TEMP_PATH)
+    expect(fake.files.size).toBe(0)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('times out and cleans up when neither load event ever fires', async () => {
+    fake.load.mockResolvedValue()
+
+    const result = expect(htmlToPdf(HTML)).rejects.toBeInstanceOf(ExportTimeoutError)
+    await vi.advanceTimersByTimeAsync(60_000)
+    await result
+
+    expect(fake.print).not.toHaveBeenCalled()
+    expect(fake.destroy).toHaveBeenCalledOnce()
+    expect(fake.files.size).toBe(0)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('cleans up after a did-fail-load event', async () => {
+    fake.load.mockImplementation(async () => {
+      fake.handlers.get('did-fail-load')?.({}, -6, 'ERR_FILE_NOT_FOUND')
+    })
+
+    await expect(htmlToPdf(HTML)).rejects.toThrow('ERR_FILE_NOT_FOUND (-6)')
+
+    expect(fake.images).not.toHaveBeenCalled()
+    expect(fake.destroy).toHaveBeenCalledOnce()
+    expect(fake.files.size).toBe(0)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('never removes a temp path belonging to a concurrent export', async () => {
+    const images = Promise.withResolvers<void>()
+    fake.images.mockReturnValueOnce(images.promise)
+    fake.uuid.mockReturnValueOnce('first-export').mockReturnValueOnce('second-export')
+    const firstPath = join('/mock-export-temp', 'orca-export-first-export.html')
+    const secondPath = join('/mock-export-temp', 'orca-export-second-export.html')
+
+    const first = htmlToPdf(HTML)
+    await vi.advanceTimersByTimeAsync(0)
+    await expect(htmlToPdf(HTML)).resolves.toBe(PDF)
+
+    expect(fake.unlink).toHaveBeenCalledExactlyOnceWith(secondPath)
+    expect(fake.files.has(firstPath)).toBe(true)
+
+    images.resolve()
+    await expect(first).resolves.toBe(PDF)
+    expect(fake.unlink).toHaveBeenCalledWith(firstPath)
+    expect(fake.files.size).toBe(0)
+  })
+})
diff --git a/src/main/lib/html-to-pdf.ts b/src/main/lib/html-to-pdf.ts
index f0cc467e515..a375e7ef7c7 100644
--- a/src/main/lib/html-to-pdf.ts
+++ b/src/main/lib/html-to-pdf.ts
@@ -33,66 +33,93 @@ new Promise((resolve) => {
 export async function htmlToPdf(html: string): Promise<Buffer> {
   const tempDir = app.getPath('temp')
   const tempPath = path.join(tempDir, `orca-export-${randomUUID()}.html`)
-  await writeFile(tempPath, html, 'utf-8')
 
-  const win = new BrowserWindow({
-    show: false,
-    webPreferences: {
-      sandbox: true,
-      contextIsolation: true,
-      nodeIntegration: false,
-      // Why: image-wait needs to run a short script inside the export page, and
-      // the exported renderer DOM may already embed scripts/SVGs (e.g. Mermaid)
-      // that need JS to paint correctly. The window stays sandboxed and
-      // isolated so this is safe.
-      javascript: true
+  // Why: 'wx' is an exclusive create, so the shared temp dir cannot pre-seat this
+  // path as a symlink and have the export write through it. EEXIST is the one
+  // failure where the path is not ours, so it must not be unlinked below.
+  try {
+    await writeFile(tempPath, html, { encoding: 'utf-8', flag: 'wx' })
+  } catch (error) {
+    if (isAlreadyExists(error)) {
+      throw error
     }
-  })
-
-  let timer: NodeJS.Timeout | undefined
+    await removeOwnTempDocument(tempPath)
+    throw error
+  }
 
   try {
-    const loadPromise = new Promise<void>((resolve, reject) => {
-      win.webContents.once('did-finish-load', () => resolve())
-      win.webContents.once('did-fail-load', (_event, errorCode, errorDescription) => {
-        reject(new Error(`Failed to load export document: ${errorDescription} (${errorCode})`))
-      })
+    const win = new BrowserWindow({
+      show: false,
+      webPreferences: {
+        sandbox: true,
+        contextIsolation: true,
+        nodeIntegration: false,
+        // Why: image-wait needs to run a short script inside the export page, and
+        // the exported renderer DOM may already embed scripts/SVGs (e.g. Mermaid)
+        // that need JS to paint correctly. The window stays sandboxed and
+        // isolated so this is safe.
+        javascript: true
+      }
     })
 
-    await win.loadFile(tempPath)
-    await loadPromise
+    let timer: NodeJS.Timeout | undefined
 
-    const renderAndPrint = (async (): Promise<Buffer> => {
-      await win.webContents.executeJavaScript(WAIT_FOR_IMAGES_SCRIPT, true)
-      return win.webContents.printToPDF({
-        printBackground: true,
-        pageSize: 'A4',
-        margins: {
-          top: 0.75,
-          bottom: 0.75,
-          left: 0.75,
-          right: 0.75
-        }
-      })
-    })()
-
-    const timeoutPromise = new Promise<never>((_resolve, reject) => {
-      timer = setTimeout(() => reject(new ExportTimeoutError()), EXPORT_TIMEOUT_MS)
-    })
-
-    return await Promise.race([renderAndPrint, timeoutPromise])
-  } finally {
-    if (timer) {
-      clearTimeout(timer)
-    }
-    if (!win.isDestroyed()) {
-      win.destroy()
-    }
     try {
-      await unlink(tempPath)
-    } catch {
-      // Why: best-effort cleanup — losing the temp file should not surface
-      // as a user-facing export failure.
+      // Why: the timeout has to cover loading too. An export document whose script
+      // never yields fires neither did-finish-load nor did-fail-load, so a
+      // render-only timeout would leave this window and its temp file forever.
+      const timeoutPromise = new Promise<never>((_resolve, reject) => {
+        timer = setTimeout(() => reject(new ExportTimeoutError()), EXPORT_TIMEOUT_MS)
+      })
+
+      const loadAndPrint = (async (): Promise<Buffer> => {
+        const loadPromise = new Promise<void>((resolve, reject) => {
+          win.webContents.once('did-finish-load', () => resolve())
+          win.webContents.once('did-fail-load', (_event, errorCode, errorDescription) => {
+            reject(new Error(`Failed to load export document: ${errorDescription} (${errorCode})`))
+          })
+        })
+
+        await win.loadFile(tempPath)
+        await loadPromise
+        await win.webContents.executeJavaScript(WAIT_FOR_IMAGES_SCRIPT, true)
+        return win.webContents.printToPDF({
+          printBackground: true,
+          pageSize: 'A4',
+          margins: {
+            top: 0.75,
+            bottom: 0.75,
+            left: 0.75,
+            right: 0.75
+          }
+        })
+      })()
+
+      return await Promise.race([loadAndPrint, timeoutPromise])
+    } finally {
+      if (timer) {
+        clearTimeout(timer)
+      }
+      if (!win.isDestroyed()) {
+        win.destroy()
+      }
     }
+  } finally {
+    await removeOwnTempDocument(tempPath)
+  }
+}
+
+function isAlreadyExists(error: unknown): boolean {
+  return error instanceof Error && 'code' in error && error.code === 'EEXIST'
+}
+
+// unlink never follows a symlink, so this removes the entry this export created
+// and never the target of one swapped in underneath it.
+async function removeOwnTempDocument(tempPath: string): Promise<void> {
+  try {
+    await unlink(tempPath)
+  } catch {
+    // Why: best-effort cleanup — losing the temp file should not surface
+    // as a user-facing export failure.
   }
 }
diff --git a/src/main/linear/teams.test.ts b/src/main/linear/teams.test.ts
index d0d8986373d..55808711824 100644
--- a/src/main/linear/teams.test.ts
+++ b/src/main/linear/teams.test.ts
@@ -72,16 +72,15 @@ function makeConnection<TNode>(pages: TNode[][]) {
   return {
     nodes,
     pageInfo: { hasNextPage: pages.length > 1 },
-    fetchNext: vi
-      .fn()
-      .mockImplementation(
-        async function fetchNext(this: { nodes: TNode[]; pageInfo: { hasNextPage: boolean } }) {
-          pageIndex += 1
-          this.nodes.push(...(pages[pageIndex] ?? []))
-          this.pageInfo.hasNextPage = pageIndex < pages.length - 1
-          return this
-        }
-      )
+    fetchNext: vi.fn().mockImplementation(async function fetchNext(this: {
+      nodes: TNode[]
+      pageInfo: { hasNextPage: boolean }
+    }) {
+      pageIndex += 1
+      this.nodes.push(...(pages[pageIndex] ?? []))
+      this.pageInfo.hasNextPage = pageIndex < pages.length - 1
+      return this
+    })
   }
 }
 
diff --git a/src/main/linux-update-package-type.test.ts b/src/main/linux-update-package-type.test.ts
index 7453c727bb8..ed1abf90b47 100644
--- a/src/main/linux-update-package-type.test.ts
+++ b/src/main/linux-update-package-type.test.ts
@@ -221,7 +221,7 @@ describe('getLinuxRootPackageType', () => {
   })
 
   it('returns unusable when the marker is unreadable', async () => {
-    // A directory in the marker's place makes readFileSync fail with EISDIR.
+    // A directory in the marker's place makes fail with EISDIR.
     await fsp.mkdir(path.join(resourcesDir, 'package-type'))
     const module = await loadPackageType()
     expect(module.getLinuxPackageType()).toBe('unusable')
diff --git a/src/main/local-orphaned-worktree-cleanup.ts b/src/main/local-orphaned-worktree-cleanup.ts
new file mode 100644
index 00000000000..9ed666e5021
--- /dev/null
+++ b/src/main/local-orphaned-worktree-cleanup.ts
@@ -0,0 +1,39 @@
+import type { LocalWorktreeFilesystemOptions } from './local-worktree-filesystem'
+import {
+  getLocalWorktreePathAccess,
+  removeLocalWorktreePath,
+  toLocalWorktreeRuntimePath
+} from './local-worktree-filesystem'
+import {
+  canSafelyRemoveOrphanedWorktreeDirectory,
+  isWorktreePathMissing,
+  ORPHANED_WORKTREE_DIRECTORY_MESSAGE
+} from './worktree-removal-safety'
+import { CLIENT_REMOVAL_HOME } from './worktree-removal-home-guard'
+
+export async function cleanupLocalOrphanedWorktreeDirectory(
+  repoPath: string,
+  path: string,
+  options: LocalWorktreeFilesystemOptions,
+  closeWatchers: (path: string) => Promise<void>
+): Promise<void> {
+  const access = getLocalWorktreePathAccess(options)
+  const runtimePath = toLocalWorktreeRuntimePath(path, options)
+  if (
+    await canSafelyRemoveOrphanedWorktreeDirectory(
+      runtimePath,
+      toLocalWorktreeRuntimePath(repoPath, options),
+      CLIENT_REMOVAL_HOME,
+      access.statPath,
+      access.readPath
+    )
+  ) {
+    await closeWatchers(path)
+    await removeLocalWorktreePath(path, options).catch(() => {})
+  } else {
+    console.warn(`[worktrees] Refusing recursive cleanup for unproven worktree directory: ${path}`)
+  }
+  if (!(await isWorktreePathMissing(runtimePath, access.statPath))) {
+    throw new Error(ORPHANED_WORKTREE_DIRECTORY_MESSAGE)
+  }
+}
diff --git a/src/main/local-worktree-filesystem.test.ts b/src/main/local-worktree-filesystem.test.ts
index c9e97f72e90..d69d82b914f 100644
--- a/src/main/local-worktree-filesystem.test.ts
+++ b/src/main/local-worktree-filesystem.test.ts
@@ -25,17 +25,18 @@ import {
   toHostFilesystemPath,
   toHostRemovalPath
 } from './local-worktree-filesystem'
+import { isWorktreePathMissing } from './worktree-removal-safety'
 
 function completeExecFile(stdout = ''): void {
   runProcessMock.mockResolvedValue({ code: 0, signal: null, stdout, stderr: '', timedOut: false })
 }
 
-function failExecFile(exitCode: number): void {
+function failExecFile(exitCode: number, stderr = 'missing'): void {
   runProcessMock.mockResolvedValue({
     code: exitCode,
     signal: null,
     stdout: '',
-    stderr: 'missing',
+    stderr,
     timedOut: false
   })
 }
@@ -171,7 +172,7 @@ describe('local worktree filesystem runtime access', () => {
 
   it('uses the selected WSL distro for stat, read, and removal on Windows', async () => {
     await withPlatform('win32', async () => {
-      completeExecFile('file')
+      completeExecFile('regular file')
       const access = getLocalWorktreePathAccess({ wslDistro: 'Ubuntu' })
       await expect(access.statPath('/home/me/repo/.git')).resolves.toEqual({ type: 'file' })
 
@@ -218,14 +219,68 @@ describe('local worktree filesystem runtime access', () => {
     })
   })
 
-  it('reports missing WSL stat targets with an ENOENT-shaped error', async () => {
+  // Captured verbatim from live hosts: GNU coreutils 9.4 (Ubuntu 24.04) and BusyBox v1.36.1.
+  it.each([
+    ['GNU', "stat: cannot statx '/mnt/c/repo/missing/.git': No such file or directory\n"],
+    ['GNU', "stat: cannot statx '/mnt/c/repo/missing/.git': Not a directory\n"],
+    ['BusyBox', "stat: can't stat '/mnt/c/repo/missing/.git': No such file or directory\n"],
+    ['BusyBox', "stat: can't stat '/mnt/c/repo/missing/.git': Not a directory\n"]
+  ])('reports a missing WSL stat target as ENOENT on %s userland', async (_userland, stderr) => {
     await withPlatform('win32', async () => {
-      failExecFile(2)
+      failExecFile(1, stderr)
       const access = getLocalWorktreePathAccess({ wslDistro: 'Ubuntu' })
 
       await expect(access.statPath('/mnt/c/repo/missing/.git')).rejects.toMatchObject({
         code: 'ENOENT'
       })
+      await expect(isWorktreePathMissing('/mnt/c/repo/missing', access.statPath)).resolves.toBe(
+        true
+      )
+    })
+  })
+
+  it.each([
+    ['GNU', "stat: cannot statx '/mnt/c/repo/locked': Permission denied\n"],
+    ['BusyBox', "stat: can't stat '/mnt/c/repo/locked': Permission denied\n"]
+  ])(
+    'does not treat an unreadable WSL stat target as missing on %s userland',
+    async (_userland, stderr) => {
+      await withPlatform('win32', async () => {
+        failExecFile(1, stderr)
+        const access = getLocalWorktreePathAccess({ wslDistro: 'Ubuntu' })
+
+        await expect(access.statPath('/mnt/c/repo/locked')).rejects.toThrow('Permission denied')
+        // A delete that did not happen still has to look like a failure, or cleanup silently "succeeds".
+        await expect(isWorktreePathMissing('/mnt/c/repo/locked', access.statPath)).resolves.toBe(
+          false
+        )
+      })
+    }
+  )
+
+  it('pins the stat probe to the C locale so its error text stays English', async () => {
+    await withPlatform('win32', async () => {
+      completeExecFile('directory')
+      await getLocalWorktreePathAccess({ wslDistro: 'Ubuntu' }).statPath('/mnt/c/repo/feature')
+
+      const args = runProcessMock.mock.calls[0]?.[0].args as string[]
+      expect(args.at(-1)).toContain('LC_ALL=C stat -c %F --')
+    })
+  })
+
+  it('reports a translated stat failure as a failure rather than as absence', async () => {
+    await withPlatform('win32', async () => {
+      // Synthetic: no host available here ships a non-English locale, and the probe pins LC_ALL=C
+      // anyway. The point is the direction it errs if that pin ever comes off.
+      failExecFile(1, "stat: <translated verb> '/mnt/c/repo/missing': <translated errno>\n")
+      const access = getLocalWorktreePathAccess({ wslDistro: 'Ubuntu' })
+
+      await expect(access.statPath('/mnt/c/repo/missing')).rejects.not.toMatchObject({
+        code: 'ENOENT'
+      })
+      await expect(isWorktreePathMissing('/mnt/c/repo/missing', access.statPath)).resolves.toBe(
+        false
+      )
     })
   })
 })
diff --git a/src/main/local-worktree-filesystem.ts b/src/main/local-worktree-filesystem.ts
index 1078b1f50bc..d6820dd5b14 100644
--- a/src/main/local-worktree-filesystem.ts
+++ b/src/main/local-worktree-filesystem.ts
@@ -18,8 +18,6 @@ type LocalWorktreePathAccess = {
 }
 
 const WSL_FILE_OPERATION_TIMEOUT_MS = 30_000
-/** The stat probe's explicit "missing path" branch. */
-const WSL_MISSING_PATH_EXIT_CODE = 2
 
 function shouldUseWslFilesystem(options: LocalWorktreeFilesystemOptions): boolean {
   return process.platform === 'win32' && !!options.wslDistro?.trim()
@@ -48,18 +46,27 @@ async function runWslCommand(distro: string, command: string): Promise<string> {
   }
   if (result.code !== 0) {
     throw Object.assign(new Error(result.stderr.trim() || `wsl.exe exited ${result.code}`), {
-      exitCode: result.code
+      exitCode: result.code,
+      stderr: result.stderr
     })
   }
   return result.stdout
 }
 
+/**
+ * Only stat's trailing strerror text is portable: GNU coreutils says `cannot statx`,
+ * BusyBox says `can't stat`, so matching the verb made a BusyBox distro report a
+ * successful cleanup as a permanent failure. The tail stays English because the probe
+ * pins LC_ALL=C, and stat is the only thing in that probe that writes to stderr.
+ */
+const WSL_MISSING_PATH_STDERR = /: (?:No such file or directory|Not a directory)\r?\n?$/
+
 function isWslMissingPathError(error: unknown): boolean {
-  return (
-    typeof error === 'object' &&
-    error !== null &&
-    (error as { exitCode?: unknown }).exitCode === WSL_MISSING_PATH_EXIT_CODE
-  )
+  if (typeof error !== 'object' || error === null || !('exitCode' in error)) {
+    return false
+  }
+  const stderr = 'stderr' in error && typeof error.stderr === 'string' ? error.stderr : ''
+  return error.exitCode === 1 && WSL_MISSING_PATH_STDERR.test(stderr)
 }
 
 export function toLocalWorktreeRuntimePath(
@@ -83,19 +90,26 @@ export function getLocalWorktreePathAccess(
   return {
     statPath: async (path) => {
       const target = quotePosixShell(toLinuxPath(path))
-      const stdout = await runWslCommand(
-        distro,
-        [
-          `target=${target}`,
-          'if [ -L "$target" ]; then printf symlink; elif [ -f "$target" ]; then printf file; elif [ -d "$target" ]; then printf directory; else exit 2; fi'
-        ].join('\n')
-      ).catch((error) => {
-        if (isWslMissingPathError(error)) {
-          throw Object.assign(new Error(`missing ${path}`), { code: 'ENOENT' })
+      // Shell file tests conflate permission failures with absence; stat preserves the reason.
+      const stdout = await runWslCommand(distro, `LC_ALL=C stat -c %F -- ${target}`).catch(
+        (error: unknown) => {
+          if (isWslMissingPathError(error)) {
+            throw Object.assign(new Error(`missing ${path}`), { code: 'ENOENT' })
+          }
+          throw error
         }
-        throw error
-      })
-      return { type: stdout.trim() }
+      )
+      const kind = stdout.trim()
+      return {
+        type:
+          kind === 'symbolic link'
+            ? 'symlink'
+            : kind === 'regular file' || kind === 'regular empty file'
+              ? 'file'
+              : kind === 'directory'
+                ? 'directory'
+                : 'other'
+      }
     },
     readPath: async (path) => {
       const target = quotePosixShell(toLinuxPath(path))
diff --git a/src/main/macos-keychain/generic-password.test.ts b/src/main/macos-keychain/generic-password.test.ts
new file mode 100644
index 00000000000..38ec1b05a72
--- /dev/null
+++ b/src/main/macos-keychain/generic-password.test.ts
@@ -0,0 +1,101 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const execFileMock = vi.hoisted(() => vi.fn())
+
+vi.mock('node:child_process', () => ({ execFile: execFileMock }))
+
+import {
+  deleteKeychainPassword,
+  isKeychainNotFoundError,
+  readKeychainPassword,
+  writeKeychainPassword
+} from './generic-password'
+
+const originalPlatform = process.platform
+
+function setPlatform(platform: NodeJS.Platform): void {
+  Object.defineProperty(process, 'platform', { value: platform, configurable: true })
+}
+
+function respond(stdout: string): void {
+  execFileMock.mockImplementation((_file, _args, _options, callback) => {
+    callback(null, stdout, '')
+    return { kill: vi.fn() }
+  })
+}
+
+function fail(error: unknown): void {
+  execFileMock.mockImplementation((_file, _args, _options, callback) => {
+    callback(error, '', '')
+    return { kill: vi.fn() }
+  })
+}
+
+beforeEach(() => {
+  execFileMock.mockReset()
+  setPlatform('darwin')
+})
+
+afterEach(() => {
+  setPlatform(originalPlatform)
+})
+
+describe('readKeychainPassword', () => {
+  it('returns the trimmed secret for a stored item', async () => {
+    respond('  secret-value\n')
+    await expect(readKeychainPassword('cursor-access-token', 'cursor-user')).resolves.toBe(
+      'secret-value'
+    )
+    expect(execFileMock.mock.calls[0]?.[1]).toEqual([
+      'find-generic-password',
+      '-s',
+      'cursor-access-token',
+      '-a',
+      'cursor-user',
+      '-w'
+    ])
+  })
+
+  it('returns null rather than throwing when the item does not exist', async () => {
+    fail(Object.assign(new Error('The specified item could not be found'), { code: 44 }))
+    await expect(readKeychainPassword('svc', 'acct')).resolves.toBeNull()
+  })
+
+  it('rethrows a denied or locked keychain so callers can report it', async () => {
+    fail(new Error('User interaction is not allowed'))
+    await expect(readKeychainPassword('svc', 'acct')).rejects.toThrow(
+      'User interaction is not allowed'
+    )
+  })
+
+  it('never shells out off macOS', async () => {
+    setPlatform('win32')
+    await expect(readKeychainPassword('svc', 'acct')).resolves.toBeNull()
+    await writeKeychainPassword('svc', 'acct', 'value')
+    await deleteKeychainPassword('svc', 'acct')
+    expect(execFileMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('deleteKeychainPassword', () => {
+  it('swallows a missing item', async () => {
+    fail(Object.assign(new Error('could not be found'), { code: 44 }))
+    await expect(deleteKeychainPassword('svc', 'acct')).resolves.toBeUndefined()
+  })
+
+  it('surfaces an access failure only when the caller asks for it', async () => {
+    fail(new Error('User interaction is not allowed'))
+    await expect(deleteKeychainPassword('svc', 'acct')).resolves.toBeUndefined()
+    await expect(
+      deleteKeychainPassword('svc', 'acct', { failOnAccessError: true })
+    ).rejects.toThrow('User interaction is not allowed')
+  })
+})
+
+describe('isKeychainNotFoundError', () => {
+  it('recognizes the security(1) not-found signals', () => {
+    expect(isKeychainNotFoundError({ code: 44 })).toBe(true)
+    expect(isKeychainNotFoundError(new Error('The specified item could not be found'))).toBe(true)
+    expect(isKeychainNotFoundError(new Error('User interaction is not allowed'))).toBe(false)
+  })
+})
diff --git a/src/main/macos-keychain/generic-password.ts b/src/main/macos-keychain/generic-password.ts
new file mode 100644
index 00000000000..8a805edd809
--- /dev/null
+++ b/src/main/macos-keychain/generic-password.ts
@@ -0,0 +1,147 @@
+// Why execFile and not runProcess: this is a relocation of the Claude keychain
+// reader's existing exception, kept byte-for-byte so Claude's credential path and
+// its tests are unchanged. See the child_process import allowlist.
+import { execFile } from 'node:child_process'
+
+const KEYCHAIN_COMMAND_TIMEOUT_MS = 3_000
+
+type SecurityCommandResult = {
+  stdout: string
+  stderr: string
+}
+
+export function isKeychainNotFoundError(error: unknown): boolean {
+  const code =
+    error && typeof error === 'object' && 'code' in error
+      ? (error as { code?: unknown }).code
+      : undefined
+  const message =
+    error && typeof error === 'object'
+      ? `${String((error as { stderr?: unknown }).stderr ?? '')} ${String(
+          (error as { message?: unknown }).message ?? ''
+        )}`.toLowerCase()
+      : String(error).toLowerCase()
+  return code === 44 || message.includes('could not be found') || message.includes('not be found')
+}
+
+export function execSecurityCommand(args: string[]): Promise<SecurityCommandResult> {
+  return new Promise((resolve, reject) => {
+    let settled = false
+    let child: ReturnType<typeof execFile> | undefined
+    const timer = setTimeout(() => {
+      if (settled) {
+        return
+      }
+      settled = true
+      child?.kill()
+      reject(
+        Object.assign(new Error(`security timed out after ${KEYCHAIN_COMMAND_TIMEOUT_MS}ms`), {
+          code: 'ETIMEDOUT',
+          stderr: ''
+        })
+      )
+    }, KEYCHAIN_COMMAND_TIMEOUT_MS)
+
+    const settle = (callback: () => void): void => {
+      if (settled) {
+        return
+      }
+      settled = true
+      clearTimeout(timer)
+      callback()
+    }
+
+    // Why: Node's execFile timeout only signals the `security` process; a
+    // stuck callback would otherwise leave auth/keychain operations pending.
+    try {
+      child = execFile(
+        'security',
+        args,
+        { timeout: KEYCHAIN_COMMAND_TIMEOUT_MS },
+        (error, stdout, stderr) => {
+          if (error) {
+            settle(() =>
+              reject(
+                Object.assign(error, {
+                  stdout: String(stdout),
+                  stderr: String(stderr)
+                })
+              )
+            )
+            return
+          }
+          settle(() => resolve({ stdout: String(stdout), stderr: String(stderr) }))
+        }
+      )
+    } catch (error) {
+      settle(() => reject(error))
+    }
+  })
+}
+
+export function execSecurity(
+  args: string[],
+  options?: { ignoreFailure?: boolean; ignoreNotFound?: boolean }
+): Promise<void> {
+  return execSecurityCommand(args).then(undefined, (error: unknown) => {
+    if (options?.ignoreNotFound && isKeychainNotFoundError(error)) {
+      return
+    }
+    if (!options?.ignoreFailure) {
+      throw error
+    }
+  })
+}
+
+export async function readKeychainPassword(
+  service: string,
+  account: string
+): Promise<string | null> {
+  if (process.platform !== 'darwin') {
+    return null
+  }
+  try {
+    const { stdout } = await execSecurityCommand([
+      'find-generic-password',
+      '-s',
+      service,
+      '-a',
+      account,
+      '-w'
+    ])
+    if (stdout.trim()) {
+      return stdout.trim()
+    }
+    throw new Error(`Could not read macOS Keychain item ${service}/${account}.`)
+  } catch (error) {
+    if (isKeychainNotFoundError(error)) {
+      return null
+    }
+    throw error
+  }
+}
+
+export async function writeKeychainPassword(
+  service: string,
+  account: string,
+  contents: string
+): Promise<void> {
+  if (process.platform !== 'darwin') {
+    return
+  }
+  await execSecurity(['add-generic-password', '-U', '-s', service, '-a', account, '-w', contents])
+}
+
+export async function deleteKeychainPassword(
+  service: string,
+  account: string,
+  options?: { failOnAccessError?: boolean }
+): Promise<void> {
+  if (process.platform !== 'darwin') {
+    return
+  }
+  await execSecurity(['delete-generic-password', '-s', service, '-a', account], {
+    ignoreNotFound: true,
+    ignoreFailure: !options?.failOnAccessError
+  })
+}
diff --git a/src/main/menu/register-app-menu.test.ts b/src/main/menu/register-app-menu.test.ts
index 08b5a489a9c..b5a12718058 100644
--- a/src/main/menu/register-app-menu.test.ts
+++ b/src/main/menu/register-app-menu.test.ts
@@ -72,6 +72,20 @@ function getSubmenu(
 }
 
 describe('registerAppMenu', () => {
+  it('shows the Settings hint when the user assigns a shortcut', () => {
+    registerAppMenu({
+      ...buildMenuOptions(),
+      getKeybindings: () => ({ 'app.settings': ['Mod+Comma'] })
+    })
+
+    const submenu = getSubmenu(getTemplate(), isMac ? 'Orca' : 'File')
+    expect(submenu).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ label: `Settings\t${isMac ? '⌘,' : 'Ctrl+,'}` })
+      ])
+    )
+  })
+
   it('toggles missing default-on appearance settings from visible to hidden', () => {
     expect(getNextDefaultOnAppearanceSettingValue(undefined)).toBe(false)
     expect(getNextDefaultOnAppearanceSettingValue(true)).toBe(false)
@@ -381,10 +395,8 @@ describe('registerAppMenu', () => {
 
     const fileLabels = getSubmenu(template, 'File').map((item) => item.label)
     expect(fileLabels).not.toContain(`Export as PDF...\t${isMac ? '⌘⇧E' : 'Ctrl+Shift+E'}`)
-    expect(fileLabels[0]).toBe(`Settings\t${isMac ? '⌘,' : 'Ctrl+,'}`)
-    expect(fileLabels).toEqual(
-      expect.arrayContaining([`Settings\t${isMac ? '⌘,' : 'Ctrl+,'}`, 'Exit'])
-    )
+    expect(fileLabels[0]).toBe('Settings')
+    expect(fileLabels).toEqual(expect.arrayContaining(['Settings', 'Exit']))
 
     const helpLabels = getSubmenu(template, 'Help').map((item) => item.label)
     expect(helpLabels).toEqual(
@@ -403,9 +415,7 @@ describe('registerAppMenu', () => {
     const template = getTemplate()
     const appSubmenu = getSubmenu(template, 'Orca')
     const appLabels = appSubmenu.map((item) => item.label)
-    expect(appLabels).toEqual(
-      expect.arrayContaining(['Check for Updates...', `Settings\t${isMac ? '⌘,' : 'Ctrl+,'}`])
-    )
+    expect(appLabels).toEqual(expect.arrayContaining(['Check for Updates...', 'Settings']))
     // Why: on macOS File should NOT duplicate Settings/Exit — those live in
     // the system app menu. Without global Export, there is no File item left.
     expect(template.find((item) => item.label === 'File')).toBeUndefined()
diff --git a/src/main/menu/register-app-menu.ts b/src/main/menu/register-app-menu.ts
index 2f77e7f8941..889e0cd0b08 100644
--- a/src/main/menu/register-app-menu.ts
+++ b/src/main/menu/register-app-menu.ts
@@ -113,8 +113,16 @@ function buildAndApplyMenu(options: RegisterAppMenuOptions): void {
     click: checkForUpdatesClick
   }
 
+  const settingsBindings = getEffectiveKeybindingsForAction(
+    'app.settings',
+    process.platform,
+    getKeybindings?.()
+  )
+  const settingsShortcut = settingsBindings.length
+    ? `\t${formatKeybindingList(settingsBindings, process.platform)}`
+    : ''
   const settingsItem: Electron.MenuItemConstructorOptions = {
-    label: `${translateMain('menu.settings', 'Settings')}\t${shortcutLabel('app.settings')}`,
+    label: `${translateMain('menu.settings', 'Settings')}${settingsShortcut}`,
     click: () => onOpenSettings()
   }
 
diff --git a/src/main/muse-usage/store-snapshot-filtering.test.ts b/src/main/muse-usage/store-snapshot-filtering.test.ts
new file mode 100644
index 00000000000..0db268083d9
--- /dev/null
+++ b/src/main/muse-usage/store-snapshot-filtering.test.ts
@@ -0,0 +1,106 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { MuseUsageStore } from './store'
+import { museUsageAggregation } from './scanner'
+import * as filters from '../usage/usage-scope-filters'
+import type { MuseUsageAttributedEvent } from './types'
+
+const fake = vi.hoisted(() => ({ directory: '' }))
+vi.mock('electron', () => ({ app: { getPath: () => fake.directory } }))
+vi.mock('../usage-cache-snapshot-writer', () => ({
+  UsageCacheSnapshotWriter: class {
+    flush = async () => {}
+    write = async () => {}
+  }
+}))
+
+class FixtureStore extends MuseUsageStore {
+  constructor(count: number) {
+    super({ getRepos: () => [], getAllWorktreeMeta: () => ({}) })
+    const events: MuseUsageAttributedEvent[] = Array.from({ length: count }, (_, index) => {
+      const day = ['2026-09-25', '2026-08-01', '2026-05-01'][index % 3]
+      const inside = index % 2 === 0
+      return {
+        sessionId: `session-${index}`,
+        timestamp: `${day}T12:00:00.000Z`,
+        day,
+        eventKey: String(index),
+        cwd: null,
+        model: index % 4 === 0 ? null : `model-${index % 3}`,
+        projectKey: `project-${index % 4}`,
+        projectLabel: `Project ${index % 4}`,
+        repoId: inside ? 'repo' : null,
+        worktreeId: inside ? `folder-${index % 4}` : null,
+        inputTokens: 100,
+        cachedInputTokens: 20,
+        outputTokens: 10,
+        reasoningOutputTokens: 2,
+        totalTokens: 110
+      }
+    })
+    const projection = museUsageAggregation.aggregate(events)
+    this.state = { ...this.state, ...projection }
+  }
+}
+
+beforeEach(() => {
+  fake.directory = mkdtempSync(join(tmpdir(), 'orca-muse-snapshot-'))
+  vi.useFakeTimers()
+  vi.setSystemTime(new Date(2026, 8, 26, 12))
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+  rmSync(fake.directory, { recursive: true, force: true })
+})
+
+it('filters each accumulated projection once per snapshot', () => {
+  const store = new FixtureStore(20_000)
+  const daily = vi.spyOn(filters, 'filterUsageDaily')
+  const sessions = vi.spyOn(filters, 'filterUsageSessions')
+  const result = store.getSnapshot('orca', '30d')
+  expect(result.summary.sessions).toBeGreaterThan(0)
+  expect(result.recentSessions).toHaveLength(10)
+  expect(sessions.mock.calls[0]?.[0]).toHaveLength(20_000)
+  expect({ daily: daily.mock.calls.length, sessions: sessions.mock.calls.length }).toEqual({
+    daily: 1,
+    sessions: 1
+  })
+})
+
+it.each(['orca', 'all'] as const)(
+  'keeps snapshot projections equal to individual %s reads',
+  async (scope) => {
+    const store = new FixtureStore(30)
+    for (const range of ['7d', '30d', '90d', 'all'] as const) {
+      for (const limit of [0, 1, 10]) {
+        const snapshot = store.getSnapshot(scope, range, limit)
+        expect(snapshot).toEqual({
+          scanState: store.getScanState(),
+          summary: await store.getSummary(scope, range),
+          daily: await store.getDaily(scope, range),
+          modelBreakdown: await store.getBreakdown(scope, range, 'model'),
+          projectBreakdown: await store.getBreakdown(scope, range, 'project'),
+          recentSessions: await store.getRecentSessions(scope, range, limit)
+        })
+      }
+    }
+  }
+)
+
+it('keeps empty snapshots and later calls independent', () => {
+  const store = new FixtureStore(0)
+  const first = store.getSnapshot('all', 'all')
+  const next = store.getSnapshot('orca', '7d', 0)
+  expect(first.daily).toEqual([])
+  expect(first.recentSessions).toEqual([])
+  expect(next.summary).toMatchObject({
+    sessions: 0,
+    events: 0,
+    totalTokens: 0,
+    scope: 'orca',
+    range: '7d'
+  })
+})
diff --git a/src/main/muse-usage/store.ts b/src/main/muse-usage/store.ts
index 95f13f3ec8c..b1b22996848 100644
--- a/src/main/muse-usage/store.ts
+++ b/src/main/muse-usage/store.ts
@@ -56,16 +56,15 @@ export class MuseUsageStore extends UsageProviderStoreLifecycle<
     range: MuseUsageRange,
     recentSessionLimit = 10
   ): MuseUsageSnapshot {
+    const daily = this.getFilteredDaily(scope, range)
+    const sessions = this.getFilteredSessions(scope, range)
     return {
       scanState: this.getScanState(),
-      summary: this.buildSummary(scope, range),
-      daily: buildMuseUsageDailyPoints(this.getFilteredDaily(scope, range)),
-      modelBreakdown: this.buildBreakdown(scope, range, 'model'),
-      projectBreakdown: this.buildBreakdown(scope, range, 'project'),
-      recentSessions: buildMuseUsageRecentSessions(
-        this.getFilteredSessions(scope, range),
-        recentSessionLimit
-      )
+      summary: buildMuseUsageSummary(scope, range, daily, sessions),
+      daily: buildMuseUsageDailyPoints(daily),
+      modelBreakdown: buildMuseUsageBreakdownRows('model', scope, daily, sessions),
+      projectBreakdown: buildMuseUsageBreakdownRows('project', scope, daily, sessions),
+      recentSessions: buildMuseUsageRecentSessions(sessions, recentSessionLimit)
     }
   }
 
diff --git a/src/main/muse/hook-settings.ts b/src/main/muse/hook-settings.ts
index 5b5fe3f63fd..0ef3d5d462b 100644
--- a/src/main/muse/hook-settings.ts
+++ b/src/main/muse/hook-settings.ts
@@ -4,11 +4,11 @@ import {
   buildManagedCommandHook,
   createManagedCommandMatcher,
   getSharedManagedScriptPath,
-  isPlainObject,
   wrapPosixHookCommand,
   wrapWindowsHookCommand,
   type HookDefinition
 } from '../agent-hooks/installer-utils'
+import { readManagedHookEventsFromJson } from '../agent-hooks/managed-hooks-json-events'
 
 const MUSE_SCRIPT_BASE = 'muse-hook'
 
@@ -87,45 +87,9 @@ export function readManagedMuseHookEvents(
   parsed: unknown,
   isManagedCommand: (command: string | undefined) => boolean
 ): Set<string> {
-  const present = new Set<string>()
-  if (!isPlainObject(parsed) || !isPlainObject(parsed.hooks)) {
-    return present
-  }
-  for (const event of MUSE_HOOK_EVENTS) {
-    const definitions = parsed.hooks[event]
-    if (!Array.isArray(definitions)) {
-      continue
-    }
-    // Why: a hand-edited managed file can hold null definitions, non-array
-    // hook lists, or null entries — treat all of them as absent so status
-    // calculation never throws on user content.
-    if (
-      definitions.some((definition) =>
-        managedHookEntries(definition).some((hook) => isManagedCommand(hookEntryCommand(hook)))
-      )
-    ) {
-      present.add(event)
-    }
-  }
-  return present
+  return readManagedHookEventsFromJson(parsed, MUSE_HOOK_EVENTS, isManagedCommand)
 }
 
 export function getMuseManagedCommandMatcher(): (command: string | undefined) => boolean {
   return createManagedCommandMatcher(getMuseManagedScriptFileName())
 }
-
-function managedHookEntries(definition: unknown): readonly unknown[] {
-  if (!isPlainObject(definition)) {
-    return []
-  }
-  const hooks = definition.hooks
-  return Array.isArray(hooks) ? hooks : []
-}
-
-function hookEntryCommand(hook: unknown): string | undefined {
-  if (!isPlainObject(hook)) {
-    return undefined
-  }
-  const command = hook.command
-  return typeof command === 'string' ? command : undefined
-}
diff --git a/src/main/native-chat/agent-model-catalog/agent-model-catalog-store.test.ts b/src/main/native-chat/agent-model-catalog/agent-model-catalog-store.test.ts
index 5f0b2f3bc7a..34e0294b458 100644
--- a/src/main/native-chat/agent-model-catalog/agent-model-catalog-store.test.ts
+++ b/src/main/native-chat/agent-model-catalog/agent-model-catalog-store.test.ts
@@ -153,6 +153,46 @@ describe('agent model catalog store', () => {
     expect(save).toHaveBeenCalledTimes(2)
   })
 
+  it("keeps a live child's default effort through a listing that names none, across a restart", async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'agent-model-catalog-'))
+    const store = new AgentModelCatalogStore()
+    await store.attachPersistence(createAgentModelCatalogFilePersistence(directory))
+    const efforts = [
+      { value: 'medium', label: 'Medium' },
+      { value: 'high', label: 'High' }
+    ]
+    const listing = (defaultEffort?: string): AgentModelCatalogSuccess => ({
+      models: [
+        {
+          id: 'opus',
+          label: 'Opus',
+          isDefault: true,
+          efforts,
+          ...(defaultEffort ? { defaultEffort } : {})
+        }
+      ],
+      fastModeTierByModel: new Map(),
+      origin: 'live-session'
+    })
+    store.recordSuccess('fp', 'claude', listing('medium'))
+    // A session-less probe never names Claude's default.
+    store.recordSuccess('fp', 'claude', { ...listing(), origin: 'probe' })
+    expect(store.get('fp')!.models[0]!.defaultEffort).toBe('medium')
+    await store.flushPersistence()
+    const restarted = new AgentModelCatalogStore()
+    await restarted.attachPersistence(createAgentModelCatalogFilePersistence(directory))
+    expect(restarted.get('fp')!.models[0]!.defaultEffort).toBe('medium')
+
+    // A newer report replaces it; a model that stops offering it drops it.
+    store.recordSuccess('fp', 'claude', listing('high'))
+    expect(store.get('fp')!.models[0]!.defaultEffort).toBe('high')
+    store.recordSuccess('fp', 'claude', {
+      ...listing(),
+      models: [{ id: 'opus', label: 'Opus', isDefault: true, efforts: [efforts[0]!] }]
+    })
+    expect(store.get('fp')!.models[0]).not.toHaveProperty('defaultEffort')
+  })
+
   it('persists successes only and hydrates them across a restart', async () => {
     const directory = mkdtempSync(join(tmpdir(), 'agent-model-catalog-'))
     const store = new AgentModelCatalogStore()
diff --git a/src/main/native-chat/agent-model-catalog/agent-model-catalog-store.ts b/src/main/native-chat/agent-model-catalog/agent-model-catalog-store.ts
index eb26d78de5f..dcb6e3935ac 100644
--- a/src/main/native-chat/agent-model-catalog/agent-model-catalog-store.ts
+++ b/src/main/native-chat/agent-model-catalog/agent-model-catalog-store.ts
@@ -53,6 +53,22 @@ function tierRecord(tiers: ReadonlyMap<string, string>): Record<string, string>
   return Object.fromEntries(tiers.entries())
 }
 
+/** A listing that names no default effort for a model keeps the one a live child reported for it,
+ *  while that model still offers it: Claude's listing never names one, only a running child does. */
+function withKnownDefaultEfforts(
+  models: readonly AgentSessionModelOption[],
+  previous: AgentModelCatalogEntry | undefined
+): AgentSessionModelOption[] {
+  return models.map((model) => {
+    const known = previous?.models.find((entry) => entry.id === model.id)?.defaultEffort
+    return model.defaultEffort === undefined &&
+      known !== undefined &&
+      model.efforts.some((choice) => choice.value === known)
+      ? { ...model, defaultEffort: known }
+      : { ...model }
+  })
+}
+
 function listingKey(entry: AgentModelCatalogEntry): string {
   return JSON.stringify([
     entry.origin,
@@ -135,16 +151,16 @@ export class AgentModelCatalogStore {
       // An empty list identifies no model; it is doubt, not a catalog.
       return null
     }
+    const previous = this.entries.get(fingerprint)
     const entry: AgentModelCatalogEntry = {
       agent,
       fingerprint,
-      models: success.models.map((model) => ({ ...model })),
+      models: withKnownDefaultEfforts(success.models, previous),
       ...(success.fastModeSupport ? { fastModeSupport: success.fastModeSupport } : {}),
       fastModeTierByModel: tierRecord(success.fastModeTierByModel),
       origin: success.origin,
       fetchedAt: this.now()
     }
-    const previous = this.entries.get(fingerprint)
     this.entries.delete(fingerprint)
     this.entries.set(fingerprint, entry)
     this.failures.delete(fingerprint)
diff --git a/src/main/native-chat/agent-session-journal/journal-corruption-repair.test.ts b/src/main/native-chat/agent-session-journal/journal-corruption-repair.test.ts
index 978f076d6e9..c44390b738e 100644
--- a/src/main/native-chat/agent-session-journal/journal-corruption-repair.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-corruption-repair.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // A repair drops what it cannot replay, and says so.
 //
 // Two things make a suffix unreplayable: a row this build cannot parse, and a
@@ -102,9 +103,18 @@ afterEach(async () => {
 describe('a malformed row', () => {
   it('keeps the readable prefix live and drops the rest of the epoch', async () => {
     const journal = await open()
-    await journal.appendItem(item(0), body('readable'), { fence: 1 })
-    await journal.appendItem(item(1), body('unreadable'), { fence: 1 })
-    await journal.appendItem(item(2), body('after the fault'), { fence: 1 })
+    await journal.appendItem(item(0), body('readable'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
+    await journal.appendItem(item(1), body('unreadable'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
+    await journal.appendItem(item(2), body('after the fault'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     await journal.close()
     await withJournalDatabase((db) => {
       db.prepare('UPDATE journal_rows SET row_json = ? WHERE seq = ?').run('{"not":"a row"}', 3)
@@ -118,8 +128,14 @@ describe('a malformed row', () => {
 
   it('discloses the line it could not read', async () => {
     const journal = await open()
-    await journal.appendItem(item(0), body('readable'), { fence: 1 })
-    await journal.appendItem(item(1), body('later'), { fence: 1 })
+    await journal.appendItem(item(0), body('readable'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
+    await journal.appendItem(item(1), body('later'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     await journal.close()
     await withJournalDatabase((db) => {
       db.prepare('UPDATE journal_rows SET row_json = ? WHERE seq = ?').run('}{', 2)
@@ -141,7 +157,10 @@ describe('a sequence gap', () => {
   it('drops every row after the hole and reports the epoch corrupt', async () => {
     const journal = await open()
     for (let ordinal = 0; ordinal < 5; ordinal += 1) {
-      await journal.appendItem(item(ordinal), body(`m${ordinal}`), { fence: 1 })
+      await journal.appendItem(item(ordinal), body(`m${ordinal}`), {
+        fence: 1,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
     }
     await journal.close()
     // Sequence 1 is the epoch row, so the items occupy 2..6. Removing 4 leaves
@@ -163,7 +182,10 @@ describe('a sequence gap', () => {
   it('still reports corrupt on the next probe, with the deleted suffix unrebuilt', async () => {
     const journal = await open()
     for (let ordinal = 0; ordinal < 5; ordinal += 1) {
-      await journal.appendItem(item(ordinal), body(`m${ordinal}`), { fence: 1 })
+      await journal.appendItem(item(ordinal), body(`m${ordinal}`), {
+        fence: 1,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
     }
     await journal.close()
     await withJournalDatabase((db) => {
@@ -177,7 +199,10 @@ describe('a sequence gap', () => {
     // Same policy the emptied-epoch repair takes: a session that writes into the
     // epoch owns it, and a later import must not replace rows the user has seen.
     const writable = await open()
-    await writable.appendItem(item(9), body('typed after the repair'), { fence: 1 })
+    await writable.appendItem(item(9), body('typed after the repair'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     await writable.close()
     expect(loadJournal(root, IDENTITY.sessionId)).toMatchObject({ corrupt: false })
   })
@@ -187,7 +212,10 @@ describe('a sequence gap', () => {
   it('is not settled by the repair disclosure it appends for a malformed row', async () => {
     const journal = await open()
     for (let ordinal = 0; ordinal < 3; ordinal += 1) {
-      await journal.appendItem(item(ordinal), body(`m${ordinal}`), { fence: 1 })
+      await journal.appendItem(item(ordinal), body(`m${ordinal}`), {
+        fence: 1,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
     }
     await journal.close()
     await withJournalDatabase((db) => {
@@ -207,7 +235,10 @@ describe('a missing epoch row', () => {
   // renders a repaired journal as a clean timeline.
   it('rejects the whole surviving range rather than declaring it contiguous', async () => {
     const journal = await open()
-    await journal.appendItem(item(0), body('anchor'), { fence: 1 })
+    await journal.appendItem(item(0), body('anchor'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     await journal.appendSubmission({
       clientMessageId: 'client-message-1',
       payloadFingerprint: 'fingerprint-1',
@@ -245,7 +276,10 @@ describe('a missing epoch row', () => {
   // consulted again and the dropped rows never come back.
   it('keeps asking for provider history until the epoch has content of its own', async () => {
     const journal = await open()
-    await journal.appendItem(item(0), body('anchor'), { fence: 1 })
+    await journal.appendItem(item(0), body('anchor'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     await journal.close()
     await withJournalDatabase((db) => {
       db.prepare('DELETE FROM journal_rows WHERE seq = ?').run(1)
@@ -258,7 +292,10 @@ describe('a missing epoch row', () => {
     // A session that writes into the epoch owns it: its own rows are not a
     // repair placeholder, and a later import must not replace them.
     const writable = await open()
-    await writable.appendItem(item(1), body('typed after the repair'), { fence: 1 })
+    await writable.appendItem(item(1), body('typed after the repair'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     await writable.close()
     expect(loadJournal(root, IDENTITY.sessionId)).toMatchObject({ corrupt: false })
   })
diff --git a/src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts b/src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts
index d142672f8e5..17fb2b1eb49 100644
--- a/src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // The crash boundary: the host wrote a submission row, dispatched, and died
 // before it learned whether the provider took the message. Replay must reconcile
 // without duplicating the user's message and without losing it.
@@ -16,7 +17,8 @@ import type {
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
 import { hasUnansweredStructuredAgentSessionDispatch } from '../../../shared/structured-agent-session-projection'
-import { dispatchWriteFailureReason } from '../../../shared/structured-agent-session-dispatch-rejection'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
 import { digestPayload } from './journal-payload-bounds'
 import {
   reconcileSubmissions,
@@ -137,7 +139,10 @@ describe('crash between provider accept and journal commit', () => {
     })
     // The provider's own copy of the message arrives next, under the identity
     // reconciliation adopted. It must land in the bubble the user already sees.
-    await restarted.appendItem(outcome.identity, userMessage('deploy the thing'), { fence: 2 })
+    await restarted.appendItem(outcome.identity, userMessage('deploy the thing'), {
+      fence: 2,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
 
     const items = restarted.snapshot().items
     expect(items).toHaveLength(1)
@@ -180,7 +185,7 @@ describe('crash between provider accept and journal commit', () => {
     await journal.resolveDispatch({
       clientMessageId: 'cm_write_failed',
       state: 'rejected',
-      reason: dispatchWriteFailureReason(new Error('broken pipe')),
+      ...agentSessionFailureWords(agentSessionFailureFact('writeFailed'), { surface: 'rejection' }),
       fence: 1
     })
 
@@ -191,7 +196,7 @@ describe('crash between provider accept and journal commit', () => {
     // so recovery must not reopen it as doubt.
     expect(restarted.submissions()[0]).toMatchObject({
       dispatchState: 'rejected',
-      reason: 'provider_write_failed: broken pipe'
+      reason: 'provider_write_failed'
     })
     expect(restarted.submissions()[0]?.recovered).toBeUndefined()
     expect(hasUnansweredStructuredAgentSessionDispatch(restarted.submissions())).toBe(false)
@@ -250,7 +255,9 @@ describe('crash between provider accept and journal commit', () => {
     await restarted.resolveDispatch({
       clientMessageId: 'cm_1',
       state: 'rejected',
-      reason: 'not_delivered',
+      ...agentSessionFailureWords(agentSessionFailureFact('notDelivered'), {
+        surface: 'rejection'
+      }),
       fence: 2,
       recovered: true
     })
diff --git a/src/main/native-chat/agent-session-journal/journal-database.ts b/src/main/native-chat/agent-session-journal/journal-database.ts
index 6f1cd60733b..e1c4da54a08 100644
--- a/src/main/native-chat/agent-session-journal/journal-database.ts
+++ b/src/main/native-chat/agent-session-journal/journal-database.ts
@@ -7,6 +7,7 @@
 import Database from '../../sqlite/sync-database'
 import { hardenSqliteDatabaseFiles } from '../../sqlite/harden-database-files'
 import { createJournalTablesSql, JOURNAL_DB_SCHEMA_VERSION } from './journal-database-schema'
+import { ensureQueuedMessagesTable } from './queued-message-schema'
 
 export const JOURNAL_BUSY_TIMEOUT_MS = 5000
 
@@ -37,6 +38,10 @@ export function openJournalDatabase(dbPath: string): OpenJournalDatabase {
   try {
     configureJournalPragmas(probe)
     createJournalSchema(probe, stored)
+    // Outside `createJournalSchema` on purpose: its early return skips a db
+    // already at the current version, and this table must exist at EVERY
+    // writable open with no `user_version` bump (see `ensureQueuedMessagesTable`).
+    ensureQueuedMessagesTable(probe)
     hardenSqliteDatabaseFiles(dbPath)
     const opened = { db: probe, readOnly: false }
     transferred = true
diff --git a/src/main/native-chat/agent-session-journal/journal-derived-turn-scope.ts b/src/main/native-chat/agent-session-journal/journal-derived-turn-scope.ts
new file mode 100644
index 00000000000..0fbadede3bc
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-derived-turn-scope.ts
@@ -0,0 +1,51 @@
+// The turn scope of a row written before rows stated one: the root turn that was open when the
+// row was created. Hosts now state a scope on every item they write, so this reads only legacy
+// rows, and rows an older host writes into a newer journal after a downgrade. It needs no
+// persisted state: the journal is replayed in full on every open, in creation order.
+//
+// A root turn record created running opens a span, which closes when a revision ends it or
+// removes its turn body — a legacy `/compact` row was created as a running turn carrier and then
+// overwritten with plain status. A turn record created already settled (rebuilt history) stays
+// open until the next root turn record: that is its position within the provider's history.
+// Rows created in the window between a crash and the stale-turn sweep land in the dead turn,
+// which is where their position puts them too.
+
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalItemBody,
+  type AgentJournalTurnScope
+} from '../../../shared/agent-session-journal-types'
+import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
+
+export class JournalDerivedTurnScope {
+  private openTurnItemId: string | null = null
+
+  /** The scope for a row being created now that states none. A turn record belongs to no turn. */
+  scopeFor(body: AgentJournalItemBody): AgentJournalTurnScope {
+    return this.openTurnItemId === null || readAgentJournalTurn(body)
+      ? AGENT_JOURNAL_THREAD_SCOPE
+      : { kind: 'turn', turnItemId: this.openTurnItemId }
+  }
+
+  /** Every change to an item, from any row, after it is applied. `before` is undefined when the
+   *  row created the item, `after` when it removed it. Only the session's own turns open a span. */
+  observe(
+    itemId: string,
+    root: boolean,
+    before: AgentJournalItemBody | undefined,
+    after: AgentJournalItemBody | undefined
+  ): void {
+    const turn = readAgentJournalTurn(after)
+    if (before === undefined && turn && root) {
+      this.openTurnItemId = itemId
+      return
+    }
+    if (
+      itemId === this.openTurnItemId &&
+      readAgentJournalTurn(before)?.state === 'running' &&
+      turn?.state !== 'running'
+    ) {
+      this.openTurnItemId = null
+    }
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-dispatch-reason-bound.test.ts b/src/main/native-chat/agent-session-journal/journal-dispatch-reason-bound.test.ts
index 70052865242..668232e607d 100644
--- a/src/main/native-chat/agent-session-journal/journal-dispatch-reason-bound.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-dispatch-reason-bound.test.ts
@@ -4,9 +4,9 @@ import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import type { AgentSessionJournalIdentity } from '../../../shared/agent-session-journal-types'
 import {
+  classifyDispatchRejection,
   DISPATCH_REJECTED_WRITE_FAILED,
-  dispatchRejectionReasonIsInternal,
-  dispatchRejectionWasTransportWriteFailure
+  isWriteFailureSubmission
 } from '../../../shared/structured-agent-session-dispatch-rejection'
 import { DEFAULT_JOURNAL_PAYLOAD_LIMITS } from './journal-payload-bounds'
 import type { openAgentSessionJournal } from './journal-store-factory'
@@ -45,7 +45,14 @@ async function settle(reason: string): Promise<string | null> {
     body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hi' }] },
     fence: 1
   })
-  await journal.resolveDispatch({ clientMessageId: 'msg-1', state: 'rejected', reason, fence: 1 })
+  await journal.resolveDispatch({
+    clientMessageId: 'msg-1',
+    // A rejection's reason comes only from `agentSessionFailureWords`; an unknown's is still free
+    // text (an adapter's error), so it is what reaches the bound.
+    state: 'unknown',
+    reason,
+    fence: 1
+  })
   return journal.snapshot().submissions[0]?.reason ?? null
 }
 
@@ -81,7 +88,8 @@ describe('dispatch reason bounding', () => {
   it('keeps a clipped transport failure classifiable', async () => {
     const stored = await settle(`${DISPATCH_REJECTED_WRITE_FAILED}: ${HUGE}`)
     expect(stored).not.toBe(`${DISPATCH_REJECTED_WRITE_FAILED}: ${HUGE}`)
-    expect(dispatchRejectionWasTransportWriteFailure(stored)).toBe(true)
-    expect(dispatchRejectionReasonIsInternal(stored)).toBe(true)
+    // Read as an older host wrote it: by the reason alone.
+    expect(isWriteFailureSubmission({ reason: stored })).toBe(true)
+    expect(classifyDispatchRejection({ reason: stored })).toMatchObject({ kind: 'writeFailed' })
   })
 })
diff --git a/src/main/native-chat/agent-session-journal/journal-dispatch-reducer.ts b/src/main/native-chat/agent-session-journal/journal-dispatch-reducer.ts
new file mode 100644
index 00000000000..89722959799
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-dispatch-reducer.ts
@@ -0,0 +1,73 @@
+// How a `dispatch` row settles its submission. Field by field, so a key the row gains must be
+// copied here to reach any reader.
+
+import {
+  readAgentSessionFailureFact,
+  type UnreadAgentSessionFailureFact
+} from '../../../shared/agent-session-failure'
+import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
+import { journalDispatchRowApplies } from './journal-dispatch-settlement'
+import type { JournalReducerState } from './journal-reducer'
+import { notePersonTurnAccepted, placeHandedOverMessage } from './journal-submission-fold'
+import type { JournalRow } from './journal-row-schema'
+
+export function applyJournalDispatchRow(
+  state: JournalReducerState,
+  row: Extract<JournalRow, { kind: 'dispatch' }>
+): void {
+  const submission = state.submissions.get(row.clientMessageId)
+  // Shared with the queued-draft returned hook: a row ignored here must not alter a draft.
+  if (!submission || !journalDispatchRowApplies(submission)) {
+    return
+  }
+  submission.fence = row.fence
+  submission.dispatchState = row.state
+  submission.providerItemId = row.providerItemId
+  submission.reason = row.reason
+  const rejection = row.state === 'rejected' ? readStoredRejectionFact(row.rejection) : undefined
+  if (rejection) {
+    submission.rejection = rejection
+  } else {
+    delete submission.rejection
+  }
+  submission.resolvedAt = row.state === 'pending' ? null : row.ts
+  if (row.state === 'pending') {
+    submission.handedOverAt = row.ts
+    placeHandedOverMessage(state, submission, row)
+  }
+  if (row.recovered) {
+    submission.recovered = row.recovered
+  } else {
+    delete submission.recovered
+  }
+  if (row.state === 'accepted') {
+    notePersonTurnAccepted(state, submission)
+  }
+  if (row.state !== 'accepted' || !row.providerItemId) {
+    return
+  }
+  state.aliases.set(row.providerItemId, agentJournalSubmissionKey(row.clientMessageId))
+  state.receipts.set(row.clientMessageId, {
+    clientMessageId: row.clientMessageId,
+    providerItemId: row.providerItemId,
+    cursor: { epoch: row.epoch, sequence: row.seq },
+    acceptedAt: row.ts
+  })
+}
+
+/** A stored rejection fact, read where it can be placed; a kind it cannot place is kept as
+ *  written, so the classifier still knows a fact was there without this build claiming what it
+ *  says. Shared with the queued-draft table, whose returned card mirrors its submission. */
+export function readStoredRejectionFact(value: unknown): UnreadAgentSessionFailureFact | undefined {
+  return readAgentSessionFailureFact(value) ?? unreadFailureFact(value)
+}
+
+function unreadFailureFact(value: unknown): UnreadAgentSessionFailureFact | undefined {
+  return typeof value === 'object' &&
+    value !== null &&
+    'kind' in value &&
+    typeof value.kind === 'string' &&
+    value.kind
+    ? { kind: value.kind }
+    : undefined
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-dispatch-settlement.test.ts b/src/main/native-chat/agent-session-journal/journal-dispatch-settlement.test.ts
new file mode 100644
index 00000000000..7f9711151fc
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-dispatch-settlement.test.ts
@@ -0,0 +1,51 @@
+import { describe, expect, it } from 'vitest'
+import {
+  agentSessionFailureFact,
+  type SubmissionRejectionKind
+} from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
+import {
+  DISPATCH_REJECTED_CANCELLED,
+  DISPATCH_REJECTED_HOST_RESTARTED
+} from '../../../shared/structured-agent-session-dispatch-rejection'
+import { rejectedDraftSettlement } from './journal-dispatch-settlement'
+
+function settle(kind: SubmissionRejectionKind) {
+  return rejectedDraftSettlement(
+    agentSessionFailureWords(agentSessionFailureFact(kind), { surface: 'rejection' })
+  )
+}
+
+describe('what a rejection does to the draft it was consumed from', () => {
+  it("a Stop's withdrawal sends it back to waiting, under the queue's pause rather than a hold of its own", () => {
+    expect(settle('cancelled')).toEqual({ state: 'waiting' })
+    expect(rejectedDraftSettlement({ reason: DISPATCH_REJECTED_CANCELLED })).toEqual({
+      state: 'waiting'
+    })
+  })
+
+  it('a restart or close before hand-over sends it back to waiting too', () => {
+    for (const kind of ['hostRestarted', 'chatClosed', 'notDelivered'] as const) {
+      expect(settle(kind)).toEqual({ state: 'waiting' })
+    }
+    expect(rejectedDraftSettlement({ reason: DISPATCH_REJECTED_HOST_RESTARTED })).toEqual({
+      state: 'waiting'
+    })
+  })
+
+  it('a failure returns the card for the user to act on', () => {
+    for (const kind of [
+      'providerRejected',
+      'providerExited',
+      'hostStopped',
+      'startFailed',
+      'writeFailed',
+      'queueFull'
+    ] as const) {
+      expect(settle(kind)).toEqual({ state: 'returned' })
+    }
+    expect(rejectedDraftSettlement({ reason: 'the provider said no' })).toEqual({
+      state: 'returned'
+    })
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-dispatch-settlement.ts b/src/main/native-chat/agent-session-journal/journal-dispatch-settlement.ts
new file mode 100644
index 00000000000..7e1d6949bf3
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-dispatch-settlement.ts
@@ -0,0 +1,58 @@
+// The one decision for whether a committed dispatch row changes a submission's
+// effective delivery answer, and what a rejection does to the draft it was
+// consumed from. The reducer folds rows through the first and the queued
+// draft's settlement hook fires through it, so the two can never disagree: a
+// row the reducer ignores must not alter a draft.
+
+import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
+import { classifyDispatchRejection } from '../../../shared/structured-agent-session-dispatch-rejection'
+import type { JournalDispatchRow } from './journal-row-schema'
+
+/** `rejected` and `accepted` are terminal; a late row for an absent or settled
+ *  submission must not reopen the answer. */
+export function journalDispatchRowApplies(
+  submission: Pick<AgentJournalSubmission, 'dispatchState'> | undefined
+): boolean {
+  return (
+    submission !== undefined &&
+    submission.dispatchState !== 'rejected' &&
+    submission.dispatchState !== 'accepted'
+  )
+}
+
+/** A consumed draft's submission settled `rejected`: the draft is settled by
+ *  `rejectedDraftSettlement`, since its text has no other holder once it left
+ *  the sender's outbox as a draft. */
+export function consumedSubmissionWasRejected(
+  submission: Pick<AgentJournalSubmission, 'dispatchState'> | undefined
+): boolean {
+  return submission?.dispatchState === 'rejected'
+}
+
+/** What a consumed draft becomes when its submission is rejected. */
+export type RejectedDraftSettlement = { state: 'returned' } | { state: 'waiting' }
+
+/**
+ * Where no one failed the user — a Stop withdrew it, or a restart or close
+ * interrupted it before hand-over — the draft goes back to waiting at its own
+ * position, under whatever pauses the queue: the Stop's own pause, or the
+ * restart's, derived from the host instance. A returned card would block the
+ * drafts behind it on a failure that never happened. A failure returns the
+ * card with its refusal for the user to act on.
+ */
+export function rejectedDraftSettlement(
+  rejection: Pick<AgentJournalSubmission, 'reason'> & { rejection?: unknown }
+): RejectedDraftSettlement {
+  return classifyDispatchRejection(rejection).verdict === null
+    ? { state: 'waiting' }
+    : { state: 'returned' }
+}
+
+/** True when committing this row NEWLY settles the submission to `rejected` —
+ *  the only transition that settles a consumed draft. */
+export function journalDispatchRowNewlyRejects(
+  submission: Pick<AgentJournalSubmission, 'dispatchState'> | undefined,
+  row: Pick<JournalDispatchRow, 'state'>
+): boolean {
+  return row.state === 'rejected' && journalDispatchRowApplies(submission)
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-epoch-replacement.test.ts b/src/main/native-chat/agent-session-journal/journal-epoch-replacement.test.ts
index 96273366d5f..7d87399c62b 100644
--- a/src/main/native-chat/agent-session-journal/journal-epoch-replacement.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-epoch-replacement.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // Republishing an epoch is ONE transaction.
 
 import { mkdtemp, rm } from 'node:fs/promises'
@@ -86,8 +87,16 @@ describe('journal epoch replacement', () => {
 
   it('discards every superseded row in the same transaction', async () => {
     const journal = await journals.open({ identity: IDENTITY, journalDir: root })
-    await journal.appendItem(item(1), { kind: 'status', text: 'old' }, { fence: 1 })
-    await journal.appendItem(item(2), { kind: 'status', text: 'older' }, { fence: 1 })
+    await journal.appendItem(
+      item(1),
+      { kind: 'status', text: 'old' },
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
+    await journal.appendItem(
+      item(2),
+      { kind: 'status', text: 'older' },
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
     const before = journal.epoch
 
     await journal.replaceEpochItems('legacy_import', 1, [
diff --git a/src/main/native-chat/agent-session-journal/journal-epoch-replacement.ts b/src/main/native-chat/agent-session-journal/journal-epoch-replacement.ts
index 9512d5e9fa1..cc9a2adc1bd 100644
--- a/src/main/native-chat/agent-session-journal/journal-epoch-replacement.ts
+++ b/src/main/native-chat/agent-session-journal/journal-epoch-replacement.ts
@@ -7,6 +7,8 @@
 import type {
   AgentJournalItemBody,
   AgentJournalItemIdentity,
+  AgentJournalProducerLinkage,
+  AgentJournalTurnScope,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
 import type Database from '../../sqlite/sync-database'
@@ -22,10 +24,13 @@ import {
 import type { AgentJournalEpochReason, JournalRow } from './journal-row-schema'
 import { assertJournalFence } from './journal-write-guards'
 
-export type JournalReplacementItem = {
+export type JournalReplacementItem = AgentJournalProducerLinkage & {
   identity: AgentJournalItemIdentity
   body: AgentJournalItemBody
   observedAt?: number
+  /** Absent for history rebuilt from a source that never stated one: derived from position, as
+   *  a legacy row's is, and then written down. */
+  turnScope?: AgentJournalTurnScope
 }
 
 export function replaceJournalEpoch(input: {
@@ -56,7 +61,9 @@ export function replaceJournalEpoch(input: {
       body: item.body,
       seq: state.lastSequence + 1,
       fence: input.fence,
-      ts: item.observedAt ?? input.now()
+      ts: item.observedAt ?? input.now(),
+      linkage: item,
+      turnScope: item.turnScope ?? state.derivedTurnScope.scopeFor(item.body)
     })
     assertJournalFence(row.fence, state.highestFence)
     applyJournalRow(state, row)
diff --git a/src/main/native-chat/agent-session-journal/journal-file-format-remnant.test.ts b/src/main/native-chat/agent-session-journal/journal-file-format-remnant.test.ts
index d6424ce7952..34fed89be53 100644
--- a/src/main/native-chat/agent-session-journal/journal-file-format-remnant.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-file-format-remnant.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // An empty chat beside a pre-SQLite journal explains itself.
 //
 // The SQLite move shipped no importer, so a session whose history is a
@@ -142,7 +143,7 @@ describe('a chat whose history is still in the pre-SQLite format', () => {
     await journal.appendItem(
       { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal: 0 },
       { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'history' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await journal.close()
     // Deleting the anchor leaves every row unanchored: replay keeps nothing, so
diff --git a/src/main/native-chat/agent-session-journal/journal-handle-ownership.test.ts b/src/main/native-chat/agent-session-journal/journal-handle-ownership.test.ts
index 592f7471c5c..7a69de557a4 100644
--- a/src/main/native-chat/agent-session-journal/journal-handle-ownership.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-handle-ownership.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // Every path that can open a SQLite connection releases it.
 //
 // Asserting that the happy path closes cleanly proves nothing: these sites are
@@ -73,7 +74,11 @@ afterEach(async () => {
 describe('the standalone probe owns its own connection', () => {
   it('leaves no handle behind after fifty repeated loads', async () => {
     const journal = await journals.open({ identity: IDENTITY, journalDir: root })
-    await journal.appendItem(item(1), { kind: 'message', role: 'user', blocks: [] }, { fence: 1 })
+    await journal.appendItem(
+      item(1),
+      { kind: 'message', role: 'user', blocks: [] },
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
     await journal.close()
 
     for (let attempt = 0; attempt < 50; attempt += 1) {
@@ -141,7 +146,10 @@ describe('failure paths inside the open call', () => {
   // connection exists, which is what lets the factory need no `finally`.
   it('leaves nothing open when a post-connection step of open() throws', async () => {
     const journal = await journals.open({ identity: IDENTITY, journalDir: root })
-    await journal.appendItem(item(1), runningTool(), { fence: 1 })
+    await journal.appendItem(item(1), runningTool(), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     await journal.close()
 
     // Replay runs after the connection is open, so a read it cannot serve
diff --git a/src/main/native-chat/agent-session-journal/journal-item-fold.ts b/src/main/native-chat/agent-session-journal/journal-item-fold.ts
new file mode 100644
index 00000000000..10aee4a99c4
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-item-fold.ts
@@ -0,0 +1,97 @@
+// Folding one item write into the render model: the revision, tombstone and creating-write rules
+// the reducer header states. Turn scope is the creating write's too, with one exception, which the
+// submission fold owns: a queued message's scope and position are its handover's.
+
+import type {
+  AgentJournalItemBody,
+  AgentJournalRenderItem,
+  AgentJournalTurnScope
+} from '../../../shared/agent-session-journal-types'
+import { parseAgentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
+import {
+  agentJournalLinkageFields,
+  isRootAgentJournalItem,
+  namesAgentJournalProducer
+} from '../../../shared/agent-session-journal-producer'
+import type { JournalReducerState } from './journal-reducer'
+
+export function statedOrDerivedTurnScope(
+  state: JournalReducerState,
+  write: { body: AgentJournalItemBody; turnScope?: AgentJournalTurnScope }
+): AgentJournalTurnScope {
+  return write.turnScope ?? state.derivedTurnScope.scopeFor(write.body)
+}
+
+export function upsertJournalItem(
+  state: JournalReducerState,
+  itemId: string,
+  revision: number,
+  next: AgentJournalRenderItem,
+  /** The creating write's fence: the generation a running turn belongs to. */
+  fence: number
+): void {
+  const tombstoned = state.tombstones.get(itemId)
+  if (tombstoned !== undefined && revision <= tombstoned) {
+    return
+  }
+  const existing = state.items.get(itemId)
+  if (existing && revision <= existing.revision) {
+    return
+  }
+  state.derivedTurnScope.observe(itemId, isRootAgentJournalItem(next), existing?.body, next.body)
+  if (!existing) {
+    state.items.set(itemId, next)
+    state.itemFences.set(itemId, fence)
+    state.tombstones.delete(itemId)
+    return
+  }
+  // Creation sequence is the ordering key; a revision refreshes content only.
+  // `observedAt` is pinned with it: clients sort the timeline by that timestamp,
+  // so letting a revision advance it makes the row jump past everything that
+  // landed in between — the provider's own echo of a send revises the submission
+  // row, which relocated the user's bubble below later rows.
+  const submitted =
+    existing.body.kind === 'message' &&
+    existing.body.role === 'user' &&
+    parseAgentJournalItemKey(itemId)?.provider === 'orca'
+  const { sequenceIndex: _revisedAt, ...revised } = next
+  state.items.set(itemId, {
+    ...revised,
+    // Settlements, prompt answers and reopen sweeps revise rows any agent wrote
+    // without naming one; each would otherwise hand a subagent's row to the session.
+    ...(namesAgentJournalProducer(next) ? {} : agentJournalLinkageFields(existing)),
+    // Provider history may normalize text or omit local attachments from the original send.
+    body: submitted ? existing.body : next.body,
+    sequence: existing.sequence,
+    ...(existing.sequenceIndex !== undefined ? { sequenceIndex: existing.sequenceIndex } : {}),
+    observedAt: existing.observedAt,
+    turnScope: existing.turnScope ?? next.turnScope
+  })
+  state.tombstones.delete(itemId)
+}
+
+export function removeJournalItem(
+  state: JournalReducerState,
+  itemId: string,
+  revision: number
+): void {
+  const existing = state.items.get(itemId)
+  if (existing && revision <= existing.revision) {
+    return
+  }
+  const tombstoned = state.tombstones.get(itemId)
+  if (tombstoned !== undefined && revision <= tombstoned) {
+    return
+  }
+  if (existing) {
+    state.derivedTurnScope.observe(
+      itemId,
+      isRootAgentJournalItem(existing),
+      existing.body,
+      undefined
+    )
+  }
+  state.tombstones.set(itemId, revision)
+  state.items.delete(itemId)
+  state.itemFences.delete(itemId)
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-legacy-import.test.ts b/src/main/native-chat/agent-session-journal/journal-legacy-import.test.ts
index 92b085e2e0f..7751265b72e 100644
--- a/src/main/native-chat/agent-session-journal/journal-legacy-import.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-legacy-import.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // Legacy import runs the existing per-agent transcript decoders and keys the
 // results by identity read off the same raw lines. Fixtures are shaped like the
 // files the providers actually write.
@@ -567,7 +568,7 @@ describe('import failures', () => {
     await journal.appendItem(
       { provider: 'codex', threadId: CODEX_SESSION, turnId: 'turn-1', ordinal: 1 },
       { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'kept' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     const before = journal.epoch
     const metadataOnly = await writeFixture('metadata-only.jsonl', [
diff --git a/src/main/native-chat/agent-session-journal/journal-open-failure.test.ts b/src/main/native-chat/agent-session-journal/journal-open-failure.test.ts
new file mode 100644
index 00000000000..a5427f76fdc
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-open-failure.test.ts
@@ -0,0 +1,159 @@
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { agentSessionRefusalError } from '../../../shared/agent-session-wire-refusals'
+import { openJournalDatabase } from './journal-database'
+import {
+  classifyJournalOpenFailure,
+  createJournalOpenReadRefusals,
+  journalOpenReadRefusal
+} from './journal-open-failure'
+import { loadJournal } from './journal-open'
+import { journalDatabaseFile } from './journal-paths'
+
+let root: string
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-journal-open-failure-'))
+})
+
+afterEach(async () => {
+  await rm(root, { recursive: true, force: true })
+})
+
+/** What the journal's own open throws for the file as it stands. */
+function openFailure(): unknown {
+  try {
+    loadJournal(root, 'session-1')
+  } catch (error) {
+    return error
+  }
+  throw new Error('the journal opened')
+}
+
+/** A thrown value shaped as node:sqlite shapes one, with the result code it reports. */
+function nodeSqliteError(errcode: number): Error {
+  return Object.assign(new Error('sqlite'), { code: 'ERR_SQLITE_ERROR', errcode })
+}
+
+function systemError(code: string, errno: number): Error {
+  return Object.assign(new Error(`${code}: open`), { code, errno })
+}
+
+describe('classifyJournalOpenFailure', () => {
+  it('calls a journal that is not a database corrupt', async () => {
+    await writeFile(journalDatabaseFile(root), 'not a database '.repeat(64))
+    const error = openFailure()
+    expect(error).toMatchObject({ errcode: 26 })
+    expect(classifyJournalOpenFailure(error)).toBe('journalCorrupt')
+  })
+
+  it('calls a journal whose pages are damaged corrupt', async () => {
+    const path = journalDatabaseFile(root)
+    const opened = openJournalDatabase(path)
+    opened.db.exec('PRAGMA journal_mode = DELETE')
+    opened.db.close()
+    const bytes = await readFile(path)
+    // Page 1 holds the header and schema; every table's root page follows it.
+    bytes.fill(0xab, 4096)
+    await writeFile(path, bytes)
+    const error = openFailure()
+    expect(error).toMatchObject({ errcode: 11 })
+    expect(classifyJournalOpenFailure(error)).toBe('journalCorrupt')
+  })
+
+  it.each([
+    ['SQLITE_CORRUPT_VTAB', 267],
+    ['SQLITE_CORRUPT_SEQUENCE', 523],
+    ['SQLITE_CORRUPT_INDEX', 779]
+  ])('reads an extended corrupt code as corrupt: %s', (_name, errcode) => {
+    expect(classifyJournalOpenFailure(nodeSqliteError(errcode))).toBe('journalCorrupt')
+  })
+
+  it("reads the Bun driver's corrupt code as corrupt", () => {
+    const error = Object.assign(new Error('file is not a database'), {
+      name: 'SQLiteError',
+      code: 'SQLITE_NOTADB',
+      errno: 26
+    })
+    expect(classifyJournalOpenFailure(error)).toBe('journalCorrupt')
+  })
+
+  it('finds corruption a wrapper names as its cause', () => {
+    const wrapped = new Error('opening the conversation failed', {
+      cause: new Error('the journal would not open', { cause: nodeSqliteError(11) })
+    })
+    expect(classifyJournalOpenFailure(wrapped)).toBe('journalCorrupt')
+  })
+
+  it.each([
+    ['a busy database', nodeSqliteError(5)],
+    ['a locked database', nodeSqliteError(6)],
+    ['a database SQLite cannot open', nodeSqliteError(14)],
+    ['a disk I/O error', nodeSqliteError(10)],
+    ['permission denied', systemError('EACCES', -13)],
+    ['too many open files', systemError('EMFILE', -24)],
+    ['a Windows error whose low byte reads as corrupt', systemError('EUNKNOWN', -4085)],
+    ['an error that only claims a corrupt code', Object.assign(new Error('x'), { errcode: 11 })],
+    ['a thrown string', 'database disk image is malformed'],
+    ['nothing at all', undefined]
+  ])('calls any other failure one that can clear: %s', (_label, error) => {
+    expect(classifyJournalOpenFailure(error)).toBe('journalUnavailable')
+  })
+
+  it('stops on a cause chain that loops back on itself', () => {
+    const first = new Error('first')
+    const second = new Error('second', { cause: first })
+    Object.assign(first, { cause: second })
+    expect(classifyJournalOpenFailure(first)).toBe('journalUnavailable')
+  })
+})
+
+describe('journalOpenReadRefusal', () => {
+  it('names the reason, keeps the message the code and the storage text only as the cause', () => {
+    vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    const storage = nodeSqliteError(26)
+    const refusal = journalOpenReadRefusal(storage)
+    expect(refusal.message).toBe('agent_session_journal_unreadable')
+    expect(refusal.refusal).toMatchObject({
+      code: 'agent_session_journal_unreadable',
+      details: { reason: 'journalCorrupt' }
+    })
+    expect(refusal.cause).toBe(storage)
+    vi.restoreAllMocks()
+  })
+
+  it('passes a refusal the open already raised through unchanged', () => {
+    const raised = agentSessionRefusalError('agent_session_identity_required', {
+      reason: 'recordMissing'
+    })
+    expect(journalOpenReadRefusal(raised)).toBe(raised)
+  })
+})
+
+describe('createJournalOpenReadRefusals', () => {
+  it('logs a session once per failure until it opens, and each session on its own', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    const refusals = createJournalOpenReadRefusals()
+    const denied = systemError('EACCES', -13)
+    const corrupt = nodeSqliteError(26)
+
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+      const refusal = refusals.refusal('session-1', denied)
+      expect(refusal.refusal).toMatchObject({ details: { reason: 'journalUnavailable' } })
+      expect(refusal.cause).toBe(denied)
+    }
+    expect(warn).toHaveBeenCalledTimes(1)
+    refusals.refusal('session-2', denied)
+    expect(warn).toHaveBeenCalledTimes(2)
+    expect(refusals.refusal('session-1', corrupt).refusal).toMatchObject({
+      details: { reason: 'journalCorrupt' }
+    })
+    expect(warn).toHaveBeenCalledTimes(3)
+    refusals.forget('session-1')
+    refusals.refusal('session-1', corrupt)
+    expect(warn).toHaveBeenCalledTimes(4)
+    vi.restoreAllMocks()
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-open-failure.ts b/src/main/native-chat/agent-session-journal/journal-open-failure.ts
new file mode 100644
index 00000000000..5e4cff1f3ee
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-open-failure.ts
@@ -0,0 +1,80 @@
+// What a failed journal open means for the chat: its history is damaged, which no retry reads
+// past, or the open failed in a way that can clear (a lock, permissions, too many open files).
+
+import type { AgentSessionRefusalReason } from '../../../shared/agent-session-refusal-details'
+import {
+  AgentSessionRefusalError,
+  isAgentSessionRefusalError,
+  refuse
+} from '../../../shared/agent-session-wire-refusals'
+import { isSqliteCorruption } from '../../sqlite/sqlite-read-failure'
+
+export type JournalOpenFailure = AgentSessionRefusalReason<'agent_session_journal_unreadable'>
+
+// Bounds a cause chain that loops back on itself.
+const MAX_CAUSE_DEPTH = 8
+
+/** Damage only where the storage says so; anything unproven can clear. */
+export function classifyJournalOpenFailure(error: unknown): JournalOpenFailure {
+  let current = error
+  for (let depth = 0; depth < MAX_CAUSE_DEPTH && current !== undefined; depth += 1) {
+    if (isSqliteCorruption(current)) {
+      return 'journalCorrupt'
+    }
+    current = current instanceof Error ? current.cause : undefined
+  }
+  return 'journalUnavailable'
+}
+
+/**
+ * What a read throws when the conversation it reaches cannot be opened. The storage's own text
+ * (a path, "file is not a database") goes to the log only; the reader gets the classified refusal,
+ * whose message stays the bare code.
+ */
+export function journalOpenReadRefusal(error: unknown): AgentSessionRefusalError {
+  if (isAgentSessionRefusalError(error)) {
+    return error
+  }
+  return unreadableRefusal(error, classifyJournalOpenFailure(error), true)
+}
+
+const MAX_LOGGED_SESSIONS = 256
+
+/**
+ * The read door's refusals for one host. A reader reconnects on a timer while an open can clear,
+ * so a session's failure is logged once until that session opens or the failure changes.
+ */
+export function createJournalOpenReadRefusals() {
+  const logged = new Map<string, string>()
+  return {
+    refusal: (sessionId: string, error: unknown): AgentSessionRefusalError => {
+      if (isAgentSessionRefusalError(error)) {
+        return error
+      }
+      const reason = classifyJournalOpenFailure(error)
+      const failure = `${reason}:${error instanceof Error ? error.message : String(error)}`
+      const repeat = logged.get(sessionId) === failure
+      // Past the cap a new session logs every failure rather than evict another's.
+      if (!repeat && (logged.has(sessionId) || logged.size < MAX_LOGGED_SESSIONS)) {
+        logged.set(sessionId, failure)
+      }
+      return unreadableRefusal(error, reason, !repeat)
+    },
+    /** The session opened or closed: its next failure is news. */
+    forget: (sessionId: string): void => {
+      logged.delete(sessionId)
+    }
+  }
+}
+
+function unreadableRefusal(
+  error: unknown,
+  reason: JournalOpenFailure,
+  log: boolean
+): AgentSessionRefusalError {
+  if (log) {
+    console.warn('[agent-session] opening the conversation for a read failed:', error)
+  }
+  const code = 'agent_session_journal_unreadable'
+  return new AgentSessionRefusalError(refuse(code, { reason }, code), { cause: error })
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-pending-submission-recovery.ts b/src/main/native-chat/agent-session-journal/journal-pending-submission-recovery.ts
index c4138ba2241..c252a57d8a5 100644
--- a/src/main/native-chat/agent-session-journal/journal-pending-submission-recovery.ts
+++ b/src/main/native-chat/agent-session-journal/journal-pending-submission-recovery.ts
@@ -1,8 +1,12 @@
+import type { AgentJournalDispatchRejection } from '../../../shared/agent-session-failure-words'
+import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
 import { DISPATCH_DOUBT_HOST_RESTARTED } from './journal-dispatch-doubt-reasons'
 import type { AgentSessionJournal } from './journal-store'
 
 /** Settles every submission a process fact left unanswerable. Doubt is never
- *  proof of non-delivery, so nothing here ever becomes re-deliverable. */
+ *  proof of non-delivery, so nothing here ever becomes re-deliverable. A queued
+ *  submission was never handed over, so it is not in doubt and is left alone. */
 export async function markJournalPendingSubmissionsUnknown(
   journal: AgentSessionJournal,
   fence: number,
@@ -12,8 +16,9 @@ export async function markJournalPendingSubmissionsUnknown(
     .submissions()
     .filter(
       (entry) =>
-        entry.dispatchState === 'pending' ||
-        (entry.dispatchState === 'unknown' && entry.recovered !== true)
+        !isQueuedAgentJournalSubmission(entry) &&
+        (entry.dispatchState === 'pending' ||
+          (entry.dispatchState === 'unknown' && entry.recovered !== true))
     )
   for (const entry of unresolved) {
     // An earlier reason already names a sharper fact than "the host restarted".
@@ -31,27 +36,51 @@ export async function markJournalPendingSubmissionsUnknown(
 }
 
 /** Settles every submission a child that never proved its start left unanswered as `rejected`:
- *  such a child accepted nothing, so each is provably unwritten and safe to send again. */
+ *  such a child accepted nothing, so each is provably unwritten and safe to send again. A queued
+ *  submission was never handed to that child; the delivery loop settles it. */
 export async function rejectJournalPendingSubmissions(
   journal: AgentSessionJournal,
   fence: number,
-  reason: string
+  rejection: AgentJournalDispatchRejection
 ): Promise<string[]> {
   const unwritten = journal
     .submissions()
     .filter(
       (entry) =>
-        entry.dispatchState === 'pending' ||
-        (entry.dispatchState === 'unknown' && entry.recovered !== true)
+        !isQueuedAgentJournalSubmission(entry) &&
+        (entry.dispatchState === 'pending' ||
+          (entry.dispatchState === 'unknown' && entry.recovered !== true))
     )
   for (const entry of unwritten) {
     await journal.resolveDispatch({
       clientMessageId: entry.clientMessageId,
       state: 'rejected',
-      reason,
+      ...rejection,
       fence,
       recovered: true
     })
   }
   return unwritten.map((entry) => entry.clientMessageId)
 }
+
+/** Rejects queued submissions — accepted, never handed over, so provably unwritten. */
+export async function rejectJournalQueuedSubmissions(
+  journal: AgentSessionJournal,
+  fence: number,
+  rejection: AgentJournalDispatchRejection,
+  which: (submission: AgentJournalSubmission) => boolean = () => true
+): Promise<string[]> {
+  const queued = journal
+    .submissions()
+    .filter((entry) => isQueuedAgentJournalSubmission(entry) && which(entry))
+  for (const entry of queued) {
+    await journal.resolveDispatch({
+      clientMessageId: entry.clientMessageId,
+      state: 'rejected',
+      ...rejection,
+      fence,
+      recovered: true
+    })
+  }
+  return queued.map((entry) => entry.clientMessageId)
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-producer-inheritance.test.ts b/src/main/native-chat/agent-session-journal/journal-producer-inheritance.test.ts
index 07ae011b790..d31d2569c18 100644
--- a/src/main/native-chat/agent-session-journal/journal-producer-inheritance.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-producer-inheritance.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -79,7 +80,8 @@ function seeded() {
         seq,
         fence: 1,
         ts: 1_000 + seq,
-        ...(stamp ? { linkage: stamp } : {})
+        ...(stamp ? { linkage: stamp } : {}),
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
       })
     )
   }
@@ -90,7 +92,12 @@ function seeded() {
       journalLifecycleBatchRowBuilder(
         () => state,
         `settle-${seq}`,
-        identities.map((identity) => ({ kind: 'item' as const, identity, body: text('settled') })),
+        identities.map((identity) => ({
+          kind: 'item' as const,
+          identity,
+          body: text('settled'),
+          turnScope: AGENT_JOURNAL_THREAD_SCOPE
+        })),
         { fence: 1 }
       )(seq, 1_000 + seq)
     )
@@ -180,15 +187,35 @@ describe('producer inheritance across a reopen', () => {
 
   it('replays an inherited producer from disk exactly as it was folded live', async () => {
     const journal = await open()
-    await journal.appendItem(child, text('working'), { fence: 1, ...linkage })
-    await journal.appendItem(own, text('working'), { fence: 1 })
-    await journal.appendItem(child, text('still working'), { fence: 1 })
+    await journal.appendItem(child, text('working'), {
+      fence: 1,
+      ...linkage,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
+    await journal.appendItem(own, text('working'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
+    await journal.appendItem(child, text('still working'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     await journal.appendLifecycleBatch({
       settlementId: 'settle-1',
       fence: 1,
       mutations: [
-        { kind: 'item', identity: child, body: text('settled') },
-        { kind: 'item', identity: own, body: text('settled') }
+        {
+          kind: 'item',
+          identity: child,
+          body: text('settled'),
+          turnScope: AGENT_JOURNAL_THREAD_SCOPE
+        },
+        {
+          kind: 'item',
+          identity: own,
+          body: text('settled'),
+          turnScope: AGENT_JOURNAL_THREAD_SCOPE
+        }
       ]
     })
     const live = journal.snapshot().items
diff --git a/src/main/native-chat/agent-session-journal/journal-queued-messages.ts b/src/main/native-chat/agent-session-journal/journal-queued-messages.ts
new file mode 100644
index 00000000000..3fc8c373788
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-queued-messages.ts
@@ -0,0 +1,369 @@
+// The journal's draft-store collaborator: every read and write of one session's
+// `queued_messages` rows, serialized on the same queue as the journal's own
+// appends so a draft mutation can never interleave with the consume that
+// converts it. Drafts are NEVER owed work: nothing here feeds the reducer,
+// working status, teardown, or the idle sweep.
+
+import type Database from '../../sqlite/sync-database'
+import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
+import {
+  AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS,
+  AGENT_SESSION_OPERATION_FUTURE_SKEW_MS
+} from '../../../shared/agent-session-host-authority'
+import type { JournalReducerState } from './journal-reducer'
+import type { JournalRow } from './journal-row-schema'
+import type { JournalSubmissionConsume } from './journal-store-contracts'
+import { adoptQueuedMessages, holdQueuedMessages } from './queued-message-holds'
+import {
+  clearQueuePause,
+  queuePauseHoldsBack,
+  readQueuePause,
+  recordQueuePause,
+  retireQueuePauseIfNothingHeld,
+  type QueuePauseFact,
+  type QueuePauseReason
+} from './queued-message-pause-table'
+import {
+  consumeQueuedMessageInTransaction,
+  getQueuedMessage,
+  insertQueuedMessage,
+  listQueuedMessages,
+  queuedMessagesSettledByOp,
+  withdrawQueuedMessages,
+  type QueuedMessageHoldReason,
+  type QueuedMessageRow
+} from './queued-message-table'
+import { draftsDeliveredByAppliedEcho } from './queued-message-delivered-echo'
+import { pruneQueuedMessages, retainedSubmissionVerdict } from './queued-message-retention'
+import {
+  owedBackToWaiting,
+  queuedMessageSettlementOwed,
+  settleOwedQueuedMessages,
+  settleQueuedMessagesForRow
+} from './queued-message-settlement'
+import { AgentSessionJournalError, assertJournalWritable } from './journal-write-guards'
+
+/** Tombstones must outlive the window in which their operation id could still be admitted as new. */
+export const QUEUED_MESSAGE_REPLAY_WINDOW_MS =
+  AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS + AGENT_SESSION_OPERATION_FUTURE_SKEW_MS
+
+export type JournalQueuedMessagesDeps = {
+  sessionId: string
+  now: () => number
+  serialize: <T>(run: () => Promise<T>) => Promise<T>
+  database: () => { db: Database.Database }
+  readOnly: () => boolean
+  state: () => JournalReducerState
+  /** The journal's own commit notification. Every standalone draft-table
+   *  transaction that changed rows fires it after COMMIT, so a draft or hold
+   *  change publishes and wakes the drain through the same path a journal row
+   *  does — no call site can forget. In-transaction consume and the returned
+   *  transition already ride their row's own commit. */
+  committed: () => void
+}
+
+export class JournalQueuedMessages {
+  /** Bumped on every draft-table write, so publication memos recompute only when they must. */
+  private changeRevision = 0
+  private listed: { revision: number; rows: readonly QueuedMessageRow[] } | null = null
+  private paused: { revision: number; fact: QueuePauseFact | null } | null = null
+
+  constructor(private readonly deps: JournalQueuedMessagesDeps) {}
+
+  revision(): number {
+    return this.changeRevision
+  }
+
+  /** The submission row of the latest accepted turn a person asked for; 0 when none. What
+   *  ends the queue's pause, read from the reducer in O(1). */
+  latestPersonTurnSequence(): number {
+    return this.deps.state().latestPersonTurnSequence
+  }
+
+  /** A journal transaction rolled back: nothing read inside it may stay cached. */
+  invalidate(): void {
+    this.changeRevision++
+  }
+
+  /** Cached per revision: the drain re-checks on every journal publish, so an
+   *  unchanged table must cost no SQL read or body parse on token streams. */
+  list(): readonly QueuedMessageRow[] {
+    if (this.listed?.revision !== this.changeRevision) {
+      this.listed = {
+        revision: this.changeRevision,
+        rows: listQueuedMessages(this.deps.database().db, this.deps.sessionId)
+      }
+    }
+    return this.listed.rows
+  }
+
+  get(messageId: string): QueuedMessageRow | null {
+    return getQueuedMessage(this.deps.database().db, this.deps.sessionId, messageId)
+  }
+
+  /** Replay receipts for one caller-scoped operation key. */
+  receipts(settledByOp: string): QueuedMessageRow[] {
+    return queuedMessagesSettledByOp(this.deps.database().db, this.deps.sessionId, settledByOp)
+  }
+
+  /** `pausedBy`: the queue is paused in the SAME transaction as this card lands
+   *  (a /clear's carry), so the drain never sees it unpaused and no pause fact
+   *  exists without a card under it. */
+  insert(input: {
+    messageId: string
+    body: AgentJournalMessageItem
+    fingerprint: string
+    hostInstance: string
+    pausedBy?: QueuePauseReason
+  }): Promise<QueuedMessageRow> {
+    const { pausedBy, ...draft } = input
+    const { sessionId } = this.deps
+    let inserted = false
+    return this.transact(
+      (db) => {
+        const existing = getQueuedMessage(db, sessionId, draft.messageId)
+        if (existing) {
+          // One id, one draft: admission replays a recorded operation before it
+          // gets here, so an existing row is the same accept landing twice.
+          return existing
+        }
+        inserted = true
+        const row = insertQueuedMessage(db, { ...draft, sessionId, now: this.deps.now() })
+        if (pausedBy) {
+          recordQueuePause(db, { sessionId, fact: this.pauseFact(pausedBy) })
+        }
+        return row
+      },
+      () => inserted
+    )
+  }
+
+  /** Hold one waiting draft whose conversion failed. Stored on the row, so it
+   *  survives handle eviction and restart; withdraw and consume clear it in their
+   *  own UPDATE. */
+  hold(input: { messageIds: readonly string[]; reason: QueuedMessageHoldReason }): Promise<void> {
+    return this.transact(
+      (db) => holdQueuedMessages(db, { ...input, sessionId: this.deps.sessionId }),
+      (held) => held > 0
+    ).then(() => undefined)
+  }
+
+  /** Where the user's last Stop took effect, if it is still recorded; cached per revision. */
+  pause(): QueuePauseFact | null {
+    if (this.paused?.revision !== this.changeRevision) {
+      this.paused = {
+        revision: this.changeRevision,
+        fact: readQueuePause(this.deps.database().db, this.deps.sessionId)
+      }
+    }
+    return this.paused.fact
+  }
+
+  /** A Stop took effect here: the queue is paused from this position on — if, judged in
+   *  the same transaction, it holds back a card at all. Returns whether it recorded. */
+  recordPause(reason: QueuePauseReason): Promise<boolean> {
+    const fact = this.pauseFact(reason)
+    return this.transact(
+      (db) =>
+        queuePauseHoldsBack(db, this.pauseScope()) &&
+        (recordQueuePause(db, { sessionId: this.deps.sessionId, fact }), true),
+      (recorded) => recorded
+    )
+  }
+
+  /** What `queuePauseHoldsBack` judges a pause by, from this journal's submissions. */
+  private pauseScope() {
+    return {
+      sessionId: this.deps.sessionId,
+      owedToWaiting: owedBackToWaiting(this.deps.state().submissions)
+    }
+  }
+
+  private pauseFact(reason: QueuePauseReason): QueuePauseFact {
+    const { epoch, lastSequence: sequence } = this.deps.state()
+    return { reason, epoch, sequence, recordedAt: this.deps.now() }
+  }
+
+  /** Ends the queue's pause: `stop` retires that Stop fact (never a later one),
+   *  `adoptInto` adopts a restart's rows into this host instance. Returns whether
+   *  anything changed. */
+  liftPause(input: { stop: QueuePauseFact | null; adoptInto: string | null }): Promise<boolean> {
+    const { sessionId } = this.deps
+    return this.transact(
+      (db) =>
+        (input.stop ? clearQueuePause(db, { sessionId, fact: input.stop }) : 0) +
+        (input.adoptInto === null
+          ? 0
+          : adoptQueuedMessages(db, { sessionId, hostInstance: input.adoptInto })),
+      (changed) => changed > 0
+    ).then((changed) => changed > 0)
+  }
+
+  /** Compare-and-transition waiting ∪ returned rows to op-stamped tombstones,
+   *  kept only so a replay of the settling operation answers "spent". */
+  withdraw(input: {
+    messageIds: readonly string[]
+    settledByOp: string
+  }): Promise<QueuedMessageRow[]> {
+    if (input.messageIds.length === 0) {
+      // Delete races and empty carries land here; neither may cost a write transaction.
+      return Promise.resolve([])
+    }
+    return this.transact(
+      (db) =>
+        withdrawQueuedMessages(db, {
+          ...input,
+          sessionId: this.deps.sessionId,
+          now: this.deps.now()
+        }),
+      (withdrawn) => withdrawn.length > 0
+    )
+  }
+
+  /** One standalone draft-table transaction on the journal's queue; one that
+   *  changed rows bumps the revision and notifies after COMMIT. */
+  private transact<T>(
+    run: (db: Database.Database) => T,
+    changed: (result: T) => boolean
+  ): Promise<T> {
+    return this.deps.serialize(async () => {
+      assertJournalWritable(this.deps.readOnly(), this.deps.sessionId)
+      const { db } = this.deps.database()
+      db.exec('BEGIN IMMEDIATE')
+      let result: T
+      let retired: number
+      try {
+        result = run(db)
+        // Any draft write may take the last card a pause holds back.
+        retired = retireQueuePauseIfNothingHeld(db, this.pauseScope())
+        db.exec('COMMIT')
+      } catch (error) {
+        db.exec('ROLLBACK')
+        throw error
+      }
+      if (changed(result) || retired > 0) {
+        this.changeRevision++
+        this.deps.committed()
+      }
+      return result
+    })
+  }
+
+  /** The standing writer hook, within the append's transaction
+   *  (`settleQueuedMessagesForRow`). */
+  onRowInTransaction(db: Database.Database, row: JournalRow): void {
+    this.changeRevision += settleQueuedMessagesForRow(db, {
+      sessionId: this.deps.sessionId,
+      state: this.deps.state(),
+      drafts: () => this.list(),
+      row,
+      now: this.deps.now()
+    })
+    this.changeRevision += retireQueuePauseIfNothingHeld(db, this.pauseScope())
+  }
+
+  /** The in-transaction consume for `appendSubmission`; a false compare-and-set
+   *  throws so the whole append — draft transition AND submission row — rolls back. */
+  consumeInTransaction(
+    db: Database.Database,
+    input: JournalSubmissionConsume & { consumedAs: string }
+  ): void {
+    const { db: own } = this.deps.database()
+    if (own !== db) {
+      // Same handle only: a second connection could not join the transaction.
+      throw new AgentSessionJournalError('journal_closed', 'consume crossed database handles')
+    }
+    const consumed = consumeQueuedMessageInTransaction(db, {
+      ...input,
+      sessionId: this.deps.sessionId,
+      now: this.deps.now()
+    })
+    if (!consumed) {
+      throw new QueuedMessageNotConsumableError(input.messageId, input.expect)
+    }
+    retireQueuePauseIfNothingHeld(db, this.pauseScope())
+    this.changeRevision++
+  }
+
+  /** A skipped live settlement the journal already decided (`queued-message-settlement.ts`). */
+  settlementOwed(): boolean {
+    return queuedMessageSettlementOwed(this.list(), this.deps.state().submissions)
+  }
+
+  /** Waiting drafts a skipped echo hook left unwithdrawn; reads every item, so only the drain
+   *  step asks, right before a draft would send. */
+  deliveredByEchoOwed(): boolean {
+    return draftsDeliveredByAppliedEcho(this.deps.state(), this.list()).length > 0
+  }
+
+  /** Applies owed settlements now, so a skipped live transition heals without a reopen. */
+  settleOwed(): Promise<void> {
+    return this.transact(
+      (db) =>
+        settleOwedQueuedMessages(db, {
+          sessionId: this.deps.sessionId,
+          state: this.deps.state(),
+          now: this.deps.now()
+        }),
+      (settled) => settled > 0
+    ).then(() => undefined)
+  }
+
+  /** Bookkeeping at open: a failure is reported and retried at the next open,
+   *  never allowed to fail opening the chat. */
+  repairAndPruneAtOpen(): Promise<void> {
+    return this.repairAndPrune().catch((error: unknown) => {
+      console.warn('[journal-open] queued-message repair skipped:', {
+        sessionId: this.deps.sessionId,
+        error: error instanceof Error ? error.message : String(error)
+      })
+    })
+  }
+
+  /**
+   * Open-time reconciliation, a re-derivation behind the stored fact: owed
+   * settlements apply exactly as the live hook would have (covers consume →
+   * crash → downgrade → upgrade, where the old build rejected the leftover with
+   * no hook), then retention runs; a pause left holding back nothing retires.
+   */
+  repairAndPrune(): Promise<void> {
+    if (this.deps.readOnly()) {
+      return Promise.resolve()
+    }
+    const { sessionId } = this.deps
+    return this.transact(
+      (db) => {
+        const [now, state] = [this.deps.now(), this.deps.state()]
+        return (
+          settleOwedQueuedMessages(db, { sessionId, state, now }) +
+          pruneQueuedMessages(db, {
+            sessionId,
+            now,
+            replayWindowMs: QUEUED_MESSAGE_REPLAY_WINDOW_MS,
+            submissionVerdict: retainedSubmissionVerdict(state.submissions)
+          })
+        )
+      },
+      (changed) => changed > 0
+    ).then(() => undefined)
+  }
+}
+
+/** The per-append hook converting one draft inside the append's own transaction. */
+export function queuedMessageConsumeHook(
+  queuedMessages: JournalQueuedMessages,
+  consumedAs: string,
+  consume: JournalSubmissionConsume
+): (db: Database.Database) => void {
+  return (db) => queuedMessages.consumeInTransaction(db, { ...consume, consumedAs })
+}
+
+export class QueuedMessageNotConsumableError extends Error {
+  constructor(
+    readonly messageId: string,
+    readonly expected: 'waiting' | 'returned'
+  ) {
+    super(`queued message ${messageId} is no longer ${expected}`)
+    this.name = 'QueuedMessageNotConsumableError'
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-reducer-producer-linkage.test.ts b/src/main/native-chat/agent-session-journal/journal-reducer-producer-linkage.test.ts
new file mode 100644
index 00000000000..6c3640c15cb
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-reducer-producer-linkage.test.ts
@@ -0,0 +1,214 @@
+import { describe, expect, it } from 'vitest'
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalItemIdentity,
+  type AgentJournalMessageItem
+} from '../../../shared/agent-session-journal-types'
+import { applyJournalRow, createJournalReducerState, renderJournalState } from './journal-reducer'
+import { buildJournalItemRow, journalLifecycleBatchRowBuilder } from './journal-row-builders'
+
+const EPOCH = 'epoch-1'
+
+function text(value: string): AgentJournalMessageItem {
+  return { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: value }] }
+}
+
+function base(seq: number): { v: number; epoch: string; seq: number; fence: number; ts: number } {
+  return { v: 1, epoch: EPOCH, seq, fence: 1, ts: 1_000 + seq }
+}
+
+describe('producer linkage round-trips through the reducer', () => {
+  const identity: AgentJournalItemIdentity = {
+    provider: 'claude',
+    sessionId: 'claude-session',
+    uuid: 'child-1'
+  }
+  const linkage = {
+    agentId: 'task-1',
+    parentAgentId: 'task-parent',
+    providerParentRef: 'toolu_1',
+    producerKind: 'agent' as const,
+    attempt: 2
+  }
+
+  it('copies the whole bundle onto the render item on the plain item path', () => {
+    const state = createJournalReducerState('session-1', EPOCH)
+    applyJournalRow(
+      state,
+      buildJournalItemRow({
+        state,
+        identity,
+        body: text('looking'),
+        seq: 1,
+        fence: 1,
+        ts: 1_001,
+        linkage,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
+    )
+    expect(renderJournalState(state).items[0]).toMatchObject(linkage)
+  })
+
+  it('copies it on the lifecycle-batch path too, which is a separate upsert', () => {
+    const state = createJournalReducerState('session-1', EPOCH)
+    applyJournalRow(state, {
+      kind: 'lifecycle-batch',
+      settlementId: 'settle-1',
+      mutations: [{ kind: 'item', itemId: 'i-child', revision: 1, body: text('looking') }],
+      ...base(1),
+      ...linkage
+    })
+    expect(renderJournalState(state).items[0]).toMatchObject(linkage)
+  })
+
+  it('reads each mutation of a mixed batch as its own producer', () => {
+    // A batch can CREATE rows several agents produced — a settlement landing
+    // before any checkpoint did. The mutation that names a producer is that
+    // producer's; the one naming none is the session's own, beside it.
+    const state = createJournalReducerState('session-1', EPOCH)
+    applyJournalRow(
+      state,
+      journalLifecycleBatchRowBuilder(
+        () => state,
+        'settle-mixed',
+        [
+          {
+            kind: 'item',
+            identity,
+            body: text('child'),
+            linkage,
+            turnScope: AGENT_JOURNAL_THREAD_SCOPE
+          },
+          {
+            kind: 'item',
+            identity: { provider: 'claude', sessionId: 'claude-session', uuid: 'own-1' },
+            body: text('own'),
+            turnScope: AGENT_JOURNAL_THREAD_SCOPE
+          }
+        ],
+        { fence: 1 }
+      )(1, 1_001)
+    )
+
+    const [child, own] = renderJournalState(state).items
+    expect(child).toMatchObject({ body: text('child'), ...linkage })
+    expect(own?.body).toEqual(text('own'))
+    expect(own && 'agentId' in own).toBe(false)
+  })
+
+  it('lets a correction win over the provisional row, without moving the bubble', () => {
+    // Write-through then correct: the row is written under the spawn call's own
+    // id, then re-appended under the canonical one. Revision is assigned inside
+    // the journal's serialized write step, so the later append always outranks
+    // — and `sequence`/`observedAt` stay pinned, so re-attributing a row does
+    // not relocate it in the timeline.
+    const state = createJournalReducerState('session-1', EPOCH)
+    const provisional = { agentId: 'toolu_1', providerParentRef: 'toolu_1' }
+    applyJournalRow(
+      state,
+      buildJournalItemRow({
+        state,
+        identity,
+        body: text('looking'),
+        seq: 1,
+        fence: 1,
+        ts: 1_001,
+        linkage: provisional,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
+    )
+    applyJournalRow(
+      state,
+      buildJournalItemRow({
+        state,
+        identity,
+        body: text('looking'),
+        seq: 9,
+        fence: 1,
+        ts: 9_999,
+        linkage,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
+    )
+
+    const items = renderJournalState(state).items
+    expect(items).toHaveLength(1)
+    expect(items[0]).toMatchObject({ revision: 2, ...linkage })
+    expect(items[0]).toMatchObject({ sequence: 1, observedAt: 1_001 })
+  })
+
+  it('does not let a stale checkpoint undo a correction that already landed', () => {
+    // A text checkpoint carrying the OLD stamp, submitted after the correction,
+    // would re-root the row. It cannot: revision is read at write time, so the
+    // last write wins and the lane resolves linkage fresh on every checkpoint.
+    const state = createJournalReducerState('session-1', EPOCH)
+    applyJournalRow(
+      state,
+      buildJournalItemRow({
+        state,
+        identity,
+        body: text('a'),
+        seq: 1,
+        fence: 1,
+        ts: 1,
+        linkage,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
+    )
+    applyJournalRow(
+      state,
+      buildJournalItemRow({
+        state,
+        identity,
+        body: text('a and more'),
+        seq: 2,
+        fence: 1,
+        ts: 2,
+        linkage,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
+    )
+    const items = renderJournalState(state).items
+    expect(items[0]).toMatchObject({ revision: 2, ...linkage })
+  })
+
+  it('keeps linkage when a later revision rewrites the row', () => {
+    // The resolved-append path lost the marker once before by rebuilding the
+    // row without it, so the SECOND write is the one that matters here.
+    const state = createJournalReducerState('session-1', EPOCH)
+    for (const [seq, body] of [
+      [1, text('look')],
+      [2, text('looking at the lane')]
+    ] as const) {
+      applyJournalRow(
+        state,
+        buildJournalItemRow({
+          state,
+          identity,
+          body,
+          seq,
+          fence: 1,
+          ts: 1_000 + seq,
+          linkage,
+          turnScope: AGENT_JOURNAL_THREAD_SCOPE
+        })
+      )
+    }
+    const items = renderJournalState(state).items
+    expect(items).toHaveLength(1)
+    expect(items[0]).toMatchObject({ revision: 2, ...linkage })
+  })
+
+  it("renders a row that predates linkage as the session's own", () => {
+    const state = createJournalReducerState('session-1', EPOCH)
+    applyJournalRow(state, {
+      kind: 'item',
+      itemId: 'i-legacy',
+      revision: 1,
+      body: text('written before linkage existed'),
+      ...base(1)
+    })
+    const item = renderJournalState(state).items[0]
+    expect(item && 'agentId' in item).toBe(false)
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-reducer-rejection-fact.test.ts b/src/main/native-chat/agent-session-journal/journal-reducer-rejection-fact.test.ts
new file mode 100644
index 00000000000..3332e53b0b3
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-reducer-rejection-fact.test.ts
@@ -0,0 +1,100 @@
+// A dispatch row's typed rejection fact, as the reducer folds it onto the submission.
+
+import { describe, expect, it } from 'vitest'
+import {
+  classifyDispatchRejection,
+  DISPATCH_REJECTED_QUEUE_FULL
+} from '../../../shared/structured-agent-session-dispatch-rejection'
+import {
+  applyJournalRow,
+  createJournalReducerState,
+  type JournalReducerState
+} from './journal-reducer'
+import type { JournalRow } from './journal-row-schema'
+
+const EPOCH = 'epoch-1'
+
+function base(seq: number): { v: number; epoch: string; seq: number; fence: number; ts: number } {
+  return { v: 1, epoch: EPOCH, seq, fence: 1, ts: 1_000 + seq }
+}
+
+function fold(rows: JournalRow[]): JournalReducerState {
+  const state = createJournalReducerState('session-1', EPOCH)
+  for (const row of rows) {
+    applyJournalRow(state, row)
+  }
+  return state
+}
+
+describe('a rejected dispatch', () => {
+  const submission: JournalRow = {
+    kind: 'submission',
+    clientMessageId: 'cm_1',
+    payloadFingerprint: 'fp_1',
+    providerHandle: { kind: 'codex', threadId: 'thread-1' },
+    body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hi' }] },
+    ...base(1)
+  }
+
+  it("copies a rejection's typed fact onto the submission, and only on `rejected`", () => {
+    const rejection = { kind: 'providerRejected', detail: { text: 'Too long', audience: 'person' } }
+    const state = fold([
+      submission,
+      {
+        kind: 'dispatch',
+        clientMessageId: 'cm_1',
+        state: 'rejected',
+        providerItemId: null,
+        reason: 'The provider did not accept this message.',
+        rejection: { kind: 'providerRejected', detail: { text: 'Too long', audience: 'person' } },
+        ...base(2)
+      }
+    ])
+    expect(state.submissions.get('cm_1')).toMatchObject({
+      dispatchState: 'rejected',
+      reason: 'The provider did not accept this message.',
+      rejection
+    })
+
+    const doubt = fold([
+      { ...submission, clientMessageId: 'cm_2' },
+      {
+        kind: 'dispatch',
+        clientMessageId: 'cm_2',
+        state: 'unknown',
+        providerItemId: null,
+        reason: 'provider_exited_before_acknowledgement',
+        rejection: { kind: 'writeFailed' },
+        ...base(2)
+      }
+    ])
+    expect(doubt.submissions.get('cm_2')).not.toHaveProperty('rejection')
+  })
+
+  it('keeps only the kind of a rejection fact it cannot place, so it reads as no verdict', () => {
+    const rejected = (rejection: unknown): JournalRow => {
+      const row: JournalRow = {
+        kind: 'dispatch',
+        clientMessageId: 'cm_1',
+        state: 'rejected',
+        providerItemId: null,
+        reason: DISPATCH_REJECTED_QUEUE_FULL,
+        ...base(2)
+      }
+      // A row read from disk carries whatever the host that wrote it did.
+      return Object.assign(row, { rejection })
+    }
+    // A newer host's kind: the marker beside it must not decide.
+    const newer = fold([submission, rejected({ kind: 'futureKind', detail: 'x' })])
+    const settled = newer.submissions.get('cm_1')
+    expect(settled).toMatchObject({ dispatchState: 'rejected', rejection: { kind: 'futureKind' } })
+    expect(settled && classifyDispatchRejection(settled)).toEqual({
+      category: 'undelivered',
+      verdict: null
+    })
+    // Not a fact at all: dropped, leaving the reason.
+    const malformed = fold([submission, rejected('queueFull')]).submissions.get('cm_1')
+    expect(malformed).not.toHaveProperty('rejection')
+    expect(malformed && classifyDispatchRejection(malformed)).toMatchObject({ kind: 'queueFull' })
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-reducer.test.ts b/src/main/native-chat/agent-session-journal/journal-reducer.test.ts
index 825c5aaf347..45681f32871 100644
--- a/src/main/native-chat/agent-session-journal/journal-reducer.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-reducer.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { describe, expect, it } from 'vitest'
 import {
   agentJournalItemKey,
@@ -17,11 +18,7 @@ import {
   renderJournalState,
   type JournalReducerState
 } from './journal-reducer'
-import {
-  buildJournalItemRow,
-  buildJournalTombstoneRow,
-  journalLifecycleBatchRowBuilder
-} from './journal-row-builders'
+import { buildJournalItemRow, buildJournalTombstoneRow } from './journal-row-builders'
 import type { JournalRow } from './journal-row-schema'
 
 const EPOCH = 'epoch-1'
@@ -118,6 +115,39 @@ describe('ordering', () => {
     expect(renderJournalState(state).items.map((item) => item.itemId)).toEqual(['earlier', 'later'])
   })
 
+  it("places a batch's writes by their order in it, and keeps that place on revision", () => {
+    // One Codex ask writes all its questions in one batch; their ids are not their order.
+    const state = fold([
+      {
+        kind: 'lifecycle-batch',
+        settlementId: 'ask',
+        mutations: [
+          { kind: 'item', itemId: 'scope', revision: 1, body: text('first') },
+          { kind: 'item', itemId: 'priority', revision: 1, body: text('second') },
+          { kind: 'item', itemId: 'deadline', revision: 1, body: text('third') }
+        ],
+        ...base(1)
+      },
+      {
+        kind: 'lifecycle-batch',
+        settlementId: 'answer',
+        mutations: [{ kind: 'item', itemId: 'deadline', revision: 2, body: text('answered') }],
+        ...base(2)
+      }
+    ])
+    expect(
+      renderJournalState(state).items.map(({ itemId, sequence, sequenceIndex }) => ({
+        itemId,
+        sequence,
+        sequenceIndex
+      }))
+    ).toEqual([
+      { itemId: 'scope', sequence: 1, sequenceIndex: undefined },
+      { itemId: 'priority', sequence: 1, sequenceIndex: 1 },
+      { itemId: 'deadline', sequence: 1, sequenceIndex: 2 }
+    ])
+  })
+
   it('orders by sequence even when the observed timestamp runs backwards', () => {
     const state = fold([
       { kind: 'item', itemId: 'late', revision: 1, body: text('late'), ...base(1), ts: 9_000 },
@@ -624,7 +654,15 @@ describe('re-adding a tombstoned row', () => {
     const state = createJournalReducerState('session-1', EPOCH)
     applyJournalRow(
       state,
-      buildJournalItemRow({ state, identity, body: text('first'), seq: 1, fence: 1, ts: 1_001 })
+      buildJournalItemRow({
+        state,
+        identity,
+        body: text('first'),
+        seq: 1,
+        fence: 1,
+        ts: 1_001,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
     )
     applyJournalRow(state, buildJournalTombstoneRow({ state, itemId, seq: 2, fence: 1, ts: 1_002 }))
     expect(renderJournalState(state).items).toEqual([])
@@ -633,7 +671,15 @@ describe('re-adding a tombstoned row', () => {
     // `items` would restart at 1 and lose to the tombstone forever.
     applyJournalRow(
       state,
-      buildJournalItemRow({ state, identity, body: text('second'), seq: 3, fence: 1, ts: 1_003 })
+      buildJournalItemRow({
+        state,
+        identity,
+        body: text('second'),
+        seq: 3,
+        fence: 1,
+        ts: 1_003,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
     )
     expect(renderJournalState(state).items.map((item) => item.body)).toEqual([text('second')])
   })
@@ -649,12 +695,28 @@ describe('re-adding a tombstoned row', () => {
     const state = createJournalReducerState('session-1', EPOCH)
     applyJournalRow(
       state,
-      buildJournalItemRow({ state, identity, body: text('first'), seq: 1, fence: 1, ts: 1_001 })
+      buildJournalItemRow({
+        state,
+        identity,
+        body: text('first'),
+        seq: 1,
+        fence: 1,
+        ts: 1_001,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
     )
     applyJournalRow(state, buildJournalTombstoneRow({ state, itemId, seq: 2, fence: 1, ts: 1_002 }))
     applyJournalRow(
       state,
-      buildJournalItemRow({ state, identity, body: text('second'), seq: 3, fence: 1, ts: 1_003 })
+      buildJournalItemRow({
+        state,
+        identity,
+        body: text('second'),
+        seq: 3,
+        fence: 1,
+        ts: 1_003,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
     )
     expect(state.tombstones.get(itemId)).toBeUndefined()
 
@@ -662,170 +724,3 @@ describe('re-adding a tombstoned row', () => {
     expect(renderJournalState(state).items).toEqual([])
   })
 })
-
-describe('producer linkage round-trips through the reducer', () => {
-  const identity: AgentJournalItemIdentity = {
-    provider: 'claude',
-    sessionId: 'claude-session',
-    uuid: 'child-1'
-  }
-  const linkage = {
-    agentId: 'task-1',
-    parentAgentId: 'task-parent',
-    providerParentRef: 'toolu_1',
-    producerKind: 'agent' as const,
-    attempt: 2
-  }
-
-  it('copies the whole bundle onto the render item on the plain item path', () => {
-    const state = createJournalReducerState('session-1', EPOCH)
-    applyJournalRow(
-      state,
-      buildJournalItemRow({
-        state,
-        identity,
-        body: text('looking'),
-        seq: 1,
-        fence: 1,
-        ts: 1_001,
-        linkage
-      })
-    )
-    expect(renderJournalState(state).items[0]).toMatchObject(linkage)
-  })
-
-  it('copies it on the lifecycle-batch path too, which is a separate upsert', () => {
-    const state = createJournalReducerState('session-1', EPOCH)
-    applyJournalRow(state, {
-      kind: 'lifecycle-batch',
-      settlementId: 'settle-1',
-      mutations: [{ kind: 'item', itemId: 'i-child', revision: 1, body: text('looking') }],
-      ...base(1),
-      ...linkage
-    })
-    expect(renderJournalState(state).items[0]).toMatchObject(linkage)
-  })
-
-  it('reads each mutation of a mixed batch as its own producer', () => {
-    // A batch can CREATE rows several agents produced — a settlement landing
-    // before any checkpoint did. The mutation that names a producer is that
-    // producer's; the one naming none is the session's own, beside it.
-    const state = createJournalReducerState('session-1', EPOCH)
-    applyJournalRow(
-      state,
-      journalLifecycleBatchRowBuilder(
-        () => state,
-        'settle-mixed',
-        [
-          { kind: 'item', identity, body: text('child'), linkage },
-          {
-            kind: 'item',
-            identity: { provider: 'claude', sessionId: 'claude-session', uuid: 'own-1' },
-            body: text('own')
-          }
-        ],
-        { fence: 1 }
-      )(1, 1_001)
-    )
-
-    const [child, own] = renderJournalState(state).items
-    expect(child).toMatchObject({ body: text('child'), ...linkage })
-    expect(own?.body).toEqual(text('own'))
-    expect(own && 'agentId' in own).toBe(false)
-  })
-
-  it('lets a correction win over the provisional row, without moving the bubble', () => {
-    // Write-through then correct: the row is written under the spawn call's own
-    // id, then re-appended under the canonical one. Revision is assigned inside
-    // the journal's serialized write step, so the later append always outranks
-    // — and `sequence`/`observedAt` stay pinned, so re-attributing a row does
-    // not relocate it in the timeline.
-    const state = createJournalReducerState('session-1', EPOCH)
-    const provisional = { agentId: 'toolu_1', providerParentRef: 'toolu_1' }
-    applyJournalRow(
-      state,
-      buildJournalItemRow({
-        state,
-        identity,
-        body: text('looking'),
-        seq: 1,
-        fence: 1,
-        ts: 1_001,
-        linkage: provisional
-      })
-    )
-    applyJournalRow(
-      state,
-      buildJournalItemRow({
-        state,
-        identity,
-        body: text('looking'),
-        seq: 9,
-        fence: 1,
-        ts: 9_999,
-        linkage
-      })
-    )
-
-    const items = renderJournalState(state).items
-    expect(items).toHaveLength(1)
-    expect(items[0]).toMatchObject({ revision: 2, ...linkage })
-    expect(items[0]).toMatchObject({ sequence: 1, observedAt: 1_001 })
-  })
-
-  it('does not let a stale checkpoint undo a correction that already landed', () => {
-    // A text checkpoint carrying the OLD stamp, submitted after the correction,
-    // would re-root the row. It cannot: revision is read at write time, so the
-    // last write wins and the lane resolves linkage fresh on every checkpoint.
-    const state = createJournalReducerState('session-1', EPOCH)
-    applyJournalRow(
-      state,
-      buildJournalItemRow({ state, identity, body: text('a'), seq: 1, fence: 1, ts: 1, linkage })
-    )
-    applyJournalRow(
-      state,
-      buildJournalItemRow({
-        state,
-        identity,
-        body: text('a and more'),
-        seq: 2,
-        fence: 1,
-        ts: 2,
-        linkage
-      })
-    )
-    const items = renderJournalState(state).items
-    expect(items[0]).toMatchObject({ revision: 2, ...linkage })
-  })
-
-  it('keeps linkage when a later revision rewrites the row', () => {
-    // The resolved-append path lost the marker once before by rebuilding the
-    // row without it, so the SECOND write is the one that matters here.
-    const state = createJournalReducerState('session-1', EPOCH)
-    for (const [seq, body] of [
-      [1, text('look')],
-      [2, text('looking at the lane')]
-    ] as const) {
-      applyJournalRow(
-        state,
-        buildJournalItemRow({ state, identity, body, seq, fence: 1, ts: 1_000 + seq, linkage })
-      )
-    }
-    const items = renderJournalState(state).items
-    expect(items).toHaveLength(1)
-    expect(items[0]).toMatchObject({ revision: 2, ...linkage })
-  })
-
-  it("renders a row that predates linkage as the session's own", () => {
-    const state = createJournalReducerState('session-1', EPOCH)
-    applyJournalRow(state, {
-      kind: 'item',
-      itemId: 'i-legacy',
-      revision: 1,
-      body: text('written before linkage existed'),
-      ...base(1)
-    })
-    const item = renderJournalState(state).items[0]
-    expect(item && 'agentId' in item).toBe(false)
-  })
-})
diff --git a/src/main/native-chat/agent-session-journal/journal-reducer.ts b/src/main/native-chat/agent-session-journal/journal-reducer.ts
index 273502c8cf2..ed12c4a6cba 100644
--- a/src/main/native-chat/agent-session-journal/journal-reducer.ts
+++ b/src/main/native-chat/agent-session-journal/journal-reducer.ts
@@ -4,9 +4,11 @@
 //
 // Rules: highest revision wins, a tombstone removes, a late lower revision is
 // dropped rather than resurrecting stale content, and ordering is by the
-// sequence of the row that CREATED an item (a later revision updates the body,
-// it does not move the bubble). Producer linkage is likewise the creating
-// write's: a revision naming no producer keeps it, one naming any replaces it.
+// position (sequence, then place in the row) of the write that CREATED an item
+// (a later revision updates the body, it does not move the bubble) — except a
+// queued message, which sits where its handover put it. Producer linkage is
+// likewise the creating write's: a revision naming no producer keeps it, one
+// naming any replaces it.
 
 import type {
   AgentJournalAcceptanceReceipt,
@@ -15,18 +17,19 @@ import type {
   AgentJournalSubmission
 } from '../../../shared/agent-session-journal-types'
 import { journalBatchMutationProducer, journalRenderItem } from './journal-render-item'
+import { compareAgentJournalItems } from '../../../shared/agent-session-journal-position'
 import {
   agentJournalSubmissionKey,
   parseAgentJournalItemKey
 } from '../../../shared/agent-session-journal-item-key'
-import {
-  agentJournalLinkageFields,
-  namesAgentJournalProducer
-} from '../../../shared/agent-session-journal-producer'
 import { structuredAgentSessionPayloadFingerprint } from '../../../shared/structured-agent-session-mutation'
+import { JournalDerivedTurnScope } from './journal-derived-turn-scope'
+import { removeJournalItem, statedOrDerivedTurnScope, upsertJournalItem } from './journal-item-fold'
 import { journalItemRevisionIsStale } from './journal-item-revision'
 import type { JournalRow } from './journal-row-schema'
-import { dispatchRejectionWasTransportWriteFailure } from '../../../shared/structured-agent-session-dispatch-rejection'
+import { acceptSubmissionFromProviderItem, applyJournalSubmission } from './journal-submission-fold'
+import { applyJournalDispatchRow } from './journal-dispatch-reducer'
+import { isWriteFailureSubmission } from '../../../shared/structured-agent-session-dispatch-rejection'
 
 export const MAX_JOURNAL_APPLIED_SETTLEMENT_IDS = 4_096
 
@@ -39,6 +42,8 @@ export type JournalReducerState = {
   oldestSequence: number
   highestFence: number
   items: Map<string, AgentJournalRenderItem>
+  /** Fence of the writer that created each item: the generation a running turn belongs to. */
+  itemFences: Map<string, number>
   /** Revision of a removed item, so a late lower revision cannot resurrect it. */
   tombstones: Map<string, number>
   submissions: Map<string, AgentJournalSubmission>
@@ -47,6 +52,11 @@ export type JournalReducerState = {
    *  echo from appending a second copy of the user's own message. */
   aliases: Map<string, string>
   appliedSettlementIds: Set<string>
+  /** Scope for rows stored without one; rebuilt by replay, never persisted. */
+  derivedTurnScope: JournalDerivedTurnScope
+  /** The submission row of the latest turn a person asked for (`origin: 'client'`) that the
+   *  provider accepted; 0 when none. Kept as it folds so the queue's pause reads it in O(1). */
+  latestPersonTurnSequence: number
 }
 
 export function createJournalReducerState(sessionId: string, epoch: string): JournalReducerState {
@@ -58,11 +68,14 @@ export function createJournalReducerState(sessionId: string, epoch: string): Jou
     oldestSequence: 1,
     highestFence: 0,
     items: new Map(),
+    itemFences: new Map(),
     tombstones: new Map(),
     submissions: new Map(),
     receipts: new Map(),
     aliases: new Map(),
-    appliedSettlementIds: new Set()
+    appliedSettlementIds: new Set(),
+    derivedTurnScope: new JournalDerivedTurnScope(),
+    latestPersonTurnSequence: 0
   }
 }
 
@@ -79,48 +92,47 @@ export function applyJournalRow(state: JournalReducerState, row: JournalRow): vo
     }
     const itemId = resolveJournalItemId(state, row.itemId, row.body)
     acceptSubmissionFromProviderItem(state, row.itemId, itemId, row)
-    upsertItem(state, itemId, row.revision, journalRenderItem(itemId, row.revision, row.body, row))
+    upsertJournalItem(
+      state,
+      itemId,
+      row.revision,
+      journalRenderItem(itemId, row.revision, row.body, row, statedOrDerivedTurnScope(state, row)),
+      row.fence
+    )
     return
   }
   if (row.kind === 'tombstone') {
-    removeItem(state, resolveItemId(state, row.itemId), row.revision)
+    removeJournalItem(state, resolveItemId(state, row.itemId), row.revision)
     return
   }
   if (row.kind === 'lifecycle-batch') {
     if (state.appliedSettlementIds.has(row.settlementId)) {
       return
     }
-    for (const mutation of row.mutations) {
+    for (const [sequenceIndex, mutation] of row.mutations.entries()) {
       if (mutation.kind === 'item') {
         if (journalItemRevisionIsStale(state, mutation.itemId, mutation.revision)) {
           continue
         }
-        const itemId = resolveJournalItemId(state, mutation.itemId, mutation.body)
+        const { revision, body } = mutation
+        const itemId = resolveJournalItemId(state, mutation.itemId, body)
         acceptSubmissionFromProviderItem(state, mutation.itemId, itemId, row)
-        upsertItem(
-          state,
-          itemId,
-          mutation.revision,
-          journalRenderItem(
-            itemId,
-            mutation.revision,
-            mutation.body,
-            row,
-            journalBatchMutationProducer(row, mutation)
-          )
-        )
+        const producer = journalBatchMutationProducer(row, mutation)
+        const scope = statedOrDerivedTurnScope(state, mutation)
+        const item = journalRenderItem(itemId, revision, body, row, scope, producer, sequenceIndex)
+        upsertJournalItem(state, itemId, revision, item, row.fence)
       } else {
-        removeItem(state, resolveItemId(state, mutation.itemId), mutation.revision)
+        removeJournalItem(state, resolveItemId(state, mutation.itemId), mutation.revision)
       }
     }
     rememberAppliedSettlementId(state, row.settlementId)
     return
   }
   if (row.kind === 'submission') {
-    applySubmission(state, row)
+    applyJournalSubmission(state, row)
     return
   }
-  applyDispatch(state, row)
+  applyJournalDispatchRow(state, row)
 }
 
 export function rememberAppliedSettlementId(
@@ -146,16 +158,38 @@ export function resolveJournalItemId(
   if (aliased) {
     return aliased
   }
-  const identity = parseAgentJournalItemKey(itemId)
-  if (
-    !body ||
-    body.kind !== 'message' ||
-    body.role !== 'user' ||
-    !identity ||
-    identity.provider === 'orca'
-  ) {
+  const submissionId = journalEchoClaimant(state, itemId, body)
+  if (!submissionId) {
     return itemId
   }
+  state.aliases.set(itemId, submissionId)
+  return submissionId
+}
+
+/** A user message the provider wrote: the only item a submission's echo can be. */
+export function isProviderUserMessageEcho(
+  itemId: string,
+  body: AgentJournalRenderItem['body']
+): boolean {
+  const identity = parseAgentJournalItemKey(itemId)
+  return (
+    body.kind === 'message' &&
+    body.role === 'user' &&
+    identity !== null &&
+    identity.provider !== 'orca'
+  )
+}
+
+/** The submission item a provider's echo of a user message would fold into, read without
+ *  claiming it; null when the item is not such an echo, or no submission may claim it. */
+export function journalEchoClaimant(
+  state: JournalReducerState,
+  itemId: string,
+  body?: AgentJournalRenderItem['body']
+): string | null {
+  if (!body || !isProviderUserMessageEcho(itemId, body)) {
+    return null
+  }
   const fingerprint = structuredAgentSessionPayloadFingerprint({
     method: 'agentSession.send',
     sessionId: state.sessionId,
@@ -172,166 +206,22 @@ export function resolveJournalItemId(
     .find(
       (candidate) =>
         candidate.dispatchState !== 'rejected' &&
-        !dispatchRejectionWasTransportWriteFailure(candidate.reason) &&
+        !isWriteFailureSubmission(candidate) &&
         candidate.payloadFingerprint === fingerprint &&
         state.items.get(agentJournalSubmissionKey(candidate.clientMessageId))?.revision === 0
     )
-  if (!submission) {
-    return itemId
-  }
-  const submissionId = agentJournalSubmissionKey(submission.clientMessageId)
-  state.aliases.set(itemId, submissionId)
-  return submissionId
+  return submission ? agentJournalSubmissionKey(submission.clientMessageId) : null
 }
 
 function resolveItemId(state: JournalReducerState, itemId: string): string {
   return state.aliases.get(itemId) ?? itemId
 }
 
-function upsertItem(
-  state: JournalReducerState,
-  itemId: string,
-  revision: number,
-  next: AgentJournalRenderItem
-): void {
-  const tombstoned = state.tombstones.get(itemId)
-  if (tombstoned !== undefined && revision <= tombstoned) {
-    return
-  }
-  const existing = state.items.get(itemId)
-  if (existing && revision <= existing.revision) {
-    return
-  }
-  if (!existing) {
-    state.items.set(itemId, next)
-    state.tombstones.delete(itemId)
-    return
-  }
-  // Creation sequence is the ordering key; a revision refreshes content only.
-  // `observedAt` is pinned with it: clients sort the timeline by that timestamp,
-  // so letting a revision advance it makes the row jump past everything that
-  // landed in between — the provider's own echo of a send revises the submission
-  // row, which relocated the user's bubble below later rows.
-  const submitted =
-    existing.body.kind === 'message' &&
-    existing.body.role === 'user' &&
-    parseAgentJournalItemKey(itemId)?.provider === 'orca'
-  state.items.set(itemId, {
-    ...next,
-    // Settlements, prompt answers and reopen sweeps revise rows any agent wrote
-    // without naming one; each would otherwise hand a subagent's row to the session.
-    ...(namesAgentJournalProducer(next) ? {} : agentJournalLinkageFields(existing)),
-    // Provider history may normalize text or omit local attachments from the original send.
-    body: submitted ? existing.body : next.body,
-    sequence: existing.sequence,
-    observedAt: existing.observedAt
-  })
-  state.tombstones.delete(itemId)
-}
-
-function removeItem(state: JournalReducerState, itemId: string, revision: number): void {
-  const existing = state.items.get(itemId)
-  if (existing && revision <= existing.revision) {
-    return
-  }
-  const tombstoned = state.tombstones.get(itemId)
-  if (tombstoned !== undefined && revision <= tombstoned) {
-    return
-  }
-  state.tombstones.set(itemId, revision)
-  state.items.delete(itemId)
-}
-
-function applySubmission(
-  state: JournalReducerState,
-  row: Extract<JournalRow, { kind: 'submission' }>
-): void {
-  state.submissions.set(row.clientMessageId, {
-    clientMessageId: row.clientMessageId,
-    fence: row.fence,
-    payloadFingerprint: row.payloadFingerprint,
-    dispatchState: 'pending',
-    providerItemId: null,
-    reason: null,
-    submittedAt: row.ts,
-    resolvedAt: null
-  })
-  const itemId = agentJournalSubmissionKey(row.clientMessageId)
-  upsertItem(state, itemId, 0, journalRenderItem(itemId, 0, row.body, row))
-}
-
-function applyDispatch(
-  state: JournalReducerState,
-  row: Extract<JournalRow, { kind: 'dispatch' }>
-): void {
-  const submission = state.submissions.get(row.clientMessageId)
-  if (!submission) {
-    return
-  }
-  // `rejected` is terminal; a late `unknown` must not reopen a settled answer.
-  if (submission.dispatchState === 'rejected' || submission.dispatchState === 'accepted') {
-    return
-  }
-  submission.fence = row.fence
-  submission.dispatchState = row.state
-  submission.providerItemId = row.providerItemId
-  submission.reason = row.reason
-  submission.resolvedAt = row.state === 'pending' ? null : row.ts
-  if (row.recovered) {
-    submission.recovered = row.recovered
-  } else {
-    delete submission.recovered
-  }
-  if (row.state !== 'accepted' || !row.providerItemId) {
-    return
-  }
-  state.aliases.set(row.providerItemId, agentJournalSubmissionKey(row.clientMessageId))
-  state.receipts.set(row.clientMessageId, {
-    clientMessageId: row.clientMessageId,
-    providerItemId: row.providerItemId,
-    cursor: { epoch: row.epoch, sequence: row.seq },
-    acceptedAt: row.ts
-  })
-}
-
-function acceptSubmissionFromProviderItem(
-  state: JournalReducerState,
-  providerItemId: string,
-  resolvedItemId: string,
-  row: Pick<JournalRow, 'epoch' | 'seq' | 'fence' | 'ts'>
-): void {
-  if (providerItemId === resolvedItemId) {
-    return
-  }
-  const submission = [...state.submissions.values()].find(
-    (candidate) => agentJournalSubmissionKey(candidate.clientMessageId) === resolvedItemId
-  )
-  if (
-    !submission ||
-    submission.dispatchState === 'accepted' ||
-    submission.dispatchState === 'rejected'
-  ) {
-    return
-  }
-  submission.fence = row.fence
-  submission.dispatchState = 'accepted'
-  submission.providerItemId = providerItemId
-  submission.reason = null
-  submission.resolvedAt = row.ts
-  delete submission.recovered
-  state.receipts.set(submission.clientMessageId, {
-    clientMessageId: submission.clientMessageId,
-    providerItemId,
-    cursor: { epoch: row.epoch, sequence: row.seq },
-    acceptedAt: row.ts
-  })
-}
-
 /** Project the folded state into the client-facing snapshot. */
 export function renderJournalState(state: JournalReducerState): AgentJournalSnapshot {
-  // Sequence is the sole ordering key; map insertion order is not, because a
-  // re-created item re-enters the map after the items that followed it.
-  const items = [...state.items.values()].sort((a, b) => a.sequence - b.sequence)
+  // The journal position is the sole ordering key; map insertion order is not,
+  // because a re-created item re-enters the map after the items that followed it.
+  const items = [...state.items.values()].sort(compareAgentJournalItems)
   return {
     sessionId: state.sessionId,
     cursor: { epoch: state.epoch, sequence: state.lastSequence },
diff --git a/src/main/native-chat/agent-session-journal/journal-render-item.ts b/src/main/native-chat/agent-session-journal/journal-render-item.ts
index 6f41ff3e862..fd58b2c25e4 100644
--- a/src/main/native-chat/agent-session-journal/journal-render-item.ts
+++ b/src/main/native-chat/agent-session-journal/journal-render-item.ts
@@ -1,7 +1,8 @@
 import type {
   AgentJournalItemBody,
   AgentJournalProducerLinkage,
-  AgentJournalRenderItem
+  AgentJournalRenderItem,
+  AgentJournalTurnScope
 } from '../../../shared/agent-session-journal-types'
 import {
   agentJournalLinkageFields,
@@ -19,16 +20,21 @@ export function journalRenderItem(
   revision: number,
   body: AgentJournalItemBody,
   row: JournalRow,
-  producer: AgentJournalProducerLinkage = row
+  turnScope: AgentJournalTurnScope,
+  producer: AgentJournalProducerLinkage = row,
+  /** Which of the row's writes this is; only a lifecycle batch has more than one. */
+  sequenceIndex = 0
 ): AgentJournalRenderItem {
   return {
     itemId,
     revision,
     body,
     sequence: row.seq,
+    ...(sequenceIndex > 0 ? { sequenceIndex } : {}),
     observedAt: row.ts,
     ...(row.recovered ? { recoveredAt: row.ts } : {}),
     ...(row.recovered ? { recovered: row.recovered } : {}),
+    turnScope,
     ...agentJournalLinkageFields(producer)
   }
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-restart-reconciliation.test.ts b/src/main/native-chat/agent-session-journal/journal-restart-reconciliation.test.ts
index 46d161b1172..aaac2bc1a20 100644
--- a/src/main/native-chat/agent-session-journal/journal-restart-reconciliation.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-restart-reconciliation.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // Wiring the restart reconciler: what provider history is allowed to decide
 // about a submission the crash boundary could only doubt.
 
@@ -15,6 +16,9 @@ import { digestPayload } from './journal-payload-bounds'
 import { reconcileJournalSubmissionsAgainstHistory } from './journal-restart-reconciliation'
 import type { ProviderHistoryItem, ProviderHistoryWindow } from './journal-submission-reconciler'
 import { createTrackedJournalOpener } from './journal-store-test-open'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
+import { classifyDispatchRejection } from '../../../shared/structured-agent-session-dispatch-rejection'
 
 const IDENTITY: AgentSessionJournalIdentity = {
   sessionId: 'session-1',
@@ -122,7 +126,18 @@ describe('reconcileJournalSubmissionsAgainstHistory', () => {
     expect(settled).toEqual(['cm_1'])
     const submission = journal.submissions()[0]
     expect(submission?.dispatchState).toBe('rejected')
-    expect(submission?.reason).toBe('not_delivered')
+    // A sentence, since released clients print the reason as it is, and the fact beside it.
+    expect(submission?.reason).toBe(
+      agentSessionFailureWords(agentSessionFailureFact('notDelivered'), { surface: 'rejection' })
+        .reason
+    )
+    expect(submission?.rejection).toEqual({ kind: 'notDelivered' })
+    // Nobody failed: the crash stranded it before the provider took it.
+    expect(submission && classifyDispatchRejection(submission)).toEqual({
+      category: 'undelivered',
+      verdict: null,
+      kind: 'notDelivered'
+    })
   })
 
   it('leaves a submission unknown while the provider reports a turn in flight', async () => {
@@ -201,7 +216,8 @@ describe('reconcileJournalSubmissionsAgainstHistory', () => {
     const journal = await open()
     // An identical message, delivered and committed BEFORE the one that crashed.
     await journal.appendItem(claudeIdentity('uuid-old'), userMessage('deploy the thing'), {
-      fence: 1
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
     })
     await journal.appendSubmission({
       clientMessageId: 'cm_1',
@@ -254,7 +270,7 @@ describe('reconcileJournalSubmissionsAgainstHistory', () => {
       'accepted',
       'rejected'
     ])
-    expect(restarted.submissions()[1]?.reason).toBe('not_delivered')
+    expect(restarted.submissions()[1]?.rejection).toEqual({ kind: 'notDelivered' })
   })
 
   it('leaves two identical unsettled sends unknown rather than guessing between them', async () => {
diff --git a/src/main/native-chat/agent-session-journal/journal-restart-reconciliation.ts b/src/main/native-chat/agent-session-journal/journal-restart-reconciliation.ts
index 626baa9820a..f1484bf5da8 100644
--- a/src/main/native-chat/agent-session-journal/journal-restart-reconciliation.ts
+++ b/src/main/native-chat/agent-session-journal/journal-restart-reconciliation.ts
@@ -10,6 +10,8 @@
 // through the user's Retry, which rotates the client message id; Orca still
 // never puts a message back on the wire on the user's behalf.
 
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
 import type {
   AgentJournalMessageItem,
   AgentJournalSubmission
@@ -18,6 +20,7 @@ import {
   agentJournalItemKey,
   agentJournalSubmissionKey
 } from '../../../shared/agent-session-journal-item-key'
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
 import type { AgentSessionJournal } from './journal-store'
 import { reconcileSubmissions, type ProviderHistoryWindow } from './journal-submission-reconciler'
 
@@ -32,6 +35,8 @@ function comparableBody(body: AgentJournalMessageItem | undefined): boolean {
   return (
     body?.kind === 'message' &&
     body.role === 'user' &&
+    // A conversation command leaves no user item in provider history to find.
+    body.command === undefined &&
     body.blocks.length === 1 &&
     body.blocks[0]?.type === 'text' &&
     body.blocks[0].text.trim().length > 0
@@ -42,7 +47,11 @@ function comparableSubmissions(journal: AgentSessionJournal): AgentJournalSubmis
   const { items, submissions } = journal.snapshot()
   const bodies = new Map(items.map((item) => [item.itemId, item.body]))
   return submissions.filter((submission) => {
-    if (submission.dispatchState !== 'pending' && submission.dispatchState !== 'unknown') {
+    if (
+      (submission.dispatchState !== 'pending' && submission.dispatchState !== 'unknown') ||
+      // Never handed over, so provider history cannot hold it.
+      isQueuedAgentJournalSubmission(submission)
+    ) {
       return false
     }
     const body = bodies.get(agentJournalSubmissionKey(submission.clientMessageId))
@@ -111,7 +120,9 @@ export async function reconcileJournalSubmissionsAgainstHistory(input: {
         : {
             clientMessageId: outcome.clientMessageId,
             state: 'rejected',
-            reason: outcome.reason,
+            ...agentSessionFailureWords(agentSessionFailureFact('notDelivered'), {
+              surface: 'rejection'
+            }),
             fence: input.fence,
             recovered: true
           }
diff --git a/src/main/native-chat/agent-session-journal/journal-row-builders.ts b/src/main/native-chat/agent-session-journal/journal-row-builders.ts
index e17ccf0cdf8..46d41ecb7cf 100644
--- a/src/main/native-chat/agent-session-journal/journal-row-builders.ts
+++ b/src/main/native-chat/agent-session-journal/journal-row-builders.ts
@@ -1,9 +1,10 @@
 import type {
-  AgentJournalDispatchState,
   AgentJournalItemBody,
   AgentJournalItemIdentity,
   AgentJournalMessageItem,
   AgentJournalProducerLinkage,
+  AgentJournalRowAttribution,
+  AgentJournalTurnScope,
   AgentSessionProviderHandle
 } from '../../../shared/agent-session-journal-types'
 import { journalRowSchemaVersion } from '../../../shared/agent-session-journal-types'
@@ -26,6 +27,7 @@ import {
   MAX_JOURNAL_LIFECYCLE_BATCH_MUTATIONS
 } from './journal-row-schema'
 import { boundInlineText, DEFAULT_JOURNAL_PAYLOAD_LIMITS } from './journal-payload-bounds'
+import { assertSubmissionIdUnused } from './journal-write-guards'
 import type { ResolveDispatchInput } from './journal-store-contracts'
 
 type RowBuilder<T> = (seq: number, ts: number) => T
@@ -34,7 +36,7 @@ export function journalItemRowBuilder(
   state: () => JournalReducerState,
   identity: AgentJournalItemIdentity,
   body: AgentJournalItemBody,
-  options: AgentJournalProducerLinkage & { fence: number; observedAt?: number; recovered?: true }
+  options: AgentJournalRowAttribution & { fence: number; observedAt?: number; recovered?: true }
 ): RowBuilder<JournalItemRow> {
   return (seq, ts) =>
     buildJournalItemRow({
@@ -45,7 +47,8 @@ export function journalItemRowBuilder(
       fence: options.fence,
       ts: options.observedAt ?? ts,
       recovered: options.recovered,
-      linkage: options
+      linkage: options,
+      turnScope: options.turnScope
     })
 }
 
@@ -65,10 +68,29 @@ export function journalSubmissionRowBuilder(
     payloadFingerprint: string
     body: AgentJournalMessageItem
     fence: number
-  }
+    handoverRecorded?: true
+    queuedMessageId?: string
+    origin?: 'client' | 'host'
+  },
+  /** Present when the append hands off a queued draft: the row names that draft, stamped here
+   *  from the consume itself so no hand-off path can leave the link off. */
+  consume?: { messageId: string }
 ): RowBuilder<JournalSubmissionRow> {
-  return (seq, ts) =>
-    buildJournalSubmissionRow({ state: state(), providerHandle, ...input, seq, ts })
+  return (seq, ts) => {
+    assertSubmissionIdUnused(state().submissions, input.clientMessageId)
+    if (consume && (input.queuedMessageId ?? consume.messageId) !== consume.messageId) {
+      throw new Error(`submission ${input.clientMessageId} names a draft it does not consume`)
+    }
+    const queuedMessageId = consume?.messageId ?? input.queuedMessageId
+    return buildJournalSubmissionRow({
+      state: state(),
+      providerHandle,
+      ...input,
+      ...(queuedMessageId !== undefined ? { queuedMessageId } : {}),
+      seq,
+      ts
+    })
+  }
 }
 
 export function journalDispatchRowBuilder(
@@ -76,24 +98,26 @@ export function journalDispatchRowBuilder(
   input: ResolveDispatchInput
 ): RowBuilder<JournalDispatchRow> {
   const providerItemId =
-    input.state === 'accepted' ? agentJournalItemKey(input.providerIdentity) : null
-  return (seq, ts) =>
-    buildJournalDispatchRow({
-      state: state(),
-      clientMessageId: input.clientMessageId,
-      dispatchState: input.state,
-      providerItemId,
-      reason: boundedDispatchReason(input),
-      seq,
-      fence: input.fence,
-      ts,
-      recovered: input.recovered
-    })
+    input.state === 'accepted' && input.providerIdentity
+      ? agentJournalItemKey(input.providerIdentity)
+      : null
+  // The only dispatch-row builder: its input type is what makes a rejected row carry its fact.
+  return (seq, ts) => ({
+    kind: 'dispatch',
+    clientMessageId: input.clientMessageId,
+    state: input.state,
+    providerItemId,
+    reason: boundedDispatchReason(input),
+    ...(input.state === 'rejected' ? { rejection: input.rejection } : {}),
+    ...journalRowBase(state().epoch, seq, input.fence, ts),
+    ...(input.recovered ? { recovered: input.recovered } : {}),
+    ...(input.state === 'pending' ? { turnScope: input.turnScope } : {})
+  })
 }
 
 /** `reason` is the only unbounded field written by Orca's own code: a provider error is
  *  arbitrary text, and a multi-megabyte one reached the row verbatim. Bounded head-first,
- *  because `dispatchRejectionWasTransportWriteFailure` prefix-matches the value. Rows
+ *  because `isWriteFailureSubmission` prefix-matches the value. Rows
  *  written before this keep their full text, so readers still meet unbounded ones. */
 function boundedDispatchReason(input: ResolveDispatchInput): string | null {
   if (input.state === 'accepted' || input.state === 'pending' || !input.reason) {
@@ -110,6 +134,8 @@ export type JournalLifecycleMutationInput =
       /** Who wrote the row. Absent ⇒ the session's own agent on a first write,
        *  and the row's existing producer on a revision. */
       linkage?: AgentJournalProducerLinkage
+      /** Which turn the row belongs to. Kept from the write that creates the row. */
+      turnScope: AgentJournalTurnScope
     }
   | { kind: 'tombstone'; identity: AgentJournalItemIdentity }
 
@@ -118,13 +144,14 @@ export type JournalLifecycleMutationInput =
  *  settled before any checkpoint landed — and one batch can mix producers.
  *  The session's own rows carry no key at all: absence is the claim. */
 export function journalLifecycleItemMutation(
-  producer: AgentJournalProducerLinkage,
+  attribution: AgentJournalRowAttribution,
   identity: AgentJournalItemIdentity,
   body: AgentJournalItemBody
 ): JournalLifecycleMutationInput {
-  return namesAgentJournalProducer(producer)
-    ? { kind: 'item', identity, body, linkage: agentJournalLinkageFields(producer) }
-    : { kind: 'item', identity, body }
+  const { turnScope } = attribution
+  return namesAgentJournalProducer(attribution)
+    ? { kind: 'item', identity, body, turnScope, linkage: agentJournalLinkageFields(attribution) }
+    : { kind: 'item', identity, body, turnScope }
 }
 
 /** The persisted form of one mutation, shared with the partitioner's size probe
@@ -140,6 +167,7 @@ export function journalLifecycleMutationRow(
         itemId,
         revision,
         body: mutation.body,
+        turnScope: mutation.turnScope,
         ...agentJournalLinkageFields(mutation.linkage)
       }
     : { kind: 'tombstone', itemId, revision }
@@ -213,6 +241,7 @@ export function buildJournalItemRow(input: {
   ts: number
   recovered?: true
   linkage?: AgentJournalProducerLinkage
+  turnScope: AgentJournalTurnScope
 }): JournalItemRow {
   const itemId = agentJournalItemKey(input.identity)
   const resolved = input.state.aliases.get(itemId) ?? itemId
@@ -230,6 +259,7 @@ export function buildJournalItemRow(input: {
     body: input.body,
     ...journalRowBase(input.state.epoch, input.seq, input.fence, input.ts, [input.body]),
     ...(input.recovered ? { recovered: input.recovered } : {}),
+    turnScope: input.turnScope,
     ...agentJournalLinkageFields(input.linkage)
   }
 }
@@ -267,6 +297,9 @@ export function buildJournalSubmissionRow(input: {
   seq: number
   fence: number
   ts: number
+  handoverRecorded?: true
+  queuedMessageId?: string
+  origin?: 'client' | 'host'
 }): JournalSubmissionRow {
   return {
     kind: 'submission',
@@ -274,28 +307,9 @@ export function buildJournalSubmissionRow(input: {
     payloadFingerprint: input.payloadFingerprint,
     providerHandle: input.providerHandle,
     body: input.body,
-    ...journalRowBase(input.state.epoch, input.seq, input.fence, input.ts)
-  }
-}
-
-export function buildJournalDispatchRow(input: {
-  state: JournalReducerState
-  clientMessageId: string
-  dispatchState: AgentJournalDispatchState
-  providerItemId: string | null
-  reason: string | null
-  seq: number
-  fence: number
-  ts: number
-  recovered?: true
-}): JournalDispatchRow {
-  return {
-    kind: 'dispatch',
-    clientMessageId: input.clientMessageId,
-    state: input.dispatchState,
-    providerItemId: input.providerItemId,
-    reason: input.reason,
     ...journalRowBase(input.state.epoch, input.seq, input.fence, input.ts),
-    ...(input.recovered ? { recovered: input.recovered } : {})
+    ...(input.handoverRecorded ? { handoverRecorded: true } : {}),
+    ...(input.queuedMessageId !== undefined ? { queuedMessageId: input.queuedMessageId } : {}),
+    ...(input.origin !== undefined ? { origin: input.origin } : {})
   }
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-row-context-usage.test.ts b/src/main/native-chat/agent-session-journal/journal-row-context-usage.test.ts
index fe23a5ddcb5..6ebc20e5a33 100644
--- a/src/main/native-chat/agent-session-journal/journal-row-context-usage.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-row-context-usage.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // Context facts ride turn rows. Every kind the writer produces must replay, and
 // one this build cannot read must cost the fact, never the row or the journal.
 
@@ -91,7 +92,10 @@ describe('context facts on replayed turn rows', () => {
   it('replays every part and kind the writer produces, unchanged', async () => {
     const journal = await open()
     for (const [index, facts] of FACTS.entries()) {
-      await journal.appendItem(row(index), turn(`turn-${index}`, facts), { fence: 1 })
+      await journal.appendItem(row(index), turn(`turn-${index}`, facts), {
+        fence: 1,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
     }
     const written = journal.snapshot().items.map((item) => item.body)
     await journal.close()
@@ -104,11 +108,14 @@ describe('context facts on replayed turn rows', () => {
 
   it('keeps a turn row whose facts it cannot read, and everything after it, minus the facts', async () => {
     const journal = await open()
-    await journal.appendItem(row(0), turn('turn-0', FACTS[0]), { fence: 1 })
+    await journal.appendItem(row(0), turn('turn-0', FACTS[0]), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     await journal.appendItem(
       row(1),
       { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'after' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await journal.close()
     const opened = openJournalDatabase(journalDatabaseFile(root))
diff --git a/src/main/native-chat/agent-session-journal/journal-row-schema-version.test.ts b/src/main/native-chat/agent-session-journal/journal-row-schema-version.test.ts
index b764ebd5ec9..f49dda6dcb6 100644
--- a/src/main/native-chat/agent-session-journal/journal-row-schema-version.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-row-schema-version.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -39,12 +40,12 @@ describe('journal row schema versions', () => {
     await journal.appendItem(
       identity,
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hi' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await journal.appendItem(
       { provider: 'legacy', agent: 'codex', sessionId: 'session-1', recordId: 'turn-lifecycle:t1' },
       agentJournalTurnBody({ turnId: 't1', state: 'running', startedAt: 1_000 }),
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await journal.close()
     const opened = openJournalDatabase(journalDatabaseFile(join(root, 'session-1')))
diff --git a/src/main/native-chat/agent-session-journal/journal-row-schema.test.ts b/src/main/native-chat/agent-session-journal/journal-row-schema.test.ts
index 870b5259357..1d013255b21 100644
--- a/src/main/native-chat/agent-session-journal/journal-row-schema.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-row-schema.test.ts
@@ -1,5 +1,8 @@
 import { describe, expect, it } from 'vitest'
-import { AGENT_SESSION_JOURNAL_SCHEMA_VERSION } from '../../../shared/agent-session-journal-types'
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  AGENT_SESSION_JOURNAL_SCHEMA_VERSION
+} from '../../../shared/agent-session-journal-types'
 import {
   MAX_JOURNAL_LIFECYCLE_BATCH_MUTATIONS,
   parseJournalRow,
@@ -277,7 +280,8 @@ describe('producer linkage on the persisted row', () => {
       seq: 1,
       fence: 1,
       ts: 1_700_000_000_000,
-      ...(withLinkage ? { linkage } : {})
+      ...(withLinkage ? { linkage } : {}),
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
     })
     const parsed = parseJournalRow(JSON.stringify(row))
     return parsed.ok ? parsed.row : null
@@ -348,10 +352,21 @@ describe('producer linkage on the persisted row', () => {
 
   it('round-trips a batch mutation that names its own producer, with no version bump', () => {
     const state = createJournalReducerState('session-1', 'epoch-1')
-    const own = { kind: 'item' as const, identity: { ...identity, uuid: 'u-own' }, body }
+    const own = {
+      kind: 'item' as const,
+      identity: { ...identity, uuid: 'u-own' },
+      body,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    }
     const build = (child: JournalLifecycleMutationInput) =>
       journalLifecycleBatchRowBuilder(() => state, 'settle-1', [child, own], { fence: 1 })(1, 1)
-    const row = build({ kind: 'item', identity, body, linkage })
+    const row = build({
+      kind: 'item',
+      identity,
+      body,
+      linkage,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
 
     const parsed = parseJournalRow(JSON.stringify(row))
     const mutations = parsed.ok && parsed.row.kind === 'lifecycle-batch' ? parsed.row.mutations : []
@@ -359,7 +374,9 @@ describe('producer linkage on the persisted row', () => {
     expect(mutations[1] && 'agentId' in mutations[1]).toBe(false)
     // The same batch without the stamp writes the same version: an older host
     // ignores the unknown keys rather than latching the journal read-only.
-    expect(row.v).toBe(build({ kind: 'item', identity, body }).v)
+    expect(row.v).toBe(
+      build({ kind: 'item', identity, body, turnScope: AGENT_JOURNAL_THREAD_SCOPE }).v
+    )
   })
 
   it('keeps a batch mutation but drops its unusable producer id', () => {
diff --git a/src/main/native-chat/agent-session-journal/journal-row-schema.ts b/src/main/native-chat/agent-session-journal/journal-row-schema.ts
index 99cb47971e9..1c7ea36eaef 100644
--- a/src/main/native-chat/agent-session-journal/journal-row-schema.ts
+++ b/src/main/native-chat/agent-session-journal/journal-row-schema.ts
@@ -5,12 +5,14 @@
 // UNREADABLE, not skippable: the caller must degrade to read-only rather than
 // render a partial timeline or compact past a row it cannot interpret.
 
+import type { AgentSessionFailureFact } from '../../../shared/agent-session-failure'
 import {
   AGENT_SESSION_JOURNAL_SCHEMA_VERSION,
   type AgentJournalDispatchState,
   type AgentJournalItemBody,
   type AgentJournalMessageItem,
   type AgentJournalProducerLinkage,
+  type AgentJournalTurnScope,
   type AgentSessionProviderHandle
 } from '../../../shared/agent-session-journal-types'
 import {
@@ -36,6 +38,10 @@ type JournalRowBase = AgentJournalProducerLinkage & {
   ts: number
   /** Set when crash reconciliation appended the row after the fact. */
   recovered?: true
+  /** Which turn the item this row creates belongs to. Rides the base, and is not a `v` bump,
+   *  for the reason linkage does. Absent on rows from hosts that predate it: the reducer
+   *  derives one for them on read. */
+  turnScope?: AgentJournalTurnScope
 }
 
 /** First row of every epoch: binds the epoch to a provider handle and records why it opened. */
@@ -77,8 +83,21 @@ export type JournalSubmissionRow = JournalRowBase & {
   payloadFingerprint: string
   providerHandle: AgentSessionProviderHandle
   body: AgentJournalMessageItem
+  /** Accepted to be handed over by a later `dispatch{pending}` row; absent on rows whose writer
+   *  dispatched in the same step. Older readers keep the key and ignore it. */
+  handoverRecorded?: true
+  /** The queued draft this submission hands off; absent for a direct send. Older readers keep
+   *  the key and ignore it. */
+  queuedMessageId?: string
+  /** Who asked for this turn: `client` for a person's send over the client send RPC (typed, or
+   *  a queued card they sent now); `host` for Orca's own — orchestration mail, a restart
+   *  continuation, a launch prompt, the queue's automatic drain. Absent on rows from before it
+   *  was recorded. Older readers keep the key and ignore it. */
+  origin?: JournalSubmissionOrigin
 }
 
+export type JournalSubmissionOrigin = 'client' | 'host'
+
 export type JournalDispatchRow = JournalRowBase & {
   kind: 'dispatch'
   clientMessageId: string
@@ -86,6 +105,11 @@ export type JournalDispatchRow = JournalRowBase & {
   /** Provider item identity adopted on accept. */
   providerItemId: string | null
   reason: string | null
+  /** On `pending`: the turn the message was handed into, which becomes its row's scope. */
+  turnScope?: AgentJournalTurnScope
+  /** On `rejected`: why, typed. Older readers keep the key and ignore it; a malformed one is
+   *  dropped when read, never the row. */
+  rejection?: AgentSessionFailureFact
 }
 
 /** An item mutation may name its own producer, because one batch can CREATE
@@ -98,6 +122,7 @@ export type JournalLifecycleMutation =
       itemId: string
       revision: number
       body: AgentJournalItemBody
+      turnScope?: AgentJournalTurnScope
     })
   | { kind: 'tombstone'; itemId: string; revision: number }
 
@@ -163,10 +188,12 @@ export function parseJournalRow(line: string): JournalRowParse {
   }
   const upcast = upcastRow(record, version)
   dropUnusableProducerLinkage(upcast)
+  dropUnusableTurnScope(upcast)
   if (upcast.kind === 'lifecycle-batch' && Array.isArray(upcast.mutations)) {
     for (const mutation of upcast.mutations) {
       if (isPlainObject(mutation)) {
         dropUnusableProducerLinkage(mutation)
+        dropUnusableTurnScope(mutation)
       }
     }
   }
@@ -195,6 +222,24 @@ function dropUnusableProducerLinkage(record: Record<string, unknown>): void {
   }
 }
 
+/** A scope this build cannot place, removed like unusable linkage: the row then reads as one
+ *  written before scopes existed, and the reducer derives its scope. */
+function dropUnusableTurnScope(record: Record<string, unknown>): void {
+  const scope = record.turnScope
+  if (
+    scope !== undefined &&
+    !(
+      isPlainObject(scope) &&
+      (scope.kind === 'thread' ||
+        (scope.kind === 'turn' &&
+          typeof scope.turnItemId === 'string' &&
+          scope.turnItemId.length > 0))
+    )
+  ) {
+    delete record.turnScope
+  }
+}
+
 /** Context facts this build cannot read, removed from the turn row that carries
  *  them. Same reasoning as linkage: they are an annotation on the turn, and
  *  rejecting the row for them would truncate the journal from that row on. */
diff --git a/src/main/native-chat/agent-session-journal/journal-row-writer.ts b/src/main/native-chat/agent-session-journal/journal-row-writer.ts
index 85ff7da7a3f..b45a841d26e 100644
--- a/src/main/native-chat/agent-session-journal/journal-row-writer.ts
+++ b/src/main/native-chat/agent-session-journal/journal-row-writer.ts
@@ -1,8 +1,14 @@
 import type Database from '../../sqlite/sync-database'
 import { insertJournalRow, upsertJournalSessionRow } from './journal-row-table'
+import type { AgentJournalCursor } from '../../../shared/agent-session-journal-types'
 import type { JournalRow } from './journal-row-schema'
 import { assertJournalFence, assertJournalWritable } from './journal-write-guards'
 
+/** Runs between BEGIN IMMEDIATE and COMMIT, on the SAME connection as the row
+ *  insert; a throw rolls the whole append back. Synchronous by construction so
+ *  nothing can interleave inside the transaction. */
+export type JournalRowTransactionHook = (db: Database.Database, row: JournalRow) => void
+
 export type JournalRowWriterDeps = {
   sessionId: string
   now: () => number
@@ -12,12 +18,23 @@ export type JournalRowWriterDeps = {
   highestFence: () => number
   nextSequence: () => number
   commit: (row: JournalRow) => void
+  /** Standing hook run for EVERY appended row — the queued-draft returned
+   *  transition rides here so no rejection path can bypass it. Bookkeeping: it
+   *  runs in its own savepoint, so its failure is reported and never vetoes the row. */
+  inTransaction?: JournalRowTransactionHook
+  /** After any rollback, so a cache filled inside the transaction cannot outlive it. */
+  rolledBack?: () => void
 }
 
+const BOOKKEEPING_SAVEPOINT = 'journal_row_bookkeeping'
+
 export class JournalRowWriter {
   constructor(private readonly deps: JournalRowWriterDeps) {}
 
-  enqueue(build: (seq: number, ts: number) => JournalRow): Promise<JournalRow> {
+  enqueue(
+    build: (seq: number, ts: number) => JournalRow,
+    hook?: JournalRowTransactionHook
+  ): Promise<JournalRow> {
     return this.deps.serialize(async () => {
       assertJournalWritable(this.deps.readOnly(), this.deps.sessionId)
       const row = build(this.deps.nextSequence(), this.deps.now())
@@ -27,9 +44,12 @@ export class JournalRowWriter {
       try {
         insertJournalRow(db, this.deps.sessionId, row)
         upsertJournalSessionRow(db, this.deps.sessionId, row.epoch, row.ts)
+        hook?.(db, row)
+        this.runBookkeeping(db, row)
         db.exec('COMMIT')
       } catch (error) {
         db.exec('ROLLBACK')
+        this.deps.rolledBack?.()
         throw error
       }
       // COMMIT landed, so the row is durable: adopt it before anything that can
@@ -39,4 +59,36 @@ export class JournalRowWriter {
       return row
     })
   }
+
+  /** Assign the next sequence, make the row durable, and fold it through the SAME reducer
+   *  replay uses — all inside one serialized step — answering where the row landed. */
+  append(
+    build: (seq: number, ts: number) => JournalRow,
+    hook?: JournalRowTransactionHook
+  ): Promise<AgentJournalCursor> {
+    return this.enqueue(build, hook).then((row) => ({ epoch: row.epoch, sequence: row.seq }))
+  }
+
+  private runBookkeeping(db: Database.Database, row: JournalRow): void {
+    const hook = this.deps.inTransaction
+    if (!hook) {
+      return
+    }
+    db.exec(`SAVEPOINT ${BOOKKEEPING_SAVEPOINT}`)
+    try {
+      hook(db, row)
+      db.exec(`RELEASE ${BOOKKEEPING_SAVEPOINT}`)
+    } catch (error) {
+      db.exec(`ROLLBACK TO ${BOOKKEEPING_SAVEPOINT}`)
+      db.exec(`RELEASE ${BOOKKEEPING_SAVEPOINT}`)
+      this.deps.rolledBack?.()
+      // The draft store re-derives what this missed from the committed rows: at open, and in
+      // the drain step before a draft sends.
+      console.warn('[journal-append] row bookkeeping skipped:', {
+        sessionId: this.deps.sessionId,
+        kind: row.kind,
+        error: error instanceof Error ? error.message : String(error)
+      })
+    }
+  }
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-store-close.test.ts b/src/main/native-chat/agent-session-journal/journal-store-close.test.ts
index 960c65a638a..5ab255749c1 100644
--- a/src/main/native-chat/agent-session-journal/journal-store-close.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store-close.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // `close()`: enqueue-time admission, and the fulfilled/rejected split.
 //
 // The two failures this file exists to prevent: an append enqueued in the same
@@ -13,6 +14,8 @@ import type {
   AgentJournalItemIdentity,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
 import { journalDatabaseFile } from './journal-paths'
 import type { AgentSessionJournal } from './journal-store'
 import { createTrackedJournalOpener } from './journal-store-test-open'
@@ -78,7 +81,10 @@ afterEach(async () => {
 describe('closed-state admission happens at enqueue', () => {
   it('completes a write enqueued in the same turn as the close', async () => {
     const journal = await openJournal()
-    const append = journal.appendItem(item(1), body('before'), { fence: 1 })
+    const append = journal.appendItem(item(1), body('before'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     const closed = journal.close()
 
     await expect(append).resolves.toBeDefined()
@@ -90,7 +96,10 @@ describe('closed-state admission happens at enqueue', () => {
   it('refuses a write offered while the close is still in flight, without queueing it', async () => {
     const journal = await openJournal()
     const closing = journal.close()
-    const refused = journal.appendItem(item(1), body('during'), { fence: 1 })
+    const refused = journal.appendItem(item(1), body('during'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
 
     // The rejection is available before the close step has run: it never joined
     // the queue, so nothing is ever chained behind a close.
@@ -107,7 +116,12 @@ describe('closed-state admission happens at enqueue', () => {
         (error: unknown) => error
       )
     const refusals = [
-      settle(journal.appendItem(item(1), body('after'), { fence: 1 })),
+      settle(
+        journal.appendItem(item(1), body('after'), {
+          fence: 1,
+          turnScope: AGENT_JOURNAL_THREAD_SCOPE
+        })
+      ),
       settle(journal.appendTombstone(item(3), { fence: 1 })),
       settle(
         journal.appendSubmission({
@@ -117,12 +131,28 @@ describe('closed-state admission happens at enqueue', () => {
           fence: 1
         })
       ),
-      settle(journal.resolveDispatch({ clientMessageId: 'cm_1', state: 'rejected', fence: 1 })),
+      settle(
+        journal.resolveDispatch({
+          clientMessageId: 'cm_1',
+          state: 'rejected',
+          ...agentSessionFailureWords(agentSessionFailureFact('hostFault'), {
+            surface: 'rejection'
+          }),
+          fence: 1
+        })
+      ),
       settle(
         journal.appendLifecycleBatch({
           settlementId: 'settle',
           fence: 1,
-          mutations: [{ kind: 'item', identity: item(4), body: body('x') }]
+          mutations: [
+            {
+              kind: 'item',
+              identity: item(4),
+              body: body('x'),
+              turnScope: AGENT_JOURNAL_THREAD_SCOPE
+            }
+          ]
         })
       ),
       settle(journal.rollEpoch('handle_forked', 1)),
@@ -137,12 +167,20 @@ describe('closed-state admission happens at enqueue', () => {
   // caller's own turn, so a refusal never advances the queue.
   it('rejects without waiting for the queue to advance', async () => {
     const journal = await openJournal()
-    const inFlight = journal.appendItem(item(1), body('admitted'), { fence: 1 })
+    const inFlight = journal.appendItem(item(1), body('admitted'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     const closing = journal.close()
 
     // Settles while the admitted append is still running: it reached the gate in
     // the caller's own turn and never joined the queue behind it.
-    await expect(journal.appendItem(item(2), body('later'), { fence: 1 })).rejects.toMatchObject({
+    await expect(
+      journal.appendItem(item(2), body('later'), {
+        fence: 1,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
+    ).rejects.toMatchObject({
       code: 'journal_closed'
     })
     await expect(inFlight).resolves.toBeDefined()
@@ -164,7 +202,10 @@ describe('closed-state admission happens at enqueue', () => {
 describe('a rejected close is a real retry', () => {
   it('retries the release, releases the handle, and then goes terminal', async () => {
     const journal = await openJournal()
-    await journal.appendItem(item(1), body('durable'), { fence: 1 })
+    await journal.appendItem(item(1), body('durable'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     const injected = injectReleaseFailure(journal)
 
     await expect(journal.close()).rejects.toThrow('injected release failure')
@@ -172,7 +213,12 @@ describe('a rejected close is a real retry', () => {
 
     // Write-closed anyway: retry exists to release the OS handle, never to
     // resurrect the store.
-    await expect(journal.appendItem(item(2), body('after'), { fence: 1 })).rejects.toMatchObject({
+    await expect(
+      journal.appendItem(item(2), body('after'), {
+        fence: 1,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
+    ).rejects.toMatchObject({
       code: 'journal_closed'
     })
 
diff --git a/src/main/native-chat/agent-session-journal/journal-store-collaborators.ts b/src/main/native-chat/agent-session-journal/journal-store-collaborators.ts
index a4ff455b31f..42d167914ce 100644
--- a/src/main/native-chat/agent-session-journal/journal-store-collaborators.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store-collaborators.ts
@@ -12,6 +12,7 @@ import { JournalEpochController } from './journal-epoch-controller'
 import { JournalItemAppender } from './journal-item-appender'
 import { JournalLifecycleBatchAppender } from './journal-lifecycle-batch-appender'
 import type { JournalLoad } from './journal-open'
+import { JournalQueuedMessages } from './journal-queued-messages'
 import type { JournalReducerState } from './journal-reducer'
 import { JournalRowWriter } from './journal-row-writer'
 import { restoreJournalStore } from './journal-store-restore'
@@ -19,6 +20,10 @@ import type { JournalRow } from './journal-row-schema'
 import type { AgentSessionJournal } from './journal-store'
 
 export type JournalStoreHost = {
+  /** Fires the journal's commit listener for a durable change that appended no
+   *  row — a standalone draft-table transaction — so readers learn of it the
+   *  same way they learn of a row. */
+  notifyCommitted: () => void
   identity: AgentSessionJournalIdentity
   journalDir: string
   now: () => number
@@ -44,6 +49,7 @@ export type JournalStoreCollaborators = {
   epochController: JournalEpochController
   itemAppender: JournalItemAppender
   lifecycleBatchAppender: JournalLifecycleBatchAppender
+  queuedMessages: JournalQueuedMessages
   /** Restores the store's state from disk. Owned here because it needs the same
    *  collaborators the constructor just built. */
   restore: () => Promise<void>
@@ -62,9 +68,24 @@ export function createJournalStoreCollaborators(host: JournalStoreHost): Journal
     cursor: host.cursor,
     adopt: host.adopt
   })
+  const queuedMessages = new JournalQueuedMessages({
+    sessionId: host.identity.sessionId,
+    now: host.now,
+    serialize: host.serialize,
+    database: host.database,
+    readOnly: host.readOnly,
+    state: host.state,
+    committed: host.notifyCommitted
+  })
   return {
     epochController,
-    restore: () => restoreJournalStore(host, { epochController }),
+    queuedMessages,
+    // Behind the stored fact: settles drafts whose consumed submission the loaded journal shows
+    // refused (a downgrade wrote no hook), then prunes. Bookkeeping, never failing the open.
+    restore: () =>
+      restoreJournalStore(host, { epochController }).then(() =>
+        queuedMessages.repairAndPruneAtOpen()
+      ),
     rowWriter: new JournalRowWriter({
       sessionId: host.identity.sessionId,
       now: host.now,
@@ -73,7 +94,11 @@ export function createJournalStoreCollaborators(host: JournalStoreHost): Journal
       readOnly: host.readOnly,
       highestFence: () => host.state().highestFence,
       nextSequence: () => host.state().lastSequence + 1,
-      commit: host.commit
+      commit: host.commit,
+      // Every rejection is a dispatch row through this one writer; the draft
+      // returned-transition rides it so no path can bypass the hook.
+      inTransaction: (db, row) => queuedMessages.onRowInTransaction(db, row),
+      rolledBack: () => queuedMessages.invalidate()
     }),
     itemAppender: new JournalItemAppender({
       state: host.state,
diff --git a/src/main/native-chat/agent-session-journal/journal-store-contracts.ts b/src/main/native-chat/agent-session-journal/journal-store-contracts.ts
index cea47e381fe..dcb6a4bd5d1 100644
--- a/src/main/native-chat/agent-session-journal/journal-store-contracts.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store-contracts.ts
@@ -1,10 +1,12 @@
+import type { AgentJournalDispatchRejection } from '../../../shared/agent-session-failure-words'
 import type {
   AgentJournalCursor,
   AgentJournalItemBody,
   AgentJournalItemIdentity,
   AgentJournalMessageItem,
-  AgentJournalProducerLinkage,
   AgentJournalResetReason,
+  AgentJournalRowAttribution,
+  AgentJournalTurnScope,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
 import type { JournalLoad } from './journal-open'
@@ -28,11 +30,18 @@ export type ResolveDispatchInput = {
   clientMessageId: string
   fence: number
   recovered?: true
-} & (
-  | { state: 'accepted'; providerIdentity: AgentJournalItemIdentity }
-  | { state: 'pending' }
-  | { state: 'rejected' | 'unknown'; reason?: string | null }
-)
+} &
+  /** A null identity: the provider took the message without echoing an item of its own, as a
+   *  conversation command it carries out in place. */
+  (
+    | { state: 'accepted'; providerIdentity: AgentJournalItemIdentity | null }
+    /** The turn the message is handed into — the live root turn, or `thread` when none runs. */
+    | { state: 'pending'; turnScope: AgentJournalTurnScope }
+    /** `reason` is what released clients print, `rejection` what newer ones read: both from
+     *  `agentSessionFailureWords`, never written by hand. */
+    | ({ state: 'rejected' } & AgentJournalDispatchRejection)
+    | { state: 'unknown'; reason?: string | null }
+  )
 
 export type JournalAppendResult = {
   cursor: AgentJournalCursor
@@ -40,7 +49,7 @@ export type JournalAppendResult = {
   revision: number
 }
 
-export type JournalItemAppendOptions = AgentJournalProducerLinkage & {
+export type JournalItemAppendOptions = AgentJournalRowAttribution & {
   fence: number
   observedAt?: number
   recovered?: true
@@ -59,6 +68,23 @@ export type JournalSubmissionInput = {
   payloadFingerprint: string
   body: AgentJournalMessageItem
   fence: number
+  /** The send is accepted now and handed over later, by a `dispatch{pending}` row. */
+  handoverRecorded?: true
+  /** Stamped by `appendSubmission` from its consume; a caller-passed value must match it. */
+  queuedMessageId?: string
+  /** Who asked for this turn (`JournalSubmissionRow.origin`). */
+  origin?: 'client' | 'host'
+}
+
+/** A submission append that converts a queued draft, in one transaction. */
+export type JournalSubmissionConsume = {
+  messageId: string
+  expect: 'waiting' | 'returned'
+  /** The operation ledger's caller-scoped key; null for the host's own drain. */
+  settledByOp: string | null
+  /** The host process handing it off, stamped on the draft so a hand-off withdrawn back to
+   *  waiting belongs to the process that sent it, not the one that first wrote the card. */
+  hostInstance?: string
 }
 
 export type JournalItemAppendInput = {
diff --git a/src/main/native-chat/agent-session-journal/journal-store-restore.ts b/src/main/native-chat/agent-session-journal/journal-store-restore.ts
index fc69dd339d8..1b6f3a260a3 100644
--- a/src/main/native-chat/agent-session-journal/journal-store-restore.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store-restore.ts
@@ -6,6 +6,7 @@
 // same host the collaborators use, so the store keeps the state and this owns
 // the sequence.
 
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import type { JournalEpochController } from './journal-epoch-controller'
 import { replayJournal } from './journal-open'
 import type { JournalStoreHost } from './journal-store-collaborators'
@@ -39,7 +40,9 @@ export function restoreJournalStore(
     publishRepairEpoch: () =>
       collaborators.epochController.start('unreconcilable_prefix', host.state().highestFence),
     adopt: host.adopt,
-    appendItem: (identity, body, fence) => host.journal().appendItem(identity, body, { fence }),
+    // Repair and file-format notices are about the conversation, not any turn in it.
+    appendItem: (identity, body, fence) =>
+      host.journal().appendItem(identity, body, { fence, turnScope: AGENT_JOURNAL_THREAD_SCOPE }),
     agent: host.identity.agent,
     highestFence: () => host.state().highestFence,
     malformedRows: host.malformedRows,
diff --git a/src/main/native-chat/agent-session-journal/journal-store-schema.test.ts b/src/main/native-chat/agent-session-journal/journal-store-schema.test.ts
index df34ef73e73..daa2e819647 100644
--- a/src/main/native-chat/agent-session-journal/journal-store-schema.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store-schema.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // Two independent version axes, both fail closed.
 //
 //   `PRAGMA user_version`  the DB SHAPE, known before the first read
@@ -86,14 +87,19 @@ afterEach(async () => {
 describe('axis 1: the database shape', () => {
   it('latches read-only on a newer user_version and writes nothing', async () => {
     const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
+    await journal.appendItem(item(0), body('a'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     await journal.close()
     await withDatabase((db) => db.pragma(`user_version = ${JOURNAL_DB_SCHEMA_VERSION + 1}`))
     const before = await stat(journalDatabaseFile(root))
 
     const reopened = await open()
     expect(reopened.isReadOnly).toBe(true)
-    await expect(reopened.appendItem(item(1), body('b'), { fence: 1 })).rejects.toMatchObject({
+    await expect(
+      reopened.appendItem(item(1), body('b'), { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE })
+    ).rejects.toMatchObject({
       code: 'journal_read_only'
     })
     // The file this build must not touch is byte-identical afterwards.
@@ -120,7 +126,10 @@ describe('axis 1: the database shape', () => {
 
   it('migrates an older user_version forward on reopen', async () => {
     const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
+    await journal.appendItem(item(0), body('a'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     await journal.close()
     await withDatabase((db) => db.pragma('user_version = 0'))
 
@@ -137,7 +146,10 @@ describe('axis 1: the database shape', () => {
 describe('axis 2: the row body shape', () => {
   it('degrades to read-only on a row from a newer build, without skipping it', async () => {
     const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
+    await journal.appendItem(item(0), body('a'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     const epoch = journal.epoch
     const nextSeq = journal.cursor().sequence + 1
     await journal.close()
@@ -159,7 +171,9 @@ describe('axis 2: the row body shape', () => {
 
     const reopened = await open()
     expect(reopened.isReadOnly).toBe(true)
-    await expect(reopened.appendItem(item(1), body('b'), { fence: 1 })).rejects.toMatchObject({
+    await expect(
+      reopened.appendItem(item(1), body('b'), { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE })
+    ).rejects.toMatchObject({
       code: 'journal_read_only'
     })
     await reopened.close()
@@ -174,7 +188,10 @@ describe('axis 2: the row body shape', () => {
 
   it('skips a malformed row without giving up the journal, and discloses the skip', async () => {
     const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
+    await journal.appendItem(item(0), body('a'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     const epoch = journal.epoch
     const nextSeq = journal.cursor().sequence + 1
     await journal.close()
@@ -195,7 +212,10 @@ describe('axis 2: the row body shape', () => {
 
   it('keeps one disclosure row across reopens instead of stacking duplicates', async () => {
     const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
+    await journal.appendItem(item(0), body('a'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     const epoch = journal.epoch
     const nextSeq = journal.cursor().sequence + 1
     await journal.close()
@@ -214,7 +234,10 @@ describe('axis 2: the row body shape', () => {
 
   it('reopens a journal holding an admitted malformed-percent item id without throwing', async () => {
     const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
+    await journal.appendItem(item(0), body('a'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     const epoch = journal.epoch
     const nextSeq = journal.cursor().sequence + 1
     await journal.close()
diff --git a/src/main/native-chat/agent-session-journal/journal-store.test.ts b/src/main/native-chat/agent-session-journal/journal-store.test.ts
index ffaea5c5d6f..67eb19f8cbe 100644
--- a/src/main/native-chat/agent-session-journal/journal-store.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { mkdtemp, readdir, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -76,7 +77,10 @@ describe('sequences', () => {
     const journal = await open()
     const results = await Promise.all(
       Array.from({ length: 25 }, (_unused, index) =>
-        journal.appendItem(item(index), body(`m${index}`), { fence: 1 })
+        journal.appendItem(item(index), body(`m${index}`), {
+          fence: 1,
+          turnScope: AGENT_JOURNAL_THREAD_SCOPE
+        })
       )
     )
     const sequences = results.map((result) => result.cursor.sequence)
@@ -89,9 +93,9 @@ describe('sequences', () => {
   it('serializes revisions of one item so the last write wins deterministically', async () => {
     const journal = await open()
     const results = await Promise.all([
-      journal.appendItem(item(0), body('a'), { fence: 1 }),
-      journal.appendItem(item(0), body('b'), { fence: 1 }),
-      journal.appendItem(item(0), body('c'), { fence: 1 })
+      journal.appendItem(item(0), body('a'), { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }),
+      journal.appendItem(item(0), body('b'), { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }),
+      journal.appendItem(item(0), body('c'), { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE })
     ])
     expect(results.map((result) => result.revision)).toEqual([1, 2, 3])
     expect(journal.snapshot().items).toHaveLength(1)
@@ -100,9 +104,18 @@ describe('sequences', () => {
 
   it('visits reduced items at their creation sequence without promoting an older revision', async () => {
     const journal = await open()
-    await journal.appendItem(item(0), body('first'), { fence: 1 })
-    const latest = await journal.appendItem(item(1), body('second'), { fence: 1 })
-    await journal.appendItem(item(0), body('first revised'), { fence: 1 })
+    await journal.appendItem(item(0), body('first'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
+    const latest = await journal.appendItem(item(1), body('second'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
+    await journal.appendItem(item(0), body('first revised'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     const visited: { itemId: string; sequence: number }[] = []
 
     journal.visitItems((itemId, sequence) => visited.push({ itemId, sequence }))
@@ -131,23 +144,26 @@ describe('sequences', () => {
     await journal.appendItem(
       turnItem('turn-1'),
       { kind: 'turn', turnId: 'turn-1', state: 'running' },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
-    await journal.appendItem(item(0), body('work'), { fence: 1 })
+    await journal.appendItem(item(0), body('work'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     await bothAgreeOn('turn-1')
 
     // The completion is a revision, so it keeps the row's creation sequence rather than moving it.
     await journal.appendItem(
       turnItem('turn-1'),
       { kind: 'turn', turnId: 'turn-1', state: 'completed' },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await bothAgreeOn(null)
 
     await journal.appendItem(
       turnItem('turn-2'),
       { kind: 'turn', turnId: 'turn-2', state: 'running' },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await bothAgreeOn('turn-2')
   })
@@ -165,8 +181,14 @@ describe('sequences', () => {
     const mimicIdentity = identityFor(digestFormMimic)
     const journal = await open()
 
-    const oversized = await journal.appendItem(oversizedIdentity, body('oversized'), { fence: 1 })
-    const mimic = await journal.appendItem(mimicIdentity, body('mimic'), { fence: 1 })
+    const oversized = await journal.appendItem(oversizedIdentity, body('oversized'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
+    const mimic = await journal.appendItem(mimicIdentity, body('mimic'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     expect(oversized.itemId).not.toBe(mimic.itemId)
     expect([oversized.revision, mimic.revision]).toEqual([1, 1])
 
@@ -187,17 +209,28 @@ describe('sequences', () => {
 describe('fences', () => {
   it('rejects an append from a writer behind the journal', async () => {
     const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 7 })
-    await expect(journal.appendItem(item(1), body('b'), { fence: 6 })).rejects.toBeInstanceOf(
-      AgentSessionJournalError
-    )
+    await journal.appendItem(item(0), body('a'), {
+      fence: 7,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
+    await expect(
+      journal.appendItem(item(1), body('b'), { fence: 6, turnScope: AGENT_JOURNAL_THREAD_SCOPE })
+    ).rejects.toBeInstanceOf(AgentSessionJournalError)
   })
 
   it('keeps accepting appends after a rejected one', async () => {
     const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 7 })
-    await journal.appendItem(item(1), body('b'), { fence: 6 }).catch(() => undefined)
-    await journal.appendItem(item(2), body('c'), { fence: 7 })
+    await journal.appendItem(item(0), body('a'), {
+      fence: 7,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
+    await journal
+      .appendItem(item(1), body('b'), { fence: 6, turnScope: AGENT_JOURNAL_THREAD_SCOPE })
+      .catch(() => undefined)
+    await journal.appendItem(item(2), body('c'), {
+      fence: 7,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     expect(journal.snapshot().items.map((entry) => entry.body)).toEqual([body('a'), body('c')])
   })
 })
@@ -205,7 +238,10 @@ describe('fences', () => {
 describe('replay', () => {
   it('adopts a caller-provided load without replaying the rows again', async () => {
     const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
+    await journal.appendItem(item(0), body('a'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     const loaded = await loadJournal(root, IDENTITY.sessionId)
     expect(loaded).not.toBeNull()
     await journal.close()
@@ -216,9 +252,18 @@ describe('replay', () => {
 
   it('reopens to the same render model the live writer held', async () => {
     const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
-    await journal.appendItem(item(1), body('b'), { fence: 1 })
-    await journal.appendItem(item(0), body('a2'), { fence: 1 })
+    await journal.appendItem(item(0), body('a'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
+    await journal.appendItem(item(1), body('b'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
+    await journal.appendItem(item(0), body('a2'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     await journal.appendTombstone(item(1), { fence: 1 })
     const live = journal.snapshot()
 
@@ -228,9 +273,15 @@ describe('replay', () => {
 
   it('serves a resume from a cursor and refuses one from a stale epoch', async () => {
     const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
+    await journal.appendItem(item(0), body('a'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     const cursor = journal.cursor()
-    await journal.appendItem(item(1), body('b'), { fence: 1 })
+    await journal.appendItem(item(1), body('b'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
 
     const resumed = journal.readSince(cursor)
     expect(resumed.ok && resumed.rows).toHaveLength(1)
@@ -241,7 +292,10 @@ describe('replay', () => {
 
   it('rebuilds from a clean epoch after a rollover', async () => {
     const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
+    await journal.appendItem(item(0), body('a'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     await journal.rollEpoch('unreconcilable_prefix', 2)
     expect(journal.snapshot().items).toHaveLength(0)
 
@@ -253,7 +307,10 @@ describe('replay', () => {
   it('keeps the intact prefix and drops the rejected suffix', async () => {
     const journal = await open()
     for (let index = 0; index < 4; index += 1) {
-      await journal.appendItem(item(index), body(`m${index}`), { fence: 1 })
+      await journal.appendItem(item(index), body(`m${index}`), {
+        fence: 1,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
     }
     const before = journal.epoch
     await journal.close()
@@ -306,7 +363,14 @@ describe('lifecycle batches', () => {
     const input = {
       settlementId: 'concurrent-settlement',
       fence: 1,
-      mutations: [{ kind: 'item' as const, identity: item(1), body: body('settled') }]
+      mutations: [
+        {
+          kind: 'item' as const,
+          identity: item(1),
+          body: body('settled'),
+          turnScope: AGENT_JOURNAL_THREAD_SCOPE
+        }
+      ]
     }
 
     const [first, replay] = await Promise.all([
@@ -325,17 +389,27 @@ describe('lifecycle batches', () => {
       sessionId: 'session-1',
       recordId: 'turn-lifecycle:turn-1'
     }
-    await journal.appendItem(turn, { kind: 'status', text: 'working' }, { fence: 1 })
+    await journal.appendItem(
+      turn,
+      { kind: 'status', text: 'working' },
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
 
     const settled = await journal.appendLifecycleBatch({
       settlementId: 'exit:turn-1',
       fence: 1,
       mutations: [
-        { kind: 'item', identity: item(1), body: body('tool settled') },
+        {
+          kind: 'item',
+          identity: item(1),
+          body: body('tool settled'),
+          turnScope: AGENT_JOURNAL_THREAD_SCOPE
+        },
         {
           kind: 'item',
           identity: { provider: 'orca', clientMessageId: 'exit-status' },
-          body: { kind: 'status', text: 'Provider exited' }
+          body: { kind: 'status', text: 'Provider exited' },
+          turnScope: AGENT_JOURNAL_THREAD_SCOPE
         },
         { kind: 'tombstone', identity: turn }
       ]
@@ -356,7 +430,14 @@ describe('lifecycle batches', () => {
     const replay = await reopened.appendLifecycleBatch({
       settlementId: 'exit:turn-1',
       fence: 1,
-      mutations: [{ kind: 'item', identity: item(9), body: body('must not appear') }]
+      mutations: [
+        {
+          kind: 'item',
+          identity: item(9),
+          body: body('must not appear'),
+          turnScope: AGENT_JOURNAL_THREAD_SCOPE
+        }
+      ]
     })
     expect(replay).toEqual(beforeReplay)
     expect(
@@ -397,7 +478,10 @@ describe('journal location', () => {
 describe('on-disk layout', () => {
   it('keeps the session database and its projection in one directory', async () => {
     const journal: AgentSessionJournal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
+    await journal.appendItem(item(0), body('a'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     expect(await readdir(root)).toContain('journal.db')
     await journal.close()
     await withJournalDatabase(root, (db) => {
@@ -424,3 +508,34 @@ async function withJournalDatabase(
     opened.db.close()
   }
 }
+
+describe('what a handle found on disk when it opened', () => {
+  const submission = (clientMessageId: string) => ({
+    clientMessageId,
+    payloadFingerprint: 'fp',
+    body: { kind: 'message' as const, role: 'user' as const, blocks: [] },
+    fence: 1,
+    handoverRecorded: true as const
+  })
+
+  it('names rows an earlier handle wrote, and never a row of a later epoch', async () => {
+    const earlier = await open()
+    await earlier.appendItem(item(1), body('one'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
+    await earlier.appendSubmission(submission('earlier'))
+    await earlier.close()
+
+    const journal = await open()
+    const leftover = journal.submissions().find((entry) => entry.clientMessageId === 'earlier')
+    expect(journal.wroteBeforeOpen(leftover?.acceptedSequence)).toBe(true)
+
+    // Sequences restart with an epoch, so a row accepted after it can sit below the open cursor.
+    await journal.replaceEpochItems('handle_forked', 1, [])
+    await journal.appendSubmission(submission('later'))
+    const later = journal.submissions().find((entry) => entry.clientMessageId === 'later')
+    expect(later?.acceptedSequence).toBeLessThanOrEqual(2)
+    expect(journal.wroteBeforeOpen(later?.acceptedSequence)).toBe(false)
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-store.ts b/src/main/native-chat/agent-session-journal/journal-store.ts
index ec445cb7004..1f6015c3940 100644
--- a/src/main/native-chat/agent-session-journal/journal-store.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store.ts
@@ -1,5 +1,6 @@
 // Append-only journal store for one agent session.
 
+import type { AgentJournalDispatchRejection } from '../../../shared/agent-session-failure-words'
 import { randomUUID } from 'node:crypto'
 import type {
   AgentJournalAcceptanceReceipt,
@@ -10,6 +11,7 @@ import type {
   AgentJournalSubmission,
   AgentJournalThreadGoal,
   AgentJournalTurnLifecycle,
+  AgentJournalTurnScope,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
 import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
@@ -18,6 +20,7 @@ import type { AgentSessionContextUsage } from '../../../shared/agent-session-con
 import { latestStructuredAgentContextFacts } from '../../../shared/structured-agent-session-context-usage'
 import {
   activeStructuredAgentSessionTurnIdBySequence,
+  liveStructuredAgentSessionTurnScope,
   newestStructuredAgentSessionTurnBySequence
 } from '../../../shared/structured-agent-session-live-turn'
 import { agentSessionJournalCloseRetries } from './journal-close-retry'
@@ -28,7 +31,8 @@ import { readJournalRowsAfterCursor, type JournalLoad } from './journal-open'
 import { journalDatabaseFile } from './journal-paths'
 import {
   markJournalPendingSubmissionsUnknown,
-  rejectJournalPendingSubmissions
+  rejectJournalPendingSubmissions,
+  rejectJournalQueuedSubmissions
 } from './journal-pending-submission-recovery'
 import {
   applyJournalRow,
@@ -48,11 +52,13 @@ import type {
   JournalItemAppendOptions,
   JournalLifecycleBatchInput,
   JournalReadSince,
+  JournalSubmissionConsume,
   JournalSubmissionInput,
   JournalTombstoneInput,
   ResolveDispatchInput
 } from './journal-store-contracts'
-import type { AgentJournalEpochReason, JournalRow } from './journal-row-schema'
+import { queuedMessageConsumeHook, type JournalQueuedMessages } from './journal-queued-messages'
+import type { AgentJournalEpochReason } from './journal-row-schema'
 import { AgentSessionJournalError } from './journal-write-guards'
 import type { JournalRowWriter } from './journal-row-writer'
 import type { JournalEpochController } from './journal-epoch-controller'
@@ -75,7 +81,9 @@ export class AgentSessionJournal {
   private state: JournalReducerState
   private readOnly = false
   private malformedRows = 0
+  private openedThrough: AgentJournalCursor = { epoch: '', sequence: 0 }
   private database: OpenJournalDatabase | null = null
+  private onCommitted: (() => void) | null = null
   private readonly queue: JournalWriteQueue
   private readonly closer: JournalConnectionCloser
   private readonly rowWriter: JournalRowWriter
@@ -83,6 +91,8 @@ export class AgentSessionJournal {
   private readonly itemAppender: JournalItemAppender
   private readonly lifecycleBatchAppender: JournalLifecycleBatchAppender
   private readonly restore: () => Promise<void>
+  /** Draft rows queued while the agent works; never reducer input or owed work. */
+  readonly queuedMessages: JournalQueuedMessages
 
   constructor(options: AgentSessionJournalOptions) {
     this.identity = options.identity
@@ -111,20 +121,28 @@ export class AgentSessionJournal {
         this.readOnly = readOnly
       },
       cursor: this.cursor,
-      adopt: (loaded) => this.adoptLoadedJournal(loaded),
-      commit: (row) => applyJournalRow(this.state, row),
+      adopt: (loaded) => {
+        this.adoptLoadedJournal(loaded)
+        this.onCommitted?.()
+      },
+      commit: (row) => {
+        applyJournalRow(this.state, row)
+        this.onCommitted?.()
+      },
+      notifyCommitted: () => this.onCommitted?.(),
       loaded: () => this.loaded,
       malformedRows: () => this.malformedRows,
       setMalformedRows: (count) => {
         this.malformedRows = count
       },
       journal: () => this,
-      enqueue: (build) => this.enqueue(build)
+      enqueue: (build) => this.rowWriter.enqueue(build)
     })
     this.rowWriter = collaborators.rowWriter
     this.epochController = collaborators.epochController
     this.itemAppender = collaborators.itemAppender
     this.lifecycleBatchAppender = collaborators.lifecycleBatchAppender
+    this.queuedMessages = collaborators.queuedMessages
     this.restore = collaborators.restore
   }
 
@@ -140,6 +158,16 @@ export class AgentSessionJournal {
     return this.journalDir
   }
 
+  /** Whether a row at this sequence was on disk when this handle opened, so an earlier handle
+   *  wrote it. Sequences restart with each epoch, so a row of a later epoch never was. */
+  wroteBeforeOpen(sequence: number | undefined): boolean {
+    return (
+      sequence !== undefined &&
+      this.state.epoch === this.openedThrough.epoch &&
+      sequence <= this.openedThrough.sequence
+    )
+  }
+
   /** What the last open's repair did. */
   get repair(): { malformedRows: number } {
     return { malformedRows: this.malformedRows }
@@ -150,6 +178,7 @@ export class AgentSessionJournal {
     this.database = openJournalDatabase(this.dbPath)
     try {
       await this.restore()
+      this.openedThrough = this.cursor()
     } catch (error) {
       // Nothing else holds a reference to this connection, so a throw here is
       // the leak site unless the store releases it itself — and a close that
@@ -167,6 +196,12 @@ export class AgentSessionJournal {
     return this.closer.close()
   }
 
+  /** Told of every durable change, epoch replacements included, so a reader learns of a write
+   *  without its writer saying so. One listener: a later call replaces it. It must not throw. */
+  observeCommits(listener: () => void): void {
+    this.onCommitted = listener
+  }
+
   cursor = (): AgentJournalCursor => ({
     epoch: this.state.epoch,
     sequence: this.state.lastSequence
@@ -192,6 +227,10 @@ export class AgentSessionJournal {
   activeTurnId = (): string | null =>
     activeStructuredAgentSessionTurnIdBySequence(this.state.items.values())
 
+  /** Where a row written now belongs: the running turn, or the conversation. */
+  liveTurnScope = (): AgentJournalTurnScope =>
+    liveStructuredAgentSessionTurnScope(this.state.items.values())
+
   /** The newest turn record whatever state it settled in, for readers that need the outcome. */
   newestTurn = (): AgentJournalTurnLifecycle | null =>
     newestStructuredAgentSessionTurnBySequence(this.state.items.values())
@@ -207,8 +246,13 @@ export class AgentSessionJournal {
   /** Includes revisions and completion tombstones, whose timestamps disappear from render items. */
   lastActivityAt = (): number => this.state.lastActivityAt
 
+  /** Fence of the writer that created the item, while it is in the timeline. */
+  itemFence = (itemId: string): number | undefined => this.state.itemFences.get(itemId)
+
   submissions = (): AgentJournalSubmission[] => [...this.state.submissions.values()]
 
+  submission = (clientMessageId: string) => this.state.submissions.get(clientMessageId)
+
   pendingSubmissions = (): AgentJournalSubmission[] =>
     this.submissions().filter((entry) => entry.dispatchState === 'pending')
 
@@ -243,7 +287,7 @@ export class AgentSessionJournal {
   appendItem(
     identity: AgentJournalItemIdentity,
     body: AgentJournalItemBody,
-    options: JournalItemAppendOptions = { fence: 0 }
+    options: JournalItemAppendOptions
   ): Promise<JournalAppendResult> {
     return this.itemAppender.append(identity, body, options)
   }
@@ -253,8 +297,8 @@ export class AgentSessionJournal {
     options: JournalTombstoneInput
   ): Promise<AgentJournalCursor> {
     const itemId = agentJournalItemKey(identity)
-    return this.enqueue(journalTombstoneRowBuilder(() => this.state, itemId, options.fence)).then(
-      (row) => ({ epoch: row.epoch, sequence: row.seq })
+    return this.rowWriter.append(
+      journalTombstoneRowBuilder(() => this.state, itemId, options.fence)
     )
   }
 
@@ -267,10 +311,16 @@ export class AgentSessionJournal {
    * anything, and it doubles as the optimistic user bubble so an accepted echo
    * reconciles into an existing slot instead of appending a second copy.
    */
-  appendSubmission(input: JournalSubmissionInput): Promise<AgentJournalCursor> {
-    return this.enqueue(
-      journalSubmissionRowBuilder(() => this.state, this.identity.providerHandle, input)
-    ).then((row) => ({ epoch: row.epoch, sequence: row.seq }))
+  appendSubmission(
+    input: JournalSubmissionInput,
+    /** Present: this submission is a queued draft's conversion, and the draft's
+     *  state transition commits in the SAME transaction — exactly-once consume. */
+    consume?: JournalSubmissionConsume
+  ): Promise<AgentJournalCursor> {
+    return this.rowWriter.append(
+      journalSubmissionRowBuilder(() => this.state, this.identity.providerHandle, input, consume),
+      consume && queuedMessageConsumeHook(this.queuedMessages, input.clientMessageId, consume)
+    )
   }
 
   /**
@@ -281,10 +331,7 @@ export class AgentSessionJournal {
    * string here would silently give the user a second copy of their own message.
    */
   resolveDispatch(input: ResolveDispatchInput): Promise<AgentJournalCursor> {
-    return this.enqueue(journalDispatchRowBuilder(() => this.state, input)).then((row) => ({
-      epoch: row.epoch,
-      sequence: row.seq
-    }))
+    return this.rowWriter.append(journalDispatchRowBuilder(() => this.state, input))
   }
 
   /** Retire unanswered sends after their execution owner ended, without assuming delivery. */
@@ -293,8 +340,20 @@ export class AgentSessionJournal {
   }
 
   /** Reject unanswered sends after an owner that never proved its start ended: none was written. */
-  async rejectPendingSubmissions(fence: number, reason: string): Promise<string[]> {
-    return rejectJournalPendingSubmissions(this, fence, reason)
+  async rejectPendingSubmissions(
+    fence: number,
+    rejection: AgentJournalDispatchRejection
+  ): Promise<string[]> {
+    return rejectJournalPendingSubmissions(this, fence, rejection)
+  }
+
+  /** Reject sends accepted but never handed over, optionally only those `which` names. */
+  async rejectQueuedSubmissions(
+    fence: number,
+    rejection: AgentJournalDispatchRejection,
+    which?: (submission: AgentJournalSubmission) => boolean
+  ): Promise<string[]> {
+    return rejectJournalQueuedSubmissions(this, fence, rejection, which)
   }
 
   /** The escape hatch for corruption, an unreconcilable prefix, a forked handle,
@@ -324,13 +383,4 @@ export class AgentSessionJournal {
     }
     return this.database
   }
-
-  /**
-   * Assign the next sequence, make the row durable, and fold it through the
-   * SAME reducer replay uses — all inside one serialized step, so concurrent
-   * callers cannot interleave and mint the same sequence.
-   */
-  private enqueue(build: (seq: number, ts: number) => JournalRow): Promise<JournalRow> {
-    return this.rowWriter.enqueue(build)
-  }
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-subagent-liveness.test.ts b/src/main/native-chat/agent-session-journal/journal-subagent-liveness.test.ts
index b0dff559b1a..1fea8b9efa5 100644
--- a/src/main/native-chat/agent-session-journal/journal-subagent-liveness.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-subagent-liveness.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -222,7 +223,10 @@ describe('journal reopen after the writing host is gone', () => {
       { id: 'a', label: 'read_readme', state: 'working', startedAt: 10 },
       { id: 'b', label: 'read_package', state: 'working', startedAt: 10 }
     ])
-    await live.appendItem(row.identity, row.body, { fence: 0 })
+    await live.appendItem(row.identity, row.body, {
+      fence: 0,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
 
     // Still the writing host: it can see the children, so the row says so.
     const beforeRestart = live.snapshot().items.at(-1)!
@@ -245,7 +249,10 @@ describe('journal reopen after the writing host is gone', () => {
   it('revises the row in place rather than appending a second one', async () => {
     const live = await open()
     const row = rosterRow([{ id: 'a', label: 'read', state: 'working', startedAt: 10 }])
-    await live.appendItem(row.identity, row.body, { fence: 0 })
+    await live.appendItem(row.identity, row.body, {
+      fence: 0,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     const before = live.snapshot().items.length
     await live.close()
 
@@ -257,7 +264,10 @@ describe('journal reopen after the writing host is gone', () => {
   it('settles a persisted working background task to unverifiable', async () => {
     const live = await open()
     const row = backgroundTaskRow()
-    await live.appendItem(row.identity, row.body, { fence: 0 })
+    await live.appendItem(row.identity, row.body, {
+      fence: 0,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     const beforeRestart = live.snapshot().items.at(-1)!
     expect(taskOf(beforeRestart.body)).toMatchObject({ state: 'working' })
     expect(twinOf(beforeRestart.body)).toBe('Started background command "sleep 20"')
@@ -273,7 +283,10 @@ describe('journal reopen after the writing host is gone', () => {
   it('writes nothing on a second reopen once every child is settled', async () => {
     const live = await open()
     const row = rosterRow([{ id: 'a', label: 'read', state: 'working', startedAt: 10 }])
-    await live.appendItem(row.identity, row.body, { fence: 0 })
+    await live.appendItem(row.identity, row.body, {
+      fence: 0,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     await live.close()
 
     const once = await open()
diff --git a/src/main/native-chat/agent-session-journal/journal-submission-fold.ts b/src/main/native-chat/agent-session-journal/journal-submission-fold.ts
new file mode 100644
index 00000000000..2c9c6cfcd04
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-submission-fold.ts
@@ -0,0 +1,113 @@
+// Folding submission rows: the queue entry, its message row, where a handover places it, and the
+// provider item an accepted message adopts.
+
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalSubmission
+} from '../../../shared/agent-session-journal-types'
+import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
+import { journalRenderItem } from './journal-render-item'
+import { statedOrDerivedTurnScope, upsertJournalItem } from './journal-item-fold'
+import type { JournalReducerState } from './journal-reducer'
+import type { JournalRow } from './journal-row-schema'
+import { journalDispatchRowApplies } from './journal-dispatch-settlement'
+
+export function applyJournalSubmission(
+  state: JournalReducerState,
+  row: Extract<JournalRow, { kind: 'submission' }>
+): void {
+  state.submissions.set(row.clientMessageId, {
+    clientMessageId: row.clientMessageId,
+    fence: row.fence,
+    payloadFingerprint: row.payloadFingerprint,
+    dispatchState: 'pending',
+    providerItemId: null,
+    reason: null,
+    submittedAt: row.ts,
+    resolvedAt: null,
+    ...(row.handoverRecorded ? { handoverRecorded: true, acceptedSequence: row.seq } : {}),
+    // A malformed stored link is dropped, never the row.
+    ...(typeof row.queuedMessageId === 'string' && row.queuedMessageId.length > 0
+      ? { queuedMessageId: row.queuedMessageId }
+      : {}),
+    ...(row.origin === 'client' || row.origin === 'host' ? { origin: row.origin } : {})
+  })
+  const itemId = agentJournalSubmissionKey(row.clientMessageId)
+  // A message handed over later belongs to no turn until its handover names one.
+  const turnScope = row.handoverRecorded
+    ? AGENT_JOURNAL_THREAD_SCOPE
+    : statedOrDerivedTurnScope(state, row)
+  upsertJournalItem(
+    state,
+    itemId,
+    0,
+    journalRenderItem(itemId, 0, row.body, row, turnScope),
+    row.fence
+  )
+}
+
+/** A queued message joins the conversation where it was handed over, not where it was accepted:
+ *  what the agent did meanwhile — a command it waited behind, say — happened before it. It joins
+ *  the turn that handover delivered it into — a steer — or none. Rows from hosts that predate the
+ *  stated scope are scoped at the handover, as their creation would have been. */
+export function placeHandedOverMessage(
+  state: JournalReducerState,
+  submission: AgentJournalSubmission,
+  row: Extract<JournalRow, { kind: 'dispatch' }>
+): void {
+  const itemId = agentJournalSubmissionKey(submission.clientMessageId)
+  const item = state.items.get(itemId)
+  if (!submission.handoverRecorded || !item) {
+    return
+  }
+  const { sequenceIndex: _acceptedAt, ...accepted } = item
+  state.items.set(itemId, {
+    ...accepted,
+    sequence: row.seq,
+    observedAt: row.ts,
+    turnScope: row.turnScope ?? state.derivedTurnScope.scopeFor(item.body)
+  })
+}
+
+export function acceptSubmissionFromProviderItem(
+  state: JournalReducerState,
+  providerItemId: string,
+  resolvedItemId: string,
+  row: Pick<JournalRow, 'epoch' | 'seq' | 'fence' | 'ts'>
+): void {
+  if (providerItemId === resolvedItemId) {
+    return
+  }
+  const submission = [...state.submissions.values()].find(
+    (candidate) => agentJournalSubmissionKey(candidate.clientMessageId) === resolvedItemId
+  )
+  if (!submission || !journalDispatchRowApplies(submission)) {
+    return
+  }
+  submission.fence = row.fence
+  submission.dispatchState = 'accepted'
+  notePersonTurnAccepted(state, submission)
+  submission.providerItemId = providerItemId
+  submission.reason = null
+  submission.resolvedAt = row.ts
+  delete submission.recovered
+  state.receipts.set(submission.clientMessageId, {
+    clientMessageId: submission.clientMessageId,
+    providerItemId,
+    cursor: { epoch: row.epoch, sequence: row.seq },
+    acceptedAt: row.ts
+  })
+}
+
+/** A person's turn the provider accepted: the fact the queue's pause is lifted by. */
+export function notePersonTurnAccepted(
+  state: JournalReducerState,
+  submission: Pick<AgentJournalSubmission, 'origin' | 'acceptedSequence'>
+): void {
+  if (submission.origin === 'client' && submission.acceptedSequence !== undefined) {
+    state.latestPersonTurnSequence = Math.max(
+      state.latestPersonTurnSequence,
+      submission.acceptedSequence
+    )
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-submission-queued-link.test.ts b/src/main/native-chat/agent-session-journal/journal-submission-queued-link.test.ts
new file mode 100644
index 00000000000..0d62ed1b232
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-submission-queued-link.test.ts
@@ -0,0 +1,154 @@
+// A submission that hands off a queued draft names that draft (`queuedMessageId`),
+// persisted on its journal row and published on the submission; a direct send
+// names none. Clients read the link, never a draft id compared with a submission id.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { AgentJournalSubmissionSchema } from '../../../shared/agent-session-journal-schemas'
+import type {
+  AgentJournalMessageItem,
+  AgentSessionJournalIdentity
+} from '../../../shared/agent-session-journal-types'
+import { createJournalReducerState, applyJournalRow } from './journal-reducer'
+import { parseJournalRow, serializeJournalRow, type JournalRow } from './journal-row-schema'
+import type { AgentSessionJournal } from './journal-store'
+import { createTrackedJournalOpener } from './journal-store-test-open'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: 'session-q',
+  workspaceId: 'ws-1',
+  hostId: 'host-1',
+  agent: 'claude',
+  providerHandle: { kind: 'claude', sessionId: 'native-1', leafUuid: null }
+}
+const BODY: AgentJournalMessageItem = {
+  kind: 'message',
+  role: 'user',
+  blocks: [{ type: 'text', text: 'queued text' }]
+}
+
+let root: string
+let clock = 1_000
+const journals = createTrackedJournalOpener()
+
+function open(): Promise<AgentSessionJournal> {
+  return journals.open({
+    identity: IDENTITY,
+    journalDir: root,
+    now: () => ++clock,
+    mintEpoch: () => `epoch-${clock}`
+  })
+}
+
+async function handOff(journal: AgentSessionJournal, draftId: string, submissionId: string) {
+  await journal.queuedMessages.insert({
+    messageId: draftId,
+    body: BODY,
+    fingerprint: 'fp',
+    hostInstance: 'p'
+  })
+  await journal.appendSubmission(
+    { clientMessageId: submissionId, payloadFingerprint: 'fp', body: BODY, fence: 0 },
+    { messageId: draftId, expect: 'waiting', settledByOp: null }
+  )
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-queued-link-'))
+  clock = 1_000
+})
+
+afterEach(async () => {
+  await journals.closeAll()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('the submission names the queued draft it hands off', () => {
+  it('on every hand-off, and never on a direct send', async () => {
+    const journal = await open()
+    await handOff(journal, 'draft-1', 'handoff-1')
+    await journal.appendSubmission({
+      clientMessageId: 'direct-1',
+      payloadFingerprint: 'fp-direct',
+      body: BODY,
+      fence: 0
+    })
+    expect(journal.submission('handoff-1')?.queuedMessageId).toBe('draft-1')
+    expect(journal.submission('direct-1')).not.toHaveProperty('queuedMessageId')
+  })
+
+  it('survives a reload, which replays the rows through the reducer', async () => {
+    let journal = await open()
+    await handOff(journal, 'draft-1', 'handoff-1')
+    await journal.close()
+    journal = await open()
+    expect(journal.submission('handoff-1')?.queuedMessageId).toBe('draft-1')
+    expect(
+      journal.snapshot().submissions.find((entry) => entry.clientMessageId === 'handoff-1')
+    ).toMatchObject({ queuedMessageId: 'draft-1' })
+  })
+
+  it('refuses a caller naming a different draft than the one it consumes, and writes nothing', async () => {
+    const journal = await open()
+    await journal.queuedMessages.insert({
+      messageId: 'draft-1',
+      body: BODY,
+      fingerprint: 'fp',
+      hostInstance: 'p'
+    })
+    await expect(
+      journal.appendSubmission(
+        {
+          clientMessageId: 'handoff-1',
+          payloadFingerprint: 'fp',
+          body: BODY,
+          fence: 0,
+          queuedMessageId: 'draft-2'
+        },
+        { messageId: 'draft-1', expect: 'waiting', settledByOp: null }
+      )
+    ).rejects.toThrow()
+    expect(journal.submissions()).toHaveLength(0)
+    expect(journal.queuedMessages.get('draft-1')?.state).toBe('waiting')
+  })
+
+  it('is published: the wire schema keeps the field rather than stripping it', async () => {
+    const journal = await open()
+    await handOff(journal, 'draft-1', 'handoff-1')
+    const published = AgentJournalSubmissionSchema.parse(journal.submission('handoff-1'))
+    expect(published.queuedMessageId).toBe('draft-1')
+  })
+})
+
+describe('the persisted row', () => {
+  const row: JournalRow = {
+    v: 1,
+    kind: 'submission',
+    epoch: 'epoch-1',
+    seq: 1,
+    fence: 0,
+    ts: 1,
+    clientMessageId: 'handoff-1',
+    payloadFingerprint: 'fp',
+    providerHandle: IDENTITY.providerHandle,
+    body: BODY,
+    queuedMessageId: 'draft-1'
+  }
+
+  it('parses with the key, which a reader that does not know it simply keeps', () => {
+    const parsed = parseJournalRow(serializeJournalRow(row))
+    expect(parsed).toMatchObject({ ok: true, row: { queuedMessageId: 'draft-1' } })
+  })
+
+  it('keeps a row whose stored link is malformed, dropping only the link', () => {
+    const parsed = parseJournalRow(JSON.stringify({ ...row, queuedMessageId: 42 }))
+    if (!parsed.ok) {
+      throw new Error('the row must survive a malformed link')
+    }
+    const state = createJournalReducerState('session-q', 'epoch-1')
+    applyJournalRow(state, parsed.row)
+    expect(state.submissions.get('handoff-1')).not.toHaveProperty('queuedMessageId')
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-submission-reconciler.ts b/src/main/native-chat/agent-session-journal/journal-submission-reconciler.ts
index 16999de0363..4647ba1e0e3 100644
--- a/src/main/native-chat/agent-session-journal/journal-submission-reconciler.ts
+++ b/src/main/native-chat/agent-session-journal/journal-submission-reconciler.ts
@@ -18,6 +18,7 @@ import type {
   AgentJournalSubmission
 } from '../../../shared/agent-session-journal-types'
 import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
+import { DISPATCH_REJECTED_NOT_DELIVERED } from '../../../shared/structured-agent-session-dispatch-rejection'
 
 export type ProviderHistoryItem = {
   /** The provider's own id for this item. Used to claim it at most once; the
@@ -55,7 +56,7 @@ export type SubmissionReconciliation =
   | { clientMessageId: string; outcome: 'rejected'; reason: SubmissionRejectionReason }
   | { clientMessageId: string; outcome: 'unknown'; reason: SubmissionUnknownReason }
 
-export type SubmissionRejectionReason = 'not_delivered'
+export type SubmissionRejectionReason = typeof DISPATCH_REJECTED_NOT_DELIVERED
 
 export type SubmissionUnknownReason =
   | 'history_boundary_inconsistent'
@@ -197,6 +198,6 @@ function resolveOne(
   return {
     clientMessageId: submission.clientMessageId,
     outcome: 'rejected',
-    reason: 'not_delivered'
+    reason: DISPATCH_REJECTED_NOT_DELIVERED
   }
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-turn-scope.test.ts b/src/main/native-chat/agent-session-journal/journal-turn-scope.test.ts
new file mode 100644
index 00000000000..6842c119f73
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-turn-scope.test.ts
@@ -0,0 +1,245 @@
+import { describe, expect, it } from 'vitest'
+import {
+  agentJournalItemKey,
+  agentJournalSubmissionKey
+} from '../../../shared/agent-session-journal-item-key'
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalItemBody,
+  type AgentJournalItemIdentity,
+  type AgentJournalTurnScope
+} from '../../../shared/agent-session-journal-types'
+import { projectNativeChatTranscriptMessages } from '../../../shared/native-chat-transcript-projection'
+import { projectStructuredAgentSessionMessages } from '../../../shared/structured-agent-session-message-projection'
+import {
+  applyJournalRow,
+  createJournalReducerState,
+  renderJournalState,
+  type JournalReducerState
+} from './journal-reducer'
+import {
+  buildJournalItemRow,
+  buildJournalSubmissionRow,
+  journalRowBase
+} from './journal-row-builders'
+import type { JournalRow } from './journal-row-schema'
+
+const TURN_1: AgentJournalItemIdentity = { provider: 'orca', clientMessageId: 'turn-1' }
+const TURN_2: AgentJournalItemIdentity = { provider: 'orca', clientMessageId: 'turn-2' }
+const COMMAND_TURN: AgentJournalItemIdentity = {
+  provider: 'orca',
+  clientMessageId: 'command-turn:cmd-1'
+}
+const inTurn = (identity: AgentJournalItemIdentity): AgentJournalTurnScope => ({
+  kind: 'turn',
+  turnItemId: agentJournalItemKey(identity)
+})
+
+function row(id: string): AgentJournalItemIdentity {
+  return { provider: 'orca', clientMessageId: id }
+}
+
+function prose(text: string): AgentJournalItemBody {
+  return { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text }] }
+}
+
+function turn(turnId: string, state: 'running' | 'completed'): AgentJournalItemBody {
+  return { kind: 'turn', turnId, state, startedAt: 1 }
+}
+
+/** Builds rows against a scratch state, so the same list can be folded more than once. */
+function rows() {
+  const state = createJournalReducerState('session-1', 'epoch-1')
+  const built: JournalRow[] = []
+  let seq = 0
+  const push = (next: JournalRow): void => {
+    built.push(next)
+    applyJournalRow(state, next)
+  }
+  return {
+    state,
+    built,
+    item(
+      identity: AgentJournalItemIdentity,
+      body: AgentJournalItemBody,
+      scope?: AgentJournalTurnScope
+    ) {
+      seq += 1
+      const next = buildJournalItemRow({
+        state,
+        identity,
+        body,
+        seq,
+        fence: 1,
+        ts: 1_000 + seq,
+        turnScope: scope ?? AGENT_JOURNAL_THREAD_SCOPE
+      })
+      if (!scope) {
+        // A row from a host that predates stated scopes.
+        delete next.turnScope
+      }
+      push(next)
+    },
+    submission(clientMessageId: string) {
+      seq += 1
+      push(
+        buildJournalSubmissionRow({
+          state,
+          clientMessageId,
+          payloadFingerprint: `fp-${clientMessageId}`,
+          providerHandle: { kind: 'codex', threadId: 'thread-1' },
+          body: {
+            kind: 'message',
+            role: 'user',
+            blocks: [{ type: 'text', text: clientMessageId }]
+          },
+          seq,
+          fence: 1,
+          ts: 1_000 + seq,
+          handoverRecorded: true
+        })
+      )
+    },
+    handover(clientMessageId: string, scope?: AgentJournalTurnScope) {
+      seq += 1
+      // Built by hand: a row from an older host carries no scope, which the builder never writes.
+      push({
+        kind: 'dispatch',
+        clientMessageId,
+        state: 'pending',
+        providerItemId: null,
+        reason: null,
+        ...journalRowBase(state.epoch, seq, 1, 1_000 + seq),
+        ...(scope ? { turnScope: scope } : {})
+      })
+    }
+  }
+}
+
+function scopeOf(state: JournalReducerState, identity: AgentJournalItemIdentity) {
+  return state.items.get(agentJournalItemKey(identity))?.turnScope
+}
+
+function submissionScope(state: JournalReducerState, clientMessageId: string) {
+  return state.items.get(agentJournalSubmissionKey(clientMessageId))?.turnScope
+}
+
+function refold(built: readonly JournalRow[]) {
+  const state = createJournalReducerState('session-1', 'epoch-1')
+  for (const next of built) {
+    applyJournalRow(state, next)
+  }
+  return renderJournalState(state)
+}
+
+describe('stated turn scope', () => {
+  it('keeps the scope of the write that created the row', () => {
+    const { state, item } = rows()
+    item(TURN_1, turn('t1', 'running'), AGENT_JOURNAL_THREAD_SCOPE)
+    item(row('answer'), prose('first'), inTurn(TURN_1))
+    // A revision stating another scope only updates the content.
+    item(row('answer'), prose('second'), AGENT_JOURNAL_THREAD_SCOPE)
+    expect(scopeOf(state, row('answer'))).toEqual(inTurn(TURN_1))
+  })
+
+  it('places a queued message only when its handover states a turn', () => {
+    const { state, item, submission, handover } = rows()
+    item(TURN_1, turn('t1', 'running'), AGENT_JOURNAL_THREAD_SCOPE)
+    submission('steer')
+    submission('later')
+    // Accepted while a turn runs, but not yet delivered into it.
+    expect(submissionScope(state, 'steer')).toEqual(AGENT_JOURNAL_THREAD_SCOPE)
+    handover('steer', inTurn(TURN_1))
+    handover('later', AGENT_JOURNAL_THREAD_SCOPE)
+    expect(submissionScope(state, 'steer')).toEqual(inTurn(TURN_1))
+    expect(submissionScope(state, 'later')).toEqual(AGENT_JOURNAL_THREAD_SCOPE)
+  })
+
+  it('keeps a message held behind a command out of the command turn', () => {
+    const { state, item, submission, handover } = rows()
+    submission('cmd-1')
+    handover('cmd-1', AGENT_JOURNAL_THREAD_SCOPE)
+    item(COMMAND_TURN, turn('compact:cmd-1', 'running'), AGENT_JOURNAL_THREAD_SCOPE)
+    submission('held')
+    expect(submissionScope(state, 'held')).toEqual(AGENT_JOURNAL_THREAD_SCOPE)
+    item(row('result'), prose('compacted'), inTurn(COMMAND_TURN))
+    item(COMMAND_TURN, turn('compact:cmd-1', 'completed'), AGENT_JOURNAL_THREAD_SCOPE)
+    const drawn = (messages: readonly { id: string }[]) =>
+      messages
+        .map((message) => message.id)
+        .filter((id) => id === agentJournalItemKey(row('result')) || id.includes('held'))
+    const expected = [agentJournalItemKey(row('result')), agentJournalSubmissionKey('held')]
+    const onPhone = () => {
+      const { items, submissions } = renderJournalState(state)
+      return projectStructuredAgentSessionMessages(items, [], submissions)
+    }
+    // Still waiting: drawn after everything the agent did, the command's result included.
+    expect(drawn(onPhone())).toEqual(expected)
+    handover('held', AGENT_JOURNAL_THREAD_SCOPE)
+    expect(submissionScope(state, 'held')).toEqual(AGENT_JOURNAL_THREAD_SCOPE)
+    // Delivered: placed where it was handed over, by sequence for paging and the phone, and by
+    // timestamp for the desktop transcript.
+    expect(drawn(onPhone())).toEqual(expected)
+    expect(drawn(projectNativeChatTranscriptMessages(onPhone()))).toEqual(expected)
+  })
+})
+
+describe('scope derived for rows stored without one', () => {
+  it('places rows inside a live span and closes it at the terminal revision', () => {
+    const { state, item } = rows()
+    item(row('before'), prose('before'))
+    item(TURN_1, turn('t1', 'running'))
+    item(row('inside'), prose('inside'))
+    item(TURN_1, turn('t1', 'completed'))
+    item(row('after'), prose('after'))
+    expect(scopeOf(state, row('before'))).toEqual(AGENT_JOURNAL_THREAD_SCOPE)
+    expect(scopeOf(state, TURN_1)).toEqual(AGENT_JOURNAL_THREAD_SCOPE)
+    expect(scopeOf(state, row('inside'))).toEqual(inTurn(TURN_1))
+    expect(scopeOf(state, row('after'))).toEqual(AGENT_JOURNAL_THREAD_SCOPE)
+  })
+
+  it('keeps a turn rebuilt already settled open until the next turn record', () => {
+    const { state, item } = rows()
+    item(TURN_1, turn('t1', 'completed'))
+    item(row('first'), prose('first'))
+    item(TURN_2, turn('t2', 'completed'))
+    item(row('second'), prose('second'))
+    expect(scopeOf(state, row('first'))).toEqual(inTurn(TURN_1))
+    expect(scopeOf(state, row('second'))).toEqual(inTurn(TURN_2))
+  })
+
+  it('closes a legacy /compact carrier where its turn body is overwritten, and shows the carrier', () => {
+    const { state, item } = rows()
+    const carrier = row('compact:op-1')
+    item(carrier, {
+      kind: 'status',
+      text: 'Compacting conversation…',
+      turnLifecycle: { turnId: 'compact:op-1', state: 'running' }
+    })
+    item(row('summary'), prose('summary'))
+    item(carrier, { kind: 'status', text: 'Conversation compacted.' })
+    item(row('after'), prose('after'))
+    expect(scopeOf(state, carrier)).toEqual(AGENT_JOURNAL_THREAD_SCOPE)
+    expect(scopeOf(state, row('summary'))).toEqual(inTurn(carrier))
+    expect(scopeOf(state, row('after'))).toEqual(AGENT_JOURNAL_THREAD_SCOPE)
+  })
+
+  it('lands rows written after a crash left a turn running in that turn', () => {
+    const { state, item } = rows()
+    item(TURN_1, turn('t1', 'running'))
+    item(row('crash-window'), prose('written before the sweep'))
+    expect(scopeOf(state, row('crash-window'))).toEqual(inTurn(TURN_1))
+  })
+
+  it('derives the same scopes on replay as live', () => {
+    const { state, built, item, submission, handover } = rows()
+    item(TURN_1, turn('t1', 'running'))
+    item(row('inside'), prose('inside'))
+    submission('steer')
+    handover('steer')
+    item(TURN_1, turn('t1', 'completed'))
+    item(row('after'), prose('after'))
+    expect(submissionScope(state, 'steer')).toEqual(inTurn(TURN_1))
+    expect(refold(built)).toEqual(renderJournalState(state))
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-write-guards.ts b/src/main/native-chat/agent-session-journal/journal-write-guards.ts
index e1869ae0c73..eeab1671649 100644
--- a/src/main/native-chat/agent-session-journal/journal-write-guards.ts
+++ b/src/main/native-chat/agent-session-journal/journal-write-guards.ts
@@ -5,7 +5,11 @@
 
 export class AgentSessionJournalError extends Error {
   constructor(
-    readonly code: 'journal_read_only' | 'journal_stale_fence' | 'journal_closed',
+    readonly code:
+      | 'journal_read_only'
+      | 'journal_stale_fence'
+      | 'journal_closed'
+      | 'journal_submission_exists',
     message: string
   ) {
     super(message)
@@ -34,3 +38,17 @@ export function assertJournalFence(fence: number, highestFence: number): void {
     )
   }
 }
+
+/** One id, one delivery: a second submission row under an id would reset its
+ *  settled answer to pending and hand the message over again. */
+export function assertSubmissionIdUnused(
+  submissions: ReadonlyMap<string, unknown>,
+  clientMessageId: string
+): void {
+  if (submissions.has(clientMessageId)) {
+    throw new AgentSessionJournalError(
+      'journal_submission_exists',
+      `a submission ${clientMessageId} is already recorded`
+    )
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/queued-message-bookkeeping-failure.test.ts b/src/main/native-chat/agent-session-journal/queued-message-bookkeeping-failure.test.ts
new file mode 100644
index 00000000000..75b2e1ff65d
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/queued-message-bookkeeping-failure.test.ts
@@ -0,0 +1,213 @@
+// Draft bookkeeping never vetoes a journal row: a failing draft transition
+// rolls back alone and the next open re-derives it, and a draft table an
+// earlier build created gains the columns this build writes.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type {
+  AgentJournalMessageItem,
+  AgentSessionJournalIdentity
+} from '../../../shared/agent-session-journal-types'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
+import Database from '../../sqlite/sync-database'
+import { journalDatabaseFile } from './journal-paths'
+import { JournalQueuedMessages } from './journal-queued-messages'
+import type { AgentSessionJournal } from './journal-store'
+import { createTrackedJournalOpener } from './journal-store-test-open'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: 'session-q',
+  workspaceId: 'ws-1',
+  hostId: 'host-1',
+  agent: 'claude',
+  providerHandle: { kind: 'claude', sessionId: 'native-1', leafUuid: null }
+}
+const REFUSAL = agentSessionFailureWords(
+  agentSessionFailureFact('providerRejected', {
+    detail: { text: 'Claude refused this payload', audience: 'person' }
+  }),
+  { surface: 'rejection' }
+)
+
+const BODY: AgentJournalMessageItem = {
+  kind: 'message',
+  role: 'user',
+  blocks: [{ type: 'text', text: 'queued text' }]
+}
+
+let root: string
+let clock = 1_000
+const journals = createTrackedJournalOpener()
+
+function open(): Promise<AgentSessionJournal> {
+  return journals.open({
+    identity: IDENTITY,
+    journalDir: root,
+    now: () => ++clock,
+    mintEpoch: () => `epoch-${clock}`
+  })
+}
+
+async function queueAndConsume(journal: AgentSessionJournal, messageId: string): Promise<void> {
+  const body: AgentJournalMessageItem = {
+    kind: 'message',
+    role: 'user',
+    blocks: [{ type: 'text', text: 'queued text' }]
+  }
+  await journal.queuedMessages.insert({
+    messageId,
+    body,
+    fingerprint: `fp-${messageId}`,
+    hostInstance: 'proc-1'
+  })
+  await journal.appendSubmission(
+    {
+      clientMessageId: `sub-${messageId}`,
+      payloadFingerprint: `fp-${messageId}`,
+      body,
+      fence: 0,
+      handoverRecorded: true
+    },
+    { messageId, expect: 'waiting', settledByOp: null }
+  )
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-queued-bookkeeping-'))
+  clock = 1_000
+})
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  await journals.closeAll()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('draft bookkeeping inside a journal append', () => {
+  it('a throwing draft transition still commits the rejection row, and the next open recovers the draft', async () => {
+    let journal = await open()
+    await queueAndConsume(journal, 'draft-1')
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    vi.spyOn(JournalQueuedMessages.prototype, 'onRowInTransaction').mockImplementationOnce(() => {
+      throw new Error('table queued_messages has no column named returned_rejection')
+    })
+    await journal.resolveDispatch({
+      clientMessageId: 'sub-draft-1',
+      state: 'rejected',
+      ...REFUSAL,
+      fence: 0
+    })
+    // The journal's own answer stands: Stop, failed starts and refusals depend on it.
+    expect(journal.submission('sub-draft-1')?.dispatchState).toBe('rejected')
+    expect(journal.queuedMessages.get('draft-1')?.state).toBe('dispatched')
+    expect(warn).toHaveBeenCalledWith(
+      '[journal-append] row bookkeeping skipped:',
+      expect.objectContaining({ kind: 'dispatch' })
+    )
+    await journal.close()
+    journal = await open()
+    expect(journal.submission('sub-draft-1')?.dispatchState).toBe('rejected')
+    expect(journal.queuedMessages.get('draft-1')).toMatchObject({
+      state: 'returned',
+      returnedReason: REFUSAL.reason,
+      returnedRejection: { kind: 'providerRejected' }
+    })
+  })
+
+  it('an older draft table without a later column is healed at open, so a refusal returns the card', async () => {
+    const first = await open()
+    await first.close()
+    const db = new Database(journalDatabaseFile(root))
+    db.exec('DROP TABLE queued_messages')
+    // The shape an earlier build of the draft table wrote: no returned_rejection.
+    db.exec(`CREATE TABLE queued_messages (
+      session_id TEXT NOT NULL, message_id TEXT NOT NULL, position INTEGER NOT NULL,
+      body_json TEXT NOT NULL, fingerprint TEXT NOT NULL, created_at INTEGER NOT NULL,
+      host_instance TEXT NOT NULL, state TEXT NOT NULL, hold_reason TEXT,
+      returned_reason TEXT, settled_at INTEGER, settled_by_op TEXT, consumed_as TEXT,
+      PRIMARY KEY (session_id, message_id))`)
+    db.close()
+    const journal = await open()
+    expect(journal.isReadOnly).toBe(false)
+    await queueAndConsume(journal, 'draft-1')
+    await journal.resolveDispatch({
+      clientMessageId: 'sub-draft-1',
+      state: 'rejected',
+      ...REFUSAL,
+      fence: 0
+    })
+    expect(journal.queuedMessages.get('draft-1')).toMatchObject({
+      state: 'returned',
+      returnedRejection: { kind: 'providerRejected' }
+    })
+  })
+
+  describe('a failed COMMIT', () => {
+    /** The append's own COMMIT fails once, after its hooks ran. */
+    function failNextCommit() {
+      const exec = Database.prototype.exec
+      let armed = true
+      return vi.spyOn(Database.prototype, 'exec').mockImplementation(function (
+        this: Database,
+        sql: string
+      ) {
+        if (armed && sql === 'COMMIT') {
+          armed = false
+          throw new Error('SQLITE_FULL')
+        }
+        return exec.call(this, sql)
+      })
+    }
+
+    async function consumeFailingCommit(journal: AgentSessionJournal): Promise<void> {
+      await journal.queuedMessages.insert({
+        messageId: 'draft-1',
+        body: BODY,
+        fingerprint: 'fp-draft-1',
+        hostInstance: 'proc-1'
+      })
+      expect(journal.queuedMessages.list()).toMatchObject([{ state: 'waiting' }])
+      const commit = failNextCommit()
+      try {
+        await expect(
+          journal.appendSubmission(
+            { clientMessageId: 'sub-draft-1', payloadFingerprint: 'fp', body: BODY, fence: 0 },
+            { messageId: 'draft-1', expect: 'waiting', settledByOp: null }
+          )
+        ).rejects.toThrow('SQLITE_FULL')
+      } finally {
+        commit.mockRestore()
+      }
+    }
+
+    it('leaves no uncommitted draft state cached: the per-row hook reads drafts only for an echo', async () => {
+      const journal = await open()
+      const list = vi.spyOn(JournalQueuedMessages.prototype, 'list')
+      await consumeFailingCommit(journal)
+      // Once by the test itself before the append; never inside it.
+      expect(list).toHaveBeenCalledTimes(1)
+      list.mockRestore()
+      expect(journal.submissions()).toHaveLength(0)
+      expect(journal.queuedMessages.list()).toMatchObject([
+        { messageId: 'draft-1', state: 'waiting' }
+      ])
+    })
+
+    it('invalidates what any read inside the rolled-back transaction cached', async () => {
+      const journal = await open()
+      // Some other bookkeeping reads the list inside the transaction, after the consume wrote.
+      vi.spyOn(JournalQueuedMessages.prototype, 'onRowInTransaction').mockImplementation(function (
+        this: JournalQueuedMessages
+      ) {
+        this.list()
+      })
+      await consumeFailingCommit(journal)
+      expect(journal.queuedMessages.list()).toMatchObject([
+        { messageId: 'draft-1', state: 'waiting' }
+      ])
+    })
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/queued-message-delivered-echo.test.ts b/src/main/native-chat/agent-session-journal/queued-message-delivered-echo.test.ts
new file mode 100644
index 00000000000..376d3145a9d
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/queued-message-delivered-echo.test.ts
@@ -0,0 +1,206 @@
+// A draft sent back to waiting after a handed-over hand-off was rejected as
+// never delivered is withdrawn when the provider echoes that message: the
+// first send reached the agent, so sending it again would repeat it.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
+import type {
+  AgentJournalMessageItem,
+  AgentSessionJournalIdentity
+} from '../../../shared/agent-session-journal-types'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
+import { queuedMessageFingerprint } from '../agent-session-wire/structured-agent-session-queued-messages'
+import { JournalQueuedMessages } from './journal-queued-messages'
+import type { AgentSessionJournal } from './journal-store'
+import { createTrackedJournalOpener } from './journal-store-test-open'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: 'session-q',
+  workspaceId: 'ws-1',
+  hostId: 'host-1',
+  agent: 'claude',
+  providerHandle: { kind: 'claude', sessionId: 'native-1', leafUuid: null }
+}
+const STOP_WITHDRAWAL = agentSessionFailureWords(agentSessionFailureFact('cancelled'), {
+  surface: 'rejection'
+})
+
+let root: string
+let clock = 1_000
+const journals = createTrackedJournalOpener()
+
+function message(text: string): AgentJournalMessageItem {
+  return { kind: 'message', role: 'user', blocks: [{ type: 'text', text }] }
+}
+
+function echo(journal: AgentSessionJournal, uuid: string, text: string) {
+  return journal.appendItem({ provider: 'claude', sessionId: 'native-1', uuid }, message(text), {
+    fence: 0,
+    turnScope: AGENT_JOURNAL_THREAD_SCOPE
+  })
+}
+
+/** A draft consumed and handed to the agent, then rejected as never delivered (the provider
+ *  confirmed a Stop withdrew it): back to waiting. `handedOver: false` rejects it before
+ *  hand-over instead, which proves it was never written. */
+async function withdrawnDraft(
+  text: string,
+  options: { handedOver: boolean } = { handedOver: true }
+): Promise<AgentSessionJournal> {
+  const journal = await open()
+  await handOffAndReject(journal, text, options)
+  return journal
+}
+
+function open(): Promise<AgentSessionJournal> {
+  return journals.open({
+    identity: IDENTITY,
+    journalDir: root,
+    now: () => ++clock,
+    mintEpoch: () => `epoch-${clock}`
+  })
+}
+
+async function handOffAndReject(
+  journal: AgentSessionJournal,
+  text: string,
+  options: { handedOver: boolean } = { handedOver: true }
+): Promise<void> {
+  const body = message(text)
+  const fingerprint = queuedMessageFingerprint(IDENTITY.sessionId, body)
+  await journal.queuedMessages.insert({
+    messageId: 'draft-1',
+    body,
+    fingerprint,
+    hostInstance: 'p'
+  })
+  await journal.appendSubmission(
+    {
+      clientMessageId: 'sub-draft-1',
+      payloadFingerprint: fingerprint,
+      body,
+      fence: 0,
+      handoverRecorded: true
+    },
+    { messageId: 'draft-1', expect: 'waiting', settledByOp: null }
+  )
+  if (options.handedOver) {
+    await journal.resolveDispatch({
+      clientMessageId: 'sub-draft-1',
+      state: 'pending',
+      fence: 0,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
+    await journal.resolveDispatch({
+      clientMessageId: 'sub-draft-1',
+      state: 'rejected',
+      ...STOP_WITHDRAWAL,
+      fence: 0
+    })
+  } else {
+    await journal.rejectQueuedSubmissions(0, STOP_WITHDRAWAL)
+  }
+  expect(journal.queuedMessages.get('draft-1')).toMatchObject({
+    state: 'waiting',
+    consumedAs: null
+  })
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-queued-echo-'))
+  clock = 1_000
+})
+
+afterEach(async () => {
+  await journals.closeAll()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe("a waiting draft whose 'never delivered' claim an echo disproves", () => {
+  it('is withdrawn when the provider echoes the message it was withdrawn from', async () => {
+    const journal = await withdrawnDraft('did it land?')
+    await echo(journal, 'echo-1', 'did it land?')
+    expect(journal.queuedMessages.get('draft-1')).toMatchObject({
+      state: 'withdrawn',
+      settledByOp: null
+    })
+    // The rejection stays terminal: the echo is kept apart, not folded into it.
+    expect(journal.submission('sub-draft-1')?.dispatchState).toBe('rejected')
+    expect(journal.snapshot().items.map((item) => item.itemId)).toHaveLength(2)
+  })
+
+  it('stays waiting when the rejected hand-off never reached the agent: the echo is some other message', async () => {
+    const journal = await withdrawnDraft('did it land?', { handedOver: false })
+    await echo(journal, 'echo-1', 'did it land?')
+    expect(journal.queuedMessages.get('draft-1')?.state).toBe('waiting')
+  })
+
+  it('retires the pause in the per-row hook when that echo withdraws the last card it holds back', async () => {
+    const journal = await withdrawnDraft('did it land?')
+    expect(await journal.queuedMessages.recordPause('stopped')).toBe(true)
+    await echo(journal, 'echo-1', 'did it land?')
+    expect(journal.queuedMessages.get('draft-1')?.state).toBe('withdrawn')
+    expect(journal.queuedMessages.pause()).toBeNull()
+  })
+
+  it('stays waiting for an echo of some other text', async () => {
+    const journal = await withdrawnDraft('did it land?')
+    await echo(journal, 'echo-1', 'something else')
+    expect(journal.queuedMessages.get('draft-1')?.state).toBe('waiting')
+  })
+
+  it('stays waiting when a live send of the same text claims the echo', async () => {
+    const journal = await withdrawnDraft('did it land?')
+    const body = message('did it land?')
+    await journal.appendSubmission({
+      clientMessageId: 'typed-again',
+      payloadFingerprint: queuedMessageFingerprint(IDENTITY.sessionId, body),
+      body,
+      fence: 0,
+      handoverRecorded: true
+    })
+    await echo(journal, 'echo-1', 'did it land?')
+    expect(journal.submission('typed-again')?.dispatchState).toBe('accepted')
+    expect(journal.queuedMessages.get('draft-1')?.state).toBe('waiting')
+  })
+
+  describe('when the per-row hook was skipped', () => {
+    it('the re-derivation withdraws it from the echo already in the journal, and at reopen', async () => {
+      let journal = await withdrawnDraft('did it land?')
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+      const hook = vi
+        .spyOn(JournalQueuedMessages.prototype, 'onRowInTransaction')
+        .mockImplementationOnce(() => {
+          throw new Error('bookkeeping failed')
+        })
+      try {
+        await echo(journal, 'echo-1', 'did it land?')
+      } finally {
+        hook.mockRestore()
+        warn.mockRestore()
+      }
+      expect(journal.queuedMessages.get('draft-1')?.state).toBe('waiting')
+      expect(journal.queuedMessages.deliveredByEchoOwed()).toBe(true)
+      // The drain's heal, before the draft could send again.
+      await journal.queuedMessages.settleOwed()
+      expect(journal.queuedMessages.get('draft-1')?.state).toBe('withdrawn')
+      expect(journal.queuedMessages.deliveredByEchoOwed()).toBe(false)
+      await journal.close()
+      journal = await open()
+      expect(journal.queuedMessages.get('draft-1')?.state).toBe('withdrawn')
+    })
+
+    it('an unclaimed echo from before the hand-off proves nothing about it', async () => {
+      const journal = await open()
+      await echo(journal, 'typed-in-the-agent', 'did it land?')
+      await handOffAndReject(journal, 'did it land?')
+      expect(journal.queuedMessages.deliveredByEchoOwed()).toBe(false)
+      await journal.queuedMessages.settleOwed()
+      expect(journal.queuedMessages.get('draft-1')?.state).toBe('waiting')
+    })
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/queued-message-delivered-echo.ts b/src/main/native-chat/agent-session-journal/queued-message-delivered-echo.ts
new file mode 100644
index 00000000000..f111b49037f
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/queued-message-delivered-echo.ts
@@ -0,0 +1,128 @@
+// A draft sent back to waiting rests on its submission's "never delivered"
+// claim. The provider echoing that message proves the claim wrong: the first
+// delivery happened. The reducer keeps such an echo apart (a rejected
+// submission may not claim it), so it is read here, from the row itself.
+
+import type { AgentJournalItemBody } from '../../../shared/agent-session-journal-types'
+import { structuredAgentSessionPayloadFingerprint } from '../../../shared/structured-agent-session-mutation'
+import {
+  isProviderUserMessageEcho,
+  journalEchoClaimant,
+  type JournalReducerState
+} from './journal-reducer'
+import type { JournalRow } from './journal-row-schema'
+import type { QueuedMessageRow } from './queued-message-table'
+
+/** The waiting draft this appended row proves was delivered, or null. Called
+ *  before the row applies, for every row, so a row that is no new provider
+ *  echo of a user message returns before anything else is read. */
+export function draftDeliveredByEcho(
+  state: JournalReducerState,
+  drafts: () => readonly QueuedMessageRow[],
+  row: JournalRow
+): string | null {
+  const echoes = appendedItems(row).filter(
+    (item) =>
+      isProviderUserMessageEcho(item.itemId, item.body) &&
+      !state.items.has(item.itemId) &&
+      !state.aliases.has(item.itemId) &&
+      journalEchoClaimant(state, item.itemId, item.body) === null
+  )
+  if (echoes.length === 0) {
+    return null
+  }
+  const spent = spentWaitingDrafts(state, drafts())
+  for (const item of echoes) {
+    const delivered = spent.find((draft) => echoProvesDelivered(state, draft, item.body, row.seq))
+    if (delivered) {
+      return delivered.draft.messageId
+    }
+  }
+  return null
+}
+
+/**
+ * The re-derivation behind that per-row hook, which is bookkeeping and may be
+ * skipped: waiting drafts an echo ALREADY in the journal proves delivered. An
+ * unclaimed echo is the item still stored under its provider id — a claimed one
+ * was folded into its submission's item. Reads every item, so callers run it
+ * only where a draft is about to send, never per streamed row.
+ */
+export function draftsDeliveredByAppliedEcho(
+  state: JournalReducerState,
+  drafts: readonly QueuedMessageRow[]
+): string[] {
+  const spent = spentWaitingDrafts(state, drafts)
+  if (spent.length === 0) {
+    return []
+  }
+  const delivered = new Set<string>()
+  for (const item of state.items.values()) {
+    if (!isProviderUserMessageEcho(item.itemId, item.body)) {
+      continue
+    }
+    for (const candidate of spent) {
+      if (echoProvesDelivered(state, candidate, item.body, item.sequence)) {
+        delivered.add(candidate.draft.messageId)
+      }
+    }
+  }
+  return [...delivered]
+}
+
+type SpentDraft = { draft: QueuedMessageRow; since: number }
+
+/** Waiting drafts some hand-off of which was handed over, then rejected as never delivered;
+ *  `since` is the earliest such hand-off's row. A hand-off rejected before hand-over is
+ *  provably unwritten: an echo matching it is some other message, and must not delete the card. */
+function spentWaitingDrafts(
+  state: JournalReducerState,
+  drafts: readonly QueuedMessageRow[]
+): SpentDraft[] {
+  const since = new Map<string, number>()
+  for (const submission of state.submissions.values()) {
+    if (
+      submission.queuedMessageId !== undefined &&
+      submission.dispatchState === 'rejected' &&
+      submission.handedOverAt !== undefined
+    ) {
+      const sequence = submission.acceptedSequence ?? 0
+      const earliest = since.get(submission.queuedMessageId)
+      since.set(submission.queuedMessageId, Math.min(earliest ?? sequence, sequence))
+    }
+  }
+  return drafts.flatMap((draft) => {
+    const from = since.get(draft.messageId)
+    return draft.state === 'waiting' && from !== undefined ? [{ draft, since: from }] : []
+  })
+}
+
+/** The one predicate both paths share: an unclaimed echo appended after a disproved hand-off,
+ *  carrying the draft's own payload. */
+function echoProvesDelivered(
+  state: JournalReducerState,
+  spent: SpentDraft,
+  body: AgentJournalItemBody,
+  sequence: number
+): boolean {
+  return (
+    sequence > spent.since &&
+    structuredAgentSessionPayloadFingerprint({
+      method: 'agentSession.send',
+      sessionId: state.sessionId,
+      fields: { body }
+    }) === spent.draft.fingerprint
+  )
+}
+
+function appendedItems(row: JournalRow): { itemId: string; body: AgentJournalItemBody }[] {
+  if (row.kind === 'item') {
+    return [{ itemId: row.itemId, body: row.body }]
+  }
+  if (row.kind === 'lifecycle-batch') {
+    return row.mutations.flatMap((mutation) =>
+      mutation.kind === 'item' ? [{ itemId: mutation.itemId, body: mutation.body }] : []
+    )
+  }
+  return []
+}
diff --git a/src/main/native-chat/agent-session-journal/queued-message-holds.ts b/src/main/native-chat/agent-session-journal/queued-message-holds.ts
new file mode 100644
index 00000000000..665466d60e7
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/queued-message-holds.ts
@@ -0,0 +1,49 @@
+// Per-draft holds: what keeps one card from auto-sending, stored on its row. A
+// Stop or a restart pauses the whole queue instead (`queued-message-pause-table.ts`,
+// and the host instance each row records); a per-draft hold is only a
+// conversion that failed, which an explicit Send releases.
+
+import type Database from '../../sqlite/sync-database'
+import type { QueuedMessageHoldReason } from './queued-message-table'
+
+/** Hold waiting drafts from auto-sending. The hold retires with the row: consume
+ *  and withdraw clear it in their own UPDATE. Returns how many rows it newly reached. */
+export function holdQueuedMessages(
+  db: Database.Database,
+  input: {
+    sessionId: string
+    messageIds: readonly string[]
+    reason: QueuedMessageHoldReason
+  }
+): number {
+  const update = db.prepare(
+    `UPDATE queued_messages SET hold_reason = ?
+     WHERE session_id = ? AND message_id = ? AND state = 'waiting'
+       AND (hold_reason IS NULL OR hold_reason <> ?)`
+  )
+  let held = 0
+  for (const messageId of input.messageIds) {
+    held += Number(update.run(input.reason, input.sessionId, messageId, input.reason).changes ?? 0)
+  }
+  return held
+}
+
+/** Ends a restart's pause: waiting rows another host instance wrote are adopted
+ *  into this one, the same fact the pause is derived from, so no second copy
+ *  exists. Also clears a per-row 'stopped' hold an earlier build of the queue
+ *  wrote, which this build only ever lifts. Returns how many rows it changed. */
+export function adoptQueuedMessages(
+  db: Database.Database,
+  input: { sessionId: string; hostInstance: string }
+): number {
+  return Number(
+    db
+      .prepare(
+        `UPDATE queued_messages
+         SET host_instance = ?, hold_reason = CASE WHEN hold_reason = 'stopped' THEN NULL ELSE hold_reason END
+         WHERE session_id = ? AND state = 'waiting'
+           AND (host_instance <> ? OR hold_reason = 'stopped')`
+      )
+      .run(input.hostInstance, input.sessionId, input.hostInstance).changes ?? 0
+  )
+}
diff --git a/src/main/native-chat/agent-session-journal/queued-message-pause-table.ts b/src/main/native-chat/agent-session-journal/queued-message-pause-table.ts
new file mode 100644
index 00000000000..41387165de0
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/queued-message-pause-table.ts
@@ -0,0 +1,161 @@
+// The queue-level pause fact: where in the journal the user's last Stop (or a
+// /clear, which starts its replacement paused) took effect. The pause itself is never stored — it is derived from this fact and
+// the journal rows after it (a user-requested turn that started ends it); the
+// fact only records the one event the journal's closed row kinds cannot carry.
+// An explicit Resume retires it.
+
+import type Database from '../../sqlite/sync-database'
+
+export type QueuePauseReason = 'stopped' | 'cleared'
+
+export type QueuePauseFact = {
+  reason: QueuePauseReason
+  /** The journal position the Stop took effect at: rows after it are later. */
+  epoch: string
+  sequence: number
+  recordedAt: number
+}
+
+export function readQueuePause(db: Database.Database, sessionId: string): QueuePauseFact | null {
+  const row: unknown = db
+    .prepare(
+      'SELECT reason, epoch, sequence, recorded_at FROM queued_message_pauses WHERE session_id = ?'
+    )
+    .get(sessionId)
+  if (
+    typeof row !== 'object' ||
+    row === null ||
+    !('reason' in row) ||
+    (row.reason !== 'stopped' && row.reason !== 'cleared') ||
+    !('epoch' in row) ||
+    typeof row.epoch !== 'string' ||
+    !('sequence' in row) ||
+    typeof row.sequence !== 'number' ||
+    !('recorded_at' in row) ||
+    typeof row.recorded_at !== 'number'
+  ) {
+    // A reason this build cannot place reads as no pause rather than a wrong one.
+    return null
+  }
+  return {
+    reason: row.reason,
+    epoch: row.epoch,
+    sequence: row.sequence,
+    recordedAt: row.recorded_at
+  }
+}
+
+/** The latest Stop replaces an earlier one: only the last interruption decides. */
+export function recordQueuePause(
+  db: Database.Database,
+  input: { sessionId: string; fact: QueuePauseFact }
+): void {
+  db.prepare(
+    `INSERT INTO queued_message_pauses (session_id, reason, epoch, sequence, recorded_at)
+     VALUES (?, ?, ?, ?, ?)
+     ON CONFLICT (session_id) DO UPDATE SET
+       reason = excluded.reason, epoch = excluded.epoch,
+       sequence = excluded.sequence, recorded_at = excluded.recorded_at`
+  ).run(
+    input.sessionId,
+    input.fact.reason,
+    input.fact.epoch,
+    input.fact.sequence,
+    input.fact.recordedAt
+  )
+}
+
+/** Compare-and-clear: only the fact the caller judged, so a Stop recorded since stands. */
+export function clearQueuePause(
+  db: Database.Database,
+  input: { sessionId: string; fact: Pick<QueuePauseFact, 'epoch' | 'sequence'> }
+): number {
+  return Number(
+    db
+      .prepare(
+        'DELETE FROM queued_message_pauses WHERE session_id = ? AND epoch = ? AND sequence = ?'
+      )
+      .run(input.sessionId, input.fact.epoch, input.fact.sequence).changes ?? 0
+  )
+}
+
+type QueueCardState = { state: string; holdReason: string | null }
+
+/** A card a pause holds back: waiting, with no hold of its own, wherever it sits.
+ *  While one exists — or a hand-off still owed a return to waiting
+ *  (`queuePauseHoldsBack`) — the pause is KEPT: a Stop records it, and it is
+ *  retired only once none remains, so deleting a returned card that blocks such
+ *  cards leaves them paused rather than sending them unasked. */
+export function isPausableQueuedMessage(row: QueueCardState): boolean {
+  return row.state === 'waiting' && row.holdReason === null
+}
+
+/** Whether Resume would send anything: a pausable card not behind a returned one,
+ *  which blocks everything after it until the user acts, exactly as the drain
+ *  reads it. Only then is the kept pause PUBLISHED, so its header never offers a
+ *  Resume that sends nothing. */
+export function hasResumableQueuedMessage(rows: readonly QueueCardState[]): boolean {
+  for (const row of rows) {
+    if (row.state === 'returned') {
+      return false
+    }
+    if (isPausableQueuedMessage(row)) {
+      return true
+    }
+  }
+  return false
+}
+
+/** What a queue pause holds back, judged inside the caller's transaction: a waiting
+ *  card with no hold of its own (`isPausableQueuedMessage`, in SQL), or a dispatched
+ *  one whose settlement back to waiting is still owed — its hook was skipped, so the
+ *  row has not caught up with its rejected submission, which only the journal's
+ *  submissions can tell (`owedToWaiting`). */
+export function queuePauseHoldsBack(
+  db: Database.Database,
+  input: { sessionId: string; owedToWaiting: (consumedRef: string) => boolean }
+): boolean {
+  const pausable = db
+    .prepare(
+      `SELECT 1 FROM queued_messages
+       WHERE session_id = ? AND state = 'waiting' AND hold_reason IS NULL LIMIT 1`
+    )
+    .get(input.sessionId)
+  if (pausable !== undefined) {
+    return true
+  }
+  return db
+    .prepare(
+      `SELECT consumed_as FROM queued_messages
+       WHERE session_id = ? AND state = 'dispatched' AND consumed_as IS NOT NULL`
+    )
+    .all(input.sessionId)
+    .some(
+      (row) =>
+        typeof row === 'object' &&
+        row !== null &&
+        'consumed_as' in row &&
+        typeof row.consumed_as === 'string' &&
+        input.owedToWaiting(row.consumed_as)
+    )
+}
+
+/** A pause is over the cards it paused: once it holds back none (`queuePauseHoldsBack`),
+ *  the fact goes too, in the same transaction as the write that took the last one, so
+ *  it can never outlive them and catch a card typed long after. */
+export function retireQueuePauseIfNothingHeld(
+  db: Database.Database,
+  input: { sessionId: string; owedToWaiting: (consumedRef: string) => boolean }
+): number {
+  // Runs on every appended journal row: with no pause recorded there is nothing to judge.
+  const recorded = db
+    .prepare('SELECT 1 FROM queued_message_pauses WHERE session_id = ?')
+    .get(input.sessionId)
+  if (recorded === undefined || queuePauseHoldsBack(db, input)) {
+    return 0
+  }
+  return Number(
+    db.prepare('DELETE FROM queued_message_pauses WHERE session_id = ?').run(input.sessionId)
+      .changes ?? 0
+  )
+}
diff --git a/src/main/native-chat/agent-session-journal/queued-message-retention.ts b/src/main/native-chat/agent-session-journal/queued-message-retention.ts
new file mode 100644
index 00000000000..cf18a1e5006
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/queued-message-retention.ts
@@ -0,0 +1,74 @@
+// Retention for the draft table: which settled rows may be deleted, and when. A row is kept for
+// as long as anything could still read it — a replayed operation, or a late refusal returning it.
+
+import type Database from '../../sqlite/sync-database'
+import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
+import { listQueuedMessages } from './queued-message-table'
+
+/** What the loaded journal says about a dispatched draft's consumed submission. */
+export type QueuedMessageSubmissionVerdict =
+  /** Still owed an answer — a crash leftover the delivery loop will reject; keep the row. */
+  | 'pending'
+  /** `accepted` or `unknown`: terminal and not refused. */
+  | 'terminal-not-refused'
+  /** Absent from the current epoch. */
+  | 'absent'
+  /** Effectively rejected; the open-time repair settles it rather than pruning. */
+  | 'rejected'
+
+/**
+ * Retention: `withdrawn` tombstones live for the operation-replay window;
+ * a `dispatched` row only once its consumed submission is terminal-and-not-
+ * refused or absent AND the window has passed — never while pending, so a slow
+ * refusal can still return it. `waiting` and `returned` rows are never pruned.
+ */
+export function pruneQueuedMessages(
+  db: Database.Database,
+  input: {
+    sessionId: string
+    now: number
+    replayWindowMs: number
+    submissionVerdict: (consumedRef: string) => QueuedMessageSubmissionVerdict
+  }
+): number {
+  const cutoff = input.now - input.replayWindowMs
+  const tombstones = db
+    .prepare(
+      `DELETE FROM queued_messages
+     WHERE session_id = ? AND state = 'withdrawn' AND settled_at IS NOT NULL AND settled_at < ?`
+    )
+    .run(input.sessionId, cutoff)
+  let pruned = Number(tombstones.changes ?? 0)
+  for (const row of listQueuedMessages(db, input.sessionId)) {
+    if (row.state !== 'dispatched' || row.settledAt === null || row.settledAt >= cutoff) {
+      continue
+    }
+    // A dispatched row always names its hand-off; one that does not has nothing to wait for.
+    const verdict = row.consumedAs === null ? 'absent' : input.submissionVerdict(row.consumedAs)
+    if (verdict === 'terminal-not-refused' || verdict === 'absent') {
+      db.prepare('DELETE FROM queued_messages WHERE session_id = ? AND message_id = ?').run(
+        input.sessionId,
+        row.messageId
+      )
+      pruned += 1
+    }
+  }
+  return pruned
+}
+
+/** How retention reads a consumed submission from the loaded journal. Run after the
+ *  owed settlements, which already settled every rejected row. */
+export function retainedSubmissionVerdict(
+  submissions: ReadonlyMap<string, AgentJournalSubmission>
+): (consumedRef: string) => QueuedMessageSubmissionVerdict {
+  return (consumedRef) => {
+    const submission = submissions.get(consumedRef)
+    if (!submission) {
+      return 'absent'
+    }
+    if (submission.dispatchState === 'accepted' || submission.dispatchState === 'unknown') {
+      return 'terminal-not-refused'
+    }
+    return submission.dispatchState === 'rejected' ? 'rejected' : 'pending'
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/queued-message-schema.ts b/src/main/native-chat/agent-session-journal/queued-message-schema.ts
new file mode 100644
index 00000000000..31806e6b71a
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/queued-message-schema.ts
@@ -0,0 +1,72 @@
+// The draft table's shape, created and healed at every writable open.
+
+import type Database from '../../sqlite/sync-database'
+
+/** Columns a later build added, so an older draft table can gain them in place. */
+const NULLABLE_COLUMNS: readonly (readonly [name: string, type: string])[] = [
+  ['hold_reason', 'TEXT'],
+  ['returned_reason', 'TEXT'],
+  ['returned_rejection', 'TEXT'],
+  ['settled_at', 'INTEGER'],
+  ['settled_by_op', 'TEXT'],
+  ['consumed_as', 'TEXT']
+]
+
+/**
+ * Created idempotently at EVERY writable open, never lazily at first insert, so
+ * no reader hits "no such table". Deliberately no `user_version` bump: an old
+ * build sees stored == supported and stays writable, ignoring the table; a bump
+ * would latch every opened db read-only after a downgrade (`journal-database.ts`).
+ * For the same reason a missing column is added here rather than versioned:
+ * `CREATE TABLE IF NOT EXISTS` never reshapes a table an earlier build created.
+ */
+export function ensureQueuedMessagesTable(db: Database.Database): void {
+  db.exec(`
+CREATE TABLE IF NOT EXISTS queued_messages (
+  session_id      TEXT    NOT NULL,
+  message_id      TEXT    NOT NULL,
+  position        INTEGER NOT NULL,
+  body_json       TEXT    NOT NULL,
+  fingerprint     TEXT    NOT NULL,
+  created_at      INTEGER NOT NULL,
+  host_instance   TEXT    NOT NULL,
+  state           TEXT    NOT NULL,
+  hold_reason     TEXT,
+  returned_reason TEXT,
+  returned_rejection TEXT,
+  settled_at      INTEGER,
+  settled_by_op   TEXT,
+  consumed_as     TEXT,
+  PRIMARY KEY (session_id, message_id)
+);
+`)
+  const names = new Set(
+    db
+      .prepare('PRAGMA table_info(queued_messages)')
+      .all()
+      .flatMap((column) =>
+        typeof column === 'object' &&
+        column !== null &&
+        'name' in column &&
+        typeof column.name === 'string'
+          ? [column.name]
+          : []
+      )
+  )
+  for (const [name, type] of NULLABLE_COLUMNS) {
+    if (!names.has(name)) {
+      db.exec(`ALTER TABLE queued_messages ADD COLUMN ${name} ${type}`)
+    }
+  }
+  db.exec(`
+CREATE UNIQUE INDEX IF NOT EXISTS queued_messages_consumed_as
+  ON queued_messages (session_id, consumed_as) WHERE consumed_as IS NOT NULL;
+CREATE TABLE IF NOT EXISTS queued_message_pauses (
+  session_id  TEXT    PRIMARY KEY,
+  reason      TEXT    NOT NULL,
+  epoch       TEXT    NOT NULL,
+  sequence    INTEGER NOT NULL,
+  recorded_at INTEGER NOT NULL
+);
+`)
+}
diff --git a/src/main/native-chat/agent-session-journal/queued-message-settlement.ts b/src/main/native-chat/agent-session-journal/queued-message-settlement.ts
new file mode 100644
index 00000000000..75e62256780
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/queued-message-settlement.ts
@@ -0,0 +1,142 @@
+// What a journal row does to the drafts, and the re-derivation behind it. The
+// live hook runs inside each append's transaction; it is bookkeeping and may be
+// skipped, so a dispatched draft whose current submission the journal already
+// rejected is owed the settlement it would have applied, which the open-time
+// repair and the drain both apply.
+
+import type Database from '../../sqlite/sync-database'
+import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
+import {
+  consumedSubmissionWasRejected,
+  journalDispatchRowNewlyRejects,
+  rejectedDraftSettlement
+} from './journal-dispatch-settlement'
+import type { JournalReducerState } from './journal-reducer'
+import type { JournalRow } from './journal-row-schema'
+import { draftDeliveredByEcho, draftsDeliveredByAppliedEcho } from './queued-message-delivered-echo'
+import {
+  listQueuedMessages,
+  settleRejectedQueuedMessage,
+  withdrawQueuedMessages,
+  type QueuedMessageRow
+} from './queued-message-table'
+
+type Submissions = ReadonlyMap<string, AgentJournalSubmission>
+
+/** Some dispatched draft still waits on a settlement the journal already decided. */
+export function queuedMessageSettlementOwed(
+  rows: readonly QueuedMessageRow[],
+  submissions: Submissions
+): boolean {
+  return rows.some(
+    (row) =>
+      row.state === 'dispatched' &&
+      row.consumedAs !== null &&
+      consumedSubmissionWasRejected(submissions.get(row.consumedAs))
+  )
+}
+
+/** A dispatched draft's consumed submission settled so that the draft is owed a
+ *  return to waiting (a withdrawal, not a refusal): what a queue pause must still
+ *  count as a card it holds back while that settlement is owed. */
+export function owedBackToWaiting(submissions: Submissions): (consumedRef: string) => boolean {
+  return (consumedRef) => {
+    const submission = submissions.get(consumedRef)
+    return (
+      submission !== undefined &&
+      consumedSubmissionWasRejected(submission) &&
+      rejectedDraftSettlement(submission).state === 'waiting'
+    )
+  }
+}
+
+/** Applies each owed settlement, and withdraws each waiting draft an applied echo proves
+ *  delivered (`draftsDeliveredByAppliedEcho`); returns how many drafts changed. */
+export function settleOwedQueuedMessages(
+  db: Database.Database,
+  input: { sessionId: string; state: JournalReducerState; now: number }
+): number {
+  const { submissions } = input.state
+  let settled = 0
+  for (const row of listQueuedMessages(db, input.sessionId)) {
+    const consumedRef = row.consumedAs
+    const submission = consumedRef === null ? undefined : submissions.get(consumedRef)
+    if (
+      row.state !== 'dispatched' ||
+      consumedRef === null ||
+      !consumedSubmissionWasRejected(submission)
+    ) {
+      continue
+    }
+    const changed = settleRejectedQueuedMessage(db, {
+      sessionId: input.sessionId,
+      consumedRef,
+      reason: submission?.reason ?? null,
+      rejection: submission?.rejection,
+      now: input.now
+    })
+    settled += changed ? 1 : 0
+  }
+  const delivered = draftsDeliveredByAppliedEcho(
+    input.state,
+    listQueuedMessages(db, input.sessionId)
+  )
+  if (delivered.length > 0) {
+    settled += withdrawQueuedMessages(db, {
+      sessionId: input.sessionId,
+      messageIds: delivered,
+      settledByOp: null,
+      now: input.now
+    }).length
+  }
+  return settled
+}
+
+/**
+ * The live hook, before `row` applies: an echo proving a waiting draft's first
+ * send was delivered withdraws it; a row that NEWLY settles a dispatched
+ * draft's current submission to `rejected` settles the draft — a refusal
+ * returns it, a withdrawal (a Stop, a restart) sends it back to waiting.
+ * Decided by the same function the reducer folds rows through, so a row the
+ * journal's settlement rules ignore never alters a draft. Returns how many
+ * drafts changed.
+ */
+export function settleQueuedMessagesForRow(
+  db: Database.Database,
+  input: {
+    sessionId: string
+    state: JournalReducerState
+    /** Read only once the row holds an unclaimed echo: a list read inside the append's
+     *  transaction must not be cached under state a rollback could undo. */
+    drafts: () => readonly QueuedMessageRow[]
+    row: JournalRow
+    now: number
+  }
+): number {
+  const { row } = input
+  let changed = 0
+  const delivered = draftDeliveredByEcho(input.state, input.drafts, row)
+  if (delivered !== null) {
+    // Its first send reached the agent after all; sending it again would repeat it.
+    changed += withdrawQueuedMessages(db, {
+      sessionId: input.sessionId,
+      messageIds: [delivered],
+      settledByOp: null,
+      now: input.now
+    }).length
+  }
+  if (row.kind !== 'dispatch' || row.state !== 'rejected') {
+    return changed
+  }
+  if (!journalDispatchRowNewlyRejects(input.state.submissions.get(row.clientMessageId), row)) {
+    return changed
+  }
+  const settled = settleRejectedQueuedMessage(db, {
+    sessionId: input.sessionId,
+    consumedRef: row.clientMessageId,
+    reason: row.reason,
+    rejection: row.rejection,
+    now: input.now
+  })
+  return changed + (settled ? 1 : 0)
+}
diff --git a/src/main/native-chat/agent-session-journal/queued-message-store.test.ts b/src/main/native-chat/agent-session-journal/queued-message-store.test.ts
new file mode 100644
index 00000000000..4f9b6f81e03
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/queued-message-store.test.ts
@@ -0,0 +1,835 @@
+// The draft store's contract: exactly-once consume in one transaction, the
+// rejected-draft settlement following the journal's EFFECTIVE settlement, retention
+// that never outruns a slow refusal, and rows that survive epoch replacement.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
+import type {
+  AgentJournalMessageItem,
+  AgentSessionJournalIdentity
+} from '../../../shared/agent-session-journal-types'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
+import Database from '../../sqlite/sync-database'
+import { journalDatabaseFile } from './journal-paths'
+import {
+  JournalQueuedMessages,
+  QUEUED_MESSAGE_REPLAY_WINDOW_MS,
+  QueuedMessageNotConsumableError
+} from './journal-queued-messages'
+import type { AgentSessionJournal } from './journal-store'
+import { createTrackedJournalOpener } from './journal-store-test-open'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: 'session-q',
+  workspaceId: 'ws-1',
+  hostId: 'host-1',
+  agent: 'claude',
+  providerHandle: { kind: 'claude', sessionId: 'native-1', leafUuid: null }
+}
+
+let root: string
+let clock = 1_000
+
+function tick(): number {
+  clock += 1
+  return clock
+}
+
+function message(text: string): AgentJournalMessageItem {
+  return { kind: 'message', role: 'user', blocks: [{ type: 'text', text }] }
+}
+
+const journals = createTrackedJournalOpener()
+const STOP_WITHDRAWAL = agentSessionFailureWords(agentSessionFailureFact('cancelled'), {
+  surface: 'rejection'
+})
+const HOST_RESTARTED = agentSessionFailureWords(agentSessionFailureFact('hostRestarted'), {
+  surface: 'rejection'
+})
+const PROVIDER_REFUSAL = agentSessionFailureFact('providerRejected', {
+  detail: { text: 'Claude refused this payload', audience: 'person' }
+})
+/** A provider refusal as a settled rejection stores it: its sentence and typed fact. */
+function refusal(text: string) {
+  return agentSessionFailureWords(
+    agentSessionFailureFact('providerRejected', { detail: { text, audience: 'person' } }),
+    { surface: 'rejection' }
+  )
+}
+
+async function open(): Promise<AgentSessionJournal> {
+  const journal = await journals.open({
+    identity: IDENTITY,
+    journalDir: root,
+    now: tick,
+    mintEpoch: () => `epoch-${clock}`
+  })
+  return journal
+}
+
+async function queueDraft(journal: AgentSessionJournal, messageId: string, text = 'queued text') {
+  return journal.queuedMessages.insert({
+    messageId,
+    body: message(text),
+    fingerprint: `fp-${messageId}`,
+    hostInstance: 'proc-1'
+  })
+}
+
+async function consumeDraft(
+  journal: AgentSessionJournal,
+  messageId: string,
+  options: { as?: string; expect?: 'waiting' | 'returned'; settledByOp?: string | null } = {}
+) {
+  const draft = journal.queuedMessages.get(messageId)
+  await journal.appendSubmission(
+    {
+      clientMessageId: options.as ?? `sub-${messageId}`,
+      payloadFingerprint: draft?.fingerprint ?? `fp-${messageId}`,
+      body: draft?.body ?? message('queued text'),
+      fence: 0,
+      handoverRecorded: true
+    },
+    {
+      messageId,
+      expect: options.expect ?? 'waiting',
+      settledByOp: options.settledByOp ?? null
+    }
+  )
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-queued-message-'))
+  clock = 1_000
+})
+
+afterEach(async () => {
+  await journals.closeAll()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('draft rows', () => {
+  it('creates the table at open without bumping user_version, so an old build stays writable', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await journal.close()
+    const db = new Database(journalDatabaseFile(root), { readonly: true })
+    try {
+      const version = Number(db.pragma('user_version', { simple: true }))
+      // An old build compares stored == supported and keeps writing; a bump
+      // would latch it read-only after downgrade.
+      expect(version).toBe(2)
+      const table = db
+        .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?")
+        .get('queued_messages')
+      expect(table).toBeDefined()
+    } finally {
+      db.close()
+    }
+  })
+
+  it('opens a database an older build shaped (no drafts table) and creates the table', async () => {
+    const first = await open()
+    await first.appendItem(
+      { provider: 'orca', clientMessageId: 'seed' },
+      { kind: 'status', text: 'seed' },
+      { fence: 0, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
+    await first.close()
+    const db = new Database(journalDatabaseFile(root))
+    db.exec('DROP TABLE queued_messages')
+    db.close()
+    const journal = await open()
+    expect(journal.isReadOnly).toBe(false)
+    const row = await queueDraft(journal, 'draft-1')
+    expect(row.position).toBe(1)
+  })
+
+  it('assigns monotonic positions and lists in order', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await queueDraft(journal, 'draft-2')
+    const listed = journal.queuedMessages.list()
+    expect(listed.map((row) => [row.messageId, row.position, row.state])).toEqual([
+      ['draft-1', 1, 'waiting'],
+      ['draft-2', 2, 'waiting']
+    ])
+  })
+
+  it('replays an insert under an already-used id instead of duplicating', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    const again = await queueDraft(journal, 'draft-1')
+    expect(again.position).toBe(1)
+    expect(journal.queuedMessages.list()).toHaveLength(1)
+  })
+
+  it('drafts survive epoch replacement, which deletes only journal rows', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await journal.replaceEpochItems('handle_forked', 0, [])
+    expect(journal.queuedMessages.list().map((row) => row.messageId)).toEqual(['draft-1'])
+  })
+})
+
+describe('consume', () => {
+  it('converts waiting → dispatched and appends the submission in one transaction', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await consumeDraft(journal, 'draft-1')
+    const row = journal.queuedMessages.get('draft-1')
+    expect(row?.state).toBe('dispatched')
+    expect(row?.consumedAs).toBe('sub-draft-1')
+    expect(journal.submissions().map((entry) => entry.clientMessageId)).toEqual(['sub-draft-1'])
+  })
+
+  it('never hands a draft off under its own id: the submission names it by link, not id equality', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await expect(consumeDraft(journal, 'draft-1', { as: 'draft-1' })).rejects.toBeInstanceOf(
+      QueuedMessageNotConsumableError
+    )
+    expect(journal.submissions()).toHaveLength(0)
+    expect(journal.queuedMessages.get('draft-1')?.state).toBe('waiting')
+  })
+
+  it('never records a second submission under an id it already holds, whatever state it settled in', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await consumeDraft(journal, 'draft-1')
+    await journal.resolveDispatch({
+      clientMessageId: 'sub-draft-1',
+      state: 'rejected',
+      ...refusal('refused'),
+      fence: 0
+    })
+    const cursor = journal.cursor()
+    await expect(
+      journal.appendSubmission({
+        clientMessageId: 'sub-draft-1',
+        payloadFingerprint: 'fp-draft-1',
+        body: message('queued text'),
+        fence: 0,
+        handoverRecorded: true
+      })
+    ).rejects.toMatchObject({ code: 'journal_submission_exists' })
+    // The refusal stands: re-appending would reset it to pending and hand it over again.
+    expect(journal.submission('sub-draft-1')?.dispatchState).toBe('rejected')
+    expect(journal.cursor()).toEqual(cursor)
+  })
+
+  it('a second consume of the same draft fails and appends nothing (exactly-once)', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await consumeDraft(journal, 'draft-1')
+    await expect(consumeDraft(journal, 'draft-1', { as: 'second-id' })).rejects.toBeInstanceOf(
+      QueuedMessageNotConsumableError
+    )
+    expect(journal.submissions().map((entry) => entry.clientMessageId)).toEqual(['sub-draft-1'])
+  })
+
+  it('a consume racing a withdraw loses and appends nothing', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await journal.queuedMessages.withdraw({
+      messageIds: ['draft-1'],
+      settledByOp: 'caller\u0000op-1'
+    })
+    await expect(consumeDraft(journal, 'draft-1')).rejects.toBeInstanceOf(
+      QueuedMessageNotConsumableError
+    )
+    expect(journal.submissions()).toHaveLength(0)
+    expect(journal.queuedMessages.get('draft-1')?.state).toBe('withdrawn')
+  })
+
+  it('a failed submission insert rolls the draft transition back', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    const cursor = journal.cursor()
+    // Occupy the next sequence directly so the append's INSERT violates the
+    // primary key inside the transaction, after the draft was transitioned.
+    const db = new Database(journalDatabaseFile(root))
+    db.prepare(
+      'INSERT INTO journal_rows (session_id, epoch, seq, ts, row_json) VALUES (?, ?, ?, ?, ?)'
+    ).run(IDENTITY.sessionId, cursor.epoch, cursor.sequence + 1, tick(), '{}')
+    db.close()
+    await expect(consumeDraft(journal, 'draft-1')).rejects.toThrow()
+    expect(journal.queuedMessages.get('draft-1')?.state).toBe('waiting')
+  })
+})
+
+describe('returned transition (D1/N4)', () => {
+  it('a non-withdrawn rejection returns the consumed draft with its reason', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await consumeDraft(journal, 'draft-1')
+    await journal.resolveDispatch({
+      clientMessageId: 'sub-draft-1',
+      state: 'rejected',
+      ...refusal('Claude refused this payload'),
+      rejection: PROVIDER_REFUSAL,
+      fence: 0
+    })
+    const row = journal.queuedMessages.get('draft-1')
+    expect(row?.state).toBe('returned')
+    expect(row?.returnedReason).toBe(refusal('Claude refused this payload').reason)
+    expect(row?.returnedRejection).toEqual(PROVIDER_REFUSAL)
+  })
+
+  it('a late rejection row after acceptance settles nothing and returns no card', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await consumeDraft(journal, 'draft-1')
+    await journal.resolveDispatch({
+      clientMessageId: 'sub-draft-1',
+      state: 'accepted',
+      providerIdentity: { provider: 'claude', sessionId: 'native-1', uuid: 'echo-1' },
+      fence: 0
+    })
+    await journal.resolveDispatch({
+      clientMessageId: 'sub-draft-1',
+      state: 'rejected',
+      ...refusal('late duplicate'),
+      fence: 0
+    })
+    expect(journal.queuedMessages.get('draft-1')?.state).toBe('dispatched')
+  })
+
+  it("a Stop's withdrawal before the agent received it sends the draft back to waiting, held like the rest, and it survives a restart", async () => {
+    let journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await consumeDraft(journal, 'draft-1')
+    // The Stop's own withdrawal path: the queued (not handed over) submission.
+    expect(await journal.rejectQueuedSubmissions(0, STOP_WITHDRAWAL)).toEqual(['sub-draft-1'])
+    // Nothing failed: no refusal to show, its position kept, its spent id recorded.
+    const requeued = {
+      state: 'waiting',
+      position: 1,
+      holdReason: null,
+      consumedAs: null,
+      returnedReason: null,
+      returnedRejection: null
+    }
+    expect(journal.queuedMessages.get('draft-1')).toMatchObject(requeued)
+    // Atomic with the rejection row: a crash before the Stop answered keeps the text.
+    await journal.close()
+    clock += QUEUED_MESSAGE_REPLAY_WINDOW_MS + 1_000
+    journal = await open()
+    expect(journal.queuedMessages.get('draft-1')).toMatchObject(requeued)
+  })
+
+  it('a draft sent back to waiting hands off again under a fresh id, never a spent one', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await consumeDraft(journal, 'draft-1')
+    await journal.rejectQueuedSubmissions(0, STOP_WITHDRAWAL)
+    // The spent id already names a rejected submission: one id, one delivery.
+    await expect(consumeDraft(journal, 'draft-1')).rejects.toMatchObject({
+      code: 'journal_submission_exists'
+    })
+    expect(journal.submission('sub-draft-1')?.dispatchState).toBe('rejected')
+    await consumeDraft(journal, 'draft-1', { as: 'fresh-1' })
+    expect(journal.queuedMessages.get('draft-1')).toMatchObject({
+      state: 'dispatched',
+      consumedAs: 'fresh-1'
+    })
+    // Both hand-offs name the draft.
+    expect(journal.submission('fresh-1')).toMatchObject({
+      dispatchState: 'pending',
+      queuedMessageId: 'draft-1'
+    })
+    expect(journal.submission('sub-draft-1')?.queuedMessageId).toBe('draft-1')
+  })
+
+  it("a restart between consume and handover sends the draft back to waiting under the restart's pause", async () => {
+    let journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await consumeDraft(journal, 'draft-1')
+    await journal.close()
+    journal = await open()
+    expect(journal.queuedMessages.get('draft-1')?.state).toBe('dispatched')
+    await journal.rejectQueuedSubmissions(0, HOST_RESTARTED, (submission) =>
+      journal.wroteBeforeOpen(submission.acceptedSequence)
+    )
+    // No stored hold: the restart's pause derives from the row's host instance.
+    expect(journal.queuedMessages.get('draft-1')).toMatchObject({
+      state: 'waiting',
+      holdReason: null,
+      hostInstance: 'proc-1',
+      consumedAs: null,
+      returnedReason: null
+    })
+  })
+
+  it('refuse → Send under a fresh id → refuse again returns the card again; a late duplicate of the first refusal never touches the re-send (N4)', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await consumeDraft(journal, 'draft-1')
+    await journal.resolveDispatch({
+      clientMessageId: 'sub-draft-1',
+      state: 'rejected',
+      ...refusal('first refusal'),
+      rejection: PROVIDER_REFUSAL,
+      fence: 0
+    })
+    expect(journal.queuedMessages.get('draft-1')?.state).toBe('returned')
+    // Send on the returned card re-consumes under a fresh submission id.
+    await consumeDraft(journal, 'draft-1', { as: 'resend-1', expect: 'returned' })
+    // The earlier refusal retires with the card: the row now describes the re-send.
+    expect(journal.queuedMessages.get('draft-1')).toMatchObject({
+      state: 'dispatched',
+      consumedAs: 'resend-1',
+      returnedReason: null,
+      returnedRejection: null
+    })
+    // A duplicate resolution of the FIRST submission is ignored by the journal
+    // and must not alter the draft's current relation.
+    await journal.resolveDispatch({
+      clientMessageId: 'sub-draft-1',
+      state: 'rejected',
+      ...refusal('duplicate of first refusal'),
+      fence: 0
+    })
+    expect(journal.queuedMessages.get('draft-1')?.state).toBe('dispatched')
+    // The re-send's own refusal returns the card, matched via consumed_as.
+    await journal.resolveDispatch({
+      clientMessageId: 'resend-1',
+      state: 'rejected',
+      ...refusal('second refusal'),
+      fence: 0
+    })
+    const returned = journal.queuedMessages.get('draft-1')
+    expect(returned?.state).toBe('returned')
+    expect(returned?.returnedReason).toBe(refusal('second refusal').reason)
+    // The first refusal's fact does not outlive it: the pair is the second submission's.
+    expect(returned?.returnedRejection).toEqual(refusal('second refusal').rejection)
+    expect(returned?.returnedRejection).not.toEqual(PROVIDER_REFUSAL)
+  })
+
+  it('a rejection never revives a withdrawn draft', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await consumeDraft(journal, 'draft-1')
+    await journal.resolveDispatch({
+      clientMessageId: 'sub-draft-1',
+      state: 'rejected',
+      ...refusal('refused'),
+      fence: 0
+    })
+    await journal.queuedMessages.withdraw({ messageIds: ['draft-1'], settledByOp: 'c\u0000op' })
+    expect(journal.queuedMessages.get('draft-1')?.state).toBe('withdrawn')
+    await journal.resolveDispatch({
+      clientMessageId: 'sub-draft-1',
+      state: 'rejected',
+      ...refusal('again'),
+      fence: 0
+    })
+    expect(journal.queuedMessages.get('draft-1')?.state).toBe('withdrawn')
+  })
+
+  it('the returned row and its stored reason survive epoch replacement and reopen (B1)', async () => {
+    let journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await consumeDraft(journal, 'draft-1')
+    await journal.resolveDispatch({
+      clientMessageId: 'sub-draft-1',
+      state: 'rejected',
+      ...refusal('stored refusal'),
+      fence: 0
+    })
+    await journal.replaceEpochItems('handle_forked', 0, [])
+    await journal.close()
+    journal = await open()
+    const row = journal.queuedMessages.get('draft-1')
+    expect(row?.state).toBe('returned')
+    expect(row?.returnedReason).toBe(refusal('stored refusal').reason)
+  })
+})
+
+describe('withdraw', () => {
+  it('withdraws waiting and returned rows together into op-stamped receipts', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1', 'first text')
+    await queueDraft(journal, 'draft-2', 'second text')
+    await consumeDraft(journal, 'draft-1')
+    await journal.resolveDispatch({
+      clientMessageId: 'sub-draft-1',
+      state: 'rejected',
+      ...refusal('refused'),
+      fence: 0
+    })
+    const withdrawn = await journal.queuedMessages.withdraw({
+      messageIds: ['draft-1', 'draft-2'],
+      settledByOp: 'caller\u0000stop-1'
+    })
+    expect(withdrawn.map((row) => [row.messageId, row.body.blocks])).toEqual([
+      ['draft-1', [{ type: 'text', text: 'first text' }]],
+      ['draft-2', [{ type: 'text', text: 'second text' }]]
+    ])
+    // A lost acknowledgement replays from the tombstones, keyed by the
+    // caller-scoped operation key — never from the ledger.
+    const receipts = journal.queuedMessages.receipts('caller\u0000stop-1')
+    expect(receipts.map((row) => row.messageId)).toEqual(['draft-1', 'draft-2'])
+    // Pending or dispatched rows stay outside the withdrawable set.
+    const second = await journal.queuedMessages.withdraw({
+      messageIds: ['draft-1'],
+      settledByOp: 'caller\u0000stop-2'
+    })
+    expect(second).toHaveLength(0)
+  })
+
+  it('two callers reusing one operation id read only their own receipts', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await journal.queuedMessages.withdraw({
+      messageIds: ['draft-1'],
+      settledByOp: 'caller-a\u0000op-1'
+    })
+    expect(journal.queuedMessages.receipts('caller-b\u0000op-1')).toHaveLength(0)
+    expect(journal.queuedMessages.receipts('caller-a\u0000op-1')).toHaveLength(1)
+  })
+})
+
+describe('open-time repair and retention', () => {
+  it('a failed repair is reported and skipped, never failing the open', async () => {
+    const repair = vi
+      .spyOn(JournalQueuedMessages.prototype, 'repairAndPrune')
+      .mockRejectedValueOnce(new Error('SQLITE_FULL'))
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    try {
+      const journal = await open()
+      expect(warn).toHaveBeenCalledWith(
+        '[journal-open] queued-message repair skipped:',
+        expect.objectContaining({ error: 'SQLITE_FULL' })
+      )
+      await queueDraft(journal, 'draft-1')
+      expect(journal.queuedMessages.list()).toHaveLength(1)
+    } finally {
+      repair.mockRestore()
+      warn.mockRestore()
+    }
+  })
+
+  it('returns a dispatched row whose loaded submission is effectively rejected (downgrade wrote no hook)', async () => {
+    let journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await consumeDraft(journal, 'draft-1')
+    await journal.resolveDispatch({
+      clientMessageId: 'sub-draft-1',
+      state: 'rejected',
+      ...refusal('refused while downgraded'),
+      rejection: PROVIDER_REFUSAL,
+      fence: 0
+    })
+    await journal.close()
+    // Simulate the old build having written the rejection with no hook: put the
+    // draft back to dispatched behind the stored fact.
+    const db = new Database(journalDatabaseFile(root))
+    db.prepare(
+      "UPDATE queued_messages SET state = 'dispatched', returned_reason = NULL, returned_rejection = NULL WHERE message_id = ?"
+    ).run('draft-1')
+    db.close()
+    journal = await open()
+    const row = journal.queuedMessages.get('draft-1')
+    expect(row?.state).toBe('returned')
+    expect(row?.returnedReason).toBe(refusal('refused while downgraded').reason)
+    expect(row?.returnedRejection).toEqual(PROVIDER_REFUSAL)
+  })
+
+  it('sends back to waiting a dispatched row whose submission a Stop withdrew with no hook, never leaving it dispatched', async () => {
+    let journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await consumeDraft(journal, 'draft-1')
+    await journal.rejectQueuedSubmissions(0, STOP_WITHDRAWAL)
+    await journal.close()
+    const db = new Database(journalDatabaseFile(root))
+    db.prepare(
+      "UPDATE queued_messages SET state = 'dispatched', hold_reason = NULL, consumed_as = 'sub-draft-1' WHERE message_id = ?"
+    ).run('draft-1')
+    db.close()
+    clock += QUEUED_MESSAGE_REPLAY_WINDOW_MS + 1_000
+    journal = await open()
+    // The same settlement the live hook applies.
+    expect(journal.queuedMessages.get('draft-1')).toMatchObject({
+      state: 'waiting',
+      holdReason: null,
+      consumedAs: null,
+      returnedReason: null
+    })
+  })
+
+  it('keeps a dispatched row while its submission is still pending, even past the window, so a late rejection still settles it (N5)', async () => {
+    let journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await consumeDraft(journal, 'draft-1')
+    await journal.close()
+    // Reopen "25 hours" later: the submission is still queued/pending.
+    clock += QUEUED_MESSAGE_REPLAY_WINDOW_MS + 60 * 60 * 1000
+    journal = await open()
+    expect(journal.queuedMessages.get('draft-1')?.state).toBe('dispatched')
+    // The delivery loop's leftover rejection now sends it back to waiting.
+    await journal.rejectQueuedSubmissions(0, HOST_RESTARTED)
+    expect(journal.queuedMessages.get('draft-1')).toMatchObject({
+      state: 'waiting',
+      consumedAs: null
+    })
+  })
+
+  it('prunes accepted and withdrawn rows once the replay window passes, and never waiting or returned rows', async () => {
+    let journal = await open()
+    await queueDraft(journal, 'accepted-1')
+    await consumeDraft(journal, 'accepted-1')
+    await journal.resolveDispatch({
+      clientMessageId: 'sub-accepted-1',
+      state: 'accepted',
+      providerIdentity: { provider: 'claude', sessionId: 'native-1', uuid: 'echo-1' },
+      fence: 0
+    })
+    await queueDraft(journal, 'withdrawn-1')
+    await journal.queuedMessages.withdraw({
+      messageIds: ['withdrawn-1'],
+      settledByOp: 'c\u0000op-w'
+    })
+    await queueDraft(journal, 'waiting-1')
+    await queueDraft(journal, 'returned-1')
+    await consumeDraft(journal, 'returned-1')
+    await journal.resolveDispatch({
+      clientMessageId: 'sub-returned-1',
+      state: 'rejected',
+      ...refusal('refused'),
+      fence: 0
+    })
+    await journal.close()
+    clock += QUEUED_MESSAGE_REPLAY_WINDOW_MS + 1_000
+    journal = await open()
+    expect(journal.queuedMessages.list().map((row) => [row.messageId, row.state])).toEqual([
+      ['waiting-1', 'waiting'],
+      ['returned-1', 'returned']
+    ])
+  })
+
+  it('keeps fresh tombstones inside the replay window', async () => {
+    let journal = await open()
+    await queueDraft(journal, 'withdrawn-1')
+    await journal.queuedMessages.withdraw({
+      messageIds: ['withdrawn-1'],
+      settledByOp: 'c\u0000op-w'
+    })
+    await journal.close()
+    clock += 1_000
+    journal = await open()
+    expect(journal.queuedMessages.get('withdrawn-1')?.state).toBe('withdrawn')
+  })
+})
+
+describe('holds', () => {
+  it('a hold is stored on the row, survives reopen, and withdraw clears it', async () => {
+    let journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await journal.queuedMessages.hold({ messageIds: ['draft-1'], reason: 'send_failed' })
+    expect(journal.queuedMessages.get('draft-1')?.holdReason).toBe('send_failed')
+    await journal.close()
+    journal = await open()
+    expect(journal.queuedMessages.get('draft-1')?.holdReason).toBe('send_failed')
+    await journal.queuedMessages.withdraw({ messageIds: ['draft-1'], settledByOp: 'c\u0000op' })
+    expect(journal.queuedMessages.get('draft-1')).toMatchObject({
+      state: 'withdrawn',
+      holdReason: null
+    })
+  })
+
+  it('consume clears the hold in the same transaction (Send-now overrides it)', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await journal.queuedMessages.hold({ messageIds: ['draft-1'], reason: 'send_failed' })
+    await consumeDraft(journal, 'draft-1')
+    expect(journal.queuedMessages.get('draft-1')).toMatchObject({
+      state: 'dispatched',
+      holdReason: null
+    })
+  })
+
+  it('a withdraw naming no drafts touches nothing — a Delete race with no rows costs no write', async () => {
+    const journal = await open()
+    await journal.close()
+    await expect(
+      journal.queuedMessages.withdraw({ messageIds: [], settledByOp: 'c\u0000op' })
+    ).resolves.toEqual([])
+  })
+
+  it('holds reach only waiting rows', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await consumeDraft(journal, 'draft-1')
+    await journal.resolveDispatch({
+      clientMessageId: 'sub-draft-1',
+      state: 'rejected',
+      ...refusal('refused'),
+      fence: 0
+    })
+    await journal.queuedMessages.hold({ messageIds: ['draft-1'], reason: 'send_failed' })
+    expect(journal.queuedMessages.get('draft-1')).toMatchObject({
+      state: 'returned',
+      holdReason: null
+    })
+  })
+})
+
+describe("the queue's Stop fact", () => {
+  it('records where the Stop took effect, survives reopen, and the latest Stop replaces an earlier one', async () => {
+    let journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await journal.queuedMessages.recordPause('stopped')
+    const first = journal.queuedMessages.pause()
+    expect(first).toMatchObject({ reason: 'stopped', sequence: journal.cursor().sequence })
+    await journal.appendItem(
+      { provider: 'orca', clientMessageId: 'later' },
+      { kind: 'status', text: 'later' },
+      { fence: 0, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
+    await journal.queuedMessages.recordPause('stopped')
+    expect(journal.queuedMessages.pause()?.sequence).toBe((first?.sequence ?? 0) + 1)
+    await journal.close()
+    journal = await open()
+    expect(journal.queuedMessages.pause()?.sequence).toBe((first?.sequence ?? 0) + 1)
+    // The pause is the queue's, never a row's.
+    expect(journal.queuedMessages.get('draft-1')?.holdReason).toBeNull()
+  })
+
+  it("a /clear's replacement records its pause as 'cleared', read back the same way", async () => {
+    let journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await journal.queuedMessages.recordPause('cleared')
+    await journal.close()
+    journal = await open()
+    expect(journal.queuedMessages.pause()).toMatchObject({ reason: 'cleared' })
+  })
+
+  it('retires in the write that takes the last card it holds back: a hold of its own', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-held')
+    expect(await journal.queuedMessages.recordPause('stopped')).toBe(true)
+    await journal.queuedMessages.hold({ messageIds: ['draft-held'], reason: 'send_failed' })
+    expect(journal.queuedMessages.pause()).toBeNull()
+  })
+
+  it('records nothing over a queue with no card it holds back, judged in its own transaction', async () => {
+    const journal = await open()
+    expect(await journal.queuedMessages.recordPause('stopped')).toBe(false)
+    expect(journal.queuedMessages.pause()).toBeNull()
+    await queueDraft(journal, 'draft-1')
+    expect(await journal.queuedMessages.recordPause('stopped')).toBe(true)
+    expect(journal.queuedMessages.pause()).not.toBeNull()
+  })
+
+  it('a hand-off whose return to waiting is still owed (its hook skipped) keeps the pause', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-sent')
+    await queueDraft(journal, 'draft-other')
+    await consumeDraft(journal, 'draft-sent')
+    expect(await journal.queuedMessages.recordPause('stopped')).toBe(true)
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    const hook = vi
+      .spyOn(JournalQueuedMessages.prototype, 'onRowInTransaction')
+      .mockImplementationOnce(() => {
+        throw new Error('bookkeeping failed')
+      })
+    try {
+      await journal.rejectQueuedSubmissions(0, STOP_WITHDRAWAL)
+    } finally {
+      hook.mockRestore()
+      warn.mockRestore()
+    }
+    expect(journal.queuedMessages.get('draft-sent')?.state).toBe('dispatched')
+    // The only waiting card goes; the owed one is still a card the pause holds back.
+    await journal.queuedMessages.withdraw({ messageIds: ['draft-other'], settledByOp: 'c\u0000op' })
+    expect(journal.queuedMessages.pause()).not.toBeNull()
+    await journal.queuedMessages.settleOwed()
+    expect(journal.queuedMessages.get('draft-sent')?.state).toBe('waiting')
+    expect(journal.queuedMessages.pause()).not.toBeNull()
+  })
+
+  it('lifting retires only the Stop fact it judged, never one recorded since', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    await journal.queuedMessages.recordPause('stopped')
+    const judged = journal.queuedMessages.pause()
+    await journal.appendItem(
+      { provider: 'orca', clientMessageId: 'later' },
+      { kind: 'status', text: 'later' },
+      { fence: 0, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
+    await journal.queuedMessages.recordPause('stopped')
+    expect(await journal.queuedMessages.liftPause({ stop: judged, adoptInto: null })).toBe(false)
+    expect(journal.queuedMessages.pause()).not.toBeNull()
+    expect(
+      await journal.queuedMessages.liftPause({
+        stop: journal.queuedMessages.pause(),
+        adoptInto: null
+      })
+    ).toBe(true)
+    expect(journal.queuedMessages.pause()).toBeNull()
+  })
+
+  it("adopting a restart's rows moves them into this instance and clears an older build's stored 'stopped' hold; send_failed stays", async () => {
+    const journal = await open()
+    await journal.queuedMessages.insert({
+      messageId: 'draft-restart',
+      body: message('written before the restart'),
+      fingerprint: 'fp-draft-restart',
+      hostInstance: 'proc-0'
+    })
+    await queueDraft(journal, 'draft-legacy')
+    await queueDraft(journal, 'draft-failed')
+    await journal.queuedMessages.hold({ messageIds: ['draft-failed'], reason: 'send_failed' })
+    const db = new Database(journalDatabaseFile(root))
+    db.prepare("UPDATE queued_messages SET hold_reason = 'stopped' WHERE message_id = ?").run(
+      'draft-legacy'
+    )
+    db.close()
+    journal.queuedMessages.invalidate()
+    expect(await journal.queuedMessages.liftPause({ stop: null, adoptInto: 'proc-1' })).toBe(true)
+    expect(
+      journal.queuedMessages.list().map((row) => [row.messageId, row.hostInstance, row.holdReason])
+    ).toEqual([
+      ['draft-restart', 'proc-1', null],
+      ['draft-legacy', 'proc-1', null],
+      ['draft-failed', 'proc-1', 'send_failed']
+    ])
+  })
+
+  it('a lift with nothing to lift changes nothing and fires no commit notification', async () => {
+    const journal = await open()
+    await queueDraft(journal, 'draft-1')
+    const revision = journal.queuedMessages.revision()
+    expect(await journal.queuedMessages.liftPause({ stop: null, adoptInto: 'proc-1' })).toBe(false)
+    expect(journal.queuedMessages.revision()).toBe(revision)
+  })
+})
+
+describe('the commit listener', () => {
+  it('draft-table writes fire it exactly when rows changed, so no caller publishes by hand', async () => {
+    const journal = await open()
+    let commits = 0
+    journal.observeCommits(() => {
+      commits += 1
+    })
+    await queueDraft(journal, 'draft-1')
+    expect(commits).toBe(1)
+    // An idempotent replay changes nothing and stays silent.
+    await queueDraft(journal, 'draft-1')
+    expect(commits).toBe(1)
+    await journal.queuedMessages.hold({ messageIds: ['draft-1'], reason: 'send_failed' })
+    expect(commits).toBe(2)
+    await journal.queuedMessages.hold({ messageIds: ['draft-1'], reason: 'send_failed' })
+    expect(commits).toBe(2)
+    await journal.queuedMessages.withdraw({ messageIds: ['draft-1'], settledByOp: 'c\u0000op' })
+    expect(commits).toBe(3)
+    await journal.queuedMessages.withdraw({ messageIds: ['draft-1'], settledByOp: 'c\u0000op-2' })
+    expect(commits).toBe(3)
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/queued-message-table.ts b/src/main/native-chat/agent-session-journal/queued-message-table.ts
new file mode 100644
index 00000000000..ffc9b240987
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/queued-message-table.ts
@@ -0,0 +1,326 @@
+// Host-owned draft rows for messages queued while the main agent is working.
+//
+// A queued message is NOT a journal row: it becomes one — an ordinary
+// submission — only when consume converts it, in the same transaction as the
+// submission's append. Until then it lives here, `session_id`-keyed so it
+// survives epoch rollover and replacement (`journal-row-table.ts` deletes only
+// `journal_rows`). After a refusal its text survives as a `returned` row a
+// rewind cannot delete; after a withdrawal it waits again.
+
+import type Database from '../../sqlite/sync-database'
+import type { UnreadAgentSessionFailureFact } from '../../../shared/agent-session-failure'
+import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
+import { rejectedDraftSettlement } from './journal-dispatch-settlement'
+import { readStoredRejectionFact } from './journal-dispatch-reducer'
+
+export type QueuedMessageState = 'waiting' | 'dispatched' | 'returned' | 'withdrawn'
+
+/** Why ONE waiting draft is held from auto-sending: its conversion failed.
+ *  Stored on the row, so it survives handle eviction and restart; a wire marker
+ *  (it publishes as `pausedReason`). A Stop or a restart pauses the whole queue
+ *  instead. A reader treats an unknown stored value as a plain hold. */
+export type QueuedMessageHoldReason = 'send_failed'
+
+/** Definitively unsettled: what Stop, /clear, Edit and the budget count, and
+ *  what the published list shows. Pending/unknown/accepted deliveries and
+ *  tombstones stay outside it. */
+export function isUnsettledQueuedMessage(row: Pick<QueuedMessageRow, 'state'>): boolean {
+  return row.state === 'waiting' || row.state === 'returned'
+}
+
+export type QueuedMessageRow = {
+  sessionId: string
+  messageId: string
+  position: number
+  body: AgentJournalMessageItem
+  fingerprint: string
+  createdAt: number
+  hostInstance: string
+  state: QueuedMessageState
+  /** Non-null holds this one waiting draft from auto-sending; typed values in
+   *  `QueuedMessageHoldReason`, unknown strings read as a plain hold. */
+  holdReason: string | null
+  /** A returned card's refusal, mirroring its submission's `reason` and `rejection` pair. */
+  returnedReason: string | null
+  returnedRejection: UnreadAgentSessionFailureFact | null
+  settledAt: number | null
+  /** The operation ledger's caller-scoped key, making settled rows mutation receipts. */
+  settledByOp: string | null
+  /** The submission that last handed it off: set on every dispatched row, kept on a returned
+   *  card, cleared when a withdrawal sends it back to waiting. Host-only; the published link is
+   *  the submission's `queuedMessageId`. */
+  consumedAs: string | null
+}
+
+const COLUMNS =
+  'session_id, message_id, position, body_json, fingerprint, created_at, host_instance, state, hold_reason, returned_reason, returned_rejection, settled_at, settled_by_op, consumed_as'
+
+export function insertQueuedMessage(
+  db: Database.Database,
+  input: {
+    sessionId: string
+    messageId: string
+    body: AgentJournalMessageItem
+    fingerprint: string
+    hostInstance: string
+    now: number
+  }
+): QueuedMessageRow {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the statement selects exactly one aliased numeric column; better-sqlite3 types rows as unknown.
+  const highest = db
+    .prepare('SELECT COALESCE(MAX(position), 0) AS p FROM queued_messages WHERE session_id = ?')
+    .get(input.sessionId) as { p?: number } | undefined
+  const position = Number(highest?.p ?? 0) + 1
+  db.prepare(
+    `INSERT INTO queued_messages (${COLUMNS})
+     VALUES (?, ?, ?, ?, ?, ?, ?, 'waiting', NULL, NULL, NULL, NULL, NULL, NULL)`
+  ).run(
+    input.sessionId,
+    input.messageId,
+    position,
+    JSON.stringify(input.body),
+    input.fingerprint,
+    input.now,
+    input.hostInstance
+  )
+  return {
+    sessionId: input.sessionId,
+    messageId: input.messageId,
+    position,
+    body: input.body,
+    fingerprint: input.fingerprint,
+    createdAt: input.now,
+    hostInstance: input.hostInstance,
+    state: 'waiting',
+    holdReason: null,
+    returnedReason: null,
+    returnedRejection: null,
+    settledAt: null,
+    settledByOp: null,
+    consumedAs: null
+  }
+}
+
+export function listQueuedMessages(db: Database.Database, sessionId: string): QueuedMessageRow[] {
+  return db
+    .prepare(`SELECT ${COLUMNS} FROM queued_messages WHERE session_id = ? ORDER BY position ASC`)
+    .all(sessionId)
+    .flatMap((row) => toStoredRow(row) ?? [])
+}
+
+export function getQueuedMessage(
+  db: Database.Database,
+  sessionId: string,
+  messageId: string
+): QueuedMessageRow | null {
+  const row = db
+    .prepare(`SELECT ${COLUMNS} FROM queued_messages WHERE session_id = ? AND message_id = ?`)
+    .get(sessionId, messageId)
+  return row === undefined ? null : toStoredRow(row)
+}
+
+/**
+ * The one waiting→dispatched (or returned→dispatched) transition, always under
+ * a fresh submission id — never the draft's own — so no reader can mistake id
+ * equality for the hand-off link. MUST run inside the caller's transaction — the journal
+ * writer's, between BEGIN IMMEDIATE and COMMIT — so a failed submission append
+ * rolls the consume back and a failed consume rolls the append back. Returns
+ * false when the draft was not in the expected state, in which case the caller
+ * throws to abort the append.
+ */
+export function consumeQueuedMessageInTransaction(
+  db: Database.Database,
+  input: {
+    sessionId: string
+    messageId: string
+    expect: 'waiting' | 'returned'
+    /** The fresh submission id; never the draft's own id. */
+    consumedAs: string
+    settledByOp: string | null
+    /** The handing-off process; absent keeps the row's own. */
+    hostInstance?: string
+    now: number
+  }
+): boolean {
+  if (input.consumedAs === input.messageId) {
+    return false
+  }
+  const changed = db
+    .prepare(
+      `UPDATE queued_messages
+       SET state = 'dispatched', hold_reason = NULL, returned_reason = NULL, returned_rejection = NULL,
+           settled_at = ?, settled_by_op = ?, consumed_as = ?, host_instance = COALESCE(?, host_instance)
+       WHERE session_id = ? AND message_id = ? AND state = ?`
+    )
+    .run(
+      input.now,
+      input.settledByOp,
+      input.consumedAs,
+      input.hostInstance ?? null,
+      input.sessionId,
+      input.messageId,
+      input.expect
+    )
+  return Number(changed.changes ?? 0) === 1
+}
+
+/** Compare-and-transition unsettled rows (waiting ∪ returned) to withdrawn
+ *  tombstones stamped with the operation's caller-scoped key, kept only so a
+ *  replay of the settling operation answers "spent"; null when the host itself
+ *  withdrew it. Returns the rows actually transitioned; their text stays in
+ *  this database, never on the wire. */
+export function withdrawQueuedMessages(
+  db: Database.Database,
+  input: {
+    sessionId: string
+    messageIds: readonly string[]
+    settledByOp: string | null
+    now: number
+  }
+): QueuedMessageRow[] {
+  const withdrawn: QueuedMessageRow[] = []
+  for (const messageId of input.messageIds) {
+    const row = getQueuedMessage(db, input.sessionId, messageId)
+    if (!row || !isUnsettledQueuedMessage(row)) {
+      continue
+    }
+    db.prepare(
+      `UPDATE queued_messages
+       SET state = 'withdrawn', hold_reason = NULL, settled_at = ?, settled_by_op = ?
+       WHERE session_id = ? AND message_id = ? AND state IN ('waiting', 'returned')`
+    ).run(input.now, input.settledByOp, input.sessionId, messageId)
+    withdrawn.push({
+      ...row,
+      state: 'withdrawn',
+      holdReason: null,
+      settledAt: input.now,
+      settledByOp: input.settledByOp
+    })
+  }
+  return withdrawn
+}
+
+/**
+ * dispatched → returned, or back to waiting (`rejectedDraftSettlement`),
+ * matched on the draft's CURRENT hand-off (`consumed_as`), so a re-send refused
+ * again still settles while a late duplicate of an earlier refusal matches
+ * nothing. A draft back to waiting keeps its position and carries no refusal;
+ * its spent submissions stay findable by their `queuedMessageId` link.
+ */
+export function settleRejectedQueuedMessage(
+  db: Database.Database,
+  input: {
+    sessionId: string
+    consumedRef: string
+    reason: string | null
+    rejection: UnreadAgentSessionFailureFact | undefined
+    now: number
+  }
+): boolean {
+  const settlement = rejectedDraftSettlement({ reason: input.reason, rejection: input.rejection })
+  const changed =
+    settlement.state === 'waiting'
+      ? db
+          .prepare(
+            `UPDATE queued_messages
+             SET state = 'waiting', hold_reason = NULL, consumed_as = NULL,
+                 returned_reason = NULL, returned_rejection = NULL, settled_at = NULL, settled_by_op = NULL
+             WHERE session_id = ? AND state = 'dispatched' AND consumed_as = ?`
+          )
+          .run(input.sessionId, input.consumedRef)
+      : db
+          .prepare(
+            `UPDATE queued_messages
+             SET state = 'returned', returned_reason = ?, returned_rejection = ?, settled_at = ?
+             WHERE session_id = ? AND state = 'dispatched' AND consumed_as = ?`
+          )
+          .run(
+            input.reason,
+            input.rejection ? JSON.stringify(input.rejection) : null,
+            input.now,
+            input.sessionId,
+            input.consumedRef
+          )
+  return Number(changed.changes ?? 0) > 0
+}
+
+/** Replay receipts: every row a given caller-scoped operation settled. */
+export function queuedMessagesSettledByOp(
+  db: Database.Database,
+  sessionId: string,
+  settledByOp: string
+): QueuedMessageRow[] {
+  return db
+    .prepare(
+      `SELECT ${COLUMNS} FROM queued_messages
+       WHERE session_id = ? AND settled_by_op = ? ORDER BY position ASC`
+    )
+    .all(sessionId, settledByOp)
+    .flatMap((row) => toStoredRow(row) ?? [])
+}
+
+function toStoredRow(row: unknown): QueuedMessageRow | null {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: rows come from this file's own SELECTs, which name exactly these columns; better-sqlite3 types them as unknown.
+  const record = row as {
+    session_id: string
+    message_id: string
+    position: number
+    body_json: string
+    fingerprint: string
+    created_at: number
+    host_instance: string
+    state: string
+    hold_reason: string | null
+    returned_reason: string | null
+    returned_rejection: string | null
+    settled_at: number | null
+    settled_by_op: string | null
+    consumed_as: string | null
+  }
+  let body: AgentJournalMessageItem
+  try {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: body_json is written only by insertQueuedMessage from a schema-validated AgentJournalMessageItem.
+    body = JSON.parse(record.body_json) as AgentJournalMessageItem
+  } catch {
+    // Our own writer stringified it; an unreadable body is corruption, and a
+    // row we cannot re-materialize must not masquerade as an empty message.
+    return null
+  }
+  const state = record.state
+  if (
+    state !== 'waiting' &&
+    state !== 'dispatched' &&
+    state !== 'returned' &&
+    state !== 'withdrawn'
+  ) {
+    return null
+  }
+  return {
+    sessionId: record.session_id,
+    messageId: record.message_id,
+    position: record.position,
+    body,
+    fingerprint: record.fingerprint,
+    createdAt: record.created_at,
+    hostInstance: record.host_instance,
+    state,
+    holdReason: record.hold_reason,
+    returnedReason: record.returned_reason,
+    returnedRejection: storedRejection(record.returned_rejection),
+    settledAt: record.settled_at,
+    settledByOp: record.settled_by_op,
+    consumedAs: record.consumed_as
+  }
+}
+
+function storedRejection(json: string | null): UnreadAgentSessionFailureFact | null {
+  if (json === null) {
+    return null
+  }
+  try {
+    return readStoredRejectionFact(JSON.parse(json)) ?? null
+  } catch {
+    // The refusal stays readable from `returned_reason`; a bad fact must not lose the card.
+    return null
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/agent-session-empty-delta-retention.test.ts b/src/main/native-chat/agent-session-wire/agent-session-empty-delta-retention.test.ts
index 3907fa7a645..1ab1089d494 100644
--- a/src/main/native-chat/agent-session-wire/agent-session-empty-delta-retention.test.ts
+++ b/src/main/native-chat/agent-session-wire/agent-session-empty-delta-retention.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { describe, expect, it, vi } from 'vitest'
 import { createCodexStructuredItemStreams } from '../../codex/codex-structured-item-streams'
 import { createAgentSessionDeltaCoalescer } from './agent-session-delta-coalescer'
@@ -9,7 +10,7 @@ describe('empty streamed deltas', () => {
       sink: { appendItem() {}, appendTombstone() {}, publish() {} },
       turnIdFor: () => 'turn',
       identityFor: () => ({ provider: 'codex', threadId: 'thread', turnId: 'turn', ordinal: 0 }),
-      linkageFor: () => ({}),
+      attributionFor: () => ({ turnScope: AGENT_JOURNAL_THREAD_SCOPE }),
       schedule: () => () => {}
     })
     const append = (delta: string) =>
@@ -24,15 +25,16 @@ describe('empty streamed deltas', () => {
       }
       const originalJoin = Array.prototype.join
       let retainedSlots = -1
-      const spy = vi
-        .spyOn(Array.prototype, 'join')
-        .mockImplementation(function (this: unknown[], separator) {
-          // Byte counters cannot detect empty entries retained by the stream's chunk array.
-          if (separator === '' && this[0] === prefix) {
-            retainedSlots = this.length
-          }
-          return originalJoin.call(this, separator)
-        })
+      const spy = vi.spyOn(Array.prototype, 'join').mockImplementation(function (
+        this: unknown[],
+        separator
+      ) {
+        // Byte counters cannot detect empty entries retained by the stream's chunk array.
+        if (separator === '' && this[0] === prefix) {
+          retainedSlots = this.length
+        }
+        return originalJoin.call(this, separator)
+      })
       let snapshot: ReturnType<typeof streams.snapshot>
       try {
         snapshot = streams.snapshot('thread', 'item')
diff --git a/src/main/native-chat/agent-session-wire/agent-session-history-byte-accounting.test.ts b/src/main/native-chat/agent-session-wire/agent-session-history-byte-accounting.test.ts
index 17bdf710490..f13d41373d7 100644
--- a/src/main/native-chat/agent-session-wire/agent-session-history-byte-accounting.test.ts
+++ b/src/main/native-chat/agent-session-wire/agent-session-history-byte-accounting.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -40,7 +41,10 @@ function body(text: string): AgentJournalItemBody {
 
 async function appendItems(count: number, text: string): Promise<void> {
   for (let ordinal = 1; ordinal <= count; ordinal += 1) {
-    await journal.appendItem(item(ordinal), body(`${text}-${ordinal}`), { fence: 1 })
+    await journal.appendItem(item(ordinal), body(`${text}-${ordinal}`), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
   }
 }
 
diff --git a/src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts b/src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts
index cda878f5a01..97ce6ecd216 100644
--- a/src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts
+++ b/src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts
@@ -12,7 +12,10 @@ import type {
   AgentJournalMessageItem,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
-import { AGENT_SESSION_JOURNAL_SCHEMA_VERSION } from '../../../shared/agent-session-journal-types'
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  AGENT_SESSION_JOURNAL_SCHEMA_VERSION
+} from '../../../shared/agent-session-journal-types'
 import { AGENT_SESSION_HISTORY_MAX_LIMIT } from '../../../shared/agent-session-wire'
 import {
   REMOTE_RUNTIME_MAX_OUTBOUND_JSON_BYTES,
@@ -61,7 +64,10 @@ function body(text: string): AgentJournalItemBody {
 
 async function appendItems(count: number): Promise<void> {
   for (let ordinal = 1; ordinal <= count; ordinal += 1) {
-    await journal.appendItem(item(ordinal), body(`item-${ordinal}`), { fence: 1 })
+    await journal.appendItem(item(ordinal), body(`item-${ordinal}`), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
   }
 }
 
@@ -216,7 +222,10 @@ describe('history page byte ceiling', () => {
 
   async function appendLargeItems(count: number): Promise<void> {
     for (let ordinal = 1; ordinal <= count; ordinal += 1) {
-      await journal.appendItem(item(ordinal), body(`${ordinal}:${LARGE_TEXT}`), { fence: 1 })
+      await journal.appendItem(item(ordinal), body(`${ordinal}:${LARGE_TEXT}`), {
+        fence: 1,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
     }
   }
 
@@ -300,7 +309,10 @@ describe('history page byte ceiling', () => {
   })
 
   it('degrades a single over-budget item to a visible truncation marker instead of overflowing', async () => {
-    await journal.appendItem(item(1), body(`1:${'y'.repeat(3 * 1024 * 1024)}`), { fence: 1 })
+    await journal.appendItem(item(1), body(`1:${'y'.repeat(3 * 1024 * 1024)}`), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
 
     const tail = pageOf(
       readAgentSessionHistory(journal, { sessionId: 'session-1', direction: 'tail', limit: 40 })
@@ -320,14 +332,28 @@ describe('projectJournalBatch', () => {
       sessionId: 'session-1',
       recordId: 'turn-lifecycle:turn-1'
     }
-    await journal.appendItem(turn, { kind: 'status', text: 'working' }, { fence: 1 })
+    await journal.appendItem(
+      turn,
+      { kind: 'status', text: 'working' },
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
     const cursor = journal.cursor()
     await journal.appendLifecycleBatch({
       settlementId: 'settlement-1',
       fence: 1,
       mutations: [
-        { kind: 'item', identity: item(1), body: body('one') },
-        { kind: 'item', identity: item(2), body: body('two') },
+        {
+          kind: 'item',
+          identity: item(1),
+          body: body('one'),
+          turnScope: AGENT_JOURNAL_THREAD_SCOPE
+        },
+        {
+          kind: 'item',
+          identity: item(2),
+          body: body('two'),
+          turnScope: AGENT_JOURNAL_THREAD_SCOPE
+        },
         { kind: 'tombstone', identity: turn }
       ]
     })
@@ -371,7 +397,10 @@ describe('projectJournalBatch', () => {
   it('publishes touched items at their current reduced state, not as a delta', async () => {
     await appendItems(1)
     const cursor = journal.cursor()
-    await journal.appendItem(item(1), body('revised'), { fence: 1 })
+    await journal.appendItem(item(1), body('revised'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     const since = journal.readSince(cursor)
     if (!since.ok) {
       throw new Error(`expected rows, got reset ${since.reset}`)
@@ -440,7 +469,7 @@ describe('projectJournalBatch', () => {
     await journal.appendItem(
       { provider: 'codex', threadId: 'thread-1', turnId: 'root-turn', ordinal: 2 },
       message,
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
 
     const page = readAgentSessionHistory(journal, {
@@ -636,7 +665,10 @@ describe('identity bounding at admission', () => {
       ordinal: 1
     }
     const start = { epoch: journal.epoch, sequence: journal.cursor().sequence }
-    const appended = await journal.appendItem(oversized, body('bounded'), { fence: 1 })
+    const appended = await journal.appendItem(oversized, body('bounded'), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     expect(appended.itemId.length).toBeLessThan(2048)
     expect(appended.itemId).toContain('~orca-oversized~')
 
diff --git a/src/main/native-chat/agent-session-wire/agent-session-journal-batch.ts b/src/main/native-chat/agent-session-wire/agent-session-journal-batch.ts
index 57f2291e476..b70a18a8386 100644
--- a/src/main/native-chat/agent-session-wire/agent-session-journal-batch.ts
+++ b/src/main/native-chat/agent-session-wire/agent-session-journal-batch.ts
@@ -6,6 +6,7 @@
 // key instead of appearing as a second copy of the user's own message.
 
 import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
+import { compareAgentJournalItems } from '../../../shared/agent-session-journal-position'
 import type {
   AgentJournalRenderItem,
   AgentJournalSnapshot,
@@ -65,7 +66,7 @@ export function projectJournalBatch(input: {
   const items = [...touchedItemIds]
     .map((itemId) => live.get(itemId))
     .filter((item) => item !== undefined)
-    .sort((a, b) => a.sequence - b.sequence)
+    .sort(compareAgentJournalItems)
   return {
     ok: true,
     batch: {
diff --git a/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts b/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts
index 214c889b5c9..df2330346ae 100644
--- a/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts
+++ b/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // Recovery drives the real journal loader against real on-disk damage: a hole
 // punched in the row sequence, and a row stamped with a schema this host cannot
 // read — on both version axes, because only one of them is detectable before a
@@ -6,14 +7,14 @@
 import { mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type {
   AgentJournalItemIdentity,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
 import { openJournalDatabase } from '../agent-session-journal/journal-database'
 import { JOURNAL_DB_SCHEMA_VERSION } from '../agent-session-journal/journal-database-schema'
-import { loadJournal } from '../agent-session-journal/journal-open'
+import { loadJournal, replayJournal } from '../agent-session-journal/journal-open'
 import { journalDatabaseFile } from '../agent-session-journal/journal-paths'
 import { readJournalEpochRows } from '../agent-session-journal/journal-row-table'
 import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
@@ -24,6 +25,12 @@ import {
   recoveryJournalDir
 } from './agent-session-journal-recovery'
 
+// Only the store's own replay goes through the mock; the probe's, inside the same module, does not.
+vi.mock('../agent-session-journal/journal-open', async (importOriginal) => {
+  const actual = await importOriginal<{ replayJournal: typeof replayJournal }>()
+  return { ...actual, replayJournal: vi.fn(actual.replayJournal) }
+})
+
 const CODEX_SESSION = '019fd532-7c11-7a90-b6de-4e1a2c3d5f60'
 
 const IDENTITY: AgentSessionJournalIdentity = {
@@ -74,7 +81,7 @@ async function seedJournal(count: number): Promise<string> {
     await journal.appendItem(
       item(ordinal),
       { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: `item-${ordinal}` }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
   }
   const epoch = journal.epoch
@@ -160,6 +167,21 @@ describe('openAgentSessionJournalWithRecovery', () => {
     expect(opened.snapshot().items).toHaveLength(2)
   })
 
+  it('reads the journal once: the probe is the open', async () => {
+    await seedJournal(2)
+    vi.mocked(replayJournal).mockClear()
+    const opened = journals.track(
+      await openAgentSessionJournalWithRecovery({
+        identity: IDENTITY,
+        journalDir,
+        fence: 1,
+        historyFilePath
+      }).then((result) => result.journal)
+    )
+    expect(opened.snapshot().items).toHaveLength(2)
+    expect(replayJournal).not.toHaveBeenCalled()
+  })
+
   it('rebuilds a holed journal in place on a fresh epoch', async () => {
     await seedJournal(3)
     await deleteRow(3)
@@ -269,7 +291,8 @@ describe('openAgentSessionJournalWithRecovery', () => {
         {
           kind: 'item',
           identity: { provider: 'orca', clientMessageId: 'approval-1' },
-          body: { kind: 'status', text: 'approved' }
+          body: { kind: 'status', text: 'approved' },
+          turnScope: AGENT_JOURNAL_THREAD_SCOPE
         }
       ]
     })
@@ -384,7 +407,7 @@ describe('openAgentSessionJournalWithRecovery', () => {
     await reopened.journal.appendItem(
       item(2),
       { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'typed later' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     const epoch = reopened.journal.epoch
     await reopened.journal.close()
diff --git a/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.ts b/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.ts
index 6e771a31809..29d324be971 100644
--- a/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.ts
+++ b/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.ts
@@ -67,7 +67,9 @@ export async function openAgentSessionJournalWithRecovery(input: {
   }
   const journal = await openAgentSessionJournal({
     identity: input.identity,
-    journalDir: input.journalDir
+    journalDir: input.journalDir,
+    // The probe is this open's replay; omitted, not `null`, when there was nothing to load.
+    ...(probe ? { loaded: probe } : {})
   })
   if (!probe?.corrupt) {
     return { journal, recovery: null }
diff --git a/src/main/native-chat/agent-session-wire/agent-session-subscriber-catch-up.ts b/src/main/native-chat/agent-session-wire/agent-session-subscriber-catch-up.ts
new file mode 100644
index 00000000000..5ff159ce2e6
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/agent-session-subscriber-catch-up.ts
@@ -0,0 +1,135 @@
+// One subscriber's catch-up: page it forward to the journal head, or hand it
+// the empty caught-up frame its per-emit fields still owe it. Split from the
+// subscriber registry so the registry stays the bookkeeping and this stays the
+// paging policy.
+
+import {
+  AGENT_SESSION_HISTORY_MAX_LIMIT,
+  type AgentSessionBackgroundTaskState,
+  type AgentSessionSlashCommand,
+  type AgentSessionSubscribeEvent,
+  type AgentSessionTurnActivity
+} from '../../../shared/agent-session-wire'
+import { sameJournalCursor } from '../agent-session-journal/journal-cursor'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { emptyAgentSessionBatch } from './agent-session-empty-batch'
+import { createAgentSessionCatchUpReader } from './agent-session-history-page'
+import {
+  subscriberQueuedMessagesChanged,
+  type SubscriberFieldHooks
+} from './agent-session-subscriber-frame-fields'
+import type { Subscriber } from './structured-agent-session-subscribers'
+
+export type SubscriberDeliveryPort = {
+  hooks: SubscriberFieldHooks & {
+    readCommands?: (sessionId: string) => AgentSessionSlashCommand[] | undefined
+  }
+  emit: (
+    subscriber: Subscriber,
+    event: AgentSessionSubscribeEvent,
+    options?: { withholdQueued?: boolean }
+  ) => void
+  isActive: (subscriber: Subscriber) => boolean
+  activity: (sessionId: string) => AgentSessionTurnActivity | null
+}
+
+export function deliverToSubscriber(
+  port: SubscriberDeliveryPort,
+  input: {
+    subscriber: Subscriber
+    journal: AgentSessionJournal
+    hostNow: number
+    emitCheckpoint: boolean
+    backgroundTasks?: AgentSessionBackgroundTaskState | null | undefined
+    activity?: AgentSessionTurnActivity | null | undefined
+  }
+): void {
+  const { subscriber, journal, hostNow, emitCheckpoint, backgroundTasks, activity } = input
+  const checkpointActivity = emitCheckpoint ? port.activity(subscriber.sessionId) : undefined
+  const publishedActivity = activity !== undefined ? activity : checkpointActivity
+  const shared = {
+    hostNow,
+    ...(backgroundTasks !== undefined ? { backgroundTasks } : {}),
+    ...(publishedActivity !== undefined ? { activity: publishedActivity } : {})
+  }
+  // Caught up, so there are no rows to read: every publish behind a commit's own delivery.
+  if (!journal.isReadOnly && sameJournalCursor(subscriber.cursor, journal.cursor())) {
+    emitCaughtUp(port, subscriber, emitCheckpoint, shared)
+    return
+  }
+  const readPage = createAgentSessionCatchUpReader(journal)
+  while (true) {
+    const result = readPage({
+      sessionId: subscriber.sessionId,
+      direction: 'after',
+      cursor: subscriber.cursor,
+      limit: AGENT_SESSION_HISTORY_MAX_LIMIT
+    })
+    if (!result.ok) {
+      const page = { ...result.page, fence: subscriber.fence }
+      port.emit(subscriber, {
+        type: 'reset',
+        sessionId: subscriber.sessionId,
+        reset: result.reset,
+        page,
+        fence: subscriber.fence,
+        ...shared
+      })
+      subscriber.cursor = page.liveCursor ?? page.window.nextCursor
+      return
+    }
+    const page = result.page
+    const advanced = page.window.nextCursor.sequence > subscriber.cursor.sequence
+    if (!advanced) {
+      emitCaughtUp(port, subscriber, emitCheckpoint, shared)
+      return
+    }
+    port.emit(
+      subscriber,
+      {
+        type: 'batch',
+        sessionId: subscriber.sessionId,
+        batch: {
+          cursor: page.window.nextCursor,
+          items: page.items,
+          removedItemIds: page.removedItemIds,
+          submissions: page.submissions
+        },
+        fence: subscriber.fence,
+        ...shared
+      },
+      // On a multi-page catch-up the draft list rides only the final page, or a
+      // consumed card would vanish pages before its bubble arrives.
+      { withholdQueued: page.hasNewer }
+    )
+    subscriber.cursor = page.window.nextCursor
+    if (!page.hasNewer || !port.isActive(subscriber)) {
+      return
+    }
+  }
+}
+
+function emitCaughtUp(
+  port: SubscriberDeliveryPort,
+  subscriber: Subscriber,
+  emitCheckpoint: boolean,
+  shared: {
+    hostNow: number
+    backgroundTasks?: AgentSessionBackgroundTaskState | null
+    activity?: AgentSessionTurnActivity | null
+  }
+): void {
+  const commandsChanged =
+    port.hooks.readCommands !== undefined &&
+    (port.hooks.readCommands(subscriber.sessionId) ?? null) !== subscriber.commands
+  const queuedChanged = subscriberQueuedMessagesChanged(port.hooks, subscriber)
+  if (emitCheckpoint || shared.activity !== undefined || commandsChanged || queuedChanged) {
+    port.emit(subscriber, {
+      type: 'batch',
+      sessionId: subscriber.sessionId,
+      batch: emptyAgentSessionBatch(subscriber.cursor),
+      fence: subscriber.fence,
+      ...shared
+    })
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/agent-session-subscriber-frame-fields.ts b/src/main/native-chat/agent-session-wire/agent-session-subscriber-frame-fields.ts
new file mode 100644
index 00000000000..eebec1e6d1b
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/agent-session-subscriber-frame-fields.ts
@@ -0,0 +1,77 @@
+// Which per-emit fields ride one subscriber frame: the provider command catalog
+// and the queue publication (the draft list with the queue's pause). Both are
+// identity-deduplicated against the LAST VALUE SENT — never advanced on a frame
+// that withheld the field, or the final replacement would be suppressed — and
+// both attach whole to hydrating frames.
+
+import type {
+  AgentSessionSlashCommand,
+  AgentSessionSubscribeEvent
+} from '../../../shared/agent-session-wire'
+import type { QueuePublication } from './structured-agent-session-queued-publication'
+
+export type SubscriberFieldState = {
+  sessionId: string
+  commands?: AgentSessionSlashCommand[] | null
+  /** The last queue publication actually SENT. */
+  queuePublication?: QueuePublication
+}
+
+export type SubscriberFieldHooks = {
+  readCommands?: (sessionId: string) => AgentSessionSlashCommand[] | undefined
+  readQueuePublication?: (sessionId: string) => QueuePublication | undefined
+}
+
+export type SubscriberFrame = {
+  frame: AgentSessionSubscribeEvent
+  commands: AgentSessionSlashCommand[] | null
+  attachedQueued: boolean
+  queued: QueuePublication | undefined
+}
+
+/** Builds the frame to emit; the caller stores the returned refs only after the
+ *  emit succeeded, so a dropped subscriber never advances its dedup state. */
+export function buildSubscriberFrame(
+  hooks: SubscriberFieldHooks,
+  subscriber: SubscriberFieldState,
+  event: AgentSessionSubscribeEvent,
+  withholdQueued: boolean
+): SubscriberFrame {
+  const commands = hooks.readCommands?.(subscriber.sessionId) ?? null
+  const includeCommands =
+    hooks.readCommands !== undefined &&
+    event.type !== 'end' &&
+    (event.type !== 'batch' || commands !== subscriber.commands)
+  // Withheld on intermediate catch-up pages (the caller says so), attached to
+  // every hydrating frame, and to batches only when the list changed.
+  const queued = withholdQueued ? undefined : hooks.readQueuePublication?.(subscriber.sessionId)
+  const attachedQueued =
+    queued !== undefined &&
+    event.type !== 'end' &&
+    (event.type !== 'batch' || queued !== subscriber.queuePublication)
+  return {
+    frame: {
+      ...event,
+      ...(includeCommands ? { commands: commands ?? null } : {}),
+      ...(attachedQueued && queued
+        ? { queuedMessages: queued.queuedMessages, queuePause: queued.queuePause }
+        : {})
+    },
+    commands,
+    attachedQueued,
+    queued
+  }
+}
+
+/** Whether a caught-up publish with no rows still owes this subscriber a frame:
+ *  draft inserts and pause changes write no journal row, so an unchanged cursor
+ *  must still deliver the changed publication. */
+export function subscriberQueuedMessagesChanged(
+  hooks: SubscriberFieldHooks,
+  subscriber: SubscriberFieldState
+): boolean {
+  return (
+    hooks.readQueuePublication !== undefined &&
+    hooks.readQueuePublication(subscriber.sessionId) !== subscriber.queuePublication
+  )
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-accept-then-deliver.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-accept-then-deliver.test.ts
new file mode 100644
index 00000000000..98a6f7e42dc
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-accept-then-deliver.test.ts
@@ -0,0 +1,866 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
+// A send is accepted, then delivered: the host answers once the message is recorded, and the
+// session's delivery loop starts a provider child for it and hands it over. Against the real host,
+// store and journal; each assertion reads what an open chat or the journal's next reader sees.
+
+import type { AgentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
+import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
+import type {
+  AgentSessionSubscribeEvent,
+  AgentSessionTurnCompletionEvent
+} from '../../../shared/agent-session-wire'
+import {
+  classifyDispatchRejection,
+  DISPATCH_REJECTED_CANCELLED
+} from '../../../shared/structured-agent-session-dispatch-rejection'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import {
+  AgentSessionPreSpawnError,
+  type StructuredAgentSessionAdapter
+} from './structured-agent-session-adapter'
+import { journalIdentityFor } from './structured-agent-session-attach'
+import { attachParamsForRecord } from './structured-agent-session-conversation-open'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import type { StructuredAgentSessionChildEndCause } from './structured-agent-session-host-types'
+import { persistRewindRecord } from './structured-rewind-recovery'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestDrawnRowIds,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
+
+const CALLER = { callerKey: 'client-1' }
+
+function eventually(assertion: () => void | Promise<void>): Promise<void> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let acquire: Mock<StructuredAgentSessionAdapter['acquire']>
+let dispatch: Mock<StructuredAgentSessionAdapter['dispatch']>
+let adapterExtras: Partial<StructuredAgentSessionAdapter>
+let idleMs: number
+
+const spawnChild: StructuredAgentSessionAdapter['acquire'] = async ({ fence, spawnToken }) => ({
+  process: { hostId: 'local', pid: 4242, processStartTimeMs: 1_700_000_000_000, spawnToken },
+  acquisitionGeneration: `generation-${acquire.mock.calls.length}`,
+  link: {
+    linkId: `link-${fence}`,
+    handle: { provider: 'codex' as const, threadId: THREAD },
+    origin: store.getRecord(SESSION)?.providerHandleChain.length
+      ? ('resumed' as const)
+      : ('created' as const),
+    mintedAtFence: fence,
+    observedAt: NOW
+  }
+})
+
+async function startHost(): Promise<void> {
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: {
+      acquire,
+      dispatch,
+      closeSession: vi.fn(async () => true),
+      releaseAcquisition: vi.fn(async () => true),
+      cancelTurn: vi.fn(async () => ({ cancelled: false })),
+      answerPrompt: vi.fn(async () => undefined),
+      setOption: vi.fn(async () => undefined),
+      ...adapterExtras
+    },
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => `spawn-${acquire.mock.calls.length}`,
+    idleSweep: { intervalMs: 5, idleMs },
+    now: () => NOW
+  })
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-accept-deliver-'))
+  resetHostTestOperationIds()
+  adapterExtras = {}
+  idleMs = 60 * 60_000
+  acquire = vi.fn(spawnChild)
+  dispatch = vi.fn(async () => ({
+    state: 'accepted' as const,
+    providerIdentity: {
+      provider: 'codex' as const,
+      threadId: THREAD,
+      turnId: `turn-${dispatch.mock.calls.length}`,
+      ordinal: dispatch.mock.calls.length
+    }
+  }))
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  await startHost()
+  expect(await host.attach(CALLER, hostTestAttachParams(null))).toMatchObject({ ok: true })
+})
+
+afterEach(async () => {
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+function sendParams(text: string) {
+  const body = hostTestMessage(text)
+  return {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: 1,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    },
+    body
+  }
+}
+
+/** Accepted at once, whatever the child is doing; answers the message id. */
+async function accept(text: string): Promise<string> {
+  const params = sendParams(text)
+  expect(await host.send(CALLER, params)).toMatchObject({
+    ok: true,
+    value: { submission: { dispatchState: 'pending', handoverRecorded: true } }
+  })
+  return params.envelope.clientOperationId
+}
+
+function stop() {
+  const turnId = 'turn-none'
+  return host.cancel(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: null,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.cancel',
+        sessionId: SESSION,
+        fields: { turnId }
+      })
+    },
+    turnId
+  })
+}
+
+async function submission(id: string): Promise<AgentJournalSubmission | undefined> {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === id
+  )
+}
+
+/** Read back after the conversation was closed, through the same open any reader takes. */
+async function reopened(id: string): Promise<AgentJournalSubmission | undefined> {
+  await host.revealSession(SESSION)
+  return submission(id)
+}
+
+async function errorRows(): Promise<string[]> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status' && item.body.tone === 'error' ? [item.body.text] : []
+  )
+}
+
+async function errorFailures(): Promise<(AgentSessionFailureFact | undefined)[]> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status' && item.body.tone === 'error' ? [item.body.failure] : []
+  )
+}
+
+let subscriptions = 0
+
+async function subscribe(): Promise<AgentSessionSubscribeEvent[]> {
+  const events: AgentSessionSubscribeEvent[] = []
+  subscriptions += 1
+  // Cloned as received: a frame shares the journal's live objects, which later rows revise.
+  await host.subscribe({
+    id: `sub-${subscriptions}`,
+    sessionId: SESSION,
+    emit: (event) => events.push(structuredClone(event))
+  })
+  return events
+}
+
+/** What an open chat was told about one message, in frame order. */
+function framedStates(events: AgentSessionSubscribeEvent[], id: string): string[] {
+  return events.flatMap((event) =>
+    event.type === 'batch'
+      ? event.batch.submissions
+          .filter((entry) => entry.clientMessageId === id)
+          .map((entry) =>
+            entry.dispatchState === 'pending' && entry.handedOverAt !== undefined
+              ? 'handed-over'
+              : entry.dispatchState
+          )
+      : []
+  )
+}
+
+function deferred<T>() {
+  let resolve!: (value: T) => void
+  let reject!: (error: unknown) => void
+  const promise = new Promise<T>((next, fail) => {
+    resolve = next
+    reject = fail
+  })
+  return { promise, resolve, reject }
+}
+
+/** Rows written by an earlier host process that ended before handing them over. */
+async function writeAsEarlierProcess(
+  write: (journal: AgentSessionJournal, fence: number) => Promise<void>
+): Promise<void> {
+  await host.close(SESSION)
+  const record = store.getRecord(SESSION)!
+  const params = attachParamsForRecord(record, {
+    clientOperationId: 'earlier',
+    expectedRuntimeFence: record.lease.runtimeFence
+  })
+  const journal = await openAgentSessionJournal({
+    identity: journalIdentityFor(record, params),
+    journalDir: journalDirectoryFor(root, {
+      workspaceId: record.location.workspaceId,
+      sessionId: SESSION
+    })
+  })
+  await write(journal, record.lease.runtimeFence)
+  await journal.close()
+}
+
+function earlierSubmission(id: string, text: string, handoverRecorded?: true) {
+  const body = hostTestMessage(text)
+  return {
+    clientMessageId: id,
+    payloadFingerprint: computeAgentSessionPayloadFingerprint({
+      method: 'agentSession.send',
+      sessionId: SESSION,
+      fields: { body }
+    }),
+    body,
+    ...(handoverRecorded ? { handoverRecorded } : {})
+  }
+}
+
+describe('a send is answered at acceptance', () => {
+  it('answers before the child starts, then an open chat sees the handover and the reply (W2)', async () => {
+    await host.close(SESSION)
+    const starting = deferred<void>()
+    acquire.mockImplementationOnce(async (input) => {
+      await starting.promise
+      return spawnChild(input)
+    })
+
+    const answering = deferred<void>()
+    const answer = dispatch.getMockImplementation()!
+    dispatch.mockImplementationOnce(async (input) => {
+      await answering.promise
+      return answer(input)
+    })
+
+    const id = await accept('hello')
+    const events = await subscribe()
+    await eventually(async () => expect(acquire).toHaveBeenCalledTimes(2))
+    expect(dispatch).not.toHaveBeenCalled()
+
+    starting.resolve()
+    await eventually(async () => expect(framedStates(events, id)).toEqual(['handed-over']))
+    answering.resolve()
+    await eventually(async () =>
+      expect(framedStates(events, id)).toEqual(['handed-over', 'accepted'])
+    )
+  })
+
+  it('accepts a second send while the first one starts the child, before handing either over (W6)', async () => {
+    await host.close(SESSION)
+    const starting = deferred<void>()
+    acquire.mockImplementationOnce(async (input) => {
+      await starting.promise
+      return spawnChild(input)
+    })
+    const first = await accept('first')
+    await eventually(async () => expect(acquire).toHaveBeenCalledTimes(2))
+    const second = host.send(CALLER, sendParams('second'))
+
+    starting.resolve()
+    const secondResult = await second
+    if (!secondResult.ok) {
+      throw new Error('the second send was refused')
+    }
+    const secondId = secondResult.value.clientMessageId
+    await eventually(async () =>
+      expect((await submission(secondId))?.dispatchState).toBe('accepted')
+    )
+    expect(dispatch.mock.calls.map(([input]) => input.clientMessageId)).toEqual([first, secondId])
+    // The second was accepted while the start held the queue — before the first was handed over.
+    expect((await submission(secondId))!.submittedAt).toBeLessThanOrEqual(
+      (await submission(first))!.handedOverAt!
+    )
+    const rows = (await host.journalSnapshot(SESSION)).submissions
+    expect(rows.map((row) => row.clientMessageId)).toEqual([first, secondId])
+  })
+})
+
+describe('a start the chat needed and did not get', () => {
+  it('writes one error row and rejects every queued message with it; the next send starts (W3)', async () => {
+    await host.close(SESSION)
+    acquire.mockRejectedValueOnce(new Error('spawn codex ENOENT'))
+    const first = await accept('first')
+    const second = await accept('second')
+
+    await eventually(async () => expect((await submission(second))?.dispatchState).toBe('rejected'))
+    const rows = await errorRows()
+    expect(rows).toHaveLength(1)
+    // Orca's spawn error goes to the log; the row and every message say what failed, typed. The
+    // child is gone, but no exit was observed, so nothing blames the provider.
+    expect(rows[0]).toBe("Codex couldn't restart. Send your message to try again.")
+    const failure = {
+      kind: 'restartFailed',
+      refusal: { code: 'agent_session_operation_invalid', details: { ownerVerdict: 'exited' } }
+    }
+    expect(await errorFailures()).toEqual([failure])
+    for (const id of [first, second]) {
+      expect(await submission(id)).toMatchObject({
+        dispatchState: 'rejected',
+        reason: rows[0],
+        rejection: failure
+      })
+    }
+
+    const next = await accept('after the fix')
+    await eventually(async () => expect((await submission(next))?.dispatchState).toBe('accepted'))
+    expect(await errorRows()).toHaveLength(1)
+  })
+
+  it('draws the messages it failed above the error row, since they were accepted first', async () => {
+    await host.close(SESSION)
+    acquire.mockRejectedValueOnce(new Error('spawn codex ENOENT'))
+    const first = await accept('first')
+    const second = await accept('second')
+    await eventually(async () => expect((await submission(second))?.dispatchState).toBe('rejected'))
+
+    const snapshot = await host.journalSnapshot(SESSION)
+    const errorRow = snapshot.items.find(
+      (item) => item.body.kind === 'status' && item.body.tone === 'error'
+    )?.itemId
+    const shown = [agentJournalSubmissionKey(first), agentJournalSubmissionKey(second), errorRow]
+    const drawn = hostTestDrawnRowIds(snapshot, [
+      { clientMessageId: first, text: 'first' },
+      { clientMessageId: second, text: 'second' }
+    ])
+    expect(drawn.filter((id) => shown.includes(id))).toEqual(shown)
+  })
+
+  it('notifies failed once for the queued messages one start failure refused', async () => {
+    await host.close(SESSION)
+    acquire.mockRejectedValueOnce(new Error('spawn codex ENOENT'))
+    const completions: AgentSessionTurnCompletionEvent[] = []
+    host.subscribeTurnCompletions({ id: 'dot-1', emit: (event) => completions.push(event) })
+    await accept('first')
+    const second = await accept('second')
+
+    await eventually(async () => expect((await submission(second))?.dispatchState).toBe('rejected'))
+    await host.flushAllStreamedEvents()
+    expect(completions).toEqual([
+      {
+        type: 'completion',
+        completion: expect.objectContaining({
+          sessionId: SESSION,
+          turnId: agentJournalSubmissionKey(second),
+          outcome: 'failure'
+        })
+      }
+    ])
+  })
+
+  it.each([
+    [
+      'eligibility',
+      () => {
+        adapterExtras = { supportsLocation: () => false }
+      },
+      {
+        text: "Codex couldn't restart. Start a new chat to continue.",
+        failure: {
+          kind: 'restartFailed',
+          refusal: {
+            code: 'structured_agent_session_unsupported',
+            details: { reason: 'hostUnsupported' }
+          }
+        }
+      }
+    ],
+    [
+      'spawn',
+      () => acquire.mockRejectedValueOnce(new Error('spawn codex ENOENT')),
+      {
+        text: "Codex couldn't restart. Send your message to try again.",
+        failure: {
+          kind: 'restartFailed',
+          refusal: { code: 'agent_session_operation_invalid', details: { ownerVerdict: 'exited' } }
+        }
+      }
+    ],
+    [
+      'auth',
+      () =>
+        acquire.mockRejectedValueOnce(
+          new AgentSessionPreSpawnError(new Error('Not logged in. Please run /login.'))
+        ),
+      {
+        // No process ever started, so nothing says the provider stopped.
+        text: "Codex couldn't restart. Send your message to try again.",
+        failure: {
+          kind: 'restartFailed',
+          refusal: { code: 'agent_session_operation_invalid', details: { ownerVerdict: 'exited' } }
+        }
+      }
+    ]
+  ])('writes one row a live chat sees for a %s refusal (W14)', async (_source, arrange, row) => {
+    await host.close(SESSION)
+    arrange()
+    await host.flushAllStreamedEvents()
+    await startHost()
+    const id = await accept('hello')
+    const events = await subscribe()
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('rejected'))
+    expect(await errorRows()).toEqual([row.text])
+    expect(await errorFailures()).toEqual([row.failure])
+    const framedRows = events.flatMap((event) =>
+      event.type === 'batch' || event.type === 'snapshot'
+        ? (event.type === 'batch' ? event.batch.items : event.page.items).filter(
+            (item) => item.body.kind === 'status' && item.body.tone === 'error'
+          )
+        : []
+    )
+    expect(framedRows.length).toBeGreaterThan(0)
+  })
+
+  it('names the start failure on queued messages when the attach fails after acquiring (W4′a)', async () => {
+    await host.close(SESSION)
+    const id = await accept('hello')
+    // The attach's own success record is the post-acquisition step that fails.
+    const record = vi.spyOn(store, 'recordOperationOutcome')
+    record.mockImplementation(async (input) => {
+      if (input.operationId !== id && input.outcome.status === 'succeeded') {
+        record.mockRestore()
+        throw new Error('record store write failed')
+      }
+      return AgentSessionRecordStore.prototype.recordOperationOutcome.call(store, input)
+    })
+
+    // Read through the open any reader takes, so a conversation the failure dropped is reopened
+    // and its message read as that reopen settles it.
+    let settled: AgentJournalSubmission | undefined
+    await eventually(async () => {
+      settled = await reopened(id)
+      expect(settled?.dispatchState).not.toBe('pending')
+    })
+    // The message names the start that failed, not a close or a restart it never met — and never
+    // the store's own error, which is Orca's and goes to the log.
+    expect(settled).toMatchObject({
+      dispatchState: 'rejected',
+      rejection: (await errorFailures())[0]
+    })
+    expect(settled?.reason).not.toContain('record store write failed')
+    expect(await errorRows()).toEqual([settled?.reason])
+  })
+})
+
+describe('an attach that fails after indexing its child', () => {
+  it('leaves no child behind, so the next send starts one and is delivered', async () => {
+    await host.close(SESSION)
+    const owned: boolean[] = []
+    host.subscribeStatus({
+      id: 'list-1',
+      emit: (event) => {
+        if (event.type === 'status') {
+          owned.push(event.session.hostExecutionOwned === true)
+        }
+      }
+    })
+    const first = await accept('hello')
+    // The attach's own success record is the step after `onAttached` indexed the child.
+    const record = vi.spyOn(store, 'recordOperationOutcome')
+    record.mockImplementation(async (input) => {
+      if (input.operationId !== first && input.outcome.status === 'succeeded') {
+        record.mockRestore()
+        throw new Error('record store write failed')
+      }
+      return AgentSessionRecordStore.prototype.recordOperationOutcome.call(store, input)
+    })
+    await eventually(async () => expect((await submission(first))?.dispatchState).toBe('rejected'))
+    // Nothing was indexed, so nothing had to be taken back: no list ever showed a child.
+    expect(host['sessions'].get(SESSION)?.child).toBeNull()
+    expect(owned).not.toContain(true)
+    const acquiresBefore = acquire.mock.calls.length
+
+    const next = await accept('after the failure')
+
+    await eventually(async () => expect((await submission(next))?.dispatchState).toBe('accepted'))
+    expect(acquire).toHaveBeenCalledTimes(acquiresBefore + 1)
+    expect(dispatch.mock.calls.map(([input]) => input.clientMessageId)).toEqual([next])
+  })
+})
+
+describe('what an earlier host process left behind', () => {
+  it('rejects a message it accepted and never handed over, as not sent (W4′b)', async () => {
+    await writeAsEarlierProcess(async (journal, fence) => {
+      await journal.appendSubmission({ ...earlierSubmission('queued', 'q', true), fence })
+    })
+
+    await host.revealSession(SESSION)
+
+    expect(await submission('queued')).toMatchObject({
+      dispatchState: 'rejected',
+      ...agentSessionFailureWords(agentSessionFailureFact('hostRestarted'), {
+        surface: 'rejection'
+      })
+    })
+    expect(dispatch).not.toHaveBeenCalled()
+  })
+
+  it('leaves a legacy pending message and a handed-over one in doubt, never re-sent (W4′c)', async () => {
+    const providerHistoryWindow = vi.fn(async () => null)
+    adapterExtras = { providerHistoryWindow }
+    await writeAsEarlierProcess(async (journal, fence) => {
+      await journal.appendSubmission({ ...earlierSubmission('legacy', 'l'), fence })
+      await journal.appendSubmission({ ...earlierSubmission('handed', 'h', true), fence })
+      await journal.resolveDispatch({
+        clientMessageId: 'handed',
+        state: 'pending',
+        fence,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
+    })
+    await host.flushAllStreamedEvents()
+    await startHost()
+
+    await host.revealSession(SESSION)
+
+    expect(await submission('legacy')).toMatchObject({ dispatchState: 'unknown', recovered: true })
+    expect(await submission('handed')).toMatchObject({ dispatchState: 'unknown', recovered: true })
+    // Deciding them from provider history waits for a won lease (W4′d).
+    expect(providerHistoryWindow).not.toHaveBeenCalled()
+    expect(dispatch).not.toHaveBeenCalled()
+  })
+})
+
+describe('a child that exits before its message is handed over', () => {
+  it('rejects the message with the exit reason instead of starting another child (W24)', async () => {
+    // Each child the loop starts dies between its start step and its handover step.
+    const awaitStarted = vi.fn(async (sessionId: string) => {
+      await host.handleAdapterEvent({
+        type: 'ended',
+        sessionId,
+        fence: store.getRecord(sessionId)!.lease.runtimeFence,
+        acquisitionGeneration: `generation-${acquire.mock.calls.length}`,
+        reason: 'codex app-server crashed',
+        cause: 'unexpected-exit'
+      })
+    })
+    adapterExtras = { awaitStarted }
+    await host.close(SESSION)
+    await startHost()
+
+    const id = await accept('hello')
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('rejected'))
+    expect(await submission(id)).toMatchObject({
+      reason: 'Codex stopped before this message was sent.',
+      rejection: { kind: 'providerExited' }
+    })
+    expect(acquire).toHaveBeenCalledTimes(2)
+    expect(dispatch).not.toHaveBeenCalled()
+  })
+})
+
+describe('a start whose failure the delivery loop settles before the exit is published', () => {
+  it('keeps one row in the words its rejected messages carry', async () => {
+    // The adapter's startup answer and its later exit event word the same start differently.
+    const awaitStarted = vi.fn(async () => agentSessionFailureFact('startFailed'))
+    adapterExtras = { awaitStarted }
+    acquire.mockImplementation(async (input) => ({
+      ...(await spawnChild(input)),
+      providerChildPhase: 'starting' as const
+    }))
+    await host.close(SESSION)
+    await startHost()
+
+    const first = await accept('first')
+    const second = await accept('second')
+    await eventually(async () => expect((await submission(second))?.dispatchState).toBe('rejected'))
+    await host.handleAdapterEvent({
+      type: 'ended',
+      sessionId: SESSION,
+      fence: store.getRecord(SESSION)!.lease.runtimeFence,
+      acquisitionGeneration: `generation-${acquire.mock.calls.length}`,
+      reason: 'codex app-server exited with code 1',
+      failure: agentSessionFailureFact('providerStartFailed', {
+        detail: { text: 'codex: config.toml is invalid', audience: 'person' }
+      }),
+      cause: 'unexpected-exit',
+      startupUnproven: true
+    })
+    await host.flushStreamedEvents(SESSION)
+
+    const rows = (await host.journalSnapshot(SESSION)).items.filter((item) =>
+      item.itemId.includes('start-failure')
+    )
+    expect(rows).toHaveLength(1)
+    const words = agentSessionFailureWords(agentSessionFailureFact('startFailed'), {
+      surface: 'rejection',
+      agentName: 'Codex',
+      provider: 'codex'
+    })
+    expect(rows[0].body).toMatchObject({ text: words.reason, failure: words.rejection })
+    for (const id of [first, second]) {
+      expect(await submission(id)).toMatchObject({
+        dispatchState: 'rejected',
+        reason: words.reason,
+        rejection: words.rejection
+      })
+    }
+  })
+})
+
+describe('Stop withdraws what is queued', () => {
+  it('withdraws a crash leftover ahead of any delivery step (W17a)', async () => {
+    await writeAsEarlierProcess(async (journal, fence) => {
+      await journal.appendSubmission({ ...earlierSubmission('leftover', 'l', true), fence })
+    })
+
+    // Stop's own open wakes the delivery loop, whose first step queues behind this Stop.
+    expect(await stop()).toMatchObject({ ok: true })
+
+    expect(await submission('leftover')).toMatchObject({
+      dispatchState: 'rejected',
+      reason: DISPATCH_REJECTED_CANCELLED
+    })
+    expect(acquire).toHaveBeenCalledTimes(1)
+  })
+
+  it('withdraws a message whose start holds the queue: nothing is handed over (W17b)', async () => {
+    await host.close(SESSION)
+    const starting = deferred<void>()
+    acquire.mockImplementationOnce(async (input) => {
+      await starting.promise
+      return spawnChild(input)
+    })
+    const id = await accept('hello')
+    await eventually(async () => expect(acquire).toHaveBeenCalledTimes(2))
+    const stopped = stop()
+
+    starting.resolve()
+    expect(await stopped).toMatchObject({ ok: true })
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('rejected'))
+    expect(await submission(id)).toMatchObject({ reason: DISPATCH_REJECTED_CANCELLED })
+    expect((await submission(id))?.handedOverAt).toBeUndefined()
+    expect(dispatch).not.toHaveBeenCalled()
+  })
+
+  it('stops a child still proving its start, and the delivery loop ends with it (W17c)', async () => {
+    const ended = deferred<void>()
+    const awaitStarted = vi.fn(() => ended.promise)
+    const closeSession = vi.fn(async () => {
+      ended.resolve()
+      return true
+    })
+    adapterExtras = { awaitStarted, closeSession }
+    await host.close(SESSION)
+    await startHost()
+    acquire.mockImplementationOnce(async (input) => ({
+      ...(await spawnChild(input)),
+      providerChildPhase: 'starting' as const
+    }))
+    const id = await accept('hello')
+    await eventually(async () => expect(awaitStarted).toHaveBeenCalled())
+
+    expect(await stop()).toMatchObject({ ok: true, value: { cancelled: true } })
+
+    expect(await reopened(id)).toMatchObject({
+      dispatchState: 'rejected',
+      reason: DISPATCH_REJECTED_CANCELLED
+    })
+    expect(closeSession).toHaveBeenCalled()
+    // A loop still waiting on that start would swallow this send; it starts a new child instead.
+    awaitStarted.mockImplementation(async () => undefined)
+    const next = await accept('after stop')
+    await eventually(async () => expect((await submission(next))?.dispatchState).toBe('accepted'))
+    expect(dispatch).toHaveBeenCalledTimes(1)
+  })
+})
+
+describe('an eviction between acceptance and handover', () => {
+  it('rejects the message as not sent, never leaves it in doubt (W24)', async () => {
+    const started = deferred<void>()
+    adapterExtras = { awaitStarted: () => started.promise }
+    await host.close(SESSION)
+    await startHost()
+    const id = await accept('hello')
+    await eventually(async () => expect(acquire).toHaveBeenCalledTimes(2))
+    // Between the delivery loop's start step and its handover step.
+    await host.close(SESSION)
+    started.resolve()
+
+    expect(await reopened(id)).toMatchObject({
+      dispatchState: 'rejected',
+      ...agentSessionFailureWords(agentSessionFailureFact('chatClosed'), { surface: 'rejection' })
+    })
+    expect(dispatch).not.toHaveBeenCalled()
+  })
+
+  it('rejects a queued message behind a handed-over one, which alone stays in doubt (W24)', async () => {
+    const second = deferred<void>()
+    const awaitStarted = vi.fn(async (): Promise<void> => undefined)
+    adapterExtras = { awaitStarted }
+    await host.close(SESSION)
+    await startHost()
+    dispatch.mockResolvedValueOnce({ state: 'admitted' })
+    const handed = await accept('handed over')
+    await eventually(async () => expect((await submission(handed))?.handedOverAt).toBeDefined())
+    awaitStarted.mockImplementation(() => second.promise)
+    const queued = await accept('still queued')
+    await eventually(async () => expect(awaitStarted).toHaveBeenCalledTimes(2))
+
+    await host.close(SESSION)
+    second.resolve()
+
+    expect(await reopened(queued)).toMatchObject({
+      dispatchState: 'rejected',
+      ...agentSessionFailureWords(agentSessionFailureFact('chatClosed'), { surface: 'rejection' })
+    })
+    expect(await submission(handed)).toMatchObject({ dispatchState: 'unknown' })
+    expect(dispatch).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not stop an idle child while a message is still queued for it (W24)', async () => {
+    idleMs = 0
+    const started = deferred<void>()
+    adapterExtras = { awaitStarted: () => started.promise }
+    await host.close(SESSION)
+    await startHost()
+    const id = await accept('hello')
+    await eventually(async () => expect(acquire).toHaveBeenCalledTimes(2))
+    // The idle sweep ticks every few milliseconds meanwhile.
+    await new Promise((resolve) => setTimeout(resolve, 20))
+
+    started.resolve()
+    // Handed to the child it was queued for; the eviction may follow once nothing is owed.
+    await eventually(async () => expect(dispatch).toHaveBeenCalledTimes(1))
+    expect(dispatch.mock.calls[0]?.[0].clientMessageId).toBe(id)
+    expect(acquire).toHaveBeenCalledTimes(2)
+  })
+})
+
+// A close abandons what is queued before it stops the child, so a release that then fails still
+// leaves every queued message rejected as closed, never blamed on the provider.
+describe('a close that stops the child and then fails', () => {
+  const END_CHILD = {
+    evict: () => host.close(SESSION)
+  } satisfies Partial<Record<StructuredAgentSessionChildEndCause, () => Promise<void>>>
+
+  it.each([
+    { end: 'evict', starting: true, kind: 'chatClosed', verdict: null },
+    { end: 'evict', starting: false, kind: 'chatClosed', verdict: null }
+  ] as const)(
+    'rejects what is queued as $kind after a $end (during startup: $starting)',
+    async ({ end, starting, kind, verdict }) => {
+      const started = deferred<void>()
+      adapterExtras = {
+        awaitStarted: () => started.promise,
+        // Once: the host's own teardown acknowledges again.
+        acknowledgeSessionRelease: vi.fn().mockImplementationOnce(() => {
+          throw new Error('release acknowledgement failed')
+        })
+      }
+      await host.close(SESSION)
+      await startHost()
+      acquire.mockImplementationOnce(async (input) => ({
+        ...(await spawnChild(input)),
+        ...(starting ? { providerChildPhase: 'starting' as const } : {})
+      }))
+      const id = await accept('hello')
+      await eventually(() => expect(acquire).toHaveBeenCalledTimes(2))
+
+      await expect(END_CHILD[end]()).rejects.toThrow()
+      expect(host.hasSession(SESSION)).toBe(true)
+      started.resolve()
+
+      await eventually(async () => expect((await submission(id))?.dispatchState).toBe('rejected'))
+      const rejected = (await submission(id))!
+      expect(rejected.rejection).toMatchObject({ kind })
+      expect(classifyDispatchRejection(rejected).verdict).toBe(verdict)
+      expect(dispatch).not.toHaveBeenCalled()
+    }
+  )
+})
+
+describe('a compaction or rewind an earlier child left prepared', () => {
+  async function leftPrepared(prepare: (fence: number) => Promise<unknown>): Promise<void> {
+    await host.close(SESSION)
+    await prepare(store.getRecord(SESSION)!.lease.runtimeFence)
+    // A new process: nothing is open and no view attaches.
+    await host.flushAllStreamedEvents()
+    await startHost()
+  }
+
+  it("ignores an older build's interrupted compaction, so a send is accepted and delivered (R16)", async () => {
+    await leftPrepared((fence) =>
+      store.setConversationCommand(SESSION, fence, {
+        command: 'compact',
+        runtimeFence: fence,
+        operationId: 'compact-op',
+        callerKey: 'client-1',
+        phase: 'prepared',
+        state: 'unknown'
+      })
+    )
+
+    const id = await accept('after the compaction')
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('accepted'))
+    // Nothing settles the record: it belongs to a child this host no longer runs.
+    expect(store.getRecord(SESSION)?.conversationCommand).toMatchObject({ phase: 'prepared' })
+  })
+
+  it('completes a rewind the provider already applied at open, so a send is accepted (R16)', async () => {
+    await leftPrepared((fence) =>
+      persistRewindRecord(store, SESSION, fence, {
+        operationId: 'rewind-op',
+        callerKey: 'client-1',
+        itemId: 'orca:rewound',
+        providerItemId: `codex:${THREAD}:turn-1:0`,
+        expectedEpoch: 'epoch-before',
+        phase: 'provider-succeeded',
+        hydrationVerified: true,
+        retained: []
+      })
+    )
+
+    const id = await accept('after the rewind')
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('accepted'))
+    expect(store.getRecord(SESSION)?.rewind).toMatchObject({ phase: 'completed' })
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-acquisition-options.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-acquisition-options.test.ts
index e0549e1816e..7c12909e036 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-acquisition-options.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-acquisition-options.test.ts
@@ -15,6 +15,7 @@ import {
   attachFingerprintFields,
   type AgentSessionAttachParams
 } from './structured-agent-session-attach'
+import { openTestAttachConversation } from './structured-agent-session-attach-test-conversation'
 import { performAttach } from './structured-agent-session-attach-flow'
 import type { AgentSessionCreatePhaseRecorder } from '../../observability/agent-session-instrumentation'
 
@@ -107,7 +108,7 @@ function expectSettledAttachLease(record: AgentSessionRecord | null): void {
   expect(record).not.toBeNull()
   const lease = record!.lease
   const durableState = lease.handoffStage ?? lease.claimStatus
-  expect(['live', 'released', 'recovering', 'manual-recovery']).toContain(durableState)
+  expect(['live', 'released', 'recovering']).toContain(durableState)
   expect(lease.handoffStage).not.toBe('new-owner-proving')
 }
 
@@ -154,6 +155,7 @@ describe('structured session acquisition options', () => {
       store: initialStore,
       adapter: withHistory('created'),
       journalRoot: root,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-a',
         claimKeyId: 'key-1',
@@ -194,6 +196,7 @@ describe('structured session acquisition options', () => {
       store,
       adapter: withHistory('resumed'),
       journalRoot: root,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-b',
         claimKeyId: 'key-1',
@@ -228,6 +231,7 @@ describe('structured session acquisition options', () => {
       store,
       adapter: sessionAdapter,
       journalRoot: root,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-a',
         claimKeyId: 'key-1',
@@ -260,6 +264,7 @@ describe('structured session acquisition options', () => {
         store,
         adapter: sessionAdapter,
         journalRoot: root!,
+        openConversation: openTestAttachConversation(root!),
         authority: {
           spawnToken,
           claimKeyId: 'key-1',
@@ -291,6 +296,7 @@ describe('structured session acquisition options', () => {
       store,
       adapter: adapter({ origin: 'created' }),
       journalRoot: root,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-a',
         claimKeyId: 'key-1',
@@ -330,6 +336,7 @@ describe('structured session acquisition options', () => {
         }
       }),
       journalRoot: root,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-b',
         claimKeyId: 'key-1',
@@ -369,6 +376,7 @@ describe('structured session acquisition options', () => {
       store,
       adapter: sessionAdapter,
       journalRoot: root,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-a',
         claimKeyId: 'key-1',
@@ -408,6 +416,7 @@ describe('structured session acquisition options', () => {
         store,
         adapter: failingAdapter,
         journalRoot: root,
+        openConversation: openTestAttachConversation(root!),
         authority: {
           spawnToken: 'spawn-a',
           claimKeyId: 'key-1',
@@ -421,7 +430,10 @@ describe('structured session acquisition options', () => {
       })
     ).resolves.toEqual({
       ok: false,
-      refusal: { code: 'agent_session_operation_invalid', message: 'model list unavailable' }
+      refusal: {
+        code: 'agent_session_operation_invalid',
+        message: "Codex couldn't restart. Send your message to try again."
+      }
     })
     expect(releaseAcquisition).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease.ownerProcess).toBeNull()
@@ -499,6 +511,7 @@ describe('structured session acquisition options', () => {
           store: target,
           adapter: failingAdapter,
           journalRoot: root!,
+          openConversation: openTestAttachConversation(root!, failingAdapter),
           authority: {
             spawnToken: operationId === CREATE_OPERATION ? 'spawn-a' : 'spawn-b',
             claimKeyId: 'key-1',
@@ -511,12 +524,16 @@ describe('structured session acquisition options', () => {
           onAttached: () => {}
         })
 
-      // A proven exit before the journal opens is answered once, as the refusal its replay gives.
+      // A proven exit before the journal opens is answered once, as the refusal its replay gives;
+      // no exit was observed, so it names no situation.
       const failed = perform(store, CREATE_OPERATION, null)
       await (exitProven && failurePoint !== 'journal'
         ? expect(failed).resolves.toEqual({
             ok: false,
-            refusal: { code: 'agent_session_operation_invalid', message: injected.message }
+            refusal: {
+              code: 'agent_session_operation_invalid',
+              message: "Codex couldn't restart. Send your message to try again."
+            }
           })
         : expect(failed).rejects.toThrow(
             exitProven ? injected.message : 'agent_session_acquisition_exit_unproven'
@@ -553,14 +570,12 @@ describe('structured session acquisition options', () => {
         })
         await expect(perform(reopened, RESUME_OPERATION, 2)).resolves.toMatchObject({ ok: true })
         expectSettledAttachLease(reopened.getRecord(SESSION))
-      } else {
+      } else if (failurePoint === 'proof' || failurePoint === 'journal') {
+        // A recorded owner goes to recovery, which concludes about it before the next start.
         expect(failedRecord?.lease).toMatchObject({
           runtimeFence: 1,
           claimStatus: failurePoint === 'journal' ? 'live' : 'reserved',
-          handoffStage:
-            failurePoint === 'proof' || failurePoint === 'journal'
-              ? 'recovering'
-              : 'manual-recovery',
+          handoffStage: 'recovering',
           // The settled operation must not stay named by the lease as an in-flight transfer.
           handoffOperationId: null,
           reservedSpawnToken: 'spawn-a'
@@ -569,12 +584,25 @@ describe('structured session acquisition options', () => {
           ok: false,
           refusal: { code: 'agent_session_ownership_unknown' }
         })
+      } else {
+        // No owner was recorded, and the adapter closed the stdio of anything it spawned: released,
+        // with no death evidence, since nothing proved one.
+        expect(failedRecord?.lease).toMatchObject({
+          runtimeFence: 2,
+          claimStatus: 'released',
+          handoffStage: null,
+          handoffOperationId: null,
+          ownerProcess: null,
+          reservedSpawnToken: null,
+          deathEvidence: null
+        })
+        await expect(perform(reopened, RESUME_OPERATION, 2)).resolves.toMatchObject({ ok: true })
       }
     })
   })
 })
 
-describe('the tab id a create records', () => {
+describe('the tab a create reserves', () => {
   async function openStore() {
     root = await mkdtemp(join(tmpdir(), 'orca-surface-tab-id-'))
     return AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
@@ -585,6 +613,7 @@ describe('the tab id a create records', () => {
       store,
       adapter: adapter({ origin: 'created' }),
       journalRoot: root!,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-a',
         claimKeyId: 'key-1',
@@ -603,30 +632,18 @@ describe('the tab id a create records', () => {
     })
   }
 
-  it('pins the id the caller reserved on the record and answers with it', async () => {
+  it('takes no tab at attach, then answers a retry naming another tab with the one it was given', async () => {
     const store = await openStore()
-    const result = await attachWith(store, 'chat-tab-1')
+    const created = await attachWith(store, 'chat-tab-1')
+    // Publishing the tab takes the id, so a create that never gets there leaves nothing behind.
+    expect(created.ok && created.value.tabId).toBeUndefined()
+    expect(store.getSessionTabId(SESSION)).toBeNull()
 
-    expect(result).toMatchObject({ ok: true, value: { tabId: 'chat-tab-1' } })
-    expect(store.getRecord(SESSION)?.surfaceTabId).toBe('chat-tab-1')
-  })
-
-  it('records the id clients derive when the caller reserved none', async () => {
-    const store = await openStore()
-    const result = await attachWith(store)
-
-    // Every reader still keys by the derived id, so an unreserved chat must not record another.
-    const derived = `structured-agent-session-${SESSION}`
-    expect(result).toMatchObject({ ok: true, value: { tabId: derived } })
-    expect(store.getRecord(SESSION)?.surfaceTabId).toBe(derived)
-  })
-
-  it('answers a retry that names another tab with the one the record holds', async () => {
-    const store = await openStore()
-    await attachWith(store, 'chat-tab-1')
-    const retried = await attachWith(store, 'chat-tab-2')
-
-    expect(retried).toMatchObject({ ok: true, value: { tabId: 'chat-tab-1' } })
-    expect(store.getRecord(SESSION)?.surfaceTabId).toBe('chat-tab-1')
+    await store.setSessionTabVisibility(SESSION, true, 'chat-tab-1')
+    expect(await attachWith(store, 'chat-tab-2')).toMatchObject({
+      ok: true,
+      value: { tabId: 'chat-tab-1' }
+    })
+    expect(store.getSessionTabId(SESSION)).toBe('chat-tab-1')
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-acquisition.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-acquisition.ts
index 7968176a5a9..ac2f1823e5f 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-acquisition.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-acquisition.ts
@@ -26,16 +26,8 @@ export async function acquireOwner(
   if (!spawnToken) {
     throw new Error('agent_session_ownership_unknown')
   }
-  // Pre-spawn proof is single-use: this retry may create a child after the durable clear.
   try {
     try {
-      record = await input.store.setReservationProcesslessProof({
-        sessionId: record.sessionId,
-        fence,
-        spawnToken,
-        processlessAt: null,
-        now: input.now()
-      })
       await input.onAcquiring?.()
     } catch (error) {
       throw new AgentSessionPreSpawnError(error)
@@ -47,7 +39,15 @@ export async function acquireOwner(
       spawnToken,
       ...(record.options ? { options: record.options } : {}),
       ...(input.eventSink ? { events: input.eventSink } : {}),
-      ...(input.recordPhase ? { recordPhase: input.recordPhase } : {})
+      ...(input.recordPhase ? { recordPhase: input.recordPhase } : {}),
+      onSpawned: async (process) => {
+        record = await input.store.commitProcessIdentity({
+          sessionId: record.sessionId,
+          fence,
+          process,
+          now: input.now()
+        })
+      }
     })
     const providerChildPhase = acquired.providerChildPhase ?? 'ready'
     // A starting child has proven nothing: the record keeps the reservation's saved options as
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-adapter-router.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-adapter-router.ts
index 7fa1446d6c5..bb003f93427 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-adapter-router.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-adapter-router.ts
@@ -1,3 +1,4 @@
+import type { SubmissionRejectionFact } from '../../../shared/agent-session-failure'
 import type { AgentSessionJournalIdentity } from '../../../shared/agent-session-journal-types'
 import type {
   AgentSessionAccountHome,
@@ -61,8 +62,8 @@ export class StructuredAgentSessionAdapterRouter implements StructuredAgentSessi
   dispatch: StructuredAgentSessionAdapter['dispatch'] = (input) =>
     this.owner(input.sessionId).dispatch(input)
 
-  rewindSupport: NonNullable<StructuredAgentSessionAdapter['rewindSupport']> = (sessionId) =>
-    this.liveOwnerOrNull(sessionId)?.rewindSupport?.(sessionId) ?? {
+  rewindSupport: NonNullable<StructuredAgentSessionAdapter['rewindSupport']> = (sessionId, agent) =>
+    this.capabilityOwner(sessionId, agent)?.rewindSupport?.(sessionId) ?? {
       supported: false,
       reason: 'unsupported'
     }
@@ -94,11 +95,11 @@ export class StructuredAgentSessionAdapterRouter implements StructuredAgentSessi
     return change(input)
   }
 
-  supportsThreadGoal = (sessionId: string): boolean =>
-    this.liveOwnerOrNull(sessionId)?.supportsThreadGoal?.(sessionId) ?? false
+  supportsThreadGoal = (sessionId: string, agent?: string): boolean =>
+    this.capabilityOwner(sessionId, agent)?.supportsThreadGoal?.(sessionId) ?? false
 
-  recordsContextUsage = (sessionId: string): boolean =>
-    this.liveOwnerOrNull(sessionId)?.recordsContextUsage?.(sessionId) ?? false
+  recordsContextUsage = (sessionId: string, agent?: string): boolean =>
+    this.capabilityOwner(sessionId, agent)?.recordsContextUsage?.(sessionId) ?? false
 
   stopBackgroundTasks: NonNullable<StructuredAgentSessionAdapter['stopBackgroundTasks']> = (
     input
@@ -122,6 +123,8 @@ export class StructuredAgentSessionAdapterRouter implements StructuredAgentSessi
 
   awaitOptionWritable = (sessionId: string): Promise<void> =>
     this.liveOwnerOrNull(sessionId)?.awaitOptionWritable?.(sessionId) ?? Promise.resolve()
+  awaitStarted = (sessionId: string): Promise<void | SubmissionRejectionFact> =>
+    this.liveOwnerOrNull(sessionId)?.awaitStarted?.(sessionId) ?? Promise.resolve()
 
   readOptions = (input: { sessionId: string; fence: number }) => {
     const reader = this.owner(input.sessionId).readOptions
@@ -214,6 +217,11 @@ export class StructuredAgentSessionAdapterRouter implements StructuredAgentSessi
     return adapter
   }
 
+  /** The live owner, or for a session at rest the provider it would start under. */
+  private capabilityOwner(sessionId: string, agent?: string): StructuredAgentSessionAdapter | null {
+    return this.liveOwnerOrNull(sessionId) ?? (agent ? this.adapterForAgent(agent) : null)
+  }
+
   private liveOwnerOrNull(sessionId: string): StructuredAgentSessionAdapter | null {
     const route = this.routes.get(sessionId)
     return route?.state === 'live' ? route.adapter : null
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-adapter.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-adapter.ts
index 7085700cdcb..df81e8ec1a0 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-adapter.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-adapter.ts
@@ -15,6 +15,7 @@ import type {
   AgentJournalItemBody,
   AgentJournalMessageItem,
   AgentJournalDispatchState,
+  AgentJournalTurnItem,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
 import type { AgentSessionProviderHandleLink } from '../../../shared/agent-session-provider-handle'
@@ -27,22 +28,39 @@ import type {
   AgentSessionBackgroundTaskState,
   AgentSessionOptionsResult,
   AgentSessionSlashCommand,
-  AgentSessionThreadGoalChange,
-  AgentSessionWireRefusalCode
+  AgentSessionThreadGoalChange
 } from '../../../shared/agent-session-wire'
-import { isAgentSessionWireRefusalCode } from '../../../shared/agent-session-wire-refusals'
+import {
+  isAgentSessionWireRefusalCode,
+  type AgentSessionRefusalReason
+} from '../../../shared/agent-session-wire-refusals'
+import type {
+  ProviderDiagnostic,
+  SubmissionRejectionFact
+} from '../../../shared/agent-session-failure'
+import type { AgentJournalDispatchRejection } from '../../../shared/agent-session-failure-words'
+import type { AgentSessionPromptResponse } from '../../../shared/agent-session-question-answer'
 import type { ProviderHistoryWindow } from '../agent-session-journal/journal-submission-reconciler'
 import type { StructuredAgentSessionEventSink } from './structured-agent-session-event-sink'
 import type { AgentSessionCreatePhaseRecorder } from '../../observability/agent-session-instrumentation'
 
 export class AgentSessionAcquisitionRefusal extends Error {
+  readonly code = 'agent_session_operation_invalid'
+
   constructor(
     message: string,
-    readonly code: AgentSessionWireRefusalCode = 'agent_session_operation_invalid'
+    /** The situation, so the chat can say what to do; the message is Orca's log wording. Absent,
+     *  the provider refused its own start. */
+    readonly reason: AgentSessionRefusalReason<'agent_session_operation_invalid'> = 'providerStartFailed'
   ) {
     super(message)
     this.name = 'AgentSessionAcquisitionRefusal'
   }
+
+  /** The conversation's history is more than this host can restore. */
+  static historyTooLarge(message: string): AgentSessionAcquisitionRefusal {
+    return new AgentSessionAcquisitionRefusal(message, 'historyTooLarge')
+  }
 }
 
 export class AgentSessionPromptUnavailableError extends Error {
@@ -52,11 +70,19 @@ export class AgentSessionPromptUnavailableError extends Error {
   }
 }
 
+/** The provider cannot take this answer. Thrown before the journal commit, so nothing is recorded. */
+export class AgentSessionPromptAnswerRejectedError extends Error {
+  constructor(message: string) {
+    super(message)
+    this.name = 'AgentSessionPromptAnswerRejectedError'
+  }
+}
+
 /**
  * The provider's own root process was observed to exit, but its descendant tree
- * could not be verified. The lease keys on the root's pid and start time, so its
- * observed death releases the reservation; nothing is claimed about descendants.
- * Never thrown when a descendant was observed still alive — that stays unproven.
+ * was not proven gone. The lease keys on the root's pid and start time, so its
+ * observed death releases the reservation; nothing is claimed about descendants,
+ * including one seen still alive.
  */
 export class AgentSessionAcquisitionRootExitObservedError extends Error {
   constructor(cause: unknown) {
@@ -94,11 +120,24 @@ export type AgentSessionAcquisition = {
   providerChildPhase?: StructuredAgentSessionProviderChildPhase
 }
 
+/** A refusal before spawn that a person can act on; the site that refused names it. */
+export type AgentSessionPreSpawnReason = Extract<
+  AgentSessionRefusalReason<'agent_session_operation_invalid'>,
+  'managedAccountEnvOverride' | 'accountSwitchInProgress' | 'managedAccountUnsupported'
+>
+
 /** Acquisition failed with first-hand proof that no provider process existed. */
 export class AgentSessionPreSpawnError extends Error {
-  constructor(cause: unknown) {
-    super(cause instanceof Error ? cause.message : String(cause), { cause })
+  /** Absent: Orca's own reason, which only the log reads. A wrapped pre-spawn error keeps its. */
+  readonly reason: AgentSessionPreSpawnReason | undefined
+
+  constructor(
+    cause: unknown,
+    options: { reason?: AgentSessionPreSpawnReason; message?: string } = {}
+  ) {
+    super(options.message ?? (cause instanceof Error ? cause.message : String(cause)), { cause })
     this.name = 'AgentSessionPreSpawnError'
+    this.reason = options.reason ?? (isAgentSessionPreSpawnError(cause) ? cause.reason : undefined)
   }
 }
 
@@ -106,6 +145,23 @@ export function isAgentSessionPreSpawnError(error: unknown): error is AgentSessi
   return error instanceof Error && error.name === 'AgentSessionPreSpawnError'
 }
 
+/** A conversation command the host handed to a provider child: the running turn it opened for it,
+ *  which the child's translator ends, and where the command's own result row goes. */
+export type StructuredAgentSessionCommandRun = {
+  clientMessageId: string
+  /** What a Stop names. */
+  turnId: string
+  identity: AgentJournalItemIdentity
+  resultIdentity: AgentJournalItemIdentity
+  /** The turn record as the host wrote it; the translator's end revises it. */
+  running: AgentJournalTurnItem
+}
+
+/** A command the provider took answers it in place and echoes no item of its own. */
+export type AgentSessionCommandAdmission =
+  | AgentSessionDispatchOutcome
+  | { state: 'accepted'; providerIdentity: null }
+
 export type AgentSessionDispatchOutcome =
   /** The provider owns the turn now, under this identity. */
   | { state: 'accepted'; providerIdentity: AgentJournalItemIdentity }
@@ -116,21 +172,24 @@ export type AgentSessionDispatchOutcome =
    * anything and never promotes this to `unknown`.
    */
   | { state: 'admitted' }
-  | { state: 'rejected'; reason: string }
+  /** Words from `agentSessionFailureWords`, never written by hand. */
+  | ({ state: 'rejected' } & AgentJournalDispatchRejection)
   /** The call did not settle. Never re-send on the user's behalf. */
   | { state: 'unknown'; reason: string }
 
 export type StructuredAgentSessionEndedEvent = {
   type: 'ended'
   sessionId: string
+  /** Log text only; the chat's words come from `failure`. */
   reason: string
+  /** Why it ended, as the adapter knows it: the provider's exit with its own diagnostic, or an
+   *  Orca fault. Absent reads as a provider exit with nothing to add. */
+  failure?: SubmissionRejectionFact
   cause: 'unexpected-exit' | 'requested-close'
   fence: number
   acquisitionGeneration: string
-  /** Host receipt of the child exit, retained across settlement retries. */
+  /** Host receipt of the child exit: the end time of a turn it interrupted. */
   observedAt?: number
-  /** Translator could not admit terminal rows; host recovery must append its bounded fallback. */
-  settlementRetryRequired?: boolean
   /** The provider ended before it finished starting, so resuming it would repeat the failure. */
   startupUnproven?: true
 }
@@ -165,6 +224,9 @@ export type StructuredAgentSessionAcquireInput = {
   /** Provider events may begin before acquisition returns. */
   events?: StructuredAgentSessionEventSink
   recordPhase?: AgentSessionCreatePhaseRecorder
+  /** Durably records the child's identity the moment it exists, before any handshake, so a crash
+   *  mid-start leaves an owner recovery can stop. The acquisition's `process` must match it. */
+  onSpawned?: (process: AgentSessionProcessIdentity) => Promise<void>
 }
 
 export type StructuredAgentSessionSetOptionInput = {
@@ -174,6 +236,14 @@ export type StructuredAgentSessionSetOptionInput = {
   fence: number
 }
 
+/** `refusal`: the provider answered the Stop and declined it, in its own words when it gave any.
+ *  `unconfirmed`: the provider took the Stop, but Orca could not confirm the turn's work ended. */
+export type AgentSessionCancelOutcome = {
+  cancelled: boolean
+  refusal?: { detail?: ProviderDiagnostic }
+  unconfirmed?: true
+}
+
 export type StructuredAgentSessionAdapter = {
   /** Provider-aware capability check for hosts that route more than one adapter. */
   supportsCreate?(location: AgentSessionExecutionLocation, agent: string): boolean
@@ -186,7 +256,7 @@ export type StructuredAgentSessionAdapter = {
   /** Reaps an acquired provider when the host cannot commit or prove its lease.
    *  Returns true only after provider child exit is proven. Throws
    *  `AgentSessionAcquisitionRootExitObservedError` when the provider root's own
-   *  exit was observed first-hand but its descendants could not be verified. */
+   *  exit was observed first-hand but its descendants were not proven gone. */
   releaseAcquisition?(input: { sessionId: string }): Promise<boolean>
   dispatch(input: {
     sessionId: string
@@ -199,7 +269,8 @@ export type StructuredAgentSessionAdapter = {
     /** Revalidate after preparation, immediately before writing to the provider. */
     beforeDispatch?: () => Promise<void>
   }): Promise<AgentSessionDispatchOutcome>
-  rewindSupport?(sessionId: string): AgentSessionRewindSupport
+  /** `agent` answers for a session with no child running, from the provider alone. */
+  rewindSupport?(sessionId: string, agent?: string): AgentSessionRewindSupport
   recoverRewind?(input: {
     sessionId: string
     fence: number
@@ -215,22 +286,24 @@ export type StructuredAgentSessionAdapter = {
     onPrepared?: (
       items: { identity: AgentJournalItemIdentity; body: AgentJournalItemBody }[]
     ) => Promise<void>
-    onReverted?: () => Promise<void>
   }): Promise<
     | { ok: true; items?: { identity: AgentJournalItemIdentity; body: AgentJournalItemBody }[] }
     | { ok: false; reason: AgentSessionRewindReason }
   >
+  /** Sends a conversation compaction and answers with the provider's receipt of it, as a dispatch
+   *  does. The command's turn is the child's journal translator's to end, from the provider's own
+   *  frames; a child that ends first leaves it to the host's settlement of that child. */
   compact?(input: {
-    turnId: string
     sessionId: string
     fence: number
-    onLateResult?: (result: { error?: string }) => Promise<void>
-  }): Promise<{ error?: string }>
+    command: StructuredAgentSessionCommandRun
+  }): Promise<AgentSessionCommandAdmission>
   /** Cancels one turn, not the session: a session-wide interrupt would also kill
-   *  a turn the client never asked to stop. */
+   *  a turn the client never asked to stop. With no `turnId` the conversation asked to stop
+   *  everything it has in flight — a running turn, or a dispatch whose turn has not opened yet. */
   cancelTurn(input: {
     sessionId: string
-    turnId: string
+    turnId?: string
     fence: number
     prompt?: { itemId: string }
     /** Latest journal submission for this fence, when the host has one. */
@@ -239,7 +312,7 @@ export type StructuredAgentSessionAdapter = {
      *  could have named. A function, not a value, because the guard re-checks after the
      *  delivery fence may have waited. Absent for direct callers with no journal. */
     resolveLiveTurnId?: () => string | null
-  }): Promise<{ cancelled: boolean }>
+  }): Promise<AgentSessionCancelOutcome>
   /** Changes the provider thread's goal. `rejected` is the provider refusing the
    *  change; a throw leaves its effect unknown. Absent where no goal exists. */
   changeThreadGoal?(input: {
@@ -250,10 +323,10 @@ export type StructuredAgentSessionAdapter = {
      *  start a new goal rather than rewrite that one's objective in place. */
     replacesGoal: boolean
   }): Promise<{ ok: true } | { ok: false; rejected: string }>
-  /** Whether this live session can change its goal. */
-  supportsThreadGoal?(sessionId: string): boolean
-  /** Whether this live session writes context facts to its turn rows. */
-  recordsContextUsage?(sessionId: string): boolean
+  /** Whether this session can change its goal; `agent` answers one at rest. */
+  supportsThreadGoal?(sessionId: string, agent?: string): boolean
+  /** Whether this session writes context facts to its turn rows; `agent` answers one at rest. */
+  recordsContextUsage?(sessionId: string, agent?: string): boolean
   stopBackgroundTasks?(input: {
     sessionId: string
     fence: number
@@ -263,13 +336,14 @@ export type StructuredAgentSessionAdapter = {
   /** The `/` surface the running provider reports for itself. Undefined when the
    *  provider never reports one, which is what keeps the client on its catalog. */
   readCommands?(sessionId: string): AgentSessionSlashCommand[] | undefined
-  /** Claims the live callback, commits the journal CAS while that claim is held, then answers it.
-   *  A prompt cancel claims the same callback, so only one operation can commit. */
+  /** Claims the live callback, builds the provider reply, commits the journal CAS while that claim is
+   *  held, then answers it. A reply that cannot be built throws `AgentSessionPromptAnswerRejectedError`
+   *  before the commit. A prompt cancel claims the same callback, so only one operation can commit. */
   answerPrompt(input: {
     sessionId: string
     itemId: string
     kind: 'approval' | 'question'
-    optionId: string
+    response: AgentSessionPromptResponse
     fence: number
     commit: () => Promise<void>
   }): Promise<void>
@@ -278,6 +352,10 @@ export type StructuredAgentSessionAdapter = {
   ): Promise<void | Readonly<Record<string, string>>>
   /** Resolves once a live session can take an option write, or after a bound; never rejects. */
   awaitOptionWritable?(sessionId: string): Promise<void>
+  /** Resolves once a session published before it proved its start has proven it, failed, or been
+   *  closed; at once for any other. A start that did not land resolves with the chat's words for
+   *  why. Never rejects. */
+  awaitStarted?(sessionId: string): Promise<void | SubmissionRejectionFact>
   readOptions?(input: { sessionId: string; fence: number }): Promise<AgentSessionOptionsResult>
   /** Option keys skipped after a provider rejected their persisted restore value. */
   readOptionRestoreFailures?(sessionId: string): readonly string[]
@@ -343,8 +421,8 @@ function provenExitAcquisitionFailure(cause: unknown): unknown {
 }
 
 /** Whether a stop left the provider root gone. The lease follows the root, so a first-hand root
- *  exit or a processless child ends the session even with descendants unverified; any other
- *  failure, including known-live descendants, still throws. */
+ *  exit or a processless child ends the session whatever its descendants did; any other
+ *  failure still throws. */
 export async function stopAgentSessionProviderRoot(stop: () => Promise<boolean>): Promise<boolean> {
   try {
     return (await stop()) === true
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.test.ts
index 0248799980a..371b942c2f4 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // Source validation must finish before a new session claims the provider conversation.
 
 import { mkdtemp, rm, writeFile, truncate } from 'node:fs/promises'
@@ -11,10 +12,12 @@ import {
   attachFingerprintFields,
   type AgentSessionAttachParams
 } from './structured-agent-session-attach'
+import { openTestAttachConversation } from './structured-agent-session-attach-test-conversation'
 import { performAttach, type AttachFlowInput } from './structured-agent-session-attach-flow'
 import { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import { agentSessionJournalCloseRetries } from '../agent-session-journal/journal-close-retry'
 import * as legacyImport from '../agent-session-journal/journal-legacy-import'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
 
 const NOW = 1_800_000_000_000
 const SESSION = 'codex_adopting_session'
@@ -121,6 +124,7 @@ async function attach(
     store,
     adapter: sessionAdapter,
     journalRoot: root!,
+    openConversation: openTestAttachConversation(root!),
     authority: {
       spawnToken: 'spawn-a',
       claimKeyId: 'key-1',
@@ -159,7 +163,7 @@ describe('adopting a provider conversation on create', () => {
       await journal.appendItem(
         { provider: 'legacy', agent: 'codex', sessionId: THREAD, recordId: 'journal-only' },
         { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'not yet in rollout' }] },
-        { fence: 1 }
+        { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
       )
       await journal.close()
     })
@@ -210,7 +214,7 @@ describe('adopting a provider conversation on create', () => {
     }
   )
 
-  it('still releases acquisition and closes the provisional journal on an import write failure', async () => {
+  it('still releases acquisition on an import write failure, and leaves the conversation open', async () => {
     root = await mkdtemp(join(tmpdir(), 'orca-adopt-write-failure-'))
     const transcriptPath = join(root, 'rollout.jsonl')
     await writeCodexRollout(transcriptPath, 'valid source')
@@ -222,7 +226,51 @@ describe('adopting a provider conversation on create', () => {
     await expect(attach(transcriptPath, sessionAdapter)).rejects.toThrow('disk write failed')
     expect(sessionAdapter.acquire).toHaveBeenCalledTimes(1)
     expect(sessionAdapter.releaseAcquisition).toHaveBeenCalledTimes(1)
-    expect(close).toHaveBeenCalledTimes(1)
+    // The journal is the conversation's, not the attach's: a failed import closes nothing.
+    expect(close).not.toHaveBeenCalled()
+  })
+
+  it('leaves the conversation writable when the import fails after acquiring', async () => {
+    root = await mkdtemp(join(tmpdir(), 'orca-adopt-host-failure-'))
+    const transcriptPath = join(root, 'rollout.jsonl')
+    await writeCodexRollout(transcriptPath, 'valid source')
+    store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+    const host = new StructuredAgentSessionHost({
+      store,
+      adapter: adapter(),
+      journalRoot: root,
+      claimKeyId: 'key-1',
+      mintSpawnToken: () => 'spawn-a',
+      now: () => NOW
+    })
+    vi.spyOn(AgentSessionJournal.prototype, 'replaceEpochItems').mockRejectedValueOnce(
+      new Error('disk write failed')
+    )
+    const attached = await host
+      .attach({ callerKey: 'client-1' }, attachParams(transcriptPath))
+      .catch(() => null)
+    expect(attached?.ok).not.toBe(true)
+
+    const body = { kind: 'message' as const, role: 'user' as const, blocks: [] }
+    const sent = await host.send(
+      { callerKey: 'client-1' },
+      {
+        envelope: {
+          sessionId: SESSION,
+          clientOperationId: `${NOW}-${'2'.padStart(32, '0')}`,
+          expectedRuntimeFence: null,
+          payloadFingerprint: computeAgentSessionPayloadFingerprint({
+            method: 'agentSession.send',
+            sessionId: SESSION,
+            fields: { body }
+          })
+        },
+        body
+      }
+    )
+    // The failed attach kept the conversation's own journal open, so the send is recorded.
+    expect(sent).toMatchObject({ ok: true, value: { submission: { dispatchState: 'pending' } } })
+    await host.flushAllStreamedEvents()
   })
 
   it('prepares a valid source once before acquisition and imports those exact items', async () => {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.ts
index 459d21b1f3b..3eccc4f9457 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.ts
@@ -1,7 +1,11 @@
-import type { AgentSessionWireRefusal } from '../../../shared/agent-session-wire'
+import {
+  agentSessionRefusalError,
+  isAgentSessionRefusalError,
+  refuse,
+  type AgentSessionWireRefusal
+} from '../../../shared/agent-session-wire'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 import type { AgentSessionAttachParams, AttachedJournal } from './structured-agent-session-attach'
-import { agentSessionJournalCloseRetries } from '../agent-session-journal/journal-close-retry'
 import type { JournalReplacementItem } from '../agent-session-journal/journal-epoch-replacement'
 import {
   importLegacyTranscriptIntoJournal,
@@ -19,10 +23,13 @@ export async function prepareAdoptedTranscript(
   } catch (error) {
     return {
       ok: false,
-      refusal: {
-        code: 'agent_session_identity_required',
-        message: error instanceof Error ? error.message : String(error)
-      }
+      refusal: isAgentSessionRefusalError(error)
+        ? error.refusal
+        : refuse(
+            'agent_session_identity_required',
+            { reason: 'transcriptUnreadable' },
+            error instanceof Error ? error.message : String(error)
+          )
     }
   }
 }
@@ -36,7 +43,9 @@ async function readAdoptedTranscript(
     return null
   }
   if (!adopt.transcriptPath) {
-    throw new Error('agent_session_identity_required')
+    throw agentSessionRefusalError('agent_session_identity_required', {
+      reason: 'transcriptNotFound'
+    })
   }
   const prepared = await prepareLegacyTranscriptImport({
     agent: params.agent,
@@ -50,7 +59,9 @@ async function readAdoptedTranscript(
     throw new Error(prepared.error)
   }
   if (prepared.items.length === 0) {
-    throw new Error('agent_session_identity_required')
+    throw agentSessionRefusalError('agent_session_identity_required', {
+      reason: 'transcriptUnreadable'
+    })
   }
   return prepared.items
 }
@@ -62,13 +73,8 @@ export async function importAdoptedTranscript(
   record: AgentSessionRecord,
   prepared: JournalReplacementItem[] | null
 ): Promise<void> {
-  try {
-    await applyAdoptedTranscript(params, attached, record, prepared)
-  } catch (error) {
-    // Publication has not taken ownership of this provisional journal yet.
-    await agentSessionJournalCloseRetries.closeOrRetain(attached.journal)
-    throw error
-  }
+  // The journal is the conversation's, which outlives a failed import; nothing here closes it.
+  await applyAdoptedTranscript(params, attached, record, prepared)
 }
 
 async function applyAdoptedTranscript(
@@ -87,7 +93,9 @@ async function applyAdoptedTranscript(
     return
   }
   if (!adopt.transcriptPath) {
-    throw new Error('agent_session_identity_required')
+    throw agentSessionRefusalError('agent_session_identity_required', {
+      reason: 'transcriptNotFound'
+    })
   }
   const imported = await importLegacyTranscriptIntoJournal({
     journal: attached.journal,
@@ -105,6 +113,8 @@ async function applyAdoptedTranscript(
   // `replaced: false` means the transcript decoded to nothing. The row promised a conversation and
   // the provider resumed one, so an empty journal here is a disagreement, not an empty chat.
   if (!imported.replaced) {
-    throw new Error('agent_session_identity_required')
+    throw agentSessionRefusalError('agent_session_identity_required', {
+      reason: 'transcriptUnreadable'
+    })
   }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-agent-start.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-agent-start.ts
new file mode 100644
index 00000000000..a4c93fa00f8
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-agent-start.ts
@@ -0,0 +1,212 @@
+// Giving a session its provider child back.
+//
+// Only work starts one: the delivery loop for a queued message, and the few operations that need
+// the provider itself — never a view, and never the app launching. It runs inside the session's
+// serialize, with the attach it is given, so the eligibility it reads is the one the attach acts
+// on.
+
+import {
+  providerDiagnosticOf,
+  type ProviderDiagnostic
+} from '../../../shared/agent-session-failure'
+import {
+  agentSessionRefusalFromReference,
+  readAgentSessionRefusalReference,
+  refuse,
+  refuseUnclassified,
+  type AgentSessionRefusalDetailsByCode,
+  type AgentSessionWireRefusalCode
+} from '../../../shared/agent-session-wire-refusals'
+import { agentSessionWriteNoticeEnglish } from '../../../shared/agent-session-refusal-notice'
+import type {
+  AgentSessionAttachResult,
+  AgentSessionMutationResult,
+  AgentSessionWireRefusal
+} from '../../../shared/agent-session-wire'
+import { terminalOwnerRefusalMessage } from '../../../shared/agent-session-legacy-handoff-lease'
+import type { StructuredAgentSessionAttachContext } from './structured-agent-session-attach-context'
+import { attachStructuredAgentSessionUnderSerialize } from './structured-agent-session-attach-orchestration'
+import { failedCreateRefusal } from './structured-agent-session-failed-create-refusal'
+import { adapterSupportsRecord } from './structured-agent-session-provider-support'
+import {
+  structuredAgentSessionResumeOperationId,
+  structuredAgentSessionResumeParams
+} from './structured-agent-session-resume-eligibility'
+
+/** A resume answers with the attach's own refusal, verdict and all, so the asker can tell a lease
+ *  someone else is settling from an owner that will not come back. */
+export type StructuredAgentSessionResumeOutcome =
+  | { ok: true }
+  | {
+      ok: false
+      refusal: AgentSessionWireRefusal
+      /** What the provider said about the failed start, for the chat's own record; host-side
+       *  only, never on the refusal. */
+      diagnostic?: ProviderDiagnostic
+    }
+
+/** The attach's caller key: the ledger row a start settles is Orca's own. */
+const AGENT_START_CALLER_KEY = 'trusted-local:agent-start'
+
+/**
+ * Gives the session a provider child if it has none, for a caller inside its serialize — which is
+ * what makes "if it has none" exact: two askers run this in turn, and the second finds the first
+ * one's child. A failed start leaves the next asker to make its own.
+ */
+export async function ensureStructuredAgentSessionAgent(
+  context: StructuredAgentSessionAttachContext,
+  sessionId: string,
+  startedFor?: string
+): Promise<StructuredAgentSessionResumeOutcome> {
+  if (context.sessions.get(sessionId)?.child) {
+    return { ok: true }
+  }
+  const started = await startStructuredAgentSessionAgent(context, sessionId, startedFor)
+  if (!started.ok || context.sessions.get(sessionId)?.child) {
+    return started
+  }
+  return refuseResume(
+    'agent_session_ownership_unknown',
+    { reason: 'noProviderChild' },
+    'The session attached without a provider child to write to.'
+  )
+}
+
+/** The same, for an operation's admission: a start that throws is that operation's refusal. */
+export function ensureStructuredAgentSessionAgentForOperation(
+  context: StructuredAgentSessionAttachContext,
+  sessionId: string
+): Promise<StructuredAgentSessionResumeOutcome> {
+  return ensureStructuredAgentSessionAgent(context, sessionId).catch((error: unknown) => {
+    // The error is Orca's own and goes to the log; the refusal says only that the start failed.
+    console.warn('[agent-session] starting the agent for an operation failed:', error)
+    return {
+      ok: false,
+      refusal: refuseUnclassified(
+        'agent_session_owner_restart_failed',
+        agentSessionWriteNoticeEnglish(['restartFailed'])
+      )
+    }
+  })
+}
+
+async function startStructuredAgentSessionAgent(
+  context: StructuredAgentSessionAttachContext,
+  sessionId: string,
+  startedFor: string | undefined
+): Promise<StructuredAgentSessionResumeOutcome> {
+  const callerKey = AGENT_START_CALLER_KEY
+  // The record is read only once this host has adjudicated it and recovery resolution has
+  // concluded about any owner a failed attempt left in `recovering`, so the eligibility below sees
+  // the lease the resolver handed back.
+  const unreconciled = await context.reconcileLeases(sessionId)
+  if (unreconciled) {
+    return { ok: false, refusal: unreconciled }
+  }
+  await context.runtimeState.resolveRecovery(sessionId)
+  const record = context.deps.store.getRecord(sessionId)
+  if (!record) {
+    return refuseResume(
+      'agent_session_identity_required',
+      { reason: 'recordMissing' },
+      'No structured session exists by that id.'
+    )
+  }
+  if (!adapterSupportsRecord(context.deps.adapter, record)) {
+    return refuseResume(
+      'structured_agent_session_unsupported',
+      { reason: 'hostUnsupported' },
+      'This execution host cannot resume the requested structured agent session.'
+    )
+  }
+  const params = structuredAgentSessionResumeParams(
+    record,
+    structuredAgentSessionResumeOperationId(context.now())
+  )
+  if (!params) {
+    return record.lease.unreconciled
+      ? refuseResume(
+          'execution_owner_reconciling',
+          { reason: 'hostReconciling' },
+          'This host has not yet adjudicated the session lease.'
+        )
+      : record.lease.claimStatus === 'conflicted'
+        ? refuseResume(
+            'agent_session_conflict',
+            { reason: 'claimConflicted' },
+            terminalOwnerRefusalMessage(record.lease)
+          )
+        : refuseResume(
+            'agent_session_ownership_unknown',
+            { reason: 'notResumable' },
+            'The session lease is not one this host may resume.'
+          )
+  }
+  let attached: AgentSessionMutationResult<AgentSessionAttachResult>
+  let acquisitionError: unknown
+  try {
+    attached = await attachStructuredAgentSessionUnderSerialize(context, callerKey, params, {
+      ...(startedFor === undefined ? {} : { startedFor }),
+      onAcquisitionFailed: (error) => {
+        acquisitionError = error
+      }
+    })
+  } catch (error) {
+    // The attach settles an acquisition that failed — the ledger row, the released lease — before
+    // it rethrows the cause. That row is the answer: a failure it recorded is this resume's
+    // refusal, verdict and all. Only an error it did not record is a fault for the caller.
+    const settled = settledResumeRefusal(
+      context,
+      callerKey,
+      params.envelope.clientOperationId,
+      sessionId,
+      error
+    )
+    if (settled) {
+      return withDiagnostic(settled.refusal, error)
+    }
+    throw error
+  }
+  return attached.ok ? { ok: true } : withDiagnostic(attached.refusal, acquisitionError)
+}
+
+function withDiagnostic(
+  refusal: AgentSessionWireRefusal,
+  error: unknown
+): StructuredAgentSessionResumeOutcome {
+  const diagnostic = providerDiagnosticOf(error)
+  return { ok: false, refusal, ...(diagnostic ? { diagnostic } : {}) }
+}
+
+function settledResumeRefusal(
+  context: Pick<StructuredAgentSessionAttachContext, 'deps'>,
+  callerKey: string,
+  operationId: string,
+  sessionId: string,
+  error: unknown
+): { ok: false; refusal: AgentSessionWireRefusal } | null {
+  const outcome = context.deps.store.getOperationRow(callerKey, operationId)?.outcome
+  const reference =
+    outcome?.status === 'failed'
+      ? readAgentSessionRefusalReference({ code: outcome.code, details: outcome.details })
+      : undefined
+  if (outcome?.status !== 'failed' || !reference) {
+    return null
+  }
+  return failedCreateRefusal(
+    agentSessionRefusalFromReference(
+      reference,
+      outcome.message ?? (error instanceof Error ? error.message : String(error))
+    ),
+    outcome.status,
+    context.deps.store.getRecord(sessionId)
+  )
+}
+
+function refuseResume<C extends AgentSessionWireRefusalCode>(
+  code: C,
+  details: NoInfer<AgentSessionRefusalDetailsByCode[C]>,
+  message: string
+): StructuredAgentSessionResumeOutcome {
+  return { ok: false, refusal: refuse(code, details, message) }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-append-delivery.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-append-delivery.test.ts
new file mode 100644
index 00000000000..dbb3a63e7b5
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-append-delivery.test.ts
@@ -0,0 +1,256 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
+// What an open chat receives, asserted at its subscriber rather than in the journal: a fresh
+// subscribe re-reads the journal and hides a write that never reached the readers already open.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import type {
+  AgentJournalRenderItem,
+  AgentJournalSubmission
+} from '../../../shared/agent-session-journal-types'
+import type { AgentSessionSubscribeEvent } from '../../../shared/agent-session-wire'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+const CALLER = { callerKey: 'client-1' }
+const EXIT_REASON = 'Claude Code is not signed in. Sign in with the Claude CLI'
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let acquire: Mock<StructuredAgentSessionAdapter['acquire']>
+let generation = 0
+
+/** Everything a live subscriber was sent after it opened. */
+function liveReader() {
+  const events: AgentSessionSubscribeEvent[] = []
+  host.subscribe({ id: 'pane', sessionId: SESSION, emit: (event) => events.push(event) })
+  const opened = events.length
+  const received = () => {
+    const items: AgentJournalRenderItem[] = []
+    const submissions: AgentJournalSubmission[] = []
+    for (const event of events.slice(opened)) {
+      if (event.type === 'batch') {
+        items.push(...event.batch.items)
+        submissions.push(...event.batch.submissions)
+      } else if (event.type === 'snapshot' || event.type === 'reset') {
+        items.push(...event.page.items)
+        submissions.push(...event.page.submissions)
+      }
+    }
+    const rows = new Map<string, string>()
+    for (const item of items) {
+      if (item.body.kind === 'status') {
+        rows.set(item.itemId, item.body.text)
+      }
+    }
+    return {
+      statuses: items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : [])),
+      /** Each status row as the chat renders it: its latest revision, once. */
+      statusRows: [...rows.values()],
+      submissions,
+      batches: events.slice(opened).filter((event) => event.type === 'batch').length
+    }
+  }
+  return { received }
+}
+
+async function send(text: string): Promise<string> {
+  const body = hostTestMessage(text)
+  const sent = await host.send(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: store.getRecord(SESSION)?.lease.runtimeFence ?? 0,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    },
+    body
+  })
+  expect(sent, JSON.stringify(sent)).toMatchObject({ ok: true })
+  return sent.ok ? sent.value.clientMessageId : ''
+}
+
+function exitBeforeProof(): Promise<void> {
+  return host.handleAdapterEvent({
+    type: 'ended',
+    sessionId: SESSION,
+    fence: store.getRecord(SESSION)?.lease.runtimeFence ?? 0,
+    acquisitionGeneration: `generation-${generation}`,
+    reason: EXIT_REASON,
+    failure: { kind: 'providerExited', detail: { text: EXIT_REASON, audience: 'log' } },
+    cause: 'unexpected-exit',
+    startupUnproven: true
+  })
+}
+
+function providerSink() {
+  const events = acquire.mock.calls.at(-1)?.[0].events
+  if (!events) {
+    throw new Error('no acquired provider sink')
+  }
+  return events
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-append-delivery-'))
+  resetHostTestOperationIds()
+  generation = 0
+  acquire = vi.fn(async ({ fence, spawnToken }) => ({
+    process: { hostId: 'local', pid: 4242, processStartTimeMs: 1_700_000_000_000, spawnToken },
+    link: {
+      linkId: `link-${fence}`,
+      handle: { provider: 'codex', threadId: THREAD },
+      origin: generation === 0 ? ('created' as const) : ('resumed' as const),
+      mintedAtFence: fence,
+      observedAt: NOW
+    },
+    acquisitionGeneration: `generation-${++generation}`,
+    providerChildPhase: 'starting' as const
+  }))
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: {
+      acquire,
+      releaseAcquisition: vi.fn(async () => true),
+      closeSession: vi.fn(async () => true),
+      dispatch: vi.fn(async () => ({ state: 'admitted' as const })),
+      cancelTurn: vi.fn(async () => ({ cancelled: true })),
+      answerPrompt: vi.fn(async () => undefined),
+      setOption: vi.fn(async () => undefined)
+    },
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => `spawn-${generation + 1}`,
+    now: () => NOW
+  })
+  await expect(host.attach(CALLER, hostTestAttachParams(null))).resolves.toMatchObject({
+    ok: true
+  })
+})
+
+afterEach(async () => {
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('an open chat receives every row its journal commits', () => {
+  it('shows a failed start whose lease could not be handed back', async () => {
+    const held = await send('hello')
+    const pane = liveReader()
+    // The exit settles the journal, then fails to release the lease: nothing moves the fence.
+    vi.spyOn(store, 'transitionHandoff').mockRejectedValueOnce(new Error('record store busy'))
+
+    await exitBeforeProof()
+
+    // The exit ends the child; the delivery loop, which reads why, rejects what it had queued.
+    await vi.waitFor(() =>
+      expect(pane.received().submissions).toContainEqual(
+        expect.objectContaining({ clientMessageId: held, dispatchState: 'rejected' })
+      )
+    )
+    // One row, however many of its writers reported the start.
+    expect(pane.received().statusRows).toEqual([
+      'Codex stopped before it finished starting. Send your message to try again.'
+    ])
+  })
+
+  it('shows a revision the provider queued with no publish behind it', async () => {
+    const pane = liveReader()
+    const identity = { provider: 'orca' as const, clientMessageId: 'context-usage' }
+    const body = { kind: 'status' as const, text: 'context usage answered after the turn' }
+
+    expect(
+      providerSink().tryReviseResolvedItem?.(4_096, () => ({ identity, body }), {
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
+    ).toEqual({
+      accepted: true
+    })
+    await host.flushStreamedEvents(SESSION)
+
+    expect(pane.received().statuses).toEqual(['context usage answered after the turn'])
+  })
+
+  it('shows a row appended straight to the journal', async () => {
+    const pane = liveReader()
+    const journal = host['sessions'].get(SESSION)?.journal
+    if (!journal) {
+      throw new Error('the attached chat has no journal')
+    }
+
+    await journal.appendItem(
+      { provider: 'orca', clientMessageId: 'host-note' },
+      { kind: 'status', text: 'written by a writer that publishes nothing' },
+      {
+        fence: store.getRecord(SESSION)?.lease.runtimeFence ?? 0,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      }
+    )
+
+    expect(pane.received().statuses).toEqual(['written by a writer that publishes nothing'])
+  })
+})
+
+describe('an open chat receives each row once', () => {
+  it('when the provider frame that wrote it also publishes', async () => {
+    const pane = liveReader()
+    const sink = providerSink()
+    const journal = host['sessions'].get(SESSION)?.journal
+    if (!journal) {
+      throw new Error('the attached chat has no journal')
+    }
+    const readSince = vi.spyOn(journal, 'readSince')
+
+    sink.appendItem(
+      { provider: 'orca', clientMessageId: 'streamed' },
+      { kind: 'status', text: 'streamed row' },
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
+    sink.publish()
+    await host.flushStreamedEvents(SESSION)
+
+    expect(pane.received().statuses).toEqual(['streamed row'])
+    // The frame's publish finds the reader caught up and reads no rows: streaming stays one read.
+    expect(readSince).toHaveBeenCalledOnce()
+  })
+
+  it('when a writer publishes the row it appended', async () => {
+    const pane = liveReader()
+    const journal = host['sessions'].get(SESSION)?.journal
+    if (!journal) {
+      throw new Error('the attached chat has no journal')
+    }
+
+    await journal.appendItem(
+      { provider: 'orca', clientMessageId: 'host-row' },
+      { kind: 'status', text: 'host row' },
+      {
+        fence: store.getRecord(SESSION)?.lease.runtimeFence ?? 0,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      }
+    )
+    host['subscribers'].publish(SESSION, journal)
+
+    expect(pane.received().statuses).toEqual(['host row'])
+    // The second publish found nothing past the reader's cursor, so it sent nothing at all.
+    expect(pane.received().batches).toBe(1)
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-context.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-context.ts
index 4b9b46716cb..90c638c23fb 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-context.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-context.ts
@@ -15,6 +15,7 @@ import type {
 } from './structured-agent-session-host-types'
 import type { StructuredAgentSessionHostRuntimeState } from './structured-agent-session-host-runtime-state'
 import type { StructuredAgentSessionTaskQueue } from './structured-agent-session-task-queue'
+import type { StructuredAgentSessionConversationOpenOptions } from './structured-agent-session-conversation-open'
 
 export type StructuredAgentSessionAttachContext = {
   deps: StructuredAgentSessionHostDeps
@@ -38,8 +39,10 @@ export type StructuredAgentSessionAttachContext = {
   reconcileLeases: (sessionId: string) => Promise<AgentSessionWireRefusal | null>
   serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
   now: () => number
-  /** Paired with `sessions.delete` by `forgetStructuredAgentSession`; a failed attach that only
-   *  deleted would leave the store's row behind. */
-  forgetStatus: (sessionId: string) => void
-  publishStatus?: (sessionId: string) => void
+  publishStatus: (sessionId: string) => void
+  /** The conversation's one open journal, opened when closed; see `conversation-open`. */
+  openConversation: (
+    sessionId: string,
+    options?: StructuredAgentSessionConversationOpenOptions
+  ) => Promise<StructuredAgentSessionHostSession | null>
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-failure.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-failure.ts
index 3a77aa2d6cc..16af00e32ea 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-failure.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-failure.ts
@@ -24,8 +24,7 @@ export async function settlePostAcquisitionAttachFailure(
           ? 'root-exit-observed'
           : 'exit-proven'
   }
-  // A failed close must not prevent durable failure settlement.
-  await Promise.resolve(input.onAttachFailed?.()).catch(() => undefined)
+  input.onAcquisitionReleased?.(cause, { rootGone: exitProof !== 'unproven' })
   try {
     await input.store.settleFailedPostAcquisitionAttachment({
       sessionId: record.sessionId,
@@ -36,6 +35,7 @@ export async function settlePostAcquisitionAttachFailure(
       outcome: {
         status: 'failed',
         code: 'agent_session_operation_invalid',
+        details: { reason: 'attachFailed' },
         message: cause instanceof Error ? cause.message : String(cause)
       },
       exitProof,
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-flow.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-flow.ts
index ab9c44949e0..8fdee5c62bd 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-flow.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-flow.ts
@@ -1,7 +1,9 @@
+import { refuse } from '../../../shared/agent-session-wire-refusals'
 import { settlePostAcquisitionAttachFailure } from './structured-agent-session-attach-failure'
 import {
   failedAcquisitionRefusal,
-  failedAcquisitionSettlement
+  failedAcquisitionSettlement,
+  preSpawnFailureInWords
 } from './structured-agent-session-failed-create-refusal'
 import type {
   StructuredAgentSessionAdapter,
@@ -41,6 +43,7 @@ import {
   type AgentSessionCreatePhaseRecorder
 } from '../../observability/agent-session-instrumentation'
 import type { ProviderHistoryWindow } from '../agent-session-journal/journal-submission-reconciler'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 
 export type AttachFlowInput = {
   store: AgentSessionRecordStore
@@ -66,8 +69,14 @@ export type AttachFlowInput = {
   onAcquiring?: () => Promise<void> | void
   /** Settles writes already captured by the superseded journal before opening another. */
   beforeJournalOpen?: () => Promise<void> | void
-  /** Closes and removes partial publication after journal attachment fails. */
-  onAttachFailed?: () => Promise<void>
+  /** The conversation's own open journal, which the attach adopts: it never opens one itself. */
+  openConversation: (record: AgentSessionRecord) => Promise<AgentSessionJournal>
+  /** A failure after acquisition released the session's acquisition; `cause` is that failure and
+   *  `rootGone` whether the release saw the provider root go. */
+  onAcquisitionReleased?: (cause: unknown, verdict: { rootGone: boolean }) => void
+  /** The error an acquisition failed with, for a host-side reader of the provider's words; the
+   *  refusal never carries them. */
+  onAcquisitionFailed?: (error: unknown) => void
 }
 
 export async function performAttach(
@@ -76,10 +85,11 @@ export async function performAttach(
   const { params, store } = input
   const unsupported = (): AgentSessionMutationResult<AgentSessionAttachResult> => ({
     ok: false,
-    refusal: {
-      code: 'structured_agent_session_unsupported',
-      message: 'This execution host cannot create the requested structured agent session.'
-    }
+    refusal: refuse(
+      'structured_agent_session_unsupported',
+      { reason: 'hostUnsupported' },
+      'This execution host cannot create the requested structured agent session.'
+    )
   })
   const sessionId = params.envelope.sessionId
   const admitted = admitAttachOrRefuse(params)
@@ -168,6 +178,10 @@ export async function performAttach(
       acquiredOwner = true
     }
   } catch (error) {
+    const wording = {
+      record: reservedRecord ?? store.getRecord(sessionId),
+      newSession: !params.providerHandle
+    }
     const spawnToken = reservedRecord?.lease.reservedSpawnToken
     if (reservedRecord && spawnToken && !unsupportedReservationSettlementAttempted) {
       // Settle processless proof and failed operation atomically.
@@ -178,7 +192,7 @@ export async function performAttach(
           spawnToken,
           callerKey: input.callerKey,
           operationId: params.envelope.clientOperationId,
-          ...failedAcquisitionSettlement(error),
+          ...failedAcquisitionSettlement(error, wording),
           now: input.now()
         })
       } catch (settlementError) {
@@ -188,11 +202,18 @@ export async function performAttach(
         )
       }
     }
+    input.onAcquisitionFailed?.(error)
+    const failed = failedAcquisitionRefusal(error, wording)
+    const thrown = failed ? error : preSpawnFailureInWords(error, wording)
+    if (failed || thrown !== error) {
+      // The answer carries only its sentence, so what failed is kept here.
+      console.warn('[agent-session] provider start failed:', error)
+    }
     return (
-      failedAcquisitionRefusal(error) ?? {
+      failed ?? {
         ok: false,
         refusal: classifyStoreFailure(
-          error,
+          thrown,
           store.getRecord(sessionId)?.lease.runtimeFence ?? null,
           store.getRecord(sessionId)
         )
@@ -208,6 +229,7 @@ export async function performAttach(
       params,
       journalRoot: input.journalRoot,
       adapter: input.adapter,
+      openConversation: input.openConversation,
       providerHistoryWindow
     })
     await importAdoptedTranscript(params, attached, record, preparedTranscript.items)
@@ -222,6 +244,7 @@ export async function performAttach(
   }
 
   const fence = record.lease.runtimeFence
+  const tabId = store.getSessionTabId(sessionId)
   return {
     ok: true,
     replayed,
@@ -232,7 +255,7 @@ export async function performAttach(
       fence,
       page: readAgentSessionHydrationPage(attached.journal, fence),
       unconfirmedClientMessageIds: attached.unconfirmedClientMessageIds,
-      ...(record.surfaceTabId ? { tabId: record.surfaceTabId } : {})
+      ...(tabId ? { tabId } : {})
     }
   }
 }
@@ -276,6 +299,7 @@ async function settleUnsupportedReservation(
       outcome: {
         status: 'failed',
         code: 'structured_agent_session_unsupported',
+        details: { reason: 'hostUnsupported' },
         message: 'Structured session support changed before the provider could start.'
       },
       exitProof: 'processless',
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts
index 5482826d072..6fc715022aa 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts
@@ -1,5 +1,5 @@
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
 import { recoverStructuredRewind } from './structured-rewind-recovery'
-import { recoverInterruptedCompaction } from './structured-compaction-recovery'
 // The host's attach, lifted out of the host class.
 //
 // Attach is the one operation that touches every collaborator the host owns — the lease
@@ -14,20 +14,26 @@ import type {
   AgentSessionTurnActivity
 } from '../../../shared/agent-session-wire'
 import type { AgentSessionAttachParams } from './structured-agent-session-attach'
-import { performAttach } from './structured-agent-session-attach-flow'
+import { performAttach, type AttachFlowInput } from './structured-agent-session-attach-flow'
 import { stampFailedCreateOwnerVerdict } from './structured-agent-session-failed-create-refusal'
 import {
   pinnedAgentSessionLaunchArgs,
   pinnedAgentSessionLaunchEnv
 } from './structured-agent-session-launch-env'
 import { refuseAgentSessionMutation } from './structured-agent-session-mutation-admission'
-import { isResumableStructuredAgentSessionRecord } from './structured-agent-session-resume-eligibility'
-import { retryPendingStructuredAgentSessionSettlement } from './structured-agent-session-settlement-retry'
-import { settleStaleSessionStateOnAcquire } from './structured-agent-session-stale-turn-verdict'
+import { settleStaleStructuredAgentSessionState } from './structured-agent-session-dead-generation-settlement'
+import { structuredAgentSessionFailureWordsContext } from './structured-agent-session-send-preparation'
 import type { StructuredAgentSessionAttachContext } from './structured-agent-session-attach-context'
-import { forgetStructuredAgentSession } from './structured-agent-session-host-lifetime'
+import type {
+  StructuredAgentSessionProviderChild,
+  StructuredAgentSessionStopVerdict
+} from './structured-agent-session-host-types'
+import {
+  endProviderChild,
+  indexProviderChild,
+  structuredAgentSessionConversationFence
+} from './structured-agent-session-provider-child'
 import type { DeferredStructuredAgentSessionEventSink } from './structured-agent-session-event-sink'
-import { agentSessionJournalCloseRetries } from '../agent-session-journal/journal-close-retry'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import {
   addAgentSessionCreatePhaseAttributes,
@@ -37,17 +43,18 @@ import {
 } from '../../observability/agent-session-instrumentation'
 
 export type StructuredAgentSessionAttachOptions = {
-  /** Provider-exit recovery: refuses once the ticket the restart was issued for is stale. */
-  admitRecoveryTicket?: () => boolean
   recordPhase?: AgentSessionCreatePhaseRecorder
+  onAcquisitionFailed?: AttachFlowInput['onAcquisitionFailed']
+  /** The queued message a start is for; see `StructuredAgentSessionProviderChild.startedFor`. */
+  startedFor?: string
 }
 
 /**
  * The attach itself, for a caller already inside the session's serialize.
  *
- * That is every caller that has to know what the session looks like RIGHT NOW: a hold, a send
- * making sure it has an owner, provider-exit recovery. They run their
- * check and this attach in one serialized step, so "the session has no child" is still true when
+ * That is every caller that has to know what the session looks like RIGHT NOW: the delivery loop,
+ * and an operation that needs the provider. They run their check and this attach in one serialized
+ * step, so "the session has no child" is still true when
  * the attach starts. `attachStructuredAgentSession` is this under `serialize`, for a client.
  */
 export function attachStructuredAgentSessionUnderSerialize(
@@ -96,12 +103,10 @@ async function runAttach(
 ): Promise<AgentSessionMutationResult<AgentSessionAttachResult>> {
   const sessionId = params.envelope.sessionId
   const recordPhase = options.recordPhase
-  if (options.admitRecoveryTicket && !options.admitRecoveryTicket()) {
-    return refuseAgentSessionMutation({
-      code: 'agent_session_checkpoint_stale',
-      message: 'The provider-exit recovery ticket is no longer current.'
-    })
-  }
+  // Readers of a conversation already open are re-baselined when this attach moves its fence.
+  const fenceBefore = context.sessions.has(sessionId)
+    ? structuredAgentSessionConversationFence(context.deps.store, sessionId)
+    : null
   const unreconciled = await withAgentSessionCreatePhase('reconcile_leases', recordPhase, () =>
     context.reconcileLeases(sessionId)
   )
@@ -111,42 +116,23 @@ async function runAttach(
   await withAgentSessionCreatePhase('resolve_recovery', recordPhase, () =>
     context.runtimeState.resolveRecovery(sessionId)
   )
-  // Retries a durable provider-exit journal settlement before a new owner is reserved. Answers
-  // settled when the record has none pending, so every attach can ask unconditionally.
-  const settled = await withAgentSessionCreatePhase('settlement_retry', recordPhase, () =>
-    retryPendingStructuredAgentSessionSettlement({
-      deps: context.deps,
-      sessions: context.sessions,
-      sessionId,
-      params,
-      now: () => context.now()
-    })
-  )
-  if (!settled) {
-    return refuseAgentSessionMutation({
-      code: 'agent_session_ownership_unknown',
-      message: 'The provider-exit terminal journal settlement is still pending; retry attach.'
-    })
-  }
   const probe = await withAgentSessionCreatePhase('probe_owner', recordPhase, () =>
     context.runtimeState.probeOwner(sessionId)
   )
   // A child this attach spawns writes through a sink this attempt owns. Only a successful
-  // attach makes it the session's; any other exit closes it with whatever the child queued.
+  // attach makes the child and its sink the session's; any other exit closes the sink with
+  // whatever the child queued, and leaves the conversation's child as it was.
   const attemptSink = context.runtimeState.mintEventSink(sessionId)
-  let attemptSinkAdopted = false
-  // A lease handed back cleanly is what a resume replaces. A writer current as of that owner is
-  // rebased onto the fence this attach publishes, since the restart is the only thing that moved it.
-  const released = context.deps.store.getRecord(sessionId)
-  const resumedFromFence =
-    released && isResumableStructuredAgentSessionRecord(released)
-      ? released.lease.runtimeFence
-      : undefined
-  const attached = stampFailedCreateOwnerVerdict(
-    context.deps.store,
-    callerKey,
-    params.envelope,
-    await performAttach({
+  // Read before the reserve clears it: how the previous generation ended decides how whatever it
+  // left running is settled.
+  const priorRecord = context.deps.store.getRecord(sessionId)
+  const priorDeathEvidence = priorRecord?.lease.deathEvidence ?? null
+  const attempt: { candidate: AttachCandidate | null; committed: boolean } = {
+    candidate: null,
+    committed: false
+  }
+  try {
+    const attached = await performAttach({
       store: context.deps.store,
       adapter: context.deps.adapter,
       journalRoot: context.deps.journalRoot,
@@ -170,66 +156,51 @@ async function runAttach(
       params,
       now: () => context.now(),
       recordPhase,
-      // Site 9: this closes the PRIOR map entry it drops, never the provisional
-      // journal — it has no reference to that one. `onAttached` owns that.
-      onAttachFailed: async () => {
-        await forgetStructuredAgentSession(context, sessionId)
-        context.runtimeState.currentEventSink(sessionId)?.close()
-        context.runtimeState.discardEventSink(sessionId)
+      ...(options.onAcquisitionFailed ? { onAcquisitionFailed: options.onAcquisitionFailed } : {}),
+      openConversation: async (record) => {
+        const conversation = await context.openConversation(record.sessionId, {
+          acquisition: true
+        })
+        if (!conversation) {
+          throw new Error('agent_session_identity_required')
+        }
+        return conversation.journal
       },
+      // The cleanup released the acquisition, which for a re-attach is the live child itself.
+      onAcquisitionReleased: (cause, verdict) =>
+        endReleasedChild(context, sessionId, cause, verdict),
       onAttached: async (attached, acquisitionGeneration, acquiredOwner, providerChildPhase) => {
-        const fence = context.deps.store.getRecord(sessionId)?.lease.runtimeFence ?? 0
-        const previous = context.sessions.get(sessionId)
-        const previousFence = previous?.fence
+        const fence = structuredAgentSessionConversationFence(context.deps.store, sessionId)
+        const current = context.sessions.get(sessionId)?.child ?? null
+        const startedFor = acquiredOwner ? options.startedFor : current?.startedFor
         // A re-attach to a live child keeps the sink that child already writes through.
         const eventSink = acquiredOwner
           ? attemptSink
           : (context.runtimeState.currentEventSink(sessionId) ?? attemptSink)
-        // Site 8: the provisional journal has no owner until the map takes it,
-        // and the barrier below throws by design.
-        try {
-          if (acquiredOwner) {
-            // Before the drain: the buffered events are the new child's, never a stale row's.
-            await settleStaleSessionStateOnAcquire({
-              journal: attached.journal,
-              sessionId,
-              fence,
-              acquisitionGeneration
-            })
-          }
-          await bindAndDrain(eventSink, attached.journal, fence, (activity) =>
-            context.subscribers.publish(sessionId, attached.journal, activity)
-          )
-        } catch (error) {
-          await agentSessionJournalCloseRetries.closeOrRetain(attached.journal)
-          throw error
+        if (acquiredOwner) {
+          // Before the drain: the buffered events are the new child's, never a stale row's.
+          await settleStaleStructuredAgentSessionState({
+            journal: attached.journal,
+            sessionId,
+            fence,
+            acquisitionGeneration,
+            deathEvidence: priorDeathEvidence,
+            failureTextContext: structuredAgentSessionFailureWordsContext(priorRecord)
+          })
         }
-        // Site 10: a `set` over a live entry would orphan its handle — and a
-        // close that REJECTED did not release it. The replacement is therefore
-        // ABORTED rather than completed over a handle nothing can reach again:
-        // `previous` stays indexed, so teardown still owns it and can retry.
-        if (previous && previous.journal !== attached.journal) {
-          try {
-            await previous.journal.close()
-          } catch (error) {
-            await agentSessionJournalCloseRetries.closeOrRetain(attached.journal)
-            throw error
+        await bindAndDrain(eventSink, attached.journal, fence, (activity) =>
+          context.subscribers.publish(sessionId, attached.journal, activity)
+        )
+        attempt.candidate = {
+          sink: eventSink,
+          child: {
+            generation: acquisitionGeneration ?? current?.generation ?? null,
+            fence,
+            // A re-attach to a live child keeps what that child already proved, and its cause.
+            phase: acquiredOwner ? providerChildPhase : (current?.phase ?? 'ready'),
+            ...(startedFor === undefined ? {} : { startedFor })
           }
         }
-        context.runtimeState.adoptEventSink(sessionId, eventSink)
-        attemptSinkAdopted = eventSink === attemptSink
-        context.sessions.set(sessionId, {
-          journal: attached.journal,
-          params,
-          fence,
-          hasProviderChild: true,
-          // A re-attach to a live child keeps what that child already proved.
-          providerChildPhase: acquiredOwner
-            ? providerChildPhase
-            : (previous?.providerChildPhase ?? 'ready'),
-          acquisitionGeneration: acquisitionGeneration ?? previous?.acquisitionGeneration ?? null,
-          resumedFromFence: acquiredOwner ? resumedFromFence : previous?.resumedFromFence
-        })
         await recoverStructuredRewind(
           context.deps.store,
           sessionId,
@@ -238,22 +209,61 @@ async function runAttach(
           context.deps.adapter,
           context.now
         )
-        await recoverInterruptedCompaction(context.deps.store, sessionId, attached.journal, fence)
-        if (attached.recovery) {
-          context.subscribers.reset(sessionId, attached.journal, attached.recovery.reset, fence)
-        } else if (previousFence !== undefined && previousFence !== fence) {
+        if (fenceBefore !== null && fence !== fenceBefore) {
           context.subscribers.snapshot(sessionId, attached.journal, fence)
         } else {
           context.subscribers.publish(sessionId, attached.journal)
         }
       }
-    }).finally(() => {
-      if (!attemptSinkAdopted) {
-        attemptSink.close()
-      }
     })
-  )
-  return attached
+    const { candidate } = attempt
+    const conversation = context.sessions.get(sessionId)
+    if (attached.ok && candidate && conversation) {
+      context.runtimeState.adoptEventSink(sessionId, candidate.sink)
+      attempt.committed = candidate.sink === attemptSink
+      indexProviderChild(conversation, candidate.child)
+      context.publishStatus?.(sessionId)
+    }
+    return stampFailedCreateOwnerVerdict(context.deps.store, callerKey, params.envelope, attached)
+  } finally {
+    if (!attempt.committed) {
+      attemptSink.close()
+    }
+  }
+}
+
+type AttachCandidate = {
+  child: StructuredAgentSessionProviderChild
+  sink: DeferredStructuredAgentSessionEventSink
+}
+
+function endReleasedChild(
+  context: StructuredAgentSessionAttachContext,
+  sessionId: string,
+  cause: unknown,
+  verdict: StructuredAgentSessionStopVerdict
+): void {
+  const session = context.sessions.get(sessionId)
+  const child = session?.child
+  if (
+    !session ||
+    !child ||
+    !endProviderChild(session, {
+      generation: child.generation,
+      fence: child.fence,
+      cause: 'attach-failed',
+      reason: cause instanceof Error ? cause.message : String(cause),
+      // Orca failed to attach; the provider said nothing.
+      failure: agentSessionFailureFact('hostFault'),
+      duringStartup: child.phase === 'starting',
+      ...verdict
+    })
+  ) {
+    return
+  }
+  context.runtimeState.currentEventSink(sessionId)?.close()
+  context.runtimeState.discardEventSink(sessionId)
+  context.publishStatus?.(sessionId)
 }
 
 /** Binds the sink to the journal and waits for the barrier the host publishes
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-reconciliation.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-reconciliation.test.ts
index 97f429933d8..36f6ebc79e8 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-reconciliation.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-reconciliation.test.ts
@@ -8,11 +8,13 @@ import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { agentSessionRecordFixture } from '../../../shared/agent-session-record.test-fixture'
 import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
+import { projectStructuredAgentSessionStatusState } from '../../../shared/structured-agent-session-projection'
 import { digestPayload } from '../agent-session-journal/journal-payload-bounds'
 import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
 import type { ProviderHistoryWindow } from '../agent-session-journal/journal-submission-reconciler'
 import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { openTestAttachConversation } from './structured-agent-session-attach-test-conversation'
 import {
   attachJournal,
   journalIdentityFor,
@@ -85,6 +87,7 @@ async function attach(adapter: StructuredAgentSessionAdapter) {
     record: RECORD,
     params: PARAMS,
     journalRoot: root,
+    openConversation: openTestAttachConversation(root),
     adapter
   })
   journals.track(attached.journal)
@@ -110,11 +113,24 @@ describe('attachJournal restart reconciliation', () => {
     expect(attached.unconfirmedClientMessageIds).toEqual([])
     const submission = attached.journal.submissions()[0]
     expect(submission?.dispatchState).toBe('rejected')
-    expect(submission?.reason).toBe('not_delivered')
+    expect(submission?.rejection).toEqual({ kind: 'notDelivered' })
     // Deciding is not sending: nothing here puts the message back on the wire.
     expect(dispatch).not.toHaveBeenCalled()
   })
 
+  it('gives a send the provider never received no verdict and no listing', async () => {
+    await crashedJournal()
+    const { adapter } = adapterWith(async () => window())
+
+    const attached = await attach(adapter)
+
+    // Nobody failed: the crash stranded it, so the chat must not read Failed or be listed by it.
+    const { items, submissions } = attached.journal.snapshot()
+    expect(
+      projectStructuredAgentSessionStatusState(items, submissions, RECORD.lease.runtimeFence)
+    ).toMatchObject({ summary: { status: null }, latestRequest: null })
+  })
+
   it('still reports a submission unconfirmed when the window cannot decide it', async () => {
     await crashedJournal()
     const { adapter, dispatch } = adapterWith(async () => window({ turnInFlight: true }))
@@ -147,4 +163,37 @@ describe('attachJournal restart reconciliation', () => {
     expect(attached.unconfirmedClientMessageIds).toEqual(['cm_1'])
     expect(attached.journal.submissions()[0]?.dispatchState).toBe('unknown')
   })
+
+  it('leaves a message the open conversation still has queued alone (W4′e)', async () => {
+    const journal = await journals.open({
+      identity: IDENTITY,
+      journalDir: journalDirectoryFor(root, {
+        workspaceId: IDENTITY.workspaceId,
+        sessionId: IDENTITY.sessionId
+      })
+    })
+    await journal.appendSubmission({
+      clientMessageId: 'queued',
+      payloadFingerprint: digestPayload('still queued'),
+      body: userMessage('still queued'),
+      fence: RECORD.lease.runtimeFence,
+      handoverRecorded: true
+    })
+    // History that holds nothing: absence would prove a handed-over message undelivered.
+    const { adapter, dispatch } = adapterWith(async () => window())
+
+    const attached = await attachJournal({
+      record: RECORD,
+      params: PARAMS,
+      journalRoot: root,
+
+      adapter,
+      openConversation: async () => journal
+    })
+
+    expect(attached.journal).toBe(journal)
+    expect(journal.submissions()[0]).toMatchObject({ dispatchState: 'pending' })
+    expect(journal.submissions()[0]?.handedOverAt).toBeUndefined()
+    expect(dispatch).not.toHaveBeenCalled()
+  })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-test-conversation.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-test-conversation.ts
new file mode 100644
index 00000000000..1e2322cbc6d
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-test-conversation.ts
@@ -0,0 +1,18 @@
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { openStructuredAgentSessionConversationJournal } from './structured-agent-session-conversation-open'
+
+/** For a test that attaches without a host: the conversation's journal, through the one open a
+ *  host would take, so the attach under test adopts it the way it adopts the host's. */
+export function openTestAttachConversation(
+  journalRoot: string,
+  adapter: Pick<StructuredAgentSessionAdapter, 'historyFilePath'> = {}
+): (record: AgentSessionRecord) => Promise<AgentSessionJournal> {
+  return async (record) =>
+    (
+      await openStructuredAgentSessionConversationJournal({ journalRoot, adapter }, record, {
+        acquisition: true
+      })
+    ).session.journal
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach.ts
index 2e42ffe9893..10c4866cea3 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-attach.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach.ts
@@ -23,12 +23,15 @@ import type {
   AgentSessionLaunchEnv,
   AgentSessionRecord
 } from '../../../shared/agent-session-record'
-import { structuredAgentSessionTabId } from '../../../shared/structured-agent-session-projection'
 import {
-  AGENT_SESSION_WIRE_REFUSAL_CODES,
+  AgentSessionRefusalError,
+  agentSessionRefusalFromReference,
+  agentSessionRefusalReference,
+  isAgentSessionWireRefusalCode,
+  refuse,
   type AgentSessionMutationEnvelope,
-  type AgentSessionWireRefusal,
-  type AgentSessionWireRefusalCode
+  type AgentSessionRefusalReference,
+  type AgentSessionWireRefusal
 } from '../../../shared/agent-session-wire'
 import {
   agentSessionFingerprintConflict,
@@ -36,15 +39,9 @@ import {
 } from '../../../shared/agent-session-mutation-envelope'
 import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import { agentSessionProviderHandleChainHead } from '../../../shared/agent-session-provider-handle'
-import { agentSessionJournalCloseRetries } from '../agent-session-journal/journal-close-retry'
-import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import { reconcileJournalSubmissionsAgainstHistory } from '../agent-session-journal/journal-restart-reconciliation'
 import type { ProviderHistoryWindow } from '../agent-session-journal/journal-submission-reconciler'
-import {
-  openAgentSessionJournalWithRecovery,
-  type AgentSessionJournalRecovery
-} from './agent-session-journal-recovery'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { structuredAgentSessionRefusalMessage } from './structured-agent-session-refusal-message'
 
@@ -64,8 +61,8 @@ export type AgentSessionAttachParams = {
   runtimeKind: 'native'
   /** Host-resolved defaults for a create-by-intent; remote attach schemas do not accept them. */
   options?: Readonly<Record<string, string>>
-  /** The tab id a create reserves for this chat; absent records the id clients derive. Never on
-   *  the attach fingerprint: which tab shows the chat is not which conversation it attaches to. */
+  /** The tab id a create reserves for this chat, taken when its tab is published. Never on the
+   *  attach fingerprint: which tab shows the chat is not which conversation it attaches to. */
   surfaceTabId?: string
   launchArgs?: string[]
   /** Omitted only for create-by-intent; the adapter proves the durable handle. */
@@ -125,10 +122,11 @@ export function admitAttachOrRefuse(
   if (params.providerHandle && params.providerHandle.kind !== params.provider) {
     return {
       ok: false,
-      refusal: {
-        code: 'agent_session_operation_invalid',
-        message: `A ${params.provider} session requires a ${params.provider} provider handle.`
-      }
+      refusal: refuse(
+        'agent_session_operation_invalid',
+        { reason: 'requestMalformed' },
+        `A ${params.provider} session requires a ${params.provider} provider handle.`
+      )
     }
   }
   const fingerprint = computeAgentSessionPayloadFingerprint({
@@ -166,16 +164,13 @@ export function journalIdentityFor(
 
 export type AttachedJournal = {
   journal: AgentSessionJournal
-  recovery: AgentSessionJournalRecovery | null
-  /** Submissions still `unknown` after this open: the crash boundary settled
-   *  them there and provider history could not decide them either. */
+  /** Submissions the crash boundary left `unknown` that provider history could not decide. */
   unconfirmedClientMessageIds: string[]
 }
 
 /**
- * Open the session's journal, recovering it when the stored one is unusable,
- * settle every submission left in flight by a previous process, then let
- * provider history decide the ones it can prove.
+ * The conversation's journal — opened, and its crash boundary settled, by the conversation's own
+ * open — with provider history deciding the submissions that boundary could only doubt.
  *
  * Why the reconciliation belongs HERE and nowhere else: this runs after the
  * record store handed this host the lease and before `onAttached` starts a
@@ -183,54 +178,44 @@ export type AttachedJournal = {
  * is read, and the window stays valid until the resume consumes it. Every other
  * settlement site — a proven child exit — runs while the host
  * may still start another child, and a read there could be overtaken before it
- * is acted on. Orca still never re-sends: this decides state only.
+ * is acted on. Orca still never re-sends: this decides state only. A queued
+ * submission is left alone: it was never handed over, so history cannot hold it.
  */
 export async function attachJournal(input: {
   record: AgentSessionRecord
   params: AgentSessionAttachParams
   journalRoot: string
   adapter: StructuredAgentSessionAdapter
+  /** The host's open conversation, whose journal the attach adopts. */
+  openConversation: (record: AgentSessionRecord) => Promise<AgentSessionJournal>
   /** Provider history sampled before a new child is acquired. `null` means the
    *  adapter had no usable history; omit to read lazily for direct callers. */
   providerHistoryWindow?: ProviderHistoryWindow | null
 }): Promise<AttachedJournal> {
   const identity = journalIdentityFor(input.record, input.params)
   const fence = input.record.lease.runtimeFence
-  const historyFilePath = input.adapter.historyFilePath
-    ? await input.adapter.historyFilePath({ identity })
-    : null
-  const opened = await openAgentSessionJournalWithRecovery({
+  const journal = await input.openConversation(input.record)
+  const settled = await reconcileAgainstProviderHistory({
+    adapter: input.adapter,
     identity,
-    journalDir: journalDirectoryFor(input.journalRoot, {
-      workspaceId: identity.workspaceId,
-      sessionId: identity.sessionId
-    }),
+    journal,
     fence,
-    historyFilePath
+    accountHome: input.record.accountHome,
+    ...(Object.hasOwn(input, 'providerHistoryWindow')
+      ? { history: input.providerHistoryWindow }
+      : {})
   })
-  try {
-    // That await is a WRITE. A failure in it leaves the journal with no caller
-    // holding a reference to close it.
-    const unconfirmed = await opened.journal.markPendingSubmissionsUnknown(fence)
-    const settled = await reconcileAgainstProviderHistory({
-      adapter: input.adapter,
-      identity,
-      journal: opened.journal,
-      fence,
-      accountHome: input.record.accountHome,
-      ...(Object.hasOwn(input, 'providerHistoryWindow')
-        ? { history: input.providerHistoryWindow }
-        : {})
-    })
-    return {
-      ...opened,
-      unconfirmedClientMessageIds: unconfirmed.filter((id) => !settled.includes(id))
-    }
-  } catch (error) {
-    // A rejected close leaves the handle open, so the journal is retained for a
-    // later retry rather than dropped along with the only reference to it.
-    await agentSessionJournalCloseRetries.closeOrRetain(opened.journal)
-    throw error
+  return {
+    journal,
+    unconfirmedClientMessageIds: journal
+      .submissions()
+      .filter(
+        (entry) =>
+          entry.dispatchState === 'unknown' &&
+          entry.recovered === true &&
+          !settled.includes(entry.clientMessageId)
+      )
+      .map((entry) => entry.clientMessageId)
   }
 }
 
@@ -317,10 +302,8 @@ export function reserveRequestFor(input: {
     provider: params.provider,
     accountHome: params.accountHome,
     ...(params.options ? { options: params.options } : {}),
-    // Create path only: an existing record keeps its own. Unreserved, it is the id every client
-    // still derives, so nothing keyed by it moves until those readers copy the recorded one.
-    ...(params.envelope.expectedRuntimeFence === null
-      ? { surfaceTabId: params.surfaceTabId ?? structuredAgentSessionTabId(input.sessionId) }
+    ...(params.envelope.expectedRuntimeFence === null && params.surfaceTabId
+      ? { surfaceTabId: params.surfaceTabId }
       : {}),
     ...(authority.launchArgs ? { launchArgs: authority.launchArgs } : {}),
     ...(authority.launchEnv ? { launchEnv: authority.launchEnv } : {}),
@@ -353,16 +336,21 @@ export function classifyStoreFailure(
   record: AgentSessionRecord | null = null
 ): AgentSessionWireRefusal {
   const rawCode = error instanceof Error ? error.message : String(error)
-  if (!(AGENT_SESSION_WIRE_REFUSAL_CODES as readonly string[]).includes(rawCode)) {
+  if (!isAgentSessionWireRefusalCode(rawCode)) {
     throw error
   }
-  const code = rawCode as AgentSessionWireRefusalCode
-  return {
-    code,
-    // Why: a latched session is exactly where a bare store code strands the user.
-    message:
-      structuredAgentSessionRefusalMessage(code, record) ??
-      `The session store refused this call: ${code}.`,
-    ...(code === 'agent_session_checkpoint_stale' && currentFence !== null ? { currentFence } : {})
-  }
+  // A refusal error's message is its code, so its details are this code's.
+  const emitted: AgentSessionRefusalReference =
+    error instanceof AgentSessionRefusalError
+      ? agentSessionRefusalReference(error.refusal)
+      : { code: rawCode }
+  // Why: a latched session is exactly where a bare store code strands the user.
+  const told = structuredAgentSessionRefusalMessage(emitted, record)
+  const reference = told?.reference ?? emitted
+  return agentSessionRefusalFromReference(
+    reference.code === 'agent_session_checkpoint_stale' && currentFence !== null
+      ? { code: reference.code, details: { ...reference.details, currentFence } }
+      : reference,
+    told?.message ?? `The session store refused this call: ${rawCode}.`
+  )
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-background-task-channel.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-background-task-channel.ts
index 5d922d72350..08ee51f49f7 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-background-task-channel.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-background-task-channel.ts
@@ -4,6 +4,7 @@ import type {
   AgentSessionHistoryResult
 } from '../../../shared/agent-session-wire'
 import { readStructuredAgentSessionHistoryResult } from './structured-agent-session-history-result'
+import { tryReadQueuePublication } from './structured-agent-session-queued-publication'
 import type {
   AgentSessionSubscribers,
   AgentSessionSubscribeInput
@@ -12,43 +13,55 @@ import type {
   StructuredAgentSessionHostDeps,
   StructuredAgentSessionHostSession
 } from './structured-agent-session-host-types'
+import { structuredAgentSessionConversationFence } from './structured-agent-session-provider-child'
 
 export class StructuredAgentSessionBackgroundTaskChannel {
   constructor(
     private readonly deps: StructuredAgentSessionHostDeps,
     private readonly sessions: Map<string, StructuredAgentSessionHostSession>,
     private readonly subscribers: AgentSessionSubscribers,
-    private readonly requireSession: (sessionId: string) => StructuredAgentSessionHostSession,
+    /** The host's accessor: opens a conversation at rest, and never starts an agent. */
+    private readonly conversation: (
+      sessionId: string
+    ) => Promise<StructuredAgentSessionHostSession>,
     /** Task edges change the status summary too; the feed's equality check
      *  keeps a no-op re-projection from reaching subscribers. */
     private readonly onPublished: (sessionId: string) => void
   ) {}
 
-  history(request: AgentSessionHistoryRequest): AgentSessionHistoryResult {
+  async history(request: AgentSessionHistoryRequest): Promise<AgentSessionHistoryResult> {
+    const journal = (await this.conversation(request.sessionId)).journal
     const result = readStructuredAgentSessionHistoryResult({
-      journal: this.requireSession(request.sessionId).journal,
+      journal,
       record: this.deps.store.getRecord(request.sessionId),
       request
     })
     const backgroundTasks = this.state(request.sessionId)
+    const queue = tryReadQueuePublication(journal)
     const hostNow = this.deps.now?.() ?? Date.now()
     return {
       ...result,
       page: {
         ...result.page,
         hostNow,
+        // A stale history answer never replaces newer live subscription state;
+        // the client's reducer keeps live-over-history precedence.
+        ...(queue !== undefined
+          ? { queuedMessages: queue.queuedMessages, queuePause: queue.queuePause }
+          : {}),
         ...(backgroundTasks !== undefined ? { backgroundTasks } : {})
       }
     }
   }
 
-  subscribe(input: AgentSessionSubscribeInput): () => void {
-    const session = this.requireSession(input.sessionId)
+  /** Resolves once the conversation is open and the subscriber holds its opening frame. */
+  async subscribe(input: AgentSessionSubscribeInput): Promise<() => void> {
+    const session = await this.conversation(input.sessionId)
     const backgroundTasks = this.state(input.sessionId)
     return this.subscribers.open({
       ...input,
       journal: session.journal,
-      fence: this.deps.store.getRecord(input.sessionId)?.lease.runtimeFence ?? 0,
+      fence: structuredAgentSessionConversationFence(this.deps.store, input.sessionId),
       ...(backgroundTasks !== undefined ? { backgroundTasks } : {})
     })
   }
@@ -57,7 +70,11 @@ export class StructuredAgentSessionBackgroundTaskChannel {
     const session = this.sessions.get(sessionId)
     const state = publishedState !== undefined ? publishedState : this.state(sessionId)
     if (session && state !== undefined) {
-      this.subscribers.backgroundTasks(sessionId, state, session.fence)
+      this.subscribers.backgroundTasks(
+        sessionId,
+        state,
+        structuredAgentSessionConversationFence(this.deps.store, sessionId)
+      )
       this.onPublished(sessionId)
     }
   }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-claude-compact-stop.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-claude-compact-stop.test.ts
new file mode 100644
index 00000000000..61e3f7ef3ad
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-claude-compact-stop.test.ts
@@ -0,0 +1,291 @@
+// Stop and `/compact` on the shipping Claude adapter, driven by the frames a stream-json child
+// writes: which result ends the command, and what the next message is handed to.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
+import { ClaudeControlRequestError } from '../../claude/claude-agent-sdk-control-requests'
+import { ClaudeStructuredSessionAdapter } from '../../claude/claude-structured-session-adapter'
+import {
+  fakeClaude,
+  PROVIDER_SESSION_ID,
+  type FakeConnection
+} from '../../claude/claude-structured-session-test-support'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { structuredClaudeLifecycleEvent } from '../../runtime/structured-claude-runtime-adapter'
+import { structuredAgentSessionCommandTurn } from './structured-agent-session-command-turn'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+const CALLER = { callerKey: 'client-1' }
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let adapter: ClaudeStructuredSessionAdapter
+let claude: ReturnType<typeof fakeClaude>
+/** The adapter's clock, which a real child's exit reads at a different instant than the host's. */
+let adapterNow = NOW
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-claude-compact-stop-'))
+  resetHostTestOperationIds()
+  adapterNow = NOW + 7
+  // No echo of its own: each test writes the frames Claude would.
+  claude = fakeClaude({ replayUuid: null })
+  adapter = new ClaudeStructuredSessionAdapter({
+    resolveLaunch: async () => ({
+      pathToClaudeCodeExecutable: 'claude',
+      options: {},
+      cwd: root,
+      claudeConfigDir: join(root, 'claude-home'),
+      providerSessionId: PROVIDER_SESSION_ID,
+      resumeLeafUuid: null,
+      resumesTranscript: (store.getRecord(SESSION)?.providerHandleChain.length ?? 0) > 0,
+      continuesChain: (store.getRecord(SESSION)?.providerHandleChain.length ?? 0) > 0
+    }),
+    onEvent: (event) => {
+      const mapped = structuredClaudeLifecycleEvent(event)
+      if (mapped) {
+        void host.handleAdapterEvent(mapped)
+      }
+    },
+    // The runtime's own wiring: the provider's answer is what settles a send it took.
+    onDispatchSettledLate: (settlement) => void host.settleLateDispatch(settlement),
+    openConnection: claude.openConnection,
+    readProcessStartTime: async () => 1_700_000_000_000,
+    now: () => adapterNow
+  })
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  host = new StructuredAgentSessionHost({
+    store,
+    // The production router is what declares create support; the bare adapter only knows locations.
+    adapter: Object.assign(adapter, { supportsCreate: () => true }),
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-a',
+    now: () => NOW
+  })
+  const attached = await host.attach(
+    CALLER,
+    hostTestAttachParams(null, {
+      provider: 'claude',
+      agent: 'claude',
+      accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: join(root, 'claude-home') },
+      providerHandle: { kind: 'claude', sessionId: PROVIDER_SESSION_ID, leafUuid: null }
+    })
+  )
+  expect(attached).toMatchObject({ ok: true })
+  await adapter.awaitStarted(SESSION)
+})
+
+afterEach(async () => {
+  await adapter.closeAll()
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+function envelope(method: string, fields: Record<string, unknown>) {
+  return {
+    sessionId: SESSION,
+    clientOperationId: hostTestOperationId(),
+    expectedRuntimeFence: store.getRecord(SESSION)?.lease.runtimeFence ?? 1,
+    payloadFingerprint: computeAgentSessionPayloadFingerprint({
+      method,
+      sessionId: SESSION,
+      fields
+    })
+  }
+}
+
+async function compact(): Promise<string> {
+  const params = {
+    command: 'compact' as const,
+    envelope: envelope('agentSession.conversationCommand', { command: 'compact' })
+  }
+  await expect(host.conversationCommand(CALLER, params)).resolves.toMatchObject({ ok: true })
+  return params.envelope.clientOperationId
+}
+
+function stop(cmid: string) {
+  const { turnId } = structuredAgentSessionCommandTurn(cmid)
+  return host.cancel(CALLER, { envelope: envelope('agentSession.cancel', { turnId }), turnId })
+}
+
+/** The uuid of the frame that carried `text` to Claude, and the child it went to. */
+async function sent(text: string): Promise<{ connection: FakeConnection; uuid: string }> {
+  return vi.waitFor(() => {
+    for (const connection of claude.connections) {
+      const frame = connection.sent.find((message) => JSON.stringify(message).includes(text))
+      if (frame) {
+        return { connection, uuid: String(frame.uuid) }
+      }
+    }
+    throw new Error(`nothing sent ${text}`)
+  })
+}
+
+function frame(connection: FakeConnection, message: Record<string, unknown>): void {
+  connection.handlers.onMessage?.({ session_id: PROVIDER_SESSION_ID, ...message })
+}
+
+function result(uuid: string, overrides: Record<string, unknown> = {}): Record<string, unknown> {
+  return {
+    type: 'result',
+    subtype: 'success',
+    is_error: false,
+    uuid: `result-${uuid}`,
+    user_message_uuid: uuid,
+    ...overrides
+  }
+}
+
+const INTERRUPTED = {
+  subtype: 'error_during_execution',
+  is_error: true,
+  terminal_reason: 'aborted_streaming'
+}
+
+async function commandState(cmid: string) {
+  await host.flushStreamedEvents(SESSION)
+  const { itemId } = structuredAgentSessionCommandTurn(cmid)
+  const snapshot = await host.journalSnapshot(SESSION)
+  return readAgentJournalTurn(snapshot.items.find((item) => item.itemId === itemId)?.body)
+}
+
+it('ends a hung /compact Claude will not interrupt by stopping it, and answers the next send in its own turn', async () => {
+  claude.routes.interrupt = () => {
+    throw new ClaudeControlRequestError('interrupt', 'Claude did not answer the interrupt.')
+  }
+  const cmid = await compact()
+  const { connection: compacting } = await sent('/compact')
+
+  await expect(stop(cmid)).resolves.toMatchObject({ ok: true, value: { cancelled: true } })
+  await vi.waitFor(async () => expect((await commandState(cmid))?.state).toBe('interrupted'))
+
+  const body = hostTestMessage('what next?')
+  await host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
+  const { connection, uuid } = await sent('what next?')
+  expect(compacting.closed).toBe(true)
+  expect(connection).not.toBe(compacting)
+  frame(connection, {
+    type: 'user',
+    uuid,
+    parent_tool_use_id: null,
+    message: { role: 'user', content: [{ type: 'text', text: 'what next?' }] }
+  })
+  frame(connection, {
+    type: 'assistant',
+    uuid: 'answer',
+    parent_tool_use_id: null,
+    message: { id: 'msg-1', role: 'assistant', content: [{ type: 'text', text: 'Here is.' }] }
+  })
+  frame(connection, result(uuid))
+
+  await vi.waitFor(async () => {
+    await host.flushStreamedEvents(SESSION)
+    const snapshot = await host.journalSnapshot(SESSION)
+    const answer = snapshot.items.find(
+      (item) => item.body.kind === 'message' && item.body.role === 'assistant'
+    )
+    expect(answer?.turnScope).toMatchObject({ kind: 'turn' })
+    expect(answer?.turnScope).not.toEqual({
+      kind: 'turn',
+      turnItemId: structuredAgentSessionCommandTurn(cmid).itemId
+    })
+  })
+})
+
+it('ends a stopped /compact on its own interrupted result, and a late copy of that result does not end the next one', async () => {
+  claude.routes.interrupt = () => ({})
+  const first = await compact()
+  const { connection, uuid: firstUuid } = await sent('/compact')
+
+  await expect(stop(first)).resolves.toMatchObject({ ok: true, value: { cancelled: true } })
+  // The interrupt was taken: the command runs until Claude answers it.
+  expect((await commandState(first))?.state).toBe('running')
+  frame(connection, result(firstUuid, INTERRUPTED))
+  await vi.waitFor(async () =>
+    expect(await commandState(first)).toMatchObject({
+      state: 'interrupted',
+      outcome: 'cancellation'
+    })
+  )
+
+  const second = await compact()
+  await vi.waitFor(() =>
+    expect(
+      connection.sent.filter((message) => JSON.stringify(message).includes('/compact'))
+    ).toHaveLength(2)
+  )
+  const secondUuid = String(connection.sent.at(-1)?.uuid)
+  frame(connection, result(firstUuid, INTERRUPTED))
+  frame(
+    connection,
+    result('an-earlier-send', { subtype: 'error_during_execution', is_error: true })
+  )
+  expect((await commandState(second))?.state).toBe('running')
+
+  frame(connection, { type: 'system', subtype: 'compact_boundary', uuid: 'boundary' })
+  frame(connection, result(secondUuid))
+  await vi.waitFor(async () =>
+    expect(await commandState(second)).toMatchObject({ state: 'completed', outcome: 'success' })
+  )
+})
+
+it('settles a /compact whose Claude child exits mid-command through that child, and delivers what waited', async () => {
+  const cmid = await compact()
+  const { connection: compacting } = await sent('/compact')
+  const body = hostTestMessage('after the exit')
+  await host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
+
+  // Claude sends no end frame at all: its child is gone.
+  compacting.handlers.onExit?.(new Error('claude stream-json exited (code 1): crashed'))
+
+  await vi.waitFor(async () => expect((await commandState(cmid))?.state).toBe('interrupted'))
+  const { connection } = await sent('after the exit')
+  expect(connection).not.toBe(compacting)
+})
+
+it('tells why a /compact ended when its Claude child exits after taking it', async () => {
+  const cmid = await compact()
+  const { connection, uuid } = await sent('/compact')
+  // Claude echoes the command, so the send is answered; then the child dies with no end frame.
+  frame(connection, {
+    type: 'user',
+    uuid,
+    parent_tool_use_id: null,
+    message: { role: 'user', content: [{ type: 'text', text: '/compact' }] }
+  })
+  await host.flushStreamedEvents(SESSION)
+  adapterNow = NOW + 7
+  connection.handlers.onExit?.(new Error('claude stream-json exited (code 1)'))
+
+  await vi.waitFor(async () => expect((await commandState(cmid))?.state).toBe('interrupted'))
+  await vi.waitFor(async () => {
+    await host.flushStreamedEvents(SESSION)
+    const snapshot = await host.journalSnapshot(SESSION)
+    // The exit's words are the host's sentence, never Claude's log text.
+    const exitRow = snapshot.items.find(
+      (item) => item.body.kind === 'status' && item.body.failure?.kind === 'providerExited'
+    )
+    expect(exitRow?.body).toMatchObject({
+      text: 'Claude stopped while this response was in progress. You can continue in this conversation.',
+      tone: 'error'
+    })
+    expect(exitRow?.turnScope).toEqual({
+      kind: 'turn',
+      turnItemId: structuredAgentSessionCommandTurn(cmid).itemId
+    })
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-claude-echo-working.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-claude-echo-working.test.ts
new file mode 100644
index 00000000000..0fe20620160
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-claude-echo-working.test.ts
@@ -0,0 +1,146 @@
+// Claude's echo of a sent message both answers the send and opens its turn. Whatever order the
+// host publishes those in, a chat reading its frames one at a time must read working throughout:
+// Stop and every session list's Working come from that one rule.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, expect, it } from 'vitest'
+import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import { isStructuredAgentSessionMainAgentWorking } from '../../../shared/structured-agent-session-main-agent-working'
+import { ClaudeStructuredSessionAdapter } from '../../claude/claude-structured-session-adapter'
+import {
+  fakeClaude,
+  PROVIDER_SESSION_ID
+} from '../../claude/claude-structured-session-test-support'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { structuredClaudeLifecycleEvent } from '../../runtime/structured-claude-runtime-adapter'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+const CALLER = { callerKey: 'client-1' }
+
+let root: string
+let host: StructuredAgentSessionHost
+let adapter: ClaudeStructuredSessionAdapter
+let store: AgentSessionRecordStore
+const claude = { current: fakeClaude({ replayUuid: null }) }
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-claude-echo-working-'))
+  resetHostTestOperationIds()
+  claude.current = fakeClaude({ replayUuid: null })
+  const lifecycle: Promise<void>[] = []
+  adapter = new ClaudeStructuredSessionAdapter({
+    resolveLaunch: async () => ({
+      pathToClaudeCodeExecutable: 'claude',
+      options: {},
+      cwd: root,
+      claudeConfigDir: join(root, 'claude-home'),
+      providerSessionId: PROVIDER_SESSION_ID,
+      resumeLeafUuid: null,
+      resumesTranscript: false,
+      continuesChain: false
+    }),
+    onEvent: (event) => {
+      const mapped = structuredClaudeLifecycleEvent(event)
+      if (mapped) {
+        lifecycle.push(host.handleAdapterEvent(mapped))
+      }
+    },
+    // As the runtime wires it.
+    onDispatchSettledLate: (settlement) => void host.settleLateDispatch(settlement),
+    openConnection: claude.current.openConnection,
+    readProcessStartTime: async () => 1_700_000_000_000,
+    now: () => NOW
+  })
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: Object.assign(adapter, { supportsCreate: () => true }),
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-a',
+    now: () => NOW
+  })
+  const params = hostTestAttachParams(null, {
+    provider: 'claude',
+    agent: 'claude',
+    accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: join(root, 'claude-home') },
+    providerHandle: { kind: 'claude', sessionId: PROVIDER_SESSION_ID, leafUuid: null }
+  })
+  expect(await host.attach(CALLER, params)).toMatchObject({ ok: true })
+  await adapter.awaitStarted(SESSION)
+  await Promise.all(lifecycle)
+})
+
+afterEach(async () => {
+  await adapter.closeAll()
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+function settled(): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, 20))
+}
+
+it('reads working at every published frame from the send through the echo that opens its turn', async () => {
+  const submissions = new Map<string, AgentJournalSubmission>()
+  const turns = new Map<string, string>()
+  const working: boolean[] = []
+  const fence = store.getRecord(SESSION)!.lease.runtimeFence
+  host.subscribe({
+    id: 'chat-1',
+    sessionId: SESSION,
+    emit: (event) => {
+      if (event.type !== 'batch') {
+        return
+      }
+      for (const submission of event.batch.submissions) {
+        submissions.set(submission.clientMessageId, submission)
+      }
+      for (const item of event.batch.items) {
+        if (item.body.kind === 'turn') {
+          turns.set(item.itemId, item.body.state)
+        }
+      }
+      const running = [...turns].find(([, state]) => state === 'running')?.[0] ?? null
+      working.push(
+        isStructuredAgentSessionMainAgentWorking(running, [...submissions.values()], fence)
+      )
+    }
+  })
+  const body = hostTestMessage('hi')
+  await host.send(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: fence,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    },
+    body
+  })
+  await settled()
+  const connection = claude.current.connections[0]!
+  // Claude echoes the written message back, which is what opens its turn.
+  connection.handlers.onMessage?.({ ...connection.sent.at(-1)!, uuid: 'echo-uuid' })
+  await settled()
+
+  expect([...submissions.values()].map((submission) => submission.dispatchState)).toEqual([
+    'accepted'
+  ])
+  expect([...turns.values()]).toEqual(['running'])
+  expect(working).not.toContain(false)
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-claude-queued-stop.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-claude-queued-stop.test.ts
new file mode 100644
index 00000000000..e8b8d0f0044
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-claude-queued-stop.test.ts
@@ -0,0 +1,196 @@
+// A follow-up Claude queued behind the running turn is dropped by Stop, so the chat must record it
+// as withdrawn and stop reading as working — under the SessionStart hook Orca installs, whose frame
+// proves the start before the turn's system/init says the CLI can cancel its queue.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import { DISPATCH_REJECTED_CANCELLED } from '../../../shared/structured-agent-session-dispatch-rejection'
+import { activeStructuredAgentSessionTurnId } from '../../../shared/structured-agent-session-live-turn'
+import { projectStructuredAgentSessionStatus } from '../../../shared/structured-agent-session-projection'
+import { ClaudeStructuredSessionAdapter } from '../../claude/claude-structured-session-adapter'
+import {
+  fakeClaude,
+  PROVIDER_SESSION_ID
+} from '../../claude/claude-structured-session-test-support'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { structuredClaudeLifecycleEvent } from '../../runtime/structured-claude-runtime-adapter'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+const CALLER = { callerKey: 'client-1' }
+// As Claude Code 2.1.280 advertises them on a turn's system/init frame.
+const CAPABILITIES = ['interrupt_receipt_v1', 'interrupt_cancel_queued_v1', 'msg_lifecycle_v1']
+
+let root: string
+let host: StructuredAgentSessionHost
+let adapter: ClaudeStructuredSessionAdapter
+let store: AgentSessionRecordStore
+let queued: string[]
+let claude: ReturnType<typeof fakeClaude>
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-claude-queued-stop-'))
+  resetHostTestOperationIds()
+  queued = []
+  claude = fakeClaude({
+    replayUuid: null,
+    initProof: 'session-start',
+    // What the real CLI answers: cancel_queued cancels the queue, a plain interrupt keeps it.
+    routes: {
+      interrupt: (params) =>
+        params?.cancelQueued
+          ? { still_queued: [], cancelled: queued.splice(0) }
+          : { still_queued: [...queued] }
+    }
+  })
+  const lifecycle: Promise<void>[] = []
+  adapter = new ClaudeStructuredSessionAdapter({
+    resolveLaunch: async () => ({
+      pathToClaudeCodeExecutable: 'claude',
+      options: {},
+      cwd: root,
+      claudeConfigDir: join(root, 'claude-home'),
+      providerSessionId: PROVIDER_SESSION_ID,
+      resumeLeafUuid: null,
+      resumesTranscript: false,
+      continuesChain: false
+    }),
+    onEvent: (event) => {
+      const mapped = structuredClaudeLifecycleEvent(event)
+      if (mapped) {
+        lifecycle.push(host.handleAdapterEvent(mapped))
+      }
+    },
+    // As the runtime wires it.
+    onDispatchSettledLate: (settlement) => void host.settleLateDispatch(settlement),
+    openConnection: claude.openConnection,
+    readProcessStartTime: async () => 1_700_000_000_000,
+    now: () => NOW
+  })
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: Object.assign(adapter, { supportsCreate: () => true }),
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-a',
+    now: () => NOW
+  })
+  const params = hostTestAttachParams(null, {
+    provider: 'claude',
+    agent: 'claude',
+    accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: join(root, 'claude-home') },
+    providerHandle: { kind: 'claude', sessionId: PROVIDER_SESSION_ID, leafUuid: null }
+  })
+  expect(await host.attach(CALLER, params)).toMatchObject({ ok: true })
+  await adapter.awaitStarted(SESSION)
+  await Promise.all(lifecycle)
+})
+
+afterEach(async () => {
+  await adapter.closeAll()
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+function eventually(assertion: () => unknown): Promise<unknown> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
+
+function envelope(
+  method: 'agentSession.send' | 'agentSession.cancel',
+  fields: Record<string, unknown>
+) {
+  return {
+    sessionId: SESSION,
+    clientOperationId: hostTestOperationId(),
+    expectedRuntimeFence: store.getRecord(SESSION)!.lease.runtimeFence,
+    payloadFingerprint: computeAgentSessionPayloadFingerprint({
+      method,
+      sessionId: SESSION,
+      fields
+    })
+  }
+}
+
+async function send(text: string): Promise<string> {
+  const body = hostTestMessage(text)
+  const sent = await host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
+  if (!sent.ok) {
+    throw new Error('send refused')
+  }
+  return sent.value.clientMessageId
+}
+
+async function dispatch(clientMessageId: string) {
+  const submission = (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )
+  return { state: submission?.dispatchState, reason: submission?.reason }
+}
+
+async function status(): Promise<string> {
+  const snapshot = await host.journalSnapshot(SESSION)
+  return projectStructuredAgentSessionStatus(
+    snapshot.items,
+    snapshot.submissions,
+    store.getRecord(SESSION)!.lease.runtimeFence
+  )
+}
+
+it('withdraws a follow-up Claude queued behind the running turn when that turn is stopped', async () => {
+  const connection = claude.connections[0]!
+  const first = await send('Write a long reply.')
+  await eventually(() => expect(connection.sent).toHaveLength(1))
+  // Claude opens the turn: its system/init, then the echo of the message it runs.
+  connection.handlers.onMessage?.({
+    type: 'system',
+    subtype: 'init',
+    session_id: PROVIDER_SESSION_ID,
+    uuid: 'turn-init',
+    model: 'claude-sonnet-5',
+    capabilities: CAPABILITIES
+  })
+  connection.handlers.onMessage?.({
+    ...connection.sent.at(-1)!,
+    uuid: connection.sent.at(-1)!.uuid
+  })
+  await eventually(async () => expect((await dispatch(first)).state).toBe('accepted'))
+  const turnId = activeStructuredAgentSessionTurnId((await host.journalSnapshot(SESSION)).items)
+  expect(turnId).not.toBeNull()
+
+  const followUp = await send('And then this.')
+  await eventually(() => expect(connection.sent).toHaveLength(2))
+  queued.push(String(connection.sent.at(-1)!.uuid))
+  await eventually(async () => expect((await dispatch(followUp)).state).toBe('pending'))
+
+  const stopped = await host.cancel(CALLER, {
+    envelope: envelope('agentSession.cancel', { turnId }),
+    turnId: turnId!
+  })
+  expect(stopped).toMatchObject({ ok: true, value: { cancelled: true } })
+  // The interrupted turn closes as the CLI ends it.
+  connection.handlers.onMessage?.({
+    type: 'result',
+    subtype: 'error_during_execution',
+    session_id: PROVIDER_SESSION_ID,
+    uuid: 'interrupted-result'
+  })
+  await eventually(async () =>
+    expect(await dispatch(followUp)).toEqual({
+      state: 'rejected',
+      reason: DISPATCH_REJECTED_CANCELLED
+    })
+  )
+  await eventually(async () => expect(await status()).toBe('idle'))
+}, 15_000)
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-claude-root-exit.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-claude-root-exit.test.ts
index a73e46b898e..4a8f0a1440f 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-claude-root-exit.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-claude-root-exit.test.ts
@@ -11,7 +11,7 @@ import {
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import type { AgentSessionAttachParams } from './structured-agent-session-attach'
-import { evictHeldStructuredAgentSession } from './structured-agent-session-host-lifetime'
+import { stopStructuredAgentSessionAgentUnderSerialize } from './structured-agent-session-host-lifetime'
 import { StructuredAgentSessionHostRuntimeState } from './structured-agent-session-host-runtime-state'
 import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
 
@@ -24,7 +24,7 @@ afterEach(async () => {
   await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
 })
 
-describe('Claude root-exit eviction', () => {
+describe('Claude root-exit stop', () => {
   it('releases a captured live claim after the provider root exits', async () => {
     const root = await mkdtemp(join(tmpdir(), 'orca-claude-root-exit-'))
     roots.push(root)
@@ -78,6 +78,7 @@ describe('Claude root-exit eviction', () => {
       journalDir: join(root, 'journal')
     })
     const close = vi.spyOn(journal, 'close')
+    const publishStatus = vi.fn()
     const params: AgentSessionAttachParams = {
       envelope: {
         sessionId: 'session-1',
@@ -103,10 +104,11 @@ describe('Claude root-exit eviction', () => {
         {
           journal,
           params,
-          fence,
-          hasProviderChild: true,
-          providerChildPhase: 'ready',
-          acquisitionGeneration: acquisition.acquisitionGeneration ?? null
+          child: {
+            generation: acquisition.acquisitionGeneration ?? null,
+            fence,
+            phase: 'ready'
+          }
         }
       ]
     ])
@@ -115,13 +117,13 @@ describe('Claude root-exit eviction', () => {
 
     claude.connections[0]!.handlers.onExit?.(new Error('provider exited'))
     await expect(
-      evictHeldStructuredAgentSession(
+      stopStructuredAgentSessionAgentUnderSerialize(
         {
           deps,
           runtimeState,
           sessions,
           now: () => NOW + 30 * 60_000,
-          forgetStatus: vi.fn()
+          publishStatus
         },
         'session-1'
       )
@@ -132,8 +134,10 @@ describe('Claude root-exit eviction', () => {
       ownerProcess: null,
       deathEvidence: { kind: 'exit-observed' }
     })
-    expect(sessions.size).toBe(0)
-    expect(close).toHaveBeenCalledOnce()
+    // The agent went to rest; the conversation stays open and listed.
+    expect(sessions.get('session-1')?.child).toBeNull()
+    expect(close).not.toHaveBeenCalled()
+    expect(publishStatus).toHaveBeenCalledWith('session-1')
     // The adapter agrees the session is over: nothing is left to refuse the next start.
     await expect(adapter.closeSession('session-1')).resolves.toBe(true)
   })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-client-delivery.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-client-delivery.ts
index aa3f298a077..fee7f9e1d3d 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-client-delivery.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-client-delivery.ts
@@ -1,6 +1,8 @@
+import { AgentSessionRefusalError } from '../../../shared/agent-session-wire-refusals'
 import type { AgentChildWorkEvidence } from '../../../shared/agent-status-child-work-evidence'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import { AgentSessionSubscribers } from './structured-agent-session-subscribers'
+import { tryReadQueuePublication } from './structured-agent-session-queued-publication'
 import type {
   StructuredAgentSessionHostDeps,
   StructuredAgentSessionHostSession
@@ -28,16 +30,28 @@ export class StructuredAgentSessionClientDelivery {
     private readonly sessions: Map<string, StructuredAgentSessionHostSession>,
     now: () => number,
     deps: () => StructuredAgentSessionHostDeps,
-    private readonly onJournalActivity?: (sessionId: string) => void
+    private readonly onJournalActivity?: (sessionId: string) => void,
+    onAgentStarted?: (sessionId: string) => void
   ) {
-    this.statusFeed = createStructuredAgentSessionHostStatusFeed({ sessions, now, deps })
-    this.turnCompletionFeed = new StructuredAgentSessionTurnCompletionFeed({ sessions, now })
+    this.statusFeed = createStructuredAgentSessionHostStatusFeed({
+      sessions,
+      now,
+      deps,
+      ...(onAgentStarted ? { onAgentStarted } : {})
+    })
+    this.turnCompletionFeed = new StructuredAgentSessionTurnCompletionFeed({
+      sessions,
+      now,
+      readStatusState: (sessionId, journal) => this.statusFeed.statusState(sessionId, journal)
+    })
     this.sendSettlement = new StructuredAgentSessionSendSettlement((sessionId) =>
       this.requireJournal(sessionId)
     )
     this.waitForSendSettlement = this.sendSettlement.wait
     this.subscribers = new AgentSessionSubscribers({
       readCommands: (sessionId) => deps().adapter.readCommands?.(sessionId),
+      readQueuePublication: (sessionId) =>
+        tryReadQueuePublication(sessions.get(sessionId)?.journal),
       onJournalPublished: (sessionId, journal) => this.publishJournal(sessionId, journal)
     })
   }
@@ -66,10 +80,16 @@ export class StructuredAgentSessionClientDelivery {
     subscriber: StructuredAgentSessionTurnCompletionSubscriber
   ): (() => void) => this.turnCompletionFeed.subscribe(subscriber)
 
-  closeSession(sessionId: string): void {
+  /** The conversation's handle closed. Its status row stays in every session list; the
+   *  agent-status store keeps it too while the chat still has a tab to show it in. */
+  closeSession(sessionId: string, options: { listed: boolean }): void {
     this.sendSettlement.closeSession(sessionId)
-    this.statusFeed.close(sessionId)
-    // The next attach re-baselines rather than announcing the turn it was already holding.
+    if (options.listed) {
+      this.statusFeed.revokeLive(sessionId)
+    } else {
+      this.statusFeed.close(sessionId)
+    }
+    // The next open re-baselines rather than announcing the turn it was already holding.
     this.turnCompletionFeed.forget(sessionId)
   }
 
@@ -81,7 +101,8 @@ export class StructuredAgentSessionClientDelivery {
     this.statusFeed.publish(sessionId, journal)
     this.sendSettlement.publish(sessionId, journal)
     // Derived here rather than per-subscriber: this edge runs whether or not anyone is
-    // subscribed, which is the whole reason a backgrounded chat can complete at all.
+    // subscribed, which is the whole reason a backgrounded chat can complete at all. After the
+    // status publish, so it reads the projection that publish cached.
     this.turnCompletionFeed.observe(sessionId, journal)
     this.onJournalActivity?.(sessionId)
   }
@@ -89,7 +110,7 @@ export class StructuredAgentSessionClientDelivery {
   private requireJournal(sessionId: string): AgentSessionJournal {
     const journal = this.sessions.get(sessionId)?.journal
     if (!journal) {
-      throw new Error(AGENT_SESSION_NOT_ATTACHED.code)
+      throw new AgentSessionRefusalError(AGENT_SESSION_NOT_ATTACHED)
     }
     return journal
   }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-close-retry.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-close-retry.test.ts
index b9e8f8e506d..74d5355edd5 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-close-retry.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-close-retry.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // A close that REJECTED did not release the handle.
 //
 // `AgentSessionJournal.close()` is retryable by design: the release step is
@@ -78,10 +79,7 @@ function hostSession(journal: AgentSessionJournal): StructuredAgentSessionHostSe
   return {
     journal,
     params: {} as StructuredAgentSessionHostSession['params'],
-    fence: 1,
-    hasProviderChild: false,
-    providerChildPhase: 'ready',
-    acquisitionGeneration: null
+    child: null
   }
 }
 
@@ -138,7 +136,7 @@ function attachContext(
     reconcileLeases: async () => null,
     serialize: <T>(_sessionId: string, task: () => Promise<T>) => task(),
     now: () => 1,
-    forgetStatus: () => undefined
+    publishStatus: () => undefined
   } as unknown as StructuredAgentSessionAttachContext
 }
 
@@ -178,40 +176,35 @@ describe('the registry', () => {
 })
 
 describe('the attach orchestration', () => {
-  it('ABORTS the map replacement when the previous journal will not close', async () => {
-    const previousDir = join(root, 'previous')
-    const provisionalDir = join(root, 'provisional')
-    const previous = flakyClose(
-      await journals.open({ identity: IDENTITY, journalDir: previousDir }),
-      1
-    )
-    const provisional = await journals.open({
-      identity: IDENTITY,
-      journalDir: provisionalDir
-    })
-    attachFlow.journal = provisional
-    const sessions = new Map([[SESSION, hostSession(previous)]])
+  // The attach adopts the conversation's one open journal; it never opens a second handle, so
+  // there is no replacement to abort and no provisional journal to close.
+  it('keeps the journal it adopted indexed and open when an attach succeeds', async () => {
+    const directory = join(root, 'adopted')
+    const journal = await journals.open({ identity: IDENTITY, journalDir: directory })
+    attachFlow.journal = journal
+    const sessions = new Map([[SESSION, hostSession(journal)]])
 
+    await attachStructuredAgentSession(attachContext(sessions), 'caller-1', attachParams)
+
+    expect(sessions.get(SESSION)?.journal).toBe(journal)
     await expect(
-      attachStructuredAgentSession(attachContext(sessions), 'caller-1', attachParams)
-    ).rejects.toThrow('close rejected')
-
-    // The live entry is UNTOUCHED: overwriting it would have left its handle
-    // open with nothing able to reach it again.
-    expect(sessions.get(SESSION)?.journal).toBe(previous)
-    // And the provisional journal is owned by the registry, not orphaned.
+      journal.appendItem(
+        { provider: 'orca', clientMessageId: 'after-attach' },
+        {
+          kind: 'status',
+          text: 'still writable'
+        },
+        { fence: 0, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+      )
+    ).resolves.toBeDefined()
     expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([])
-    await expectNothingHoldsTheDirectory(provisionalDir)
   })
 
-  it('retains the provisional journal when its own close rejects on the barrier path', async () => {
-    const provisionalDir = join(root, 'provisional-barrier')
-    const provisional = flakyClose(
-      await journals.open({ identity: IDENTITY, journalDir: provisionalDir }),
-      1
-    )
-    attachFlow.journal = provisional
-    const sessions = new Map<string, StructuredAgentSessionHostSession>()
+  it('leaves the conversation indexed and open when the sink barrier fails', async () => {
+    const directory = join(root, 'adopted-barrier')
+    const journal = await journals.open({ identity: IDENTITY, journalDir: directory })
+    attachFlow.journal = journal
+    const sessions = new Map([[SESSION, hostSession(journal)]])
     const context = attachContext(sessions)
     const failing = {
       sink: {},
@@ -229,9 +222,20 @@ describe('the attach orchestration', () => {
       'sink barrier failed'
     )
 
-    expect(sessions.size).toBe(0)
-    // Retained rather than dropped, so teardown can still release the handle.
-    expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([provisionalDir])
+    // A failed attach does not end the conversation: its queued messages and the failure row
+    // are written into this same journal.
+    expect(sessions.get(SESSION)?.journal).toBe(journal)
+    await expect(
+      journal.appendItem(
+        { provider: 'orca', clientMessageId: 'after-failure' },
+        {
+          kind: 'status',
+          text: 'still writable'
+        },
+        { fence: 0, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+      )
+    ).resolves.toBeDefined()
+    expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([])
   })
 })
 
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-command-readers.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-command-readers.test.ts
new file mode 100644
index 00000000000..993ee3fd258
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-command-readers.test.ts
@@ -0,0 +1,191 @@
+// After `/compact`, every reader that reports on the user's requests reads past the command: the
+// sidebar's prompt, preview, verdict and instant, restart resume, and an older client's label.
+
+import { describe, expect, it } from 'vitest'
+import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
+import type {
+  AgentJournalRenderItem,
+  AgentJournalSubmission
+} from '../../../shared/agent-session-journal-types'
+import { latestStructuredAgentSessionRequest } from '../../../shared/structured-agent-session-latest-request'
+import { projectStructuredAgentSessionStatusSummary } from '../../../shared/structured-agent-session-projection'
+import { projectTurnItemHistory } from '../../runtime/rpc/methods/structured-agent-session-turn-item-capability'
+import { structuredAgentSessionWorkingAtStop } from './structured-agent-session-working-at-teardown'
+import {
+  journal,
+  NOW,
+  record,
+  SESSION,
+  TEARDOWN_CURRENT
+} from './structured-agent-session-restart-resume-test-harness'
+
+const PROMPT = agentJournalSubmissionKey('prompt-1')
+const COMMAND = agentJournalSubmissionKey('command-1')
+const REAL_TURN = 'legacy:codex:session:turn-lifecycle%3Aturn-1'
+const COMMAND_TURN = 'orca:command-turn%3Acommand-1'
+
+let sequence = 0
+function item(itemId: string, body: AgentJournalRenderItem['body'], scope?: string) {
+  sequence += 1
+  return {
+    itemId,
+    revision: 1,
+    body,
+    sequence,
+    observedAt: NOW,
+    turnScope: scope ? { kind: 'turn' as const, turnItemId: scope } : { kind: 'thread' as const }
+  }
+}
+
+function accepted(clientMessageId: string): AgentJournalSubmission {
+  return {
+    clientMessageId,
+    fence: 1,
+    payloadFingerprint: 'fp',
+    dispatchState: 'accepted',
+    providerItemId: null,
+    reason: null,
+    submittedAt: NOW,
+    resolvedAt: NOW
+  }
+}
+
+/** "List three fruits", answered, then `/compact` in its own turn. */
+function compactedAfterARealTurn(commandState: 'running' | 'completed' = 'completed') {
+  sequence = 0
+  const items: AgentJournalRenderItem[] = [
+    item(PROMPT, {
+      kind: 'message',
+      role: 'user',
+      blocks: [{ type: 'text', text: 'List three fruits' }]
+    }),
+    item(REAL_TURN, {
+      kind: 'turn',
+      turnId: 'turn-1',
+      state: 'completed',
+      outcome: 'success',
+      userItemId: PROMPT,
+      startedAt: NOW,
+      completedAt: NOW + 1_000
+    }),
+    item(
+      'codex:answer',
+      { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'Apple, pear, fig' }] },
+      REAL_TURN
+    ),
+    item(COMMAND, {
+      kind: 'message',
+      role: 'user',
+      blocks: [{ type: 'text', text: '/compact' }],
+      command: { name: 'compact' }
+    }),
+    item(COMMAND_TURN, {
+      kind: 'turn',
+      turnId: 'compact:command-1',
+      state: commandState,
+      userItemId: COMMAND,
+      startedAt: NOW + 5_000,
+      ...(commandState === 'completed' ? { outcome: 'success', completedAt: NOW + 9_000 } : {})
+    }),
+    item(
+      'codex:summary',
+      { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'Summary of it all' }] },
+      COMMAND_TURN
+    ),
+    item(
+      'orca:command-result%3Acommand-1',
+      { kind: 'status', text: 'Conversation compacted.', presentation: 'compaction' },
+      COMMAND_TURN
+    )
+  ]
+  return { items, submissions: [accepted('prompt-1'), accepted('command-1')] }
+}
+
+describe('the sidebar after /compact (B7)', () => {
+  it('keeps the last real prompt, its answer, its verdict and its instant', () => {
+    const { items, submissions } = compactedAfterARealTurn()
+    expect(projectStructuredAgentSessionStatusSummary(items, submissions)).toEqual({
+      status: 'idle',
+      latestPrompt: 'List three fruits',
+      lastAssistantMessage: 'Apple, pear, fig',
+      turnOutcome: 'success',
+      statusStartedAt: NOW + 1_000
+    })
+  })
+
+  it('reads working while the command runs', () => {
+    const { items, submissions } = compactedAfterARealTurn('running')
+    expect(projectStructuredAgentSessionStatusSummary(items, submissions)).toMatchObject({
+      status: 'working',
+      latestPrompt: 'List three fruits'
+    })
+  })
+})
+
+describe('the completion feed around /compact (B6)', () => {
+  // The feed announces on a change of latest request; /compact running or settled leaves it be.
+  it.each(['running', 'completed'] as const)(
+    'keeps the last real turn latest while it is %s',
+    (state) => {
+      const { items, submissions } = compactedAfterARealTurn(state)
+      expect(latestStructuredAgentSessionRequest(items, submissions)).toMatchObject({
+        kind: 'turn',
+        id: 'turn-1',
+        running: false,
+        outcome: 'success'
+      })
+    }
+  )
+})
+
+describe('restart resume around /compact (B14)', () => {
+  function markerFor(items: AgentJournalRenderItem[], tasks: boolean) {
+    return structuredAgentSessionWorkingAtStop({
+      sessionId: SESSION,
+      session: { journal: journal(items), child: { fence: 1 } },
+      getRecord: () => record(),
+      backgroundTasks: () =>
+        tasks ? [{ id: 'task-a', kind: 'agent', description: 'Review', state: 'working' }] : [],
+      trigger: 'quit',
+      teardownId: TEARDOWN_CURRENT,
+      now: NOW
+    })
+  }
+
+  it('records nothing while the command runs', () => {
+    expect(markerFor(compactedAfterARealTurn('running').items, false)).toBeNull()
+  })
+
+  it('anchors a settled lead with live children on its last real turn', () => {
+    const marker = markerFor(compactedAfterARealTurn().items, true)
+    expect(marker?.work).toEqual({ kind: 'turn', id: 'turn-1' })
+    // The newest user message is still the last real prompt, as before commands were messages.
+    expect(marker?.latestUserItemId).toBe(PROMPT)
+  })
+})
+
+describe("an older client's label for a command turn (B17)", () => {
+  it("names the session's agent, not the one its key suggests", () => {
+    const { items, submissions } = compactedAfterARealTurn()
+    const history = {
+      ok: true as const,
+      page: {
+        sessionId: SESSION,
+        epoch: 'epoch-1',
+        direction: 'tail' as const,
+        items,
+        removedItemIds: [],
+        submissions,
+        window: { oldest: null, newest: null, nextCursor: { epoch: 'epoch-1', sequence: 0 } },
+        hasOlder: false,
+        hasNewer: false
+      }
+    }
+    const projected = projectTurnItemHistory(history, { clientKind: 'runtime' }, 'claude')
+    const commandTurn = projected.page.items.find((entry) => entry.itemId === COMMAND_TURN)
+    expect(commandTurn?.body).toMatchObject({
+      kind: 'status',
+      text: expect.stringContaining('Claude')
+    })
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-command-turn.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-command-turn.ts
new file mode 100644
index 00000000000..cb83dba870a
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-command-turn.ts
@@ -0,0 +1,320 @@
+// A conversation command the user sent, such as `/compact`, carried out as a turn of its own.
+//
+// The command is an ordinary queued message until the delivery loop hands it over. There the loop
+// opens the command's turn and sends it; the provider's receipt resolves the message, as it does
+// any send. The provider child's journal translator ends the turn from the provider's own frames,
+// and a child that ends first is settled with it. The host writes a command's end only when the
+// provider never took it. While the turn runs it takes no input, so the loop hands nothing over.
+
+import {
+  agentSessionFailureFact,
+  type AgentSessionFailureFact,
+  type SubmissionRejectionFact
+} from '../../../shared/agent-session-failure'
+import {
+  agentSessionFailureWords,
+  type AgentJournalDispatchRejection,
+  type AgentSessionFailureWordsContext
+} from '../../../shared/agent-session-failure-words'
+import {
+  agentJournalItemKey,
+  agentJournalSubmissionKey,
+  parseAgentJournalItemKey
+} from '../../../shared/agent-session-journal-item-key'
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalItemIdentity,
+  type AgentJournalMessageItem,
+  type AgentJournalSubmission
+} from '../../../shared/agent-session-journal-types'
+import type { AgentSessionConversationCommand } from '../../../shared/agent-session-conversation-command'
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import { agentSessionRefusalReference } from '../../../shared/agent-session-wire-refusals'
+import {
+  agentJournalTurnBody,
+  readAgentJournalTurn
+} from '../../../shared/agent-session-turn-record'
+import type { JournalLifecycleMutationInput } from '../agent-session-journal/journal-row-builders'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import type {
+  AgentSessionCommandAdmission,
+  StructuredAgentSessionAdapter,
+  StructuredAgentSessionProviderChildPhase
+} from './structured-agent-session-adapter'
+import { structuredAgentSessionStartFailure } from './structured-agent-session-failure-text'
+import { conversationCommandBlocked } from './structured-conversation-command-admission'
+
+export const STRUCTURED_AGENT_SESSION_COMPACT_COMMAND = 'compact'
+
+/** What the user sent for `/compact`: the text they typed, and the command it names. */
+export function structuredAgentSessionCompactBody(): AgentJournalMessageItem {
+  return {
+    kind: 'message',
+    role: 'user',
+    blocks: [{ type: 'text', text: '/compact' }],
+    command: { name: STRUCTURED_AGENT_SESSION_COMPACT_COMMAND }
+  }
+}
+
+type AwaitedSubmission = Pick<
+  AgentJournalSubmission,
+  'clientMessageId' | 'dispatchState' | 'acceptedSequence'
+>
+
+/** Optional `submissions` as the dead-generation journal reads it. */
+export type StructuredAgentSessionAwaitedCommandJournal = {
+  submissions?: () => readonly AwaitedSubmission[]
+  itemBody: AgentSessionJournal['itemBody']
+}
+
+/** The command the oldest message still waiting on the provider names: a start that fails now
+ *  fails that message first, so its next step is to run the command again. */
+export function structuredAgentSessionAwaitedCommand(
+  journal: StructuredAgentSessionAwaitedCommandJournal
+): AgentSessionConversationCommand | undefined {
+  let oldest: AwaitedSubmission | undefined
+  for (const submission of journal.submissions?.() ?? []) {
+    if (
+      submission.dispatchState === 'pending' &&
+      (oldest === undefined || (submission.acceptedSequence ?? 0) < (oldest.acceptedSequence ?? 0))
+    ) {
+      oldest = submission
+    }
+  }
+  const body = oldest && journal.itemBody(agentJournalSubmissionKey(oldest.clientMessageId))
+  return body?.kind === 'message' && body.command?.name === STRUCTURED_AGENT_SESSION_COMPACT_COMMAND
+    ? STRUCTURED_AGENT_SESSION_COMPACT_COMMAND
+    : undefined
+}
+
+/** The command's turn: its record and the `turnId` a Stop names. The `compact:` prefix is how the
+ *  host's Stop and delivery gate tell a command's turn from any other. */
+export function structuredAgentSessionCommandTurn(clientMessageId: string): {
+  identity: AgentJournalItemIdentity
+  itemId: string
+  turnId: string
+  /** The command's one result row, inside its turn. */
+  resultIdentity: AgentJournalItemIdentity
+} {
+  const identity = { provider: 'orca' as const, clientMessageId: `command-turn:${clientMessageId}` }
+  return {
+    identity,
+    itemId: agentJournalItemKey(identity),
+    turnId: `compact:${clientMessageId}`,
+    resultIdentity: { provider: 'orca', clientMessageId: `command-result:${clientMessageId}` }
+  }
+}
+
+/** Whether the journal's running turn is a command's, which takes no input while it runs. */
+export function structuredAgentSessionCommandRunning(
+  journal: Pick<AgentSessionJournal, 'activeTurnId'>
+): boolean {
+  const turnId = journal.activeTurnId()
+  return turnId !== null && isStructuredAgentSessionCommandTurnId(turnId)
+}
+
+export function isStructuredAgentSessionCommandTurnId(turnId: string): boolean {
+  return turnId.startsWith('compact:')
+}
+
+const STOP_NOTE_PREFIX = 'stop:'
+
+/** A Stop's note, on the turn it named. The key says what it is, so a later Stop can read it. */
+export function structuredAgentSessionStopNoteIdentity(
+  clientOperationId: string
+): AgentJournalItemIdentity {
+  return { provider: 'orca', clientMessageId: `${STOP_NOTE_PREFIX}${clientOperationId}` }
+}
+
+/** Whether an earlier Stop already asked the running command `turnId` names to end. Read from the
+ *  journal, so nothing is held that could outlive the command. */
+export function structuredAgentSessionCommandWasStopped(
+  journal: Pick<AgentSessionJournal, 'snapshot'>,
+  turnId: string
+): boolean {
+  const { itemId } = structuredAgentSessionCommandTurn(turnId.slice('compact:'.length))
+  return journal.snapshot().items.some((item) => {
+    const identity = parseAgentJournalItemKey(item.itemId)
+    return (
+      item.turnScope?.kind === 'turn' &&
+      item.turnScope.turnItemId === itemId &&
+      identity?.provider === 'orca' &&
+      identity.clientMessageId.startsWith(STOP_NOTE_PREFIX)
+    )
+  })
+}
+
+export type StructuredAgentSessionCommandHandoverContext = {
+  sessionId: string
+  journal: AgentSessionJournal
+  fence: number
+  adapter: StructuredAgentSessionAdapter
+  providerChildPhase?: () => StructuredAgentSessionProviderChildPhase | undefined
+  /** Who a failure the handover meets names, as the start's own row does. */
+  failureTextContext?: AgentSessionFailureWordsContext
+  record: () => AgentSessionRecord | null
+  flushStreamedEvents: () => Promise<void>
+  now: () => number
+}
+
+/** Refuses the command, or opens its turn and sends it. */
+export async function handOverStructuredAgentSessionCommand(
+  ctx: StructuredAgentSessionCommandHandoverContext,
+  submission: AgentJournalSubmission,
+  body: AgentJournalMessageItem
+): Promise<void> {
+  const { clientMessageId } = submission
+  // Provider frames already received decide whether a turn is running.
+  await ctx.flushStreamedEvents()
+  const blocked = commandBlocked(ctx, body)
+  if (blocked) {
+    await ctx.journal.resolveDispatch({
+      clientMessageId,
+      state: 'rejected',
+      ...agentSessionFailureWords(blocked, { ...ctx.failureTextContext, surface: 'rejection' }),
+      fence: ctx.fence
+    })
+    return
+  }
+  const turn = structuredAgentSessionCommandTurn(clientMessageId)
+  await ctx.journal.resolveDispatch({
+    clientMessageId,
+    state: 'pending',
+    fence: ctx.fence,
+    turnScope: ctx.journal.liveTurnScope()
+  })
+  const startedAt = ctx.now()
+  const running = agentJournalTurnBody({
+    turnId: turn.turnId,
+    state: 'running',
+    userItemId: agentJournalSubmissionKey(clientMessageId),
+    requestedAt: structuredAgentSessionHandoverOrigin(ctx.journal, submission),
+    startedAt
+  })
+  await ctx.journal.appendItem(turn.identity, running, {
+    fence: ctx.fence,
+    observedAt: startedAt,
+    turnScope: AGENT_JOURNAL_THREAD_SCOPE
+  })
+  let admission: AgentSessionCommandAdmission
+  try {
+    admission = await ctx.adapter.compact!({
+      sessionId: ctx.sessionId,
+      fence: ctx.fence,
+      command: { clientMessageId, ...turn, running }
+    })
+  } catch (error) {
+    // A child that had not proven its start took nothing, so the command provably did not run. Any
+    // other throw is a lost reply: the command may have run.
+    const unsent =
+      ctx.providerChildPhase?.() === 'starting'
+        ? {
+            state: 'rejected' as const,
+            ...structuredAgentSessionStartFailure({ error }, ctx.failureTextContext)
+          }
+        : {
+            state: 'unknown' as const,
+            reason: error instanceof Error ? error.message : String(error)
+          }
+    await settleUnsentCommand(ctx, clientMessageId, unsent)
+    return
+  }
+  if (admission.state === 'rejected') {
+    // The provider refused the compaction itself: its row reads as the compaction failing.
+    await settleUnsentCommand(
+      ctx,
+      clientMessageId,
+      admission,
+      agentSessionFailureFact('compactionFailed', { detail: admission.rejection.detail })
+    )
+  } else if (admission.state !== 'admitted') {
+    // An unknown write leaves the turn to the provider's end or the child's: it may have run.
+    await ctx.journal.resolveDispatch({ clientMessageId, ...admission, fence: ctx.fence })
+  }
+}
+
+/** Where the turn a handed-over submission runs in starts counting: its handover, so time spent
+ *  held behind a command or a start is not counted as the agent's work. */
+export function structuredAgentSessionHandoverOrigin(
+  journal: AgentSessionJournal,
+  submission: AgentJournalSubmission
+): number {
+  const handedOver = journal
+    .submissions()
+    .find((entry) => entry.clientMessageId === submission.clientMessageId)
+  return handedOver?.handedOverAt ?? submission.submittedAt
+}
+
+/** The command's end when the provider never took it: refused, or lost with the adapter's throw.
+ *  The message's answer goes first, so a crash before the turn's end leaves a running turn, which
+ *  the stale-turn sweep settles, never an ended turn whose message still reads as in flight. */
+async function settleUnsentCommand(
+  ctx: StructuredAgentSessionCommandHandoverContext,
+  clientMessageId: string,
+  unsent:
+    | ({ state: 'rejected' } & AgentJournalDispatchRejection)
+    | { state: 'unknown'; reason: string },
+  /** What the result row reports, when it is not the rejection's own fact. */
+  rowFailure?: AgentSessionFailureFact
+): Promise<void> {
+  const turn = structuredAgentSessionCommandTurn(clientMessageId)
+  const running = readAgentJournalTurn(ctx.journal.itemBody(turn.itemId) ?? undefined)
+  await ctx.journal.resolveDispatch({ clientMessageId, ...unsent, fence: ctx.fence })
+  if (running?.state !== 'running') {
+    return
+  }
+  const refused = unsent.state === 'rejected'
+  const mutations: JournalLifecycleMutationInput[] = [
+    ...(refused
+      ? [
+          {
+            kind: 'item' as const,
+            identity: turn.resultIdentity,
+            body: {
+              kind: 'status' as const,
+              ...agentSessionFailureWords(rowFailure ?? unsent.rejection, {
+                ...ctx.failureTextContext,
+                surface: 'row'
+              }),
+              tone: 'error' as const
+            },
+            turnScope: { kind: 'turn' as const, turnItemId: turn.itemId }
+          }
+        ]
+      : []),
+    {
+      kind: 'item',
+      identity: turn.identity,
+      body: agentJournalTurnBody({
+        ...running,
+        ...(refused
+          ? { state: 'completed', outcome: 'failure', completedAt: ctx.now() }
+          : { state: 'unverifiable' })
+      }),
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    }
+  ]
+  await ctx.journal.appendLifecycleBatch({
+    settlementId: `command-settled:${clientMessageId}`,
+    fence: ctx.fence,
+    mutations
+  })
+}
+
+/** Why the command may not run now, as the fact its message is rejected with; null when it may. */
+function commandBlocked(
+  ctx: StructuredAgentSessionCommandHandoverContext,
+  body: AgentJournalMessageItem
+): SubmissionRejectionFact | null {
+  if (body.command?.name !== STRUCTURED_AGENT_SESSION_COMPACT_COMMAND || !ctx.adapter.compact) {
+    return agentSessionFailureFact('commandRefused')
+  }
+  const record = ctx.record()
+  if (!record) {
+    return agentSessionFailureFact('hostFault')
+  }
+  const refusal = conversationCommandBlocked(ctx, record, 'handover')
+  return refusal
+    ? agentSessionFailureFact('commandRefused', { refusal: agentSessionRefusalReference(refusal) })
+    : null
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-close.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-close.test.ts
new file mode 100644
index 00000000000..bf3cd1f96a6
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-close.test.ts
@@ -0,0 +1,326 @@
+// Stopping an agent and closing its conversation's handle are two things, and a reader, a session
+// list and a send each see only the one that happened. Ticks are driven by hand.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import type { AgentSessionStatusSummary } from '../../../shared/agent-session-wire'
+import { readStructuredSessionGateFacts } from '../../runtime/orchestration/structured-mailbox-pointer-host'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+import { setStructuredAgentSessionHost } from './structured-agent-session-registry'
+import {
+  collectSubscriber,
+  createRestTestRig,
+  foundRestTestChat,
+  IDLE_MS,
+  readerSaw,
+  REST_TEST_CALLER as CALLER,
+  REST_TEST_SESSION as SESSION,
+  restTestSend,
+  sweepOnce,
+  type RestTestRig
+} from './structured-agent-session-rest-test-rig'
+import { StructuredAgentSessionIdleSweep } from './structured-agent-session-idle-sweep'
+import { hostTestAttachParams } from './structured-agent-session-host-test-data'
+
+let rig: RestTestRig
+
+const COLD_START = { timeout: 10_000 }
+
+beforeEach(async () => {
+  rig = await createRestTestRig({ idleSweep: { intervalMs: 3_600_000 } })
+  setStructuredAgentSessionHost(rig.host)
+})
+
+afterEach(async () => {
+  setStructuredAgentSessionHost(null)
+  await rig.dispose()
+})
+
+function fence(): number {
+  return rig.store.getRecord(SESSION)?.lease.runtimeFence ?? 1
+}
+
+function openSession(): StructuredAgentSessionHostSession | undefined {
+  return rig.host.collaboratorsForTests().sessions.get(SESSION)
+}
+
+function statusRows(): AgentSessionStatusSummary[] {
+  return rig.statusEvents
+    .flatMap((event) => (event.type === 'status' ? [event.session] : []))
+    .filter((summary) => summary.sessionId === SESSION)
+}
+
+describe('a stop that fails', () => {
+  it('is retried on the next tick (P2-11 a)', async () => {
+    await foundRestTestChat(rig)
+    rig.adapter.closeSession.mockResolvedValueOnce(false)
+    rig.clock.now += IDLE_MS + 1
+
+    await sweepOnce(rig.host)
+    expect(openSession()?.owesProviderChildWindDown).toMatchObject({
+      generation: expect.any(String)
+    })
+    await sweepOnce(rig.host)
+
+    expect(rig.adapter.closeSession).toHaveBeenCalledTimes(2)
+    expect(rig.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
+    expect(statusRows().at(-1)?.hostExecutionOwned).toBeUndefined()
+  })
+
+  it('finishes its wind-down on the next tick, whatever its own writes did to the clock (P2-11 b)', async () => {
+    await foundRestTestChat(rig)
+    rig.clock.now += IDLE_MS + 1
+    // The child is proven gone and its work settled, then handing the lease back fails.
+    const transition = vi
+      .spyOn(rig.store, 'transitionHandoff')
+      .mockRejectedValueOnce(new Error('store unavailable'))
+
+    await sweepOnce(rig.host)
+    expect(transition).toHaveBeenCalledOnce()
+    expect(rig.store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
+    // Five minutes later, not thirty.
+    rig.clock.now += 5 * 60_000
+    await sweepOnce(rig.host)
+
+    expect(rig.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
+    expect(rig.adapter.closeSession).toHaveBeenCalledOnce()
+  })
+})
+
+describe('closing the handle', () => {
+  it('keeps a tabbed chat listed and its reader open, and a send reopens it for that reader (P2-14)', async () => {
+    await foundRestTestChat(rig)
+    const reader = collectSubscriber()
+    await rig.host.subscribe({ id: 'reader', sessionId: SESSION, emit: reader.emit })
+    rig.clock.now += IDLE_MS + 1
+
+    await sweepOnce(rig.host)
+    expect(rig.host.hasSession(SESSION)).toBe(false)
+    // The row stays in the agent-status store, idle and no longer running here, and a session
+    // list that connects now still gets it.
+    expect(rig.sink.forget).not.toHaveBeenCalled()
+    expect(rig.sink.publish.mock.calls.at(-1)?.[0]).toMatchObject({ sessionId: SESSION })
+    expect(statusRows().at(-1)?.hostExecutionOwned).toBeUndefined()
+    const late: { type: string; sessions?: AgentSessionStatusSummary[] }[] = []
+    rig.host.subscribeStatus({ id: 'late', emit: (event) => late.push(event) })
+    expect(late[0]?.sessions?.map((summary) => summary.sessionId)).toContain(SESSION)
+    expect(reader.events.some((event) => event.type === 'end')).toBe(false)
+
+    const sent = await rig.host.send(CALLER, restTestSend('after the close', fence()))
+    expect(sent.ok).toBe(true)
+    // A cold start: reopen, reconcile and acquire.
+    await vi.waitFor(() => expect(rig.adapter.dispatch).toHaveBeenCalledTimes(2), COLD_START)
+    // The reader opened on the first handle is fed by the second.
+    await vi.waitFor(() => expect(readerSaw(reader.events).texts).toContain('after the close'))
+  })
+
+  it('drops the agent-status row of a chat whose tab is gone (P2-14, retired)', async () => {
+    await foundRestTestChat(rig)
+    await rig.store.setSessionTabVisibility(SESSION, false)
+    rig.clock.now += IDLE_MS + 1
+
+    await sweepOnce(rig.host)
+    expect(rig.host.hasSession(SESSION)).toBe(false)
+    expect(rig.sink.forget).toHaveBeenCalled()
+  })
+
+  it('forgets the row of a resting chat once its tab closes (P2-32)', async () => {
+    await foundRestTestChat(rig)
+    rig.clock.now += IDLE_MS + 1
+    await sweepOnce(rig.host)
+    expect(rig.sink.forget).not.toHaveBeenCalled()
+
+    await rig.host.setSessionTabVisibility(SESSION, false)
+    expect(rig.sink.forget).toHaveBeenCalled()
+  })
+
+  it('keeps the row when a chat with an open tab is evicted, and forgets it once the tab closes', async () => {
+    await foundRestTestChat(rig)
+
+    await rig.host.close(SESSION)
+    expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION)
+    // The stop says not-running; the row belongs to the tab, so nothing forgets it.
+    expect(rig.sink.forget).not.toHaveBeenCalled()
+    expect(rig.sink.publish.mock.calls.at(-1)?.[0]).toMatchObject({ sessionId: SESSION })
+    expect(rig.sink.publish.mock.calls.at(-1)?.[0].hostExecutionOwned).toBeUndefined()
+
+    await rig.host.setSessionTabVisibility(SESSION, false)
+    expect(rig.sink.forget).toHaveBeenCalledOnce()
+  })
+
+  it('never hands a reader a handle it is closing (P2-25)', async () => {
+    await foundRestTestChat(rig)
+    const journal = openSession()?.journal
+    if (!journal) {
+      throw new Error('the conversation should be open')
+    }
+    const closing = Promise.withResolvers<void>()
+    const gate = Promise.withResolvers<void>()
+    const close = journal.close.bind(journal)
+    vi.spyOn(journal, 'close').mockImplementation(async () => {
+      await close()
+      closing.resolve()
+      await gate.promise
+    })
+    rig.clock.now += IDLE_MS + 1
+    const tick = sweepOnce(rig.host)
+    await closing.promise
+
+    const history = rig.host.history({ sessionId: SESSION, direction: 'tail' })
+    const facts = readStructuredSessionGateFacts(SESSION)
+    gate.resolve()
+    await tick
+
+    const page = await history
+    expect(page.ok && page.page.items.length).toBeGreaterThan(0)
+    await expect(facts).resolves.not.toBeNull()
+    // And the handle a write finds is a live one.
+    const sent = await rig.host.send(CALLER, restTestSend('after the close', fence()))
+    expect(sent.ok).toBe(true)
+    // A cold start: reopen, reconcile and acquire.
+    await vi.waitFor(() => expect(rig.adapter.dispatch).toHaveBeenCalledTimes(2), COLD_START)
+  })
+
+  it('never re-enters the session lock: a send and a Stop right after still finish (P2-28)', async () => {
+    await foundRestTestChat(rig)
+    rig.clock.now += IDLE_MS + 1
+    const tick = sweepOnce(rig.host)
+    const within = <T>(work: Promise<T>) =>
+      Promise.race([
+        work,
+        new Promise<never>((_, reject) => setTimeout(() => reject(new Error('wedged')), 2_000))
+      ])
+    const sent = within(rig.host.send(CALLER, restTestSend('right after', fence())))
+
+    await within(tick)
+    expect(await sent).toMatchObject({ ok: true })
+    await vi.waitFor(() => expect(rig.adapter.dispatch).toHaveBeenCalledTimes(2))
+    await expect(within(sweepOnce(rig.host))).resolves.toBeUndefined()
+  })
+})
+
+describe('the sweep and the lease (P2-20)', () => {
+  it('reads only open conversations and never probes or resolves a lease', async () => {
+    await foundRestTestChat(rig)
+    const probeOwner = vi.fn(async () => ({ outcome: 'pid-absent' as const }))
+    await rig.restart({ probeOwner })
+    setStructuredAgentSessionHost(rig.host)
+    await rig.store.transitionHandoff(SESSION, (current) => ({
+      ...current,
+      lease: { ...current.lease, handoffStage: 'recovering' }
+    }))
+    const resolveRecovery = vi.spyOn(
+      rig.host.collaboratorsForTests().runtimeState,
+      'resolveRecovery'
+    )
+    // Open, at rest, on a lease still recovering.
+    await rig.host.journalSnapshot(SESSION)
+    expect(rig.host.hasSession(SESSION)).toBe(true)
+    rig.clock.now += IDLE_MS + 1
+
+    await sweepOnce(rig.host)
+    expect(rig.host.hasSession(SESSION)).toBe(false)
+    expect(probeOwner).not.toHaveBeenCalled()
+    expect(resolveRecovery).not.toHaveBeenCalled()
+  })
+})
+
+describe('a start that never finishes (P2-15)', () => {
+  it('is stopped by the sweep, and the delivery loop alone writes its one row and rejection', async () => {
+    const stopReason = 'Codex never finished starting, so Orca stopped it.'
+    const order: string[] = []
+    const started = Promise.withResolvers<void>()
+    rig.adapter.closeSession.mockImplementation(async () => {
+      order.push('stopped')
+      started.resolve()
+      return true
+    })
+    const spawn = rig.adapter.acquire.getMockImplementation()!
+    rig.adapter.acquire.mockImplementationOnce(async (input) => ({
+      ...(await spawn(input)),
+      providerChildPhase: 'starting' as const
+    }))
+    Object.assign(rig.host.deps.adapter, { awaitStarted: () => started.promise })
+    const reject = AgentSessionJournal.prototype.rejectQueuedSubmissions
+    vi.spyOn(AgentSessionJournal.prototype, 'rejectQueuedSubmissions').mockImplementation(function (
+      this: AgentSessionJournal,
+      ...args
+    ) {
+      // Not the open's sweep of an earlier process's leftovers.
+      if (args[1].rejection.kind !== 'hostRestarted') {
+        order.push(`rejected: ${args[1].reason}`)
+      }
+      return reject.apply(this, args)
+    })
+    const reader = collectSubscriber()
+    const attached = await rig.host.attach(CALLER, hostTestAttachParams(null))
+    expect(attached.ok).toBe(true)
+    await rig.host.subscribe({ id: 'reader', sessionId: SESSION, emit: reader.emit })
+    const sent = await rig.host.send(CALLER, restTestSend('stuck behind the start', fence()))
+    expect(sent.ok).toBe(true)
+    rig.clock.now += IDLE_MS + 1
+
+    await sweepOnce(rig.host)
+    expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION)
+    await vi.waitFor(() =>
+      expect(readerSaw(reader.events).submissions).toContainEqual(
+        expect.objectContaining({ dispatchState: 'rejected', reason: stopReason })
+      )
+    )
+    // One rejection, written after the stop by the loop, with the stop's own words.
+    expect(order).toEqual(['stopped', `rejected: ${stopReason}`])
+    const errorRows = reader.events.flatMap((event) =>
+      event.type === 'batch'
+        ? event.batch.items.filter(
+            (item) => item.body.kind === 'status' && item.body.tone === 'error'
+          )
+        : []
+    )
+    expect(errorRows.map((item) => (item.body.kind === 'status' ? item.body.text : null))).toEqual([
+      stopReason
+    ])
+    expect(rig.adapter.dispatch).not.toHaveBeenCalled()
+
+    const again = await rig.host.send(CALLER, restTestSend('try again', fence()))
+    expect(again.ok).toBe(true)
+    await vi.waitFor(() => expect(rig.adapter.dispatch).toHaveBeenCalledOnce(), COLD_START)
+    await expect(sweepOnce(rig.host)).resolves.toBeUndefined()
+  })
+})
+
+describe('the wind-down retry with a message queued (P2-31)', () => {
+  it('waits for the delivery rather than rejecting a message accepted after the failed stop', async () => {
+    const queued = { clientMessageId: 'm', dispatchState: 'pending', handoverRecorded: true }
+    const session = {
+      journal: {
+        submissions: () => [queued],
+        pendingSubmissions: () => [queued],
+        snapshot: () => ({ items: [] })
+      },
+      child: null,
+      owesProviderChildWindDown: { generation: 'generation-1', fence: 1 }
+    }
+    const stopAgent = vi.fn(async () => undefined)
+    const sweep = new StructuredAgentSessionIdleSweep({
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a session fixture carrying only the journal and child facts the sweep reads.
+      sessions: Object.assign(new Map([[SESSION, session as never]]), {
+        lastActivityAt: () => 0,
+        touch: () => undefined
+      }),
+      serialize: (_id, task) => task(),
+      now: () => IDLE_MS + 1,
+      isDisposed: () => false,
+      deliveryActive: () => true,
+      backgroundTaskState: () => undefined,
+      hasOpenDispatch: () => false,
+      stopAgent,
+      stopStartingAgent: stopAgent,
+      closeConversation: vi.fn(async () => false),
+      onError: (_id, error) => {
+        throw error
+      }
+    })
+    await sweep.tick()
+    expect(stopAgent).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-lifetime.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-lifetime.ts
new file mode 100644
index 00000000000..0fbd1a0a233
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-lifetime.ts
@@ -0,0 +1,148 @@
+// How a conversation is reached, closed and swept — the host's lifetime rules in one place.
+//
+// A conversation is reached only through `conversation`, which opens it at rest and starts no
+// agent. It closes when its tab closes or the idle sweep finds its handle is only a cache. Every
+// public entry point here takes the session's serialize once and calls the under-serialize forms,
+// because the queue is not reentrant.
+
+import {
+  AgentSessionRefusalError,
+  agentSessionRefusalError
+} from '../../../shared/agent-session-wire-refusals'
+import { createJournalOpenReadRefusals } from '../agent-session-journal/journal-open-failure'
+import type { StructuredAgentSessionConversations } from './structured-agent-session-conversations'
+import {
+  abandonQueuedStructuredAgentSessionMessages,
+  closeStructuredAgentSessionConversationUnderSerialize,
+  stopStructuredAgentSessionAgentUnderSerialize,
+  type StructuredAgentSessionLifetimeContext
+} from './structured-agent-session-host-lifetime'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+import { StructuredAgentSessionIdleSweep } from './structured-agent-session-idle-sweep'
+import { AGENT_SESSION_NOT_ATTACHED } from './structured-agent-session-mutation-admission'
+import { adapterSupportsRecord } from './structured-agent-session-provider-support'
+
+export type StructuredAgentSessionConversationLifetime = ReturnType<
+  typeof createStructuredAgentSessionConversationLifetime
+>
+
+export function createStructuredAgentSessionConversationLifetime(host: {
+  /** Resolved per call: the host's collaborators are assigned after this is built. */
+  context: () => StructuredAgentSessionLifetimeContext
+  sessions: StructuredAgentSessionConversations
+  serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
+  /** PR 1's one open function, for a caller inside the session's serialize. */
+  open: (sessionId: string) => Promise<StructuredAgentSessionHostSession | null>
+  deliveryActive: (sessionId: string) => boolean
+  /** The handle closed: `listed` keeps the chat's row in the agent-status store for its tab. */
+  closeStatus: (sessionId: string, options: { listed: boolean }) => void
+}) {
+  let disposed = false
+  const { sessions, serialize } = host
+  const deps = () => host.context().deps
+  const readRefusals = createJournalOpenReadRefusals()
+  // The sweep's stop puts an idle agent to rest: nothing is queued, so no loop reads its cause.
+  const stopAgent = (sessionId: string) =>
+    stopStructuredAgentSessionAgentUnderSerialize(host.context(), sessionId)
+
+  const closeConversation = (sessionId: string): Promise<boolean> =>
+    closeStructuredAgentSessionConversationUnderSerialize(
+      {
+        sessions,
+        closeStatus: (id) => {
+          const tabs = deps().store.getVisibleSessionTabIndex()
+          // A legacy store cannot say, so the row stays; restart is the boundary that forgets.
+          host.closeStatus(id, { listed: !tabs.present || tabs.sessionIds.includes(id) })
+        }
+      },
+      sessionId
+    )
+
+  const idleSweep = new StructuredAgentSessionIdleSweep({
+    sessions,
+    serialize,
+    now: () => host.context().now(),
+    isDisposed: () => disposed,
+    deliveryActive: host.deliveryActive,
+    backgroundTaskState: (sessionId) => deps().adapter.backgroundTaskState?.(sessionId),
+    hasOpenDispatch: (sessionId) => {
+      const record = deps().store.getRecord(sessionId)
+      return record !== null && deps().hasOpenDispatch?.(record) === true
+    },
+    stopAgent,
+    // A host stop: the delivery loop waiting on this child writes the one error row and rejects
+    // what is queued with it, both worded from the hostStopped fact.
+    stopStartingAgent: (sessionId) =>
+      stopStructuredAgentSessionAgentUnderSerialize(host.context(), sessionId, {
+        cause: 'host-stop'
+      }),
+    closeConversation,
+    onError: (sessionId, error) => deps().onEventSinkError?.({ sessionId, error }),
+    ...deps().idleSweep
+  })
+
+  return {
+    idleSweep,
+    stopAgent,
+    /** Quit has begun: nothing opens a conversation or sweeps one after this. */
+    dispose: (): void => {
+      disposed = true
+      idleSweep.dispose()
+    },
+    /**
+     * The only way any code reaches a session. An open conversation answers without the lock, so
+     * a read never waits behind a start; a closed one is opened once, under it. Nothing here
+     * touches the lease or starts a child. Use the result before the next `await`: a close can
+     * drop it after.
+     */
+    conversation: async (sessionId: string): Promise<StructuredAgentSessionHostSession> => {
+      const open = sessions.get(sessionId)
+      if (open) {
+        readRefusals.forget(sessionId)
+        return open
+      }
+      const record = deps().store.getRecord(sessionId)
+      if (!record) {
+        throw agentSessionRefusalError('agent_session_identity_required', {
+          reason: 'recordMissing'
+        })
+      }
+      if (!adapterSupportsRecord(deps().adapter, record)) {
+        throw agentSessionRefusalError('structured_agent_session_unsupported', {
+          reason: 'hostUnsupported'
+        })
+      }
+      return serialize(sessionId, async () => {
+        // Read at the open itself: a read queued before quit began runs after it.
+        if (disposed) {
+          throw new AgentSessionRefusalError(AGENT_SESSION_NOT_ATTACHED)
+        }
+        const session = await host.open(sessionId).catch((error: unknown) => {
+          throw readRefusals.refusal(sessionId, error)
+        })
+        if (!session) {
+          throw agentSessionRefusalError('agent_session_identity_required', {
+            reason: 'recordMissing'
+          })
+        }
+        readRefusals.forget(sessionId)
+        return session
+      })
+    },
+    /** Ends a chat's resources, not the chat: its record and journal stay on disk, and what is
+     *  still queued will not be sent. */
+    close: (sessionId: string): Promise<void> =>
+      serialize(sessionId, async () => {
+        readRefusals.forget(sessionId)
+        const session = sessions.get(sessionId)
+        if (session) {
+          // Abandoned before the stop, so no start delivers it.
+          await abandonQueuedStructuredAgentSessionMessages(deps(), sessionId, session.journal)
+        }
+        await stopStructuredAgentSessionAgentUnderSerialize(host.context(), sessionId, {
+          cause: 'evict'
+        })
+        await closeConversation(sessionId)
+      })
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-open.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-open.ts
new file mode 100644
index 00000000000..dd8853954e3
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-open.ts
@@ -0,0 +1,186 @@
+// The one way a conversation's journal becomes open on this host: for a send, for a reader, and
+// for an attach that finds none open.
+//
+// It opens with recovery, so an unusable journal is rebuilt rather than refused, and it marks what
+// an earlier host process handed over and left unanswered as in doubt, and settles what it left
+// running — the crash boundary. That
+// needs no lease: provider history decides such a row later, under a won lease, in the attach. A
+// row an earlier process accepted and never handed over is the delivery loop's, which the open
+// wakes. Nothing here starts a provider child.
+
+import type { AgentJournalResetReason } from '../../../shared/agent-session-journal-types'
+import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { openAgentSessionJournalWithRecovery } from './agent-session-journal-recovery'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import {
+  attachFingerprintFields,
+  journalIdentityFor,
+  type AgentSessionAttachParams
+} from './structured-agent-session-attach'
+import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { settleStaleStructuredAgentSessionState } from './structured-agent-session-dead-generation-settlement'
+import { structuredAgentSessionFailureWordsContext } from './structured-agent-session-send-preparation'
+import type {
+  StructuredAgentSessionHostDeps,
+  StructuredAgentSessionHostSession
+} from './structured-agent-session-host-types'
+
+export type OpenedStructuredAgentSessionConversation = {
+  session: StructuredAgentSessionHostSession
+  /** Set when the journal was rebuilt on the way; readers reload from a snapshot. */
+  reset: AgentJournalResetReason | null
+}
+
+export type StructuredAgentSessionConversationOpenDeps = {
+  store: Pick<AgentSessionRecordStore, 'getRecord'>
+  adapter: Pick<StructuredAgentSessionAdapter, 'historyFilePath'>
+  journalRoot: string
+  onEventSinkError?: StructuredAgentSessionHostDeps['onEventSinkError']
+}
+
+/** An acquisition's own open: its reserve cleared the record's death evidence, so it settles
+ *  what the gone generation left running itself, from what it read before. */
+export type StructuredAgentSessionConversationOpenOptions = { acquisition?: boolean }
+
+export type StructuredAgentSessionConversationOpenContext = {
+  deps: StructuredAgentSessionConversationOpenDeps
+  sessions: Map<string, StructuredAgentSessionHostSession>
+  /** Indexes a conversation that just became open; the host publishes it and wakes delivery. */
+  adoptOpened: (
+    sessionId: string,
+    opened: OpenedStructuredAgentSessionConversation
+  ) => Promise<void>
+}
+
+/** The open conversation, or null when this host has no record of it. For a caller inside the
+ *  session's serialize, which is what makes "not open yet" exact. */
+export async function openStructuredAgentSessionConversation(
+  context: StructuredAgentSessionConversationOpenContext,
+  sessionId: string,
+  options: StructuredAgentSessionConversationOpenOptions = {}
+): Promise<StructuredAgentSessionHostSession | null> {
+  const open = context.sessions.get(sessionId)
+  if (open) {
+    return open
+  }
+  const record = context.deps.store.getRecord(sessionId)
+  if (!record) {
+    return null
+  }
+  const opened = await openStructuredAgentSessionConversationJournal(context.deps, record, options)
+  await context.adoptOpened(sessionId, opened)
+  return opened.session
+}
+
+/** The open itself, indexed by nobody yet: the caller adopts the result. */
+export async function openStructuredAgentSessionConversationJournal(
+  deps: Omit<StructuredAgentSessionConversationOpenDeps, 'store'>,
+  record: AgentSessionRecord,
+  options: StructuredAgentSessionConversationOpenOptions = {}
+): Promise<OpenedStructuredAgentSessionConversation> {
+  const { sessionId } = record
+  const fence = record.lease.runtimeFence
+  const params = attachParamsForRecord(record, {
+    clientOperationId: `read-restore:${sessionId}`,
+    expectedRuntimeFence: fence
+  })
+  const identity = journalIdentityFor(record, params)
+  const opened = await openAgentSessionJournalWithRecovery({
+    identity,
+    journalDir: journalDirectoryFor(deps.journalRoot, {
+      workspaceId: record.location.workspaceId,
+      sessionId
+    }),
+    fence,
+    historyFilePath: (await deps.adapter.historyFilePath?.({ identity })) ?? null
+  })
+  try {
+    // A queued row found here is a leftover the delivery loop's first step rejects; a handed-over
+    // one is only doubt, which provider history decides under a won lease.
+    await opened.journal.markPendingSubmissionsUnknown(fence)
+  } catch (error) {
+    deps.onEventSinkError?.({ sessionId, error })
+  }
+  // No child in this process writes to a journal nobody had open, so whatever it shows running
+  // belongs to a generation that is gone, whatever the lease still claims. Settled before any
+  // reader or child sees it.
+  if (!options.acquisition) {
+    await settleGoneGeneration(deps, record, opened.journal)
+  }
+  return {
+    session: { journal: opened.journal, params, child: null },
+    reset: opened.recovery?.reset ?? null
+  }
+}
+
+/**
+ * The open's settle again, for a conversation already open: a proof of death written since it
+ * opened (the startup reconcile, a recovery) revises what the open could only call `unverifiable`.
+ * A record holds a proof only while released, so no child here is writing. A no-op once revised.
+ */
+export async function resettleOpenStructuredAgentSessionConversation(
+  deps: StructuredAgentSessionConversationOpenDeps,
+  sessionId: string,
+  session: StructuredAgentSessionHostSession | undefined
+): Promise<void> {
+  const record = deps.store.getRecord(sessionId)
+  if (session && record?.lease.deathEvidence) {
+    await settleGoneGeneration(deps, record, session.journal)
+  }
+}
+
+async function settleGoneGeneration(
+  deps: Pick<StructuredAgentSessionConversationOpenDeps, 'onEventSinkError'>,
+  record: AgentSessionRecord,
+  journal: AgentSessionJournal
+): Promise<void> {
+  try {
+    await settleStaleStructuredAgentSessionState({
+      journal,
+      sessionId: record.sessionId,
+      fence: record.lease.runtimeFence,
+      acquisitionGeneration: null,
+      deathEvidence: record.lease.deathEvidence ?? null,
+      failureTextContext: structuredAgentSessionFailureWordsContext(record)
+    })
+  } catch (error) {
+    // Best effort: the next open or acquire re-derives it.
+    deps.onEventSinkError?.({ sessionId: record.sessionId, error })
+  }
+}
+
+export function attachParamsForRecord(
+  record: AgentSessionRecord,
+  input: {
+    clientOperationId: string
+    expectedRuntimeFence: number
+  }
+): AgentSessionAttachParams {
+  const params: AgentSessionAttachParams = {
+    envelope: {
+      sessionId: record.sessionId,
+      clientOperationId: input.clientOperationId,
+      expectedRuntimeFence: input.expectedRuntimeFence,
+      payloadFingerprint: ''
+    },
+    location: record.location,
+    provider: record.provider,
+    agent: record.provider,
+    accountHome: record.accountHome,
+    runtimeKind: 'native'
+  }
+  return {
+    ...params,
+    envelope: {
+      ...params.envelope,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.attach',
+        sessionId: record.sessionId,
+        fields: attachFingerprintFields(params)
+      })
+    }
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-stop.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-stop.test.ts
new file mode 100644
index 00000000000..ab0368a6b92
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-stop.test.ts
@@ -0,0 +1,277 @@
+// A Stop that names no turn stops what the conversation has in flight: it withdraws what is
+// queued, and interrupts a handed-over message even before the provider has opened its turn —
+// the gap no client can name a turn for. Against the real host, store and journal.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
+import { DISPATCH_REJECTED_CANCELLED } from '../../../shared/structured-agent-session-dispatch-rejection'
+import { CancelParams } from '../../../shared/rpc-contract/structured-agent-session-params'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+const CALLER = { callerKey: 'client-1' }
+const ALREADY_FINISHED = 'The provider had already finished this turn.'
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let dispatch: Mock<StructuredAgentSessionAdapter['dispatch']>
+let cancelTurn: Mock<StructuredAgentSessionAdapter['cancelTurn']>
+let awaitStarted: Mock<NonNullable<StructuredAgentSessionAdapter['awaitStarted']>>
+
+function eventually(assertion: () => void | Promise<void>): Promise<void> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-conversation-stop-'))
+  resetHostTestOperationIds()
+  // Admitted, not accepted: the message is written and its turn has not opened.
+  dispatch = vi.fn(async () => ({ state: 'admitted' as const }))
+  cancelTurn = vi.fn(async () => ({ cancelled: true }))
+  awaitStarted = vi.fn(async () => undefined)
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: {
+      acquire: async ({ fence, spawnToken }) => ({
+        process: { hostId: 'local', pid: 4242, processStartTimeMs: 1_700_000_000_000, spawnToken },
+        acquisitionGeneration: 'generation-1',
+        link: {
+          linkId: `link-${fence}`,
+          handle: { provider: 'codex' as const, threadId: THREAD },
+          origin: 'created' as const,
+          mintedAtFence: fence,
+          observedAt: NOW
+        }
+      }),
+      dispatch,
+      awaitStarted,
+      closeSession: vi.fn(async () => true),
+      releaseAcquisition: vi.fn(async () => true),
+      cancelTurn,
+      answerPrompt: vi.fn(async () => undefined),
+      setOption: vi.fn(async () => undefined)
+    },
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-1',
+    now: () => NOW
+  })
+  expect(await host.attach(CALLER, hostTestAttachParams(null))).toMatchObject({ ok: true })
+})
+
+afterEach(async () => {
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+function send(text: string) {
+  const body = hostTestMessage(text)
+  const clientOperationId = hostTestOperationId()
+  const result = host.send(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId,
+      expectedRuntimeFence: 1,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    },
+    body
+  })
+  return { id: clientOperationId, result }
+}
+
+function stop(turnId?: string, clientOperationId = hostTestOperationId()) {
+  const fields = turnId === undefined ? {} : { turnId }
+  return host.cancel(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId,
+      expectedRuntimeFence: null,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.cancel',
+        sessionId: SESSION,
+        fields
+      })
+    },
+    ...fields
+  })
+}
+
+async function submission(id: string): Promise<AgentJournalSubmission | undefined> {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === id
+  )
+}
+
+async function statusRows(): Promise<string[]> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status' ? [item.body.text] : []
+  )
+}
+
+describe('a Stop that names no turn', () => {
+  it('is a valid cancel, and only a plain Stop may omit the turn', () => {
+    const envelope = {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: 1,
+      payloadFingerprint: '0'.repeat(64)
+    }
+    expect(CancelParams.safeParse({ envelope }).success).toBe(true)
+    expect(
+      CancelParams.safeParse({ envelope, prompt: { itemId: 'item-1', expectedRevision: 1 } })
+        .success
+    ).toBe(false)
+    expect(CancelParams.safeParse({ envelope, scope: 'background-tasks' }).success).toBe(false)
+  })
+
+  it('interrupts a handed-over message before its turn opens, as a cancellation', async () => {
+    const { id, result } = send('hello')
+    await result
+    await eventually(async () => expect((await submission(id))?.handedOverAt).toBeDefined())
+    expect(
+      (await host.journalSnapshot(SESSION)).items.some((item) => item.body.kind === 'turn')
+    ).toBe(false)
+
+    const stopped = await stop()
+
+    expect(stopped).toEqual({
+      ok: true,
+      replayed: false,
+      fence: 1,
+      cursor: expect.anything(),
+      value: { cancelled: true }
+    })
+    expect(cancelTurn).toHaveBeenCalledTimes(1)
+    expect(cancelTurn.mock.calls[0]![0]).not.toHaveProperty('turnId')
+    expect(cancelTurn.mock.calls[0]![0]).toMatchObject({ sessionId: SESSION, fence: 1 })
+    expect(await statusRows()).toEqual(['Cancellation requested.'])
+  })
+
+  it('withdraws what is queued on a ready child and asks the provider for nothing more', async () => {
+    const started = Promise.withResolvers<undefined>()
+    awaitStarted.mockImplementationOnce(() => started.promise)
+    const { id, result } = send('hello')
+    await result
+    await eventually(() => expect(awaitStarted).toHaveBeenCalled())
+
+    expect(await stop()).toMatchObject({ ok: true, value: { cancelled: true } })
+    started.resolve(undefined)
+
+    expect(await submission(id)).toMatchObject({
+      dispatchState: 'rejected',
+      reason: DISPATCH_REJECTED_CANCELLED
+    })
+    expect(cancelTurn).not.toHaveBeenCalled()
+    await host.flushStreamedEvents(SESSION)
+    expect(dispatch).not.toHaveBeenCalled()
+    expect(await statusRows()).toEqual([])
+  })
+
+  it('withdraws a send still on its way in, which the host takes first', async () => {
+    const { id, result } = send('hello')
+    const stopped = stop()
+
+    expect(await result).toMatchObject({ ok: true })
+    expect(await stopped).toMatchObject({ ok: true, value: { cancelled: true } })
+    expect(await submission(id)).toMatchObject({
+      dispatchState: 'rejected',
+      reason: DISPATCH_REJECTED_CANCELLED
+    })
+    await host.flushStreamedEvents(SESSION)
+    expect(dispatch).not.toHaveBeenCalled()
+  })
+
+  it('says the agent did not stop, in its words, when it refused', async () => {
+    const { id, result } = send('hello')
+    await result
+    await eventually(async () => expect((await submission(id))?.handedOverAt).toBeDefined())
+    cancelTurn.mockResolvedValueOnce({
+      cancelled: false,
+      refusal: { detail: { text: 'no active turn to interrupt', audience: 'person' } }
+    })
+
+    expect(await stop()).toMatchObject({ ok: true, value: { cancelled: false } })
+
+    expect(cancelTurn).toHaveBeenCalledOnce()
+    expect(await statusRows()).toEqual(["Codex didn't stop: no active turn to interrupt."])
+  })
+
+  it('says the Stop is unconfirmed, not that nothing ran, when the provider took it', async () => {
+    const { id, result } = send('hello')
+    await result
+    await eventually(async () => expect((await submission(id))?.handedOverAt).toBeDefined())
+    cancelTurn.mockResolvedValueOnce({ cancelled: false, unconfirmed: true })
+
+    expect(await stop()).toMatchObject({ ok: true, value: { cancelled: false } })
+
+    expect(await statusRows()).toEqual(['Cancellation was not confirmed.'])
+  })
+
+  it('says the agent had no turn to stop when it had none', async () => {
+    const { id, result } = send('hello')
+    await result
+    await eventually(async () => expect((await submission(id))?.handedOverAt).toBeDefined())
+    cancelTurn.mockResolvedValueOnce({ cancelled: false })
+
+    expect(await stop()).toMatchObject({ ok: true, value: { cancelled: false } })
+
+    expect(await statusRows()).toEqual(['Codex had no turn running to stop.'])
+  })
+
+  it('stops nothing when it reuses the id of a Stop the host already ran', async () => {
+    const operationId = hostTestOperationId()
+    expect(await stop(undefined, operationId)).toMatchObject({ ok: true, replayed: false })
+    const { id, result } = send('hello')
+    await result
+    await eventually(async () => expect((await submission(id))?.handedOverAt).toBeDefined())
+
+    // Why the client never reuses a no-turn Stop's id: the same id is the same Stop.
+    expect(await stop(undefined, operationId)).toMatchObject({
+      ok: true,
+      replayed: true,
+      value: { cancelled: false }
+    })
+    expect(cancelTurn).not.toHaveBeenCalled()
+    expect(await stop()).toMatchObject({ ok: true, value: { cancelled: true } })
+    expect(cancelTurn).toHaveBeenCalledOnce()
+  })
+
+  it('is a quiet no-op with nothing in flight', async () => {
+    expect(await stop()).toMatchObject({ ok: true, value: { cancelled: false } })
+    expect(cancelTurn).not.toHaveBeenCalled()
+    expect(await statusRows()).toEqual([])
+  })
+})
+
+describe('a Stop that names its turn, as an older client sends it', () => {
+  it('reaches the provider with that turn and keeps its not-cancelled note', async () => {
+    cancelTurn.mockResolvedValueOnce({ cancelled: false })
+
+    expect(await stop('turn-1')).toMatchObject({
+      ok: true,
+      value: { turnId: 'turn-1', cancelled: false }
+    })
+    expect(cancelTurn).toHaveBeenCalledWith(expect.objectContaining({ turnId: 'turn-1' }))
+    expect(await statusRows()).toEqual([ALREADY_FINISHED])
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-conversations.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-conversations.test.ts
new file mode 100644
index 00000000000..954525c6429
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-conversations.test.ts
@@ -0,0 +1,161 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { AgentSessionJournalIdentity } from '../../../shared/agent-session-journal-types'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
+import { StructuredAgentSessionConversations } from './structured-agent-session-conversations'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+import { hostTestAttachParams } from './structured-agent-session-host-test-data'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: 'session-1',
+  workspaceId: 'workspace-1',
+  hostId: 'host-1',
+  agent: 'codex',
+  providerHandle: { kind: 'codex', threadId: 'thread-1' }
+}
+
+const journals = createTrackedJournalOpener()
+let root: string | null = null
+
+afterEach(async () => {
+  await journals.closeAll()
+  if (root) {
+    await rm(root, { recursive: true, force: true })
+    root = null
+  }
+})
+
+async function openJournal(name: string): Promise<AgentSessionJournal> {
+  root ??= await mkdtemp(join(tmpdir(), 'orca-conversations-'))
+  return journals.open({ identity: IDENTITY, journalDir: join(root, name) })
+}
+
+function session(journal: AgentSessionJournal) {
+  return {
+    journal,
+    params: hostTestAttachParams(null),
+    child: null
+  }
+}
+
+function appendStatus(journal: AgentSessionJournal, text: string) {
+  return journal.appendItem(
+    { provider: 'orca', clientMessageId: text },
+    { kind: 'status', text },
+    { fence: 0, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+  )
+}
+
+describe('a conversation delivers what its journal commits', () => {
+  it('delivers an append that no writer published', async () => {
+    const deliver = vi.fn()
+    const conversations = new StructuredAgentSessionConversations({
+      deliver,
+      onDeliveryError: vi.fn(),
+      now: () => 0
+    })
+    const journal = await openJournal('a')
+    conversations.set('session-1', session(journal))
+
+    await appendStatus(journal, 'written')
+
+    // Already delivered when the writer's await returns, as an explicit publish would have been.
+    expect(deliver).toHaveBeenCalledOnce()
+    expect(deliver).toHaveBeenCalledWith('session-1', journal)
+  })
+
+  it('binds a handle set through a plain map reference', async () => {
+    const deliver = vi.fn()
+    // Collaborators hold the host's map as a plain `Map`; `set` still reaches the binding.
+    const sessions: Map<string, StructuredAgentSessionHostSession> =
+      new StructuredAgentSessionConversations({
+        deliver,
+        onDeliveryError: vi.fn(),
+        now: () => 0
+      })
+    const journal = await openJournal('a')
+    sessions.set('session-1', session(journal))
+
+    await appendStatus(journal, 'through the plain map')
+
+    expect(deliver).toHaveBeenCalledExactlyOnceWith('session-1', journal)
+  })
+
+  it('delivers an epoch replacement, which readers must reload from', async () => {
+    const deliver = vi.fn()
+    const conversations = new StructuredAgentSessionConversations({
+      deliver,
+      onDeliveryError: vi.fn(),
+      now: () => 0
+    })
+    const journal = await openJournal('a')
+    conversations.set('session-1', session(journal))
+
+    await journal.replaceEpochItems('handle_forked', 0, [])
+
+    expect(deliver).toHaveBeenCalledExactlyOnceWith('session-1', journal)
+  })
+
+  it('delivers nothing for a handle the conversation has replaced', async () => {
+    const deliver = vi.fn()
+    const conversations = new StructuredAgentSessionConversations({
+      deliver,
+      onDeliveryError: vi.fn(),
+      now: () => 0
+    })
+    const replaced = await openJournal('a')
+    const current = await openJournal('b')
+    conversations.set('session-1', session(replaced))
+    conversations.set('session-1', session(current))
+
+    await appendStatus(replaced, 'stale')
+    expect(deliver).not.toHaveBeenCalled()
+
+    await appendStatus(current, 'live')
+    expect(deliver).toHaveBeenCalledExactlyOnceWith('session-1', current)
+  })
+
+  it('delivers nothing once the conversation is dropped', async () => {
+    const deliver = vi.fn()
+    const conversations = new StructuredAgentSessionConversations({
+      deliver,
+      onDeliveryError: vi.fn(),
+      now: () => 0
+    })
+    const journal = await openJournal('a')
+    conversations.set('session-1', session(journal))
+    conversations.delete('session-1')
+
+    await appendStatus(journal, 'after close')
+
+    expect(deliver).not.toHaveBeenCalled()
+  })
+
+  it('reports a reader failure without failing the durable write', async () => {
+    const failure = new Error('reader failed')
+    const onDeliveryError = vi.fn()
+    const conversations = new StructuredAgentSessionConversations({
+      deliver: () => {
+        throw failure
+      },
+      onDeliveryError,
+      now: () => 0
+    })
+    const journal = await openJournal('a')
+    conversations.set('session-1', session(journal))
+
+    await expect(appendStatus(journal, 'durable')).resolves.toMatchObject({
+      itemId: expect.any(String)
+    })
+
+    expect(onDeliveryError).toHaveBeenCalledExactlyOnceWith('session-1', failure)
+    expect(journal.snapshot().items.map((item) => item.body)).toContainEqual({
+      kind: 'status',
+      text: 'durable'
+    })
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-conversations.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-conversations.ts
new file mode 100644
index 00000000000..c312d6013fd
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-conversations.ts
@@ -0,0 +1,73 @@
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+
+/**
+ * The host's open conversations. A journal handle becomes a conversation's when it is set here,
+ * and from then on every change it commits reaches that conversation's readers: no writer
+ * publishes what it appended, so none can forget to.
+ *
+ * Delivery runs a microtask after the commit, so a reader that throws cannot fail a write that is
+ * already durable. A handle this map has since replaced or dropped delivers nothing.
+ *
+ * Each entry also carries when it last saw activity — its open, then every journal publish — which
+ * is the idle sweep's clock. In memory only, so it dies with the entry.
+ */
+export class StructuredAgentSessionConversations extends Map<
+  string,
+  StructuredAgentSessionHostSession
+> {
+  private readonly activity = new Map<string, number>()
+
+  constructor(
+    private readonly delivery: {
+      deliver: (sessionId: string, journal: AgentSessionJournal) => void
+      onDeliveryError: (sessionId: string, error: unknown) => void
+      /** A conversation became held: state that waited on it (queued drafts) re-derives. */
+      onOpened?: (sessionId: string) => void
+      now: () => number
+    }
+  ) {
+    super()
+  }
+
+  override set(sessionId: string, session: StructuredAgentSessionHostSession): this {
+    const { journal } = session
+    let queued = false
+    journal.observeCommits(() => {
+      if (queued) {
+        return
+      }
+      queued = true
+      queueMicrotask(() => {
+        queued = false
+        if (this.get(sessionId)?.journal !== journal) {
+          return
+        }
+        try {
+          this.delivery.deliver(sessionId, journal)
+        } catch (error) {
+          this.delivery.onDeliveryError(sessionId, error)
+        }
+      })
+    })
+    this.activity.set(sessionId, this.delivery.now())
+    const adopted = super.set(sessionId, session)
+    this.delivery.onOpened?.(sessionId)
+    return adopted
+  }
+
+  override delete(sessionId: string): boolean {
+    this.activity.delete(sessionId)
+    return super.delete(sessionId)
+  }
+
+  touch(sessionId: string): void {
+    if (this.has(sessionId)) {
+      this.activity.set(sessionId, this.delivery.now())
+    }
+  }
+
+  lastActivityAt(sessionId: string): number | undefined {
+    return this.activity.get(sessionId)
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-crash-mid-start.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-crash-mid-start.test.ts
new file mode 100644
index 00000000000..6e364ccb477
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-crash-mid-start.test.ts
@@ -0,0 +1,237 @@
+// A host that dies while its Codex child is still starting leaves a lease behind. The child's
+// identity is committed the moment it spawns, before the handshake, so the next host can stop that
+// exact process and start over instead of guessing whether anything is running.
+
+import { cp, mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS,
+  AGENT_SESSION_OPERATION_FUTURE_SKEW_MS
+} from '../../../shared/agent-session-host-authority'
+import type { AgentSessionOwnerProbe } from '../../../shared/agent-session-lease-adjudication'
+import type { openCodexAppServerConnection } from '../../codex/codex-app-server-connection'
+import { adapterFor, fakeCodex } from '../../codex/codex-structured-session-adapter-fixture'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  hostTestAttachParams,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+const CALLER = { callerKey: 'client-1' }
+const CHILD_PID = 4321
+
+let root: string
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-crash-mid-start-'))
+  resetHostTestOperationIds()
+})
+
+afterEach(async () => {
+  await rm(root, { recursive: true, force: true })
+})
+
+type HostGeneration = 'dying' | 'relaunched'
+
+/** Each generation's files. The relaunch opens a copy taken at the crash: the dying host stays in
+ *  this process with its attach still pending, and a dead process writes nothing after it dies. */
+function generationRoot(generation: HostGeneration): string {
+  return join(root, generation)
+}
+
+async function crash(dying: AgentSessionRecordStore): Promise<void> {
+  // An empty renewal queues behind every write the dying host committed, so they are on disk.
+  await dying.renewLeases([])
+  await cp(generationRoot('dying'), generationRoot('relaunched'), {
+    recursive: true,
+    // A write still in flight at the crash never landed, and a dead process holds no lock.
+    filter: (source) => !source.endsWith('.tmp') && !source.includes('.lock')
+  })
+}
+
+function openStore(generation: HostGeneration): Promise<AgentSessionRecordStore> {
+  return AgentSessionRecordStore.open({
+    directory: join(generationRoot(generation), 'store'),
+    hostId: 'local'
+  })
+}
+
+/** A Codex adapter whose child spawns, reports its pid the way the real connection does, and then
+ *  never answers the thread handshake: the host dies in that window. */
+function adapterThatNeverFinishesStarting(): StructuredAgentSessionAdapter {
+  const codex = fakeCodex({
+    'thread/start': () => new Promise(() => {}),
+    'thread/resume': () => new Promise(() => {})
+  })
+  const openConnection: typeof openCodexAppServerConnection = async (launch, handlers = {}) => {
+    const connection = await codex.openConnection(launch, handlers)
+    await handlers.onSpawned?.(CHILD_PID)
+    return connection
+  }
+  return Object.assign(adapterFor({ ...codex, openConnection }), { supportsCreate: () => true })
+}
+
+/** A Codex adapter whose child never gets as far as reporting its pid: the reservation is all the
+ *  next host finds. */
+function adapterThatNeverSpawns(): StructuredAgentSessionAdapter {
+  const codex = fakeCodex()
+  const openConnection: typeof openCodexAppServerConnection = () => new Promise(() => {})
+  return Object.assign(adapterFor({ ...codex, openConnection }), { supportsCreate: () => true })
+}
+
+function host(
+  generation: HostGeneration,
+  store: AgentSessionRecordStore,
+  adapter: StructuredAgentSessionAdapter,
+  overrides: Partial<StructuredAgentSessionHostDeps> = {}
+): StructuredAgentSessionHost {
+  return new StructuredAgentSessionHost({
+    store,
+    adapter,
+    journalRoot: generationRoot(generation),
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-a',
+    now: () => NOW,
+    ...overrides
+  })
+}
+
+describe('a host that dies while its Codex child is starting', () => {
+  it('leaves the spawned child recorded, so the next host stops it by identity and starts over', async () => {
+    const first = await openStore('dying')
+    const dying = host('dying', first, adapterThatNeverFinishesStarting())
+    void dying.attach(CALLER, hostTestAttachParams(null)).catch(() => {})
+    await vi.waitFor(() => expect(first.getRecord(SESSION)?.lease.ownerProcess).toBeTruthy())
+    // Durable before the handshake returned: the only record the next host will have.
+    expect(first.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'reserved',
+      handoffStage: 'new-owner-proving',
+      ownerProcess: { pid: CHILD_PID, spawnToken: 'spawn-a' }
+    })
+
+    // The relaunch. The orphan is still alive until something stops it.
+    let orphanAlive = true
+    const stopOwnerProcess = vi.fn(() => {
+      orphanAlive = false
+    })
+    const restarted = fakeCodex()
+    await crash(first)
+    const store = await openStore('relaunched')
+    const relaunched = host(
+      'relaunched',
+      store,
+      Object.assign(adapterFor(restarted), { supportsCreate: () => true }),
+      {
+        mintSpawnToken: () => 'spawn-b',
+        probeOwner: async () =>
+          orphanAlive
+            ? { outcome: 'identity-matched', matchedOn: ['spawn-token'] }
+            : { outcome: 'pid-absent' },
+        stopOwnerProcess
+      }
+    )
+    await relaunched.restoreReadableSessions()
+
+    expect(stopOwnerProcess).toHaveBeenCalledWith(CHILD_PID, 'SIGTERM')
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
+      handoffStage: null,
+      ownerProcess: null,
+      deathEvidence: { kind: 'pid-absent' }
+    })
+    // What the next send's delivery does: start at the record's current fence.
+    const fence = store.getRecord(SESSION)?.lease.runtimeFence ?? null
+    expect(await relaunched.attach(CALLER, hostTestAttachParams(fence))).toMatchObject({ ok: true })
+    expect(restarted.connections).toHaveLength(1)
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'live',
+      ownerProcess: { spawnToken: 'spawn-b' }
+    })
+  })
+})
+
+// The client keeps a create it never heard back from and retries it under the same operation id, so
+// that replay, not a fresh start, is what the user's Retry and first send go through.
+describe('a create replayed after the host that ran it died', () => {
+  const PAST_OPERATION_EXPIRY =
+    AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS + AGENT_SESSION_OPERATION_FUTURE_SKEW_MS + 60_000
+
+  it.each([
+    ['its child was recorded', adapterThatNeverFinishesStarting, 0],
+    [
+      'its child was recorded, and its operation row has since expired',
+      adapterThatNeverFinishesStarting,
+      PAST_OPERATION_EXPIRY
+    ],
+    ['nothing was recorded beyond the reservation', adapterThatNeverSpawns, 0],
+    [
+      'nothing was recorded, and its operation row has since expired',
+      adapterThatNeverSpawns,
+      PAST_OPERATION_EXPIRY
+    ]
+  ] as const)('starts an agent when %s', async (_case, dyingAdapter, elapsedMs) => {
+    const params = hostTestAttachParams(null)
+    const first = await openStore('dying')
+    const dying = host('dying', first, dyingAdapter())
+    void dying.attach(CALLER, params).catch(() => {})
+    await vi.waitFor(() =>
+      expect(first.getRecord(SESSION)?.lease).toMatchObject(
+        dyingAdapter === adapterThatNeverSpawns
+          ? { claimStatus: 'reserved' }
+          : { claimStatus: 'reserved', ownerProcess: { pid: CHILD_PID } }
+      )
+    )
+
+    const restarted = fakeCodex()
+    await crash(first)
+    const store = await openStore('relaunched')
+    const relaunched = host(
+      'relaunched',
+      store,
+      Object.assign(adapterFor(restarted), { supportsCreate: () => true }),
+      {
+        mintSpawnToken: () => 'spawn-b',
+        // A reservation with no pid probes indeterminate: no token scan off Linux.
+        probeOwner: async (record): Promise<AgentSessionOwnerProbe> =>
+          record.lease.ownerProcess
+            ? { outcome: 'pid-absent' }
+            : { outcome: 'indeterminate', reason: 'spawn token scan unavailable' },
+        now: () => NOW + elapsedMs
+      }
+    )
+    await relaunched.restoreReadableSessions()
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
+      handoffStage: null,
+      runtimeFence: 2
+    })
+
+    const replayed = await relaunched.attach(CALLER, params)
+    // Before, `agent_session_ownership_unknown` while the row was pending, then `_operation_expired`.
+    expect(replayed.ok ? null : replayed.refusal.code).toBeNull()
+    expect(replayed).toMatchObject({ ok: true, value: { sessionId: SESSION, fence: 3 } })
+    expect(restarted.connections).toHaveLength(1)
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'live',
+      runtimeFence: 3,
+      ownerProcess: { spawnToken: 'spawn-b' }
+    })
+    expect(
+      store.getOperationRow(CALLER.callerKey, params.envelope.clientOperationId)?.outcome
+    ).toEqual({ status: 'succeeded', sessionId: SESSION })
+
+    // Settled now: the same id replays that answer and never starts a second agent.
+    await expect(relaunched.attach(CALLER, params)).resolves.toMatchObject({
+      ok: true,
+      replayed: true
+    })
+    expect(restarted.connections).toHaveLength(1)
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-crash-turn-end.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-crash-turn-end.test.ts
new file mode 100644
index 00000000000..f91c8baba15
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-crash-turn-end.test.ts
@@ -0,0 +1,537 @@
+// Where a turn a crash cut short ends, when the provider wrote nothing while it worked.
+//
+// Claude reports a Bash call once when it starts and again only when it finishes, so a command
+// that runs for half a minute leaves one journal row at its start. The lease renewal the host
+// wrote every ten seconds is what saw the child working after that row.
+
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentSessionOwnerProbe } from '../../../shared/agent-session-lease-adjudication'
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import type { AgentSessionSubscribeEvent } from '../../../shared/agent-session-wire'
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
+import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
+import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
+import {
+  completedStructuredAgentTurnSeconds,
+  selectStructuredAgentTurnTimings
+} from '../../../shared/structured-agent-session-turn-timing'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { AGENT_SESSION_STORE_FILE_NAME } from '../../runtime/agent-session-record-store-file'
+import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
+import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import {
+  AgentSessionAcquisitionExitUnprovenError,
+  type StructuredAgentSessionAdapter
+} from './structured-agent-session-adapter'
+import { resettleOpenStructuredAgentSessionConversation } from './structured-agent-session-conversation-open'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import { STRUCTURED_AGENT_SESSION_IDLE_MS } from './structured-agent-session-idle-sweep'
+import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
+import {
+  hostTestAttachParams,
+  HOST_TEST_LOCATION as LOCATION,
+  HOST_TEST_SESSION as SESSION
+} from './structured-agent-session-host-test-data'
+
+const PROVIDER_SESSION = 'provider-session-alpha-1'
+/** The tool call's row: the last thing the provider wrote before the crash. */
+const TOOL_STARTED_AT = 1_800_000_000_000
+/** The last renewal before the crash, while the command was still running. */
+const LAST_RENEWED_AT = TOOL_STARTED_AT + 25_000
+/** Orca comes back an hour later. */
+const RELAUNCHED_AT = TOOL_STARTED_AT + 60 * 60 * 1000
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+
+function crashedClaudeRecord(): AgentSessionRecord {
+  const linkId = 'claude-13-link'
+  return {
+    schemaVersion: 2,
+    sessionId: SESSION,
+    location: LOCATION,
+    provider: 'claude',
+    providerHandleChain: [
+      {
+        linkId,
+        handle: { provider: 'claude', sessionId: PROVIDER_SESSION, leafUuid: null },
+        origin: 'created',
+        mintedAtFence: 13,
+        observedAt: TOOL_STARTED_AT - 60_000
+      }
+    ],
+    accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: '/home/dev/.claude' },
+    createdAt: TOOL_STARTED_AT - 60_000,
+    updatedAt: LAST_RENEWED_AT,
+    lease: {
+      sessionId: SESSION,
+      runtimeKind: 'native',
+      runtimeFence: 13,
+      handoffStage: null,
+      provenHandleLinkId: linkId,
+      ownerProcess: {
+        hostId: 'local',
+        pid: 12_546,
+        processStartTimeMs: TOOL_STARTED_AT - 60_000,
+        spawnToken: 'spawn-crashed'
+      },
+      reservedSpawnToken: 'spawn-crashed',
+      leaseDeadlineAt: LAST_RENEWED_AT + 30_000,
+      lastRenewedAt: LAST_RENEWED_AT,
+      handoffOperationId: null,
+      journalCheckpoint: null,
+      claimKeyId: 'key-1',
+      claimStatus: 'live',
+      unreconciled: false,
+      deathEvidence: null
+    }
+  }
+}
+
+async function seedCrashedStore(): Promise<void> {
+  const directory = join(root, 'store')
+  await mkdir(directory, { recursive: true })
+  await writeFile(
+    join(directory, AGENT_SESSION_STORE_FILE_NAME),
+    JSON.stringify({
+      schemaVersion: 2,
+      hostId: 'local',
+      records: { [SESSION]: crashedClaudeRecord() },
+      operations: {},
+      retiredClaimKeys: [],
+      unusableRecords: {}
+    }),
+    'utf-8'
+  )
+  store = await AgentSessionRecordStore.open({ directory, hostId: 'local' })
+}
+
+/** A running turn whose only row after its start is a Bash call that never reported back, for a
+ *  send the provider never acknowledged: the reopen settles it at the fence after the crash. */
+async function seedClaudeToolTurn(): Promise<void> {
+  let now = TOOL_STARTED_AT - 2_000
+  const journal = await openAgentSessionJournal({
+    identity: {
+      sessionId: SESSION,
+      workspaceId: LOCATION.workspaceId,
+      hostId: LOCATION.executionHostId,
+      agent: 'claude',
+      providerHandle: { kind: 'claude', sessionId: PROVIDER_SESSION, leafUuid: null }
+    },
+    journalDir: journalDirectoryFor(root, {
+      workspaceId: LOCATION.workspaceId,
+      sessionId: SESSION
+    }),
+    now: () => now
+  })
+  await journal.appendSubmission({
+    clientMessageId: 'send-1',
+    payloadFingerprint: '0'.repeat(64),
+    body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'run the loop' }] },
+    fence: 13
+  })
+  const turnIdentity = {
+    provider: 'claude' as const,
+    sessionId: PROVIDER_SESSION,
+    uuid: 'uuid-turn'
+  }
+  const turnScope = { kind: 'turn' as const, turnItemId: agentJournalItemKey(turnIdentity) }
+  await journal.appendItem(
+    turnIdentity,
+    { kind: 'turn', turnId: 'turn-1', state: 'running', startedAt: now },
+    { fence: 13, turnScope }
+  )
+  now = TOOL_STARTED_AT
+  await journal.appendItem(
+    { provider: 'claude', sessionId: PROVIDER_SESSION, uuid: 'uuid-bash' },
+    {
+      kind: 'tool-call',
+      name: 'Bash',
+      input: { command: 'for i in $(seq 90); do sleep 1; done' },
+      state: 'running'
+    },
+    { fence: 13, turnScope }
+  )
+  await journal.close()
+}
+
+function openHost(overrides: Partial<StructuredAgentSessionHostDeps>): void {
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: {
+      acquire: vi.fn(),
+      dispatch: vi.fn(),
+      cancelTurn: vi.fn(),
+      answerPrompt: vi.fn(),
+      setOption: vi.fn(),
+      supportsCreate: () => true
+    },
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-new',
+    now: () => RELAUNCHED_AT,
+    ...overrides
+  })
+}
+
+/** What a client reads over the wire. */
+async function settledTurn() {
+  return (await host.journalSnapshot(SESSION)).items
+    .map((item) => readAgentJournalTurn(item.body))
+    .find(Boolean)
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-crash-turn-end-'))
+  await seedCrashedStore()
+  await seedClaudeToolTurn()
+})
+
+afterEach(async () => {
+  await host?.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('a turn a crash cut short mid-tool', () => {
+  it('ends at the last renewal, not at the tool call the provider last reported', async () => {
+    openHost({ probeOwner: async () => ({ outcome: 'pid-absent' }) })
+
+    await host.restoreReadableSessions()
+
+    expect(store.getRecord(SESSION)?.lease.deathEvidence).toMatchObject({
+      kind: 'pid-absent',
+      observedAt: RELAUNCHED_AT,
+      lastProvenAliveAt: LAST_RENEWED_AT
+    })
+    expect(await settledTurn()).toMatchObject({
+      state: 'interrupted',
+      completedAt: LAST_RENEWED_AT
+    })
+    // "Worked for 27s", where the tool call's row alone reads 2s.
+    const [timing] = selectStructuredAgentTurnTimings(
+      (await host.journalSnapshot(SESSION)).items
+    ).values()
+    expect(completedStructuredAgentTurnSeconds(timing)).toBe(27)
+  })
+
+  it('ends at the pre-crash renewal when the child outlived Orca and recovery stopped it', async () => {
+    // The orphan is alive at relaunch, but its output went nowhere: none of that is work shown.
+    let alive = true
+    const probeOwner = async (): Promise<AgentSessionOwnerProbe> =>
+      alive
+        ? { outcome: 'identity-matched', matchedOn: ['spawn-token'] }
+        : { outcome: 'pid-absent' }
+    const stopOwnerProcess = vi.fn(() => {
+      alive = false
+    })
+    openHost({ probeOwner, stopOwnerProcess })
+
+    await host.restoreReadableSessions()
+
+    expect(stopOwnerProcess).toHaveBeenCalledOnce()
+    expect(store.getRecord(SESSION)?.lease.deathEvidence).toMatchObject({
+      kind: 'pid-absent',
+      lastProvenAliveAt: LAST_RENEWED_AT
+    })
+    expect(await settledTurn()).toMatchObject({
+      state: 'interrupted',
+      completedAt: LAST_RENEWED_AT
+    })
+  })
+})
+
+/** Every turn state a subscriber was sent, in order: snapshots, then live batches. */
+function turnStatesSent(events: readonly AgentSessionSubscribeEvent[]) {
+  return events
+    .flatMap((event) =>
+      event.type === 'snapshot' ? event.page.items : event.type === 'batch' ? event.batch.items : []
+    )
+    .flatMap((item) => readAgentJournalTurn(item.body) ?? [])
+}
+
+function attach(fence: number) {
+  return host.attach(
+    { callerKey: 'client-1' },
+    hostTestAttachParams(fence, {
+      provider: 'claude',
+      agent: 'claude',
+      accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: '/home/dev/.claude' },
+      providerHandle: { kind: 'claude', sessionId: PROVIDER_SESSION, leafUuid: null }
+    })
+  )
+}
+
+/** Runs whatever this session's serialize already has queued. */
+function drainSession(): Promise<void> {
+  return host.collaboratorsForTests().serialize(SESSION, async () => {})
+}
+
+// On desktop the chat on screen at relaunch opens before the startup reconcile has probed its owner,
+// so the open can only call the turn unverifiable; the proof, whoever writes it, then revises it.
+describe('a turn a read reached before the reconcile proved its owner dead', () => {
+  it('reads unverifiable, then interrupted at the last renewal, and a subscriber is sent both', async () => {
+    openHost({ probeOwner: async () => ({ outcome: 'pid-absent' }) })
+    const events: AgentSessionSubscribeEvent[] = []
+    const unsubscribe = await host.subscribe({
+      id: 'reader-1',
+      sessionId: SESSION,
+      emit: (event) => events.push(event)
+    })
+    expect(await settledTurn()).toEqual(UNVERIFIABLE_TURN)
+
+    await host.reconcileRestartLeases()
+    await drainSession()
+
+    // A paired or phone client learns of the revision through the ordinary journal publish.
+    await vi.waitFor(() =>
+      expect(turnStatesSent(events)).toMatchObject([
+        { state: 'unverifiable' },
+        { state: 'interrupted', completedAt: LAST_RENEWED_AT }
+      ])
+    )
+    const { items } = await host.journalSnapshot(SESSION)
+    const [timing] = selectStructuredAgentTurnTimings(items).values()
+    expect(completedStructuredAgentTurnSeconds(timing)).toBe(27)
+    expect(items.filter((item) => item.body.kind === 'status')).toHaveLength(1)
+    unsubscribe()
+  })
+
+  it('revises nothing twice, whoever re-runs the settle', async () => {
+    openHost({ probeOwner: async () => ({ outcome: 'pid-absent' }) })
+    await host.history({ sessionId: SESSION, direction: 'tail' })
+    await host.reconcileRestartLeases()
+    await drainSession()
+    const settled = await host.journalSnapshot(SESSION)
+
+    await host
+      .collaboratorsForTests()
+      .serialize(SESSION, () =>
+        resettleOpenStructuredAgentSessionConversation(
+          host.deps,
+          SESSION,
+          host.collaboratorsForTests().sessions.get(SESSION)
+        )
+      )
+    await host.restoreReadableSessions()
+
+    expect(await host.journalSnapshot(SESSION)).toEqual(settled)
+  })
+
+  it('revises it when recovery stops a child that outlived Orca, with no send', async () => {
+    let alive = true
+    const probeOwner = async (): Promise<AgentSessionOwnerProbe> =>
+      alive
+        ? { outcome: 'identity-matched', matchedOn: ['spawn-token'] }
+        : { outcome: 'pid-absent' }
+    const stopOwnerProcess = vi.fn(() => {
+      alive = false
+    })
+    const acquire = vi.fn<StructuredAgentSessionAdapter['acquire']>()
+    openHost({
+      adapter: {
+        acquire,
+        dispatch: vi.fn(),
+        cancelTurn: vi.fn(),
+        answerPrompt: vi.fn(),
+        setOption: vi.fn(),
+        supportsCreate: () => true
+      },
+      probeOwner,
+      stopOwnerProcess
+    })
+    await host.history({ sessionId: SESSION, direction: 'tail' })
+    expect(await settledTurn()).toEqual(UNVERIFIABLE_TURN)
+
+    // The reconcile only parks the live orphan in recovery; recovery's stop is what proves it gone.
+    await host.restoreReadableSessions()
+    await drainSession()
+
+    expect(stopOwnerProcess).toHaveBeenCalledOnce()
+    expect(acquire).not.toHaveBeenCalled()
+    expect(await settledTurn()).toMatchObject({
+      state: 'interrupted',
+      completedAt: LAST_RENEWED_AT
+    })
+  })
+
+  it('never touches the turn a start after the crash is writing', async () => {
+    const acquire = vi.fn<StructuredAgentSessionAdapter['acquire']>(
+      async ({ fence, spawnToken, onSpawned, events }) => {
+        const process = {
+          hostId: 'local',
+          pid: 8_000,
+          processStartTimeMs: RELAUNCHED_AT,
+          spawnToken
+        }
+        await onSpawned?.(process)
+        // The new child is already working when its start lands, ahead of the queued revision.
+        events?.appendItem(
+          { provider: 'claude', sessionId: PROVIDER_SESSION, uuid: 'uuid-turn-2' },
+          { kind: 'turn', turnId: 'turn-2', state: 'running', startedAt: RELAUNCHED_AT },
+          { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+        )
+        return {
+          process,
+          link: {
+            linkId: `claude-${fence}-link`,
+            handle: { provider: 'claude', sessionId: PROVIDER_SESSION, leafUuid: null },
+            origin: 'resumed',
+            mintedAtFence: fence,
+            observedAt: RELAUNCHED_AT
+          }
+        }
+      }
+    )
+    openHost({
+      adapter: {
+        acquire,
+        dispatch: vi.fn(),
+        cancelTurn: vi.fn(),
+        answerPrompt: vi.fn(),
+        setOption: vi.fn(),
+        supportsCreate: () => true
+      },
+      probeOwner: async () => ({ outcome: 'pid-absent' })
+    })
+    await host.history({ sessionId: SESSION, direction: 'tail' })
+
+    // The start runs the reconcile itself, so the revision it queues waits behind the start.
+    await expect(attach(14)).resolves.toMatchObject({ ok: true })
+    await host.flushStreamedEvents(SESSION)
+    await drainSession()
+
+    const turns = (await host.journalSnapshot(SESSION)).items.flatMap(
+      (item) => readAgentJournalTurn(item.body) ?? []
+    )
+    expect(turns).toMatchObject([
+      { turnId: 'turn-1', state: 'interrupted', completedAt: LAST_RENEWED_AT },
+      { turnId: 'turn-2', state: 'running' }
+    ])
+  })
+
+  it('stays unverifiable when the revision cannot be written, and a later open revises it', async () => {
+    let now = RELAUNCHED_AT
+    const onEventSinkError = vi.fn()
+    openHost({
+      probeOwner: async () => ({ outcome: 'pid-absent' }),
+      now: () => now,
+      onEventSinkError
+    })
+    await host.history({ sessionId: SESSION, direction: 'tail' })
+    const { journal } = host.collaboratorsForTests().sessions.get(SESSION)!
+    vi.spyOn(journal, 'appendLifecycleBatch').mockRejectedValueOnce(new Error('disk full'))
+
+    await host.reconcileRestartLeases()
+    await drainSession()
+
+    expect(onEventSinkError).toHaveBeenCalledOnce()
+    expect(await settledTurn()).toEqual(UNVERIFIABLE_TURN)
+    // The proof is durable on the record, so the next open converges.
+    now += STRUCTURED_AGENT_SESSION_IDLE_MS + 1
+    await host.collaboratorsForTests().lifetime.idleSweep.tick()
+    expect(host.hasSession(SESSION)).toBe(false)
+    expect(await settledTurn()).toMatchObject({
+      state: 'interrupted',
+      completedAt: LAST_RENEWED_AT
+    })
+  })
+})
+
+/** A relaunched host whose first start after the crash, at fence 15, fails with `failure`; every
+ *  later start succeeds. The crashed owner, and any child left behind, probe gone. */
+async function hostWithFailingFirstStart(failure: Error) {
+  let now = RELAUNCHED_AT
+  const acquire = vi.fn<StructuredAgentSessionAdapter['acquire']>(
+    async ({ fence, spawnToken, onSpawned }) => {
+      const process = { hostId: 'local', pid: 7_000 + fence, processStartTimeMs: now, spawnToken }
+      await onSpawned?.(process)
+      if (fence === 15) {
+        throw failure
+      }
+      return {
+        process,
+        link: {
+          linkId: `claude-${fence}-link`,
+          handle: { provider: 'claude', sessionId: PROVIDER_SESSION, leafUuid: null },
+          origin: 'resumed',
+          mintedAtFence: fence,
+          observedAt: now
+        }
+      }
+    }
+  )
+  openHost({
+    adapter: {
+      acquire,
+      releaseAcquisition: async () => true,
+      dispatch: vi.fn(),
+      cancelTurn: vi.fn(),
+      answerPrompt: vi.fn(),
+      setOption: vi.fn(),
+      supportsCreate: () => true
+    },
+    probeOwner: async () => ({ outcome: 'pid-absent' }),
+    now: () => now
+  })
+  await host.reconcileRestartLeases()
+  return {
+    attach,
+    advance: (ms: number) => {
+      now += ms
+    }
+  }
+}
+
+/** The turn as the crashed owner left it, with no end: nothing proves when that owner stopped. */
+const UNVERIFIABLE_TURN = {
+  turnId: 'turn-1',
+  state: 'unverifiable',
+  startedAt: TOOL_STARTED_AT - 2_000
+}
+
+// The relaunch proved the fence-13 owner gone, but a start reserving fence 15 clears that proof
+// before the turn is settled; what the record holds afterwards is about the start's own child.
+describe('a turn a newer start could not settle before it failed', () => {
+  it('is not judged by the death of the child it left for recovery', async () => {
+    const { attach, advance } = await hostWithFailingFirstStart(
+      new AgentSessionAcquisitionExitUnprovenError(new Error('hung'))
+    )
+
+    await attach(14).catch(() => undefined)
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      runtimeFence: 15,
+      handoffStage: 'recovering',
+      lastRenewedAt: RELAUNCHED_AT
+    })
+    advance(60_000)
+    // Recovery records that child's death, then the client retries at the fence it was told.
+    await expect(attach(15)).resolves.toMatchObject({ refusal: { currentFence: 16 } })
+    expect(store.getRecord(SESSION)?.lease.deathEvidence).toMatchObject({
+      ownerFence: 15,
+      lastProvenAliveAt: RELAUNCHED_AT
+    })
+    await expect(attach(16)).resolves.toMatchObject({ ok: true })
+
+    expect(await settledTurn()).toEqual(UNVERIFIABLE_TURN)
+  })
+
+  it('is not judged by the watched exit of a start that failed', async () => {
+    const { attach, advance } = await hostWithFailingFirstStart(new Error('claude exited (code 1)'))
+
+    await expect(attach(14)).resolves.toMatchObject({ ok: false })
+    expect(store.getRecord(SESSION)?.lease.deathEvidence).toMatchObject({
+      kind: 'exit-observed',
+      ownerFence: 15,
+      observedAt: RELAUNCHED_AT
+    })
+    advance(60_000)
+    await expect(attach(16)).resolves.toMatchObject({ ok: true })
+
+    // Main ended it at the failed start, an hour after the crash, with the start's reason.
+    expect(await settledTurn()).toEqual(UNVERIFIABLE_TURN)
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.test.ts
index d553fbaecf3..5a55bbb26cc 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.test.ts
@@ -1,19 +1,25 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
 import type { AgentJournalRenderItem } from '../../../shared/agent-session-journal-types'
-import { dispatchRejectionReasonIsInternal } from '../../../shared/structured-agent-session-dispatch-rejection'
+import {
+  agentSessionFailureFact,
+  MAX_PROVIDER_DIAGNOSTIC_CHARS,
+  providerDiagnostic
+} from '../../../shared/agent-session-failure'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import {
   captureUnfinishedStructuredAgentSessionWork,
-  MAX_UNEXPECTED_EXIT_REASON_CHARS,
   settleStructuredAgentSessionDeadGeneration,
-  UNEXPECTED_PROVIDER_EXIT_OUTCOME,
   unfinishedStructuredAgentSessionWorkWasInterrupted
 } from './structured-agent-session-dead-generation-settlement'
 
+const UNEXPECTED_PROVIDER_EXIT_OUTCOME =
+  'The agent stopped while this response was in progress. You can continue in this conversation.'
+
 const SESSION = 'session-dead-generation'
 const THREAD = 'thread-1'
 let root: string
@@ -49,7 +55,7 @@ async function seedUnfinishedWork(): Promise<void> {
   await journal.appendItem(
     { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 1 },
     { kind: 'tool-call', name: 'shell', input: { command: 'pnpm test' }, state: 'running' },
-    { fence: 7 }
+    { fence: 7, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
   await journal.appendItem(
     { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 2 },
@@ -60,7 +66,7 @@ async function seedUnfinishedWork(): Promise<void> {
       options: [{ id: 'yes', label: 'Allow' }],
       resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
     },
-    { fence: 7 }
+    { fence: 7, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
   await journal.appendItem(
     { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 3 },
@@ -70,12 +76,12 @@ async function seedUnfinishedWork(): Promise<void> {
       options: [{ id: 'web', label: 'Web' }],
       resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
     },
-    { fence: 7 }
+    { fence: 7, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
   await journal.appendItem(
     { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 4 },
     { kind: 'turn', turnId: 'turn-1', state: 'running', startedAt: 900 },
-    { fence: 7 }
+    { fence: 7, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
 }
 
@@ -143,7 +149,7 @@ describe('dead structured-session generation settlement', () => {
     ).toHaveLength(1)
   })
 
-  it('keeps the actionable tail when the provider dumps a stderr wall into its exit reason', async () => {
+  it('keeps a stderr wall out of the sentence, as a bounded detail for a log', async () => {
     await seedUnfinishedWork()
 
     await expect(
@@ -155,19 +161,48 @@ describe('dead structured-session generation settlement', () => {
         pendingSubmissionReason: 'provider_exited_before_acknowledgement',
         verdict: { state: 'interrupted', completedAt: 1_000 },
         showUnexpectedExitOutcome: true,
-        unexpectedExitReason: 'stack frame '.repeat(4_000)
+        exitFailure: agentSessionFailureFact('providerExited', {
+          detail: providerDiagnostic('stack frame '.repeat(4_000), 'log')
+        })
       })
     ).resolves.toBe(true)
 
     const statuses = journal
       .snapshot()
-      .items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
+      .items.flatMap((item) => (item.body.kind === 'status' ? [item.body] : []))
     expect(statuses).toHaveLength(1)
-    // The cause is bounded before composing, so the row never reaches the byte cap that would
-    // truncate the sentence telling the user the conversation is still usable.
-    expect(statuses[0]).toContain('stack frame')
-    expect(statuses[0]).toMatch(/You can continue in this conversation\.$/)
-    expect(statuses[0]?.length).toBeLessThan(MAX_UNEXPECTED_EXIT_REASON_CHARS * 2)
+    expect(statuses[0]?.text).toBe(UNEXPECTED_PROVIDER_EXIT_OUTCOME)
+    expect(statuses[0]?.failure?.kind).toBe('providerExited')
+    expect(statuses[0]?.failure?.detail?.audience).toBe('log')
+    expect(statuses[0]?.failure?.detail?.text.length).toBe(MAX_PROVIDER_DIAGNOSTIC_CHARS)
+  })
+
+  it("words Orca's own fault as Orca's, never as the provider stopping", async () => {
+    await seedUnfinishedWork()
+
+    await settleStructuredAgentSessionDeadGeneration({
+      journal,
+      sessionId: SESSION,
+      fence: 7,
+      settlementId: `provider-exit:${SESSION}:7:generation-1`,
+      pendingSubmissionReason: 'provider_exited_before_acknowledgement',
+      verdict: { state: 'interrupted', completedAt: 1_000 },
+      showUnexpectedExitOutcome: true,
+      // Orca stopped the provider because its own journal failed.
+      exitFailure: agentSessionFailureFact('hostFault')
+    })
+
+    const statuses = journal
+      .snapshot()
+      .items.flatMap((item) => (item.body.kind === 'status' ? [item.body] : []))
+    expect(statuses).toEqual([
+      {
+        kind: 'status',
+        text: "Orca ran into a problem, so this didn't go through. Try again.",
+        failure: { kind: 'hostFault' },
+        tone: 'error'
+      }
+    ])
   })
 
   it('retries an already settled expected close without writing through a closed journal gate', async () => {
@@ -190,6 +225,7 @@ describe('dead structured-session generation settlement', () => {
       | 'submissions'
       | 'markPendingSubmissionsUnknown'
       | 'rejectPendingSubmissions'
+      | 'rejectQueuedSubmissions'
       | 'appendLifecycleBatch'
     > = {
       snapshot: () => ({
@@ -203,6 +239,9 @@ describe('dead structured-session generation settlement', () => {
       rejectPendingSubmissions: async () => {
         throw new Error('journal_closed')
       },
+      rejectQueuedSubmissions: async () => {
+        throw new Error('journal_closed')
+      },
       appendLifecycleBatch: async () => {
         throw new Error('journal_closed')
       }
@@ -272,16 +311,24 @@ describe('dead structured-session generation settlement', () => {
       settlementId: `provider-exit:${SESSION}:7:generation-1`,
       pendingSubmissionReason: 'provider_closed_before_acknowledgement',
       verdict: { state: 'interrupted', completedAt: 1_000 },
-      unexpectedExitReason: 'claude stream-json exited (code 1): not signed in',
-      exitedDuringStartup: true
+      exitFailure: agentSessionFailureFact('providerExited', {
+        detail: providerDiagnostic('code 1\nnot signed in', 'log')
+      }),
+      exitedDuringStartup: { generation: 'generation-1' }
     })
 
-    const reason =
-      'The provider stopped before it finished starting: claude stream-json exited (code 1): not signed in.'
+    // The sentence is Orca's; the stderr the exit carried rides as a log detail only.
     expect(journal.submissions()).toEqual([
-      expect.objectContaining({ clientMessageId: 'client-held', dispatchState: 'rejected', reason })
+      expect.objectContaining({
+        clientMessageId: 'client-held',
+        dispatchState: 'rejected',
+        reason: 'The agent stopped before it finished starting. Send your message to try again.',
+        rejection: {
+          kind: 'providerStartFailed',
+          detail: { text: 'code 1\nnot signed in', audience: 'log' }
+        }
+      })
     ])
-    expect(dispatchRejectionReasonIsInternal(reason)).toBe(false)
   })
 
   it("keeps a subagent's settled rows the subagent's, in one batch and after a reopen", async () => {
@@ -304,7 +351,7 @@ describe('dead structured-session generation settlement', () => {
     await journal.appendItem(
       childCall,
       { kind: 'tool-call', name: 'shell', input: { command: 'ls' }, state: 'running' },
-      { fence: 7, ...child }
+      { fence: 7, ...child, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await journal.appendItem(
       childAsk,
@@ -315,7 +362,7 @@ describe('dead structured-session generation settlement', () => {
         options: [{ id: 'yes', label: 'Allow' }],
         resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
       },
-      { fence: 7, ...child }
+      { fence: 7, ...child, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
 
     await settleStructuredAgentSessionDeadGeneration({
@@ -375,12 +422,12 @@ describe('whether a dead generation interrupted anything', () => {
         options: [{ id: 'yes', label: 'Allow' }],
         resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
       },
-      { fence: 7 }
+      { fence: 7, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await journal.appendItem(
       { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 2 },
       { kind: 'turn', turnId: 'turn-1', state: 'completed', startedAt: 900, completedAt: 950 },
-      { fence: 7 }
+      { fence: 7, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
   }
 
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.ts
index 1b5f73fdbda..72caac40844 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.ts
@@ -1,78 +1,48 @@
+import {
+  agentSessionFailureFact,
+  MAX_PROVIDER_DIAGNOSTIC_CHARS,
+  type SubmissionRejectionFact
+} from '../../../shared/agent-session-failure'
 import { parseAgentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
-import type {
-  AgentJournalItemBody,
-  AgentJournalRenderItem
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalItemBody,
+  type AgentJournalRenderItem
 } from '../../../shared/agent-session-journal-types'
 import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
 import { partitionJournalLifecycleMutations } from '../agent-session-journal/journal-lifecycle-batch-partition'
 import type { JournalLifecycleMutationInput } from '../agent-session-journal/journal-row-builders'
-import {
-  boundJournalStatusText,
-  cancelledJournalPromptBody
-} from '../agent-session-journal/journal-prompt-body-bounds'
+import { cancelledJournalPromptBody } from '../agent-session-journal/journal-prompt-body-bounds'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import {
+  agentSessionFailureWords,
+  type AgentSessionFailureWordsContext
+} from '../../../shared/agent-session-failure-words'
+import { structuredAgentSessionStartFailure } from './structured-agent-session-failure-text'
+import {
+  hasStructuredAgentSessionStartFailureRow,
+  structuredAgentSessionStartFailureRow
+} from './structured-agent-session-start-failure-row'
+import type { AgentSessionDeathEvidence } from '../../../shared/agent-session-record'
+import {
+  provenUnverifiableTurnRevisions,
   runningTurnLifecycleRevisions,
+  turnVerdictFromDeathEvidence,
   type StructuredAgentSessionTurnVerdict
 } from './structured-agent-session-stale-turn-verdict'
+import {
+  exitedRootTurnScope,
+  runningRootTurnScope
+} from './structured-agent-session-exit-turn-scope'
 
-export const UNEXPECTED_PROVIDER_EXIT_OUTCOME =
-  'The provider stopped while this response was in progress. You can continue in this conversation.'
-
-/** A provider may put a whole stderr dump in its exit reason; unbounded it would push the
- *  actionable tail past the row's byte cap and lose it to truncation. */
-export const MAX_UNEXPECTED_EXIT_REASON_CHARS = 512
-
-/** The cause is the only thing separating an auth failure from an OOM kill, so it is carried
- *  into the copy rather than left in the durable record nothing renders. */
-export function unexpectedProviderExitOutcome(reason?: string): string {
-  const detail = exitReasonDetail(reason)
-  return detail
-    ? `The provider stopped while this response was in progress: ${detail}. You can continue in this conversation.`
-    : UNEXPECTED_PROVIDER_EXIT_OUTCOME
-}
-
-/** A restart that produced no child, answered to the send that asked for it; its cause is the
- *  whole story, and nothing is remembered, so the next try is a fresh one. A new chat is offered
- *  only when the host holds nothing this chat could restart from. */
-export function ownerRestartFailedOutcome(input: {
-  agentName: string
-  reason?: string
-  resumable: boolean
-}): string {
-  const detail = exitReasonDetail(input.reason)
-  const failed = detail
-    ? `${input.agentName} couldn't restart: ${detail}.`
-    : `${input.agentName} couldn't restart.`
-  return input.resumable ? failed : `${failed} Start a new chat to continue.`
-}
-
-/** A start that never finished has no response to interrupt; its cause is the whole story. */
-export function providerStartupFailureOutcome(reason?: string): string {
-  const detail = exitReasonDetail(reason)
-  return detail
-    ? `The provider stopped before it finished starting: ${detail}.`
-    : 'The provider stopped before it finished starting.'
-}
-
-/** Why a send a child that never started left unwritten was rejected. The child's own diagnostic is
- *  the cause the user can act on, so it is the reason, in the words the chat row uses. */
-export function providerStartupFailureRejection(cause?: unknown): string {
-  return providerStartupFailureOutcome(
-    cause === undefined ? undefined : cause instanceof Error ? cause.message : String(cause)
-  )
-}
-
-function exitReasonDetail(reason: string | undefined): string | undefined {
-  return reason
-    ?.slice(0, MAX_UNEXPECTED_EXIT_REASON_CHARS)
-    .trim()
-    .replace(/[.\s]+$/, '')
-}
+/** Bounds the exit reason the lease keeps as log evidence; a provider diagnostic is held to the
+ *  same cap. */
+export const MAX_UNEXPECTED_EXIT_REASON_CHARS = MAX_PROVIDER_DIAGNOSTIC_CHARS
 
 type DeadGenerationSubmission = Pick<
   ReturnType<AgentSessionJournal['submissions']>[number],
-  'clientMessageId' | 'dispatchState' | 'recovered'
+  'clientMessageId' | 'dispatchState' | 'recovered' | 'handoverRecorded' | 'handedOverAt'
 >
 
 export type DeadGenerationJournal = {
@@ -140,10 +110,13 @@ export async function settleStructuredAgentSessionDeadGeneration(input: {
   verdict: StructuredAgentSessionTurnVerdict
   pendingSubmissionReason: string
   showUnexpectedExitOutcome?: boolean
-  /** Why the provider stopped, when the host has it. Rendered with the outcome copy. */
-  unexpectedExitReason?: string
-  /** The provider never finished starting; the outcome says so instead of naming a response. */
-  exitedDuringStartup?: boolean
+  /** Why the provider stopped, as the adapter told it; the row's sentence is this fact's. */
+  exitFailure?: SubmissionRejectionFact
+  /** Who a failed start's sentence names. */
+  failureTextContext?: AgentSessionFailureWordsContext
+  /** The provider never finished starting: the start that failed, keyed by the child's
+   *  generation. Its row is the one the delivery loop writes for the same start. */
+  exitedDuringStartup?: { generation: string | null }
   onError?: (sessionId: string, error: unknown) => void
 }): Promise<boolean> {
   try {
@@ -152,36 +125,58 @@ export async function settleStructuredAgentSessionDeadGeneration(input: {
     if (!showUnexpectedExitOutcome && !hasUnfinishedWork) {
       return true
     }
-    // A child that never proved its start accepted nothing — input is written only after it
-    // initializes — so every send it left unanswered is provably unwritten and is rejected with the
-    // child's own diagnostic. A proven child's unanswered sends stay in doubt.
-    await (input.exitedDuringStartup
-      ? input.journal.rejectPendingSubmissions(
-          input.fence,
-          providerStartupFailureRejection(input.unexpectedExitReason)
-        )
+    // A queued message is the delivery loop's to settle: it was never handed to this child. A
+    // child that never proved its start accepted nothing either — input is written only after it
+    // initializes — so every send it was handed is rejected with the child's own diagnostic. A
+    // proven child's handed-over sends stay in doubt.
+    const startupFailure = input.exitedDuringStartup
+      ? structuredAgentSessionStartFailure({ exit: input.exitFailure }, input.failureTextContext)
+      : null
+    await (startupFailure
+      ? input.journal.rejectPendingSubmissions(input.fence, startupFailure)
       : input.journal.markPendingSubmissionsUnknown(input.fence, input.pendingSubmissionReason))
     const items = input.journal.snapshot().items
     const mutations: JournalLifecycleMutationInput[] = []
-    if (showUnexpectedExitOutcome) {
+    if (showUnexpectedExitOutcome && input.exitedDuringStartup && startupFailure) {
+      const startKey = input.exitedDuringStartup.generation ?? input.settlementId
+      // A start a message waited on is the delivery loop's to record, before or after this exit,
+      // in the words it rejected the message with; this row is for a command, goal or rewind start.
+      // A row already written stays: rejected is terminal, so its words are not reworded.
+      const recordedByDeliveryLoop =
+        input.journal.submissions?.().some(isQueuedAgentJournalSubmission) ||
+        hasStructuredAgentSessionStartFailureRow(items, startKey)
+      if (!recordedByDeliveryLoop) {
+        mutations.push(structuredAgentSessionStartFailureRow(startKey, startupFailure))
+      }
+    } else if (showUnexpectedExitOutcome) {
+      // The turn the exit ended, and an error so no fold ever hides why it stopped.
       mutations.push({
         kind: 'item',
         identity: { provider: 'orca', clientMessageId: input.settlementId },
         body: {
           kind: 'status',
-          text: boundJournalStatusText(
-            input.exitedDuringStartup
-              ? providerStartupFailureOutcome(input.unexpectedExitReason)
-              : unexpectedProviderExitOutcome(input.unexpectedExitReason)
-          )
-        }
+          ...agentSessionFailureWords(
+            input.exitFailure ?? agentSessionFailureFact('providerExited'),
+            {
+              ...input.failureTextContext,
+              surface: 'row'
+            }
+          ),
+          tone: 'error'
+        },
+        turnScope: exitedRootTurnScope(items, input.verdict)
       })
     }
     for (const item of items) {
       const identity = parseAgentJournalItemKey(item.itemId)
       const body = terminalDeadGenerationBody(item)
       if (identity && body) {
-        mutations.push({ kind: 'item', identity, body })
+        mutations.push({
+          kind: 'item',
+          identity,
+          body,
+          turnScope: item.turnScope ?? AGENT_JOURNAL_THREAD_SCOPE
+        })
       }
     }
     mutations.push(...runningTurnLifecycleRevisions(items, input.verdict))
@@ -201,6 +196,85 @@ export async function settleStructuredAgentSessionDeadGeneration(input: {
   }
 }
 
+/**
+ * Settles whatever a generation with no child in this process left running: found when a new child
+ * is acquired, or when a chat is reopened for reading. Derived from the journal and the lease's
+ * death evidence each time, so nothing is owed in between. Proven death ends the turn interrupted,
+ * and a proof written after an earlier settle revises what that settle left `unverifiable`. Must
+ * run before a new child's buffered events land, or a live turn would be judged.
+ */
+export async function settleStaleStructuredAgentSessionState(input: {
+  journal: AgentSessionJournal
+  sessionId: string
+  fence: number
+  acquisitionGeneration: string | null
+  deathEvidence: AgentSessionDeathEvidence | null
+  /** Who the exit row names. */
+  failureTextContext?: AgentSessionFailureWordsContext
+}): Promise<number> {
+  const { journal } = input
+  const items = journal.snapshot().items
+  // Each turn is judged by the evidence only if it names that turn's owner.
+  const verdictFor = (item: AgentJournalRenderItem) =>
+    turnVerdictFromDeathEvidence(input.deathEvidence, journal.itemFence(item.itemId))
+  // Per attempt: a retry re-partitions only what is left, and a reused chunk id would skip it.
+  const generation = input.acquisitionGeneration ?? `seq-${journal.cursor().sequence}`
+  const settlementId = `stale-session:${input.sessionId}:${input.fence}:${generation}`
+  const mutations: JournalLifecycleMutationInput[] = []
+  for (const item of items) {
+    const identity = parseAgentJournalItemKey(item.itemId)
+    const body = terminalDeadGenerationBody(item)
+    if (identity && body) {
+      mutations.push({
+        kind: 'item',
+        identity,
+        body,
+        turnScope: item.turnScope ?? AGENT_JOURNAL_THREAD_SCOPE
+      })
+    }
+  }
+  const proven = provenUnverifiableTurnRevisions(items, input.deathEvidence, journal)
+  mutations.push(
+    ...items.flatMap((item) => runningTurnLifecycleRevisions([item], verdictFor(item))),
+    ...proven
+  )
+  const evidence = input.deathEvidence
+  if (
+    evidence &&
+    (proven.length > 0 ||
+      items.some((item) => isInProgressItem(item) && verdictFor(item).state === 'interrupted'))
+  ) {
+    mutations.unshift({
+      kind: 'item',
+      // Named by the death it explains, so a retry after a partly written settle adds no second row.
+      identity: {
+        provider: 'orca',
+        clientMessageId: `stale-session:${input.sessionId}:death-${evidence.ownerFence ?? 'unowned'}-${evidence.observedAt}`
+      },
+      // The death evidence is Orca's log text, never a sentence for a person: the row says only
+      // that the provider stopped.
+      body: {
+        kind: 'status',
+        ...agentSessionFailureWords(agentSessionFailureFact('providerExited'), {
+          ...input.failureTextContext,
+          surface: 'row'
+        }),
+        tone: 'error'
+      },
+      turnScope: runningRootTurnScope(items)
+    })
+  }
+  for (const chunk of partitionJournalLifecycleMutations(settlementId, mutations)) {
+    await journal.appendLifecycleBatch({
+      settlementId: chunk.settlementId,
+      fence: input.fence,
+      recovered: true,
+      mutations: chunk.mutations
+    })
+  }
+  return mutations.length
+}
+
 function terminalDeadGenerationBody(item: AgentJournalRenderItem): AgentJournalItemBody | null {
   if (item.body.kind === 'tool-call' && item.body.state === 'running') {
     return { ...item.body, state: 'failed' }
@@ -247,7 +321,9 @@ function hasUnsettledSubmission(journal: DeadGenerationJournal): boolean {
   return submissions
     ? submissions.some(
         (submission) =>
-          submission.dispatchState === 'pending' ||
+          // A queued message is not work in progress: nothing has it yet.
+          (submission.dispatchState === 'pending' &&
+            !(submission.handoverRecorded && submission.handedOverAt === undefined)) ||
           (submission.dispatchState === 'unknown' && submission.recovered !== true)
       )
     : (journal.pendingSubmissions?.().length ?? 0) > 0
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.test.ts
new file mode 100644
index 00000000000..242daf74faf
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.test.ts
@@ -0,0 +1,57 @@
+import { describe, expect, it } from 'vitest'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { structuredAgentSessionEndedChildFailure } from './structured-agent-session-delivery-loop'
+import type {
+  StructuredAgentSessionChildEndCause,
+  StructuredAgentSessionEndedChild
+} from './structured-agent-session-host-types'
+
+const EXIT_FAILURE = agentSessionFailureFact('providerExited', {
+  detail: { text: 'crashed', audience: 'log' }
+})
+
+function ended(
+  cause: StructuredAgentSessionChildEndCause,
+  duringStartup: boolean
+): StructuredAgentSessionEndedChild {
+  return {
+    generation: 'generation-1',
+    fence: 2,
+    rootGone: true,
+    cause,
+    reason: null,
+    failure: EXIT_FAILURE,
+    duringStartup,
+    endedAt: { epoch: 'epoch-1', sequence: 3 }
+  }
+}
+
+describe('what a child end means for the messages queued behind it', () => {
+  it.each([false, true])("fails nothing after a user's Stop (during startup: %s)", (starting) => {
+    expect(structuredAgentSessionEndedChildFailure(ended('user-stop', starting))).toBeNull()
+  })
+
+  it.each([false, true])(
+    'is a start Orca stopped after a host stop (during startup: %s)',
+    (starting) => {
+      expect(structuredAgentSessionEndedChildFailure(ended('host-stop', starting))).toEqual({
+        failure: { kind: 'hostStopped' }
+      })
+    }
+  )
+
+  it.each(['exit', 'attach-failed', 'evict'] as const)(
+    'carries the recorded failure of a %s, as a failed start while starting',
+    (cause) => {
+      expect(structuredAgentSessionEndedChildFailure(ended(cause, true))).toEqual({
+        exit: EXIT_FAILURE
+      })
+      expect(structuredAgentSessionEndedChildFailure(ended(cause, false))).toEqual({
+        failure: EXIT_FAILURE
+      })
+      expect(
+        structuredAgentSessionEndedChildFailure({ ...ended(cause, false), failure: undefined })
+      ).toEqual({ failure: agentSessionFailureFact('providerExited') })
+    }
+  )
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.ts
new file mode 100644
index 00000000000..373e2ae3c36
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.ts
@@ -0,0 +1,301 @@
+// The one thing that starts a provider child for a send, the one thing that hands a message to
+// it, and the one thing that settles a queued message because of a start, a child or a leftover.
+//
+// A send is accepted on its own serialized step and returns; this loop does the rest. It exists
+// for a session exactly while a message is queued there — accepted, not yet handed over — and no
+// child is running a conversation command: a command's turn takes no input, and the commit that
+// ends it wakes the loop again. Every step re-reads the journal and the conversation's child
+// record to decide, so there is no loop state to disagree with them. Each step is its own serialized task. That is what lets a Stop
+// that arrives while a start holds the queue withdraw the queued messages before the handover that
+// would have written them. Stop and the conversation's close are the only other writers of a
+// queued message: a child's exit only ends the child, and this loop reads why.
+
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import {
+  agentSessionFailureFact,
+  type SubmissionRejectionFact
+} from '../../../shared/agent-session-failure'
+import {
+  agentSessionFailureWords,
+  type AgentSessionFailureWordsContext
+} from '../../../shared/agent-session-failure-words'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import {
+  structuredAgentSessionStartFailure,
+  type StructuredAgentSessionStartFailureCause
+} from './structured-agent-session-failure-text'
+import type { StructuredAgentSessionResumeOutcome } from './structured-agent-session-agent-start'
+import type {
+  StructuredAgentSessionChildEndCause,
+  StructuredAgentSessionEndedChild,
+  StructuredAgentSessionHostSession,
+  StructuredAgentSessionProviderChildIdentity
+} from './structured-agent-session-host-types'
+import {
+  oldestQueuedSubmission,
+  recordStructuredAgentSessionStartFailure
+} from './structured-agent-session-start-failure-row'
+import { failedProviderChildStart } from './structured-agent-session-provider-child'
+import { handOverSubmission } from './structured-agent-session-turns'
+import { structuredAgentSessionCommandRunning } from './structured-agent-session-command-turn'
+
+export type StructuredAgentSessionDeliveryLoopDeps = {
+  sessions: ReadonlyMap<string, StructuredAgentSessionHostSession>
+  adapter: StructuredAgentSessionAdapter
+  serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
+  /** A start step, tracked from enqueue so quit waits for the child it may produce. */
+  trackStart: <T>(start: Promise<T>) => Promise<T>
+  /** Gives the session a provider child if it has none; for a caller inside `serialize`. */
+  /** Starts a child for `startedFor`, the queued message at the head, if the session has none. */
+  ensureProviderChild: (
+    sessionId: string,
+    startedFor: string
+  ) => Promise<StructuredAgentSessionResumeOutcome>
+  /** The fence the conversation's own writes carry; see `structuredAgentSessionConversationFence`. */
+  conversationFence: (sessionId: string) => number
+  /** Who the chat's failure sentences name. */
+  failureTextContext: (sessionId: string) => AgentSessionFailureWordsContext
+  onError: (sessionId: string, error: unknown) => void
+  record: (sessionId: string) => AgentSessionRecord | null
+  flushStreamedEvents: (sessionId: string) => Promise<void>
+  now: () => number
+}
+
+type Step = 'continue' | 'stop'
+
+type Prepared =
+  | 'stop'
+  | Extract<StructuredAgentSessionResumeOutcome, { ok: false }>
+  | { ok: true; awaited: StructuredAgentSessionProviderChildIdentity | null }
+
+/** A failed start before it is worded; `fail` words it once, through the one wording point. */
+type StartFailure = { startKey: string | null; cause: StructuredAgentSessionStartFailureCause }
+
+export class StructuredAgentSessionDeliveryLoop {
+  private readonly running = new Set<string>()
+  private disposed = false
+
+  constructor(private readonly deps: StructuredAgentSessionDeliveryLoopDeps) {}
+
+  isRunning(sessionId: string): boolean {
+    return this.running.has(sessionId)
+  }
+
+  /** Quit: no step after this one starts a child or hands a message over. */
+  dispose(): void {
+    this.disposed = true
+  }
+
+  /** From inside the session's serialize, after a message was accepted or the conversation
+   *  opened. A loop already running re-reads the journal on its next step. */
+  wake(sessionId: string): void {
+    if (this.disposed || this.running.has(sessionId)) {
+      return
+    }
+    this.running.add(sessionId)
+    void this.run(sessionId)
+  }
+
+  private async run(sessionId: string): Promise<void> {
+    try {
+      for (;;) {
+        const prepared = await this.deps.trackStart(
+          this.deps.serialize(sessionId, () => this.prepare(sessionId))
+        )
+        if (prepared === 'stop') {
+          return
+        }
+        if (!prepared.ok) {
+          const { refusal, diagnostic } = prepared
+          const cause = { refusal, ...(diagnostic ? { diagnostic } : {}) }
+          await this.deps.serialize(sessionId, () =>
+            this.fail(sessionId, { startKey: null, cause })
+          )
+          return
+        }
+        // A child published before it proved its start takes no input yet; waited for outside
+        // the queue so a Stop can reach it meanwhile.
+        const failure = await this.deps.adapter.awaitStarted?.(sessionId)
+        const handed = await this.deps.serialize(sessionId, () =>
+          this.handOver(sessionId, prepared.awaited, failure || null)
+        )
+        if (handed === 'stop') {
+          return
+        }
+      }
+    } catch (error) {
+      // The error is Orca's own and goes to the log; the chat says only that Orca failed.
+      this.deps.onError(sessionId, error)
+      const cause = { hostFault: true } as const
+      await this.deps
+        .serialize(sessionId, () => this.fail(sessionId, { startKey: null, cause }))
+        .catch((failure: unknown) => {
+          // Rows left queued are rejected by the next open, or by the next loop an accept wakes.
+          this.running.delete(sessionId)
+          this.deps.onError(sessionId, failure)
+        })
+    }
+  }
+
+  /** Settles what an earlier host process left queued, then makes the session ready. */
+  private async prepare(sessionId: string): Promise<Prepared> {
+    const session = this.deps.sessions.get(sessionId)
+    if (!session || this.disposed) {
+      return this.stop(sessionId)
+    }
+    await session.journal.rejectQueuedSubmissions(
+      this.deps.conversationFence(sessionId),
+      agentSessionFailureWords(agentSessionFailureFact('hostRestarted'), { surface: 'rejection' }),
+      // A handle closes only with nothing queued, so one an earlier handle wrote is a leftover.
+      (submission) => session.journal.wroteBeforeOpen(submission.acceptedSequence)
+    )
+    const oldest = oldestQueuedSubmission(session)
+    // A running command takes no input while its child carries it; its end is a commit, which
+    // wakes the loop again. With no child it is a gone generation's, which the start below settles.
+    if (!oldest || (session.child && structuredAgentSessionCommandRunning(session.journal))) {
+      return this.stop(sessionId)
+    }
+    const failedStart = startThatFailedWhileQueued(session, oldest)
+    if (failedStart) {
+      return this.fail(sessionId, failedStart)
+    }
+    const ready = await this.deps.ensureProviderChild(sessionId, oldest.clientMessageId)
+    if (!ready.ok) {
+      return ready
+    }
+    const child = this.deps.sessions.get(sessionId)?.child
+    // The child this run waits on; handover checks it is still the one there.
+    return {
+      ok: true,
+      awaited: child ? { generation: child.generation, fence: child.fence } : null
+    }
+  }
+
+  private async handOver(
+    sessionId: string,
+    awaited: StructuredAgentSessionProviderChildIdentity | null,
+    startFailure: SubmissionRejectionFact | null
+  ): Promise<Step> {
+    const session = this.deps.sessions.get(sessionId)
+    if (!session || this.disposed) {
+      return this.stop(sessionId)
+    }
+    // Re-derived here, not carried from the start: the child may have ended, or another may have
+    // taken its place, since.
+    const { child } = session
+    const awaitedChild =
+      child && awaited && child.generation === awaited.generation && child.fence === awaited.fence
+        ? child
+        : null
+    // The host's `starting` trails the adapter's `started` by one serialized step, so for the child
+    // waited on, the adapter's own answer decides whether its start landed.
+    if (!awaitedChild || (awaitedChild.phase === 'starting' && startFailure !== null)) {
+      // The child waited on is gone, replaced by another, or settled its start without proving it.
+      const ended = awaitedChild ? undefined : session.lastEndedChild
+      const endedFailure = ended ? structuredAgentSessionEndedChildFailure(ended) : undefined
+      // A user's Stop is not a failure: the next step starts, or waits on, a child for what is
+      // queued.
+      if (endedFailure === null) {
+        return 'continue'
+      }
+      return this.fail(sessionId, {
+        startKey: awaited?.generation ?? null,
+        cause: endedFailure ??
+          // Gone with no end observed: nothing says the provider stopped.
+          { failure: startFailure ?? agentSessionFailureFact('startFailed') }
+      })
+    }
+    const next = oldestQueuedSubmission(session)
+    if (!next) {
+      return this.stop(sessionId)
+    }
+    await handOverSubmission(
+      {
+        sessionId,
+        journal: session.journal,
+        fence: awaitedChild.fence,
+        adapter: this.deps.adapter,
+        providerChildPhase: () => this.deps.sessions.get(sessionId)?.child?.phase,
+        failureTextContext: this.deps.failureTextContext(sessionId),
+        record: () => this.deps.record(sessionId),
+        flushStreamedEvents: () => this.deps.flushStreamedEvents(sessionId),
+        now: this.deps.now
+      },
+      next
+    )
+    return 'continue'
+  }
+
+  private async fail(sessionId: string, failure: StartFailure): Promise<'stop'> {
+    const session = this.deps.sessions.get(sessionId)
+    if (session) {
+      await recordStructuredAgentSessionStartFailure(
+        { journal: session.journal, fence: this.deps.conversationFence(sessionId) },
+        {
+          startKey: failure.startKey,
+          ...structuredAgentSessionStartFailure(
+            failure.cause,
+            this.deps.failureTextContext(sessionId)
+          )
+        }
+      )
+    }
+    return this.stop(sessionId)
+  }
+
+  /** Inside the serialized step that found nothing to do, so an accept after it wakes anew. */
+  private stop(sessionId: string): 'stop' {
+    this.running.delete(sessionId)
+    return 'stop'
+  }
+}
+
+/** A start that died while this message waited on it — a view's, say — is the message's failed
+ *  start: settled with it, under its key, rather than started again into the same failure. */
+function startThatFailedWhileQueued(
+  session: StructuredAgentSessionHostSession,
+  oldest: NonNullable<ReturnType<typeof oldestQueuedSubmission>>
+): StartFailure | null {
+  const ended = failedProviderChildStart(session)
+  if (
+    !ended ||
+    oldest.acceptedSequence === undefined ||
+    ended.endedAt.epoch !== session.journal.cursor().epoch ||
+    ended.endedAt.sequence < oldest.acceptedSequence
+  ) {
+    return null
+  }
+  const cause = structuredAgentSessionEndedChildFailure(ended)
+  return cause ? { startKey: ended.generation, cause } : null
+}
+
+function providerEndFailure(
+  ended: StructuredAgentSessionEndedChild
+): StructuredAgentSessionStartFailureCause {
+  if (ended.duringStartup) {
+    return { exit: ended.failure }
+  }
+  return { failure: ended.failure ?? agentSessionFailureFact('providerExited') }
+}
+
+// Every end cause, so a new one does not compile until it says whether it fails what is queued.
+const ENDED_CHILD_FAILURE = {
+  'user-stop': () => null,
+  // The host stopping the child is Orca's cause, never the provider's: a start that never finished.
+  'host-stop': () => ({ failure: agentSessionFailureFact('hostStopped') }),
+  exit: providerEndFailure,
+  // The attach records its own fault as the end's failure.
+  'attach-failed': providerEndFailure,
+  // Reached only when an eviction's stop landed and a later step failed, leaving the conversation.
+  evict: providerEndFailure
+} satisfies Record<
+  StructuredAgentSessionChildEndCause,
+  (ended: StructuredAgentSessionEndedChild) => StructuredAgentSessionStartFailureCause | null
+>
+
+/** Why a queued message the child never took is rejected; null when its end fails nothing. */
+export function structuredAgentSessionEndedChildFailure(
+  ended: StructuredAgentSessionEndedChild
+): StructuredAgentSessionStartFailureCause | null {
+  return ENDED_CHILD_FAILURE[ended.cause](ended)
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-event-recovery.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-event-recovery.ts
index 19989e10711..f7a50627370 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-event-recovery.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-event-recovery.ts
@@ -1,3 +1,4 @@
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
 import {
   stopAgentSessionProviderRoot,
   type StructuredAgentSessionLifecycleEvent
@@ -7,12 +8,8 @@ import type {
   StructuredAgentSessionHostSession
 } from './structured-agent-session-host-types'
 import type { StructuredAgentSessionSinkBarrier } from './structured-agent-session-event-sink'
-import type { StructuredAgentSessionHolds } from './structured-agent-session-holds'
 import { settleStructuredAgentSessionProviderStarted } from './structured-agent-session-provider-started'
-import {
-  isStructuredAgentSessionRecoveryTicketCurrent,
-  settleUnexpectedStructuredAgentSessionExit
-} from './structured-agent-session-unexpected-exit'
+import { settleUnexpectedStructuredAgentSessionExit } from './structured-agent-session-unexpected-exit'
 
 export class StructuredAgentSessionEventRecovery {
   private readonly sinkFailures = new Set<string>()
@@ -25,12 +22,8 @@ export class StructuredAgentSessionEventRecovery {
       flushLifecycle: (sessionId: string) => Promise<StructuredAgentSessionSinkBarrier>
       publishFence: (sessionId: string, session: StructuredAgentSessionHostSession) => void
       publishStatus?: (sessionId: string) => void
-      hasResumeCapableHolder: (sessionId: string) => boolean
-      restartReleaseGrace: (sessionId: string) => void
       serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
       now: () => number
-      /** The one restart every asker shares; the holds put an unheld child on the idle clock. */
-      ensureProviderChild: StructuredAgentSessionHolds['ensureProviderChild']
       onBarrierError: (sessionId: string, error: unknown) => void
     }
   ) {}
@@ -42,14 +35,13 @@ export class StructuredAgentSessionEventRecovery {
     this.sinkFailures.add(sessionId)
     void this.context
       .serialize(sessionId, async () => {
-        const session = this.context.sessions.get(sessionId)
+        const child = this.context.sessions.get(sessionId)?.child
         const stop =
           this.context.deps.adapter.forceCloseSession ?? this.context.deps.adapter.closeSession
-        if (!session?.hasProviderChild || !stop) {
+        if (!child || !stop) {
           return null
         }
-        const fence = session.fence
-        const acquisitionGeneration = session.acquisitionGeneration
+        const { fence, generation: acquisitionGeneration } = child
         const stopped = await stopAgentSessionProviderRoot(() => stop(sessionId))
         if (!stopped || !acquisitionGeneration) {
           return null
@@ -58,6 +50,8 @@ export class StructuredAgentSessionEventRecovery {
           type: 'ended',
           sessionId,
           reason: `journal sink failure: ${error instanceof Error ? error.message : String(error)}`,
+          // Orca stopped the provider because its own journal failed.
+          failure: agentSessionFailureFact('hostFault'),
           cause: 'unexpected-exit',
           fence,
           acquisitionGeneration
@@ -68,34 +62,12 @@ export class StructuredAgentSessionEventRecovery {
       .finally(() => this.sinkFailures.delete(sessionId))
   }
 
+  /** An exit is settled and shown; nothing restarts the child. The next send does, through the
+   *  delivery loop, which also owns any message still queued. */
   async handle(event: StructuredAgentSessionLifecycleEvent): Promise<void> {
     if (event.type === 'started') {
       return settleStructuredAgentSessionProviderStarted(this.context, event)
     }
-    const ticket = await settleUnexpectedStructuredAgentSessionExit(this.context, event)
-    if (!ticket) {
-      return
-    }
-    // One serialized step with the ticket check inside it: a hold or a send that got there first
-    // has already replaced the owner, and this step finds that child and attaches nothing — or,
-    // once the lease has moved on, refuses on the stale ticket rather than spawning a second child.
-    try {
-      const resumed = await this.context.serialize(ticket.sessionId, () =>
-        this.context.ensureProviderChild(ticket.sessionId, {
-          admitRecoveryTicket: () =>
-            isStructuredAgentSessionRecoveryTicketCurrent(this.context, ticket)
-        })
-      )
-      if (!resumed.ok && isStructuredAgentSessionRecoveryTicketCurrent(this.context, ticket)) {
-        this.context.onBarrierError(
-          ticket.sessionId,
-          new Error(`${resumed.refusal.code}: ${resumed.refusal.message}`)
-        )
-      }
-    } catch (error) {
-      if (isStructuredAgentSessionRecoveryTicketCurrent(this.context, ticket)) {
-        this.context.onBarrierError(ticket.sessionId, error)
-      }
-    }
+    await settleUnexpectedStructuredAgentSessionExit(this.context, event)
   }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink-queue.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink-queue.ts
index c9a32533db4..428a3c1c0d4 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink-queue.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink-queue.ts
@@ -15,6 +15,8 @@ export type StructuredAgentSessionSinkOperation = {
   lifecycleBytes?: number
   lifecycle?: boolean
   coalescingKey?: string
+  /** The queued operation with this key wins, as the journal keeps a settlement's first batch. */
+  keepsFirst?: boolean
   run: (target: StructuredAgentSessionEventTarget) => Promise<unknown> | void
 }
 
@@ -117,10 +119,13 @@ export class StructuredAgentSessionSinkQueue {
     if (this.failure !== null) {
       return { accepted: false, reason: 'failed' }
     }
-    const sequence = ++this.acceptedSequence
     const key = options.coalescingKey ?? operation.coalescingKey
     const replaceAt = key ? this.queue.findIndex((queued) => queued.coalescingKey === key) : -1
     const replaced = replaceAt >= 0 ? this.queue[replaceAt] : undefined
+    if (replaced && operation.keepsFirst) {
+      return { accepted: true }
+    }
+    const sequence = ++this.acceptedSequence
     const lifecycle = operation.lifecycle ?? options.lifecycle === true
     const lifecycleBytes = lifecycle ? (operation.lifecycleBytes ?? operation.bytes) : 0
     const nextBytes = this.queuedBytes - (replaced?.bytes ?? 0) + operation.bytes
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.test.ts
index 6c3747fb824..46dc8fbf7e4 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { describe, expect, it, vi } from 'vitest'
 import type {
   AgentJournalItemBody,
@@ -37,7 +38,7 @@ type Recorded = {
  *  it: a double that omits the third parameter makes every assertion about what
  *  the sink forwards pass against `undefined`, which is how this went unnoticed
  *  before. Kept separate so the call-order assertions stay about call order. */
-const journalAppendOptions: JournalItemAppendOptions[] = []
+const journalAppendOptions: Partial<JournalItemAppendOptions>[] = []
 
 function target(
   fence: number,
@@ -92,8 +93,8 @@ describe('deferred structured agent-session event sink', () => {
     const log: Recorded[] = []
     const deferred = createDeferredStructuredAgentSessionEventSink()
 
-    deferred.sink.appendItem(identity(0), BODY)
-    deferred.sink.appendItem(identity(1), BODY)
+    deferred.sink.appendItem(identity(0), BODY, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
+    deferred.sink.appendItem(identity(1), BODY, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
     deferred.sink.publish()
     expect(log).toEqual([])
 
@@ -112,10 +113,10 @@ describe('deferred structured agent-session event sink', () => {
     const deferred = createDeferredStructuredAgentSessionEventSink()
     deferred.bind(target(1, log))
 
-    deferred.sink.appendItem(identity(0), BODY)
+    deferred.sink.appendItem(identity(0), BODY, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
     // The re-attach that raised the fence.
     deferred.bind(target(2, log))
-    deferred.sink.appendItem(identity(1), BODY)
+    deferred.sink.appendItem(identity(1), BODY, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
     await deferred.drained()
 
     expect(log).toEqual([
@@ -130,7 +131,7 @@ describe('deferred structured agent-session event sink', () => {
     deferred.bind(target(1, log))
     deferred.unbind()
 
-    deferred.sink.appendItem(identity(0), BODY)
+    deferred.sink.appendItem(identity(0), BODY, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
     expect(log).toEqual([])
     deferred.bind(target(2, log))
     await deferred.drained()
@@ -143,9 +144,15 @@ describe('deferred structured agent-session event sink', () => {
     const deferred = createDeferredStructuredAgentSessionEventSink()
 
     expect(
-      deferred.sink.tryAppendLifecycleTransition?.(identity(0), BODY, () => identity(1))
+      deferred.sink.tryAppendLifecycleTransition?.(identity(0), BODY, () => identity(1), {
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
     ).toEqual({ accepted: true })
-    expect(deferred.sink.tryAppendLifecycleTransition?.(identity(0), BODY, () => null)).toEqual({
+    expect(
+      deferred.sink.tryAppendLifecycleTransition?.(identity(0), BODY, () => null, {
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
+    ).toEqual({
       accepted: true
     })
     deferred.bind(target(2, log))
@@ -161,10 +168,10 @@ describe('deferred structured agent-session event sink', () => {
     const log: Recorded[] = []
     const deferred = createDeferredStructuredAgentSessionEventSink()
 
-    deferred.sink.appendItem(identity(0), BODY)
+    deferred.sink.appendItem(identity(0), BODY, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
     deferred.close()
     deferred.bind(target(3, log))
-    deferred.sink.appendItem(identity(1), BODY)
+    deferred.sink.appendItem(identity(1), BODY, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
     await deferred.drained()
 
     expect(log).toEqual([])
@@ -180,7 +187,7 @@ describe('deferred structured agent-session event sink', () => {
     })
     deferred.bind(target(4, log, 0))
 
-    deferred.sink.appendItem(identity(0), BODY)
+    deferred.sink.appendItem(identity(0), BODY, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
     deferred.sink.appendTombstone(identity(1))
     const barrier = await deferred.drained()
 
@@ -202,14 +209,14 @@ describe('deferred structured agent-session event sink', () => {
     const runtime = new StructuredAgentSessionHostRuntimeState({ store: {} } as never)
     const failed = runtime.eventSinkFor('session-1')
     failed.bind(target(1, [], 0))
-    failed.sink.appendItem(identity(0), BODY)
+    failed.sink.appendItem(identity(0), BODY, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
     await expect(failed.drained()).resolves.toMatchObject({ ok: false })
 
     const recovered = runtime.eventSinkFor('session-1')
     expect(recovered).not.toBe(failed)
     const log: Recorded[] = []
     recovered.bind(target(2, log))
-    recovered.sink.appendItem(identity(1), BODY)
+    recovered.sink.appendItem(identity(1), BODY, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
     await expect(recovered.drained()).resolves.toEqual({ ok: true })
     expect(log).toEqual([{ call: 'appendItem', fence: 2, ordinal: 1 }])
   })
@@ -229,9 +236,15 @@ describe('deferred structured agent-session event sink', () => {
       onBackpressureChange: (paused) => changes.push(paused)
     })
 
-    expect(deferred.sink.tryAppendItem?.(identity(0), BODY)).toEqual({ accepted: true })
-    expect(deferred.sink.tryAppendItem?.(identity(1), BODY)).toEqual({ accepted: true })
-    expect(deferred.sink.tryAppendItem?.(identity(2), BODY)).toEqual({
+    expect(
+      deferred.sink.tryAppendItem?.(identity(0), BODY, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
+    ).toEqual({ accepted: true })
+    expect(
+      deferred.sink.tryAppendItem?.(identity(1), BODY, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
+    ).toEqual({ accepted: true })
+    expect(
+      deferred.sink.tryAppendItem?.(identity(2), BODY, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
+    ).toEqual({
       accepted: false,
       reason: 'backpressure'
     })
@@ -257,11 +270,17 @@ describe('deferred structured agent-session event sink', () => {
       }
     })
 
-    expect(deferred.sink.tryAppendItem?.(identity(0), BODY)).toEqual({ accepted: true })
     expect(
-      deferred.sink.tryAppendResolvedItemAndPublish?.(identity(1), BODY, () => identity(1))
+      deferred.sink.tryAppendItem?.(identity(0), BODY, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
     ).toEqual({ accepted: true })
-    expect(deferred.sink.tryAppendItem?.(identity(2), BODY)).toEqual({
+    expect(
+      deferred.sink.tryAppendResolvedItemAndPublish?.(identity(1), BODY, () => identity(1), {
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
+    ).toEqual({ accepted: true })
+    expect(
+      deferred.sink.tryAppendItem?.(identity(2), BODY, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
+    ).toEqual({
       accepted: false,
       reason: 'backpressure'
     })
@@ -292,7 +311,9 @@ describe('deferred structured agent-session event sink', () => {
       onBackpressureChange: (paused) => changes.push(paused)
     })
 
-    expect(deferred.sink.tryAppendItem?.(identity(0), BODY)).toEqual({ accepted: true })
+    expect(
+      deferred.sink.tryAppendItem?.(identity(0), BODY, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
+    ).toEqual({ accepted: true })
     expect(deferred.state()).toMatchObject({ backpressured: true, queuedOperations: 1 })
     expect(readingControl.pauseReading).toHaveBeenCalledOnce()
 
@@ -322,7 +343,7 @@ describe('deferred structured agent-session event sink', () => {
 
     deferred.sink.appendLifecycleBatch?.(
       'settlement-1',
-      [{ kind: 'item', identity: identity(0), body: BODY }],
+      [{ kind: 'item', identity: identity(0), body: BODY, turnScope: AGENT_JOURNAL_THREAD_SCOPE }],
       { lifecycle: true }
     )
     expect(deferred.sink.tryPublish?.({ lifecycle: true })).toEqual({
@@ -354,7 +375,9 @@ describe('deferred structured agent-session event sink', () => {
     })
     const releaseFirst = deferred.sink.bindReadingControl?.(firstControl)
 
-    expect(deferred.sink.tryAppendItem?.(identity(0), BODY)).toEqual({ accepted: true })
+    expect(
+      deferred.sink.tryAppendItem?.(identity(0), BODY, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
+    ).toEqual({ accepted: true })
     expect(firstControl.pauseReading).toHaveBeenCalledOnce()
 
     const releaseSecond = deferred.sink.bindReadingControl?.(secondControl)
@@ -373,7 +396,7 @@ describe('deferred structured agent-session event sink', () => {
   it('replaces a queued same-item checkpoint before it runs', async () => {
     const log: Recorded[] = []
     const deferred = createDeferredStructuredAgentSessionEventSink()
-    const options = { coalescingKey: 'checkpoint:item-1' }
+    const options = { coalescingKey: 'checkpoint:item-1', turnScope: AGENT_JOURNAL_THREAD_SCOPE }
 
     deferred.sink.appendItem(identity(0), BODY, options)
     deferred.sink.appendItem(identity(1), BODY, options)
@@ -384,13 +407,44 @@ describe('deferred structured agent-session event sink', () => {
     expect(log).toEqual([{ call: 'appendItem', fence: 6, ordinal: 1 }])
   })
 
+  it('keeps the first queued lifecycle batch for a settlement, as the journal does', async () => {
+    // The journal applies a settlement id once and skips any later batch with it,
+    // so the queue must not let a later batch replace one it has not run yet.
+    const log: Recorded[] = []
+    const deferred = createDeferredStructuredAgentSessionEventSink()
+    const batch = (ordinal: number) => [
+      {
+        kind: 'item' as const,
+        identity: identity(ordinal),
+        body: BODY,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      }
+    ]
+
+    deferred.sink.appendLifecycleBatch?.('turn-completed:turn-1', batch(0))
+    expect(deferred.sink.tryAppendLifecycleBatch?.('turn-completed:turn-1', batch(1))).toEqual({
+      accepted: true
+    })
+    expect(deferred.state().queuedOperations).toBe(1)
+
+    const bound = target(6, log)
+    deferred.bind(bound)
+    await deferred.drained()
+
+    expect(
+      vi
+        .mocked(bound.journal.appendLifecycleBatch)
+        .mock.calls.map(([input]) => input.mutations.map((mutation) => mutation.identity))
+    ).toEqual([[identity(0)]])
+  })
+
   it('keeps a replacement checkpoint after distinct intervening operations', async () => {
     const log: Recorded[] = []
     const deferred = createDeferredStructuredAgentSessionEventSink()
-    const options = { coalescingKey: 'checkpoint:item-1' }
+    const options = { coalescingKey: 'checkpoint:item-1', turnScope: AGENT_JOURNAL_THREAD_SCOPE }
 
     deferred.sink.appendItem(identity(0), BODY, options)
-    deferred.sink.appendItem(identity(1), BODY)
+    deferred.sink.appendItem(identity(1), BODY, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
     deferred.sink.appendItem(identity(2), BODY, options)
     deferred.bind(target(6, log))
     await deferred.drained()
@@ -434,10 +488,15 @@ describe('producer linkage reaches the journal through every append path', () =>
       const log: Recorded[] = []
       const deferred = createDeferredStructuredAgentSessionEventSink()
       deferred.bind(target(5, log))
-      deferred.sink[append]?.(identity(1), BODY, { ...LINKAGE })
+      deferred.sink[append]?.(identity(1), BODY, {
+        ...LINKAGE,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
       await deferred.drained()
 
-      expect(journalAppendOptions).toEqual([{ fence: 5, ...LINKAGE }])
+      expect(journalAppendOptions).toEqual([
+        { fence: 5, turnScope: AGENT_JOURNAL_THREAD_SCOPE, ...LINKAGE }
+      ])
       deferred.close()
     }
   })
@@ -453,10 +512,15 @@ describe('producer linkage reaches the journal through every append path', () =>
       const log: Recorded[] = []
       const deferred = createDeferredStructuredAgentSessionEventSink()
       deferred.bind(target(5, log))
-      deferred.sink[append]?.(identity(1), BODY, () => identity(1), { ...LINKAGE })
+      deferred.sink[append]?.(identity(1), BODY, () => identity(1), {
+        ...LINKAGE,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
       await deferred.drained()
 
-      expect(journalAppendOptions).toEqual([{ fence: 5, ...LINKAGE }])
+      expect(journalAppendOptions).toEqual([
+        { fence: 5, turnScope: AGENT_JOURNAL_THREAD_SCOPE, ...LINKAGE }
+      ])
       deferred.close()
     }
   })
@@ -470,7 +534,7 @@ describe('producer linkage reaches the journal through every append path', () =>
     deferred.bind(target(5, log))
     deferred.sink.appendLifecycleBatch?.(
       'settle-1',
-      [{ kind: 'item', identity: identity(1), body: BODY }],
+      [{ kind: 'item', identity: identity(1), body: BODY, turnScope: AGENT_JOURNAL_THREAD_SCOPE }],
       { ...LINKAGE }
     )
 
@@ -485,13 +549,13 @@ describe('producer linkage reaches the journal through every append path', () =>
     const log: Recorded[] = []
     const deferred = createDeferredStructuredAgentSessionEventSink()
     deferred.bind(target(5, log))
-    deferred.sink.appendItem(identity(1), BODY)
+    deferred.sink.appendItem(identity(1), BODY, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
     await deferred.drained()
 
     // A control, not a pin. Absence is the claim, so the keys must be missing
     // rather than present-and-undefined: a reader holding this options object
     // would read `agentId: undefined` as a key that exists.
-    expect(journalAppendOptions).toEqual([{ fence: 5 }])
+    expect(journalAppendOptions).toEqual([{ fence: 5, turnScope: AGENT_JOURNAL_THREAD_SCOPE }])
     deferred.close()
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.ts
index 923342b7fa6..f712c36cc91 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.ts
@@ -2,7 +2,8 @@ import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-
 import type {
   AgentJournalItemBody,
   AgentJournalItemIdentity,
-  AgentJournalProducerLinkage
+  AgentJournalProducerLinkage,
+  AgentJournalTurnScope
 } from '../../../shared/agent-session-journal-types'
 import type { AgentSessionTurnActivity } from '../../../shared/agent-session-wire'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
@@ -36,6 +37,11 @@ export type StructuredAgentSessionAppendOptions = AgentJournalProducerLinkage &
   observedAt?: number
 }
 
+/** An item write states which turn its row belongs to; the write that creates the row decides. */
+export type StructuredAgentSessionItemAppendOptions = StructuredAgentSessionAppendOptions & {
+  turnScope: AgentJournalTurnScope
+}
+
 export type StructuredAgentSessionLifecycleJournal = Pick<
   AgentSessionJournal,
   'epoch' | 'visitItems'
@@ -58,7 +64,7 @@ export type StructuredAgentSessionRevisionResolver = (
 
 /** A revision's body is derived from the row it revises, so coalescing one away would lose it. */
 export type StructuredAgentSessionRevisionOptions = Omit<
-  StructuredAgentSessionAppendOptions,
+  StructuredAgentSessionItemAppendOptions,
   'coalescingKey'
 >
 
@@ -69,7 +75,7 @@ export type StructuredAgentSessionEventSink = {
   appendItem(
     identity: AgentJournalItemIdentity,
     body: AgentJournalItemBody,
-    options?: StructuredAgentSessionAppendOptions
+    options: StructuredAgentSessionItemAppendOptions
   ): void
   appendTombstone(
     identity: AgentJournalItemIdentity,
@@ -84,40 +90,40 @@ export type StructuredAgentSessionEventSink = {
   tryAppendItem?(
     identity: AgentJournalItemIdentity,
     body: AgentJournalItemBody,
-    options?: StructuredAgentSessionAppendOptions
+    options: StructuredAgentSessionItemAppendOptions
   ): StructuredAgentSessionSinkAdmission
   /** Queues an ordinary append whose identity is resolved after journal bind. */
   tryAppendResolvedItem?(
     identitySizeBound: AgentJournalItemIdentity,
     body: AgentJournalItemBody,
     resolveIdentity: StructuredAgentSessionIdentityResolver,
-    options?: StructuredAgentSessionAppendOptions
+    options: StructuredAgentSessionItemAppendOptions
   ): StructuredAgentSessionSinkAdmission
   /** Queues one resolved append and its publication as a single admitted operation. */
   tryAppendResolvedItemAndPublish?(
     identitySizeBound: AgentJournalItemIdentity,
     body: AgentJournalItemBody,
     resolveIdentity: StructuredAgentSessionIdentityResolver,
-    options?: StructuredAgentSessionAppendOptions
+    options: StructuredAgentSessionItemAppendOptions
   ): StructuredAgentSessionSinkAdmission
   /** Queues a read-modify-write of one row; `reservedBytes` must bound the resolved write. */
   tryReviseResolvedItem?(
     reservedBytes: number,
     resolve: StructuredAgentSessionRevisionResolver,
-    options?: StructuredAgentSessionRevisionOptions
+    options: StructuredAgentSessionRevisionOptions
   ): StructuredAgentSessionSinkAdmission
   /** Queues one revision and its publication as a single admitted operation. */
   tryReviseResolvedItemAndPublish?(
     reservedBytes: number,
     resolve: StructuredAgentSessionRevisionResolver,
-    options?: StructuredAgentSessionRevisionOptions
+    options: StructuredAgentSessionRevisionOptions
   ): StructuredAgentSessionSinkAdmission
   /** Queues one journal-derived lifecycle append; a null resolution is a no-op. */
   tryAppendLifecycleTransition?(
     identitySizeBound: AgentJournalItemIdentity,
     body: AgentJournalItemBody,
     resolveIdentity: StructuredAgentSessionIdentityResolver,
-    options?: StructuredAgentSessionAppendOptions
+    options: StructuredAgentSessionItemAppendOptions
   ): StructuredAgentSessionSinkAdmission
   /** Current durable epoch, when this deferred sink is bound to its journal. */
   journalEpoch?(): string | null
@@ -205,6 +211,7 @@ export function createDeferredStructuredAgentSessionEventSink(
       {
         bytes: Buffer.byteLength(JSON.stringify({ settlementId, mutations }), 'utf8') + 512,
         coalescingKey: `lifecycle:${settlementId}`,
+        keepsFirst: true,
         run: (bound) =>
           bound.journal.appendLifecycleBatch({
             settlementId,
@@ -230,7 +237,7 @@ export function createDeferredStructuredAgentSessionEventSink(
 
   return {
     sink: {
-      appendItem: (identity, body, options = {}) => {
+      appendItem: (identity, body, options) => {
         queue.submit(
           {
             bytes: estimateStructuredAgentSessionItemBytes(identity, body),
@@ -245,7 +252,7 @@ export function createDeferredStructuredAgentSessionEventSink(
           options
         )
       },
-      tryAppendItem: (identity, body, options = {}) =>
+      tryAppendItem: (identity, body, options) =>
         queue.submit(
           {
             bytes: estimateStructuredAgentSessionItemBytes(identity, body),
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts
index cb0cb2fb233..8fc810de2a4 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts
@@ -30,8 +30,8 @@ function context(): StructuredAgentSessionEvictionContext & { order: string[] }
         return true
       })
     } as unknown as StructuredAgentSessionEvictionContext['adapter'],
-    forget: vi.fn(async () => {
-      order.push('forget')
+    acknowledgeRelease: vi.fn(() => {
+      order.push('acknowledgeRelease')
     }),
     discardSink: vi.fn(() => order.push('discardSink')),
     settleWork: vi.fn(async () => {
@@ -51,7 +51,7 @@ function runtimeState(): StructuredAgentSessionHostRuntimeState {
 }
 
 describe('structured agent session eviction', () => {
-  it('stops the child before it lets the sink go, then forgets the session', async () => {
+  it('stops the child before it lets the sink go, then acknowledges the release', async () => {
     const ctx = context()
     await evictStructuredAgentSession(ctx)
     expect(ctx.order).toEqual([
@@ -62,7 +62,7 @@ describe('structured agent session eviction', () => {
       'close',
       'discardSink',
       'releaseLease',
-      'forget'
+      'acknowledgeRelease'
     ])
   })
 
@@ -90,7 +90,7 @@ describe('structured agent session eviction', () => {
       'close-sink',
       'discard-sink',
       'release-lease',
-      'forget-session'
+      'acknowledge-release'
     ])
   })
 
@@ -114,7 +114,7 @@ describe('structured agent session eviction', () => {
     }
   })
 
-  it('aborts after a failed drain barrier without unbinding or forgetting the session', async () => {
+  it('aborts after a failed drain barrier without unbinding or acknowledging the release', async () => {
     const ctx = context()
     ctx.eventSink.drained = vi.fn(async () => {
       ctx.order.push('drained')
@@ -128,7 +128,7 @@ describe('structured agent session eviction', () => {
     expect(ctx.eventSink.close).not.toHaveBeenCalled()
     expect(ctx.discardSink).not.toHaveBeenCalled()
     expect(ctx.releaseLease).not.toHaveBeenCalled()
-    expect(ctx.forget).not.toHaveBeenCalled()
+    expect(ctx.acknowledgeRelease).not.toHaveBeenCalled()
     expect(ctx.order).toEqual(['closeSession', 'drained'])
   })
 })
@@ -154,9 +154,9 @@ describe('rows the provider emits while closing', () => {
           return true
         }
       } as never,
-      forget: async () => {},
       discardSink: () => state.discardEventSink(sessionId),
-      releaseLease: async () => {}
+      releaseLease: async () => {},
+      acknowledgeRelease: () => {}
     })
 
     expect(published).toEqual(['final-flush'])
@@ -174,9 +174,13 @@ describe('a child that will not stop', () => {
     ctx.adapter.closeSession = vi.fn(async () => {
       throw error
     })
+    const stopped = vi.fn()
+    ctx.onProviderChildStopped = stopped
 
     await evictStructuredAgentSession(ctx)
 
+    // The host ends its child on the one reading of the verdict, not a second one of its own.
+    expect(stopped).toHaveBeenCalledWith({ rootGone: true })
     expect(ctx.order).toEqual([
       'drained',
       'settleWork',
@@ -184,18 +188,18 @@ describe('a child that will not stop', () => {
       'close',
       'discardSink',
       'releaseLease',
-      'forget'
+      'acknowledgeRelease'
     ])
   })
 
-  it('aborts without forgetting the session, so the next close is a real retry', async () => {
+  it('aborts without acknowledging the release, so the next stop is a real retry', async () => {
     const ctx = context()
     ctx.adapter.closeSession = vi.fn(async () => false)
 
     await expect(evictStructuredAgentSession(ctx)).rejects.toMatchObject({
       step: 'stop-provider-child'
     })
-    expect(ctx.forget).not.toHaveBeenCalled()
+    expect(ctx.acknowledgeRelease).not.toHaveBeenCalled()
     expect(ctx.discardSink).not.toHaveBeenCalled()
     expect(ctx.order).toEqual([])
   })
@@ -210,7 +214,7 @@ describe('a child that will not stop', () => {
       StructuredAgentSessionEvictionError
     )
     expect(ctx.eventSink.close).not.toHaveBeenCalled()
-    expect(ctx.forget).not.toHaveBeenCalled()
+    expect(ctx.acknowledgeRelease).not.toHaveBeenCalled()
   })
 })
 
@@ -225,9 +229,9 @@ describe('eviction against the real sink cache', () => {
       sessionId,
       eventSink: state.eventSinkFor(sessionId),
       adapter: { closeSession: async () => true } as never,
-      forget: async () => {},
       discardSink: () => state.discardEventSink(sessionId),
-      releaseLease: async () => {}
+      releaseLease: async () => {},
+      acknowledgeRelease: () => {}
     })
 
     const published: string[] = []
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.ts
index e5a1d942818..226781117bd 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.ts
@@ -1,4 +1,4 @@
-// Releasing one structured session's resources.
+// Stopping one structured session's provider child and handing its lease back.
 //
 // Teardown is a DATA list, not a method body, for the reason this file exists at all: the host
 // tracked which sessions were live in a map, and tore them down at three unrelated call sites
@@ -22,6 +22,7 @@ import {
   type StructuredAgentSessionAdapter
 } from './structured-agent-session-adapter'
 import type { DeferredStructuredAgentSessionEventSink } from './structured-agent-session-event-sink'
+import type { StructuredAgentSessionStopVerdict } from './structured-agent-session-host-types'
 import { withTimeout } from '../../../shared/promise-timeout-fallback'
 
 export type StructuredAgentSessionEvictionContext = {
@@ -29,17 +30,17 @@ export type StructuredAgentSessionEvictionContext = {
   hasProviderChild?: boolean
   eventSink: DeferredStructuredAgentSessionEventSink
   adapter: StructuredAgentSessionAdapter
-  /** Closes the session's journal handle and drops the map entry. Async and
-   *  awaited: `close()` is ordered behind queued writes, and a delete that
-   *  returns while the close is still queued leaves nothing to retry. */
-  forget: () => Promise<void>
+  /** Tells the adapter the released lease is done with, so it drops this child's route and index.
+   *  The conversation stays: stopping the agent never closes its journal. */
+  acknowledgeRelease: () => Promise<void> | void
   /** Drops the cached sink so a later attach mints a fresh one. */
   discardSink: () => void
   /** Fires right before the stop, while the child's turn and background roster are still live. A
    *  throw is logged, never allowed to abort the stop. */
   beforeProviderChildStop?: () => void
-  /** Fires once the adapter has PROVEN the child gone, so host bookkeeping stops claiming one. */
-  onProviderChildStopped?: () => void
+  /** Fires with the stop's verdict once `stopAgentSessionProviderRoot` read the root gone, so host
+   *  bookkeeping stops claiming a child. */
+  onProviderChildStopped?: (verdict: StructuredAgentSessionStopVerdict) => void
   /** Whether this host still owes the child's wind-down. Distinct from `hasProviderChild`, which a
    *  proven exit retires mid-run: the two disagree for exactly the steps a retry has to repeat. */
   owesProviderChildWindDown?: boolean
@@ -51,7 +52,7 @@ export type StructuredAgentSessionEvictionContext = {
 }
 
 /** The resume offer is advisory; a stalled sink must not hold the child's stop behind it. */
-const SNAPSHOT_DRAIN_TIMEOUT_MS = 1_000
+export const SNAPSHOT_DRAIN_TIMEOUT_MS = 1_000
 
 export type StructuredAgentSessionEvictionStep = {
   name: string
@@ -84,13 +85,13 @@ export const STRUCTURED_AGENT_SESSION_EVICTION_STEPS: readonly StructuredAgentSe
         }
         // An adapter with no close has nothing to stop; anything else must PROVE the exit.
         const stop = context.adapter.disposeSession ?? context.adapter.closeSession
-        if (
-          stop &&
-          !(await stopAgentSessionProviderRoot(() => stop.call(context.adapter, context.sessionId)))
-        ) {
+        const rootGone = stop
+          ? await stopAgentSessionProviderRoot(() => stop.call(context.adapter, context.sessionId))
+          : true
+        if (!rootGone) {
           throw new Error('provider child exit was not proven')
         }
-        context.onProviderChildStopped?.()
+        context.onProviderChildStopped?.({ rootGone })
       }
     },
     {
@@ -115,11 +116,11 @@ export const STRUCTURED_AGENT_SESSION_EVICTION_STEPS: readonly StructuredAgentSe
     // these two; eviction has to as well.
     { name: 'discard-sink', run: (context) => context.discardSink() },
     // Why here and not last: the durable lease still names a process this host just stopped, and a
-    // record left claiming a live owner is one nothing can resume — the next surface to open the
-    // chat would find a session it may not acquire. Placed BEFORE forget so a release that cannot
-    // be written aborts while the session is still indexed, which is what makes the retry real.
+    // record left claiming a live owner is one nothing can resume — the next send would find a
+    // session it may not acquire. Placed BEFORE the acknowledgement so a release that cannot be
+    // written aborts while the adapter still routes the session, which is what makes the retry real.
     { name: 'release-lease', run: (context) => context.releaseLease() },
-    { name: 'forget-session', run: (context) => context.forget() }
+    { name: 'acknowledge-release', run: (context) => context.acknowledgeRelease() }
   ]
 
 export class StructuredAgentSessionEvictionError extends Error {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-exit-turn-scope.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-exit-turn-scope.ts
new file mode 100644
index 00000000000..c336a1d3eca
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-exit-turn-scope.ts
@@ -0,0 +1,36 @@
+// Which turn a gone generation's exit row belongs to, so the row reports on the turn it ended.
+
+import { isRootAgentJournalItem } from '../../../shared/agent-session-journal-producer'
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalRenderItem,
+  type AgentJournalTurnScope
+} from '../../../shared/agent-session-journal-types'
+import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
+import type { StructuredAgentSessionTurnVerdict } from './structured-agent-session-stale-turn-verdict'
+
+/** The turn the exit ended: still running, or already ended at the exit's instant by the child's
+ *  own translator, which settles its open turn when the child goes. */
+export function exitedRootTurnScope(
+  items: readonly AgentJournalRenderItem[],
+  verdict: StructuredAgentSessionTurnVerdict
+): AgentJournalTurnScope {
+  const endedAt = verdict.state === 'interrupted' ? verdict.completedAt : undefined
+  const ended = items.findLast((item) => {
+    const turn = isRootAgentJournalItem(item) ? readAgentJournalTurn(item.body) : null
+    return (
+      turn?.state === 'running' ||
+      (turn?.state === 'interrupted' && endedAt !== undefined && turn.completedAt === endedAt)
+    )
+  })
+  return ended ? { kind: 'turn', turnItemId: ended.itemId } : AGENT_JOURNAL_THREAD_SCOPE
+}
+
+export function runningRootTurnScope(
+  items: readonly AgentJournalRenderItem[]
+): AgentJournalTurnScope {
+  const running = items.findLast(
+    (item) => isRootAgentJournalItem(item) && readAgentJournalTurn(item.body)?.state === 'running'
+  )
+  return running ? { kind: 'turn', turnItemId: running.itemId } : AGENT_JOURNAL_THREAD_SCOPE
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-owner-verdict.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-owner-verdict.test.ts
index 3d064eed7e0..317e7ca81a0 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-owner-verdict.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-owner-verdict.test.ts
@@ -13,6 +13,7 @@ import {
   type StructuredAgentSessionAdapter
 } from './structured-agent-session-adapter'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import { withObservedProviderExit } from './structured-agent-session-failure-text'
 import {
   HOST_TEST_NOW as NOW,
   HOST_TEST_SESSION as SESSION,
@@ -23,6 +24,10 @@ import {
 
 const CALLER = { callerKey: 'client-1' }
 const EXIT_REASON = 'claude stream-json exited (code 1): stderr tail'
+// The refusal says what the chat's start failure says; the error text stays in the log.
+const COULD_NOT_RESTART = "Codex couldn't restart. Send your message to try again."
+const PROVIDER_STOPPED =
+  'Codex stopped before it finished starting. Send your message to try again.'
 
 let root: string
 let store: AgentSessionRecordStore
@@ -66,47 +71,75 @@ afterEach(async () => {
 })
 
 describe('failed create owner verdict', () => {
-  it('answers an exit-proven failure as exited on the first call and its replay, and a new operation starts fresh', async () => {
-    // The cleanup's release proves the whole tree gone: the common failed start.
-    acquire.mockRejectedValueOnce(new Error(EXIT_REASON))
-    const first = hostTestAttachParams(null)
-    const refusal = {
-      code: 'agent_session_operation_invalid',
-      message: EXIT_REASON,
-      ownerVerdict: 'exited'
+  it.each([
+    // The cleanup's release proves the whole tree gone, which says nothing about why it failed.
+    ['a failure the cleanup proved gone', () => new Error(EXIT_REASON), {}, COULD_NOT_RESTART],
+    // Only an exit the adapter saw says the provider stopped.
+    [
+      'an exit the adapter observed',
+      () => withObservedProviderExit(new Error(EXIT_REASON)),
+      { reason: 'providerStartFailed' },
+      PROVIDER_STOPPED
+    ]
+  ])(
+    'answers %s as exited on the first call and its replay, and a new operation starts fresh',
+    async (_case, failure, situation, message) => {
+      acquire.mockRejectedValueOnce(failure())
+      const first = hostTestAttachParams(null)
+      // The replay names the same details as the first answer: the ledger kept them beside the code,
+      // and the verdict reaches released clients at the top level exactly as before.
+      const refusal = {
+        code: 'agent_session_operation_invalid',
+        details: { ...situation, ownerVerdict: 'exited' },
+        message,
+        ownerVerdict: 'exited'
+      }
+
+      await expect(host.attach(CALLER, first)).resolves.toEqual({ ok: false, refusal })
+      await expect(host.attach(CALLER, first)).resolves.toEqual({ ok: false, refusal })
+      expect(acquire).toHaveBeenCalledOnce()
+
+      const retry = hostTestAttachParams(null)
+      expect(retry.envelope.clientOperationId).not.toBe(first.envelope.clientOperationId)
+      await expect(host.attach(CALLER, retry)).resolves.toMatchObject({ ok: true })
+      expect(acquire).toHaveBeenCalledTimes(2)
+      expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
     }
+  )
 
-    await expect(host.attach(CALLER, first)).resolves.toEqual({ ok: false, refusal })
-    await expect(host.attach(CALLER, first)).resolves.toEqual({ ok: false, refusal })
-    expect(acquire).toHaveBeenCalledOnce()
+  it.each([
+    // A cleanup that saw the root go may have stopped it itself.
+    ['a root exit the cleanup saw', () => new Error(EXIT_REASON), {}, COULD_NOT_RESTART],
+    [
+      'a root exit the adapter observed',
+      () => withObservedProviderExit(new Error(EXIT_REASON)),
+      { reason: 'providerStartFailed' },
+      PROVIDER_STOPPED
+    ]
+  ])(
+    'answers %s as exited on the first call, in the shape its replay takes',
+    async (_case, cause, situation, message) => {
+      acquire.mockRejectedValueOnce(new AgentSessionAcquisitionRootExitObservedError(cause()))
+      const first = hostTestAttachParams(null)
+      // The replay names the same details as the first answer: the ledger kept them beside the code,
+      // and the verdict reaches released clients at the top level exactly as before.
+      const refusal = {
+        code: 'agent_session_operation_invalid',
+        details: { ...situation, ownerVerdict: 'exited' },
+        message,
+        ownerVerdict: 'exited'
+      }
 
-    const retry = hostTestAttachParams(null)
-    expect(retry.envelope.clientOperationId).not.toBe(first.envelope.clientOperationId)
-    await expect(host.attach(CALLER, retry)).resolves.toMatchObject({ ok: true })
-    expect(acquire).toHaveBeenCalledTimes(2)
-    expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
-  })
+      await expect(host.attach(CALLER, first)).resolves.toEqual({ ok: false, refusal })
+      await expect(host.attach(CALLER, first)).resolves.toEqual({ ok: false, refusal })
+      expect(acquire).toHaveBeenCalledOnce()
 
-  it('answers a first-hand root exit as exited on the first call, in the shape its replay takes', async () => {
-    acquire.mockRejectedValueOnce(
-      new AgentSessionAcquisitionRootExitObservedError(new Error(EXIT_REASON))
-    )
-    const first = hostTestAttachParams(null)
-    const refusal = {
-      code: 'agent_session_operation_invalid',
-      message: EXIT_REASON,
-      ownerVerdict: 'exited'
+      await expect(host.attach(CALLER, hostTestAttachParams(null))).resolves.toMatchObject({
+        ok: true
+      })
+      expect(acquire).toHaveBeenCalledTimes(2)
     }
-
-    await expect(host.attach(CALLER, first)).resolves.toEqual({ ok: false, refusal })
-    await expect(host.attach(CALLER, first)).resolves.toEqual({ ok: false, refusal })
-    expect(acquire).toHaveBeenCalledOnce()
-
-    await expect(host.attach(CALLER, hostTestAttachParams(null))).resolves.toMatchObject({
-      ok: true
-    })
-    expect(acquire).toHaveBeenCalledTimes(2)
-  })
+  )
 
   it('answers an acquisition refusal with its verdict directly', async () => {
     acquire.mockRejectedValueOnce(new AgentSessionAcquisitionRefusal('not signed in'))
@@ -115,7 +148,8 @@ describe('failed create owner verdict', () => {
       ok: false,
       refusal: {
         code: 'agent_session_operation_invalid',
-        message: 'not signed in',
+        details: { reason: 'providerStartFailed', ownerVerdict: 'exited' },
+        message: PROVIDER_STOPPED,
         ownerVerdict: 'exited'
       }
     })
@@ -132,6 +166,10 @@ describe('failed create owner verdict', () => {
       ok: false,
       refusal: { code: 'agent_session_ownership_unknown', ownerVerdict: 'unverifiable' }
     })
-    expect(store.getRecord(SESSION)?.lease.claimStatus).not.toBe('released')
+    // Released so the next start can go ahead, but with no death evidence: nothing proved it.
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
+      deathEvidence: null
+    })
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-refusal.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-refusal.ts
index a5e00fde53c..90f52db3d09 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-refusal.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-refusal.ts
@@ -1,7 +1,12 @@
-import type {
-  AgentSessionAttachResult,
-  AgentSessionMutationResult,
-  AgentSessionWireRefusal
+import {
+  isAgentSessionWireRefusalCode,
+  refuse,
+  refuseUnclassified,
+  withAgentSessionRefusalFacts,
+  type AgentSessionAttachResult,
+  type AgentSessionMutationResult,
+  type AgentSessionRefusalDetailsByCode,
+  type AgentSessionWireRefusal
 } from '../../../shared/agent-session-wire'
 import type {
   AgentSessionOperationOutcome,
@@ -15,16 +20,50 @@ import {
   AgentSessionAcquisitionExitUnprovenError,
   AgentSessionAcquisitionRefusal,
   AgentSessionAcquisitionRootExitObservedError,
+  AgentSessionPreSpawnError,
   isAgentSessionPreSpawnError
 } from './structured-agent-session-adapter'
+import {
+  providerExitObserved,
+  structuredAgentSessionStartFailure
+} from './structured-agent-session-failure-text'
+import { structuredAgentSessionFailureWordsContext } from './structured-agent-session-send-preparation'
+
+/** Who a failed acquisition's sentence names, and whether it was the session's first start. */
+export type FailedAcquisitionWording = {
+  record: AgentSessionRecord | null
+  newSession: boolean
+}
+
+/** The refusal a failed acquisition answers with, worded as the start failure it records: its
+ *  error text is Orca's or the provider's log wording, so it goes to the log, never the wire. */
+function failedAcquisitionWireRefusal(
+  details: AgentSessionRefusalDetailsByCode['agent_session_operation_invalid'] | undefined,
+  wording: FailedAcquisitionWording
+): AgentSessionWireRefusal {
+  const code = 'agent_session_operation_invalid'
+  const refusal = details ? refuse(code, details, code) : refuseUnclassified(code, code)
+  const { reason } = structuredAgentSessionStartFailure(
+    { refusal, ...(wording.newSession ? { newSession: true as const } : {}) },
+    structuredAgentSessionFailureWordsContext(wording.record)
+  )
+  return { ...refusal, message: reason }
+}
 
 /** What a failed acquisition proved about its process, and the outcome its operation settles to. */
-export function failedAcquisitionSettlement(error: unknown): {
+export function failedAcquisitionSettlement(
+  error: unknown,
+  wording: FailedAcquisitionWording
+): {
   exitProof: AgentSessionAcquisitionExitProof
   outcome: Extract<AgentSessionOperationOutcome, { status: 'failed' }>
 } {
   if (error instanceof AgentSessionAcquisitionExitUnprovenError) {
-    const outcome = { code: 'agent_session_ownership_unknown', message: error.message }
+    const outcome = {
+      code: 'agent_session_ownership_unknown',
+      details: { reason: 'ownerUnproven' as const },
+      message: error.message
+    }
     return { exitProof: 'unproven', outcome: { status: 'failed', ...outcome } }
   }
   const exitProof = isAgentSessionPreSpawnError(error)
@@ -32,33 +71,79 @@ export function failedAcquisitionSettlement(error: unknown): {
     : error instanceof AgentSessionAcquisitionRootExitObservedError
       ? 'root-exit-observed'
       : 'exit-proven'
-  const message = error instanceof Error ? error.message : String(error)
-  const code =
-    error instanceof AgentSessionAcquisitionRefusal ? error.code : 'agent_session_operation_invalid'
-  return { exitProof, outcome: { status: 'failed', code, message } }
+  const raw = error instanceof Error ? error.message : String(error)
+  const details = failedAcquisitionDetails(error)
+  const message =
+    failedAcquisitionRefusal(error, wording)?.refusal.message ??
+    // A store refusal's message is its code, which its replay has always carried.
+    (isAgentSessionWireRefusalCode(raw)
+      ? raw
+      : failedAcquisitionWireRefusal(details, wording).message)
+  return {
+    exitProof,
+    outcome: {
+      status: 'failed',
+      code: 'agent_session_operation_invalid',
+      ...(details ? { details } : {}),
+      message
+    }
+  }
+}
+
+/** Cleanup proved the child gone after the start failed, whatever failed it. */
+function isExitProvenAcquisitionFailure(error: unknown): error is Error {
+  return (
+    error instanceof AgentSessionAcquisitionRootExitObservedError ||
+    error instanceof AgentSessionAcquisitionExitProvenError
+  )
+}
+
+/** The situation a failed acquisition stands for: what the adapter typed, or a provider the
+ *  adapter saw exit while starting. A provider refusing a request, a timeout, a store refusal or
+ *  Orca's own fault names none: the child being gone now says nothing about why. */
+function failedAcquisitionDetails(
+  error: unknown
+): AgentSessionRefusalDetailsByCode['agent_session_operation_invalid'] | undefined {
+  if (error instanceof AgentSessionAcquisitionRefusal) {
+    return { reason: error.reason }
+  }
+  if (isAgentSessionPreSpawnError(error) && error.reason) {
+    return { reason: error.reason }
+  }
+  if (isExitProvenAcquisitionFailure(error) && providerExitObserved(error)) {
+    return { reason: 'providerStartFailed' }
+  }
+  return undefined
 }
 
 /** A failed acquisition answered as a refusal on the first call, in the shape its replay takes;
  *  null leaves the error to the store-failure classification. */
 export function failedAcquisitionRefusal(
-  error: unknown
+  error: unknown,
+  wording: FailedAcquisitionWording
 ): { ok: false; refusal: AgentSessionWireRefusal } | null {
-  if (error instanceof AgentSessionAcquisitionRefusal) {
-    return { ok: false, refusal: { code: error.code, message: error.message } }
-  }
-  // A proven exit is a settled fact; its message is the provider's own diagnostic.
-  if (
-    error instanceof AgentSessionAcquisitionRootExitObservedError ||
-    error instanceof AgentSessionAcquisitionExitProvenError
-  ) {
+  // A proven exit is a settled failure, answered in the shape its ledger row replays.
+  if (error instanceof AgentSessionAcquisitionRefusal || isExitProvenAcquisitionFailure(error)) {
     return {
       ok: false,
-      refusal: { code: 'agent_session_operation_invalid', message: error.message }
+      refusal: failedAcquisitionWireRefusal(failedAcquisitionDetails(error), wording)
     }
   }
   return null
 }
 
+/** A start that failed before any process still throws, in the sentence its replay reads: the
+ *  error's own text is Orca's or the refusing site's, so it goes to the log. A message that is
+ *  itself a code keeps it, since the wire routes on it. */
+export function preSpawnFailureInWords(error: unknown, wording: FailedAcquisitionWording): unknown {
+  if (!isAgentSessionPreSpawnError(error) || /^[a-z0-9_]+$/.test(error.message)) {
+    return error
+  }
+  return new AgentSessionPreSpawnError(error, {
+    message: failedAcquisitionSettlement(error, wording).outcome.message
+  })
+}
+
 /** Only a durably failed operation says anything about retrying under a new one. */
 export function failedCreateRefusal(
   refusal: AgentSessionWireRefusal,
@@ -68,7 +153,9 @@ export function failedCreateRefusal(
   return status === 'failed' && record
     ? {
         ok: false,
-        refusal: { ...refusal, ownerVerdict: agentSessionLeaseOwnerVerdict(record.lease) }
+        refusal: withAgentSessionRefusalFacts(refusal, {
+          ownerVerdict: agentSessionLeaseOwnerVerdict(record.lease)
+        })
       }
     : { ok: false, refusal }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-sink-release.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-sink-release.test.ts
index c61d93cbb8f..69f9b95c03a 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-sink-release.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-sink-release.test.ts
@@ -82,8 +82,11 @@ describe('a create that fails after its child wrote through the unbound sink', (
 
       const failed = host.attach(CALLER, hostTestAttachParams(null))
       await (cause instanceof AgentSessionPreSpawnError
-        ? expect(failed).rejects.toThrow(EXIT_REASON)
-        : expect(failed).resolves.toMatchObject({ ok: false, refusal: { message: EXIT_REASON } }))
+        ? expect(failed).rejects.toThrow("Codex couldn't restart. Send your message to try again.")
+        : expect(failed).resolves.toMatchObject({
+            ok: false,
+            refusal: { message: "Codex couldn't restart. Send your message to try again." }
+          }))
 
       await expect(host.attach(CALLER, hostTestAttachParams(null))).resolves.toMatchObject({
         ok: true
@@ -118,7 +121,7 @@ describe('a create that fails after its child wrote through the unbound sink', (
     // The session stays indexed across this failure: it is a resume, not a create.
     const failed = host.attach(CALLER, hostTestAttachParams(releasedFence))
     await (cause instanceof AgentSessionPreSpawnError
-      ? expect(failed).rejects.toThrow(EXIT_REASON)
+      ? expect(failed).rejects.toThrow("Codex couldn't restart. Send your message to try again.")
       : expect(failed).resolves.toMatchObject({ ok: false }))
 
     const fence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-failure-text.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-failure-text.test.ts
new file mode 100644
index 00000000000..fcebdda7726
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-failure-text.test.ts
@@ -0,0 +1,201 @@
+import { describe, expect, it } from 'vitest'
+import {
+  MAX_PROVIDER_DIAGNOSTIC_CHARS,
+  providerDiagnostic,
+  withProviderDiagnostic
+} from '../../../shared/agent-session-failure'
+import {
+  AgentSessionRefusalError,
+  refuse,
+  refuseUnclassified
+} from '../../../shared/agent-session-wire-refusals'
+import { AgentSessionAcquisitionRefusal } from './structured-agent-session-adapter'
+import { MAX_UNEXPECTED_EXIT_REASON_CHARS } from './structured-agent-session-dead-generation-settlement'
+import {
+  structuredAgentSessionStartFailure,
+  withObservedProviderExit
+} from './structured-agent-session-failure-text'
+
+/** What Orca's own error text looks like: a code, a marker, a uuid, a path, an exception. */
+const ORCA_INTERNAL =
+  /agent_session_|execution_owner|provider_[a-z_]+|[0-9a-f]{8}-[0-9a-f]{4}-|[/\\][\w.-]+[/\\]|Error:|ENOENT/
+
+describe('structuredAgentSessionStartFailure', () => {
+  it('keeps a provider diagnostic only when the error carried one', () => {
+    const carried = withProviderDiagnostic(
+      new Error('claude stream-json exited (code 1): boom'),
+      providerDiagnostic('code 1\nboom', 'log')
+    )
+    expect(structuredAgentSessionStartFailure({ error: carried }, { agentName: 'Claude' })).toEqual(
+      {
+        reason: "Claude couldn't start. Send your message to try again.",
+        rejection: { kind: 'startFailed', detail: { text: 'code 1\nboom', audience: 'log' } }
+      }
+    )
+    // Orca's own words, however provider-like, are never promoted to a detail.
+    expect(
+      structuredAgentSessionStartFailure({ error: new Error('Not logged in. Run /login.') })
+        .rejection
+    ).toEqual({ kind: 'startFailed' })
+  })
+
+  it('keeps a start refusal the adapter typed', () => {
+    const refusal = new AgentSessionAcquisitionRefusal(
+      'Claude is not signed in for the selected account.',
+      'notSignedIn'
+    )
+    expect(structuredAgentSessionStartFailure({ error: refusal }, { agentName: 'Claude' })).toEqual(
+      {
+        reason:
+          'Claude is not signed in for the selected account. Sign in, then send your message again.',
+        rejection: { kind: 'notSignedIn' }
+      }
+    )
+  })
+
+  it.each([
+    [
+      'managedAccountEnvOverride',
+      'This Claude launch sets its own Anthropic sign-in variables. Remove them to use a managed Claude account.'
+    ],
+    [
+      'accountSwitchInProgress',
+      'A Claude account switch is in progress. Try again after it finishes.'
+    ],
+    [
+      'managedAccountUnsupported',
+      'While a Claude account is added in WSL, Claude chats need a Windows Claude account. Choose or add one in Claude Accounts settings, then send your message again.'
+    ]
+  ] as const)('words a start refused for %s by that situation', (reason, sentence) => {
+    const code = 'agent_session_operation_invalid'
+    expect(
+      structuredAgentSessionStartFailure(
+        { refusal: refuse(code, { reason }, code) },
+        { agentName: 'Claude' }
+      )
+    ).toEqual({ reason: sentence, rejection: { kind: reason } })
+  })
+
+  it('words a refused restart by its situation, never its message', () => {
+    const words = structuredAgentSessionStartFailure(
+      {
+        refusal: refuse(
+          'agent_session_ownership_unknown',
+          { reason: 'ownerUnproven' },
+          'Orca cannot prove that process 4242 on host-1 has exited.'
+        )
+      },
+      { agentName: 'Claude' }
+    )
+    expect(words).toEqual({
+      reason: "Claude couldn't restart. Send your message to try again.",
+      rejection: {
+        kind: 'restartFailed',
+        refusal: {
+          code: 'agent_session_ownership_unknown',
+          details: { reason: 'ownerUnproven' }
+        }
+      }
+    })
+  })
+
+  it("reads an exit before the start as a failed start, and an Orca fault as Orca's", () => {
+    expect(
+      structuredAgentSessionStartFailure({
+        exit: { kind: 'providerExited', detail: { text: 'stderr', audience: 'log' } }
+      }).rejection
+    ).toEqual({ kind: 'providerStartFailed', detail: { text: 'stderr', audience: 'log' } })
+    expect(structuredAgentSessionStartFailure({ exit: { kind: 'hostFault' } }).rejection).toEqual({
+      kind: 'hostFault'
+    })
+    expect(structuredAgentSessionStartFailure({ hostFault: true }).reason).not.toMatch(
+      ORCA_INTERNAL
+    )
+  })
+
+  it("holds any provider detail to the lease record's cap", () => {
+    expect(MAX_PROVIDER_DIAGNOSTIC_CHARS).toBe(512)
+    expect(MAX_UNEXPECTED_EXIT_REASON_CHARS).toBe(MAX_PROVIDER_DIAGNOSTIC_CHARS)
+    const long = 'x'.repeat(4_000)
+    // However the caller built the detail, the fact stores at most the cap.
+    const words = structuredAgentSessionStartFailure({
+      diagnostic: { text: long, audience: 'log' }
+    })
+    expect(words.rejection.detail?.text).toHaveLength(MAX_UNEXPECTED_EXIT_REASON_CHARS)
+    expect(
+      structuredAgentSessionStartFailure({
+        exit: { kind: 'providerExited', detail: { text: long, audience: 'log' } }
+      }).rejection.detail?.text
+    ).toHaveLength(MAX_UNEXPECTED_EXIT_REASON_CHARS)
+  })
+
+  it('says the provider stopped only when an exit was observed', () => {
+    // An `exited` verdict says only that nothing runs now, not that the provider stopped.
+    const gone = refuseUnclassified('agent_session_operation_invalid', 'thread gone', {
+      ownerVerdict: 'exited'
+    })
+    const person = { text: 'no rollout found for thread id T', audience: 'person' } as const
+    expect(
+      structuredAgentSessionStartFailure(
+        { refusal: gone, diagnostic: person },
+        { agentName: 'Codex' }
+      )
+    ).toEqual({
+      reason: "Codex couldn't restart. Send your message to try again.",
+      rejection: {
+        kind: 'restartFailed',
+        detail: person,
+        refusal: {
+          code: 'agent_session_operation_invalid',
+          details: { ownerVerdict: 'exited' }
+        }
+      }
+    })
+    const observed = refuse(
+      'agent_session_operation_invalid',
+      { reason: 'providerStartFailed', ownerVerdict: 'exited' },
+      'exited (code 1)'
+    )
+    expect(
+      structuredAgentSessionStartFailure({
+        refusal: observed,
+        diagnostic: { text: 'code 1', audience: 'log' }
+      })
+    ).toEqual({
+      reason: 'The agent stopped before it finished starting. Send your message to try again.',
+      rejection: { kind: 'providerStartFailed', detail: { text: 'code 1', audience: 'log' } }
+    })
+    // A start that threw proves nothing about the provider: it may be Orca's, or a failed spawn.
+    expect(
+      structuredAgentSessionStartFailure({ error: new Error('spawn claude ENOENT') }, {})
+    ).toEqual({
+      reason: "The agent couldn't start. Send your message to try again.",
+      rejection: { kind: 'startFailed' }
+    })
+    // The same error, once the adapter that observed the child's exit marked it, blames the provider.
+    const exit = withObservedProviderExit(
+      withProviderDiagnostic(new Error('exited (code 1)'), providerDiagnostic('code 1', 'log'))
+    )
+    expect(
+      structuredAgentSessionStartFailure({ error: new Error('wrapped', { cause: exit }) })
+    ).toEqual({
+      reason: 'The agent stopped before it finished starting. Send your message to try again.',
+      rejection: { kind: 'providerStartFailed', detail: { text: 'code 1', audience: 'log' } }
+    })
+  })
+
+  it('reads a thrown refusal the same as a returned one', () => {
+    const thrown = new AgentSessionRefusalError(
+      refuse(
+        'agent_session_conflict',
+        { reason: 'claimConflicted' },
+        'Another process claims this session.'
+      )
+    )
+    expect(thrown.message).toBe('agent_session_conflict')
+    expect(structuredAgentSessionStartFailure({ refusal: thrown.refusal }).rejection).toEqual({
+      kind: 'restartFailed',
+      refusal: { code: 'agent_session_conflict', details: { reason: 'claimConflicted' } }
+    })
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-failure-text.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-failure-text.ts
new file mode 100644
index 00000000000..c0c2172230d
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-failure-text.ts
@@ -0,0 +1,163 @@
+// The facts a start or an exit reduces to, and the one place a failed start is worded. The
+// sentence itself comes from `agentSessionFailureWords`, beside the fact it states.
+
+import {
+  agentSessionFailureFact,
+  providerDiagnosticOf,
+  type SubmissionRejectionFact,
+  type AgentSessionFailureKind,
+  type ProviderDiagnostic
+} from '../../../shared/agent-session-failure'
+import type { AgentSessionRefusalReason } from '../../../shared/agent-session-refusal-details'
+import {
+  agentSessionFailureWords,
+  type AgentJournalDispatchRejection,
+  type AgentSessionFailureWordsContext
+} from '../../../shared/agent-session-failure-words'
+import {
+  agentSessionRefusalReference,
+  type AgentSessionWireRefusal
+} from '../../../shared/agent-session-wire-refusals'
+import { AgentSessionAcquisitionRefusal } from './structured-agent-session-adapter'
+
+/** Start refusals whose situation is itself what the person reads, with its own next step. */
+const TYPED_START_REFUSALS = [
+  'notSignedIn',
+  'historyTooLarge',
+  'managedAccountEnvOverride',
+  'accountSwitchInProgress',
+  'managedAccountUnsupported'
+] as const satisfies readonly (AgentSessionFailureKind &
+  AgentSessionRefusalReason<'agent_session_operation_invalid'>)[]
+
+function typedStartRefusal(
+  reason: string | undefined
+): (typeof TYPED_START_REFUSALS)[number] | undefined {
+  return TYPED_START_REFUSALS.find((typed) => typed === reason)
+}
+
+/** Marks the error an adapter observed its child's exit with, where it observed it. */
+export function withObservedProviderExit<TError extends Error>(error: TError): TError {
+  return Object.assign(error, { providerExitObserved: true })
+}
+
+/** Whether the adapter saw the child exit on its own. Follows `cause` and the errors a cleanup
+ *  aggregated, since the acquisition errors wrap what the adapter threw. */
+export function providerExitObserved(error: unknown, depth = 0): boolean {
+  if (depth >= 6 || !(error instanceof Error)) {
+    return false
+  }
+  if ('providerExitObserved' in error && error.providerExitObserved === true) {
+    return true
+  }
+  if (
+    error instanceof AggregateError &&
+    error.errors.some((inner) => providerExitObserved(inner, depth + 1))
+  ) {
+    return true
+  }
+  return providerExitObserved(error.cause, depth + 1)
+}
+
+/** A start that did not land. A refusal the adapter typed keeps its situation, and an exit the
+ *  adapter observed says the provider stopped; anything else blames no one — it may be Orca's, or
+ *  a spawn that failed. Either keeps the provider's diagnostic when the error carried one. */
+export function providerStartupFailureFact(cause?: unknown): SubmissionRejectionFact {
+  const typed = typedStartRefusal(
+    cause instanceof AgentSessionAcquisitionRefusal ? cause.reason : undefined
+  )
+  if (typed) {
+    return agentSessionFailureFact(typed)
+  }
+  return agentSessionFailureFact(
+    providerExitObserved(cause) ? 'providerStartFailed' : 'startFailed',
+    { detail: providerDiagnosticOf(cause) }
+  )
+}
+
+/** A child that ended before it proved its start: an exit is a start that failed, keeping the
+ *  provider's diagnostic; an Orca fault or a typed start refusal stays what it was. */
+function startupFailureFromExit(
+  failure: SubmissionRejectionFact | undefined
+): SubmissionRejectionFact {
+  if (!failure || failure.kind === 'providerExited') {
+    return agentSessionFailureFact('providerStartFailed', { detail: failure?.detail })
+  }
+  return failure
+}
+
+/** What the chat records when a session could not be made ready. Only a refusal the host typed as
+ *  an observed exit says the provider stopped; a verdict of `exited` means only that nothing runs
+ *  now. */
+function refusedStartFailureFact(
+  cause: Extract<StructuredAgentSessionStartFailureCause, { refusal: unknown }>
+): SubmissionRejectionFact {
+  const { refusal, diagnostic } = cause
+  const reason = refusal.details?.reason
+  const typed = typedStartRefusal(reason)
+  if (typed) {
+    return agentSessionFailureFact(typed)
+  }
+  if (reason === 'providerStartFailed') {
+    return agentSessionFailureFact('providerStartFailed', { detail: diagnostic })
+  }
+  return agentSessionFailureFact(cause.newSession ? 'startFailed' : 'restartFailed', {
+    detail: diagnostic,
+    refusal: agentSessionRefusalReference(refusal)
+  })
+}
+
+/** Why a start the chat needed did not land, as the place that saw it knows it. */
+export type StructuredAgentSessionStartFailureCause =
+  /** The session could not be made ready; the provider's words, if any, are kept host-side, off
+   *  the refusal. `newSession`: one that never ran, so it failed to start rather than restart. */
+  | { refusal: AgentSessionWireRefusal; diagnostic?: ProviderDiagnostic; newSession?: true }
+  /** A start that threw, or an adapter's own startup failure; any diagnostic it carries. */
+  | { error: unknown }
+  /** The child ended before it proved its start, as its ended event told it. */
+  | { exit: SubmissionRejectionFact | undefined }
+  /** The provider exited while starting; only its words are known, and the caller names their
+   *  audience. */
+  | { diagnostic: ProviderDiagnostic | undefined }
+  /** Orca's own fault; its error belongs in the log. */
+  | { hostFault: true }
+  /** Already typed where it was observed. */
+  | { failure: SubmissionRejectionFact }
+
+/** A start failure's row repeats the sentence its rejected messages carry: both are about the
+ *  messages the start was for. */
+export type StructuredAgentSessionStartFailureWords = AgentJournalDispatchRejection
+
+/** The fact a failed start records, for a writer that words it on its own surface. */
+export function structuredAgentSessionStartFailureFact(
+  cause: StructuredAgentSessionStartFailureCause
+): SubmissionRejectionFact {
+  if ('refusal' in cause) {
+    return refusedStartFailureFact(cause)
+  }
+  if ('error' in cause) {
+    return providerStartupFailureFact(cause.error)
+  }
+  if ('exit' in cause) {
+    return startupFailureFromExit(cause.exit)
+  }
+  if ('diagnostic' in cause) {
+    return agentSessionFailureFact('providerStartFailed', { detail: cause.diagnostic })
+  }
+  if ('hostFault' in cause) {
+    return agentSessionFailureFact('hostFault')
+  }
+  return cause.failure
+}
+
+/** The one place a failed start is worded: the error row and every message it rejects carry this
+ *  sentence and this fact, whichever writer saw the start fail. */
+export function structuredAgentSessionStartFailure(
+  cause: StructuredAgentSessionStartFailureCause,
+  context: AgentSessionFailureWordsContext = {}
+): StructuredAgentSessionStartFailureWords {
+  return agentSessionFailureWords(structuredAgentSessionStartFailureFact(cause), {
+    ...context,
+    surface: 'rejection'
+  })
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-forget-status.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-forget-status.test.ts
index 20531bd6465..8ce8d7d1507 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-forget-status.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-forget-status.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // Removing a session from the host's map and removing its status row are ONE operation.
 //
 // The store keeps a row until told to drop it, and `structuredHostOwned` bypasses the staleness
@@ -21,11 +22,10 @@ import type { StructuredAgentSessionAttachContext } from './structured-agent-ses
 import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
 import { StructuredAgentSessionStatusFeed } from './structured-agent-session-status-feed'
 
-// Everything before the journal is out of scope here; what matters is that the orchestration's
-// own `onAttachFailed` runs, which is the real one.
+// Everything before the journal is out of scope here; what matters is what the orchestration does
+// when the attach throws after acquisition.
 vi.mock('./structured-agent-session-attach-flow', () => ({
-  performAttach: async (input: { onAttachFailed?: () => Promise<void> }) => {
-    await input.onAttachFailed?.()
+  performAttach: async () => {
     throw new Error('attach failed after acquisition')
   }
 }))
@@ -111,12 +111,12 @@ async function workingSession(): Promise<{
   await journal.appendItem(
     PROMPT,
     { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'ship it' }] },
-    { fence: 1 }
+    { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
   await journal.appendItem(
     TURN,
     { kind: 'status', text: 'Working', turnLifecycle: { turnId: 'turn-1', state: 'running' } },
-    { fence: 1 }
+    { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
   const sessions = new Map<string, StructuredAgentSessionHostSession>([
     [
@@ -136,10 +136,7 @@ async function workingSession(): Promise<{
           accountHome: ownerRecord().accountHome,
           runtimeKind: 'native'
         },
-        fence: 1,
-        hasProviderChild: true,
-        providerChildPhase: 'ready',
-        acquisitionGeneration: null
+        child: { generation: null, fence: 1, phase: 'ready' }
       }
     ]
   ])
@@ -190,7 +187,7 @@ function attachContext(
     reconcileLeases: async () => null,
     serialize: <T>(_sessionId: string, task: () => Promise<T>) => task(),
     now: () => 1,
-    forgetStatus: (sessionId: string) => feed.forget(sessionId)
+    publishStatus: (sessionId: string) => feed.publish(sessionId)
   } as unknown as StructuredAgentSessionAttachContext
 }
 
@@ -230,15 +227,19 @@ describe('a session that leaves the host without an explicit close', () => {
     expect(server.getStatusSnapshot()).toEqual([expect.objectContaining({ prompt: 'other host' })])
   })
 
-  it('leaves the agent-status store with it when an attach fails', async () => {
+  // A failed attach no longer drops the session: the conversation stays open for the failure to be
+  // written into, so its row stays with it and the later close forgets both together.
+  it('keeps the session and its status row together when an attach fails', async () => {
     const { server, feed, sessions } = await workingSession()
+    const drop = vi.spyOn(server, 'dropStructuredStatus')
 
     await expect(
       attachStructuredAgentSession(attachContext(sessions, feed), 'caller-1', attachParams)
     ).rejects.toThrow('attach failed after acquisition')
 
-    expect(sessions.has(SESSION)).toBe(false)
-    expect(server.getStatusSnapshot()).toEqual([])
+    expect(sessions.has(SESSION)).toBe(true)
+    expect(drop).not.toHaveBeenCalled()
+    expect(server.getStatusSnapshot()).toHaveLength(1)
   })
 
   // The feed's own cache deliberately retains the projection for reload history; only the store
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-grouped-prompt.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-grouped-prompt.test.ts
index bbc1ec49d4c..72317e8ed81 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-grouped-prompt.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-grouped-prompt.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -70,33 +71,37 @@ async function seedGroupedQuestion(): Promise<{ itemId: string; revision: number
   if (!events) {
     throw new Error('seedGroupedQuestion requires an acquired session')
   }
-  events.appendItem(identity, {
-    kind: 'question',
-    question: '2 grouped questions from Claude',
-    options: [],
-    questions: [
-      {
-        id: 'q1',
-        question: 'Targets',
-        multiSelect: true,
-        options: [
-          { id: 'target-web', label: 'Web' },
-          { id: 'target-mobile', label: 'Mobile' }
-        ]
-      },
-      {
-        id: 'q2',
-        question: 'Host',
-        multiSelect: false,
-        options: [],
-        freeTextQuestionId: 'q2'
-      }
-    ],
-    resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
-  })
+  events.appendItem(
+    identity,
+    {
+      kind: 'question',
+      question: '2 grouped questions from Claude',
+      options: [],
+      questions: [
+        {
+          id: 'q1',
+          question: 'Targets',
+          multiSelect: true,
+          options: [
+            { id: 'target-web', label: 'Web' },
+            { id: 'target-mobile', label: 'Mobile' }
+          ]
+        },
+        {
+          id: 'q2',
+          question: 'Host',
+          multiSelect: false,
+          options: [],
+          freeTextQuestionId: 'q2'
+        }
+      ],
+      resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
+    },
+    { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+  )
   await host.flushStreamedEvents(SESSION)
   const itemId = agentJournalItemKey(identity)
-  const page = host.history({ sessionId: SESSION, direction: 'tail' })
+  const page = await host.history({ sessionId: SESSION, direction: 'tail' })
   const appended = page.ok ? page.page.items.find((item) => item.itemId === itemId) : null
   if (!appended) {
     throw new Error('provider question was not written to the journal')
@@ -141,23 +146,78 @@ afterEach(async () => {
 })
 
 describe('grouped question admission', () => {
-  it('admits renderer question-group payloads with child ids and multi-select answers', async () => {
+  it('reads the packed answer an older client sends into structured answers', async () => {
     const attached = await host.attach(CALLER, attachParams())
     expect(attached.ok).toBe(true)
     const prompt = await seedGroupedQuestion()
-    const optionId = encodeAgentSessionQuestionAnswers([
+    const answers = [
       { questionId: 'q1', optionIds: ['target-web', 'target-mobile'] },
       { questionId: 'q2', optionIds: [], other: 'SSH host' }
-    ])
+    ]
+    const optionId = encodeAgentSessionQuestionAnswers(answers)
     const fields = { itemId: prompt.itemId, expectedRevision: prompt.revision, optionId }
     const result = await host.respondToPrompt(CALLER, {
       envelope: envelope('agentSession.respondTo:question', fields),
       kind: 'question',
       ...fields
     })
-    expect(result).toMatchObject({ ok: true, value: { resolution: { state: 'resolved' } } })
+    expect(result).toMatchObject({
+      ok: true,
+      value: { resolution: { state: 'resolved', selectedOptionId: optionId, answers } }
+    })
     expect(answerPrompt).toHaveBeenCalledWith(
-      expect.objectContaining({ itemId: prompt.itemId, optionId })
+      expect.objectContaining({ itemId: prompt.itemId, response: { kind: 'answers', answers } })
     )
   })
+
+  it('takes structured answers past the old option-id bound and keeps the packed form for older readers', async () => {
+    const attached = await host.attach(CALLER, attachParams())
+    expect(attached.ok).toBe(true)
+    const prompt = await seedGroupedQuestion()
+    const typed = 'Proceed with the replacement, but wait for the capture. '.repeat(40)
+    const answers = [
+      { questionId: 'q1', optionIds: ['target-web'] },
+      { questionId: 'q2', optionIds: [], other: typed }
+    ]
+    const fields = { itemId: prompt.itemId, expectedRevision: prompt.revision, answers }
+    const result = await host.respondToPrompt(CALLER, {
+      envelope: envelope('agentSession.respondTo:question', fields),
+      kind: 'question',
+      ...fields
+    })
+
+    expect(typed.length).toBeGreaterThan(1024)
+    expect(result).toMatchObject({
+      ok: true,
+      value: {
+        resolution: {
+          state: 'resolved',
+          selectedOptionId: encodeAgentSessionQuestionAnswers(answers),
+          answers
+        }
+      }
+    })
+    expect(answerPrompt).toHaveBeenCalledWith(
+      expect.objectContaining({ response: { kind: 'answers', answers } })
+    )
+  })
+
+  it('refuses answers that do not match the questions without reaching the provider', async () => {
+    const attached = await host.attach(CALLER, attachParams())
+    expect(attached.ok).toBe(true)
+    const prompt = await seedGroupedQuestion()
+    const answers = [{ questionId: 'q1', optionIds: ['target-web'] }]
+    const fields = { itemId: prompt.itemId, expectedRevision: prompt.revision, answers }
+    const result = await host.respondToPrompt(CALLER, {
+      envelope: envelope('agentSession.respondTo:question', fields),
+      kind: 'question',
+      ...fields
+    })
+
+    expect(result).toMatchObject({
+      ok: false,
+      refusal: { code: 'agent_session_operation_invalid' }
+    })
+    expect(answerPrompt).not.toHaveBeenCalled()
+  })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-hold-resume-race.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-hold-resume-race.test.ts
deleted file mode 100644
index 974a69b1c3c..00000000000
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-hold-resume-race.test.ts
+++ /dev/null
@@ -1,260 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { runKeyedSerializedOperation } from '../../cli/keyed-promise-queue'
-import type { StructuredAgentSessionResumeOutcome } from './structured-agent-session-hold-resume'
-import { StructuredAgentSessionHolds } from './structured-agent-session-holds'
-
-const GRACE_MS = 15_000
-const pendingHolds: StructuredAgentSessionHolds[] = []
-
-/** The host's per-session queue: a second hold waits for the attach the first one is running. */
-function keyedSerialize() {
-  const chains = new Map<string, Promise<void>>()
-  return <T>(sessionId: string, task: () => Promise<T>) =>
-    runKeyedSerializedOperation(chains, sessionId, task)
-}
-
-function resumeHarness() {
-  const resumeGate = Promise.withResolvers<void>()
-  let child = false
-  let turnActive = false
-  const evict = vi.fn(async () => {
-    child = false
-  })
-  const resume = vi.fn(async () => {
-    await resumeGate.promise
-    child = true
-    return { ok: true as const }
-  })
-  const holds = new StructuredAgentSessionHolds({
-    resume,
-    serialize: keyedSerialize(),
-    hasProviderChild: () => child,
-    hasOwedWork: () => turnActive,
-    evict,
-    graceMs: GRACE_MS
-  })
-  pendingHolds.push(holds)
-  return {
-    holds,
-    resume,
-    resumeGate,
-    evict,
-    hasChild: () => child,
-    setTurnActive: (value: boolean) => {
-      turnActive = value
-    }
-  }
-}
-
-beforeEach(() => vi.useFakeTimers())
-afterEach(() => {
-  for (const holds of pendingHolds.splice(0)) {
-    holds.dispose()
-  }
-  vi.useRealTimers()
-})
-
-describe('a surface leaving while its structured session resumes', () => {
-  it('releases the acquired child after the last surface disconnects during resume', async () => {
-    const { holds, resumeGate, evict, hasChild } = resumeHarness()
-    const hold = holds.hold('session-1', 'connection-1:chat')
-
-    holds.release('session-1', 'connection-1:chat')
-    expect(holds.isReleasePending('session-1')).toBe(false)
-    resumeGate.resolve()
-    await hold
-
-    expect(hasChild()).toBe(true)
-    expect(holds.isHeld('session-1')).toBe(false)
-    expect(holds.isReleasePending('session-1')).toBe(true)
-    await vi.advanceTimersByTimeAsync(GRACE_MS - 1)
-    expect(evict).not.toHaveBeenCalled()
-    await vi.advanceTimersByTimeAsync(1)
-    expect(evict).toHaveBeenCalledExactlyOnceWith('session-1')
-    expect(hasChild()).toBe(false)
-  })
-
-  it('waits for an active turn before releasing the late child', async () => {
-    const { holds, resumeGate, evict, setTurnActive } = resumeHarness()
-    const hold = holds.hold('session-1', 'connection-1:chat')
-    holds.release('session-1', 'connection-1:chat')
-    setTurnActive(true)
-    resumeGate.resolve()
-    await hold
-
-    await vi.advanceTimersByTimeAsync(GRACE_MS * 2)
-    expect(evict).not.toHaveBeenCalled()
-    expect(holds.isReleasePending('session-1')).toBe(true)
-
-    setTurnActive(false)
-    await vi.advanceTimersByTimeAsync(GRACE_MS)
-    expect(evict).toHaveBeenCalledExactlyOnceWith('session-1')
-  })
-
-  it.each([false, true])('preserves an arriving holder with resume=%s', async (resume) => {
-    const { holds, resumeGate, evict } = resumeHarness()
-    const first = holds.hold('session-1', 'connection-1:chat')
-    holds.release('session-1', 'connection-1:chat')
-    const replacement = holds.hold('session-1', 'connection-2:chat', { resume })
-    resumeGate.resolve()
-    await Promise.all([first, replacement])
-
-    await vi.advanceTimersByTimeAsync(GRACE_MS * 2)
-    expect(holds.isHeld('session-1')).toBe(true)
-    expect(holds.isReleasePending('session-1')).toBe(false)
-    expect(evict).not.toHaveBeenCalled()
-
-    holds.release('session-1', 'connection-2:chat')
-    await vi.advanceTimersByTimeAsync(GRACE_MS)
-    expect(evict).toHaveBeenCalledExactlyOnceWith('session-1')
-  })
-
-  it('cancels the late-child release when a surface reconnects during grace', async () => {
-    const { holds, resumeGate, evict } = resumeHarness()
-    const hold = holds.hold('session-1', 'connection-1:chat')
-    holds.release('session-1', 'connection-1:chat')
-    resumeGate.resolve()
-    await hold
-    expect(holds.isReleasePending('session-1')).toBe(true)
-
-    await holds.hold('session-1', 'connection-2:chat')
-    await vi.advanceTimersByTimeAsync(GRACE_MS * 2)
-    expect(holds.isReleasePending('session-1')).toBe(false)
-    expect(evict).not.toHaveBeenCalled()
-  })
-
-  it('preserves a failed resume without scheduling eviction', async () => {
-    const { holds, resumeGate, evict, hasChild } = resumeHarness()
-    const failure = new Error('provider acquisition failed')
-    const hold = holds.hold('session-1', 'connection-1:chat')
-    const rejected = expect(hold).rejects.toBe(failure)
-    holds.release('session-1', 'connection-1:chat')
-    resumeGate.reject(failure)
-    await rejected
-
-    await vi.advanceTimersByTimeAsync(GRACE_MS * 2)
-    expect(hasChild()).toBe(false)
-    expect(holds.isHeld('session-1')).toBe(false)
-    expect(holds.isReleasePending('session-1')).toBe(false)
-    expect(evict).not.toHaveBeenCalled()
-  })
-
-  it('leaves late acquisition cleanup to host teardown after disposal', async () => {
-    const { holds, resumeGate, evict } = resumeHarness()
-    const hold = holds.hold('session-1', 'connection-1:chat')
-    holds.release('session-1', 'connection-1:chat')
-    holds.dispose()
-    resumeGate.resolve()
-    await hold
-
-    await vi.advanceTimersByTimeAsync(GRACE_MS * 2)
-    expect(holds.isReleasePending('session-1')).toBe(false)
-    expect(evict).not.toHaveBeenCalled()
-  })
-
-  it('does not restart release timers when a surface leaves after disposal', async () => {
-    const { holds, resumeGate, evict } = resumeHarness()
-    const hold = holds.hold('session-1', 'connection-1:chat')
-    resumeGate.resolve()
-    await hold
-    holds.dispose()
-    holds.release('session-1', 'connection-1:chat')
-
-    await vi.advanceTimersByTimeAsync(GRACE_MS * 2)
-    expect(holds.isHeld('session-1')).toBe(false)
-    expect(holds.isReleasePending('session-1')).toBe(false)
-    expect(evict).not.toHaveBeenCalled()
-  })
-
-  it('releases a late child acquired after explicit close forgot its holders', async () => {
-    const { holds, resumeGate, evict } = resumeHarness()
-    const hold = holds.hold('session-1', 'connection-1:chat')
-    holds.forget('session-1')
-    resumeGate.resolve()
-    await hold
-
-    await vi.advanceTimersByTimeAsync(GRACE_MS)
-    expect(holds.isHeld('session-1')).toBe(false)
-    expect(evict).toHaveBeenCalledExactlyOnceWith('session-1')
-  })
-
-  it('lets a holder that left and came back make its own attempt behind a failing one, and its failure releases it', async () => {
-    const { holds, resume, resumeGate, evict } = resumeHarness()
-    const first = holds.hold('session-1', 'same-holder')
-    const firstRejected = expect(first).rejects.toThrow('acquisition failed')
-    holds.release('session-1', 'same-holder')
-    const replacement = holds.hold('session-1', 'same-holder')
-    const replacementRejected = expect(replacement).rejects.toThrow('acquisition failed')
-    await vi.advanceTimersByTimeAsync(0)
-    expect(holds.isHeld('session-1')).toBe(true)
-    expect(resume).toHaveBeenCalledOnce()
-
-    // The gate stays rejected, so the replacement's own attempt fails the same way.
-    resumeGate.reject(new Error('acquisition failed'))
-    await Promise.all([firstRejected, replacementRejected])
-
-    expect(resume).toHaveBeenCalledTimes(2)
-    expect(holds.isHeld('session-1')).toBe(false)
-    expect(holds.isReleasePending('session-1')).toBe(false)
-    await vi.advanceTimersByTimeAsync(GRACE_MS * 2)
-    expect(evict).not.toHaveBeenCalled()
-  })
-
-  it('keeps a re-hold that finds the child the failing attempt ahead of it left behind', async () => {
-    const gate = Promise.withResolvers<void>()
-    let child = false
-    const holds = new StructuredAgentSessionHolds({
-      // The child is up before the attempt settles, and then the attempt fails behind it.
-      resume: async () => {
-        child = true
-        await gate.promise
-        return { ok: true as const }
-      },
-      serialize: keyedSerialize(),
-      hasProviderChild: () => child,
-      hasOwedWork: () => false,
-      evict: async () => {},
-      graceMs: GRACE_MS
-    })
-    pendingHolds.push(holds)
-    const first = holds.hold('session-1', 'same-holder')
-    const rejected = expect(first).rejects.toThrow('acquisition failed')
-    holds.release('session-1', 'same-holder')
-    const replacement = holds.hold('session-1', 'same-holder')
-
-    gate.reject(new Error('acquisition failed'))
-    await rejected
-    // The first hold's failure released only the holder it added, at the incarnation it added;
-    // the replacement then ran, found the child, and kept the holder it re-took.
-    await replacement
-
-    expect(holds.isHeld('session-1')).toBe(true)
-    expect(holds.isReleasePending('session-1')).toBe(false)
-  })
-
-  it('starts a fresh resume once the failed one has settled', async () => {
-    let child = false
-    const resume = vi
-      .fn<() => Promise<StructuredAgentSessionResumeOutcome>>()
-      .mockRejectedValueOnce(new Error('first acquisition failed'))
-      .mockImplementationOnce(async () => {
-        child = true
-        return { ok: true }
-      })
-    const holds = new StructuredAgentSessionHolds({
-      resume,
-      serialize: keyedSerialize(),
-      hasProviderChild: () => child,
-      hasOwedWork: () => false,
-      evict: async () => {},
-      graceMs: GRACE_MS
-    })
-    pendingHolds.push(holds)
-
-    await expect(holds.hold('session-1', 'chat-1')).rejects.toThrow('first acquisition failed')
-    await holds.hold('session-1', 'chat-1')
-
-    expect(resume).toHaveBeenCalledTimes(2)
-    expect(holds.isHeld('session-1')).toBe(true)
-  })
-})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-hold-resume.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-hold-resume.ts
deleted file mode 100644
index 9ea59e18487..00000000000
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-hold-resume.ts
+++ /dev/null
@@ -1,130 +0,0 @@
-// Giving a session its provider child back.
-//
-// This is the replacement for the startup resume, and the difference is only in WHO asks: the same
-// eligibility rule, run when a surface binds, when a send finds the owner gone, or when a child
-// exits under an open surface — never when the app launches. It runs inside the session's
-// serialize, with the attach it is given, so the eligibility it reads is the one the attach acts
-// on. A write-capable hold must fail when acquisition is refused so the surface never mistakes a
-// readable journal for a live provider child.
-
-import type {
-  AgentSessionAttachResult,
-  AgentSessionMutationResult,
-  AgentSessionWireRefusal
-} from '../../../shared/agent-session-wire'
-import { isAgentSessionWireRefusalCode } from '../../../shared/agent-session-wire-refusals'
-import type { StructuredAgentSessionAttachContext } from './structured-agent-session-attach-context'
-import {
-  attachStructuredAgentSessionUnderSerialize,
-  type StructuredAgentSessionAttachOptions
-} from './structured-agent-session-attach-orchestration'
-import { failedCreateRefusal } from './structured-agent-session-failed-create-refusal'
-import { adapterSupportsRecord } from './structured-agent-session-provider-support'
-import {
-  structuredAgentSessionResumeOperationId,
-  structuredAgentSessionResumeParams
-} from './structured-agent-session-resume-eligibility'
-
-/** A resume answers with the attach's own refusal, verdict and all, so the asker can tell a lease
- *  someone else is settling from an owner that will not come back. */
-export type StructuredAgentSessionResumeOutcome =
-  | { ok: true }
-  | { ok: false; refusal: AgentSessionWireRefusal }
-
-export async function resumeHeldStructuredAgentSession(input: {
-  sessionId: string
-  context: StructuredAgentSessionAttachContext
-  /** Who is asking; the attach keys the ledger row it settles by it. */
-  callerKey: string
-  attachOptions?: StructuredAgentSessionAttachOptions
-}): Promise<StructuredAgentSessionResumeOutcome> {
-  const { sessionId, context, callerKey } = input
-  // The record is read only once this host has adjudicated it and exited any recovery stage a
-  // failed attempt latched — a lease left in `manual-recovery` by an unproven exit is one the
-  // resolver hands back, and the eligibility below must see it that way.
-  const unreconciled = await context.reconcileLeases(sessionId)
-  if (unreconciled) {
-    return { ok: false, refusal: unreconciled }
-  }
-  await context.runtimeState.resolveRecovery(sessionId)
-  const record = context.deps.store.getRecord(sessionId)
-  if (!record) {
-    return refuse('agent_session_identity_required', 'No structured session exists by that id.')
-  }
-  if (!adapterSupportsRecord(context.deps.adapter, record)) {
-    return refuse(
-      'structured_agent_session_unsupported',
-      'This execution host cannot resume the requested structured agent session.'
-    )
-  }
-  const params = structuredAgentSessionResumeParams(
-    record,
-    structuredAgentSessionResumeOperationId(context.now())
-  )
-  if (!params) {
-    return record.lease.unreconciled
-      ? refuse(
-          'execution_owner_reconciling',
-          'This host has not yet adjudicated the session lease.'
-        )
-      : record.lease.claimStatus === 'conflicted'
-        ? refuse('agent_session_conflict', 'Another process claims this session.')
-        : refuse(
-            'agent_session_ownership_unknown',
-            'The session lease is not one this host may resume.'
-          )
-  }
-  let attached: AgentSessionMutationResult<AgentSessionAttachResult>
-  try {
-    attached = await attachStructuredAgentSessionUnderSerialize(
-      context,
-      callerKey,
-      params,
-      input.attachOptions
-    )
-  } catch (error) {
-    // The attach settles an acquisition that failed — the ledger row, the released lease — before
-    // it rethrows the cause. That row is the answer: a failure it recorded is this resume's
-    // refusal, verdict and all. Only an error it did not record is a fault for the caller.
-    const settled = settledResumeRefusal(
-      context,
-      callerKey,
-      params.envelope.clientOperationId,
-      sessionId,
-      error
-    )
-    if (settled) {
-      return settled
-    }
-    throw error
-  }
-  return attached.ok ? { ok: true } : { ok: false, refusal: attached.refusal }
-}
-
-function settledResumeRefusal(
-  context: Pick<StructuredAgentSessionAttachContext, 'deps'>,
-  callerKey: string,
-  operationId: string,
-  sessionId: string,
-  error: unknown
-): StructuredAgentSessionResumeOutcome | null {
-  const outcome = context.deps.store.getOperationRow(callerKey, operationId)?.outcome
-  if (outcome?.status !== 'failed' || !isAgentSessionWireRefusalCode(outcome.code)) {
-    return null
-  }
-  return failedCreateRefusal(
-    {
-      code: outcome.code,
-      message: outcome.message ?? (error instanceof Error ? error.message : String(error))
-    },
-    outcome.status,
-    context.deps.store.getRecord(sessionId)
-  )
-}
-
-function refuse(
-  code: AgentSessionWireRefusal['code'],
-  message: string
-): StructuredAgentSessionResumeOutcome {
-  return { ok: false, refusal: { code, message } }
-}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-holders.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-holders.ts
deleted file mode 100644
index 531717168b1..00000000000
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-holders.ts
+++ /dev/null
@@ -1,71 +0,0 @@
-// Who WANTS this session alive, as a set of ids rather than a count.
-//
-// A refcount is the obvious shape and the wrong one. Every path that decrements it — a chat tab
-// closing, a transport dying, a client retrying a release it already sent — can fire twice or not
-// at all, and an integer cannot tell those apart: a duplicate release evicts a session somebody is
-// still looking at, and a lost one leaks the child forever. A set answers both idempotently,
-// because it records WHICH surface holds the session, not how many do.
-
-type Holder = { resumeCapable: boolean; incarnation: symbol }
-
-export class StructuredAgentSessionHolders {
-  private readonly bySession = new Map<string, Map<string, Holder>>()
-
-  /** True when the session gained its FIRST holder — the edge that ends a pending release. */
-  add(sessionId: string, holderId: string, resumeCapable = true): boolean {
-    const holders = this.bySession.get(sessionId)
-    if (!holders) {
-      this.bySession.set(sessionId, new Map([[holderId, { resumeCapable, incarnation: Symbol() }]]))
-      return true
-    }
-    const previous = holders.get(holderId)
-    holders.set(holderId, {
-      resumeCapable: (previous?.resumeCapable ?? false) || resumeCapable,
-      incarnation: previous?.incarnation ?? Symbol()
-    })
-    return false
-  }
-
-  /** True when the session lost its LAST holder — the edge that starts one. */
-  remove(sessionId: string, holderId: string, expectedIncarnation?: symbol): boolean {
-    const holders = this.bySession.get(sessionId)
-    if (
-      expectedIncarnation !== undefined &&
-      holders?.get(holderId)?.incarnation !== expectedIncarnation
-    ) {
-      return false
-    }
-    if (!holders?.delete(holderId) || holders.size > 0) {
-      return false
-    }
-    this.bySession.delete(sessionId)
-    return true
-  }
-
-  isHeld(sessionId: string): boolean {
-    return (this.bySession.get(sessionId)?.size ?? 0) > 0
-  }
-
-  has(sessionId: string, holderId: string): boolean {
-    return this.bySession.get(sessionId)?.has(holderId) ?? false
-  }
-
-  incarnation(sessionId: string, holderId: string): symbol | undefined {
-    return this.bySession.get(sessionId)?.get(holderId)?.incarnation
-  }
-
-  holderIds(sessionId: string): string[] {
-    return [...(this.bySession.get(sessionId)?.keys() ?? [])]
-  }
-
-  hasResumeCapableHolder(sessionId: string): boolean {
-    return [...(this.bySession.get(sessionId)?.values() ?? [])].some(
-      (holder) => holder.resumeCapable
-    )
-  }
-
-  /** Drops every holder of one session without evaluating the edge, for a session that is gone. */
-  forget(sessionId: string): void {
-    this.bySession.delete(sessionId)
-  }
-}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-holds.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-holds.test.ts
deleted file mode 100644
index 68027f81887..00000000000
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-holds.test.ts
+++ /dev/null
@@ -1,346 +0,0 @@
-// The parts a session's lifetime is assembled from: the holder set, the release clock, and the
-// deadline that keeps teardown from hanging.
-
-import { afterEach, describe, expect, it, vi } from 'vitest'
-import { runKeyedSerializedOperation } from '../../cli/keyed-promise-queue'
-import { StructuredAgentSessionHolders } from './structured-agent-session-holders'
-import { StructuredAgentSessionReleaseClock } from './structured-agent-session-release-clock'
-import { StructuredAgentSessionHolds } from './structured-agent-session-holds'
-import {
-  STRUCTURED_AGENT_SESSION_EVICTION_STEPS,
-  evictStructuredAgentSession
-} from './structured-agent-session-eviction'
-import {
-  StructuredAgentSessionEvictionTimeoutError,
-  withStructuredAgentSessionEvictionDeadline
-} from './structured-agent-session-eviction-deadline'
-
-const clocks: StructuredAgentSessionReleaseClock[] = []
-
-/** The host's per-session queue, so a hold and a writer really take turns. */
-function keyedSerialize() {
-  const chains = new Map<string, Promise<void>>()
-  return <T>(sessionId: string, task: () => Promise<T>) =>
-    runKeyedSerializedOperation(chains, sessionId, task)
-}
-
-function clock(deps: {
-  hasOwedWork?: () => boolean
-  isHeld?: () => boolean
-  evict: (sessionId: string) => Promise<void>
-  onError?: (input: { sessionId: string; error: unknown }) => void
-}): StructuredAgentSessionReleaseClock {
-  const created = new StructuredAgentSessionReleaseClock({
-    hasOwedWork: deps.hasOwedWork ?? (() => false),
-    isHeld: deps.isHeld ?? (() => false),
-    evict: deps.evict,
-    ...(deps.onError ? { onError: deps.onError } : {}),
-    graceMs: 1
-  })
-  clocks.push(created)
-  return created
-}
-
-afterEach(() => {
-  for (const created of clocks.splice(0)) {
-    created.dispose()
-  }
-})
-
-describe('the holder set', () => {
-  it('reports the first and last holder, and nothing in between', () => {
-    const holders = new StructuredAgentSessionHolders()
-
-    expect(holders.add('session-1', 'a')).toBe(true)
-    expect(holders.add('session-1', 'b')).toBe(false)
-    expect(holders.remove('session-1', 'a')).toBe(false)
-    expect(holders.remove('session-1', 'b')).toBe(true)
-    expect(holders.isHeld('session-1')).toBe(false)
-  })
-
-  // The reason this is a set and not a count: every release path can fire twice or not at all.
-  it('absorbs a duplicate hold and a duplicate release', () => {
-    const holders = new StructuredAgentSessionHolders()
-
-    holders.add('session-1', 'a')
-    holders.add('session-1', 'a')
-    expect(holders.remove('session-1', 'a')).toBe(true)
-    expect(holders.remove('session-1', 'a')).toBe(false)
-    expect(holders.holderIds('session-1')).toEqual([])
-  })
-
-  it('keeps one session holders out of another session holders', () => {
-    const holders = new StructuredAgentSessionHolders()
-
-    holders.add('session-1', 'a')
-    holders.add('session-2', 'a')
-    holders.remove('session-1', 'a')
-
-    expect(holders.isHeld('session-1')).toBe(false)
-    expect(holders.isHeld('session-2')).toBe(true)
-  })
-
-  it('distinguishes retaining holders from holders that may resume a provider', () => {
-    const holders = new StructuredAgentSessionHolders()
-
-    holders.add('session-1', 'subscriber', false)
-    expect(holders.hasResumeCapableHolder('session-1')).toBe(false)
-
-    holders.add('session-1', 'chat', true)
-    expect(holders.hasResumeCapableHolder('session-1')).toBe(true)
-    holders.remove('session-1', 'chat')
-    expect(holders.hasResumeCapableHolder('session-1')).toBe(false)
-  })
-})
-
-describe('the release clock', () => {
-  it('waits out a running turn instead of evicting into it', async () => {
-    const evict = vi.fn(async () => {})
-    let turnRunning = true
-    const releasing = clock({ hasOwedWork: () => turnRunning, evict })
-
-    releasing.arm('session-1')
-    await new Promise((resolve) => setTimeout(resolve, 30))
-    expect(evict).not.toHaveBeenCalled()
-
-    turnRunning = false
-    await vi.waitFor(() => expect(evict).toHaveBeenCalledWith('session-1'))
-  })
-
-  it('stands down when a holder arrives during the wait', async () => {
-    const evict = vi.fn(async () => {})
-    const releasing = clock({ isHeld: () => true, evict })
-
-    releasing.arm('session-1')
-    await new Promise((resolve) => setTimeout(resolve, 30))
-
-    expect(evict).not.toHaveBeenCalled()
-  })
-
-  it('keeps an idle unheld child for thirty minutes, and activity starts the window over', async () => {
-    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
-    try {
-      const evict = vi.fn(async () => {})
-      const idle = new StructuredAgentSessionReleaseClock({
-        hasOwedWork: () => false,
-        isHeld: () => false,
-        evict
-      })
-      clocks.push(idle)
-      const minutes = (count: number) => vi.advanceTimersByTimeAsync(count * 60_000)
-
-      idle.arm('session-1')
-      await minutes(20)
-      idle.renew('session-1')
-      await minutes(29)
-      expect(evict).not.toHaveBeenCalled()
-
-      await minutes(1)
-      expect(evict).toHaveBeenCalledWith('session-1')
-    } finally {
-      vi.useRealTimers()
-    }
-  })
-
-  it('does not start a window for a session nothing released', async () => {
-    const evict = vi.fn(async () => {})
-    const releasing = clock({ evict })
-
-    releasing.renew('session-1')
-    await new Promise((resolve) => setTimeout(resolve, 30))
-
-    expect(releasing.isArmed('session-1')).toBe(false)
-    expect(evict).not.toHaveBeenCalled()
-  })
-
-  it('reports a failed eviction rather than swallowing it', async () => {
-    const onError = vi.fn()
-    const releasing = clock({
-      evict: async () => {
-        throw new Error('child would not stop')
-      },
-      onError
-    })
-
-    releasing.arm('session-1')
-
-    await vi.waitFor(() =>
-      expect(onError).toHaveBeenCalledWith({
-        sessionId: 'session-1',
-        error: expect.objectContaining({ message: 'child would not stop' })
-      })
-    )
-  })
-})
-
-describe('holds', () => {
-  it('resumes a session on its first hold and not on a retained one', async () => {
-    let child = false
-    const resume = vi.fn(async () => {
-      child = true
-      return { ok: true as const }
-    })
-    const holds = new StructuredAgentSessionHolds({
-      resume,
-      serialize: keyedSerialize(),
-      hasProviderChild: () => child,
-      hasOwedWork: () => false,
-      evict: async () => {},
-      graceMs: 1
-    })
-
-    await holds.hold('session-1', 'stream-1', { resume: false })
-    expect(resume).not.toHaveBeenCalled()
-
-    await holds.hold('session-1', 'chat-1')
-    expect(resume).toHaveBeenCalledOnce()
-
-    child = true
-    await holds.hold('session-1', 'chat-2')
-    expect(resume).toHaveBeenCalledOnce()
-    holds.dispose()
-  })
-
-  it('runs one resume for a writer and a hold that ask in the same gap', async () => {
-    const gate = Promise.withResolvers<void>()
-    let child = false
-    const resume = vi.fn(async () => {
-      await gate.promise
-      child = true
-      return { ok: true as const }
-    })
-    const serialize = keyedSerialize()
-    const holds = new StructuredAgentSessionHolds({
-      resume,
-      serialize,
-      hasProviderChild: () => child,
-      hasOwedWork: () => false,
-      evict: async () => {},
-      graceMs: 1
-    })
-
-    // A send's ensure-owner step: already inside the session's serialize when it asks.
-    const writer = serialize('session-1', () => holds.ensureProviderChild('session-1'))
-    const hold = holds.hold('session-1', 'chat-1')
-    gate.resolve()
-
-    await expect(writer).resolves.toEqual({ ok: true })
-    await hold
-    // The hold ran after the writer's step and found the child: nothing to resume.
-    expect(resume).toHaveBeenCalledOnce()
-    // The surface arrived while the writer's resume ran, so the child it got is held, not idle.
-    expect(holds.isHeld('session-1')).toBe(true)
-    expect(holds.isReleasePending('session-1')).toBe(false)
-    holds.dispose()
-  })
-
-  it('puts a child a writer resumed with no surface on the idle clock', async () => {
-    let child = false
-    const serialize = keyedSerialize()
-    const holds = new StructuredAgentSessionHolds({
-      resume: async () => {
-        child = true
-        return { ok: true as const }
-      },
-      serialize,
-      hasProviderChild: () => child,
-      hasOwedWork: () => false,
-      evict: async () => {},
-      graceMs: 60_000
-    })
-
-    await serialize('session-1', () => holds.ensureProviderChild('session-1'))
-
-    expect(holds.isHeld('session-1')).toBe(false)
-    expect(holds.isReleasePending('session-1')).toBe(true)
-    holds.dispose()
-  })
-
-  it('never arms the clock for a session with nothing to stop', async () => {
-    const evict = vi.fn(async () => {})
-    const holds = new StructuredAgentSessionHolds({
-      resume: async () => ({ ok: true as const }),
-      serialize: keyedSerialize(),
-      hasProviderChild: () => false,
-      hasOwedWork: () => false,
-      evict,
-      graceMs: 1
-    })
-
-    await holds.hold('session-1', 'chat-1', { resume: false })
-    holds.release('session-1', 'chat-1')
-    await new Promise((resolve) => setTimeout(resolve, 20))
-
-    expect(evict).not.toHaveBeenCalled()
-    expect(holds.isReleasePending('session-1')).toBe(false)
-    holds.dispose()
-  })
-
-  it('fails a write-capable hold when resume proves no provider child', async () => {
-    const holds = new StructuredAgentSessionHolds({
-      resume: async () => ({ ok: true as const }),
-      serialize: keyedSerialize(),
-      hasProviderChild: () => false,
-      hasOwedWork: () => false,
-      evict: async () => {},
-      graceMs: 1
-    })
-
-    await expect(holds.hold('session-1', 'chat-1')).rejects.toThrow(
-      'agent_session_ownership_unknown'
-    )
-    expect(holds.isHeld('session-1')).toBe(false)
-    holds.dispose()
-  })
-})
-
-describe('the teardown deadline', () => {
-  it('leaves the child loaded instead of forcing it, and keeps the session indexed', async () => {
-    const forget = vi.fn()
-    const releaseLease = vi.fn(async () => {})
-
-    await expect(
-      evictStructuredAgentSession(
-        {
-          sessionId: 'session-1',
-          eventSink: {
-            unbind: vi.fn(),
-            drained: vi.fn(async () => {}),
-            close: vi.fn()
-          } as never,
-          adapter: { closeSession: () => new Promise<void>(() => {}) } as never,
-          forget,
-          discardSink: vi.fn(),
-          releaseLease
-        },
-        withStructuredAgentSessionEvictionDeadline(STRUCTURED_AGENT_SESSION_EVICTION_STEPS, 5)
-      )
-    ).rejects.toMatchObject({ step: 'stop-provider-child' })
-
-    expect(forget).not.toHaveBeenCalled()
-    expect(releaseLease).not.toHaveBeenCalled()
-  })
-
-  it('names the step that ran out of time', async () => {
-    const [step] = withStructuredAgentSessionEvictionDeadline(
-      [{ name: 'slow-step', run: () => new Promise<void>(() => {}) }],
-      5
-    )
-
-    await expect(step?.run({} as never)).rejects.toBeInstanceOf(
-      StructuredAgentSessionEvictionTimeoutError
-    )
-  })
-
-  it('does not delay a step that finishes', async () => {
-    const ran: string[] = []
-    const steps = withStructuredAgentSessionEvictionDeadline(
-      [{ name: 'fast-step', run: () => void ran.push('fast-step') }],
-      5_000
-    )
-
-    await steps[0]?.run({} as never)
-
-    expect(ran).toEqual(['fast-step'])
-  })
-})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-holds.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-holds.ts
deleted file mode 100644
index 0acbccb6b55..00000000000
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-holds.ts
+++ /dev/null
@@ -1,179 +0,0 @@
-// The lifetime of a structured session, tied to the surfaces that want one.
-//
-// Nothing used to tell the host that a chat WANTED a session, and nothing told it when a chat
-// stopped wanting one. Both halves of that gap cost real processes: sessions nobody had opened got
-// an app-server at every launch, and sessions the user closed kept theirs until the app quit.
-//
-// A surface takes a hold when it binds and drops it when it goes away. The first hold on a session
-// with no child resumes it — that, and not the shape of a lease on disk, is what makes a provider
-// process exist. The last hold leaving starts the idle release clock. Transport close is the BACKSTOP,
-// not the mechanism: a client that vanishes mid-flight never sends its release, so the caller
-// registers one against the connection and the holder set absorbs the duplicate.
-//
-// A send to a childless session resumes it too, and so does provider-exit recovery under an open
-// surface. All three go through `ensureProviderChild` inside the session's serialize, so they take
-// turns: the first to run attaches, and the next finds the child and attaches nothing. Two attaches
-// for one session would race against the same released fence, and the loser's stale fence refused
-// it — a hold that lost dropped its holder, a send that lost was refused.
-
-import {
-  StructuredAgentSessionReleaseClock,
-  type StructuredAgentSessionReleaseClockDeps
-} from './structured-agent-session-release-clock'
-import { StructuredAgentSessionHolders } from './structured-agent-session-holders'
-import type { StructuredAgentSessionResumeOutcome } from './structured-agent-session-hold-resume'
-import type { StructuredAgentSessionAttachOptions } from './structured-agent-session-attach-orchestration'
-
-export type StructuredAgentSessionHoldsDeps = {
-  /** Attaches a provider child, for a caller already inside `serialize`. */
-  resume: (
-    sessionId: string,
-    attachOptions?: StructuredAgentSessionAttachOptions
-  ) => Promise<StructuredAgentSessionResumeOutcome>
-  serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
-  /** Whether evicting this session would actually free anything. */
-  hasProviderChild: (sessionId: string) => boolean
-  hasOwedWork: (sessionId: string) => boolean
-  evict: (sessionId: string) => Promise<void>
-  onError?: (input: { sessionId: string; error: unknown }) => void
-  graceMs?: number
-}
-
-export type StructuredAgentSessionHoldOptions = {
-  /** False for a hold that only RETAINS — a subscription stream, which must not make a child
-   *  exist just by reading history. */
-  resume?: boolean
-}
-
-export class StructuredAgentSessionHolds {
-  private readonly holders = new StructuredAgentSessionHolders()
-  private readonly clock: StructuredAgentSessionReleaseClock
-  private disposed = false
-
-  constructor(private readonly deps: StructuredAgentSessionHoldsDeps) {
-    const clockDeps: StructuredAgentSessionReleaseClockDeps = {
-      hasOwedWork: deps.hasOwedWork,
-      isHeld: (sessionId) => this.holders.isHeld(sessionId),
-      evict: (sessionId) => this.deps.evict(sessionId),
-      ...(deps.onError ? { onError: deps.onError } : {}),
-      ...(deps.graceMs === undefined ? {} : { graceMs: deps.graceMs })
-    }
-    this.clock = new StructuredAgentSessionReleaseClock(clockDeps)
-  }
-
-  async hold(
-    sessionId: string,
-    holderId: string,
-    options: StructuredAgentSessionHoldOptions = {}
-  ): Promise<void> {
-    const alreadyHeld = this.holders.has(sessionId, holderId)
-    this.holders.add(sessionId, holderId, options.resume !== false)
-    const incarnation = this.holders.incarnation(sessionId, holderId)
-    // Unconditional, not only on the first-holder edge: a second surface arriving during the grace
-    // window must cancel the pending release too.
-    this.clock.cancel(sessionId)
-    if (options.resume === false) {
-      return
-    }
-    let resumed: StructuredAgentSessionResumeOutcome
-    try {
-      resumed = await this.deps.serialize(sessionId, () => this.ensureProviderChild(sessionId))
-    } catch (error) {
-      this.releaseFailedHold(sessionId, holderId, alreadyHeld, incarnation)
-      throw error
-    }
-    if (!resumed.ok) {
-      this.releaseFailedHold(sessionId, holderId, alreadyHeld, incarnation)
-      // The RPC surface raises a refusal as its code.
-      throw new Error(resumed.refusal.code)
-    }
-  }
-
-  /** Only the holder this call added, at the incarnation it added: a same-ID hold that left and
-   *  came back while this one waited owns the holder now, and its own attempt decides it. */
-  private releaseFailedHold(
-    sessionId: string,
-    holderId: string,
-    alreadyHeld: boolean,
-    incarnation: symbol | undefined
-  ): void {
-    if (!alreadyHeld && incarnation !== undefined) {
-      this.release(sessionId, holderId, incarnation)
-    }
-  }
-
-  /**
-   * Gives the session a provider child if it has none.
-   *
-   * For a caller already inside the session's serialize, which is what makes "if it has none"
-   * exact: a hold and a send that both find the owner gone run this in turn, and the second sees
-   * the first one's child. Each caller makes at most one attach, and a failed one leaves the
-   * next caller to make its own. With no surface holding the session afterwards, the child goes
-   * on the same clock a departed surface would start — including the surface that held it when
-   * provider-exit recovery began and left while the attach ran.
-   */
-  async ensureProviderChild(
-    sessionId: string,
-    attachOptions?: StructuredAgentSessionAttachOptions
-  ): Promise<StructuredAgentSessionResumeOutcome> {
-    if (this.deps.hasProviderChild(sessionId)) {
-      return { ok: true }
-    }
-    const resumed = await this.deps.resume(sessionId, attachOptions)
-    if (!resumed.ok) {
-      return resumed
-    }
-    if (!this.deps.hasProviderChild(sessionId)) {
-      return {
-        ok: false,
-        refusal: {
-          code: 'agent_session_ownership_unknown',
-          message: 'The session attached without a provider child to write to.'
-        }
-      }
-    }
-    // The last surface can disconnect before acquisition makes a child available to release.
-    if (!this.disposed && !this.holders.isHeld(sessionId)) {
-      this.clock.arm(sessionId)
-    }
-    return { ok: true }
-  }
-
-  /** Activity — a journal write, or a start reaching the work it held; only a pending release
-   *  notices, and it restarts its full window. */
-  renew(sessionId: string): void {
-    this.clock.renew(sessionId)
-  }
-
-  release(sessionId: string, holderId: string, expectedIncarnation?: symbol): void {
-    if (!this.holders.remove(sessionId, holderId, expectedIncarnation)) {
-      return
-    }
-    if (!this.disposed && this.deps.hasProviderChild(sessionId)) {
-      this.clock.arm(sessionId)
-    }
-  }
-
-  /** Drops the holders of a session that is gone, whoever evicted it. */
-  forget(sessionId: string): void {
-    this.clock.cancel(sessionId)
-    this.holders.forget(sessionId)
-  }
-
-  isHeld(sessionId: string): boolean {
-    return this.holders.isHeld(sessionId)
-  }
-
-  hasResumeCapableHolder(sessionId: string): boolean {
-    return this.holders.hasResumeCapableHolder(sessionId)
-  }
-
-  isReleasePending(sessionId: string): boolean {
-    return this.clock.isArmed(sessionId)
-  }
-
-  dispose(): void {
-    this.disposed = true
-    this.clock.dispose()
-  }
-}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-delivery.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-delivery.ts
new file mode 100644
index 00000000000..ed2e48fd562
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-delivery.ts
@@ -0,0 +1,156 @@
+// The host's conversations: how one becomes open, and the delivery loop that hands its accepted
+// messages to a provider child. Bundled because they share one invariant — a conversation open
+// with a message queued has a delivery loop — and the open is where a loop for leftovers wakes.
+
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
+import type { AgentJournalResetReason } from '../../../shared/agent-session-journal-types'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import {
+  openStructuredAgentSessionConversation,
+  resettleOpenStructuredAgentSessionConversation,
+  type OpenedStructuredAgentSessionConversation,
+  type StructuredAgentSessionConversationOpenOptions
+} from './structured-agent-session-conversation-open'
+import { StructuredAgentSessionDeliveryLoop } from './structured-agent-session-delivery-loop'
+import { structuredAgentSessionCommandRunning } from './structured-agent-session-command-turn'
+import type { StructuredAgentSessionResumeOutcome } from './structured-agent-session-agent-start'
+import type {
+  StructuredAgentSessionHostDeps,
+  StructuredAgentSessionHostSession
+} from './structured-agent-session-host-types'
+import { structuredAgentSessionConversationFence } from './structured-agent-session-provider-child'
+import { structuredAgentSessionFailureWordsContext } from './structured-agent-session-send-preparation'
+import { recoverStructuredRewind } from './structured-rewind-recovery'
+
+export type StructuredAgentSessionConversationDelivery = {
+  loop: StructuredAgentSessionDeliveryLoop
+  /** For a caller inside the session's serialize. */
+  open: (
+    sessionId: string,
+    options?: StructuredAgentSessionConversationOpenOptions
+  ) => Promise<StructuredAgentSessionHostSession | null>
+  /** Every commit a conversation's journal makes: one may have ended the command that held its
+   *  queue. Enqueued through the session's serialize, never read here, so a commit that lands while
+   *  a step is deciding to stop wakes the loop after that step rather than being lost to it. */
+  afterCommit: (sessionId: string, journal: AgentSessionJournal) => void
+  /** Stops the loop and the resettle on a proof of death; quit's first step. */
+  dispose: () => void
+  /** Indexes a conversation some other open produced, as `open` would have. */
+  adoptOpened: (
+    sessionId: string,
+    opened: OpenedStructuredAgentSessionConversation
+  ) => Promise<void>
+}
+
+export function createStructuredAgentSessionConversationDelivery(input: {
+  deps: StructuredAgentSessionHostDeps
+  sessions: Map<string, StructuredAgentSessionHostSession>
+  serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
+  trackStart: <T>(start: Promise<T>) => Promise<T>
+  /** Starts a child for `startedFor`, the queued message at the head, if the session has none. */
+  ensureProviderChild: (
+    sessionId: string,
+    startedFor: string
+  ) => Promise<StructuredAgentSessionResumeOutcome>
+  reset: (sessionId: string, journal: AgentSessionJournal, reset: AgentJournalResetReason) => void
+  publishRestored: (sessionId: string) => void
+  flushStreamedEvents: (sessionId: string) => Promise<void>
+}): StructuredAgentSessionConversationDelivery {
+  const { deps, sessions } = input
+  const loop = new StructuredAgentSessionDeliveryLoop({
+    sessions,
+    adapter: deps.adapter,
+    serialize: input.serialize,
+    trackStart: input.trackStart,
+    ensureProviderChild: input.ensureProviderChild,
+    conversationFence: (sessionId) =>
+      structuredAgentSessionConversationFence(deps.store, sessionId),
+    failureTextContext: (sessionId) =>
+      structuredAgentSessionFailureWordsContext(
+        deps.store.getRecord(sessionId),
+        sessions.get(sessionId)?.journal
+      ),
+    onError: (sessionId, error) => deps.onEventSinkError?.({ sessionId, error }),
+    record: (sessionId) => deps.store.getRecord(sessionId),
+    flushStreamedEvents: input.flushStreamedEvents,
+    now: () => deps.now?.() ?? Date.now()
+  })
+  const adoptOpened = async (
+    sessionId: string,
+    opened: OpenedStructuredAgentSessionConversation
+  ): Promise<void> => {
+    const { session, reset } = opened
+    sessions.set(sessionId, session)
+    if (reset) {
+      input.reset(sessionId, session.journal, reset)
+    }
+    input.publishRestored(sessionId)
+    await settleInterruptedCommands(deps, sessionId, session)
+    if (session.journal.submissions().some(isQueuedAgentJournalSubmission)) {
+      loop.wake(sessionId)
+    }
+  }
+  const wakesQueued = new Set<string>()
+  const afterCommit = (sessionId: string, journal: AgentSessionJournal): void => {
+    if (
+      wakesQueued.has(sessionId) ||
+      structuredAgentSessionCommandRunning(journal) ||
+      !journal.submissions().some(isQueuedAgentJournalSubmission)
+    ) {
+      return
+    }
+    wakesQueued.add(sessionId)
+    void input
+      .serialize(sessionId, async () => {
+        wakesQueued.delete(sessionId)
+        loop.wake(sessionId)
+      })
+      .catch((error: unknown) => {
+        wakesQueued.delete(sessionId)
+        deps.onEventSinkError?.({ sessionId, error })
+      })
+  }
+  // A chat open before its owner's death was proven revises what its open settled. Queued, never
+  // awaited: the writer can hold this session's serialize (an attach recovering its lease).
+  const stopResettling = deps.store.onDeathEvidence((sessionId) => {
+    if (sessions.has(sessionId)) {
+      void input
+        .trackStart(
+          input.serialize(sessionId, () =>
+            resettleOpenStructuredAgentSessionConversation(deps, sessionId, sessions.get(sessionId))
+          )
+        )
+        .catch((error: unknown) => deps.onEventSinkError?.({ sessionId, error }))
+    }
+  })
+  return {
+    loop,
+    afterCommit,
+    adoptOpened,
+    dispose: () => {
+      loop.dispose()
+      stopResettling()
+    },
+    open: (sessionId, options) =>
+      openStructuredAgentSessionConversation({ deps, sessions, adoptOpened }, sessionId, options)
+  }
+}
+
+/**
+ * A rewind found prepared when the conversation opens was started under a child this process no
+ * longer has — the open runs only when none is indexed — so nothing will finish it, and left alone
+ * it refuses every send until a view attaches. Settled here instead of by a start inside
+ * acceptance. A Codex rewind only its provider can prove stays for the attach.
+ */
+async function settleInterruptedCommands(
+  deps: StructuredAgentSessionHostDeps,
+  sessionId: string,
+  session: StructuredAgentSessionHostSession
+): Promise<void> {
+  const fence = structuredAgentSessionConversationFence(deps.store, sessionId)
+  try {
+    await recoverStructuredRewind(deps.store, sessionId, session.journal, fence)
+  } catch (error) {
+    deps.onEventSinkError?.({ sessionId, error })
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts
index 0eed19031c7..c9ba8714b4e 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts
@@ -1,27 +1,34 @@
-// The host's half of a session's lifetime: what a close does, and what a hold is wired to.
+// The host's half of a session's lifetime: stopping its agent, and closing its conversation.
 //
-// Lifted out of the host for the same reason attaching was — the host is a coordinator, and the
-// sequence that stops a provider child and hands its lease back reads better next to the holder
-// bookkeeping that decides when to run it than buried among the twenty other things a session can
-// do.
+// Two operations, because they end two different things. Stopping the agent ends the provider
+// child and hands the lease back; the conversation — its open journal, its status row and its
+// readers — stays, and the next send starts a new child. Closing the conversation drops the open
+// journal handle, a cache the next read or write reopens.
+//
+// Both are written for a caller already inside the session's serialize: the queue is not
+// reentrant, so every public entry point takes it once and calls these.
 
-import { agentChildWorkLiveness } from '../../../shared/agent-status-child-work-liveness'
-import { activeStructuredAgentSessionTurnId } from '../../../shared/structured-agent-session-projection'
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
 import {
   evictStructuredAgentSession,
   STRUCTURED_AGENT_SESSION_EVICTION_STEPS,
   type StructuredAgentSessionEvictionContext
 } from './structured-agent-session-eviction'
 import { withStructuredAgentSessionEvictionDeadline } from './structured-agent-session-eviction-deadline'
-import { StructuredAgentSessionHolds } from './structured-agent-session-holds'
 import type { StructuredAgentSessionHostRuntimeState } from './structured-agent-session-host-runtime-state'
 import type {
+  StructuredAgentSessionChildEndCause,
   StructuredAgentSessionHostDeps,
-  StructuredAgentSessionHostSession
+  StructuredAgentSessionHostSession,
+  StructuredAgentSessionProviderChildIdentity
 } from './structured-agent-session-host-types'
+import {
+  endProviderChild,
+  structuredAgentSessionConversationFence
+} from './structured-agent-session-provider-child'
 import { releaseStoredStructuredAgentSessionOwner } from './structured-agent-session-lease-release'
-import { resumeHeldStructuredAgentSession } from './structured-agent-session-hold-resume'
-import type { StructuredAgentSessionAttachContext } from './structured-agent-session-attach-context'
 import { settleStructuredAgentSessionDeadGeneration } from './structured-agent-session-dead-generation-settlement'
 
 export type StructuredAgentSessionLifetimeContext = {
@@ -29,8 +36,8 @@ export type StructuredAgentSessionLifetimeContext = {
   runtimeState: StructuredAgentSessionHostRuntimeState
   sessions: Map<string, StructuredAgentSessionHostSession>
   now: () => number
-  /** Drops the session's row from the agent-status store; see `forgetStructuredAgentSession`. */
-  forgetStatus: (sessionId: string) => void
+  /** Re-projects the session's status after its agent stopped and the chat stays. */
+  publishStatus?: (sessionId: string) => void
   /** Quit-only snapshot taken immediately before the provider child is stopped. */
   restartWitness?: {
     beforeStop: (sessionId: string) => void
@@ -38,73 +45,96 @@ export type StructuredAgentSessionLifetimeContext = {
   }
 }
 
-/** Dropping a session and dropping its status row are ONE operation: the store keeps the row until
- *  told, so a caller that only deletes strands a live-looking row no reader can ever decay. */
-export async function forgetStructuredAgentSession(
-  context: StructuredAgentSessionLifetimeContext,
-  sessionId: string
-): Promise<void> {
-  await context.sessions.get(sessionId)?.journal.close()
-  context.sessions.delete(sessionId)
-  context.forgetStatus(sessionId)
+type ConversationCloseDeps = Pick<StructuredAgentSessionHostDeps, 'onEventSinkError'> & {
+  store: Pick<StructuredAgentSessionHostDeps['store'], 'getRecord'>
 }
 
-function hasProviderChild(
-  context: StructuredAgentSessionLifetimeContext,
-  sessionId: string
-): boolean {
-  return context.sessions.get(sessionId)?.hasProviderChild === true
+/** A conversation's handle closes with nothing queued: what is still queued when the chat closes,
+ *  or the app quits, will not be handed over. Best effort: the next open's delivery loop rejects a
+ *  leftover itself. */
+export async function abandonQueuedStructuredAgentSessionMessages(
+  deps: ConversationCloseDeps,
+  sessionId: string,
+  journal: StructuredAgentSessionHostSession['journal']
+): Promise<void> {
+  await journal
+    .rejectQueuedSubmissions(
+      structuredAgentSessionConversationFence(deps.store, sessionId),
+      agentSessionFailureWords(agentSessionFailureFact('chatClosed'), { surface: 'rejection' })
+    )
+    .catch((error: unknown) => deps.onEventSinkError?.({ sessionId, error }))
 }
 
 /** The wind-down this host owes for the session's child. A live child always owes one, whatever a
- *  previous childless eviction recorded: a remembered `false` must never outrank the child in front
- *  of it. */
-function owesProviderChildWindDown(session: StructuredAgentSessionHostSession): boolean {
-  return session.hasProviderChild || session.owesProviderChildWindDown === true
+ *  previous childless eviction recorded: a remembered tombstone must never outrank the child in
+ *  front of it. */
+function owedProviderChildWindDown(
+  session: StructuredAgentSessionHostSession
+): StructuredAgentSessionProviderChildIdentity | undefined {
+  return session.child
+    ? { generation: session.child.generation, fence: session.child.fence }
+    : session.owesProviderChildWindDown
 }
 
-/** Runs the eviction steps under a deadline. A step that fails — or runs out of time — aborts the
- *  rest, which leaves the session indexed and the child loaded so the next close is a real retry. */
-export async function evictHeldStructuredAgentSession(
+/**
+ * The agent goes to rest; the conversation stays. Runs the eviction steps under a deadline. A step
+ * that fails — or runs out of time — aborts the rest and leaves the wind-down owed, so the next
+ * stop is a real retry. `ending` is how the child's end is told: a user's Stop, the host stopping it
+ * for a cause (with its text), or an eviction the conversation's close follows.
+ */
+export async function stopStructuredAgentSessionAgentUnderSerialize(
   context: StructuredAgentSessionLifetimeContext,
-  sessionId: string
+  sessionId: string,
+  ending: {
+    cause: Extract<StructuredAgentSessionChildEndCause, 'user-stop' | 'host-stop' | 'evict'>
+    reason?: string
+  } = { cause: 'user-stop' }
 ): Promise<void> {
   const session = context.sessions.get(sessionId)
   if (!session) {
     return
   }
-  // The obligation OUTLIVES the child. `hasProviderChild` is retired the instant the adapter
-  // proves the exit, so a step that aborts after that point would otherwise leave the retry
-  // reading "no child here" and skipping the settlement and the lease release it still owes.
-  const owesWindDown = owesProviderChildWindDown(session)
-  session.owesProviderChildWindDown = owesWindDown
+  // The obligation OUTLIVES the child. `child` is ended the instant the adapter proves the exit,
+  // so a step that aborts after that point would otherwise leave the retry reading "no child
+  // here" and skipping the settlement and the lease release it still owes.
+  const owed = owedProviderChildWindDown(session)
+  session.owesProviderChildWindDown = owed
+  const stopping = session.child
   let settlementError: unknown
   const eviction: StructuredAgentSessionEvictionContext = {
     sessionId,
     // The retry must not re-stop a child the adapter already proved gone, so this stays honest.
-    hasProviderChild: session.hasProviderChild,
-    owesProviderChildWindDown: owesWindDown,
+    hasProviderChild: stopping !== null,
+    owesProviderChildWindDown: owed !== undefined,
     eventSink: context.runtimeState.eventSinkFor(sessionId),
     adapter: context.deps.adapter,
     ...(context.restartWitness
       ? { beforeProviderChildStop: () => context.restartWitness?.beforeStop(sessionId) }
       : {}),
-    // Host state must not disagree with the adapter for the seven steps in between.
-    onProviderChildStopped: () => {
-      session.hasProviderChild = false
+    // Host state must not disagree with the adapter for the steps in between.
+    onProviderChildStopped: (verdict) => {
+      if (stopping) {
+        endProviderChild(session, {
+          generation: stopping.generation,
+          fence: stopping.fence,
+          cause: ending.cause,
+          reason: ending.reason ?? null,
+          duringStartup: stopping.phase === 'starting',
+          ...verdict
+        })
+      }
       context.restartWitness?.stopped(sessionId)
     },
-    forget: async () => {
-      await forgetStructuredAgentSession(context, sessionId)
-      context.deps.adapter.acknowledgeSessionRelease?.(sessionId)
-    },
+    acknowledgeRelease: () => context.deps.adapter.acknowledgeSessionRelease?.(sessionId),
     discardSink: () => context.runtimeState.discardEventSink(sessionId),
     settleWork: async () => {
+      const fence =
+        owed?.fence ?? structuredAgentSessionConversationFence(context.deps.store, sessionId)
       const settled = await settleStructuredAgentSessionDeadGeneration({
         journal: session.journal,
         sessionId,
-        fence: session.fence,
-        settlementId: `expected-close:${sessionId}:${session.fence}:${session.acquisitionGeneration ?? 'unknown'}`,
+        fence,
+        settlementId: `expected-close:${sessionId}:${fence}:${owed?.generation ?? 'unknown'}`,
         pendingSubmissionReason: 'provider_closed_before_acknowledgement',
         verdict: { state: 'interrupted', completedAt: context.now() },
         showUnexpectedExitOutcome: false,
@@ -114,20 +144,24 @@ export async function evictHeldStructuredAgentSession(
         }
       })
       if (!settled) {
-        // Without the cause the quit log names the step and nothing else.
+        // Without the cause the log names the step and nothing else.
         throw new Error('dead generation work settlement failed', { cause: settlementError })
       }
     },
     releaseLease: async () => {
-      await releaseStoredStructuredAgentSessionOwner({
-        store: context.deps.store,
-        sessionId,
-        hasProviderChild: owesWindDown,
-        expectedFence: session.fence,
-        now: context.now()
-      })
-      session.owesProviderChildWindDown = false
-      context.forgetStatus(sessionId)
+      if (owed) {
+        await releaseStoredStructuredAgentSessionOwner({
+          store: context.deps.store,
+          sessionId,
+          hasProviderChild: true,
+          expectedFence: owed.fence,
+          now: context.now()
+        })
+      }
+      session.owesProviderChildWindDown = undefined
+      // Whatever ended the child, the row belongs to the conversation: it shows not-running, and
+      // only the conversation's close forgets it.
+      context.publishStatus?.(sessionId)
     }
   }
   await evictStructuredAgentSession(
@@ -136,6 +170,41 @@ export async function evictHeldStructuredAgentSession(
   )
 }
 
+/** Whether the conversation's handle is only a cache now: no child, no wind-down owed, and nothing
+ *  queued or waiting on the provider. */
+export function structuredAgentSessionConversationClosable(
+  session: StructuredAgentSessionHostSession
+): boolean {
+  return (
+    owedProviderChildWindDown(session) === undefined &&
+    !session.journal.submissions().some(isQueuedAgentJournalSubmission) &&
+    session.journal.pendingSubmissions().length === 0
+  )
+}
+
+/**
+ * Drops the conversation's open handle. The entry leaves the map BEFORE the handle closes, so a
+ * lock-free reader sees an open handle or none — never one that is closing — and one arriving
+ * after the delete waits behind this step and reopens. Answers false, closing nothing, when the
+ * handle is still more than a cache.
+ */
+export async function closeStructuredAgentSessionConversationUnderSerialize(
+  context: Pick<StructuredAgentSessionLifetimeContext, 'sessions'> & {
+    /** The status row outlives the handle; see `StructuredAgentSessionClientDelivery`. */
+    closeStatus: (sessionId: string) => void
+  },
+  sessionId: string
+): Promise<boolean> {
+  const session = context.sessions.get(sessionId)
+  if (!session || !structuredAgentSessionConversationClosable(session)) {
+    return false
+  }
+  context.sessions.delete(sessionId)
+  context.closeStatus(sessionId)
+  await session.journal.close()
+  return true
+}
+
 /** Stops every provider child owned by this host while keeping failed evictions reachable. A
  *  session whose child is already stopped but whose wind-down aborted is still in scope — that is
  *  the retry. */
@@ -146,9 +215,9 @@ export async function evictOwnedStructuredAgentSessions(
   retainOnFailure: Set<string>
 ): Promise<void> {
   const ownedSessionIds = [...context.sessions]
-    .filter(([, session]) => owesProviderChildWindDown(session))
+    .filter(([, session]) => owedProviderChildWindDown(session) !== undefined)
     .map(([sessionId]) => sessionId)
-  // Retained up front and cleared only once an eviction settles: the quit phase is bounded, and a
+  // Retained up front and cleared only once a stop settles: the quit phase is bounded, and a
   // timeout leaves these still running. Closing their journals underneath them is the one outcome
   // the retain set exists to prevent.
   for (const sessionId of ownedSessionIds) {
@@ -159,7 +228,7 @@ export async function evictOwnedStructuredAgentSessions(
     ownedSessionIds.map(async (sessionId) => {
       try {
         await context.serialize(sessionId, () =>
-          evictHeldStructuredAgentSession(context, sessionId)
+          stopStructuredAgentSessionAgentUnderSerialize(context, sessionId)
         )
         retainOnFailure.delete(sessionId)
       } catch (error) {
@@ -171,47 +240,3 @@ export async function evictOwnedStructuredAgentSessions(
     throw new AggregateError(failures, 'structured agent-session child eviction failed')
   }
 }
-
-/** The holds resume through the host's own attach, inside the session's serialize: a hold's
- *  resume and a send's ensure-owner step are the same serialized attach with a different asker. */
-export function createStructuredAgentSessionHolds(
-  attachContext: () => StructuredAgentSessionAttachContext,
-  close: (sessionId: string) => Promise<void>
-): StructuredAgentSessionHolds {
-  const context = attachContext()
-  return new StructuredAgentSessionHolds({
-    resume: (sessionId, attachOptions) =>
-      resumeHeldStructuredAgentSession({
-        sessionId,
-        context: attachContext(),
-        callerKey: attachOptions?.admitRecoveryTicket
-          ? 'trusted-local:provider-exit-recovery'
-          : 'trusted-local:surface-hold',
-        ...(attachOptions ? { attachOptions } : {})
-      }),
-    // Tracked from enqueue: a quit drains a queued resume before it evicts, so no child is
-    // spawned behind the eviction and orphaned.
-    serialize: (sessionId, task) => {
-      const current = attachContext()
-      return current.tasks.trackAttach(current.serialize(sessionId, task))
-    },
-    evict: close,
-    hasProviderChild: (sessionId) => hasProviderChild(context, sessionId),
-    // A send pending while the child is still starting is held for that start; evicting would
-    // refuse it. Any other pending send may wait on an echo that never comes, so eviction retires it.
-    // Subagents, commands and monitors outlive the lead's turn inside the child, so the live roster
-    // the sidebar shows as working is owed too; stopping the child would end them silently.
-    hasOwedWork: (sessionId) => {
-      const session = context.sessions.get(sessionId)
-      return session
-        ? activeStructuredAgentSessionTurnId(session.journal.snapshot().items) !== null ||
-            (session.providerChildPhase === 'starting' &&
-              session.journal.pendingSubmissions().length > 0) ||
-            agentChildWorkLiveness(context.deps.adapter.backgroundTaskState?.(sessionId)?.tasks) !==
-              null
-        : false
-    },
-    onError: (error) => context.deps.onEventSinkError?.(error),
-    ...(context.deps.releaseGraceMs === undefined ? {} : { graceMs: context.deps.releaseGraceMs })
-  })
-}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-mutations.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-mutations.ts
index 364f1e7c0dd..2a4e282ec23 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-mutations.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-mutations.ts
@@ -1,10 +1,11 @@
-// Everything a client can ask an ATTACHED session to do: send a turn, cancel one, answer a prompt,
-// change an option, read the options back.
+// Everything a client can ask a session to do: send a turn, cancel one, answer a prompt, change an
+// option, read the options back.
 //
 // They share one shape — admit the envelope against the lease, run a plan, publish the journal — so
-// they share one path here rather than five copies in the host. The host keeps attach, holds and
-// teardown. A send is the one mutation that may need those first: it makes sure the session has
-// an owner as a step of its own serialized admission, see `structured-agent-session-send-preparation`.
+// they share one path here rather than five copies in the host. The host keeps attach and teardown.
+// Each opens the conversation first. A send, a Stop and an option pick are conversation writes,
+// admitted without the writer lease; the delivery loop starts the provider child a send needs, and
+// an operation only the provider can perform starts it before admission.
 
 import type {
   AgentJournalItemIdentity,
@@ -15,20 +16,30 @@ import type {
   AgentSessionMutationEnvelope,
   AgentSessionMutationResult,
   AgentSessionOptionResult,
-  AgentSessionOptionsResult,
   AgentSessionPromptResult,
   AgentSessionSendResult,
   AgentSessionThreadGoalChange,
   AgentSessionThreadGoalResult
 } from '../../../shared/agent-session-wire'
-import type { StructuredAgentSessionHolds } from './structured-agent-session-holds'
+import { isStructuredAgentSessionMainAgentWorking } from '../../../shared/structured-agent-session-main-agent-working'
+import {
+  agentSessionFailureWords,
+  type AgentJournalDispatchRejection
+} from '../../../shared/agent-session-failure-words'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import type { AgentSessionPromptRequest } from './structured-agent-session-turns-prompt'
 import { threadGoalPlan } from './structured-agent-session-thread-goal'
+import { structuredAgentSessionConversationFence } from './structured-agent-session-provider-child'
 import {
   admitAndRunAgentSessionMutation,
-  type AgentSessionMutationRequest
+  type AgentSessionMutationRequest,
+  type AgentSessionMutationSessionPreparation
 } from './structured-agent-session-mutation-admission'
 import {
-  prepareStructuredAgentSessionSend,
+  openForWrite,
+  openWithAgent,
+  sendPreparation,
+  structuredAgentSessionFailureWordsContext,
   structuredAgentSessionSendBlock
 } from './structured-agent-session-send-preparation'
 import {
@@ -38,28 +49,43 @@ import {
   setOptionPlan,
   type MutationPlan
 } from './structured-agent-session-mutation-plans'
+import { runQueueableStructuredAgentSessionSend } from './structured-agent-session-queued-send'
+import { runStopWithQueuePause } from './structured-agent-session-queued-stop'
 import type {
   StructuredAgentSessionCaller,
   StructuredAgentSessionHostDeps,
   StructuredAgentSessionHostSession
 } from './structured-agent-session-host-types'
+import {
+  readStructuredAgentSessionOptions,
+  recordStructuredAgentSessionOptionIntent
+} from './structured-agent-session-options-read'
 
 export type StructuredAgentSessionMutationContext = {
   deps: StructuredAgentSessionHostDeps
   sessions: Map<string, StructuredAgentSessionHostSession>
   publish: (sessionId: string, journal: StructuredAgentSessionHostSession['journal']) => void
   flushStreamedEvents: (sessionId: string) => Promise<void>
-  requireSession: (sessionId: string) => StructuredAgentSessionHostSession
+  /** The host's accessor, for a caller outside the session's serialize. */
+  conversation: (sessionId: string) => Promise<StructuredAgentSessionHostSession>
   serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
-  /** A send that finds the owner gone brings it back through here, inside its own serialize. */
-  holds: Pick<StructuredAgentSessionHolds, 'ensureProviderChild'>
-  /** Makes a closed session's journal readable again, inside the caller's serialize, for a send
-   *  the ledger answers without an owner. */
-  restoreReadable: (sessionId: string) => Promise<boolean>
+  /** The session's conversation, opened when closed; inside the caller's serialize. */
+  openConversation: (sessionId: string) => Promise<StructuredAgentSessionHostSession | null>
+  /** Gives the session a provider child; inside the caller's serialize. */
+  ensureAgent: (sessionId: string) => Promise<AgentSessionMutationSessionPreparation>
+  /** A message was accepted: the session's delivery loop hands it over. */
+  wakeDelivery: (sessionId: string) => void
+  /** Stops the session's provider child, keeping its conversation; inside the caller's serialize. */
+  stopAgent: (sessionId: string) => Promise<void>
+  /** Only for gate inputs living in the RECORD store, which can settle with no
+   *  journal commit (a conversation command). Draft-table changes need no call:
+   *  the draft store notifies through the journal's own commit listener. */
+  wakeQueuedDrain?: (sessionId: string) => void
   now: () => number
 }
 
-function mutate<TValue>(
+/** Admits the envelope and runs the plan inside the session's serialize. */
+export function mutateStructuredAgentSession<TValue>(
   context: StructuredAgentSessionMutationContext,
   caller: StructuredAgentSessionCaller,
   envelope: AgentSessionMutationEnvelope,
@@ -77,7 +103,7 @@ function mutate<TValue>(
       prepareSession,
       publish: (journal) => context.publish(envelope.sessionId, journal),
       flushStreamedEvents: context.flushStreamedEvents,
-      providerChildPhase: () => context.sessions.get(envelope.sessionId)?.providerChildPhase,
+      providerChildPhase: () => context.sessions.get(envelope.sessionId)?.child?.phase,
       now: () => context.now()
     })
   )
@@ -90,22 +116,34 @@ export function sendStructuredAgentSessionTurn(
     envelope: AgentSessionMutationEnvelope
     body: AgentJournalMessageItem
     retryUnknown?: true
+    delivery?: 'queue-if-active'
+    /** Host-local, set only by the client-facing `agentSession.send` RPC (the
+     *  renderer's launch prompt included): recorded as the submission's `client`
+     *  origin, whose started turn ends a Stop's or a restart's queue pause.
+     *  Orchestration mail, a restart continuation and `agent.launch`'s host-sent
+     *  prompt never set it. */
+    userSend?: true
     beforeRun?: () => void
   }
 ): Promise<AgentSessionMutationResult<AgentSessionSendResult>> {
   const plan = sendPlan(params)
-  return mutate(
+  return mutateStructuredAgentSession(
     context,
     caller,
     params.envelope,
     {
       ...plan,
-      run: (ctx) => {
-        const blocked = structuredAgentSessionSendBlock(context.deps.store.getRecord(ctx.sessionId))
-        return blocked ? Promise.resolve(blocked) : plan.run(ctx)
-      }
+      run: (ctx) =>
+        runQueueableStructuredAgentSessionSend(
+          context,
+          ctx,
+          params,
+          async () =>
+            structuredAgentSessionSendBlock(context.deps.store.getRecord(ctx.sessionId)) ??
+            (await plan.run(ctx))
+        )
     },
-    (ledger, record) => prepareStructuredAgentSessionSend(context, params.envelope, ledger, record)
+    sendPreparation(context, params.envelope)
   )
 }
 
@@ -114,37 +152,88 @@ export function cancelStructuredAgentSessionTurn(
   caller: StructuredAgentSessionCaller,
   params: {
     envelope: AgentSessionMutationEnvelope
-    turnId: string
+    turnId?: string
     scope?: 'background-tasks'
     taskId?: string
     prompt?: { itemId: string; expectedRevision: number }
   }
 ): Promise<AgentSessionMutationResult<AgentSessionCancelResult>> {
-  const command = context.deps.store.getRecord(params.envelope.sessionId)?.conversationCommand
-  // Interrupts must reach a provider while the command awaits its terminal frame.
-  const cancellationContext =
-    command?.command === 'compact' && command.phase === 'prepared'
-      ? {
-          ...context,
-          serialize: <T>(sessionId: string, task: () => Promise<T>) =>
-            context.serialize(`compact-cancel:${sessionId}`, task)
-        }
-      : context
-  return mutate(cancellationContext, caller, params.envelope, cancelPlan(params))
+  if (params.scope || params.prompt) {
+    return mutateStructuredAgentSession(
+      context,
+      caller,
+      params.envelope,
+      cancelPlan(params),
+      openForWrite(context, params.envelope)
+    )
+  }
+  const plan = cancelPlan({
+    ...params,
+    stopChild: () => context.stopAgent(params.envelope.sessionId)
+  })
+  return mutateStructuredAgentSession(
+    context,
+    caller,
+    params.envelope,
+    {
+      ...plan,
+      // Stop's queue step, the same for every client: once the Stop takes effect
+      // the queue is paused. The cards stay published; nothing is withdrawn and no
+      // text ever rides the answer.
+      run: (ctx) =>
+        runStopWithQueuePause(ctx, async (tookEffect) => {
+          // Stop withdraws every queued SUBMISSION first, whatever the start or the child is doing.
+          const withdrawn = await ctx.journal.rejectQueuedSubmissions(
+            ctx.fence,
+            agentSessionFailureWords(agentSessionFailureFact('cancelled'), { surface: 'rejection' })
+          )
+          const named = params.turnId !== undefined ? { turnId: params.turnId } : {}
+          const child = context.sessions.get(ctx.sessionId)?.child
+          if (child?.phase === 'starting') {
+            // A start that may never land is the one thing here Stop has to end; the chat stays.
+            await tookEffect()
+            await context.stopAgent(ctx.sessionId)
+            return { ok: true, value: { ...named, cancelled: true } }
+          }
+          // A Stop naming no turn ends nothing more unless the session reads working, by the rule
+          // every session list and the chat's own Stop read it.
+          const inFlight =
+            params.turnId !== undefined ||
+            isStructuredAgentSessionMainAgentWorking(
+              ctx.journal.activeTurnId(),
+              ctx.journal.submissions(),
+              ctx.fence
+            )
+          const record = context.deps.store.getRecord(ctx.sessionId)
+          if (!child || !inFlight) {
+            if (withdrawn.length > 0) {
+              await tookEffect()
+            }
+            return { ok: true, value: { ...named, cancelled: withdrawn.length > 0 } }
+          }
+          await tookEffect()
+          return plan.run({
+            ...ctx,
+            failureTextContext: structuredAgentSessionFailureWordsContext(record)
+          })
+        })
+    },
+    openForWrite(context, params.envelope)
+  )
 }
 
 export function respondToStructuredAgentSessionPrompt(
   context: StructuredAgentSessionMutationContext,
   caller: StructuredAgentSessionCaller,
-  params: {
-    envelope: AgentSessionMutationEnvelope
-    kind: 'approval' | 'question'
-    itemId: string
-    expectedRevision: number
-    optionId: string
-  }
+  params: AgentSessionPromptRequest & { envelope: AgentSessionMutationEnvelope }
 ): Promise<AgentSessionMutationResult<AgentSessionPromptResult>> {
-  return mutate(context, caller, params.envelope, promptPlan(params))
+  return mutateStructuredAgentSession(
+    context,
+    caller,
+    params.envelope,
+    promptPlan(params),
+    openForWrite(context, params.envelope)
+  )
 }
 
 export async function setStructuredAgentSessionOption(
@@ -154,7 +243,26 @@ export async function setStructuredAgentSessionOption(
 ): Promise<AgentSessionMutationResult<AgentSessionOptionResult>> {
   // Outside the queue: a pick made while the provider starts then queues behind what its start persists.
   await context.deps.adapter.awaitOptionWritable?.(params.envelope.sessionId)
-  return mutate(context, caller, params.envelope, setOptionPlan(params))
+  const plan = setOptionPlan(params)
+  const atRest = () => !context.sessions.get(params.envelope.sessionId)?.child
+  return mutateStructuredAgentSession(
+    context,
+    caller,
+    params.envelope,
+    {
+      ...plan,
+      // Read as the call is admitted: with no child running, the pick is a conversation write —
+      // intent the next start replays. A running child's pick is still its owner's to make.
+      get conversationWrite() {
+        return atRest() ? (true as const) : undefined
+      },
+      run: (ctx) =>
+        atRest()
+          ? recordStructuredAgentSessionOptionIntent(context.deps.store, ctx, params)
+          : plan.run(ctx)
+    },
+    openForWrite(context, params.envelope)
+  )
 }
 
 export function changeStructuredAgentSessionThreadGoal(
@@ -162,38 +270,13 @@ export function changeStructuredAgentSessionThreadGoal(
   caller: StructuredAgentSessionCaller,
   params: { envelope: AgentSessionMutationEnvelope; change: AgentSessionThreadGoalChange }
 ): Promise<AgentSessionMutationResult<AgentSessionThreadGoalResult>> {
-  return mutate(context, caller, params.envelope, threadGoalPlan(params))
-}
-
-export function readStructuredAgentSessionOptions(
-  context: StructuredAgentSessionMutationContext,
-  sessionId: string
-): Promise<AgentSessionOptionsResult> {
-  return context.serialize(sessionId, async () => {
-    const session = context.requireSession(sessionId)
-    if (!context.deps.adapter.readOptions) {
-      throw new Error('structured_agent_session_options_unsupported')
-    }
-    const options = await context.deps.adapter.readOptions({ sessionId, fence: session.fence })
-    return {
-      ...options,
-      rewind:
-        context.deps.store.getRecord(sessionId)?.rewind?.phase === 'prepared' ||
-        context.deps.store.getRecord(sessionId)?.rewind?.phase === 'provider-succeeded'
-          ? { supported: false, reason: 'outcome-unknown' }
-          : (context.deps.adapter.rewindSupport?.(sessionId) ?? {
-              supported: false,
-              reason: 'unsupported'
-            }),
-      conversationCommands: context.deps.adapter.compact ? ['clear', 'compact'] : ['clear'],
-      ...(context.deps.adapter.supportsThreadGoal?.(sessionId)
-        ? { threadGoal: { current: session.journal.threadGoal() } }
-        : {}),
-      ...(context.deps.adapter.recordsContextUsage?.(sessionId)
-        ? { contextUsage: { current: session.journal.contextUsage() } }
-        : {})
-    }
-  })
+  return mutateStructuredAgentSession(
+    context,
+    caller,
+    params.envelope,
+    threadGoalPlan(params),
+    openWithAgent(context, params.envelope)
+  )
 }
 
 /** Settle provider-proven delivery independently of an in-flight client mutation. */
@@ -202,12 +285,16 @@ export async function settleStructuredAgentSessionLateDispatch(
   input: {
     sessionId: string
     clientMessageId: string
-  } & ({ providerIdentity: AgentJournalItemIdentity } | { state: 'rejected'; reason: string })
+  } & (
+    | { providerIdentity: AgentJournalItemIdentity }
+    | ({ state: 'rejected' } & AgentJournalDispatchRejection)
+  )
 ): Promise<void> {
   const session = context.sessions.get(input.sessionId)
   if (!session) {
     return
   }
+  const fence = structuredAgentSessionConversationFence(context.deps.store, input.sessionId)
   // The journal queue drains before close; the host queue would defer this past teardown.
   await session.journal.resolveDispatch(
     'providerIdentity' in input
@@ -215,55 +302,16 @@ export async function settleStructuredAgentSessionLateDispatch(
           clientMessageId: input.clientMessageId,
           state: 'accepted',
           providerIdentity: input.providerIdentity,
-          fence: session.fence
+          fence
         }
       : {
           clientMessageId: input.clientMessageId,
           state: 'rejected',
           reason: input.reason,
-          fence: session.fence
+          rejection: input.rejection,
+          fence
         }
   )
-  context.publish(input.sessionId, session.journal)
-}
-
-/**
- * Releases sends the provider can no longer be holding.
- *
- * A dispatch whose RPC timed out is recorded `unknown` — doubt, never proof of
- * non-delivery — and a live `unknown` reads as work still owed, so the session
- * shows working until something re-derives it. The provider reporting its thread
- * not running, with no turn open, IS that re-derivation.
- *
- * `pending` is deliberately untouched: that send's dispatch has not returned yet
- * and may be in flight right now. And `recovered` only retires the obligation —
- * it never makes a send re-deliverable, because the provider may well have run it.
- */
-export async function releaseStructuredAgentSessionUnansweredDispatches(
-  context: Pick<StructuredAgentSessionMutationContext, 'sessions' | 'publish'>,
-  input: { sessionId: string; reason: string }
-): Promise<void> {
-  const session = context.sessions.get(input.sessionId)
-  if (!session) {
-    return
-  }
-  const stranded = session.journal
-    .submissions()
-    .filter((entry) => entry.dispatchState === 'unknown' && entry.recovered !== true)
-  if (stranded.length === 0) {
-    return
-  }
-  for (const entry of stranded) {
-    await session.journal.resolveDispatch({
-      clientMessageId: entry.clientMessageId,
-      state: 'unknown',
-      // The earlier reason names a sharper fact than this one does.
-      reason: entry.reason ?? input.reason,
-      fence: session.fence,
-      recovered: true
-    })
-  }
-  context.publish(input.sessionId, session.journal)
 }
 
 /** The host's thin mutation surface. Each call re-reads the context, so a session
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-runtime-state.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-runtime-state.ts
index 39fe7c3fc22..63f37a37590 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-runtime-state.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-runtime-state.ts
@@ -34,8 +34,9 @@ export class StructuredAgentSessionHostRuntimeState {
     this.leaseRenewer.start()
   }
 
-  stopLeaseRenewal(): void {
-    this.leaseRenewer.stop()
+  /** Resolves once a renewal tick already in flight has finished writing. */
+  stopLeaseRenewal(): Promise<void> {
+    return this.leaseRenewer.stop()
   }
 
   /** The sink the session's current child writes through, created on first use. */
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-tabs.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-tabs.ts
index 3bd6e46b98e..8a18040daf3 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-tabs.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-tabs.ts
@@ -9,19 +9,26 @@ import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 export function setStructuredAgentSessionTabVisibility(
   host: {
     deps: {
-      store: { setSessionTabVisibility: (sessionId: string, visible: boolean) => Promise<void> }
+      store: {
+        setSessionTabVisibility: (
+          sessionId: string,
+          visible: boolean,
+          tabId?: string
+        ) => Promise<void>
+      }
     }
     restartResume: { dismiss: (sessionIds: readonly string[]) => Promise<number> }
   },
   sessionId: string,
-  visible: boolean
+  visible: boolean,
+  tabId?: string
 ): Promise<void> {
   if (!visible) {
     void host.restartResume.dismiss([sessionId]).catch(() => {
       console.warn('[structured-agent-session] forgetting recovery records on chat close failed')
     })
   }
-  return host.deps.store.setSessionTabVisibility(sessionId, visible)
+  return host.deps.store.setSessionTabVisibility(sessionId, visible, tabId)
 }
 
 export type StructuredAgentSessionTab = {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.test.ts
index d04e17d2d26..aa8692a0c73 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.test.ts
@@ -1,11 +1,25 @@
 import { describe, expect, it, vi } from 'vitest'
-import { structuredAgentSessionHostTeardownPhases } from './structured-agent-session-host-teardown'
+import { WILL_QUIT_TEARDOWN_DEADLINE_MS } from '../../../shared/quit-teardown-deadline'
+import {
+  GRACEFUL_EXIT_MS as CLAUDE_WINDOWS_GRACEFUL_EXIT_MS,
+  SUPERVISED_GRACEFUL_EXIT_MS
+} from '../../claude/claude-child-exit-proof-ladder'
+import { GRACEFUL_EXIT_MS as CODEX_WINDOWS_GRACEFUL_EXIT_MS } from '../../codex/codex-app-server-connection'
+import { PROVIDER_SUPERVISOR_MAX_STOP_MS } from '../../codex/codex-app-server-posix-supervisor'
+import { SNAPSHOT_DRAIN_TIMEOUT_MS } from './structured-agent-session-eviction'
+import {
+  CHILD_EVICTION_TIMEOUT_MS,
+  EVICTION_MARGIN_MS,
+  RESUME_MARKER_RECORD_TIMEOUT_MS,
+  structuredAgentSessionHostTeardownPhases
+} from './structured-agent-session-host-teardown'
+
+const noop = async (): Promise<void> => undefined
 
 describe('structured agent-session host teardown', () => {
   it('names every phase, so the quit-path order is pinned rather than incidental', () => {
-    const noop = async (): Promise<void> => undefined
     const phases = structuredAgentSessionHostTeardownPhases({
-      holds: { dispose: noop },
+      idleSweep: { dispose: noop },
       runtimeState: { stopLeaseRenewal: () => undefined, flushAllEventSinks: noop },
       tasks: { drainAttaches: noop },
       evictOwnedSessions: noop,
@@ -14,7 +28,7 @@ describe('structured agent-session host teardown', () => {
     })
     expect(phases.map((phase) => phase.name)).toEqual([
       'begin-resume-markers',
-      'dispose-holds',
+      'dispose-idle-sweep',
       'stop-lease-renewal',
       'drain-attaches',
       'evict-owned-sessions',
@@ -23,6 +37,53 @@ describe('structured agent-session host teardown', () => {
     ])
   })
 
+  it("derives quit's child-eviction bound from every provider's supervised close", () => {
+    // Eviction drains the sink for the resume offer before it stops the child, inside one bound.
+    // Each close's tree-kill fallback is deliberately outside it: once main exits the supervisor
+    // stops its group itself, and next launch's recovery settles the lease.
+    const closes = {
+      claude: SUPERVISED_GRACEFUL_EXIT_MS,
+      codex: PROVIDER_SUPERVISOR_MAX_STOP_MS,
+      // No supervisor on Windows, so its closes wait less than any supervised one.
+      claudeWindows: CLAUDE_WINDOWS_GRACEFUL_EXIT_MS,
+      codexWindows: CODEX_WINDOWS_GRACEFUL_EXIT_MS
+    }
+    for (const closeMs of Object.values(closes)) {
+      expect(SNAPSHOT_DRAIN_TIMEOUT_MS + closeMs + EVICTION_MARGIN_MS).toBeLessThanOrEqual(
+        CHILD_EVICTION_TIMEOUT_MS
+      )
+    }
+    // The resume markers recorded after eviction still fit under quit's global deadline.
+    expect(CHILD_EVICTION_TIMEOUT_MS + RESUME_MARKER_RECORD_TIMEOUT_MS).toBeLessThan(
+      WILL_QUIT_TEARDOWN_DEADLINE_MS
+    )
+  })
+
+  it('ends child eviction as soon as every chat has closed, not at its bound', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const evict = structuredAgentSessionHostTeardownPhases({
+      idleSweep: { dispose: noop },
+      runtimeState: { stopLeaseRenewal: () => undefined, flushAllEventSinks: noop },
+      tasks: { drainAttaches: noop },
+      evictOwnedSessions: noop,
+      beginResumeMarkers: () => {},
+      recordResumeMarkers: noop
+    }).find((phase) => phase.name === 'evict-owned-sessions')
+    try {
+      let finished = false
+      const run = Promise.resolve(evict?.run()).then(() => {
+        finished = true
+      })
+      // No timer advances: the phase settles with the eviction, not at CHILD_EVICTION_TIMEOUT_MS.
+      await vi.advanceTimersByTimeAsync(0)
+      expect(finished).toBe(true)
+      await run
+      expect(vi.getTimerCount()).toBe(0)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
   it('bounds stalled recovery publication without preventing later cleanup', async () => {
     vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
     const warning = vi.spyOn(console, 'warn').mockImplementation(() => {})
@@ -30,7 +91,7 @@ describe('structured agent-session host teardown', () => {
     const cleaned = vi.fn(async () => {})
     const flush = vi.fn(async () => cleaned())
     const phases = structuredAgentSessionHostTeardownPhases({
-      holds: { dispose: cleaned },
+      idleSweep: { dispose: cleaned },
       runtimeState: { stopLeaseRenewal: () => {}, flushAllEventSinks: flush },
       tasks: { drainAttaches: cleaned },
       evictOwnedSessions: cleaned,
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.ts
index 6b1693c3dca..bc9a48c5dac 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.ts
@@ -7,8 +7,12 @@
 // nothing can ever close them.
 
 import type { AgentSessionResumeTrigger } from '../../../shared/agent-session-resume-marker'
+import { SUPERVISED_GRACEFUL_EXIT_MS } from '../../claude/claude-child-exit-proof-ladder'
+import { PROVIDER_SUPERVISOR_MAX_STOP_MS } from '../../codex/codex-app-server-posix-supervisor'
+import { SNAPSHOT_DRAIN_TIMEOUT_MS } from './structured-agent-session-eviction'
 import type { StructuredAgentSessionRestartResume } from './structured-agent-session-restart-resume-host'
 import {
+  abandonQueuedStructuredAgentSessionMessages,
   evictOwnedStructuredAgentSessions,
   type StructuredAgentSessionLifetimeContext
 } from './structured-agent-session-host-lifetime'
@@ -22,12 +26,20 @@ export type StructuredAgentSessionTeardownPhase = {
 }
 
 /** Advisory persistence must not hold shutdown open. */
-const RESUME_MARKER_RECORD_TIMEOUT_MS = 2_000
+export const RESUME_MARKER_RECORD_TIMEOUT_MS = 2_000
 
-/** Eight steps at ten seconds each would outlast the global quit deadline, and a quit that dies
- *  mid-eviction leaves the lease unreleased — the exact state restart has to clean up. Bounded
- *  well below that deadline so the phases after this one still get to run. */
-const CHILD_EVICTION_TIMEOUT_MS = 8_000
+/** Covers a provider's stop observed late on a loaded host. */
+export const EVICTION_MARGIN_MS = 1_000
+
+/** A quit that dies mid-eviction leaves the lease unreleased — the exact state restart has to
+ *  clean up — so this covers the sink drain plus the longest supervised provider close, well below
+ *  the global quit deadline so later phases still run. A close's tree-kill fallback is outside it:
+ *  once main exits the supervisor stops its group itself, and next launch's recovery settles the
+ *  lease. Windows closes have no supervisor and wait less. */
+export const CHILD_EVICTION_TIMEOUT_MS =
+  SNAPSHOT_DRAIN_TIMEOUT_MS +
+  Math.max(SUPERVISED_GRACEFUL_EXIT_MS, PROVIDER_SUPERVISOR_MAX_STOP_MS) +
+  EVICTION_MARGIN_MS
 
 /** Bounds a phase without swallowing its failure, which `withTimeout` alone would. */
 async function withPhaseTimeout(run: () => Promise<void>, timeoutMs: number): Promise<void> {
@@ -46,9 +58,9 @@ async function withPhaseTimeout(run: () => Promise<void>, timeoutMs: number): Pr
 
 /** The quit-path phase order, which is load-bearing rather than incidental. */
 export function structuredAgentSessionHostTeardownPhases(collaborators: {
-  holds: { dispose: () => Promise<void> | void }
+  idleSweep: { dispose: () => Promise<void> | void }
   runtimeState: {
-    stopLeaseRenewal: () => void
+    stopLeaseRenewal: () => Promise<void> | void
     flushAllEventSinks: () => Promise<void>
   }
   tasks: { drainAttaches: () => Promise<void> }
@@ -68,7 +80,7 @@ export function structuredAgentSessionHostTeardownPhases(collaborators: {
         }
       }
     },
-    { name: 'dispose-holds', run: () => collaborators.holds.dispose() },
+    { name: 'dispose-idle-sweep', run: () => collaborators.idleSweep.dispose() },
     { name: 'stop-lease-renewal', run: () => collaborators.runtimeState.stopLeaseRenewal() },
     { name: 'drain-attaches', run: () => collaborators.tasks.drainAttaches() },
     {
@@ -93,6 +105,8 @@ export async function tearDownStructuredAgentSessionHost(input: {
   sessions: Map<string, StructuredAgentSessionHostSession>
   retainSessionIds?: ReadonlySet<string>
   acknowledgeSessionRelease?: (sessionId: string) => void
+  /** Quit closes every conversation, so it settles what they still queue as a close does. */
+  abandonQueued?: (sessionId: string, session: StructuredAgentSessionHostSession) => Promise<void>
 }): Promise<void> {
   const failures: unknown[] = []
   for (const phase of input.phases) {
@@ -107,7 +121,12 @@ export async function tearDownStructuredAgentSessionHost(input: {
     ([sessionId]) => !input.retainSessionIds?.has(sessionId)
   )
   // `allSettled`, so one rejected close cannot skip the others.
-  const closed = await Promise.allSettled(entries.map(([, session]) => session.journal.close()))
+  const closed = await Promise.allSettled(
+    entries.map(async ([sessionId, session]) => {
+      await input.abandonQueued?.(sessionId, session)
+      await session.journal.close()
+    })
+  )
   closed.forEach((result, index) => {
     const sessionId = entries[index]?.[0]
     if (result.status === 'fulfilled') {
@@ -133,7 +152,7 @@ export async function tearDownStructuredAgentSessionHost(input: {
 
 export async function flushStructuredAgentSessionHost(
   context: StructuredAgentSessionLifetimeContext &
-    Pick<Parameters<typeof structuredAgentSessionHostTeardownPhases>[0], 'holds' | 'tasks'> & {
+    Pick<Parameters<typeof structuredAgentSessionHostTeardownPhases>[0], 'idleSweep' | 'tasks'> & {
       restartResume: StructuredAgentSessionRestartResume
       serialize: (sessionId: string, task: () => Promise<void>) => Promise<void>
       trigger: AgentSessionResumeTrigger
@@ -160,6 +179,8 @@ export async function flushStructuredAgentSessionHost(
     sessions: context.sessions,
     retainSessionIds,
     acknowledgeSessionRelease: (sessionId) =>
-      context.deps.adapter.acknowledgeSessionRelease?.(sessionId)
+      context.deps.adapter.acknowledgeSessionRelease?.(sessionId),
+    abandonQueued: (sessionId, session) =>
+      abandonQueuedStructuredAgentSessionMessages(context.deps, sessionId, session.journal)
   })
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-abandon.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-abandon.test.ts
new file mode 100644
index 00000000000..b069fecd1bb
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-abandon.test.ts
@@ -0,0 +1,123 @@
+// The helper is what the restart specs remove their temp directory behind, so what it waits for is
+// load-bearing: a store commit that lands afterwards re-creates the directory it just removed.
+
+import { existsSync } from 'node:fs'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import { abandonStructuredAgentSessionHost } from './structured-agent-session-host-test-abandon'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestMessage
+} from './structured-agent-session-host-test-data'
+
+const CALLER = { callerKey: 'client-1' }
+
+describe('abandoning a structured agent-session host', () => {
+  it('waits for the restart the delivery loop woke for an accepted send', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-abandon-'))
+    const store = await AgentSessionRecordStore.open({
+      directory: join(root, 'store'),
+      hostId: 'local'
+    })
+    // Holds the restart inside its provider acquisition, so the point teardown must not run past
+    // is exact rather than a timing window.
+    let gate: Promise<void> | null = null
+    let openGate = (): void => {}
+    let reportEntered = (): void => {}
+    const entered = new Promise<void>((resolve) => {
+      reportEntered = resolve
+    })
+    const adapter: StructuredAgentSessionAdapter = {
+      acquire: async ({ fence }) => {
+        if (gate) {
+          reportEntered()
+          await gate
+        }
+        return {
+          process: {
+            hostId: 'local',
+            pid: 4242,
+            processStartTimeMs: NOW - 1_000,
+            spawnToken: store.getRecord(SESSION)?.lease.reservedSpawnToken ?? 'spawn-a'
+          },
+          link: {
+            linkId: `link-${fence}`,
+            handle: { provider: 'codex', threadId: THREAD },
+            origin: 'created',
+            mintedAtFence: fence,
+            observedAt: NOW
+          }
+        }
+      },
+      dispatch: async () => ({
+        state: 'accepted',
+        providerIdentity: { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 1 }
+      }),
+      cancelTurn: async () => ({ cancelled: true }),
+      answerPrompt: async () => undefined,
+      releaseAcquisition: async () => true,
+      setOption: async () => undefined
+    }
+    const host = new StructuredAgentSessionHost({
+      store,
+      adapter,
+      probeOwner: async () => ({
+        outcome: 'identity-matched',
+        matchedOn: ['process-start-time']
+      }),
+      journalRoot: root,
+      claimKeyId: 'key-1',
+      mintSpawnToken: () => 'spawn-a',
+      now: () => NOW
+    })
+    expect(await host.attach(CALLER, hostTestAttachParams(null))).toMatchObject({ ok: true })
+    // The conversation stays and its provider child does not, so the next send makes the delivery
+    // loop start one — the shape the refusal-oracle spec ends on.
+    await host.close(SESSION)
+    gate = new Promise<void>((resolve) => {
+      openGate = resolve
+    })
+
+    const body = hostTestMessage('delivery loop')
+    expect(
+      await host.send(CALLER, {
+        envelope: {
+          sessionId: SESSION,
+          clientOperationId: `${NOW}-000000000000000000000000000003e9`,
+          expectedRuntimeFence: store.getRecord(SESSION)?.lease.runtimeFence ?? 1,
+          payloadFingerprint: computeAgentSessionPayloadFingerprint({
+            method: 'agentSession.send',
+            sessionId: SESSION,
+            fields: { body }
+          })
+        },
+        body
+      })
+    ).toMatchObject({ ok: true })
+    await entered
+
+    let abandoned = false
+    const abandoning = abandonStructuredAgentSessionHost(host).then(() => {
+      abandoned = true
+    })
+    await new Promise((resolve) => setTimeout(resolve, 20))
+    expect(abandoned).toBe(false)
+
+    openGate()
+    await abandoning
+
+    // Nothing is left to put the directory back after this returns.
+    await rm(root, { recursive: true })
+    await new Promise((resolve) => setTimeout(resolve, 200))
+    expect(existsSync(root)).toBe(false)
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-abandon.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-abandon.ts
new file mode 100644
index 00000000000..a4069875bad
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-abandon.ts
@@ -0,0 +1,25 @@
+// What a host that VANISHES without a clean quit has to release, for the tests that model one.
+//
+// Deliberately not the quit path: quit evicts provider children and releases leases, and that is
+// the state a restart test is checking gets re-derived from disk. It stops short of ownership.
+//
+// What it cannot skip is work already in flight, which is what every copy of this helper used to
+// get wrong. Two producers reach the session store after the last awaited call has returned — a
+// lease-renewal tick, and the restart the delivery loop wakes for an accepted send — and the store
+// re-creates its own directory before every commit. A commit landing after the test removed its
+// temp directory therefore puts that directory back, and the removal fails with ENOTEMPTY. Quit
+// waits for both, in its `stop-lease-renewal` and `drain-attaches` phases; so does this.
+
+import type { StructuredAgentSessionHost } from './structured-agent-session-host'
+
+export async function abandonStructuredAgentSessionHost(
+  host: StructuredAgentSessionHost
+): Promise<void> {
+  // First, so the drain below cannot race the loop into enqueueing another step.
+  host['conversationDelivery'].dispose()
+  host['lifetime'].dispose()
+  await host['runtimeState'].stopLeaseRenewal()
+  await host['tasks'].drainAttaches()
+  await Promise.all([...host['sessions'].values()].map((session) => session.journal.close()))
+  host['sessions'].clear()
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-data.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-data.ts
index 69e6d029d60..959a02919a2 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-data.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-data.ts
@@ -1,6 +1,12 @@
-import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
+import type {
+  AgentJournalMessageItem,
+  AgentJournalSnapshot
+} from '../../../shared/agent-session-journal-types'
 import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
 import type { AgentSessionExecutionLocation } from '../../../shared/agent-session-record'
+import { projectNativeChatTranscriptMessages } from '../../../shared/native-chat-transcript-projection'
+import { projectStructuredAgentSessionMessages } from '../../../shared/structured-agent-session-message-projection'
+import { createStructuredAgentSessionOutboxEntry } from '../../../shared/structured-agent-session-outbox'
 import { attachFingerprintFields } from './structured-agent-session-attach'
 import type { AgentSessionAttachParams } from './structured-agent-session-attach'
 
@@ -61,3 +67,23 @@ export function hostTestAttachParams(
     }
   }
 }
+
+/** The row ids a chat draws from `snapshot`, top to bottom, while its composer still holds `sent`
+ *  as dispatched, as it does until the journal accepts them. */
+export function hostTestDrawnRowIds(
+  snapshot: AgentJournalSnapshot,
+  sent: readonly { clientMessageId: string; text: string }[]
+): string[] {
+  const outbox = sent.map((message) => ({
+    ...createStructuredAgentSessionOutboxEntry({
+      ...message,
+      sessionId: HOST_TEST_SESSION,
+      attachments: [],
+      queuedAt: HOST_TEST_NOW
+    }),
+    state: 'dispatching' as const
+  }))
+  return projectNativeChatTranscriptMessages(
+    projectStructuredAgentSessionMessages(snapshot.items, outbox, snapshot.submissions)
+  ).map(({ id }) => id)
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-harness.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-harness.ts
index e0ac9c00d88..d354ad911f0 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-harness.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-harness.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { AgentSessionRecoveryCapsule } from '../../runtime/agent-session-recovery-capsule'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
@@ -98,16 +99,20 @@ async function seedApproval(optionId = 'allow'): Promise<{ itemId: string; revis
   if (!events) {
     throw new Error('seedApproval requires an acquired session')
   }
-  events.appendItem(identity, {
-    kind: 'approval',
-    title: 'Run the command?',
-    detail: null,
-    options: [{ id: optionId, label: 'Allow' }],
-    resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
-  })
+  events.appendItem(
+    identity,
+    {
+      kind: 'approval',
+      title: 'Run the command?',
+      detail: null,
+      options: [{ id: optionId, label: 'Allow' }],
+      resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
+    },
+    { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+  )
   await host.flushStreamedEvents(SESSION)
   const itemId = agentJournalItemKey(identity)
-  const page = host.history({ sessionId: SESSION, direction: 'tail' })
+  const page = await host.history({ sessionId: SESSION, direction: 'tail' })
   const appended = page.ok ? page.page.items.find((item) => item.itemId === itemId) : null
   if (!appended) {
     throw new Error('provider approval was not written to the journal')
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-types.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-types.ts
index 574ced3cc38..44699536a6f 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-types.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-types.ts
@@ -1,4 +1,6 @@
+import type { SubmissionRejectionFact } from '../../../shared/agent-session-failure'
 import type { AgentSessionOwnerProbe } from '../../../shared/agent-session-lease-adjudication'
+import type { AgentJournalCursor } from '../../../shared/agent-session-journal-types'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 import type { AgentSessionStatusSummary } from '../../../shared/agent-session-wire'
 import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
@@ -18,7 +20,7 @@ export type StructuredAgentSessionCaller = { callerKey: string }
 /** What the host believes about a session it just made addressable again. The workspace and agent
  *  come from the record, so a caller publishes the host's view rather than a client's assertion.
  *  `readable` is false when the journal could not be opened — the tab is still worth publishing,
- *  because attach recovers what read restore cannot. */
+ *  because the chat shows that failure and its Retry. */
 export type StructuredAgentSessionReveal = {
   sessionId: string
   workspaceId: string
@@ -26,28 +28,66 @@ export type StructuredAgentSessionReveal = {
   readable: boolean
 }
 
+/** Which provider child: the adapter acquisition and the lease fence it writes at. */
+export type StructuredAgentSessionProviderChildIdentity = {
+  readonly generation: string | null
+  readonly fence: number
+}
+
+/** The provider process behind a conversation. Written only in
+ *  `structured-agent-session-provider-child`. */
+export type StructuredAgentSessionProviderChild = StructuredAgentSessionProviderChildIdentity & {
+  /** A publish-first acquire is `starting` until the adapter's `started` event; only then are its
+   *  reported options fact. */
+  phase: StructuredAgentSessionProviderChildPhase
+  /** The queued message whose delivery started this child, fixed when the start is made; absent
+   *  for any other start. In memory only: it tells a restart offer its own start from another. */
+  readonly startedFor?: string
+}
+
+/** What ending a child established about its provider root. A stop's comes only from
+ *  `stopAgentSessionProviderRoot`; an observed exit's root is gone by definition. */
+export type StructuredAgentSessionStopVerdict = { rootGone: boolean }
+
+export type StructuredAgentSessionChildEndCause =
+  | 'user-stop'
+  | 'host-stop'
+  | 'exit'
+  | 'attach-failed'
+  | 'evict'
+
+/** How the conversation's last child ended. In memory only: the delivery loop reads it to tell a
+ *  Stop from a failure. */
+export type StructuredAgentSessionEndedChild = StructuredAgentSessionProviderChildIdentity &
+  StructuredAgentSessionStopVerdict & {
+    /** `user-stop` is a Stop the user asked for; `host-stop` is the host stopping the child for a
+     *  cause of its own, which fails the start the delivery loop was waiting on. */
+    cause: StructuredAgentSessionChildEndCause
+    /** Descriptive text only — the provider's diagnostic, or the host's cause. Decides nothing. */
+    reason: string | null
+    /** What the chat records about this end; absent reads as a provider exit with no detail. */
+    failure?: SubmissionRejectionFact
+    duringStartup: boolean
+    startedFor?: string
+    /** Where the conversation's journal stood when the child ended, to order the end against a
+     *  message's acceptance. */
+    endedAt: AgentJournalCursor
+  }
+
+/** The conversation: its journal, params and readers outlive any child that serves it. */
 export type StructuredAgentSessionHostSession = {
-  journal: AgentSessionJournal
+  /** Readonly: a new handle enters only through the session map's `set`, which binds its delivery. */
+  readonly journal: AgentSessionJournal
   params: AgentSessionAttachParams
-  fence: number
-  /** Whether THIS host generation is running the provider process behind the session. A journal
-   *  restored for reading has none — so it may not be evicted to free a child, nor have its lease
-   *  released as an observed exit. */
-  hasProviderChild: boolean
-  /** Whether the child behind `hasProviderChild` has proven its start. A publish-first acquire
-   *  is `starting` until the adapter's `started` event; only then are its reported options fact. */
-  providerChildPhase: StructuredAgentSessionProviderChildPhase
+  /** The child THIS host generation runs for the conversation. A conversation opened for reading
+   *  has none — so it may not be evicted to free a child, nor have its lease released as an
+   *  observed exit. */
+  child: StructuredAgentSessionProviderChild | null
   /** The wind-down this host still owes for a child it started: settling that generation's work
-   *  and handing the lease back. A separate fact from `hasProviderChild`, which goes false the
-   *  moment the adapter proves the exit — an eviction that aborts after that point must still be
-   *  able to finish the wind-down on the next close. */
-  owesProviderChildWindDown?: boolean
-  /** Exact adapter acquisition behind `hasProviderChild`; retained after exit to fence recovery. */
-  acquisitionGeneration: string | null
-  /** The fence of the released owner this child replaced, when it was resumed into a lease handed
-   *  back cleanly. A writer current as of that owner is admitted at `fence`: the restart is the
-   *  only thing that moved it. Absent for a create or a journal restored for reading. */
-  resumedFromFence?: number
+   *  and handing the lease back. Outlives `child`, which ends the moment the adapter proves the
+   *  exit — an eviction that aborts after that point must still finish it on the next close. */
+  owesProviderChildWindDown?: StructuredAgentSessionProviderChildIdentity
+  lastEndedChild?: StructuredAgentSessionEndedChild
 }
 
 export type StructuredAgentSessionHostDeps = {
@@ -73,8 +113,10 @@ export type StructuredAgentSessionHostDeps = {
     provider: AgentSessionRecord['provider']
   ) => Promise<Record<string, string> | undefined> | Record<string, string> | undefined
   now?: () => number
-  /** How long a session outlives its last surface. Tests drive this; production takes the default. */
-  releaseGraceMs?: number
+  /** The idle sweep's period and window. Tests drive these; production takes the defaults. */
+  idleSweep?: { intervalMs?: number; idleMs?: number }
+  /** Whether an orchestration dispatch still owns this session's worker; absent answers no. */
+  hasOpenDispatch?: (record: AgentSessionRecord) => boolean
   onEventSinkError?: (input: { sessionId: string; error: unknown }) => void
   /** Every status projection this host publishes. `replay` marks a re-projection of state the host
    *  already knew (restore, an arriving subscriber) rather than a fresh journal edge. */
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts
index 62f88672342..5db9e5d0d74 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
 import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
 import type { AgentSessionOwnerProbe } from '../../../shared/agent-session-lease-adjudication'
@@ -8,6 +9,7 @@ import { AgentSessionRecordStore } from '../../runtime/agent-session-record-stor
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
 import {
   adapter,
   attach,
@@ -138,11 +140,13 @@ describe('attach', () => {
     })
     const params = attachParams()
 
+    // Orca's own store fault: the child is gone, but nothing blames the provider.
     const refused = {
       ok: false,
       refusal: {
         code: 'agent_session_operation_invalid',
-        message: 'agent_session_provider_handle_stale_fence',
+        details: { ownerVerdict: 'exited' },
+        message: "Codex couldn't restart. Send your message to try again.",
         ownerVerdict: 'exited'
       }
     }
@@ -160,7 +164,10 @@ describe('attach', () => {
 
     await expect(host.attach(CALLER, attachParams())).resolves.toMatchObject({
       ok: false,
-      refusal: { message: 'commit failed', ownerVerdict: 'exited' }
+      refusal: {
+        message: "Codex couldn't restart. Send your message to try again.",
+        ownerVerdict: 'exited'
+      }
     })
 
     expect(releaseAcquisition).toHaveBeenCalledWith({ sessionId: SESSION })
@@ -180,7 +187,8 @@ describe('attach', () => {
     })
     events?.appendItem(
       { provider: 'orca', clientMessageId: 'old-journal-write' },
-      { kind: 'status', text: 'old journal write' }
+      { kind: 'status', text: 'old journal write' },
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await vi.waitFor(() => expect(append).toHaveBeenCalledOnce())
     const released = await store.evictProvenDeadOwner({
@@ -208,7 +216,7 @@ describe('cancel', () => {
       turnId: 'turn-1'
     })
     expect(result).toMatchObject({ ok: true, value: { cancelled: true } })
-    const page = host.history({ sessionId: SESSION, direction: 'tail' })
+    const page = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(page.ok && page.page.items[0]?.body).toMatchObject({
       kind: 'status',
       text: 'Cancellation requested.'
@@ -332,7 +340,7 @@ describe('cancel', () => {
       refusal: { code: 'agent_session_operation_unknown' }
     })
     expect(cancelTurn).toHaveBeenCalledTimes(1)
-    expect(host.history({ sessionId: SESSION, direction: 'tail' })).toMatchObject({
+    expect(await host.history({ sessionId: SESSION, direction: 'tail' })).toMatchObject({
       ok: true,
       page: {
         items: [
@@ -383,7 +391,7 @@ describe('respondToPrompt', () => {
         options: [{ id: 'allow', label: 'Allow' }],
         resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
       },
-      child
+      { ...child, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await host.flushStreamedEvents(SESSION)
     const itemId = agentJournalItemKey(identity)
@@ -395,7 +403,7 @@ describe('respondToPrompt', () => {
       ...fields
     })
 
-    const page = host.history({ sessionId: SESSION, direction: 'tail' })
+    const page = await host.history({ sessionId: SESSION, direction: 'tail' })
     const answered = page.ok ? page.page.items.find((item) => item.itemId === itemId) : null
     expect(answered).toMatchObject({
       revision: 2,
@@ -490,7 +498,7 @@ describe('respondToPrompt', () => {
       ...fields
     })
     expect(result.ok).toBe(true)
-    const page = host.history({ sessionId: SESSION, direction: 'tail' })
+    const page = await host.history({ sessionId: SESSION, direction: 'tail' })
     const statusId = agentJournalItemKey({
       provider: 'orca',
       clientMessageId: `${prompt.itemId}#delivery`
@@ -520,7 +528,7 @@ describe('setOption', () => {
     })
     expect(setOption).toHaveBeenCalledTimes(1)
     expect(store.getRecord(SESSION)?.options).toEqual({ model: 'gpt-5', effort: 'high' })
-    const page = host.history({ sessionId: SESSION, direction: 'tail' })
+    const page = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(page.ok && page.page.items).toHaveLength(0)
   })
 
@@ -547,16 +555,19 @@ describe('restart', () => {
    *  them. Every lease loads unreconciled, so this is the state that decides
    *  whether a persisted session is reachable at all. */
   async function reboot(
-    probeOwner: (record: AgentSessionRecord) => Promise<AgentSessionOwnerProbe>
+    probeOwner: (record: AgentSessionRecord) => Promise<AgentSessionOwnerProbe>,
+    adapterOverrides: Partial<StructuredAgentSessionAdapter> = {},
+    stopOwnerProcess?: StructuredAgentSessionHostDeps['stopOwnerProcess']
   ) {
     store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
     host = new StructuredAgentSessionHost({
       store,
-      adapter: adapter(),
+      adapter: { ...adapter(), ...adapterOverrides },
       journalRoot: root,
       claimKeyId: 'key-1',
       mintSpawnToken: () => 'spawn-b',
       probeOwner,
+      ...(stopOwnerProcess ? { stopOwnerProcess } : {}),
       now: () => NOW
     })
     replaceHostTestState({ store, host })
@@ -601,13 +612,13 @@ describe('restart', () => {
     expect(host.listSessionTabs()).toEqual([
       { sessionId: SESSION, workspaceId: 'workspace-1', agent: 'codex' }
     ])
-    const history = host.history({ sessionId: SESSION, direction: 'tail' })
+    const history = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(history.ok && history.page.items).not.toHaveLength(0)
     expect(acquire).not.toHaveBeenCalled()
     expect(listRecords).toHaveBeenCalledTimes(restoreReads)
   })
 
-  it('clears a stale conflicted recovery at restart, and reacquires the native owner when a surface holds it', async () => {
+  it('clears a stale conflicted recovery at restart, and reacquires the native owner on the next start', async () => {
     await attach()
     await store.transitionHandoff(SESSION, (record) => ({
       ...record,
@@ -615,16 +626,17 @@ describe('restart', () => {
         ...record.lease,
         // How a terminal owner an older build recorded loads.
         claimStatus: 'conflicted',
-        handoffStage: 'manual-recovery'
+        handoffStage: 'recovering'
       }
     }))
     await reboot(async () => ({ outcome: 'pid-absent' }))
     acquire.mockClear()
 
     await host.restoreReadableSessions()
-    // The recovery stage clears on evidence at startup; the child comes back only once a surface
-    // holds the session (see structured-agent-session-surface-lifetime.test.ts).
-    await host.hold(SESSION, 'surface-1')
+    // The recovery stage clears on evidence at startup; the child comes back only once work
+    // starts it — here the explicit attach a send's delivery would make.
+    const fence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
+    expect(await host.attach(CALLER, ensureParams(fence))).toMatchObject({ ok: true })
 
     expect(acquire).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
@@ -633,14 +645,14 @@ describe('restart', () => {
       handoffStage: null,
       handoffOperationId: null
     })
-    await expect(host.handoffStatus(SESSION)).resolves.toMatchObject({
+    expect(host.handoffStatus(SESSION)).toMatchObject({
       owner: 'native',
       phase: 'idle',
       stage: null
     })
   })
 
-  it('answers the owner status of a starting chat once its start settles', async () => {
+  it('answers native for a chat whose start is still in flight', async () => {
     await attach()
     await reboot(async () => ({ outcome: 'pid-absent' }))
     await host.restoreReadableSessions()
@@ -656,24 +668,45 @@ describe('restart', () => {
       return settled(input)
     })
 
-    const hold = host.hold(SESSION, 'surface-1')
+    const start = host.attach(
+      CALLER,
+      ensureParams(store.getRecord(SESSION)?.lease.runtimeFence ?? 0)
+    )
     await started.promise
+    const claimMidStart = store.getRecord(SESSION)?.lease.claimStatus
     const status = host.handoffStatus(SESSION)
     release.resolve()
-    await hold
+    await start
 
-    await expect(status).resolves.toMatchObject({ owner: 'native', stage: null })
+    // Mid-start the lease is only reserved; ownership does not wait for the agent.
+    expect(claimMidStart).toBe('reserved')
+    expect(status).toMatchObject({ owner: 'native' })
   })
 
-  it("keeps a session whose owner cannot be probed out of a live writer's hands", async () => {
+  it('vouches for no owner of a chat this host cannot run', async () => {
+    await attach()
+
+    await reboot(async () => ({ outcome: 'pid-absent' }), { supportsCreate: () => false })
+    expect(() => host.handoffStatus(SESSION)).toThrow('structured_agent_session_unsupported')
+  })
+
+  it('releases a session whose owner can never be probed, signalling nothing, and starts over', async () => {
     await attach()
     const held = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
-    await reboot(async () => ({ outcome: 'indeterminate', reason: 'no probe on this host' }))
+    const stopOwnerProcess = vi.fn()
+    await reboot(
+      async () => ({ outcome: 'indeterminate', reason: 'no probe on this host' }),
+      {},
+      stopOwnerProcess
+    )
+    acquire.mockClear()
 
-    expect(await host.attach(CALLER, ensureParams(held))).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_ownership_unknown' }
+    expect(await host.attach(CALLER, ensureParams(await staleFenceFrom(held)))).toMatchObject({
+      ok: true
     })
+    expect(acquire).toHaveBeenCalledOnce()
+    // An unverifiable pid may already belong to an unrelated process.
+    expect(stopOwnerProcess).not.toHaveBeenCalled()
   })
 
   it('does not remember a failed adjudication as done', async () => {
@@ -696,7 +729,7 @@ describe('subscribe', () => {
   it('opens with a snapshot and then streams cursor-qualified batches', async () => {
     await attach()
     const events: AgentSessionSubscribeEvent[] = []
-    const dispose = host.subscribe({
+    const dispose = await host.subscribe({
       id: 'sub-1',
       sessionId: SESSION,
       emit: (event) => events.push(event)
@@ -726,7 +759,7 @@ describe('subscribe', () => {
     }
 
     const events: AgentSessionSubscribeEvent[] = []
-    host.subscribe({
+    await host.subscribe({
       id: 'sub-2',
       sessionId: SESSION,
       emit: (event) => events.push(event),
@@ -747,14 +780,14 @@ describe('subscribe', () => {
   it('drops a failed transport without aborting the mutation or other subscribers', async () => {
     await attach()
     const events: AgentSessionSubscribeEvent[] = []
-    host.subscribe({
+    await host.subscribe({
       id: 'dead-sub',
       sessionId: SESSION,
       emit: () => {
         throw new Error('socket closed')
       }
     })
-    host.subscribe({
+    await host.subscribe({
       id: 'live-sub',
       sessionId: SESSION,
       emit: (event) => events.push(event)
@@ -766,15 +799,25 @@ describe('subscribe', () => {
       body
     })
 
-    expect(result).toMatchObject({ ok: true, value: { submission: { dispatchState: 'accepted' } } })
-    expect(dispatch).toHaveBeenCalledTimes(1)
-    expect(events.some((event) => event.type === 'batch')).toBe(true)
+    expect(result).toMatchObject({ ok: true, value: { submission: { dispatchState: 'pending' } } })
+    // The failed transport does not stop the delivery loop either: the handover still lands and
+    // reaches the live subscriber.
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledTimes(1))
+    await vi.waitFor(() =>
+      expect(
+        events.some(
+          (event) =>
+            event.type === 'batch' &&
+            event.batch.submissions?.some((entry) => entry.dispatchState === 'accepted')
+        )
+      ).toBe(true)
+    )
   })
 
   it('resets a subscriber whose epoch is gone', async () => {
     await attach()
     const events: AgentSessionSubscribeEvent[] = []
-    host.subscribe({
+    await host.subscribe({
       id: 'sub-3',
       sessionId: SESSION,
       emit: (event) => events.push(event),
@@ -786,7 +829,7 @@ describe('subscribe', () => {
   it('publishes the replacement fence when the owner generation changes', async () => {
     const record = await attach()
     const events: AgentSessionSubscribeEvent[] = []
-    host.subscribe({
+    await host.subscribe({
       id: 'sub-4',
       sessionId: SESSION,
       emit: (event) => events.push(event)
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host.ts
index 4ba2e6db478..efdd83d9f14 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host.ts
@@ -2,53 +2,60 @@ import type { AgentSessionRewindParams } from '../../../shared/agent-session-rew
 import { rewindStructuredAgentSession } from './structured-agent-session-rewind'
 import { StructuredConversationCommandController } from './structured-conversation-command-controller'
 // Structured agent-session host: where the lease, journal, and provider adapter meet.
-// Mutations share one durable admission path and serialize per session.
+// Mutations share one durable admission path and serialize per session. A conversation is reached
+// only through `conversation`, which opens it at rest; an agent is started only by work that needs
+// it, and the idle sweep is the one thing that puts it to rest.
 
 import type { AgentJournalSnapshot } from '../../../shared/agent-session-journal-types'
 import type { AgentSessionExecutionLocation } from '../../../shared/agent-session-record'
 import type * as SessionWire from '../../../shared/agent-session-wire'
 import type { AgentSessionAttachParams } from './structured-agent-session-attach'
-import { AGENT_SESSION_NOT_ATTACHED } from './structured-agent-session-mutation-admission'
 import { createRestartReconciler } from './structured-agent-session-restart-reconcile'
 import type { AgentSessionSubscribeInput } from './structured-agent-session-subscribers'
 import { StructuredAgentSessionTaskQueue } from './structured-agent-session-task-queue'
 import * as providerSupport from './structured-agent-session-provider-support'
-import { createStructuredAgentSessionHostRestore } from './structured-agent-session-reveal'
+import {
+  createStructuredAgentSessionHostRestore,
+  revealStructuredAgentSession
+} from './structured-agent-session-reveal'
 import { structuredAgentSessionOwnerStatus } from './structured-agent-session-owner-status'
 import { StructuredAgentSessionHostRuntimeState } from './structured-agent-session-host-runtime-state'
 import { attachStructuredAgentSession } from './structured-agent-session-attach-orchestration'
+import type { StructuredAgentSessionLifetimeContext } from './structured-agent-session-host-lifetime'
 import {
-  createStructuredAgentSessionHolds,
-  evictHeldStructuredAgentSession,
-  type StructuredAgentSessionLifetimeContext
-} from './structured-agent-session-host-lifetime'
-import type {
-  StructuredAgentSessionHolds,
-  StructuredAgentSessionHoldOptions
-} from './structured-agent-session-holds'
+  ensureStructuredAgentSessionAgent,
+  ensureStructuredAgentSessionAgentForOperation
+} from './structured-agent-session-agent-start'
+import {
+  createStructuredAgentSessionConversationLifetime,
+  type StructuredAgentSessionConversationLifetime
+} from './structured-agent-session-conversation-lifetime'
 import type { StructuredAgentSessionAttachContext } from './structured-agent-session-attach-context'
 import * as sessionTabs from './structured-agent-session-host-tabs'
 import {
   structuredAgentSessionMutationDelegates,
   settleStructuredAgentSessionLateDispatch,
-  type StructuredAgentSessionMutationContext,
-  releaseStructuredAgentSessionUnansweredDispatches
+  type StructuredAgentSessionMutationContext
 } from './structured-agent-session-host-mutations'
+import { releaseStructuredAgentSessionUnansweredDispatches } from './structured-agent-session-unanswered-dispatch-release'
 import { flushStructuredAgentSessionHost } from './structured-agent-session-host-teardown'
 import type {
   StructuredAgentSessionCaller,
   StructuredAgentSessionHostDeps,
-  StructuredAgentSessionHostSession,
   StructuredAgentSessionReveal
 } from './structured-agent-session-host-types'
 import { StructuredAgentSessionEventRecovery } from './structured-agent-session-event-recovery'
 import { StructuredAgentSessionBackgroundTaskChannel } from './structured-agent-session-background-task-channel'
 import { StructuredAgentSessionClientDelivery } from './structured-agent-session-client-delivery'
+import { StructuredAgentSessionConversations } from './structured-agent-session-conversations'
 import {
   createStructuredAgentSessionRestartResume,
   type StructuredAgentSessionRestartResume
 } from './structured-agent-session-restart-resume-host'
 import { structuredAgentSessionRestartResumeSurfaces } from './structured-agent-session-restart-resume-wiring'
+import { createStructuredAgentSessionConversationDelivery } from './structured-agent-session-host-delivery'
+import { structuredAgentSessionConversationFence } from './structured-agent-session-provider-child'
+import { wireStructuredAgentSessionQueuedMessages } from './structured-agent-session-queued-wiring'
 export type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
 
 export class StructuredAgentSessionHost {
@@ -56,12 +63,25 @@ export class StructuredAgentSessionHost {
     () => this.mutationContext(),
     this
   )
-  private readonly sessions = new Map<string, StructuredAgentSessionHostSession>()
+  private readonly sessions = new StructuredAgentSessionConversations({
+    deliver: (sessionId, journal) => {
+      this.subscribers.publish(sessionId, journal)
+      this.conversationDelivery.afterCommit(sessionId, journal)
+    },
+    onDeliveryError: (sessionId, error) => this.deps.onEventSinkError?.({ sessionId, error }),
+    onOpened: (sessionId) => this.queued.drain.schedule(sessionId),
+    now: () => this.now()
+  })
+  private readonly queued = wireStructuredAgentSessionQueuedMessages(this.sessions, () =>
+    this.mutationContext()
+  )
+  // Every journal publish is activity: the one renewal the idle sweep reads.
   private readonly clientDelivery = new StructuredAgentSessionClientDelivery(
     this.sessions,
     () => this.now(),
     () => this.deps,
-    (sessionId) => this.holds.renew(sessionId)
+    (sessionId) => this.queued.onJournalActivity(sessionId),
+    (sessionId) => this.restartResume.onAgentStarted(sessionId)
   )
   private readonly subscribers = this.clientDelivery.subscribers
   private readonly tasks = new StructuredAgentSessionTaskQueue()
@@ -70,7 +90,10 @@ export class StructuredAgentSessionHost {
     sessionId: string
   ) => Promise<SessionWire.AgentSessionWireRefusal | null>
   private readonly restore: ReturnType<typeof createStructuredAgentSessionHostRestore>
-  private readonly holds: StructuredAgentSessionHolds
+  private readonly lifetime: StructuredAgentSessionConversationLifetime
+  private readonly conversationDelivery: ReturnType<
+    typeof createStructuredAgentSessionConversationDelivery
+  >
   private readonly eventRecovery: StructuredAgentSessionEventRecovery
   private readonly backgroundTasks: StructuredAgentSessionBackgroundTaskChannel
   /** Public because the RPC surface addresses it directly; see the restart-resume collaborator. */
@@ -81,7 +104,7 @@ export class StructuredAgentSessionHost {
       deps,
       this.sessions,
       this.subscribers,
-      (sessionId) => this.requireSession(sessionId),
+      (sessionId) => this.lifetime.conversation(sessionId),
       this.clientDelivery.publishStatus
     )
     this.runtimeState = new StructuredAgentSessionHostRuntimeState(deps, (sessionId, error) =>
@@ -93,21 +116,32 @@ export class StructuredAgentSessionHost {
       ...(deps.probeOwners ? { probeMany: deps.probeOwners } : {}),
       now: () => this.now()
     })
-    this.holds = createStructuredAgentSessionHolds(
-      () => this.attachContext(),
-      (sessionId) => this.close(sessionId)
-    )
-    this.restore = createStructuredAgentSessionHostRestore(deps, this.sessions, () => this.now(), {
+    this.conversationDelivery = createStructuredAgentSessionConversationDelivery({
+      deps,
+      sessions: this.sessions,
+      serialize: (sessionId, task) => this.serialize(sessionId, task),
+      // Quit drains a delivery start before it evicts, so the child it produces is stopped.
+      trackStart: (start) => this.tasks.trackAttach(start),
+      ensureProviderChild: (sessionId, startedFor) =>
+        ensureStructuredAgentSessionAgent(this.attachContext(), sessionId, startedFor),
+      reset: (sessionId, journal, reset) =>
+        this.subscribers.reset(
+          sessionId,
+          journal,
+          reset,
+          structuredAgentSessionConversationFence(deps.store, sessionId)
+        ),
+      publishRestored: this.clientDelivery.publishRestored,
+      flushStreamedEvents: (sessionId) => this.flushStreamedEvents(sessionId)
+    })
+    this.restore = createStructuredAgentSessionHostRestore(deps, {
       reconcile: this.reconcileLeases,
       resolveRecovery: (sessionId) => this.runtimeState.resolveRecovery(sessionId),
       serialize: (sessionId, task) => this.serialize(sessionId, task),
       hasSession: this.hasSession,
       // Site 10: cannot overwrite a live entry — the restorer returns early on
       // `hasSession` inside the same serialized step as this `set`.
-      onReadable: (sessionId, restored) => {
-        this.sessions.set(sessionId, restored)
-        this.clientDelivery.publishRestored(sessionId)
-      }
+      onReadable: this.conversationDelivery.adoptOpened
     })
     this.eventRecovery = new StructuredAgentSessionEventRecovery({
       deps,
@@ -115,38 +149,37 @@ export class StructuredAgentSessionHost {
       sessions: this.sessions,
       flushLifecycle: (sessionId) => this.runtimeState.lifecycleBarrier(sessionId),
       publishFence: (sessionId, session) =>
-        this.subscribers.snapshot(sessionId, session.journal, session.fence),
+        this.subscribers.snapshot(
+          sessionId,
+          session.journal,
+          structuredAgentSessionConversationFence(deps.store, sessionId)
+        ),
       publishStatus: this.clientDelivery.publishStatusAndSettlement,
-      hasResumeCapableHolder: (sessionId) => this.holds.hasResumeCapableHolder(sessionId),
-      restartReleaseGrace: (sessionId) => this.holds.renew(sessionId),
-      // Tracked: a quit drains a queued restart before it evicts, so no child outlives it.
       serialize: (sessionId, task) => this.tasks.trackAttach(this.serialize(sessionId, task)),
       now: () => this.now(),
-      ensureProviderChild: (id, options) => this.holds.ensureProviderChild(id, options),
       onBarrierError: (sessionId, error) => deps.onEventSinkError?.({ sessionId, error })
     })
-    this.restartResume = createStructuredAgentSessionRestartResume(deps, this.sessions, {
-      ...structuredAgentSessionRestartResumeSurfaces(this, this.now),
-      publish: this.subscribers.publish.bind(this.subscribers)
+    this.restartResume = createStructuredAgentSessionRestartResume(
+      deps,
+      this.sessions,
+      structuredAgentSessionRestartResumeSurfaces(this, this.now)
+    )
+    this.lifetime = createStructuredAgentSessionConversationLifetime({
+      context: () => this.lifetimeContext(),
+      sessions: this.sessions,
+      serialize: (sessionId, task) => this.serialize(sessionId, task),
+      open: (sessionId) => this.conversationDelivery.open(sessionId),
+      deliveryActive: (sessionId) => this.conversationDelivery.loop.isRunning(sessionId),
+      closeStatus: (sessionId, options) => this.clientDelivery.closeSession(sessionId, options)
     })
     this.runtimeState.startLeaseRenewal()
+    this.lifetime.idleSweep.start()
   }
 
   private now = (): number => this.deps.now?.() ?? Date.now()
 
   hasSession = (sessionId: string): boolean => this.sessions.has(sessionId)
-  isHeld = (sessionId: string): boolean => this.holds.isHeld(sessionId)
-
-  /** A surface bound to this session and wants it live. The FIRST hold on a session with no
-   *  provider child is what resumes one; a retained hold (a subscription) only keeps it. */
-  hold = (
-    sessionId: string,
-    holderId: string,
-    options?: StructuredAgentSessionHoldOptions
-  ): Promise<void> => this.holds.hold(sessionId, holderId, options)
-
-  /** That surface is gone. The child outlives it by the idle window, and by any running turn. */
-  release = (sessionId: string, holderId: string): void => this.holds.release(sessionId, holderId)
+  sessionAgent = (sessionId: string) => this.deps.store.getRecord(sessionId)?.provider ?? null
 
   handleAdapterEvent = (event: Parameters<StructuredAgentSessionEventRecovery['handle']>[0]) =>
     this.eventRecovery.handle(event)
@@ -157,7 +190,7 @@ export class StructuredAgentSessionHost {
       runtimeState: this.runtimeState,
       sessions: this.sessions,
       now: () => this.now(),
-      forgetStatus: this.clientDelivery.forgetStatus
+      publishStatus: this.clientDelivery.publishStatus
     }
   }
 
@@ -169,28 +202,31 @@ export class StructuredAgentSessionHost {
       tasks: this.tasks,
       reconcileLeases: (sessionId) => this.reconcileLeases(sessionId),
       serialize: (sessionId, task) => this.serialize(sessionId, task),
-      publishStatus: this.clientDelivery.publishStatus
+      publishStatus: this.clientDelivery.publishStatus,
+      openConversation: this.conversationDelivery.open
     }
   }
-  /** Releases a session's resources without ending the conversation: the record and journal stay
-   *  on disk, so the same session can be attached again. */
-  close(sessionId: string): Promise<void> {
-    return this.serialize(sessionId, async () => {
-      await evictHeldStructuredAgentSession(this.lifetimeContext(), sessionId)
-      this.clientDelivery.closeSession(sessionId)
-      // The holders now look at a session that is gone; a failed eviction throws above, keeping them.
-      this.holds.forget(sessionId)
-    })
-  }
+  /** Releases a session's resources without ending the conversation; see the lifetime's close. */
+  close = (sessionId: string): Promise<void> => this.lifetime.close(sessionId)
 
   supportsCreate = (location: AgentSessionExecutionLocation, agent: string): boolean =>
     providerSupport.adapterSupportsCreate(this.deps.adapter, location, agent)
 
   listSessionTabs = () => sessionTabs.listStructuredAgentSessionTabs(this.sessions)
   getPersistedVisibleSessionTabIndex = () => this.deps.store.getVisibleSessionTabIndex()
+  getSessionTabId = (sessionId: string): string | null => this.deps.store.getSessionTabId(sessionId)
 
-  setSessionTabVisibility = (sessionId: string, visible: boolean): Promise<void> =>
-    sessionTabs.setStructuredAgentSessionTabVisibility(this, sessionId, visible)
+  setSessionTabVisibility = async (
+    sessionId: string,
+    visible: boolean,
+    tabId?: string
+  ): Promise<void> => {
+    await sessionTabs.setStructuredAgentSessionTabVisibility(this, sessionId, visible, tabId)
+    // The tab edge of the row's lifetime; the handle close is the other.
+    if (!visible && !this.sessions.get(sessionId)?.child) {
+      this.clientDelivery.forgetStatus(sessionId)
+    }
+  }
 
   reconcileRestartLeases = async (): Promise<void> => {
     const refusal = await this.reconcileLeases('startup')
@@ -204,7 +240,7 @@ export class StructuredAgentSessionHost {
 
   /** Make one persisted session addressable again; see `structured-agent-session-reveal`. */
   revealSession = (sessionId: string): Promise<StructuredAgentSessionReveal> =>
-    this.restore.revealSession(sessionId)
+    revealStructuredAgentSession(this.deps, sessionId, (id) => this.lifetime.conversation(id))
 
   private serialize = this.tasks.serialize.bind(this.tasks)
 
@@ -221,9 +257,10 @@ export class StructuredAgentSessionHost {
   // Trigger inlined rather than imported: `AgentSessionResumeTrigger` in shared is the canonical
   // type, and this file has no line budget left for the import.
   async flushAllStreamedEvents(options?: { trigger?: 'quit' | 'update' }): Promise<void> {
+    this.conversationDelivery.dispose()
     await flushStructuredAgentSessionHost({
       ...this.lifetimeContext(),
-      holds: this.holds,
+      idleSweep: this.lifetime,
       tasks: this.tasks,
       restartResume: this.restartResume,
       serialize: this.serialize,
@@ -237,16 +274,24 @@ export class StructuredAgentSessionHost {
       sessions: this.sessions,
       publish: (sessionId, journal) => this.subscribers.publish(sessionId, journal),
       flushStreamedEvents: this.flushStreamedEvents,
-      requireSession: (sessionId) => this.requireSession(sessionId),
+      conversation: this.lifetime.conversation,
       serialize: (sessionId, task) => this.serialize(sessionId, task),
-      holds: this.holds,
-      restoreReadable: (sessionId) => this.restore.restoreReadableUnderSerialize(sessionId),
+      openConversation: this.conversationDelivery.open,
+      ensureAgent: (sessionId) =>
+        ensureStructuredAgentSessionAgentForOperation(this.attachContext(), sessionId),
+      wakeDelivery: (sessionId) => this.conversationDelivery.loop.wake(sessionId),
+      stopAgent: this.lifetime.stopAgent,
+      wakeQueuedDrain: (sessionId) => this.queued.drain.schedule(sessionId),
       now: () => this.now()
     }
   }
 
   send = this.conversationCommands.send
 
+  queuedMessageSend = this.queued.queuedMessageSend
+  queuedMessageDelete = this.queued.queuedMessageDelete
+  queuedMessagesResume = this.queued.queuedMessagesResume
+
   waitForSendSettlement = this.clientDelivery.waitForSendSettlement
 
   private mutations = structuredAgentSessionMutationDelegates(() => this.mutationContext())
@@ -267,27 +312,19 @@ export class StructuredAgentSessionHost {
     commands: this.deps.adapter.readCommands?.(sessionId)
   })
 
-  async handoffStatus(sessionId: string): Promise<SessionWire.AgentSessionHandoffStatus> {
-    this.requireSession(sessionId)
-    // Queued behind an in-flight attach, so a starting chat answers with its settled owner.
-    return this.serialize(sessionId, async () => {
-      const record = this.deps.store.getRecord(sessionId)
-      if (!record) {
-        throw new Error('agent_session_identity_required')
-      }
-      return structuredAgentSessionOwnerStatus(record)
-    })
-  }
+  /** From the record store, never the session map: an idle-released chat has no map entry. */
+  handoffStatus = (sessionId: string): SessionWire.AgentSessionHandoffStatus =>
+    structuredAgentSessionOwnerStatus(this.deps, sessionId)
 
   history: StructuredAgentSessionBackgroundTaskChannel['history'] = (request) =>
     this.backgroundTasks.history(request)
 
   /** The fully reduced timeline, for readers that cannot tolerate a page's ambiguity — rows are
    *  revised or tombstoned in place, so an item's ABSENCE from a bounded page proves nothing. */
-  journalSnapshot = (sessionId: string): AgentJournalSnapshot =>
-    this.requireSession(sessionId).journal.snapshot()
+  journalSnapshot = async (sessionId: string): Promise<AgentJournalSnapshot> =>
+    (await this.lifetime.conversation(sessionId)).journal.snapshot()
 
-  subscribe = (input: AgentSessionSubscribeInput): (() => void) =>
+  subscribe = (input: AgentSessionSubscribeInput): Promise<() => void> =>
     this.backgroundTasks.subscribe(input)
 
   settleLateDispatch = (input: Parameters<typeof settleStructuredAgentSessionLateDispatch>[1]) =>
@@ -308,11 +345,13 @@ export class StructuredAgentSessionHost {
   /** Turns that settle from now on. Live-only: nothing missed is replayed. */
   subscribeTurnCompletions = this.clientDelivery.subscribeTurnCompletions
 
-  private requireSession(sessionId: string): StructuredAgentSessionHostSession {
-    const session = this.sessions.get(sessionId)
-    if (!session) {
-      throw new Error(AGENT_SESSION_NOT_ATTACHED.code)
-    }
-    return session
-  }
+  /** Test rigs only: the collaborators the host builds itself, typed, for tests that drive them. */
+  collaboratorsForTests = () => ({
+    sessions: this.sessions,
+    subscribers: this.subscribers,
+    runtimeState: this.runtimeState,
+    conversationDelivery: this.conversationDelivery,
+    lifetime: this.lifetime,
+    serialize: this.serialize
+  })
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-idle-sweep.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-idle-sweep.test.ts
new file mode 100644
index 00000000000..25288dc6490
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-idle-sweep.test.ts
@@ -0,0 +1,318 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
+// The idle sweep on a real host: what puts an agent to rest, what keeps it running, and what a
+// reader and the session lists see when it does.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentSessionStatusSummary } from '../../../shared/agent-session-wire'
+import {
+  collectSubscriber,
+  createRestTestRig,
+  foundRestTestChat,
+  readerSaw,
+  IDLE_MS,
+  REST_TEST_CALLER as CALLER,
+  REST_TEST_SESSION as SESSION,
+  REST_TEST_THREAD as THREAD,
+  restTestSend,
+  sweepTicks,
+  type RestTestRig
+} from './structured-agent-session-rest-test-rig'
+import { StructuredAgentSessionIdleSweep } from './structured-agent-session-idle-sweep'
+
+let rig: RestTestRig
+
+beforeEach(async () => {
+  rig = await createRestTestRig()
+})
+
+afterEach(async () => {
+  await rig.dispose()
+})
+
+function providerEvents() {
+  const events = rig.adapter.acquire.mock.calls.at(-1)?.[0].events
+  if (!events) {
+    throw new Error('no provider child was started')
+  }
+  return events
+}
+
+function lastStatus(): AgentSessionStatusSummary | undefined {
+  return rig.statusEvents
+    .flatMap((event) => (event.type === 'status' ? [event.session] : []))
+    .findLast((summary) => summary.sessionId === SESSION)
+}
+
+function fence(): number {
+  return rig.store.getRecord(SESSION)?.lease.runtimeFence ?? 1
+}
+
+describe('the idle sweep', () => {
+  it('stops an idle agent and keeps the conversation, its status row and its reader (P2-07)', async () => {
+    await foundRestTestChat(rig)
+    const reader = collectSubscriber()
+    await rig.host.subscribe({ id: 'reader', sessionId: SESSION, emit: reader.emit })
+    rig.clock.now += IDLE_MS + 1
+
+    await vi.waitFor(() => expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION))
+    await vi.waitFor(() => expect(rig.store.getRecord(SESSION)?.lease.claimStatus).toBe('released'))
+    await vi.waitFor(() => expect(rig.adapter.acknowledgeSessionRelease).toHaveBeenCalledOnce())
+    expect(rig.adapter.acknowledgeSessionRelease).toHaveBeenCalledWith(SESSION)
+    // Listed, idle, and no longer running on this host — never dropped from any list.
+    expect(lastStatus()).toMatchObject({ status: 'idle' })
+    expect(lastStatus()?.hostExecutionOwned).toBeUndefined()
+    expect(rig.sink.forget).not.toHaveBeenCalled()
+    expect(reader.events.some((event) => event.type === 'end')).toBe(false)
+
+    // Everything a chat at rest answers still answers, and the next send starts a new agent.
+    await expect(rig.host.readOptions(SESSION)).resolves.toMatchObject({ current: {} })
+    const sent = await rig.host.send(CALLER, restTestSend('carry on', fence()))
+    expect(sent.ok).toBe(true)
+    await vi.waitFor(() => expect(rig.adapter.acquire).toHaveBeenCalledTimes(2))
+    await vi.waitFor(() => expect(rig.adapter.dispatch).toHaveBeenCalledTimes(2))
+    await vi.waitFor(() => expect(readerSaw(reader.events).texts).toContain('carry on'))
+  })
+
+  it('never stops an agent a message is queued for, and hands the message over (P2-08)', async () => {
+    await foundRestTestChat(rig)
+    rig.adapter.closeSession.mockClear()
+    // The loop takes the message and waits on the child's start, outside the lock.
+    const started = Promise.withResolvers<void>()
+    const awaitStarted = vi.fn(() => started.promise)
+    Object.assign(rig.host.deps.adapter, { awaitStarted })
+    const reader = collectSubscriber()
+    await rig.host.subscribe({ id: 'reader', sessionId: SESSION, emit: reader.emit })
+    const sent = await rig.host.send(CALLER, restTestSend('queued one', fence()))
+    expect(sent.ok).toBe(true)
+    await vi.waitFor(() => expect(awaitStarted).toHaveBeenCalled())
+    rig.clock.now += IDLE_MS + 1
+
+    await sweepTicks()
+    expect(rig.adapter.closeSession).not.toHaveBeenCalled()
+    started.resolve()
+    await vi.waitFor(() => expect(rig.adapter.dispatch).toHaveBeenCalledTimes(2))
+    const settled = (await rig.host.journalSnapshot(SESSION)).submissions.at(-1)
+    expect(settled?.dispatchState).toBe('accepted')
+    const seen = readerSaw(reader.events).submissions
+    expect(seen.some((row) => row.dispatchState === 'accepted')).toBe(true)
+    expect(
+      seen.some((row) => row.dispatchState === 'rejected' || row.dispatchState === 'unknown')
+    ).toBe(false)
+  })
+
+  it('never stops an agent whose background work still runs (P2-09)', async () => {
+    await foundRestTestChat(rig)
+    // A Codex subagent thread is one of these tasks; the tracker projects both kinds alike.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a background roster fixture; the sweep reads only whether live tasks exist.
+    rig.adapter.backgroundTaskState.mockReturnValue({
+      state: 'monitoring',
+      tasks: [
+        {
+          taskId: 'subagent-1',
+          kind: 'subagent',
+          status: 'running',
+          title: 'reviewer',
+          startedAt: rig.clock.now
+        }
+      ]
+    } as never)
+    rig.clock.now += IDLE_MS + 1
+
+    await sweepTicks()
+    expect(rig.adapter.closeSession).not.toHaveBeenCalled()
+    rig.adapter.backgroundTaskState.mockReturnValue(undefined)
+    rig.clock.now += IDLE_MS + 1
+    await vi.waitFor(() => expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION))
+  })
+
+  // A finished child reads done before the lead's wake-up turn writes its first row; stopping the
+  // agent in that gap would lose the wake-up. Owed work is activity, as main's release clock had it.
+  it('gives an agent a full idle window after its background work ends', async () => {
+    await foundRestTestChat(rig)
+    rig.adapter.backgroundTaskState.mockReturnValue({
+      state: 'monitoring',
+      tasks: [{ id: 'subagent-1', kind: 'agent', state: 'working' }]
+    })
+    rig.clock.now += IDLE_MS + 1
+    await sweepTicks()
+    rig.adapter.backgroundTaskState.mockReturnValue({
+      state: 'monitoring',
+      tasks: [{ id: 'subagent-1', kind: 'agent', state: 'done' }]
+    })
+
+    await sweepTicks()
+    expect(rig.adapter.closeSession).not.toHaveBeenCalled()
+    rig.clock.now += IDLE_MS + 1
+    await vi.waitFor(() => expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION))
+  })
+
+  // Owed work is read every tick, not once a window: work that ends just before a window would
+  // have closed still leaves the agent a full window after it.
+  it('gives a full window after background work that ends late in a window', async () => {
+    await foundRestTestChat(rig)
+    const subagent = (state: 'working' | 'done') => ({
+      state: 'monitoring' as const,
+      tasks: [{ id: 'subagent-1', kind: 'agent' as const, state }]
+    })
+    rig.adapter.backgroundTaskState.mockReturnValue(subagent('working'))
+    rig.clock.now += IDLE_MS + 1
+    await sweepTicks()
+    rig.clock.now += IDLE_MS - 60_000
+    await sweepTicks()
+    rig.adapter.backgroundTaskState.mockReturnValue(subagent('done'))
+    rig.clock.now += 60_000 + 1
+
+    await sweepTicks()
+    expect(rig.adapter.closeSession).not.toHaveBeenCalled()
+    rig.clock.now += IDLE_MS
+    await vi.waitFor(() => expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION))
+  })
+
+  it('stops an agent whose roster holds only children that went idle or finished', async () => {
+    await foundRestTestChat(rig)
+    rig.adapter.backgroundTaskState.mockReturnValue({
+      state: 'monitoring',
+      tasks: [
+        { id: 'subagent-1', kind: 'agent', state: 'idle' },
+        { id: 'command-1', kind: 'command', state: 'done' }
+      ]
+    })
+    rig.clock.now += IDLE_MS + 1
+
+    await vi.waitFor(() => expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION))
+  })
+
+  it('never stops an agent while its lead turn runs, however quiet (P2-10)', async () => {
+    await foundRestTestChat(rig)
+    providerEvents().appendItem(
+      { provider: 'codex', threadId: THREAD, turnId: 'working', ordinal: 50 },
+      { kind: 'turn', turnId: 'working', state: 'running' },
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
+    await rig.host.flushStreamedEvents(SESSION)
+    rig.clock.now += IDLE_MS + 1
+
+    await sweepTicks()
+    expect(rig.adapter.closeSession).not.toHaveBeenCalled()
+  })
+
+  it('stops an agent whose chat is still open on screen (P2-12)', async () => {
+    await foundRestTestChat(rig)
+    const reader = collectSubscriber()
+    await rig.host.subscribe({ id: 'on-screen', sessionId: SESSION, emit: reader.emit })
+    rig.clock.now += IDLE_MS + 1
+
+    await vi.waitFor(() => expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION))
+    expect(reader.events.some((event) => event.type === 'end')).toBe(false)
+  })
+
+  it('counts the idle window from the last activity (P2-13)', async () => {
+    await foundRestTestChat(rig)
+    rig.clock.now += IDLE_MS - 60_000
+    // Activity at 29 minutes: a provider row reaching the journal.
+    providerEvents().appendItem(
+      { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 60 },
+      { kind: 'status', text: 'still thinking' },
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
+    await rig.host.flushStreamedEvents(SESSION)
+    rig.clock.now += 60_001
+
+    await sweepTicks()
+    expect(rig.adapter.closeSession).not.toHaveBeenCalled()
+    rig.clock.now += IDLE_MS
+    await vi.waitFor(() => expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION))
+  })
+
+  it('never stops a worker whose orchestration dispatch is open, and stops it once it settles (P2-19 i)', async () => {
+    await rig.dispose()
+    let open = true
+    const hasOpenDispatch = vi.fn(() => open)
+    rig = await createRestTestRig({ hasOpenDispatch })
+    await foundRestTestChat(rig)
+    rig.clock.now += 2 * IDLE_MS
+
+    await sweepTicks(12)
+    expect(rig.adapter.closeSession).not.toHaveBeenCalled()
+    expect(hasOpenDispatch).toHaveBeenCalledWith(expect.objectContaining({ sessionId: SESSION }))
+    open = false
+    rig.clock.now += IDLE_MS + 1
+    await vi.waitFor(() => expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION))
+  })
+
+  it('keeps a child an unanswered prompt waits on (P2-22 i)', async () => {
+    await foundRestTestChat(rig)
+    providerEvents().appendItem(
+      { provider: 'codex', threadId: THREAD, turnId: 'subagent-turn', ordinal: 70 },
+      {
+        kind: 'approval',
+        title: 'Run the command?',
+        detail: null,
+        options: [{ id: 'allow', label: 'Allow' }],
+        resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
+      },
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
+    await rig.host.flushStreamedEvents(SESSION)
+    rig.clock.now += IDLE_MS + 1
+
+    await sweepTicks()
+    expect(rig.adapter.closeSession).not.toHaveBeenCalled()
+  })
+})
+
+describe('the idle sweep with no child running (P2-22 ii)', () => {
+  it('closes a handle whose only leftover is a prompt nobody can answer', async () => {
+    const journal = {
+      submissions: () => [],
+      pendingSubmissions: () => [],
+      snapshot: () => ({
+        items: [
+          {
+            itemId: 'prompt',
+            revision: 1,
+            sequence: 1,
+            observedAt: 0,
+            body: {
+              kind: 'approval',
+              title: 'Run?',
+              detail: null,
+              options: [],
+              resolution: {
+                state: 'pending',
+                selectedOptionId: null,
+                resolvedBy: null,
+                resolvedAt: null
+              }
+            }
+          }
+        ]
+      })
+    }
+    const sessions = Object.assign(
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a session fixture carrying only the journal and child facts the sweep reads.
+      new Map([[SESSION, { journal, child: null } as never]]),
+      { lastActivityAt: () => 0, touch: () => undefined }
+    )
+    const stopAgent = vi.fn(async () => undefined)
+    const closeConversation = vi.fn(async () => true)
+    const sweep = new StructuredAgentSessionIdleSweep({
+      sessions,
+      serialize: (_id, task) => task(),
+      now: () => IDLE_MS + 1,
+      isDisposed: () => false,
+      deliveryActive: () => false,
+      backgroundTaskState: () => undefined,
+      hasOpenDispatch: () => false,
+      stopAgent,
+      stopStartingAgent: stopAgent,
+      closeConversation,
+      onError: (_id, error) => {
+        throw error
+      }
+    })
+    await sweep.tick()
+    expect(stopAgent).not.toHaveBeenCalled()
+    expect(closeConversation).toHaveBeenCalledWith(SESSION)
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-idle-sweep.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-idle-sweep.ts
new file mode 100644
index 00000000000..2394b604171
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-idle-sweep.ts
@@ -0,0 +1,151 @@
+// The one thing that puts an idle agent to rest.
+//
+// Nothing a viewer does keeps an agent alive or starts one: a chat on screen and a chat in a
+// background tab are the same to this sweep. Every few minutes it looks at each open conversation
+// and stops the provider child of one that has been quiet for the idle window and owes no work,
+// then drops the open journal handle of one that is only a cache. The conversation itself — its
+// record, tab, status row and readers — is untouched, and the next send starts a new child.
+//
+// Owed work is derived on every tick, never stored, so there is nothing to disagree with it.
+
+import { agentChildWorkLiveness } from '../../../shared/agent-status-child-work-liveness'
+import { activeStructuredAgentSessionTurnId } from '../../../shared/structured-agent-session-projection'
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
+import type { AgentJournalRenderItem } from '../../../shared/agent-session-journal-types'
+import type { AgentSessionBackgroundTaskState } from '../../../shared/agent-session-wire'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+
+export const STRUCTURED_AGENT_SESSION_IDLE_SWEEP_INTERVAL_MS = 5 * 60_000
+export const STRUCTURED_AGENT_SESSION_IDLE_MS = 30 * 60_000
+
+export type StructuredAgentSessionIdleSweepDeps = {
+  sessions: ReadonlyMap<string, StructuredAgentSessionHostSession> & {
+    lastActivityAt: (sessionId: string) => number | undefined
+    touch: (sessionId: string) => void
+  }
+  serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
+  now: () => number
+  isDisposed: () => boolean
+  deliveryActive: (sessionId: string) => boolean
+  backgroundTaskState: (sessionId: string) => AgentSessionBackgroundTaskState | null | undefined
+  /** An orchestration dispatch that still owns this session's worker; derived from its database. */
+  hasOpenDispatch: (sessionId: string) => boolean
+  /** Each of these runs inside the session's serialize and never takes it again. */
+  stopAgent: (sessionId: string) => Promise<void>
+  stopStartingAgent: (sessionId: string) => Promise<void>
+  closeConversation: (sessionId: string) => Promise<boolean>
+  onError: (sessionId: string, error: unknown) => void
+  intervalMs?: number
+  idleMs?: number
+}
+
+/** A prompt the user has not answered. A subagent can raise one the lead turn cannot see. */
+export function hasPendingStructuredAgentSessionPrompt(
+  items: readonly AgentJournalRenderItem[]
+): boolean {
+  return items.some(
+    (item) =>
+      (item.body.kind === 'approval' || item.body.kind === 'question') &&
+      item.body.resolution.state === 'pending'
+  )
+}
+
+export class StructuredAgentSessionIdleSweep {
+  private timer: ReturnType<typeof setInterval> | null = null
+  private running = false
+
+  constructor(private readonly deps: StructuredAgentSessionIdleSweepDeps) {}
+
+  start(): void {
+    this.timer = setInterval(
+      () => void this.tick(),
+      this.deps.intervalMs ?? STRUCTURED_AGENT_SESSION_IDLE_SWEEP_INTERVAL_MS
+    )
+    // An idle sweep must never be the reason a process stays alive at quit.
+    this.timer.unref?.()
+  }
+
+  dispose(): void {
+    if (this.timer) {
+      clearInterval(this.timer)
+      this.timer = null
+    }
+  }
+
+  /** One pass over every open conversation. Sessions run concurrently, so one waiting behind a
+   *  locked start does not hold up the rest; a pass still running skips the next. */
+  async tick(): Promise<void> {
+    if (this.running || this.deps.isDisposed()) {
+      return
+    }
+    this.running = true
+    try {
+      await Promise.allSettled(
+        [...this.deps.sessions.keys()].map((sessionId) =>
+          this.deps
+            .serialize(sessionId, () => this.tickUnderSerialize(sessionId))
+            .catch((error: unknown) => this.deps.onError(sessionId, error))
+        )
+      )
+    } finally {
+      this.running = false
+    }
+  }
+
+  /** Re-derives everything inside the session's lock, so an accept already queued ahead is seen. */
+  private async tickUnderSerialize(sessionId: string): Promise<void> {
+    const session = this.deps.sessions.get(sessionId)
+    if (!session || this.deps.isDisposed()) {
+      return
+    }
+    // A stop that failed after the child was proven gone: finish it now, before the idle test, so
+    // the rows its settlement wrote cannot push the retry out. A message accepted since goes first.
+    if (
+      session.owesProviderChildWindDown !== undefined &&
+      !session.child &&
+      !this.queuedOrDelivering(sessionId, session)
+    ) {
+      await this.deps.stopAgent(sessionId)
+      return
+    }
+    // Owed work is activity, read every tick, so the agent gets a full window once it ends: a child
+    // can read done before the lead's wake-up turn writes anything.
+    if (session.child && session.child.phase !== 'starting' && this.owesWork(sessionId, session)) {
+      this.deps.sessions.touch(sessionId)
+      return
+    }
+    const lastActivityAt = this.deps.sessions.lastActivityAt(sessionId) ?? this.deps.now()
+    if (this.deps.now() - lastActivityAt < (this.deps.idleMs ?? STRUCTURED_AGENT_SESSION_IDLE_MS)) {
+      return
+    }
+    if (session.child) {
+      // A start that has been quiet this long is not coming: the host stops it, with its reason.
+      if (session.child.phase === 'starting') {
+        await this.deps.stopStartingAgent(sessionId)
+        return
+      }
+      await this.deps.stopAgent(sessionId)
+    }
+    await this.deps.closeConversation(sessionId)
+  }
+
+  private queuedOrDelivering(sessionId: string, session: StructuredAgentSessionHostSession) {
+    return (
+      this.deps.deliveryActive(sessionId) ||
+      session.journal.submissions().some(isQueuedAgentJournalSubmission)
+    )
+  }
+
+  /** Work the running child still owes. Scoped to the child: with none, nothing here can pin the
+   *  handle, and a leftover prompt or turn row is only history. */
+  private owesWork(sessionId: string, session: StructuredAgentSessionHostSession): boolean {
+    const items = session.journal.snapshot().items
+    return (
+      activeStructuredAgentSessionTurnId(items) !== null ||
+      this.queuedOrDelivering(sessionId, session) ||
+      agentChildWorkLiveness(this.deps.backgroundTaskState(sessionId)?.tasks) !== null ||
+      this.deps.hasOpenDispatch(sessionId) ||
+      hasPendingStructuredAgentSessionPrompt(items)
+    )
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-journal-append-options.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-journal-append-options.ts
index b35690c4e7d..e7ce667ed2b 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-journal-append-options.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-journal-append-options.ts
@@ -6,15 +6,16 @@
 
 import { agentJournalLinkageFields } from '../../../shared/agent-session-journal-producer'
 import type { JournalItemAppendOptions } from '../agent-session-journal/journal-store-contracts'
-import type { StructuredAgentSessionAppendOptions } from './structured-agent-session-event-sink'
+import type { StructuredAgentSessionItemAppendOptions } from './structured-agent-session-event-sink'
 
 export function structuredAgentSessionJournalAppendOptions(
   fence: number,
-  options: StructuredAgentSessionAppendOptions
+  options: StructuredAgentSessionItemAppendOptions
 ): JournalItemAppendOptions {
   return {
     fence,
     ...(options.observedAt === undefined ? {} : { observedAt: options.observedAt }),
+    turnScope: options.turnScope,
     ...agentJournalLinkageFields(options)
   }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-journal-handles.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-journal-handles.test.ts
index 1c9f271004c..f6ca0bc4a4e 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-journal-handles.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-journal-handles.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // Journal handle ownership across the wire layer.
 //
 // Every one of these sites is reached only when something has already gone
@@ -15,11 +16,7 @@ import { journalDatabaseFile } from '../agent-session-journal/journal-paths'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import { openAgentSessionJournalWithRecovery } from './agent-session-journal-recovery'
-import {
-  evictStructuredAgentSession,
-  STRUCTURED_AGENT_SESSION_EVICTION_STEPS,
-  type StructuredAgentSessionEvictionContext
-} from './structured-agent-session-eviction'
+import { closeStructuredAgentSessionConversationUnderSerialize } from './structured-agent-session-host-lifetime'
 import { tearDownStructuredAgentSessionHost } from './structured-agent-session-host-teardown'
 import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
 
@@ -73,29 +70,7 @@ function hostSession(journal: AgentSessionJournal): StructuredAgentSessionHostSe
   return {
     journal,
     params: {} as StructuredAgentSessionHostSession['params'],
-    fence: 1,
-    hasProviderChild: false,
-    providerChildPhase: 'ready',
-    acquisitionGeneration: null
-  }
-}
-
-function evictionContext(
-  overrides: Partial<StructuredAgentSessionEvictionContext>
-): StructuredAgentSessionEvictionContext {
-  return {
-    sessionId: SESSION,
-    hasProviderChild: false,
-    eventSink: {
-      drained: async () => ({ ok: true }) as const,
-      unbind: () => undefined,
-      close: () => undefined
-    } as unknown as StructuredAgentSessionEvictionContext['eventSink'],
-    adapter: {} as StructuredAgentSessionEvictionContext['adapter'],
-    forget: async () => undefined,
-    discardSink: () => undefined,
-    releaseLease: async () => undefined,
-    ...overrides
+    child: null
   }
 }
 
@@ -117,7 +92,7 @@ describe('site 6: recovery rehydration', () => {
       await seeded.appendItem(
         { provider: 'codex', threadId: SESSION, turnId: 'turn-1', ordinal },
         { kind: 'status', text: `seed-${ordinal}` },
-        { fence: 1 }
+        { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
       )
     }
     await seeded.close()
@@ -140,46 +115,44 @@ describe('site 6: recovery rehydration', () => {
   })
 })
 
-describe('sites 9 and 10: the delete and overwrite callbacks', () => {
-  it('awaits the journal close before dropping the map entry', async () => {
+describe('sites 9 and 10: closing a conversation handle', () => {
+  it('drops the map entry before the close, and releases the handle', async () => {
     const journal = await journals.open({ identity: IDENTITY, journalDir })
     const sessions = new Map([[SESSION, hostSession(journal)]])
     const order: string[] = []
+    const close = journal.close.bind(journal)
+    journal.close = async () => {
+      // A lock-free reader arriving now must find no entry, never a closing handle.
+      order.push(sessions.has(SESSION) ? 'close-while-indexed' : 'close-after-delete')
+      await close()
+      order.push('closed')
+    }
 
-    await evictStructuredAgentSession(
-      evictionContext({
-        forget: async () => {
-          order.push('close-started')
-          await sessions.get(SESSION)?.journal.close()
-          order.push('closed')
-          sessions.delete(SESSION)
-          order.push('forgotten')
-        }
-      }),
-      STRUCTURED_AGENT_SESSION_EVICTION_STEPS
-    )
+    await expect(
+      closeStructuredAgentSessionConversationUnderSerialize(
+        { sessions, closeStatus: () => order.push('status') },
+        SESSION
+      )
+    ).resolves.toBe(true)
 
-    expect(order).toEqual(['close-started', 'closed', 'forgotten'])
+    expect(order).toEqual(['status', 'close-after-delete', 'closed'])
     expect(sessions.size).toBe(0)
     await expectNothingHoldsTheDirectory(journalDir)
   })
 
-  it('aborts the eviction with the session still indexed when the close rejects', async () => {
+  it('surfaces a rejected close to its caller', async () => {
     const journal = await journals.open({ identity: IDENTITY, journalDir })
     const sessions = new Map([[SESSION, hostSession(journal)]])
+    const close = journal.close.bind(journal)
+    journal.close = () => Promise.reject(new Error('close rejected'))
 
     await expect(
-      evictStructuredAgentSession(
-        evictionContext({
-          forget: async () => {
-            await Promise.reject(new Error('close rejected'))
-          }
-        }),
-        STRUCTURED_AGENT_SESSION_EVICTION_STEPS
+      closeStructuredAgentSessionConversationUnderSerialize(
+        { sessions, closeStatus: () => undefined },
+        SESSION
       )
-    ).rejects.toMatchObject({ step: 'forget-session' })
-    // Still indexed, so the next close is a real retry.
-    expect(sessions.has(SESSION)).toBe(true)
+    ).rejects.toThrow('close rejected')
+    journal.close = close
   })
 })
 
@@ -242,9 +215,13 @@ describe('site 11: host teardown is failure-complete', () => {
     const failing = sessions.get(SESSION)
     const closeError = new Error('close rejected')
     if (failing) {
-      failing.journal = {
-        close: () => Promise.reject(closeError)
-      } as unknown as AgentSessionJournal
+      sessions.set(SESSION, {
+        ...failing,
+        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: teardown calls only `close`, and this map is a plain `Map` that binds no delivery.
+        journal: {
+          close: () => Promise.reject(closeError)
+        } as unknown as AgentSessionJournal
+      })
     }
 
     await expect(
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-late-settlement.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-late-settlement.test.ts
index 1874f7ee1c6..8a43b1a8eff 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-late-settlement.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-late-settlement.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -24,6 +25,8 @@ import {
   hostTestOperationId,
   resetHostTestOperationIds
 } from './structured-agent-session-host-test-data'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
 
 const CALLER = { callerKey: 'client-1' }
 
@@ -60,8 +63,8 @@ function sendParams(text: string): {
   }
 }
 
-function submissions(): unknown {
-  const state = host.history({ sessionId: SESSION, direction: 'tail' })
+async function submissions(): Promise<unknown> {
+  const state = await host.history({ sessionId: SESSION, direction: 'tail' })
   return state.ok ? state.page.submissions : null
 }
 
@@ -71,6 +74,18 @@ function journal(): AgentSessionJournal {
   ).sessions.get(SESSION)!.journal
 }
 
+/** A send is accepted first; this waits for the delivery loop to hand it to the provider. */
+async function handedOver(clientMessageId: string): Promise<void> {
+  await vi.waitFor(async () => {
+    expect(
+      journal()
+        .submissions()
+        .find((entry) => entry.clientMessageId === clientMessageId)?.handedOverAt
+    ).toBeDefined()
+    expect(dispatch).toHaveBeenCalled()
+  })
+}
+
 beforeEach(async () => {
   root = await mkdtemp(join(tmpdir(), 'orca-wire-late-settle-'))
   resetHostTestOperationIds()
@@ -126,14 +141,14 @@ describe('settling a send the provider proves it received after the ack window',
         })
     )
     const events: AgentSessionSubscribeEvent[] = []
-    const unsubscribe = host.subscribe({
+    const unsubscribe = await host.subscribe({
       id: 'late-receipt',
       sessionId: SESSION,
       emit: (event) => events.push(event)
     })
     const params = sendParams('echo before send completes')
     const pending = host.send(CALLER, params)
-    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledTimes(1))
+    await vi.waitFor(async () => expect(dispatch).toHaveBeenCalledTimes(1))
     try {
       await host.settleLateDispatch({
         sessionId: SESSION,
@@ -152,10 +167,13 @@ describe('settling a send the provider proves it received after the ack window',
       finishDispatch({ state: 'unknown', reason: 'ack timeout' })
       unsubscribe()
     }
-    await expect(pending).resolves.toMatchObject({
-      ok: true,
-      value: { submission: { dispatchState: 'accepted' } }
-    })
+    await expect(pending).resolves.toMatchObject({ ok: true })
+    // The late `unknown` from the handover does not reopen the proven acceptance.
+    await vi.waitFor(async () =>
+      expect(await submissions()).toMatchObject([
+        { clientMessageId: params.envelope.clientOperationId, dispatchState: 'accepted' }
+      ])
+    )
     await expect(host.send(CALLER, { ...params, retryUnknown: true })).resolves.toMatchObject({
       ok: true,
       value: { submission: { dispatchState: 'accepted' } }
@@ -167,6 +185,10 @@ describe('settling a send the provider proves it received after the ack window',
     dispatch.mockResolvedValueOnce({ state: 'unknown', reason: 'ack timeout' })
     const params = sendParams('received just before shutdown')
     await host.send(CALLER, params)
+    await handedOver(params.envelope.clientOperationId)
+    await vi.waitFor(async () =>
+      expect(await submissions()).toMatchObject([{ dispatchState: 'unknown' }])
+    )
     let settlement: Promise<void> | undefined
     closeSession.mockImplementationOnce(async () => {
       settlement = host.settleLateDispatch({
@@ -181,15 +203,18 @@ describe('settling a send the provider proves it received after the ack window',
     await host.close(SESSION)
     await expect(settlement).resolves.toBeUndefined()
     await host.revealSession(SESSION)
-    expect(submissions()).toMatchObject([{ dispatchState: 'accepted' }])
+    expect(await submissions()).toMatchObject([{ dispatchState: 'accepted' }])
     expect(dispatch).toHaveBeenCalledTimes(1)
   })
 
   it('moves a durable unknown to accepted so nothing offers to send it again', async () => {
     dispatch.mockRejectedValueOnce(new Error('socket closed'))
     const params = sendParams('sent while a turn was running')
-    const first = await host.send(CALLER, params)
-    expect(first).toMatchObject({ ok: true, value: { submission: { dispatchState: 'unknown' } } })
+    await host.send(CALLER, params)
+    await handedOver(params.envelope.clientOperationId)
+    await vi.waitFor(async () =>
+      expect(await submissions()).toMatchObject([{ dispatchState: 'unknown' }])
+    )
 
     await host.settleLateDispatch({
       sessionId: SESSION,
@@ -197,7 +222,7 @@ describe('settling a send the provider proves it received after the ack window',
       providerIdentity: { provider: 'claude', sessionId: THREAD, uuid: 'late-uuid' }
     })
 
-    expect(submissions()).toMatchObject([
+    expect(await submissions()).toMatchObject([
       { clientMessageId: params.envelope.clientOperationId, dispatchState: 'accepted' }
     ])
     // The point of the fix: the client stops rendering Retry, and Retry is what
@@ -209,19 +234,21 @@ describe('settling a send the provider proves it received after the ack window',
     dispatch.mockResolvedValueOnce({ state: 'admitted' })
     const params = sendParams('queued behind the active turn')
     await host.send(CALLER, params)
+    await handedOver(params.envelope.clientOperationId)
 
     await host.settleLateDispatch({
       sessionId: SESSION,
       clientMessageId: params.envelope.clientOperationId,
       state: 'rejected',
-      reason: DISPATCH_REJECTED_CANCELLED
+      ...agentSessionFailureWords(agentSessionFailureFact('cancelled'), { surface: 'rejection' })
     })
 
-    expect(submissions()).toMatchObject([
+    expect(await submissions()).toMatchObject([
       {
         clientMessageId: params.envelope.clientOperationId,
         dispatchState: 'rejected',
-        reason: DISPATCH_REJECTED_CANCELLED
+        reason: DISPATCH_REJECTED_CANCELLED,
+        rejection: { kind: 'cancelled' }
       }
     ])
   })
@@ -230,6 +257,7 @@ describe('settling a send the provider proves it received after the ack window',
     dispatch.mockResolvedValueOnce({ state: 'admitted' })
     const params = sendParams('settle from provider echo')
     await host.send(CALLER, params)
+    await handedOver(params.envelope.clientOperationId)
     vi.spyOn(journal(), 'resolveDispatch').mockRejectedValueOnce(
       new Error('direct settlement write failed')
     )
@@ -244,10 +272,13 @@ describe('settling a send the provider proves it received after the ack window',
     await journal().appendItem(
       { provider: 'claude', sessionId: THREAD, uuid: 'echo-row' },
       params.body,
-      { fence: store.getRecord(SESSION)?.lease.runtimeFence ?? 1 }
+      {
+        fence: store.getRecord(SESSION)?.lease.runtimeFence ?? 1,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      }
     )
 
-    expect(submissions()).toMatchObject([
+    expect(await submissions()).toMatchObject([
       {
         clientMessageId: params.envelope.clientOperationId,
         dispatchState: 'accepted',
@@ -259,6 +290,9 @@ describe('settling a send the provider proves it received after the ack window',
   it('leaves an already accepted send alone', async () => {
     const params = sendParams('ordinary send')
     await host.send(CALLER, params)
+    await vi.waitFor(async () =>
+      expect(await submissions()).toMatchObject([{ dispatchState: 'accepted' }])
+    )
 
     await host.settleLateDispatch({
       sessionId: SESSION,
@@ -266,7 +300,7 @@ describe('settling a send the provider proves it received after the ack window',
       providerIdentity: { provider: 'claude', sessionId: THREAD, uuid: 'a-different-uuid' }
     })
 
-    expect(submissions()).toMatchObject([
+    expect(await submissions()).toMatchObject([
       { clientMessageId: params.envelope.clientOperationId, dispatchState: 'accepted' }
     ])
   })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-launch-send-after-create.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-launch-send-after-create.test.ts
index 300f1423cb3..cd26b96e5cd 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-launch-send-after-create.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-launch-send-after-create.test.ts
@@ -57,12 +57,19 @@ async function launchAndDeliver(): Promise<{
     text: 'fix the failing test'
   })
   const sent = await send.mock.results[0]!.value
-  return {
-    messageId,
-    dispatchState: sent.ok
-      ? sent.value.submission.dispatchState
-      : `refused:${sent.refusal.code}:${sent.refusal.message}`
+  if (!sent.ok) {
+    return { messageId, dispatchState: `refused:${sent.refusal.code}:${sent.refusal.message}` }
   }
+  // Accepted first; the delivery loop hands it over, and that outcome is what reached the agent.
+  let dispatchState = sent.value.submission.dispatchState
+  await vi.waitFor(async () => {
+    dispatchState =
+      (await host.journalSnapshot(created.value.sessionId)).submissions.find(
+        (entry) => entry.clientMessageId === sent.value.clientMessageId
+      )?.dispatchState ?? 'missing'
+    expect(dispatchState).not.toBe('pending')
+  })
+  return { messageId, dispatchState }
 }
 
 beforeEach(() => {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-lease-release.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-lease-release.ts
index bacc56fbcaf..fe584a50fce 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-lease-release.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-lease-release.ts
@@ -51,7 +51,7 @@ export async function releaseStoredStructuredAgentSessionOwnerAfterUnexpectedExi
   acquisitionGeneration: string | null
   now: number
   exitObservedAt?: number
-  settlementRetry?: { settlementId: string; detail: string }
+  exitReason?: string
 }): Promise<AgentSessionRecord> {
   if (input.acquisitionGeneration !== input.expectedAcquisitionGeneration) {
     throw new Error('agent_session_checkpoint_stale')
@@ -69,6 +69,6 @@ export async function releaseStoredStructuredAgentSessionOwnerAfterUnexpectedExi
     expectedFence: input.expectedFence,
     now: input.now,
     exitObservedAt: input.exitObservedAt,
-    ...(input.settlementRetry ? { settlementRetry: input.settlementRetry } : {})
+    ...(input.exitReason ? { exitReason: input.exitReason } : {})
   })
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.test.ts
index f969e3c0bbf..9545e42b051 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.test.ts
@@ -190,11 +190,36 @@ describe('structured agent-session lease renewal', () => {
         { timeout: 5000 }
       )
     } finally {
-      renewer.stop()
+      await renewer.stop()
       vi.useRealTimers()
     }
   })
 
+  it('stops only once a renewal already in flight has finished writing', async () => {
+    const store = await liveStore()
+    let releaseProbe = (): void => {}
+    const probing = new Promise<void>((resolve) => {
+      releaseProbe = resolve
+    })
+    const renewer = new StructuredAgentSessionLeaseRenewer({
+      store,
+      probe: async () => {
+        await probing
+        return { outcome: 'identity-matched', matchedOn: ['process-start-time'] }
+      },
+      now: () => NOW + 10_000
+    })
+
+    void renewer.renewNow()
+    // Nothing has been written yet: the tick is parked in its probe.
+    expect(store.getRecord('session-renewal')?.lease.lastRenewedAt).toBe(NOW)
+    const stopped = renewer.stop()
+    releaseProbe()
+    await stopped
+
+    expect(store.getRecord('session-renewal')?.lease.lastRenewedAt).toBe(NOW + 10_000)
+  })
+
   it('renews every live owner only after re-proving its child identity', async () => {
     const store = await liveStore()
     const probe = vi.fn(async () => ({
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.ts
index f1e5ca98305..a61e11b6f4f 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.ts
@@ -10,6 +10,9 @@ const RENEW_INTERVAL_MS = Math.floor(AGENT_SESSION_LEASE_TTL_MS / 3)
 export class StructuredAgentSessionLeaseRenewer {
   private timer: ReturnType<typeof setInterval> | null = null
   private running = false
+  /** The tick in flight. Never rejects: the timer path reports renewal failures through `onError`,
+   *  and stopping must not turn one into a teardown failure as well. */
+  private inFlight: Promise<void> = Promise.resolve()
 
   constructor(
     private readonly input: {
@@ -32,71 +35,81 @@ export class StructuredAgentSessionLeaseRenewer {
     this.timer.unref?.()
   }
 
-  stop(): void {
+  /** Clearing the interval only stops the NEXT tick. A tick already past its guard still has a
+   *  store transaction to commit, and that transaction re-creates the store directory, so a stop
+   *  that returned before it landed would let the write outlive whatever tore the host down. */
+  stop(): Promise<void> {
     if (this.timer) {
       clearInterval(this.timer)
       this.timer = null
     }
+    return this.inFlight
   }
 
-  async renewNow(): Promise<void> {
+  renewNow(): Promise<void> {
     if (this.running) {
-      return
+      return this.inFlight
     }
     this.running = true
-    try {
-      const records = this.input.store.listRecords().filter(
-        (record) =>
-          !record.lease.unreconciled &&
-          record.lease.claimStatus === 'live' &&
-          record.lease.ownerProcess !== null &&
-          // A record parked in recovery has no transport the host can vouch for; renewing it
-          // keeps an orphan pid's lease reading as a healthy owner.
-          record.lease.handoffStage !== 'recovering' &&
-          record.lease.handoffStage !== 'manual-recovery'
-      )
-      const probes = await this.probe(records)
-      const renewals: {
-        sessionId: string
-        fence: number
-        childProbe: AgentSessionOwnerProbe
-        now: number
-      }[] = []
-      const now = this.input.now()
-      for (const record of records) {
-        const probe = probes.get(record.sessionId)
-        if (!probe) {
-          continue
-        }
-        renewals.push({
-          sessionId: record.sessionId,
-          fence: record.lease.runtimeFence,
-          childProbe: probe,
-          now
-        })
-      }
-      // The store persists the whole record file per transaction, so keep the healthy path to
-      // one commit. If one renewal is superseded, retrying individually preserves isolation.
-      let results: PromiseSettledResult<AgentSessionRecord>[]
-      try {
-        const renewed = await this.input.store.renewLeases(renewals)
-        results = renewed.map((record) => ({ status: 'fulfilled', value: record }) as const)
-      } catch {
-        results = await Promise.allSettled(
-          renewals.map((renewal) => this.input.store.renewLease(renewal))
-        )
-      }
-      results.forEach((result, index) => {
-        if (result.status === 'rejected') {
-          const renewal = renewals[index]
-          if (renewal) {
-            this.input.onError?.({ sessionId: renewal.sessionId, error: result.reason })
-          }
-        }
-      })
-    } finally {
+    const attempt = this.renewOnce().finally(() => {
       this.running = false
+    })
+    this.inFlight = attempt.then(
+      () => undefined,
+      () => undefined
+    )
+    return attempt
+  }
+
+  private async renewOnce(): Promise<void> {
+    const records = this.input.store.listRecords().filter(
+      (record) =>
+        !record.lease.unreconciled &&
+        record.lease.claimStatus === 'live' &&
+        record.lease.ownerProcess !== null &&
+        // A record parked in recovery has no transport the host can vouch for; renewing it
+        // keeps an orphan pid's lease reading as a healthy owner.
+        record.lease.handoffStage !== 'recovering'
+    )
+    const probes = await this.probe(records)
+    const renewals: {
+      sessionId: string
+      fence: number
+      childProbe: AgentSessionOwnerProbe
+      now: number
+    }[] = []
+    const now = this.input.now()
+    for (const record of records) {
+      const probe = probes.get(record.sessionId)
+      if (!probe) {
+        continue
+      }
+      renewals.push({
+        sessionId: record.sessionId,
+        fence: record.lease.runtimeFence,
+        childProbe: probe,
+        now
+      })
     }
+    // The store persists the whole record file per transaction, so keep the healthy path to
+    // one commit. If one renewal is superseded, retrying individually preserves isolation.
+    let results: PromiseSettledResult<AgentSessionRecord>[]
+    try {
+      const renewed = await this.input.store.renewLeases(renewals)
+      results = renewed.map((record) => ({ status: 'fulfilled', value: record }) as const)
+    } catch {
+      results = await Promise.allSettled(
+        renewals.map((renewal) => this.input.store.renewLease(renewal))
+      )
+    }
+    results.forEach((result, index) => {
+      if (result.status === 'rejected') {
+        const renewal = renewals[index]
+        if (renewal) {
+          this.input.onError?.({ sessionId: renewal.sessionId, error: result.reason })
+        }
+      }
+    })
   }
 
   private async probe(
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-legacy-handoff-record.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-legacy-handoff-record.test.ts
index 42ffe172cd7..213126fb5eb 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-legacy-handoff-record.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-legacy-handoff-record.test.ts
@@ -25,12 +25,18 @@ import {
 
 const CALLER = { callerKey: 'client-1' }
 
+/** Delivery runs on its own serialized steps; under a loaded runner they take more than a second. */
+function eventually(assertion: () => void | Promise<void>): Promise<void> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
+
 let root: string
 let store: AgentSessionRecordStore
 let host: StructuredAgentSessionHost
 let acquire: Mock<StructuredAgentSessionAdapter['acquire']>
 let probe: Mock<() => Promise<AgentSessionOwnerProbe>>
 let stopOwnerProcess: Mock<(pid: number, signal: 'SIGTERM' | 'SIGKILL') => void>
+let dispatch: Mock<StructuredAgentSessionAdapter['dispatch']>
 
 function openHost(): void {
   host = new StructuredAgentSessionHost({
@@ -39,7 +45,7 @@ function openHost(): void {
       acquire,
       closeSession: vi.fn(async () => true),
       releaseAcquisition: vi.fn(async () => true),
-      dispatch: vi.fn(async () => ({ state: 'admitted' as const })),
+      dispatch,
       cancelTurn: vi.fn(async () => ({ cancelled: false })),
       answerPrompt: vi.fn(async () => undefined),
       setOption: vi.fn(async () => undefined)
@@ -54,7 +60,13 @@ function openHost(): void {
 }
 
 /** Writes the lease an older build left behind, then starts a fresh app generation over it. */
-async function persistFromOlderBuild(lease: Partial<PersistedAgentSessionLease>): Promise<void> {
+/** Older builds also wrote the retired settlement latch fields. */
+type OlderBuildLease = Partial<PersistedAgentSessionLease> & {
+  settlementRetryRequired?: boolean
+  settlementRetryId?: string
+}
+
+async function persistFromOlderBuild(lease: OlderBuildLease): Promise<void> {
   expect(await host.attach(CALLER, hostTestAttachParams(null))).toMatchObject({ ok: true })
   const attached = store.getRecord(SESSION)?.lease
   await host.flushAllStreamedEvents()
@@ -65,6 +77,23 @@ async function persistFromOlderBuild(lease: Partial<PersistedAgentSessionLease>)
   openHost()
 }
 
+/** A send is accepted at once; what became of it is the submission's state once the host's
+ *  delivery settles it — handed over, or rejected with the reason the chat shows. */
+async function delivered(text: string) {
+  const sent = await send(text)
+  expect(sent).toMatchObject({ ok: true })
+  const clientMessageId = sent.ok ? sent.value.clientMessageId : ''
+  const submission = async () =>
+    (await host.journalSnapshot(SESSION)).submissions.find(
+      (candidate) => candidate.clientMessageId === clientMessageId
+    )
+  await eventually(async () => {
+    const current = await submission()
+    expect(current?.dispatchState !== 'pending' || current?.handedOverAt !== undefined).toBe(true)
+  })
+  return submission()
+}
+
 async function send(text: string) {
   const body = hostTestMessage(text)
   return host.send(CALLER, {
@@ -87,6 +116,7 @@ beforeEach(async () => {
   resetHostTestOperationIds()
   probe = vi.fn(async () => ({ outcome: 'pid-absent' as const }))
   stopOwnerProcess = vi.fn()
+  dispatch = vi.fn(async () => ({ state: 'admitted' as const }))
   acquire = vi.fn(async ({ fence, spawnToken }) => ({
     process: { hostId: 'local', pid: 4242, processStartTimeMs: NOW - 1_000, spawnToken },
     link: {
@@ -134,10 +164,11 @@ describe('a record an older build left mid terminal handoff', () => {
 
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       handoffStage: null,
-      handoffOperationId: null,
-      settlementRetryRequired: undefined
+      handoffOperationId: null
     })
-    expect(await send('after the upgrade')).toMatchObject({ ok: true })
+    expect(store.getRecord(SESSION)?.lease).not.toHaveProperty('settlementRetryRequired')
+    expect(await delivered('after the upgrade')).toMatchObject({ dispatchState: 'pending' })
+    expect(dispatch).toHaveBeenCalledOnce()
     expect(acquire).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       runtimeKind: 'native',
@@ -169,7 +200,8 @@ describe('a record an older build left mid terminal handoff', () => {
       handoffStage: null,
       handoffOperationId: null
     })
-    expect(await send('after the upgrade')).toMatchObject({ ok: true })
+    expect(await delivered('after the upgrade')).toMatchObject({ dispatchState: 'pending' })
+    expect(dispatch).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({ claimStatus: 'live' })
   })
 
@@ -188,7 +220,8 @@ describe('a record an older build left mid terminal handoff', () => {
       handoffStage: null,
       claimStatus: 'released'
     })
-    expect(await send('after the upgrade')).toMatchObject({ ok: true })
+    expect(await delivered('after the upgrade')).toMatchObject({ dispatchState: 'pending' })
+    expect(dispatch).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       runtimeKind: 'native',
       claimStatus: 'live'
@@ -208,21 +241,40 @@ describe('a record an older build left mid terminal handoff', () => {
 
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       claimStatus: 'conflicted',
-      handoffStage: 'manual-recovery'
+      handoffStage: 'recovering'
     })
-    expect(await send('while the terminal still runs')).toMatchObject({
+    // Sending and opening the chat both say what frees it: quitting that terminal agent. A send is
+    // accepted, then rejected by the start that cannot take the lease, and the chat's row says why,
+    // worded from the refusal's details; only the live refusal names the process.
+    const quitTerminal =
+      'This chat is still open in a terminal agent (process 4242). Quit that agent to continue the chat here.'
+    expect(await delivered('while the terminal still runs')).toMatchObject({
+      dispatchState: 'rejected'
+    })
+    expect(
+      (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+        item.body.kind === 'status' && item.body.tone === 'error' ? [item.body.text] : []
+      )
+    ).toEqual([
+      "Codex couldn't restart. This chat is still open in a terminal agent. Quit that agent to continue the chat here."
+    ])
+    const fence = store.getRecord(SESSION)?.lease.runtimeFence ?? null
+    expect(await host.attach(CALLER, hostTestAttachParams(fence))).toMatchObject({
       ok: false,
-      refusal: { code: 'agent_session_conflict' }
+      refusal: { code: 'agent_session_conflict', message: quitTerminal }
     })
+    expect(dispatch).not.toHaveBeenCalled()
     expect(stopOwnerProcess).not.toHaveBeenCalled()
     expect(acquire).not.toHaveBeenCalled()
 
-    // The user closes the terminal; the next open proves it gone and the chat takes over.
+    // The user closes the terminal; the next send's start proves it gone and the chat takes over.
     probe.mockResolvedValue({ outcome: 'pid-absent' })
-    await host.hold(SESSION, 'surface-1')
 
     expect(stopOwnerProcess).not.toHaveBeenCalled()
-    expect(await send('after the terminal closed')).toMatchObject({ ok: true })
+    expect(await delivered('after the terminal closed')).toMatchObject({
+      dispatchState: 'pending'
+    })
+    expect(dispatch).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       runtimeKind: 'native',
       claimStatus: 'live',
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-main-agent-working-agreement.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-main-agent-working-agreement.test.ts
new file mode 100644
index 00000000000..95861c81f29
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-main-agent-working-agreement.test.ts
@@ -0,0 +1,232 @@
+// The chat's own Stop and every session list read whether the main agent is working through one
+// rule, but over two copies of the host's journal: the chat reduces its stream, and a list reads the
+// status feed. Both leave the host from one publication edge, so once each has landed they must say
+// the same thing. Against the real host, store, journal, stream and status feed.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import type { AgentSessionBackgroundTaskState } from '../../../shared/agent-session-background-task-wire'
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalItemBody
+} from '../../../shared/agent-session-journal-types'
+import type { AgentSessionStatusSummary } from '../../../shared/agent-session-wire'
+import { structuredAgentSessionAgentStatus } from '../../../shared/structured-agent-session-agent-status'
+import { activeStructuredAgentSessionTurnId } from '../../../shared/structured-agent-session-live-turn'
+import { isStructuredAgentSessionMainAgentWorking } from '../../../shared/structured-agent-session-main-agent-working'
+import {
+  EMPTY_STRUCTURED_AGENT_SESSION,
+  reduceStructuredAgentSession,
+  type StructuredAgentSessionState
+} from '../../../shared/structured-agent-session-reducer'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import type { StructuredAgentSessionEventSink } from './structured-agent-session-event-sink'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+const CALLER = { callerKey: 'client-1' }
+const PROVIDER_ROW = { provider: 'codex' as const, threadId: THREAD, turnId: 'turn-1' }
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let dispatch: Mock<StructuredAgentSessionAdapter['dispatch']>
+let events: StructuredAgentSessionEventSink | undefined
+let backgroundTasks: AgentSessionBackgroundTaskState | null
+let chat: StructuredAgentSessionState
+let listed: AgentSessionStatusSummary | undefined
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-main-agent-working-'))
+  resetHostTestOperationIds()
+  events = undefined
+  backgroundTasks = null
+  chat = EMPTY_STRUCTURED_AGENT_SESSION
+  listed = undefined
+  // Written, and the provider has neither opened a turn for it nor answered it.
+  dispatch = vi.fn(async () => ({ state: 'admitted' as const }))
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: {
+      acquire: async (input) => {
+        events = input.events
+        return {
+          process: {
+            hostId: 'local',
+            pid: 4242,
+            processStartTimeMs: 1_700_000_000_000,
+            spawnToken: input.spawnToken
+          },
+          acquisitionGeneration: 'generation-1',
+          link: {
+            linkId: `link-${input.fence}`,
+            handle: { provider: 'codex' as const, threadId: THREAD },
+            origin: 'created' as const,
+            mintedAtFence: input.fence,
+            observedAt: NOW
+          }
+        }
+      },
+      dispatch,
+      awaitStarted: vi.fn(async () => undefined),
+      closeSession: vi.fn(async () => true),
+      releaseAcquisition: vi.fn(async () => true),
+      cancelTurn: vi.fn(async () => ({ cancelled: true })),
+      answerPrompt: vi.fn(async () => undefined),
+      setOption: vi.fn(async () => undefined),
+      backgroundTaskState: () => backgroundTasks
+    },
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-1',
+    now: () => NOW
+  })
+  expect(await host.attach(CALLER, hostTestAttachParams(null))).toMatchObject({ ok: true })
+  host.subscribe({
+    id: 'chat-1',
+    sessionId: SESSION,
+    emit: (event) => {
+      chat = reduceStructuredAgentSession(chat, { type: 'event', event: structuredClone(event) })
+    }
+  })
+  host.subscribeStatus({
+    id: 'list-1',
+    emit: (event) => {
+      if (event.type === 'status' && event.session.sessionId === SESSION) {
+        listed = structuredClone(event.session)
+      } else if (event.type === 'snapshot') {
+        listed = event.sessions.find((session) => session.sessionId === SESSION) ?? listed
+      }
+    }
+  })
+})
+
+afterEach(async () => {
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+async function send(text: string): Promise<string> {
+  const body = hostTestMessage(text)
+  const clientOperationId = hostTestOperationId()
+  expect(
+    await host.send(CALLER, {
+      envelope: {
+        sessionId: SESSION,
+        clientOperationId,
+        expectedRuntimeFence: 1,
+        payloadFingerprint: computeAgentSessionPayloadFingerprint({
+          method: 'agentSession.send',
+          sessionId: SESSION,
+          fields: { body }
+        })
+      },
+      body
+    })
+  ).toMatchObject({ ok: true })
+  return clientOperationId
+}
+
+async function provider(ordinal: number, body: AgentJournalItemBody): Promise<void> {
+  events!.appendItem({ ...PROVIDER_ROW, ordinal }, body, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
+  events!.publish()
+  await host.flushStreamedEvents(SESSION)
+}
+
+/** What the chat's Stop reads: the transport state's rule over the chat's reduced stream. */
+function chatReadsWorking(): boolean {
+  return isStructuredAgentSessionMainAgentWorking(
+    activeStructuredAgentSessionTurnId(chat.items),
+    chat.submissions,
+    chat.fence
+  )
+}
+
+/** What a session list's row reads for the main agent, and the whole row, from the status feed. */
+function listReads(): { mainAgent: string; row: string } {
+  const summary = listed
+  if (!summary?.status) {
+    return { mainAgent: 'none', row: 'none' }
+  }
+  const status = structuredAgentSessionAgentStatus({ ...summary, status: summary.status })
+  return { mainAgent: status.mainAgent.state, row: status.state }
+}
+
+describe('the main agent read by the chat and by a session list', () => {
+  it('agrees while a rate-limited request retries with no turn open', async () => {
+    const id = await send('hello')
+    await vi.waitFor(async () =>
+      expect((await host.journalSnapshot(SESSION)).submissions[0]?.handedOverAt).toBeDefined()
+    )
+    // What Claude writes for an HTTP 429 retry: a status row, no echo, no turn.
+    await provider(1, { kind: 'status', text: 'rate_limit', tone: 'error' })
+    await provider(2, { kind: 'status', text: 'rate_limit', tone: 'error' })
+
+    expect(chat.submissions.map((submission) => submission.clientMessageId)).toEqual([id])
+    expect(activeStructuredAgentSessionTurnId(chat.items)).toBeNull()
+    expect(chatReadsWorking()).toBe(true)
+    expect(listReads().mainAgent).toBe('working')
+  })
+
+  it('agrees once the handed-over message is answered and only a subagent still runs', async () => {
+    dispatch.mockResolvedValueOnce({
+      state: 'accepted',
+      providerIdentity: { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 0 }
+    })
+    await send('fan out')
+    await vi.waitFor(async () =>
+      expect((await host.journalSnapshot(SESSION)).submissions[0]?.dispatchState).toBe('accepted')
+    )
+    await provider(1, { kind: 'turn', turnId: 'turn-1', state: 'running' })
+    expect(chatReadsWorking()).toBe(true)
+    expect(listReads().mainAgent).toBe('working')
+
+    await provider(1, { kind: 'turn', turnId: 'turn-1', state: 'completed', outcome: 'success' })
+    backgroundTasks = {
+      state: 'monitoring',
+      tasks: [{ id: 'task-1', kind: 'agent', name: 'deep_review', state: 'working' }]
+    }
+    host.publishBackgroundTaskState(SESSION)
+    await host.flushStreamedEvents(SESSION)
+
+    expect(chat.backgroundTasks?.tasks).toHaveLength(1)
+    // The row reads Working for the subagent; the main agent, and so Stop, does not.
+    expect(listReads()).toEqual({ mainAgent: 'done', row: 'working' })
+    expect(chatReadsWorking()).toBe(false)
+  })
+
+  it('agrees when the child that was handed the message exits', async () => {
+    await send('hello')
+    await vi.waitFor(async () =>
+      expect((await host.journalSnapshot(SESSION)).submissions[0]?.handedOverAt).toBeDefined()
+    )
+    expect(chatReadsWorking()).toBe(true)
+
+    await host.handleAdapterEvent({
+      type: 'ended',
+      sessionId: SESSION,
+      fence: store.getRecord(SESSION)!.lease.runtimeFence,
+      acquisitionGeneration: 'generation-1',
+      reason: 'codex app-server crashed',
+      cause: 'unexpected-exit'
+    })
+    await host.flushStreamedEvents(SESSION)
+
+    expect(chat.fence).toBe(store.getRecord(SESSION)!.lease.runtimeFence)
+    expect(chatReadsWorking()).toBe(false)
+    expect(listReads().mainAgent).not.toBe('working')
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-admission.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-admission.ts
index 04001450621..6a623428e4f 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-admission.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-admission.ts
@@ -5,8 +5,8 @@
 //
 // Admission is two-phase for a call that brings a `prepareSession`. The ledger's
 // answer comes first and places nothing; a call it will admit may then give the
-// session an owner, and only after that are the row placed and the lease and
-// fence checked — against the lease as it stands once the owner is there.
+// session an owner, and only after that are the row placed and the lease
+// checked — against the lease as it stands once the owner is there.
 
 import {
   admitAgentSessionMutation,
@@ -15,10 +15,11 @@ import {
 } from '../../../shared/agent-session-mutation-envelope'
 import type { AgentSessionOperationDecision } from '../../../shared/agent-session-operation-ledger'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
-import type {
-  AgentSessionMutationEnvelope,
-  AgentSessionMutationResult,
-  AgentSessionWireRefusal
+import {
+  refuse,
+  type AgentSessionMutationEnvelope,
+  type AgentSessionMutationResult,
+  type AgentSessionWireRefusal
 } from '../../../shared/agent-session-wire'
 import { AGENT_SESSION_UNATTACHED_REFUSAL_CODE } from '../../../shared/structured-agent-session-read-refusal'
 import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
@@ -31,10 +32,11 @@ import type { AgentSessionTurnContext } from './structured-agent-session-turns'
 
 // The code is shared with the client so a read that refuses this way can be told apart from a
 // transcript that failed to load; the two must never drift apart.
-export const AGENT_SESSION_NOT_ATTACHED: AgentSessionWireRefusal = {
-  code: AGENT_SESSION_UNATTACHED_REFUSAL_CODE,
-  message: 'This host holds no attached session by that id.'
-}
+export const AGENT_SESSION_NOT_ATTACHED: AgentSessionWireRefusal = refuse(
+  AGENT_SESSION_UNATTACHED_REFUSAL_CODE,
+  { reason: 'sessionNotAttached' },
+  'This host holds no attached session by that id.'
+)
 
 export function refuseAgentSessionMutation(refusal: AgentSessionWireRefusal): {
   ok: false
@@ -44,7 +46,7 @@ export function refuseAgentSessionMutation(refusal: AgentSessionWireRefusal): {
 }
 
 export type AgentSessionMutationSessionPreparation =
-  | { ok: true; envelope: AgentSessionMutationEnvelope }
+  | { ok: true }
   | { ok: false; refusal: AgentSessionWireRefusal }
 
 export type AgentSessionMutationRequest<TValue> = {
@@ -56,8 +58,7 @@ export type AgentSessionMutationRequest<TValue> = {
   /** Journal of the attached session, read after `prepareSession`; absent when this host holds none. */
   journal: () => AgentSessionJournal | undefined
   /** Between the ledger's answer and the lease check, for a call that may first have to make the
-   *  session ready for itself. Answers with the envelope to admit — the caller's, or one moved
-   *  onto a fence the preparation itself published — or with the refusal that ends the call. */
+   *  session ready for itself. Answers with the refusal that ends the call, if any. */
   prepareSession?: (
     ledger: Exclude<AgentSessionOperationDecision['decision'], 'refused'>,
     record: AgentSessionRecord
@@ -71,8 +72,7 @@ export type AgentSessionMutationRequest<TValue> = {
 export async function admitAndRunAgentSessionMutation<TValue>(
   request: AgentSessionMutationRequest<TValue>
 ): Promise<AgentSessionMutationResult<TValue>> {
-  const { plan } = request
-  let { envelope } = request
+  const { plan, envelope } = request
   const hostFingerprint = computeAgentSessionPayloadFingerprint({
     method: plan.method,
     sessionId: envelope.sessionId,
@@ -98,7 +98,6 @@ export async function admitAndRunAgentSessionMutation<TValue>(
       if (!prepared.ok) {
         return prepared
       }
-      envelope = prepared.envelope
     }
   }
   const journal = request.journal()
@@ -110,7 +109,8 @@ export async function admitAndRunAgentSessionMutation<TValue>(
     envelope,
     hostFingerprint,
     now: request.now(),
-    ...(plan.operationIdScope ? { operationIdScope: plan.operationIdScope } : {})
+    ...(plan.operationIdScope ? { operationIdScope: plan.operationIdScope } : {}),
+    ...(plan.conversationWrite ? { conversationWrite: true } : {})
   })
   if (!admitted) {
     return refuseAgentSessionMutation(AGENT_SESSION_NOT_ATTACHED)
@@ -137,14 +137,15 @@ export async function admitAndRunAgentSessionMutation<TValue>(
       return { ok: true, replayed: true, fence, cursor: journal.cursor(), value: replay.value }
     }
     // Nothing durable landed, so this id is about to run for the first time. A
-    // refused call leaves its ledger row behind, and replaying past the lease and
-    // the fence would let a resend act under an owner that has since changed — so
-    // a first run pays the full admission price either way.
+    // refused call leaves its ledger row behind, and replaying past the lease
+    // would let a resend act with no live owner — so a first run pays the full
+    // admission price either way.
     const rerun = admitAgentSessionMutation({
       envelope,
       hostFingerprint,
       ledger: { decision: 'admit', row: admission.row },
-      lease: record.lease
+      lease: record.lease,
+      ...(plan.conversationWrite ? { conversationWrite: true } : {})
     })
     if (rerun.decision === 'refused') {
       return refuseAgentSessionMutation(rerun.refusal)
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-plans.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-plans.ts
index d8d2876d272..388fabd7bd4 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-plans.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-plans.ts
@@ -14,7 +14,13 @@ import type {
   AgentSessionPromptResult,
   AgentSessionSendResult
 } from '../../../shared/agent-session-wire'
+import type { AgentSessionConversationCommandResult } from '../../../shared/agent-session-conversation-command'
 import { DISPATCH_DOUBT_SUBMISSION_MISSING } from '../agent-session-journal/journal-dispatch-doubt-reasons'
+import { structuredAgentSessionPayloadFingerprint } from '../../../shared/structured-agent-session-mutation'
+import {
+  STRUCTURED_AGENT_SESSION_COMPACT_COMMAND,
+  structuredAgentSessionCompactBody
+} from './structured-agent-session-command-turn'
 import {
   performCancel,
   performPrompt,
@@ -23,13 +29,26 @@ import {
   type AgentSessionTurnContext,
   type TurnOutcome
 } from './structured-agent-session-turns'
+import type { AgentSessionPromptRequest } from './structured-agent-session-turns-prompt'
+import { queuedSendAnswer } from './structured-agent-session-queued-send-answer'
+
+/** The body-only hash: what the reducer recomputes to alias a provider echo
+ *  onto its submission, so the stored value must never include control fields. */
+function sendBodyFingerprint(sessionId: string, body: AgentJournalMessageItem): string {
+  return structuredAgentSessionPayloadFingerprint({
+    method: 'agentSession.send',
+    sessionId,
+    fields: { body }
+  })
+}
 
 export type MutationPlan<TValue> = {
   method: string
   fields: Record<string, unknown>
   operationIdScope?: 'global'
+  /** Admitted without the writer lease: see `admitAgentSessionMutation`. */
+  conversationWrite?: true
   markUnknownBeforeRun?: boolean
-  beforeRun?: () => void
   run: (ctx: AgentSessionTurnContext) => Promise<TurnOutcome<TValue>>
   replay: (ctx: AgentSessionTurnContext, outcome: AgentSessionOperationOutcome) => TValue | null
   rerunWhenReplayMissing?: (ctx: AgentSessionTurnContext) => boolean
@@ -41,6 +60,8 @@ export function sendPlan(params: {
   envelope: AgentSessionMutationEnvelope
   body: AgentJournalMessageItem
   retryUnknown?: true
+  delivery?: 'queue-if-active'
+  userSend?: true
   beforeRun?: () => void
 }): MutationPlan<AgentSessionSendResult> {
   // The operation id IS the client message id: one send, one durable row, one
@@ -49,20 +70,31 @@ export function sendPlan(params: {
   return {
     method: 'agentSession.send',
     operationIdScope: 'global',
+    conversationWrite: true,
     markUnknownBeforeRun: true,
-    // A control signal is not payload; it cannot alter durable replay.
-    fields: { body: params.body },
-    ...(params.beforeRun ? { beforeRun: params.beforeRun } : {}),
+    // `delivery` joins the OPERATION fingerprint only; the submission row keeps
+    // the body-only fingerprint the reducer's echo-aliasing recomputes.
+    fields: { body: params.body, ...(params.delivery ? { delivery: params.delivery } : {}) },
     recoverUnknownFromDurableState: true,
     // `retryUnknown` is a compatibility-only client signal. A recorded send
     // always replays and never reaches the provider twice.
-    run: (ctx) =>
-      performSend(ctx, {
+    run: (ctx) => {
+      // Asked at acceptance: a send accepted after this one is queued behind it.
+      params.beforeRun?.()
+      return performSend(ctx, {
+        origin: params.userSend ? 'client' : 'host',
         clientMessageId,
-        payloadFingerprint: params.envelope.payloadFingerprint,
+        payloadFingerprint: sendBodyFingerprint(params.envelope.sessionId, params.body),
         body: params.body
-      }),
+      })
+    },
     replay: (ctx, outcome) => {
+      // A send this host queued answers from its draft, then its hand-off; a
+      // withdrawn draft replays as spent — never as missing-submission doubt.
+      const queued = queuedSendAnswer(ctx.journal, clientMessageId)
+      if (queued) {
+        return queued
+      }
       const submission = ctx.journal
         .submissions()
         .find((entry) => entry.clientMessageId === clientMessageId)
@@ -91,17 +123,61 @@ export function sendPlan(params: {
   }
 }
 
+export type ConversationCommandAcceptance =
+  | { clientMessageId: string }
+  /** What an older build's run of this operation recorded. */
+  | { recorded: AgentSessionConversationCommandResult }
+
+/** `/compact` accepted like a send: one submission, keyed by the operation id, that the delivery
+ *  loop carries out as the command's own turn. */
+export function conversationCommandPlan(params: {
+  envelope: AgentSessionMutationEnvelope
+  priorRecord: () => AgentSessionConversationCommandResult | null
+}): MutationPlan<ConversationCommandAcceptance> {
+  const clientMessageId = params.envelope.clientOperationId
+  return {
+    method: 'agentSession.conversationCommand',
+    conversationWrite: true,
+    markUnknownBeforeRun: true,
+    fields: { command: STRUCTURED_AGENT_SESSION_COMPACT_COMMAND },
+    recoverUnknownFromDurableState: true,
+    run: async (ctx) => {
+      const sent = await performSend(ctx, {
+        clientMessageId,
+        // Only a client asks through the command RPC: the person's own turn.
+        origin: 'client',
+        payloadFingerprint: params.envelope.payloadFingerprint,
+        body: structuredAgentSessionCompactBody()
+      })
+      return sent.ok ? { ok: true, value: { clientMessageId } } : sent
+    },
+    replay: (ctx, outcome) => {
+      if (outcome.status === 'succeeded' && outcome.conversationCommand) {
+        return { recorded: outcome.conversationCommand }
+      }
+      if (ctx.journal.submissions().some((entry) => entry.clientMessageId === clientMessageId)) {
+        return { clientMessageId }
+      }
+      const prior = params.priorRecord()
+      return prior ? { recorded: prior } : null
+    }
+  }
+}
+
 export function cancelPlan(params: {
   envelope: AgentSessionMutationEnvelope
-  turnId: string
+  turnId?: string
   scope?: 'background-tasks'
   taskId?: string
   prompt?: { itemId: string; expectedRevision: number }
+  stopChild?: () => Promise<void>
 }): MutationPlan<AgentSessionCancelResult> {
   return {
     method: 'agentSession.cancel',
+    // Stop is a conversation write; a prompt or background-task cancel needs the live child.
+    ...(params.scope || params.prompt ? {} : { conversationWrite: true as const }),
     fields: {
-      turnId: params.turnId,
+      ...(params.turnId !== undefined ? { turnId: params.turnId } : {}),
       ...(params.scope ? { scope: params.scope } : {}),
       ...(params.taskId ? { taskId: params.taskId } : {}),
       ...(params.prompt ? { prompt: params.prompt } : {})
@@ -109,29 +185,32 @@ export function cancelPlan(params: {
     run: (ctx) =>
       performCancel(ctx, {
         clientOperationId: params.envelope.clientOperationId,
-        turnId: params.turnId,
+        ...(params.turnId !== undefined ? { turnId: params.turnId } : {}),
         ...(params.scope ? { scope: params.scope } : {}),
         ...(params.taskId ? { taskId: params.taskId } : {}),
-        ...(params.prompt ? { prompt: params.prompt } : {})
+        ...(params.prompt ? { prompt: params.prompt } : {}),
+        ...(params.stopChild ? { stopChild: params.stopChild } : {})
       }),
     // Interrupting twice would kill a turn the client never asked to stop, so a
-    // replay reports the turn as already handled instead.
-    replay: () => ({ turnId: params.turnId, cancelled: false })
+    // replay reports the turn as already handled.
+    replay: () => ({
+      ...(params.turnId !== undefined ? { turnId: params.turnId } : {}),
+      cancelled: false
+    })
   }
 }
 
-export function promptPlan(params: {
-  kind: 'approval' | 'question'
-  itemId: string
-  expectedRevision: number
-  optionId: string
-}): MutationPlan<AgentSessionPromptResult> {
+export function promptPlan(
+  params: AgentSessionPromptRequest
+): MutationPlan<AgentSessionPromptResult> {
   return {
     method: `agentSession.respondTo:${params.kind}`,
+    // The client hashes exactly what it sent; the absent one of these two drops out of the digest.
     fields: {
       itemId: params.itemId,
       expectedRevision: params.expectedRevision,
-      optionId: params.optionId
+      optionId: params.optionId,
+      answers: params.answers
     },
     run: (ctx) => performPrompt(ctx, params),
     replay: (ctx) => {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.test.ts
index b1eb5704f01..094ddffdcb2 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.test.ts
@@ -2,7 +2,6 @@ import { join } from 'node:path'
 import { afterEach, expect, it, vi } from 'vitest'
 import {
   AgentSessionPreDispatchError,
-  AGENT_SESSION_ADMISSION_BARRIER_TIMEOUT_MS,
   runSettledAgentSessionMutation
 } from './structured-agent-session-operation-settlement'
 import {
@@ -42,6 +41,9 @@ async function context(): Promise<AgentSessionTurnContext> {
   }
 }
 
+/** Longer than any bookkeeping bound: a refusal must already be answered by then. */
+const SETTLED_WAIT_MS = 2_000
+
 afterEach(() => {
   vi.useRealTimers()
   vi.restoreAllMocks()
@@ -80,7 +82,7 @@ it('returns a pre-dispatch refusal without waiting on redundant uncertainty pers
   })
   try {
     await refusing.promise
-    await vi.advanceTimersByTimeAsync(AGENT_SESSION_ADMISSION_BARRIER_TIMEOUT_MS)
+    await vi.advanceTimersByTimeAsync(SETTLED_WAIT_MS)
     expect(returned).toBe(true)
     expect(writes).toHaveBeenCalledOnce()
     expect(hostTestState().dispatch).not.toHaveBeenCalled()
@@ -129,9 +131,10 @@ it.each([1, 2])(
   }
 )
 
-// The pre-dispatch check judges only what the journal already holds; the send path never waits on
-// the provider's stream barrier, so a sink that stalls or fails cannot delay or double a send.
-it('dispatches without touching the event-stream barrier', async () => {
+// A send's plan only accepts: it records the submission and never waits on the provider's stream
+// barrier, so a sink that stalls or fails cannot delay or double a send. Handing it over is the
+// delivery loop's.
+it('accepts without touching the event-stream barrier or the provider', async () => {
   const ctx = await context()
   const { store } = hostTestState()
   vi.spyOn(store, 'recordOperationOutcome').mockResolvedValue()
@@ -149,42 +152,33 @@ it('dispatches without touching the event-stream barrier', async () => {
   })
   expect(result).toMatchObject({ ok: true })
   expect(beforeRun).toHaveBeenCalledOnce()
-  expect(hostTestState().dispatch).toHaveBeenCalledOnce()
-  expect(ctx.journal.submissions()[0]?.dispatchState).toBe('accepted')
+  expect(hostTestState().dispatch).not.toHaveBeenCalled()
+  expect(ctx.journal.submissions()[0]).toMatchObject({
+    dispatchState: 'pending',
+    handoverRecorded: true
+  })
   expect(barrier).not.toHaveBeenCalled()
 })
 
-it('refuses a superseded send without waiting on a stalled refusal write, and never dispatches late', async () => {
+it('refuses a superseded send at acceptance, recording and dispatching nothing', async () => {
   const ctx = await context()
   const { store } = hostTestState()
   vi.spyOn(store, 'recordOperationOutcome').mockResolvedValue()
-  const pending = Promise.withResolvers<void>()
-  const refusing = Promise.withResolvers<void>()
-  vi.spyOn(ctx.journal, 'resolveDispatch').mockImplementationOnce(() => {
-    refusing.resolve()
-    return pending.promise.then(() => ctx.journal.cursor())
-  })
-  vi.spyOn(console, 'warn').mockImplementation(() => {})
   const beforeRun = vi.fn(() => {
     throw new AgentSessionPreDispatchError('agent_session_restart_work_superseded')
   })
   const body = hostTestMessage('Continue the interrupted work')
   const operation = envelope('agentSession.send', { body })
   vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
-  const result = runSettledAgentSessionMutation({
+  const result = await runSettledAgentSessionMutation({
     store,
     operationCallerKey: 'test',
     envelope: operation,
     context: ctx,
     plan: sendPlan({ envelope: operation, body, beforeRun })
   }).catch((error: unknown) => error)
-  await refusing.promise
-  await vi.advanceTimersByTimeAsync(AGENT_SESSION_ADMISSION_BARRIER_TIMEOUT_MS)
-  expect(await result).toBeInstanceOf(AgentSessionPreDispatchError)
-  expect(hostTestState().dispatch).not.toHaveBeenCalled()
-  expect(ctx.journal.submissions()[0]?.dispatchState).toBe('pending')
-  pending.resolve()
-  await vi.advanceTimersByTimeAsync(0)
+  expect(result).toBeInstanceOf(AgentSessionPreDispatchError)
+  expect(ctx.journal.submissions()).toEqual([])
   expect(hostTestState().dispatch).not.toHaveBeenCalled()
   expect(vi.getTimerCount()).toBe(0)
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.ts
index baf871aef65..e4675bfefb1 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.ts
@@ -11,8 +11,6 @@ export class AgentSessionPreDispatchError extends Error {
   }
 }
 
-export const AGENT_SESSION_ADMISSION_BARRIER_TIMEOUT_MS = 2_000
-
 export async function runSettledAgentSessionMutation<TValue>(input: {
   store: AgentSessionRecordStore
   operationCallerKey: string
@@ -33,10 +31,7 @@ export async function runSettledAgentSessionMutation<TValue>(input: {
     if (input.plan.markUnknownBeforeRun) {
       await settle({ status: 'unknown' })
     }
-    outcome = await input.plan.run({
-      ...input.context,
-      ...(input.plan.beforeRun ? { beforeDispatch: input.plan.beforeRun } : {})
-    })
+    outcome = await input.plan.run(input.context)
     await settle(
       outcome.ok
         ? (input.plan.settledOutcome?.(outcome.value) ?? {
@@ -46,6 +41,8 @@ export async function runSettledAgentSessionMutation<TValue>(input: {
         : {
             status: 'failed',
             code: outcome.refusal.code,
+            ...(outcome.refusal.details ? { details: outcome.refusal.details } : {}),
+            // The row's own field, which builds before details read; copied from the legacy mirror.
             ...(outcome.refusal.rewindReason ? { rewindReason: outcome.refusal.rewindReason } : {})
           }
     )
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-operation-start-refusal.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-operation-start-refusal.test.ts
new file mode 100644
index 00000000000..7700a616b38
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-operation-start-refusal.test.ts
@@ -0,0 +1,61 @@
+// What an operation that needs the agent is told when it cannot have one: a typed refusal in
+// words a person can read, never Orca's own error text.
+
+import { describe, expect, it, vi } from 'vitest'
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import type { StructuredAgentSessionAttachContext } from './structured-agent-session-attach-context'
+import { ensureStructuredAgentSessionAgentForOperation } from './structured-agent-session-agent-start'
+import { recordStructuredAgentSessionOptionIntent } from './structured-agent-session-options-read'
+
+const SESSION = 'session-1'
+
+describe('an operation whose agent start throws', () => {
+  it('is refused as a failed restart, with the error only in the log', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const cause = new Error('EACCES: permission denied, open /Users/me/.orca/leases.json')
+    const context = {
+      sessions: new Map(),
+      reconcileLeases: () => Promise.reject(cause)
+    }
+
+    const refused = await ensureStructuredAgentSessionAgentForOperation(
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a partial context double; the start throws at `reconcileLeases`, before any other member is read.
+      context as unknown as StructuredAgentSessionAttachContext,
+      SESSION
+    )
+
+    expect(refused).toEqual({
+      ok: false,
+      refusal: {
+        code: 'agent_session_owner_restart_failed',
+        message: "The agent couldn't restart."
+      }
+    })
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining('starting the agent'), cause)
+    warn.mockRestore()
+  })
+})
+
+describe('an option picked while the chat is at rest', () => {
+  it('refuses a key the provider would not accept as a rejected option', async () => {
+    const persistOptions = vi.fn(async () => {})
+    const refused = await recordStructuredAgentSessionOptionIntent(
+      {
+        getRecord: () =>
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the intent reads only the record's provider and options.
+          ({ provider: 'codex', options: {} }) as unknown as AgentSessionRecord
+      },
+      { sessionId: SESSION, persistOptions, publish: () => {} },
+      { key: 'notAnOption', value: 'x' }
+    )
+
+    expect(refused).toMatchObject({
+      ok: false,
+      refusal: {
+        code: 'agent_session_operation_invalid',
+        details: { reason: 'optionRejected' }
+      }
+    })
+    expect(persistOptions).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-option-error.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-option-error.ts
index 607db1e6c4b..47f67910cf9 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-option-error.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-option-error.ts
@@ -1,6 +1,10 @@
 /** Option validation failed before the provider session was mutated. */
 export class AgentSessionOptionRejectedError extends Error {
-  constructor(cause: unknown) {
+  constructor(
+    cause: unknown,
+    /** `providerStarting`: nothing is wrong with the value; the session cannot take it yet. */
+    readonly refusalReason: 'optionRejected' | 'providerStarting' = 'optionRejected'
+  ) {
     super(cause instanceof Error ? cause.message : String(cause), { cause })
     this.name = 'AgentSessionOptionRejectedError'
   }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-option-settlement.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-option-settlement.test.ts
index 7957ed326a8..3eae8a7ae08 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-option-settlement.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-option-settlement.test.ts
@@ -152,6 +152,11 @@ describe('structured session options and close', () => {
       envelope: envelope('agentSession.send', { body }),
       body
     })
+    // Accepted, then handed over by the delivery loop; the status is read once it answered.
+    await vi.waitFor(() => expect(dispatchedModels).toEqual([DEFAULT_MODEL]))
+    await vi.waitFor(async () =>
+      expect((await host.journalSnapshot(SESSION)).submissions[0]?.dispatchState).toBe('accepted')
+    )
     const events: AgentSessionStatusEvent[] = []
     host.subscribeStatus({ id: 'session-list', emit: (event) => events.push(event) })
     expect(events).toEqual([
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-options-read.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-options-read.ts
new file mode 100644
index 00000000000..3bad8d9789f
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-options-read.ts
@@ -0,0 +1,134 @@
+// A chat's options, live or at rest.
+//
+// At rest nothing here needs a child. The pick is the record's own `options` — what the next start replays —
+// and the list is the host's model catalog, the same one the picker already reads before a chat
+// exists. A pick made at rest is written to the record as intent, through the same transition a live
+// pick takes, so the next start applies it.
+
+import {
+  refuse,
+  type AgentSessionOptionResult,
+  type AgentSessionOptionsResult
+} from '../../../shared/agent-session-wire'
+import { decodeStructuredAgentSessionOptionValue } from '../../../shared/structured-agent-session-option-codec'
+import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { journalOpenReadRefusal } from '../agent-session-journal/journal-open-failure'
+import { isClaudeStructuredOptionKey } from '../../claude/claude-structured-options'
+import { isCodexTurnOptionKey } from '../../codex/codex-structured-turn-start'
+import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
+import type { AgentSessionTurnContext, TurnOutcome } from './structured-agent-session-turns'
+import type { StructuredAgentSessionMutationContext } from './structured-agent-session-host-mutations'
+
+type RestingOptions = Pick<AgentSessionOptionsResult, 'models' | 'fastModeSupport' | 'current'>
+
+async function readStructuredAgentSessionOptionsAtRest(
+  deps: Pick<StructuredAgentSessionHostDeps, 'store' | 'modelCatalog'>,
+  sessionId: string
+): Promise<RestingOptions> {
+  const record = deps.store.getRecord(sessionId)
+  if (!record) {
+    throw new Error('agent_session_identity_required')
+  }
+  const catalog = (await deps.modelCatalog
+    ?.read({ agent: record.provider, sessionId })
+    .catch(() => null)) ?? { origin: 'unknown' as const }
+  const models = catalog.origin === 'unknown' ? [] : catalog.models
+  const saved = record.options ?? {}
+  const fastMode =
+    saved.fastMode === undefined
+      ? null
+      : decodeStructuredAgentSessionOptionValue('fastMode', saved.fastMode)
+  // An unknown model is one the client already treats as unconfirmed.
+  const model = saved.model ?? models.find((entry) => entry.isDefault)?.id ?? ''
+  // As a live child answers: the pick, else what Claude runs for this model when none is sent.
+  // A live Codex child answers only the effort its thread reported, never the model's default.
+  const effort =
+    saved.effort ??
+    (record.provider === 'claude'
+      ? models.find((entry) => entry.id === model)?.defaultEffort
+      : undefined)
+  return {
+    models,
+    ...(catalog.origin !== 'unknown' && catalog.fastModeSupport
+      ? { fastModeSupport: catalog.fastModeSupport }
+      : {}),
+    current: {
+      model,
+      ...(effort ? { effort } : {}),
+      ...(typeof fastMode === 'boolean' ? { fastMode } : {})
+    }
+  }
+}
+
+/** Records a pick for the next start. Only a key the provider would accept is kept. */
+export async function recordStructuredAgentSessionOptionIntent(
+  store: Pick<AgentSessionRecordStore, 'getRecord'>,
+  ctx: Pick<AgentSessionTurnContext, 'sessionId' | 'persistOptions' | 'publish'>,
+  input: { key: string; value: string }
+): Promise<TurnOutcome<AgentSessionOptionResult>> {
+  const record = store.getRecord(ctx.sessionId)
+  const accepted =
+    record?.provider === 'codex'
+      ? isCodexTurnOptionKey(input.key)
+      : record?.provider === 'claude' && isClaudeStructuredOptionKey(input.key)
+  if (!record || !accepted) {
+    return {
+      ok: false,
+      refusal: refuse(
+        'agent_session_operation_invalid',
+        { reason: 'optionRejected' },
+        `${record?.provider ?? 'This session'} has no session option named ${input.key}`
+      )
+    }
+  }
+  const options = { ...record.options, [input.key]: input.value }
+  await ctx.persistOptions(options)
+  ctx.publish()
+  return { ok: true, value: { ...input, options } }
+}
+
+/** A live child's own answer, or the answer at rest; the goal, usage and rewind either way. */
+export async function readStructuredAgentSessionOptions(
+  context: Pick<
+    StructuredAgentSessionMutationContext,
+    'deps' | 'serialize' | 'openConversation' | 'conversation'
+  >,
+  sessionId: string
+): Promise<AgentSessionOptionsResult> {
+  const { adapter, store } = context.deps
+  const live = await context.serialize(sessionId, async () => {
+    const session = await context.openConversation(sessionId).catch((error: unknown) => {
+      throw journalOpenReadRefusal(error)
+    })
+    const child = session?.child
+    if (!child) {
+      return null
+    }
+    if (!adapter.readOptions) {
+      throw new Error('structured_agent_session_options_unsupported')
+    }
+    return adapter.readOptions({ sessionId, fence: child.fence })
+  })
+  const options = live ?? (await readStructuredAgentSessionOptionsAtRest(context.deps, sessionId))
+  // Re-acquired after the reads above: the handle they saw may have closed and reopened since.
+  const session = await context.conversation(sessionId)
+  const phase = store.getRecord(sessionId)?.rewind?.phase
+  const agent = session.params.provider
+  return {
+    ...options,
+    rewind:
+      phase === 'prepared' || phase === 'provider-succeeded'
+        ? { supported: false, reason: 'outcome-unknown' }
+        : (adapter.rewindSupport?.(sessionId, agent) ?? {
+            supported: false,
+            reason: 'unsupported'
+          }),
+    conversationCommands: adapter.compact ? ['clear', 'compact'] : ['clear'],
+    ...(adapter.supportsThreadGoal?.(sessionId, agent)
+      ? { threadGoal: { current: session.journal.threadGoal() } }
+      : {}),
+    ...(adapter.recordsContextUsage?.(sessionId, agent)
+      ? { contextUsage: { current: session.journal.contextUsage() } }
+      : {})
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-owed-work-release.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-owed-work-release.test.ts
index d2d5d746469..9da47ae1f22 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-owed-work-release.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-owed-work-release.test.ts
@@ -1,10 +1,12 @@
-// Switching away from a chat starts the release clock, and the clock must never stop a provider
-// child that still owes the user work.
+// The idle sweep must never stop a provider child that still owes the user work.
 //
 // A Claude chat is published before its CLI answers initialize, and a message sent in that window
-// is held until it does; evicting then refuses a message the user already sent. And a lead whose
-// turn has settled can leave subagents, commands and monitors running inside the child; evicting
-// then ends them silently.
+// is accepted and stays queued until it does; the delivery loop hands it over once startup lands.
+// The idle sweep ticks meanwhile. Inside the idle window it must leave that queued message and the
+// starting child alone, and every journal publish — the handover included — starts the window
+// again; only a chat quiet for the whole window loses its agent. And a lead whose turn has settled
+// can leave subagents, commands and monitors running inside the child; stopping it then ends them
+// silently.
 
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
@@ -29,8 +31,8 @@ import {
 } from './structured-agent-session-host-test-data'
 
 const CALLER = { callerKey: 'client-1' }
-const SURFACE = 'desktop-chat:1'
-const GRACE_MS = 5
+const SWEEP_MS = 5
+const IDLE_MS = 1_000
 
 let root: string
 let store: AgentSessionRecordStore
@@ -39,12 +41,14 @@ let adapter: ClaudeStructuredSessionAdapter
 let claude: ReturnType<typeof fakeClaude>
 let landInit: () => void
 let lifecycle: Promise<void>[]
+let clock: number
 
 beforeEach(async () => {
   root = await mkdtemp(join(tmpdir(), 'orca-owed-work-release-'))
   resetHostTestOperationIds()
   claude = fakeClaude()
   lifecycle = []
+  clock = NOW
   const initLanded = new Promise<void>((resolve) => {
     landInit = resolve
   })
@@ -65,7 +69,7 @@ beforeEach(async () => {
         lifecycle.push(host.handleAdapterEvent(mapped))
       }
     },
-    // As the runtime wires it: a held prompt's outcome reaches the journal out of band.
+    // As the runtime wires it: an admitted prompt's outcome reaches the journal out of band.
     onDispatchSettledLate: (settlement) => void host.settleLateDispatch(settlement),
     // Initialize answers only when the test says so.
     openConnection: async (launch, handlers) => {
@@ -87,8 +91,8 @@ beforeEach(async () => {
     journalRoot: root,
     claimKeyId: 'key-1',
     mintSpawnToken: () => 'spawn-a',
-    releaseGraceMs: GRACE_MS,
-    now: () => NOW
+    idleSweep: { intervalMs: SWEEP_MS, idleMs: IDLE_MS },
+    now: () => clock
   })
 })
 
@@ -111,7 +115,6 @@ async function attachStarting(): Promise<void> {
     })
   )
   expect(created).toMatchObject({ ok: true })
-  await host.hold(SESSION, SURFACE)
 }
 
 async function send(text: string, dispatchState = 'pending'): Promise<string> {
@@ -133,38 +136,48 @@ async function send(text: string, dispatchState = 'pending'): Promise<string> {
   return sent.ok ? sent.value.clientMessageId : ''
 }
 
-function dispatchState(clientMessageId: string): string | undefined {
-  return host
-    .journalSnapshot(SESSION)
-    .submissions.find((entry) => entry.clientMessageId === clientMessageId)?.dispatchState
+async function dispatchState(clientMessageId: string): Promise<string | undefined> {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )?.dispatchState
 }
 
-/** Long enough for several grace windows to elapse, so "not evicted" means the clock declined. */
-function waitOutSeveralGraceWindows(): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, GRACE_MS * 20))
+/** The delivery loop hands a message over on its own serialized steps after startup lands; this
+ *  yields to them without moving the host clock. */
+async function untilSent(connection: { sent: unknown[] }): Promise<void> {
+  for (let turn = 0; turn < 2000 && connection.sent.length === 0; turn += 1) {
+    await new Promise((resolve) => setImmediate(resolve))
+  }
 }
 
-describe('a chat left while its Claude CLI is still starting', () => {
-  it('keeps the session for a message it is holding, and delivers it once startup lands', async () => {
+/** Long enough for many sweep ticks, so "not stopped" means the sweep declined. */
+function waitOutSeveralSweeps(): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, SWEEP_MS * 20))
+}
+
+describe('a Claude chat whose CLI is still starting', () => {
+  it('keeps a message queued inside the idle window, and delivers it once startup lands', async () => {
     await attachStarting()
     const held = await send('sent while starting')
 
-    host.release(SESSION, SURFACE)
-    await waitOutSeveralGraceWindows()
+    clock += IDLE_MS - 1
+    await waitOutSeveralSweeps()
 
     expect(host.hasSession(SESSION)).toBe(true)
     expect(claude.connections[0].closeCount).toBe(0)
-    expect(dispatchState(held)).toBe('pending')
+    expect(await dispatchState(held)).toBe('pending')
 
     landInit()
-    await adapter.drainStartup(SESSION)
+    await adapter.awaitStarted(SESSION)
 
-    expect(claude.connections[0].sent).toEqual([expect.objectContaining({ type: 'user' })])
-    await vi.waitFor(() => expect(dispatchState(held)).toBe('accepted'))
+    await vi.waitFor(
+      () => expect(claude.connections[0].sent).toEqual([expect.objectContaining({ type: 'user' })]),
+      { timeout: 3000 }
+    )
+    await vi.waitFor(async () => expect(await dispatchState(held)).toBe('accepted'))
   })
 
-  it('gives the message it wrote at startup a full grace to open its turn', async () => {
-    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+  it('gives the message it hands over at startup a full idle window to open its turn', async () => {
     await attachStarting()
     const held = await send('sent while starting')
     const connection = claude.connections[0]
@@ -172,31 +185,34 @@ describe('a chat left while its Claude CLI is still starting', () => {
     connection.send = async (message) => {
       connection.sent.push(message)
     }
-    host.release(SESSION, SURFACE)
-    await vi.advanceTimersByTimeAsync(GRACE_MS * 3 - 1)
+    clock += IDLE_MS - 1
+    await waitOutSeveralSweeps()
     expect(host.hasSession(SESSION)).toBe(true)
 
-    // Startup lands just before the clock's next tick.
+    // Startup lands just before the window closes; the handover's publish starts it again.
     landInit()
-    await adapter.drainStartup(SESSION)
+    await adapter.awaitStarted(SESSION)
     await Promise.all(lifecycle)
+    await untilSent(connection)
     expect(connection.sent).toEqual([expect.objectContaining({ type: 'user' })])
-    await vi.advanceTimersByTimeAsync(GRACE_MS - 1)
+    clock += IDLE_MS - 1
+    await waitOutSeveralSweeps()
 
     expect(host.hasSession(SESSION)).toBe(true)
     expect(connection.closeCount).toBe(0)
     connection.handlers.onMessage?.(connection.sent[0])
     await host.flushStreamedEvents(SESSION)
-    await vi.advanceTimersByTimeAsync(GRACE_MS * 3)
+    await waitOutSeveralSweeps()
     expect(host.hasSession(SESSION)).toBe(true)
-    expect(dispatchState(held)).toBe('accepted')
+    expect(await dispatchState(held)).toBe('accepted')
   })
 
-  it('is released after the grace once its turn has finished', async () => {
+  it('stops the agent and closes the conversation once its turn has finished and it idled', async () => {
     await attachStarting()
     landInit()
-    await adapter.drainStartup(SESSION)
-    await send('answered', 'accepted')
+    await adapter.awaitStarted(SESSION)
+    const answered = await send('answered')
+    await vi.waitFor(async () => expect(await dispatchState(answered)).toBe('accepted'))
     claude.connections[0].handlers.onMessage?.({
       type: 'result',
       subtype: 'success',
@@ -206,25 +222,25 @@ describe('a chat left while its Claude CLI is still starting', () => {
       result: 'done'
     })
     await host.flushStreamedEvents(SESSION)
-    expect(host.journalSnapshot(SESSION).submissions).toHaveLength(1)
+    expect((await host.journalSnapshot(SESSION)).submissions).toHaveLength(1)
 
-    host.release(SESSION, SURFACE)
+    clock += IDLE_MS
 
     await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
     expect(claude.connections[0].closeCount).toBe(1)
   })
 
-  it('is released after the grace when it owes nothing', async () => {
+  it('stops a start that stayed quiet for the whole window when it owes nothing', async () => {
     await attachStarting()
 
-    host.release(SESSION, SURFACE)
+    clock += IDLE_MS
 
     await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
     expect(claude.connections[0].closeCount).toBe(1)
   })
 })
 
-describe('a chat left while its settled lead still has background work running', () => {
+describe('a chat whose settled lead still has background work running', () => {
   function frame(message: Record<string, unknown>): void {
     claude.connections[0].handlers.onMessage?.({ session_id: PROVIDER_SESSION_ID, ...message })
   }
@@ -232,8 +248,9 @@ describe('a chat left while its settled lead still has background work running',
   async function settleTurnLeavingTask(taskType: string): Promise<void> {
     await attachStarting()
     landInit()
-    await adapter.drainStartup(SESSION)
-    await send('fan out', 'accepted')
+    await adapter.awaitStarted(SESSION)
+    const fanOut = await send('fan out')
+    await vi.waitFor(async () => expect(await dispatchState(fanOut)).toBe('accepted'))
     frame({
       type: 'system',
       subtype: 'task_started',
@@ -253,11 +270,11 @@ describe('a chat left while its settled lead still has background work running',
     ['a subagent', 'local_agent'],
     ['a background command', 'local_bash'],
     ['a monitor', 'monitor']
-  ])('keeps the session while %s runs, then releases it once that settles', async (_, type) => {
+  ])('keeps the agent while %s runs, then stops it once that settles', async (_, type) => {
     await settleTurnLeavingTask(type)
 
-    host.release(SESSION, SURFACE)
-    await waitOutSeveralGraceWindows()
+    clock += IDLE_MS
+    await waitOutSeveralSweeps()
 
     expect(host.hasSession(SESSION)).toBe(true)
     expect(claude.connections[0].closeCount).toBe(0)
@@ -272,6 +289,7 @@ describe('a chat left while its settled lead still has background work running',
     // A finished background task can wake the lead; that turn is owed too until it settles.
     frame({ type: 'result', subtype: 'success', uuid: 'result-2', is_error: false, result: 'ok' })
     await host.flushStreamedEvents(SESSION)
+    clock += IDLE_MS
 
     await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
     expect(claude.connections[0].closeCount).toBe(1)
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-owner-status.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-owner-status.ts
index 890b8f34fee..b9db10c1579 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-owner-status.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-owner-status.ts
@@ -1,27 +1,25 @@
-import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 import type { AgentSessionHandoffStatus } from '../../../shared/agent-session-wire'
+import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
+import { adapterSupportsRecord } from './structured-agent-session-provider-support'
 
 /** The `agentSession.handoffStatus` answer. Released desktop clients gate worktree activation on
- *  `owner`, so the method outlives the terminal handoff it was named for. */
+ *  `owner`, so the method outlives the terminal handoff it was named for. It reports ownership, not
+ *  liveness: a chat whose agent is stopped, idle-released or still starting is owned all the same. */
 export function structuredAgentSessionOwnerStatus(
-  record: AgentSessionRecord
+  deps: Pick<StructuredAgentSessionHostDeps, 'store' | 'adapter'>,
+  sessionId: string
 ): AgentSessionHandoffStatus {
-  const { handoffStage: stage, handoffOperationId: operationId } = record.lease
-  if (stage === 'manual-recovery') {
-    return {
-      owner: 'none',
-      direction: 'to-native',
-      phase: 'failed',
-      stage,
-      operationId,
-      error: {
-        message: "Couldn't verify which runtime owns this session — manual recovery is required",
-        recoverableOwner: 'none'
-      }
-    }
+  const record = deps.store.getRecord(sessionId)
+  if (!record) {
+    throw new Error('agent_session_identity_required')
   }
+  // Same refusal as reveal: a host that cannot run this chat vouches for no owner.
+  if (!adapterSupportsRecord(deps.adapter, record)) {
+    throw new Error('structured_agent_session_unsupported')
+  }
+  const { handoffStage: stage, handoffOperationId: operationId } = record.lease
   return {
-    owner: record.lease.claimStatus === 'live' && record.lease.ownerProcess ? 'native' : 'none',
+    owner: 'native',
     direction: stage ? 'to-native' : null,
     phase: stage ? 'switching' : 'idle',
     stage,
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-pre-spawn-first-answer.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-pre-spawn-first-answer.test.ts
new file mode 100644
index 00000000000..89772d45469
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-pre-spawn-first-answer.test.ts
@@ -0,0 +1,185 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { mapRuntimeError } from '../../runtime/rpc/errors'
+import {
+  AgentSessionPreSpawnError,
+  type AgentSessionPreSpawnReason,
+  type StructuredAgentSessionAdapter
+} from './structured-agent-session-adapter'
+import {
+  attachFingerprintFields,
+  type AgentSessionAttachParams
+} from './structured-agent-session-attach'
+import { openTestAttachConversation } from './structured-agent-session-attach-test-conversation'
+import { performAttach } from './structured-agent-session-attach-flow'
+
+const NOW = 1_800_000_000_000
+const SESSION = 'session-alpha'
+const OPERATION = `${NOW}-${'1'.padStart(32, '0')}`
+let root: string | null = null
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  if (root) {
+    await rm(root, { recursive: true, force: true })
+  }
+  root = null
+})
+
+function createParams(): AgentSessionAttachParams {
+  const params: AgentSessionAttachParams = {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: OPERATION,
+      expectedRuntimeFence: null,
+      payloadFingerprint: ''
+    },
+    location: {
+      executionHostId: 'local',
+      wslDistro: null,
+      workspaceId: 'workspace-1',
+      workspaceKind: 'folder'
+    },
+    provider: 'claude',
+    agent: 'claude',
+    accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: '/home/dev/.claude' },
+    runtimeKind: 'native'
+  }
+  return {
+    ...params,
+    envelope: {
+      ...params.envelope,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.attach',
+        sessionId: SESSION,
+        fields: attachFingerprintFields(params)
+      })
+    }
+  }
+}
+
+/** The thrown first answer as the wire sends it, and the ledger's replay of the same operation. */
+async function firstAnswerAndReplay(thrown: AgentSessionPreSpawnError) {
+  root = await mkdtemp(join(tmpdir(), 'orca-pre-spawn-first-answer-'))
+  const store = await AgentSessionRecordStore.open({
+    directory: join(root, 'store'),
+    hostId: 'local'
+  })
+  const unused = async (): Promise<never> => {
+    throw new Error('not reached before a spawn')
+  }
+  const adapter: StructuredAgentSessionAdapter = {
+    acquire: async () => {
+      throw thrown
+    },
+    dispatch: unused,
+    cancelTurn: unused,
+    answerPrompt: unused,
+    setOption: unused
+  }
+  const input = {
+    store,
+    adapter,
+    journalRoot: root,
+    openConversation: openTestAttachConversation(root),
+    authority: {
+      spawnToken: 'spawn-a',
+      claimKeyId: 'key-1',
+      handoffOperationId: OPERATION,
+      probe: { outcome: 'reservation-unused' as const }
+    },
+    callerKey: 'client-1',
+    params: createParams(),
+    now: () => NOW,
+    onAttached: () => {}
+  }
+  const first = await performAttach(input).then(
+    () => null,
+    (error: unknown) => error
+  )
+  expect(first).toBeInstanceOf(AgentSessionPreSpawnError)
+  return {
+    first: mapRuntimeError('req-1', { runtimeId: 'runtime-1' }, first),
+    replay: await performAttach(input)
+  }
+}
+
+describe('a create that fails before any process spawns', () => {
+  it.each<[string, string, AgentSessionPreSpawnReason | undefined, string]>([
+    [
+      'the managed account env override',
+      'This Claude launch defines explicit Anthropic auth environment variables.',
+      'managedAccountEnvOverride',
+      'This Claude launch sets its own Anthropic sign-in variables. Remove them to use a managed Claude account.'
+    ],
+    [
+      'an account switch in progress',
+      'A Claude account switch is in progress. Try again after it finishes.',
+      'accountSwitchInProgress',
+      'A Claude account switch is in progress. Try again after it finishes.'
+    ],
+    [
+      'a Claude account added in WSL',
+      'structured Claude is not offered under the active managed Claude account',
+      'managedAccountUnsupported',
+      'While a Claude account is added in WSL, Claude chats need a Windows Claude account. Choose or add one in Claude Accounts settings, then send your message again.'
+    ],
+    [
+      "Orca's own reason",
+      'claude sessions pin CLAUDE_CONFIG_DIR, not CODEX_HOME',
+      undefined,
+      "Claude couldn't start. Send your message to try again."
+    ]
+  ])('answers %s first in the words its replay reads', async (_, raw, reason, sentence) => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+
+    const { first, replay } = await firstAnswerAndReplay(
+      new AgentSessionPreSpawnError(new Error(raw), reason ? { reason } : {})
+    )
+
+    // Thrown as before: the wire code is unchanged, only the words are the replay's.
+    expect(first).toMatchObject({ ok: false, error: { code: 'runtime_error', message: sentence } })
+    expect(replay).toMatchObject({
+      ok: false,
+      refusal: {
+        code: 'agent_session_operation_invalid',
+        message: sentence,
+        ...(reason ? { details: { reason } } : {})
+      }
+    })
+    if (!reason) {
+      expect(replay).not.toHaveProperty('refusal.details')
+    }
+    if (raw !== sentence) {
+      expect(JSON.stringify([first, replay])).not.toContain(raw)
+    }
+    // What failed is kept for the log.
+    expect(warn).toHaveBeenCalledWith(
+      '[agent-session] provider start failed:',
+      expect.objectContaining({ message: raw })
+    )
+  })
+
+  it('keeps a message that is itself a code, and the wire code it maps to', async () => {
+    const { first } = await firstAnswerAndReplay(
+      new AgentSessionPreSpawnError(new Error('runtime_unavailable'))
+    )
+
+    expect(first).toMatchObject({
+      ok: false,
+      error: { code: 'runtime_unavailable', message: 'runtime_unavailable' }
+    })
+  })
+
+  it('keeps the situation of a pre-spawn error it wraps', () => {
+    const typed = new AgentSessionPreSpawnError(new Error('switching'), {
+      reason: 'accountSwitchInProgress'
+    })
+
+    expect(new AgentSessionPreSpawnError(typed).reason).toBe('accountSwitchInProgress')
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-processless-reservation.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-processless-reservation.test.ts
index 0f115da5ebd..348d5a3d90c 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-processless-reservation.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-processless-reservation.test.ts
@@ -12,6 +12,7 @@ import {
   attachFingerprintFields,
   type AgentSessionAttachParams
 } from './structured-agent-session-attach'
+import { openTestAttachConversation } from './structured-agent-session-attach-test-conversation'
 import { performAttach } from './structured-agent-session-attach-flow'
 
 const NOW = 1_800_000_000_000
@@ -86,6 +87,7 @@ describe('processless structured session reservation', () => {
         store,
         adapter,
         journalRoot: root,
+        openConversation: openTestAttachConversation(root!),
         authority: {
           spawnToken: 'spawn-a',
           claimKeyId: 'key-1',
@@ -133,6 +135,7 @@ describe('processless structured session reservation', () => {
       store,
       adapter,
       journalRoot: root,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-a',
         claimKeyId: 'key-1',
@@ -172,6 +175,7 @@ describe('processless structured session reservation', () => {
       store,
       adapter,
       journalRoot: root,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-drift',
         claimKeyId: 'key-1',
@@ -194,7 +198,6 @@ describe('processless structured session reservation', () => {
       claimStatus: 'released',
       handoffStage: null,
       reservedSpawnToken: null,
-      processlessAt: null,
       runtimeFence: 2,
       deathEvidence: { kind: 'pid-absent', detail: 'reservation failed before spawn' }
     })
@@ -218,7 +221,6 @@ describe('processless structured session reservation', () => {
         throw new AgentSessionPreSpawnError(new Error('workspace no longer exists'))
       })
     } as unknown as StructuredAgentSessionAdapter
-    const processlessProof = vi.spyOn(store, 'setReservationProcesslessProof')
     const settlement = vi.spyOn(store, 'settleFailedAcquisition')
 
     await expect(
@@ -226,6 +228,7 @@ describe('processless structured session reservation', () => {
         store,
         adapter,
         journalRoot: root,
+        openConversation: openTestAttachConversation(root!),
         authority: {
           spawnToken: 'spawn-a',
           claimKeyId: 'key-1',
@@ -237,20 +240,15 @@ describe('processless structured session reservation', () => {
         now: () => NOW,
         onAttached: () => {}
       })
-    ).rejects.toThrow('workspace no longer exists')
+    ).rejects.toThrow("Codex couldn't restart. Send your message to try again.")
     expect(settlement).toHaveBeenCalledExactlyOnceWith(
       expect.objectContaining({ exitProof: 'processless', spawnToken: 'spawn-a' })
     )
-    // No separate durable proof write: the only proof call is acquisition's single-use clear.
-    expect(processlessProof).toHaveBeenCalledExactlyOnceWith(
-      expect.objectContaining({ processlessAt: null })
-    )
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       claimStatus: 'released',
       handoffStage: null,
       handoffOperationId: null,
       runtimeFence: 2,
-      processlessAt: null,
       reservedSpawnToken: null,
       deathEvidence: { kind: 'pid-absent', detail: 'reservation failed before spawn' }
     })
@@ -297,6 +295,7 @@ describe('processless structured session reservation', () => {
       store,
       adapter,
       journalRoot: root,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-a',
         claimKeyId: 'key-1',
@@ -309,7 +308,9 @@ describe('processless structured session reservation', () => {
       onAttached: () => {}
     }
 
-    await expect(performAttach(input)).rejects.toThrow('launch not ready')
+    await expect(performAttach(input)).rejects.toThrow(
+      "Codex couldn't restart. Send your message to try again."
+    )
     await expect(performAttach(input)).resolves.toMatchObject({
       ok: false,
       refusal: { code: 'agent_session_operation_invalid' }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-prompt-cancel.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-prompt-cancel.test.ts
index a9e32b026e6..e0ae5da9d81 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-prompt-cancel.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-prompt-cancel.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -50,7 +51,7 @@ async function pendingPrompt(): Promise<{ journal: AgentSessionJournal; itemId:
         resolvedAt: null
       }
     },
-    { fence: 1 }
+    { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
   return { journal, itemId: item.itemId }
 }
@@ -117,7 +118,7 @@ describe('performCancel for a pending prompt', () => {
             resolvedAt: null
           }
         },
-        { fence: 1 }
+        { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
       )
     })
 
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-prompt-state.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-prompt-state.ts
index 7f71a9c28ce..7324e3be9ec 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-prompt-state.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-prompt-state.ts
@@ -2,7 +2,7 @@ import type {
   AgentJournalItemBody,
   AgentJournalRenderItem
 } from '../../../shared/agent-session-journal-types'
-import type { AgentSessionWireRefusal } from '../../../shared/agent-session-wire'
+import { refuse, type AgentSessionWireRefusal } from '../../../shared/agent-session-wire'
 import type { AgentSessionTurnContext } from './structured-agent-session-turns'
 
 type PendingPromptBody = Extract<AgentJournalItemBody, { kind: 'approval' | 'question' }>
@@ -11,8 +11,12 @@ export type PendingPromptValidation =
   | { ok: true; item: AgentJournalRenderItem; prompt: PendingPromptBody }
   | { ok: false; refusal: AgentSessionWireRefusal }
 
-function invalid(message: string): PendingPromptValidation {
-  return { ok: false, refusal: { code: 'agent_session_operation_invalid', message } }
+/** The prompt the client named is not one waiting on the user: nothing to answer. */
+function promptGone(message: string): PendingPromptValidation {
+  return {
+    ok: false,
+    refusal: refuse('agent_session_operation_invalid', { reason: 'promptGone' }, message)
+  }
 }
 
 export function validatePendingPrompt(
@@ -25,34 +29,36 @@ export function validatePendingPrompt(
 ): PendingPromptValidation {
   const item = ctx.journal.snapshot().items.find((entry) => entry.itemId === input.itemId)
   if (!item) {
-    return invalid(`No item ${input.itemId} in session ${ctx.sessionId}.`)
+    return promptGone(`No item ${input.itemId} in session ${ctx.sessionId}.`)
   }
   const prompt = item.body.kind === 'approval' || item.body.kind === 'question' ? item.body : null
   if (!prompt || (input.kind !== undefined && prompt.kind !== input.kind)) {
-    return invalid(
+    return promptGone(
       `Item ${input.itemId} is not a pending${input.kind ? ` ${input.kind}` : ' prompt'}.`
     )
   }
   if (item.revision !== input.expectedRevision) {
     return {
       ok: false,
-      refusal: {
-        code: 'agent_session_item_revision_stale',
-        message: `Item ${input.itemId} has moved on.`,
-        currentRevision: item.revision,
-        resolution: prompt.resolution
-      }
+      refusal: refuse(
+        'agent_session_item_revision_stale',
+        { reason: 'promptMoved', currentRevision: item.revision, resolution: prompt.resolution },
+        `Item ${input.itemId} has moved on.`
+      )
     }
   }
   if (prompt.resolution.state !== 'pending') {
     return {
       ok: false,
-      refusal: {
-        code: 'agent_session_already_resolved',
-        message: `Item ${input.itemId} was already ${prompt.resolution.state}.`,
-        currentRevision: item.revision,
-        resolution: prompt.resolution
-      }
+      refusal: refuse(
+        'agent_session_already_resolved',
+        {
+          reason: 'promptAlreadyResolved',
+          currentRevision: item.revision,
+          resolution: prompt.resolution
+        },
+        `Item ${input.itemId} was already ${prompt.resolution.state}.`
+      )
     }
   }
   return { ok: true, item, prompt }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-provider-child-record.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-child-record.test.ts
new file mode 100644
index 00000000000..30e81ab2d1e
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-child-record.test.ts
@@ -0,0 +1,743 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
+// The provider child is its own record on the conversation: stopping it, losing it or failing to
+// start it ends the child, never the conversation. Against the real host, store and journal, with a
+// live subscriber opened before each action.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
+import type {
+  AgentSessionStatusSummary,
+  AgentSessionSubscribeEvent
+} from '../../../shared/agent-session-wire'
+import { DISPATCH_REJECTED_CANCELLED } from '../../../shared/structured-agent-session-dispatch-rejection'
+import {
+  agentSessionFailureFact,
+  type AgentSessionFailureFact,
+  type SubmissionRejectionFact
+} from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
+import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
+import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { ensureStructuredAgentSessionAgent } from './structured-agent-session-agent-start'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import { stopStructuredAgentSessionAgentUnderSerialize } from './structured-agent-session-host-lifetime'
+import {
+  HOST_TEST_LOCATION,
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+const CALLER = { callerKey: 'client-1' }
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let acquire: Mock<StructuredAgentSessionAdapter['acquire']>
+let dispatch: Mock<StructuredAgentSessionAdapter['dispatch']>
+let adapterExtras: Partial<StructuredAgentSessionAdapter>
+
+function eventually(assertion: () => void | Promise<void>): Promise<void> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
+
+function generation(): string {
+  return `generation-${acquire.mock.calls.length}`
+}
+
+const spawnChild: StructuredAgentSessionAdapter['acquire'] = async ({ fence, spawnToken }) => ({
+  process: { hostId: 'local', pid: 4242, processStartTimeMs: 1_700_000_000_000, spawnToken },
+  acquisitionGeneration: generation(),
+  link: {
+    linkId: `link-${fence}`,
+    handle: { provider: 'codex' as const, threadId: THREAD },
+    origin: store.getRecord(SESSION)?.providerHandleChain.length
+      ? ('resumed' as const)
+      : ('created' as const),
+    mintedAtFence: fence,
+    observedAt: NOW
+  }
+})
+
+/** A Claude-shaped child: published at spawn, so it is `starting` until `started`. */
+const spawnStartingChild: StructuredAgentSessionAdapter['acquire'] = async (input) => ({
+  ...(await spawnChild(input)),
+  providerChildPhase: 'starting' as const
+})
+
+function startHost(): void {
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: {
+      acquire,
+      dispatch,
+      closeSession: vi.fn(async () => true),
+      releaseAcquisition: vi.fn(async () => true),
+      cancelTurn: vi.fn(async () => ({ cancelled: false })),
+      answerPrompt: vi.fn(async () => undefined),
+      setOption: vi.fn(async () => undefined),
+      ...adapterExtras
+    },
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => `spawn-${acquire.mock.calls.length}`,
+    now: () => NOW
+  })
+}
+
+async function restartHost(): Promise<void> {
+  await host.flushAllStreamedEvents()
+  startHost()
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-child-record-'))
+  resetHostTestOperationIds()
+  adapterExtras = {}
+  acquire = vi.fn(spawnChild)
+  dispatch = vi.fn(async (input) => ({
+    state: 'accepted' as const,
+    providerIdentity: {
+      provider: 'codex' as const,
+      threadId: THREAD,
+      turnId: `turn-${input.clientMessageId}`,
+      ordinal: dispatch.mock.calls.length
+    }
+  }))
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  startHost()
+  expect(await host.attach(CALLER, hostTestAttachParams(null))).toMatchObject({ ok: true })
+  await host.close(SESSION)
+})
+
+afterEach(async () => {
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+function sendParams(text: string) {
+  const body = hostTestMessage(text)
+  return {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: 1,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    },
+    body
+  }
+}
+
+async function accept(text: string): Promise<string> {
+  const params = sendParams(text)
+  const sent = await host.send(CALLER, params)
+  expect(sent).toMatchObject({ ok: true, value: { submission: { dispatchState: 'pending' } } })
+  return params.envelope.clientOperationId
+}
+
+function stop() {
+  const turnId = 'turn-none'
+  return host.cancel(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: null,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.cancel',
+        sessionId: SESSION,
+        fields: { turnId }
+      })
+    },
+    turnId
+  })
+}
+
+async function submission(id: string): Promise<AgentJournalSubmission | undefined> {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === id
+  )
+}
+
+async function statusRows(): Promise<
+  {
+    itemId: string
+    text: string
+    tone?: string
+    failure?: AgentSessionFailureFact
+  }[]
+> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status'
+      ? [
+          {
+            itemId: item.itemId,
+            text: item.body.text,
+            ...(item.body.tone ? { tone: item.body.tone } : {}),
+            ...(item.body.failure ? { failure: item.body.failure } : {})
+          }
+        ]
+      : []
+  )
+}
+
+/** The child the conversation has now, as its lifecycle events name it. */
+function currentChild() {
+  const child = conversation()?.child
+  if (!child?.generation) {
+    throw new Error('no child indexed')
+  }
+  return { sessionId: SESSION, fence: child.fence, acquisitionGeneration: child.generation }
+}
+
+function exit(child: ReturnType<typeof currentChild>, reason: string, startupUnproven?: true) {
+  return host.handleAdapterEvent({
+    type: 'ended',
+    ...child,
+    reason,
+    // As an adapter reports it: the exit's stderr as a log detail.
+    failure: { kind: 'providerExited', detail: { text: reason, audience: 'log' } },
+    cause: 'unexpected-exit',
+    ...(startupUnproven ? { startupUnproven } : {})
+  })
+}
+
+function rejectedIn(events: AgentSessionSubscribeEvent[], id: string): boolean {
+  return events.some(
+    (event) =>
+      event.type === 'batch' &&
+      event.batch.submissions.some(
+        (entry) => entry.clientMessageId === id && entry.dispatchState === 'rejected'
+      )
+  )
+}
+
+function conversation() {
+  return host['sessions'].get(SESSION)
+}
+
+async function subscribe(): Promise<AgentSessionSubscribeEvent[]> {
+  const events: AgentSessionSubscribeEvent[] = []
+  await host.subscribe({
+    id: 'sub-1',
+    sessionId: SESSION,
+    emit: (event) => events.push(structuredClone(event))
+  })
+  return events
+}
+
+/** The chat's status row as a session list sees it, frame by frame. */
+function watchStatus(): AgentSessionStatusSummary[] {
+  const frames: AgentSessionStatusSummary[] = []
+  host.subscribeStatus({
+    id: 'list-1',
+    emit: (event) => {
+      if (event.type === 'status' && event.session.sessionId === SESSION) {
+        frames.push(event.session)
+      }
+    }
+  })
+  return frames
+}
+
+function deferred<T>() {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((next) => {
+    resolve = next
+  })
+  return { promise, resolve }
+}
+
+describe('Stop on a child still proving its start', () => {
+  it('ends the child and keeps the conversation and its readers (R1)', async () => {
+    const ended = deferred<void>()
+    adapterExtras = {
+      awaitStarted: vi.fn(() => ended.promise),
+      closeSession: vi.fn(async () => {
+        ended.resolve()
+        return true
+      })
+    }
+    await restartHost()
+    acquire.mockImplementationOnce(spawnStartingChild)
+    const first = await accept('hello')
+    const journal = conversation()?.journal
+    const events = await subscribe()
+    const frames = watchStatus()
+    await eventually(() => expect(conversation()?.child?.phase).toBe('starting'))
+
+    expect(await stop()).toMatchObject({ ok: true, value: { cancelled: true } })
+
+    // The same conversation: no reopen, and the chat told it is idle again.
+    expect(conversation()?.journal).toBe(journal)
+    expect(conversation()?.child).toBeNull()
+    expect(conversation()?.lastEndedChild).toMatchObject({ cause: 'user-stop', rootGone: true })
+    expect(frames.at(-1)).not.toHaveProperty('hostExecutionPhase')
+    expect(frames.at(-1)).not.toHaveProperty('hostExecutionOwned')
+    expect(await submission(first)).toMatchObject({
+      dispatchState: 'rejected',
+      reason: DISPATCH_REJECTED_CANCELLED
+    })
+    // A Stop is not a failure: no row, and the loop is gone.
+    expect(await statusRows()).toEqual([])
+    await eventually(() => expect(host['conversationDelivery'].loop.isRunning(SESSION)).toBe(false))
+
+    const next = await accept('after stop')
+    await eventually(async () => expect((await submission(next))?.dispatchState).toBe('accepted'))
+    expect(conversation()?.journal).toBe(journal)
+    expect(dispatch.mock.calls.map(([input]) => input.clientMessageId)).toEqual([next])
+    // The reader opened before the Stop saw the next message delivered on the same stream.
+    expect(
+      events.some(
+        (event) =>
+          event.type === 'batch' &&
+          event.batch.submissions.some(
+            (entry) => entry.clientMessageId === next && entry.dispatchState === 'accepted'
+          )
+      )
+    ).toBe(true)
+  })
+})
+
+describe('settling an earlier child before the next one takes its message', () => {
+  it("settles the earlier child's turn from its death evidence and leaves the queued message to the new child (R1)", async () => {
+    // The earlier child exited mid-turn; the released lease keeps only its death evidence.
+    await store.transitionHandoff(SESSION, (record) => ({
+      ...record,
+      lease: {
+        ...record.lease,
+        deathEvidence: { kind: 'exit-observed', detail: 'provider exited', observedAt: NOW - 1_000 }
+      }
+    }))
+    const releasedFence = store.getRecord(SESSION)!.lease.runtimeFence
+    const journal = await openAgentSessionJournal({
+      identity: {
+        sessionId: SESSION,
+        workspaceId: HOST_TEST_LOCATION.workspaceId,
+        hostId: HOST_TEST_LOCATION.executionHostId,
+        agent: 'codex',
+        providerHandle: { kind: 'codex', threadId: THREAD }
+      },
+      journalDir: journalDirectoryFor(root, {
+        workspaceId: HOST_TEST_LOCATION.workspaceId,
+        sessionId: SESSION
+      })
+    })
+    await journal.appendItem(
+      { provider: 'codex', threadId: THREAD, turnId: 'earlier-turn', ordinal: 0 },
+      { kind: 'turn', turnId: 'earlier-turn', state: 'running', startedAt: NOW - 5_000 },
+      { fence: releasedFence, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
+    await journal.close()
+    const id = await accept('for the next child')
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('accepted'))
+    // The exit was observed, so its receipt ends the turn, and the chat says why it stopped.
+    const items = conversation()!.journal.snapshot().items
+    expect(items.map((item) => readAgentJournalTurn(item.body)).filter(Boolean)).toContainEqual(
+      expect.objectContaining({
+        turnId: 'earlier-turn',
+        state: 'interrupted',
+        completedAt: NOW - 1_000
+      })
+    )
+    expect(
+      items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
+    ).toContain(
+      'Codex stopped while this response was in progress. You can continue in this conversation.'
+    )
+    // Handed over at the new child's fence, which the attach reserved after settling.
+    const newFence = store.getRecord(SESSION)!.lease.runtimeFence
+    expect(newFence).toBeGreaterThan(releasedFence)
+    expect((await submission(id))?.fence).toBe(newFence)
+    expect(conversation()?.child).toMatchObject({ generation: generation(), fence: newFence })
+  })
+})
+
+const START_EXIT = 'claude stream-json exited (code 1)'
+const START_TEXT = 'Codex stopped before it finished starting. Send your message to try again.'
+const START_FAILURE: SubmissionRejectionFact = {
+  kind: 'providerStartFailed',
+  detail: { text: START_EXIT, audience: 'log' }
+}
+
+describe('a published child that dies while it proves its start', () => {
+  const EXIT = START_EXIT
+  const TEXT = START_TEXT
+
+  it.each([['the loop sees the start fail first'], ['the exit is processed first']])(
+    'leaves one error row keyed by the start, and every queued message rejected with it: %s (R2)',
+    async (order) => {
+      const settled = deferred<SubmissionRejectionFact>()
+      adapterExtras = { awaitStarted: vi.fn(() => settled.promise) }
+      await restartHost()
+      acquire.mockImplementation(spawnStartingChild)
+      const first = await accept('first')
+      const events = await subscribe()
+      const second = await accept('second')
+      await eventually(() => expect(adapterExtras.awaitStarted).toHaveBeenCalled())
+      const child = currentChild()
+
+      if (order === 'the exit is processed first') {
+        await exit(child, EXIT, true)
+        settled.resolve(START_FAILURE)
+      } else {
+        settled.resolve(START_FAILURE)
+        await eventually(async () =>
+          expect((await submission(second))?.dispatchState).toBe('rejected')
+        )
+        await exit(child, EXIT, true)
+      }
+
+      await eventually(async () =>
+        expect((await submission(second))?.dispatchState).toBe('rejected')
+      )
+      expect(await statusRows()).toEqual([
+        {
+          itemId: `orca:${encodeURIComponent(`start-failure:${child.acquisitionGeneration}`)}`,
+          text: TEXT,
+          tone: 'error',
+          failure: START_FAILURE
+        }
+      ])
+      for (const id of [first, second]) {
+        expect(await submission(id)).toMatchObject({
+          dispatchState: 'rejected',
+          reason: TEXT,
+          rejection: START_FAILURE
+        })
+      }
+      expect(rejectedIn(events, second)).toBe(true)
+      expect(dispatch).not.toHaveBeenCalled()
+      expect(acquire).toHaveBeenCalledTimes(2)
+    }
+  )
+})
+
+/** A start by an operation that needs the agent, such as a goal change, outside the loop. */
+function startForOperation() {
+  return host['serialize'](SESSION, () =>
+    ensureStructuredAgentSessionAgent(host['attachContext'](), SESSION)
+  )
+}
+
+describe('a start another operation made that dies while a sent message waits on it', () => {
+  const EXIT = START_EXIT
+  const TEXT = START_TEXT
+
+  it("is the message's own failed start: one error row, the message rejected, no second start (R2)", async () => {
+    adapterExtras = { awaitStarted: vi.fn(async () => START_FAILURE) }
+    await restartHost()
+    acquire.mockImplementation(spawnStartingChild)
+    // An operation that needs the agent starts a child that has not proven its start.
+    await startForOperation()
+    const operationChild = currentChild()
+    const events = await subscribe()
+    const params = sendParams('hello')
+
+    // Accepted first; that child's exit is settled before the loop's first step.
+    const sent = host.send(CALLER, params)
+    const exited = exit(operationChild, EXIT, true)
+    expect(await sent).toMatchObject({
+      ok: true,
+      value: { submission: { dispatchState: 'pending' } }
+    })
+    await exited
+    const id = params.envelope.clientOperationId
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('rejected'))
+    await settleLoop()
+    expect((await submission(id))?.reason).toBe(TEXT)
+    expect(await statusRows()).toEqual([
+      {
+        itemId: `orca:${encodeURIComponent(`start-failure:${operationChild.acquisitionGeneration}`)}`,
+        text: TEXT,
+        tone: 'error',
+        failure: START_FAILURE
+      }
+    ])
+    expect(rejectedIn(events, id)).toBe(true)
+    // The setup's child and the operation's: nothing started again into the same failure.
+    expect(acquire).toHaveBeenCalledTimes(2)
+    expect(dispatch).not.toHaveBeenCalled()
+  })
+
+  it('leaves a message sent after that start failed to a fresh start (R2)', async () => {
+    await restartHost()
+    acquire.mockImplementationOnce(spawnStartingChild)
+    await startForOperation()
+    await exit(currentChild(), EXIT, true)
+    expect(await statusRows()).toHaveLength(1)
+
+    const id = await accept('after the failure')
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('accepted'))
+    expect(acquire).toHaveBeenCalledTimes(3)
+  })
+
+  it('starts again for a message whose proven child crashed: only a failed start settles it (R2)', async () => {
+    await restartHost()
+    await startForOperation()
+    const params = sendParams('hello')
+
+    const sent = host.send(CALLER, params)
+    const exited = exit(currentChild(), 'codex app-server crashed')
+    await sent
+    await exited
+    const id = params.envelope.clientOperationId
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).not.toBe('pending'))
+    expect((await submission(id))?.dispatchState).toBe('accepted')
+    expect(acquire).toHaveBeenCalledTimes(3)
+  })
+
+  it('waits on a child started since the failed one, not on the failure (R2)', async () => {
+    adapterExtras = { awaitStarted: vi.fn(async () => undefined) }
+    await restartHost()
+    acquire.mockImplementation(spawnStartingChild)
+    await startForOperation()
+    const params = sendParams('hello')
+
+    // A second operation's start lands after the first child's exit, before the loop's first step.
+    const sent = host.send(CALLER, params)
+    const exited = exit(currentChild(), EXIT, true)
+    const held = startForOperation()
+    await sent
+    await exited
+    await held
+    const id = params.envelope.clientOperationId
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).not.toBe('pending'))
+    expect((await submission(id))?.dispatchState).toBe('accepted')
+    expect(acquire).toHaveBeenCalledTimes(3)
+  })
+})
+
+describe('a child that ends before its message is handed over', () => {
+  it('starts one child for the message, then rejects it and stops (R2)', async () => {
+    // The child the loop starts exits between its start step and its handover step.
+    adapterExtras = {
+      awaitStarted: vi.fn(async () => {
+        await exit(currentChild(), 'codex app-server crashed')
+      })
+    }
+    await restartHost()
+    const id = await accept('hello')
+    const events = await subscribe()
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('rejected'))
+    // The exit's stderr rides beside the sentence, never in it.
+    const failure = {
+      kind: 'providerExited',
+      detail: { text: 'codex app-server crashed', audience: 'log' }
+    }
+    expect(await submission(id)).toMatchObject({
+      reason: 'Codex stopped before this message was sent.',
+      rejection: failure
+    })
+    expect(await statusRows()).toEqual([
+      { itemId: expect.any(String), text: (await submission(id))?.reason, tone: 'error', failure }
+    ])
+    expect(rejectedIn(events, id)).toBe(true)
+    await eventually(() => expect(host['conversationDelivery'].loop.isRunning(SESSION)).toBe(false))
+    expect(acquire).toHaveBeenCalledTimes(2)
+    expect(dispatch).not.toHaveBeenCalled()
+  })
+})
+
+describe('another child indexed while the loop waits on the one it started', () => {
+  it('hands nothing over until the child now there has proven its start (R2)', async () => {
+    const starts = new Map<string, ReturnType<typeof deferred<void>>>()
+    const startOf = (generation: string) => {
+      const start = starts.get(generation) ?? deferred<void>()
+      starts.set(generation, start)
+      return start
+    }
+    adapterExtras = {
+      awaitStarted: vi.fn(() => startOf(currentChild().acquisitionGeneration).promise),
+      // The stop ends the child without settling the start the loop is waiting on.
+      closeSession: vi.fn(async () => true)
+    }
+    await restartHost()
+    acquire.mockImplementation(spawnStartingChild)
+    const first = await accept('first')
+    await eventually(() => expect(adapterExtras.awaitStarted).toHaveBeenCalledTimes(1))
+    const stopped = currentChild()
+    expect(await stop()).toMatchObject({ ok: true })
+    const second = await accept('second')
+    // An operation that needs the agent starts its own child before the loop's handover step runs.
+    await host['serialize'](SESSION, () =>
+      ensureStructuredAgentSessionAgent(host['attachContext'](), SESSION)
+    )
+    const replacement = currentChild()
+    expect(replacement.acquisitionGeneration).not.toBe(stopped.acquisitionGeneration)
+
+    startOf(stopped.acquisitionGeneration).resolve()
+    await eventually(() => expect(adapterExtras.awaitStarted).toHaveBeenCalledTimes(2))
+    expect(dispatch).not.toHaveBeenCalled()
+
+    await host.handleAdapterEvent({
+      type: 'started',
+      ...replacement,
+      reportedOptions: { model: 'sonnet' },
+      restoreSkippedOptions: []
+    })
+    startOf(replacement.acquisitionGeneration).resolve()
+
+    await eventually(async () => expect((await submission(second))?.dispatchState).toBe('accepted'))
+    expect(dispatch.mock.calls.map(([input]) => input.clientMessageId)).toEqual([second])
+    expect(await submission(first)).toMatchObject({ reason: DISPATCH_REJECTED_CANCELLED })
+  })
+})
+
+describe('a quit with a message still queued', () => {
+  /** Read by the next launch, through the same open any reader takes. */
+  async function afterRelaunch(id: string): Promise<AgentJournalSubmission | undefined> {
+    startHost()
+    await host.revealSession(SESSION)
+    return await submission(id)
+  }
+
+  it('settles a message no child ever had the way a chat close does (R2)', async () => {
+    // Quit has begun — its first step stops the delivery loops — when this message is accepted.
+    host['conversationDelivery'].loop.dispose()
+    const id = await accept('hello')
+    expect(conversation()?.child).toBeNull()
+    await host.flushAllStreamedEvents()
+
+    expect(await afterRelaunch(id)).toMatchObject({
+      dispatchState: 'rejected',
+      ...agentSessionFailureWords(agentSessionFailureFact('chatClosed'), { surface: 'rejection' })
+    })
+  })
+
+  it('waits for the start already in flight and stops the child it produced (R2)', async () => {
+    const starting = deferred<void>()
+    const closeSession = vi.fn(async () => true)
+    adapterExtras = { closeSession }
+    await restartHost()
+    // The loop's start step is under way, but has not reached its attach yet.
+    const resolveRecovery = host['runtimeState'].resolveRecovery.bind(host['runtimeState'])
+    const recovering = vi.spyOn(host['runtimeState'], 'resolveRecovery')
+    recovering.mockImplementationOnce(async (sessionId) => {
+      await starting.promise
+      return resolveRecovery(sessionId)
+    })
+    const id = await accept('hello')
+    await eventually(() => expect(recovering).toHaveBeenCalled())
+
+    const quit = host.flushAllStreamedEvents()
+    starting.resolve()
+    await quit
+
+    expect(closeSession).toHaveBeenCalledWith(SESSION)
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({ claimStatus: 'released' })
+    expect(dispatch).not.toHaveBeenCalled()
+    expect(await afterRelaunch(id)).toMatchObject({
+      dispatchState: 'rejected',
+      ...agentSessionFailureWords(agentSessionFailureFact('chatClosed'), { surface: 'rejection' })
+    })
+  })
+})
+
+describe('a send whose start failed, sent again with the same operation id', () => {
+  it('replays the recorded rejection and starts no second agent (R2)', async () => {
+    acquire.mockRejectedValueOnce(new Error('spawn claude ENOENT'))
+    const fenceBefore = store.getRecord(SESSION)!.lease.runtimeFence
+    const params = sendParams('hello')
+    // A failed start is a rejected message, never a refused send.
+    expect(await host.send(CALLER, params)).toMatchObject({
+      ok: true,
+      value: { submission: { dispatchState: 'pending' } }
+    })
+    const id = params.envelope.clientOperationId
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('rejected'))
+    // The start moved the fence while the message was out.
+    expect(store.getRecord(SESSION)!.lease.runtimeFence).toBeGreaterThan(fenceBefore)
+    const starts = acquire.mock.calls.length
+
+    const replay = await host.send(CALLER, params)
+
+    expect(replay).toMatchObject({
+      ok: true,
+      replayed: true,
+      value: { submission: { clientMessageId: id, dispatchState: 'rejected' } }
+    })
+    await settleLoop()
+    expect(acquire).toHaveBeenCalledTimes(starts)
+    expect(dispatch).not.toHaveBeenCalled()
+  })
+})
+
+async function settleLoop(): Promise<void> {
+  await eventually(() => expect(host['conversationDelivery'].loop.isRunning(SESSION)).toBe(false))
+}
+
+describe('how a stopped child ends the start its loop was waiting on', () => {
+  /** A child the loop waits on, whose start the stop below does not settle, so a message sent
+   *  after the stop is queued when the loop next looks. */
+  async function stoppedWhileStarting(stop: () => Promise<void>) {
+    const start = deferred<void>()
+    adapterExtras = {
+      awaitStarted: vi.fn(() => start.promise),
+      closeSession: vi.fn(async () => true)
+    }
+    await restartHost()
+    acquire.mockImplementationOnce(spawnStartingChild)
+    await accept('first')
+    await eventually(() => expect(adapterExtras.awaitStarted).toHaveBeenCalledTimes(1))
+    await stop()
+    const second = await accept('second')
+    adapterExtras.awaitStarted = undefined
+    start.resolve()
+    return second
+  }
+
+  it("goes on after a user's Stop and delivers what was sent since (R2)", async () => {
+    const second = await stoppedWhileStarting(async () => {
+      expect(await stop()).toMatchObject({ ok: true })
+    })
+
+    await eventually(async () => expect((await submission(second))?.dispatchState).toBe('accepted'))
+    expect(conversation()?.lastEndedChild).toMatchObject({ cause: 'user-stop', reason: null })
+    expect(await statusRows()).toEqual([])
+  })
+
+  it("fails the start after a host stop, as a start Orca stopped rather than the provider's (R2)", async () => {
+    const reason = 'the start watchdog fired'
+    const second = await stoppedWhileStarting(() =>
+      host['serialize'](SESSION, () =>
+        stopStructuredAgentSessionAgentUnderSerialize(host['lifetimeContext'](), SESSION, {
+          cause: 'host-stop',
+          reason
+        })
+      )
+    )
+
+    await eventually(async () => expect((await submission(second))?.dispatchState).toBe('rejected'))
+    // The sentence is the constructor's, not the reason the stop was given.
+    const text = 'Codex never finished starting, so Orca stopped it.'
+    expect(await submission(second)).toMatchObject({
+      reason: text,
+      rejection: { kind: 'hostStopped' }
+    })
+    expect(await statusRows()).toEqual([
+      { itemId: expect.any(String), text, tone: 'error', failure: { kind: 'hostStopped' } }
+    ])
+    expect(dispatch).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-provider-child.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-child.ts
new file mode 100644
index 00000000000..da5e491e1d1
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-child.ts
@@ -0,0 +1,83 @@
+// The provider child behind a conversation, kept as its own record on the conversation's entry.
+//
+// The entry is the conversation and outlives any number of children. A child enters only when an
+// attach has fully succeeded, and leaves only through `endProviderChild`, which every ending shares:
+// an exit, a failed re-attach, a Stop and an eviction. Each is matched on the child's generation
+// and fence, so an ending that arrives late for an older child cannot end a newer one.
+
+import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import type {
+  StructuredAgentSessionEndedChild,
+  StructuredAgentSessionHostSession,
+  StructuredAgentSessionProviderChild,
+  StructuredAgentSessionProviderChildIdentity
+} from './structured-agent-session-host-types'
+
+type ChildBearer = Pick<StructuredAgentSessionHostSession, 'child' | 'lastEndedChild'> & {
+  journal: Pick<AgentSessionJournal, 'cursor'>
+}
+
+/** The fence a conversation write carries: the record's, which is where the next child starts. A
+ *  child's own writes carry `child.fence`, which equals it while that child holds the lease. */
+export function structuredAgentSessionConversationFence(
+  store: Pick<AgentSessionRecordStore, 'getRecord'>,
+  sessionId: string
+): number {
+  return store.getRecord(sessionId)?.lease.runtimeFence ?? 0
+}
+
+/** For the end of a successful attach only: a failed one never wrote a child to take back. */
+export function indexProviderChild(
+  session: ChildBearer,
+  child: StructuredAgentSessionProviderChild
+): void {
+  session.child = child
+}
+
+export function markProviderChildStarted(
+  session: ChildBearer,
+  identity: StructuredAgentSessionProviderChildIdentity
+): boolean {
+  const child = matchingChild(session, identity)
+  if (child) {
+    child.phase = 'ready'
+  }
+  return child !== null
+}
+
+export function endProviderChild(
+  session: ChildBearer,
+  ended: Omit<StructuredAgentSessionEndedChild, 'endedAt' | 'startedFor'>
+): boolean {
+  const child = matchingChild(session, ended)
+  if (!child) {
+    return false
+  }
+  session.child = null
+  session.lastEndedChild = {
+    ...ended,
+    ...(child.startedFor === undefined ? {} : { startedFor: child.startedFor }),
+    endedAt: session.journal.cursor()
+  }
+  return true
+}
+
+/** The conversation's last start died before it proved itself, and nothing started since. Only a
+ *  send retries it: a view or an exit recovery would respawn into the same failure, adding a row. */
+export function failedProviderChildStart(
+  session: Pick<ChildBearer, 'child' | 'lastEndedChild'>
+): StructuredAgentSessionEndedChild | null {
+  const ended = session.lastEndedChild
+  return !session.child && ended?.duringStartup && ended.cause !== 'user-stop' ? ended : null
+}
+
+function matchingChild(
+  session: ChildBearer,
+  identity: StructuredAgentSessionProviderChildIdentity
+): StructuredAgentSessionProviderChild | null {
+  const { child } = session
+  return child && child.generation === identity.generation && child.fence === identity.fence
+    ? child
+    : null
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-provider-restore.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-restore.test.ts
index c8a2e4bba14..5da0861aa19 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-provider-restore.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-restore.test.ts
@@ -5,12 +5,15 @@ import { afterEach, describe, expect, it } from 'vitest'
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import { abandonStructuredAgentSessionHost } from './structured-agent-session-host-test-abandon'
 import {
   HOST_TEST_NOW,
   HOST_TEST_SESSION,
   hostTestAttachParams,
   resetHostTestOperationIds
 } from './structured-agent-session-host-test-data'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
 
 const CLAUDE_SESSION = 'claude-session'
 const hosts: StructuredAgentSessionHost[] = []
@@ -34,7 +37,12 @@ function claudeAdapter(): StructuredAgentSessionAdapter {
         observedAt: HOST_TEST_NOW
       }
     }),
-    dispatch: async () => ({ state: 'rejected', reason: 'unused' }),
+    dispatch: async () => ({
+      state: 'rejected',
+      ...agentSessionFailureWords(agentSessionFailureFact('providerRejected'), {
+        surface: 'rejection'
+      })
+    }),
     cancelTurn: async () => ({ cancelled: false }),
     answerPrompt: async () => undefined,
     setOption: async () => undefined
@@ -58,15 +66,8 @@ function createHost(
   return host
 }
 
-async function abandonHost(host: StructuredAgentSessionHost): Promise<void> {
-  host['runtimeState'].stopLeaseRenewal()
-  host['holds'].dispose()
-  await Promise.all([...host['sessions'].values()].map((session) => session.journal.close()))
-  host['sessions'].clear()
-}
-
 afterEach(async () => {
-  await Promise.all(hosts.splice(0).map(abandonHost))
+  await Promise.all(hosts.splice(0).map(abandonStructuredAgentSessionHost))
   await rm(root, { recursive: true, force: true })
   root = ''
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.test.ts
index 52699fd062f..b1836983869 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.test.ts
@@ -37,7 +37,17 @@ beforeEach(async () => {
   resetHostTestOperationIds()
   lifecycle = []
   statuses = []
-  const claude = fakeClaude({ initDelayMs: INIT_DELAY_MS, initModel: 'claude-opus-9' })
+  // A CLI whose own default is not the catalog's: startup reports it through get_settings,
+  // since system/init arrives only with the first command.
+  const claude = fakeClaude({
+    initDelayMs: INIT_DELAY_MS,
+    initModel: 'claude-opus-9',
+    settings: {
+      applied: { model: 'claude-opus-9', effort: 'high', advisor: null, ultracode: false },
+      effective: { model: 'claude-opus-9', effortLevel: 'high', env: {} },
+      sources: {}
+    }
+  })
   adapter = new ClaudeStructuredSessionAdapter({
     resolveLaunch: async () => ({
       pathToClaudeCodeExecutable: 'claude',
@@ -80,8 +90,8 @@ afterEach(async () => {
   await rm(root, { recursive: true, force: true })
 })
 
-function claudeParams() {
-  return hostTestAttachParams(null, {
+function claudeParams(expectedRuntimeFence: number | null = null) {
+  return hostTestAttachParams(expectedRuntimeFence, {
     provider: 'claude',
     agent: 'claude',
     accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: join(root, 'claude-home') },
@@ -102,7 +112,7 @@ describe('a publish-first Claude create whose init is slow', () => {
     expect(store.getRecord(SESSION)?.options?.model).toBeUndefined()
     expect(lastPhase()).toBe('starting')
 
-    await adapter.drainStartup(SESSION)
+    await adapter.awaitStarted(SESSION)
     await Promise.all(lifecycle)
 
     expect(store.getRecord(SESSION)?.options?.model).toBe('claude-opus-9')
@@ -116,7 +126,7 @@ describe('a publish-first Claude create whose init is slow', () => {
     ).resolves.toMatchObject({ ok: true })
     expect(store.getRecord(SESSION)?.options?.model).toBe('opus')
 
-    await adapter.drainStartup(SESSION)
+    await adapter.awaitStarted(SESSION)
     await Promise.all(lifecycle)
 
     expect(store.getRecord(SESSION)?.options?.model).toBe('opus')
@@ -126,19 +136,21 @@ describe('a publish-first Claude create whose init is slow', () => {
   it('keeps the picked model across a resume whose new child starts on its own default', async () => {
     const params = claudeParams()
     await host.attach(CALLER, { ...params, options: { model: 'opus' } })
-    await adapter.drainStartup(SESSION)
+    await adapter.awaitStarted(SESSION)
     await Promise.all(lifecycle)
     await host.close(SESSION)
     const releasedFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
 
-    // Reopening the chat: the surface's first hold resumes the session.
-    await host.hold(SESSION, 'chat-1')
+    // Starting the chat again resumes the session under a new fence.
+    await expect(host.attach(CALLER, claudeParams(releasedFence))).resolves.toMatchObject({
+      ok: true
+    })
     expect(store.getRecord(SESSION)?.lease.runtimeFence).toBeGreaterThan(releasedFence)
     // The new child's init reports its CLI default; the saved pick is restored over it.
     expect(store.getRecord(SESSION)?.options?.model).toBe('opus')
     expect(lastPhase()).toBe('starting')
 
-    await adapter.drainStartup(SESSION)
+    await adapter.awaitStarted(SESSION)
     await Promise.all(lifecycle)
 
     expect(store.getRecord(SESSION)?.options?.model).toBe('opus')
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.ts
index 55c718f967b..8f3c0390aaa 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.ts
@@ -16,6 +16,7 @@ import type {
   StructuredAgentSessionHostSession
 } from './structured-agent-session-host-types'
 import { nativeSessionOptionsFromReport } from './structured-agent-session-option-restoration'
+import { markProviderChildStarted } from './structured-agent-session-provider-child'
 
 export type StructuredAgentSessionProviderStartedContext = {
   deps: StructuredAgentSessionHostDeps
@@ -23,7 +24,6 @@ export type StructuredAgentSessionProviderStartedContext = {
   serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
   now: () => number
   publishStatus?: (sessionId: string) => void
-  restartReleaseGrace: (sessionId: string) => void
   onBarrierError: (sessionId: string, error: unknown) => void
 }
 
@@ -35,16 +35,14 @@ export function settleStructuredAgentSessionProviderStarted(
   return context.serialize(event.sessionId, async () => {
     const session = context.sessions.get(event.sessionId)
     if (
-      !session?.hasProviderChild ||
-      session.fence !== event.fence ||
-      session.acquisitionGeneration !== event.acquisitionGeneration
+      !session ||
+      !markProviderChildStarted(session, {
+        generation: event.acquisitionGeneration,
+        fence: event.fence
+      })
     ) {
       return
     }
-    session.providerChildPhase = 'ready'
-    // Prompts held for the start are written now but open a turn only on their echo; a release
-    // tick in between would stop the child before it runs them.
-    context.restartReleaseGrace(event.sessionId)
     try {
       await persistStartedOptions(context, event)
     } catch (error) {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-queued-command.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-command.test.ts
new file mode 100644
index 00000000000..9cc22f9547a
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-command.test.ts
@@ -0,0 +1,161 @@
+// Queued drafts across conversation commands: a /compact is a queued message
+// and then a turn, so a capable send during it becomes a card that waits for it
+// like any turn, while Delete and Send-now answer at once; a /clear in flight
+// admits no draft onto the source it is superseding; and a draft /clear carries
+// to its replacement is fingerprinted for the replacement, so the provider's
+// echo folds into its sent bubble.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
+import {
+  createQueuedMessageTestRig,
+  eventually,
+  QUEUED_RIG_CALLER as CALLER,
+  type QueuedMessageTestRig
+} from './structured-agent-session-queued-message-rig.test-fixture'
+import {
+  HOST_TEST_THREAD as THREAD,
+  hostTestMessage,
+  hostTestOperationId
+} from './structured-agent-session-host-test-data'
+
+let rig: QueuedMessageTestRig
+
+beforeEach(async () => {
+  rig = await createQueuedMessageTestRig()
+})
+
+afterEach(() => rig.dispose())
+
+const WAIT_REFUSAL = {
+  ok: false,
+  refusal: {
+    code: 'agent_session_operation_invalid',
+    details: { reason: 'conversationCommandInFlight' },
+    message: 'Wait for the conversation operation to finish.'
+  }
+}
+
+function command(name: 'compact' | 'clear') {
+  const fields = { command: name }
+  return rig.host.conversationCommand(CALLER, {
+    envelope: rig.envelope(fields, 'agentSession.conversationCommand', hostTestOperationId()),
+    ...fields
+  })
+}
+
+async function queuedId(
+  result: ReturnType<QueuedMessageTestRig['send']>['result']
+): Promise<string> {
+  const queued = await result
+  if (!queued.ok || !('queued' in queued.value)) {
+    throw new Error('expected a queued receipt')
+  }
+  return queued.value.queued.messageId
+}
+
+describe('a /compact in flight', () => {
+  /** A /compact the provider took: a queued message, then its own turn, running until the
+   *  provider ends it (`finishCompact`). */
+  async function compactRunning(): Promise<void> {
+    expect(await command('compact')).toMatchObject({ ok: true, value: { command: 'compact' } })
+    await eventually(() => expect(rig.compact).toHaveBeenCalledOnce())
+  }
+
+  it('turns a capable send into a card, which waits for the compaction and then drains', async () => {
+    await compactRunning()
+    const draftId = await queuedId(rig.send('sent while compacting', 'queue-if-active').result)
+    expect(await rig.drafts()).toEqual([{ messageId: draftId, state: 'waiting' }])
+    // The compaction's turn owes work, so the drain waits behind it like any turn.
+    await new Promise((resolve) => setTimeout(resolve, 150))
+    expect(await rig.handoff(draftId)).toBeUndefined()
+    rig.finishCompact()
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+    expect(await rig.drafts()).toHaveLength(0)
+  })
+
+  it('answers Delete at once, and Send-now sends its card behind the compaction like any send', async () => {
+    await compactRunning()
+    const deletedId = await queuedId(rig.send('deleted while compacting', 'queue-if-active').result)
+    const sentId = await queuedId(rig.send('sent now while compacting', 'queue-if-active').result)
+    const hung = new Promise<'hung'>((resolve) => setTimeout(() => resolve('hung'), 2_000))
+    // Nothing holds the session's lane for the compaction's length any more.
+    expect(await Promise.race([rig.deleteQueued(deletedId), hung])).toMatchObject({
+      ok: true,
+      value: { deleted: true }
+    })
+    expect(await Promise.race([rig.sendNow(sentId), hung])).toMatchObject({
+      ok: true,
+      value: { submission: { queuedMessageId: sentId } }
+    })
+    // Accepted, then handed over only once the compaction ends — the order every send keeps.
+    await new Promise((resolve) => setTimeout(resolve, 150))
+    expect(rig.dispatch).toHaveBeenCalledTimes(0)
+    rig.finishCompact()
+    await eventually(async () => expect((await rig.handoff(sentId))?.handedOverAt).toBeDefined())
+  })
+})
+
+describe('/clear', () => {
+  it('in flight, refuses a capable send as today: no card lands on the source it supersedes', async () => {
+    const attach = rig.host.attach.bind(rig.host)
+    let release: (() => void) | undefined
+    const released = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    const spy = vi.spyOn(rig.host, 'attach').mockImplementationOnce(async (...args) => {
+      await released
+      return attach(...args)
+    })
+    try {
+      const cleared = command('clear')
+      // Nothing is recorded before the clear commits; wait until it is starting the replacement.
+      await eventually(() => expect(spy).toHaveBeenCalled())
+      expect(await rig.send('sent while clearing', 'queue-if-active').result).toEqual(WAIT_REFUSAL)
+      release?.()
+      const done = await cleared
+      const replacementId = done.ok ? done.value.replacementSessionId : undefined
+      if (!replacementId) {
+        throw new Error('expected a replacement session')
+      }
+      expect(await rig.drafts()).toHaveLength(0)
+      expect(await rig.drafts(replacementId)).toHaveLength(0)
+    } finally {
+      spy.mockRestore()
+    }
+  })
+
+  it("a carried draft sent on the replacement: the provider's echo folds into its one bubble", async () => {
+    const working = await rig.workingSend()
+    const draftId = await queuedId(rig.send('carried text', 'queue-if-active').result)
+    await rig.stop()
+    await rig.settleAccepted(working, 'a')
+    const cleared = await command('clear')
+    const replacementId = cleared.ok ? cleared.value.replacementSessionId : undefined
+    if (!replacementId) {
+      throw new Error('expected a replacement session')
+    }
+    expect(await rig.sendNow(draftId, hostTestOperationId(), replacementId)).toMatchObject({
+      ok: true,
+      value: { submission: expect.anything() }
+    })
+    const journal = rig.host.collaboratorsForTests().sessions.get(replacementId)?.journal
+    const sent = journal?.submissions().findLast((entry) => entry.queuedMessageId === draftId)
+    if (!journal || !sent) {
+      throw new Error('expected the carried draft sent on the replacement')
+    }
+    await journal.appendItem(
+      { provider: 'codex', threadId: THREAD, turnId: 'turn-echo', ordinal: 0 },
+      hostTestMessage('carried text'),
+      { fence: sent.fence, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
+    const snapshot = await rig.host.journalSnapshot(replacementId)
+    const userBubbles = snapshot.items.filter(
+      (item) => item.body.kind === 'message' && item.body.role === 'user'
+    )
+    expect(userBubbles).toHaveLength(1)
+    expect(snapshot.submissions.find((entry) => entry.queuedMessageId === draftId)).toMatchObject({
+      dispatchState: 'accepted'
+    })
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-queued-gate.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-gate.test.ts
new file mode 100644
index 00000000000..bc4697be6df
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-gate.test.ts
@@ -0,0 +1,302 @@
+// The one queue gate: admission, the drain step and Send-now consume a single
+// typed hold decision, so the lists cannot drift — pinned here with a clear in
+// doubt, Send-now's override set, and the replay-preference rule for a refused
+// draft.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
+import { structuredQueueHold } from './structured-agent-session-queued-messages'
+import {
+  createQueuedMessageTestRig,
+  eventually,
+  QUEUED_RIG_CALLER as CALLER,
+  type QueuedMessageTestRig
+} from './structured-agent-session-queued-message-rig.test-fixture'
+import {
+  HOST_TEST_SESSION as SESSION,
+  hostTestMessage,
+  hostTestOperationId
+} from './structured-agent-session-host-test-data'
+
+let rig: QueuedMessageTestRig
+let host: QueuedMessageTestRig['host']
+let store: QueuedMessageTestRig['store']
+
+beforeEach(async () => {
+  rig = await createQueuedMessageTestRig()
+  ;({ host, store } = rig)
+})
+
+afterEach(() => rig.dispose())
+
+const envelope: QueuedMessageTestRig['envelope'] = (...args) => rig.envelope(...args)
+const send: QueuedMessageTestRig['send'] = (...args) => rig.send(...args)
+const sendNow: QueuedMessageTestRig['sendNow'] = (...args) => rig.sendNow(...args)
+const submission: QueuedMessageTestRig['submission'] = (...args) => rig.submission(...args)
+const drafts: QueuedMessageTestRig['drafts'] = () => rig.drafts()
+const workingSend: QueuedMessageTestRig['workingSend'] = () => rig.workingSend()
+const settleAccepted: QueuedMessageTestRig['settleAccepted'] = (...args) =>
+  rig.settleAccepted(...args)
+const settleRejected: QueuedMessageTestRig['settleRejected'] = (...args) =>
+  rig.settleRejected(...args)
+
+describe('the one queue gate', () => {
+  it('a clear an older build left prepared holds nothing: Send-now sends the draft', async () => {
+    await workingSend()
+    const queued = await send('queued behind the clear', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    const draftId = queued.value.queued.messageId
+    // An unfinished /clear changed nothing the chat reads, so it refuses no send.
+    await store.setConversationCommand(SESSION, 1, {
+      command: 'clear',
+      runtimeFence: 1,
+      operationId: hostTestOperationId(),
+      callerKey: CALLER.callerKey,
+      phase: 'prepared',
+      state: 'unknown'
+    })
+    expect(await sendNow(draftId)).toMatchObject({ ok: true })
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+  })
+
+  it('Send-now refuses on a pending prompt and overrides a running turn', async () => {
+    const working = await workingSend()
+    const queued = await send('queued mid-turn', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    const draftId = queued.value.queued.messageId
+    const journal = host.collaboratorsForTests().sessions.get(SESSION)!.journal
+    await journal.appendItem(
+      { provider: 'orca', clientMessageId: 'prompt-1' },
+      {
+        kind: 'approval',
+        title: 'Allow the tool?',
+        detail: null,
+        options: [],
+        resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
+      },
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
+    expect(await sendNow(draftId)).toMatchObject({
+      ok: false,
+      refusal: { message: expect.stringContaining('pending request') }
+    })
+    // Read in place: the gate runs on every admission and drain step.
+    const snapshot = vi.spyOn(journal, 'snapshot')
+    expect(structuredQueueHold({ journal, record: store.getRecord(SESSION), fence: 1 })).toBe(
+      'prompt'
+    )
+    expect(snapshot).not.toHaveBeenCalled()
+    snapshot.mockRestore()
+    await journal.appendItem(
+      { provider: 'orca', clientMessageId: 'prompt-1' },
+      {
+        kind: 'approval',
+        title: 'Allow the tool?',
+        detail: null,
+        options: [],
+        resolution: {
+          state: 'resolved',
+          selectedOptionId: 'allow',
+          resolvedBy: 'client-1',
+          resolvedAt: 1
+        }
+      },
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
+    // The turn still runs (`working`), which Send-now alone may override.
+    expect(await submission(working)).toMatchObject({ dispatchState: 'pending' })
+    expect(await sendNow(draftId)).toMatchObject({
+      ok: true,
+      value: { submission: expect.anything() }
+    })
+  })
+})
+
+describe('replay preference', () => {
+  it('a replayed send whose draft was refused answers with the returned card, never the rejected submission', async () => {
+    const working = await workingSend()
+    const body = hostTestMessage('refused later')
+    const clientOperationId = hostTestOperationId()
+    const params = {
+      envelope: envelope(
+        { body, delivery: 'queue-if-active' },
+        'agentSession.send',
+        clientOperationId
+      ),
+      body,
+      delivery: 'queue-if-active' as const
+    }
+    expect(await host.send(CALLER, params)).toMatchObject({
+      ok: true,
+      value: { queued: { state: 'waiting' } }
+    })
+    await settleAccepted(working, 'a')
+    await eventually(async () => expect(await rig.handoff(clientOperationId)).toBeDefined())
+    await settleRejected(await rig.handoffId(clientOperationId), 'provider refused this payload')
+    await eventually(async () =>
+      expect(await drafts()).toMatchObject([{ messageId: clientOperationId, state: 'returned' }])
+    )
+    // The original reply was lost; the retry must agree with the card, or the
+    // same text renders twice — once on a Retry row, once on the card.
+    const replay = await host.send(CALLER, params)
+    expect(replay).toMatchObject({
+      ok: true,
+      replayed: true,
+      value: { queued: { messageId: clientOperationId, state: 'returned' } }
+    })
+    if (replay.ok && 'submission' in replay.value) {
+      throw new Error('replay answered with the rejected submission')
+    }
+  })
+})
+
+describe('replay of a deleted card', () => {
+  it('answers withdrawn once its row is pruned, never with the rejected hand-off it came back from', async () => {
+    const working = await workingSend()
+    const body = hostTestMessage('refused, then deleted')
+    const clientOperationId = hostTestOperationId()
+    const params = {
+      envelope: envelope(
+        { body, delivery: 'queue-if-active' },
+        'agentSession.send',
+        clientOperationId
+      ),
+      body,
+      delivery: 'queue-if-active' as const
+    }
+    await host.send(CALLER, params)
+    await settleAccepted(working, 'a')
+    await eventually(async () => expect(await rig.handoff(clientOperationId)).toBeDefined())
+    await settleRejected(await rig.handoffId(clientOperationId), 'provider refused this payload')
+    await eventually(async () =>
+      expect(await drafts()).toMatchObject([{ messageId: clientOperationId, state: 'returned' }])
+    )
+    expect(await rig.deleteQueued(clientOperationId)).toMatchObject({
+      ok: true,
+      value: { deleted: true }
+    })
+    // Retention later drops the tombstone; the rejected hand-off still names the draft.
+    const journal = host.collaboratorsForTests().sessions.get(SESSION)?.journal
+    if (!journal) {
+      throw new Error('expected the conversation open')
+    }
+    vi.spyOn(journal.queuedMessages, 'get').mockReturnValue(null)
+    const replay = await host.send(CALLER, params)
+    expect(replay).toMatchObject({
+      ok: true,
+      replayed: true,
+      value: { queued: { messageId: clientOperationId, state: 'withdrawn' } }
+    })
+    if (replay.ok && 'submission' in replay.value) {
+      throw new Error('replay answered with the rejected hand-off')
+    }
+  })
+})
+
+describe('the hand-off link on answers', () => {
+  it('a replayed queued send, once drained, answers with the hand-off that names its draft', async () => {
+    const working = await workingSend()
+    const body = hostTestMessage('drained later')
+    const clientOperationId = hostTestOperationId()
+    const params = {
+      envelope: envelope(
+        { body, delivery: 'queue-if-active' },
+        'agentSession.send',
+        clientOperationId
+      ),
+      body,
+      delivery: 'queue-if-active' as const
+    }
+    await host.send(CALLER, params)
+    await settleAccepted(working, 'a')
+    await eventually(async () =>
+      expect((await rig.handoff(clientOperationId))?.queuedMessageId).toBe(clientOperationId)
+    )
+    const replayed = await host.send(CALLER, params)
+    expect(replayed).toMatchObject({
+      ok: true,
+      replayed: true,
+      value: { submission: { queuedMessageId: clientOperationId } }
+    })
+    // Handed off under a fresh id, never the draft's (the send operation's) own.
+    expect(
+      replayed.ok && 'submission' in replayed.value && replayed.value.submission.clientMessageId
+    ).not.toBe(clientOperationId)
+    // The first send, direct, names no draft.
+    expect(await submission(working)).not.toHaveProperty('queuedMessageId')
+  })
+
+  it('a queued send asked again after its ledger row is gone answers with its hand-off, never sending twice', async () => {
+    const working = await workingSend()
+    const body = hostTestMessage('asked again')
+    const clientOperationId = hostTestOperationId()
+    const params = {
+      envelope: envelope(
+        { body, delivery: 'queue-if-active' },
+        'agentSession.send',
+        clientOperationId
+      ),
+      body,
+      delivery: 'queue-if-active' as const,
+      userSend: true as const
+    }
+    await host.send(CALLER, params)
+    await settleAccepted(working, 'a')
+    await eventually(async () => expect(await rig.handoff(clientOperationId)).toBeDefined())
+    const handedOffAs = await rig.handoffId(clientOperationId)
+    // The ledger forgot the id, so the send runs again rather than replaying.
+    const operations = store['transactions'].state.operations
+    for (const [key, row] of operations) {
+      if (row.operationId === clientOperationId) {
+        operations.delete(key)
+      }
+    }
+    const count = (await host.journalSnapshot(SESSION)).submissions.length
+    expect(await host.send(CALLER, params)).toMatchObject({
+      ok: true,
+      replayed: false,
+      value: { submission: { clientMessageId: handedOffAs, queuedMessageId: clientOperationId } }
+    })
+    expect((await host.journalSnapshot(SESSION)).submissions).toHaveLength(count)
+  })
+})
+
+describe('Send-now rerun', () => {
+  it('a Send whose answer never settled answers again with the submission it made, never re-sending it', async () => {
+    const working = await workingSend()
+    const queued = await send('refused twice', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    const draftId = queued.value.queued.messageId
+    await settleAccepted(working, 'a')
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+    await settleRejected(await rig.handoffId(draftId), 'first refusal')
+    await eventually(async () =>
+      expect(await drafts()).toMatchObject([{ messageId: draftId, state: 'returned' }])
+    )
+    const operationId = hostTestOperationId()
+    expect(await sendNow(draftId, operationId)).toMatchObject({ ok: true })
+    await settleRejected(operationId, 'second refusal')
+    await eventually(async () =>
+      expect(await drafts()).toMatchObject([{ messageId: draftId, state: 'returned' }])
+    )
+    // The host died before the Send's answer settled: its ledger row is still pending, so it reruns.
+    for (const row of store['transactions'].state.operations.values()) {
+      if (row.operationId === operationId) {
+        row.outcome = { status: 'pending' }
+      }
+    }
+    const count = (await host.journalSnapshot(SESSION)).submissions.length
+    expect(await sendNow(draftId, operationId)).toMatchObject({
+      ok: true,
+      value: { clientMessageId: operationId, submission: { dispatchState: 'rejected' } }
+    })
+    expect((await host.journalSnapshot(SESSION)).submissions).toHaveLength(count)
+    expect(await drafts()).toMatchObject([{ messageId: draftId, state: 'returned' }])
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-queued-message-rig.test-fixture.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-message-rig.test-fixture.ts
new file mode 100644
index 00000000000..fcc167cbb67
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-message-rig.test-fixture.ts
@@ -0,0 +1,299 @@
+// One real-host rig for the mid-turn queue suites: store, journal, adapter
+// mocks, and the send/stop/draft helpers every suite shares.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { expect, vi, type Mock } from 'vitest'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
+import type { AgentSessionQueuePause } from '../../../shared/agent-session-wire'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import type { StructuredAgentSessionEventSink } from './structured-agent-session-event-sink'
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import { rotateStructuredAgentSessionHostInstanceForTests } from './structured-agent-session-queued-pause'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+export const QUEUED_RIG_CALLER = { callerKey: 'client-1' }
+
+export function eventually(assertion: () => void | Promise<void>): Promise<void> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
+
+export type QueuedMessageTestRig = Awaited<ReturnType<typeof createQueuedMessageTestRig>>
+
+export async function createQueuedMessageTestRig() {
+  const root = await mkdtemp(join(tmpdir(), 'orca-queued-messages-'))
+  resetHostTestOperationIds()
+  // Admitted: the message is written and unanswered, so the session owes work
+  // until the test settles it.
+  const dispatch: Mock<StructuredAgentSessionAdapter['dispatch']> = vi.fn(async () => ({
+    state: 'admitted' as const
+  }))
+  const awaitStarted: Mock<NonNullable<StructuredAgentSessionAdapter['awaitStarted']>> = vi.fn(
+    async () => undefined
+  )
+  // The provider's receipt of a /compact; its end arrives later, as `finishCompact` writes it.
+  const compact: Mock<NonNullable<StructuredAgentSessionAdapter['compact']>> = vi.fn(async () => ({
+    state: 'accepted' as const,
+    providerIdentity: null
+  }))
+  let events: StructuredAgentSessionEventSink | undefined
+  const store = await AgentSessionRecordStore.open({
+    directory: join(root, 'store'),
+    hostId: 'local'
+  })
+  const host = new StructuredAgentSessionHost({
+    store,
+    adapter: {
+      acquire: async ({ fence, spawnToken, events: sink }) => {
+        events = sink
+        return {
+          process: {
+            hostId: 'local',
+            pid: 4242,
+            processStartTimeMs: 1_700_000_000_000,
+            spawnToken
+          },
+          acquisitionGeneration: 'generation-1',
+          link: {
+            linkId: `link-${fence}`,
+            handle: { provider: 'codex' as const, threadId: THREAD },
+            origin: 'created' as const,
+            mintedAtFence: fence,
+            observedAt: NOW
+          }
+        }
+      },
+      dispatch,
+      awaitStarted,
+      closeSession: vi.fn(async () => true),
+      releaseAcquisition: vi.fn(async () => true),
+      compact,
+      cancelTurn: vi.fn(async () => ({ cancelled: true })),
+      answerPrompt: vi.fn(async () => undefined),
+      setOption: vi.fn(async () => undefined)
+    },
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-1',
+    now: () => NOW
+  })
+  expect(await host.attach(QUEUED_RIG_CALLER, hostTestAttachParams(null))).toMatchObject({
+    ok: true
+  })
+
+  function envelope(
+    fields: Record<string, unknown>,
+    method: string,
+    clientOperationId: string,
+    sessionId = SESSION
+  ) {
+    return {
+      sessionId,
+      clientOperationId,
+      expectedRuntimeFence: 1,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method,
+        sessionId,
+        fields
+      })
+    }
+  }
+
+  /** A client's send, as the `agentSession.send` RPC hands it to the host;
+   *  `internal` is a host-side sender (orchestration mail, a restart continuation). */
+  function send(text: string, delivery?: 'queue-if-active', options?: { internal?: true }) {
+    const body = hostTestMessage(text)
+    const clientOperationId = hostTestOperationId()
+    const fields = { body, ...(delivery ? { delivery } : {}) }
+    const result = host.send(QUEUED_RIG_CALLER, {
+      envelope: envelope(fields, 'agentSession.send', clientOperationId),
+      body,
+      ...(delivery ? { delivery } : {}),
+      ...(options?.internal ? {} : { userSend: true as const })
+    })
+    return { id: clientOperationId, result }
+  }
+
+  function stop(clientOperationId = hostTestOperationId(), caller = QUEUED_RIG_CALLER) {
+    return host.cancel(caller, {
+      envelope: envelope({}, 'agentSession.cancel', clientOperationId)
+    })
+  }
+
+  function sendNow(
+    messageId: string,
+    clientOperationId = hostTestOperationId(),
+    sessionId = SESSION
+  ) {
+    return host.queuedMessageSend(QUEUED_RIG_CALLER, {
+      envelope: envelope(
+        { messageId },
+        'agentSession.queuedMessageSend',
+        clientOperationId,
+        sessionId
+      ),
+      messageId
+    })
+  }
+
+  function deleteQueued(messageId: string, clientOperationId = hostTestOperationId()) {
+    return host.queuedMessageDelete(QUEUED_RIG_CALLER, {
+      envelope: envelope({ messageId }, 'agentSession.queuedMessageDelete', clientOperationId),
+      messageId
+    })
+  }
+
+  async function submission(id: string): Promise<AgentJournalSubmission | undefined> {
+    return (await host.journalSnapshot(SESSION)).submissions.find(
+      (entry) => entry.clientMessageId === id
+    )
+  }
+
+  /** The latest submission that hands off this draft, found by its link. */
+  async function handoff(draftId: string): Promise<AgentJournalSubmission | undefined> {
+    return (await host.journalSnapshot(SESSION)).submissions.findLast(
+      (entry) => entry.queuedMessageId === draftId
+    )
+  }
+
+  /** The submission id a draft went out under: never the draft's own id. */
+  async function handoffId(draftId: string): Promise<string> {
+    const sent = await handoff(draftId)
+    if (!sent) {
+      throw new Error(`draft ${draftId} has not been handed off`)
+    }
+    return sent.clientMessageId
+  }
+
+  async function drafts(
+    sessionId = SESSION
+  ): Promise<{ messageId: string; state: string; paused?: true }[]> {
+    const page = await host.history({ sessionId, direction: 'tail' })
+    if (!page.ok) {
+      throw new Error('history refused')
+    }
+    return (page.page.queuedMessages ?? []).map(({ messageId, state, paused }) => ({
+      messageId,
+      state,
+      ...(paused ? { paused } : {})
+    }))
+  }
+
+  /** A first send that keeps the session working until the test settles it. */
+  async function workingSend(): Promise<string> {
+    const { id, result } = send('work on this')
+    await result
+    await eventually(async () => expect((await submission(id))?.handedOverAt).toBeDefined())
+    return id
+  }
+
+  async function settleAccepted(id: string, itemId: string): Promise<void> {
+    await host.settleLateDispatch({
+      sessionId: SESSION,
+      clientMessageId: id,
+      providerIdentity: {
+        provider: 'codex',
+        threadId: THREAD,
+        turnId: `turn-${itemId}`,
+        ordinal: 0
+      }
+    })
+  }
+
+  /** A provider refusal, written as the host writes one: the sentence and the typed fact. */
+  async function settleRejected(id: string, providerText: string): Promise<void> {
+    const detail = { text: providerText, audience: 'person' as const }
+    await host.settleLateDispatch({
+      sessionId: SESSION,
+      clientMessageId: id,
+      state: 'rejected',
+      ...agentSessionFailureWords(agentSessionFailureFact('providerRejected', { detail }), {
+        surface: 'rejection'
+      })
+    })
+  }
+
+  /** What the provider's translator writes when a /compact's turn ends, as a success. */
+  function finishCompact(): void {
+    const { command } = compact.mock.calls.at(-1)![0]
+    events!.appendLifecycleBatch!(
+      `turn-completed:${command.clientMessageId}`,
+      [
+        {
+          kind: 'item',
+          identity: command.identity,
+          body: { ...command.running, state: 'completed', outcome: 'success', completedAt: NOW },
+          turnScope: AGENT_JOURNAL_THREAD_SCOPE
+        }
+      ],
+      { lifecycle: true }
+    )
+  }
+
+  /** A host-process restart, as the queue sees it: the conversation closes, and
+   *  opens afresh under a new instance id while its rows survive. */
+  async function restartHostProcess(): Promise<void> {
+    await host.close(SESSION)
+    rotateStructuredAgentSessionHostInstanceForTests()
+  }
+
+  /** The queue's published pause: null when it sends on its own. */
+  async function queuePause(sessionId = SESSION): Promise<AgentSessionQueuePause | null> {
+    const page = await host.history({ sessionId, direction: 'tail' })
+    if (!page.ok) {
+      throw new Error('history refused')
+    }
+    return page.page.queuePause ?? null
+  }
+
+  function resume(clientOperationId = hostTestOperationId()) {
+    return host.queuedMessagesResume(QUEUED_RIG_CALLER, {
+      envelope: envelope({}, 'agentSession.queuedMessagesResume', clientOperationId)
+    })
+  }
+
+  async function dispose(): Promise<void> {
+    await host.flushAllStreamedEvents()
+    await rm(root, { recursive: true, force: true })
+  }
+
+  return {
+    root,
+    store,
+    host,
+    dispatch,
+    awaitStarted,
+    compact,
+    finishCompact,
+    envelope,
+    send,
+    stop,
+    sendNow,
+    deleteQueued,
+    submission,
+    handoff,
+    handoffId,
+    drafts,
+    workingSend,
+    settleAccepted,
+    settleRejected,
+    restartHostProcess,
+    queuePause,
+    resume,
+    dispose
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-queued-messages.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-messages.test.ts
new file mode 100644
index 00000000000..aa9d31cbf10
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-messages.test.ts
@@ -0,0 +1,862 @@
+// Mid-turn queueing against the real host, store and journal: a capable send
+// while the session owes work becomes a draft, the drain converts exactly one
+// draft when the work settles, Stop holds the queue (never withdrawing text)
+// until a user send starts its turn and lifts the pause, /clear carries the
+// cards to its replacement session, and a refused conversion comes back as a
+// returned card while a withdrawn one waits again.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  QUEUED_MESSAGE_PAUSED_SEND_FAILED,
+  type AgentSessionQueuedMessage,
+  type AgentSessionSubscribeEvent
+} from '../../../shared/agent-session-wire'
+import { ConversationCommandParams } from '../../../shared/rpc-contract/structured-agent-session-params'
+import { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { JournalQueuedMessages } from '../agent-session-journal/journal-queued-messages'
+import { rotateStructuredAgentSessionHostInstanceForTests } from './structured-agent-session-queued-pause'
+import {
+  createQueuedMessageTestRig,
+  eventually,
+  QUEUED_RIG_CALLER as CALLER,
+  type QueuedMessageTestRig
+} from './structured-agent-session-queued-message-rig.test-fixture'
+import {
+  HOST_TEST_SESSION as SESSION,
+  hostTestMessage,
+  hostTestOperationId
+} from './structured-agent-session-host-test-data'
+
+let rig: QueuedMessageTestRig
+let host: QueuedMessageTestRig['host']
+let store: QueuedMessageTestRig['store']
+let dispatch: QueuedMessageTestRig['dispatch']
+let awaitStarted: QueuedMessageTestRig['awaitStarted']
+
+beforeEach(async () => {
+  rig = await createQueuedMessageTestRig()
+  ;({ host, store, dispatch, awaitStarted } = rig)
+})
+
+afterEach(() => rig.dispose())
+
+const envelope: QueuedMessageTestRig['envelope'] = (...args) => rig.envelope(...args)
+const send: QueuedMessageTestRig['send'] = (...args) => rig.send(...args)
+const stop: QueuedMessageTestRig['stop'] = (...args) => rig.stop(...args)
+const sendNow: QueuedMessageTestRig['sendNow'] = (...args) => rig.sendNow(...args)
+const deleteQueued: QueuedMessageTestRig['deleteQueued'] = (...args) => rig.deleteQueued(...args)
+const drafts: QueuedMessageTestRig['drafts'] = (...args) => rig.drafts(...args)
+const workingSend: QueuedMessageTestRig['workingSend'] = () => rig.workingSend()
+const settleAccepted: QueuedMessageTestRig['settleAccepted'] = (...args) =>
+  rig.settleAccepted(...args)
+const settleRejected: QueuedMessageTestRig['settleRejected'] = (...args) =>
+  rig.settleRejected(...args)
+
+describe('accept', () => {
+  it('queues a capable send while the session owes work; an ordinary send still dispatches', async () => {
+    await workingSend()
+    const queued = await send('queued behind', 'queue-if-active').result
+    expect(queued).toMatchObject({
+      ok: true,
+      value: { queued: { position: 1, state: 'waiting' } }
+    })
+    // The draft is not a submission, feeds no reducer, and owes no work.
+    expect((await host.journalSnapshot(SESSION)).submissions).toHaveLength(1)
+    expect(await drafts()).toMatchObject([{ state: 'waiting' }])
+  })
+
+  it('replays the same queued answer for the same operation id', async () => {
+    await workingSend()
+    const body = hostTestMessage('queued behind')
+    const clientOperationId = hostTestOperationId()
+    const params = {
+      envelope: envelope(
+        { body, delivery: 'queue-if-active' },
+        'agentSession.send',
+        clientOperationId
+      ),
+      body,
+      delivery: 'queue-if-active' as const
+    }
+    expect(await host.send(CALLER, params)).toMatchObject({
+      ok: true,
+      replayed: false,
+      value: { queued: { state: 'waiting' } }
+    })
+    expect(await host.send(CALLER, params)).toMatchObject({
+      ok: true,
+      replayed: true,
+      value: { queued: { state: 'waiting' } }
+    })
+    expect(await drafts()).toHaveLength(1)
+  })
+
+  it('routes an image send to the immediate path even while working (text-only v1)', async () => {
+    await workingSend()
+    const body = {
+      kind: 'message' as const,
+      role: 'user' as const,
+      blocks: [{ type: 'image-ref' as const, path: '/tmp/shot.png' }]
+    }
+    const clientOperationId = hostTestOperationId()
+    const result = await host.send(CALLER, {
+      envelope: envelope(
+        { body, delivery: 'queue-if-active' },
+        'agentSession.send',
+        clientOperationId
+      ),
+      body,
+      delivery: 'queue-if-active'
+    })
+    expect(result).toMatchObject({ ok: true, value: { submission: expect.anything() } })
+    expect(await drafts()).toHaveLength(0)
+  })
+
+  it('a send without the delivery field never queues, whatever the session is doing', async () => {
+    await workingSend()
+    const { result } = send('old client send')
+    expect(await result).toMatchObject({ ok: true, value: { submission: expect.anything() } })
+    expect(await drafts()).toHaveLength(0)
+  })
+
+  it('refuses past the draft-count budget with a readable message', async () => {
+    await workingSend()
+    for (let index = 0; index < 20; index += 1) {
+      expect(await send(`draft ${index}`, 'queue-if-active').result).toMatchObject({ ok: true })
+    }
+    expect(await send('one too many', 'queue-if-active').result).toMatchObject({
+      ok: false,
+      refusal: { message: expect.stringContaining('queue is full') }
+    })
+  })
+})
+
+describe('drain', () => {
+  it('drains a single draft when the owed work settles, and one of two drafts per settle (A1)', async () => {
+    const working = await workingSend()
+    const first = await send('first queued', 'queue-if-active').result
+    const second = await send('second queued', 'queue-if-active').result
+    if (!first.ok || !('queued' in first.value) || !second.ok || !('queued' in second.value)) {
+      throw new Error('expected queued receipts')
+    }
+    const firstId = first.value.queued.messageId
+    const secondId = second.value.queued.messageId
+    await settleAccepted(working, 'a')
+    // The drain converts the OLDEST actionable draft; the consumed submission
+    // owes work again, which holds the second draft (one message per turn).
+    await eventually(async () => expect(await rig.handoff(firstId)).toBeDefined())
+    expect(await rig.handoff(secondId)).toBeUndefined()
+    expect(await drafts()).toMatchObject([{ messageId: secondId, state: 'waiting' }])
+    await settleAccepted(await rig.handoffId(firstId), 'b')
+    await eventually(async () => expect(await rig.handoff(secondId)).toBeDefined())
+    expect(await drafts()).toHaveLength(0)
+  })
+
+  it('takes no serialized drain step while the session is working, then drains when the work settles', async () => {
+    const working = await workingSend()
+    const flush = vi.spyOn(host, 'flushStreamedEvents')
+    const queued = await send('waits for the turn', 'queue-if-active').result
+    await send('and another', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    // Every wake during the turn is answered by the pre-check, not a step.
+    expect(flush).not.toHaveBeenCalled()
+    await settleAccepted(working, 'a')
+    const draftId = queued.value.queued.messageId
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+    expect(flush).toHaveBeenCalled()
+  })
+
+  it('a refused conversion returns the card with its stored reason, and an idle send overtakes a lone returned card (N1)', async () => {
+    const working = await workingSend()
+    const queued = await send('will be refused', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    const draftId = queued.value.queued.messageId
+    await settleAccepted(working, 'a')
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+    await settleRejected(await rig.handoffId(draftId), 'provider refused this payload')
+    await eventually(async () =>
+      expect(await drafts()).toMatchObject([{ messageId: draftId, state: 'returned' }])
+    )
+    // Classified like a rejected submission: from the fact, not the sentence.
+    const page = await host.history({ sessionId: SESSION, direction: 'tail' })
+    expect(page.ok && page.page.queuedMessages?.[0]?.returnedRejection).toEqual({
+      kind: 'providerRejected',
+      detail: { text: 'provider refused this payload', audience: 'person' }
+    })
+    // The lone returned card traps nothing: a new capable send goes immediately.
+    const overtaking = await send('sent past the card', 'queue-if-active').result
+    expect(overtaking).toMatchObject({ ok: true, value: { submission: expect.anything() } })
+    // And the card still offers Send: a fresh submission id re-delivers it.
+    const resent = await sendNow(draftId)
+    expect(resent).toMatchObject({ ok: true, value: { submission: expect.anything() } })
+    if (!resent.ok || !('submission' in resent.value)) {
+      throw new Error('expected the submission arm')
+    }
+    expect(resent.value.submission.clientMessageId).not.toBe(draftId)
+    // The answer names the card it sent; clients read that, never id equality.
+    expect(resent.value.submission.queuedMessageId).toBe(draftId)
+    expect(await drafts()).toHaveLength(0)
+    // Refused again: the card returns, matched through its current submission (N4).
+    await settleRejected(resent.value.submission.clientMessageId, 'refused again')
+    await eventually(async () =>
+      expect(await drafts()).toMatchObject([{ messageId: draftId, state: 'returned' }])
+    )
+  })
+
+  it('a skipped settlement hook heals on the next drain step, not only at the next open', async () => {
+    const working = await workingSend()
+    const queued = await send('refused while the hook fails', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    const draftId = queued.value.queued.messageId
+    await settleAccepted(working, 'a')
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    const hook = vi
+      .spyOn(JournalQueuedMessages.prototype, 'onRowInTransaction')
+      .mockImplementationOnce(() => {
+        throw new Error('bookkeeping failed')
+      })
+    try {
+      await settleRejected(await rig.handoffId(draftId), 'provider refused this payload')
+      await eventually(async () =>
+        expect(await drafts()).toMatchObject([{ messageId: draftId, state: 'returned' }])
+      )
+    } finally {
+      hook.mockRestore()
+      warn.mockRestore()
+    }
+  })
+
+  it('a waiting draft behind a returned card does not drain until the card is acted on (S5)', async () => {
+    const working = await workingSend()
+    const first = await send('to be refused', 'queue-if-active').result
+    const second = await send('waits behind the card', 'queue-if-active').result
+    if (!first.ok || !('queued' in first.value) || !second.ok || !('queued' in second.value)) {
+      throw new Error('expected queued receipts')
+    }
+    await settleAccepted(working, 'a')
+    const firstId = first.value.queued.messageId
+    const secondId = second.value.queued.messageId
+    await eventually(async () => expect(await rig.handoff(firstId)).toBeDefined())
+    await settleRejected(await rig.handoffId(firstId), 'refused')
+    await eventually(async () =>
+      expect(await drafts()).toMatchObject([
+        { messageId: firstId, state: 'returned' },
+        { messageId: secondId, state: 'waiting' }
+      ])
+    )
+    // Deleting the card unblocks the one behind it.
+    expect(await deleteQueued(firstId)).toMatchObject({ ok: true, value: { deleted: true } })
+    await eventually(async () => expect(await rig.handoff(secondId)).toBeDefined())
+  })
+})
+
+describe('held drafts', () => {
+  it('a restart pauses the queue, reason restarted, and it survives a reopen; never auto-sent', async () => {
+    const working = await workingSend()
+    const queued = await send('written before the restart', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    const draftId = queued.value.queued.messageId
+    await rig.restartHostProcess()
+    await settleAccepted(working, 'a')
+    // The queue is paused, not the card: it carries no hold of its own.
+    expect(await drafts()).toEqual([{ messageId: draftId, state: 'waiting' }])
+    expect(await rig.queuePause()).toEqual({ reason: 'restarted' })
+    await host.close(SESSION)
+    expect(await rig.queuePause()).toEqual({ reason: 'restarted' })
+    await new Promise((resolve) => setTimeout(resolve, 250))
+    expect(await rig.handoff(draftId)).toBeUndefined()
+    expect(await sendNow(draftId)).toMatchObject({
+      ok: true,
+      value: { submission: expect.anything() }
+    })
+  })
+
+  it("a restart's pause also lifts when the user's next send starts its turn, exactly like a Stop's", async () => {
+    const working = await workingSend()
+    const queued = await send('written before the restart', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    const draftId = queued.value.queued.messageId
+    await rig.restartHostProcess()
+    await settleAccepted(working, 'a')
+    await new Promise((resolve) => setTimeout(resolve, 250))
+    expect(await rig.handoff(draftId)).toBeUndefined()
+    expect(await rig.queuePause()).toEqual({ reason: 'restarted' })
+    // The user's send starting its turn lifts it, and adopts the row into this instance.
+    const next = send('user starts a new turn')
+    await next.result
+    expect(await rig.queuePause()).toEqual({ reason: 'restarted' })
+    await settleAccepted(next.id, 'b')
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+  })
+
+  it('a failed conversion leaves the draft waiting and paused with its error; Send retries', async () => {
+    const working = await workingSend()
+    const queued = await send('conversion fails once', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    const draftId = queued.value.queued.messageId
+    const original = AgentSessionJournal.prototype.appendSubmission
+    const append = vi
+      .spyOn(AgentSessionJournal.prototype, 'appendSubmission')
+      .mockImplementationOnce(async () => {
+        throw new Error('disk full')
+      })
+    try {
+      await settleAccepted(working, 'a')
+      await eventually(async () =>
+        expect(await drafts()).toMatchObject([
+          { messageId: draftId, state: 'waiting', paused: true }
+        ])
+      )
+    } finally {
+      append.mockRestore()
+    }
+    expect(AgentSessionJournal.prototype.appendSubmission).toBe(original)
+    const page = await host.history({ sessionId: SESSION, direction: 'tail' })
+    // A marker the client localizes, never host-authored copy.
+    expect(page.ok && page.page.queuedMessages?.[0]?.pausedReason).toBe(
+      QUEUED_MESSAGE_PAUSED_SEND_FAILED
+    )
+    // The marker is stored on the row, so a host restart keeps "Couldn't send"
+    // instead of downgrading the card to a plain pause.
+    rotateStructuredAgentSessionHostInstanceForTests()
+    const restarted = await host.history({ sessionId: SESSION, direction: 'tail' })
+    expect(restarted.ok && restarted.page.queuedMessages?.[0]?.pausedReason).toBe(
+      QUEUED_MESSAGE_PAUSED_SEND_FAILED
+    )
+    expect(await rig.handoff(draftId)).toBeUndefined()
+    expect(await sendNow(draftId)).toMatchObject({
+      ok: true,
+      value: { submission: expect.anything() }
+    })
+    expect(await drafts()).toHaveLength(0)
+  })
+})
+
+describe('Stop and Delete', () => {
+  it('Stop pauses the queue — from ANY client — and the cards stay published; no text rides the answer', async () => {
+    await workingSend()
+    const first = await send('first text', 'queue-if-active').result
+    const second = await send('second text', 'queue-if-active').result
+    if (!first.ok || !('queued' in first.value) || !second.ok || !('queued' in second.value)) {
+      throw new Error('expected queued receipts')
+    }
+    // The Stop comes from a DIFFERENT client than the one that typed the
+    // drafts: it must never move their text anywhere.
+    const operationId = hostTestOperationId()
+    const stopped = await stop(operationId, { callerKey: 'client-2' })
+    expect(stopped).toMatchObject({ ok: true, value: { cancelled: true } })
+    expect(stopped.ok && Object.keys(stopped.value).sort()).toEqual(['cancelled'])
+    expect(await drafts()).toEqual([
+      { messageId: first.value.queued.messageId, state: 'waiting' },
+      { messageId: second.value.queued.messageId, state: 'waiting' }
+    ])
+    // One pause for the whole queue: "Queue paused because you interrupted".
+    expect(await rig.queuePause()).toEqual({ reason: 'stopped' })
+    // A lost acknowledgement replays the settled Stop; still no text, no field.
+    const replayed = await stop(operationId, { callerKey: 'client-2' })
+    expect(replayed).toMatchObject({ ok: true, replayed: true, value: { cancelled: false } })
+    expect(replayed.ok && Object.keys(replayed.value).sort()).toEqual(['cancelled'])
+    expect(await drafts()).toHaveLength(2)
+  })
+
+  /** A draft consumed into a submission the delivery loop has not handed over:
+   *  the loop is held at the child's start proof until the returned release. */
+  async function consumedButNotHandedOver(): Promise<{ draftId: string; release: () => void }> {
+    const working = await workingSend()
+    const queued = await send('stopped in flight', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    let release: () => void = () => undefined
+    awaitStarted.mockImplementationOnce(
+      () => new Promise<undefined>((resolve) => (release = () => resolve(undefined)))
+    )
+    await settleAccepted(working, 'a')
+    const draftId = queued.value.queued.messageId
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+    expect((await rig.handoff(draftId))?.handedOverAt).toBeUndefined()
+    return { draftId, release: () => release() }
+  }
+
+  it("a Stop between consume and the agent's receipt sends the draft back to waiting, paused like the rest", async () => {
+    const { draftId, release } = await consumedButNotHandedOver()
+    const stopped = await stop()
+    release()
+    expect(stopped).toMatchObject({ ok: true })
+    expect(await drafts()).toEqual([{ messageId: draftId, state: 'waiting' }])
+    expect(await rig.queuePause()).toEqual({ reason: 'stopped' })
+    // Nothing failed, so the card carries no refusal: it reads like any other paused card.
+    const page = await host.history({ sessionId: SESSION, direction: 'tail' })
+    const card = page.ok ? page.page.queuedMessages?.[0] : undefined
+    expect(card).not.toHaveProperty('returnedReason')
+    expect(card).not.toHaveProperty('returnedRejection')
+    expect(dispatch).toHaveBeenCalledTimes(1)
+  })
+
+  it('the Stop pause survives eviction and reopen, and Send-now overrides it', async () => {
+    const working = await workingSend()
+    const queued = await send('paused by stop', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    const draftId = queued.value.queued.messageId
+    await stop()
+    expect(await rig.queuePause()).toEqual({ reason: 'stopped' })
+    await settleAccepted(working, 'a')
+    // Evict the handle and reopen (the history read opens the conversation at
+    // rest): the pause is derived from what the journal holds, so nothing drains.
+    await host.close(SESSION)
+    expect(await rig.queuePause()).toEqual({ reason: 'stopped' })
+    await new Promise((resolve) => setTimeout(resolve, 250))
+    expect(await rig.handoff(draftId)).toBeUndefined()
+    // Send-now overrides the pause — the user acting is a release.
+    expect(await sendNow(draftId)).toMatchObject({
+      ok: true,
+      value: { submission: expect.anything() }
+    })
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+  })
+
+  it("the user's next send lifts the stopped hold once its turn starts, and the held draft drains after that turn", async () => {
+    const working = await workingSend()
+    const queued = await send('paused by stop', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    const draftId = queued.value.queued.messageId
+    await stop()
+    await settleAccepted(working, 'a')
+    // Settling the stopped turn is not the user starting one: still paused.
+    await new Promise((resolve) => setTimeout(resolve, 250))
+    expect(await rig.handoff(draftId)).toBeUndefined()
+    expect(await rig.queuePause()).toEqual({ reason: 'stopped' })
+    // The host accepting the send is not yet a turn: the pause lifts when the
+    // provider accepts it, and the draft drains after that turn.
+    const next = send('user starts a new turn')
+    await next.result
+    expect(await rig.queuePause()).toEqual({ reason: 'stopped' })
+    await settleAccepted(next.id, 'b')
+    expect(await rig.queuePause()).toBeNull()
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+  })
+
+  it('a host-internal send (orchestration mail, a restart continuation, a host-sent launch prompt) never lifts the pause', async () => {
+    const working = await workingSend()
+    const queued = await send('paused by stop', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    const draftId = queued.value.queued.messageId
+    await stop()
+    await settleAccepted(working, 'a')
+    // All three reach the host as a send the client send RPC did not make.
+    const mail = send('coordinator mail', undefined, { internal: true })
+    expect(await mail.result).toMatchObject({ ok: true, value: { submission: expect.anything() } })
+    // The journal records who asked, which is what the pause reads.
+    expect(await rig.submission(mail.id)).toMatchObject({ origin: 'host' })
+    expect(await rig.submission(working)).toMatchObject({ origin: 'client' })
+    await settleAccepted(mail.id, 'b')
+    await new Promise((resolve) => setTimeout(resolve, 250))
+    expect(await rig.handoff(draftId)).toBeUndefined()
+    expect(await rig.queuePause()).toEqual({ reason: 'stopped' })
+  })
+
+  it("a user send lifts nothing from a 'send_failed' hold — that card waits for its explicit Send", async () => {
+    const working = await workingSend()
+    const queued = await send('conversion fails once', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    const draftId = queued.value.queued.messageId
+    const append = vi
+      .spyOn(AgentSessionJournal.prototype, 'appendSubmission')
+      .mockImplementationOnce(async () => {
+        throw new Error('disk full')
+      })
+    try {
+      await settleAccepted(working, 'a')
+      await eventually(async () =>
+        expect(await drafts()).toMatchObject([
+          { messageId: draftId, state: 'waiting', paused: true }
+        ])
+      )
+    } finally {
+      append.mockRestore()
+    }
+    const next = send('user starts a new turn')
+    await next.result
+    await settleAccepted(next.id, 'b')
+    await new Promise((resolve) => setTimeout(resolve, 250))
+    expect(await rig.handoff(draftId)).toBeUndefined()
+    const page = await host.history({ sessionId: SESSION, direction: 'tail' })
+    expect(page.ok && page.page.queuedMessages?.[0]?.pausedReason).toBe(
+      QUEUED_MESSAGE_PAUSED_SEND_FAILED
+    )
+    // The explicit Send is still the release.
+    expect(await sendNow(draftId)).toMatchObject({
+      ok: true,
+      value: { submission: expect.anything() }
+    })
+  })
+
+  it('a Stop whose pause record fails still interrupts; only the pause is lost, and it is reported', async () => {
+    await workingSend()
+    const queued = await send('kept by the stop', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    const record = vi
+      .spyOn(JournalQueuedMessages.prototype, 'recordPause')
+      .mockRejectedValueOnce(new Error('disk full'))
+    const warned = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    try {
+      expect(await stop()).toMatchObject({ ok: true, value: { cancelled: true } })
+      expect(warned).toHaveBeenCalledWith(expect.stringContaining('queue pause'), expect.anything())
+    } finally {
+      record.mockRestore()
+      warned.mockRestore()
+    }
+    expect(await rig.queuePause()).toBeNull()
+    // The draft is intact (never withdrawn), merely unpaused.
+    expect(await drafts()).toEqual([{ messageId: queued.value.queued.messageId, state: 'waiting' }])
+  })
+
+  it('Delete returns no body, replays from the receipt, and a fresh delete reports the disposition', async () => {
+    await workingSend()
+    const queued = await send('delete me', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    const draftId = queued.value.queued.messageId
+    const operationId = hostTestOperationId()
+    const deleted = await deleteQueued(draftId, operationId)
+    expect(deleted).toMatchObject({
+      ok: true,
+      replayed: false,
+      value: { deleted: true, messageId: draftId }
+    })
+    // The card leaving the published list is the whole answer.
+    expect(deleted.ok && Object.keys(deleted.value).sort()).toEqual(['deleted', 'messageId'])
+    expect(await drafts()).toHaveLength(0)
+    expect(await deleteQueued(draftId, operationId)).toMatchObject({
+      ok: true,
+      replayed: true,
+      value: { deleted: true, messageId: draftId }
+    })
+    // A FRESH delete of the already-withdrawn draft reports the disposition.
+    expect(await deleteQueued(draftId)).toMatchObject({
+      ok: true,
+      value: { deleted: false, disposition: 'withdrawn' }
+    })
+  })
+})
+
+describe('/clear', () => {
+  function clear(clientOperationId: string) {
+    const fields = { command: 'clear' as const }
+    return host.conversationCommand(CALLER, {
+      envelope: envelope(fields, 'agentSession.conversationCommand', clientOperationId),
+      ...fields
+    })
+  }
+
+  /** Two drafts paused by a Stop, then the work settled so command admission
+   *  has nothing pending. */
+  async function pausedDrafts(): Promise<[string, string]> {
+    const working = await workingSend()
+    const first = await send('first text', 'queue-if-active').result
+    const second = await send('second text', 'queue-if-active').result
+    if (!first.ok || !('queued' in first.value) || !second.ok || !('queued' in second.value)) {
+      throw new Error('expected queued receipts')
+    }
+    await stop()
+    await settleAccepted(working, 'a')
+    return [first.value.queued.messageId, second.value.queued.messageId]
+  }
+
+  it('the clear schema refuses the never-shipped withdraw opt-in', () => {
+    const base = { envelope: envelope({}, 'agentSession.conversationCommand', 'op-schema') }
+    expect(ConversationCommandParams.safeParse({ ...base, command: 'clear' }).success).toBe(true)
+    expect(
+      ConversationCommandParams.safeParse({ ...base, command: 'clear', withdrawQueued: true })
+        .success
+    ).toBe(false)
+  })
+
+  it('carries the drafts to the replacement session as visible cards on a paused queue — the same for every client', async () => {
+    const [firstId, secondId] = await pausedDrafts()
+    const operationId = hostTestOperationId()
+    const cleared = await clear(operationId)
+    expect(cleared).toMatchObject({ ok: true, value: { command: 'clear', state: 'completed' } })
+    const replacementId = cleared.ok ? cleared.value.replacementSessionId : undefined
+    if (!replacementId) {
+      throw new Error('expected a replacement session')
+    }
+    // The source's cards are spent tombstones; the replacement shows them on a
+    // queue paused by the clear — not "because you interrupted" — until the user
+    // acts: Resume, or their next send starting its turn.
+    expect(await drafts()).toHaveLength(0)
+    expect(await drafts(replacementId)).toEqual([
+      { messageId: firstId, state: 'waiting' },
+      { messageId: secondId, state: 'waiting' }
+    ])
+    expect(await rig.queuePause(replacementId)).toEqual({ reason: 'cleared' })
+    // Paused from before the first carried card lands: the idle replacement auto-sends nothing.
+    await new Promise((resolve) => setTimeout(resolve, 250))
+    expect((await host.journalSnapshot(replacementId)).submissions).toHaveLength(0)
+    // A lost acknowledgement's replay re-runs nothing and duplicates nothing.
+    const replayed = await clear(operationId)
+    expect(replayed).toMatchObject({ ok: true, replayed: true })
+    expect(await drafts(replacementId)).toHaveLength(2)
+    // The carried card still answers Send-now, on the replacement.
+    expect(await rig.sendNow(firstId, hostTestOperationId(), replacementId)).toMatchObject({
+      ok: true,
+      value: { submission: expect.anything() }
+    })
+  })
+
+  it("the replacement's 'cleared' pause lifts through Resume exactly like a Stop's", async () => {
+    const [firstId] = await pausedDrafts()
+    const cleared = await clear(hostTestOperationId())
+    const replacementId = cleared.ok ? cleared.value.replacementSessionId : undefined
+    if (!replacementId) {
+      throw new Error('expected a replacement session')
+    }
+    expect(await rig.queuePause(replacementId)).toEqual({ reason: 'cleared' })
+    const resumed = await host.queuedMessagesResume(CALLER, {
+      envelope: envelope(
+        {},
+        'agentSession.queuedMessagesResume',
+        hostTestOperationId(),
+        replacementId
+      )
+    })
+    expect(resumed).toMatchObject({ ok: true, value: { resumed: true } })
+    expect(await rig.queuePause(replacementId)).toBeNull()
+    await eventually(async () =>
+      expect(
+        (await host.journalSnapshot(replacementId)).submissions.some(
+          (entry) => entry.queuedMessageId === firstId
+        )
+      ).toBe(true)
+    )
+  })
+
+  it('a carry whose insert fails leaves no pause over the empty replacement', async () => {
+    await pausedDrafts()
+    const warned = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    const insert = vi
+      .spyOn(JournalQueuedMessages.prototype, 'insert')
+      .mockRejectedValueOnce(new Error('disk full'))
+    let replacementId: string | undefined
+    try {
+      const cleared = await clear(hostTestOperationId())
+      replacementId = cleared.ok ? cleared.value.replacementSessionId : undefined
+    } finally {
+      insert.mockRestore()
+      warned.mockRestore()
+    }
+    if (!replacementId) {
+      throw new Error('expected a replacement session')
+    }
+    expect(await drafts(replacementId)).toHaveLength(0)
+    const journal = host.collaboratorsForTests().sessions.get(replacementId)?.journal
+    expect(journal?.queuedMessages.pause()).toBeNull()
+  })
+
+  it('a returned card carries over as a plain waiting draft on the paused replacement', async () => {
+    const working = await workingSend()
+    const queued = await send('refused then cleared', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    const draftId = queued.value.queued.messageId
+    await settleAccepted(working, 'a')
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+    await settleRejected(await rig.handoffId(draftId), 'provider refused this payload')
+    await eventually(async () =>
+      expect(await drafts()).toMatchObject([{ messageId: draftId, state: 'returned' }])
+    )
+    const cleared = await clear(hostTestOperationId())
+    const replacementId = cleared.ok ? cleared.value.replacementSessionId : undefined
+    if (!replacementId) {
+      throw new Error('expected a replacement session')
+    }
+    // The refusal belonged to the source's submissions; on the replacement the
+    // text is simply a waiting draft again, behind the replacement's pause.
+    expect(await drafts(replacementId)).toEqual([{ messageId: draftId, state: 'waiting' }])
+    expect(await rig.queuePause(replacementId)).toEqual({ reason: 'cleared' })
+    expect(await drafts()).toHaveLength(0)
+  })
+
+  it('a clear an older build left prepared holds no draft: it drains when the turn settles', async () => {
+    const working = await workingSend()
+    const queued = await send('behind the clear', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    const draftId = queued.value.queued.messageId
+    await store.setConversationCommand(SESSION, 1, {
+      command: 'clear',
+      runtimeFence: 1,
+      operationId: hostTestOperationId(),
+      callerKey: CALLER.callerKey,
+      phase: 'prepared',
+      state: 'unknown'
+    })
+    await settleAccepted(working, 'a')
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+  })
+
+  it('a clear with no drafts carries nothing and answers exactly as before', async () => {
+    const cleared = await clear(hostTestOperationId())
+    expect(cleared).toMatchObject({ ok: true, value: { command: 'clear', state: 'completed' } })
+    const replacementId = cleared.ok ? cleared.value.replacementSessionId : undefined
+    if (!replacementId) {
+      throw new Error('expected a replacement session')
+    }
+    expect(await drafts(replacementId)).toHaveLength(0)
+  })
+})
+
+describe('publication', () => {
+  async function subscribeEvents(): Promise<AgentSessionSubscribeEvent[]> {
+    const events: AgentSessionSubscribeEvent[] = []
+    await host.subscribe({
+      id: 'subscriber-1',
+      sessionId: SESSION,
+      emit: (event) => events.push(event)
+    })
+    return events
+  }
+
+  function queuedFrames(events: AgentSessionSubscribeEvent[]): AgentSessionQueuedMessage[][] {
+    return events.flatMap((event) =>
+      event.type !== 'end' && event.queuedMessages !== undefined && event.queuedMessages !== null
+        ? [event.queuedMessages]
+        : []
+    )
+  }
+
+  it('hydrates the list on subscribe, publishes draft inserts at an unchanged cursor, and carries the shrunk list with the consumed submission in one frame', async () => {
+    const working = await workingSend()
+    const events = await subscribeEvents()
+    // Hydration: the opening snapshot carries the (empty) list.
+    expect(events[0]).toMatchObject({ type: 'snapshot', queuedMessages: [] })
+    const queued = await send('queued behind', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    const draftId = queued.value.queued.messageId
+    // The insert writes no journal row, yet the caught-up publish delivers it.
+    await eventually(() => {
+      const lists = queuedFrames(events)
+      expect(lists.at(-1)).toMatchObject([{ messageId: draftId, state: 'waiting' }])
+    })
+    await settleAccepted(working, 'a')
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+    // The frame that carries the consumed submission also carries the shrunk list.
+    const consumeFrame = events.find(
+      (event) =>
+        event.type === 'batch' &&
+        event.batch.submissions.some((entry) => entry.queuedMessageId === draftId)
+    )
+    expect(consumeFrame).toBeDefined()
+    if (consumeFrame?.type === 'batch') {
+      expect(consumeFrame.queuedMessages).toEqual([])
+    }
+  })
+
+  it('a failed conversion reaches live subscribers as a paused card, with no further journal commit', async () => {
+    const working = await workingSend()
+    const events = await subscribeEvents()
+    const queued = await send('conversion fails once', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    const draftId = queued.value.queued.messageId
+    const append = vi
+      .spyOn(AgentSessionJournal.prototype, 'appendSubmission')
+      .mockImplementationOnce(async () => {
+        throw new Error('disk full')
+      })
+    try {
+      await settleAccepted(working, 'a')
+      await eventually(() =>
+        expect(queuedFrames(events).at(-1)).toMatchObject([
+          { messageId: draftId, paused: true, pausedReason: QUEUED_MESSAGE_PAUSED_SEND_FAILED }
+        ])
+      )
+    } finally {
+      append.mockRestore()
+    }
+    // Send releases the process-level pause, which later tests' reused ids would otherwise inherit.
+    expect(await sendNow(draftId)).toMatchObject({ ok: true })
+  })
+
+  it("live frames carry the queue's pause with the list, and Resume's lift", async () => {
+    await workingSend()
+    const events = await subscribeEvents()
+    const queued = await send('paused by stop', 'queue-if-active').result
+    if (!queued.ok || !('queued' in queued.value)) {
+      throw new Error('expected a queued receipt')
+    }
+    const pauses = () =>
+      events.flatMap((event) =>
+        event.type !== 'end' && event.queuePause !== undefined ? [event.queuePause] : []
+      )
+    await eventually(() => expect(pauses().at(-1)).toBeNull())
+    await stop()
+    await eventually(() => expect(pauses().at(-1)).toEqual({ reason: 'stopped' }))
+    expect(await rig.resume()).toMatchObject({ ok: true, value: { resumed: true } })
+    await eventually(() => expect(pauses().at(-1)).toBeNull())
+  })
+
+  it('an idle Stop that takes no effect pauses nothing', async () => {
+    const working = await workingSend()
+    const first = await send('to be refused', 'queue-if-active').result
+    const second = await send('waits behind the card', 'queue-if-active').result
+    if (!first.ok || !('queued' in first.value) || !second.ok || !('queued' in second.value)) {
+      throw new Error('expected queued receipts')
+    }
+    const firstId = first.value.queued.messageId
+    await settleAccepted(working, 'a')
+    await eventually(async () => expect(await rig.handoff(firstId)).toBeDefined())
+    await settleRejected(await rig.handoffId(firstId), 'refused')
+    await eventually(async () =>
+      expect(await drafts()).toMatchObject([{ messageId: firstId, state: 'returned' }, {}])
+    )
+    // Idle, nothing in flight and nothing withdrawn: the Stop changes nothing.
+    expect(await stop()).toMatchObject({ ok: true, value: { cancelled: false } })
+    expect(await rig.queuePause()).toBeNull()
+  })
+
+  it('an unchanged list is not re-sent on later frames', async () => {
+    await workingSend()
+    const events = await subscribeEvents()
+    await send('queued behind', 'queue-if-active').result
+    await eventually(() => expect(queuedFrames(events).length).toBeGreaterThan(0))
+    const framesAfterInsert = queuedFrames(events).length
+    // Another journal commit with no draft change re-sends nothing.
+    const { result } = send('another working send')
+    await result
+    await eventually(async () => {
+      const last = events.at(-1)
+      expect(last?.type).toBe('batch')
+    })
+    expect(queuedFrames(events).length).toBe(framesAfterInsert)
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-queued-messages.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-messages.ts
new file mode 100644
index 00000000000..273af6dfee6
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-messages.ts
@@ -0,0 +1,378 @@
+// Mid-turn queueing: the accept decision that turns a send into a host-held
+// draft, the serialized drain that converts one draft into an ordinary
+// submission when the session stops owing work, and the published draft list.
+//
+// Drafts are never owed work: they feed no reducer, no working status, no
+// teardown and no idle sweep. The drain re-reads every gate inside its own
+// serialized step, so there is no loop state to disagree with the journal.
+
+import { randomUUID } from 'node:crypto'
+import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
+import {
+  QUEUED_MESSAGE_PAUSED_SEND_FAILED,
+  type AgentSessionSendResult,
+  type AgentSessionWireRefusal
+} from '../../../shared/agent-session-wire'
+import {
+  createStructuredAgentSessionOperationId,
+  structuredAgentSessionPayloadFingerprint
+} from '../../../shared/structured-agent-session-mutation'
+import { queuedSendAnswer } from './structured-agent-session-queued-send-answer'
+import { structuredAgentSessionSendBlock } from './structured-agent-session-send-preparation'
+import { isUnsettledQueuedMessage } from '../agent-session-journal/queued-message-table'
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import { isStructuredAgentSessionMainAgentWorking } from '../../../shared/structured-agent-session-main-agent-working'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { QueuedMessageNotConsumableError } from '../agent-session-journal/journal-queued-messages'
+import type { QueuedMessageRow } from '../agent-session-journal/queued-message-table'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+import {
+  structuredAgentSessionHostInstance,
+  structuredQueuePause
+} from './structured-agent-session-queued-pause'
+
+/** Budget at accept, in the send schema's own unit (`Buffer.byteLength` of the
+ *  serialized blocks); refused readably rather than trimmed. */
+export const QUEUED_MESSAGES_MAX_COUNT = 20
+export const QUEUED_MESSAGES_MAX_TOTAL_BYTES = 1024 * 1024
+
+/** Text-only v1: any image block routes to the immediate path. */
+export function queuedMessageBodyIsTextOnly(body: AgentJournalMessageItem): boolean {
+  return body.blocks.every((block) => block.type === 'text')
+}
+
+/** Walks the reduced items in place: the gate runs on every admission and
+ *  drain step, so it must not render a snapshot of the whole journal. */
+export function pendingPromptExists(journal: Pick<AgentSessionJournal, 'visitItems'>): boolean {
+  let pending = false
+  journal.visitItems((_itemId, _sequence, body) => {
+    if (
+      !pending &&
+      (body.kind === 'approval' || body.kind === 'question') &&
+      body.resolution.state === 'pending'
+    ) {
+      pending = true
+    }
+  })
+  return pending
+}
+
+/** Waiting, not held on its own, not positioned behind a returned card, and the
+ *  queue not paused. The admission rule (§accept) and the drain's selection
+ *  both read it. */
+function oldestActionableQueuedMessage(
+  journal: Pick<AgentSessionJournal, 'queuedMessages' | 'cursor' | 'wroteBeforeOpen'>
+): QueuedMessageRow | null {
+  const rows = journal.queuedMessages.list()
+  // Nothing waiting costs no pause derivation: this runs on every journal publish.
+  if (!rows.some((row) => row.state === 'waiting') || structuredQueuePause(journal) !== null) {
+    return null
+  }
+  for (const row of rows) {
+    if (row.state === 'returned') {
+      // A returned card blocks everything after it until the user acts.
+      return null
+    }
+    if (row.state === 'waiting' && row.holdReason === null) {
+      return row
+    }
+  }
+  return null
+}
+
+/**
+ * Why the queue is not sending right now — ONE decision for admission, the
+ * drain step and Send-now, so the lists cannot drift. Each caller's override
+ * policy sits next to its use:
+ *
+ *   admission: `blocked` refuses (the immediate path's own refusal); any other
+ *     hold, or an actionable backlog, queues the send as a draft.
+ *   drain step: any hold returns early; whatever clears it publishes or
+ *     commits, which re-derives.
+ *   Send-now: overrides only `working` (plus FIFO order and the stored hold);
+ *     `blocked` and `prompt` refuse readably.
+ *
+ * `blocked` is whatever refuses any send (an uncertain rewind, a cleared source);
+ * the rest are waits. A /compact is a queued message and then a turn,
+ * so it holds the queue as `working`; an older build's compaction record belongs
+ * to a child this host no longer runs and holds nothing. Host-local vocabulary —
+ * never on the wire.
+ */
+export type StructuredQueueHold = 'blocked' | 'working' | 'prompt'
+
+export function structuredQueueHold(input: {
+  journal: AgentSessionJournal
+  record: AgentSessionRecord | null
+  fence: number
+}): StructuredQueueHold | null {
+  // Whatever refuses any send refuses the queue too: an uncertain rewind or a source a
+  // clear superseded. One rule, the immediate path's own.
+  if (structuredAgentSessionSendBlock(input.record)) {
+    return 'blocked'
+  }
+  const { journal } = input
+  // `prompt` outranks `working`: it is the one wait Send-now may not override,
+  // so a prompt raised mid-turn must not read as merely `working`.
+  if (pendingPromptExists(journal)) {
+    return 'prompt'
+  }
+  if (
+    isStructuredAgentSessionMainAgentWorking(
+      journal.activeTurnId(),
+      journal.submissions(),
+      input.fence
+    )
+  ) {
+    return 'working'
+  }
+  return null
+}
+
+/**
+ * Whether a `queue-if-active` send becomes a draft: any queue hold short of
+ * `blocked`, or an actionable draft already exists (FIFO backlog — an
+ * ADMISSION rule only, never a drain gate). A lone returned card, or a paused
+ * queue, does not trap a new send: the user acting now wins, and that send's
+ * turn starting is what lifts the pause — Orca's own queue policy, a stated
+ * deviation from held-head backlog counting.
+ */
+export function shouldQueueStructuredAgentSessionSend(input: {
+  journal: AgentSessionJournal
+  record: AgentSessionRecord | null
+  fence: number
+}): boolean {
+  const hold = structuredQueueHold(input)
+  if (hold === 'blocked') {
+    // The immediate path's own refusal (`structuredAgentSessionSendBlock`)
+    // answers; queueing behind a fence would strand the draft.
+    return false
+  }
+  if (hold !== null) {
+    return true
+  }
+  return oldestActionableQueuedMessage(input.journal) !== null
+}
+
+/** A draft's payload fingerprint in the session that will send it: the reducer
+ *  aliases the provider's echo to the submission by recomputing exactly this. */
+export function queuedMessageFingerprint(sessionId: string, body: AgentJournalMessageItem): string {
+  return structuredAgentSessionPayloadFingerprint({
+    method: 'agentSession.send',
+    sessionId,
+    fields: { body }
+  })
+}
+
+/** The accept-side budget refusal, or null when the draft fits. */
+export function queuedMessageBudgetRefusal(
+  journal: AgentSessionJournal,
+  body: AgentJournalMessageItem
+): AgentSessionWireRefusal | null {
+  const unsettled = journal.queuedMessages.list().filter(isUnsettledQueuedMessage)
+  const bytes = unsettled.reduce(
+    (sum, row) => sum + Buffer.byteLength(JSON.stringify(row.body.blocks), 'utf8'),
+    Buffer.byteLength(JSON.stringify(body.blocks), 'utf8')
+  )
+  if (unsettled.length >= QUEUED_MESSAGES_MAX_COUNT || bytes > QUEUED_MESSAGES_MAX_TOTAL_BYTES) {
+    return {
+      code: 'agent_session_operation_invalid',
+      message: 'The message queue is full. Send again after the current turn ends.'
+    }
+  }
+  return null
+}
+
+/**
+ * The accept branch: a capable send while the session is working (or behind an
+ * actionable backlog) becomes a draft instead of a submission. Returns null for
+ * the immediate path — an incapable client, an image body (text-only v1), a
+ * replayed id the journal already answers, or an idle session.
+ */
+export async function maybeQueueStructuredAgentSessionSend(
+  context: {
+    deps: { store: { getRecord: (sessionId: string) => AgentSessionRecord | null } }
+  },
+  ctx: {
+    sessionId: string
+    journal: AgentSessionJournal
+    fence: number
+  },
+  params: {
+    envelope: { clientOperationId: string }
+    body: AgentJournalMessageItem
+    delivery?: 'queue-if-active'
+  }
+): Promise<
+  | { ok: true; value: AgentSessionSendResult }
+  | { ok: false; refusal: AgentSessionWireRefusal }
+  | null
+> {
+  const clientMessageId = params.envelope.clientOperationId
+  if (params.delivery !== 'queue-if-active' || !queuedMessageBodyIsTextOnly(params.body)) {
+    return null
+  }
+  // Asked again with no ledger answer: a send this host queued answers as its replay would —
+  // its hand-off goes out under a fresh id, so no submission under this id guards it.
+  const queuedBefore = queuedSendAnswer(ctx.journal, clientMessageId)
+  if (queuedBefore) {
+    return { ok: true, value: queuedBefore }
+  }
+  // A recorded direct submission under this id replays through today's path.
+  if (ctx.journal.submissions().some((entry) => entry.clientMessageId === clientMessageId)) {
+    return null
+  }
+  if (
+    !shouldQueueStructuredAgentSessionSend({
+      journal: ctx.journal,
+      record: context.deps.store.getRecord(ctx.sessionId),
+      fence: ctx.fence
+    })
+  ) {
+    return null
+  }
+  const refusal = queuedMessageBudgetRefusal(ctx.journal, params.body)
+  if (refusal) {
+    return { ok: false, refusal }
+  }
+  // The insert notifies through the journal's commit listener: publication and
+  // the drain re-derive with no call here to forget.
+  const row = await ctx.journal.queuedMessages.insert({
+    messageId: clientMessageId,
+    body: params.body,
+    fingerprint: queuedMessageFingerprint(ctx.sessionId, params.body),
+    hostInstance: structuredAgentSessionHostInstance()
+  })
+  return {
+    ok: true,
+    value: {
+      clientMessageId,
+      queued: { messageId: row.messageId, position: row.position, state: row.state }
+    }
+  }
+}
+
+export type QueuedMessageDrainDeps = {
+  sessions: ReadonlyMap<string, StructuredAgentSessionHostSession>
+  getRecord: (sessionId: string) => AgentSessionRecord | null
+  serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
+  /** The streamed-event barrier: a turn-open already accepted by the host is
+   *  committed before the gates are read, so no stored busy flag is needed. */
+  flushStreamedEvents: (sessionId: string) => Promise<void>
+  conversationFence: (sessionId: string) => number
+  /** The consumed submission is ordinary #22821 work from here on. */
+  wakeDelivery: (sessionId: string) => void
+  onError: (sessionId: string, error: unknown) => void
+}
+
+/**
+ * The serialized drain. Woken by every journal commit (turn, submission, prompt,
+ * command and Stop settlements are all commits), by draft mutations, and by the
+ * conversation opening; each step re-derives everything and consumes at most one
+ * draft — the consumed submission then owes work, which gates the next.
+ */
+export class StructuredAgentSessionQueuedMessageDrain {
+  private readonly scheduled = new Set<string>()
+
+  constructor(private readonly deps: QueuedMessageDrainDeps) {}
+
+  schedule(sessionId: string): void {
+    const journal = this.deps.sessions.get(sessionId)?.journal
+    if (!journal || journal.isReadOnly) {
+      return
+    }
+    // Cheap pre-check so token streams do not pay a serialized step per delta.
+    // Skipping while working is safe: whatever ends the work is itself a commit
+    // that schedules again, and the step re-reads every gate after its flush.
+    try {
+      if (
+        !journal.queuedMessages.settlementOwed() &&
+        (oldestActionableQueuedMessage(journal) === null ||
+          isStructuredAgentSessionMainAgentWorking(
+            journal.activeTurnId(),
+            journal.submissions(),
+            this.deps.conversationFence(sessionId)
+          ))
+      ) {
+        return
+      }
+    } catch {
+      // The handle is opening or closing; the next commit re-schedules.
+      return
+    }
+    if (this.scheduled.has(sessionId)) {
+      return
+    }
+    this.scheduled.add(sessionId)
+    void this.deps
+      .serialize(sessionId, () => {
+        this.scheduled.delete(sessionId)
+        return this.step(sessionId)
+      })
+      .catch((error: unknown) => {
+        this.scheduled.delete(sessionId)
+        this.deps.onError(sessionId, error)
+      })
+  }
+
+  private async step(sessionId: string): Promise<void> {
+    const session = this.deps.sessions.get(sessionId)
+    if (!session || session.journal.isReadOnly) {
+      return
+    }
+    await this.deps.flushStreamedEvents(sessionId)
+    const journal = session.journal
+    if (journal.queuedMessages.settlementOwed() || journal.queuedMessages.deliveredByEchoOwed()) {
+      // A live per-row hook was skipped; heal now, before a draft sends, rather than at reopen.
+      await journal.queuedMessages.settleOwed().catch((error: unknown) => {
+        this.deps.onError(sessionId, error)
+      })
+    }
+    const next = oldestActionableQueuedMessage(journal)
+    if (!next) {
+      return
+    }
+    const record = this.deps.getRecord(sessionId)
+    const fence = this.deps.conversationFence(sessionId)
+    // Live facts only, through the one gate; the backlog is never a gate, so a
+    // lone draft drains. Whatever clears a hold publishes or commits, which
+    // re-derives this step.
+    if (structuredQueueHold({ journal, record, fence }) !== null) {
+      return
+    }
+    // Always a fresh id: the submission names its draft by `queuedMessageId`, never by id equality.
+    const submissionId = createStructuredAgentSessionOperationId(randomUUID)
+    try {
+      await journal.appendSubmission(
+        {
+          clientMessageId: submissionId,
+          // The queue's own automatic send: it never ends a pause.
+          origin: 'host',
+          payloadFingerprint: next.fingerprint,
+          body: next.body,
+          fence,
+          handoverRecorded: true
+        },
+        {
+          messageId: next.messageId,
+          expect: 'waiting',
+          settledByOp: null,
+          hostInstance: structuredAgentSessionHostInstance()
+        }
+      )
+    } catch (error) {
+      if (error instanceof QueuedMessageNotConsumableError) {
+        // Lost a race with a Send-now or Delete; their transition stands.
+        return
+      }
+      // Pre-consume failure: the draft stays waiting, held with the marker on
+      // the card (a stored fact, so it survives eviction and restart). The
+      // hold's own commit notification publishes it. An explicit Send retries;
+      // no automatic retry loop.
+      await journal.queuedMessages
+        .hold({ messageIds: [next.messageId], reason: QUEUED_MESSAGE_PAUSED_SEND_FAILED })
+        .catch(() => {})
+      throw error
+    }
+    this.deps.wakeDelivery(sessionId)
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-queued-mutations.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-mutations.ts
new file mode 100644
index 00000000000..89fc2b0c432
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-mutations.ts
@@ -0,0 +1,316 @@
+// `agentSession.queuedMessageSend` / `agentSession.queuedMessageDelete`, and
+// /clear's carry of the source's drafts to its replacement session. Settling
+// operations stamp op-scoped tombstone receipts, so a lost acknowledgement
+// replays from the rows themselves — never from the operation ledger, which
+// records only that an operation happened. No mutation returns draft text:
+// the published list is the one authority a client renders.
+
+import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
+import { agentSessionOperationKey } from '../../../shared/agent-session-operation-ledger'
+import type {
+  AgentSessionMutationEnvelope,
+  AgentSessionMutationResult,
+  AgentSessionQueuedMessageDeleteResult,
+  AgentSessionQueuedMessagesResumeResult,
+  AgentSessionSendResult
+} from '../../../shared/agent-session-wire'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { QueuedMessageNotConsumableError } from '../agent-session-journal/journal-queued-messages'
+import type { QueuedMessageRow } from '../agent-session-journal/queued-message-table'
+import type { MutationPlan } from './structured-agent-session-mutation-plans'
+import {
+  queuedMessageFingerprint,
+  structuredQueueHold
+} from './structured-agent-session-queued-messages'
+import {
+  resumeStructuredQueue,
+  structuredAgentSessionHostInstance
+} from './structured-agent-session-queued-pause'
+import { unsettledQueuedMessages } from './structured-agent-session-queued-stop'
+import {
+  mutateStructuredAgentSession,
+  type StructuredAgentSessionMutationContext
+} from './structured-agent-session-host-mutations'
+import type { StructuredAgentSessionCaller } from './structured-agent-session-host-types'
+import {
+  openForWrite,
+  structuredAgentSessionSendBlock
+} from './structured-agent-session-send-preparation'
+import type { AgentSessionTurnContext, TurnOutcome } from './structured-agent-session-turns'
+
+function invalid(message: string): {
+  ok: false
+  refusal: { code: 'agent_session_operation_invalid'; message: string }
+} {
+  return { ok: false, refusal: { code: 'agent_session_operation_invalid', message } }
+}
+
+function submissionFor(
+  ctx: AgentSessionTurnContext,
+  clientMessageId: string
+): AgentJournalSubmission | undefined {
+  return ctx.journal.submissions().find((entry) => entry.clientMessageId === clientMessageId)
+}
+
+/** One transaction, stamped with the operation's caller-scoped key so a replay
+ *  answers "spent" from the receipts. Withdrawal retires any hold in the same
+ *  UPDATE, and the store's commit notification publishes the change. */
+export async function withdrawQueuedMessagesForOperation(
+  journal: AgentSessionJournal,
+  input: {
+    sessionId: string
+    messageIds: readonly string[]
+    callerKey: string
+    operationId: string
+  }
+): Promise<QueuedMessageRow[]> {
+  return journal.queuedMessages.withdraw({
+    messageIds: input.messageIds,
+    settledByOp: agentSessionOperationKey(input.callerKey, input.operationId)
+  })
+}
+
+/**
+ * /clear's carry: the source's unsettled drafts become rows on the replacement
+ * session — the SAME for every client version, with no text on the wire — so the
+ * cards stay visible where the user now is. The replacement's queue starts
+ * paused ('cleared'), lifted exactly like a Stop's: the cards were written for the context /clear just
+ * discarded, so they wait for the user's next turn there, or Resume, rather than
+ * sending into the fresh context unasked. Each card lands with the pause in one
+ * transaction, so the drain never sees a carried card unpaused and no pause is
+ * left over an empty queue if an insert fails. Runs after the
+ * replacement's attach succeeded and before the clear commits. Each insert is
+ * idempotent on (session, message), so a retried clear replays it safely; the source rows are then tombstoned. Bookkeeping around the clear:
+ * a failure leaves the cards on the superseded source — whose supersession
+ * fence already blocks the drain — reported, never gating the clear. A crash
+ * between the copy and the tombstone leaves both, which the fence also makes
+ * harmless: nothing is lost and nothing runs.
+ */
+export async function carryQueuedMessagesToClearReplacement(
+  ctx: AgentSessionTurnContext,
+  input: {
+    replacementSessionId: string
+    replacementJournal: AgentSessionJournal | undefined
+    callerKey: string
+    operationId: string
+  }
+): Promise<void> {
+  try {
+    const rows = unsettledQueuedMessages(ctx.journal)
+    if (rows.length === 0) {
+      return
+    }
+    const replacement = input.replacementJournal
+    if (!replacement) {
+      throw new Error('the replacement journal is not open')
+    }
+    for (const row of rows) {
+      // A returned card carries over as a plain waiting draft — its refusal
+      // belonged to the source's submissions. The fingerprint is re-scoped to the
+      // replacement, or its echo could never alias the sent bubble.
+      await replacement.queuedMessages.insert({
+        messageId: row.messageId,
+        body: row.body,
+        fingerprint: queuedMessageFingerprint(input.replacementSessionId, row.body),
+        hostInstance: structuredAgentSessionHostInstance(),
+        pausedBy: 'cleared'
+      })
+    }
+    await withdrawQueuedMessagesForOperation(ctx.journal, {
+      sessionId: ctx.sessionId,
+      messageIds: rows.map((row) => row.messageId),
+      callerKey: input.callerKey,
+      operationId: input.operationId
+    })
+  } catch (error) {
+    console.warn("[agent-session] /clear's queued-draft carry skipped:", {
+      sessionId: ctx.sessionId,
+      error: error instanceof Error ? error.message : String(error)
+    })
+  }
+}
+
+/** Draft actions run like any mutation: admitted on the session's lane, the
+ *  conversation opened for the write. */
+function mutateQueued<TValue>(
+  context: StructuredAgentSessionMutationContext,
+  caller: StructuredAgentSessionCaller,
+  envelope: AgentSessionMutationEnvelope,
+  plan: MutationPlan<TValue>
+): Promise<AgentSessionMutationResult<TValue>> {
+  return mutateStructuredAgentSession(
+    context,
+    caller,
+    envelope,
+    plan,
+    openForWrite(context, envelope)
+  )
+}
+
+/**
+ * Send-now. It overrides ONLY queue policy — FIFO order, pause, the busy-turn
+ * wait — through the same send block and pending-prompt gates as any send;
+ * supersession, Stop and prepared commands are never overridden. The card goes
+ * out under this operation's id, never its own, and the submission names it by
+ * `queuedMessageId`; one id still means one delivery.
+ */
+export function sendQueuedStructuredAgentMessage(
+  context: StructuredAgentSessionMutationContext,
+  caller: StructuredAgentSessionCaller,
+  params: { envelope: AgentSessionMutationEnvelope; messageId: string }
+): Promise<AgentSessionMutationResult<AgentSessionSendResult>> {
+  const { messageId } = params
+  const operationId = params.envelope.clientOperationId
+  const plan: MutationPlan<AgentSessionSendResult> = {
+    method: 'agentSession.queuedMessageSend',
+    fields: { messageId },
+    conversationWrite: true,
+    run: async (ctx): Promise<TurnOutcome<AgentSessionSendResult>> => {
+      // A rerun of this operation after it consumed the card (its answer never
+      // settled): answer with the submission it made, never append it again.
+      const consumedHere = submissionFor(ctx, operationId)
+      if (consumedHere?.queuedMessageId === messageId) {
+        return { ok: true, value: { clientMessageId: operationId, submission: consumedHere } }
+      }
+      // The one queue gate; Send-now's override set is exactly `working` (plus
+      // FIFO order and the stored hold, which the consume below clears).
+      const record = context.deps.store.getRecord(ctx.sessionId)
+      const hold = structuredQueueHold({ journal: ctx.journal, record, fence: ctx.fence })
+      if (hold === 'blocked') {
+        return structuredAgentSessionSendBlock(record) ?? invalid('This conversation cannot send.')
+      }
+      if (hold === 'prompt') {
+        return invalid('Answer the pending request before sending this message.')
+      }
+      const row = ctx.journal.queuedMessages.get(messageId)
+      if (!row) {
+        return invalid('No queued message by that id.')
+      }
+      if (row.state === 'withdrawn') {
+        return invalid('This queued message was withdrawn.')
+      }
+      if (row.state === 'dispatched') {
+        // Already a submission — answer with it rather than sending twice.
+        const submission = row.consumedAs === null ? undefined : submissionFor(ctx, row.consumedAs)
+        return submission
+          ? { ok: true, value: { clientMessageId: submission.clientMessageId, submission } }
+          : invalid('This queued message was already sent.')
+      }
+      const submissionId = operationId
+      try {
+        await ctx.journal.appendSubmission(
+          {
+            clientMessageId: submissionId,
+            // The person asked for this turn, so it ends a Stop's pause once it starts.
+            origin: 'client',
+            payloadFingerprint: row.fingerprint,
+            body: row.body,
+            fence: ctx.fence,
+            handoverRecorded: true
+          },
+          {
+            messageId,
+            expect: row.state,
+            settledByOp: agentSessionOperationKey(ctx.resolvedBy, operationId),
+            hostInstance: structuredAgentSessionHostInstance()
+          }
+        )
+      } catch (error) {
+        if (error instanceof QueuedMessageNotConsumableError) {
+          return invalid('The queued message changed underneath this Send; try again.')
+        }
+        throw error
+      }
+      const submission = submissionFor(ctx, submissionId)
+      if (!submission) {
+        throw new Error('agent_session_submission_lost')
+      }
+      context.wakeDelivery(ctx.sessionId)
+      return { ok: true, value: { clientMessageId: submissionId, submission } }
+    },
+    replay: (ctx) => {
+      const opKey = agentSessionOperationKey(ctx.resolvedBy, operationId)
+      const row = ctx.journal.queuedMessages
+        .receipts(opKey)
+        .find((receipt) => receipt.messageId === messageId)
+      if (!row || row.state !== 'dispatched') {
+        return null
+      }
+      const submission = row.consumedAs === null ? undefined : submissionFor(ctx, row.consumedAs)
+      return submission ? { clientMessageId: submission.clientMessageId, submission } : null
+    }
+  }
+  return mutateQueued(context, caller, params.envelope, plan)
+}
+
+/** Delete = discard, with no body in the answer: the card leaving the published
+ *  list IS the outcome, so a lost answer needs no re-ask. An Edit is the client
+ *  copying the text it already renders, then this Delete. */
+export function deleteQueuedStructuredAgentMessage(
+  context: StructuredAgentSessionMutationContext,
+  caller: StructuredAgentSessionCaller,
+  params: { envelope: AgentSessionMutationEnvelope; messageId: string }
+): Promise<AgentSessionMutationResult<AgentSessionQueuedMessageDeleteResult>> {
+  const { messageId } = params
+  const operationId = params.envelope.clientOperationId
+  const plan: MutationPlan<AgentSessionQueuedMessageDeleteResult> = {
+    method: 'agentSession.queuedMessageDelete',
+    fields: { messageId },
+    conversationWrite: true,
+    run: async (ctx): Promise<TurnOutcome<AgentSessionQueuedMessageDeleteResult>> => {
+      const row = ctx.journal.queuedMessages.get(messageId)
+      if (!row) {
+        return { ok: true, value: { deleted: false, messageId, disposition: 'missing' } }
+      }
+      if (row.state === 'dispatched') {
+        return { ok: true, value: { deleted: false, messageId, disposition: 'dispatched' } }
+      }
+      if (row.state === 'withdrawn') {
+        return { ok: true, value: { deleted: false, messageId, disposition: 'withdrawn' } }
+      }
+      // The withdrawal notifies through the journal's commit listener, which
+      // also re-derives the drain — deleting a returned card can unblock the
+      // drafts behind it.
+      const withdrawn = await withdrawQueuedMessagesForOperation(ctx.journal, {
+        sessionId: ctx.sessionId,
+        messageIds: [messageId],
+        callerKey: ctx.resolvedBy,
+        operationId
+      })
+      return withdrawn.length > 0
+        ? { ok: true, value: { deleted: true, messageId } }
+        : { ok: true, value: { deleted: false, messageId, disposition: 'withdrawn' } }
+    },
+    replay: (ctx) => {
+      const replayed = ctx.journal.queuedMessages
+        .receipts(agentSessionOperationKey(ctx.resolvedBy, operationId))
+        .some((row) => row.messageId === messageId && row.state === 'withdrawn')
+      return replayed ? { deleted: true, messageId } : null
+    }
+  }
+  return mutateQueued(context, caller, params.envelope, plan)
+}
+
+/** Resume: ends the queue's pause — a Stop's, or a restart's — so the cards send
+ *  again, oldest first, as the session goes idle. A no-op when nothing is paused,
+ *  and a per-card `send_failed` hold stays for its own Send. */
+export function resumeStructuredAgentQueue(
+  context: StructuredAgentSessionMutationContext,
+  caller: StructuredAgentSessionCaller,
+  params: { envelope: AgentSessionMutationEnvelope }
+): Promise<AgentSessionMutationResult<AgentSessionQueuedMessagesResumeResult>> {
+  const plan: MutationPlan<AgentSessionQueuedMessagesResumeResult> = {
+    method: 'agentSession.queuedMessagesResume',
+    fields: {},
+    conversationWrite: true,
+    // The lift notifies through the journal's commit listener, which publishes the
+    // cleared pause and wakes the drain.
+    run: async (ctx) => ({
+      ok: true,
+      value: { resumed: await resumeStructuredQueue(ctx.journal) }
+    }),
+    // Like Stop's replay: the Resume already ran, so this one lifts nothing.
+    replay: () => ({ resumed: false })
+  }
+  return mutateQueued(context, caller, params.envelope, plan)
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-queued-pause-lift.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-pause-lift.test.ts
new file mode 100644
index 00000000000..1349a6a178e
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-pause-lift.test.ts
@@ -0,0 +1,476 @@
+// A Stop pauses the whole queue, derived from the journal: it lasts until a turn
+// a person asked for (a send over the client RPC, or a card they sent now)
+// starts — the provider accepts it, never merely the host — or they Resume.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import {
+  HOST_TEST_SESSION,
+  hostTestMessage,
+  hostTestOperationId
+} from './structured-agent-session-host-test-data'
+import {
+  QUEUED_RIG_CALLER,
+  createQueuedMessageTestRig,
+  eventually,
+  type QueuedMessageTestRig
+} from './structured-agent-session-queued-message-rig.test-fixture'
+import { sameQueuePause } from './structured-agent-session-queued-publication'
+import {
+  structuredAgentSessionHostInstance,
+  structuredQueuePause
+} from './structured-agent-session-queued-pause'
+
+let rig: QueuedMessageTestRig
+
+beforeEach(async () => {
+  rig = await createQueuedMessageTestRig()
+})
+
+afterEach(() => rig.dispose())
+
+/** No drain step may convert the drafts, and the queue reads paused. */
+async function expectPaused(...draftIds: string[]): Promise<void> {
+  await new Promise((resolve) => setTimeout(resolve, 250))
+  for (const draftId of draftIds) {
+    expect(await rig.handoff(draftId)).toBeUndefined()
+  }
+  expect(await rig.queuePause()).toEqual({ reason: 'stopped' })
+}
+
+async function queuedDraft(text: string): Promise<string> {
+  const queued = await rig.send(text, 'queue-if-active').result
+  if (!queued.ok || !('queued' in queued.value)) {
+    throw new Error('expected a queued receipt')
+  }
+  return queued.value.queued.messageId
+}
+
+/** A draft behind a Stop, with the stopped turn settled so the session is idle. */
+async function stoppedDraft(): Promise<string> {
+  const working = await rig.workingSend()
+  const draftId = await queuedDraft('paused by stop')
+  await rig.stop()
+  await rig.settleAccepted(working, 'stopped')
+  return draftId
+}
+
+/** A queued draft handed off and handed over, found by its hand-off link. */
+async function handedOver(draftId: string): Promise<void> {
+  await eventually(async () => expect((await rig.handoff(draftId))?.handedOverAt).toBeDefined())
+}
+
+/** A user send the host accepted and handed over, still unanswered by the provider. */
+async function handedOverUserSend(text: string): Promise<string> {
+  const { id, result } = rig.send(text)
+  expect(await result).toMatchObject({ ok: true, value: { submission: expect.anything() } })
+  await eventually(async () => expect((await rig.submission(id))?.handedOverAt).toBeDefined())
+  return id
+}
+
+describe("a Stop's queue pause", () => {
+  it('outlives a user send the provider accepts and then refuses; a later send that starts lifts it', async () => {
+    const draftId = await stoppedDraft()
+    const refused = await handedOverUserSend('the start fails')
+    expect(await rig.queuePause()).toEqual({ reason: 'stopped' })
+    await rig.settleRejected(refused, 'turn/start refused')
+    await expectPaused(draftId)
+    const started = await handedOverUserSend('this one starts')
+    await rig.settleAccepted(started, 'started')
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+  })
+
+  it('a Stop after the user send supersedes it: that send starting its turn lifts nothing', async () => {
+    const draftId = await stoppedDraft()
+    const earlier = await handedOverUserSend('sent before the second stop')
+    await rig.stop()
+    await rig.settleAccepted(earlier, 'late')
+    await expectPaused(draftId)
+  })
+
+  it('survives a restart, and a send made after the Stop still ends it when its turn starts there', async () => {
+    const draftId = await stoppedDraft()
+    const inFlight = await handedOverUserSend('sent before the restart')
+    // Derived from the journal, not remembered: a restart forgets nothing it needs.
+    await rig.restartHostProcess()
+    expect(await rig.queuePause()).toEqual({ reason: 'stopped' })
+    await rig.settleAccepted(inFlight, 'after-restart')
+    // The Stop's pause is over; the restart's own lasts until a turn asked for since it.
+    await eventually(async () => expect(await rig.queuePause()).toEqual({ reason: 'restarted' }))
+    const next = rig.send('sent after the restart')
+    await next.result
+    await rig.settleAccepted(next.id, 'next')
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+  })
+
+  it("a draft typed while the stopped turn winds down waits with the rest: the pause is the queue's", async () => {
+    const working = await rig.workingSend()
+    const olderId = await queuedDraft('paused by the stop')
+    await rig.stop()
+    const typedId = await queuedDraft('typed while stopping')
+    await rig.settleAccepted(working, 'stopped')
+    await expectPaused(olderId, typedId)
+    expect(await rig.drafts()).toEqual([
+      { messageId: olderId, state: 'waiting' },
+      { messageId: typedId, state: 'waiting' }
+    ])
+  })
+
+  it('Send-now sends only its own card; the rest stay paused until that turn starts, then drain after it', async () => {
+    const working = await rig.workingSend()
+    const sentId = await queuedDraft('sent now')
+    const heldId = await queuedDraft('held until that turn starts')
+    await rig.stop()
+    await rig.settleAccepted(working, 'stopped')
+    expect(await rig.sendNow(sentId)).toMatchObject({
+      ok: true,
+      value: { submission: { origin: 'client', queuedMessageId: sentId } }
+    })
+    await handedOver(sentId)
+    // Only the card the user asked for went: the queue is still paused.
+    await expectPaused(heldId)
+    expect(await rig.drafts()).toEqual([{ messageId: heldId, state: 'waiting' }])
+    // A turn the user asked for has now started, which ends the pause.
+    await rig.settleAccepted(await rig.handoffId(sentId), 'sent-now')
+    await eventually(async () => expect(await rig.handoff(heldId)).toBeDefined())
+  })
+
+  it('a card sent now that the provider refuses lifts nothing', async () => {
+    const working = await rig.workingSend()
+    // Ahead of the refused card, so its return blocks nothing Resume would send.
+    const heldId = await queuedDraft('held by the stop')
+    const sentId = await queuedDraft('sent now, refused')
+    await rig.stop()
+    await rig.settleAccepted(working, 'stopped')
+    await rig.sendNow(sentId)
+    await handedOver(sentId)
+    await rig.settleRejected(await rig.handoffId(sentId), 'turn/start refused')
+    await expectPaused(heldId)
+  })
+
+  it('an old send answered again after its ledger row is gone lifts nothing from a later Stop', async () => {
+    const working = await rig.workingSend()
+    const draftId = await queuedDraft('paused by stop')
+    await rig.stop()
+    await rig.settleAccepted(working, 'stopped')
+    // The ledger forgot the id, so the send runs again and answers with its accepted submission.
+    const operations = rig.store['transactions'].state.operations
+    for (const [key, row] of operations) {
+      if (row.operationId === working) {
+        operations.delete(key)
+      }
+    }
+    const body = hostTestMessage('work on this')
+    const replayed = await rig.host.send(QUEUED_RIG_CALLER, {
+      envelope: rig.envelope({ body }, 'agentSession.send', working),
+      body,
+      userSend: true
+    })
+    expect(replayed).toMatchObject({
+      ok: true,
+      replayed: false,
+      value: { submission: { dispatchState: 'accepted' } }
+    })
+    // A later journal commit re-derives the pause; the old send was accepted before the Stop.
+    const mail = rig.send('coordinator mail', undefined, { internal: true })
+    await mail.result
+    await rig.settleAccepted(mail.id, 'mail')
+    await expectPaused(draftId)
+  })
+})
+
+describe('the pause read', () => {
+  it("costs no scan of the submissions: the reducer keeps the latest person's accepted turn", async () => {
+    const draftId = await stoppedDraft()
+    const journal = rig.host.collaboratorsForTests().sessions.get(HOST_TEST_SESSION)?.journal
+    if (!journal) {
+      throw new Error('expected the conversation open')
+    }
+    const scan = vi.spyOn(journal, 'submissions')
+    // Read on every publish, per subscriber: it must not walk the submissions.
+    expect(structuredQueuePause(journal)).toEqual({ reason: 'stopped' })
+    expect(scan).not.toHaveBeenCalled()
+    scan.mockRestore()
+    const before = journal.queuedMessages.latestPersonTurnSequence()
+    const mail = rig.send('coordinator mail', undefined, { internal: true })
+    await mail.result
+    await rig.settleAccepted(mail.id, 'mail')
+    // Orca's own turn moves nothing; a person's does, and lifts the pause.
+    expect(journal.queuedMessages.latestPersonTurnSequence()).toBe(before)
+    const next = rig.send('user starts a new turn')
+    await next.result
+    await rig.settleAccepted(next.id, 'next')
+    expect(journal.queuedMessages.latestPersonTurnSequence()).toBe(
+      journal.submission(next.id)?.acceptedSequence
+    )
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+  })
+})
+
+describe('a pause is over the cards it paused', () => {
+  it('a Stop over an empty queue pauses nothing: a card typed during a later mail turn drains', async () => {
+    const working = await rig.workingSend()
+    await rig.stop()
+    await rig.settleAccepted(working, 'stopped')
+    const mail = rig.send('coordinator mail', undefined, { internal: true })
+    await mail.result
+    await eventually(async () =>
+      expect((await rig.submission(mail.id))?.handedOverAt).toBeDefined()
+    )
+    const followUp = await queuedDraft('typed during the mail turn')
+    await rig.settleAccepted(mail.id, 'mail')
+    await eventually(async () => expect(await rig.handoff(followUp)).toBeDefined())
+    expect(await rig.queuePause()).toBeNull()
+  })
+
+  it('a Stop over an empty queue pauses nothing: a correction typed before the turn ends drains', async () => {
+    const working = await rig.workingSend()
+    await rig.stop()
+    const correction = await queuedDraft('typed right after the stop')
+    await rig.settleAccepted(working, 'stopped')
+    await eventually(async () => expect(await rig.handoff(correction)).toBeDefined())
+  })
+
+  it('deleting the last paused card ends the pause, so a card typed later is not held by it', async () => {
+    const working = await rig.workingSend()
+    const only = await queuedDraft('paused, then deleted')
+    await rig.stop()
+    await rig.settleAccepted(working, 'stopped')
+    expect(await rig.queuePause()).toEqual({ reason: 'stopped' })
+    expect(await rig.deleteQueued(only)).toMatchObject({ ok: true, value: { deleted: true } })
+    const mail = rig.send('coordinator mail', undefined, { internal: true })
+    await mail.result
+    await eventually(async () =>
+      expect((await rig.submission(mail.id))?.handedOverAt).toBeDefined()
+    )
+    const later = await queuedDraft('typed during the mail turn')
+    await rig.settleAccepted(mail.id, 'mail')
+    await eventually(async () => expect(await rig.handoff(later)).toBeDefined())
+  })
+})
+
+describe('a pause only over cards Resume could send', () => {
+  it('a Stop that leaves only a returned card publishes no pause and keeps no fact', async () => {
+    const working = await rig.workingSend()
+    const draftId = await queuedDraft('refused before the stop')
+    await rig.settleAccepted(working, 'a')
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+    await rig.settleRejected(await rig.handoffId(draftId), 'provider refused this payload')
+    await eventually(async () =>
+      expect(await rig.drafts()).toEqual([{ messageId: draftId, state: 'returned' }])
+    )
+    // A lone returned card traps nothing: this send goes now, and the Stop interrupts it.
+    const next = await handedOverUserSend('sent past the card')
+    expect(await rig.stop()).toMatchObject({ ok: true })
+    await rig.settleAccepted(next, 'stopped')
+    expect(await rig.queuePause()).toBeNull()
+    const journal = rig.host.collaboratorsForTests().sessions.get(HOST_TEST_SESSION)?.journal
+    expect(journal?.queuedMessages.pause()).toBeNull()
+  })
+
+  it('a returned card blocking the paused cards hides the pause but keeps it; deleting that card shows it again, and only Resume sends', async () => {
+    const working = await rig.workingSend()
+    const refusedId = await queuedDraft('refused after the stop')
+    const behindId = await queuedDraft('waits behind the card')
+    await rig.settleAccepted(working, 'a')
+    await handedOver(refusedId)
+    // The Stop interrupts the refused card's turn and pauses the card behind it.
+    await rig.stop()
+    expect(await rig.queuePause()).toEqual({ reason: 'stopped' })
+    await rig.settleRejected(await rig.handoffId(refusedId), 'provider refused this payload')
+    await eventually(async () =>
+      expect(await rig.drafts()).toEqual([
+        { messageId: refusedId, state: 'returned' },
+        { messageId: behindId, state: 'waiting' }
+      ])
+    )
+    const journal = rig.host.collaboratorsForTests().sessions.get(HOST_TEST_SESSION)?.journal
+    if (!journal) {
+      throw new Error('expected the conversation open')
+    }
+    // Resume would send nothing past the returned card, so no header offers it; the pause stays.
+    expect(await rig.queuePause()).toBeNull()
+    expect(journal.queuedMessages.pause()).toMatchObject({ reason: 'stopped' })
+    // Deleting the blocking card shows the pause again: the card behind it does not send unasked.
+    expect(await rig.deleteQueued(refusedId)).toMatchObject({ ok: true, value: { deleted: true } })
+    await expectPaused(behindId)
+    expect(await rig.resume()).toMatchObject({ ok: true, value: { resumed: true } })
+    await eventually(async () => expect(await rig.handoff(behindId)).toBeDefined())
+  })
+
+  it('a restart over only a card held by its own failed send publishes no pause', async () => {
+    const working = await rig.workingSend()
+    const draftId = await queuedDraft('conversion fails once')
+    const append = vi
+      .spyOn(AgentSessionJournal.prototype, 'appendSubmission')
+      .mockImplementationOnce(async () => {
+        throw new Error('disk full')
+      })
+    try {
+      await rig.settleAccepted(working, 'a')
+      await eventually(async () =>
+        expect(await rig.drafts()).toEqual([{ messageId: draftId, state: 'waiting', paused: true }])
+      )
+    } finally {
+      append.mockRestore()
+    }
+    await rig.restartHostProcess()
+    // Only its own Send releases that card: a queue-level Resume would send nothing.
+    expect(await rig.queuePause()).toBeNull()
+  })
+
+  it('compares a pause by presence before reason, so appearing or clearing is always a change', () => {
+    expect(sameQueuePause(null, {})).toBe(false)
+    expect(sameQueuePause({}, null)).toBe(false)
+    expect(sameQueuePause(null, null)).toBe(true)
+    expect(sameQueuePause({ reason: 'stopped' }, { reason: 'stopped' })).toBe(true)
+    expect(sameQueuePause({ reason: 'stopped' }, { reason: 'cleared' })).toBe(false)
+  })
+})
+
+describe("a restart's pause", () => {
+  it("once a person's turn ends it, stays ended when the conversation reopens", async () => {
+    const working = await rig.workingSend()
+    const first = await queuedDraft('first')
+    const second = await queuedDraft('second')
+    await rig.restartHostProcess()
+    await rig.settleAccepted(working, 'a')
+    expect(await rig.queuePause()).toEqual({ reason: 'restarted' })
+    const next = rig.send('user starts a new turn')
+    await next.result
+    await rig.settleAccepted(next.id, 'b')
+    await eventually(async () => expect(await rig.handoff(first)).toBeDefined())
+    // Reopened, that turn is "before this open", yet the pause it ended stays ended:
+    // the lift adopted the rows into this process.
+    await rig.host.close(HOST_TEST_SESSION)
+    expect(await rig.queuePause()).toBeNull()
+    expect(await rig.drafts()).toContainEqual({ messageId: second, state: 'waiting' })
+  })
+})
+
+describe('a card handed off after a restart', () => {
+  it('belongs to the process that sent it: withdrawn back to waiting, it raises no restart pause', async () => {
+    const working = await rig.workingSend()
+    const draftId = await queuedDraft('refused, then re-sent after a restart')
+    await rig.settleAccepted(working, 'a')
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+    await rig.settleRejected(await rig.handoffId(draftId), 'provider refused this payload')
+    await eventually(async () =>
+      expect(await rig.drafts()).toEqual([{ messageId: draftId, state: 'returned' }])
+    )
+    await rig.restartHostProcess()
+    // Sent again in this process, then withdrawn by a Stop before the agent had it.
+    let release: () => void = () => undefined
+    rig.awaitStarted.mockImplementationOnce(
+      () => new Promise<undefined>((resolve) => (release = () => resolve(undefined)))
+    )
+    expect(await rig.sendNow(draftId)).toMatchObject({ ok: true })
+    await rig.stop()
+    release()
+    await eventually(async () =>
+      expect(await rig.drafts()).toEqual([{ messageId: draftId, state: 'waiting' }])
+    )
+    const journal = rig.host.collaboratorsForTests().sessions.get(HOST_TEST_SESSION)?.journal
+    if (!journal) {
+      throw new Error('expected the conversation open')
+    }
+    expect(journal.queuedMessages.get(draftId)?.hostInstance).toBe(
+      structuredAgentSessionHostInstance()
+    )
+    // With the Stop's pause gone, nothing else holds it: no restart happened since it was sent.
+    await journal.queuedMessages.liftPause({
+      stop: journal.queuedMessages.pause(),
+      adoptInto: null
+    })
+    expect(structuredQueuePause(journal)).toBeNull()
+  })
+})
+
+describe('Resume', () => {
+  it('lifts the pause and the queue drains, oldest first; a second Resume is a no-op', async () => {
+    const working = await rig.workingSend()
+    const first = await queuedDraft('first')
+    const second = await queuedDraft('second')
+    await rig.stop()
+    await rig.settleAccepted(working, 'stopped')
+    await expectPaused(first, second)
+    expect(await rig.resume()).toMatchObject({ ok: true, value: { resumed: true } })
+    expect(await rig.queuePause()).toBeNull()
+    await eventually(async () => expect(await rig.handoff(first)).toBeDefined())
+    expect(await rig.handoff(second)).toBeUndefined()
+    // Nothing is paused now: another Resume changes nothing.
+    expect(await rig.resume()).toMatchObject({ ok: true, value: { resumed: false } })
+  })
+
+  it('is idempotent: a replay of the same Resume answers without lifting a later pause', async () => {
+    const working = await rig.workingSend()
+    const draftId = await queuedDraft('paused twice')
+    await rig.stop()
+    const operationId = hostTestOperationId()
+    expect(await rig.resume(operationId)).toMatchObject({ ok: true, value: { resumed: true } })
+    await rig.stop()
+    expect(await rig.resume(operationId)).toMatchObject({
+      ok: true,
+      replayed: true,
+      value: { resumed: false }
+    })
+    await rig.settleAccepted(working, 'stopped')
+    await expectPaused(draftId)
+  })
+
+  it("lifts a restart's pause too", async () => {
+    const working = await rig.workingSend()
+    const draftId = await queuedDraft('written before the restart')
+    await rig.restartHostProcess()
+    await rig.settleAccepted(working, 'a')
+    expect(await rig.queuePause()).toEqual({ reason: 'restarted' })
+    expect(await rig.resume()).toMatchObject({ ok: true, value: { resumed: true } })
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+  })
+
+  it('is a no-op on a queue that is not paused', async () => {
+    await rig.workingSend()
+    await queuedDraft('waiting behind the turn')
+    expect(await rig.queuePause()).toBeNull()
+    expect(await rig.resume()).toMatchObject({ ok: true, value: { resumed: false } })
+  })
+})
+
+describe('a failed Stop', () => {
+  it('records nothing when it fails before taking effect, so the queue sends as if no Stop was pressed', async () => {
+    const working = await rig.workingSend()
+    const draftId = await queuedDraft('queued before the stop')
+    const reject = vi
+      .spyOn(AgentSessionJournal.prototype, 'rejectQueuedSubmissions')
+      .mockRejectedValueOnce(new Error('disk full'))
+    try {
+      await expect(rig.stop()).rejects.toThrow('disk full')
+    } finally {
+      reject.mockRestore()
+    }
+    expect(await rig.queuePause()).toBeNull()
+    await rig.settleAccepted(working, 'working')
+    await eventually(async () => expect(await rig.handoff(draftId)).toBeDefined())
+  })
+
+  it('keeps its pause when it fails after the interrupt reached the agent', async () => {
+    await rig.workingSend()
+    const draftId = await queuedDraft('paused by stop')
+    const append = AgentSessionJournal.prototype.appendItem
+    const failing = vi
+      .spyOn(AgentSessionJournal.prototype, 'appendItem')
+      .mockImplementation(async function (this: AgentSessionJournal, ...args) {
+        // The status note written after the provider was asked to stop.
+        if (args[1].kind === 'status') {
+          throw new Error('disk full')
+        }
+        return append.apply(this, args)
+      })
+    try {
+      await expect(rig.stop()).rejects.toThrow('disk full')
+    } finally {
+      failing.mockRestore()
+    }
+    await expectPaused(draftId)
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-queued-pause.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-pause.ts
new file mode 100644
index 00000000000..1428de75fe6
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-pause.ts
@@ -0,0 +1,108 @@
+// Whether the queue is paused, and why — DERIVED, never stored as a flag. The
+// queue is paused when:
+//   - 'stopped': the user's last Stop took effect (its recorded journal
+//     position) and no turn a person asked for has started since — or
+//     'cleared', the same for a /clear's replacement, whose carried cards
+//     start paused; or
+//   - 'restarted': a waiting draft was written by another host process and no
+//     turn a person asked for has started since this conversation opened.
+// A person's turn is a submission whose recorded origin is `client` (a send over
+// the client send RPC, or a card they sent now) that the provider accepted.
+// Orchestration mail, a restart continuation, a host-sent launch prompt and the
+// queue's own drain are `host` and never lift it. An explicit Resume lifts any.
+
+import { randomUUID } from 'node:crypto'
+import type { AgentSessionQueuePause } from '../../../shared/agent-session-wire'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import type { QueuePauseFact } from '../agent-session-journal/queued-message-pause-table'
+
+/** A per-process id, minted once per host process like the runtime's own
+ *  `runtimeId` (`orca-runtime-runtime-id.ts`); a draft written by another
+ *  instance pauses the queue rather than auto-sending after a restart. */
+let hostInstance = randomUUID()
+
+export function structuredAgentSessionHostInstance(): string {
+  return hostInstance
+}
+
+/** Simulates a host-process restart. Tests only. */
+export function rotateStructuredAgentSessionHostInstanceForTests(): string {
+  hostInstance = randomUUID()
+  return hostInstance
+}
+
+type PauseJournal = Pick<AgentSessionJournal, 'queuedMessages' | 'cursor' | 'wroteBeforeOpen'>
+
+// Both read the reducer's latest accepted person turn (its submission row), so a
+// derivation on every publish costs no scan of the submissions.
+
+function stopEnded(journal: PauseJournal, stop: QueuePauseFact): boolean {
+  const latest = journal.queuedMessages.latestPersonTurnSequence()
+  // Sent after the Stop: a send made before it no longer lifts it, even if its turn starts later.
+  return stop.epoch !== journal.cursor().epoch ? latest > 0 : latest > stop.sequence
+}
+
+function restartPending(journal: PauseJournal): boolean {
+  return journal.queuedMessages
+    .list()
+    .some((row) => row.state === 'waiting' && row.hostInstance !== hostInstance)
+}
+
+function restartEnded(journal: PauseJournal): boolean {
+  const latest = journal.queuedMessages.latestPersonTurnSequence()
+  return latest > 0 && !journal.wroteBeforeOpen(latest)
+}
+
+/** The queue's pause, derived; null when the queue sends on its own. */
+export function structuredQueuePause(journal: PauseJournal): AgentSessionQueuePause | null {
+  const stop = journal.queuedMessages.pause()
+  if (stop && !stopEnded(journal, stop)) {
+    return { reason: stop.reason }
+  }
+  if (restartPending(journal) && !restartEnded(journal)) {
+    return { reason: 'restarted' }
+  }
+  return null
+}
+
+/**
+ * Every journal publish: retire what a person's started turn already ended — the
+ * Stop fact it superseded, and a restart's rows, adopted into this instance. The
+ * derivation already reads them as lifted; the write keeps that answer when the
+ * handle reopens (the restart's "since this conversation opened" moves) and spares
+ * later derivations the submission scan. Bookkeeping: a failure is reported.
+ */
+export async function retireEndedQueuePause(
+  sessionId: string,
+  journal: PauseJournal
+): Promise<void> {
+  try {
+    const stop = journal.queuedMessages.pause()
+    const retireStop = stop !== null && stopEnded(journal, stop) ? stop : null
+    const adopt = restartPending(journal) && restartEnded(journal)
+    if (retireStop === null && !adopt) {
+      return
+    }
+    await journal.queuedMessages.liftPause({
+      stop: retireStop,
+      adoptInto: adopt ? hostInstance : null
+    })
+  } catch (error) {
+    console.warn("[agent-session] a started turn's queue-pause retirement skipped:", {
+      sessionId,
+      error: error instanceof Error ? error.message : String(error)
+    })
+  }
+}
+
+/** Resume: ends whichever pause holds the queue. Returns whether it was paused. */
+export async function resumeStructuredQueue(journal: PauseJournal): Promise<boolean> {
+  if (structuredQueuePause(journal) === null) {
+    return false
+  }
+  await journal.queuedMessages.liftPause({
+    stop: journal.queuedMessages.pause(),
+    adoptInto: hostInstance
+  })
+  return true
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-queued-publication.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-publication.ts
new file mode 100644
index 00000000000..10b1f75fc3e
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-publication.ts
@@ -0,0 +1,112 @@
+// The published view of a conversation's queue: its whole draft list and the
+// queue's pause, on the `commands` precedent — read per emit, reference-stable
+// while unchanged, so the subscribers' identity dedup keeps token streams from
+// re-sending it. The two ride together: a client never sees one without the other.
+
+import {
+  QUEUED_MESSAGE_PAUSED_SEND_FAILED,
+  type AgentSessionQueuedMessage,
+  type AgentSessionQueuePause
+} from '../../../shared/agent-session-wire'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { hasResumableQueuedMessage } from '../agent-session-journal/queued-message-pause-table'
+import { structuredQueuePause } from './structured-agent-session-queued-pause'
+
+export type QueuePublication = {
+  queuedMessages: AgentSessionQueuedMessage[]
+  queuePause: AgentSessionQueuePause | null
+}
+
+/** Waiting and returned rows only. `paused` is a per-card hold (a failed
+ *  conversion); a Stop or a restart pauses the queue, published once beside it. */
+function computePublishedQueuedMessages(journal: AgentSessionJournal): AgentSessionQueuedMessage[] {
+  const published: AgentSessionQueuedMessage[] = []
+  for (const row of journal.queuedMessages.list()) {
+    if (row.state !== 'waiting' && row.state !== 'returned') {
+      continue
+    }
+    const held = row.state === 'waiting' && row.holdReason !== null
+    published.push({
+      messageId: row.messageId,
+      position: row.position,
+      body: row.body,
+      state: row.state,
+      ...(held ? { paused: true as const } : {}),
+      // The stored reason is a typed marker; an unknown one reads as a plain hold.
+      ...(held && row.holdReason === QUEUED_MESSAGE_PAUSED_SEND_FAILED
+        ? { pausedReason: QUEUED_MESSAGE_PAUSED_SEND_FAILED }
+        : {}),
+      ...(row.state === 'returned' ? { returnedReason: row.returnedReason } : {}),
+      ...(row.state === 'returned' && row.returnedRejection
+        ? { returnedRejection: row.returnedRejection }
+        : {})
+    })
+  }
+  return published
+}
+
+type ListMemo = { key: string; serialized: string; list: AgentSessionQueuedMessage[] }
+
+/** Reference-stable per journal handle: an unchanged list is never
+ *  re-serialized onto token-stream frames, and any draft-table write changes
+ *  the reference by construction. */
+const listMemos = new WeakMap<AgentSessionJournal, ListMemo>()
+const publications = new WeakMap<AgentSessionJournal, QueuePublication>()
+
+function readPublishedQueuedMessages(journal: AgentSessionJournal): AgentSessionQueuedMessage[] {
+  const key = String(journal.queuedMessages.revision())
+  const memo = listMemos.get(journal)
+  if (memo && memo.key === key) {
+    return memo.list
+  }
+  const list = computePublishedQueuedMessages(journal)
+  // Belt for the identity dedup: equal recomputed content keeps the previous reference.
+  const serialized = JSON.stringify(list)
+  if (memo && memo.serialized === serialized) {
+    listMemos.set(journal, { key, serialized, list: memo.list })
+    return memo.list
+  }
+  listMemos.set(journal, { key, serialized, list })
+  return list
+}
+
+/** Presence first: a pause appearing or clearing is a change even when neither side
+ *  names a reason this build can read. */
+export function sameQueuePause(
+  previous: { reason?: string } | null,
+  next: { reason?: string } | null
+): boolean {
+  return (previous === null) === (next === null) && previous?.reason === next?.reason
+}
+
+export function readQueuePublication(journal: AgentSessionJournal): QueuePublication {
+  const queuedMessages = readPublishedQueuedMessages(journal)
+  // Read per emit: the pause also turns on submissions (a person's turn starting).
+  // Kept over any card it holds back, but shown only over one Resume would send, so its
+  // header never offers to send nothing; deleting a blocking returned card shows it again.
+  const pausable = hasResumableQueuedMessage(journal.queuedMessages.list())
+  const queuePause = pausable ? structuredQueuePause(journal) : null
+  const previous = publications.get(journal)
+  if (
+    previous &&
+    previous.queuedMessages === queuedMessages &&
+    sameQueuePause(previous.queuePause, queuePause)
+  ) {
+    return previous
+  }
+  const publication = { queuedMessages, queuePause }
+  publications.set(journal, publication)
+  return publication
+}
+
+/** For readers that must never fail on drafts — a subscriber stream, a history
+ *  page: a closing handle answers "no claim" (absent) instead of throwing. */
+export function tryReadQueuePublication(
+  journal: AgentSessionJournal | undefined
+): QueuePublication | undefined {
+  try {
+    return journal ? readQueuePublication(journal) : undefined
+  } catch {
+    return undefined
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-queued-send-answer.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-send-answer.ts
new file mode 100644
index 00000000000..e0eb83e0a0b
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-send-answer.ts
@@ -0,0 +1,42 @@
+// What a send this host queued answers with when it is asked again — a lost
+// acknowledgement's replay, or a rerun the operation ledger no longer covers:
+// from its draft first, then from the hand-off that names it.
+
+import type { AgentSessionSendResult } from '../../../shared/agent-session-wire'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+
+/** Null for a send this host never queued. A refused conversion answers with
+ *  its returned card, never the rejected submission, or the same text would
+ *  render twice — on a Retry row AND the card. */
+export function queuedSendAnswer(
+  journal: Pick<AgentSessionJournal, 'queuedMessages' | 'submission' | 'submissions'>,
+  clientMessageId: string
+): AgentSessionSendResult | null {
+  const draft = journal.queuedMessages.get(clientMessageId)
+  if (draft) {
+    const consumed =
+      draft.state === 'dispatched' && draft.consumedAs !== null
+        ? journal.submission(draft.consumedAs)
+        : undefined
+    return consumed
+      ? { clientMessageId, submission: consumed }
+      : {
+          clientMessageId,
+          queued: { messageId: draft.messageId, position: draft.position, state: draft.state }
+        }
+  }
+  // The draft row was pruned; its last hand-off still names it. Only a withdrawn row is pruned
+  // while its last hand-off stands rejected — a card the user deleted — so it answers withdrawn,
+  // never as a refused send.
+  const handoff = journal
+    .submissions()
+    .findLast((entry) => entry.queuedMessageId === clientMessageId)
+  if (handoff?.dispatchState === 'rejected') {
+    // The pruned row's position went with it; a withdrawn receipt names no place in the queue.
+    return {
+      clientMessageId,
+      queued: { messageId: clientMessageId, position: 0, state: 'withdrawn' }
+    }
+  }
+  return handoff ? { clientMessageId, submission: handoff } : null
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-queued-send.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-send.ts
new file mode 100644
index 00000000000..d411efc4239
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-send.ts
@@ -0,0 +1,34 @@
+// A send's queue step around its immediate path: the queue decision before it. A
+// person's send lifts a paused queue through its recorded origin once its turn
+// starts (`structured-agent-session-queued-pause.ts`), not through anything here.
+
+import type { AgentSessionSendResult } from '../../../shared/agent-session-wire'
+import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
+import type { StructuredAgentSessionMutationContext } from './structured-agent-session-host-mutations'
+import { maybeQueueStructuredAgentSessionSend } from './structured-agent-session-queued-messages'
+import type { AgentSessionTurnContext, TurnOutcome } from './structured-agent-session-turns'
+
+export async function runQueueableStructuredAgentSessionSend(
+  context: StructuredAgentSessionMutationContext,
+  ctx: AgentSessionTurnContext,
+  params: {
+    envelope: { clientOperationId: string }
+    body: AgentJournalMessageItem
+    delivery?: 'queue-if-active'
+    userSend?: true
+  },
+  immediate: () => Promise<TurnOutcome<AgentSessionSendResult>>
+): Promise<TurnOutcome<AgentSessionSendResult>> {
+  // The queue decision runs first: a capable send while the session owes work (a
+  // /compact included — it is a queued message like any other) becomes a draft;
+  // only a `blocked` hold, which never queues, falls through to the refusal.
+  const queued = await maybeQueueStructuredAgentSessionSend(context, ctx, params)
+  if (queued) {
+    return queued
+  }
+  const accepted = await immediate()
+  if (accepted.ok) {
+    context.wakeDelivery(ctx.sessionId)
+  }
+  return accepted
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-queued-stop.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-stop.ts
new file mode 100644
index 00000000000..16a9b4aeaf7
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-stop.ts
@@ -0,0 +1,66 @@
+// Stop's pause on the queue. A Stop never withdraws a draft and no text ever
+// travels back over the wire: it records WHERE in the journal it took effect,
+// and the queue is paused from there (`structured-agent-session-queued-pause.ts`
+// derives it) until a turn a person asked for starts, or they Resume. The cards
+// stay published, and Send-now sends one card without lifting the pause for the
+// rest until that card's turn starts. The record is bookkeeping: a failure is
+// reported and never gates the interrupt.
+
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import {
+  isUnsettledQueuedMessage,
+  type QueuedMessageRow
+} from '../agent-session-journal/queued-message-table'
+import type { AgentSessionTurnContext, TurnOutcome } from './structured-agent-session-turns'
+
+/** The one unsettled-card predicate /clear's carry and the budget share:
+ *  waiting or returned. Pending/unknown/accepted deliveries stay outside it. */
+export function unsettledQueuedMessages(journal: AgentSessionJournal): QueuedMessageRow[] {
+  return journal.queuedMessages.list().filter(isUnsettledQueuedMessage)
+}
+
+/**
+ * Runs a Stop and records its queue pause at the point it takes effect — after
+ * it withdrew the queued sends, as it reaches the agent, or, reaching no agent,
+ * once it withdrew something — and only over cards it then holds back. The Stop
+ * calls `tookEffect` there. A Stop that throws before then changed nothing and
+ * recorded nothing, so there is nothing to undo; one that fails after it keeps
+ * the pause, since the interrupt may have landed. A draft whose hand-off the
+ * Stop withdrew is back to waiting in its own place, under this same pause. The
+ * drain cannot slip a draft in between: it runs on the same serialized lane as
+ * the Stop.
+ */
+export async function runStopWithQueuePause<TValue>(
+  ctx: AgentSessionTurnContext,
+  stop: (tookEffect: () => Promise<void>) => Promise<TurnOutcome<TValue>>
+): Promise<TurnOutcome<TValue>> {
+  let attempted = false
+  return stop(async () => {
+    if (attempted) {
+      return
+    }
+    attempted = true
+    const { queuedMessages } = ctx.journal
+    // A hand-off this Stop's withdrawal sent back may not have caught up yet (its hook
+    // was skipped): heal it first, as the drain would, so the pause sees it waiting.
+    try {
+      if (queuedMessages.settlementOwed()) {
+        await queuedMessages.settleOwed()
+      }
+    } catch (error) {
+      report(ctx, 'owed settlement', error)
+    }
+    // Recorded only over a card it holds back — judged in its own transaction, which
+    // still counts an owed return to waiting if that heal failed.
+    await queuedMessages
+      .recordPause('stopped')
+      .catch((error: unknown) => report(ctx, 'queue pause', error))
+  })
+}
+
+function report(ctx: AgentSessionTurnContext, step: string, error: unknown): void {
+  console.warn(`[agent-session] Stop's ${step} skipped:`, {
+    sessionId: ctx.sessionId,
+    error: error instanceof Error ? error.message : String(error)
+  })
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-queued-wiring.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-wiring.ts
new file mode 100644
index 00000000000..2b193d5cb82
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-wiring.ts
@@ -0,0 +1,64 @@
+// Host wiring for mid-turn queueing: builds the serialized drain from the
+// host's mutation context and exposes the draft actions (Send, Delete, Resume), so the host
+// class stays a description of its surface.
+
+import type { StructuredAgentSessionMutationContext } from './structured-agent-session-host-mutations'
+import type {
+  StructuredAgentSessionCaller,
+  StructuredAgentSessionHostSession
+} from './structured-agent-session-host-types'
+import { structuredAgentSessionConversationFence } from './structured-agent-session-provider-child'
+import { StructuredAgentSessionQueuedMessageDrain } from './structured-agent-session-queued-messages'
+import { retireEndedQueuePause } from './structured-agent-session-queued-pause'
+import {
+  deleteQueuedStructuredAgentMessage,
+  resumeStructuredAgentQueue,
+  sendQueuedStructuredAgentMessage
+} from './structured-agent-session-queued-mutations'
+
+/** `sessions` are the live conversations (their `touch` is the idle sweep's activity renewal,
+ *  which the drain's schedule rides); everything else comes from the host's mutation context,
+ *  read lazily because the host's fields are still initializing when this is built. */
+export function wireStructuredAgentSessionQueuedMessages(
+  sessions: ReadonlyMap<string, StructuredAgentSessionHostSession> & {
+    touch: (sessionId: string) => void
+  },
+  context: () => StructuredAgentSessionMutationContext
+) {
+  const drain = new StructuredAgentSessionQueuedMessageDrain({
+    sessions,
+    getRecord: (sessionId) => context().deps.store.getRecord(sessionId),
+    serialize: (sessionId, task) => context().serialize(sessionId, task),
+    flushStreamedEvents: (sessionId) => context().flushStreamedEvents(sessionId),
+    conversationFence: (sessionId) =>
+      structuredAgentSessionConversationFence(context().deps.store, sessionId),
+    wakeDelivery: (sessionId) => context().wakeDelivery(sessionId),
+    onError: (sessionId, error) => context().deps.onEventSinkError?.({ sessionId, error })
+  })
+  return {
+    drain,
+    /** Every journal publish: turn, submission, prompt, command and Stop
+     *  settlements are all commits, and each re-derives the drain's gates —
+     *  and retires a queue pause a person's started turn already ended. */
+    onJournalActivity: (sessionId: string) => {
+      sessions.touch(sessionId)
+      const journal = sessions.get(sessionId)?.journal
+      if (journal && !journal.isReadOnly) {
+        void retireEndedQueuePause(sessionId, journal)
+      }
+      drain.schedule(sessionId)
+    },
+    queuedMessageSend: (
+      caller: StructuredAgentSessionCaller,
+      params: Parameters<typeof sendQueuedStructuredAgentMessage>[2]
+    ) => sendQueuedStructuredAgentMessage(context(), caller, params),
+    queuedMessageDelete: (
+      caller: StructuredAgentSessionCaller,
+      params: Parameters<typeof deleteQueuedStructuredAgentMessage>[2]
+    ) => deleteQueuedStructuredAgentMessage(context(), caller, params),
+    queuedMessagesResume: (
+      caller: StructuredAgentSessionCaller,
+      params: Parameters<typeof resumeStructuredAgentQueue>[2]
+    ) => resumeStructuredAgentQueue(context(), caller, params)
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-queued-withdrawn-draft.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-withdrawn-draft.test.ts
new file mode 100644
index 00000000000..403cb08a405
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-queued-withdrawn-draft.test.ts
@@ -0,0 +1,209 @@
+// A consumed draft whose submission a Stop withdrew before the agent had it is
+// not a failure: it waits again at its own position under the Stop's hold, so
+// it never blocks the paused cards behind it. After the user's next turn the
+// whole queue drains one per turn in queue order, the withdrawn draft first,
+// under a fresh submission id.
+
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { JournalQueuedMessages } from '../agent-session-journal/journal-queued-messages'
+import { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { HOST_TEST_SESSION as SESSION } from './structured-agent-session-host-test-data'
+import {
+  createQueuedMessageTestRig,
+  eventually,
+  type QueuedMessageTestRig
+} from './structured-agent-session-queued-message-rig.test-fixture'
+
+let rig: QueuedMessageTestRig
+
+beforeEach(async () => {
+  rig = await createQueuedMessageTestRig()
+})
+
+afterEach(() => rig.dispose())
+
+async function queuedDraft(text: string): Promise<string> {
+  const queued = await rig.send(text, 'queue-if-active').result
+  if (!queued.ok || !('queued' in queued.value)) {
+    throw new Error('expected a queued receipt')
+  }
+  return queued.value.queued.messageId
+}
+
+async function submissionIds(): Promise<string[]> {
+  return (await rig.host.journalSnapshot(SESSION)).submissions.map((entry) => entry.clientMessageId)
+}
+
+async function handedOver(id: string): Promise<void> {
+  await eventually(async () => expect((await rig.submission(id))?.handedOverAt).toBeDefined())
+}
+
+it('Stop, then a user send: the withdrawn draft and the paused cards behind it drain one per turn, in queue order', async () => {
+  const working = await rig.workingSend()
+  const a = await queuedDraft('A')
+  const b = await queuedDraft('B')
+  const c = await queuedDraft('C')
+  // The turn ends and the drain consumes A; the agent's start is held, so A is not handed over.
+  let release: () => void = () => undefined
+  rig.awaitStarted.mockImplementationOnce(
+    () => new Promise<undefined>((resolve) => (release = () => resolve(undefined)))
+  )
+  await rig.settleAccepted(working, 'working')
+  await eventually(async () => expect(await rig.handoff(a)).toBeDefined())
+  // Never under the draft's own id: the submission names A by its link.
+  const firstA = await rig.handoffId(a)
+  expect(firstA).not.toBe(a)
+  expect((await rig.submission(firstA))?.handedOverAt).toBeUndefined()
+
+  expect(await rig.stop()).toMatchObject({ ok: true })
+  release()
+  // A is back in its place, behind the same queue pause as B and C: no returned card blocks them.
+  const paused = [a, b, c].map((messageId) => ({ messageId, state: 'waiting' }))
+  expect(await rig.drafts()).toEqual(paused)
+  expect(await rig.queuePause()).toEqual({ reason: 'stopped' })
+
+  const d = rig.send('D')
+  await d.result
+  await handedOver(d.id)
+  expect(await rig.drafts()).toEqual(paused)
+  await rig.settleAccepted(d.id, 'd')
+
+  // After D's turn, A drains first, under another fresh id: the first names the withdrawn submission.
+  const before = new Set([working, firstA, d.id])
+  let resentA = ''
+  await eventually(async () => {
+    const fresh = (await submissionIds()).filter((id) => !before.has(id))
+    expect(fresh).toHaveLength(1)
+    resentA = fresh[0] ?? ''
+  })
+  expect((await rig.submission(firstA))?.dispatchState).toBe('rejected')
+  // Both hand-offs of A name it; D, a direct send, names no draft.
+  expect((await rig.submission(resentA))?.queuedMessageId).toBe(a)
+  expect((await rig.submission(firstA))?.queuedMessageId).toBe(a)
+  expect(await rig.submission(d.id)).not.toHaveProperty('queuedMessageId')
+  expect((await rig.submission(resentA))?.payloadFingerprint).toBe(
+    (await rig.submission(firstA))?.payloadFingerprint
+  )
+  expect(await rig.drafts()).toEqual([
+    { messageId: b, state: 'waiting' },
+    { messageId: c, state: 'waiting' }
+  ])
+
+  await handedOver(resentA)
+  await rig.settleAccepted(resentA, 'a')
+  await eventually(async () => expect((await rig.handoff(b))?.queuedMessageId).toBe(b))
+  expect(await rig.handoff(c)).toBeUndefined()
+  await handedOver(await rig.handoffId(b))
+  await rig.settleAccepted(await rig.handoffId(b), 'b')
+  await eventually(async () => expect(await rig.handoff(c)).toBeDefined())
+  expect(await rig.drafts()).toEqual([])
+})
+
+it('a Stop that fails after withdrawing a consumed draft releases it, and it sends again under a fresh id', async () => {
+  const working = await rig.workingSend()
+  const a = await queuedDraft('A')
+  let release: () => void = () => undefined
+  rig.awaitStarted.mockImplementationOnce(
+    () => new Promise<undefined>((resolve) => (release = () => resolve(undefined)))
+  )
+  await rig.settleAccepted(working, 'working')
+  await eventually(async () => expect(await rig.handoff(a)).toBeDefined())
+  const firstA = await rig.handoffId(a)
+  const withdraw = AgentSessionJournal.prototype.rejectQueuedSubmissions
+  const failing = vi
+    .spyOn(AgentSessionJournal.prototype, 'rejectQueuedSubmissions')
+    .mockImplementation(async function (this: AgentSessionJournal, ...args) {
+      const withdrawn = await withdraw.apply(this, args)
+      // Only the Stop's own withdrawal fails, after it landed; the delivery loop's pass through.
+      if (args[1].rejection.kind === 'cancelled') {
+        throw new Error('disk full')
+      }
+      return withdrawn
+    })
+  try {
+    await expect(rig.stop()).rejects.toThrow('disk full')
+  } finally {
+    failing.mockRestore()
+    release()
+  }
+  expect((await rig.submission(firstA))?.dispatchState).toBe('rejected')
+  const before = new Set([working, firstA])
+  await eventually(async () => {
+    expect((await submissionIds()).filter((id) => !before.has(id))).toHaveLength(1)
+    expect(await rig.drafts()).toEqual([])
+  })
+})
+
+/** A consumed card whose delivery is held at the agent's start, so a Stop withdraws it;
+ *  the settlement hook throws on that withdrawal's row, leaving the card owed a return. */
+async function stopWithSkippedSettlement(): Promise<{ a: string; working: string }> {
+  const working = await rig.workingSend()
+  const a = await queuedDraft('A')
+  let release: () => void = () => undefined
+  rig.awaitStarted.mockImplementationOnce(
+    () => new Promise<undefined>((resolve) => (release = () => resolve(undefined)))
+  )
+  await rig.settleAccepted(working, 'working')
+  await eventually(async () => expect(await rig.handoff(a)).toBeDefined())
+  const settle = JournalQueuedMessages.prototype.onRowInTransaction
+  let skipped = false
+  const hook = vi
+    .spyOn(JournalQueuedMessages.prototype, 'onRowInTransaction')
+    .mockImplementation(function (this: JournalQueuedMessages, db, row) {
+      if (!skipped && row.kind === 'dispatch' && row.state === 'rejected') {
+        skipped = true
+        throw new Error('bookkeeping failed')
+      }
+      return settle.call(this, db, row)
+    })
+  const warned = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+  try {
+    expect(await rig.stop()).toMatchObject({ ok: true })
+  } finally {
+    hook.mockRestore()
+    warned.mockRestore()
+    release()
+  }
+  expect(skipped).toBe(true)
+  return { a, working }
+}
+
+it("a Stop whose withdrawal's settlement was skipped still pauses the card it sent back", async () => {
+  const { a } = await stopWithSkippedSettlement()
+  expect(await rig.queuePause()).toEqual({ reason: 'stopped' })
+  await new Promise((resolve) => setTimeout(resolve, 250))
+  // Healed back to waiting, but the Stop's pause holds it: it does not send.
+  expect(await rig.drafts()).toEqual([{ messageId: a, state: 'waiting' }])
+  expect(await rig.resume()).toMatchObject({ ok: true, value: { resumed: true } })
+  await eventually(async () =>
+    expect(
+      (await rig.host.journalSnapshot(SESSION)).submissions.filter(
+        (entry) => entry.queuedMessageId === a
+      )
+    ).toHaveLength(2)
+  )
+})
+
+it('the pause is recorded even when healing the skipped settlement fails, since the card is still owed', async () => {
+  const heal = vi
+    .spyOn(JournalQueuedMessages.prototype, 'settleOwed')
+    .mockRejectedValueOnce(new Error('disk full'))
+  try {
+    const { a } = await stopWithSkippedSettlement()
+    const journal = rig.host.collaboratorsForTests().sessions.get(SESSION)?.journal
+    expect(journal?.queuedMessages.pause()).toMatchObject({ reason: 'stopped' })
+    // The drain heals it later; the pause recorded over the owed card holds it then.
+    await eventually(async () =>
+      expect(await rig.drafts()).toEqual([{ messageId: a, state: 'waiting' }])
+    )
+    await new Promise((resolve) => setTimeout(resolve, 250))
+    expect(await rig.queuePause()).toEqual({ reason: 'stopped' })
+    expect(
+      (await rig.host.journalSnapshot(SESSION)).submissions.filter(
+        (entry) => entry.queuedMessageId === a
+      )
+    ).toHaveLength(1)
+  } finally {
+    heal.mockRestore()
+  }
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.test.ts
index 34e3fb8a4cf..514008e49f9 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.test.ts
@@ -48,6 +48,11 @@ const store = {
 } as unknown as AgentSessionRecordStore
 
 let journalRoot: string
+const openDeps = () => ({
+  store,
+  journalRoot,
+  adapter: {}
+})
 const opened: AgentSessionJournal[] = []
 
 async function writeRemnant(name: string): Promise<string> {
@@ -73,29 +78,29 @@ describe('a session whose journal is still the pre-SQLite format', () => {
   it('is published, carrying the message that explains it', async () => {
     const transcript = await writeRemnant('log.jsonl')
 
-    const restored = await restoreStructuredAgentSessionRead(store, journalRoot, SESSION_ID)
+    const restored = await restoreStructuredAgentSessionRead(openDeps(), SESSION_ID)
 
     expect(restored).not.toBeNull()
-    opened.push(restored!.journal)
-    const disclosed = restored!.journal
+    opened.push(restored!.session.journal)
+    const disclosed = restored!.session.journal
       .snapshot()
       .items.map((entry) => (entry.body.kind === 'status' ? entry.body.text : ''))
     expect(disclosed.join('')).toContain(transcript)
     // Publishing it costs no agent process; acquisition still waits for the user.
-    expect(restored!.hasProviderChild).toBe(false)
+    expect(restored!.session.child).toBeNull()
   })
 
   it('is published for a remnant whose log is gone', async () => {
     await writeRemnant('snapshot.json')
 
-    const restored = await restoreStructuredAgentSessionRead(store, journalRoot, SESSION_ID)
+    const restored = await restoreStructuredAgentSessionRead(openDeps(), SESSION_ID)
 
     expect(restored).not.toBeNull()
-    opened.push(restored!.journal)
+    opened.push(restored!.session.journal)
   })
 
   it('still drops a session with neither a journal nor a remnant', async () => {
-    const restored = await restoreStructuredAgentSessionRead(store, journalRoot, SESSION_ID)
+    const restored = await restoreStructuredAgentSessionRead(openDeps(), SESSION_ID)
 
     expect(restored).toBeNull()
   })
@@ -103,7 +108,7 @@ describe('a session whose journal is still the pre-SQLite format', () => {
   it('still drops a session with no record', async () => {
     await writeRemnant('log.jsonl')
 
-    const restored = await restoreStructuredAgentSessionRead(store, journalRoot, 'unknown-session')
+    const restored = await restoreStructuredAgentSessionRead(openDeps(), 'unknown-session')
 
     expect(restored).toBeNull()
   })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.ts
index 65b913daf42..0e1441b729c 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.ts
@@ -1,104 +1,32 @@
-import type { AgentSessionRecord } from '../../../shared/agent-session-record'
-import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import { findJournalFileFormatRemnant } from '../agent-session-journal/journal-file-format-remnant'
-import { loadJournal } from '../agent-session-journal/journal-open'
-import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
-import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { existsSync } from 'node:fs'
+import { journalDatabaseFile, journalDirectoryFor } from '../agent-session-journal/journal-paths'
 import {
-  attachFingerprintFields,
-  journalIdentityFor,
-  type AgentSessionAttachParams
-} from './structured-agent-session-attach'
-import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
-
-export type RestoredStructuredAgentSessionRead = {
-  journal: AgentSessionJournal
-  params: AgentSessionAttachParams
-  fence: number
-  hasProviderChild: false
-  providerChildPhase: 'ready'
-  acquisitionGeneration: null
-}
+  openStructuredAgentSessionConversationJournal,
+  type OpenedStructuredAgentSessionConversation,
+  type StructuredAgentSessionConversationOpenDeps
+} from './structured-agent-session-conversation-open'
 
+/**
+ * A reader's open: the conversation's own open, for a session that has a journal to read. One
+ * with none — never written, or gone — stays unpublished rather than founding an empty one.
+ * Opening can still write: the crash boundary, and the row explaining an old-format history.
+ */
 export async function restoreStructuredAgentSessionRead(
-  store: AgentSessionRecordStore,
-  journalRoot: string,
+  deps: StructuredAgentSessionConversationOpenDeps,
   sessionId: string
-): Promise<RestoredStructuredAgentSessionRead | null> {
-  const record = store.getRecord(sessionId)
+): Promise<OpenedStructuredAgentSessionConversation | null> {
+  const record = deps.store.getRecord(sessionId)
   if (!record) {
     return null
   }
-  const params = attachParamsForRecord(record, {
-    clientOperationId: `read-restore:${record.sessionId}`,
-    expectedRuntimeFence: record.lease.runtimeFence
-  })
-  const journalDir = journalDirectoryFor(journalRoot, {
+  const journalDir = journalDirectoryFor(deps.journalRoot, {
     workspaceId: record.location.workspaceId,
     sessionId
   })
-  const loaded = loadJournal(journalDir, sessionId)
-  if (loaded?.corrupt) {
+  // A session still in the pre-SQLite format has no `journal.db`; the open imports it.
+  if (!existsSync(journalDatabaseFile(journalDir)) && !findJournalFileFormatRemnant(journalDir)) {
     return null
   }
-  // A session still in the pre-SQLite format has no `journal.db` to load. Dropping
-  // it here leaves it unpublished, which is also what prunes its tab out of the
-  // saved workspace — so the chat disappears with nowhere to explain itself.
-  if (!loaded && !findJournalFileFormatRemnant(journalDir)) {
-    return null
-  }
-  const journal = await openAgentSessionJournal({
-    identity: journalIdentityFor(record, params),
-    journalDir,
-    // Omitted, not `null`: the store reads `null` as "replay already ran and
-    // found nothing" and founds a fresh epoch. In process the probe above is the
-    // previous statement, so the window is zero-width; this holds the line for a
-    // database another process creates in between.
-    ...(loaded ? { loaded } : {})
-  })
-  // Read restore opens the journal and nothing else: no adapter call, so no
-  // provider child. Opening it can still write — a session whose history is in
-  // the old format founds its epoch and commits the row explaining that here.
-  return {
-    journal,
-    params,
-    fence: record.lease.runtimeFence,
-    hasProviderChild: false,
-    providerChildPhase: 'ready',
-    acquisitionGeneration: null
-  }
-}
-
-export function attachParamsForRecord(
-  record: AgentSessionRecord,
-  input: {
-    clientOperationId: string
-    expectedRuntimeFence: number
-  }
-): AgentSessionAttachParams {
-  const params: AgentSessionAttachParams = {
-    envelope: {
-      sessionId: record.sessionId,
-      clientOperationId: input.clientOperationId,
-      expectedRuntimeFence: input.expectedRuntimeFence,
-      payloadFingerprint: ''
-    },
-    location: record.location,
-    provider: record.provider,
-    agent: record.provider,
-    accountHome: record.accountHome,
-    runtimeKind: 'native'
-  }
-  return {
-    ...params,
-    envelope: {
-      ...params.envelope,
-      payloadFingerprint: computeAgentSessionPayloadFingerprint({
-        method: 'agentSession.attach',
-        sessionId: record.sessionId,
-        fields: attachFingerprintFields(params)
-      })
-    }
-  }
+  return openStructuredAgentSessionConversationJournal(deps, record)
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.test.ts
index 5d579fbe256..d1cc9408a62 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.test.ts
@@ -19,15 +19,17 @@ describe('StructuredAgentSessionReadableRestorer', () => {
       (sessionId) => ({ sessionId }) as AgentSessionRecord
     )
     const restorer = new StructuredAgentSessionReadableRestorer({
-      store: { listRecords: () => records } as never,
-      journalRoot: '/tmp/journals',
+      openDeps: {
+        store: { getRecord: () => null, listRecords: () => records },
+        journalRoot: '/tmp/journals',
+        adapter: {}
+      },
       supportsRecord: () => true,
       reconcile: async () => null,
       resolveRecovery: async () => undefined,
       serialize: async (_sessionId, task) => task(),
       hasSession: () => false,
-      onReadable: () => undefined,
-      retrySettlement: async () => true
+      onReadable: () => undefined
     })
 
     await restorer.restore(['visible-a', 'visible-b', 'background-a', 'background-b'])
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.ts
index a11c3a85b6c..06bd043aec0 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.ts
@@ -1,30 +1,13 @@
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
-import type { AgentSessionWireRefusal } from '../../../shared/agent-session-wire'
-import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
-import type { RestoredStructuredAgentSessionRead } from './structured-agent-session-read-restore'
-import {
-  restoreOneStructuredAgentSessionRead,
-  restoreOneStructuredAgentSessionReadUnderSerialize,
-  restoreStructuredAgentSessionsOnRestart
-} from './structured-agent-session-restart-restore'
+import type { StructuredAgentSessionReadRestoreDeps } from './structured-agent-session-restart-restore'
+import { restoreStructuredAgentSessionsOnRestart } from './structured-agent-session-restart-restore'
 
 export class StructuredAgentSessionReadableRestorer {
   private restorePromise: Promise<void> | null = null
 
   constructor(
-    private readonly input: {
-      store: AgentSessionRecordStore
-      journalRoot: string
+    private readonly input: StructuredAgentSessionReadRestoreDeps & {
       supportsRecord: (record: AgentSessionRecord) => boolean
-      reconcile: (sessionId: string) => Promise<AgentSessionWireRefusal | null>
-      resolveRecovery: (sessionId: string) => Promise<unknown>
-      serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
-      hasSession: (sessionId: string) => boolean
-      onReadable: (sessionId: string, restored: RestoredStructuredAgentSessionRead) => void
-      retrySettlement: (
-        sessionId: string,
-        params: RestoredStructuredAgentSessionRead['params']
-      ) => Promise<boolean>
     }
   ) {}
 
@@ -36,46 +19,11 @@ export class StructuredAgentSessionReadableRestorer {
     return this.restorePromise
   }
 
-  /**
-   * One session, on demand, after startup.
-   *
-   * Deliberately outside `restorePromise`: that latch answers "has the startup sweep run", and a
-   * surface asking for a session the sweep never covered — or that was closed since — must not be
-   * told yes because the sweep finished. Needs no dedupe of its own; the per-session task queue
-   * `serialize` runs on already orders concurrent callers, and the second one sees `hasSession`.
-   *
-   * Provider-agnostic by construction: eligibility is `supportsRecord`, which the adapter router
-   * answers for Claude and Codex from the record's own provider.
-   */
-  async restoreOne(sessionId: string): Promise<boolean> {
-    if (!this.supports(sessionId)) {
-      return false
-    }
-    await restoreOneStructuredAgentSessionRead(this.input, sessionId)
-    return this.input.hasSession(sessionId)
-  }
-
-  /** `restoreOne` for a caller already inside the session's serialize. Reconciliation is skipped
-   *  on purpose: a lease this host has not adjudicated is the attach's problem, and a replay
-   *  needs only the journal. */
-  async restoreOneUnderSerialize(sessionId: string): Promise<boolean> {
-    if (!this.supports(sessionId)) {
-      return false
-    }
-    await restoreOneStructuredAgentSessionReadUnderSerialize(this.input, sessionId)
-    return this.input.hasSession(sessionId)
-  }
-
-  private supports(sessionId: string): boolean {
-    const record = this.input.store.getRecord(sessionId)
-    return record !== null && this.input.supportsRecord(record)
-  }
-
   private async restoreReadableSessions(sessionIds?: readonly string[]): Promise<void> {
     const targetOrder = sessionIds
       ? new Map(sessionIds.map((sessionId, index) => [sessionId, index]))
       : null
-    const records = this.input.store
+    const records = this.input.openDeps.store
       .listRecords()
       .filter(
         (record) =>
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-recovered-turn-clock.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-recovered-turn-clock.test.ts
index a239e4a5154..7a90850dfc6 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-recovered-turn-clock.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-recovered-turn-clock.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // A turn that was running when its host went away ends when recovery settles it. That settlement is
 // the edge the user needs to see — their work stopped — so the session reads as newly done then,
 // and nothing along the way may call it a success. Every hop is the real one: durable journal,
@@ -14,11 +15,11 @@ import type {
 import { AgentHookServer, _internals } from '../../agent-hooks/server'
 import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import { settleStructuredAgentSessionDeadGeneration } from './structured-agent-session-dead-generation-settlement'
 import {
-  settleStaleSessionStateOnAcquire,
-  type StructuredAgentSessionTurnVerdict
-} from './structured-agent-session-stale-turn-verdict'
+  settleStaleStructuredAgentSessionState,
+  settleStructuredAgentSessionDeadGeneration
+} from './structured-agent-session-dead-generation-settlement'
+import type { StructuredAgentSessionTurnVerdict } from './structured-agent-session-stale-turn-verdict'
 import { StructuredAgentSessionStatusFeed } from './structured-agent-session-status-feed'
 import { indexedStatusFeedSession } from './structured-agent-session-status-feed-test-session'
 import { StructuredAgentSessionTurnCompletionFeed } from './structured-agent-session-turn-completion-feed'
@@ -59,12 +60,12 @@ async function sessionWithRunningTurn() {
   await journal.appendItem(
     { provider: 'orca', clientMessageId: 'prompt-1' },
     { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'long job' }] },
-    { fence: 1 }
+    { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
   await journal.appendItem(
     { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 9 },
     { kind: 'turn', turnId: 'turn-1', state: 'running', startedAt: TURN_STARTED },
-    { fence: 1 }
+    { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
   const server = new AgentHookServer()
   const sessions = new Map([[SESSION, indexedStatusFeedSession({ journal })]])
@@ -88,7 +89,11 @@ async function sessionWithRunningTurn() {
       }
     }
   })
-  const completions = new StructuredAgentSessionTurnCompletionFeed({ sessions, now: () => clock })
+  const completions = new StructuredAgentSessionTurnCompletionFeed({
+    sessions,
+    now: () => clock,
+    readStatusState: (sessionId, source) => feed.statusState(sessionId, source)
+  })
   const completionEvents: AgentSessionTurnCompletionEvent[] = []
   completions.subscribe({ id: 'dot-1', emit: (event) => completionEvents.push(event) })
   // Both feeds have seen the turn running, so its settlement is a transition they must judge.
@@ -157,11 +162,12 @@ describe('a turn recovery settled after its host went away', () => {
   it('is dated the same way when a new provider child finds the turn still running', async () => {
     const session = await sessionWithRunningTurn()
     session.recoverAt(RECOVERED)
-    await settleStaleSessionStateOnAcquire({
+    await settleStaleStructuredAgentSessionState({
       journal: session.journal,
       sessionId: SESSION,
       fence: 2,
-      acquisitionGeneration: 'generation-2'
+      acquisitionGeneration: 'generation-2',
+      deathEvidence: null
     })
     session.publish()
 
@@ -191,7 +197,7 @@ describe('a turn recovery settled after its host went away', () => {
         startedAt: TURN_STARTED,
         completedAt: EXIT_OBSERVED
       },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     session.publish()
 
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-exits.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-exits.test.ts
index 7cd92bf521b..2da22f95873 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-exits.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-exits.test.ts
@@ -11,6 +11,7 @@ import { readProcessStartTimeMs } from '../../runtime/agent-session-process-iden
 import { createStructuredAgentSessionOwnerProbe } from '../../runtime/structured-agent-session-owner-probe'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import { abandonStructuredAgentSessionHost } from './structured-agent-session-host-test-abandon'
 import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
 import {
   HOST_TEST_NOW as NOW,
@@ -59,6 +60,12 @@ async function stopOwner(child: ReturnType<typeof spawnProcess>): Promise<void>
   spawnedOwners.delete(child)
 }
 
+/** What a send's delivery or `agentSession.ensure` does: attach at the record's current fence. */
+async function startAgent(): Promise<void> {
+  const fence = store.getRecord(SESSION)?.lease.runtimeFence ?? null
+  expect((await host.attach(CALLER, hostTestAttachParams(fence))).ok).toBe(true)
+}
+
 function adapter(): StructuredAgentSessionAdapter {
   return {
     acquire,
@@ -82,17 +89,8 @@ function openHost(overrides: Partial<StructuredAgentSessionHostDeps> = {}): void
   })
 }
 
-async function abandonHost(abandonedHost: StructuredAgentSessionHost): Promise<void> {
-  abandonedHost['runtimeState'].stopLeaseRenewal()
-  abandonedHost['holds'].dispose()
-  await Promise.all(
-    [...abandonedHost['sessions'].values()].map((session) => session.journal.close())
-  )
-  abandonedHost['sessions'].clear()
-}
-
 async function reopenStore(): Promise<void> {
-  await abandonHost(host)
+  await abandonStructuredAgentSessionHost(host)
   store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
 }
 
@@ -119,37 +117,35 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
-  await abandonHost(host)
-  await Promise.all([...supersededHosts].map(abandonHost))
+  await abandonStructuredAgentSessionHost(host)
+  await Promise.all([...supersededHosts].map(abandonStructuredAgentSessionHost))
   supersededHosts.clear()
   await Promise.all([...spawnedOwners].map((child) => stopOwner(child)))
   await rm(root, { recursive: true, force: true })
 })
 
 describe('recovery exits', () => {
-  it('keeps an ownerless unproven acquisition in manual recovery across restart', async () => {
+  it('releases an ownerless unproven acquisition, so the next start goes ahead', async () => {
     acquire.mockRejectedValueOnce(new Error('simulated crash before identity commit'))
     await expect(host.attach(CALLER, hostTestAttachParams(null))).rejects.toThrow(
       'agent_session_acquisition_exit_unproven'
     )
+    // No owner was recorded, and the adapter closed the stdio of anything it spawned.
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      claimStatus: 'reserved',
-      handoffStage: 'manual-recovery',
+      claimStatus: 'released',
+      handoffStage: null,
       handoffOperationId: null,
       ownerProcess: null,
-      runtimeFence: 1,
-      reservedSpawnToken: 'spawn-a'
+      runtimeFence: 2,
+      reservedSpawnToken: null,
+      deathEvidence: null
     })
 
     await reopenStore()
     openHost({ mintSpawnToken: () => 'spawn-b' })
 
-    const refused = await host.attach(CALLER, hostTestAttachParams(1))
-    expect(refused).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_ownership_unknown' }
-    })
-    expect(acquire).toHaveBeenCalledOnce()
+    expect(await host.attach(CALLER, hostTestAttachParams(2))).toMatchObject({ ok: true })
+    expect(acquire).toHaveBeenCalledTimes(2)
   })
 
   it('releases an unproven acquisition whose owner later dies, without replaying it as a handoff', async () => {
@@ -197,8 +193,8 @@ describe('recovery exits', () => {
       runtimeFence: 4
     })
 
-    // The ordinary native recovery path remains: the first surface hold resumes it.
-    await host.hold(SESSION, 'surface-1')
+    // The ordinary native recovery path remains: the next start resumes it.
+    await startAgent()
     expect(acquire).toHaveBeenCalledTimes(3)
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       claimStatus: 'live',
@@ -242,7 +238,7 @@ describe('recovery exits', () => {
     })
   })
 
-  it('heals a stranded native owner during startup restore, and spawns nothing until a surface asks', async () => {
+  it('heals a stranded native owner during startup restore, and spawns nothing until work asks', async () => {
     expect((await host.attach(CALLER, hostTestAttachParams(null))).ok).toBe(true)
     await reopenStore()
 
@@ -262,7 +258,7 @@ describe('recovery exits', () => {
     await host.restoreReadableSessions()
 
     // Healing is startup's job; spawning is not. The orphan is stopped and the lease is free, but
-    // nothing has asked to look at this session, so no replacement child exists yet.
+    // nothing has asked this session for work, so no replacement child exists yet.
     expect(stopOwnerProcess).toHaveBeenCalledWith(4242, 'SIGTERM')
     expect(acquire).toHaveBeenCalledTimes(1)
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
@@ -271,7 +267,7 @@ describe('recovery exits', () => {
       ownerProcess: null
     })
 
-    await host.hold(SESSION, 'surface-1')
+    await startAgent()
 
     expect(acquire).toHaveBeenCalledTimes(2)
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
@@ -340,7 +336,7 @@ describe('recovery exits', () => {
       }
     })
 
-    await host.hold(SESSION, 'surface-overlap')
+    await startAgent()
 
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       runtimeFence: 3,
@@ -348,6 +344,6 @@ describe('recovery exits', () => {
       handoffStage: null,
       ownerProcess: { pid: replacement.process.pid, spawnToken: 'spawn-b' }
     })
-    expect(host.history({ sessionId: SESSION, direction: 'tail' }).ok).toBe(true)
+    expect((await host.history({ sessionId: SESSION, direction: 'tail' })).ok).toBe(true)
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.test.ts
index b647ed01883..063e8c64af7 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.test.ts
@@ -1,3 +1,4 @@
+import { spawn } from 'node:child_process'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -8,6 +9,7 @@ import {
   writeOlderBuildLease
 } from '../../runtime/agent-session-older-build-lease.test-fixture'
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { supervisedPosixLaunch } from '../../codex/codex-app-server-posix-supervisor'
 import {
   resolveStructuredSessionRecovery,
   type StructuredSessionRecoveryResolutionDeps
@@ -62,7 +64,7 @@ async function reserve(store: AgentSessionRecordStore) {
   })
 }
 
-async function liveOwner(store: AgentSessionRecordStore) {
+async function liveOwner(store: AgentSessionRecordStore, pid = 4242) {
   const reserved = await reserve(store)
   const fence = reserved.record.lease.runtimeFence
   await store.commitProcessIdentity({
@@ -70,7 +72,7 @@ async function liveOwner(store: AgentSessionRecordStore) {
     fence,
     process: {
       hostId: 'local',
-      pid: 4242,
+      pid,
       processStartTimeMs: NOW - 1_000,
       spawnToken: 'spawn-recovery'
     },
@@ -90,10 +92,10 @@ async function liveOwner(store: AgentSessionRecordStore) {
   })
 }
 
-async function latch(store: AgentSessionRecordStore, stage: 'recovering' | 'manual-recovery') {
+async function latch(store: AgentSessionRecordStore) {
   return store.transitionHandoff(SESSION, (record) => ({
     ...record,
-    lease: { ...record.lease, handoffStage: stage }
+    lease: { ...record.lease, handoffStage: 'recovering' }
   }))
 }
 
@@ -117,29 +119,30 @@ function deps(
 }
 
 describe('structured session recovery resolution', () => {
-  it('does not release an ownerless native reservation without processless proof', async () => {
+  it('releases an ownerless reservation: nothing it recorded can be holding it', async () => {
     const store = await openStore()
     await reserve(store)
-    await latch(store, 'recovering')
+    await latch(store)
 
     const result = await resolveStructuredSessionRecovery(
       deps(store, () => ({ outcome: 'indeterminate', reason: 'no scan' })),
       SESSION
     )
 
-    expect(result).toBe('unresolved')
+    expect(result).toBe('resolved')
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      claimStatus: 'reserved',
-      handoffStage: 'recovering',
-      runtimeFence: 1,
-      reservedSpawnToken: 'spawn-recovery'
+      claimStatus: 'released',
+      handoffStage: null,
+      runtimeFence: 2,
+      reservedSpawnToken: null,
+      deathEvidence: null
     })
   })
 
   it('evicts a latched owner the probe now proves dead, without a stop request', async () => {
     const store = await openStore()
     await liveOwner(store)
-    await latch(store, 'manual-recovery')
+    await latch(store)
     const stopOwnerProcess = vi.fn()
 
     const result = await resolveStructuredSessionRecovery(
@@ -160,7 +163,7 @@ describe('structured session recovery resolution', () => {
   it('stops a live identity-matched orphan and evicts only after absence is proven', async () => {
     const store = await openStore()
     await liveOwner(store)
-    await latch(store, 'recovering')
+    await latch(store)
     let alive = true
     const stopOwnerProcess = vi.fn(() => {
       alive = false
@@ -188,10 +191,10 @@ describe('structured session recovery resolution', () => {
     })
   })
 
-  it('escalates the stop request but never evicts an owner that stays alive', async () => {
+  it('releases an owner that survives the stop ladder, with no death evidence', async () => {
     const store = await openStore()
     await liveOwner(store)
-    await latch(store, 'recovering')
+    await latch(store)
     const stopOwnerProcess = vi.fn()
 
     const result = await resolveStructuredSessionRecovery(
@@ -201,22 +204,25 @@ describe('structured session recovery resolution', () => {
       SESSION
     )
 
-    expect(result).toBe('unresolved')
-    expect(stopOwnerProcess).toHaveBeenCalledWith(4242, 'SIGTERM')
-    expect(stopOwnerProcess).toHaveBeenCalledWith(4242, 'SIGKILL')
-    // The latch is preserved verbatim: no fence move, no cleared owner, no lost state.
+    expect(result).toBe('resolved')
+    expect(stopOwnerProcess.mock.calls).toEqual([
+      [4242, 'SIGTERM'],
+      [4242, 'SIGKILL']
+    ])
+    // Its transport died with the runtime that held it; nothing proved it gone, so no evidence.
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      claimStatus: 'live',
-      handoffStage: 'recovering',
-      runtimeFence: 1,
-      ownerProcess: { pid: 4242 }
+      claimStatus: 'released',
+      handoffStage: null,
+      runtimeFence: 2,
+      ownerProcess: null,
+      deathEvidence: null
     })
   })
 
-  it('leaves an unverifiable owner latched and requests no stop', async () => {
+  it('releases an owner whose identity cannot be verified, and signals nothing', async () => {
     const store = await openStore()
     await liveOwner(store)
-    await latch(store, 'recovering')
+    await latch(store)
     const stopOwnerProcess = vi.fn()
 
     const result = await resolveStructuredSessionRecovery(
@@ -226,11 +232,15 @@ describe('structured session recovery resolution', () => {
       SESSION
     )
 
-    expect(result).toBe('unresolved')
+    expect(result).toBe('resolved')
+    // The pid may have been reused by an unrelated process.
     expect(stopOwnerProcess).not.toHaveBeenCalled()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      handoffStage: 'recovering',
-      runtimeFence: 1
+      claimStatus: 'released',
+      handoffStage: null,
+      runtimeFence: 2,
+      ownerProcess: null,
+      deathEvidence: null
     })
   })
 
@@ -255,7 +265,7 @@ describe('structured session recovery resolution', () => {
     expect(await readPersistedLease(directory, SESSION)).toMatchObject({
       runtimeKind: 'native',
       claimStatus: 'conflicted',
-      handoffStage: 'manual-recovery'
+      handoffStage: 'recovering'
     })
 
     expect(
@@ -270,7 +280,7 @@ describe('structured session recovery resolution', () => {
     })
   })
 
-  it('resolves a terminal reservation an older build left naming nobody', async () => {
+  it('releases a terminal reservation an older build left naming nobody at restart', async () => {
     const directory = await newStoreDirectory()
     await reserve(await openStore(directory))
     await writeOlderBuildLease(directory, SESSION, { runtimeKind: 'tui' })
@@ -279,63 +289,87 @@ describe('structured session recovery resolution', () => {
       probe: async () => ({ outcome: 'indeterminate', reason: 'no scan' }),
       now: NOW
     })
-    // Only the kind changes: no process is recorded for a conflict to name.
+    // No process is recorded for a conflict to name, so there is nothing to wait out.
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       runtimeKind: 'native',
-      claimStatus: 'reserved',
-      handoffStage: 'manual-recovery'
+      claimStatus: 'released',
+      handoffStage: null,
+      deathEvidence: null
     })
-
     expect(
       await resolveStructuredSessionRecovery(
         deps(store, () => ({ outcome: 'reservation-unused' })),
         SESSION
       )
-    ).toBe('resolved')
-    expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      handoffStage: null,
-      claimStatus: 'released'
-    })
-  })
-
-  it('frees a conflicted claim once its named owner is proven gone', async () => {
-    const store = await openStore()
-    await liveOwner(store)
-    await store.markClaimConflicted(SESSION, NOW)
-
-    expect(
-      await resolveStructuredSessionRecovery(
-        deps(store, () => ({ outcome: 'pid-absent' })),
-        SESSION
-      )
-    ).toBe('resolved')
-    expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      handoffStage: null,
-      claimStatus: 'released',
-      deathEvidence: { kind: 'pid-absent' }
-    })
-  })
-
-  it('never stops the process a conflicted claim names, and keeps the conflict without proof', async () => {
-    const store = await openStore()
-    await liveOwner(store)
-    await store.markClaimConflicted(SESSION, NOW)
-    const stopOwnerProcess = vi.fn()
-
-    const result = await resolveStructuredSessionRecovery(
-      deps(store, () => ({ outcome: 'identity-matched', matchedOn: ['spawn-token'] }), {
-        stopOwnerProcess
-      }),
-      SESSION
-    )
-
-    // Ownership was never settled, so the process on the other side of the conflict is not
-    // Orca's to kill; only the user can decide which claimant wins.
-    expect(stopOwnerProcess).not.toHaveBeenCalled()
-    expect(result).toBe('unresolved')
-    expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      claimStatus: 'conflicted',
-      handoffStage: 'manual-recovery'
-    })
+    ).toBe('not-applicable')
   })
 })
+
+describe.runIf(process.platform !== 'win32')(
+  'structured session recovery of a supervised owner',
+  () => {
+    const recordedPids: number[] = []
+    const alive = (pid: number): boolean => {
+      try {
+        process.kill(pid, 0)
+        return true
+      } catch (error) {
+        return !(error instanceof Error && 'code' in error && error.code === 'ESRCH')
+      }
+    }
+
+    afterEach(() => {
+      for (const pid of recordedPids.splice(0)) {
+        if (alive(pid)) {
+          process.kill(pid, 'SIGKILL')
+        }
+      }
+    })
+
+    it('evicts only after the supervisor has reaped a provider that ignores SIGTERM', async () => {
+      const launch = supervisedPosixLaunch(
+        {
+          command: process.execPath,
+          args: [
+            '-e',
+            "process.on('SIGTERM', () => {}); process.stdout.write(process.pid + '\\n'); setInterval(() => {}, 60000)"
+          ]
+        },
+        process.env
+      )
+      const supervisor = spawn(launch.command, launch.args, {
+        env: launch.env,
+        stdio: ['pipe', 'pipe', 'ignore'],
+        detached: true
+      })
+      recordedPids.push(supervisor.pid!)
+      const provider = await new Promise<number>((resolve, reject) => {
+        const timeout = setTimeout(() => reject(new Error('provider never started')), 10_000)
+        supervisor.stdout.once('data', (chunk: Buffer) => {
+          clearTimeout(timeout)
+          resolve(Number(chunk.toString().trim()))
+        })
+      })
+      recordedPids.push(provider)
+      const store = await openStore()
+      await liveOwner(store, supervisor.pid!)
+      await latch(store)
+
+      const result = await resolveStructuredSessionRecovery(
+        {
+          store,
+          // The recorded pid is the supervisor's; its absence is the proof recovery evicts on.
+          probeRecord: async () =>
+            alive(supervisor.pid!) ? MATCHED : { outcome: 'pid-absent' as const },
+          now: () => NOW + 10_000
+        },
+        SESSION
+      )
+
+      expect(result).toBe('resolved')
+      // Evicted on proof of death, which must hold for the provider too, not only the supervisor.
+      expect(store.getRecord(SESSION)?.lease.deathEvidence).not.toBeNull()
+      expect(alive(provider)).toBe(false)
+    })
+  }
+)
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.ts
index 40317552d6e..385d438f7a0 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.ts
@@ -1,8 +1,12 @@
 /**
- * Exits from latched recovery stages. A session lands in `recovering` / `manual-recovery`
- * when evidence about its owner was UNAVAILABLE; this module re-asks with present-time
- * evidence and releases the lease only on proof. A stop is a request — the lease moves only
- * after a later probe proves the process absent, never on a timeout.
+ * Exits from the `recovering` stage. A session lands there when evidence about its owner was
+ * unavailable; this re-asks with present-time evidence and always concludes. A dead owner is
+ * evicted on proof. A live one is stopped by identity and evicted once
+ * proven gone. One that outlives the stop, or whose identity cannot be verified, is released
+ * anyway: its transport died with the runtime that held it, so nothing can drive it, and no signal
+ * is sent to a pid that cannot be verified as the one recorded. Only a conflicted claim, which is
+ * how a terminal owner an older build recorded now loads, is waited out and never stopped: it is
+ * the user's own agent, and its exit is its way out.
  */
 
 import {
@@ -11,6 +15,8 @@ import {
   type AgentSessionOwnerProbe
 } from '../../../shared/agent-session-lease-adjudication'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import { PROVIDER_SUPERVISOR_MAX_STOP_MS } from '../../codex/codex-app-server-posix-supervisor'
+import { releaseUnprovenAgentSessionOwner } from '../../runtime/agent-session-lease-transitions'
 import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 
 export type StructuredSessionRecoveryStopSignal = 'SIGTERM' | 'SIGKILL'
@@ -23,8 +29,13 @@ export type StructuredSessionRecoveryResolutionDeps = {
   delay?: (ms: number) => Promise<void>
 }
 
-const STOP_PROBES_PER_SIGNAL = 4
 const STOP_PROBE_INTERVAL_MS = 250
+// A POSIX structured owner is its provider supervisor, which exits only after its provider
+// group. A SIGKILL that lands first leaves the group running, so SIGTERM outlasts its stop.
+const STOP_PROBES: Record<StructuredSessionRecoveryStopSignal, number> = {
+  SIGTERM: Math.ceil(PROVIDER_SUPERVISOR_MAX_STOP_MS / STOP_PROBE_INTERVAL_MS) + 1,
+  SIGKILL: 4
+}
 
 const UNRESOLVED_REFUSALS: ReadonlySet<string> = new Set([
   'agent_session_ownership_unknown',
@@ -33,62 +44,46 @@ const UNRESOLVED_REFUSALS: ReadonlySet<string> = new Set([
   'agent_session_identity_required'
 ])
 
-/** Which latched records this module may re-ask about. */
-export function structuredSessionRecoveryIsResolvable(record: AgentSessionRecord): boolean {
-  if (record.lease.settlementRetryRequired) {
-    // Settlement latches are cleared only by a successful journal retry, never by owner probing.
-    return false
-  }
-  const { claimStatus, handoffStage, ownerProcess } = record.lease
-  if (handoffStage !== 'recovering' && handoffStage !== 'manual-recovery') {
-    return false
-  }
-  if (claimStatus === 'conflicted') {
-    // A conflict names one process. Re-asking is only meaningful against that name; with none
-    // recorded there is nothing present-time evidence could settle, and the user decides.
-    return ownerProcess !== null
-  }
-  return true
-}
-
-/** Stopping a matched owner is only Orca's call when Orca owned its transport. A conflicted claim
- *  means ownership was never settled — including a terminal an older build recorded as owner. */
-function recoveryMayStopOwner(record: AgentSessionRecord): boolean {
-  return record.lease.claimStatus !== 'conflicted'
-}
-
 export async function resolveStructuredSessionRecovery(
   deps: StructuredSessionRecoveryResolutionDeps,
   sessionId: string
 ): Promise<'resolved' | 'unresolved' | 'not-applicable'> {
   const record = deps.store.getRecord(sessionId)
-  if (!record || !structuredSessionRecoveryIsResolvable(record)) {
+  if (record?.lease.handoffStage !== 'recovering') {
     return 'not-applicable'
   }
   let probe = await deps.probeRecord(record)
   const owner = record.lease.ownerProcess
-  if (
-    owner &&
-    owner.hostId === deps.store.hostId &&
-    isProvenAliveProbe(probe) &&
-    recoveryMayStopOwner(record)
-  ) {
-    // The owner is a live child of a runtime that no longer exists; its transport cannot be
-    // reconstructed, so the only way forward is to stop it and prove it gone.
+  if (owner && record.lease.claimStatus === 'conflicted' && !isProvenDeadProbe(probe)) {
+    // A terminal agent keeps its transport across a restart, so only proof of its exit is a way in.
+    return 'unresolved'
+  }
+  if (owner && isProvenAliveProbe(probe)) {
+    if (owner.hostId !== deps.store.hostId) {
+      return 'unresolved'
+    }
     probe = await stopOwnerAndReprobe(deps, record, owner.pid)
   }
   try {
-    await deps.store.evictProvenDeadOwner({
-      sessionId,
-      expectedFence: record.lease.runtimeFence,
-      probe,
-      now: deps.now()
-    })
+    await (owner && !isProvenDeadProbe(probe)
+      ? deps.store.transitionHandoff(sessionId, (latest) =>
+          releaseUnprovenAgentSessionOwner({
+            record: latest,
+            expectedFence: record.lease.runtimeFence,
+            now: deps.now()
+          })
+        )
+      : deps.store.evictProvenDeadOwner({
+          sessionId,
+          expectedFence: record.lease.runtimeFence,
+          probe,
+          now: deps.now()
+        }))
     return 'resolved'
   } catch (error) {
     const code = error instanceof Error ? error.message : String(error)
     if (UNRESOLVED_REFUSALS.has(code)) {
-      // No proof yet; the record is preserved untouched and the next attempt re-asks.
+      // The record moved under this resolution; the next attempt re-asks against what it is now.
       return 'unresolved'
     }
     throw error
@@ -105,7 +100,7 @@ async function stopOwnerAndReprobe(
   let probe: AgentSessionOwnerProbe = { outcome: 'indeterminate', reason: 'owner stop requested' }
   for (const signal of ['SIGTERM', 'SIGKILL'] as const) {
     stop(pid, signal)
-    for (let attempt = 0; attempt < STOP_PROBES_PER_SIGNAL; attempt += 1) {
+    for (let attempt = 0; attempt < STOP_PROBES[signal]; attempt += 1) {
       probe = await deps.probeRecord(record)
       if (isProvenDeadProbe(probe)) {
         return probe
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-details.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-details.test.ts
new file mode 100644
index 00000000000..505bec74c23
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-details.test.ts
@@ -0,0 +1,274 @@
+// A refusal's details name the situation, so every place that answers for a refusal — the first
+// reply, a ledger replay, the store fallback copy — must name the same one.
+
+import { describe, expect, it } from 'vitest'
+import {
+  agentSessionRecordFixture,
+  agentSessionLeaseFixture
+} from '../../../shared/agent-session-record.test-fixture'
+import { agentSessionRefusalError } from '../../../shared/agent-session-wire-refusals'
+import { classifyStoreFailure } from './structured-agent-session-attach'
+import {
+  AgentSessionAcquisitionExitProvenError,
+  AgentSessionAcquisitionExitUnprovenError,
+  AgentSessionAcquisitionRefusal,
+  AgentSessionPreSpawnError
+} from './structured-agent-session-adapter'
+import {
+  failedAcquisitionRefusal,
+  failedAcquisitionSettlement
+} from './structured-agent-session-failed-create-refusal'
+import { withObservedProviderExit } from './structured-agent-session-failure-text'
+import { resolveAgentSessionReplayOutcome } from './structured-agent-session-replay-outcome'
+
+const CLAUDE_CREATE = {
+  record: agentSessionRecordFixture(),
+  newSession: true
+}
+
+function replay(outcome: Parameters<typeof resolveAgentSessionReplayOutcome>[0]['outcome']) {
+  return resolveAgentSessionReplayOutcome({
+    operationId: 'op-1',
+    outcome,
+    reconstruct: () => null
+  })
+}
+
+describe('a ledger replay names the details its first answer did', () => {
+  it.each([
+    [new AgentSessionAcquisitionRefusal('not signed in', 'notSignedIn'), 'notSignedIn'],
+    [
+      new AgentSessionAcquisitionExitProvenError(
+        withObservedProviderExit(new Error('exited (code 1)'))
+      ),
+      'providerStartFailed'
+    ],
+    // Gone now, with no exit observed: no situation, on the first answer or the replay.
+    [new AgentSessionAcquisitionExitProvenError(new Error('spawn codex ENOENT')), undefined]
+  ])('for a failed create: %s', (error, reason) => {
+    const first = failedAcquisitionRefusal(error, CLAUDE_CREATE)
+    const replayed = replay(failedAcquisitionSettlement(error, CLAUDE_CREATE).outcome)
+    expect(first?.refusal.details?.reason).toBe(reason)
+    expect(replayed).toMatchObject({
+      decision: 'refuse',
+      refusal: { code: first?.refusal.code, ...(reason ? { details: first?.refusal.details } : {}) }
+    })
+    if (!reason) {
+      expect(replayed).not.toHaveProperty('refusal.details')
+    }
+  })
+
+  it('for a create whose cleanup could not prove the child gone', () => {
+    const outcome = failedAcquisitionSettlement(
+      new AgentSessionAcquisitionExitUnprovenError(new Error('probe failed')),
+      CLAUDE_CREATE
+    ).outcome
+    expect(replay(outcome)).toMatchObject({
+      refusal: { code: 'agent_session_ownership_unknown', details: { reason: 'ownerUnproven' } }
+    })
+  })
+
+  it.each([
+    [
+      new AgentSessionAcquisitionExitProvenError(
+        withObservedProviderExit(
+          new Error('claude stream-json exited (code 1): claude: not signed in (rig)')
+        )
+      ),
+      'Claude stopped before it finished starting. Send your message to try again.'
+    ],
+    [
+      new AgentSessionAcquisitionExitProvenError(new Error('spawn claude ENOENT')),
+      "Claude couldn't start. Send your message to try again."
+    ],
+    [
+      new AgentSessionAcquisitionRefusal(
+        'Claude is not signed in for the selected account. Sign in with the Claude CLI for this CLAUDE_CONFIG_DIR, then retry.',
+        'notSignedIn'
+      ),
+      'Claude is not signed in for the selected account. Sign in, then send your message again.'
+    ],
+    [
+      AgentSessionAcquisitionRefusal.historyTooLarge(
+        'Codex thread history exceeds the bounded restore queue; history was not partially imported.'
+      ),
+      "This conversation's history is too large to restore here. Start a new chat to continue."
+    ]
+  ])('answers and replays %s in the sentence its start failure reads as', (error, sentence) => {
+    const first = failedAcquisitionRefusal(error, CLAUDE_CREATE)
+    const replayed = replay(failedAcquisitionSettlement(error, CLAUDE_CREATE).outcome)
+    expect(first?.refusal.message).toBe(sentence)
+    expect(replayed).toMatchObject({ decision: 'refuse', refusal: { message: sentence } })
+    for (const message of [
+      first?.refusal.message,
+      failedAcquisitionSettlement(error, CLAUDE_CREATE).outcome.message
+    ]) {
+      expect(message).not.toMatch(
+        /stream-json|exited \(code|ENOENT|CLAUDE_CONFIG_DIR|restore queue/
+      )
+    }
+  })
+
+  it('replays a spawn that failed before any process in a sentence, not its error', () => {
+    const outcome = failedAcquisitionSettlement(
+      new AgentSessionPreSpawnError(new Error('spawn claude ENOENT')),
+      CLAUDE_CREATE
+    ).outcome
+    expect(replay(outcome)).toMatchObject({
+      refusal: { message: "Claude couldn't start. Send your message to try again." }
+    })
+  })
+
+  it('keeps the code a store refusal replays with, and the unproven-exit marker', () => {
+    expect(
+      failedAcquisitionSettlement(new Error('agent_session_conflict'), CLAUDE_CREATE).outcome
+        .message
+    ).toBe('agent_session_conflict')
+    expect(
+      failedAcquisitionSettlement(
+        new AgentSessionAcquisitionExitUnprovenError(new Error('probe failed')),
+        CLAUDE_CREATE
+      ).outcome.message
+    ).toBe('agent_session_acquisition_exit_unproven')
+  })
+
+  it('replays the facts beside the reason, and mirrors them where released clients read', () => {
+    const resolution = {
+      state: 'resolved' as const,
+      selectedOptionId: 'allow',
+      resolvedBy: 'phone',
+      resolvedAt: 5
+    }
+    const replayed = replay({
+      status: 'failed',
+      code: 'agent_session_item_revision_stale',
+      details: { reason: 'promptMoved', currentRevision: 3, resolution }
+    })
+    expect(replayed).toMatchObject({
+      refusal: {
+        code: 'agent_session_item_revision_stale',
+        details: { reason: 'promptMoved', currentRevision: 3, resolution },
+        currentRevision: 3,
+        resolution
+      }
+    })
+  })
+
+  it('reads a row an older host wrote, with no details, as naming none', () => {
+    const replayed = replay({ status: 'failed', code: 'agent_session_conflict' })
+    expect(replayed).toMatchObject({ refusal: { code: 'agent_session_conflict' } })
+    expect(replayed.decision === 'refuse' && replayed.refusal).not.toHaveProperty('details')
+  })
+
+  it('drops the cause an unreleased build wrote, and a reason the code does not list', () => {
+    for (const row of [
+      { status: 'failed' as const, code: 'agent_session_conflict', cause: 'claimConflicted' },
+      {
+        status: 'failed' as const,
+        code: 'agent_session_conflict',
+        details: { reason: 'promptGone' as const }
+      }
+    ]) {
+      const replayed = replay(row)
+      expect(replayed).toMatchObject({ refusal: { code: 'agent_session_conflict' } })
+      expect(replayed.decision === 'refuse' && replayed.refusal).not.toHaveProperty('details')
+    }
+  })
+
+  it('names a code this build cannot place as refused earlier', () => {
+    expect(replay({ status: 'failed', code: 'agent_session_future_code' })).toMatchObject({
+      refusal: {
+        code: 'agent_session_operation_invalid',
+        details: { reason: 'operationRefusedEarlier' }
+      }
+    })
+  })
+
+  it('names a lost outcome and a lost result', () => {
+    expect(replay({ status: 'unknown' })).toMatchObject({
+      refusal: { details: { reason: 'outcomeUnknown' } }
+    })
+    expect(replay({ status: 'succeeded', sessionId: 's' })).toMatchObject({
+      refusal: { details: { reason: 'resultLost' } }
+    })
+  })
+})
+
+describe('the store fallback copy', () => {
+  const record = agentSessionRecordFixture(
+    agentSessionLeaseFixture({
+      ownerProcess: { hostId: 'local', pid: 4242, processStartTimeMs: 1, spawnToken: 'spawn-1' }
+    })
+  )
+
+  it('words a situation its code would misdescribe by the situation', () => {
+    const refusal = classifyStoreFailure(
+      agentSessionRefusalError('agent_session_ownership_unknown', { reason: 'replaySuperseded' }),
+      null,
+      record
+    )
+    expect(refusal).toMatchObject({
+      code: 'agent_session_ownership_unknown',
+      details: { reason: 'replaySuperseded' }
+    })
+    // Not the latched-owner story: this owner is not in doubt, the replay is just stale.
+    expect(refusal.message).not.toContain('4242')
+  })
+
+  it('keeps the latched-owner story, with its reason, for an owner it cannot prove gone', () => {
+    const refusal = classifyStoreFailure(
+      agentSessionRefusalError('agent_session_ownership_unknown', { reason: 'ownerUnproven' }),
+      null,
+      record
+    )
+    expect(refusal.details?.reason).toBe('ownerUnproven')
+    expect(refusal.message).toContain('4242')
+  })
+
+  it('does not promise an update fixes a record this build cannot read', () => {
+    // Unreadable covers a damaged record as well as one a newer build wrote.
+    expect(
+      classifyStoreFailure(
+        agentSessionRefusalError('execution_owner_reconciling', { reason: 'recordUnreadable' }),
+        null,
+        null
+      )
+    ).toEqual({
+      code: 'execution_owner_reconciling',
+      details: { reason: 'recordUnreadable' },
+      message:
+        "Orca can't read this chat's saved state. If a newer version of Orca saved it, update Orca to open it; otherwise start a new chat."
+    })
+  })
+
+  it('names the latch for a bare code an older path still throws', () => {
+    expect(
+      classifyStoreFailure(new Error('agent_session_conflict'), null, {
+        ...record,
+        lease: { ...record.lease, claimStatus: 'conflicted' }
+      }).details
+    ).toEqual({ reason: 'claimConflicted' })
+    expect(
+      classifyStoreFailure(new Error('agent_session_conflict'), null, null)
+    ).not.toHaveProperty('details')
+  })
+
+  it('puts the current fence in the details of a stale checkpoint, and mirrors it', () => {
+    expect(
+      classifyStoreFailure(
+        agentSessionRefusalError('agent_session_checkpoint_stale', { reason: 'fenceStale' }),
+        7,
+        null
+      )
+    ).toEqual({
+      code: 'agent_session_checkpoint_stale',
+      details: { reason: 'fenceStale', currentFence: 7 },
+      currentFence: 7,
+      message: 'The session store refused this call: agent_session_checkpoint_stale.'
+    })
+    // A bare code names no reason, but the fence is still a fact.
+    expect(
+      classifyStoreFailure(new Error('agent_session_checkpoint_stale'), 7, null)
+    ).toMatchObject({ details: { currentFence: 7 }, currentFence: 7 })
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-message.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-message.ts
index 0184366e344..7a7a9e289ef 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-message.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-message.ts
@@ -7,8 +7,12 @@
  * the action that supplies it.
  */
 
+import { terminalOwnerRefusalMessage } from '../../../shared/agent-session-legacy-handoff-lease'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
-import type { AgentSessionWireRefusalCode } from '../../../shared/agent-session-wire'
+import type {
+  AgentSessionAnyRefusalReason,
+  AgentSessionRefusalReference
+} from '../../../shared/agent-session-wire'
 
 function ownerDescription(record: AgentSessionRecord): string {
   const owner = record.lease.ownerProcess
@@ -16,33 +20,71 @@ function ownerDescription(record: AgentSessionRecord): string {
 }
 
 function latchedMessage(record: AgentSessionRecord): string {
-  const owner = record.lease.ownerProcess
-  if (record.lease.settlementRetryRequired) {
-    return 'The provider exited, but Orca has not finished settling the terminal chat state. Reopen this chat to retry the settlement.'
-  }
   if (record.lease.claimStatus === 'conflicted') {
-    return owner
-      ? `Two runtimes claimed this session and Orca cannot yet prove that ${ownerDescription(record)} has exited. Quit that process, or reopen this chat once it is gone, and Orca will take the session back.`
-      : 'Two runtimes claimed this session and the record names no process to check. Quit any other Orca or agent process using this workspace, then reopen this chat.'
+    return terminalOwnerRefusalMessage(record.lease)
   }
-  return owner
+  return record.lease.ownerProcess
     ? `Orca cannot prove that ${ownerDescription(record)} — the previous owner of this session — has exited, so it will not start a second agent on the same conversation. Quit that process and reopen this chat.`
     : 'Orca cannot tell whether an agent started for this session before the app stopped, so it will not start a second one on the same conversation. Quit any leftover agent process for this workspace and reopen this chat.'
 }
 
-/** Null when the code has no session-specific story to tell; the caller keeps its own wording. */
+/**
+ * A situation whose own words the store's code would get wrong: each of these reaches the chat as
+ * `ownership_unknown` or `conflict`, which by code alone would read as the latched-owner story.
+ */
+const SITUATION_MESSAGES: Partial<Record<AgentSessionAnyRefusalReason, string>> = {
+  replaySuperseded: 'A newer start of this chat replaced this one. Try again.',
+  leaseMoved: 'This chat changed hands while Orca was starting it. Try again.',
+  spawnIdentityMismatch:
+    'The agent that started was not the one Orca launched, so Orca did not use it. Try again.',
+  identityMismatch:
+    'This chat belongs to a different workspace, agent or account. Start a new chat to continue.',
+  sessionExists: 'This chat already exists. Open it to continue.',
+  tabIdTaken: 'Another chat already uses this tab. Try again.',
+  conversationHeldElsewhere:
+    'Another chat is already working in this conversation. Open that chat to continue.',
+  // Also a damaged record, which no update opens.
+  recordUnreadable:
+    "Orca can't read this chat's saved state. If a newer version of Orca saved it, update Orca to open it; otherwise start a new chat."
+}
+
+/**
+ * The words and the situation for a store refusal. The reason is what the emitter named, when it
+ * named one; the latched branches name their own. Null when neither has a story to tell, and the
+ * caller keeps its own wording.
+ */
 export function structuredAgentSessionRefusalMessage(
-  code: AgentSessionWireRefusalCode,
+  emitted: AgentSessionRefusalReference,
   record: AgentSessionRecord | null
-): string | null {
+): { message: string; reference: AgentSessionRefusalReference } | null {
+  const reason = emitted.details?.reason
+  const situational = reason ? SITUATION_MESSAGES[reason] : undefined
+  if (situational) {
+    return { message: situational, reference: emitted }
+  }
   if (!record) {
     return null
   }
+  const { code } = emitted
   if (code === 'agent_session_ownership_unknown' || code === 'agent_session_conflict') {
-    return latchedMessage(record)
+    const message = latchedMessage(record)
+    if (record.lease.claimStatus === 'conflicted') {
+      return { message, reference: { code, details: { reason: 'claimConflicted' } } }
+    }
+    return {
+      message,
+      reference:
+        code === 'agent_session_conflict' && reason === 'ownerAlive'
+          ? { code, details: { reason: 'ownerAlive' } }
+          : { code, details: { reason: 'ownerUnproven' } }
+    }
   }
   if (code === 'execution_owner_reconciling') {
-    return 'Orca is still working out who owns this session on this machine. Reopen the chat in a moment.'
+    return {
+      message:
+        'Orca is still working out who owns this session on this machine. Reopen the chat in a moment.',
+      reference: { code, details: { reason: 'hostReconciling' } }
+    }
   }
   return null
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts
index 566156e096f..4043e27b30c 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts
@@ -19,6 +19,7 @@ import {
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import { abandonStructuredAgentSessionHost } from './structured-agent-session-host-test-abandon'
 import {
   HOST_TEST_NOW as NOW,
   HOST_TEST_SESSION as SESSION,
@@ -103,16 +104,9 @@ async function createHarness(options: { attached?: boolean } = {}) {
   return harness
 }
 
-async function abandonHost(host: StructuredAgentSessionHost): Promise<void> {
-  host['runtimeState'].stopLeaseRenewal()
-  host['holds'].dispose()
-  await Promise.all([...host['sessions'].values()].map((session) => session.journal.close()))
-  host['sessions'].clear()
-}
-
 afterEach(async () => {
   const completed = harnesses.splice(0)
-  await Promise.all(completed.map(async ({ host }) => abandonHost(host)))
+  await Promise.all(completed.map(async ({ host }) => abandonStructuredAgentSessionHost(host)))
   await Promise.all(completed.map(async ({ root }) => rm(root, { recursive: true })))
 })
 
@@ -225,13 +219,20 @@ const UNREACHABLE = new Set<Pair>([
   // StructuredAgentSessionHost.mutate maps an absent record to AGENT_SESSION_NOT_ATTACHED.
   'agentSession.setOption:agent_session_identity_required',
   'agentSession.send:agent_session_identity_required',
-  // No structured-agent-session host branch emits agent_session_journal_unreadable.
+  // Only a send opens the conversation it writes to.
   'agentSession.setOption:agent_session_journal_unreadable',
-  'agentSession.send:agent_session_journal_unreadable',
   // Send reconstructs doubt from its global tombstone instead of refusing it.
   'agentSession.send:agent_session_operation_unknown',
   // Only a send restarts a lost owner.
-  'agentSession.setOption:agent_session_owner_restart_failed'
+  'agentSession.setOption:agent_session_owner_restart_failed',
+  // A write names its target, not an owner generation; only an attach compares fences.
+  'agentSession.setOption:agent_session_checkpoint_stale',
+  'agentSession.send:agent_session_checkpoint_stale',
+  // A send is a conversation write: admitted whoever owns the lease, and a start it needs that
+  // fails rejects the accepted message rather than refusing the call.
+  'agentSession.send:agent_session_conflict',
+  'agentSession.send:execution_owner_reconciling',
+  'agentSession.send:agent_session_owner_restart_failed'
 ])
 
 describe('agentSessionRefusalOperationState host oracle', () => {
@@ -242,25 +243,13 @@ describe('agentSessionRefusalOperationState host oracle', () => {
 
     const stale = await createHarness()
     for (const method of METHODS) {
-      const spec = {
-        method,
-        operationId: operationId(),
-        expectedRuntimeFence: 99
-      }
-      record(
-        await assertHostAgreement(stale, spec, 'agent_session_checkpoint_stale', async () => ({
-          harness: stale,
-          spec: {
-            ...spec,
-            expectedRuntimeFence: stale.store.getRecord(SESSION)?.lease.runtimeFence ?? 1
-          }
-        }))
-      )
+      const spec = { method, operationId: operationId(), expectedRuntimeFence: 99 }
+      await expect(invoke(stale, spec), method).resolves.toMatchObject({ ok: true })
     }
     expect(stale.setOption).toHaveBeenCalledTimes(1)
 
     const conflict = await createHarness()
-    for (const method of ['agentSession.setOption', 'agentSession.send'] as const) {
+    for (const method of ['agentSession.setOption'] as const) {
       await setLease(conflict, (current) => ({
         ...current,
         lease: { ...current.lease, handoffStage: 'new-owner-proving' }
@@ -340,7 +329,7 @@ describe('agentSessionRefusalOperationState host oracle', () => {
     record(await assertHostAgreement(unknown, optionUnknown, 'agent_session_operation_unknown'))
 
     const reconciling = await createHarness()
-    for (const method of ['agentSession.setOption', 'agentSession.send'] as const) {
+    for (const method of ['agentSession.setOption'] as const) {
       await setLease(reconciling, (current) => ({
         ...current,
         lease: { ...current.lease, unreconciled: true }
@@ -357,16 +346,21 @@ describe('agentSessionRefusalOperationState host oracle', () => {
       )
     }
 
-    const unrecoverable = await createHarness()
-    await unrecoverable.host.close(SESSION)
-    unrecoverable.host.deps.adapter.acquire = async () => {
-      throw new Error('no provider thread to resume')
+    const unreadable = await createHarness()
+    await unreadable.host.close(SESSION)
+    unreadable.host.deps.adapter.historyFilePath = async () => {
+      throw new Error('transcript unreadable')
     }
+    const unreadableSend = { method: 'agentSession.send' as const, operationId: operationId() }
     record(
       await assertHostAgreement(
-        unrecoverable,
-        { method: 'agentSession.send', operationId: operationId() },
-        'agent_session_owner_restart_failed'
+        unreadable,
+        unreadableSend,
+        'agent_session_journal_unreadable',
+        async () => {
+          delete unreadable.host.deps.adapter.historyFilePath
+          return { harness: unreadable, spec: unreadableSend }
+        }
       )
     )
 
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-release-clock.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-release-clock.ts
deleted file mode 100644
index 91daa5606a8..00000000000
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-release-clock.ts
+++ /dev/null
@@ -1,85 +0,0 @@
-// The delay between "nothing holds this session and nothing has happened in it" and "stop its
-// provider child".
-//
-// It is an IDLE window, not a short grace. A surface that reconnects — a mobile socket dropping on
-// a network switch, a renderer remounting a tab, a worktree switch hiding the pane — releases and
-// re-holds, and a send to a chat nobody is looking at restarts its owner; stopping the child soon
-// after either costs the user a respawn plus a resume on the next message. And a turn the user
-// already asked for must finish: stopping the child mid-answer strands the open turn marker.
-//
-// So the clock arms when the last holder leaves, every journal write while it is armed starts it
-// again, and a tick that finds work still owed — a turn running, a message sent but not yet
-// taken by the provider, or a subagent, command or monitor still running — re-arms instead of
-// evicting. The child goes only after a full window
-// with no holder and no owed work. Quit still stops every child at once.
-
-export const STRUCTURED_AGENT_SESSION_RELEASE_GRACE_MS = 30 * 60_000
-
-export type StructuredAgentSessionReleaseClockDeps = {
-  /** Never evict while work is owed; a true answer re-arms the clock instead. */
-  hasOwedWork: (sessionId: string) => boolean
-  /** Re-checked at fire time: a holder may have arrived while the timer ran. */
-  isHeld: (sessionId: string) => boolean
-  evict: (sessionId: string) => Promise<void>
-  onError?: (input: { sessionId: string; error: unknown }) => void
-  graceMs?: number
-}
-
-export class StructuredAgentSessionReleaseClock {
-  private readonly timers = new Map<string, ReturnType<typeof setTimeout>>()
-  private readonly graceMs: number
-
-  constructor(private readonly deps: StructuredAgentSessionReleaseClockDeps) {
-    this.graceMs = deps.graceMs ?? STRUCTURED_AGENT_SESSION_RELEASE_GRACE_MS
-  }
-
-  arm(sessionId: string): void {
-    this.cancel(sessionId)
-    const timer = setTimeout(() => {
-      this.timers.delete(sessionId)
-      this.fire(sessionId)
-    }, this.graceMs)
-    // A pending release must never be the reason a process stays alive at quit.
-    timer.unref?.()
-    this.timers.set(sessionId, timer)
-  }
-
-  /** Activity in an unheld session: the idle window starts over. */
-  renew(sessionId: string): void {
-    if (this.timers.has(sessionId)) {
-      this.arm(sessionId)
-    }
-  }
-
-  cancel(sessionId: string): void {
-    const timer = this.timers.get(sessionId)
-    if (timer) {
-      clearTimeout(timer)
-      this.timers.delete(sessionId)
-    }
-  }
-
-  isArmed(sessionId: string): boolean {
-    return this.timers.has(sessionId)
-  }
-
-  dispose(): void {
-    for (const timer of this.timers.values()) {
-      clearTimeout(timer)
-    }
-    this.timers.clear()
-  }
-
-  private fire(sessionId: string): void {
-    if (this.deps.isHeld(sessionId)) {
-      return
-    }
-    if (this.deps.hasOwedWork(sessionId)) {
-      this.arm(sessionId)
-      return
-    }
-    void this.deps.evict(sessionId).catch((error: unknown) => {
-      this.deps.onError?.({ sessionId, error })
-    })
-  }
-}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-replay-outcome.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-replay-outcome.ts
index c81c45dfba5..00fa33a30fb 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-replay-outcome.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-replay-outcome.ts
@@ -1,9 +1,11 @@
 import { rewindRefusal } from './structured-rewind-refusal'
 import type { AgentSessionOperationOutcome } from '../../../shared/agent-session-operation-ledger'
 import {
-  AGENT_SESSION_WIRE_REFUSAL_CODES,
-  type AgentSessionWireRefusal,
-  type AgentSessionWireRefusalCode
+  agentSessionRefusalFromReference,
+  readAgentSessionRefusalReference,
+  refuse,
+  type AgentSessionRefusalReference,
+  type AgentSessionWireRefusal
 } from '../../../shared/agent-session-wire'
 
 export type AgentSessionReplayOutcomeDecision<TValue> =
@@ -23,15 +25,12 @@ export function resolveAgentSessionReplayOutcome<TValue>(input: {
     if (outcome.rewindReason) {
       return { decision: 'refuse', refusal: rewindRefusal(outcome.rewindReason).refusal }
     }
-    const code = (AGENT_SESSION_WIRE_REFUSAL_CODES as readonly string[]).includes(outcome.code)
-      ? (outcome.code as AgentSessionWireRefusalCode)
-      : 'agent_session_operation_invalid'
     return {
       decision: 'refuse',
-      refusal: {
-        code,
-        message: outcome.message ?? `Operation ${operationId} was already refused: ${outcome.code}.`
-      }
+      refusal: agentSessionRefusalFromReference(
+        recordedRefusal(outcome.code, outcome.details),
+        outcome.message ?? `Operation ${operationId} was already refused: ${outcome.code}.`
+      )
     }
   }
   if (outcome.status === 'unknown') {
@@ -44,10 +43,11 @@ export function resolveAgentSessionReplayOutcome<TValue>(input: {
     }
     return {
       decision: 'refuse',
-      refusal: {
-        code: 'agent_session_operation_unknown',
-        message: `The outcome of operation ${operationId} is unknown; it was not run again.`
-      }
+      refusal: refuse(
+        'agent_session_operation_unknown',
+        { reason: 'outcomeUnknown' },
+        `The outcome of operation ${operationId} is unknown; it was not run again.`
+      )
     }
   }
   const recorded = input.reconstruct()
@@ -60,10 +60,22 @@ export function resolveAgentSessionReplayOutcome<TValue>(input: {
   return outcome.status === 'succeeded'
     ? {
         decision: 'refuse',
-        refusal: {
-          code: 'agent_session_operation_unknown',
-          message: `Operation ${operationId} succeeded, but its result is no longer reconstructable.`
-        }
+        refusal: refuse(
+          'agent_session_operation_unknown',
+          { reason: 'resultLost' },
+          `Operation ${operationId} succeeded, but its result is no longer reconstructable.`
+        )
       }
     : { decision: 'rerun' }
 }
+
+/** The refusal a failed row recorded, so a replay says what the first answer said. A code this
+ *  build does not know was refused for a reason it cannot name. */
+function recordedRefusal(code: string, details: unknown): AgentSessionRefusalReference {
+  return (
+    readAgentSessionRefusalReference({ code, details }) ?? {
+      code: 'agent_session_operation_invalid',
+      details: { reason: 'operationRefusedEarlier' }
+    }
+  )
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-resolved-append.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-resolved-append.test.ts
index 005986adb44..d3c15de933c 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-resolved-append.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-resolved-append.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { describe, expect, it, vi } from 'vitest'
 import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
 import type {
@@ -63,7 +64,11 @@ describe('resolved revisions', () => {
     const deferred = createDeferredStructuredAgentSessionEventSink()
     const bytes = estimateStructuredAgentSessionItemBytes(ROW, text('abc'))
     for (const suffix of ['a', 'b', 'c']) {
-      expect(deferred.sink.tryReviseResolvedItem?.(bytes, appendSuffix(suffix))).toEqual({
+      expect(
+        deferred.sink.tryReviseResolvedItem?.(bytes, appendSuffix(suffix), {
+          turnScope: AGENT_JOURNAL_THREAD_SCOPE
+        })
+      ).toEqual({
         accepted: true
       })
     }
@@ -77,7 +82,9 @@ describe('resolved revisions', () => {
   it('skips a revision that resolves to nothing', async () => {
     const rows = new Map<string, AgentJournalItemBody>()
     const deferred = createDeferredStructuredAgentSessionEventSink()
-    deferred.sink.tryReviseResolvedItem?.(1_000, () => null)
+    deferred.sink.tryReviseResolvedItem?.(1_000, () => null, {
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     const target = journalTarget(rows)
     deferred.bind(target)
     await expect(deferred.drained()).resolves.toEqual({ ok: true })
@@ -88,8 +95,12 @@ describe('resolved revisions', () => {
     const rows = new Map<string, AgentJournalItemBody>()
     const deferred = createDeferredStructuredAgentSessionEventSink()
     const bytes = estimateStructuredAgentSessionItemBytes(ROW, text('a'))
-    deferred.sink.tryReviseResolvedItemAndPublish?.(bytes, appendSuffix('a'))
-    deferred.sink.tryReviseResolvedItemAndPublish?.(bytes, () => null)
+    deferred.sink.tryReviseResolvedItemAndPublish?.(bytes, appendSuffix('a'), {
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
+    deferred.sink.tryReviseResolvedItemAndPublish?.(bytes, () => null, {
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
     const target = journalTarget(rows)
     const published: string[] = []
     vi.mocked(target.publish).mockImplementation(() =>
@@ -105,10 +116,14 @@ describe('resolved revisions', () => {
     const rows = new Map<string, AgentJournalItemBody>()
     const deferred = createDeferredStructuredAgentSessionEventSink()
     const bytes = estimateStructuredAgentSessionItemBytes(ROW, text('a'))
-    deferred.sink.tryReviseResolvedItem?.(bytes, () => ({
-      identity: ROW,
-      body: text('a'.repeat(64))
-    }))
+    deferred.sink.tryReviseResolvedItem?.(
+      bytes,
+      () => ({
+        identity: ROW,
+        body: text('a'.repeat(64))
+      }),
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
     deferred.bind(journalTarget(rows))
     await expect(deferred.drained()).resolves.toMatchObject({ ok: false })
     expect(rows.size).toBe(0)
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-resolved-append.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-resolved-append.ts
index de1190aefc1..eb2fbea97fb 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-resolved-append.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-resolved-append.ts
@@ -4,7 +4,7 @@ import type {
 } from '../../../shared/agent-session-journal-types'
 import { estimateStructuredAgentSessionItemBytes } from './structured-agent-session-event-sink-estimate'
 import type {
-  StructuredAgentSessionAppendOptions,
+  StructuredAgentSessionItemAppendOptions,
   StructuredAgentSessionEventSink,
   StructuredAgentSessionRevisionJournal
 } from './structured-agent-session-event-sink'
@@ -30,7 +30,7 @@ export function createStructuredAgentSessionResolvedAppend(
   const submit = (
     reservedBytes: number,
     resolve: (journal: StructuredAgentSessionRevisionJournal) => ResolvedItem | null,
-    options: StructuredAgentSessionAppendOptions,
+    options: Omit<StructuredAgentSessionItemAppendOptions, 'coalescingKey'>,
     publish: boolean
   ) =>
     queue.submit(
@@ -58,7 +58,7 @@ export function createStructuredAgentSessionResolvedAppend(
       options
     )
   const identityOnly = (publish: boolean) =>
-    ((identitySizeBound, body, resolveIdentity, options = {}) =>
+    ((identitySizeBound, body, resolveIdentity, options) =>
       submit(
         estimateStructuredAgentSessionItemBytes(identitySizeBound, body) + (publish ? 1 : 0),
         (journal) => {
@@ -71,11 +71,11 @@ export function createStructuredAgentSessionResolvedAppend(
   return {
     tryAppendResolvedItem: identityOnly(false),
     tryAppendResolvedItemAndPublish: identityOnly(true),
-    tryReviseResolvedItem: (reservedBytes, resolve, options = {}) =>
+    tryReviseResolvedItem: (reservedBytes, resolve, options) =>
       submit(reservedBytes, resolve, options, false),
-    tryReviseResolvedItemAndPublish: (reservedBytes, resolve, options = {}) =>
+    tryReviseResolvedItemAndPublish: (reservedBytes, resolve, options) =>
       submit(reservedBytes + 1, resolve, options, true),
-    tryAppendLifecycleTransition: (identitySizeBound, body, resolveIdentity, options = {}) => {
+    tryAppendLifecycleTransition: (identitySizeBound, body, resolveIdentity, options) => {
       const bytes = estimateStructuredAgentSessionItemBytes(identitySizeBound, body)
       return queue.submit(
         {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-rest-test-rig.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-rest-test-rig.ts
new file mode 100644
index 00000000000..3ea116fa361
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-rest-test-rig.ts
@@ -0,0 +1,224 @@
+// A real host over a real store and journal, with a scripted provider and a clock the test moves,
+// for the tests of a conversation that outlives its agent. The idle sweep runs on its own short
+// interval; a test moves `clock.now` past the idle window and waits for the outcome.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { expect, vi, type Mock } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
+import type {
+  AgentSessionMutationEnvelope,
+  AgentSessionStatusEvent,
+  AgentSessionSubscribeEvent
+} from '../../../shared/agent-session-wire'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type {
+  AgentSessionDispatchOutcome,
+  StructuredAgentSessionAdapter
+} from './structured-agent-session-adapter'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
+import {
+  HOST_TEST_NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+import { STRUCTURED_AGENT_SESSION_IDLE_MS } from './structured-agent-session-idle-sweep'
+
+export const REST_TEST_CALLER = { callerKey: 'client-1' }
+export const IDLE_MS = STRUCTURED_AGENT_SESSION_IDLE_MS
+export const SWEEP_INTERVAL_MS = 5
+
+export type RestTestAdapter = {
+  acquire: Mock<StructuredAgentSessionAdapter['acquire']>
+  closeSession: Mock<NonNullable<StructuredAgentSessionAdapter['closeSession']>>
+  dispatch: Mock<StructuredAgentSessionAdapter['dispatch']>
+  acknowledgeSessionRelease: Mock<
+    NonNullable<StructuredAgentSessionAdapter['acknowledgeSessionRelease']>
+  >
+  backgroundTaskState: Mock<NonNullable<StructuredAgentSessionAdapter['backgroundTaskState']>>
+  readOptions: Mock<NonNullable<StructuredAgentSessionAdapter['readOptions']>>
+}
+
+export type RestTestRig = {
+  root: string
+  store: AgentSessionRecordStore
+  host: StructuredAgentSessionHost
+  adapter: RestTestAdapter
+  clock: { now: number }
+  statusEvents: AgentSessionStatusEvent[]
+  sink: { publish: Mock; forget: Mock }
+  /** Opens a fresh host over the same store and journals: what a restart leaves behind. */
+  restart: (deps?: Partial<StructuredAgentSessionHostDeps>) => Promise<StructuredAgentSessionHost>
+  dispose: () => Promise<void>
+}
+
+let ordinal = 0
+let generations = 0
+
+export function acceptedDispatch(): AgentSessionDispatchOutcome {
+  ordinal += 1
+  return {
+    state: 'accepted',
+    providerIdentity: { provider: 'codex', threadId: THREAD, turnId: `turn-${ordinal}`, ordinal }
+  }
+}
+
+export function restTestSend(
+  text: string,
+  fence = 1
+): { envelope: AgentSessionMutationEnvelope; body: AgentJournalMessageItem } {
+  const body = hostTestMessage(text)
+  return {
+    body,
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: fence,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    }
+  }
+}
+
+/** Every item and submission a reader was sent, whatever frame carried it. */
+export function readerSaw(events: readonly AgentSessionSubscribeEvent[]) {
+  const items = events.flatMap((event) =>
+    event.type === 'batch' ? event.batch.items : event.type === 'end' ? [] : event.page.items
+  )
+  const submissions = events.flatMap((event) =>
+    event.type === 'batch' ? event.batch.submissions : []
+  )
+  return {
+    texts: items.flatMap((item) =>
+      item.body.kind === 'message'
+        ? item.body.blocks.flatMap((block) => (block.type === 'text' ? [block.text] : []))
+        : []
+    ),
+    submissions
+  }
+}
+
+export function collectSubscriber(): {
+  events: AgentSessionSubscribeEvent[]
+  emit: (event: AgentSessionSubscribeEvent) => void
+} {
+  const events: AgentSessionSubscribeEvent[] = []
+  return { events, emit: (event) => events.push(event) }
+}
+
+export async function createRestTestRig(
+  deps: Partial<StructuredAgentSessionHostDeps> = {}
+): Promise<RestTestRig> {
+  resetHostTestOperationIds()
+  ordinal = 0
+  const root = await mkdtemp(join(tmpdir(), 'orca-rest-'))
+  const clock = { now: HOST_TEST_NOW }
+  const statusEvents: AgentSessionStatusEvent[] = []
+  const sink = { publish: vi.fn(), forget: vi.fn() }
+  let store = await AgentSessionRecordStore.open({
+    directory: join(root, 'store'),
+    hostId: 'local'
+  })
+  const adapter: RestTestAdapter = {
+    acquire: vi.fn(async ({ fence, spawnToken }) => ({
+      acquisitionGeneration: `generation-${++generations}`,
+      process: { hostId: 'local', pid: 4242, processStartTimeMs: 1_700_000_000_000, spawnToken },
+      link: {
+        linkId: `link-${fence}`,
+        handle: { provider: 'codex' as const, threadId: THREAD },
+        origin: store.getRecord(SESSION)?.providerHandleChain.length
+          ? ('resumed' as const)
+          : ('created' as const),
+        mintedAtFence: fence,
+        observedAt: clock.now
+      }
+    })),
+    closeSession: vi.fn(async () => true),
+    dispatch: vi.fn(async () => acceptedDispatch()),
+    acknowledgeSessionRelease: vi.fn(),
+    backgroundTaskState: vi.fn(() => undefined),
+    readOptions: vi.fn(async () => ({ models: [], current: { model: 'gpt-live' } }))
+  }
+  const hostFor = (overrides: Partial<StructuredAgentSessionHostDeps>) =>
+    new StructuredAgentSessionHost({
+      store,
+      adapter: {
+        ...adapter,
+        releaseAcquisition: vi.fn(async () => true),
+        cancelTurn: async () => ({ cancelled: true }),
+        answerPrompt: async ({ commit }) => commit(),
+        setOption: async () => undefined
+      },
+      journalRoot: root,
+      claimKeyId: 'key-1',
+      mintSpawnToken: () => 'spawn-a',
+      probeOwner: async () => ({ outcome: 'pid-absent' }),
+      now: () => clock.now,
+      statusSink: sink,
+      idleSweep: { intervalMs: SWEEP_INTERVAL_MS },
+      ...deps,
+      ...overrides
+    })
+  const rig: RestTestRig = {
+    root,
+    store,
+    host: hostFor({}),
+    adapter,
+    clock,
+    statusEvents,
+    sink,
+    restart: async (overrides = {}) => {
+      await rig.host.flushAllStreamedEvents().catch(() => undefined)
+      store = await AgentSessionRecordStore.open({
+        directory: join(root, 'store'),
+        hostId: 'local'
+      })
+      rig.store = store
+      rig.host = hostFor(overrides)
+      rig.host.subscribeStatus({ id: 'status', emit: (event) => statusEvents.push(event) })
+      return rig.host
+    },
+    dispose: async () => {
+      await rig.host.flushAllStreamedEvents().catch(() => undefined)
+      await rm(root, { recursive: true, force: true })
+    }
+  }
+  rig.host.subscribeStatus({ id: 'status', emit: (event) => statusEvents.push(event) })
+  return rig
+}
+
+/** Creates the chat, lists its tab, and sends one message so its journal is on disk. */
+export async function foundRestTestChat(rig: RestTestRig): Promise<void> {
+  const attached = await rig.host.attach(REST_TEST_CALLER, hostTestAttachParams(null))
+  if (!attached.ok) {
+    throw new Error(`attach refused: ${attached.refusal.code}`)
+  }
+  await rig.store.setSessionTabVisibility(SESSION, true)
+  const sent = await rig.host.send(REST_TEST_CALLER, restTestSend('hello', attached.fence))
+  if (!sent.ok) {
+    throw new Error(`send refused: ${sent.refusal.code}`)
+  }
+  await vi.waitFor(() => expect(rig.adapter.dispatch).toHaveBeenCalled())
+}
+
+/** Runs one sweep pass now, for a test that set `idleSweep.intervalMs` out of reach. */
+export function sweepOnce(host: StructuredAgentSessionHost): Promise<void> {
+  return host.collaboratorsForTests().lifetime.idleSweep.tick()
+}
+
+/** Waits long enough for several sweep ticks to have run. */
+export function sweepTicks(count = 6): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, SWEEP_INTERVAL_MS * count))
+}
+
+export { SESSION as REST_TEST_SESSION, THREAD as REST_TEST_THREAD }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-candidates.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-candidates.ts
index 46879aefe49..b16f76c1633 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-candidates.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-candidates.ts
@@ -2,16 +2,11 @@
 //
 // A different question from storage: the durable record decides which markers are still present;
 // this decides which of those a resume may act on. The offer, the click and the pre-send check all
-// ask it, and all get the same answer: the marker stands until the user sends a newer message.
+// ask it, and all get the same answer.
 
-import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
-import type { AgentJournalRenderItem } from '../../../shared/agent-session-journal-types'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 import type { AgentSessionResumeMarker } from '../../../shared/agent-session-resume-marker'
-import {
-  latestStructuredAgentSessionPrompt,
-  latestStructuredAgentSessionUserItem
-} from '../../../shared/structured-agent-session-projection'
+import { latestStructuredAgentSessionPrompt } from '../../../shared/structured-agent-session-latest-request'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { adapterSupportsRecord } from './structured-agent-session-provider-support'
@@ -23,61 +18,29 @@ import {
 /** The only part of a live session this reads. */
 export type StructuredAgentSessionRestartJournalSource = { journal: AgentSessionJournal }
 
-export type StructuredAgentSessionRestartCandidateOptions = {
-  /** A continuation already in flight; its own submission is not newer user work. */
-  pendingContinuationId?: string
-}
-
 export type StructuredAgentSessionRestartCandidateReader = (
   markers: readonly AgentSessionResumeMarker[],
-  leaseState: 'must-be-released' | 'may-be-held',
-  options?: StructuredAgentSessionRestartCandidateOptions
+  leaseState: 'must-be-released' | 'may-be-held'
 ) => StructuredAgentSessionResumableSet
 
-/** The newest user message in a live session's journal, the same fact the predicate compares
- *  against a marker. Undefined when the session is not readable here, which decides nothing. */
-export function liveStructuredAgentSessionLatestUserItemId(
-  sessions: ReadonlyMap<string, StructuredAgentSessionRestartJournalSource>,
-  sessionId: string
-): string | null | undefined {
-  const session = sessions.get(sessionId)
-  return session
-    ? (latestStructuredAgentSessionUserItem(session.journal.snapshot().items)?.itemId ?? null)
-    : undefined
-}
-
 export function createStructuredAgentSessionRestartCandidateReader(deps: {
   /** The host's live session map; a marker's chat is readable once listing has revealed it. */
   sessions: ReadonlyMap<string, StructuredAgentSessionRestartJournalSource>
   getRecord: (sessionId: string) => AgentSessionRecord | null
   adapter: StructuredAgentSessionAdapter
+  /** Whether the chat moved on since the offer was taken; see the offer withdrawal. */
+  movedOn: (marker: AgentSessionResumeMarker) => boolean
 }): StructuredAgentSessionRestartCandidateReader {
-  return (markers, leaseState, options = {}) => {
-    const items = new Map<string, AgentJournalRenderItem[] | undefined>()
-    const itemsFor = (sessionId: string): AgentJournalRenderItem[] | undefined => {
-      if (items.has(sessionId)) {
-        return items.get(sessionId)
-      }
-      let snapshot = deps.sessions.get(sessionId)?.journal.snapshot().items
-      if (snapshot && options.pendingContinuationId) {
-        const ownItemId = agentJournalSubmissionKey(options.pendingContinuationId)
-        snapshot = snapshot.filter((item) => item.itemId !== ownItemId)
-      }
-      items.set(sessionId, snapshot)
-      return snapshot
-    }
-    return structuredAgentSessionResumableSet({
+  return (markers, leaseState) =>
+    structuredAgentSessionResumableSet({
       markers,
       getRecord: deps.getRecord,
       supportsRecord: (record) => adapterSupportsRecord(deps.adapter, record),
-      latestPrompt: (sessionId) => latestStructuredAgentSessionPrompt(itemsFor(sessionId) ?? []),
-      latestUserItemId: (sessionId) => {
-        const snapshot = itemsFor(sessionId)
-        return snapshot === undefined
-          ? undefined
-          : (latestStructuredAgentSessionUserItem(snapshot)?.itemId ?? null)
-      },
+      movedOn: deps.movedOn,
+      latestPrompt: (sessionId) =>
+        latestStructuredAgentSessionPrompt(
+          deps.sessions.get(sessionId)?.journal.snapshot().items ?? []
+        ),
       leaseState
     })
-  }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-cap.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-cap.test.ts
new file mode 100644
index 00000000000..9ded5b54d98
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-cap.test.ts
@@ -0,0 +1,86 @@
+// "Resume all" starts agents a few at a time. A continuation is a send, so a chat counts as started
+// once its agent took the message or its start failed — not when the message was accepted, which
+// is instant and would let every agent start at once.
+
+import { expect, it, vi } from 'vitest'
+import {
+  startStructuredAgentSessionContinuation,
+  type StructuredAgentSessionContinuationDeps
+} from './structured-agent-session-restart-continuation'
+import {
+  resumeStructuredAgentSessionsFromRestart,
+  STRUCTURED_AGENT_SESSION_RESUME_CONCURRENCY,
+  StructuredAgentSessionResumeAdmission
+} from './structured-agent-session-restart-resume-runner'
+import { marker } from './structured-agent-session-restart-resume-test-harness'
+
+type Handover = { dispatchState: string; reason?: string | null } | undefined
+
+it('holds each slot from accept until handover or rejection, and frees it when the wait ends (P2-27)', async () => {
+  const handovers = new Map<string, PromiseWithResolvers<Handover>>()
+  let waiting = 0
+  let mostWaiting = 0
+  const deps = (sessionId: string): StructuredAgentSessionContinuationDeps => ({
+    currentFence: () => 1,
+    send: vi.fn(async () => ({ ok: true, value: { submission: { dispatchState: 'pending' } } })),
+    awaitHandedOver: async () => {
+      const handover = Promise.withResolvers<Handover>()
+      handovers.set(sessionId, handover)
+      waiting += 1
+      mostWaiting = Math.max(mostWaiting, waiting)
+      try {
+        return await handover.promise
+      } finally {
+        waiting -= 1
+      }
+    },
+    awaitSettlement: async () => ({ dispatchState: 'accepted' }),
+    note: async () => undefined,
+    onNoteFailed: () => undefined
+  })
+  const sessions = Array.from({ length: 8 }, (_, index) => `session-${index}`)
+  const outcomes = resumeStructuredAgentSessionsFromRestart(
+    {
+      admission: new StructuredAgentSessionResumeAdmission(),
+      consumeMarker: async () => true,
+      resume: async (sessionId) => {
+        const started = await startStructuredAgentSessionContinuation(
+          deps(sessionId),
+          sessionId,
+          marker(),
+          'operation-1'
+        )
+        if ('done' in started && started.done.outcome === 'refused') {
+          throw new Error(started.done.reason ?? 'refused')
+        }
+      }
+    },
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the runner reads only each candidate's session id.
+    sessions.map((sessionId) => ({ sessionId }) as never),
+    'modal'
+  )
+  const settle = async (sessionId: string, handover: Handover) => {
+    await vi.waitFor(() => expect(handovers.has(sessionId)).toBe(true))
+    handovers.get(sessionId)!.resolve(handover)
+  }
+
+  await vi.waitFor(() => expect(waiting).toBe(STRUCTURED_AGENT_SESSION_RESUME_CONCURRENCY))
+  // Accepted but not yet handed over: a slow start keeps its slot.
+  await new Promise((resolve) => setTimeout(resolve, 20))
+  expect(handovers.size).toBe(STRUCTURED_AGENT_SESSION_RESUME_CONCURRENCY)
+  await settle('session-0', { dispatchState: 'pending' })
+  await settle('session-1', { dispatchState: 'rejected', reason: 'Codex could not start.' })
+  // The session closed, or too many waited: the wait proves nothing, and the slot is freed.
+  await settle('session-2', undefined)
+  for (const sessionId of sessions.slice(3)) {
+    await settle(sessionId, { dispatchState: 'pending' })
+  }
+
+  const results = await outcomes
+  expect(mostWaiting).toBe(STRUCTURED_AGENT_SESSION_RESUME_CONCURRENCY)
+  expect(results.find((result) => result.sessionId === 'session-1')).toMatchObject({
+    outcome: 'refused',
+    reason: 'Codex could not start.'
+  })
+  expect(results.filter((result) => result.outcome === 'resumed')).toHaveLength(7)
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-child-work.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-child-work.test.ts
index 63c778144ee..6d8514c830e 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-child-work.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-child-work.test.ts
@@ -2,10 +2,7 @@
 
 import { expect, it, vi } from 'vitest'
 import { interruptedRestart } from './structured-agent-session-restart-interruption-test-harness'
-import {
-  HOST_TEST_SESSION as SESSION,
-  HOST_TEST_THREAD as THREAD
-} from './structured-agent-session-host-test-data'
+import { HOST_TEST_SESSION as SESSION } from './structured-agent-session-host-test-data'
 
 // What the user hit: the lead had finished, its subagent had not. The offer names the subagent
 // from the roster snapshot taken BEFORE the child stopped — the close that follows settles the
@@ -21,65 +18,22 @@ it('offers a chat whose subagent the restart stopped, named from the stop-time s
   ])
 })
 
-// On resume the provider restates what it lost in its own words, rewriting the row before the
-// continuation is dispatched. What the offer was admitted for still stands.
-it('continues a stopped subagent after the provider restates its row', async () => {
-  const { host, acquire, dispatch } = await interruptedRestart('children')
-  await host.hold(SESSION, 'pane')
-  const events = acquire.mock.calls[0]?.[0].events
-  if (!events) {
-    throw new Error('missing resumed provider event sink')
-  }
-  const admit = vi.spyOn(host.deps.store, 'admitMutationOperation')
-  admit.mockImplementationOnce(async (input) => {
-    events.appendItem(
-      { provider: 'codex', threadId: THREAD, turnId: 'settled-turn', ordinal: 2 },
-      {
-        kind: 'message',
-        role: 'system',
-        blocks: [
-          {
-            type: 'subagent-group',
-            groupId: 'settled-turn',
-            agents: [{ id: 'child-1', label: 'Review loop 4', state: 'completed' }]
-          }
-        ]
-      }
-    )
-    await host.flushStreamedEvents(SESSION)
-    admit.mockRestore()
-    return host.deps.store.admitMutationOperation(input)
-  })
+// The offer was admitted for the subagent's work; the continuation asks the agent to carry it on.
+it('continues a chat whose subagent the restart stopped', async () => {
+  const { host, dispatch } = await interruptedRestart('children')
   expect(
     (await host.restartResume.continueAfterRestart([SESSION], 'modal')).continued
   ).toMatchObject([{ outcome: 'continued' }])
   expect(dispatch).toHaveBeenCalledTimes(1)
-  host.release(SESSION, 'pane')
 })
 
-// The user opens the chat before choosing Resume, and the reattached provider restates its row.
+// The user opens the chat before choosing Resume: reading it starts nothing, so the offer stands.
 it('still offers and continues a chat the user opened before resuming', async () => {
   const { host, acquire, dispatch } = await interruptedRestart('children')
-  await host.hold(SESSION, 'pane')
-  const events = acquire.mock.calls[0]?.[0].events
-  if (!events) {
-    throw new Error('missing resumed provider event sink')
-  }
-  events.appendItem(
-    { provider: 'codex', threadId: THREAD, turnId: 'settled-turn', ordinal: 2 },
-    {
-      kind: 'message',
-      role: 'system',
-      blocks: [
-        {
-          type: 'subagent-group',
-          groupId: 'settled-turn',
-          agents: [{ id: 'child-1', label: 'Review loop 4', state: 'completed' }]
-        }
-      ]
-    }
-  )
-  await host.flushStreamedEvents(SESSION)
+  const unsubscribe = await host.subscribe({ id: 'pane', sessionId: SESSION, emit: vi.fn() })
+  await host.history({ sessionId: SESSION, direction: 'tail' })
+  unsubscribe()
+  expect(acquire).not.toHaveBeenCalled()
   expect(await host.restartResume.list()).toMatchObject([
     { sessionId: SESSION, activity: { tasks: [{ kind: 'agent', label: 'Review loop 4' }] } }
   ])
@@ -87,5 +41,4 @@ it('still offers and continues a chat the user opened before resuming', async ()
     (await host.restartResume.continueAfterRestart([SESSION], 'modal')).continued
   ).toMatchObject([{ outcome: 'continued' }])
   expect(dispatch).toHaveBeenCalledTimes(1)
-  host.release(SESSION, 'pane')
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation-envelope.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation-envelope.ts
new file mode 100644
index 00000000000..cfa2c7b502e
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation-envelope.ts
@@ -0,0 +1,77 @@
+// The restart continuation as a message: its body, which depends on the marker alone, and its
+// identity, which is one per resume action.
+
+import { createHash } from 'node:crypto'
+import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import { restartContinuationMessage } from '../../../shared/agent-session-restart-continuation'
+import type { AgentSessionResumeMarker } from '../../../shared/agent-session-resume-marker'
+import type { AgentSessionMutationEnvelope } from '../../../shared/agent-session-wire'
+
+/** The message body, built once so both the send and any test read the same text. */
+export function restartContinuationBody(marker: AgentSessionResumeMarker): AgentJournalMessageItem {
+  return {
+    kind: 'message',
+    role: 'user',
+    blocks: [{ type: 'text', text: restartContinuationMessage(marker) }]
+  }
+}
+
+const hex16 = (parts: readonly unknown[]): string =>
+  createHash('sha256').update(JSON.stringify(parts)).digest('hex').slice(0, 16)
+
+/** Names the offer: every continuation any of its actions sends carries it, and nothing else does. */
+function restartOfferTag(marker: AgentSessionResumeMarker): string {
+  return hex16([marker.teardownId, marker.sessionId])
+}
+
+/** One resume action's continuation: the offer's tag, then the action's own part, so a retry is a
+ *  new message, never a replay of the one that failed. Dated by the action, not the quit: the
+ *  ledger refuses a new id dated more than a day back, and an offer has no expiry. */
+export function restartContinuationId(
+  marker: AgentSessionResumeMarker,
+  operationId: string,
+  actionAt: number
+): string {
+  return `${Math.trunc(actionAt).toString().padStart(13, '0')}-${restartOfferTag(marker)}${hex16([
+    marker.teardownId,
+    marker.sessionId,
+    marker.work.kind,
+    marker.work.id,
+    marker.providerHandleRoot,
+    operationId
+  ])}`
+}
+
+/** Whether a message is a continuation one of this offer's resume actions sent, read off its id. */
+export function isRestartContinuationOf(
+  marker: AgentSessionResumeMarker,
+  clientMessageId: string
+): boolean {
+  return /^\d{13}-[0-9a-f]{32}$/.test(clientMessageId)
+    ? clientMessageId.slice(14, 30) === restartOfferTag(marker)
+    : false
+}
+
+/** The fence only fills the envelope: admission names this send by its operation id, not a fence. */
+export function restartContinuationEnvelope(
+  sessionId: string,
+  fence: number,
+  marker: AgentSessionResumeMarker,
+  continuationId: string
+): { envelope: AgentSessionMutationEnvelope; body: AgentJournalMessageItem } {
+  const body = restartContinuationBody(marker)
+  return {
+    body,
+    envelope: {
+      sessionId,
+      clientOperationId: continuationId,
+      expectedRuntimeFence: fence,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId,
+        fields: { body }
+      })
+    }
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation-wait.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation-wait.test.ts
new file mode 100644
index 00000000000..4dff44ff2ab
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation-wait.test.ts
@@ -0,0 +1,113 @@
+// The restart continuation is accepted like any send, so its verdict is its delivery: a cold start
+// longer than the legacy client wait must not turn a continuation that went through into an
+// "unconfirmed" one.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
+import { structuredAgentSessionRestartResumeSurfaces } from './structured-agent-session-restart-resume-wiring'
+import { StructuredAgentSessionSendSettlement } from './structured-agent-session-send-settlement'
+
+const SESSION = 'session-1'
+const MESSAGE = 'continuation-1'
+
+let submission: AgentJournalSubmission
+const journal = {
+  submissions: (): AgentJournalSubmission[] => [submission],
+  cursor: () => ({ epoch: 'epoch-1', sequence: 1 }),
+  activeTurnId: () => null
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  submission = {
+    clientMessageId: MESSAGE,
+    fence: 2,
+    payloadFingerprint: 'fingerprint',
+    dispatchState: 'pending',
+    providerItemId: null,
+    reason: null,
+    submittedAt: 1,
+    resolvedAt: null,
+    handoverRecorded: true
+  }
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('the restart continuation waits for its delivery (W18)', () => {
+  it('reaches accepted after a 40 s cold start, with nothing filed as unconfirmed', async () => {
+    const settlement = new StructuredAgentSessionSendSettlement(() => journal)
+    const surfaces = structuredAgentSessionRestartResumeSurfaces(
+      {
+        revealSession: async () => ({ readable: true }),
+        send: async () => {
+          throw new Error('not used')
+        },
+        waitForSendSettlement: settlement.wait
+      },
+      () => 0
+    )
+
+    const verdict = surfaces.awaitSendSettlement(SESSION, MESSAGE)
+    await vi.advanceTimersByTimeAsync(40_000)
+    submission = { ...submission, dispatchState: 'accepted', providerItemId: 'item-1' }
+    settlement.publish(SESSION, journal)
+
+    await expect(verdict).resolves.toMatchObject({
+      value: { submission: { dispatchState: 'accepted' } }
+    })
+  })
+})
+
+describe('a restart batch holds a chat until its continuation is handed over', () => {
+  function surfacesOver(settlement: StructuredAgentSessionSendSettlement) {
+    return structuredAgentSessionRestartResumeSurfaces(
+      {
+        revealSession: async () => ({ readable: true }),
+        send: async () => {
+          throw new Error('not used')
+        },
+        waitForSendSettlement: settlement.wait
+      },
+      () => 0
+    )
+  }
+
+  it('keeps waiting through a slow start and resolves once the agent takes the message', async () => {
+    const settlement = new StructuredAgentSessionSendSettlement(() => journal)
+    let released = false
+    const handedOver = surfacesOver(settlement)
+      .awaitSendHandedOver(SESSION, MESSAGE)
+      .then((result) => {
+        released = true
+        return result
+      })
+    await vi.advanceTimersByTimeAsync(5 * 60_000)
+    expect(released).toBe(false)
+    // Handed over: still pending at the provider, no longer queued.
+    submission = { ...submission, handedOverAt: 2 }
+    settlement.publish(SESSION, journal)
+    await expect(handedOver).resolves.toMatchObject({
+      value: { submission: { dispatchState: 'pending', handedOverAt: 2 } }
+    })
+  })
+
+  it('resolves once the start fails and the message is rejected', async () => {
+    const settlement = new StructuredAgentSessionSendSettlement(() => journal)
+    const handedOver = surfacesOver(settlement).awaitSendHandedOver(SESSION, MESSAGE)
+    submission = { ...submission, dispatchState: 'rejected', reason: 'Codex could not start.' }
+    settlement.publish(SESSION, journal)
+    await expect(handedOver).resolves.toMatchObject({
+      value: { submission: { dispatchState: 'rejected' } }
+    })
+  })
+
+  it('resolves undefined when the session closes first', async () => {
+    const settlement = new StructuredAgentSessionSendSettlement(() => journal)
+    const handedOver = surfacesOver(settlement).awaitSendHandedOver(SESSION, MESSAGE)
+    settlement.closeSession(SESSION)
+    await expect(handedOver).resolves.toBeUndefined()
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.test.ts
index 2d558f8f028..0fe36994cd7 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.test.ts
@@ -6,13 +6,22 @@ import {
   AGENT_SESSION_RESTART_NOT_CONNECTED_NOTE
 } from '../../../shared/agent-session-restart-continuation'
 import {
-  continueStructuredAgentSessionAfterRestart,
   RestartContinuationSupersededError,
+  startStructuredAgentSessionContinuation,
   type StructuredAgentSessionContinuationDeps
 } from './structured-agent-session-restart-continuation'
 
+/** The whole continuation: handed over, then its verdict. */
+async function continueStructuredAgentSessionAfterRestart(
+  ...args: Parameters<typeof startStructuredAgentSessionContinuation>
+) {
+  const started = await startStructuredAgentSessionContinuation(...args)
+  return 'done' in started ? started.done : started.verdict()
+}
+
 function dependencies(
-  settledDispatch: 'accepted' | 'pending' | 'unknown' | 'rejected'
+  settledDispatch: 'accepted' | 'pending' | 'unknown' | 'rejected',
+  handedOver: 'pending' | 'rejected' | undefined = 'pending'
 ): StructuredAgentSessionContinuationDeps & {
   note: ReturnType<typeof vi.fn>
   send: ReturnType<typeof vi.fn>
@@ -27,6 +36,14 @@ function dependencies(
       dispatchState: settledDispatch,
       reason: settledDispatch === 'rejected' ? 'provider_refused' : null
     })),
+    awaitHandedOver: vi.fn(async () =>
+      handedOver
+        ? {
+            dispatchState: handedOver,
+            reason: handedOver === 'rejected' ? 'Codex could not start.' : null
+          }
+        : undefined
+    ),
     note: vi.fn(async () => undefined),
     onNoteFailed: vi.fn()
   }
@@ -36,7 +53,7 @@ it('reports an accepted continuation and records its note', async () => {
   const deps = dependencies('accepted')
 
   await expect(
-    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker())
+    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker(), 'operation-1')
   ).resolves.toEqual({
     sessionId: SESSION,
     outcome: 'continued'
@@ -58,20 +75,20 @@ it.each([
     const deps = dependencies(settled)
 
     await expect(
-      continueStructuredAgentSessionAfterRestart(deps, SESSION, marker())
+      continueStructuredAgentSessionAfterRestart(deps, SESSION, marker(), 'operation-1')
     ).resolves.toEqual(expected)
     expect(deps.note).toHaveBeenCalledExactlyOnceWith(...note)
   }
 )
 
-it('notes a superseded continuation in the chat and still reports the refusal', async () => {
+it("writes nothing in the chat when the user's own message came first, and still refuses", async () => {
   const deps = dependencies('accepted')
   deps.send.mockRejectedValue(new RestartContinuationSupersededError())
 
   await expect(
-    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker())
+    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker(), 'operation-1')
   ).rejects.toBeInstanceOf(RestartContinuationSupersededError)
-  expect(deps.note).toHaveBeenCalledExactlyOnceWith(...REFUSED)
+  expect(deps.note).not.toHaveBeenCalled()
 })
 
 // An ownership refusal would meet the user's own message too, so the note gives no advice to send one.
@@ -83,7 +100,7 @@ it.each([
   deps.send.mockResolvedValue({ ok: false, refusal: { code } })
 
   await expect(
-    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker())
+    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker(), 'operation-1')
   ).resolves.toEqual({
     sessionId: SESSION,
     outcome: 'refused',
@@ -98,7 +115,7 @@ it('reports an unattached chat without sending', async () => {
   deps.currentFence = () => null
 
   await expect(
-    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker())
+    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker(), 'operation-1')
   ).resolves.toEqual({
     sessionId: SESSION,
     outcome: 'refused',
@@ -106,3 +123,45 @@ it('reports an unattached chat without sending', async () => {
   })
   expect(deps.send).not.toHaveBeenCalled()
 })
+
+// A start that failed rejects the continuation before any provider saw it: that is the verdict.
+it('reports a continuation rejected at handover without waiting for the provider', async () => {
+  const deps = dependencies('accepted', 'rejected')
+
+  await expect(
+    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker(), 'operation-1')
+  ).resolves.toEqual({ sessionId: SESSION, outcome: 'refused', reason: 'Codex could not start.' })
+  expect(deps.awaitSettlement).not.toHaveBeenCalled()
+  expect(deps.note).toHaveBeenCalledExactlyOnceWith(...REFUSED)
+})
+
+// The start completes once the agent took the message; the provider's answer is a later verdict.
+it('returns at handover and leaves the provider verdict to be awaited', async () => {
+  const deps = dependencies('accepted')
+
+  const started = await startStructuredAgentSessionContinuation(
+    deps,
+    SESSION,
+    marker(),
+    'operation-1'
+  )
+
+  expect(deps.awaitHandedOver).toHaveBeenCalledOnce()
+  expect(deps.awaitSettlement).not.toHaveBeenCalled()
+  if (!('verdict' in started)) {
+    throw new Error('expected a handed-over continuation')
+  }
+  await expect(started.verdict()).resolves.toEqual({ sessionId: SESSION, outcome: 'continued' })
+  expect(deps.note).toHaveBeenCalledOnce()
+})
+
+// A handover wait that ends without an answer — the session closed, or too many waited — proves
+// nothing, so the provider's verdict still decides.
+it('still awaits the verdict when the handover wait ends unanswered', async () => {
+  const deps = dependencies('unknown', undefined)
+
+  await expect(
+    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker(), 'operation-1')
+  ).resolves.toEqual({ sessionId: SESSION, outcome: 'unknown' })
+  expect(deps.note).toHaveBeenCalledExactlyOnceWith(...UNCONFIRMED)
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.ts
index 58d104a651c..8038e90e1fc 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.ts
@@ -1,27 +1,35 @@
 // Asking an interrupted agent to carry on, on the user's opt-in.
 //
-// Reattaching and continuing are SEPARATE operations: `resume` reattaches and sends nothing; this
-// adds one message on top of it. Both the restart prompt and an opted-in launch come here, so a
-// SETTING can reach this send — acceptable because the work is the user's own, the message asks the
-// agent to verify its last action before repeating it, and the launch toast reports what happened.
+// The continuation is a send like any other: accepted into the conversation, and delivered by the
+// session's delivery loop, which starts the agent. Both the restart prompt and an opted-in launch
+// come here, so a SETTING can reach this send — acceptable because the work is the user's own, the
+// message asks the agent to verify its last action before repeating it, and the launch toast
+// reports what happened.
 
-import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
-import type {
-  AgentSessionMutationEnvelope,
-  AgentSessionMutationResult,
-  AgentSessionSendResult
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalMessageItem
+} from '../../../shared/agent-session-journal-types'
+import {
+  readAgentSessionFailureFact,
+  type UnreadAgentSessionFailureFact
+} from '../../../shared/agent-session-failure'
+import type { AgentSessionRefusalReference } from '../../../shared/agent-session-wire-refusals'
+import {
+  agentSessionSendSubmission,
+  type AgentSessionMutationEnvelope,
+  type AgentSessionMutationResult,
+  type AgentSessionSendResult
 } from '../../../shared/agent-session-wire'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
 import {
   AGENT_SESSION_RESTART_CONTINUATION_NOTE,
   AGENT_SESSION_RESTART_CONTINUATION_REFUSED_NOTE,
   AGENT_SESSION_RESTART_CONTINUATION_UNCONFIRMED_NOTE,
-  AGENT_SESSION_RESTART_NOT_CONNECTED_NOTE,
-  restartContinuationMessage
+  AGENT_SESSION_RESTART_NOT_CONNECTED_NOTE
 } from '../../../shared/agent-session-restart-continuation'
 import { AgentSessionPreDispatchError } from './structured-agent-session-operation-settlement'
-import { createHash } from 'node:crypto'
+import { restartContinuationEnvelope } from './structured-agent-session-restart-continuation-envelope'
 import type { AgentSessionResumeMarker } from '../../../shared/agent-session-resume-marker'
 
 /**
@@ -40,11 +48,16 @@ export type StructuredAgentSessionContinuationOutcome = {
   sessionId: string
   outcome: 'continued' | 'pending' | 'unknown' | 'refused'
   reason?: string
+  /** The refusal that kept the agent from starting; `reason` is then its code. */
+  refusal?: AgentSessionRefusalReference
 }
 
 /** The slice of the host one continuation needs. Structural so this module never imports the host. */
 export type StructuredAgentSessionContinuationHost = {
-  sessions: ReadonlyMap<string, { journal: AgentSessionJournal; fence: number }>
+  sessions: ReadonlyMap<string, { journal: AgentSessionJournal }>
+  /** The fence a conversation write carries; null when this host has no record of the session.
+   *  The send opens the conversation itself, so a closed one still answers. */
+  conversationFence: (sessionId: string) => number | null
   send: (input: {
     envelope: AgentSessionMutationEnvelope
     body: AgentJournalMessageItem
@@ -54,16 +67,15 @@ export type StructuredAgentSessionContinuationHost = {
     sessionId: string,
     clientMessageId: string
   ) => Promise<{ value: AgentSessionSendResult } | undefined>
+  awaitSendHandedOver: (
+    sessionId: string,
+    clientMessageId: string
+  ) => Promise<{ value: AgentSessionSendResult } | undefined>
   onNoteFailed: (sessionId: string, error: unknown) => void
-  publish: (sessionId: string, journal: AgentSessionJournal) => void
   now: () => number
-  /** Whether the marker is still an offer, with the continuation's own submission set aside.
-   *  Re-asked right before dispatch, so a newer user message refuses the send; a provider turn
-   *  running then does not, since both providers queue a message sent mid-turn. */
-  stillResumable: (
-    marker: AgentSessionResumeMarker,
-    options: { pendingContinuationId: string }
-  ) => boolean
+  /** Whether the marker is still an offer. Asked at acceptance, inside the session lock, so the
+   *  first message accepted since the restart decides: the user's, or this continuation. */
+  stillResumable: (marker: AgentSessionResumeMarker) => boolean
 }
 
 /** Binds one continuation to the host: the superseded check before dispatch, the settlement
@@ -73,54 +85,45 @@ export function restartContinuationDeps(
   marker: AgentSessionResumeMarker
 ): StructuredAgentSessionContinuationDeps {
   return {
-    currentFence: (sessionId) => host.sessions.get(sessionId)?.fence ?? null,
+    currentFence: host.conversationFence,
     send: (input) =>
       host.send({
         ...input,
         beforeRun: () => {
-          if (
-            !host.stillResumable(marker, {
-              pendingContinuationId: input.envelope.clientOperationId
-            })
-          ) {
+          if (!host.stillResumable(marker)) {
             throw new RestartContinuationSupersededError()
           }
         }
       }),
     awaitSettlement: async (sessionId, clientMessageId) =>
-      (await host.awaitSendSettlement(sessionId, clientMessageId))?.value.submission,
+      agentSessionSendSubmission(
+        (await host.awaitSendSettlement(sessionId, clientMessageId))?.value
+      ),
+    awaitHandedOver: async (sessionId, clientMessageId) =>
+      agentSessionSendSubmission(
+        (await host.awaitSendHandedOver(sessionId, clientMessageId))?.value
+      ),
     onNoteFailed: host.onNoteFailed,
     note: restartNoteWriter(host)
   }
 }
 
-/** The note for a reattach that failed before any continuation was attempted. */
-export function noteRestartReattachFailed(
-  host: StructuredAgentSessionContinuationHost,
-  sessionId: string
-): Promise<void> {
-  return noteNotContinued(
-    { note: restartNoteWriter(host), onNoteFailed: host.onNoteFailed },
-    sessionId,
-    'not-connected'
-  )
-}
-
-/** Writes a host-authored status note into the chat and publishes it to open panes. */
+/** Writes a host-authored status note into the chat. */
 function restartNoteWriter(
-  host: Pick<StructuredAgentSessionContinuationHost, 'sessions' | 'publish' | 'now'>
+  host: Pick<StructuredAgentSessionContinuationHost, 'sessions' | 'conversationFence' | 'now'>
 ): StructuredAgentSessionContinuationDeps['note'] {
   return async (sessionId, text, tone) => {
     const session = host.sessions.get(sessionId)
-    if (!session) {
+    const fence = host.conversationFence(sessionId)
+    if (!session || fence === null) {
       return
     }
     await session.journal.appendItem(
       { provider: 'orca', clientMessageId: `restart-continuation:${sessionId}:${host.now()}` },
       { kind: 'status', text, ...(tone ? { tone } : {}) },
-      { fence: session.fence }
+      // About the conversation, not any turn in it.
+      { fence, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
-    host.publish(sessionId, session.journal)
   }
 }
 
@@ -131,60 +134,25 @@ const OWNERSHIP_REFUSALS = new Set([
   'execution_owner_reconciling'
 ])
 
+/** The user's own message was accepted first; the offer is spent, and nothing failed. */
+export const RESTART_CONTINUATION_SUPERSEDED = 'agent_session_restart_work_superseded'
+
 /** Only this pre-dispatch failure proves a thrown send did not deliver. */
 export class RestartContinuationSupersededError extends AgentSessionPreDispatchError {
   constructor() {
-    super('agent_session_restart_work_superseded')
+    super(RESTART_CONTINUATION_SUPERSEDED)
     this.name = 'RestartContinuationSupersededError'
   }
 }
 
-/** The message body, built once so both the send and any test read the same text. */
-export function restartContinuationBody(marker: AgentSessionResumeMarker): AgentJournalMessageItem {
-  return {
-    kind: 'message',
-    role: 'user',
-    blocks: [{ type: 'text', text: restartContinuationMessage(marker) }]
-  }
-}
-
-/** The fence is read AFTER the reconnect: reattaching mints a new one, and the pre-reconnect value
- *  would be refused by the mutation admission. */
-export function restartContinuationEnvelope(
-  sessionId: string,
-  fence: number,
-  marker: AgentSessionResumeMarker
-): { envelope: AgentSessionMutationEnvelope; body: AgentJournalMessageItem } {
-  const body = restartContinuationBody(marker)
-  return {
-    body,
-    envelope: {
-      sessionId,
-      // The same interrupted work must reach the durable ledger with the same message identity.
-      clientOperationId: `${marker.recordedAt.toString().padStart(13, '0')}-${createHash('sha256')
-        .update(
-          JSON.stringify([
-            marker.teardownId,
-            sessionId,
-            marker.work.kind,
-            marker.work.id,
-            marker.providerHandleRoot
-          ])
-        )
-        .digest('hex')
-        .slice(0, 32)}`,
-      expectedRuntimeFence: fence,
-      payloadFingerprint: computeAgentSessionPayloadFingerprint({
-        method: 'agentSession.send',
-        sessionId,
-        fields: { body }
-      })
-    }
-  }
+type ContinuationSubmission = {
+  dispatchState?: string
+  reason?: string | null
+  rejection?: UnreadAgentSessionFailureFact
 }
 
 export type StructuredAgentSessionContinuationDeps = {
-  /** Runtime fence as it stands now; null when the session is not attached. */
+  /** Runtime fence as it stands now; null when this host has no record of the session. */
   currentFence: (sessionId: string) => number | null
   send: (input: {
     envelope: AgentSessionMutationEnvelope
@@ -192,8 +160,10 @@ export type StructuredAgentSessionContinuationDeps = {
   }) => Promise<{
     ok: boolean
     refusal?: { code: string }
-    /** The submission is where the provider's answer lives; the envelope only says Orca took it. */
-    value?: { submission?: { dispatchState?: string; reason?: string | null } }
+    /** The submission is where the provider's answer lives; the envelope only says Orca took it.
+     *  A continuation never sends `delivery`, so a queued answer cannot arrive; the key exists so
+     *  the host's union return stays assignable. */
+    value?: { submission?: { dispatchState?: string; reason?: string | null }; queued?: unknown }
   }>
   /**
    * Waits for that send's dispatch to stop being `pending`, through the host's existing settlement
@@ -205,7 +175,13 @@ export type StructuredAgentSessionContinuationDeps = {
   awaitSettlement: (
     sessionId: string,
     clientMessageId: string
-  ) => Promise<{ dispatchState?: string; reason?: string | null } | undefined>
+  ) => Promise<ContinuationSubmission | undefined>
+  /** Waits until the send is handed to a started agent or rejected. Undefined when the wait ended
+   *  first — the session closed, or too many waited — which proves neither. */
+  awaitHandedOver: (
+    sessionId: string,
+    clientMessageId: string
+  ) => Promise<ContinuationSubmission | undefined>
   /** Records a host-authored journal note: that this send was Orca's, not the user's, or that the
    *  chat did not carry on. `tone` is a display hint older clients render as plain text. */
   note: (sessionId: string, text: string, tone?: 'error' | 'warning') => Promise<void>
@@ -214,26 +190,61 @@ export type StructuredAgentSessionContinuationDeps = {
   onNoteFailed: (sessionId: string, error: unknown) => void
 }
 
+/** A continuation handed to its agent, or already decided. */
+export type StartedStructuredAgentSessionContinuation =
+  | { done: StructuredAgentSessionContinuationOutcome }
+  | { verdict: () => Promise<StructuredAgentSessionContinuationOutcome> }
+
 /**
- * Sends the continuation to ONE already-reconnected session.
- *
- * The caller must have reconnected it first: this deliberately does not reconnect, so that every
- * eligibility check, the admission gate and the consume-once ordering stay in the resume path and
- * are not re-implemented here.
+ * Sends the continuation to ONE session and returns once the agent has taken it or its start
+ * failed — the point a restart batch counts a start as done. What the provider then answered is
+ * the `verdict`, awaited separately so a slow answer does not hold the batch.
  */
-export async function continueStructuredAgentSessionAfterRestart(
+export async function startStructuredAgentSessionContinuation(
   deps: StructuredAgentSessionContinuationDeps,
   sessionId: string,
-  marker: AgentSessionResumeMarker
-): Promise<StructuredAgentSessionContinuationOutcome> {
-  let result: StructuredAgentSessionContinuationOutcome
+  marker: AgentSessionResumeMarker,
+  /** This action's continuation, as its offer recorded it. */
+  continuationId: string
+): Promise<StartedStructuredAgentSessionContinuation> {
+  let started: StartedStructuredAgentSessionContinuation
   try {
-    result = await sendContinuation(deps, sessionId, marker)
+    started = await sendContinuation(deps, sessionId, marker, continuationId)
   } catch (error) {
-    await noteNotContinued(deps, sessionId, 'refused')
+    // The user's own message came first: nothing failed, so the chat says nothing.
+    if (!(error instanceof RestartContinuationSupersededError)) {
+      await noteNotContinued(deps, sessionId, 'refused')
+    }
     throw error
   }
-  if (result.outcome !== 'continued') {
+  if ('done' in started) {
+    await noteOutcome(deps, sessionId, started.done)
+    return started
+  }
+  const { verdict } = started
+  return {
+    verdict: async () => {
+      const outcome = await verdict()
+      await noteOutcome(deps, sessionId, outcome)
+      return outcome
+    }
+  }
+}
+
+async function noteOutcome(
+  deps: Pick<StructuredAgentSessionContinuationDeps, 'note' | 'onNoteFailed'>,
+  sessionId: string,
+  result: StructuredAgentSessionContinuationOutcome
+): Promise<void> {
+  if (result.outcome === 'continued') {
+    // Only an accepted dispatch gets the note: it is a durable claim that Orca asked this agent to
+    // carry on. Best effort — losing it must not turn a delivered continuation into a failure.
+    try {
+      await deps.note(sessionId, AGENT_SESSION_RESTART_CONTINUATION_NOTE)
+    } catch (error) {
+      deps.onNoteFailed(sessionId, error)
+    }
+  } else {
     await noteNotContinued(
       deps,
       sessionId,
@@ -244,7 +255,6 @@ export async function continueStructuredAgentSessionAfterRestart(
           : 'refused'
     )
   }
-  return result
 }
 
 /** The chat itself carries the failure, so it survives the toast, a dismissed record and a restart,
@@ -272,13 +282,14 @@ async function noteNotContinued(
 async function sendContinuation(
   deps: StructuredAgentSessionContinuationDeps,
   sessionId: string,
-  marker: AgentSessionResumeMarker
-): Promise<StructuredAgentSessionContinuationOutcome> {
+  marker: AgentSessionResumeMarker,
+  continuationId: string
+): Promise<StartedStructuredAgentSessionContinuation> {
   const fence = deps.currentFence(sessionId)
   if (fence === null) {
-    return { sessionId, outcome: 'refused', reason: 'agent_session_not_attached' }
+    return { done: { sessionId, outcome: 'refused', reason: 'agent_session_not_attached' } }
   }
-  const { envelope, body } = restartContinuationEnvelope(sessionId, fence, marker)
+  const { envelope, body } = restartContinuationEnvelope(sessionId, fence, marker, continuationId)
   const sent = await deps.send({ envelope, body }).catch((error: unknown) => {
     if (error instanceof AgentSessionPreDispatchError) {
       throw error
@@ -288,46 +299,64 @@ async function sendContinuation(
     return null
   })
   if (!sent) {
-    return { sessionId, outcome: 'unknown' }
+    return { done: { sessionId, outcome: 'unknown' } }
   }
   if (!sent.ok) {
     return {
-      sessionId,
-      outcome: 'refused',
-      reason: sent.refusal?.code ?? 'agent_session_send_failed'
+      done: {
+        sessionId,
+        outcome: 'refused',
+        reason: sent.refusal?.code ?? 'agent_session_send_failed'
+      }
     }
   }
-  // The send result carries the dispatch as it stood when Orca took the message, which for a normal
-  // successful send is `pending`. Judging it here would report every delivered continuation as
-  // pending and never write the note, so the settled value is what decides.
-  const submission =
-    (await deps.awaitSettlement(sessionId, envelope.clientOperationId).catch(() => undefined)) ??
-    sent.value?.submission
+  const clientMessageId = envelope.clientOperationId
+  const handedOver = await deps.awaitHandedOver(sessionId, clientMessageId).catch(() => undefined)
+  if (handedOver?.dispatchState === 'rejected') {
+    return { done: refusedBy(sessionId, handedOver) }
+  }
+  return {
+    verdict: async () =>
+      verdictOf(
+        sessionId,
+        // The send result carries the dispatch as it stood when Orca took the message, which for
+        // a normal successful send is `pending`, so the settled value is what decides.
+        (await deps.awaitSettlement(sessionId, clientMessageId).catch(() => undefined)) ??
+          handedOver ??
+          sent.value?.submission
+      )
+  }
+}
+
+function refusedBy(
+  sessionId: string,
+  submission: ContinuationSubmission
+): StructuredAgentSessionContinuationOutcome {
+  // A start the agent was refused files that refusal's code, which the failure guidance keys on.
+  const refusal = readAgentSessionFailureFact(submission.rejection)?.refusal
+  return {
+    sessionId,
+    outcome: 'refused',
+    reason: refusal?.code ?? submission.reason ?? 'agent_session_dispatch_rejected',
+    ...(refusal ? { refusal } : {})
+  }
+}
+
+function verdictOf(
+  sessionId: string,
+  submission: ContinuationSubmission | undefined
+): StructuredAgentSessionContinuationOutcome {
   const dispatch = submission?.dispatchState
-  if (dispatch === 'rejected') {
-    return {
-      sessionId,
-      outcome: 'refused',
-      reason: submission?.reason ?? 'agent_session_dispatch_rejected'
-    }
+  if (submission && dispatch === 'rejected') {
+    return refusedBy(sessionId, submission)
   }
   if (dispatch === 'pending') {
     // Still pending after settlement gave up: handed off, never confirmed.
     return { sessionId, outcome: 'pending' }
   }
-  if (dispatch !== 'accepted') {
-    // `unknown`, or a peer that reported no state at all. Delivery is unverifiable, so this claims
-    // neither success nor failure — and writes no note saying the agent was asked to continue.
-    return { sessionId, outcome: 'unknown' }
-  }
-  // Only an accepted dispatch gets the note: it is a durable claim that Orca asked this agent to
-  // carry on, and it must not sit beside a message the provider refused or never confirmed. Best
-  // effort beyond that — losing the note must not turn a delivered continuation into a failure —
-  // but reported, never swallowed.
-  try {
-    await deps.note(sessionId, AGENT_SESSION_RESTART_CONTINUATION_NOTE)
-  } catch (error) {
-    deps.onNoteFailed(sessionId, error)
-  }
-  return { sessionId, outcome: 'continued' }
+  // `unknown`, or a peer that reported no state at all: delivery is unverifiable, so this claims
+  // neither success nor failure — and writes no note saying the agent was asked to continue.
+  return dispatch === 'accepted'
+    ? { sessionId, outcome: 'continued' }
+    : { sessionId, outcome: 'unknown' }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-filing.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-filing.test.ts
index 5dcc3ca7690..f1fe0a40b42 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-filing.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-filing.test.ts
@@ -2,21 +2,18 @@ import { afterEach, expect, it, vi } from 'vitest'
 import { AgentSessionRecoveryCapsule } from '../../runtime/agent-session-recovery-capsule'
 import {
   AGENT_SESSION_RESTART_CONTINUATION_REFUSED_NOTE,
-  AGENT_SESSION_RESTART_CONTINUATION_UNCONFIRMED_NOTE,
-  AGENT_SESSION_RESTART_NOT_CONNECTED_NOTE
+  AGENT_SESSION_RESTART_CONTINUATION_UNCONFIRMED_NOTE
 } from '../../../shared/agent-session-restart-continuation'
-import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
-import { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import { latestStructuredAgentSessionUserItem } from '../../../shared/structured-agent-session-projection'
 import { StructuredAgentSessionResumeAdmission } from './structured-agent-session-restart-resume-runner'
+import { STRUCTURED_AGENT_SESSION_RESTART_CONTINUATION_CALLER } from './structured-agent-session-restart-resume-wiring'
 import {
   interruptedRestart,
   statusNotes
 } from './structured-agent-session-restart-interruption-test-harness'
+import { CALLER, envelope } from './structured-agent-session-host-test-harness'
 import {
   HOST_TEST_NOW as NOW,
   HOST_TEST_SESSION as SESSION,
-  HOST_TEST_THREAD as THREAD,
   hostTestMessage
 } from './structured-agent-session-host-test-data'
 
@@ -24,206 +21,71 @@ import {
 
 afterEach(() => vi.restoreAllMocks())
 
-function providerEvents(acquire: Awaited<ReturnType<typeof interruptedRestart>>['acquire']) {
-  const events = acquire.mock.calls[0]?.[0].events
-  if (!events) {
-    throw new Error('missing resumed provider event sink')
-  }
-  return events
-}
-
-// The reported case: after the reattach the provider replays a queued message, which the chat
-// journals as a newer user turn, so the continuation is refused just before dispatch.
-it('files a continuation superseded by a replayed message, lists it and says so in the chat', async () => {
-  const { host, acquire, dispatch, root } = await interruptedRestart()
-  await host.restartResume.list()
-  await host.hold(SESSION, 'pane')
-  const events = providerEvents(acquire)
-  const append = AgentSessionJournal.prototype.appendSubmission
-  vi.spyOn(AgentSessionJournal.prototype, 'appendSubmission').mockImplementationOnce(
-    async function (this: AgentSessionJournal, input) {
-      const cursor = await append.call(this, input)
-      events.appendItem(
-        { provider: 'codex', threadId: THREAD, turnId: 'replayed-turn', ordinal: 1 },
-        hostTestMessage('A queued notification the provider replayed')
-      )
-      return cursor
-    }
-  )
-
-  const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
-
-  expect(dispatch).not.toHaveBeenCalled()
-  expect(result.resumed).toMatchObject([
-    { outcome: 'refused', reason: 'agent_session_restart_work_superseded' }
-  ])
-  const failure = {
-    sessionId: SESSION,
-    outcome: 'refused',
-    reason: 'agent_session_restart_work_superseded'
-  }
-  expect(result.failed).toMatchObject([failure])
-  expect(await host.restartResume.listFailures()).toMatchObject([failure])
-  expect(await new AgentSessionRecoveryCapsule(root).listFailed(NOW)).toHaveLength(1)
-  expect(statusNotes(host)).toContainEqual({
-    text: AGENT_SESSION_RESTART_CONTINUATION_REFUSED_NOTE,
-    tone: 'error'
-  })
-  host.release(SESSION, 'pane')
-})
-
-// Nothing was attempted and nothing is owed: the user moved on between listing and acting.
+// Nothing was owed once the user's own message came first: the offer is spent and nothing is filed.
 it('files nothing for a chat the user moved on in before its attempt, and spends the offer', async () => {
-  const { host, acquire, root } = await interruptedRestart()
+  const { host, root, dispatch } = await interruptedRestart()
   await host.restartResume.list()
-  await host.hold(SESSION, 'pane')
-  const events = providerEvents(acquire)
   const admit = StructuredAgentSessionResumeAdmission.prototype.run
   vi.spyOn(StructuredAgentSessionResumeAdmission.prototype, 'run').mockImplementationOnce(
     async function (this, ...args) {
-      events.appendItem(
-        { provider: 'codex', threadId: THREAD, turnId: 'newer-turn', ordinal: 1 },
-        hostTestMessage('A newer task from another client')
-      )
-      await host.flushStreamedEvents(SESSION)
+      const body = hostTestMessage('A newer task from another client')
+      await host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
       return admit.apply(this, args)
     }
   )
 
   const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
 
-  expect(result.resumed).toMatchObject([{ reason: 'agent_session_resume_not_eligible' }])
+  expect(result.continued.filter((entry) => entry.outcome === 'continued')).toEqual([])
   expect(result.failed).toEqual([])
+  await vi.waitFor(() => expect(dispatch).toHaveBeenCalledOnce())
   const capsule = new AgentSessionRecoveryCapsule(root)
   expect(await capsule.listFailed(NOW)).toEqual([])
   expect(await capsule.list(NOW)).toEqual([])
-  expect(statusNotes(host)).toEqual([])
-  host.release(SESSION, 'pane')
+  expect(await statusNotes(host)).toEqual([])
 })
 
-it.each(['resume', 'continueAfterRestart'] as const)(
-  'says so in the chat when the reattach itself fails (%s)',
-  async (action) => {
-    const { host, acquire } = await interruptedRestart()
-    await host.restartResume.list()
-    acquire.mockRejectedValueOnce(new Error('provider could not reconnect'))
+// The continuation is accepted and its agent then fails to start: the message is rejected with the
+// cause, the failure is filed, and the chat says the agent did not carry on.
+it('says so in the chat when the agent cannot start for the continuation', async () => {
+  const { host, acquire } = await interruptedRestart()
+  await host.restartResume.list()
+  acquire.mockRejectedValueOnce(new Error('provider could not reconnect'))
 
-    await host.restartResume[action]([SESSION], 'modal')
+  await host.restartResume.continueAfterRestart([SESSION], 'modal')
 
-    expect(await host.restartResume.listFailures()).toMatchObject([
-      { sessionId: SESSION, outcome: 'refused' }
-    ])
-    // The fix depends on why it failed, which the dialog explains; "send a message" would not work.
-    expect(statusNotes(host)).toEqual([
-      { text: AGENT_SESSION_RESTART_NOT_CONNECTED_NOTE, tone: 'error' }
-    ])
-  }
-)
+  expect(await host.restartResume.listFailures()).toMatchObject([
+    { sessionId: SESSION, outcome: 'refused', retryable: true }
+  ])
+  expect(await statusNotes(host)).toContainEqual({
+    text: AGENT_SESSION_RESTART_CONTINUATION_REFUSED_NOTE,
+    tone: 'error'
+  })
+})
 
-/** A continuation the provider accepted whose settlement could not be written: filed unconfirmed. */
-async function unconfirmedContinuation() {
-  const state = await interruptedRestart()
-  const { host, store } = state
+// A send that throws after Orca may have taken it cannot be proven undelivered: filed unconfirmed,
+// and it stays on record while the agent that may be carrying on keeps running.
+it('keeps an unconfirmed failure while the agent the continuation started keeps running', async () => {
+  const { host, store } = await interruptedRestart()
   vi.spyOn(console, 'warn').mockImplementation(() => {})
   await host.restartResume.list()
-  await host.hold(SESSION, 'pane')
   const settle = store.recordOperationOutcome.bind(store)
   vi.spyOn(store, 'recordOperationOutcome').mockImplementation(async (input) => {
-    if (input.outcome.status === 'succeeded') {
+    if (
+      input.callerKey === STRUCTURED_AGENT_SESSION_RESTART_CONTINUATION_CALLER &&
+      input.outcome.status === 'succeeded'
+    ) {
       throw new Error('operation outcome could not be persisted')
     }
     return settle(input)
   })
+
   const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+
   expect(result.failed).toMatchObject([{ sessionId: SESSION, outcome: 'unconfirmed' }])
-  expect(statusNotes(host)).toContainEqual({
+  expect(await statusNotes(host)).toContainEqual({
     text: AGENT_SESSION_RESTART_CONTINUATION_UNCONFIRMED_NOTE,
     tone: 'warning'
   })
-  const continuation = host.journalSnapshot(SESSION).submissions.at(-1)
-  const providerItemId = continuation?.providerItemId
-  if (!continuation || !providerItemId) {
-    throw new Error('missing accepted continuation')
-  }
-  return { ...state, continuation, providerItemId, events: providerEvents(state.acquire) }
-}
-
-// The warning asked the user to check the agent's reply; a turn opened by the continuation's own
-// message is that reply starting, however the provider names the message.
-it.each(['submission key', 'provider key'] as const)(
-  'retires an unconfirmed failure once the continuation opens a turn (%s)',
-  async (naming) => {
-    const { host, root, continuation, providerItemId, events } = await unconfirmedContinuation()
-    events.appendItem(
-      { provider: 'codex', threadId: THREAD, turnId: 'continued-turn', ordinal: 1 },
-      {
-        kind: 'turn',
-        turnId: 'continued-turn',
-        state: 'running',
-        userItemId:
-          naming === 'submission key'
-            ? agentJournalSubmissionKey(continuation.clientMessageId)
-            : providerItemId
-      },
-      { lifecycle: true }
-    )
-    await host.flushStreamedEvents(SESSION)
-
-    expect(await host.restartResume.listFailures()).toEqual([])
-    await vi.waitFor(async () => {
-      expect(await new AgentSessionRecoveryCapsule(root).listFailed(NOW)).toEqual([])
-    })
-    host.release(SESSION, 'pane')
-  }
-)
-
-it('keeps an unconfirmed failure while the newest turn is not the continuation’s', async () => {
-  const { host, events } = await unconfirmedContinuation()
-  // Provider output opened this turn, keyed by its own row rather than by any user message.
-  events.appendItem(
-    { provider: 'codex', threadId: THREAD, turnId: 'provider-turn', ordinal: 1 },
-    { kind: 'turn', turnId: 'provider-turn', state: 'running', userItemId: 'provider-turn-row' },
-    { lifecycle: true }
-  )
-  await host.flushStreamedEvents(SESSION)
-
   expect(await host.restartResume.listFailures()).toMatchObject([{ outcome: 'unconfirmed' }])
-  host.release(SESSION, 'pane')
-})
-
-// Nothing journaled the continuation, so the newest user message is still the interrupted one and
-// the turn it opened is the interrupted work reporting in, not the agent carrying on.
-it('keeps an unconfirmed failure whose continuation was never journaled while the interrupted turn runs', async () => {
-  const { host, acquire, store, marker } = await interruptedRestart('submission', false)
-  vi.spyOn(console, 'warn').mockImplementation(() => {})
-  await host.restartResume.list()
-  await host.hold(SESSION, 'pane')
-  const events = providerEvents(acquire)
-  events.appendItem(
-    { provider: 'codex', threadId: THREAD, turnId: 'original-turn', ordinal: 1 },
-    hostTestMessage('Perform the original task')
-  )
-  await host.flushStreamedEvents(SESSION)
-  // A send that throws before recording anything cannot be proven undelivered.
-  vi.spyOn(store, 'admitMutationOperation').mockRejectedValueOnce(new Error('store unavailable'))
-  const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
-  expect(result.failed).toMatchObject([{ sessionId: SESSION, outcome: 'unconfirmed' }])
-  const submissions = host.journalSnapshot(SESSION).submissions
-  const original = submissions[0]?.providerItemId
-  if (submissions.length !== 1 || !original) {
-    throw new Error('expected only the original submission, accepted by the provider')
-  }
-  expect(latestStructuredAgentSessionUserItem(host.journalSnapshot(SESSION).items)?.itemId).toBe(
-    marker?.latestUserItemId
-  )
-
-  events.appendItem(
-    { provider: 'codex', threadId: THREAD, turnId: 'original-turn', ordinal: 2 },
-    { kind: 'turn', turnId: 'original-turn', state: 'running', userItemId: original },
-    { lifecycle: true }
-  )
-  await host.flushStreamedEvents(SESSION)
-
-  expect(await host.restartResume.listFailures()).toMatchObject([{ outcome: 'unconfirmed' }])
-  host.release(SESSION, 'pane')
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-ledger.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-ledger.ts
index 3b8fad40de0..ee769b9e8c3 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-ledger.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-ledger.ts
@@ -4,9 +4,8 @@
 // the offer, so without this record nothing durable would point at the chat the user has to
 // continue by hand. The capsule holds the record; this decides what goes in and when it leaves.
 //
-// Whether a record is still current is derived, never cached: it is current only while the chat's
-// newest user message is the one it had when the failure was filed. The user's own send, from any
-// client, therefore retires it without a hook on the send path.
+// A record ends when the chat's agent is started again outside a resume action — the host retires
+// it at that start, with the offer — or by a successful retry, or a dismissal.
 
 import type {
   AgentSessionRecoveryCapsule,
@@ -18,19 +17,10 @@ import type {
   AgentSessionResumeFailureOutcome,
   AgentSessionResumeMarker
 } from '../../../shared/agent-session-resume-marker'
-import type { AgentJournalSnapshot } from '../../../shared/agent-session-journal-types'
-import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
-import { isRootAgentJournalItem } from '../../../shared/agent-session-journal-producer'
-import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
-import { latestStructuredAgentSessionUserItem } from '../../../shared/structured-agent-session-projection'
 import { normalizeOptionalField } from '../../../shared/agent-status-field-normalization'
 import { AGENT_MODEL_MAX_LENGTH } from '../../../shared/agent-status-types'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { adapterSupportsRecord } from './structured-agent-session-provider-support'
-import {
-  liveStructuredAgentSessionLatestUserItemId,
-  type StructuredAgentSessionRestartJournalSource
-} from './structured-agent-session-restart-candidates'
 import type { StructuredAgentSessionContinuationOutcome } from './structured-agent-session-restart-continuation'
 import type {
   StructuredAgentSessionResumeCandidate,
@@ -40,37 +30,18 @@ import {
   STRUCTURED_AGENT_SESSION_RESUME_NOT_ELIGIBLE,
   type StructuredAgentSessionResumeOutcome
 } from './structured-agent-session-restart-resume-runner'
+import { RESTART_CONTINUATION_SUPERSEDED } from './structured-agent-session-restart-continuation'
 
 type FailureCapsule = Pick<
   AgentSessionRecoveryCapsule,
-  | 'listFailed'
-  | 'completeResume'
-  | 'failResume'
-  | 'rollbackResume'
-  | 'dismiss'
-  | 'clearAll'
-  | 'forgetSuperseded'
+  'listFailed' | 'completeResume' | 'failResume' | 'rollbackResume' | 'dismiss' | 'clearAll'
 >
 
-/** What a failure is filed against: the chat's newest user message as its own attempt ended. Kept
- *  per chat rather than read at settlement, because the rest of a batch can take a while and a
- *  message the user sends meanwhile answers the failure rather than belongs to it. */
-export type StructuredAgentSessionRestartAttempts = {
-  observe: (sessionId: string) => void
-  latestUserItemId: (sessionId: string) => string | null
-}
-
 export type StructuredAgentSessionRestartFailureLedger = {
   /** The stored records, current or not. */
   read: () => Promise<AgentSessionResumeFailureRecord[]>
-  /** The current records as rows a surface can show; sessions this host no longer holds are left
-   *  out, and records the chat has since superseded are dropped and pruned. */
+  /** The records as rows a surface can show; sessions this build cannot run are left out. */
   list: () => Promise<StructuredAgentSessionResumeFailure[]>
-  /** One action's attempts; a chat never observed after an attempt falls back to its reserved
-   *  marker. */
-  attempts: (
-    markers: ReadonlyMap<string, AgentSessionResumeMarker>
-  ) => StructuredAgentSessionRestartAttempts
   /** Settles one operation's reservations: the agent carried on, or the failure is filed. Rows the
    *  operation still owns after that are reopened. */
   settle: (
@@ -78,7 +49,8 @@ export type StructuredAgentSessionRestartFailureLedger = {
     outcomes: readonly StructuredAgentSessionResumeOutcome[],
     action: {
       candidates: readonly StructuredAgentSessionResumeCandidate[]
-      attempts: StructuredAgentSessionRestartAttempts
+      /** The reserved markers; a failure carries its marker's message id for older readers. */
+      markers: ReadonlyMap<string, AgentSessionResumeMarker>
       /** How a reattached session's action ended; null when the agent carried on. Reattaching alone
        *  is not the whole action, so the runner's own outcome cannot decide this. */
       failureAfterResume: (sessionId: string) => AgentSessionResumeFailureOutcome | null
@@ -99,54 +71,14 @@ export function continuationFailureOutcome(
   return outcome === 'continued' ? null : outcome === 'refused' ? 'refused' : 'unconfirmed'
 }
 
-/** Whether the chat itself has moved past a failure: a newer user message, or, for a delivery
- *  nobody confirmed, a turn the continuation's own message opened. */
-function failureAnsweredByChat(
-  failure: AgentSessionResumeFailureRecord,
-  snapshot: AgentJournalSnapshot
-): boolean {
-  const latest = latestStructuredAgentSessionUserItem(snapshot.items)?.itemId ?? null
-  if (latest !== failure.latestUserItemId) {
-    return true
-  }
-  // Only when the continuation's message was journaled: otherwise the newest user message is the
-  // interrupted one, whose own turn proves nothing about the continuation.
-  return (
-    failure.outcome === 'unconfirmed' &&
-    latest !== null &&
-    latest !== failure.marker.latestUserItemId &&
-    newestTurnUserItemId(snapshot) === latest
-  )
-}
-
-/** The user message that opened the newest root turn, resolved through a provider key the send was
- *  accepted under. */
-function newestTurnUserItemId(snapshot: AgentJournalSnapshot): string | null {
-  for (let index = snapshot.items.length - 1; index >= 0; index -= 1) {
-    const item = snapshot.items[index]
-    const turn = isRootAgentJournalItem(item) ? readAgentJournalTurn(item?.body) : null
-    if (!turn) {
-      continue
-    }
-    const key = turn.userItemId
-    if (key === undefined) {
-      return null
-    }
-    const accepted = snapshot.submissions.find((entry) => entry.providerItemId === key)
-    return accepted ? agentJournalSubmissionKey(accepted.clientMessageId) : key
-  }
-  return null
-}
-
 export function createStructuredAgentSessionRestartFailureLedger(deps: {
   capsule?: FailureCapsule
-  sessions: ReadonlyMap<string, StructuredAgentSessionRestartJournalSource>
-  /** Makes a persisted chat's journal readable here, as listing an offer does. */
-  reveal: (sessionId: string) => Promise<void>
   getRecord: (sessionId: string) => AgentSessionRecord | null
   adapter: StructuredAgentSessionAdapter
   /** The predicate a retry applies to the failure's marker. */
   retryable: (marker: AgentSessionResumeMarker) => boolean
+  /** Makes the failed chats readable here, so `retryable` reads each one's journal. */
+  reveal: (markers: readonly AgentSessionResumeMarker[]) => Promise<void>
   now: () => number
   /** The capsule's single mutation lane, shared with the offer's own operations. */
   enqueue: <T>(operation: () => Promise<T>) => Promise<T>
@@ -184,41 +116,16 @@ export function createStructuredAgentSessionRestartFailureLedger(deps: {
         failedAt: failure.failedAt,
         outcome: failure.outcome,
         reason: failure.reason,
+        ...(failure.details ? { details: failure.details } : {}),
         retryable: deps.retryable(failure.marker)
       }
     ]
   }
 
   const list = async (): Promise<StructuredAgentSessionResumeFailure[]> => {
-    const current: AgentSessionResumeFailureRecord[] = []
-    const superseded: AgentSessionResumeFailureRecord[] = []
-    for (const failure of await read()) {
-      const sessionId = failure.marker.sessionId
-      if (!deps.sessions.has(sessionId)) {
-        await deps.reveal(sessionId)
-      }
-      const snapshot = deps.sessions.get(sessionId)?.journal.snapshot()
-      // An unreadable journal decides nothing; the record stays until something that can decide.
-      if (snapshot && failureAnsweredByChat(failure, snapshot)) {
-        superseded.push(failure)
-      } else {
-        current.push(failure)
-      }
-    }
-    const capsule = deps.capsule
-    if (capsule && superseded.length > 0) {
-      const gone = superseded.map((failure) => ({
-        sessionId: failure.marker.sessionId,
-        recordedAt: failure.marker.recordedAt,
-        failedAt: failure.failedAt
-      }))
-      void deps
-        .enqueue(() => capsule.forgetSuperseded(gone, deps.now()))
-        .catch(() => {
-          console.warn('[structured-agent-session] pruning superseded restart failures failed')
-        })
-    }
-    return current.flatMap(toRow)
+    const failures = await read()
+    await deps.reveal(failures.map((failure) => failure.marker))
+    return failures.flatMap(toRow)
   }
 
   const settle: StructuredAgentSessionRestartFailureLedger['settle'] = async (
@@ -232,16 +139,22 @@ export function createStructuredAgentSessionRestartFailureLedger(deps: {
     }
     const completed: string[] = []
     const failures: AgentSessionResumeFailureInput[] = []
-    const promptBySession = new Map(
-      action.candidates.map((candidate) => [candidate.sessionId, candidate.latestPrompt])
-    )
+    // A retry keeps the prompt its first failure named: the chat's newest user message since then
+    // is the rejected continuation, and a message of the user's own would have ended the offer.
+    const promptBySession = new Map([
+      ...action.candidates.map(
+        (candidate) => [candidate.sessionId, candidate.latestPrompt] as const
+      ),
+      ...(await read()).map((filed) => [filed.marker.sessionId, filed.latestPrompt] as const)
+    ])
     for (const outcome of outcomes) {
       const resumed = outcome.outcome === 'resumed'
-      // Ineligible means the user moved on or the offer no longer applies (record gone,
-      // conversation forked), so there is nothing to retry and the offer is spent.
+      // Ineligible means the offer no longer applies (record gone, conversation forked), and
+      // superseded means the user's own message came first: nothing to retry, and the offer is spent.
       const failure = resumed
         ? action.failureAfterResume(outcome.sessionId)
-        : outcome.reason === STRUCTURED_AGENT_SESSION_RESUME_NOT_ELIGIBLE
+        : outcome.reason === STRUCTURED_AGENT_SESSION_RESUME_NOT_ELIGIBLE ||
+            outcome.reason === RESTART_CONTINUATION_SUPERSEDED
           ? null
           : 'refused'
       if (failure === null) {
@@ -255,8 +168,9 @@ export function createStructuredAgentSessionRestartFailureLedger(deps: {
         reason: resumed
           ? action.failureReason(outcome.sessionId)
           : (outcome.reason ?? 'agent_session_resume_refused'),
+        ...(!resumed && outcome.details ? { details: outcome.details } : {}),
         latestPrompt: promptBySession.get(outcome.sessionId) ?? '',
-        latestUserItemId: action.attempts.latestUserItemId(outcome.sessionId)
+        latestUserItemId: action.markers.get(outcome.sessionId)?.latestUserItemId ?? null
       })
     }
     await deps
@@ -280,27 +194,9 @@ export function createStructuredAgentSessionRestartFailureLedger(deps: {
       })
   }
 
-  const attempts: StructuredAgentSessionRestartFailureLedger['attempts'] = (markers) => {
-    const observed = new Map<string, string | null>()
-    return {
-      // Observed after the attempt, so the continuation's own message is part of the filed state.
-      observe: (sessionId) => {
-        const latest = liveStructuredAgentSessionLatestUserItemId(deps.sessions, sessionId)
-        if (latest !== undefined) {
-          observed.set(sessionId, latest)
-        }
-      },
-      latestUserItemId: (sessionId) => {
-        const latest = observed.get(sessionId)
-        return latest !== undefined ? latest : (markers.get(sessionId)?.latestUserItemId ?? null)
-      }
-    }
-  }
-
   return {
     read,
     list,
-    attempts,
     settle,
     dismiss: (sessionIds, beforeClearAll) =>
       deps.enqueue(async () => {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-interruption-test-harness.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-interruption-test-harness.ts
index 1bcb27ca4a2..6566105ee87 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-interruption-test-harness.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-interruption-test-harness.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // A chat interrupted mid-turn by a restart, rebuilt on a fresh host over the same store, for the
 // restart-resume ownership and failure tests.
 
@@ -10,8 +11,8 @@ import {
 } from '../../runtime/agent-session-recovery-capsule'
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import { parseAgentSessionResumeMarker } from '../../../shared/agent-session-resume-marker'
-import { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
 import { StructuredAgentSessionResumeAdmission } from './structured-agent-session-restart-resume-runner'
 import {
   adapter,
@@ -25,14 +26,30 @@ import {
   HOST_TEST_NOW as NOW,
   HOST_TEST_SESSION as SESSION,
   HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
   hostTestMessage
 } from './structured-agent-session-host-test-data'
 
-export const GRACE = 15_000
+/** Starts the agent explicitly — the attach a client's ensure makes — for a test that needs a
+ *  running child before its next step. Nothing else starts one ahead of a send. */
+export async function startAgent(state: {
+  host: StructuredAgentSessionHost
+  store: AgentSessionRecordStore
+}): Promise<void> {
+  const result = await state.host.attach(
+    CALLER,
+    hostTestAttachParams(state.store.getRecord(SESSION)?.lease.runtimeFence ?? null)
+  )
+  expect(result.ok).toBe(true)
+}
 
 export async function interruptedRestart(
   work: 'turn' | 'submission' | 'send-after-reply' | 'children' = 'turn',
-  historyBoundaryConsistent = true
+  historyBoundaryConsistent = true,
+  /** What the restarted host proves about the recorded owner; gone unless a test says otherwise. */
+  probeOwner: NonNullable<StructuredAgentSessionHostDeps['probeOwner']> = async () => ({
+    outcome: 'pid-absent'
+  })
 ) {
   const previous = hostTestState()
   await attach()
@@ -44,7 +61,8 @@ export async function interruptedRestart(
     // An earlier exchange had finished; the user's next send had not opened a turn yet.
     events.appendItem(
       { provider: 'codex', threadId: THREAD, turnId: 'earlier-turn', ordinal: 1 },
-      { kind: 'turn', turnId: 'earlier-turn', state: 'completed' }
+      { kind: 'turn', turnId: 'earlier-turn', state: 'completed' },
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await previous.host.flushStreamedEvents(SESSION)
   }
@@ -52,10 +70,13 @@ export async function interruptedRestart(
     previous.dispatch.mockResolvedValueOnce({ state: 'admitted' })
     const body = hostTestMessage('Perform the original task')
     await previous.host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
+    // Accepted first, handed over after: the work in flight is a send the provider took.
+    await vi.waitFor(() => expect(previous.dispatch).toHaveBeenCalledOnce())
   } else if (work === 'children') {
     events.appendItem(
       { provider: 'codex', threadId: THREAD, turnId: 'settled-turn', ordinal: 1 },
-      { kind: 'turn', turnId: 'settled-turn', state: 'completed' }
+      { kind: 'turn', turnId: 'settled-turn', state: 'completed' },
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     const group = {
       provider: 'codex',
@@ -74,20 +95,21 @@ export async function interruptedRestart(
         }
       ]
     })
-    events.appendItem(group, roster('working'))
+    events.appendItem(group, roster('working'), { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
     previous.host.deps.adapter.backgroundTaskState = () => ({
       state: 'monitoring',
       tasks: [{ id: 'child-1', kind: 'agent', description: 'Review loop 4', state: 'working' }]
     })
     // As the real adapters do: the child's own close settles the children it can no longer hear.
     previous.host.deps.adapter.closeSession = async () => {
-      events.appendItem(group, roster('unverifiable'))
+      events.appendItem(group, roster('unverifiable'), { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
       return true
     }
   } else {
     events.appendItem(
       { provider: 'codex', threadId: THREAD, turnId: 'interrupted-turn', ordinal: 1 },
-      { kind: 'turn', turnId: 'interrupted-turn', state: 'running' }
+      { kind: 'turn', turnId: 'interrupted-turn', state: 'running' },
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
   }
   await previous.host.flushStreamedEvents(SESSION)
@@ -97,6 +119,8 @@ export async function interruptedRestart(
     hostId: 'local'
   })
   const closeSession = vi.fn(async () => true)
+  // The relaunch comes after the quit that recorded the offer.
+  const clock = { now: NOW + 1 }
   const host = new StructuredAgentSessionHost({
     store,
     adapter: {
@@ -115,10 +139,9 @@ export async function interruptedRestart(
     journalRoot: previous.root,
     claimKeyId: 'key-1',
     mintSpawnToken: () => 'spawn-next',
-    probeOwner: async () => ({ outcome: 'pid-absent' }),
+    probeOwner,
     recoveryCapsule: new AgentSessionRecoveryCapsule(previous.root),
-    releaseGraceMs: GRACE,
-    now: () => NOW
+    now: () => clock.now
   })
   replaceHostTestState({ store, host })
   previous.acquire.mockClear()
@@ -128,43 +151,34 @@ export async function interruptedRestart(
     await readFile(join(previous.root, AGENT_SESSION_RECOVERY_CAPSULE_FILE), 'utf8')
   )
   const marker = parseAgentSessionResumeMarker(capsule.entries[0]?.marker)
-  return { ...hostTestState(), host, store, closeSession, marker }
+  return { ...hostTestState(), host, store, closeSession, marker, clock }
 }
 
-export function statusNotes(host: StructuredAgentSessionHost) {
-  return host
-    .journalSnapshot(SESSION)
-    .items.flatMap((item) =>
-      item.body.kind === 'status' ? [{ text: item.body.text, tone: item.body.tone }] : []
-    )
+export async function statusNotes(host: StructuredAgentSessionHost) {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status' ? [{ text: item.body.text, tone: item.body.tone }] : []
+  )
 }
 
-/** A reattach that succeeds and a continuation the host refuses: a message from another client
- *  lands while the continuation is being recorded. `userAnswers` has the user reply in the chat
- *  just before or after its own attempt, while the rest of a batch would still be running. */
+/** A continuation the host refuses because the user's own message was accepted first: another
+ *  client's send lands after the action reserved the offer, just before the continuation is
+ *  accepted. `userAnswers` instead has the user send before or after the whole attempt. */
 export async function supersededRefusal(userAnswers?: 'before' | 'after') {
-  const { host, acquire, dispatch, root } = await interruptedRestart()
+  const { host, store, acquire, dispatch, root } = await interruptedRestart()
   await host.restartResume.list()
-  await host.hold(SESSION, 'pane')
-  const events = acquire.mock.calls[0]?.[0].events
-  if (!events) {
-    throw new Error('missing resumed provider event sink')
-  }
-  const append = AgentSessionJournal.prototype.appendSubmission
-  const writing = vi.spyOn(AgentSessionJournal.prototype, 'appendSubmission')
-  writing.mockImplementationOnce(async function (this: AgentSessionJournal, input) {
-    const cursor = await append.call(this, input)
-    events.appendItem(
-      { provider: 'codex', threadId: THREAD, turnId: 'newer-turn', ordinal: 1 },
-      hostTestMessage('A newer task from another client')
-    )
-    return cursor
-  })
-  const admit = StructuredAgentSessionResumeAdmission.prototype.run
-  const admitting = vi.spyOn(StructuredAgentSessionResumeAdmission.prototype, 'run')
-  const body = hostTestMessage('Carry on from where you stopped')
+  const body = hostTestMessage('A newer task from another client')
   const answer = () =>
     host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
+  const send = host.send
+  const writing = vi.spyOn(host, 'send')
+  if (!userAnswers) {
+    writing.mockImplementationOnce(async (caller, params) => {
+      await answer()
+      return send(caller, params)
+    })
+  }
+  const admit = StructuredAgentSessionResumeAdmission.prototype.run
+  const admitting = vi.spyOn(StructuredAgentSessionResumeAdmission.prototype, 'run')
   if (userAnswers) {
     admitting.mockImplementationOnce(async function (this, ...args) {
       await (userAnswers === 'before' ? answer() : null)
@@ -177,9 +191,7 @@ export async function supersededRefusal(userAnswers?: 'before' | 'after') {
   }
   try {
     const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
-    expect(result.continued).toMatchObject([{ outcome: 'refused' }])
-    expect(dispatch).toHaveBeenCalledTimes(userAnswers ? 1 : 0)
-    return { host, root, result }
+    return { host, store, acquire, dispatch, root, result }
   } finally {
     writing.mockRestore()
     admitting.mockRestore()
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-after-reattach.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-after-reattach.test.ts
index 912594a1737..032b0e07b2a 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-after-reattach.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-after-reattach.test.ts
@@ -1,99 +1,42 @@
-// An offer across the provider reattaching and rewriting the chat in its own words: a notice turn
-// of its own, restated rows. None of it withdraws the offer or changes the message Resume sends.
+// An offer across a failed attempt and its retry, and across builds: the message Resume sends
+// depends on the marker alone, and each action sends its own.
 
 import { expect, it } from 'vitest'
 import { AgentSessionRecoveryCapsule } from '../../runtime/agent-session-recovery-capsule'
 import { AGENT_SESSION_RESTART_CONTINUATION_MESSAGE } from '../../../shared/agent-session-restart-continuation'
-import { restartContinuationBody } from './structured-agent-session-restart-continuation'
+import { restartContinuationBody } from './structured-agent-session-restart-continuation-envelope'
 import { interruptedRestart } from './structured-agent-session-restart-interruption-test-harness'
 import {
   HOST_TEST_NOW as NOW,
-  HOST_TEST_SESSION as SESSION,
-  HOST_TEST_THREAD as THREAD
+  HOST_TEST_SESSION as SESSION
 } from './structured-agent-session-host-test-data'
 
-function resumedEvents(state: Awaited<ReturnType<typeof interruptedRestart>>) {
-  // The latest acquisition: an earlier one may have been refused.
-  const events = state.acquire.mock.calls.at(-1)?.[0].events
-  if (!events) {
-    throw new Error('missing resumed provider event sink')
-  }
-  return events
-}
-
-// THE REPORTED REFUSAL: opening the chat reattached Claude, which opened a turn of its own to say
-// the previous session did not finish, and closed it. The chat is still offered and Resume sends —
-// including when the offer is a send that had not become a turn, where that closed notice turn is
-// the newest turn in the journal.
-it.each(['turn', 'submission'] as const)(
-  'still offers and continues a %s offer after the provider opens and closes a notice turn',
-  async (work) => {
-    const state = await interruptedRestart(work, false)
-    const { host, dispatch } = state
-    await host.hold(SESSION, 'pane')
-    const events = resumedEvents(state)
-    const notice = { provider: 'codex', threadId: THREAD, turnId: 'notice-turn' } as const
-    events.appendItem(
-      { ...notice, ordinal: 1 },
-      { kind: 'turn', turnId: 'notice-turn', state: 'running', userItemId: 'turn:notice-turn' }
-    )
-    events.appendItem(
-      { ...notice, ordinal: 2 },
-      {
-        kind: 'message',
-        role: 'assistant',
-        blocks: [{ type: 'text', text: "didn't finish before the previous session ended" }]
-      }
-    )
-    events.appendItem(
-      { ...notice, ordinal: 1 },
-      { kind: 'turn', turnId: 'notice-turn', state: 'completed', userItemId: 'turn:notice-turn' }
-    )
-    await host.flushStreamedEvents(SESSION)
-
-    expect(await host.restartResume.list()).toMatchObject([{ sessionId: SESSION }])
-    expect(
-      (await host.restartResume.continueAfterRestart([SESSION], 'modal')).continued
-    ).toMatchObject([{ outcome: 'continued' }])
-    expect(dispatch).toHaveBeenCalledTimes(1)
-    host.release(SESSION, 'pane')
-  }
-)
-
-// A retry after the first attempt never reached the provider, with the rows restated in between:
-// the body depends on the marker alone, so the ledger fingerprint stays the offer's.
-it('sends the same continuation body on a retry after the provider restates its rows', async () => {
-  const state = await interruptedRestart('children')
-  const { host, acquire, dispatch, marker } = state
+// The first attempt's start failed, so its continuation was rejected and never reached the agent.
+// A retry is a new action with a new message, not a replay of the rejected one, and it is
+// delivered with the same body.
+it("delivers a retry as a new continuation after the first one's start failed", async () => {
+  const { host, acquire, dispatch, marker } = await interruptedRestart('children')
   if (!marker) {
     throw new Error('missing interrupted restart marker')
   }
   acquire.mockRejectedValueOnce(new Error('provider could not reconnect'))
-  await host.restartResume.continueAfterRestart([SESSION], 'modal')
-  expect(await host.restartResume.listFailures()).toMatchObject([{ retryable: true }])
+  const first = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+  expect(first.failed).toMatchObject([{ sessionId: SESSION, outcome: 'refused', retryable: true }])
+  const [rejected] = (await host.journalSnapshot(SESSION)).submissions
+  expect(rejected).toMatchObject({ dispatchState: 'rejected' })
 
-  await host.hold(SESSION, 'pane')
-  resumedEvents(state).appendItem(
-    { provider: 'codex', threadId: THREAD, turnId: 'settled-turn', ordinal: 2 },
-    {
-      kind: 'message',
-      role: 'system',
-      blocks: [
-        {
-          type: 'subagent-group',
-          groupId: 'settled-turn',
-          agents: [{ id: 'child-1', label: 'Review loop 4', state: 'completed' }]
-        }
-      ]
-    }
-  )
-  await host.flushStreamedEvents(SESSION)
   const retried = await host.restartResume.continueAfterRestart([SESSION], 'retry')
 
   expect(retried.continued).toMatchObject([{ outcome: 'continued' }])
-  expect(dispatch).toHaveBeenCalledTimes(1)
-  expect(dispatch.mock.calls[0]?.[0].body).toEqual(restartContinuationBody(marker))
-  host.release(SESSION, 'pane')
+  expect(dispatch).toHaveBeenCalledOnce()
+  const sent = dispatch.mock.calls[0]?.[0]
+  expect(sent?.clientMessageId).not.toBe(rejected?.clientMessageId)
+  expect(sent?.body).toEqual(restartContinuationBody(marker))
+  expect((await host.journalSnapshot(SESSION)).submissions).toMatchObject([
+    { clientMessageId: rejected?.clientMessageId, dispatchState: 'rejected' },
+    { clientMessageId: sent?.clientMessageId, dispatchState: 'accepted' }
+  ])
+  expect(retried.failed).toEqual([])
 })
 
 // A marker from a build that recorded only a working lead: no snapshot, so no activity to name,
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-endings.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-endings.test.ts
index 69f6f661c37..aefa34f4b67 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-endings.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-endings.test.ts
@@ -1,10 +1,11 @@
-// The ways an offer ends. Every ending is the user's own act, and every ending DELETES the
-// durable record — nothing stays behind to be re-filtered on every later read.
+// The ways an offer ends. Every ending DELETES the durable record — nothing stays behind to be
+// re-filtered on every later read.
 
 import { expect, it, vi } from 'vitest'
 import { AgentSessionRecoveryCapsule } from '../../runtime/agent-session-recovery-capsule'
-import { StructuredAgentSessionReadableRestorer } from './structured-agent-session-readable-restorer'
+import { rename, writeFile, rm } from 'node:fs/promises'
 import { interruptedRestart } from './structured-agent-session-restart-interruption-test-harness'
+import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
 import { CALLER, envelope } from './structured-agent-session-host-test-harness'
 import {
   HOST_TEST_NOW as NOW,
@@ -12,36 +13,47 @@ import {
   hostTestMessage
 } from './structured-agent-session-host-test-data'
 
-// The user answering the chat themselves is the one signal the offer is moot. The next listing
-// notices and deletes the durable record, not merely hides it.
+// The user's own message starts the chat's agent again, which ends the offer: the durable record
+// is deleted, not merely hidden (R-04).
 it('deletes the offer once the user sends their own message in that chat', async () => {
   const { host, root, dispatch } = await interruptedRestart()
   const capsule = new AgentSessionRecoveryCapsule(root)
   expect(await capsule.list(NOW)).toHaveLength(1)
 
-  await host.hold(SESSION, 'pane')
   dispatch.mockResolvedValueOnce({ state: 'admitted' })
   const body = hostTestMessage('Never mind, do this instead')
   await host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
 
+  // Written when the agent's start is proven: a cold start.
+  await vi.waitFor(
+    async () => {
+      expect(await capsule.list(NOW)).toEqual([])
+    },
+    { timeout: 10_000 }
+  )
   expect(await host.restartResume.list()).toEqual([])
-  await vi.waitFor(async () => {
-    expect(await capsule.list(NOW)).toEqual([])
-  })
-  host.release(SESSION, 'pane')
 })
 
-// A journal this host cannot read says nothing about the user moving on, so it must not end the offer.
+// A journal this host cannot read decides nothing, so it must not end the offer.
 it('keeps the offer when the chat cannot be read on this host', async () => {
-  const { host, root } = await interruptedRestart('submission')
+  const { host, root, store } = await interruptedRestart('submission')
   const capsule = new AgentSessionRecoveryCapsule(root)
-  const restoring = vi
-    .spyOn(StructuredAgentSessionReadableRestorer.prototype, 'restoreOne')
-    .mockRejectedValue(new Error('journal unreadable'))
+  const location = store.getRecord(SESSION)?.location
+  if (!location) {
+    throw new Error('missing session record')
+  }
+  // A file where the journal directory belongs: this host cannot open the conversation at all.
+  const journalDir = journalDirectoryFor(root, {
+    workspaceId: location.workspaceId,
+    sessionId: SESSION
+  })
+  await rename(journalDir, `${journalDir}.aside`)
+  await writeFile(journalDir, 'not a journal')
   try {
     expect(await host.restartResume.list()).toMatchObject([{ sessionId: SESSION }])
   } finally {
-    restoring.mockRestore()
+    await rm(journalDir)
+    await rename(`${journalDir}.aside`, journalDir)
   }
   expect(await capsule.list(NOW)).toHaveLength(1)
   expect(await host.restartResume.list()).toMatchObject([{ sessionId: SESSION }])
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-withdrawal.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-withdrawal.test.ts
new file mode 100644
index 00000000000..d36e5702d1d
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-withdrawal.test.ts
@@ -0,0 +1,548 @@
+// A restart offer ends when the chat moves on after the restart: another message accepted, or its
+// agent started, other than by the offer's own continuation. Each case reads the offer list and the
+// capsule, never only an in-memory set.
+
+import { mkdtemp, readFile, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
+import {
+  AgentSessionRecoveryCapsule,
+  AGENT_SESSION_RECOVERY_CAPSULE_FILE
+} from '../../runtime/agent-session-recovery-capsule'
+import { parseAgentSessionResumeMarker } from '../../../shared/agent-session-resume-marker'
+import { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import type { AgentSessionSubscribeEvent } from '../../../shared/agent-session-wire'
+import {
+  interruptedRestart,
+  statusNotes
+} from './structured-agent-session-restart-interruption-test-harness'
+import { CALLER, envelope } from './structured-agent-session-host-test-harness'
+import { STRUCTURED_AGENT_SESSION_IDLE_MS } from './structured-agent-session-idle-sweep'
+import { createStructuredAgentSessionRestartOfferWithdrawal } from './structured-agent-session-restart-offer-withdrawal'
+import { restartContinuationId } from './structured-agent-session-restart-continuation-envelope'
+import { sweepOnce } from './structured-agent-session-rest-test-rig'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  hostTestMessage
+} from './structured-agent-session-host-test-data'
+
+afterEach(() => vi.restoreAllMocks())
+
+const SUPERSEDED = 'agent_session_restart_work_superseded'
+
+/** A start under a loaded machine: reconcile, acquire, hand over. */
+const COLD_START = { timeout: 10_000 }
+
+async function offered(work: 'turn' | 'submission' = 'turn') {
+  const state = await interruptedRestart(work, false)
+  expect(await state.host.restartResume.list()).toHaveLength(1)
+  return state
+}
+
+function offersIn(root: string) {
+  return new AgentSessionRecoveryCapsule(root).list(NOW)
+}
+
+function userSend(text: string) {
+  const body = hostTestMessage(text)
+  return { envelope: envelope('agentSession.send', { body }), body }
+}
+
+function compactParams() {
+  return {
+    command: 'compact' as const,
+    envelope: envelope('agentSession.conversationCommand', { command: 'compact' })
+  }
+}
+
+function sentTexts(dispatch: Awaited<ReturnType<typeof offered>>['dispatch']): string[] {
+  return dispatch.mock.calls.map(([input]) =>
+    input.body.blocks.flatMap((block) => (block.type === 'text' ? [block.text] : [])).join('')
+  )
+}
+
+it('withdraws the offer when /compact starts the agent at rest (R-01)', async () => {
+  const { host, root, acquire } = await offered()
+  Object.assign(host.deps.adapter, { compact: vi.fn(async () => ({})) })
+
+  expect(await host.conversationCommand(CALLER, compactParams())).toMatchObject({ ok: true })
+
+  expect(acquire).toHaveBeenCalledOnce()
+  await vi.waitFor(async () => expect(await offersIn(root)).toEqual([]), COLD_START)
+  expect(await host.restartResume.list()).toEqual([])
+})
+
+it('keeps the offer through every way of looking at the chat (R-02)', async () => {
+  const { host, root, acquire } = await offered()
+  const unsubscribe = await host.subscribe({ id: 'pane', sessionId: SESSION, emit: vi.fn() })
+  await host.history({ sessionId: SESSION, direction: 'tail' })
+  await host.readOptions(SESSION)
+  host.readCommands(SESSION)
+  await host.handoffStatus(SESSION)
+  await host.revealSession(SESSION)
+  unsubscribe()
+
+  expect(acquire).not.toHaveBeenCalled()
+  expect(await host.restartResume.list()).toHaveLength(1)
+  expect(await offersIn(root)).toHaveLength(1)
+})
+
+it("does not let the offer's own continuation withdraw it (R-03)", async () => {
+  const { host, root, dispatch } = await offered()
+  const dismiss = vi.spyOn(AgentSessionRecoveryCapsule.prototype, 'dismiss')
+
+  const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+
+  expect(result.continued).toMatchObject([{ outcome: 'continued' }])
+  expect(dispatch).toHaveBeenCalledOnce()
+  // The start was the continuation's own: whatever asked, it withdrew nothing.
+  for (const call of dismiss.mock.results) {
+    expect(await call.value).toBe(0)
+  }
+  // Ended by the success path instead.
+  expect(await offersIn(root)).toEqual([])
+})
+
+it('refuses the continuation when another start lands inside its action (R-03b)', async () => {
+  const { host, root, dispatch } = await offered()
+  Object.assign(host.deps.adapter, { compact: vi.fn(async () => ({})) })
+  const send = host.send
+  vi.spyOn(host, 'send').mockImplementationOnce(async (caller, params) => {
+    // Another client's /compact starts the agent after the action reserved the offer.
+    expect(await host.conversationCommand(CALLER, compactParams())).toMatchObject({ ok: true })
+    return send(caller, params)
+  })
+
+  const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+
+  expect(result.continued).toMatchObject([{ outcome: 'refused', reason: SUPERSEDED }])
+  expect(dispatch).not.toHaveBeenCalled()
+  expect(await offersIn(root)).toEqual([])
+  expect(result.failed).toEqual([])
+})
+
+it('keeps the offer when a tabbed chat is restored at boot (R-05)', async () => {
+  const { host, store, root, acquire } = await offered()
+  await store.setSessionTabVisibility(SESSION, true)
+
+  await host.restoreReadableSessions([SESSION])
+
+  expect(acquire).not.toHaveBeenCalled()
+  expect(await host.restartResume.list()).toHaveLength(1)
+  expect(await offersIn(root)).toHaveLength(1)
+})
+
+it('reads an older build’s marker whose message id no longer matches, and one with none (R-06)', async () => {
+  const { host, root, dispatch, marker } = await offered('submission')
+  if (!marker) {
+    throw new Error('missing interrupted restart marker')
+  }
+  // The older build compared this id with the chat's newest message; nothing does now.
+  await host.restartResume.dismiss([SESSION])
+  await new AgentSessionRecoveryCapsule(root).record(
+    [{ ...marker, latestUserItemId: 'user-sent-under-the-older-build' }],
+    NOW
+  )
+  expect(await host.restartResume.list()).toHaveLength(1)
+  const { latestUserItemId: _dropped, ...withoutId } = marker
+  expect(parseAgentSessionResumeMarker(withoutId)).toEqual(withoutId)
+
+  await host.send(CALLER, userSend('Carry on'))
+  await vi.waitFor(() => expect(dispatch).toHaveBeenCalledOnce(), COLD_START)
+  await vi.waitFor(async () => expect(await offersIn(root)).toEqual([]), COLD_START)
+})
+
+it('still writes the message id the previous build requires on every marker', async () => {
+  const { root } = await offered('submission')
+  const capsule = JSON.parse(
+    await readFile(join(root, AGENT_SESSION_RECOVERY_CAPSULE_FILE), 'utf8')
+  )
+  expect(capsule.entries[0]?.marker).toHaveProperty('latestUserItemId')
+})
+
+/** Sends a message whose start fails, and waits for it to be rejected. */
+async function sendWhoseStartFails(state: Awaited<ReturnType<typeof offered>>) {
+  state.acquire.mockRejectedValueOnce(new Error('Not signed in'))
+  const params = userSend('while signed out')
+  await state.host.send(CALLER, params)
+  await vi.waitFor(async () =>
+    expect(
+      (await state.host.journalSnapshot(SESSION)).submissions.find(
+        (entry) => entry.clientMessageId === params.envelope.clientOperationId
+      )
+    ).toMatchObject({ dispatchState: 'rejected' })
+  )
+}
+
+// A message the user sent is activity even when its start then failed.
+it('withdraws the offer when the user sends a message whose start then fails (R-08)', async () => {
+  const state = await offered()
+  const { host, root, dispatch } = state
+
+  await sendWhoseStartFails(state)
+
+  expect(await host.restartResume.list()).toEqual([])
+  await vi.waitFor(async () => expect(await offersIn(root)).toEqual([]), COLD_START)
+  // A click from a surface that still shows the offer finds nothing to act on.
+  expect(await host.restartResume.continueAfterRestart([SESSION], 'stale-click')).toMatchObject({
+    resumed: [],
+    continued: []
+  })
+  expect(dispatch).not.toHaveBeenCalled()
+})
+
+// The idle sweep closes a chat's open handle, and the next read opens a new one: the user's message
+// still counts, because it is read against where the journal stood when the offer was taken.
+it('keeps the offer withdrawn after the idle sweep closes the chat and it is read again', async () => {
+  const state = await offered()
+  const { host, root, clock } = state
+  await sendWhoseStartFails(state)
+  clock.now += STRUCTURED_AGENT_SESSION_IDLE_MS + 1
+
+  await sweepOnce(host)
+  expect(host.hasSession(SESSION)).toBe(false)
+  await host.revealSession(SESSION)
+
+  expect(await host.restartResume.list()).toEqual([])
+  // The listing retires what it finds moved on; the write trails the answer.
+  await vi.waitFor(async () => expect(await offersIn(root)).toEqual([]))
+})
+
+// A failure the chat moved on from is read from its journal like an offer is, open or not.
+it('keeps a failure not retryable after the user moved on and the sweep closed the chat', async () => {
+  const state = await offered()
+  const { host, clock } = state
+  state.acquire.mockRejectedValueOnce(new Error('provider could not reconnect'))
+  const resumed = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+  expect(resumed.failed).toMatchObject([{ sessionId: SESSION, retryable: true }])
+  await sendWhoseStartFails(state)
+  expect(await host.restartResume.listFailures()).toMatchObject([{ retryable: false }])
+  clock.now += STRUCTURED_AGENT_SESSION_IDLE_MS + 1
+
+  await sweepOnce(host)
+  expect(host.hasSession(SESSION)).toBe(false)
+
+  expect(await host.restartResume.listFailures()).toMatchObject([{ retryable: false }])
+})
+
+const DAY_AND_AN_HOUR = 25 * 60 * 60 * 1000
+
+// An offer has no expiry; the ledger refuses a new id dated more than a day back.
+it('resumes more than a day after the quit', async () => {
+  const state = await offered()
+  const { host, clock, dispatch } = state
+  clock.now += DAY_AND_AN_HOUR
+
+  const resumed = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+
+  expect(resumed.continued).toMatchObject([{ sessionId: SESSION, outcome: 'continued' }])
+  expect(sentTexts(dispatch)).toHaveLength(1)
+  expect(await host.restartResume.listFailures()).toEqual([])
+})
+
+// The offer remembers its own continuations; nothing about them expires before the offer does.
+it('keeps a failed resume retryable more than a day later, after the ledger pruned its row', async () => {
+  const state = await offered()
+  const { host, clock, store } = state
+  state.acquire.mockRejectedValueOnce(new Error('provider could not reconnect'))
+  const first = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+  expect(first.failed).toMatchObject([{ sessionId: SESSION, retryable: true }])
+  clock.now += DAY_AND_AN_HOUR
+  // What an app restart does to the operation ledger a day on.
+  await store.reconcileOnRestart({
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: reconciliation only reads the probe outcome.
+    probe: async () => ({ outcome: 'pid-absent' }) as never,
+    now: clock.now
+  })
+
+  expect(await host.restartResume.listFailures()).toMatchObject([
+    { sessionId: SESSION, retryable: true }
+  ])
+  const retried = await host.restartResume.continueAfterRestart([SESSION], 'retry')
+  expect(retried.continued).toMatchObject([{ sessionId: SESSION, outcome: 'continued' }])
+})
+
+// The start was the continuation's own even after the provider refused it: the child it started,
+// running or since stopped, is still the offer's, so the offer stays retryable.
+it('keeps a resume retryable when its agent started but refused the continuation', async () => {
+  const state = await offered()
+  const { host, store } = state
+  const acquire = state.acquire.getMockImplementation()
+  if (!acquire) {
+    throw new Error('the harness acquire has no implementation')
+  }
+  state.acquire.mockImplementationOnce(async (input) => ({
+    ...(await acquire(input)),
+    acquisitionGeneration: 'generation-continuation'
+  }))
+  state.dispatch.mockResolvedValueOnce({
+    state: 'rejected',
+    ...agentSessionFailureWords(
+      agentSessionFailureFact('providerRejected', {
+        detail: { text: 'the provider refused the turn', audience: 'log' }
+      }),
+      { surface: 'rejection' }
+    )
+  })
+
+  const first = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+
+  expect(state.acquire).toHaveBeenCalledOnce()
+  expect(first.failed).toMatchObject([{ sessionId: SESSION, retryable: true }])
+  expect(await host.restartResume.listFailures()).toMatchObject([
+    { sessionId: SESSION, retryable: true }
+  ])
+  // The child the continuation started exits after proving its start.
+  await host.handleAdapterEvent({
+    type: 'ended',
+    sessionId: SESSION,
+    fence: store.getRecord(SESSION)?.lease.runtimeFence ?? 0,
+    acquisitionGeneration: 'generation-continuation',
+    reason: 'codex app-server exited',
+    cause: 'unexpected-exit'
+  })
+  expect(await host.restartResume.listFailures()).toMatchObject([
+    { sessionId: SESSION, retryable: true }
+  ])
+  const retried = await host.restartResume.continueAfterRestart([SESSION], 'retry')
+  expect(retried.continued).toMatchObject([{ sessionId: SESSION, outcome: 'continued' }])
+})
+
+// A continuation handed to the agent may have landed even with no answer yet, so a retry could send
+// it twice: the failure it files is not retryable, as for one whose dispatch is in doubt.
+it('keeps an unanswered continuation the agent was handed from being sent again', async () => {
+  const state = await offered()
+  const { host } = state
+  // The agent took it and never answered; the wait for that answer ended first (too many waited).
+  state.dispatch.mockResolvedValueOnce({ state: 'admitted' })
+  const wait = host.waitForSendSettlement
+  vi.spyOn(host, 'waitForSendSettlement').mockImplementation(async (...args) =>
+    args[2]?.until === 'handed-over' ? wait(...args) : undefined
+  )
+
+  const first = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+
+  expect(first.continued).toMatchObject([{ sessionId: SESSION, outcome: 'pending' }])
+  expect(await host.restartResume.listFailures()).toMatchObject([
+    { sessionId: SESSION, outcome: 'unconfirmed', retryable: false }
+  ])
+  expect(await host.restartResume.continueAfterRestart([SESSION], 'retry')).toMatchObject({
+    continued: []
+  })
+  expect(state.dispatch).toHaveBeenCalledOnce()
+})
+
+// The rejected continuation is the chat's newest user message; the row still names the user's.
+it("names the user's prompt on a failed retry, not the rejected continuation", async () => {
+  const state = await offered('submission')
+  const { host } = state
+  state.acquire.mockRejectedValueOnce(new Error('provider could not reconnect'))
+  const first = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+  expect(first.failed).toMatchObject([{ latestPrompt: 'Perform the original task' }])
+
+  state.acquire.mockRejectedValueOnce(new Error('provider could not reconnect'))
+  const retried = await host.restartResume.continueAfterRestart([SESSION], 'retry')
+
+  expect(retried.failed).toMatchObject([
+    { latestPrompt: 'Perform the original task', retryable: true }
+  ])
+})
+
+// Resume that runs by itself at launch goes through the same call a click does, and the same rule
+// decides: whichever of the two was accepted first since the restart wins.
+it("refuses an automatic continuation when the user's message was accepted first, and writes nothing", async () => {
+  const { host, root, dispatch } = await offered()
+  const events: AgentSessionSubscribeEvent[] = []
+  const unsubscribe = await host.subscribe({
+    id: 'pane',
+    sessionId: SESSION,
+    emit: (event) => events.push(structuredClone(event))
+  })
+  const send = host.send
+  vi.spyOn(host, 'send').mockImplementationOnce(async (caller, params) => {
+    // Both accepted before any start, the user's first: the continuation queues behind the user's
+    // acceptance, ahead of the start that acceptance wakes.
+    let continuation: ReturnType<typeof send> | undefined
+    const append = AgentSessionJournal.prototype.appendSubmission
+    vi.spyOn(AgentSessionJournal.prototype, 'appendSubmission').mockImplementationOnce(
+      async function (this: AgentSessionJournal, ...args) {
+        continuation = send(caller, params)
+        await new Promise((resolve) => setTimeout(resolve, 50))
+        return append.apply(this, args)
+      }
+    )
+    await send(CALLER, userSend('A new request'))
+    return continuation!
+  })
+
+  const result = await host.restartResume.continueAfterRestart(undefined, 'launch')
+
+  expect(result.continued).toMatchObject([{ outcome: 'refused', reason: SUPERSEDED }])
+  await vi.waitFor(() => expect(dispatch).toHaveBeenCalledOnce(), COLD_START)
+  expect(sentTexts(dispatch)).toEqual(['A new request'])
+  // Nothing the user did failed: no row reached the reader, and nothing is kept.
+  expect(await statusNotes(host)).toEqual([])
+  expect(
+    events.some(
+      (event) =>
+        event.type === 'batch' && event.batch.items.some((item) => item.body.kind === 'status')
+    )
+  ).toBe(false)
+  expect(await offersIn(root)).toEqual([])
+  expect(await new AgentSessionRecoveryCapsule(root).listFailed(NOW)).toEqual([])
+  unsubscribe()
+})
+
+it('delivers a clicked continuation and a message sent right after it, in the order accepted', async () => {
+  const { host, root, dispatch } = await offered()
+  const send = host.send
+  vi.spyOn(host, 'send').mockImplementationOnce(async (caller, params) => {
+    const continuation = send(caller, params)
+    const user = send(CALLER, userSend('And then this'))
+    await user
+    return continuation
+  })
+
+  const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+
+  expect(result.continued).toMatchObject([{ outcome: 'continued' }])
+  await vi.waitFor(() => expect(dispatch).toHaveBeenCalledTimes(2), COLD_START)
+  const [first, second] = sentTexts(dispatch)
+  expect(first).not.toBe('And then this')
+  expect(second).toBe('And then this')
+  expect(await offersIn(root)).toEqual([])
+})
+
+describe('reading the chat against where the offer was taken', () => {
+  const TAKEN = { epoch: 'epoch-1', sequence: 5 }
+
+  const OFFER = {
+    sessionId: SESSION,
+    work: { kind: 'turn' as const, id: 'turn-1' },
+    recordedAt: NOW,
+    trigger: 'quit' as const,
+    providerHandleRoot: 'codex:"thread"',
+    teardownId: 'teardown-1'
+  }
+
+  function movedOn(
+    input: {
+      epoch?: string
+      submissions?: {
+        clientMessageId: string
+        acceptedSequence: number
+        dispatchState: string
+        handoverRecorded?: boolean
+        handedOverAt?: number
+      }[]
+    },
+    journalCursor: { epoch: string; sequence: number } | null = TAKEN
+  ): boolean {
+    const session = {
+      child: null,
+      journal: {
+        cursor: () => ({ epoch: input.epoch ?? TAKEN.epoch, sequence: 9 }),
+        submissions: () => input.submissions ?? []
+      }
+    }
+    const withdrawal = createStructuredAgentSessionRestartOfferWithdrawal({
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the fact reads only the journal's cursor and submissions and the child fields given here.
+      sessions: new Map([[SESSION, session as never]]),
+      now: () => NOW,
+      enqueue: (operation) => operation()
+    })
+    return withdrawal.movedOn({ ...OFFER, ...(journalCursor ? { journalCursor } : {}) })
+  }
+
+  it('counts a message accepted after that position, and nothing before it', () => {
+    const at = (acceptedSequence: number) => ({
+      clientMessageId: `m-${acceptedSequence}`,
+      acceptedSequence,
+      dispatchState: 'rejected'
+    })
+    expect(movedOn({ submissions: [at(4), at(5)] })).toBe(false)
+    expect(movedOn({ submissions: [at(4), at(6)] })).toBe(true)
+  })
+
+  it('counts a journal on another epoch as moved on', () => {
+    expect(movedOn({ epoch: 'epoch-2' })).toBe(true)
+  })
+
+  it("does not count the offer's own continuation while queued or rejected, so a retry still runs", () => {
+    const own = restartContinuationId(OFFER, 'operation-1', NOW)
+    const rejected = { clientMessageId: own, acceptedSequence: 7, dispatchState: 'rejected' }
+    const queued = { ...rejected, dispatchState: 'pending', handoverRecorded: true }
+    expect(movedOn({ submissions: [rejected] })).toBe(false)
+    expect(movedOn({ submissions: [queued] })).toBe(false)
+    // Handed over, it may have reached the agent, answered or not.
+    expect(movedOn({ submissions: [{ ...queued, handedOverAt: NOW }] })).toBe(true)
+    expect(movedOn({ submissions: [{ ...rejected, dispatchState: 'accepted' }] })).toBe(true)
+    // Another offer's continuation, and any other message, is the chat moving on.
+    const other = restartContinuationId({ ...OFFER, teardownId: 'teardown-2' }, 'operation-1', NOW)
+    expect(movedOn({ submissions: [{ ...rejected, clientMessageId: other }] })).toBe(true)
+  })
+
+  // The retry's reservation lapses with the app, and the capsule hands back the failure's marker,
+  // written before the retry ran. The next launch rejects the retry's queued continuation.
+  it('keeps a failure retryable after the app crashed during its retry', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-crash-during-retry-'))
+    try {
+      const capsule = new AgentSessionRecoveryCapsule(root)
+      await capsule.record([{ ...OFFER, journalCursor: TAKEN }], NOW)
+      await capsule.beginResume([SESSION], 'operation-a', NOW)
+      await capsule.failResume(
+        'operation-a',
+        [
+          {
+            sessionId: SESSION,
+            failedAt: NOW,
+            outcome: 'refused',
+            reason: 'x',
+            latestPrompt: '',
+            latestUserItemId: null
+          }
+        ],
+        NOW
+      )
+      const [retrying] = await capsule.beginResume([SESSION], 'operation-b', NOW + 1)
+      if (!retrying) {
+        throw new Error('the retry reserved nothing')
+      }
+      const retry = restartContinuationId(retrying, 'operation-b', NOW + 1)
+      const afterCrash = NOW + 60 * 60_000
+      expect(await capsule.list(afterCrash)).toEqual([])
+      const [failed] = await capsule.listFailed(afterCrash)
+
+      const session = {
+        child: null,
+        journal: {
+          cursor: () => ({ epoch: TAKEN.epoch, sequence: 9 }),
+          submissions: () => [
+            { clientMessageId: retry, acceptedSequence: 7, dispatchState: 'rejected' }
+          ]
+        }
+      }
+      const withdrawal = createStructuredAgentSessionRestartOfferWithdrawal({
+        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the fact reads only the journal's cursor and submissions and the child fields given here.
+        sessions: new Map([[SESSION, session as never]]),
+        now: () => afterCrash,
+        enqueue: (operation) => operation()
+      })
+      if (!failed) {
+        throw new Error('the failure did not outlive the crash')
+      }
+      expect(withdrawal.movedOn(failed.marker)).toBe(false)
+    } finally {
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
+  it('leaves an older build’s offer, which recorded no position, to a start', () => {
+    const after = { clientMessageId: 'm-7', acceptedSequence: 7, dispatchState: 'accepted' }
+    expect(movedOn({ submissions: [after], epoch: 'epoch-2' }, null)).toBe(false)
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-withdrawal.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-withdrawal.ts
new file mode 100644
index 00000000000..76d8006d9a1
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-withdrawal.ts
@@ -0,0 +1,92 @@
+// When a restart offer ends without being acted on: the chat moved on.
+//
+// One derived fact decides it, for the offer list and for the continuation's own acceptance alike:
+// since the offer was taken, another message was accepted in the chat, or its agent proved a start.
+// A message is read against the journal position the offer recorded, so the answer survives any
+// number of handle closes. A start is known only to the host that saw it, so it is also written
+// to the recovery file when it happens. A restored row, a replayed row or a view carries neither,
+// so opening a chat withdraws nothing. The rest of a resume action does not count: its own
+// continuation, and the start that continuation waits on.
+
+import type { AgentSessionRecoveryCapsule } from '../../runtime/agent-session-recovery-capsule'
+import type { AgentSessionResumeMarker } from '../../../shared/agent-session-resume-marker'
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+import { isRestartContinuationOf } from './structured-agent-session-restart-continuation-envelope'
+
+export type StructuredAgentSessionRestartOfferWithdrawal = ReturnType<
+  typeof createStructuredAgentSessionRestartOfferWithdrawal
+>
+
+export type StructuredAgentSessionRestartOfferSession = Pick<
+  StructuredAgentSessionHostSession,
+  'journal' | 'child' | 'lastEndedChild'
+>
+
+export function createStructuredAgentSessionRestartOfferWithdrawal(deps: {
+  sessions: ReadonlyMap<string, StructuredAgentSessionRestartOfferSession>
+  capsule?: Pick<AgentSessionRecoveryCapsule, 'dismiss'>
+  now: () => number
+  /** The capsule's single mutation lane, shared with the offer's own operations. */
+  enqueue: <T>(operation: () => Promise<T>) => Promise<T>
+}) {
+  const movedOn = (marker: AgentSessionResumeMarker): boolean => {
+    const session = deps.sessions.get(marker.sessionId)
+    if (!session) {
+      return false
+    }
+    const taken = marker.journalCursor
+    // An older build's offer recorded no position: only a start withdraws it.
+    const accepted =
+      taken !== undefined &&
+      (session.journal.cursor().epoch !== taken.epoch ||
+        session.journal.submissions().some(
+          (submission) =>
+            (submission.acceptedSequence ?? 0) > taken.sequence &&
+            // The offer's own continuation, still queued or rejected, never reached the agent: a
+            // retry sends a new one. One handed over may have, answered or not.
+            !(
+              (isQueuedAgentJournalSubmission(submission) ||
+                submission.dispatchState === 'rejected') &&
+              isRestartContinuationOf(marker, submission.clientMessageId)
+            )
+        ))
+    // Proven, not merely spawned: a start that failed during startup never ran the agent. Whose
+    // start it was is fixed when it was made, so a continuation rejected since still owns it.
+    const started =
+      session.child?.phase === 'ready'
+        ? session.child
+        : session.lastEndedChild?.duringStartup === false
+          ? session.lastEndedChild
+          : undefined
+    return (
+      accepted ||
+      (started !== undefined &&
+        !(started.startedFor !== undefined && isRestartContinuationOf(marker, started.startedFor)))
+    )
+  }
+
+  return {
+    movedOn,
+    /** The chat's agent proved a start: the offer and any failure record go from the recovery file,
+     *  unless the start was for one of that offer's own continuations. Advisory: a failed write is
+     *  logged, never raised. */
+    onAgentStarted: (sessionId: string): void => {
+      const session = deps.sessions.get(sessionId)
+      const capsule = deps.capsule
+      if (!capsule || !session) {
+        return
+      }
+      const startedFor = session.child?.startedFor
+      void deps
+        .enqueue(() =>
+          capsule.dismiss([sessionId], deps.now(), (marker) =>
+            startedFor === undefined ? false : isRestartContinuationOf(marker, startedFor)
+          )
+        )
+        .catch(() => {
+          console.warn('[structured-agent-session] withdrawing a restart offer failed')
+        })
+    }
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-ownership.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-ownership.test.ts
index c3301861c01..59ff6958d53 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-ownership.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-ownership.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { mkdir, rm, writeFile } from 'node:fs/promises'
 import {
   AgentSessionRecoveryCapsule,
@@ -7,8 +8,6 @@ import { parseAgentSessionResumeMarker } from '../../../shared/agent-session-res
 import { join } from 'node:path'
 import { afterEach, expect, it, vi } from 'vitest'
 import { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import { pendingApproval } from './structured-agent-session-restart-resume-test-harness'
-import { restartContinuationEnvelope } from './structured-agent-session-restart-continuation'
 import {
   AGENT_SESSION_RESTART_CONTINUATION_NOTE,
   AGENT_SESSION_RESTART_CONTINUATION_REFUSED_NOTE,
@@ -16,8 +15,8 @@ import {
 } from '../../../shared/agent-session-restart-continuation'
 import { STRUCTURED_AGENT_SESSION_RESTART_CONTINUATION_CALLER } from './structured-agent-session-restart-resume-wiring'
 import {
-  GRACE,
   interruptedRestart,
+  startAgent,
   statusNotes,
   supersededRefusal
 } from './structured-agent-session-restart-interruption-test-harness'
@@ -33,6 +32,8 @@ import {
   HOST_TEST_THREAD as THREAD,
   hostTestMessage
 } from './structured-agent-session-host-test-data'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
 
 afterEach(() => vi.useRealTimers())
 
@@ -40,7 +41,7 @@ it('publishes continuation attribution to the subscribed chat without another pr
   const { host } = await interruptedRestart()
   await host.restartResume.list()
   const emit = vi.fn()
-  const unsubscribe = host.subscribe({ id: 'pane', sessionId: SESSION, emit })
+  const unsubscribe = await host.subscribe({ id: 'pane', sessionId: SESSION, emit })
   try {
     expect(
       (await host.restartResume.continueAfterRestart([SESSION], 'modal')).continued
@@ -81,273 +82,75 @@ it.each(['turn', 'submission'] as const)(
   async (work) => {
     const { host, dispatch } = await interruptedRestart(work, false)
     expect(await host.restartResume.list()).toHaveLength(1)
-    await host.hold(SESSION, 'pane')
+    await startAgent(hostTestState())
     dispatch.mockResolvedValueOnce({ state: 'admitted' })
     const body = hostTestMessage('Stop the old task and do this instead')
     await host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
     await host.restartResume.continueAfterRestart([SESSION], 'modal')
     expect(dispatch).toHaveBeenCalledTimes(1)
-    expect(host.journalSnapshot(SESSION).submissions).toHaveLength(work === 'turn' ? 1 : 2)
-    host.release(SESSION, 'pane')
-    expect(host.isHeld(SESSION)).toBe(false)
+    expect((await host.journalSnapshot(SESSION)).submissions).toHaveLength(work === 'turn' ? 1 : 2)
   }
 )
 
-it('preserves the offer when the original submission receives its provider echo', async () => {
-  const { host, acquire, dispatch } = await interruptedRestart('submission', false)
-  expect(await host.restartResume.list()).toHaveLength(1)
-  await host.hold(SESSION, 'pane')
-  const events = acquire.mock.calls[0]?.[0].events
-  if (!events) {
-    throw new Error('missing resumed provider event sink')
-  }
-  events.appendItem(
-    { provider: 'codex', threadId: THREAD, turnId: 'original-turn', ordinal: 1 },
-    hostTestMessage('Perform the original task')
-  )
-  await host.flushStreamedEvents(SESSION)
-  expect(host.journalSnapshot(SESSION).submissions[0]?.dispatchState).toBe('accepted')
-  expect(
-    (await host.restartResume.continueAfterRestart([SESSION], 'modal')).continued
-  ).toMatchObject([{ outcome: 'continued' }])
-  expect(acquire).toHaveBeenCalledTimes(1)
-  expect(dispatch).toHaveBeenCalledTimes(1)
-  host.release(SESSION, 'pane')
-  expect(host.isHeld(SESSION)).toBe(false)
-})
-
-// Teardown judged the chat working, and only the user moving on withdraws that. A send the
-// provider proves it never received is still the chat Orca stopped; the continuation asks the agent
+// Teardown judged the chat working. A send the provider proves it never received is still the chat
+// Orca stopped; the continuation asks the agent
 // to check what finished rather than refusing.
 it('still continues a chat whose last send acquisition proves was never delivered', async () => {
   const { host, acquire, dispatch } = await interruptedRestart('submission')
   expect(await host.restartResume.list()).toHaveLength(1)
   const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
-  expect(host.journalSnapshot(SESSION).submissions[0]).toMatchObject({
+  expect((await host.journalSnapshot(SESSION)).submissions[0]).toMatchObject({
     dispatchState: 'rejected',
-    reason: 'not_delivered'
+    rejection: { kind: 'notDelivered' }
   })
   expect(acquire).toHaveBeenCalledTimes(1)
   expect(dispatch).toHaveBeenCalledTimes(1)
   expect(result.continued).toMatchObject([{ outcome: 'continued' }])
-  expect(host.isHeld(SESSION)).toBe(false)
 })
 
-/** Holds the continuation at send admission while `during` runs, then lets it proceed. */
-async function continueAcross(
-  state: Awaited<ReturnType<typeof interruptedRestart>>,
-  during: (events: NonNullable<ReturnType<typeof resumedEvents>>) => void
-) {
-  const { host, store } = state
-  expect(await host.restartResume.list()).toHaveLength(1)
-  await host.hold(SESSION, 'pane')
-  const events = resumedEvents(state)
-  if (!events) {
-    throw new Error('missing resumed provider event sink')
-  }
-  const admitting = Promise.withResolvers<void>()
-  const proceed = Promise.withResolvers<void>()
-  const admit = store.admitMutationOperation
-  vi.spyOn(store, 'admitMutationOperation').mockImplementationOnce(async (input) => {
-    admitting.resolve()
-    await proceed.promise
-    return admit(input)
-  })
-  const continuing = host.restartResume.continueAfterRestart([SESSION], 'modal')
-  await admitting.promise
-  during(events)
-  await host.flushStreamedEvents(SESSION)
-  proceed.resolve()
-  return continuing
-}
-
-function resumedEvents(state: Awaited<ReturnType<typeof interruptedRestart>>) {
-  return state.acquire.mock.calls[0]?.[0].events
-}
-
-it('refuses at send admission once the user has sent a newer message', async () => {
-  const state = await interruptedRestart()
-  const { host, dispatch } = state
-  const result = await continueAcross(state, (events) =>
-    events.appendItem(
-      { provider: 'codex', threadId: THREAD, turnId: 'newer-turn', ordinal: 1 },
-      hostTestMessage('A newer task from another client')
-    )
-  )
-  expect(result.resumed).toMatchObject([
-    { outcome: 'refused', reason: 'agent_session_restart_work_superseded' }
-  ])
-  expect(dispatch).not.toHaveBeenCalled()
-  expect(host.journalSnapshot(SESSION).submissions).toMatchObject([
-    { dispatchState: 'rejected', reason: 'agent_session_restart_work_superseded' }
-  ])
-  host.release(SESSION, 'pane')
-  expect(host.isHeld(SESSION)).toBe(false)
-})
-
-// Claude opens a turn of its own on reattach to say the last session did not finish. Resume is
-// pressed while that turn still runs: the continuation is sent and the provider queues it.
-it('sends the continuation while a turn the provider opened is still running', async () => {
-  const state = await interruptedRestart()
-  const { host, dispatch } = state
-  const result = await continueAcross(state, (events) =>
-    events.appendItem(
-      { provider: 'codex', threadId: THREAD, turnId: 'notice-turn', ordinal: 1 },
-      { kind: 'turn', turnId: 'notice-turn', state: 'running' }
-    )
-  )
-  expect(result.continued).toMatchObject([{ outcome: 'continued' }])
-  expect(dispatch).toHaveBeenCalledTimes(1)
-  host.release(SESSION, 'pane')
-})
-
-// The send the user made just before quitting, after an earlier exchange had finished. Neither
-// that finished turn nor the provider completing the send's own turn after the restart withdraws it.
+// The send the user made just before quitting, after an earlier exchange had finished: that
+// finished turn does not withdraw it.
 it('offers and continues a send made after an earlier completed turn', async () => {
-  const state = await interruptedRestart('send-after-reply', false)
-  const { host, dispatch, marker } = state
+  const { host, dispatch, marker } = await interruptedRestart('send-after-reply', false)
   expect(marker?.work.kind).toBe('submission')
-  const result = await continueAcross(state, (events) =>
-    events.appendItem(
-      { provider: 'codex', threadId: THREAD, turnId: 'original-turn', ordinal: 1 },
-      { kind: 'turn', turnId: 'original-turn', state: 'completed' }
-    )
-  )
+  const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
   expect(result.continued).toMatchObject([{ outcome: 'continued' }])
   expect(dispatch).toHaveBeenCalledTimes(1)
-  host.release(SESSION, 'pane')
 })
 
-it.each([false, true])(
-  'refuses a queued newer message before dispatch even if later settlement fails: %s',
-  async (settlementFails) => {
-    const { host, store, acquire, dispatch } = await interruptedRestart('submission', false)
-    expect(await host.restartResume.list()).toHaveLength(1)
-    await host.hold(SESSION, 'pane')
-    const events = acquire.mock.calls[0]?.[0].events
-    if (!events) {
-      throw new Error('missing resumed provider event sink')
-    }
-    const warning = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    const settle = store.recordOperationOutcome.bind(store)
-    let admitted = false
-    vi.spyOn(store, 'recordOperationOutcome').mockImplementation(async (input) => {
-      if (admitted) {
-        if (settlementFails) {
-          throw new Error('operation outcome could not be persisted')
-        }
-        return settle(input)
-      }
-      await settle(input)
-      admitted = true
-      events.appendItem(
-        { provider: 'codex', threadId: THREAD, turnId: 'original-turn', ordinal: 2 },
-        { kind: 'status', text: 'Provider finished its last action' }
-      )
-      events.appendItem(
-        { provider: 'codex', threadId: THREAD, turnId: 'original-turn', ordinal: 1 },
-        hostTestMessage('A newer task from another client'),
-        { lifecycle: true }
-      )
-    })
-
-    const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
-
-    expect(result.continued).toMatchObject([
-      { outcome: 'refused', reason: 'agent_session_restart_work_superseded' }
-    ])
-    expect(dispatch).not.toHaveBeenCalled()
-    expect(host.journalSnapshot(SESSION).submissions).toHaveLength(2)
-    expect(host.journalSnapshot(SESSION).submissions[1]?.dispatchState).toBe('rejected')
-    host.release(SESSION, 'pane')
-    expect(host.isHeld(SESSION)).toBe(false)
-    // The offer is spent, but the refusal is kept as a durable failure: a retry finds it, and the
-    // superseded chat is still not eligible, so nothing runs and the record stays for the user.
-    expect(await host.restartResume.continueAfterRestart([SESSION], 'retry')).toMatchObject({
-      resumed: [],
-      continued: [],
-      sessions: [],
-      failed: [
-        { sessionId: SESSION, outcome: 'refused', reason: 'agent_session_restart_work_superseded' }
-      ]
-    })
-    expect(dispatch).not.toHaveBeenCalled()
-    if (settlementFails) {
-      expect(store.recordOperationOutcome).toHaveBeenCalledOnce()
-      expect(warning).not.toHaveBeenCalled()
-    }
-    warning.mockRestore()
-  }
-)
-
-// What the provider says after reattaching does not re-judge the offer.
-it.each(['completed', 'approval', 'question'] as const)(
-  'continues past provider %s evidence accepted while recording the continuation',
-  async (event) => {
-    const { host, acquire, dispatch } = await interruptedRestart()
-    await host.restartResume.list()
-    await host.hold(SESSION, 'pane')
-    const events = acquire.mock.calls[0]?.[0].events
-    if (!events) {
-      throw new Error('missing resumed provider event sink')
-    }
-    const append = AgentSessionJournal.prototype.appendSubmission
-    const writing = vi.spyOn(AgentSessionJournal.prototype, 'appendSubmission')
-    writing.mockImplementationOnce(async function (this: AgentSessionJournal, input) {
-      const cursor = await append.call(this, input)
-      events.appendItem(
-        { provider: 'codex', threadId: THREAD, turnId: 'interrupted-turn', ordinal: 1 },
-        event === 'completed'
-          ? { kind: 'turn', turnId: 'interrupted-turn', state: 'completed' }
-          : { ...pendingApproval().body, question: 'Which action?', kind: event },
-        { lifecycle: true }
-      )
-      return cursor
-    })
-    try {
-      const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
-      expect(result.continued).toMatchObject([{ outcome: 'continued' }])
-      expect(dispatch).toHaveBeenCalledTimes(1)
-    } finally {
-      writing.mockRestore()
-      host.release(SESSION, 'pane')
-    }
-  }
-)
-
 it('replays the same logical continuation through the durable send ledger', async () => {
-  const { host, store, dispatch, marker } = await interruptedRestart()
-  if (!marker) {
-    throw new Error('missing interrupted restart marker')
-  }
+  const { host, dispatch } = await interruptedRestart()
+  const sending = vi.spyOn(host, 'send')
   await host.restartResume.continueAfterRestart([SESSION], 'modal')
-  const fence = store.getRecord(SESSION)?.lease.runtimeFence
-  if (fence === undefined) {
-    throw new Error('missing resumed lease')
+  const sent = sending.mock.calls[0]?.[1]
+  sending.mockRestore()
+  if (!sent) {
+    throw new Error('the continuation was not sent')
   }
   const replay = await host.send(
     { callerKey: STRUCTURED_AGENT_SESSION_RESTART_CONTINUATION_CALLER },
-    restartContinuationEnvelope(SESSION, fence, marker)
+    { envelope: sent.envelope, body: sent.body }
   )
   expect(replay).toMatchObject({ ok: true, replayed: true })
-  expect(host.journalSnapshot(SESSION).submissions).toHaveLength(1)
+  expect((await host.journalSnapshot(SESSION)).submissions).toHaveLength(1)
   expect(dispatch).toHaveBeenCalledTimes(1)
 })
 
+// A send that throws after Orca may have taken it is not proof it was not delivered.
 it.each([false, true])(
-  'keeps dispatched delivery unconfirmed when settlement fails (uncertainty write fails: %s)',
+  'keeps a continuation unconfirmed when its acceptance cannot be recorded (uncertainty write fails: %s)',
   async (uncertaintyFails) => {
-    const { host, store, dispatch } = await interruptedRestart()
+    const { host, store } = await interruptedRestart()
     const warning = vi.spyOn(console, 'warn').mockImplementation(() => {})
     expect(await host.restartResume.list()).toHaveLength(1)
-    await host.hold(SESSION, 'pane')
     const settle = store.recordOperationOutcome.bind(store)
-    let dispatched = false
-    vi.spyOn(store, 'recordOperationOutcome').mockImplementation(async (input) => {
-      if (input.outcome.status === 'succeeded') {
-        dispatched = true
-      }
-      if (dispatched && (input.outcome.status === 'succeeded' || uncertaintyFails)) {
+    const recording = vi.spyOn(store, 'recordOperationOutcome')
+    recording.mockImplementation(async (input) => {
+      // Only the continuation's own record: the start it makes records its attach as usual.
+      if (
+        input.callerKey === STRUCTURED_AGENT_SESSION_RESTART_CONTINUATION_CALLER &&
+        (input.outcome.status === 'succeeded' || uncertaintyFails)
+      ) {
         throw new Error('operation outcome could not be persisted')
       }
       return settle(input)
@@ -355,127 +158,96 @@ it.each([false, true])(
 
     const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
 
-    expect(dispatch).toHaveBeenCalledTimes(1)
-    expect(host.journalSnapshot(SESSION).submissions[0]?.dispatchState).toBe('accepted')
     expect(result.continued).toMatchObject([{ sessionId: SESSION, outcome: 'unknown' }])
-    // Filed as unconfirmed, with a warning in the chat; the continuation's own message is part of
-    // the filed state, so it does not retire the record it caused.
+    // Filed as unconfirmed, with a warning in the chat.
     expect(result.failed).toMatchObject([{ sessionId: SESSION, outcome: 'unconfirmed' }])
-    expect(statusNotes(host)).toContainEqual({
+    expect(await statusNotes(host)).toContainEqual({
       text: AGENT_SESSION_RESTART_CONTINUATION_UNCONFIRMED_NOTE,
       tone: 'warning'
     })
-    host.release(SESSION, 'pane')
-    expect(host.isHeld(SESSION)).toBe(false)
-    await host.restartResume.continueAfterRestart([SESSION], 'retry')
-    expect(dispatch).toHaveBeenCalledTimes(1)
-    expect(await host.restartResume.listFailures()).toMatchObject([{ outcome: 'unconfirmed' }])
-    expect(warning.mock.calls.flat()).not.toContainEqual(
-      expect.objectContaining({ message: 'operation outcome could not be persisted' })
-    )
+    recording.mockRestore()
     warning.mockRestore()
   }
 )
 
-it('releases a failed acquisition and leaves the offer retryable', async () => {
+// The continuation is accepted, then its start fails: the message is rejected with the cause and
+// the failure is filed, and nothing is stopped because nothing started.
+it('rejects the continuation when its start fails, and files a retryable refusal', async () => {
   const { host, acquire, dispatch, closeSession } = await interruptedRestart()
   acquire.mockRejectedValueOnce(new Error('provider could not reconnect'))
-  expect(await host.restartResume.resume([SESSION], 'modal')).toMatchObject([
-    { outcome: 'refused' }
+  const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+  expect(result.resumed).toMatchObject([{ outcome: 'refused' }])
+  expect(result.continued).toMatchObject([{ outcome: 'refused' }])
+  // Nothing ran, so the offer stands as a failure a retry can act on.
+  expect(result.failed).toMatchObject([{ sessionId: SESSION, outcome: 'refused', retryable: true }])
+  expect(await statusNotes(host)).toContainEqual({
+    text: AGENT_SESSION_RESTART_CONTINUATION_REFUSED_NOTE,
+    tone: 'error'
+  })
+  expect((await host.journalSnapshot(SESSION)).submissions).toMatchObject([
+    { dispatchState: 'rejected' }
   ])
-  expect(host.isHeld(SESSION)).toBe(false)
-  await host.restartResume.continueAfterRestart([SESSION], 'retry')
-  expect(acquire).toHaveBeenCalledTimes(2)
-  expect(dispatch).toHaveBeenCalledTimes(1)
+  expect(acquire).toHaveBeenCalledTimes(1)
+  expect(dispatch).not.toHaveBeenCalled()
   expect(closeSession).not.toHaveBeenCalled()
 })
 
-it.each([false, true])(
-  'admits one durable continuation under concurrent calls (pane already live: %s)',
-  async (alreadyLive) => {
-    const { host, root, acquire, dispatch } = await interruptedRestart()
-    if (alreadyLive) {
-      expect(await host.restartResume.list()).toHaveLength(1)
-      await host.hold(SESSION, 'pane')
-    }
-    const results = await Promise.all([
-      host.restartResume.continueAfterRestart([SESSION], 'window-one'),
-      host.restartResume.continueAfterRestart([SESSION], 'window-two')
-    ])
-    expect(
-      results.flatMap((result) => result.resumed).filter((r) => r.outcome === 'resumed')
-    ).toHaveLength(1)
-    expect(
-      results.flatMap((result) => result.continued).filter((r) => r.outcome === 'continued')
-    ).toHaveLength(1)
-    expect(acquire).toHaveBeenCalledTimes(1)
-    expect(dispatch).toHaveBeenCalledTimes(1)
-    expect(host.journalSnapshot(SESSION).submissions).toHaveLength(1)
-    expect(await new AgentSessionRecoveryCapsule(root).list(NOW)).toEqual([])
-    await host.restartResume.continueAfterRestart([SESSION], 'later-click')
-    expect(dispatch).toHaveBeenCalledTimes(1)
-    host.release(SESSION, 'pane')
-  }
-)
+it('admits one durable continuation under concurrent calls', async () => {
+  const { host, root, acquire, dispatch } = await interruptedRestart()
+  const results = await Promise.all([
+    host.restartResume.continueAfterRestart([SESSION], 'window-one'),
+    host.restartResume.continueAfterRestart([SESSION], 'window-two')
+  ])
+  expect(
+    results.flatMap((result) => result.resumed).filter((r) => r.outcome === 'resumed')
+  ).toHaveLength(1)
+  expect(
+    results.flatMap((result) => result.continued).filter((r) => r.outcome === 'continued')
+  ).toHaveLength(1)
+  expect(acquire).toHaveBeenCalledTimes(1)
+  expect(dispatch).toHaveBeenCalledTimes(1)
+  expect((await host.journalSnapshot(SESSION)).submissions).toHaveLength(1)
+  expect(await new AgentSessionRecoveryCapsule(root).list(NOW)).toEqual([])
+  await host.restartResume.continueAfterRestart([SESSION], 'later-click')
+  expect(dispatch).toHaveBeenCalledTimes(1)
+})
 
-it.each([false, true])(
-  'releases reconnect acquisition to idle eviction (pane: %s)',
-  async (pane) => {
-    const { host, acquire, dispatch, closeSession } = await interruptedRestart()
-    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
-    expect(await host.restartResume.resume([SESSION], 'modal')).toMatchObject([
-      { outcome: 'resumed' }
-    ])
-    expect(host.isHeld(SESSION)).toBe(false)
-    if (pane) {
-      await host.hold(SESSION, 'pane')
-      await vi.advanceTimersByTimeAsync(GRACE * 2)
-      expect(closeSession).not.toHaveBeenCalled()
-      host.release(SESSION, 'pane')
-    }
-    await vi.advanceTimersByTimeAsync(GRACE)
-    await vi.waitFor(() => expect(closeSession).toHaveBeenCalledTimes(1))
-    expect(acquire).toHaveBeenCalledTimes(1)
-    expect(dispatch).not.toHaveBeenCalled()
-  }
-)
-
-it('retains acquisition through slow continuation settlement, then releases it', async () => {
-  const { host, dispatch, closeSession } = await interruptedRestart()
-  vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+// The batch counts a chat done once its agent took the continuation; the provider's slow answer is
+// awaited after, and decides the outcome.
+it('waits out a slow provider answer before reporting the continuation', async () => {
+  const { host, dispatch } = await interruptedRestart()
   const settlement = Promise.withResolvers<Awaited<ReturnType<typeof dispatch>>>()
   const dispatched = Promise.withResolvers<void>()
   dispatch.mockImplementationOnce(() => {
     dispatched.resolve()
     return settlement.promise
   })
-  const continuing = host.restartResume.continueAfterRestart([SESSION], 'modal')
+  let settled = false
+  const continuing = host.restartResume
+    .continueAfterRestart([SESSION], 'modal')
+    .finally(() => (settled = true))
   await dispatched.promise
-  await vi.advanceTimersByTimeAsync(GRACE * 2)
-  expect(host.isHeld(SESSION)).toBe(true)
-  expect(closeSession).not.toHaveBeenCalled()
-  settlement.resolve({ state: 'rejected', reason: 'provider refused' })
+  await new Promise((resolve) => setTimeout(resolve, 20))
+  expect(settled).toBe(false)
+  settlement.resolve({
+    state: 'rejected',
+    ...agentSessionFailureWords(agentSessionFailureFact('providerRejected'), {
+      surface: 'rejection'
+    })
+  })
   expect((await continuing).continued).toMatchObject([{ outcome: 'refused' }])
-  expect(host.isHeld(SESSION)).toBe(false)
-  await vi.advanceTimersByTimeAsync(GRACE)
-  await vi.waitFor(() => expect(closeSession).toHaveBeenCalledTimes(1))
   expect(dispatch).toHaveBeenCalledTimes(1)
 })
 
-// Opening the chat is inspection only. The explicit restart action is what removes the durable
-// offer, so ordinary pane lifecycle must not make this status disappear.
+// Opening the chat is inspection only: it starts nothing, and the explicit restart action is what
+// removes the durable offer, so reading the chat must not make this status disappear.
 it('keeps offering a chat after the user opens it', async () => {
-  const { host, root, store } = await interruptedRestart()
+  const { host, root, acquire } = await interruptedRestart()
   expect(await host.restartResume.list()).toHaveLength(1)
-  vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
-  await host.hold(SESSION, 'pane')
-  host.release(SESSION, 'pane')
-  await vi.advanceTimersByTimeAsync(GRACE)
-  // The whole eviction, not just the provider stop: the lease returns to `released` on the step
-  // before the last, and until it does the offer is refused for a reason that is not recovery.
-  await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
-  expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
-  vi.useRealTimers()
+  const unsubscribe = await host.subscribe({ id: 'pane', sessionId: SESSION, emit: vi.fn() })
+  await host.history({ sessionId: SESSION, direction: 'tail' })
+  unsubscribe()
+  expect(acquire).not.toHaveBeenCalled()
 
   expect(await host.restartResume.list()).toHaveLength(1)
   await host.restartResume.recordMarkers()
@@ -508,7 +280,8 @@ it('serializes teardown publication behind an explicit dismissal', async () => {
   }
   events.appendItem(
     { provider: 'codex', threadId: THREAD, turnId: 'working', ordinal: 1 },
-    { kind: 'turn', turnId: 'working', state: 'running' }
+    { kind: 'turn', turnId: 'working', state: 'running' },
+    { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
   await host.flushStreamedEvents(SESSION)
   host.restartResume.beginTeardown('quit')
@@ -544,7 +317,7 @@ it('keeps concurrent recovery reads independent and non-destructive', async () =
   list.mockRestore()
 })
 
-it('fails closed on corrupt recovery storage while ordinary hold and send still work', async () => {
+it('fails closed on corrupt recovery storage while an ordinary send still works', async () => {
   const { host, root, dispatch } = await interruptedRestart()
   await writeFile(join(root, AGENT_SESSION_RECOVERY_CAPSULE_FILE), '{')
   const warning = vi.spyOn(console, 'warn').mockImplementation(() => {})
@@ -555,81 +328,56 @@ it('fails closed on corrupt recovery storage while ordinary hold and send still
     sessions: [],
     failed: []
   })
-  await host.hold(SESSION, 'pane')
   const body = hostTestMessage('A fresh ordinary request')
   expect(
     await host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
   ).toMatchObject({ ok: true })
-  expect(dispatch).toHaveBeenCalledTimes(1)
-  // list; the action's read of offers and of failures; the post-action refresh of both.
-  expect(warning).toHaveBeenCalledTimes(5)
+  await vi.waitFor(() => expect(dispatch).toHaveBeenCalledTimes(1))
+  // list; the action's read of offers and of failures; the post-action refresh of both. The send
+  // cannot withdraw an offer it cannot read either, and says so.
+  const withdrawing = '[structured-agent-session] withdrawing a restart offer failed'
+  await vi.waitFor(() => expect(warning).toHaveBeenLastCalledWith(withdrawing))
+  expect(warning.mock.calls.filter(([message]) => message !== withdrawing)).toHaveLength(5)
   warning.mockRestore()
-  host.release(SESSION, 'pane')
 })
 
-// The toast is gone in seconds and the offer is spent by the reattach, so without this record
-// nothing on any surface would still name the chat the user has to continue by hand.
-it('keeps a refused continuation as a durable failure that names the chat and the reason', async () => {
-  const { host, root, result } = await supersededRefusal()
-  const failure = {
-    sessionId: SESSION,
-    outcome: 'refused',
-    reason: 'agent_session_restart_work_superseded',
-    latestPrompt: expect.any(String),
-    agent: 'codex',
-    retryable: false
-  }
-  expect(result).toMatchObject({ sessions: [], failed: [failure] })
-  // The chat itself says what happened and what to do.
-  expect(statusNotes(host)).toContainEqual({
-    text: AGENT_SESSION_RESTART_CONTINUATION_REFUSED_NOTE,
-    tone: 'error'
+// The user's own message was accepted first: the continuation is refused, and since nothing the
+// user did failed, the chat says nothing and no failure is kept.
+it("refuses a continuation quietly when the user's own message was accepted first", async () => {
+  const { host, root, dispatch, result } = await supersededRefusal()
+  expect(result).toMatchObject({
+    continued: [{ outcome: 'refused', reason: 'agent_session_restart_work_superseded' }],
+    sessions: [],
+    failed: []
   })
-  expect(await host.restartResume.list()).toEqual([])
-  expect(await host.restartResume.listFailures()).toMatchObject([failure])
-  // Durable: a fresh reader of the same file sees it too.
-  expect(await new AgentSessionRecoveryCapsule(root).listFailed(NOW)).toMatchObject([
-    { marker: { sessionId: SESSION }, outcome: 'refused' }
-  ])
-  host.release(SESSION, 'pane')
+  await vi.waitFor(() => expect(dispatch).toHaveBeenCalledOnce())
+  expect(await statusNotes(host)).toEqual([])
+  expect(await new AgentSessionRecoveryCapsule(root).list(NOW)).toEqual([])
+  expect(await new AgentSessionRecoveryCapsule(root).listFailed(NOW)).toEqual([])
 })
 
-// The failure asked the user to continue the chat themselves; their own message is that
-// continuation. Nothing on the send path clears it: the listing sees the newer message.
+/** A continuation whose start failed, filed as a retryable failure. */
+async function failedContinuation() {
+  const state = await interruptedRestart()
+  state.acquire.mockRejectedValueOnce(new Error('provider could not reconnect'))
+  const result = await state.host.restartResume.continueAfterRestart([SESSION], 'modal')
+  expect(result.failed).toMatchObject([{ sessionId: SESSION, outcome: 'refused' }])
+  return state
+}
+
+// Starting the chat's agent again answers a failure, as it ends an offer.
 it('retires a recorded failure once the user sends in that chat, with no send hook', async () => {
-  const { host, root } = await supersededRefusal()
+  const { host, root, dispatch } = await failedContinuation()
   const body = hostTestMessage('Carry on from where you stopped')
   await host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
-  expect(await host.restartResume.listFailures()).toEqual([])
-  // Pruned from the file too, not only hidden.
+  await vi.waitFor(() => expect(dispatch).toHaveBeenCalledOnce())
+  // Pruned from the file, not only hidden.
   await vi.waitFor(async () => {
     expect(await new AgentSessionRecoveryCapsule(root).listFailed(NOW)).toEqual([])
   })
-  host.release(SESSION, 'pane')
+  expect(await host.restartResume.listFailures()).toEqual([])
 })
 
-// The user can reply in a chat while other chats in the same action are still being continued,
-// before its turn in the batch or after its own note asks them to. Either reply answers the failure.
-it.each(['before', 'after'] as const)(
-  'retires a failure the user answered %s its own attempt, before the action settled',
-  async (userAnswers) => {
-    const { host, root, result } = await supersededRefusal(userAnswers)
-    expect(result.resumed).toMatchObject([
-      userAnswers === 'before' ? { reason: 'agent_session_resume_not_eligible' } : {}
-    ])
-    expect(
-      statusNotes(host).some(
-        (note) => note.text === AGENT_SESSION_RESTART_CONTINUATION_REFUSED_NOTE
-      )
-    ).toBe(userAnswers === 'after')
-    expect(result.failed).toEqual([])
-    await vi.waitFor(async () => {
-      expect(await new AgentSessionRecoveryCapsule(root).listFailed(NOW)).toEqual([])
-    })
-    host.release(SESSION, 'pane')
-  }
-)
-
 it('removes a failure when a named retry succeeds', async () => {
   const { host, root, dispatch } = await interruptedRestart()
   const capsule = new AgentSessionRecoveryCapsule(root)
@@ -645,7 +393,7 @@ it('removes a failure when a named retry succeeds', async () => {
         outcome: 'refused',
         reason: 'agent_session_conflict',
         latestPrompt: '',
-        latestUserItemId: pending!.latestUserItemId
+        latestUserItemId: pending!.latestUserItemId ?? null
       }
     ],
     NOW
@@ -661,7 +409,7 @@ it('removes a failure when a named retry succeeds', async () => {
 })
 
 it('dismisses one failure by name and leaves the rest of the durable records alone', async () => {
-  const { host, root } = await supersededRefusal()
+  const { host, root } = await failedContinuation()
   const capsule = new AgentSessionRecoveryCapsule(root)
   const other = parseAgentSessionResumeMarker({
     sessionId: 'session-other',
@@ -680,7 +428,6 @@ it('dismisses one failure by name and leaves the rest of the durable records alo
   expect(await host.restartResume.dismiss([SESSION])).toBe(1)
   expect(await host.restartResume.listFailures()).toEqual([])
   expect(await capsule.list(NOW)).toEqual([other])
-  host.release(SESSION, 'pane')
 })
 
 it('logs teardown capsule publication failure and still releases the provider', async () => {
@@ -692,14 +439,17 @@ it('logs teardown capsule publication failure and still releases the provider',
   }
   events.appendItem(
     { provider: 'codex', threadId: THREAD, turnId: 'working', ordinal: 1 },
-    { kind: 'turn', turnId: 'working', state: 'running' }
+    { kind: 'turn', turnId: 'working', state: 'running' },
+    { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
   await previous.host.flushStreamedEvents(SESSION)
   const capsulePath = join(previous.root, AGENT_SESSION_RECOVERY_CAPSULE_FILE)
   await mkdir(capsulePath)
   const warning = vi.spyOn(console, 'warn').mockImplementation(() => {})
   await expect(previous.host.flushAllStreamedEvents()).resolves.toBeUndefined()
-  expect(() => previous.host.journalSnapshot(SESSION)).toThrow('agent_session_ownership_unknown')
+  await expect(previous.host.journalSnapshot(SESSION)).rejects.toThrow(
+    'agent_session_ownership_unknown'
+  )
   expect(warning).toHaveBeenCalledWith(
     '[structured-agent-session] recording recovery capsule failed'
   )
@@ -708,3 +458,29 @@ it('logs teardown capsule publication failure and still releases the provider',
   warning.mockRestore()
   await rm(capsulePath, { recursive: true })
 })
+
+// The resume ledger's reason stays the refusal code, which is what every renderer's guidance keys
+// on; the details are filed beside it, never in its place.
+it('files a restart refused by a conflicted claim under its code, with its details beside it', async () => {
+  // The terminal agent that holds the claim is still running, so nothing may take it over.
+  const { host, store } = await interruptedRestart('turn', true, async () => ({
+    outcome: 'identity-matched',
+    matchedOn: ['spawn-token']
+  }))
+  await store.transitionHandoff(SESSION, (record) => ({
+    ...record,
+    lease: {
+      ...record.lease,
+      claimStatus: 'conflicted',
+      ownerProcess: { hostId: 'local', pid: 4242, processStartTimeMs: 1, spawnToken: 'terminal' }
+    }
+  }))
+
+  await host.restartResume.continueAfterRestart([SESSION], 'modal')
+
+  await vi.waitFor(async () =>
+    expect(await host.restartResume.listFailures()).toMatchObject([
+      { reason: 'agent_session_conflict', details: { reason: 'claimConflicted' } }
+    ])
+  )
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.test.ts
index f46ff48ce15..90875832c8f 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.test.ts
@@ -10,10 +10,13 @@ vi.mock('./structured-agent-session-read-restore', () => ({
   restoreStructuredAgentSessionRead: restoreRead
 }))
 
-import {
-  restoreOneStructuredAgentSessionRead,
-  restoreStructuredAgentSessionsOnRestart
-} from './structured-agent-session-restart-restore'
+import { restoreStructuredAgentSessionsOnRestart } from './structured-agent-session-restart-restore'
+
+const NO_OPEN_DEPS = {
+  store: { getRecord: () => null, listRecords: () => [] },
+  journalRoot: '/tmp/journals',
+  adapter: {}
+}
 
 describe('restart journal restoration', () => {
   beforeEach(() => restoreRead.mockReset())
@@ -22,17 +25,19 @@ describe('restart journal restoration', () => {
     const gate = Promise.withResolvers<void>()
     let active = 0
     let peak = 0
-    restoreRead.mockImplementation(async (_store, _root, sessionId: string) => {
+    restoreRead.mockImplementation(async (_deps, sessionId: string) => {
       active += 1
       peak = Math.max(peak, active)
       await gate.promise
       active -= 1
       return {
-        journal: {},
-        params: { location: { workspaceId: 'workspace-1' }, provider: 'codex' },
-        fence: 1,
-        hasProviderChild: false,
-        sessionId
+        session: {
+          journal: {},
+          params: { location: { workspaceId: 'workspace-1' }, provider: 'codex' },
+          child: null,
+          sessionId
+        },
+        reset: null
       }
     })
     const records = Array.from(
@@ -41,15 +46,13 @@ describe('restart journal restoration', () => {
     )
 
     const restoration = restoreStructuredAgentSessionsOnRestart({
-      store: {} as never,
-      journalRoot: '/tmp/journals',
+      openDeps: NO_OPEN_DEPS,
       records,
       reconcile: async () => null,
       resolveRecovery: async () => undefined,
       serialize: async (_sessionId, task) => task(),
       hasSession: () => false,
-      onReadable: () => undefined,
-      retrySettlement: async () => true
+      onReadable: () => undefined
     })
 
     await vi.waitFor(() => expect(active).toBe(4))
@@ -61,7 +64,7 @@ describe('restart journal restoration', () => {
     expect(peak).toBe(4)
   })
 
-  it('runs pending settlement retry after recovery resolution', async () => {
+  it('settles what a gone generation left running after recovery resolution, before publishing', async () => {
     const calls: string[] = []
     const params: AgentSessionAttachParams = {
       envelope: {
@@ -81,64 +84,52 @@ describe('restart journal restoration', () => {
       accountHome: { variable: 'CODEX_HOME', path: '/tmp/codex' },
       runtimeKind: 'native'
     }
-    restoreRead.mockResolvedValue({
-      journal: {},
-      params,
-      fence: 4,
-      hasProviderChild: false,
-      acquisitionGeneration: null
+    const restored = {
+      session: { journal: {}, params, child: null },
+      reset: null
+    }
+    // The open is what settles: it runs after recovery resolution and before the publish.
+    restoreRead.mockImplementation(async () => {
+      calls.push('open')
+      return restored
     })
 
-    await restoreOneStructuredAgentSessionRead(
-      {
-        store: {} as never,
-        journalRoot: '/tmp/journals',
-        reconcile: async () => null,
-        resolveRecovery: async () => {
-          calls.push('resolveRecovery')
-        },
-        serialize: async (_sessionId, task) => task(),
-        hasSession: () => false,
-        onReadable: () => {
-          calls.push('onReadable')
-        },
-        retrySettlement: async (_sessionId, restoredParams) => {
-          calls.push(
-            restoredParams === params ? 'retrySettlement:restored-params' : 'retrySettlement'
-          )
-          return true
-        }
+    await restoreStructuredAgentSessionsOnRestart({
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the restore reads only the record's session id here.
+      records: [{ sessionId: 'session-1' } as AgentSessionRecord],
+      openDeps: NO_OPEN_DEPS,
+      reconcile: async () => null,
+      resolveRecovery: async () => {
+        calls.push('resolveRecovery')
       },
-      'session-1'
-    )
+      serialize: async (_sessionId, task) => task(),
+      hasSession: () => false,
+      onReadable: (_sessionId, readable) => {
+        calls.push(readable === restored ? 'onReadable:restored' : 'onReadable')
+      }
+    })
 
-    expect(calls).toEqual(['resolveRecovery', 'onReadable', 'retrySettlement:restored-params'])
+    expect(calls).toEqual(['resolveRecovery', 'open', 'onReadable:restored'])
   })
 
-  it('does not rerun settlement retry when a second restore finds the session already open', async () => {
-    const retrySettlement = vi.fn(async () => true)
+  it('does not settle again when a second restore finds the session already open', async () => {
     restoreRead.mockResolvedValue({
-      journal: {},
-      params: {},
-      fence: 4,
-      hasProviderChild: false,
-      acquisitionGeneration: null
+      session: { journal: {}, params: {}, child: null },
+      reset: null
     })
 
-    await restoreOneStructuredAgentSessionRead(
-      {
-        store: {} as never,
-        journalRoot: '/tmp/journals',
-        reconcile: async () => null,
-        resolveRecovery: async () => undefined,
-        serialize: async (_sessionId, task) => task(),
-        hasSession: () => true,
-        onReadable: () => undefined,
-        retrySettlement
-      },
-      'session-1'
-    )
+    await restoreStructuredAgentSessionsOnRestart({
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the restore reads only the record's session id here.
+      records: [{ sessionId: 'session-1' } as AgentSessionRecord],
+      openDeps: NO_OPEN_DEPS,
+      reconcile: async () => null,
+      resolveRecovery: async () => undefined,
+      serialize: async (_sessionId, task) => task(),
+      hasSession: () => true,
+      onReadable: () => undefined
+    })
 
-    expect(retrySettlement).not.toHaveBeenCalled()
+    // The open is where the settlement runs, and a session already open is not opened again.
+    expect(restoreRead).not.toHaveBeenCalled()
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.ts
index 38c04d2a597..d54687c25a6 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.ts
@@ -8,42 +8,37 @@
 // It does not owe a provider child. This used to resume every record whose lease was `released`,
 // which is the normal end state of a chat the user closed cleanly — so a
 // healthy profile started an app-server per session it had ever used, in parallel, at every launch,
-// with no client attached and nothing on screen. A child now exists because a surface asked for the
-// session (see `structured-agent-session-holds`), not because a record survived on disk.
+// with no client attached and nothing on screen. A child now exists because work asked for it — a
+// send, through the delivery loop — not because a record survived on disk.
 
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 import type { AgentSessionWireRefusal } from '../../../shared/agent-session-wire'
-import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import { mapWithConcurrency } from '../../../shared/map-with-concurrency'
-import {
-  restoreStructuredAgentSessionRead,
-  type RestoredStructuredAgentSessionRead
-} from './structured-agent-session-read-restore'
+import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type {
+  OpenedStructuredAgentSessionConversation,
+  StructuredAgentSessionConversationOpenDeps
+} from './structured-agent-session-conversation-open'
+import { restoreStructuredAgentSessionRead } from './structured-agent-session-read-restore'
 
 const JOURNAL_RESTORE_CONCURRENCY = 4
 
 export type StructuredAgentSessionReadRestoreDeps = {
-  store: AgentSessionRecordStore
-  journalRoot: string
+  openDeps: StructuredAgentSessionConversationOpenDeps & {
+    store: Pick<AgentSessionRecordStore, 'getRecord' | 'listRecords'>
+  }
   reconcile: (sessionId: string) => Promise<AgentSessionWireRefusal | null>
   resolveRecovery: (sessionId: string) => Promise<unknown>
   serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
   hasSession: (sessionId: string) => boolean
-  onReadable: (sessionId: string, restored: RestoredStructuredAgentSessionRead) => void
-  retrySettlement: (
+  onReadable: (
     sessionId: string,
-    params: RestoredStructuredAgentSessionRead['params']
-  ) => Promise<boolean>
+    opened: OpenedStructuredAgentSessionConversation
+  ) => Promise<void> | void
 }
 
-/**
- * One session's share of the restart restore, and the whole of an on-demand one.
- *
- * Startup maps this over every supported record; a surface asking for a session it cannot see
- * calls it for one id. The CALLER decides which records are eligible — startup filters by
- * `supportsRecord` before mapping, so an on-demand caller owes the same check.
- */
-export async function restoreOneStructuredAgentSessionRead(
+/** One session's share of the restart restore. Startup maps this over every supported record. */
+async function restoreOneStructuredAgentSessionRead(
   input: StructuredAgentSessionReadRestoreDeps,
   sessionId: string
 ): Promise<void> {
@@ -57,29 +52,21 @@ export async function restoreOneStructuredAgentSessionRead(
   )
 }
 
-/** The serialized half of the restore, for a caller already inside the session's serialize — a
- *  send replaying into a session this host has closed, which needs the journal and no child. */
-export async function restoreOneStructuredAgentSessionReadUnderSerialize(
-  input: Pick<
-    StructuredAgentSessionReadRestoreDeps,
-    'store' | 'journalRoot' | 'hasSession' | 'onReadable' | 'retrySettlement'
-  >,
+/** The serialized half of the restore. */
+async function restoreOneStructuredAgentSessionReadUnderSerialize(
+  input: Pick<StructuredAgentSessionReadRestoreDeps, 'openDeps' | 'hasSession' | 'onReadable'>,
   sessionId: string
 ): Promise<void> {
   if (input.hasSession(sessionId)) {
-    // A surface that took a hold mid-restore already attached this one.
+    // A read or a send mid-restore already opened this one.
     return
   }
-  const restored = await restoreStructuredAgentSessionRead(
-    input.store,
-    input.journalRoot,
-    sessionId
-  )
-  if (!restored) {
+  const opened = await restoreStructuredAgentSessionRead(input.openDeps, sessionId)
+  if (!opened) {
     return
   }
-  input.onReadable(sessionId, restored)
-  await input.retrySettlement(sessionId, restored.params)
+  // The open settled what a gone generation left running, so no reader sees it run.
+  await input.onReadable(sessionId, opened)
 }
 
 export async function restoreStructuredAgentSessionsOnRestart(
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-host.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-host.ts
index 0770190c2f4..d053caf006b 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-host.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-host.ts
@@ -1,21 +1,18 @@
 // Restart offers are durable per-session records. Listing reserves nothing and removes only offers
 // the chat has provably moved past; an explicit action reserves records, and only a completed
-// action removes them — or files what went wrong.
+// action removes them — or files what went wrong. Starting the chat's agent again withdraws them.
 
 import { randomUUID } from 'node:crypto'
+import {
+  AgentSessionRefusalError,
+  agentSessionRefusalFromReference
+} from '../../../shared/agent-session-wire-refusals'
 import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import type { AgentSessionRecoveryCapsule } from '../../runtime/agent-session-recovery-capsule'
 import type {
   AgentSessionResumeMarker,
   AgentSessionResumeTrigger
 } from '../../../shared/agent-session-resume-marker'
-import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
-import type {
-  AgentSessionMutationEnvelope,
-  AgentSessionMutationResult,
-  AgentSessionSendResult
-} from '../../../shared/agent-session-wire'
-import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { createStructuredAgentSessionRestartCandidateReader } from './structured-agent-session-restart-candidates'
 import {
@@ -34,33 +31,21 @@ import {
   type StructuredAgentSessionResumeOutcome
 } from './structured-agent-session-restart-resume-runner'
 import {
-  continueStructuredAgentSessionAfterRestart,
-  noteRestartReattachFailed,
   restartContinuationDeps,
+  startStructuredAgentSessionContinuation,
   type StructuredAgentSessionContinuationHost,
   type StructuredAgentSessionContinuationOutcome
 } from './structured-agent-session-restart-continuation'
+import { restartContinuationId } from './structured-agent-session-restart-continuation-envelope'
+import {
+  createStructuredAgentSessionRestartOfferWithdrawal,
+  type StructuredAgentSessionRestartOfferSession
+} from './structured-agent-session-restart-offer-withdrawal'
+import type { StructuredAgentSessionRestartResumeSurfaces } from './structured-agent-session-restart-resume-wiring'
 import { createStructuredAgentSessionRestartWitnesses } from './structured-agent-session-restart-witnesses'
+import { structuredAgentSessionConversationFence } from './structured-agent-session-provider-child'
 
-type LiveSession = { journal: AgentSessionJournal; hasProviderChild: boolean; fence: number }
-
-export type StructuredAgentSessionRestartResumeSurfaces = {
-  publish: (sessionId: string, journal: AgentSessionJournal) => void
-  revealSession: (sessionId: string) => Promise<{ readable: boolean }>
-  hold: (sessionId: string, holderId: string) => Promise<void>
-  release: (sessionId: string, holderId: string) => void
-  send: (input: {
-    envelope: AgentSessionMutationEnvelope
-    body: AgentJournalMessageItem
-    beforeRun?: () => void
-  }) => Promise<AgentSessionMutationResult<AgentSessionSendResult>>
-  awaitSendSettlement: (
-    sessionId: string,
-    clientMessageId: string
-  ) => Promise<{ value: AgentSessionSendResult } | undefined>
-  onNoteFailed: (sessionId: string, error: unknown) => void
-  now: () => number
-}
+type LiveSession = StructuredAgentSessionRestartOfferSession
 
 export type StructuredAgentSessionRestartResume = {
   /** Teardown: begin, then per session a snapshot right before its child stops and a confirmation
@@ -72,10 +57,6 @@ export type StructuredAgentSessionRestartResume = {
   list: () => Promise<StructuredAgentSessionResumeCandidate[]>
   /** Offers already acted on whose agent did not carry on. Read-only; nothing here is spent. */
   listFailures: () => Promise<StructuredAgentSessionResumeFailure[]>
-  resume: (
-    sessionIds: readonly string[] | undefined,
-    owner: string
-  ) => Promise<StructuredAgentSessionResumeOutcome[]>
   continueAfterRestart: (
     sessionIds: readonly string[] | undefined,
     owner: string
@@ -87,6 +68,8 @@ export type StructuredAgentSessionRestartResume = {
   }>
   /** Named sessions forget their offer or failure; unnamed, every durable record goes. */
   dismiss: (sessionIds?: readonly string[]) => Promise<number>
+  /** The chat's agent proved a start: its offer ends unless the start is a resume's own. */
+  onAgentStarted: (sessionId: string) => void
 }
 
 export function createStructuredAgentSessionRestartResume(
@@ -101,11 +84,6 @@ export function createStructuredAgentSessionRestartResume(
   const admission = new StructuredAgentSessionResumeAdmission()
   const enqueueRecoveryOperation = createStructuredAgentSessionRestartOperationQueue()
 
-  const derive = createStructuredAgentSessionRestartCandidateReader({
-    sessions,
-    getRecord: deps.store.getRecord,
-    adapter: deps.adapter
-  })
   const witnesses = createStructuredAgentSessionRestartWitnesses({
     sessions,
     getRecord: deps.store.getRecord,
@@ -115,15 +93,24 @@ export function createStructuredAgentSessionRestartResume(
     now: surfaces.now,
     enqueue: enqueueRecoveryOperation
   })
+  const withdrawal = createStructuredAgentSessionRestartOfferWithdrawal({
+    sessions,
+    ...(deps.recoveryCapsule ? { capsule: deps.recoveryCapsule } : {}),
+    now: surfaces.now,
+    enqueue: enqueueRecoveryOperation
+  })
+  const derive = createStructuredAgentSessionRestartCandidateReader({
+    sessions,
+    getRecord: deps.store.getRecord,
+    adapter: deps.adapter,
+    movedOn: withdrawal.movedOn
+  })
   const failures = createStructuredAgentSessionRestartFailureLedger({
     ...(deps.recoveryCapsule ? { capsule: deps.recoveryCapsule } : {}),
-    sessions,
-    reveal: async (sessionId) => {
-      await surfaces.revealSession(sessionId).catch(() => null)
-    },
     getRecord: deps.store.getRecord,
     adapter: deps.adapter,
     retryable: (marker) => derive([marker], 'may-be-held').candidates.length === 1,
+    reveal: (markers) => revealMarkers(markers),
     now: surfaces.now,
     enqueue: enqueueRecoveryOperation
   })
@@ -153,19 +140,20 @@ export function createStructuredAgentSessionRestartResume(
   const continuationHost: StructuredAgentSessionContinuationHost = {
     ...surfaces,
     sessions,
-    stillResumable: (marker, options) =>
-      derive([marker], 'may-be-held', options).candidates.length === 1
+    conversationFence: (sessionId) =>
+      deps.store.getRecord(sessionId)
+        ? structuredAgentSessionConversationFence(deps.store, sessionId)
+        : null,
+    stillResumable: (marker) => derive([marker], 'may-be-held').candidates.length === 1
   }
 
+  /** One explicit action: reserve the offers, then continue each through `continueOne`, a few at
+   *  a time. The runner counts a chat as done once `continueOne` returns. */
   const run = async (
     sessionIds: readonly string[] | undefined,
     owner: string,
-    afterAcquire?: (marker: AgentSessionResumeMarker) => Promise<void>,
-    settlement: Omit<Parameters<typeof failures.settle>[2], 'candidates' | 'attempts'> = {
-      failureAfterResume: () => null,
-      failureReason: () => 'agent_session_resume_refused'
-    }
-  ): Promise<StructuredAgentSessionResumeOutcome[]> => {
+    continueOne: (marker: AgentSessionResumeMarker, continuationId: string) => Promise<void>
+  ) => {
     // An explicit action supersedes teardown witnesses captured by this host. The durable mutation
     // lane below also drains a publication already in flight before completion.
     witnesses.clear()
@@ -176,25 +164,26 @@ export function createStructuredAgentSessionRestartResume(
     retireSuperseded(derived.superseded)
     const eligible = derived.candidates.filter((candidate) => requested.has(candidate.sessionId))
     if (eligible.length === 0) {
-      return []
+      return null
     }
     const operationId = randomUUID()
+    const actionAt = surfaces.now()
+    // Tagged with its offer, so a rejected one is told apart for as long as the offer lasts.
+    const continuationFor = (marker: AgentSessionResumeMarker) =>
+      restartContinuationId(marker, operationId, actionAt)
     const reserved =
       (await enqueueRecoveryOperation(
         () =>
           deps.recoveryCapsule?.beginResume(
             eligible.map((candidate) => candidate.sessionId),
             operationId,
-            surfaces.now()
+            actionAt
           ) ?? Promise.resolve([])
       )) ?? []
     const markersBySession = new Map(reserved.map((marker) => [marker.sessionId, marker]))
     const candidates = derive(reserved, 'may-be-held').candidates
-    const attempts = failures.attempts(markersBySession)
-
-    let outcomes: StructuredAgentSessionResumeOutcome[]
     try {
-      outcomes = await resumeStructuredAgentSessionsFromRestart(
+      const outcomes = await resumeStructuredAgentSessionsFromRestart(
         {
           admission,
           consumeMarker: async (sessionId) => {
@@ -202,26 +191,16 @@ export function createStructuredAgentSessionRestartResume(
             return marker !== undefined && derive([marker], 'may-be-held').candidates.length === 1
           },
           resume: async (sessionId) => {
-            const holder = `restart-resume:${sessionId}`
-            try {
-              await surfaces.hold(sessionId, holder).catch(async (error: unknown) => {
-                // The reattach failure is filed like any other, so the chat must say so too.
-                await noteRestartReattachFailed(continuationHost, sessionId)
-                throw error
-              })
-              const marker = markersBySession.get(sessionId)
-              if (marker) {
-                await afterAcquire?.(marker)
-              }
-            } finally {
-              attempts.observe(sessionId)
-              surfaces.release(sessionId, holder)
+            const marker = markersBySession.get(sessionId)
+            if (marker) {
+              await continueOne(marker, continuationFor(marker))
             }
           }
         },
         candidates,
         owner
       )
+      return { operationId, outcomes, candidates, markers: markersBySession }
     } catch (error) {
       if (deps.recoveryCapsule) {
         await enqueueRecoveryOperation(() =>
@@ -232,8 +211,6 @@ export function createStructuredAgentSessionRestartResume(
       }
       throw error
     }
-    await failures.settle(operationId, outcomes, { candidates, attempts, ...settlement })
-    return outcomes
   }
 
   const continueAfterRestart = async (
@@ -246,34 +223,50 @@ export function createStructuredAgentSessionRestartResume(
     failed?: StructuredAgentSessionResumeFailure[]
   }> => {
     const continued: StructuredAgentSessionContinuationOutcome[] = []
-    const continuationFor = (sessionId: string) =>
-      continued.find((outcome) => outcome.sessionId === sessionId)
-    const resumed = await run(
-      sessionIds,
-      owner,
-      async (marker) => {
-        continued.push(
-          await continueStructuredAgentSessionAfterRestart(
-            restartContinuationDeps(continuationHost, marker),
-            marker.sessionId,
-            marker
-          )
-        )
-      },
-      {
+    const verdicts: Promise<void>[] = []
+    // A chat holds its slot until its agent took the continuation or its start failed, so a batch
+    // never starts more agents at once than the runner allows; the provider's answer comes after.
+    const action = await run(sessionIds, owner, async (marker, continuationId) => {
+      const started = await startStructuredAgentSessionContinuation(
+        restartContinuationDeps(continuationHost, marker),
+        marker.sessionId,
+        marker,
+        continuationId
+      )
+      if ('done' in started) {
+        continued.push(started.done)
+        const { outcome, reason, refusal } = started.done
+        if (outcome === 'refused') {
+          // Thrown as a refusal so the filed failure keeps its details beside the code.
+          throw refusal
+            ? new AgentSessionRefusalError(agentSessionRefusalFromReference(refusal, refusal.code))
+            : new Error(reason ?? 'agent_session_continuation_refused')
+        }
+        return
+      }
+      verdicts.push(started.verdict().then((outcome) => void continued.push(outcome)))
+    })
+    await Promise.all(verdicts)
+    const resumed = action?.outcomes ?? []
+    if (action) {
+      await failures.settle(action.operationId, resumed, {
+        candidates: action.candidates,
+        markers: action.markers,
         failureAfterResume: (sessionId) => {
-          const outcome = continuationFor(sessionId)
-          // Reattached but never asked to continue: nothing confirms the agent carried on.
-          return outcome ? continuationFailureOutcome(outcome.outcome) : 'unconfirmed'
+          const outcome = continued.find((entry) => entry.sessionId === sessionId)
+          return outcome ? continuationFailureOutcome(outcome.outcome) : null
         },
         failureReason: (sessionId) => {
-          const outcome = continuationFor(sessionId)
+          const outcome = continued.find((entry) => entry.sessionId === sessionId)
           return outcome?.reason ?? outcome?.outcome ?? 'agent_session_continuation_unknown'
         }
-      }
-    )
+      })
+    }
     for (const outcome of resumed) {
-      if (outcome.outcome !== 'resumed') {
+      if (
+        outcome.outcome !== 'resumed' &&
+        !continued.some((entry) => entry.sessionId === outcome.sessionId)
+      ) {
         continued.push({
           sessionId: outcome.sessionId,
           outcome: 'refused',
@@ -307,7 +300,7 @@ export function createStructuredAgentSessionRestartResume(
     // Do not let a teardown witness already captured in this host republish after explicit
     // dismissal. A later capture is a new interruption and may create a fresh offer normally.
     dismiss: (sessionIds) => failures.dismiss(sessionIds, witnesses.clear),
-    resume: (sessionIds, owner) => run(sessionIds, owner),
-    continueAfterRestart
+    continueAfterRestart,
+    onAgentStarted: withdrawal.onAgentStarted
   }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-runner.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-runner.ts
index 33a07e80335..a298e23f454 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-runner.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-runner.ts
@@ -1,14 +1,17 @@
 // Delivering the explicit restart action: the one path that turns a resumable candidate back into
-// a live agent.
+// a working agent.
 //
 // The manual "Resume" button and the automatic setting both land here, so the two can never drift
 // into different eligibility or different double-fire protection.
 //
-// Resume itself acquires a provider child, not a new send. The first resume-capable hold on a
-// childless session re-acquires the provider's own conversation — Claude's `resume` by session id,
-// Codex's thread id — which is native continuation. Nothing re-sends the user's prompt: that is
-// what makes an agent redo work it already finished.
+// A resume is the continuation send. Its delivery starts the provider on its own conversation —
+// Claude's `resume` by session id, Codex's thread id — which is native continuation. Nothing
+// re-sends the user's prompt: that is what makes an agent redo work it already finished.
 
+import {
+  isAgentSessionRefusalError,
+  type AgentSessionAnyRefusalDetails
+} from '../../../shared/agent-session-wire-refusals'
 import { forEachWithConcurrency } from '../../../shared/map-with-concurrency'
 import type { StructuredAgentSessionResumeCandidate } from './structured-agent-session-restart-resume-set'
 
@@ -27,6 +30,8 @@ export type StructuredAgentSessionResumeOutcome = {
   outcome: 'resumed' | 'refused'
   /** Refusal code; `agent_session_resume_already_in_progress` names the live owner in `owner`. */
   reason?: string
+  /** A thrown refusal's details, kept apart so `reason` stays the code readers match. */
+  details?: AgentSessionAnyRefusalDetails
   owner?: string
 }
 
@@ -52,7 +57,7 @@ function resumeAdmissionOwner(error: unknown): string | null {
  * One resume per session at a time, whoever is asking.
  *
  * Two surfaces can reach for the same chat at once — the banner's "Resume all" and a user clicking
- * one row — and both would otherwise take a hold, race the acquisition, and leave the loser's
+ * one row — and both would otherwise send the continuation twice, and leave the loser's
  * refusal looking like a real failure. The second caller is told who holds it instead.
  */
 export class StructuredAgentSessionResumeAdmission {
@@ -80,7 +85,7 @@ export type StructuredAgentSessionResumeRunnerDeps = {
   admission: StructuredAgentSessionResumeAdmission
   /** Validates this action's durable reservation. False means the candidate is no longer eligible. */
   consumeMarker: (sessionId: string) => Promise<boolean>
-  /** Acquires the provider child for the reserved session. */
+  /** Continues the reserved session; resolves once its agent took the message or refused it. */
   resume: (sessionId: string) => Promise<void>
   concurrency?: number
 }
@@ -123,10 +128,12 @@ async function resumeOne(
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error)
     const owner = resumeAdmissionOwner(error)
+    const details = isAgentSessionRefusalError(error) ? error.refusal.details : undefined
     return {
       sessionId,
       outcome: 'refused',
       reason,
+      ...(details ? { details } : {}),
       ...(owner === null ? {} : { owner })
     }
   }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-set.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-set.ts
index 245fbcf4bbf..3c91a9732b9 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-set.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-set.ts
@@ -7,12 +7,12 @@
 // restored thread), and every reading of those rewrites as "the work is done" dropped chats that
 // were owed a resume.
 //
-// An offer ends only by the user's own actions. The ones this predicate can see — a newer message
-// of theirs in that chat, or the conversation forked — are reported back as `superseded` so the
-// caller DELETES the record rather than filtering it forever. What remains are structural checks
-// that are not about work at all: the record still exists and this build supports it, and the
-// lease is free.
+// An offer ends when the chat moves on after the restart — another message accepted, or its agent
+// started — or when the conversation forked. Both are reported back as `superseded` so the caller
+// DELETES the record rather than filtering it forever. What remains are structural checks that are not about work at all: the record still
+// exists and this build supports it, and the lease is free.
 
+import type { AgentSessionAnyRefusalDetails } from '../../../shared/agent-session-wire-refusals'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 import {
   agentSessionProviderHandleChainHead,
@@ -57,6 +57,8 @@ export type StructuredAgentSessionResumeFailure = StructuredAgentSessionResumeCa
   outcome: AgentSessionResumeFailureOutcome
   /** The host's or provider's refusal code, verbatim, so it can be quoted in a report. */
   reason: string
+  /** The refusal's details beside its code in `reason`; absent on older records and non-refusals. */
+  details?: AgentSessionAnyRefusalDetails
   /** Whether naming it in an action would run it again: whether it is still an offer. A
    *  continuation the chat already holds, or the user having moved on, makes a retry a no-op no
    *  matter what the reason says. */
@@ -65,8 +67,8 @@ export type StructuredAgentSessionResumeFailure = StructuredAgentSessionResumeCa
 
 export type StructuredAgentSessionResumableSet = {
   candidates: StructuredAgentSessionResumeCandidate[]
-  /** Markers the chat has provably moved past — a newer user message, or a forked conversation.
-   *  Every ending deletes: the caller retires these rather than re-filtering them forever. */
+  /** Markers the chat has provably moved past, or whose conversation forked. Every ending deletes:
+   *  the caller retires these rather than re-filtering them forever. */
   superseded: AgentSessionResumeMarker[]
 }
 
@@ -75,8 +77,8 @@ export type StructuredAgentSessionResumeSetInput = {
   getRecord: (sessionId: string) => AgentSessionRecord | null
   supportsRecord: (record: AgentSessionRecord) => boolean
   latestPrompt: (sessionId: string) => string
-  /** Undefined when the chat's journal is not readable here, which decides nothing. */
-  latestUserItemId: (sessionId: string) => string | null | undefined
+  /** Whether the chat moved on since the offer was taken; false when its journal is not open here. */
+  movedOn: (marker: AgentSessionResumeMarker) => boolean
   /**
    * Whether the lease must be free.
    *
@@ -103,7 +105,7 @@ export function structuredAgentSessionResumableSet(
       continue
     }
     // A conversation that FORKED since teardown is not the one we marked, and can never be again:
-    // deleted like a newer message, so it cannot sit unseen forever. Compared by identity root,
+    // deleted, so it cannot sit unseen forever. Compared by identity root,
     // because a resume legitimately advances Claude's leaf and that is not a fork.
     const head = agentSessionProviderHandleChainHead(record.providerHandleChain)
     if (!head) {
@@ -113,10 +115,7 @@ export function structuredAgentSessionResumableSet(
       superseded.push(marker)
       continue
     }
-    // The user moving on is the one thing that withdraws the offer. Anything the provider does on
-    // its own after reattaching — a turn it opens, a prompt, restated rows — is not.
-    const latestUserItemId = input.latestUserItemId(marker.sessionId)
-    if (latestUserItemId !== undefined && latestUserItemId !== marker.latestUserItemId) {
+    if (input.movedOn(marker)) {
       superseded.push(marker)
       continue
     }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-test-harness.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-test-harness.ts
index e5b65009634..e359e31157b 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-test-harness.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-test-harness.ts
@@ -145,7 +145,7 @@ export type HarnessJournal = {
   appendItem: (envelope: unknown, body: { kind: string; text: string }) => Promise<void>
 }
 
-export type HarnessSession = { journal: HarnessJournal; hasProviderChild: boolean; fence?: number }
+export type HarnessSession = { journal: HarnessJournal; child: { fence: number } | null }
 
 export function journal(
   items: AgentJournalRenderItem[],
@@ -203,13 +203,12 @@ export function resumableSet(input: {
   markers: AgentSessionResumeMarker[]
   items?: AgentJournalRenderItem[]
   chain?: AgentSessionRecord['providerHandleChain']
-  latestUserItemId?: string | null
 }) {
   return structuredAgentSessionResumableSet({
     markers: input.markers,
     getRecord: () => record(input.chain === undefined ? {} : { chain: input.chain }),
     supportsRecord: () => true,
     latestPrompt: () => 'fix the auth bug',
-    latestUserItemId: () => input.latestUserItemId ?? null
+    movedOn: () => false
   })
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-wiring.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-wiring.ts
index 4494392fb48..4004502e408 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-wiring.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-wiring.ts
@@ -11,7 +11,27 @@ import type {
   AgentSessionMutationResult,
   AgentSessionSendResult
 } from '../../../shared/agent-session-wire'
-import type { StructuredAgentSessionRestartResumeSurfaces } from './structured-agent-session-restart-resume-host'
+import { MAX_TIMER_DELAY_MS } from '../../../shared/timer-delay'
+import type { SendSettlementWaitOptions } from './structured-agent-session-send-settlement'
+
+export type StructuredAgentSessionRestartResumeSurfaces = {
+  revealSession: (sessionId: string) => Promise<{ readable: boolean }>
+  send: (input: {
+    envelope: AgentSessionMutationEnvelope
+    body: AgentJournalMessageItem
+    beforeRun?: () => void
+  }) => Promise<AgentSessionMutationResult<AgentSessionSendResult>>
+  awaitSendSettlement: (
+    sessionId: string,
+    clientMessageId: string
+  ) => Promise<{ value: AgentSessionSendResult } | undefined>
+  awaitSendHandedOver: (
+    sessionId: string,
+    clientMessageId: string
+  ) => Promise<{ value: AgentSessionSendResult } | undefined>
+  onNoteFailed: (sessionId: string, error: unknown) => void
+  now: () => number
+}
 
 /** The caller key the continuation sends under, so its writes are attributable to Orca itself. */
 export const STRUCTURED_AGENT_SESSION_RESTART_CONTINUATION_CALLER =
@@ -21,8 +41,6 @@ export const STRUCTURED_AGENT_SESSION_RESTART_CONTINUATION_CALLER =
  *  dependency, and nothing outside this list is reachable from here. */
 type RestartResumeHostBindings = {
   revealSession: (sessionId: string) => Promise<{ readable: boolean }>
-  hold: (sessionId: string, holderId: string) => Promise<void>
-  release: (sessionId: string, holderId: string) => void
   send: (
     caller: { callerKey: string },
     params: {
@@ -34,21 +52,30 @@ type RestartResumeHostBindings = {
   /** The host's existing settlement waiter; a send returns while its dispatch is still pending. */
   waitForSendSettlement: (
     sessionId: string,
-    clientMessageId: string
+    clientMessageId: string,
+    options: SendSettlementWaitOptions
   ) => Promise<{ value: AgentSessionSendResult } | undefined>
 }
 
 export function structuredAgentSessionRestartResumeSurfaces(
   host: RestartResumeHostBindings,
   now: () => number
-): Omit<StructuredAgentSessionRestartResumeSurfaces, 'publish'> {
+): StructuredAgentSessionRestartResumeSurfaces {
   return {
     revealSession: host.revealSession,
-    hold: host.hold,
-    release: host.release,
     send: (params) =>
       host.send({ callerKey: STRUCTURED_AGENT_SESSION_RESTART_CONTINUATION_CALLER }, params),
-    awaitSendSettlement: host.waitForSendSettlement,
+    // Accepted like any send, so its verdict is its delivery, however long the start takes; the
+    // wait ends when the submission settles or the session closes.
+    awaitSendSettlement: (sessionId, clientMessageId) =>
+      host.waitForSendSettlement(sessionId, clientMessageId, { budgetMs: MAX_TIMER_DELAY_MS }),
+    // How long a restart batch holds a chat's slot: until the agent took the message or its start
+    // failed. Undefined — the session closed, or too many waited — frees the slot too.
+    awaitSendHandedOver: (sessionId, clientMessageId) =>
+      host.waitForSendSettlement(sessionId, clientMessageId, {
+        until: 'handed-over',
+        budgetMs: MAX_TIMER_DELAY_MS
+      }),
     onNoteFailed: () =>
       console.warn('[structured-agent-session] restart continuation attribution failed'),
     now
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume.test.ts
index 1d6a8a1fc5e..efcd70345a8 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume.test.ts
@@ -17,6 +17,7 @@ import { structuredAgentSessionWorkingAtStop } from './structured-agent-session-
 import {
   CLAUDE_ROOT,
   claudeRecord,
+  EPOCH,
   HANDLE_ROOT,
   journal,
   TEARDOWN_CURRENT,
@@ -48,7 +49,7 @@ describe('deriving what was working at teardown', () => {
   it('marks a session this host was running a turn for', () => {
     const markers = markersAtTeardown({
       sessions: new Map([
-        [SESSION, { journal: journal([turnItem('turn-1', 'running')]), hasProviderChild: true }]
+        [SESSION, { journal: journal([turnItem('turn-1', 'running')]), child: { fence: 1 } }]
       ]),
       getRecord: () => record(),
       backgroundTasks: () => undefined,
@@ -64,6 +65,7 @@ describe('deriving what was working at teardown', () => {
         recordedAt: NOW,
         trigger: 'quit',
         teardownId: TEARDOWN_CURRENT,
+        journalCursor: { epoch: EPOCH, sequence: 1 },
         providerHandleRoot: HANDLE_ROOT,
         latestUserItemId: null,
         activity: { state: 'working', prompts: [], tasks: [] }
@@ -74,7 +76,7 @@ describe('deriving what was working at teardown', () => {
   it('carries the update trigger so the surface can say the restart was not the user choice', () => {
     const [recorded] = markersAtTeardown({
       sessions: new Map([
-        [SESSION, { journal: journal([turnItem('turn-1', 'running')]), hasProviderChild: true }]
+        [SESSION, { journal: journal([turnItem('turn-1', 'running')]), child: { fence: 1 } }]
       ]),
       getRecord: () => record(),
       backgroundTasks: () => undefined,
@@ -89,7 +91,7 @@ describe('deriving what was working at teardown', () => {
   it('marks nothing for an idle session', () => {
     expect(
       markersAtTeardown({
-        sessions: new Map([[SESSION, { journal: journal([]), hasProviderChild: true }]]),
+        sessions: new Map([[SESSION, { journal: journal([]), child: { fence: 1 } }]]),
         getRecord: () => record(),
         backgroundTasks: () => undefined,
         trigger: 'quit',
@@ -103,7 +105,7 @@ describe('deriving what was working at teardown', () => {
     expect(
       markersAtTeardown({
         sessions: new Map([
-          [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), hasProviderChild: true }]
+          [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), child: { fence: 1 } }]
         ]),
         getRecord: () => record(),
         backgroundTasks: () => undefined,
@@ -115,12 +117,12 @@ describe('deriving what was working at teardown', () => {
   })
 
   // The user's stated fear. A journal restored for READING carries whatever `running` row an older
-  // crash left behind, and it is the live `hasProviderChild` — not that row — that decides.
+  // crash left behind, and it is the live `child` — not that row — that decides.
   it('marks nothing for a stale running row this host was not executing', () => {
     expect(
       markersAtTeardown({
         sessions: new Map([
-          [SESSION, { journal: journal([turnItem('turn-1', 'running')]), hasProviderChild: false }]
+          [SESSION, { journal: journal([turnItem('turn-1', 'running')]), child: null }]
         ]),
         getRecord: () => record(),
         backgroundTasks: () => undefined,
@@ -141,7 +143,7 @@ describe('deriving what was working at teardown', () => {
           SESSION,
           {
             journal: journal([turnItem('turn-1', 'running'), pendingApproval()]),
-            hasProviderChild: true
+            child: { fence: 1 }
           }
         ]
       ]),
@@ -165,7 +167,7 @@ describe('deriving what was working at teardown', () => {
   it('marks a settled lead whose subagent was still running, anchored on its last turn', () => {
     const markers = markersAtTeardown({
       sessions: new Map([
-        [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), hasProviderChild: true }]
+        [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), child: { fence: 1 } }]
       ]),
       getRecord: () => record(),
       backgroundTasks: () => [
@@ -188,7 +190,7 @@ describe('deriving what was working at teardown', () => {
   it('records only the live rows of the roster, bounded', () => {
     const [recorded] = markersAtTeardown({
       sessions: new Map([
-        [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), hasProviderChild: true }]
+        [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), child: { fence: 1 } }]
       ]),
       getRecord: () => record(),
       backgroundTasks: () => [
@@ -213,7 +215,7 @@ describe('deriving what was working at teardown', () => {
   it('marks a settled lead whose only live work is a monitor', () => {
     const markers = markersAtTeardown({
       sessions: new Map([
-        [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), hasProviderChild: true }]
+        [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), child: { fence: 1 } }]
       ]),
       getRecord: () => record(),
       backgroundTasks: () => [{ id: 'task-m', kind: 'monitor', name: 'ci-watch' }],
@@ -230,7 +232,7 @@ describe('deriving what was working at teardown', () => {
     expect(
       markersAtTeardown({
         sessions: new Map([
-          [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), hasProviderChild: true }]
+          [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), child: { fence: 1 } }]
         ]),
         getRecord: () => record(),
         backgroundTasks: () => [
@@ -248,7 +250,7 @@ describe('deriving what was working at teardown', () => {
   it('records the identity root so an advancing Claude leaf cannot invalidate the marker', () => {
     const [recorded] = markersAtTeardown({
       sessions: new Map([
-        [SESSION, { journal: journal([turnItem('turn-1', 'running')]), hasProviderChild: true }]
+        [SESSION, { journal: journal([turnItem('turn-1', 'running')]), child: { fence: 1 } }]
       ]),
       getRecord: () => claudeRecord(null),
       backgroundTasks: () => undefined,
@@ -264,7 +266,7 @@ describe('deriving what was working at teardown', () => {
     expect(
       markersAtTeardown({
         sessions: new Map([
-          [SESSION, { journal: journal([turnItem('turn-1', 'running')]), hasProviderChild: true }]
+          [SESSION, { journal: journal([turnItem('turn-1', 'running')]), child: { fence: 1 } }]
         ]),
         getRecord: () => record({ chain: [] }),
         backgroundTasks: () => undefined,
@@ -285,7 +287,7 @@ describe('deriving what was working at teardown', () => {
           SESSION,
           {
             journal: journal([], false, [submission('msg-1', 'pending')]),
-            hasProviderChild: true
+            child: { fence: 1 }
           }
         ]
       ]),
@@ -310,7 +312,7 @@ describe('deriving what was working at teardown', () => {
             journal: journal([turnItem('turn-0', 'completed')], false, [
               submission('msg-1', 'pending')
             ]),
-            hasProviderChild: true
+            child: { fence: 1 }
           }
         ]
       ]),
@@ -324,6 +326,67 @@ describe('deriving what was working at teardown', () => {
     expect(recorded?.work).toEqual({ kind: 'submission', id: 'msg-1' })
   })
 
+  // Accepted while the agent was starting and never handed over: the chat shows working, but no
+  // agent had the message, and quit rejects it as never sent.
+  it('marks nothing for a session whose only work is a message still queued', () => {
+    const queued = { ...submission('msg-1', 'pending'), handoverRecorded: true as const }
+    expect(
+      markersAtTeardown({
+        sessions: new Map([
+          [
+            SESSION,
+            {
+              journal: journal([turnItem('turn-0', 'completed')], false, [queued]),
+              child: { fence: 1 }
+            }
+          ]
+        ]),
+        getRecord: () => claudeRecord(null),
+        backgroundTasks: () => undefined,
+        trigger: 'quit',
+        teardownId: TEARDOWN_CURRENT,
+        now: NOW
+      })
+    ).toEqual([])
+  })
+
+  it('marks a handed-over message over a newer queued one, and a turn a queued one waits behind', () => {
+    const handedOver = {
+      ...submission('msg-1', 'pending'),
+      handoverRecorded: true as const,
+      handedOverAt: NOW
+    }
+    const queued = { ...submission('msg-2', 'pending'), handoverRecorded: true as const }
+    const markers = markersAtTeardown({
+      sessions: new Map([
+        [
+          SESSION,
+          {
+            journal: journal([turnItem('turn-0', 'completed')], false, [handedOver, queued]),
+            child: { fence: 1 }
+          }
+        ],
+        [
+          'session-running',
+          {
+            journal: journal([turnItem('turn-1', 'running')], false, [queued]),
+            child: { fence: 1 }
+          }
+        ]
+      ]),
+      getRecord: () => claudeRecord(null),
+      backgroundTasks: () => undefined,
+      trigger: 'quit',
+      teardownId: TEARDOWN_CURRENT,
+      now: NOW
+    })
+
+    expect(markers.map((entry) => entry.work)).toEqual([
+      { kind: 'submission', id: 'msg-1' },
+      { kind: 'turn', id: 'turn-1' }
+    ])
+  })
+
   // Once a turn exists it is the better identity: it is what eviction rewrites, so it is what the
   // journal can be asked about at launch.
   it('prefers the running turn over the send that opened it', () => {
@@ -335,7 +398,7 @@ describe('deriving what was working at teardown', () => {
             journal: journal([turnItem('turn-1', 'running')], false, [
               submission('msg-1', 'accepted')
             ]),
-            hasProviderChild: true
+            child: { fence: 1 }
           }
         ]
       ]),
@@ -390,7 +453,7 @@ describe('the resumable set', () => {
       getRecord: () => claudeRecord('5aed93d6-advanced-leaf'),
       supportsRecord: () => true,
       latestPrompt: () => '',
-      latestUserItemId: () => null
+      movedOn: () => false
     })
 
     expect(candidates).toHaveLength(1)
@@ -405,14 +468,14 @@ describe('the resumable set', () => {
       getRecord: () => claudeRecord(null, 'prov-session-2'),
       supportsRecord: () => true,
       latestPrompt: () => '',
-      latestUserItemId: () => null
+      movedOn: () => false
     })
 
     expect(set.candidates).toEqual([])
     expect(set.superseded).toEqual([forked])
   })
 
-  // An offer has no expiry: it ends only by the user's own actions, however old it is.
+  // An offer has no expiry, however old it is.
   it('still offers a months-old marker', () => {
     const monthsAgo = NOW - 90 * 24 * 60 * 60 * 1000
     expect(resumableSet({ markers: [marker({ recordedAt: monthsAgo })] }).candidates).toHaveLength(
@@ -420,16 +483,6 @@ describe('the resumable set', () => {
     )
   })
 
-  // The user moving on is what withdraws an offer — and it is reported for DELETION, not merely
-  // filtered, so the record does not have to be re-filtered on every read forever.
-  it('withdraws and reports for deletion once the user has sent a newer message', () => {
-    const withdrawn = marker()
-    const set = resumableSet({ markers: [withdrawn], latestUserItemId: 'user-newer' })
-
-    expect(set.candidates).toEqual([])
-    expect(set.superseded).toEqual([withdrawn])
-  })
-
   // Structural refusals are NOT endings: a record this host cannot see right now must not delete
   // a durable offer the user still owns.
   it('does not report a structurally refused marker for deletion', () => {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-status-publication.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-status-publication.test.ts
index 884fba78a4e..524d8943fac 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-status-publication.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-status-publication.test.ts
@@ -95,7 +95,12 @@ async function restartWithPersistedTurn(): Promise<StructuredAgentSessionHost> {
   const host = createHost(store)
   expect(await host.attach(CALLER, hostTestAttachParams(null))).toMatchObject({ ok: true })
   const body = hostTestMessage('persisted conversation')
-  await host.send(CALLER, { envelope: sendEnvelope(store, { body }), body })
+  const sent = await host.send(CALLER, { envelope: sendEnvelope(store, { body }), body })
+  if (!sent.ok) {
+    throw new Error('send was refused')
+  }
+  // Delivered, not just accepted: a message still queued at the restart was never a request.
+  await host.waitForSendSettlement(SESSION, sent.value.clientMessageId)
   await host.flushAllStreamedEvents()
   return createHost(await AgentSessionRecordStore.open({ directory, hostId: 'local' }))
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-teardown.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-teardown.test.ts
index cc40d483187..2ea9e6f57b7 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-teardown.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-teardown.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { expect, it, vi } from 'vitest'
 import { AgentSessionRecoveryCapsule } from '../../runtime/agent-session-recovery-capsule'
 import { attach, hostTestState } from './structured-agent-session-host-test-harness'
@@ -30,7 +31,7 @@ it.each(['beginTeardown', 'captureBeforeStop', 'recordMarkers'] as const)(
       )
       expect(warning.mock.calls.flat().map(String).join(' ')).not.toContain(failure.message)
       expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
-      expect(() => host.journalSnapshot(SESSION)).toThrow('agent_session_ownership_unknown')
+      await expect(host.journalSnapshot(SESSION)).rejects.toThrow('agent_session_ownership_unknown')
     } finally {
       operation.mockRestore()
       warning.mockRestore()
@@ -49,12 +50,14 @@ it.each(['approval', 'question', 'completed'])(
     }
     events.appendItem(
       { provider: 'codex', threadId: THREAD, turnId: 'working', ordinal: 1 },
-      { kind: 'turn', turnId: 'working', state: 'running' }
+      { kind: 'turn', turnId: 'working', state: 'running' },
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await host.flushStreamedEvents(SESSION)
     events.appendItem(
       { provider: 'codex', threadId: THREAD, turnId: 'working', ordinal: 2 },
-      { kind: 'status', text: 'Provider is requesting approval' }
+      { kind: 'status', text: 'Provider is requesting approval' },
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     events.appendItem(
       { provider: 'codex', threadId: THREAD, turnId: 'working', ordinal: 3 },
@@ -65,7 +68,7 @@ it.each(['approval', 'question', 'completed'])(
             kind: event === 'approval' ? 'approval' : 'question'
           }
         : { kind: 'turn', turnId: 'working', state: 'completed' },
-      { lifecycle: true }
+      { lifecycle: true, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await host.flushAllStreamedEvents()
     const offered = await new AgentSessionRecoveryCapsule(root).list(NOW)
@@ -90,7 +93,8 @@ it.each(['approval', 'question', 'completed'] as const)(
     }
     events.appendItem(
       { provider: 'codex', threadId: THREAD, turnId: 'working', ordinal: 1 },
-      { kind: 'turn', turnId: 'working', state: 'running' }
+      { kind: 'turn', turnId: 'working', state: 'running' },
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await host.flushStreamedEvents(SESSION)
     host.deps.adapter.closeSession = async () => {
@@ -103,7 +107,8 @@ it.each(['approval', 'question', 'completed'] as const)(
         },
         event === 'completed'
           ? { kind: 'turn', turnId: 'working', state: 'completed' }
-          : { ...pendingApproval().body, question: 'Which action?', kind: event }
+          : { ...pendingApproval().body, question: 'Which action?', kind: event },
+        { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
       )
       return true
     }
@@ -123,7 +128,8 @@ it('marks a settled chat whose subagent was still running', async () => {
   }
   events.appendItem(
     { provider: 'codex', threadId: THREAD, turnId: 'settled', ordinal: 1 },
-    { kind: 'turn', turnId: 'settled', state: 'completed' }
+    { kind: 'turn', turnId: 'settled', state: 'completed' },
+    { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
   await host.flushStreamedEvents(SESSION)
   host.deps.adapter.backgroundTaskState = () => ({
@@ -153,7 +159,8 @@ it('offers nothing for a chat whose child was not proven stopped', async () => {
   }
   events.appendItem(
     { provider: 'codex', threadId: THREAD, turnId: 'working', ordinal: 1 },
-    { kind: 'turn', turnId: 'working', state: 'running' }
+    { kind: 'turn', turnId: 'working', state: 'running' },
+    { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
   await host.flushStreamedEvents(SESSION)
   host.deps.adapter.closeSession = async () => false
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-resume-eligibility.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-resume-eligibility.ts
index 1b054018371..93a7962d4a2 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-resume-eligibility.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-resume-eligibility.ts
@@ -7,17 +7,14 @@
 // it answers "may this be resumed", not "should it be" — so it lives here now and the caller that
 // knows a surface is asking is the only one that acts on it.
 
+import { agentSessionLeaseIsReleased } from '../../../shared/agent-session-lease-adjudication'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 import { randomUUID } from 'node:crypto'
 import type { AgentSessionAttachParams } from './structured-agent-session-attach'
-import { attachParamsForRecord } from './structured-agent-session-read-restore'
+import { attachParamsForRecord } from './structured-agent-session-conversation-open'
 
 export function isResumableStructuredAgentSessionRecord(record: AgentSessionRecord): boolean {
-  return (
-    !record.lease.unreconciled &&
-    record.lease.claimStatus === 'released' &&
-    record.lease.handoffStage === null
-  )
+  return agentSessionLeaseIsReleased(record.lease)
 }
 
 /** Attach params for a resume, or null when this record's lease is somebody else's problem. */
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.test.ts
index 291a6e0c53e..49a116ec7f7 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.test.ts
@@ -3,8 +3,8 @@
  *
  * The reveal path is the only way an Agent Session History row reaches a chat whose tab this
  * process never published — a chat closed cleanly, or one this process has not opened since
- * launch. It is exercised here through the readable restorer rather than the whole host, because
- * what it must get right is which records it accepts and what it does when the journal is gone.
+ * launch. It opens the conversation through the host's accessor and starts no agent; what it must
+ * get right is which records it accepts and what it answers when the journal cannot be opened.
  */
 
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
@@ -13,8 +13,6 @@ import {
   agentSessionLeaseFixture,
   agentSessionRecordFixture
 } from '../../../shared/agent-session-record.test-fixture'
-import { StructuredAgentSessionReadableRestorer } from './structured-agent-session-readable-restorer'
-import * as readRestore from './structured-agent-session-read-restore'
 import * as providerSupport from './structured-agent-session-provider-support'
 import { revealStructuredAgentSession } from './structured-agent-session-reveal'
 
@@ -35,114 +33,10 @@ function recordFor(provider: 'claude' | 'codex', sessionId: string): AgentSessio
   }
 }
 
-function harness(
-  records: AgentSessionRecord[],
-  options: { supports?: (record: AgentSessionRecord) => boolean } = {}
-) {
-  const live = new Map<string, unknown>()
-  const serializedIds: string[] = []
-  const serialize = <T>(sessionId: string, task: () => Promise<T>): Promise<T> => {
-    serializedIds.push(sessionId)
-    return task()
-  }
-  const restorer = new StructuredAgentSessionReadableRestorer({
-    store: {
-      getRecord: (sessionId: string) => records.find((r) => r.sessionId === sessionId) ?? null,
-      listRecords: () => records
-    } as never,
-    journalRoot: '/journals',
-    supportsRecord: options.supports ?? (() => true),
-    reconcile: async () => null,
-    resolveRecovery: async () => undefined,
-    serialize,
-    hasSession: (sessionId) => live.has(sessionId),
-    onReadable: (sessionId, restored) => live.set(sessionId, restored),
-    retrySettlement: async () => true
-  })
-  return { restorer, live, serializedIds }
-}
-
-const readable = { journal: {}, params: {}, fence: 1 } as never
-
 afterEach(() => {
   vi.restoreAllMocks()
 })
 
-describe('revealing one structured session on demand', () => {
-  beforeEach(() => {
-    vi.spyOn(readRestore, 'restoreStructuredAgentSessionRead').mockResolvedValue(readable)
-  })
-
-  it.each(['claude', 'codex'] as const)('restores a persisted %s chat', async (provider) => {
-    const sessionId = `session-${provider}`
-    const { restorer, live } = harness([recordFor(provider, sessionId)])
-
-    await expect(restorer.restoreOne(sessionId)).resolves.toBe(true)
-    expect(live.has(sessionId)).toBe(true)
-  })
-
-  it('does not need the startup sweep to have run, or run it', async () => {
-    // The whole point: `restore()` is latched to once per process, and a surface asking later must
-    // not be answered from that latch — nor trip it, which would skip every other record.
-    const records = [recordFor('codex', 'session-asked'), recordFor('claude', 'session-untouched')]
-    const { restorer, live } = harness(records)
-
-    await restorer.restoreOne('session-asked')
-
-    expect(live.has('session-asked')).toBe(true)
-    expect(live.has('session-untouched')).toBe(false)
-  })
-
-  it('serializes against the session it restores', async () => {
-    const { restorer, serializedIds } = harness([recordFor('claude', 'session-serialized')])
-
-    await restorer.restoreOne('session-serialized')
-
-    // Ordering against close/eviction is the task queue's job, so the restore must be inside it.
-    expect(serializedIds).toEqual(['session-serialized'])
-  })
-
-  it('returns the live session instead of restoring over it', async () => {
-    const { restorer, live } = harness([recordFor('codex', 'session-live')])
-    live.set('session-live', readable)
-
-    await expect(restorer.restoreOne('session-live')).resolves.toBe(true)
-    expect(readRestore.restoreStructuredAgentSessionRead).not.toHaveBeenCalled()
-  })
-
-  it('refuses a record no adapter supports', async () => {
-    const { restorer } = harness([recordFor('codex', 'session-unsupported')], {
-      supports: () => false
-    })
-
-    await expect(restorer.restoreOne('session-unsupported')).resolves.toBe(false)
-    expect(readRestore.restoreStructuredAgentSessionRead).not.toHaveBeenCalled()
-  })
-
-  it('refuses a session this host holds no record for', async () => {
-    const { restorer } = harness([])
-
-    await expect(restorer.restoreOne('session-absent')).resolves.toBe(false)
-  })
-})
-
-describe('a record whose journal cannot be read', () => {
-  it('reports not-readable without throwing, for either provider', async () => {
-    // A chat whose journal predates the SQLite store restores to nothing here. That is not a
-    // refusal: attach still recovers it, so the caller publishes the tab and lets the pane's hold
-    // finish the job. Throwing, or reporting success, would both be wrong.
-    vi.spyOn(readRestore, 'restoreStructuredAgentSessionRead').mockResolvedValue(null)
-    const { restorer, live } = harness([
-      recordFor('claude', 'session-no-journal-claude'),
-      recordFor('codex', 'session-no-journal-codex')
-    ])
-
-    await expect(restorer.restoreOne('session-no-journal-claude')).resolves.toBe(false)
-    await expect(restorer.restoreOne('session-no-journal-codex')).resolves.toBe(false)
-    expect(live.size).toBe(0)
-  })
-})
-
 describe('the host answer a client acts on', () => {
   beforeEach(() => {
     // Eligibility is the router's call; these cases are about what the answer carries.
@@ -154,39 +48,45 @@ describe('the host answer a client acts on', () => {
     return { ...base, location: { ...base.location, workspaceId } }
   }
 
-  it("answers with the record's own workspace and provider, never a caller's", async () => {
-    // The security property: a client sends only a session id, so the tab cannot be aimed at
-    // another workspace by asking for one.
-    const stored = record('claude', 'workspace-from-record')
+  it.each(['claude', 'codex'] as const)(
+    "answers a %s chat with the record's own workspace and provider, never a caller's",
+    async (provider) => {
+      // The security property: a client sends only a session id, so the tab cannot be aimed at
+      // another workspace by asking for one.
+      const stored = record(provider, 'workspace-from-record')
+      const open = vi.fn(async () => undefined)
 
-    await expect(
-      revealStructuredAgentSession(
-        { store: { getRecord: () => stored } as never, adapter: {} as never },
-        'session-answered',
-        () => true,
-        async () => true
-      )
-    ).resolves.toEqual({
-      sessionId: 'session-answered',
-      workspaceId: 'workspace-from-record',
-      agent: 'claude',
-      readable: true
-    })
-  })
+      await expect(
+        revealStructuredAgentSession(
+          { store: { getRecord: () => stored } as never, adapter: {} as never },
+          'session-answered',
+          open
+        )
+      ).resolves.toEqual({
+        sessionId: 'session-answered',
+        workspaceId: 'workspace-from-record',
+        agent: provider,
+        readable: true
+      })
+      expect(open).toHaveBeenCalledExactlyOnceWith('session-answered')
+    }
+  )
 
-  it('refuses a session this host holds no record for', async () => {
+  it('refuses a session this host holds no record for, opening nothing', async () => {
+    const open = vi.fn(async () => undefined)
     await expect(
       revealStructuredAgentSession(
         { store: { getRecord: () => null } as never, adapter: {} as never },
         'session-absent',
-        () => false,
-        async () => false
+        open
       )
     ).rejects.toThrow('agent_session_identity_required')
+    expect(open).not.toHaveBeenCalled()
   })
 
   it('refuses a record no adapter of this host supports', async () => {
     vi.mocked(providerSupport.adapterSupportsRecord).mockReturnValue(false)
+    const open = vi.fn(async () => undefined)
 
     await expect(
       revealStructuredAgentSession(
@@ -195,14 +95,14 @@ describe('the host answer a client acts on', () => {
           adapter: {} as never
         },
         'session-answered',
-        () => false,
-        async () => false
+        open
       )
     ).rejects.toThrow('structured_agent_session_unsupported')
+    expect(open).not.toHaveBeenCalled()
   })
 
-  it('answers not-readable without refusing when the journal could not be restored', async () => {
-    // The tab is still worth publishing: attach recovers what read restore cannot.
+  it('answers not-readable without refusing when the journal could not be opened', async () => {
+    // The tab is still worth publishing: the chat shows the failure and keeps retrying the read.
     await expect(
       revealStructuredAgentSession(
         {
@@ -210,26 +110,10 @@ describe('the host answer a client acts on', () => {
           adapter: {} as never
         },
         'session-answered',
-        () => false,
-        async () => false
+        async () => {
+          throw new Error('journal unreadable')
+        }
       )
     ).resolves.toMatchObject({ readable: false, agent: 'codex' })
   })
-
-  it('does not restore over a session that is already live', async () => {
-    const restoreReadable = vi.fn(async () => true)
-
-    await expect(
-      revealStructuredAgentSession(
-        {
-          store: { getRecord: () => record('codex', 'workspace-1') } as never,
-          adapter: {} as never
-        },
-        'session-answered',
-        () => true,
-        restoreReadable
-      )
-    ).resolves.toMatchObject({ readable: true })
-    expect(restoreReadable).not.toHaveBeenCalled()
-  })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.ts
index bc36df76df8..2a1899ab1cc 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.ts
@@ -6,39 +6,41 @@
 // launch — is reachable in Agent Session History by id and by nothing else. This is the lookup that
 // turns that id back into something a client can publish.
 //
-// It is deliberately the whole of what reveal does on the host. It takes no hold: a provider child
-// exists because a surface asked for one, and the chat pane asks when it binds. And a journal it
-// cannot read is not a refusal — a chat whose journal predates the SQLite store restores to nothing
-// here, yet attach still recovers it, so the tab is worth publishing either way.
+// It is deliberately the whole of what reveal does on the host. It starts no provider child: only
+// a send does. And a journal it cannot open is not a refusal — the chat shows that failure with a
+// Retry, so the tab is worth publishing either way.
 
+import { agentSessionRefusalError } from '../../../shared/agent-session-wire-refusals'
 import { adapterSupportsRecord } from './structured-agent-session-provider-support'
 import { StructuredAgentSessionReadableRestorer } from './structured-agent-session-readable-restorer'
 import { StructuredAgentSessionRestartRestoreGate } from './structured-agent-session-restart-restore-gate'
 import type {
   StructuredAgentSessionHostDeps,
-  StructuredAgentSessionHostSession,
   StructuredAgentSessionReveal
 } from './structured-agent-session-host-types'
-import { retryPendingStructuredAgentSessionSettlement } from './structured-agent-session-settlement-retry'
 
-/** Throws its refusal as the code itself, matching `resumeHeldStructuredAgentSession`. */
+/** Throws its refusal as the code itself. */
 export async function revealStructuredAgentSession(
   deps: Pick<StructuredAgentSessionHostDeps, 'store' | 'adapter'>,
   sessionId: string,
-  hasSession: (sessionId: string) => boolean,
-  restoreReadable: (sessionId: string) => Promise<boolean>
+  openConversation: (sessionId: string) => Promise<unknown>
 ): Promise<StructuredAgentSessionReveal> {
   const record = deps.store.getRecord(sessionId)
   if (!record) {
-    throw new Error('agent_session_identity_required')
+    throw agentSessionRefusalError('agent_session_identity_required', { reason: 'recordMissing' })
   }
   if (!adapterSupportsRecord(deps.adapter, record)) {
-    throw new Error('structured_agent_session_unsupported')
+    throw agentSessionRefusalError('structured_agent_session_unsupported', {
+      reason: 'hostUnsupported'
+    })
   }
   // Lease state is not consulted on purpose: this neither claims the lease nor spawns a child, so a
-  // contested or reconciling chat still reveals and the hold that follows adjudicates it. Refusing
+  // contested or reconciling chat still reveals and the send that follows adjudicates it. Refusing
   // here would hide the one view of a session a user needs when its ownership is in doubt.
-  const readable = hasSession(sessionId) || (await restoreReadable(sessionId))
+  const readable = await openConversation(sessionId).then(
+    () => true,
+    () => false
+  )
   return {
     sessionId,
     // From the record, never from a caller: a client that knows only a session id must not be able
@@ -49,41 +51,23 @@ export async function revealStructuredAgentSession(
   }
 }
 
-/**
- * The host's whole readable-restore surface: the startup sweep and the on-demand reveal.
- *
- * Bundled the way the lifetime collaborators are, because the two share the restorer
- * and differ only in who is asking — startup, once, for everything; a surface, later, for one.
- */
+/** The host's startup readable-restore sweep: reconcile, resolve, then open each chat's journal. */
 export function createStructuredAgentSessionHostRestore(
   deps: StructuredAgentSessionHostDeps,
-  sessions: Map<string, StructuredAgentSessionHostSession>,
-  now: () => number,
   wiring: Omit<
     ConstructorParameters<typeof StructuredAgentSessionReadableRestorer>[0],
-    'store' | 'journalRoot' | 'supportsRecord' | 'retrySettlement'
+    'openDeps' | 'supportsRecord'
   >
 ): {
   restoreReadableSessions: (sessionIds?: readonly string[]) => Promise<void>
-  revealSession: (sessionId: string) => Promise<StructuredAgentSessionReveal>
-  /** One session, for a caller already inside its serialize. */
-  restoreReadableUnderSerialize: (sessionId: string) => Promise<boolean>
 } {
   const restorer = new StructuredAgentSessionReadableRestorer({
-    store: deps.store,
-    journalRoot: deps.journalRoot,
+    openDeps: deps,
     supportsRecord: (record) => adapterSupportsRecord(deps.adapter, record),
-    retrySettlement: (sessionId, params) =>
-      retryPendingStructuredAgentSessionSettlement({ deps, sessions, sessionId, params, now }),
     ...wiring
   })
   const gate = new StructuredAgentSessionRestartRestoreGate()
   return {
-    restoreReadableSessions: (sessionIds) => gate.run(() => restorer.restore(sessionIds)),
-    revealSession: (sessionId) =>
-      revealStructuredAgentSession(deps, sessionId, wiring.hasSession, (id) =>
-        restorer.restoreOne(id)
-      ),
-    restoreReadableUnderSerialize: (sessionId) => restorer.restoreOneUnderSerialize(sessionId)
+    restoreReadableSessions: (sessionIds) => gate.run(() => restorer.restore(sessionIds))
   }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-rewind-at-rest.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-rewind-at-rest.test.ts
new file mode 100644
index 00000000000..d3a262d0511
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-rewind-at-rest.test.ts
@@ -0,0 +1,227 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
+// A Codex rewind whose outcome only the provider can prove, found on a chat at rest: nothing on
+// screen will start the agent that settles it, so the next send does, and its message is kept.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type {
+  AgentSessionDispatchOutcome,
+  StructuredAgentSessionAdapter
+} from './structured-agent-session-adapter'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import type { StructuredAgentSessionEventSink } from './structured-agent-session-event-sink'
+import {
+  HOST_TEST_NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+const caller = { callerKey: 'desktop' }
+const KEPT = { provider: 'codex' as const, threadId: THREAD, turnId: 'kept', ordinal: 0 }
+
+let directory: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let sink: StructuredAgentSessionEventSink
+let acquires = 0
+const rewind = vi.fn<NonNullable<StructuredAgentSessionAdapter['rewind']>>()
+const recoverRewind = vi.fn<NonNullable<StructuredAgentSessionAdapter['recoverRewind']>>()
+const rewindSupport = vi.fn<NonNullable<StructuredAgentSessionAdapter['rewindSupport']>>()
+const dispatch = vi.fn<StructuredAgentSessionAdapter['dispatch']>()
+
+function adapter(): StructuredAgentSessionAdapter {
+  return {
+    supportsCreate: (_location, agent) => agent === 'codex',
+    supportsLocation: () => true,
+    acquire: async (input) => {
+      acquires += 1
+      sink = input.events!
+      return {
+        process: {
+          hostId: 'local',
+          pid: 4000 + acquires,
+          processStartTimeMs: HOST_TEST_NOW,
+          spawnToken: input.spawnToken
+        },
+        acquisitionGeneration: `generation-${acquires}`,
+        link: {
+          linkId: `link-${acquires}`,
+          mintedAtFence: input.fence,
+          observedAt: HOST_TEST_NOW,
+          origin: acquires === 1 ? 'created' : 'resumed',
+          handle: { provider: 'codex', threadId: THREAD }
+        }
+      }
+    },
+    dispatch,
+    cancelTurn: async () => ({ cancelled: false }),
+    answerPrompt: async () => {},
+    setOption: async () => {},
+    rewindSupport,
+    rewind,
+    recoverRewind,
+    releaseAcquisition: async () => true,
+    closeSession: async () => true
+  }
+}
+
+function openHost(): StructuredAgentSessionHost {
+  return new StructuredAgentSessionHost({
+    store,
+    adapter: adapter(),
+    journalRoot: directory,
+    claimKeyId: 'key',
+    now: () => HOST_TEST_NOW,
+    probeOwner: async () => ({ outcome: 'exit-observed' }),
+    idleSweep: { intervalMs: 3_600_000 }
+  })
+}
+
+beforeEach(async () => {
+  resetHostTestOperationIds()
+  acquires = 0
+  rewind.mockReset()
+  recoverRewind.mockReset().mockResolvedValue({
+    ok: true,
+    items: [{ identity: KEPT, body: hostTestMessage('verified history') }]
+  })
+  rewindSupport.mockReset().mockReturnValue({ supported: true })
+  dispatch.mockReset().mockImplementation(async (input): Promise<AgentSessionDispatchOutcome> => ({
+    state: 'accepted',
+    providerIdentity: {
+      provider: 'codex',
+      threadId: THREAD,
+      turnId: input.clientMessageId,
+      ordinal: 1
+    }
+  }))
+  directory = await mkdtemp(join(tmpdir(), 'orca-rewind-rest-'))
+  store = await AgentSessionRecordStore.open({
+    directory: join(directory, 'store'),
+    hostId: 'local'
+  })
+  host = openHost()
+})
+
+afterEach(async () => {
+  await host.flushAllStreamedEvents()
+  await rm(directory, { recursive: true, force: true })
+})
+
+function fence(): number {
+  return store.getRecord(SESSION)!.lease.runtimeFence
+}
+
+function rewindParams(itemId: string, expectedEpoch: string) {
+  return {
+    itemId,
+    expectedEpoch,
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: fence(),
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.rewind',
+        sessionId: SESSION,
+        fields: { itemId, expectedEpoch }
+      })
+    }
+  }
+}
+
+function sendParams(text: string) {
+  const body = hostTestMessage(text)
+  return {
+    body,
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: fence(),
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    }
+  }
+}
+
+/** A chat whose rewind the provider applied, whose Orca side never finished, reopened at rest. */
+async function interruptedRewindAtRest(): Promise<void> {
+  expect(await host.attach(caller, hostTestAttachParams(null))).toMatchObject({ ok: true })
+  const drop = { ...KEPT, turnId: 'drop' }
+  sink.appendItem(KEPT, hostTestMessage('verified history'), {
+    turnScope: AGENT_JOURNAL_THREAD_SCOPE
+  })
+  sink.appendItem(drop, hostTestMessage('to be rewound'), { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
+  await host.flushStreamedEvents(SESSION)
+  rewind.mockImplementation(async () => {
+    throw new Error('history unavailable')
+  })
+  const epoch = (await host.journalSnapshot(SESSION)).cursor.epoch
+  await expect(host.rewind(caller, rewindParams(agentJournalItemKey(drop), epoch))).rejects.toThrow(
+    'history unavailable'
+  )
+  expect(store.getRecord(SESSION)?.rewind).toMatchObject({ phase: 'prepared' })
+  await host.flushAllStreamedEvents()
+  store = await AgentSessionRecordStore.open({
+    directory: join(directory, 'store'),
+    hostId: 'local'
+  })
+  host = openHost()
+}
+
+describe('an interrupted Codex rewind on a chat at rest (R16)', () => {
+  it('is settled by the start a send makes, and the message is delivered after it', async () => {
+    await interruptedRewindAtRest()
+    expect(host.hasSession(SESSION)).toBe(false)
+    const before = acquires
+
+    const sent = await host.send(caller, sendParams('after the rewind'))
+    expect(sent).toMatchObject({ ok: true })
+    expect(acquires - before).toBe(1)
+    expect(recoverRewind).toHaveBeenCalledOnce()
+    expect(store.getRecord(SESSION)?.rewind?.phase).toBe('completed')
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledOnce())
+    const snapshot = await host.journalSnapshot(SESSION)
+    const texts = snapshot.items.flatMap((item) =>
+      item.body.kind === 'message'
+        ? item.body.blocks.flatMap((block) => (block.type === 'text' ? [block.text] : []))
+        : []
+    )
+    // The recovered history, then the new message — nothing the rewind dropped, nothing lost.
+    expect(texts).toEqual(['verified history', 'after the rewind'])
+    expect(snapshot.submissions.at(-1)?.dispatchState).toBe('accepted')
+  })
+})
+
+describe('a rewind asked of a chat at rest (P2-23)', () => {
+  it('starts the agent first and answers with what the provider says', async () => {
+    expect(await host.attach(caller, hostTestAttachParams(null))).toMatchObject({ ok: true })
+    sink.appendItem(KEPT, hostTestMessage('kept'), { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
+    await host.flushStreamedEvents(SESSION)
+    const epoch = (await host.journalSnapshot(SESSION)).cursor.epoch
+    await host.flushAllStreamedEvents()
+    store = await AgentSessionRecordStore.open({
+      directory: join(directory, 'store'),
+      hostId: 'local'
+    })
+    host = openHost()
+    const before = acquires
+    rewindSupport.mockReturnValue({ supported: false, reason: 'history-not-paginated' })
+
+    const result = await host.rewind(caller, rewindParams(agentJournalItemKey(KEPT), epoch))
+    expect(acquires - before).toBe(1)
+    expect(result).toMatchObject({ ok: false, refusal: { rewindReason: 'history-not-paginated' } })
+    expect(rewind).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-rewind.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-rewind.test.ts
index 19ae18dd5f4..22be823ad78 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-rewind.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-rewind.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
@@ -8,6 +9,7 @@ import {
   agentJournalSubmissionKey
 } from '../../../shared/agent-session-journal-item-key'
 import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import { nativeChatTurnMembership } from '../../../shared/native-chat-turn-membership'
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
 import type {
@@ -139,20 +141,26 @@ async function seed(acceptedSubmissions = false) {
           }
         })
       ).toMatchObject({ ok: true })
+      // Accepted into the conversation first; the delivery loop hands it over after.
+      await vi.waitFor(async () =>
+        expect(
+          (await host.journalSnapshot(HOST_TEST_SESSION)).submissions.find(
+            (entry) => entry.clientMessageId === clientOperationId
+          )?.dispatchState
+        ).toBe('accepted')
+      )
       if (i === 1) {
         selectedItemId = agentJournalSubmissionKey(clientOperationId)
       }
     } else {
-      sink.appendItem(identity, body)
+      sink.appendItem(identity, body, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
     }
   }
   await host.flushStreamedEvents(HOST_TEST_SESSION)
   return selectedItemId
 }
-function params(
-  itemId: string,
-  expectedEpoch = host.journalSnapshot(HOST_TEST_SESSION).cursor.epoch
-) {
+async function params(itemId: string, epoch?: string) {
+  const expectedEpoch = epoch ?? (await host.journalSnapshot(HOST_TEST_SESSION)).cursor.epoch
   return {
     itemId,
     expectedEpoch,
@@ -173,14 +181,14 @@ describe('host rewind', () => {
   it('resolves accepted codex user submissions to provider targets', async () => {
     const target = await seed(true)
     expect(target.startsWith('orca:')).toBe(true)
-    expect(await host.rewind(caller, params(target))).toMatchObject({ ok: true })
-    expect(host.journalSnapshot(HOST_TEST_SESSION).items).toHaveLength(1)
+    expect(await host.rewind(caller, await params(target))).toMatchObject({ ok: true })
+    expect((await host.journalSnapshot(HOST_TEST_SESSION)).items).toHaveLength(1)
     expect(rewind).toHaveBeenCalledWith(expect.objectContaining({ beforeTurnId: 'drop' }))
   })
 
   it('finishes a durable provider success on reattach without repeating the provider mutation', async () => {
     const target = await seed()
-    const request = params(target)
+    const request = await params(target)
     const replace = vi
       .spyOn(AgentSessionJournal.prototype, 'replaceEpochItems')
       .mockRejectedValueOnce(new Error('disk failed'))
@@ -189,7 +197,7 @@ describe('host rewind', () => {
     replace.mockRestore()
     const fence = store.getRecord(HOST_TEST_SESSION)!.lease.runtimeFence
     expect(await host.attach(caller, hostTestAttachParams(fence))).toMatchObject({ ok: true })
-    expect(host.journalSnapshot(HOST_TEST_SESSION).items).toHaveLength(1)
+    expect((await host.journalSnapshot(HOST_TEST_SESSION)).items).toHaveLength(1)
     expect(store.getRecord(HOST_TEST_SESSION)?.rewind?.phase).toBe('completed')
     expect(await host.rewind(caller, request)).toMatchObject({ ok: true, replayed: true })
     expect(rewind).toHaveBeenCalledTimes(1)
@@ -197,17 +205,13 @@ describe('host rewind', () => {
 
   it('retries complete hydration after native acknowledgement without committing partial history', async () => {
     const target = await seed()
-    const before = host.journalSnapshot(HOST_TEST_SESSION)
-    rewind.mockImplementation(async (input) => {
-      await input.onReverted?.()
+    const before = await host.journalSnapshot(HOST_TEST_SESSION)
+    rewind.mockImplementation(async () => {
       throw new Error('history unavailable')
     })
-    await expect(host.rewind(caller, params(target))).rejects.toThrow('history unavailable')
-    expect(host.journalSnapshot(HOST_TEST_SESSION)).toEqual(before)
-    expect(store.getRecord(HOST_TEST_SESSION)?.rewind).toMatchObject({
-      phase: 'prepared',
-      providerApplied: true
-    })
+    await expect(host.rewind(caller, await params(target))).rejects.toThrow('history unavailable')
+    expect(await host.journalSnapshot(HOST_TEST_SESSION)).toEqual(before)
+    expect(store.getRecord(HOST_TEST_SESSION)?.rewind).toMatchObject({ phase: 'prepared' })
     recoverRewind.mockRejectedValueOnce(new Error('history still unavailable'))
     await expect(
       host.attach(
@@ -222,21 +226,15 @@ describe('host rewind', () => {
         hostTestAttachParams(store.getRecord(HOST_TEST_SESSION)!.lease.runtimeFence)
       )
     ).toMatchObject({ ok: true })
-    expect(host.journalSnapshot(HOST_TEST_SESSION).items).toHaveLength(1)
-    expect(host.journalSnapshot(HOST_TEST_SESSION).items[0]?.body).toEqual(
+    expect((await host.journalSnapshot(HOST_TEST_SESSION)).items).toHaveLength(1)
+    expect((await host.journalSnapshot(HOST_TEST_SESSION)).items[0]?.body).toEqual(
       hostTestMessage('verified history')
     )
     expect(recoverRewind).toHaveBeenCalledTimes(2)
     expect(rewind).toHaveBeenCalledTimes(1)
   })
-  it('fences stale owners and the second of two concurrent rewinds', async () => {
+  it('refuses the second of two concurrent rewinds by the epoch it targets', async () => {
     const target = await seed()
-    const stale = params(target)
-    stale.envelope.expectedRuntimeFence++
-    expect(await host.rewind(caller, stale)).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_checkpoint_stale' }
-    })
     let finish!: () => void
     rewind.mockImplementation(
       () =>
@@ -244,9 +242,9 @@ describe('host rewind', () => {
           finish = () => resolve({ ok: true })
         })
     )
-    const first = host.rewind(caller, params(target))
-    const second = host.rewind(caller, params(target))
-    await vi.waitFor(() => expect(finish).toBeTypeOf('function'))
+    const first = host.rewind(caller, await params(target))
+    const second = host.rewind(caller, await params(target))
+    await vi.waitFor(async () => expect(finish).toBeTypeOf('function'))
     finish()
     expect(await first).toMatchObject({ ok: true })
     expect(await second).toMatchObject({ ok: false, refusal: { rewindReason: 'stale-epoch' } })
@@ -254,11 +252,13 @@ describe('host rewind', () => {
   })
   it('replaces the epoch with the retained prefix and replays without another provider call', async () => {
     const target = await seed()
-    const request = params(target)
+    const request = await params(target)
     const result = await host.rewind(caller, request)
     expect(result).toMatchObject({ ok: true })
-    expect(host.journalSnapshot(HOST_TEST_SESSION).items).toHaveLength(1)
-    expect(host.journalSnapshot(HOST_TEST_SESSION).cursor.epoch).not.toBe(request.expectedEpoch)
+    expect((await host.journalSnapshot(HOST_TEST_SESSION)).items).toHaveLength(1)
+    expect((await host.journalSnapshot(HOST_TEST_SESSION)).cursor.epoch).not.toBe(
+      request.expectedEpoch
+    )
     expect(await host.rewind(caller, request)).toMatchObject({ ok: true, replayed: true })
     expect(rewind).toHaveBeenCalledTimes(1)
   })
@@ -266,9 +266,10 @@ describe('host rewind', () => {
     const target = await seed()
     sink.appendItem(
       { provider: 'orca', clientMessageId: 'active' },
-      { kind: 'status', text: 'working', turnLifecycle: { turnId: 'active', state: 'running' } }
+      { kind: 'status', text: 'working', turnLifecycle: { turnId: 'active', state: 'running' } },
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
-    expect(await host.rewind(caller, params(target))).toMatchObject({
+    expect(await host.rewind(caller, await params(target))).toMatchObject({
       ok: false,
       refusal: { rewindReason: 'busy' }
     })
@@ -276,11 +277,11 @@ describe('host rewind', () => {
   })
   it('refuses stale epochs and targets from another provider', async () => {
     const target = await seed()
-    expect(await host.rewind(caller, params(target, 'old-epoch'))).toMatchObject({
+    expect(await host.rewind(caller, await params(target, 'old-epoch'))).toMatchObject({
       ok: false,
       refusal: { rewindReason: 'stale-epoch' }
     })
-    expect(await host.rewind(caller, params('claude:foreign'))).toMatchObject({
+    expect(await host.rewind(caller, await params('claude:foreign'))).toMatchObject({
       ok: false,
       refusal: { rewindReason: 'invalid-target' }
     })
@@ -288,18 +289,18 @@ describe('host rewind', () => {
   })
   it('keeps a failed hydration epoch intact and blocks sends and duplicate rewind', async () => {
     const target = await seed()
-    const request = params(target)
-    const before = host.journalSnapshot(HOST_TEST_SESSION)
+    const request = await params(target)
+    const before = await host.journalSnapshot(HOST_TEST_SESSION)
     rewind.mockRejectedValue(new Error('hydration failed'))
     await expect(host.rewind(caller, request)).rejects.toThrow('hydration failed')
-    expect(host.journalSnapshot(HOST_TEST_SESSION)).toEqual(before)
+    expect(await host.journalSnapshot(HOST_TEST_SESSION)).toEqual(before)
     expect(await host.rewind(caller, request)).toMatchObject({
       ok: false,
       refusal: { code: 'agent_session_operation_unknown' }
     })
     const body = hostTestMessage('new prompt')
     const envelope = {
-      ...params(target).envelope,
+      ...(await params(target)).envelope,
       payloadFingerprint: computeAgentSessionPayloadFingerprint({
         method: 'agentSession.send',
         sessionId: HOST_TEST_SESSION,
@@ -324,9 +325,9 @@ describe('host rewind', () => {
 
   it('clears an unapplied prepared rewind after observing the target still present', async () => {
     const target = await seed()
-    const before = host.journalSnapshot(HOST_TEST_SESSION)
+    const before = await host.journalSnapshot(HOST_TEST_SESSION)
     rewind.mockRejectedValueOnce(new Error('read failed before revert'))
-    await expect(host.rewind(caller, params(target))).rejects.toThrow('read failed')
+    await expect(host.rewind(caller, await params(target))).rejects.toThrow('read failed')
     recoverRewind.mockResolvedValueOnce({ ok: false, reason: 'provider-refused' })
     expect(
       await host.attach(
@@ -334,9 +335,45 @@ describe('host rewind', () => {
         hostTestAttachParams(store.getRecord(HOST_TEST_SESSION)!.lease.runtimeFence)
       )
     ).toMatchObject({ ok: true })
-    expect(host.journalSnapshot(HOST_TEST_SESSION)).toEqual(before)
+    expect(await host.journalSnapshot(HOST_TEST_SESSION)).toEqual(before)
     expect(store.getRecord(HOST_TEST_SESSION)?.rewind?.phase).toBe('refused')
-    expect(await host.rewind(caller, params(target))).toMatchObject({ ok: true })
+    expect(await host.rewind(caller, await params(target))).toMatchObject({ ok: true })
+  })
+
+  // The journal is replaced only once the provider proves the revert, so both still hold the turn.
+  it('settles an acknowledged revert the provider did not keep, so the chat attaches and sends', async () => {
+    const target = await seed()
+    const before = await host.journalSnapshot(HOST_TEST_SESSION)
+    rewind.mockImplementationOnce(async () => {
+      throw new Error('history unavailable')
+    })
+    await expect(host.rewind(caller, await params(target))).rejects.toThrow('history unavailable')
+    expect(store.getRecord(HOST_TEST_SESSION)?.rewind).toMatchObject({ phase: 'prepared' })
+    recoverRewind.mockResolvedValueOnce({ ok: false, reason: 'provider-refused' })
+    expect(
+      await host.attach(
+        caller,
+        hostTestAttachParams(store.getRecord(HOST_TEST_SESSION)!.lease.runtimeFence)
+      )
+    ).toMatchObject({ ok: true })
+    expect(await host.journalSnapshot(HOST_TEST_SESSION)).toEqual(before)
+    expect(store.getRecord(HOST_TEST_SESSION)?.rewind?.phase).toBe('refused')
+    const body = hostTestMessage('after the refused rewind')
+    expect(
+      await host.send(caller, {
+        body,
+        envelope: {
+          sessionId: HOST_TEST_SESSION,
+          clientOperationId: hostTestOperationId(),
+          expectedRuntimeFence: store.getRecord(HOST_TEST_SESSION)!.lease.runtimeFence,
+          payloadFingerprint: computeAgentSessionPayloadFingerprint({
+            method: 'agentSession.send',
+            sessionId: HOST_TEST_SESSION,
+            fields: { body }
+          })
+        }
+      })
+    ).toMatchObject({ ok: true })
   })
 
   it('keeps host-stamped turn and goal rows through a Codex provider hydration', async () => {
@@ -375,27 +412,43 @@ describe('host rewind', () => {
       completedAt: HOST_TEST_NOW - 4_000,
       durationMs: 5_000
     }
-    sink.appendItem(message('kept'), hostTestMessage('kept'))
-    sink.appendItem(goalRow, goalBody)
-    sink.appendItem(turnRow('kept'), keptTurn)
-    sink.appendItem(message('drop'), hostTestMessage('drop'))
-    sink.appendItem(turnRow('drop'), { ...keptTurn, turnId: 'drop', durationMs: 1_000 })
-    sink.appendItem(message('tip'), { ...hostTestMessage('tip'), role: 'assistant' })
+    sink.appendItem(message('kept'), hostTestMessage('kept'), {
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
+    sink.appendItem(goalRow, goalBody, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
+    sink.appendItem(turnRow('kept'), keptTurn, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
+    sink.appendItem(message('drop'), hostTestMessage('drop'), {
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
+    sink.appendItem(
+      turnRow('drop'),
+      { ...keptTurn, turnId: 'drop', durationMs: 1_000 },
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
+    sink.appendItem(
+      message('tip'),
+      { ...hostTestMessage('tip'), role: 'assistant' },
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
     await host.flushStreamedEvents(HOST_TEST_SESSION)
     // The provider preflight knows only its own items, never the host's turn rows.
     const items = [{ identity: message('kept'), body: hostTestMessage('kept from provider') }]
     rewind.mockImplementationOnce(async (input) => {
       await input.onPrepared?.(items)
-      await input.onReverted?.()
       return { ok: true, items }
     })
 
-    expect(await host.rewind(caller, params(agentJournalItemKey(message('drop'))))).toMatchObject({
+    expect(
+      await host.rewind(caller, await params(agentJournalItemKey(message('drop'))))
+    ).toMatchObject({
       ok: true
     })
 
     expect(
-      host.journalSnapshot(HOST_TEST_SESSION).items.map(({ itemId, body }) => ({ itemId, body }))
+      (await host.journalSnapshot(HOST_TEST_SESSION)).items.map(({ itemId, body }) => ({
+        itemId,
+        body
+      }))
     ).toEqual([
       { itemId: agentJournalItemKey(message('kept')), body: hostTestMessage('kept from provider') },
       { itemId: agentJournalItemKey(goalRow), body: goalBody },
@@ -404,6 +457,97 @@ describe('host rewind', () => {
     expect(store.getRecord(HOST_TEST_SESSION)?.rewind?.phase).toBe('completed')
   })
 
+  it('keeps each kept turn opened by the message that opened it, under its provider key', async () => {
+    expect(await host.attach(caller, hostTestAttachParams(null))).toMatchObject({ ok: true })
+    const message = (turnId: string, ordinal = 0) => ({
+      provider: 'codex' as const,
+      threadId: HOST_TEST_THREAD,
+      turnId,
+      ordinal
+    })
+    const turnRow = (turnId: string) => ({
+      provider: 'legacy' as const,
+      agent: 'codex',
+      sessionId: HOST_TEST_SESSION,
+      recordId: `turn-lifecycle:${turnId}`
+    })
+    for (const turnId of ['kept', 'drop']) {
+      const body = hostTestMessage(turnId)
+      const clientOperationId = hostTestOperationId()
+      vi.mocked(adapter.dispatch).mockResolvedValueOnce({
+        state: 'accepted',
+        providerIdentity: message(turnId)
+      })
+      expect(
+        await host.send(caller, {
+          body,
+          envelope: {
+            sessionId: HOST_TEST_SESSION,
+            clientOperationId,
+            expectedRuntimeFence: store.getRecord(HOST_TEST_SESSION)!.lease.runtimeFence,
+            payloadFingerprint: computeAgentSessionPayloadFingerprint({
+              method: 'agentSession.send',
+              sessionId: HOST_TEST_SESSION,
+              fields: { body }
+            })
+          }
+        })
+      ).toMatchObject({ ok: true })
+      await vi.waitFor(async () =>
+        expect(
+          (await host.journalSnapshot(HOST_TEST_SESSION)).submissions.find(
+            (entry) => entry.clientMessageId === clientOperationId
+          )?.dispatchState
+        ).toBe('accepted')
+      )
+      // As the translator writes it: the turn names the submission that opened it.
+      sink.appendItem(
+        turnRow(turnId),
+        {
+          kind: 'turn',
+          turnId,
+          state: 'completed',
+          outcome: 'success',
+          userItemId: agentJournalSubmissionKey(clientOperationId),
+          startedAt: HOST_TEST_NOW - 2_000,
+          completedAt: HOST_TEST_NOW - 1_000
+        },
+        { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+      )
+      sink.appendItem(
+        message(turnId, 1),
+        { ...hostTestMessage(`answer ${turnId}`), role: 'assistant' },
+        { turnScope: { kind: 'turn', turnItemId: agentJournalItemKey(turnRow(turnId)) } }
+      )
+      await host.flushStreamedEvents(HOST_TEST_SESSION)
+    }
+    const items = [
+      { identity: message('kept'), body: hostTestMessage('kept') },
+      {
+        identity: message('kept', 1),
+        body: { ...hostTestMessage('answer kept'), role: 'assistant' as const }
+      }
+    ]
+    rewind.mockImplementationOnce(async (input) => {
+      await input.onPrepared?.(items)
+      return { ok: true, items }
+    })
+    const target = (await host.journalSnapshot(HOST_TEST_SESSION)).submissions.at(-1)!
+    expect(
+      await host.rewind(caller, await params(agentJournalSubmissionKey(target.clientMessageId)))
+    ).toMatchObject({ ok: true })
+
+    const rebuilt = await host.journalSnapshot(HOST_TEST_SESSION)
+    const membership = nativeChatTurnMembership(
+      rebuilt.items.flatMap(({ itemId, body }) =>
+        body.kind === 'message' ? [{ id: itemId, role: body.role }] : []
+      ),
+      rebuilt
+    )
+    const opener = agentJournalItemKey(message('kept'))
+    expect(membership.turnKeys).toEqual([opener, opener])
+  })
+
   it('keeps a host goal row when interrupted Codex rewind recovery rebuilds provider history', async () => {
     expect(await host.attach(caller, hostTestAttachParams(null))).toMatchObject({ ok: true })
     const message = (turnId: string) => ({
@@ -425,19 +569,26 @@ describe('host rewind', () => {
         payload: { head: '{}', byteLength: 2, digest: '4'.repeat(64), truncated: false }
       }
     }
-    sink.appendItem(message('kept'), hostTestMessage('kept'))
-    sink.appendItem(goalRow, goalBody)
-    sink.appendItem(message('drop'), hostTestMessage('drop'))
-    sink.appendItem(message('tip'), { ...hostTestMessage('tip'), role: 'assistant' })
+    sink.appendItem(message('kept'), hostTestMessage('kept'), {
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
+    sink.appendItem(goalRow, goalBody, { turnScope: AGENT_JOURNAL_THREAD_SCOPE })
+    sink.appendItem(message('drop'), hostTestMessage('drop'), {
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
+    sink.appendItem(
+      message('tip'),
+      { ...hostTestMessage('tip'), role: 'assistant' },
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
     await host.flushStreamedEvents(HOST_TEST_SESSION)
-    rewind.mockImplementationOnce(async (input) => {
-      await input.onReverted?.()
+    rewind.mockImplementationOnce(async () => {
       throw new Error('lost after provider revert')
     })
 
-    await expect(host.rewind(caller, params(agentJournalItemKey(message('drop'))))).rejects.toThrow(
-      'lost after provider revert'
-    )
+    await expect(
+      host.rewind(caller, await params(agentJournalItemKey(message('drop'))))
+    ).rejects.toThrow('lost after provider revert')
     recoverRewind.mockResolvedValueOnce({
       ok: true,
       items: [{ identity: message('kept'), body: hostTestMessage('kept from recovery') }]
@@ -450,7 +601,10 @@ describe('host rewind', () => {
     ).toMatchObject({ ok: true })
 
     expect(
-      host.journalSnapshot(HOST_TEST_SESSION).items.map(({ itemId, body }) => ({ itemId, body }))
+      (await host.journalSnapshot(HOST_TEST_SESSION)).items.map(({ itemId, body }) => ({
+        itemId,
+        body
+      }))
     ).toEqual([
       { itemId: agentJournalItemKey(message('kept')), body: hostTestMessage('kept from recovery') },
       { itemId: agentJournalItemKey(goalRow), body: goalBody }
@@ -466,10 +620,9 @@ describe('host rewind', () => {
     }))
     rewind.mockImplementationOnce(async (input) => {
       await input.onPrepared?.(items)
-      await input.onReverted?.()
       throw new Error('lost after revert')
     })
-    await expect(host.rewind(caller, params(target))).rejects.toThrow('lost after revert')
+    await expect(host.rewind(caller, await params(target))).rejects.toThrow('lost after revert')
     recoverRewind.mockResolvedValueOnce({ ok: true, items })
     expect(
       await host.attach(
@@ -477,7 +630,7 @@ describe('host rewind', () => {
         hostTestAttachParams(store.getRecord(HOST_TEST_SESSION)!.lease.runtimeFence)
       )
     ).toMatchObject({ ok: true })
-    expect(host.journalSnapshot(HOST_TEST_SESSION).items).toHaveLength(2)
+    expect((await host.journalSnapshot(HOST_TEST_SESSION)).items).toHaveLength(2)
     expect(store.getRecord(HOST_TEST_SESSION)?.rewind?.phase).toBe('completed')
   })
 
@@ -485,7 +638,7 @@ describe('host rewind', () => {
     'never commits a recovered prefix that omits an expected retained %s',
     async (missing) => {
       const target = await seed()
-      const before = host.journalSnapshot(HOST_TEST_SESSION)
+      const before = await host.journalSnapshot(HOST_TEST_SESSION)
       const items = [0, 1].map((ordinal) => ({
         identity: {
           provider: 'codex' as const,
@@ -499,7 +652,7 @@ describe('host rewind', () => {
         await input.onPrepared?.(items)
         throw new Error('reply lost')
       })
-      await expect(host.rewind(caller, params(target))).rejects.toThrow('reply lost')
+      await expect(host.rewind(caller, await params(target))).rejects.toThrow('reply lost')
       recoverRewind.mockResolvedValueOnce({
         ok: true,
         items: missing === 'turn' ? [] : items.slice(0, 1)
@@ -520,7 +673,7 @@ describe('host rewind', () => {
 
   it('settles the existing epoch after a crash between journal commit and record completion', async () => {
     const target = await seed()
-    const request = params(target)
+    const request = await params(target)
     const transition = store.transitionHandoff.bind(store)
     const checkpoint = vi
       .spyOn(store, 'transitionHandoff')
@@ -534,7 +687,7 @@ describe('host rewind', () => {
         })
       )
     await expect(host.rewind(caller, request)).rejects.toThrow('completion write failed')
-    const committed = host.journalSnapshot(HOST_TEST_SESSION)
+    const committed = await host.journalSnapshot(HOST_TEST_SESSION)
     expect(committed.cursor.epoch).not.toBe(request.expectedEpoch)
     checkpoint.mockRestore()
     const replace = vi.spyOn(AgentSessionJournal.prototype, 'replaceEpochItems')
@@ -544,7 +697,7 @@ describe('host rewind', () => {
         hostTestAttachParams(store.getRecord(HOST_TEST_SESSION)!.lease.runtimeFence)
       )
     ).toMatchObject({ ok: true })
-    expect(host.journalSnapshot(HOST_TEST_SESSION)).toEqual(committed)
+    expect(await host.journalSnapshot(HOST_TEST_SESSION)).toEqual(committed)
     expect(replace).not.toHaveBeenCalled()
     replace.mockRestore()
     expect(await host.rewind(caller, request)).toMatchObject({ ok: true, replayed: true })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-rewind.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-rewind.ts
index baedbe7c4d1..e855ae97ab2 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-rewind.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-rewind.ts
@@ -1,4 +1,5 @@
 import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
+import { agentJournalLinkageFields } from '../../../shared/agent-session-journal-producer'
 import {
   agentJournalItemKey,
   agentJournalSubmissionKey,
@@ -11,8 +12,10 @@ import type {
   AgentSessionRewindResult
 } from '../../../shared/agent-session-rewind'
 import type { AgentSessionMutationResult } from '../../../shared/agent-session-wire'
+import type { AgentJournalItemBody } from '../../../shared/agent-session-journal-types'
 import { AGENT_SESSION_HISTORY_MAX_PAGE_BYTES } from './agent-session-history-page-bounds'
 import type { StructuredAgentSessionMutationContext } from './structured-agent-session-host-mutations'
+import { openWithAgent } from './structured-agent-session-send-preparation'
 import type { StructuredAgentSessionAttachContext } from './structured-agent-session-attach-context'
 import type { StructuredAgentSessionCaller } from './structured-agent-session-host-types'
 import { admitAndRunAgentSessionMutation } from './structured-agent-session-mutation-admission'
@@ -35,6 +38,8 @@ export async function rewindStructuredAgentSession(
       adapter: context.deps.adapter,
       callerKey: caller.callerKey,
       envelope: params.envelope,
+      // Only the provider can do this, so an agent at rest is started first.
+      prepareSession: openWithAgent(context, params.envelope),
       journal: () => context.sessions.get(sessionId)?.journal,
       publish: (journal) => context.publish(sessionId, journal),
       flushStreamedEvents: context.flushStreamedEvents,
@@ -117,10 +122,12 @@ export async function rewindStructuredAgentSession(
           }
           const retained = snapshot.items
             .slice(0, boundary)
-            .map(({ itemId, body, observedAt }) => ({
+            .map(({ itemId, body, observedAt, turnScope, ...linkage }) => ({
               itemId: providerKey(itemId),
-              body,
-              observedAt
+              body: withRenamedTurnOpener(body, providerKey),
+              observedAt,
+              ...(turnScope ? { turnScope } : {}),
+              ...agentJournalLinkageFields(linkage)
             }))
           if (
             retained.length > 10_000 ||
@@ -162,12 +169,6 @@ export async function rewindStructuredAgentSession(
               }
               prepared = { ...prepared, retained }
               await persistRewindRecord(store, sessionId, ctx.fence, prepared)
-            },
-            onReverted: async () => {
-              await persistRewindRecord(store, sessionId, ctx.fence, {
-                ...prepared,
-                providerApplied: true
-              })
             }
           })
           const fence = store.getRecord(sessionId)!.lease.runtimeFence
@@ -226,3 +227,18 @@ export async function rewindStructuredAgentSession(
       : result
   })
 }
+
+/** The new epoch keeps no submissions, so a sent message survives only under its provider key; the
+ *  turn it opened must name it by that key too, or the turn anchors on nothing. */
+function withRenamedTurnOpener(
+  body: AgentJournalItemBody,
+  rename: (itemId: string) => string
+): AgentJournalItemBody {
+  if (body.kind === 'turn' && body.userItemId !== undefined) {
+    return { ...body, userItemId: rename(body.userItemId) }
+  }
+  const lifecycle = body.kind === 'status' ? body.turnLifecycle : undefined
+  return body.kind === 'status' && lifecycle?.userItemId !== undefined
+    ? { ...body, turnLifecycle: { ...lifecycle, userItemId: rename(lifecycle.userItemId) } }
+    : body
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send-block.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send-block.test.ts
new file mode 100644
index 00000000000..61696b573c0
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send-block.test.ts
@@ -0,0 +1,115 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { AgentSessionConversationCommandRecord } from '../../../shared/agent-session-conversation-command'
+import { agentSessionRecordFixture } from '../../../shared/agent-session-record.test-fixture'
+import {
+  openConversationForWrite,
+  structuredAgentSessionSendBlock
+} from './structured-agent-session-send-preparation'
+
+function withCommand(command: AgentSessionConversationCommandRecord) {
+  return { ...agentSessionRecordFixture(), conversationCommand: command }
+}
+
+const COMMAND = { operationId: 'operation-1', callerKey: 'client-1', runtimeFence: 7 }
+
+describe('a send refused by the conversation command it follows', () => {
+  // A clear's commit is its only durable write, so a record short of it never changed the chat.
+  it("lets a send follow a /clear that never committed, as an older build's record leaves one", () => {
+    expect(
+      structuredAgentSessionSendBlock(
+        withCommand({
+          ...COMMAND,
+          command: 'clear',
+          state: 'unknown',
+          phase: 'prepared',
+          replacementSessionId: 'clear-replacement-1'
+        })
+      )
+    ).toBeNull()
+  })
+
+  it('says a committed /clear cleared the conversation', () => {
+    const blocked = structuredAgentSessionSendBlock(
+      withCommand({
+        ...COMMAND,
+        command: 'clear',
+        state: 'completed',
+        phase: 'committed',
+        replacementSessionId: 'clear-replacement-1'
+      })
+    )
+
+    expect(blocked?.refusal).toMatchObject({
+      code: 'agent_session_operation_invalid',
+      details: { reason: 'conversationCleared' }
+    })
+  })
+
+  it("lets a send follow an older build's unconfirmed /compact, whose child this host no longer runs", () => {
+    expect(
+      structuredAgentSessionSendBlock(
+        withCommand({ ...COMMAND, command: 'compact', state: 'unknown', phase: 'prepared' })
+      )
+    ).toBeNull()
+  })
+
+  it('lets a send follow a /clear whose new conversation failed to start', () => {
+    expect(
+      structuredAgentSessionSendBlock(
+        withCommand({ ...COMMAND, command: 'clear', state: 'completed', phase: 'committed' })
+      )
+    ).toBeNull()
+  })
+})
+
+describe('a write whose conversation the host could not open', () => {
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  const ENVELOPE = {
+    sessionId: 'session-1',
+    clientOperationId: 'operation-1',
+    expectedRuntimeFence: 1,
+    payloadFingerprint: ''
+  }
+
+  function refusedBy(error: unknown) {
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    return openConversationForWrite(async () => {
+      throw error
+    }, ENVELOPE)
+  }
+
+  it('says a corrupt history is final, in words and not the error', async () => {
+    const corrupt = Object.assign(new Error('/Users/me/journal.db: file is not a database'), {
+      code: 'ERR_SQLITE_ERROR',
+      errcode: 26
+    })
+
+    expect(await refusedBy(corrupt)).toEqual({
+      ok: false,
+      refusal: {
+        code: 'agent_session_journal_unreadable',
+        details: { reason: 'journalCorrupt' },
+        message: 'Unable to load this chat.'
+      }
+    })
+  })
+
+  it('says any other failed open can clear', async () => {
+    const denied = Object.assign(new Error('EACCES: permission denied, open /Users/me'), {
+      code: 'EACCES',
+      errno: -13
+    })
+
+    expect(await refusedBy(denied)).toEqual({
+      ok: false,
+      refusal: {
+        code: 'agent_session_journal_unreadable',
+        details: { reason: 'journalUnavailable' },
+        message: "Orca couldn't open this chat's history right now. Try again."
+      }
+    })
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts
index 0f75c9a3322..2494535e019 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts
@@ -120,11 +120,16 @@ describe('structured send idempotency', () => {
     await performSend(context, input)
     const replay = await performSend(context, input)
 
+    // Acceptance records the one submission; the reused id answers with it and writes nothing.
+    // Handing it over is the delivery loop's, never a second accept's.
     expect(replay).toMatchObject({
       ok: true,
-      value: { clientMessageId: 'shared-send-id', submission: { dispatchState: 'accepted' } }
+      value: {
+        clientMessageId: 'shared-send-id',
+        submission: { dispatchState: 'pending', handoverRecorded: true }
+      }
     })
-    expect(dispatch).toHaveBeenCalledOnce()
+    expect(dispatch).not.toHaveBeenCalled()
     expect(journal.submissions()).toHaveLength(1)
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send-open-stale-turn.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send-open-stale-turn.test.ts
new file mode 100644
index 00000000000..630e3fa386e
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send-open-stale-turn.test.ts
@@ -0,0 +1,159 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
+// A send can be what opens a conversation this process has not read yet: a chat nobody has on
+// screen after the app died, sent to from a phone or the CLI. Whatever that journal shows running
+// belongs to a generation that is gone, so it is settled when the journal opens, not only when a
+// new child starts: a start that then fails would leave the turn running for every reader.
+
+import { cp, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { afterEach, expect, it, vi } from 'vitest'
+import type { AgentSessionOwnerProbe } from '../../../shared/agent-session-lease-adjudication'
+import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import {
+  adapter,
+  attach,
+  CALLER,
+  envelope,
+  hostTestState,
+  replaceHostTestState
+} from './structured-agent-session-host-test-harness'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestMessage
+} from './structured-agent-session-host-test-data'
+
+/** Delivery runs on its own serialized steps; under a loaded runner they take more than a second. */
+function eventually(assertion: () => unknown): Promise<unknown> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
+
+const relaunchedRoots: string[] = []
+
+afterEach(async () => {
+  await Promise.all(
+    relaunchedRoots.splice(0).map((dir) => rm(dir, { recursive: true, force: true }))
+  )
+})
+
+/** A host that dies mid-turn, relaunched over a copy of its files taken at the crash. */
+async function relaunchAfterCrashMidTurn(
+  probe: AgentSessionOwnerProbe,
+  { reconcile = true }: { reconcile?: boolean } = {}
+) {
+  const dying = hostTestState()
+  await attach()
+  const events = dying.acquire.mock.calls[0]?.[0].events
+  if (!events) {
+    throw new Error('missing provider event sink')
+  }
+  events.appendItem(
+    { provider: 'codex', threadId: THREAD, turnId: 'crashed-turn', ordinal: 1 },
+    { kind: 'turn', turnId: 'crashed-turn', state: 'running' },
+    { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+  )
+  await dying.host.flushStreamedEvents(SESSION)
+  // An empty renewal queues behind every record write, so they are on disk.
+  await dying.store.renewLeases([])
+  const relaunched = `${dying.root}-relaunched`
+  relaunchedRoots.push(relaunched)
+  // A dead process holds no lock.
+  await cp(dying.root, relaunched, {
+    recursive: true,
+    filter: (source) => !source.includes('.lock')
+  })
+  const store = await AgentSessionRecordStore.open({
+    directory: join(relaunched, 'store'),
+    hostId: 'local'
+  })
+  const acquire = vi.fn(async () => {
+    throw new Error('claude: command not found')
+  })
+  const host = new StructuredAgentSessionHost({
+    store,
+    adapter: { ...adapter(), acquire },
+    journalRoot: relaunched,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-next',
+    probeOwner: async () => probe,
+    now: () => NOW
+  })
+  if (reconcile) {
+    await host.reconcileRestartLeases()
+  }
+  replaceHostTestState({ store, host })
+  return { host, acquire }
+}
+
+async function turnStates(host: StructuredAgentSessionHost) {
+  return (await host.journalSnapshot(SESSION)).items
+    .flatMap((item) => readAgentJournalTurn(item.body) ?? [])
+    .map((turn) => turn.state)
+}
+
+// A host that cannot prove the old owner gone leaves its lease in recovery, still claimed, until
+// the next acquire resolves it: the open is not that acquire, and the turn is no less gone. Only
+// the proof decides whether it reads interrupted.
+const PROBES = [
+  ['the old owner is proven gone', { outcome: 'pid-absent' }, 'interrupted'],
+  [
+    'nothing proves the old owner gone',
+    { outcome: 'indeterminate', reason: 'This host cannot probe structured session owners.' },
+    'unverifiable'
+  ]
+] as const satisfies readonly (readonly [string, AgentSessionOwnerProbe, string])[]
+
+it.each(PROBES)(
+  'settles a turn a dead generation left running when a send opens the chat and its start fails, when %s',
+  async (_when, probe, settled) => {
+    const { host, acquire } = await relaunchAfterCrashMidTurn(probe)
+    expect(host.hasSession(SESSION)).toBe(false)
+
+    const body = hostTestMessage('sent to a chat nobody has open')
+    const sendEnvelope = envelope('agentSession.send', { body })
+    await expect(host.send(CALLER, { envelope: sendEnvelope, body })).resolves.toMatchObject({
+      ok: true
+    })
+    await eventually(async () =>
+      expect(
+        (await host.journalSnapshot(SESSION)).submissions.find(
+          (entry) => entry.clientMessageId === sendEnvelope.clientOperationId
+        )
+      ).toMatchObject({ dispatchState: 'rejected' })
+    )
+
+    expect(acquire).toHaveBeenCalledOnce()
+    expect(await turnStates(host)).toEqual([settled])
+    await host.flushAllStreamedEvents()
+  }
+)
+
+it.each(PROBES)(
+  'settles the same turn when a reader opens the chat, when %s',
+  async (_when, probe, settled) => {
+    const { host } = await relaunchAfterCrashMidTurn(probe)
+
+    await host.revealSession(SESSION)
+
+    expect(await turnStates(host)).toEqual([settled])
+    await host.flushAllStreamedEvents()
+  }
+)
+
+// On desktop the chat on screen at relaunch reads before startup reconciles the leases: nothing
+// has proved its owner gone yet, and the reconcile's proof then revises what the open settled.
+it('settles it when a read reaches the chat before the startup reconcile, then revises it', async () => {
+  const { host } = await relaunchAfterCrashMidTurn({ outcome: 'pid-absent' }, { reconcile: false })
+  expect(hostTestState().store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
+
+  await host.history({ sessionId: SESSION, direction: 'tail' })
+  expect(await turnStates(host)).toEqual(['unverifiable'])
+  await host.reconcileRestartLeases()
+  await host.restoreReadableSessions([SESSION])
+
+  expect(await turnStates(host)).toEqual(['interrupted'])
+  await host.flushAllStreamedEvents()
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.test.ts
index f48af3b4d4b..259ad16c858 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.test.ts
@@ -1,15 +1,19 @@
-// A send, or a hold, that finds the session's provider child gone, against the real host.
+// A send, or a hold, that finds the session's provider child gone, against the real host. The
+// send is accepted at once; its delivery restarts the child, or rejects it with the reason.
 
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
 import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
-import { agentSessionRefusalOperationState } from '../../../shared/agent-session-refusal-retry'
-import type { AgentSessionMutationEnvelope } from '../../../shared/agent-session-wire'
+import type {
+  AgentSessionMutationEnvelope,
+  AgentSessionSubscribeEvent
+} from '../../../shared/agent-session-wire'
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import { CodexAppServerRequestError } from '../../codex/codex-app-server-request-error'
 import {
   HOST_TEST_NOW as NOW,
   HOST_TEST_SESSION as SESSION,
@@ -21,8 +25,11 @@ import {
 } from './structured-agent-session-host-test-data'
 
 const CALLER = { callerKey: 'client-1' }
-// Long enough that no release fires mid-test; whether one is pending is asserted directly.
-const GRACE_MS = 60_000
+
+/** Delivery runs on its own serialized steps; under a loaded runner they take more than a second. */
+function eventually(assertion: () => void | Promise<void>): Promise<void> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
 
 let root: string
 let store: AgentSessionRecordStore
@@ -75,7 +82,6 @@ beforeEach(async () => {
     journalRoot: root,
     claimKeyId: 'key-1',
     mintSpawnToken: () => `spawn-${acquire.mock.calls.length}`,
-    releaseGraceMs: GRACE_MS,
     now: () => NOW,
     onEventSinkError: ({ error }) => hostErrors.push(error)
   })
@@ -102,15 +108,37 @@ function sendParams(text: string, operationId = hostTestOperationId()) {
   return { envelope, body }
 }
 
-/** Every status row the chat shows, oldest first; none when the session is not even readable. */
-function journalStatuses(): string[] {
-  if (!host.hasSession(SESSION)) {
-    return []
-  }
-  const history = host.history({ sessionId: SESSION, direction: 'tail' })
-  return history.ok
-    ? history.page.items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
-    : []
+/** Accepted at once, before any owner exists for it; answers the message id. */
+async function accept(params: ReturnType<typeof sendParams>): Promise<string> {
+  const result = await host.send(CALLER, params)
+  expect(result, JSON.stringify(result)).toMatchObject({
+    ok: true,
+    replayed: false,
+    value: { submission: { dispatchState: 'pending', handoverRecorded: true } }
+  })
+  return params.envelope.clientOperationId
+}
+
+async function submission(clientMessageId: string) {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )
+}
+
+/** The submission once delivery is done with it: handed over, or rejected unwritten. */
+async function settled(clientMessageId: string) {
+  await eventually(async () => {
+    const current = await submission(clientMessageId)
+    expect(current?.dispatchState !== 'pending' || current.handedOverAt !== undefined).toBe(true)
+  })
+  return submission(clientMessageId)
+}
+
+/** The failure rows a start the chat needed left, oldest first. */
+async function errorStatuses(): Promise<string[]> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status' && item.body.tone === 'error' ? [item.body.text] : []
+  )
 }
 
 /** The child timed out or exited: its lease is handed back and the host holds no session. */
@@ -127,15 +155,14 @@ describe('a send with no live owner', () => {
   it('restarts the owner once and delivers against it', async () => {
     await loseOwner()
 
-    const result = await host.send(CALLER, sendParams('after the child died'))
+    await accept(sendParams('after the child died'))
 
-    expect(result).toMatchObject({ ok: true, replayed: false })
+    await eventually(async () => expect(dispatch).toHaveBeenCalledOnce())
     expect(acquire).toHaveBeenCalledOnce()
-    expect(dispatch).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
   })
 
-  it('restarts the owner before the send is admitted, so the send is admitted once', async () => {
+  it('accepts the send before anything restarts, and the restart hands it over', async () => {
     await loseOwner()
     const order: string[] = []
     const spawnChild = acquire.getMockImplementation()!
@@ -149,21 +176,18 @@ describe('a send with no live owner', () => {
       return admit(args)
     })
 
-    await expect(host.send(CALLER, sendParams('ensure first'))).resolves.toMatchObject({
-      ok: true,
-      replayed: false
-    })
+    await accept(sendParams('accept first'))
+    await eventually(async () => expect(dispatch).toHaveBeenCalledOnce())
 
-    expect(order).toEqual(['acquire', 'admit'])
+    expect(order).toEqual(['admit', 'acquire'])
   })
 
   it('leaves a live owner alone', async () => {
     acquire.mockClear()
 
-    await expect(host.send(CALLER, sendParams('owner is live'))).resolves.toMatchObject({
-      ok: true
-    })
+    await accept(sendParams('owner is live'))
 
+    await eventually(async () => expect(dispatch).toHaveBeenCalledOnce())
     expect(acquire).not.toHaveBeenCalled()
   })
 
@@ -181,39 +205,14 @@ describe('a send with no live owner', () => {
       }
     }))
 
-    await host.send(CALLER, sendParams('into a cleared chat'))
+    await expect(host.send(CALLER, sendParams('into a cleared chat'))).resolves.toMatchObject({
+      ok: false,
+      refusal: { code: 'agent_session_operation_invalid' }
+    })
 
     expect(acquire).not.toHaveBeenCalled()
   })
 
-  it('renews the idle window on journal activity in an unheld session', async () => {
-    await loseOwner()
-    await expect(host.send(CALLER, sendParams('restart'))).resolves.toMatchObject({ ok: true })
-    const arm = vi.spyOn(host['holds']['clock'], 'arm')
-
-    await expect(host.send(CALLER, sendParams('more activity'))).resolves.toMatchObject({
-      ok: true
-    })
-
-    expect(arm).toHaveBeenCalledWith(SESSION)
-  })
-
-  it('releases the restarted child on the usual clock only when no surface holds it', async () => {
-    await loseOwner()
-    await expect(host.send(CALLER, sendParams('nobody is watching'))).resolves.toMatchObject({
-      ok: true
-    })
-    expect(host['holds'].isReleasePending(SESSION)).toBe(true)
-
-    await host.close(SESSION)
-    // A reading surface that does not itself restart the agent.
-    await host.hold(SESSION, 'desktop-chat:1', { resume: false })
-    await expect(host.send(CALLER, sendParams('the chat is open'))).resolves.toMatchObject({
-      ok: true
-    })
-    expect(host['holds'].isReleasePending(SESSION)).toBe(false)
-  })
-
   it('restarts an owner that exited while the session stayed readable', async () => {
     const fence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
     await host.handleAdapterEvent({
@@ -228,15 +227,15 @@ describe('a send with no live owner', () => {
     expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
     acquire.mockClear()
 
-    await expect(host.send(CALLER, sendParams('after an exit'))).resolves.toMatchObject({
-      ok: true
-    })
+    await accept(sendParams('after an exit'))
+    await eventually(async () => expect(dispatch).toHaveBeenCalledOnce())
     expect(acquire).toHaveBeenCalledOnce()
   })
 
   it('restarts nothing for a resend the journal already answers', async () => {
     const params = sendParams('sent once')
-    await expect(host.send(CALLER, params)).resolves.toMatchObject({ ok: true, replayed: false })
+    await accept(params)
+    await eventually(async () => expect(dispatch).toHaveBeenCalledOnce())
     // The child died during startup: the lease is handed back, the fence moves, and the session
     // stays readable. The client resends against the new fence.
     await host.handleAdapterEvent({
@@ -265,12 +264,9 @@ describe('a send with no live owner', () => {
     expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
 
     // Retry rotates the id: a genuinely new send restarts the owner once.
-    await expect(host.send(CALLER, sendParams('sent once'))).resolves.toMatchObject({
-      ok: true,
-      replayed: false
-    })
+    await accept(sendParams('sent once'))
+    await eventually(async () => expect(dispatch).toHaveBeenCalledTimes(2))
     expect(acquire).toHaveBeenCalledOnce()
-    expect(dispatch).toHaveBeenCalledTimes(2)
   })
 
   it('restarts nothing for a send the ledger holds but the journal never saw', async () => {
@@ -317,7 +313,7 @@ describe('a send with no live owner', () => {
     expect(dispatch).not.toHaveBeenCalled()
   })
 
-  it('rebases a send that arrives after the restart has already claimed the lease', async () => {
+  it('accepts a send that arrives while a restart holds the queue, and hands both over in order', async () => {
     await loseOwner()
     const lostFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
     let claimed = () => {}
@@ -331,18 +327,22 @@ describe('a send with no live owner', () => {
       return spawnChild!(input)
     })
 
-    const first = host.send(CALLER, sendParams('first'))
+    const first = await accept(sendParams('first'))
     await claim
     expect(store.getRecord(SESSION)?.lease.runtimeFence).toBe(lostFence + 1)
+    // Written against the lost owner's fence, which admits it: a send is a conversation write.
     const late = sendParams('second')
     late.envelope.expectedRuntimeFence = lostFence
     const second = host.send(CALLER, late)
     release()
 
-    expect(await first).toMatchObject({ ok: true })
     expect(await second).toMatchObject({ ok: true })
+    await eventually(async () => expect(dispatch).toHaveBeenCalledTimes(2))
     expect(acquire).toHaveBeenCalledOnce()
-    expect(dispatch).toHaveBeenCalledTimes(2)
+    expect(dispatch.mock.calls.map(([input]) => input.clientMessageId)).toEqual([
+      first,
+      late.envelope.clientOperationId
+    ])
   })
 
   it('shares one restart between concurrent sends', async () => {
@@ -355,142 +355,151 @@ describe('a send with no live owner', () => {
     ])
 
     expect(results.map((result) => result.ok)).toEqual([true, true, true])
+    await eventually(async () => expect(dispatch).toHaveBeenCalledTimes(3))
     expect(acquire).toHaveBeenCalledOnce()
-    expect(dispatch).toHaveBeenCalledTimes(3)
-  })
-
-  it('shares one restart between a hold and a send that arrive in the same gap', async () => {
-    await loseOwner()
-
-    const [held, sent] = await Promise.allSettled([
-      host.hold(SESSION, 'desktop-chat:1'),
-      host.send(CALLER, sendParams('while the chat opens'))
-    ])
-
-    expect(held).toMatchObject({ status: 'fulfilled' })
-    expect(sent).toMatchObject({ status: 'fulfilled', value: { ok: true } })
-    expect(acquire).toHaveBeenCalledOnce()
-    expect(dispatch).toHaveBeenCalledOnce()
-    expect(host['holds'].isHeld(SESSION)).toBe(true)
-    expect(host['holds'].isReleasePending(SESSION)).toBe(false)
   })
 
   it('replays into a closed session without spawning anything', async () => {
     const params = sendParams('sent once')
-    await expect(host.send(CALLER, params)).resolves.toMatchObject({ ok: true, replayed: false })
+    await accept(params)
+    await eventually(async () => expect(dispatch).toHaveBeenCalledOnce())
     await loseOwner()
 
     await expect(host.send(CALLER, params)).resolves.toMatchObject({ ok: true, replayed: true })
     await expect(host.send(CALLER, params)).resolves.toMatchObject({ ok: true, replayed: true })
 
-    // The journal was made readable for the answer; the record's lease was left as it was.
+    // The conversation was opened for the answer; the record's lease was left as it was.
     expect(host.hasSession(SESSION)).toBe(true)
     expect(acquire).not.toHaveBeenCalled()
     expect(dispatch).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
-    expect(host['holds'].isReleasePending(SESSION)).toBe(false)
   })
 
-  it("refuses with the restart's own cause, in the answer and in the chat", async () => {
+  it("rejects the accepted message with the restart's own cause, and says so in the chat once", async () => {
     await loseOwner()
     acquire.mockRejectedValue(new Error('Not signed in. Run codex login'))
     const params = sendParams('while signed out')
+    // The acquire's error is Orca's wrapper, not the provider's words: it goes to the log. No exit
+    // was observed, so the chat does not say the provider stopped.
+    const cause = "Codex couldn't restart. Send your message to try again."
 
-    const result = await host.send(CALLER, params)
+    const id = await accept(params)
 
-    expect(result).toEqual({
-      ok: false,
-      refusal: {
-        code: 'agent_session_owner_restart_failed',
-        message: "Codex couldn't restart: Not signed in. Run codex login.",
-        // The failed attach proved its child gone: nothing runs for this session.
-        ownerVerdict: 'exited'
-      }
+    expect(await settled(id)).toMatchObject({
+      dispatchState: 'rejected',
+      reason: cause,
+      rejection: { kind: 'restartFailed' }
     })
     expect(dispatch).not.toHaveBeenCalled()
-    expect(hostErrors).not.toEqual([])
-    expect(agentSessionRefusalOperationState('agent_session_owner_restart_failed')).toBe(
-      'settled-rejected'
-    )
-    // Refused before admission: the ledger holds nothing a resend would replay.
-    expect(store.getOperationRow(CALLER.callerKey, params.envelope.clientOperationId)).toBeNull()
-    // The same status row a failed start leaves, so the reason outlives the error strip.
-    expect(journalStatuses()).toEqual([
-      'The provider stopped before it finished starting: Not signed in. Run codex login.'
-    ])
+    // Accepted, so the ledger answers a resend with the rejection rather than a second attempt.
+    expect(
+      store.getOperationRow(CALLER.callerKey, params.envelope.clientOperationId)
+    ).toMatchObject({ outcome: { status: 'succeeded' } })
+    // One row, in the error tone, so the reason outlives the error strip.
+    expect(await errorStatuses()).toEqual([cause])
   })
 
-  it('restarts again for a Retry of the refused send, under its own id or a new one', async () => {
+  it("keeps Codex's own words behind a refused resume without saying the provider stopped", async () => {
+    await loseOwner()
+    const said = `no rollout found for thread id ${THREAD}`
+    acquire.mockRejectedValue(
+      new CodexAppServerRequestError('thread/resume', -32600, `thread/resume failed: ${said}`, said)
+    )
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+
+    const id = await accept(sendParams('after the thread went away'))
+
+    // The sentence names no cause and quotes nothing; Codex's words ride in the fact for Details.
+    const rejection = {
+      kind: 'restartFailed',
+      detail: { text: said, audience: 'person' },
+      refusal: { code: 'agent_session_operation_invalid', details: { ownerVerdict: 'exited' } }
+    }
+    expect(await settled(id)).toMatchObject({
+      dispatchState: 'rejected',
+      reason: "Codex couldn't restart. Send your message to try again.",
+      rejection
+    })
+    expect(await errorStatuses()).toEqual([
+      "Codex couldn't restart. Send your message to try again."
+    ])
+    // Orca's own text is logged once where the start failed.
+    expect(warn).toHaveBeenCalledWith(
+      '[agent-session] provider start failed:',
+      expect.objectContaining({ message: `thread/resume failed: ${said}` })
+    )
+    warn.mockRestore()
+  })
+
+  it('restarts again for a Retry under a new id, and replays a resend of the same id', async () => {
     await loseOwner()
     acquire.mockRejectedValue(new Error('Not signed in'))
     const params = sendParams('while signed out')
-    await expect(host.send(CALLER, params)).resolves.toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_owner_restart_failed' }
-    })
+    await settled(await accept(params))
+    expect(acquire).toHaveBeenCalledTimes(1)
 
-    // A client that resends the same id gets another attempt, and the chat no second row.
+    // A client that resends the same id gets the recorded rejection, and the chat no second row.
     await expect(host.send(CALLER, params)).resolves.toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_owner_restart_failed' }
+      ok: true,
+      replayed: true,
+      value: { submission: { dispatchState: 'rejected' } }
+    })
+    expect(acquire).toHaveBeenCalledTimes(1)
+    expect(await errorStatuses()).toHaveLength(1)
+
+    // The outbox's Retry rotates the id: a fresh attempt, with its own row.
+    expect(await settled(await accept(sendParams('while signed out')))).toMatchObject({
+      dispatchState: 'rejected'
     })
     expect(acquire).toHaveBeenCalledTimes(2)
-    expect(journalStatuses()).toHaveLength(1)
-
-    // The outbox's Retry rotates the id: also a fresh attempt.
-    await expect(host.send(CALLER, sendParams('while signed out'))).resolves.toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_owner_restart_failed' }
-    })
-    expect(acquire).toHaveBeenCalledTimes(3)
+    expect(await errorStatuses()).toHaveLength(2)
     expect(dispatch).not.toHaveBeenCalled()
   })
 
   it('restarts and delivers a later send once the cause clears', async () => {
     await loseOwner()
     acquire.mockRejectedValueOnce(new Error('Not signed in'))
-    await expect(host.send(CALLER, sendParams('while signed out'))).resolves.toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_owner_restart_failed' }
+    expect(await settled(await accept(sendParams('while signed out')))).toMatchObject({
+      dispatchState: 'rejected'
     })
 
     // The user signed in; nothing about the failed attempt is remembered.
-    await expect(host.send(CALLER, sendParams('signed in now'))).resolves.toMatchObject({
-      ok: true,
-      replayed: false
-    })
+    await accept(sendParams('signed in now'))
+    await eventually(async () => expect(dispatch).toHaveBeenCalledOnce())
     expect(acquire).toHaveBeenCalledTimes(2)
-    expect(dispatch).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
   })
 
   it('suggests a new chat only when this host has nothing to restart the chat from', async () => {
     await loseOwner()
     acquire.mockRejectedValue(new Error('Not signed in'))
-    const failed = await host.send(CALLER, sendParams('restart fails'))
-    expect(failed).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_owner_restart_failed' }
-    })
-    expect(failed.ok ? '' : failed.refusal.message).not.toMatch(/new chat/)
+    const failed = await settled(await accept(sendParams('restart fails')))
+    expect(failed).toMatchObject({ dispatchState: 'rejected' })
+    expect(failed?.reason).not.toMatch(/new chat/)
 
     // The adapter cannot run this record where it lives: no retry would bring it back.
     host.deps.adapter.supportsLocation = () => false
-    const unresumable = await host.send(CALLER, sendParams('cannot resume here'))
+    const unresumable = await settled(await accept(sendParams('cannot resume here')))
 
     expect(unresumable).toMatchObject({
-      ok: false,
-      refusal: {
-        code: 'agent_session_owner_restart_failed',
-        message:
-          "Codex couldn't restart: This execution host cannot resume the requested structured agent session. Start a new chat to continue."
+      dispatchState: 'rejected',
+      reason: "Codex couldn't restart. Start a new chat to continue.",
+      rejection: {
+        kind: 'restartFailed',
+        refusal: {
+          code: 'structured_agent_session_unsupported',
+          details: { reason: 'hostUnsupported' }
+        }
       }
     })
   })
 
-  it('runs the send as the lease stands when the restart met a lease someone else is settling', async () => {
+  it('rejects the message with the cause when the restart met a lease someone else is settling', async () => {
     await loseOwner()
-    vi.spyOn(host['holds'], 'ensureProviderChild').mockResolvedValueOnce({
+    vi.spyOn(
+      host['conversationDelivery'].loop['deps'],
+      'ensureProviderChild'
+    ).mockResolvedValueOnce({
       ok: false,
       refusal: {
         code: 'execution_owner_reconciling',
@@ -498,161 +507,52 @@ describe('a send with no live owner', () => {
       }
     })
 
-    const result = await host.send(CALLER, sendParams('owner being settled'))
+    const id = await accept(sendParams('owner being settled'))
 
-    // The ordinary lease check answers, retryably; nothing terminal and nothing in the chat.
-    expect(result).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_ownership_unknown' }
+    // The refusal's prose stays out of the chat; its code rides in the fact.
+    const cause = "Codex couldn't restart. Send your message to try again."
+    expect(await settled(id)).toMatchObject({
+      dispatchState: 'rejected',
+      reason: cause,
+      rejection: { kind: 'restartFailed', refusal: { code: 'execution_owner_reconciling' } }
     })
     expect(acquire).not.toHaveBeenCalled()
-    expect(journalStatuses()).toEqual([])
+    expect(await errorStatuses()).toEqual([cause])
   })
 
-  it('runs the send as the lease stands when the restart itself faults', async () => {
+  it('rejects the message, and reports the fault, when the restart itself faults', async () => {
     await loseOwner()
-    vi.spyOn(host['holds'], 'ensureProviderChild').mockRejectedValueOnce(
-      new Error('spawn-token mint failed')
-    )
+    vi.spyOn(
+      host['conversationDelivery'].loop['deps'],
+      'ensureProviderChild'
+    ).mockRejectedValueOnce(new Error('spawn-token mint failed'))
 
-    const result = await host.send(CALLER, sendParams('bookkeeping failed'))
+    const id = await accept(sendParams('bookkeeping failed'))
 
-    expect(result).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_ownership_unknown' }
+    // Orca's own fault: reported to the log, and the chat says only that Orca failed.
+    expect(await settled(id)).toMatchObject({
+      dispatchState: 'rejected',
+      reason: "Orca ran into a problem, so this didn't go through. Try again.",
+      rejection: { kind: 'hostFault' }
     })
     expect(hostErrors).toContainEqual(
       expect.objectContaining({ message: 'spawn-token mint failed' })
     )
-    expect(journalStatuses()).toEqual([])
+    expect(await errorStatuses()).toHaveLength(1)
   })
 
-  it('keeps a second surface holder taken during an auto-restart, and starts nothing for it', async () => {
-    await host.hold(SESSION, 'desktop-chat:1')
-    const exitedFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
-    acquire.mockClear()
-    const entered = Promise.withResolvers<void>()
-    const gate = Promise.withResolvers<void>()
-    const spawnChild = acquire.getMockImplementation()!
-    acquire.mockImplementationOnce(async (input) => {
-      entered.resolve()
-      await gate.promise
-      return spawnChild(input)
-    })
-
-    // The held child exits: the host restarts it on its own, under the surface that holds it.
-    const restarted = host.handleAdapterEvent({
-      type: 'ended',
-      sessionId: SESSION,
-      reason: 'provider exited',
-      cause: 'unexpected-exit',
-      fence: exitedFence,
-      acquisitionGeneration: 'generation-1'
-    })
-    await entered.promise
-    const second = host.hold(SESSION, 'paired-phone:1')
-    gate.resolve()
-    await Promise.all([restarted, second])
-
-    expect(acquire).toHaveBeenCalledOnce()
-    expect(host['holds']['holders'].holderIds(SESSION)).toEqual([
-      'desktop-chat:1',
-      'paired-phone:1'
-    ])
-    expect(host['holds'].isReleasePending(SESSION)).toBe(false)
-    expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
-  })
-
-  it('puts the child of an auto-restart on the idle clock when its surface left mid-attach', async () => {
-    await host.hold(SESSION, 'desktop-chat:1')
-    const exitedFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
-    acquire.mockClear()
-    const entered = Promise.withResolvers<void>()
-    const gate = Promise.withResolvers<void>()
-    const spawnChild = acquire.getMockImplementation()!
-    acquire.mockImplementationOnce(async (input) => {
-      entered.resolve()
-      await gate.promise
-      return spawnChild(input)
-    })
-
-    const restarted = host.handleAdapterEvent({
-      type: 'ended',
-      sessionId: SESSION,
-      reason: 'provider exited',
-      cause: 'unexpected-exit',
-      fence: exitedFence,
-      acquisitionGeneration: 'generation-1'
-    })
-    await entered.promise
-    // The only surface leaves while the host is still spawning the child it asked for.
-    host.release(SESSION, 'desktop-chat:1')
-    gate.resolve()
-    await restarted
-
-    expect(acquire).toHaveBeenCalledOnce()
-    expect(host['holds'].isHeld(SESSION)).toBe(false)
-    // Nobody holds the child, so it goes on the same clock a departed surface would start.
-    expect(host['holds'].isReleasePending(SESSION)).toBe(true)
-    expect(hostErrors).toEqual([])
-  })
-
-  it('counts a queued restart as in flight from the moment it is asked for, so a quit drains it', async () => {
-    const closeSession = vi.mocked(host.deps.adapter.closeSession!)
-    acquire.mockClear()
-    const gate = Promise.withResolvers<void>()
-    closeSession.mockImplementationOnce(async () => {
-      await gate.promise
-      return true
-    })
-    const closing = host.close(SESSION)
-    const hold = host.hold(SESSION, 'desktop-chat:1')
-    let drained = false
-    void host['tasks'].drainAttaches().then(() => {
-      drained = true
-    })
-    await new Promise<void>((resolve) => setImmediate(resolve))
-
-    // The hold waits its turn behind the close, and the quit's drain waits for the hold: the
-    // child it is about to spawn must exist before the quit decides what to evict.
-    expect(acquire).not.toHaveBeenCalled()
-    expect(drained).toBe(false)
-
-    gate.resolve()
-    await Promise.all([closing, hold])
-    await new Promise<void>((resolve) => setImmediate(resolve))
-    expect(acquire).toHaveBeenCalledOnce()
-    expect(drained).toBe(true)
-  })
-
-  it('adjudicates a lease this host has not reconciled before a hold resumes it', async () => {
-    await loseOwner()
-    await store.transitionHandoff(SESSION, (current) => ({
-      ...current,
-      lease: { ...current.lease, unreconciled: true }
-    }))
-    host.deps.probeOwner = async () => ({ outcome: 'pid-absent' })
-
-    await host.hold(SESSION, 'desktop-chat:1')
-
-    expect(acquire).toHaveBeenCalledOnce()
-    expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      unreconciled: false,
-      claimStatus: 'live'
-    })
-  })
-
-  it('exits the recovery stage a failed attempt latched before a hold resumes', async () => {
+  it('exits the recovery stage a failed attempt latched before its delivery resumes it', async () => {
     await loseOwner()
     // What an acquisition whose exit could not be proven leaves behind: nobody's, but latched.
     await store.transitionHandoff(SESSION, (current) => ({
       ...current,
-      lease: { ...current.lease, handoffStage: 'manual-recovery' }
+      lease: { ...current.lease, handoffStage: 'recovering' }
     }))
     host.deps.probeOwner = async () => ({ outcome: 'pid-absent' })
 
-    await host.hold(SESSION, 'desktop-chat:1')
+    await accept(sendParams('latched owner'))
 
+    await eventually(async () => expect(dispatch).toHaveBeenCalledOnce())
     expect(acquire).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       handoffStage: null,
@@ -660,19 +560,112 @@ describe('a send with no live owner', () => {
     })
   })
 
-  it('leaves a lease it cannot adjudicate alone', async () => {
+  it('adjudicates a lease this host has not reconciled before its delivery resumes it', async () => {
     await loseOwner()
     await store.transitionHandoff(SESSION, (current) => ({
       ...current,
       lease: { ...current.lease, unreconciled: true }
     }))
 
-    const result = await host.send(CALLER, sendParams('owner unverifiable'))
+    // The send's start is the same serialized resume a hold runs, reconciliation first.
+    await accept(sendParams('owner unverified'))
 
-    expect(result).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_ownership_unknown' }
+    await eventually(async () => expect(dispatch).toHaveBeenCalledOnce())
+    expect(acquire).toHaveBeenCalledOnce()
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      unreconciled: false,
+      claimStatus: 'live'
     })
-    expect(acquire).not.toHaveBeenCalled()
+  })
+})
+
+// A pane keeps the fence of the last frame it read. An idle release and the restart after it
+// each move the lease, so that fence can be several generations behind the one a write lands on.
+describe('a write fenced to an owner the pane has not seen replaced', () => {
+  it('delivers a send fenced to the owner an idle release retired', async () => {
+    const seenFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
+    await loseOwner()
+    const params = sendParams('after the release')
+    params.envelope.expectedRuntimeFence = seenFence
+
+    const id = await accept(params)
+    expect(await settled(id)).toMatchObject({ dispatchState: 'accepted' })
+
+    expect(acquire).toHaveBeenCalledOnce()
+    expect(dispatch).toHaveBeenCalledOnce()
+    expect(store.getRecord(SESSION)?.lease.runtimeFence).toBeGreaterThan(seenFence + 1)
+  })
+
+  // Clients resend a refused message when the fence they hold moves. A failed start is a
+  // rejected message now, never a refused send, and the pane keeps the fence it subscribed under.
+  it("keeps the pane's fence on the rows a failed start publishes, and rejects the message", async () => {
+    const seenFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
+    const frames: AgentSessionSubscribeEvent[] = []
+    await host.subscribe({ id: 'pane', sessionId: SESSION, emit: (event) => frames.push(event) })
+    await loseOwner()
+    acquire.mockRejectedValueOnce(new Error('Not signed in'))
+    const subscribed = frames.length
+
+    const id = await accept(sendParams('while signed out'))
+
+    expect(await settled(id)).toMatchObject({
+      dispatchState: 'rejected',
+      rejection: { kind: 'restartFailed' }
+    })
+    expect(store.getRecord(SESSION)?.lease.runtimeFence).toBeGreaterThan(seenFence + 1)
+    const published = frames.slice(subscribed)
+    expect(published.length).toBeGreaterThan(0)
+    for (const frame of published) {
+      expect(frame).toMatchObject({ fence: seenFence })
+    }
+  })
+
+  it('admits a Stop and a send queued behind the cold start that replaced their owner', async () => {
+    await loseOwner()
+    const lostFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
+    let claimed = () => {}
+    let release = () => {}
+    const claim = new Promise<void>((resolve) => (claimed = resolve))
+    const spawn = new Promise<void>((resolve) => (release = resolve))
+    acquire.mockImplementationOnce(async (input) => {
+      claimed()
+      await spawn
+      return spawnChild(input)
+    })
+
+    const firstParams = sendParams('starts the agent')
+    const first = host.send(CALLER, firstParams)
+    await claim
+    const cancelFields = { turnId: 'turn-1' }
+    const stop = host.cancel(CALLER, {
+      envelope: {
+        sessionId: SESSION,
+        clientOperationId: hostTestOperationId(),
+        expectedRuntimeFence: lostFence,
+        payloadFingerprint: computeAgentSessionPayloadFingerprint({
+          method: 'agentSession.cancel',
+          sessionId: SESSION,
+          fields: cancelFields
+        })
+      },
+      ...cancelFields
+    })
+    const late = sendParams('typed during the start')
+    late.envelope.expectedRuntimeFence = lostFence - 1
+    const second = host.send(CALLER, late)
+    release()
+
+    expect(await first).toMatchObject({ ok: true })
+    expect(await stop).toMatchObject({ ok: true, replayed: false })
+    expect(await second).toMatchObject({ ok: true, replayed: false })
+    // The Stop withdrew the message its start held; the one typed after it is delivered.
+    expect(await settled(late.envelope.clientOperationId)).toMatchObject({
+      dispatchState: 'accepted'
+    })
+    expect(await submission(firstParams.envelope.clientOperationId)).toMatchObject({
+      dispatchState: 'rejected'
+    })
+    expect(acquire).toHaveBeenCalledOnce()
+    expect(dispatch).toHaveBeenCalledTimes(1)
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.ts
index e4a332f7acf..59f265750d2 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.ts
@@ -1,75 +1,33 @@
-// What a send needs from the session before its lease is checked.
-//
-// A provider child that exits or fails to start hands its lease back. Before this, a send to that
-// session was refused `agent_session_ownership_unknown` — which a client reads as "not admitted
-// yet" and resends forever — and only a surface hold could ever make a new child. Now the send
-// makes sure it has an owner as a step of its own serialized admission: a released lease where
-// resume is allowed gets a child first; anything else runs as it is and meets the lease check.
-// A restart that fails refuses with a code the client stops auto-retrying on, carrying the
-// restart's own cause, and writes that cause into the chat the way a start that failed does, so
-// the user sees why. A manual Retry or a new send is a fresh attempt: a refusal before admission
-// leaves no ledger row behind.
-//
-// The ledger's answer comes first, so a send it already holds a row for restarts nothing:
-// admission replays or refuses it whoever owns the session now, and a closed session is made
-// readable for that, never given a child. Otherwise a child that dies at startup moves the fence,
-// the client resends the same message against the new fence, and each replay spawns another
-// child that dies the same way.
-//
-// Running inside the send's serialize is what makes "no child" exact and the fence bookkeeping
-// simple: the owner this send (or a hold just ahead of it) replaced is the one the client was
-// current as of, so the send is admitted at the fence the restart published.
-//
-// A child that has not proven its start is still the owner: the send is admitted against it and
-// the adapter holds the message until startup lands, or rejects it with the child's own reason
-// when the child dies first. The exit settlement writes that reason into the chat.
+// What a send or a Stop needs from the session before the ledger places its row: the
+// conversation open. Nothing here needs an owner — a send is accepted into the conversation and
+// the delivery loop makes the session ready — so a refusal before acceptance is only one the
+// conversation itself makes: a rewind in doubt, a cleared conversation, or a journal that cannot be
+// opened.
 
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
-import type {
-  AgentSessionMutationEnvelope,
-  AgentSessionWireRefusal
-} from '../../../shared/agent-session-wire'
-import type { AgentSessionWireRefusalCode } from '../../../shared/agent-session-wire-refusals'
-import { boundJournalStatusText } from '../agent-session-journal/journal-prompt-body-bounds'
-import { TUI_AGENT_DISPLAY_NAMES } from '../../../shared/tui-agent-display-names'
 import {
-  ownerRestartFailedOutcome,
-  providerStartupFailureOutcome
-} from './structured-agent-session-dead-generation-settlement'
+  refuse,
+  type AgentSessionMutationEnvelope,
+  type AgentSessionWireRefusal
+} from '../../../shared/agent-session-wire'
+import { TUI_AGENT_DISPLAY_NAMES } from '../../../shared/tui-agent-display-names'
+import type { AgentSessionFailureWordsContext } from '../../../shared/agent-session-failure-words'
+import { agentSessionWriteNoticeEnglish } from '../../../shared/agent-session-refusal-notice'
+import {
+  classifyJournalOpenFailure,
+  type JournalOpenFailure
+} from '../agent-session-journal/journal-open-failure'
+import {
+  structuredAgentSessionAwaitedCommand,
+  type StructuredAgentSessionAwaitedCommandJournal
+} from './structured-agent-session-command-turn'
 import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
-import type { StructuredAgentSessionMutationContext } from './structured-agent-session-host-mutations'
-import type { AgentSessionMutationSessionPreparation } from './structured-agent-session-mutation-admission'
-import { isResumableStructuredAgentSessionRecord } from './structured-agent-session-resume-eligibility'
+import {
+  AGENT_SESSION_NOT_ATTACHED,
+  type AgentSessionMutationSessionPreparation
+} from './structured-agent-session-mutation-admission'
 import { rewindRefusal } from './structured-rewind-refusal'
-
-/**
- * What a refused resume means for the send that ran it. `transient`: the resume met a lease
- * someone else is settling, which is not proof it cannot resume — the send runs as the lease
- * stands and admission reports it. `failed`: the restart itself failed; the send answers with the
- * cause and stops the client's retry loop, and the user may clear the cause and retry.
- * `unresumable`: this host has nothing to restart the chat from — no record, or none it can run —
- * so only a new chat continues. A new wire code does not compile until it is classified here.
- */
-const RESUME_REFUSAL_OUTCOME: Record<
-  AgentSessionWireRefusalCode,
-  'transient' | 'failed' | 'unresumable'
-> = {
-  execution_owner_reconciling: 'transient',
-  agent_session_conflict: 'transient',
-  agent_session_checkpoint_stale: 'transient',
-  agent_session_ownership_unknown: 'transient',
-  agent_session_operation_capacity: 'transient',
-  structured_agent_session_unsupported: 'unresumable',
-  agent_session_operation_conflict: 'failed',
-  agent_session_operation_expired: 'failed',
-  agent_session_operation_invalid: 'failed',
-  agent_session_operation_unknown: 'failed',
-  agent_session_item_revision_stale: 'failed',
-  agent_session_already_resolved: 'failed',
-  agent_session_identity_required: 'unresumable',
-  agent_session_journal_unreadable: 'failed',
-  agent_session_owner_restart_failed: 'failed'
-}
+import type { StructuredAgentSessionMutationContext } from './structured-agent-session-host-mutations'
 
 /** Why the record refuses any send right now, whoever owns it; null when a send may run. */
 export function structuredAgentSessionSendBlock(
@@ -80,165 +38,94 @@ export function structuredAgentSessionSendBlock(
     return rewindRefusal('outcome-unknown')
   }
   const command = record?.conversationCommand
+  // Only a committed clear: one that never committed changed nothing, and an older build's
+  // unconfirmed record is one of those.
   if (
-    command &&
-    ((command.state === 'unknown' && command.phase === 'prepared') ||
-      (command.command === 'clear' && command.replacementSessionId))
+    command?.command === 'clear' &&
+    command.phase === 'committed' &&
+    command.replacementSessionId
   ) {
     return {
       ok: false,
-      refusal: {
-        code: 'agent_session_operation_invalid',
-        message: command.replacementSessionId
-          ? 'This conversation has been cleared. Use the current conversation.'
-          : 'The conversation operation is unconfirmed.'
-      }
+      refusal: refuse(
+        'agent_session_operation_invalid',
+        { reason: 'conversationCleared' },
+        'This conversation has been cleared. Use the current conversation.'
+      )
     }
   }
   return null
 }
 
-/** Whether this send is the one that must bring the owner back: no child, a lease handed back
- *  cleanly, and nothing on the record that refuses the send anyway. Live, unverifiable, still
- *  reserved, or handed off: that lease is not this send's to replace. */
-export function structuredAgentSessionSendNeedsOwner(
-  session: StructuredAgentSessionHostSession | undefined,
-  record: AgentSessionRecord
-): boolean {
-  return (
-    session?.hasProviderChild !== true &&
-    isResumableStructuredAgentSessionRecord(record) &&
-    structuredAgentSessionSendBlock(record) === null
-  )
-}
-
-type SendPreparationContext = Pick<
-  StructuredAgentSessionMutationContext,
-  'deps' | 'sessions' | 'holds' | 'restoreReadable' | 'publish'
->
-
-export async function prepareStructuredAgentSessionSend(
-  context: SendPreparationContext,
-  envelope: AgentSessionMutationEnvelope,
-  ledger: 'admit' | 'replay',
-  record: AgentSessionRecord
-): Promise<AgentSessionMutationSessionPreparation> {
-  const { sessionId } = record
-  if (ledger !== 'admit') {
-    if (!context.sessions.has(sessionId)) {
-      await context.restoreReadable(sessionId)
-    }
-    return { ok: true, envelope }
-  }
-  if (structuredAgentSessionSendNeedsOwner(context.sessions.get(sessionId), record)) {
-    const refusal = await restartOwnerForSend(context, envelope, record)
-    if (refusal) {
-      return { ok: false, refusal }
-    }
-  }
-  return { ok: true, envelope: admitAtResumedFence(context.sessions.get(sessionId), envelope) }
-}
-
-/** One restart attempt. Answers with the refusal that ends the send, or null when the send goes
- *  on to admission — after a child, after a transient refusal, or after a fault in the restart's
- *  own bookkeeping, which is reported and never gates the user's action. */
-async function restartOwnerForSend(
-  context: SendPreparationContext,
-  envelope: AgentSessionMutationEnvelope,
-  record: AgentSessionRecord
-): Promise<AgentSessionWireRefusal | null> {
-  const { sessionId } = envelope
-  let resumed: Awaited<ReturnType<typeof context.holds.ensureProviderChild>>
-  try {
-    resumed = await context.holds.ensureProviderChild(sessionId)
-  } catch (error) {
-    context.deps.onEventSinkError?.({ sessionId, error })
-    return null
-  }
-  const outcome = resumed.ok ? null : RESUME_REFUSAL_OUTCOME[resumed.refusal.code]
-  if (resumed.ok || outcome === 'transient') {
-    return null
-  }
-  const refusal = ownerRestartFailedRefusal(record, resumed.refusal, outcome !== 'unresumable')
-  context.deps.onEventSinkError?.({
-    sessionId,
-    error: new Error(`${resumed.refusal.code}: ${resumed.refusal.message}`)
-  })
-  // A restart whose child died starting leaves the row any start that died leaves, so the chat
-  // reads the same whether the send met that death before admission or after it.
-  await recordFailedRestart(
-    context,
-    envelope,
-    resumed.refusal.ownerVerdict === 'exited'
-      ? providerStartupFailureOutcome(resumed.refusal.message)
-      : refusal.message
-  )
-  return refusal
-}
-
-/** The client stops on the code; the message carries the restart's own cause, and the verdict —
- *  when the failed attach proved its child gone — tells a client nothing runs for the session. */
-function ownerRestartFailedRefusal(
-  record: AgentSessionRecord,
-  cause: AgentSessionWireRefusal,
-  resumable: boolean
-): AgentSessionWireRefusal {
-  return {
-    code: 'agent_session_owner_restart_failed',
-    message: ownerRestartFailedOutcome({
-      agentName: TUI_AGENT_DISPLAY_NAMES[record.provider],
-      reason: cause.message,
-      resumable
-    }),
-    ...(cause.ownerVerdict ? { ownerVerdict: cause.ownerVerdict } : {})
-  }
-}
-
-/** The same status row a start that failed leaves in the chat, so the reason outlives the error
- *  strip. The journal is made readable for it when the failed attach left none behind. Keyed by
- *  the send, not the clock: a resend of the same id that fails again adds no second row. */
-async function recordFailedRestart(
-  context: SendPreparationContext,
-  envelope: AgentSessionMutationEnvelope,
-  text: string
-): Promise<void> {
-  const { sessionId } = envelope
-  try {
-    if (!context.sessions.has(sessionId)) {
-      await context.restoreReadable(sessionId)
-    }
-    const session = context.sessions.get(sessionId)
-    if (!session) {
-      return
-    }
-    const settlementId = `failed-restart:${envelope.clientOperationId}`
-    await session.journal.appendLifecycleBatch({
-      settlementId,
-      fence: session.fence,
-      recovered: true,
-      mutations: [
-        {
-          kind: 'item',
-          identity: { provider: 'orca', clientMessageId: settlementId },
-          body: { kind: 'status', text: boundJournalStatusText(text) }
-        }
-      ]
-    })
-    context.publish(sessionId, session.journal)
-  } catch (error) {
-    context.deps.onEventSinkError?.({ sessionId, error })
-  }
-}
-
-/** A writer current as of the owner this child replaced is current now: the restart was the only
- *  thing that moved the fence, whether this send ran it or one just ahead of it did. */
-function admitAtResumedFence(
-  session: StructuredAgentSessionHostSession | undefined,
+/** The conversation a send or a Stop writes to, opened when this host holds it closed. */
+export async function openConversationForWrite(
+  openConversation: (sessionId: string) => Promise<StructuredAgentSessionHostSession | null>,
   envelope: AgentSessionMutationEnvelope
-): AgentSessionMutationEnvelope {
-  return session?.hasProviderChild &&
-    session.resumedFromFence !== undefined &&
-    envelope.expectedRuntimeFence === session.resumedFromFence
-    ? { ...envelope, expectedRuntimeFence: session.fence }
-    : envelope
+): Promise<AgentSessionMutationSessionPreparation> {
+  try {
+    if (await openConversation(envelope.sessionId)) {
+      return { ok: true }
+    }
+    return { ok: false, refusal: AGENT_SESSION_NOT_ATTACHED }
+  } catch (error) {
+    console.warn('[agent-session] opening the conversation for a write failed:', error)
+    const reason = classifyJournalOpenFailure(error)
+    return {
+      ok: false,
+      refusal: refuse('agent_session_journal_unreadable', { reason }, JOURNAL_OPEN_MESSAGE[reason])
+    }
+  }
+}
+
+// Released clients print a refusal's message for a send; it fits a Stop too.
+const JOURNAL_OPEN_MESSAGE: Record<JournalOpenFailure, string> = {
+  journalCorrupt: agentSessionWriteNoticeEnglish(['historyUnusable']),
+  journalUnavailable: agentSessionWriteNoticeEnglish(['historyUnavailable', 'tryAgain'])
+}
+
+/** The conversation a write lands in, opened when this host holds it closed. */
+export function openForWrite(
+  context: Pick<StructuredAgentSessionMutationContext, 'openConversation'>,
+  envelope: AgentSessionMutationEnvelope
+): () => Promise<AgentSessionMutationSessionPreparation> {
+  return () => openConversationForWrite(context.openConversation, envelope)
+}
+
+/** For an operation only the provider can perform: the conversation, then its agent. */
+export function openWithAgent(
+  context: Pick<StructuredAgentSessionMutationContext, 'openConversation' | 'ensureAgent'>,
+  envelope: AgentSessionMutationEnvelope
+): () => Promise<AgentSessionMutationSessionPreparation> {
+  return async () => {
+    const opened = await openConversationForWrite(context.openConversation, envelope)
+    return opened.ok ? context.ensureAgent(envelope.sessionId) : opened
+  }
+}
+
+/** A rewind still in doubt once the conversation is open is one only its provider can settle —
+ *  the open settles every other — so a send starts the agent, whose attach recovers it. */
+export function sendPreparation(
+  context: Pick<StructuredAgentSessionMutationContext, 'openConversation' | 'ensureAgent' | 'deps'>,
+  envelope: AgentSessionMutationEnvelope
+): () => Promise<AgentSessionMutationSessionPreparation> {
+  return async () => {
+    const opened = await openConversationForWrite(context.openConversation, envelope)
+    const phase = context.deps.store.getRecord(envelope.sessionId)?.rewind?.phase
+    return opened.ok && (phase === 'prepared' || phase === 'provider-succeeded')
+      ? context.ensureAgent(envelope.sessionId)
+      : opened
+  }
+}
+
+/** Who a failure sentence names: the chat's agent, when the record says; and, given the journal,
+ *  the command a failed start leaves to run again. */
+export function structuredAgentSessionFailureWordsContext(
+  record: AgentSessionRecord | null,
+  journal?: StructuredAgentSessionAwaitedCommandJournal
+): AgentSessionFailureWordsContext {
+  const command = journal && structuredAgentSessionAwaitedCommand(journal)
+  return {
+    ...(record ? { agentName: TUI_AGENT_DISPLAY_NAMES[record.provider] } : {}),
+    ...(command ? { command } : {})
+  }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send-restarts-failed-start.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send-restarts-failed-start.test.ts
index 181b40660f8..f339aa1113f 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-send-restarts-failed-start.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send-restarts-failed-start.test.ts
@@ -1,17 +1,17 @@
 // A session that published and then lost its child before startup (not signed in, say) keeps a
 // released lease and a chat the user can still type into. The send is the user asking for the
-// child back: the host restarts it before admitting the write and delivers against the new owner,
-// instead of parking the message behind a lease nothing would ever re-acquire.
+// child back: the host accepts the message, and its delivery restarts the child and hands the
+// message to the new owner, instead of parking it behind a lease nothing would ever re-acquire.
 //
 // A child is published before it has proven its start, and it owns the send from that moment: the
-// message is admitted against it and the adapter holds it for the start. When the child exits
-// first, the exit settlement rejects the message and writes the cause into the chat, once, and
-// the next send is a fresh restart.
+// message is handed to it. When the child exits first, the exit settlement rejects the message and
+// writes the cause into the chat, once, and the next send is a fresh restart.
 
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
 import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
 import type { AgentSessionMutationEnvelope } from '../../../shared/agent-session-wire'
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
@@ -22,12 +22,18 @@ import {
   HOST_TEST_SESSION as SESSION,
   HOST_TEST_THREAD as THREAD,
   hostTestAttachParams,
+  hostTestDrawnRowIds,
   hostTestMessage,
   hostTestOperationId,
   resetHostTestOperationIds
 } from './structured-agent-session-host-test-data'
 
 const CALLER = { callerKey: 'client-1' }
+
+/** Delivery runs on its own serialized steps; under a loaded runner they take more than a second. */
+function eventually(assertion: () => void | Promise<void>): Promise<void> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
 const EXIT_REASON = 'Claude Code is not signed in. Sign in with the Claude CLI'
 
 let root: string
@@ -53,7 +59,7 @@ function sendEnvelope(
   }
 }
 
-/** A send is admitted against the child it meets, proven or not; the adapter holds the rest. */
+/** A send is accepted at once and handed to the child delivery finds or starts. */
 async function send(
   text: string,
   fence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
@@ -63,9 +69,13 @@ async function send(
   expect(sent, JSON.stringify(sent)).toMatchObject({
     ok: true,
     replayed: false,
-    value: { submission: { dispatchState: 'pending' } }
+    value: { submission: { dispatchState: 'pending', handoverRecorded: true } }
   })
-  return sent.ok ? sent.value.clientMessageId : ''
+  const clientMessageId = sent.ok ? sent.value.clientMessageId : ''
+  await eventually(async () =>
+    expect((await submission(clientMessageId))?.handedOverAt).toBeDefined()
+  )
+  return clientMessageId
 }
 
 /** The child of the current acquisition, as the adapter would identify it in a lifecycle event. */
@@ -91,21 +101,27 @@ function exitBeforeProof(): Promise<void> {
     type: 'ended',
     ...currentChild(),
     reason: EXIT_REASON,
+    failure: { kind: 'providerExited', detail: { text: EXIT_REASON, audience: 'log' } },
     cause: 'unexpected-exit',
     startupUnproven: true
   })
 }
 
-function journalStatuses(): string[] {
-  return host
-    .journalSnapshot(SESSION)
-    .items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
+const STARTUP_FAILURE = {
+  kind: 'providerStartFailed',
+  detail: { text: EXIT_REASON, audience: 'log' }
 }
 
-function submission(clientMessageId: string) {
-  return host
-    .journalSnapshot(SESSION)
-    .submissions.find((entry) => entry.clientMessageId === clientMessageId)
+async function journalStatuses(): Promise<string[]> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status' ? [item.body.text] : []
+  )
+}
+
+async function submission(clientMessageId: string) {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )
 }
 
 beforeEach(async () => {
@@ -166,8 +182,7 @@ describe('a send into a published session whose child ended before startup', ()
 
     await send('hello again', releasedFence)
 
-    // The client was current as of the lost owner, so the send is rebased onto the fence the
-    // resume published and admitted once, with no stale round trip.
+    // Accepted at the lost owner's fence and handed to the child delivery started, once.
     expect(acquire).toHaveBeenCalledTimes(2)
     expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
     expect(dispatch).toHaveBeenCalledOnce()
@@ -183,40 +198,50 @@ describe('a send into a published session whose child ended before startup', ()
 
   it('retires the held message with the cause when the restarted child exits before proving its start', async () => {
     const releasedFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
-    const rowsBefore = journalStatuses().length
+    const rowsBefore = (await journalStatuses()).length
 
     const held = await send('still not signed in', releasedFence)
     await exitBeforeProof()
 
     // The child never proved its start, so it accepted nothing: the exit rejects the message this
     // host admitted, so nothing pins the session and Retry stays offered, and one row names the cause.
-    expect(submission(held)).toMatchObject({
+    expect(await submission(held)).toMatchObject({
       dispatchState: 'rejected',
-      reason: expect.stringContaining(EXIT_REASON),
+      reason: 'Codex stopped before it finished starting. Send your message to try again.',
+      rejection: STARTUP_FAILURE,
       recovered: true
     })
     expect(
-      host.journalSnapshot(SESSION).submissions.filter((e) => e.dispatchState === 'pending')
+      (await host.journalSnapshot(SESSION)).submissions.filter((e) => e.dispatchState === 'pending')
     ).toEqual([])
-    expect(journalStatuses().slice(rowsBefore)).toEqual([
-      expect.stringMatching(/stopped before it finished starting: .*not signed in/)
+    expect((await journalStatuses()).slice(rowsBefore)).toEqual([
+      'Codex stopped before it finished starting. Send your message to try again.'
     ])
+    // Accepted before the restart it needed, so the chat draws it above the row naming the cause.
+    const snapshot = await host.journalSnapshot(SESSION)
+    const causeRow = snapshot.items.findLast((item) => item.body.kind === 'status')?.itemId
+    const shown = [agentJournalSubmissionKey(held), causeRow]
+    expect(
+      hostTestDrawnRowIds(snapshot, [
+        { clientMessageId: held, text: 'still not signed in' }
+      ]).filter((id) => shown.includes(id))
+    ).toEqual(shown)
     // The failed restart moved the fence twice: the acquisition, and the exit that released it.
     expect(store.getRecord(SESSION)?.lease.runtimeFence).toBe(releasedFence + 2)
     expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
     // One spawn per user action: nothing restarted it a second time.
     expect(acquire).toHaveBeenCalledTimes(2)
 
-    // Retry is a fresh action: it restarts once and is admitted against the new child.
+    // Retry is a fresh action: it restarts once and is handed to the new child.
     await send('signed in now')
     expect(acquire).toHaveBeenCalledTimes(3)
     expect(dispatch).toHaveBeenCalledTimes(2)
-    expect(journalStatuses().slice(rowsBefore)).toHaveLength(1)
+    expect((await journalStatuses()).slice(rowsBefore)).toHaveLength(1)
   })
 })
 
 describe('a send while the child of the first start is still proving itself', () => {
-  it('is admitted against the starting child, and nothing restarts it', async () => {
+  it('is handed to the starting child, and nothing restarts it', async () => {
     await send('hello')
 
     expect(dispatch).toHaveBeenCalledOnce()
@@ -225,7 +250,7 @@ describe('a send while the child of the first start is still proving itself', ()
     await proveStarted()
 
     expect(acquire).toHaveBeenCalledOnce()
-    expect(journalStatuses()).toEqual([])
+    expect(await journalStatuses()).toEqual([])
   })
 
   it('is retired with the cause when that child exits first, and restarts nothing', async () => {
@@ -234,14 +259,15 @@ describe('a send while the child of the first start is still proving itself', ()
 
     await exitBeforeProof()
 
-    expect(submission(held)).toMatchObject({
+    expect(await submission(held)).toMatchObject({
       dispatchState: 'rejected',
-      reason: expect.stringContaining(EXIT_REASON),
+      reason: 'Codex stopped before it finished starting. Send your message to try again.',
+      rejection: STARTUP_FAILURE,
       recovered: true
     })
     expect(acquire).toHaveBeenCalledOnce()
-    expect(journalStatuses()).toEqual([
-      expect.stringMatching(/stopped before it finished starting: .*not signed in/)
+    expect(await journalStatuses()).toEqual([
+      'Codex stopped before it finished starting. Send your message to try again.'
     ])
     expect(store.getRecord(SESSION)?.lease.runtimeFence).toBe(fence + 1)
   })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.test.ts
index b461d508f42..677963ab3f9 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.test.ts
@@ -27,6 +27,74 @@ function emptyJournal(): AgentSessionJournal {
   } as unknown as AgentSessionJournal
 }
 
+/** A message accepted and not yet handed over, while `activeTurnId` names the running turn. */
+function queuedJournal(
+  activeTurnId: string | null,
+  handedOver = false
+): Pick<AgentSessionJournal, 'submissions' | 'cursor' | 'activeTurnId'> {
+  return {
+    cursor: () => ({ epoch: 'epoch-1', sequence: handedOver ? 3 : 2 }),
+    activeTurnId: () => activeTurnId,
+    submissions: () => [
+      {
+        clientMessageId: 'client-1',
+        fence: 1,
+        payloadFingerprint: 'fingerprint',
+        dispatchState: 'pending',
+        providerItemId: null,
+        reason: null,
+        submittedAt: 1,
+        resolvedAt: null,
+        handoverRecorded: true,
+        ...(handedOver ? { handedOverAt: 3 } : {})
+      }
+    ]
+  }
+}
+
+describe('a wait that also ends behind a running command', () => {
+  const until = 'handed-over-or-behind-command' as const
+
+  it('ends once the message waits behind a running command', async () => {
+    const settlements = new StructuredAgentSessionSendSettlement(() => queuedJournal('turn-1'))
+    const pending = settlements.wait('session-1', 'client-1', { until })
+
+    settlements.publish('session-1', queuedJournal('compact:cmd-1'))
+
+    const settled = await pending
+    if (!settled || !('submission' in settled.value)) {
+      throw new Error('expected the submission arm')
+    }
+    expect(settled.value.submission.dispatchState).toBe('pending')
+    expect(settled.value.submission).not.toHaveProperty('handedOverAt')
+  })
+
+  it('keeps waiting for the handover behind anything that is not a command', async () => {
+    const settlements = new StructuredAgentSessionSendSettlement(() => queuedJournal(null))
+    let settled = false
+    const pending = settlements.wait('session-1', 'client-1', { until }).then((result) => {
+      settled = true
+      return result
+    })
+
+    settlements.publish('session-1', queuedJournal('turn-1'))
+    await Promise.resolve()
+    expect(settled).toBe(false)
+    settlements.publish('session-1', queuedJournal('turn-1', true))
+
+    await expect(pending).resolves.toMatchObject({ value: { submission: { handedOverAt: 3 } } })
+  })
+
+  it('leaves the plain handover wait to the handover', async () => {
+    const settlements = new StructuredAgentSessionSendSettlement(() =>
+      queuedJournal('compact:cmd-1')
+    )
+    const pending = settlements.wait('session-1', 'client-1', { until: 'handed-over', budgetMs: 1 })
+
+    await expect(pending).resolves.toBeUndefined()
+  })
+})
+
 describe('structured send settlement compatibility wait', () => {
   afterEach(() => vi.useRealTimers())
 
@@ -61,7 +129,7 @@ describe('structured send settlement compatibility wait', () => {
   it('removes an abandoned wait on transport cancellation', async () => {
     const settlements = new StructuredAgentSessionSendSettlement(() => journal('pending'))
     const controller = new AbortController()
-    const pending = settlements.wait('session-1', 'client-1', controller.signal)
+    const pending = settlements.wait('session-1', 'client-1', { signal: controller.signal })
 
     controller.abort(new Error('transport closed'))
     await expect(pending).rejects.toThrow('transport closed')
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.ts
index 6150e3412a6..a9815b953f8 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.ts
@@ -3,7 +3,12 @@ import type {
   AgentJournalSubmission
 } from '../../../shared/agent-session-journal-types'
 import type { AgentSessionSendResult } from '../../../shared/agent-session-wire'
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { isStructuredAgentSessionCommandTurnId } from './structured-agent-session-command-turn'
+
+/** What a settlement read needs of a journal. */
+type SendSettlementJournal = Pick<AgentSessionJournal, 'submissions' | 'cursor' | 'activeTurnId'>
 
 type SettledSend = {
   cursor: AgentJournalCursor
@@ -12,8 +17,20 @@ type SettledSend = {
 
 type SendSettlement = SettledSend | 'pending' | 'missing'
 
+/** What ends a wait: the provider's answer, the host handing the message over, or either that or
+ *  the message waiting behind a running command, which hands nothing over until it ends. */
+export type SendSettlementPoint = 'answered' | 'handed-over' | 'handed-over-or-behind-command'
+
+export type SendSettlementWaitOptions = {
+  signal?: AbortSignal
+  /** How long to observe; unanswered by then resolves undefined. */
+  budgetMs?: number
+  until?: SendSettlementPoint
+}
+
 type SendSettlementWaiter = {
   clientMessageId: string
+  until: SendSettlementPoint
   resolve: (result: SettledSend | undefined) => void
   reject: (error: Error) => void
   timer: ReturnType<typeof setTimeout>
@@ -23,12 +40,15 @@ type SendSettlementWaiter = {
 
 // Known legacy clients abandon the RPC after 15s without cancelling its socket dispatch.
 const SEND_SETTLEMENT_WAIT_TIMEOUT_MS = 30_000
+/** Long enough for a cold provider start; a longer one replays through the same wait. */
+export const STRUCTURED_AGENT_SESSION_START_WAIT_MS = 120_000
 const MAX_SEND_SETTLEMENT_WAITERS_PER_SESSION = 64
 const MAX_SEND_SETTLEMENT_WAITERS = 1_024
 
 function settledSend(
-  journal: AgentSessionJournal,
+  journal: SendSettlementJournal,
   clientMessageId: string,
+  until: SendSettlementPoint,
   submission: AgentJournalSubmission | undefined = journal
     .submissions()
     .find((candidate) => candidate.clientMessageId === clientMessageId)
@@ -36,9 +56,17 @@ function settledSend(
   if (!submission) {
     return 'missing'
   }
-  return submission.dispatchState === 'pending'
-    ? 'pending'
-    : { cursor: journal.cursor(), value: { clientMessageId, submission } }
+  const waiting =
+    until === 'answered'
+      ? submission.dispatchState === 'pending'
+      : isQueuedAgentJournalSubmission(submission) &&
+        !(until === 'handed-over-or-behind-command' && runningCommand(journal))
+  return waiting ? 'pending' : { cursor: journal.cursor(), value: { clientMessageId, submission } }
+}
+
+function runningCommand(journal: SendSettlementJournal): boolean {
+  const turnId = journal.activeTurnId()
+  return turnId !== null && isStructuredAgentSessionCommandTurnId(turnId)
 }
 
 function abortError(signal: AbortSignal): Error {
@@ -52,17 +80,19 @@ export class StructuredAgentSessionSendSettlement {
   private readonly waiters = new Map<string, Set<SendSettlementWaiter>>()
   private waiterCount = 0
 
-  constructor(private readonly journalFor: (sessionId: string) => AgentSessionJournal) {}
+  constructor(private readonly journalFor: (sessionId: string) => SendSettlementJournal) {}
 
   wait = (
     sessionId: string,
     clientMessageId: string,
-    signal?: AbortSignal
+    options: SendSettlementWaitOptions = {}
   ): Promise<SettledSend | undefined> => {
+    const { signal } = options
+    const until = options.until ?? 'answered'
     if (signal?.aborted) {
       return Promise.reject(abortError(signal))
     }
-    const immediate = settledSend(this.journalFor(sessionId), clientMessageId)
+    const immediate = settledSend(this.journalFor(sessionId), clientMessageId, until)
     if (immediate === 'missing') {
       return Promise.reject(new Error('agent session send disappeared before settlement'))
     }
@@ -79,12 +109,13 @@ export class StructuredAgentSessionSendSettlement {
     return new Promise((resolve, reject) => {
       const waiter: SendSettlementWaiter = {
         clientMessageId,
+        until,
         resolve,
         reject,
         timer: setTimeout(() => {
           this.remove(sessionId, waiter)
           resolve(undefined)
-        }, SEND_SETTLEMENT_WAIT_TIMEOUT_MS)
+        }, options.budgetMs ?? SEND_SETTLEMENT_WAIT_TIMEOUT_MS)
       }
       waiter.timer.unref?.()
       const session = existingSession ?? new Set<SendSettlementWaiter>()
@@ -106,7 +137,7 @@ export class StructuredAgentSessionSendSettlement {
     })
   }
 
-  publish(sessionId: string, journal: AgentSessionJournal): void {
+  publish(sessionId: string, journal: SendSettlementJournal): void {
     const waiters = this.waiters.get(sessionId)
     if (!waiters) {
       return
@@ -118,6 +149,7 @@ export class StructuredAgentSessionSendSettlement {
       const result = settledSend(
         journal,
         waiter.clientMessageId,
+        waiter.until,
         submissions.get(waiter.clientMessageId)
       )
       if (result !== 'pending') {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts
index f2d1ab12230..f0163b22791 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts
@@ -23,6 +23,8 @@ import {
   HOST_TEST_THREAD as THREAD,
   hostTestMessage
 } from './structured-agent-session-host-test-data'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
 
 let store: AgentSessionRecordStore
 let host: StructuredAgentSessionHost
@@ -32,6 +34,28 @@ beforeEach(() => {
   ;({ store, host, dispatch } = hostTestState())
 })
 
+function hostJournal(): AgentSessionJournal {
+  return (
+    host as unknown as { sessions: Map<string, { journal: AgentSessionJournal }> }
+  ).sessions.get(SESSION)!.journal
+}
+
+/** A send is accepted, then the session's delivery loop hands it over: wait for the handover's
+ *  outcome, or with `handedOver`, only for the handover itself (an admitted send stays pending). */
+async function delivered(clientMessageId: string, options: { handedOver?: true } = {}) {
+  let submission: ReturnType<AgentSessionJournal['submissions']>[number] | undefined
+  await vi.waitFor(() => {
+    submission = hostJournal()
+      .submissions()
+      .find((entry) => entry.clientMessageId === clientMessageId)
+    expect(submission?.handedOverAt).toBeDefined()
+    if (!options.handedOver) {
+      expect(submission?.dispatchState).not.toBe('pending')
+    }
+  })
+  return submission!
+}
+
 describe('send', () => {
   it('writes the submission before dispatching and resolves it accepted', async () => {
     await attach()
@@ -43,9 +67,20 @@ describe('send', () => {
     if (!result.ok) {
       throw new Error(`expected a send, got ${result.refusal.code}`)
     }
-    expect(result.value.submission.dispatchState).toBe('accepted')
+    if (!('submission' in result.value)) {
+      throw new Error('expected the submission arm')
+    }
+    // Answered once accepted; the delivery loop hands it over after.
+    expect(result.value.submission).toMatchObject({
+      dispatchState: 'pending',
+      handoverRecorded: true
+    })
+    expect(result.value.submission.handedOverAt).toBeUndefined()
+    await expect(delivered(result.value.clientMessageId)).resolves.toMatchObject({
+      dispatchState: 'accepted'
+    })
     expect(dispatch).toHaveBeenCalledTimes(1)
-    const page = host.history({ sessionId: SESSION, direction: 'tail' })
+    const page = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(page.ok && page.page.items).toHaveLength(1)
     expect(page.ok && page.page.fence).toBe(1)
     expect(page.page.hostNow).toBe(NOW)
@@ -75,11 +110,11 @@ describe('send', () => {
     await attach()
     dispatch.mockRejectedValueOnce(new Error('socket closed'))
     const body = hostTestMessage('add a retry')
-    const result = await host.send(CALLER, {
-      envelope: envelope('agentSession.send', { body }),
-      body
+    const params = { envelope: envelope('agentSession.send', { body }), body }
+    await host.send(CALLER, params)
+    await expect(delivered(params.envelope.clientOperationId)).resolves.toMatchObject({
+      dispatchState: 'unknown'
     })
-    expect(result).toMatchObject({ ok: true, value: { submission: { dispatchState: 'unknown' } } })
   })
 
   it('replays a retried send from the journal without dispatching twice', async () => {
@@ -87,6 +122,7 @@ describe('send', () => {
     const body = hostTestMessage('add a retry')
     const params = { envelope: envelope('agentSession.send', { body }), body }
     await host.send(CALLER, params)
+    await delivered(params.envelope.clientOperationId)
     const retry = await host.send(CALLER, params)
     expect(retry).toMatchObject({ ok: true, replayed: true })
     expect(dispatch).toHaveBeenCalledTimes(1)
@@ -98,10 +134,9 @@ describe('send', () => {
     const body = hostTestMessage('possibly delivered')
     const params = { envelope: envelope('agentSession.send', { body }), body }
 
-    const first = await host.send(CALLER, params)
-    expect(first).toMatchObject({
-      ok: true,
-      value: { submission: { dispatchState: 'unknown' } }
+    await host.send(CALLER, params)
+    await expect(delivered(params.envelope.clientOperationId)).resolves.toMatchObject({
+      dispatchState: 'unknown'
     })
     // A thrown adapter call is indistinguishable from a lost reply, so Retry
     // replays the recorded outcome.
@@ -110,7 +145,7 @@ describe('send', () => {
       value: { submission: { dispatchState: 'unknown' } }
     })
     expect(dispatch).toHaveBeenCalledTimes(1)
-    const state = host.history({ sessionId: SESSION, direction: 'tail' })
+    const state = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(state.ok && state.page.submissions).toHaveLength(1)
   })
 
@@ -129,6 +164,7 @@ describe('send', () => {
     const params = { envelope: envelope('agentSession.send', { body }), body }
 
     await host.send(CALLER, params)
+    await delivered(params.envelope.clientOperationId)
     await expect(host.send(CALLER, { ...params, retryUnknown: true })).resolves.toMatchObject({
       ok: true,
       value: {
@@ -136,7 +172,7 @@ describe('send', () => {
       }
     })
     expect(dispatch).toHaveBeenCalledTimes(1)
-    const state = host.history({ sessionId: SESSION, direction: 'tail' })
+    const state = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(state.ok && state.page.submissions).toHaveLength(1)
   })
 
@@ -145,30 +181,29 @@ describe('send', () => {
     dispatch
       .mockImplementationOnce(async () => ({
         state: 'rejected' as const,
-        reason: 'provider_write_failed: broken pipe'
+        ...agentSessionFailureWords(agentSessionFailureFact('writeFailed'), {
+          surface: 'rejection'
+        })
       }))
       .mockImplementationOnce(async () => accepted())
     const body = hostTestMessage('never written')
     const params = { envelope: envelope('agentSession.send', { body }), body }
 
-    await expect(host.send(CALLER, params)).resolves.toMatchObject({
-      ok: true,
-      value: {
-        submission: { dispatchState: 'rejected', reason: 'provider_write_failed: broken pipe' }
-      }
+    await host.send(CALLER, params)
+    await expect(delivered(params.envelope.clientOperationId)).resolves.toMatchObject({
+      dispatchState: 'rejected',
+      reason: 'provider_write_failed'
     })
     // What the user's Retry does with a rejection: a fresh client message id,
     // which is a first delivery by construction and cannot duplicate the frame
     // that never left the process.
-    await expect(
-      host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
-    ).resolves.toMatchObject({
-      ok: true,
-      replayed: false,
-      value: { submission: { dispatchState: 'accepted' } }
+    const rotated = { envelope: envelope('agentSession.send', { body }), body }
+    await expect(host.send(CALLER, rotated)).resolves.toMatchObject({ ok: true, replayed: false })
+    await expect(delivered(rotated.envelope.clientOperationId)).resolves.toMatchObject({
+      dispatchState: 'accepted'
     })
     expect(dispatch).toHaveBeenCalledTimes(2)
-    const state = host.history({ sessionId: SESSION, direction: 'tail' })
+    const state = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(state.ok && state.page.submissions).toHaveLength(2)
   })
 
@@ -183,10 +218,9 @@ describe('send', () => {
     const body = hostTestMessage('a message the provider may already hold')
     const params = { envelope: envelope('agentSession.send', { body }), body }
 
-    const first = await host.send(CALLER, params)
-    expect(first).toMatchObject({
-      ok: true,
-      value: { submission: { dispatchState: 'unknown' } }
+    await host.send(CALLER, params)
+    await expect(delivered(params.envelope.clientOperationId)).resolves.toMatchObject({
+      dispatchState: 'unknown'
     })
     // No `unknown` is re-delivered under its own id, whatever its reason says,
     // so Retry replays the recorded outcome instead of writing again.
@@ -203,6 +237,7 @@ describe('send', () => {
     const body = hostTestMessage('settled for good')
     const params = { envelope: envelope('agentSession.send', { body }), body }
     await host.send(CALLER, params)
+    await delivered(params.envelope.clientOperationId)
     const journal = (
       host as unknown as { sessions: Map<string, { journal: AgentSessionJournal }> }
     ).sessions.get(SESSION)!.journal
@@ -223,7 +258,7 @@ describe('send', () => {
     expect(journal.receiptFor(params.envelope.clientOperationId)).not.toBeNull()
   })
 
-  it('leaves an admitted send pending and writes no dispatch row', async () => {
+  it('leaves an admitted send pending once handed over', async () => {
     await attach()
     dispatch.mockImplementationOnce(async () => ({ state: 'admitted' as const }))
     const body = hostTestMessage('queued behind a running turn')
@@ -233,9 +268,9 @@ describe('send', () => {
       ok: true,
       value: { submission: { dispatchState: 'pending', reason: null, resolvedAt: null } }
     })
-    const journal = (
-      host as unknown as { sessions: Map<string, { journal: AgentSessionJournal }> }
-    ).sessions.get(SESSION)!.journal
+    await delivered(params.envelope.clientOperationId, { handedOver: true })
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledTimes(1))
+    const journal = hostJournal()
     expect(journal.pendingSubmissions()).toHaveLength(1)
   })
 
@@ -245,6 +280,8 @@ describe('send', () => {
     const body = hostTestMessage('written, never acknowledged')
     const params = { envelope: envelope('agentSession.send', { body }), body }
     await host.send(CALLER, params)
+    await delivered(params.envelope.clientOperationId, { handedOver: true })
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledTimes(1))
     const journal = (
       host as unknown as { sessions: Map<string, { journal: AgentSessionJournal }> }
     ).sessions.get(SESSION)!.journal
@@ -281,6 +318,8 @@ describe('send', () => {
     const params = { envelope: envelope('agentSession.send', { body }), body }
 
     await expect(host.send(CALLER, params)).rejects.toThrow('operation settlement failed')
+    // The submission was recorded before the ledger write failed, so it is still delivered.
+    await delivered(params.envelope.clientOperationId)
     await expect(host.send(CALLER, params)).resolves.toMatchObject({
       ok: true,
       replayed: true,
@@ -333,9 +372,8 @@ describe('send', () => {
 
     await expect(host.send(CALLER, params)).rejects.toThrow('operation settlement failed')
     settlement.mockRestore()
-    const journal = (
-      host as unknown as { sessions: Map<string, { journal: AgentSessionJournal }> }
-    ).sessions.get(SESSION)!.journal
+    await delivered(params.envelope.clientOperationId)
+    const journal = hostJournal()
     await journal.rollEpoch('schema_unreadable', store.getRecord(SESSION)?.lease.runtimeFence ?? 1)
     expect(journal.submissions()).toHaveLength(0)
 
@@ -362,6 +400,7 @@ describe('send', () => {
     const params = { envelope: envelope('agentSession.send', { body }), body }
 
     await host.send(CALLER, params)
+    await delivered(params.envelope.clientOperationId)
     expect(dispatch).toHaveBeenCalledTimes(1)
     await store.recordOperationOutcome({
       callerKey: CALLER.callerKey,
@@ -393,6 +432,8 @@ describe('send', () => {
     const body = hostTestMessage('written, then the child died')
     const params = { envelope: envelope('agentSession.send', { body }), body }
     await host.send(CALLER, params)
+    await delivered(params.envelope.clientOperationId, { handedOver: true })
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledTimes(1))
     const journal = (
       host as unknown as { sessions: Map<string, { journal: AgentSessionJournal }> }
     ).sessions.get(SESSION)!.journal
@@ -411,21 +452,25 @@ describe('send', () => {
 
   it('advances an explicit retry after a ledger-unknown send is reconciled in the journal', async () => {
     await attach()
-    const journal = (
-      host as unknown as { sessions: Map<string, { journal: AgentSessionJournal }> }
-    ).sessions.get(SESSION)!.journal
-    vi.spyOn(journal, 'resolveDispatch').mockRejectedValueOnce(new Error('journal resolve failed'))
+    const journal = hostJournal()
+    const resolve = journal.resolveDispatch.bind(journal)
+    // The handover row lands; the provider's answer, written after the adapter took the
+    // message, does not.
+    vi.spyOn(journal, 'resolveDispatch')
+      .mockImplementationOnce(resolve)
+      .mockRejectedValueOnce(new Error('journal resolve failed'))
     const body = hostTestMessage('possibly delivered before persistence failed')
     const params = { envelope: envelope('agentSession.send', { body }), body }
 
-    await expect(host.send(CALLER, params)).rejects.toThrow('journal resolve failed')
-    expect(journal.submissions()).toMatchObject([
-      { clientMessageId: params.envelope.clientOperationId, dispatchState: 'unknown' }
-    ])
+    await expect(host.send(CALLER, params)).resolves.toMatchObject({ ok: true })
+    await expect(delivered(params.envelope.clientOperationId)).resolves.toMatchObject({
+      dispatchState: 'unknown'
+    })
+    // Acceptance is what the ledger answers for; delivery is the journal's to say.
     expect(
       store.listOperationRows().find((row) => row.operationId === params.envelope.clientOperationId)
         ?.outcome
-    ).toEqual({ status: 'unknown' })
+    ).toMatchObject({ status: 'succeeded' })
     expect(dispatch).toHaveBeenCalledTimes(1)
 
     await journal.markPendingSubmissionsUnknown(store.getRecord(SESSION)?.lease.runtimeFence ?? 1)
@@ -446,24 +491,7 @@ describe('send', () => {
     expect(journal.submissions()).toHaveLength(1)
   })
 
-  it('refuses a stale fence and hands back the current one', async () => {
-    const record = await attach()
-    const body = hostTestMessage('add a retry')
-    const result = await host.send(CALLER, {
-      envelope: envelope(
-        'agentSession.send',
-        { body },
-        { expectedRuntimeFence: (record?.lease.runtimeFence ?? 1) + 5 }
-      ),
-      body
-    })
-    expect(result).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_checkpoint_stale', currentFence: record?.lease.runtimeFence }
-    })
-  })
-
-  it('reuses a pending send admission after the client refreshes its fence', async () => {
+  it('admits a send fenced to another generation, delivers it once, and replays it by id', async () => {
     const record = await attach()
     const body = hostTestMessage('add a retry')
     const params = {
@@ -474,27 +502,14 @@ describe('send', () => {
       ),
       body
     }
-    expect(await host.send(CALLER, params)).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_checkpoint_stale' }
+    expect(await host.send(CALLER, params)).toMatchObject({ ok: true, replayed: false })
+    await expect(delivered(params.envelope.clientOperationId)).resolves.toMatchObject({
+      dispatchState: 'accepted'
     })
-    expect(
-      store
-        .listOperationRows()
-        .filter((row) => row.operationId === params.envelope.clientOperationId)
-    ).toEqual([])
     const retry = {
       ...params,
-      envelope: {
-        ...params.envelope,
-        expectedRuntimeFence: record?.lease.runtimeFence ?? 1
-      }
+      envelope: { ...params.envelope, expectedRuntimeFence: record?.lease.runtimeFence ?? 1 }
     }
-    expect(await host.send(CALLER, retry)).toMatchObject({
-      ok: true,
-      replayed: false,
-      value: { submission: { dispatchState: 'accepted' } }
-    })
     expect(await host.send(CALLER, retry)).toMatchObject({ ok: true, replayed: true })
     expect(dispatch).toHaveBeenCalledTimes(1)
   })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-settled-attach-retry.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-settled-attach-retry.test.ts
index 5780359a8ae..7602afa230b 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-settled-attach-retry.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-settled-attach-retry.test.ts
@@ -125,6 +125,11 @@ afterEach(async () => {
   await rm(root, { recursive: true, force: true })
 })
 
+/** The host starting the agent with no message to deliver, as an operation that needs it does. */
+function startAgent(): Promise<unknown> {
+  return host['serialize'](SESSION, () => host['mutationContext']().ensureAgent(SESSION))
+}
+
 describe('settled attach retry', () => {
   it('settles a post-acquisition journal failure and retries without a restart', async () => {
     const historyFilePath = vi
@@ -207,7 +212,7 @@ describe('settled attach retry', () => {
     expect(spawnTokens).toEqual(['spawn-safe', 'spawn-safe'])
   })
 
-  it('fences a crash-interrupted reservation replay until positive recovery', async () => {
+  it('releases a reservation a crash left ownerless at restart, so the next start goes ahead', async () => {
     const spawnTokens: string[] = []
     acquire.mockImplementation(async ({ fence, spawnToken }) => {
       spawnTokens.push(spawnToken)
@@ -232,17 +237,17 @@ describe('settled attach retry', () => {
     })
     let token = 0
     const mintSpawnToken = vi.fn(() => `spawn-${++token}`)
-    let reservationUnused = false
     host = new StructuredAgentSessionHost({
       store,
       adapter: adapter(),
       journalRoot: root,
       claimKeyId: 'key-1',
       mintSpawnToken,
-      probeOwner: async () =>
-        reservationUnused
-          ? { outcome: 'reservation-unused' }
-          : { outcome: 'indeterminate', reason: 'spawn token scan unavailable' },
+      // A host that cannot read another process's environment, so no scan can prove anything.
+      probeOwner: async () => ({
+        outcome: 'indeterminate',
+        reason: 'spawn token scan unavailable'
+      }),
       now: () => NOW
     })
     const params = hostTestAttachParams(null)
@@ -268,36 +273,28 @@ describe('settled attach retry', () => {
       journalRoot: root,
       claimKeyId: 'key-1',
       mintSpawnToken,
-      probeOwner: async () =>
-        reservationUnused
-          ? { outcome: 'reservation-unused' }
-          : { outcome: 'indeterminate', reason: 'spawn token scan unavailable' },
+      // A host that cannot read another process's environment, so no scan can prove anything.
+      probeOwner: async () => ({
+        outcome: 'indeterminate',
+        reason: 'spawn token scan unavailable'
+      }),
       now: () => NOW
     })
 
-    const refused = await host.attach(CALLER, params)
-    if (refused.ok) {
-      throw new Error('expected the replayed reservation to stay fenced')
-    }
-    expect(refused.refusal.code).toBe('agent_session_ownership_unknown')
-    expect(acquire).toHaveBeenCalledTimes(1)
+    await host.restoreReadableSessions()
     expect(releaseAcquisition).toHaveBeenCalledTimes(1)
-    expect(mintSpawnToken).toHaveBeenCalledTimes(1)
-    expect(spawnTokens).toEqual(['spawn-1'])
+    // No owner was recorded: released at restart, with no evidence, since nothing proved one.
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      claimStatus: 'reserved',
-      handoffStage: 'manual-recovery',
-      runtimeFence: 1,
-      reservedSpawnToken: 'spawn-1',
-      ownerProcess: null
+      claimStatus: 'released',
+      handoffStage: null,
+      runtimeFence: 2,
+      reservedSpawnToken: null,
+      ownerProcess: null,
+      deathEvidence: null
     })
-    expect(
-      store.listOperationRows().find((row) => row.operationId === params.envelope.clientOperationId)
-        ?.outcome
-    ).toEqual({ status: 'pending' })
 
-    reservationUnused = true
-    await host.hold(SESSION, 'desktop-chat:retry')
+    // The interrupted operation's own retry continues it as a fresh reservation.
+    await expect(host.attach(CALLER, params)).resolves.toMatchObject({ ok: true })
     expect(mintSpawnToken).toHaveBeenCalledTimes(2)
     expect(spawnTokens).toEqual(['spawn-1', 'spawn-2'])
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
@@ -322,6 +319,8 @@ describe('settled attach retry', () => {
     }
     const first = await host.send(CALLER, unknownParams)
     expect(first).toMatchObject({ ok: true, value: { submission: { dispatchState: 'pending' } } })
+    // Handed over before the host dies: that is what makes the restart's answer doubt.
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledTimes(1))
 
     await host.flushAllStreamedEvents()
     store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
@@ -335,7 +334,7 @@ describe('settled attach retry', () => {
       now: () => NOW
     })
     await host.restoreReadableSessions()
-    await host.hold(SESSION, 'desktop-chat:restart')
+    await startAgent()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       claimStatus: 'live',
       handoffStage: null,
@@ -351,8 +350,8 @@ describe('settled attach retry', () => {
     if (!sent.ok) {
       throw new Error(`unexpected restored send refusal: ${sent.refusal.message}`)
     }
-    expect(dispatch).toHaveBeenCalledTimes(2)
-    const restoredHistory = host.history({ sessionId: SESSION, direction: 'tail' })
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledTimes(2))
+    const restoredHistory = await host.history({ sessionId: SESSION, direction: 'tail' })
     if (!restoredHistory.ok) {
       throw new Error(`unexpected restored history reset: ${restoredHistory.reset}`)
     }
@@ -384,7 +383,10 @@ describe('settled attach retry', () => {
 
     await expect(host.attach(CALLER, hostTestAttachParams(null))).resolves.toMatchObject({
       ok: false,
-      refusal: { message: 'resume rejected', ownerVerdict: 'exited' }
+      refusal: {
+        message: "Codex couldn't restart. Send your message to try again.",
+        ownerVerdict: 'exited'
+      }
     })
 
     expect(releaseAcquisition).toHaveBeenCalledTimes(1)
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-settlement-retry.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-settlement-retry.test.ts
deleted file mode 100644
index c0d29f6b9ef..00000000000
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-settlement-retry.test.ts
+++ /dev/null
@@ -1,190 +0,0 @@
-// The settlement latch governs EVERY unclean restart — SIGKILL, force quit, OOM, a quit that blew
-// its deadline — so the evidence it reads decides whether the user sees a failure notice at all.
-
-import { mkdtemp, rm } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import type {
-  AgentSessionDeathEvidence,
-  AgentSessionRecord
-} from '../../../shared/agent-session-record'
-import { agentSessionRecordFixture } from '../../../shared/agent-session-record.test-fixture'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
-import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import type { StructuredAgentSessionLeaseStore } from './structured-agent-session-lease-release'
-import { retryLoadedStructuredAgentSessionSettlement } from './structured-agent-session-settlement-retry'
-
-const SESSION = 'session-alpha-1'
-const THREAD = 'thread-1'
-const FENCE = 8
-
-let root: string
-let journal: AgentSessionJournal
-let record: AgentSessionRecord
-
-function store(): StructuredAgentSessionLeaseStore {
-  return {
-    getRecord: () => record,
-    transitionHandoff: async (_sessionId, transition) => {
-      record = transition(record)
-      return record
-    }
-  }
-}
-
-function retry(settlementId: string, deathEvidence: AgentSessionDeathEvidence) {
-  record = agentSessionRecordFixture({
-    ...agentSessionRecordFixture().lease,
-    runtimeKind: 'native',
-    runtimeFence: FENCE,
-    deathEvidence,
-    settlementRetryRequired: true,
-    settlementRetryId: settlementId
-  })
-  return retryLoadedStructuredAgentSessionSettlement({
-    deps: { store: store() },
-    sessionId: SESSION,
-    session: { journal, fence: FENCE, acquisitionGeneration: null },
-    now: () => 2_000
-  })
-}
-
-function statusTexts(): string[] {
-  return journal
-    .snapshot()
-    .items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
-}
-
-beforeEach(async () => {
-  root = await mkdtemp(join(tmpdir(), 'orca-settlement-retry-'))
-  journal = await openAgentSessionJournal({
-    identity: {
-      sessionId: SESSION,
-      workspaceId: 'workspace-1',
-      hostId: 'local',
-      agent: 'codex',
-      providerHandle: { kind: 'codex', threadId: THREAD }
-    },
-    journalDir: root,
-    now: () => 1_000
-  })
-})
-
-/** A turn the dead generation left running: work to settle either way. */
-async function seedRunningTurn(): Promise<void> {
-  await journal.appendItem(
-    { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 1 },
-    { kind: 'turn', turnId: 'turn-1', state: 'running', startedAt: 900 },
-    { fence: FENCE }
-  )
-}
-
-/** The provider died while the user, not the provider, held the conversation. */
-async function seedIdlePendingApproval(): Promise<void> {
-  await journal.appendItem(
-    { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 1 },
-    {
-      kind: 'approval',
-      title: 'Run command?',
-      detail: null,
-      options: [{ id: 'yes', label: 'Allow' }],
-      resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
-    },
-    { fence: FENCE }
-  )
-}
-
-afterEach(async () => {
-  await journal.close()
-  await rm(root, { recursive: true, force: true })
-})
-
-describe('pending settlement retry', () => {
-  it('writes no status row when the death was only adjudicated, not witnessed', async () => {
-    await seedRunningTurn()
-
-    await expect(
-      retry(`restart-eviction:${SESSION}:${FENCE}`, {
-        kind: 'pid-absent',
-        detail: 'recorded pid absent on host',
-        observedAt: 1_500
-      })
-    ).resolves.toBe(true)
-
-    expect(statusTexts()).toEqual([])
-    expect(journal.snapshot().items.map((item) => item.body)).toContainEqual(
-      expect.objectContaining({ kind: 'turn', state: 'unverifiable' })
-    )
-    expect(record.lease.settlementRetryRequired).toBeUndefined()
-  })
-
-  it('writes no status row for an identity mismatch either', async () => {
-    await seedRunningTurn()
-
-    await expect(
-      retry(`restart-eviction:${SESSION}:${FENCE}`, {
-        kind: 'identity-mismatch',
-        detail: 'mismatched spawn-token',
-        observedAt: 1_500
-      })
-    ).resolves.toBe(true)
-
-    expect(statusTexts()).toEqual([])
-  })
-
-  it('reads the evidence, not the settlement id, when deciding to speak', async () => {
-    // Pins the discriminator: the id shape that normally accompanies a witnessed exit must not
-    // earn the notice on its own.
-    await seedRunningTurn()
-
-    await expect(
-      retry(`provider-exit:${SESSION}:${FENCE}:generation-1`, {
-        kind: 'pid-absent',
-        detail: 'recorded pid absent on host',
-        observedAt: 1_500
-      })
-    ).resolves.toBe(true)
-
-    expect(statusTexts()).toEqual([])
-  })
-
-  it('writes user-facing copy carrying the cause when the exit was observed', async () => {
-    await seedRunningTurn()
-
-    await expect(
-      retry(`provider-exit:${SESSION}:${FENCE}:generation-1`, {
-        kind: 'exit-observed',
-        detail: 'transport closed',
-        observedAt: 1_500
-      })
-    ).resolves.toBe(true)
-
-    expect(statusTexts()).toEqual([
-      'The provider stopped while this response was in progress: transport closed. You can continue in this conversation.'
-    ])
-    expect(journal.snapshot().items.map((item) => item.body)).toContainEqual(
-      expect.objectContaining({ kind: 'turn', state: 'interrupted', completedAt: 1_500 })
-    )
-  })
-
-  it('stays silent about a witnessed exit that interrupted nothing but a waiting prompt', async () => {
-    await seedIdlePendingApproval()
-
-    await expect(
-      retry(`provider-exit:${SESSION}:${FENCE}:generation-1`, {
-        kind: 'exit-observed',
-        detail: 'transport closed',
-        observedAt: 1_500
-      })
-    ).resolves.toBe(true)
-
-    expect(statusTexts()).toEqual([])
-    expect(journal.snapshot().items.map((item) => item.body)).toContainEqual(
-      expect.objectContaining({
-        kind: 'approval',
-        resolution: expect.objectContaining({ state: 'cancelled' })
-      })
-    )
-  })
-})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-settlement-retry.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-settlement-retry.ts
deleted file mode 100644
index 1000881220e..00000000000
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-settlement-retry.ts
+++ /dev/null
@@ -1,130 +0,0 @@
-import type { AgentSessionAttachParams } from './structured-agent-session-attach'
-import { attachJournal } from './structured-agent-session-attach'
-import type {
-  StructuredAgentSessionHostDeps,
-  StructuredAgentSessionHostSession
-} from './structured-agent-session-host-types'
-import type { StructuredAgentSessionLeaseStore } from './structured-agent-session-lease-release'
-import { turnVerdictFromDeathEvidence } from './structured-agent-session-stale-turn-verdict'
-import {
-  captureUnfinishedStructuredAgentSessionWork,
-  settleStructuredAgentSessionDeadGeneration,
-  unfinishedStructuredAgentSessionWorkWasInterrupted
-} from './structured-agent-session-dead-generation-settlement'
-
-export async function retryPendingStructuredAgentSessionSettlement(input: {
-  deps: StructuredAgentSessionHostDeps
-  sessions: Map<string, StructuredAgentSessionHostSession>
-  sessionId: string
-  params: AgentSessionAttachParams
-  now: () => number
-}): Promise<boolean> {
-  const record = input.deps.store.getRecord(input.sessionId)
-  if (!record?.lease.settlementRetryRequired || !record.lease.settlementRetryId) {
-    return true
-  }
-  let journal = input.sessions.get(input.sessionId)?.journal
-  if (!journal) {
-    try {
-      journal = (
-        await attachJournal({
-          record,
-          params: input.params,
-          journalRoot: input.deps.journalRoot,
-          adapter: input.deps.adapter
-        })
-      ).journal
-    } catch (error) {
-      input.deps.onEventSinkError?.({ sessionId: input.sessionId, error })
-      return false
-    }
-  }
-  const current = input.sessions.get(input.sessionId)
-  const retrySession =
-    current ??
-    ({
-      journal,
-      params: input.params,
-      fence: record.lease.runtimeFence,
-      hasProviderChild: false,
-      acquisitionGeneration: null
-    } as StructuredAgentSessionHostSession)
-  return retryLoadedStructuredAgentSessionSettlement({
-    deps: input.deps,
-    sessionId: input.sessionId,
-    session: retrySession,
-    now: input.now
-  })
-}
-
-export async function retryLoadedStructuredAgentSessionSettlement(input: {
-  deps: {
-    store: StructuredAgentSessionLeaseStore
-    onEventSinkError?: StructuredAgentSessionHostDeps['onEventSinkError']
-  }
-  sessionId: string
-  session: Pick<StructuredAgentSessionHostSession, 'journal' | 'fence' | 'acquisitionGeneration'>
-  now: () => number
-}): Promise<boolean> {
-  const record = input.deps.store.getRecord(input.sessionId)
-  if (!record?.lease.settlementRetryRequired || !record.lease.settlementRetryId) {
-    return true
-  }
-  const retrySession = input.session
-  retrySession.fence = record.lease.runtimeFence
-  const onError = (id: string, error: unknown): void =>
-    input.deps.onEventSinkError?.({ sessionId: id, error })
-  // Only an observed exit earns an end time; a probe-proven death never saw one.
-  const verdict = turnVerdictFromDeathEvidence(record.lease.deathEvidence)
-  const ok = await settleStructuredAgentSessionDeadGeneration({
-    journal: retrySession.journal,
-    sessionId: input.sessionId,
-    fence: retrySession.fence,
-    settlementId: record.lease.settlementRetryId,
-    pendingSubmissionReason: 'provider_exited_before_acknowledgement',
-    verdict,
-    // The same evidence decides the copy: only a witnessed death is worth telling the user
-    // about. An unverifiable one is a restart artefact, and the session stays sendable. The
-    // work check matches the live exit path — a provider that died waiting on a prompt
-    // interrupted no response, so it must not claim one was in progress.
-    showUnexpectedExitOutcome:
-      verdict.state === 'interrupted' &&
-      unfinishedStructuredAgentSessionWorkWasInterrupted(
-        captureUnfinishedStructuredAgentSessionWork(retrySession.journal),
-        retrySession.journal,
-        verdict.completedAt
-      ),
-    ...(record.lease.deathEvidence?.detail
-      ? { unexpectedExitReason: record.lease.deathEvidence.detail }
-      : {}),
-    onError
-  })
-  if (!ok) {
-    return false
-  }
-  try {
-    await input.deps.store.transitionHandoff(input.sessionId, (latest) => {
-      if (
-        latest.lease.runtimeFence !== record.lease.runtimeFence ||
-        !latest.lease.settlementRetryRequired
-      ) {
-        throw new Error('agent_session_checkpoint_stale')
-      }
-      return {
-        ...latest,
-        lease: {
-          ...latest.lease,
-          handoffStage: null,
-          handoffOperationId: null,
-          settlementRetryRequired: undefined,
-          settlementRetryId: undefined,
-          lastRenewedAt: input.now()
-        }
-      }
-    })
-    return true
-  } catch (error) {
-    input.deps.onEventSinkError?.({ sessionId: input.sessionId, error })
-    return false
-  }
-}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-open.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-open.test.ts
new file mode 100644
index 00000000000..204da81a2e6
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-open.test.ts
@@ -0,0 +1,116 @@
+// A turn an exited agent left running, whose settlement write failed, is settled by the next open of
+// the conversation, not only by the next send: a reader reopening a chat the idle sweep closed, or
+// reading it before the restart restore reaches it.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
+import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
+import { setStructuredAgentSessionHost } from './structured-agent-session-registry'
+import {
+  collectSubscriber,
+  createRestTestRig,
+  foundRestTestChat,
+  IDLE_MS,
+  REST_TEST_SESSION as SESSION,
+  REST_TEST_THREAD,
+  sweepOnce,
+  type RestTestRig
+} from './structured-agent-session-rest-test-rig'
+
+let rig: RestTestRig
+
+beforeEach(async () => {
+  rig = await createRestTestRig({ idleSweep: { intervalMs: 3_600_000 } })
+  setStructuredAgentSessionHost(rig.host)
+})
+
+afterEach(async () => {
+  setStructuredAgentSessionHost(null)
+  await rig.dispose()
+})
+
+/** A turn in flight whose agent exits, and whose exit settlement the journal refuses: by default
+ *  also the retry that recording the exit queues, so only an open is left to settle it. */
+async function exitWithUnwrittenSettlement(refusedWrites = 2): Promise<void> {
+  await foundRestTestChat(rig)
+  const open = rig.host.collaboratorsForTests().sessions.get(SESSION)!
+  const running = open.child!
+  rig.adapter.acquire.mock.calls
+    .at(-1)?.[0]
+    .events?.appendItem(
+      { provider: 'codex', threadId: REST_TEST_THREAD, turnId: 'working', ordinal: 50 },
+      { kind: 'turn', turnId: 'working', state: 'running' },
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
+  await rig.host.flushStreamedEvents(SESSION)
+  const append = vi.spyOn(open.journal, 'appendLifecycleBatch')
+  for (let refused = 0; refused < refusedWrites; refused += 1) {
+    append.mockRejectedValueOnce(new Error('disk full'))
+  }
+  await rig.host.handleAdapterEvent({
+    type: 'ended',
+    sessionId: SESSION,
+    reason: 'killed',
+    cause: 'unexpected-exit',
+    fence: running.fence,
+    acquisitionGeneration: running.generation!
+  })
+  await vi.waitFor(() =>
+    expect(rig.store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
+      deathEvidence: { kind: 'exit-observed' }
+    })
+  )
+  await rig.host.collaboratorsForTests().serialize(SESSION, async () => {})
+}
+
+async function workingTurnState(): Promise<string | undefined> {
+  const items = (await rig.host.journalSnapshot(SESSION)).items
+  return items
+    .map((item) => readAgentJournalTurn(item.body))
+    .find((turn) => turn?.turnId === 'working')?.state
+}
+
+describe('a turn its gone agent left running', () => {
+  it('is settled in place by the retry recording the exit queues, with no reopen', async () => {
+    await exitWithUnwrittenSettlement(1)
+
+    expect(rig.host.collaboratorsForTests().sessions.has(SESSION)).toBe(true)
+    expect(await workingTurnState()).toBe('interrupted')
+    const { items } = await rig.host.journalSnapshot(SESSION)
+    expect(JSON.stringify(items)).toContain(
+      'Codex stopped while this response was in progress. You can continue in this conversation.'
+    )
+    expect(rig.adapter.acquire).toHaveBeenCalledOnce()
+  })
+
+  it('is settled when the idle-closed conversation is opened again, and its reader sees it', async () => {
+    await exitWithUnwrittenSettlement()
+    expect(await workingTurnState()).toBe('running')
+    rig.clock.now += IDLE_MS + 1
+    await sweepOnce(rig.host)
+    expect(rig.host.collaboratorsForTests().sessions.has(SESSION)).toBe(false)
+
+    const reader = collectSubscriber()
+    await rig.host.subscribe({ id: 'reader', sessionId: SESSION, emit: reader.emit })
+
+    expect(await workingTurnState()).toBe('interrupted')
+    // The death evidence is Orca's log text: the row says only that the provider stopped.
+    expect(JSON.stringify(reader.events)).toContain(
+      'Codex stopped while this response was in progress. You can continue in this conversation.'
+    )
+    expect(rig.adapter.acquire).toHaveBeenCalledOnce()
+  })
+
+  it('is settled by a read after a restart that reaches the chat before the restore does', async () => {
+    await exitWithUnwrittenSettlement()
+    await rig.restart()
+    setStructuredAgentSessionHost(rig.host)
+
+    // The client's read opens the chat first; the restore then finds it open and skips it.
+    expect(await workingTurnState()).toBe('interrupted')
+    await rig.host.restoreReadableSessions([SESSION])
+    expect(await workingTurnState()).toBe('interrupted')
+    expect(rig.adapter.acquire).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.test.ts
index 3264a55fff2..54acad4832b 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.test.ts
@@ -1,14 +1,21 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { describe, expect, it, vi } from 'vitest'
 import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
-import type { AgentJournalRenderItem } from '../../../shared/agent-session-journal-types'
+import type {
+  AgentJournalItemIdentity,
+  AgentJournalRenderItem,
+  AgentJournalTurnScope
+} from '../../../shared/agent-session-journal-types'
+import type { AgentSessionDeathEvidence } from '../../../shared/agent-session-record'
+import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
+import { settleStaleStructuredAgentSessionState } from './structured-agent-session-dead-generation-settlement'
 import {
   runningTurnLifecycleRevisions,
-  settleStaleSessionStateOnAcquire,
   turnVerdictFromDeathEvidence,
   UNVERIFIABLE_TURN_VERDICT
 } from './structured-agent-session-stale-turn-verdict'
@@ -21,6 +28,10 @@ const RUNNING_IDENTITY = {
   ordinal: 0
 }
 
+function turnScopeOf(identity: AgentJournalItemIdentity): AgentJournalTurnScope {
+  return { kind: 'turn', turnItemId: agentJournalItemKey(identity) }
+}
+
 function lifecycleItem(
   turnId: string,
   state: 'running' | 'completed',
@@ -75,17 +86,77 @@ function promptItem(state: 'pending' | 'resolved', sequence: number): AgentJourn
 }
 
 describe('turn verdict from death evidence', () => {
-  it('earns an end time only from an observed exit', () => {
+  /** Judges a turn the fence-1 owner wrote, by evidence naming that owner. */
+  const verdictForTurn = (evidence: AgentSessionDeathEvidence | null | undefined) =>
+    turnVerdictFromDeathEvidence(evidence && { ownerFence: 1, ...evidence }, 1)
+
+  it('ends a watched exit at the exit', () => {
+    expect(verdictForTurn({ kind: 'exit-observed', detail: 'exit', observedAt: 500 })).toEqual({
+      state: 'interrupted',
+      completedAt: 500
+    })
+  })
+
+  it.each(['pid-absent', 'identity-mismatch'] as const)(
+    'ends a %s proof at the last proof of life, never after the probe',
+    (kind) => {
+      const proof = (lastProvenAliveAt?: number) => ({
+        kind,
+        detail: 'gone',
+        observedAt: 9_000,
+        ...(lastProvenAliveAt === undefined ? {} : { lastProvenAliveAt })
+      })
+      // Probed at 9000, long after the crash: the downtime is never counted as work.
+      expect(verdictForTurn(proof(8_000))).toEqual({ state: 'interrupted', completedAt: 8_000 })
+      expect(verdictForTurn(proof(9_500))).toEqual({ state: 'interrupted', completedAt: 9_000 })
+      // A proof that recorded no proof of life has only the probe.
+      expect(verdictForTurn(proof())).toEqual({ state: 'interrupted', completedAt: 9_000 })
+    }
+  )
+
+  it('ends a watched exit at the exit even when a renewal is recorded', () => {
     expect(
-      turnVerdictFromDeathEvidence({ kind: 'exit-observed', detail: 'exit', observedAt: 500 })
+      verdictForTurn({
+        kind: 'exit-observed',
+        detail: 'exit',
+        observedAt: 500,
+        lastProvenAliveAt: 400
+      })
     ).toEqual({ state: 'interrupted', completedAt: 500 })
-    expect(
-      turnVerdictFromDeathEvidence({ kind: 'pid-absent', detail: 'gone', observedAt: 500 })
-    ).toEqual({ state: 'unverifiable' })
-    expect(
-      turnVerdictFromDeathEvidence({ kind: 'identity-mismatch', detail: 'pid', observedAt: 500 })
-    ).toEqual({ state: 'unverifiable' })
-    expect(turnVerdictFromDeathEvidence(null)).toEqual({ state: 'unverifiable' })
+  })
+
+  it('leaves a release nothing proved unverifiable', () => {
+    expect(verdictForTurn(null)).toEqual({ state: 'unverifiable' })
+    expect(verdictForTurn(undefined)).toEqual({ state: 'unverifiable' })
+  })
+  it('keeps the rule an older build applied to evidence that names no owner', () => {
+    // Only a watched exit was proof then; a probe's proof stays unverifiable.
+    const legacy = { detail: 'gone', observedAt: 9_000, lastProvenAliveAt: 8_000 }
+    expect(turnVerdictFromDeathEvidence({ ...legacy, kind: 'exit-observed' }, 1)).toEqual({
+      state: 'interrupted',
+      completedAt: 9_000
+    })
+    expect(turnVerdictFromDeathEvidence({ ...legacy, kind: 'pid-absent' }, 1)).toEqual({
+      state: 'unverifiable'
+    })
+  })
+
+  it('gives a turn no end from evidence about any other owner', () => {
+    const proof = {
+      kind: 'pid-absent' as const,
+      detail: 'gone',
+      observedAt: 9_000,
+      lastProvenAliveAt: 8_000
+    }
+    // A newer start's death, and a turn whose writer the timeline no longer knows: neither proves
+    // the turn's own owner gone.
+    for (const [evidence, turnFence] of [
+      [{ ...proof, ownerFence: 3 }, 1],
+      [{ ...proof, kind: 'exit-observed' as const, ownerFence: 3 }, 1],
+      [{ ...proof, ownerFence: 1 }, undefined]
+    ] as const) {
+      expect(turnVerdictFromDeathEvidence(evidence, turnFence)).toEqual({ state: 'unverifiable' })
+    }
   })
 })
 
@@ -107,7 +178,8 @@ describe('running turn lifecycle revisions', () => {
             state: 'interrupted',
             startedAt: 30,
             completedAt: 40
-          }
+          },
+          turnScope: { kind: 'thread' }
         }
       ]
     )
@@ -162,6 +234,13 @@ describe('running turn lifecycle revisions', () => {
     })
   })
 
+  it('never ends a turn before it began, when the last proof of life predates it', () => {
+    const item = lifecycleItem('turn-2', 'running', 2, { startedAt: 500 })
+    expect(
+      runningTurnLifecycleRevisions([item], { state: 'interrupted', completedAt: 300 })
+    ).toMatchObject([{ body: { kind: 'turn', state: 'interrupted', completedAt: 500 } }])
+  })
+
   it('revises a legacy status-form running row from an older host into a typed turn', () => {
     expect(
       runningTurnLifecycleRevisions([legacyLifecycleItem('turn-2', 30)], { state: 'unverifiable' })
@@ -169,7 +248,8 @@ describe('running turn lifecycle revisions', () => {
       {
         kind: 'item',
         identity: RUNNING_IDENTITY,
-        body: { kind: 'turn', turnId: 'turn-2', state: 'unverifiable', startedAt: 30 }
+        body: { kind: 'turn', turnId: 'turn-2', state: 'unverifiable', startedAt: 30 },
+        turnScope: { kind: 'thread' }
       }
     ])
   })
@@ -180,11 +260,22 @@ describe('running turn lifecycle revisions', () => {
   })
 })
 
+/** A probe that found the fence-1 owner gone at 9000, last proven alive at 100. */
+const PROVEN: AgentSessionDeathEvidence = {
+  kind: 'pid-absent',
+  detail: 'recorded pid absent on host',
+  observedAt: 9_000,
+  ownerFence: 1,
+  lastProvenAliveAt: 100
+}
+
 describe('stale session state on a cold acquire', () => {
   function journalWith(items: AgentJournalRenderItem[]) {
     const appendLifecycleBatch = vi.fn(async () => ({ epoch: 'epoch-1', sequence: 9 }))
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the settle reads only these journal members.
     const journal = {
       snapshot: () => ({ items }),
+      itemFence: () => 1,
       cursor: () => ({ epoch: 'epoch-1', sequence: 8 }),
       appendLifecycleBatch
     } as unknown as AgentSessionJournal
@@ -198,11 +289,12 @@ describe('stale session state on a cold acquire', () => {
     ])
 
     await expect(
-      settleStaleSessionStateOnAcquire({
+      settleStaleStructuredAgentSessionState({
         journal,
         sessionId: 'session-1',
         fence: 14,
-        acquisitionGeneration: 'generation-2'
+        acquisitionGeneration: 'generation-2',
+        deathEvidence: null
       })
     ).resolves.toBe(1)
 
@@ -214,7 +306,8 @@ describe('stale session state on a cold acquire', () => {
         {
           kind: 'item',
           identity: RUNNING_IDENTITY,
-          body: { kind: 'turn', turnId: 'turn-2', state: 'unverifiable', startedAt: 30 }
+          body: { kind: 'turn', turnId: 'turn-2', state: 'unverifiable', startedAt: 30 },
+          turnScope: { kind: 'thread' }
         }
       ]
     })
@@ -226,11 +319,12 @@ describe('stale session state on a cold acquire', () => {
     const { journal, appendLifecycleBatch } = journalWith([pending, resolved])
 
     await expect(
-      settleStaleSessionStateOnAcquire({
+      settleStaleStructuredAgentSessionState({
         journal,
         sessionId: 'session-1',
         fence: 14,
-        acquisitionGeneration: 'generation-2'
+        acquisitionGeneration: 'generation-2',
+        deathEvidence: null
       })
     ).resolves.toBe(1)
 
@@ -255,7 +349,8 @@ describe('stale session state on a cold acquire', () => {
               resolvedBy: null,
               resolvedAt: null
             }
-          }
+          },
+          turnScope: { kind: 'thread' }
         }
       ]
     })
@@ -285,14 +380,22 @@ describe('stale session state on a cold acquire', () => {
         turnId: 'turn-1',
         ordinal: 1
       })
-      await journal.appendItem(prompt('thread-child'), body, { fence: 1, ...child })
-      await journal.appendItem(prompt(THREAD), body, { fence: 1 })
+      await journal.appendItem(prompt('thread-child'), body, {
+        fence: 1,
+        ...child,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
+      await journal.appendItem(prompt(THREAD), body, {
+        fence: 1,
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      })
 
-      await settleStaleSessionStateOnAcquire({
+      await settleStaleStructuredAgentSessionState({
         journal,
         sessionId: 'session-1',
         fence: 2,
-        acquisitionGeneration: 'generation-2'
+        acquisitionGeneration: 'generation-2',
+        deathEvidence: null
       })
 
       expect(
@@ -307,26 +410,283 @@ describe('stale session state on a cold acquire', () => {
     }
   })
 
+  it('ends a probe-proven turn at its last proof of life, not at a row written after it', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-stale-session-'))
+    const journals = createTrackedJournalOpener()
+    let now = 100
+    try {
+      const journal = await journals.open({
+        identity: {
+          sessionId: 'session-1',
+          workspaceId: 'workspace-1',
+          hostId: 'local',
+          agent: 'codex',
+          providerHandle: { kind: 'codex', threadId: THREAD }
+        },
+        journalDir: root,
+        now: () => now
+      })
+      const command = { provider: 'codex' as const, threadId: THREAD, turnId: 'turn-1', ordinal: 1 }
+      const shell = { kind: 'tool-call' as const, name: 'shell', input: { command: 'pnpm test' } }
+      const turnScope = turnScopeOf({ ...command, ordinal: 0 })
+      await journal.appendItem(
+        { ...command, ordinal: 0 },
+        { kind: 'turn', turnId: 'turn-1', state: 'running', startedAt: 100 },
+        { fence: 1, turnScope }
+      )
+      now = 200
+      await journal.appendItem(command, { ...shell, state: 'running' }, { fence: 1, turnScope })
+      // Rows can outlast the last renewal; only the renewal is proof of life.
+      now = 700
+      await journal.appendItem(
+        command,
+        { ...shell, input: { command: 'pnpm test', streamed: 'ok' }, state: 'running' },
+        { fence: 1, turnScope }
+      )
+      now = 9_000
+
+      await settleStaleStructuredAgentSessionState({
+        journal,
+        sessionId: 'session-1',
+        fence: 2,
+        acquisitionGeneration: 'generation-2',
+        deathEvidence: {
+          kind: 'pid-absent',
+          detail: 'recorded pid absent on host',
+          observedAt: 9_000,
+          ownerFence: 1,
+          lastProvenAliveAt: 650
+        }
+      })
+
+      const items = journal.snapshot().items
+      expect(items.map((item) => readAgentJournalTurn(item.body)).find(Boolean)).toMatchObject({
+        state: 'interrupted',
+        completedAt: 650
+      })
+      // The probe's detail is Orca's, so the row carries none.
+      expect(
+        items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
+      ).toEqual([
+        'The agent stopped while this response was in progress. You can continue in this conversation.'
+      ])
+    } finally {
+      await journals.closeAll()
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
+  it('ends a crashed turn at its last proof of life, not at a send accepted before the proof', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-stale-session-'))
+    const journals = createTrackedJournalOpener()
+    let now = 100
+    try {
+      const journal = await journals.open({
+        identity: {
+          sessionId: 'session-1',
+          workspaceId: 'workspace-1',
+          hostId: 'local',
+          agent: 'codex',
+          providerHandle: { kind: 'codex', threadId: THREAD }
+        },
+        journalDir: root,
+        now: () => now
+      })
+      await journal.appendItem(
+        RUNNING_IDENTITY,
+        { kind: 'turn', turnId: 'turn-2', state: 'running', startedAt: 100 },
+        { fence: 1, turnScope: turnScopeOf(RUNNING_IDENTITY) }
+      )
+      now = 200
+      await journal.appendItem(
+        { ...RUNNING_IDENTITY, ordinal: 1 },
+        { kind: 'tool-call', name: 'shell', input: { command: 'pnpm test' }, state: 'running' },
+        { fence: 1, turnScope: turnScopeOf(RUNNING_IDENTITY) }
+      )
+      const settle = (deathEvidence: AgentSessionDeathEvidence | null) =>
+        settleStaleStructuredAgentSessionState({
+          journal,
+          sessionId: 'session-1',
+          fence: 1,
+          acquisitionGeneration: null,
+          deathEvidence
+        })
+      // An hour later the relaunch opens the chat before anything proved the owner gone.
+      now = 3_600_000
+      await settle(null)
+      const turn = () => journal.snapshot().items.map((item) => readAgentJournalTurn(item.body))[0]
+      expect(turn()).toMatchObject({ state: 'unverifiable' })
+      now = 3_605_000
+      await journal.appendSubmission({
+        clientMessageId: 'send-1',
+        payloadFingerprint: 'fingerprint-1',
+        body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'still there?' }] },
+        fence: 1,
+        handoverRecorded: true
+      })
+      await journal.resolveDispatch({
+        clientMessageId: 'send-1',
+        state: 'pending',
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE,
+        fence: 1
+      })
+      now = 3_606_000
+
+      await settle({
+        kind: 'pid-absent',
+        detail: 'gone',
+        observedAt: 3_606_000,
+        ownerFence: 1,
+        lastProvenAliveAt: 210
+      })
+
+      expect(turn()).toMatchObject({ state: 'interrupted', completedAt: 210 })
+    } finally {
+      await journals.closeAll()
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
+  it('revises an unverifiable turn only from a proof naming its own owner, and only once', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-stale-session-'))
+    const journals = createTrackedJournalOpener()
+    let now = 100
+    try {
+      const journal = await journals.open({
+        identity: {
+          sessionId: 'session-1',
+          workspaceId: 'workspace-1',
+          hostId: 'local',
+          agent: 'codex',
+          providerHandle: { kind: 'codex', threadId: THREAD }
+        },
+        journalDir: root,
+        now: () => now
+      })
+      await journal.appendItem(
+        RUNNING_IDENTITY,
+        { kind: 'turn', turnId: 'turn-2', state: 'running', startedAt: 100 },
+        { fence: 1, turnScope: turnScopeOf(RUNNING_IDENTITY) }
+      )
+      now = 400
+      // The open, before anything proved the fence-1 owner gone.
+      const settle = (deathEvidence: AgentSessionDeathEvidence | null) =>
+        settleStaleStructuredAgentSessionState({
+          journal,
+          sessionId: 'session-1',
+          fence: 2,
+          acquisitionGeneration: null,
+          deathEvidence
+        })
+      await settle(null)
+      now = 9_000
+      const turn = () => journal.snapshot().items.map((item) => readAgentJournalTurn(item.body))[0]
+      expect(turn()).toMatchObject({ state: 'unverifiable' })
+
+      const unrevised = journal.cursor()
+      await expect(settle({ ...PROVEN, ownerFence: 2 })).resolves.toBe(0)
+      const { ownerFence: _ownerFence, ...olderBuildProof } = PROVEN
+      await expect(settle({ ...olderBuildProof, kind: 'exit-observed' })).resolves.toBe(0)
+      expect(journal.cursor()).toEqual(unrevised)
+      expect(turn()).toMatchObject({ state: 'unverifiable' })
+
+      await expect(settle(PROVEN)).resolves.toBe(2)
+      expect(turn()).toEqual({
+        turnId: 'turn-2',
+        state: 'interrupted',
+        startedAt: 100,
+        completedAt: 100
+      })
+      const revised = journal.cursor()
+      await expect(settle(PROVEN)).resolves.toBe(0)
+      expect(journal.cursor()).toEqual(revised)
+      expect(journal.snapshot().items.filter((item) => item.body.kind === 'status')).toHaveLength(1)
+    } finally {
+      await journals.closeAll()
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
+  it('adds one row for a death however many attempts its settle takes to write', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-stale-session-'))
+    const journals = createTrackedJournalOpener()
+    let now = 100
+    try {
+      const journal = await journals.open({
+        identity: {
+          sessionId: 'session-1',
+          workspaceId: 'workspace-1',
+          hostId: 'local',
+          agent: 'codex',
+          providerHandle: { kind: 'codex', threadId: THREAD }
+        },
+        journalDir: root,
+        now: () => now
+      })
+      // Enough running turns that the settle writes two batches, and its retry two again.
+      for (let index = 0; index < 399; index++) {
+        const turnId = `turn-${index}`
+        await journal.appendItem(
+          { ...RUNNING_IDENTITY, turnId },
+          { kind: 'turn', turnId, state: 'running', startedAt: 100 },
+          { fence: 1, turnScope: turnScopeOf({ ...RUNNING_IDENTITY, turnId }) }
+        )
+      }
+      now = 9_000
+      const settle = () =>
+        settleStaleStructuredAgentSessionState({
+          journal,
+          sessionId: 'session-1',
+          fence: 2,
+          acquisitionGeneration: null,
+          deathEvidence: PROVEN
+        })
+      const turns = () =>
+        journal.snapshot().items.flatMap((item) => readAgentJournalTurn(item.body) ?? [])
+      const statusRows = () =>
+        journal.snapshot().items.filter((item) => item.body.kind === 'status')
+      const append = journal.appendLifecycleBatch.bind(journal)
+      const secondBatchFails = vi
+        .spyOn(journal, 'appendLifecycleBatch')
+        .mockImplementationOnce(append)
+        .mockRejectedValueOnce(new Error('disk full'))
+
+      await expect(settle()).rejects.toThrow('disk full')
+      secondBatchFails.mockRestore()
+      expect(turns().filter((turn) => turn.state === 'running')).toHaveLength(200)
+      expect(statusRows()).toHaveLength(1)
+
+      await settle()
+      expect(turns().filter((turn) => turn.state !== 'interrupted')).toEqual([])
+      expect(statusRows()).toHaveLength(1)
+    } finally {
+      await journals.closeAll()
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
   it('writes nothing when no turn is running and keys on the journal position without a generation', async () => {
     const idle = journalWith([
       lifecycleItem('turn-1', 'completed', 1, { startedAt: 10, completedAt: 20 })
     ])
     await expect(
-      settleStaleSessionStateOnAcquire({
+      settleStaleStructuredAgentSessionState({
         journal: idle.journal,
         sessionId: 'session-1',
         fence: 14,
-        acquisitionGeneration: null
+        acquisitionGeneration: null,
+        deathEvidence: null
       })
     ).resolves.toBe(0)
     expect(idle.appendLifecycleBatch).not.toHaveBeenCalled()
 
     const running = journalWith([lifecycleItem('turn-2', 'running', 2)])
-    await settleStaleSessionStateOnAcquire({
+    await settleStaleStructuredAgentSessionState({
       journal: running.journal,
       sessionId: 'session-1',
       fence: 14,
-      acquisitionGeneration: null
+      acquisitionGeneration: null,
+      deathEvidence: null
     })
     expect(running.appendLifecycleBatch).toHaveBeenCalledWith(
       expect.objectContaining({ settlementId: 'stale-session:session-1:14:seq-8' })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.ts
index 784067b303c..97c951b4517 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.ts
@@ -1,23 +1,24 @@
 // What the host may durably say about a turn whose provider child is gone.
 //
-// `interrupted` requires the host to have seen the child exit; that receipt is the only end time it
-// is allowed to record. Everything weaker — a pid probe, an identity mismatch, a journal found
-// running on a cold acquire — is `unverifiable` and carries no end at all.
+// `interrupted` requires proof that the child which wrote the turn is gone: death evidence naming
+// that turn's owner by fence — a watched exit, or a local probe that found the recorded pid gone or
+// reused. A release nothing proved — lost contact, an unverifiable identity, a stop that outlived the
+// ladder — carries none, and neither does a later owner's death; the turn is then `unverifiable`
+// with no end at all, until a proof naming its owner is written and revises it.
 
 import { parseAgentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
-import type {
-  AgentJournalRenderItem,
-  AgentJournalTurnLifecycle
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalRenderItem,
+  type AgentJournalTurnLifecycle
 } from '../../../shared/agent-session-journal-types'
 import {
   agentJournalTurnBody,
   readAgentJournalTurn
 } from '../../../shared/agent-session-turn-record'
 import type { AgentSessionDeathEvidence } from '../../../shared/agent-session-record'
-import { partitionJournalLifecycleMutations } from '../agent-session-journal/journal-lifecycle-batch-partition'
 import type { JournalLifecycleMutationInput } from '../agent-session-journal/journal-row-builders'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import { cancelledJournalPromptBody } from '../agent-session-journal/journal-prompt-body-bounds'
 
 export type StructuredAgentSessionTurnVerdict =
   | { state: 'interrupted'; completedAt: number }
@@ -28,11 +29,31 @@ export const UNVERIFIABLE_TURN_VERDICT: StructuredAgentSessionTurnVerdict = {
 }
 
 export function turnVerdictFromDeathEvidence(
-  evidence: AgentSessionDeathEvidence | null | undefined
+  evidence: AgentSessionDeathEvidence | null | undefined,
+  /** Fence of the owner that wrote the turn. */
+  turnFence: number | undefined
 ): StructuredAgentSessionTurnVerdict {
-  return evidence?.kind === 'exit-observed'
-    ? { state: 'interrupted', completedAt: evidence.observedAt }
-    : UNVERIFIABLE_TURN_VERDICT
+  if (!evidence) {
+    return UNVERIFIABLE_TURN_VERDICT
+  }
+  if (evidence.ownerFence === undefined) {
+    // Evidence an older build wrote names no owner; it keeps the rule that build applied.
+    return evidence.kind === 'exit-observed'
+      ? { state: 'interrupted', completedAt: evidence.observedAt }
+      : UNVERIFIABLE_TURN_VERDICT
+  }
+  if (evidence.ownerFence !== turnFence) {
+    return UNVERIFIABLE_TURN_VERDICT
+  }
+  if (evidence.kind === 'exit-observed') {
+    return { state: 'interrupted', completedAt: evidence.observedAt }
+  }
+  // A probe finds a dead child long after it died; its last renewal bounds the end, so the turn never
+  // counts the time Orca was down. Timeline rows don't: a send can land there after the death.
+  return {
+    state: 'interrupted',
+    completedAt: Math.min(evidence.lastProvenAliveAt ?? evidence.observedAt, evidence.observedAt)
+  }
 }
 
 /** Revises every still-running lifecycle item in place, keeping its identity and start. */
@@ -40,45 +61,50 @@ export function runningTurnLifecycleRevisions(
   items: readonly AgentJournalRenderItem[],
   verdict: StructuredAgentSessionTurnVerdict
 ): JournalLifecycleMutationInput[] {
-  const revisions: JournalLifecycleMutationInput[] = []
-  for (const item of items) {
+  return items.flatMap((item) => {
     const turn = readAgentJournalTurn(item.body)
-    if (turn?.state !== 'running') {
-      continue
-    }
-    const identity = parseAgentJournalItemKey(item.itemId)
-    if (!identity) {
-      continue
-    }
-    revisions.push({
-      kind: 'item',
-      identity,
-      body: agentJournalTurnBody(settledLifecycle(turn, verdict))
-    })
-  }
-  return revisions
+    return turn?.state === 'running' ? turnLifecycleRevision(item, turn, verdict) : []
+  })
 }
 
-function staleSessionLifecycleRevisions(
-  items: readonly AgentJournalRenderItem[]
+/**
+ * A turn an earlier settle could only call `unverifiable`, because the proof had not been written
+ * yet, revised once a proof names the owner that wrote it. Only ever upward, and never from an
+ * older build's proof, which names no owner.
+ */
+export function provenUnverifiableTurnRevisions(
+  items: readonly AgentJournalRenderItem[],
+  evidence: AgentSessionDeathEvidence | null | undefined,
+  journal: Pick<AgentSessionJournal, 'itemFence'>
 ): JournalLifecycleMutationInput[] {
-  const revisions: JournalLifecycleMutationInput[] = []
-  for (const item of items) {
-    const identity = parseAgentJournalItemKey(item.itemId)
-    if (!identity) {
-      continue
-    }
-    const cancelled =
-      (item.body.kind === 'approval' || item.body.kind === 'question') &&
-      item.body.resolution.state === 'pending'
-        ? cancelledJournalPromptBody(item.body)
-        : null
-    if (cancelled) {
-      revisions.push({ kind: 'item', identity, body: cancelled })
-    }
+  const ownerFence = evidence?.ownerFence
+  if (ownerFence === undefined) {
+    return []
   }
-  revisions.push(...runningTurnLifecycleRevisions(items, UNVERIFIABLE_TURN_VERDICT))
-  return revisions
+  return items.flatMap((item) => {
+    const turn = readAgentJournalTurn(item.body)
+    return turn?.state === 'unverifiable' && journal.itemFence(item.itemId) === ownerFence
+      ? turnLifecycleRevision(item, turn, turnVerdictFromDeathEvidence(evidence, ownerFence))
+      : []
+  })
+}
+
+function turnLifecycleRevision(
+  item: AgentJournalRenderItem,
+  turn: AgentJournalTurnLifecycle,
+  verdict: StructuredAgentSessionTurnVerdict
+): JournalLifecycleMutationInput[] {
+  const identity = parseAgentJournalItemKey(item.itemId)
+  return identity
+    ? [
+        {
+          kind: 'item',
+          identity,
+          body: agentJournalTurnBody(settledLifecycle(turn, verdict)),
+          turnScope: AGENT_JOURNAL_THREAD_SCOPE
+        }
+      ]
+    : []
 }
 
 /** The verdict owns the turn's end and nothing else; every other field the row
@@ -94,30 +120,10 @@ function settledLifecycle(
     durationMs: _durationMs,
     ...kept
   } = lifecycle
-  return verdict.state === 'interrupted'
-    ? { ...kept, state: verdict.state, completedAt: verdict.completedAt }
-    : { ...kept, state: verdict.state }
-}
-
-/** A running row found when a NEW child is acquired belongs to a generation whose exit nobody
- *  observed. Must run before that child's buffered events land, or a live turn would be judged. */
-export async function settleStaleSessionStateOnAcquire(input: {
-  journal: AgentSessionJournal
-  sessionId: string
-  fence: number
-  acquisitionGeneration: string | null
-}): Promise<number> {
-  const { journal } = input
-  const revisions = staleSessionLifecycleRevisions(journal.snapshot().items)
-  const generation = input.acquisitionGeneration ?? `seq-${journal.cursor().sequence}`
-  const settlementId = `stale-session:${input.sessionId}:${input.fence}:${generation}`
-  for (const chunk of partitionJournalLifecycleMutations(settlementId, revisions)) {
-    await journal.appendLifecycleBatch({
-      settlementId: chunk.settlementId,
-      fence: input.fence,
-      recovered: true,
-      mutations: chunk.mutations
-    })
+  if (verdict.state !== 'interrupted') {
+    return { ...kept, state: verdict.state }
   }
-  return revisions.length
+  // A renewal can predate the turn, which started with its owner alive; it never ends before that.
+  const began = Math.max(lifecycle.requestedAt ?? 0, lifecycle.startedAt ?? 0)
+  return { ...kept, state: verdict.state, completedAt: Math.max(verdict.completedAt, began) }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-start-failure-row.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-start-failure-row.ts
new file mode 100644
index 00000000000..12fa05710f0
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-start-failure-row.ts
@@ -0,0 +1,83 @@
+import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
+import { structuredAgentSessionStartFailureRowIdentity } from '../../../shared/structured-agent-session-start-failure-row-key'
+import type { JournalLifecycleMutationInput } from '../agent-session-journal/journal-row-builders'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+import type { StructuredAgentSessionStartFailureWords } from './structured-agent-session-failure-text'
+
+/** A start that failed, keyed like its row, in the words `structuredAgentSessionStartFailure` gave. */
+export type StructuredAgentSessionStartFailure = StructuredAgentSessionStartFailureWords & {
+  startKey: string | null
+}
+
+/**
+ * The one row a start that failed leaves in the chat, whoever saw it fail: an error row, so the
+ * reason outlives any error strip. Keyed by the start — the child's generation, or the oldest
+ * message it was for when no child was ever published — so a second report of the same failure
+ * lands on the same row instead of adding one.
+ */
+export function structuredAgentSessionStartFailureRow(
+  startKey: string,
+  words: StructuredAgentSessionStartFailureWords
+): JournalLifecycleMutationInput {
+  return {
+    kind: 'item',
+    identity: structuredAgentSessionStartFailureRowIdentity(startKey),
+    // The row repeats the sentence the start's rejected messages carry.
+    body: { kind: 'status', text: words.reason, tone: 'error', failure: words.rejection },
+    // A start that failed opened no turn.
+    turnScope: AGENT_JOURNAL_THREAD_SCOPE
+  }
+}
+
+/** Whether the start's row is already written. Its words are the ones its rejected messages carry,
+ *  and rejected is terminal, so the exit's later report of the same start must not reword it. */
+export function hasStructuredAgentSessionStartFailureRow(
+  items: readonly { itemId: string }[],
+  startKey: string
+): boolean {
+  const itemId = agentJournalItemKey(structuredAgentSessionStartFailureRowIdentity(startKey))
+  return items.some((item) => item.itemId === itemId)
+}
+
+/**
+ * A start the delivery loop needed and did not get: the start's row, and every queued message
+ * rejected with the same words. Writes nothing when nothing is still queued: a start whose
+ * messages Stop withdrew did not fail anyone.
+ */
+export async function recordStructuredAgentSessionStartFailure(
+  session: Pick<StructuredAgentSessionHostSession, 'journal'> & { fence: number },
+  failure: StructuredAgentSessionStartFailure
+): Promise<void> {
+  const oldest = oldestQueuedSubmission(session)
+  if (!oldest) {
+    return
+  }
+  const startKey = failure.startKey ?? oldest.clientMessageId
+  await session.journal.appendLifecycleBatch({
+    settlementId: `start-failure:${startKey}`,
+    fence: session.fence,
+    recovered: true,
+    mutations: [structuredAgentSessionStartFailureRow(startKey, failure)]
+  })
+  await session.journal.rejectQueuedSubmissions(session.fence, {
+    reason: failure.reason,
+    rejection: failure.rejection
+  })
+}
+
+export function oldestQueuedSubmission(
+  session: Pick<StructuredAgentSessionHostSession, 'journal'>
+): ReturnType<StructuredAgentSessionHostSession['journal']['submissions']>[number] | undefined {
+  let oldest: ReturnType<typeof oldestQueuedSubmission>
+  for (const submission of session.journal.submissions()) {
+    if (
+      isQueuedAgentJournalSubmission(submission) &&
+      (oldest === undefined || (submission.acceptedSequence ?? 0) < (oldest.acceptedSequence ?? 0))
+    ) {
+      oldest = submission
+    }
+  }
+  return oldest
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-start-failure-writer.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-start-failure-writer.test.ts
new file mode 100644
index 00000000000..5ce1fdb3694
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-start-failure-writer.test.ts
@@ -0,0 +1,194 @@
+// A start a queued message waited on can be seen failing twice: by the delivery loop, when the
+// adapter settles the start without proving it, and by the exit settlement, when the child's exit
+// lands. The chat gets one row for that start, the loop's, in the words the message was rejected
+// with — whichever of the two reports first.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  agentSessionFailureFact,
+  type SubmissionRejectionFact
+} from '../../../shared/agent-session-failure'
+import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import type { AgentSessionSubscribeEvent } from '../../../shared/agent-session-wire'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+const CALLER = { callerKey: 'client-1' }
+const EXIT_REASON = 'Claude Code is not signed in. Sign in with the Claude CLI'
+const ADAPTER_FAILURE = agentSessionFailureFact('notSignedIn')
+const ADAPTER_FAILURE_TEXT =
+  'Codex is not signed in for the selected account. Sign in, then send your message again.'
+// The exit's reason is Orca's log text; the row says only that the start stopped.
+const EXIT_TEXT = 'Codex stopped before it finished starting. Send your message to try again.'
+// The first child (generation-1) is lost at setup; the send starts generation-2.
+const START_ROW = agentJournalItemKey({
+  provider: 'orca',
+  clientMessageId: 'start-failure:generation-2'
+})
+
+function eventually(assertion: () => void | Promise<void>): Promise<void> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let generation = 0
+let settleStart: (failure: SubmissionRejectionFact | undefined) => void = () => {}
+let awaitStarted = vi.fn<() => Promise<SubmissionRejectionFact | undefined>>()
+let frames: AgentSessionSubscribeEvent[] = []
+
+function exitBeforeProof(): Promise<void> {
+  return host.handleAdapterEvent({
+    type: 'ended',
+    sessionId: SESSION,
+    fence: store.getRecord(SESSION)?.lease.runtimeFence ?? 0,
+    acquisitionGeneration: `generation-${generation}`,
+    reason: EXIT_REASON,
+    cause: 'unexpected-exit',
+    startupUnproven: true
+  })
+}
+
+async function sendQueued(text: string): Promise<string> {
+  const body = hostTestMessage(text)
+  const sent = await host.send(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: store.getRecord(SESSION)?.lease.runtimeFence ?? 0,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    },
+    body
+  })
+  expect(sent).toMatchObject({ ok: true })
+  // The loop started a child and waits on its start with the message still queued.
+  await eventually(() => expect(awaitStarted).toHaveBeenCalledOnce())
+  expect(generation).toBe(2)
+  return sent.ok ? sent.value.clientMessageId : ''
+}
+
+async function submission(clientMessageId: string) {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )
+}
+
+/** Every text the subscriber was sent for the start's row, in order. */
+function publishedStartRows(): string[] {
+  return frames.flatMap((frame) =>
+    frame.type === 'batch'
+      ? frame.batch.items.flatMap((item) =>
+          item.itemId === START_ROW && item.body.kind === 'status' ? [item.body.text] : []
+        )
+      : []
+  )
+}
+
+async function startRows(): Promise<string[]> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.itemId === START_ROW && item.body.kind === 'status' ? [item.body.text] : []
+  )
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-start-failure-writer-'))
+  resetHostTestOperationIds()
+  generation = 0
+  frames = []
+  awaitStarted = vi.fn(
+    () => new Promise<SubmissionRejectionFact | undefined>((resolve) => (settleStart = resolve))
+  )
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: {
+      acquire: vi.fn(async ({ fence, spawnToken }) => ({
+        process: { hostId: 'local', pid: 4242, processStartTimeMs: 1_700_000_000_000, spawnToken },
+        link: {
+          linkId: `link-${fence}`,
+          handle: { provider: 'codex' as const, threadId: THREAD },
+          origin: generation === 0 ? ('created' as const) : ('resumed' as const),
+          mintedAtFence: fence,
+          observedAt: NOW
+        },
+        acquisitionGeneration: `generation-${++generation}`,
+        providerChildPhase: 'starting' as const
+      })),
+      awaitStarted,
+      releaseAcquisition: vi.fn(async () => true),
+      closeSession: vi.fn(async () => true),
+      dispatch: vi.fn(async () => ({ state: 'admitted' as const })),
+      cancelTurn: vi.fn(async () => ({ cancelled: true })),
+      answerPrompt: vi.fn(async () => undefined),
+      setOption: vi.fn(async () => undefined)
+    },
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => `spawn-${generation + 1}`,
+    now: () => NOW
+  })
+  await expect(host.attach(CALLER, hostTestAttachParams(null))).resolves.toMatchObject({
+    ok: true
+  })
+  await exitBeforeProof()
+  await host.subscribe({ id: 'pane', sessionId: SESSION, emit: (event) => frames.push(event) })
+})
+
+afterEach(async () => {
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('a queued message whose start fails and whose child then exits', () => {
+  it("keeps the loop's row when the loop saw the failure first", async () => {
+    const queued = await sendQueued('hello')
+
+    settleStart(ADAPTER_FAILURE)
+    await eventually(async () =>
+      expect(await submission(queued)).toMatchObject({
+        dispatchState: 'rejected',
+        reason: ADAPTER_FAILURE_TEXT,
+        rejection: ADAPTER_FAILURE
+      })
+    )
+    await exitBeforeProof()
+    await host.flushStreamedEvents(SESSION)
+
+    expect(await startRows()).toEqual([ADAPTER_FAILURE_TEXT])
+    expect(publishedStartRows()).toEqual([ADAPTER_FAILURE_TEXT])
+  })
+
+  it('leaves the row to the loop when the exit lands while the message still waits', async () => {
+    const queued = await sendQueued('hello')
+
+    await exitBeforeProof()
+    expect(await submission(queued)).toMatchObject({ dispatchState: 'pending' })
+    settleStart(undefined)
+    await eventually(async () =>
+      expect(await submission(queued)).toMatchObject({ dispatchState: 'rejected' })
+    )
+    await host.flushStreamedEvents(SESSION)
+
+    expect(await startRows()).toEqual([EXIT_TEXT])
+    // Written once, after the message was settled, not first by the exit and again by the loop.
+    expect(publishedStartRows()).toEqual([EXIT_TEXT])
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-startup-failure-exit.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-startup-failure-exit.test.ts
index 0fd544ec9ee..3c4096be138 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-startup-failure-exit.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-startup-failure-exit.test.ts
@@ -4,7 +4,7 @@ import {
   agentSessionLeaseFixture,
   agentSessionRecordFixture
 } from '../../../shared/agent-session-record.test-fixture'
-import { providerStartupFailureOutcome } from './structured-agent-session-dead-generation-settlement'
+import { structuredAgentSessionCompactBody } from './structured-agent-session-command-turn'
 import {
   settleUnexpectedStructuredAgentSessionExit,
   type StructuredAgentSessionUnexpectedExitContext,
@@ -13,16 +13,17 @@ import {
 
 const SESSION = 'session-1'
 const GENERATION = 'generation-1'
-const REASON = 'Claude Code is not signed in. Sign in with the Claude CLI'
+const REASON = 'claude stream-json exited (code 1): session limit reached'
+const STARTUP_TEXT = 'Claude stopped before it finished starting. Send your message to try again.'
 
 function startedSession(): StructuredAgentSessionUnexpectedExitSession & {
   journal: { appendLifecycleBatch: ReturnType<typeof vi.fn> }
 } {
   return {
-    hasProviderChild: true,
-    fence: 7,
-    acquisitionGeneration: GENERATION,
+    child: { generation: GENERATION, fence: 7, phase: 'ready' },
     journal: {
+      cursor: () => ({ epoch: 'epoch-1', sequence: 0 }),
+      itemBody: () => null,
       // Nothing ran: the start failed before any response or acknowledged prompt.
       snapshot: () => ({ items: [] }),
       appendLifecycleBatch: vi.fn(async () => ({ epoch: 'epoch-1', sequence: 1 })),
@@ -56,7 +57,6 @@ function contextFor(session: StructuredAgentSessionUnexpectedExitSession) {
     sessions: new Map([[SESSION, session]]),
     flushLifecycle: async () => ({ ok: true }),
     publishFence: vi.fn(),
-    hasResumeCapableHolder: () => true,
     serialize: async <T>(_sessionId: string, task: () => Promise<T>) => task(),
     now: () => 1
   }
@@ -73,50 +73,99 @@ const ended = {
 }
 
 describe('a provider that ends before it finished starting', () => {
-  it('tells the user why, even with no response in progress, and does not auto-resume', async () => {
+  it('tells the user why, even with no response in progress', async () => {
     const session = startedSession()
 
-    const ticket = await settleUnexpectedStructuredAgentSessionExit(contextFor(session), {
+    await settleUnexpectedStructuredAgentSessionExit(contextFor(session), {
       ...ended,
+      // The adapter typed the start's own failure; the host keeps it rather than reword it.
+      failure: { kind: 'notSignedIn' },
       startupUnproven: true
     })
 
-    expect(ticket).toBeNull()
     expect(session.journal.appendLifecycleBatch).toHaveBeenCalledWith(
       expect.objectContaining({
         mutations: [
           expect.objectContaining({
-            body: { kind: 'status', text: providerStartupFailureOutcome(REASON) }
+            // The same row the delivery loop writes for a failed start: an error, keyed by it.
+            identity: { provider: 'orca', clientMessageId: `start-failure:${GENERATION}` },
+            body: {
+              kind: 'status',
+              text: 'Claude is not signed in for the selected account. Sign in, then send your message again.',
+              tone: 'error',
+              failure: { kind: 'notSignedIn' }
+            }
           })
         ]
       })
     )
-    expect(providerStartupFailureOutcome(REASON)).toContain('not signed in')
   })
 
-  it('keeps an ordinary idle exit silent and resumable', async () => {
+  it('keeps an ordinary idle exit silent', async () => {
     const session = startedSession()
 
-    const ticket = await settleUnexpectedStructuredAgentSessionExit(contextFor(session), ended)
+    await settleUnexpectedStructuredAgentSessionExit(contextFor(session), ended)
 
-    expect(ticket).not.toBeNull()
+    expect(session.child).toBeNull()
     expect(session.journal.appendLifecycleBatch).not.toHaveBeenCalled()
   })
 
   it("reads a start that failed off the host's own phase when the provider omits the flag", async () => {
-    const session = { ...startedSession(), providerChildPhase: 'starting' as const }
+    const session = {
+      ...startedSession(),
+      child: { generation: GENERATION, fence: 7, phase: 'starting' as const }
+    }
 
-    const ticket = await settleUnexpectedStructuredAgentSessionExit(contextFor(session), ended)
+    await settleUnexpectedStructuredAgentSessionExit(contextFor(session), {
+      ...ended,
+      failure: { kind: 'providerExited', detail: { text: REASON, audience: 'log' } }
+    })
 
-    expect(ticket).toBeNull()
     expect(session.journal.appendLifecycleBatch).toHaveBeenCalledWith(
       expect.objectContaining({
         mutations: [
           expect.objectContaining({
-            body: { kind: 'status', text: providerStartupFailureOutcome(REASON) }
+            // The same row the delivery loop writes for a failed start: an error, keyed by it.
+            identity: { provider: 'orca', clientMessageId: `start-failure:${GENERATION}` },
+            // The exit's stderr stays out of the sentence, as a log detail beside it.
+            body: {
+              kind: 'status',
+              text: STARTUP_TEXT,
+              tone: 'error',
+              failure: {
+                kind: 'providerStartFailed',
+                detail: { text: REASON, audience: 'log' }
+              }
+            }
           })
         ]
       })
     )
   })
+
+  it('names /compact as the next step when the start that failed was carrying it', async () => {
+    const base = startedSession()
+    const session = {
+      ...base,
+      child: { generation: GENERATION, fence: 7, phase: 'starting' as const },
+      journal: {
+        ...base.journal,
+        submissions: () => [{ clientMessageId: 'compact-1', dispatchState: 'pending' as const }],
+        itemBody: () => structuredAgentSessionCompactBody()
+      }
+    }
+
+    await settleUnexpectedStructuredAgentSessionExit(contextFor(session), ended)
+
+    const text = 'Claude stopped before it finished starting. Run /compact again.'
+    expect(session.journal.rejectPendingSubmissions).toHaveBeenCalledWith(
+      7,
+      expect.objectContaining({ reason: text })
+    )
+    expect(session.journal.appendLifecycleBatch).toHaveBeenCalledWith(
+      expect.objectContaining({
+        mutations: [expect.objectContaining({ body: expect.objectContaining({ text }) })]
+      })
+    )
+  })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-child.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-child.test.ts
new file mode 100644
index 00000000000..78e10bec076
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-child.test.ts
@@ -0,0 +1,76 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, expect, it } from 'vitest'
+import type { AgentSessionStatusEvent } from '../../../shared/agent-session-wire'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
+import { StructuredAgentSessionStatusFeed } from './structured-agent-session-status-feed'
+import { indexedStatusFeedSession } from './structured-agent-session-status-feed-test-session'
+
+const SESSION = 'status-session'
+const journals = createTrackedJournalOpener()
+let root: string
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-status-child-'))
+})
+
+afterEach(async () => {
+  await journals.closeAll()
+  await rm(root, { recursive: true, force: true })
+})
+
+it('publishes each provider child even when a replacement has the same startup phase', async () => {
+  const journal = await journals.open({
+    identity: {
+      sessionId: SESSION,
+      workspaceId: 'workspace-1',
+      hostId: 'local',
+      agent: 'codex',
+      providerHandle: { kind: 'codex', threadId: 'thread-1' }
+    },
+    journalDir: join(root, SESSION)
+  })
+  const sessions = new Map<string, ReturnType<typeof indexedStatusFeedSession>>()
+  const setChild = (
+    child: {
+      phase: 'starting' | 'ready'
+      generation: string
+      fence: number
+    } | null
+  ) => sessions.set(SESSION, indexedStatusFeedSession({ journal, child }))
+  setChild({ phase: 'starting', generation: 'child-1', fence: 1 })
+  const events: AgentSessionStatusEvent[] = []
+  const feed = new StructuredAgentSessionStatusFeed({
+    sessions,
+    getRecord: () => null,
+    now: () => 1
+  })
+  const dispose = feed.subscribe({ id: 'list-1', emit: (event) => events.push(event) })
+  expect(events.at(-1)).toMatchObject({
+    type: 'snapshot',
+    sessions: [
+      {
+        hostExecutionOwned: true,
+        hostExecutionPhase: 'starting',
+        hostExecutionChild: { generation: 'child-1', fence: 1 }
+      }
+    ]
+  })
+  setChild({ phase: 'starting', generation: 'child-2', fence: 2 })
+  feed.publish(SESSION, journal)
+  expect(events.at(-1)).toMatchObject({
+    session: {
+      hostExecutionPhase: 'starting',
+      hostExecutionChild: { generation: 'child-2', fence: 2 }
+    }
+  })
+  setChild({ phase: 'ready', generation: 'child-2', fence: 2 })
+  feed.publish(SESSION, journal)
+  expect(events.at(-1)).toMatchObject({ session: { hostExecutionPhase: 'ready' } })
+  setChild(null)
+  feed.publish(SESSION, journal)
+  expect(events.at(-1)).not.toMatchObject({ session: { hostExecutionPhase: expect.any(String) } })
+  expect(events.at(-1)).not.toMatchObject({ session: { hostExecutionChild: expect.any(Object) } })
+  dispose()
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-clock.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-clock.test.ts
index dcd06c0c7ef..8576df8a95c 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-clock.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-clock.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // Which journal changes republish a session's status now that the summary carries its own state
 // clock: a moved clock always does, and row activity alone does not once the clock dates the state.
 
@@ -73,7 +74,7 @@ async function openFeed() {
     }
   })
   const write = async (identity: AgentJournalItemIdentity, body: AgentJournalItemBody) => {
-    await journal.appendItem(identity, body, { fence: 1 })
+    await journal.appendItem(identity, body, { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE })
     feed.publish(SESSION, journal)
   }
   await write(
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-test-session.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-test-session.ts
index e4fa6ebed1b..da7275cc641 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-test-session.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-test-session.ts
@@ -1,18 +1,13 @@
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import type { StructuredAgentSessionProviderChildIdentity } from './structured-agent-session-host-types'
 
 export function indexedStatusFeedSession(session: {
   journal: AgentSessionJournal
-  hasProviderChild?: boolean
-  providerChildPhase?: 'starting' | 'ready'
-  fence?: number
+  child?: (StructuredAgentSessionProviderChildIdentity & { phase: 'starting' | 'ready' }) | null
 }) {
   return {
     journal: session.journal,
-    fence: session.fence ?? 1,
-    ...(session.hasProviderChild !== undefined
-      ? { hasProviderChild: session.hasProviderChild }
-      : {}),
-    ...(session.providerChildPhase ? { providerChildPhase: session.providerChildPhase } : {}),
+    ...(session.child !== undefined ? { child: session.child } : {}),
     params: {
       location: {
         executionHostId: 'local' as const,
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.test.ts
index 65c7f54fb30..8ff9de818a3 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.test.ts
@@ -1,8 +1,10 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import { agentSessionRecordFixture } from '../../../shared/agent-session-record.test-fixture'
 import type {
   AgentSessionBackgroundTask,
   AgentSessionStatusEvent,
@@ -33,6 +35,8 @@ const USER_IDENTITY = {
   ordinal: 1
 } as const
 
+type Indexed = Parameters<typeof indexed>[0]
+
 let root: string
 const journals = createTrackedJournalOpener()
 
@@ -82,7 +86,8 @@ function feedFor(
         }
       }
     } as unknown as ReadonlyMap<string, ReturnType<typeof indexed>>,
-    getRecord: () => record as AgentSessionRecord | null,
+    // A partial record still has a lease: the feed reads the conversation's fence off it.
+    getRecord: () => (record ? { ...agentSessionRecordFixture(), ...record } : null),
     now: () => (now += 1)
   })
   const events: AgentSessionStatusEvent[] = []
@@ -91,33 +96,17 @@ function feedFor(
 }
 
 describe('StructuredAgentSessionStatusFeed', () => {
-  it('projects whether the owned child has proven its start, and nothing once it is not owned', async () => {
-    const journal = await openJournal()
-    const session = { journal, hasProviderChild: true, providerChildPhase: 'starting' as const }
-    const sessions = new Map<string, Parameters<typeof indexed>[0]>([[SESSION, session]])
-    const { feed, events, dispose } = feedFor(sessions)
-    expect(events.at(-1)).toMatchObject({
-      type: 'snapshot',
-      sessions: [{ hostExecutionOwned: true, hostExecutionPhase: 'starting' }]
-    })
-    sessions.set(SESSION, { ...session, providerChildPhase: 'ready' })
-    feed.publish(SESSION, journal)
-    expect(events.at(-1)).toMatchObject({ session: { hostExecutionPhase: 'ready' } })
-    sessions.set(SESSION, { ...session, hasProviderChild: false })
-    feed.publish(SESSION, journal)
-    expect(events.at(-1)).not.toMatchObject({ session: { hostExecutionPhase: expect.any(String) } })
-    dispose()
-  })
-
   it('publishes provider ownership transitions without changing journal time', async () => {
     const journal = await openJournal()
-    const sessions = new Map([[SESSION, { journal, hasProviderChild: true }]])
+    const sessions = new Map<string, Indexed>([
+      [SESSION, { journal, child: { phase: 'ready', generation: 'child-1', fence: 1 } }]
+    ])
     const { feed, events, dispose } = feedFor(sessions)
     events.length = 0
     await journal.appendItem(
       USER_IDENTITY,
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     feed.publish(SESSION, journal)
     expect(events.at(-1)).toEqual({
@@ -130,7 +119,7 @@ describe('StructuredAgentSessionStatusFeed', () => {
       throw new Error('status publication missing')
     }
     const journalTime = firstStatus.session.updatedAt
-    sessions.get(SESSION)!.hasProviderChild = false
+    sessions.get(SESSION)!.child = null
     feed.publish(SESSION, journal)
     expect(events.at(-1)).toEqual({
       type: 'status',
@@ -167,8 +156,10 @@ describe('StructuredAgentSessionStatusFeed', () => {
 
   it('stops projecting an old-host unknown submission after the owner fence advances', async () => {
     const journal = await openJournal()
-    const session = { journal, fence: 1 }
-    const { feed, events } = feedFor(new Map([[SESSION, session]]))
+    // The conversation's fence is the record's: a child's end moves it.
+    const lease = agentSessionRecordFixture().lease
+    const record = agentSessionRecordFixture({ ...lease, runtimeFence: 1 })
+    const { feed, events } = feedFor(new Map([[SESSION, { journal }]]), record)
     await journal.appendSubmission({
       clientMessageId: 'old-host',
       payloadFingerprint: 'fp',
@@ -183,9 +174,10 @@ describe('StructuredAgentSessionStatusFeed', () => {
     })
     feed.publish(SESSION)
     expect(events.at(-1)).toMatchObject({ session: { status: 'working' } })
-    session.fence = 2
+    record.lease.runtimeFence = 2
     feed.publish(SESSION)
-    expect(events.at(-1)).toMatchObject({ session: { status: 'idle' } })
+    // Its only send outlived the host that sent it and became no turn: nothing left to list.
+    expect(events.at(-1)).toMatchObject({ session: { status: null } })
   })
 
   it('publishes working from the pending submission, before the provider replays the turn', async () => {
@@ -224,12 +216,12 @@ describe('StructuredAgentSessionStatusFeed', () => {
     await journal.appendItem(
       USER_IDENTITY,
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'write a poem' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await journal.appendItem(
       TURN_IDENTITY,
       { kind: 'status', text: 'Working', turnLifecycle: { turnId: 'turn-1', state: 'running' } },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
 
     feed.publish(SESSION)
@@ -260,12 +252,12 @@ describe('StructuredAgentSessionStatusFeed', () => {
     await journal.appendItem(
       USER_IDENTITY,
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await journal.appendItem(
       TURN_IDENTITY,
       { kind: 'status', text: 'Working', turnLifecycle: { turnId: 'turn-1', state: 'running' } },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     const { feed, events } = feedFor(new Map([[SESSION, { journal }]]))
     now = 200
@@ -291,20 +283,20 @@ describe('StructuredAgentSessionStatusFeed', () => {
     await journal.appendItem(
       USER_IDENTITY,
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     const assistant = { ...USER_IDENTITY, ordinal: 2 }
     await journal.appendItem(
       assistant,
       { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'first' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     const { feed, events } = feedFor(new Map([[SESSION, { journal }]]))
     now = 200
     await journal.appendItem(
       assistant,
       { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'finished' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     feed.publish(SESSION)
     expect(events.at(-1)).toMatchObject({
@@ -328,12 +320,12 @@ describe('StructuredAgentSessionStatusFeed', () => {
     await journal.appendItem(
       USER_IDENTITY,
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await journal.appendItem(
       TURN_IDENTITY,
       { kind: 'status', text: 'Working', turnLifecycle: { turnId: 'turn-1', state: 'running' } },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     const { feed, events } = feedFor(new Map([[SESSION, { journal }]]))
     for (let revision = 1; revision <= 20; revision += 1) {
@@ -341,7 +333,7 @@ describe('StructuredAgentSessionStatusFeed', () => {
       await journal.appendItem(
         TURN_IDENTITY,
         { kind: 'status', text: 'Working', turnLifecycle: { turnId: 'turn-1', state: 'running' } },
-        { fence: 1 }
+        { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
       )
       feed.publish(SESSION)
     }
@@ -365,12 +357,12 @@ describe('StructuredAgentSessionStatusFeed', () => {
     await journal.appendItem(
       USER_IDENTITY,
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'run the tests' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await journal.appendItem(
       TURN_IDENTITY,
       { kind: 'status', text: 'Working', turnLifecycle: { turnId: 'turn-1', state: 'running' } },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     feed.publish(SESSION)
     expect(events.at(-1)).toEqual({
@@ -381,7 +373,7 @@ describe('StructuredAgentSessionStatusFeed', () => {
     await journal.appendItem(
       { ...USER_IDENTITY, ordinal: 2 },
       { kind: 'tool-call', name: 'shell', input: { command: 'pnpm test' }, state: 'running' },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     feed.publish(SESSION)
 
@@ -399,7 +391,7 @@ describe('StructuredAgentSessionStatusFeed', () => {
     await journal.appendItem(
       USER_IDENTITY,
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'run it' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await journal.appendItem(
       TURN_IDENTITY,
@@ -410,7 +402,7 @@ describe('StructuredAgentSessionStatusFeed', () => {
         options: [{ id: 'yes', label: 'Allow' }],
         resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
       },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
 
     feed.publish(SESSION)
@@ -427,7 +419,7 @@ describe('StructuredAgentSessionStatusFeed', () => {
     await journal.appendItem(
       USER_IDENTITY,
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     feed.publish(SESSION)
     expect(events.at(-1)).toEqual({
@@ -458,7 +450,7 @@ describe('StructuredAgentSessionStatusFeed', () => {
     await journal.appendItem(
       USER_IDENTITY,
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
 
     const late: AgentSessionStatusEvent[] = []
@@ -490,7 +482,7 @@ describe('StructuredAgentSessionStatusFeed', () => {
     await journal.appendItem(
       USER_IDENTITY,
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     feed.publish(SESSION)
 
@@ -509,12 +501,12 @@ describe('StructuredAgentSessionStatusFeed', () => {
     await journal.appendItem(
       USER_IDENTITY,
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'fix the auth bug' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await journal.appendItem(
       TURN_IDENTITY,
       { kind: 'status', text: 'Working', turnLifecycle: { turnId: 'turn-1', state: 'running' } },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
 
     feed.publish(SESSION, journal)
@@ -542,7 +534,7 @@ describe('StructuredAgentSessionStatusFeed', () => {
           role: 'user',
           blocks: [{ type: 'text', text: 'Fix auth' }]
         },
-        { fence: 1 }
+        { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
       )
       const seen: (string | null)[] = []
       const { feed } = feedFor(new Map([[SESSION, { journal }]]), null, (summary) =>
@@ -622,7 +614,7 @@ describe('StructuredAgentSessionStatusFeed', () => {
     await journal.appendItem(
       USER_IDENTITY,
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
 
     expect(() => feed.publish(SESSION, journal)).not.toThrow()
@@ -637,12 +629,12 @@ describe('StructuredAgentSessionStatusFeed', () => {
     await journal.appendItem(
       USER_IDENTITY,
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'fan out' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await journal.appendItem(
       TURN_IDENTITY,
       { kind: 'status', text: 'Working', turnLifecycle: { turnId: 'turn-1', state: 'running' } },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     const snapshot = vi.spyOn(journal, 'snapshot')
     let taskState: 'working' | 'waiting' = 'working'
@@ -671,7 +663,7 @@ describe('StructuredAgentSessionStatusFeed', () => {
     await journal.appendItem(
       USER_IDENTITY,
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     const record = { options: { model: 'first-model' }, providerHandleChain: [] }
     const { feed, events } = feedFor(new Map([[SESSION, { journal }]]), record)
@@ -701,7 +693,7 @@ describe('StructuredAgentSessionStatusFeed', () => {
     await journal.appendItem(
       USER_IDENTITY,
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'fan out' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     feed.publish(SESSION, journal)
     expect(events.at(-1)).toEqual({
@@ -740,7 +732,7 @@ describe('StructuredAgentSessionStatusFeed', () => {
     await journal.appendItem(
       USER_IDENTITY,
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'fan out' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     feed.publish(SESSION, journal)
     const before = events.length
@@ -793,13 +785,15 @@ describe('the status sink sees the roster the broadcast cache deliberately lacks
 
   it('receives every change once, ownership revocation, and the forget edge', async () => {
     const journal = await openJournal()
-    const sessions = new Map([[SESSION, { journal, hasProviderChild: true }]])
+    const sessions = new Map<string, Indexed>([
+      [SESSION, { journal, child: { phase: 'ready', generation: 'child-1', fence: 1 } }]
+    ])
     const { sink, published, forgotten } = sinkFor()
     const { feed } = feedFor(sessions, null, undefined, undefined, sink)
     await journal.appendItem(
       USER_IDENTITY,
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     feed.publish(SESSION, journal)
     // A second identical publication is deduped for the sink exactly as for subscribers, so the
@@ -815,6 +809,8 @@ describe('the status sink sees the roster the broadcast cache deliberately lacks
     feed.revokeLive(SESSION)
     expect(published.at(-1)).toMatchObject({ sessionId: SESSION, status: 'idle' })
     expect(published.at(-1)?.hostExecutionOwned).toBeUndefined()
+    expect(published.at(-1)?.hostExecutionPhase).toBeUndefined()
+    expect(published.at(-1)?.hostExecutionChild).toBeUndefined()
 
     // Exactly what `close` does after eviction: the cache keeps the projection, the sink does not.
     sessions.delete(SESSION)
@@ -859,7 +855,7 @@ describe('the status sink sees the roster the broadcast cache deliberately lacks
     await journal.appendItem(
       USER_IDENTITY,
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     feed.publish(SESSION, journal)
     expect(() => feed.forget(SESSION)).not.toThrow()
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.ts
index eef1c0e06f9..22a61a006bb 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.ts
@@ -22,10 +22,10 @@ import {
   type AgentSessionStatusSummary
 } from '../../../shared/agent-session-wire'
 import type { AgentChildWorkEvidence } from '../../../shared/agent-status-child-work-evidence'
-import { projectStructuredAgentSessionStatusSummary } from '../../../shared/structured-agent-session-projection'
+import { projectStructuredAgentSessionStatusState } from '../../../shared/structured-agent-session-projection'
 import { structuredAgentSessionAgentStatus } from '../../../shared/structured-agent-session-agent-status'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import type { StructuredAgentSessionProviderChildPhase } from './structured-agent-session-adapter'
+import type { StructuredAgentSessionProviderChild } from './structured-agent-session-host-types'
 import { structuredAgentSessionProviderSessionMetadata } from './structured-agent-session-history-result'
 import {
   StructuredAgentSessionStatusOwnership,
@@ -34,6 +34,10 @@ import {
 
 export type { StructuredAgentSessionStatusSink } from './structured-agent-session-status-ownership'
 
+export type StructuredAgentSessionStatusState = ReturnType<
+  typeof projectStructuredAgentSessionStatusState
+>
+
 export type StructuredAgentSessionStatusSubscriber = {
   id: string
   emit: (event: AgentSessionStatusEvent) => void
@@ -42,9 +46,7 @@ export type StructuredAgentSessionStatusSubscriber = {
 type StatusFeedSession = {
   journal: AgentSessionJournal
   params: { location: AgentSessionRecord['location']; provider: AgentSessionRecord['provider'] }
-  hasProviderChild?: boolean
-  providerChildPhase?: StructuredAgentSessionProviderChildPhase
-  fence?: number
+  child?: Pick<StructuredAgentSessionProviderChild, 'phase' | 'generation' | 'fence'> | null
 }
 
 export type StructuredAgentSessionStatusFeedDeps = {
@@ -60,6 +62,8 @@ export type StructuredAgentSessionStatusFeedDeps = {
   /** Live provider-owned background tasks for the summary, so session lists can
    *  render subagent children. Optional: a provider without the hook projects none. */
   readBackgroundTasks?: (sessionId: string) => AgentSessionBackgroundTaskState | null | undefined
+  /** The session's agent proved a start: its row's phase became `ready`. */
+  onAgentStarted?: (sessionId: string) => void
 }
 
 function summariesEqual(a: AgentSessionStatusSummary, b: AgentSessionStatusSummary): boolean {
@@ -69,6 +73,8 @@ function summariesEqual(a: AgentSessionStatusSummary, b: AgentSessionStatusSumma
     a.status === b.status &&
     a.hostExecutionOwned === b.hostExecutionOwned &&
     a.hostExecutionPhase === b.hostExecutionPhase &&
+    a.hostExecutionChild?.generation === b.hostExecutionChild?.generation &&
+    a.hostExecutionChild?.fence === b.hostExecutionChild?.fence &&
     a.rewindBlockedReason === b.rewindBlockedReason &&
     // A moved state clock changes ranking; row activity alone, including a subagent's, does not.
     // An idle state the journal cannot date still republishes, since readers date it by `updatedAt`,
@@ -117,6 +123,7 @@ export function createStructuredAgentSessionHostStatusFeed(args: {
     onSessionStatusChanged?: StructuredAgentSessionStatusFeedDeps['onStatusChanged']
     statusSink?: StructuredAgentSessionStatusSink
   }
+  onAgentStarted?: (sessionId: string) => void
 }): StructuredAgentSessionStatusFeed {
   return new StructuredAgentSessionStatusFeed({
     sessions: args.sessions,
@@ -126,7 +133,8 @@ export function createStructuredAgentSessionHostStatusFeed(args: {
     readBackgroundTasks: (sessionId) => args.deps().adapter.backgroundTaskState?.(sessionId),
     // Resolved per call for the same reason the other deps are: the host builds this feed in a
     // field initializer, before its constructor parameters are assigned.
-    statusSink: () => args.deps().statusSink
+    statusSink: () => args.deps().statusSink,
+    ...(args.onAgentStarted ? { onAgentStarted: args.onAgentStarted } : {})
   })
 }
 
@@ -144,7 +152,7 @@ export class StructuredAgentSessionStatusFeed {
       sequence: number
       readOnly: boolean
       fence: number | undefined
-      summary: ReturnType<typeof projectStructuredAgentSessionStatusSummary>
+      state: StructuredAgentSessionStatusState
     }
   >()
 
@@ -197,7 +205,12 @@ export class StructuredAgentSessionStatusFeed {
     if (!previous) {
       return
     }
-    const { hostExecutionOwned: _hostExecutionOwned, ...retained } = previous
+    const {
+      hostExecutionOwned: _hostExecutionOwned,
+      hostExecutionPhase: _hostExecutionPhase,
+      hostExecutionChild: _hostExecutionChild,
+      ...retained
+    } = previous
     this.published.set(sessionId, retained)
     this.sink(retained)
     this.broadcast({
@@ -206,6 +219,17 @@ export class StructuredAgentSessionStatusFeed {
     })
   }
 
+  /** The projection behind the session's row and the latest request it read, cached per commit,
+   *  so the completion feed follows the same request without snapshotting the journal again. */
+  statusState(
+    sessionId: string,
+    journal?: AgentSessionJournal
+  ): StructuredAgentSessionStatusState | null {
+    const session = this.deps.sessions.get(sessionId)
+    const source = journal ?? session?.journal
+    return source ? this.projectionFor(source, this.deps.getRecord(sessionId)) : null
+  }
+
   /** Re-projects one session after its journal changed; equal projections are not re-sent. */
   publish(sessionId: string, journal?: AgentSessionJournal, options?: { replay?: boolean }): void {
     const session = this.deps.sessions.get(sessionId)
@@ -223,6 +247,9 @@ export class StructuredAgentSessionStatusFeed {
     this.published.set(sessionId, summary)
     this.sink(summary, session.params.location)
     this.broadcast({ type: 'status', session: summary })
+    if (summary.hostExecutionPhase === 'ready' && previous?.hostExecutionPhase !== 'ready') {
+      this.deps.onAgentStarted?.(sessionId)
+    }
     try {
       this.deps.onStatusChanged?.(summary, { replay: options?.replay === true })
     } catch (error) {
@@ -236,34 +263,8 @@ export class StructuredAgentSessionStatusFeed {
     session: StatusFeedSession,
     journal: AgentSessionJournal
   ): AgentSessionStatusSummary {
-    // An unreadable journal projects as "no turn": the chat itself shows the reset.
-    const cursor = journal.cursor()
-    const readOnly = journal.isReadOnly
-    const fence = session.fence
-    let projection = this.journalProjections.get(journal)
-    if (
-      !projection ||
-      projection.epoch !== cursor.epoch ||
-      projection.sequence !== cursor.sequence ||
-      projection.readOnly !== readOnly ||
-      projection.fence !== fence
-    ) {
-      // A journalled submission bumps `lastSequence`, so the send-time working
-      // signal reaches the cache; the lease fence does not, hence the extra key.
-      const snapshot = readOnly ? null : journal.snapshot()
-      projection = {
-        ...cursor,
-        readOnly,
-        fence,
-        summary: projectStructuredAgentSessionStatusSummary(
-          snapshot?.items ?? [],
-          snapshot?.submissions ?? [],
-          fence
-        )
-      }
-      this.journalProjections.set(journal, projection)
-    }
     const record = this.deps.getRecord(sessionId)
+    const { summary: projected } = this.projectionFor(journal, record)
     const providerSession = structuredAgentSessionProviderSessionMetadata(record)
     // The journal has no model: the record's acknowledged options are where a mid-session
     // switch lands, so the row follows whichever is in force.
@@ -278,15 +279,14 @@ export class StructuredAgentSessionStatusFeed {
       sessionId,
       workspaceId: session.params.location.workspaceId,
       agent: session.params.provider,
-      ...(session.hasProviderChild
+      ...(session.child
         ? {
             hostExecutionOwned: true as const,
-            ...(session.providerChildPhase
-              ? { hostExecutionPhase: session.providerChildPhase }
-              : {})
+            hostExecutionPhase: session.child.phase,
+            hostExecutionChild: { generation: session.child.generation, fence: session.child.fence }
           }
         : {}),
-      ...projection.summary,
+      ...projected,
       ...(record?.rewind?.phase === 'prepared' || record?.rewind?.phase === 'provider-succeeded'
         ? { rewindBlockedReason: 'outcome-unknown' as const }
         : {}),
@@ -310,6 +310,41 @@ export class StructuredAgentSessionStatusFeed {
     }
   }
 
+  private projectionFor(
+    journal: AgentSessionJournal,
+    record: AgentSessionRecord | null
+  ): StructuredAgentSessionStatusState {
+    // An unreadable journal projects as "no turn": the chat itself shows the reset.
+    const cursor = journal.cursor()
+    const readOnly = journal.isReadOnly
+    // The conversation's fence, which a child's end moves: its unanswered sends stop counting.
+    const fence = record?.lease.runtimeFence
+    let projection = this.journalProjections.get(journal)
+    if (
+      !projection ||
+      projection.epoch !== cursor.epoch ||
+      projection.sequence !== cursor.sequence ||
+      projection.readOnly !== readOnly ||
+      projection.fence !== fence
+    ) {
+      // A journalled submission bumps `lastSequence`, so the send-time working
+      // signal reaches the cache; the lease fence does not, hence the extra key.
+      const snapshot = readOnly ? null : journal.snapshot()
+      projection = {
+        ...cursor,
+        readOnly,
+        fence,
+        state: projectStructuredAgentSessionStatusState(
+          snapshot?.items ?? [],
+          snapshot?.submissions ?? [],
+          fence
+        )
+      }
+      this.journalProjections.set(journal, projection)
+    }
+    return projection.state
+  }
+
   /** A failing sink must never cost the subscribers their status event. */
   private sink(
     summary: AgentSessionStatusSummary,
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-status-reentry.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-status-reentry.test.ts
index 57218d0f4bd..ad081c6774f 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-status-reentry.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-status-reentry.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -39,7 +40,7 @@ async function openJournal(): Promise<AgentSessionJournal> {
   await journal.appendItem(
     { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal: 1 },
     { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
-    { fence: 1 }
+    { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
   return journal
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-subagent-recency.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-subagent-recency.test.ts
index cf908932667..a0912e86dbc 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-subagent-recency.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-subagent-recency.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // A subagent's work must not re-date the session that spawned it.
 //
 // The status row takes its completion stamp and acknowledgement clock from the summary's
@@ -63,7 +64,15 @@ async function openSession() {
   const roster: { tasks: AgentSessionBackgroundTask[] } = { tasks: [] }
   const server = new AgentHookServer()
   const feed = new StructuredAgentSessionStatusFeed({
-    sessions: new Map([[SESSION, indexedStatusFeedSession({ journal, hasProviderChild: true })]]),
+    sessions: new Map([
+      [
+        SESSION,
+        indexedStatusFeedSession({
+          journal,
+          child: { phase: 'ready', generation: 'child-1', fence: 1 }
+        })
+      ]
+    ]),
     getRecord: () => null,
     now: () => 1,
     readBackgroundTasks: () => ({ state: 'monitoring', tasks: roster.tasks }),
@@ -84,7 +93,7 @@ async function openSession() {
     journal.appendItem(
       { provider: 'orca', clientMessageId },
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
   const latestStatus = () => {
     const event = events.findLast((candidate) => candidate.type === 'status')
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts
index 82f8c551642..c39cfe44e1d 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts
@@ -2,7 +2,10 @@ import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import { AGENT_SESSION_JOURNAL_SCHEMA_VERSION } from '../../../shared/agent-session-journal-types'
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  AGENT_SESSION_JOURNAL_SCHEMA_VERSION
+} from '../../../shared/agent-session-journal-types'
 import type {
   AgentSessionStatusEvent,
   AgentSessionSubscribeEvent
@@ -116,7 +119,7 @@ describe('AgentSessionSubscribers', () => {
     await journal.appendItem(
       { provider: 'orca', clientMessageId: 'clocked' },
       { kind: 'status', text: 'Clocked' },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     subscribers.publish(SESSION, journal)
     subscribers.backgroundTasks(SESSION, null, 1)
@@ -253,12 +256,12 @@ describe('AgentSessionSubscribers', () => {
     await journal.appendItem(
       { ...turn, ordinal: 1 },
       { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'write a poem' }] },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     await journal.appendItem(
       turn,
       { kind: 'status', text: 'Working', turnLifecycle: { turnId: 'turn-1', state: 'running' } },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     subscribers.publish(SESSION, journal)
 
@@ -318,7 +321,7 @@ describe('AgentSessionSubscribers', () => {
     await journal.appendItem(
       { provider: 'orca', clientMessageId: 'after-background-fence' },
       { kind: 'status', text: 'After background state' },
-      { fence: 2 }
+      { fence: 2, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     subscribers.publish(SESSION, journal)
 
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.ts
index af5e231730c..ae795674564 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.ts
@@ -8,19 +8,18 @@ import type {
   AgentJournalCursor,
   AgentJournalResetReason
 } from '../../../shared/agent-session-journal-types'
-import {
-  AGENT_SESSION_HISTORY_MAX_LIMIT,
-  type AgentSessionBackgroundTaskState,
-  type AgentSessionSlashCommand,
-  type AgentSessionSubscribeEvent,
-  type AgentSessionTurnActivity
+import type {
+  AgentSessionBackgroundTaskState,
+  AgentSessionSlashCommand,
+  AgentSessionSubscribeEvent,
+  AgentSessionTurnActivity
 } from '../../../shared/agent-session-wire'
+import { buildSubscriberFrame } from './agent-session-subscriber-frame-fields'
+import type { QueuePublication } from './structured-agent-session-queued-publication'
+import { deliverToSubscriber } from './agent-session-subscriber-catch-up'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import { emptyAgentSessionBatch } from './agent-session-empty-batch'
-import {
-  createAgentSessionCatchUpReader,
-  readAgentSessionHydrationPage
-} from './agent-session-history-page'
+import { readAgentSessionHydrationPage } from './agent-session-history-page'
 import { rememberSessionActivity } from './structured-agent-session-activity-retention'
 
 export type AgentSessionSubscriberEmit = (event: AgentSessionSubscribeEvent) => void
@@ -31,17 +30,23 @@ export type AgentSessionSubscribeInput = {
   cursor?: AgentJournalCursor
 }
 
-type Subscriber = {
+export type Subscriber = {
   id: string
   sessionId: string
   emit: AgentSessionSubscriberEmit
   cursor: AgentJournalCursor
   fence: number
   commands?: AgentSessionSlashCommand[] | null
+  /** The last draft list actually SENT — never advanced on a page that withheld
+   *  it, or the final replacement would be suppressed by the identity dedup. */
+  queuePublication?: QueuePublication
 }
 
 export type AgentSessionSubscribersHooks = {
   readCommands?: (sessionId: string) => AgentSessionSlashCommand[] | undefined
+  /** Revision-stable per emit: an unchanged list keeps its reference, so token
+   *  streams never re-serialize it; any draft-table write changes it. */
+  readQueuePublication?: (sessionId: string) => QueuePublication | undefined
   /** Fires after publications that can change journal content. */
   onJournalPublished?: (sessionId: string, journal: AgentSessionJournal) => void
   now?: () => number
@@ -57,6 +62,10 @@ export class AgentSessionSubscribers {
     return this.activityBySession.size
   }
 
+  subscriberCountForTests(sessionId: string): number {
+    return this.bySession.get(sessionId)?.size ?? 0
+  }
+
   open(input: {
     id: string
     sessionId: string
@@ -209,71 +218,15 @@ export class AgentSessionSubscribers {
     backgroundTasks?: AgentSessionBackgroundTaskState | null,
     activity?: AgentSessionTurnActivity | null
   ): void {
-    const checkpointActivity = emitCheckpoint
-      ? this.activityField(subscriber.sessionId).activity
-      : undefined
-    const publishedActivity = activity !== undefined ? activity : checkpointActivity
-    const readPage = createAgentSessionCatchUpReader(journal)
-    while (true) {
-      const result = readPage({
-        sessionId: subscriber.sessionId,
-        direction: 'after',
-        cursor: subscriber.cursor,
-        limit: AGENT_SESSION_HISTORY_MAX_LIMIT
-      })
-      if (!result.ok) {
-        const page = { ...result.page, fence: subscriber.fence }
-        this.emit(subscriber, {
-          type: 'reset',
-          sessionId: subscriber.sessionId,
-          reset: result.reset,
-          page,
-          fence: subscriber.fence,
-          hostNow,
-          ...(backgroundTasks !== undefined ? { backgroundTasks } : {}),
-          ...(publishedActivity !== undefined ? { activity: publishedActivity } : {})
-        })
-        subscriber.cursor = page.liveCursor ?? page.window.nextCursor
-        return
-      }
-      const page = result.page
-      const advanced = page.window.nextCursor.sequence > subscriber.cursor.sequence
-      if (!advanced) {
-        const commandsChanged =
-          this.hooks.readCommands !== undefined &&
-          (this.hooks.readCommands(subscriber.sessionId) ?? null) !== subscriber.commands
-        if (emitCheckpoint || publishedActivity !== undefined || commandsChanged) {
-          this.emit(subscriber, {
-            type: 'batch',
-            sessionId: subscriber.sessionId,
-            batch: emptyAgentSessionBatch(page.window.nextCursor),
-            fence: subscriber.fence,
-            hostNow,
-            ...(backgroundTasks !== undefined ? { backgroundTasks } : {}),
-            ...(publishedActivity !== undefined ? { activity: publishedActivity } : {})
-          })
-        }
-        return
-      }
-      this.emit(subscriber, {
-        type: 'batch',
-        sessionId: subscriber.sessionId,
-        batch: {
-          cursor: page.window.nextCursor,
-          items: page.items,
-          removedItemIds: page.removedItemIds,
-          submissions: page.submissions
-        },
-        fence: subscriber.fence,
-        hostNow,
-        ...(backgroundTasks !== undefined ? { backgroundTasks } : {}),
-        ...(publishedActivity !== undefined ? { activity: publishedActivity } : {})
-      })
-      subscriber.cursor = page.window.nextCursor
-      if (!page.hasNewer || !this.isActive(subscriber)) {
-        return
-      }
-    }
+    deliverToSubscriber(
+      {
+        hooks: this.hooks,
+        emit: (target, event, options) => this.emit(target, event, options),
+        isActive: (target) => this.isActive(target),
+        activity: (sessionId) => this.activityField(sessionId).activity
+      },
+      { subscriber, journal, hostNow, emitCheckpoint, backgroundTasks, activity }
+    )
   }
 
   private now = (): number => this.hooks.now?.() ?? Date.now()
@@ -283,15 +236,23 @@ export class AgentSessionSubscribers {
 
   /** A dead transport cannot be allowed to turn a durable mutation into an
    *  unknown outcome or poison every later publication. */
-  private emit(subscriber: Subscriber, event: AgentSessionSubscribeEvent): void {
+  private emit(
+    subscriber: Subscriber,
+    event: AgentSessionSubscribeEvent,
+    options?: { withholdQueued?: boolean }
+  ): void {
     try {
-      const commands = this.hooks.readCommands?.(subscriber.sessionId) ?? null
-      const includeCommands =
-        this.hooks.readCommands !== undefined &&
-        event.type !== 'end' &&
-        (event.type !== 'batch' || commands !== subscriber.commands)
-      subscriber.emit(includeCommands ? { ...event, commands: commands ?? null } : event)
-      subscriber.commands = commands
+      const built = buildSubscriberFrame(
+        this.hooks,
+        subscriber,
+        event,
+        options?.withholdQueued === true
+      )
+      subscriber.emit(built.frame)
+      subscriber.commands = built.commands
+      if (built.attachedQueued) {
+        subscriber.queuePublication = built.queued
+      }
     } catch {
       this.drop(subscriber)
     }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-surface-lifetime.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-surface-lifetime.test.ts
index 661da1ed844..4594c8c38bd 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-surface-lifetime.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-surface-lifetime.test.ts
@@ -1,7 +1,9 @@
-// The lifetime of a provider child, from the surfaces that hold the session.
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
+// The lifetime of a provider child, against the real host rather than a double.
 //
-// Two leaks meet here and each has to be tested against the real host, not a double: a chat that
-// closes without stopping its app-server, and a launch that starts one for every record on disk.
+// Two leaks meet here: a chat that closes without stopping its app-server, and a launch that
+// starts one for every record on disk. A view never starts or keeps a child; work starts one, the
+// idle sweep stops it, and an exit is settled and left for the next send.
 
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
@@ -16,7 +18,6 @@ import type {
   AgentSessionMutationEnvelope,
   AgentSessionSubscribeEvent
 } from '../../../shared/agent-session-wire'
-import { AGENT_SESSION_UNATTACHED_REFUSAL_CODE } from '../../../shared/structured-agent-session-read-refusal'
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import {
   AgentSessionAcquisitionRootExitObservedError,
@@ -24,7 +25,8 @@ import {
 } from './structured-agent-session-adapter'
 import type { StructuredAgentSessionEventSink } from './structured-agent-session-event-sink'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
-import { unexpectedProviderExitOutcome } from './structured-agent-session-dead-generation-settlement'
+import { abandonStructuredAgentSessionHost } from './structured-agent-session-host-test-abandon'
+import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
 import type { StructuredAgentSessionStatusSink } from './structured-agent-session-status-feed'
 import {
   HOST_TEST_NOW as NOW,
@@ -35,11 +37,16 @@ import {
   hostTestOperationId,
   resetHostTestOperationIds
 } from './structured-agent-session-host-test-data'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
+
+const UNEXPECTED_PROVIDER_EXIT_OUTCOME =
+  'Codex stopped while this response was in progress. You can continue in this conversation.'
 
 const CALLER = { callerKey: 'client-1' }
-const SURFACE = 'desktop-chat:1'
-/** Short enough to keep the suite fast, long enough that an eviction is a decision and not a race. */
-const GRACE_MS = 5
+/** Short enough to keep the suite fast; the host clock below decides what is idle. */
+const SWEEP_MS = 5
+const IDLE_MS = 1_000
 
 let root: string
 let store: AgentSessionRecordStore
@@ -50,6 +57,7 @@ let dispatch: Mock<StructuredAgentSessionAdapter['dispatch']>
 let sink: StructuredAgentSessionEventSink | null
 let hostErrors: unknown[]
 let statusSink: StructuredAgentSessionStatusSink
+let clock: number
 function adapter(): StructuredAgentSessionAdapter {
   return {
     acquire,
@@ -71,8 +79,8 @@ function openHost(
     journalRoot: root,
     claimKeyId: 'key-1',
     mintSpawnToken: () => `spawn-${acquire.mock.calls.length}`,
-    releaseGraceMs: GRACE_MS,
-    now: () => NOW,
+    idleSweep: { intervalMs: SWEEP_MS, idleMs: IDLE_MS },
+    now: () => clock,
     onEventSinkError: ({ error }) => hostErrors.push(error),
     statusSink,
     ...(probeOwner ? { probeOwner } : {})
@@ -92,6 +100,12 @@ async function attach(): Promise<void> {
   expect(await host.attach(CALLER, hostTestAttachParams(null))).toMatchObject({ ok: true })
 }
 
+/** What a send's delivery or `agentSession.ensure` does: attach at the record's current fence. */
+async function startAgent(): Promise<void> {
+  const fence = store.getRecord(SESSION)?.lease.runtimeFence ?? null
+  expect(await host.attach(CALLER, hostTestAttachParams(fence))).toMatchObject({ ok: true })
+}
+
 function envelope(method: string, fields: Record<string, unknown>): AgentSessionMutationEnvelope {
   return {
     sessionId: SESSION,
@@ -108,11 +122,12 @@ function envelope(method: string, fields: Record<string, unknown>): AgentSession
 function emitTurnLifecycle(state: 'running' | 'completed', ordinal: number): void {
   sink?.appendItem(
     { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal },
-    { kind: 'status', text: state, turnLifecycle: { turnId: 'turn-1', state } }
+    { kind: 'status', text: state, turnLifecycle: { turnId: 'turn-1', state } },
+    { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
 }
 
-/** Eviction is a sequence, not an event: the child stops first and the session is forgotten last. */
+/** The sweep stops the child first and closes the conversation last. */
 function waitForEviction(): Promise<void> {
   return vi.waitFor(() => {
     expect(closeSession).toHaveBeenCalledWith(SESSION)
@@ -120,9 +135,9 @@ function waitForEviction(): Promise<void> {
   })
 }
 
-/** Long enough for several grace windows to elapse, so "not evicted" means the clock declined. */
-function waitOutSeveralGraceWindows(): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, GRACE_MS * 20))
+/** Long enough for many sweep ticks, so "not stopped" means the sweep declined. */
+function waitOutSeveralSweeps(): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, SWEEP_MS * 20))
 }
 
 /** Fails the next eviction at `drain-published`, which leaves the session indexed for a retry. */
@@ -144,7 +159,8 @@ async function failJournalSinkUntilReleased(): Promise<void> {
   vi.spyOn(session!.journal, 'appendItem').mockRejectedValueOnce(new Error('disk unavailable'))
   sink?.appendItem(
     { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 1 },
-    { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'lost write' }] }
+    { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'lost write' }] },
+    { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
   await vi.waitFor(() => {
     expect(closeSession).toHaveBeenCalledWith(SESSION)
@@ -188,6 +204,7 @@ beforeEach(async () => {
   resetHostTestOperationIds()
   sink = null
   hostErrors = []
+  clock = NOW
   statusSink = { publish: vi.fn(), forget: vi.fn() }
   let generation = 0
   acquire = vi.fn(async ({ fence, spawnToken, events }) => {
@@ -207,7 +224,12 @@ beforeEach(async () => {
     }
   })
   closeSession = vi.fn(async () => true)
-  dispatch = vi.fn(async () => ({ state: 'rejected' as const, reason: 'unused' }))
+  dispatch = vi.fn(async () => ({
+    state: 'rejected' as const,
+    ...agentSessionFailureWords(agentSessionFailureFact('providerRejected'), {
+      surface: 'rejection'
+    })
+  }))
   store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
   openHost()
 })
@@ -218,13 +240,13 @@ afterEach(async () => {
 })
 
 describe('a chat that closes', () => {
-  it('releases the provider child it was holding', async () => {
+  it('stops the provider child it started', async () => {
     await attach()
-    await host.hold(SESSION, SURFACE)
 
-    host.release(SESSION, SURFACE)
+    await host.close(SESSION)
 
-    await waitForEviction()
+    expect(closeSession).toHaveBeenCalledWith(SESSION)
+    expect(host.hasSession(SESSION)).toBe(false)
     expect(hostErrors).toEqual([])
     // The record and its journal stay; only the process and the claim on it go.
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
@@ -234,52 +256,27 @@ describe('a chat that closes', () => {
     })
   })
 
-  it('keeps the child while another surface still holds the session', async () => {
-    await attach()
-    await host.hold(SESSION, SURFACE)
-    await host.hold(SESSION, 'paired-phone:1')
-
-    host.release(SESSION, SURFACE)
-    await waitOutSeveralGraceWindows()
-
-    expect(closeSession).not.toHaveBeenCalled()
-    expect(host.hasSession(SESSION)).toBe(true)
-  })
-
   // The pane outlives the close by a few frames — a workspace delete closes the chats inside it
-  // while their panes are still mounted — so whatever a read raises in that window is what the user
-  // sees. This is the code the client narrows on to keep that window off the pane; a host that
-  // starts raising a different one there puts the red error back.
-  it('answers a read from the pane that outlived it with the code the client treats as transitional', async () => {
+  // while their panes are still mounted. A read in that window reopens the conversation as a cache
+  // and is answered, never refused; it starts nothing.
+  it('answers a read from the pane that outlived it without starting a child', async () => {
     await attach()
-    await host.hold(SESSION, SURFACE)
 
     await host.close(SESSION)
-
     expect(host.hasSession(SESSION)).toBe(false)
-    expect(() => host.history({ sessionId: SESSION, direction: 'tail' })).toThrow(
-      AGENT_SESSION_UNATTACHED_REFUSAL_CODE
-    )
-    expect(() =>
-      host.subscribe({ id: 'sub-1', sessionId: SESSION, emit: () => undefined })
-    ).toThrow(AGENT_SESSION_UNATTACHED_REFUSAL_CODE)
+
+    expect((await host.history({ sessionId: SESSION, direction: 'tail' })).ok).toBe(true)
+    const unsubscribe = await host.subscribe({
+      id: 'sub-1',
+      sessionId: SESSION,
+      emit: () => undefined
+    })
+    unsubscribe()
+    expect(acquire).toHaveBeenCalledOnce()
+    expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
   })
 
-  it('does not lose the session to a release the client sent twice', async () => {
-    await attach()
-    await host.hold(SESSION, SURFACE)
-    await host.hold(SESSION, 'paired-phone:1')
-
-    // A retried release must retire ONE holder, which is what a set gets right and a count does not.
-    host.release(SESSION, SURFACE)
-    host.release(SESSION, SURFACE)
-    await waitOutSeveralGraceWindows()
-
-    expect(closeSession).not.toHaveBeenCalled()
-    expect(host.hasSession(SESSION)).toBe(true)
-  })
-
-  it('releases a compatibility wait when the session is evicted', async () => {
+  it('answers a compatibility wait with what eviction recorded', async () => {
     await attach()
     dispatch.mockResolvedValueOnce({ state: 'admitted' })
     const body = hostTestMessage('pending until close')
@@ -294,14 +291,21 @@ describe('a chat that closes', () => {
     if (!result.ok) {
       throw new Error('send was refused')
     }
+    // Handed over first: a message still queued at close is rejected as never sent instead.
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalled())
     const settlement = host.waitForSendSettlement(SESSION, result.value.clientMessageId)
 
     await host.close(SESSION)
 
-    await expect(settlement).resolves.toBeUndefined()
+    // Eviction's settlement is a journal write, so the wait sees it rather than timing out.
+    await expect(settlement).resolves.toMatchObject({
+      value: {
+        submission: { dispatchState: 'unknown', reason: 'provider_closed_before_acknowledgement' }
+      }
+    })
   })
 
-  it('retries teardown after journal close loses its result', async () => {
+  it('keeps the stop it made when the journal close loses its result', async () => {
     await attach()
     const session = host['sessions'].get(SESSION)
     expect(session).toBeDefined()
@@ -313,27 +317,16 @@ describe('a chat that closes', () => {
       })
       .mockImplementation(closeJournal)
 
-    await expect(host.close(SESSION)).rejects.toMatchObject({
-      step: 'forget-session',
-      cause: expect.objectContaining({ message: 'journal close result lost' })
-    })
-    expect(host.hasSession(SESSION)).toBe(true)
-    expect(host['sessions'].get(SESSION)?.hasProviderChild).toBe(false)
+    // The child is stopped and the lease released before the handle closes; the entry is dropped
+    // before that close, so a lost result leaves no closing handle for a reader to find.
+    await expect(host.close(SESSION)).rejects.toThrow('journal close result lost')
+    expect(host.hasSession(SESSION)).toBe(false)
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       claimStatus: 'released',
       ownerProcess: null
     })
-    expect(statusSink.forget).toHaveBeenCalledWith({
-      kind: 'structured-session',
-      sessionId: SESSION,
-      executionHostId: 'local',
-      wslDistro: null,
-      workspaceId: 'workspace-1',
-      workspaceKind: 'git-worktree'
-    })
 
     await expect(host.close(SESSION)).resolves.toBeUndefined()
-    expect(host.hasSession(SESSION)).toBe(false)
     expect(closeSession).toHaveBeenCalledOnce()
   })
 
@@ -356,7 +349,7 @@ describe('a chat that closes', () => {
 
     await expect(host.close(SESSION)).rejects.toMatchObject({ step: 'drain-published' })
     // The child is proven gone, but the wind-down it owes is not done: nothing settled, no release.
-    expect(session!.hasProviderChild).toBe(false)
+    expect(session!.child).toBeNull()
     expect(store.getRecord(SESSION)?.lease.claimStatus).not.toBe('released')
 
     await expect(host.close(SESSION)).resolves.toBeUndefined()
@@ -370,31 +363,31 @@ describe('a chat that closes', () => {
 })
 
 describe('a session with a turn in flight', () => {
-  it('is not evicted while the turn runs, and is once it ends', async () => {
+  it('is not stopped while the turn runs, and is once it ends and idles', async () => {
     await attach()
-    await host.hold(SESSION, SURFACE)
     emitTurnLifecycle('running', 1)
     await host.flushStreamedEvents(SESSION)
 
-    host.release(SESSION, SURFACE)
-    await waitOutSeveralGraceWindows()
+    clock += IDLE_MS
+    await waitOutSeveralSweeps()
 
     expect(closeSession).not.toHaveBeenCalled()
     expect(host.hasSession(SESSION)).toBe(true)
 
     emitTurnLifecycle('completed', 2)
     await host.flushStreamedEvents(SESSION)
+    clock += IDLE_MS
 
     await waitForEviction()
   })
 
-  // Codex settles an admitted send only on its echo, which may never come; eviction retires it.
-  it('is evicted with an admitted send outstanding once no turn runs', async () => {
+  // Codex settles an admitted send only on its echo, which may never come; the stop retires it.
+  it('is stopped with an admitted send outstanding once no turn runs', async () => {
     await attach()
-    await host.hold(SESSION, SURFACE)
     await sendPending('admitted, never echoed')
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledOnce())
 
-    host.release(SESSION, SURFACE)
+    clock += IDLE_MS
 
     await waitForEviction()
   })
@@ -404,26 +397,22 @@ describe('startup', () => {
   it('settles an idle absent owner without chat pollution and resumes the same provider identity', async () => {
     await attach()
     const beforeRestart = store.getRecord(SESSION)
-    host['runtimeState'].stopLeaseRenewal()
-    host['holds'].dispose()
-    await host['sessions'].get(SESSION)?.journal.close()
-    host['sessions'].clear()
+    await abandonStructuredAgentSessionHost(host)
 
     store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
     openHost(async () => ({ outcome: 'pid-absent' }))
     await host.restoreReadableSessions()
 
-    const restored = host.history({ sessionId: SESSION, direction: 'tail' })
+    const restored = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(restored.ok && restored.page.items.some((item) => item.body.kind === 'status')).toBe(
       false
     )
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       claimStatus: 'released',
-      ownerProcess: null,
-      settlementRetryRequired: undefined
+      ownerProcess: null
     })
 
-    await host.hold(SESSION, SURFACE)
+    await startAgent()
     expect(store.getRecord(SESSION)?.providerHandleChain.at(-1)?.handle).toEqual(
       beforeRestart?.providerHandleChain.at(-1)?.handle
     )
@@ -441,16 +430,23 @@ describe('startup', () => {
     expect(host.listSessionTabs()).toEqual([
       { sessionId: SESSION, workspaceId: 'workspace-1', agent: 'codex' }
     ])
-    expect(host.history({ sessionId: SESSION, direction: 'tail' }).ok).toBe(true)
+    expect((await host.history({ sessionId: SESSION, direction: 'tail' })).ok).toBe(true)
     expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
   })
 
-  it('gives the child back to a chat a surface actually opens', async () => {
+  it('gives the child back for work, never for a read', async () => {
     await attach()
     await reboot()
     await host.restoreReadableSessions()
 
-    await host.hold(SESSION, SURFACE)
+    const unsubscribe = await host.subscribe({
+      id: 'viewer-1',
+      sessionId: SESSION,
+      emit: () => undefined
+    })
+    expect(acquire).not.toHaveBeenCalled()
+    await startAgent()
+    unsubscribe()
 
     expect(acquire).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
@@ -461,23 +457,23 @@ describe('startup', () => {
   })
 })
 
-describe('a session evicted and opened again', () => {
+describe('a session closed and started again', () => {
   it('publishes provider events to the reattached chat', async () => {
     await attach()
-    await host.hold(SESSION, SURFACE)
-    host.release(SESSION, SURFACE)
-    await waitForEviction()
+    await host.close(SESSION)
+    expect(host.hasSession(SESSION)).toBe(false)
 
-    await host.hold(SESSION, 'desktop-chat:2')
+    await startAgent()
     const events: AgentSessionSubscribeEvent[] = []
-    const unsubscribe = host.subscribe({
+    const unsubscribe = await host.subscribe({
       id: 'subscriber-1',
       sessionId: SESSION,
       emit: (event) => events.push(event)
     })
     sink?.appendItem(
       { provider: 'codex', threadId: THREAD, turnId: 'turn-2', ordinal: 1 },
-      { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'back again' }] }
+      { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'back again' }] },
+      { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     sink?.publish()
     await host.flushStreamedEvents(SESSION)
@@ -487,6 +483,12 @@ describe('a session evicted and opened again', () => {
   })
 })
 
+async function submissionState(clientMessageId: string): Promise<string | undefined> {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )?.dispatchState
+}
+
 describe('an unexpected provider exit', () => {
   it('publishes terminal settlement to a waiting older client', async () => {
     await attach()
@@ -503,6 +505,8 @@ describe('an unexpected provider exit', () => {
     if (!result.ok) {
       throw new Error('send was refused')
     }
+    // Accepted first; the exit must meet a message the provider was handed.
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledOnce())
     const settlement = host.waitForSendSettlement(SESSION, result.value.clientMessageId)
     const exitedFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
 
@@ -526,7 +530,7 @@ describe('an unexpected provider exit', () => {
     await failJournalSinkUntilReleased()
 
     expect(dispatch).not.toHaveBeenCalled()
-    const history = host.history({ sessionId: SESSION, direction: 'tail' })
+    const history = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(
       history.ok &&
         history.page.items.some(
@@ -548,17 +552,18 @@ describe('an unexpected provider exit', () => {
     replaceFailedSink()
   })
 
-  it('releases the exact generation, reacquires outside the queue, and dispatches a new message', async () => {
+  it('releases the exact generation, starts nothing, and the next message starts a child', async () => {
     await attach()
-    await host.hold(SESSION, SURFACE)
     dispatch.mockRejectedValueOnce(new Error('provider delivery became unknown'))
     const unknownBody = hostTestMessage('message with unknown delivery')
+    const unknownEnvelope = envelope('agentSession.send', { body: unknownBody })
     await expect(
-      host.send(CALLER, {
-        envelope: envelope('agentSession.send', { body: unknownBody }),
-        body: unknownBody
-      })
-    ).resolves.toMatchObject({ ok: true, value: { submission: { dispatchState: 'unknown' } } })
+      host.send(CALLER, { envelope: unknownEnvelope, body: unknownBody })
+    ).resolves.toMatchObject({ ok: true, value: { submission: { dispatchState: 'pending' } } })
+    // Accepted, then handed over by the delivery loop, where the thrown dispatch becomes doubt.
+    await vi.waitFor(async () =>
+      expect(await submissionState(unknownEnvelope.clientOperationId)).toBe('unknown')
+    )
     const exitedFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
 
     await host.handleAdapterEvent({
@@ -570,32 +575,42 @@ describe('an unexpected provider exit', () => {
       acquisitionGeneration: 'generation-1'
     })
 
-    const recoveredHistory = host.history({ sessionId: SESSION, direction: 'tail' })
+    const recoveredHistory = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(
       recoveredHistory.ok &&
         hasUnansweredStructuredAgentSessionDispatch(recoveredHistory.page.submissions)
     ).toBe(false)
-    expect(acquire).toHaveBeenCalledTimes(2)
+    // No respawn: the exit is settled and shown, and the conversation waits for work.
+    expect(acquire).toHaveBeenCalledOnce()
     expect(dispatch).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      claimStatus: 'live',
-      runtimeFence: exitedFence + 2,
-      ownerProcess: { pid: 4242 }
+      claimStatus: 'released',
+      runtimeFence: exitedFence + 1
     })
     dispatch.mockResolvedValueOnce({
       state: 'accepted',
       providerIdentity: { provider: 'codex', threadId: THREAD, turnId: 'turn-next', ordinal: 1 }
     })
     const body = hostTestMessage('a distinct next message')
-    await expect(
-      host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
-    ).resolves.toMatchObject({ ok: true, value: { submission: { dispatchState: 'accepted' } } })
+    const nextEnvelope = envelope('agentSession.send', { body })
+    await expect(host.send(CALLER, { envelope: nextEnvelope, body })).resolves.toMatchObject({
+      ok: true,
+      value: { submission: { dispatchState: 'pending' } }
+    })
+    await vi.waitFor(async () =>
+      expect(await submissionState(nextEnvelope.clientOperationId)).toBe('accepted')
+    )
+    expect(acquire).toHaveBeenCalledTimes(2)
     expect(dispatch).toHaveBeenCalledTimes(2)
   })
 
-  it('does not reacquire for a subscription-only hold or a stale child generation', async () => {
+  it('does not reacquire for a live reader or a stale child generation', async () => {
     await attach()
-    await host.hold(SESSION, 'subscriber-1', { resume: false })
+    const unsubscribe = await host.subscribe({
+      id: 'subscriber-1',
+      sessionId: SESSION,
+      emit: () => undefined
+    })
     const exitedFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
 
     await host.handleAdapterEvent({
@@ -623,11 +638,11 @@ describe('an unexpected provider exit', () => {
       runtimeFence: exitedFence + 1,
       deathEvidence: { kind: 'exit-observed' }
     })
+    unsubscribe()
   })
 
   it('keeps a requested close out of recovery', async () => {
     await attach()
-    await host.hold(SESSION, SURFACE)
     const fence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
 
     await host.handleAdapterEvent({
@@ -645,7 +660,6 @@ describe('an unexpected provider exit', () => {
 
   it('recovers after a failed lifecycle barrier and dispatches a distinct next message', async () => {
     await attach()
-    await host.hold(SESSION, SURFACE)
     dispatch.mockRejectedValueOnce(new Error('provider delivery became unknown'))
     const unknownBody = hostTestMessage('message with unknown delivery')
     const unknownParams = {
@@ -654,8 +668,11 @@ describe('an unexpected provider exit', () => {
     }
     await expect(host.send(CALLER, unknownParams)).resolves.toMatchObject({
       ok: true,
-      value: { submission: { dispatchState: 'unknown' } }
+      value: { submission: { dispatchState: 'pending' } }
     })
+    await vi.waitFor(async () =>
+      expect(await submissionState(unknownParams.envelope.clientOperationId)).toBe('unknown')
+    )
     const runtimeState = (
       host as unknown as {
         runtimeState: { lifecycleBarrier: () => Promise<{ ok: false; error: Error }> }
@@ -677,21 +694,20 @@ describe('an unexpected provider exit', () => {
     })
 
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      claimStatus: 'live',
-      runtimeFence: exitedFence + 2,
-      ownerProcess: { pid: 4242 }
+      claimStatus: 'released',
+      runtimeFence: exitedFence + 1
     })
-    expect(acquire).toHaveBeenCalledTimes(2)
+    expect(acquire).toHaveBeenCalledOnce()
     expect(dispatch).toHaveBeenCalledOnce()
     expect(hostErrors).toContainEqual(expect.objectContaining({ message: 'journal failed' }))
-    const history = host.history({ sessionId: SESSION, direction: 'tail' })
+    const history = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(history.ok && history.page.submissions[0]?.dispatchState).toBe('unknown')
     // A send whose delivery outcome is unknown IS work in progress, so the reassuring outcome is
-    // written — carrying the cause, and never the old bare `Provider exited: <reason>` row.
+    // written — its failure fact beside it, and never the old bare `Provider exited: <reason>` row.
     const statuses = history.ok
       ? history.page.items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
       : []
-    expect(statuses).toEqual([unexpectedProviderExitOutcome('provider exited')])
+    expect(statuses).toEqual([UNEXPECTED_PROVIDER_EXIT_OUTCOME])
     expect(statuses.some((text) => text.startsWith('Provider exited'))).toBe(false)
 
     dispatch.mockResolvedValueOnce({
@@ -699,15 +715,19 @@ describe('an unexpected provider exit', () => {
       providerIdentity: { provider: 'codex', threadId: THREAD, turnId: 'turn-next', ordinal: 1 }
     })
     const body = hostTestMessage('a distinct next message after failed-barrier recovery')
-    await expect(
-      host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
-    ).resolves.toMatchObject({ ok: true, value: { submission: { dispatchState: 'accepted' } } })
+    const nextEnvelope = envelope('agentSession.send', { body })
+    await expect(host.send(CALLER, { envelope: nextEnvelope, body })).resolves.toMatchObject({
+      ok: true,
+      value: { submission: { dispatchState: 'pending' } }
+    })
+    await vi.waitFor(async () =>
+      expect(await submissionState(nextEnvelope.clientOperationId)).toBe('accepted')
+    )
     expect(dispatch).toHaveBeenCalledTimes(2)
   })
 
-  it('latches a failed exit settlement and blocks attach until the terminal batch is written', async () => {
+  it('releases the lease when the exit settlement cannot be written, and the next send settles the turn it left', async () => {
     await attach()
-    await host.hold(SESSION, SURFACE)
     emitTurnLifecycle('running', 1)
     await host.flushStreamedEvents(SESSION)
     const runtimeState = (
@@ -728,7 +748,8 @@ describe('an unexpected provider exit', () => {
       }
     ).sessions.get(SESSION)
     expect(session).toBeDefined()
-    const appendSettlement = vi
+    // The conversation's one handle refuses every write of the exit's settlement.
+    const refusing = vi
       .spyOn(session!.journal, 'appendLifecycleBatch')
       .mockRejectedValue(new Error('settlement still unavailable'))
     const exitedFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
@@ -742,30 +763,48 @@ describe('an unexpected provider exit', () => {
       acquisitionGeneration: 'generation-1'
     })
 
-    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+    const released = store.getRecord(SESSION)?.lease
+    expect(released).toMatchObject({
       claimStatus: 'released',
-      handoffStage: 'recovering',
-      settlementRetryRequired: true,
-      settlementRetryId: `provider-exit:${SESSION}:${exitedFence}:generation-1`,
-      ownerProcess: null,
-      runtimeFence: exitedFence + 1
-    })
-    expect(await host.attach(CALLER, hostTestAttachParams(exitedFence + 1))).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_ownership_unknown' }
-    })
-    expect(acquire).toHaveBeenCalledOnce()
-
-    appendSettlement.mockRestore()
-    expect(await host.attach(CALLER, hostTestAttachParams(exitedFence + 1))).toMatchObject({
-      ok: true
-    })
-    expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      claimStatus: 'live',
       handoffStage: null,
-      settlementRetryRequired: undefined
+      ownerProcess: null,
+      runtimeFence: exitedFence + 1,
+      deathEvidence: { kind: 'exit-observed', detail: 'provider exited', observedAt: NOW }
     })
+    // The retry recording the exit queues is refused too; once the journal writes again, the next
+    // acquire re-derives it.
+    await host.collaboratorsForTests().serialize(SESSION, async () => {})
+    refusing.mockRestore()
+
+    dispatch.mockResolvedValueOnce({
+      state: 'accepted',
+      providerIdentity: { provider: 'codex', threadId: THREAD, turnId: 'turn-next', ordinal: 1 }
+    })
+    const body = hostTestMessage('sent after a settlement that never landed')
+    const sentEnvelope = envelope('agentSession.send', { body })
+    await expect(host.send(CALLER, { envelope: sentEnvelope, body })).resolves.toMatchObject({
+      ok: true,
+      value: { submission: { dispatchState: 'pending' } }
+    })
+    await vi.waitFor(async () =>
+      expect(await submissionState(sentEnvelope.clientOperationId)).toBe('accepted')
+    )
     expect(acquire).toHaveBeenCalledTimes(2)
+    // The new child's acquire settled the turn from the release's evidence: ended at the exit's
+    // receipt. The evidence is Orca's log text, so the row says only that the provider stopped.
+    const history = await host.history({ sessionId: SESSION, direction: 'tail' })
+    const items = history.ok ? history.page.items : []
+    expect(items.map((item) => readAgentJournalTurn(item.body)).filter(Boolean)).toContainEqual(
+      expect.objectContaining({ turnId: 'turn-1', state: 'interrupted', completedAt: NOW })
+    )
+    const statuses = items.flatMap((item) => (item.body.kind === 'status' ? [item.body] : []))
+    expect(statuses).toContainEqual({
+      kind: 'status',
+      text: UNEXPECTED_PROVIDER_EXIT_OUTCOME,
+      failure: { kind: 'providerExited' },
+      tone: 'error'
+    })
+    expect(statuses.map((status) => status.text).join('\n')).not.toContain('provider exited')
   })
 })
 
@@ -780,7 +819,7 @@ describe('a quit over an eviction that never got its retry', () => {
     failNextDrain()
 
     await expect(host.close(SESSION)).rejects.toMatchObject({ step: 'drain-published' })
-    expect(host['sessions'].get(SESSION)?.hasProviderChild).toBe(false)
+    expect(host['sessions'].get(SESSION)?.child).toBeNull()
     expect(store.getRecord(SESSION)?.lease.claimStatus).not.toBe('released')
 
     await host.flushAllStreamedEvents()
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.test.ts
index 3d4e8491986..9fddf6c7b34 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -57,7 +58,7 @@ function appendGoalRow(
   return journal.appendItem(
     { provider: 'orca', clientMessageId: `goal-row:${journal.snapshot().items.length}` },
     { kind: 'status', text: 'Goal', threadGoal: { state: 'set', goal: { ...GOAL, ...overrides } } },
-    { fence: 1 }
+    { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
 }
 
@@ -125,7 +126,11 @@ describe('performThreadGoalChange', () => {
 
     expect(result).toEqual({
       ok: false,
-      refusal: { code: 'agent_session_operation_invalid', message: 'goals feature is disabled' }
+      refusal: {
+        code: 'agent_session_operation_invalid',
+        details: { reason: 'providerRejected' },
+        message: 'goals feature is disabled'
+      }
     })
     expect(journal.snapshot().items).toEqual([])
   })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.ts
index 4e49e00f587..a779ba51abe 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.ts
@@ -1,6 +1,7 @@
 // `agentSession.threadGoal`: change the provider thread's goal through the same
 // admission, ledger and journal path every other session mutation takes.
 
+import { refuse, type AgentSessionRefusalReason } from '../../../shared/agent-session-wire-refusals'
 import type {
   AgentJournalItemIdentity,
   AgentJournalThreadGoal
@@ -13,8 +14,11 @@ import type {
 import type { MutationPlan } from './structured-agent-session-mutation-plans'
 import type { AgentSessionTurnContext, TurnOutcome } from './structured-agent-session-turns'
 
-function refused(message: string): TurnOutcome<AgentSessionThreadGoalResult> {
-  return { ok: false, refusal: { code: 'agent_session_operation_invalid', message } }
+function refused(
+  reason: AgentSessionRefusalReason<'agent_session_operation_invalid'>,
+  message: string
+): TurnOutcome<AgentSessionThreadGoalResult> {
+  return { ok: false, refusal: refuse('agent_session_operation_invalid', { reason }, message) }
 }
 
 /** Keyed by the operation, so a replayed set upserts its one objective row. */
@@ -44,7 +48,7 @@ export async function performThreadGoalChange(
   input: { clientOperationId: string; change: AgentSessionThreadGoalChange }
 ): Promise<TurnOutcome<AgentSessionThreadGoalResult>> {
   if (!ctx.adapter.changeThreadGoal || !ctx.adapter.supportsThreadGoal?.(ctx.sessionId)) {
-    return refused('Goals are unavailable for this chat session.')
+    return refused('goalsUnsupported', 'Goals are unavailable for this chat session.')
   }
   const { change } = input
   const identity = objectiveIdentity(input.clientOperationId)
@@ -66,15 +70,14 @@ export async function performThreadGoalChange(
         blocks: [{ type: 'text', text: change.objective }],
         sentAs: 'goal'
       },
-      { fence: ctx.fence }
+      // Accepting a goal is delivering it, so it joins whatever turn runs now.
+      { fence: ctx.fence, turnScope: ctx.journal.liveTurnScope() }
     )
-    ctx.publish()
   }
   const withdrawObjective = async (): Promise<void> => {
     if (change.kind === 'set') {
       // Nothing was sent as a goal.
       await ctx.journal.appendTombstone(identity, { fence: ctx.fence })
-      ctx.publish()
     }
   }
   let result: Awaited<ReturnType<typeof ctx.adapter.changeThreadGoal>>
@@ -91,7 +94,7 @@ export async function performThreadGoalChange(
   }
   if (!result.ok) {
     await withdrawObjective()
-    return refused(result.rejected)
+    return refused('providerRejected', result.rejected)
   }
   return { ok: true, value: { change: change.kind } }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-turn-completion-feed.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-turn-completion-feed.test.ts
index c0e652724af..1c2ff9b9e53 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-turn-completion-feed.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-turn-completion-feed.test.ts
@@ -1,6 +1,18 @@
 import { describe, expect, it, vi } from 'vitest'
-import type { AgentJournalTurnLifecycle } from '../../../shared/agent-session-journal-types'
+import type {
+  AgentJournalRenderItem,
+  AgentJournalSubmission,
+  AgentJournalTurnLifecycle
+} from '../../../shared/agent-session-journal-types'
+import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
 import type { AgentSessionTurnCompletionEvent } from '../../../shared/agent-session-wire'
+import {
+  DISPATCH_REJECTED_CANCELLED,
+  DISPATCH_REJECTED_HOST_RESTARTED,
+  DISPATCH_REJECTED_NOT_DELIVERED,
+  DISPATCH_REJECTED_PROVIDER_CLOSED
+} from '../../../shared/structured-agent-session-dispatch-rejection'
+import { projectStructuredAgentSessionStatusState } from '../../../shared/structured-agent-session-projection'
 import { StructuredAgentSessionTurnCompletionFeed } from './structured-agent-session-turn-completion-feed'
 
 const LOCATION = {
@@ -10,6 +22,8 @@ const LOCATION = {
   workspaceKind: 'git-worktree'
 } as const
 
+const START_FAILURE = 'Claude is not signed in.'
+
 function turn(
   turnId: string,
   state: AgentJournalTurnLifecycle['state'],
@@ -18,33 +32,102 @@ function turn(
   return { turnId, state, ...(outcome ? { outcome } : {}) }
 }
 
+function turnItem(lifecycle: AgentJournalTurnLifecycle, sequence: number): AgentJournalRenderItem {
+  return {
+    itemId: `codex:turn:${lifecycle.turnId}`,
+    revision: 1,
+    sequence,
+    observedAt: sequence,
+    body: { kind: 'turn', ...lifecycle }
+  }
+}
+
+function userEntry(clientMessageId: string, sequence: number): AgentJournalRenderItem {
+  return {
+    itemId: agentJournalSubmissionKey(clientMessageId),
+    revision: 0,
+    sequence,
+    observedAt: sequence,
+    body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: clientMessageId }] }
+  }
+}
+
+function sent(
+  clientMessageId: string,
+  fields: Partial<AgentJournalSubmission> & Pick<AgentJournalSubmission, 'dispatchState'>
+): AgentJournalSubmission {
+  return {
+    clientMessageId,
+    fence: 1,
+    payloadFingerprint: clientMessageId,
+    providerItemId: null,
+    reason: null,
+    submittedAt: 10,
+    resolvedAt: 20,
+    handoverRecorded: true,
+    ...fields
+  }
+}
+
+const pending = (clientMessageId: string, fence = 1) =>
+  sent(clientMessageId, { dispatchState: 'pending', fence, handedOverAt: 11, resolvedAt: null })
+const refused = (clientMessageId: string, reason = START_FAILURE) =>
+  sent(clientMessageId, { dispatchState: 'rejected', reason })
+
 function harness(): {
   feed: StructuredAgentSessionTurnCompletionFeed
   setTurn: (next: AgentJournalTurnLifecycle | null) => void
+  setJournal: (
+    items: AgentJournalRenderItem[],
+    submissions: AgentJournalSubmission[],
+    fence?: number
+  ) => void
   setCursor: (next: { epoch: string; sequence: number }) => void
   observe: () => void
   events: AgentSessionTurnCompletionEvent[]
+  outcomes: () => [string, string][]
+  /** Whether each completion said the user is being asked something. */
+  awaitingUser: () => boolean[]
   listen: () => () => void
 } {
-  let current: AgentJournalTurnLifecycle | null = null
+  let items: AgentJournalRenderItem[] = []
+  let submissions: AgentJournalSubmission[] = []
+  let fence: number | undefined
   let cursor = { epoch: 'epoch-1', sequence: 0 }
-  const journal = {
-    newestTurn: () => current,
-    cursor: () => cursor
-  }
+  const journal = { cursor: () => cursor }
   const sessions = new Map([['session-1', { journal, params: { location: LOCATION } }]])
-  const feed = new StructuredAgentSessionTurnCompletionFeed({ sessions, now: () => 1_700 })
+  const feed = new StructuredAgentSessionTurnCompletionFeed({
+    sessions,
+    now: () => 1_700,
+    // The status feed's projection, computed as it computes it.
+    readStatusState: () => projectStructuredAgentSessionStatusState(items, submissions, fence)
+  })
   const events: AgentSessionTurnCompletionEvent[] = []
   return {
     feed,
     setTurn: (next) => {
-      current = next
+      items = next ? [turnItem(next, 1)] : []
+      submissions = []
+    },
+    setJournal: (nextItems, nextSubmissions, nextFence) => {
+      items = nextItems
+      submissions = nextSubmissions
+      fence = nextFence
+      cursor = { ...cursor, sequence: cursor.sequence + 1 }
     },
     setCursor: (next) => {
       cursor = next
     },
     observe: () => feed.observe('session-1'),
     events,
+    outcomes: () =>
+      events.flatMap((event): [string, string][] =>
+        event.type === 'completion' ? [[event.completion.turnId, event.completion.outcome]] : []
+      ),
+    awaitingUser: () =>
+      events.flatMap((event) =>
+        event.type === 'completion' ? [event.completion.awaitingUser === true] : []
+      ),
     listen: () => feed.subscribe({ id: 'sub', emit: (event) => events.push(event) })
   }
 }
@@ -59,7 +142,8 @@ describe('StructuredAgentSessionTurnCompletionFeed', () => {
     h.setTurn(turn('turn-1', 'completed', 'success'))
     h.setCursor({ epoch: 'epoch-1', sequence: 2 })
     h.observe()
-    expect(h.events).toEqual([
+    // Strict: an idle settle omits `awaitingUser` rather than sending it undefined.
+    expect(h.events).toStrictEqual([
       {
         type: 'completion',
         completion: {
@@ -260,4 +344,352 @@ describe('StructuredAgentSessionTurnCompletionFeed', () => {
     h.feed.observe('session-unknown')
     expect(emit).not.toHaveBeenCalled()
   })
+
+  it('announces no /compact turn and keeps its mark on the last real turn (B6)', () => {
+    const h = harness()
+    h.listen()
+    const real = [userEntry('m1', 1), turnItem(turn('t1', 'completed', 'success'), 2)]
+    const accepted = sent('m1', { dispatchState: 'accepted' })
+    h.setJournal(real, [accepted])
+    h.observe()
+    const command: AgentJournalRenderItem = {
+      ...userEntry('c1', 3),
+      body: {
+        kind: 'message',
+        role: 'user',
+        blocks: [{ type: 'text', text: '/compact' }],
+        command: { name: 'compact' }
+      }
+    }
+    const commandTurn = (lifecycle: AgentJournalTurnLifecycle): AgentJournalRenderItem => ({
+      ...turnItem({ ...lifecycle, userItemId: command.itemId }, 4),
+      itemId: 'orca:command-turn:c1'
+    })
+    h.setJournal(
+      [...real, command, commandTurn(turn('compact:c1', 'running'))],
+      [accepted, pending('c1')]
+    )
+    h.observe()
+    h.setJournal(
+      [...real, command, commandTurn(turn('compact:c1', 'completed', 'success'))],
+      [accepted, sent('c1', { dispatchState: 'accepted' })]
+    )
+    h.observe()
+    expect(h.events).toEqual([])
+  })
+})
+
+describe('a request the agent or its start refused', () => {
+  const M1 = agentJournalSubmissionKey('m1')
+  const M2 = agentJournalSubmissionKey('m2')
+  const M3 = agentJournalSubmissionKey('m3')
+  const settledTurn = turnItem(turn('t1', 'completed', 'success'), 2)
+
+  /** A session whose first turn succeeded, as the feed saw it happen. */
+  function afterSuccessfulTurn() {
+    const h = harness()
+    h.listen()
+    h.setJournal([userEntry('m1', 1), turnItem(turn('t1', 'running'), 2)], [])
+    h.observe()
+    h.setJournal([userEntry('m1', 1), settledTurn], [sent('m1', { dispatchState: 'accepted' })])
+    h.observe()
+    expect(h.outcomes()).toEqual([['t1', 'success']])
+    return h
+  }
+
+  it('notifies failed once when the only send fails to start, named by its item key', () => {
+    const h = harness()
+    h.listen()
+    h.observe()
+    h.setJournal([userEntry('m1', 1)], [pending('m1')])
+    h.observe()
+    h.setJournal([userEntry('m1', 1)], [refused('m1')])
+    h.observe()
+    h.observe()
+    expect(h.events).toEqual([
+      {
+        type: 'completion',
+        completion: {
+          scope: LOCATION,
+          sessionId: 'session-1',
+          turnId: M1,
+          outcome: 'failure',
+          completedAt: 1_700
+        }
+      }
+    ])
+  })
+
+  it('stays silent on a first observation of a send that had already failed', () => {
+    // A restart, reopen or re-attach: the failure is history, not news.
+    const h = harness()
+    h.listen()
+    h.setJournal([userEntry('m1', 1)], [refused('m1')])
+    h.observe()
+    h.observe()
+    expect(h.events).toEqual([])
+  })
+
+  it('re-baselines an epoch replacement that surfaces an older failure', () => {
+    const h = afterSuccessfulTurn()
+    h.setJournal([userEntry('m1', 1)], [refused('m1')])
+    h.setCursor({ epoch: 'epoch-2', sequence: 1 })
+    h.observe()
+    expect(h.outcomes()).toEqual([['t1', 'success']])
+  })
+
+  it.each([
+    DISPATCH_REJECTED_CANCELLED,
+    DISPATCH_REJECTED_HOST_RESTARTED,
+    DISPATCH_REJECTED_PROVIDER_CLOSED,
+    DISPATCH_REJECTED_NOT_DELIVERED
+  ])('never notifies a send %s, alone or after a turn', (reason) => {
+    const alone = harness()
+    alone.listen()
+    alone.observe()
+    alone.setJournal([userEntry('m1', 1)], [pending('m1')])
+    alone.observe()
+    alone.setJournal([userEntry('m1', 1)], [refused('m1', reason)])
+    alone.observe()
+    expect(alone.events).toEqual([])
+
+    // The latest request falls back to the turn already announced, which must not announce again.
+    const h = afterSuccessfulTurn()
+    const accepted = sent('m1', { dispatchState: 'accepted' })
+    h.setJournal([userEntry('m1', 1), settledTurn, userEntry('m2', 3)], [accepted, pending('m2')])
+    h.observe()
+    h.setJournal(
+      [userEntry('m1', 1), settledTurn, userEntry('m2', 3)],
+      [accepted, refused('m2', reason)]
+    )
+    h.observe()
+    expect(h.outcomes()).toEqual([['t1', 'success']])
+  })
+
+  it('never notifies a crash-stranded send that restart reconciliation finds undelivered', () => {
+    const h = afterSuccessfulTurn()
+    const items = [userEntry('m1', 1), settledTurn, userEntry('m2', 3)]
+    const accepted = sent('m1', { dispatchState: 'accepted' })
+    h.setJournal(items, [accepted, sent('m2', { dispatchState: 'unknown', recovered: true })], 2)
+    h.observe()
+    h.setJournal(
+      items,
+      [
+        accepted,
+        sent('m2', {
+          dispatchState: 'rejected',
+          reason: DISPATCH_REJECTED_NOT_DELIVERED,
+          fence: 2,
+          recovered: true
+        })
+      ],
+      2
+    )
+    h.observe()
+    expect(h.outcomes()).toEqual([['t1', 'success']])
+  })
+
+  it('notifies failed, then success, when a failed start is retried and the retry succeeds', () => {
+    const h = harness()
+    h.listen()
+    h.observe()
+    h.setJournal([userEntry('m1', 1)], [refused('m1')])
+    h.observe()
+    h.setJournal([userEntry('m1', 1), userEntry('m2', 2)], [refused('m1'), pending('m2')])
+    h.observe()
+    const accepted = sent('m2', { dispatchState: 'accepted' })
+    h.setJournal(
+      [userEntry('m1', 1), userEntry('m2', 2), turnItem(turn('t2', 'running'), 3)],
+      [refused('m1'), accepted]
+    )
+    h.observe()
+    h.setJournal(
+      [userEntry('m1', 1), userEntry('m2', 2), turnItem(turn('t2', 'completed', 'success'), 3)],
+      [refused('m1'), accepted]
+    )
+    h.observe()
+    expect(h.outcomes()).toEqual([
+      [M1, 'failure'],
+      ['t2', 'success']
+    ])
+  })
+
+  it('notifies each failed start that follows another', () => {
+    const h = harness()
+    h.listen()
+    h.observe()
+    h.setJournal([userEntry('m1', 1)], [refused('m1')])
+    h.observe()
+    h.setJournal([userEntry('m1', 1), userEntry('m2', 2)], [refused('m1'), pending('m2')])
+    h.observe()
+    h.setJournal([userEntry('m1', 1), userEntry('m2', 2)], [refused('m1'), refused('m2')])
+    h.observe()
+    expect(h.outcomes()).toEqual([
+      [M1, 'failure'],
+      [M2, 'failure']
+    ])
+  })
+
+  it.each([
+    ['in one commit', [['m2', 'm3']]],
+    ['oldest first, across commits', [['m2'], ['m3']]],
+    ['newest first, across commits', [['m3'], ['m2']]]
+  ])('notifies once for queued sends one start failure refused %s', (_name, batches) => {
+    const h = afterSuccessfulTurn()
+    const items = [userEntry('m1', 1), settledTurn, userEntry('m2', 3), userEntry('m3', 4)]
+    const accepted = sent('m1', { dispatchState: 'accepted' })
+    const queued = (id: string) => sent(id, { dispatchState: 'pending', resolvedAt: null })
+    const answered = new Set<string>()
+    const submissions = () => [
+      accepted,
+      ...['m2', 'm3'].map((id) => (answered.has(id) ? refused(id) : queued(id)))
+    ]
+    h.setJournal(items, submissions())
+    h.observe()
+    for (const batch of batches) {
+      batch.forEach((id) => answered.add(id))
+      h.setJournal(items, submissions())
+      h.observe()
+    }
+    expect(h.outcomes()).toEqual([
+      ['t1', 'success'],
+      [M3, 'failure']
+    ])
+  })
+
+  it('does not wait on a send left pending at an older fence', () => {
+    const h = harness()
+    h.listen()
+    h.setJournal([userEntry('m1', 1), userEntry('m2', 2)], [pending('m1', 1), pending('m2', 2)], 2)
+    h.observe()
+    h.setJournal([userEntry('m1', 1), userEntry('m2', 2)], [pending('m1', 1), refused('m2')], 2)
+    h.observe()
+    expect(h.outcomes()).toEqual([[M2, 'failure']])
+  })
+})
+
+describe('a request that settles while the user is asked something', () => {
+  const M1 = agentJournalSubmissionKey('m1')
+
+  /** An approval the user has not answered; `agentId` makes it a subagent's. */
+  function approval(
+    itemId: string,
+    sequence: number,
+    state: 'pending' | 'resolved',
+    agentId?: string
+  ): AgentJournalRenderItem {
+    return {
+      itemId,
+      revision: state === 'pending' ? 1 : 2,
+      sequence,
+      observedAt: sequence,
+      ...(agentId ? { agentId } : {}),
+      body: {
+        kind: 'approval',
+        title: 'Run command?',
+        detail: null,
+        options: [{ id: 'yes', label: 'Allow' }],
+        resolution: { state, selectedOptionId: null, resolvedBy: null, resolvedAt: null }
+      }
+    }
+  }
+
+  it('notifies once when the main turn settles while a subagent waits on an approval', () => {
+    const h = harness()
+    h.listen()
+    const user = userEntry('m1', 1)
+    const accepted = [sent('m1', { dispatchState: 'accepted' })]
+    h.setJournal([user, turnItem(turn('t1', 'running'), 2)], accepted)
+    h.observe()
+    h.setJournal(
+      [user, turnItem(turn('t1', 'running'), 2), approval('a1', 3, 'pending', 'child-1')],
+      accepted
+    )
+    h.observe()
+    h.setJournal(
+      [
+        user,
+        turnItem(turn('t1', 'completed', 'success'), 2),
+        approval('a1', 3, 'pending', 'child-1')
+      ],
+      accepted
+    )
+    h.observe()
+    expect(h.outcomes()).toEqual([['t1', 'success']])
+    expect(h.awaitingUser()).toEqual([true])
+
+    // Answering the prompt settles the session idle on the request already announced.
+    h.setJournal(
+      [
+        user,
+        turnItem(turn('t1', 'completed', 'success'), 2),
+        approval('a1', 3, 'resolved', 'child-1')
+      ],
+      accepted
+    )
+    h.observe()
+    expect(h.outcomes()).toEqual([['t1', 'success']])
+  })
+
+  it('notifies a refused send once while a prompt is pending', () => {
+    const h = harness()
+    h.listen()
+    const prompt = approval('a1', 1, 'pending', 'child-1')
+    h.setJournal([prompt, userEntry('m1', 2)], [pending('m1')])
+    h.observe()
+    h.setJournal([prompt, userEntry('m1', 2)], [refused('m1')])
+    h.observe()
+    expect(h.outcomes()).toEqual([[M1, 'failure']])
+    expect(h.awaitingUser()).toEqual([true])
+    h.setJournal([approval('a1', 1, 'resolved', 'child-1'), userEntry('m1', 2)], [refused('m1')])
+    h.observe()
+    expect(h.outcomes()).toEqual([[M1, 'failure']])
+  })
+
+  it('sends nothing while the main turn asks for permission, and one event when it settles', () => {
+    const h = harness()
+    h.listen()
+    const user = userEntry('m1', 1)
+    const accepted = [sent('m1', { dispatchState: 'accepted' })]
+    h.setJournal([user, turnItem(turn('t1', 'running'), 2)], accepted)
+    h.observe()
+    h.setJournal([user, turnItem(turn('t1', 'running'), 2), approval('a1', 3, 'pending')], accepted)
+    h.observe()
+    expect(h.events).toEqual([])
+    h.setJournal(
+      [user, turnItem(turn('t1', 'running'), 2), approval('a1', 3, 'resolved')],
+      accepted
+    )
+    h.observe()
+    h.setJournal(
+      [user, turnItem(turn('t1', 'completed', 'success'), 2), approval('a1', 3, 'resolved')],
+      accepted
+    )
+    h.observe()
+    expect(h.outcomes()).toEqual([['t1', 'success']])
+    // Idle when it settles: the prompt was already answered.
+    expect(h.awaitingUser()).toEqual([false])
+  })
+
+  it('still waits on a queued send the prompt hides, so the queue notifies once', () => {
+    const h = harness()
+    h.listen()
+    const prompt = approval('a1', 3, 'pending', 'child-1')
+    const items = [userEntry('m1', 1), turnItem(turn('t1', 'running'), 2), prompt]
+    const queued = sent('m2', { dispatchState: 'pending', resolvedAt: null })
+    const accepted = sent('m1', { dispatchState: 'accepted' })
+    h.setJournal([...items, userEntry('m2', 4)], [accepted, queued])
+    h.observe()
+    h.setJournal(
+      [
+        userEntry('m1', 1),
+        turnItem(turn('t1', 'completed', 'success'), 2),
+        prompt,
+        userEntry('m2', 4)
+      ],
+      [accepted, queued]
+    )
+    h.observe()
+    expect(h.events).toEqual([])
+  })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-turn-completion-feed.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-turn-completion-feed.ts
index 1281fbec49b..ca9f64c0573 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-turn-completion-feed.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-turn-completion-feed.ts
@@ -1,4 +1,5 @@
-// The host's answer to "a turn just finished", derived once per journal commit.
+// The host's answer to "a request just finished", derived once per journal commit. A request is
+// the one the status row reports: a turn, or a send the agent or its start refused.
 //
 // WHY THE HOST DERIVES IT: a structured session runs on the execution host and keeps journalling
 // whether or not any renderer has a reader mounted. A client that derived completions itself would
@@ -10,41 +11,45 @@
 // needs, a completion is an edge that has already passed. Keeping a queue would create a durable
 // obligation with nothing to retire it.
 
-import type { AgentJournalTurnLifecycle } from '../../../shared/agent-session-journal-types'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
-import { readAgentJournalTurnOutcome } from '../../../shared/agent-session-turn-record'
 import type {
   AgentSessionTurnCompletion,
   AgentSessionTurnCompletionEvent
 } from '../../../shared/agent-session-wire'
+import type { StructuredAgentSessionLatestRequest } from '../../../shared/structured-agent-session-latest-request'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import type { StructuredAgentSessionStatusState } from './structured-agent-session-status-feed'
 
 export type StructuredAgentSessionTurnCompletionSubscriber = {
   id: string
   emit: (event: AgentSessionTurnCompletionEvent) => void
 }
 
-/** Only the newest-turn reader and cursor are needed here; asking for the whole journal would overstate it. */
 type CompletionFeedCursor = { epoch: string; sequence: number }
 
-type CompletionFeedJournal = Pick<AgentSessionJournal, 'newestTurn' | 'cursor'>
-
 type CompletionFeedSession = {
-  journal: CompletionFeedJournal
+  journal: Pick<AgentSessionJournal, 'cursor'>
   params: { location: AgentSessionRecord['location'] }
 }
 
 export type StructuredAgentSessionTurnCompletionFeedDeps = {
   sessions: ReadonlyMap<string, CompletionFeedSession>
   now: () => number
+  /** The status feed's projection for this commit, so the event follows the request its row reports. */
+  readStatusState: (
+    sessionId: string,
+    journal?: AgentSessionJournal
+  ) => StructuredAgentSessionStatusState | null
 }
 
-/** Per-session baseline. `settledTurnId` is the last settled turn this feed has accounted for;
- *  absence of the whole entry — not a null field — is what makes the first observation silent. */
-type SessionBaseline = CompletionFeedCursor & { settledTurnId: string | null }
+type RequestMark = Pick<StructuredAgentSessionLatestRequest, 'kind' | 'id'>
 
-function isSettled(turn: AgentJournalTurnLifecycle | null): turn is AgentJournalTurnLifecycle {
-  return turn !== null && turn.state !== 'running'
+/** Per-session baseline. `settled` is the last settled request this feed has accounted for;
+ *  absence of the whole entry — not a null field — is what makes the first observation silent. */
+type SessionBaseline = CompletionFeedCursor & { settled: RequestMark | null }
+
+function settledMark(request: StructuredAgentSessionLatestRequest | null): RequestMark | null {
+  return request && !request.running ? { kind: request.kind, id: request.id } : null
 }
 
 export class StructuredAgentSessionTurnCompletionFeed {
@@ -80,29 +85,24 @@ export class StructuredAgentSessionTurnCompletionFeed {
 
   /**
    * One journal publication. Emits at most one completion, and only on the transition into a
-   * settled turn this feed has not already accounted for.
+   * settled request this feed has not already accounted for.
    *
    * The first observation of a session only records where it is, so restore, restart, rewind and
-   * a re-read of history all pass through silently. An already-settled turn republished by an
-   * in-place revision carries the same turn id and so cannot fire twice.
+   * a re-read of history all pass through silently. An already-settled request republished by an
+   * in-place revision carries the same identity and so cannot fire twice.
    */
-  observe(sessionId: string, journal?: CompletionFeedJournal): void {
+  observe(sessionId: string, journal?: AgentSessionJournal): void {
     const session = this.deps.sessions.get(sessionId)
-    if (!session) {
+    const state = session ? this.deps.readStatusState(sessionId, journal) : null
+    if (!session || !state) {
       return
     }
-    const source = journal ?? session.journal
-    const cursor = source.cursor()
-    const turn = source.newestTurn()
-    const settled = isSettled(turn) ? turn : null
+    const cursor = (journal ?? session.journal).cursor()
+    const request = state.latestRequest
     const baseline = this.baselines.get(sessionId)
     if (!baseline) {
       // Baseline only. Whatever the session was already holding is history, not news.
-      this.baselines.set(sessionId, {
-        epoch: cursor.epoch,
-        sequence: cursor.sequence,
-        settledTurnId: settled?.turnId ?? null
-      })
+      this.baselines.set(sessionId, { ...cursor, settled: settledMark(request) })
       return
     }
     if (baseline.epoch !== cursor.epoch || cursor.sequence < baseline.sequence) {
@@ -111,24 +111,31 @@ export class StructuredAgentSessionTurnCompletionFeed {
       // newest settled row as a fresh completion.
       baseline.epoch = cursor.epoch
       baseline.sequence = cursor.sequence
-      baseline.settledTurnId = settled?.turnId ?? null
+      baseline.settled = settledMark(request)
       return
     }
     baseline.sequence = cursor.sequence
-    if (!settled) {
+    if (request?.running) {
       // A running turn clears the mark, so this detector fires on each running → settled
       // transition rather than on an id it happens not to have seen.
-      baseline.settledTurnId = null
+      baseline.settled = null
       return
     }
-    if (baseline.settledTurnId === settled.turnId) {
+    // Owed work waits, so sends refused one commit at a time announce once, when the last is
+    // answered. A pending prompt does not wait (structured chat has no other attention producer):
+    // the event says so itself, and answering it keeps the same identity.
+    // A withdrawn send leaves the older request latest.
+    if (
+      state.owesWork ||
+      !request ||
+      (baseline.settled?.kind === request.kind && baseline.settled.id === request.id)
+    ) {
       return
     }
-    baseline.settledTurnId = settled.turnId
+    baseline.settled = settledMark(request)
     // ABSENT OUTCOME IS UNKNOWN: a turn the host only saw stop carries no verdict and gets no
     // event. Inferring success here is the one mistake that would light the dot on a failure.
-    const outcome = readAgentJournalTurnOutcome(settled)
-    if (!outcome) {
+    if (!request.outcome) {
       return
     }
     this.broadcast({
@@ -136,9 +143,11 @@ export class StructuredAgentSessionTurnCompletionFeed {
       completion: {
         scope: session.params.location,
         sessionId,
-        turnId: settled.turnId,
-        outcome,
-        completedAt: this.deps.now()
+        turnId: request.id,
+        outcome: request.outcome,
+        completedAt: this.deps.now(),
+        // Stated here, not joined from the status stream: remote clients receive the two unordered.
+        ...(state.summary.status === 'attention' ? { awaitingUser: true } : {})
       }
     })
   }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-turns-cancel.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-turns-cancel.ts
new file mode 100644
index 00000000000..4bd5b412300
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-turns-cancel.ts
@@ -0,0 +1,125 @@
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
+import type { AgentJournalStatusItem } from '../../../shared/agent-session-journal-types'
+import type { AgentSessionCancelResult } from '../../../shared/agent-session-wire'
+import { latestJournalDispatchObservation } from '../agent-session-journal/journal-dispatch-observation'
+import type { AgentSessionCancelOutcome } from './structured-agent-session-adapter'
+import {
+  isStructuredAgentSessionCommandTurnId,
+  structuredAgentSessionCommandWasStopped,
+  structuredAgentSessionStopNoteIdentity
+} from './structured-agent-session-command-turn'
+import { validatePendingPrompt } from './structured-agent-session-prompt-state'
+import type { AgentSessionTurnContext, TurnOutcome } from './structured-agent-session-turns'
+
+export async function performCancel(
+  ctx: AgentSessionTurnContext,
+  input: {
+    clientOperationId: string
+    /** Absent: whatever the conversation has in flight; present: only while that turn is current. */
+    turnId?: string
+    scope?: 'background-tasks'
+    taskId?: string
+    prompt?: { itemId: string; expectedRevision: number }
+    /** Ends the provider child, for a running command the provider did not take the Stop on. */
+    stopChild?: () => Promise<void>
+  }
+): Promise<TurnOutcome<AgentSessionCancelResult>> {
+  if (input.prompt) {
+    const validated = validatePendingPrompt(ctx, input.prompt)
+    if (!validated.ok) {
+      return validated
+    }
+  }
+  let cancelled = false
+  let note: AgentJournalStatusItem | null = { kind: 'status', text: 'Cancellation requested.' }
+  // The turn the Stop names, read before the cancel settles it: the note reports on that turn.
+  const turnScope = ctx.journal.liveTurnScope()
+  // Only the provider's end or the child's ends a command. A command the provider has not opened a
+  // turn for, would not interrupt, or was already asked to stop, ends with its child; that child's
+  // dead-generation settlement writes the command's verdict.
+  const liveTurnId = ctx.journal.activeTurnId()
+  const runningCommand =
+    input.stopChild !== undefined &&
+    liveTurnId !== null &&
+    isStructuredAgentSessionCommandTurnId(liveTurnId) &&
+    (input.turnId === undefined || input.turnId === liveTurnId)
+  const stoppedBefore =
+    runningCommand && structuredAgentSessionCommandWasStopped(ctx.journal, liveTurnId)
+  try {
+    const dispatchStatus = latestJournalDispatchObservation(ctx.journal, ctx.fence)
+    const outcome: AgentSessionCancelOutcome = stoppedBefore
+      ? { cancelled: false }
+      : input.scope
+        ? {
+            cancelled:
+              (
+                await ctx.adapter.stopBackgroundTasks?.({
+                  sessionId: ctx.sessionId,
+                  fence: ctx.fence,
+                  ...(input.taskId ? { taskId: input.taskId } : {})
+                })
+              )?.cancelled === true
+          }
+        : await ctx.adapter.cancelTurn({
+            sessionId: ctx.sessionId,
+            ...(input.turnId !== undefined ? { turnId: input.turnId } : {}),
+            fence: ctx.fence,
+            // The journal is what the client read to name a turn, so it is what judges the request.
+            resolveLiveTurnId: () => ctx.journal.activeTurnId(),
+            ...(dispatchStatus ? { dispatchStatus } : {}),
+            ...(input.prompt ? { prompt: { itemId: input.prompt.itemId } } : {})
+          })
+    cancelled = outcome.cancelled
+    if (!cancelled && input.turnId !== undefined) {
+      note = { kind: 'status', text: 'The provider had already finished this turn.' }
+    } else if (!cancelled && input.prompt) {
+      note = null
+    } else if (!cancelled && outcome.unconfirmed) {
+      note = {
+        kind: 'status',
+        ...agentSessionFailureWords(agentSessionFailureFact('cancelUnconfirmed'), {
+          surface: 'row'
+        })
+      }
+    } else if (!cancelled) {
+      // Sent only while the chat reads working, so a Stop that ended nothing must say why.
+      const detail = outcome.refusal?.detail
+      note = {
+        kind: 'status',
+        ...agentSessionFailureWords(
+          agentSessionFailureFact('stopRefused', detail ? { detail } : {}),
+          { ...ctx.failureTextContext, surface: 'row' }
+        )
+      }
+    }
+  } catch (error) {
+    if (input.prompt) {
+      throw error
+    }
+    // The adapter's error is Orca's; the row says only that the stop is unconfirmed.
+    note = {
+      kind: 'status',
+      ...agentSessionFailureWords(agentSessionFailureFact('cancelUnconfirmed'), { surface: 'row' })
+    }
+  }
+  if (runningCommand && !cancelled) {
+    await input.stopChild?.()
+    cancelled = true
+    note = { kind: 'status', text: 'Cancellation requested.' }
+  }
+  if (cancelled && input.prompt) {
+    await ctx.flushStreamedEvents()
+  }
+  const value = { ...(input.turnId !== undefined ? { turnId: input.turnId } : {}), cancelled }
+  if (input.scope || note === null) {
+    return { ok: true, value }
+  }
+  // Keyed by the operation id so a replayed cancel upserts one item, not two.
+  await ctx.journal.appendItem(
+    structuredAgentSessionStopNoteIdentity(input.clientOperationId),
+    note,
+    { fence: ctx.fence, turnScope }
+  )
+  return { ok: true, value }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-turns-options.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-turns-options.ts
index cb1685405a1..9230e56cbe8 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-turns-options.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-turns-options.ts
@@ -1,4 +1,4 @@
-import type { AgentSessionOptionResult } from '../../../shared/agent-session-wire'
+import { refuse, type AgentSessionOptionResult } from '../../../shared/agent-session-wire'
 import { isAgentSessionOptionRejectedError } from './structured-agent-session-option-error'
 import type { AgentSessionTurnContext, TurnOutcome } from './structured-agent-session-turns'
 
@@ -17,7 +17,11 @@ export async function performSetOption(
     if (isAgentSessionOptionRejectedError(error)) {
       return {
         ok: false,
-        refusal: { code: 'agent_session_operation_invalid', message: error.message }
+        refusal: refuse(
+          'agent_session_operation_invalid',
+          { reason: error.refusalReason },
+          error.message
+        )
       }
     }
     throw error
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-turns-prompt.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-turns-prompt.ts
index 6ac29cab0ab..370dd12500d 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-turns-prompt.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-turns-prompt.ts
@@ -1,59 +1,103 @@
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
 import { parseAgentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
 import {
-  decodeAgentSessionQuestionAnswers,
-  isValidAgentSessionQuestionAnswers
+  agentSessionPromptQuestions,
+  isValidAgentSessionQuestionAnswers,
+  legacyAgentSessionQuestionAnswers,
+  legacyAgentSessionSelectedOptionId,
+  type AgentSessionPromptResponse,
+  type AgentSessionQuestionAnswer
 } from '../../../shared/agent-session-question-answer'
-import type { AgentJournalResolution } from '../../../shared/agent-session-journal-types'
-import type { AgentSessionPromptResult } from '../../../shared/agent-session-wire'
-import { decodeCodexQuestionOptionId } from '../../codex/codex-structured-prompt-replies'
-import { AgentSessionPromptUnavailableError } from './structured-agent-session-adapter'
+import type {
+  AgentJournalApprovalItem,
+  AgentJournalQuestionItem,
+  AgentJournalResolution
+} from '../../../shared/agent-session-journal-types'
+import {
+  refuse,
+  type AgentSessionPromptResult,
+  type AgentSessionRefusalReason
+} from '../../../shared/agent-session-wire'
+import {
+  AgentSessionPromptAnswerRejectedError,
+  AgentSessionPromptUnavailableError
+} from './structured-agent-session-adapter'
 import { validatePendingPrompt } from './structured-agent-session-prompt-state'
 import type { AgentSessionTurnContext, TurnOutcome } from './structured-agent-session-turns'
 
-function invalid(message: string): TurnOutcome<never> {
-  return { ok: false, refusal: { code: 'agent_session_operation_invalid', message } }
+export type AgentSessionPromptRequest = {
+  itemId: string
+  expectedRevision: number
+  kind: 'approval' | 'question'
+  /** A decision id; or, from a client that predates `answers`, a question answer packed into one id. */
+  optionId?: string
+  answers?: AgentSessionQuestionAnswer[]
+}
+
+function invalid(
+  reason: AgentSessionRefusalReason<'agent_session_operation_invalid'>,
+  message: string
+): TurnOutcome<never> {
+  return { ok: false, refusal: refuse('agent_session_operation_invalid', { reason }, message) }
+}
+
+/** The one place a client's choice is read; an answer an older client packed into `optionId` is unpacked here, once. */
+function readPromptChoice(
+  prompt: AgentJournalApprovalItem | AgentJournalQuestionItem,
+  input: AgentSessionPromptRequest
+): { response: AgentSessionPromptResponse; selectedOptionId: string } | null {
+  if (prompt.kind === 'approval') {
+    const optionId = input.optionId
+    return optionId !== undefined && prompt.options.some((option) => option.id === optionId)
+      ? { response: { kind: 'option', optionId }, selectedOptionId: optionId }
+      : null
+  }
+  const answers =
+    input.answers ??
+    (input.optionId === undefined
+      ? null
+      : legacyAgentSessionQuestionAnswers(prompt, input.optionId))
+  if (
+    !answers ||
+    !isValidAgentSessionQuestionAnswers(agentSessionPromptQuestions(prompt), answers)
+  ) {
+    return null
+  }
+  const selectedOptionId = legacyAgentSessionSelectedOptionId(prompt, answers)
+  return selectedOptionId === null
+    ? null
+    : { response: { kind: 'answers', answers }, selectedOptionId }
 }
 
 export async function performPrompt(
   ctx: AgentSessionTurnContext,
-  input: {
-    itemId: string
-    expectedRevision: number
-    optionId: string
-    kind: 'approval' | 'question'
-  }
+  input: AgentSessionPromptRequest
 ): Promise<TurnOutcome<AgentSessionPromptResult>> {
   const validated = validatePendingPrompt(ctx, input)
   if (!validated.ok) {
     return validated
   }
   const { prompt } = validated
-  const question = prompt.kind === 'question' ? prompt : null
-  const freeText = decodeCodexQuestionOptionId(input.optionId)
-  const acceptsFreeText =
-    question?.freeTextQuestionId !== undefined &&
-    freeText?.questionId === question.freeTextQuestionId &&
-    freeText.answer.trim().length > 0
-  const grouped = question?.questions ? decodeAgentSessionQuestionAnswers(input.optionId) : null
-  const acceptsGrouped =
-    grouped !== null &&
-    question?.questions !== undefined &&
-    isValidAgentSessionQuestionAnswers(question.questions, grouped)
-  if (
-    !acceptsFreeText &&
-    !acceptsGrouped &&
-    !prompt.options.some((option) => option.id === input.optionId)
-  ) {
-    return invalid(`Option ${input.optionId} is not offered by item ${input.itemId}.`)
+  const choice = readPromptChoice(prompt, input)
+  if (!choice) {
+    return invalid(
+      'optionRejected',
+      input.optionId !== undefined
+        ? `Option ${input.optionId} is not offered by item ${input.itemId}.`
+        : `The answers do not match the questions on item ${input.itemId}.`
+    )
   }
+  const { response } = choice
   const identity = parseAgentJournalItemKey(input.itemId)
   if (!identity) {
-    return invalid(`Item id ${input.itemId} is not a well-formed item key.`)
+    return invalid('requestMalformed', `Item id ${input.itemId} is not a well-formed item key.`)
   }
 
   const resolution: AgentJournalResolution = {
     state: 'resolved',
-    selectedOptionId: input.optionId,
+    selectedOptionId: choice.selectedOptionId,
+    ...(response.kind === 'answers' ? { answers: response.answers } : {}),
     resolvedBy: ctx.resolvedBy,
     resolvedAt: ctx.now()
   }
@@ -63,37 +107,38 @@ export async function performPrompt(
       sessionId: ctx.sessionId,
       itemId: input.itemId,
       kind: input.kind,
-      optionId: input.optionId,
+      response,
       fence: ctx.fence,
       commit: async () => {
         committed.item = await ctx.journal.appendItem(
           identity,
           { ...prompt, resolution },
-          {
-            fence: ctx.fence
-          }
+          // A revision: the prompt keeps the turn it was raised in.
+          { fence: ctx.fence, turnScope: ctx.journal.liveTurnScope() }
         )
-        ctx.publish()
       }
     })
   } catch (error) {
     if (!committed.item && error instanceof AgentSessionPromptUnavailableError) {
-      return invalid(error.message)
+      return invalid('promptGone', error.message)
+    }
+    if (!committed.item && error instanceof AgentSessionPromptAnswerRejectedError) {
+      return invalid('optionRejected', error.message)
     }
     if (!committed.item) {
       throw error
     }
+    // The adapter's error is Orca's; the row says only what the user needs to know.
     await ctx.journal.appendItem(
       { provider: 'orca', clientMessageId: `${input.itemId}#delivery` },
       {
         kind: 'status',
-        text: `Your answer was recorded but the agent did not confirm it: ${
-          error instanceof Error ? error.message : String(error)
-        }`
+        ...agentSessionFailureWords(agentSessionFailureFact('answerUnconfirmed'), {
+          surface: 'row'
+        })
       },
-      { fence: ctx.fence }
+      { fence: ctx.fence, turnScope: ctx.journal.liveTurnScope() }
     )
-    ctx.publish()
   }
   const appended = committed.item
   if (!appended) {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-turns.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-turns.test.ts
index 576743ebac4..302f6dd812f 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-turns.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-turns.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -43,7 +44,7 @@ describe('performCancel', () => {
         text: 'Agent is working…',
         turnLifecycle: { turnId: 'turn-1', state: 'running' }
       },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     const cancelTurn = vi.fn(async () => ({ cancelled: true }))
     const ctx: AgentSessionTurnContext = {
@@ -91,7 +92,7 @@ describe('performCancel', () => {
         text: 'Agent is working…',
         turnLifecycle: { turnId: 'turn-1', state: 'running' }
       },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     let resolveLiveTurnId: (() => string | null) | undefined
     const cancelTurn = vi.fn(
@@ -123,7 +124,7 @@ describe('performCancel', () => {
         text: 'Done.',
         turnLifecycle: { turnId: 'turn-1', state: 'completed' }
       },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     expect(resolveLiveTurnId?.()).toBeNull()
   })
@@ -143,7 +144,7 @@ describe('performCancel', () => {
         text: 'Agent is working…',
         turnLifecycle: { turnId: 'turn-1', state: 'running' }
       },
-      { fence: 1 }
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
     const ctx: AgentSessionTurnContext = {
       sessionId: 'session-1',
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts
index bea393eddbb..0ce27596966 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts
@@ -1,37 +1,43 @@
 // The effects behind send / cancel / respond / setOption.
 //
-// Admission (lease, fence, idempotency) has already passed by the time anything
+// Admission (writer lease, idempotency) has already passed by the time anything
 // here runs; these functions own only the journal writes and the adapter call,
 // in that order. Journal first is deliberate: a crash between the two leaves a
 // row the next attach settles as `unknown`, whereas the reverse would lose a
 // turn the provider already accepted.
 
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import {
+  agentSessionFailureWords,
+  type AgentSessionFailureWordsContext
+} from '../../../shared/agent-session-failure-words'
 import type {
   AgentJournalMessageItem,
   AgentJournalSubmission
 } from '../../../shared/agent-session-journal-types'
-import type {
-  AgentSessionCancelResult,
-  AgentSessionSendResult,
-  AgentSessionWireRefusal
+import {
+  refuse,
+  type AgentSessionRefusalReason,
+  type AgentSessionSendResult,
+  type AgentSessionWireRefusal
 } from '../../../shared/agent-session-wire'
 import { DISPATCH_DOUBT_PERSISTENCE_FAILED } from '../agent-session-journal/journal-dispatch-doubt-reasons'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import { latestJournalDispatchObservation } from '../agent-session-journal/journal-dispatch-observation'
 import type {
   AgentSessionDispatchOutcome,
   StructuredAgentSessionAdapter,
   StructuredAgentSessionProviderChildPhase
 } from './structured-agent-session-adapter'
-import { providerStartupFailureRejection } from './structured-agent-session-dead-generation-settlement'
-import { validatePendingPrompt } from './structured-agent-session-prompt-state'
-import { withTimeout } from '../../../shared/promise-timeout-fallback'
+import { structuredAgentSessionStartFailure } from './structured-agent-session-failure-text'
+import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
 import {
-  AgentSessionPreDispatchError,
-  AGENT_SESSION_ADMISSION_BARRIER_TIMEOUT_MS
-} from './structured-agent-session-operation-settlement'
+  handOverStructuredAgentSessionCommand,
+  structuredAgentSessionHandoverOrigin,
+  type StructuredAgentSessionCommandHandoverContext
+} from './structured-agent-session-command-turn'
 export { performSetOption } from './structured-agent-session-turns-options'
 export { performPrompt } from './structured-agent-session-turns-prompt'
+export { performCancel } from './structured-agent-session-turns-cancel'
 
 export type AgentSessionTurnContext = {
   sessionId: string
@@ -42,13 +48,15 @@ export type AgentSessionTurnContext = {
   persistOptions: (options: Readonly<Record<string, string>>) => Promise<void>
   /** Opaque client identity recorded as the resolver of a prompt. */
   resolvedBy: string
+  /** Republishes state kept outside the journal, such as the record's options or rewind phase.
+   *  Journal appends reach readers on their own. */
   publish: () => void
   /** Drains provider lifecycle already accepted by the execution host. */
   flushStreamedEvents: () => Promise<void>
-  /** Re-derives authorization after submission persistence, immediately before provider dispatch. */
-  beforeDispatch?: () => void
   /** What the host holds about the child this dispatch is for, read at the moment it is needed. */
   providerChildPhase?: () => StructuredAgentSessionProviderChildPhase | undefined
+  /** Who a Stop's refusal row names. */
+  failureTextContext?: AgentSessionFailureWordsContext
   now: () => number
 }
 
@@ -56,8 +64,11 @@ export type TurnOutcome<TValue> =
   | { ok: true; value: TValue }
   | { ok: false; refusal: AgentSessionWireRefusal }
 
-function invalid(message: string): { ok: false; refusal: AgentSessionWireRefusal } {
-  return { ok: false, refusal: { code: 'agent_session_operation_invalid', message } }
+function invalid(
+  reason: AgentSessionRefusalReason<'agent_session_operation_invalid'>,
+  message: string
+): { ok: false; refusal: AgentSessionWireRefusal } {
+  return { ok: false, refusal: refuse('agent_session_operation_invalid', { reason }, message) }
 }
 
 /** A thrown adapter error is indistinguishable from a lost reply, so it settles as `unknown`
@@ -65,10 +76,10 @@ function invalid(message: string): { ok: false; refusal: AgentSessionWireRefusal
  *  accepted nothing (input is written only after it initializes), so a dispatch it could not
  *  take is provably unwritten and is rejected with the cause the adapter gave. */
 async function dispatchSafely(
-  ctx: AgentSessionTurnContext,
+  ctx: AgentSessionHandoverContext,
   clientMessageId: string,
   body: AgentJournalMessageItem,
-  requestedAt: number | undefined
+  requestedAt: number
 ): Promise<AgentSessionDispatchOutcome> {
   try {
     return await ctx.adapter.dispatch({
@@ -76,33 +87,19 @@ async function dispatchSafely(
       clientMessageId,
       body,
       fence: ctx.fence,
-      ...(ctx.beforeDispatch ? { beforeDispatch: async () => ctx.beforeDispatch?.() } : {}),
-      ...(requestedAt === undefined ? {} : { requestedAt })
+      requestedAt
     })
   } catch (error) {
-    if (error instanceof AgentSessionPreDispatchError) {
-      throw error
-    }
     if (ctx.providerChildPhase?.() === 'starting') {
-      return { state: 'rejected', reason: providerStartupFailureRejection(error) }
+      return {
+        state: 'rejected',
+        ...structuredAgentSessionStartFailure({ error }, ctx.failureTextContext)
+      }
     }
     return { state: 'unknown', reason: error instanceof Error ? error.message : String(error) }
   }
 }
 
-async function appendStatus(
-  ctx: AgentSessionTurnContext,
-  clientMessageId: string,
-  text: string
-): Promise<void> {
-  await ctx.journal.appendItem(
-    { provider: 'orca', clientMessageId },
-    { kind: 'status', text },
-    { fence: ctx.fence }
-  )
-  ctx.publish()
-}
-
 /**
  * One id, one delivery. A submission that already exists replays its recorded
  * outcome and NEVER goes back on the wire, whatever state it is in and whatever
@@ -110,6 +107,8 @@ async function appendStatus(
  * the whole content of the word — and one message reached the model five times
  * when this was a judgement call instead of an invariant. A distinct send after
  * a terminal rejection uses a fresh id, which is a first delivery.
+ *
+ * Accepting only records the message; the session's delivery loop hands it over.
  */
 export async function performSend(
   ctx: AgentSessionTurnContext,
@@ -117,13 +116,18 @@ export async function performSend(
     clientMessageId: string
     payloadFingerprint: string
     body: AgentJournalMessageItem
+    /** Who asked for the turn; absent on callers that predate it. */
+    origin?: 'client' | 'host'
   }
 ): Promise<TurnOutcome<AgentSessionSendResult>> {
   const existing = ctx.journal
     .submissions()
     .find((entry) => entry.clientMessageId === input.clientMessageId)
   if (existing && existing.payloadFingerprint !== input.payloadFingerprint) {
-    return invalid(`Message id ${input.clientMessageId} was already used for another send.`)
+    return invalid(
+      'messageIdReused',
+      `Message id ${input.clientMessageId} was already used for another send.`
+    )
   }
   if (existing) {
     return {
@@ -132,84 +136,10 @@ export async function performSend(
     }
   }
   try {
-    await ctx.journal.appendSubmission({ ...input, fence: ctx.fence })
+    await ctx.journal.appendSubmission({ ...input, fence: ctx.fence, handoverRecorded: true })
   } catch {
-    return invalid('The message could not be recorded and was not sent.')
+    return invalid('journalWriteFailed', 'The message could not be recorded and was not sent.')
   }
-  ctx.publish()
-
-  // The row just written is the send's instant on the host clock; the turn this
-  // dispatch opens records it so the live counter never re-anchors at turn-open.
-  const requestedAt = ctx.journal
-    .submissions()
-    .find((entry) => entry.clientMessageId === input.clientMessageId)?.submittedAt
-  const outcome = await dispatchSafely(ctx, input.clientMessageId, input.body, requestedAt).catch(
-    async (error: unknown) => {
-      if (error instanceof AgentSessionPreDispatchError) {
-        const recorded = await withTimeout(
-          ctx.journal
-            .resolveDispatch({
-              clientMessageId: input.clientMessageId,
-              state: 'rejected',
-              reason: error.message,
-              fence: ctx.fence
-            })
-            .then(() => true),
-          AGENT_SESSION_ADMISSION_BARRIER_TIMEOUT_MS,
-          false
-        )
-        if (!recorded) {
-          console.warn('[structured-agent-session] pre-dispatch refusal persistence failed')
-        }
-        ctx.publish()
-      }
-      throw error
-    }
-  )
-  // An admission needs no dispatch row: the submission is already pending.
-  if (outcome.state === 'admitted') {
-    ctx.publish()
-    return {
-      ok: true,
-      value: {
-        clientMessageId: input.clientMessageId,
-        submission: requireSubmission(ctx, input.clientMessageId)
-      }
-    }
-  }
-  try {
-    await ctx.journal.resolveDispatch(
-      outcome.state === 'accepted'
-        ? {
-            clientMessageId: input.clientMessageId,
-            state: 'accepted',
-            providerIdentity: outcome.providerIdentity,
-            fence: ctx.fence
-          }
-        : {
-            clientMessageId: input.clientMessageId,
-            state: outcome.state,
-            reason: outcome.reason,
-            fence: ctx.fence
-          }
-    )
-  } catch (error) {
-    // A failed resolution must not strand a pending row; an unknown result is
-    // explicitly replayable.
-    try {
-      await ctx.journal.resolveDispatch({
-        clientMessageId: input.clientMessageId,
-        state: 'unknown',
-        reason: DISPATCH_DOUBT_PERSISTENCE_FAILED,
-        fence: ctx.fence
-      })
-    } catch {
-      // Nothing further to record; the pending row is settled on the next attach.
-    }
-    ctx.publish()
-    throw error
-  }
-  ctx.publish()
   return {
     ok: true,
     value: {
@@ -219,6 +149,86 @@ export async function performSend(
   }
 }
 
+export type AgentSessionHandoverContext = StructuredAgentSessionCommandHandoverContext
+
+/**
+ * Hands one queued submission to the provider. The `dispatch{pending}` row goes first: a crash
+ * after it leaves a message in doubt, never one that reads as queued and so provably unwritten.
+ */
+export async function handOverSubmission(
+  ctx: AgentSessionHandoverContext,
+  submission: AgentJournalSubmission
+): Promise<void> {
+  const { clientMessageId } = submission
+  const body = ctx.journal.itemBody(agentJournalSubmissionKey(clientMessageId))
+  if (body?.kind !== 'message') {
+    await ctx.journal.resolveDispatch({
+      clientMessageId,
+      state: 'rejected',
+      ...agentSessionFailureWords(agentSessionFailureFact('hostFault'), { surface: 'rejection' }),
+      fence: ctx.fence
+    })
+    return
+  }
+  if (body.command) {
+    await handOverStructuredAgentSessionCommand(ctx, submission, body)
+    return
+  }
+  // The message joins the turn running at handover, a steer, or opens its own.
+  await ctx.journal.resolveDispatch({
+    clientMessageId,
+    state: 'pending',
+    fence: ctx.fence,
+    turnScope: ctx.journal.liveTurnScope()
+  })
+  // The handover row's instant on the host clock; the turn this dispatch opens records it so the
+  // live counter never re-anchors at turn-open.
+  const outcome = await dispatchSafely(
+    ctx,
+    clientMessageId,
+    body,
+    structuredAgentSessionHandoverOrigin(ctx.journal, submission)
+  )
+  // An admission needs no dispatch row: the submission is already pending.
+  if (outcome.state === 'admitted') {
+    return
+  }
+  try {
+    await ctx.journal.resolveDispatch(
+      outcome.state === 'accepted'
+        ? {
+            clientMessageId,
+            state: 'accepted',
+            providerIdentity: outcome.providerIdentity,
+            fence: ctx.fence
+          }
+        : outcome.state === 'rejected'
+          ? {
+              clientMessageId,
+              state: 'rejected',
+              reason: outcome.reason,
+              rejection: outcome.rejection,
+              fence: ctx.fence
+            }
+          : { clientMessageId, state: 'unknown', reason: outcome.reason, fence: ctx.fence }
+    )
+  } catch (error) {
+    // A failed resolution must not strand a pending row; an unknown result is
+    // explicitly replayable.
+    try {
+      await ctx.journal.resolveDispatch({
+        clientMessageId,
+        state: 'unknown',
+        reason: DISPATCH_DOUBT_PERSISTENCE_FAILED,
+        fence: ctx.fence
+      })
+    } catch {
+      // Nothing further to record; the pending row is settled on the next open.
+    }
+    throw error
+  }
+}
+
 function requireSubmission(
   ctx: AgentSessionTurnContext,
   clientMessageId: string
@@ -231,64 +241,3 @@ function requireSubmission(
   }
   return submission
 }
-
-export async function performCancel(
-  ctx: AgentSessionTurnContext,
-  input: {
-    clientOperationId: string
-    turnId: string
-    scope?: 'background-tasks'
-    taskId?: string
-    prompt?: { itemId: string; expectedRevision: number }
-  }
-): Promise<TurnOutcome<AgentSessionCancelResult>> {
-  if (input.prompt) {
-    const validated = validatePendingPrompt(ctx, input.prompt)
-    if (!validated.ok) {
-      return validated
-    }
-  }
-  let cancelled = false
-  let note = 'Cancellation requested.'
-  try {
-    const dispatchStatus = latestJournalDispatchObservation(ctx.journal, ctx.fence)
-    cancelled = input.scope
-      ? (
-          await ctx.adapter.stopBackgroundTasks?.({
-            sessionId: ctx.sessionId,
-            fence: ctx.fence,
-            ...(input.taskId ? { taskId: input.taskId } : {})
-          })
-        )?.cancelled === true
-      : (
-          await ctx.adapter.cancelTurn({
-            sessionId: ctx.sessionId,
-            turnId: input.turnId,
-            fence: ctx.fence,
-            // The journal is what the client read to name a turn, so it is what judges the request.
-            resolveLiveTurnId: () => ctx.journal.activeTurnId(),
-            ...(dispatchStatus ? { dispatchStatus } : {}),
-            ...(input.prompt ? { prompt: { itemId: input.prompt.itemId } } : {})
-          })
-        ).cancelled
-    if (!cancelled) {
-      note = 'The provider had already finished this turn.'
-    }
-  } catch (error) {
-    if (input.prompt) {
-      throw error
-    }
-    note = `Cancellation was not confirmed: ${
-      error instanceof Error ? error.message : String(error)
-    }`
-  }
-  if (cancelled && input.prompt) {
-    await ctx.flushStreamedEvents()
-  }
-  if (input.scope) {
-    return { ok: true, value: { turnId: input.turnId, cancelled } }
-  }
-  // Keyed by the operation id so a replayed cancel upserts one item, not two.
-  await appendStatus(ctx, input.clientOperationId, note)
-  return { ok: true, value: { turnId: input.turnId, cancelled } }
-}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-unanswered-dispatch-release.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-unanswered-dispatch-release.test.ts
index fc8440500a4..9a27415dc71 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-unanswered-dispatch-release.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-unanswered-dispatch-release.test.ts
@@ -1,7 +1,7 @@
 import { describe, expect, it, vi } from 'vitest'
 import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
 import { projectStructuredAgentSessionStatus } from '../../../shared/structured-agent-session-projection'
-import { releaseStructuredAgentSessionUnansweredDispatches } from './structured-agent-session-host-mutations'
+import { releaseStructuredAgentSessionUnansweredDispatches } from './structured-agent-session-unanswered-dispatch-release'
 
 const FENCE = 7
 
@@ -32,12 +32,13 @@ function contextWith(submissions: AgentJournalSubmission[]) {
       return { epoch: 'e', sequence: 1 }
     })
   }
-  // The mutation reads only `journal.submissions`, `journal.resolveDispatch` and `fence`.
-  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: all three are supplied here; the rest of the host session is unreachable from this mutation.
-  const session = { journal, fence: FENCE } as unknown as ReleaseSession
-  const publish = vi.fn()
-  const context: ReleaseContext = { sessions: new Map([['s-1', session]]), publish }
-  return { context, resolved, publish, journal }
+  // The mutation reads only `journal.submissions`, `journal.resolveDispatch` and the record fence.
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: all three are supplied here; the rest of the session and the record is unreachable from this mutation.
+  const context = {
+    sessions: new Map([['s-1', { journal }]]),
+    deps: { store: { getRecord: () => ({ lease: { runtimeFence: FENCE } }) } }
+  } as unknown as ReleaseContext
+  return { context, resolved, journal }
 }
 
 describe('releasing dispatches the provider can no longer answer', () => {
@@ -45,7 +46,7 @@ describe('releasing dispatches the provider can no longer answer', () => {
     const live = [submission({})]
     // POSITIVE CONTROL: this is the latch being dissolved.
     expect(projectStructuredAgentSessionStatus([], live, FENCE)).toBe('working')
-    const { context, resolved, publish } = contextWith(live)
+    const { context, resolved } = contextWith(live)
 
     await releaseStructuredAgentSessionUnansweredDispatches(context, {
       sessionId: 's-1',
@@ -62,14 +63,13 @@ describe('releasing dispatches the provider can no longer answer', () => {
         recovered: true
       }
     ])
-    expect(publish).toHaveBeenCalledOnce()
     expect(projectStructuredAgentSessionStatus([], [submission({ recovered: true })], FENCE)).toBe(
       'idle'
     )
   })
 
   it('never touches a pending send, whose dispatch may still be in flight', async () => {
-    const { context, resolved, publish } = contextWith([
+    const { context, resolved } = contextWith([
       submission({ clientMessageId: 'm-2', dispatchState: 'pending', reason: null })
     ])
 
@@ -79,7 +79,6 @@ describe('releasing dispatches the provider can no longer answer', () => {
     })
 
     expect(resolved).toEqual([])
-    expect(publish).not.toHaveBeenCalled()
   })
 
   it('leaves an already recovered unknown alone', async () => {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-unanswered-dispatch-release.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-unanswered-dispatch-release.ts
new file mode 100644
index 00000000000..713838c177e
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-unanswered-dispatch-release.ts
@@ -0,0 +1,43 @@
+import { structuredAgentSessionConversationFence } from './structured-agent-session-provider-child'
+import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
+import type { StructuredAgentSessionMutationContext } from './structured-agent-session-host-mutations'
+
+/**
+ * Releases sends the provider can no longer be holding.
+ *
+ * A dispatch whose RPC timed out is recorded `unknown` — doubt, never proof of
+ * non-delivery — and a live `unknown` reads as work still owed, so the session
+ * shows working until something re-derives it. The provider reporting its thread
+ * not running, with no turn open, IS that re-derivation.
+ *
+ * `pending` is deliberately untouched: that send's dispatch has not returned yet
+ * and may be in flight right now. And `recovered` only retires the obligation —
+ * it never makes a send re-deliverable, because the provider may well have run it.
+ */
+export async function releaseStructuredAgentSessionUnansweredDispatches(
+  context: Pick<StructuredAgentSessionMutationContext, 'sessions'> & {
+    deps: { store: Pick<StructuredAgentSessionHostDeps['store'], 'getRecord'> }
+  },
+  input: { sessionId: string; reason: string }
+): Promise<void> {
+  const session = context.sessions.get(input.sessionId)
+  if (!session) {
+    return
+  }
+  const stranded = session.journal
+    .submissions()
+    .filter((entry) => entry.dispatchState === 'unknown' && entry.recovered !== true)
+  if (stranded.length === 0) {
+    return
+  }
+  for (const entry of stranded) {
+    await session.journal.resolveDispatch({
+      clientMessageId: entry.clientMessageId,
+      state: 'unknown',
+      // The earlier reason names a sharper fact than this one does.
+      reason: entry.reason ?? input.reason,
+      fence: structuredAgentSessionConversationFence(context.deps.store, input.sessionId),
+      recovered: true
+    })
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts
index 4ba1a93169b..2cb38a46634 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts
@@ -7,50 +7,19 @@ import {
   agentSessionRecordFixture
 } from '../../../shared/agent-session-record.test-fixture'
 import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
-import { unexpectedProviderExitOutcome } from './structured-agent-session-dead-generation-settlement'
-import { retryLoadedStructuredAgentSessionSettlement } from './structured-agent-session-settlement-retry'
+import { settleStaleStructuredAgentSessionState } from './structured-agent-session-dead-generation-settlement'
 import {
-  isStructuredAgentSessionRecoveryTicketCurrent,
   settleUnexpectedStructuredAgentSessionExit,
   type StructuredAgentSessionUnexpectedExitContext,
-  type StructuredAgentSessionUnexpectedExitSession,
-  type StructuredAgentSessionRecoveryTicket
+  type StructuredAgentSessionUnexpectedExitSession
 } from './structured-agent-session-unexpected-exit'
 
+const exitOutcome = (agent: string): string =>
+  `${agent} stopped while this response was in progress. You can continue in this conversation.`
+
 const SESSION = 'session-1'
 const GENERATION = 'generation-1'
 
-const ticket: StructuredAgentSessionRecoveryTicket = {
-  sessionId: SESSION,
-  releasedFence: 8,
-  deadAcquisitionGeneration: GENERATION,
-  stableSettlementId: 'settlement-1'
-}
-
-function recoveryContext(input: {
-  generation?: string
-  handoffStage?: AgentSessionRecord['lease']['handoffStage']
-  resumeCapable?: boolean
-}) {
-  const session = {
-    hasProviderChild: false,
-    fence: 8,
-    acquisitionGeneration: input.generation ?? GENERATION
-  } as StructuredAgentSessionHostSession
-  const record = {
-    lease: {
-      runtimeFence: 8,
-      claimStatus: 'released',
-      handoffStage: input.handoffStage ?? null
-    }
-  } as AgentSessionRecord
-  return {
-    sessions: new Map([[SESSION, session]]),
-    store: { getRecord: () => record },
-    hasResumeCapableHolder: () => input.resumeCapable ?? true
-  } as never
-}
-
 function lifecycleItem(
   turnId: string,
   sequence: number,
@@ -102,20 +71,12 @@ function mutableStore() {
   }
 }
 
-describe('provider-exit recovery tickets', () => {
-  it.each([undefined, 2_000])('keeps exit receipt %s on retry', async (observedAt) => {
+describe('provider-exit settlement', () => {
+  it.each([undefined, 2_000])('keeps exit receipt %s when settling fails', async (observedAt) => {
     let now = observedAt === undefined ? 2_000 : 30_000
-    let record = {
-      lease: {
-        handoffStage: null,
-        runtimeFence: 7,
-        runtimeKind: 'native',
-        claimStatus: 'live',
-        ownerProcess: 'provider',
-        reservedSpawnToken: null,
-        processlessAt: null
-      }
-    } as unknown as AgentSessionRecord
+    let record = agentSessionRecordFixture(
+      agentSessionLeaseFixture({ runtimeKind: 'native', reservedSpawnToken: null })
+    )
     const store = {
       getRecord: () => record,
       transitionHandoff: async (
@@ -127,14 +88,16 @@ describe('provider-exit recovery tickets', () => {
       .fn()
       .mockRejectedValueOnce(new Error('journal unavailable'))
       .mockResolvedValue({ epoch: 'epoch-1', sequence: 2 })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the exit reads only the child record and these journal methods; the rest of the session is unreachable from it.
     const session = {
-      hasProviderChild: true,
-      fence: 7,
-      acquisitionGeneration: GENERATION,
+      child: { generation: GENERATION, fence: 7, phase: 'ready' },
       journal: {
+        cursor: () => ({ epoch: 'epoch-1', sequence: 0 }),
+        itemBody: () => null,
         snapshot: () => ({
           items: [lifecycleItem('turn-1', 1, { state: 'running', startedAt: 1_000 })]
         }),
+        itemFence: () => 7,
         appendLifecycleBatch,
         markPendingSubmissionsUnknown: vi.fn(async () => [])
       }
@@ -149,7 +112,6 @@ describe('provider-exit recovery tickets', () => {
           return { ok: false, error: new Error('sink unavailable') }
         },
         publishFence: vi.fn(),
-        hasResumeCapableHolder: () => true,
         serialize: async (_sessionId, task) => task(),
         now: () => now
       } as never,
@@ -163,20 +125,23 @@ describe('provider-exit recovery tickets', () => {
         observedAt
       }
     )
-    expect(record.lease.settlementRetryRequired).toBe(true)
-    expect(record.lease.deathEvidence?.observedAt).toBe(2_000)
+    // Released, not latched: a later settle from this evidence finishes what this write left.
+    expect(record.lease).toMatchObject({
+      claimStatus: 'released',
+      handoffStage: null,
+      deathEvidence: { kind: 'exit-observed', detail: 'provider exited', observedAt: 2_000 }
+    })
     expect(record.lease.lastRenewedAt).toBe(60_000)
     expect(record.updatedAt).toBe(60_000)
 
     now = 120_000
-    await expect(
-      retryLoadedStructuredAgentSessionSettlement({
-        deps: { store } as never,
-        sessionId: SESSION,
-        session: { journal: session.journal, fence: 8, acquisitionGeneration: null },
-        now: () => now
-      })
-    ).resolves.toBe(true)
+    await settleStaleStructuredAgentSessionState({
+      journal: session.journal,
+      sessionId: SESSION,
+      fence: 8,
+      acquisitionGeneration: 'generation-2',
+      deathEvidence: record.lease.deathEvidence
+    })
     expect(appendLifecycleBatch.mock.calls.at(-1)?.[0].mutations).toContainEqual(
       expect.objectContaining({
         body: {
@@ -188,7 +153,6 @@ describe('provider-exit recovery tickets', () => {
         }
       })
     )
-    expect(record.lease.settlementRetryRequired).toBeUndefined()
   })
 
   it('uses the fallback when the one-shot translator admission was rejected, revising the running turn in place', async () => {
@@ -197,11 +161,12 @@ describe('provider-exit recovery tickets', () => {
       lifecycleItem('turn-1', 1, { state: 'completed', startedAt: 10, completedAt: 20 }),
       lifecycleItem('turn-2', 2, { state: 'running', startedAt: 30 })
     ]
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the exit reads only the child record and these journal methods; the rest of the session is unreachable from it.
     const session = {
-      hasProviderChild: true,
-      fence: 7,
-      acquisitionGeneration: GENERATION,
+      child: { generation: GENERATION, fence: 7, phase: 'ready' },
       journal: {
+        cursor: () => ({ epoch: 'epoch-1', sequence: 0 }),
+        itemBody: () => null,
         snapshot: () => ({ items }),
         appendLifecycleBatch,
         markPendingSubmissionsUnknown: vi.fn(async () => [])
@@ -215,20 +180,18 @@ describe('provider-exit recovery tickets', () => {
           runtimeKind: 'native',
           claimStatus: 'live',
           ownerProcess: 'provider',
-          reservedSpawnToken: null,
-          processlessAt: null
+          reservedSpawnToken: null
         }
       }),
       transitionHandoff: async () => ({ lease: { runtimeFence: 8 } })
     }
 
-    const result = await settleUnexpectedStructuredAgentSessionExit(
+    await settleUnexpectedStructuredAgentSessionExit(
       {
         store,
         sessions: new Map([[SESSION, session]]),
         flushLifecycle: async () => ({ ok: true }),
         publishFence: vi.fn(),
-        hasResumeCapableHolder: () => true,
         serialize: async (_sessionId, task) => task(),
         now: () => 1_234
       } as never,
@@ -238,17 +201,15 @@ describe('provider-exit recovery tickets', () => {
         reason: 'provider exited',
         cause: 'unexpected-exit',
         fence: 7,
-        acquisitionGeneration: GENERATION,
-        settlementRetryRequired: true
+        acquisitionGeneration: GENERATION
       }
     )
 
-    expect(result).toMatchObject({ releasedFence: 8 })
     expect(session.journal.markPendingSubmissionsUnknown).toHaveBeenCalledWith(
       7,
       'provider_exited_before_acknowledgement'
     )
-    expect(session.hasProviderChild).toBe(false)
+    expect(session.child).toBeNull()
     // The running row is revised to interrupted at exit receipt, never tombstoned.
     expect(appendLifecycleBatch).toHaveBeenCalledExactlyOnceWith({
       settlementId: `dead-generation:provider-exit:${SESSION}:7:${GENERATION}`,
@@ -261,7 +222,22 @@ describe('provider-exit recovery tickets', () => {
             provider: 'orca',
             clientMessageId: `provider-exit:${SESSION}:7:${GENERATION}`
           },
-          body: { kind: 'status', text: unexpectedProviderExitOutcome('provider exited') }
+          body: {
+            kind: 'status',
+            text: exitOutcome('The agent'),
+            failure: { kind: 'providerExited' },
+            tone: 'error'
+          },
+          // The exit belongs to the turn it ended.
+          turnScope: {
+            kind: 'turn',
+            turnItemId: agentJournalItemKey({
+              provider: 'codex',
+              threadId: 'thread-1',
+              turnId: 'turn-2',
+              ordinal: 0
+            })
+          }
         },
         {
           kind: 'item',
@@ -272,7 +248,8 @@ describe('provider-exit recovery tickets', () => {
             state: 'interrupted',
             startedAt: 30,
             completedAt: 1_234
-          }
+          },
+          turnScope: { kind: 'thread' }
         }
       ]
     })
@@ -305,10 +282,10 @@ describe('provider-exit recovery tickets', () => {
         sequence: 3
       }))
       const session: StructuredAgentSessionUnexpectedExitSession = {
-        hasProviderChild: true,
-        fence: 7,
-        acquisitionGeneration: GENERATION,
+        child: { generation: GENERATION, fence: 7, phase: 'ready' },
         journal: {
+          cursor: () => ({ epoch: 'epoch-1', sequence: 0 }),
+          itemBody: () => null,
           snapshot: () => ({ items }),
           appendLifecycleBatch,
           markPendingSubmissionsUnknown: vi.fn(async () => []),
@@ -331,7 +308,6 @@ describe('provider-exit recovery tickets', () => {
           return { ok: true }
         },
         publishFence: vi.fn(),
-        hasResumeCapableHolder: () => true,
         serialize: async <T>(_sessionId: string, task: () => Promise<T>) => task(),
         now: () => 1_234
       }
@@ -351,7 +327,9 @@ describe('provider-exit recovery tickets', () => {
           expect.objectContaining({
             body: {
               kind: 'status',
-              text: unexpectedProviderExitOutcome('provider exited after completing the turn')
+              text: exitOutcome('Claude'),
+              failure: { kind: 'providerExited' },
+              tone: 'error'
             }
           })
         ])
@@ -362,10 +340,10 @@ describe('provider-exit recovery tickets', () => {
   it('settles a submission the dead child never acknowledged', async () => {
     const markPendingSubmissionsUnknown = vi.fn(async () => ['client-1'])
     const session: StructuredAgentSessionUnexpectedExitSession = {
-      hasProviderChild: true,
-      fence: 7,
-      acquisitionGeneration: GENERATION,
+      child: { generation: GENERATION, fence: 7, phase: 'ready' },
       journal: {
+        cursor: () => ({ epoch: 'epoch-1', sequence: 0 }),
+        itemBody: () => null,
         snapshot: () => ({ items: [] }),
         appendLifecycleBatch: vi.fn(async () => ({ epoch: 'epoch-1', sequence: 1 })),
         markPendingSubmissionsUnknown,
@@ -380,7 +358,6 @@ describe('provider-exit recovery tickets', () => {
       sessions: new Map([[SESSION, session]]),
       flushLifecycle: async () => ({ ok: true }),
       publishFence: vi.fn(),
-      hasResumeCapableHolder: () => true,
       serialize: async <T>(_sessionId: string, task: () => Promise<T>) => task(),
       now: () => 1
     }
@@ -401,19 +378,24 @@ describe('provider-exit recovery tickets', () => {
       expect.objectContaining({
         mutations: [
           expect.objectContaining({
-            body: { kind: 'status', text: unexpectedProviderExitOutcome('provider exited') }
+            body: {
+              kind: 'status',
+              text: exitOutcome('Claude'),
+              failure: { kind: 'providerExited' },
+              tone: 'error'
+            }
           })
         ]
       })
     )
   })
 
-  it('does not release or reacquire while terminal settlement retry is still failing', async () => {
+  it('releases without offering a restart while terminal settlement is failing', async () => {
     const session: StructuredAgentSessionUnexpectedExitSession = {
-      hasProviderChild: true,
-      fence: 7,
-      acquisitionGeneration: GENERATION,
+      child: { generation: GENERATION, fence: 7, phase: 'ready' },
       journal: {
+        cursor: () => ({ epoch: 'epoch-1', sequence: 0 }),
+        itemBody: () => null,
         markPendingSubmissionsUnknown: vi.fn(async () => []),
         rejectPendingSubmissions: vi.fn(async () => []),
         snapshot: () => ({
@@ -440,45 +422,14 @@ describe('provider-exit recovery tickets', () => {
       sessions: new Map([[SESSION, session]]),
       flushLifecycle: async () => ({ ok: false, error: new Error('sink failed') }),
       publishFence,
-      hasResumeCapableHolder: () => true,
       serialize: async (_sessionId, task) => task(),
       now: () => 1,
       onBarrierError: release
     }
-    const result = await settleUnexpectedStructuredAgentSessionExit(context, event)
+    await settleUnexpectedStructuredAgentSessionExit(context, event)
 
-    expect(result).toBeNull()
-    expect(session.hasProviderChild).toBe(false)
-    expect(session.fence).toBe(8)
+    expect(session.child).toBeNull()
     expect(publishFence).toHaveBeenCalledTimes(1)
     expect(release).toHaveBeenCalledTimes(2)
   })
-
-  it('admits the exact released generation for a resume-capable holder', () => {
-    expect(isStructuredAgentSessionRecoveryTicketCurrent(recoveryContext({}), ticket)).toBe(true)
-  })
-
-  it('is cancelled by a latched stage before reattachment', () => {
-    expect(
-      isStructuredAgentSessionRecoveryTicketCurrent(
-        recoveryContext({ handoffStage: 'recovering' }),
-        ticket
-      )
-    ).toBe(false)
-  })
-
-  it('is cancelled when its holder or dead acquisition generation is no longer current', () => {
-    expect(
-      isStructuredAgentSessionRecoveryTicketCurrent(
-        recoveryContext({ resumeCapable: false }),
-        ticket
-      )
-    ).toBe(false)
-    expect(
-      isStructuredAgentSessionRecoveryTicketCurrent(
-        recoveryContext({ generation: 'generation-new' }),
-        ticket
-      )
-    ).toBe(false)
-  })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.ts
index 5363b8588e7..3f758f81607 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.ts
@@ -1,8 +1,9 @@
-import type {
-  StructuredAgentSessionEndedEvent,
-  StructuredAgentSessionProviderChildPhase
-} from './structured-agent-session-adapter'
+import type { AgentSessionFailureWordsContext } from '../../../shared/agent-session-failure-words'
+import { structuredAgentSessionFailureWordsContext } from './structured-agent-session-send-preparation'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import type { StructuredAgentSessionEndedEvent } from './structured-agent-session-adapter'
 import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+import { endProviderChild } from './structured-agent-session-provider-child'
 import {
   releaseStoredStructuredAgentSessionOwnerAfterUnexpectedExit,
   type StructuredAgentSessionLeaseStore
@@ -21,20 +22,10 @@ type UnexpectedExitLifecycleEvent = StructuredAgentSessionEndedEvent & {
   cause: 'unexpected-exit'
 }
 
-export type StructuredAgentSessionRecoveryTicket = {
-  sessionId: string
-  releasedFence: number
-  deadAcquisitionGeneration: string
-  stableSettlementId: string
-}
-
-export type StructuredAgentSessionUnexpectedExitSession = {
-  journal: DeadGenerationJournal
-  hasProviderChild: boolean
-  fence: number
-  acquisitionGeneration: string | null
-  providerChildPhase?: StructuredAgentSessionProviderChildPhase
-}
+export type StructuredAgentSessionUnexpectedExitSession = Pick<
+  StructuredAgentSessionHostSession,
+  'child' | 'lastEndedChild'
+> & { journal: DeadGenerationJournal & Pick<AgentSessionJournal, 'cursor' | 'itemBody'> }
 
 export type StructuredAgentSessionUnexpectedExitContext<
   TSession extends StructuredAgentSessionUnexpectedExitSession = StructuredAgentSessionHostSession
@@ -44,7 +35,6 @@ export type StructuredAgentSessionUnexpectedExitContext<
   flushLifecycle: (sessionId: string) => Promise<StructuredAgentSessionSinkBarrier>
   publishFence: (sessionId: string, session: TSession) => void
   publishStatus?: (sessionId: string) => void
-  hasResumeCapableHolder: (sessionId: string) => boolean
   serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
   now: () => number
   onBarrierError?: (sessionId: string, error: unknown) => void
@@ -55,40 +45,50 @@ export async function settleUnexpectedStructuredAgentSessionExit<
 >(
   context: StructuredAgentSessionUnexpectedExitContext<TSession>,
   event: StructuredAgentSessionEndedEvent
-): Promise<StructuredAgentSessionRecoveryTicket | null> {
+): Promise<void> {
   if (event.cause !== 'unexpected-exit') {
-    return null
+    return
   }
   const unexpectedEvent = event as UnexpectedExitLifecycleEvent
   // Receipt of the exit is the one end time the host may record for a running turn.
   const observedAt = event.observedAt ?? context.now()
   return context.serialize(unexpectedEvent.sessionId, async () => {
     const session = context.sessions.get(unexpectedEvent.sessionId)
+    const child = session?.child
     if (
-      !session?.hasProviderChild ||
-      session.fence !== unexpectedEvent.fence ||
-      session.acquisitionGeneration !== unexpectedEvent.acquisitionGeneration
+      !session ||
+      !child ||
+      child.fence !== unexpectedEvent.fence ||
+      child.generation !== unexpectedEvent.acquisitionGeneration
     ) {
-      return null
+      return
+    }
+    // The host's own phase decides, so a provider that omits the flag still gets a start that
+    // failed told as one: the row says so.
+    const exitedDuringStartup =
+      unexpectedEvent.startupUnproven === true || child.phase === 'starting'
+    const endChild = (): void => {
+      endProviderChild(session, {
+        generation: child.generation,
+        fence: child.fence,
+        cause: 'exit',
+        reason: unexpectedEvent.reason,
+        ...(unexpectedEvent.failure ? { failure: unexpectedEvent.failure } : {}),
+        duringStartup: exitedDuringStartup,
+        // The adapter publishes an exit only once it saw the root go, first-hand or proven.
+        rootGone: true
+      })
+      context.publishStatus?.(unexpectedEvent.sessionId)
     }
     const record = context.store.getRecord(unexpectedEvent.sessionId)
     if (!record || record.lease.handoffStage !== null) {
       // An acquisition or recovery already owns this lease's transition.
-      session.hasProviderChild = false
-      context.publishStatus?.(unexpectedEvent.sessionId)
-      return null
+      endChild()
+      return
     }
-    // The host's own phase decides, so a provider that omits the flag still gets a start that
-    // failed told as one: the row says so, and nothing resumes into the same failure.
-    const exitedDuringStartup =
-      unexpectedEvent.startupUnproven === true || session.providerChildPhase === 'starting'
 
-    let settlementFailed = false
     const stableSettlementId = providerExitSettlementId(unexpectedEvent)
     const unfinishedWork = captureUnfinishedStructuredAgentSessionWork(session.journal)
-    let released: Awaited<
-      ReturnType<typeof releaseStoredStructuredAgentSessionOwnerAfterUnexpectedExit>
-    > | null = null
     try {
       try {
         const barrier = await context.flushLifecycle(unexpectedEvent.sessionId)
@@ -98,13 +98,15 @@ export async function settleUnexpectedStructuredAgentSessionExit<
       } catch (error) {
         context.onBarrierError?.(unexpectedEvent.sessionId, error)
       }
-      settlementFailed = !(await retryUnexpectedExitSettlement({
+      await retryUnexpectedExitSettlement({
         context,
         event: unexpectedEvent,
-        session,
+        journal: session.journal,
+        fence: child.fence,
         stableSettlementId,
         verdict: { state: 'interrupted', completedAt: observedAt },
         exitedDuringStartup,
+        failureTextContext: structuredAgentSessionFailureWordsContext(record, session.journal),
         // A failed start always says why: no response was running to carry the reason.
         showUnexpectedExitOutcome:
           exitedDuringStartup ||
@@ -113,102 +115,62 @@ export async function settleUnexpectedStructuredAgentSessionExit<
             session.journal,
             observedAt
           )
-      }))
+      })
     } finally {
       // Provider exit was positively observed, so release the owner even when
       // terminal settlement could not be durably accepted.
+      let released: Awaited<
+        ReturnType<typeof releaseStoredStructuredAgentSessionOwnerAfterUnexpectedExit>
+      > | null = null
       try {
         released = await releaseStoredStructuredAgentSessionOwnerAfterUnexpectedExit({
           store: context.store,
           sessionId: unexpectedEvent.sessionId,
           expectedFence: unexpectedEvent.fence,
           expectedAcquisitionGeneration: unexpectedEvent.acquisitionGeneration,
-          acquisitionGeneration: session.acquisitionGeneration,
+          acquisitionGeneration: child.generation,
           now: context.now(),
           exitObservedAt: observedAt,
-          ...(settlementFailed
-            ? {
-                settlementRetry: {
-                  settlementId: stableSettlementId,
-                  // Bare cause: the retry renders it, and `exit-observed` already says the rest.
-                  detail: unexpectedEvent.reason.slice(0, MAX_UNEXPECTED_EXIT_REASON_CHARS)
-                }
-              }
-            : {})
+          // Bare cause: whatever this settlement could not write is settled from it later (the
+          // settle recording it queues, or the next open or acquire); `exit-observed` says the rest.
+          exitReason: unexpectedEvent.reason.slice(0, MAX_UNEXPECTED_EXIT_REASON_CHARS)
         })
       } catch (error) {
         context.onBarrierError?.(unexpectedEvent.sessionId, error)
       } finally {
-        session.hasProviderChild = false
-        context.publishStatus?.(unexpectedEvent.sessionId)
+        endChild()
         if (released) {
-          session.fence = released.lease.runtimeFence
           context.publishFence(unexpectedEvent.sessionId, session)
         }
       }
     }
-    if (settlementFailed || !released) {
-      return null
-    }
-    // Resuming a start that failed would respawn into the same failure; the next send retries.
-    if (exitedDuringStartup || !context.hasResumeCapableHolder(unexpectedEvent.sessionId)) {
-      return null
-    }
-    return {
-      sessionId: unexpectedEvent.sessionId,
-      releasedFence: released.lease.runtimeFence,
-      deadAcquisitionGeneration: unexpectedEvent.acquisitionGeneration,
-      stableSettlementId
-    }
   })
 }
 
-export function isStructuredAgentSessionRecoveryTicketCurrent(
-  context: {
-    store: Pick<StructuredAgentSessionLeaseStore, 'getRecord'>
-    sessions: Map<
-      string,
-      Pick<
-        StructuredAgentSessionUnexpectedExitSession,
-        'hasProviderChild' | 'fence' | 'acquisitionGeneration'
-      >
-    >
-    hasResumeCapableHolder: (sessionId: string) => boolean
-  },
-  ticket: StructuredAgentSessionRecoveryTicket
-): boolean {
-  const session = context.sessions.get(ticket.sessionId)
-  const record = context.store.getRecord(ticket.sessionId)
-  return (
-    session?.hasProviderChild === false &&
-    session.fence === ticket.releasedFence &&
-    session.acquisitionGeneration === ticket.deadAcquisitionGeneration &&
-    record?.lease.runtimeFence === ticket.releasedFence &&
-    record.lease.claimStatus === 'released' &&
-    record.lease.handoffStage === null &&
-    context.hasResumeCapableHolder(ticket.sessionId)
-  )
-}
-
 async function retryUnexpectedExitSettlement(input: {
   context: Pick<StructuredAgentSessionUnexpectedExitContext, 'onBarrierError'>
   event: UnexpectedExitLifecycleEvent
-  session: Pick<StructuredAgentSessionUnexpectedExitSession, 'journal' | 'fence'>
+  journal: DeadGenerationJournal
+  fence: number
   stableSettlementId: string
   verdict: StructuredAgentSessionTurnVerdict
   exitedDuringStartup: boolean
+  failureTextContext: AgentSessionFailureWordsContext
   showUnexpectedExitOutcome?: boolean
 }): Promise<boolean> {
   return settleStructuredAgentSessionDeadGeneration({
-    journal: input.session.journal,
+    journal: input.journal,
     sessionId: input.event.sessionId,
-    fence: input.session.fence,
+    fence: input.fence,
     settlementId: input.stableSettlementId,
     verdict: input.verdict,
     pendingSubmissionReason: 'provider_exited_before_acknowledgement',
     showUnexpectedExitOutcome: input.showUnexpectedExitOutcome,
-    unexpectedExitReason: input.event.reason,
-    exitedDuringStartup: input.exitedDuringStartup,
+    ...(input.event.failure ? { exitFailure: input.event.failure } : {}),
+    failureTextContext: input.failureTextContext,
+    ...(input.exitedDuringStartup
+      ? { exitedDuringStartup: { generation: input.event.acquisitionGeneration } }
+      : {}),
     onError: input.context.onBarrierError
   })
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-view-start-after-failed-start.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-view-start-after-failed-start.test.ts
new file mode 100644
index 00000000000..957ac2f275d
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-view-start-after-failed-start.test.ts
@@ -0,0 +1,212 @@
+// A Claude chat whose CLI exits before it finishes starting leaves one red row per start. A view
+// opening, or coming back to, a chat whose last start failed used to start the CLI again, so every
+// look at the chat added an identical row. Only a send retries a failed start: it is the user asking.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import { ClaudeStructuredSessionAdapter } from '../../claude/claude-structured-session-adapter'
+import {
+  fakeClaude,
+  PROVIDER_SESSION_ID
+} from '../../claude/claude-structured-session-test-support'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { structuredClaudeLifecycleEvent } from '../../runtime/structured-claude-runtime-adapter'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+/** Delivery runs on its own serialized steps; under a loaded runner they take more than a second. */
+function eventually(assertion: () => unknown): Promise<unknown> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
+
+const CALLER = { callerKey: 'client-1' }
+const SURFACE = 'desktop-chat:1'
+const LAUNCH_FAILURE =
+  'claude stream-json exited (code 1): qa-shim: simulated claude launch failure'
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let adapter: ClaudeStructuredSessionAdapter
+let claude: ReturnType<typeof fakeClaude>
+let lifecycle: Promise<void>[]
+/** Every initialize waits on it: a start that must outlast a step does not race a timer. */
+let initGate: Promise<void>
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-view-start-after-failed-start-'))
+  resetHostTestOperationIds()
+  lifecycle = []
+  initGate = Promise.resolve()
+  // Every start spawns, is published, and exits before it answers initialize.
+  claude = fakeClaude({ initDelayMs: 20, exitBeforeInit: LAUNCH_FAILURE })
+  adapter = new ClaudeStructuredSessionAdapter({
+    resolveLaunch: async () => ({
+      pathToClaudeCodeExecutable: 'claude',
+      options: {},
+      cwd: root,
+      claudeConfigDir: join(root, 'claude-home'),
+      providerSessionId: PROVIDER_SESSION_ID,
+      resumeLeafUuid: null,
+      resumesTranscript: (store.getRecord(SESSION)?.providerHandleChain.length ?? 0) > 0,
+      continuesChain: (store.getRecord(SESSION)?.providerHandleChain.length ?? 0) > 0
+    }),
+    onEvent: (event) => {
+      const mapped = structuredClaudeLifecycleEvent(event)
+      if (mapped) {
+        lifecycle.push(host.handleAdapterEvent(mapped))
+      }
+    },
+    openConnection: async (launch, handlers) => {
+      const connection = await claude.openConnection(launch, handlers)
+      const initialize = connection.initializationResult
+      return Object.assign(connection, {
+        initializationResult: async () => {
+          await initGate
+          return initialize()
+        }
+      })
+    },
+    readProcessStartTime: async () => 1_700_000_000_000,
+    now: () => NOW
+  })
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: Object.assign(adapter, { supportsCreate: () => true }),
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => `spawn-${claude.connections.length + 1}`,
+    now: () => NOW
+  })
+})
+
+afterEach(async () => {
+  await adapter.closeAll()
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+/** Waits until the adapter has published every exit it saw and the host settled each one. */
+async function settleExits(): Promise<void> {
+  await eventually(async () => {
+    await adapter.drainObservedExits()
+    await Promise.all(lifecycle)
+    expect((await host.journalSnapshot(SESSION)).items.length).toBeGreaterThan(0)
+  })
+  await Promise.all(lifecycle)
+}
+
+/** A view of the chat: a subscription, which reads the chat and starts nothing. */
+function view(id: string): Promise<() => void> {
+  return host.subscribe({ id, sessionId: SESSION, emit: () => undefined })
+}
+
+/** The chat as it renders: the user's messages and the error rows, in journal order. */
+async function timeline(): Promise<string[]> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'message'
+      ? ['message']
+      : item.body.kind === 'status' && item.body.tone === 'error'
+        ? [item.body.text]
+        : []
+  )
+}
+
+async function send(text: string): Promise<string> {
+  const body = hostTestMessage(text)
+  const sent = await host.send(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: store.getRecord(SESSION)?.lease.runtimeFence ?? 1,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    },
+    body
+  })
+  expect(sent).toMatchObject({ ok: true })
+  return sent.ok ? sent.value.clientMessageId : ''
+}
+
+describe('a fresh chat whose Claude start fails', () => {
+  // QA saw three failed starts from opening the chat alone: the create's, and the view's.
+  it.each([
+    ['after the create already died', false],
+    ['while the create is still starting', true]
+  ] as const)(
+    'starts once for the open and once for a send, one row each, when the view binds %s',
+    async (_when, createStillStarting) => {
+      // Released only once the views bound, so no runner is slow enough to let the create die first.
+      let releaseCreate = (): void => {}
+      const createGate = new Promise<void>((resolve) => {
+        releaseCreate = resolve
+      })
+      if (!createStillStarting) {
+        releaseCreate()
+      }
+      initGate = createGate
+      claude = fakeClaude({ exitBeforeInit: LAUNCH_FAILURE })
+      await expect(
+        host.attach(
+          CALLER,
+          hostTestAttachParams(null, {
+            provider: 'claude',
+            agent: 'claude',
+            accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: join(root, 'claude-home') },
+            providerHandle: { kind: 'claude', sessionId: PROVIDER_SESSION_ID, leafUuid: null }
+          })
+        )
+      ).resolves.toMatchObject({ ok: true })
+      if (!createStillStarting) {
+        await settleExits()
+      }
+      // Two surfaces bind, as a pane and a second window do.
+      const unsubscribe = await view(SURFACE)
+      await view('desktop-chat:2')
+      if (createStillStarting) {
+        // The views bound to the create's child itself, before it exited.
+        expect(await timeline()).toEqual([])
+        releaseCreate()
+      }
+      await settleExits()
+      // The row says the provider stopped; its stderr stays out of the sentence.
+      const startFailure =
+        'Claude stopped before it finished starting. Send your message to try again.'
+      // Opening the chat: the create's start, once, and its row.
+      expect(claude.connections).toHaveLength(1)
+      expect(await timeline()).toEqual([startFailure])
+
+      const sent = await send('reply with exactly: alpha')
+      await eventually(async () =>
+        expect(
+          (await host.journalSnapshot(SESSION)).submissions.find((s) => s.clientMessageId === sent)
+        ).toMatchObject({ dispatchState: 'rejected', reason: startFailure })
+      )
+      await settleExits()
+      // The send's own start, once, and one row for it below the message.
+      expect(claude.connections).toHaveLength(2)
+      expect(await timeline()).toEqual([startFailure, 'message', startFailure])
+
+      // Switching away and back re-subscribes; it starts nothing and adds no row.
+      unsubscribe()
+      await view(SURFACE)
+      await settleExits()
+      expect(claude.connections).toHaveLength(2)
+      expect(await timeline()).toEqual([startFailure, 'message', startFailure])
+    }
+  )
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-wedged-profile-migration.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-wedged-profile-migration.test.ts
index 21a5fe4e49d..05c57a5941c 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-wedged-profile-migration.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-wedged-profile-migration.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../shared/agent-session-journal-types'
 // The profiles already shipped into a dead end.
 //
 // Every record here is a shape taken from a real wedged store: a lease that no acquisition, no
@@ -6,16 +7,20 @@
 // conversation — the journal, the provider handle chain, and the recorded evidence all survive.
 //
 // "Usable" means ACQUIRABLE, not acquired. Startup no longer resumes a provider child for a record
-// nobody is looking at; a surface taking a hold is what spawns one. So the migration's job is to
-// leave the lease in a state a hold can claim, and these tests prove that by adjudicating it rather
-// than by reading fields off it.
+// nobody is looking at; work that needs the agent is what spawns one. So the migration's job is to
+// leave the lease in a state an attach can claim, and these tests prove that by adjudicating it
+// rather than by reading fields off it.
 
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
-import { evaluateAgentSessionAcquisition } from '../../../shared/agent-session-lease-adjudication'
+import {
+  evaluateAgentSessionAcquisition,
+  type AgentSessionOwnerProbe
+} from '../../../shared/agent-session-lease-adjudication'
 import { activeStructuredAgentSessionTurnId } from '../../../shared/structured-agent-session-projection'
+import type { AgentSessionStatusSummary } from '../../../shared/agent-session-wire'
 import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
 import type {
   AgentSessionClaimStatus,
@@ -31,7 +36,7 @@ import { AGENT_SESSION_STORE_FILE_NAME } from '../../runtime/agent-session-recor
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
 import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
-import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
 import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
 import {
@@ -145,6 +150,11 @@ function openHost(overrides: Partial<StructuredAgentSessionHostDeps> = {}): void
   })
 }
 
+/** The host starting the agent with no message to deliver, as an operation that needs it does. */
+function startAgent(): Promise<unknown> {
+  return host['serialize'](SESSION, () => host['mutationContext']().ensureAgent(SESSION))
+}
+
 beforeEach(async () => {
   root = await mkdtemp(join(tmpdir(), 'orca-wedged-profile-'))
   resetHostTestOperationIds()
@@ -182,6 +192,9 @@ function isAcquirable(lease: NonNullable<ReturnType<typeof store.getRecord>>['le
   )
 }
 
+/** After the owner's last renewal, so a turn it proves dead ends at its start, never before. */
+const SEEDED_TURN_STARTED_AT = NOW - 5_000
+
 async function seedRunningTurn(provider: 'codex' | 'claude' = 'codex'): Promise<void> {
   const journal = await openAgentSessionJournal({
     identity: {
@@ -200,8 +213,8 @@ async function seedRunningTurn(provider: 'codex' | 'claude' = 'codex'): Promise<
     provider === 'codex'
       ? { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 0 }
       : { provider: 'claude', sessionId: 'provider-session-alpha-1', uuid: 'uuid-running' },
-    { kind: 'turn', turnId: 'turn-1', state: 'running', startedAt: NOW - 5_000 },
-    { fence: 13 }
+    { kind: 'turn', turnId: 'turn-1', state: 'running', startedAt: SEEDED_TURN_STARTED_AT },
+    { fence: 13, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
   await journal.close()
 }
@@ -265,9 +278,7 @@ describe('already-wedged profiles become usable on load', () => {
       expect(activeStructuredAgentSessionTurnId(restoredJournal().snapshot().items)).toBe(null)
       expect(store.getRecord(SESSION)?.lease).toMatchObject({
         claimStatus: 'released',
-        handoffStage: null,
-        settlementRetryRequired: undefined,
-        settlementRetryId: undefined
+        handoffStage: null
       })
       expect(acquire).not.toHaveBeenCalled()
 
@@ -284,40 +295,130 @@ describe('already-wedged profiles become usable on load', () => {
     }
   )
 
-  it('settles restart eviction through attach when a hold arrives before the boot sweep', async () => {
+  it.each([
+    [
+      'an exit the host saw but could not settle before quitting',
+      wedgedRecord({ claimStatus: 'released', handoffStage: null }),
+      {
+        kind: 'exit-observed',
+        detail: 'provider exited: transport closed',
+        observedAt: NOW - 1_000
+      } as const,
+      { state: 'interrupted', completedAt: NOW - 1_000 }
+    ],
+    [
+      'a quit that left the owner for a probe to prove gone',
+      wedgedRecord({ claimStatus: 'live', handoffStage: null, ownerProcess: DEAD_OWNER }),
+      null,
+      { state: 'interrupted', completedAt: SEEDED_TURN_STARTED_AT }
+    ],
+    [
+      'a quit that left an owner on a host this one cannot probe',
+      wedgedRecord({
+        claimStatus: 'live',
+        handoffStage: null,
+        ownerProcess: { ...DEAD_OWNER, hostId: 'remote-host' }
+      }),
+      null,
+      { state: 'unverifiable' }
+    ]
+  ] as const)(
+    'reopens a chat that was mid-turn at %s with nothing running and no working status',
+    async (_quit, seeded, deathEvidence, verdict) => {
+      await seedStore({ ...seeded, lease: { ...seeded.lease, deathEvidence } })
+      await seedRunningTurn()
+      const published: AgentSessionStatusSummary[] = []
+      const remote = seeded.lease.ownerProcess?.hostId === 'remote-host'
+      openHost({
+        statusSink: { publish: (summary) => published.push(summary), forget: () => {} },
+        // Loss of contact is never proof of death: a remote owner only ever probes indeterminate.
+        ...(remote
+          ? {
+              probeOwner: async () => ({
+                outcome: 'indeterminate' as const,
+                reason: 'owner runs on remote-host, which this host cannot probe'
+              })
+            }
+          : {})
+      })
+
+      await host.restoreReadableSessions()
+
+      expect(acquire).not.toHaveBeenCalled()
+      expect(turnLifecycle('turn-1')).toEqual({
+        turnId: 'turn-1',
+        startedAt: NOW - 5_000,
+        recovered: true,
+        ...verdict
+      })
+      expect(activeStructuredAgentSessionTurnId(restoredJournal().snapshot().items)).toBe(null)
+      // The row never carries the proof's detail, which is Orca's log text.
+      const statusRows = restoredJournal()
+        .snapshot()
+        .items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
+      expect(statusRows).toEqual(
+        remote
+          ? []
+          : [
+              'Codex stopped while this response was in progress. You can continue in this conversation.'
+            ]
+      )
+      // What the sidebar reads: every status this restart published says the chat is not working.
+      expect(published.filter((summary) => summary.sessionId === SESSION)).not.toEqual([])
+      expect(published.map((summary) => summary.status)).not.toContain('working')
+      // A crash is not something the user did: no outcome is claimed, so no reader files it as a
+      // cancellation the user already knows about.
+      expect(published.map((summary) => summary.turnOutcome)).toEqual(
+        published.map(() => undefined)
+      )
+    }
+  )
+
+  it('settles restart eviction through attach when a start arrives before the boot sweep', async () => {
     await seedStore(
       wedgedRecord({ claimStatus: 'live', handoffStage: null, ownerProcess: DEAD_OWNER })
     )
     await seedRunningTurn()
     openHost()
 
-    await host.hold(SESSION, 'desktop-chat:restart')
+    // The attach adjudicates the dead owner first, which moves the fence; like a client's ensure,
+    // it is retried at the fence the refusal names.
+    const stale = await host.attach(CALLER, hostTestAttachParams(13))
+    const fence = stale.ok ? 13 : (stale.refusal.currentFence ?? 13)
+    expect(stale.ok || stale.refusal.code === 'agent_session_checkpoint_stale').toBe(true)
+    expect(stale.ok || (await host.attach(CALLER, hostTestAttachParams(fence))).ok).toBe(true)
 
     expect(acquire).toHaveBeenCalledOnce()
     expect(activeStructuredAgentSessionTurnId(restoredJournal().snapshot().items)).toBe(null)
-    // A pid probe proved the owner gone; nobody saw it exit, so the turn has no end.
+    // A pid probe proved the owner gone, so the turn was cut short when it was last proven alive.
     expect(turnLifecycle('turn-1')).toEqual({
       turnId: 'turn-1',
-      state: 'unverifiable',
+      state: 'interrupted',
       startedAt: NOW - 5_000,
+      completedAt: SEEDED_TURN_STARTED_AT,
       recovered: true
     })
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       claimStatus: 'live',
-      handoffStage: null,
-      settlementRetryRequired: undefined,
-      settlementRetryId: undefined
+      handoffStage: null
     })
   })
 
   it('settles an observed-exit latch through attach before the boot sweep', async () => {
     const record = wedgedRecord({ claimStatus: 'released', handoffStage: 'recovering' })
-    record.lease.settlementRetryRequired = true
-    record.lease.settlementRetryId = `provider-exit:${SESSION}:12:generation-1`
-    record.lease.deathEvidence = {
-      kind: 'exit-observed',
-      detail: 'provider exited: transport closed',
-      observedAt: NOW - 1_000
+    // The settlement latch an older build wrote; this build derives the settlement instead.
+    const olderBuildLatch = {
+      settlementRetryRequired: true,
+      settlementRetryId: `provider-exit:${SESSION}:12:generation-1`
+    }
+    record.lease = {
+      ...record.lease,
+      ...olderBuildLatch,
+      deathEvidence: {
+        kind: 'exit-observed',
+        detail: 'provider exited: transport closed',
+        observedAt: NOW - 1_000
+      }
     }
     await seedStore(record)
     await seedRunningTurn()
@@ -337,12 +438,114 @@ describe('already-wedged profiles become usable on load', () => {
     })
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       claimStatus: 'live',
-      handoffStage: null,
-      settlementRetryRequired: undefined,
-      settlementRetryId: undefined
+      handoffStage: null
     })
+    // The older build's latch is dropped at load, so a downgrade never sees it again.
+    expect(store.getRecord(SESSION)?.lease).not.toHaveProperty('settlementRetryRequired')
+    expect(store.getRecord(SESSION)?.lease).not.toHaveProperty('settlementRetryId')
   })
 
+  it.each([
+    ['a restart eviction', false],
+    ['a proven eviction by recovery', true]
+  ] as const)(
+    'settles the turn %s left at the next acquire when the read restore could not write it',
+    async (_origin, ownerOutlivedRestart) => {
+      await seedStore(
+        wedgedRecord({ claimStatus: 'live', handoffStage: null, ownerProcess: DEAD_OWNER })
+      )
+      await seedRunningTurn()
+      let ownerAlive = ownerOutlivedRestart
+      const stopOwnerProcess = vi.fn(() => {
+        ownerAlive = false
+      })
+      openHost({
+        probeOwner: async () =>
+          ownerAlive
+            ? { outcome: 'identity-matched', matchedOn: ['spawn-token'] }
+            : { outcome: 'pid-absent' },
+        stopOwnerProcess
+      })
+      // The read restore's settlement fails, and nothing retries it.
+      const failing = vi
+        .spyOn(AgentSessionJournal.prototype, 'appendLifecycleBatch')
+        .mockRejectedValue(new Error('journal unavailable'))
+      await host.restoreReadableSessions()
+      failing.mockRestore()
+      expect(activeStructuredAgentSessionTurnId(restoredJournal().snapshot().items)).toBe('turn-1')
+      expect(stopOwnerProcess).toHaveBeenCalledTimes(ownerOutlivedRestart ? 1 : 0)
+      expect(store.getRecord(SESSION)?.lease).toMatchObject({
+        claimStatus: 'released',
+        handoffStage: null,
+        deathEvidence: { kind: 'pid-absent' }
+      })
+
+      await startAgent()
+
+      expect(acquire).toHaveBeenCalledOnce()
+      expect(store.getRecord(SESSION)?.lease).toMatchObject({ claimStatus: 'live' })
+      // A pid probe proved the owner gone, so the turn was cut short when it was last proven alive.
+      expect(turnLifecycle('turn-1')).toEqual({
+        turnId: 'turn-1',
+        state: 'interrupted',
+        startedAt: NOW - 5_000,
+        completedAt: SEEDED_TURN_STARTED_AT,
+        recovered: true
+      })
+    }
+  )
+
+  it('releases an owner that survives every stop signal, and the chat starts again', async () => {
+    await seedStore(
+      wedgedRecord({ claimStatus: 'live', handoffStage: null, ownerProcess: DEAD_OWNER })
+    )
+    const stopOwnerProcess = vi.fn()
+    openHost({
+      probeOwner: async () => ({ outcome: 'identity-matched', matchedOn: ['spawn-token'] }),
+      stopOwnerProcess
+    })
+
+    await host.restoreReadableSessions()
+
+    expect(stopOwnerProcess.mock.calls).toEqual([
+      [DEAD_OWNER.pid, 'SIGTERM'],
+      [DEAD_OWNER.pid, 'SIGKILL']
+    ])
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
+      handoffStage: null,
+      ownerProcess: null,
+      deathEvidence: null
+    })
+    expect(await host.attach(CALLER, hostTestAttachParams(14))).toMatchObject({ ok: true })
+    expect(acquire).toHaveBeenCalledOnce()
+  })
+
+  it.each([
+    ['a conflicted claim naming no process', { claimStatus: 'conflicted', ownerProcess: null }],
+    [
+      'an unproven reservation left in manual recovery',
+      { claimStatus: 'reserved', ownerProcess: null, reservedSpawnToken: 'spawn-lost' }
+    ]
+  ] as const)(
+    'releases %s an older build left, and the chat starts again',
+    async (_legacyRecord, lease) => {
+      await seedStore(wedgedRecord({ handoffStage: 'manual-recovery', ...lease }))
+      openHost({ probeOwner: async () => ({ outcome: 'indeterminate', reason: 'no scan here' }) })
+
+      await host.restoreReadableSessions()
+
+      expect(store.getRecord(SESSION)?.lease).toMatchObject({
+        claimStatus: 'released',
+        handoffStage: null,
+        runtimeFence: 14,
+        deathEvidence: null
+      })
+      expect(await host.attach(CALLER, hostTestAttachParams(14))).toMatchObject({ ok: true })
+      expect(acquire).toHaveBeenCalledOnce()
+    }
+  )
+
   it('marks a running turn left behind by a released lease unverifiable on a cold acquire', async () => {
     // No settlement latch: the record was released cleanly, but the journal still says a turn is
     // running. The child that wrote it is gone and nothing observed its exit.
@@ -380,7 +583,7 @@ describe('already-wedged profiles become usable on load', () => {
     await restoredJournal().appendItem(
       { provider: 'codex', threadId: THREAD, turnId: 'turn-2', ordinal: 0 },
       { kind: 'turn', turnId: 'turn-2', state: 'running', startedAt: NOW },
-      { fence }
+      { fence, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
     )
 
     // A reconnecting client replays its attach; the same operation admits the live owner.
@@ -419,27 +622,6 @@ describe('already-wedged profiles become usable on load', () => {
     expect(acquire).not.toHaveBeenCalled()
   })
 
-  it('leaves a conflicted record alone while its owner cannot be proven gone', async () => {
-    await seedStore(
-      wedgedRecord({
-        claimStatus: 'conflicted',
-        handoffStage: 'manual-recovery',
-        ownerProcess: DEAD_OWNER
-      })
-    )
-    openHost({
-      probeOwner: async () => ({ outcome: 'identity-matched', matchedOn: ['spawn-token'] })
-    })
-
-    await host.restoreReadableSessions()
-
-    expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      claimStatus: 'conflicted',
-      handoffStage: 'manual-recovery',
-      ownerProcess: { pid: DEAD_OWNER.pid }
-    })
-  })
-
   it('unlatches a released record that reloaded into recovery with nothing outstanding', async () => {
     // An evicted lease has no owner and no token, so a restart has nothing to probe. Treating that
     // as an unproven reservation re-latched it to `recovering` on every single boot.
@@ -523,12 +705,13 @@ describe('already-wedged profiles become usable on load', () => {
     await host.restoreReadableSessions()
     expect(order).toEqual([])
     expect(scan).not.toHaveBeenCalled()
-    await host.hold(SESSION, 'holder-1')
+    const fence = store.getRecord(SESSION)?.lease.runtimeFence ?? null
+    expect(await host.attach(CALLER, hostTestAttachParams(fence))).toMatchObject({ ok: true })
 
     expect(order).toEqual(['acquire'])
   })
 
-  it('names the missing evidence when a latched record still cannot be freed', async () => {
+  it('waits out a conflicted owner it cannot verify, signalling nothing, until it is proven gone', async () => {
     await seedStore(
       wedgedRecord({
         claimStatus: 'conflicted',
@@ -536,14 +719,23 @@ describe('already-wedged profiles become usable on load', () => {
         ownerProcess: DEAD_OWNER
       })
     )
-    openHost({ probeOwner: async () => ({ outcome: 'indeterminate', reason: 'no answer' }) })
+    const stopOwnerProcess = vi.fn()
+    let probe: AgentSessionOwnerProbe = { outcome: 'indeterminate', reason: 'no answer' }
+    openHost({ probeOwner: async () => probe, stopOwnerProcess })
     await host.restoreReadableSessions()
 
-    const refused = await host.attach(CALLER, hostTestAttachParams(13))
+    // A terminal agent keeps its transport across a restart, so an unanswered probe is not a way in.
+    const fence = store.getRecord(SESSION)?.lease.runtimeFence ?? null
+    expect(await host.attach(CALLER, hostTestAttachParams(fence))).toMatchObject({
+      ok: false,
+      refusal: { code: 'agent_session_conflict' }
+    })
+    expect(acquire).not.toHaveBeenCalled()
 
-    expect(refused.ok).toBe(false)
-    const message = refused.ok ? '' : refused.refusal.message
-    expect(message).toContain('process 12546 on local')
-    expect(message).not.toContain('The session store refused this call')
+    // The user quits that terminal: the next start proves it gone and the chat takes over.
+    probe = { outcome: 'pid-absent' }
+    await startAgent()
+    expect(acquire).toHaveBeenCalledOnce()
+    expect(stopOwnerProcess).not.toHaveBeenCalled()
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-wire-admission.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-wire-admission.test.ts
index 585cbd4fbbd..cb9f4285d73 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-wire-admission.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-wire-admission.test.ts
@@ -9,7 +9,10 @@ import type {
 import type { AgentSessionSubscribeEvent } from '../../../shared/agent-session-wire'
 import { REMOTE_RUNTIME_MAX_OUTBOUND_JSON_BYTES } from '../../../shared/remote-runtime-memory-limits'
 import { mobileE2EETextPayloadAdmissionBytes } from '../../runtime/rpc/mobile-e2ee-outbound-admission'
-import { AGENT_SESSION_JOURNAL_SCHEMA_VERSION } from '../../../shared/agent-session-journal-types'
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  AGENT_SESSION_JOURNAL_SCHEMA_VERSION
+} from '../../../shared/agent-session-journal-types'
 import { openJournalDatabase } from '../agent-session-journal/journal-database'
 import { journalDatabaseFile } from '../agent-session-journal/journal-paths'
 import { insertJournalRow } from '../agent-session-journal/journal-row-table'
@@ -39,7 +42,10 @@ beforeEach(async () => {
     journalDir: root
   })
   for (let ordinal = 1; ordinal <= 20; ordinal += 1) {
-    await journal.appendItem(item(ordinal), body(`${ordinal}:${LARGE_TEXT}`), { fence: 1 })
+    await journal.appendItem(item(ordinal), body(`${ordinal}:${LARGE_TEXT}`), {
+      fence: 1,
+      turnScope: AGENT_JOURNAL_THREAD_SCOPE
+    })
   }
 })
 
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-working-at-teardown.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-working-at-teardown.ts
index 8eac02dc17b..c3186d00daf 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-working-at-teardown.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-working-at-teardown.ts
@@ -16,7 +16,8 @@ import {
   agentSessionProviderHandleChainHead,
   agentSessionProviderHandleRoot
 } from '../../../shared/agent-session-provider-handle'
-import { latestStructuredAgentSessionUserItem } from '../../../shared/structured-agent-session-projection'
+import { latestStructuredAgentSessionUserItem } from '../../../shared/structured-agent-session-latest-request'
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 import type {
   AgentSessionResumeMarker,
@@ -37,6 +38,12 @@ import {
   type AgentSessionRestartTask
 } from '../../../shared/agent-session-restart-activity'
 import { isLiveChildWork } from '../../../shared/agent-status-child-work-liveness'
+import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
+import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
+import {
+  isStructuredAgentSessionCommandEntry,
+  isStructuredAgentSessionCommandTurn
+} from '../../../shared/structured-agent-session-command-entry'
 import {
   activeStructuredAgentSessionTurnId,
   newestStructuredAgentSessionTurn
@@ -83,12 +90,31 @@ function structuredAgentSessionResumeWork(
   items: readonly AgentJournalRenderItem[],
   submissions: readonly AgentJournalSubmission[]
 ): AgentSessionResumeWork | null {
+  const bodies = new Map(items.map((item) => [item.itemId, item.body]))
+  const bodyOf = (itemId: string) => bodies.get(itemId)
+  // A conversation command in flight is nothing to resume: the user ran it, not the agent.
+  const newest = newestStructuredAgentSessionTurn(items)
+  const inFlightSubmission = pendingSubmissionInFlight(submissions)
+  if (
+    (newest?.state === 'running' && isStructuredAgentSessionCommandTurn(newest, bodyOf)) ||
+    (inFlightSubmission &&
+      isStructuredAgentSessionCommandEntry(
+        bodyOf(agentJournalSubmissionKey(inFlightSubmission.clientMessageId))
+      ))
+  ) {
+    return null
+  }
   const inFlight = structuredAgentSessionWorkInFlight(items, submissions)
   if (inFlight) {
     return inFlight
   }
-  const newest = newestStructuredAgentSessionTurn(items)
-  return newest ? { kind: 'turn', id: newest.turnId } : null
+  // A settled lead whose children were the work anchors on its last real turn.
+  const lastRequest = items.findLast((item) => {
+    const turn = readAgentJournalTurn(item.body)
+    return turn !== null && !isStructuredAgentSessionCommandTurn(turn, bodyOf)
+  })
+  const turn = readAgentJournalTurn(lastRequest?.body)
+  return turn ? { kind: 'turn', id: turn.turnId } : null
 }
 
 function boundedLabel(text: string | undefined): string {
@@ -135,8 +161,7 @@ function liveTasks(
 type WorkingCandidateSession = {
   journal: AgentSessionJournal
   /** Only this host generation's own child counts. A restored-for-reading journal has none. */
-  hasProviderChild: boolean
-  fence?: number
+  child: { fence: number } | null
 }
 
 /** The offer one session is owed, taken right before teardown stops its provider child; null when
@@ -154,16 +179,24 @@ export function structuredAgentSessionWorkingAtStop(input: {
 }): AgentSessionResumeMarker | null {
   const { sessionId, session } = input
   // A journal this host cannot read tells us nothing about what the turn was doing.
-  if (!session?.hasProviderChild || session.journal.isReadOnly) {
+  if (!session?.child || session.journal.isReadOnly) {
     return null
   }
   const snapshot = session.journal.snapshot()
+  // A queued message reached no agent, so it is no work to resume: quit rejects it as never sent.
+  const handedOver = snapshot.submissions.filter(
+    (submission) => !isQueuedAgentJournalSubmission(submission)
+  )
   const roster = input.backgroundTasks(sessionId)
-  const status = structuredAgentSessionShownStatus(snapshot, roster, session.fence)
+  const status = structuredAgentSessionShownStatus(
+    { items: snapshot.items, submissions: handedOver },
+    roster,
+    session.child.fence
+  )
   if (status.state === 'done') {
     return null
   }
-  const work = structuredAgentSessionResumeWork(snapshot.items, snapshot.submissions)
+  const work = structuredAgentSessionResumeWork(snapshot.items, handedOver)
   const head = agentSessionProviderHandleChainHead(
     input.getRecord(sessionId)?.providerHandleChain ?? []
   )
@@ -184,6 +217,7 @@ export function structuredAgentSessionWorkingAtStop(input: {
     recordedAt: input.now,
     trigger: input.trigger,
     teardownId: input.teardownId,
+    journalCursor: snapshot.cursor,
     // Root, not key: the close path advances Claude's leaf moments after this runs, and a key
     // comparison would then refuse the session forever.
     providerHandleRoot: agentSessionProviderHandleRoot(head.handle),
diff --git a/src/main/native-chat/agent-session-wire/structured-compaction-recovery.ts b/src/main/native-chat/agent-session-wire/structured-compaction-recovery.ts
deleted file mode 100644
index 2199da05392..00000000000
--- a/src/main/native-chat/agent-session-wire/structured-compaction-recovery.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
-import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
-
-/** A newly acquired owner cannot still be executing the previous owner's command. */
-export async function recoverInterruptedCompaction(
-  store: AgentSessionRecordStore,
-  sessionId: string,
-  journal: AgentSessionJournal,
-  fence: number
-): Promise<void> {
-  const command = store.getRecord(sessionId)?.conversationCommand
-  if (
-    command?.command !== 'compact' ||
-    command.phase !== 'prepared' ||
-    command.runtimeFence === undefined ||
-    command.runtimeFence === fence
-  ) {
-    return
-  }
-  const error = 'Previous compaction completion could not be confirmed after session recovery.'
-  await journal.appendItem(
-    { provider: 'orca', clientMessageId: `compact:${command.operationId}` },
-    { kind: 'status', text: error },
-    { fence }
-  )
-  const recovered = { ...command, phase: 'committed' as const, state: 'unknown' as const, error }
-  await store.setConversationCommand(sessionId, fence, recovered)
-  await store.recordOperationOutcome({
-    callerKey: command.callerKey,
-    operationId: command.operationId,
-    outcome: { status: 'succeeded', sessionId, conversationCommand: recovered }
-  })
-}
diff --git a/src/main/native-chat/agent-session-wire/structured-conversation-command-admission.test.ts b/src/main/native-chat/agent-session-wire/structured-conversation-command-admission.test.ts
index 5a3370c910f..0acdb2dbbce 100644
--- a/src/main/native-chat/agent-session-wire/structured-conversation-command-admission.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-conversation-command-admission.test.ts
@@ -29,12 +29,12 @@ describe('conversationCommandBlocked background tasks', () => {
       contextWith({ state: 'monitoring', supportsTaskStop: true }),
       RECORD
     )
-    expect(blocked).toBe('Stop background tasks before using this command.')
+    expect(blocked?.message).toBe('Stop background tasks before using this command.')
   })
 
   it('asks for a stop on a host that predates the stop-capability field', () => {
     const blocked = conversationCommandBlocked(contextWith({ state: 'monitoring' }), RECORD)
-    expect(blocked).toBe('Stop background tasks before using this command.')
+    expect(blocked?.message).toBe('Stop background tasks before using this command.')
   })
 
   it('asks the user to wait when the provider exposes no stop at all', () => {
@@ -43,7 +43,7 @@ describe('conversationCommandBlocked background tasks', () => {
       contextWith({ state: 'monitoring', supportsStopAll: false }),
       RECORD
     )
-    expect(blocked).toBe('Wait for background tasks to finish before using this command.')
+    expect(blocked?.message).toBe('Wait for background tasks to finish before using this command.')
   })
 
   it('still refuses on the open turn, not on the work the strip now shows', () => {
@@ -63,8 +63,77 @@ describe('conversationCommandBlocked background tasks', () => {
           }
         ]
       }) as unknown as ReturnType<typeof ctx.journal.snapshot>
-    expect(conversationCommandBlocked(ctx, RECORD)).toBe(
+    expect(conversationCommandBlocked(ctx, RECORD)?.message).toBe(
       'Wait for the current turn to finish before using this command.'
     )
   })
 })
+
+describe('conversationCommandBlocked for a command sent at rest (C6, B3)', () => {
+  const staleTurn = {
+    items: [{ itemId: 'turn-1', body: { kind: 'turn', turnId: 'turn-1', state: 'running' } }]
+  }
+
+  it("does not refuse over a dead generation's running turn, which the start sweeps", () => {
+    const ctx = contextWith(null)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the admission reads only each item's body.
+    ctx.journal.snapshot = () => staleTurn as never
+    expect(conversationCommandBlocked(ctx, RECORD, 'at-rest')).toBeNull()
+    expect(conversationCommandBlocked(ctx, RECORD)).toMatchObject({
+      details: { reason: 'turnActive' },
+      message: 'Wait for the current turn to finish before using this command.'
+    })
+  })
+
+  it("ignores an older build's compaction record", () => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the admission reads only the lease and the command record.
+    const record = {
+      lease: {},
+      conversationCommand: { command: 'compact', phase: 'prepared', state: 'unknown' }
+    } as unknown as AgentSessionRecord
+    expect(conversationCommandBlocked(contextWith(null), record)).toBeNull()
+  })
+
+  // A clear's commit is its only durable write, so a record short of it never changed the chat.
+  it("ignores a clear that never committed, as an older build's record leaves one", () => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the admission reads only the lease and the command record.
+    const record = {
+      lease: {},
+      conversationCommand: {
+        command: 'clear',
+        phase: 'prepared',
+        state: 'unknown',
+        replacementSessionId: 'clear-replacement'
+      }
+    } as unknown as AgentSessionRecord
+    expect(conversationCommandBlocked(contextWith(null), record)).toBeNull()
+  })
+
+  it('refuses on a committed clear', () => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the admission reads only the lease and the command record.
+    const record = {
+      lease: {},
+      conversationCommand: {
+        command: 'clear',
+        phase: 'committed',
+        state: 'completed',
+        replacementSessionId: 'clear-replacement'
+      }
+    } as unknown as AgentSessionRecord
+    expect(conversationCommandBlocked(contextWith(null), record)).toMatchObject({
+      code: 'agent_session_operation_invalid',
+      details: { reason: 'conversationCleared' }
+    })
+  })
+
+  it('at handover, lets the command itself and messages queued behind it wait', () => {
+    const ctx = contextWith(null)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the admission reads only the dispatch fields.
+    const queued = [
+      { clientMessageId: 'command', dispatchState: 'pending', handoverRecorded: true },
+      { clientMessageId: 'behind', dispatchState: 'pending', handoverRecorded: true }
+    ] as never
+    ctx.journal.submissions = () => queued
+    expect(conversationCommandBlocked(ctx, RECORD, 'handover')).toBeNull()
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-conversation-command-admission.ts b/src/main/native-chat/agent-session-wire/structured-conversation-command-admission.ts
index 78b9f4a59d0..937f63733c5 100644
--- a/src/main/native-chat/agent-session-wire/structured-conversation-command-admission.ts
+++ b/src/main/native-chat/agent-session-wire/structured-conversation-command-admission.ts
@@ -1,33 +1,55 @@
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
 import { activeStructuredAgentSessionTurnId } from '../../../shared/structured-agent-session-projection'
 import type { AgentSessionTurnContext } from './structured-agent-session-turns'
+import {
+  refuse,
+  type AgentSessionRefusalReason,
+  type AgentSessionWireRefusal
+} from '../../../shared/agent-session-wire-refusals'
 
+function blocked(
+  reason: AgentSessionRefusalReason<'agent_session_operation_invalid'>,
+  message: string
+): AgentSessionWireRefusal {
+  return refuse('agent_session_operation_invalid', { reason }, message)
+}
+
+export function conversationCommandInFlight(): AgentSessionWireRefusal {
+  return blocked('conversationCommandInFlight', 'Wait for the conversation operation to finish.')
+}
+
+/**
+ * Why a conversation command may not run now; null when it may.
+ *
+ * `at-rest`: a command accepted with no child running. A running turn on record then belongs to a
+ * dead generation, which the start before handover sweeps, so it refuses nothing yet.
+ * `handover`: the command is the oldest queued message, and those queued behind it wait for it.
+ */
 export function conversationCommandBlocked(
-  ctx: AgentSessionTurnContext,
-  record: AgentSessionRecord
-): string | null {
+  ctx: Pick<AgentSessionTurnContext, 'journal' | 'adapter' | 'sessionId' | 'fence'>,
+  record: AgentSessionRecord,
+  admission?: 'at-rest' | 'handover'
+): AgentSessionWireRefusal | null {
   const items = ctx.journal.snapshot().items
   if (record.rewind?.phase === 'prepared' || record.rewind?.phase === 'provider-succeeded') {
-    return 'agent_session_rewind:outcome-unknown'
+    return blocked('rewindUnconfirmed', 'agent_session_rewind:outcome-unknown')
   }
   if (
     record.conversationCommand?.command === 'clear' &&
     record.conversationCommand.phase === 'committed' &&
     record.conversationCommand.replacementSessionId
   ) {
-    return 'This conversation has been cleared. Open the current conversation to continue.'
-  }
-  if (
-    record.conversationCommand?.state === 'unknown' &&
-    record.conversationCommand.phase === 'prepared'
-  ) {
-    return 'The previous conversation operation is unconfirmed.'
+    return blocked(
+      'conversationCleared',
+      'This conversation has been cleared. Open the current conversation to continue.'
+    )
   }
   if (record.lease.handoffStage || record.lease.handoffOperationId) {
-    return 'Wait for the session handoff to finish.'
+    return blocked('handoffInFlight', 'Wait for the session handoff to finish.')
   }
-  if (activeStructuredAgentSessionTurnId(items)) {
-    return 'Wait for the current turn to finish before using this command.'
+  if (admission !== 'at-rest' && activeStructuredAgentSessionTurnId(items)) {
+    return blocked('turnActive', 'Wait for the current turn to finish before using this command.')
   }
   if (
     items.some(
@@ -36,23 +58,36 @@ export function conversationCommandBlocked(
         item.body.resolution.state === 'pending'
     )
   ) {
-    return 'Resolve the pending question or approval before using this command.'
+    return blocked(
+      'promptPending',
+      'Resolve the pending question or approval before using this command.'
+    )
   }
   const backgroundTasks = ctx.adapter.backgroundTaskState?.(ctx.sessionId)
   if (backgroundTasks?.state === 'monitoring') {
     // Only ask for a stop the host can actually perform. A provider that
     // exposes neither a targeted nor an untargeted stop would otherwise leave
     // the command refused behind an instruction nobody can follow.
-    return backgroundTasks.supportsTaskStop || backgroundTasks.supportsStopAll !== false
-      ? 'Stop background tasks before using this command.'
-      : 'Wait for background tasks to finish before using this command.'
+    return blocked(
+      'backgroundTasksRunning',
+      backgroundTasks.supportsTaskStop || backgroundTasks.supportsStopAll !== false
+        ? 'Stop background tasks before using this command.'
+        : 'Wait for background tasks to finish before using this command.'
+    )
   }
   if (
-    ctx.journal
-      .submissions()
-      .some((entry) => entry.dispatchState === 'pending' || entry.dispatchState === 'unknown')
+    ctx.journal.submissions().some(
+      (entry) =>
+        (entry.dispatchState === 'pending' &&
+          !(admission === 'handover' && isQueuedAgentJournalSubmission(entry))) ||
+        // Doubt left by an earlier child is not this one's work in flight.
+        (entry.dispatchState === 'unknown' && entry.recovered !== true && entry.fence === ctx.fence)
+    )
   ) {
-    return 'Resolve pending or unconfirmed messages before using this command.'
+    return blocked(
+      'messagesUnsettled',
+      'Resolve pending or unconfirmed messages before using this command.'
+    )
   }
   return null
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-conversation-command-controller.ts b/src/main/native-chat/agent-session-wire/structured-conversation-command-controller.ts
index e5a0283ba83..4e4e42c46e4 100644
--- a/src/main/native-chat/agent-session-wire/structured-conversation-command-controller.ts
+++ b/src/main/native-chat/agent-session-wire/structured-conversation-command-controller.ts
@@ -1,43 +1,41 @@
+import { conversationCommandInFlight } from './structured-conversation-command-admission'
 import { sendStructuredAgentSessionTurn } from './structured-agent-session-host-mutations'
 import {
   runStructuredConversationCommand,
   type ConversationCommandParams
 } from './structured-conversation-command'
+import { runStructuredCompaction } from './structured-conversation-compaction'
 import type { StructuredAgentSessionMutationContext } from './structured-agent-session-host-mutations'
 import type { StructuredAgentSessionCaller } from './structured-agent-session-host-types'
 import type { StructuredAgentSessionHost } from './structured-agent-session-host'
 
 export class StructuredConversationCommandController {
+  /** Held only by a clear, which replaces the conversation a send would land in. A compaction is
+   *  a queued message, and sends accepted behind it wait for it in the queue. */
   readonly pending = new Map<string, { key: string; count: number }>()
   constructor(
     private readonly context: () => StructuredAgentSessionMutationContext,
-    private readonly host: Pick<StructuredAgentSessionHost, 'attach' | 'flushStreamedEvents'>
+    private readonly host: Pick<
+      StructuredAgentSessionHost,
+      'attach' | 'flushStreamedEvents' | 'waitForSendSettlement'
+    >
   ) {}
   send = (
     caller: StructuredAgentSessionCaller,
     params: Parameters<typeof sendStructuredAgentSessionTurn>[2]
   ): ReturnType<typeof sendStructuredAgentSessionTurn> =>
     this.pending.has(params.envelope.sessionId)
-      ? Promise.resolve({
-          ok: false,
-          refusal: {
-            code: 'agent_session_operation_invalid',
-            message: 'Wait for the conversation operation to finish.'
-          }
-        })
+      ? Promise.resolve({ ok: false, refusal: conversationCommandInFlight() })
       : sendStructuredAgentSessionTurn(this.context(), caller, params)
 
   run = (caller: StructuredAgentSessionCaller, params: ConversationCommandParams) => {
+    if (params.command === 'compact') {
+      return runStructuredCompaction(this.context(), this.host, caller, params)
+    }
     const key = JSON.stringify([caller.callerKey, params.envelope.clientOperationId])
     const pending = this.pending.get(params.envelope.sessionId)
     if (pending && pending.key !== key) {
-      return Promise.resolve({
-        ok: false as const,
-        refusal: {
-          code: 'agent_session_operation_invalid' as const,
-          message: 'Wait for the conversation operation to finish.'
-        }
-      })
+      return Promise.resolve({ ok: false as const, refusal: conversationCommandInFlight() })
     }
     const entry = pending ?? { key, count: 0 }
     entry.count++
@@ -47,6 +45,9 @@ export class StructuredConversationCommandController {
         if (--entry.count === 0 && this.pending.get(params.envelope.sessionId) === entry) {
           this.pending.delete(params.envelope.sessionId)
         }
+        // A clear can settle with no journal commit (a failed attach), and drafts held behind
+        // its prepared phase would otherwise wait for an unrelated commit.
+        this.context().wakeQueuedDrain?.(params.envelope.sessionId)
       }
     )
   }
diff --git a/src/main/native-chat/agent-session-wire/structured-conversation-command-outcome.test.ts b/src/main/native-chat/agent-session-wire/structured-conversation-command-outcome.test.ts
new file mode 100644
index 00000000000..a2c0e9aef6b
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-conversation-command-outcome.test.ts
@@ -0,0 +1,46 @@
+import { describe, expect, it } from 'vitest'
+import { structuredCompactionOutcome } from './structured-conversation-command-outcome'
+
+describe('structuredCompactionOutcome', () => {
+  it('is a success only when the provider reported the compaction', () => {
+    expect(structuredCompactionOutcome({ compacted: true, interruptRequested: true })).toEqual({
+      outcome: 'success'
+    })
+  })
+
+  it("reads no compaction after Orca's interrupt as the user's cancellation", () => {
+    expect(
+      structuredCompactionOutcome({
+        compacted: false,
+        interruptRequested: true,
+        failed: { detail: { text: 'API Error: Request was aborted.', audience: 'person' } }
+      })
+    ).toEqual({ outcome: 'cancellation' })
+  })
+
+  it("reads a failure the provider reported as a failed compaction, keeping the provider's words", () => {
+    expect(
+      structuredCompactionOutcome({
+        compacted: false,
+        interruptRequested: false,
+        failed: { detail: { text: 'Not enough messages to compact.', audience: 'person' } }
+      })
+    ).toEqual({
+      outcome: 'failure',
+      failure: {
+        kind: 'compactionFailed',
+        detail: { text: 'Not enough messages to compact.', audience: 'person' }
+      }
+    })
+    expect(
+      structuredCompactionOutcome({ compacted: false, interruptRequested: false, failed: {} })
+    ).toEqual({ outcome: 'failure', failure: { kind: 'compactionFailed' } })
+  })
+
+  it('reads a compaction the provider never reported as a failure it did not confirm', () => {
+    expect(structuredCompactionOutcome({ compacted: false, interruptRequested: false })).toEqual({
+      outcome: 'failure',
+      failure: { kind: 'compactionUnconfirmed' }
+    })
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-conversation-command-outcome.ts b/src/main/native-chat/agent-session-wire/structured-conversation-command-outcome.ts
new file mode 100644
index 00000000000..cc9513a6ad1
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-conversation-command-outcome.ts
@@ -0,0 +1,44 @@
+// How a conversation command the provider ran ended, read the same way for every provider.
+
+import {
+  agentSessionFailureFact,
+  type AgentSessionFailureFact,
+  type ProviderDiagnostic
+} from '../../../shared/agent-session-failure'
+
+export type StructuredConversationCommandOutcome = {
+  outcome: 'success' | 'failure' | 'cancellation'
+  /** On a failure: what its row reports. */
+  failure?: AgentSessionFailureFact
+}
+
+/** What the provider showed of one compaction while it ran. */
+export type StructuredCompactionEvidence = {
+  /** The provider reported the conversation compacted: Claude's boundary, Codex's item. */
+  compacted: boolean
+  /** Orca asked the provider to stop the command. */
+  interruptRequested: boolean
+  /** The provider said the compaction failed, with its words for a person when it gave any. */
+  failed?: { detail?: ProviderDiagnostic } | null
+}
+
+/** Only a compaction the provider reported doing is a success: Claude answers a stopped `/compact`
+ *  with the same success result as a finished one, so the result's own verdict cannot decide. With
+ *  none, one Orca asked to stop is the user's cancellation; anything else failed — reported as the
+ *  provider's failure when it said so, and otherwise as a compaction it never confirmed. */
+export function structuredCompactionOutcome(
+  evidence: StructuredCompactionEvidence
+): StructuredConversationCommandOutcome {
+  if (evidence.compacted) {
+    return { outcome: 'success' }
+  }
+  if (evidence.interruptRequested) {
+    return { outcome: 'cancellation' }
+  }
+  return {
+    outcome: 'failure',
+    failure: evidence.failed
+      ? agentSessionFailureFact('compactionFailed', { detail: evidence.failed.detail })
+      : agentSessionFailureFact('compactionUnconfirmed')
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-conversation-command.test.ts b/src/main/native-chat/agent-session-wire/structured-conversation-command.test.ts
index a261c6dd151..3380c7fd136 100644
--- a/src/main/native-chat/agent-session-wire/structured-conversation-command.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-conversation-command.test.ts
@@ -1,12 +1,18 @@
-import { mkdtemp, rm } from 'node:fs/promises'
+import { cp, mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS } from '../../../shared/agent-session-host-authority'
 import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
 import type { AgentSessionConversationCommand } from '../../../shared/agent-session-conversation-command'
+import type { AgentSessionOwnerProbe } from '../../../shared/agent-session-lease-adjudication'
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
-import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import {
+  AgentSessionAcquisitionRefusal,
+  type StructuredAgentSessionAdapter
+} from './structured-agent-session-adapter'
+import { STRUCTURED_AGENT_SESSION_IDLE_MS } from './structured-agent-session-idle-sweep'
 import {
   HOST_TEST_NOW,
   HOST_TEST_SESSION,
@@ -18,37 +24,80 @@ import {
 
 const caller = { callerKey: 'desktop' }
 let directory: string
+let generation: number
+let clock: number
 let store: AgentSessionRecordStore
 let host: StructuredAgentSessionHost
+let hosts: StructuredAgentSessionHost[]
 let adapter: StructuredAgentSessionAdapter
 const compact = vi.fn<NonNullable<StructuredAgentSessionAdapter['compact']>>()
 let acquisitions = 0
 
-function commandParams(command: AgentSessionConversationCommand) {
+function envelope(method: string, fields: Record<string, unknown>) {
   return {
-    command,
-    envelope: {
+    sessionId: HOST_TEST_SESSION,
+    clientOperationId: hostTestOperationId(),
+    expectedRuntimeFence: store.getRecord(HOST_TEST_SESSION)!.lease.runtimeFence,
+    payloadFingerprint: computeAgentSessionPayloadFingerprint({
+      method,
       sessionId: HOST_TEST_SESSION,
-      clientOperationId: hostTestOperationId(),
-      expectedRuntimeFence: store.getRecord(HOST_TEST_SESSION)!.lease.runtimeFence,
-      payloadFingerprint: computeAgentSessionPayloadFingerprint({
-        method: 'agentSession.conversationCommand',
-        sessionId: HOST_TEST_SESSION,
-        fields: { command }
-      })
-    }
+      fields
+    })
   }
 }
 
+function commandParams(command: AgentSessionConversationCommand) {
+  return { command, envelope: envelope('agentSession.conversationCommand', { command }) }
+}
+
+function sendParams(text: string) {
+  const body = hostTestMessage(text)
+  return { body, envelope: envelope('agentSession.send', { body }) }
+}
+
+const generationRoot = () => join(directory, `generation-${generation}`)
+
+let ownerProbe: AgentSessionOwnerProbe = { outcome: 'pid-absent' }
+
+async function openHost(): Promise<void> {
+  store = await AgentSessionRecordStore.open({
+    directory: join(generationRoot(), 'store'),
+    hostId: 'local'
+  })
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter,
+    journalRoot: generationRoot(),
+    claimKeyId: 'key',
+    now: () => clock,
+    mintSpawnToken: () => `spawn-${acquisitions}`,
+    // The owners a restarted host finds died with the process that started them, unless a test says otherwise.
+    probeOwner: async () => ownerProbe
+  })
+  hosts.push(host)
+}
+
+/** A crash and relaunch: the next host opens what the dying one had written, and nothing after. */
+async function restartHost(): Promise<void> {
+  await store.renewLeases([])
+  const dying = generationRoot()
+  generation++
+  await cp(dying, generationRoot(), {
+    recursive: true,
+    filter: (source) => !source.endsWith('.tmp') && !source.includes('.lock')
+  })
+  await openHost()
+}
+
 beforeEach(async () => {
   resetHostTestOperationIds()
+  ownerProbe = { outcome: 'pid-absent' }
   acquisitions = 0
-  compact.mockReset().mockResolvedValue({})
+  generation = 0
+  clock = HOST_TEST_NOW
+  hosts = []
+  compact.mockReset().mockResolvedValue({ state: 'accepted', providerIdentity: null })
   directory = await mkdtemp(join(tmpdir(), 'orca-conversation-command-'))
-  store = await AgentSessionRecordStore.open({
-    directory: join(directory, 'store'),
-    hostId: 'local'
-  })
   adapter = {
     supportsLocation: (location) =>
       location.executionHostId === 'local' && location.wslDistro === null,
@@ -81,18 +130,11 @@ beforeEach(async () => {
     answerPrompt: async () => {},
     setOption: async () => {},
     compact,
-    releaseAcquisition: async () => true,
-    closeSession: async () => true,
+    releaseAcquisition: vi.fn(async () => true),
+    closeSession: vi.fn(async () => true),
     readOptions: async () => ({ models: [], current: { model: 'test-model', effort: 'high' } })
   }
-  host = new StructuredAgentSessionHost({
-    store,
-    adapter,
-    journalRoot: directory,
-    claimKeyId: 'key',
-    now: () => HOST_TEST_NOW,
-    mintSpawnToken: () => `spawn-${acquisitions}`
-  })
+  await openHost()
   expect(
     await host.attach(caller, hostTestAttachParams(null, { options: { effort: 'low' } }))
   ).toMatchObject({ ok: true })
@@ -100,54 +142,13 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
-  await host.flushAllStreamedEvents()
+  for (const each of hosts) {
+    await each.flushAllStreamedEvents()
+  }
   await rm(directory, { recursive: true, force: true })
 })
 
 describe('host conversation commands', () => {
-  it('compacts once without an ordinary message submission and replays its receipt', async () => {
-    const params = commandParams('compact')
-    expect(await host.conversationCommand(caller, params)).toMatchObject({
-      ok: true,
-      value: { state: 'completed' }
-    })
-    expect(await host.conversationCommand(caller, params)).toMatchObject({
-      ok: true,
-      replayed: true
-    })
-    expect(compact).toHaveBeenCalledTimes(1)
-    expect(adapter.dispatch).not.toHaveBeenCalled()
-    const history = host.history({ sessionId: HOST_TEST_SESSION, direction: 'tail' })
-    expect(history.page.submissions).toEqual([])
-    expect(
-      history.page.items.some(
-        (item) => item.body.kind === 'status' && item.body.turnLifecycle?.state === 'running'
-      )
-    ).toBe(false)
-  })
-
-  it('reports provider compaction failure without a stuck lifecycle', async () => {
-    compact.mockResolvedValue({ error: 'Not enough messages to compact.' })
-    expect(await host.conversationCommand(caller, commandParams('compact'))).toMatchObject({
-      ok: true,
-      value: { state: 'completed', error: 'Not enough messages to compact.' }
-    })
-    expect(store.getRecord(HOST_TEST_SESSION)?.conversationCommand?.state).toBe('completed')
-  })
-
-  it('keeps an unknown compaction from being executed again', async () => {
-    compact.mockRejectedValue(new Error('connection lost'))
-    const params = commandParams('compact')
-    await expect(host.conversationCommand(caller, params)).rejects.toThrow('connection lost')
-    expect(await host.conversationCommand(caller, params)).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_operation_unknown' }
-    })
-    expect(compact).toHaveBeenCalledTimes(1)
-  })
-
-  /** The replacement seeds from what the provider reports now, not from what the
-   *  retired record happened to store — the same rule acquire and handoff apply. */
   it('adopts the reported Fast preference into the replacement record', async () => {
     adapter.readOptions = async () => ({
       models: [],
@@ -204,7 +205,7 @@ describe('host conversation commands', () => {
     })
     expect(store.getRecord(HOST_TEST_SESSION)).not.toBeNull()
     expect(store.listVisibleSessionIds()).toEqual([nextId])
-    expect(host.history({ sessionId: nextId, direction: 'tail' }).page.items).toEqual([])
+    expect((await host.history({ sessionId: nextId, direction: 'tail' })).page.items).toEqual([])
     expect(await host.conversationCommand(caller, params)).toMatchObject({
       ok: true,
       replayed: true,
@@ -236,7 +237,13 @@ describe('host conversation commands', () => {
     })
     expect(await host.conversationCommand(caller, commandParams('clear'))).toMatchObject({
       ok: true,
-      value: { state: 'completed', replacementSessionId: undefined, error: expect.any(String) }
+      value: {
+        state: 'completed',
+        replacementSessionId: undefined,
+        // The refusal's message is Orca's log text; the result words its situation.
+        error: "Codex couldn't start. Start a new chat to continue.",
+        failure: { kind: 'startFailed', refusal: { code: 'structured_agent_session_unsupported' } }
+      }
     })
     expect(store.listVisibleSessionIds()).toEqual([HOST_TEST_SESSION])
     expect(acquisitions).toBe(1)
@@ -245,48 +252,37 @@ describe('host conversation commands', () => {
     })
   })
 
-  it('rejects stale fences before provider execution', async () => {
-    const params = commandParams('compact')
-    params.envelope.expectedRuntimeFence++
-    expect(await host.conversationCommand(caller, params)).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_checkpoint_stale' }
+  it('tells the user to run /clear again when the replacement could not start', async () => {
+    vi.mocked(adapter.acquire).mockRejectedValueOnce(new Error('spawn codex ENOENT'))
+    expect(await host.conversationCommand(caller, commandParams('clear'))).toMatchObject({
+      ok: true,
+      value: { state: 'completed', error: "Codex couldn't start. Run /clear again." }
     })
-    expect(compact).not.toHaveBeenCalled()
-  })
-  it('allows cancellation while compaction is awaiting completion and refuses a second client', async () => {
-    let finish!: (value: {}) => void
-    compact.mockImplementation(
-      () =>
-        new Promise((resolve) => {
-          finish = resolve
-        })
-    )
-    const params = commandParams('compact')
-    const running = host.conversationCommand(caller, params)
-    await vi.waitFor(() => expect(compact).toHaveBeenCalled())
-    expect(
-      await host.conversationCommand({ callerKey: 'mobile' }, commandParams('clear'))
-    ).toMatchObject({ ok: false })
-    const turnId = `compact:${params.envelope.clientOperationId}`
-    const cancel = await host.cancel(caller, {
-      turnId,
-      envelope: {
-        ...params.envelope,
-        clientOperationId: hostTestOperationId(),
-        payloadFingerprint: computeAgentSessionPayloadFingerprint({
-          method: 'agentSession.cancel',
-          sessionId: HOST_TEST_SESSION,
-          fields: { turnId }
-        })
-      }
-    })
-    expect(cancel).toMatchObject({ ok: true, value: { cancelled: true } })
-    expect(adapter.cancelTurn).toHaveBeenCalled()
-    finish({})
-    await running
   })
 
+  it('keeps the situation a refused replacement start named', async () => {
+    vi.mocked(adapter.acquire).mockRejectedValueOnce(
+      new AgentSessionAcquisitionRefusal('Codex is not signed in.', 'notSignedIn')
+    )
+    expect(await host.conversationCommand(caller, commandParams('clear'))).toMatchObject({
+      ok: true,
+      value: {
+        state: 'completed',
+        replacementSessionId: undefined,
+        // The next step is the command the user ran, not a message into the old conversation.
+        error: 'Codex is not signed in for the selected account. Sign in, then run /clear again.',
+        failure: { kind: 'notSignedIn' }
+      }
+    })
+    expect(store.listVisibleSessionIds()).toEqual([HOST_TEST_SESSION])
+  })
+
+  it('runs a command whose fence the client has not caught up to', async () => {
+    const params = commandParams('compact')
+    params.envelope.expectedRuntimeFence++
+    expect(await host.conversationCommand(caller, params)).toMatchObject({ ok: true })
+    await vi.waitFor(() => expect(compact).toHaveBeenCalledTimes(1))
+  })
   it('reconstructs a committed replacement after the ledger settlement is lost', async () => {
     const persist = store.recordOperationOutcome.bind(store)
     vi.spyOn(store, 'recordOperationOutcome').mockImplementation(async (input) => {
@@ -305,19 +301,6 @@ describe('host conversation commands', () => {
     expect(acquisitions).toBe(2)
   })
 
-  it('repairs an unknown receipt when the provider completes late', async () => {
-    compact.mockRejectedValue(new Error('connection lost'))
-    const params = commandParams('compact')
-    await expect(host.conversationCommand(caller, params)).rejects.toThrow()
-    await compact.mock.calls[0]![0].onLateResult?.({})
-    expect(await host.conversationCommand(caller, params)).toMatchObject({
-      ok: true,
-      replayed: true,
-      value: { state: 'completed' }
-    })
-    expect(compact).toHaveBeenCalledTimes(1)
-  })
-
   it('keeps explicitly revealed history and closed replacement tabs out of automatic restoration', async () => {
     const result = await host.conversationCommand(caller, commandParams('clear'))
     if (!result.ok) {
@@ -330,26 +313,383 @@ describe('host conversation commands', () => {
     await host.setSessionTabVisibility(result.value.replacementSessionId!, false)
     expect(host.conversationReplacements()).toEqual([])
   })
-  it('keeps the old compact outcome unknown but restores usability after verified reacquisition', async () => {
-    compact.mockRejectedValue(new Error('lost response'))
-    const params = commandParams('compact')
-    await expect(host.conversationCommand(caller, params)).rejects.toThrow()
-    await host.close(HOST_TEST_SESSION)
-    const fence = store.getRecord(HOST_TEST_SESSION)!.lease.runtimeFence
-    expect(await host.attach(caller, hostTestAttachParams(fence))).toMatchObject({ ok: true })
-    expect(store.getRecord(HOST_TEST_SESSION)?.conversationCommand).toMatchObject({
-      phase: 'committed',
-      state: 'unknown'
+})
+
+describe('a clear that never committed', () => {
+  /** The replacement's start answers with a refusal that proves nothing either way. */
+  function refuseReplacementStartOnce() {
+    vi.spyOn(host, 'attach').mockResolvedValueOnce({
+      ok: false,
+      refusal: { code: 'agent_session_operation_capacity', message: 'Too many operations.' }
     })
+  }
+
+  async function clearCommits(params = commandParams('clear')) {
+    const result = await host.conversationCommand(caller, params)
+    expect(result).toMatchObject({
+      ok: true,
+      value: { state: 'completed', replacementSessionId: expect.any(String) }
+    })
+    return result.ok ? result.value.replacementSessionId! : ''
+  }
+
+  it('refuses nothing afterwards: a rewind, a compaction and a send all run', async () => {
+    adapter.rewindSupport = () => ({ supported: true })
+    refuseReplacementStartOnce()
+    await expect(host.conversationCommand(caller, commandParams('clear'))).rejects.toThrow(
+      'Too many operations.'
+    )
+    // Past every conversation check: only the stale epoch it names stops it.
+    expect(
+      await host.rewind(caller, {
+        envelope: envelope('agentSession.rewind', {
+          itemId: 'item-1',
+          expectedEpoch: 'stale-epoch'
+        }),
+        itemId: 'item-1',
+        expectedEpoch: 'stale-epoch'
+      })
+    ).toMatchObject({ ok: false, refusal: { rewindReason: 'stale-epoch' } })
+    expect(await host.conversationCommand(caller, commandParams('compact'))).toMatchObject({
+      ok: true
+    })
+    expect(await host.send(caller, sendParams('still here'))).toMatchObject({ ok: true })
+  })
+
+  it('lets a clear under a new operation id commit', async () => {
+    refuseReplacementStartOnce()
+    await expect(host.conversationCommand(caller, commandParams('clear'))).rejects.toThrow()
+    const replacement = await clearCommits()
+    expect(store.listVisibleSessionIds()).toEqual([replacement])
+  })
+
+  // Its id is too old to start anything now, and it started nothing to finish.
+  it('lets a clear under a new operation id commit a day after a try that started nothing', async () => {
+    refuseReplacementStartOnce()
+    await expect(host.conversationCommand(caller, commandParams('clear'))).rejects.toThrow()
+    clock += AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS + 60_000
+    const params = commandParams('clear')
+    params.envelope.clientOperationId = `${clock}-${'a'.repeat(32)}`
+    await clearCommits(params)
+  })
+
+  it('reruns under the same operation id and starts exactly one replacement', async () => {
+    refuseReplacementStartOnce()
+    const params = commandParams('clear')
+    await expect(host.conversationCommand(caller, params)).rejects.toThrow()
+    expect(acquisitions).toBe(1)
+    await clearCommits(params)
+    expect(acquisitions).toBe(2)
+  })
+
+  /** What an older build left when its clear's outcome was lost: gated every write until now. */
+  async function restartOverAnOlderBuildsUnconfirmedClear() {
+    const record = store.getRecord(HOST_TEST_SESSION)!
+    await store.setConversationCommand(HOST_TEST_SESSION, record.lease.runtimeFence, {
+      command: 'clear',
+      runtimeFence: record.lease.runtimeFence,
+      operationId: hostTestOperationId(),
+      callerKey: caller.callerKey,
+      phase: 'prepared',
+      state: 'unknown',
+      replacementSessionId: 'clear-from-an-older-build'
+    })
+    await restartHost()
+  }
+
+  it("accepts a send on a restarted host holding an older build's unconfirmed clear", async () => {
+    await restartOverAnOlderBuildsUnconfirmedClear()
+    expect(await host.send(caller, sendParams('after the restart'))).toMatchObject({ ok: true })
+  })
+
+  it("clears on a restarted host holding an older build's unconfirmed clear", async () => {
+    await restartOverAnOlderBuildsUnconfirmedClear()
+    await clearCommits()
+  })
+
+  /** A clear whose replacement started but whose commit never landed. */
+  async function clearThatDiesBeforeItsCommit(params = commandParams('clear')): Promise<string> {
+    const commit = store.setConversationCommand.bind(store)
+    let crashed = false
+    vi.spyOn(store, 'setConversationCommand').mockImplementation(async (...args) => {
+      if (!crashed && args[2].phase === 'committed' && args[2].replacementSessionId) {
+        crashed = true
+        throw new Error('crash before the commit')
+      }
+      return commit(...args)
+    })
+    await expect(host.conversationCommand(caller, params)).rejects.toThrow(
+      'crash before the commit'
+    )
+    const [orphan] = store
+      .listRecords()
+      .flatMap((record) => (record.sessionId === HOST_TEST_SESSION ? [] : [record.sessionId]))
+    expect(host.collaboratorsForTests().sessions.get(orphan!)?.child).toBeTruthy()
+    return orphan!
+  }
+
+  function otherRecordIds(): string[] {
+    return store
+      .listRecords()
+      .flatMap((record) => (record.sessionId === HOST_TEST_SESSION ? [] : [record.sessionId]))
+  }
+
+  function startsFor(sessionId: string): number {
+    return vi
+      .mocked(adapter.acquire)
+      .mock.calls.filter(([input]) => input.identity.sessionId === sessionId).length
+  }
+
+  function sendTo(sessionId: string, text: string) {
+    const body = hostTestMessage(text)
+    return host.send(caller, {
+      body,
+      envelope: {
+        sessionId,
+        clientOperationId: hostTestOperationId(),
+        expectedRuntimeFence: store.getRecord(sessionId)!.lease.runtimeFence,
+        payloadFingerprint: computeAgentSessionPayloadFingerprint({
+          method: 'agentSession.send',
+          sessionId,
+          fields: { body }
+        })
+      }
+    })
+  }
+
+  /** The chat reads cleared onto `replacement`, which starts its agent for its first message. */
+  async function expectClearedOnto(replacement: string): Promise<void> {
+    expect(store.listVisibleSessionIds()).toEqual([replacement])
+    expect(host.conversationReplacements().map((entry) => entry.sessionId)).toEqual([replacement])
+    expect(await host.send(caller, sendParams('into the old chat'))).toMatchObject({
+      ok: false,
+      refusal: { details: { reason: 'conversationCleared' } }
+    })
+    const started = startsFor(replacement)
+    expect(await sendTo(replacement, 'first message')).toMatchObject({ ok: true })
+    await vi.waitFor(() => expect(startsFor(replacement)).toBe(started + 1))
+  }
+
+  // A restart stopped the replacement the first try started, which leaves it at rest like any
+  // quiet chat, so the retry switches to it.
+  it('retried under the same operation id after a crash, finishes onto the replacement it started', async () => {
+    const params = commandParams('clear')
+    const orphan = await clearThatDiesBeforeItsCommit(params)
+    await restartHost()
+    await host.restoreReadableSessions(store.listVisibleSessionIds())
+    const result = await host.conversationCommand(caller, params)
+    expect(result).toMatchObject({
+      ok: true,
+      value: { phase: 'committed', state: 'completed', replacementSessionId: orphan }
+    })
+    expect(result.ok && result.value.error).toBeFalsy()
+    expect(otherRecordIds()).toEqual([orphan])
+    expect(startsFor(orphan)).toBe(1)
+    await expectClearedOnto(orphan)
+  })
+
+  it('retried in the same app session once the idle sweep stopped the replacement, finishes onto it', async () => {
+    const params = commandParams('clear')
+    const attach = host.attach.bind(host)
+    // The replacement starts, but the answer the clear gets proves nothing either way.
+    vi.spyOn(host, 'attach').mockImplementationOnce(async (...args) => {
+      await attach(...args)
+      return {
+        ok: false,
+        refusal: { code: 'agent_session_operation_capacity', message: 'Too many operations.' }
+      }
+    })
+    await expect(host.conversationCommand(caller, params)).rejects.toThrow('Too many operations.')
+    const [orphan] = otherRecordIds()
+    expect(store.getRecord(orphan!)?.lease.claimStatus).not.toBe('released')
+    clock += STRUCTURED_AGENT_SESSION_IDLE_MS + 1
+    await host.collaboratorsForTests().lifetime.idleSweep.tick()
+    expect(store.getRecord(orphan!)?.lease).toMatchObject({ claimStatus: 'released' })
+    const result = await host.conversationCommand(caller, params)
+    expect(result).toMatchObject({
+      ok: true,
+      value: { phase: 'committed', state: 'completed', replacementSessionId: orphan }
+    })
+    expect(result.ok && result.value.error).toBeFalsy()
+    expect(startsFor(orphan!)).toBe(1)
+    await expectClearedOnto(orphan!)
+  })
+
+  it('retried after the replacement definitely failed to start, still reads that failure', async () => {
+    vi.mocked(adapter.acquire).mockRejectedValueOnce(
+      new AgentSessionAcquisitionRefusal('Codex is not signed in.', 'notSignedIn')
+    )
+    vi.spyOn(store, 'setConversationCommand').mockRejectedValueOnce(
+      new Error('crash before the commit')
+    )
+    const params = commandParams('clear')
+    await expect(host.conversationCommand(caller, params)).rejects.toThrow(
+      'crash before the commit'
+    )
+    const [replacement] = otherRecordIds()
+    expect(store.getRecord(replacement!)?.lease).toMatchObject({ claimStatus: 'released' })
     expect(await host.conversationCommand(caller, params)).toMatchObject({
       ok: true,
-      replayed: true,
-      value: { state: 'unknown' }
+      value: {
+        state: 'completed',
+        replacementSessionId: undefined,
+        error: 'Codex is not signed in for the selected account. Sign in, then run /clear again.',
+        failure: { kind: 'notSignedIn' }
+      }
     })
-    compact.mockResolvedValue({})
-    expect(await host.conversationCommand(caller, commandParams('compact'))).toMatchObject({
+    expect(startsFor(replacement!)).toBe(1)
+    expect(store.listVisibleSessionIds()).toEqual([HOST_TEST_SESSION])
+  })
+
+  // The client mints a fresh operation id per press; the host still finds that press's earlier try.
+  it('retried under a fresh operation id while its replacement runs, finishes onto it and starts no other', async () => {
+    const orphan = await clearThatDiesBeforeItsCommit()
+    const result = await host.conversationCommand(caller, commandParams('clear'))
+    expect(result).toMatchObject({
       ok: true,
-      value: { state: 'completed' }
+      value: { phase: 'committed', state: 'completed', replacementSessionId: orphan }
     })
+    expect(result.ok && result.value.error).toBeFalsy()
+    expect(otherRecordIds()).toEqual([orphan])
+    expect(startsFor(orphan)).toBe(1)
+    expect(store.listVisibleSessionIds()).toEqual([orphan])
+    expect(host.conversationReplacements().map((entry) => entry.sessionId)).toEqual([orphan])
+    expect(await sendTo(orphan, 'first message')).toMatchObject({ ok: true })
+  })
+
+  it('retried under a fresh operation id after a restart, finishes onto the replacement it started', async () => {
+    const orphan = await clearThatDiesBeforeItsCommit()
+    await restartHost()
+    await host.restoreReadableSessions(store.listVisibleSessionIds())
+    const result = await host.conversationCommand(caller, commandParams('clear'))
+    expect(result).toMatchObject({
+      ok: true,
+      value: { phase: 'committed', state: 'completed', replacementSessionId: orphan }
+    })
+    expect(otherRecordIds()).toEqual([orphan])
+    expect(startsFor(orphan)).toBe(1)
+    expect(store.getRecord(orphan)?.lease).toMatchObject({
+      claimStatus: 'released',
+      ownerProcess: null
+    })
+    await expectClearedOnto(orphan)
+  })
+
+  it("refuses another window's /clear while this one's replacement runs, and runs it once that stops", async () => {
+    const otherWindow = { callerKey: 'mobile' }
+    const orphan = await clearThatDiesBeforeItsCommit()
+    expect(await host.conversationCommand(otherWindow, commandParams('clear'))).toMatchObject({
+      ok: false,
+      refusal: { details: { reason: 'conversationCommandInFlight' } }
+    })
+    expect(otherRecordIds()).toEqual([orphan])
+    clock += STRUCTURED_AGENT_SESSION_IDLE_MS + 1
+    await host.collaboratorsForTests().lifetime.idleSweep.tick()
+    const result = await host.conversationCommand(otherWindow, commandParams('clear'))
+    expect(result).toMatchObject({
+      ok: true,
+      value: { state: 'completed', replacementSessionId: expect.any(String) }
+    })
+    const replacement = result.ok ? result.value.replacementSessionId! : ''
+    expect(replacement).not.toBe(orphan)
+    // Nothing points at the first window's replacement, so nothing lists, opens or starts it.
+    expect(store.listVisibleSessionIds()).toEqual([replacement])
+    expect(host.conversationReplacements().map((entry) => entry.sessionId)).toEqual([replacement])
+    expect(host.collaboratorsForTests().sessions.has(orphan)).toBe(false)
+    expect(store.getRecord(orphan)?.lease).toMatchObject({ claimStatus: 'released' })
+    expect(startsFor(orphan)).toBe(1)
+  })
+
+  function failNextReplacementStart() {
+    vi.mocked(adapter.acquire).mockRejectedValueOnce(
+      new AgentSessionAcquisitionRefusal('Codex is not signed in.', 'notSignedIn')
+    )
+  }
+
+  // The other window's failure is the conversation's latest; this window's own still ended its try.
+  it('starts a new replacement for a /clear after one that committed its failure, in either window', async () => {
+    for (const each of [caller, { callerKey: 'mobile' }]) {
+      failNextReplacementStart()
+      expect(await host.conversationCommand(each, commandParams('clear'))).toMatchObject({
+        ok: true,
+        value: { replacementSessionId: undefined, failure: { kind: 'notSignedIn' } }
+      })
+    }
+    const failed = otherRecordIds()
+    expect(failed).toHaveLength(2)
+    const replacement = await clearCommits()
+    expect(failed).not.toContain(replacement)
+    expect(startsFor(replacement)).toBe(1)
+    expect(store.listVisibleSessionIds()).toEqual([replacement])
+  })
+
+  it('starts a new replacement after a committed failure whose ledger settlement was lost', async () => {
+    failNextReplacementStart()
+    const persist = store.recordOperationOutcome.bind(store)
+    vi.spyOn(store, 'recordOperationOutcome').mockImplementation(async (input) => {
+      if (input.outcome.status === 'succeeded' && input.outcome.conversationCommand) {
+        throw new Error('crash')
+      }
+      return persist(input)
+    })
+    await expect(host.conversationCommand(caller, commandParams('clear'))).rejects.toThrow('crash')
+    vi.mocked(store.recordOperationOutcome).mockRestore()
+    const [failed] = otherRecordIds()
+    const replacement = await clearCommits()
+    expect(replacement).not.toBe(failed)
+    expect(store.listVisibleSessionIds()).toEqual([replacement])
+  })
+
+  it("does not gate another window's /clear on a replacement whose stop is only unproven", async () => {
+    const orphan = await clearThatDiesBeforeItsCommit()
+    ownerProbe = { outcome: 'indeterminate', reason: 'test' }
+    await restartHost()
+    await host.restoreReadableSessions(store.listVisibleSessionIds())
+    expect(store.getRecord(orphan)?.lease.claimStatus).not.toBe('released')
+    const result = await host.conversationCommand({ callerKey: 'mobile' }, commandParams('clear'))
+    expect(result).toMatchObject({
+      ok: true,
+      value: { state: 'completed', replacementSessionId: expect.any(String) }
+    })
+    expect(result.ok && result.value.replacementSessionId).not.toBe(orphan)
+  })
+
+  it('starts afresh when a retry under a new operation id follows a start that definitely failed', async () => {
+    failNextReplacementStart()
+    vi.spyOn(store, 'setConversationCommand').mockRejectedValueOnce(
+      new Error('crash before the commit')
+    )
+    await expect(host.conversationCommand(caller, commandParams('clear'))).rejects.toThrow(
+      'crash before the commit'
+    )
+    const [failed] = otherRecordIds()
+    const result = await host.conversationCommand(caller, commandParams('clear'))
+    expect(result).toMatchObject({
+      ok: true,
+      value: { state: 'completed', replacementSessionId: expect.any(String) }
+    })
+    expect(result.ok && result.value.error).toBeFalsy()
+    expect(result.ok && result.value.replacementSessionId).not.toBe(failed)
+  })
+
+  it('starts afresh when a retry after a restart follows a try whose start never answered', async () => {
+    let hostDies!: (error: Error) => void
+    vi.mocked(adapter.acquire).mockImplementationOnce(
+      () => new Promise((_, reject) => (hostDies = reject))
+    )
+    const dying = host.conversationCommand(caller, commandParams('clear')).catch(() => {})
+    await vi.waitFor(() => expect(otherRecordIds()).toHaveLength(1))
+    const [interrupted] = otherRecordIds()
+    await restartHost()
+    await host.restoreReadableSessions(store.listVisibleSessionIds())
+    const result = await host.conversationCommand(caller, commandParams('clear'))
+    expect(result).toMatchObject({
+      ok: true,
+      value: { state: 'completed', replacementSessionId: expect.any(String) }
+    })
+    expect(result.ok && result.value.error).toBeFalsy()
+    expect(result.ok && result.value.replacementSessionId).not.toBe(interrupted)
+    hostDies(new Error('the host that started it is gone'))
+    await dying
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-conversation-command.ts b/src/main/native-chat/agent-session-wire/structured-conversation-command.ts
index 022343d9407..065ead6e343 100644
--- a/src/main/native-chat/agent-session-wire/structured-conversation-command.ts
+++ b/src/main/native-chat/agent-session-wire/structured-conversation-command.ts
@@ -9,6 +9,10 @@ import type {
   AgentSessionMutationEnvelope,
   AgentSessionMutationResult
 } from '../../../shared/agent-session-wire'
+import {
+  agentSessionLeaseAdmitsWriter,
+  agentSessionLeaseIsReleased
+} from '../../../shared/agent-session-lease-adjudication'
 import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
 import {
   attachFingerprintFields,
@@ -16,9 +20,36 @@ import {
 } from './structured-agent-session-attach'
 import { admitAndRunAgentSessionMutation } from './structured-agent-session-mutation-admission'
 import type { StructuredAgentSessionMutationContext } from './structured-agent-session-host-mutations'
+import {
+  openWithAgent,
+  structuredAgentSessionFailureWordsContext
+} from './structured-agent-session-send-preparation'
 import type { StructuredAgentSessionCaller } from './structured-agent-session-host-types'
 import type { StructuredAgentSessionHost } from './structured-agent-session-host'
-import { conversationCommandBlocked } from './structured-conversation-command-admission'
+import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import {
+  conversationCommandInFlight,
+  conversationCommandBlocked
+} from './structured-conversation-command-admission'
+import type { AgentSessionFailureFact } from '../../../shared/agent-session-failure'
+import {
+  agentSessionFailureWords,
+  type AgentSessionFailureWordsContext
+} from '../../../shared/agent-session-failure-words'
+import { structuredAgentSessionStartFailureFact } from './structured-agent-session-failure-text'
+import { carryQueuedMessagesToClearReplacement } from './structured-agent-session-queued-mutations'
+
+/** A command's `error` is the sentence its row shows. */
+export function conversationCommandFailure(
+  failure: AgentSessionFailureFact | undefined,
+  context: AgentSessionFailureWordsContext = {}
+) {
+  if (!failure) {
+    return {}
+  }
+  const words = agentSessionFailureWords(failure, { ...context, surface: 'row' })
+  return { error: words.text, failure: words.failure }
+}
 
 export type ConversationCommandParams = {
   envelope: AgentSessionMutationEnvelope
@@ -31,6 +62,76 @@ export type ConversationReplacement = {
   agent: 'claude' | 'codex'
 }
 
+/** The replacement a /clear try names, and the operation id of its start. */
+function clearReplacementIds(sessionId: string, callerKey: string, operationId: string) {
+  const digest = createHash('sha256')
+    .update(JSON.stringify([sessionId, callerKey, operationId]))
+    .digest('hex')
+  return {
+    sessionId: `clear-${digest.slice(0, 40)}`,
+    attachOperationId: `${parseAgentSessionOperationTimestamp(operationId)}-${digest.slice(0, 32)}`
+  }
+}
+
+/**
+ * The try this caller's /clear finishes: the oldest since its last commit whose replacement start
+ * reached the ledger, else this one. Read from the ledger in admission order, so a retry under a
+ * fresh operation id finds the replacement an earlier try started.
+ */
+function clearTryToFinish(
+  store: AgentSessionRecordStore,
+  sessionId: string,
+  callerKey: string,
+  clearFingerprint: string,
+  operationId: string
+): string {
+  const committed = store.getRecord(sessionId)?.conversationCommand
+  let earliest: string | null = null
+  for (const row of store.listOperationRows()) {
+    if (row.callerKey !== callerKey || row.fingerprint !== clearFingerprint) {
+      continue
+    }
+    // The record also names a commit whose ledger settlement a crash lost.
+    if (
+      row.outcome.status === 'succeeded' ||
+      (committed?.phase === 'committed' &&
+        committed.callerKey === callerKey &&
+        committed.operationId === row.operationId)
+    ) {
+      earliest = null
+    } else if (earliest === null) {
+      const start = store.getOperationRow(
+        callerKey,
+        clearReplacementIds(sessionId, callerKey, row.operationId).attachOperationId
+      )
+      // Only a start that succeeded left a conversation to finish; replaying any other repeats it.
+      if (start?.outcome.status === 'succeeded') {
+        earliest = row.operationId
+      }
+    }
+  }
+  return earliest ?? operationId
+}
+
+/** Another caller's uncommitted /clear holds a replacement whose agent is running. One whose stop
+ *  is merely unproven gates nothing: only that caller's own start would ever settle it. */
+function otherCallersClearIsLive(
+  store: AgentSessionRecordStore,
+  sessionId: string,
+  callerKey: string,
+  clearFingerprint: string
+): boolean {
+  return store.listOperationRows().some((row) => {
+    if (row.callerKey === callerKey || row.fingerprint !== clearFingerprint) {
+      return false
+    }
+    const replacement = store.getRecord(
+      clearReplacementIds(sessionId, row.callerKey, row.operationId).sessionId
+    )
+    return replacement !== null && agentSessionLeaseAdmitsWriter(replacement.lease)
+  })
+}
+
 export function runStructuredConversationCommand(
   context: StructuredAgentSessionMutationContext,
   host: Pick<StructuredAgentSessionHost, 'attach' | 'flushStreamedEvents'>,
@@ -52,6 +153,8 @@ export function runStructuredConversationCommand(
       adapter: context.deps.adapter,
       callerKey: caller.callerKey,
       envelope,
+      // Only the provider can do this, so an agent at rest is started first.
+      prepareSession: openWithAgent(context, params.envelope),
       journal: () => context.sessions.get(sessionId)?.journal,
       publish: (journal) => context.publish(sessionId, journal),
       flushStreamedEvents: context.flushStreamedEvents,
@@ -66,64 +169,53 @@ export function runStructuredConversationCommand(
             return outcome.conversationCommand
           }
           const prior = matching()
-          if (prior?.phase === 'committed') {
-            return prior
-          }
-          if (command === 'compact' && prior && outcome.status !== 'unknown') {
-            return {
-              command,
-              state: 'unknown',
-              error: 'Compaction completion is unconfirmed; it was not run again.'
-            }
-          }
-          return outcome.status === 'succeeded' && command === 'compact'
-            ? { command, state: 'completed' }
-            : null
+          return prior?.phase === 'committed' ? prior : null
         },
-        rerunWhenReplayMissing: () => command === 'clear' && matching()?.phase === 'prepared',
+        // Nothing the chat reads is written before the commit, so a clear with no committed answer
+        // changed nothing and runs again, finishing the replacement its earliest try started.
+        rerunWhenReplayMissing: () => command === 'clear',
         run: async (ctx) => {
           await host.flushStreamedEvents(sessionId)
           const record = store.getRecord(sessionId)!
-          const prior = matching()
-          const blocked =
-            prior?.phase === 'prepared' && command === 'clear'
-              ? null
-              : conversationCommandBlocked(ctx, record)
+          const blocked = conversationCommandBlocked(ctx, record)
           if (blocked) {
-            return {
-              ok: false,
-              refusal: { code: 'agent_session_operation_invalid', message: blocked }
-            }
+            return { ok: false, refusal: blocked }
           }
-          const replacementSessionId =
-            command === 'clear'
-              ? (prior?.replacementSessionId ??
-                `clear-${createHash('sha256')
-                  .update(JSON.stringify([sessionId, caller.callerKey, clientOperationId]))
-                  .digest('hex')
-                  .slice(0, 40)}`)
-              : undefined
-          const prepared = {
+          let ids: ReturnType<typeof clearReplacementIds> | undefined
+          if (command === 'clear') {
+            const clearFingerprint = computeAgentSessionPayloadFingerprint({
+              method: 'agentSession.conversationCommand',
+              sessionId,
+              fields: { command }
+            })
+            if (otherCallersClearIsLive(store, sessionId, caller.callerKey, clearFingerprint)) {
+              return { ok: false, refusal: conversationCommandInFlight() }
+            }
+            ids = clearReplacementIds(
+              sessionId,
+              caller.callerKey,
+              clearTryToFinish(
+                store,
+                sessionId,
+                caller.callerKey,
+                clearFingerprint,
+                clientOperationId
+              )
+            )
+          }
+          const replacementSessionId = ids?.sessionId
+          const base = {
             command,
             runtimeFence: ctx.fence,
             operationId: clientOperationId,
             callerKey: caller.callerKey,
-            phase: 'prepared' as const,
-            state: 'unknown' as const,
             ...(replacementSessionId ? { replacementSessionId } : {})
           }
-          await store.setConversationCommand(sessionId, ctx.fence, prepared)
-          let error: string | undefined
-          if (command === 'clear' && replacementSessionId) {
+          if (ids) {
             const attach: AgentSessionAttachParams = {
               envelope: {
-                sessionId: replacementSessionId,
-                clientOperationId: `${parseAgentSessionOperationTimestamp(clientOperationId)}-${createHash(
-                  'sha256'
-                )
-                  .update(JSON.stringify([sessionId, caller.callerKey, clientOperationId]))
-                  .digest('hex')
-                  .slice(0, 32)}`,
+                sessionId: ids.sessionId,
+                clientOperationId: ids.attachOperationId,
                 expectedRuntimeFence: null,
                 payloadFingerprint: ''
               },
@@ -138,106 +230,56 @@ export function runStructuredConversationCommand(
             }
             attach.envelope.payloadFingerprint = computeAgentSessionPayloadFingerprint({
               method: 'agentSession.attach',
-              sessionId: replacementSessionId,
+              sessionId: ids.sessionId,
               fields: attachFingerprintFields(attach)
             })
             const acquired = await host.attach(caller, attach)
-            if (!acquired.ok) {
+            const replacement = store.getRecord(ids.sessionId)
+            // An earlier try started this replacement and a restart or the idle sweep has since
+            // stopped it: attach can't replay a settled start, but the new conversation is at rest.
+            const startedAndAtRest =
+              replacement !== null &&
+              agentSessionLeaseIsReleased(replacement.lease) &&
+              store.getOperationRow(caller.callerKey, attach.envelope.clientOperationId)?.outcome
+                .status === 'succeeded'
+            if (!acquired.ok && !startedAndAtRest) {
               if (
                 !isDefinitiveAgentSessionCreateRefusal(acquired.refusal.code) &&
-                store.getRecord(replacementSessionId)?.lease.claimStatus !== 'released'
+                replacement?.lease.claimStatus !== 'released'
               ) {
                 throw new Error(acquired.refusal.message)
               }
+              // The refusal's message is Orca's log text; the result keeps its situation instead.
               const failed = {
-                ...prepared,
+                ...base,
                 replacementSessionId: undefined,
                 phase: 'committed' as const,
                 state: 'completed' as const,
-                error: acquired.refusal.message.slice(0, 4096)
+                ...conversationCommandFailure(
+                  structuredAgentSessionStartFailureFact({
+                    refusal: acquired.refusal,
+                    newSession: true
+                  }),
+                  { ...structuredAgentSessionFailureWordsContext(record), command: 'clear' }
+                )
               }
               await store.setConversationCommand(sessionId, ctx.fence, failed)
               return { ok: true, value: failed }
             }
-          } else {
-            if (!ctx.adapter.compact) {
-              throw new Error('Compaction is unavailable for this provider.')
-            }
-            const identity = {
-              provider: 'orca' as const,
-              clientMessageId: `compact:${clientOperationId}`
-            }
-            await ctx.journal.appendItem(
-              identity,
-              {
-                kind: 'status',
-                text: 'Compacting conversation…',
-                turnLifecycle: { turnId: `compact:${clientOperationId}`, state: 'running' }
-              },
-              { fence: ctx.fence }
-            )
-            ctx.publish()
-            try {
-              error = (
-                await ctx.adapter.compact({
-                  turnId: `compact:${clientOperationId}`,
-                  sessionId,
-                  fence: ctx.fence,
-                  onLateResult: (result) =>
-                    context.serialize(sessionId, async () => {
-                      if (
-                        matching()?.phase !== 'prepared' ||
-                        context.sessions.get(sessionId)?.journal !== ctx.journal
-                      ) {
-                        return
-                      }
-                      await host.flushStreamedEvents(sessionId)
-                      await ctx.journal.appendItem(
-                        identity,
-                        { kind: 'status', text: result.error ?? 'Conversation compacted.' },
-                        { fence: ctx.fence }
-                      )
-                      await store.setConversationCommand(sessionId, ctx.fence, {
-                        ...prepared,
-                        phase: 'committed',
-                        state: 'completed',
-                        ...(result.error ? { error: result.error.slice(0, 4096) } : {})
-                      })
-                      await store.recordOperationOutcome({
-                        callerKey: caller.callerKey,
-                        operationId: clientOperationId,
-                        outcome: {
-                          status: 'succeeded',
-                          sessionId,
-                          conversationCommand: matching()!
-                        }
-                      })
-                      ctx.publish()
-                    })
-                })
-              ).error
-              await host.flushStreamedEvents(sessionId)
-            } catch (cause) {
-              await ctx.journal.appendItem(
-                identity,
-                { kind: 'status', text: 'Compaction completion is unconfirmed.' },
-                { fence: ctx.fence }
-              )
-              ctx.publish()
-              throw cause
-            }
-            await ctx.journal.appendItem(
-              identity,
-              { kind: 'status', text: error ?? 'Conversation compacted.' },
-              { fence: ctx.fence }
-            )
-            ctx.publish()
+            // Carry the source's drafts to the replacement, the same for every client version:
+            // the cards stay visible where the user now is, and no text rides the wire.
+            // Bookkeeping — a failure is reported and never fails the clear.
+            await carryQueuedMessagesToClearReplacement(ctx, {
+              replacementSessionId: ids.sessionId,
+              replacementJournal: context.sessions.get(ids.sessionId)?.journal,
+              callerKey: caller.callerKey,
+              operationId: clientOperationId
+            })
           }
           const completed = {
-            ...prepared,
+            ...base,
             phase: 'committed' as const,
-            state: 'completed' as const,
-            ...(error ? { error: error.slice(0, 4096) } : {})
+            state: 'completed' as const
           }
           await store.setConversationCommand(sessionId, ctx.fence, completed)
           return { ok: true, value: completed }
diff --git a/src/main/native-chat/agent-session-wire/structured-conversation-compaction.test.ts b/src/main/native-chat/agent-session-wire/structured-conversation-compaction.test.ts
new file mode 100644
index 00000000000..28eae2dff68
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-conversation-compaction.test.ts
@@ -0,0 +1,751 @@
+// `/compact` travels the send path: accepted as the user's message, carried out by the delivery loop
+// as a turn of its own, settled by re-reading the journal. Each case reads what a subscriber that
+// was open before the command saw, or the journal a client would load.
+
+import { beforeEach, expect, it, vi, type Mock } from 'vitest'
+import {
+  AgentJournalSubmissionSchema,
+  isAdmissibleAgentJournalItemBody
+} from '../../../shared/agent-session-journal-schemas'
+import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalItemBody,
+  type AgentJournalRenderItem
+} from '../../../shared/agent-session-journal-types'
+import type { AgentSessionSubscribeEvent } from '../../../shared/agent-session-wire'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
+import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { structuredAgentSessionCommandTurn } from './structured-agent-session-command-turn'
+import { settleStaleStructuredAgentSessionState } from './structured-agent-session-dead-generation-settlement'
+import {
+  attach,
+  CALLER,
+  envelope,
+  hostTestState
+} from './structured-agent-session-host-test-harness'
+import {
+  HOST_TEST_NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestMessage
+} from './structured-agent-session-host-test-data'
+import type { StructuredConversationCommandOutcome } from './structured-conversation-command-outcome'
+
+let state: ReturnType<typeof hostTestState>
+let compact: Mock<NonNullable<StructuredAgentSessionAdapter['compact']>>
+let closeSession: Mock<NonNullable<StructuredAgentSessionAdapter['closeSession']>>
+
+beforeEach(() => {
+  state = hostTestState()
+  // Codex's ack: the provider took the command, which its translator ends later.
+  compact = vi.fn(async () => ({ state: 'accepted' as const, providerIdentity: null }))
+  closeSession = vi.fn(async () => true)
+  Object.assign(state.host.deps.adapter, { compact, closeSession })
+})
+
+/** What the child's journal translator writes when the provider ends the command: the command's
+ *  one result row and its turn's end, in one batch. */
+function finish(result: StructuredConversationCommandOutcome): void {
+  const { command } = compact.mock.calls.at(-1)![0]
+  const events = state.acquire.mock.calls.at(-1)![0].events!
+  const turnScope = { kind: 'turn' as const, turnItemId: agentJournalItemKey(command.identity) }
+  const row: AgentJournalItemBody | null =
+    result.outcome === 'success'
+      ? { kind: 'status', text: 'Context compacted', presentation: 'compaction' }
+      : result.outcome === 'failure'
+        ? {
+            kind: 'status',
+            ...agentSessionFailureWords(
+              result.failure ?? agentSessionFailureFact('compactionUnconfirmed'),
+              { surface: 'row' }
+            ),
+            tone: 'error'
+          }
+        : null
+  events.appendLifecycleBatch!(
+    `turn-completed:${command.clientMessageId}`,
+    [
+      ...(row
+        ? [{ kind: 'item' as const, identity: command.resultIdentity, body: row, turnScope }]
+        : []),
+      {
+        kind: 'item',
+        identity: command.identity,
+        body: {
+          ...command.running,
+          state: result.outcome === 'cancellation' ? 'interrupted' : 'completed',
+          outcome: result.outcome,
+          completedAt: HOST_TEST_NOW
+        },
+        turnScope: AGENT_JOURNAL_THREAD_SCOPE
+      }
+    ],
+    { lifecycle: true }
+  )
+}
+
+/** Claude's words for a compaction it refused, as its frames carry them. */
+const NOT_ENOUGH = { text: 'Not enough messages to compact.', audience: 'person' as const }
+
+function compactParams() {
+  return {
+    command: 'compact' as const,
+    envelope: envelope('agentSession.conversationCommand', { command: 'compact' })
+  }
+}
+
+function sendParams(text: string) {
+  const body = hostTestMessage(text)
+  return { envelope: envelope('agentSession.send', { body }), body }
+}
+
+async function subscribe(): Promise<AgentSessionSubscribeEvent[]> {
+  const events: AgentSessionSubscribeEvent[] = []
+  await state.host.subscribe({
+    id: 'pane',
+    sessionId: SESSION,
+    emit: (event) => events.push(event)
+  })
+  return events
+}
+
+/** One line per journal fact a subscriber received, in delivery order. */
+function frames(events: AgentSessionSubscribeEvent[]): string[] {
+  return events.flatMap((event) =>
+    event.type === 'batch'
+      ? [
+          ...event.batch.items.map(describeItem),
+          ...event.batch.submissions.map(
+            (entry) => `submission:${entry.dispatchState}${entry.handedOverAt ? ':handed' : ''}`
+          )
+        ]
+      : []
+  )
+}
+
+function describeItem(item: AgentJournalRenderItem): string {
+  const turn = readAgentJournalTurn(item.body)
+  if (turn) {
+    return `turn:${turn.state}${turn.outcome ? `:${turn.outcome}` : ''}`
+  }
+  return item.body.kind === 'status' ? `status:${item.body.text}` : item.body.kind
+}
+
+async function journal() {
+  return state.host.journalSnapshot(SESSION)
+}
+
+async function commandTurn(clientMessageId: string) {
+  const { itemId } = structuredAgentSessionCommandTurn(clientMessageId)
+  return (await journal()).items.find((item) => item.itemId === itemId)
+}
+
+it('answers at handover, then journals its own entry, turn and result (B1, B16)', async () => {
+  await attach()
+  const events = await subscribe()
+  const params = compactParams()
+  const cmid = params.envelope.clientOperationId
+
+  // The reply means "started"; the provider has not finished.
+  await expect(state.host.conversationCommand(CALLER, params)).resolves.toMatchObject({
+    ok: true,
+    value: { command: 'compact', state: 'completed' }
+  })
+  await vi.waitFor(() => expect(compact).toHaveBeenCalledOnce())
+  finish({ outcome: 'success' })
+
+  await vi.waitFor(async () =>
+    expect(readAgentJournalTurn((await commandTurn(cmid))?.body)?.state).toBe('completed')
+  )
+  // A client saw the command working before it saw the command's end.
+  const facts = frames(events)
+  const running = facts.indexOf('turn:running')
+  const ended = facts.indexOf('turn:completed:success')
+  expect(running, facts.join('\n')).toBeGreaterThanOrEqual(0)
+  expect(ended).toBeGreaterThan(running)
+  expect(facts.indexOf('status:Context compacted')).toBeGreaterThan(running)
+  // No turn row was ever overwritten by another body kind.
+  const turnKey = structuredAgentSessionCommandTurn(cmid).itemId
+  for (const event of events) {
+    for (const item of event.type === 'batch' ? event.batch.items : []) {
+      expect(item.itemId !== turnKey || item.body.kind === 'turn').toBe(true)
+    }
+  }
+  const snapshot = await journal()
+  const entry = snapshot.items.find((item) => item.body.kind === 'message')
+  expect(entry?.body).toMatchObject({ command: { name: 'compact' } })
+  expect(entry?.turnScope).toEqual(AGENT_JOURNAL_THREAD_SCOPE)
+  const result = snapshot.items.find(
+    (item) => item.body.kind === 'status' && item.body.presentation === 'compaction'
+  )
+  expect(result?.turnScope).toEqual({ kind: 'turn', turnItemId: turnKey })
+  const submission = snapshot.submissions.find((item) => item.clientMessageId === cmid)
+  expect(submission).toMatchObject({ dispatchState: 'accepted', providerItemId: null })
+  // An older client's schemas take the accepted submission with no provider item.
+  expect(AgentJournalSubmissionSchema.safeParse(submission).success).toBe(true)
+  expect(isAdmissibleAgentJournalItemBody(entry!.body)).toBe(true)
+  expect(state.dispatch).not.toHaveBeenCalled()
+})
+
+it('replays the reply for the same operation without running it again (B16)', async () => {
+  await attach()
+  const params = compactParams()
+  await state.host.conversationCommand(CALLER, params)
+  await vi.waitFor(() => expect(compact).toHaveBeenCalledOnce())
+  finish({ outcome: 'success' })
+  await expect(state.host.conversationCommand(CALLER, params)).resolves.toMatchObject({
+    ok: true,
+    replayed: true
+  })
+  expect(compact).toHaveBeenCalledOnce()
+})
+
+it('holds messages sent during the command and delivers them after it, in order (B2)', async () => {
+  await attach()
+  const params = compactParams()
+  await state.host.conversationCommand(CALLER, params)
+  await vi.waitFor(() => expect(compact).toHaveBeenCalledOnce())
+  await expect(state.host.send(CALLER, sendParams('first'))).resolves.toMatchObject({ ok: true })
+  await expect(state.host.send(CALLER, sendParams('second'))).resolves.toMatchObject({ ok: true })
+  // Nothing is handed over while the command's turn runs.
+  await new Promise((resolve) => setTimeout(resolve, 50))
+  expect(state.dispatch).not.toHaveBeenCalled()
+
+  finish({
+    outcome: 'failure',
+    failure: agentSessionFailureFact('compactionFailed', { detail: NOT_ENOUGH })
+  })
+
+  // Delivered even though the command failed.
+  await vi.waitFor(() => expect(state.dispatch).toHaveBeenCalledTimes(2))
+  expect(state.dispatch.mock.calls.map(([input]) => input.body.blocks)).toEqual([
+    [{ type: 'text', text: 'first' }],
+    [{ type: 'text', text: 'second' }]
+  ])
+  const turn = await commandTurn(params.envelope.clientOperationId)
+  expect(readAgentJournalTurn(turn?.body)).toMatchObject({ state: 'completed', outcome: 'failure' })
+  const error = (await journal()).items.find(
+    (item) => item.body.kind === 'status' && item.body.tone === 'error'
+  )
+  expect(error?.body).toMatchObject({
+    text: 'Compaction failed: Not enough messages to compact.',
+    failure: { kind: 'compactionFailed', detail: NOT_ENOUGH }
+  })
+})
+
+it('hands over a message held behind the command when the command ends just as the loop stops for it', async () => {
+  await attach()
+  await state.host.conversationCommand(CALLER, compactParams())
+  await vi.waitFor(() => expect(compact).toHaveBeenCalledOnce())
+  const { journal: live } = state.host['sessions'].get(SESSION)!
+  const activeTurnId = live.activeTurnId
+  let ended = false
+  vi.spyOn(live, 'activeTurnId').mockImplementation(() => {
+    const read = activeTurnId()
+    // The provider's end lands the moment the loop's own step reads the command as running and
+    // stops; no other reader's view of it matters here.
+    if (
+      !ended &&
+      read?.startsWith('compact:') &&
+      new Error('who reads').stack?.includes('StructuredAgentSessionDeliveryLoop.prepare')
+    ) {
+      ended = true
+      finish({ outcome: 'success' })
+    }
+    return read
+  })
+
+  await expect(state.host.send(CALLER, sendParams('held'))).resolves.toMatchObject({ ok: true })
+
+  await vi.waitFor(() => expect(state.dispatch).toHaveBeenCalledOnce())
+  expect(ended).toBe(true)
+})
+
+it('settles a command the provider refused as a failure with its reason, and moves on (B3)', async () => {
+  await attach()
+  compact.mockResolvedValue({
+    state: 'rejected',
+    ...agentSessionFailureWords(
+      agentSessionFailureFact('providerRejected', { detail: NOT_ENOUGH }),
+      {
+        surface: 'rejection'
+      }
+    )
+  })
+  const params = compactParams()
+  const cmid = params.envelope.clientOperationId
+  await state.host.conversationCommand(CALLER, params)
+  await state.host.send(CALLER, sendParams('after the refusal'))
+
+  await vi.waitFor(() => expect(state.dispatch).toHaveBeenCalledOnce())
+  expect(readAgentJournalTurn((await commandTurn(cmid))?.body)).toMatchObject({
+    state: 'completed',
+    outcome: 'failure'
+  })
+  const snapshot = await journal()
+  // The message was not sent, in the provider's words; the command's row says the compaction failed.
+  expect(snapshot.submissions.find((entry) => entry.clientMessageId === cmid)).toMatchObject({
+    dispatchState: 'rejected',
+    reason: 'The provider did not accept this message: Not enough messages to compact.',
+    rejection: { kind: 'providerRejected', detail: NOT_ENOUGH }
+  })
+  expect(
+    snapshot.items.filter((item) => item.body.kind === 'status' && item.body.tone === 'error')
+  ).toEqual([
+    expect.objectContaining({
+      body: {
+        kind: 'status',
+        text: 'Compaction failed: Not enough messages to compact.',
+        failure: { kind: 'compactionFailed', detail: NOT_ENOUGH },
+        tone: 'error'
+      },
+      turnScope: { kind: 'turn', turnItemId: structuredAgentSessionCommandTurn(cmid).itemId }
+    })
+  ])
+})
+
+it('says only that the compaction failed when the provider refused it without words', async () => {
+  await attach()
+  compact.mockResolvedValue({
+    state: 'rejected',
+    ...agentSessionFailureWords(agentSessionFailureFact('writeFailed'), { surface: 'rejection' })
+  })
+  const params = compactParams()
+  await state.host.conversationCommand(CALLER, params)
+
+  await vi.waitFor(async () =>
+    expect(
+      (await journal()).items
+        .filter((item) => item.body.kind === 'status' && item.body.tone === 'error')
+        .map((item) => item.body)
+    ).toEqual([
+      {
+        kind: 'status',
+        text: 'Compaction failed.',
+        failure: { kind: 'compactionFailed' },
+        tone: 'error'
+      }
+    ])
+  )
+})
+
+it('refuses the command at handover when the provider opened a turn meanwhile (B3)', async () => {
+  await attach()
+  const events = state.acquire.mock.calls.at(-1)?.[0].events
+  // The provider starts a turn of its own after acceptance, before the command is handed over.
+  Object.assign(state.host.deps.adapter, {
+    awaitStarted: vi.fn(async () => {
+      events?.appendItem(
+        { provider: 'codex', threadId: THREAD, turnId: 'provider-turn', ordinal: 0 },
+        { kind: 'turn', turnId: 'provider-turn', state: 'running' },
+        { turnScope: AGENT_JOURNAL_THREAD_SCOPE, lifecycle: true }
+      )
+    })
+  })
+  const params = compactParams()
+
+  const refused = {
+    kind: 'commandRefused',
+    refusal: { code: 'agent_session_operation_invalid', details: { reason: 'turnActive' } }
+  }
+  await expect(state.host.conversationCommand(CALLER, params)).resolves.toMatchObject({
+    ok: true,
+    value: { state: 'completed', error: "This command didn't run. Try it again.", failure: refused }
+  })
+  expect(compact).not.toHaveBeenCalled()
+  expect(await commandTurn(params.envelope.clientOperationId)).toBeUndefined()
+  expect(
+    (await journal()).submissions.find(
+      (entry) => entry.clientMessageId === params.envelope.clientOperationId
+    )
+  ).toMatchObject({
+    dispatchState: 'rejected',
+    reason: "This command didn't run. Try it again.",
+    rejection: refused
+  })
+})
+
+it('leaves a command whose start failed not sent, beside one start-failure row (B3)', async () => {
+  await attach()
+  await state.host.close(SESSION)
+  state.acquire.mockRejectedValue(new Error('not signed in'))
+  const params = compactParams()
+
+  // The next step is the command again, not a message.
+  await expect(state.host.conversationCommand(CALLER, params)).resolves.toMatchObject({
+    ok: true,
+    value: {
+      state: 'completed',
+      error: "Codex couldn't restart. Run /compact again.",
+      failure: { kind: 'restartFailed' }
+    }
+  })
+  const snapshot = await journal()
+  expect(snapshot.items.filter((item) => readAgentJournalTurn(item.body))).toEqual([])
+  // The start's own row, in the words the command's message was refused with.
+  expect(
+    snapshot.items
+      .filter((item) => item.body.kind === 'status' && item.body.tone === 'error')
+      .map((item) => item.body)
+  ).toEqual([
+    {
+      kind: 'status',
+      text: "Codex couldn't restart. Run /compact again.",
+      failure: expect.objectContaining({ kind: 'restartFailed' }),
+      tone: 'error'
+    }
+  ])
+  expect(
+    snapshot.submissions.find(
+      (entry) => entry.clientMessageId === params.envelope.clientOperationId
+    )
+  ).toMatchObject({
+    dispatchState: 'rejected',
+    reason: "Codex couldn't restart. Run /compact again."
+  })
+  expect(compact).not.toHaveBeenCalled()
+})
+
+function stop(turnId: string) {
+  return state.host.cancel(CALLER, {
+    envelope: envelope('agentSession.cancel', { turnId }),
+    turnId
+  })
+}
+
+it('leaves the command to the provider when it takes the Stop, and ends it as cancelled (B4)', async () => {
+  await attach()
+  const params = compactParams()
+  const cmid = params.envelope.clientOperationId
+  await state.host.conversationCommand(CALLER, params)
+  await vi.waitFor(() => expect(compact).toHaveBeenCalledOnce())
+  const { turnId } = structuredAgentSessionCommandTurn(cmid)
+
+  await expect(stop(turnId)).resolves.toMatchObject({ ok: true, value: { cancelled: true } })
+
+  // The interrupt was taken, not answered: the command runs until the provider ends it.
+  expect(state.cancelTurn).toHaveBeenCalledWith(expect.objectContaining({ turnId }))
+  expect(closeSession).not.toHaveBeenCalled()
+  expect(readAgentJournalTurn((await commandTurn(cmid))?.body)?.state).toBe('running')
+  finish({ outcome: 'cancellation' })
+  await vi.waitFor(async () =>
+    expect(readAgentJournalTurn((await commandTurn(cmid))?.body)).toMatchObject({
+      state: 'interrupted',
+      outcome: 'cancellation'
+    })
+  )
+  // A cancellation writes no result row.
+  expect((await journal()).items.some((item) => item.itemId.includes('command-result'))).toBe(false)
+})
+
+it('ends the command by stopping the child at a second Stop the provider never answered (B4)', async () => {
+  await attach()
+  const params = compactParams()
+  const cmid = params.envelope.clientOperationId
+  await state.host.conversationCommand(CALLER, params)
+  await vi.waitFor(() => expect(compact).toHaveBeenCalledOnce())
+  const { turnId } = structuredAgentSessionCommandTurn(cmid)
+
+  // The provider takes the interrupt and then never answers it.
+  await expect(stop(turnId)).resolves.toMatchObject({ ok: true, value: { cancelled: true } })
+  expect(closeSession).not.toHaveBeenCalled()
+  await expect(stop(turnId)).resolves.toMatchObject({ ok: true, value: { cancelled: true } })
+
+  expect(state.cancelTurn).toHaveBeenCalledOnce()
+  expect(closeSession).toHaveBeenCalledOnce()
+  expect(readAgentJournalTurn((await commandTurn(cmid))?.body)?.state).toBe('interrupted')
+})
+
+it('ends the command by stopping the child when the provider cannot take the Stop (B4)', async () => {
+  await attach()
+  // Codex before it opened the command's turn, or Claude refusing the interrupt.
+  state.cancelTurn.mockResolvedValue({ cancelled: false })
+  const params = compactParams()
+  const cmid = params.envelope.clientOperationId
+  await state.host.conversationCommand(CALLER, params)
+  await vi.waitFor(() => expect(compact).toHaveBeenCalledOnce())
+
+  await expect(stop(structuredAgentSessionCommandTurn(cmid).turnId)).resolves.toMatchObject({
+    ok: true,
+    value: { cancelled: true }
+  })
+
+  expect(closeSession).toHaveBeenCalledOnce()
+  expect(readAgentJournalTurn((await commandTurn(cmid))?.body)?.state).toBe('interrupted')
+  const notes = (await journal()).items.filter((item) => item.body.kind === 'status')
+  expect(notes.map((item) => item.body.kind === 'status' && item.body.text)).toEqual([
+    'Cancellation requested.'
+  ])
+  // The next message starts a child of its own.
+  await state.host.send(CALLER, sendParams('after the stop'))
+  await vi.waitFor(() => expect(state.dispatch).toHaveBeenCalledOnce())
+  expect(state.acquire).toHaveBeenCalledTimes(2)
+})
+
+it('does not stop the child for a Stop naming a command that already ended (B4)', async () => {
+  await attach()
+  state.cancelTurn.mockResolvedValue({ cancelled: false })
+  const params = compactParams()
+  await state.host.conversationCommand(CALLER, params)
+  await vi.waitFor(() => expect(compact).toHaveBeenCalledOnce())
+  finish({ outcome: 'success' })
+  const { itemId, turnId } = structuredAgentSessionCommandTurn(params.envelope.clientOperationId)
+  await vi.waitFor(async () =>
+    expect(
+      readAgentJournalTurn((await journal()).items.find((item) => item.itemId === itemId)?.body)
+        ?.state
+    ).toBe('completed')
+  )
+
+  await expect(stop(turnId)).resolves.toMatchObject({ ok: true, value: { cancelled: false } })
+  expect(closeSession).not.toHaveBeenCalled()
+})
+
+it("answers a refused command's message before ending its turn, so a crash between them leaves a turn the sweep settles (B4)", async () => {
+  await attach()
+  // The one command end the host still writes: the provider refused it. A provider's own end is
+  // one batch its translator writes, with nothing to split.
+  compact.mockResolvedValue({
+    state: 'rejected',
+    ...agentSessionFailureWords(
+      agentSessionFailureFact('providerRejected', { detail: NOT_ENOUGH }),
+      {
+        surface: 'rejection'
+      }
+    )
+  })
+  const { journal: live } = state.host['sessions'].get(SESSION)!
+  const appendLifecycleBatch = live.appendLifecycleBatch.bind(live)
+  const crash = vi
+    .spyOn(live, 'appendLifecycleBatch')
+    .mockImplementation((input) =>
+      input.settlementId.startsWith('command-settled:')
+        ? Promise.reject(new Error('host crashed'))
+        : appendLifecycleBatch(input)
+    )
+  const params = compactParams()
+  const cmid = params.envelope.clientOperationId
+  await state.host.conversationCommand(CALLER, params)
+  await vi.waitFor(() => expect(crash).toHaveBeenCalled())
+  crash.mockRestore()
+
+  // Never an ended turn whose message still reads as in flight.
+  expect(readAgentJournalTurn((await commandTurn(cmid))?.body)?.state).toBe('running')
+  expect(
+    (await journal()).submissions.find((entry) => entry.clientMessageId === cmid)?.dispatchState
+  ).toBe('rejected')
+  await settleStaleStructuredAgentSessionState({
+    journal: live,
+    sessionId: SESSION,
+    fence: state.store.getRecord(SESSION)!.lease.runtimeFence,
+    acquisitionGeneration: null,
+    deathEvidence: null
+  })
+  expect(readAgentJournalTurn((await commandTurn(cmid))?.body)?.state).toBe('unverifiable')
+})
+
+it('counts a message held behind the command from its handover, not its send', async () => {
+  await attach()
+  await state.host.conversationCommand(CALLER, compactParams())
+  await vi.waitFor(() => expect(compact).toHaveBeenCalledOnce())
+  const sent = await state.host.send(CALLER, sendParams('held'))
+  expect(sent.ok).toBe(true)
+  await new Promise((resolve) => setTimeout(resolve, 20))
+  finish({ outcome: 'success' })
+
+  await vi.waitFor(() => expect(state.dispatch).toHaveBeenCalledOnce())
+  const [dispatched] = state.dispatch.mock.calls[0]!
+  const submission = (await journal()).submissions.find(
+    (entry) => entry.clientMessageId === dispatched.clientMessageId
+  )
+  expect(submission?.handedOverAt).toBeGreaterThan(submission!.submittedAt)
+  expect(dispatched.requestedAt).toBe(submission?.handedOverAt)
+})
+
+it('settles a command whose adapter call threw after the start as unknown (B4)', async () => {
+  await attach()
+  compact.mockImplementation(() => {
+    throw new Error('codex app-server session is not live')
+  })
+  const params = compactParams()
+  const cmid = params.envelope.clientOperationId
+
+  await expect(state.host.conversationCommand(CALLER, params)).resolves.toMatchObject({ ok: true })
+
+  await vi.waitFor(async () =>
+    expect(readAgentJournalTurn((await commandTurn(cmid))?.body)?.state).toBe('unverifiable')
+  )
+  expect(
+    (await journal()).submissions.find((entry) => entry.clientMessageId === cmid)
+  ).toMatchObject({ dispatchState: 'unknown', reason: 'codex app-server session is not live' })
+})
+
+it('writes one exit row when the child dies mid-command, and the loop writes nothing but moves on (B4)', async () => {
+  state.acquire.mockImplementation(async ({ fence, spawnToken }) => ({
+    process: { hostId: 'local', pid: 4242, processStartTimeMs: 1_700_000_000_000, spawnToken },
+    acquisitionGeneration: `generation-${fence}`,
+    link: {
+      linkId: `link-${fence}`,
+      handle: { provider: 'codex', threadId: THREAD },
+      // The next child resumes the thread, as a real one does.
+      origin: state.store.getRecord(SESSION)?.providerHandleChain.length ? 'resumed' : 'created',
+      mintedAtFence: fence,
+      observedAt: 1
+    }
+  }))
+  await attach()
+  const params = compactParams()
+  const cmid = params.envelope.clientOperationId
+  await state.host.conversationCommand(CALLER, params)
+  await vi.waitFor(() => expect(compact).toHaveBeenCalledOnce())
+  await expect(state.host.send(CALLER, sendParams('queued behind it'))).resolves.toMatchObject({
+    ok: true
+  })
+
+  // The adapter never answers the command: the host's own record of the child's end is enough.
+  const fence = state.store.getRecord(SESSION)!.lease.runtimeFence
+  await state.host.handleAdapterEvent({
+    type: 'ended',
+    sessionId: SESSION,
+    fence,
+    acquisitionGeneration: `generation-${fence}`,
+    reason: 'provider exited',
+    cause: 'unexpected-exit'
+  })
+
+  await vi.waitFor(async () =>
+    expect(readAgentJournalTurn((await commandTurn(cmid))?.body)?.state).toBe('interrupted')
+  )
+  // Released from the command, the loop starts a child and delivers what waited behind it.
+  await vi.waitFor(() => expect(state.dispatch).toHaveBeenCalledOnce())
+  expect(state.acquire).toHaveBeenCalledTimes(2)
+  const snapshot = await journal()
+  expect(
+    snapshot.items.filter((item) => item.body.kind === 'status' && item.body.tone === 'error')
+  ).toHaveLength(1)
+  expect(snapshot.items.some((item) => item.itemId.includes('command-result'))).toBe(false)
+  // Codex acknowledged the command, so the message was delivered; only its turn was cut short.
+  expect(snapshot.submissions.find((entry) => entry.clientMessageId === cmid)?.dispatchState).toBe(
+    'accepted'
+  )
+})
+
+it('delivers the next message after a command whose child died and whose settlement could not be written', async () => {
+  state.acquire.mockImplementation(async ({ fence, spawnToken }) => ({
+    process: { hostId: 'local', pid: 4242, processStartTimeMs: 1_700_000_000_000, spawnToken },
+    acquisitionGeneration: `generation-${fence}`,
+    link: {
+      linkId: `link-${fence}`,
+      handle: { provider: 'codex', threadId: THREAD },
+      origin: state.store.getRecord(SESSION)?.providerHandleChain.length ? 'resumed' : 'created',
+      mintedAtFence: fence,
+      observedAt: 1
+    }
+  }))
+  await attach()
+  const params = compactParams()
+  const cmid = params.envelope.clientOperationId
+  await state.host.conversationCommand(CALLER, params)
+  await vi.waitFor(() => expect(compact).toHaveBeenCalledOnce())
+  const { journal: live } = state.host['sessions'].get(SESSION)!
+  const appendLifecycleBatch = live.appendLifecycleBatch.bind(live)
+  vi.spyOn(live, 'appendLifecycleBatch').mockImplementation((input) =>
+    input.settlementId.includes('provider-exit:')
+      ? Promise.reject(new Error('disk full'))
+      : appendLifecycleBatch(input)
+  )
+
+  const fence = state.store.getRecord(SESSION)!.lease.runtimeFence
+  await state.host.handleAdapterEvent({
+    type: 'ended',
+    sessionId: SESSION,
+    fence,
+    acquisitionGeneration: `generation-${fence}`,
+    reason: 'provider exited',
+    cause: 'unexpected-exit'
+  })
+  await vi.waitFor(() => expect(state.host['sessions'].get(SESSION)?.child).toBeNull())
+  // The exit it recorded settles what the failed write left running, so the command holds nothing.
+  await vi.waitFor(async () =>
+    expect(readAgentJournalTurn((await commandTurn(cmid))?.body)?.state).toBe('interrupted')
+  )
+
+  await expect(state.host.send(CALLER, sendParams('after it'))).resolves.toMatchObject({
+    ok: true
+  })
+  await vi.waitFor(() => expect(state.dispatch).toHaveBeenCalledOnce())
+  expect(state.acquire).toHaveBeenCalledTimes(2)
+  expect(readAgentJournalTurn((await commandTurn(cmid))?.body)?.state).not.toBe('running')
+})
+
+it("ignores an older build's unconfirmed compaction record, and answers its operation without rerunning it (B15)", async () => {
+  await attach()
+  const older = compactParams()
+  // An older build admitted this operation and died before recording its outcome.
+  await state.store.admitMutationOperation({
+    callerKey: CALLER.callerKey,
+    envelope: older.envelope,
+    hostFingerprint: older.envelope.payloadFingerprint,
+    now: HOST_TEST_NOW
+  })
+  await state.store.setConversationCommand(
+    SESSION,
+    state.store.getRecord(SESSION)!.lease.runtimeFence,
+    {
+      command: 'compact',
+      runtimeFence: state.store.getRecord(SESSION)!.lease.runtimeFence,
+      operationId: older.envelope.clientOperationId,
+      callerKey: CALLER.callerKey,
+      phase: 'prepared',
+      state: 'unknown'
+    }
+  )
+
+  await expect(state.host.send(CALLER, sendParams('still works'))).resolves.toMatchObject({
+    ok: true
+  })
+  await vi.waitFor(() => expect(state.dispatch).toHaveBeenCalledOnce())
+  await expect(state.host.conversationCommand(CALLER, compactParams())).resolves.toMatchObject({
+    ok: true,
+    value: { state: 'completed' }
+  })
+  await vi.waitFor(() => expect(compact).toHaveBeenCalledOnce())
+  finish({ outcome: 'success' })
+  await vi.waitFor(async () =>
+    expect((await journal()).submissions.every((entry) => entry.dispatchState === 'accepted')).toBe(
+      true
+    )
+  )
+
+  await expect(state.host.conversationCommand(CALLER, older)).resolves.toMatchObject({
+    ok: true,
+    value: {
+      state: 'unknown',
+      error: 'Compaction completion is unconfirmed.',
+      failure: { kind: 'compactionUnconfirmed' }
+    }
+  })
+  expect(compact).toHaveBeenCalledOnce()
+})
+
+it('never lets a provider echo alias the command entry', async () => {
+  await attach()
+  const params = compactParams()
+  await state.host.conversationCommand(CALLER, params)
+  await vi.waitFor(() => expect(compact).toHaveBeenCalledOnce())
+  finish({ outcome: 'success' })
+  const events = state.acquire.mock.calls.at(-1)?.[0].events
+  const echo = { provider: 'codex' as const, threadId: THREAD, turnId: 'later', ordinal: 0 }
+  events?.appendItem(
+    echo,
+    { kind: 'message', role: 'user', blocks: [{ type: 'text', text: '/compact' }] },
+    { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+  )
+  await state.host.flushStreamedEvents(SESSION)
+  expect((await journal()).items.some((item) => item.itemId === agentJournalItemKey(echo))).toBe(
+    true
+  )
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-conversation-compaction.ts b/src/main/native-chat/agent-session-wire/structured-conversation-compaction.ts
new file mode 100644
index 00000000000..7ad7f9bb1bc
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-conversation-compaction.ts
@@ -0,0 +1,160 @@
+// `/compact` sent through the command RPC: accepted into the conversation as the user's message,
+// and answered once the delivery loop hands it over.
+
+import type { AgentSessionConversationCommandResult } from '../../../shared/agent-session-conversation-command'
+import {
+  agentSessionFailureFact,
+  readAgentSessionFailureFact
+} from '../../../shared/agent-session-failure'
+import type { AgentSessionFailureWordsContext } from '../../../shared/agent-session-failure-words'
+import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
+import type {
+  AgentSessionMutationEnvelope,
+  AgentSessionMutationResult
+} from '../../../shared/agent-session-wire'
+import type { StructuredAgentSessionHost } from './structured-agent-session-host'
+import {
+  mutateStructuredAgentSession,
+  type StructuredAgentSessionMutationContext
+} from './structured-agent-session-host-mutations'
+import type { StructuredAgentSessionCaller } from './structured-agent-session-host-types'
+import {
+  conversationCommandPlan,
+  type ConversationCommandAcceptance
+} from './structured-agent-session-mutation-plans'
+import {
+  sendPreparation,
+  structuredAgentSessionFailureWordsContext,
+  structuredAgentSessionSendBlock
+} from './structured-agent-session-send-preparation'
+import { STRUCTURED_AGENT_SESSION_START_WAIT_MS } from './structured-agent-session-send-settlement'
+import {
+  conversationCommandFailure,
+  type ConversationCommandParams
+} from './structured-conversation-command'
+import { conversationCommandBlocked } from './structured-conversation-command-admission'
+
+/**
+ * `/compact` from a client that asks through the command RPC: accepted into the conversation like
+ * any message, and answered once it is handed over — the command has started, not finished. Its
+ * end reaches the chat as its own turn and result row.
+ */
+export async function runStructuredCompaction(
+  context: StructuredAgentSessionMutationContext,
+  host: Pick<StructuredAgentSessionHost, 'waitForSendSettlement'>,
+  caller: StructuredAgentSessionCaller,
+  params: ConversationCommandParams
+): Promise<AgentSessionMutationResult<AgentSessionConversationCommandResult>> {
+  const { sessionId, clientOperationId } = params.envelope
+  // An older build ran this operation id and recorded it on the session: answered, never rerun.
+  const priorRecord = (): AgentSessionConversationCommandResult | null => {
+    const prior = context.deps.store.getRecord(sessionId)?.conversationCommand
+    if (prior?.operationId !== clientOperationId || prior.callerKey !== caller.callerKey) {
+      return null
+    }
+    return prior.phase === 'committed'
+      ? prior
+      : {
+          command: 'compact',
+          state: 'unknown',
+          ...conversationCommandFailure(agentSessionFailureFact('compactionUnconfirmed'))
+        }
+  }
+  const accepted = await acceptStructuredConversationCommand(context, caller, params, priorRecord)
+  if (!accepted.ok) {
+    return accepted
+  }
+  if ('recorded' in accepted.value) {
+    return { ...accepted, value: accepted.value.recorded }
+  }
+  const settled = await host.waitForSendSettlement(sessionId, accepted.value.clientMessageId, {
+    until: 'handed-over',
+    budgetMs: STRUCTURED_AGENT_SESSION_START_WAIT_MS
+  })
+  return {
+    ...accepted,
+    ...(settled ? { cursor: settled.cursor } : {}),
+    // A /compact is a command send, never a queued draft, so its settlement always carries the submission.
+    value: compactionReply(
+      settled && 'submission' in settled.value ? settled.value.submission : undefined,
+      {
+        ...structuredAgentSessionFailureWordsContext(context.deps.store.getRecord(sessionId)),
+        command: 'compact'
+      }
+    )
+  }
+}
+
+/** The reply shape clients already read: `completed` is now "started". */
+function compactionReply(
+  submission: AgentJournalSubmission | undefined,
+  context: AgentSessionFailureWordsContext
+): AgentSessionConversationCommandResult {
+  const error = (reason: string | null, fallback: string) => (reason ?? fallback).slice(0, 4096)
+  if (!submission || isQueuedAgentJournalSubmission(submission)) {
+    return { command: 'compact', state: 'unknown', error: 'The command has not started yet.' }
+  }
+  if (submission.dispatchState === 'rejected') {
+    // The message's own fact, in the words its row shows; a row from an older host keeps its reason.
+    const rejection = readAgentSessionFailureFact(submission.rejection)
+    return rejection
+      ? {
+          command: 'compact',
+          state: 'completed',
+          ...conversationCommandFailure(rejection, context)
+        }
+      : {
+          command: 'compact',
+          state: 'completed',
+          error: error(submission.reason, 'The command was not run.')
+        }
+  }
+  return submission.dispatchState === 'unknown'
+    ? {
+        command: 'compact',
+        state: 'unknown',
+        error: error(submission.reason, 'The command may not have run.')
+      }
+    : { command: 'compact', state: 'completed' }
+}
+
+/** A conversation command, accepted into the queue as the user's message. */
+function acceptStructuredConversationCommand(
+  context: StructuredAgentSessionMutationContext,
+  caller: StructuredAgentSessionCaller,
+  params: { envelope: AgentSessionMutationEnvelope },
+  priorRecord: () => AgentSessionConversationCommandResult | null
+): Promise<AgentSessionMutationResult<ConversationCommandAcceptance>> {
+  const plan = conversationCommandPlan({ envelope: params.envelope, priorRecord })
+  return mutateStructuredAgentSession(
+    context,
+    caller,
+    params.envelope,
+    {
+      ...plan,
+      run: async (ctx) => {
+        const record = context.deps.store.getRecord(ctx.sessionId)
+        const refusal =
+          record &&
+          conversationCommandBlocked(
+            ctx,
+            record,
+            context.sessions.get(ctx.sessionId)?.child ? undefined : 'at-rest'
+          )
+        const blocked =
+          structuredAgentSessionSendBlock(record) ??
+          (refusal ? { ok: false as const, refusal } : null)
+        if (blocked) {
+          return blocked
+        }
+        const accepted = await plan.run(ctx)
+        if (accepted.ok) {
+          context.wakeDelivery(ctx.sessionId)
+        }
+        return accepted
+      }
+    },
+    sendPreparation(context, params.envelope)
+  )
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-rewind-journal-body.test.ts b/src/main/native-chat/agent-session-wire/structured-rewind-journal-body.test.ts
index 6fa4d32293b..9de1925791f 100644
--- a/src/main/native-chat/agent-session-wire/structured-rewind-journal-body.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-rewind-journal-body.test.ts
@@ -2,6 +2,13 @@ import { describe, expect, it } from 'vitest'
 import { AgentSessionRewindRecordSchema } from '../../../shared/agent-session-rewind'
 import { restoreRewindJournalBody } from './structured-rewind-journal-body'
 
+/** A row this build cannot place: still a row, never its stored JSON, and not a failure — a
+ *  hostFault's "Try again" would be false for a placeholder. */
+const UNPLACEABLE = {
+  kind: 'status',
+  text: 'Orca could not show this item after the rewind.'
+}
+
 describe('rewind recovery of newer durable records', () => {
   it('keeps an unknown message role and block readable without discarding the row', () => {
     expect(
@@ -43,16 +50,13 @@ describe('rewind recovery of newer durable records', () => {
       input: { path: 'file' },
       state: 'paused-by-provider'
     }
-    expect(restoreRewindJournalBody(body)).toEqual({ kind: 'status', text: JSON.stringify(body) })
+    expect(restoreRewindJournalBody(body)).toEqual(UNPLACEABLE)
     const status = {
       kind: 'status' as const,
       text: 'state',
       turnLifecycle: { turnId: 'turn', state: 'future-state' }
     }
-    expect(restoreRewindJournalBody(status)).toEqual({
-      kind: 'status',
-      text: JSON.stringify(status)
-    })
+    expect(restoreRewindJournalBody(status)).toEqual(UNPLACEABLE)
   })
   it.each(['interrupted', 'unverifiable'] as const)(
     'keeps a %s turn and its recorded endpoints',
@@ -82,10 +86,7 @@ describe('rewind recovery of newer durable records', () => {
     }
     expect(restoreRewindJournalBody(turn)).toEqual(turn)
     const unknown = { ...turn, state: 'future-state' }
-    expect(restoreRewindJournalBody(unknown)).toEqual({
-      kind: 'status',
-      text: JSON.stringify(unknown)
-    })
+    expect(restoreRewindJournalBody(unknown)).toEqual(UNPLACEABLE)
   })
   it('keeps a known turn outcome across rewind recovery in both journal shapes', () => {
     const turn = {
diff --git a/src/main/native-chat/agent-session-wire/structured-rewind-journal-body.ts b/src/main/native-chat/agent-session-wire/structured-rewind-journal-body.ts
index addc234e2a1..99489b18769 100644
--- a/src/main/native-chat/agent-session-wire/structured-rewind-journal-body.ts
+++ b/src/main/native-chat/agent-session-wire/structured-rewind-journal-body.ts
@@ -9,10 +9,15 @@ import { NATIVE_CHAT_ROLES } from '../../../shared/native-chat-types'
 
 type StoredBody = AgentSessionRewindRecord['retained'][number]['body']
 
-/** Unknown future values remain visible evidence, never invented turn or prompt state. */
+/** A row this build cannot place stays visible as a row, never invented turn or prompt state —
+ *  and never as its stored JSON, which is Orca's record, not something a person reads. */
 export function restoreRewindJournalBody(body: StoredBody): AgentJournalItemBody {
   let normalized: unknown = body
-  const fallback = () => ({ kind: 'status', text: JSON.stringify(body) })
+  // A placeholder, not a failure anyone can act on, so it carries no fact.
+  const fallback = () => ({
+    kind: 'status',
+    text: 'Orca could not show this item after the rewind.'
+  })
   if (body.kind === 'message') {
     normalized = {
       ...body,
diff --git a/src/main/native-chat/agent-session-wire/structured-rewind-recovery.ts b/src/main/native-chat/agent-session-wire/structured-rewind-recovery.ts
index 42b6e8dd91d..b572e51e5f3 100644
--- a/src/main/native-chat/agent-session-wire/structured-rewind-recovery.ts
+++ b/src/main/native-chat/agent-session-wire/structured-rewind-recovery.ts
@@ -1,5 +1,7 @@
-import { restoreRewindJournalBody } from './structured-rewind-journal-body'
-import { mergeRetainedHostLifecycleRows } from './structured-rewind-retained-host-rows'
+import {
+  mergeRetainedHostLifecycleRows,
+  retainedRowReplacement
+} from './structured-rewind-retained-host-rows'
 import { isDeepStrictEqual } from 'node:util'
 import {
   agentJournalItemKey,
@@ -83,11 +85,9 @@ export async function recoverStructuredRewind(
       beforeTurnId: target.turnId
     })
     if (!recovered?.ok) {
-      if (
-        recovered?.reason === 'provider-refused' &&
-        rewind.phase === 'prepared' &&
-        !rewind.providerApplied
-      ) {
+      // The target is still in the provider's history, and the journal is replaced only once the
+      // revert is proven, so both still hold it even when the provider acknowledged the revert.
+      if (recovered?.reason === 'provider-refused' && rewind.phase === 'prepared') {
         await persistRewindRecord(store, sessionId, fence, {
           ...rewind,
           phase: 'refused',
@@ -141,13 +141,7 @@ export async function recoverStructuredRewind(
   if (rewind.phase !== 'provider-succeeded') {
     return
   }
-  const replacement = rewind.retained.map((item) => {
-    const identity = parseAgentJournalItemKey(item.itemId)
-    if (!identity) {
-      throw new Error('agent_session_rewind:invalid-retained-identity')
-    }
-    return { identity, body: restoreRewindJournalBody(item.body), observedAt: item.observedAt }
-  })
+  const replacement = rewind.retained.map(retainedRowReplacement)
   // A crash after the journal transaction must settle its existing epoch, not replace it twice.
   const alreadyReplaced = journal.cursor().epoch !== rewind.expectedEpoch
   if (
diff --git a/src/main/native-chat/agent-session-wire/structured-rewind-refusal.ts b/src/main/native-chat/agent-session-wire/structured-rewind-refusal.ts
index 5ea205a527c..af309b13f40 100644
--- a/src/main/native-chat/agent-session-wire/structured-rewind-refusal.ts
+++ b/src/main/native-chat/agent-session-wire/structured-rewind-refusal.ts
@@ -2,23 +2,28 @@ import {
   AGENT_SESSION_REWIND_REASONS,
   type AgentSessionRewindReason
 } from '../../../shared/agent-session-rewind'
-import type { AgentSessionWireRefusal } from '../../../shared/agent-session-wire'
+import { refuse, type AgentSessionWireRefusal } from '../../../shared/agent-session-wire'
 
 export function rewindRefusal(reason: AgentSessionRewindReason): {
   ok: false
   refusal: AgentSessionWireRefusal
 } {
-  const knownReason =
+  const rewindReason =
     AGENT_SESSION_REWIND_REASONS.find((value) => value === reason) ?? 'outcome-unknown'
+  const message = `agent_session_rewind:${rewindReason}`
   return {
     ok: false,
-    refusal: {
-      code:
-        knownReason === 'outcome-unknown'
-          ? 'agent_session_operation_unknown'
-          : 'agent_session_operation_invalid',
-      message: `agent_session_rewind:${knownReason}`,
-      rewindReason: knownReason
-    }
+    refusal:
+      rewindReason === 'outcome-unknown'
+        ? refuse(
+            'agent_session_operation_unknown',
+            { reason: 'rewindUnconfirmed', rewindReason },
+            message
+          )
+        : refuse(
+            'agent_session_operation_invalid',
+            { reason: 'rewindRefused', rewindReason },
+            message
+          )
   }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-rewind-retained-host-rows.test.ts b/src/main/native-chat/agent-session-wire/structured-rewind-retained-host-rows.test.ts
new file mode 100644
index 00000000000..5b47be7f9f8
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-rewind-retained-host-rows.test.ts
@@ -0,0 +1,195 @@
+import { describe, expect, it, vi } from 'vitest'
+import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
+import type { AgentJournalItemBody } from '../../../shared/agent-session-journal-types'
+import {
+  AgentSessionRewindRecordSchema,
+  type AgentSessionRewindRecord
+} from '../../../shared/agent-session-rewind'
+import {
+  mergeRetainedHostLifecycleRows,
+  retainedRowReplacement
+} from './structured-rewind-retained-host-rows'
+import { restoreRewindJournalBody } from './structured-rewind-journal-body'
+import type * as RewindJournalBody from './structured-rewind-journal-body'
+
+vi.mock('./structured-rewind-journal-body', async (importOriginal) => {
+  const actual = await importOriginal<typeof RewindJournalBody>()
+  return { ...actual, restoreRewindJournalBody: vi.fn(actual.restoreRewindJournalBody) }
+})
+
+type Retained = AgentSessionRewindRecord['retained'][number]
+
+const codexKey = (turnId: string, ordinal: number) =>
+  agentJournalItemKey({ provider: 'codex', threadId: 'thread-1', turnId, ordinal })
+const orcaKey = (clientMessageId: string) =>
+  agentJournalItemKey({ provider: 'orca', clientMessageId })
+
+function prose(text: string): AgentJournalItemBody {
+  return { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text }] }
+}
+
+function retained(itemId: string, body: AgentJournalItemBody, extra: Partial<Retained> = {}) {
+  return { itemId, body, observedAt: 1, ...extra }
+}
+
+/** Provider history carries no scope or producer of its own. */
+function providerItem(itemId: string, body: AgentJournalItemBody): Retained {
+  return { itemId, body, observedAt: 2 }
+}
+
+const TURN_RECORD = orcaKey('turn-a')
+const inTurnA = { kind: 'turn', turnItemId: TURN_RECORD }
+
+describe('rewind keeps each retained row attributed', () => {
+  it("keeps a held row's scope and producer, a subagent's row staying the subagent's", () => {
+    const own = codexKey('a', 1)
+    const child = codexKey('a', 2)
+    const reference = [
+      retained(TURN_RECORD, { kind: 'turn', turnId: 'a', state: 'completed' }),
+      retained(own, prose('own'), { turnScope: inTurnA }),
+      retained(child, prose('child'), {
+        turnScope: inTurnA,
+        agentId: 'child-thread',
+        parentAgentId: 'root',
+        producerKind: 'agent'
+      })
+    ]
+    const merged = mergeRetainedHostLifecycleRows(reference, [
+      providerItem(own, prose('own')),
+      providerItem(child, prose('child'))
+    ])
+    expect(merged.find((item) => item.itemId === own)).toMatchObject({ turnScope: inTurnA })
+    expect(merged.find((item) => item.itemId === own)?.agentId).toBeUndefined()
+    expect(merged.find((item) => item.itemId === child)).toMatchObject({
+      turnScope: inTurnA,
+      agentId: 'child-thread',
+      parentAgentId: 'root',
+      producerKind: 'agent',
+      observedAt: 2
+    })
+  })
+
+  it("splices a command's turn, result and entry back, since provider history holds none", () => {
+    const before = codexKey('a', 1)
+    const commandTurn = orcaKey('command-turn:cmd-1')
+    const commandResult = orcaKey('command-result:cmd-1')
+    const entry = orcaKey('cmd-1')
+    const reference = [
+      retained(before, prose('before')),
+      retained(entry, {
+        kind: 'message',
+        role: 'user',
+        blocks: [{ type: 'text', text: '/compact' }],
+        command: { name: 'compact' }
+      }),
+      retained(commandTurn, { kind: 'turn', turnId: 'compact:cmd-1', state: 'completed' }),
+      retained(
+        commandResult,
+        { kind: 'status', text: 'Conversation compacted.', presentation: 'compaction' },
+        { turnScope: { kind: 'turn', turnItemId: commandTurn } }
+      )
+    ]
+    const merged = mergeRetainedHostLifecycleRows(reference, [
+      providerItem(before, prose('before'))
+    ])
+    expect(merged.map((item) => item.itemId)).toEqual([before, entry, commandTurn, commandResult])
+    expect(merged.at(-1)?.turnScope).toEqual({ kind: 'turn', turnItemId: commandTurn })
+  })
+
+  it('places a provider item the old epoch never held in the turn record for its provider turn', () => {
+    const commandTurn = orcaKey('command-turn:cmd-1')
+    const reference = [
+      retained(TURN_RECORD, { kind: 'turn', turnId: 'a', state: 'completed' }),
+      retained(commandTurn, {
+        kind: 'turn',
+        turnId: 'compact:cmd-1',
+        state: 'completed',
+        providerTurnId: 'b'
+      })
+    ]
+    const merged = mergeRetainedHostLifecycleRows(reference, [
+      providerItem(codexKey('a', 1), prose('in a')),
+      providerItem(codexKey('b', 1), prose('claimed by the command')),
+      providerItem(codexKey('c', 1), prose('no record'))
+    ])
+    const scopeOf = (itemId: string) => merged.find((item) => item.itemId === itemId)?.turnScope
+    expect(scopeOf(codexKey('a', 1))).toEqual(inTurnA)
+    expect(scopeOf(codexKey('b', 1))).toEqual({ kind: 'turn', turnItemId: commandTurn })
+    // No record to join: the rebuilt epoch places it by position.
+    expect(scopeOf(codexKey('c', 1))).toBeUndefined()
+  })
+})
+
+describe('the rebuilt epoch item for a retained row', () => {
+  it('passes a placeable scope and a known producer through', () => {
+    expect(
+      retainedRowReplacement(
+        retained(codexKey('a', 1), prose('x'), {
+          turnScope: inTurnA,
+          agentId: 'child',
+          producerKind: 'agent',
+          attempt: 2
+        })
+      )
+    ).toMatchObject({ turnScope: inTurnA, agentId: 'child', producerKind: 'agent', attempt: 2 })
+  })
+
+  it('drops a scope and a producer kind this build cannot place', () => {
+    const replacement = retainedRowReplacement(
+      retained(codexKey('a', 1), prose('x'), {
+        turnScope: { kind: 'future-kind' },
+        producerKind: 'future-producer'
+      })
+    )
+    expect(replacement.turnScope).toBeUndefined()
+    expect(replacement.producerKind).toBeUndefined()
+    expect(
+      retainedRowReplacement(
+        retained(codexKey('a', 1), prose('x'), { turnScope: { kind: 'turn' } })
+      ).turnScope
+    ).toBeUndefined()
+  })
+
+  it('leaves a row from an older record unscoped, for the rebuild to derive', () => {
+    const replacement = retainedRowReplacement(retained(codexKey('a', 1), prose('x')))
+    expect(replacement).not.toHaveProperty('turnScope')
+    expect(replacement).not.toHaveProperty('agentId')
+  })
+
+  it('still reads a persisted record written before rows carried scope or producer', () => {
+    const older = {
+      operationId: 'op-1',
+      callerKey: 'desktop',
+      itemId: codexKey('b', 0),
+      expectedEpoch: 'epoch-1',
+      phase: 'prepared',
+      retained: [{ itemId: codexKey('a', 1), body: prose('x'), observedAt: 1 }]
+    }
+    expect(AgentSessionRewindRecordSchema.safeParse(older).success).toBe(true)
+  })
+})
+
+describe('rewind merge cost', () => {
+  it('reads each merged row once to place the provider items it never held', () => {
+    const turns = 400
+    const providerItems = Array.from({ length: turns }, (_, index) =>
+      providerItem(codexKey(`t${index}`, 1), prose(`answer ${index}`))
+    )
+    const reference = Array.from({ length: turns }, (_, index) =>
+      retained(orcaKey(`turn-${index}`), {
+        kind: 'turn',
+        turnId: `t${index}`,
+        state: 'completed'
+      })
+    )
+    vi.mocked(restoreRewindJournalBody).mockClear()
+
+    const merged = mergeRetainedHostLifecycleRows(reference, providerItems)
+
+    expect(merged.find((item) => item.itemId === codexKey(`t${turns - 1}`, 1))).toMatchObject({
+      turnScope: { kind: 'turn', turnItemId: orcaKey(`turn-${turns - 1}`) }
+    })
+    // A scan per provider item reads every merged row for each one: turns² reads.
+    expect(vi.mocked(restoreRewindJournalBody).mock.calls.length).toBeLessThanOrEqual(merged.length)
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-rewind-retained-host-rows.ts b/src/main/native-chat/agent-session-wire/structured-rewind-retained-host-rows.ts
index 35307566599..6496518b50b 100644
--- a/src/main/native-chat/agent-session-wire/structured-rewind-retained-host-rows.ts
+++ b/src/main/native-chat/agent-session-wire/structured-rewind-retained-host-rows.ts
@@ -1,18 +1,30 @@
 // Provider preflight returns provider items only. The host's lifecycle rows are its own record, so
 // a rewind that takes the provider list as the new epoch must splice those rows back beside the
-// provider item each one followed.
+// provider item each one followed. Provider items carry neither turn scope nor producer, so each
+// keeps the ones its retained row held.
 
 import { parseCodexGoalJournalItemId } from '../../codex/codex-goal-journal-identity'
-import type { AgentJournalItemBody } from '../../../shared/agent-session-journal-types'
+import { parseAgentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity,
+  AgentJournalProducerLinkage,
+  AgentJournalTurnScope
+} from '../../../shared/agent-session-journal-types'
 import type { AgentSessionRewindRecord } from '../../../shared/agent-session-rewind'
 import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
+import { restoreRewindJournalBody } from './structured-rewind-journal-body'
 
 type RetainedRow = AgentSessionRewindRecord['retained'][number]
 
 export function isRetainedHostLifecycleRow(item: RetainedRow): boolean {
+  const identity = parseAgentJournalItemKey(item.itemId)
   return (
     readAgentJournalTurn(item.body as AgentJournalItemBody) !== null ||
-    parseCodexGoalJournalItemId(item.itemId) !== null
+    parseCodexGoalJournalItemId(item.itemId) !== null ||
+    // A conversation command's entry and result: the provider's history holds neither.
+    (item.body.kind === 'message' && item.body.command !== undefined) ||
+    (identity?.provider === 'orca' && identity.clientMessageId.startsWith('command-'))
   )
 }
 
@@ -22,6 +34,7 @@ export function mergeRetainedHostLifecycleRows(
   providerItems: readonly RetainedRow[]
 ): RetainedRow[] {
   const spineIndex = new Map(providerItems.map((item, index) => [item.itemId, index]))
+  const held = new Map(reference.map((item) => [item.itemId, item]))
   const rowsAfter = new Map<number, RetainedRow[]>()
   let anchor = -1
   for (const item of reference) {
@@ -32,6 +45,77 @@ export function mergeRetainedHostLifecycleRows(
     }
   }
   const merged = [...(rowsAfter.get(-1) ?? [])]
-  providerItems.forEach((item, index) => merged.push(item, ...(rowsAfter.get(index) ?? [])))
-  return merged
+  providerItems.forEach((item, index) =>
+    merged.push(withHeldAttribution(item, held.get(item.itemId)), ...(rowsAfter.get(index) ?? []))
+  )
+  const turnRecords = turnRecordsByProviderTurn(merged)
+  return merged.map((item) =>
+    held.has(item.itemId) || item.turnScope ? item : withProviderTurnScope(item, turnRecords)
+  )
+}
+
+/** The rebuilt epoch's item for one retained row, with the scope and producer it was written with. */
+export function retainedRowReplacement(row: RetainedRow): AgentJournalProducerLinkage & {
+  identity: AgentJournalItemIdentity
+  body: AgentJournalItemBody
+  observedAt: number
+  turnScope?: AgentJournalTurnScope
+} {
+  const identity = parseAgentJournalItemKey(row.itemId)
+  if (!identity) {
+    throw new Error('agent_session_rewind:invalid-retained-identity')
+  }
+  const { agentId, parentAgentId, providerParentRef, producerKind, attempt, turnScope } = row
+  const scope =
+    turnScope?.kind === 'turn' && turnScope.turnItemId
+      ? { kind: 'turn' as const, turnItemId: turnScope.turnItemId }
+      : turnScope?.kind === 'thread'
+        ? { kind: 'thread' as const }
+        : undefined
+  return {
+    identity,
+    body: restoreRewindJournalBody(row.body),
+    observedAt: row.observedAt,
+    ...(scope ? { turnScope: scope } : {}),
+    ...(agentId === undefined ? {} : { agentId }),
+    ...(parentAgentId === undefined ? {} : { parentAgentId }),
+    ...(providerParentRef === undefined ? {} : { providerParentRef }),
+    ...(producerKind === 'agent' || producerKind === 'background' ? { producerKind } : {}),
+    ...(attempt === undefined ? {} : { attempt })
+  }
+}
+
+function withHeldAttribution(item: RetainedRow, held: RetainedRow | undefined): RetainedRow {
+  if (!held) {
+    return item
+  }
+  const { itemId: _itemId, body: _body, observedAt: _observedAt, ...attribution } = held
+  return { ...item, ...attribution }
+}
+
+/** Provider turn id → the item id of its turn record: the turn's own, or the command turn that
+ *  claimed it. The first record wins, as a scan from the top would find it. */
+function turnRecordsByProviderTurn(merged: readonly RetainedRow[]): ReadonlyMap<string, string> {
+  const records = new Map<string, string>()
+  for (const candidate of merged) {
+    const turn = readAgentJournalTurn(restoreRewindJournalBody(candidate.body))
+    for (const turnId of [turn?.turnId, turn?.providerTurnId]) {
+      if (turnId !== undefined && !records.has(turnId)) {
+        records.set(turnId, candidate.itemId)
+      }
+    }
+  }
+  return records
+}
+
+/** A provider item the old epoch never held joins the turn record for its provider turn.
+ *  Otherwise the rebuild places it. */
+function withProviderTurnScope(
+  item: RetainedRow,
+  turnRecords: ReadonlyMap<string, string>
+): RetainedRow {
+  const identity = parseAgentJournalItemKey(item.itemId)
+  const turnItemId =
+    identity?.provider === 'codex' && identity.turnId ? turnRecords.get(identity.turnId) : undefined
+  return turnItemId ? { ...item, turnScope: { kind: 'turn', turnItemId } } : item
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-session-compaction.test.ts b/src/main/native-chat/agent-session-wire/structured-session-compaction.test.ts
deleted file mode 100644
index 13a22b655b3..00000000000
--- a/src/main/native-chat/agent-session-wire/structured-session-compaction.test.ts
+++ /dev/null
@@ -1,108 +0,0 @@
-import { describe, expect, it, vi } from 'vitest'
-import { StructuredSessionCompaction } from './structured-session-compaction'
-
-describe('structured compaction lifecycle', () => {
-  it('waits beyond the Codex acknowledgment and ignores other threads', async () => {
-    const tracker = new StructuredSessionCompaction()
-    const finished = vi.fn()
-    const result = tracker
-      .run('session', 'thread', async () => ({}))
-      .then((value) => {
-        finished()
-        return value
-      })
-    await Promise.resolve()
-    tracker.codex('session', 'turn/started', { threadId: 'other', turn: { id: 'foreign' } })
-    tracker.codex('session', 'turn/completed', {
-      threadId: 'other',
-      turn: { id: 'foreign', status: 'completed' }
-    })
-    expect(finished).not.toHaveBeenCalled()
-    tracker.codex('session', 'turn/started', { threadId: 'thread', turn: { id: 'compact-turn' } })
-    tracker.codex('session', 'item/completed', {
-      threadId: 'thread',
-      item: { type: 'contextCompaction' }
-    })
-    expect(finished).not.toHaveBeenCalled()
-    tracker.codex('session', 'turn/completed', {
-      threadId: 'thread',
-      turn: { id: 'compact-turn', status: 'completed' }
-    })
-    await expect(result).resolves.toEqual({})
-  })
-
-  it('observes notifications arriving before the request acknowledgment', async () => {
-    const tracker = new StructuredSessionCompaction()
-    await expect(
-      tracker.run('s', 't', async () => {
-        tracker.codex('s', 'turn/started', { threadId: 't', turn: { id: 'c' } })
-        tracker.codex('s', 'turn/completed', {
-          threadId: 't',
-          turn: { id: 'c', status: 'failed', error: { message: 'Unavailable' } }
-        })
-      })
-    ).resolves.toEqual({ error: 'Unavailable' })
-  })
-
-  it.each(['success', 'failed'])(
-    'uses Claude compact_result %s rather than result subtype',
-    async (state) => {
-      const tracker = new StructuredSessionCompaction()
-      const result = tracker.run('s', 'provider', async () => {})
-      tracker.claude('s', {
-        type: 'system',
-        subtype: 'status',
-        session_id: 'provider',
-        compact_result: state,
-        compact_error: 'Not enough messages to compact.'
-      })
-      tracker.claude('s', {
-        type: 'result',
-        subtype: 'success',
-        session_id: 'provider',
-        result: ''
-      })
-      await expect(result).resolves.toEqual(
-        state === 'success' ? {} : { error: 'Not enough messages to compact.' }
-      )
-    }
-  )
-
-  it('cleans up on provider exit and permits another operation', async () => {
-    const tracker = new StructuredSessionCompaction()
-    const pending = tracker.run('s', 'p', async () => {})
-    tracker.ended('s')
-    await expect(pending).resolves.toEqual({ error: 'The provider exited during compaction.' })
-    const next = tracker.run('s', 'p', async () => {
-      tracker.claude('s', { type: 'system', subtype: 'compact_boundary', session_id: 'p' })
-      tracker.claude('s', { type: 'result', subtype: 'success', session_id: 'p' })
-    })
-    await expect(next).resolves.toEqual({})
-  })
-  it('reconciles a terminal frame after timeout without repeating the provider request', async () => {
-    vi.useFakeTimers()
-    try {
-      const tracker = new StructuredSessionCompaction(10)
-      const late = vi.fn(async () => {})
-      const invoke = vi.fn(async () => ({}))
-      const result = tracker.run('s', 'p', invoke, late)
-      const rejected = expect(result).rejects.toThrow('unconfirmed')
-      await vi.advanceTimersByTimeAsync(11)
-      await rejected
-      tracker.claude('s', { type: 'system', subtype: 'compact_boundary', session_id: 'p' })
-      tracker.claude('s', { type: 'result', subtype: 'success', session_id: 'p' })
-      expect(late).toHaveBeenCalledWith({})
-      expect(invoke).toHaveBeenCalledTimes(1)
-    } finally {
-      vi.useRealTimers()
-    }
-  })
-
-  it('does not mistake an unrelated completed turn for compaction', async () => {
-    const tracker = new StructuredSessionCompaction()
-    const result = tracker.run('s', 't', async () => ({}))
-    tracker.codex('s', 'turn/started', { threadId: 't', turn: { id: 'c' } })
-    tracker.codex('s', 'turn/completed', { threadId: 't', turn: { id: 'c', status: 'completed' } })
-    await expect(result).resolves.toEqual({ error: 'Compaction did not complete.' })
-  })
-})
diff --git a/src/main/native-chat/agent-session-wire/structured-session-compaction.ts b/src/main/native-chat/agent-session-wire/structured-session-compaction.ts
deleted file mode 100644
index 328c283dc11..00000000000
--- a/src/main/native-chat/agent-session-wire/structured-session-compaction.ts
+++ /dev/null
@@ -1,143 +0,0 @@
-type PendingCompaction = {
-  identity: string
-  commandTurnId?: string
-  turnId?: string
-  error?: string
-  compacted: boolean
-  finish: (result: { error?: string }) => void
-}
-
-function record(value: unknown): Record<string, unknown> {
-  return value && typeof value === 'object' ? (value as Record<string, unknown>) : {}
-}
-
-export function isCodexCompactionComplete(method: string, params: unknown): boolean {
-  return (
-    method === 'thread/compacted' ||
-    (method === 'item/completed' && record(record(params).item).type === 'contextCompaction')
-  )
-}
-
-/** A receipt is not completion; keep listening through the provider's terminal frame. */
-export class StructuredSessionCompaction {
-  private readonly pending = new Map<string, PendingCompaction>()
-  constructor(private readonly timeoutMs = 180_000) {}
-
-  async run(
-    sessionId: string,
-    identity: string,
-    invoke: () => Promise<unknown>,
-    onLateResult?: (result: { error?: string }) => Promise<void>,
-    commandTurnId?: string
-  ): Promise<{ error?: string }> {
-    if (this.pending.has(sessionId)) {
-      throw new Error('Compaction is already running.')
-    }
-    let timer: ReturnType<typeof setTimeout>
-    let expired = false
-    const completion = new Promise<{ error?: string }>((resolve, reject) => {
-      const finish = (result: { error?: string }) => {
-        this.pending.delete(sessionId)
-        if (expired && onLateResult) {
-          void onLateResult(result).catch((error) =>
-            console.warn('Could not persist late compaction completion', error)
-          )
-        }
-        resolve(result)
-      }
-      this.pending.set(sessionId, {
-        identity,
-        commandTurnId,
-        compacted: false,
-        finish
-      })
-      timer = setTimeout(() => {
-        expired = true
-        reject(new Error('Compaction completion is unconfirmed.'))
-      }, this.timeoutMs)
-      timer.unref?.()
-    })
-    // Observe rejection even while invoke is waiting for its own receipt.
-    void completion.catch(() => {})
-    try {
-      const admission = record(await invoke())
-      if (typeof admission.error === 'string') {
-        this.pending.get(sessionId)?.finish({ error: admission.error })
-      }
-      return await completion
-    } catch (error) {
-      expired = this.pending.has(sessionId)
-      throw error
-    } finally {
-      clearTimeout(timer!)
-      if (!expired) {
-        this.pending.delete(sessionId)
-      }
-    }
-  }
-
-  hasPending(sessionId: string): boolean {
-    return this.pending.has(sessionId)
-  }
-
-  ownsTurn(sessionId: string, turnId: string): boolean {
-    return this.pending.get(sessionId)?.commandTurnId === turnId
-  }
-
-  providerTurnId(sessionId: string, turnId: string): string | undefined {
-    return this.ownsTurn(sessionId, turnId) ? this.pending.get(sessionId)?.turnId : turnId
-  }
-
-  ended(sessionId: string): void {
-    this.pending.get(sessionId)?.finish({ error: 'The provider exited during compaction.' })
-  }
-
-  codex(sessionId: string, method: string, value: unknown): void {
-    const pending = this.pending.get(sessionId)
-    const params = record(value)
-    if (!pending || params.threadId !== pending.identity) {
-      return
-    }
-    const turn = record(params.turn)
-    if (method === 'turn/started' && typeof turn.id === 'string') {
-      pending.turnId = turn.id
-    }
-    if (isCodexCompactionComplete(method, params)) {
-      pending.compacted = true
-    }
-    if (method === 'turn/completed' && turn.id === pending.turnId) {
-      const error = record(turn.error).message
-      pending.finish(
-        turn.status === 'completed' && pending.compacted
-          ? {}
-          : { error: typeof error === 'string' ? error : 'Compaction did not complete.' }
-      )
-    }
-  }
-
-  claude(sessionId: string, message: Record<string, unknown>): void {
-    const pending = this.pending.get(sessionId)
-    if (!pending || message.session_id !== pending.identity) {
-      return
-    }
-    if (message.compact_result === 'failed') {
-      pending.error =
-        typeof message.compact_error === 'string' ? message.compact_error : 'Compaction failed.'
-    }
-    if (message.compact_result === 'success' || message.subtype === 'compact_boundary') {
-      pending.compacted = true
-    }
-    if (message.type === 'result') {
-      if (
-        message.is_error === true ||
-        (typeof message.subtype === 'string' && message.subtype.startsWith('error'))
-      ) {
-        pending.error ??= 'Compaction did not complete.'
-      }
-      const error =
-        pending.error ??
-        (pending.compacted ? undefined : 'Compaction was not confirmed by the provider.')
-      pending.finish(error ? { error } : {})
-    }
-  }
-}
diff --git a/src/main/native-chat/agent-session-wire/unhandled-provider-frame.ts b/src/main/native-chat/agent-session-wire/unhandled-provider-frame.ts
index cbb0857c859..915bbad5e54 100644
--- a/src/main/native-chat/agent-session-wire/unhandled-provider-frame.ts
+++ b/src/main/native-chat/agent-session-wire/unhandled-provider-frame.ts
@@ -1,4 +1,4 @@
-import type { AgentJournalStatusItem } from '../../../shared/agent-session-journal-types'
+import type { AgentJournalPlainStatusItem } from '../../../shared/agent-session-journal-types'
 import {
   boundInlineText,
   boundPayload,
@@ -12,7 +12,7 @@ import {
 } from './provider-frame-disposition'
 
 export type UnhandledProviderFrameJournalItem = {
-  body: AgentJournalStatusItem
+  body: AgentJournalPlainStatusItem
   /** Why the frame surfaced. Error frames are exempt from generic-row caps. */
   classification: 'timeline-substantive' | 'error-surface'
 }
diff --git a/src/main/native-chat/claude-structured-managed-account-support.ts b/src/main/native-chat/claude-structured-managed-account-support.ts
index dccf6216bda..3b42c44c443 100644
--- a/src/main/native-chat/claude-structured-managed-account-support.ts
+++ b/src/main/native-chat/claude-structured-managed-account-support.ts
@@ -43,12 +43,19 @@ export function structuredClaudeMatchesActiveManagedAccount(
     // apart after the fact: honest deselection, where ambient auth is the truth and the UI names no
     // identity, and the WSL-only case, where the prune emptied the host slot and persisted null
     // while the UI still names the WSL account. The presence of any WSL-bound account decides.
-    return !accounts.some((candidate) => candidate.managedAuthRuntime === 'wsl')
+    return !hasWslBoundClaudeAccount(settings)
   }
   const active = accounts.find((candidate) => candidate.id === activeHostId)
   return active ? active.managedAuthRuntime !== 'wsl' : false
 }
 
+/** Whether any managed Claude account lives in WSL, the account shape the gate refuses over. */
+export function hasWslBoundClaudeAccount(settings: ClaudeManagedAccountGateSettings): boolean {
+  return (settings.claudeManagedAccounts ?? []).some(
+    (candidate) => candidate.managedAuthRuntime === 'wsl'
+  )
+}
+
 /** Reads the gate's settings, answering null when they cannot be read so callers refuse. */
 export function readClaudeManagedAccountGateSettings(
   getSettings: () => ClaudeManagedAccountGateSettings
diff --git a/src/main/native-chat/structured-agent-session-history-adoption.ts b/src/main/native-chat/structured-agent-session-history-adoption.ts
index d470735b032..e64e8f799d8 100644
--- a/src/main/native-chat/structured-agent-session-history-adoption.ts
+++ b/src/main/native-chat/structured-agent-session-history-adoption.ts
@@ -5,6 +5,7 @@
 // journal, and a call site written there would compile however wrong it was. The runtime hands over
 // the facts it owns — the account homes it recognises, the records it holds — and this decides.
 
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
 import type { AgentSessionOperationRow } from '../../shared/agent-session-operation-ledger'
 import type { AgentSessionProviderHandle } from '../../shared/agent-session-journal-types'
 import type { AgentSessionLease, AgentSessionRecord } from '../../shared/agent-session-record'
@@ -106,10 +107,11 @@ export function findConflictingStructuredAdoption(input: {
 export function structuredAdoptionConflictError(
   ownership: StructuredAgentSessionAdoptionOwnership
 ): Error {
-  return new Error(
+  return agentSessionRefusalError(
     agentSessionLeaseAdmitsWriter(ownership.lease)
       ? 'agent_session_conflict'
-      : 'agent_session_ownership_unknown'
+      : 'agent_session_ownership_unknown',
+    { reason: 'conversationHeldElsewhere' }
   )
 }
 
@@ -152,5 +154,7 @@ export async function resolveStructuredAgentSessionAdoption(input: {
   }
   // Refuse rather than fall back to the default home. Resuming under a home that does not hold the
   // conversation is how a "resume" silently becomes a blank chat wearing the old chat's name.
-  throw new Error('agent_session_identity_required')
+  throw agentSessionRefusalError('agent_session_identity_required', {
+    reason: 'transcriptNotFound'
+  })
 }
diff --git a/src/main/native-chat/transcript-read-cache-inflight.test.ts b/src/main/native-chat/transcript-read-cache-inflight.test.ts
new file mode 100644
index 00000000000..47abc8b3e42
--- /dev/null
+++ b/src/main/native-chat/transcript-read-cache-inflight.test.ts
@@ -0,0 +1,215 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ReadTranscriptResult } from './transcript-reader'
+
+const mocks = vi.hoisted(() => ({
+  resolve: vi.fn<(...args: unknown[]) => Promise<string | null>>(),
+  stat: vi.fn<() => Promise<{ mtimeMs: number; size: number }>>(),
+  read: vi.fn<() => Promise<ReadTranscriptResult>>()
+}))
+
+vi.mock('./session-file-resolver', () => ({ resolveSessionFilePath: mocks.resolve }))
+vi.mock('./wsl-transcript-fs-access', () => ({ wslGatedStat: mocks.stat }))
+vi.mock('./transcript-reader', () => ({ readNativeChatTranscript: mocks.read }))
+
+import {
+  clearNativeChatTranscriptCache,
+  readNativeChatTranscriptCached
+} from './transcript-read-cache'
+import {
+  WSL_TRANSCRIPT_FS_SLOW_MESSAGE,
+  wslTranscriptFsTimeoutError
+} from './wsl-transcript-fs-error'
+
+beforeEach(() => {
+  clearNativeChatTranscriptCache()
+  vi.resetAllMocks()
+  mocks.resolve.mockResolvedValue('/repo/session.jsonl')
+  mocks.stat.mockResolvedValue({ mtimeMs: 1, size: 10 })
+})
+
+describe('concurrent transcript cache reads', () => {
+  it('parses a shared file generation once across simultaneous clients and session aliases', async () => {
+    const pending = Promise.withResolvers<ReadTranscriptResult>()
+    const result: ReadTranscriptResult = { messages: [] }
+    mocks.read.mockReturnValue(pending.promise)
+    const calls = Array.from({ length: 8 }, (_, i) =>
+      readNativeChatTranscriptCached('claude', `session-alias-${i}`)
+    )
+
+    await vi.waitFor(() => expect(mocks.stat).toHaveBeenCalledTimes(8))
+    pending.resolve(result)
+
+    expect((await Promise.all(calls)).every((value) => value === result)).toBe(true)
+    expect(mocks.read).toHaveBeenCalledTimes(1)
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(result)
+    expect(mocks.read).toHaveBeenCalledTimes(1)
+    expect(mocks.stat).toHaveBeenCalledTimes(9)
+  })
+
+  it('does not share a session id across distinct resolved files or agents', async () => {
+    const first = Promise.withResolvers<ReadTranscriptResult>()
+    const second = Promise.withResolvers<ReadTranscriptResult>()
+    const third = Promise.withResolvers<ReadTranscriptResult>()
+    mocks.resolve
+      .mockResolvedValueOnce('/repo-a/session.jsonl')
+      .mockResolvedValueOnce('/repo-b/session.jsonl')
+      .mockResolvedValueOnce('/repo-a/session.jsonl')
+    mocks.read
+      .mockReturnValueOnce(first.promise)
+      .mockReturnValueOnce(second.promise)
+      .mockReturnValueOnce(third.promise)
+    const calls = [
+      readNativeChatTranscriptCached('claude', 'session'),
+      readNativeChatTranscriptCached('claude', 'session'),
+      readNativeChatTranscriptCached('codex', 'session')
+    ]
+    const results: ReadTranscriptResult[] = [{ messages: [] }, { messages: [] }, { messages: [] }]
+    first.resolve(results[0])
+    second.resolve(results[1])
+    third.resolve(results[2])
+
+    const actual = await Promise.all(calls)
+    actual.forEach((value, i) => expect(value).toBe(results[i]))
+    expect(mocks.read).toHaveBeenCalledTimes(3)
+  })
+
+  it.each([
+    { mtimeMs: 2, size: 10 },
+    { mtimeMs: 1, size: 20 }
+  ])('does not let an older parse overwrite changed file stats %j', async (changedStat) => {
+    const oldRead = Promise.withResolvers<ReadTranscriptResult>()
+    const oldResult: ReadTranscriptResult = { messages: [] }
+    const newResult: ReadTranscriptResult = { messages: [] }
+    mocks.read.mockReturnValueOnce(oldRead.promise).mockResolvedValueOnce(newResult)
+    const first = readNativeChatTranscriptCached('claude', 'session')
+    await vi.waitFor(() => expect(mocks.read).toHaveBeenCalledTimes(1))
+
+    mocks.stat.mockResolvedValue(changedStat)
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(newResult)
+    oldRead.resolve(oldResult)
+    await expect(first).resolves.toBe(oldResult)
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(newResult)
+    expect(mocks.read).toHaveBeenCalledTimes(2)
+  })
+
+  it('invalidates a completed parse when size changes without an mtime change', async () => {
+    const first: ReadTranscriptResult = { messages: [] }
+    const second: ReadTranscriptResult = { messages: [] }
+    mocks.read.mockResolvedValueOnce(first).mockResolvedValueOnce(second)
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(first)
+    mocks.stat.mockResolvedValue({ mtimeMs: 1, size: 20 })
+
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(second)
+    expect(mocks.read).toHaveBeenCalledTimes(2)
+  })
+
+  it('rechecks the cache when another read completes during stat', async () => {
+    const slowStat = Promise.withResolvers<{ mtimeMs: number; size: number }>()
+    const result: ReadTranscriptResult = { messages: [] }
+    mocks.stat.mockReturnValueOnce(slowStat.promise)
+    mocks.read.mockResolvedValue(result)
+    const delayed = readNativeChatTranscriptCached('claude', 'session')
+    await vi.waitFor(() => expect(mocks.stat).toHaveBeenCalledTimes(1))
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(result)
+    slowStat.resolve({ mtimeMs: 1, size: 10 })
+
+    await expect(delayed).resolves.toBe(result)
+    expect(mocks.read).toHaveBeenCalledTimes(1)
+  })
+
+  it('serves the latest completed parse if a concurrent stat is refused', async () => {
+    const first: ReadTranscriptResult = { messages: [] }
+    const latest: ReadTranscriptResult = { messages: [] }
+    mocks.read.mockResolvedValueOnce(first).mockResolvedValueOnce(latest)
+    await readNativeChatTranscriptCached('claude', 'session')
+
+    const slowStat = Promise.withResolvers<{ mtimeMs: number; size: number }>()
+    mocks.stat.mockReturnValueOnce(slowStat.promise).mockResolvedValue({ mtimeMs: 2, size: 20 })
+    const delayed = readNativeChatTranscriptCached('claude', 'session')
+    await vi.waitFor(() => expect(mocks.stat).toHaveBeenCalledTimes(2))
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(latest)
+    slowStat.reject(wslTranscriptFsTimeoutError())
+
+    await expect(delayed).resolves.toBe(latest)
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(latest)
+    expect(mocks.read).toHaveBeenCalledTimes(2)
+  })
+
+  it.each(['resolve', 'stat', 'read'] as const)(
+    'clear fences work waiting on %s',
+    async (stage) => {
+      const oldResult: ReadTranscriptResult = { messages: [] }
+      const freshResult: ReadTranscriptResult = { messages: [] }
+      const pending = Promise.withResolvers<void>()
+      if (stage === 'resolve') {
+        mocks.resolve.mockImplementationOnce(async () => {
+          await pending.promise
+          return '/repo/session.jsonl'
+        })
+      } else if (stage === 'stat') {
+        mocks.stat.mockImplementationOnce(async () => {
+          await pending.promise
+          return { mtimeMs: 1, size: 10 }
+        })
+      } else {
+        mocks.read.mockImplementationOnce(async () => {
+          await pending.promise
+          return oldResult
+        })
+      }
+      const oldCall = readNativeChatTranscriptCached('claude', 'session')
+      await vi.waitFor(() => expect(mocks[stage]).toHaveBeenCalledTimes(1))
+      clearNativeChatTranscriptCache()
+      mocks.read.mockResolvedValue(freshResult)
+      await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(freshResult)
+      mocks.read.mockResolvedValue(oldResult)
+      pending.resolve()
+
+      await expect(oldCall).resolves.toBe(oldResult)
+      await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(freshResult)
+      expect(mocks.read).toHaveBeenCalledTimes(2)
+    }
+  )
+
+  it.each([
+    { error: WSL_TRANSCRIPT_FS_SLOW_MESSAGE },
+    { error: 'File was rotated', notFound: true } as const
+  ])('shares a retryable result only while in flight: %j', async (error) => {
+    const pending = Promise.withResolvers<ReadTranscriptResult>()
+    mocks.read.mockReturnValueOnce(pending.promise).mockResolvedValue({ messages: [] })
+    const first = readNativeChatTranscriptCached('claude', 'session')
+    const second = readNativeChatTranscriptCached('claude', 'session')
+    await vi.waitFor(() => expect(mocks.stat).toHaveBeenCalledTimes(2))
+    pending.resolve(error)
+
+    expect(await Promise.all([first, second])).toEqual([error, error])
+    expect(mocks.read).toHaveBeenCalledTimes(1)
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toEqual({
+      messages: []
+    })
+    expect(mocks.read).toHaveBeenCalledTimes(2)
+  })
+
+  it('retries a rejected body read', async () => {
+    mocks.read.mockRejectedValueOnce(new Error('read failure')).mockResolvedValue({ messages: [] })
+    await expect(readNativeChatTranscriptCached('claude', 'session')).rejects.toThrow(
+      'read failure'
+    )
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toEqual({
+      messages: []
+    })
+    expect(mocks.read).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not share or cache reads whose file generation could not be determined', async () => {
+    mocks.stat.mockRejectedValue(new Error('stat failed'))
+    mocks.read.mockImplementation(async () => ({ messages: [] }))
+    const [first, second] = await Promise.all([
+      readNativeChatTranscriptCached('claude', 'session'),
+      readNativeChatTranscriptCached('claude', 'session')
+    ])
+    expect(first).not.toBe(second)
+    await readNativeChatTranscriptCached('claude', 'session')
+    expect(mocks.read).toHaveBeenCalledTimes(3)
+  })
+})
diff --git a/src/main/native-chat/transcript-read-cache.ts b/src/main/native-chat/transcript-read-cache.ts
index ab5c220bfd1..828521e2e3d 100644
--- a/src/main/native-chat/transcript-read-cache.ts
+++ b/src/main/native-chat/transcript-read-cache.ts
@@ -1,4 +1,5 @@
 import type { AgentType } from '../../shared/native-chat-types'
+import { InFlightPromiseDedupe, stableInFlightKey } from '../../shared/in-flight-promise-dedupe'
 import { resolveSessionFilePath } from './session-file-resolver'
 import { readNativeChatTranscript, type ReadTranscriptResult } from './transcript-reader'
 import { wslGatedStat } from './wsl-transcript-fs-access'
@@ -24,14 +25,18 @@ import {
 
 type CachedTranscript = {
   result: ReadTranscriptResult
-  /** mtime of the resolved file when cached; a newer mtime invalidates it. */
+  /** mtime of the resolved file when cached; changed mtime or size invalidates it. */
   mtimeMs: number
   /** On-disk byte size of the resolved file — a cheap, monotonic proxy for this
    *  entry's parsed memory footprint, used to bound the cache by total bytes. */
   bytes: number
+  readOrder: number
 }
 
 const cache = new Map<string, CachedTranscript>()
+const inFlightReads = new InFlightPromiseDedupe<ReadTranscriptResult>()
+let cacheEpoch = 0
+let nextReadOrder = 0
 
 // Why: cap the cache so a long-lived process browsing many sessions can't grow
 // it unbounded. Map preserves insertion order, so evicting the first key drops
@@ -90,7 +95,7 @@ async function fileStat(filePath: string): Promise<{ mtimeMs: number; bytes: num
 
 /**
  * Read the full transcript for an agent + session, returning the cached parse on
- * an mtime hit and re-reading (and re-caching) when the file changed. Returns the
+ * an mtime/size hit and re-reading (and re-caching) when the file changed. Returns the
  * canonical, unwindowed result; callers apply their own windowing/truncation.
  */
 export async function readNativeChatTranscriptCached(
@@ -99,6 +104,7 @@ export async function readNativeChatTranscriptCached(
   /** Hook-reported authoritative transcript path, preferred over the id glob. */
   transcriptPath?: string
 ): Promise<ReadTranscriptResult> {
+  const epoch = cacheEpoch
   let filePath: string | null
   try {
     filePath = await resolveSessionFilePath(agent, sessionId, { transcriptPath })
@@ -114,7 +120,7 @@ export async function readNativeChatTranscriptCached(
   }
 
   const key = cacheKey(agent, filePath)
-  const cached = cache.get(key)
+  let cached = epoch === cacheEpoch ? cache.get(key) : undefined
   let mtimeMs: number
   let bytes: number
   try {
@@ -123,6 +129,7 @@ export async function readNativeChatTranscriptCached(
     // Why: the refusal says the distro stalled, not that this parse went stale —
     // a complete cached transcript beats a retry banner. With nothing cached the
     // error stands, and no `notFound`, so the next call re-stats a woken distro.
+    cached = epoch === cacheEpoch ? (cache.get(key) ?? cached) : undefined
     if (cached) {
       // Bump recency so a session read through a stall survives eviction.
       setCached(key, cached)
@@ -130,30 +137,43 @@ export async function readNativeChatTranscriptCached(
     }
     return { error: wslTranscriptFsRefusal(err).message }
   }
-  if (cached && Number.isFinite(mtimeMs) && cached.mtimeMs === mtimeMs) {
+  // Another reader can populate the cache while this caller waits for stat.
+  cached = epoch === cacheEpoch ? cache.get(key) : undefined
+  if (cached && Number.isFinite(mtimeMs) && cached.mtimeMs === mtimeMs && cached.bytes === bytes) {
     // Bump recency so a frequently-read session survives eviction.
     setCached(key, cached)
     return cached.result
   }
 
-  const result = await readNativeChatTranscript(agent, sessionId, { filePath })
-  // Why: a body-read refusal is transient unavailability, but the file's mtime
-  // is unchanged by it — caching it would serve the retryable error to every
-  // later call until the transcript itself changes, even after the distro woke.
-  if (Number.isFinite(mtimeMs) && !isGateRefusal(result)) {
-    setCached(key, { result, mtimeMs, bytes })
+  if (!Number.isFinite(mtimeMs) || epoch !== cacheEpoch) {
+    return readNativeChatTranscript(agent, sessionId, { filePath })
   }
-  return result
+
+  return inFlightReads.run(stableInFlightKey([key, mtimeMs, bytes, epoch]), async () => {
+    const readOrder = ++nextReadOrder
+    const result = await readNativeChatTranscript(agent, sessionId, { filePath })
+    // Late parses must not overwrite a newer completed read or repopulate a cleared cache.
+    if (
+      epoch === cacheEpoch &&
+      (cache.get(key)?.readOrder ?? 0) < readOrder &&
+      !isRetryableReadError(result)
+    ) {
+      setCached(key, { result, mtimeMs, bytes, readOrder })
+    }
+    return result
+  })
 }
 
-// The reader flattens a refusal into its message, so that is the only handle
-// this layer has on one.
-function isGateRefusal(result: ReadTranscriptResult): boolean {
-  return 'error' in result && isWslTranscriptFsRefusalMessage(result.error)
+function isRetryableReadError(result: ReadTranscriptResult): boolean {
+  return (
+    'error' in result && (result.notFound === true || isWslTranscriptFsRefusalMessage(result.error))
+  )
 }
 
 /** Test-only: drop the transcript parse cache between runs. */
 export function clearNativeChatTranscriptCache(): void {
+  cacheEpoch += 1
+  inFlightReads.clear()
   cache.clear()
 }
 
diff --git a/src/main/network/macos-tailscale-dns-diagnostic.ts b/src/main/network/macos-tailscale-dns-diagnostic.ts
index a4dc948c0bd..a8e5a92ef58 100644
--- a/src/main/network/macos-tailscale-dns-diagnostic.ts
+++ b/src/main/network/macos-tailscale-dns-diagnostic.ts
@@ -14,8 +14,28 @@ type CacheEntry = {
 
 let cache: CacheEntry | null = null
 
+// Symbolic errno/Chromium codes carry the weight because they are locale-independent; the
+// English phrases only add coverage, so a localized or reworded string costs the hint, never
+// a wrong message. Deliberately over-inclusive: a false candidate re-reads cached DNS state,
+// a missed one silently drops the diagnostic that explains a broken connection.
 const NETWORK_LOOKUP_FAILURE_RE =
-  /\b(?:ENOTFOUND|EAI_AGAIN|ESERVFAIL|ERR_NAME_NOT_RESOLVED)\b|lookup address|nodename nor servname|name resolution|dns|websocket|connection refused/i
+  /\b(?:ENOTFOUND|ENODATA|EAI_AGAIN|EAI_FAIL|EAI_NODATA|EAI_NONAME|ESERVFAIL|ERR_NAME_NOT_RESOLVED|ERR_NAME_RESOLUTION_FAILED|getaddrinfo)\b|lookup address|nodename nor servname|name resolution|name or service not known|no address associated with hostname|(?:could not|couldn't|cannot|can't|unable to|failed to) resolve|dns|websocket|connection refused/i
+
+const MAGIC_DNS_HINT =
+  'macOS is using Tailscale MagicDNS (100.100.100.100) as the only global DNS resolver; add an upstream DNS server to the active network service or configure Tailscale global nameservers, then retry.'
+
+/**
+ * Single source of truth for "could a DNS sample explain this failure?". The probe-admission
+ * gate and the hint decision must never disagree — a gate stricter than the hint test silently
+ * loses the diagnostic for a genuine DNS failure.
+ */
+export function isMacTailscaleDnsHintCandidate(message: string, detail?: string | null): boolean {
+  // Already hinted: re-wrapping a hinted message would match on its own "DNS" text.
+  if (message.endsWith(MAGIC_DNS_HINT)) {
+    return false
+  }
+  return NETWORK_LOOKUP_FAILURE_RE.test(`${message}\n${detail ?? ''}`)
+}
 
 function globalDnsSection(scutilOutput: string): string {
   const scopedStart = scutilOutput.indexOf('\nDNS configuration (for scoped queries)')
@@ -66,26 +86,31 @@ function readMacTailscaleDnsDiagnostic(now = Date.now()): DnsDiagnostic | null {
   return diagnostic
 }
 
+// Why: Claude/Codex own the failing API transports, so Orca can only point
+// users at the macOS resolver configuration that makes those transports fail.
+function appendMagicDnsHint(message: string, diagnostic: DnsDiagnostic | null): string {
+  return diagnostic ? `${message} ${MAGIC_DNS_HINT}` : message
+}
+
 export function withMacTailscaleDnsHintForDiagnostic(
   message: string,
   detail: string | null | undefined,
   diagnostic: DnsDiagnostic | null
 ): string {
-  const probeText = `${message}\n${detail ?? ''}`
-  if (!NETWORK_LOOKUP_FAILURE_RE.test(probeText)) {
-    return message
-  }
-  if (!diagnostic) {
-    return message
-  }
-
-  // Why: Claude/Codex own the failing API transports, so Orca can only point
-  // users at the macOS resolver configuration that makes those transports fail.
-  return `${message} macOS is using Tailscale MagicDNS (100.100.100.100) as the only global DNS resolver; add an upstream DNS server to the active network service or configure Tailscale global nameservers, then retry.`
+  return isMacTailscaleDnsHintCandidate(message, detail)
+    ? appendMagicDnsHint(message, diagnostic)
+    : message
 }
 
 export function withMacTailscaleDnsHint(message: string, detail?: string | null): string {
-  return withMacTailscaleDnsHintForDiagnostic(message, detail, readMacTailscaleDnsDiagnostic())
+  // The hint only describes macOS resolver state, so nothing off darwin can produce it.
+  if (process.platform !== 'darwin') {
+    return message
+  }
+  if (!isMacTailscaleDnsHintCandidate(message, detail)) {
+    return message
+  }
+  return appendMagicDnsHint(message, readMacTailscaleDnsDiagnostic())
 }
 
 export function __resetMacTailscaleDnsDiagnosticCacheForTests(): void {
diff --git a/src/main/network/macos-tailscale-dns-probe-admission.test.ts b/src/main/network/macos-tailscale-dns-probe-admission.test.ts
new file mode 100644
index 00000000000..9297c356f13
--- /dev/null
+++ b/src/main/network/macos-tailscale-dns-probe-admission.test.ts
@@ -0,0 +1,160 @@
+import { execFileSync } from 'node:child_process'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { formatAgentCliFailureMessage } from '../text-generation/source-control-agent-failure'
+import {
+  __resetMacTailscaleDnsDiagnosticCacheForTests,
+  parseMacTailscaleDnsDiagnostic,
+  withMacTailscaleDnsHint,
+  withMacTailscaleDnsHintForDiagnostic
+} from './macos-tailscale-dns-diagnostic'
+
+vi.mock('node:child_process', () => ({ execFileSync: vi.fn() }))
+
+const MAGIC_DNS = 'DNS configuration\n  nameserver[0] : 100.100.100.100\n'
+const PUBLIC_DNS = 'DNS configuration\n  nameserver[0] : 1.1.1.1\n'
+
+beforeEach(() => {
+  vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+  vi.spyOn(Date, 'now').mockReturnValue(1_000)
+  vi.mocked(execFileSync).mockReset().mockReturnValue(MAGIC_DNS)
+  __resetMacTailscaleDnsDiagnosticCacheForTests()
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  __resetMacTailscaleDnsDiagnosticCacheForTests()
+})
+
+describe('macOS DNS probe admission', () => {
+  it.each(['permission denied', 'authentication failed', 'PTY timeout', '', 'invalid JSON'])(
+    'does not probe for an unrelated error: %s',
+    (detail) => {
+      expect(withMacTailscaleDnsHint('Codex failed.', detail)).toBe('Codex failed.')
+      expect(execFileSync).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each([
+    'ENOTFOUND',
+    'eai_again',
+    'lookup address',
+    'DNS failure',
+    'websocket',
+    'connection refused'
+  ])('still diagnoses a relevant detail: %s', (detail) => {
+    expect(withMacTailscaleDnsHint('Codex failed.', detail)).toContain('Tailscale MagicDNS')
+    expect(execFileSync).toHaveBeenCalledOnce()
+  })
+
+  it('recognizes a relevant message without detail', () => {
+    expect(withMacTailscaleDnsHint('ERR_NAME_NOT_RESOLVED')).toContain('Tailscale MagicDNS')
+    expect(execFileSync).toHaveBeenCalledOnce()
+  })
+
+  it.each(['linux', 'win32'] as const)('never probes on %s', (platform) => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+    expect(withMacTailscaleDnsHint('ENOTFOUND')).toBe('ENOTFOUND')
+    expect(execFileSync).not.toHaveBeenCalled()
+  })
+
+  it('does not warm the diagnostic cache for an unrelated failure', () => {
+    vi.mocked(execFileSync).mockReturnValue(PUBLIC_DNS)
+    withMacTailscaleDnsHint('permission denied')
+    expect(execFileSync).not.toHaveBeenCalled()
+
+    vi.mocked(execFileSync).mockReturnValue(MAGIC_DNS)
+    expect(withMacTailscaleDnsHint('ENOTFOUND')).toContain('Tailscale MagicDNS')
+    expect(execFileSync).toHaveBeenCalledOnce()
+  })
+
+  it('reuses the sample inside the five-minute window and refreshes it after', () => {
+    expect(withMacTailscaleDnsHint('ENOTFOUND')).toContain('Tailscale MagicDNS')
+
+    vi.mocked(Date.now).mockReturnValue(300_999)
+    vi.mocked(execFileSync).mockReturnValue(PUBLIC_DNS)
+    expect(withMacTailscaleDnsHint('ENOTFOUND')).toContain('Tailscale MagicDNS')
+
+    vi.mocked(Date.now).mockReturnValue(301_000)
+    expect(withMacTailscaleDnsHint('permission denied')).toBe('permission denied')
+    // The invariant is the resolver state the next relevant error reports, not the probe count.
+    expect(withMacTailscaleDnsHint('ENOTFOUND')).toBe('ENOTFOUND')
+  })
+
+  it.each(['empty output', 'failed command'])('retains negative caching for %s', (failure) => {
+    vi.mocked(execFileSync).mockImplementation(() => {
+      if (failure === 'failed command') {
+        throw new Error('probe failed')
+      }
+      return ''
+    })
+    expect(withMacTailscaleDnsHint('ENOTFOUND')).toBe('ENOTFOUND')
+    expect(withMacTailscaleDnsHint('EAI_AGAIN')).toBe('EAI_AGAIN')
+    expect(execFileSync).toHaveBeenCalledOnce()
+  })
+
+  it.each([
+    'EAI_NONAME',
+    'EAI_FAIL',
+    'ENODATA',
+    'getaddrinfo failed',
+    'could not resolve host orca.example',
+    'Name or service not known',
+    'ERR_NAME_RESOLUTION_FAILED',
+    'Temporary failure in name resolution'
+  ])('diagnoses the resolution failure wording %s', (detail) => {
+    expect(withMacTailscaleDnsHint('Codex failed.', detail)).toContain('Tailscale MagicDNS')
+  })
+
+  it('never lets probe admission change the message the hint decision would produce', () => {
+    const diagnostic = parseMacTailscaleDnsDiagnostic(MAGIC_DNS)
+    const details = [
+      'permission denied',
+      'authentication failed',
+      'PTY timeout',
+      'invalid JSON',
+      '',
+      'ENOTFOUND',
+      'EAI_AGAIN',
+      'EAI_NONAME',
+      'getaddrinfo failed',
+      'could not resolve host orca.example',
+      'connection refused',
+      'websocket closed'
+    ]
+
+    for (const detail of details) {
+      __resetMacTailscaleDnsDiagnosticCacheForTests()
+      expect(withMacTailscaleDnsHint('Codex failed.', detail)).toBe(
+        withMacTailscaleDnsHintForDiagnostic('Codex failed.', detail, diagnostic)
+      )
+    }
+  })
+
+  it('does not append or re-probe for a message that already carries the hint', () => {
+    const hinted = withMacTailscaleDnsHint('Codex failed.', 'ENOTFOUND')
+    expect(execFileSync).toHaveBeenCalledOnce()
+    // Past the cache window, so a second probe would run if the hint were re-admitted.
+    vi.mocked(Date.now).mockReturnValue(301_000)
+
+    expect(withMacTailscaleDnsHint(hinted, 'ENOTFOUND')).toBe(hinted)
+    expect(execFileSync).toHaveBeenCalledOnce()
+  })
+
+  it('avoids probing while formatting a local CLI permission failure', () => {
+    expect(formatAgentCliFailureMessage('Codex', '', 'permission denied', 1)).toBe(
+      'Codex CLI command failed with code 1: permission denied'
+    )
+    expect(execFileSync).not.toHaveBeenCalled()
+  })
+
+  it('keeps local network hints and honors the remote host opt-out', () => {
+    expect(
+      formatAgentCliFailureMessage('Codex', '', 'ENOTFOUND', 1, { includeLocalMacDnsHint: false })
+    ).toBe('Codex CLI command failed with code 1: ENOTFOUND')
+    expect(execFileSync).not.toHaveBeenCalled()
+    expect(formatAgentCliFailureMessage('Codex', '', 'ENOTFOUND', 1)).toContain(
+      'Tailscale MagicDNS'
+    )
+    expect(execFileSync).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/notebook/notebook-kernel.test.ts b/src/main/notebook/notebook-kernel.test.ts
index 899205dc2fe..1ed290e3f9e 100644
--- a/src/main/notebook/notebook-kernel.test.ts
+++ b/src/main/notebook/notebook-kernel.test.ts
@@ -8,21 +8,189 @@ vi.mock('../../../resources/notebook/kernel-bridge.py?asset&asarUnpack', () => (
 
 import { createFrameReader, startNotebookKernel } from './notebook-kernel'
 
+function collect(chunks: string[]): unknown[] {
+  const frames: unknown[] = []
+  const read = createFrameReader((frame) => frames.push(frame))
+  for (const chunk of chunks) {
+    read(chunk)
+  }
+  return frames
+}
+
 describe('createFrameReader', () => {
   it('reassembles frames split across chunks and skips stray lines', () => {
-    const frames: unknown[] = []
-    const read = createFrameReader((frame) => frames.push(frame))
-    read('warning: something printed\n{"type": "rea')
-    read('dy"}\n{"type": "stream", "content": {"name": "stdout", "text": "hi"}}\n[1, 2]\n')
-    read('{"type": "missing", "externallyManaged": true}\n{"type": "missing"}\n')
-    read('{"type": "unknown"}\n{"type": "done", "status": "ok", "execution_count": 3}\n{"partial')
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    try {
+      expect(
+        collect([
+          'warning: something printed\n{"type": "rea',
+          'dy"}\n{"type": "stream", "content": {"name": "stdout", "text": "hi"}}\n[1, 2]\n',
+          '{"type": "missing", "externallyManaged": true}\n{"type": "missing"}\n',
+          '{"type": "unknown"}\n{"type": "done", "status": "ok", "execution_count": 3}\n{"partial'
+        ])
+      ).toEqual([
+        { type: 'ready' },
+        { type: 'stream', content: { name: 'stdout', text: 'hi' } },
+        { type: 'missing', externallyManaged: true },
+        { type: 'missing', externallyManaged: false },
+        { type: 'done', status: 'ok', execution_count: 3 }
+      ])
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
+  it('avoids repeatedly scanning an incomplete image record for newlines', () => {
+    const frame = { type: 'display_data', content: { data: { 'image/png': 'x'.repeat(524_288) } } }
+    const wire = `${JSON.stringify(frame)}\n`
+    const chunks: string[] = []
+    for (let offset = 0; offset < wire.length; offset += 4096) {
+      chunks.push(wire.slice(offset, offset + 4096))
+    }
+    const originalSplit: { split(separator: unknown, limit?: number): string[] }['split'] =
+      String.prototype.split
+    const originalIndexOf = String.prototype.indexOf
+    let scannedCharacters = 0
+    const split = vi.spyOn(String.prototype, 'split').mockImplementation(function (
+      this: string,
+      separator: unknown,
+      limit?: number
+    ) {
+      if (separator === '\n') {
+        scannedCharacters += this.length
+      }
+      return originalSplit.call(this, separator, limit)
+    })
+    const indexOf = vi.spyOn(String.prototype, 'indexOf').mockImplementation(function (
+      this: string,
+      search: string,
+      position = 0
+    ) {
+      const found = originalIndexOf.call(this, search, position)
+      if (search === '\n') {
+        scannedCharacters += (found === -1 ? this.length : found + 1) - position
+      }
+      return found
+    })
+    let frames: unknown[]
+    try {
+      frames = collect(chunks)
+    } finally {
+      split.mockRestore()
+      indexOf.mockRestore()
+    }
+    expect(frames).toEqual([frame])
+    expect(scannedCharacters).toBeLessThanOrEqual(wire.length * 2)
+  })
+
+  it('does not measure record bytes when no size limit applies', () => {
+    const frame = { type: 'display_data', content: { data: { 'image/png': 'x'.repeat(65_536) } } }
+    const byteLength = vi.spyOn(Buffer, 'byteLength')
+    let frames: unknown[]
+    let measurements: number
+    try {
+      frames = collect([`${JSON.stringify(frame)}\n`])
+      measurements = byteLength.mock.calls.length
+    } finally {
+      byteLength.mockRestore()
+    }
+    expect(frames).toEqual([frame])
+    expect(measurements).toBe(0)
+  })
+
+  it('preserves code units at every split boundary', () => {
+    const frames = [
+      { type: 'stream', content: { text: 'café 漢字 🐋\n\u0000' } },
+      { type: 'execute_result', content: { data: { 'text/plain': '42' } } },
+      { type: 'done', status: 'ok', execution_count: 3 }
+    ]
+    const wire = `${frames.map((frame) => JSON.stringify(frame)).join('\n')}\n`
+    for (let offset = 0; offset <= wire.length; offset++) {
+      expect(collect([wire.slice(0, offset), '', wire.slice(offset)])).toEqual(frames)
+    }
+    expect(collect(wire.split(''))).toEqual(frames)
+  })
+
+  it('skips malformed and unsupported records without losing valid neighbors', () => {
+    const wire = [
+      'startup warning',
+      '',
+      '  ',
+      'null',
+      '[]',
+      '{"type":"ready"}',
+      '{"type":"missing","externallyManaged":true}',
+      '{"type":"missing","externallyManaged":"true"}',
+      '{"type":"stream","content":[]}',
+      '{"type":"unknown","content":{}}',
+      '{"type":"done","status":12,"execution_count":"3"}',
+      ''
+    ].join('\r\n')
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    let frames: unknown[]
+    let reported: number
+    try {
+      frames = collect([wire])
+      reported = warn.mock.calls.length
+    } finally {
+      warn.mockRestore()
+    }
     expect(frames).toEqual([
       { type: 'ready' },
-      { type: 'stream', content: { name: 'stdout', text: 'hi' } },
       { type: 'missing', externallyManaged: true },
       { type: 'missing', externallyManaged: false },
-      { type: 'done', status: 'ok', execution_count: 3 }
+      { type: 'done', status: '12', execution_count: null }
     ])
+    // The unreadable line is reported; a parsed record of an unknown shape is not.
+    expect(reported).toBe(1)
+  })
+
+  it('does not apply the shared transport size limit to notebook display data', () => {
+    const frame = {
+      type: 'display_data',
+      content: { data: { 'image/png': 'x'.repeat(16 * 1024 * 1024 + 1) } }
+    }
+    expect(collect([JSON.stringify(frame), '\n'])).toEqual([frame])
+  })
+
+  it('waits for the final newline before delivering a record', () => {
+    const frames: unknown[] = []
+    const read = createFrameReader((frame) => frames.push(frame))
+    read('{"type":"rea')
+    expect(frames).toEqual([])
+    read('dy"}\n{"type":"missing"}')
+    expect(frames).toEqual([{ type: 'ready' }])
+    read('')
+    expect(frames).toHaveLength(1)
+    read('\n')
+    expect(frames).toEqual([{ type: 'ready' }, { type: 'missing', externallyManaged: false }])
+  })
+
+  it('holds a never-terminated record without emitting or rejecting it', () => {
+    const frames: unknown[] = []
+    const text = 'x'.repeat(200_000)
+    const wire = JSON.stringify({ type: 'stream', content: { name: 'stdout', text } })
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const read = createFrameReader((frame) => frames.push(frame))
+    try {
+      for (let offset = 0; offset < wire.length; offset += 4096) {
+        read(wire.slice(offset, offset + 4096))
+      }
+      expect(frames).toEqual([])
+      expect(warn).not.toHaveBeenCalled()
+      read('\n')
+    } finally {
+      warn.mockRestore()
+    }
+    expect(frames).toEqual([{ type: 'stream', content: { name: 'stdout', text } }])
+  })
+
+  it('does not swallow a consumer exception as malformed JSON', () => {
+    const error = new Error('consumer failed')
+    const read = createFrameReader(() => {
+      throw error
+    })
+    expect(() => read('{"type":"ready"}\n')).toThrow(error)
   })
 })
 
diff --git a/src/main/notebook/notebook-kernel.ts b/src/main/notebook/notebook-kernel.ts
index 6e50542f1f9..413b3bfeb65 100644
--- a/src/main/notebook/notebook-kernel.ts
+++ b/src/main/notebook/notebook-kernel.ts
@@ -1,6 +1,7 @@
 import bridgePath from '../../../resources/notebook/kernel-bridge.py?asset&asarUnpack'
 import { spawnProcess } from '../../shared/child-process/run-process'
 import { forceTerminateProcessTree } from '../../shared/child-process/process-tree-termination'
+import { createNdjsonParser } from '../../shared/main-process-ndjson-framer'
 import {
   KERNEL_OUTPUT_TYPES,
   type KernelFrame,
@@ -16,13 +17,7 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value)
 }
 
-function parseFrame(line: string): BridgeFrame | null {
-  let value: unknown
-  try {
-    value = JSON.parse(line)
-  } catch {
-    return null
-  }
+function parseFrame(value: unknown): BridgeFrame | null {
   if (!isRecord(value)) {
     return null
   }
@@ -46,17 +41,20 @@ function parseFrame(line: string): BridgeFrame | null {
 
 /** Splits bridge stdout into frames, skipping any line that is not one. */
 export function createFrameReader(onFrame: (frame: BridgeFrame) => void): (text: string) => void {
-  let partial = ''
-  return (text) => {
-    const lines = (partial + text).split('\n')
-    partial = lines.pop() ?? ''
-    for (const line of lines) {
-      const frame = parseFrame(line)
+  // Each frame ships as its line completes; a consumer throw escapes the stdout listener and is fatal anyway.
+  const parser = createNdjsonParser(
+    (value) => {
+      const frame = parseFrame(value)
       if (frame) {
         onFrame(frame)
       }
-    }
-  }
+    },
+    // The bridge keeps fd 1 to itself, so an unreadable line means the frame channel is damaged.
+    (error) => console.warn('[notebook-kernel] Dropped an unreadable bridge record:', error),
+    // Notebook display frames can contain large images; preserve the existing unrestricted size.
+    { maxLineBytes: Number.POSITIVE_INFINITY }
+  )
+  return (text) => parser.feed(text)
 }
 
 export type NotebookKernel = {
diff --git a/src/main/notebook/python-environments.test.ts b/src/main/notebook/python-environments.test.ts
index 05088d8236b..eb69d981493 100644
--- a/src/main/notebook/python-environments.test.ts
+++ b/src/main/notebook/python-environments.test.ts
@@ -9,7 +9,8 @@ vi.mock('../../shared/child-process/run-process', () => ({ runProcess: runProces
 import {
   createNotebookVenv,
   findWorkspaceInterpreters,
-  installIpykernel
+  installIpykernel,
+  listPythonEnvironments
 } from './python-environments'
 
 function existing(...paths: string[]): (path: string) => boolean {
@@ -47,6 +48,96 @@ describe('findWorkspaceInterpreters', () => {
   })
 })
 
+describe('listPythonEnvironments', () => {
+  let root = ''
+  const windows = process.platform === 'win32'
+  const venvPython = (): string =>
+    join(root, '.venv', ...(windows ? ['Scripts', 'python.exe'] : ['bin', 'python']))
+  const condaPython = (): string =>
+    join(root, 'nb', '.conda', ...(windows ? ['python.exe'] : ['bin', 'python']))
+  const programs = (): string[] => runProcessMock.mock.calls.map(([spec]) => spec.program)
+
+  beforeEach(() => {
+    runProcessMock.mockReset()
+    runProcessMock.mockImplementation(async ({ program }: { program: string }) => ({
+      code: 0,
+      stdout: `${program}\n3.13.0\n`,
+      stderr: ''
+    }))
+    root = mkdtempSync(join(tmpdir(), 'orca-pyenvs-'))
+    for (const interpreter of [venvPython(), condaPython()]) {
+      mkdirSync(dirname(interpreter), { recursive: true })
+      writeFileSync(interpreter, '')
+    }
+    writeFileSync(
+      join(root, '.venv', 'pyvenv.cfg'),
+      'home = /usr/bin\nversion_info = 3.12.1.final.0\n'
+    )
+    const condaMeta = join(root, 'nb', '.conda', 'conda-meta')
+    mkdirSync(condaMeta)
+    writeFileSync(join(condaMeta, 'python-dateutil-2.9.0-pyhd8ed1ab_0.json'), '{}')
+    writeFileSync(join(condaMeta, 'python-3.11.9-h8d4a6d2_0.json'), '{}')
+    return () => rmSync(root, { recursive: true, force: true })
+  })
+
+  it('lists workspace envs from disk without running them before trust', async () => {
+    const found = await listPythonEnvironments(join(root, 'nb', 'a.ipynb'), root, {
+      runWorkspaceInterpreters: false
+    })
+    expect(programs()).not.toContain(venvPython())
+    expect(programs()).not.toContain(condaPython())
+    expect(programs().length).toBeGreaterThan(0)
+    expect(found.workspace).toEqual([
+      { path: condaPython(), name: '.conda', version: '3.11.9' },
+      { path: venvPython(), name: '.venv', version: '3.12.1' }
+    ])
+  })
+
+  it('reads the stdlib venv version key and omits a version it cannot find', async () => {
+    writeFileSync(join(root, '.venv', 'pyvenv.cfg'), 'home = /usr/bin\nversion = 3.10.4\n')
+    const found = await listPythonEnvironments(join(root, 'a.ipynb'), root, {
+      runWorkspaceInterpreters: false
+    })
+    expect(found.workspace).toEqual([{ path: venvPython(), name: '.venv', version: '3.10.4' }])
+
+    writeFileSync(join(root, '.venv', 'pyvenv.cfg'), 'home = /usr/bin\n')
+    const unversioned = await listPythonEnvironments(join(root, 'a.ipynb'), root, {
+      runWorkspaceInterpreters: false
+    })
+    expect(unversioned.workspace).toEqual([{ path: venvPython(), name: '.venv' }])
+  })
+
+  it('reads only the head of pyvenv.cfg, whatever size it reports', async () => {
+    // procfs files report size 0 yet never end, so the read must be bounded, not size-gated.
+    const padding = `# ${'x'.repeat(1022)}\n`.repeat(128)
+    const cfg = join(root, '.venv', 'pyvenv.cfg')
+    const list = () =>
+      listPythonEnvironments(join(root, 'a.ipynb'), root, { runWorkspaceInterpreters: false })
+
+    writeFileSync(cfg, `version_info = 3.12.1.final.0\n${padding}`)
+    expect((await list()).workspace).toEqual([
+      { path: venvPython(), name: '.venv', version: '3.12.1' }
+    ])
+
+    writeFileSync(cfg, `${padding}version_info = 3.12.1.final.0\n`)
+    expect((await list()).workspace).toEqual([{ path: venvPython(), name: '.venv' }])
+  })
+
+  it('probes workspace envs once the notebook is trusted, dropping ones that fail', async () => {
+    runProcessMock.mockImplementation(async ({ program }: { program: string }) =>
+      program === condaPython()
+        ? { code: 1, stdout: '', stderr: 'broken' }
+        : { code: 0, stdout: `${program}\n3.13.0\n`, stderr: '' }
+    )
+    const found = await listPythonEnvironments(join(root, 'nb', 'a.ipynb'), root, {
+      runWorkspaceInterpreters: true
+    })
+    expect(programs()).toContain(venvPython())
+    expect(programs()).toContain(condaPython())
+    expect(found.workspace).toEqual([{ path: venvPython(), name: '.venv', version: '3.13.0' }])
+  })
+})
+
 describe('installIpykernel', () => {
   beforeEach(() => runProcessMock.mockReset())
   const result = (code: number | null, stderr = '', extra = {}) => ({
diff --git a/src/main/notebook/python-environments.ts b/src/main/notebook/python-environments.ts
index 4270f9ca62d..116e20e9e1b 100644
--- a/src/main/notebook/python-environments.ts
+++ b/src/main/notebook/python-environments.ts
@@ -1,4 +1,4 @@
-import { existsSync } from 'node:fs'
+import { closeSync, existsSync, openSync, readdirSync, readSync, statSync } from 'node:fs'
 import { basename, dirname, isAbsolute, join, relative } from 'node:path'
 import { runProcess } from '../../shared/child-process/run-process'
 import type { ProcessResult } from '../../shared/child-process/process-spec'
@@ -15,6 +15,7 @@ const WORKSPACE_ENV_DIRS = ['.venv', '.conda']
 const INSTALL_TIMEOUT_MS = 10 * 60_000
 const INSTALL_DETAIL_CHARS = 4000
 const VENV_TIMEOUT_MS = 2 * 60_000
+const PYVENV_CFG_MAX_BYTES = 64 * 1024
 
 /** `.venv`/`.conda` interpreters from the notebook's folder up to the workspace root, nearest first. */
 export function findWorkspaceInterpreters(
@@ -62,27 +63,86 @@ async function probe(
   }
 }
 
-/** Names an interpreter after its environment folder when it lives in one. */
-function environmentName(executable: string): string {
+/** The environment folder an interpreter lives in, when it lives in one. */
+function environmentDir(executable: string): string | undefined {
   // venvs keep python in bin/ or Scripts\; Windows conda envs keep it at the env root.
-  const envDir = [dirname(dirname(executable)), dirname(executable)].find(
+  return [dirname(dirname(executable)), dirname(executable)].find(
     (dir) => existsSync(join(dir, 'pyvenv.cfg')) || existsSync(join(dir, 'conda-meta'))
   )
-  return basename(envDir ?? executable)
+}
+
+/** Names an interpreter after its environment folder when it lives in one. */
+function environmentName(executable: string): string {
+  return basename(environmentDir(executable) ?? executable)
+}
+
+/** The head of a regular file, read once into a fixed buffer. */
+function readFileHead(path: string, maxBytes: number): string | undefined {
+  // Why not a FIFO or device: opening one can block; a symlinked procfs file passes and reports size 0.
+  if (!existsSync(path) || !statSync(path).isFile()) {
+    return undefined
+  }
+  const fd = openSync(path, 'r')
+  try {
+    const buffer = Buffer.alloc(maxBytes)
+    return buffer.toString('utf8', 0, readSync(fd, buffer, 0, maxBytes, 0))
+  } finally {
+    closeSync(fd)
+  }
+}
+
+/** The Python version an environment records on disk: venv `pyvenv.cfg`, else conda's `conda-meta`. */
+function recordedVersion(envDir: string): string | undefined {
+  try {
+    // Why bounded, not size-checked: a hostile repo can point pyvenv.cfg at an endless file.
+    const cfg = readFileHead(join(envDir, 'pyvenv.cfg'), PYVENV_CFG_MAX_BYTES)
+    const match = cfg && /^\s*version(?:_info)?\s*=\s*(\d+\.\d+(?:\.\d+)?)/m.exec(cfg)
+    if (match) {
+      return match[1]
+    }
+    const condaMeta = join(envDir, 'conda-meta')
+    if (existsSync(condaMeta)) {
+      for (const entry of readdirSync(condaMeta)) {
+        const match = /^python-(\d+\.\d+(?:\.\d+)?)-.*\.json$/.exec(entry)
+        if (match) {
+          return match[1]
+        }
+      }
+    }
+  } catch {
+    // Unreadable metadata just leaves the version unknown.
+  }
+  return undefined
+}
+
+/** Describes a workspace interpreter from its files alone, without running it. */
+function describeWithoutRunning(interpreter: string): PythonEnvironment {
+  const envDir = environmentDir(interpreter)
+  const version = envDir === undefined ? undefined : recordedVersion(envDir)
+  const name = basename(envDir ?? interpreter)
+  return version ? { path: interpreter, name, version } : { path: interpreter, name }
 }
 
 export function describePython(path: string): Promise<PythonEnvironment | null> {
   return probe(path, [], environmentName)
 }
 
+/**
+ * Pythons a notebook can use. `runWorkspaceInterpreters` is false until the notebook is trusted:
+ * a repo can ship its own `.venv/bin/python`, so those are then read from disk, never run.
+ */
 export async function listPythonEnvironments(
   notebookPath: string,
-  rootPath: string | null
+  rootPath: string | null,
+  { runWorkspaceInterpreters }: { runWorkspaceInterpreters: boolean }
 ): Promise<PythonEnvironments> {
   const pathCommands =
     process.platform === 'win32' ? [['py', '-3'], ['python']] : [['python3'], ['python']]
+  const workspaceInterpreters = findWorkspaceInterpreters(notebookPath, rootPath)
   const [workspace, onPath] = await Promise.all([
-    Promise.all(findWorkspaceInterpreters(notebookPath, rootPath).map(describePython)),
+    runWorkspaceInterpreters
+      ? Promise.all(workspaceInterpreters.map(describePython))
+      : workspaceInterpreters.map(describeWithoutRunning),
     Promise.all(
       pathCommands.map(([program, ...args]) =>
         probe(program, args, () => [program, ...args].join(' '))
diff --git a/src/main/observability/agent-session-instrumentation.ts b/src/main/observability/agent-session-instrumentation.ts
index dc57bd69d0e..693d96a28c2 100644
--- a/src/main/observability/agent-session-instrumentation.ts
+++ b/src/main/observability/agent-session-instrumentation.ts
@@ -3,7 +3,6 @@ import { withSpan, type ActiveSpan } from './tracer'
 export type AgentSessionCreatePhase =
   | 'reconcile_leases'
   | 'resolve_recovery'
-  | 'settlement_retry'
   | 'probe_owner'
   | 'reserve_owner'
   | 'acquire_owner'
diff --git a/src/main/observability/instrumentation.test.ts b/src/main/observability/instrumentation.test.ts
index 9bdbfd91d02..139bb2494dd 100644
--- a/src/main/observability/instrumentation.test.ts
+++ b/src/main/observability/instrumentation.test.ts
@@ -261,8 +261,7 @@ describe('agentSession.create tracing', () => {
         totalDurationMs: 57,
         phases: [
           { phase: 'reconcile_leases', startedAtMs: 0, durationMs: 1 },
-          { phase: 'resolve_recovery', startedAtMs: 1, durationMs: 2 },
-          { phase: 'settlement_retry', startedAtMs: 3, durationMs: 3 },
+          { phase: 'resolve_recovery', startedAtMs: 1, durationMs: 5 },
           { phase: 'probe_owner', startedAtMs: 6, durationMs: 4 },
           { phase: 'reserve_owner', startedAtMs: 10, durationMs: 5 },
           { phase: 'acquire_owner', startedAtMs: 15, durationMs: 6 },
diff --git a/src/main/opencode-usage/store.ts b/src/main/opencode-usage/store.ts
index 5dc8a87c67b..3bdcefeb0a7 100644
--- a/src/main/opencode-usage/store.ts
+++ b/src/main/opencode-usage/store.ts
@@ -1,3 +1,4 @@
+import { codexOpenCodeTokenSessions } from '../usage/agent-token-usage'
 import { app } from 'electron'
 import { join } from 'node:path'
 import type {
@@ -50,6 +51,10 @@ export class OpenCodeUsageStore extends UsageProviderStoreLifecycle<
 > {
   constructor(store: Pick<Store, 'getRepos' | 'getAllWorktreeMeta'>) {
     super(store, {
+      tokenUsage: {
+        provider: 'opencode',
+        selectSessions: (state) => codexOpenCodeTokenSessions(state.sessions)
+      },
       logTag: '[opencode-usage]',
       resolveCacheFile: getOpenCodeUsageFile,
       createDefaultState: getDefaultState,
diff --git a/src/main/opencode/hook-plugin-dispose-host.test.ts b/src/main/opencode/hook-plugin-dispose-host.test.ts
new file mode 100644
index 00000000000..179714d8c83
--- /dev/null
+++ b/src/main/opencode/hook-plugin-dispose-host.test.ts
@@ -0,0 +1,165 @@
+/**
+ * Executes the generated plugin through each OpenCode host entry point, because
+ * what disposal means differs by host: OpenCode 1 disposes only on instance
+ * teardown (which cancels every run), OpenCode 2 also on a plugin hot reload.
+ */
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { getPathMock } = vi.hoisted(() => ({
+  getPathMock: vi.fn<(name: string) => string>()
+}))
+
+vi.mock('electron', () => ({
+  app: { getPath: getPathMock }
+}))
+
+import { _internals } from './hook-service'
+
+type PluginHooks = {
+  event: (input: { event: unknown }) => Promise<void>
+  dispose?: () => Promise<void>
+}
+type HostEvent = { type: string; data: Record<string, unknown> }
+type PluginModule = {
+  default?: {
+    server?: (ctx: unknown) => Promise<PluginHooks>
+    setup?: (ctx: unknown) => Promise<() => Promise<void>>
+  }
+}
+
+const ENV_KEYS = [
+  'ORCA_PANE_KEY',
+  'ORCA_OPENCODE_AGENT',
+  'ORCA_AGENT_HOOK_ENDPOINT',
+  'ORCA_AGENT_HOOK_PORT',
+  'ORCA_AGENT_HOOK_TOKEN'
+] as const
+
+// A live OpenCode 2 event bus: stays open until the subscriber aborts.
+function createEventBus(): {
+  push: (event: HostEvent) => void
+  subscribe: (input: { signal: AbortSignal }) => AsyncGenerator<HostEvent>
+} {
+  const queue: HostEvent[] = []
+  let wake: (() => void) | null = null
+  return {
+    push(event) {
+      queue.push(event)
+      wake?.()
+    },
+    async *subscribe({ signal }) {
+      while (!signal.aborted) {
+        const next = queue.shift()
+        if (next) {
+          yield next
+          continue
+        }
+        await new Promise<void>((resolve) => {
+          wake = resolve
+          signal.addEventListener('abort', () => resolve(), { once: true })
+        })
+        wake = null
+      }
+    }
+  }
+}
+
+describe.each(['opencode', 'opencode2'] as const)('%s plugin disposal by host', (agent) => {
+  let tempDir: string
+  let savedEnv: Record<string, string | undefined>
+  let names: string[]
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), 'orca-opencode-dispose-host-'))
+    savedEnv = {}
+    for (const key of ENV_KEYS) {
+      savedEnv[key] = process.env[key]
+    }
+    process.env.ORCA_PANE_KEY = 'tab-1:leaf-1'
+    process.env.ORCA_OPENCODE_AGENT = agent
+    delete process.env.ORCA_AGENT_HOOK_ENDPOINT
+    process.env.ORCA_AGENT_HOOK_PORT = '59999'
+    process.env.ORCA_AGENT_HOOK_TOKEN = 'test-token'
+    names = []
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async (_input: RequestInfo | URL, init?: RequestInit) => {
+        names.push(String(JSON.parse(String(init?.body)).payload?.hook_event_name))
+        return new Response('{}', { status: 200 })
+      })
+    )
+  })
+
+  afterEach(() => {
+    vi.unstubAllGlobals()
+    for (const key of ENV_KEYS) {
+      if (savedEnv[key] === undefined) {
+        delete process.env[key]
+      } else {
+        process.env[key] = savedEnv[key]
+      }
+    }
+    rmSync(tempDir, { recursive: true, force: true })
+  })
+
+  async function loadPluginModule(): Promise<PluginModule> {
+    const pluginPath = join(tempDir, `orca-${agent}-status.mjs`)
+    writeFileSync(
+      pluginPath,
+      agent === 'opencode2'
+        ? _internals.getOpenCode2PluginSource()
+        : _internals.getOpenCodePluginSource()
+    )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the generated plugin module exports this shape.
+    return (await import(pathToFileURL(pluginPath).href)) as PluginModule
+  }
+
+  function setupContext(bus: ReturnType<typeof createEventBus>): unknown {
+    return {
+      session: {
+        get: async ({ sessionID }: { sessionID: string }) => ({ id: sessionID }),
+        hook: async () => ({ dispose: async () => {} })
+      },
+      event: { subscribe: bus.subscribe }
+    }
+  }
+
+  it('publishes a final Idle when the OpenCode 1 instance tears down mid-turn', async () => {
+    const module = await loadPluginModule()
+    const hooks = await module.default?.server?.({
+      client: { session: { get: async () => ({ data: { id: 'ses_root' } }) } }
+    })
+    await hooks?.event({
+      event: {
+        type: 'session.status',
+        properties: { sessionID: 'ses_root', status: { type: 'busy' } }
+      }
+    })
+    await hooks?.dispose?.()
+
+    expect(names).toEqual(['SessionBusy', 'SessionIdle'])
+  })
+
+  it('keeps the pane Working when OpenCode 2 reloads the plugin mid-turn', async () => {
+    const module = await loadPluginModule()
+    const firstBus = createEventBus()
+    const firstCleanup = await module.default?.setup?.(setupContext(firstBus))
+    firstBus.push({ type: 'session.execution.started', data: { sessionID: 'ses_root' } })
+    await vi.waitFor(() => expect(names).toEqual(['SessionBusy']))
+
+    await firstCleanup?.()
+    expect(names).toEqual(['SessionBusy'])
+
+    // The turn kept running; its end reaches the reloaded plugin.
+    const secondBus = createEventBus()
+    const secondCleanup = await module.default?.setup?.(setupContext(secondBus))
+    secondBus.push({ type: 'session.execution.succeeded', data: { sessionID: 'ses_root' } })
+    await vi.waitFor(() => expect(names).toEqual(['SessionBusy', 'SessionIdle']))
+    await secondCleanup?.()
+    expect(names).toEqual(['SessionBusy', 'SessionIdle'])
+  })
+})
diff --git a/src/main/opencode/hook-service.test.ts b/src/main/opencode/hook-service.test.ts
index 920c0b5e392..c8941d83313 100644
--- a/src/main/opencode/hook-service.test.ts
+++ b/src/main/opencode/hook-service.test.ts
@@ -1,13 +1,17 @@
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   existsSync,
+  openSync,
+  closeSync,
   lstatSync,
   mkdirSync,
   mkdtempSync,
   readFileSync,
   readdirSync,
   rmSync,
+  statSync,
   symlinkSync,
+  utimesSync,
   writeFileSync
 } from 'node:fs'
 import { createHash } from 'node:crypto'
@@ -45,26 +49,6 @@ beforeEach(() => {
 const { isUsableId, toSafeDirName } = _internals
 
 describe('OpenCode hook plugin source', () => {
-  it('preserves the public module surface', async () => {
-    const module = await import('./hook-service')
-
-    expect(Object.keys(module).sort()).toEqual([
-      'OpenCodeHookService',
-      '_internals',
-      'getOpenCode2PluginSource',
-      'getOpenCodeFamilyPluginSource',
-      'getOpenCodePluginSource',
-      'openCode2HookService',
-      'openCodeHookService'
-    ])
-    expect(Object.keys(module._internals).sort()).toEqual([
-      'getOpenCode2PluginSource',
-      'getOpenCodePluginSource',
-      'isUsableId',
-      'toSafeDirName'
-    ])
-  })
-
   it('keeps family routing and session-start policy separate', () => {
     const primarySource = getOpenCodePluginSource()
     const familySource = getOpenCodeFamilyPluginSource('/hook/mimo-code', {
@@ -93,11 +77,11 @@ describe('OpenCode hook plugin source', () => {
     const digest = (source: string): string => createHash('sha256').update(source).digest('hex')
 
     expect(digest(getOpenCodePluginSource())).toBe(
-      'f2c469ff2d360ed94955d715705b9d4dd633dd334887906fbb534c1925ec81c9'
+      '655d603f31c3e4462b4c600861833cbdba9dd541f693e11a349e7a57b8c059d7'
     )
     expect(
       digest(getOpenCodeFamilyPluginSource('/hook/mimo-code', { emitSessionStart: false }))
-    ).toBe('2267e2ab6e854e71c9bae12afed97e464f93b2b14f3e25dca133ca6666c98752')
+    ).toBe('d36d869823cc3dd506565e0512beb278fe4fd6533bd12be30bd98db140ca9f3e')
   })
 
   it('filters child sessions via parentID lookup before forwarding events', () => {
@@ -290,6 +274,51 @@ describe('OpenCodeHookService buildPtyEnv / clearPty round-trip', () => {
     expect(pluginSource).toContain('messageID: part.messageID')
   })
 
+  // Why: OpenCode 2 reloads a plugin whose file mtime changed, which restarted status mid-turn.
+  it('leaves a current installed plugin untouched and replaces a stale one', () => {
+    const service = new OpenCodeHookService()
+    service.buildPtyEnv(daemonSessionId)
+    const pluginPath = join(resolveOpenCodeConfigDirectory(), 'plugins', 'orca-opencode-status.js')
+    const past = new Date('2020-01-01T00:00:00Z')
+    utimesSync(pluginPath, past, past)
+
+    service.buildPtyEnv(daemonSessionId)
+    expect(statSync(pluginPath).mtimeMs).toBe(past.getTime())
+
+    writeFileSync(pluginPath, 'stale plugin')
+    service.buildPtyEnv(daemonSessionId)
+    expect(readFileSync(pluginPath, 'utf8')).toBe(_internals.getOpenCodePluginSource())
+  })
+
+  // Why: OpenCode 2 loads through a file-level symlink (dotfile managers) and stats its target.
+  it.skipIf(process.platform === 'win32')(
+    'compares a symlinked plugin by its target and writes through only when stale',
+    () => {
+      const service = new OpenCodeHookService()
+      const pluginPath = join(
+        resolveOpenCodeConfigDirectory(),
+        'plugins',
+        'orca-opencode-status.js'
+      )
+      const targetPath = join(userDataDir, 'dotfiles-orca-opencode-status.js')
+      writeFileSync(targetPath, _internals.getOpenCodePluginSource())
+      rmSync(pluginPath, { force: true })
+      symlinkSync(targetPath, pluginPath)
+      const past = new Date('2020-01-01T00:00:00Z')
+      utimesSync(targetPath, past, past)
+
+      service.buildPtyEnv(daemonSessionId)
+      expect(statSync(targetPath).mtimeMs).toBe(past.getTime())
+
+      writeFileSync(targetPath, 'stale plugin')
+      service.buildPtyEnv(daemonSessionId)
+      expect(lstatSync(pluginPath).isSymbolicLink()).toBe(true)
+      expect(readFileSync(targetPath, 'utf8')).toBe(_internals.getOpenCodePluginSource())
+      rmSync(pluginPath, { force: true })
+      rmSync(targetPath, { force: true })
+    }
+  )
+
   // Why: #22234 — OpenCode 2 installs under the plain `opencode` name, and its loader
   // rejects a default export that only has server(). Asserting the emitted *source* is
   // not enough; the installed file is what the v2 server validates, so load it.
@@ -313,6 +342,93 @@ describe('OpenCodeHookService buildPtyEnv / clearPty round-trip', () => {
     expect(module.default?.setup).toBeTypeOf('function')
   })
 
+  // Why: pre-1.4.209 Orca wrote a server()-only plugin into <userData>/opencode-hooks/shared and
+  // stopped maintaining it; shells and OpenCode 2 background services still pointing there got
+  // "Plugin must export a default definition with an id and an effect or setup function."
+  it('refreshes a stale plugin left in the retired shared hooks dir', async () => {
+    const legacyPluginPath = join(
+      userDataDir,
+      'opencode-hooks',
+      'shared',
+      'plugins',
+      'orca-opencode-status.js'
+    )
+    mkdirSync(join(legacyPluginPath, '..'), { recursive: true })
+    writeFileSync(
+      legacyPluginPath,
+      'export default { id: "orca-opencode-status", server: async () => ({}) };\n'
+    )
+
+    new OpenCodeHookService().buildPtyEnv(daemonSessionId)
+
+    const modulePath = join(userDataDir, `legacy-opencode-plugin-${Date.now()}.mjs`)
+    writeFileSync(modulePath, readFileSync(legacyPluginPath, 'utf8'))
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the assertions below validate the shape this names.
+    const module = (await import(pathToFileURL(modulePath).href)) as {
+      default?: { id?: unknown; server?: unknown; setup?: unknown }
+    }
+    expect(module.default?.id).toBe('orca-opencode-status')
+    expect(module.default?.server).toBeTypeOf('function')
+    expect(module.default?.setup).toBeTypeOf('function')
+  })
+
+  it('repairs late and overwritten legacy plugins atomically on the same service', () => {
+    const service = new OpenCodeHookService()
+    service.refreshLegacySharedPlugin()
+    const path = join(userDataDir, 'opencode-hooks', 'shared', 'plugins', 'orca-opencode-status.js')
+    mkdirSync(join(path, '..'), { recursive: true })
+    for (const stale of ['// late old install', '// old process overwrote repair']) {
+      writeFileSync(path, stale)
+      const reader = openSync(path, 'r')
+      try {
+        service.refreshLegacySharedPlugin()
+        expect(readFileSync(path, 'utf8')).toBe(getOpenCodePluginSource())
+        expect(readFileSync(reader, 'utf8')).toBe(stale)
+        expect(readdirSync(join(path, '..'))).toEqual(['orca-opencode-status.js'])
+      } finally {
+        closeSync(reader)
+      }
+    }
+  })
+
+  it('reports repair failures and retries after the obstruction is removed', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const path = join(userDataDir, 'opencode-hooks', 'shared', 'plugins', 'orca-opencode-status.js')
+    const service = new OpenCodeHookService()
+    try {
+      service.refreshLegacySharedPlugin()
+      expect(warn).not.toHaveBeenCalled()
+      mkdirSync(path, { recursive: true })
+      service.refreshLegacySharedPlugin()
+      expect(warn).toHaveBeenCalledWith(
+        '[OpenCode] Failed to repair legacy status plugin:',
+        path,
+        expect.any(Error)
+      )
+      rmSync(path, { recursive: true })
+      writeFileSync(path, '// stale')
+      service.refreshLegacySharedPlugin()
+      expect(readFileSync(path, 'utf8')).toBe(getOpenCodePluginSource())
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
+  it('leaves an up-to-date legacy plugin untouched and never creates the retired dir', () => {
+    const legacyDir = join(userDataDir, 'opencode-hooks')
+    new OpenCodeHookService().buildPtyEnv(daemonSessionId)
+    expect(existsSync(legacyDir)).toBe(false)
+
+    const legacyPluginPath = join(legacyDir, 'shared', 'plugins', 'orca-opencode-status.js')
+    mkdirSync(join(legacyPluginPath, '..'), { recursive: true })
+    writeFileSync(legacyPluginPath, getOpenCodePluginSource())
+    const past = new Date('2020-01-01T00:00:00Z')
+    utimesSync(legacyPluginPath, past, past)
+    new OpenCodeHookService().buildPtyEnv(daemonSessionId)
+    // Why: a running OpenCode 2 service re-runs its plugin load on every write to a watched plugin file.
+    expect(statSync(legacyPluginPath).mtimeMs).toBe(past.getTime())
+  })
+
   // Why: #22506 — both variants install side by side in one global plugins dir, and
   // OpenCode 2 kills every plugin after the first that reuses an id ("Duplicate plugin
   // ID"). Discovery sorts by path, so orca-opencode-status.js always wins and the
@@ -609,6 +725,19 @@ describe('OpenCodeHookService overlay mode (user OPENCODE_CONFIG_DIR set)', () =
     expectUserConfigIntact()
   })
 
+  it('leaves a current overlay plugin file in place across spawns', () => {
+    const service = new OpenCodeHookService()
+    const overlayDir = service.buildPtyEnv(ptyId, userConfigDir).OPENCODE_CONFIG_DIR!
+    const pluginPath = join(overlayDir, 'plugins', 'orca-opencode-status.js')
+    const past = new Date('2020-01-01T00:00:00Z')
+    utimesSync(pluginPath, past, past)
+
+    service.buildPtyEnv(ptyId, userConfigDir)
+
+    expect(statSync(pluginPath).mtimeMs).toBe(past.getTime())
+    expect(readFileSync(pluginPath, 'utf8')).toBe(_internals.getOpenCodePluginSource())
+  })
+
   it('reconciles stale mirrored entries while preserving OpenCode runtime files', () => {
     const service = new OpenCodeHookService()
     const firstEnv = service.buildPtyEnv(ptyId, userConfigDir)
diff --git a/src/main/opencode/hook-service.ts b/src/main/opencode/hook-service.ts
index f46667ed1b8..74f24577c6e 100644
--- a/src/main/opencode/hook-service.ts
+++ b/src/main/opencode/hook-service.ts
@@ -1,3 +1,4 @@
+import { writeFileAtomically } from '../codex-accounts/fs-utils'
 import { getAppEnvironment } from '../../shared/app-environment'
 import { join } from 'node:path'
 import {
@@ -22,11 +23,18 @@ import { getStatusPluginOwnershipSource } from './status-plugin-ownership-source
 import { getStatusPluginLifecycleSource } from './status-plugin-lifecycle-source'
 import { getStatusPluginFactorySource } from './status-plugin-factory-source'
 import { resolveOpenCodeConfigDirectory } from '../../shared/opencode-config-directory'
+import {
+  getOpenCodeLegacySharedConfigDir,
+  OPENCODE2_LEGACY_HOOKS_DIR,
+  OPENCODE_LEGACY_HOOKS_DIR
+} from './legacy-shared-config-dir'
+import {
+  isInstalledOpenCodePluginCurrent,
+  isOverlayOpenCodePluginCurrent
+} from '../../shared/opencode-installed-plugin'
 
 const ORCA_OPENCODE_PLUGIN_FILE = 'orca-opencode-status.js'
-const OPENCODE_LEGACY_HOOKS_DIR = 'opencode-hooks'
 const OPENCODE_OVERLAY_DIR = 'opencode-config-overlays'
-const OPENCODE_SHARED_CONFIG_DIR = 'shared'
 const OPENCODE_OVERLAY_MANIFEST_FILE = '.orca-opencode-overlay-manifest.json'
 
 type OpenCodeOverlayManifest = {
@@ -127,6 +135,7 @@ export class OpenCodeHookService {
       return existingConfigDir ? { OPENCODE_CONFIG_DIR: existingConfigDir } : {}
     }
 
+    this.refreshLegacySharedPlugin()
     const managedConfigDir = this.getSharedConfigDir()
     if (!existingConfigDir || existingConfigDir === managedConfigDir) {
       try {
@@ -150,6 +159,23 @@ export class OpenCodeHookService {
     }
   }
 
+  // Why: pre-1.4.209 Orca left a server()-only plugin here that OpenCode 2 rejects. Only helps
+  // processes that load it later; a running OpenCode 2 service keeps its cached module until restarted.
+  refreshLegacySharedPlugin(): void {
+    const pluginPath = join(this.getSharedConfigDir(), 'plugins', this.pluginFileName)
+    try {
+      const source = this.pluginSource()
+      if (readFileSync(pluginPath, 'utf8') !== source) {
+        writeFileAtomically(pluginPath, source)
+      }
+    } catch (error) {
+      if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+        return
+      }
+      console.warn('[OpenCode] Failed to repair legacy status plugin:', pluginPath, error)
+    }
+  }
+
   private getOverlayRoot(): string {
     return join(getAppEnvironment().getPath('userData'), this.overlayDir)
   }
@@ -159,10 +185,9 @@ export class OpenCodeHookService {
   }
 
   private getSharedConfigDir(): string {
-    return join(
+    return getOpenCodeLegacySharedConfigDir(
       getAppEnvironment().getPath('userData'),
-      this.legacyHooksDir,
-      OPENCODE_SHARED_CONFIG_DIR
+      this.legacyHooksDir
     )
   }
 
@@ -257,25 +282,32 @@ export class OpenCodeHookService {
     const pluginsDir = join(overlayDir, 'plugins')
     mkdirSync(pluginsDir, { recursive: true })
     const pluginPath = join(pluginsDir, this.pluginFileName)
-    try {
-      unlinkSync(pluginPath)
-    } catch {
-      // File may not exist on a fresh overlay; a real failure surfaces on writeFileSync below.
+    const source = this.pluginSource()
+    if (!isOverlayOpenCodePluginCurrent(pluginPath, source)) {
+      try {
+        unlinkSync(pluginPath)
+      } catch {
+        // File may not exist on a fresh overlay; a real failure surfaces on writeFileSync below.
+      }
+      writeFileSync(pluginPath, source)
     }
-    writeFileSync(pluginPath, this.pluginSource())
   }
 
   private writePluginToConfigDir(configDir: string): void {
     const pluginsDir = join(configDir, 'plugins')
     mkdirSync(pluginsDir, { recursive: true })
-    writeFileSync(join(pluginsDir, this.pluginFileName), this.pluginSource())
+    const pluginPath = join(pluginsDir, this.pluginFileName)
+    const source = this.pluginSource()
+    if (!isInstalledOpenCodePluginCurrent(pluginPath, source)) {
+      writeFileSync(pluginPath, source)
+    }
   }
 }
 
 export const openCodeHookService = new OpenCodeHookService()
 export const openCode2HookService = new OpenCodeHookService({
   pluginFileName: 'orca-opencode2-status.js',
-  legacyHooksDir: 'opencode2-hooks',
+  legacyHooksDir: OPENCODE2_LEGACY_HOOKS_DIR,
   overlayDir: 'opencode2-config-overlays',
   pluginSource: getOpenCode2PluginSource
 })
diff --git a/src/main/opencode/legacy-shared-config-dir.test.ts b/src/main/opencode/legacy-shared-config-dir.test.ts
new file mode 100644
index 00000000000..f4a20713e8b
--- /dev/null
+++ b/src/main/opencode/legacy-shared-config-dir.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it } from 'vitest'
+import { join } from 'node:path'
+import { isOpenCodeLegacySharedConfigDir } from './legacy-shared-config-dir'
+
+describe('retired config directory recognition', () => {
+  const root = join(process.cwd(), 'user-data')
+  it.each(['opencode-hooks', 'opencode2-hooks'])('normalizes %s paths', (hooks) => {
+    const path = join(root, hooks, 'shared')
+    expect(isOpenCodeLegacySharedConfigDir(`${path}/`, root)).toBe(true)
+    expect(isOpenCodeLegacySharedConfigDir(`${path}/../shared`, root)).toBe(true)
+    expect(isOpenCodeLegacySharedConfigDir(`${path}/../mine`, root)).toBe(false)
+    expect(isOpenCodeLegacySharedConfigDir(`${path}-custom`, root)).toBe(false)
+    expect(isOpenCodeLegacySharedConfigDir(undefined, root)).toBe(false)
+  })
+  it.skipIf(process.platform !== 'win32')('handles Windows casing and separators', () => {
+    expect(isOpenCodeLegacySharedConfigDir('C:/ORCA/opencode-hooks/shared/', 'c:\\orca')).toBe(true)
+  })
+})
+
+describe('isOpenCodeLegacySharedConfigDir', () => {
+  const userData = join('fixture', 'user-data')
+
+  it('matches only the retired shared dirs of both OpenCode variants', () => {
+    expect(
+      isOpenCodeLegacySharedConfigDir(join(userData, 'opencode-hooks', 'shared'), userData)
+    ).toBe(true)
+    expect(
+      isOpenCodeLegacySharedConfigDir(join(userData, 'opencode2-hooks', 'shared'), userData)
+    ).toBe(true)
+    expect(
+      isOpenCodeLegacySharedConfigDir(join(userData, 'opencode-hooks', 'mine'), userData)
+    ).toBe(false)
+    expect(
+      isOpenCodeLegacySharedConfigDir(join('other', 'opencode-hooks', 'shared'), userData)
+    ).toBe(false)
+    expect(isOpenCodeLegacySharedConfigDir(undefined, userData)).toBe(false)
+  })
+})
diff --git a/src/main/opencode/legacy-shared-config-dir.ts b/src/main/opencode/legacy-shared-config-dir.ts
new file mode 100644
index 00000000000..8b0c2b842e4
--- /dev/null
+++ b/src/main/opencode/legacy-shared-config-dir.ts
@@ -0,0 +1,48 @@
+import { join, resolve } from 'node:path'
+
+export const OPENCODE_LEGACY_HOOKS_DIR = 'opencode-hooks'
+export const OPENCODE2_LEGACY_HOOKS_DIR = 'opencode2-hooks'
+
+// Why: before 1.4.209 Orca pointed OPENCODE_CONFIG_DIR at this dir; shells and OpenCode 2 background services from then can still load it.
+export function getOpenCodeLegacySharedConfigDir(
+  userDataPath: string,
+  legacyHooksDir: string
+): string {
+  return join(userDataPath, legacyHooksDir, 'shared')
+}
+
+export function isOpenCodeLegacySharedConfigDir(
+  configDir: string | undefined,
+  userDataPath: string
+): boolean {
+  return (
+    configDir !== undefined &&
+    [OPENCODE_LEGACY_HOOKS_DIR, OPENCODE2_LEGACY_HOOKS_DIR].some(
+      (hooksDir) =>
+        normalizeConfigPath(configDir) ===
+        normalizeConfigPath(getOpenCodeLegacySharedConfigDir(userDataPath, hooksDir))
+    )
+  )
+}
+
+function normalizeConfigPath(path: string): string {
+  const resolved = resolve(path)
+  return process.platform === 'win32' ? resolved.toLowerCase() : resolved
+}
+
+export const OPENCODE_CONFIG_DIR_ENV_KEYS = [
+  'OPENCODE_CONFIG_DIR',
+  'ORCA_OPENCODE_CONFIG_DIR',
+  'ORCA_OPENCODE_SOURCE_CONFIG_DIR'
+] as const
+
+/** Carries retired inherited paths through providers that merge their environment later. */
+export function getLegacyOpenCodeEnvKeysToDelete(
+  env: Record<string, string | undefined> | undefined,
+  userDataPath: string,
+  inherited: Record<string, string | undefined> = process.env
+): string[] {
+  return OPENCODE_CONFIG_DIR_ENV_KEYS.filter((key) =>
+    isOpenCodeLegacySharedConfigDir(env?.[key] ?? inherited[key], userDataPath)
+  )
+}
diff --git a/src/main/opencode/status-plugin-factory-source.ts b/src/main/opencode/status-plugin-factory-source.ts
index 8348cc968eb..218d15c3e41 100644
--- a/src/main/opencode/status-plugin-factory-source.ts
+++ b/src/main/opencode/status-plugin-factory-source.ts
@@ -23,6 +23,7 @@ export function getStatusPluginFactorySource(options: {
     'export const OrcaOpenCodeStatusPlugin = async (_ctx) => {',
     `  if (process.env.ORCA_OPENCODE_AGENT && process.env.ORCA_OPENCODE_AGENT !== '${expectedAgent}') return {};`,
     '  const client = _ctx?.client;',
+    '  const sessionsOutliveDispose = _ctx?.sessionsOutliveDispose === true;',
     '  const factoryID = ++nextFactoryID;',
     '  activeFactoryIDs.add(factoryID);',
     '  let disposed = false;',
@@ -242,7 +243,14 @@ export function getStatusPluginFactorySource(options: {
     '        pendingAssistantPart = null;',
     '      }',
     '      const ownsDeliveredMessagePart = deliveredMessagePartFactoryID === factoryID;',
-    '      if (desiredFactoryID === factoryID || ownsDeliveredMessagePart) {',
+    '      // Why: OpenCode 1 disposes only on instance teardown, which cancels every run, so a final',
+    '      // Idle is true. OpenCode 2 also disposes on a hot reload mid-turn, so it publishes nothing.',
+    '      if (sessionsOutliveDispose) {',
+    '        if (desiredFactoryID === factoryID) {',
+    '          clearStatusRetry();',
+    '          statusRevision += 1;',
+    '        }',
+    '      } else if (desiredFactoryID === factoryID || ownsDeliveredMessagePart) {',
     '        clearStatusRetry();',
     '        statusRevision += 1;',
     '        // A MessagePart may have changed the listener to Working after the',
@@ -250,17 +258,13 @@ export function getStatusPluginFactorySource(options: {
     '        statusDeliveryDirty = ownsDeliveredMessagePart;',
     '        busyRecoveryUsed = false;',
     '        busyRecoveryEndpointKey = "";',
-    '        const fallbackFactoryID = Array.from(activeFactoryIDs).find(',
-    '          (id) => id !== factoryID',
-    '        );',
+    '        const fallbackFactoryID = Array.from(activeFactoryIDs).find((id) => id !== factoryID);',
     '        if (fallbackFactoryID !== undefined) {',
     '          await publishAggregateStatus(',
     '            fallbackFactoryID,',
     '            desiredStatusProperties?.sessionID',
     '          );',
     '        } else {',
-    '          // Why: Instance disposal can happen while the PTY stays alive;',
-    '          // publish a final idle so Orca does not retain a dead owner.',
     '          if (!deliveredStatusKey.startsWith("idle:") || ownsDeliveredMessagePart) {',
     '            await setStatus(',
     '              "idle",',
diff --git a/src/main/opencode2/status-plugin-setup-lifetime.test.ts b/src/main/opencode2/status-plugin-setup-lifetime.test.ts
new file mode 100644
index 00000000000..5a2c4280ced
--- /dev/null
+++ b/src/main/opencode2/status-plugin-setup-lifetime.test.ts
@@ -0,0 +1,204 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { getOpenCode2SetupSource } from './status-plugin-setup-source'
+
+type Hooks = { event: (event: unknown) => Promise<void>; dispose?: () => Promise<void> }
+
+function createSetup(factory: () => Promise<Hooks>) {
+  const setup: unknown = new Function(
+    'OrcaOpenCodeStatusPlugin',
+    'AbortController',
+    'console',
+    `${getOpenCode2SetupSource().join('\n')}\nreturn setupOpenCode2Status;`
+  )(factory, AbortController, { warn: vi.fn() })
+  if (typeof setup !== 'function') {
+    throw new Error('Missing generated setup')
+  }
+  return async (context: unknown) => {
+    const cleanup: unknown = await setup(context)
+    if (typeof cleanup !== 'function') {
+      throw new Error('Missing generated cleanup')
+    }
+    return cleanup
+  }
+}
+
+function deferred() {
+  let finish = () => {}
+  const promise = new Promise<void>((resolve) => {
+    finish = resolve
+  })
+  return { promise, finish }
+}
+
+beforeEach(() => {
+  vi.stubGlobal(
+    'fetch',
+    vi.fn(async () => new Response('{}', { status: 200 }))
+  )
+})
+afterEach(() => {
+  expect(fetch).not.toHaveBeenCalled()
+  vi.unstubAllGlobals()
+})
+
+describe('generated OpenCode 2 setup ownership', () => {
+  it.each(['throw', 'reject'] as const)(
+    'disposes the factory after prompt registration %s',
+    async (failure) => {
+      const hooks = { event: vi.fn(async () => {}), dispose: vi.fn(async () => {}) }
+      const subscribe = vi.fn(async function* () {})
+      const hook = () => {
+        if (failure === 'throw') {
+          throw new Error('Registration failed')
+        }
+        return Promise.reject(new Error('Registration failed'))
+      }
+      const cleanup = await createSetup(async () => hooks)({
+        session: { hook },
+        event: { subscribe }
+      })
+      expect(hooks.dispose).toHaveBeenCalledOnce()
+      expect(subscribe).not.toHaveBeenCalled()
+      await cleanup()
+      expect(hooks.dispose).toHaveBeenCalledOnce()
+    }
+  )
+
+  it.each(['throw', 'reject'] as const)(
+    'disposes the factory after prompt cleanup %s',
+    async (failure) => {
+      const hooks = { event: vi.fn(async () => {}), dispose: vi.fn(async () => {}) }
+      const promptDispose = vi.fn(() => {
+        if (failure === 'throw') {
+          throw new Error('Prompt cleanup failed')
+        }
+        return Promise.reject(new Error('Prompt cleanup failed'))
+      })
+      let signal: AbortSignal | undefined
+      const cleanup = await createSetup(async () => hooks)({
+        session: { hook: async () => ({ dispose: promptDispose }) },
+        event: {
+          subscribe: (options: { signal: AbortSignal }) => {
+            signal = options.signal
+            return []
+          }
+        }
+      })
+      await cleanup()
+      expect(signal?.aborted).toBe(true)
+      expect(promptDispose).toHaveBeenCalledOnce()
+      expect(hooks.dispose).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('waits for in-flight delivery before factory cleanup after a prompt cleanup failure', async () => {
+    const delivery = deferred()
+    const started = deferred()
+    const order: string[] = []
+    const hooks = {
+      event: vi.fn(async () => {
+        started.finish()
+        await delivery.promise
+        order.push('event')
+      }),
+      dispose: vi.fn(async () => {
+        order.push('factory')
+      })
+    }
+    const cleanup = await createSetup(async () => hooks)({
+      session: {
+        hook: async () => ({
+          dispose: async () => {
+            order.push('prompt')
+            throw new Error('Failed')
+          }
+        })
+      },
+      event: {
+        subscribe: async function* ({ signal }: { signal: AbortSignal }) {
+          try {
+            yield { type: 'session.execution.started', data: { sessionID: 'synthetic' } }
+            if (!signal.aborted) {
+              yield { type: 'session.execution.succeeded', data: { sessionID: 'synthetic' } }
+            }
+          } finally {
+            order.push('subscription')
+          }
+        }
+      }
+    })
+    await started.promise
+    const disposing = cleanup()
+    await Promise.resolve()
+    expect(hooks.dispose).not.toHaveBeenCalled()
+    delivery.finish()
+    await disposing
+    expect(order).toEqual(['prompt', 'event', 'subscription', 'factory'])
+    expect(hooks.event).toHaveBeenCalledOnce()
+    expect(hooks.dispose).toHaveBeenCalledOnce()
+  })
+
+  it.each(['setup', 'unload'] as const)(
+    'keeps %s fail-open when factory cleanup also rejects',
+    async (stage) => {
+      const hooks = {
+        event: vi.fn(async () => {}),
+        dispose: vi.fn(async () => {
+          throw new Error('Factory cleanup failed')
+        })
+      }
+      const cleanup = await createSetup(async () => hooks)({
+        session: {
+          hook: async () => {
+            if (stage === 'setup') {
+              throw new Error('Registration failed')
+            }
+            return {
+              dispose: async () => {
+                throw new Error('Prompt cleanup failed')
+              }
+            }
+          }
+        },
+        event: { subscribe: async function* () {} }
+      })
+      await cleanup()
+      expect(hooks.dispose).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('disposes both owners once on ordinary unload', async () => {
+    const hooks = { event: vi.fn(async () => {}), dispose: vi.fn(async () => {}) }
+    const promptDispose = vi.fn(async () => {})
+    const cleanup = await createSetup(async () => hooks)({
+      session: { hook: async () => ({ dispose: promptDispose }) },
+      event: { subscribe: async function* () {} }
+    })
+    expect(hooks.dispose).not.toHaveBeenCalled()
+    await cleanup()
+    expect(promptDispose).toHaveBeenCalledOnce()
+    expect(hooks.dispose).toHaveBeenCalledOnce()
+  })
+
+  it('accepts absent optional disposers', async () => {
+    const cleanup = await createSetup(async () => ({ event: async () => {} }))({
+      session: { hook: async () => undefined },
+      event: { subscribe: async function* () {} }
+    })
+    await cleanup()
+  })
+
+  it('skips allocation for an unusable context and tolerates factory rejection', async () => {
+    const factory = vi.fn(async (): Promise<Hooks> => {
+      throw new Error('Factory failed')
+    })
+    await (
+      await createSetup(factory)(undefined)
+    )()
+    expect(factory).not.toHaveBeenCalled()
+    await (
+      await createSetup(factory)({ session: { hook: vi.fn() }, event: { subscribe: vi.fn() } })
+    )()
+    expect(factory).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/opencode2/status-plugin-setup-source.ts b/src/main/opencode2/status-plugin-setup-source.ts
index c4bf8d0ea72..7b825056ecd 100644
--- a/src/main/opencode2/status-plugin-setup-source.ts
+++ b/src/main/opencode2/status-plugin-setup-source.ts
@@ -10,6 +10,7 @@ const NON_SESSION_FORM_OWNERS = new Set(["global"]);
 
 async function setupOpenCode2Status(ctx) {
   const noop = async () => {};
+  let hooks;
   // Why: OpenCode may probe setup() with no context during startup, and the setup
   // API shape can drift between releases. Never throw from setup — a throw surfaces
   // as an 'orca-opencode-status' plugin failed error in the TUI, which is worse
@@ -23,7 +24,8 @@ async function setupOpenCode2Status(ctx) {
     // Without it, resolveRootSessionID returns null for every session and a
     // subagent's work publishes as if it were the root's.
     const client = { session: { get: async (input, options) => { const result = await ctx.session.get(input, options); return result && typeof result.id === "string" ? { data: result } : result; } } };
-    const hooks = await OrcaOpenCodeStatusPlugin({ client });
+    // Why: this host disposes plugins on a hot reload while turns keep running.
+    hooks = await OrcaOpenCodeStatusPlugin({ client, sessionsOutliveDispose: true });
     if (!hooks || typeof hooks.event !== "function") return noop;
     const promptRegistration = await ctx.session.hook("prompt", async (properties) => {
       await hooks.event({ event: { type: "session.next.prompt.admitted", properties } });
@@ -79,14 +81,22 @@ async function setupOpenCode2Status(ctx) {
     return async () => {
       try {
         controller.abort();
-        await promptRegistration?.dispose?.();
-        await consuming;
-        await hooks.dispose?.();
+        // Each owner must finish cleanup even when an earlier disposer rejects.
+        try {
+          await promptRegistration?.dispose?.();
+        } finally {
+          try {
+            await consuming;
+          } finally {
+            await hooks.dispose?.();
+          }
+        }
       } catch {
         // Why: cleanup runs during plugin unload; a throw here also fails the plugin.
       }
     };
   } catch {
+    try { await hooks?.dispose?.(); } catch {}
     return noop;
   }
 }
diff --git a/src/main/orca-profiles/profile-active-transfer-worker.test.ts b/src/main/orca-profiles/profile-active-transfer-worker.test.ts
new file mode 100644
index 00000000000..2e19eaf73f0
--- /dev/null
+++ b/src/main/orca-profiles/profile-active-transfer-worker.test.ts
@@ -0,0 +1,127 @@
+import { mkdtempSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import { getDefaultPersistedState } from '../../shared/constants'
+import { ORCA_PROFILE_INDEX_SCHEMA_VERSION } from '../../shared/orca-profiles'
+import { createWorkerMaintenanceFixture } from '../persistence/loading-store/profile-state-maintenance-fixture'
+import { ProfileStateSqliteAuthority } from '../persistence/profile-state/profile-state-sqlite-authority'
+import { transferActiveProfileProject } from './profile-active-transfer'
+import * as domainState from './profile-project-domain-state'
+import {
+  profileHasPendingProjectMove,
+  recoverPendingProfileProjectMoves
+} from './profile-project-move-intent'
+import { readProfileStateWithRevision } from './profile-project-state-file'
+
+vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+async function fixture() {
+  const root = mkdtempSync(join(tmpdir(), 'orca-worker-profile-transfer-'))
+  writeFileSync(
+    join(root, 'orca-profile-index.json'),
+    JSON.stringify({
+      schemaVersion: ORCA_PROFILE_INDEX_SCHEMA_VERSION,
+      activeProfileId: 'source',
+      profiles: ['source', 'target'].map((id) => ({
+        id,
+        name: id,
+        avatar: { kind: 'initials', initials: id[0], color: 'neutral' },
+        kind: 'local',
+        createdAt: 1,
+        updatedAt: 1,
+        lastOpenedAt: 1
+      }))
+    })
+  )
+  const current = await createWorkerMaintenanceFixture({
+    directory: join(root, 'profiles', 'source'),
+    profileId: 'source',
+    cleanupRoot: root
+  })
+  const target = new ProfileStateSqliteAuthority(
+    join(root, 'profiles', 'target', 'profile-state.db'),
+    'target'
+  )
+  try {
+    target.writeSerializedState(Buffer.from(JSON.stringify(getDefaultPersistedState(root))))
+  } finally {
+    target.close()
+  }
+  const args = {
+    sourceProfileId: 'source',
+    targetProfileId: 'target',
+    repoId: 'repo-remote',
+    mode: 'move'
+  } as const
+  const read = (id: string) => readProfileStateWithRevision(id, root)
+  return { ...current, root, args, read }
+}
+
+describe('active profile transfers with the live writer', () => {
+  it('resumes the exact source revision after a validation failure', async () => {
+    const { store, root, args, read } = await fixture()
+    const reopen = vi.fn(async () => {})
+    await expect(
+      transferActiveProfileProject({ ...args, repoId: 'missing' }, root, store, reopen)
+    ).rejects.toThrow('unknown_source_repo')
+    expect(reopen).not.toHaveBeenCalled()
+    store.updateSettings({ theme: 'dark' })
+    await store.flushPendingOrThrowAsync()
+    expect(read('source').state.settings.theme).toBe('dark')
+  })
+
+  it('keeps the source frozen after moving a remote project and its persisted state', async () => {
+    const { store, root, args, read } = await fixture()
+    const result = await transferActiveProfileProject(args, root, store, async () => {})
+    expect(result.status).toBe('transferred')
+    expect(read('source').state.repos.some((repo) => repo.id === args.repoId)).toBe(false)
+    expect(read('target').state.repos.some((repo) => repo.id === args.repoId)).toBe(true)
+    const source = read('source')
+    store.updateSettings({ theme: 'dark' })
+    await expect(store.flushPendingOrThrowAsync()).rejects.toThrow('finalized')
+    expect(read('source')).toEqual(source)
+  })
+
+  it('resumes when a copy makes a later move a duplicate', async () => {
+    const { store, root, args, read } = await fixture()
+    await transferActiveProfileProject({ ...args, mode: 'copy' }, root, store, async () => {})
+    const result = await transferActiveProfileProject(args, root, store, async () => {})
+    expect(result.status).toBe('duplicate-target')
+    store.updateSettings({ theme: 'dark' })
+    await store.flushPendingOrThrowAsync()
+    expect(read('source').state.settings.theme).toBe('dark')
+    expect(read('source').state.repos.some((repo) => repo.id === args.repoId)).toBe(true)
+  })
+
+  it('leaves an interrupted move frozen until journal recovery runs with the writer closed', async () => {
+    const { store, root, args, read } = await fixture()
+    const original = domainState.writeProfileProjectDomainChanges
+    const fault = vi
+      .spyOn(domainState, 'writeProfileProjectDomainChanges')
+      .mockImplementation((id, ...rest) => {
+        if (id === args.sourceProfileId) {
+          throw new Error('source commit interrupted')
+        }
+        return original(id, ...rest)
+      })
+    const reopen = vi.fn(async () => {})
+    await expect(transferActiveProfileProject(args, root, store, reopen)).rejects.toThrow(
+      'source commit interrupted'
+    )
+    expect(reopen).toHaveBeenCalledOnce()
+    expect(profileHasPendingProjectMove('source', root)).toBe(true)
+    await expect(store.flushPendingOrThrowAsync()).rejects.toThrow('finalized')
+    fault.mockRestore()
+    expect(recoverPendingProfileProjectMoves(root)).toBe(1)
+    expect(read('source').state.repos.some((repo) => repo.id === args.repoId)).toBe(false)
+    expect(read('target').state.repos.some((repo) => repo.id === args.repoId)).toBe(true)
+  })
+})
diff --git a/src/main/orca-profiles/profile-active-transfer.test.ts b/src/main/orca-profiles/profile-active-transfer.test.ts
new file mode 100644
index 00000000000..0cfd80d7eef
--- /dev/null
+++ b/src/main/orca-profiles/profile-active-transfer.test.ts
@@ -0,0 +1,232 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { getDefaultPersistedState } from '../../shared/constants'
+import { ORCA_PROFILE_INDEX_SCHEMA_VERSION } from '../../shared/orca-profiles'
+import { openProfileStateDatabase } from '../persistence/profile-state/profile-state-database'
+import { importProfileStateJson } from '../persistence/profile-state/profile-state-documents'
+import { ProfileStateSqliteAuthority } from '../persistence/profile-state/profile-state-sqlite-authority'
+import * as stateFiles from './profile-project-state-file'
+import * as domainState from './profile-project-domain-state'
+import * as moveIntents from './profile-project-move-intent'
+import { transferActiveProfileProject } from './profile-active-transfer'
+import { transferOrcaProfileProject } from './profile-project-transfer'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: { isEncryptionAvailable: () => false },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: vi.fn(() => ({ nth_repo_added: 2 }))
+}))
+vi.mock('../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: vi.fn(() => ({ hosts: [] })),
+  sshConfigHostsToTargets: vi.fn(() => [])
+}))
+
+const { Store } = await import('../persistence/loading-store/store')
+const stores: InstanceType<typeof Store>[] = []
+let directory: string
+const args = {
+  sourceProfileId: 'source',
+  targetProfileId: 'target',
+  repoId: 'repo-1',
+  mode: 'move'
+} as const
+
+function snapshot(profileId: string) {
+  return stateFiles.readProfileStateWithRevision(profileId, directory)
+}
+
+function openStore() {
+  const profileDirectory = join(directory, 'profiles', 'source')
+  const store = new Store({
+    dataFile: join(profileDirectory, 'orca-data.json'),
+    profileStateAuthority: new ProfileStateSqliteAuthority(
+      join(profileDirectory, 'profile-state.db'),
+      'source'
+    )
+  })
+  stores.push(store)
+  store.flushOrThrow()
+  return store
+}
+
+function interruptSourceCommit() {
+  const originalWrite = domainState.writeProfileProjectDomainChanges
+  return vi
+    .spyOn(domainState, 'writeProfileProjectDomainChanges')
+    .mockImplementation((profileId, ...rest) => {
+      if (profileId === 'source') {
+        throw new Error('source commit interrupted')
+      }
+      return originalWrite(profileId, ...rest)
+    })
+}
+
+beforeEach(() => {
+  directory = mkdtempSync(join(tmpdir(), 'orca-active-profile-transfer-'))
+  vi.spyOn(ProfileStateSqliteAuthority.prototype, 'scheduleBackup').mockImplementation(() => {})
+  writeFileSync(
+    join(directory, 'orca-profile-index.json'),
+    JSON.stringify({
+      schemaVersion: ORCA_PROFILE_INDEX_SCHEMA_VERSION,
+      activeProfileId: 'source',
+      profiles: ['source', 'target'].map((id) => ({
+        id,
+        name: id,
+        avatar: { kind: 'initials', initials: id[0], color: 'neutral' },
+        kind: 'local',
+        createdAt: 1,
+        updatedAt: 1,
+        lastOpenedAt: 1
+      }))
+    })
+  )
+  for (const profileId of ['source', 'target']) {
+    const profileDirectory = join(directory, 'profiles', profileId)
+    mkdirSync(profileDirectory, { recursive: true })
+    const db = openProfileStateDatabase(join(profileDirectory, 'profile-state.db'), profileId).db
+    try {
+      importProfileStateJson(
+        db,
+        JSON.stringify({
+          ...getDefaultPersistedState('/home/test'),
+          repos:
+            profileId === 'source'
+              ? [{ id: 'repo-1', path: '/projects/folder', kind: 'folder', addedAt: 1 }]
+              : []
+        })
+      )
+    } finally {
+      db.close()
+    }
+  }
+})
+
+afterEach(() => {
+  for (const store of stores.splice(0)) {
+    store.freezeWrites()
+  }
+  vi.restoreAllMocks()
+  rmSync(directory, { recursive: true, force: true })
+})
+
+describe('active profile transfer recovery', () => {
+  it.each(['source commit', 'intent cleanup'] as const)(
+    'fences an existing SQLite Store after interrupted %s until recovery and reopen',
+    async (failure) => {
+      const store = openStore()
+      const before = snapshot('source')
+      const interrupted =
+        failure === 'source commit'
+          ? interruptSourceCommit()
+          : vi.spyOn(moveIntents, 'removeProfileProjectMoveIntent').mockImplementation(() => {
+              throw new Error('intent cleanup interrupted')
+            })
+      const reopen = vi.fn(async () => {
+        const retained = snapshot('source')
+        store.updateSettings({ theme: 'light' })
+        expect(() => store.flushOrThrow()).toThrow('final persistence')
+        expect(snapshot('source')).toEqual(retained)
+      })
+
+      await expect(transferActiveProfileProject(args, directory, store, reopen)).rejects.toThrow(
+        `${failure} interrupted`
+      )
+      expect(reopen).toHaveBeenCalledOnce()
+      expect(snapshot('source').revision).toBe(
+        (before.revision ?? 0) + (failure === 'source commit' ? 0 : 1)
+      )
+      expect(snapshot('target').state.repos).toHaveLength(1)
+      interrupted.mockRestore()
+
+      expect(moveIntents.recoverPendingProfileProjectMoves(directory)).toBe(1)
+      expect(moveIntents.recoverPendingProfileProjectMoves(directory)).toBe(0)
+      expect(snapshot('source').state.repos).toHaveLength(0)
+      expect(snapshot('target').state.repos).toHaveLength(1)
+      const reloaded = openStore()
+      reloaded.updateSettings({ theme: 'light' })
+      reloaded.flushOrThrow()
+      expect(snapshot('source').state.settings.theme).toBe('light')
+      expect(moveIntents.recoverPendingProfileProjectMoves(directory)).toBe(0)
+    }
+  )
+
+  it('leaves an unchanged SQLite Store writable after validation fails', async () => {
+    const store = openStore()
+    const before = snapshot('source')
+    const reopen = vi.fn(async () => {})
+    await expect(
+      transferActiveProfileProject({ ...args, repoId: 'missing' }, directory, store, reopen)
+    ).rejects.toThrow('unknown_source_repo')
+    expect(reopen).not.toHaveBeenCalled()
+    store.updateSettings({ theme: 'light' })
+    store.flushOrThrow()
+    expect(snapshot('source').revision).toBe((before.revision ?? 0) + 1)
+    expect(snapshot('source').state.settings.theme).toBe('light')
+  })
+
+  it('keeps writes fenced when reopening after a partial transfer fails', async () => {
+    const store = openStore()
+    const before = snapshot('source')
+    const interrupted = interruptSourceCommit()
+    await expect(
+      transferActiveProfileProject(args, directory, store, async () => {
+        throw new Error('reopen failed')
+      })
+    ).rejects.toThrow('reopen failed')
+    store.updateSettings({ theme: 'light' })
+    expect(() => store.flushOrThrow()).toThrow('final persistence')
+    expect(snapshot('source')).toEqual(before)
+    interrupted.mockRestore()
+    expect(moveIntents.recoverPendingProfileProjectMoves(directory)).toBe(1)
+  })
+
+  it('reopens before an outstanding move can change the active Store behind its revision', async () => {
+    const store = openStore()
+    const interrupted = interruptSourceCommit()
+    expect(() => transferOrcaProfileProject(args, directory)).toThrow('source commit interrupted')
+    interrupted.mockRestore()
+    const reopen = vi.fn(async () => {
+      expect(moveIntents.recoverPendingProfileProjectMoves(directory)).toBe(1)
+    })
+    await expect(transferActiveProfileProject(args, directory, store, reopen)).rejects.toThrow(
+      'active_source_orca_profile_move_requires_recovery'
+    )
+    const recovered = snapshot('source')
+    store.updateSettings({ theme: 'light' })
+    expect(() => store.flushOrThrow()).toThrow('final persistence')
+    expect(snapshot('source')).toEqual(recovered)
+    expect(reopen).toHaveBeenCalledOnce()
+  })
+
+  it('keeps the Store frozen when an unreadable intent cannot identify its participants', async () => {
+    const store = openStore()
+    const before = snapshot('source')
+    const intentDirectory = join(directory, 'profile-move-intents')
+    mkdirSync(intentDirectory)
+    writeFileSync(join(intentDirectory, '11111111-1111-4111-8111-111111111111.json'), '{')
+    const reopen = vi.fn(async () => {
+      moveIntents.recoverPendingProfileProjectMoves(directory)
+    })
+    await expect(transferActiveProfileProject(args, directory, store, reopen)).rejects.toThrow(
+      'Profile move intent is unreadable'
+    )
+    store.updateSettings({ theme: 'light' })
+    expect(() => store.flushOrThrow()).toThrow('final persistence')
+    expect(snapshot('source')).toEqual(before)
+    expect(reopen).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/orca-profiles/profile-active-transfer.ts b/src/main/orca-profiles/profile-active-transfer.ts
new file mode 100644
index 00000000000..53ba8481da5
--- /dev/null
+++ b/src/main/orca-profiles/profile-active-transfer.ts
@@ -0,0 +1,39 @@
+import type {
+  TransferOrcaProfileProjectArgs,
+  TransferOrcaProfileProjectResult
+} from '../../shared/orca-profiles'
+import type { Store } from '../persistence/loading-store/store'
+import { transferOrcaProfileProject } from './profile-project-transfer'
+import { hasOrcaProfileStateDatabase } from './profile-storage-paths'
+import { profileHasPendingProjectMove } from './profile-project-move-intent'
+import { flushActiveProfileBeforeFileMutation } from './profile-persistence-deadline'
+
+/** Keep the active Store stopped until file mutation either succeeds or proves unchanged. */
+export async function transferActiveProfileProject(
+  args: TransferOrcaProfileProjectArgs,
+  userDataPath: string,
+  store: Pick<Store, 'beginProfileMaintenance'>,
+  reopenSource: () => Promise<void>
+): Promise<TransferOrcaProfileProjectResult> {
+  const hadDatabase = hasOrcaProfileStateDatabase(args.sourceProfileId, userDataPath)
+  const pendingMove = profileHasPendingProjectMove(args.sourceProfileId, userDataPath)
+  const maintenance = await flushActiveProfileBeforeFileMutation(store, { flush: !pendingMove })
+  let result: TransferOrcaProfileProjectResult
+  try {
+    if (profileHasPendingProjectMove(args.sourceProfileId, userDataPath)) {
+      throw new Error('active_source_orca_profile_move_requires_recovery')
+    }
+    result = transferOrcaProfileProject(args, userDataPath)
+  } catch (error) {
+    const needsRecovery =
+      (!hadDatabase && hasOrcaProfileStateDatabase(args.sourceProfileId, userDataPath)) ||
+      profileHasPendingProjectMove(args.sourceProfileId, userDataPath)
+    // Further writes would invalidate a retained move's recovery revision.
+    await (needsRecovery ? reopenSource() : maintenance.resume())
+    throw error
+  }
+  if (result.status !== 'transferred' || args.mode !== 'move') {
+    await maintenance.resume()
+  }
+  return result
+}
diff --git a/src/main/orca-profiles/profile-cloud-auth-status.test.ts b/src/main/orca-profiles/profile-cloud-auth-status.test.ts
index 7a28783e9a9..3db3ccb92e9 100644
--- a/src/main/orca-profiles/profile-cloud-auth-status.test.ts
+++ b/src/main/orca-profiles/profile-cloud-auth-status.test.ts
@@ -38,6 +38,7 @@ function activeProfile(linked: boolean): ActiveOrcaProfileState {
     profile,
     index: { schemaVersion: 1, activeProfileId: profile.id, profiles: [profile] },
     dataFile: '',
+    stateDatabaseFile: '',
     profileDirectory: ''
   }
 }
diff --git a/src/main/orca-profiles/profile-index-store.test.ts b/src/main/orca-profiles/profile-index-store.test.ts
index 1d02c4d7dcc..84a6927a8a7 100644
--- a/src/main/orca-profiles/profile-index-store.test.ts
+++ b/src/main/orca-profiles/profile-index-store.test.ts
@@ -1,9 +1,17 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { installFakeAppEnvironment } from '../../../config/scripts/vitest-host-ports-setup'
-import { existsSync, mkdtempSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs'
+import {
+  existsSync,
+  mkdtempSync,
+  readFileSync,
+  writeFileSync,
+  mkdirSync,
+  renameSync
+} from 'node:fs'
 import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
+import { openProfileStateDatabase } from '../persistence/profile-state/profile-state-database'
 import {
   createDefaultLocalOrcaProfile,
   DEFAULT_LOCAL_ORCA_PROFILE_ID,
@@ -66,6 +74,9 @@ describe('profile index store', () => {
     expect(activeProfile.dataFile).toBe(
       join(testState.dir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID, 'orca-data.json')
     )
+    expect(activeProfile.stateDatabaseFile).toBe(
+      join(testState.dir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID, 'profile-state.db')
+    )
     expect(readJson(activeProfile.dataFile)).toEqual(legacyState)
     expect(readJson(`${activeProfile.dataFile}.bak.0`)).toEqual(legacyBackup)
     expect(
@@ -115,9 +126,59 @@ describe('profile index store', () => {
 
     expect(activeProfile.profile.id).toBe(profileId)
     expect(activeProfile.dataFile).toBe(join(profileDirectory, 'orca-data.json'))
+    expect(activeProfile.stateDatabaseFile).toBe(join(profileDirectory, 'profile-state.db'))
     expect(readJson(activeProfile.dataFile)).toEqual(profileData)
   })
 
+  it('does not copy legacy JSON into a database-only default profile', async () => {
+    writeFileSync(
+      join(testState.dir, 'orca-data.json'),
+      JSON.stringify({ settings: { theme: 'legacy' } }),
+      'utf-8'
+    )
+    const profileDirectory = join(testState.dir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID)
+    mkdirSync(profileDirectory, { recursive: true })
+    const database = openProfileStateDatabase(
+      join(profileDirectory, 'profile-state.db'),
+      DEFAULT_LOCAL_ORCA_PROFILE_ID
+    )
+    database.db.close()
+
+    const { ensureActiveOrcaProfile } = await loadProfileIndexStore()
+    const activeProfile = ensureActiveOrcaProfile()
+
+    expect(activeProfile.stateDatabaseFile).toBe(join(profileDirectory, 'profile-state.db'))
+    expect(existsSync(activeProfile.dataFile)).toBe(false)
+    expect(readFileSync(join(testState.dir, 'orca-data.json'), 'utf-8')).toContain('legacy')
+  })
+
+  it.each([
+    'orca-data.json.sqlite-export.1.json',
+    'profile-state.db.backup.1789999999999-00000000-0000-4000-8000-000000000000.db',
+    'profile-state.db-wal',
+    'profile-state.db-shm',
+    'profile-state.db-journal'
+  ])('does not seed a stale mirror when %s exists without the database', async (artifact) => {
+    writeFileSync(
+      join(testState.dir, 'orca-data.json'),
+      JSON.stringify({ settings: { theme: 'legacy' } }),
+      'utf-8'
+    )
+    const profileDirectory = join(testState.dir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID)
+    mkdirSync(profileDirectory, { recursive: true })
+    writeFileSync(
+      join(profileDirectory, artifact),
+      JSON.stringify({ settings: { theme: 'migrated' } }),
+      'utf-8'
+    )
+
+    const { ensureActiveOrcaProfile } = await loadProfileIndexStore()
+    const activeProfile = ensureActiveOrcaProfile()
+
+    expect(existsSync(activeProfile.dataFile)).toBe(false)
+    expect(readFileSync(join(testState.dir, 'orca-data.json'), 'utf-8')).toContain('legacy')
+  })
+
   it('creates an empty local profile without copying legacy state into it', async () => {
     writeFileSync(
       join(testState.dir, 'orca-data.json'),
@@ -195,6 +256,45 @@ describe('profile index store', () => {
     expect(recovered.profiles.length).toBeGreaterThanOrEqual(2)
   })
 
+  it('retains the selected profile when only its backup index remains', async () => {
+    const store = await loadProfileIndexStore()
+    store.ensureActiveOrcaProfile()
+    const created = store.createLocalOrcaProfile({ name: 'Work' })
+    store.setActiveOrcaProfile(created.profile.id)
+    const indexPath = store.getOrcaProfileIndexPath()
+    renameSync(indexPath, `${indexPath}.bak`)
+
+    expect(store.loadOrCreateProfileIndex(testState.dir).activeProfileId).toBe(created.profile.id)
+    expect(store.ensureActiveOrcaProfile().profile.id).toBe(created.profile.id)
+    expect(readJson(indexPath)).toMatchObject({ activeProfileId: created.profile.id })
+  })
+
+  it.each(['primary', 'backup', 'both'] as const)(
+    'refuses an unreadable %s index without replacing it',
+    async (source) => {
+      const store = await loadProfileIndexStore()
+      const indexPath = store.getOrcaProfileIndexPath()
+      if (source !== 'backup') {
+        writeFileSync(indexPath, '{broken-primary')
+      }
+      if (source !== 'primary') {
+        writeFileSync(`${indexPath}.bak`, '{broken-backup')
+      }
+
+      expect(() => store.loadOrCreateProfileIndex(testState.dir)).toThrow(
+        'Could not read active profile index'
+      )
+      expect(() => store.ensureActiveOrcaProfile()).toThrow('Could not read active profile index')
+      if (source !== 'backup') {
+        expect(readFileSync(indexPath, 'utf8')).toBe('{broken-primary')
+      }
+      if (source !== 'primary') {
+        expect(readFileSync(`${indexPath}.bak`, 'utf8')).toBe('{broken-backup')
+      }
+      expect(existsSync(join(testState.dir, 'profiles'))).toBe(false)
+    }
+  )
+
   it('rejects profile ids that are not safe path segments', async () => {
     const store = await loadProfileIndexStore()
     const indexPath = store.getOrcaProfileIndexPath()
@@ -216,8 +316,7 @@ describe('profile index store', () => {
     mkdirSync(testState.dir, { recursive: true })
     writeFileSync(indexPath, JSON.stringify(index), 'utf-8')
 
-    // The tampered entry is filtered; startup falls back to a fresh default.
-    const state = store.ensureActiveOrcaProfile()
-    expect(state.profile.id).toBe(DEFAULT_LOCAL_ORCA_PROFILE_ID)
+    expect(() => store.ensureActiveOrcaProfile()).toThrow('Could not read active profile index')
+    expect(readJson(indexPath)).toEqual(index)
   })
 })
diff --git a/src/main/orca-profiles/profile-index-store.ts b/src/main/orca-profiles/profile-index-store.ts
index 7897e299a21..8f852581ce8 100644
--- a/src/main/orca-profiles/profile-index-store.ts
+++ b/src/main/orca-profiles/profile-index-store.ts
@@ -9,7 +9,6 @@ import {
 import { randomUUID } from 'node:crypto'
 import { dirname } from 'node:path'
 import { bestEffortFsyncDirectorySync, fsyncFileSync } from '../../shared/secure-file'
-import type { GlobalSettings } from '../../shared/global-settings-types'
 import {
   createDefaultLocalOrcaProfile,
   DEFAULT_LOCAL_ORCA_PROFILE_ID,
@@ -22,23 +21,24 @@ import {
   type OrcaProfileSummary
 } from '../../shared/orca-profiles'
 import {
-  getOrcaProfileBrowserSessionMetaFile,
   getOrcaProfileDataFile,
   getOrcaProfileDirectory,
   getOrcaProfileIndexPath,
-  getProfileUserDataPath,
-  LEGACY_BACKUP_COUNT,
-  legacyBackupPath,
-  legacyBrowserSessionMetaPath,
-  legacyDataFilePath,
-  profileBackupPath
+  getOrcaProfileStateDatabaseFile,
+  hasOrcaProfileStateDatabase,
+  getProfileUserDataPath
 } from './profile-storage-paths'
+import { copyLegacyStateToProfile } from './profile-legacy-state-import'
+import { profileStateJsonExportPaths } from '../persistence/profile-state/legacy-json/profile-state-export-path'
+import { profileStateDatabaseBackups } from '../persistence/profile-state/profile-state-backup-path'
 
 export {
   getOrcaProfileBrowserSessionMetaFile,
   getOrcaProfileDataFile,
   getOrcaProfileDirectory,
   getOrcaProfileIndexPath,
+  getOrcaProfileStateDatabaseFile,
+  hasOrcaProfileStateDatabase,
   getOrcaProfilesDirectory,
   initOrcaProfilePaths
 } from './profile-storage-paths'
@@ -47,6 +47,7 @@ export type ActiveOrcaProfileState = {
   index: OrcaProfileIndex
   profile: OrcaProfileSummary
   dataFile: string
+  stateDatabaseFile: string
   profileDirectory: string
 }
 
@@ -118,6 +119,14 @@ export function readProfileIndex(indexPath: string): OrcaProfileIndex | null {
   return readProfileIndexFile(indexPath) ?? readProfileIndexFile(`${indexPath}.bak`)
 }
 
+function readExistingProfileIndex(indexPath: string): OrcaProfileIndex | null {
+  const index = readProfileIndex(indexPath)
+  if (!index && (existsSync(indexPath) || existsSync(`${indexPath}.bak`))) {
+    throw new Error(`Could not read active profile index ${indexPath}`)
+  }
+  return index
+}
+
 export function writeProfileIndex(indexPath: string, index: OrcaProfileIndex): void {
   mkdirSync(dirname(indexPath), { recursive: true })
   // Why: only a still-parseable current index may refresh the backup;
@@ -136,51 +145,7 @@ export function writeProfileIndex(indexPath: string, index: OrcaProfileIndex): v
   bestEffortFsyncDirectorySync(dirname(indexPath))
 }
 
-function copyIfPresent(source: string, target: string): void {
-  if (!existsSync(source) || existsSync(target)) {
-    return
-  }
-  mkdirSync(dirname(target), { recursive: true })
-  // Why: tmp+rename so a crash mid-copy cannot leave a truncated target that
-  // the exists() guard above would then treat as a completed migration.
-  const tmpTarget = `${target}.tmp`
-  copyFileSync(source, tmpTarget)
-  renameSync(tmpTarget, target)
-}
-
-function copyLegacyStateToProfile(userDataPath: string, profileId: string): void {
-  const profileDataFile = getOrcaProfileDataFile(profileId, userDataPath)
-  copyIfPresent(legacyDataFilePath(userDataPath), profileDataFile)
-  copyIfPresent(
-    legacyBrowserSessionMetaPath(userDataPath),
-    getOrcaProfileBrowserSessionMetaFile(profileId, userDataPath)
-  )
-  for (let i = 0; i < LEGACY_BACKUP_COUNT; i++) {
-    copyIfPresent(legacyBackupPath(userDataPath, i), profileBackupPath(profileDataFile, i))
-  }
-}
-
-// Why: a brand-new profile has no data file, which the telemetry cohort
-// migration reads as a fresh install and defaults to opted-in. Copying the
-// active profile's consent block keeps an opted-out user opted out (and keeps
-// one installId per install) when they create additional profiles.
-export function seedNewOrcaProfileTelemetryConsent(
-  profileId: string,
-  telemetry: GlobalSettings['telemetry'],
-  userDataPath = getProfileUserDataPath()
-): void {
-  if (!telemetry) {
-    return
-  }
-  const dataFile = getOrcaProfileDataFile(profileId, userDataPath)
-  if (existsSync(dataFile)) {
-    return
-  }
-  mkdirSync(dirname(dataFile), { recursive: true })
-  const tmpPath = `${dataFile}.tmp`
-  writeFileSync(tmpPath, JSON.stringify({ settings: { telemetry } }, null, 2), 'utf-8')
-  renameSync(tmpPath, dataFile)
-}
+export { seedNewOrcaProfileTelemetryConsent } from './profile-telemetry-consent-seed'
 
 function createInitialProfileIndex(now = Date.now()): OrcaProfileIndex {
   const profile = createDefaultLocalOrcaProfile(now)
@@ -193,7 +158,7 @@ function createInitialProfileIndex(now = Date.now()): OrcaProfileIndex {
 
 export function loadOrCreateProfileIndex(userDataPath: string): OrcaProfileIndex {
   const indexPath = getOrcaProfileIndexPath(userDataPath)
-  const index = existsSync(indexPath) ? readProfileIndex(indexPath) : null
+  const index = readExistingProfileIndex(indexPath)
   if (index) {
     return index
   }
@@ -214,8 +179,8 @@ export function ensureActiveOrcaProfile(
   userDataPath = getProfileUserDataPath()
 ): ActiveOrcaProfileState {
   const indexPath = getOrcaProfileIndexPath(userDataPath)
-  let index = existsSync(indexPath) ? readProfileIndex(indexPath) : null
-  let shouldWriteIndex = false
+  let index = readExistingProfileIndex(indexPath)
+  let shouldWriteIndex = !existsSync(indexPath)
 
   if (!index) {
     index = createInitialProfileIndex()
@@ -230,7 +195,22 @@ export function ensureActiveOrcaProfile(
 
   const profileDirectory = getOrcaProfileDirectory(activeProfile.id, userDataPath)
   mkdirSync(profileDirectory, { recursive: true })
-  if (activeProfile.id === DEFAULT_LOCAL_ORCA_PROFILE_ID) {
+  const profileDatabaseFile = getOrcaProfileStateDatabaseFile(activeProfile.id, userDataPath)
+  const profileDataFile = getOrcaProfileDataFile(activeProfile.id, userDataPath)
+  let hasRetainedProfileStateExport = false
+  try {
+    hasRetainedProfileStateExport =
+      profileStateJsonExportPaths(profileDataFile).length > 0 ||
+      profileStateDatabaseBackups(profileDatabaseFile).length > 0
+  } catch {
+    // An unreadable profile directory must never trigger a fallback copy of legacy state.
+    hasRetainedProfileStateExport = true
+  }
+  if (
+    activeProfile.id === DEFAULT_LOCAL_ORCA_PROFILE_ID &&
+    !hasOrcaProfileStateDatabase(activeProfile.id, userDataPath) &&
+    !hasRetainedProfileStateExport
+  ) {
     copyLegacyStateToProfile(userDataPath, activeProfile.id)
   }
 
@@ -241,7 +221,8 @@ export function ensureActiveOrcaProfile(
   return {
     index,
     profile: activeProfile,
-    dataFile: getOrcaProfileDataFile(activeProfile.id, userDataPath),
+    dataFile: profileDataFile,
+    stateDatabaseFile: profileDatabaseFile,
     profileDirectory
   }
 }
diff --git a/src/main/orca-profiles/profile-legacy-state-import.ts b/src/main/orca-profiles/profile-legacy-state-import.ts
new file mode 100644
index 00000000000..03500f74e26
--- /dev/null
+++ b/src/main/orca-profiles/profile-legacy-state-import.ts
@@ -0,0 +1,35 @@
+import { copyFileSync, existsSync, mkdirSync, renameSync } from 'node:fs'
+import { dirname } from 'node:path'
+import {
+  getOrcaProfileBrowserSessionMetaFile,
+  getOrcaProfileDataFile,
+  LEGACY_BACKUP_COUNT,
+  legacyBackupPath,
+  legacyBrowserSessionMetaPath,
+  legacyDataFilePath,
+  profileBackupPath
+} from './profile-storage-paths'
+
+function copyIfPresent(source: string, target: string): void {
+  if (!existsSync(source) || existsSync(target)) {
+    return
+  }
+  mkdirSync(dirname(target), { recursive: true })
+  // Why: tmp+rename so a crash mid-copy cannot leave a truncated target that
+  // the exists() guard above would then treat as a completed migration.
+  const tmpTarget = `${target}.tmp`
+  copyFileSync(source, tmpTarget)
+  renameSync(tmpTarget, target)
+}
+
+export function copyLegacyStateToProfile(userDataPath: string, profileId: string): void {
+  const profileDataFile = getOrcaProfileDataFile(profileId, userDataPath)
+  copyIfPresent(legacyDataFilePath(userDataPath), profileDataFile)
+  copyIfPresent(
+    legacyBrowserSessionMetaPath(userDataPath),
+    getOrcaProfileBrowserSessionMetaFile(profileId, userDataPath)
+  )
+  for (let i = 0; i < LEGACY_BACKUP_COUNT; i++) {
+    copyIfPresent(legacyBackupPath(userDataPath, i), profileBackupPath(profileDataFile, i))
+  }
+}
diff --git a/src/main/orca-profiles/profile-persistence-deadline.test.ts b/src/main/orca-profiles/profile-persistence-deadline.test.ts
new file mode 100644
index 00000000000..87e0507c507
--- /dev/null
+++ b/src/main/orca-profiles/profile-persistence-deadline.test.ts
@@ -0,0 +1,37 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { ProfileStateMaintenance } from '../persistence/loading-store/profile-state-authority'
+import type { ProfileStateMaintenanceOptions } from '../persistence/loading-store/profile-state-maintenance'
+import { flushActiveProfileBeforeFileMutation } from './profile-persistence-deadline'
+
+afterEach(() => vi.useRealTimers())
+
+describe('profile persistence deadline', () => {
+  it('allows the writer request deadline to finish before imposing maintenance cancellation', async () => {
+    vi.useFakeTimers()
+    const result = Promise.withResolvers<ProfileStateMaintenance>()
+    const beginProfileMaintenance = vi.fn(
+      (_options?: ProfileStateMaintenanceOptions) => result.promise
+    )
+    const pending = flushActiveProfileBeforeFileMutation({ beginProfileMaintenance })
+    await vi.advanceTimersByTimeAsync(30_000)
+    expect(beginProfileMaintenance.mock.calls[0]?.[0]?.signal?.aborted).not.toBe(true)
+    const handle = { resume: vi.fn(async () => {}) }
+    result.resolve(handle)
+    await expect(pending).resolves.toBe(handle)
+    expect(handle.resume).not.toHaveBeenCalled()
+  })
+
+  it('resumes a clean pause that finishes after the caller times out', async () => {
+    vi.useFakeTimers()
+    const result = Promise.withResolvers<ProfileStateMaintenance>()
+    const beginProfileMaintenance = vi.fn(() => result.promise)
+    const pending = flushActiveProfileBeforeFileMutation({ beginProfileMaintenance })
+    const rejected = expect(pending).rejects.toThrow('orca_profile_persistence_timeout')
+    await vi.advanceTimersByTimeAsync(60_000)
+    await rejected
+    const handle = { resume: vi.fn(async () => {}) }
+    result.resolve(handle)
+    await vi.advanceTimersByTimeAsync(0)
+    expect(handle.resume).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/orca-profiles/profile-persistence-deadline.ts b/src/main/orca-profiles/profile-persistence-deadline.ts
index 084a53c40fe..73280914e4a 100644
--- a/src/main/orca-profiles/profile-persistence-deadline.ts
+++ b/src/main/orca-profiles/profile-persistence-deadline.ts
@@ -1,8 +1,33 @@
 import type { Store } from '../persistence'
+import type { ProfileStateMaintenance } from '../persistence/loading-store/profile-state-authority'
+import type { ProfileStateMaintenanceOptions } from '../persistence/loading-store/profile-state-maintenance'
 
-const PROFILE_PERSISTENCE_TIMEOUT_MS = 20_000
+const PROFILE_PERSISTENCE_TIMEOUT_MS = 60_000
 
-export async function flushActiveProfileBeforeFileMutation(store: Store): Promise<void> {
+export async function flushActiveProfileBeforeFileMutation(
+  store: Pick<Store, 'beginProfileMaintenance'>,
+  options: Pick<ProfileStateMaintenanceOptions, 'flush'> = {}
+): Promise<ProfileStateMaintenance> {
+  return withinProfilePersistenceDeadline((signal) =>
+    store.beginProfileMaintenance({ ...options, signal }).then(async (handle) => {
+      if (signal.aborted && options.flush !== false) {
+        await handle.resume()
+        throw new Error('orca_profile_persistence_timeout')
+      }
+      return handle
+    })
+  )
+}
+
+export function flushActiveProfileBeforeRelaunch(
+  store: Pick<Store, 'flushPendingOrThrowAsync'>
+): Promise<void> {
+  return withinProfilePersistenceDeadline((signal) => store.flushPendingOrThrowAsync({ signal }))
+}
+
+async function withinProfilePersistenceDeadline<T>(
+  operation: (signal: AbortSignal) => Promise<T>
+): Promise<T> {
   const controller = new AbortController()
   let timeout: ReturnType<typeof setTimeout> | null = null
   const deadline = new Promise<never>((_resolve, reject) => {
@@ -12,7 +37,7 @@ export async function flushActiveProfileBeforeFileMutation(store: Store): Promis
     }, PROFILE_PERSISTENCE_TIMEOUT_MS)
   })
   try {
-    await Promise.race([store.flushPendingOrThrowAsync({ signal: controller.signal }), deadline])
+    return await Promise.race([operation(controller.signal), deadline])
   } finally {
     if (timeout) {
       clearTimeout(timeout)
diff --git a/src/main/orca-profiles/profile-project-domain-changes.ts b/src/main/orca-profiles/profile-project-domain-changes.ts
new file mode 100644
index 00000000000..30f5aef805e
--- /dev/null
+++ b/src/main/orca-profiles/profile-project-domain-changes.ts
@@ -0,0 +1,144 @@
+import { hashProfileStateJson } from '../persistence/profile-state/profile-state-documents'
+import {
+  isRecord,
+  type ProfileStateParsedDocument
+} from '../persistence/profile-state/profile-state-document-validation'
+import { prepareProfileStateDomainMutation } from '../persistence/profile-state/profile-state-domain-write-validation'
+import type { ProfileStateDomainMutation } from '../persistence/profile-state/profile-state-domain-writes'
+import type { PersistedState } from '../../shared/persisted-state-types'
+
+export type ProfileProjectDomainDigest = { domain: string; hash: string }
+
+export type ProfileProjectDomainChanges = {
+  expectedRevision: number
+  before: ProfileProjectDomainDigest[]
+  afterHash: string
+  replacements: { domain: string; payload: string | null }[]
+}
+
+export function profileProjectDomainFingerprint(
+  domains: readonly ProfileProjectDomainDigest[]
+): string {
+  const pairs = domains.map(({ domain, hash }) => [domain, hash])
+  pairs.sort(([left = ''], [right = '']) => (left < right ? -1 : left > right ? 1 : 0))
+  return hashProfileStateJson(`orca-profile-move-domains-v2:${JSON.stringify(pairs)}`)
+}
+
+export function profileProjectDomainDigests(
+  documents: readonly ProfileStateParsedDocument[]
+): ProfileProjectDomainDigest[] {
+  return documents.map(({ domain, contentHash }) => ({ domain, hash: contentHash }))
+}
+
+export function prepareProfileProjectDomainChanges(
+  revision: number,
+  documents: readonly ProfileStateParsedDocument[],
+  state: PersistedState
+): ProfileProjectDomainChanges {
+  const originals = new Map(documents.map((document) => [document.domain, document]))
+  const replacements: ProfileProjectDomainChanges['replacements'] = []
+  for (const [domain, value] of Object.entries(state)) {
+    const original = originals.get(domain)
+    // Transfer projections retain unchanged values; do not serialize unrelated history/output.
+    if (original && Object.is(original.value, value)) {
+      continue
+    }
+    const payload = JSON.stringify(value) ?? null
+    if (
+      payload === null
+        ? original !== undefined
+        : hashProfileStateJson(payload) !== original?.contentHash
+    ) {
+      replacements.push({ domain, payload })
+    }
+  }
+  for (const domain of originals.keys()) {
+    if (!Object.hasOwn(state, domain)) {
+      replacements.push({ domain, payload: null })
+    }
+  }
+  const before = profileProjectDomainDigests(documents)
+  return {
+    expectedRevision: revision,
+    before,
+    afterHash: profileProjectDomainFingerprint(applyDomainDigests(before, replacements)),
+    replacements
+  }
+}
+
+function applyDomainDigests(
+  before: readonly ProfileProjectDomainDigest[],
+  replacements: readonly ProfileStateDomainMutation[]
+): ProfileProjectDomainDigest[] {
+  const digests = new Map(before.map(({ domain, hash }) => [domain, hash]))
+  for (const { domain, payload } of replacements) {
+    if (payload === null) {
+      digests.delete(domain)
+    } else {
+      digests.set(domain, hashProfileStateJson(payload))
+    }
+  }
+  return [...digests].map(([domain, hash]) => ({ domain, hash }))
+}
+
+export function validateProfileProjectDomainChanges(
+  value: unknown
+): asserts value is ProfileProjectDomainChanges {
+  if (
+    !isRecord(value) ||
+    typeof value.expectedRevision !== 'number' ||
+    !Number.isSafeInteger(value.expectedRevision) ||
+    value.expectedRevision < 0 ||
+    !Number.isSafeInteger(value.expectedRevision + 1) ||
+    !Array.isArray(value.before) ||
+    !Array.isArray(value.replacements) ||
+    value.replacements.length === 0 ||
+    !isHash(value.afterHash)
+  ) {
+    throw new Error('Profile move domain changes are malformed')
+  }
+  const before: ProfileProjectDomainDigest[] = []
+  const domains = new Set<string>()
+  for (const digest of value.before) {
+    if (
+      !isRecord(digest) ||
+      typeof digest.domain !== 'string' ||
+      !isHash(digest.hash) ||
+      domains.has(digest.domain)
+    ) {
+      throw new Error('Profile move domain manifest is malformed')
+    }
+    domains.add(digest.domain)
+    before.push({ domain: digest.domain, hash: digest.hash })
+  }
+  const replacements: ProfileStateDomainMutation[] = []
+  domains.clear()
+  for (const replacement of value.replacements) {
+    if (
+      !isRecord(replacement) ||
+      !isDomain(replacement.domain) ||
+      (replacement.payload !== null && typeof replacement.payload !== 'string') ||
+      domains.has(replacement.domain)
+    ) {
+      throw new Error('Profile move domain replacement is malformed')
+    }
+    domains.add(replacement.domain)
+    const mutation = { domain: replacement.domain, payload: replacement.payload }
+    prepareProfileStateDomainMutation(mutation)
+    replacements.push(mutation)
+  }
+  if (
+    profileProjectDomainFingerprint(applyDomainDigests(before, replacements)) !== value.afterHash ||
+    profileProjectDomainFingerprint(before) === value.afterHash
+  ) {
+    throw new Error('Profile move domain changes do not match their fingerprint')
+  }
+}
+
+function isDomain(value: unknown): value is string {
+  return typeof value === 'string' && value.length > 0
+}
+
+function isHash(value: unknown): value is string {
+  return typeof value === 'string' && /^[a-f0-9]{64}$/.test(value)
+}
diff --git a/src/main/orca-profiles/profile-project-domain-move-intent.ts b/src/main/orca-profiles/profile-project-domain-move-intent.ts
new file mode 100644
index 00000000000..3441b2d8f3a
--- /dev/null
+++ b/src/main/orca-profiles/profile-project-domain-move-intent.ts
@@ -0,0 +1,58 @@
+import { randomUUID } from 'node:crypto'
+import type { ProfileProjectDomainMoveIntent } from './profile-project-move-record'
+export type { ProfileProjectDomainMoveIntent } from './profile-project-move-record'
+import {
+  profileProjectDomainDigests,
+  profileProjectDomainFingerprint,
+  type ProfileProjectDomainChanges
+} from './profile-project-domain-changes'
+import {
+  readProfileProjectTransferState,
+  type ReadProfileProjectTransferResult
+} from './profile-project-domain-state'
+
+export function createProfileProjectDomainMoveIntent(args: {
+  sourceProfileId: string
+  targetProfileId: string
+  source: ProfileProjectDomainChanges
+  target: ProfileProjectDomainChanges
+}): ProfileProjectDomainMoveIntent {
+  return { version: 2, id: randomUUID(), ...args }
+}
+
+export function readProfileProjectDomainMoveState(
+  userDataPath: string,
+  intent: ProfileProjectDomainMoveIntent
+): { sourceBefore: boolean; sourceAfter: boolean; targetBefore: boolean; targetAfter: boolean } {
+  const source = readProfileProjectTransferState(intent.sourceProfileId, userDataPath)
+  const target = readProfileProjectTransferState(intent.targetProfileId, userDataPath)
+  if (source.documents === undefined || target.documents === undefined) {
+    throw new Error(`Profile move ${intent.id} no longer has two SQLite participants`)
+  }
+  return {
+    sourceBefore: matches(
+      source,
+      intent.source.expectedRevision,
+      profileProjectDomainFingerprint(intent.source.before)
+    ),
+    targetBefore: matches(
+      target,
+      intent.target.expectedRevision,
+      profileProjectDomainFingerprint(intent.target.before)
+    ),
+    sourceAfter: matches(source, intent.source.expectedRevision + 1, intent.source.afterHash),
+    targetAfter: matches(target, intent.target.expectedRevision + 1, intent.target.afterHash)
+  }
+}
+
+function matches(
+  snapshot: ReadProfileProjectTransferResult,
+  revision: number,
+  hash: string
+): boolean {
+  return (
+    snapshot.revision === revision &&
+    snapshot.documents !== undefined &&
+    profileProjectDomainFingerprint(profileProjectDomainDigests(snapshot.documents)) === hash
+  )
+}
diff --git a/src/main/orca-profiles/profile-project-domain-state.ts b/src/main/orca-profiles/profile-project-domain-state.ts
new file mode 100644
index 00000000000..e788b4b0def
--- /dev/null
+++ b/src/main/orca-profiles/profile-project-domain-state.ts
@@ -0,0 +1,84 @@
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from '../persistence/profile-state/profile-state-database'
+import {
+  readProfileStateDocuments,
+  readProfileStateRevision
+} from '../persistence/profile-state/profile-state-documents'
+import type { ProfileStateParsedDocument } from '../persistence/profile-state/profile-state-document-validation'
+import { writeProfileStateDomains } from '../persistence/profile-state/profile-state-domain-writes'
+import { withProfileStateReadSnapshot } from '../persistence/profile-state/profile-state-read-snapshot'
+import { getOrcaProfileStateDatabaseFile } from './profile-storage-paths'
+import {
+  normalizeProfileProjectState,
+  profileStateStorage,
+  readProfileStateWithRevision,
+  type ReadProfileStateResult
+} from './profile-project-state-file'
+import {
+  validateProfileProjectDomainChanges,
+  type ProfileProjectDomainChanges
+} from './profile-project-domain-changes'
+
+export type ReadProfileProjectTransferResult = ReadProfileStateResult & {
+  documents?: readonly ProfileStateParsedDocument[]
+}
+
+/** Keep checked domain values for transfer without joining and reparsing the complete profile. */
+export function readProfileProjectTransferState(
+  profileId: string,
+  userDataPath: string
+): ReadProfileProjectTransferResult {
+  if (profileStateStorage(profileId, userDataPath) === 'json') {
+    return readProfileStateWithRevision(profileId, userDataPath)
+  }
+  const opened = openProfileStateDatabaseReadOnly(
+    getOrcaProfileStateDatabaseFile(profileId, userDataPath),
+    profileId
+  )
+  try {
+    return withProfileStateReadSnapshot(opened.db, () => {
+      const revision = readProfileStateRevision(opened.db)
+      const documents = readProfileStateDocuments(opened.db, {
+        profileRevision: revision,
+        representation: 'parsed'
+      })
+      return {
+        revision,
+        documents,
+        state: normalizeProfileProjectState(
+          Object.fromEntries(documents.map(({ domain, value }) => [domain, value]))
+        )
+      }
+    })
+  } finally {
+    opened.db.close()
+  }
+}
+
+export function writeProfileProjectDomainChanges(
+  profileId: string,
+  userDataPath: string,
+  changes: ProfileProjectDomainChanges
+): void {
+  validateProfileProjectDomainChanges(changes)
+  if (profileStateStorage(profileId, userDataPath) !== 'sqlite') {
+    throw new Error('Profile domain transfer requires an established SQLite participant')
+  }
+  const opened = openProfileStateDatabase(
+    getOrcaProfileStateDatabaseFile(profileId, userDataPath),
+    profileId
+  )
+  try {
+    const result = writeProfileStateDomains(opened.db, {
+      expectedRevision: changes.expectedRevision,
+      replacements: changes.replacements.map(({ domain, payload }) => ({ domain, payload }))
+    })
+    if (!result.changed || result.revision !== changes.expectedRevision + 1) {
+      throw new Error('Profile domain transfer did not commit its expected revision')
+    }
+  } finally {
+    opened.db.close()
+  }
+}
diff --git a/src/main/orca-profiles/profile-project-domain-transfer.test.ts b/src/main/orca-profiles/profile-project-domain-transfer.test.ts
new file mode 100644
index 00000000000..00ceb64455e
--- /dev/null
+++ b/src/main/orca-profiles/profile-project-domain-transfer.test.ts
@@ -0,0 +1,546 @@
+import { mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
+import { buildSync } from 'esbuild'
+import { runProcess } from '../../shared/child-process/run-process'
+import { getDefaultPersistedState } from '../../shared/constants'
+import { ORCA_PROFILE_INDEX_SCHEMA_VERSION } from '../../shared/orca-profiles'
+import type { Repo } from '../../shared/repo-types'
+import { openProfileStateDatabase } from '../persistence/profile-state/profile-state-database'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateSnapshot
+} from '../persistence/profile-state/profile-state-documents'
+import { writeProfileStateDomain } from '../persistence/profile-state/profile-state-domain-writes'
+import {
+  prepareProfileProjectDomainChanges,
+  profileProjectDomainFingerprint,
+  validateProfileProjectDomainChanges
+} from './profile-project-domain-changes'
+import * as domainState from './profile-project-domain-state'
+import { createProfileProjectDomainMoveIntent } from './profile-project-domain-move-intent'
+import {
+  persistProfileProjectMoveIntent,
+  recoverPendingProfileProjectMoves
+} from './profile-project-move-intent'
+import { normalizeProfileProjectState } from './profile-project-state-file'
+import { removeSourceRepo } from './profile-project-source-removal'
+import {
+  applyPayloadToTarget,
+  createTargetRepo,
+  createTransferPayload
+} from './profile-project-transfer-payload'
+import { transferOrcaProfileProject } from './profile-project-transfer'
+
+let root: string
+let crashRoot: string
+let crashBundle: string
+let crashScript: string
+const repo: Repo = {
+  id: 'repo-1',
+  path: '/project',
+  displayName: 'Project',
+  badgeColor: 'neutral',
+  addedAt: 1,
+  kind: 'git',
+  connectionId: null
+}
+
+function dbPath(id: string): string {
+  return join(root, 'profiles', id, 'profile-state.db')
+}
+
+function withDatabase<T>(
+  id: string,
+  action: (db: ReturnType<typeof openProfileStateDatabase>['db']) => T
+): T {
+  const opened = openProfileStateDatabase(dbPath(id), id)
+  try {
+    return action(opened.db)
+  } finally {
+    opened.db.close()
+  }
+}
+
+function seed(id: string, repos: Repo[] = []): void {
+  mkdirSync(join(root, 'profiles', id), { recursive: true })
+  withDatabase(id, (db) =>
+    importProfileStateJson(
+      db,
+      JSON.stringify({
+        futureOpaque: { z: ['\ud800', null, id], a: 'x'.repeat(100_000) },
+        ['']: { keep: true },
+        ['__proto__']: { inert: true },
+        settings: { opencodeSessionCookie: 'enc:v1:sealed-inactive', unknownSetting: [2, 1] },
+        repos,
+        projects: null,
+        projectHostSetups: null,
+        workspaceSessionsByHostId: null,
+        automationRuns: [],
+        futureNull: null,
+        futureDelete: { remove: true }
+      })
+    )
+  )
+}
+
+function raw(id: string) {
+  return withDatabase(id, (db) => readProfileStateSnapshot(db))
+}
+
+function transfer(mode: 'copy' | 'move' = 'move') {
+  return transferOrcaProfileProject(
+    { sourceProfileId: 'source', targetProfileId: 'target', repoId: repo.id, mode },
+    root
+  )
+}
+
+function frozen<T>(value: T): T {
+  if (value !== null && typeof value === 'object') {
+    for (const nested of Object.values(value)) {
+      frozen(nested)
+    }
+    Object.freeze(value)
+  }
+  return value
+}
+
+function preparedMove() {
+  const source = domainState.readProfileProjectTransferState('source', root)
+  const target = domainState.readProfileProjectTransferState('target', root)
+  if (
+    source.revision === undefined ||
+    target.revision === undefined ||
+    !source.documents ||
+    !target.documents
+  ) {
+    throw new Error('Missing SQL fixture')
+  }
+  const sourceRepo = source.state.repos[0]
+  if (!sourceRepo) {
+    throw new Error('Missing source repo')
+  }
+  const targetRepo = createTargetRepo(sourceRepo, target.state, false)
+  const payload = createTransferPayload({
+    sourceState: source.state,
+    sourceRepo,
+    targetRepo,
+    includeSessions: true
+  })
+  const sourceAfter = removeSourceRepo(source.state, sourceRepo.id)
+  const targetAfter = applyPayloadToTarget(target.state, payload)
+  const intent = createProfileProjectDomainMoveIntent({
+    sourceProfileId: 'source',
+    targetProfileId: 'target',
+    source: prepareProfileProjectDomainChanges(source.revision, source.documents, sourceAfter),
+    target: prepareProfileProjectDomainChanges(target.revision, target.documents, targetAfter)
+  })
+  return { intent, sourceAfter, targetAfter }
+}
+
+beforeAll(() => {
+  crashRoot = mkdtempSync(join(tmpdir(), 'orca-domain-move-crash-api-'))
+  crashBundle = join(crashRoot, 'api.cjs')
+  crashScript = join(crashRoot, 'crash.cjs')
+  buildSync({
+    stdin: {
+      contents:
+        "export { transferOrcaProfileProject } from './src/main/orca-profiles/profile-project-transfer'",
+      loader: 'ts',
+      resolveDir: process.cwd()
+    },
+    outfile: crashBundle,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    packages: 'external'
+  })
+  writeFileSync(
+    crashScript,
+    `
+const fs = require('node:fs')
+const path = require('node:path')
+const [bundle, root, stage] = process.argv.slice(2)
+const barrier = label => {
+  if (label !== stage) return
+  fs.writeSync(1, label + '\\n')
+  process.kill(process.pid, 'SIGKILL')
+  throw new Error('SIGKILL returned')
+}
+const sqlite = require('node:sqlite')
+const exec = sqlite.DatabaseSync.prototype.exec
+const writers = new WeakSet()
+sqlite.DatabaseSync.prototype.exec = function(sql) {
+  const writing = writers.has(this)
+  const participant = writing ? this.prepare("SELECT value FROM profile_state_meta WHERE key = 'profile_id'").get().value : ''
+  if (writing && sql === 'COMMIT') barrier(participant + '-before-commit')
+  const result = exec.call(this, sql)
+  if (sql === 'BEGIN IMMEDIATE') writers.add(this)
+  if (sql === 'COMMIT' || sql === 'ROLLBACK') writers.delete(this)
+  if (writing && sql === 'COMMIT') barrier(participant + '-committed')
+  return result
+}
+let published = false
+let removed = false
+const rename = fs.renameSync
+fs.renameSync = (from, to) => {
+  const intent = path.dirname(to) === path.join(root, 'profile-move-intents') && to.endsWith('.json')
+  if (intent) barrier('intent-before-publish')
+  rename(from, to)
+  if (intent) { published = true; barrier('intent-published') }
+}
+const rm = fs.rmSync
+fs.rmSync = (target, ...rest) => {
+  const intent = path.dirname(target) === path.join(root, 'profile-move-intents') && target.endsWith('.json')
+  if (intent) barrier('cleanup-before-remove')
+  rm(target, ...rest)
+  if (intent) { removed = true; barrier('cleanup-removed') }
+}
+const fsync = fs.fsyncSync
+fs.fsyncSync = fd => {
+  fsync(fd)
+  if (fs.fstatSync(fd).isDirectory()) {
+    if (removed) barrier('cleanup-durable')
+    else if (published) barrier('intent-durable')
+  }
+}
+require(bundle).transferOrcaProfileProject({ sourceProfileId: 'source', targetProfileId: 'target', repoId: 'repo-1', mode: 'move' }, root)
+throw new Error('Crash boundary not reached: ' + stage)
+`
+  )
+})
+
+afterAll(() => rmSync(crashRoot, { recursive: true, force: true }))
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'orca-domain-transfer-'))
+  writeFileSync(
+    join(root, 'orca-profile-index.json'),
+    JSON.stringify({
+      schemaVersion: ORCA_PROFILE_INDEX_SCHEMA_VERSION,
+      activeProfileId: 'source',
+      profiles: ['source', 'target'].map((id) => ({
+        id,
+        name: id,
+        avatar: { kind: 'initials', initials: id[0], color: 'neutral' },
+        kind: 'local',
+        createdAt: 1,
+        updatedAt: 1,
+        lastOpenedAt: 1
+      }))
+    })
+  )
+  seed('source', [repo])
+  seed('target')
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  rmSync(root, { recursive: true, force: true })
+})
+
+describe('profile domain transfers', () => {
+  it.each(['copy', 'move'] as const)(
+    '%s preserves the full normalized projection and unchanged physical rows',
+    (mode) => {
+      const beforeSource = domainState.readProfileProjectTransferState('source', root).state
+      const beforeTarget = domainState.readProfileProjectTransferState('target', root).state
+      const physicalBefore = withDatabase('target', (db) =>
+        db
+          .prepare(
+            "SELECT * FROM profile_state_documents WHERE domain IN ('futureOpaque', '', '__proto__', 'futureNull') ORDER BY domain"
+          )
+          .all()
+      )
+      const result = transfer(mode)
+      expect(result.status).toBe('transferred')
+      const afterTarget = JSON.parse(raw('target').json)
+      const targetRepo: Repo = afterTarget.repos[0]
+      const payload = createTransferPayload({
+        sourceState: beforeSource,
+        sourceRepo: repo,
+        targetRepo,
+        includeSessions: mode === 'move'
+      })
+      expect(afterTarget).toEqual(
+        JSON.parse(JSON.stringify(applyPayloadToTarget(beforeTarget, payload)))
+      )
+      expect(afterTarget.settings.opencodeSessionCookie).toBe('enc:v1:sealed-inactive')
+      expect(
+        withDatabase('target', (db) =>
+          db
+            .prepare(
+              "SELECT * FROM profile_state_documents WHERE domain IN ('futureOpaque', '', '__proto__', 'futureNull') ORDER BY domain"
+            )
+            .all()
+        )
+      ).toEqual(physicalBefore)
+      expect(raw('target').revision).toBe(2)
+      expect(raw('source').revision).toBe(mode === 'move' ? 2 : 1)
+      if (mode === 'move') {
+        expect(JSON.parse(raw('source').json)).toEqual(
+          JSON.parse(JSON.stringify(removeSourceRepo(beforeSource, repo.id)))
+        )
+      }
+    }
+  )
+
+  it.each(['git', 'folder', 'ssh'] as const)(
+    'normalization and %s projections do not mutate raw nested values',
+    (kind) => {
+      const snapshot = domainState.readProfileProjectTransferState('source', root)
+      const input = Object.fromEntries(
+        (snapshot.documents ?? []).map(({ domain, value }) => [domain, value])
+      )
+      input.repos = [
+        {
+          ...repo,
+          kind: kind === 'folder' ? 'folder' : 'git',
+          connectionId: kind === 'ssh' ? 'remote' : null
+        }
+      ]
+      input.projects = [
+        {
+          id: 'old-project',
+          displayName: 'Previous',
+          badgeColor: 'neutral',
+          sourceRepoIds: ['repo-1'],
+          createdAt: 1,
+          updatedAt: 1,
+          localWindowsRuntimePreference: { kind: 'wsl', distro: 'Ubuntu' }
+        }
+      ]
+      input.workspaceSession = {
+        ...getDefaultPersistedState('/test').workspaceSession,
+        tabsByWorktree: {
+          'repo-1::/project/branch': [
+            {
+              id: 'tab',
+              ptyId: 'pty',
+              worktreeId: 'repo-1::/project/branch',
+              title: 'Shell',
+              customTitle: null,
+              color: null,
+              sortOrder: 0,
+              createdAt: 1
+            }
+          ]
+        }
+      }
+      if (kind === 'ssh') {
+        input.workspaceSessionsByHostId = { 'runtime:remote': input.workspaceSession }
+      }
+      const before = JSON.stringify(input)
+      frozen(input)
+      const source = frozen(normalizeProfileProjectState(input))
+      const target = frozen(normalizeProfileProjectState({ repos: [] }))
+      const sourceRepo = source.repos[0]
+      if (!sourceRepo) {
+        throw new Error('Missing source repo')
+      }
+      const payload = frozen(
+        createTransferPayload({
+          sourceState: source,
+          sourceRepo,
+          targetRepo: createTargetRepo(sourceRepo, target, false),
+          includeSessions: true
+        })
+      )
+      expect(() => applyPayloadToTarget(target, payload)).not.toThrow()
+      expect(() => removeSourceRepo(source, sourceRepo.id)).not.toThrow()
+      expect(JSON.stringify(input)).toBe(before)
+      expect(Object.entries(source).find(([domain]) => domain === 'futureOpaque')?.[1]).toBe(
+        input.futureOpaque
+      )
+    }
+  )
+
+  it('journals only changed domains and replays target-first with exact revisions', () => {
+    const { intent, sourceAfter, targetAfter } = preparedMove()
+    expect(intent.source.replacements.map(({ domain }) => domain)).not.toContain('futureOpaque')
+    expect(JSON.stringify(intent).length).toBeLessThan(40_000)
+    persistProfileProjectMoveIntent(root, intent)
+    domainState.writeProfileProjectDomainChanges('target', root, intent.target)
+    expect(recoverPendingProfileProjectMoves(root)).toBe(1)
+    expect(JSON.parse(raw('source').json)).toEqual(JSON.parse(JSON.stringify(sourceAfter)))
+    expect(JSON.parse(raw('target').json)).toEqual(JSON.parse(JSON.stringify(targetAfter)))
+    expect(raw('source').revision).toBe(2)
+    expect(raw('target').revision).toBe(2)
+    expect(recoverPendingProfileProjectMoves(root)).toBe(0)
+  })
+
+  it.each(['source', 'target'] as const)(
+    'refuses an unrelated %s write and retains the move intent',
+    (participant) => {
+      const { intent } = preparedMove()
+      persistProfileProjectMoveIntent(root, intent)
+      domainState.writeProfileProjectDomainChanges('target', root, intent.target)
+      withDatabase(participant, (db) =>
+        writeProfileStateDomain(db, {
+          expectedRevision: participant === 'source' ? 1 : 2,
+          domain: 'unrelated',
+          payload: 'true'
+        })
+      )
+      expect(() => recoverPendingProfileProjectMoves(root)).toThrow(/conflicts|unrecognized/)
+      expect(readdirSync(join(root, 'profile-move-intents'))).toContain(`${intent.id}.json`)
+      expect(JSON.parse(raw('source').json).repos).toHaveLength(1)
+    }
+  )
+
+  it('leaves conflicted moves between inactive profiles for those profiles to recover', () => {
+    const { intent } = preparedMove()
+    persistProfileProjectMoveIntent(root, intent)
+    domainState.writeProfileProjectDomainChanges('target', root, intent.target)
+    withDatabase('source', (db) =>
+      writeProfileStateDomain(db, {
+        expectedRevision: 1,
+        domain: 'unrelated',
+        payload: 'true'
+      })
+    )
+    expect(recoverPendingProfileProjectMoves(root, 'third-profile')).toBe(0)
+    expect(() => recoverPendingProfileProjectMoves(root, 'source')).toThrow(/conflicts/)
+    expect(readdirSync(join(root, 'profile-move-intents'))).toContain(`${intent.id}.json`)
+  })
+
+  it('refuses a malformed move record even when its header names inactive profiles', () => {
+    const { intent } = preparedMove()
+    persistProfileProjectMoveIntent(root, intent)
+    const path = join(root, 'profile-move-intents', `${intent.id}.json`)
+    writeFileSync(path, JSON.stringify({ ...intent, source: null }))
+    expect(() => recoverPendingProfileProjectMoves(root, 'third-profile')).toThrow('malformed')
+    expect(JSON.parse(readFileSync(path, 'utf8')).source).toBeNull()
+  })
+
+  it('refuses independently hashed malformed unrelated data before a copy writes anything', () => {
+    const before = raw('target').json
+    withDatabase('source', (db) =>
+      db
+        .prepare(
+          'UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = ?'
+        )
+        .run('null,"extra":true', hashProfileStateJson('null,"extra":true'), 'futureNull')
+    )
+    expect(() => transfer('copy')).toThrow(/JSON/)
+    expect(raw('target').json).toBe(before)
+  })
+
+  it('distinguishes deletions and null while ignoring extra executable mutation options', () => {
+    const snapshot = domainState.readProfileProjectTransferState('target', root)
+    if (!snapshot.documents || snapshot.revision === undefined) {
+      throw new Error('Missing SQL fixture')
+    }
+    const after = { ...snapshot.state, futureDelete: undefined, futureNull: null, addedNull: null }
+    const changes = prepareProfileProjectDomainChanges(snapshot.revision, snapshot.documents, after)
+    const poisoned = {
+      ...changes,
+      automationRunsAfter: [{}],
+      replacements: changes.replacements.map((replacement) => ({
+        ...replacement,
+        domainVersion: -1
+      }))
+    }
+    domainState.writeProfileProjectDomainChanges('target', root, poisoned)
+    const saved = JSON.parse(raw('target').json)
+    expect(saved.futureNull).toBeNull()
+    expect(saved.addedNull).toBeNull()
+    expect(saved).not.toHaveProperty('futureDelete')
+    expect(saved.automationRuns).toEqual([])
+  })
+
+  it.each(['payload', 'afterHash', 'duplicate', 'revision', 'before'] as const)(
+    'rejects %s tampering before recovery modifies either participant',
+    (kind) => {
+      const { intent } = preparedMove()
+      persistProfileProjectMoveIntent(root, intent)
+      domainState.writeProfileProjectDomainChanges('target', root, intent.target)
+      const before = raw('source').json
+      if (kind === 'payload') {
+        intent.source.replacements[0]!.payload = 'null'
+      }
+      if (kind === 'afterHash') {
+        intent.source.afterHash = 'a'.repeat(64)
+      }
+      if (kind === 'duplicate') {
+        intent.source.replacements.push(intent.source.replacements[0]!)
+      }
+      if (kind === 'revision') {
+        intent.source.expectedRevision = Number.MAX_SAFE_INTEGER
+      }
+      if (kind === 'before') {
+        intent.source.before.push(intent.source.before[0]!)
+      }
+      writeFileSync(join(root, 'profile-move-intents', `${intent.id}.json`), JSON.stringify(intent))
+      expect(() => recoverPendingProfileProjectMoves(root)).toThrow()
+      expect(raw('source').json).toBe(before)
+      expect(readFileSync(join(root, 'profile-move-intents', `${intent.id}.json`), 'utf8')).toBe(
+        JSON.stringify(intent)
+      )
+    }
+  )
+
+  it('canonicalizes only domain ordering in fingerprints', () => {
+    const a = { domain: 'a', hash: hashProfileStateJson('{"x":1,"y":2}') }
+    const b = { domain: 'b', hash: hashProfileStateJson('[2,1]') }
+    expect(profileProjectDomainFingerprint([a, b])).toBe(profileProjectDomainFingerprint([b, a]))
+    expect(profileProjectDomainFingerprint([a, b])).not.toBe(
+      profileProjectDomainFingerprint([{ ...a, hash: hashProfileStateJson('{"y":2,"x":1}') }, b])
+    )
+    const { intent } = preparedMove()
+    expect(() => validateProfileProjectDomainChanges(intent.source)).not.toThrow()
+  })
+
+  const crashStages = [
+    'intent-before-publish',
+    'intent-published',
+    ...(process.platform === 'win32' ? [] : ['intent-durable']),
+    'target-before-commit',
+    'target-committed',
+    'source-before-commit',
+    'source-committed',
+    'cleanup-before-remove',
+    'cleanup-removed',
+    ...(process.platform === 'win32' ? [] : ['cleanup-durable'])
+  ]
+  it.each(crashStages)('recovers exact state after actual SIGKILL at %s', async (stage) => {
+    const sourceBefore = raw('source').json
+    const targetBefore = raw('target').json
+    const { sourceAfter, targetAfter } = preparedMove()
+    const child = await runProcess({
+      program: process.execPath,
+      args: [crashScript, crashBundle, root, stage],
+      env: {
+        ...process.env,
+        ORCA_BACKGROUND_LAUNCH: '1',
+        NODE_PATH: join(process.cwd(), 'node_modules')
+      },
+      timeoutMs: 10_000,
+      maxOutputBytes: 16_384
+    })
+    expect(child.timedOut, child.stderr).toBe(false)
+    expect(child.stdout, child.stderr).toBe(`${stage}\n`)
+    expect(child.code).not.toBe(0)
+    if (process.platform !== 'win32') {
+      expect(child.signal).toBe('SIGKILL')
+    }
+    recoverPendingProfileProjectMoves(root)
+    const targetCommitted = ![
+      'intent-before-publish',
+      'intent-published',
+      'intent-durable',
+      'target-before-commit'
+    ].includes(stage)
+    expect(JSON.parse(raw('source').json)).toEqual(
+      targetCommitted ? JSON.parse(JSON.stringify(sourceAfter)) : JSON.parse(sourceBefore)
+    )
+    expect(JSON.parse(raw('target').json)).toEqual(
+      targetCommitted ? JSON.parse(JSON.stringify(targetAfter)) : JSON.parse(targetBefore)
+    )
+    expect(raw('source').revision).toBe(targetCommitted ? 2 : 1)
+    expect(raw('target').revision).toBe(targetCommitted ? 2 : 1)
+    expect(recoverPendingProfileProjectMoves(root)).toBe(0)
+  })
+})
diff --git a/src/main/orca-profiles/profile-project-move-intent.ts b/src/main/orca-profiles/profile-project-move-intent.ts
new file mode 100644
index 00000000000..51fd796e5ff
--- /dev/null
+++ b/src/main/orca-profiles/profile-project-move-intent.ts
@@ -0,0 +1,124 @@
+import { randomUUID } from 'node:crypto'
+import { mkdirSync, renameSync, rmSync, writeFileSync } from 'node:fs'
+import { bestEffortFsyncDirectorySync, fsyncFileSync } from '../../shared/secure-file'
+import { hashProfileStateJson } from '../persistence/profile-state/profile-state-documents'
+import {
+  readProfileStateWithRevision,
+  writeSerializedProfileState,
+  type ReadProfileStateResult
+} from './profile-project-state-file'
+import { getOrcaProfileMoveIntentDirectory } from './profile-storage-paths'
+import { readProfileProjectDomainMoveState } from './profile-project-domain-move-intent'
+import { writeProfileProjectDomainChanges } from './profile-project-domain-state'
+import {
+  profileProjectMoveIntentPath,
+  readPendingProfileProjectMoveIntents,
+  validateProfileProjectMoveIntent,
+  type ProfileProjectMoveIntent,
+  type ProfileProjectMoveIntentV1
+} from './profile-project-move-record'
+export { profileHasPendingProjectMove } from './profile-project-move-record'
+export type {
+  ProfileProjectMoveIdentity,
+  ProfileProjectMoveIntent
+} from './profile-project-move-record'
+
+export function persistProfileProjectMoveIntent(
+  userDataPath: string,
+  intent: ProfileProjectMoveIntent
+): void {
+  validateProfileProjectMoveIntent(intent)
+  const directory = getOrcaProfileMoveIntentDirectory(userDataPath)
+  mkdirSync(directory, { recursive: true, mode: 0o700 })
+  const path = profileProjectMoveIntentPath(userDataPath, intent.id)
+  const temporaryPath = `${path}.${process.pid}.${randomUUID()}.tmp`
+  writeFileSync(temporaryPath, JSON.stringify(intent), { encoding: 'utf8', mode: 0o600 })
+  fsyncFileSync(temporaryPath)
+  renameSync(temporaryPath, path)
+  bestEffortFsyncDirectorySync(directory)
+}
+
+export function removeProfileProjectMoveIntent(userDataPath: string, intentId: string): void {
+  rmSync(profileProjectMoveIntentPath(userDataPath, intentId), { force: true })
+  bestEffortFsyncDirectorySync(getOrcaProfileMoveIntentDirectory(userDataPath))
+}
+
+export function recoverPendingProfileProjectMoves(
+  userDataPath: string,
+  profileId?: string
+): number {
+  const intents = readPendingProfileProjectMoveIntents(userDataPath).filter(
+    (intent) =>
+      profileId === undefined ||
+      intent.sourceProfileId === profileId ||
+      intent.targetProfileId === profileId
+  )
+  for (const intent of intents) {
+    recoverProfileProjectMoveIntent(userDataPath, intent)
+  }
+  return intents.length
+}
+
+function recoverProfileProjectMoveIntent(
+  userDataPath: string,
+  intent: ProfileProjectMoveIntent
+): void {
+  const { sourceBefore, targetBefore, sourceAfter, targetAfter } =
+    intent.version === 2
+      ? readProfileProjectDomainMoveState(userDataPath, intent)
+      : readLegacyMoveState(userDataPath, intent)
+
+  if (sourceAfter && targetAfter) {
+    removeProfileProjectMoveIntent(userDataPath, intent.id)
+    return
+  }
+  if (sourceBefore && targetBefore) {
+    removeProfileProjectMoveIntent(userDataPath, intent.id)
+    return
+  }
+  if (sourceBefore && targetAfter) {
+    if (intent.version === 2) {
+      writeProfileProjectDomainChanges(intent.sourceProfileId, userDataPath, intent.source)
+    } else {
+      writeSerializedProfileState(intent.sourceProfileId, userDataPath, intent.sourceAfterJson, {
+        expectedRevision: intent.expectedSourceRevision
+      })
+    }
+    removeProfileProjectMoveIntent(userDataPath, intent.id)
+    return
+  }
+  if (sourceBefore && !targetAfter && !targetBefore) {
+    throw new Error(`Profile move ${intent.id} has an unrecognized target state`)
+  }
+  if (targetAfter && !sourceAfter) {
+    // Preserve the journal when an independent write makes replay unsafe.
+    throw new Error(`Profile move ${intent.id} conflicts with a source profile write`)
+  }
+  if (sourceAfter && targetBefore) {
+    throw new Error(`Profile move ${intent.id} has a source commit without its target commit`)
+  }
+  throw new Error(`Profile move ${intent.id} has an unrecognized participant state`)
+}
+
+function readLegacyMoveState(userDataPath: string, intent: ProfileProjectMoveIntentV1) {
+  const source = readProfileStateWithRevision(intent.sourceProfileId, userDataPath)
+  const target = readProfileStateWithRevision(intent.targetProfileId, userDataPath)
+  if (source.revision === undefined || target.revision === undefined) {
+    throw new Error(`Profile move ${intent.id} no longer has two SQLite participants`)
+  }
+
+  return {
+    sourceBefore: matches(source, intent.expectedSourceRevision, intent.sourceBeforeHash),
+    targetBefore: matches(target, intent.expectedTargetRevision, intent.targetBeforeHash),
+    sourceAfter: matches(source, intent.expectedSourceRevision + 1, intent.sourceAfterHash),
+    targetAfter: matches(target, intent.expectedTargetRevision + 1, intent.targetAfterHash)
+  }
+}
+
+function matches(snapshot: ReadProfileStateResult, revision: number, hash: string): boolean {
+  return (
+    snapshot.revision === revision &&
+    snapshot.serialized !== undefined &&
+    hashProfileStateJson(snapshot.serialized) === hash
+  )
+}
diff --git a/src/main/orca-profiles/profile-project-move-record.ts b/src/main/orca-profiles/profile-project-move-record.ts
new file mode 100644
index 00000000000..68391cd117d
--- /dev/null
+++ b/src/main/orca-profiles/profile-project-move-record.ts
@@ -0,0 +1,141 @@
+import { existsSync, readdirSync, readFileSync } from 'node:fs'
+import { basename, join } from 'node:path'
+import { hashProfileStateJson } from '../persistence/profile-state/profile-state-documents'
+import { isRecord } from '../persistence/profile-state/profile-state-document-validation'
+import { getOrcaProfileMoveIntentDirectory } from './profile-storage-paths'
+import {
+  validateProfileProjectDomainChanges,
+  type ProfileProjectDomainChanges
+} from './profile-project-domain-changes'
+
+const PROFILE_MOVE_INTENT_VERSION = 1
+const INTENT_FILE_PATTERN = /^[0-9a-f-]{36}\.json$/
+const PROFILE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/
+
+export type ProfileProjectMoveIdentity = {
+  id: string
+  sourceProfileId: string
+  targetProfileId: string
+}
+
+export type ProfileProjectMoveIntentV1 = ProfileProjectMoveIdentity & {
+  version: typeof PROFILE_MOVE_INTENT_VERSION
+  expectedSourceRevision: number
+  expectedTargetRevision: number
+  sourceBeforeHash: string
+  targetBeforeHash: string
+  sourceAfterHash: string
+  targetAfterHash: string
+  sourceAfterJson: string
+  targetAfterJson: string
+}
+
+export type ProfileProjectDomainMoveIntent = ProfileProjectMoveIdentity & {
+  version: 2
+  source: ProfileProjectDomainChanges
+  target: ProfileProjectDomainChanges
+}
+
+export type ProfileProjectMoveIntent = ProfileProjectMoveIntentV1 | ProfileProjectDomainMoveIntent
+
+export function profileHasPendingProjectMove(profileId: string, userDataPath: string): boolean {
+  try {
+    return readPendingProfileProjectMoveIntents(userDataPath).some(
+      (intent) => intent.sourceProfileId === profileId || intent.targetProfileId === profileId
+    )
+  } catch {
+    // An unreadable intent cannot rule this profile out as a participant.
+    return true
+  }
+}
+
+export function readPendingProfileProjectMoveIntents(
+  userDataPath: string
+): ProfileProjectMoveIntent[] {
+  const directory = getOrcaProfileMoveIntentDirectory(userDataPath)
+  return existsSync(directory)
+    ? readdirSync(directory)
+        .filter((file) => INTENT_FILE_PATTERN.test(file))
+        .map((file) => readProfileProjectMoveIntent(join(directory, file)))
+    : []
+}
+
+export function profileProjectMoveIntentPath(userDataPath: string, intentId: string): string {
+  if (!/^[0-9a-f-]{36}$/.test(intentId)) {
+    throw new Error('Invalid profile move intent ID')
+  }
+  return join(getOrcaProfileMoveIntentDirectory(userDataPath), `${intentId}.json`)
+}
+
+function readProfileProjectMoveIntent(path: string): ProfileProjectMoveIntent {
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(readFileSync(path, 'utf8'))
+  } catch (error) {
+    throw new Error(
+      `Profile move intent is unreadable: ${path}: ${error instanceof Error ? error.message : String(error)}`
+    )
+  }
+  if (!isRecord(parsed)) {
+    throw new Error(`Profile move intent is malformed: ${path}`)
+  }
+  validateProfileProjectMoveIntent(parsed)
+  if (basename(path) !== `${parsed.id}.json`) {
+    throw new Error(`Profile move intent ID does not match its file: ${path}`)
+  }
+  return parsed
+}
+
+export function validateProfileProjectMoveIntent(
+  value: unknown
+): asserts value is ProfileProjectMoveIntent {
+  validateMoveIdentity(value)
+  if (value.version === 2) {
+    validateProfileProjectDomainChanges(value.source)
+    validateProfileProjectDomainChanges(value.target)
+    return
+  }
+  const intent = value
+  const expectedSourceRevision = intent.expectedSourceRevision
+  const expectedTargetRevision = intent.expectedTargetRevision
+  if (
+    intent.version !== PROFILE_MOVE_INTENT_VERSION ||
+    !Number.isSafeInteger(expectedSourceRevision) ||
+    !Number.isSafeInteger(expectedTargetRevision) ||
+    typeof expectedSourceRevision !== 'number' ||
+    typeof expectedTargetRevision !== 'number' ||
+    expectedSourceRevision < 0 ||
+    expectedTargetRevision < 0 ||
+    !isHash(intent.sourceBeforeHash) ||
+    !isHash(intent.targetBeforeHash) ||
+    !isHash(intent.sourceAfterHash) ||
+    !isHash(intent.targetAfterHash) ||
+    typeof intent.sourceAfterJson !== 'string' ||
+    typeof intent.targetAfterJson !== 'string' ||
+    hashProfileStateJson(intent.sourceAfterJson) !== intent.sourceAfterHash ||
+    hashProfileStateJson(intent.targetAfterJson) !== intent.targetAfterHash
+  ) {
+    throw new Error('Profile move intent is malformed')
+  }
+}
+
+function validateMoveIdentity(
+  value: unknown
+): asserts value is ProfileProjectMoveIdentity & Record<string, unknown> {
+  if (
+    !isRecord(value) ||
+    typeof value.id !== 'string' ||
+    !/^[0-9a-f-]{36}$/.test(value.id) ||
+    typeof value.sourceProfileId !== 'string' ||
+    typeof value.targetProfileId !== 'string' ||
+    !PROFILE_ID_PATTERN.test(value.sourceProfileId) ||
+    !PROFILE_ID_PATTERN.test(value.targetProfileId) ||
+    value.sourceProfileId === value.targetProfileId
+  ) {
+    throw new Error('Profile move intent is malformed')
+  }
+}
+
+function isHash(value: unknown): value is string {
+  return typeof value === 'string' && /^[a-f0-9]{64}$/.test(value)
+}
diff --git a/src/main/orca-profiles/profile-project-session-field-disposition.ts b/src/main/orca-profiles/profile-project-session-field-disposition.ts
index 49e4cb9ea98..02a7ce77ca6 100644
--- a/src/main/orca-profiles/profile-project-session-field-disposition.ts
+++ b/src/main/orca-profiles/profile-project-session-field-disposition.ts
@@ -128,9 +128,9 @@ export const WORKSPACE_SESSION_FIELD_DISPOSITION = {
     onRepoRemoval: 'prunedByBespokeRule',
     onTransfer: 'copiedByBespokeRule'
   },
-  // Residue: keyed by tab id and pruned by neither path, like remoteSessionIdsByTabId. Bounded
-  // anyway -- every write and every pull merge runs it through the TTL and cap in
-  // shared/closed-terminal-tab-tombstones.ts, and a resolved host retires its own entries.
+  // Owner-scoped after all, just not by this path: removing a workspace's session rows prunes these
+  // by the record's worktreeId. A project moved to another profile leaves them in the source profile
+  // until its next load, whose deregistered-repo sweep takes them.
   closedTerminalTabTombstonesByTabId: {
     onRepoRemoval: 'notRepoScoped',
     onTransfer: 'notTransferred'
diff --git a/src/main/orca-profiles/profile-project-source-removal.ts b/src/main/orca-profiles/profile-project-source-removal.ts
index 37480164ebc..8bf401762f2 100644
--- a/src/main/orca-profiles/profile-project-source-removal.ts
+++ b/src/main/orca-profiles/profile-project-source-removal.ts
@@ -10,6 +10,7 @@ import {
 } from './profile-project-session-state'
 import { isRepoWorktreeId, removeRepoWorktreeRecord } from './profile-project-worktree-identity'
 
+/** Removes repository-owned sessions, lineage, and UI preferences from the source profile after transfer. */
 export function removeSourceRepo(
   state: TransferProfileState,
   repoId: string
@@ -35,6 +36,10 @@ export function removeSourceRepo(
           ? null
           : state.ui.lastActiveWorktreeId,
       filterRepoIds: state.ui.filterRepoIds?.filter((id) => id !== repoId) ?? [],
+      explorerDisplayRootByWorktree: removeRepoWorktreeRecord(
+        state.ui.explorerDisplayRootByWorktree,
+        repoId
+      ),
       showDotfilesByWorktree: removeRepoWorktreeRecord(state.ui.showDotfilesByWorktree, repoId)
     }
   }
diff --git a/src/main/orca-profiles/profile-project-state-file.ts b/src/main/orca-profiles/profile-project-state-file.ts
index d4f291a09e4..87d3cdd36c8 100644
--- a/src/main/orca-profiles/profile-project-state-file.ts
+++ b/src/main/orca-profiles/profile-project-state-file.ts
@@ -1,7 +1,5 @@
-import { randomUUID } from 'node:crypto'
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { dirname } from 'node:path'
 import { getDefaultPersistedState, getDefaultWorkspaceSession } from '../../shared/constants'
 import { projectHostSetupProjectionFromRepos } from '../../shared/project-host-setup-projection'
 import {
@@ -15,29 +13,116 @@ import type { Repo } from '../../shared/repo-types'
 import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
 import type { SparsePreset } from '../../shared/worktree/create-types'
 import type { RetiredNameRegistry } from '../../shared/worktree/retired-name-registry'
-import { getOrcaProfileDataFile } from './profile-index-store'
+import { getOrcaProfileDataFile, getOrcaProfileStateDatabaseFile } from './profile-index-store'
+import {
+  importProfileStateJson,
+  profileStateJsonMatchesAcceptance,
+  readProfileStateRevision,
+  readProfileStateSnapshot
+} from '../persistence/profile-state/profile-state-documents'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from '../persistence/profile-state/profile-state-database'
+import { parseProfileStateRoot } from '../persistence/profile-state/profile-state-document-validation'
+import { assertProfileStateCanInitialize } from '../persistence/profile-state/profile-state-recovery-required'
+import { hasProfileStateDatabaseFiles } from '../persistence/profile-state/profile-state-storage-classification'
 
 export type TransferProfileState = PersistedState
 
-function isRecord<T>(value: unknown): value is Record<string, T> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value)
+export type ReadProfileStateResult = {
+  state: TransferProfileState
+  /** SQLite profile revision observed with the state snapshot; absent for legacy JSON. */
+  revision?: number
+  /** Exact compact JSON projection observed with the state snapshot. */
+  serialized?: string
 }
 
-function arrayOrEmpty<T>(value: unknown): T[] {
-  return Array.isArray(value) ? value : []
-}
+/** A profile must have one unambiguous transfer source. */
+export class AmbiguousProfileStateStorageError extends Error {
+  readonly code = 'ambiguous_profile_state_storage' as const
 
-function recordOrEmpty<T>(value: unknown): Record<string, T> {
-  return isRecord<T>(value) ? value : {}
-}
-
-export function readProfileState(profileId: string, userDataPath: string): TransferProfileState {
-  const defaults = getDefaultPersistedState(homedir())
-  const dataFile = getOrcaProfileDataFile(profileId, userDataPath)
-  if (!existsSync(dataFile)) {
-    return structuredClone(defaults)
+  constructor(profileId: string, message?: string) {
+    super(message ?? `Profile ${profileId} has both SQLite and legacy JSON state`)
+    this.name = 'AmbiguousProfileStateStorageError'
   }
-  const parsed: Partial<PersistedState> = JSON.parse(readFileSync(dataFile, 'utf-8'))
+}
+
+export type ProfileStateStorage = 'json' | 'sqlite'
+
+export function profileStateStorage(profileId: string, userDataPath: string): ProfileStateStorage {
+  const dataFile = getOrcaProfileDataFile(profileId, userDataPath)
+  const databaseFile = getOrcaProfileStateDatabaseFile(profileId, userDataPath)
+  const hasJson = existsSync(dataFile)
+  const hasDatabase = hasProfileStateDatabaseFiles(databaseFile)
+  if (hasJson && hasDatabase) {
+    assertAcceptedLegacyJsonMirror(profileId, dataFile, databaseFile)
+    return 'sqlite'
+  }
+  if (!hasDatabase) {
+    assertProfileStateCanInitialize({ dataFile, databaseFile, profileId })
+  }
+  return hasDatabase ? 'sqlite' : 'json'
+}
+
+/**
+ * A migrated profile may retain its JSON export during the rollback window.
+ * Select SQLite only when its acceptance marker still names the exact export;
+ * any edit, missing marker, or corrupt database remains fail-closed.
+ */
+function assertAcceptedLegacyJsonMirror(
+  profileId: string,
+  dataFile: string,
+  databaseFile: string
+): void {
+  const rawJson = readFileSync(dataFile, 'utf-8')
+  const opened = openProfileStateDatabaseReadOnly(databaseFile, profileId)
+  try {
+    if (!profileStateJsonMatchesAcceptance(opened.db, rawJson)) {
+      throw new AmbiguousProfileStateStorageError(profileId)
+    }
+  } finally {
+    opened.db.close()
+  }
+}
+
+/** Read one profile state and retain the SQLite revision that fenced that snapshot. */
+export function readProfileStateWithRevision(
+  profileId: string,
+  userDataPath: string
+): ReadProfileStateResult {
+  const storage = profileStateStorage(profileId, userDataPath)
+  if (storage === 'json') {
+    const dataFile = getOrcaProfileDataFile(profileId, userDataPath)
+    const serialized = existsSync(dataFile) ? readFileSync(dataFile, 'utf-8') : undefined
+    return { state: parseProfileState(serialized), ...(serialized ? { serialized } : {}) }
+  }
+
+  const databaseFile = getOrcaProfileStateDatabaseFile(profileId, userDataPath)
+  const opened = openProfileStateDatabaseReadOnly(databaseFile, profileId)
+  try {
+    const snapshot = readProfileStateSnapshot(opened.db)
+    return {
+      state: parseProfileState(snapshot.json),
+      revision: snapshot.revision,
+      serialized: snapshot.json
+    }
+  } finally {
+    opened.db.close()
+  }
+}
+
+function parseProfileState(rawJson: string | undefined): TransferProfileState {
+  if (rawJson === undefined) {
+    return structuredClone(getDefaultPersistedState(homedir()))
+  }
+  return normalizeProfileProjectState(parseProfileStateRoot(rawJson))
+}
+
+export function normalizeProfileProjectState(
+  parsed: Partial<PersistedState>
+): TransferProfileState {
+  const defaults = getDefaultPersistedState(homedir())
   return rebuildRepoBackedProjectState({
     ...defaults,
     ...parsed,
@@ -91,16 +176,50 @@ export function readProfileState(profileId: string, userDataPath: string): Trans
   })
 }
 
+function isRecord<T>(value: unknown): value is Record<string, T> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function arrayOrEmpty<T>(value: unknown): T[] {
+  return Array.isArray(value) ? value : []
+}
+
+function recordOrEmpty<T>(value: unknown): Record<string, T> {
+  return isRecord<T>(value) ? value : {}
+}
+
+export function readProfileState(profileId: string, userDataPath: string): TransferProfileState {
+  return readProfileStateWithRevision(profileId, userDataPath).state
+}
+
 export function writeProfileState(
   profileId: string,
   userDataPath: string,
-  state: TransferProfileState
+  state: TransferProfileState,
+  options: { expectedRevision?: number } = {}
 ): void {
-  const dataFile = getOrcaProfileDataFile(profileId, userDataPath)
-  mkdirSync(dirname(dataFile), { recursive: true })
-  const tmpPath = `${dataFile}.${process.pid}.${randomUUID()}.tmp`
-  writeFileSync(tmpPath, JSON.stringify(state, null, 2), 'utf-8')
-  renameSync(tmpPath, dataFile)
+  writeSerializedProfileState(profileId, userDataPath, JSON.stringify(state), options)
+}
+
+/** Write an already validated JSON projection while preserving its exact bytes in SQLite. */
+export function writeSerializedProfileState(
+  profileId: string,
+  userDataPath: string,
+  serialized: string,
+  options: { expectedRevision?: number } = {}
+): void {
+  if (profileStateStorage(profileId, userDataPath) !== 'sqlite') {
+    throw new Error('Profile transfer write requires an established SQLite participant')
+  }
+  const databaseFile = getOrcaProfileStateDatabaseFile(profileId, userDataPath)
+  const opened = openProfileStateDatabase(databaseFile, profileId)
+  try {
+    importProfileStateJson(opened.db, serialized, {
+      expectedRevision: options.expectedRevision ?? readProfileStateRevision(opened.db)
+    })
+  } finally {
+    opened.db.close()
+  }
 }
 
 function isRepoBackedProjectHostSetup(
diff --git a/src/main/orca-profiles/profile-project-transfer-migration.test.ts b/src/main/orca-profiles/profile-project-transfer-migration.test.ts
new file mode 100644
index 00000000000..46bef280333
--- /dev/null
+++ b/src/main/orca-profiles/profile-project-transfer-migration.test.ts
@@ -0,0 +1,366 @@
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { getDefaultPersistedState } from '../../shared/constants'
+import { ORCA_PROFILE_INDEX_SCHEMA_VERSION } from '../../shared/orca-profiles'
+import type { Repo } from '../../shared/repo-types'
+import * as profileStateDocuments from '../persistence/profile-state/profile-state-documents'
+import { openProfileStateDatabase } from '../persistence/profile-state/profile-state-database'
+import { ProfileStateSqliteAuthority } from '../persistence/profile-state/profile-state-sqlite-authority'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath
+} from '../persistence/profile-state/profile-state-backup-path'
+import { transferOrcaProfileProject } from './profile-project-transfer'
+import {
+  readProfileStateWithRevision,
+  writeSerializedProfileState
+} from './profile-project-state-file'
+import { recoverPendingProfileProjectMoves } from './profile-project-move-intent'
+import * as profileProjectDomainState from './profile-project-domain-state'
+
+vi.mock('../persistence/loading-store/store', () => {
+  throw new Error('Profile transfers must not load inactive Stores')
+})
+
+const repo: Repo = {
+  id: 'repo-1',
+  path: '/projects/folder',
+  displayName: 'Folder',
+  badgeColor: 'neutral',
+  addedAt: 1,
+  kind: 'folder',
+  connectionId: null
+}
+let directory: string
+
+function paths(profileId: string): { dataFile: string; databaseFile: string } {
+  return {
+    dataFile: join(directory, 'profiles', profileId, 'orca-data.json'),
+    databaseFile: join(directory, 'profiles', profileId, 'profile-state.db')
+  }
+}
+
+function writeState(profileId: string, sqlite: boolean, repos: Repo[] = []): string {
+  const defaults = getDefaultPersistedState('/home/test')
+  const source = JSON.stringify(
+    {
+      ...defaults,
+      repos,
+      futureDomain: { profileId },
+      settings: { ...defaults.settings, opencodeSessionCookie: 'enc:v1:sealed-inactive-secret' }
+    },
+    null,
+    2
+  )
+  const location = paths(profileId)
+  mkdirSync(join(location.dataFile, '..'), { recursive: true })
+  if (sqlite) {
+    const opened = openProfileStateDatabase(location.databaseFile, profileId)
+    try {
+      profileStateDocuments.importProfileStateJson(opened.db, source)
+    } finally {
+      opened.db.close()
+    }
+  } else {
+    writeFileSync(location.dataFile, source)
+  }
+  return source
+}
+
+function transfer(mode: 'copy' | 'move' = 'move') {
+  return transferOrcaProfileProject(
+    {
+      sourceProfileId: 'source',
+      targetProfileId: 'target',
+      repoId: repo.id,
+      mode
+    },
+    directory
+  )
+}
+
+beforeEach(() => {
+  directory = mkdtempSync(join(tmpdir(), 'orca-profile-transfer-migration-'))
+  writeFileSync(
+    join(directory, 'orca-profile-index.json'),
+    JSON.stringify({
+      schemaVersion: ORCA_PROFILE_INDEX_SCHEMA_VERSION,
+      activeProfileId: 'source',
+      profiles: ['source', 'target'].map((id) => ({
+        id,
+        name: id,
+        avatar: { kind: 'initials', initials: id[0], color: 'neutral' },
+        kind: 'local',
+        createdAt: 1,
+        updatedAt: 1,
+        lastOpenedAt: 1
+      }))
+    })
+  )
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  rmSync(directory, { recursive: true, force: true })
+})
+
+describe('profile transfer migration', () => {
+  it.each(['copy', 'move'] as const)(
+    '%s adopts an unopened JSON target without loading Store',
+    (mode) => {
+      writeState('source', true, [repo])
+      const targetJson = writeState('target', false)
+      expect(transfer(mode)).toMatchObject({ status: 'transferred', mode })
+
+      const target = readProfileStateWithRevision('target', directory)
+      expect(target.revision).toBe(2)
+      expect(target.state.repos).toHaveLength(1)
+      expect(target.state.repos[0]).toMatchObject({ kind: 'folder', path: repo.path })
+      expect(target.state.settings.opencodeSessionCookie).toBe('enc:v1:sealed-inactive-secret')
+      expect(JSON.parse(target.serialized ?? '{}').futureDomain).toEqual({ profileId: 'target' })
+      expect(readFileSync(paths('target').dataFile, 'utf8')).toBe(targetJson)
+      expect(existsSync(`${paths('target').dataFile}.sqlite-export.1.json`)).toBe(true)
+      expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(
+        mode === 'move' ? 0 : 1
+      )
+    }
+  )
+
+  it('initializes a target with no saved JSON before its move intent is created', () => {
+    writeState('source', true, [repo])
+    expect(transfer()).toMatchObject({ status: 'transferred' })
+    expect(readProfileStateWithRevision('target', directory).state.repos).toHaveLength(1)
+    expect(existsSync(paths('target').dataFile)).toBe(false)
+    expect(existsSync(paths('target').databaseFile)).toBe(true)
+  })
+
+  it.each(['copy', 'move'] as const)(
+    '%s refuses an apparently empty target that retains a legacy JSON backup',
+    (mode) => {
+      writeState('source', true, [repo])
+      const sourceRevision = readProfileStateWithRevision('source', directory).revision
+      const targetJson = writeState('target', false)
+      const target = paths('target')
+      writeFileSync(`${target.dataFile}.bak.0`, targetJson)
+      rmSync(target.dataFile)
+
+      expect(() => transfer(mode)).toThrow('restore a selected backup')
+      expect(readProfileStateWithRevision('source', directory)).toMatchObject({
+        revision: sourceRevision,
+        state: { repos: [repo] }
+      })
+      expect(existsSync(target.dataFile)).toBe(false)
+      expect(existsSync(target.databaseFile)).toBe(false)
+      expect(readFileSync(`${target.dataFile}.bak.0`, 'utf8')).toBe(targetJson)
+    }
+  )
+
+  it.each(['[]', '7', '"invalid"', 'true'])(
+    'refuses a non-object JSON target (%s) without replacing its contents',
+    (raw) => {
+      writeState('source', false, [repo])
+      writeState('target', false)
+      const target = paths('target')
+      writeFileSync(target.dataFile, raw)
+
+      expect(() => transfer()).toThrow('Profile state JSON root must be an object')
+      expect(readFileSync(target.dataFile, 'utf8')).toBe(raw)
+      expect(existsSync(target.databaseFile)).toBe(false)
+      expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(1)
+    }
+  )
+
+  it('migrates a JSON source before moving into SQLite and retains its exact rollback bytes', () => {
+    const sourceJson = writeState('source', false, [repo])
+    writeState('target', true)
+    expect(transfer()).toMatchObject({ status: 'transferred' })
+    expect(readProfileStateWithRevision('source', directory)).toMatchObject({
+      revision: 2,
+      state: { repos: [] }
+    })
+    expect(readProfileStateWithRevision('target', directory).state.repos).toHaveLength(1)
+    expect(readFileSync(paths('source').dataFile, 'utf8')).toBe(sourceJson)
+  })
+
+  it('copies from JSON into SQLite without migrating or changing the source', () => {
+    const sourceJson = writeState('source', false, [repo])
+    writeState('target', true)
+    expect(transfer('copy')).toMatchObject({ status: 'transferred' })
+    expect(readFileSync(paths('source').dataFile, 'utf8')).toBe(sourceJson)
+    expect(existsSync(paths('source').databaseFile)).toBe(false)
+    expect(readProfileStateWithRevision('target', directory).state.repos).toHaveLength(1)
+  })
+
+  it.each(['copy', 'move'] as const)(
+    '%s migrates every mutated JSON participant while preserving storage-form values',
+    (mode) => {
+      const sourceJson = writeState('source', false, [repo])
+      const targetJson = writeState('target', false)
+      expect(transfer(mode)).toMatchObject({ status: 'transferred', mode })
+      expect(existsSync(paths('source').databaseFile)).toBe(mode === 'move')
+      expect(existsSync(paths('target').databaseFile)).toBe(true)
+      expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(
+        mode === 'move' ? 0 : 1
+      )
+      expect(readProfileStateWithRevision('target', directory)).toMatchObject({
+        revision: 2,
+        state: { repos: [expect.objectContaining({ path: repo.path })] }
+      })
+      for (const [profileId, rawJson] of [
+        ['source', sourceJson],
+        ['target', targetJson]
+      ]) {
+        expect(readFileSync(paths(profileId).dataFile, 'utf8')).toBe(rawJson)
+        const current = readProfileStateWithRevision(profileId, directory)
+        expect(current.state.settings.opencodeSessionCookie).toBe('enc:v1:sealed-inactive-secret')
+        expect(JSON.parse(current.serialized ?? '{}').futureDomain).toEqual({ profileId })
+      }
+    }
+  )
+
+  it.each(['copy', 'move'] as const)(
+    '%s rejects JSON-only mutation without SQLite and preserves both legacy sources',
+    (mode) => {
+      const sourceJson = writeState('source', false, [repo])
+      const targetJson = writeState('target', false)
+      const getBuiltin = process.getBuiltinModule
+      vi.spyOn(process, 'getBuiltinModule').mockImplementation((name) =>
+        name === 'node:sqlite' ? undefined : getBuiltin(name)
+      )
+      expect(() => transfer(mode)).toThrow('Unable to open profile state database')
+      expect(existsSync(paths('source').databaseFile)).toBe(false)
+      expect(existsSync(paths('target').databaseFile)).toBe(false)
+      expect(readFileSync(paths('source').dataFile, 'utf8')).toBe(sourceJson)
+      expect(readFileSync(paths('target').dataFile, 'utf8')).toBe(targetJson)
+      expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(1)
+    }
+  )
+
+  it('refuses a legacy JSON write outside participant migration', () => {
+    const sourceJson = writeState('source', false, [repo])
+    expect(() => writeSerializedProfileState('source', directory, '{}')).toThrow(
+      'established SQLite participant'
+    )
+    expect(readFileSync(paths('source').dataFile, 'utf8')).toBe(sourceJson)
+    expect(() => writeSerializedProfileState('target', directory, '{}')).toThrow(
+      'established SQLite participant'
+    )
+    expect(existsSync(paths('target').dataFile)).toBe(false)
+    expect(existsSync(paths('target').databaseFile)).toBe(false)
+  })
+
+  it('refuses mixed storage on a runtime without SQLite before migrating or editing JSON', () => {
+    const sourceJson = writeState('source', false, [repo])
+    writeState('target', true)
+    const getBuiltin = process.getBuiltinModule
+    vi.spyOn(process, 'getBuiltinModule').mockImplementation((name) =>
+      name === 'node:sqlite' ? undefined : getBuiltin(name)
+    )
+    expect(() => transfer()).toThrow('Unable to open profile state database')
+    expect(readFileSync(paths('source').dataFile, 'utf8')).toBe(sourceJson)
+    expect(existsSync(paths('source').databaseFile)).toBe(false)
+  })
+
+  it('refuses to adopt stale target JSON when a retained database backup proves missing authority', () => {
+    writeState('source', true, [repo])
+    writeState('target', false)
+    const backupPath = profileStateDatabaseBackupPath(
+      paths('target').databaseFile,
+      createProfileStateDatabaseBackupId(1)
+    )
+    writeFileSync(backupPath, 'retained recovery evidence')
+    expect(() => transfer()).toThrowError(
+      expect.objectContaining({
+        code: 'profile-state-recovery-required',
+        backupPaths: [backupPath]
+      })
+    )
+    expect(existsSync(paths('target').databaseFile)).toBe(false)
+    expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(1)
+  })
+
+  it('does not migrate a duplicate target', () => {
+    writeState('source', true, [repo])
+    writeState('target', false, [repo])
+    expect(transfer()).toMatchObject({ status: 'duplicate-target' })
+    expect(existsSync(paths('target').databaseFile)).toBe(false)
+  })
+
+  it('leaves both participants untouched when the import fails before publication', () => {
+    writeState('source', true, [repo])
+    const targetJson = writeState('target', false)
+    vi.spyOn(profileStateDocuments, 'importProfileStateJson').mockImplementation(() => {
+      throw new Error('import failure')
+    })
+    expect(() => transfer()).toThrow('import failure')
+    expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(1)
+    expect(readFileSync(paths('target').dataFile, 'utf8')).toBe(targetJson)
+    expect(existsSync(paths('target').databaseFile)).toBe(false)
+    expect(readdirSync(join(paths('target').dataFile, '..'))).toEqual(['orca-data.json'])
+  })
+
+  it('rejects a JSON edit during migration before publishing SQLite', () => {
+    writeState('source', true, [repo])
+    writeState('target', false)
+    const originalImport = profileStateDocuments.importProfileStateJson
+    vi.spyOn(profileStateDocuments, 'importProfileStateJson').mockImplementation((...args) => {
+      const revision = originalImport(...args)
+      writeFileSync(paths('target').dataFile, '{"settings":{"theme":"light"}}')
+      return revision
+    })
+    expect(() => transfer()).toThrow('JSON changed while importing')
+    expect(existsSync(paths('target').databaseFile)).toBe(false)
+    expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(1)
+  })
+
+  it('keeps a valid migrated participant after export failure without moving the project', () => {
+    writeState('source', true, [repo])
+    const targetJson = writeState('target', false)
+    vi.spyOn(ProfileStateSqliteAuthority.prototype, 'writeJsonExport').mockImplementation(() => {
+      throw new Error('export failure')
+    })
+    expect(() => transfer()).toThrow('export failure')
+    expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(1)
+    expect(readProfileStateWithRevision('target', directory).state.repos).toHaveLength(0)
+    expect(readFileSync(paths('target').dataFile, 'utf8')).toBe(targetJson)
+  })
+
+  it.each([
+    [true, false],
+    [false, true],
+    [false, false]
+  ])(
+    'replays an interrupted move with initial SQLite source=%s target=%s',
+    (sourceSqlite, targetSqlite) => {
+      writeState('source', sourceSqlite, [repo])
+      writeState('target', targetSqlite)
+      const originalWrite = profileProjectDomainState.writeProfileProjectDomainChanges
+      const write = vi
+        .spyOn(profileProjectDomainState, 'writeProfileProjectDomainChanges')
+        .mockImplementation((profileId, ...rest) => {
+          if (profileId === 'source') {
+            throw new Error('source commit interrupted')
+          }
+          return originalWrite(profileId, ...rest)
+        })
+      expect(() => transfer()).toThrow('source commit interrupted')
+      expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(1)
+      expect(readProfileStateWithRevision('target', directory).state.repos).toHaveLength(1)
+      write.mockRestore()
+      expect(recoverPendingProfileProjectMoves(directory)).toBe(1)
+      expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(0)
+      expect(readProfileStateWithRevision('target', directory).state.repos).toHaveLength(1)
+      expect(recoverPendingProfileProjectMoves(directory)).toBe(0)
+    }
+  )
+})
diff --git a/src/main/orca-profiles/profile-project-transfer-migration.ts b/src/main/orca-profiles/profile-project-transfer-migration.ts
new file mode 100644
index 00000000000..1b380030c65
--- /dev/null
+++ b/src/main/orca-profiles/profile-project-transfer-migration.ts
@@ -0,0 +1,27 @@
+import { migrateProfileStateToSqlite } from '../persistence/profile-state/profile-state-migration'
+import { getOrcaProfileDataFile, getOrcaProfileStateDatabaseFile } from './profile-storage-paths'
+import type { ReadProfileStateResult } from './profile-project-state-file'
+import {
+  readProfileProjectTransferState,
+  type ReadProfileProjectTransferResult
+} from './profile-project-domain-state'
+
+/** Adopt inactive storage without running Store's active-profile listeners or secret transforms. */
+export function migrateProfileProjectTransferParticipant(
+  profileId: string,
+  userDataPath: string,
+  snapshot: ReadProfileStateResult
+): ReadProfileProjectTransferResult {
+  const migrated = migrateProfileStateToSqlite({
+    dataFile: getOrcaProfileDataFile(profileId, userDataPath),
+    databaseFile: getOrcaProfileStateDatabaseFile(profileId, userDataPath),
+    profileId,
+    expectedLegacyJson: snapshot.serialized,
+    serializedState: snapshot.serialized ?? '{}'
+  })
+  try {
+    return readProfileProjectTransferState(profileId, userDataPath)
+  } finally {
+    migrated.authority.close()
+  }
+}
diff --git a/src/main/orca-profiles/profile-project-transfer-worktree-ids.ts b/src/main/orca-profiles/profile-project-transfer-worktree-ids.ts
index 485861d748d..d8ad76ea675 100644
--- a/src/main/orca-profiles/profile-project-transfer-worktree-ids.ts
+++ b/src/main/orca-profiles/profile-project-transfer-worktree-ids.ts
@@ -7,6 +7,7 @@ import {
   isWorktreeHostIdentity
 } from '../../shared/worktree/host-qualified-identity'
 
+/** Includes worktrees referenced only by sessions or UI preferences so profile transfer cannot strand their state. */
 export function collectTransferWorktreeIds(
   state: TransferProfileState,
   repoId: string
@@ -36,6 +37,7 @@ export function collectTransferWorktreeIds(
   for (const session of Object.values(state.workspaceSessionsByHostId ?? {})) {
     collectSessionWorktreeIds(session, repoId, ids)
   }
+  Object.keys(state.ui?.explorerDisplayRootByWorktree ?? {}).forEach(add)
   Object.keys(state.ui?.showDotfilesByWorktree ?? {}).forEach(add)
   return ids
 }
diff --git a/src/main/orca-profiles/profile-project-transfer.test.ts b/src/main/orca-profiles/profile-project-transfer.test.ts
index fc40cd03bb6..06c3cb74c63 100644
--- a/src/main/orca-profiles/profile-project-transfer.test.ts
+++ b/src/main/orca-profiles/profile-project-transfer.test.ts
@@ -1,4 +1,12 @@
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { beforeEach, afterEach, describe, expect, it, vi } from 'vitest'
@@ -11,6 +19,50 @@ import type { PersistedState } from '../../shared/persisted-state-types'
 import type { Repo } from '../../shared/repo-types'
 import type { WorktreeMeta } from '../../shared/worktree/meta-types'
 import type { SshTarget } from '../../shared/ssh-types'
+import {
+  exportProfileStateJson,
+  hashProfileStateJson,
+  importProfileStateJson
+} from '../persistence/profile-state/profile-state-documents'
+import { openProfileStateDatabase } from '../persistence/profile-state/profile-state-database'
+import {
+  persistProfileProjectMoveIntent,
+  recoverPendingProfileProjectMoves,
+  type ProfileProjectMoveIntent
+} from './profile-project-move-intent'
+import type { ReadProfileStateResult } from './profile-project-state-file'
+
+function createProfileProjectMoveIntent(args: {
+  sourceProfileId: string
+  targetProfileId: string
+  source: ReadProfileStateResult
+  target: ReadProfileStateResult
+  sourceAfterJson: string
+  targetAfterJson: string
+}): Extract<ProfileProjectMoveIntent, { version: 1 }> {
+  if (
+    args.source.revision === undefined ||
+    args.target.revision === undefined ||
+    args.source.serialized === undefined ||
+    args.target.serialized === undefined
+  ) {
+    throw new Error('Legacy move fixture requires two serialized SQLite snapshots')
+  }
+  return {
+    version: 1,
+    id: '11111111-1111-1111-1111-111111111111',
+    sourceProfileId: args.sourceProfileId,
+    targetProfileId: args.targetProfileId,
+    expectedSourceRevision: args.source.revision,
+    expectedTargetRevision: args.target.revision,
+    sourceBeforeHash: hashProfileStateJson(args.source.serialized),
+    targetBeforeHash: hashProfileStateJson(args.target.serialized),
+    sourceAfterHash: hashProfileStateJson(args.sourceAfterJson),
+    targetAfterHash: hashProfileStateJson(args.targetAfterJson),
+    sourceAfterJson: args.sourceAfterJson,
+    targetAfterJson: args.targetAfterJson
+  }
+}
 
 const testState = { dir: '' }
 
@@ -50,13 +102,53 @@ function profileDataPath(profileId: string): string {
   return join(testState.dir, 'profiles', profileId, 'orca-data.json')
 }
 
+function profileDatabasePath(profileId: string): string {
+  return join(testState.dir, 'profiles', profileId, 'profile-state.db')
+}
+
 function writeProfileState(profileId: string, state: PersistedState): void {
   const dataFile = profileDataPath(profileId)
   mkdirSync(join(dataFile, '..'), { recursive: true })
   writeFileSync(dataFile, JSON.stringify(state, null, 2), 'utf-8')
 }
 
+function writeProfileStateDatabase(profileId: string, state: PersistedState): void {
+  const databasePath = profileDatabasePath(profileId)
+  mkdirSync(join(databasePath, '..'), { recursive: true })
+  const opened = openProfileStateDatabase(databasePath, profileId)
+  try {
+    importProfileStateJson(opened.db, JSON.stringify(state))
+  } finally {
+    opened.db.close()
+  }
+}
+
+function writeProfileStateDatabaseWithAcceptedLegacyJson(profileId: string, rawJson: string): void {
+  const databasePath = profileDatabasePath(profileId)
+  mkdirSync(join(databasePath, '..'), { recursive: true })
+  const opened = openProfileStateDatabase(databasePath, profileId)
+  try {
+    importProfileStateJson(opened.db, rawJson, {
+      acceptedLegacyJsonHash: hashProfileStateJson(rawJson)
+    })
+  } finally {
+    opened.db.close()
+  }
+}
+
+function readProfileStateDatabase(profileId: string): PersistedState {
+  const opened = openProfileStateDatabase(profileDatabasePath(profileId), profileId)
+  try {
+    return JSON.parse(exportProfileStateJson(opened.db))
+  } finally {
+    opened.db.close()
+  }
+}
+
 function readProfileState(profileId: string): PersistedState {
+  if (existsSync(profileDatabasePath(profileId))) {
+    return readProfileStateDatabase(profileId)
+  }
   return JSON.parse(readFileSync(profileDataPath(profileId), 'utf-8')) as PersistedState
 }
 
@@ -324,4 +416,353 @@ describe('profile project transfer', () => {
     })
     expect(readProfileState('work').repos.map((repo) => repo.id)).toEqual(['repo-existing'])
   })
+
+  it('transfers between SQLite-backed profiles without creating legacy JSON or touching sidecars', async () => {
+    const sourceState = makeState({ repos: [makeRepo()] })
+    writeProfileStateDatabase('personal', sourceState)
+    writeProfileStateDatabase('work', makeState())
+    const sidecarPath = join(testState.dir, 'profiles', 'work', 'browser-session-meta.json')
+    writeFileSync(sidecarPath, '{"preserve":true}', 'utf-8')
+
+    const { transferOrcaProfileProject } = await loadTransferModule()
+    const result = transferOrcaProfileProject(
+      {
+        sourceProfileId: 'personal',
+        targetProfileId: 'work',
+        repoId: 'repo-1',
+        mode: 'copy'
+      },
+      testState.dir
+    )
+
+    expect(result.status).toBe('transferred')
+    expect(readProfileStateDatabase('work').repos).toEqual([
+      expect.objectContaining({ path: '/workspace/orca' })
+    ])
+    expect(existsSync(profileDataPath('personal'))).toBe(false)
+    expect(existsSync(profileDataPath('work'))).toBe(false)
+    expect(readFileSync(sidecarPath, 'utf-8')).toBe('{"preserve":true}')
+  })
+
+  it('migrates the mutated target when both participants have only legacy JSON', async () => {
+    writeProfileState('personal', makeState({ repos: [makeRepo()] }))
+    writeProfileState('work', makeState())
+
+    const { transferOrcaProfileProject } = await loadTransferModule()
+    const result = transferOrcaProfileProject(
+      {
+        sourceProfileId: 'personal',
+        targetProfileId: 'work',
+        repoId: 'repo-1',
+        mode: 'copy'
+      },
+      testState.dir
+    )
+
+    expect(result.status).toBe('transferred')
+    expect(readProfileState('work').repos).toEqual([
+      expect.objectContaining({ path: '/workspace/orca' })
+    ])
+    expect(existsSync(profileDatabasePath('personal'))).toBe(false)
+    expect(existsSync(profileDatabasePath('work'))).toBe(true)
+  })
+
+  it('fails closed when a profile has both database and legacy JSON state', async () => {
+    const sourceState = makeState({ repos: [makeRepo()] })
+    writeProfileState('personal', sourceState)
+    writeProfileStateDatabase('personal', sourceState)
+    writeProfileState('work', makeState())
+
+    const { transferOrcaProfileProject } = await loadTransferModule()
+    expect(() =>
+      transferOrcaProfileProject(
+        {
+          sourceProfileId: 'personal',
+          targetProfileId: 'work',
+          repoId: 'repo-1',
+          mode: 'copy'
+        },
+        testState.dir
+      )
+    ).toThrowError(expect.objectContaining({ code: 'ambiguous_profile_state_storage' }))
+  })
+
+  it('uses SQLite when the retained legacy JSON is the accepted migration export', async () => {
+    const sourceState = makeState({ repos: [makeRepo()] })
+    writeProfileState('personal', sourceState)
+    const sourceJson = readFileSync(profileDataPath('personal'), 'utf-8')
+    writeProfileStateDatabaseWithAcceptedLegacyJson('personal', sourceJson)
+    writeProfileState('work', makeState())
+
+    const { transferOrcaProfileProject } = await loadTransferModule()
+    const result = transferOrcaProfileProject(
+      {
+        sourceProfileId: 'personal',
+        targetProfileId: 'work',
+        repoId: 'repo-1',
+        mode: 'copy'
+      },
+      testState.dir
+    )
+
+    expect(result.status).toBe('transferred')
+    expect(readProfileStateDatabase('work').repos).toEqual([
+      expect.objectContaining({ path: '/workspace/orca' })
+    ])
+    expect(readFileSync(profileDataPath('personal'), 'utf-8')).toBe(sourceJson)
+    expect(readProfileStateDatabase('personal').repos).toEqual([
+      expect.objectContaining({ path: '/workspace/orca' })
+    ])
+  })
+
+  it('rejects a missing SQLite database when a retained export proves JSON is stale', async () => {
+    const sourceState = makeState({ repos: [makeRepo()] })
+    writeProfileState('personal', sourceState)
+    const sourceJson = readFileSync(profileDataPath('personal'), 'utf-8')
+    writeProfileStateDatabaseWithAcceptedLegacyJson('personal', sourceJson)
+    rmSync(profileDatabasePath('personal'))
+    writeFileSync(`${profileDataPath('personal')}.sqlite-export.1.json`, sourceJson)
+    writeProfileState('work', makeState())
+
+    const { transferOrcaProfileProject } = await loadTransferModule()
+    expect(() =>
+      transferOrcaProfileProject(
+        {
+          sourceProfileId: 'personal',
+          targetProfileId: 'work',
+          repoId: 'repo-1',
+          mode: 'copy'
+        },
+        testState.dir
+      )
+    ).toThrowError(expect.objectContaining({ code: 'profile-state-recovery-required' }))
+  })
+
+  it.each(['-wal', '-shm', '-journal'])(
+    'refuses a transfer from an orphaned %s',
+    async (suffix) => {
+      writeProfileState('personal', makeState({ repos: [makeRepo()] }))
+      writeProfileState('work', makeState())
+      const sourceJson = readFileSync(profileDataPath('personal'), 'utf8')
+      const targetJson = readFileSync(profileDataPath('work'), 'utf8')
+      const sidecar = `${profileDatabasePath('personal')}${suffix}`
+      writeFileSync(sidecar, 'orphaned recovery evidence')
+
+      const { transferOrcaProfileProject } = await loadTransferModule()
+      expect(() =>
+        transferOrcaProfileProject(
+          { sourceProfileId: 'personal', targetProfileId: 'work', repoId: 'repo-1', mode: 'move' },
+          testState.dir
+        )
+      ).toThrow()
+      expect(readFileSync(profileDataPath('personal'), 'utf8')).toBe(sourceJson)
+      expect(readFileSync(profileDataPath('work'), 'utf8')).toBe(targetJson)
+      expect(readFileSync(sidecar, 'utf8')).toBe('orphaned recovery evidence')
+      expect(existsSync(profileDatabasePath('personal'))).toBe(false)
+      expect(existsSync(profileDatabasePath('work'))).toBe(false)
+    }
+  )
+
+  it.each(['copy', 'move'] as const)(
+    '%s transfers between SQLite-only profiles while retaining rollback exports',
+    async (mode) => {
+      const sourceState = makeState({ repos: [makeRepo()] })
+      const targetState = makeState()
+      writeProfileStateDatabase('personal', sourceState)
+      writeProfileStateDatabase('work', targetState)
+      const sourceExport = JSON.stringify(sourceState)
+      const targetExport = JSON.stringify(targetState)
+      const sourceExportPath = `${profileDataPath('personal')}.sqlite-export.1.json`
+      const targetExportPath = `${profileDataPath('work')}.sqlite-export.1.json`
+      writeFileSync(sourceExportPath, sourceExport)
+      writeFileSync(targetExportPath, targetExport)
+
+      const { transferOrcaProfileProject } = await loadTransferModule()
+      const result = transferOrcaProfileProject(
+        {
+          sourceProfileId: 'personal',
+          targetProfileId: 'work',
+          repoId: 'repo-1',
+          mode
+        },
+        testState.dir
+      )
+
+      expect(result.status).toBe('transferred')
+      expect(readProfileStateDatabase('personal').repos).toHaveLength(mode === 'move' ? 0 : 1)
+      expect(readProfileStateDatabase('work').repos).toEqual([
+        expect.objectContaining({ path: '/workspace/orca' })
+      ])
+      expect(existsSync(profileDataPath('personal'))).toBe(false)
+      expect(existsSync(profileDataPath('work'))).toBe(false)
+      expect(readFileSync(sourceExportPath, 'utf8')).toBe(sourceExport)
+      expect(readFileSync(targetExportPath, 'utf8')).toBe(targetExport)
+    }
+  )
+
+  it('fences a SQLite transfer write against the revision that was read', async () => {
+    writeProfileStateDatabase('work', makeState())
+
+    await loadTransferModule()
+    const stateFile = await import('./profile-project-state-file')
+    const observed = stateFile.readProfileStateWithRevision('work', testState.dir)
+    expect(observed.revision).toBeGreaterThan(0)
+
+    const opened = openProfileStateDatabase(profileDatabasePath('work'), 'work')
+    try {
+      importProfileStateJson(
+        opened.db,
+        JSON.stringify(makeState({ settings: { ...makeState().settings, theme: 'dark' } }))
+      )
+    } finally {
+      opened.db.close()
+    }
+
+    expect(() =>
+      stateFile.writeProfileState('work', testState.dir, makeState(), {
+        expectedRevision: observed.revision
+      })
+    ).toThrowError(expect.objectContaining({ code: 'profile-state-revision-conflict' }))
+    expect(readProfileStateDatabase('work').settings.theme).toBe('dark')
+  })
+
+  it('moves between SQLite-backed profiles through a durable cross-profile intent', async () => {
+    writeProfileStateDatabase('personal', makeState({ repos: [makeRepo()] }))
+    writeProfileStateDatabase('work', makeState())
+
+    const { transferOrcaProfileProject } = await loadTransferModule()
+    const result = transferOrcaProfileProject(
+      {
+        sourceProfileId: 'personal',
+        targetProfileId: 'work',
+        repoId: 'repo-1',
+        mode: 'move'
+      },
+      testState.dir
+    )
+    expect(result.status).toBe('transferred')
+    expect(readProfileStateDatabase('personal').repos).toHaveLength(0)
+    expect(readProfileStateDatabase('work').repos).toHaveLength(1)
+    expect(
+      readdirSync(join(testState.dir, 'profile-move-intents')).filter((file) =>
+        file.endsWith('.json')
+      )
+    ).toEqual([])
+  })
+
+  it('moves between rollback-window profiles while retaining their JSON exports', async () => {
+    const sourceState = makeState({ repos: [makeRepo()] })
+    writeProfileState('personal', sourceState)
+    writeProfileState('work', makeState())
+    const sourceJson = readFileSync(profileDataPath('personal'), 'utf-8')
+    const targetJson = readFileSync(profileDataPath('work'), 'utf-8')
+    writeProfileStateDatabaseWithAcceptedLegacyJson('personal', sourceJson)
+    writeProfileStateDatabaseWithAcceptedLegacyJson('work', targetJson)
+
+    const { transferOrcaProfileProject } = await loadTransferModule()
+    const result = transferOrcaProfileProject(
+      {
+        sourceProfileId: 'personal',
+        targetProfileId: 'work',
+        repoId: 'repo-1',
+        mode: 'move'
+      },
+      testState.dir
+    )
+
+    expect(result.status).toBe('transferred')
+    expect(readProfileStateDatabase('personal').repos).toHaveLength(0)
+    expect(readProfileStateDatabase('work').repos).toHaveLength(1)
+    expect(readFileSync(profileDataPath('personal'), 'utf-8')).toBe(sourceJson)
+    expect(readFileSync(profileDataPath('work'), 'utf-8')).toBe(targetJson)
+  })
+
+  it('migrates a legacy JSON target before moving a SQLite-backed project', async () => {
+    const sourceState = makeState({ repos: [makeRepo()] })
+    writeProfileStateDatabase('personal', sourceState)
+    writeProfileState('work', makeState())
+    const targetJson = readFileSync(profileDataPath('work'), 'utf-8')
+
+    const { transferOrcaProfileProject } = await loadTransferModule()
+    expect(
+      transferOrcaProfileProject(
+        {
+          sourceProfileId: 'personal',
+          targetProfileId: 'work',
+          repoId: 'repo-1',
+          mode: 'move'
+        },
+        testState.dir
+      )
+    ).toMatchObject({ status: 'transferred', mode: 'move' })
+    expect(readProfileStateDatabase('personal').repos).toHaveLength(0)
+    expect(readProfileStateDatabase('work').repos).toHaveLength(1)
+    expect(readFileSync(profileDataPath('work'), 'utf-8')).toBe(targetJson)
+  })
+
+  it.each([undefined, 'prepared', 'target-committed'])(
+    'replays a move after the target commit with legacy phase=%s',
+    async (phase) => {
+      writeProfileStateDatabase('personal', makeState({ repos: [makeRepo()] }))
+      writeProfileStateDatabase('work', makeState())
+      const stateFile = await import('./profile-project-state-file')
+      const source = stateFile.readProfileStateWithRevision('personal', testState.dir)
+      const target = stateFile.readProfileStateWithRevision('work', testState.dir)
+      const sourceAfter = makeState()
+      const targetAfter = makeState({ repos: [makeRepo()] })
+      const intent = createProfileProjectMoveIntent({
+        sourceProfileId: 'personal',
+        targetProfileId: 'work',
+        source,
+        target,
+        sourceAfterJson: JSON.stringify(sourceAfter),
+        targetAfterJson: JSON.stringify(targetAfter)
+      })
+      const historicalIntent = phase === undefined ? intent : { ...intent, phase }
+      persistProfileProjectMoveIntent(testState.dir, historicalIntent)
+      stateFile.writeProfileState('work', testState.dir, targetAfter, {
+        expectedRevision: target.revision
+      })
+
+      expect(recoverPendingProfileProjectMoves(testState.dir)).toBe(1)
+      expect(recoverPendingProfileProjectMoves(testState.dir)).toBe(0)
+      expect(readProfileStateDatabase('personal').repos).toHaveLength(0)
+      expect(readProfileStateDatabase('work').repos).toHaveLength(1)
+      expect(
+        readdirSync(join(testState.dir, 'profile-move-intents')).filter((file) =>
+          file.endsWith('.json')
+        )
+      ).toEqual([])
+    }
+  )
+
+  it('refuses a move intent whose after-state bytes no longer match their hashes', async () => {
+    writeProfileStateDatabase('personal', makeState({ repos: [makeRepo()] }))
+    writeProfileStateDatabase('work', makeState())
+    const stateFile = await import('./profile-project-state-file')
+    const source = stateFile.readProfileStateWithRevision('personal', testState.dir)
+    const target = stateFile.readProfileStateWithRevision('work', testState.dir)
+    const intent = createProfileProjectMoveIntent({
+      sourceProfileId: 'personal',
+      targetProfileId: 'work',
+      source,
+      target,
+      sourceAfterJson: JSON.stringify(makeState()),
+      targetAfterJson: JSON.stringify(makeState({ repos: [makeRepo()] }))
+    })
+    persistProfileProjectMoveIntent(testState.dir, intent)
+    stateFile.writeProfileState('work', testState.dir, makeState({ repos: [makeRepo()] }), {
+      expectedRevision: target.revision
+    })
+    const intentPath = join(testState.dir, 'profile-move-intents', `${intent.id}.json`)
+    const tampered = JSON.parse(readFileSync(intentPath, 'utf8'))
+    tampered.sourceAfterJson = JSON.stringify(
+      makeState({ settings: { ...makeState().settings, theme: 'light' } })
+    )
+    writeFileSync(intentPath, JSON.stringify(tampered), 'utf8')
+
+    expect(() => recoverPendingProfileProjectMoves(testState.dir)).toThrow(/intent is malformed/)
+    expect(readProfileStateDatabase('personal').repos).toHaveLength(1)
+    expect(existsSync(intentPath)).toBe(true)
+  })
 })
diff --git a/src/main/orca-profiles/profile-project-transfer.ts b/src/main/orca-profiles/profile-project-transfer.ts
index 75022d3ad65..ed7d51e6acf 100644
--- a/src/main/orca-profiles/profile-project-transfer.ts
+++ b/src/main/orca-profiles/profile-project-transfer.ts
@@ -3,7 +3,15 @@ import type {
   TransferOrcaProfileProjectResult
 } from '../../shared/orca-profiles'
 import { getOrcaProfileListState } from './profile-index-store'
-import { readProfileState, writeProfileState } from './profile-project-state-file'
+import {
+  readProfileProjectTransferState,
+  writeProfileProjectDomainChanges
+} from './profile-project-domain-state'
+import {
+  prepareProfileProjectDomainChanges,
+  type ProfileProjectDomainChanges
+} from './profile-project-domain-changes'
+import { createProfileProjectDomainMoveIntent } from './profile-project-domain-move-intent'
 import { removeSourceRepo } from './profile-project-source-removal'
 import {
   applyPayloadToTarget,
@@ -11,6 +19,13 @@ import {
   createTransferPayload
 } from './profile-project-transfer-payload'
 import { repoPhysicalKey } from './profile-project-worktree-identity'
+import { migrateProfileProjectTransferParticipant } from './profile-project-transfer-migration'
+import {
+  persistProfileProjectMoveIntent,
+  recoverPendingProfileProjectMoves,
+  removeProfileProjectMoveIntent,
+  type ProfileProjectMoveIntent
+} from './profile-project-move-intent'
 
 function assertKnownProfiles(args: TransferOrcaProfileProjectArgs, userDataPath: string): void {
   const profiles = getOrcaProfileListState(userDataPath).profiles
@@ -30,14 +45,15 @@ export function transferOrcaProfileProject(
   args: TransferOrcaProfileProjectArgs,
   userDataPath: string
 ): TransferOrcaProfileProjectResult {
+  recoverPendingProfileProjectMoves(userDataPath)
   assertKnownProfiles(args, userDataPath)
-  const sourceState = readProfileState(args.sourceProfileId, userDataPath)
-  const targetState = readProfileState(args.targetProfileId, userDataPath)
-  const sourceRepo = sourceState.repos.find((repo) => repo.id === args.repoId)
+  let sourceSnapshot = readProfileProjectTransferState(args.sourceProfileId, userDataPath)
+  let targetSnapshot = readProfileProjectTransferState(args.targetProfileId, userDataPath)
+  const sourceRepo = sourceSnapshot.state.repos.find((repo) => repo.id === args.repoId)
   if (!sourceRepo) {
     throw new Error('unknown_source_repo')
   }
-  const duplicate = targetState.repos.find(
+  const duplicate = targetSnapshot.state.repos.find(
     (repo) => repoPhysicalKey(repo) === repoPhysicalKey(sourceRepo)
   )
   if (duplicate) {
@@ -50,6 +66,24 @@ export function transferOrcaProfileProject(
     }
   }
 
+  let moveIntent: ProfileProjectMoveIntent | undefined
+  if (targetSnapshot.revision === undefined) {
+    targetSnapshot = migrateProfileProjectTransferParticipant(
+      args.targetProfileId,
+      userDataPath,
+      targetSnapshot
+    )
+  }
+  if (args.mode === 'move' && sourceSnapshot.revision === undefined) {
+    sourceSnapshot = migrateProfileProjectTransferParticipant(
+      args.sourceProfileId,
+      userDataPath,
+      sourceSnapshot
+    )
+  }
+
+  const sourceState = sourceSnapshot.state
+  const targetState = targetSnapshot.state
   const targetRepo = createTargetRepo(sourceRepo, targetState, args.mode === 'copy')
   const payload = createTransferPayload({
     sourceState,
@@ -57,14 +91,44 @@ export function transferOrcaProfileProject(
     targetRepo,
     includeSessions: args.mode === 'move'
   })
-  writeProfileState(args.targetProfileId, userDataPath, applyPayloadToTarget(targetState, payload))
-  if (args.mode === 'move') {
-    writeProfileState(
-      args.sourceProfileId,
-      userDataPath,
-      removeSourceRepo(sourceState, sourceRepo.id)
+  const targetAfterState = applyPayloadToTarget(targetState, payload)
+  const sourceAfterState =
+    args.mode === 'move' ? removeSourceRepo(sourceState, sourceRepo.id) : undefined
+  if (targetSnapshot.documents === undefined || targetSnapshot.revision === undefined) {
+    throw new Error('Profile transfer requires an established SQLite target')
+  }
+  const targetChanges = prepareProfileProjectDomainChanges(
+    targetSnapshot.revision,
+    targetSnapshot.documents,
+    targetAfterState
+  )
+  let sourceChanges: ProfileProjectDomainChanges | undefined
+  if (sourceAfterState !== undefined) {
+    if (sourceSnapshot.documents === undefined || sourceSnapshot.revision === undefined) {
+      throw new Error('Profile move requires an established SQLite source')
+    }
+    sourceChanges = prepareProfileProjectDomainChanges(
+      sourceSnapshot.revision,
+      sourceSnapshot.documents,
+      sourceAfterState
     )
   }
+  if (sourceChanges !== undefined) {
+    moveIntent = createProfileProjectDomainMoveIntent({
+      sourceProfileId: args.sourceProfileId,
+      targetProfileId: args.targetProfileId,
+      source: sourceChanges,
+      target: targetChanges
+    })
+    persistProfileProjectMoveIntent(userDataPath, moveIntent)
+  }
+  writeProfileProjectDomainChanges(args.targetProfileId, userDataPath, targetChanges)
+  if (sourceChanges !== undefined) {
+    writeProfileProjectDomainChanges(args.sourceProfileId, userDataPath, sourceChanges)
+    if (moveIntent) {
+      removeProfileProjectMoveIntent(userDataPath, moveIntent.id)
+    }
+  }
   return {
     status: 'transferred',
     mode: args.mode,
diff --git a/src/main/orca-profiles/profile-storage-paths.ts b/src/main/orca-profiles/profile-storage-paths.ts
index 81dc990b0e1..1e8de1a367e 100644
--- a/src/main/orca-profiles/profile-storage-paths.ts
+++ b/src/main/orca-profiles/profile-storage-paths.ts
@@ -1,12 +1,17 @@
 import { getAppEnvironment } from '../../shared/app-environment'
+import {
+  getOrcaProfileDataFile as getSharedOrcaProfileDataFile,
+  getOrcaProfileStateDatabaseFile as getSharedOrcaProfileStateDatabaseFile
+} from '../../shared/profile-state-storage-paths'
+import { hasProfileStateDatabaseFiles } from '../persistence/profile-state/profile-state-storage-classification'
 import { join } from 'node:path'
 
 const LEGACY_DATA_FILE_NAME = 'orca-data.json'
 const LEGACY_BROWSER_SESSION_META_FILE_NAME = 'browser-session-meta.json'
 const PROFILE_INDEX_FILE_NAME = 'orca-profile-index.json'
-const PROFILE_DATA_FILE_NAME = 'orca-data.json'
 const PROFILE_BROWSER_SESSION_META_FILE_NAME = 'browser-session-meta.json'
 const PROFILE_DIRECTORY_NAME = 'profiles'
+const PROFILE_MOVE_INTENT_DIRECTORY_NAME = 'profile-move-intents'
 
 export const LEGACY_BACKUP_COUNT = 5
 
@@ -31,6 +36,11 @@ export function getOrcaProfilesDirectory(userDataPath = getProfileUserDataPath()
   return join(userDataPath, PROFILE_DIRECTORY_NAME)
 }
 
+/** Durable cross-profile move intents live outside either profile database. */
+export function getOrcaProfileMoveIntentDirectory(userDataPath = getProfileUserDataPath()): string {
+  return join(userDataPath, PROFILE_MOVE_INTENT_DIRECTORY_NAME)
+}
+
 export function getOrcaProfileDirectory(
   profileId: string,
   userDataPath = getProfileUserDataPath()
@@ -42,7 +52,26 @@ export function getOrcaProfileDataFile(
   profileId: string,
   userDataPath = getProfileUserDataPath()
 ): string {
-  return join(getOrcaProfileDirectory(profileId, userDataPath), PROFILE_DATA_FILE_NAME)
+  return getSharedOrcaProfileDataFile(profileId, userDataPath)
+}
+
+/**
+ * Return the future profile-state database path without changing the legacy
+ * JSON path used by the current Store and its sidecars.
+ */
+export function getOrcaProfileStateDatabaseFile(
+  profileId: string,
+  userDataPath = getProfileUserDataPath()
+): string {
+  return getSharedOrcaProfileStateDatabaseFile(profileId, userDataPath)
+}
+
+export function hasOrcaProfileStateDatabase(
+  profileId: string,
+  userDataPath = getProfileUserDataPath()
+): boolean {
+  const databaseFile = getOrcaProfileStateDatabaseFile(profileId, userDataPath)
+  return hasProfileStateDatabaseFiles(databaseFile)
 }
 
 export function getOrcaProfileBrowserSessionMetaFile(
diff --git a/src/main/orca-profiles/profile-telemetry-consent-seed.test.ts b/src/main/orca-profiles/profile-telemetry-consent-seed.test.ts
new file mode 100644
index 00000000000..aad1bd9c812
--- /dev/null
+++ b/src/main/orca-profiles/profile-telemetry-consent-seed.test.ts
@@ -0,0 +1,118 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission
+} from '../persistence/profile-state/profile-state-access'
+import * as database from '../persistence/profile-state/profile-state-database'
+import { exportProfileStateJson } from '../persistence/profile-state/profile-state-documents'
+import {
+  getOrcaProfileDataFile,
+  getOrcaProfileStateDatabaseFile,
+  seedNewOrcaProfileTelemetryConsent
+} from './profile-index-store'
+
+const telemetry = {
+  optedIn: false,
+  installId: 'retained-install-id',
+  existedBeforeTelemetryRelease: true
+}
+let root: string
+const profileId = 'new-profile'
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'orca-profile-consent-'))
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  removeTreeSync(root)
+})
+
+describe('new profile consent seeding', () => {
+  it('inherits consent and install identity directly into SQLite alongside the active runtime', () => {
+    const runtime = acquireProfileStateRuntimeAdmission(root)
+    try {
+      seedNewOrcaProfileTelemetryConsent(profileId, telemetry, root)
+      const opened = database.openProfileStateDatabaseReadOnly(
+        getOrcaProfileStateDatabaseFile(profileId, root),
+        profileId
+      )
+      try {
+        expect(JSON.parse(exportProfileStateJson(opened.db))).toEqual({ settings: { telemetry } })
+      } finally {
+        opened.db.close()
+      }
+      expect(existsSync(getOrcaProfileDataFile(profileId, root))).toBe(false)
+      expect(() => runtime.assertActive()).not.toThrow()
+    } finally {
+      runtime.release()
+    }
+    const maintenance = acquireProfileStateMaintenance(root)
+    maintenance.release()
+  })
+
+  it('preserves established SQLite consent on a repeated seed', () => {
+    seedNewOrcaProfileTelemetryConsent(profileId, telemetry, root)
+    seedNewOrcaProfileTelemetryConsent(profileId, { ...telemetry, installId: 'replacement' }, root)
+    const opened = database.openProfileStateDatabaseReadOnly(
+      getOrcaProfileStateDatabaseFile(profileId, root),
+      profileId
+    )
+    try {
+      expect(JSON.parse(exportProfileStateJson(opened.db))).toEqual({ settings: { telemetry } })
+    } finally {
+      opened.db.close()
+    }
+  })
+
+  it('preserves existing JSON as input for its later import', () => {
+    const path = getOrcaProfileDataFile(profileId, root)
+    const original = '{"settings":{"telemetry":{"installId":"older"}}}'
+    mkdirSync(dirname(path), { recursive: true })
+    writeFileSync(path, original)
+
+    seedNewOrcaProfileTelemetryConsent(profileId, telemetry, root)
+
+    expect(readFileSync(path, 'utf8')).toBe(original)
+    expect(existsSync(getOrcaProfileStateDatabaseFile(profileId, root))).toBe(false)
+  })
+
+  it('refuses an incapable runtime before admission or profile creation', () => {
+    vi.spyOn(database, 'isProfileStateSqliteAvailable').mockReturnValue(false)
+    expect(() => seedNewOrcaProfileTelemetryConsent(profileId, telemetry, root)).toThrow(
+      'bundled Orca runtime'
+    )
+    expect(existsSync(join(root, '.profile-state-access'))).toBe(false)
+    expect(existsSync(join(root, 'profiles'))).toBe(false)
+  })
+
+  it('refuses seeding while maintenance owns the root', () => {
+    const maintenance = acquireProfileStateMaintenance(root)
+    try {
+      expect(() => seedNewOrcaProfileTelemetryConsent(profileId, telemetry, root)).toThrow()
+      expect(existsSync(getOrcaProfileStateDatabaseFile(profileId, root))).toBe(false)
+    } finally {
+      maintenance.release()
+    }
+  })
+
+  it.each(['orca-data.json.bak.0', 'orca-data.json.sqlite-export.1.json', 'profile-state.db-wal'])(
+    'retains missing-authority evidence in %s',
+    (name) => {
+      const directory = dirname(getOrcaProfileDataFile(profileId, root))
+      mkdirSync(directory, { recursive: true })
+      const evidence = join(directory, name)
+      writeFileSync(evidence, 'retained recovery evidence')
+
+      expect(() => seedNewOrcaProfileTelemetryConsent(profileId, telemetry, root)).toThrow()
+
+      expect(existsSync(getOrcaProfileDataFile(profileId, root))).toBe(false)
+      expect(existsSync(getOrcaProfileStateDatabaseFile(profileId, root))).toBe(false)
+      expect(readFileSync(evidence, 'utf8')).toBe('retained recovery evidence')
+    }
+  )
+})
diff --git a/src/main/orca-profiles/profile-telemetry-consent-seed.ts b/src/main/orca-profiles/profile-telemetry-consent-seed.ts
new file mode 100644
index 00000000000..c73a6de63fa
--- /dev/null
+++ b/src/main/orca-profiles/profile-telemetry-consent-seed.ts
@@ -0,0 +1,42 @@
+import { existsSync } from 'node:fs'
+import type { GlobalSettings } from '../../shared/global-settings-types'
+import { acquireProfileStateRuntimeAdmission } from '../persistence/profile-state/profile-state-access'
+import { isProfileStateSqliteAvailable } from '../persistence/profile-state/profile-state-database'
+import { migrateProfileStateToSqlite } from '../persistence/profile-state/profile-state-migration'
+import {
+  getOrcaProfileDataFile,
+  getOrcaProfileStateDatabaseFile,
+  getProfileUserDataPath
+} from './profile-storage-paths'
+
+// Keep the active install's consent and anonymous identity when creating another profile.
+export function seedNewOrcaProfileTelemetryConsent(
+  profileId: string,
+  telemetry: GlobalSettings['telemetry'],
+  userDataPath = getProfileUserDataPath()
+): void {
+  if (!telemetry) {
+    return
+  }
+  if (!isProfileStateSqliteAvailable()) {
+    throw new Error('Creating profile state requires the bundled Orca runtime.')
+  }
+  const admission = acquireProfileStateRuntimeAdmission(userDataPath)
+  try {
+    const dataFile = getOrcaProfileDataFile(profileId, userDataPath)
+    const databaseFile = getOrcaProfileStateDatabaseFile(profileId, userDataPath)
+    if (existsSync(dataFile) || existsSync(databaseFile)) {
+      return
+    }
+    const migrated = migrateProfileStateToSqlite({
+      dataFile,
+      databaseFile,
+      profileId,
+      expectedLegacyJson: undefined,
+      serializedState: JSON.stringify({ settings: { telemetry } })
+    })
+    migrated.authority.close()
+  } finally {
+    admission.release()
+  }
+}
diff --git a/src/main/orcad/main-preflight-order.test.ts b/src/main/orcad/main-preflight-order.test.ts
index bd130bfb33f..e746be8cc5e 100644
--- a/src/main/orcad/main-preflight-order.test.ts
+++ b/src/main/orcad/main-preflight-order.test.ts
@@ -1,11 +1,35 @@
-import { describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  ORCAD_PROFILE_PREFLIGHT_FLAG,
+  ORCAD_STARTUP_PREFLIGHT_FLAG
+} from '../../shared/orcad-profile-preflight'
 
 /**
  * The precondition is only worth anything if it runs first. A loader failure is not
  * catchable, so a preflight that lands after `main()` has already reached
  * `await import('../ipc/pty')` prevents nothing.
  */
-const order: string[] = []
+const { order, profileProbe } = vi.hoisted(() => {
+  const order: string[] = []
+  return { order, profileProbe: vi.fn(async () => {}) }
+})
+
+vi.mock('./orcad-bundled-runtime', () => ({ handoffToBundledOrcad: () => false }))
+vi.mock('./orcad-profile-preflight', () => ({
+  preflightBundledOrcadStartup: async () => {
+    order.push('profile-admission')
+  },
+  runOrcadProfilePreflight: profileProbe
+}))
+
+beforeEach(() => {
+  vi.resetModules()
+  order.length = 0
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.clearAllMocks()
+})
 
 vi.mock('./orcad-native-preflight', () => ({
   runOrcadNativePreflight: () => {
@@ -21,10 +45,23 @@ vi.mock('./orcad-entry', () => ({
 }))
 
 describe('orcad entry', () => {
+  it.each([
+    { flag: ORCAD_PROFILE_PREFLIGHT_FLAG, nativeFeatures: true },
+    { flag: ORCAD_STARTUP_PREFLIGHT_FLAG, nativeFeatures: false }
+  ])(
+    'runs the selected disposable probe without starting a server: $flag',
+    async ({ flag, nativeFeatures }) => {
+      vi.spyOn(process, 'argv', 'get').mockReturnValue(['runtime', 'orcad.js', flag, 'nonce'])
+      await import('./main')
+      expect(profileProbe).toHaveBeenCalledExactlyOnceWith('nonce', { nativeFeatures })
+      expect(order).toEqual([])
+    }
+  )
+
   it('runs the native preflight before starting the runtime', async () => {
     await import('./main')
     await vi.waitFor(() => expect(order).toContain('main'))
 
-    expect(order).toEqual(['preflight', 'main'])
+    expect(order).toEqual(['profile-admission', 'preflight', 'main'])
   })
 })
diff --git a/src/main/orcad/main.ts b/src/main/orcad/main.ts
index 73a973c7b24..79fc667fd22 100644
--- a/src/main/orcad/main.ts
+++ b/src/main/orcad/main.ts
@@ -2,6 +2,12 @@
 import process from 'node:process'
 import { main, resolveOrcadExitCode } from './orcad-entry'
 import { runOrcadNativePreflight } from './orcad-native-preflight'
+import {
+  ORCAD_PROFILE_PREFLIGHT_FLAG,
+  ORCAD_STARTUP_PREFLIGHT_FLAG
+} from '../../shared/orcad-profile-preflight'
+import { preflightBundledOrcadStartup, runOrcadProfilePreflight } from './orcad-profile-preflight'
+import { handoffToBundledOrcad } from './orcad-bundled-runtime'
 
 // Why exit before the preflight: reaching this line means the whole module graph resolved
 // under plain Node, which is all the build guard needs to prove. Probing natives or
@@ -16,12 +22,33 @@ if (process.argv.includes('--orcad-smoke-load-check')) {
 // evaluated before this statement, so the guarantee is that no module in the graph
 // requires node-pty at import time — which the bundle's lazy `require("node-pty")` in
 // local-pty-provider satisfies. See ./node-pty-precondition.ts for why a child process.
-runOrcadNativePreflight()
-
-main().catch((error: unknown) => {
+function failStartup(error: unknown): void {
   console.error('orcad: failed to start:', error)
   // Why a resolved code and not a bare 1: a data-root or bind-address refusal is a
   // configuration fault that restarting cannot fix, and a supervisor needs to tell the two
   // apart to avoid restart-spinning on it.
   process.exit(resolveOrcadExitCode(error))
-})
+}
+
+try {
+  if (!handoffToBundledOrcad()) {
+    const flag = process.argv[2]
+    if (
+      (flag === ORCAD_PROFILE_PREFLIGHT_FLAG || flag === ORCAD_STARTUP_PREFLIGHT_FLAG) &&
+      process.argv.length === 4
+    ) {
+      void runOrcadProfilePreflight(process.argv[3], {
+        nativeFeatures: flag === ORCAD_PROFILE_PREFLIGHT_FLAG
+      }).catch(failStartup)
+    } else {
+      void preflightBundledOrcadStartup()
+        .then(() => {
+          runOrcadNativePreflight()
+          return main()
+        })
+        .catch(failStartup)
+    }
+  }
+} catch (error) {
+  failStartup(error)
+}
diff --git a/src/main/orcad/orcad-artifact-identity.ts b/src/main/orcad/orcad-artifact-identity.ts
new file mode 100644
index 00000000000..0049ef10ffa
--- /dev/null
+++ b/src/main/orcad/orcad-artifact-identity.ts
@@ -0,0 +1,41 @@
+import { createHash } from 'node:crypto'
+import { createReadStream, existsSync } from 'node:fs'
+import { readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { z } from 'zod'
+import {
+  ORCAD_BUILD_TARGET_FILENAME,
+  ORCAD_VERSION,
+  orcadArtifactFilenames,
+  orcadArtifactHashPrefix
+} from '../../shared/orcad-artifacts'
+import { ORCAD_BUN_TARGETS } from '../../shared/orcad-bun-runtime'
+import { orcadAgentBrowserNativeName } from '../../shared/orcad-agent-browser-name'
+
+/** Hash installed bytes in the build's order; a version marker is not proof of delivery. */
+export async function readOrcadArtifactIdentity(directory: string): Promise<string> {
+  const target = z
+    .enum(ORCAD_BUN_TARGETS)
+    .parse((await readFile(join(directory, ORCAD_BUILD_TARGET_FILENAME), 'utf8')).trim())
+  const platform = target.startsWith('win32-')
+    ? 'win32'
+    : target.startsWith('darwin-')
+      ? 'darwin'
+      : 'linux'
+  const browser = orcadAgentBrowserNativeName(
+    platform,
+    target.split('-')[1] ?? '',
+    target.endsWith('-musl') ? 'musl' : 'glibc'
+  )
+  const filenames = orcadArtifactFilenames(target)
+  if (existsSync(join(directory, browser))) {
+    filenames.push(browser)
+  }
+  const hash = createHash('sha256').update(orcadArtifactHashPrefix(target))
+  for (const filename of filenames) {
+    for await (const chunk of createReadStream(join(directory, filename))) {
+      hash.update(chunk)
+    }
+  }
+  return `${ORCAD_VERSION}+${hash.digest('hex').slice(0, 12)}`
+}
diff --git a/src/main/orcad/orcad-artifact-preflight.test.ts b/src/main/orcad/orcad-artifact-preflight.test.ts
new file mode 100644
index 00000000000..f48a1436a92
--- /dev/null
+++ b/src/main/orcad/orcad-artifact-preflight.test.ts
@@ -0,0 +1,66 @@
+import { randomUUID } from 'node:crypto'
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { orcadArtifactFilenames } from '../../shared/orcad-artifacts'
+import { runOrcadProfilePreflight } from './orcad-profile-preflight'
+import { readOrcadArtifactIdentity } from './orcad-artifact-identity'
+import { resolveOrcadExitCode } from './orcad-exit-code'
+
+const fixture = vi.hoisted(() => ({
+  directory: '',
+  sqlite: vi.fn(async () => ({ sqliteVersion: '3.53.2', revision: 1 }))
+}))
+vi.mock('./orcad-app-paths', () => ({ resolveOrcadInstallRoot: () => fixture.directory }))
+vi.mock('../persistence/profile-state/profile-state-runtime-preflight', () => ({
+  preflightProfileStateRuntime: fixture.sqlite
+}))
+vi.mock('./orcad-bun-native-preflight', () => ({
+  preflightOrcadBunNativeRuntime: vi.fn(async () => {})
+}))
+
+beforeEach(async () => {
+  fixture.directory = await mkdtemp(join(tmpdir(), 'orcad-artifact-preflight-'))
+  for (const filename of orcadArtifactFilenames('linux-x64-glibc')) {
+    const path = join(fixture.directory, filename)
+    await mkdir(dirname(path), { recursive: true })
+    await writeFile(path, filename === '.build-target' ? 'linux-x64-glibc\n' : filename)
+  }
+  vi.spyOn(console, 'log').mockImplementation(() => {})
+})
+afterEach(async () => {
+  vi.restoreAllMocks()
+  vi.clearAllMocks()
+  await rm(fixture.directory, { recursive: true, force: true })
+})
+
+describe('installed artifact admission', () => {
+  it('qualifies build output before its version marker is published', async () => {
+    await runOrcadProfilePreflight(randomUUID())
+    expect(fixture.sqlite).toHaveBeenCalledOnce()
+    expect(console.log).toHaveBeenCalledWith(
+      expect.stringContaining(await readOrcadArtifactIdentity(fixture.directory))
+    )
+  })
+
+  it.each(['.build-target', 'node_modules/@parcel/watcher/watcher.node', 'bun-runtime'])(
+    'refuses a missing %s as configuration before any profile probe',
+    async (filename) => {
+      await rm(join(fixture.directory, filename))
+      const error = await runOrcadProfilePreflight(randomUUID()).catch(
+        (failure: unknown) => failure
+      )
+      expect(resolveOrcadExitCode(error)).toBe(78)
+      expect(fixture.sqlite).not.toHaveBeenCalled()
+      expect(console.log).not.toHaveBeenCalled()
+    }
+  )
+
+  it('refuses a malformed target even though all named files exist', async () => {
+    await writeFile(join(fixture.directory, '.build-target'), 'not-a-runtime-target')
+    const error = await runOrcadProfilePreflight(randomUUID()).catch((failure: unknown) => failure)
+    expect(resolveOrcadExitCode(error)).toBe(78)
+    expect(fixture.sqlite).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/orcad/orcad-bun-launcher.integration.test.ts b/src/main/orcad/orcad-bun-launcher.integration.test.ts
new file mode 100644
index 00000000000..8ee18d53293
--- /dev/null
+++ b/src/main/orcad/orcad-bun-launcher.integration.test.ts
@@ -0,0 +1,298 @@
+import { build } from 'esbuild'
+import { existsSync, readFileSync } from 'node:fs'
+import { copyFile, mkdtemp, readFile, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { spawnProcess } from '../../shared/child-process/run-process'
+import { orcadBunRuntimeFilename } from '../../shared/orcad-artifacts'
+import { ORCAD_BUN_VERSION } from '../../shared/orcad-bun-runtime'
+import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
+
+const runtimePath =
+  process.env.BUN_EXECUTABLE ?? resolve('out/orcad', orcadBunRuntimeFilename(process.platform))
+const nodePath =
+  process.env.ORCA_TEST_NODE_EXECUTABLE ?? (process.versions.bun ? 'node' : process.execPath)
+let directory = ''
+const children = new Set<ReturnType<typeof spawnProcess>>()
+const runtimes = new Set<number>()
+
+describe.skipIf(!existsSync(runtimePath))('real Bun launcher lifecycle', () => {
+  beforeEach(async () => {
+    directory = await mkdtemp(join(tmpdir(), 'orca-bun-launcher-'))
+    await copyFile(runtimePath, join(directory, orcadBunRuntimeFilename(process.platform)))
+    await writeFile(join(directory, '.build-target'), `${process.platform}-${process.arch}\n`)
+    await build({
+      // Record entry before imports without relying on either process's stdout.
+      banner: {
+        js: `
+          function traceLauncherPhase(phase) {
+            const runtime = process.versions.bun ? 'bun' : 'node'
+            try {
+              require('node:fs').appendFileSync(process.env.ORCA_TEST_PHASES + '.' + runtime,
+                JSON.stringify({ at: Date.now(), phase, pid: process.pid, runtime, arch: process.arch }) + '\\n')
+            } catch (error) {
+              console.error('launcher fixture trace failed:', error)
+            }
+          }
+          traceLauncherPhase('entry')
+          process.once('exit', code => traceLauncherPhase('exit:' + code))
+        `
+      },
+      stdin: {
+        contents: `
+          import {handoffToBundledOrcad, OrcadBundledRuntimeError} from './src/main/orcad/orcad-bundled-runtime'
+          import {installOrcadShutdownSignals} from './src/main/orcad/orcad-lifecycle'
+          import {resolveOrcadExitCode} from './src/main/orcad/orcad-exit-code'
+          import {writeFile} from 'node:fs/promises'
+          if (!process.versions.bun) {
+            traceLauncherPhase('before-handoff')
+            if (!handoffToBundledOrcad()) throw new Error('Missing bundled runtime')
+            traceLauncherPhase('after-handoff')
+            process.on('message', signal => process.emit(signal))
+          } else {
+            traceLauncherPhase('before-booting')
+            console.log('booting:' + process.pid)
+            console.log('runtime:' + process.versions.bun)
+            console.log('channel-env:' + (process.env.ORCA_BUNDLED_LAUNCHER_CHANNEL ?? 'absent'))
+            traceLauncherPhase('booting-written')
+            process.on('exit', code => console.log('runtime-exit:' + code))
+            const keepalive = setInterval(() => {}, 1_000)
+            const install = async () => {
+              if (process.env.ORCA_TEST_FAIL_STARTUP === '1') {
+                const startup = new Promise((_, reject) => setTimeout(() =>
+                  reject(new OrcadBundledRuntimeError('startup configuration failed')), 100))
+                installOrcadShutdownSignals(async () => (await startup).stop())
+                await startup
+                return
+              }
+              installOrcadShutdownSignals(async () => {
+                console.log('flushing')
+                clearInterval(keepalive)
+                if (process.env.ORCA_TEST_STALL === '1') await new Promise(() => {})
+                await new Promise(resolve => setTimeout(resolve, 150))
+                await writeFile(process.env.ORCA_TEST_DONE, 'flushed')
+              }, process.env.ORCA_TEST_STALL === '1' ? 100 : undefined)
+              console.log('ready')
+            }
+            // Exercise the shutdown observer before the outer startup-failure reporter.
+            const start = () => Promise.resolve().then(install)
+              .catch(error => setImmediate(() => process.exit(resolveOrcadExitCode(error))))
+            if (process.env.ORCA_TEST_DELAY_INSTALL === '1') setTimeout(start, 300)
+            else start()
+          }
+        `,
+        resolveDir: process.cwd(),
+        loader: 'ts'
+      },
+      outfile: join(directory, 'orcad.js'),
+      bundle: true,
+      platform: 'node',
+      target: 'node18',
+      format: 'cjs'
+    })
+  })
+
+  afterEach(() => {
+    for (const child of children) {
+      child.kill('SIGKILL')
+    }
+    children.clear()
+    for (const pid of runtimes) {
+      try {
+        process.kill(pid, 'SIGKILL')
+      } catch {}
+    }
+    runtimes.clear()
+    removeTreeSync(directory)
+  })
+
+  function launch(
+    options: {
+      direct?: boolean
+      nohup?: boolean
+      delay?: boolean
+      stall?: boolean
+      failStartup?: boolean
+    } = {}
+  ) {
+    const runtime = options.direct
+      ? join(directory, orcadBunRuntimeFilename(process.platform))
+      : nodePath
+    const startedAt = Date.now()
+    const events: { at: number; event: string }[] = []
+    const record = (event: string): void => {
+      if (events.length < 16) {
+        events.push({ at: Date.now(), event })
+      }
+    }
+    const child = spawnProcess({
+      program: options.nohup ? 'nohup' : runtime,
+      args: [...(options.nohup ? [runtime] : []), join(directory, 'orcad.js')],
+      env: {
+        ...process.env,
+        ORCA_BACKGROUND_LAUNCH: '1',
+        ORCA_TEST_DONE: join(directory, 'done'),
+        ORCA_TEST_PHASES: join(directory, 'phases'),
+        ORCA_TEST_DELAY_INSTALL: options.delay ? '1' : '0',
+        ORCA_TEST_STALL: options.stall ? '1' : '0',
+        ORCA_TEST_FAIL_STARTUP: options.failStartup ? '1' : '0'
+      },
+      detached: process.platform !== 'win32',
+      stdio: ['ignore', 'pipe', 'pipe', 'ipc']
+    })
+    children.add(child)
+    child.once('spawn', () => record('spawn'))
+    let closed = false
+    child.once('close', () => {
+      record('close')
+      closed = true
+    })
+    let output = ''
+    const capture = (chunk: Buffer): void => {
+      output += chunk.toString()
+      const pid = /booting:(\d+)/.exec(output)?.[1]
+      if (pid && !output.includes('runtime-exit:')) {
+        runtimes.add(Number(pid))
+      } else if (pid) {
+        runtimes.delete(Number(pid))
+      }
+    }
+    const streams = [
+      ['stdout', child.stdout],
+      ['stderr', child.stderr]
+    ] as const
+    for (const [name, stream] of streams) {
+      stream.on('data', capture)
+      stream.once('data', () => record(`${name}:data`))
+      stream.once('end', () => record(`${name}:end`))
+      stream.once('close', () => record(`${name}:close`))
+    }
+    const exit = new Promise<{ code: number | null; signal: NodeJS.Signals | null }>(
+      (resolve, reject) => {
+        child.once('error', (error) => {
+          record(`error:${error.message}`)
+          reject(error)
+        })
+        child.once('exit', (code, signal) => {
+          record(`exit:${code}:${signal}`)
+          children.delete(child)
+          resolve({ code, signal })
+        })
+      }
+    )
+    const diagnostics = () => ({
+      startedAt,
+      elapsedMs: Date.now() - startedAt,
+      events,
+      pid: child.pid,
+      exitCode: child.exitCode,
+      signalCode: child.signalCode,
+      connected: child.connected,
+      closed,
+      streams: streams.map(([name, stream]) => ({
+        name,
+        ended: stream.readableEnded,
+        destroyed: stream.destroyed,
+        error: stream.errored?.message,
+        bufferedBytes: stream.readableLength
+      })),
+      phases: ['node', 'bun'].map((runtime) => {
+        try {
+          return {
+            runtime,
+            trace: readFileSync(join(directory, `phases.${runtime}`), 'utf8').slice(0, 4096)
+          }
+        } catch (error) {
+          return { runtime, error: String(error) }
+        }
+      })
+    })
+    return { child, output: () => output, exit, isClosed: () => closed, diagnostics }
+  }
+
+  it.each([false, true])(
+    'drains Bun after its launcher is killed (startup pending: %s)',
+    async (delay) => {
+      const h = launch({ delay })
+      await vi.waitFor(
+        () => {
+          expect(h.output()).toContain(delay ? 'booting:' : 'ready')
+          expect(h.output()).toContain(`runtime:${ORCAD_BUN_VERSION}`)
+          expect(h.output()).toContain('channel-env:absent')
+        },
+        { timeout: 5_000 }
+      )
+      h.child.kill('SIGKILL')
+      await h.exit
+      await vi.waitFor(
+        async () => expect(await readFile(join(directory, 'done'), 'utf8')).toBe('flushed'),
+        { timeout: 5_000 }
+      )
+      expect(h.output().match(/flushing/g)).toHaveLength(1)
+      await vi.waitFor(() => expect(h.output()).toContain('runtime-exit:0'))
+      await vi.waitFor(() => expect(h.isClosed()).toBe(true), { timeout: 5_000 })
+    }
+  )
+
+  it.skipIf(process.platform === 'win32').each([false, true])(
+    'survives nohup hangups and drains on TERM (direct Bun: %s)',
+    async (direct) => {
+      const h = launch({ direct, nohup: true })
+      await vi.waitFor(() => expect(h.output()).toContain('ready'), { timeout: 5_000 })
+      if (!h.child.pid) {
+        throw new Error('Missing launcher pid')
+      }
+      process.kill(-h.child.pid, 'SIGHUP')
+      await new Promise((resolve) => setTimeout(resolve, 100))
+      expect(h.child.exitCode).toBeNull()
+      expect(h.child.signalCode).toBeNull()
+      expect(h.output()).not.toContain('flushing')
+      h.child.kill('SIGTERM')
+      expect(await h.exit).toEqual({ code: 0, signal: null })
+      expect(await readFile(join(directory, 'done'), 'utf8')).toBe('flushed')
+      await vi.waitFor(() => expect(h.isClosed()).toBe(true), { timeout: 5_000 })
+    }
+  )
+
+  it('keeps an unfinished shutdown alive until its failure deadline', async () => {
+    const h = launch({ stall: true })
+    await vi.waitFor(() => expect(h.output()).toContain('ready'), { timeout: 5_000 })
+    h.child.kill('SIGKILL')
+    await h.exit
+    await vi.waitFor(() => expect(h.output()).toContain('runtime-exit:1'))
+    expect(h.output()).toContain('exceeded 100ms')
+    await vi.waitFor(() => expect(h.isClosed()).toBe(true), { timeout: 5_000 })
+  })
+
+  it.each(process.platform === 'win32' ? [false, true] : [false])(
+    'forwards launcher stop requests and drains once (startup pending: %s)',
+    async (delay) => {
+      const h = launch({ delay })
+      await vi.waitFor(() => expect(h.output()).toContain(delay ? 'booting:' : 'ready'), {
+        timeout: 5_000
+      })
+      h.child.send('SIGINT')
+      h.child.send('SIGTERM')
+      expect(await h.exit).toEqual({ code: 0, signal: null })
+      expect(await readFile(join(directory, 'done'), 'utf8')).toBe('flushed')
+      expect(h.output().match(/flushing/g)).toHaveLength(1)
+      await vi.waitFor(() => expect(h.isClosed()).toBe(true), { timeout: 5_000 })
+    }
+  )
+
+  it('preserves a startup configuration verdict after early launcher loss', async () => {
+    const h = launch({ delay: true, failStartup: true })
+    try {
+      await vi.waitFor(() => expect(h.output()).toContain('booting:'), { timeout: 5_000 })
+    } catch (error) {
+      console.error('Bun launcher startup diagnostics:', JSON.stringify(h.diagnostics()))
+      throw error
+    }
+    h.child.kill('SIGKILL')
+    await h.exit
+    await vi.waitFor(() => expect(h.output()).toContain('runtime-exit:78'), { timeout: 5_000 })
+    expect(h.output()).toContain('shutdown after launcher disconnect failed')
+    await vi.waitFor(() => expect(h.isClosed()).toBe(true), { timeout: 5_000 })
+  })
+})
diff --git a/src/main/orcad/orcad-bun-native-preflight.test.ts b/src/main/orcad/orcad-bun-native-preflight.test.ts
new file mode 100644
index 00000000000..3e6df8402c1
--- /dev/null
+++ b/src/main/orcad/orcad-bun-native-preflight.test.ts
@@ -0,0 +1,165 @@
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type {
+  WatcherProcessCallback,
+  WatcherProcessHooks
+} from '../ipc/parcel-watcher-process-subscription'
+import { preflightOrcadBunNativeRuntime } from './orcad-bun-native-preflight'
+
+const fixture = vi.hoisted(() => ({
+  temp: vi.fn(),
+  pty: vi.fn(),
+  available: vi.fn(),
+  startTime: vi.fn(),
+  rows: vi.fn(),
+  subscribe: vi.fn(),
+  unsubscribe: vi.fn(),
+  dispose: vi.fn(),
+  write: vi.fn(),
+  remove: vi.fn()
+}))
+vi.mock('../daemon/pty-subprocess/spawn-preflight', () => ({ runPtySpawnHealthProbe: fixture.pty }))
+vi.mock('../windows/windows-process-table', () => ({
+  isWindowsProcessTableAvailable: fixture.available,
+  isWindowsProcessStartTimeAvailable: fixture.startTime,
+  readWindowsProcessIdentityTableFresh: fixture.rows
+}))
+vi.mock('node:fs/promises', () => ({
+  mkdtemp: fixture.temp,
+  writeFile: fixture.write,
+  rm: fixture.remove
+}))
+vi.mock('../ipc/parcel-watcher-process-supervisor', () => ({
+  WatcherProcessSupervisor: class {
+    subscribe = fixture.subscribe
+    dispose = fixture.dispose
+  }
+}))
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  fixture.temp.mockResolvedValue('/temp/probe')
+  fixture.pty.mockResolvedValue(undefined)
+  fixture.available.mockReturnValue(true)
+  fixture.startTime.mockReturnValue(true)
+  fixture.rows.mockResolvedValue([{ pid: process.pid, creationTimeMs: Date.now() - 1_000 }])
+  fixture.unsubscribe.mockResolvedValue(undefined)
+  fixture.remove.mockResolvedValue(undefined)
+  fixture.subscribe.mockImplementation(
+    async (directory: string, callback: WatcherProcessCallback) => {
+      fixture.write.mockImplementation(async () =>
+        callback(null, [{ path: join(directory, 'ready'), type: 'create' }])
+      )
+      return { unsubscribe: fixture.unsubscribe }
+    }
+  )
+})
+afterEach(() => {
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+  vi.resetAllMocks()
+})
+
+describe('bundled native readiness', () => {
+  it('keeps runtime startup independent of PTY or watcher probe availability', async () => {
+    fixture.pty.mockRejectedValue(new Error('PTY spawn health check timed out'))
+    fixture.subscribe.mockRejectedValue(new Error('ENOSPC: watch limit reached'))
+    await preflightOrcadBunNativeRuntime({ nativeFeatures: false })
+    expect(fixture.pty).not.toHaveBeenCalled()
+    expect(fixture.subscribe).not.toHaveBeenCalled()
+  })
+
+  it('still requires Windows ownership support on normal startup', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+    fixture.startTime.mockReturnValue(false)
+    await expect(preflightOrcadBunNativeRuntime({ nativeFeatures: false })).rejects.toThrow(
+      'Windows process table'
+    )
+  })
+
+  it('does not admit a failed PTY in explicit qualification', async () => {
+    fixture.pty.mockRejectedValue(new Error('PTY spawn health check timed out'))
+    await expect(preflightOrcadBunNativeRuntime()).rejects.toThrow(
+      'PTY spawn health check timed out'
+    )
+  })
+
+  it('awaits actual watcher delivery and unsubscribe before disposing temporary state', async () => {
+    await preflightOrcadBunNativeRuntime()
+    expect(fixture.pty).toHaveBeenCalledOnce()
+    expect(fixture.unsubscribe).toHaveBeenCalledOnce()
+    expect(fixture.dispose).toHaveBeenCalledOnce()
+    expect(fixture.remove).toHaveBeenCalledWith('/temp/probe', { recursive: true, force: true })
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('cancels a subscribe blocked on capacity by the same readiness deadline', async () => {
+    fixture.subscribe.mockImplementation(
+      (
+        _directory: string,
+        _callback: WatcherProcessCallback,
+        _options: unknown,
+        hooks: WatcherProcessHooks
+      ) =>
+        new Promise((_resolve, reject) => {
+          hooks.signal?.addEventListener('abort', () => reject(hooks.signal?.reason), {
+            once: true
+          })
+        })
+    )
+    const readiness = preflightOrcadBunNativeRuntime()
+    const rejected = expect(readiness).rejects.toThrow('readiness timed out')
+    await vi.advanceTimersByTimeAsync(5_000)
+    await rejected
+    expect(fixture.dispose).toHaveBeenCalledOnce()
+    expect(fixture.remove).toHaveBeenCalledOnce()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('cleans up when native delivery fails before subscribe resolves', async () => {
+    fixture.subscribe.mockImplementation(
+      async (_directory: string, callback: WatcherProcessCallback) => {
+        callback(new Error('native watcher failed'), [])
+        return { unsubscribe: fixture.unsubscribe }
+      }
+    )
+    await expect(preflightOrcadBunNativeRuntime()).rejects.toThrow('native watcher failed')
+    expect(fixture.unsubscribe).toHaveBeenCalledOnce()
+    expect(fixture.dispose).toHaveBeenCalledOnce()
+  })
+
+  it('still disposes temporary state when unsubscribe fails', async () => {
+    fixture.unsubscribe.mockRejectedValue(new Error('watcher did not exit'))
+    await expect(preflightOrcadBunNativeRuntime()).rejects.toThrow('watcher did not exit')
+    expect(fixture.dispose).toHaveBeenCalledOnce()
+    expect(fixture.remove).toHaveBeenCalledOnce()
+  })
+
+  it.each(['missing-addon', 'missing-creation-time', 'invalid-self-row'])(
+    'refuses %s on Windows before spawning a PTY or allowing CIM fallback',
+    async (reason) => {
+      vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+      if (reason === 'missing-addon') {
+        fixture.available.mockReturnValue(false)
+      }
+      if (reason === 'missing-creation-time') {
+        fixture.startTime.mockReturnValue(false)
+      }
+      if (reason === 'invalid-self-row') {
+        fixture.rows.mockResolvedValue([{ pid: process.pid }])
+      }
+      await expect(preflightOrcadBunNativeRuntime()).rejects.toThrow('Windows process table')
+      expect(fixture.pty).not.toHaveBeenCalled()
+      if (reason !== 'invalid-self-row') {
+        expect(fixture.rows).not.toHaveBeenCalled()
+      }
+    }
+  )
+
+  it('reads a fresh self identity on Windows before qualifying the PTY', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+    await preflightOrcadBunNativeRuntime()
+    expect(fixture.rows).toHaveBeenCalledOnce()
+    expect(fixture.pty).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/orcad/orcad-bun-native-preflight.ts b/src/main/orcad/orcad-bun-native-preflight.ts
new file mode 100644
index 00000000000..163f6ce2987
--- /dev/null
+++ b/src/main/orcad/orcad-bun-native-preflight.ts
@@ -0,0 +1,83 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { runPtySpawnHealthProbe } from '../daemon/pty-subprocess/spawn-preflight'
+import { WatcherProcessSupervisor } from '../ipc/parcel-watcher-process-supervisor'
+import { resolveWatcherProcessEntryPath } from '../ipc/parcel-watcher-entry-path'
+import { resolveOrcadInstallRoot } from './orcad-app-paths'
+import {
+  isWindowsProcessTableAvailable,
+  isWindowsProcessStartTimeAvailable,
+  readWindowsProcessIdentityTableFresh
+} from '../windows/windows-process-table'
+
+/** The candidate process owns disposable PTY and watcher probes before it touches user state. */
+export async function preflightOrcadBunNativeRuntime(
+  options: { nativeFeatures?: boolean } = {}
+): Promise<void> {
+  if (process.platform === 'win32') {
+    await preflightWindowsProcessIdentity()
+  }
+  // Runtime health checks can degrade independently; artifact qualification remains strict.
+  if (options.nativeFeatures === false) {
+    return
+  }
+  await runPtySpawnHealthProbe()
+  const directory = await mkdtemp(join(tmpdir(), 'orca-native-ready-'))
+  const supervisor = new WatcherProcessSupervisor({
+    entryPath: resolveWatcherProcessEntryPath(resolveOrcadInstallRoot(), false),
+    useInProcessVitestFallback: false
+  })
+  const cancellation = new AbortController()
+  let subscription: { unsubscribe(): Promise<void> } | undefined
+  let timer: ReturnType<typeof setTimeout> | undefined
+  try {
+    let resolveDelivery: () => void = () => {}
+    let rejectDelivery: (error: unknown) => void = () => {}
+    const delivered = new Promise<void>((resolve, reject) => {
+      resolveDelivery = resolve
+      rejectDelivery = reject
+    })
+    // A native callback can fail while subscribe is pending.
+    void delivered.catch(() => {})
+    timer = setTimeout(() => {
+      const error = new Error('Bun file watcher readiness timed out')
+      cancellation.abort(error)
+      rejectDelivery(error)
+    }, 5_000)
+    subscription = await supervisor.subscribe(
+      directory,
+      (error, events) => {
+        if (error) {
+          rejectDelivery(error)
+        } else if (events.some((event) => event.path === join(directory, 'ready'))) {
+          resolveDelivery()
+        }
+      },
+      process.platform === 'win32' ? { backend: 'windows' } : {},
+      { signal: cancellation.signal, subscribeTimeoutMs: 5_000, onTerminalError: rejectDelivery }
+    )
+    await writeFile(join(directory, 'ready'), '')
+    await delivered
+  } finally {
+    clearTimeout(timer)
+    try {
+      await subscription?.unsubscribe()
+    } finally {
+      supervisor.dispose()
+      await rm(directory, { recursive: true, force: true })
+    }
+  }
+}
+
+async function preflightWindowsProcessIdentity(): Promise<void> {
+  if (!isWindowsProcessTableAvailable() || !isWindowsProcessStartTimeAvailable()) {
+    throw new Error('The bundled Windows process table must support process creation times')
+  }
+  const rows = await readWindowsProcessIdentityTableFresh()
+  const self = rows.find((row) => row.pid === process.pid)
+  const created = self?.creationTimeMs
+  if (created === undefined || !Number.isFinite(created) || created <= 0 || created > Date.now()) {
+    throw new Error('The bundled Windows process table could not identify this process')
+  }
+}
diff --git a/src/main/orcad/orcad-bundle-native-load-order.test.ts b/src/main/orcad/orcad-bundle-native-load-order.test.ts
index 1c26501b6a6..5ed9085fa36 100644
--- a/src/main/orcad/orcad-bundle-native-load-order.test.ts
+++ b/src/main/orcad/orcad-bundle-native-load-order.test.ts
@@ -1,91 +1,70 @@
 import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { afterEach, describe, expect, it } from 'vitest'
+import { pathToFileURL } from 'node:url'
+import { afterEach, expect, it } from 'vitest'
 import { runProcessSync } from '../../shared/child-process/run-process'
 
-/**
- * The preflight only prevents a loader crash if nothing in the bundle's import graph has
- * already required node-pty by the time it runs. esbuild wraps `local-pty-provider` in a
- * lazy initializer because `orcad-entry` reaches it through `await import('../ipc/pty')`,
- * and that laziness is load-bearing rather than incidental — a single top-level static
- * import anywhere in the graph would hoist `require("node-pty")` above every statement in
- * `main.ts`, including the preflight.
- *
- * Why this builds the bundle instead of skipping without one: no CI job builds orcad and
- * runs vitest. `smoke:orcad-terminal` builds it in the static-analysis job, which never
- * runs vitest; the `orcad_browser` job runs vitest but deliberately does not build orcad.
- * A `runIf(existsSync(...))` guard therefore skips in every shard, forever — the same way
- * an unset ORCA_BROWSER_EXECUTABLE kept the browser provider uncovered.
- *
- * Why not fail-when-CI instead: the wiring that would satisfy it lives in `.github/`, so
- * that turns a silent gap into a red build someone else has to fix. Building costs well
- * under a second (esbuild), works in every shard and on every machine, and needs no job
- * to cooperate. What it must never do is skip.
- */
 const REPO_ROOT = join(__dirname, '..', '..', '..')
-const BUNDLE = join(REPO_ROOT, 'out', 'orcad', 'orcad.js')
-const BUILD_SCRIPT = join(REPO_ROOT, 'config', 'scripts', 'build-orcad.mjs')
+const directories: string[] = []
 
-/**
- * Why it throws rather than skipping when the build fails: a bundle that cannot be built
- * is a louder problem than the one this test checks, and swallowing it here is exactly
- * how the assertion would go missing.
- */
-function ensureOrcadBundle(): void {
-  if (existsSync(BUNDLE)) {
-    return
+afterEach(() => {
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
   }
-  const build = runProcessSync({
-    program: process.execPath,
-    args: [BUILD_SCRIPT],
-    cwd: REPO_ROOT,
-    timeoutMs: 300_000
-  })
-  if (!existsSync(BUNDLE)) {
-    const output = `${build.stdout}${build.stderr}`.slice(0, 4000)
-    throw new Error(
-      `could not build ${BUNDLE} (exit ${build.code}); the load-order assertion cannot run:\n${output}`
-    )
-  }
-}
-
-describe('orcad bundle native load order', () => {
-  const dirs: string[] = []
-  afterEach(() => {
-    for (const dir of dirs.splice(0)) {
-      rmSync(dir, { recursive: true, force: true })
-    }
-  })
-
-  it('does not require node-pty in-process before the entry rejects its argv', () => {
-    ensureOrcadBundle()
-    const dir = mkdtempSync(join(tmpdir(), 'orcad-load-order-'))
-    dirs.push(dir)
-    const harness = join(dir, 'harness.cjs')
-    writeFileSync(
-      harness,
-      [
-        "const Module = require('module')",
-        'const original = Module._load',
-        'Module._load = function (request, ...rest) {',
-        "  if (request === 'node-pty') { console.log('IN_PROCESS_NODE_PTY_REQUIRE') }",
-        '  return original.call(this, request, ...rest)',
-        '}',
-        "process.argv.push('--orcad-load-order-check')",
-        `require(${JSON.stringify(BUNDLE)})`
-      ].join('\n')
-    )
-
-    const result = runProcessSync({
-      program: process.execPath,
-      args: [harness],
-      timeoutMs: 120_000
-    })
-    const output = `${result.stdout}${result.stderr}`
-
-    // Proof the graph fully loaded and reached argv parsing rather than dying early.
-    expect(output).toContain('Unknown argument: --orcad-load-order-check')
-    expect(output).not.toContain('IN_PROCESS_NODE_PTY_REQUIRE')
-  }, 360_000)
 })
+
+it('loads a fresh production import graph before requiring native PTY code', () => {
+  const directory = mkdtempSync(join(tmpdir(), 'orcad-load-order-'))
+  directories.push(directory)
+  const bundle = join(directory, 'orcad.js')
+  const builder = pathToFileURL(join(REPO_ROOT, 'config/scripts/orcad-entry-build.mjs')).href
+  const built = runProcessSync({
+    program: process.execPath,
+    args: [
+      '--input-type=module',
+      '-e',
+      `import { buildOrcadEntry } from ${JSON.stringify(builder)}; await buildOrcadEntry(${JSON.stringify(bundle)})`
+    ],
+    cwd: REPO_ROOT,
+    env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1' },
+    timeoutMs: 60_000
+  })
+  expect(built.code, built.stderr.slice(0, 2_000)).toBe(0)
+  expect(existsSync(bundle)).toBe(true)
+
+  const marker = join(directory, 'premature-native-load')
+  const preload = join(directory, 'preload.cjs')
+  writeFileSync(
+    preload,
+    [
+      "const Module = require('node:module')",
+      'const original = Module._load',
+      'Module._load = function (request, ...rest) {',
+      "  if (request === 'node-pty') {",
+      `    require('node:fs').writeFileSync(${JSON.stringify(marker)}, request)`,
+      "    throw new Error('native PTY required before preflight')",
+      '  }',
+      '  return original.call(this, request, ...rest)',
+      '}'
+    ].join('\n')
+  )
+  const run = (extraArgs: string[] = []) =>
+    runProcessSync({
+      program: process.execPath,
+      // The production load-check exits after module evaluation, before runtime handoff or probes.
+      args: ['--require', preload, ...extraArgs, bundle, '--orcad-smoke-load-check'],
+      env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1' },
+      timeoutMs: 30_000
+    })
+
+  const loaded = run()
+  expect(loaded.code, loaded.stderr.slice(0, 2_000)).toBe(0)
+  expect(existsSync(marker)).toBe(false)
+
+  // Prove the interception works without relying on minified source echoed in an error.
+  const eagerNative = join(directory, 'eager-native.cjs')
+  writeFileSync(eagerNative, "require('node-pty')")
+  expect(run(['--require', eagerNative]).code).not.toBe(0)
+  expect(existsSync(marker)).toBe(true)
+}, 90_000)
diff --git a/src/main/orcad/orcad-bundled-runtime.integration.test.ts b/src/main/orcad/orcad-bundled-runtime.integration.test.ts
new file mode 100644
index 00000000000..9db0d5000c9
--- /dev/null
+++ b/src/main/orcad/orcad-bundled-runtime.integration.test.ts
@@ -0,0 +1,221 @@
+import { build } from 'esbuild'
+import { chmod, mkdir, mkdtemp, readFile, rm, symlink, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { runProcess, spawnProcess } from '../../shared/child-process/run-process'
+import { shellEscape } from '../ssh/ssh-connection-utils'
+
+let directory = ''
+const children = new Set<ReturnType<typeof spawnProcess>>()
+
+beforeEach(async () => {
+  directory = await mkdtemp(join(tmpdir(), 'orca-handoff-'))
+  await build({
+    stdin: {
+      contents: `
+        import { handoffToBundledOrcad, OrcadBundledRuntimeError } from './src/main/orcad/orcad-bundled-runtime'
+        import { installOrcadShutdownSignals, flushOrcadProfileStoreForShutdown } from './src/main/orcad/orcad-lifecycle'
+        import { writeFile } from 'node:fs/promises'
+        if (process.env.ORCA_TEST_HANDOFF_CHILD === '1') {
+          if (process.env.ORCA_TEST_HANDOFF_DURABLE === '1') {
+            installOrcadShutdownSignals(() => flushOrcadProfileStoreForShutdown({
+              flushFinalOrThrowAsync: async () => {
+                console.log('flushing')
+                await new Promise(resolve => setTimeout(resolve, 250))
+                await writeFile(process.env.ORCA_TEST_SHUTDOWN_FILE, 'flushed')
+              },
+              freezeWritesAsync: async () => console.log('closed')
+            }))
+          }
+          for (const signal of ['SIGINT', 'SIGTERM']) {
+            process.on(signal, () => {
+              console.log('received:' + signal)
+              if (process.env.ORCA_TEST_HANDOFF_DURABLE !== '1') process.exit(29)
+            })
+          }
+          console.log('ready:' + JSON.stringify(process.argv.slice(2)))
+          console.log('child-pid:' + process.pid)
+          setTimeout(() => process.exit(99), 4_000)
+        } else {
+          try {
+            if (!handoffToBundledOrcad()) throw new Error('handoff failed')
+          } catch (error) {
+            console.error(error.message)
+            process.exit(error instanceof OrcadBundledRuntimeError ? 78 : 1)
+          }
+        }
+      `,
+      resolveDir: process.cwd(),
+      loader: 'ts'
+    },
+    outfile: join(directory, 'orcad.js'),
+    bundle: true,
+    platform: 'node',
+    target: 'node18',
+    format: 'cjs'
+  })
+  await writeFile(join(directory, '.build-target'), 'darwin-arm64\n')
+  const runtime = join(directory, 'bun-runtime')
+  await writeFile(
+    runtime,
+    `#!/bin/sh\nORCA_TEST_HANDOFF_CHILD=1 exec ${shellEscape(process.execPath)} "$@"\n`
+  )
+  await chmod(runtime, 0o700)
+})
+
+afterEach(async () => {
+  for (const child of children) {
+    child.kill('SIGKILL')
+  }
+  children.clear()
+  await rm(directory, { recursive: true, force: true })
+})
+
+function launch(
+  args: string[],
+  env: NodeJS.ProcessEnv = {},
+  options: { entry?: string; nohup?: boolean } = {}
+) {
+  const child = spawnProcess({
+    program: options.nohup ? 'nohup' : process.execPath,
+    args: [
+      ...(options.nohup ? [process.execPath] : []),
+      options.entry ?? join(directory, 'orcad.js'),
+      ...args
+    ],
+    env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1', ...env },
+    stdio: ['ignore', 'pipe', 'pipe'],
+    detached: true
+  })
+  children.add(child)
+  let output = ''
+  child.stdout.on('data', (data: Buffer) => {
+    output += data.toString()
+  })
+  child.stderr.on('data', (data: Buffer) => {
+    output += data.toString()
+  })
+  const exit = new Promise<{ code: number | null; signal: NodeJS.Signals | null }>(
+    (resolve, reject) => {
+      child.once('error', reject)
+      child.once('exit', (code, signal) => {
+        children.delete(child)
+        resolve({ code, signal })
+      })
+    }
+  )
+  return { child, output: () => output, exit }
+}
+
+describe.skipIf(process.platform === 'win32')('bundled handoff process lifecycle', () => {
+  it('refuses a partial installation before launching its adjacent runtime', async () => {
+    await rm(join(directory, '.build-target'))
+    const result = await runProcess({
+      program: process.execPath,
+      args: [join(directory, 'orcad.js')],
+      env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1' },
+      timeoutMs: 5_000
+    })
+    expect(result.code).toBe(78)
+    expect(result.stderr).toContain('bundled Orca runtime target is missing')
+    expect(result.stdout).not.toContain('ready:')
+  })
+
+  it.each(['SIGINT', 'SIGTERM'] as const)(
+    'forwards %s to the actual child and mirrors its exit',
+    async (signal) => {
+      const args = ['--label', 'two words', 'quote"$literal']
+      const { child, output, exit } = launch(args)
+      await vi.waitFor(() => expect(output()).toContain(`ready:${JSON.stringify(args)}`), {
+        timeout: 2_000
+      })
+      child.kill(signal)
+      expect(await exit).toEqual({ code: 29, signal: null })
+      expect(output()).toContain(`received:${signal}`)
+    }
+  )
+
+  it.each(
+    (['SIGINT', 'SIGTERM'] as const).flatMap((signal) =>
+      (['process group', 'separate service deliveries'] as const).map((delivery) => ({
+        signal,
+        delivery
+      }))
+    )
+  )(
+    'finishes a pending durable flush after duplicate $signal from $delivery',
+    async ({ signal, delivery }) => {
+      const shutdownFile = join(directory, 'shutdown-complete')
+      const { child, output, exit } = launch([], {
+        ORCA_TEST_HANDOFF_DURABLE: '1',
+        ORCA_TEST_SHUTDOWN_FILE: shutdownFile
+      })
+      await vi.waitFor(() => expect(output()).toContain('child-pid:'), { timeout: 2_000 })
+      const runtimePid = Number(output().match(/child-pid:(\d+)/)?.[1])
+      expect(runtimePid).toBeGreaterThan(0)
+      if (!child.pid) {
+        throw new Error('Launcher has no process ID')
+      }
+      if (delivery === 'process group') {
+        process.kill(-child.pid, signal)
+      } else {
+        process.kill(runtimePid, signal)
+        await vi.waitFor(() => expect(output()).toContain('flushing'))
+        child.kill(signal)
+      }
+      expect(await exit).toEqual({ code: 0, signal: null })
+      expect(await readFile(shutdownFile, 'utf8')).toBe('flushed')
+      expect(output().match(/flushing/g)).toHaveLength(1)
+      expect(output()).toContain('closed')
+      if (delivery === 'separate service deliveries') {
+        expect(output().match(new RegExp(`received:${signal}`, 'g'))).toHaveLength(2)
+      }
+    }
+  )
+
+  it('hands off a symlinked entry to its adjacent runtime', async () => {
+    const aliases = join(directory, 'aliases')
+    await mkdir(aliases)
+    const entry = join(aliases, 'orcad.js')
+    await symlink(join(directory, 'orcad.js'), entry)
+    const { child, output, exit } = launch([], {}, { entry })
+    await vi.waitFor(() => expect(output()).toContain('child-pid:'), { timeout: 2_000 })
+    child.kill('SIGTERM')
+    expect(await exit).toEqual({ code: 29, signal: null })
+  })
+
+  it('drains the child after its launcher is force-killed', async () => {
+    const shutdownFile = join(directory, 'shutdown-complete')
+    const { child, output, exit } = launch([], {
+      ORCA_TEST_HANDOFF_DURABLE: '1',
+      ORCA_TEST_SHUTDOWN_FILE: shutdownFile
+    })
+    await vi.waitFor(() => expect(output()).toContain('child-pid:'), { timeout: 2_000 })
+    child.kill('SIGKILL')
+    expect(await exit).toEqual({ code: null, signal: 'SIGKILL' })
+    await vi.waitFor(async () => expect(await readFile(shutdownFile, 'utf8')).toBe('flushed'))
+    expect(output().match(/flushing/g)).toHaveLength(1)
+  })
+
+  it('preserves nohup across a terminal hangup and still stops gracefully on SIGTERM', async () => {
+    const shutdownFile = join(directory, 'shutdown-complete')
+    const { child, output, exit } = launch(
+      [],
+      { ORCA_TEST_HANDOFF_DURABLE: '1', ORCA_TEST_SHUTDOWN_FILE: shutdownFile },
+      { nohup: true }
+    )
+    await vi.waitFor(() => expect(output()).toContain('child-pid:'), { timeout: 2_000 })
+    if (!child.pid) {
+      throw new Error('Launcher has no process ID')
+    }
+    process.kill(-child.pid, 'SIGHUP')
+    await new Promise((resolve) => setTimeout(resolve, 100))
+    expect(child.exitCode).toBeNull()
+    expect(child.signalCode).toBeNull()
+    expect(output()).not.toContain('flushing')
+    child.kill('SIGTERM')
+    expect(await exit).toEqual({ code: 0, signal: null })
+    expect(await readFile(shutdownFile, 'utf8')).toBe('flushed')
+  })
+})
diff --git a/src/main/orcad/orcad-bundled-runtime.test.ts b/src/main/orcad/orcad-bundled-runtime.test.ts
new file mode 100644
index 00000000000..5541314057e
--- /dev/null
+++ b/src/main/orcad/orcad-bundled-runtime.test.ts
@@ -0,0 +1,176 @@
+import { EventEmitter } from 'node:events'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { handoffToBundledOrcad } from './orcad-bundled-runtime'
+import { ORCAD_BUN_VERSION } from '../../shared/orcad-bun-runtime'
+import { ORCAD_VERSION_FILENAME } from '../../shared/orcad-artifacts'
+
+const fixture = vi.hoisted(() => ({
+  exists: vi.fn<(path: string) => boolean>(),
+  realpath: vi.fn<(path: string) => string>(),
+  spawn: vi.fn()
+}))
+vi.mock('node:fs', () => ({ existsSync: fixture.exists, realpathSync: fixture.realpath }))
+vi.mock('../../shared/child-process/run-process', () => ({ spawnProcess: fixture.spawn }))
+
+class RuntimeChild extends EventEmitter {
+  kill = vi.fn()
+  disconnect = vi.fn()
+  connected = true
+}
+
+let child: RuntimeChild
+const signalNames = ['SIGINT', 'SIGTERM', 'SIGHUP'] as const
+let oldListeners: Map<NodeJS.Signals, ReturnType<typeof process.rawListeners>>
+
+beforeEach(() => {
+  oldListeners = new Map(signalNames.map((signal) => [signal, process.rawListeners(signal)]))
+  child = new RuntimeChild()
+  fixture.exists.mockReturnValue(true)
+  fixture.realpath.mockImplementation((path) => path)
+  fixture.spawn.mockReturnValue(child)
+  vi.spyOn(process, 'exit').mockImplementation(() => {
+    throw new Error('test process exit')
+  })
+  vi.spyOn(process, 'kill').mockReturnValue(true)
+  vi.spyOn(console, 'error').mockImplementation(() => {})
+  vi.spyOn(process, 'argv', 'get').mockReturnValue(['/node', '/slot/orcad.js', '--port', '0'])
+})
+
+afterEach(() => {
+  for (const signal of signalNames) {
+    for (const listener of process.rawListeners(signal)) {
+      if (!oldListeners.get(signal)?.includes(listener)) {
+        process.off(signal, listener)
+      }
+    }
+  }
+  vi.restoreAllMocks()
+  vi.clearAllMocks()
+})
+
+describe('bundled Orca runtime handoff', () => {
+  it('leaves nonpackaged entries on their existing runtime', () => {
+    fixture.exists.mockReturnValue(false)
+    expect(handoffToBundledOrcad()).toBe(false)
+    expect(fixture.spawn).not.toHaveBeenCalled()
+  })
+
+  it('refuses an incomplete slot before starting a process', () => {
+    fixture.exists.mockImplementation((path) => path.endsWith('.build-target'))
+    expect(() => handoffToBundledOrcad()).toThrow('bundled Orca runtime is missing')
+    expect(fixture.spawn).not.toHaveBeenCalled()
+  })
+
+  it('refuses a versioned slot missing both its runtime and target marker', () => {
+    fixture.exists.mockImplementation((path) => path.endsWith(ORCAD_VERSION_FILENAME))
+    expect(() => handoffToBundledOrcad()).toThrow('bundled Orca runtime target is missing')
+    expect(fixture.spawn).not.toHaveBeenCalled()
+  })
+
+  it('refuses a remaining bundled runtime without its target marker', () => {
+    fixture.exists.mockImplementation((path) => !path.endsWith('.build-target'))
+    expect(() => handoffToBundledOrcad()).toThrow('bundled Orca runtime target is missing')
+    expect(fixture.realpath).toHaveBeenCalledExactlyOnceWith('/slot/orcad.js')
+    expect(fixture.spawn).not.toHaveBeenCalled()
+  })
+
+  it('accepts only the pinned version when already executing the bundled runtime', () => {
+    fixture.realpath.mockReturnValue('/real/runtime')
+    vi.spyOn(process, 'versions', 'get').mockReturnValue({
+      ...process.versions,
+      bun: ORCAD_BUN_VERSION
+    })
+    expect(handoffToBundledOrcad()).toBe(false)
+    expect(fixture.spawn).not.toHaveBeenCalled()
+  })
+
+  it('refuses an adjacent runtime that reports the wrong Bun version', () => {
+    fixture.realpath.mockReturnValue('/real/runtime')
+    vi.spyOn(process, 'versions', 'get').mockReturnValue({ ...process.versions, bun: '0.0.0' })
+    expect(() => handoffToBundledOrcad()).toThrow(`must be Bun ${ORCAD_BUN_VERSION}`)
+  })
+
+  it.each(['linux', 'darwin', 'win32'] as const)(
+    'hands off arguments and respects %s signal delivery',
+    (platform) => {
+      vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+      expect(handoffToBundledOrcad()).toBe(true)
+      expect(fixture.spawn).toHaveBeenCalledWith({
+        program: expect.stringMatching(/bun-runtime(?:\.exe)?$/),
+        args: ['/slot/orcad.js', '--port', '0'],
+        env: expect.objectContaining({ ORCA_BUNDLED_LAUNCHER_CHANNEL: '1' }),
+        detached: true,
+        stdio: ['inherit', 'inherit', 'inherit', 'ipc']
+      })
+      for (const signal of signalNames) {
+        const listener = process
+          .rawListeners(signal)
+          .find((candidate) => !oldListeners.get(signal)?.includes(candidate))
+        if (signal === 'SIGHUP' && platform === 'win32') {
+          expect(listener).toBeUndefined()
+          continue
+        }
+        expect(listener).toBeDefined()
+        if (listener) {
+          listener.call(process, signal)
+        }
+        if (signal === 'SIGHUP') {
+          expect(child.kill).not.toHaveBeenCalledWith('SIGHUP')
+        } else if (platform === 'win32') {
+          expect(child.kill).not.toHaveBeenCalled()
+          expect(child.disconnect).toHaveBeenCalled()
+        } else {
+          expect(child.kill).toHaveBeenLastCalledWith(signal)
+        }
+      }
+    }
+  )
+
+  it('propagates a child exit code and removes every signal listener', () => {
+    handoffToBundledOrcad()
+    expect(() => child.emit('exit', 23, null)).toThrow('test process exit')
+    expect(process.exit).toHaveBeenCalledWith(23)
+    expect(process.kill).not.toHaveBeenCalled()
+    for (const signal of signalNames) {
+      expect(process.rawListeners(signal)).toEqual(oldListeners.get(signal))
+    }
+  })
+
+  it('locates the runtime beside the resolved entry rather than its symlink', () => {
+    fixture.realpath.mockImplementation((path) =>
+      path === '/slot/orcad.js' ? '/real/slot/orcad.js' : path
+    )
+    handoffToBundledOrcad()
+    expect(fixture.spawn).toHaveBeenCalledWith(
+      expect.objectContaining({
+        program: expect.stringMatching(/real\/slot\/bun-runtime(?:\.exe)?$/),
+        args: ['/real/slot/orcad.js', '--port', '0']
+      })
+    )
+  })
+
+  it('reports failed spawn as a configuration failure and removes listeners', () => {
+    handoffToBundledOrcad()
+    expect(() => child.emit('error', new Error('ENOENT'))).toThrow('test process exit')
+    expect(process.exit).toHaveBeenCalledWith(78)
+    for (const signal of signalNames) {
+      expect(process.rawListeners(signal)).toEqual(oldListeners.get(signal))
+    }
+  })
+
+  it('mirrors a POSIX signal exit without exiting before the signal is delivered', () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('linux')
+    handoffToBundledOrcad()
+    child.emit('exit', null, 'SIGTERM')
+    expect(process.kill).toHaveBeenCalledWith(process.pid, 'SIGTERM')
+    expect(process.exit).not.toHaveBeenCalled()
+  })
+
+  it('preserves a signal exit without sending unsupported signals on Windows', () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+    handoffToBundledOrcad()
+    expect(() => child.emit('exit', null, 'SIGTERM')).toThrow('test process exit')
+    expect(process.exit).toHaveBeenCalledWith(143)
+    expect(process.kill).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/orcad/orcad-bundled-runtime.ts b/src/main/orcad/orcad-bundled-runtime.ts
new file mode 100644
index 00000000000..05b86387124
--- /dev/null
+++ b/src/main/orcad/orcad-bundled-runtime.ts
@@ -0,0 +1,90 @@
+import { existsSync, realpathSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { constants } from 'node:os'
+import { spawnProcess } from '../../shared/child-process/run-process'
+import {
+  ORCAD_BUILD_TARGET_FILENAME,
+  ORCAD_VERSION_FILENAME,
+  orcadBunRuntimeFilename
+} from '../../shared/orcad-artifacts'
+import { ORCAD_BUN_VERSION } from '../../shared/orcad-bun-runtime'
+
+export class OrcadBundledRuntimeError extends Error {}
+export const ORCAD_BUNDLED_LAUNCHER_ENV = 'ORCA_BUNDLED_LAUNCHER_CHANNEL'
+
+/** Keep old Node service commands usable without letting Node open the profile. */
+export function handoffToBundledOrcad(): boolean {
+  const script = process.argv[1]
+  if (!script) {
+    return false
+  }
+  const entry = realpathSync(script)
+  const directory = dirname(entry)
+  const runtime = join(directory, orcadBunRuntimeFilename(process.platform))
+  const hasTarget = existsSync(join(directory, ORCAD_BUILD_TARGET_FILENAME))
+  const hasRuntime = existsSync(runtime)
+  if (!hasTarget && !hasRuntime && !existsSync(join(directory, ORCAD_VERSION_FILENAME))) {
+    return false
+  }
+  if (!hasTarget) {
+    throw new OrcadBundledRuntimeError('The bundled Orca runtime target is missing')
+  }
+  if (!hasRuntime) {
+    throw new OrcadBundledRuntimeError('The bundled Orca runtime is missing')
+  }
+  if (realpathSync(process.execPath) === realpathSync(runtime)) {
+    if (process.versions.bun !== ORCAD_BUN_VERSION) {
+      throw new OrcadBundledRuntimeError(
+        `The bundled Orca runtime must be Bun ${ORCAD_BUN_VERSION}`
+      )
+    }
+    return false
+  }
+  const child = spawnProcess({
+    program: runtime,
+    args: [entry, ...process.argv.slice(2)],
+    env: { ...process.env, [ORCAD_BUNDLED_LAUNCHER_ENV]: '1' },
+    // Windows' default child job kills Bun before it can drain on launcher disconnect.
+    detached: true,
+    stdio: ['inherit', 'inherit', 'inherit', 'ipc']
+  })
+  // Node resets nohup's disposition; headless runtimes stop through INT/TERM or owner loss.
+  const ignoreHangup = (): void => {}
+  if (process.platform !== 'win32') {
+    process.on('SIGHUP', ignoreHangup)
+  }
+  const forwards = (['SIGINT', 'SIGTERM'] as const).map((signal) => {
+    const forward = (): void => {
+      if (process.platform === 'win32') {
+        // Detached Windows children have a separate console; kill() skips durable shutdown.
+        if (child.connected) {
+          child.disconnect()
+        }
+      } else {
+        child.kill(signal)
+      }
+    }
+    process.on(signal, forward)
+    return { signal, forward }
+  })
+  const cleanup = (): void => {
+    process.off('SIGHUP', ignoreHangup)
+    for (const { signal, forward } of forwards) {
+      process.off(signal, forward)
+    }
+  }
+  child.once('error', (error) => {
+    cleanup()
+    console.error('orcad: could not start the bundled runtime:', error.message)
+    process.exit(78)
+  })
+  child.once('exit', (code, signal) => {
+    cleanup()
+    if (signal && process.platform !== 'win32') {
+      process.kill(process.pid, signal)
+      return
+    }
+    process.exit(code ?? (signal ? 128 + constants.signals[signal] : 1))
+  })
+  return true
+}
diff --git a/src/main/orcad/orcad-entry.test.ts b/src/main/orcad/orcad-entry.test.ts
new file mode 100644
index 00000000000..5b0fe6fa560
--- /dev/null
+++ b/src/main/orcad/orcad-entry.test.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  flushOrcadProfileStoreForShutdown,
+  installOrcadShutdownSignals,
+  ORCAD_SHUTDOWN_DEADLINE_MS
+} from './orcad-lifecycle'
+
+describe('orcad profile-state shutdown', () => {
+  it('keeps one bounded shutdown even when stop signals repeat', () => {
+    vi.useFakeTimers()
+    let signal: (() => void) | undefined
+    vi.spyOn(process, 'on').mockImplementation((event, listener) => {
+      if (event === 'SIGTERM') {
+        signal = listener
+      }
+      return process
+    })
+    const exit = vi.spyOn(process, 'exit').mockImplementation(() => {
+      throw new Error('shutdown deadline')
+    })
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const stop = vi.fn(() => new Promise<void>(() => {}))
+    try {
+      installOrcadShutdownSignals(stop)
+      signal?.()
+      signal?.()
+      expect(stop).toHaveBeenCalledOnce()
+      expect(exit).not.toHaveBeenCalled()
+      expect(() => vi.advanceTimersByTime(ORCAD_SHUTDOWN_DEADLINE_MS)).toThrow('shutdown deadline')
+      expect(exit).toHaveBeenCalledWith(1)
+    } finally {
+      vi.restoreAllMocks()
+      vi.useRealTimers()
+    }
+  })
+
+  it('flushes durably before closing the profile store', async () => {
+    const events: string[] = []
+    const store = {
+      flushFinalOrThrowAsync: vi.fn(async () => {
+        events.push('flush')
+      }),
+      freezeWritesAsync: vi.fn(async () => {
+        events.push('freeze')
+      })
+    }
+
+    await flushOrcadProfileStoreForShutdown(store)
+
+    expect(store.flushFinalOrThrowAsync).toHaveBeenCalledExactlyOnceWith({
+      exportJsonCompatibility: true
+    })
+    expect(store.freezeWritesAsync).toHaveBeenCalledOnce()
+    expect(events).toEqual(['flush', 'freeze'])
+  })
+
+  it('closes the profile store even when the durable flush fails', async () => {
+    const flushError = new Error('profile flush failed')
+    const freezeWritesAsync = vi.fn(async () => {})
+    const store = {
+      flushFinalOrThrowAsync: vi.fn(async () => {
+        throw flushError
+      }),
+      freezeWritesAsync
+    }
+
+    await expect(flushOrcadProfileStoreForShutdown(store)).rejects.toBe(flushError)
+    expect(freezeWritesAsync).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/orcad/orcad-entry.ts b/src/main/orcad/orcad-entry.ts
index edc4426a2a9..02533588e9d 100644
--- a/src/main/orcad/orcad-entry.ts
+++ b/src/main/orcad/orcad-entry.ts
@@ -1,13 +1,12 @@
 /**
- * `orcad` — the Orca runtime served from plain Node, with no Electron.
+ * `orcad` — the Orca runtime served without Electron.
  *
  * Installs the Node host adapters, constructs the same `OrcaRuntimeService` the
  * desktop uses, installs a PTY controller via `registerHeadlessPtyRuntime`, and
  * serves runtime RPC. See docs/design/node-only-runtime-backend.html.
  *
- * Desktop UI surfaces stay uninstalled: no native notifications, no renderer window. The
- * renderer window is faked as a destroyed one because `registerPtyHandlers` takes a
- * non-null `BrowserWindow`. Browser automation is different — it is installed through
+ * Desktop UI surfaces stay uninstalled: no native notifications or renderer delivery.
+ * Browser automation is installed through
  * the runtime factory, but only when an Electron serve sidecar or an operator-supplied
  * Chromium proves available at startup.
  */
@@ -15,16 +14,13 @@ import process from 'node:process'
 import { setAppEnvironment, type AppEnvironment } from '../../shared/app-environment'
 import { setSecretStore, type SecretStore } from '../../shared/secret-store'
 import type { ServeReadiness } from '../server/serve-readiness'
-import { setRuntimeBrowserCommandsFactory } from '../runtime/runtime-browser-commands-factory'
-import { resolveOrcadBrowserProvider } from './orcad-browser-provider'
 import { resolveOrcadInstallRoot, resolveOrcadPath, resolveUserDataPath } from './orcad-app-paths'
+import { describeOrcadBindExposure, resolveOrcadBindHost } from './orcad-bind-address'
 import {
-  describeOrcadBindExposure,
-  OrcadBindAddressError,
-  resolveOrcadBindHost
-} from './orcad-bind-address'
-import { acquireOrcadInstanceLock, OrcadInstanceLockError } from './orcad-instance-lock'
-import { startOrcadWithLifecycle } from './orcad-lifecycle'
+  flushOrcadProfileStoreForShutdown,
+  installOrcadShutdownSignals,
+  startOrcadWithHost
+} from './orcad-lifecycle'
 import { parseArgs } from './orcad-command-arguments'
 import {
   changedAiVaultSearchSettings,
@@ -110,27 +106,10 @@ export type OrcadHandle = {
  */
 export async function startOrcad(options: OrcadOptions = {}): Promise<OrcadHandle> {
   installOrcadHostAdapters()
-  const userDataPath = resolveUserDataPath()
-  // Why before anything else touches the root: the profile index, the store and the daemon
-  // runtime dir all live under it, and two orcads sharing them corrupt state silently. This
-  // is also the last point at which refusing costs nothing.
-  const instanceLock = acquireOrcadInstanceLock(userDataPath)
-  const browserProvider = await resolveOrcadBrowserProvider({ userDataPath })
-  setRuntimeBrowserCommandsFactory(browserProvider?.factory ?? null, {
-    headless: browserProvider !== null,
-    ...(browserProvider ? { isAvailable: () => browserProvider.isAvailable() } : {})
-  })
-  return startOrcadWithLifecycle(
+  return startOrcadWithHost(
+    resolveUserDataPath(),
     (registerCleanup) => startOrcadRuntime(options, registerCleanup),
-    async () => {
-      try {
-        await browserProvider?.stop()
-      } finally {
-        setRuntimeBrowserCommandsFactory(null)
-        runOrcadQuitHandlers()
-        instanceLock.release()
-      }
-    }
+    () => runOrcadQuitHandlers()
   )
 }
 
@@ -145,10 +124,7 @@ async function startOrcadRuntime(
   const { getAppEnvironment } = await import('../../shared/app-environment')
   const { resolveAdvertisedPairingEndpoint } = await import('../runtime/pairing-endpoint')
   const { ServeReadinessPublisher } = await import('../server/serve-readiness')
-  const { Store } = await import('../persistence/loading-store/store')
-  const { ensureActiveOrcaProfile, initOrcaProfilePaths } =
-    await import('../orca-profiles/profile-index-store')
-  const { initSshHostKeyStoreFile } = await import('../ssh/ssh-host-key-store')
+  const { createOrcadProfileStateStartup } = await import('./orcad-profile-state-startup')
   const { startOrcadDaemon, stopOrcadDaemon } = await import('./orcad-daemon-supervision')
   const { daemonOwnsFreshPersistentPtys } = await import('../daemon/daemon-init')
   const { collectOrcadHealth } = await import('./orcad-health')
@@ -162,6 +138,9 @@ async function startOrcadRuntime(
     await import('../runtime/agent-status-observed-pane-identity')
 
   let rpc: InstanceType<typeof OrcaRuntimeRpcServer> | null = null
+  let profileStoreForShutdown:
+    | { flushFinalOrThrowAsync(): Promise<void>; freezeWritesAsync(): Promise<void> }
+    | undefined
   let uninstallHookStatusRepublish = (): void => {}
   let uninstallObservedStatusIdentity = (): void => {}
   registerCleanup(async () => {
@@ -169,13 +148,21 @@ async function startOrcadRuntime(
       await rpc?.stop()
     } finally {
       try {
-        // Why disconnect and not shut down: the daemon must outlive this process, or an
-        // orcad restart goes back to killing every running terminal.
-        await stopOrcadDaemon()
+        // Stop accepting RPC writes before the final persistence barrier. A SQLite-backed
+        // orcad has no JSON mirror to absorb a debounced write after SIGTERM.
+        if (profileStoreForShutdown) {
+          await flushOrcadProfileStoreForShutdown(profileStoreForShutdown)
+        }
       } finally {
-        uninstallObservedStatusIdentity()
-        uninstallHookStatusRepublish()
-        agentHookServer.stop()
+        try {
+          // Why disconnect and not shut down: the daemon must outlive this process, or an
+          // orcad restart goes back to killing every running terminal.
+          await stopOrcadDaemon()
+        } finally {
+          uninstallObservedStatusIdentity()
+          uninstallHookStatusRepublish()
+          agentHookServer.stop()
+        }
       }
     }
   })
@@ -183,8 +170,8 @@ async function startOrcadRuntime(
   const { resolvePushGatewayOrigin } = await import('../runtime/push/push-gateway-origin')
 
   const runtimeUserDataPath = getAppEnvironment().getPath('userData')
-  initOrcaProfilePaths()
-  const profile = ensureActiveOrcaProfile(runtimeUserDataPath)
+  const { store: profileStore, authority: profileStateAuthority } =
+    await createOrcadProfileStateStartup(runtimeUserDataPath)
   const observedPaneIdentities = new AgentStatusObservedPaneIdentities()
   const observedStatusCapture = new AgentStatusObservedPaneIdentityCapture(observedPaneIdentities)
   // Why a real Store: without one every persistence-backed RPC throws `runtime_unavailable`
@@ -192,15 +179,14 @@ async function startOrcadRuntime(
   // a server that pairs and lists nothing looks healthy and is not.
   // Why: orcad IS the runtime authority — loading as 'desktop' would classify its
   // own runtime-scheduled automations as ambiguous mirrors and orphan them.
-  const store = new Store({ dataFile: profile.dataFile, storageAuthority: 'runtime' })
+  profileStoreForShutdown = profileStore
   // Why: every SSH connect consults this sidecar. Left unbound it reports nothing trusted,
   // which is safe but silently discards accept records on every launch.
-  initSshHostKeyStoreFile(profile.dataFile)
 
   uninstallObservedStatusIdentity = agentHookServer.subscribeEnrichedStatus((enriched) =>
     observedStatusCapture.observe(enriched)
   )
-  if (isAgentStatusHooksEnabled(store.getSettings())) {
+  if (isAgentStatusHooksEnabled(profileStore.getSettings())) {
     await agentHookServer.start({ env: 'production', userDataPath: runtimeUserDataPath })
   }
 
@@ -213,7 +199,7 @@ async function startOrcadRuntime(
   // constructed, and the deps hook is only ever called later, from an RPC.
   let sessionSearch: { apply(settings: AiVaultSearchSettings): void; dispose(): void } | null = null
 
-  const runtime = new OrcaRuntimeService(store, undefined, {
+  const runtime = new OrcaRuntimeService(profileStore, undefined, {
     // Why lazy: a daemon swap replaces the provider after construction, so an eager
     // reference would freeze the pre-daemon one.
     getLocalProvider: () => getLocalPtyProvider(),
@@ -252,7 +238,7 @@ async function startOrcadRuntime(
     reconcileAgentStatusForEndedProcess: (paneKeys) =>
       agentHookServer.reconcileEndedProcessForPaneKeys(paneKeys),
     buildAgentHookPtyEnv: () =>
-      isAgentStatusHooksEnabled(store.getSettings()) ? agentHookServer.buildPtyEnv() : {},
+      isAgentStatusHooksEnabled(profileStore.getSettings()) ? agentHookServer.buildPtyEnv() : {},
     // Why the dedupe here and not in the instance: `apply` closes and reconstructs
     // unconditionally, so an unchanged value would restart a healthy index.
     applySessionSearchSettings: (before, after) => {
@@ -266,7 +252,7 @@ async function startOrcadRuntime(
   const { installOrcadSessionSearchService } = await import('./orcad-session-search')
   sessionSearch = await installOrcadSessionSearchService({
     userDataPath: runtimeUserDataPath,
-    getSettings: () => store.getSettings()
+    getSettings: () => profileStore.getSettings()
   })
   getAppEnvironment().onWillQuit(() => sessionSearch?.dispose())
 
@@ -284,7 +270,13 @@ async function startOrcadRuntime(
   // Codex-home and Claude-auth preparation are left unset: both are desktop account
   // flows. A launch that needs one fails with its own message rather than silently
   // spawning an unauthenticated agent.
-  await registerHeadlessPtyRuntime(runtime, undefined, () => store.getSettings(), undefined, store)
+  await registerHeadlessPtyRuntime(
+    runtime,
+    undefined,
+    () => profileStore.getSettings(),
+    undefined,
+    profileStore
+  )
 
   // Why: same post-registration reconciliation `--serve` performs. Skipping it leaves
   // restored orchestration rows claiming an authority this host never took over.
@@ -356,7 +348,7 @@ async function startOrcadRuntime(
     // Why in the readiness payload: this is the one message a supervisor and a deploy
     // transaction both read, and a green orcad with a dead daemon is exactly the
     // looks-healthy-but-useless state they must not activate.
-    health: await collectOrcadHealth(getAppEnvironment().getVersion())
+    health: await collectOrcadHealth(getAppEnvironment().getVersion(), profileStateAuthority)
   }
 
   await new ServeReadinessPublisher().publish(readiness, {
@@ -374,50 +366,18 @@ async function startOrcadRuntime(
  * supervision contract has to prevent, so systemd's `RestartPreventExitStatus` needs a code
  * that means "do not retry" and nothing else does.
  */
-export const ORCAD_EXIT_OK = 0
-export const ORCAD_EXIT_FAILED = 1
-export const ORCAD_EXIT_CONFIGURATION = 78
+export {
+  ORCAD_EXIT_OK,
+  ORCAD_EXIT_FAILED,
+  ORCAD_EXIT_CONFIGURATION,
+  resolveOrcadExitCode
+} from './orcad-exit-code'
 
 /** Bounded so a wedged transport cannot hold a supervisor's stop past its own deadline. */
-export const ORCAD_SHUTDOWN_DEADLINE_MS = 15_000
-
-export function resolveOrcadExitCode(error: unknown): number {
-  return error instanceof OrcadInstanceLockError || error instanceof OrcadBindAddressError
-    ? ORCAD_EXIT_CONFIGURATION
-    : ORCAD_EXIT_FAILED
-}
+export { ORCAD_SHUTDOWN_DEADLINE_MS } from './orcad-lifecycle'
 
 export async function main(argv: string[] = process.argv.slice(2)): Promise<void> {
-  const handle = await startOrcad(parseArgs(argv))
-  let stopping = false
-  const shutdown = (signal: NodeJS.Signals): void => {
-    if (stopping) {
-      // Why escalate rather than ignore: a supervisor's second signal means the first
-      // deadline elapsed. Continuing to wait silently is what makes a stop hang until
-      // SIGKILL, which is the one teardown that skips the daemon handoff entirely.
-      console.error(`orcad: second ${signal} during shutdown — exiting immediately`)
-      process.exit(ORCAD_EXIT_FAILED)
-    }
-    stopping = true
-    // Why a self-imposed deadline as well: the supervisor's SIGKILL leaves no exit code and
-    // no log line. Exiting ourselves keeps the failure attributable.
-    const deadline = setTimeout(() => {
-      console.error(
-        `orcad: shutdown after ${signal} exceeded ${ORCAD_SHUTDOWN_DEADLINE_MS}ms — exiting`
-      )
-      process.exit(ORCAD_EXIT_FAILED)
-    }, ORCAD_SHUTDOWN_DEADLINE_MS)
-    deadline.unref()
-    handle
-      .stop()
-      .then(() => process.exit(ORCAD_EXIT_OK))
-      // Why not rethrow: we are already tearing down on a signal, and an exit code is
-      // the only thing a supervisor can act on.
-      .catch((error) => {
-        console.error(`orcad: shutdown after ${signal} failed:`, error)
-        process.exit(ORCAD_EXIT_FAILED)
-      })
-  }
-  process.on('SIGINT', () => shutdown('SIGINT'))
-  process.on('SIGTERM', () => shutdown('SIGTERM'))
+  const startup = startOrcad(parseArgs(argv))
+  installOrcadShutdownSignals(async () => (await startup).stop())
+  await startup
 }
diff --git a/src/main/orcad/orcad-exit-code.ts b/src/main/orcad/orcad-exit-code.ts
new file mode 100644
index 00000000000..8b07dd2f5c9
--- /dev/null
+++ b/src/main/orcad/orcad-exit-code.ts
@@ -0,0 +1,18 @@
+import { OrcadBindAddressError } from './orcad-bind-address'
+import { OrcadBundledRuntimeError } from './orcad-bundled-runtime'
+import { OrcadInstanceLockError } from './orcad-instance-lock'
+import { ProfileStateAccessError } from '../persistence/profile-state/profile-state-access'
+
+export const ORCAD_EXIT_OK = 0
+export const ORCAD_EXIT_FAILED = 1
+export const ORCAD_EXIT_CONFIGURATION = 78
+
+/** Configuration faults cannot be repaired by a supervisor restart. */
+export function resolveOrcadExitCode(error: unknown): number {
+  return error instanceof OrcadInstanceLockError ||
+    error instanceof OrcadBindAddressError ||
+    error instanceof OrcadBundledRuntimeError ||
+    error instanceof ProfileStateAccessError
+    ? ORCAD_EXIT_CONFIGURATION
+    : ORCAD_EXIT_FAILED
+}
diff --git a/src/main/orcad/orcad-health.test.ts b/src/main/orcad/orcad-health.test.ts
index c77f18477f0..70e02b37e87 100644
--- a/src/main/orcad/orcad-health.test.ts
+++ b/src/main/orcad/orcad-health.test.ts
@@ -134,6 +134,24 @@ describe('collectOrcadHealth', () => {
     expect(health.platform).toBe(process.platform)
     expect(health.terminalDaemon.state).toBe('live')
   })
+
+  it('includes bounded profile-state authority metadata when supplied', async () => {
+    const health = await collectOrcadHealth('1.2.3', {
+      backend: 'sqlite',
+      classification: 'sqlite-only',
+      authority_mode: 'sqlite-established',
+      runtime: 'orcad',
+      migrated: false
+    })
+
+    expect(health.profileStateAuthority).toEqual({
+      backend: 'sqlite',
+      classification: 'sqlite-only',
+      authority_mode: 'sqlite-established',
+      runtime: 'orcad',
+      migrated: false
+    })
+  })
 })
 
 describe('computeOrcadBuildHash', () => {
diff --git a/src/main/orcad/orcad-health.ts b/src/main/orcad/orcad-health.ts
index d9a567531ac..0c3a3525171 100644
--- a/src/main/orcad/orcad-health.ts
+++ b/src/main/orcad/orcad-health.ts
@@ -17,6 +17,7 @@ import {
   getDaemonEndpointFacts,
   readDaemonPidRecord
 } from '../daemon/daemon-init'
+import type { OrcadProfileStateAuthoritySelection } from './orcad-profile-state-telemetry'
 
 /**
  * How much a green self-test actually proves.
@@ -64,6 +65,8 @@ export type OrcadHealth = {
   arch: string
   pid: number
   terminalDaemon: TerminalDaemonHealth
+  /** The low-cardinality profile-state authority selected during startup, when available. */
+  profileStateAuthority?: OrcadProfileStateAuthoritySelection
 }
 
 /**
@@ -146,7 +149,10 @@ export async function collectTerminalDaemonHealth(): Promise<TerminalDaemonHealt
   }
 }
 
-export async function collectOrcadHealth(buildVersion: string): Promise<OrcadHealth> {
+export async function collectOrcadHealth(
+  buildVersion: string,
+  profileStateAuthority?: OrcadProfileStateAuthoritySelection
+): Promise<OrcadHealth> {
   return {
     buildHash: computeOrcadBuildHash(),
     buildVersion,
@@ -155,6 +161,7 @@ export async function collectOrcadHealth(buildVersion: string): Promise<OrcadHea
     platform: process.platform,
     arch: process.arch,
     pid: process.pid,
-    terminalDaemon: await collectTerminalDaemonHealth()
+    terminalDaemon: await collectTerminalDaemonHealth(),
+    ...(profileStateAuthority ? { profileStateAuthority } : {})
   }
 }
diff --git a/src/main/orcad/orcad-launch-contract.test.ts b/src/main/orcad/orcad-launch-contract.test.ts
index 2d2e4e6157e..26f2f28cbed 100644
--- a/src/main/orcad/orcad-launch-contract.test.ts
+++ b/src/main/orcad/orcad-launch-contract.test.ts
@@ -12,6 +12,8 @@ import {
 import { startOrcadWithLifecycle } from './orcad-lifecycle'
 import { OrcadBindAddressError } from './orcad-bind-address'
 import { OrcadInstanceLockError } from './orcad-instance-lock'
+import { ProfileStateAccessError } from '../persistence/profile-state/profile-state-access'
+import { OrcadBundledRuntimeError } from './orcad-bundled-runtime'
 
 describe('parseArgs', () => {
   it('accepts --bind and leaves it unset when absent', () => {
@@ -38,7 +40,13 @@ describe('resolveOrcadExitCode', () => {
       resolveOrcadExitCode(new OrcadInstanceLockError('orcad_instance_lock_held', 'held'))
     ).toBe(ORCAD_EXIT_CONFIGURATION)
     expect(resolveOrcadExitCode(new OrcadBindAddressError('bad'))).toBe(ORCAD_EXIT_CONFIGURATION)
+    expect(resolveOrcadExitCode(new ProfileStateAccessError('recovery interrupted'))).toBe(
+      ORCAD_EXIT_CONFIGURATION
+    )
     expect(resolveOrcadExitCode(new Error('port in use'))).toBe(ORCAD_EXIT_FAILED)
+    expect(resolveOrcadExitCode(new OrcadBundledRuntimeError('partial installation'))).toBe(
+      ORCAD_EXIT_CONFIGURATION
+    )
     expect(ORCAD_EXIT_CONFIGURATION).not.toBe(ORCAD_EXIT_FAILED)
   })
 })
@@ -57,7 +65,7 @@ describe('orcad lifecycle cleanup', () => {
     ).rejects.toThrow('startup failed')
 
     expect(cleanupRuntime).toHaveBeenCalledOnce()
-    expect(cleanupHost).toHaveBeenCalledOnce()
+    expect(cleanupHost).toHaveBeenCalledExactlyOnceWith(true)
   })
 
   it('preserves the startup error when rollback also fails', async () => {
@@ -96,4 +104,17 @@ describe('orcad lifecycle cleanup', () => {
     expect(cleanupRuntime).toHaveBeenCalledOnce()
     expect(cleanupHost).toHaveBeenCalledOnce()
   })
+
+  it('keeps the host aware of failed runtime teardown so it cannot release profile admission', async () => {
+    const failure = new Error('profile writer still running')
+    const cleanupHost = vi.fn(async () => {})
+    const handle = await startOrcadWithLifecycle(async (registerCleanup) => {
+      registerCleanup(async () => {
+        throw failure
+      })
+      return {}
+    }, cleanupHost)
+    await expect(handle.stop()).rejects.toBe(failure)
+    expect(cleanupHost).toHaveBeenCalledExactlyOnceWith(false)
+  })
 })
diff --git a/src/main/orcad/orcad-lifecycle.ts b/src/main/orcad/orcad-lifecycle.ts
index 913a21c4874..bfff3b7f14e 100644
--- a/src/main/orcad/orcad-lifecycle.ts
+++ b/src/main/orcad/orcad-lifecycle.ts
@@ -1,3 +1,16 @@
+import { setRuntimeBrowserCommandsFactory } from '../runtime/runtime-browser-commands-factory'
+import { resolveOrcadBrowserProvider } from './orcad-browser-provider'
+import { acquireOrcadInstanceLock } from './orcad-instance-lock'
+import { ORCAD_BUNDLED_LAUNCHER_ENV } from './orcad-bundled-runtime'
+import { resolveOrcadExitCode } from './orcad-exit-code'
+import {
+  acquireProfileStateRuntimeAdmission,
+  type ProfileStateRuntimeAdmission
+} from '../persistence/profile-state/profile-state-access'
+
+const bundledLauncherChannel = process.env[ORCAD_BUNDLED_LAUNCHER_ENV] === '1'
+delete process.env[ORCAD_BUNDLED_LAUNCHER_ENV]
+
 function createIdempotentOrcadCleanup(cleanup: () => Promise<void>): () => Promise<void> {
   let completion: Promise<void> | null = null
   return () => {
@@ -6,16 +19,56 @@ function createIdempotentOrcadCleanup(cleanup: () => Promise<void>): () => Promi
   }
 }
 
+export const ORCAD_SHUTDOWN_DEADLINE_MS = 15_000
+
+/** A launcher and its child can both receive the same process-group or service stop signal. */
+export function installOrcadShutdownSignals(
+  stop: () => Promise<void>,
+  deadlineMs = ORCAD_SHUTDOWN_DEADLINE_MS
+): void {
+  let stopping = false
+  const shutdown = (signal: string): void => {
+    if (stopping) {
+      return
+    }
+    stopping = true
+    setTimeout(() => {
+      console.error(`orcad: shutdown after ${signal} exceeded ${deadlineMs}ms — exiting`)
+      process.exit(1)
+    }, deadlineMs)
+    stop()
+      .then(() => process.exit(0))
+      .catch((error) => {
+        console.error(`orcad: shutdown after ${signal} failed:`, error)
+        process.exit(resolveOrcadExitCode(error))
+      })
+  }
+  process.on('SIGINT', () => shutdown('SIGINT'))
+  process.on('SIGTERM', () => shutdown('SIGTERM'))
+  // Headless runtimes survive terminal hangups; INT/TERM are the graceful stop contract.
+  if (process.platform !== 'win32') {
+    process.on('SIGHUP', () => {})
+  }
+  if (bundledLauncherChannel && typeof process.send === 'function') {
+    process.once('disconnect', () => shutdown('launcher disconnect'))
+    if (!process.connected) {
+      shutdown('launcher disconnect')
+    }
+  }
+}
+
 export async function startOrcadWithLifecycle<T extends object>(
   start: (registerRuntimeCleanup: (cleanup: () => Promise<void>) => void) => Promise<T>,
-  cleanupHost: () => Promise<void>
+  cleanupHost: (runtimeCleanupSucceeded: boolean) => Promise<void>
 ): Promise<T & { stop(): Promise<void> }> {
   let cleanupRuntime = async (): Promise<void> => {}
   const cleanup = createIdempotentOrcadCleanup(async () => {
+    let runtimeCleanupSucceeded = false
     try {
       await cleanupRuntime()
+      runtimeCleanupSucceeded = true
     } finally {
-      await cleanupHost()
+      await cleanupHost(runtimeCleanupSucceeded)
     }
   })
   try {
@@ -33,3 +86,53 @@ export async function startOrcadWithLifecycle<T extends object>(
     throw error
   }
 }
+
+/** Keep profile admission until every runtime writer has stopped. */
+export async function startOrcadWithHost<T extends object>(
+  userDataPath: string,
+  start: (registerCleanup: (cleanup: () => Promise<void>) => void) => Promise<T>,
+  runQuitHandlers: () => void
+): Promise<T & { stop(): Promise<void> }> {
+  const instanceLock = acquireOrcadInstanceLock(userDataPath)
+  let admission: ProfileStateRuntimeAdmission | undefined
+  let browserProvider: Awaited<ReturnType<typeof resolveOrcadBrowserProvider>> | undefined
+  return startOrcadWithLifecycle(
+    async (registerCleanup) => {
+      admission = acquireProfileStateRuntimeAdmission(userDataPath)
+      browserProvider = await resolveOrcadBrowserProvider({ userDataPath })
+      const provider = browserProvider
+      setRuntimeBrowserCommandsFactory(provider?.factory ?? null, {
+        headless: provider !== null,
+        ...(provider ? { isAvailable: () => provider.isAvailable() } : {})
+      })
+      return start(registerCleanup)
+    },
+    async (runtimeCleanupSucceeded) => {
+      try {
+        await browserProvider?.stop()
+      } finally {
+        setRuntimeBrowserCommandsFactory(null)
+        runQuitHandlers()
+        try {
+          // Failed teardown excludes recovery until the process actually exits.
+          if (runtimeCleanupSucceeded) {
+            admission?.release()
+          }
+        } finally {
+          instanceLock.release()
+        }
+      }
+    }
+  )
+}
+
+export async function flushOrcadProfileStoreForShutdown(store: {
+  flushFinalOrThrowAsync(options?: { exportJsonCompatibility?: boolean }): Promise<void>
+  freezeWritesAsync(): Promise<void>
+}): Promise<void> {
+  try {
+    await store.flushFinalOrThrowAsync({ exportJsonCompatibility: true })
+  } finally {
+    await store.freezeWritesAsync()
+  }
+}
diff --git a/src/main/orcad/orcad-native-preflight.ts b/src/main/orcad/orcad-native-preflight.ts
index 0f3c2cf8970..ee2f323dbe5 100644
--- a/src/main/orcad/orcad-native-preflight.ts
+++ b/src/main/orcad/orcad-native-preflight.ts
@@ -5,6 +5,7 @@
  * testable apart from the detection (what the verdict is).
  */
 import process from 'node:process'
+import { canUseBunPty } from '../daemon/pty-subprocess/bun-pty-process-capabilities'
 import { setRuntimeTerminalUnavailableCause } from '../runtime/native-terminal-availability'
 import { terminalUnavailableMessage } from '../../shared/runtime-types'
 import {
@@ -37,6 +38,10 @@ export type NativePreflightHooks = {
  * sentence printed here.
  */
 export function runOrcadNativePreflight(hooks: NativePreflightHooks = {}): boolean {
+  if (!hooks.check && canUseBunPty()) {
+    setRuntimeTerminalUnavailableCause(null)
+    return true
+  }
   const check = hooks.check ?? checkNodePtyPrecondition
   const warn = hooks.warn ?? ((message: string) => console.warn(message))
   const fail = hooks.fail ?? ((message: string) => console.error(message))
diff --git a/src/main/orcad/orcad-profile-preflight.test.ts b/src/main/orcad/orcad-profile-preflight.test.ts
new file mode 100644
index 00000000000..9c51e1a349e
--- /dev/null
+++ b/src/main/orcad/orcad-profile-preflight.test.ts
@@ -0,0 +1,197 @@
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ProcessResult, ProcessSpec } from '../../shared/child-process/run-process'
+import { ORCAD_BUN_VERSION } from '../../shared/orcad-bun-runtime'
+import { ORCAD_STARTUP_PREFLIGHT_FLAG } from '../../shared/orcad-profile-preflight'
+import { OrcadBundledRuntimeError } from './orcad-bundled-runtime'
+import { resolveOrcadExitCode } from './orcad-exit-code'
+import { preflightBundledOrcadStartup, runOrcadProfilePreflight } from './orcad-profile-preflight'
+
+const fixture = vi.hoisted(() => ({
+  identity: vi.fn(),
+  readVersion: vi.fn(),
+  sql: vi.fn(),
+  native: vi.fn(),
+  run: vi.fn<(spec: ProcessSpec) => Promise<ProcessResult>>()
+}))
+vi.mock('./orcad-artifact-identity', () => ({ readOrcadArtifactIdentity: fixture.identity }))
+vi.mock('./orcad-app-paths', () => ({ resolveOrcadInstallRoot: () => '/slot' }))
+vi.mock('node:fs/promises', () => ({ readFile: fixture.readVersion }))
+vi.mock('../persistence/profile-state/profile-state-runtime-preflight', () => ({
+  preflightProfileStateRuntime: fixture.sql
+}))
+vi.mock('./orcad-bun-native-preflight', () => ({
+  preflightOrcadBunNativeRuntime: fixture.native
+}))
+vi.mock('../../shared/child-process/run-process', () => ({ runProcess: fixture.run }))
+
+const identity = '0.1.0+aaaaaaaaaaaa'
+const nonce = '743bf9c8-2e58-4c79-a0ac-52c8d3e8e103'
+
+function readyResult(challenge: string | undefined): ProcessResult {
+  return {
+    code: 0,
+    signal: null,
+    timedOut: false,
+    stderr: '',
+    stdout: JSON.stringify({
+      type: 'orca_profile_state_ready',
+      nonce: challenge,
+      runtime: 'bun',
+      runtimeVersion: ORCAD_BUN_VERSION,
+      artifactVersion: identity,
+      sqliteVersion: '3.53.2',
+      revision: 1
+    })
+  }
+}
+
+beforeEach(() => {
+  vi.spyOn(process, 'versions', 'get').mockReturnValue({
+    ...process.versions,
+    bun: ORCAD_BUN_VERSION
+  })
+  fixture.identity.mockResolvedValue(identity)
+  fixture.readVersion.mockResolvedValue(`${identity}\n`)
+  fixture.sql.mockResolvedValue({ sqliteVersion: '3.53.2', revision: 1 })
+  fixture.native.mockResolvedValue(undefined)
+  fixture.run.mockImplementation(async (spec) => readyResult(spec.args?.[2]))
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.resetAllMocks()
+})
+
+describe('bundled Orca startup readiness', () => {
+  it.each(['win32', 'darwin', 'linux'] as const)(
+    'isolates native process state in the exact bundled %s executable',
+    async (platform) => {
+      vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+      await preflightBundledOrcadStartup()
+      expect(fixture.run).toHaveBeenCalledOnce()
+      expect(fixture.run).toHaveBeenCalledWith({
+        program: join('/slot', platform === 'win32' ? 'bun-runtime.exe' : 'bun-runtime'),
+        args: [join('/slot', 'orcad.js'), ORCAD_STARTUP_PREFLIGHT_FLAG, expect.any(String)],
+        env: expect.objectContaining({ ORCA_BACKGROUND_LAUNCH: '1' }),
+        timeoutMs: 90_000,
+        maxOutputBytes: 64 * 1024,
+        terminationBarrier: true
+      })
+      expect(fixture.sql).not.toHaveBeenCalled()
+      expect(fixture.native).not.toHaveBeenCalled()
+    }
+  )
+
+  it('leaves legacy Node startup on its existing readiness path', async () => {
+    const { bun: _bun, ...versions } = process.versions
+    vi.spyOn(process, 'versions', 'get').mockReturnValue(versions)
+    await preflightBundledOrcadStartup()
+    expect(fixture.identity).not.toHaveBeenCalled()
+    expect(fixture.run).not.toHaveBeenCalled()
+  })
+
+  it('hashes installed bytes only in the isolated child', async () => {
+    await preflightBundledOrcadStartup()
+    expect(fixture.identity).not.toHaveBeenCalled()
+    vi.spyOn(console, 'log').mockImplementation(() => {})
+    await runOrcadProfilePreflight(nonce, { nativeFeatures: false })
+    expect(fixture.identity).toHaveBeenCalledOnce()
+  })
+
+  it.each(['missing artifact', 'corrupt build target'])(
+    'classifies %s as a configuration fault before testing SQLite',
+    async (message) => {
+      fixture.identity.mockRejectedValue(new Error(message))
+      const failure = await runOrcadProfilePreflight(nonce).catch((error: unknown) => error)
+      expect(failure).toBeInstanceOf(OrcadBundledRuntimeError)
+      expect(resolveOrcadExitCode(failure)).toBe(78)
+      expect(fixture.sql).not.toHaveBeenCalled()
+    }
+  )
+
+  it('classifies changed artifact bytes as configuration faults on normal startup', async () => {
+    fixture.readVersion.mockResolvedValue('0.1.0+bbbbbbbbbbbb')
+    await expect(preflightBundledOrcadStartup()).rejects.toThrow(OrcadBundledRuntimeError)
+  })
+
+  it.each([undefined, 'broken-version'])(
+    'classifies an unreadable or malformed version marker as configuration: %s',
+    async (version) => {
+      if (version === undefined) {
+        fixture.readVersion.mockRejectedValue(new Error('ENOENT'))
+      } else {
+        fixture.readVersion.mockResolvedValue(version)
+      }
+      await expect(preflightBundledOrcadStartup()).rejects.toThrow(OrcadBundledRuntimeError)
+      expect(fixture.run).not.toHaveBeenCalled()
+    }
+  )
+
+  it('awaits probe termination before permitting server startup', async () => {
+    const exit = Promise.withResolvers<ProcessResult>()
+    fixture.run.mockReturnValue(exit.promise)
+    let admitted = false
+    const startup = preflightBundledOrcadStartup().then(() => {
+      admitted = true
+    })
+    await vi.waitFor(() => expect(fixture.run).toHaveBeenCalledOnce())
+    expect(admitted).toBe(false)
+    exit.resolve(readyResult(fixture.run.mock.calls[0]?.[0].args?.[2]))
+    await startup
+    expect(admitted).toBe(true)
+  })
+
+  it.each([{ code: 78 }, { timedOut: true }, { outputTruncated: true }])(
+    'refuses a failed child even if it emitted a valid readiness reply: %j',
+    async (failure) => {
+      fixture.run.mockImplementation(async (spec) => ({
+        ...readyResult(spec.args?.[2]),
+        ...failure,
+        stderr: 'native probe failed'
+      }))
+      await expect(preflightBundledOrcadStartup()).rejects.toThrow('native probe failed')
+    }
+  )
+
+  it('preserves configuration exit status from the isolated child', async () => {
+    fixture.run.mockImplementation(async (spec) => ({ ...readyResult(spec.args?.[2]), code: 78 }))
+    const failure = await preflightBundledOrcadStartup().catch((error: unknown) => error)
+    expect(resolveOrcadExitCode(failure)).toBe(78)
+  })
+
+  it('keeps transient SQLite readiness failures retryable', async () => {
+    fixture.sql.mockRejectedValue(new Error('SQLITE_BUSY'))
+    const failure = await runOrcadProfilePreflight(nonce).catch((error: unknown) => error)
+    expect(resolveOrcadExitCode(failure)).toBe(1)
+  })
+
+  it('leaves optional native probes to runtime health on normal startup', async () => {
+    vi.spyOn(console, 'log').mockImplementation(() => {})
+    await runOrcadProfilePreflight(nonce, { nativeFeatures: false })
+    expect(fixture.sql).toHaveBeenCalledOnce()
+    expect(fixture.native).toHaveBeenCalledWith({ nativeFeatures: false })
+  })
+
+  it('rejects stale output from a different challenge', async () => {
+    fixture.run.mockResolvedValue(readyResult(nonce))
+    await expect(preflightBundledOrcadStartup()).rejects.toThrow('invalid readiness identity')
+  })
+
+  it('rechecks the child artifact identity against the verified installed version', async () => {
+    fixture.run.mockImplementation(async (spec) => {
+      const result = readyResult(spec.args?.[2])
+      return { ...result, stdout: result.stdout.replace(identity, '0.1.0+bbbbbbbbbbbb') }
+    })
+    await expect(preflightBundledOrcadStartup()).rejects.toThrow('invalid readiness identity')
+  })
+
+  it('runs disposable probes directly in the command child without recursive spawning', async () => {
+    const output = vi.spyOn(console, 'log').mockImplementation(() => {})
+    await runOrcadProfilePreflight(nonce)
+    expect(fixture.sql).toHaveBeenCalledOnce()
+    expect(fixture.native).toHaveBeenCalledOnce()
+    expect(fixture.run).not.toHaveBeenCalled()
+    expect(output).toHaveBeenCalledWith(readyResult(nonce).stdout)
+  })
+})
diff --git a/src/main/orcad/orcad-profile-preflight.ts b/src/main/orcad/orcad-profile-preflight.ts
new file mode 100644
index 00000000000..eeb5bb611dd
--- /dev/null
+++ b/src/main/orcad/orcad-profile-preflight.ts
@@ -0,0 +1,93 @@
+import { z } from 'zod'
+import { randomUUID } from 'node:crypto'
+import { readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { preflightProfileStateRuntime } from '../persistence/profile-state/profile-state-runtime-preflight'
+import {
+  ORCAD_STARTUP_PREFLIGHT_FLAG,
+  ORCAD_PROFILE_PREFLIGHT_TIMEOUT_MS,
+  parseOrcadProfilePreflight,
+  orcadProfilePreflightResponseSchema,
+  type OrcadProfilePreflightResponse
+} from '../../shared/orcad-profile-preflight'
+import { readOrcadArtifactIdentity } from './orcad-artifact-identity'
+import { resolveOrcadInstallRoot } from './orcad-app-paths'
+import { ORCAD_VERSION_FILENAME, orcadBunRuntimeFilename } from '../../shared/orcad-artifacts'
+import { ORCAD_BUN_VERSION } from '../../shared/orcad-bun-runtime'
+import { runProcess } from '../../shared/child-process/run-process'
+import { preflightOrcadBunNativeRuntime } from './orcad-bun-native-preflight'
+import { OrcadBundledRuntimeError } from './orcad-bundled-runtime'
+
+/** Check every packaged start before a profile index, data-root lock or import is touched. */
+export async function preflightBundledOrcadStartup(): Promise<void> {
+  if (!process.versions.bun) {
+    return
+  }
+  const directory = resolveOrcadInstallRoot()
+  const identity = await readInstalledVersion(directory)
+  const nonce = randomUUID()
+  // Keep disposable SQLite ownership and native state out of the serving process.
+  const result = await runProcess({
+    program: join(directory, orcadBunRuntimeFilename(process.platform)),
+    args: [join(directory, 'orcad.js'), ORCAD_STARTUP_PREFLIGHT_FLAG, nonce],
+    env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1' },
+    timeoutMs: ORCAD_PROFILE_PREFLIGHT_TIMEOUT_MS,
+    maxOutputBytes: 64 * 1024,
+    terminationBarrier: true
+  })
+  if (result.code !== 0 || result.timedOut || result.outputTruncated) {
+    const Failure = result.code === 78 ? OrcadBundledRuntimeError : Error
+    throw new Failure(`The bundled Orca runtime failed readiness: ${result.stderr}`)
+  }
+  try {
+    parseOrcadProfilePreflight(result.stdout, nonce, ORCAD_BUN_VERSION, identity)
+  } catch (cause) {
+    throw new OrcadBundledRuntimeError('The bundled runtime returned invalid readiness identity', {
+      cause
+    })
+  }
+}
+
+/** Only disposable state is opened; no server, profile index or host adapters are installed. */
+export async function runOrcadProfilePreflight(
+  nonce: string | undefined,
+  options: { nativeFeatures?: boolean } = {}
+): Promise<void> {
+  const checkedNonce = z.string().uuid().parse(nonce)
+  let artifactVersion: string
+  try {
+    artifactVersion = await readOrcadArtifactIdentity(resolveOrcadInstallRoot())
+  } catch (cause) {
+    throw new OrcadBundledRuntimeError('The bundled Orca artifacts are incomplete or altered', {
+      cause
+    })
+  }
+  const result = await preflightProfileStateRuntime()
+  if (process.versions.bun) {
+    await preflightOrcadBunNativeRuntime(options)
+  }
+  const response: OrcadProfilePreflightResponse = {
+    type: 'orca_profile_state_ready',
+    nonce: checkedNonce,
+    runtime: process.versions.bun ? 'bun' : 'node',
+    runtimeVersion: process.versions.bun ?? process.versions.node,
+    artifactVersion,
+    ...result
+  }
+  console.log(JSON.stringify(response))
+}
+
+async function readInstalledVersion(directory: string): Promise<string> {
+  try {
+    return orcadProfilePreflightResponseSchema.shape.artifactVersion.parse(
+      (await readFile(join(directory, ORCAD_VERSION_FILENAME), 'utf8')).trim()
+    )
+  } catch (cause) {
+    throw new OrcadBundledRuntimeError(
+      'The installed Orca artifact version is missing or invalid',
+      {
+        cause
+      }
+    )
+  }
+}
diff --git a/src/main/orcad/orcad-profile-state-startup.test.ts b/src/main/orcad/orcad-profile-state-startup.test.ts
new file mode 100644
index 00000000000..32939c2e078
--- /dev/null
+++ b/src/main/orcad/orcad-profile-state-startup.test.ts
@@ -0,0 +1,110 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  createProfileStateStoreForStartupMock,
+  emitMock,
+  ensureActiveOrcaProfileMock,
+  initOrcaProfilePathsMock,
+  initSshHostKeyStoreFileMock
+} = vi.hoisted(() => ({
+  createProfileStateStoreForStartupMock: vi.fn(),
+  emitMock: vi.fn(),
+  ensureActiveOrcaProfileMock: vi.fn(),
+  initOrcaProfilePathsMock: vi.fn(),
+  initSshHostKeyStoreFileMock: vi.fn()
+}))
+
+vi.mock('../persistence/profile-state/profile-state-startup-authority', () => ({
+  createProfileStateStoreForStartup: createProfileStateStoreForStartupMock
+}))
+vi.mock('../orca-profiles/profile-index-store', () => ({
+  ensureActiveOrcaProfile: ensureActiveOrcaProfileMock,
+  initOrcaProfilePaths: initOrcaProfilePathsMock
+}))
+vi.mock('../ssh/ssh-host-key-store', () => ({
+  initSshHostKeyStoreFile: initSshHostKeyStoreFileMock
+}))
+vi.mock('./orcad-profile-state-telemetry', () => ({
+  emitOrcadProfileStateAuthoritySelected: emitMock
+}))
+
+const { createOrcadProfileStateStartup } = await import('./orcad-profile-state-startup')
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  ensureActiveOrcaProfileMock.mockReturnValue({
+    dataFile: '/tmp/profile/orca-data.json',
+    stateDatabaseFile: '/tmp/profile/profile-state.db',
+    profile: { id: 'profile-1' }
+  })
+})
+
+describe('orcad profile-state startup', () => {
+  it('selects the capable authority once and publishes bounded metadata', async () => {
+    const store = { getSettings: vi.fn() }
+    createProfileStateStoreForStartupMock.mockReturnValue({
+      store,
+      authority: { readSerializedState: vi.fn() },
+      backend: 'sqlite',
+      classification: 'json-only',
+      migrated: true
+    })
+
+    const result = await createOrcadProfileStateStartup('/tmp/user-data')
+
+    expect(initOrcaProfilePathsMock).toHaveBeenCalledOnce()
+    expect(ensureActiveOrcaProfileMock).toHaveBeenCalledWith('/tmp/user-data')
+    expect(initSshHostKeyStoreFileMock).toHaveBeenCalledWith('/tmp/profile/orca-data.json')
+
+    expect(createProfileStateStoreForStartupMock).toHaveBeenCalledWith({
+      dataFile: '/tmp/profile/orca-data.json',
+      databaseFile: '/tmp/profile/profile-state.db',
+      profileId: 'profile-1',
+      runtime: 'orcad',
+      storageAuthority: 'runtime'
+    })
+    expect(result.store).toBe(store)
+    expect(result.authority).toEqual({
+      backend: 'sqlite',
+      classification: 'json-only',
+      authority_mode: 'sqlite-established',
+      runtime: 'orcad',
+      migrated: true
+    })
+    expect(emitMock).toHaveBeenCalledWith(result.authority)
+  })
+
+  it('publishes nothing before the profile writer is ready', async () => {
+    let refuse = (_error: Error) => {}
+    createProfileStateStoreForStartupMock.mockImplementationOnce(
+      () =>
+        new Promise((_resolve, reject) => {
+          refuse = reject
+        })
+    )
+    const startup = createOrcadProfileStateStartup('/tmp/user-data')
+    const failure = new Error('writer startup refused')
+    const rejected = expect(startup).rejects.toBe(failure)
+    expect(initSshHostKeyStoreFileMock).not.toHaveBeenCalled()
+    expect(emitMock).not.toHaveBeenCalled()
+    refuse(failure)
+    await rejected
+  })
+
+  it('closes a ready writer if sidecar initialization fails', async () => {
+    const store = { freezeWritesAsync: vi.fn(async () => {}) }
+    createProfileStateStoreForStartupMock.mockResolvedValueOnce({
+      store,
+      backend: 'sqlite',
+      classification: 'sqlite-only',
+      migrated: false
+    })
+    const failure = new Error('sidecar initialization refused')
+    initSshHostKeyStoreFileMock.mockImplementationOnce(() => {
+      throw failure
+    })
+    await expect(createOrcadProfileStateStartup('/tmp/user-data')).rejects.toBe(failure)
+    expect(store.freezeWritesAsync).toHaveBeenCalledOnce()
+    expect(emitMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/orcad/orcad-profile-state-startup.ts b/src/main/orcad/orcad-profile-state-startup.ts
new file mode 100644
index 00000000000..dba09365993
--- /dev/null
+++ b/src/main/orcad/orcad-profile-state-startup.ts
@@ -0,0 +1,59 @@
+import { createProfileStateStoreForStartup } from '../persistence/profile-state/profile-state-startup-authority'
+import type { ProfileStateStoreFactoryResult } from '../persistence/profile-state/profile-state-store-factory'
+import { ensureActiveOrcaProfile, initOrcaProfilePaths } from '../orca-profiles/profile-index-store'
+import { initSshHostKeyStoreFile } from '../ssh/ssh-host-key-store'
+import { emitOrcadProfileStateAuthoritySelected } from './orcad-profile-state-telemetry'
+
+export type OrcadProfileStateProfile = {
+  dataFile: string
+  stateDatabaseFile: string
+  profile: { id: string }
+}
+
+export type OrcadProfileStateStartup = {
+  store: ProfileStateStoreFactoryResult['store']
+  authority: {
+    backend: ProfileStateStoreFactoryResult['backend']
+    classification: ProfileStateStoreFactoryResult['classification']
+    authority_mode: 'sqlite-established'
+    runtime: 'orcad'
+    migrated: boolean
+  }
+}
+
+/** Build the headless Store and publish its authority selection at one Node-only seam. */
+export async function createOrcadProfileStateStartup(
+  userDataPath: string
+): Promise<OrcadProfileStateStartup> {
+  initOrcaProfilePaths()
+  const profile = ensureActiveOrcaProfile(userDataPath)
+  const result = await createProfileStateStoreForStartup({
+    dataFile: profile.dataFile,
+    databaseFile: profile.stateDatabaseFile,
+    profileId: profile.profile.id,
+    runtime: 'orcad',
+    storageAuthority: 'runtime'
+  })
+  const authority = {
+    backend: result.backend,
+    classification: result.classification,
+    authority_mode: 'sqlite-established' as const,
+    runtime: 'orcad' as const,
+    migrated: result.migrated
+  }
+  try {
+    initSshHostKeyStoreFile(profile.dataFile)
+    emitOrcadProfileStateAuthoritySelected(authority)
+    return { store: result.store, authority }
+  } catch (error) {
+    try {
+      await result.store.freezeWritesAsync()
+    } catch (closeError) {
+      console.error(
+        '[persistence] Failed to close profile persistence after startup failure:',
+        closeError
+      )
+    }
+    throw error
+  }
+}
diff --git a/src/main/orcad/orcad-profile-state-telemetry.test.ts b/src/main/orcad/orcad-profile-state-telemetry.test.ts
new file mode 100644
index 00000000000..9302990de1b
--- /dev/null
+++ b/src/main/orcad/orcad-profile-state-telemetry.test.ts
@@ -0,0 +1,46 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  emitOrcadProfileStateAuthoritySelected,
+  formatOrcadProfileStateAuthoritySelected,
+  type OrcadProfileStateAuthoritySelection
+} from './orcad-profile-state-telemetry'
+
+const selection: OrcadProfileStateAuthoritySelection = {
+  backend: 'sqlite',
+  classification: 'json-only',
+  authority_mode: 'sqlite-established',
+  runtime: 'orcad',
+  migrated: true
+}
+
+describe('orcad profile-state telemetry', () => {
+  it('formats a bounded machine-readable authority selection event', () => {
+    expect(JSON.parse(formatOrcadProfileStateAuthoritySelected(selection).slice(18))).toEqual({
+      event: 'profile_state_authority_selected',
+      ...selection
+    })
+  })
+
+  it('strips unexpected runtime fields before writing the record', () => {
+    const selectionWithRuntimeFields = Object.assign({}, selection, {
+      database_path: '/private/profile-state.db'
+    })
+    const line = formatOrcadProfileStateAuthoritySelected(selectionWithRuntimeFields)
+    expect(line).not.toContain('database_path')
+  })
+
+  it('sends the event to the supplied sink', () => {
+    const sink = vi.fn()
+    emitOrcadProfileStateAuthoritySelected(selection, sink)
+    expect(sink).toHaveBeenCalledOnce()
+    expect(sink).toHaveBeenCalledWith(formatOrcadProfileStateAuthoritySelected(selection))
+  })
+
+  it('never lets a failing sink block startup', () => {
+    expect(() =>
+      emitOrcadProfileStateAuthoritySelected(selection, () => {
+        throw new Error('closed stderr')
+      })
+    ).not.toThrow()
+  })
+})
diff --git a/src/main/orcad/orcad-profile-state-telemetry.ts b/src/main/orcad/orcad-profile-state-telemetry.ts
new file mode 100644
index 00000000000..0e53dc31a67
--- /dev/null
+++ b/src/main/orcad/orcad-profile-state-telemetry.ts
@@ -0,0 +1,46 @@
+import type { ProfileStateStorageClassification } from '../persistence/profile-state/profile-state-storage-classification'
+
+/**
+ * The low-cardinality profile-state selection facts that a headless host can publish safely.
+ * Paths, profile IDs, and serialized state deliberately stay out of this record.
+ */
+export type OrcadProfileStateAuthoritySelection = {
+  backend: 'sqlite'
+  classification: ProfileStateStorageClassification
+  authority_mode: 'sqlite-established'
+  runtime: 'orcad'
+  migrated: boolean
+}
+
+export type OrcadProfileStateTelemetrySink = (line: string) => void
+
+/** Render one machine-readable stderr line for fleet log collection. */
+export function formatOrcadProfileStateAuthoritySelected(
+  selection: OrcadProfileStateAuthoritySelection
+): string {
+  // Keep the wire shape explicit even if a future caller passes a structurally-compatible
+  // object with extra runtime fields. Paths, IDs, and serialized state must never leak here.
+  return `[orcad-telemetry] ${JSON.stringify({
+    event: 'profile_state_authority_selected',
+    backend: selection.backend,
+    classification: selection.classification,
+    authority_mode: selection.authority_mode,
+    runtime: selection.runtime,
+    migrated: selection.migrated
+  })}`
+}
+
+/**
+ * Publish authority selection without importing Electron or the desktop PostHog client.
+ * Logging is best-effort: observability must never prevent an orcad host from serving.
+ */
+export function emitOrcadProfileStateAuthoritySelected(
+  selection: OrcadProfileStateAuthoritySelection,
+  sink: OrcadProfileStateTelemetrySink = (line) => console.error(line)
+): void {
+  try {
+    sink(formatOrcadProfileStateAuthoritySelected(selection))
+  } catch {
+    // A closed stderr or custom supervisor sink cannot turn a successful startup into a failure.
+  }
+}
diff --git a/src/main/orcad/orcad-push-startup.test.ts b/src/main/orcad/orcad-push-startup.test.ts
index a8fbbc9fe16..21ad507c016 100644
--- a/src/main/orcad/orcad-push-startup.test.ts
+++ b/src/main/orcad/orcad-push-startup.test.ts
@@ -1,4 +1,4 @@
-import { mkdtempSync, rmSync } from 'node:fs'
+import { mkdtempSync, readdirSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, expect, it, vi } from 'vitest'
@@ -6,12 +6,15 @@ import { DeviceRegistry } from '../runtime/device-registry'
 import { RuntimeMobileNotificationController } from '../runtime/runtime-mobile-notification-controller'
 import { PushUnregisterOutbox } from '../runtime/push/push-unregister-outbox'
 import { createPushHostKeypair } from '../runtime/push/push-host-challenge-fixtures'
+import { acquireProfileStateMaintenance } from '../persistence/profile-state/profile-state-access'
+import { profileStateAccessPaths } from '../persistence/profile-state/profile-state-access-owner'
 
 const state = vi.hoisted(() => ({
   root: '',
   controller: null as RuntimeMobileNotificationController | null,
   registry: null as DeviceRegistry | null,
   rpcStarted: false,
+  browserProvider: vi.fn(async () => null),
   register: vi.fn(async () => ({ ok: true, registrationId: 'headless-registration' })),
   send: vi.fn(async () => ({ ok: true, results: [] }))
 }))
@@ -20,7 +23,7 @@ vi.mock('./orcad-app-paths', () => ({
   resolveOrcadPath: () => state.root,
   resolveUserDataPath: () => state.root
 }))
-vi.mock('./orcad-browser-provider', () => ({ resolveOrcadBrowserProvider: async () => null }))
+vi.mock('./orcad-browser-provider', () => ({ resolveOrcadBrowserProvider: state.browserProvider }))
 vi.mock('./orcad-instance-lock', () => ({ acquireOrcadInstanceLock: () => ({ release() {} }) }))
 vi.mock('./orcad-daemon-supervision', () => ({
   startOrcadDaemon: async () => {},
@@ -33,16 +36,29 @@ vi.mock('../ipc/pty', () => ({
   getLocalPtyProvider: () => null,
   getSshPtyProvider: () => null
 }))
-vi.mock('../persistence/loading-store/store', () => ({
-  Store: class {
-    getSettings() {
-      return {}
+vi.mock('./orcad-profile-state-startup', () => ({
+  createOrcadProfileStateStartup: async () => ({
+    store: {
+      getSettings: () => ({}),
+      flushFinalOrThrowAsync: async () => {},
+      freezeWritesAsync: async () => {}
+    },
+    authority: {
+      backend: 'sqlite',
+      classification: 'neither',
+      authority_mode: 'sqlite-candidate',
+      runtime: 'orcad',
+      migrated: false
     }
-  }
+  })
 }))
 vi.mock('../orca-profiles/profile-index-store', () => ({
   initOrcaProfilePaths() {},
-  ensureActiveOrcaProfile: () => ({ dataFile: join(state.root, 'profile.json') })
+  ensureActiveOrcaProfile: () => ({
+    dataFile: join(state.root, 'profile.json'),
+    stateDatabaseFile: join(state.root, 'profile-state.db'),
+    profile: { id: 'headless-profile' }
+  })
 }))
 vi.mock('../ssh/ssh-host-key-store', () => ({ initSshHostKeyStoreFile() {} }))
 vi.mock('../server/serve-readiness', () => ({
@@ -109,6 +125,19 @@ afterEach(() => {
   vi.clearAllMocks()
 })
 
+it('refuses recovery overlap before initializing the browser provider or runtime', async () => {
+  state.root = mkdtempSync(join(tmpdir(), 'orca-headless-recovery-'))
+  const maintenance = acquireProfileStateMaintenance(state.root)
+  const { startOrcad } = await import('./orcad-entry')
+  try {
+    await expect(startOrcad({ noPairing: true, json: true })).rejects.toThrow()
+    expect(state.browserProvider).not.toHaveBeenCalled()
+    expect(state.rpcStarted).toBe(false)
+  } finally {
+    maintenance.release()
+  }
+})
+
 it('starts push after RPC identity is available and stops dispatch on shutdown', async () => {
   state.root = mkdtempSync(join(tmpdir(), 'orca-headless-push-'))
   state.controller = new RuntimeMobileNotificationController()
@@ -140,8 +169,19 @@ it('starts push after RPC identity is available and stops dispatch on shutdown',
   } finally {
     await host.stop()
   }
+  expect(readdirSync(profileStateAccessPaths(state.root).participants)).toEqual([])
+  acquireProfileStateMaintenance(state.root).release()
   expect(state.controller.getListenerCount()).toBe(0)
   expect(await state.controller.registerPushDevice({} as never)).toMatchObject({
     registered: false
   })
 })
+
+it('releases admission when host setup fails before a runtime exists', async () => {
+  state.root = mkdtempSync(join(tmpdir(), 'orca-headless-setup-failure-'))
+  state.browserProvider.mockRejectedValueOnce(new Error('browser setup failed'))
+  const { startOrcad } = await import('./orcad-entry')
+  await expect(startOrcad()).rejects.toThrow('browser setup failed')
+  expect(readdirSync(profileStateAccessPaths(state.root).participants)).toEqual([])
+  acquireProfileStateMaintenance(state.root).release()
+})
diff --git a/src/main/orcad/orcad-sidecar-runtime-client.test.ts b/src/main/orcad/orcad-sidecar-runtime-client.test.ts
index 1ec2055c0d2..64d81444c54 100644
--- a/src/main/orcad/orcad-sidecar-runtime-client.test.ts
+++ b/src/main/orcad/orcad-sidecar-runtime-client.test.ts
@@ -39,14 +39,16 @@ describe('sidecar response framing', () => {
     const wire = `${JSON.stringify({ id, ok: true, result: 'x'.repeat(1024 * 1024) })}\n`
     const originalIndexOf = String.prototype.indexOf
     let searchedCharacters = 0
-    const search = vi
-      .spyOn(String.prototype, 'indexOf')
-      .mockImplementation(function (this: string, value, position) {
-        if (value === '\n') {
-          searchedCharacters += this.length - (position ?? 0)
-        }
-        return originalIndexOf.call(this, value, position)
-      })
+    const search = vi.spyOn(String.prototype, 'indexOf').mockImplementation(function (
+      this: string,
+      value,
+      position
+    ) {
+      if (value === '\n') {
+        searchedCharacters += this.length - (position ?? 0)
+      }
+      return originalIndexOf.call(this, value, position)
+    })
     try {
       for (let offset = 0; offset < wire.length; offset += 256) {
         socket.emit('data', wire.slice(offset, offset + 256))
diff --git a/src/main/persistence-async-write-syscalls.test.ts b/src/main/persistence-async-write-syscalls.test.ts
index 282dc1e2988..27943f12fac 100644
--- a/src/main/persistence-async-write-syscalls.test.ts
+++ b/src/main/persistence-async-write-syscalls.test.ts
@@ -1,166 +1,106 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import {
-  existsSync,
-  mkdtempSync,
-  readFileSync,
-  readdirSync,
-  rmSync,
-  utimesSync,
-  writeFileSync
-} from 'node:fs'
+import { existsSync } from 'node:fs'
 import type * as NodeFs from 'node:fs'
 import type * as NodeFsPromises from 'node:fs/promises'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { SshRemotePtyLeaseState } from '../shared/ssh-types'
-import { installFakeAppEnvironment } from '../../config/scripts/vitest-host-ports-setup'
+import {
+  createWorkerMaintenanceFixture,
+  createSqliteMaintenanceFixture,
+  maintenanceBarrier
+} from './persistence/loading-store/profile-state-maintenance-fixture'
+import { profileStateDatabaseBackups } from './persistence/profile-state/profile-state-backup-path'
+import { ProfileStateSqliteAuthority } from './persistence/profile-state/profile-state-sqlite-authority'
+import type { ProfileStateWorkerAuthority } from './persistence/profile-state/profile-state-worker-authority'
 
-const testState = { dir: '' }
+type FilesystemCalls = {
+  directory: string
+  recording: boolean
+  sync: string[]
+  waitAsync: ((name: string, path: string) => Promise<void> | undefined) | undefined
+}
 
-const fsCalls = vi.hoisted(() => {
-  const blocker = new Int32Array(new SharedArrayBuffer(4))
-  const calls = {
-    recording: false,
-    dirPrefix: '',
-    /** When > 0, every recorded sync call parks the main thread this long — a stalled mount in miniature. */
-    stallMs: 0,
-    syncCalls: [] as string[],
-    asyncCalls: [] as string[],
-    failAsync: null as ((fn: string, target: string) => NodeJS.ErrnoException | null) | null,
-    beforeAsync: null as ((fn: string, target: string) => void) | null,
-    waitAsync: null as ((fn: string, target: string) => Promise<void> | null) | null,
-    reset(): void {
-      calls.syncCalls.length = 0
-      calls.asyncCalls.length = 0
-      calls.stallMs = 0
-      calls.failAsync = null
-      calls.beforeAsync = null
-      calls.waitAsync = null
-    },
-    inScope(target: unknown): target is string {
-      return (
-        calls.recording &&
-        typeof target === 'string' &&
-        calls.dirPrefix !== '' &&
-        target.startsWith(calls.dirPrefix)
-      )
-    },
-    recordSync(fn: string, target: unknown): void {
-      if (!calls.inScope(target)) {
-        return
-      }
-      calls.syncCalls.push(`${fn}:${target}`)
-      if (calls.stallMs > 0) {
-        // Atomics.wait blocks the thread the way an uninterruptible syscall does.
-        Atomics.wait(blocker, 0, 0, calls.stallMs)
-      }
-    },
-    recordAsync(fn: string, target: unknown): NodeJS.ErrnoException | null {
-      if (!calls.inScope(target)) {
-        return null
-      }
-      calls.asyncCalls.push(`${fn}:${target}`)
-      calls.beforeAsync?.(fn, target)
-      return calls.failAsync?.(fn, target) ?? null
-    }
-  }
-  return calls
-})
+const fsCalls = vi.hoisted((): FilesystemCalls => ({
+  directory: '',
+  recording: false,
+  sync: [],
+  waitAsync: undefined
+}))
 
 vi.mock('node:fs', async (importOriginal) => {
+  function isSynchronousFilesystemCall(
+    name: string,
+    value: unknown
+  ): value is (...args: unknown[]) => unknown {
+    return name.endsWith('Sync') && typeof value === 'function'
+  }
+
   const actual = await importOriginal<typeof NodeFs>()
   const patched: Record<string, unknown> = { ...actual }
-  for (const name of Object.keys(actual)) {
-    const original = (actual as unknown as Record<string, unknown>)[name]
-    if (!name.endsWith('Sync') || typeof original !== 'function') {
+  for (const [name, original] of Object.entries(actual)) {
+    if (!isSynchronousFilesystemCall(name, original)) {
       continue
     }
-    const fn = original as (...args: unknown[]) => unknown
-    const wrapper = (...args: unknown[]): unknown => {
-      fsCalls.recordSync(name, args[0])
-      return fn(...args)
-    }
-    patched[name] = Object.assign(wrapper, fn)
+    patched[name] = Object.assign((...args: unknown[]) => {
+      const path = args[0]
+      if (fsCalls.recording && typeof path === 'string' && path.startsWith(fsCalls.directory)) {
+        fsCalls.sync.push(`${name}:${path}`)
+      }
+      return original(...args)
+    }, original)
   }
   return { ...patched, default: patched }
 })
 
 vi.mock('node:fs/promises', async (importOriginal) => {
   const actual = await importOriginal<typeof NodeFsPromises>()
-  const patched: Record<string, unknown> = { ...actual }
-  for (const name of ['stat', 'access', 'rename', 'copyFile', 'rm', 'mkdir', 'open']) {
-    const fn = (actual as unknown as Record<string, (...args: unknown[]) => unknown>)[name]
-    patched[name] = async (...args: unknown[]): Promise<unknown> => {
-      const failure = fsCalls.recordAsync(name, args[0])
-      if (failure) {
-        throw failure
-      }
+  return {
+    ...actual,
+    rename: async (...args: Parameters<typeof actual.rename>) => {
       if (typeof args[0] === 'string') {
-        await fsCalls.waitAsync?.(name, args[0])
+        await fsCalls.waitAsync?.('rename', args[0])
       }
-      return fn(...args)
+      return actual.rename(...args)
     }
   }
-  return { ...patched, default: patched }
+})
+vi.mock('./telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('./telemetry/cohort-classifier', () => ({ getCohortAtEmit: () => ({ nth_repo_added: 2 }) }))
+vi.mock('./ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+beforeEach(() => {
+  fsCalls.recording = false
+  fsCalls.directory = ''
+  fsCalls.sync = []
+  fsCalls.waitAsync = undefined
+})
+afterEach(() => {
+  fsCalls.recording = false
 })
 
-vi.mock('./ssh/ssh-config-parser', () => ({
-  loadUserSshConfig: vi.fn(),
-  sshConfigHostsToTargets: vi.fn()
-}))
+function record(directory: string): void {
+  fsCalls.directory = directory
+  fsCalls.sync = []
+  fsCalls.recording = true
+}
 
-vi.mock('./telemetry/client', () => ({ track: vi.fn() }))
-
-vi.mock('./telemetry/cohort-classifier', () => ({
-  getCohortAtEmit: vi.fn().mockReturnValue({ nth_repo_added: 2 })
-}))
-
-// Deterministic cipher so two stores driven through identical mutations produce identical bytes.
-vi.mock('electron', () => ({
-  app: { getPath: () => testState.dir },
-  safeStorage: {
-    isEncryptionAvailable: () => true,
-    encryptString: (plaintext: string) => Buffer.from(`enc:${plaintext}`, 'utf-8'),
-    decryptString: (ciphertext: Buffer) => ciphertext.toString('utf-8').slice('enc:'.length)
+function pauseCommit(authority: ProfileStateWorkerAuthority) {
+  const started = maintenanceBarrier()
+  const finish = maintenanceBarrier()
+  let held = false
+  for (const name of ['writeSerializedDomains', 'writeCompleteSerializedDomains'] as const) {
+    const original = authority[name].bind(authority)
+    vi.spyOn(authority, name).mockImplementation(async (replacements) => {
+      if (!held) {
+        held = true
+        started.resolve()
+        await finish.promise
+      }
+      await original(replacements)
+    })
   }
-}))
-
-const BACKUP_COUNT = 5
-const BACKUP_MIN_INTERVAL_MS = 60 * 60 * 1000
-const PAST_ROTATION_INTERVAL_MS = BACKUP_MIN_INTERVAL_MS * 2
-const SAVE_DEBOUNCE_MS = 1_000
-
-const ROTATION_INTERLEAVE_CASES = [
-  ['initial access', 'access', ''],
-  ['oldest removal', 'rm', '.bak.4'],
-  ['slot access', 'access', '.bak.0'],
-  ['slot rename', 'rename', '.bak.0'],
-  ['final copy', 'copyFile', '']
-] as const
-
-type TestStore = {
-  updateUI(updates: { sidebarWidth: number }): void
-  setGitHubCache(cache: { pr: Record<string, never>; issue: Record<string, never> }): void
-  waitForPendingWrite(): Promise<void>
-  flushOrThrow(): void
-  flushPendingAsync(): Promise<void>
-  flushPendingOrThrowAsync(options?: { drainToStableGeneration?: boolean }): Promise<void>
-  upsertSshPtyConsumerRecovery(record: {
-    targetId: string
-    clientInstanceId: string
-    serverBuildId: string
-    clientGeneration: number
-    ownerGeneration: number
-    ownerLease: string
-  }): Promise<void>
-  removeSshPtyConsumerRecovery(targetId: string): Promise<void>
-  upsertSshRemotePtyLease(lease: {
-    targetId: string
-    ptyId: string
-    state: SshRemotePtyLeaseState
-  }): void
-  markSshRemotePtyLeasesAsync(targetId: string, state: SshRemotePtyLeaseState): Promise<void>
-  markSshRemotePtyLeasesAttachedAsync(targetId: string, ptyIds: readonly string[]): Promise<void>
+  return { started: started.promise, release: finish.resolve }
 }
 
 function consumerRecovery(clientInstanceId: string) {
@@ -174,655 +114,221 @@ function consumerRecovery(clientInstanceId: string) {
   }
 }
 
-async function createStore(dir: string): Promise<TestStore> {
-  testState.dir = dir
-  vi.resetModules()
-  const { Store, initDataPath } = await import('./persistence')
-  // Why here: userData resolves through AppEnvironment, and this must point at this
-  // file's temp dir rather than the global fake's shared one, after resetModules.
-  installFakeAppEnvironment({ getPath: () => testState.dir })
-  initDataPath()
-  return new Store() as unknown as TestStore
-}
-
-function dataFile(dir: string): string {
-  return join(dir, 'orca-data.json')
-}
-
-function deferred(): { promise: Promise<void>; resolve: () => void } {
-  let resolve!: () => void
-  const promise = new Promise<void>((next) => {
-    resolve = next
-  })
-  return { promise, resolve }
-}
-
-function recordFsCalls(dir: string): void {
-  fsCalls.dirPrefix = dir
-  fsCalls.recording = true
-}
-
-function delayNextDataFileRename(dir: string): ReturnType<typeof deferred> & {
-  started: Promise<void>
-} {
-  const release = deferred()
-  const started = deferred()
-  let held = false
-  fsCalls.waitAsync = (fn, target) => {
-    if (held || fn !== 'rename' || !target.startsWith(dataFile(dir))) {
-      return null
-    }
-    held = true
-    started.resolve()
-    return release.promise
+function readBackup(path: string) {
+  const reader = new ProfileStateSqliteAuthority(path, 'maintenance-test')
+  try {
+    return JSON.parse(reader.readSerializedState() ?? '{}')
+  } finally {
+    reader.close()
   }
-  return { ...release, started: started.promise }
 }
 
-function seedStaleBackup(dir: string): void {
-  const path = `${dataFile(dir)}.bak.0`
-  writeFileSync(path, '{"stale":true}', 'utf-8')
-  const staleSeconds = (Date.now() - PAST_ROTATION_INTERVAL_MS) / 1000
-  utimesSync(path, staleSeconds, staleSeconds)
-}
-
-function ringSnapshot(dir: string): Record<string, string> {
-  const snapshot: Record<string, string> = {}
-  for (const name of readdirSync(dir).sort()) {
-    if (name === 'orca-data.json' || name.startsWith('orca-data.json.bak.')) {
-      snapshot[name] = readFileSync(join(dir, name), 'utf-8')
-    }
-  }
-  return snapshot
-}
-
-describe('async persistence write path avoids synchronous fs syscalls', () => {
-  const dirs: string[] = []
-
-  function makeDir(): string {
-    const dir = mkdtempSync(join(tmpdir(), 'orca-async-write-'))
-    dirs.push(dir)
-    return dir
-  }
-
-  beforeEach(() => {
+describe('worker persistence avoids synchronous profile filesystem calls', () => {
+  it('commits and creates a real SQLite backup without synchronous profile syscalls', async () => {
+    const { store, authority, directory, databaseFile, dataFile, readState } =
+      await createWorkerMaintenanceFixture()
+    record(directory)
+    store.updateUI({ sidebarWidth: 301 })
+    await store.flushPendingOrThrowAsync()
+    await authority.drainBackups()
     fsCalls.recording = false
-    fsCalls.dirPrefix = ''
-    fsCalls.reset()
-    vi.useFakeTimers()
+    expect(fsCalls.sync).toEqual([])
+    expect(readState().ui.sidebarWidth).toBe(301)
+    const backups = profileStateDatabaseBackups(databaseFile)
+    expect(backups).toHaveLength(1)
+    expect(readBackup(backups[0].path).ui.sidebarWidth).toBe(301)
+    expect(existsSync(dataFile)).toBe(false)
+    expect(existsSync(`${dataFile}.bak.0`)).toBe(false)
   })
 
-  afterEach(() => {
+  it('keeps five hourly SQL backups and skips rotation within the hour without sync syscalls', async () => {
+    const start = Date.now()
+    vi.spyOn(Date, 'now').mockReturnValue(start)
+    const { store, authority, directory, databaseFile } = await createWorkerMaintenanceFixture()
+    record(directory)
+    for (let index = 0; index < 6; index++) {
+      vi.mocked(Date.now).mockReturnValue(start + index * 3_600_001)
+      store.updateUI({ sidebarWidth: 310 + index })
+      await store.flushPendingOrThrowAsync()
+      await authority.drainBackups()
+    }
+    store.updateUI({ sidebarWidth: 399 })
+    await store.flushPendingOrThrowAsync()
+    await authority.drainBackups()
     fsCalls.recording = false
-    vi.useRealTimers()
-    while (dirs.length > 0) {
-      rmSync(dirs.pop() as string, { recursive: true, force: true })
-    }
+    expect(fsCalls.sync).toEqual([])
+    const backups = profileStateDatabaseBackups(databaseFile)
+    expect(backups).toHaveLength(5)
+    expect(backups.map((backup) => readBackup(backup.path).ui.sidebarWidth)).toEqual([
+      315, 314, 313, 312, 311
+    ])
   })
 
-  async function recordAsyncSave(
-    store: TestStore,
-    dir: string,
-    sidebarWidth: number
-  ): Promise<void> {
-    store.updateUI({ sidebarWidth })
-    recordFsCalls(dir)
-    try {
-      vi.advanceTimersByTime(PAST_ROTATION_INTERVAL_MS)
-      await store.waitForPendingWrite()
-    } finally {
-      fsCalls.recording = false
-    }
-  }
-
-  it('issues no sync fs syscall under the profile dir when rotation runs with an empty ring', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-
-    await recordAsyncSave(store, dir, 301)
-
-    expect(fsCalls.syncCalls).toEqual([])
-    // Rotation must actually have happened, else the assertion above is vacuous.
-    expect(ringSnapshot(dir)['orca-data.json.bak.0']).toBe(readFileSync(dataFile(dir), 'utf-8'))
-  })
-
-  it('uses an awaited stat, not statSync, for the backup rotation interval check', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    seedStaleBackup(dir)
-
-    await recordAsyncSave(store, dir, 302)
-
-    expect(fsCalls.syncCalls).toEqual([])
-    expect(fsCalls.asyncCalls).toContain(`stat:${dataFile(dir)}.bak.0`)
-  })
-
-  it('issues no sync fs syscall while rotating a saturated ring', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-
-    // One more save than the ring holds, so the oldest slot is evicted and every slot renames.
-    for (let i = 0; i <= BACKUP_COUNT; i++) {
-      await recordAsyncSave(store, dir, 310 + i)
-    }
-
-    expect(fsCalls.syncCalls).toEqual([])
-    const ring = ringSnapshot(dir)
-    expect(Object.keys(ring)).toContain(`orca-data.json.bak.${BACKUP_COUNT - 1}`)
-    expect(Object.keys(ring)).not.toContain(`orca-data.json.bak.${BACKUP_COUNT}`)
-  })
-
-  it('lets a main-thread timer keep firing while a rotating save is in flight', async () => {
-    // A recorded sync call stalls long enough for the heartbeat to catch it.
-    vi.useRealTimers()
-    const dir = makeDir()
-    const store = await createStore(dir)
-    seedStaleBackup(dir)
-    // Generous stall so ordinary scheduler/GC jitter can't reach the threshold on a loaded CI box.
-    const stallMs = 500
-
-    let lastTick = Date.now()
-    let worstGapMs = 0
-    const heartbeat = setInterval(() => {
-      const now = Date.now()
-      worstGapMs = Math.max(worstGapMs, now - lastTick)
-      lastTick = now
-    }, 10)
-
-    try {
-      store.updateUI({ sidebarWidth: 341 })
-      fsCalls.dirPrefix = dir
-      fsCalls.stallMs = stallMs
-      fsCalls.recording = true
-      lastTick = Date.now()
-      await new Promise((resolve) => setTimeout(resolve, SAVE_DEBOUNCE_MS + 200))
-      await store.waitForPendingWrite()
-    } finally {
-      fsCalls.recording = false
-      clearInterval(heartbeat)
-    }
-
-    expect(worstGapMs).toBeLessThan(stallMs)
-    // The save really happened, so a small gap isn't just an absent write.
-    expect(ringSnapshot(dir)['orca-data.json.bak.0']).toBe(readFileSync(dataFile(dir), 'utf-8'))
-  }, 20_000)
-
-  it('skips rotation when a sync flush rotated during the rotation-interval await', async () => {
-    // The acquired owner keeps rotation when the flush skips the ring.
-    const dir = makeDir()
-    const store = await createStore(dir)
-    seedStaleBackup(dir)
-    const staleBackup = readFileSync(`${dataFile(dir)}.bak.0`, 'utf-8')
-
-    store.updateUI({ sidebarWidth: 361 })
-    recordFsCalls(dir)
-    let flushed = false
-    fsCalls.beforeAsync = (fn, target) => {
-      if (flushed || fn !== 'stat' || !target.endsWith('.bak.0')) {
-        return
-      }
-      flushed = true
-      store.updateUI({ sidebarWidth: 362 })
-      store.flushOrThrow()
-    }
-    try {
-      vi.advanceTimersByTime(PAST_ROTATION_INTERVAL_MS)
-      await store.waitForPendingWrite()
-    } finally {
-      fsCalls.recording = false
-      fsCalls.beforeAsync = null
-    }
-
-    expect(flushed).toBe(true)
-    const ring = ringSnapshot(dir)
-    expect(ring['orca-data.json.bak.0']).toBe(ring['orca-data.json'])
-    expect(ring['orca-data.json.bak.1']).toBe(staleBackup)
-    expect(ring['orca-data.json.bak.2']).toBeUndefined()
-  })
-
-  it('a sync checkpoint vetoes an async write already parked on rename', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const rename = delayNextDataFileRename(dir)
-
-    recordFsCalls(dir)
-    store.updateUI({ sidebarWidth: 501 })
-    vi.advanceTimersByTime(SAVE_DEBOUNCE_MS)
-    const pending = store.waitForPendingWrite()
-    await rename.started
-
-    store.updateUI({ sidebarWidth: 502 })
-    store.flushOrThrow()
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(502)
-
-    rename.resolve()
+  it('keeps the event loop live while a SQL acknowledgement is stalled', async () => {
+    const { store, authority, directory, readState } = await createWorkerMaintenanceFixture()
+    const gate = pauseCommit(authority)
+    record(directory)
+    const pending = store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1'))
+    await gate.started
+    let complete = false
+    void pending.then(() => {
+      complete = true
+    })
+    await new Promise((resolve) => setTimeout(resolve, 20))
+    expect(complete).toBe(false)
+    expect(fsCalls.sync).toEqual([])
+    gate.release()
     await pending
     fsCalls.recording = false
-    fsCalls.waitAsync = null
-
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(502)
-    expect(readdirSync(dir).filter((name) => name.endsWith('.tmp'))).toHaveLength(0)
+    expect(readState().sshPtyConsumerRecoveries[0].clientInstanceId).toBe('client-1')
   })
 
-  it('retries a genuine ENOENT instead of marking the state persisted', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const errors = vi.spyOn(console, 'error').mockImplementation(() => {})
-    recordFsCalls(dir)
-    fsCalls.failAsync = (fn, target) =>
-      fn === 'rename' && target.startsWith(dataFile(dir)) && !target.includes('.bak.')
-        ? Object.assign(new Error('mount disappeared'), { code: 'ENOENT' })
-        : null
-
-    store.updateUI({ sidebarWidth: 511 })
-    await store.flushPendingAsync()
-    expect(existsSync(dataFile(dir))).toBe(false)
-
-    fsCalls.failAsync = null
-    await store.flushPendingAsync()
-    fsCalls.recording = false
-    errors.mockRestore()
-
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(511)
-  })
-
-  it('the throwing async barrier drains mutations made during its write', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const rename = delayNextDataFileRename(dir)
-    recordFsCalls(dir)
-
+  it('drains a newer mutation before resolving a stable-generation barrier', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const gate = pauseCommit(authority)
     store.updateUI({ sidebarWidth: 601 })
     const barrier = store.flushPendingOrThrowAsync()
-    await rename.started
+    await gate.started
     store.updateUI({ sidebarWidth: 602 })
-    rename.resolve()
+    gate.release()
     await barrier
-    fsCalls.recording = false
-
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(602)
+    expect(readState().ui.sidebarWidth).toBe(602)
   })
 
-  it('bounds a best-effort flush to one state generation', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const rename = delayNextDataFileRename(dir)
-    recordFsCalls(dir)
-
+  it('bounds a best-effort flush to its captured generation and retains later dirtiness', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const gate = pauseCommit(authority)
     store.updateUI({ sidebarWidth: 621 })
-    const flush = store.flushPendingAsync()
-    await rename.started
+    const pending = store.flushPendingAsync()
+    await gate.started
     store.updateUI({ sidebarWidth: 622 })
-    rename.resolve()
-    await flush
-    fsCalls.recording = false
-
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(621)
-
+    gate.release()
+    await pending
+    expect(readState().ui.sidebarWidth).toBe(621)
     await store.flushPendingOrThrowAsync()
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(622)
+    expect(readState().ui.sidebarWidth).toBe(622)
   })
 
-  it('keeps a bounded barrier open when its staged writer is superseded before rename', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const openRelease = deferred()
-    const openStarted = deferred()
-    const renameRelease = deferred()
-    const renameStarted = deferred()
-    let heldOpen = false
-    let heldRename = false
-    fsCalls.waitAsync = (fn, target) => {
-      if (
-        !heldOpen &&
-        fn === 'open' &&
-        target.startsWith(dataFile(dir)) &&
-        target.endsWith('.tmp')
-      ) {
-        heldOpen = true
-        openStarted.resolve()
-        return openRelease.promise
-      }
-      if (!heldRename && fn === 'rename' && target.startsWith(dataFile(dir))) {
-        heldRename = true
-        renameStarted.resolve()
-        return renameRelease.promise
-      }
-      return null
-    }
-    recordFsCalls(dir)
-
-    store.updateUI({ sidebarWidth: 631 })
-    const barrier = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
-    await openStarted.promise
-    store.updateUI({ sidebarWidth: 632 })
-    openRelease.resolve()
-    const firstOutcome = await Promise.race([
-      barrier.then(() => 'settled' as const),
-      renameStarted.promise.then(() => 'retrying' as const)
-    ])
-
-    expect(firstOutcome).toBe('retrying')
-    renameRelease.resolve()
-    await barrier
-    fsCalls.recording = false
-
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(632)
-  })
-
-  it('rewrites a matching hash after a superseded rename installed stale state', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
+  it('rewrites an earlier value after a captured stale generation commits', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
     store.updateUI({ sidebarWidth: 641 })
     await store.flushPendingOrThrowAsync()
-    const rename = delayNextDataFileRename(dir)
-    recordFsCalls(dir)
-
+    const gate = pauseCommit(authority)
     store.updateUI({ sidebarWidth: 642 })
-    vi.advanceTimersByTime(SAVE_DEBOUNCE_MS)
-    const staleWrite = store.waitForPendingWrite()
-    await rename.started
+    const pending = store.flushPendingAsync()
+    await gate.started
     store.updateUI({ sidebarWidth: 641 })
-    rename.resolve()
-    await staleWrite
-
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(642)
+    gate.release()
+    await pending
+    expect(readState().ui.sidebarWidth).toBe(642)
     await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
-    fsCalls.recording = false
-
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(641)
+    expect(readState().ui.sidebarWidth).toBe(641)
   })
 
-  it('the throwing async barrier drains mutations made during sidecar I/O', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const renameRelease = deferred()
-    const renameStarted = deferred()
-    fsCalls.waitAsync = (fn, target) => {
-      if (fn !== 'rename' || !target.includes('orca-github-cache.json.')) {
-        return null
-      }
-      renameStarted.resolve()
-      return renameRelease.promise
-    }
-    recordFsCalls(dir)
+  it('retains dirty state when a SQL commit fails and persists an explicit retry', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    vi.spyOn(authority, 'writeCompleteSerializedDomains').mockRejectedValueOnce(
+      new Error('disk refused')
+    )
+    const original = readState().ui.sidebarWidth
+    store.updateUI({ sidebarWidth: 511 })
+    await store.flushPendingAsync()
+    expect(readState().ui.sidebarWidth).toBe(original)
+    await store.flushPendingOrThrowAsync()
+    expect(readState().ui.sidebarWidth).toBe(511)
+  })
 
+  it('drains mutations made while a sidecar rename is stalled', async () => {
+    const { store, readState } = await createWorkerMaintenanceFixture()
+    const started = maintenanceBarrier()
+    const finish = maintenanceBarrier()
+    fsCalls.waitAsync = (name, path) => {
+      if (name !== 'rename' || !path.includes('orca-github-cache.json.')) {
+        return
+      }
+      started.resolve()
+      return finish.promise
+    }
     store.updateUI({ sidebarWidth: 611 })
     store.setGitHubCache({ pr: {}, issue: {} })
     const barrier = store.flushPendingOrThrowAsync()
-    await renameStarted.promise
+    await started.promise
     store.updateUI({ sidebarWidth: 612 })
-    renameRelease.resolve()
+    finish.resolve()
     await barrier
-    fsCalls.recording = false
-
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(612)
+    expect(readState().ui.sidebarWidth).toBe(612)
   })
 
-  it('serializes a second writer behind the owned rotation', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    seedStaleBackup(dir)
-    const almostDueSeconds = (Date.now() - (BACKUP_MIN_INTERVAL_MS - SAVE_DEBOUNCE_MS - 100)) / 1000
-    utimesSync(`${dataFile(dir)}.bak.0`, almostDueSeconds, almostDueSeconds)
-    const staleBackup = readFileSync(`${dataFile(dir)}.bak.0`, 'utf-8')
-    const statCall = `stat:${dataFile(dir)}.bak.0`
-    const rotationRelease = deferred()
-    const rotationStarted = deferred()
-    let held = false
-    fsCalls.waitAsync = (fn, target) => {
-      if (held || fn !== 'stat' || target !== `${dataFile(dir)}.bak.0`) {
-        return null
-      }
-      held = true
-      rotationStarted.resolve()
-      return rotationRelease.promise
-    }
-
-    recordFsCalls(dir)
-    store.updateUI({ sidebarWidth: 371 })
-    vi.advanceTimersByTime(SAVE_DEBOUNCE_MS)
-    const firstWrite = store.waitForPendingWrite()
-    let allWrites = firstWrite
-    try {
-      await rotationStarted.promise
-      store.updateUI({ sidebarWidth: 372 })
-      store.flushOrThrow()
-      store.updateUI({ sidebarWidth: 373 })
-      vi.advanceTimersByTime(SAVE_DEBOUNCE_MS)
-      allWrites = store.waitForPendingWrite()
-      expect(fsCalls.asyncCalls.filter((call) => call === statCall)).toHaveLength(1)
-      rotationRelease.resolve()
-      await Promise.all([firstWrite, allWrites])
-    } finally {
-      rotationRelease.resolve()
-      await allWrites
-      fsCalls.recording = false
-      fsCalls.waitAsync = null
-    }
-    const ring = ringSnapshot(dir)
-    expect(JSON.parse(ring['orca-data.json']).ui.sidebarWidth).toBe(373)
-    expect(JSON.parse(ring['orca-data.json.bak.0']).ui.sidebarWidth).toBe(372)
-    expect(ring['orca-data.json.bak.1']).toBe(staleBackup)
-    expect(ring['orca-data.json.bak.2']).toBeUndefined()
-  })
-
-  it.each(ROTATION_INTERLEAVE_CASES)(
-    'keeps one rotation owner when a sync flush lands during %s',
-    async (_phase, expectedFn, targetSuffix) => {
-      const dir = makeDir()
-      const store = await createStore(dir)
-      seedStaleBackup(dir)
-      const staleBackup = readFileSync(`${dataFile(dir)}.bak.0`, 'utf-8')
-      const expectedTarget = `${dataFile(dir)}${targetSuffix}`
-
-      store.updateUI({ sidebarWidth: 363 })
-      recordFsCalls(dir)
-      let flushed = false
-      fsCalls.beforeAsync = (fn, target) => {
-        if (flushed || fn !== expectedFn || target !== expectedTarget) {
-          return
-        }
-        flushed = true
-        store.updateUI({ sidebarWidth: 364 })
-        store.flushOrThrow()
-      }
-      try {
-        vi.advanceTimersByTime(PAST_ROTATION_INTERVAL_MS)
-        await store.waitForPendingWrite()
-      } finally {
-        fsCalls.recording = false
-        fsCalls.beforeAsync = null
-      }
-
-      expect(flushed).toBe(true)
-      const ring = ringSnapshot(dir)
-      expect(ring['orca-data.json.bak.0']).toBe(ring['orca-data.json'])
-      expect(ring['orca-data.json.bak.1']).toBe(staleBackup)
-      expect(ring['orca-data.json.bak.2']).toBeUndefined()
-    }
-  )
-
-  it('does not log for absent ring slots even when the mount rejects renames non-ENOENT', async () => {
-    // Probing keeps degraded mounts from logging one error per absent slot.
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const errors = vi.spyOn(console, 'error').mockImplementation(() => {})
-    fsCalls.failAsync = (fn, target) =>
-      fn === 'rename' && target.includes('.bak.')
-        ? Object.assign(new Error('stale NFS file handle'), { code: 'ESTALE' })
-        : null
-
-    try {
-      await recordAsyncSave(store, dir, 351)
-      expect(errors).not.toHaveBeenCalled()
-    } finally {
-      errors.mockRestore()
-    }
-  })
-
-  it('logs when a ring slot that exists fails to rotate', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    seedStaleBackup(dir)
-    const errors = vi.spyOn(console, 'error').mockImplementation(() => {})
-    fsCalls.failAsync = (fn, target) =>
-      fn === 'rename' && target.endsWith('.bak.0')
-        ? Object.assign(new Error('permission denied'), { code: 'EPERM' })
-        : null
-
-    try {
-      await recordAsyncSave(store, dir, 352)
-      expect(errors).toHaveBeenCalledWith(
-        '[persistence] Failed to rotate backup',
-        `${dataFile(dir)}.bak.0`,
-        '->',
-        `${dataFile(dir)}.bak.1`,
-        expect.objectContaining({ code: 'EPERM' })
-      )
-    } finally {
-      errors.mockRestore()
-    }
-  })
-
-  it('produces a .bak ring byte-identical to the sync path, at capacity and with ring holes', async () => {
-    const asyncDir = makeDir()
-    const syncDir = makeDir()
-    // Match generated IDs so only rotation behavior can differ.
-    const seedDir = makeDir()
-    const seedStore = await createStore(seedDir)
-    seedStore.updateUI({ sidebarWidth: 320 })
-    seedStore.flushOrThrow()
-    const seed = readFileSync(dataFile(seedDir), 'utf-8')
-    for (const dir of [asyncDir, syncDir]) {
-      writeFileSync(dataFile(dir), seed, 'utf-8')
-      // Holes: slots 1 and 3 occupied, 0 and 2 missing — exercises the per-slot existence branch.
-      writeFileSync(`${dataFile(dir)}.bak.1`, '{"old":1}', 'utf-8')
-      writeFileSync(`${dataFile(dir)}.bak.3`, '{"old":3}', 'utf-8')
-    }
-
-    const widths = [321, 322, 323, 324, 325, 326]
-    const asyncStore = await createStore(asyncDir)
-    for (const width of widths) {
-      asyncStore.updateUI({ sidebarWidth: width })
-      vi.advanceTimersByTime(PAST_ROTATION_INTERVAL_MS)
-      await asyncStore.waitForPendingWrite()
-    }
-
-    const syncStore = await createStore(syncDir)
-    for (const width of widths) {
-      syncStore.updateUI({ sidebarWidth: width })
-      syncStore.flushOrThrow()
-      vi.advanceTimersByTime(PAST_ROTATION_INTERVAL_MS)
-    }
-
-    const ring = ringSnapshot(asyncDir)
-    expect(ring).toEqual(ringSnapshot(syncDir))
-    expect(Object.keys(ring)).toContain(`orca-data.json.bak.${BACKUP_COUNT - 1}`)
-  })
-
-  it('persists SSH PTY consumer recovery without a sync syscall, durable once awaited', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-
-    recordFsCalls(dir)
-    try {
-      await store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1'))
-    } finally {
-      fsCalls.recording = false
-    }
-
-    expect(fsCalls.syncCalls).toEqual([])
-    // Durability is awaited, not merely debounced: the record is on disk when the promise resolves.
-    const persisted = JSON.parse(readFileSync(dataFile(dir), 'utf-8')) as {
-      sshPtyConsumerRecoveries: { clientInstanceId: string }[]
-    }
-    expect(persisted.sshPtyConsumerRecoveries).toHaveLength(1)
-    expect(persisted.sshPtyConsumerRecoveries[0]?.clientInstanceId).toBe('client-1')
-  })
-
-  it('rejects the consumer-recovery durability barrier when the primary write fails', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const writeError = Object.assign(new Error('profile mount rejected write'), { code: 'EIO' })
-    const errors = vi.spyOn(console, 'error').mockImplementation(() => {})
-    recordFsCalls(dir)
-    fsCalls.failAsync = (fn, target) =>
-      fn === 'open' && target.startsWith(`${dataFile(dir)}.`) ? writeError : null
-
-    try {
-      await expect(store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1'))).rejects.toBe(
-        writeError
-      )
-    } finally {
-      fsCalls.recording = false
-      errors.mockRestore()
-    }
-  })
-
-  it('removes SSH PTY consumer recovery without a sync syscall, durable once awaited', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
+  it('persists SSH consumer recovery without sync syscalls before acknowledging it', async () => {
+    const { store, authority, directory, readState } = await createWorkerMaintenanceFixture()
+    record(directory)
     await store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1'))
-
-    recordFsCalls(dir)
-    try {
-      await store.removeSshPtyConsumerRecovery('ssh-1')
-    } finally {
-      fsCalls.recording = false
-    }
-
-    expect(fsCalls.syncCalls).toEqual([])
-    const persisted = JSON.parse(readFileSync(dataFile(dir), 'utf-8')) as {
-      sshPtyConsumerRecoveries: unknown[]
-    }
-    expect(persisted.sshPtyConsumerRecoveries).toEqual([])
+    await authority.drainBackups()
+    fsCalls.recording = false
+    expect(fsCalls.sync).toEqual([])
+    expect(readState().sshPtyConsumerRecoveries).toEqual([
+      expect.objectContaining({ clientInstanceId: 'client-1' })
+    ])
   })
 
-  it('persists failed-session lease detachment without a sync syscall', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    store.upsertSshRemotePtyLease({ targetId: 'ssh-1', ptyId: 'pty-1', state: 'attached' })
-
-    recordFsCalls(dir)
-    try {
-      await store.markSshRemotePtyLeasesAsync('ssh-1', 'detached')
-    } finally {
-      fsCalls.recording = false
-    }
-
-    expect(fsCalls.syncCalls).toEqual([])
-    const persisted = JSON.parse(readFileSync(dataFile(dir), 'utf-8')) as {
-      sshRemotePtyLeases: { state: string }[]
-    }
-    expect(persisted.sshRemotePtyLeases[0]?.state).toBe('detached')
+  it('rejects failed consumer recovery and preserves the prior durable state', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const before = readState().sshPtyConsumerRecoveries
+    const failure = new Error('profile mount rejected write')
+    vi.spyOn(authority, 'writeCompleteSerializedDomains').mockRejectedValueOnce(failure)
+    await expect(store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1'))).rejects.toBe(
+      failure
+    )
+    expect(readState().sshPtyConsumerRecoveries).toEqual(before)
   })
 
-  it('persists selected reattach leases in one async write', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    store.upsertSshRemotePtyLease({ targetId: 'ssh-1', ptyId: 'pty-1', state: 'detached' })
+  it('durably removes SSH consumer recovery without sync syscalls', async () => {
+    const { store, authority, directory, readState } = await createWorkerMaintenanceFixture()
+    await store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1'))
+    await authority.drainBackups()
+    record(directory)
+    await store.removeSshPtyConsumerRecovery('ssh-1')
+    await authority.drainBackups()
+    fsCalls.recording = false
+    expect(fsCalls.sync).toEqual([])
+    expect(readState().sshPtyConsumerRecoveries).toEqual([])
+  })
+
+  it('persists lease detachment and selected reattachments without sync syscalls', async () => {
+    const { store, authority, directory, readState } = await createWorkerMaintenanceFixture()
+    for (const [ptyId, state] of [
+      ['pty-1', 'attached'],
+      ['pty-2', 'expired'],
+      ['pty-3', 'detached'],
+      ['pty-4', 'terminated']
+    ] as const) {
+      store.upsertSshRemotePtyLease({ targetId: 'ssh-1', ptyId, state })
+    }
+    record(directory)
+    await store.markSshRemotePtyLeasesAsync('ssh-1', 'detached')
+    await authority.drainBackups()
+    fsCalls.recording = false
+    expect(fsCalls.sync).toEqual([])
+    expect(
+      readState().sshRemotePtyLeases.filter(
+        (lease: { targetId: string }) => lease.targetId === 'ssh-1'
+      )
+    ).toEqual(
+      expect.arrayContaining([expect.objectContaining({ ptyId: 'pty-1', state: 'detached' })])
+    )
     store.upsertSshRemotePtyLease({ targetId: 'ssh-1', ptyId: 'pty-2', state: 'expired' })
-    store.upsertSshRemotePtyLease({ targetId: 'ssh-1', ptyId: 'pty-3', state: 'detached' })
-    // Why: a PTY that exits mid-reattach is terminated before the batch write lands; it must stay dead.
     store.upsertSshRemotePtyLease({ targetId: 'ssh-1', ptyId: 'pty-4', state: 'terminated' })
-
-    recordFsCalls(dir)
-    try {
-      await store.markSshRemotePtyLeasesAttachedAsync('ssh-1', ['pty-1', 'pty-2', 'pty-4'])
-    } finally {
-      fsCalls.recording = false
-    }
-
-    expect(fsCalls.syncCalls).toEqual([])
-    const persisted = JSON.parse(readFileSync(dataFile(dir), 'utf-8')) as {
-      sshRemotePtyLeases: { ptyId: string; state: string }[]
-    }
-    expect(persisted.sshRemotePtyLeases).toEqual(
+    record(directory)
+    const write = vi.spyOn(authority, 'writeSerializedDomains')
+    await store.markSshRemotePtyLeasesAttachedAsync('ssh-1', ['pty-1', 'pty-2', 'pty-4'])
+    await authority.drainBackups()
+    fsCalls.recording = false
+    expect(fsCalls.sync).toEqual([])
+    expect(write).toHaveBeenCalledOnce()
+    expect(readState().sshRemotePtyLeases).toEqual(
       expect.arrayContaining([
         expect.objectContaining({ ptyId: 'pty-1', state: 'attached' }),
-        // An id-qualified reattach named this pty and succeeded, which is the one thing that can
-        // settle what `expired` meant: the client had lost its route, not that the shell died.
         expect.objectContaining({ ptyId: 'pty-2', state: 'attached' }),
         expect.objectContaining({ ptyId: 'pty-3', state: 'detached' }),
         expect.objectContaining({ ptyId: 'pty-4', state: 'terminated' })
@@ -830,97 +336,30 @@ describe('async persistence write path avoids synchronous fs syscalls', () => {
     )
   })
 
-  it('keeps async writers serialized across a synchronous shutdown flush', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const firstOpen = deferred()
-    const firstOpenRelease = deferred()
-    let held = false
-    fsCalls.waitAsync = (fn, target) => {
-      if (held || fn !== 'open' || !target.endsWith('.tmp')) {
-        return null
-      }
-      held = true
-      firstOpen.resolve()
-      return firstOpenRelease.promise
-    }
-
-    recordFsCalls(dir)
-    try {
-      const firstWrite = store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1'))
-      await firstOpen.promise
-      store.flushOrThrow()
-      const secondWrite = store.upsertSshPtyConsumerRecovery(consumerRecovery('client-2'))
-      await Promise.resolve()
-      await Promise.resolve()
-
-      expect(fsCalls.asyncCalls.filter((call) => call.startsWith('open:'))).toHaveLength(1)
-      firstOpenRelease.resolve()
-      await Promise.all([firstWrite, secondWrite])
-    } finally {
-      firstOpenRelease.resolve()
-      fsCalls.recording = false
-      fsCalls.waitAsync = null
-    }
-
-    const persisted = JSON.parse(readFileSync(dataFile(dir), 'utf-8')) as {
-      sshPtyConsumerRecoveries: { clientInstanceId: string }[]
-    }
-    expect(persisted.sshPtyConsumerRecoveries[0]?.clientInstanceId).toBe('client-2')
+  it('serializes queued durable mutations and refuses a synchronous live flush', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const gate = pauseCommit(authority)
+    const first = store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1'))
+    await gate.started
+    expect(() => store.flushOrThrow()).toThrow('awaited flush')
+    const second = store.upsertSshPtyConsumerRecovery(consumerRecovery('client-2'))
+    await Promise.resolve()
+    expect(
+      vi.mocked(authority.writeSerializedDomains).mock.calls.length +
+        vi.mocked(authority.writeCompleteSerializedDomains).mock.calls.length
+    ).toBe(1)
+    gate.release()
+    await Promise.all([first, second])
+    expect(readState().sshPtyConsumerRecoveries[0].clientInstanceId).toBe('client-2')
   })
 
-  it('lets a main-thread timer keep firing while a consumer-recovery write is in flight', async () => {
-    // The P1-A freeze itself: a stalled profile mount must not park the main thread on establish.
-    vi.useRealTimers()
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const stallMs = 1_000
-    // Why half: a sync write parks the loop for at least stallMs while the async path ticks every
-    // ~10ms, so this leaves room for scheduler jitter on a loaded runner without going vacuous.
-    const maxAcceptableGapMs = stallMs / 2
-
-    let lastTick = Date.now()
-    let worstGapMs = 0
-    const heartbeat = setInterval(() => {
-      const now = Date.now()
-      worstGapMs = Math.max(worstGapMs, now - lastTick)
-      lastTick = now
-    }, 10)
-
-    try {
-      fsCalls.dirPrefix = dir
-      fsCalls.stallMs = stallMs
-      fsCalls.recording = true
-      lastTick = Date.now()
-      const write = store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1'))
-      // Why not await first: a fully synchronous write finishes before the interval can fire, so the
-      // heartbeat would never observe the stall it exists to detect.
-      await new Promise((resolve) => setTimeout(resolve, stallMs + 200))
-      await write
-    } finally {
-      fsCalls.recording = false
-      clearInterval(heartbeat)
-    }
-
-    expect(worstGapMs).toBeLessThan(maxAcceptableGapMs)
-    expect(readFileSync(dataFile(dir), 'utf-8')).toContain('client-1')
-  }, 20_000)
-
-  it('keeps the sync quit/crash fallback on synchronous syscalls', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    seedStaleBackup(dir)
-
+  it('keeps admitted offline SQL checkpoints synchronous and durable', () => {
+    const { store, authority, dataFile } = createSqliteMaintenanceFixture()
+    const write = vi.spyOn(authority, 'writeCompleteSerializedDomains')
     store.updateUI({ sidebarWidth: 331 })
-    recordFsCalls(dir)
-    try {
-      store.flushOrThrow()
-    } finally {
-      fsCalls.recording = false
-    }
-
-    expect(fsCalls.syncCalls).toContain(`statSync:${dataFile(dir)}.bak.0`)
-    expect(fsCalls.syncCalls).toContain(`existsSync:${dataFile(dir)}`)
-    expect(fsCalls.asyncCalls).toEqual([])
+    store.flushOrThrow()
+    expect(write).toHaveBeenCalledOnce()
+    expect(JSON.parse(authority.readSerializedState() ?? '{}').ui.sidebarWidth).toBe(331)
+    expect(existsSync(dataFile)).toBe(false)
   })
 })
diff --git a/src/main/persistence-automations.test.ts b/src/main/persistence-automations.test.ts
index 9db16b7e681..fcd61b77ec3 100644
--- a/src/main/persistence-automations.test.ts
+++ b/src/main/persistence-automations.test.ts
@@ -1,16 +1,17 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { PersistedState } from '../shared/persisted-state-types'
-import { toRuntimeExecutionHostId, toSshExecutionHostId } from '../shared/execution-host'
 import {
+  closeTestStores,
   testState,
   createStore,
   writeDataFile,
   readDataFile,
   makeRepo
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { PersistedState } from '../shared/persisted-state-types'
+import { toRuntimeExecutionHostId, toSshExecutionHostId } from '../shared/execution-host'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -60,7 +61,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('can clear an automation back to the project default branch', async () => {
diff --git a/src/main/persistence-clipboard-selection-migration.test.ts b/src/main/persistence-clipboard-selection-migration.test.ts
index c04b4d5bdd6..552aa10b6f7 100644
--- a/src/main/persistence-clipboard-selection-migration.test.ts
+++ b/src/main/persistence-clipboard-selection-migration.test.ts
@@ -1,14 +1,15 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
 import {
+  closeTestStores,
   testState,
   createStore,
   withPlatform,
   writeDataFile,
   readDataFile
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -58,7 +59,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('migrates the legacy floating terminal disabled default to enabled', async () => {
diff --git a/src/main/persistence-cohort-and-identity-migration.test.ts b/src/main/persistence-cohort-and-identity-migration.test.ts
index a894b8a4c63..02afa7e3da5 100644
--- a/src/main/persistence-cohort-and-identity-migration.test.ts
+++ b/src/main/persistence-cohort-and-identity-migration.test.ts
@@ -1,11 +1,5 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { writeFileSync, rmSync, mkdtempSync, mkdirSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
-import { getDefaultWorkspaceSession } from '../shared/constants'
-import { folderWorkspaceKey, worktreeWorkspaceKey } from '../shared/workspace-scope'
 import {
+  closeTestStores,
   testState,
   createStore,
   dataFile,
@@ -15,6 +9,14 @@ import {
   makeWorktreeLineage,
   makeWorkspaceLineage
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { writeFileSync, rmSync, mkdtempSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
+import { getDefaultWorkspaceSession } from '../shared/constants'
+import { folderWorkspaceKey, worktreeWorkspaceKey } from '../shared/workspace-scope'
+import { createProfileStateStore } from './persistence/profile-state/profile-state-store-factory'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -64,7 +66,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── Telemetry cohort migration ─────────────────────────────────────
@@ -105,19 +108,16 @@ describe('Store', () => {
     expect(store.getSettings().theme).toBe('dark')
   })
 
-  it('still classifies as existing-user cohort when the data file is corrupt', async () => {
-    // Load-bearing: the corrupt-file catch path keeps `fileExistedOnLoad` true so a corrupted install isn't silently opted in as fresh.
-    mkdirSync(testState.dir, { recursive: true })
-    writeFileSync(dataFile(), '{{{corrupt json', 'utf-8')
-    const store = await createStore()
-    const t = store.getSettings().telemetry
-    expect(t).toBeDefined()
-    expect(t!.existedBeforeTelemetryRelease).toBe(true)
-    expect(t!.optedIn).toBeNull()
-    expect(t!.installId).toMatch(
-      /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
-    )
-    expect(store.getSettings().experimentalNewWorktreeCardStyle).toBe(false)
+  it('retains the existing-user cohort when a corrupt legacy primary recovers from backup', async () => {
+    await withRecoveredLegacyProfile((store) => {
+      const telemetry = store.getSettings().telemetry
+      expect(telemetry?.existedBeforeTelemetryRelease).toBe(true)
+      expect(telemetry?.optedIn).toBeNull()
+      expect(telemetry?.installId).toMatch(
+        /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
+      )
+      expect(store.getSettings().experimentalNewWorktreeCardStyle).toBe(false)
+    })
   })
 
   it('preserves an already-migrated telemetry block on subsequent launches', async () => {
@@ -152,7 +152,8 @@ describe('Store.migrateTabSwitchKeybindings', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
@@ -176,11 +177,10 @@ describe('Store.migrateTabSwitchKeybindings', () => {
     expect(store.getSettings().theme).toBe('dark')
   })
 
-  it('treats a corrupt data file as a pre-existing install', async () => {
-    mkdirSync(testState.dir, { recursive: true })
-    writeFileSync(dataFile(), '{{{corrupt json', 'utf-8')
-    const store = await createStore()
-    expect(store.getSettings().tabSwitchKeybindingSeed).toBe('pending')
+  it('retains the existing keybinding cohort when recovering a legacy backup', async () => {
+    await withRecoveredLegacyProfile((store) => {
+      expect(store.getSettings().tabSwitchKeybindingSeed).toBe('pending')
+    })
   })
 
   it('preserves an already-frozen cohort on subsequent launches', async () => {
@@ -209,7 +209,8 @@ describe('Store.migrateWorktreeIdentity', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
@@ -442,3 +443,21 @@ describe('Store.migrateWorktreeIdentity', () => {
     expect(store.getWorktreeMeta(OLD)?.priorWorktreeIds).toBeUndefined()
   })
 })
+
+async function withRecoveredLegacyProfile(
+  verify: (store: ReturnType<typeof createProfileStateStore>['store']) => void
+): Promise<void> {
+  writeDataFile({ schemaVersion: 1, repos: [], worktreeMeta: {}, settings: {}, ui: {} })
+  writeFileSync(`${dataFile()}.bak.0`, readFileSync(dataFile()))
+  writeFileSync(dataFile(), '{{{corrupt json')
+  const { store } = createProfileStateStore({
+    dataFile: dataFile(),
+    databaseFile: join(testState.dir, 'profile-state.db'),
+    profileId: 'cohort-recovery'
+  })
+  try {
+    verify(store)
+  } finally {
+    await store.freezeWritesAsync()
+  }
+}
diff --git a/src/main/persistence-cross-host-pane-identity.test.ts b/src/main/persistence-cross-host-pane-identity.test.ts
index 479d3727837..d3bdab23d6b 100644
--- a/src/main/persistence-cross-host-pane-identity.test.ts
+++ b/src/main/persistence-cross-host-pane-identity.test.ts
@@ -1,11 +1,5 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
-import { getDefaultWorkspaceSession } from '../shared/constants'
-import { isTerminalLeafId } from '../shared/stable-pane-id'
 import {
+  closeTestStores,
   testState,
   createStore,
   writeDataFile,
@@ -13,6 +7,13 @@ import {
   makeRepo,
   makeTerminalTab
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
+import { getDefaultWorkspaceSession } from '../shared/constants'
+import { isTerminalLeafId } from '../shared/stable-pane-id'
 
 vi.mock('electron', () => ({
   app: { getPath: () => testState.dir },
@@ -47,7 +48,8 @@ describe('cross-host pane identity migration', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/persistence-deregistered-repo-residue.test.ts b/src/main/persistence-deregistered-repo-residue.test.ts
index a7fb4d7353f..b519b04cad8 100644
--- a/src/main/persistence-deregistered-repo-residue.test.ts
+++ b/src/main/persistence-deregistered-repo-residue.test.ts
@@ -1,3 +1,12 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  writeDataFile,
+  readDataFile,
+  makeRepo,
+  makeTerminalTab
+} from './persistence-test-harness'
 // Why this file exists: deregistering a project used to strand every row it owned. No sweeper could
 // reach them because the missing-directory prune is gated on the repo still being registered.
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
@@ -8,14 +17,6 @@ import { getDefaultWorkspaceSession } from '../shared/constants'
 import { composeWorktreeHostIdentity } from '../shared/worktree/host-qualified-identity'
 import { folderWorkspaceKey, worktreeWorkspaceKey } from '../shared/workspace-scope'
 import type { PersistedState } from '../shared/persisted-state-types'
-import {
-  testState,
-  createStore,
-  writeDataFile,
-  readDataFile,
-  makeRepo,
-  makeTerminalTab
-} from './persistence-test-harness'
 
 vi.mock('./ssh/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
@@ -67,7 +68,8 @@ describe('deregistered repo residue', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-orphan-sweep-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
@@ -186,6 +188,31 @@ describe('deregistered repo residue', () => {
     expect(reloaded.sweepDeregisteredRepoResidue()).toEqual([])
   })
 
+  // A close record names its workspace only in its value, so like a sleeping agent it must seed the
+  // sweep itself or a removed project's records wait out the TTL.
+  it("drops a close record that is the orphan repo's only residue, and self-clears", async () => {
+    writeDataFile({
+      schemaVersion: 1,
+      repos: [makeRepo({ id: LIVE_REPO, path: '/workspace/live' })],
+      worktreeMeta: {},
+      workspaceSession: {
+        ...getDefaultWorkspaceSession(),
+        closedTerminalTabTombstonesByTabId: {
+          'tab-gone': { worktreeId: GONE_WORKTREE, closedAt: Date.now(), reason: 'user' },
+          'tab-live': { worktreeId: LIVE_WORKTREE, closedAt: Date.now(), reason: 'user' }
+        }
+      }
+    })
+
+    const store = await createStore()
+    store.flush()
+    expect(
+      Object.keys(store.getWorkspaceSession('local').closedTerminalTabTombstonesByTabId ?? {})
+    ).toEqual(['tab-live'])
+    const reloaded = await createStore()
+    expect(reloaded.sweepDeregisteredRepoResidue()).toEqual([])
+  })
+
   // The session scalars are pruned by bespoke rules, not by owner key, so no owner-key loop reaches
   // them. Each has to be able to seed the sweep on its own or an orphan named only there is stuck.
   it.each([
diff --git a/src/main/persistence-duplicate-repo-id-host-scope.test.ts b/src/main/persistence-duplicate-repo-id-host-scope.test.ts
index 0da93c3a979..48cb826f909 100644
--- a/src/main/persistence-duplicate-repo-id-host-scope.test.ts
+++ b/src/main/persistence-duplicate-repo-id-host-scope.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from './persistence-test-harness'
 /**
  * The same repo id may be registered on two execution hosts (see `removeProjectForHost`).
  * Every deletion that resolves a *row* must therefore delete only that row: `removeProject`
@@ -57,7 +58,7 @@ async function createStoreFromState(state: Record<string, unknown>) {
   // file's temp dir rather than the global fake's shared one, after resetModules.
   installFakeAppEnvironment({ getPath: () => testState.dir })
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 function createStoreWithDuplicateRepoId() {
@@ -98,7 +99,8 @@ beforeEach(() => {
   testState.dir = mkdtempSync(join(tmpdir(), 'orca-dup-repo-id-'))
 })
 
-afterEach(() => {
+afterEach(async () => {
+  await closeTestStores()
   rmSync(testState.dir, { recursive: true, force: true })
 })
 
diff --git a/src/main/persistence-feature-interaction-broadcast.benchmark.test.ts b/src/main/persistence-feature-interaction-broadcast.benchmark.test.ts
index cfb7f555b08..95f4836d692 100644
--- a/src/main/persistence-feature-interaction-broadcast.benchmark.test.ts
+++ b/src/main/persistence-feature-interaction-broadcast.benchmark.test.ts
@@ -1,4 +1,9 @@
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson
+} from './persistence-test-harness'
+import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { performance } from 'node:perf_hooks'
@@ -27,11 +32,12 @@ function createStore(name: string): { dataFile: string; store: Store } {
   const dir = mkdtempSync(join(tmpdir(), `orca-ui-broadcast-${name}-`))
   tempDirs.push(dir)
   const dataFile = join(dir, 'orca-data.json')
-  return { dataFile, store: new Store({ dataFile }) }
+  return { dataFile, store: createSqliteTestStore(Store, { dataFile }) }
 }
 
 describe('feature interaction UI broadcast benchmark', () => {
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     for (const dir of tempDirs.splice(0)) {
       rmSync(dir, { recursive: true, force: true })
     }
@@ -76,9 +82,12 @@ describe('feature interaction UI broadcast benchmark', () => {
     ).toBe(INTERACTIONS)
     optimizedStore.flush()
     expect(
-      new Store({ dataFile }).getUI().featureInteractions?.['agent-orchestration']?.interactionCount
+      createSqliteTestStore(Store, { dataFile }).getUI().featureInteractions?.[
+        'agent-orchestration'
+      ]?.interactionCount
     ).toBe(INTERACTIONS)
-    const persisted = JSON.parse(readFileSync(dataFile, 'utf8')) as PersistedState
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const persisted = JSON.parse(readPersistedStateJson(dataFile)) as PersistedState
     expect(persisted.featureInteractionTelemetryBuckets?.['agent-orchestration']).toBe(
       'count_200_499'
     )
diff --git a/src/main/persistence-floating-terminal-trust.test.ts b/src/main/persistence-floating-terminal-trust.test.ts
index 630a1c16559..49ea6457e6d 100644
--- a/src/main/persistence-floating-terminal-trust.test.ts
+++ b/src/main/persistence-floating-terminal-trust.test.ts
@@ -1,15 +1,16 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync, mkdirSync, realpathSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { PersistedState } from '../shared/persisted-state-types'
 import {
+  closeTestStores,
   testState,
   createStore,
   writeDataFile,
   readDataFile,
   symlinkDirectorySync
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync, mkdirSync, realpathSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { PersistedState } from '../shared/persisted-state-types'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -59,7 +60,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('seeds trusted floating workspace directories from legacy explicit cwd values', async () => {
diff --git a/src/main/persistence-flush-and-save-scheduling.test.ts b/src/main/persistence-flush-and-save-scheduling.test.ts
index 2d6180d5fa8..dbe4ce8262f 100644
--- a/src/main/persistence-flush-and-save-scheduling.test.ts
+++ b/src/main/persistence-flush-and-save-scheduling.test.ts
@@ -1,10 +1,13 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync, mkdirSync, existsSync, statSync } from 'node:fs'
+import { rmSync, mkdtempSync, mkdirSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { PersistedState } from '../shared/persisted-state-types'
 import type { Repo } from '../shared/repo-types'
 import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson,
   testState,
   createStore,
   withPlatform,
@@ -68,9 +71,10 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
     vi.restoreAllMocks()
     _resetPtyBindingSpanSamplingForTests()
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── 10. flush writes synchronously ─────────────────────────────────
@@ -85,6 +89,26 @@ describe('Store', () => {
     expect(persisted.repos[0].id).toBe('r1')
   })
 
+  it('durably commits an exact JSON operation before a following microtask changes generation', async () => {
+    const store = await createStore()
+    const originalTabId = store.getWorkspaceSession().activeTabId
+    await store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'dark' })
+      queueMicrotask(() => {
+        store.setWorkspaceSession({ ...store.getWorkspaceSession(), activeTabId: 'newer-tab' })
+      })
+      return { value: undefined }
+    })
+    expect(readDataFile()).toMatchObject({
+      settings: { theme: 'dark' },
+      workspaceSession: { activeTabId: originalTabId }
+    })
+    expect(store.getWorkspaceSession().activeTabId).toBe('newer-tab')
+    await store.flushPendingOrThrowAsync()
+    expect(readDataFile()).toHaveProperty(['workspaceSession', 'activeTabId'], 'newer-tab')
+    store.freezeWrites()
+  })
+
   it('flush remains safe when a debounced save is also pending', async () => {
     vi.useFakeTimers()
     try {
@@ -126,7 +150,7 @@ describe('Store', () => {
   })
 
   // ── Content-hash write skipping ────────────────────────────────────
-  // Why inode comparison: every real write is a tmp+rename (new inode), so an unchanged inode proves no write happened.
+  // Retained ciphertext makes an unintended secret rewrite visible in the SQL projection.
 
   it('skips the disk write when a mutation burst nets out to already-persisted state', async () => {
     vi.useFakeTimers()
@@ -135,14 +159,14 @@ describe('Store', () => {
       store.updateUI({ sidebarWidth: 400 })
       vi.advanceTimersByTime(1000)
       await store.waitForPendingWrite()
-      const inoBefore = statSync(dataFile()).ino
+      const stateBefore = readPersistedStateJson(dataFile())
 
       store.updateUI({ sidebarWidth: 500 })
       store.updateUI({ sidebarWidth: 400 })
       vi.advanceTimersByTime(2000)
       await store.waitForPendingWrite()
 
-      expect(statSync(dataFile()).ino).toBe(inoBefore)
+      expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
     } finally {
       vi.useRealTimers()
     }
@@ -155,11 +179,11 @@ describe('Store', () => {
       store.updateUI({ sidebarWidth: 420 })
       vi.advanceTimersByTime(1000)
       await store.waitForPendingWrite()
-      const inoBefore = statSync(dataFile()).ino
+      const stateBefore = readPersistedStateJson(dataFile())
 
       store.flush()
 
-      expect(statSync(dataFile()).ino).toBe(inoBefore)
+      expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
     } finally {
       vi.useRealTimers()
     }
@@ -177,7 +201,7 @@ describe('Store', () => {
       }
       await store.waitForPendingWrite()
 
-      expect(existsSync(dataFile())).toBe(true)
+      expect(existsSync(join(testState.dir, 'profile-state.db'))).toBe(true)
       const persisted = readDataFile() as { ui: { sidebarWidth: number } }
       expect(persisted.ui.sidebarWidth).toBeGreaterThanOrEqual(400)
     } finally {
@@ -220,13 +244,13 @@ describe('Store', () => {
       leafId: TEST_LEAF_1,
       ptyId: 'daemon-pty'
     }
-    store.persistPtyBinding(binding)
-    const inoBefore = statSync(dataFile()).ino
+    await store.persistPtyBinding(binding)
+    const stateBefore = readPersistedStateJson(dataFile())
 
     // Warm-restart re-bind storm: an identical binding re-asserted with a sync flush must not rewrite.
-    store.persistPtyBinding(binding)
+    await store.persistPtyBinding(binding)
 
-    expect(statSync(dataFile()).ino).toBe(inoBefore)
+    expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
   })
 
   // ── worktreeMeta startup GC ────────────────────────────────────────
@@ -326,14 +350,14 @@ describe('Store', () => {
       store.updateUI({ sidebarWidth: 411 })
       vi.advanceTimersByTime(1000)
       await store.waitForPendingWrite()
-      const inoBefore = statSync(dataFile()).ino
+      const stateBefore = readPersistedStateJson(dataFile())
       expect((readDataFile() as { githubCache?: unknown }).githubCache).toBeUndefined()
 
       store.setGitHubCache({ pr: { 'o/r#1': { fetchedAt: 123 } as never }, issue: {} })
       vi.advanceTimersByTime(6000)
       await store.waitForPendingWrite()
 
-      expect(statSync(dataFile()).ino).toBe(inoBefore)
+      expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
     } finally {
       vi.useRealTimers()
     }
@@ -360,17 +384,17 @@ describe('Store', () => {
     vi.resetModules()
     const { Store, initDataPath } = await import('./persistence')
     initDataPath()
-    const profileAStore = new Store({ dataFile: profileADataFile })
+    const profileAStore = createSqliteTestStore(Store, { dataFile: profileADataFile })
     profileAStore.setGitHubCache({ pr: { 'o/r#a': { fetchedAt: 10 } as never }, issue: {} })
     profileAStore.flush()
 
-    const profileBStore = new Store({ dataFile: profileBDataFile })
+    const profileBStore = createSqliteTestStore(Store, { dataFile: profileBDataFile })
     expect(profileBStore.getGitHubCache().pr['o/r#a']).toBeUndefined()
     profileBStore.setGitHubCache({ pr: { 'o/r#b': { fetchedAt: 20 } as never }, issue: {} })
     profileBStore.flush()
 
-    const restartedProfileA = new Store({ dataFile: profileADataFile })
-    const restartedProfileB = new Store({ dataFile: profileBDataFile })
+    const restartedProfileA = createSqliteTestStore(Store, { dataFile: profileADataFile })
+    const restartedProfileB = createSqliteTestStore(Store, { dataFile: profileBDataFile })
     expect(restartedProfileA.getGitHubCache().pr['o/r#a']).toEqual({ fetchedAt: 10 })
     expect(restartedProfileA.getGitHubCache().pr['o/r#b']).toBeUndefined()
     expect(restartedProfileB.getGitHubCache().pr['o/r#b']).toEqual({ fetchedAt: 20 })
@@ -423,7 +447,7 @@ describe('Store', () => {
       }
     }
 
-    afterEach(() => {
+    afterEach(async () => {
       _resetTracerForTests()
     })
 
@@ -432,47 +456,53 @@ describe('Store', () => {
       async (hostId) => {
         const store = await createStore()
         store.setWorkspaceSession(boundSession(), hostId)
-        expect(store.persistPtyBinding(binding, hostId)).toBe(true)
-        const inoBefore = statSync(dataFile()).ino
-        const flushSpy = vi.spyOn(store, 'flushOrThrow')
+        expect(await store.persistPtyBinding(binding, hostId)).toBe(true)
+        const stateBefore = readPersistedStateJson(dataFile())
+        const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
         const cloneSpy = vi.spyOn(globalThis, 'structuredClone')
 
-        expect(store.persistPtyBinding(binding, hostId)).toBe(true)
+        expect(await store.persistPtyBinding(binding, hostId)).toBe(true)
 
-        expect(flushSpy).not.toHaveBeenCalled()
+        expect(runtimeCounters(store).lastDurableWriteGeneration).toBe(durableGenerationBefore)
         expect(cloneSpy).not.toHaveBeenCalled()
-        expect(statSync(dataFile()).ino).toBe(inoBefore)
+        expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
       }
     )
 
     it('flushes while a save is pending, and the sync hash match makes the next call durable', async () => {
       const store = await createStore()
       store.setWorkspaceSession(boundSession())
-      store.persistPtyBinding(binding)
-      const inoBefore = statSync(dataFile()).ino
+      await store.persistPtyBinding(binding)
+      const stateBefore = readPersistedStateJson(dataFile())
       // Bumps the write generation without changing any binding.
       store.setWorkspaceSession({ ...store.getWorkspaceSession() })
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
-      expect(store.persistPtyBinding(binding)).toBe(true)
-      expect(flushSpy).toHaveBeenCalledTimes(1)
-      expect(statSync(dataFile()).ino).toBe(inoBefore)
+      expect(await store.persistPtyBinding(binding)).toBe(true)
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBeGreaterThan(
+        durableGenerationBefore
+      )
+      expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
 
       // Without the writeToDiskSync counter fix the hash-match flush leaves the durable
       // generation one behind and this third bind would flush again.
-      expect(store.persistPtyBinding(binding)).toBe(true)
-      expect(flushSpy).toHaveBeenCalledTimes(1)
+      expect(await store.persistPtyBinding(binding)).toBe(true)
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBeGreaterThan(
+        durableGenerationBefore
+      )
     })
 
     it('falls through on an incarnation change and persists the new incarnation', async () => {
       const store = await createStore()
       store.setWorkspaceSession(boundSession())
-      store.persistPtyBinding({ ...binding, incarnationId: 'a' })
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      await store.persistPtyBinding({ ...binding, incarnationId: 'a' })
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
-      expect(store.persistPtyBinding({ ...binding, incarnationId: 'b' })).toBe(true)
+      expect(await store.persistPtyBinding({ ...binding, incarnationId: 'b' })).toBe(true)
 
-      expect(flushSpy).toHaveBeenCalledTimes(1)
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBeGreaterThan(
+        durableGenerationBefore
+      )
       expect(readDataFile()).toHaveProperty(
         ['workspaceSession', 'terminalPtyIncarnationsByPaneKey', paneKey],
         'b'
@@ -482,18 +512,19 @@ describe('Store', () => {
     it('does not acknowledge an unpersisted binding published after the final flush', async () => {
       const store = await createStore()
       store.setWorkspaceSession(boundSession())
-      store.persistPtyBinding(binding)
+      await store.persistPtyBinding(binding)
       await store.flushAsync()
 
       const next = boundSession()
       next.tabsByWorktree[WORKTREE][0].ptyId = 'pty-after-quit'
       next.terminalLayoutsByTabId.tab1.ptyIdsByLeafId = { [TEST_LEAF_1]: 'pty-after-quit' }
-      store.setWorkspaceSession(next)
+      expect(() => store.setWorkspaceSession(next)).toThrow('finalization')
+      Object.assign(store.getWorkspaceSession(), next)
       expect(store.getWorkspaceSession().tabsByWorktree[WORKTREE][0].ptyId).toBe('pty-after-quit')
 
-      expect(() => store.persistPtyBinding({ ...binding, ptyId: 'pty-after-quit' })).toThrow(
-        'Cannot synchronously flush after final persistence has started'
-      )
+      await expect(
+        store.persistPtyBinding({ ...binding, ptyId: 'pty-after-quit' })
+      ).rejects.toThrow('Cannot mutate finalized profile persistence')
       expect(readDataFile()).toHaveProperty(
         ['workspaceSession', 'tabsByWorktree', WORKTREE, '0', 'ptyId'],
         'pty-1'
@@ -503,12 +534,14 @@ describe('Store', () => {
     it('treats an undefined incarnation against a recorded one as a miss', async () => {
       const store = await createStore()
       store.setWorkspaceSession(boundSession())
-      store.persistPtyBinding({ ...binding, incarnationId: 'a' })
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      await store.persistPtyBinding({ ...binding, incarnationId: 'a' })
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
-      expect(store.persistPtyBinding(binding)).toBe(true)
+      expect(await store.persistPtyBinding(binding)).toBe(true)
 
-      expect(flushSpy).toHaveBeenCalledTimes(1)
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBeGreaterThan(
+        durableGenerationBefore
+      )
     })
 
     it('falls through on a tombstone and lets the write path clear it', async () => {
@@ -532,11 +565,13 @@ describe('Store', () => {
       expect(
         store.getWorkspaceSession().terminalSurfaceTombstonesByPaneKey?.[paneKey]
       ).toBeDefined()
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
-      expect(store.persistPtyBinding({ ...binding, incarnationId: 'inc-1' })).toBe(true)
+      expect(await store.persistPtyBinding({ ...binding, incarnationId: 'inc-1' })).toBe(true)
 
-      expect(flushSpy).toHaveBeenCalledTimes(1)
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBeGreaterThan(
+        durableGenerationBefore
+      )
       expect(
         store.getWorkspaceSession().terminalSurfaceTombstonesByPaneKey?.[paneKey]
       ).toBeUndefined()
@@ -547,20 +582,22 @@ describe('Store', () => {
       store.setWorkspaceSession(
         boundSession({ terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-stale' } })
       )
-      store.persistPtyBinding({ ...binding, incarnationId: 'inc-stale' })
+      await store.persistPtyBinding({ ...binding, incarnationId: 'inc-stale' })
       const revisionBefore =
         store.getWorkspaceSession().terminalTopologyRevisionByRepoId?.repo1 ?? 0
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
       expect(
-        store.persistPtyBinding({
+        await store.persistPtyBinding({
           ...binding,
           incarnationId: 'inc-live',
           expectedBinding: { ptyId: 'pty-1', incarnationId: 'inc-stale' }
         })
       ).toBe(true)
 
-      expect(flushSpy).toHaveBeenCalledTimes(1)
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBeGreaterThan(
+        durableGenerationBefore
+      )
       expect(store.getWorkspaceSession().terminalTopologyRevisionByRepoId?.repo1).toBe(
         revisionBefore + 1
       )
@@ -571,8 +608,8 @@ describe('Store', () => {
       store.setWorkspaceSession(
         boundSession({ terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-1' } })
       )
-      store.persistPtyBinding({ ...binding, incarnationId: 'inc-1' })
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      await store.persistPtyBinding({ ...binding, incarnationId: 'inc-1' })
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
       const refusals = [
         {
@@ -583,9 +620,9 @@ describe('Store', () => {
         { ...binding, tabId: 'missing-tab', mayCreate: false }
       ]
       for (const refusal of refusals) {
-        expect(store.persistPtyBinding(refusal)).toBe(false)
+        expect(await store.persistPtyBinding(refusal)).toBe(false)
       }
-      expect(flushSpy).not.toHaveBeenCalled()
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBe(durableGenerationBefore)
     })
 
     it.each([undefined, 'ssh:ssh-1', 'runtime:runtime-1'])(
@@ -593,14 +630,16 @@ describe('Store', () => {
       async (hostId) => {
         const store = await createStore()
         store.setWorkspaceSession(boundSession(), hostId)
-        expect(store.persistPtyBinding(binding, hostId)).toBe(true)
+        expect(await store.persistPtyBinding(binding, hostId)).toBe(true)
         store.addRepo(makeRepo({ id: 'r-dirty', path: '/dirty' }))
-        const flushSpy = vi.spyOn(store, 'flushOrThrow')
+        const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
-        expect(store.persistPtyBinding(binding, hostId)).toBe(true)
-        expect(store.persistPtyBinding(binding, hostId)).toBe(true)
+        expect(await store.persistPtyBinding(binding, hostId)).toBe(true)
+        expect(await store.persistPtyBinding(binding, hostId)).toBe(true)
 
-        expect(flushSpy).toHaveBeenCalledTimes(1)
+        expect(runtimeCounters(store).lastDurableWriteGeneration).toBeGreaterThan(
+          durableGenerationBefore
+        )
         expect(readDataFile()).toMatchObject({
           repos: expect.arrayContaining([expect.objectContaining({ id: 'r-dirty' })])
         })
@@ -610,27 +649,31 @@ describe('Store', () => {
     it('flushes again once the session object is replaced', async () => {
       const store = await createStore()
       store.setWorkspaceSession(boundSession())
-      store.persistPtyBinding(binding)
+      await store.persistPtyBinding(binding)
       // A renderer publish schedules another save, so global durability must be re-established.
       store.setWorkspaceSession({ ...store.getWorkspaceSession() })
       store.addRepo(makeRepo({ id: 'r-dirty', path: '/dirty' }))
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
-      expect(store.persistPtyBinding(binding)).toBe(true)
+      expect(await store.persistPtyBinding(binding)).toBe(true)
 
-      expect(flushSpy).toHaveBeenCalledTimes(1)
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBeGreaterThan(
+        durableGenerationBefore
+      )
     })
 
     it('flushes a changed pty for a pane whose old binding was durable', async () => {
       const store = await createStore()
       store.setWorkspaceSession(boundSession())
-      store.persistPtyBinding(binding)
+      await store.persistPtyBinding(binding)
       store.addRepo(makeRepo({ id: 'r-dirty', path: '/dirty' }))
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
-      expect(store.persistPtyBinding({ ...binding, ptyId: 'pty-next' })).toBe(true)
+      expect(await store.persistPtyBinding({ ...binding, ptyId: 'pty-next' })).toBe(true)
 
-      expect(flushSpy).toHaveBeenCalledTimes(1)
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBeGreaterThan(
+        durableGenerationBefore
+      )
       expect(readDataFile()).toHaveProperty(
         ['workspaceSession', 'terminalLayoutsByTabId', 'tab1', 'ptyIdsByLeafId', TEST_LEAF_1],
         'pty-next'
@@ -658,16 +701,16 @@ describe('Store', () => {
       )
       const sibling = { ...binding, leafId: TEST_LEAF_2, ptyId: 'pty-2' }
       // First remount after a cold park: both panes reattach back to back.
-      expect(store.persistPtyBinding(binding)).toBe(true)
-      expect(store.persistPtyBinding(sibling)).toBe(true)
+      expect(await store.persistPtyBinding(binding)).toBe(true)
+      expect(await store.persistPtyBinding(sibling)).toBe(true)
       expect(store.getWorkspaceSession().tabsByWorktree?.[WORKTREE]?.[0]?.ptyId).toBe('pty-1')
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
       // Second remount: neither pane may rewrite the tab row, so neither flushes.
-      expect(store.persistPtyBinding(sibling)).toBe(true)
-      expect(store.persistPtyBinding(binding)).toBe(true)
+      expect(await store.persistPtyBinding(sibling)).toBe(true)
+      expect(await store.persistPtyBinding(binding)).toBe(true)
 
-      expect(flushSpy).not.toHaveBeenCalled()
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBe(durableGenerationBefore)
       expect(store.getWorkspaceSession().tabsByWorktree?.[WORKTREE]?.[0]?.ptyId).toBe('pty-1')
     })
 
@@ -675,14 +718,14 @@ describe('Store', () => {
       const store = await createStore()
       const hostId = 'ssh:ssh-1'
       store.setWorkspaceSession(boundSession(), hostId)
-      expect(store.persistPtyBinding(binding, hostId)).toBe(true)
+      expect(await store.persistPtyBinding(binding, hostId)).toBe(true)
       const partitionBefore = store.getWorkspaceSession(hostId)
       const partitionsBefore = store['runtime'].state.workspaceSessionsByHostId
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
-      expect(store.persistPtyBinding(binding, hostId)).toBe(true)
+      expect(await store.persistPtyBinding(binding, hostId)).toBe(true)
 
-      expect(flushSpy).not.toHaveBeenCalled()
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBe(durableGenerationBefore)
       expect(store.getWorkspaceSession(hostId)).toBe(partitionBefore)
       expect(store['runtime'].state.workspaceSessionsByHostId).toBe(partitionsBefore)
       expect(store.getWorkspaceSession().tabsByWorktree?.[WORKTREE]).toBeUndefined()
@@ -692,13 +735,13 @@ describe('Store', () => {
       const store = await createStore()
       store.addRepo(makeRepo())
       store.flushOrThrow()
-      const inoBefore = statSync(dataFile()).ino
+      const stateBefore = readPersistedStateJson(dataFile())
       const after = runtimeCounters(store)
       expect(after.lastDurableWriteGeneration).toBe(after.writeGeneration)
 
       store.flushOrThrow()
 
-      expect(statSync(dataFile()).ino).toBe(inoBefore)
+      expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
       const counters = runtimeCounters(store)
       expect(counters.writeGeneration).toBe(after.writeGeneration + 1)
       expect(counters.lastDurableWriteGeneration).toBe(counters.writeGeneration)
@@ -716,9 +759,9 @@ describe('Store', () => {
       const store = await createStore()
       store.setWorkspaceSession(boundSession())
 
-      store.persistPtyBinding(binding)
-      store.persistPtyBinding(binding)
-      store.persistPtyBinding({ ...binding, tabId: 'missing-tab', mayCreate: false })
+      await store.persistPtyBinding(binding)
+      await store.persistPtyBinding(binding)
+      await store.persistPtyBinding({ ...binding, tabId: 'missing-tab', mayCreate: false })
 
       const spans = records.filter(
         (record) =>
diff --git a/src/main/persistence-folder-workspace-notes.test.ts b/src/main/persistence-folder-workspace-notes.test.ts
index 762cdb2df01..43abe5b7412 100644
--- a/src/main/persistence-folder-workspace-notes.test.ts
+++ b/src/main/persistence-folder-workspace-notes.test.ts
@@ -1,3 +1,10 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  writeDataFile,
+  readDataFile
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
@@ -5,7 +12,6 @@ import { tmpdir } from 'node:os'
 import type { PersistedState } from '../shared/persisted-state-types'
 import { folderWorkspaceKey } from '../shared/workspace-scope'
 import { folderWorkspaceToWorktree } from '../shared/folder-workspace-worktree'
-import { testState, createStore, writeDataFile, readDataFile } from './persistence-test-harness'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -55,7 +61,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── 8b. Folder-workspace review notes across a build rollback ──
diff --git a/src/main/persistence-host-admitted-terminal-membership.test.ts b/src/main/persistence-host-admitted-terminal-membership.test.ts
index d71dbc9882c..83a6898c667 100644
--- a/src/main/persistence-host-admitted-terminal-membership.test.ts
+++ b/src/main/persistence-host-admitted-terminal-membership.test.ts
@@ -1,3 +1,9 @@
+import {
+  closeTestStores,
+  createStore,
+  makeTerminalTab,
+  testState
+} from './persistence-test-harness'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -6,7 +12,6 @@ import { getDefaultWorkspaceSession } from '../shared/constants'
 import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
 import { retireTerminalSurfaceFromPersistence } from './runtime/mobile-session-terminal-persistence-retirement'
 import { TEST_LEAF_1, TEST_LEAF_2 } from './persistence-session-fixtures'
-import { createStore, makeTerminalTab, testState } from './persistence-test-harness'
 
 vi.mock('electron', () => ({
   app: { getPath: () => testState.dir },
@@ -47,7 +52,8 @@ describe('host-admitted terminal membership survives a stale renderer replay', (
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-host-membership-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
@@ -57,7 +63,7 @@ describe('host-admitted terminal membership survives a stale renderer replay', (
 
     // `orca terminal create`: the host mints a tab the renderer has never seen.
     expect(
-      store.persistPtyBinding({
+      await store.persistPtyBinding({
         worktreeId: WORKTREE,
         tabId: 'host-tab',
         leafId: TEST_LEAF_2,
@@ -77,7 +83,7 @@ describe('host-admitted terminal membership survives a stale renderer replay', (
     const store = await createStore()
     store.setWorkspaceSession(rendererSession())
 
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: OTHER_WORKTREE,
       tabId: 'host-tab-other',
       leafId: TEST_LEAF_2,
@@ -94,7 +100,7 @@ describe('host-admitted terminal membership survives a stale renderer replay', (
     store.setWorkspaceSession(rendererSession())
 
     expect(
-      store.persistPtyBinding({
+      await store.persistPtyBinding({
         worktreeId: WORKTREE,
         tabId: 'host-tab',
         leafId: TEST_LEAF_2,
@@ -118,7 +124,7 @@ describe('host-admitted terminal membership survives a stale renderer replay', (
     const store = await createStore()
     store.setWorkspaceSession(rendererSession())
 
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: WORKTREE,
       tabId: 'renderer-second-tab',
       leafId: TEST_LEAF_2,
@@ -130,12 +136,12 @@ describe('host-admitted terminal membership survives a stale renderer replay', (
   })
 
   // Closing must still work afterwards. Closes are host-driven: the retirement is
-  // computed from the store's own session (see persistTerminalSurfaceRetirements),
+  // computed from the store's own session (see stageTerminalSurfaceRetirements),
   // which is what outranks the fence this create just raised.
   it('still lets the authoritative retirement path close the host-admitted tab', async () => {
     const store = await createStore()
     store.setWorkspaceSession(rendererSession())
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: WORKTREE,
       tabId: 'host-tab',
       leafId: TEST_LEAF_2,
diff --git a/src/main/persistence-host-partitioned-sessions.test.ts b/src/main/persistence-host-partitioned-sessions.test.ts
index d831ec85883..9c3aad9620f 100644
--- a/src/main/persistence-host-partitioned-sessions.test.ts
+++ b/src/main/persistence-host-partitioned-sessions.test.ts
@@ -1,11 +1,5 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { readFileSync, rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
-import { getDefaultWorkspaceSession } from '../shared/constants'
-import { isTerminalLeafId } from '../shared/stable-pane-id'
 import {
+  closeTestStores,
   testState,
   createStore,
   dataFile,
@@ -16,6 +10,14 @@ import {
   makeWorktreeLineage,
   makeWorkspaceLineage
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { readFileSync, rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
+import { getDefaultWorkspaceSession } from '../shared/constants'
+import { isTerminalLeafId } from '../shared/stable-pane-id'
+
 import { worktreeWorkspaceKey } from '../shared/workspace-scope'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
@@ -63,7 +65,8 @@ describe('Store host-partitioned workspace sessions', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/persistence-host-partitioned-ssh-pty-bindings.test.ts b/src/main/persistence-host-partitioned-ssh-pty-bindings.test.ts
index ff819432c54..9010f11285a 100644
--- a/src/main/persistence-host-partitioned-ssh-pty-bindings.test.ts
+++ b/src/main/persistence-host-partitioned-ssh-pty-bindings.test.ts
@@ -1,10 +1,13 @@
+import { closeTestStores, testState, createStore } from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
+import { ProfileStateSqliteAuthority } from './persistence/profile-state/profile-state-sqlite-authority'
 import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
 import { getDefaultWorkspaceSession } from '../shared/constants'
-import { testState, createStore } from './persistence-test-harness'
+
 import { TEST_LEAF_1 } from './persistence-session-fixtures'
 
 const { trackMock, getCohortAtEmitMock } = vi.hoisted(() => ({
@@ -42,7 +45,8 @@ describe('Store SSH remote PTY bindings across host partitions', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
@@ -80,7 +84,7 @@ describe('Store SSH remote PTY bindings across host partitions', () => {
     store.setWorkspaceSession(makeBoundHostSession(null), 'local')
     store.setWorkspaceSession(makeBoundHostSession(null), 'ssh:ssh-1')
 
-    store.persistPtyBinding(
+    await store.persistPtyBinding(
       {
         worktreeId: 'repo-1::/worktree',
         tabId: 'tab-1',
@@ -102,11 +106,14 @@ describe('Store SSH remote PTY bindings across host partitions', () => {
     const store = await createStore()
     store.setWorkspaceSession(makeBoundHostSession(null), 'local')
     store.setWorkspaceSession(makeBoundHostSession(null), 'ssh:ssh-1')
-    const flush = vi.spyOn(store, 'flushOrThrow').mockImplementationOnce(() => {
-      throw new Error('disk unavailable')
-    })
+    store.flushOrThrow()
+    const flush = vi
+      .spyOn(ProfileStateSqliteAuthority.prototype, 'writeSerializedDomains')
+      .mockImplementationOnce(() => {
+        throw new Error('disk unavailable')
+      })
 
-    expect(() =>
+    await expect(
       store.persistPtyBinding(
         {
           worktreeId: 'repo-1::/worktree',
@@ -116,7 +123,7 @@ describe('Store SSH remote PTY bindings across host partitions', () => {
         },
         'ssh:ssh-1'
       )
-    ).toThrow('disk unavailable')
+    ).rejects.toThrow('disk unavailable')
     flush.mockRestore()
 
     expect(
diff --git a/src/main/persistence-initial-load.test.ts b/src/main/persistence-initial-load.test.ts
index 934ab44e1cb..13beae7932c 100644
--- a/src/main/persistence-initial-load.test.ts
+++ b/src/main/persistence-initial-load.test.ts
@@ -1,3 +1,14 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  writeDataFile,
+  readDataFile,
+  makeRepo,
+  makeProject,
+  makeProjectHostSetup,
+  createSqliteTestStore
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { writeFileSync, rmSync, mkdtempSync, mkdirSync } from 'node:fs'
 import { join } from 'node:path'
@@ -6,16 +17,10 @@ import type { PersistedState } from '../shared/persisted-state-types'
 import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
 import { getDefaultPersistedState, getDefaultWorkspaceSession } from '../shared/constants'
 import { closeTerminalTabInWorkspaceSession } from '../shared/workspace-session-terminal-tab-close'
-import {
-  testState,
-  createStore,
-  writeDataFile,
-  readDataFile,
-  makeRepo,
-  makeProject,
-  makeProjectHostSetup
-} from './persistence-test-harness'
+
 import { TEST_LEAF_1 } from './persistence-session-fixtures'
+import { ProfileStateSqliteAuthority } from './persistence/profile-state/profile-state-sqlite-authority'
+
 import {
   getLocalWorktreeScanGeneration,
   isLocalWorktreeScanGenerationCurrent
@@ -69,7 +74,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── 1. Defaults when no file exists ──────────────────────────────────
@@ -79,7 +85,7 @@ describe('Store', () => {
     expect(store.getRepos()).toEqual([])
   }, 15_000)
 
-  it('clone-reads and synchronously persists the main-owned Codex reset ledger', async () => {
+  it('clone-reads and durably persists the main-owned Codex reset ledger', async () => {
     const store = await createStore()
     const ledger = {
       version: 1 as const,
@@ -97,7 +103,7 @@ describe('Store', () => {
       ]
     }
 
-    store.replaceCodexResetCreditAttemptLedgerAndFlush(ledger)
+    await store.replaceCodexResetCreditAttemptLedgerAndFlush(ledger)
     const firstRead = store.getCodexResetCreditAttemptLedger()
     firstRead.attempts.splice(0, 1)
 
@@ -105,32 +111,37 @@ describe('Store', () => {
     expect((readDataFile() as PersistedState).codexResetCreditAttemptLedger).toEqual(ledger)
   })
 
-  it('rolls the in-memory Codex reset ledger back when its sync flush fails', async () => {
+  it('rolls the in-memory Codex reset ledger back when its durable write fails', async () => {
     const store = await createStore()
     const before = store.getCodexResetCreditAttemptLedger()
-    vi.spyOn(store, 'flushOrThrow').mockImplementationOnce(() => {
-      throw new Error('disk full')
-    })
-
-    expect(() =>
-      store.replaceCodexResetCreditAttemptLedgerAndFlush({
-        version: 1,
-        attempts: [
-          {
-            idempotencyKey: '11111111-1111-4111-8111-111111111111',
-            expectedScope: {
-              target: { runtime: 'host', wslDistro: null },
-              accountId: 'account-host',
-              accountRevision: 42,
-              offerRevision: 'v1:offer'
-            },
-            state: 'providerPending'
-          }
-        ]
+    const write = vi
+      .spyOn(ProfileStateSqliteAuthority.prototype, 'writeCompleteSerializedDomains')
+      .mockImplementationOnce(() => {
+        throw new Error('disk full')
       })
-    ).toThrow('disk full')
 
-    expect(store.getCodexResetCreditAttemptLedger()).toEqual(before)
+    try {
+      await expect(
+        store.replaceCodexResetCreditAttemptLedgerAndFlush({
+          version: 1,
+          attempts: [
+            {
+              idempotencyKey: '11111111-1111-4111-8111-111111111111',
+              expectedScope: {
+                target: { runtime: 'host', wslDistro: null },
+                accountId: 'account-host',
+                accountRevision: 42,
+                offerRevision: 'v1:offer'
+              },
+              state: 'providerPending'
+            }
+          ]
+        })
+      ).rejects.toThrow('disk full')
+      expect(store.getCodexResetCreditAttemptLedger()).toEqual(before)
+    } finally {
+      write.mockRestore()
+    }
   })
 
   it('preserves a corrupt Codex reset ledger as a fail-closed read error', async () => {
@@ -222,7 +233,7 @@ describe('Store', () => {
     vi.resetModules()
     const { Store, initDataPath } = await import('./persistence')
     initDataPath()
-    const store = new Store({ dataFile: profileDataFile })
+    const store = createSqliteTestStore(Store, { dataFile: profileDataFile })
 
     expect(store.getRepos().map((repo) => repo.id)).toEqual(['profile-repo'])
   }, 15_000)
diff --git a/src/main/persistence-layout-binding-recovery.test.ts b/src/main/persistence-layout-binding-recovery.test.ts
index c539f3dd47b..7f3998eb58b 100644
--- a/src/main/persistence-layout-binding-recovery.test.ts
+++ b/src/main/persistence-layout-binding-recovery.test.ts
@@ -1,9 +1,10 @@
+import { closeTestStores, testState, createStore, makeRepo } from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { isTerminalLeafId } from '../shared/stable-pane-id'
-import { testState, createStore, makeRepo } from './persistence-test-harness'
+
 import {
   TEST_LEAF_1,
   TEST_LEAF_2,
@@ -59,7 +60,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('drops legacy leaf-keyed records from mixed-version writes before binding preservation', async () => {
diff --git a/src/main/persistence-load-repair-durability.test.ts b/src/main/persistence-load-repair-durability.test.ts
index 31ed5d5b451..5cb2bbe8f4f 100644
--- a/src/main/persistence-load-repair-durability.test.ts
+++ b/src/main/persistence-load-repair-durability.test.ts
@@ -1,3 +1,10 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  writeDataFile,
+  readDataFile
+} from './persistence-test-harness'
 /**
  * Load-time normalization repairs the in-memory state; without a matching dirty mark the bad value
  * stays on disk and the repair reruns on every launch. Each case here reloads a profile the current
@@ -10,7 +17,6 @@ import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { PersistedState } from '../shared/persisted-state-types'
-import { testState, createStore, writeDataFile, readDataFile } from './persistence-test-harness'
 
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
   loadUserSshConfigMock: vi.fn(),
@@ -81,7 +87,8 @@ describe('load-time normalization durability', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/persistence-loading-store-extraction.test.ts b/src/main/persistence-loading-store-extraction.test.ts
index a3c5e248909..3acec0d56a4 100644
--- a/src/main/persistence-loading-store-extraction.test.ts
+++ b/src/main/persistence-loading-store-extraction.test.ts
@@ -1,23 +1,34 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson,
+  writePersistedStateJson,
+  createStore,
+  dataFile,
+  makeRepo,
+  testState
+} from './persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, expectTypeOf, it, vi } from 'vitest'
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { createProfileStateStore } from './persistence/profile-state/profile-state-store-factory'
+import type * as FsModule from 'node:fs'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+  writeSync
+} from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { getDefaultPersistedState, getDefaultWorkspaceSession } from '../shared/constants'
 import type { PersistedState } from '../shared/persisted-state-types'
-import type * as StartupDiagnosticsModule from './startup/startup-diagnostics'
 import type { Store as PersistenceStore } from './persistence/loading-store/store'
-import {
-  createStore,
-  dataFile,
-  makeRepo,
-  testState,
-  writeDataFile
-} from './persistence-test-harness'
 
-const { trackMock, getCohortAtEmitMock, logStartupDiagnosticMock } = vi.hoisted(() => ({
+const { trackMock, getCohortAtEmitMock } = vi.hoisted(() => ({
   trackMock: vi.fn(),
-  getCohortAtEmitMock: vi.fn(() => ({ nth_repo_added: 2 })),
-  logStartupDiagnosticMock: vi.fn()
+  getCohortAtEmitMock: vi.fn(() => ({ nth_repo_added: 2 }))
 }))
 
 vi.mock('electron', () => ({
@@ -41,19 +52,30 @@ vi.mock('./ssh/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(() => ({ hosts: [] })),
   sshConfigHostsToTargets: vi.fn(() => [])
 }))
-vi.mock('./startup/startup-diagnostics', async (importOriginal) => {
-  const actual = await importOriginal<typeof StartupDiagnosticsModule>()
-  return { ...actual, logStartupDiagnostic: logStartupDiagnosticMock }
+vi.mock('node:fs', async (importOriginal) => {
+  const actual = await importOriginal<typeof FsModule>()
+  return { ...actual, writeSync: vi.fn(actual.writeSync) }
 })
 
+function getLoadDoneLines(): string[] {
+  return vi
+    .mocked(writeSync)
+    .mock.calls.flatMap(([fd, text]) =>
+      fd === 2 && typeof text === 'string' && text.startsWith('[startup] persistence-load-done ')
+        ? [text]
+        : []
+    )
+}
+
 describe('loading Store extraction seams', () => {
   beforeEach(() => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-loading-store-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
     vi.unstubAllEnvs()
-    logStartupDiagnosticMock.mockReset()
+    vi.mocked(writeSync).mockClear()
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
@@ -62,7 +84,7 @@ describe('loading Store extraction seams', () => {
     vi.stubEnv('ORCA_STARTUP_DIAGNOSTICS', '')
     const state = getDefaultPersistedState(testState.dir)
     state.workspaceSession = { ...state.workspaceSession, activeTabId: sentinel }
-    writeDataFile(state)
+    writePersistedStateJson(dataFile(), JSON.stringify(state))
 
     const stringifySpy = vi.spyOn(JSON, 'stringify')
     const store = createStore()
@@ -78,9 +100,7 @@ describe('loading Store extraction seams', () => {
 
     expect(store.getWorkspaceSession().activeTabId).toBe(sentinel)
     expect(workspaceSessionStringifyCalls).toHaveLength(0)
-    expect(
-      logStartupDiagnosticMock.mock.calls.some(([event]) => event === 'persistence-load-done')
-    ).toBe(false)
+    expect(getLoadDoneLines()).toEqual([])
   })
 
   it('reports the unchanged workspace-session byte count when startup diagnostics are enabled', () => {
@@ -88,7 +108,7 @@ describe('loading Store extraction seams', () => {
     vi.stubEnv('ORCA_STARTUP_DIAGNOSTICS', '1')
     const state = getDefaultPersistedState(testState.dir)
     state.workspaceSession = { ...state.workspaceSession, activeTabId: sentinel }
-    writeDataFile(state)
+    writePersistedStateJson(dataFile(), JSON.stringify(state))
 
     const stringifySpy = vi.spyOn(JSON, 'stringify')
     const store = createStore()
@@ -104,16 +124,14 @@ describe('loading Store extraction seams', () => {
 
     expect(store.getWorkspaceSession().activeTabId).toBe(sentinel)
     expect(workspaceSessionStringifyCalls).toHaveLength(1)
-    const loadDoneCall = logStartupDiagnosticMock.mock.calls.find(
-      ([event]) => event === 'persistence-load-done'
-    )
-    expect(loadDoneCall).toBeDefined()
-    const details = loadDoneCall?.[1] as Record<string, unknown> | undefined
-    expect(details).toEqual({
-      t: expect.any(Number),
-      repos: state.repos.length,
-      workspaceSessionBytes: Buffer.byteLength(JSON.stringify(store.getWorkspaceSession()))
-    })
+    const expectedBytes = Buffer.byteLength(JSON.stringify(store.getWorkspaceSession()))
+    expect(getLoadDoneLines()).toEqual([
+      expect.stringMatching(
+        new RegExp(
+          `^\\[startup\\] persistence-load-done t=\\d+ repos=${state.repos.length} workspaceSessionBytes=${expectedBytes}\\n$`
+        )
+      )
+    ])
   })
 
   it('timestamps persistence-load-done before resolving its details closure', () => {
@@ -121,7 +139,7 @@ describe('loading Store extraction seams', () => {
     vi.stubEnv('ORCA_STARTUP_DIAGNOSTICS', '1')
     const state = getDefaultPersistedState(testState.dir)
     state.workspaceSession = { ...state.workspaceSession, activeTabId: sentinel }
-    writeDataFile(state)
+    writePersistedStateJson(dataFile(), JSON.stringify(state))
 
     // Fake clock only the details closure advances, so a post-closure timestamp is unambiguous.
     let clock = 0
@@ -149,16 +167,14 @@ describe('loading Store extraction seams', () => {
       nowSpy.mockRestore()
     }
 
-    const loadDoneCall = logStartupDiagnosticMock.mock.calls.find(
-      ([event]) => event === 'persistence-load-done'
-    )
-    const details = loadDoneCall?.[1] as Record<string, unknown> | undefined
-    expect(details?.workspaceSessionBytes).toEqual(expect.any(Number))
-    expect(details?.t).toBe(0)
+    expect(getLoadDoneLines()).toEqual([
+      expect.stringMatching(
+        /^\[startup\] persistence-load-done t=0 repos=\d+ workspaceSessionBytes=\d+\n$/
+      )
+    ])
   })
 
-  it('accepts the first JSON-parseable backup even when an older backup has richer state', async () => {
-    mkdirSync(testState.dir, { recursive: true })
+  it('imports the first usable legacy backup without overwriting the damaged source', () => {
     writeFileSync(dataFile(), '{{corrupt-primary', 'utf-8')
     writeFileSync(`${dataFile()}.bak.0`, '{}', 'utf-8')
     writeFileSync(
@@ -166,31 +182,33 @@ describe('loading Store extraction seams', () => {
       JSON.stringify({ repos: [makeRepo({ id: 'older-complete-profile' })] }),
       'utf-8'
     )
-
-    const store = await createStore()
-
-    expect(store.getRepos()).toEqual([])
-    expect(readFileSync(dataFile(), 'utf-8')).toBe('{}')
+    const { store } = createProfileStateStore({
+      dataFile: dataFile(),
+      databaseFile: join(testState.dir, 'profile-state.db'),
+      profileId: 'backup-import'
+    })
+    try {
+      expect(store.getRepos()).toEqual([])
+      expect(readFileSync(dataFile(), 'utf-8')).toBe('{{corrupt-primary')
+      expect(readPersistedStateJson(dataFile(), 'backup-import')).toContain('"repos":[]')
+    } finally {
+      store.freezeWrites()
+    }
   })
 
-  it('leaves backup bytes reusable when publishing recovery to the primary path fails', async () => {
+  it('leaves backup bytes reusable when the legacy source cannot be read', () => {
     mkdirSync(dataFile(), { recursive: true })
-    writeFileSync(
-      `${dataFile()}.bak.0`,
-      JSON.stringify({ repos: [makeRepo({ id: 'recovery-survives-publish-failure' })] }),
-      'utf-8'
-    )
-
-    const failedRecovery = await createStore()
-    expect(failedRecovery.getRepos()).toEqual([])
-    failedRecovery.freezeWrites()
-    expect(existsSync(`${dataFile()}.bak.0`)).toBe(true)
-
-    rmSync(dataFile(), { recursive: true, force: true })
-    const recovered = await createStore()
-    expect(recovered.getRepos().map((repo) => repo.id)).toEqual([
-      'recovery-survives-publish-failure'
-    ])
+    const backup = JSON.stringify({ repos: [makeRepo({ id: 'recovery-survives-read-failure' })] })
+    writeFileSync(`${dataFile()}.bak.0`, backup, 'utf-8')
+    expect(() =>
+      createProfileStateStore({
+        dataFile: dataFile(),
+        databaseFile: join(testState.dir, 'profile-state.db'),
+        profileId: 'backup-import'
+      })
+    ).toThrow()
+    expect(readFileSync(`${dataFile()}.bak.0`, 'utf-8')).toBe(backup)
+    expect(existsSync(join(testState.dir, 'profile-state.db'))).toBe(false)
   })
 
   it('aliases blank host reads, writes, and patches to the local disk partition', async () => {
@@ -205,7 +223,8 @@ describe('loading Store extraction seams', () => {
     expect(store.getWorkspaceSession('  ').activeRepoId).toBe('from-blank-patch')
     expect(store.getWorkspaceSessionHostIds()).toEqual(['local'])
 
-    const persisted = JSON.parse(readFileSync(dataFile(), 'utf-8')) as PersistedState
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const persisted = JSON.parse(readPersistedStateJson(dataFile())) as PersistedState
     expect(persisted.workspaceSession?.activeRepoId).toBe('from-blank-patch')
     expect(persisted.workspaceSessionsByHostId).toEqual({})
   })
@@ -216,7 +235,7 @@ describe('loading Store extraction seams', () => {
     const { setMigrationUnsupportedPty } =
       await import('./agent-hooks/migration-unsupported-pty-state')
     const secondDataFile = join(testState.dir, 'second-profile', 'orca-data.json')
-    const second = new Store({ dataFile: secondDataFile })
+    const second = createSqliteTestStore(Store, { dataFile: secondDataFile })
 
     setMigrationUnsupportedPty({
       ptyId: 'listener-owner-pty',
@@ -227,8 +246,10 @@ describe('loading Store extraction seams', () => {
     first.flushOrThrow()
     second.flushOrThrow()
 
-    const firstState = JSON.parse(readFileSync(dataFile(), 'utf-8')) as PersistedState
-    const secondState = JSON.parse(readFileSync(secondDataFile, 'utf-8')) as PersistedState
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const firstState = JSON.parse(readPersistedStateJson(dataFile())) as PersistedState
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const secondState = JSON.parse(readPersistedStateJson(secondDataFile)) as PersistedState
     expect(
       firstState.migrationUnsupportedPtyEntries?.some(
         (entry) => entry.ptyId === 'listener-owner-pty'
@@ -249,7 +270,8 @@ describe('loading Store extraction seams', () => {
 
     store.updateUI({ sidebarWidth: 732 })
     expect(store.flushAsync()).toBe(finalFlush)
-    const persisted = JSON.parse(readFileSync(dataFile(), 'utf-8')) as PersistedState
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const persisted = JSON.parse(readPersistedStateJson(dataFile())) as PersistedState
     expect(persisted.ui.sidebarWidth).toBe(731)
     expect(store.getUI().sidebarWidth).toBe(732)
   })
@@ -262,7 +284,8 @@ describe('loading Store extraction seams', () => {
     store.updateUI({ sidebarWidth: 742 })
     await finalFlush
 
-    const persisted = JSON.parse(readFileSync(dataFile(), 'utf-8')) as PersistedState
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const persisted = JSON.parse(readPersistedStateJson(dataFile())) as PersistedState
     expect(persisted.ui.sidebarWidth).toBe(742)
   })
 
@@ -300,7 +323,7 @@ describe('loading Store extraction seams', () => {
         return 47
       }
     }
-    const overridden = new StoreWithRepoCountOverride({
+    const overridden = createSqliteTestStore(StoreWithRepoCountOverride, {
       dataFile: join(testState.dir, 'override-profile', 'orca-data.json')
     })
     expect(overridden.getRepoCount()).toBe(47)
diff --git a/src/main/persistence-loading-store-write-risks.test.ts b/src/main/persistence-loading-store-write-risks.test.ts
index 422573516f1..d7dd84f35a5 100644
--- a/src/main/persistence-loading-store-write-risks.test.ts
+++ b/src/main/persistence-loading-store-write-risks.test.ts
@@ -1,122 +1,63 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
-import type * as NodeFsPromises from 'node:fs/promises'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import { installFakeAppEnvironment } from '../../config/scripts/vitest-host-ports-setup'
-import { Store } from './persistence/loading-store/store'
-import { initDataPath } from './persistence/loading-store/user-data-path'
+import { describe, expect, it, vi } from 'vitest'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from './persistence/loading-store/profile-state-maintenance-fixture'
 
-const testState = { dir: '' }
-
-const writeControl = vi.hoisted(() => {
-  let releaseRename: (() => void) | null = null
-  let markRenameStarted: (() => void) | null = null
-  return {
-    blockPrimaryRename: false,
-    failPrimaryOpen: false,
-    renameStarted: Promise.resolve(),
-    renameRelease: Promise.resolve(),
-    reset(): void {
-      this.blockPrimaryRename = false
-      this.failPrimaryOpen = false
-      this.renameStarted = new Promise<void>((resolve) => {
-        markRenameStarted = resolve
-      })
-      this.renameRelease = new Promise<void>((resolve) => {
-        releaseRename = resolve
-      })
-    },
-    markRenameStarted(): void {
-      markRenameStarted?.()
-    },
-    releaseRename(): void {
-      releaseRename?.()
-    }
-  }
-})
-
-vi.mock('node:fs/promises', async (importOriginal) => {
-  const actual = await importOriginal<typeof NodeFsPromises>()
-  return {
-    ...actual,
-    open: async (...args: Parameters<typeof actual.open>) => {
-      const target = String(args[0])
-      if (
-        writeControl.failPrimaryOpen &&
-        target.includes('orca-data.json.') &&
-        target.endsWith('.tmp')
-      ) {
-        throw Object.assign(new Error('profile mount rejected write'), { code: 'EIO' })
-      }
-      return actual.open(...args)
-    },
-    rename: async (...args: Parameters<typeof actual.rename>) => {
-      const target = String(args[1])
-      if (writeControl.blockPrimaryRename && target.endsWith('orca-data.json')) {
-        writeControl.markRenameStarted()
-        await writeControl.renameRelease
-      }
-      return actual.rename(...args)
-    }
-  }
-})
-
-vi.mock('electron', () => ({
-  app: { getPath: () => testState.dir },
-  safeStorage: {
-    isEncryptionAvailable: () => true,
-    encryptString: (plaintext: string) => Buffer.from(`encrypted:${plaintext}`, 'utf-8'),
-    decryptString: (ciphertext: Buffer) => ciphertext.toString('utf-8').slice('encrypted:'.length)
-  }
-}))
 vi.mock('./ssh/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
 vi.mock('./telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('./telemetry/cohort-classifier', () => ({
-  getCohortAtEmit: vi.fn(() => ({ nth_repo_added: 2 }))
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
 
-function createStore(): Store {
-  installFakeAppEnvironment({ getPath: () => testState.dir })
-  initDataPath()
-  return new Store({ dataFile: join(testState.dir, 'orca-data.json') })
-}
-
 describe('loading Store write-risk characterization', () => {
-  beforeEach(() => {
-    testState.dir = mkdtempSync(join(tmpdir(), 'orca-write-risk-'))
-    writeControl.reset()
-    vi.useFakeTimers()
-  })
+  it('awaits an accepted worker commit before freezing and rejects later writes', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const committed = maintenanceBarrier()
+    const acknowledge = maintenanceBarrier()
+    const writeDomains = authority.writeCompleteSerializedDomains.bind(authority)
+    vi.spyOn(authority, 'writeCompleteSerializedDomains').mockImplementationOnce(
+      async (replacements) => {
+        await writeDomains(replacements)
+        committed.resolve()
+        await acknowledge.promise
+      }
+    )
+    const close = vi.spyOn(authority, 'close')
 
-  afterEach(() => {
-    vi.useRealTimers()
-    rmSync(testState.dir, { recursive: true, force: true })
-  })
-
-  it('allows an already-started primary rename to publish after writes are frozen', async () => {
-    const store = await createStore()
-    writeControl.blockPrimaryRename = true
     store.updateUI({ sidebarWidth: 712 })
-    vi.advanceTimersByTime(1_000)
-    await writeControl.renameStarted
+    const writing = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await committed.promise
+    const frozen = store.freezeWritesAsync()
+    await Promise.resolve()
+    expect(close).not.toHaveBeenCalled()
+    await expect(store.runDurableMutation(() => ({ value: undefined }))).rejects.toThrow(
+      'finalized'
+    )
 
-    store.freezeWrites()
-    writeControl.releaseRename()
-    await store.waitForPendingWrite()
-
-    const persisted = JSON.parse(readFileSync(join(testState.dir, 'orca-data.json'), 'utf-8')) as {
-      ui: { sidebarWidth: number }
-    }
-    expect(persisted.ui.sidebarWidth).toBe(712)
+    acknowledge.resolve()
+    await writing
+    await frozen
+    expect(close).toHaveBeenCalledOnce()
+    expect(readState().ui.sidebarWidth).toBe(712)
+    store.updateUI({ sidebarWidth: 999 })
+    await expect(store.flushPendingOrThrowAsync()).rejects.toThrow('finalized')
+    expect(readState().ui.sidebarWidth).toBe(712)
   })
 
   it('keeps a rejected durable mutation in memory for a later unrelated flush', async () => {
-    const store = await createStore()
-    writeControl.failPrimaryOpen = true
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const before = readState().sshPtyConsumerRecoveries
+    const writeDomains = authority.writeCompleteSerializedDomains.bind(authority)
+    const rejectedWrite = vi
+      .spyOn(authority, 'writeCompleteSerializedDomains')
+      .mockImplementationOnce(() =>
+        writeDomains([{ domain: 'sshPtyConsumerRecoveries', payload: '{' }])
+      )
+    vi.spyOn(console, 'error').mockImplementation(() => {})
     await expect(
       store.upsertSshPtyConsumerRecovery({
         targetId: 'ssh-1',
@@ -126,14 +67,16 @@ describe('loading Store write-risk characterization', () => {
         ownerGeneration: 5,
         ownerLease: 'secret-owner-lease'
       })
-    ).rejects.toThrow('profile mount rejected write')
+    ).rejects.toMatchObject({ outcome: 'known-failure' })
+    expect(readState().sshPtyConsumerRecoveries).toEqual(before)
+    expect(store.getSshPtyConsumerRecovery('ssh-1')?.clientInstanceId).toBe('client-1')
 
-    writeControl.failPrimaryOpen = false
+    rejectedWrite.mockRestore()
     store.updateUI({ sidebarWidth: 713 })
     await store.flushPendingOrThrowAsync()
-    const persisted = JSON.parse(readFileSync(join(testState.dir, 'orca-data.json'), 'utf-8')) as {
-      sshPtyConsumerRecoveries: { clientInstanceId: string }[]
-    }
-    expect(persisted.sshPtyConsumerRecoveries[0]?.clientInstanceId).toBe('client-1')
+    expect(readState()).toMatchObject({
+      ui: { sidebarWidth: 713 },
+      sshPtyConsumerRecoveries: [expect.objectContaining({ clientInstanceId: 'client-1' })]
+    })
   })
 })
diff --git a/src/main/persistence-native-chat-tab-view-mode.test.ts b/src/main/persistence-native-chat-tab-view-mode.test.ts
index 9bcaab15494..96de2f21f67 100644
--- a/src/main/persistence-native-chat-tab-view-mode.test.ts
+++ b/src/main/persistence-native-chat-tab-view-mode.test.ts
@@ -1,8 +1,14 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  writeDataFile,
+  makeRepo
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
-import { testState, createStore, writeDataFile, makeRepo } from './persistence-test-harness'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -49,7 +55,8 @@ describe('Store native-chat tab viewMode persistence', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/persistence-pane-identity-migration.test.ts b/src/main/persistence-pane-identity-migration.test.ts
index c9a6fc4e592..d93244cbc42 100644
--- a/src/main/persistence-pane-identity-migration.test.ts
+++ b/src/main/persistence-pane-identity-migration.test.ts
@@ -1,10 +1,17 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  writeDataFile,
+  readDataFile
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { writeFileSync, rmSync, mkdtempSync, mkdirSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { PersistedState } from '../shared/persisted-state-types'
 import { isTerminalLeafId, makePaneKey } from '../shared/stable-pane-id'
-import { testState, createStore, writeDataFile, readDataFile } from './persistence-test-harness'
+
 import {
   TEST_LEAF_1,
   TEST_LEAF_2,
@@ -59,7 +66,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('hydrates split-pane legacy numeric agent status rows onto the matching remapped leaves', async () => {
diff --git a/src/main/persistence-protected-secret-fail-closed.test.ts b/src/main/persistence-protected-secret-fail-closed.test.ts
index 26f49ea2e44..1bd42aa6ef3 100644
--- a/src/main/persistence-protected-secret-fail-closed.test.ts
+++ b/src/main/persistence-protected-secret-fail-closed.test.ts
@@ -1,5 +1,10 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson
+} from './persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { randomUUID } from 'node:crypto'
@@ -61,7 +66,7 @@ async function createStore() {
   // file's temp dir rather than the global fake's shared one, after resetModules.
   installFakeAppEnvironment({ getPath: () => testState.dir })
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 function dataFile(): string {
@@ -79,7 +84,7 @@ type ProtectedState = {
 }
 
 function readState(path = dataFile()): ProtectedState {
-  return JSON.parse(readFileSync(path, 'utf-8'))
+  return JSON.parse(readPersistedStateJson(path))
 }
 
 const ORIGINAL = {
@@ -142,7 +147,8 @@ describe('protected persistence when safeStorage fails', () => {
     vi.useFakeTimers()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
     rmSync(testState.dir, { recursive: true, force: true })
   })
@@ -154,7 +160,7 @@ describe('protected persistence when safeStorage fails', () => {
       const store = await createStore()
       await writeProtectedState(store, PENDING, 'non-secret-saved')
 
-      const raw = readFileSync(dataFile(), 'utf-8')
+      const raw = readPersistedStateJson(dataFile())
       const persisted = readState()
       expectPlaintextsAbsent(raw, PENDING)
       expect(persisted.settings.httpProxyUrl).toBe('')
@@ -384,14 +390,14 @@ describe('protected persistence when safeStorage fails', () => {
       const store = await createStore()
       await writeProtectedState(store, ORIGINAL, 'before')
       const originalCiphertext = readState()
-      expectPlaintextsAbsent(readFileSync(dataFile(), 'utf-8'), ORIGINAL)
+      expectPlaintextsAbsent(readPersistedStateJson(dataFile()), ORIGINAL)
 
       vi.advanceTimersByTime(60 * 60 * 1_000 + 1)
       setFailure(failureMode)
       await writeProtectedState(store, PENDING, 'during-failure')
 
-      const primaryRaw = readFileSync(dataFile(), 'utf-8')
-      const backupRaw = readFileSync(`${dataFile()}.bak.0`, 'utf-8')
+      const primaryRaw = readPersistedStateJson(dataFile())
+      const backupRaw = store.prepareProfileStateExport().json
       const persisted = readState()
       expectPlaintextsAbsent(primaryRaw, PENDING)
       expectPlaintextsAbsent(backupRaw, PENDING)
@@ -410,7 +416,7 @@ describe('protected persistence when safeStorage fails', () => {
       const loadedDuringFailure = await createStore()
       expect(loadedDuringFailure.getSettings().httpProxyBypassRules).toBe('during-failure')
       await settleSave(loadedDuringFailure)
-      expectPlaintextsAbsent(readFileSync(dataFile(), 'utf-8'), PENDING)
+      expectPlaintextsAbsent(readPersistedStateJson(dataFile()), PENDING)
 
       cipherState.availability = 'available'
       cipherState.encryptionThrows = false
diff --git a/src/main/persistence-protected-secret-write-race.test.ts b/src/main/persistence-protected-secret-write-race.test.ts
index 21aa20d13b8..8388a3ba1de 100644
--- a/src/main/persistence-protected-secret-write-race.test.ts
+++ b/src/main/persistence-protected-secret-write-race.test.ts
@@ -1,112 +1,78 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdtempSync, rmSync } from 'node:fs'
-import type * as NodeFsPromises from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { installFakeAppEnvironment } from '../../config/scripts/vitest-host-ports-setup'
-
-const testState = { dir: '' }
-const cipherState = { available: true }
-
-const renameGate = vi.hoisted(() => ({
-  sourcePrefix: '',
-  release: null as Promise<void> | null,
-  started: null as (() => void) | null
-}))
-
-vi.mock('node:fs/promises', async (importOriginal) => {
-  const actual = await importOriginal<typeof NodeFsPromises>()
-  return {
-    ...actual,
-    rename: async (source: string, destination: string) => {
-      if (renameGate.release && source.startsWith(renameGate.sourcePrefix)) {
-        const release = renameGate.release
-        renameGate.release = null
-        renameGate.started?.()
-        await release
-      }
-      return actual.rename(source, destination)
-    }
-  }
-})
+import { getSecretStore, setSecretStore } from '../shared/secret-store'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from './persistence/loading-store/profile-state-maintenance-fixture'
+import { Store } from './persistence/loading-store/store'
 
 vi.mock('./ssh/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
-
 vi.mock('./telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('./telemetry/cohort-classifier', () => ({
-  getCohortAtEmit: vi.fn().mockReturnValue({ nth_repo_added: 2 })
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
 
-vi.mock('electron', () => ({
-  app: { getPath: () => testState.dir }
-}))
+let encryptionAvailable = true
+let previousSecretStore: ReturnType<typeof getSecretStore>
 
-async function createStore() {
-  vi.resetModules()
-  const { setSecretStore } = await import('../shared/secret-store')
+beforeEach(() => {
+  encryptionAvailable = true
+  previousSecretStore = getSecretStore()
   setSecretStore({
-    isEncryptionAvailable: () => cipherState.available,
-    encryptString: (plaintext) => Buffer.from(`enc:${plaintext}`, 'utf-8'),
-    decryptString: (ciphertext) => ciphertext.toString('utf-8').slice('enc:'.length),
+    isEncryptionAvailable: () => encryptionAvailable,
+    encryptString: (plaintext) => Buffer.from(`enc:${plaintext}`, 'utf8'),
+    decryptString: (ciphertext) => ciphertext.toString('utf8').slice('enc:'.length),
     describeProtectionGap: () => null
   })
-  const { Store, initDataPath } = await import('./persistence')
-  // Why here: userData resolves through AppEnvironment, and this must point at this
-  // file's temp dir rather than the global fake's shared one, after resetModules.
-  installFakeAppEnvironment({ getPath: () => testState.dir })
-  initDataPath()
-  return new Store()
-}
-
-function deferred(): { promise: Promise<void>; resolve: () => void } {
-  let resolve!: () => void
-  const promise = new Promise<void>((next) => {
-    resolve = next
-  })
-  return { promise, resolve }
-}
+})
+afterEach(() => setSecretStore(previousSecretStore))
 
 describe('protected-secret async write retention', () => {
-  beforeEach(() => {
-    testState.dir = mkdtempSync(join(tmpdir(), 'orca-protected-secret-write-race-'))
-    cipherState.available = true
-    renameGate.sourcePrefix = join(testState.dir, 'orca-data.json')
-    renameGate.release = null
-    renameGate.started = null
-    vi.useFakeTimers()
-  })
-
-  afterEach(() => {
-    vi.useRealTimers()
-    rmSync(testState.dir, { recursive: true, force: true })
-  })
-
-  it('does not retain ciphertext from a superseded async secret write', async () => {
-    const store = await createStore()
+  it('does not retain ciphertext from a rejected worker write after a newer secret arrives', async () => {
+    const { store, authority, peer, dataFile, readState } = await createWorkerMaintenanceFixture()
     store.updateSettings({ opencodeSessionCookie: 'durable-cookie' })
-    vi.advanceTimersByTime(1_000)
-    await store.waitForPendingWrite()
-
-    const renameRelease = deferred()
-    const renameStarted = deferred()
-    renameGate.release = renameRelease.promise
-    renameGate.started = renameStarted.resolve
+    await store.flushPendingOrThrowAsync()
+    const durableCiphertext = readState().settings.opencodeSessionCookie
+    const entered = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const writeDomains = authority.writeSerializedDomains.bind(authority)
+    const pendingWrite = vi
+      .spyOn(authority, 'writeSerializedDomains')
+      .mockImplementationOnce(async () => {
+        entered.resolve()
+        await release.promise
+        await writeDomains([{ domain: 'settings', payload: '{' }])
+      })
+    vi.spyOn(console, 'error').mockImplementation(() => {})
 
     store.updateSettings({ opencodeSessionCookie: 'intermediate-cookie' })
-    vi.advanceTimersByTime(1_000)
-    await renameStarted.promise
-
+    const writing = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    const rejected = expect(writing).rejects.toMatchObject({ outcome: 'known-failure' })
+    await entered.promise
     store.updateSettings({ opencodeSessionCookie: 'replacement-cookie' })
-    cipherState.available = false
-    vi.advanceTimersByTime(1_000)
-    renameRelease.resolve()
-    await store.waitForPendingWrite()
+    encryptionAvailable = false
+    release.resolve()
+    await rejected
+    pendingWrite.mockRestore()
+    await store.flushPendingOrThrowAsync()
 
-    cipherState.available = true
-    const restarted = await createStore()
-    expect(restarted.getSettings().opencodeSessionCookie).toBe('durable-cookie')
+    expect(readState().settings.opencodeSessionCookie).toBe(durableCiphertext)
+    expect(store.getSettings().opencodeSessionCookie).toBe('replacement-cookie')
+    encryptionAvailable = true
+    const restarted = new Store({ dataFile, profileStateAuthority: peer() })
+    try {
+      expect(restarted.getSettings().opencodeSessionCookie).toBe('durable-cookie')
+    } finally {
+      restarted.freezeWrites()
+    }
+
+    store.updateSettings({ theme: 'dark' })
+    await store.flushPendingOrThrowAsync()
+    expect(readState().settings.opencodeSessionCookie).toBe(
+      Buffer.from('enc:replacement-cookie').toString('base64')
+    )
   })
 })
diff --git a/src/main/persistence-proxy-secret-recovery.test.ts b/src/main/persistence-proxy-secret-recovery.test.ts
index 176113192c7..ee75c72c5a0 100644
--- a/src/main/persistence-proxy-secret-recovery.test.ts
+++ b/src/main/persistence-proxy-secret-recovery.test.ts
@@ -1,3 +1,8 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson
+} from './persistence-test-harness'
 // STA-3442: httpProxyUrl is the only network setting stored via safeStorage.
 // On macOS a keychain reset/denial makes decryptString throw at load, and the
 // raw ciphertext then masqueraded as a configured proxy: applyElectronProxySettings
@@ -6,7 +11,7 @@
 // or destroyed), plaintext values survive as the upgrade path, and safeStorage
 // failures cannot expose the proxy secret or kill unrelated saves.
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { existsSync, mkdirSync, readFileSync, rmSync, mkdtempSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, rmSync, mkdtempSync, writeFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { randomUUID } from 'node:crypto'
@@ -68,7 +73,7 @@ async function createStore() {
   // file's temp dir rather than the global fake's shared one, after resetModules.
   installFakeAppEnvironment({ getPath: () => testState.dir })
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 function dataFile(): string {
@@ -87,7 +92,8 @@ describe('httpProxyUrl secret recovery (STA-3442)', () => {
     vi.useFakeTimers()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
     rmSync(testState.dir, { recursive: true, force: true })
   })
@@ -103,7 +109,8 @@ describe('httpProxyUrl secret recovery (STA-3442)', () => {
   it('persists the configured proxy across a restart and applies it as fixed_servers', async () => {
     await seedConfiguredProxy()
 
-    const persisted = JSON.parse(readFileSync(dataFile(), 'utf-8')) as {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const persisted = JSON.parse(readPersistedStateJson(dataFile())) as {
       settings: { httpProxyUrl: string; httpProxyBypassRules: string }
     }
     // On disk the URL is ciphertext (base64 of the mock's enc: payload), never plaintext.
@@ -139,7 +146,7 @@ describe('httpProxyUrl secret recovery (STA-3442)', () => {
 
   it('seals an undecryptable httpProxyUrl without destroying its ciphertext', async () => {
     await seedConfiguredProxy()
-    const originalCiphertext = JSON.parse(readFileSync(dataFile(), 'utf-8')).settings.httpProxyUrl
+    const originalCiphertext = JSON.parse(readPersistedStateJson(dataFile())).settings.httpProxyUrl
 
     // Keychain reset/denial: every decrypt now fails.
     cipherState.decryptAlwaysThrows = true
@@ -153,7 +160,8 @@ describe('httpProxyUrl secret recovery (STA-3442)', () => {
     reloaded.updateSettings({ httpProxyBypassRules: 'localhost' })
     vi.advanceTimersByTime(2000)
     await reloaded.waitForPendingWrite()
-    const persisted = JSON.parse(readFileSync(dataFile(), 'utf-8')) as {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const persisted = JSON.parse(readPersistedStateJson(dataFile())) as {
       settings: { httpProxyUrl: string }
     }
     expect(persisted.settings.httpProxyUrl).toBe(originalCiphertext)
@@ -180,8 +188,9 @@ describe('httpProxyUrl secret recovery (STA-3442)', () => {
     vi.advanceTimersByTime(1000)
     await store.waitForPendingWrite()
 
-    expect(existsSync(dataFile())).toBe(true)
-    const persisted = JSON.parse(readFileSync(dataFile(), 'utf-8')) as {
+    expect(existsSync(join(testState.dir, 'profile-state.db'))).toBe(true)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const persisted = JSON.parse(readPersistedStateJson(dataFile())) as {
       settings: { httpProxyUrl: string; httpProxyBypassRules: string }
     }
     expect(persisted.settings.httpProxyUrl).toBe('')
diff --git a/src/main/persistence-pty-binding-leaf-tab-resolution.test.ts b/src/main/persistence-pty-binding-leaf-tab-resolution.test.ts
index 2f0dc41daaf..14ac4de0a12 100644
--- a/src/main/persistence-pty-binding-leaf-tab-resolution.test.ts
+++ b/src/main/persistence-pty-binding-leaf-tab-resolution.test.ts
@@ -1,10 +1,16 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  makeTerminalTab
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { getDefaultWorkspaceSession } from '../shared/constants'
 import { findTerminalTabIdForLeaf } from './runtime/workspace-session-terminal-membership-authority'
-import { testState, createStore, makeTerminalTab } from './persistence-test-harness'
+
 import { TEST_LEAF_1, TEST_LEAF_2 } from './persistence-session-fixtures'
 
 vi.mock('electron', () => ({
@@ -19,7 +25,8 @@ describe('findTerminalTabIdForLeaf after persistPtyBinding grafts a leaf', () =>
   beforeEach(() => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
@@ -46,7 +53,7 @@ describe('findTerminalTabIdForLeaf after persistPtyBinding grafts a leaf', () =>
     expect(findTerminalTabIdForLeaf(store.getWorkspaceSession(), TEST_LEAF_1)).toBe('tab1')
 
     expect(
-      store.persistPtyBinding({
+      await store.persistPtyBinding({
         worktreeId: 'wt1',
         tabId: 'tab1',
         leafId: TEST_LEAF_2,
@@ -73,7 +80,7 @@ describe('findTerminalTabIdForLeaf after persistPtyBinding grafts a leaf', () =>
     expect(findTerminalTabIdForLeaf(store.getWorkspaceSession(), TEST_LEAF_1)).toBeUndefined()
 
     expect(
-      store.persistPtyBinding({
+      await store.persistPtyBinding({
         worktreeId: 'wt1',
         tabId: 'tab1',
         leafId: TEST_LEAF_1,
diff --git a/src/main/persistence-pty-binding-reconciliation.test.ts b/src/main/persistence-pty-binding-reconciliation.test.ts
index f72234b6823..c4fbf61f07b 100644
--- a/src/main/persistence-pty-binding-reconciliation.test.ts
+++ b/src/main/persistence-pty-binding-reconciliation.test.ts
@@ -1,9 +1,16 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  writeDataFile,
+  makeTerminalTab
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { getDefaultWorkspaceSession } from '../shared/constants'
-import { testState, createStore, writeDataFile, makeTerminalTab } from './persistence-test-harness'
+
 import { TEST_LEAF_1, TEST_LEAF_2 } from './persistence-session-fixtures'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
@@ -54,7 +61,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('remaps legacy SSH lease leaf ids by PTY when the layout is already normalized', async () => {
@@ -204,7 +212,7 @@ describe('Store', () => {
       }
     })
 
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: 'wt1',
       tabId: 'tab1',
       leafId: TEST_LEAF_1,
@@ -228,7 +236,7 @@ describe('Store', () => {
       terminalTopologyRevisionByRepoId: { wt1: 1 }
     })
 
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: 'wt1',
       tabId: 'fresh-tab',
       leafId: TEST_LEAF_1,
@@ -330,7 +338,7 @@ describe('Store', () => {
     })
 
     expect(
-      store.persistPtyBinding({
+      await store.persistPtyBinding({
         worktreeId: 'wt1',
         tabId: 'tab1',
         leafId: TEST_LEAF_1,
@@ -370,7 +378,7 @@ describe('Store', () => {
       const staleRendererSession = structuredClone(store.getWorkspaceSession(hostId))
 
       expect(
-        store.persistPtyBinding(
+        await store.persistPtyBinding(
           {
             worktreeId: 'wt1',
             tabId: 'different-target-tab',
@@ -393,7 +401,7 @@ describe('Store', () => {
       ).toBe(false)
 
       expect(
-        store.persistPtyBinding(
+        await store.persistPtyBinding(
           {
             worktreeId: 'wt-canonical',
             tabId: 'tab1',
@@ -425,7 +433,7 @@ describe('Store', () => {
       })
 
       expect(
-        store.persistPtyBinding(
+        await store.persistPtyBinding(
           {
             worktreeId: 'wt1',
             tabId: 'rejected-tab',
diff --git a/src/main/persistence-remote-session-startup.test.ts b/src/main/persistence-remote-session-startup.test.ts
index ddb3f57827b..c46f50699bb 100644
--- a/src/main/persistence-remote-session-startup.test.ts
+++ b/src/main/persistence-remote-session-startup.test.ts
@@ -1,10 +1,10 @@
+import { closeTestStores, createStore, makeRepo, testState } from './persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { getDefaultWorkspaceSession } from '../shared/constants'
 import type { BrowserPage, BrowserWorkspace } from '../shared/browser-workspace-types'
-import { createStore, makeRepo, testState } from './persistence-test-harness'
 
 vi.mock('./ssh/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
@@ -65,7 +65,8 @@ describe('remote session startup ownership', () => {
   beforeEach(() => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-remote-session-'))
   })
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/persistence-repo-lifecycle.test.ts b/src/main/persistence-repo-lifecycle.test.ts
index 150f1106d14..f70e1825348 100644
--- a/src/main/persistence-repo-lifecycle.test.ts
+++ b/src/main/persistence-repo-lifecycle.test.ts
@@ -1,11 +1,5 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { PersistedState } from '../shared/persisted-state-types'
-import type { ProjectGroup } from '../shared/project-group-types'
-import { getDefaultWorkspaceSession } from '../shared/constants'
 import {
+  closeTestStores,
   testState,
   createStore,
   writeDataFile,
@@ -14,6 +8,14 @@ import {
   makeTerminalTab,
   makeWorktreeLineage
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { PersistedState } from '../shared/persisted-state-types'
+import type { ProjectGroup } from '../shared/project-group-types'
+import { getDefaultWorkspaceSession } from '../shared/constants'
+
 import {
   advanceSshConnectionGeneration,
   assertSshMutationExpectation,
@@ -74,7 +76,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── 5. addRepo and getRepo ──────────────────────────────────────────
diff --git a/src/main/persistence-settings-ui-defaults.test.ts b/src/main/persistence-settings-ui-defaults.test.ts
index 42dc42423b7..3e75cc7d021 100644
--- a/src/main/persistence-settings-ui-defaults.test.ts
+++ b/src/main/persistence-settings-ui-defaults.test.ts
@@ -1,21 +1,19 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { GlobalSettings } from '../shared/global-settings-types'
-import type { PersistedState } from '../shared/persisted-state-types'
-import {
-  getDefaultPersistedState,
-  ONBOARDING_FINAL_STEP,
-  ONBOARDING_FLOW_VERSION
-} from '../shared/constants'
 import {
+  closeTestStores,
   testState,
   createStore,
   withPlatform,
   writeDataFile,
   readDataFile
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { GlobalSettings } from '../shared/global-settings-types'
+import type { PersistedState } from '../shared/persisted-state-types'
+import { getDefaultPersistedState } from '../shared/constants'
+import { ONBOARDING_FINAL_STEP, ONBOARDING_FLOW_VERSION } from '../shared/onboarding-defaults'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -65,7 +63,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('returns default settings when no data file exists', async () => {
diff --git a/src/main/persistence-settings-update.test.ts b/src/main/persistence-settings-update.test.ts
index 9af63ca7ccd..aced61e0ac4 100644
--- a/src/main/persistence-settings-update.test.ts
+++ b/src/main/persistence-settings-update.test.ts
@@ -1,11 +1,5 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { writeFileSync, rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { GlobalSettings } from '../shared/global-settings-types'
-import type { PersistedState } from '../shared/persisted-state-types'
-import { getDefaultWorkspaceSession } from '../shared/constants'
 import {
+  closeTestStores,
   testState,
   createStore,
   writeDataFile,
@@ -14,6 +8,14 @@ import {
   makeRepo,
   makeTerminalTab
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { writeFileSync, rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { GlobalSettings } from '../shared/global-settings-types'
+import type { PersistedState } from '../shared/persisted-state-types'
+import { getDefaultWorkspaceSession } from '../shared/constants'
+
 import {
   getLocalWorktreeScanGeneration,
   isLocalWorktreeScanGenerationCurrent
@@ -67,7 +69,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── 9. Settings: get/update ────────────────────────────────────────
diff --git a/src/main/persistence-single-serialize.test.ts b/src/main/persistence-single-serialize.test.ts
index 1293bb30f48..b70c2c01573 100644
--- a/src/main/persistence-single-serialize.test.ts
+++ b/src/main/persistence-single-serialize.test.ts
@@ -1,10 +1,15 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson
+} from './persistence-test-harness'
 // Why this file exists: persistence.test.ts mocks safeStorage.encryptString
 // deterministically, which cannot catch the real-world hazard the single-
 // stringify save guard must survive — encrypt() uses a random IV, so identical
 // state produces different on-disk bytes each save. These tests mock a
 // nondeterministic cipher and pin the guard + payload invariants.
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { readFileSync, rmSync, mkdtempSync, statSync } from 'node:fs'
+import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { randomUUID } from 'node:crypto'
@@ -63,7 +68,7 @@ async function createStore() {
   // file's temp dir rather than the global fake's shared one, after resetModules.
   installFakeAppEnvironment({ getPath: () => testState.dir })
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 function dataFile(): string {
@@ -84,7 +89,8 @@ describe('persistence single-serialize save guard', () => {
     vi.useFakeTimers()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
     rmSync(testState.dir, { recursive: true, force: true })
   })
@@ -100,7 +106,7 @@ describe('persistence single-serialize save guard', () => {
 
   it('skips the disk write when state is identical, even with secrets set (random-IV cipher)', async () => {
     const store = await seedStoreWithSecrets()
-    const inoBefore = statSync(dataFile()).ino
+    const stateBefore = readPersistedStateJson(dataFile())
 
     // Net no-op mutation burst: the encrypted payload bytes would differ
     // (random IV), but the normalized guard hash must not.
@@ -111,29 +117,29 @@ describe('persistence single-serialize save guard', () => {
     vi.advanceTimersByTime(2000)
     await store.waitForPendingWrite()
 
-    expect(statSync(dataFile()).ino).toBe(inoBefore)
+    expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
   })
 
   it('still writes when state actually changes (including a secret change)', async () => {
     const store = await seedStoreWithSecrets()
-    const inoBefore = statSync(dataFile()).ino
+    const stateBefore = readPersistedStateJson(dataFile())
 
     store.updateSettings({ opencodeSessionCookie: 'rotated-cookie' })
     vi.advanceTimersByTime(2000)
     await store.waitForPendingWrite()
-    const inoAfter = statSync(dataFile()).ino
-    expect(inoAfter).not.toBe(inoBefore)
+    const stateAfter = readPersistedStateJson(dataFile())
+    expect(stateAfter).not.toBe(stateBefore)
 
     store.updateUI({ sidebarWidth: 777 })
     vi.advanceTimersByTime(2000)
     await store.waitForPendingWrite()
-    expect(statSync(dataFile()).ino).not.toBe(inoAfter)
+    expect(readPersistedStateJson(dataFile())).not.toBe(stateAfter)
   })
 
   it('writes encrypted secrets to disk and round-trips them through a reload', async () => {
     await seedStoreWithSecrets()
 
-    const raw = readFileSync(dataFile(), 'utf-8')
+    const raw = readPersistedStateJson(dataFile())
     const persisted = JSON.parse(raw) as {
       settings: { opencodeSessionCookie: string; httpProxyUrl: string }
       ui: { browserKagiSessionLink: string }
@@ -158,29 +164,30 @@ describe('persistence single-serialize save guard', () => {
     vi.advanceTimersByTime(1000)
     await store.waitForPendingWrite()
 
-    const persisted = JSON.parse(readFileSync(dataFile(), 'utf-8')) as {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const persisted = JSON.parse(readPersistedStateJson(dataFile())) as {
       settings: { opencodeSessionCookie: string; httpProxyUrl: string }
     }
     expect(persisted.settings.opencodeSessionCookie).toBe('')
     expect(persisted.settings.httpProxyUrl).toBe('')
 
-    const inoBefore = statSync(dataFile()).ino
+    const stateBefore = readPersistedStateJson(dataFile())
     store.updateSettings({ httpProxyUrl: SECRETS.httpProxyUrl })
     vi.advanceTimersByTime(2000)
     await store.waitForPendingWrite()
-    expect(statSync(dataFile()).ino).toBe(inoBefore)
+    expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
   })
 
   it('sync flush also skips on identical state with secrets set', async () => {
     const store = await seedStoreWithSecrets()
-    const inoBefore = statSync(dataFile()).ino
+    const stateBefore = readPersistedStateJson(dataFile())
 
     store.flushOrThrow()
 
-    expect(statSync(dataFile()).ino).toBe(inoBefore)
+    expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
   })
 
-  it('performs exactly one full-state JSON.stringify per save (was two)', async () => {
+  it('does not serialize the complete profile for a UI domain save', async () => {
     const store = await seedStoreWithSecrets()
 
     // Count full-state serializations: only the durable-state payload is
@@ -188,17 +195,20 @@ describe('persistence single-serialize save guard', () => {
     // stay far below the threshold).
     const original = JSON.stringify.bind(JSON)
     let fullStateSerializations = 0
-    const spy = vi.spyOn(JSON, 'stringify').mockImplementation(((
-      value: unknown,
-      ...rest: unknown[]
-    ) => {
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      const out = original(value as any, ...(rest as [any?, any?]))
-      if (typeof out === 'string' && out.length > 1_000) {
+    const spy = vi.spyOn(JSON, 'stringify').mockImplementation((...args) => {
+      const [value] = args
+      const out = original(...args)
+      if (
+        value &&
+        typeof value === 'object' &&
+        'repos' in value &&
+        'settings' in value &&
+        'ui' in value
+      ) {
         fullStateSerializations++
       }
       return out
-    }) as typeof JSON.stringify)
+    })
     try {
       store.updateUI({ sidebarWidth: 640 })
       vi.advanceTimersByTime(2000)
@@ -207,7 +217,7 @@ describe('persistence single-serialize save guard', () => {
       spy.mockRestore()
     }
 
-    expect(fullStateSerializations).toBe(1)
+    expect(fullStateSerializations).toBe(0)
   })
 
   // Regression (adversarial review, gpt-5.6-sol round 1): the guard hash
@@ -227,11 +237,7 @@ describe('persistence single-serialize save guard', () => {
     store.updateSettings({ opencodeSessionCookie: P })
     vi.advanceTimersByTime(1000)
     await store.waitForPendingWrite()
-    const C = (
-      JSON.parse(readFileSync(dataFile(), 'utf-8')) as {
-        settings: { opencodeSessionCookie: string }
-      }
-    ).settings.opencodeSessionCookie
+    const C: string = JSON.parse(readPersistedStateJson(dataFile())).settings.opencodeSessionCookie
     expect(C).not.toBe(P) // C is ciphertext
 
     // State 1: the plaintext bypass-rules field literally holds ciphertext C;
@@ -239,13 +245,13 @@ describe('persistence single-serialize save guard', () => {
     store.updateSettings({ httpProxyBypassRules: C, opencodeSessionCookie: P })
     vi.advanceTimersByTime(2000)
     await store.waitForPendingWrite()
-    const inoState1 = statSync(dataFile()).ino
+    const inoState1 = readPersistedStateJson(dataFile())
 
     // State 2 (distinct): swap the two values. Must be written, not skipped.
     store.updateSettings({ httpProxyBypassRules: P, opencodeSessionCookie: C })
     vi.advanceTimersByTime(2000)
     await store.waitForPendingWrite()
-    expect(statSync(dataFile()).ino).not.toBe(inoState1)
+    expect(readPersistedStateJson(dataFile())).not.toBe(inoState1)
 
     // The swap round-trips through a reload — nothing was lost.
     const reloaded = await createStore()
@@ -268,11 +274,7 @@ describe('persistence single-serialize save guard', () => {
     store.updateUI({ browserKagiSessionLink: K })
     vi.advanceTimersByTime(1000)
     await store.waitForPendingWrite()
-    const C = (
-      JSON.parse(readFileSync(dataFile(), 'utf-8')) as {
-        ui: { browserKagiSessionLink: string }
-      }
-    ).ui.browserKagiSessionLink
+    const C: string = JSON.parse(readPersistedStateJson(dataFile())).ui.browserKagiSessionLink
     expect(C).not.toBe(K) // C is ciphertext
 
     // State 1: env var literally named after the secret field, value = C; the
@@ -281,14 +283,14 @@ describe('persistence single-serialize save guard', () => {
     store.updateUI({ browserKagiSessionLink: K })
     vi.advanceTimersByTime(2000)
     await store.waitForPendingWrite()
-    const inoState1 = statSync(dataFile()).ino
+    const inoState1 = readPersistedStateJson(dataFile())
 
     // State 2 (distinct): swap — env var value = K, ui secret = C. Must write.
     store.updateSettings({ agentDefaultEnv: { claude: { browserKagiSessionLink: K } } })
     store.updateUI({ browserKagiSessionLink: C })
     vi.advanceTimersByTime(2000)
     await store.waitForPendingWrite()
-    expect(statSync(dataFile()).ino).not.toBe(inoState1)
+    expect(readPersistedStateJson(dataFile())).not.toBe(inoState1)
 
     const reloaded = await createStore()
     expect(reloaded.getSettings().agentDefaultEnv?.claude?.browserKagiSessionLink).toBe(K)
diff --git a/src/main/persistence-source-control-ai-migration.test.ts b/src/main/persistence-source-control-ai-migration.test.ts
index ffc7d5b6eba..f3969da6ef0 100644
--- a/src/main/persistence-source-control-ai-migration.test.ts
+++ b/src/main/persistence-source-control-ai-migration.test.ts
@@ -1,17 +1,19 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  dataFile,
+  writeDataFile,
+  readDataFile,
+  readPersistedStateJson,
+  makeRepo
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { writeFileSync, readFileSync, rmSync, mkdtempSync, mkdirSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { PersistedState } from '../shared/persisted-state-types'
 import { setSourceControlActionDefault } from '../shared/source-control-ai-actions'
-import {
-  testState,
-  createStore,
-  dataFile,
-  writeDataFile,
-  readDataFile,
-  makeRepo
-} from './persistence-test-harness'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -61,19 +63,18 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
-  // ── 3. Corrupt JSON → falls back to defaults ────────────────────────
+  // Invalid profile state must not silently replace user settings with defaults.
 
-  it('falls back to defaults when data file contains invalid JSON', async () => {
+  it('refuses invalid legacy JSON without replacing it with defaults', () => {
     mkdirSync(testState.dir, { recursive: true })
     writeFileSync(dataFile(), '{{{invalid json', 'utf-8')
 
-    const store = await createStore()
-    expect(store.getRepos()).toEqual([])
-    expect(store.getSettings().theme).toBe('system')
-    expect(store.getSettings().experimentalNewWorktreeCardStyle).toBe(false)
+    expect(() => createStore()).toThrow('Profile state JSON is invalid')
+    expect(readFileSync(dataFile(), 'utf8')).toBe('{{{invalid json')
   })
 
   // ── 4. Schema migration: merges with defaults ───────────────────────
@@ -347,7 +348,7 @@ describe('Store', () => {
       customAgentCommand: 'claude'
     })
     store.flush()
-    const persisted = JSON.parse(readFileSync(join(testState.dir, 'orca-data.json'), 'utf-8'))
+    const persisted = JSON.parse(readPersistedStateJson(dataFile()))
     expect(persisted.settings.sourceControlAi.actions.commitMessage).toEqual({
       agentId: 'claude',
       commandInputTemplate: '{basePrompt}\n\nRollback commit prompt'
diff --git a/src/main/persistence-split-pane-incarnation.test.ts b/src/main/persistence-split-pane-incarnation.test.ts
index b092c3d7d9e..b628c28384b 100644
--- a/src/main/persistence-split-pane-incarnation.test.ts
+++ b/src/main/persistence-split-pane-incarnation.test.ts
@@ -1,10 +1,18 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  makeTerminalTab
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
+import { ProfileStateSqliteAuthority } from './persistence/profile-state/profile-state-sqlite-authority'
 import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
 import { getDefaultWorkspaceSession } from '../shared/constants'
-import { testState, createStore, makeTerminalTab } from './persistence-test-harness'
+
 import { TEST_LEAF_1, TEST_LEAF_2 } from './persistence-session-fixtures'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
@@ -55,7 +63,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('rejects a split source incarnation mismatch', async () => {
@@ -77,7 +86,7 @@ describe('Store', () => {
     })
 
     expect(
-      store.persistPtyBinding({
+      await store.persistPtyBinding({
         worktreeId: 'wt1',
         tabId: 'tab1',
         leafId: TEST_LEAF_2,
@@ -127,7 +136,7 @@ describe('Store', () => {
       store.setWorkspaceSession(sourceSession, hostId)
 
       expect(
-        store.persistPtyBinding(
+        await store.persistPtyBinding(
           {
             worktreeId: 'wt1',
             tabId: 'tab1',
@@ -174,7 +183,7 @@ describe('Store', () => {
     )
 
     expect(
-      store.persistPtyBinding({
+      await store.persistPtyBinding({
         worktreeId: 'wt1',
         tabId: 'tab1',
         leafId: TEST_LEAF_2,
@@ -213,7 +222,7 @@ describe('Store', () => {
       { ptyId: 'pty-current', expectedIncarnationId: 'inc-replaced' }
     ]) {
       expect(
-        store.persistPtyBinding({
+        await store.persistPtyBinding({
           worktreeId: 'wt1',
           tabId: 'tab1',
           leafId: TEST_LEAF_1,
@@ -253,7 +262,7 @@ describe('Store', () => {
     store.setWorkspaceSession(structuredClone(session), 'ssh:ssh-1')
 
     expect(
-      store.persistPtyBinding(
+      await store.persistPtyBinding(
         {
           worktreeId: 'wt1',
           tabId: 'tab1',
@@ -302,7 +311,7 @@ describe('Store', () => {
       )
 
       expect(
-        store.persistPtyBinding(
+        await store.persistPtyBinding(
           {
             worktreeId: 'wt1',
             tabId: 'tab1',
@@ -348,11 +357,15 @@ describe('Store', () => {
       },
       terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-stale' }
     })
-    vi.spyOn(store, 'flushOrThrow').mockImplementationOnce(() => {
+    store.flushOrThrow()
+    vi.spyOn(
+      ProfileStateSqliteAuthority.prototype,
+      'writeSerializedDomains'
+    ).mockImplementationOnce(() => {
       throw new Error('disk full')
     })
 
-    expect(() =>
+    await expect(
       store.persistPtyBinding({
         worktreeId: 'wt1',
         tabId: 'tab1',
@@ -361,7 +374,7 @@ describe('Store', () => {
         incarnationId: 'inc-live',
         expectedBinding: { ptyId: 'pty-1', incarnationId: 'inc-stale' }
       })
-    ).toThrow('disk full')
+    ).rejects.toThrow('disk full')
     expect(store.getWorkspaceSession().terminalPtyIncarnationsByPaneKey?.[paneKey]).toBe(
       'inc-stale'
     )
diff --git a/src/main/persistence-ssh-lease-reattach-reclaim.test.ts b/src/main/persistence-ssh-lease-reattach-reclaim.test.ts
index b2088fa616b..adc6946725b 100644
--- a/src/main/persistence-ssh-lease-reattach-reclaim.test.ts
+++ b/src/main/persistence-ssh-lease-reattach-reclaim.test.ts
@@ -1,8 +1,9 @@
+import { closeTestStores, createStore, testState } from './persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { createStore, testState } from './persistence-test-harness'
+
 import { sshRemotePtyLeaseAllowsReattach } from '../shared/ssh-types'
 
 vi.mock('electron', () => ({
@@ -24,7 +25,8 @@ describe('ssh remote pty lease reclaim after a proven reattach', () => {
   beforeEach(() => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/persistence-ssh-lease-tombstone-retention.test.ts b/src/main/persistence-ssh-lease-tombstone-retention.test.ts
index feafdd766e4..1e52c6ad41c 100644
--- a/src/main/persistence-ssh-lease-tombstone-retention.test.ts
+++ b/src/main/persistence-ssh-lease-tombstone-retention.test.ts
@@ -1,8 +1,9 @@
+import { closeTestStores, createStore, testState } from './persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { createStore, testState } from './persistence-test-harness'
+
 import { TEST_LEAF_1 } from './persistence-session-fixtures'
 
 vi.mock('electron', () => ({
@@ -18,7 +19,8 @@ describe('operator-closed SSH lease tombstones', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/persistence-ssh-pending-pty-kill.test.ts b/src/main/persistence-ssh-pending-pty-kill.test.ts
index 627d9f38de0..19298b3288f 100644
--- a/src/main/persistence-ssh-pending-pty-kill.test.ts
+++ b/src/main/persistence-ssh-pending-pty-kill.test.ts
@@ -1,8 +1,9 @@
+import { closeTestStores, testState, createStore } from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
-import { testState, createStore } from './persistence-test-harness'
+
 import {
   MAX_SSH_PENDING_PTY_KILLS_PER_TARGET,
   SSH_PENDING_PTY_KILL_TTL_MS
@@ -27,7 +28,8 @@ describe('Store SSH pending PTY kills', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
@@ -48,6 +50,19 @@ describe('Store SSH pending PTY kills', () => {
     ])
   })
 
+  it('keeps an epoch-scoped intent with no incarnation across a restart, and drops a legacy one', async () => {
+    const store = await createStore()
+    for (const ptyId of ['pty2:epoch-a:1', 'pty-2']) {
+      store.recordSshRemotePtyKillIntent('ssh-1', ptyId, { requestedAt: NOW, attempts: 0 })
+    }
+    store.flush()
+
+    const reloaded = await createStore()
+    expect(reloaded.getSshRemotePtyKillIntents('ssh-1', NOW)).toEqual([
+      { ptyId: 'pty2:epoch-a:1', intent: { requestedAt: NOW, attempts: 0 } }
+    ])
+  })
+
   // A kill issued while the provider was already unregistered writes no lease of its own, and that
   // offline close is the case most likely to strand a remote shell.
   it('records an intent for a PTY that has no lease row yet', async () => {
diff --git a/src/main/persistence-ssh-readoption-automation-migration.test.ts b/src/main/persistence-ssh-readoption-automation-migration.test.ts
index 172c854cfd0..886b5475983 100644
--- a/src/main/persistence-ssh-readoption-automation-migration.test.ts
+++ b/src/main/persistence-ssh-readoption-automation-migration.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from './persistence-test-harness'
 /**
  * SSH re-adoption has to repair the automation with the workspace.
  *
@@ -145,7 +146,7 @@ async function createStoreFromState(state: Record<string, unknown>) {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('./persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 /** Re-read whatever is on disk now — no fixture rewrite. */
@@ -154,7 +155,7 @@ async function reloadStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('./persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 async function createSshStore(state: Record<string, unknown>) {
@@ -172,7 +173,8 @@ beforeEach(() => {
   testState.dir = mkdtempSync(join(tmpdir(), 'orca-readopt-'))
 })
 
-afterEach(() => {
+afterEach(async () => {
+  await closeTestStores()
   rmSync(testState.dir, { recursive: true, force: true })
   vi.resetModules()
 })
diff --git a/src/main/persistence-ssh-remote-pty-binding-replay.test.ts b/src/main/persistence-ssh-remote-pty-binding-replay.test.ts
index 8cfbd7b2057..f32f3836827 100644
--- a/src/main/persistence-ssh-remote-pty-binding-replay.test.ts
+++ b/src/main/persistence-ssh-remote-pty-binding-replay.test.ts
@@ -1,8 +1,9 @@
+import { closeTestStores, testState, createStore } from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
-import { testState, createStore } from './persistence-test-harness'
+
 import { TEST_LEAF_1, TEST_LEAF_2 } from './persistence-session-fixtures'
 import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
 
@@ -54,7 +55,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('retains an SSH host binding when a stale renderer clears its pty map', async () => {
diff --git a/src/main/persistence-ssh-remote-pty-leases.test.ts b/src/main/persistence-ssh-remote-pty-leases.test.ts
index d4cdc79285c..ea0d8fe350d 100644
--- a/src/main/persistence-ssh-remote-pty-leases.test.ts
+++ b/src/main/persistence-ssh-remote-pty-leases.test.ts
@@ -1,8 +1,9 @@
+import { closeTestStores, testState, createStore, writeDataFile } from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
-import { testState, createStore, writeDataFile } from './persistence-test-harness'
+
 import { getDefaultPersistedState } from '../shared/constants'
 import { sshRemotePtyLeaseAllowsReattach } from '../shared/ssh-types'
 import { TEST_LEAF_1, TEST_LEAF_2 } from './persistence-session-fixtures'
@@ -96,7 +97,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('merges missing prior layout bindings into partial renderer snapshots', async () => {
@@ -794,7 +796,8 @@ describe('ssh remote pty lease route-retirement marks survive the disk round tri
   beforeEach(() => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/persistence-ssh-targets-and-pane-keys.test.ts b/src/main/persistence-ssh-targets-and-pane-keys.test.ts
index c11ecbf0bc2..4a1da77dc10 100644
--- a/src/main/persistence-ssh-targets-and-pane-keys.test.ts
+++ b/src/main/persistence-ssh-targets-and-pane-keys.test.ts
@@ -1,11 +1,5 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import { isTerminalLeafId, makePaneKey } from '../shared/stable-pane-id'
-import { SshConnectionStore } from './ssh/ssh-connection-store'
-import { LEGACY_DEFAULT_SSH_RELAY_GRACE_PERIOD_SECONDS } from '../shared/ssh-types'
 import {
+  closeTestStores,
   testState,
   createStore,
   writeDataFile,
@@ -13,6 +7,14 @@ import {
   makeRepo,
   makeTerminalTab
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { isTerminalLeafId, makePaneKey } from '../shared/stable-pane-id'
+import { SshConnectionStore } from './ssh/ssh-connection-store'
+import { LEGACY_DEFAULT_SSH_RELAY_GRACE_PERIOD_SECONDS } from '../shared/ssh-types'
+
 import { TEST_LEAF_1 } from './persistence-session-fixtures'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
@@ -63,7 +65,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── 2. Load from existing valid file ─────────────────────────────────
diff --git a/src/main/persistence-terminal-option-key-migration.test.ts b/src/main/persistence-terminal-option-key-migration.test.ts
index e9219c41bfa..9d171178322 100644
--- a/src/main/persistence-terminal-option-key-migration.test.ts
+++ b/src/main/persistence-terminal-option-key-migration.test.ts
@@ -1,15 +1,16 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { PersistedState } from '../shared/persisted-state-types'
 import {
+  closeTestStores,
   testState,
   createStore,
   withPlatform,
   writeDataFile,
   readDataFile
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { PersistedState } from '../shared/persisted-state-types'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -59,7 +60,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── terminalMacOptionAsAlt migration (issue #903) ───────────────────
diff --git a/src/main/persistence-test-harness.ts b/src/main/persistence-test-harness.ts
index e2c04495e92..5a146da6e1d 100644
--- a/src/main/persistence-test-harness.ts
+++ b/src/main/persistence-test-harness.ts
@@ -1,5 +1,5 @@
-import { mkdirSync, readFileSync, symlinkSync, writeFileSync } from 'node:fs'
-import { join } from 'node:path'
+import { existsSync, mkdirSync, readFileSync, symlinkSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
 import { installFakeAppEnvironment } from '../../config/scripts/vitest-host-ports-setup'
 import type { Project, ProjectHostSetup } from '../shared/project-types'
 import type { Repo } from '../shared/repo-types'
@@ -9,16 +9,84 @@ import { folderWorkspaceKey, worktreeWorkspaceKey } from '../shared/workspace-sc
 import type { PersistedState } from '../shared/persisted-state-types'
 import { hydrateWorktreeMetaAliasProjection } from './persistence/loading-store/worktree-meta-alias-projection'
 import { Store } from './persistence/loading-store/store'
-import { initDataPath } from './persistence/loading-store/user-data-path'
+import { getDataFile, initDataPath } from './persistence/loading-store/user-data-path'
+import type { StoreRuntimeOptions } from './persistence/loading-store/store-runtime-state'
+import { ProfileStateSqliteAuthority } from './persistence/profile-state/profile-state-sqlite-authority'
+import {
+  openProfileStateDatabaseReadOnly,
+  profileStateDatabaseFile
+} from './persistence/profile-state/profile-state-database'
+import { exportProfileStateJson } from './persistence/profile-state/profile-state-documents'
 
 // Shared mutable state so the electron mock can reference a per-test directory
 export const testState = { dir: '' }
+const stores = new Set<Store>()
+
+class UnitTestProfileStateAuthority extends ProfileStateSqliteAuthority {
+  // Worker backup coverage uses the dedicated real-worker fixtures.
+  override scheduleBackup(): void {}
+}
+
+export function createSqliteTestStore(
+  StoreConstructor: typeof Store,
+  options: Omit<StoreRuntimeOptions, 'profileStateAuthority'> = {}
+): Store {
+  const path = options.dataFile ?? getDataFile()
+  const databaseFile = profileStateDatabaseFile(dirname(path))
+  mkdirSync(dirname(path), { recursive: true })
+  const authority = new UnitTestProfileStateAuthority(databaseFile, 'persistence-test')
+  try {
+    if (!existsSync(databaseFile) && existsSync(path)) {
+      authority.writeSerializedState(readFileSync(path))
+    }
+    const store = new StoreConstructor({
+      ...options,
+      dataFile: path,
+      profileStateAuthority: authority
+    })
+    stores.add(store)
+    return store
+  } catch (error) {
+    authority.close()
+    throw error
+  }
+}
+
+export function writePersistedStateJson(path: string, json: string): void {
+  mkdirSync(dirname(path), { recursive: true })
+  const databaseFile = profileStateDatabaseFile(dirname(path))
+  const authority = new UnitTestProfileStateAuthority(databaseFile, 'persistence-test')
+  try {
+    authority.writeSerializedState(Buffer.from(json))
+  } finally {
+    authority.close()
+  }
+}
+
+export async function closeTestStores(): Promise<void> {
+  const opened = [...stores]
+  stores.clear()
+  await Promise.all(opened.map((store) => store.freezeWritesAsync()))
+}
+
+export function readPersistedStateJson(path = dataFile(), profileId = 'persistence-test'): string {
+  const databaseFile = profileStateDatabaseFile(dirname(path))
+  if (!existsSync(databaseFile)) {
+    return readFileSync(path, 'utf8')
+  }
+  const opened = openProfileStateDatabaseReadOnly(databaseFile, profileId)
+  try {
+    return exportProfileStateJson(opened.db)
+  } finally {
+    opened.db.close()
+  }
+}
 
 /** Create a profile store without rebuilding its large module graph inside each test timeout. */
 export function createStore(): Store {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   initDataPath()
-  return new Store({ dataFile: dataFile() })
+  return createSqliteTestStore(Store, { dataFile: dataFile() })
 }
 
 export async function withPlatform<T>(platform: NodeJS.Platform, fn: () => Promise<T>): Promise<T> {
@@ -37,7 +105,12 @@ export function dataFile(): string {
 
 export function writeDataFile(data: unknown): void {
   mkdirSync(testState.dir, { recursive: true })
-  writeFileSync(dataFile(), JSON.stringify(data, null, 2), 'utf-8')
+  const json = JSON.stringify(data, null, 2)
+  if (existsSync(profileStateDatabaseFile(testState.dir))) {
+    writePersistedStateJson(dataFile(), json)
+    return
+  }
+  writeFileSync(dataFile(), json, 'utf-8')
 }
 
 /**
@@ -47,7 +120,8 @@ export function writeDataFile(data: unknown): void {
  * the literal bytes parse the file themselves (see `worktree-meta-alias-projection.test.ts`).
  */
 export function readDataFile(): unknown {
-  const parsed = JSON.parse(readFileSync(dataFile(), 'utf-8')) as PersistedState
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Store exports use PersistedState; this fixture reader restores only its omitted aliases.
+  const parsed = JSON.parse(readPersistedStateJson()) as PersistedState
   hydrateWorktreeMetaAliasProjection(parsed)
   return parsed
 }
diff --git a/src/main/persistence-ui-state.test.ts b/src/main/persistence-ui-state.test.ts
index 1b092293c68..10bea531533 100644
--- a/src/main/persistence-ui-state.test.ts
+++ b/src/main/persistence-ui-state.test.ts
@@ -1,11 +1,14 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { readFileSync, rmSync, mkdtempSync, existsSync } from 'node:fs'
+import { rmSync, mkdtempSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { PersistedState } from '../shared/persisted-state-types'
 import { getDefaultPersistedState } from '../shared/constants'
 import { createDefaultWorkspaceCleanupBrowseState } from '../shared/workspace-cleanup-browse-state'
 import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson,
   testState,
   dataFile,
   writeDataFile,
@@ -55,7 +58,7 @@ async function createStore() {
   // file's temp dir rather than the global fake's shared one, after resetModules.
   installFakeAppEnvironment({ getPath: () => testState.dir })
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 vi.mock('./telemetry/client', () => ({
@@ -74,7 +77,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── UI state ───────────────────────────────────────────────────────
@@ -132,6 +136,25 @@ describe('Store', () => {
     expect(store.getUI().sidebarWidth).toBe(400)
   })
 
+  it('updateUI persists sanitized per-worktree explorer roots', async () => {
+    const store = await createStore()
+    store.updateUI({
+      explorerDisplayRootByWorktree: {
+        'repo-1::/repo': '/',
+        'repo-2::/repo': 'packages/app',
+        // @ts-expect-error Deliberately malformed input exercises runtime sanitization.
+        'repo-3::/repo': false,
+        // @ts-expect-error Deliberately malformed prototype key exercises runtime sanitization.
+        constructor: false
+      }
+    })
+
+    expect(store.getUI().explorerDisplayRootByWorktree).toEqual({
+      'repo-1::/repo': '/',
+      'repo-2::/repo': 'packages/app'
+    })
+  })
+
   it('updateUI persists sanitized per-worktree dotfile visibility', async () => {
     const store = await createStore()
     store.updateUI({
@@ -165,7 +188,7 @@ describe('Store', () => {
       })
       vi.advanceTimersByTime(1000)
       await store.waitForPendingWrite()
-      const persistedBefore = readFileSync(dataFile(), 'utf-8')
+      const persistedBefore = readPersistedStateJson(dataFile())
       store.onUIChanged((ui) => notifications.push(ui))
 
       store.updateUI({
@@ -181,7 +204,7 @@ describe('Store', () => {
       await store.waitForPendingWrite()
 
       expect(notifications).toEqual([])
-      expect(readFileSync(dataFile(), 'utf-8')).toBe(persistedBefore)
+      expect(readPersistedStateJson(dataFile())).toBe(persistedBefore)
     } finally {
       vi.useRealTimers()
     }
@@ -193,7 +216,7 @@ describe('Store', () => {
     store.updateUI({ sidebarWidth: 321 })
     store.flush()
 
-    const raw = readFileSync(dataFile(), 'utf-8')
+    const raw = readPersistedStateJson(dataFile())
     // Compact payload: no newline-plus-indentation from JSON.stringify(_, null, 2).
     expect(raw).not.toMatch(/\n\s+"/)
     const parsed = JSON.parse(raw) as PersistedState
@@ -782,4 +805,39 @@ describe('Store', () => {
     const store = await createStore()
     expect(store.getUI().browserKagiSessionLink).toBe(sessionLink)
   })
+
+  it.each(['shutdown', 'freeze', 'maintenance'] as const)(
+    'rejects legacy SSH mutations before changing memory during %s',
+    async (gate) => {
+      const store = await createStore()
+      const recovery = {
+        targetId: 'ssh-1',
+        clientInstanceId: 'client-1',
+        serverBuildId: 'relay-build-1',
+        clientGeneration: 3,
+        ownerGeneration: 5,
+        ownerLease: 'secret-owner-lease'
+      }
+      await store.upsertSshPtyConsumerRecovery(recovery)
+      store.upsertSshRemotePtyLease({ targetId: 'ssh-1', ptyId: 'pty-1', state: 'detached' })
+      await store.flushPendingOrThrowAsync()
+      const closing =
+        gate === 'shutdown'
+          ? store.flushAsync()
+          : gate === 'freeze'
+            ? store.freezeWritesAsync()
+            : store.beginProfileMaintenance()
+      await Promise.all(
+        [
+          store.upsertSshPtyConsumerRecovery({ ...recovery, clientInstanceId: 'refused-owner' }),
+          store.removeSshPtyConsumerRecovery('ssh-1'),
+          store.markSshRemotePtyLeasesAsync('ssh-1', 'terminated'),
+          store.markSshRemotePtyLeasesAttachedAsync('ssh-1', ['pty-1'])
+        ].map((operation) => expect(operation).rejects.toThrow('finalized profile persistence'))
+      )
+      expect(store.getSshPtyConsumerRecovery('ssh-1')).toEqual(recovery)
+      expect(store.getSshRemotePtyLeases('ssh-1')[0]?.state).toBe('detached')
+      await closing
+    }
+  )
 })
diff --git a/src/main/persistence-update-repo.test.ts b/src/main/persistence-update-repo.test.ts
index d2426729658..b60e43df840 100644
--- a/src/main/persistence-update-repo.test.ts
+++ b/src/main/persistence-update-repo.test.ts
@@ -1,9 +1,5 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import { getDefaultPersistedState } from '../shared/constants'
 import {
+  closeTestStores,
   testState,
   createStore,
   writeDataFile,
@@ -11,6 +7,12 @@ import {
   makeProject,
   makeProjectHostSetup
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { getDefaultPersistedState } from '../shared/constants'
+
 import {
   getLocalWorktreeScanGeneration,
   isLocalWorktreeScanGenerationCurrent
@@ -64,7 +66,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── 7. updateRepo ──────────────────────────────────────────────────
diff --git a/src/main/persistence-workspace-pinned-automation-fence.test.ts b/src/main/persistence-workspace-pinned-automation-fence.test.ts
index 977aed0692d..1eaf04739a9 100644
--- a/src/main/persistence-workspace-pinned-automation-fence.test.ts
+++ b/src/main/persistence-workspace-pinned-automation-fence.test.ts
@@ -1,3 +1,9 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson,
+  writePersistedStateJson
+} from './persistence-test-harness'
 /**
  * A `local`-typed automation whose folder workspace pins it to an SSH host is
  * projected as SSH-owned, so it must be fenceable like any other SSH-owned row.
@@ -8,7 +14,7 @@
  * different machine. These tests drive the real Store through create and reload.
  */
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { Automation, AutomationCreateInput } from '../shared/automations-types'
@@ -116,7 +122,7 @@ async function createStoreFromState(state: Record<string, unknown>) {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('./persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 async function reloadStore() {
@@ -124,16 +130,16 @@ async function reloadStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('./persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 /** The same target id now carries a different registration incarnation. */
 function replaceStoredTargetGeneration(generation: number): void {
   const file = join(testState.dir, 'orca-data.json')
-  const state = JSON.parse(readFileSync(file, 'utf-8'))
+  const state = JSON.parse(readPersistedStateJson(file))
   state.sshTargets = [prodTarget(generation)]
   state.sshTargetGenerationCounter = generation
-  writeFileSync(file, JSON.stringify(state), 'utf-8')
+  writePersistedStateJson(file, JSON.stringify(state))
 }
 
 const PINNED_CREATE_INPUT: AutomationCreateInput = {
@@ -158,7 +164,8 @@ beforeEach(() => {
   testState.dir = mkdtempSync(join(tmpdir(), 'orca-pinned-fence-'))
 })
 
-afterEach(() => {
+afterEach(async () => {
+  await closeTestStores()
   rmSync(testState.dir, { recursive: true, force: true })
   vi.resetModules()
 })
diff --git a/src/main/persistence-workspace-repin-automation-owner.test.ts b/src/main/persistence-workspace-repin-automation-owner.test.ts
index 14f33c5db29..4f17c14ec47 100644
--- a/src/main/persistence-workspace-repin-automation-owner.test.ts
+++ b/src/main/persistence-workspace-repin-automation-owner.test.ts
@@ -1,3 +1,9 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson,
+  writePersistedStateJson
+} from './persistence-test-harness'
 /**
  * A folder workspace can be re-pointed at another SSH host outside the automation
  * editor — the workspace's scope connection moves, and every record inside it
@@ -10,7 +16,7 @@
  * a host removed and re-added under the same id still cannot re-adopt the record.
  */
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { FolderWorkspace } from '../shared/folder-workspace-types'
@@ -140,25 +146,26 @@ async function loadStore(state: Record<string, unknown>) {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('./persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 /** The workspace's execution host changes without any automation being edited. */
 function repinWorkspace(connectionId: string, sshTargets?: SshTarget[]): void {
   const file = join(testState.dir, 'orca-data.json')
-  const state = JSON.parse(readFileSync(file, 'utf-8'))
+  const state = JSON.parse(readPersistedStateJson(file))
   state.folderWorkspaces = [folderWorkspace(connectionId)]
   if (sshTargets) {
     state.sshTargets = sshTargets
   }
-  writeFileSync(file, JSON.stringify(state), 'utf-8')
+  writePersistedStateJson(file, JSON.stringify(state))
 }
 
 beforeEach(() => {
   testState.dir = mkdtempSync(join(tmpdir(), 'orca-workspace-repin-'))
 })
 
-afterEach(() => {
+afterEach(async () => {
+  await closeTestStores()
   rmSync(testState.dir, { recursive: true, force: true })
   vi.resetModules()
 })
@@ -183,7 +190,9 @@ describe('a workspace re-pinned outside the automation editor', () => {
     installFakeAppEnvironment({ getPath: () => testState.dir })
     const { Store, initDataPath } = await import('./persistence')
     initDataPath()
-    const reloaded = new Store()
+    const reloaded = createSqliteTestStore(Store, {
+      dataFile: join(testState.dir, 'orca-data.json')
+    })
 
     expect(reloaded.listAutomations()[0].executionTargetGeneration).toBe(STAGING_GENERATION)
     expect(reloaded.listAutomationsForScope().items[0].selector).toEqual({
@@ -205,7 +214,9 @@ describe('a workspace re-pinned outside the automation editor', () => {
     installFakeAppEnvironment({ getPath: () => testState.dir })
     const { Store, initDataPath } = await import('./persistence')
     initDataPath()
-    const reloaded = new Store()
+    const reloaded = createSqliteTestStore(Store, {
+      dataFile: join(testState.dir, 'orca-data.json')
+    })
 
     expect(reloaded.listAutomations()[0].executionTargetGeneration).toBe(PROD_GENERATION)
     expect(reloaded.listAutomationsForScope().items[0].selector).toEqual({
diff --git a/src/main/persistence-workspace-session-scrollback.test.ts b/src/main/persistence-workspace-session-scrollback.test.ts
index 29c664be49b..8afd69d70b0 100644
--- a/src/main/persistence-workspace-session-scrollback.test.ts
+++ b/src/main/persistence-workspace-session-scrollback.test.ts
@@ -1,12 +1,15 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { writeFileSync, readFileSync, rmSync, mkdtempSync, mkdirSync, existsSync } from 'node:fs'
-import type * as NodeFsPromises from 'node:fs/promises'
+import { writeFileSync, rmSync, mkdtempSync, mkdirSync, existsSync } from 'node:fs'
+import { ProfileStateSqliteAuthority } from './persistence/profile-state/profile-state-sqlite-authority'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { isTerminalLeafId, makePaneKey } from '../shared/stable-pane-id'
 import { TERMINAL_SCROLLBACK_REPLAY_BYTE_LIMIT } from '../shared/terminal-scrollback-limits'
 import { MAX_BROWSER_HISTORY_ENTRIES } from '../shared/workspace-session-browser-history'
 import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson,
   testState,
   createStore,
   dataFile,
@@ -29,29 +32,6 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-const asyncPrimaryWriteFailure = vi.hoisted(() => ({
-  error: null as Error | null,
-  targetPrefix: ''
-}))
-
-vi.mock('node:fs/promises', async (importOriginal) => {
-  const actual = await importOriginal<typeof NodeFsPromises>()
-  return {
-    ...actual,
-    open: async (...args: Parameters<typeof actual.open>) => {
-      const target = args[0]
-      if (
-        asyncPrimaryWriteFailure.error &&
-        typeof target === 'string' &&
-        target.startsWith(asyncPrimaryWriteFailure.targetPrefix)
-      ) {
-        throw asyncPrimaryWriteFailure.error
-      }
-      return actual.open(...args)
-    }
-  }
-})
-
 vi.mock('./ssh/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
@@ -92,14 +72,11 @@ describe('Store', () => {
     trackMock.mockReset()
     getCohortAtEmitMock.mockReset()
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
-    asyncPrimaryWriteFailure.error = null
-    asyncPrimaryWriteFailure.targetPrefix = ''
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
-    asyncPrimaryWriteFailure.error = null
-    asyncPrimaryWriteFailure.targetPrefix = ''
   })
   // ── GitHub Cache ───────────────────────────────────────────────────
 
@@ -222,7 +199,7 @@ describe('Store', () => {
     // AppEnvironment — without this it points at the global fake's shared dir.
     installFakeAppEnvironment({ getPath: () => testState.dir })
     initDataPath()
-    const store = new Store({ dataFile: profileDataFile })
+    const store = createSqliteTestStore(Store, { dataFile: profileDataFile })
     store.addRepo(makeRepo({ id: 'remote-repo', connectionId: 'ssh-target-1' }))
     const session = makeSessionWithTerminalBuffers()
     store.setWorkspaceSession({
@@ -253,7 +230,7 @@ describe('Store', () => {
     // AppEnvironment — without this it points at the global fake's shared dir.
     installFakeAppEnvironment({ getPath: () => testState.dir })
     initDataPath()
-    const store = new Store({ dataFile: profileDataFile })
+    const store = createSqliteTestStore(Store, { dataFile: profileDataFile })
 
     expect(store.readTerminalScrollbackSnapshot(ref)).toBe('legacy-scrollback')
   })
@@ -342,7 +319,8 @@ describe('Store', () => {
     })
 
     expect(existsSync(join(testState.dir, 'terminal-scrollback', `${ref}.bin`))).toBe(false)
-    const stillPublished = JSON.parse(readFileSync(dataFile(), 'utf-8')) as {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const stillPublished = JSON.parse(readPersistedStateJson(dataFile())) as {
       workspaceSession: {
         terminalLayoutsByTabId: Record<string, { scrollbackRefsByLeafId?: Record<string, string> }>
       }
@@ -353,7 +331,7 @@ describe('Store', () => {
     ).toBe(ref)
   })
 
-  it('leaves durable JSON pointing at deleted scrollback when the replacement write fails', async () => {
+  it('leaves durable state pointing at deleted scrollback when the replacement write fails', async () => {
     const store = await createStore()
     store.addRepo(makeRepo({ id: 'remote-repo', connectionId: 'ssh-target-1' }))
     const session = makeSessionWithTerminalBuffers()
@@ -375,14 +353,17 @@ describe('Store', () => {
     }
     const snapshotPath = join(testState.dir, 'terminal-scrollback', `${ref}.bin`)
     store.flushOrThrow()
-    const durableBeforeRemoval = readFileSync(dataFile(), 'utf-8')
+    const durableBeforeRemoval = readPersistedStateJson(dataFile())
     expect(existsSync(snapshotPath)).toBe(true)
 
     const writeError = Object.assign(new Error('profile mount rejected replacement write'), {
       code: 'EIO'
     })
-    asyncPrimaryWriteFailure.error = writeError
-    asyncPrimaryWriteFailure.targetPrefix = `${dataFile()}.`
+    const failure = vi
+      .spyOn(ProfileStateSqliteAuthority.prototype, 'writeSerializedDomains')
+      .mockImplementation(() => {
+        throw writeError
+      })
     const errors = vi.spyOn(console, 'error').mockImplementation(() => {})
     try {
       store.setWorkspaceSession({
@@ -397,10 +378,11 @@ describe('Store', () => {
       expect(store.getWorkspaceSession().terminalLayoutsByTabId).toEqual({})
       await expect(store.flushPendingOrThrowAsync()).rejects.toBe(writeError)
     } finally {
+      failure.mockRestore()
       errors.mockRestore()
     }
 
-    expect(readFileSync(dataFile(), 'utf-8')).toBe(durableBeforeRemoval)
+    expect(readPersistedStateJson(dataFile())).toBe(durableBeforeRemoval)
     const stillPublished = JSON.parse(durableBeforeRemoval) as {
       workspaceSession: {
         terminalLayoutsByTabId: Record<string, { scrollbackRefsByLeafId?: Record<string, string> }>
diff --git a/src/main/persistence-workspace-status-workflow.test.ts b/src/main/persistence-workspace-status-workflow.test.ts
index 9b6d5d4c9bb..1804d04dc41 100644
--- a/src/main/persistence-workspace-status-workflow.test.ts
+++ b/src/main/persistence-workspace-status-workflow.test.ts
@@ -1,9 +1,16 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  writeDataFile,
+  readDataFile
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { PersistedState } from '../shared/persisted-state-types'
-import { testState, createStore, writeDataFile, readDataFile } from './persistence-test-harness'
+
 import {
   REORDERED_DEFAULT_WORKSPACE_STATUSES,
   REORDERED_DONE_DEFAULT_WORKSPACE_STATUSES,
@@ -59,7 +66,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('preserves persisted smart sort value', async () => {
diff --git a/src/main/persistence-worktree-card-properties.test.ts b/src/main/persistence-worktree-card-properties.test.ts
index 37a6fbe5e1f..e370168af4f 100644
--- a/src/main/persistence-worktree-card-properties.test.ts
+++ b/src/main/persistence-worktree-card-properties.test.ts
@@ -1,8 +1,8 @@
+import { closeTestStores, testState, createStore, writeDataFile } from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
-import { testState, createStore, writeDataFile } from './persistence-test-harness'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -52,7 +52,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── worktree-card property migration ───────────────────────────────
diff --git a/src/main/persistence-worktree-deletion-fencing.test.ts b/src/main/persistence-worktree-deletion-fencing.test.ts
index 62619bbd05b..40a4c50e9f4 100644
--- a/src/main/persistence-worktree-deletion-fencing.test.ts
+++ b/src/main/persistence-worktree-deletion-fencing.test.ts
@@ -1,9 +1,15 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  makeTerminalTab
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { getDefaultWorkspaceSession } from '../shared/constants'
-import { testState, createStore, makeTerminalTab } from './persistence-test-harness'
+
 import { TEST_LEAF_1, TEST_LEAF_2 } from './persistence-session-fixtures'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
@@ -54,7 +60,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('adds a missing split leaf to the durable root when a new pane spawns before layout debounce', async () => {
@@ -87,7 +94,7 @@ describe('Store', () => {
       }
     })
 
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: 'wt1',
       tabId: 'tab1',
       leafId: TEST_LEAF_2,
@@ -132,7 +139,7 @@ describe('Store', () => {
       terminalTopologyRevisionByRepoId: { wt1: 1 }
     })
 
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: 'wt1',
       tabId: 'tab1',
       leafId: TEST_LEAF_2,
@@ -179,7 +186,7 @@ describe('Store', () => {
     store.setWorkspaceSession(stale)
     expect(store.getWorkspaceSession().tabsByWorktree.wt1).toEqual([])
 
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: 'wt1',
       tabId: 'fresh-tab',
       leafId: TEST_LEAF_2,
@@ -261,7 +268,7 @@ describe('Store', () => {
     expect(store.getWorkspaceSession().tabsByWorktree[worktreeA]?.[0]?.id).toBe('tab-a')
     expect(store.getWorkspaceSession().tabsByWorktree[worktreeB]?.[0]?.id).toBe('tab-b')
 
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: worktreeB,
       tabId: 'fresh-tab',
       leafId: TEST_LEAF_1,
@@ -281,7 +288,7 @@ describe('Store', () => {
     for (let index = 0; index < 25; index += 1) {
       const worktreeId = `repo::/worktree-${index}`
       store.setWorktreeMeta(worktreeId, { displayName: `Worktree ${index}` })
-      store.persistPtyBinding({
+      await store.persistPtyBinding({
         worktreeId,
         tabId: `tab-${index}`,
         leafId: TEST_LEAF_1,
@@ -364,7 +371,7 @@ describe('Store', () => {
       }
     })
 
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: 'wt1',
       tabId: 'tab1',
       leafId: TEST_LEAF_1,
diff --git a/src/main/persistence-worktree-lineage-and-backups.test.ts b/src/main/persistence-worktree-lineage-and-backups.test.ts
index 372e8b0e33b..0c38ca2f32f 100644
--- a/src/main/persistence-worktree-lineage-and-backups.test.ts
+++ b/src/main/persistence-worktree-lineage-and-backups.test.ts
@@ -1,10 +1,6 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { writeFileSync, readFileSync, rmSync, mkdtempSync, mkdirSync, existsSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { Repo } from '../shared/repo-types'
-import { folderWorkspaceKey, worktreeWorkspaceKey } from '../shared/workspace-scope'
 import {
+  closeTestStores,
+  readPersistedStateJson,
   testState,
   createStore,
   dataFile,
@@ -14,6 +10,16 @@ import {
   makeWorktreeLineage,
   makeWorkspaceLineage
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { writeFileSync, readFileSync, rmSync, mkdtempSync, mkdirSync, existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { createProfileStateStore } from './persistence/profile-state/profile-state-store-factory'
+import { ProfileStateAuthorityBootstrapError } from './persistence/profile-state/profile-state-authority-bootstrap'
+import { restoreProfileStateJsonExport } from './persistence/profile-state/legacy-json/profile-state-recovery'
+import { acquireProfileStateMaintenance } from './persistence/profile-state/profile-state-access'
+import type { Repo } from '../shared/repo-types'
+import { folderWorkspaceKey, worktreeWorkspaceKey } from '../shared/workspace-scope'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -63,7 +69,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── getAllWorktreeMeta ─────────────────────────────────────────────
@@ -331,282 +338,129 @@ describe('Store', () => {
     })
   })
 
-  // ── Rolling backups (issue #1158) ──────────────────────────────────
-
-  describe('rolling backups', () => {
-    function backupFile(index: number): string {
-      return `${dataFile()}.bak.${index}`
-    }
-
-    function readBackup(index: number): { repos: Repo[] } {
-      return JSON.parse(readFileSync(backupFile(index), 'utf-8'))
-    }
-
-    function advanceMockedTime(advanceFn: () => void, ms: number): void {
-      vi.setSystemTime(new Date(Date.now() + ms))
-      advanceFn()
-    }
-
-    it('snapshots the just-written file to .bak.0 on the very first write', async () => {
-      const s = await createStore()
-      s.addRepo(makeRepo())
-      s.flush()
-      expect(existsSync(dataFile())).toBe(true)
-      expect(existsSync(backupFile(0))).toBe(true)
-      expect(readBackup(0).repos.map((r) => r.id)).toEqual(['r1'])
-    })
-
-    it('rotates older .bak.0 to .bak.1 when the interval elapses', async () => {
-      vi.useFakeTimers()
-      try {
-        const first = await createStore()
-        first.addRepo(makeRepo({ id: 'r1' }))
-        first.flush()
-        expect(readBackup(0).repos.map((r) => r.id)).toEqual(['r1'])
-
-        vi.setSystemTime(new Date(Date.now() + 61 * 60 * 1000))
-
-        const second = await createStore()
-        second.addRepo(makeRepo({ id: 'r2', path: '/repo2' }))
-        second.flush()
-
-        const current = readDataFile() as { repos: Repo[] }
-        expect(current.repos.map((r) => r.id).sort()).toEqual(['r1', 'r2'])
-        expect(
-          readBackup(0)
-            .repos.map((r) => r.id)
-            .sort()
-        ).toEqual(['r1', 'r2'])
-        expect(readBackup(1).repos.map((r) => r.id)).toEqual(['r1'])
-      } finally {
-        vi.useRealTimers()
-      }
-    })
-
-    it('keeps at most 5 rotating backups', async () => {
-      vi.useFakeTimers()
-      try {
-        writeDataFile({
-          schemaVersion: 1,
-          repos: [makeRepo({ id: 'seed' })],
-          worktreeMeta: {},
-          settings: {},
-          ui: {},
-          githubCache: { pr: {}, issue: {} },
-          workspaceSession: {}
-        })
-
-        for (let i = 0; i < 6; i++) {
-          vi.setSystemTime(new Date(Date.now() + 61 * 60 * 1000))
-          const s = await createStore()
-          s.addRepo(makeRepo({ id: `gen-${i}`, path: `/gen-${i}` }))
-          s.flush()
+  describe('retired JSON backups', () => {
+    it.each(['sync', 'async'] as const)(
+      'leaves legacy JSON and backups unchanged during %s SQL writes',
+      async (flush) => {
+        writeDataFile({ repos: [makeRepo({ id: 'seed' })] })
+        const retained = readFileSync(dataFile())
+        const backup = `${dataFile()}.bak.0`
+        writeFileSync(backup, retained)
+        const store = createStore()
+        store.addRepo(makeRepo({ id: 'updated', path: '/updated' }))
+        if (flush === 'sync') {
+          store.flushOrThrow()
+        } else {
+          await store.flushPendingOrThrowAsync()
         }
 
-        for (let i = 0; i < 5; i++) {
-          expect(existsSync(backupFile(i))).toBe(true)
-        }
-        expect(existsSync(backupFile(5))).toBe(false)
-      } finally {
-        vi.useRealTimers()
+        expect(readFileSync(dataFile())).toEqual(retained)
+        expect(readFileSync(backup)).toEqual(retained)
+        expect(existsSync(`${dataFile()}.bak.1`)).toBe(false)
+        const persisted = readDataFile() as { repos: Repo[] }
+        expect(persisted.repos.map((repo) => repo.id).sort()).toEqual(['seed', 'updated'])
       }
+    )
+
+    it('does not create a JSON primary or backup for a fresh SQL profile', () => {
+      const store = createStore()
+      store.addRepo(makeRepo())
+      store.flushOrThrow()
+      expect(existsSync(dataFile())).toBe(false)
+      expect(existsSync(`${dataFile()}.bak.0`)).toBe(false)
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture registered r1 before flushing; its exported repos are Repo records.
+      expect((readDataFile() as { repos: Repo[] }).repos.map((repo) => repo.id)).toEqual(['r1'])
+    })
+  })
+
+  describe('legacy backup import and recovery', () => {
+    const recoveredStores: ReturnType<typeof createProfileStateStore>['store'][] = []
+    afterEach(async () => {
+      await Promise.all(recoveredStores.splice(0).map((store) => store.freezeWritesAsync()))
     })
 
-    it('does not rotate more than once per hour', async () => {
-      vi.useFakeTimers()
-      try {
-        writeDataFile({
-          schemaVersion: 1,
-          repos: [makeRepo({ id: 'seed' })],
-          worktreeMeta: {},
-          settings: {},
-          ui: {},
-          githubCache: { pr: {}, issue: {} },
-          workspaceSession: {}
-        })
-
-        const store = await createStore()
-        store.addRepo(makeRepo({ id: 'after-seed' }))
-        store.flush()
-
-        const bak0After1 = readBackup(0)
-        expect(bak0After1.repos.map((r) => r.id).sort()).toEqual(['after-seed', 'seed'])
-
-        advanceMockedTime(
-          () => {
-            store.addRepo(makeRepo({ id: 'within-hour', path: '/within' }))
-            store.flush()
-          },
-          5 * 60 * 1000
-        )
-
-        const bak0After2 = readBackup(0)
-        expect(bak0After2.repos.map((r) => r.id).sort()).toEqual(['after-seed', 'seed'])
-      } finally {
-        vi.useRealTimers()
+    function recoveryOptions() {
+      const directory = join(testState.dir, 'profiles', 'recovery-test')
+      mkdirSync(directory, { recursive: true })
+      return {
+        dataFile: join(directory, 'orca-data.json'),
+        databaseFile: join(directory, 'profile-state.db'),
+        profileId: 'recovery-test'
       }
-    })
-
-    it('does not rotate on the async write path within the 1-hour window', async () => {
-      vi.useFakeTimers()
-      try {
-        writeDataFile({
-          schemaVersion: 1,
-          repos: [makeRepo({ id: 'seed' })],
-          worktreeMeta: {},
-          settings: {},
-          ui: {},
-          githubCache: { pr: {}, issue: {} },
-          workspaceSession: {}
-        })
-
-        const store = await createStore()
-        store.addRepo(makeRepo({ id: 'first-async' }))
-        vi.advanceTimersByTime(1000)
-        await store.waitForPendingWrite()
-
-        const bak0AfterFirst = readBackup(0)
-        expect(bak0AfterFirst.repos.map((r) => r.id).sort()).toEqual(['first-async', 'seed'])
-
-        vi.setSystemTime(new Date(Date.now() + 5 * 60 * 1000))
-        store.addRepo(makeRepo({ id: 'within-hour-async', path: '/within-async' }))
-        vi.advanceTimersByTime(1000)
-        await store.waitForPendingWrite()
-
-        const bak0AfterSecond = readBackup(0)
-        expect(bak0AfterSecond.repos.map((r) => r.id).sort()).toEqual(['first-async', 'seed'])
-      } finally {
-        vi.useRealTimers()
-      }
-    })
-
-    it('rotates on the async write path after the 1-hour window elapses', async () => {
-      vi.useFakeTimers()
-      try {
-        writeDataFile({
-          schemaVersion: 1,
-          repos: [makeRepo({ id: 'seed' })],
-          worktreeMeta: {},
-          settings: {},
-          ui: {},
-          githubCache: { pr: {}, issue: {} },
-          workspaceSession: {}
-        })
-
-        const store = await createStore()
-        store.addRepo(makeRepo({ id: 'first-async' }))
-        vi.advanceTimersByTime(1000)
-        await store.waitForPendingWrite()
-
-        expect(
-          readBackup(0)
-            .repos.map((r) => r.id)
-            .sort()
-        ).toEqual(['first-async', 'seed'])
-
-        vi.setSystemTime(new Date(Date.now() + 61 * 60 * 1000))
-        store.addRepo(makeRepo({ id: 'after-hour-async', path: '/after-async' }))
-        vi.advanceTimersByTime(1000)
-        await store.waitForPendingWrite()
-
-        expect(
-          readBackup(0)
-            .repos.map((r) => r.id)
-            .sort()
-        ).toEqual(['after-hour-async', 'first-async', 'seed'])
-        expect(existsSync(backupFile(1))).toBe(true)
-        expect(
-          readBackup(1)
-            .repos.map((r) => r.id)
-            .sort()
-        ).toEqual(['first-async', 'seed'])
-      } finally {
-        vi.useRealTimers()
-      }
-    })
-
-    function writeBackup(index: number, data: unknown): void {
-      mkdirSync(testState.dir, { recursive: true })
-      writeFileSync(backupFile(index), JSON.stringify(data, null, 2), 'utf-8')
     }
 
-    it('recovers from .bak.0 when the primary file is corrupt', async () => {
-      mkdirSync(testState.dir, { recursive: true })
-      writeFileSync(dataFile(), '{{{corrupt-json', 'utf-8')
-      writeBackup(0, {
-        schemaVersion: 1,
-        repos: [makeRepo({ id: 'recovered' })],
-        worktreeMeta: {},
-        settings: {},
-        ui: {},
-        githubCache: { pr: {}, issue: {} },
-        workspaceSession: {}
-      })
+    function importRecoveredProfile(options: ReturnType<typeof recoveryOptions>) {
+      const { store } = createProfileStateStore(options)
+      recoveredStores.push(store)
+      return store
+    }
 
-      const store = await createStore()
-      expect(store.getRepos().map((r) => r.id)).toEqual(['recovered'])
-    })
-
-    it('falls through to .bak.1 when both primary and .bak.0 are corrupt', async () => {
-      mkdirSync(testState.dir, { recursive: true })
-      writeFileSync(dataFile(), '{{{corrupt-json', 'utf-8')
-      writeFileSync(backupFile(0), '{{also-corrupt', 'utf-8')
-      writeBackup(1, {
-        schemaVersion: 1,
-        repos: [makeRepo({ id: 'from-bak1' })],
-        worktreeMeta: {},
-        settings: {},
-        ui: {},
-        githubCache: { pr: {}, issue: {} },
-        workspaceSession: {}
-      })
-
-      const store = await createStore()
-      expect(store.getRepos().map((r) => r.id)).toEqual(['from-bak1'])
-    })
-
-    it('falls back to defaults only when every backup is also unusable', async () => {
-      mkdirSync(testState.dir, { recursive: true })
-      writeFileSync(dataFile(), '{{{corrupt', 'utf-8')
-      for (let i = 0; i < 5; i++) {
-        writeFileSync(backupFile(i), `{{slot-${i}-corrupt`, 'utf-8')
+    function restoreSelectedBackup(options: ReturnType<typeof recoveryOptions>, index: number) {
+      expect(() => createProfileStateStore(options)).toThrow(ProfileStateAuthorityBootstrapError)
+      const maintenance = acquireProfileStateMaintenance(testState.dir)
+      try {
+        restoreProfileStateJsonExport({
+          ...options,
+          databasePath: options.databaseFile,
+          exportPath: `${options.dataFile}.bak.${index}`,
+          maintenance
+        })
+      } finally {
+        maintenance.release()
       }
+      return importRecoveredProfile(options)
+    }
 
-      const store = await createStore()
-      expect(store.getRepos()).toEqual([])
+    it.each([
+      { primary: 'corrupt', index: 0, repoId: 'recovered' },
+      { primary: 'corrupt', index: 1, repoId: 'from-bak1' },
+      { primary: 'missing', index: 0, repoId: 'rescued' }
+    ] as const)('imports backup $index with a $primary primary', (scenario) => {
+      const options = recoveryOptions()
+      if (scenario.primary === 'corrupt') {
+        writeFileSync(options.dataFile, '{{corrupt')
+      }
+      if (scenario.index === 1) {
+        writeFileSync(`${options.dataFile}.bak.0`, '{{also-corrupt')
+      }
+      const backup = `${options.dataFile}.bak.${scenario.index}`
+      const retained = JSON.stringify({ repos: [makeRepo({ id: scenario.repoId })] })
+      writeFileSync(backup, retained)
+      const store =
+        scenario.primary === 'missing'
+          ? restoreSelectedBackup(options, scenario.index)
+          : importRecoveredProfile(options)
+      expect(store.getRepos().map((repo) => repo.id)).toEqual([scenario.repoId])
+      expect(readFileSync(backup, 'utf8')).toBe(retained)
+      if (scenario.primary === 'corrupt') {
+        expect(readFileSync(options.dataFile, 'utf8')).toBe('{{corrupt')
+      }
     })
 
-    it('uses .bak.0 even when primary file is missing entirely', async () => {
-      mkdirSync(testState.dir, { recursive: true })
-      writeBackup(0, {
-        schemaVersion: 1,
-        repos: [makeRepo({ id: 'rescued' })],
-        worktreeMeta: {},
-        settings: {},
-        ui: {},
-        githubCache: { pr: {}, issue: {} },
-        workspaceSession: {}
-      })
-
-      const store = await createStore()
-      expect(store.getRepos().map((r) => r.id)).toEqual(['rescued'])
+    it('refuses defaults when the primary and every backup are unusable', () => {
+      const options = recoveryOptions()
+      writeFileSync(options.dataFile, '{{corrupt')
+      for (let index = 0; index < 5; index++) {
+        writeFileSync(`${options.dataFile}.bak.${index}`, `{{slot-${index}-corrupt`)
+      }
+      expect(() => createProfileStateStore(options)).toThrow(ProfileStateAuthorityBootstrapError)
+      expect(existsSync(options.databaseFile)).toBe(false)
+      expect(readFileSync(options.dataFile, 'utf8')).toBe('{{corrupt')
     })
 
-    it('still recovers repos/worktrees from a backup with corrupt workspaceSession', async () => {
-      mkdirSync(testState.dir, { recursive: true })
-      writeFileSync(dataFile(), '{{{corrupt', 'utf-8')
-      writeBackup(0, {
-        schemaVersion: 1,
-        repos: [makeRepo({ id: 'survives' })],
-        worktreeMeta: {},
-        settings: { theme: 'dark' },
-        ui: {},
-        githubCache: { pr: {}, issue: {} },
-        workspaceSession: { activeRepoId: 12345 }
-      })
-
-      const store = await createStore()
-      expect(store.getRepos().map((r) => r.id)).toEqual(['survives'])
+    it('recovers repos and settings from a selected backup with a malformed session', () => {
+      const options = recoveryOptions()
+      writeFileSync(options.dataFile, '{{corrupt')
+      writeFileSync(
+        `${options.dataFile}.bak.0`,
+        JSON.stringify({
+          repos: [makeRepo({ id: 'survives' })],
+          settings: { theme: 'dark' },
+          workspaceSession: { activeRepoId: 12345 }
+        })
+      )
+      const store = importRecoveredProfile(options)
+      expect(store.getRepos().map((repo) => repo.id)).toEqual(['survives'])
       expect(store.getSettings().theme).toBe('dark')
     })
   })
@@ -624,7 +478,8 @@ describe('Store', () => {
         vi.advanceTimersByTime(1000)
         await store.waitForPendingWrite()
 
-        const persisted = JSON.parse(readFileSync(dataFile(), 'utf-8')) as { repos: Repo[] }
+        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+        const persisted = JSON.parse(readPersistedStateJson()) as { repos: Repo[] }
         expect(persisted.repos.map((r) => r.id).sort()).toEqual(['first', 'second'])
       } finally {
         vi.useRealTimers()
diff --git a/src/main/persistence-worktree-meta-and-folder-workspaces.test.ts b/src/main/persistence-worktree-meta-and-folder-workspaces.test.ts
index 85795ac0c98..632e4ebf25a 100644
--- a/src/main/persistence-worktree-meta-and-folder-workspaces.test.ts
+++ b/src/main/persistence-worktree-meta-and-folder-workspaces.test.ts
@@ -1,11 +1,5 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { PersistedState } from '../shared/persisted-state-types'
-import { getDefaultWorkspaceSession } from '../shared/constants'
-import { folderWorkspaceKey } from '../shared/workspace-scope'
 import {
+  closeTestStores,
   testState,
   createStore,
   writeDataFile,
@@ -13,6 +7,13 @@ import {
   makeRepo,
   makeTerminalTab
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { PersistedState } from '../shared/persisted-state-types'
+import { getDefaultWorkspaceSession } from '../shared/constants'
+import { folderWorkspaceKey } from '../shared/workspace-scope'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -62,7 +63,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── 8. setWorktreeMeta and getWorktreeMeta ─────────────────────────
diff --git a/src/main/persistence-worktree-name-retirement.test.ts b/src/main/persistence-worktree-name-retirement.test.ts
index 2f89775ce87..ebe4db5feec 100644
--- a/src/main/persistence-worktree-name-retirement.test.ts
+++ b/src/main/persistence-worktree-name-retirement.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from './persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
@@ -50,7 +51,7 @@ async function reloadStore() {
   // file's temp dir rather than the global fake's shared one, after resetModules.
   installFakeAppEnvironment({ getPath: () => testState.dir })
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 async function createStore(persisted: Record<string, unknown> = {}) {
@@ -67,7 +68,8 @@ beforeEach(() => {
   testState.dir = mkdtempSync(join(tmpdir(), 'orca-worktree-name-retirement-'))
 })
 
-afterEach(() => {
+afterEach(async () => {
+  await closeTestStores()
   rmSync(testState.dir, { force: true, recursive: true })
 })
 
diff --git a/src/main/persistence-worktree-visibility.test.ts b/src/main/persistence-worktree-visibility.test.ts
index 55f81617c03..ab593396b72 100644
--- a/src/main/persistence-worktree-visibility.test.ts
+++ b/src/main/persistence-worktree-visibility.test.ts
@@ -1,3 +1,10 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  writeDataFile,
+  makeRepo
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
@@ -5,7 +12,6 @@ import { tmpdir } from 'node:os'
 import type { GlobalSettings } from '../shared/global-settings-types'
 import type { ExternalWorktreeVisibility } from '../shared/repo-types'
 import { getDefaultPersistedState } from '../shared/constants'
-import { testState, createStore, writeDataFile, makeRepo } from './persistence-test-harness'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -55,7 +61,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('updateRepo stamps legacy external-worktree visibility before changing old repos', async () => {
diff --git a/src/main/persistence/applying-settings/feature-interaction-recording.ts b/src/main/persistence/applying-settings/feature-interaction-recording.ts
index 2a29bc64f66..662e79bd40f 100644
--- a/src/main/persistence/applying-settings/feature-interaction-recording.ts
+++ b/src/main/persistence/applying-settings/feature-interaction-recording.ts
@@ -12,7 +12,7 @@ import { getCohortAtEmit } from '../../telemetry/cohort-classifier'
 
 export type FeatureInteractionOperations = {
   state: PersistedState
-  scheduleSave: () => void
+  scheduleSave: (domains?: readonly string[]) => void
   notifyUIChanged: () => void
   getUI: () => PersistedState['ui']
 }
@@ -49,7 +49,7 @@ export function recordFeatureInteraction(
   operations.state.featureInteractionTelemetryBuckets = shouldEmit
     ? { ...telemetryBuckets, [id]: nextBucket }
     : telemetryBuckets
-  operations.scheduleSave()
+  operations.scheduleSave(['ui', 'featureInteractionTelemetryBuckets'])
   // Why: live UI only consumes the seen transition; count-only telemetry must not re-hydrate the renderer.
   if (!existing) {
     operations.notifyUIChanged()
diff --git a/src/main/persistence/applying-settings/onboarding-normalization.ts b/src/main/persistence/applying-settings/onboarding-normalization.ts
index a778463566e..7c8b17badd1 100644
--- a/src/main/persistence/applying-settings/onboarding-normalization.ts
+++ b/src/main/persistence/applying-settings/onboarding-normalization.ts
@@ -5,12 +5,12 @@ import type {
 } from '../../../shared/onboarding-state-types'
 import type { NotificationSettings } from '../../../shared/notification-settings-types'
 import type { PersistedState } from '../../../shared/persisted-state-types'
+import { getDefaultNotificationSettings } from '../../../shared/notification-settings-defaults'
 import {
-  getDefaultNotificationSettings,
   getDefaultOnboardingState,
   ONBOARDING_FINAL_STEP,
   ONBOARDING_FLOW_VERSION
-} from '../../../shared/constants'
+} from '../../../shared/onboarding-defaults'
 
 export function normalizeNotificationSettings(value: unknown): NotificationSettings {
   const defaults = getDefaultNotificationSettings()
diff --git a/src/main/persistence/applying-settings/ui-state-read.ts b/src/main/persistence/applying-settings/ui-state-read.ts
index a640f971f89..ffe122efce0 100644
--- a/src/main/persistence/applying-settings/ui-state-read.ts
+++ b/src/main/persistence/applying-settings/ui-state-read.ts
@@ -1,3 +1,4 @@
+import { normalizeExplorerDisplayRootByWorktree } from '../../../shared/file-explorer-display-root'
 import type { PersistedState } from '../../../shared/persisted-state-types'
 import {
   getDefaultUIState,
@@ -32,6 +33,7 @@ import {
 } from './ui-selection-normalization'
 import { stripMainOwnedTelemetryMarkerFromUI } from './ui-interaction-merge'
 
+/** Returns normalized UI state with the authoritative active view and without the main-owned telemetry marker. */
 export function getPersistedUI(
   state: PersistedState,
   activeView: PersistedState['ui']['activeView']
@@ -66,6 +68,9 @@ export function getPersistedUI(
     workspaceHostOrder: normalizeExecutionHostOrder(state.ui?.workspaceHostOrder),
     manualRepoOrder: normalizeManualRepoOrder(state.ui?.manualRepoOrder),
     browserDefaultZoomLevel: normalizeBrowserPageZoomLevel(state.ui?.browserDefaultZoomLevel),
+    explorerDisplayRootByWorktree: normalizeExplorerDisplayRootByWorktree(
+      state.ui?.explorerDisplayRootByWorktree
+    ),
     showDotfilesByWorktree: normalizeShowDotfilesByWorktree(state.ui?.showDotfilesByWorktree),
     featureTipsSeenIds: normalizeFeatureTipIds(state.ui?.featureTipsSeenIds),
     contextualToursSeenIds: normalizeContextualTourIds(state.ui?.contextualToursSeenIds),
diff --git a/src/main/persistence/applying-settings/ui-state-update.ts b/src/main/persistence/applying-settings/ui-state-update.ts
index db06a2738fd..a89c189f499 100644
--- a/src/main/persistence/applying-settings/ui-state-update.ts
+++ b/src/main/persistence/applying-settings/ui-state-update.ts
@@ -1,3 +1,4 @@
+import { normalizeExplorerDisplayRootByWorktree } from '../../../shared/file-explorer-display-root'
 import type { PersistedState } from '../../../shared/persisted-state-types'
 import {
   getDefaultUIState,
@@ -53,11 +54,14 @@ export type UIUpdateOperations = {
   notifyUIChanged: () => void
 }
 
+/** Applies a sanitized partial update while keeping active-view persistence separate from durable UI fields. */
 export function updatePersistedUI(
   operations: UIUpdateOperations,
   updates: Partial<PersistedState['ui']>
 ): void {
-  if ('browserKagiSessionLink' in updates && !updates.browserKagiSessionLink) {
+  const clearsProtectedSecret =
+    'browserKagiSessionLink' in updates && !updates.browserKagiSessionLink
+  if (clearsProtectedSecret) {
     operations.removeRetainedBlob(PROTECTED_SECRET_SLOT.browserKagiSessionLink)
   }
   const sanitizedUpdates = stripMainOwnedTelemetryMarkerFromUI(updates)
@@ -167,6 +171,12 @@ export function updatePersistedUI(
     browserDefaultZoomLevel: normalizeBrowserPageZoomLevel(
       sanitizedUpdates.browserDefaultZoomLevel ?? operations.state.ui?.browserDefaultZoomLevel
     ),
+    explorerDisplayRootByWorktree:
+      sanitizedUpdates.explorerDisplayRootByWorktree !== undefined
+        ? normalizeExplorerDisplayRootByWorktree(sanitizedUpdates.explorerDisplayRootByWorktree)
+        : normalizeExplorerDisplayRootByWorktree(
+            operations.state.ui?.explorerDisplayRootByWorktree
+          ),
     showDotfilesByWorktree:
       sanitizedUpdates.showDotfilesByWorktree !== undefined
         ? normalizeShowDotfilesByWorktree(sanitizedUpdates.showDotfilesByWorktree)
@@ -192,7 +202,8 @@ export function updatePersistedUI(
           )
         : normalizeFeatureInteractions(operations.state.ui?.featureInteractions)
   }
-  if (persistedUIValuesEqual(previousUI, nextUI)) {
+  // A sealed secret looks empty in memory; an explicit clear must still reach disk.
+  if (!clearsProtectedSecret && persistedUIValuesEqual(previousUI, nextUI)) {
     if (activeViewChanged) {
       operations.notifyUIChanged()
     }
diff --git a/src/main/persistence/leasing-ssh-ptys/ssh-normalization.ts b/src/main/persistence/leasing-ssh-ptys/ssh-normalization.ts
index 58b0cd0473a..a23bd421dd5 100644
--- a/src/main/persistence/leasing-ssh-ptys/ssh-normalization.ts
+++ b/src/main/persistence/leasing-ssh-ptys/ssh-normalization.ts
@@ -61,7 +61,7 @@ export function normalizeSshRemotePtyLease(value: unknown): SshRemotePtyLease |
     return null
   }
   const now = Date.now()
-  const pendingKill = normalizeSshPendingPtyKill(raw.pendingKill)
+  const pendingKill = normalizeSshPendingPtyKill(raw.pendingKill, raw.ptyId)
   return {
     targetId: raw.targetId,
     ptyId: raw.ptyId,
diff --git a/src/main/persistence/leasing-ssh-ptys/ssh-pty-consumer-recovery.ts b/src/main/persistence/leasing-ssh-ptys/ssh-pty-consumer-recovery.ts
index 3b259989906..07770fe70b9 100644
--- a/src/main/persistence/leasing-ssh-ptys/ssh-pty-consumer-recovery.ts
+++ b/src/main/persistence/leasing-ssh-ptys/ssh-pty-consumer-recovery.ts
@@ -1,3 +1,4 @@
+import type { StoreRuntimeState } from '../loading-store/store-runtime-state'
 import type { SshPtyConsumerRecovery } from '../../../shared/ssh-types'
 import type { PersistedState } from '../../../shared/persisted-state-types'
 import type { ProtectedSecretPersistence } from '../../protected-secret-persistence'
@@ -7,16 +8,7 @@ import { normalizeSshPtyConsumerRecovery } from './ssh-normalization'
 export type SshPtyConsumerRecoveryOperations = {
   state: PersistedState
   protectedSecrets: Pick<ProtectedSecretPersistence, 'isSealed' | 'removeRetainedBlob'>
-  flushDurableStateOrThrowAsync: () => Promise<void>
-}
-
-async function flushSshPtyConsumerRecovery(
-  operations: SshPtyConsumerRecoveryOperations
-): Promise<void> {
-  // Why: ownership must be durable before relay setup continues, but this runs on the live
-  // establish/reconnect path — a sync flush would park the main thread on a stalled profile mount.
-  // Why not caught here: the failure must reach the awaiting caller.
-  await operations.flushDurableStateOrThrowAsync()
+  runDurableMutation: StoreRuntimeState['runDurableMutation']
 }
 
 export function getSshPtyConsumerRecovery(
@@ -46,24 +38,37 @@ export async function upsertSshPtyConsumerRecovery(
   if (!normalized) {
     throw new Error('Invalid SSH PTY consumer recovery record')
   }
-  const recoveries = operations.state.sshPtyConsumerRecoveries ?? []
-  operations.state.sshPtyConsumerRecoveries = [
-    ...recoveries.filter((candidate) => candidate.targetId !== normalized.targetId),
-    normalized
-  ]
-  await flushSshPtyConsumerRecovery(operations)
+  await operations.runDurableMutation(() => {
+    const recoveries = operations.state.sshPtyConsumerRecoveries ?? []
+    operations.state.sshPtyConsumerRecoveries = [
+      ...recoveries.filter((candidate) => candidate.targetId !== normalized.targetId),
+      normalized
+    ]
+    return { value: undefined }
+  })
 }
 
 export async function removeSshPtyConsumerRecovery(
   operations: SshPtyConsumerRecoveryOperations,
-  targetId: string
+  targetId: string,
+  expectedClientInstanceId?: string
 ): Promise<void> {
-  const recoveries = operations.state.sshPtyConsumerRecoveries ?? []
-  const next = recoveries.filter((record) => record.targetId !== targetId)
-  if (next.length === recoveries.length) {
-    return
+  await operations.runDurableMutation(() => {
+    const recoveries = operations.state.sshPtyConsumerRecoveries ?? []
+    const current = recoveries.find((record) => record.targetId === targetId)
+    if (
+      expectedClientInstanceId !== undefined &&
+      current &&
+      current.clientInstanceId !== expectedClientInstanceId
+    ) {
+      return { value: undefined, persist: false }
+    }
+    operations.state.sshPtyConsumerRecoveries = recoveries.filter(
+      (record) => record.targetId !== targetId
+    )
+    return { value: undefined }
+  })
+  if (!operations.state.sshPtyConsumerRecoveries?.some((record) => record.targetId === targetId)) {
+    operations.protectedSecrets.removeRetainedBlob(sshPtyOwnerLeaseSecretSlot(targetId))
   }
-  operations.state.sshPtyConsumerRecoveries = next
-  operations.protectedSecrets.removeRetainedBlob(sshPtyOwnerLeaseSecretSlot(targetId))
-  await flushSshPtyConsumerRecovery(operations)
 }
diff --git a/src/main/persistence/leasing-ssh-ptys/ssh-pty-kill-intent-operations.ts b/src/main/persistence/leasing-ssh-ptys/ssh-pty-kill-intent-operations.ts
index 52d1c51e9f2..a499ba10253 100644
--- a/src/main/persistence/leasing-ssh-ptys/ssh-pty-kill-intent-operations.ts
+++ b/src/main/persistence/leasing-ssh-ptys/ssh-pty-kill-intent-operations.ts
@@ -126,7 +126,7 @@ export function recordSshRemotePtyKillIntent(
     const prior = existing.pendingKill
     // Same incarnation means a repeated close; a recycled relay id starts a new intent lifetime.
     existing.pendingKill =
-      prior?.incarnationId === intent.incarnationId
+      prior && prior.incarnationId === intent.incarnationId
         ? {
             ...intent,
             requestedAt: Math.min(prior.requestedAt, now),
diff --git a/src/main/persistence/leasing-ssh-ptys/ssh-pty-lease-operations.ts b/src/main/persistence/leasing-ssh-ptys/ssh-pty-lease-operations.ts
index f06e5b0ece7..b2e3cef030b 100644
--- a/src/main/persistence/leasing-ssh-ptys/ssh-pty-lease-operations.ts
+++ b/src/main/persistence/leasing-ssh-ptys/ssh-pty-lease-operations.ts
@@ -1,3 +1,4 @@
+import type { StoreRuntimeState } from '../loading-store/store-runtime-state'
 import type { PersistedState } from '../../../shared/persisted-state-types'
 import type { SshRemotePtyLease } from '../../../shared/ssh-types'
 import { isTerminalLeafId } from '../../../shared/stable-pane-id'
@@ -12,7 +13,7 @@ export type SshPtyLeaseOperations = {
   clearBindingsForTarget: (targetId: string) => void
   clearBindingsForLeases: (targetId: string, leases: SshRemotePtyLease[]) => boolean
   flush: () => void
-  flushDurableStateOrThrowAsync: () => Promise<void>
+  runDurableMutation: StoreRuntimeState['runDurableMutation']
 }
 
 /**
@@ -93,7 +94,8 @@ function updateSshRemotePtyLeaseStates(
   operations: SshPtyLeaseOperations,
   targetId: string,
   state: SshRemotePtyLease['state'],
-  ptyIds?: ReadonlySet<string>
+  ptyIds?: ReadonlySet<string>,
+  admittedLeases?: ReadonlySet<SshRemotePtyLease>
 ): boolean {
   const now = Date.now()
   let changed = false
@@ -101,7 +103,11 @@ function updateSshRemotePtyLeaseStates(
   const leasesToClear: SshRemotePtyLease[] = []
   operations.state.sshRemotePtyLeases ??= []
   for (const lease of operations.state.sshRemotePtyLeases) {
-    if (lease.targetId !== targetId || (ptyIds && !ptyIds.has(lease.ptyId))) {
+    if (
+      lease.targetId !== targetId ||
+      (ptyIds && !ptyIds.has(lease.ptyId)) ||
+      (admittedLeases && !admittedLeases.has(lease))
+    ) {
       continue
     }
     if (state === 'attached' && lease.state === 'terminated') {
@@ -179,9 +185,12 @@ export async function markSshRemotePtyLeasesAsync(
   targetId: string,
   state: SshRemotePtyLease['state']
 ): Promise<void> {
-  if (updateSshRemotePtyLeaseStates(operations, targetId, state)) {
-    await operations.flushDurableStateOrThrowAsync()
-  }
+  // A newer connection can replace a lease while this operation waits for the writer.
+  const admittedLeases = new Set(getSshRemotePtyLeases(operations.state, targetId))
+  await operations.runDurableMutation(() => {
+    updateSshRemotePtyLeaseStates(operations, targetId, state, undefined, admittedLeases)
+    return { value: undefined }
+  })
 }
 
 export async function markSshRemotePtyLeasesAttachedAsync(
@@ -190,9 +199,12 @@ export async function markSshRemotePtyLeasesAttachedAsync(
   ptyIds: readonly string[]
 ): Promise<void> {
   const relayPtyIds = new Set(ptyIds.map((ptyId) => operations.toStoredPtyId(targetId, ptyId)))
-  if (updateSshRemotePtyLeaseStates(operations, targetId, 'attached', relayPtyIds)) {
-    await operations.flushDurableStateOrThrowAsync()
-  }
+  // A newer connection can replace a lease while this operation waits for the writer.
+  const admittedLeases = new Set(getSshRemotePtyLeases(operations.state, targetId))
+  await operations.runDurableMutation(() => {
+    updateSshRemotePtyLeaseStates(operations, targetId, 'attached', relayPtyIds, admittedLeases)
+    return { value: undefined }
+  })
 }
 
 /** `relayIdRecycled` is the pending-stop replay's evidence that the host now lists this id under a
diff --git a/src/main/persistence/loading-store/automation-persistence.ts b/src/main/persistence/loading-store/automation-persistence.ts
index 2bed89ff09b..64abd8ed2a9 100644
--- a/src/main/persistence/loading-store/automation-persistence.ts
+++ b/src/main/persistence/loading-store/automation-persistence.ts
@@ -53,7 +53,11 @@ import type { ProfilePreferences } from './profile-preferences'
 
 type AutomationPersistenceRuntime = Pick<
   StoreRuntimeState,
-  'automationListProjectionCache' | 'state' | 'storageAuthority'
+  | 'automationListProjectionCache'
+  | 'dirtyProfileStateDomains'
+  | 'pendingAutomationRunsAfter'
+  | 'state'
+  | 'storageAuthority'
 >
 
 const automationPersistenceContext = Symbol('AutomationPersistence')
@@ -195,7 +199,10 @@ export class AutomationPersistence {
   advanceAutomationNextRun(id: string, now = Date.now()): Automation {
     return advanceAutomationNextRunOperation(
       this[automationPersistenceContext].runtime.state,
-      () => this[automationPersistenceContext].flushBarriers.flush(),
+      () => {
+        markAutomationDefinitionDomain(this)
+        this[automationPersistenceContext].flushBarriers.flush()
+      },
       id,
       now
     )
@@ -212,16 +219,31 @@ export function getAutomationDefinitionOperations(
   return {
     state: owner[automationPersistenceContext].runtime.state,
     storageAuthority: owner[automationPersistenceContext].runtime.storageAuthority,
-    flush: () => owner[automationPersistenceContext].flushBarriers.flush(),
+    flush: () => {
+      markAutomationDefinitionDomain(owner)
+      owner[automationPersistenceContext].flushBarriers.flush()
+    },
     recordCreated: () =>
-      owner[automationPersistenceContext].preferences.recordFeatureInteraction('automation-created')
+      owner[automationPersistenceContext].preferences.recordFeatureInteraction(
+        'automation-created'
+      ),
+    recordAutomationRunsMutation: (runs) => {
+      owner[automationPersistenceContext].runtime.pendingAutomationRunsAfter = runs
+      owner[automationPersistenceContext].runtime.dirtyProfileStateDomains?.add('automationRuns')
+    }
   }
 }
 
 export function getAutomationRunOperations(owner: AutomationPersistence): AutomationRunOperations {
   return {
     state: owner[automationPersistenceContext].runtime.state,
-    flush: () => owner[automationPersistenceContext].flushBarriers.flush(),
+    flush: () => {
+      markAutomationDomains(owner)
+      owner[automationPersistenceContext].flushBarriers.flush()
+    },
+    recordAutomationRunsMutation: (runs) => {
+      owner[automationPersistenceContext].runtime.pendingAutomationRunsAfter = runs
+    },
     recordManualRun: () =>
       owner[automationPersistenceContext].preferences.recordFeatureInteraction('automation-run'),
     getWorkspaceDisplayName: (workspaceId) =>
@@ -242,6 +264,18 @@ export function getAutomationRunWorkspaceDisplayName(
   )
 }
 
+function markAutomationDomains(owner: AutomationPersistence): void {
+  const dirtyDomains = owner[automationPersistenceContext].runtime.dirtyProfileStateDomains
+  if (dirtyDomains !== null) {
+    dirtyDomains.add('automations')
+    dirtyDomains.add('automationRuns')
+  }
+}
+
+function markAutomationDefinitionDomain(owner: AutomationPersistence): void {
+  owner[automationPersistenceContext].runtime.dirtyProfileStateDomains?.add('automations')
+}
+
 export function installAutomationPersistenceContext(
   target: AutomationPersistence,
   source: AutomationPersistence
diff --git a/src/main/persistence/loading-store/backup-recovery-rotation.ts b/src/main/persistence/loading-store/backup-recovery-rotation.ts
deleted file mode 100644
index 7cf0a7a8078..00000000000
--- a/src/main/persistence/loading-store/backup-recovery-rotation.ts
+++ /dev/null
@@ -1,147 +0,0 @@
-import {
-  copyFileSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  statSync,
-  unlinkSync,
-  writeFileSync
-} from 'node:fs'
-import { access, copyFile, rename, rm, stat } from 'node:fs/promises'
-import { dirname } from 'node:path'
-
-const BACKUP_COUNT = 5
-const BACKUP_MIN_INTERVAL_MS = 60 * 60 * 1000
-
-function backupPath(dataFile: string, index: number): string {
-  return `${dataFile}.bak.${index}`
-}
-
-/** existsSync's non-blocking twin: existsSync is an access(F_OK) probe, so access() is the exact analogue. */
-async function exists(path: string): Promise<boolean> {
-  return access(path).then(
-    () => true,
-    () => false
-  )
-}
-
-export function hasStateBackup(dataFile: string): boolean {
-  for (let index = 0; index < BACKUP_COUNT; index += 1) {
-    if (existsSync(backupPath(dataFile, index))) {
-      return true
-    }
-  }
-  return false
-}
-
-import type { StoreRuntimeState } from './store-runtime-state'
-
-type BackupRecoveryRotationOperationsRuntime = Pick<StoreRuntimeState, 'backupRotationInFlight'>
-
-export class BackupRecoveryRotationOperations {
-  constructor(private readonly runtime: BackupRecoveryRotationOperationsRuntime) {}
-
-  shouldRotateBackups(now: number, dataFile: string): boolean {
-    try {
-      const mtime = statSync(backupPath(dataFile, 0)).mtimeMs
-      return now - mtime >= BACKUP_MIN_INTERVAL_MS
-    } catch {
-      return true
-    }
-  }
-
-  async shouldRotateBackupsAsync(dataFile: string): Promise<boolean> {
-    try {
-      const mtime = (await stat(backupPath(dataFile, 0))).mtimeMs
-      return Date.now() - mtime >= BACKUP_MIN_INTERVAL_MS
-    } catch {
-      return true
-    }
-  }
-
-  async rotateBackupsAsync(dataFile: string): Promise<void> {
-    if (this.runtime.backupRotationInFlight) {
-      return
-    }
-    this.runtime.backupRotationInFlight = true
-    try {
-      if (!(await this.shouldRotateBackupsAsync(dataFile))) {
-        return
-      }
-      if (!(await exists(dataFile))) {
-        return
-      }
-      await rm(backupPath(dataFile, BACKUP_COUNT - 1)).catch((err: unknown) => {
-        if (err && (err as NodeJS.ErrnoException).code !== 'ENOENT') {
-          console.error('[persistence] Failed to remove oldest backup:', err)
-        }
-      })
-      for (let i = BACKUP_COUNT - 2; i >= 0; i--) {
-        const src = backupPath(dataFile, i)
-        const dst = backupPath(dataFile, i + 1)
-        // Why probe instead of rename-then-swallow-ENOENT: a degraded mount rejects a rename of an
-        // absent slot with ESTALE/EIO, which would log once per empty slot on every debounced save.
-        if (await exists(src)) {
-          await rename(src, dst).catch((err) => {
-            console.error('[persistence] Failed to rotate backup', src, '->', dst, err)
-          })
-        }
-      }
-      await copyFile(dataFile, backupPath(dataFile, 0)).catch((err) => {
-        console.error('[persistence] Failed to snapshot current file to .bak.0:', err)
-      })
-    } finally {
-      this.runtime.backupRotationInFlight = false
-    }
-  }
-
-  rotateBackupsSync(dataFile: string): void {
-    if (!existsSync(dataFile)) {
-      return
-    }
-    try {
-      unlinkSync(backupPath(dataFile, BACKUP_COUNT - 1))
-    } catch (err) {
-      if (err && (err as NodeJS.ErrnoException).code !== 'ENOENT') {
-        console.error('[persistence] Failed to remove oldest backup:', err)
-      }
-    }
-    for (let i = BACKUP_COUNT - 2; i >= 0; i--) {
-      const src = backupPath(dataFile, i)
-      const dst = backupPath(dataFile, i + 1)
-      if (existsSync(src)) {
-        try {
-          renameSync(src, dst)
-        } catch (err) {
-          console.error('[persistence] Failed to rotate backup', src, '->', dst, err)
-        }
-      }
-    }
-    try {
-      copyFileSync(dataFile, backupPath(dataFile, 0))
-    } catch (err) {
-      console.error('[persistence] Failed to snapshot current file to .bak.0:', err)
-    }
-  }
-
-  restoreFromBackup(dataFile: string): boolean {
-    for (let i = 0; i < BACKUP_COUNT; i++) {
-      const path = backupPath(dataFile, i)
-      if (!existsSync(path)) {
-        continue
-      }
-      try {
-        const raw = readFileSync(path, 'utf-8')
-        JSON.parse(raw)
-        mkdirSync(dirname(dataFile), { recursive: true })
-        writeFileSync(dataFile, raw, 'utf-8')
-        console.warn(`[persistence] Recovered state from backup slot ${i}: ${path}`)
-        return true
-      } catch (err) {
-        console.error(`[persistence] Backup slot ${i} unusable, trying next:`, err)
-      }
-    }
-    return false
-  }
-}
diff --git a/src/main/persistence/loading-store/loaded-state-parsing.ts b/src/main/persistence/loading-store/loaded-state-parsing.ts
index d2a31419a03..b93dc251500 100644
--- a/src/main/persistence/loading-store/loaded-state-parsing.ts
+++ b/src/main/persistence/loading-store/loaded-state-parsing.ts
@@ -1,4 +1,3 @@
-import { readFileSync, existsSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { normalizeProxyUrl } from '../../../shared/network-proxy'
 import { normalizeKagiSessionLink } from '../../../shared/browser-url'
@@ -9,10 +8,7 @@ import { pruneLocalTerminalScrollbackBuffers } from '../../../shared/workspace-s
 import { pruneWorkspaceSessionBrowserHistory } from '../../../shared/workspace-session-browser-history'
 import { clearMissingProjectGroupMemberships } from '../../../shared/project-groups'
 import { migrateWorkspaceSessionTerminalScrollbackSnapshots } from '../../terminal-scrollback-snapshots'
-import {
-  isStartupDiagnosticsEnabled,
-  logStartupDiagnostic
-} from '../../startup/startup-diagnostics'
+import { logStartupMilestone } from '../../startup/startup-diagnostics'
 import {
   PROTECTED_SECRET_SLOT,
   sshPtyOwnerLeaseSecretSlot
@@ -38,28 +34,11 @@ import {
   projectHostSetupCompatibilityStateEqual
 } from '../tracking-repos/project-host-compatibility'
 import { backfillFolderScopeConnectionIds } from '../restoring-sessions/folder-scope-migration'
-import { hasStateBackup } from './backup-recovery-rotation'
 import { prepareLoadedTerminalSettings } from './prepare-loaded-terminal-settings'
 import { prepareLoadedProfileSettings } from './prepare-loaded-profile-settings'
 import { normalizeLoadedProfileState } from './normalize-loaded-profile-state'
 
-type PersistenceStartupDetails = Record<string, unknown> | (() => Record<string, unknown>)
-
-function logPersistenceStartupMilestone(
-  event: string,
-  details: PersistenceStartupDetails = {}
-): void {
-  if (!isStartupDiagnosticsEnabled()) {
-    return
-  }
-  // Why: snapshot `t` before resolving lazy details — otherwise an expensive details closure is billed to the milestone it measures.
-  const t = Math.round(performance.now())
-  const resolvedDetails = typeof details === 'function' ? details() : details
-  logStartupDiagnostic(event, { t, ...resolvedDetails })
-}
-
 import type { StoreRuntimeState } from './store-runtime-state'
-import type { BackupRecoveryRotationOperations } from './backup-recovery-rotation'
 import type { LoadedCohortMigrationOperations } from './loaded-cohort-migrations'
 
 type LoadedStateParsingOperationsRuntime = Pick<
@@ -75,31 +54,57 @@ type LoadedStateParsingOperationsRuntime = Pick<
 export class LoadedStateParsingOperations {
   constructor(
     private readonly runtime: LoadedStateParsingOperationsRuntime,
-    private readonly backups: BackupRecoveryRotationOperations,
     private readonly cohorts: LoadedCohortMigrationOperations
   ) {}
 
-  load(allowBackupRecovery = true): PersistedState {
+  /**
+   * Load the legacy storage representation supplied by a migration/importer.
+   *
+   * This deliberately uses the same decrypt, normalization, migration, and
+   * sidecar handling as a file load. An invalid imported document must fail
+   * closed instead of falling back to an unrelated on-disk backup.
+   */
+  loadSerialized(raw: string): PersistedState {
+    return this.loadInternal(raw)
+  }
+
+  /** Load only from an injected authority; never consult the legacy JSON path. */
+  loadFromAuthority(raw: string | undefined): PersistedState {
+    return this.loadInternal(raw)
+  }
+
+  loadParsedFromAuthority(parsed: Record<string, unknown> | undefined): PersistedState {
+    return this.loadInternal(undefined, parsed)
+  }
+
+  private loadInternal(serialized?: string, parsedInput?: Record<string, unknown>): PersistedState {
     // Capture "has run Orca before?" for telemetry cohort; the telemetry field is new, so field inference misclassifies old users as fresh.
-    const dataFile = this.runtime.dataFile
-    const fileExistedOnLoad = existsSync(dataFile)
-    logPersistenceStartupMilestone('persistence-load-start', {
+    const fileExistedOnLoad = serialized !== undefined || parsedInput !== undefined
+    logStartupMilestone('persistence-load-start', {
       fileExists: fileExistedOnLoad
     })
 
     let result: PersistedState | null = null
+    let parsed: PersistedState | undefined
     try {
       if (fileExistedOnLoad) {
         const readStartedAt = performance.now()
-        const raw = readFileSync(dataFile, 'utf-8')
-        logPersistenceStartupMilestone('persistence-read-done', {
-          bytes: Buffer.byteLength(raw),
-          durationMs: Math.round(performance.now() - readStartedAt)
-        })
-        logPersistenceStartupMilestone('persistence-json-parse-start')
-        const parsed = JSON.parse(raw) as PersistedState
-        logPersistenceStartupMilestone('persistence-json-parse-done')
-
+        const raw = parsedInput === undefined ? serialized : undefined
+        if (raw !== undefined) {
+          logStartupMilestone('persistence-read-done', {
+            bytes: Buffer.byteLength(raw),
+            durationMs: Math.round(performance.now() - readStartedAt)
+          })
+          logStartupMilestone('persistence-json-parse-start')
+          parsed = JSON.parse(raw)
+          logStartupMilestone('persistence-json-parse-done')
+        } else {
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Legacy partial records enter the existing domain normalizers through this loader type.
+          parsed = parsedInput as PersistedState
+        }
+        if (parsed === undefined) {
+          throw new Error('Profile state startup snapshot is missing')
+        }
         // Why: secrets are stored encrypted via safeStorage; decrypt at the load boundary so the app sees plaintext.
         if (parsed.settings?.opencodeSessionCookie) {
           parsed.settings.opencodeSessionCookie = this.runtime.protectedSecrets.decrypt(
@@ -188,18 +193,8 @@ export class LoadedStateParsingOperations {
         })
       }
     } catch (err) {
-      console.error('[persistence] Failed to load primary state, trying backups:', err)
-    }
-
-    // Corrupt-file and no-file paths converge here; a corrupted install counts as existing, so it sees the opt-in banner.
-    if (result === null && allowBackupRecovery) {
-      const hasBackup = hasStateBackup(dataFile)
-      if (fileExistedOnLoad || hasBackup) {
-        if (this.backups.restoreFromBackup(dataFile)) {
-          return this.load(false)
-        }
-        console.error('[persistence] No usable state file or backup found, using defaults')
-      }
+      console.error('[persistence] Failed to load imported profile state:', err)
+      throw new Error('Failed to load imported profile state', { cause: err })
     }
 
     if (result === null) {
@@ -216,7 +211,6 @@ export class LoadedStateParsingOperations {
     if (migratedScrollback.changed) {
       this.runtime.loadNeedsSave = true
     }
-
     const repos = clearMissingProjectGroupMemberships(result.repos, result.projectGroups ?? [])
     const projectHostSetupCompatibility = mergeProjectHostSetupCompatibilityState(result, repos)
     if (!projectHostSetupCompatibilityStateEqual(result, projectHostSetupCompatibility)) {
@@ -293,7 +287,7 @@ export class LoadedStateParsingOperations {
       migrated.githubCache = readGithubCacheSnapshot(this.runtime.dataFile) ?? migrated.githubCache
     }
 
-    logPersistenceStartupMilestone('persistence-load-done', () => ({
+    logStartupMilestone('persistence-load-done', () => ({
       repos: migrated.repos.length,
       workspaceSessionBytes: Buffer.byteLength(JSON.stringify(migrated.workspaceSession))
     }))
diff --git a/src/main/persistence/loading-store/metadata-lineage-operations.ts b/src/main/persistence/loading-store/metadata-lineage-operations.ts
index 2532ff3b2d3..9800b541373 100644
--- a/src/main/persistence/loading-store/metadata-lineage-operations.ts
+++ b/src/main/persistence/loading-store/metadata-lineage-operations.ts
@@ -27,7 +27,8 @@ import {
   getWorktreeMetaForHost as getWorktreeMetaForHostOperation,
   migrateWorktreeMetadataLocator,
   removeWorktreeMetadataForHost,
-  setWorktreeMetaForHost as setWorktreeMetaForHostOperation
+  setWorktreeMetaForHost as setWorktreeMetaForHostOperation,
+  WORKTREE_METADATA_DOMAINS
 } from './worktree-identity-metadata'
 import { mergeWorktreeMetaForWrite } from './worktree-meta-write-normalization'
 import {
@@ -122,7 +123,7 @@ export class MetadataLineageOperations {
     }
     const updated = mergeWorktreeMetaForWrite(stored, meta)
     state.worktreeMeta[worktreeId] = updated
-    scheduleSave(this[metadataLineageOperationsContext].scheduling)
+    scheduleSave(this[metadataLineageOperationsContext].scheduling, ['worktreeMeta'])
     return updated
   }
 
@@ -269,7 +270,11 @@ export class MetadataLineageOperations {
       mover
     )
     if (legacyChanged || canonicalChanged) {
-      scheduleSave(this[metadataLineageOperationsContext].scheduling)
+      // Legacy identity moves also re-key sessions, lineage, mobile selections, and UI state.
+      scheduleSave(
+        this[metadataLineageOperationsContext].scheduling,
+        legacyChanged ? undefined : WORKTREE_METADATA_DOMAINS
+      )
     }
   }
 
diff --git a/src/main/persistence/loading-store/normalize-loaded-explorer-root-migration.test.ts b/src/main/persistence/loading-store/normalize-loaded-explorer-root-migration.test.ts
new file mode 100644
index 00000000000..3ec0020ad15
--- /dev/null
+++ b/src/main/persistence/loading-store/normalize-loaded-explorer-root-migration.test.ts
@@ -0,0 +1,45 @@
+import { homedir } from 'node:os'
+import { expect, it, vi } from 'vitest'
+import { getDefaultPersistedState } from '../../../shared/constants'
+import type { PersistedState } from '../../../shared/persisted-state-types'
+import { normalizeLoadedUiState } from './normalize-loaded-ui-state'
+
+it.each([undefined, false, null, 1, 'true', {}, true])(
+  'persists the root migration unless the raw marker is boolean true (%j)',
+  (marker) => {
+    const defaults = getDefaultPersistedState(homedir())
+    const onboarding = defaults.onboarding!
+    const normalizedUI = normalizeLoadedUiState(
+      defaults,
+      defaults,
+      onboarding,
+      false,
+      false,
+      vi.fn()
+    )
+    const parsed: PersistedState = JSON.parse(
+      JSON.stringify({
+        ...defaults,
+        ui: { ...normalizedUI, _explorerDisplayRootMigrated: marker },
+        worktreeMeta: { existing: { sparseDirectories: ['src'] } }
+      })
+    )
+    const markNeedsSave = vi.fn()
+    const ui = normalizeLoadedUiState(parsed, defaults, onboarding, false, false, markNeedsSave)
+    expect(ui._explorerDisplayRootMigrated).toBe(true)
+    expect(ui.explorerDisplayRootByWorktree).toEqual(marker === true ? {} : { existing: '/' })
+    expect(markNeedsSave).toHaveBeenCalledTimes(marker === true ? 0 : 1)
+
+    markNeedsSave.mockClear()
+    const reloaded = normalizeLoadedUiState(
+      { ...parsed, ui },
+      defaults,
+      onboarding,
+      false,
+      false,
+      markNeedsSave
+    )
+    expect(reloaded.explorerDisplayRootByWorktree).toEqual(ui.explorerDisplayRootByWorktree)
+    expect(markNeedsSave).not.toHaveBeenCalled()
+  }
+)
diff --git a/src/main/persistence/loading-store/normalize-loaded-ui-state.ts b/src/main/persistence/loading-store/normalize-loaded-ui-state.ts
index d26f4e68430..4b208a6fa72 100644
--- a/src/main/persistence/loading-store/normalize-loaded-ui-state.ts
+++ b/src/main/persistence/loading-store/normalize-loaded-ui-state.ts
@@ -1,3 +1,4 @@
+import { migrateExplorerDisplayRoots } from '../../../shared/file-explorer-display-root'
 import {
   getWorktreeCardModeProperties,
   isDefaultedCompactWorktreeCardProperties,
@@ -20,6 +21,7 @@ import {
 import type { PersistedState } from '../../../shared/persisted-state-types'
 import type { OnboardingState } from '../../../shared/onboarding-state-types'
 
+/** Normalizes legacy UI payloads and marks one-time migrations for saving without replacing explicit user choices. */
 export function normalizeLoadedUiState(
   parsed: PersistedState,
   defaults: PersistedState,
@@ -28,6 +30,14 @@ export function normalizeLoadedUiState(
   osc52ClipboardNoticePending: boolean,
   markNeedsSave: () => void
 ): PersistedState['ui'] {
+  const explorerDisplayRootByWorktree = migrateExplorerDisplayRoots(
+    parsed.ui?.explorerDisplayRootByWorktree,
+    parsed.ui?._explorerDisplayRootMigrated === true,
+    parsed.worktreeMeta ?? {}
+  )
+  if (parsed.ui?._explorerDisplayRootMigrated !== true) {
+    markNeedsSave()
+  }
   const rawSort = parsed.ui?.sortBy
   const sort = normalizeSortBy(rawSort)
   const migrate = !parsed.ui?._sortBySmartMigrated && rawSort === 'recent'
@@ -189,6 +199,8 @@ export function normalizeLoadedUiState(
     // window exists, and it must survive a crash before the user ever sees the notice.
     osc52ClipboardDefaultOnNoticePending: osc52ClipboardNoticePending,
     sortBy: migrate ? ('smart' as const) : sort,
+    _explorerDisplayRootMigrated: true,
+    explorerDisplayRootByWorktree,
     showDotfilesByWorktree: normalizeShowDotfilesByWorktree(parsed.ui?.showDotfilesByWorktree),
     workspaceStatuses,
     _workspaceStatusesDefaultOrderMigrated: true,
diff --git a/src/main/persistence/loading-store/persisted-state-redundancy.test.ts b/src/main/persistence/loading-store/persisted-state-redundancy.test.ts
index 9a30b26da38..8b9414f4fb8 100644
--- a/src/main/persistence/loading-store/persisted-state-redundancy.test.ts
+++ b/src/main/persistence/loading-store/persisted-state-redundancy.test.ts
@@ -1,3 +1,8 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson
+} from '../../persistence-test-harness'
 /**
  * The store file re-serializes in full on a 1s debounce and re-parses in full at launch, so every
  * byte it carries is paid for on both. Two kinds of byte were provably redundant on a 4.2 MB real
@@ -8,7 +13,7 @@
  * rows, 200 browser history entries) and pin the only property that makes the omission safe: a file
  * written by the OLD serializer and a file written by the NEW one load to the same in-memory state.
  */
-import { mkdtempSync, readFileSync, realpathSync, writeFileSync } from 'node:fs'
+import { mkdtempSync, realpathSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -48,15 +53,16 @@ const LINKED_ROW_STRIDE = 40
 const RECENTLY = Date.now()
 
 const stores: InstanceType<typeof Store>[] = []
-afterEach(() => {
+afterEach(async () => {
   for (const store of stores.splice(0)) {
     store.freezeWrites()
   }
+  await closeTestStores()
   vi.restoreAllMocks()
 })
 
 function openStore(dataFile: string): InstanceType<typeof Store> {
-  const store = new Store({ dataFile })
+  const store = createSqliteTestStore(Store, { dataFile })
   stores.push(store)
   return store
 }
@@ -191,7 +197,7 @@ describe('persisted-state redundancy', () => {
     }
 
     loaded.flush()
-    const rewritten = readFileSync(dataFile, 'utf-8')
+    const rewritten = readPersistedStateJson(dataFile)
 
     // Only rows that actually hold a value still carry a slot: linkedPR + isPinned, 1 row in 40.
     expect(defaultedSlotOccurrences(rewritten)).toBe(
@@ -220,7 +226,7 @@ describe('persisted-state redundancy', () => {
 
     // A quiet app does not rewrite the file with new content on the next flush.
     reloaded.flush()
-    expect(readFileSync(dataFile, 'utf-8')).toBe(rewritten)
+    expect(readPersistedStateJson(dataFile)).toBe(rewritten)
   })
 
   it('loads an old-serializer file and a new-serializer file to the same state', () => {
@@ -231,7 +237,7 @@ describe('persisted-state redundancy', () => {
     fromLegacy.flush()
 
     const compactFile = tempDataFile()
-    writeFileSync(compactFile, readFileSync(legacyFile))
+    writeFileSync(compactFile, readPersistedStateJson(legacyFile))
     const fromCompact = openStore(compactFile)
 
     expect(fromCompact.getAllWorktreeMeta()).toEqual(fromLegacy.getAllWorktreeMeta())
diff --git a/src/main/persistence/loading-store/primary-state-write-context.ts b/src/main/persistence/loading-store/primary-state-write-context.ts
new file mode 100644
index 00000000000..bd7fbc737cb
--- /dev/null
+++ b/src/main/persistence/loading-store/primary-state-write-context.ts
@@ -0,0 +1,15 @@
+import type { PrimaryStateWriteOperationsRuntime } from './primary-state-write-runtime'
+import type { StateSerializationSecretHandlingOperations } from './state-serialization-secret-handling'
+
+export type PrimaryStateWriteOperationsContext = {
+  runtime: PrimaryStateWriteOperationsRuntime
+  serialization: StateSerializationSecretHandlingOperations
+  queuedSnapshot?: {
+    completion: Promise<void>
+    capture: {
+      skipIfClean: boolean
+      fullCheckpoint: boolean
+      pendingSnapshotFileWork: Promise<void> | null
+    }
+  }
+}
diff --git a/src/main/persistence/loading-store/primary-state-write-runtime.ts b/src/main/persistence/loading-store/primary-state-write-runtime.ts
new file mode 100644
index 00000000000..b538831a995
--- /dev/null
+++ b/src/main/persistence/loading-store/primary-state-write-runtime.ts
@@ -0,0 +1,66 @@
+import type { StoreRuntimeState } from './store-runtime-state'
+
+export type PrimaryStateWriteOperationsRuntime = Pick<
+  StoreRuntimeState,
+  | 'activeViewPreference'
+  | 'dataFile'
+  | 'dirtyProfileStateDomains'
+  | 'durableMutationPhase'
+  | 'fatalMutationError'
+  | 'flushOrThrow'
+  | 'runDurableMutation'
+  | 'firstPendingSaveAt'
+  | 'lastDurableWriteGeneration'
+  | 'lastWrittenStateHash'
+  | 'pendingSnapshotFileWork'
+  | 'pendingAutomationRunsAfter'
+  | 'pendingWrite'
+  | 'profileMaintenancePending'
+  | 'profileStateAuthority'
+  | 'protectedSecrets'
+  | 'quitFlushStarted'
+  | 'state'
+  | 'writeGeneration'
+  | 'writeTimer'
+  | 'writesFrozen'
+>
+
+export function markPrimaryStateWriteDurable(
+  runtime: Pick<StoreRuntimeState, 'lastDurableWriteGeneration'>,
+  generation: number
+): void {
+  runtime.lastDurableWriteGeneration = Math.max(runtime.lastDurableWriteGeneration, generation)
+}
+
+export function canReuseDurableProfileState(
+  runtime: Pick<StoreRuntimeState, 'lastWrittenStateHash' | 'profileStateAuthority'>,
+  stateHash: string
+): boolean {
+  if (stateHash !== runtime.lastWrittenStateHash) {
+    return false
+  }
+  const authority = runtime.profileStateAuthority
+  if (authority?.asynchronous) {
+    throw new Error('Live profile persistence requires an awaited revision check')
+  }
+  if (authority && !authority.assertCurrentRevision) {
+    return false
+  }
+  authority?.assertCurrentRevision?.()
+  return true
+}
+
+export async function stopAfterFailedPrimaryStateMutation(
+  runtime: PrimaryStateWriteOperationsRuntime,
+  error: unknown
+): Promise<void> {
+  // A throwing callback never returns its rollback; do not persist a partial edit.
+  runtime.writesFrozen = true
+  runtime.quitFlushStarted = true
+  runtime.fatalMutationError = error instanceof Error ? error : new Error(String(error))
+  if (runtime.writeTimer) {
+    clearTimeout(runtime.writeTimer)
+    runtime.writeTimer = null
+  }
+  await runtime.profileStateAuthority?.close?.()
+}
diff --git a/src/main/persistence/loading-store/primary-state-write-sync.ts b/src/main/persistence/loading-store/primary-state-write-sync.ts
new file mode 100644
index 00000000000..c1e8480063d
--- /dev/null
+++ b/src/main/persistence/loading-store/primary-state-write-sync.ts
@@ -0,0 +1,80 @@
+import { writeSelectiveProfileState } from './profile-state-selective-write'
+import type { PrimaryStateWriteOperationsContext } from './primary-state-write-context'
+import {
+  canReuseDurableProfileState,
+  markPrimaryStateWriteDurable
+} from './primary-state-write-runtime'
+
+export function writeToDiskSync(
+  context: PrimaryStateWriteOperationsContext,
+  opts: { expectedGeneration?: number } = {}
+): boolean {
+  const { runtime, serialization } = context
+  if (runtime.fatalMutationError) {
+    throw runtime.fatalMutationError
+  }
+  if (runtime.writesFrozen) {
+    return false
+  }
+  const authority = runtime.profileStateAuthority
+  if (!authority) {
+    throw new Error('Writable Store construction requires a SQLite profile-state authority')
+  }
+  if (authority.asynchronous) {
+    throw new Error('Live profile persistence requires an awaited flush')
+  }
+  const isCurrent =
+    opts.expectedGeneration === undefined
+      ? undefined
+      : () => runtime.writeGeneration === opts.expectedGeneration
+  const selective = writeSelectiveProfileState(
+    authority,
+    serialization,
+    runtime.dirtyProfileStateDomains,
+    runtime.pendingAutomationRunsAfter,
+    isCurrent
+  )
+  if (selective.handled) {
+    if (selective.aborted) {
+      return false
+    }
+    if (selective.consumedAutomationRuns) {
+      runtime.pendingAutomationRunsAfter = undefined
+    }
+    runtime.lastWrittenStateHash = null
+    runtime.protectedSecrets.commitRetentionUpdates(selective.protectedSecretUpdates)
+    markPrimaryStateWriteDurable(runtime, opts.expectedGeneration ?? runtime.writeGeneration)
+    authority.scheduleBackup?.()
+    return true
+  }
+  const built = serialization.buildStateToSave(
+    authority.writeCompleteSerializedDomains !== undefined
+  )
+  const { stateHash, protectedSecretUpdates } = built
+  if (isCurrent && !isCurrent()) {
+    return false
+  }
+  // The authority fences the revision even when the complete state is unchanged.
+  if (canReuseDurableProfileState(runtime, stateHash)) {
+    runtime.dirtyProfileStateDomains = new Set()
+    runtime.pendingAutomationRunsAfter = undefined
+    markPrimaryStateWriteDurable(runtime, opts.expectedGeneration ?? runtime.writeGeneration)
+    return true
+  }
+  if (built.domains && authority.writeCompleteSerializedDomains) {
+    authority.writeCompleteSerializedDomains(built.domains)
+  } else {
+    authority.writeSerializedState(built.payload)
+  }
+  runtime.dirtyProfileStateDomains = new Set()
+  runtime.pendingAutomationRunsAfter = undefined
+  if (!isCurrent || isCurrent()) {
+    runtime.lastWrittenStateHash = stateHash
+    runtime.protectedSecrets.commitRetentionUpdates(protectedSecretUpdates)
+  } else {
+    runtime.lastWrittenStateHash = null
+  }
+  markPrimaryStateWriteDurable(runtime, opts.expectedGeneration ?? runtime.writeGeneration)
+  authority.scheduleBackup?.()
+  return true
+}
diff --git a/src/main/persistence/loading-store/primary-state-write-worker.ts b/src/main/persistence/loading-store/primary-state-write-worker.ts
new file mode 100644
index 00000000000..71862bc3b44
--- /dev/null
+++ b/src/main/persistence/loading-store/primary-state-write-worker.ts
@@ -0,0 +1,106 @@
+import type { AsyncProfileStateAuthority } from './profile-state-authority'
+import type { PrimaryStateWriteOperationsContext } from './primary-state-write-context'
+import { markPrimaryStateWriteDurable } from './primary-state-write-runtime'
+import { prepareSelectiveProfileStateWrite } from './profile-state-selective-write'
+
+/** The queued operation owns its captured intent; later edits belong to the next write. */
+export async function writeProfileStateInWorker(
+  { runtime, serialization }: PrimaryStateWriteOperationsContext,
+  authority: AsyncProfileStateAuthority
+): Promise<boolean> {
+  authority.assertWritable()
+  const generation = runtime.writeGeneration
+  const dirtyDomains = runtime.dirtyProfileStateDomains
+  const automationRuns = runtime.pendingAutomationRunsAfter
+  runtime.dirtyProfileStateDomains = new Set()
+  runtime.pendingAutomationRunsAfter = undefined
+
+  const restoreIntent = (): void => {
+    if (dirtyDomains === null) {
+      runtime.dirtyProfileStateDomains = null
+    } else if (runtime.dirtyProfileStateDomains !== null) {
+      for (const domain of dirtyDomains) {
+        runtime.dirtyProfileStateDomains.add(domain)
+      }
+    }
+    runtime.pendingAutomationRunsAfter ??= automationRuns
+  }
+
+  try {
+    const prepared = beginWrite(
+      authority,
+      serialization,
+      dirtyDomains,
+      automationRuns,
+      runtime.lastWrittenStateHash,
+      () => runtime.writeGeneration === generation
+    )
+    if (!prepared) {
+      restoreIntent()
+      return false
+    }
+    await prepared.completion
+    runtime.protectedSecrets.commitRetentionUpdates(prepared.protectedSecretUpdates)
+    runtime.lastWrittenStateHash =
+      runtime.writeGeneration === generation ? prepared.stateHash : null
+    markPrimaryStateWriteDurable(runtime, generation)
+    if (runtime.writeGeneration === generation) {
+      if (runtime.writeTimer) {
+        clearTimeout(runtime.writeTimer)
+        runtime.writeTimer = null
+      }
+      runtime.firstPendingSaveAt = null
+    }
+  } catch (error) {
+    restoreIntent()
+    throw error
+  }
+  try {
+    authority.scheduleBackup?.()
+  } catch (error) {
+    console.error('[persistence] Failed to schedule profile state backup:', error)
+  }
+  return true
+}
+
+/** Release copied payloads before the acknowledgement; retain only commit bookkeeping. */
+function beginWrite(
+  authority: AsyncProfileStateAuthority,
+  serialization: PrimaryStateWriteOperationsContext['serialization'],
+  dirtyDomains: ReadonlySet<string> | null,
+  automationRuns: PrimaryStateWriteOperationsContext['runtime']['pendingAutomationRunsAfter'],
+  lastWrittenStateHash: string | null,
+  isCurrent: () => boolean
+) {
+  const selective = prepareSelectiveProfileStateWrite(
+    authority,
+    serialization,
+    dirtyDomains,
+    automationRuns
+  )
+  if (selective) {
+    if (!isCurrent()) {
+      return undefined
+    }
+    const completion =
+      selective.automationRuns !== undefined
+        ? authority.writeSerializedAutomationRuns(selective.replacements, selective.automationRuns)
+        : authority.writeSerializedDomains(selective.replacements)
+    return { completion, stateHash: null, protectedSecretUpdates: selective.protectedSecretUpdates }
+  }
+  const complete = serialization.buildStateToSave(true)
+  if (!isCurrent()) {
+    return undefined
+  }
+  const unchanged = complete.stateHash === lastWrittenStateHash
+  const completion = unchanged
+    ? authority.assertCurrentRevision()
+    : complete.domains
+      ? authority.writeCompleteSerializedDomains(complete.domains)
+      : authority.writeSerializedState(complete.payload)
+  return {
+    completion,
+    stateHash: complete.stateHash,
+    protectedSecretUpdates: unchanged ? [] : complete.protectedSecretUpdates
+  }
+}
diff --git a/src/main/persistence/loading-store/primary-state-writes.ts b/src/main/persistence/loading-store/primary-state-writes.ts
index 3820723fffb..014cda30958 100644
--- a/src/main/persistence/loading-store/primary-state-writes.ts
+++ b/src/main/persistence/loading-store/primary-state-writes.ts
@@ -1,282 +1,246 @@
-import { mkdirSync, existsSync, unlinkSync } from 'node:fs'
-import { mkdir, open, rm } from 'node:fs/promises'
-import { durableWriteTempPath, renameDurable, writeFileDurableSync } from '../../durable-file-write'
-import { dirname } from 'node:path'
+import { waitForPromiseWithSignal } from '../../../shared/abort-signal-reason'
 import {
   parseCodexResetCreditAttemptLedger,
   type CodexResetCreditAttemptLedger
 } from '../../../shared/codex-reset-credit-attempt-ledger'
-
-import type { StoreRuntimeState } from './store-runtime-state'
+import {
+  stopAfterFailedPrimaryStateMutation,
+  type PrimaryStateWriteOperationsRuntime
+} from './primary-state-write-runtime'
 import type { StateSerializationSecretHandlingOperations } from './state-serialization-secret-handling'
-import type { BackupRecoveryRotationOperations } from './backup-recovery-rotation'
-
-type PrimaryStateWriteOperationsRuntime = Pick<
-  StoreRuntimeState,
-  | 'activeViewPreference'
-  | 'backupRotationInFlight'
-  | 'dataFile'
-  | 'flushOrThrow'
-  | 'firstPendingSaveAt'
-  | 'inFlightAsyncTmpFile'
-  | 'lastDurableWriteGeneration'
-  | 'lastWrittenStateHash'
-  | 'pendingSnapshotFileWork'
-  | 'pendingWrite'
-  | 'protectedSecrets'
-  | 'quitFlushStarted'
-  | 'staleTempCleanup'
-  | 'state'
-  | 'writeGeneration'
-  | 'writeTimer'
-  | 'writesFrozen'
->
+import type { PrimaryStateWriteOperationsContext } from './primary-state-write-context'
+import { writeToDiskSync } from './primary-state-write-sync'
+import { writeProfileStateInWorker } from './primary-state-write-worker'
+import type { DurableProfileStateMutation } from './store-runtime-state'
+import { profileStateWriterFailureOutcome } from '../profile-state/profile-state-writer-errors'
 
 const primaryStateWriteOperationsContext = Symbol('PrimaryStateWriteOperations')
-type PrimaryStateWriteOperationsContext = {
-  runtime: PrimaryStateWriteOperationsRuntime
-  serialization: StateSerializationSecretHandlingOperations
-  backups: BackupRecoveryRotationOperations
-}
-
 export class PrimaryStateWriteOperations {
   readonly [primaryStateWriteOperationsContext]: PrimaryStateWriteOperationsContext
 
   constructor(
     runtime: PrimaryStateWriteOperationsRuntime,
-    serialization: StateSerializationSecretHandlingOperations,
-    backups: BackupRecoveryRotationOperations
+    serialization: StateSerializationSecretHandlingOperations
   ) {
-    this[primaryStateWriteOperationsContext] = { runtime, serialization, backups }
+    this[primaryStateWriteOperationsContext] = { runtime, serialization }
   }
 
   flushOrThrow(): void {
-    if (this[primaryStateWriteOperationsContext].runtime.quitFlushStarted) {
+    const context = this[primaryStateWriteOperationsContext]
+    const { runtime } = context
+    if (runtime.quitFlushStarted || runtime.profileMaintenancePending) {
       throw new Error('Cannot synchronously flush after final persistence has started')
     }
-    if (this[primaryStateWriteOperationsContext].runtime.writeTimer) {
-      clearTimeout(this[primaryStateWriteOperationsContext].runtime.writeTimer)
-      this[primaryStateWriteOperationsContext].runtime.writeTimer = null
+    if (runtime.profileStateAuthority?.asynchronous) {
+      throw new Error('Live profile persistence requires an awaited flush')
     }
-    this[primaryStateWriteOperationsContext].runtime.firstPendingSaveAt = null
-    const asyncWriteWasInFlight =
-      this[primaryStateWriteOperationsContext].runtime.pendingWrite !== null
-    // Why: bump writeGeneration so an in-flight async write skips its rename and can't overwrite this sync write.
-    this[primaryStateWriteOperationsContext].runtime.writeGeneration++
-    if (this[primaryStateWriteOperationsContext].runtime.inFlightAsyncTmpFile) {
-      try {
-        unlinkSync(this[primaryStateWriteOperationsContext].runtime.inFlightAsyncTmpFile)
-        this[primaryStateWriteOperationsContext].runtime.inFlightAsyncTmpFile = null
-      } catch (error) {
-        if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
-          void enqueueWrite(this).catch(() => {})
-          throw error
-        }
-      }
+    if (runtime.writeTimer) {
+      clearTimeout(runtime.writeTimer)
+      runtime.writeTimer = null
     }
-    // Why: later async flushes must remain serialized behind the invalidated writer.
-    writeToDiskSync(this, {
-      force: asyncWriteWasInFlight,
-      skipBackupRotation: this[primaryStateWriteOperationsContext].runtime.backupRotationInFlight
-    })
+    runtime.firstPendingSaveAt = null
+    runtime.writeGeneration++
+    writeToDiskSync(context)
   }
 
   flushActiveViewPreferenceOrThrow(): void {
+    if (this[primaryStateWriteOperationsContext].runtime.profileMaintenancePending) {
+      throw new Error('Cannot flush active-view persistence during profile maintenance')
+    }
     this[primaryStateWriteOperationsContext].runtime.activeViewPreference.flushOrThrow()
   }
 
+  /** Expected refusals return persist: false; thrown callbacks stop saving to protect partial state. */
+  runDurableMutation<T>(mutate: () => DurableProfileStateMutation<T>): Promise<T> {
+    const { runtime } = this[primaryStateWriteOperationsContext]
+    if (runtime.writesFrozen || runtime.quitFlushStarted || runtime.profileMaintenancePending) {
+      return Promise.reject(new Error('Cannot mutate finalized profile persistence'))
+    }
+    return enqueuePrimaryStateOperation(this, async () => {
+      if (runtime.profileStateAuthority?.asynchronous) {
+        runtime.profileStateAuthority.assertWritable()
+      }
+      let mutation: DurableProfileStateMutation<T>
+      try {
+        mutation = this.runAdmittedMutationCallback('mutate', mutate)
+      } catch (error) {
+        await stopAfterFailedPrimaryStateMutation(runtime, error)
+        throw error
+      }
+      if (
+        mutation.persist === false ||
+        (mutation.persist === 'if-dirty' &&
+          runtime.lastDurableWriteGeneration >= runtime.writeGeneration)
+      ) {
+        return mutation.value
+      }
+      runtime.writeGeneration++
+      const requiredGeneration = runtime.writeGeneration
+      try {
+        const captured = runtime.profileStateAuthority?.asynchronous
+          ? await writeToDiskAsync(this)
+          : writeToDiskSync(this[primaryStateWriteOperationsContext], {
+              expectedGeneration: requiredGeneration
+            })
+        if (!captured || runtime.lastDurableWriteGeneration < requiredGeneration) {
+          throw new Error('Profile mutation changed while preparing its durable snapshot')
+        }
+      } catch (error) {
+        if (profileStateWriterFailureOutcome(error) !== 'indeterminate') {
+          if (mutation.rollback) {
+            try {
+              this.runAdmittedMutationCallback('rollback', mutation.rollback)
+            } catch (rollbackError) {
+              await stopAfterFailedPrimaryStateMutation(runtime, rollbackError)
+              throw rollbackError
+            }
+          }
+        }
+        throw error
+      }
+      return mutation.value
+    })
+  }
+
+  private runAdmittedMutationCallback<T>(phase: 'mutate' | 'rollback', callback: () => T): T {
+    const { runtime } = this[primaryStateWriteOperationsContext]
+    // Finalization drains admitted mutations; the disk wait must not admit new snapshots.
+    runtime.durableMutationPhase = phase
+    try {
+      return callback()
+    } finally {
+      runtime.durableMutationPhase = null
+    }
+  }
+
   getCodexResetCreditAttemptLedger(): CodexResetCreditAttemptLedger {
     return parseCodexResetCreditAttemptLedger(
       this[primaryStateWriteOperationsContext].runtime.state.codexResetCreditAttemptLedger
     )
   }
 
-  replaceCodexResetCreditAttemptLedgerAndFlush(ledger: CodexResetCreditAttemptLedger): void {
-    if (this[primaryStateWriteOperationsContext].runtime.writesFrozen) {
-      throw new Error('Cannot persist Codex reset-credit attempts while writes are frozen')
-    }
+  replaceCodexResetCreditAttemptLedgerAndFlush(
+    ledger: CodexResetCreditAttemptLedger
+  ): Promise<void> {
+    const { runtime } = this[primaryStateWriteOperationsContext]
     const next = parseCodexResetCreditAttemptLedger(ledger)
-    const previous = this[primaryStateWriteOperationsContext].runtime.state
-      .codexResetCreditAttemptLedger
-      ? structuredClone(
-          this[primaryStateWriteOperationsContext].runtime.state.codexResetCreditAttemptLedger
-        )
-      : undefined
-    this[primaryStateWriteOperationsContext].runtime.state.codexResetCreditAttemptLedger = next
-    try {
-      this[primaryStateWriteOperationsContext].runtime.flushOrThrow()
-    } catch (error) {
-      // Why: callers use a successful return as the durability barrier before
-      // handing a scarce-credit mutation to the provider.
-      this[primaryStateWriteOperationsContext].runtime.state.codexResetCreditAttemptLedger =
-        previous
-      throw error
-    }
+    return this.runDurableMutation(() => {
+      const previous = runtime.state.codexResetCreditAttemptLedger
+      runtime.state.codexResetCreditAttemptLedger = next
+      runtime.dirtyProfileStateDomains?.add('codexResetCreditAttemptLedger')
+      return {
+        value: undefined,
+        rollback: () => {
+          if (runtime.state.codexResetCreditAttemptLedger === next) {
+            runtime.state.codexResetCreditAttemptLedger = previous
+          }
+        }
+      }
+    })
   }
 }
 
-export function enqueueWrite(owner: PrimaryStateWriteOperations): Promise<void> {
+export function enqueueWrite(
+  owner: PrimaryStateWriteOperations,
+  options: { fullCheckpoint?: boolean; skipIfClean?: boolean; signal?: AbortSignal } = {}
+): Promise<void> {
+  const context = owner[primaryStateWriteOperationsContext]
+  const { runtime } = context
+  const batchable =
+    runtime.profileStateAuthority?.asynchronous && !options.fullCheckpoint && !options.signal
+  const queued = context.queuedSnapshot
+  if (batchable && queued) {
+    queued.capture.skipIfClean &&= options.skipIfClean === true
+    // Merged explicit flushes must retain the full capture that covered untracked getter edits.
+    queued.capture.fullCheckpoint ||= !queued.capture.skipIfClean
+    queued.capture.pendingSnapshotFileWork = runtime.pendingSnapshotFileWork
+    return queued.completion
+  }
+  const capture = {
+    skipIfClean: options.skipIfClean === true,
+    fullCheckpoint: options.fullCheckpoint === true,
+    pendingSnapshotFileWork: runtime.pendingSnapshotFileWork
+  }
+  const completion = enqueuePrimaryStateOperation(owner, async () => {
+    // Later flushes must capture edits made after this batch starts, even without a new generation.
+    if (context.queuedSnapshot?.capture === capture) {
+      context.queuedSnapshot = undefined
+    }
+    if (batchable) {
+      await capture.pendingSnapshotFileWork
+    }
+    const { signal } = options
+    if (signal?.aborted) {
+      throw new Error('Persistence flush aborted')
+    }
+    if (
+      capture.skipIfClean &&
+      runtime.dirtyProfileStateDomains?.size === 0 &&
+      runtime.pendingAutomationRunsAfter === undefined &&
+      runtime.lastDurableWriteGeneration >= runtime.writeGeneration
+    ) {
+      return
+    }
+    // A queued predecessor can clear dirty domains before this checkpoint runs.
+    if (capture.fullCheckpoint) {
+      runtime.dirtyProfileStateDomains = null
+    }
+    await writeToDiskAsync(owner)
+  })
+  if (batchable) {
+    context.queuedSnapshot = { completion, capture }
+  }
+  // A caller may stop waiting; the admitted write must retain its acknowledgement and ordering.
+  return waitForPromiseWithSignal(completion, options.signal)
+}
+
+export function enqueuePrimaryStateOperation<T>(
+  owner: PrimaryStateWriteOperations,
+  operation: () => Promise<T>
+): Promise<T> {
+  const context = owner[primaryStateWriteOperationsContext]
+  const { runtime } = context
+  // A durable mutation, export, or independent checkpoint separates adjacent snapshot batches.
+  context.queuedSnapshot = undefined
   const previousWrite = Promise.all([
-    owner[primaryStateWriteOperationsContext].runtime.pendingWrite ??
-      owner[primaryStateWriteOperationsContext].runtime.staleTempCleanup,
-    owner[primaryStateWriteOperationsContext].runtime.pendingSnapshotFileWork ?? Promise.resolve()
+    runtime.pendingWrite,
+    runtime.pendingSnapshotFileWork ?? Promise.resolve()
   ]).then(() => {})
-  const write = previousWrite.then(() => writeToDiskAsync(owner))
+  const write = previousWrite.then(operation).finally(() => {
+    if (context.queuedSnapshot?.completion === write) {
+      context.queuedSnapshot = undefined
+    }
+  })
   const trackedWrite = write
+    .then(() => {})
     .catch((err) => {
       console.error('[persistence] Failed to write state:', err)
     })
     .finally(() => {
-      if (owner[primaryStateWriteOperationsContext].runtime.pendingWrite === trackedWrite) {
-        owner[primaryStateWriteOperationsContext].runtime.pendingWrite = null
+      if (runtime.pendingWrite === trackedWrite) {
+        runtime.pendingWrite = null
       }
     })
-  owner[primaryStateWriteOperationsContext].runtime.pendingWrite = trackedWrite
+  runtime.pendingWrite = trackedWrite
   return write
 }
 
-export async function writeToDiskAsync(owner: PrimaryStateWriteOperations): Promise<void> {
-  if (owner[primaryStateWriteOperationsContext].runtime.writesFrozen) {
-    return
+export async function writeToDiskAsync(owner: PrimaryStateWriteOperations): Promise<boolean> {
+  const { runtime } = owner[primaryStateWriteOperationsContext]
+  if (runtime.fatalMutationError) {
+    throw runtime.fatalMutationError
   }
-  const gen = owner[primaryStateWriteOperationsContext].runtime.writeGeneration
-  const { payload, stateHash, protectedSecretUpdates } =
-    owner[primaryStateWriteOperationsContext].serialization.buildStateToSave()
-  // Why: don't rewrite a byte-identical multi-MB file when state nets out to already-persisted.
-  if (stateHash === owner[primaryStateWriteOperationsContext].runtime.lastWrittenStateHash) {
-    owner[primaryStateWriteOperationsContext].runtime.lastDurableWriteGeneration = Math.max(
-      owner[primaryStateWriteOperationsContext].runtime.lastDurableWriteGeneration,
-      gen
+  if (runtime.writesFrozen) {
+    return false
+  }
+  const gen = runtime.writeGeneration
+  if (runtime.profileStateAuthority?.asynchronous) {
+    return writeProfileStateInWorker(
+      owner[primaryStateWriteOperationsContext],
+      runtime.profileStateAuthority
     )
-    return
-  }
-  const dataFile = owner[primaryStateWriteOperationsContext].runtime.dataFile
-  const dir = dirname(dataFile)
-  await mkdir(dir, { recursive: true }).catch(() => {})
-  const tmpFile = durableWriteTempPath(dataFile)
-
-  // Why: on any write/rename failure, remove the tmp file so it doesn't leave a multi-MB orphan.
-  let renamed = false
-  try {
-    // Why: fsync before rename, then fsync the directory; see writeFileDurable.
-    const handle = await open(tmpFile, 'w')
-    try {
-      // Already UTF-8 bytes: passing the string here would re-encode the whole state on the main thread.
-      await handle.writeFile(payload)
-      await handle.sync()
-    } finally {
-      await handle.close()
-    }
-    // Why: if flush() bumped writeGeneration mid-write, it already wrote fresher state; don't overwrite it.
-    if (owner[primaryStateWriteOperationsContext].runtime.writeGeneration !== gen) {
-      return
-    }
-    owner[primaryStateWriteOperationsContext].runtime.inFlightAsyncTmpFile = tmpFile
-    try {
-      await renameDurable(tmpFile, dataFile)
-      renamed = true
-    } catch (error) {
-      if (
-        (error as NodeJS.ErrnoException).code !== 'ENOENT' ||
-        owner[primaryStateWriteOperationsContext].runtime.writeGeneration === gen
-      ) {
-        throw error
-      }
-    } finally {
-      if (owner[primaryStateWriteOperationsContext].runtime.inFlightAsyncTmpFile === tmpFile) {
-        owner[primaryStateWriteOperationsContext].runtime.inFlightAsyncTmpFile = null
-      }
-    }
-    // Why re-check gen: a mutation or sync flush during rename makes the installed hash ambiguous; invalidate the no-op guard.
-    if (renamed && owner[primaryStateWriteOperationsContext].runtime.writeGeneration === gen) {
-      owner[primaryStateWriteOperationsContext].runtime.lastWrittenStateHash = stateHash
-      owner[primaryStateWriteOperationsContext].runtime.protectedSecrets.commitRetentionUpdates(
-        protectedSecretUpdates
-      )
-    } else if (renamed) {
-      owner[primaryStateWriteOperationsContext].runtime.lastWrittenStateHash = null
-    }
-    if (renamed) {
-      owner[primaryStateWriteOperationsContext].runtime.lastDurableWriteGeneration = Math.max(
-        owner[primaryStateWriteOperationsContext].runtime.lastDurableWriteGeneration,
-        gen
-      )
-    }
-  } finally {
-    if (!renamed) {
-      await rm(tmpFile).catch(() => {})
-    }
-  }
-  if (!renamed) {
-    return
-  }
-  // Why (#1158): rotate only after the primary rename while this write still owns its generation.
-  if (owner[primaryStateWriteOperationsContext].runtime.writeGeneration !== gen) {
-    return
-  }
-  await owner[primaryStateWriteOperationsContext].backups.rotateBackupsAsync(dataFile)
-}
-
-export function writeToDiskSync(
-  owner: PrimaryStateWriteOperations,
-  opts: { force?: boolean; skipBackupRotation?: boolean } = {}
-): void {
-  if (owner[primaryStateWriteOperationsContext].runtime.writesFrozen) {
-    return
-  }
-  const { payload, stateHash, protectedSecretUpdates } =
-    owner[primaryStateWriteOperationsContext].serialization.buildStateToSave()
-  // Why: matching hash means the file already holds this state; force overrides when an async rename may be racing past the gen check.
-  if (
-    !opts.force &&
-    stateHash === owner[primaryStateWriteOperationsContext].runtime.lastWrittenStateHash
-  ) {
-    // Why: flushOrThrow already bumped writeGeneration; the file holds this state, so record it
-    // durable or persistPtyBinding's fast lane stays parked one generation behind forever.
-    owner[primaryStateWriteOperationsContext].runtime.lastDurableWriteGeneration = Math.max(
-      owner[primaryStateWriteOperationsContext].runtime.lastDurableWriteGeneration,
-      owner[primaryStateWriteOperationsContext].runtime.writeGeneration
-    )
-    return
-  }
-  const dataFile = owner[primaryStateWriteOperationsContext].runtime.dataFile
-  const dir = dirname(dataFile)
-  if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true })
-  }
-  const tmpFile = `${dataFile}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`
-
-  // Why: on any write/rename failure, remove the tmp file so shutdown crashes don't leak orphans.
-  let renamed = false
-  try {
-    // Why: fsync the temp file and the directory; a bare rename can survive as stale or empty
-    // content after power loss, losing projects/tabs back to the newest usable .bak slot.
-    writeFileDurableSync(tmpFile, dataFile, payload)
-    renamed = true
-    owner[primaryStateWriteOperationsContext].runtime.lastWrittenStateHash = stateHash
-    owner[primaryStateWriteOperationsContext].runtime.protectedSecrets.commitRetentionUpdates(
-      protectedSecretUpdates
-    )
-    owner[primaryStateWriteOperationsContext].runtime.lastDurableWriteGeneration = Math.max(
-      owner[primaryStateWriteOperationsContext].runtime.lastDurableWriteGeneration,
-      owner[primaryStateWriteOperationsContext].runtime.writeGeneration
-    )
-  } finally {
-    if (!renamed) {
-      try {
-        unlinkSync(tmpFile)
-      } catch {
-        // Best-effort cleanup; the write already failed, swallow secondary error.
-      }
-    }
-  }
-  const now = Date.now()
-  if (
-    !opts.skipBackupRotation &&
-    owner[primaryStateWriteOperationsContext].backups.shouldRotateBackups(now, dataFile)
-  ) {
-    owner[primaryStateWriteOperationsContext].backups.rotateBackupsSync(dataFile)
   }
+  return writeToDiskSync(owner[primaryStateWriteOperationsContext], { expectedGeneration: gen })
 }
 
 export function installPrimaryStateWriteOperationsContext(
diff --git a/src/main/persistence/loading-store/profile-preferences.ts b/src/main/persistence/loading-store/profile-preferences.ts
index 8e910ed235d..15315518961 100644
--- a/src/main/persistence/loading-store/profile-preferences.ts
+++ b/src/main/persistence/loading-store/profile-preferences.ts
@@ -1,7 +1,7 @@
 import type { GlobalSettings } from '../../../shared/global-settings-types'
 import type { OnboardingChecklistState } from '../../../shared/onboarding-state-types'
 import type { PersistedState } from '../../../shared/persisted-state-types'
-import { getDefaultOnboardingState } from '../../../shared/constants'
+import { getDefaultOnboardingState } from '../../../shared/onboarding-defaults'
 import type { FeatureInteractionId } from '../../../shared/feature-interactions'
 import {
   updateSettings as updateSettingsOperation,
@@ -159,7 +159,7 @@ export function getSettingsMutationOperations(
     bumpLocalWorktreeScanGeneration,
     removeRetainedBlob: (slot) =>
       owner[profilePreferencesContext].runtime.protectedSecrets.removeRetainedBlob(slot),
-    scheduleSave: () => scheduleSave(owner[profilePreferencesContext].scheduling),
+    scheduleSave: () => scheduleSave(owner[profilePreferencesContext].scheduling, ['settings']),
     notifySettingsChanged: (updates, originWebContentsId) =>
       notifySettingsChanged(owner, updates, originWebContentsId)
   }
@@ -183,7 +183,7 @@ export function getFeatureInteractionOperations(
 ): FeatureInteractionOperations {
   return {
     state: owner[profilePreferencesContext].runtime.state,
-    scheduleSave: () => scheduleSave(owner[profilePreferencesContext].scheduling),
+    scheduleSave: (domains) => scheduleSave(owner[profilePreferencesContext].scheduling, domains),
     notifyUIChanged: () => notifyUIChanged(owner),
     getUI: () => owner.getUI()
   }
diff --git a/src/main/persistence/loading-store/profile-state-authority-writes.ts b/src/main/persistence/loading-store/profile-state-authority-writes.ts
new file mode 100644
index 00000000000..0628dbb7607
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-authority-writes.ts
@@ -0,0 +1,84 @@
+import { createHash } from 'node:crypto'
+import { types } from 'node:util'
+import {
+  applySecretSentinelSubstitutions,
+  type SecretSentinelSubstitution
+} from './secret-sentinel-substitution'
+import type { ProfileStateDomainReplacement } from './profile-state-authority'
+
+export function serializeSelectiveProfileStateDomains(
+  state: Record<string, unknown>,
+  dirtyDomains: ReadonlySet<string>
+): ProfileStateDomainReplacement[] {
+  const payloads = new Map<string, string>()
+  // Capture keys up front, but read values after preceding getters and toJSON hooks.
+  for (const domain of Object.keys(state)) {
+    const fragment = serializeSelectiveProfileStateDomainFragment(domain, state[domain])
+    if (fragment !== '{}') {
+      payloads.set(domain, extractProfileStateDomainPayload(domain, fragment))
+    }
+  }
+  return [...dirtyDomains].map((domain) => {
+    return { domain, payload: payloads.get(domain) ?? null }
+  })
+}
+
+export function serializeCompleteProfileStateDomains(
+  state: Record<string, unknown>,
+  substitutions: readonly SecretSentinelSubstitution[],
+  degradedPrefix: string
+): { payload: Buffer; stateHash: string; domains: readonly ProfileStateDomainReplacement[] } {
+  const domains: ProfileStateDomainReplacement[] = []
+  const hash = createHash('sha1').update(degradedPrefix)
+  for (const [domain, value] of Object.entries(state)) {
+    const fragment = serializeProfileStateDomainFragment(domain, value)
+    if (fragment === '{}') {
+      continue
+    }
+    const serialized = applySecretSentinelSubstitutions(fragment, substitutions, '', 'text')
+    hash.update(serialized.stateHash)
+    domains.push({
+      domain,
+      payload: extractProfileStateDomainPayload(domain, serialized.payload)
+    })
+  }
+  return {
+    domains,
+    stateHash: hash.digest('hex'),
+    get payload() {
+      return Buffer.from(
+        `{${domains.map(({ domain, payload }) => `${JSON.stringify(domain)}:${payload}`).join(',')}}`,
+        'utf8'
+      )
+    }
+  }
+}
+
+function serializeSelectiveProfileStateDomainFragment(domain: string, value: unknown): string {
+  let needsNormalization = false
+  const fragment = serializeProfileStateDomainFragment(domain, value, (_key, entry) => {
+    if (entry !== null && typeof entry === 'object') {
+      needsNormalization ||=
+        types.isProxy(entry) ||
+        ('isRawJSON' in JSON &&
+          typeof JSON.isRawJSON === 'function' &&
+          JSON.isRawJSON(entry) === true)
+    }
+    return entry
+  })
+  // Raw JSON and proxy key order still need the old UTF-8/parse/stringify normalization.
+  return needsNormalization ? JSON.stringify(JSON.parse(fragment.toWellFormed())) : fragment
+}
+
+function serializeProfileStateDomainFragment(
+  domain: string,
+  value: unknown,
+  replacer?: (key: string, value: unknown) => unknown
+): string {
+  // The wrapper preserves the original property name passed to a value's toJSON.
+  return JSON.stringify({ [domain]: value }, replacer)
+}
+
+function extractProfileStateDomainPayload(domain: string, fragment: string): string {
+  return fragment.slice(JSON.stringify(domain).length + 2, -1)
+}
diff --git a/src/main/persistence/loading-store/profile-state-authority.ts b/src/main/persistence/loading-store/profile-state-authority.ts
new file mode 100644
index 00000000000..0ced5ba3248
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-authority.ts
@@ -0,0 +1,127 @@
+import type { LegacyPaneKeyAliasEntry } from '../../../shared/persisted-state-types'
+import type { AutomationRun } from '../../../shared/automations-types'
+import type { ProfileStateDatabaseQuarantine } from '../profile-state/profile-state-database-quarantine'
+
+export type ProfileStateMaintenance = {
+  /** Re-admit the unchanged profile before permitting any new persistence work. */
+  resume(): Promise<void>
+}
+
+/** Keep offline/compatibility persistence loadable without eagerly importing SQLite. */
+export type ProfileStateAuthority = {
+  readonly asynchronous?: false
+  /** Return storage-form JSON, or undefined when this authority has no state yet. */
+  readSerializedState(): string | undefined
+
+  /** Fence a hash-identical checkpoint without rereading or rewriting its payload. */
+  assertCurrentRevision?: () => void
+
+  /**
+   * Optionally commit only the explicitly dirty top-level domains. Authorities
+   * without this capability retain the complete-document fallback below.
+   */
+  writeSerializedDomains?: (replacements: readonly ProfileStateDomainReplacement[]) => void
+
+  /**
+   * Commit automation definition replacements and the changed run projection
+   * in one profile-revision transaction without serializing unrelated domains.
+   */
+  writeSerializedAutomationRuns?: (
+    replacements: readonly ProfileStateDomainReplacement[],
+    runs: readonly AutomationRun[]
+  ) => void
+
+  /**
+   * Durably replace the complete storage-form document. Implementations may
+   * reject a stale read instead of allowing last-writer-wins replacement.
+   */
+  writeSerializedState(payload: Buffer): void
+
+  /** Replace the whole profile; omitted domains and null payloads are deleted. */
+  writeCompleteSerializedDomains?: (replacements: readonly ProfileStateDomainReplacement[]) => void
+
+  /** Schedule bounded recovery protection after a successful primary commit. */
+  scheduleBackup?: () => void
+
+  /** Drain owned backup handles before shutdown or profile file mutations. */
+  drainBackups?: (cancel?: boolean) => Promise<void>
+
+  /** Optionally publish a durable JSON export for rollback or a compatibility runtime. */
+  writeJsonExport?: (targetPath: string) => number
+
+  /** Publish canonical JSON for an older build and advance its SQLite acceptance marker. */
+  writeJsonCompatibilityExport?: (targetPath: string) => number | undefined
+
+  /** Refresh compatibility JSON after the final flush with asynchronous JSON file writes. */
+  writeJsonCompatibilityExportAsync?: (targetPath: string) => Promise<number | undefined>
+
+  /** Optionally preserve the database family before an explicit recovery decision. */
+  quarantineDatabase?: (quarantineRoot?: string, reason?: string) => ProfileStateDatabaseQuarantine
+
+  /** Release any process-local database handle before a profile is switched or removed. */
+  close?: () => void
+
+  /** Only a clean maintenance close may provide an explicit resume capability. */
+  pauseForMaintenance?: () => Promise<ProfileStateMaintenance>
+}
+
+export type AsyncProfileStateAuthority = Omit<
+  ProfileStateAuthority,
+  | 'asynchronous'
+  | 'assertCurrentRevision'
+  | 'writeSerializedDomains'
+  | 'writeSerializedAutomationRuns'
+  | 'writeSerializedState'
+  | 'writeCompleteSerializedDomains'
+  | 'writeJsonExport'
+  | 'writeJsonCompatibilityExport'
+  | 'quarantineDatabase'
+  | 'close'
+> & {
+  readonly asynchronous: true
+  assertWritable(): void
+  abort(): Promise<void>
+  assertCurrentRevision(): Promise<void>
+  writeSerializedDomains(replacements: readonly ProfileStateDomainReplacement[]): Promise<void>
+  writeSerializedAutomationRuns(
+    replacements: readonly ProfileStateDomainReplacement[],
+    runs: readonly AutomationRun[]
+  ): Promise<void>
+  writeSerializedState(payload: Buffer): Promise<void>
+  writeCompleteSerializedDomains(
+    replacements: readonly ProfileStateDomainReplacement[]
+  ): Promise<void>
+  writeJsonExport(targetPath: string): Promise<number>
+  writeLatestJsonExport(dataFile: string): Promise<number | undefined>
+  writeJsonCompatibilityExport(targetPath: string): Promise<number | undefined>
+  quarantineDatabase(
+    quarantineRoot?: string,
+    reason?: string
+  ): Promise<ProfileStateDatabaseQuarantine>
+  close(): Promise<void>
+}
+
+export type ProfileStatePersistenceAuthority = ProfileStateAuthority | AsyncProfileStateAuthority
+
+export type ProfileStateDomainReplacement = {
+  domain: string
+  /** Storage-form JSON for the domain, or null to remove its row. */
+  payload: string | null
+}
+
+export type ProfileStateStartupPaneAlias = Omit<LegacyPaneKeyAliasEntry, 'ptyId'>
+
+/** A startup read paired with the authority that observed its revision. */
+export type ProfileStateAuthorityInitialState<
+  Authority extends ProfileStatePersistenceAuthority = ProfileStateAuthority
+> = {
+  readonly authority: Authority
+  readonly unboundPaneAliases?: readonly ProfileStateStartupPaneAlias[]
+} & (
+  | { readonly serializedState: string | undefined; readonly takeParsedState?: never }
+  | {
+      readonly serializedState?: never
+      /** Transfer this storage-form object once, before the loader can decrypt or mutate it. */
+      readonly takeParsedState: () => Record<string, unknown> | undefined
+    }
+)
diff --git a/src/main/persistence/loading-store/profile-state-caller-cancellation.test.ts b/src/main/persistence/loading-store/profile-state-caller-cancellation.test.ts
new file mode 100644
index 00000000000..728c63f6b8d
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-caller-cancellation.test.ts
@@ -0,0 +1,87 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from './profile-state-maintenance-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+describe('profile flush caller cancellation', () => {
+  it('releases a canceled waiter while its admitted write completes and later saving continues', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const write = authority.writeSerializedDomains.bind(authority)
+    vi.spyOn(authority, 'writeSerializedDomains').mockImplementationOnce(async (domains) => {
+      await write(domains)
+      started.resolve()
+      await release.promise
+    })
+    const abort = vi.spyOn(authority, 'abort')
+    const controller = new AbortController()
+    store.updateSettings({ theme: 'dark' })
+    const pending = store.flushPendingOrThrowAsync({ signal: controller.signal })
+    const rejected = expect(pending).rejects.toThrow('aborted')
+    let settled = false
+    void pending.catch(() => {
+      settled = true
+    })
+    await started.promise
+    controller.abort()
+    try {
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(abort).not.toHaveBeenCalled()
+      expect(settled).toBe(true)
+      expect(() => authority.assertWritable()).not.toThrow()
+    } finally {
+      release.resolve()
+      await rejected
+    }
+    await store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'light' })
+      return { value: undefined }
+    })
+    expect(readState().settings.theme).toBe('light')
+  })
+
+  it('keeps an abandoned write ordered before the final checkpoint', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const write = authority.writeSerializedDomains.bind(authority)
+    vi.spyOn(authority, 'writeSerializedDomains').mockImplementationOnce(async (domains) => {
+      started.resolve()
+      await release.promise
+      await write(domains)
+    })
+    const controller = new AbortController()
+    store.updateSettings({ theme: 'dark' })
+    const abandoned = store.flushPendingOrThrowAsync({ signal: controller.signal })
+    const rejected = expect(abandoned).rejects.toThrow('aborted')
+    await started.promise
+    controller.abort()
+    store.getWorkspaceSession().activeTabId = 'shutdown-edit'
+    const capture = vi.spyOn(authority, 'writeCompleteSerializedDomains')
+    const final = store.flushFinalOrThrowAsync()
+    const result = final.catch((error: unknown) => error)
+    try {
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(capture).not.toHaveBeenCalled()
+    } finally {
+      release.resolve()
+      await rejected
+    }
+    await expect(result).resolves.toBeUndefined()
+    expect(readState()).toMatchObject({
+      settings: { theme: 'dark' },
+      workspaceSession: { activeTabId: 'shutdown-edit' }
+    })
+  })
+})
diff --git a/src/main/persistence/loading-store/profile-state-checkpoints.test.ts b/src/main/persistence/loading-store/profile-state-checkpoints.test.ts
new file mode 100644
index 00000000000..3b32f7702aa
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-checkpoints.test.ts
@@ -0,0 +1,238 @@
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+import { openProfileStateDatabaseReadOnly } from '../profile-state/profile-state-database'
+import { parseProfileStateRoot } from '../profile-state/profile-state-document-validation'
+import { readProfileStateSnapshot } from '../profile-state/profile-state-documents'
+import { profileStateJsonExportPath } from '../profile-state/legacy-json/profile-state-export-path'
+import { ProfileStateSqliteAuthority } from '../profile-state/profile-state-sqlite-authority'
+import { Store } from './store'
+import { scheduleSave } from './write-scheduling'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const PROFILE_ID = 'checkpoint-test'
+const fixtures: { directory: string; store: Store }[] = []
+
+afterEach(async () => {
+  for (const { directory, store } of fixtures.splice(0)) {
+    store.freezeWrites()
+    await store.flushAsync()
+    rmSync(directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+
+function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-checkpoint-'))
+  const databasePath = join(directory, 'profile-state.db')
+  const dataFile = join(directory, 'orca-data.json')
+  const authority = new ProfileStateSqliteAuthority(databasePath, PROFILE_ID)
+  const backup = vi.spyOn(authority, 'scheduleBackup').mockImplementation(() => {})
+  authority.writeSerializedState(
+    Buffer.from(JSON.stringify(buildProfileStateCutoverFixture(directory)))
+  )
+  const store = new Store({ dataFile, profileStateAuthority: authority })
+  fixtures.push({ directory, store })
+  store.flushOrThrow()
+  return {
+    directory,
+    dataFile,
+    store,
+    authority,
+    backup,
+    readState: () => {
+      const opened = openProfileStateDatabaseReadOnly(databasePath, PROFILE_ID)
+      try {
+        return parseProfileStateRoot(readProfileStateSnapshot(opened.db).json)
+      } finally {
+        opened.db.close()
+      }
+    }
+  }
+}
+
+function mutateThroughGetters(store: Store): void {
+  store.getWorkspaceSession().activeTabId = 'direct-local-tab'
+  store.getWorkspaceSession('ssh:build-host').activeTabId = 'direct-remote-tab'
+}
+
+const EXPECTED_CHECKPOINT = {
+  settings: { theme: 'dark' },
+  workspaceSession: { activeTabId: 'direct-local-tab' },
+  workspaceSessionsByHostId: { 'ssh:build-host': { activeTabId: 'direct-remote-tab' } }
+}
+
+describe('complete profile state checkpoints', () => {
+  it('does not retain a save timer after writes are frozen', () => {
+    const { store } = fixture()
+    store.freezeWrites()
+    const setTimer = vi.spyOn(globalThis, 'setTimeout')
+    scheduleSave(store)
+    expect(setTimer).not.toHaveBeenCalled()
+  })
+
+  it.each(['sync', 'async'] as const)(
+    'rejects a stale %s checkpoint even when the local hash is unchanged',
+    async (mode) => {
+      const { store, directory, readState } = fixture()
+      const other = new ProfileStateSqliteAuthority(join(directory, 'profile-state.db'), PROFILE_ID)
+      try {
+        other.readSerializedState()
+        other.writeSerializedDomains([{ domain: 'futureDomain', payload: '{"external":true}' }])
+        scheduleSave(store)
+        if (mode === 'sync') {
+          expect(() => store.flushOrThrow()).toThrow(/Profile state revision changed/)
+        } else {
+          await expect(store.flushPendingOrThrowAsync()).rejects.toThrow(
+            /Profile state revision changed/
+          )
+        }
+        expect(readState()).toMatchObject({ futureDomain: { external: true } })
+      } finally {
+        other.close()
+      }
+    }
+  )
+
+  it('captures nested history mutations after an unchanged checkpoint', async () => {
+    const { store, directory, readState } = fixture()
+    store.writeProfileStateJsonExport(join(directory, 'before.json'))
+    const run = store.listAutomationRuns()[0]
+    if (!run?.outputSnapshot) {
+      throw new Error('Expected a fixture run with output')
+    }
+    run.outputSnapshot.content = 'changed through a nested getter'
+    store.updateSettings({ theme: 'dark' })
+    await store.flushPendingOrThrowAsync()
+
+    await store.flushAsync()
+
+    expect(readState()).toMatchObject({
+      settings: { theme: 'dark' },
+      automationRuns: expect.arrayContaining([
+        expect.objectContaining({
+          id: run.id,
+          outputSnapshot: expect.objectContaining({ content: 'changed through a nested getter' })
+        })
+      ])
+    })
+  })
+
+  it.each([false, true])(
+    'captures getter mutations alongside pending settings on quit (compatibility export: %s)',
+    async (exportJsonCompatibility) => {
+      const { store, dataFile, readState } = fixture()
+      mutateThroughGetters(store)
+      store.updateSettings({ theme: 'dark' })
+
+      await store.flushAsync({ exportJsonCompatibility })
+
+      expect(readState()).toMatchObject(EXPECTED_CHECKPOINT)
+      if (exportJsonCompatibility) {
+        expect(parseProfileStateRoot(readFileSync(dataFile, 'utf8'))).toMatchObject(
+          EXPECTED_CHECKPOINT
+        )
+      }
+    }
+  )
+
+  it.each(['explicit', 'revisioned', 'compatibility'] as const)(
+    'includes getter mutations in the %s JSON export',
+    (mode) => {
+      const { store, directory, dataFile, readState } = fixture()
+      mutateThroughGetters(store)
+      store.updateSettings({ theme: 'dark' })
+      let exportPath = join(directory, 'rollback.json')
+
+      if (mode === 'explicit') {
+        store.writeProfileStateJsonExport(exportPath)
+      } else if (mode === 'revisioned') {
+        const revision = store.writeLatestProfileStateJsonExport()
+        if (revision === undefined) {
+          throw new Error('Expected a revisioned export')
+        }
+        exportPath = profileStateJsonExportPath(dataFile, revision)
+      } else {
+        store.writeLatestProfileStateJsonCompatibilityExport()
+        exportPath = dataFile
+      }
+
+      expect(readState()).toMatchObject(EXPECTED_CHECKPOINT)
+      expect(parseProfileStateRoot(readFileSync(exportPath, 'utf8'))).toMatchObject(
+        EXPECTED_CHECKPOINT
+      )
+    }
+  )
+
+  it('takes the final checkpoint after an earlier queued writer clears its dirty domains', async () => {
+    const { store, backup, readState } = fixture()
+    store.updateSettings({ theme: 'light' })
+    backup.mockImplementationOnce(() => {
+      queueMicrotask(() => {
+        mutateThroughGetters(store)
+        store.updateSettings({ theme: 'dark' })
+      })
+    })
+
+    const previous = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    const final = store.flushAsync()
+    await Promise.all([previous, final])
+
+    expect(readState()).toMatchObject(EXPECTED_CHECKPOINT)
+  })
+
+  it('keeps normal pending and synchronous writes selective', async () => {
+    const { store, authority } = fixture()
+    const fullWrite = vi.spyOn(authority, 'writeSerializedState')
+    const selectiveWrite = vi.spyOn(authority, 'writeSerializedDomains')
+
+    store.updateSettings({ theme: 'dark' })
+    await store.flushPendingOrThrowAsync()
+    store.patchWorkspaceSession({ activeTabId: 'scheduled-tab' })
+    store.flushOrThrow()
+
+    expect(fullWrite).not.toHaveBeenCalled()
+    expect(
+      selectiveWrite.mock.calls.map(([domains]) => domains.map(({ domain }) => domain))
+    ).toEqual([['settings'], ['workspaceSession']])
+  })
+
+  it('clears full-checkpoint mode after a synchronous hash no-op', () => {
+    const { store, authority } = fixture()
+    store.writeLatestProfileStateJsonExport()
+
+    const completeWrite = vi.spyOn(authority, 'writeCompleteSerializedDomains')
+    const selectiveWrite = vi.spyOn(authority, 'writeSerializedDomains')
+    store.updateSettings({ theme: 'light' })
+    store.flushOrThrow()
+
+    expect(completeWrite).not.toHaveBeenCalled()
+    expect(
+      selectiveWrite.mock.calls.map(([domains]) => domains.map(({ domain }) => domain))
+    ).toEqual([['settings']])
+  })
+
+  it('does not write a frozen profile when final persistence requests a checkpoint', async () => {
+    const { store, authority, readState } = fixture()
+    const before = readState()
+    const fullWrite = vi.spyOn(authority, 'writeSerializedState')
+    mutateThroughGetters(store)
+    store.updateSettings({ theme: 'dark' })
+    store.freezeWrites()
+
+    await store.flushAsync()
+
+    expect(fullWrite).not.toHaveBeenCalled()
+    expect(readState()).toEqual(before)
+  })
+})
diff --git a/src/main/persistence/loading-store/profile-state-delayed-authority-fixture.ts b/src/main/persistence/loading-store/profile-state-delayed-authority-fixture.ts
new file mode 100644
index 00000000000..26709b33e3f
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-delayed-authority-fixture.ts
@@ -0,0 +1,143 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, vi } from 'vitest'
+import type { AutomationRun } from '../../../shared/automations-types'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+import { ProfileStateSqliteAuthority } from '../profile-state/profile-state-sqlite-authority'
+import { writeVersionedProfileStateExport } from '../profile-state/legacy-json/profile-state-versioned-export'
+import type {
+  AsyncProfileStateAuthority,
+  ProfileStateDomainReplacement
+} from './profile-state-authority'
+import { Store } from './store'
+
+export function deferred<T>() {
+  let resolve!: (value: T) => void
+  let reject!: (error: Error) => void
+  const promise = new Promise<T>((accept, refuse) => {
+    resolve = accept
+    reject = refuse
+  })
+  return { promise, resolve, reject }
+}
+
+/** Delay the authority boundary while retaining real SQLite and Store serialization. */
+export class DelayedAuthority implements AsyncProfileStateAuthority {
+  readonly asynchronous = true
+  private next:
+    | { started: ReturnType<typeof deferred<void>>; finish: ReturnType<typeof deferred<void>> }
+    | undefined
+  readonly captures: ProfileStateDomainReplacement[][] = []
+  private failNext = false
+  readonly close = vi.fn(async () => {
+    this.inner.close()
+  })
+
+  constructor(readonly inner: ProfileStateSqliteAuthority) {}
+
+  /** Fail the next profile write the way a full disk would, after any paused gate opens. */
+  failNextWrite() {
+    this.failNext = true
+  }
+
+  pause() {
+    const gate = { started: deferred<void>(), finish: deferred<void>() }
+    this.next = gate
+    return gate
+  }
+
+  assertWritable() {}
+  async abort() {}
+  readSerializedState() {
+    return this.inner.readSerializedState()
+  }
+  async assertCurrentRevision() {
+    await this.dispatch(() => this.inner.assertCurrentRevision())
+  }
+  async writeSerializedState(payload: Buffer) {
+    const captured = Buffer.from(payload)
+    await this.dispatch(() => this.inner.writeSerializedState(captured), true)
+  }
+  async writeSerializedDomains(replacements: readonly ProfileStateDomainReplacement[]) {
+    const captured = structuredClone(replacements)
+    this.captures.push([...captured])
+    await this.dispatch(() => this.inner.writeSerializedDomains(captured), true)
+  }
+  async writeCompleteSerializedDomains(replacements: readonly ProfileStateDomainReplacement[]) {
+    const captured = structuredClone(replacements)
+    this.captures.push([...captured])
+    await this.dispatch(() => this.inner.writeCompleteSerializedDomains(captured), true)
+  }
+  async writeSerializedAutomationRuns(
+    replacements: readonly ProfileStateDomainReplacement[],
+    runs: readonly AutomationRun[]
+  ) {
+    const captured = structuredClone(replacements)
+    const capturedRuns = structuredClone(runs)
+    await this.dispatch(
+      () => this.inner.writeSerializedAutomationRuns(captured, capturedRuns),
+      true
+    )
+  }
+  async writeJsonExport(path: string) {
+    return this.inner.writeJsonExport(path)
+  }
+  async writeLatestJsonExport(path: string) {
+    return writeVersionedProfileStateExport(path, this.inner.writeJsonExport.bind(this.inner))
+  }
+  async writeJsonCompatibilityExport(path: string) {
+    return this.inner.writeJsonCompatibilityExportAsync(path)
+  }
+  async quarantineDatabase(root?: string, reason?: string) {
+    return this.inner.quarantineDatabase(root, reason)
+  }
+  private async dispatch(operation: () => void, write = false) {
+    const gate = this.next
+    this.next = undefined
+    gate?.started.resolve()
+    await gate?.finish.promise
+    if (write && this.failNext) {
+      this.failNext = false
+      throw new Error('profile_state_write_failed')
+    }
+    operation()
+  }
+}
+
+const cleanups: (() => Promise<void>)[] = []
+afterEach(async () => {
+  for (const cleanup of cleanups.splice(0)) {
+    await cleanup()
+  }
+  vi.restoreAllMocks()
+})
+
+export async function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-worker-coordination-'))
+  const path = join(directory, 'profile-state.db')
+  const inner = new ProfileStateSqliteAuthority(path, 'coordination-test')
+  inner.writeSerializedState(
+    Buffer.from(JSON.stringify(buildProfileStateCutoverFixture(directory)))
+  )
+  const authority = new DelayedAuthority(inner)
+  const store = new Store({
+    dataFile: join(directory, 'orca-data.json'),
+    profileStateAuthority: authority
+  })
+  cleanups.push(async () => {
+    await store.freezeWritesAsync()
+    rmSync(directory, { recursive: true, force: true })
+  })
+  await store.flushPendingOrThrowAsync()
+  authority.captures.length = 0
+  const readState = () => {
+    const reader = new ProfileStateSqliteAuthority(path, 'coordination-test')
+    try {
+      return JSON.parse(reader.readSerializedState() ?? '{}')
+    } finally {
+      reader.close()
+    }
+  }
+  return { store, authority, readState }
+}
diff --git a/src/main/persistence/loading-store/profile-state-direct-flush.test.ts b/src/main/persistence/loading-store/profile-state-direct-flush.test.ts
new file mode 100644
index 00000000000..9cf3d1ec2d1
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-direct-flush.test.ts
@@ -0,0 +1,188 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { CodexResetCreditAttemptLedger } from '../../../shared/codex-reset-credit-attempt-ledger'
+import { ProfileStateSqliteAuthority } from '../profile-state/profile-state-sqlite-authority'
+import { readProfileStateDomain } from '../profile-state/profile-state-domain-reader'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+import { Store } from './store'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (value: string) => Buffer.from(`encrypted:${value}`),
+    decryptString: (value: Buffer) => value.toString().slice('encrypted:'.length)
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const PROFILE_ID = 'direct-flush-test'
+const fixtures: { directory: string; store: Store }[] = []
+
+afterEach(async () => {
+  for (const fixture of fixtures.splice(0)) {
+    fixture.store.freezeWrites()
+    await fixture.store.flushAsync()
+    rmSync(fixture.directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+
+function fixture(seedState?: unknown) {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-direct-flush-'))
+  const databasePath = join(directory, 'profile-state.db')
+  const authority = new ProfileStateSqliteAuthority(databasePath, PROFILE_ID)
+  vi.spyOn(authority, 'scheduleBackup').mockImplementation(() => {})
+  if (seedState !== undefined) {
+    authority.writeSerializedState(Buffer.from(JSON.stringify(seedState)))
+  }
+  const store = new Store({
+    dataFile: join(directory, 'orca-data.json'),
+    profileStateAuthority: authority
+  })
+  fixtures.push({ directory, store })
+  store.flushOrThrow()
+  return {
+    store,
+    read: (domain: string) => readProfileStateDomain(databasePath, PROFILE_ID, domain),
+    pendSession: () => store.patchWorkspaceSession({ activeWorktreeId: 'pending-workspace' })
+  }
+}
+
+describe('SQLite durability barriers with another selective write pending', () => {
+  it('commits a reset-credit claim before returning to its provider caller', async () => {
+    const state = fixture()
+    const ledger: CodexResetCreditAttemptLedger = {
+      version: 1,
+      attempts: [
+        {
+          idempotencyKey: '158a0d86-8d8e-4589-b9c5-f53a59bdcdd8',
+          expectedScope: {
+            target: { runtime: 'host', wslDistro: null },
+            accountId: 'account',
+            accountRevision: 1,
+            offerRevision: 'v1:offer'
+          },
+          state: 'providerPending'
+        }
+      ]
+    }
+    state.pendSession()
+    await state.store.replaceCodexResetCreditAttemptLedgerAndFlush(ledger)
+    expect(state.read('codexResetCreditAttemptLedger')).toMatchObject({
+      kind: 'value',
+      value: ledger
+    })
+  })
+
+  it('commits Claude live-PTY admission before returning', () => {
+    const state = fixture()
+    state.pendSession()
+    state.store.addClaudeLivePtySessionId('claude-session')
+    expect(state.read('claudeLivePtySessionIds')).toMatchObject({
+      kind: 'value',
+      value: ['claude-session']
+    })
+  })
+
+  it('commits SSH lease admission before returning', () => {
+    const state = fixture()
+    state.pendSession()
+    state.store.upsertSshRemotePtyLease({ targetId: 'ssh-test', ptyId: 'pty-1', state: 'attached' })
+    expect(state.read('sshRemotePtyLeases')).toMatchObject({
+      kind: 'value',
+      value: [{ targetId: 'ssh-test', ptyId: 'pty-1', state: 'attached' }]
+    })
+  })
+
+  it.each(['async', 'shutdown'] as const)(
+    'persists SSH detachment through the %s barrier',
+    async (barrier) => {
+      const state = fixture()
+      state.store.upsertSshRemotePtyLease({
+        targetId: 'ssh-test',
+        ptyId: 'pty-1',
+        state: 'attached'
+      })
+      state.pendSession()
+      if (barrier === 'async') {
+        await state.store.markSshRemotePtyLeasesAsync('ssh-test', 'detached')
+      } else {
+        state.store.markSshRemotePtyLeasesForShutdown('ssh-test', 'detached')
+        await state.store.flushAsync()
+      }
+      expect(state.read('sshRemotePtyLeases')).toMatchObject({
+        kind: 'value',
+        value: [{ targetId: 'ssh-test', ptyId: 'pty-1', state: 'detached' }]
+      })
+    }
+  )
+
+  it('persists sealed SSH consumer recovery before relay setup continues', async () => {
+    const state = fixture()
+    state.pendSession()
+    await state.store.upsertSshPtyConsumerRecovery({
+      targetId: 'ssh-test',
+      clientInstanceId: 'client-test',
+      serverBuildId: 'build-test',
+      clientGeneration: 1,
+      ownerGeneration: 1,
+      ownerLease: 'secret-owner-lease'
+    })
+    const stored = state.read('sshPtyConsumerRecoveries')
+    expect(stored).toMatchObject({ kind: 'value', value: [{ targetId: 'ssh-test' }] })
+    expect(JSON.stringify(stored)).not.toContain('secret-owner-lease')
+    state.pendSession()
+    await state.store.removeSshPtyConsumerRecovery('ssh-test')
+    expect(state.read('sshPtyConsumerRecoveries')).toMatchObject({ kind: 'value', value: [] })
+  })
+
+  it('deletes an automation and its retained runs in the same commit', () => {
+    const state = fixture(buildProfileStateCutoverFixture())
+    const automation = state.store.listAutomations()[0]
+    if (!automation) {
+      throw new Error('Fixture automation is absent')
+    }
+    expect(state.store.listAutomationRuns(automation.id)).not.toHaveLength(0)
+    state.store.deleteAutomation(automation.id)
+    expect(state.read('automations')).toMatchObject({ kind: 'value', value: [] })
+    expect(state.read('automationRuns')).toMatchObject({ kind: 'value', value: [] })
+  })
+
+  it('persists the session and UI identities moved with worktree metadata', () => {
+    const seed = buildProfileStateCutoverFixture()
+    const oldId = 'repo-local::/fixture/local'
+    const newId = 'repo-local::/fixture/renamed'
+    seed.workspaceSession.activeWorktreeId = oldId
+    seed.ui.showDotfilesByWorktree = { [oldId]: true }
+    const state = fixture(seed)
+    state.store.migrateWorktreeIdentity(oldId, newId)
+    state.store.flushOrThrow()
+    expect(state.read('workspaceSession')).toMatchObject({
+      kind: 'value',
+      value: { activeWorktreeId: newId }
+    })
+    expect(state.read('ui')).toMatchObject({
+      kind: 'value',
+      value: { showDotfilesByWorktree: { [newId]: true } }
+    })
+  })
+})
diff --git a/src/main/persistence/loading-store/profile-state-flush-lifetime.ts b/src/main/persistence/loading-store/profile-state-flush-lifetime.ts
new file mode 100644
index 00000000000..215c1babe85
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-flush-lifetime.ts
@@ -0,0 +1,34 @@
+import type { StoreRuntimeState } from './store-runtime-state'
+
+/** Lifecycle cleanup must join every accepted operation before closing its writer. */
+export async function drainProfileStateOperations(
+  operations: Iterable<Promise<unknown> | null | undefined>
+): Promise<void> {
+  const settled = await Promise.allSettled(
+    Array.from(operations, (operation) => Promise.resolve(operation))
+  )
+  for (const result of settled) {
+    if (result.status === 'rejected') {
+      throw result.reason
+    }
+  }
+}
+
+/** A flush may dispatch again after SQL completes while its sidecars are still pending. */
+export async function runProfileStateFlush(
+  runtime: Pick<StoreRuntimeState, 'pendingProfileFlushes'>,
+  operation: () => Promise<void>
+): Promise<void> {
+  let finish!: () => void
+  const pending = new Promise<void>((resolve) => {
+    finish = resolve
+  })
+  runtime.pendingProfileFlushes.add(pending)
+  try {
+    await operation()
+  } finally {
+    // Each caller owns its result; lifecycle barriers may retry a known failed capture.
+    runtime.pendingProfileFlushes.delete(pending)
+    finish()
+  }
+}
diff --git a/src/main/persistence/loading-store/profile-state-import-lifetime.test.ts b/src/main/persistence/loading-store/profile-state-import-lifetime.test.ts
new file mode 100644
index 00000000000..dd201c81cd3
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-import-lifetime.test.ts
@@ -0,0 +1,124 @@
+import { createSqliteTestStore } from '../../persistence-test-harness'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, expect, it, vi } from 'vitest'
+import { agentHookServer } from '../../agent-hooks/server'
+import {
+  clearMigrationUnsupportedPty,
+  setMigrationUnsupportedPty,
+  setMigrationUnsupportedPtyPersistenceListener
+} from '../../agent-hooks/migration-unsupported-pty-state'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+import * as composition from './store-domain-composition'
+import { scheduleSave } from './write-scheduling'
+import { Store } from './store'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const directories: string[] = []
+const stores: Store[] = []
+const livePaneKey = 'live-tab:11111111-1111-4111-8111-111111111111'
+
+it('refuses a writable Store before constructing domains without an authority', () => {
+  const createDomains = vi.spyOn(composition, 'createStoreDomains')
+  expect(() => new Store()).toThrow('requires a SQLite profile-state authority')
+  expect(createDomains).not.toHaveBeenCalled()
+})
+
+afterEach(async () => {
+  agentHookServer.setPaneKeyAliasPersistenceListener(null)
+  setMigrationUnsupportedPtyPersistenceListener(null)
+  agentHookServer.clearPaneKeyAliasesForPty('later-live-pty')
+  clearMigrationUnsupportedPty('later-live-pty')
+  for (const store of stores.splice(0)) {
+    await store.freezeWritesAsync()
+  }
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+})
+
+it.each([false, true])('isolates imported aliases and live listeners (load failure=%s)', (fail) => {
+  vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+  const directory = mkdtempSync(join(tmpdir(), 'orca-import-lifetime-'))
+  directories.push(directory)
+  const live = createSqliteTestStore(Store, { dataFile: join(directory, 'live', 'orca-data.json') })
+  stores.push(live)
+  const source = buildProfileStateCutoverFixture(directory)
+  for (const session of [
+    source.workspaceSession,
+    ...Object.values(source.workspaceSessionsByHostId ?? {})
+  ]) {
+    if (!session) {
+      continue
+    }
+    for (const [tabId, layout] of Object.entries(session.terminalLayoutsByTabId)) {
+      layout.root = { type: 'leaf', leafId: 'pane:1' }
+      layout.activeLeafId = 'pane:1'
+      layout.ptyIdsByLeafId = { 'pane:1': `imported-${tabId}` }
+    }
+  }
+  const registerAlias = vi.spyOn(agentHookServer, 'registerPaneKeyAlias')
+  const replaceListener = vi.spyOn(agentHookServer, 'setPaneKeyAliasPersistenceListener')
+  if (fail) {
+    const createDomains = composition.createStoreDomains
+    vi.spyOn(composition, 'createStoreDomains').mockImplementationOnce((runtime) => {
+      const domains = createDomains(runtime)
+      vi.spyOn(domains.adaptation, 'hydrateFolderWorkspaceDiffComments').mockImplementationOnce(
+        () => {
+          scheduleSave(domains.scheduling)
+          throw new Error('normalization refused')
+        }
+      )
+      return domains
+    })
+  }
+  const pendingTimers = vi.getTimerCount()
+  const createImport = () =>
+    new Store({
+      dataFile: join(directory, 'imported', 'orca-data.json'),
+      serializedState: JSON.stringify(source)
+    })
+  if (fail) {
+    expect(createImport).toThrow('normalization refused')
+  } else {
+    const imported = createImport()
+    stores.push(imported)
+    expect(JSON.parse(imported.prepareProfileStateExport().json).legacyPaneKeyAliasEntries).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ legacyPaneKey: 'tab-local:1', ptyId: 'imported-tab-local' }),
+        expect.objectContaining({ legacyPaneKey: 'tab-remote:1', ptyId: 'imported-tab-remote' })
+      ])
+    )
+  }
+  expect(registerAlias).not.toHaveBeenCalled()
+  expect(replaceListener).not.toHaveBeenCalled()
+  expect(vi.getTimerCount()).toBe(pendingTimers)
+  agentHookServer.registerPaneKeyAlias('live-tab:1', livePaneKey, 'later-live-pty')
+  setMigrationUnsupportedPty({
+    ptyId: 'later-live-pty',
+    paneKey: livePaneKey,
+    tabId: 'live-tab',
+    worktreeId: 'live-worktree',
+    reason: 'legacy-numeric-pane-key',
+    source: 'local',
+    updatedAt: 1
+  })
+  const persisted = JSON.parse(live.prepareProfileStateExport().json)
+  expect(persisted.legacyPaneKeyAliasEntries).toEqual([
+    expect.objectContaining({ legacyPaneKey: 'live-tab:1', ptyId: 'later-live-pty' })
+  ])
+  expect(persisted.migrationUnsupportedPtyEntries).toEqual([
+    expect.objectContaining({ ptyId: 'later-live-pty', paneKey: livePaneKey })
+  ])
+})
diff --git a/src/main/persistence/loading-store/profile-state-maintenance-compatibility.test.ts b/src/main/persistence/loading-store/profile-state-maintenance-compatibility.test.ts
new file mode 100644
index 00000000000..e3313f60eb5
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-maintenance-compatibility.test.ts
@@ -0,0 +1,125 @@
+import { existsSync, mkdirSync, readFileSync, rmSync } from 'node:fs'
+import { describe, expect, it, vi } from 'vitest'
+import { createWorkerMaintenanceFixture } from './profile-state-maintenance-fixture'
+import { profileStateJsonExportPaths } from '../profile-state/legacy-json/profile-state-export-path'
+import { openProfileStateDatabase } from '../profile-state/profile-state-database'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+describe('maintenance compatibility checkpoint', () => {
+  it('exports the current worker state before a clean profile switch releases its writer', async () => {
+    const { store, dataFile, readState } = await createWorkerMaintenanceFixture()
+    expect(existsSync(dataFile)).toBe(false)
+    store.updateSettings({ theme: 'dark' })
+    store.getWorkspaceSession().activeTabId = 'latest-tab'
+    const maintenance = await store.beginProfileMaintenance()
+    const snapshot = JSON.parse(readFileSync(dataFile, 'utf8'))
+    expect(snapshot).toEqual(readState())
+    expect(snapshot.settings.theme).toBe('dark')
+    expect(snapshot.workspaceSession.activeTabId).toBe('latest-tab')
+    const [retained] = profileStateJsonExportPaths(dataFile)
+    expect(JSON.parse(readFileSync(retained, 'utf8'))).toEqual(snapshot)
+    await maintenance.resume()
+    await store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'light' })
+      return { value: undefined }
+    })
+    expect(readState().settings.theme).toBe('light')
+  })
+
+  it('does not publish compatibility files for a recovery pause', async () => {
+    const { store, dataFile } = await createWorkerMaintenanceFixture()
+    store.updateSettings({ theme: 'dark' })
+    await store.beginProfileMaintenance({ flush: false })
+    expect(existsSync(dataFile)).toBe(false)
+    expect(profileStateJsonExportPaths(dataFile)).toEqual([])
+  })
+
+  it('resumes admission after a known export failure while preserving the committed state', async () => {
+    const { store, authority, dataFile, readState } = await createWorkerMaintenanceFixture()
+    vi.spyOn(authority, 'writeJsonCompatibilityExportAsync').mockRejectedValueOnce(
+      new Error('export disk refused')
+    )
+    store.updateSettings({ theme: 'dark' })
+    await expect(store.beginProfileMaintenance()).rejects.toThrow('export disk refused')
+    expect(existsSync(dataFile)).toBe(false)
+    expect(readState().settings.theme).toBe('dark')
+    await store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'light' })
+      return { value: undefined }
+    })
+    expect(readState().settings.theme).toBe('light')
+    await (await store.beginProfileMaintenance()).resume()
+    expect(JSON.parse(readFileSync(dataFile, 'utf8')).settings.theme).toBe('light')
+  })
+
+  it('resumes after the worker cannot read JSON before staging compatibility acceptance', async () => {
+    const { store, dataFile, readState } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    mkdirSync(dataFile)
+    store.updateSettings({ theme: 'dark' })
+
+    await expect(store.beginProfileMaintenance()).rejects.toMatchObject({
+      outcome: 'known-failure'
+    })
+    expect(readState().settings.theme).toBe('dark')
+    rmSync(dataFile, { recursive: true })
+    await store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'light' })
+      return { value: undefined }
+    })
+    expect(readState().settings.theme).toBe('light')
+    await (await store.beginProfileMaintenance()).resume()
+    expect(JSON.parse(readFileSync(dataFile, 'utf8')).settings.theme).toBe('light')
+  })
+
+  it.each(['maintenance', 'update-preflight'] as const)(
+    'resumes saving after a rolled-back %s export leaves both JSON versions accepted',
+    async (phase) => {
+      const { store, authority, dataFile, databaseFile, profileId, readState } =
+        await createWorkerMaintenanceFixture()
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      await authority.writeJsonCompatibilityExportAsync(dataFile)
+      const opened = openProfileStateDatabase(databaseFile, profileId)
+      try {
+        opened.db.exec(`
+        CREATE TRIGGER reject_acceptance BEFORE INSERT ON profile_state_meta
+        WHEN NEW.key = 'legacy_json_acceptance'
+          AND json_type(NEW.value, '$.pending') IS NULL
+        BEGIN SELECT RAISE(ABORT, 'injected promotion failure'); END
+      `)
+      } finally {
+        opened.db.close()
+      }
+      store.updateSettings({ theme: 'dark' })
+
+      await expect(
+        phase === 'maintenance'
+          ? store.beginProfileMaintenance()
+          : store.writeLatestProfileStateJsonCompatibilityExportAsync()
+      ).rejects.toMatchObject({ outcome: 'known-failure' })
+      expect(JSON.parse(readFileSync(dataFile, 'utf8')).settings.theme).toBe('dark')
+      expect(readState().settings.theme).toBe('dark')
+      await store.runDurableMutation(() => {
+        store.updateSettings({ theme: 'light' })
+        return { value: undefined }
+      })
+      expect(readState().settings.theme).toBe('light')
+      const repaired = openProfileStateDatabase(databaseFile, profileId)
+      try {
+        repaired.db.exec('DROP TRIGGER reject_acceptance')
+      } finally {
+        repaired.db.close()
+      }
+      await (await store.beginProfileMaintenance()).resume()
+      expect(JSON.parse(readFileSync(dataFile, 'utf8')).settings.theme).toBe('light')
+    }
+  )
+})
diff --git a/src/main/persistence/loading-store/profile-state-maintenance-final-failure.test.ts b/src/main/persistence/loading-store/profile-state-maintenance-final-failure.test.ts
new file mode 100644
index 00000000000..7b9a5e16fa9
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-maintenance-final-failure.test.ts
@@ -0,0 +1,89 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it, vi } from 'vitest'
+import { ProfileStateWriterError } from '../profile-state/profile-state-writer-errors'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from './profile-state-maintenance-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+describe('quit during failed profile maintenance', () => {
+  it('retries a known failed checkpoint and persists shutdown edits before closing', async () => {
+    const { store, authority, readState, dataFile } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    store.upsertSshRemotePtyLease({ targetId: 'remote', ptyId: 'pty', state: 'attached' })
+    await store.flushPendingOrThrowAsync()
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const checkpoint = vi
+      .spyOn(authority, 'writeCompleteSerializedDomains')
+      .mockImplementationOnce(async () => {
+        started.resolve()
+        await release.promise
+        throw new Error('SQLITE_BUSY')
+      })
+    store.updateSettings({ theme: 'dark' })
+    const failed = expect(store.beginProfileMaintenance()).rejects.toThrow('SQLITE_BUSY')
+    await started.promise
+    store.markSshRemotePtyLeasesForShutdown('remote', 'detached')
+    const final = store.flushFinalOrThrowAsync({ exportJsonCompatibility: true })
+    const result = final.catch((error: unknown) => error)
+    release.resolve()
+    await failed
+    await expect(result).resolves.toBeUndefined()
+    expect(checkpoint).toHaveBeenCalledTimes(2)
+    expect(readState()).toMatchObject({
+      settings: { theme: 'dark' },
+      sshRemotePtyLeases: [expect.objectContaining({ state: 'detached' })]
+    })
+    expect(JSON.parse(readFileSync(dataFile, 'utf8'))).toEqual(readState())
+  })
+
+  it.each(['indeterminate', 'changed-source'] as const)(
+    'keeps %s maintenance fenced during quit',
+    async (kind) => {
+      const { store, authority, readState, peer } = await createWorkerMaintenanceFixture()
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      const durable = readState()
+      const started = maintenanceBarrier()
+      const release = maintenanceBarrier()
+      const failure =
+        kind === 'indeterminate'
+          ? new ProfileStateWriterError('test-unknown-commit', 'commit outcome unknown', kind)
+          : new Error('SQLITE_BUSY')
+      const checkpoint = vi
+        .spyOn(authority, 'writeCompleteSerializedDomains')
+        .mockImplementationOnce(async () => {
+          started.resolve()
+          await release.promise
+          if (kind === 'changed-source') {
+            const other = peer()
+            try {
+              other.writeSerializedDomains([{ domain: 'peer', payload: '{"preserved":true}' }])
+            } finally {
+              other.close()
+            }
+          }
+          throw failure
+        })
+      store.updateSettings({ theme: 'dark' })
+      const failed = expect(store.beginProfileMaintenance()).rejects.toBe(failure)
+      await started.promise
+      const final = expect(store.flushFinalOrThrowAsync()).rejects.toBe(failure)
+      release.resolve()
+      await Promise.all([failed, final])
+      expect(checkpoint).toHaveBeenCalledOnce()
+      expect(readState()).toEqual(
+        kind === 'changed-source' ? { ...durable, peer: { preserved: true } } : durable
+      )
+    }
+  )
+})
diff --git a/src/main/persistence/loading-store/profile-state-maintenance-fixture.ts b/src/main/persistence/loading-store/profile-state-maintenance-fixture.ts
new file mode 100644
index 00000000000..ba36635cc9f
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-maintenance-fixture.ts
@@ -0,0 +1,112 @@
+import { build } from 'esbuild'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterAll, afterEach, beforeAll, vi } from 'vitest'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+import { ProfileStateSqliteAuthority } from '../profile-state/profile-state-sqlite-authority'
+import { ProfileStateWorkerAuthority } from '../profile-state/profile-state-worker-authority'
+import { Store } from './store'
+
+let bundleRoot: string
+let workerOptions: { workerPath: string; backupWorkerPath: string }
+const stores: Store[] = []
+const roots: string[] = []
+const releases: (() => void)[] = []
+type ProfileFixtureLocation = { directory: string; profileId: string; cleanupRoot?: string }
+
+beforeAll(async () => {
+  bundleRoot = mkdtempSync(join(tmpdir(), 'orca-maintenance-worker-'))
+  workerOptions = {
+    workerPath: join(bundleRoot, 'profile-state-writer-worker-entry.js'),
+    backupWorkerPath: join(bundleRoot, 'profile-state-backup-worker-entry.js')
+  }
+  await build({
+    entryPoints: [
+      resolve('src/main/persistence/profile-state/profile-state-writer-worker-entry.ts'),
+      resolve('src/main/persistence/profile-state/profile-state-backup-worker-entry.ts')
+    ],
+    outdir: bundleRoot,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    logLevel: 'silent'
+  })
+})
+
+afterEach(async () => {
+  for (const release of releases.splice(0)) {
+    release()
+  }
+  await Promise.all(stores.splice(0).map((store) => store.freezeWritesAsync().catch(() => {})))
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+})
+afterAll(() => rmSync(bundleRoot, { recursive: true, force: true }))
+
+export function maintenanceBarrier() {
+  const gate = Promise.withResolvers<void>()
+  releases.push(gate.resolve)
+  return gate
+}
+
+function paths(profile?: ProfileFixtureLocation) {
+  const directory = profile?.directory ?? mkdtempSync(join(tmpdir(), 'orca-maintenance-profile-'))
+  roots.push(profile?.cleanupRoot ?? directory)
+  return {
+    directory,
+    dataFile: join(directory, 'orca-data.json'),
+    databaseFile: join(directory, 'profile-state.db'),
+    profileId: profile?.profileId ?? 'maintenance-test'
+  }
+}
+
+export async function createWorkerMaintenanceFixture(
+  profile?: ProfileFixtureLocation,
+  onFailure?: (error: Error) => void
+) {
+  const input = paths(profile)
+  const bootstrap = new ProfileStateSqliteAuthority(input.databaseFile, input.profileId)
+  bootstrap.writeSerializedState(
+    Buffer.from(JSON.stringify(buildProfileStateCutoverFixture(input.directory)))
+  )
+  const state = bootstrap.readInitialState().takeParsedState?.()
+  const authority = new ProfileStateWorkerAuthority(bootstrap.retireForWorker(), {
+    ...workerOptions,
+    onFailure
+  })
+  await authority.ready
+  const store = new Store({
+    dataFile: input.dataFile,
+    profileStateAuthority: authority,
+    initialAuthorityState: { authority, takeParsedState: () => state }
+  })
+  stores.push(store)
+  const backup = vi.spyOn(authority, 'scheduleBackup').mockImplementation(() => {})
+  await store.flushPendingOrThrowAsync()
+  backup.mockRestore()
+  const peer = () => new ProfileStateSqliteAuthority(input.databaseFile, input.profileId)
+  const readState = () => {
+    const reader = peer()
+    try {
+      return JSON.parse(reader.readSerializedState() ?? '{}')
+    } finally {
+      reader.close()
+    }
+  }
+  return { ...input, store, authority, peer, readState }
+}
+
+export function createSqliteMaintenanceFixture() {
+  const input = paths()
+  const authority = new ProfileStateSqliteAuthority(input.databaseFile, input.profileId)
+  authority.writeSerializedState(
+    Buffer.from(JSON.stringify(buildProfileStateCutoverFixture(input.directory)))
+  )
+  const store = new Store({ dataFile: input.dataFile, profileStateAuthority: authority })
+  stores.push(store)
+  return { ...input, store, authority }
+}
diff --git a/src/main/persistence/loading-store/profile-state-maintenance-recovery.test.ts b/src/main/persistence/loading-store/profile-state-maintenance-recovery.test.ts
new file mode 100644
index 00000000000..84a849b3b26
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-maintenance-recovery.test.ts
@@ -0,0 +1,145 @@
+import { describe, expect, it, vi } from 'vitest'
+import * as backupWorker from '../profile-state/profile-state-backup-worker'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from './profile-state-maintenance-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+describe('failed maintenance recovery', () => {
+  it.each(['maintenance', 'final', 'freeze'] as const)(
+    '%s cancels an active backup after a routine flush completes',
+    async (kind) => {
+      const { store } = await createWorkerMaintenanceFixture()
+      const started = maintenanceBarrier()
+      const canceled = maintenanceBarrier()
+      vi.spyOn(backupWorker, 'runProfileStateBackupWorker').mockImplementationOnce(
+        async (_job, options) => {
+          started.resolve()
+          await new Promise<void>((resolve) =>
+            options?.signal?.addEventListener('abort', () => resolve(), { once: true })
+          )
+          canceled.resolve()
+          throw new Error('backup aborted')
+        }
+      )
+      await store.runDurableMutation(() => {
+        store.updateSettings({ theme: 'dark' })
+        return { value: undefined }
+      })
+      await started.promise
+      await store.flushPendingOrThrowAsync()
+      const stop =
+        kind === 'maintenance'
+          ? store.beginProfileMaintenance()
+          : kind === 'final'
+            ? store.flushFinalOrThrowAsync()
+            : store.freezeWritesAsync()
+      await canceled.promise
+      await stop
+    }
+  )
+
+  it('cancels between checkpoints without aborting an acknowledged write', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const write = authority.writeCompleteSerializedDomains.bind(authority)
+    vi.spyOn(authority, 'writeCompleteSerializedDomains').mockImplementationOnce(
+      async (domains) => {
+        started.resolve()
+        await release.promise
+        await write(domains)
+      }
+    )
+    const abort = vi.spyOn(authority, 'abort')
+    const controller = new AbortController()
+    store.updateSettings({ theme: 'dark' })
+    const pending = store.beginProfileMaintenance({ signal: controller.signal })
+    const rejected = expect(pending).rejects.toThrow('aborted')
+    await started.promise
+    controller.abort()
+    release.resolve()
+    await rejected
+    expect(abort).not.toHaveBeenCalled()
+    store.setWorkspaceSession({ ...store.getWorkspaceSession(), activeTabId: 'after-cancellation' })
+    await store.flushPendingOrThrowAsync()
+    expect(readState()).toMatchObject({
+      settings: { theme: 'dark' },
+      workspaceSession: { activeTabId: 'after-cancellation' }
+    })
+  })
+
+  it('restores the writer and snapshot admission after a known failed checkpoint', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    vi.spyOn(authority, 'writeCompleteSerializedDomains').mockRejectedValueOnce(
+      new Error('disk refused')
+    )
+    store.updateSettings({ theme: 'dark' })
+    await expect(store.beginProfileMaintenance()).rejects.toThrow('disk refused')
+
+    store.setWorkspaceSession({ ...store.getWorkspaceSession(), activeTabId: 'after-failure' })
+    await store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'light' })
+      return { value: undefined }
+    })
+    expect(readState()).toMatchObject({
+      settings: { theme: 'light' },
+      workspaceSession: { activeTabId: 'after-failure' }
+    })
+    await (await store.beginProfileMaintenance()).resume()
+  })
+
+  it('keeps changed storage fenced when recovering a known failure', async () => {
+    const { store, authority, peer, readState } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    store.updateSettings({ theme: 'dark' })
+    vi.spyOn(authority, 'writeCompleteSerializedDomains').mockImplementationOnce(async () => {
+      const writer = peer()
+      writer.writeSerializedDomains([{ domain: 'peer', payload: '{"preserved":true}' }])
+      writer.close()
+      throw new Error('disk refused')
+    })
+    await expect(store.beginProfileMaintenance()).rejects.toThrow('disk refused')
+    await expect(store.runDurableMutation(() => ({ value: undefined }))).rejects.toThrow(
+      'finalized'
+    )
+    expect(readState().peer).toEqual({ preserved: true })
+  })
+
+  it('does not extend the maintenance checkpoint for unadmitted saves', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    store.updateSettings({ theme: 'dark' })
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const write = authority.writeCompleteSerializedDomains.bind(authority)
+    const checkpoint = vi
+      .spyOn(authority, 'writeCompleteSerializedDomains')
+      .mockImplementationOnce(async (domains) => {
+        started.resolve()
+        await release.promise
+        await write(domains)
+      })
+    const pending = store.beginProfileMaintenance()
+    await started.promise
+    for (let terminalFontSize = 12; terminalFontSize < 32; terminalFontSize++) {
+      store.updateSettings({ terminalFontSize })
+    }
+    release.resolve()
+    const maintenance = await pending
+    expect(checkpoint).toHaveBeenCalledOnce()
+    await maintenance.resume()
+    await store.flushPendingOrThrowAsync()
+    expect(readState().settings.terminalFontSize).toBe(31)
+  })
+})
diff --git a/src/main/persistence/loading-store/profile-state-maintenance.test.ts b/src/main/persistence/loading-store/profile-state-maintenance.test.ts
new file mode 100644
index 00000000000..62b785ce7f9
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-maintenance.test.ts
@@ -0,0 +1,301 @@
+import { ProfileStateSqliteAuthority } from '../profile-state/profile-state-sqlite-authority'
+import { readFileSync } from 'node:fs'
+import { describe, expect, it, vi } from 'vitest'
+import { ActiveViewPreference, getActiveViewPreferenceFile } from '../../active-view-preference'
+import * as backupWorker from '../profile-state/profile-state-backup-worker'
+import { profileStateDatabaseBackups } from '../profile-state/profile-state-backup-path'
+import {
+  createSqliteMaintenanceFixture,
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from './profile-state-maintenance-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+describe('profile maintenance admission', () => {
+  it('drains accepted writes and captures newer edits after blocking new durable operations', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const gate = maintenanceBarrier()
+    const started = maintenanceBarrier()
+    const write = authority.writeSerializedDomains.bind(authority)
+    vi.spyOn(authority, 'writeSerializedDomains').mockImplementationOnce(async (domains) => {
+      started.resolve()
+      await gate.promise
+      await write(domains)
+    })
+    const accepted = store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'dark' })
+      return { value: 'accepted' }
+    })
+    await started.promise
+    const stopped = vi.spyOn(authority, 'close')
+    const paused = store.beginProfileMaintenance()
+    const refused = vi.fn(() => ({ value: undefined }))
+    await expect(store.runDurableMutation(refused)).rejects.toThrow('finalized')
+    expect(refused).not.toHaveBeenCalled()
+    await expect(store.flushPendingOrThrowAsync()).rejects.toThrow('finalized')
+    await expect(store.writeLatestProfileStateJsonExportAsync()).rejects.toThrow('finalized')
+    expect(() => store.stageWorkspaceSessionBeforeUnload(store.getWorkspaceSession())).toThrow(
+      'maintenance'
+    )
+    store.updateSettings({ theme: 'light' })
+    store.getWorkspaceSession().activeTabId = 'during-maintenance'
+    expect(stopped).not.toHaveBeenCalled()
+    gate.resolve()
+    await expect(accepted).resolves.toBe('accepted')
+    const maintenance = await paused
+    expect(stopped).toHaveBeenCalledOnce()
+    expect(readState()).toMatchObject({
+      settings: { theme: 'light' },
+      workspaceSession: { activeTabId: 'during-maintenance' }
+    })
+    store.updateSettings({ theme: 'dark' })
+    await maintenance.resume()
+    await store.flushPendingOrThrowAsync()
+    expect(readState().settings.theme).toBe('dark')
+    await expect(maintenance.resume()).rejects.toThrow('finalization')
+  })
+
+  it('refuses re-admission after a competing write without adopting its revision', async () => {
+    const { store, peer, readState } = await createWorkerMaintenanceFixture()
+    store.updateSettings({ theme: 'dark' })
+    const maintenance = await store.beginProfileMaintenance()
+    const writer = peer()
+    try {
+      writer.readSerializedState()
+      writer.writeSerializedDomains([{ domain: 'peer', payload: '{"preserved":true}' }])
+    } finally {
+      writer.close()
+    }
+    await expect(maintenance.resume()).rejects.toThrow('Profile state revision changed')
+    const mutate = vi.fn(() => ({ value: undefined }))
+    await expect(store.runDurableMutation(mutate)).rejects.toThrow('finalized')
+    expect(mutate).not.toHaveBeenCalled()
+    expect(readState().peer).toEqual({ preserved: true })
+  })
+
+  it.each(['maintenance', 'freeze', 'final'] as const)(
+    '%s waits for an admitted flush between SQL passes',
+    async (kind) => {
+      const { store, authority, readState } = await createWorkerMaintenanceFixture()
+      const started = maintenanceBarrier()
+      const release = maintenanceBarrier()
+      vi.spyOn(ActiveViewPreference.prototype, 'flushPendingAsync').mockImplementationOnce(
+        async () => {
+          started.resolve()
+          await release.promise
+        }
+      )
+      store.updateSettings({ theme: 'dark' })
+      const older = store.flushPendingOrThrowAsync()
+      await started.promise
+      store.updateSettings({ theme: 'light' })
+      const capture = vi.spyOn(authority, 'writeCompleteSerializedDomains')
+      const close = vi.spyOn(authority, 'close')
+      const paused =
+        kind === 'maintenance'
+          ? store.beginProfileMaintenance()
+          : kind === 'freeze'
+            ? store.freezeWritesAsync()
+            : store.flushFinalOrThrowAsync()
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(capture).not.toHaveBeenCalled()
+      expect(close).not.toHaveBeenCalled()
+      release.resolve()
+      await older
+      await paused
+      expect(close).toHaveBeenCalled()
+      expect(readState().settings.theme).toBe('light')
+    }
+  )
+
+  it.each(['maintenance', 'freeze', 'final'] as const)(
+    '%s waits for accepted retries after another flush reports a known failure',
+    async (kind) => {
+      const { store, authority, readState } = await createWorkerMaintenanceFixture()
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      const started = maintenanceBarrier()
+      const release = maintenanceBarrier()
+      vi.spyOn(ActiveViewPreference.prototype, 'flushPendingAsync').mockImplementationOnce(
+        async () => {
+          started.resolve()
+          await release.promise
+        }
+      )
+      store.updateSettings({ theme: 'dark' })
+      const accepted = store.flushPendingOrThrowAsync()
+      await started.promise
+      store.updateSettings({ theme: 'light' })
+      const failureStarted = maintenanceBarrier()
+      const fail = maintenanceBarrier()
+      vi.spyOn(authority, 'writeSerializedDomains').mockImplementationOnce(async () => {
+        failureStarted.resolve()
+        await fail.promise
+        throw new Error('disk refused')
+      })
+      const failed = expect(
+        store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+      ).rejects.toThrow('disk refused')
+      await failureStarted.promise
+      const close = vi.spyOn(authority, 'close')
+      const paused =
+        kind === 'maintenance'
+          ? store.beginProfileMaintenance()
+          : kind === 'freeze'
+            ? store.freezeWritesAsync()
+            : store.flushFinalOrThrowAsync()
+      fail.resolve()
+      await failed
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(close).not.toHaveBeenCalled()
+      release.resolve()
+      await accepted
+      await paused
+      expect(close).toHaveBeenCalledOnce()
+      expect(readState().settings.theme).toBe('light')
+    }
+  )
+
+  it('cancels a backup and waits for its worker to exit before releasing maintenance', async () => {
+    const { store, authority, databaseFile } = await createWorkerMaintenanceFixture()
+    const started = maintenanceBarrier()
+    const canceled = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    vi.spyOn(backupWorker, 'runProfileStateBackupWorker').mockImplementationOnce(
+      async (_job, options) => {
+        started.resolve()
+        await new Promise<void>((resolve) =>
+          options?.signal?.addEventListener('abort', () => resolve(), { once: true })
+        )
+        canceled.resolve()
+        await release.promise
+        throw new Error('backup aborted')
+      }
+    )
+    await store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'dark' })
+      return { value: undefined }
+    })
+    await started.promise
+    const close = vi.spyOn(authority, 'close')
+    const paused = store.beginProfileMaintenance()
+    let done = false
+    void paused.then(() => {
+      done = true
+    })
+    await canceled.promise
+    expect(done).toBe(false)
+    expect(close).not.toHaveBeenCalled()
+    release.resolve()
+    await paused
+    expect(close).toHaveBeenCalledOnce()
+    expect(profileStateDatabaseBackups(databaseFile)).toHaveLength(0)
+  })
+
+  it('drains an accepted flush before rejecting canceled maintenance', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    vi.spyOn(ActiveViewPreference.prototype, 'flushPendingAsync').mockImplementationOnce(
+      async () => {
+        started.resolve()
+        await release.promise
+      }
+    )
+    store.updateSettings({ theme: 'dark' })
+    const accepted = store.flushPendingOrThrowAsync()
+    await started.promise
+    store.updateSettings({ theme: 'light' })
+    const close = vi.spyOn(authority, 'close')
+    const controller = new AbortController()
+    controller.abort()
+    const rejected = expect(
+      store.beginProfileMaintenance({ signal: controller.signal })
+    ).rejects.toThrow('aborted')
+    await new Promise<void>((resolve) => setImmediate(resolve))
+    expect(close).not.toHaveBeenCalled()
+    release.resolve()
+    await accepted
+    await rejected
+    expect(close).toHaveBeenCalledOnce()
+    expect(readState().settings.theme).toBe('light')
+  })
+
+  it('joins an ongoing maintenance close at final shutdown without reopening or rewriting', async () => {
+    const { store, authority } = await createWorkerMaintenanceFixture()
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const close = authority.close.bind(authority)
+    vi.spyOn(authority, 'close').mockImplementationOnce(async () => {
+      started.resolve()
+      await release.promise
+      await close()
+    })
+    const paused = store.beginProfileMaintenance()
+    await started.promise
+    const write = vi.spyOn(authority, 'writeCompleteSerializedDomains')
+    const final = store.flushFinalOrThrowAsync()
+    release.resolve()
+    const maintenance = await paused
+    await final
+    expect(write).not.toHaveBeenCalled()
+    await expect(maintenance.resume()).rejects.toThrow('finalization')
+  })
+
+  it('quarantines a faulted worker only after closing it, without writing current memory', async () => {
+    const { store, authority, directory, readState } = await createWorkerMaintenanceFixture()
+    const durable = readState()
+    store.updateSettings({ theme: durable.settings.theme === 'dark' ? 'light' : 'dark' })
+    await authority.abort()
+    const result = await store.quarantineProfileStateDatabaseAsync(directory, 'worker-failure')
+    expect(result.copiedFiles.some((path) => path.endsWith('profile-state.db'))).toBe(true)
+    expect(readState()).toEqual(durable)
+    await expect(store.flushPendingOrThrowAsync()).rejects.toThrow('finalized')
+  })
+
+  it('never provides a resume token after a faulted normal-maintenance attempt', async () => {
+    const { store, authority } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    await authority.abort()
+    await expect(store.beginProfileMaintenance()).rejects.toThrow('aborted')
+    await expect(store.beginProfileMaintenance()).rejects.toThrow('already stopped')
+  })
+
+  it('pauses SQLite and preference timers, then persists edits after unchanged-source resume', async () => {
+    const { store, dataFile, authority } = createSqliteMaintenanceFixture()
+    const maintenance = await store.beginProfileMaintenance()
+    const before = authority.readSerializedState()
+    const preference = getActiveViewPreferenceFile(dataFile)
+    const preferenceBefore = readFileSync(preference)
+    vi.useFakeTimers()
+    store.updateSettings({ theme: 'dark' })
+    store.updateUI({ activeView: 'settings' })
+    await vi.advanceTimersByTimeAsync(6_000)
+    expect(authority.readSerializedState()).toEqual(before)
+    expect(readFileSync(preference)).toEqual(preferenceBefore)
+    vi.useRealTimers()
+    await maintenance.resume()
+    await store.flushPendingOrThrowAsync()
+    expect(JSON.parse(authority.readSerializedState() ?? '{}').settings.theme).toBe('dark')
+    expect(JSON.parse(readFileSync(preference, 'utf8')).activeView).toBe('settings')
+  })
+
+  it('refuses synchronous SQL resume if the source changed during maintenance', async () => {
+    const { store, databaseFile, profileId } = createSqliteMaintenanceFixture()
+    const maintenance = await store.beginProfileMaintenance()
+    const peer = new ProfileStateSqliteAuthority(databaseFile, profileId)
+    peer.readSerializedState()
+    peer.writeSerializedDomains([{ domain: 'peer', payload: 'true' }])
+    peer.close()
+    await expect(maintenance.resume()).rejects.toThrow('Profile state revision changed')
+    await expect(store.flushPendingOrThrowAsync()).rejects.toThrow('finalized')
+    expect(JSON.parse(peer.readSerializedState() ?? '{}').peer).toBe(true)
+  })
+})
diff --git a/src/main/persistence/loading-store/profile-state-maintenance.ts b/src/main/persistence/loading-store/profile-state-maintenance.ts
new file mode 100644
index 00000000000..fe1c0f79d80
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-maintenance.ts
@@ -0,0 +1,172 @@
+import { profileStateWriterFailureOutcome } from '../profile-state/profile-state-writer-errors'
+import type { ProfileStateMaintenance } from './profile-state-authority'
+import type { StoreDomains } from './store-domain-composition'
+import type { StoreRuntimeState } from './store-runtime-state'
+import { drainProfileStateOperations } from './profile-state-flush-lifetime'
+import { flushCurrentStateAsync } from './write-flush-barriers'
+import { scheduleSave } from './write-scheduling'
+
+export type ProfileStateMaintenanceOptions = {
+  signal?: AbortSignal
+  /** Recovery must preserve the existing database even when its state cannot be flushed. */
+  flush?: boolean
+}
+
+export function freezeProfileStateWrites(runtime: StoreRuntimeState): void {
+  if (runtime.profileStateAuthority?.asynchronous) {
+    throw new Error('Live profile persistence requires an awaited close')
+  }
+  runtime.writesFrozen = true
+  if (runtime.writeTimer) {
+    clearTimeout(runtime.writeTimer)
+    runtime.writeTimer = null
+  }
+  runtime.profileStateAuthority?.close?.()
+}
+
+export async function freezeProfileStateWritesAsync(runtime: StoreRuntimeState): Promise<void> {
+  runtime.quitFlushStarted = true
+  if (runtime.writeTimer) {
+    clearTimeout(runtime.writeTimer)
+    runtime.writeTimer = null
+  }
+  try {
+    await drainProfileStateOperations([
+      runtime.pendingProfileMaintenance,
+      runtime.activeViewPreference.flushAsync(),
+      drainProfileFileWork(runtime)
+    ])
+  } finally {
+    runtime.writesFrozen = true
+    await runtime.profileStateAuthority?.close?.()
+  }
+}
+
+/** Stop admission before the first await; only unchanged-source maintenance may resume. */
+export function beginProfileStateMaintenance(
+  runtime: StoreRuntimeState,
+  domains: StoreDomains,
+  options: ProfileStateMaintenanceOptions = {}
+): Promise<ProfileStateMaintenance> {
+  if (runtime.profileMaintenancePending || runtime.quitFlushStarted || runtime.writesFrozen) {
+    return Promise.reject(new Error('Profile persistence is already stopped for maintenance'))
+  }
+  runtime.profileMaintenancePending = true
+  if (runtime.writeTimer) {
+    clearTimeout(runtime.writeTimer)
+    runtime.writeTimer = null
+  }
+  const resumePreference = runtime.activeViewPreference.pauseForMaintenance()
+  const resumeScheduling = () => {
+    runtime.writesFrozen = false
+    runtime.profileMaintenancePending = false
+    runtime.pendingProfileMaintenance = null
+    resumePreference()
+    scheduleSave(domains.scheduling)
+  }
+  const paused = pauseProfileState(runtime, domains, options).then((authority) => {
+    let consumed = false
+    return {
+      resume: async () => {
+        if (consumed || runtime.quitFlushStarted || !runtime.profileMaintenancePending) {
+          throw new Error('Profile persistence cannot resume after finalization')
+        }
+        consumed = true
+        await authority.resume()
+        if (runtime.quitFlushStarted) {
+          await runtime.profileStateAuthority?.close?.()
+          throw new Error('Profile persistence finalized during maintenance admission')
+        }
+        resumeScheduling()
+      }
+    }
+  })
+  const recoverable = paused.catch(async (error: unknown) => {
+    if (await canResumeFailedMaintenance(runtime, options, error)) {
+      resumeScheduling()
+    } else {
+      runtime.writesFrozen = true
+      await runtime.profileStateAuthority?.close?.()
+    }
+    throw error
+  })
+  runtime.pendingProfileMaintenance = recoverable.then(() => {})
+  void runtime.pendingProfileMaintenance.catch(() => {})
+  return recoverable
+}
+
+async function canResumeFailedMaintenance(
+  runtime: StoreRuntimeState,
+  options: ProfileStateMaintenanceOptions,
+  error: unknown
+): Promise<boolean> {
+  try {
+    await drainProfileFileWork(runtime)
+    if (
+      options.flush === false ||
+      runtime.writesFrozen ||
+      profileStateWriterFailureOutcome(error) === 'indeterminate'
+    ) {
+      return false
+    }
+    const authority = runtime.profileStateAuthority
+    if (authority?.asynchronous) {
+      authority.assertWritable()
+    }
+    await (authority?.pauseForMaintenance
+      ? (await authority.pauseForMaintenance()).resume()
+      : authority?.assertCurrentRevision?.())
+    return true
+  } catch {
+    return false
+  }
+}
+
+async function pauseProfileState(
+  runtime: StoreRuntimeState,
+  domains: StoreDomains,
+  { signal, flush = true }: ProfileStateMaintenanceOptions
+): Promise<ProfileStateMaintenance> {
+  const authority = runtime.profileStateAuthority
+  signal?.throwIfAborted()
+  await drainProfileFileWork(runtime)
+  signal?.throwIfAborted()
+  if (flush) {
+    // Cancel between commands so a dispatched commit retains a known outcome.
+    await flushCurrentStateAsync(domains.flushBarriers, {
+      requireInitialGenerationDurable: true,
+      fullCheckpoint: true
+    })
+    signal?.throwIfAborted()
+    await authority?.writeJsonCompatibilityExportAsync?.(runtime.dataFile)
+  }
+  signal?.throwIfAborted()
+  runtime.writesFrozen = true
+  if (!flush) {
+    await authority?.close?.()
+    return {
+      resume: async () => {
+        throw new Error('Recovery maintenance requires reloading the profile')
+      }
+    }
+  }
+  if (authority?.pauseForMaintenance) {
+    return authority.pauseForMaintenance()
+  }
+  await authority?.close?.()
+  throw new Error('Profile authority cannot safely resume from maintenance')
+}
+
+async function drainProfileFileWork(runtime: StoreRuntimeState): Promise<void> {
+  await drainProfileStateOperations([
+    ...runtime.pendingProfileFlushes,
+    runtime.staleProfileStateTempCleanup,
+    runtime.pendingWrite,
+    runtime.pendingSnapshotFileWork,
+    runtime.pendingGithubCacheWrite,
+    runtime.activeViewPreference.waitForPendingWrite(),
+    runtime.profileStateAuthority?.drainBackups?.(
+      runtime.profileMaintenancePending || runtime.quitFlushStarted
+    )
+  ])
+}
diff --git a/src/main/persistence/loading-store/profile-state-pty-retirement-finalization.test.ts b/src/main/persistence/loading-store/profile-state-pty-retirement-finalization.test.ts
new file mode 100644
index 00000000000..3fe64562997
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-pty-retirement-finalization.test.ts
@@ -0,0 +1,199 @@
+import { describe, expect, it, vi } from 'vitest'
+import { toSshExecutionHostId } from '../../../shared/execution-host'
+import { retirePersistedStablePaneOwner } from '../../ipc/pty/pane/stable-owner'
+import { TEST_LEAF_1 } from '../../persistence-session-fixtures'
+import { ProfileStateWriterError } from '../profile-state/profile-state-writer-errors'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from './profile-state-maintenance-fixture'
+import type { Store } from './store'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'finalizing-retirement-tab',
+  leafId: TEST_LEAF_1,
+  ptyId: 'finalizing-retirement-pty',
+  incarnationId: 'finalizing-retirement-incarnation'
+}
+
+function retire(store: Store, connectionId?: string) {
+  return retirePersistedStablePaneOwner(
+    store,
+    { ...binding, persistedIncarnationId: binding.incarnationId },
+    binding.worktreeId,
+    connectionId
+  )
+}
+
+function assertNewSnapshotsRefused(store: Store) {
+  const session = store.getWorkspaceSession()
+  expect(() => store.setWorkspaceSession(session)).toThrow('blocking new terminal snapshot work')
+  expect(() => store.stageWorkspaceSessionBeforeUnload(session)).toThrow(
+    'blocking new terminal snapshot work'
+  )
+}
+
+describe.each([
+  ['running', undefined],
+  ['maintenance', undefined],
+  ['freeze', undefined],
+  ['final', undefined],
+  ['running', 'retirement-ssh'],
+  ['maintenance', 'retirement-ssh'],
+  ['freeze', 'retirement-ssh'],
+  ['final', 'retirement-ssh']
+] as const)('admitted terminal retirement during %s on host %s', (kind, connectionId) => {
+  const hostId = connectionId ? toSshExecutionHostId(connectionId) : undefined
+  const persistedSession = (
+    readState: Awaited<ReturnType<typeof createWorkerMaintenanceFixture>>['readState']
+  ) => {
+    const state = readState()
+    return hostId ? state.workspaceSessionsByHostId[hostId] : state.workspaceSession
+  }
+  const stop = (store: Store) =>
+    kind === 'maintenance'
+      ? store.beginProfileMaintenance()
+      : kind === 'freeze'
+        ? store.freezeWritesAsync()
+        : kind === 'final'
+          ? store.flushFinalOrThrowAsync()
+          : Promise.resolve()
+  const assertSnapshotAdmission = (store: Store) => {
+    if (kind !== 'running') {
+      assertNewSnapshotsRefused(store)
+    }
+  }
+
+  it('persists an accepted queued retirement while refusing new snapshots', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    await store.persistPtyBinding(binding, hostId)
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const write = authority.writeSerializedDomains.bind(authority)
+    vi.spyOn(authority, 'writeSerializedDomains').mockImplementationOnce(async (domains) => {
+      started.resolve()
+      await release.promise
+      await write(domains)
+    })
+    store.updateSettings({ theme: 'dark' })
+    const previous = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await started.promise
+    const accepted = retire(store, connectionId).then(
+      (value) => ({ value }),
+      (error: unknown) => ({ error })
+    )
+    const stopping = stop(store)
+    assertSnapshotAdmission(store)
+    release.resolve()
+    await previous
+    await stopping
+    expect(await accepted).toEqual({ value: true })
+    expect(persistedSession(readState).terminalLayoutsByTabId[binding.tabId]).toBeUndefined()
+    assertSnapshotAdmission(store)
+  })
+
+  it('finishes a failed retirement rollback before closing its writer', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    await store.persistPtyBinding(binding, hostId)
+    const original = structuredClone(store.getWorkspaceSession(hostId))
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const failure = new ProfileStateWriterError(
+      'test-disk-failure',
+      'retirement disk refused',
+      'known-failure'
+    )
+    vi.spyOn(authority, 'writeSerializedDomains').mockImplementationOnce(async () => {
+      started.resolve()
+      await release.promise
+      throw failure
+    })
+    const rejected = retire(store, connectionId).catch((error: unknown) => error)
+    await started.promise
+    expect(store.getWorkspaceSession(hostId).terminalLayoutsByTabId[binding.tabId]).toBeUndefined()
+    store.getWorkspaceSession(hostId).activeTabId = 'newer-active-tab'
+    const stopping = stop(store)
+    assertSnapshotAdmission(store)
+    release.resolve()
+    await stopping
+    expect(await rejected).toBe(failure)
+    expect(store.getWorkspaceSession(hostId)).toEqual({
+      ...original,
+      activeTabId: 'newer-active-tab'
+    })
+    expect(persistedSession(readState).terminalLayoutsByTabId[binding.tabId]).toEqual(
+      original.terminalLayoutsByTabId[binding.tabId]
+    )
+    assertSnapshotAdmission(store)
+  })
+})
+
+describe.each(['mutate', 'rollback'] as const)('admitted %s scope', (phase) => {
+  it('preserves durable state and refuses later saves after a callback partially mutates then throws', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const original = readState()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const failure = new Error('callback failed')
+    if (phase === 'rollback') {
+      vi.spyOn(authority, 'writeSerializedDomains').mockRejectedValueOnce(new Error('disk refused'))
+    }
+    await expect(
+      store.runDurableMutation(() => {
+        store.updateSettings({ theme: 'dark' })
+        if (phase === 'mutate') {
+          throw failure
+        }
+        return {
+          value: undefined,
+          rollback: () => {
+            throw failure
+          }
+        }
+      })
+    ).rejects.toBe(failure)
+    assertNewSnapshotsRefused(store)
+    await expect(store.runDurableMutation(() => ({ value: undefined }))).rejects.toThrow(
+      'finalized'
+    )
+    await expect(store.flushFinalOrThrowAsync()).rejects.toBe(failure)
+    expect(readState()).toEqual(original)
+  })
+})
+
+it('rejects an already admitted final flush after a queued callback partially mutates then throws', async () => {
+  const { store, authority, readState } = await createWorkerMaintenanceFixture()
+  vi.spyOn(console, 'error').mockImplementation(() => {})
+  const started = maintenanceBarrier()
+  const release = maintenanceBarrier()
+  const write = authority.writeSerializedDomains.bind(authority)
+  vi.spyOn(authority, 'writeSerializedDomains').mockImplementationOnce(async (domains) => {
+    started.resolve()
+    await release.promise
+    await write(domains)
+  })
+  store.updateSettings({ theme: 'dark' })
+  const previous = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+  await started.promise
+  const failure = new Error('partial edit failed')
+  const mutation = store.runDurableMutation(() => {
+    store.updateSettings({ theme: 'light' })
+    throw failure
+  })
+  const rejectedMutation = expect(mutation).rejects.toBe(failure)
+  const rejectedFinal = expect(store.flushFinalOrThrowAsync()).rejects.toBe(failure)
+  release.resolve()
+  await Promise.all([previous, rejectedMutation, rejectedFinal])
+  expect(readState().settings.theme).toBe('dark')
+})
diff --git a/src/main/persistence/loading-store/profile-state-selective-serialization.test.ts b/src/main/persistence/loading-store/profile-state-selective-serialization.test.ts
new file mode 100644
index 00000000000..acb8c0f3105
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-selective-serialization.test.ts
@@ -0,0 +1,272 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { getDefaultPersistedState } from '../../../shared/constants'
+import { ProtectedSecretPersistence } from '../../protected-secret-persistence'
+import { serializeSelectiveProfileStateDomains } from './profile-state-authority-writes'
+import { StateSerializationSecretHandlingOperations } from './state-serialization-secret-handling'
+
+function previousReplacements(state: Record<string, unknown>, domains: ReadonlySet<string>) {
+  const parsed: unknown = JSON.parse(Buffer.from(JSON.stringify(state), 'utf8').toString('utf8'))
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    throw new Error('Profile state payload must be a JSON object')
+  }
+  const entries = new Map(Object.entries(parsed))
+  return [...domains].map((domain) => ({
+    domain,
+    payload: entries.has(domain) ? JSON.stringify(entries.get(domain)) : null
+  }))
+}
+
+afterEach(() => vi.restoreAllMocks())
+
+describe('selective profile domain serialization', () => {
+  it('preserves deletion, JSON null, primitive roots, and escaped property values', () => {
+    const escapedDomain = '雪"\\\ud800'
+    const state = Object.fromEntries([
+      ['undefined', undefined],
+      ['function', () => 'omitted'],
+      ['symbol', Symbol('omitted')],
+      ['null', null],
+      ['string', '雪😀\ud800\n"\\'],
+      ['number', -0],
+      ['nan', Number.NaN],
+      ['infinity', Infinity],
+      ['false', false],
+      ['array', [undefined, null, Number.NaN, Symbol('omitted'), () => 'omitted']],
+      ['date', new Date('2026-09-26T00:00:00Z')],
+      ['__proto__', { own: true }],
+      [escapedDomain, { '2': 'two', '1': 'one', omitted: undefined }]
+    ])
+    const domains = new Set([...Object.keys(state).toReversed(), 'missing', 'constructor'])
+
+    expect(serializeSelectiveProfileStateDomains(state, domains)).toEqual(
+      previousReplacements(state, domains)
+    )
+    expect(serializeSelectiveProfileStateDomains(state, new Set(['undefined', 'null']))).toEqual([
+      { domain: 'undefined', payload: null },
+      { domain: 'null', payload: 'null' }
+    ])
+  })
+
+  it('passes the same keys and receiver to toJSON exactly once in state property order', () => {
+    const calls: string[] = []
+    const first = {
+      text: 'before',
+      toJSON(key: string) {
+        expect(this).toBe(first)
+        calls.push(key)
+        second.text = 'after'
+        return {
+          text: this.text,
+          child: { toJSON: (childKey: string) => childKey }
+        }
+      }
+    }
+    const second = {
+      text: 'before',
+      toJSON(key: string) {
+        expect(this).toBe(second)
+        calls.push(key)
+        return this.text
+      }
+    }
+    const omitted = { toJSON: (key: string) => void calls.push(key) }
+    const state = { first, second, omitted }
+    const domains = new Set(['second', 'omitted', 'first'])
+    const expected = previousReplacements(state, domains)
+    calls.length = 0
+    second.text = 'before'
+
+    expect(serializeSelectiveProfileStateDomains(state, domains)).toEqual(expected)
+    expect(calls).toEqual(['first', 'second', 'omitted'])
+  })
+
+  it('still rejects cyclic and BigInt state before handing anything to the authority', () => {
+    const cyclic: Record<string, unknown> = {}
+    cyclic.self = cyclic
+    for (const value of [cyclic, 1n]) {
+      expect(() =>
+        serializeSelectiveProfileStateDomains({ session: value }, new Set(['session']))
+      ).toThrow(TypeError)
+    }
+  })
+
+  it('reads later domains after earlier toJSON hooks replace or delete them', () => {
+    const buildState = () => {
+      const state: Record<string, unknown> = {
+        first: {
+          toJSON() {
+            state.replaced = { text: 'after' }
+            delete state.deleted
+            state.added = 'outside the captured keys'
+            return 'first'
+          }
+        },
+        replaced: { text: 'before' },
+        deleted: 'before'
+      }
+      return state
+    }
+    const domains = new Set(['deleted', 'replaced', 'first', 'added'])
+    const expected = previousReplacements(buildState(), domains)
+
+    expect(expected).toEqual([
+      { domain: 'deleted', payload: null },
+      { domain: 'replaced', payload: '{"text":"after"}' },
+      { domain: 'first', payload: '"first"' },
+      { domain: 'added', payload: null }
+    ])
+    expect(serializeSelectiveProfileStateDomains(buildState(), domains)).toEqual(expected)
+  })
+
+  it('interleaves domain getters and toJSON hooks in JSON property order', () => {
+    const buildState = (calls: string[]) => {
+      let text = 'before'
+      return {
+        get first() {
+          calls.push('get first')
+          return {
+            toJSON() {
+              calls.push('serialize first')
+              text = 'after'
+              return 'first'
+            }
+          }
+        },
+        get second() {
+          calls.push('get second')
+          return text
+        }
+      }
+    }
+    const domains = new Set(['first', 'second'])
+    const expectedCalls: string[] = []
+    const expected = previousReplacements(buildState(expectedCalls), domains)
+    const actualCalls: string[] = []
+
+    expect(serializeSelectiveProfileStateDomains(buildState(actualCalls), domains)).toEqual(
+      expected
+    )
+    expect(actualCalls).toEqual(expectedCalls)
+    expect(actualCalls).toEqual(['get first', 'serialize first', 'get second'])
+  })
+
+  it.each(['1.0', '1e999', '9007199254740993', '"\\u0061"', '"\ud800"', '"\\uD800"'])(
+    'normalizes raw JSON from a production domain hook like the previous path: %s',
+    (raw) => {
+      if (!('rawJSON' in JSON) || typeof JSON.rawJSON !== 'function') {
+        throw new Error('This test requires native JSON.rawJSON support')
+      }
+      const rawValue: unknown = JSON.rawJSON(raw)
+      const state = getDefaultPersistedState('/synthetic-profile')
+      const serialize = vi.fn(() => ({ ...state.workspaceSession, extension: rawValue }))
+      Object.defineProperty(state.workspaceSession, 'toJSON', { value: serialize })
+      const domains = new Set(['workspaceSession'])
+      const expected = previousReplacements({ workspaceSession: state.workspaceSession }, domains)
+      serialize.mockClear()
+      const serialization = new StateSerializationSecretHandlingOperations({
+        state,
+        protectedSecrets: new ProtectedSecretPersistence()
+      })
+
+      expect(serialization.buildStateDomainsToSave(domains)?.replacements).toEqual(expected)
+      expect(serialize).toHaveBeenCalledExactlyOnceWith('workspaceSession')
+    }
+  )
+
+  it('normalizes proxy key order without re-running its getters or toJSON', () => {
+    const read = vi.fn(() => 'one')
+    const value = new Proxy(
+      {
+        get 1() {
+          return read()
+        },
+        2: 'two'
+      },
+      { ownKeys: () => ['2', '1'] }
+    )
+    const serialize = vi.fn(() => value)
+    const state = { workspaceSession: { child: { toJSON: serialize } } }
+    const domains = new Set(['workspaceSession'])
+    const expected = previousReplacements(state, domains)
+    read.mockClear()
+    serialize.mockClear()
+
+    expect(serializeSelectiveProfileStateDomains(state, domains)).toEqual(expected)
+    expect(read).toHaveBeenCalledOnce()
+    expect(serialize).toHaveBeenCalledExactlyOnceWith('child')
+  })
+
+  it('captures production domain references before hooks replace runtime fields', () => {
+    const state = getDefaultPersistedState('/synthetic-profile')
+    state.worktreeIdentityAliases = { captured: ['identity'] }
+    const capturedAliases = state.worktreeIdentityAliases
+    const capturedAutomations = state.automations
+    Object.defineProperty(state.workspaceSession, 'toJSON', {
+      value: () => {
+        state.automations = []
+        delete state.worktreeIdentityAliases
+        return 'session'
+      }
+    })
+    const domains = new Set(['workspaceSession', 'automations', 'worktreeIdentityAliases'])
+    const serialization = new StateSerializationSecretHandlingOperations({
+      state,
+      protectedSecrets: new ProtectedSecretPersistence()
+    })
+
+    expect(serialization.buildStateDomainsToSave(domains)?.replacements).toEqual([
+      { domain: 'workspaceSession', payload: '"session"' },
+      { domain: 'automations', payload: JSON.stringify(capturedAutomations) },
+      { domain: 'worktreeIdentityAliases', payload: JSON.stringify(capturedAliases) }
+    ])
+    expect(state.automations).not.toBe(capturedAutomations)
+    expect(state.worktreeIdentityAliases).toBeUndefined()
+  })
+
+  it('serializes each selected domain once without an aggregate parse or UTF-8 buffer', () => {
+    const state = getDefaultPersistedState('/synthetic-profile')
+    state.workspaceSession.activeTabId = 'x'.repeat(200_000)
+    const serialization = new StateSerializationSecretHandlingOperations({
+      state,
+      protectedSecrets: new ProtectedSecretPersistence()
+    })
+    const domains = new Set(['workspaceSession', 'automations', 'worktreeIdentityAliases'])
+    const expected = previousReplacements(
+      {
+        workspaceSession: state.workspaceSession,
+        automations: state.automations
+      },
+      domains
+    )
+    const stringify = vi.spyOn(JSON, 'stringify')
+    const parse = vi.spyOn(JSON, 'parse')
+    const encode = vi.spyOn(Buffer, 'from')
+
+    const built = serialization.buildStateDomainsToSave(domains)
+    const stringifiedObjects = stringify.mock.calls
+      .map(([value]) => value)
+      .filter((value) => value !== null && typeof value === 'object')
+    const parseCount = parse.mock.calls.length
+    const encodeCount = encode.mock.calls.length
+    vi.restoreAllMocks()
+
+    expect(built?.replacements).toEqual(expected)
+    expect(stringifiedObjects.map((value) => Object.keys(value))).toEqual([
+      ['workspaceSession'],
+      ['automations']
+    ])
+    expect(parseCount).toBe(0)
+    expect(encodeCount).toBe(0)
+  })
+
+  it('retains the full-write fallback for unknown domains or pending secret encryption', () => {
+    const protectedSecrets = new ProtectedSecretPersistence()
+    const serialization = new StateSerializationSecretHandlingOperations({
+      state: getDefaultPersistedState('/synthetic-profile'),
+      protectedSecrets
+    })
+    expect(serialization.buildStateDomainsToSave(new Set(['future-domain']))).toBeUndefined()
+    vi.spyOn(protectedSecrets, 'hasPendingEncryption').mockReturnValue(true)
+    expect(serialization.buildStateDomainsToSave(new Set(['workspaceSession']))).toBeUndefined()
+  })
+})
diff --git a/src/main/persistence/loading-store/profile-state-selective-write.ts b/src/main/persistence/loading-store/profile-state-selective-write.ts
new file mode 100644
index 00000000000..286626c33c2
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-selective-write.ts
@@ -0,0 +1,98 @@
+import type { ProtectedSecretRetentionUpdate } from '../../protected-secret-persistence'
+import type {
+  ProfileStateAuthority,
+  ProfileStateDomainReplacement,
+  ProfileStatePersistenceAuthority
+} from './profile-state-authority'
+import type { StateSerializationSecretHandlingOperations } from './state-serialization-secret-handling'
+import type { AutomationRun } from '../../../shared/automations-types'
+
+export type SelectiveProfileStateWriteResult = {
+  handled: boolean
+  aborted: boolean
+  consumedAutomationRuns: boolean
+  protectedSecretUpdates: ProtectedSecretRetentionUpdate[]
+}
+
+export type PreparedSelectiveProfileStateWrite = {
+  replacements: ProfileStateDomainReplacement[]
+  automationRuns: readonly AutomationRun[] | undefined
+  consumedAutomationRuns: boolean
+  protectedSecretUpdates: ProtectedSecretRetentionUpdate[]
+}
+
+export function writeSelectiveProfileState(
+  authority: ProfileStateAuthority | undefined,
+  serialization: StateSerializationSecretHandlingOperations,
+  dirtyDomains: Set<string> | null,
+  pendingAutomationRunsAfter: readonly AutomationRun[] | undefined,
+  isCurrent?: () => boolean
+): SelectiveProfileStateWriteResult {
+  const prepared = prepareSelectiveProfileStateWrite(
+    authority,
+    serialization,
+    dirtyDomains,
+    pendingAutomationRunsAfter
+  )
+  if (!prepared) {
+    return {
+      handled: false,
+      aborted: false,
+      consumedAutomationRuns: false,
+      protectedSecretUpdates: []
+    }
+  }
+  if (isCurrent && !isCurrent()) {
+    return {
+      handled: true,
+      aborted: true,
+      consumedAutomationRuns: false,
+      protectedSecretUpdates: []
+    }
+  }
+  if (prepared.automationRuns !== undefined) {
+    authority?.writeSerializedAutomationRuns?.(prepared.replacements, prepared.automationRuns)
+  } else {
+    authority?.writeSerializedDomains?.(prepared.replacements)
+  }
+  dirtyDomains?.clear()
+  return {
+    handled: true,
+    aborted: false,
+    consumedAutomationRuns: prepared.consumedAutomationRuns,
+    protectedSecretUpdates: prepared.protectedSecretUpdates
+  }
+}
+
+export function prepareSelectiveProfileStateWrite(
+  authority: ProfileStatePersistenceAuthority | undefined,
+  serialization: StateSerializationSecretHandlingOperations,
+  dirtyDomains: ReadonlySet<string> | null,
+  pendingAutomationRunsAfter: readonly AutomationRun[] | undefined
+): PreparedSelectiveProfileStateWrite | undefined {
+  if (
+    !authority ||
+    dirtyDomains === null ||
+    dirtyDomains.size === 0 ||
+    !authority.writeSerializedDomains
+  ) {
+    return undefined
+  }
+  const useAutomationDelta =
+    pendingAutomationRunsAfter !== undefined &&
+    authority.writeSerializedAutomationRuns !== undefined
+  const serializableDomains = useAutomationDelta
+    ? new Set([...dirtyDomains].filter((domain) => domain !== 'automationRuns'))
+    : dirtyDomains
+  const built = serialization.buildStateDomainsToSave(serializableDomains)
+  if (built === undefined) {
+    return undefined
+  }
+  const { replacements, protectedSecretUpdates } = built
+  return {
+    replacements,
+    automationRuns: useAutomationDelta ? pendingAutomationRunsAfter : undefined,
+    consumedAutomationRuns: pendingAutomationRunsAfter !== undefined,
+    protectedSecretUpdates
+  }
+}
diff --git a/src/main/persistence/loading-store/profile-state-settings-writes.test.ts b/src/main/persistence/loading-store/profile-state-settings-writes.test.ts
new file mode 100644
index 00000000000..e7f64b6278a
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-settings-writes.test.ts
@@ -0,0 +1,320 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { getDefaultPersistedState } from '../../../shared/constants'
+import { setSecretStore } from '../../../shared/secret-store'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+import { openProfileStateDatabaseReadOnly } from '../profile-state/profile-state-database'
+import { readProfileStateSnapshot } from '../profile-state/profile-state-documents'
+import { parseProfileStateRoot } from '../profile-state/profile-state-document-validation'
+import { ProfileStateSqliteAuthority } from '../profile-state/profile-state-sqlite-authority'
+import { Store } from './store'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const ORIGINAL = {
+  opencodeSessionCookie: 'original-cookie',
+  httpProxyUrl: 'http://original:password@proxy.test:8080'
+}
+type Failure = 'none' | 'unavailable' | 'availability' | 'encryption' | 'decryption'
+let failure: Failure = 'none'
+let nonce = 0
+const directories: string[] = []
+const stores: Store[] = []
+
+beforeEach(() => {
+  failure = 'none'
+  nonce = 0
+  setSecretStore({
+    isEncryptionAvailable: () => {
+      if (failure === 'availability') {
+        throw new Error('keychain unavailable')
+      }
+      return failure !== 'unavailable'
+    },
+    encryptString: (plaintext) => {
+      if (failure === 'encryption') {
+        throw new Error('encryption failed')
+      }
+      return Buffer.from(`cipher:${++nonce}:${plaintext}`)
+    },
+    decryptString: (ciphertext) => {
+      if (failure === 'decryption') {
+        throw new Error('decryption failed')
+      }
+      const value = ciphertext.toString()
+      if (!value.startsWith('cipher:')) {
+        throw new Error('invalid ciphertext')
+      }
+      return value.slice(value.indexOf(':', 'cipher:'.length) + 1)
+    },
+    describeProtectionGap: () => null
+  })
+  vi.spyOn(ProfileStateSqliteAuthority.prototype, 'scheduleBackup').mockImplementation(() => {})
+})
+
+afterEach(async () => {
+  for (const store of stores.splice(0)) {
+    store.freezeWrites()
+    await store.flushAsync()
+  }
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+
+function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-settings-domain-'))
+  directories.push(directory)
+  const databasePath = join(directory, 'profile-state.db')
+  const dataFile = join(directory, 'orca-data.json')
+  const profileId = 'settings-domain'
+  const authority = new ProfileStateSqliteAuthority(databasePath, profileId)
+  const fixtureState = buildProfileStateCutoverFixture(directory)
+  authority.writeSerializedState(
+    Buffer.from(
+      JSON.stringify({
+        ...getDefaultPersistedState(directory),
+        automationRuns: fixtureState.automationRuns,
+        futureTopLevelExtension: fixtureState.futureTopLevelExtension
+      })
+    )
+  )
+  const createStore = (storage = new ProfileStateSqliteAuthority(databasePath, profileId)) => {
+    const store = new Store({ dataFile, profileStateAuthority: storage })
+    stores.push(store)
+    return store
+  }
+  const store = createStore(authority)
+  store.updateSettings(ORIGINAL)
+  store.flushOrThrow()
+  const read = () => {
+    const opened = openProfileStateDatabaseReadOnly(databasePath, profileId)
+    try {
+      return {
+        state: parseProfileStateRoot(readProfileStateSnapshot(opened.db).json),
+        otherDocuments: opened.db
+          .prepare(
+            "SELECT * FROM profile_state_documents WHERE domain <> 'settings' ORDER BY rowid"
+          )
+          .all(),
+        runs: opened.db.prepare('SELECT * FROM profile_state_automation_runs ORDER BY run_id').all()
+      }
+    } finally {
+      opened.db.close()
+    }
+  }
+  return { store, authority, read, reopen: () => createStore() }
+}
+
+describe('selective SQLite settings persistence', () => {
+  it.each(['sync', 'async'] as const)(
+    'saves settings through the %s barrier without rewriting history or unknown domains',
+    async (mode) => {
+      const state = fixture()
+      const before = state.read()
+      const wholeWrite = vi.spyOn(state.authority, 'writeCompleteSerializedDomains')
+      state.store.updateSettings({ terminalFontSize: 19, httpProxyBypassRules: '*.internal' })
+      if (mode === 'sync') {
+        state.store.flushOrThrow()
+      } else {
+        await state.store.flushPendingOrThrowAsync()
+      }
+      expect(wholeWrite).not.toHaveBeenCalled()
+      const after = state.read()
+      expect(after.otherDocuments).toEqual(before.otherDocuments)
+      expect(after.runs).toEqual(before.runs)
+      expect(after.state).toMatchObject({
+        settings: { terminalFontSize: 19, httpProxyBypassRules: '*.internal' },
+        futureTopLevelExtension: before.state.futureTopLevelExtension
+      })
+      expect(JSON.stringify(after.state)).not.toContain(ORIGINAL.opencodeSessionCookie)
+      expect(JSON.stringify(after.state)).not.toContain(ORIGINAL.httpProxyUrl)
+      expect(state.reopen().getSettings()).toMatchObject({ ...ORIGINAL, terminalFontSize: 19 })
+    }
+  )
+
+  it.each(['unavailable', 'availability', 'encryption'] as const)(
+    'retains committed secrets while %s and retries them after recovery',
+    async (mode) => {
+      const state = fixture()
+      const before = state.read()
+      failure = mode
+      state.store.updateSettings({ opencodeSessionCookie: 'pending-cookie', terminalFontSize: 18 })
+      await state.store.flushPendingOrThrowAsync()
+      expect(state.read().state.settings).toEqual({
+        ...getSettingsRecord(before.state),
+        terminalFontSize: 18
+      })
+      failure = 'none'
+      state.store.updateSettings({ terminalFontSize: 20 })
+      await state.store.flushPendingOrThrowAsync()
+      expect(state.reopen().getSettings()).toMatchObject({
+        ...ORIGINAL,
+        opencodeSessionCookie: 'pending-cookie',
+        terminalFontSize: 20
+      })
+    }
+  )
+
+  it('preserves sealed settings on unrelated saves and permits an explicit clear', () => {
+    const state = fixture()
+    const before = state.read()
+    state.store.freezeWrites()
+    failure = 'decryption'
+    const sealed = state.reopen()
+    sealed.flushOrThrow()
+    expect(sealed.getSettings().opencodeSessionCookie).toBe('')
+    sealed.updateSettings({ terminalFontSize: 21 })
+    sealed.flushOrThrow()
+    expect(state.read().state.settings).toEqual({
+      ...getSettingsRecord(before.state),
+      terminalFontSize: 21
+    })
+    sealed.updateSettings({ opencodeSessionCookie: '', httpProxyUrl: '' })
+    sealed.flushOrThrow()
+    failure = 'none'
+    expect(state.reopen().getSettings()).toMatchObject({
+      opencodeSessionCookie: '',
+      httpProxyUrl: '',
+      terminalFontSize: 21
+    })
+  })
+
+  it('does not retain ciphertext from a failed selective commit', () => {
+    const state = fixture()
+    const before = state.read()
+    vi.spyOn(state.authority, 'writeSerializedDomains').mockImplementationOnce(() => {
+      throw new Error('commit failed')
+    })
+    state.store.updateSettings({ opencodeSessionCookie: 'uncommitted-cookie' })
+    expect(() => state.store.flushOrThrow()).toThrow('commit failed')
+    expect(state.read()).toEqual(before)
+    failure = 'unavailable'
+    state.store.updateSettings({ terminalFontSize: 22 })
+    state.store.flushOrThrow()
+    failure = 'none'
+    expect(state.reopen().getSettings()).toMatchObject({ ...ORIGINAL, terminalFontSize: 22 })
+  })
+
+  it('commits pending session/settings domains together and falls back for unclassified updates', () => {
+    const state = fixture()
+    state.store.patchWorkspaceSession({ activeTabId: 'pending-tab' })
+    state.store.updateSettings({ terminalFontSize: 23 })
+    state.store.flushOrThrow()
+    expect(state.read().state).toMatchObject({
+      settings: { terminalFontSize: 23 },
+      workspaceSession: { activeTabId: 'pending-tab' }
+    })
+    const wholeWrite = vi.spyOn(state.authority, 'writeCompleteSerializedDomains')
+    state.store.updateSettings({ terminalFontSize: 24 })
+    state.store.updateOnboarding({ outcome: 'completed' })
+    state.store.flushOrThrow()
+    expect(wholeWrite).toHaveBeenCalledOnce()
+    expect(state.read().state).toMatchObject({
+      settings: { terminalFontSize: 24 },
+      onboarding: { outcome: 'completed' }
+    })
+  })
+
+  it.each(['unavailable', 'encryption'] as const)(
+    'retries deferred UI and SSH secrets on a settings save after %s recovers',
+    async (mode) => {
+      const state = fixture()
+      const recovery = {
+        targetId: 'ssh-test',
+        clientInstanceId: 'client-test',
+        serverBuildId: 'build-test',
+        clientGeneration: 1,
+        ownerGeneration: 1,
+        ownerLease: 'original-lease'
+      }
+      state.store.updateUI({ browserKagiSessionLink: 'original-link' })
+      await state.store.upsertSshPtyConsumerRecovery(recovery)
+      const before = state.read().state
+
+      failure = mode
+      state.store.updateUI({ browserKagiSessionLink: 'pending-link' })
+      await state.store.flushPendingOrThrowAsync()
+      await state.store.upsertSshPtyConsumerRecovery({ ...recovery, ownerLease: 'pending-lease' })
+      expect(state.read().state).toMatchObject({
+        ui: before.ui,
+        sshPtyConsumerRecoveries: before.sshPtyConsumerRecoveries
+      })
+
+      failure = 'none'
+      const wholeWrite = vi.spyOn(state.authority, 'writeCompleteSerializedDomains')
+      wholeWrite.mockImplementationOnce(() => {
+        throw new Error('recovery commit failed')
+      })
+      state.store.updateSettings({ terminalFontSize: 25 })
+      await expect(state.store.flushPendingOrThrowAsync()).rejects.toThrow('recovery commit failed')
+      expect(state.read().state).toMatchObject({
+        ui: before.ui,
+        sshPtyConsumerRecoveries: before.sshPtyConsumerRecoveries
+      })
+      state.store.updateSettings({ terminalFontSize: 26 })
+      await state.store.flushPendingOrThrowAsync()
+      expect(wholeWrite).toHaveBeenCalledTimes(2)
+      const reopened = state.reopen()
+      expect(reopened.getUI().browserKagiSessionLink).toBe('pending-link')
+      expect(reopened.getSshPtyConsumerRecovery('ssh-test')?.ownerLease).toBe('pending-lease')
+      expect(JSON.stringify(state.read().state)).not.toMatch(/pending-link|pending-lease/)
+
+      state.store.updateSettings({ terminalFontSize: 27 })
+      await state.store.flushPendingOrThrowAsync()
+      expect(wholeWrite).toHaveBeenCalledTimes(2)
+    }
+  )
+
+  it('keeps an explicit UI secret clear after an unavailable write and later settings save', async () => {
+    const state = fixture()
+    state.store.updateUI({ browserKagiSessionLink: 'original-link' })
+    await state.store.flushPendingOrThrowAsync()
+    failure = 'unavailable'
+    state.store.updateUI({ browserKagiSessionLink: 'pending-link' })
+    await state.store.flushPendingOrThrowAsync()
+    state.store.updateUI({ browserKagiSessionLink: null })
+    await state.store.flushPendingOrThrowAsync()
+    failure = 'none'
+    state.store.updateSettings({ terminalFontSize: 28 })
+    await state.store.flushPendingOrThrowAsync()
+    expect(state.reopen().getUI().browserKagiSessionLink).toBeNull()
+  })
+
+  it.each(['unavailable', 'decryption'] as const)(
+    'persists an explicit empty UI secret clear after reopening with %s secrets',
+    async (mode) => {
+      const state = fixture()
+      state.store.updateUI({ browserKagiSessionLink: 'original-link' })
+      await state.store.flushPendingOrThrowAsync()
+      state.store.freezeWrites()
+      failure = mode
+      const sealed = state.reopen()
+      await sealed.flushPendingOrThrowAsync()
+      expect(sealed.getUI().browserKagiSessionLink).toBe('')
+      sealed.updateUI({ browserKagiSessionLink: '' })
+      sealed.updateSettings({ terminalFontSize: 29 })
+      await sealed.flushPendingOrThrowAsync()
+      failure = 'none'
+      expect(state.reopen().getUI().browserKagiSessionLink).toBeNull()
+    }
+  )
+})
+
+function getSettingsRecord(state: Record<string, unknown>): Record<string, unknown> {
+  const settings = state.settings
+  if (typeof settings !== 'object' || settings === null || Array.isArray(settings)) {
+    throw new Error('Expected persisted settings')
+  }
+  return Object.fromEntries(Object.entries(settings))
+}
diff --git a/src/main/persistence/loading-store/profile-state-sqlite-authority.test.ts b/src/main/persistence/loading-store/profile-state-sqlite-authority.test.ts
new file mode 100644
index 00000000000..5f679d3128d
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-sqlite-authority.test.ts
@@ -0,0 +1,877 @@
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { MAX_AUTOMATION_RUNS_PER_AUTOMATION } from '../../../shared/automation-run-retention'
+import { ProfileStateSqliteAuthority } from '../profile-state/profile-state-sqlite-authority'
+import {
+  profileStateJsonMatchesAcceptance,
+  exportProfileStateJson,
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateJsonAcceptance,
+  readProfileStateSnapshot
+} from '../profile-state/profile-state-documents'
+import { parseProfileStateRoot } from '../profile-state/profile-state-document-validation'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from '../profile-state/profile-state-database'
+import { profileStateJsonExportPath } from '../profile-state/legacy-json/profile-state-export-path'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (value: string) => Buffer.from(`encrypted:${value}`, 'utf8'),
+    decryptString: (value: Buffer) => value.toString('utf8').slice('encrypted:'.length)
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: vi.fn(() => ({ nth_repo_added: 2 }))
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: vi.fn(() => ({ hosts: [] })),
+  sshConfigHostsToTargets: vi.fn(() => [])
+}))
+
+const { Store } = await import('./store')
+const { createProfileStateStore } = await import('../profile-state/profile-state-store-factory')
+
+const temporaryDirectories: string[] = []
+const backupAuthorities = new Set<ProfileStateSqliteAuthority>()
+const authorities = new Set<ProfileStateSqliteAuthority>()
+const scheduleBackup = ProfileStateSqliteAuthority.prototype.scheduleBackup
+
+function createAuthority(databasePath: string, profileId: string): ProfileStateSqliteAuthority {
+  const authority = new ProfileStateSqliteAuthority(databasePath, profileId)
+  authorities.add(authority)
+  return authority
+}
+
+beforeEach(() => {
+  vi.spyOn(ProfileStateSqliteAuthority.prototype, 'scheduleBackup').mockImplementation(function (
+    this: ProfileStateSqliteAuthority
+  ) {
+    backupAuthorities.add(this)
+    scheduleBackup.call(this)
+  })
+})
+
+afterEach(async () => {
+  for (const authority of authorities) {
+    authority.close()
+    await authority.drainBackups()
+  }
+  authorities.clear()
+  backupAuthorities.clear()
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+
+describe('Store with an injected SQLite profile-state authority', () => {
+  it('rejects profile-state buffers that are not valid UTF-8', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-invalid-utf8-'))
+    temporaryDirectories.push(directory)
+    const authority = createAuthority(join(directory, 'profile-state.db'), 'profile-authority-test')
+
+    authority.writeSerializedState(Buffer.from('{"settings":{"theme":"dark"}}'))
+    const before = authority.readSerializedState()
+    const malformed = Buffer.concat([
+      Buffer.from('{"settings":{"theme":"'),
+      Buffer.from([0xff]),
+      Buffer.from('"}}')
+    ])
+    expect(() => authority.writeSerializedState(malformed)).toThrow(
+      'Profile state payload is not valid UTF-8'
+    )
+    expect(authority.readSerializedState()).toBe(before)
+    authority.close()
+  })
+
+  it('mutates, flushes, and reloads without writing the legacy JSON file', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-authority-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databaseFile = join(directory, 'profile-state.db')
+    writeFileSync(dataFile, '{"settings":{"theme":"light"}}', 'utf8')
+    const legacyBytes = readFileSync(dataFile)
+    const authority = createAuthority(databaseFile, 'profile-authority-test')
+
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.updateSettings({ theme: 'dark', opencodeSessionCookie: 'authority-secret' })
+    store.flushOrThrow()
+
+    store.updateSettings({ terminalFontSize: store.getSettings().terminalFontSize + 1 })
+    await store.flushPendingOrThrowAsync()
+
+    expect(readFileSync(dataFile)).toEqual(legacyBytes)
+    expect(existsSync(databaseFile)).toBe(true)
+
+    const reloaded = new Store({ dataFile, profileStateAuthority: authority })
+    expect(reloaded.getSettings().theme).toBe('dark')
+    expect(reloaded.getSettings().terminalFontSize).toBe(store.getSettings().terminalFontSize)
+    expect(reloaded.getSettings().opencodeSessionCookie).toBe('authority-secret')
+    expect(readFileSync(dataFile)).toEqual(legacyBytes)
+    reloaded.freezeWrites()
+  })
+
+  it('rejects a corrupt ordering placeholder when normalized rows exist', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-normalized-read-'))
+    temporaryDirectories.push(directory)
+    const databasePath = join(directory, 'profile-state.db')
+    const fixture = buildProfileStateCutoverFixture()
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    authority.writeSerializedState(Buffer.from(JSON.stringify(fixture)))
+    authority.close()
+
+    const opened = openProfileStateDatabase(databasePath, 'profile-authority-test')
+    opened.db
+      .prepare('UPDATE profile_state_documents SET payload = ? WHERE domain = ?')
+      .run('{invalid', 'automationRuns')
+    opened.db.close()
+
+    const runtime = createAuthority(databasePath, 'profile-authority-test')
+    expect(() => runtime.readSerializedState()).toThrow(/hash mismatch: automationRuns/)
+    runtime.close()
+
+    const strict = openProfileStateDatabaseReadOnly(databasePath, 'profile-authority-test')
+    try {
+      expect(() => readProfileStateSnapshot(strict.db)).toThrow(/hash mismatch: automationRuns/)
+    } finally {
+      strict.db.close()
+    }
+  })
+
+  it('rejects invalid domain JSON before handing it to the Store', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-runtime-parse-'))
+    temporaryDirectories.push(directory)
+    const databasePath = join(directory, 'profile-state.db')
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    authority.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'dark' } })))
+    authority.close()
+
+    const opened = openProfileStateDatabase(databasePath, 'profile-authority-test')
+    opened.db
+      .prepare('UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = ?')
+      .run('{invalid', hashProfileStateJson('{invalid'), 'settings')
+    opened.db.close()
+
+    expect(
+      () =>
+        new Store({
+          dataFile: join(directory, 'orca-data.json'),
+          profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+        })
+    ).toThrow('Profile state document payload is invalid JSON: settings')
+  })
+
+  it('rejects documents whose revision metadata was removed or reset', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-authority-'))
+    temporaryDirectories.push(directory)
+    const databasePath = join(directory, 'profile-state.db')
+    const opened = openProfileStateDatabase(databasePath, 'profile-authority-test')
+    importProfileStateJson(opened.db, JSON.stringify({ settings: { theme: 'dark' } }))
+    opened.db.prepare("DELETE FROM profile_state_meta WHERE key = 'revision'").run()
+    opened.db.close()
+
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    expect(() => authority.readSerializedState()).toThrow()
+  })
+
+  it('fences a complete-document writer that read before another authority committed', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-authority-cas-'))
+    temporaryDirectories.push(directory)
+    const databasePath = join(directory, 'profile-state.db')
+    const first = createAuthority(databasePath, 'profile-authority-test')
+    const second = createAuthority(databasePath, 'profile-authority-test')
+
+    first.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'light' } })))
+    expect(second.readSerializedState()).toBe(JSON.stringify({ settings: { theme: 'light' } }))
+
+    first.readSerializedState()
+    first.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'dark' } })))
+    expect(() =>
+      second.writeSerializedState(
+        Buffer.from(JSON.stringify({ settings: { theme: 'stale-writer' } }))
+      )
+    ).toThrowError(
+      expect.objectContaining({
+        code: 'profile-state-revision-conflict',
+        expectedRevision: 1,
+        actualRevision: 2
+      })
+    )
+
+    const verifier = createAuthority(databasePath, 'profile-authority-test')
+    expect(verifier.readSerializedState()).toBe(JSON.stringify({ settings: { theme: 'dark' } }))
+  })
+
+  it('fences a first commit after another authority creates the database', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-authority-create-cas-'))
+    temporaryDirectories.push(directory)
+    const databasePath = join(directory, 'profile-state.db')
+    const first = createAuthority(databasePath, 'profile-authority-test')
+    const second = createAuthority(databasePath, 'profile-authority-test')
+
+    expect(first.readSerializedState()).toBeUndefined()
+    second.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'other' } })))
+
+    expect(() =>
+      first.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'stale' } })))
+    ).toThrowError(
+      expect.objectContaining({
+        code: 'profile-state-revision-conflict',
+        expectedRevision: 0,
+        actualRevision: 1
+      })
+    )
+  })
+
+  it('keeps normalized rows stable during a complete document replacement', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-complete-write-'))
+    temporaryDirectories.push(directory)
+    const databasePath = join(directory, 'profile-state.db')
+    const fixture = buildProfileStateCutoverFixture(directory)
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    authority.writeSerializedState(Buffer.from(JSON.stringify(fixture)))
+
+    const before = openProfileStateDatabaseReadOnly(databasePath, 'profile-authority-test')
+    const beforeAutomationMeta = before.db
+      .prepare(
+        'SELECT revision, content_hash FROM profile_state_automation_runs_meta WHERE domain = ?'
+      )
+      .get('automationRuns')
+    const beforeAutomationRows = before.db
+      .prepare('SELECT COUNT(*) AS count FROM profile_state_automation_runs')
+      .get()
+    before.db.close()
+
+    const replacement = parseProfileStateRoot(authority.readSerializedState() ?? '{}')
+    replacement.settings = { theme: 'complete-replacement' }
+    replacement.unknownDomain = { preserved: true }
+    delete replacement.ui
+    authority.writeSerializedState(Buffer.from(JSON.stringify(replacement)))
+
+    expect(JSON.parse(authority.readSerializedState() ?? '{}')).toMatchObject({
+      settings: { theme: 'complete-replacement' },
+      unknownDomain: { preserved: true }
+    })
+    const after = openProfileStateDatabaseReadOnly(databasePath, 'profile-authority-test')
+    try {
+      expect(
+        after.db.prepare('SELECT value FROM profile_state_meta WHERE key = ?').get('revision')
+      ).toEqual({ value: '2' })
+      expect(
+        after.db
+          .prepare(
+            'SELECT revision, content_hash FROM profile_state_automation_runs_meta WHERE domain = ?'
+          )
+          .get('automationRuns')
+      ).toEqual(beforeAutomationMeta)
+      expect(
+        after.db.prepare('SELECT COUNT(*) AS count FROM profile_state_automation_runs').get()
+      ).toEqual(beforeAutomationRows)
+      expect(
+        after.db.prepare('SELECT 1 FROM profile_state_documents WHERE domain = ?').get('ui')
+      ).toBe(undefined)
+    } finally {
+      after.db.close()
+    }
+  })
+
+  it('reopens its writer after an explicit close without losing the revision fence', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-authority-close-'))
+    temporaryDirectories.push(directory)
+    const databasePath = join(directory, 'profile-state.db')
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+
+    authority.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'light' } })))
+    authority.close()
+    authority.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'dark' } })))
+
+    const verifier = createAuthority(databasePath, 'profile-authority-test')
+    expect(verifier.readSerializedState()).toBe(JSON.stringify({ settings: { theme: 'dark' } }))
+    verifier.close()
+  })
+
+  it('keeps a newer Store commit when a stale Store flushes afterward', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-store-cas-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    const seed = createAuthority(databasePath, 'profile-authority-test')
+    seed.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'light' } })))
+
+    const first = new Store({
+      dataFile,
+      profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+    })
+    const stale = new Store({
+      dataFile,
+      profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+    })
+    const initialTerminalFontSize = first.getSettings().terminalFontSize
+    first.updateSettings({ theme: 'dark' })
+    first.flushOrThrow()
+
+    stale.updateSettings({ terminalFontSize: stale.getSettings().terminalFontSize + 1 })
+    expect(() => stale.flushOrThrow()).toThrowError(
+      expect.objectContaining({
+        code: 'profile-state-revision-conflict',
+        expectedRevision: 1,
+        actualRevision: 2
+      })
+    )
+
+    const verifier = createAuthority(databasePath, 'profile-authority-test')
+    expect(JSON.parse(verifier.readSerializedState() ?? '{}')).toMatchObject({
+      settings: { theme: 'dark', terminalFontSize: initialTerminalFontSize }
+    })
+  })
+
+  it('writes a local session mutation as dirty domains and preserves unrelated rows', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-domain-write-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    const seedDataFile = join(directory, 'seed-orca-data.json')
+    const seedStore = new Store({
+      dataFile: seedDataFile,
+      serializedState: existsSync(seedDataFile) ? readFileSync(seedDataFile, 'utf8') : '{}'
+    })
+    seedStore.updateSettings({ theme: 'light' })
+    seedStore.flushOrThrow()
+    const seed = createAuthority(databasePath, 'profile-authority-test')
+    seed.writeSerializedState(Buffer.from(seedStore.prepareProfileStateExport().json))
+    seedStore.freezeWrites()
+
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    const writeDomains = vi.spyOn(authority, 'writeSerializedDomains')
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.flushOrThrow()
+    store.setWorkspaceSession({
+      ...store.getWorkspaceSession(),
+      activeTabId: 'after'
+    })
+    store.flushOrThrow()
+
+    expect(writeDomains).toHaveBeenCalledTimes(1)
+    expect(writeDomains.mock.calls[0]?.[0].map(({ domain }) => domain)).toEqual([
+      'workspaceSession'
+    ])
+    const reloaded = new Store({
+      dataFile,
+      profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+    })
+    expect(reloaded.getWorkspaceSession().activeTabId).toBe('after')
+    expect(reloaded.getSettings().theme).toBe('light')
+    reloaded.freezeWrites()
+  })
+
+  it('writes a PTY rebind through the workspace-session domain', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-pty-domain-write-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    const fixtureFile = join(directory, 'fixture-orca-data.json')
+    writeFileSync(fixtureFile, JSON.stringify(buildProfileStateCutoverFixture(directory)))
+    const seedStore = new Store({
+      dataFile: fixtureFile,
+      serializedState: existsSync(fixtureFile) ? readFileSync(fixtureFile, 'utf8') : '{}'
+    })
+    seedStore.flushOrThrow()
+    const seed = createAuthority(databasePath, 'profile-authority-test')
+    seed.writeSerializedState(Buffer.from(seedStore.prepareProfileStateExport().json))
+    seedStore.freezeWrites()
+
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    const writeDomains = vi.spyOn(authority, 'writeSerializedDomains')
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.flushOrThrow()
+    const session = store.getWorkspaceSession()
+    const worktreeId = session.activeWorktreeId
+    const tabId = session.activeTabId
+    const layout = tabId ? session.terminalLayoutsByTabId[tabId] : undefined
+    const leafId = layout ? Object.keys(layout.ptyIdsByLeafId ?? {})[0] : undefined
+    const previousPtyId = leafId ? layout?.ptyIdsByLeafId?.[leafId] : undefined
+    if (!worktreeId || !tabId || !layout || !leafId || !previousPtyId) {
+      throw new Error('fixture did not produce a normalized PTY binding')
+    }
+
+    expect(
+      await store.persistPtyBinding({
+        worktreeId,
+        tabId,
+        leafId,
+        ptyId: 'pty-rebound',
+        expectedBinding: { ptyId: previousPtyId }
+      })
+    ).toBe(true)
+    expect(writeDomains).toHaveBeenCalledTimes(1)
+    expect(writeDomains.mock.calls[0]?.[0].map(({ domain }) => domain)).toEqual([
+      'workspaceSession'
+    ])
+
+    const remoteSession = store.getWorkspaceSession('ssh:build-host')
+    const remoteWorktreeId = remoteSession.activeWorktreeId
+    const remoteTabId = remoteSession.activeTabId
+    const remoteLayout = remoteTabId ? remoteSession.terminalLayoutsByTabId[remoteTabId] : undefined
+    const remoteLeafId = remoteLayout
+      ? Object.keys(remoteLayout.ptyIdsByLeafId ?? {})[0]
+      : undefined
+    const remotePtyId = remoteLeafId ? remoteLayout?.ptyIdsByLeafId?.[remoteLeafId] : undefined
+    if (!remoteWorktreeId || !remoteTabId || !remoteLayout || !remoteLeafId || !remotePtyId) {
+      throw new Error('fixture did not produce a normalized remote PTY binding')
+    }
+    expect(
+      await store.persistPtyBinding(
+        {
+          worktreeId: remoteWorktreeId,
+          tabId: remoteTabId,
+          leafId: remoteLeafId,
+          ptyId: 'pty-remote-rebound',
+          expectedBinding: { ptyId: remotePtyId }
+        },
+        'ssh:build-host'
+      )
+    ).toBe(true)
+    expect(writeDomains).toHaveBeenCalledTimes(2)
+    expect(writeDomains.mock.calls[1]?.[0].map(({ domain }) => domain)).toEqual([
+      'workspaceSessionsByHostId'
+    ])
+
+    const reloaded = new Store({
+      dataFile,
+      profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+    })
+    expect(
+      reloaded.getWorkspaceSession().terminalLayoutsByTabId[tabId]?.ptyIdsByLeafId
+    ).toMatchObject({
+      [leafId]: 'pty-rebound'
+    })
+    reloaded.freezeWrites()
+  })
+
+  it('writes scheduled automation changes as automations and automationRuns domains', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-automation-write-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const seedDataFile = join(directory, 'seed-orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    writeFileSync(seedDataFile, JSON.stringify(buildProfileStateCutoverFixture(directory)))
+    const seedStore = new Store({
+      dataFile: seedDataFile,
+      serializedState: existsSync(seedDataFile) ? readFileSync(seedDataFile, 'utf8') : '{}'
+    })
+    seedStore.flushOrThrow()
+    const seed = createAuthority(databasePath, 'profile-authority-test')
+    seed.writeSerializedState(Buffer.from(seedStore.prepareProfileStateExport().json))
+    seedStore.freezeWrites()
+
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    const writeAutomationRuns = vi.spyOn(authority, 'writeSerializedAutomationRuns')
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.flushOrThrow()
+    const automation = store.listAutomations()[0]
+    if (!automation) {
+      throw new Error('fixture automation missing')
+    }
+    store.createAutomationRun(automation, Date.now(), 'scheduled')
+
+    expect(writeAutomationRuns).toHaveBeenCalledTimes(1)
+    expect(writeAutomationRuns.mock.calls[0]?.[0].map(({ domain }) => domain)).toEqual([
+      'automations'
+    ])
+    expect(writeAutomationRuns.mock.calls[0]?.[1]).toHaveLength(2)
+    const reloaded = new Store({
+      dataFile,
+      profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+    })
+    expect(reloaded.listAutomationRuns()).toHaveLength(2)
+    reloaded.freezeWrites()
+  })
+
+  it('persists an automation run lifecycle through normalized rows', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-automation-lifecycle-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const seedDataFile = join(directory, 'seed-orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    writeFileSync(seedDataFile, JSON.stringify(buildProfileStateCutoverFixture(directory)))
+    const seedStore = new Store({
+      dataFile: seedDataFile,
+      serializedState: existsSync(seedDataFile) ? readFileSync(seedDataFile, 'utf8') : '{}'
+    })
+    seedStore.flushOrThrow()
+    const seed = createAuthority(databasePath, 'profile-authority-test')
+    seed.writeSerializedState(Buffer.from(seedStore.prepareProfileStateExport().json))
+    seedStore.freezeWrites()
+
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    const writeAutomationRuns = vi.spyOn(authority, 'writeSerializedAutomationRuns')
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.flushOrThrow()
+    const automation = store.listAutomations()[0]
+    if (!automation) {
+      throw new Error('fixture automation missing')
+    }
+
+    store.updateUI({ browserKagiSessionLink: 'https://kagi.com/session?t=authority' })
+    store.flushOrThrow()
+    const pending = store.createAutomationRun(automation, 30, 'manual')
+    store.flushOrThrow()
+    expect(pending.status).toBe('pending')
+    const completed = store.updateAutomationRun({
+      runId: pending.id,
+      status: 'completed',
+      outputSnapshot: {
+        format: 'plain_text',
+        content: 'completed through sqlite',
+        capturedAt: 31,
+        truncated: false
+      }
+    })
+    store.flushOrThrow()
+    expect(completed.status).toBe('completed')
+    expect(writeAutomationRuns).toHaveBeenCalledTimes(2)
+    expect(writeAutomationRuns.mock.calls[1]?.[0].map(({ domain }) => domain)).toEqual([
+      'automations'
+    ])
+
+    const reloaded = new Store({
+      dataFile,
+      profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+    })
+    expect(reloaded.listAutomationRuns('automation-fixture')).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          id: pending.id,
+          status: 'completed',
+          outputSnapshot: expect.objectContaining({ content: 'completed through sqlite' })
+        })
+      ])
+    )
+    expect(reloaded.getUI().featureInteractions?.['automation-run']?.interactionCount).toBe(1)
+    expect(reloaded.getUI().browserKagiSessionLink).toBe('https://kagi.com/session?t=authority')
+    const stored = openProfileStateDatabaseReadOnly(databasePath, 'profile-authority-test')
+    try {
+      const uiRow = stored.db
+        .prepare('SELECT payload FROM profile_state_documents WHERE domain = ?')
+        .get('ui')
+      expect(uiRow).toEqual(
+        expect.objectContaining({ payload: expect.not.stringContaining('authority') })
+      )
+    } finally {
+      stored.db.close()
+    }
+    reloaded.freezeWrites()
+  })
+
+  it('prunes normalized automation rows and reloads the retained window', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-automation-retention-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const seedDataFile = join(directory, 'seed-orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    writeFileSync(seedDataFile, JSON.stringify(buildProfileStateCutoverFixture(directory)))
+    const seedStore = new Store({
+      dataFile: seedDataFile,
+      serializedState: existsSync(seedDataFile) ? readFileSync(seedDataFile, 'utf8') : '{}'
+    })
+    seedStore.flushOrThrow()
+    const seed = createAuthority(databasePath, 'profile-authority-test')
+    seed.writeSerializedState(Buffer.from(seedStore.prepareProfileStateExport().json))
+    seedStore.freezeWrites()
+
+    const store = new Store({
+      dataFile,
+      profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+    })
+    store.flushOrThrow()
+    const automation = store.listAutomations()[0]
+    if (!automation) {
+      throw new Error('fixture automation missing')
+    }
+    for (let index = 0; index < MAX_AUTOMATION_RUNS_PER_AUTOMATION + 2; index += 1) {
+      const run = store.createAutomationRun(automation, 100 + index, 'scheduled')
+      store.updateAutomationRun({ runId: run.id, status: 'completed' })
+    }
+
+    const reloaded = new Store({
+      dataFile,
+      profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+    })
+    const retained = reloaded.listAutomationRuns('automation-fixture')
+    expect(retained).toHaveLength(MAX_AUTOMATION_RUNS_PER_AUTOMATION)
+    expect(retained.some((run) => run.id === 'automation-run-fixture')).toBe(false)
+    reloaded.flushOrThrow()
+    const stored = openProfileStateDatabaseReadOnly(databasePath, 'profile-authority-test')
+    try {
+      expect(
+        stored.db.prepare('SELECT COUNT(*) AS count FROM profile_state_automation_runs').get()
+      ).toEqual({ count: MAX_AUTOMATION_RUNS_PER_AUTOMATION })
+    } finally {
+      stored.db.close()
+    }
+    reloaded.freezeWrites()
+  })
+
+  it('writes host-qualified worktree metadata as projected domain rows', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-worktree-write-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const seedDataFile = join(directory, 'seed-orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    writeFileSync(seedDataFile, JSON.stringify(buildProfileStateCutoverFixture(directory)))
+    const seedStore = new Store({
+      dataFile: seedDataFile,
+      serializedState: existsSync(seedDataFile) ? readFileSync(seedDataFile, 'utf8') : '{}'
+    })
+    seedStore.flushOrThrow()
+    const seed = createAuthority(databasePath, 'profile-authority-test')
+    seed.writeSerializedState(Buffer.from(seedStore.prepareProfileStateExport().json))
+    seedStore.freezeWrites()
+
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    const writeDomains = vi.spyOn(authority, 'writeSerializedDomains')
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.flushOrThrow()
+    store.setWorktreeMetaForHost('repo-local::/fixture/local', 'local', {
+      displayName: 'Updated fixture local'
+    })
+    store.flushOrThrow()
+
+    expect(writeDomains).toHaveBeenCalledTimes(1)
+    expect(writeDomains.mock.calls[0]?.[0].map(({ domain }) => domain)).toEqual(
+      expect.arrayContaining(['worktreeMeta', 'worktreeMetaByIdentity', 'worktreeIdentityAliases'])
+    )
+    const reloaded = new Store({
+      dataFile,
+      profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+    })
+    expect(
+      reloaded.getWorktreeMetaForHost('repo-local::/fixture/local', 'local')?.displayName
+    ).toBe('Updated fixture local')
+    reloaded.freezeWrites()
+  })
+
+  it('publishes a durable JSON rollback export without changing the SQLite authority', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-json-export-'))
+    temporaryDirectories.push(directory)
+    const databasePath = join(directory, 'profile-state.db')
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    authority.writeSerializedState(
+      Buffer.from(JSON.stringify({ settings: { theme: 'dark' }, unknownDomain: { keep: true } }))
+    )
+
+    const exportPath = join(directory, 'rollback', 'orca-data.json.r3')
+    const revision = authority.writeJsonExport(exportPath)
+
+    expect(revision).toBe(1)
+    expect(JSON.parse(readFileSync(exportPath, 'utf8'))).toEqual({
+      settings: { theme: 'dark' },
+      unknownDomain: { keep: true }
+    })
+    const reopened = openProfileStateDatabaseReadOnly(databasePath, 'profile-authority-test')
+    try {
+      expect(exportProfileStateJson(reopened.db)).toBe(readFileSync(exportPath, 'utf8'))
+    } finally {
+      reopened.db.close()
+    }
+  })
+
+  it('publishes the Store export after flushing pending SQLite state', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-store-export-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    const seed = new Store({ dataFile, serializedState: '{}' })
+    seed.flushOrThrow()
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    authority.writeSerializedState(Buffer.from(seed.prepareProfileStateExport().json, 'utf8'))
+    seed.freezeWrites()
+
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.updateSettings({ theme: 'dark' })
+    const exportPath = join(directory, 'rollback', 'orca-data.json.current')
+    const revision = store.writeProfileStateJsonExport(exportPath)
+
+    expect(revision).toBe(2)
+    expect(JSON.parse(readFileSync(exportPath, 'utf8')).settings.theme).toBe('dark')
+    store.freezeWrites()
+  })
+
+  it('publishes the latest SQLite revision as an idempotent versioned export', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-latest-export-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    const seed = new Store({ dataFile, serializedState: '{}' })
+    seed.updateSettings({ theme: 'light' })
+    seed.flushOrThrow()
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    authority.writeSerializedState(Buffer.from(seed.prepareProfileStateExport().json, 'utf8'))
+    seed.freezeWrites()
+
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.updateSettings({ theme: 'dark' })
+
+    const firstRevision = store.writeLatestProfileStateJsonExport()
+    expect(firstRevision).toBe(2)
+    if (firstRevision === undefined) {
+      throw new Error('Expected the SQLite authority to publish a revisioned export')
+    }
+    const firstPath = profileStateJsonExportPath(dataFile, firstRevision)
+    expect(JSON.parse(readFileSync(firstPath, 'utf8')).settings.theme).toBe('dark')
+
+    expect(store.writeLatestProfileStateJsonExport()).toBe(firstRevision)
+    expect(readFileSync(profileStateJsonExportPath(dataFile, 2), 'utf8')).toBe(
+      readFileSync(firstPath, 'utf8')
+    )
+    expect(
+      readdirSync(directory).some((name) =>
+        name.startsWith('orca-data.json.sqlite-export.pending.')
+      )
+    ).toBe(false)
+    store.freezeWrites()
+  })
+
+  it('publishes canonical JSON for an older build and advances its acceptance marker', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-compat-export-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    const seed = new Store({ dataFile, serializedState: '{}' })
+    seed.updateSettings({ theme: 'light' })
+    seed.flushOrThrow()
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    authority.writeSerializedState(Buffer.from(seed.prepareProfileStateExport().json, 'utf8'))
+    seed.freezeWrites()
+
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.updateSettings({ theme: 'dark' })
+    const revision = store.writeLatestProfileStateJsonCompatibilityExport()
+
+    expect(revision).toBe(2)
+    const canonical = readFileSync(dataFile, 'utf8')
+    expect(JSON.parse(canonical).settings.theme).toBe('dark')
+    const opened = openProfileStateDatabaseReadOnly(databasePath, 'profile-authority-test')
+    try {
+      expect(readProfileStateJsonAcceptance(opened.db)).toEqual({
+        jsonHash: hashProfileStateJson(canonical),
+        acceptedRevision: revision
+      })
+      expect(profileStateJsonMatchesAcceptance(opened.db, canonical)).toBe(true)
+    } finally {
+      opened.db.close()
+    }
+    authority.close()
+    const reopened = createProfileStateStore({
+      dataFile,
+      databaseFile: databasePath,
+      profileId: 'profile-authority-test'
+    })
+    expect(reopened.backend).toBe('sqlite')
+    expect(reopened.store.getSettings().theme).toBe('dark')
+    reopened.store.freezeWrites()
+    store.freezeWrites()
+  })
+
+  it('refuses to overwrite a conflicting export for the same SQLite revision', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-export-conflict-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    authority.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'dark' } })))
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    const revision = store.writeLatestProfileStateJsonExport()
+    if (revision === undefined) {
+      throw new Error('Expected the SQLite authority to publish a revisioned export')
+    }
+    const exportPath = profileStateJsonExportPath(dataFile, revision)
+    mkdirSync(dirname(exportPath), { recursive: true })
+    writeFileSync(exportPath, '{"settings":{"theme":"tampered"}}', 'utf8')
+
+    expect(() => store.writeLatestProfileStateJsonExport()).toThrow(
+      'already exists with different content'
+    )
+    expect(readFileSync(exportPath, 'utf8')).toContain('tampered')
+    expect(
+      readdirSync(directory).some((name) =>
+        name.startsWith('orca-data.json.sqlite-export.pending.')
+      )
+    ).toBe(false)
+    store.freezeWrites()
+  })
+
+  it('freezes Store writes before quarantining the SQLite database family', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-quarantine-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    authority.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'light' } })))
+
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.updateSettings({ theme: 'dark' })
+    store.flushOrThrow()
+    await authority.drainBackups()
+    const sourceBytes = readFileSync(databasePath)
+    writeFileSync(`${databasePath}-wal`, 'wal-preservation-sentinel')
+
+    const result = store.quarantineProfileStateDatabase(
+      join(directory, 'quarantine'),
+      'store-recovery-test'
+    )
+
+    expect(readFileSync(join(result.directory, 'profile-state.db'))).toEqual(sourceBytes)
+    expect(readFileSync(join(result.directory, 'profile-state.db-wal'), 'utf8')).toBe(
+      'wal-preservation-sentinel'
+    )
+    expect(JSON.parse(readFileSync(result.manifestPath, 'utf8'))).toMatchObject({
+      profileId: 'profile-authority-test',
+      reason: 'store-recovery-test'
+    })
+    expect(readFileSync(databasePath)).toEqual(sourceBytes)
+  })
+
+  it('prepares frozen JSON imports without permitting file publication', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-legacy-export-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const store = new Store({ dataFile, serializedState: '{"settings":{"theme":"light"}}' })
+    store.updateSettings({ theme: 'dark' })
+
+    const exportPath = join(directory, 'rollback', 'orca-data.json.legacy.json')
+    expect(() => store.writeProfileStateJsonExport(exportPath)).toThrow('require a SQLite')
+    expect(JSON.parse(store.prepareProfileStateExport().json).settings.theme).toBe('dark')
+    expect(existsSync(exportPath)).toBe(false)
+    expect(existsSync(dataFile)).toBe(false)
+    expect(existsSync(join(directory, 'profile-state.db'))).toBe(false)
+    store.freezeWrites()
+  })
+})
diff --git a/src/main/persistence/loading-store/profile-state-store-backups.test.ts b/src/main/persistence/loading-store/profile-state-store-backups.test.ts
new file mode 100644
index 00000000000..aa60618cc42
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-store-backups.test.ts
@@ -0,0 +1,250 @@
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { flushActiveProfileBeforeFileMutation } from '../../orca-profiles/profile-persistence-deadline'
+import { openProfileStateDatabaseReadOnly } from '../profile-state/profile-state-database'
+import { readProfileStateSnapshot } from '../profile-state/profile-state-documents'
+import { profileStateDatabaseBackups } from '../profile-state/profile-state-backup-path'
+import * as backupExecution from '../profile-state/profile-state-backup-worker'
+import { ProfileStateSqliteAuthority } from '../profile-state/profile-state-sqlite-authority'
+import { Store } from './store'
+import { scheduleSave } from './write-scheduling'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (value: string) => Buffer.from(`encrypted:${value}`),
+    decryptString: (value: Buffer) => value.toString().slice('encrypted:'.length)
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const PROFILE_ID = 'store-backup-test'
+const HOUR = 60 * 60 * 1000
+const fixtures: { directory: string; store: Store; authority: ProfileStateSqliteAuthority }[] = []
+const releases: (() => void)[] = []
+
+beforeEach(() => {
+  vi.spyOn(backupExecution, 'runProfileStateBackup')
+})
+
+afterEach(async () => {
+  for (const release of releases.splice(0)) {
+    release()
+  }
+  for (const fixture of fixtures.splice(0)) {
+    await fixture.authority.drainBackups()
+    fixture.store.freezeWrites()
+    await fixture.store.flushAsync()
+    rmSync(fixture.directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+
+async function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-store-backup-'))
+  const databasePath = join(directory, 'profile-state.db')
+  const dataFile = join(directory, 'orca-data.json')
+  const legacyBytes = '{"settings":{"theme":"system"},"legacy":"retained"}'
+  writeFileSync(dataFile, legacyBytes)
+  const beginning = Date.now()
+  const clock = vi.spyOn(Date, 'now').mockReturnValue(beginning)
+  const authority = new ProfileStateSqliteAuthority(databasePath, PROFILE_ID)
+  const store = new Store({ dataFile, profileStateAuthority: authority })
+  fixtures.push({ directory, store, authority })
+  store.updateSettings({ theme: 'light' })
+  store.flushOrThrow()
+  await authority.drainBackups()
+  const retained = profileStateDatabaseBackups(databasePath)
+  expect(retained).toHaveLength(1)
+  const retainedBytes = readFileSync(retained[0].path)
+  clock.mockReturnValue(beginning + HOUR + 1)
+  return {
+    directory,
+    databasePath,
+    dataFile,
+    legacyBytes,
+    store,
+    authority,
+    retained,
+    retainedBytes
+  }
+}
+
+function readSnapshot(path: string) {
+  const opened = openProfileStateDatabaseReadOnly(path, PROFILE_ID)
+  try {
+    const snapshot = readProfileStateSnapshot(opened.db)
+    return { revision: snapshot.revision, state: JSON.parse(snapshot.json) }
+  } finally {
+    opened.db.close()
+  }
+}
+
+describe('Store automatic SQLite recovery snapshots', () => {
+  it.each([
+    ['selective', 'sync'],
+    ['selective', 'async'],
+    ['complete', 'sync'],
+    ['complete', 'async']
+  ] as const)('backs up a %s %s commit without rewriting retained JSON', async (scope, flush) => {
+    const state = await fixture()
+    const fullWrite = vi.spyOn(state.authority, 'writeCompleteSerializedDomains')
+    const selectiveWrite = vi.spyOn(state.authority, 'writeSerializedDomains')
+    state.store.patchWorkspaceSession({ activeWorktreeId: 'backup-worktree' })
+    if (scope === 'complete') {
+      scheduleSave(state.store)
+    }
+    if (flush === 'sync') {
+      state.store.flushOrThrow()
+      await state.authority.drainBackups()
+    } else {
+      await state.store.flushPendingOrThrowAsync()
+    }
+
+    await state.authority.drainBackups()
+    expect(scope === 'complete' ? fullWrite : selectiveWrite).toHaveBeenCalledOnce()
+    expect(scope === 'complete' ? selectiveWrite : fullWrite).not.toHaveBeenCalled()
+    const backups = profileStateDatabaseBackups(state.databasePath)
+    expect(backups).toHaveLength(2)
+    expect(readSnapshot(backups[0].path)).toEqual(readSnapshot(state.databasePath))
+    expect(readSnapshot(backups[0].path).state.workspaceSession.activeWorktreeId).toBe(
+      'backup-worktree'
+    )
+    expect(readFileSync(state.retained[0].path)).toEqual(state.retainedBytes)
+    expect(readFileSync(state.dataFile, 'utf8')).toBe(state.legacyBytes)
+    expect(
+      readdirSync(state.directory)
+        .filter((name) => name.includes('.backup.'))
+        .sort()
+    ).toEqual(backups.map((backup) => basename(backup.path)).sort())
+  })
+
+  it('acknowledges a routine flush while the previous recovery backup is still running', async () => {
+    const state = await fixture()
+    const realSnapshot = backupExecution.runProfileStateBackup
+    const started = Promise.withResolvers<void>()
+    const gate = Promise.withResolvers<void>()
+    releases.push(gate.resolve)
+    vi.spyOn(backupExecution, 'runProfileStateBackup').mockImplementationOnce(async (job) => {
+      started.resolve()
+      await gate.promise
+      await realSnapshot(job)
+    })
+    state.store.updateSettings({ theme: 'dark' })
+    state.store.flushOrThrow()
+    await started.promise
+    state.store.patchWorkspaceSession({ activeWorktreeId: 'newer-than-backup' })
+    let settled = false
+    const flush = state.store.flushPendingOrThrowAsync().then(() => {
+      settled = true
+    })
+    await vi.waitFor(() => expect(settled).toBe(true))
+    expect(readSnapshot(state.databasePath).state.workspaceSession.activeWorktreeId).toBe(
+      'newer-than-backup'
+    )
+    expect(profileStateDatabaseBackups(state.databasePath)).toHaveLength(1)
+    gate.resolve()
+    await Promise.all([flush, state.authority.drainBackups()])
+  })
+
+  it.each(['quit', 'profile mutation'] as const)(
+    '%s waits for its owned backup across Store close',
+    async (kind) => {
+      const state = await fixture()
+      const realSnapshot = backupExecution.runProfileStateBackup
+      let begin: () => void = () => {}
+      let release: () => void = () => {}
+      const started = new Promise<void>((resolve) => {
+        begin = resolve
+      })
+      const gate = new Promise<void>((resolve) => {
+        release = resolve
+      })
+      releases.push(release)
+      vi.spyOn(backupExecution, 'runProfileStateBackup').mockImplementationOnce(async (job) => {
+        begin()
+        await gate
+        await realSnapshot(job)
+      })
+      state.store.updateSettings({ theme: 'dark' })
+      state.store.flushOrThrow()
+      await started
+      const drain = vi.spyOn(state.authority, 'drainBackups')
+      let settled = false
+      const barrier = (
+        kind === 'quit'
+          ? state.store.flushAsync({ exportJsonCompatibility: true })
+          : flushActiveProfileBeforeFileMutation(state.store)
+      ).then(() => {
+        settled = true
+      })
+      await vi.waitFor(() => expect(drain).toHaveBeenCalled())
+      expect(settled).toBe(false)
+      state.store.freezeWrites()
+      expect(profileStateDatabaseBackups(state.databasePath)).toHaveLength(1)
+      release()
+      await barrier
+
+      expect(settled).toBe(true)
+      const backups = profileStateDatabaseBackups(state.databasePath)
+      expect(backups).toHaveLength(2)
+      expect(readSnapshot(backups[0].path).state.settings.theme).toBe('dark')
+      expect(readFileSync(state.retained[0].path)).toEqual(state.retainedBytes)
+      expect(JSON.parse(readFileSync(state.dataFile, 'utf8'))).toEqual(
+        readSnapshot(state.databasePath).state
+      )
+    }
+  )
+
+  it.each(['sync', 'async'] as const)(
+    'does not reject a committed %s flush when its backup fails',
+    async (flush) => {
+      const state = await fixture()
+      const log = vi.spyOn(console, 'error').mockImplementation(() => {})
+      const failure = new Error('injected backup disk failure')
+      const snapshot = vi
+        .spyOn(backupExecution, 'runProfileStateBackup')
+        .mockClear()
+        .mockRejectedValueOnce(failure)
+      state.store.updateSettings({ theme: 'dark' })
+      if (flush === 'sync') {
+        expect(() => state.store.flushOrThrow()).not.toThrow()
+        await expect(state.authority.drainBackups()).resolves.toBeUndefined()
+      } else {
+        await expect(state.store.flushPendingOrThrowAsync()).resolves.toBeUndefined()
+      }
+
+      await state.authority.drainBackups()
+      expect(snapshot).toHaveBeenCalledOnce()
+      expect(log).toHaveBeenCalledWith(
+        '[persistence] Failed to back up profile state database:',
+        failure
+      )
+      expect(readSnapshot(state.databasePath).state.settings.theme).toBe('dark')
+      expect(profileStateDatabaseBackups(state.databasePath)).toEqual(state.retained)
+      expect(readFileSync(state.retained[0].path)).toEqual(state.retainedBytes)
+      expect(readSnapshot(state.retained[0].path).state.settings.theme).toBe('light')
+      expect(readFileSync(state.dataFile, 'utf8')).toBe(state.legacyBytes)
+      expect(existsSync(`${state.dataFile}.bak.0`)).toBe(false)
+    }
+  )
+})
diff --git a/src/main/persistence/loading-store/profile-state-temp-cleanup-lifetime.test.ts b/src/main/persistence/loading-store/profile-state-temp-cleanup-lifetime.test.ts
new file mode 100644
index 00000000000..2cbdd1c59ff
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-temp-cleanup-lifetime.test.ts
@@ -0,0 +1,87 @@
+import { mkdtempSync, readFileSync, utimesSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, join } from 'node:path'
+import { afterEach, expect, it, vi } from 'vitest'
+import { removeTreeSync } from '../../../shared/windows-transient-lock-removal'
+import * as durableFileWrite from '../../durable-file-write'
+import { STALE_DURABLE_WRITE_TEMP_AGE_MS } from '../tracking-repos/worktree-metadata-normalization'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from './profile-state-maintenance-fixture'
+import { Store } from './store'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const directories: string[] = []
+afterEach(() => {
+  for (const directory of directories.splice(0)) {
+    removeTreeSync(directory)
+  }
+})
+
+it.each(['maintenance', 'freeze', 'final'] as const)(
+  '%s drains startup temp cleanup without delaying ordinary SQL writes',
+  async (kind) => {
+    const gate = maintenanceBarrier()
+    const cleanup = durableFileWrite.removeStaleDurableWriteTempFiles
+    vi.spyOn(durableFileWrite, 'removeStaleDurableWriteTempFiles').mockImplementation(
+      (file, options) =>
+        basename(file) === 'orca-data.json' ? gate.promise : cleanup(file, options)
+    )
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    store.updateSettings({ theme: 'dark' })
+    await store.flushPendingOrThrowAsync()
+    expect(readState().settings.theme).toBe('dark')
+
+    const close = vi.spyOn(authority, 'close')
+    const checkpoint = vi.spyOn(authority, 'writeCompleteSerializedDomains')
+    const finished = vi.fn()
+    const pending =
+      kind === 'maintenance'
+        ? store.beginProfileMaintenance()
+        : kind === 'freeze'
+          ? store.freezeWritesAsync()
+          : store.flushFinalOrThrowAsync()
+    void pending.then(finished, finished)
+    await new Promise<void>((resolve) => setImmediate(resolve))
+    expect(finished).not.toHaveBeenCalled()
+    expect(close).not.toHaveBeenCalled()
+    expect(checkpoint).not.toHaveBeenCalled()
+
+    gate.resolve()
+    await pending
+    expect(close).toHaveBeenCalledOnce()
+  }
+)
+
+it('leaves legacy source temp files untouched when constructing a frozen importer', async () => {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-import-temp-cleanup-'))
+  directories.push(directory)
+  const dataFile = join(directory, 'orca-data.json')
+  const source = '{"settings":{"theme":"dark"}}'
+  const staleTempFile = `${dataFile}.99999999.0.import.tmp`
+  writeFileSync(dataFile, source)
+  writeFileSync(staleTempFile, 'retained temp bytes')
+  const staleSeconds = (Date.now() - STALE_DURABLE_WRITE_TEMP_AGE_MS - 60_000) / 1000
+  utimesSync(staleTempFile, staleSeconds, staleSeconds)
+  const cleanup = vi.spyOn(durableFileWrite, 'removeStaleDurableWriteTempFiles')
+
+  const imported = new Store({ dataFile, serializedState: source })
+  expect(JSON.parse(imported.prepareProfileStateExport().json).settings.theme).toBe('dark')
+  imported.freezeWrites()
+  await Promise.all(
+    cleanup.mock.results.map((result) => (result.type === 'return' ? result.value : undefined))
+  )
+
+  expect(cleanup.mock.calls.some(([file]) => file === dataFile)).toBe(false)
+  expect(readFileSync(dataFile, 'utf8')).toBe(source)
+  expect(readFileSync(staleTempFile, 'utf8')).toBe('retained temp bytes')
+})
diff --git a/src/main/persistence/loading-store/profile-state-update-quit.test.ts b/src/main/persistence/loading-store/profile-state-update-quit.test.ts
new file mode 100644
index 00000000000..cadbdbe754a
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-update-quit.test.ts
@@ -0,0 +1,241 @@
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import * as durableFiles from '../../durable-file-write'
+import { settleTeardownWithinDeadline } from '../../quit-teardown-deadline'
+import { openProfileStateDatabaseReadOnly } from '../profile-state/profile-state-database'
+import {
+  hashProfileStateJson,
+  readProfileStateJsonAcceptance,
+  readProfileStateSnapshot
+} from '../profile-state/profile-state-documents'
+import { ProfileStateSqliteAuthority } from '../profile-state/profile-state-sqlite-authority'
+import { createProfileStateStore } from '../profile-state/profile-state-store-factory'
+import { Store } from './store'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: { isEncryptionAvailable: () => false },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const PROFILE_ID = 'update-quit-test'
+const TARGET_ID = 'remote-host'
+const fixtures: { directory: string; store: Store; authority: ProfileStateSqliteAuthority }[] = []
+const releases: (() => void)[] = []
+
+afterEach(async () => {
+  for (const release of releases.splice(0)) {
+    release()
+  }
+  for (const { store, authority, directory } of fixtures.splice(0)) {
+    await store.flushAsync()
+    await authority.drainBackups()
+    store.freezeWrites()
+    rmSync(directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+
+async function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-update-quit-'))
+  const databasePath = join(directory, 'profile-state.db')
+  const dataFile = join(directory, 'orca-data.json')
+  const authority = new ProfileStateSqliteAuthority(databasePath, PROFILE_ID)
+  const store = new Store({ dataFile, profileStateAuthority: authority })
+  fixtures.push({ directory, store, authority })
+  store.upsertSshRemotePtyLease({ targetId: TARGET_ID, ptyId: 'remote-pty', state: 'attached' })
+  await store.flushPendingOrThrowAsync()
+  store.writeLatestProfileStateJsonExport()
+  store.writeLatestProfileStateJsonCompatibilityExport()
+  return { store, authority, databasePath, dataFile }
+}
+
+function persistedState(databasePath: string) {
+  const opened = openProfileStateDatabaseReadOnly(databasePath, PROFILE_ID)
+  try {
+    return {
+      ...readProfileStateSnapshot(opened.db),
+      acceptance: readProfileStateJsonAcceptance(opened.db)
+    }
+  } finally {
+    opened.db.close()
+  }
+}
+
+function gate() {
+  let release: () => void = () => {}
+  const promise = new Promise<void>((resolve) => {
+    release = resolve
+  })
+  releases.push(release)
+  return { promise, release }
+}
+
+describe('SQLite profile state during an update quit', () => {
+  it('exports final SSH shutdown writes and reloads them through the frozen JSON importer', async () => {
+    const { store, dataFile, databasePath } = await fixture()
+    store.markSshRemotePtyLeasesForShutdown(TARGET_ID, 'detached')
+
+    await store.flushAsync({ exportJsonCompatibility: true })
+
+    const json = readFileSync(dataFile, 'utf8')
+    const snapshot = persistedState(databasePath)
+    expect(json).toBe(snapshot.json)
+    expect(snapshot.acceptance).toEqual({
+      jsonHash: hashProfileStateJson(json),
+      acceptedRevision: snapshot.revision
+    })
+    const legacy = new Store({ dataFile, serializedState: json })
+    try {
+      expect(legacy.getSshRemotePtyLeases(TARGET_ID)).toEqual([
+        expect.objectContaining({ state: 'detached', lastDetachedAt: expect.any(Number) })
+      ])
+    } finally {
+      legacy.freezeWrites()
+    }
+  })
+
+  it('exports a normal quit for an older build after sessions and settings changed', async () => {
+    const { store, dataFile, databasePath } = await fixture()
+    store.updateSettings({ theme: 'dark' })
+    store.markSshRemotePtyLeasesForShutdown(TARGET_ID, 'detached')
+
+    await store.flushFinalOrThrowAsync({ exportJsonCompatibility: true })
+
+    const json = readFileSync(dataFile, 'utf8')
+    expect(json).toBe(persistedState(databasePath).json)
+    const legacy = new Store({ dataFile, serializedState: json })
+    try {
+      expect(legacy.getSettings().theme).toBe('dark')
+      expect(legacy.getSshRemotePtyLeases(TARGET_ID)[0]?.state).toBe('detached')
+    } finally {
+      legacy.freezeWrites()
+    }
+  })
+
+  it('does not publish or accept a snapshot when final persistence fails', async () => {
+    const { store, authority, dataFile, databasePath } = await fixture()
+    const retainedJson = readFileSync(dataFile, 'utf8')
+    const before = persistedState(databasePath)
+    const failure = new Error('injected final commit failure')
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    vi.spyOn(authority, 'writeCompleteSerializedDomains').mockImplementation(() => {
+      throw failure
+    })
+    const exportJson = vi.spyOn(authority, 'writeJsonCompatibilityExportAsync')
+    store.markSshRemotePtyLeasesForShutdown(TARGET_ID, 'detached')
+
+    await store.flushAsync({ exportJsonCompatibility: true })
+
+    expect(exportJson).not.toHaveBeenCalled()
+    expect(readFileSync(dataFile, 'utf8')).toBe(retainedJson)
+    expect(persistedState(databasePath)).toEqual(before)
+  })
+
+  it('retains the preflight export and acceptance if the final file write fails', async () => {
+    const { store, dataFile, databasePath } = await fixture()
+    const retainedJson = readFileSync(dataFile, 'utf8')
+    const before = persistedState(databasePath)
+    const failure = new Error('injected final export failure')
+    const log = vi.spyOn(console, 'error').mockImplementation(() => {})
+    vi.spyOn(durableFiles, 'writeFileDurable').mockRejectedValueOnce(failure)
+    store.markSshRemotePtyLeasesForShutdown(TARGET_ID, 'detached')
+
+    await store.flushAsync({ exportJsonCompatibility: true })
+
+    expect(readFileSync(dataFile, 'utf8')).toBe(retainedJson)
+    expect(persistedState(databasePath).acceptance).toMatchObject(before.acceptance ?? {})
+    expect(persistedState(databasePath).revision).toBeGreaterThan(before.revision)
+    expect(log).toHaveBeenCalledWith('[persistence] Failed to flush final state:', failure)
+  })
+
+  it('joins the final barrier and permits its deadline while the JSON file write stalls', async () => {
+    const { store, dataFile, databasePath } = await fixture()
+    const retainedJson = readFileSync(dataFile, 'utf8')
+    const writing = gate()
+    const held = gate()
+    const writeFileDurable = durableFiles.writeFileDurable
+    const exportWrite = vi
+      .spyOn(durableFiles, 'writeFileDurable')
+      .mockImplementationOnce(async (...args) => {
+        writing.release()
+        await held.promise
+        await writeFileDurable(...args)
+      })
+    store.markSshRemotePtyLeasesForShutdown(TARGET_ID, 'detached')
+    const pending = store.flushAsync({ exportJsonCompatibility: true })
+    expect(store.flushAsync()).toBe(pending)
+    await writing.promise
+
+    await expect(
+      settleTeardownWithinDeadline([{ name: 'state', promise: pending }], 25)
+    ).resolves.toEqual(['state'])
+    expect(readFileSync(dataFile, 'utf8')).toBe(retainedJson)
+    held.release()
+    await pending
+
+    expect(exportWrite).toHaveBeenCalledOnce()
+    expect(readFileSync(dataFile, 'utf8')).toBe(persistedState(databasePath).json)
+  })
+
+  it('reopens the latest SQLite state when a concurrent commit prevents export promotion', async () => {
+    const { store, dataFile, databasePath } = await fixture()
+    const before = persistedState(databasePath)
+    const log = vi.spyOn(console, 'error').mockImplementation(() => {})
+    const writeFileDurable = durableFiles.writeFileDurable
+    vi.spyOn(durableFiles, 'writeFileDurable').mockImplementationOnce(async (...args) => {
+      await writeFileDurable(...args)
+      const competitor = new ProfileStateSqliteAuthority(databasePath, PROFILE_ID)
+      try {
+        competitor.readSerializedState()
+        competitor.writeSerializedDomains([{ domain: 'settings', payload: '{"theme":"dark"}' }])
+      } finally {
+        competitor.close()
+      }
+    })
+    store.markSshRemotePtyLeasesForShutdown(TARGET_ID, 'detached')
+
+    await store.flushAsync({ exportJsonCompatibility: true })
+
+    const snapshot = persistedState(databasePath)
+    expect(snapshot.acceptance).toMatchObject(before.acceptance ?? {})
+    expect(snapshot.acceptance?.pending?.jsonHash).toBe(
+      hashProfileStateJson(readFileSync(dataFile, 'utf8'))
+    )
+    expect(log).toHaveBeenCalledWith(
+      '[persistence] Failed to flush final state:',
+      expect.objectContaining({ code: 'profile-state-revision-conflict' })
+    )
+    store.freezeWrites()
+    const reopened = createProfileStateStore({
+      dataFile,
+      databaseFile: databasePath,
+      profileId: PROFILE_ID
+    })
+    try {
+      expect(reopened.backend).toBe('sqlite')
+      expect(reopened.store.getSettings().theme).toBe('dark')
+      expect(reopened.store.getSshRemotePtyLeases(TARGET_ID)[0]?.state).toBe('detached')
+    } finally {
+      reopened.store.freezeWrites()
+    }
+  })
+})
diff --git a/src/main/persistence/loading-store/profile-state-worker-coordination.test.ts b/src/main/persistence/loading-store/profile-state-worker-coordination.test.ts
new file mode 100644
index 00000000000..7144abe0789
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-worker-coordination.test.ts
@@ -0,0 +1,335 @@
+import { describe, expect, it, vi } from 'vitest'
+import { ProfileStateWriterError } from '../profile-state/profile-state-writer-errors'
+import { fixture } from './profile-state-delayed-authority-fixture'
+import { StateSerializationSecretHandlingOperations } from './state-serialization-secret-handling'
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+describe('worker-owned Store writes', () => {
+  it('consumes the debounce timer and avoids full checkpoints after a selective durable write', async () => {
+    const { store, authority, readState } = await fixture()
+    const full = vi.spyOn(authority, 'writeCompleteSerializedDomains')
+    const selective = vi.spyOn(authority, 'writeSerializedDomains')
+    vi.useFakeTimers()
+    try {
+      await store.runDurableMutation(() => {
+        store.updateSettings({ theme: 'dark' })
+        return { value: undefined }
+      })
+      await vi.advanceTimersByTimeAsync(6_000)
+      await store.waitForPendingWrite()
+      expect(selective).toHaveBeenCalledOnce()
+      expect(full).not.toHaveBeenCalled()
+      expect(readState().settings.theme).toBe('dark')
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('still captures direct durable mutations that do not identify dirty domains', async () => {
+    const { store, readState } = await fixture()
+    await store.runDurableMutation(() => {
+      store.getWorkspaceSession().activeTabId = 'direct-mutation'
+      return { value: undefined }
+    })
+    expect(readState().workspaceSession.activeTabId).toBe('direct-mutation')
+  })
+
+  it('skips a debounce callback already queued behind the write that consumed its changes', async () => {
+    const { store, authority } = await fixture()
+    const full = vi.spyOn(authority, 'writeCompleteSerializedDomains')
+    const gate = authority.pause()
+    vi.useFakeTimers()
+    try {
+      const durable = store.runDurableMutation(() => {
+        store.updateSettings({ theme: 'dark' })
+        return { value: undefined }
+      })
+      await gate.started.promise
+      await vi.advanceTimersByTimeAsync(1_000)
+      gate.finish.resolve()
+      await durable
+      await store.waitForPendingWrite()
+      expect(full).not.toHaveBeenCalled()
+    } finally {
+      gate.finish.resolve()
+      vi.useRealTimers()
+    }
+  })
+
+  it('handles a rejected debounced save and retains it for an explicit retry', async () => {
+    const { store, authority, readState } = await fixture()
+    const log = vi.spyOn(console, 'error').mockImplementation(() => {})
+    const gate = authority.pause()
+    vi.useFakeTimers()
+    try {
+      store.updateSettings({ theme: 'dark' })
+      await vi.advanceTimersByTimeAsync(1000)
+      await gate.started.promise
+      gate.finish.reject(new Error('disk refused'))
+      await store.waitForPendingWrite()
+      expect(log).toHaveBeenCalled()
+    } finally {
+      vi.useRealTimers()
+    }
+    await store.flushPendingOrThrowAsync()
+    expect(readState().settings.theme).toBe('dark')
+  })
+
+  it('refuses an export when serialization invalidates its full checkpoint', async () => {
+    const { store, authority, readState } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const publish = vi.spyOn(authority, 'writeLatestJsonExport')
+    const session = store.getWorkspaceSession()
+    Object.defineProperty(session, 'toJSON', {
+      configurable: true,
+      value: () => {
+        store.updateSettings({ theme: 'light' })
+        return { ...session }
+      }
+    })
+    try {
+      await expect(store.writeLatestProfileStateJsonExportAsync()).rejects.toThrow(
+        'changed while preparing its export'
+      )
+      expect(publish).not.toHaveBeenCalled()
+    } finally {
+      Reflect.deleteProperty(session, 'toJSON')
+    }
+    await store.writeLatestProfileStateJsonExportAsync()
+    expect(readState().settings.theme).toBe('light')
+    expect(publish).toHaveBeenCalledOnce()
+  })
+
+  it('retains selective write intent when a toJSON hook changes the captured generation', async () => {
+    const { store, authority, readState } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const selective = vi.spyOn(authority, 'writeSerializedDomains')
+    const serialize = vi.fn((key: string) => {
+      expect(key).toBe('workspaceSession')
+      store.updateSettings({ theme: 'light' })
+      return { ...store.getWorkspaceSession() }
+    })
+    try {
+      await expect(
+        store.runDurableMutation(() => {
+          store.patchWorkspaceSession({ activeTabId: 'captured-tab' })
+          Object.defineProperty(store.getWorkspaceSession(), 'toJSON', {
+            configurable: true,
+            value: serialize
+          })
+          return { value: undefined }
+        })
+      ).rejects.toThrow('changed while preparing its durable snapshot')
+      expect(serialize).toHaveBeenCalledOnce()
+      expect(selective).not.toHaveBeenCalled()
+    } finally {
+      Reflect.deleteProperty(store.getWorkspaceSession(), 'toJSON')
+    }
+    await store.flushPendingOrThrowAsync()
+    expect(readState()).toMatchObject({
+      settings: { theme: 'light' },
+      workspaceSession: { activeTabId: 'captured-tab' }
+    })
+    expect(selective).toHaveBeenCalledOnce()
+  })
+
+  it('preserves canonical domain bytes and revisions for raw JSON and proxy-valued hooks', async () => {
+    if (!('rawJSON' in JSON) || typeof JSON.rawJSON !== 'function') {
+      throw new Error('This test requires native JSON.rawJSON support')
+    }
+    const overflow: unknown = JSON.rawJSON('1e999')
+    const escaped: unknown = JSON.rawJSON('"\\u0061"')
+    const { store, authority, readState } = await fixture()
+    store.patchWorkspaceSession({ activeTabId: 'pending-tab' })
+    const session = store.getWorkspaceSession()
+    const keyOrder = new Proxy({ 1: 'one', 2: 'two' }, { ownKeys: () => ['2', '1'] })
+    const serialize = vi.fn(() => ({ ...session, activeTabId: escaped, overflow, keyOrder }))
+    Object.defineProperty(session, 'toJSON', { configurable: true, value: serialize })
+    const expected = JSON.stringify({
+      ...session,
+      activeTabId: 'a',
+      overflow: null,
+      keyOrder: {
+        1: 'one',
+        2: 'two'
+      }
+    })
+    try {
+      await store.flushPendingOrThrowAsync()
+      expect(authority.captures.at(-1)).toContainEqual({
+        domain: 'workspaceSession',
+        payload: expected
+      })
+      expect(readState().workspaceSession).toMatchObject({ activeTabId: 'a', overflow: null })
+      expect(serialize).toHaveBeenCalledOnce()
+      const revision = authority.inner.revision
+      store.setWorkspaceSession(session)
+      await store.flushPendingOrThrowAsync()
+      expect(authority.inner.revision).toBe(revision)
+      expect(serialize).toHaveBeenCalledTimes(2)
+    } finally {
+      Reflect.deleteProperty(session, 'toJSON')
+    }
+  })
+
+  it('retains a newer edit after an older write is acknowledged', async () => {
+    const { store, authority, readState } = await fixture()
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await gate.started.promise
+    store.updateSettings({ theme: 'light' })
+    gate.finish.resolve()
+    await first
+    expect(readState().settings.theme).toBe('dark')
+    await store.flushPendingOrThrowAsync()
+    expect(readState().settings.theme).toBe('light')
+  })
+
+  it('merges a failed older write with dirty state added while it was in flight', async () => {
+    const { store, authority, readState } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    const rejected = expect(first).rejects.toThrow('disk refused')
+    await gate.started.promise
+    store.getWorkspaceSession().activeTabId = 'newer-tab'
+    store.setWorkspaceSession(store.getWorkspaceSession())
+    gate.finish.reject(new Error('disk refused'))
+    await rejected
+    await store.flushPendingOrThrowAsync()
+    expect(readState()).toMatchObject({
+      settings: { theme: 'dark' },
+      workspaceSession: { activeTabId: 'newer-tab' }
+    })
+  })
+
+  it('captures a full checkpoint after an older save even without a new generation', async () => {
+    const { store, authority, readState } = await fixture()
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await gate.started.promise
+    store.getWorkspaceSession().activeTabId = 'getter-only-tab'
+    const final = store.flushAsync()
+    gate.finish.resolve()
+    await first
+    await final
+    expect(readState().workspaceSession.activeTabId).toBe('getter-only-tab')
+    expect(authority.captures.at(-1)?.some(({ domain }) => domain === 'workspaceSession')).toBe(
+      true
+    )
+  })
+
+  it('reserves ordering before an exact mutation changes live state', async () => {
+    const { store, authority, readState } = await fixture()
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await gate.started.promise
+    const mutate = vi.fn(() => {
+      store.updateSettings({ theme: 'light' })
+      return { value: 'durable' }
+    })
+    const exact = store.runDurableMutation(mutate)
+    await Promise.resolve()
+    expect(mutate).not.toHaveBeenCalled()
+    expect(store.getSettings().theme).toBe('dark')
+    gate.finish.resolve()
+    await first
+    await expect(exact).resolves.toBe('durable')
+    expect(readState().settings.theme).toBe('light')
+  })
+
+  it('retains dirty intent while many durability waiters share an active snapshot', async () => {
+    const { store, authority, readState } = await fixture()
+    const fullCapture = vi.spyOn(
+      StateSerializationSecretHandlingOperations.prototype,
+      'buildStateToSave'
+    )
+    const gate = authority.pause()
+    store.updateSettings({ terminalFontSize: 12 })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await gate.started.promise
+    const waiters: Promise<void>[] = [first]
+    for (let size = 13; size <= 32; size++) {
+      store.updateSettings({ terminalFontSize: size })
+      waiters.push(store.flushPendingOrThrowAsync({ drainToStableGeneration: false }))
+    }
+    await Promise.resolve()
+    expect(authority.captures).toHaveLength(1)
+    gate.finish.resolve()
+    await Promise.all(waiters)
+    expect(readState().settings.terminalFontSize).toBe(32)
+    expect(fullCapture).toHaveBeenCalledOnce()
+    expect(authority.captures).toHaveLength(2)
+  })
+
+  it('cancels a queued checkpoint without aborting the preceding writer or losing edits', async () => {
+    const { store, authority, readState } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const abortWriter = vi.spyOn(authority, 'abort')
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await gate.started.promise
+    const controller = new AbortController()
+    store.updateSettings({ theme: 'light' })
+    const canceled = store.flushPendingOrThrowAsync({ signal: controller.signal })
+    const refused = expect(canceled).rejects.toThrow('aborted')
+    controller.abort()
+    gate.finish.resolve()
+    await first
+    await refused
+    expect(abortWriter).not.toHaveBeenCalled()
+    await store.flushPendingOrThrowAsync()
+    expect(readState().settings.theme).toBe('light')
+  })
+
+  it.each(['known-failure', 'indeterminate'] as const)(
+    'only rolls back a mutation with a known failure (%s)',
+    async (outcome) => {
+      const { store, authority } = await fixture()
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      const gate = authority.pause()
+      const rollback = vi.fn()
+      const exact = store.runDurableMutation(() => {
+        store.updateSettings({ theme: 'dark' })
+        return { value: undefined, rollback }
+      })
+      const rejected = expect(exact).rejects.toThrow('write failed')
+      await gate.started.promise
+      gate.finish.reject(new ProfileStateWriterError('test', 'write failed', outcome))
+      await rejected
+      expect(rollback).toHaveBeenCalledTimes(outcome === 'known-failure' ? 1 : 0)
+    }
+  )
+
+  it('awaits accepted operations before closing and refuses new exact mutations', async () => {
+    const { store, authority, readState } = await fixture()
+    const gate = authority.pause()
+    const first = store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'dark' })
+      return { value: undefined }
+    })
+    await gate.started.promise
+    const closing = store.freezeWritesAsync()
+    await expect(store.runDurableMutation(() => ({ value: undefined }))).rejects.toThrow(
+      'finalized'
+    )
+    expect(authority.close).not.toHaveBeenCalled()
+    gate.finish.resolve()
+    await first
+    await closing
+    expect(authority.close).toHaveBeenCalledTimes(1)
+    expect(readState().settings.theme).toBe('dark')
+  })
+})
diff --git a/src/main/persistence/loading-store/profile-state-worker-secret-retention.test.ts b/src/main/persistence/loading-store/profile-state-worker-secret-retention.test.ts
new file mode 100644
index 00000000000..4d72ce144c6
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-worker-secret-retention.test.ts
@@ -0,0 +1,124 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { getSecretStore, setSecretStore } from '../../../shared/secret-store'
+import { fixture } from './profile-state-delayed-authority-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+let encryptionAvailable = true
+let previousSecretStore: ReturnType<typeof getSecretStore>
+const ciphertext = (plaintext: string) => Buffer.from(`sealed:${plaintext}`).toString('base64')
+
+beforeEach(() => {
+  encryptionAvailable = true
+  previousSecretStore = getSecretStore()
+  setSecretStore({
+    isEncryptionAvailable: () => encryptionAvailable,
+    encryptString: (value) => Buffer.from(`sealed:${value}`),
+    decryptString: (value) => value.toString().slice('sealed:'.length),
+    describeProtectionGap: () => null
+  })
+})
+afterEach(() => setSecretStore(previousSecretStore))
+
+describe.each(['opencodeSessionCookie', 'opencodeGoApiKey'] as const)(
+  'Store %s retention across worker acknowledgements',
+  (setting) => {
+    it('does not restore ciphertext cleared while its commit acknowledgement was pending', async () => {
+      const { store, authority, readState } = await fixture()
+      store.updateSettings({ [setting]: 'durable' })
+      await store.flushPendingOrThrowAsync()
+      const gate = authority.pause()
+      store.updateSettings({ [setting]: 'in-flight' })
+      const write = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+      await gate.started.promise
+      store.updateSettings({ [setting]: '' })
+      encryptionAvailable = false
+      gate.finish.resolve()
+      await write
+      await store.flushPendingOrThrowAsync()
+      expect(readState().settings[setting]).toBe('')
+      expect(store.getSettings()[setting]).toBe('')
+    })
+
+    it('retains confirmed ciphertext until a newer secret can be encrypted', async () => {
+      const { store, authority, readState } = await fixture()
+      store.updateSettings({ [setting]: 'durable' })
+      await store.flushPendingOrThrowAsync()
+      const gate = authority.pause()
+      store.updateSettings({ [setting]: 'in-flight' })
+      const write = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+      await gate.started.promise
+      store.updateSettings({ [setting]: 'newer' })
+      encryptionAvailable = false
+      gate.finish.resolve()
+      await write
+      await store.flushPendingOrThrowAsync()
+      expect(readState().settings[setting]).toBe(ciphertext('in-flight'))
+      expect(store.getSettings()[setting]).toBe('newer')
+      encryptionAvailable = true
+      store.updateSettings({ theme: 'dark' })
+      await store.flushPendingOrThrowAsync()
+      expect(readState().settings[setting]).toBe(ciphertext('newer'))
+    })
+
+    it('retains the earlier ciphertext after a failed write and retries newer plaintext', async () => {
+      const { store, authority, readState } = await fixture()
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      store.updateSettings({ [setting]: 'durable' })
+      await store.flushPendingOrThrowAsync()
+      const gate = authority.pause()
+      store.updateSettings({ [setting]: 'failed' })
+      const write = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+      const failure = expect(write).rejects.toThrow('disk refused')
+      await gate.started.promise
+      store.updateSettings({ [setting]: 'newer' })
+      encryptionAvailable = false
+      gate.finish.reject(new Error('disk refused'))
+      await failure
+      await store.flushPendingOrThrowAsync()
+      expect(readState().settings[setting]).toBe(ciphertext('durable'))
+      encryptionAvailable = true
+      store.updateSettings({ theme: 'dark' })
+      await store.flushPendingOrThrowAsync()
+      expect(readState().settings[setting]).toBe(ciphertext('newer'))
+    })
+  }
+)
+
+describe('worker protected settings serialization', () => {
+  it.each(['selective', 'complete'] as const)(
+    'encrypts both protected credentials in a %s write to SQLite',
+    async (mode) => {
+      const { store, authority, readState } = await fixture()
+      const selectiveWrite = vi.spyOn(authority, 'writeSerializedDomains')
+      const completeWrite = vi.spyOn(authority, 'writeCompleteSerializedDomains')
+      const secrets = {
+        opencodeSessionCookie: 'cookie-only-plaintext',
+        opencodeGoApiKey: 'api-key-only-plaintext'
+      }
+      store.updateSettings(secrets)
+      if (mode === 'complete') {
+        store.updateOnboarding({ outcome: 'completed' })
+      }
+      await store.flushPendingOrThrowAsync()
+      expect(selectiveWrite).toHaveBeenCalledTimes(mode === 'selective' ? 1 : 0)
+      expect(completeWrite).toHaveBeenCalledTimes(mode === 'complete' ? 1 : 0)
+      const persisted = readState()
+      expect(persisted.settings).toMatchObject({
+        opencodeSessionCookie: ciphertext(secrets.opencodeSessionCookie),
+        opencodeGoApiKey: ciphertext(secrets.opencodeGoApiKey)
+      })
+      for (const plaintext of Object.values(secrets)) {
+        expect(JSON.stringify(persisted)).not.toContain(plaintext)
+      }
+      expect(store.getSettings()).toMatchObject(secrets)
+    }
+  )
+})
diff --git a/src/main/persistence/loading-store/profile-state-write-batching.test.ts b/src/main/persistence/loading-store/profile-state-write-batching.test.ts
new file mode 100644
index 00000000000..fb6f44a5d8a
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-write-batching.test.ts
@@ -0,0 +1,251 @@
+import { describe, expect, it, vi } from 'vitest'
+import { deferred, fixture } from './profile-state-delayed-authority-fixture'
+import { StateSerializationSecretHandlingOperations } from './state-serialization-secret-handling'
+import * as composition from './store-domain-composition'
+import type { StoreRuntimeState } from './store-runtime-state'
+import { ProfileStateRevisionConflictError } from '../profile-state/profile-state-document-validation'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+async function snapshotFixture() {
+  let captured: StoreRuntimeState | undefined
+  const createDomains = composition.createStoreDomains
+  vi.spyOn(composition, 'createStoreDomains').mockImplementationOnce((runtime) => {
+    captured = runtime
+    return createDomains(runtime)
+  })
+  const state = await fixture()
+  if (!captured) {
+    throw new Error('Store runtime was not initialized')
+  }
+  return { ...state, runtime: captured }
+}
+
+describe('queued worker snapshot batching', () => {
+  it.each(['explicit', 'debounce'] as const)(
+    'preserves getter-only edits when an explicit flush joins a dirty %s batch',
+    async (firstFlush) => {
+      const { store, authority, readState } = await fixture()
+      const gate = authority.pause()
+      vi.useFakeTimers()
+      try {
+        const mutation = store.runDurableMutation(() => {
+          store.updateSettings({ theme: 'dark' })
+          return { value: undefined }
+        })
+        await gate.started.promise
+        const first =
+          firstFlush === 'explicit'
+            ? store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+            : await vi.advanceTimersByTimeAsync(1_000)
+        store.getWorkspaceSession().activeTabId = 'getter-only-edit'
+        store.updateSettings({ theme: 'light' })
+        const second = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+        gate.finish.resolve()
+        await Promise.all([mutation, first, second])
+        expect(readState()).toMatchObject({
+          settings: { theme: 'light' },
+          workspaceSession: { activeTabId: 'getter-only-edit' }
+        })
+        expect(authority.captures).toHaveLength(2)
+      } finally {
+        gate.finish.resolve()
+        vi.useRealTimers()
+      }
+    }
+  )
+
+  it('preserves a queued explicit capture when a later debounce joins it', async () => {
+    const { store, authority, readState } = await fixture()
+    const gate = authority.pause()
+    vi.useFakeTimers()
+    try {
+      const mutation = store.runDurableMutation(() => {
+        store.updateSettings({ theme: 'dark' })
+        return { value: undefined }
+      })
+      await gate.started.promise
+      store.getWorkspaceSession().activeTabId = 'getter-only-edit'
+      const explicit = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+      store.updateSettings({ theme: 'light' })
+      await vi.advanceTimersByTimeAsync(1_000)
+      gate.finish.resolve()
+      await Promise.all([mutation, explicit])
+      expect(readState()).toMatchObject({
+        settings: { theme: 'light' },
+        workspaceSession: { activeTabId: 'getter-only-edit' }
+      })
+      expect(authority.captures).toHaveLength(2)
+    } finally {
+      gate.finish.resolve()
+      vi.useRealTimers()
+    }
+  })
+
+  it('keeps batches of only debounced saves selective', async () => {
+    const { store, authority, readState } = await fixture()
+    const full = vi.spyOn(authority, 'writeCompleteSerializedDomains')
+    const gate = authority.pause()
+    vi.useFakeTimers()
+    try {
+      const mutation = store.runDurableMutation(() => {
+        store.updateSettings({ theme: 'dark' })
+        return { value: undefined }
+      })
+      await gate.started.promise
+      await vi.advanceTimersByTimeAsync(1_000)
+      store.updateSettings({ theme: 'light' })
+      await vi.advanceTimersByTimeAsync(1_000)
+      gate.finish.resolve()
+      await mutation
+      await store.waitForPendingWrite()
+      expect(readState().settings.theme).toBe('light')
+      expect(authority.captures).toHaveLength(2)
+      expect(full).not.toHaveBeenCalled()
+    } finally {
+      gate.finish.resolve()
+      vi.useRealTimers()
+    }
+  })
+
+  it('captures getter-only edits in a flush requested after the preceding capture started', async () => {
+    const { store, authority, readState } = await fixture()
+    const fullCapture = vi.spyOn(
+      StateSerializationSecretHandlingOperations.prototype,
+      'buildStateToSave'
+    )
+    const firstGate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await firstGate.started.promise
+    store.getWorkspaceSession().activeTabId = 'getter-only-edit'
+    const second = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    firstGate.finish.resolve()
+    await Promise.all([first, second])
+    expect(readState().workspaceSession.activeTabId).toBe('getter-only-edit')
+    expect(fullCapture).toHaveBeenCalledOnce()
+  })
+
+  it('upgrades a queued debounce to capture an explicit getter-only flush', async () => {
+    const { store, authority, readState } = await fixture()
+    const gate = authority.pause()
+    vi.useFakeTimers()
+    try {
+      const first = store.runDurableMutation(() => {
+        store.updateSettings({ theme: 'dark' })
+        return { value: undefined }
+      })
+      await gate.started.promise
+      await vi.advanceTimersByTimeAsync(1_000)
+      store.getWorkspaceSession().activeTabId = 'explicit-edit'
+      const explicit = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+      gate.finish.resolve()
+      await Promise.all([first, explicit])
+      expect(readState().workspaceSession.activeTabId).toBe('explicit-edit')
+    } finally {
+      gate.finish.resolve()
+      vi.useRealTimers()
+    }
+  })
+
+  it('keeps a later flush ordered after an intervening durable mutation', async () => {
+    const { store, authority, readState } = await fixture()
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await gate.started.promise
+    const before = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    const mutation = store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'light' })
+      return { value: undefined }
+    })
+    const after = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    const verifyAfter = after.then(() => expect(readState().settings.theme).toBe('light'))
+    gate.finish.resolve()
+    await Promise.all([first, before, mutation, verifyAfter])
+  })
+
+  it('shares a queued write failure with its waiters and allows a fresh retry', async () => {
+    const { store, authority, readState } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await gate.started.promise
+    store.updateSettings({ theme: 'light' })
+    const failed = [
+      store.flushPendingOrThrowAsync({ drainToStableGeneration: false }),
+      store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    ].map((waiter) => expect(waiter).rejects.toThrow('disk refused'))
+    vi.spyOn(authority, 'writeCompleteSerializedDomains').mockRejectedValueOnce(
+      new Error('disk refused')
+    )
+    gate.finish.resolve()
+    await Promise.all([first, ...failed])
+    await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    expect(readState().settings.theme).toBe('light')
+  })
+
+  it('checks the disk revision for a clean batch and rejects every waiter on conflict', async () => {
+    const { store, authority } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const conflict = new ProfileStateRevisionConflictError(1, 2)
+    const revisionCheck = vi
+      .spyOn(authority, 'assertCurrentRevision')
+      .mockRejectedValueOnce(conflict)
+    const waiters = [
+      store.flushPendingOrThrowAsync({ drainToStableGeneration: false }),
+      store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    ]
+    await Promise.all(waiters.map((waiter) => expect(waiter).rejects.toBe(conflict)))
+    expect(revisionCheck).toHaveBeenCalledOnce()
+  })
+
+  it('waits for snapshot files admitted by a later member of the queued batch', async () => {
+    const { store, authority, readState, runtime } = await snapshotFixture()
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await gate.started.promise
+    const second = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    const snapshot = deferred<void>()
+    runtime.pendingSnapshotFileWork = snapshot.promise
+    store.updateSettings({ theme: 'light' })
+    const third = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    try {
+      gate.finish.resolve()
+      await first
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(authority.captures).toHaveLength(1)
+    } finally {
+      snapshot.resolve()
+      runtime.pendingSnapshotFileWork = null
+      await Promise.all([second, third])
+    }
+    expect(readState().settings.theme).toBe('light')
+  })
+
+  it('discards a queued batch when its predecessor dependency rejects', async () => {
+    const { store, readState, runtime } = await snapshotFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    runtime.pendingSnapshotFileWork = Promise.reject(new Error('snapshot preparation failed'))
+    const waiters = [
+      store.flushPendingOrThrowAsync({ drainToStableGeneration: false }),
+      store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    ]
+    await Promise.all(
+      waiters.map((waiter) => expect(waiter).rejects.toThrow('snapshot preparation failed'))
+    )
+    runtime.pendingSnapshotFileWork = null
+    store.updateSettings({ theme: 'light' })
+    await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    expect(readState().settings.theme).toBe('light')
+  })
+})
diff --git a/src/main/persistence/loading-store/pty-binding-async-durability.test.ts b/src/main/persistence/loading-store/pty-binding-async-durability.test.ts
new file mode 100644
index 00000000000..066cea3cce5
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-binding-async-durability.test.ts
@@ -0,0 +1,267 @@
+import { describe, expect, it, vi } from 'vitest'
+import { TEST_LEAF_1, TEST_LEAF_2 } from '../../persistence-session-fixtures'
+import { ProfileStateWriterError } from '../profile-state/profile-state-writer-errors'
+import { fixture } from './profile-state-delayed-authority-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'async-binding-tab',
+  leafId: TEST_LEAF_1,
+  ptyId: 'async-binding-pty',
+  incarnationId: 'async-binding-incarnation'
+}
+
+describe('durable asynchronous PTY binding', () => {
+  it('acknowledges only after the binding reaches SQLite', async () => {
+    const { store, authority, readState } = await fixture()
+    store.getWorkspaceSession().activeWorktreeIdsOnShutdown = []
+    await store.flushPendingOrThrowAsync()
+    const gate = authority.pause()
+    let acknowledged = false
+    const pending = store.persistPtyBinding(binding).then((result) => {
+      acknowledged = true
+      return result
+    })
+    await gate.started.promise
+    expect(acknowledged).toBe(false)
+    expect(readState().workspaceSession.terminalLayoutsByTabId[binding.tabId]).toBeUndefined()
+    expect(readState().workspaceSession.activeWorktreeIdsOnShutdown).toEqual([])
+    gate.finish.resolve()
+    expect(await pending).toBe(true)
+    expect(
+      readState().workspaceSession.terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId
+    ).toEqual({
+      [binding.leafId]: binding.ptyId
+    })
+    expect(readState().workspaceSession.activeWorktreeIdsOnShutdown).toEqual([binding.worktreeId])
+  })
+
+  it('repairs activity on an otherwise matching durable reattach', async () => {
+    const { store, authority, readState } = await fixture()
+    await store.persistPtyBinding(binding)
+    store.getWorkspaceSession().activeWorktreeIdsOnShutdown = []
+    await store.flushPendingOrThrowAsync()
+    authority.captures.length = 0
+    await store.persistPtyBinding(binding)
+    expect(readState().workspaceSession.activeWorktreeIdsOnShutdown).toEqual([binding.worktreeId])
+    expect(authority.captures).toHaveLength(1)
+    await store.persistPtyBinding(binding)
+    expect(authority.captures).toHaveLength(1)
+  })
+
+  it('evaluates membership refusal after an older write finishes', async () => {
+    const { store, authority } = await fixture()
+    await store.persistPtyBinding(binding)
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const older = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await gate.started.promise
+    const resolveBinding = vi.fn(() => ({ ...binding, mayCreate: false }))
+    const queued = store.persistPtyBinding(resolveBinding)
+    expect(resolveBinding).not.toHaveBeenCalled()
+    const session = store.getWorkspaceSession()
+    session.tabsByWorktree[binding.worktreeId] = []
+    delete session.terminalLayoutsByTabId[binding.tabId]
+    store.setWorkspaceSession(session)
+    gate.finish.resolve()
+    await older
+    expect(await queued).toBe(false)
+    expect(resolveBinding).toHaveBeenCalledTimes(1)
+  })
+
+  it('restores the binding after a known write failure', async () => {
+    const { store, authority } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    store.getWorkspaceSession().activeWorktreeIdsOnShutdown = []
+    const before = structuredClone(store.getWorkspaceSession())
+    const gate = authority.pause()
+    const rejected = expect(store.persistPtyBinding(binding)).rejects.toThrow('disk refused')
+    await gate.started.promise
+    gate.finish.reject(
+      new ProfileStateWriterError('test-disk-failure', 'disk refused', 'known-failure')
+    )
+    await rejected
+    expect(store.getWorkspaceSession()).toEqual(before)
+  })
+
+  it('preserves newer getter edits when an older binding write fails', async () => {
+    const { store, authority } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const gate = authority.pause()
+    const rejected = expect(store.persistPtyBinding(binding)).rejects.toThrow('disk refused')
+    await gate.started.promise
+    store.getWorkspaceSession().terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId = {
+      [binding.leafId]: 'newer-pty'
+    }
+    gate.finish.reject(
+      new ProfileStateWriterError('test-disk-failure', 'disk refused', 'known-failure')
+    )
+    await rejected
+    expect(
+      store.getWorkspaceSession().terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId
+    ).toEqual({
+      [binding.leafId]: 'newer-pty'
+    })
+  })
+
+  it.each(['tab title', 'pane title'] as const)(
+    'rolls back a failed replacement while preserving a newer %s',
+    async (edit) => {
+      const { store, authority, readState } = await fixture()
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      await store.persistPtyBinding(binding)
+      const gate = authority.pause()
+      const rejected = expect(
+        store.persistPtyBinding({
+          ...binding,
+          ptyId: 'failed-replacement',
+          incarnationId: 'failed-incarnation',
+          expectedBinding: binding
+        })
+      ).rejects.toThrow('disk refused')
+      await gate.started.promise
+      const session = store.getWorkspaceSession()
+      const tab = session.tabsByWorktree[binding.worktreeId].find(
+        (candidate) => candidate.id === binding.tabId
+      )
+      if (!tab) {
+        throw new Error('binding did not create its terminal row')
+      }
+      if (edit === 'tab title') {
+        tab.customTitle = 'new title'
+      } else {
+        session.terminalLayoutsByTabId[binding.tabId].titlesByLeafId = {
+          [binding.leafId]: 'new title'
+        }
+      }
+      gate.finish.reject(
+        new ProfileStateWriterError('test-disk-failure', 'disk refused', 'known-failure')
+      )
+      await rejected
+      await store.flushPendingOrThrowAsync()
+      const persisted = readState().workspaceSession
+      expect(persisted.terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId).toEqual({
+        [binding.leafId]: binding.ptyId
+      })
+      expect(persisted.terminalPtyIncarnationsByPaneKey[`${binding.tabId}:${binding.leafId}`]).toBe(
+        binding.incarnationId
+      )
+      if (edit === 'tab title') {
+        expect(persisted.tabsByWorktree[binding.worktreeId]).toContainEqual(
+          expect.objectContaining({ id: binding.tabId, customTitle: 'new title' })
+        )
+      } else {
+        expect(persisted.terminalLayoutsByTabId[binding.tabId].titlesByLeafId).toEqual({
+          [binding.leafId]: 'new title'
+        })
+      }
+    }
+  )
+
+  it('rolls back a failed binding while retaining an unrelated newer navigation edit', async () => {
+    const { store, authority } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const gate = authority.pause()
+    const rejected = expect(store.persistPtyBinding(binding)).rejects.toThrow('disk refused')
+    await gate.started.promise
+    store.getWorkspaceSession().activeRepoId = 'newer-repo'
+    gate.finish.reject(
+      new ProfileStateWriterError('test-disk-failure', 'disk refused', 'known-failure')
+    )
+    await rejected
+    expect(store.getWorkspaceSession().activeRepoId).toBe('newer-repo')
+    expect(store.getWorkspaceSession().terminalLayoutsByTabId[binding.tabId]).toBeUndefined()
+  })
+
+  it('retains a newer root sibling when rolling back a failed leaf replacement', async () => {
+    const { store, authority, readState } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    await store.persistPtyBinding(binding)
+    const gate = authority.pause()
+    const rejected = expect(
+      store.persistPtyBinding({ ...binding, ptyId: 'failed-replacement' })
+    ).rejects.toThrow('disk refused')
+    await gate.started.promise
+    const session = store.getWorkspaceSession()
+    const tab = session.tabsByWorktree[binding.worktreeId].find(
+      (candidate) => candidate.id === binding.tabId
+    )
+    if (!tab) {
+      throw new Error('binding did not create its terminal row')
+    }
+    const layout = session.terminalLayoutsByTabId[binding.tabId]
+    layout.root = {
+      type: 'split',
+      direction: 'horizontal',
+      first: { type: 'leaf', leafId: TEST_LEAF_2 },
+      second: { type: 'leaf', leafId: binding.leafId }
+    }
+    layout.ptyIdsByLeafId = { ...layout.ptyIdsByLeafId, [TEST_LEAF_2]: 'new-root-pty' }
+    tab.ptyId = 'new-root-pty'
+    gate.finish.reject(
+      new ProfileStateWriterError('test-disk-failure', 'disk refused', 'known-failure')
+    )
+    await rejected
+    await store.flushPendingOrThrowAsync()
+    const persisted = readState().workspaceSession
+    expect(persisted.terminalLayoutsByTabId[binding.tabId].root).toEqual(layout.root)
+    expect(persisted.terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId).toEqual({
+      [binding.leafId]: binding.ptyId,
+      [TEST_LEAF_2]: 'new-root-pty'
+    })
+    expect(persisted.tabsByWorktree[binding.worktreeId]).toContainEqual(
+      expect.objectContaining({ id: binding.tabId, ptyId: 'new-root-pty' })
+    )
+  })
+
+  it('removes a failed new binding while retaining a newer sibling tab', async () => {
+    const { store, authority } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const gate = authority.pause()
+    const rejected = expect(store.persistPtyBinding(binding)).rejects.toThrow('disk refused')
+    await gate.started.promise
+    const tabs = store.getWorkspaceSession().tabsByWorktree[binding.worktreeId]
+    const boundTab = tabs.find((tab) => tab.id === binding.tabId)
+    if (!boundTab) {
+      throw new Error('binding did not create its terminal row')
+    }
+    tabs.push({ ...boundTab, id: 'newer-sibling', ptyId: 'newer-sibling-pty' })
+    gate.finish.reject(
+      new ProfileStateWriterError('test-disk-failure', 'disk refused', 'known-failure')
+    )
+    await rejected
+    expect(
+      store.getWorkspaceSession().tabsByWorktree[binding.worktreeId].map((tab) => tab.id)
+    ).toContain('newer-sibling')
+    expect(
+      store.getWorkspaceSession().tabsByWorktree[binding.worktreeId].map((tab) => tab.id)
+    ).not.toContain(binding.tabId)
+    expect(store.getWorkspaceSession().terminalLayoutsByTabId[binding.tabId]).toBeUndefined()
+  })
+
+  it('retains a binding whose commit outcome is indeterminate', async () => {
+    const { store, authority } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const gate = authority.pause()
+    const rejected = expect(store.persistPtyBinding(binding)).rejects.toThrow('worker exited')
+    await gate.started.promise
+    gate.finish.reject(
+      new ProfileStateWriterError('test-worker-exit', 'worker exited', 'indeterminate')
+    )
+    await rejected
+    expect(
+      store.getWorkspaceSession().terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId
+    ).toEqual({
+      [binding.leafId]: binding.ptyId
+    })
+  })
+})
diff --git a/src/main/persistence/loading-store/pty-binding-created-surface-rollback.test.ts b/src/main/persistence/loading-store/pty-binding-created-surface-rollback.test.ts
new file mode 100644
index 00000000000..0feed681bf0
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-binding-created-surface-rollback.test.ts
@@ -0,0 +1,135 @@
+import { expect, it, vi } from 'vitest'
+import { TEST_LEAF_1, TEST_LEAF_2 } from '../../persistence-session-fixtures'
+import { collectLayoutLeafIdsInOrder } from '../restoring-sessions/terminal-layout-normalization'
+import { ProfileStateWriterError } from '../profile-state/profile-state-writer-errors'
+import { fixture } from './profile-state-delayed-authority-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+it.each(['tab title', 'pane title', 'new sibling'] as const)(
+  'retains a valid unbound new surface after a failed binding and newer %s',
+  async (edit) => {
+    const { store, authority, readState } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const binding = {
+      worktreeId: 'repo-local::/fixture/local',
+      tabId: 'new-binding-tab',
+      leafId: TEST_LEAF_1,
+      ptyId: 'failed-pty',
+      incarnationId: 'failed-incarnation'
+    }
+    const gate = authority.pause()
+    const rejected = expect(store.persistPtyBinding(binding)).rejects.toThrow('disk refused')
+    await gate.started.promise
+    const session = store.getWorkspaceSession()
+    const tab = session.tabsByWorktree[binding.worktreeId].find(
+      (candidate) => candidate.id === binding.tabId
+    )
+    if (!tab) {
+      throw new Error('binding did not create its terminal row')
+    }
+    const layout = session.terminalLayoutsByTabId[binding.tabId]
+    if (edit === 'tab title') {
+      tab.customTitle = 'new title'
+    } else if (edit === 'pane title') {
+      layout.titlesByLeafId = { [binding.leafId]: 'new title' }
+    } else {
+      layout.root = {
+        type: 'split',
+        direction: 'horizontal',
+        first: { type: 'leaf', leafId: binding.leafId },
+        second: { type: 'leaf', leafId: TEST_LEAF_2 }
+      }
+      layout.ptyIdsByLeafId = { ...layout.ptyIdsByLeafId, [TEST_LEAF_2]: 'sibling-pty' }
+      session.terminalPtyIncarnationsByPaneKey = {
+        ...session.terminalPtyIncarnationsByPaneKey,
+        [`${binding.tabId}:${TEST_LEAF_2}`]: 'sibling-incarnation'
+      }
+      tab.ptyId = 'sibling-pty'
+    }
+    gate.finish.reject(
+      new ProfileStateWriterError('test-disk-failure', 'disk refused', 'known-failure')
+    )
+    await rejected
+    await store.flushPendingOrThrowAsync()
+    const persisted = readState().workspaceSession
+    expect(JSON.stringify(persisted)).not.toContain('failed-pty')
+    expect(JSON.stringify(persisted)).not.toContain('failed-incarnation')
+    expect(persisted.tabsByWorktree[binding.worktreeId]).toContainEqual(
+      expect.objectContaining({
+        id: binding.tabId,
+        worktreeId: binding.worktreeId,
+        createdAt: expect.any(Number),
+        ptyId: edit === 'new sibling' ? 'sibling-pty' : null,
+        ...(edit === 'tab title' ? { customTitle: 'new title' } : {})
+      })
+    )
+    expect(persisted.terminalLayoutsByTabId[binding.tabId]).toMatchObject({
+      root: layout.root,
+      ...(edit === 'pane title' ? { titlesByLeafId: { [binding.leafId]: 'new title' } } : {})
+    })
+    if (edit === 'new sibling') {
+      expect(persisted.terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId).toEqual({
+        [TEST_LEAF_2]: 'sibling-pty'
+      })
+      expect(persisted.terminalPtyIncarnationsByPaneKey).toEqual({
+        [`${binding.tabId}:${TEST_LEAF_2}`]: 'sibling-incarnation'
+      })
+    }
+  }
+)
+
+it('preserves the valid newer tree after a failed split insertion', async () => {
+  const { store, authority, readState } = await fixture()
+  vi.spyOn(console, 'error').mockImplementation(() => {})
+  const binding = {
+    worktreeId: 'repo-local::/fixture/local',
+    tabId: 'split-binding-tab',
+    leafId: TEST_LEAF_1,
+    ptyId: 'original-pty',
+    incarnationId: 'original-incarnation'
+  }
+  await store.persistPtyBinding(binding)
+  const gate = authority.pause()
+  const rejected = expect(
+    store.persistPtyBinding({
+      ...binding,
+      leafId: TEST_LEAF_2,
+      ptyId: 'failed-pty',
+      incarnationId: 'failed-incarnation'
+    })
+  ).rejects.toThrow('disk refused')
+  await gate.started.promise
+  const layout = store.getWorkspaceSession().terminalLayoutsByTabId[binding.tabId]
+  if (!layout.root) {
+    throw new Error('binding did not create its layout')
+  }
+  const laterLeaf = '33333333-3333-4333-8333-333333333333'
+  layout.root = {
+    type: 'split',
+    direction: 'horizontal',
+    first: layout.root,
+    second: { type: 'leaf', leafId: laterLeaf }
+  }
+  layout.ptyIdsByLeafId = { ...layout.ptyIdsByLeafId, [laterLeaf]: 'later-sibling-pty' }
+  const expectedRoot = structuredClone(layout.root)
+  gate.finish.reject(
+    new ProfileStateWriterError('test-disk-failure', 'disk refused', 'known-failure')
+  )
+  await rejected
+  await store.flushPendingOrThrowAsync()
+  const persisted = readState().workspaceSession.terminalLayoutsByTabId[binding.tabId]
+  expect(persisted.root).toEqual(expectedRoot)
+  expect(collectLayoutLeafIdsInOrder(persisted.root)).toContain(laterLeaf)
+  expect(persisted.ptyIdsByLeafId).toEqual({
+    [TEST_LEAF_1]: 'original-pty',
+    [laterLeaf]: 'later-sibling-pty'
+  })
+})
diff --git a/src/main/persistence/loading-store/pty-binding-fast-lane.test.ts b/src/main/persistence/loading-store/pty-binding-fast-lane.test.ts
index 8ac6de70a0d..3f8cc1c7e7d 100644
--- a/src/main/persistence/loading-store/pty-binding-fast-lane.test.ts
+++ b/src/main/persistence/loading-store/pty-binding-fast-lane.test.ts
@@ -71,6 +71,7 @@ describe('evaluatePtyBindingFastLane', () => {
       )
     ).toEqual(['layout_missing'])
     expect(miss({ incarnationId: 'a' })).toEqual(['incarnation'])
+    expect(miss({}, session({ activeWorktreeIdsOnShutdown: [] }))).toEqual(['inactive_worktree'])
     expect(miss({}, session({ terminalPtyIncarnationsByPaneKey: { [paneKey]: 'a' } }))).toEqual([
       'incarnation'
     ])
diff --git a/src/main/persistence/loading-store/pty-binding-fast-lane.ts b/src/main/persistence/loading-store/pty-binding-fast-lane.ts
index 9ae6304ed0f..3f0763c883f 100644
--- a/src/main/persistence/loading-store/pty-binding-fast-lane.ts
+++ b/src/main/persistence/loading-store/pty-binding-fast-lane.ts
@@ -18,6 +18,7 @@ export type PtyBindingFastLaneMiss =
   | 'leaf_pty'
   | 'incarnation'
   | 'tombstone'
+  | 'inactive_worktree'
   | 'not_durable'
 
 export type PtyBindingFastLaneRequest = {
@@ -80,6 +81,12 @@ export function evaluatePtyBindingFastLane(
   if (session.terminalSurfaceTombstonesByPaneKey?.[paneKey]) {
     misses.push('tombstone')
   }
+  if (
+    session.activeWorktreeIdsOnShutdown &&
+    !session.activeWorktreeIdsOnShutdown.includes(bindingWorktreeId)
+  ) {
+    misses.push('inactive_worktree')
+  }
   if (!durable) {
     misses.push('not_durable')
   }
diff --git a/src/main/persistence/loading-store/pty-binding-persistence.ts b/src/main/persistence/loading-store/pty-binding-persistence.ts
index c3cbff0796a..c90544f7502 100644
--- a/src/main/persistence/loading-store/pty-binding-persistence.ts
+++ b/src/main/persistence/loading-store/pty-binding-persistence.ts
@@ -1,15 +1,9 @@
+import { isDeepStrictEqual } from 'node:util'
 import { LOCAL_EXECUTION_HOST_ID, parseExecutionHostId } from '../../../shared/execution-host'
 import { isTerminalLeafId } from '../../../shared/stable-pane-id'
 import type { WorkspaceSessionState } from '../../../shared/workspace-session-state-types'
-import { getRepoIdFromWorktreeId } from '../../../shared/worktree/id'
-import {
-  cloneLayoutNode,
-  layoutContainsLeafId
-} from '../restoring-sessions/terminal-layout-normalization'
-import {
-  cloneWorkspaceSessionState,
-  createMinimalPersistedTerminalTab
-} from '../restoring-sessions/session-owner-fields'
+import { rollbackFailedPtyBinding } from './pty-binding-write-rollback'
+import { cloneWorkspaceSessionState } from '../restoring-sessions/session-owner-fields'
 
 import type { PtyBindingSourceExpectation } from './store'
 
@@ -18,21 +12,22 @@ import type { SessionHostPartitionOperations } from './session-host-partitions'
 import { resolveHostId } from './session-host-partitions'
 import { evaluatePtyBindingFastLane } from './pty-binding-fast-lane'
 import { ptyBindingIsRefused } from './pty-binding-refusals'
-import { startPtyBindingSpan, type PtyBindingOrigin } from './pty-binding-span'
-import { tabRowPtyIdAfterLeafBinding } from './terminal-tab-pty-ownership'
+import { startPtyBindingSpan, type PtyBindingOrigin, type PtyBindingSpan } from './pty-binding-span'
+import { applyPtyBinding } from './pty-binding-session-update'
 
 type PtyBindingPersistenceOperationsRuntime = Pick<
   StoreRuntimeState,
-  | 'flushOrThrow'
+  | 'runDurableMutation'
   | 'lastDurableWriteGeneration'
   | 'pendingWrite'
   | 'quitFlushStarted'
+  | 'dirtyProfileStateDomains'
   | 'state'
   | 'writeGeneration'
   | 'writeTimer'
 >
 
-type PersistPtyBindingArgs = {
+export type PersistPtyBindingArgs = {
   worktreeId: string
   tabId: string
   leafId: string
@@ -72,43 +67,60 @@ export class PtyBindingPersistenceOperations {
     this[ptyBindingPersistenceOperationsContext] = { runtime, sessions }
   }
 
-  persistPtyBinding(args: PersistPtyBindingArgs, hostId?: string | null): boolean {
-    const runtime = this[ptyBindingPersistenceOperationsContext].runtime
+  async persistPtyBinding(
+    input: PersistPtyBindingArgs | (() => PersistPtyBindingArgs | null),
+    hostId?: string | null
+  ): Promise<boolean> {
+    const { runtime, sessions } = this[ptyBindingPersistenceOperationsContext]
     const resolvedHostId = resolveHostId(hostId)
-    const session =
-      this[ptyBindingPersistenceOperationsContext].sessions.getWorkspaceSession(resolvedHostId)
-    const paneKey = `${args.tabId}:${args.leafId}`
-    const bindingWorktreeId = args.expectedSourceBinding?.worktreeId ?? args.worktreeId
-    const span = startPtyBindingSpan({
-      hostKind: parseExecutionHostId(resolvedHostId)?.kind ?? 'local',
-      origin: args.origin ?? 'unknown',
-      savePending: runtime.writeTimer !== null || runtime.pendingWrite !== null,
-      generationGap: runtime.writeGeneration - runtime.lastDurableWriteGeneration
-    })
-    if (ptyBindingIsRefused(args, session, bindingWorktreeId, paneKey)) {
-      span.finish('refused')
-      return false
-    }
-    // A durable reattach needs neither a session clone nor whole-state serialization.
-    const verdict = evaluatePtyBindingFastLane(
-      args,
-      session,
-      bindingWorktreeId,
-      !runtime.quitFlushStarted && runtime.lastDurableWriteGeneration >= runtime.writeGeneration
-    )
-    span.setEligibility(verdict)
-    if (verdict.eligible) {
-      span.finish('fast_lane')
-      return true
-    }
+    const savePending = runtime.writeTimer !== null || runtime.pendingWrite !== null
+    let span: PtyBindingSpan | undefined
+    let outcome: 'refused' | 'fast_lane' | 'flushed' = 'flushed'
     try {
-      writePtyBinding(this, args, session, resolvedHostId, bindingWorktreeId, paneKey)
-    } catch (err) {
-      span.finish('threw', err)
-      throw err
+      const persisted = await runtime.runDurableMutation(() => {
+        const args = typeof input === 'function' ? input() : input
+        if (!args) {
+          return { value: false, persist: false }
+        }
+        // Measure the admitted binding operation; queue time precedes its current-state checks.
+        span = startPtyBindingSpan({
+          hostKind: parseExecutionHostId(resolvedHostId)?.kind ?? 'local',
+          origin: args.origin ?? 'unknown',
+          savePending,
+          generationGap: runtime.writeGeneration - runtime.lastDurableWriteGeneration
+        })
+        const paneKey = `${args.tabId}:${args.leafId}`
+        const bindingWorktreeId = args.expectedSourceBinding?.worktreeId ?? args.worktreeId
+        const session = sessions.getWorkspaceSession(resolvedHostId)
+        const partitions = sessions
+          .getWorkspaceSessionHostIds()
+          .map((hostId) => sessions.getWorkspaceSession(hostId))
+        if (ptyBindingIsRefused(args, session, bindingWorktreeId, paneKey, partitions)) {
+          outcome = 'refused'
+          return { value: false, persist: false }
+        }
+        const verdict = evaluatePtyBindingFastLane(
+          args,
+          session,
+          bindingWorktreeId,
+          !runtime.quitFlushStarted && runtime.lastDurableWriteGeneration >= runtime.writeGeneration
+        )
+        span.setEligibility(verdict)
+        if (verdict.eligible) {
+          outcome = 'fast_lane'
+          return { value: true, persist: false }
+        }
+        return {
+          value: true,
+          rollback: writePtyBinding(this, args, session, resolvedHostId, bindingWorktreeId, paneKey)
+        }
+      })
+      span?.finish(outcome)
+      return persisted
+    } catch (error) {
+      span?.finish('threw', error)
+      throw error
     }
-    span.finish('flushed')
-    return true
   }
 }
 
@@ -119,9 +131,19 @@ function writePtyBinding(
   resolvedHostId: ReturnType<typeof resolveHostId>,
   bindingWorktreeId: string,
   paneKey: string
-): void {
-  const runtime = owner[ptyBindingPersistenceOperationsContext].runtime
+): () => void {
+  const { runtime, sessions } = owner[ptyBindingPersistenceOperationsContext]
   const sessionBeforeBinding = cloneWorkspaceSessionState(session)
+  const restore = (restoredSession = sessionBeforeBinding): void => {
+    if (resolvedHostId === LOCAL_EXECUTION_HOST_ID) {
+      runtime.state.workspaceSession = restoredSession
+    } else {
+      runtime.state.workspaceSessionsByHostId = {
+        ...runtime.state.workspaceSessionsByHostId,
+        [resolvedHostId]: restoredSession
+      }
+    }
+  }
   try {
     if (resolvedHostId !== LOCAL_EXECUTION_HOST_ID) {
       runtime.state.workspaceSessionsByHostId = {
@@ -130,144 +152,44 @@ function writePtyBinding(
       }
     }
     applyPtyBinding(args, session, bindingWorktreeId, paneKey)
-    runtime.flushOrThrow()
-  } catch (err) {
-    if (resolvedHostId === LOCAL_EXECUTION_HOST_ID) {
-      runtime.state.workspaceSession = sessionBeforeBinding
-    } else {
-      runtime.state.workspaceSessionsByHostId = {
-        ...runtime.state.workspaceSessionsByHostId,
-        [resolvedHostId]: sessionBeforeBinding
-      }
-    }
-    throw err
-  }
-}
-
-function applyPtyBinding(
-  args: PersistPtyBindingArgs,
-  session: WorkspaceSessionState,
-  bindingWorktreeId: string,
-  paneKey: string
-): void {
-  const reconciledIncarnation =
-    args.expectedBinding !== undefined && args.incarnationId !== args.expectedBinding.incarnationId
-  let terminalMembershipChanged = false
-  let hostAdmittedTabCreated = false
-  const advanceTopologyFence = (): void => {
-    const repoId = getRepoIdFromWorktreeId(bindingWorktreeId)
-    const currentRevision = session.terminalTopologyRevisionByRepoId?.[repoId] ?? 0
-    // Why: a split, or a host-admitted tab the renderer has never seen, is itself
-    // the authority — with no fence the renderer's pre-create tab list replays
-    // over it and the tab is lost even on the repo's first such change.
-    const establishesMembershipAuthority =
-      args.expectedSourceBinding !== undefined || hostAdmittedTabCreated
-    if (
-      !reconciledIncarnation &&
-      (!terminalMembershipChanged || (currentRevision <= 0 && !establishesMembershipAuthority))
-    ) {
-      return
-    }
-    // Why: host-admitted membership or incarnation changes must outrank a stale renderer replay.
-    session.terminalTopologyRevisionByRepoId = {
-      ...session.terminalTopologyRevisionByRepoId,
-      [repoId]: currentRevision + 1
-    }
-  }
-  if (args.incarnationId) {
-    session.terminalPtyIncarnationsByPaneKey = {
-      ...session.terminalPtyIncarnationsByPaneKey,
-      [paneKey]: args.incarnationId
-    }
-    if (session.terminalSurfaceTombstonesByPaneKey?.[paneKey]) {
-      session.terminalSurfaceTombstonesByPaneKey = {
-        ...session.terminalSurfaceTombstonesByPaneKey
-      }
-      delete session.terminalSurfaceTombstonesByPaneKey[paneKey]
-    }
-  }
-  const tabs = session.tabsByWorktree?.[bindingWorktreeId]
-  const tab = tabs?.find((t) => t.id === args.tabId)
-  if (tab) {
-    tab.ptyId = tabRowPtyIdAfterLeafBinding(
-      tab,
-      session.terminalLayoutsByTabId?.[args.tabId]?.ptyIdsByLeafId,
-      args.leafId,
-      args.ptyId
+    runtime.dirtyProfileStateDomains?.add(
+      resolvedHostId === LOCAL_EXECUTION_HOST_ID ? 'workspaceSession' : 'workspaceSessionsByHostId'
     )
-  } else {
-    terminalMembershipChanged = true
-    hostAdmittedTabCreated = args.hostAdmittedMembership === true
-    // Why: pty:spawn can beat the debounced writer; persist a minimal tab so hydration won't prune the binding as orphaned.
-    const nextTabs = [
-      ...(tabs ?? []),
-      createMinimalPersistedTerminalTab({
-        ...args,
-        worktreeId: bindingWorktreeId,
-        existingTabCount: tabs?.length ?? 0
-      })
-    ]
-    session.tabsByWorktree = {
-      ...session.tabsByWorktree,
-      [bindingWorktreeId]: nextTabs
-    }
-    session.activeWorktreeId ??= bindingWorktreeId
-    session.activeTabId ??= args.tabId
-    session.activeTabIdByWorktree = {
-      ...session.activeTabIdByWorktree,
-      [bindingWorktreeId]: session.activeTabIdByWorktree?.[bindingWorktreeId] ?? args.tabId
-    }
-  }
-  // Why: host-initiated persist snapshots used to omit this write-once guard, so every launch or reattach treated the worktree as never having default terminals applied.
-  session.defaultTerminalTabsAppliedByWorktreeId = {
-    ...session.defaultTerminalTabsAppliedByWorktreeId,
-    [bindingWorktreeId]: true
-  }
-  if (!isTerminalLeafId(args.leafId)) {
-    // Why: keep legacy renderer-local pane ids out of durable leaf-keyed layout state after the UUID migration.
-    advanceTopologyFence()
-    return
-  }
-  const layout = session.terminalLayoutsByTabId?.[args.tabId]
-  if (layout) {
-    if (!layout.root) {
-      terminalMembershipChanged = true
-      // Why: createTab can persist an empty layout before TerminalPane mounts; the sync binding still needs a durable root.
-      layout.root = { type: 'leaf', leafId: args.leafId }
-      layout.activeLeafId = args.leafId
-      layout.expandedLeafId = null
-    } else if (!layoutContainsLeafId(layout.root, args.leafId)) {
-      terminalMembershipChanged = true
-      // Why: splitPane spawns before its snapshot reaches main; add a minimal leaf so a crash can't strand the pane's binding.
-      layout.root = {
-        type: 'split',
-        direction: 'vertical',
-        first: cloneLayoutNode(layout.root),
-        second: { type: 'leaf', leafId: args.leafId }
+    const boundSession = cloneWorkspaceSessionState(session)
+    return () => {
+      const current = sessions.getWorkspaceSession(resolvedHostId)
+      const ownerState = (value: WorkspaceSessionState) => {
+        const tab = value.tabsByWorktree[bindingWorktreeId]?.find((tab) => tab.id === args.tabId)
+        return {
+          createdAt: tab?.createdAt,
+          generation: tab?.generation,
+          worktreeId: tab?.worktreeId,
+          ptyId: isTerminalLeafId(args.leafId)
+            ? value.terminalLayoutsByTabId[args.tabId]?.ptyIdsByLeafId?.[args.leafId]
+            : tab?.ptyId,
+          incarnation: value.terminalPtyIncarnationsByPaneKey?.[paneKey]
+        }
       }
-      layout.activeLeafId = args.leafId
-      if (layout.expandedLeafId && !layoutContainsLeafId(layout.root, layout.expandedLeafId)) {
-        layout.expandedLeafId = null
+      // Presentation edits do not replace the binding that must be rolled back.
+      if (!isDeepStrictEqual(ownerState(current), ownerState(boundSession))) {
+        return
       }
-    }
-    layout.ptyIdsByLeafId = {
-      ...layout.ptyIdsByLeafId,
-      [args.leafId]: args.ptyId
-    }
-  } else {
-    terminalMembershipChanged = true
-    // Why: first tab spawn — persist a minimal layout so a SIGKILL before the renderer snapshot can't lose ptyIdsByLeafId.
-    session.terminalLayoutsByTabId = {
-      ...session.terminalLayoutsByTabId,
-      [args.tabId]: {
-        root: { type: 'leaf', leafId: args.leafId },
-        activeLeafId: args.leafId,
-        expandedLeafId: null,
-        ptyIdsByLeafId: { [args.leafId]: args.ptyId }
+      const rolledBack = rollbackFailedPtyBinding(
+        sessionBeforeBinding,
+        boundSession,
+        current,
+        bindingWorktreeId,
+        args.tabId,
+        args.leafId
+      )
+      if (rolledBack !== current) {
+        restore(rolledBack)
       }
     }
+  } catch (error) {
+    restore()
+    throw error
   }
-  advanceTopologyFence()
 }
 
 export function installPtyBindingPersistenceOperationsContext(
diff --git a/src/main/persistence/loading-store/pty-binding-refusals.ts b/src/main/persistence/loading-store/pty-binding-refusals.ts
index 3c61056bfca..636e69bd936 100644
--- a/src/main/persistence/loading-store/pty-binding-refusals.ts
+++ b/src/main/persistence/loading-store/pty-binding-refusals.ts
@@ -1,3 +1,4 @@
+import { hasClosedTerminalTabRecord } from '../../../shared/closed-terminal-tab-tombstones'
 import { isTerminalLeafId } from '../../../shared/stable-pane-id'
 import type { WorkspaceSessionState } from '../../../shared/workspace-session-state-types'
 import { layoutContainsLeafId } from '../restoring-sessions/terminal-layout-normalization'
@@ -13,7 +14,7 @@ export type PtyBindingRefusalRequest = {
 }
 
 /**
- * The four fences a binding must clear before anything is mutated, so a refusal leaves nothing
+ * The five fences a binding must clear before anything is mutated, so a refusal leaves nothing
  * half-written. Order matters: every `false` here is returned before the write path or the
  * fast lane can run, which is what the relay's lease expiry and the stable-owner throw rely on.
  */
@@ -21,7 +22,10 @@ export function ptyBindingIsRefused(
   args: PtyBindingRefusalRequest,
   session: WorkspaceSessionState,
   bindingWorktreeId: string,
-  paneKey: string
+  paneKey: string,
+  /** Every host partition: a close is recorded where the tab lived, which need not be where this
+   *  binding lands (a relay reattach binds into `local`). */
+  partitions: readonly WorkspaceSessionState[] = [session]
 ): boolean {
   if (args.expectedSourceBinding) {
     const expected = args.expectedSourceBinding
@@ -56,6 +60,19 @@ export function ptyBindingIsRefused(
       return true
     }
   }
+  const existingTab = session.tabsByWorktree?.[bindingWorktreeId]?.find(
+    (candidate) => candidate.id === args.tabId
+  )
+  // Why: a closed tab's spawn can commit after the close, even after a crash and relaunch; tab
+  // ids are uuids, so a recorded id is never a new tab.
+  if (
+    !existingTab &&
+    partitions.some((partition) =>
+      hasClosedTerminalTabRecord(partition.closedTerminalTabTombstonesByTabId, args.tabId)
+    )
+  ) {
+    return true
+  }
   // Mirrors the four creating branches of the write path — mint a tab, mint a root leaf, split
   // the root and graft a leaf, mint a layout — each of which sets `terminalMembershipChanged`.
   if (
@@ -65,9 +82,6 @@ export function ptyBindingIsRefused(
     return true
   }
   if (args.mayCreate === false) {
-    const existingTab = session.tabsByWorktree?.[bindingWorktreeId]?.find(
-      (candidate) => candidate.id === args.tabId
-    )
     const existingLayout = session.terminalLayoutsByTabId?.[args.tabId]
     const wouldCreateTopology =
       !existingTab ||
diff --git a/src/main/persistence/loading-store/pty-binding-session-update.ts b/src/main/persistence/loading-store/pty-binding-session-update.ts
new file mode 100644
index 00000000000..3024543505a
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-binding-session-update.ts
@@ -0,0 +1,146 @@
+import { isTerminalLeafId } from '../../../shared/stable-pane-id'
+import type { WorkspaceSessionState } from '../../../shared/workspace-session-state-types'
+import { getRepoIdFromWorktreeId } from '../../../shared/worktree/id'
+import {
+  cloneLayoutNode,
+  layoutContainsLeafId
+} from '../restoring-sessions/terminal-layout-normalization'
+import { createMinimalPersistedTerminalTab } from '../restoring-sessions/session-owner-fields'
+import { tabRowPtyIdAfterLeafBinding } from './terminal-tab-pty-ownership'
+import type { PersistPtyBindingArgs } from './pty-binding-persistence'
+
+export function applyPtyBinding(
+  args: PersistPtyBindingArgs,
+  session: WorkspaceSessionState,
+  bindingWorktreeId: string,
+  paneKey: string
+): void {
+  const reconciledIncarnation =
+    args.expectedBinding !== undefined && args.incarnationId !== args.expectedBinding.incarnationId
+  let terminalMembershipChanged = false
+  let hostAdmittedTabCreated = false
+  const advanceTopologyFence = (): void => {
+    const repoId = getRepoIdFromWorktreeId(bindingWorktreeId)
+    const currentRevision = session.terminalTopologyRevisionByRepoId?.[repoId] ?? 0
+    // Why: a split, or a host-admitted tab the renderer has never seen, is itself
+    // the authority — with no fence the renderer's pre-create tab list replays
+    // over it and the tab is lost even on the repo's first such change.
+    const establishesMembershipAuthority =
+      args.expectedSourceBinding !== undefined || hostAdmittedTabCreated
+    if (
+      !reconciledIncarnation &&
+      (!terminalMembershipChanged || (currentRevision <= 0 && !establishesMembershipAuthority))
+    ) {
+      return
+    }
+    // Why: host-admitted membership or incarnation changes must outrank a stale renderer replay.
+    session.terminalTopologyRevisionByRepoId = {
+      ...session.terminalTopologyRevisionByRepoId,
+      [repoId]: currentRevision + 1
+    }
+  }
+  if (args.incarnationId) {
+    session.terminalPtyIncarnationsByPaneKey = {
+      ...session.terminalPtyIncarnationsByPaneKey,
+      [paneKey]: args.incarnationId
+    }
+    if (session.terminalSurfaceTombstonesByPaneKey?.[paneKey]) {
+      session.terminalSurfaceTombstonesByPaneKey = {
+        ...session.terminalSurfaceTombstonesByPaneKey
+      }
+      delete session.terminalSurfaceTombstonesByPaneKey[paneKey]
+    }
+  }
+  const tabs = session.tabsByWorktree?.[bindingWorktreeId]
+  const tab = tabs?.find((t) => t.id === args.tabId)
+  if (tab) {
+    tab.ptyId = tabRowPtyIdAfterLeafBinding(
+      tab,
+      session.terminalLayoutsByTabId?.[args.tabId]?.ptyIdsByLeafId,
+      args.leafId,
+      args.ptyId
+    )
+  } else {
+    terminalMembershipChanged = true
+    hostAdmittedTabCreated = args.hostAdmittedMembership === true
+    // Why: pty:spawn can beat the debounced writer; persist a minimal tab so hydration won't prune the binding as orphaned.
+    const nextTabs = [
+      ...(tabs ?? []),
+      createMinimalPersistedTerminalTab({
+        ...args,
+        worktreeId: bindingWorktreeId,
+        existingTabCount: tabs?.length ?? 0
+      })
+    ]
+    session.tabsByWorktree = {
+      ...session.tabsByWorktree,
+      [bindingWorktreeId]: nextTabs
+    }
+    session.activeWorktreeId ??= bindingWorktreeId
+    session.activeTabId ??= args.tabId
+    session.activeTabIdByWorktree = {
+      ...session.activeTabIdByWorktree,
+      [bindingWorktreeId]: session.activeTabIdByWorktree?.[bindingWorktreeId] ?? args.tabId
+    }
+  }
+  // Why: host-initiated persist snapshots used to omit this write-once guard, so every launch or reattach treated the worktree as never having default terminals applied.
+  session.defaultTerminalTabsAppliedByWorktreeId = {
+    ...session.defaultTerminalTabsAppliedByWorktreeId,
+    [bindingWorktreeId]: true
+  }
+  // Acknowledged spawns must survive a crash before the renderer records their activity.
+  if (
+    session.activeWorktreeIdsOnShutdown &&
+    !session.activeWorktreeIdsOnShutdown.includes(bindingWorktreeId)
+  ) {
+    session.activeWorktreeIdsOnShutdown = [
+      ...session.activeWorktreeIdsOnShutdown,
+      bindingWorktreeId
+    ]
+  }
+  if (!isTerminalLeafId(args.leafId)) {
+    // Why: keep legacy renderer-local pane ids out of durable leaf-keyed layout state after the UUID migration.
+    advanceTopologyFence()
+    return
+  }
+  const layout = session.terminalLayoutsByTabId?.[args.tabId]
+  if (layout) {
+    if (!layout.root) {
+      terminalMembershipChanged = true
+      // Why: createTab can persist an empty layout before TerminalPane mounts; the sync binding still needs a durable root.
+      layout.root = { type: 'leaf', leafId: args.leafId }
+      layout.activeLeafId = args.leafId
+      layout.expandedLeafId = null
+    } else if (!layoutContainsLeafId(layout.root, args.leafId)) {
+      terminalMembershipChanged = true
+      // Why: splitPane spawns before its snapshot reaches main; add a minimal leaf so a crash can't strand the pane's binding.
+      layout.root = {
+        type: 'split',
+        direction: 'vertical',
+        first: cloneLayoutNode(layout.root),
+        second: { type: 'leaf', leafId: args.leafId }
+      }
+      layout.activeLeafId = args.leafId
+      if (layout.expandedLeafId && !layoutContainsLeafId(layout.root, layout.expandedLeafId)) {
+        layout.expandedLeafId = null
+      }
+    }
+    layout.ptyIdsByLeafId = {
+      ...layout.ptyIdsByLeafId,
+      [args.leafId]: args.ptyId
+    }
+  } else {
+    terminalMembershipChanged = true
+    // Why: first tab spawn — persist a minimal layout so a SIGKILL before the renderer snapshot can't lose ptyIdsByLeafId.
+    session.terminalLayoutsByTabId = {
+      ...session.terminalLayoutsByTabId,
+      [args.tabId]: {
+        root: { type: 'leaf', leafId: args.leafId },
+        activeLeafId: args.leafId,
+        expandedLeafId: null,
+        ptyIdsByLeafId: { [args.leafId]: args.ptyId }
+      }
+    }
+  }
+  advanceTopologyFence()
+}
diff --git a/src/main/persistence/loading-store/pty-binding-span.ts b/src/main/persistence/loading-store/pty-binding-span.ts
index 58bed424a51..903d93c4967 100644
--- a/src/main/persistence/loading-store/pty-binding-span.ts
+++ b/src/main/persistence/loading-store/pty-binding-span.ts
@@ -10,11 +10,13 @@ export type PtyBindingSpanOutcome = 'fast_lane' | 'flushed' | 'refused' | 'threw
  */
 export type PtyBindingOrigin = 'reattach' | 'spawn' | 'relay_reattach' | 'split' | 'unknown'
 
+export type PtySpawnCommitOrigin = Extract<PtyBindingOrigin, 'reattach' | 'spawn' | 'split'>
+
 /** The spawn-commit paths share one rule: a split outranks a reattach, a reattach outranks a spawn. */
 export function spawnCommitBindingOrigin(
   commit: { isReattach?: boolean; agentSessionEnsure?: { disposition: string } },
   expectedSourceBinding?: unknown
-): PtyBindingOrigin {
+): PtySpawnCommitOrigin {
   if (expectedSourceBinding !== undefined) {
     return 'split'
   }
diff --git a/src/main/persistence/loading-store/pty-binding-write-rollback.ts b/src/main/persistence/loading-store/pty-binding-write-rollback.ts
new file mode 100644
index 00000000000..af7cb63d7b0
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-binding-write-rollback.ts
@@ -0,0 +1,94 @@
+import { isDeepStrictEqual } from 'node:util'
+import type { WorkspaceSessionState } from '../../../shared/workspace-session-state-types'
+import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from '../restoring-sessions/workspace-session-write-rollback'
+
+function restoreBindingSlot(
+  original: Record<string, string> | undefined,
+  staged: Record<string, string> | undefined,
+  current: Record<string, string> | undefined,
+  key: string
+): Record<string, string> | undefined {
+  if (current?.[key] !== staged?.[key] || original?.[key] === staged?.[key]) {
+    return current
+  }
+  const restored = { ...current }
+  const previous = original?.[key]
+  if (previous === undefined) {
+    delete restored[key]
+  } else {
+    restored[key] = previous
+  }
+  return original === undefined && Object.keys(restored).length === 0 ? undefined : restored
+}
+
+export function rollbackFailedPtyBinding(
+  original: WorkspaceSessionState,
+  staged: WorkspaceSessionState,
+  current: WorkspaceSessionState,
+  worktreeId: string,
+  tabId: string,
+  leafId: string
+): WorkspaceSessionState {
+  const tab = (session: WorkspaceSessionState) =>
+    session.tabsByWorktree[worktreeId]?.find((candidate) => candidate.id === tabId)
+  const stagedTab = tab(staged)
+  const originalLayout = original.terminalLayoutsByTabId[tabId]
+  const stagedLayout = staged.terminalLayoutsByTabId[tabId]
+  let baseline = original
+  if (
+    stagedTab &&
+    (!isDeepStrictEqual(tab(current), stagedTab) ||
+      !isDeepStrictEqual(current.terminalLayoutsByTabId[tabId], stagedLayout))
+  ) {
+    // Keep edited new surfaces structurally valid, without the failed process binding.
+    baseline = {
+      ...original,
+      tabsByWorktree: tab(original)
+        ? original.tabsByWorktree
+        : {
+            ...original.tabsByWorktree,
+            [worktreeId]: [
+              ...(original.tabsByWorktree[worktreeId] ?? []),
+              { ...stagedTab, ptyId: null }
+            ]
+          },
+      terminalLayoutsByTabId:
+        originalLayout || !stagedLayout
+          ? original.terminalLayoutsByTabId
+          : {
+              ...original.terminalLayoutsByTabId,
+              [tabId]: { ...stagedLayout, ptyIdsByLeafId: {} }
+            }
+    }
+  }
+  const restored = rollbackWorkspaceSessionAfterFailedAsyncWrite(baseline, staged, current)
+  const layout = restored.terminalLayoutsByTabId[tabId]
+  const currentRoot = current.terminalLayoutsByTabId[tabId]?.root
+  return {
+    ...restored,
+    ...(layout
+      ? {
+          terminalLayoutsByTabId: {
+            ...restored.terminalLayoutsByTabId,
+            [tabId]: {
+              ...layout,
+              // A tree is one value; fieldwise rollback can mix leaf and split node shapes.
+              root: isDeepStrictEqual(currentRoot, stagedLayout?.root) ? layout.root : currentRoot,
+              ptyIdsByLeafId: restoreBindingSlot(
+                originalLayout?.ptyIdsByLeafId,
+                stagedLayout?.ptyIdsByLeafId,
+                layout.ptyIdsByLeafId,
+                leafId
+              )
+            }
+          }
+        }
+      : {}),
+    terminalPtyIncarnationsByPaneKey: restoreBindingSlot(
+      original.terminalPtyIncarnationsByPaneKey,
+      staged.terminalPtyIncarnationsByPaneKey,
+      restored.terminalPtyIncarnationsByPaneKey,
+      `${tabId}:${leafId}`
+    )
+  }
+}
diff --git a/src/main/persistence/loading-store/pty-reattach-failure-routing.test.ts b/src/main/persistence/loading-store/pty-reattach-failure-routing.test.ts
new file mode 100644
index 00000000000..16f2978e04b
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-reattach-failure-routing.test.ts
@@ -0,0 +1,122 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { fixture } from './profile-state-delayed-authority-fixture'
+import { OrcaRuntimeService } from '../../runtime/orca-runtime'
+import { commitPtyIpcSpawn } from '../../ipc/pty/ipc/spawn-commit'
+import { createPtyIpcSpawnState } from '../../ipc/pty/ipc/spawn-state'
+import { commitRuntimePtySpawn } from '../../ipc/pty/runtime/spawn-commit'
+import { createRuntimePtySpawnState } from '../../ipc/pty/runtime/spawn-state'
+import { createPtySpawnCommitDependencies } from './pty-spawn-commit-dependencies-fixture'
+import { clearProviderPtyState } from '../../ipc/pty/provider/state-cleanup'
+import { ptyIncarnationById, ptyOwnership } from '../../ipc/pty/provider/ownership-state'
+import { toSshExecutionHostId } from '../../../shared/execution-host'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const connectionId = 'reattach-host'
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+  leafId: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+  ptyId: 'ssh:reattach-host@@surviving-pty'
+}
+const incarnation = 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
+const successorIncarnation = 'dddddddd-dddd-4ddd-8ddd-dddddddddddd'
+
+afterEach(() => {
+  clearProviderPtyState(binding.ptyId)
+  ptyOwnership.delete(binding.ptyId)
+})
+
+describe.each(['ipc', 'runtime'])('%s failed reattach routing', (controller) => {
+  it.each(
+    [undefined, incarnation].flatMap((incarnationId) =>
+      ['live', 'exited', 'replaced'].map((outcome) => ({ incarnationId, outcome }))
+    )
+  )(
+    'preserves host evidence after a failed save: $outcome, $incarnationId',
+    async ({ incarnationId, outcome }) => {
+      const { store, authority, readState } = await fixture()
+      const runtime = new OrcaRuntimeService(store)
+      runtime.onPtySpawned(binding.ptyId, incarnationId)
+      const deps = createPtySpawnCommitDependencies(runtime, store)
+      const publish = vi.spyOn(deps, 'sendPtySpawnedToRenderer')
+      const result = { id: binding.ptyId, incarnationId, isReattach: true }
+      let commit: () => Promise<unknown>
+      let shutdown: ReturnType<typeof vi.spyOn>
+      if (controller === 'ipc') {
+        const ctx = createPtyIpcSpawnState(deps, {
+          ...binding,
+          connectionId,
+          cols: 80,
+          rows: 24
+        })
+        ctx.result = result
+        ctx.metadataLeafId = binding.leafId
+        ctx.validatedLeafId = binding.leafId
+        shutdown = vi.spyOn(ctx.provider, 'shutdown')
+        commit = () => commitPtyIpcSpawn(ctx)
+      } else {
+        const ctx = createRuntimePtySpawnState(deps, {
+          ...binding,
+          connectionId,
+          cols: 80,
+          rows: 24
+        })
+        ctx.result = result
+        ctx.metadataLeafId = binding.leafId
+        ctx.hostSessionBinding = { store, ...binding }
+        shutdown = vi.spyOn(ctx.provider, 'shutdown')
+        commit = () => commitRuntimePtySpawn(ctx)
+      }
+      const gate = authority.pause()
+      const pending = expect(commit()).rejects.toThrow('ORCA_TERMINAL_SESSION_STATE_SAVE_FAILED')
+      await gate.started.promise
+      const ownerWhileSaving = ptyOwnership.get(binding.ptyId)
+      if (outcome !== 'live') {
+        clearProviderPtyState(binding.ptyId)
+        ptyOwnership.delete(binding.ptyId)
+        await runtime.onPtyExit(binding.ptyId, 0, incarnationId, { providerExitObserved: true })
+        if (outcome === 'replaced') {
+          runtime.onPtySpawned(binding.ptyId, successorIncarnation)
+          ptyOwnership.set(binding.ptyId, 'successor-host')
+          ptyIncarnationById.set(binding.ptyId, successorIncarnation)
+        }
+      }
+      gate.finish.reject(new Error('disk full'))
+      await pending
+      expect(ownerWhileSaving).toBe(connectionId)
+      expect(ptyOwnership.get(binding.ptyId)).toBe(
+        outcome === 'live' ? connectionId : outcome === 'replaced' ? 'successor-host' : undefined
+      )
+      expect(ptyIncarnationById.get(binding.ptyId)).toBe(
+        outcome === 'live'
+          ? incarnationId
+          : outcome === 'replaced'
+            ? successorIncarnation
+            : undefined
+      )
+      expect(shutdown).not.toHaveBeenCalled()
+      expect(publish).not.toHaveBeenCalled()
+      expect(store.getSshRemotePtyLeases(connectionId)).toEqual([])
+      const session = readState().workspaceSessionsByHostId[toSshExecutionHostId(connectionId)]
+      expect(
+        session?.terminalLayoutsByTabId[binding.tabId]?.ptyIdsByLeafId?.[binding.leafId]
+      ).toBeUndefined()
+      if (outcome !== 'exited') {
+        await runtime.onPtyExit(
+          binding.ptyId,
+          0,
+          outcome === 'replaced' ? successorIncarnation : incarnationId,
+          { providerExitObserved: true }
+        )
+      }
+    }
+  )
+})
diff --git a/src/main/persistence/loading-store/pty-retirement-async-durability.test.ts b/src/main/persistence/loading-store/pty-retirement-async-durability.test.ts
new file mode 100644
index 00000000000..6751cc3a010
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-retirement-async-durability.test.ts
@@ -0,0 +1,119 @@
+import { describe, expect, it, vi } from 'vitest'
+import { toSshExecutionHostId } from '../../../shared/execution-host'
+import { retirePersistedStablePaneOwner } from '../../ipc/pty/pane/stable-owner'
+import { TEST_LEAF_1 } from '../../persistence-session-fixtures'
+import { retireTerminalSurfaceFromPersistence } from '../../runtime/mobile-session-terminal-persistence-retirement'
+import { ProfileStateWriterError } from '../profile-state/profile-state-writer-errors'
+import { fixture } from './profile-state-delayed-authority-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'retirement-tab',
+  leafId: TEST_LEAF_1,
+  ptyId: 'retirement-pty',
+  incarnationId: 'retirement-incarnation'
+}
+
+async function retirementFixture(connectionId: string | undefined) {
+  const result = await fixture()
+  const hostId = connectionId ? toSshExecutionHostId(connectionId) : undefined
+  await result.store.persistPtyBinding(binding, hostId)
+  return {
+    ...result,
+    retire: () =>
+      retirePersistedStablePaneOwner(
+        result.store,
+        { ...binding, persistedIncarnationId: binding.incarnationId },
+        binding.worktreeId,
+        connectionId
+      ),
+    removeInMemory: () => {
+      result.store.setWorkspaceSession(
+        retireTerminalSurfaceFromPersistence(result.store.getWorkspaceSession(hostId), {
+          ...binding,
+          parentTabId: binding.tabId
+        }),
+        hostId
+      )
+    },
+    persistedLayout: () => {
+      const state = result.readState()
+      const session = hostId ? state.workspaceSessionsByHostId[hostId] : state.workspaceSession
+      return session.terminalLayoutsByTabId[binding.tabId]
+    }
+  }
+}
+
+describe.each([undefined, 'retirement-ssh'])(
+  'durable PTY retirement on host %s',
+  (connectionId) => {
+    it('waits for an already removed in-memory pane to reach SQLite', async () => {
+      const { authority, retire, removeInMemory, persistedLayout } =
+        await retirementFixture(connectionId)
+      removeInMemory()
+      expect(persistedLayout()?.ptyIdsByLeafId).toEqual({ [binding.leafId]: binding.ptyId })
+      const gate = authority.pause()
+      let acknowledged = false
+      const pending = retire().then((accepted) => {
+        acknowledged = true
+        return accepted
+      })
+      try {
+        await Promise.race([gate.started.promise, pending])
+        expect(acknowledged).toBe(false)
+        expect(persistedLayout()?.ptyIdsByLeafId).toEqual({ [binding.leafId]: binding.ptyId })
+      } finally {
+        gate.finish.resolve()
+      }
+      await expect(pending).resolves.toBe(true)
+      expect(persistedLayout()).toBeUndefined()
+    })
+
+    it('rejects when a pending removal cannot reach SQLite and retains it for retry', async () => {
+      const { authority, retire, removeInMemory, persistedLayout } =
+        await retirementFixture(connectionId)
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      removeInMemory()
+      const gate = authority.pause()
+      const rejected = expect(retire()).rejects.toThrow('retirement disk refused')
+      try {
+        await Promise.race([gate.started.promise, rejected])
+        gate.finish.reject(
+          new ProfileStateWriterError(
+            'test-disk-failure',
+            'retirement disk refused',
+            'known-failure'
+          )
+        )
+        await rejected
+      } finally {
+        gate.finish.resolve()
+      }
+      expect(persistedLayout()?.ptyIdsByLeafId).toEqual({ [binding.leafId]: binding.ptyId })
+      await expect(retire()).resolves.toBe(true)
+      expect(persistedLayout()).toBeUndefined()
+    })
+
+    it('skips disk work when the pane removal is already durable', async () => {
+      const { authority, retire, persistedLayout } = await retirementFixture(connectionId)
+      await expect(retire()).resolves.toBe(true)
+      expect(persistedLayout()).toBeUndefined()
+      authority.captures.length = 0
+      const revisionCheck = vi.spyOn(authority, 'assertCurrentRevision')
+      const fullStateWrite = vi.spyOn(authority, 'writeSerializedState')
+      await expect(retire()).resolves.toBe(true)
+      expect(authority.captures).toEqual([])
+      expect(revisionCheck).not.toHaveBeenCalled()
+      expect(fullStateWrite).not.toHaveBeenCalled()
+    })
+  }
+)
diff --git a/src/main/persistence/loading-store/pty-retirement-publication-during-read.test.ts b/src/main/persistence/loading-store/pty-retirement-publication-during-read.test.ts
new file mode 100644
index 00000000000..34b6e742804
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-retirement-publication-during-read.test.ts
@@ -0,0 +1,141 @@
+import { expect, it, vi } from 'vitest'
+import { fixture } from './profile-state-delayed-authority-fixture'
+import { OrcaRuntimeService } from '../../runtime/orca-runtime'
+import type { RuntimeMobileSessionTabsSnapshot } from '../../../shared/runtime-types'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+  leafId: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+  ptyId: 'retiring-pty',
+  incarnationId: 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
+}
+class RetirementRuntime extends OrcaRuntimeService {
+  readVisibleState() {
+    return this.readVisibleTerminalState(binding.ptyId)
+  }
+  snapshot(): RuntimeMobileSessionTabsSnapshot | undefined {
+    return this.mobileSessionTabsByWorktree.get(binding.worktreeId)
+  }
+  generations(): number {
+    return this.ptyLifecycleGenerationById.size
+  }
+  async closeTab(): Promise<void> {
+    const snapshot = this.snapshot()
+    const tab = snapshot?.tabs[0]
+    if (!snapshot || tab?.type !== 'terminal') {
+      throw new Error('missing test tab')
+    }
+    await this.closeHeadlessMobileTerminalTab(binding.worktreeId, snapshot, tab)
+  }
+  publish(layoutOnly = false): void {
+    this.storeMobileSessionSnapshot(binding.worktreeId, {
+      worktree: binding.worktreeId,
+      publicationEpoch: 'retirement-test',
+      snapshotVersion: 1,
+      activeGroupId: null,
+      activeTabId: `${binding.tabId}::${binding.leafId}`,
+      activeTabType: 'terminal',
+      tabs: [
+        {
+          type: 'terminal',
+          id: `${binding.tabId}::${binding.leafId}`,
+          parentTabId: binding.tabId,
+          leafId: binding.leafId,
+          ptyId: layoutOnly ? null : binding.ptyId,
+          ...(layoutOnly
+            ? {
+                parentLayout: {
+                  root: { type: 'leaf' as const, leafId: binding.leafId },
+                  activeLeafId: binding.leafId,
+                  expandedLeafId: null,
+                  ptyIdsByLeafId: { [binding.leafId]: binding.ptyId }
+                }
+              }
+            : {}),
+          title: 'Terminal',
+          isActive: true
+        }
+      ]
+    })
+  }
+}
+
+it.each(['read', 'replacement', 'legacy-replacement'] as const)(
+  'publishes an exited terminal retirement with concurrent %s',
+  async (action) => {
+    const { store, authority, readState } = await fixture()
+    await store.persistPtyBinding(binding)
+    const runtime = new RetirementRuntime(store)
+    runtime.registerPty(binding.ptyId, binding.worktreeId, null, binding)
+    runtime.publish()
+    const gate = authority.pause()
+    const exiting = runtime.onPtyExit(binding.ptyId, 0, binding.incarnationId, {
+      providerExitObserved: true
+    })
+    await gate.started.promise
+    if (action === 'read') {
+      await runtime.readVisibleState()
+    } else if (action === 'legacy-replacement') {
+      runtime.onPtySpawned(binding.ptyId)
+    } else {
+      runtime.onPtySpawned(binding.ptyId, 'dddddddd-dddd-4ddd-8ddd-dddddddddddd')
+    }
+    gate.finish.resolve()
+    await exiting
+    expect(readState().workspaceSession.terminalLayoutsByTabId[binding.tabId]).toBeUndefined()
+    // Why every action: the exit retired the leaf in memory before any of them could run.
+    expect(runtime.snapshot()?.tabs).toHaveLength(0)
+  }
+)
+
+it('publishes an exit whose only live ownership is the mobile parent layout', async () => {
+  const { store, authority, readState } = await fixture()
+  await store.persistPtyBinding(binding)
+  const runtime = new RetirementRuntime(store)
+  runtime.publish(true)
+  const gate = authority.pause()
+  const exiting = runtime.onPtyExit(binding.ptyId, 0, binding.incarnationId, {
+    providerExitObserved: true
+  })
+  await gate.started.promise
+  gate.finish.resolve()
+  await exiting
+  expect(readState().workspaceSession.terminalLayoutsByTabId[binding.tabId]).toBeUndefined()
+  expect(runtime.snapshot()?.tabs).toEqual([])
+  expect(runtime.generations()).toBe(0)
+})
+
+it('completes a durable close and refuses a split queued behind it', async () => {
+  const { store, authority, readState } = await fixture()
+  await store.persistPtyBinding(binding)
+  const runtime = new RetirementRuntime(store)
+  const kill = vi.fn(() => true)
+  runtime.setPtyController({ write: () => true, kill, getForegroundProcess: async () => null })
+  runtime.registerPty(binding.ptyId, binding.worktreeId, null, binding)
+  runtime.publish()
+  const gate = authority.pause()
+  const close = runtime.closeTab()
+  await gate.started.promise
+  const split = store.persistPtyBinding({
+    ...binding,
+    leafId: 'dddddddd-dddd-4ddd-8ddd-dddddddddddd',
+    ptyId: 'concurrent-split',
+    expectedSourceBinding: binding
+  })
+  gate.finish.resolve()
+  await close
+  await expect(split).resolves.toBe(false)
+  expect(kill).toHaveBeenCalledExactlyOnceWith(binding.ptyId)
+  expect(runtime.snapshot()?.tabs).toEqual([])
+  expect(readState().workspaceSession.terminalLayoutsByTabId[binding.tabId]).toBeUndefined()
+})
diff --git a/src/main/persistence/loading-store/pty-spawn-commit-dependencies-fixture.ts b/src/main/persistence/loading-store/pty-spawn-commit-dependencies-fixture.ts
new file mode 100644
index 00000000000..2777fdfde4b
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-spawn-commit-dependencies-fixture.ts
@@ -0,0 +1,44 @@
+import type { PtySpawnIpcDeps } from '../../ipc/pty/ipc/spawn-types'
+import type { PtyRuntimeControllerDeps } from '../../ipc/pty/runtime/controller-deps'
+import type { OrcaRuntimeService } from '../../runtime/orca-runtime'
+import type { Store } from './store'
+
+function unexpectedPreflight(): never {
+  throw new Error('Spawn commit must not rerun preflight')
+}
+
+export function createPtySpawnCommitDependencies(
+  runtime: OrcaRuntimeService,
+  store: Store
+): PtySpawnIpcDeps & PtyRuntimeControllerDeps {
+  return {
+    runtime,
+    store,
+    sendPtySpawnedToRenderer: () => {},
+    getLocalPtyStartupPromise: unexpectedPreflight,
+    getLocalPtyProviderStartupPromise: unexpectedPreflight,
+    adoptStablePane: unexpectedPreflight,
+    assertFolderWorkspacePtyPathUsable: unexpectedPreflight,
+    resolvePtySpawnStartupCwd: unexpectedPreflight,
+    localStartupCwdDirectoryExists: unexpectedPreflight,
+    prepareCodexResumeHome: unexpectedPreflight,
+    noCodexResumeLaunch: unexpectedPreflight,
+    resolveCodexResumeLaunch: unexpectedPreflight,
+    reconcileSharedRuntimeResumeHome: unexpectedPreflight,
+    stripSequencedStartupResumeArgv: unexpectedPreflight,
+    transitionSpawnHiddenRendererPtyDeliveryState: unexpectedPreflight,
+    trustedTerminalHandleEnv: new Set(),
+    syncPtyBackgroundedDelivery: unexpectedPreflight,
+    stopReplacedPty: unexpectedPreflight,
+    requestSerializedBuffer: unexpectedPreflight,
+    shutdownProviderAndDetectExit: unexpectedPreflight,
+    rememberSyntheticKillExit: unexpectedPreflight,
+    rememberRetiredRejectedPty: unexpectedPreflight,
+    sendPtyExitToRenderer: unexpectedPreflight,
+    finishPtyShutdown: unexpectedPreflight,
+    retiredRejectedPtyIds: new Map(),
+    get mainWindow() {
+      return unexpectedPreflight()
+    }
+  }
+}
diff --git a/src/main/persistence/loading-store/pty-spawn-exit-durability.test.ts b/src/main/persistence/loading-store/pty-spawn-exit-durability.test.ts
new file mode 100644
index 00000000000..ef146779b4b
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-spawn-exit-durability.test.ts
@@ -0,0 +1,238 @@
+import { expect, it, vi } from 'vitest'
+import { fixture } from './profile-state-delayed-authority-fixture'
+import { OrcaRuntimeService } from '../../runtime/orca-runtime'
+import { commitRuntimePtySpawn } from '../../ipc/pty/runtime/spawn-commit'
+import { createRuntimePtySpawnState } from '../../ipc/pty/runtime/spawn-state'
+import type { PtyRuntimeControllerDeps } from '../../ipc/pty/runtime/controller-deps'
+import { commitPtyIpcSpawn } from '../../ipc/pty/ipc/spawn-commit'
+import { createPtyIpcSpawnState } from '../../ipc/pty/ipc/spawn-state'
+import type { PtySpawnIpcDeps } from '../../ipc/pty/ipc/spawn-types'
+import { registerPersistedPtySpawn } from '../../ipc/pty/pane/spawn-registration'
+import { toSshExecutionHostId } from '../../../shared/execution-host'
+import { clearProviderPtyState } from '../../ipc/pty/provider/state-cleanup'
+import { ptyOwnership, ptyIncarnationById } from '../../ipc/pty/provider/ownership-state'
+import { ptySizes } from '../../ipc/pty/delivery/visibility-state'
+import {
+  paneSpawnReservationsByOwnerKey,
+  reservePaneSpawn,
+  reserveIdlePaneSpawn,
+  resolvePaneSpawnReservation,
+  type PaneSpawnReservation
+} from '../../ipc/pty/pane/spawn-reservation'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+it.each(
+  [
+    { controller: 'runtime', connectionId: null, exitCode: 0 },
+    { controller: 'runtime', connectionId: 'test-host', exitCode: 0 },
+    { controller: 'ipc', connectionId: null, exitCode: -1 },
+    { controller: 'ipc', connectionId: 'test-host', exitCode: 0 }
+  ].flatMap((test) => [
+    { ...test, stableOwner: false },
+    { ...test, stableOwner: true }
+  ])
+)(
+  'retires an exited $controller binding on $connectionId after disk finishes (stable: $stableOwner)',
+  async ({ controller, connectionId, exitCode, stableOwner }) => {
+    const { store, authority, readState } = await fixture()
+    const runtime = new OrcaRuntimeService(store)
+    const binding = {
+      worktreeId: 'repo-local::/fixture/local',
+      tabId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+      leafId: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+      ptyId: connectionId
+        ? `ssh:${connectionId}@@pty-exited-during-durable-bind`
+        : 'pty-exited-during-durable-bind',
+      incarnationId: 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
+    }
+    const owner = stableOwner
+      ? {
+          ...binding,
+          hasPersistedBinding: true as const,
+          persistedIncarnationId: 'previous-incarnation'
+        }
+      : null
+    if (owner) {
+      await store.persistPtyBinding(
+        { ...binding, incarnationId: owner.persistedIncarnationId },
+        connectionId ? toSshExecutionHostId(connectionId) : undefined
+      )
+    }
+    runtime.onPtySpawned(binding.ptyId, binding.incarnationId)
+    runtime.beginPtyRegistration(binding.ptyId, binding.incarnationId)
+    runtime.assertPtyRegistrationAllowed(binding.ptyId, binding.incarnationId)
+    let commit: () => Promise<unknown>
+    const reservationKey = JSON.stringify([connectionId, binding.worktreeId, binding.leafId])
+    let reservation: PaneSpawnReservation | undefined
+    if (controller === 'runtime') {
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only commit runs; its runtime/store are real and preflight-only dependencies are unreachable.
+      const deps = { runtime, store, options: {} } as PtyRuntimeControllerDeps
+      const ctx = createRuntimePtySpawnState(deps, { ...binding, connectionId, cols: 80, rows: 24 })
+      ctx.result = { id: binding.ptyId, incarnationId: binding.incarnationId }
+      ctx.stablePaneOwner = owner
+      ctx.hostSessionBinding = { store, ...binding }
+      ctx.metadataLeafId = binding.leafId
+      commit = () => commitRuntimePtySpawn(ctx)
+    } else {
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only commit runs; its runtime/store are real and preflight-only dependencies are unreachable.
+      const deps = { runtime, store } as PtySpawnIpcDeps
+      const ctx = createPtyIpcSpawnState(deps, { ...binding, connectionId, cols: 80, rows: 24 })
+      ctx.result = { id: binding.ptyId, incarnationId: binding.incarnationId }
+      ctx.stablePaneOwner = owner
+      ctx.metadataLeafId = binding.leafId
+      ctx.validatedLeafId = binding.leafId
+      reservation = reservePaneSpawn(reservationKey)
+      ctx.paneSpawnReservationKey = reservationKey
+      ctx.paneSpawnReservation = reservation
+      commit = () => commitPtyIpcSpawn(ctx)
+    }
+    const gate = authority.pause()
+    const pending =
+      controller === 'ipc'
+        ? expect(commit()).resolves.toMatchObject({
+            id: binding.ptyId,
+            incarnationId: binding.incarnationId
+          })
+        : expect(commit()).rejects.toThrow('agent_session_exited_during_start')
+    await gate.started.promise
+    const nextReservation = reservation ? reserveIdlePaneSpawn(reservationKey) : undefined
+    clearProviderPtyState(binding.ptyId)
+    ptyOwnership.delete(binding.ptyId)
+    await runtime.onPtyExit(binding.ptyId, exitCode, binding.incarnationId, {
+      providerExitObserved: true
+    })
+    gate.finish.resolve()
+    await pending
+    expect(ptyOwnership.has(binding.ptyId)).toBe(false)
+    expect(ptyIncarnationById.has(binding.ptyId)).toBe(false)
+    expect(ptySizes.has(binding.ptyId)).toBe(false)
+    expect(
+      store
+        .getSshRemotePtyLeases(connectionId ?? undefined)
+        .some((lease) => lease.ptyId.includes('pty-exited-during-durable-bind'))
+    ).toBe(false)
+    if (reservation) {
+      await expect(reservation.promise).resolves.toMatchObject({ id: binding.ptyId })
+      const next = await nextReservation
+      expect(next).not.toBe(reservation)
+      resolvePaneSpawnReservation(reservationKey, next, { id: 'next-spawn' })
+      expect(paneSpawnReservationsByOwnerKey.has(reservationKey)).toBe(false)
+    }
+    const state = readState()
+    const session = connectionId
+      ? state.workspaceSessionsByHostId[toSshExecutionHostId(connectionId)]
+      : state.workspaceSession
+    expect(
+      session.terminalLayoutsByTabId[binding.tabId]?.ptyIdsByLeafId?.[binding.leafId]
+    ).toBeUndefined()
+  }
+)
+
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+  leafId: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+  ptyId: 'exited-pty',
+  incarnationId: 'old-incarnation'
+}
+
+it.each(['replacement-pty', binding.ptyId])(
+  'preserves a replacement binding to %s while retirement waits',
+  async (ptyId) => {
+    const { store, authority, readState } = await fixture()
+    const runtime = new OrcaRuntimeService(store)
+    runtime.beginPtyRegistration(binding.ptyId, binding.incarnationId)
+    await store.persistPtyBinding(binding)
+    await runtime.onPtyExit(binding.ptyId, 0, binding.incarnationId, { providerExitObserved: true })
+    const gate = authority.pause()
+    const replacement = store.persistPtyBinding({
+      ...binding,
+      ptyId,
+      incarnationId: 'new-incarnation'
+    })
+    await gate.started.promise
+    const registration = expect(
+      registerPersistedPtySpawn(runtime, store, binding.ptyId, binding.worktreeId, null, binding)
+    ).rejects.toThrow('agent_session_exited_during_start')
+    gate.finish.resolve()
+    await Promise.all([replacement, registration])
+    const session = readState().workspaceSession
+    expect(session.terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId[binding.leafId]).toBe(ptyId)
+    expect(session.terminalPtyIncarnationsByPaneKey[`${binding.tabId}:${binding.leafId}`]).toBe(
+      'new-incarnation'
+    )
+  }
+)
+
+it('retains the binding when loss of contact supplies no process-exit proof', async () => {
+  const { store, readState } = await fixture()
+  const runtime = new OrcaRuntimeService(store)
+  runtime.beginPtyRegistration(binding.ptyId, binding.incarnationId)
+  await store.persistPtyBinding(binding)
+  await runtime.onPtyExit(binding.ptyId, -1, binding.incarnationId)
+  expect(() =>
+    registerPersistedPtySpawn(runtime, store, binding.ptyId, binding.worktreeId, null, binding)
+  ).toThrow('agent_session_exited_during_start')
+  expect(
+    readState().workspaceSession.terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId[
+      binding.leafId
+    ]
+  ).toBe(binding.ptyId)
+})
+
+it('does not settle rejected registration until its exit cleanup reaches SQLite', async () => {
+  const { store, authority, readState } = await fixture()
+  const runtime = new OrcaRuntimeService(store)
+  runtime.beginPtyRegistration(binding.ptyId, binding.incarnationId)
+  await store.persistPtyBinding(binding)
+  await runtime.onPtyExit(binding.ptyId, 0, binding.incarnationId, { providerExitObserved: true })
+  const gate = authority.pause()
+  let rejected = false
+  const cleanup = registerPersistedPtySpawn(
+    runtime,
+    store,
+    binding.ptyId,
+    binding.worktreeId,
+    null,
+    binding
+  )
+  if (!cleanup) {
+    throw new Error('exited registration did not start durable cleanup')
+  }
+  const pending = cleanup.catch((error: unknown) => {
+    rejected = true
+    throw error
+  })
+  const failure = expect(pending).rejects.toThrow('agent_session_exited_during_start')
+  await gate.started.promise
+  expect(rejected).toBe(false)
+  expect(
+    readState().workspaceSession.terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId[
+      binding.leafId
+    ]
+  ).toBe(binding.ptyId)
+  gate.finish.resolve()
+  await failure
+  expect(
+    readState().workspaceSession.terminalLayoutsByTabId[binding.tabId]?.ptyIdsByLeafId?.[
+      binding.leafId
+    ]
+  ).toBeUndefined()
+})
+
+it('keeps successful registration synchronous through the remaining spawn publication', async () => {
+  const { store } = await fixture()
+  const runtime = new OrcaRuntimeService(store)
+  await store.persistPtyBinding(binding)
+  expect(
+    registerPersistedPtySpawn(runtime, store, binding.ptyId, binding.worktreeId, null, binding)
+  ).toBeUndefined()
+})
diff --git a/src/main/persistence/loading-store/pty-spawn-handle-publication.test.ts b/src/main/persistence/loading-store/pty-spawn-handle-publication.test.ts
new file mode 100644
index 00000000000..9fb0d65a2cb
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-spawn-handle-publication.test.ts
@@ -0,0 +1,77 @@
+import { expect, it, vi } from 'vitest'
+import { fixture } from './profile-state-delayed-authority-fixture'
+import { OrcaRuntimeService } from '../../runtime/orca-runtime'
+import { commitPtyIpcSpawn } from '../../ipc/pty/ipc/spawn-commit'
+import { createPtyIpcSpawnState } from '../../ipc/pty/ipc/spawn-state'
+import { commitRuntimePtySpawn } from '../../ipc/pty/runtime/spawn-commit'
+import { createRuntimePtySpawnState } from '../../ipc/pty/runtime/spawn-state'
+import { createPtySpawnCommitDependencies } from './pty-spawn-commit-dependencies-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+  leafId: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+  ptyId: 'mobile-pending-spawn',
+  incarnationId: 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
+}
+class MobileCreateRuntime extends OrcaRuntimeService {
+  waitForCreatedSurface() {
+    this.pendingMobileTerminalCreatesByKey.set(`${binding.worktreeId}::${binding.tabId}`, {
+      activate: true,
+      paired: true,
+      selectIfNoActiveTab: true
+    })
+    return this.waitForMobileTerminalSurface(binding.worktreeId, binding.tabId, {
+      requireReady: true
+    })
+  }
+}
+
+it.each(['ipc', 'runtime'])(
+  'publishes the preallocated handle to a pending mobile %s create',
+  async (controller) => {
+    const { store, authority } = await fixture()
+    const runtime = new MobileCreateRuntime(store)
+    const preAllocatedHandle = runtime.createPreAllocatedTerminalHandle()
+    const surface = runtime.waitForCreatedSurface()
+    runtime.onPtySpawned(binding.ptyId, binding.incarnationId)
+    const deps = createPtySpawnCommitDependencies(runtime, store)
+    let commit: () => Promise<unknown>
+    if (controller === 'ipc') {
+      const ctx = createPtyIpcSpawnState(deps, { ...binding, cols: 80, rows: 24 })
+      ctx.result = { id: binding.ptyId, incarnationId: binding.incarnationId }
+      ctx.metadataLeafId = binding.leafId
+      ctx.validatedLeafId = binding.leafId
+      ctx.preAllocatedHandle = preAllocatedHandle
+      commit = () => commitPtyIpcSpawn(ctx)
+    } else {
+      const ctx = createRuntimePtySpawnState(deps, {
+        ...binding,
+        cols: 80,
+        rows: 24,
+        preAllocatedHandle
+      })
+      ctx.result = { id: binding.ptyId, incarnationId: binding.incarnationId }
+      ctx.metadataLeafId = binding.leafId
+      ctx.hostSessionBinding = { store, ...binding }
+      commit = () => commitRuntimePtySpawn(ctx)
+    }
+    const gate = authority.pause()
+    const pending = commit()
+    await gate.started.promise
+    gate.finish.resolve()
+    await pending
+    const result = await surface
+    expect(result.tab.terminal).toBe(preAllocatedHandle)
+    await runtime.onPtyExit(binding.ptyId, 0, binding.incarnationId, { providerExitObserved: true })
+  }
+)
diff --git a/src/main/persistence/loading-store/pty-spawn-replacement-durability.test.ts b/src/main/persistence/loading-store/pty-spawn-replacement-durability.test.ts
new file mode 100644
index 00000000000..202ad5e6a2d
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-spawn-replacement-durability.test.ts
@@ -0,0 +1,172 @@
+import { isTerminalSessionStorageCapacityFailure } from '../../../shared/terminal-session-state-save-failure'
+import { afterEach, expect, it, vi } from 'vitest'
+import { deferred, fixture } from './profile-state-delayed-authority-fixture'
+import { OrcaRuntimeService } from '../../runtime/orca-runtime'
+import { commitPtyIpcSpawn } from '../../ipc/pty/ipc/spawn-commit'
+import { createPtyIpcSpawnState } from '../../ipc/pty/ipc/spawn-state'
+import type { PtySpawnIpcDeps } from '../../ipc/pty/ipc/spawn-types'
+import { commitRuntimePtySpawn } from '../../ipc/pty/runtime/spawn-commit'
+import { createRuntimePtySpawnState } from '../../ipc/pty/runtime/spawn-state'
+import type { PtyRuntimeControllerDeps } from '../../ipc/pty/runtime/controller-deps'
+import { ptyIncarnationById, ptyOwnership } from '../../ipc/pty/provider/ownership-state'
+import { clearProviderPtyState } from '../../ipc/pty/provider/state-cleanup'
+import { createPtySpawnCommitDependencies } from './pty-spawn-commit-dependencies-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+  leafId: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+  ptyId: 'replaced-during-save',
+  incarnationId: 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
+}
+const replacementIncarnation = 'dddddddd-dddd-4ddd-8ddd-dddddddddddd'
+
+afterEach(() => {
+  clearProviderPtyState(binding.ptyId)
+  ptyOwnership.delete(binding.ptyId)
+})
+
+it.each(
+  ['ipc', 'runtime'].flatMap((controller) =>
+    ['save', 'shutdown'].flatMap((replacementDuring) =>
+      ['profile-state-writer-exit', 'ENOSPC'].map((code) => ({
+        controller,
+        replacementDuring,
+        code
+      }))
+    )
+  )
+)(
+  'preserves a successor during $replacementDuring when the predecessor $controller save fails with $code',
+  async ({ controller, replacementDuring, code }) => {
+    const { store, authority } = await fixture()
+    const runtime = new OrcaRuntimeService(store)
+    runtime.onPtySpawned(binding.ptyId, binding.incarnationId)
+    ptyIncarnationById.set(binding.ptyId, binding.incarnationId)
+    const deps = createPtySpawnCommitDependencies(runtime, store)
+    const shutdownStarted = deferred<void>()
+    const shutdownFinished = deferred<void>()
+    const holdShutdown = async () => {
+      shutdownStarted.resolve()
+      await shutdownFinished.promise
+    }
+    let commit: () => Promise<unknown>
+    let shutdown: ReturnType<typeof vi.spyOn>
+    if (controller === 'ipc') {
+      const ctx = createPtyIpcSpawnState(deps, { ...binding, cols: 80, rows: 24 })
+      ctx.result = { id: binding.ptyId, incarnationId: binding.incarnationId }
+      ctx.metadataLeafId = binding.leafId
+      ctx.validatedLeafId = binding.leafId
+      shutdown = vi.spyOn(ctx.provider, 'shutdown').mockImplementation(holdShutdown)
+      commit = () => commitPtyIpcSpawn(ctx)
+    } else {
+      const ctx = createRuntimePtySpawnState(deps, { ...binding, cols: 80, rows: 24 })
+      ctx.result = { id: binding.ptyId, incarnationId: binding.incarnationId }
+      ctx.metadataLeafId = binding.leafId
+      ctx.hostSessionBinding = { store, ...binding }
+      shutdown = vi.spyOn(ctx.provider, 'shutdown').mockImplementation(holdShutdown)
+      commit = () => commitRuntimePtySpawn(ctx)
+    }
+    const gate = authority.pause()
+    const pending = commit().catch((error: unknown) => {
+      expect(error).toBeInstanceOf(Error)
+      if (!(error instanceof Error)) {
+        throw error
+      }
+      expect(error.message).toContain('ORCA_TERMINAL_SESSION_STATE_SAVE_FAILED')
+      expect(isTerminalSessionStorageCapacityFailure(error.message)).toBe(code === 'ENOSPC')
+      return 'rejected'
+    })
+    await gate.started.promise
+    if (replacementDuring === 'shutdown') {
+      gate.finish.reject(Object.assign(new Error('worker exited'), { code }))
+      await shutdownStarted.promise
+    }
+    await runtime.onPtyExit(binding.ptyId, 0, binding.incarnationId, { providerExitObserved: true })
+    runtime.onPtySpawned(binding.ptyId, replacementIncarnation)
+    ptyIncarnationById.set(binding.ptyId, replacementIncarnation)
+    ptyOwnership.set(binding.ptyId, 'successor-host')
+    if (replacementDuring === 'save') {
+      gate.finish.reject(Object.assign(new Error('worker exited'), { code }))
+    }
+    shutdownFinished.resolve()
+    expect(await pending).toBe('rejected')
+    if (replacementDuring === 'save') {
+      expect(shutdown).not.toHaveBeenCalled()
+    } else {
+      expect(shutdown).toHaveBeenCalledExactlyOnceWith(binding.ptyId, {
+        immediate: true,
+        expectedIncarnationId: binding.incarnationId
+      })
+    }
+    expect(ptyIncarnationById.get(binding.ptyId)).toBe(replacementIncarnation)
+    expect(ptyOwnership.get(binding.ptyId)).toBe('successor-host')
+    await runtime.onPtyExit(binding.ptyId, 0, replacementIncarnation, {
+      providerExitObserved: true
+    })
+  }
+)
+
+it.each(['ipc', 'runtime'])(
+  'keeps replacement provider identity when an exited %s spawn finishes saving',
+  async (controller) => {
+    const { store, authority } = await fixture()
+    const runtime = new OrcaRuntimeService(store)
+    runtime.onPtySpawned(binding.ptyId, binding.incarnationId)
+    let commit: () => Promise<unknown>
+    if (controller === 'ipc') {
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only commit runs; the runtime/store are real and preflight-only dependencies are unreachable.
+      const deps = { runtime, store } as PtySpawnIpcDeps
+      const ctx = createPtyIpcSpawnState(deps, { ...binding, cols: 80, rows: 24 })
+      ctx.result = { id: binding.ptyId, incarnationId: binding.incarnationId }
+      ctx.metadataLeafId = binding.leafId
+      ctx.validatedLeafId = binding.leafId
+      commit = () => commitPtyIpcSpawn(ctx)
+    } else {
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only commit runs; the runtime/store are real and preflight-only dependencies are unreachable.
+      const deps = { runtime, store } as PtyRuntimeControllerDeps
+      const ctx = createRuntimePtySpawnState(deps, { ...binding, cols: 80, rows: 24 })
+      ctx.result = { id: binding.ptyId, incarnationId: binding.incarnationId }
+      ctx.metadataLeafId = binding.leafId
+      ctx.hostSessionBinding = { store, ...binding }
+      commit = () => commitRuntimePtySpawn(ctx)
+    }
+    const gate = authority.pause()
+    const pending = expect(commit()).rejects.toThrow('agent_session_exited_during_start')
+    await gate.started.promise
+    await runtime.onPtyExit(binding.ptyId, 0, binding.incarnationId, { providerExitObserved: true })
+    runtime.onPtySpawned(binding.ptyId, replacementIncarnation)
+    runtime.seedHeadlessTerminal(binding.ptyId, 'replacement history', { cols: 112, rows: 37 })
+    ptyIncarnationById.set(binding.ptyId, replacementIncarnation)
+    gate.finish.resolve()
+    await pending
+    expect(ptyIncarnationById.get(binding.ptyId)).toBe(replacementIncarnation)
+    expect(await runtime.serializeMainTerminalBuffer(binding.ptyId)).toMatchObject({
+      cols: 112,
+      rows: 37
+    })
+    await runtime.onPtyExit(binding.ptyId, 0, replacementIncarnation, {
+      providerExitObserved: true
+    })
+  }
+)
+
+it('does not label an IPC binding ownership refusal as a storage failure', async () => {
+  const { store } = await fixture()
+  const runtime = new OrcaRuntimeService(store)
+  const deps = createPtySpawnCommitDependencies(runtime, store)
+  const ctx = createPtyIpcSpawnState(deps, { ...binding, cols: 80, rows: 24 })
+  ctx.result = { id: binding.ptyId, incarnationId: binding.incarnationId }
+  ctx.validatedLeafId = binding.leafId
+  vi.spyOn(store, 'persistPtyBinding').mockResolvedValue(false)
+  await expect(commitPtyIpcSpawn(ctx)).rejects.toThrow('terminal_pane_owner_changed')
+})
diff --git a/src/main/persistence/loading-store/pty-spawn-restore-durability.test.ts b/src/main/persistence/loading-store/pty-spawn-restore-durability.test.ts
new file mode 100644
index 00000000000..26737df9dd0
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-spawn-restore-durability.test.ts
@@ -0,0 +1,79 @@
+import { describe, expect, it, vi } from 'vitest'
+import { fixture } from './profile-state-delayed-authority-fixture'
+import { OrcaRuntimeService } from '../../runtime/orca-runtime'
+import { commitPtyIpcSpawn } from '../../ipc/pty/ipc/spawn-commit'
+import { createPtyIpcSpawnState } from '../../ipc/pty/ipc/spawn-state'
+import type { PtySpawnResult } from '../../providers/types'
+import { commitRuntimePtySpawn } from '../../ipc/pty/runtime/spawn-commit'
+import { createRuntimePtySpawnState } from '../../ipc/pty/runtime/spawn-state'
+import { createPtySpawnCommitDependencies } from './pty-spawn-commit-dependencies-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+  leafId: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+  ptyId: 'restoring-pty',
+  incarnationId: 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
+}
+const restores: Pick<PtySpawnResult, 'snapshot' | 'coldRestore' | 'replay'>[] = [
+  { snapshot: 'restored history\r\n' },
+  {
+    coldRestore: {
+      scrollback: 'restored history\r\n',
+      lastTitle: 'Restored',
+      cwd: '/fixture/local'
+    }
+  },
+  { replay: 'restored history\r\n' }
+]
+
+describe.each(['ipc', 'runtime'])('%s restored scrollback', (controller) => {
+  it.each(restores)(
+    'keeps restored history before output during the binding save: %j',
+    async (restore) => {
+      const { store, authority } = await fixture()
+      const runtime = new OrcaRuntimeService(store)
+      runtime.onPtySpawned(binding.ptyId, binding.incarnationId)
+      const deps = createPtySpawnCommitDependencies(runtime, store)
+      let commit: () => Promise<unknown>
+      const result = { id: binding.ptyId, incarnationId: binding.incarnationId, ...restore }
+      if (controller === 'ipc') {
+        const ctx = createPtyIpcSpawnState(deps, { ...binding, cols: 80, rows: 24 })
+        ctx.result = result
+        ctx.metadataLeafId = binding.leafId
+        ctx.validatedLeafId = binding.leafId
+        commit = () => commitPtyIpcSpawn(ctx)
+      } else {
+        const ctx = createRuntimePtySpawnState(deps, { ...binding, cols: 80, rows: 24 })
+        ctx.result = result
+        ctx.metadataLeafId = binding.leafId
+        ctx.hostSessionBinding = { store, ...binding }
+        commit = () => commitRuntimePtySpawn(ctx)
+      }
+      const gate = authority.pause()
+      const pending = commit()
+      await gate.started.promise
+      runtime.onPtyData(binding.ptyId, 'live output\r\n', Date.now())
+      gate.finish.resolve()
+      await pending
+      const snapshot = await runtime.serializeMainTerminalBuffer(binding.ptyId)
+      expect(snapshot?.data).toContain('restored history')
+      expect(snapshot?.data).toContain('live output')
+      expect(snapshot?.data.indexOf('restored history')).toBeLessThan(
+        snapshot?.data.indexOf('live output') ?? -1
+      )
+      await runtime.onPtyExit(binding.ptyId, 0, binding.incarnationId, {
+        providerExitObserved: true
+      })
+    }
+  )
+})
diff --git a/src/main/persistence/loading-store/repo-lifecycle-ui-residue.ts b/src/main/persistence/loading-store/repo-lifecycle-ui-residue.ts
index d1c2ed76d7b..cf33a0255dd 100644
--- a/src/main/persistence/loading-store/repo-lifecycle-ui-residue.ts
+++ b/src/main/persistence/loading-store/repo-lifecycle-ui-residue.ts
@@ -1,6 +1,7 @@
 import type { PersistedState } from '../../../shared/persisted-state-types'
 import { getRepoIdFromWorktreeId } from '../../../shared/worktree/id'
 
+/** Mutates UI state to remove selections and preferences whose owning repositories were deregistered. */
 export function pruneDeregisteredRepoUiResidue(
   ui: PersistedState['ui'],
   orphanRepoIds: ReadonlySet<string>
@@ -14,9 +15,11 @@ export function pruneDeregisteredRepoUiResidue(
     ui.lastActiveWorktreeId = null
   }
   ui.filterRepoIds = ui.filterRepoIds?.filter((repoId) => !orphanRepoIds.has(repoId)) ?? []
-  for (const worktreeId of Object.keys(ui.showDotfilesByWorktree ?? {})) {
-    if (isOrphanWorktree(worktreeId)) {
-      delete ui.showDotfilesByWorktree?.[worktreeId]
+  for (const record of [ui.explorerDisplayRootByWorktree, ui.showDotfilesByWorktree]) {
+    for (const worktreeId of Object.keys(record ?? {})) {
+      if (isOrphanWorktree(worktreeId)) {
+        delete record?.[worktreeId]
+      }
     }
   }
 }
diff --git a/src/main/persistence/loading-store/secret-sentinel-substitution.test.ts b/src/main/persistence/loading-store/secret-sentinel-substitution.test.ts
index e58d0280bae..eaae559e77f 100644
--- a/src/main/persistence/loading-store/secret-sentinel-substitution.test.ts
+++ b/src/main/persistence/loading-store/secret-sentinel-substitution.test.ts
@@ -1,11 +1,7 @@
-/**
- * The bar for this change is "the bytes on disk did not move". Every case below runs the exact
- * loop `applySecretSentinelSubstitutions` replaced — reproduced in `previousImplementation` — and
- * compares payload bytes and guard hash, because a drifting hash silently disables the no-op write
- * guard and a drifting payload is corrupted persisted state.
- */
+/** Full serialization retains its bytes/hash; domain serialization preserves bytes and equality. */
 import { createHash, randomUUID } from 'node:crypto'
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
+import { serializeCompleteProfileStateDomains } from './profile-state-authority-writes'
 import {
   applySecretSentinelSubstitutions,
   type SecretSentinelSubstitution
@@ -36,14 +32,101 @@ function expectIdenticalToPrevious(
 ): void {
   const before = previousImplementation(serialized, subs, degradedPrefix)
   const after = applySecretSentinelSubstitutions(serialized, subs, degradedPrefix)
+  const text = applySecretSentinelSubstitutions(serialized, subs, degradedPrefix, 'text')
   expect(after.payload.equals(before.payload)).toBe(true)
   expect(after.stateHash).toBe(before.stateHash)
+  expect(text.payload).toBe(before.payload.toString('utf8'))
+  expect(text.stateHash).toBe(before.stateHash)
 }
 
 function sentinel(): string {
   return `orca-secret-slot-${randomUUID()}`
 }
 
+describe('complete profile domain serialization', () => {
+  it('preserves escaped domain names, omission and the keys passed to toJSON', () => {
+    const domain = '雪"\\\ud800'
+    const state = {
+      [domain]: {
+        toJSON(key: string) {
+          return { key, nested: { toJSON: (nestedKey: string) => nestedKey } }
+        }
+      },
+      omitted: undefined,
+      nullable: null,
+      history: [{ id: 'z' }, { id: 'a' }]
+    }
+
+    const serialized = serializeCompleteProfileStateDomains(state, [], '')
+
+    expect(serialized.payload.toString('utf8')).toBe(JSON.stringify(state))
+    expect(serialized.domains.map(({ domain }) => domain)).toEqual([domain, 'nullable', 'history'])
+    expect(JSON.parse(serialized.payload.toString('utf8'))).toMatchObject({
+      [domain]: { key: domain, nested: 'nested' },
+      nullable: null
+    })
+  })
+
+  it('keeps the complete hash stable across ciphertext changes and sensitive to plaintext and absence', () => {
+    const slot = sentinel()
+    const state = {
+      settings: { cookie: slot },
+      future: { shadow: 'ciphertext-one' },
+      nullable: null
+    }
+    const firstSub = [{ sentinel: slot, blob: 'ciphertext-one', hashValue: 'secret' }]
+    const first = serializeCompleteProfileStateDomains(state, firstSub, '')
+    const second = serializeCompleteProfileStateDomains(
+      state,
+      [{ sentinel: slot, blob: 'ciphertext-two', hashValue: 'secret' }],
+      ''
+    )
+
+    expect(first.payload).toEqual(
+      applySecretSentinelSubstitutions(JSON.stringify(state), firstSub, '').payload
+    )
+    expect(second.payload).not.toEqual(first.payload)
+    expect(second.stateHash).toBe(first.stateHash)
+    expect(JSON.parse(second.payload.toString('utf8')).future).toEqual({ shadow: 'ciphertext-one' })
+    expect(
+      serializeCompleteProfileStateDomains(
+        state,
+        [{ sentinel: slot, blob: 'ciphertext-one', hashValue: 'changed-secret' }],
+        ''
+      ).stateHash
+    ).not.toBe(first.stateHash)
+    expect(
+      serializeCompleteProfileStateDomains({ ...state, nullable: undefined }, firstSub, '')
+        .stateHash
+    ).not.toBe(first.stateHash)
+  })
+
+  it('retains unknown own keys and encodes bytes only when a complete payload is requested', () => {
+    const state = Object.fromEntries([
+      ['9', 9],
+      ['3', 3],
+      ['z', null],
+      ['__proto__', { own: true }],
+      ['constructor', false],
+      ['future', { text: '雪😀\ud800', absent: undefined }]
+    ])
+    const expected = JSON.stringify(state)
+    const encode = vi.spyOn(Buffer, 'from')
+    try {
+      const serialized = serializeCompleteProfileStateDomains(state, [], 'safeStorage-degraded\0')
+      expect(serialized.domains.map(({ domain }) => domain)).toEqual(Object.keys(state))
+      expect(serialized.domains.find(({ domain }) => domain === '__proto__')?.payload).toBe(
+        '{"own":true}'
+      )
+      expect(encode).not.toHaveBeenCalled()
+      expect(serialized.payload.toString('utf8')).toBe(expected)
+      expect(encode).toHaveBeenCalledExactlyOnceWith(expected, 'utf8')
+    } finally {
+      encode.mockRestore()
+    }
+  })
+})
+
 describe('applySecretSentinelSubstitutions', () => {
   it('produces bytes and a hash identical to the previous implementation', () => {
     const subs: SecretSentinelSubstitution[] = [
@@ -117,6 +200,39 @@ describe('applySecretSentinelSubstitutions', () => {
     expect(payload.toString('utf8')).not.toContain(subs[0].sentinel)
   })
 
+  it.each(['', 'safeStorage-degraded\0'])(
+    'keeps the first duplicate and handles adjacent escaped sentinels with prefix %j',
+    (prefix) => {
+      const slot = 'orca-$a/.*+?^${}()|[]\\"雪'
+      const subs = [
+        { sentinel: slot, blob: 'cipher-other-token-"\\\n雪\ud800', hashValue: 'plain-😀' },
+        { sentinel: slot, blob: 'duplicate-must-not-win', hashValue: 'wrong-plain' },
+        { sentinel: 'other-token', blob: 'last', hashValue: 'last-plain' }
+      ]
+      const serialized = JSON.stringify({ nested: { [slot]: `${slot}${slot}other-token` } })
+      const expectedPayload = JSON.stringify({
+        nested: { [subs[0].blob]: subs[0].blob + subs[0].blob + subs[2].blob }
+      })
+      const expectedHashInput = JSON.stringify({
+        nested: { [subs[0].hashValue]: subs[0].hashValue + subs[0].hashValue + subs[2].hashValue }
+      })
+      const expectedHash = createHash('sha1').update(prefix).update(expectedHashInput).digest('hex')
+      for (const actual of [
+        applySecretSentinelSubstitutions(serialized, subs, prefix),
+        applySecretSentinelSubstitutions(serialized, subs, prefix, 'text')
+      ]) {
+        expect(actual.payload.toString()).toBe(expectedPayload)
+        expect(actual.stateHash).toBe(expectedHash)
+      }
+    }
+  )
+
+  it('leaves domains without matching sentinels byte-identical', () => {
+    const serialized = JSON.stringify({ future: { output: '雪😀\ud800', present: null } })
+    const subs = [{ sentinel: 'missing-slot', blob: 'cipher', hashValue: 'plain' }]
+    expectIdenticalToPrevious(serialized, subs, 'safeStorage-degraded\0')
+  })
+
   it('copies and UTF-8 encodes the full state once, not once per sentinel per side', () => {
     const subs: SecretSentinelSubstitution[] = Array.from({ length: 3 }, () => ({
       sentinel: sentinel(),
@@ -172,13 +288,17 @@ describe('applySecretSentinelSubstitutions', () => {
 
     const before = counted(() => previousImplementation(serialized, subs, ''))
     const after = counted(() => applySecretSentinelSubstitutions(serialized, subs, ''))
+    const text = counted(() => applySecretSentinelSubstitutions(serialized, subs, '', 'text'))
 
     // Two `String.replace` calls over the whole state per sentinel — payload and hash input.
     expect(before.fullStateReplaces).toBe(subs.length * 2)
     expect(after.fullStateReplaces).toBe(0)
+    expect(text.fullStateReplaces).toBe(0)
     // The old path encoded the state twice: once for sha1, once for the file write.
     expect(before.encodedChars).toBeGreaterThan(serialized.length * 1.9)
     expect(after.encodedChars).toBeLessThan(serialized.length * 1.1)
     expect(after.encodedChars).toBeGreaterThan(serialized.length * 0.9)
+    expect(text.encodedChars).toBeLessThan(serialized.length * 1.1)
+    expect(text.encodedChars).toBeGreaterThan(serialized.length * 0.9)
   })
 })
diff --git a/src/main/persistence/loading-store/secret-sentinel-substitution.ts b/src/main/persistence/loading-store/secret-sentinel-substitution.ts
index afcdddafa77..30ec43eaa1d 100644
--- a/src/main/persistence/loading-store/secret-sentinel-substitution.ts
+++ b/src/main/persistence/loading-store/secret-sentinel-substitution.ts
@@ -10,69 +10,92 @@ export type SecretSentinelSubstitution = {
   hashValue: string
 }
 
-/**
- * Replace every secret sentinel in `serialized` in ONE pass, producing the on-disk bytes and the
- * guard hash from the same encoded segments.
- *
- * Why not the obvious `payload.replace(...)` / `hashInput.replace(...)` loop it replaces: each
- * `String.replace` returns a rope that the *next* `replace` has to flatten before it can search, so
- * N sentinels cost 2N-1 flattened copies of the whole multi-MB state, plus one more per side when
- * `hash.update` and the file write finally consume them. Measured on a 4.65 MB store with three
- * sentinels: 7 full-state string allocations, 62 MB of V8 heap, 27 MB of it in large_object_space.
- *
- * Here the state is walked once, each literal run is UTF-8 encoded exactly once, and those same
- * buffers feed both the payload and the hash — 1 full-state string, 1 encode.
- *
- * Byte-for-byte identical output to the loop: both sides read the sentinel in its JSON-escaped
- * form, the replacements are the JSON-escaped `blob`/`hashValue`, and the hash sees the same byte
- * sequence it saw when it was handed one concatenated string.
- */
+type SecretSubstitutionOutput<T extends string | Buffer> = {
+  encode: (value: string) => T
+  concat: (chunks: T[]) => T
+}
+
+const bufferOutput: SecretSubstitutionOutput<Buffer> = {
+  encode: (value) => Buffer.from(value, 'utf8'),
+  concat: (chunks) => Buffer.concat(chunks)
+}
+
+const textOutput: SecretSubstitutionOutput<string> = {
+  encode: (value) => value,
+  concat: (chunks) => chunks.join('')
+}
+
+/** One traversal keeps ciphertext and guard hashes aligned without copying once per secret. */
 export function applySecretSentinelSubstitutions(
   serialized: string,
   substitutions: readonly SecretSentinelSubstitution[],
-  degradedPrefix: string
-): { payload: Buffer; stateHash: string } {
+  degradedPrefix: string,
+  output?: 'buffer'
+): { payload: Buffer; stateHash: string }
+export function applySecretSentinelSubstitutions(
+  serialized: string,
+  substitutions: readonly SecretSentinelSubstitution[],
+  degradedPrefix: string,
+  output: 'text'
+): { payload: string; stateHash: string }
+export function applySecretSentinelSubstitutions(
+  serialized: string,
+  substitutions: readonly SecretSentinelSubstitution[],
+  degradedPrefix: string,
+  output: 'buffer' | 'text' = 'buffer'
+): { payload: Buffer | string; stateHash: string } {
+  return output === 'text'
+    ? substituteSentinels(serialized, substitutions, degradedPrefix, textOutput)
+    : substituteSentinels(serialized, substitutions, degradedPrefix, bufferOutput)
+}
+
+function substituteSentinels<T extends string | Buffer>(
+  serialized: string,
+  substitutions: readonly SecretSentinelSubstitution[],
+  degradedPrefix: string,
+  output: SecretSubstitutionOutput<T>
+): { payload: T; stateHash: string } {
   const hash = createHash('sha1').update(degradedPrefix)
   if (substitutions.length === 0) {
-    const payload = Buffer.from(serialized, 'utf8')
+    const payload = output.encode(serialized)
     return { payload, stateHash: hash.update(payload).digest('hex') }
   }
 
-  const replacementBySentinel = new Map<string, { blob: Buffer; hashValue: Buffer }>()
+  const replacementBySentinel = new Map<string, { blob: T; hashValue: T }>()
   const alternatives: string[] = []
   for (const { sentinel, blob, hashValue } of substitutions) {
-    // Preserved from the loop this replaces: both the search key and the replacements are the
-    // JSON-escaped forms, because that is what `serialized` actually contains.
+    // Match escaped JSON contents, including quotes and backslashes inside a secret.
     const escapedSentinel = JSON.stringify(sentinel).slice(1, -1)
     if (replacementBySentinel.has(escapedSentinel)) {
       continue
     }
     alternatives.push(escapeRegex(escapedSentinel))
     replacementBySentinel.set(escapedSentinel, {
-      blob: Buffer.from(JSON.stringify(blob).slice(1, -1), 'utf8'),
-      hashValue: Buffer.from(JSON.stringify(hashValue).slice(1, -1), 'utf8')
+      blob: output.encode(JSON.stringify(blob).slice(1, -1)),
+      hashValue: output.encode(JSON.stringify(hashValue).slice(1, -1))
     })
   }
 
-  // Global, though a sentinel is a UUID minted after the state was assembled and so occurs exactly
-  // once: a single pass that substitutes every occurrence cannot leave one behind on disk.
+  // Substitute every occurrence so a repeated sentinel cannot survive on disk.
   const pattern = new RegExp(alternatives.join('|'), 'g')
-  const chunks: Buffer[] = []
+  const chunks: T[] = []
   let cursor = 0
   let match: RegExpExecArray | null
   while ((match = pattern.exec(serialized)) !== null) {
-    // Non-null: the alternation is built from exactly the map's keys.
-    const replacement = replacementBySentinel.get(match[0])!
-    // A sliced substring, so this does not copy the state; the encode below is its only pass.
-    const literal = Buffer.from(serialized.slice(cursor, match.index), 'utf8')
+    const replacement = replacementBySentinel.get(match[0])
+    if (replacement === undefined) {
+      throw new Error('Secret substitution matched an unregistered sentinel')
+    }
+    // The Buffer output reuses each literal's UTF-8 bytes for both the payload and hash.
+    const literal = output.encode(serialized.slice(cursor, match.index))
     chunks.push(literal, replacement.blob)
     hash.update(literal)
     hash.update(replacement.hashValue)
     cursor = match.index + match[0].length
   }
-  const tail = Buffer.from(serialized.slice(cursor), 'utf8')
+  const tail = output.encode(serialized.slice(cursor))
   chunks.push(tail)
   hash.update(tail)
 
-  return { payload: Buffer.concat(chunks), stateHash: hash.digest('hex') }
+  return { payload: output.concat(chunks), stateHash: hash.digest('hex') }
 }
diff --git a/src/main/persistence/loading-store/session-host-partitions.ts b/src/main/persistence/loading-store/session-host-partitions.ts
index d358f4c8f62..12efd45a19e 100644
--- a/src/main/persistence/loading-store/session-host-partitions.ts
+++ b/src/main/persistence/loading-store/session-host-partitions.ts
@@ -146,7 +146,10 @@ export function removeWorkspaceSessionOwnerInPartition(
       [resolved]: session
     }
   }
-  scheduleSave(owner[sessionHostPartitionOperationsContext].scheduling)
+  scheduleSave(
+    owner[sessionHostPartitionOperationsContext].scheduling,
+    resolved === LOCAL_EXECUTION_HOST_ID ? ['workspaceSession'] : ['workspaceSessionsByHostId']
+  )
 }
 
 export function partitionOwnsWorktreeTabs(
@@ -206,7 +209,9 @@ export function setHostWorkspaceSession(
     ...owner[sessionHostPartitionOperationsContext].runtime.state.workspaceSessionsByHostId,
     [hostId]: pruned
   }
-  scheduleSave(owner[sessionHostPartitionOperationsContext].scheduling)
+  scheduleSave(owner[sessionHostPartitionOperationsContext].scheduling, [
+    'workspaceSessionsByHostId'
+  ])
 }
 
 export function installSessionHostPartitionOperationsContext(
diff --git a/src/main/persistence/loading-store/session-snapshot-operations.ts b/src/main/persistence/loading-store/session-snapshot-operations.ts
index 37ffd9d366b..9c3cf23be7b 100644
--- a/src/main/persistence/loading-store/session-snapshot-operations.ts
+++ b/src/main/persistence/loading-store/session-snapshot-operations.ts
@@ -3,7 +3,7 @@ import type {
   WorkspaceSessionPatch,
   WorkspaceSessionState
 } from '../../../shared/workspace-session-state-types'
-import { LOCAL_EXECUTION_HOST_ID } from '../../../shared/execution-host'
+import { LOCAL_EXECUTION_HOST_ID, type ExecutionHostId } from '../../../shared/execution-host'
 import { pruneWorkspaceSessionBrowserHistory } from '../../../shared/workspace-session-browser-history'
 
 import { workspaceSessionPatchNeedsFullNormalization } from './terminal-session-cleanup'
@@ -18,7 +18,13 @@ import { scheduleSave } from './write-scheduling'
 
 type SessionSnapshotOperationsRuntime = Pick<
   StoreRuntimeState,
-  'pendingSnapshotFileWork' | 'state' | 'terminalScrollbackSnapshotStorage'
+  | 'durableMutationPhase'
+  | 'pendingSnapshotFileWork'
+  | 'profileMaintenancePending'
+  | 'quitFlushStarted'
+  | 'state'
+  | 'terminalScrollbackSnapshotStorage'
+  | 'writesFrozen'
 >
 
 const sessionSnapshotOperationsContext = Symbol('SessionSnapshotOperations')
@@ -43,7 +49,15 @@ export class SessionSnapshotOperations {
 
   setWorkspaceSession(session: PersistedState['workspaceSession'], hostId?: string | null): void {
     const resolved = resolveHostId(hostId)
+    const { runtime } = this[sessionSnapshotOperationsContext]
+    if (runtime.durableMutationPhase === 'rollback') {
+      this.assertSnapshotAdmission(true)
+      // The fieldwise rollback already preserves newer edits; renderer rebasing would undo it.
+      this.publishSession(session, resolved)
+      return
+    }
     if (resolved === LOCAL_EXECUTION_HOST_ID) {
+      this.assertSnapshotAdmission(true)
       setLocalWorkspaceSession(this, session)
       return
     }
@@ -56,6 +70,7 @@ export class SessionSnapshotOperations {
   ): void {
     const resolved = resolveHostId(hostId)
     if (resolved === LOCAL_EXECUTION_HOST_ID) {
+      this.assertSnapshotAdmission()
       setLocalWorkspaceSession(this, session, true)
       return
     }
@@ -76,15 +91,34 @@ export class SessionSnapshotOperations {
     if (Object.hasOwn(patch, 'browserUrlHistory')) {
       next = pruneWorkspaceSessionBrowserHistory(next)
     }
-    if (resolved === LOCAL_EXECUTION_HOST_ID) {
-      this[sessionSnapshotOperationsContext].runtime.state.workspaceSession = next
+    this.publishSession(next, resolved)
+  }
+
+  private publishSession(session: WorkspaceSessionState, hostId: ExecutionHostId): void {
+    const { runtime, scheduling } = this[sessionSnapshotOperationsContext]
+    if (hostId === LOCAL_EXECUTION_HOST_ID) {
+      runtime.state.workspaceSession = session
     } else {
-      this[sessionSnapshotOperationsContext].runtime.state.workspaceSessionsByHostId = {
-        ...this[sessionSnapshotOperationsContext].runtime.state.workspaceSessionsByHostId,
-        [resolved]: next
+      runtime.state.workspaceSessionsByHostId = {
+        ...runtime.state.workspaceSessionsByHostId,
+        [hostId]: session
       }
     }
-    scheduleSave(this[sessionSnapshotOperationsContext].scheduling)
+    scheduleSave(
+      scheduling,
+      hostId === LOCAL_EXECUTION_HOST_ID ? ['workspaceSession'] : ['workspaceSessionsByHostId']
+    )
+  }
+
+  private assertSnapshotAdmission(allowAdmittedMutation = false): void {
+    const { runtime } = this[sessionSnapshotOperationsContext]
+    if (
+      runtime.writesFrozen ||
+      ((runtime.profileMaintenancePending || runtime.quitFlushStarted) &&
+        !(allowAdmittedMutation && runtime.durableMutationPhase !== null))
+    ) {
+      throw new Error('Profile maintenance or finalization is blocking new terminal snapshot work')
+    }
   }
 }
 
diff --git a/src/main/persistence/loading-store/ssh-lease-async-durability.test.ts b/src/main/persistence/loading-store/ssh-lease-async-durability.test.ts
new file mode 100644
index 00000000000..6c646285d4b
--- /dev/null
+++ b/src/main/persistence/loading-store/ssh-lease-async-durability.test.ts
@@ -0,0 +1,128 @@
+import { describe, expect, it, vi } from 'vitest'
+import { fixture } from './profile-state-delayed-authority-fixture'
+import { removeSshPtyConsumerOwnerRecovery } from '../../ssh/ssh-pty-consumer-recovery'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const recovery = {
+  targetId: 'async-target',
+  clientInstanceId: 'first-owner',
+  serverBuildId: 'build',
+  clientGeneration: 1,
+  ownerGeneration: 1,
+  ownerLease: 'owner-lease'
+}
+
+describe('reserved SSH persistence', () => {
+  it('reserves consumer replacement before mutation and durably writes both exact owners', async () => {
+    const { store, authority } = await fixture()
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const older = store.flushPendingOrThrowAsync()
+    await gate.started.promise
+    const first = store.upsertSshPtyConsumerRecovery(recovery)
+    const second = store.upsertSshPtyConsumerRecovery({
+      ...recovery,
+      clientInstanceId: 'next-owner'
+    })
+    expect(store.getSshPtyConsumerRecovery(recovery.targetId)).toBeNull()
+    gate.finish.resolve()
+    await Promise.all([older, first, second])
+    const ownerWrites = authority.captures
+      .flat()
+      .filter(({ domain }) => domain === 'sshPtyConsumerRecoveries')
+    expect(ownerWrites).toHaveLength(2)
+    expect(ownerWrites[0]?.payload).toContain('first-owner')
+    expect(ownerWrites[1]?.payload).toContain('next-owner')
+  })
+
+  it('retries a failed consumer removal through durability even after memory is already empty', async () => {
+    const { store, authority, readState } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    await store.upsertSshPtyConsumerRecovery(recovery)
+    const gate = authority.pause()
+    const removal = expect(
+      removeSshPtyConsumerOwnerRecovery(recovery.targetId, recovery.clientInstanceId, store)
+    ).rejects.toThrow('disk refused')
+    await gate.started.promise
+    gate.finish.reject(new Error('disk refused'))
+    await removal
+    expect(readState().sshPtyConsumerRecoveries).toHaveLength(1)
+    await removeSshPtyConsumerOwnerRecovery(recovery.targetId, recovery.clientInstanceId, store)
+    expect(readState().sshPtyConsumerRecoveries).toEqual([])
+  })
+
+  it('does not let an old consumer remove the newer owner ahead of it in the write queue', async () => {
+    const { store, authority, readState } = await fixture()
+    await store.upsertSshPtyConsumerRecovery(recovery)
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const older = store.flushPendingOrThrowAsync()
+    await gate.started.promise
+    const replacement = store.upsertSshPtyConsumerRecovery({
+      ...recovery,
+      clientInstanceId: 'next-owner'
+    })
+    const removal = removeSshPtyConsumerOwnerRecovery(
+      recovery.targetId,
+      recovery.clientInstanceId,
+      store
+    )
+    gate.finish.resolve()
+    await Promise.all([older, replacement, removal])
+    expect(readState().sshPtyConsumerRecoveries[0]?.clientInstanceId).toBe('next-owner')
+  })
+
+  it('does not detach a newer replacement lease while waiting for the writer', async () => {
+    const { store, authority, readState } = await fixture()
+    const lease = { targetId: recovery.targetId, ptyId: 'relay-pty', state: 'attached' as const }
+    store.upsertSshRemotePtyLease(lease)
+    await store.flushPendingOrThrowAsync()
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const older = store.flushPendingOrThrowAsync()
+    await gate.started.promise
+    const detach = store.markSshRemotePtyLeasesAsync(recovery.targetId, 'detached')
+    expect(store.getSshRemotePtyLeases(recovery.targetId)[0]?.state).toBe('attached')
+    store.upsertSshRemotePtyLease({ ...lease, worktreeId: 'new-worktree' })
+    gate.finish.resolve()
+    await Promise.all([older, detach])
+    expect(readState().sshRemotePtyLeases).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          ptyId: 'relay-pty',
+          worktreeId: 'new-worktree',
+          state: 'attached'
+        })
+      ])
+    )
+  })
+
+  it('does not acknowledge a failed attachment retry before its lease reaches disk', async () => {
+    const { store, authority, readState } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    store.upsertSshRemotePtyLease({
+      targetId: recovery.targetId,
+      ptyId: 'relay-pty',
+      state: 'expired'
+    })
+    await store.flushPendingOrThrowAsync()
+    const gate = authority.pause()
+    const attachment = expect(
+      store.markSshRemotePtyLeasesAttachedAsync(recovery.targetId, ['relay-pty'])
+    ).rejects.toThrow('disk refused')
+    await gate.started.promise
+    gate.finish.reject(new Error('disk refused'))
+    await attachment
+    expect(readState().sshRemotePtyLeases[0].state).toBe('expired')
+    await store.markSshRemotePtyLeasesAttachedAsync(recovery.targetId, ['relay-pty'])
+    expect(readState().sshRemotePtyLeases[0].state).toBe('attached')
+  })
+})
diff --git a/src/main/persistence/loading-store/ssh-lease-durable-mutation.ts b/src/main/persistence/loading-store/ssh-lease-durable-mutation.ts
new file mode 100644
index 00000000000..28f361a12cd
--- /dev/null
+++ b/src/main/persistence/loading-store/ssh-lease-durable-mutation.ts
@@ -0,0 +1,42 @@
+import type { DurableProfileStateMutation, StoreRuntimeState } from './store-runtime-state'
+import {
+  flushDurableStateOrThrowAsync,
+  type WriteFlushBarrierOperations
+} from './write-flush-barriers'
+
+export type SshLeaseDurableMutationRuntime = Pick<
+  StoreRuntimeState,
+  | 'dirtyProfileStateDomains'
+  | 'profileMaintenancePending'
+  | 'profileStateAuthority'
+  | 'quitFlushStarted'
+  | 'runDurableMutation'
+  | 'writesFrozen'
+>
+
+export async function runSshLeaseDurableMutation<T>(
+  runtime: SshLeaseDurableMutationRuntime,
+  barriers: WriteFlushBarrierOperations,
+  domain: 'sshPtyConsumerRecoveries' | 'sshRemotePtyLeases',
+  mutate: () => DurableProfileStateMutation<T>
+): Promise<T> {
+  const writeMutation = (): DurableProfileStateMutation<T> => {
+    const mutation = mutate()
+    if (mutation.persist !== false) {
+      runtime.dirtyProfileStateDomains?.add(domain)
+    }
+    return mutation
+  }
+  if (runtime.profileStateAuthority?.asynchronous) {
+    return runtime.runDurableMutation(writeMutation)
+  }
+  if (runtime.writesFrozen || runtime.quitFlushStarted || runtime.profileMaintenancePending) {
+    throw new Error('Cannot mutate finalized profile persistence')
+  }
+  // Legacy SSH recovery keeps its existing asynchronous disk barrier on older runtimes.
+  const mutation = writeMutation()
+  if (mutation.persist !== false) {
+    await flushDurableStateOrThrowAsync(barriers)
+  }
+  return mutation.value
+}
diff --git a/src/main/persistence/loading-store/ssh-lease-recovery-operations.ts b/src/main/persistence/loading-store/ssh-lease-recovery-operations.ts
index 7da5144898e..7188b4efb66 100644
--- a/src/main/persistence/loading-store/ssh-lease-recovery-operations.ts
+++ b/src/main/persistence/loading-store/ssh-lease-recovery-operations.ts
@@ -43,10 +43,14 @@ import type { StoreRuntimeState } from './store-runtime-state'
 import type { WriteFlushBarrierOperations } from './write-flush-barriers'
 import type { TerminalBindingRecoveryOperations } from './terminal-binding-recovery'
 import type { WriteSchedulingOperations } from './write-scheduling'
-import { flushDurableStateOrThrowAsync } from './write-flush-barriers'
 import { scheduleSave } from './write-scheduling'
+import {
+  runSshLeaseDurableMutation,
+  type SshLeaseDurableMutationRuntime
+} from './ssh-lease-durable-mutation'
 
-type SshLeaseRecoveryOperationsRuntime = Pick<StoreRuntimeState, 'protectedSecrets' | 'state'>
+type SshLeaseRecoveryOperationsRuntime = SshLeaseDurableMutationRuntime &
+  Pick<StoreRuntimeState, 'protectedSecrets' | 'state'>
 
 const sshLeaseRecoveryOperationsContext = Symbol('SshLeaseRecoveryOperations')
 type SshLeaseRecoveryOperationsContext = {
@@ -81,8 +85,15 @@ export class SshLeaseRecoveryOperations {
     await upsertSshPtyConsumerRecoveryOperation(getSshPtyConsumerRecoveryOperations(this), record)
   }
 
-  async removeSshPtyConsumerRecovery(targetId: string): Promise<void> {
-    await removeSshPtyConsumerRecoveryOperation(getSshPtyConsumerRecoveryOperations(this), targetId)
+  async removeSshPtyConsumerRecovery(
+    targetId: string,
+    expectedClientInstanceId?: string
+  ): Promise<void> {
+    await removeSshPtyConsumerRecoveryOperation(
+      getSshPtyConsumerRecoveryOperations(this),
+      targetId,
+      expectedClientInstanceId
+    )
   }
 
   getSshRemotePtyLeases(targetId?: string): SshRemotePtyLease[] {
@@ -127,6 +138,9 @@ export class SshLeaseRecoveryOperations {
 
   markSshRemotePtyLeasesForShutdown(targetId: string, state: SshRemotePtyLease['state']): void {
     markSshRemotePtyLeasesForShutdownOperation(getSshPtyLeaseOperations(this), targetId, state)
+    this[sshLeaseRecoveryOperationsContext].runtime.dirtyProfileStateDomains?.add(
+      'sshRemotePtyLeases'
+    )
   }
 
   async markSshRemotePtyLeasesAsync(
@@ -195,8 +209,13 @@ export function getSshPtyConsumerRecoveryOperations(
   return {
     state: owner[sshLeaseRecoveryOperationsContext].runtime.state,
     protectedSecrets: owner[sshLeaseRecoveryOperationsContext].runtime.protectedSecrets,
-    flushDurableStateOrThrowAsync: () =>
-      flushDurableStateOrThrowAsync(owner[sshLeaseRecoveryOperationsContext].flushBarriers)
+    runDurableMutation: (mutate) =>
+      runSshLeaseDurableMutation(
+        owner[sshLeaseRecoveryOperationsContext].runtime,
+        owner[sshLeaseRecoveryOperationsContext].flushBarriers,
+        'sshPtyConsumerRecoveries',
+        mutate
+      )
   }
 }
 
@@ -238,9 +257,19 @@ export function getSshPtyLeaseOperations(owner: SshLeaseRecoveryOperations): Ssh
         targetId,
         leases
       ),
-    flush: () => owner[sshLeaseRecoveryOperationsContext].flushBarriers.flush(),
-    flushDurableStateOrThrowAsync: () =>
-      flushDurableStateOrThrowAsync(owner[sshLeaseRecoveryOperationsContext].flushBarriers)
+    flush: () => {
+      owner[sshLeaseRecoveryOperationsContext].runtime.dirtyProfileStateDomains?.add(
+        'sshRemotePtyLeases'
+      )
+      owner[sshLeaseRecoveryOperationsContext].flushBarriers.flush()
+    },
+    runDurableMutation: (mutate) =>
+      runSshLeaseDurableMutation(
+        owner[sshLeaseRecoveryOperationsContext].runtime,
+        owner[sshLeaseRecoveryOperationsContext].flushBarriers,
+        'sshRemotePtyLeases',
+        mutate
+      )
   }
 }
 
diff --git a/src/main/persistence/loading-store/ssh-profile-operations.ts b/src/main/persistence/loading-store/ssh-profile-operations.ts
index d21ab5f04da..ce81cea373b 100644
--- a/src/main/persistence/loading-store/ssh-profile-operations.ts
+++ b/src/main/persistence/loading-store/ssh-profile-operations.ts
@@ -32,7 +32,10 @@ import { syncProjectHostSetupCompatibilityState } from './repo-lifecycle-operati
 import { scheduleSave } from './write-scheduling'
 import { forgetSshConnectionGeneration } from '../../ssh/ssh-connection-generation'
 
-type SshProfileOperationsRuntime = Pick<StoreRuntimeState, 'protectedSecrets' | 'state'>
+type SshProfileOperationsRuntime = Pick<
+  StoreRuntimeState,
+  'dirtyProfileStateDomains' | 'protectedSecrets' | 'state'
+>
 
 const sshProfileOperationsContext = Symbol('SshProfileOperations')
 type SshProfileOperationsContext = {
@@ -146,7 +149,12 @@ export function getSshTargetStateOperations(owner: SshProfileOperations): SshTar
     state: owner[sshProfileOperationsContext].runtime.state,
     protectedSecrets: owner[sshProfileOperationsContext].runtime.protectedSecrets,
     scheduleSave: () => scheduleSave(owner[sshProfileOperationsContext].scheduling),
-    flush: () => owner[sshProfileOperationsContext].flushBarriers.flush()
+    flush: () => {
+      owner[sshProfileOperationsContext].runtime.dirtyProfileStateDomains?.add(
+        'claudeLivePtySessionIds'
+      )
+      owner[sshProfileOperationsContext].flushBarriers.flush()
+    }
   }
 }
 
diff --git a/src/main/persistence/loading-store/state-serialization-secret-handling.ts b/src/main/persistence/loading-store/state-serialization-secret-handling.ts
index 026afd12c01..40d40818343 100644
--- a/src/main/persistence/loading-store/state-serialization-secret-handling.ts
+++ b/src/main/persistence/loading-store/state-serialization-secret-handling.ts
@@ -1,3 +1,8 @@
+import {
+  serializeCompleteProfileStateDomains,
+  serializeSelectiveProfileStateDomains
+} from './profile-state-authority-writes'
+import type { ProfileStateDomainReplacement } from './profile-state-authority'
 import { randomUUID } from 'node:crypto'
 import type { PersistedState } from '../../../shared/persisted-state-types'
 import { collectFolderWorkspaceDiffComments } from '../../folder-workspace-diff-comments'
@@ -30,7 +35,92 @@ export class StateSerializationSecretHandlingOperations {
     return durable
   }
 
-  buildStateToSave(): {
+  /** Serialize domains with complete secret handling; unknown domains fall back to a full write. */
+  buildStateDomainsToSave(domains: ReadonlySet<string>):
+    | {
+        replacements: ProfileStateDomainReplacement[]
+        protectedSecretUpdates: ProtectedSecretRetentionUpdate[]
+      }
+    | undefined {
+    // A later save must retry secrets deferred by any domain, until a durable commit succeeds.
+    if (this.runtime.protectedSecrets.hasPendingEncryption()) {
+      return undefined
+    }
+    const stateToSave: Record<string, unknown> = {}
+    const protectedSecretUpdates: ProtectedSecretRetentionUpdate[] = []
+    const encrypt = (slot: string, plaintext: string): string => {
+      const encrypted = this.runtime.protectedSecrets.encrypt(slot, plaintext)
+      if (encrypted.retentionUpdate) {
+        protectedSecretUpdates.push(encrypted.retentionUpdate)
+      }
+      return encrypted.blob
+    }
+    for (const domain of domains) {
+      switch (domain) {
+        case 'settings':
+          stateToSave[domain] = this.buildSettingsToSave(encrypt)
+          break
+        case 'workspaceSession':
+          stateToSave[domain] = this.runtime.state.workspaceSession
+          break
+        case 'automations':
+        case 'automationRuns':
+          stateToSave[domain] = this.runtime.state[domain]
+          break
+        case 'featureInteractionTelemetryBuckets':
+          stateToSave[domain] = this.runtime.state.featureInteractionTelemetryBuckets
+          break
+        case 'ui':
+          stateToSave[domain] = {
+            ...this.runtime.state.ui,
+            browserKagiSessionLink:
+              encrypt(
+                PROTECTED_SECRET_SLOT.browserKagiSessionLink,
+                this.runtime.state.ui.browserKagiSessionLink ?? ''
+              ) || null
+          }
+          break
+        case 'worktreeMeta':
+          stateToSave[domain] = omitDefaultWorktreeMetaFieldsInMap(this.runtime.state.worktreeMeta)
+          break
+        case 'worktreeMetaByIdentity':
+          if (this.runtime.state.worktreeMetaByIdentity !== undefined) {
+            stateToSave[domain] = omitDefaultWorktreeMetaFieldsInMap(
+              projectWorktreeMetaByIdentityOntoLocators(
+                this.runtime.state.worktreeMetaByIdentity,
+                this.runtime.state
+              )
+            )
+          }
+          break
+        case 'worktreeIdentityAliases':
+          if (this.runtime.state.worktreeIdentityAliases !== undefined) {
+            stateToSave[domain] = this.runtime.state.worktreeIdentityAliases
+          }
+          break
+        case 'workspaceSessionsByHostId':
+          if (this.runtime.state.workspaceSessionsByHostId !== undefined) {
+            stateToSave[domain] = withoutRedundantPartitionGlobals(
+              this.runtime.state.workspaceSessionsByHostId,
+              this.runtime.state.workspaceSession
+            )
+          }
+          break
+        case 'sshRemotePtyLeases':
+          stateToSave[domain] = this.runtime.state.sshRemotePtyLeases
+          break
+        default:
+          return undefined
+      }
+    }
+    return {
+      replacements: serializeSelectiveProfileStateDomains(stateToSave, domains),
+      protectedSecretUpdates
+    }
+  }
+
+  buildStateToSave(serializeDomains = false): {
+    domains?: readonly ProfileStateDomainReplacement[]
     payload: Buffer
     stateHash: string
     protectedSecretUpdates: ProtectedSecretRetentionUpdate[]
@@ -122,21 +212,7 @@ export class StateSerializationSecretHandlingOperations {
           )
         })
       ),
-      settings: {
-        ...stripRetiredGlobalSettings(this.runtime.state.settings),
-        opencodeSessionCookie: encryptToSentinel(
-          PROTECTED_SECRET_SLOT.opencodeSessionCookie,
-          this.runtime.state.settings.opencodeSessionCookie
-        ),
-        opencodeGoApiKey: encryptToSentinel(
-          PROTECTED_SECRET_SLOT.opencodeGoApiKey,
-          this.runtime.state.settings.opencodeGoApiKey ?? ''
-        ),
-        httpProxyUrl: encryptToSentinel(
-          PROTECTED_SECRET_SLOT.httpProxyUrl,
-          this.runtime.state.settings.httpProxyUrl ?? ''
-        )
-      },
+      settings: this.buildSettingsToSave(encryptToSentinel),
       ui: {
         ...this.runtime.state.ui,
         browserKagiSessionLink: encryptOptionalToSentinel(
@@ -145,6 +221,24 @@ export class StateSerializationSecretHandlingOperations {
         )
       }
     }
+    if (
+      serializeDomains &&
+      !('toJSON' in stateToSave && typeof stateToSave.toJSON === 'function')
+    ) {
+      const serialized = serializeCompleteProfileStateDomains(
+        stateToSave,
+        secretSubs,
+        protectedStorageDegraded ? 'safeStorage-degraded\0' : ''
+      )
+      return {
+        domains: serialized.domains,
+        stateHash: serialized.stateHash,
+        get payload() {
+          return serialized.payload
+        },
+        protectedSecretUpdates
+      }
+    }
     // Why compact: ~20% fewer bytes and less serialize time; all readers JSON.parse so formatting is irrelevant.
     // One full-state stringify; secret slots currently hold sentinels.
     const serialized = JSON.stringify(stateToSave)
@@ -158,4 +252,22 @@ export class StateSerializationSecretHandlingOperations {
     )
     return { payload, stateHash, protectedSecretUpdates }
   }
+
+  private buildSettingsToSave(encrypt: (slot: string, plaintext: string) => string) {
+    return {
+      ...stripRetiredGlobalSettings(this.runtime.state.settings),
+      opencodeSessionCookie: encrypt(
+        PROTECTED_SECRET_SLOT.opencodeSessionCookie,
+        this.runtime.state.settings.opencodeSessionCookie
+      ),
+      opencodeGoApiKey: encrypt(
+        PROTECTED_SECRET_SLOT.opencodeGoApiKey,
+        this.runtime.state.settings.opencodeGoApiKey ?? ''
+      ),
+      httpProxyUrl: encrypt(
+        PROTECTED_SECRET_SLOT.httpProxyUrl,
+        this.runtime.state.settings.httpProxyUrl ?? ''
+      )
+    }
+  }
 }
diff --git a/src/main/persistence/loading-store/state-write-round-trip.test.ts b/src/main/persistence/loading-store/state-write-round-trip.test.ts
index ee7f26feb3e..1d543fb5b5f 100644
--- a/src/main/persistence/loading-store/state-write-round-trip.test.ts
+++ b/src/main/persistence/loading-store/state-write-round-trip.test.ts
@@ -1,3 +1,8 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson
+} from '../../persistence-test-harness'
 /**
  * The write path now hands the file a Buffer it built in one pass instead of a string it rebuilt
  * per secret. Drives the real `Store` end to end — encrypted settings, a local session and a remote
@@ -5,7 +10,7 @@
  * against (a mis-sliced segment, a re-encoded payload, a dropped sentinel) is invisible until
  * something reads the bytes back.
  */
-import { mkdtempSync, readFileSync, realpathSync } from 'node:fs'
+import { mkdtempSync, realpathSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -35,15 +40,16 @@ const { Store } = await import('./store')
 const HOST_ID = 'ssh:user@host'
 
 const stores: InstanceType<typeof Store>[] = []
-afterEach(() => {
+afterEach(async () => {
   for (const store of stores.splice(0)) {
-    store.flush()
+    store.freezeWrites()
   }
+  await closeTestStores()
   vi.restoreAllMocks()
 })
 
 function openStore(dataFile: string): InstanceType<typeof Store> {
-  const store = new Store({ dataFile })
+  const store = createSqliteTestStore(Store, { dataFile })
   stores.push(store)
   return store
 }
@@ -95,7 +101,7 @@ describe('persisted state survives a save/load round trip', () => {
     }
 
     // The file is valid UTF-8 JSON and holds ciphertext, not the plaintext secrets.
-    const bytes = readFileSync(dataFile)
+    const bytes = Buffer.from(readPersistedStateJson(dataFile))
     const onDisk = JSON.parse(bytes.toString('utf8'))
     expect(onDisk.settings.opencodeSessionCookie).not.toBe('cookie-é-value')
     expect(Buffer.from(onDisk.settings.opencodeSessionCookie, 'base64').toString('utf8')).toContain(
@@ -118,7 +124,7 @@ describe('persisted state survives a save/load round trip', () => {
     // Deep equality of the whole reloaded state, taken across a second round trip so the assertion
     // is not comparing against the first load's one-time settings migrations.
     reloaded.flush()
-    const bytesAfterReload = readFileSync(dataFile)
+    const bytesAfterReload = Buffer.from(readPersistedStateJson(dataFile))
     const again = openStore(dataFile)
     expect(again.getSettings()).toEqual(reloaded.getSettings())
     expect(again.getUI()).toEqual(reloaded.getUI())
@@ -126,6 +132,6 @@ describe('persisted state survives a save/load round trip', () => {
     expect(again.getWorkspaceSession(HOST_ID)).toEqual(reloaded.getWorkspaceSession(HOST_ID))
     // ...and the bytes are stable, so a quiet app is not rewriting a 4 MB file with new content.
     again.flush()
-    expect(readFileSync(dataFile).equals(bytesAfterReload)).toBe(true)
+    expect(Buffer.from(readPersistedStateJson(dataFile)).equals(bytesAfterReload)).toBe(true)
   })
 })
diff --git a/src/main/persistence/loading-store/store-domain-composition.ts b/src/main/persistence/loading-store/store-domain-composition.ts
index c3f2059efe1..70f22e90c5c 100644
--- a/src/main/persistence/loading-store/store-domain-composition.ts
+++ b/src/main/persistence/loading-store/store-domain-composition.ts
@@ -1,7 +1,6 @@
 import type { StoreRuntimeState } from './store-runtime-state'
 import type { Store } from './store'
 import { LoadedStateAdaptationOperations } from './loaded-state-adaptation'
-import { BackupRecoveryRotationOperations } from './backup-recovery-rotation'
 import { LoadedCohortMigrationOperations } from './loaded-cohort-migrations'
 import { LoadedStateParsingOperations } from './loaded-state-parsing'
 import { StateSerializationSecretHandlingOperations } from './state-serialization-secret-handling'
@@ -65,9 +64,25 @@ import {
   installSshLeaseRecoveryOperationsContext
 } from './ssh-lease-recovery-operations'
 
+export type StoreDomainOperations = WriteSchedulingOperations &
+  PrimaryStateWriteOperations &
+  ProjectCollectionOperations &
+  RepoLifecycleOperations &
+  MobileTabSelectionPersistence &
+  SparsePresetPersistence &
+  AutomationPersistence &
+  MetadataLineageOperations &
+  ProfilePreferences &
+  SessionHostPartitionOperations &
+  SessionSnapshotOperations &
+  PtyBindingPersistenceOperations &
+  SshProfileOperations &
+  RetiredWorktreeNamePersistence &
+  SshLeaseRecoveryOperations &
+  WriteFlushBarrierOperations
+
 export type StoreDomains = {
   adaptation: LoadedStateAdaptationOperations
-  backups: BackupRecoveryRotationOperations
   cohorts: LoadedCohortMigrationOperations
   loader: LoadedStateParsingOperations
   serialization: StateSerializationSecretHandlingOperations
@@ -130,11 +145,10 @@ export function installStoreDomainContexts(target: Store, domains: StoreDomains)
 
 export function createStoreDomains(runtime: StoreRuntimeState): StoreDomains {
   const adaptation = new LoadedStateAdaptationOperations(runtime)
-  const backups = new BackupRecoveryRotationOperations(runtime)
   const cohorts = new LoadedCohortMigrationOperations(runtime)
-  const loader = new LoadedStateParsingOperations(runtime, backups, cohorts)
+  const loader = new LoadedStateParsingOperations(runtime, cohorts)
   const serialization = new StateSerializationSecretHandlingOperations(runtime)
-  const writes = new PrimaryStateWriteOperations(runtime, serialization, backups)
+  const writes = new PrimaryStateWriteOperations(runtime, serialization)
   const scheduling = new WriteSchedulingOperations(runtime, writes)
   const flushBarriers = new WriteFlushBarrierOperations(runtime, writes)
   const preferences = new ProfilePreferences(runtime, scheduling)
@@ -163,7 +177,6 @@ export function createStoreDomains(runtime: StoreRuntimeState): StoreDomains {
   )
   return {
     adaptation,
-    backups,
     cohorts,
     loader,
     serialization,
diff --git a/src/main/persistence/loading-store/store-prune-gate-signals.test.ts b/src/main/persistence/loading-store/store-prune-gate-signals.test.ts
index 9c9aa2eb176..ca459ec3982 100644
--- a/src/main/persistence/loading-store/store-prune-gate-signals.test.ts
+++ b/src/main/persistence/loading-store/store-prune-gate-signals.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../../persistence-test-harness'
 /**
  * Drives the real `Store`, because the value of the prune gate is entirely in whether the shipping
  * write paths signal it. A mutation that unwires the call site survives any test that pokes the gate
@@ -43,17 +44,18 @@ beforeEach(() => {
   __resetLocalWorktreeMetadataPruneGateForTests()
 })
 
-afterEach(() => {
+afterEach(async () => {
   // Leaving a debounced save armed would write into a temp dir after the test file finishes.
   for (const store of stores.splice(0)) {
-    store.flush()
+    store.freezeWrites()
   }
+  await closeTestStores()
   vi.restoreAllMocks()
 })
 
 function createStore(): InstanceType<typeof Store> {
   const dir = realpathSync(mkdtempSync(join(tmpdir(), 'orca-store-prune-gate-')))
-  const store = new Store({ dataFile: join(dir, 'orca-data.json') })
+  const store = createSqliteTestStore(Store, { dataFile: join(dir, 'orca-data.json') })
   stores.push(store)
   return store
 }
diff --git a/src/main/persistence/loading-store/store-runtime-authored-session-writes.test.ts b/src/main/persistence/loading-store/store-runtime-authored-session-writes.test.ts
index 9bb2af980bf..8007bfb7ece 100644
--- a/src/main/persistence/loading-store/store-runtime-authored-session-writes.test.ts
+++ b/src/main/persistence/loading-store/store-runtime-authored-session-writes.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../../persistence-test-harness'
 /**
  * Drives the real `Store`, not the helper and not a fake.
  *
@@ -38,17 +39,18 @@ const WT = 'repo-1::/tmp/worktree-a'
 
 const stores: InstanceType<typeof Store>[] = []
 
-afterEach(() => {
+afterEach(async () => {
   // Leaving a debounced save armed would write into a temp dir after the test file finishes.
   for (const store of stores.splice(0)) {
-    store.flush()
+    store.freezeWrites()
   }
+  await closeTestStores()
   vi.restoreAllMocks()
 })
 
 function createStore(): InstanceType<typeof Store> {
   const dir = realpathSync(mkdtempSync(join(tmpdir(), 'orca-store-runtime-authored-')))
-  const store = new Store({ dataFile: join(dir, 'orca-data.json') })
+  const store = createSqliteTestStore(Store, { dataFile: join(dir, 'orca-data.json') })
   stores.push(store)
   return store
 }
diff --git a/src/main/persistence/loading-store/store-runtime-state.ts b/src/main/persistence/loading-store/store-runtime-state.ts
index b14ea8ce3a4..b29f49f95f9 100644
--- a/src/main/persistence/loading-store/store-runtime-state.ts
+++ b/src/main/persistence/loading-store/store-runtime-state.ts
@@ -19,10 +19,20 @@ import type {
   AutomationListProjectionCache,
   AutomationStorageAuthority
 } from '../scheduling-automations/automation-owner-projection'
+import type { ProfileStatePersistenceAuthority } from './profile-state-authority'
+import type { AutomationRun } from '../../../shared/automations-types'
+
+export type DurableProfileStateMutation<T> = {
+  value: T
+  /** 'if-dirty' fences an existing change without rewriting an already durable generation. */
+  persist?: boolean | 'if-dirty'
+  rollback?: () => void
+}
 
 export type StoreRuntimeOptions = {
   dataFile?: string
   storageAuthority?: AutomationStorageAuthority
+  profileStateAuthority?: ProfileStatePersistenceAuthority
 }
 
 /** Mutable coordination state shared only with this Store's private collaborators. */
@@ -30,30 +40,39 @@ export class StoreRuntimeState {
   state!: PersistedState
   readonly dataFile: string
   readonly storageAuthority: AutomationStorageAuthority
+  readonly profileStateAuthority: ProfileStatePersistenceAuthority | undefined
   automationListProjectionCache: AutomationListProjectionCache | null = null
   activeViewPreference!: ActiveViewPreference
   readonly terminalScrollbackSnapshotStorage: TerminalScrollbackSnapshotStorage
   writeTimer: ReturnType<typeof setTimeout> | null = null
   pendingWrite: Promise<void> | null = null
   pendingSnapshotFileWork: Promise<void> | null = null
-  readonly staleTempCleanup: Promise<void>
   writeGeneration = 0
-  inFlightAsyncTmpFile: string | null = null
-  backupRotationInFlight = false
   writesFrozen = false
+  fatalMutationError: Error | null = null
+  durableMutationPhase: 'mutate' | 'rollback' | null = null
+  profileMaintenancePending = false
+  pendingProfileMaintenance: Promise<void> | null = null
+  readonly pendingProfileFlushes = new Set<Promise<void>>()
   quitFlushStarted = false
   quitFlushPromise: Promise<void> | null = null
   lastWrittenStateHash: string | null = null
   lastDurableWriteGeneration = -1
   firstPendingSaveAt: number | null = null
+  /** Known dirty domains, or null when a caller requires a complete-document fallback. */
+  dirtyProfileStateDomains: Set<string> | null = new Set()
+  pendingAutomationRunsAfter: readonly AutomationRun[] | undefined
   githubCacheDirty = false
   githubCacheGeneration = 0
   pendingGithubCacheWrite: Promise<void> | null = null
   readonly staleGithubCacheTempCleanup: Promise<void>
+  /** Reclaim compatibility-export temps left by a process killed during rename. */
+  readonly staleProfileStateTempCleanup: Promise<void>
   readonly gitUsernameCache = new Map<string, string>()
   readonly protectedSecrets = new ProtectedSecretPersistence()
   loadNeedsSave = false
   flushOrThrow!: () => void
+  runDurableMutation!: <T>(mutate: () => DurableProfileStateMutation<T>) => Promise<T>
   settingsChangeListeners = new Set<
     (
       updates: Partial<GlobalSettings>,
@@ -72,9 +91,12 @@ export class StoreRuntimeState {
   constructor(options: StoreRuntimeOptions = {}) {
     this.dataFile = options.dataFile ?? getDataFile()
     this.storageAuthority = options.storageAuthority ?? 'desktop'
-    this.staleTempCleanup = removeStaleDurableWriteTempFiles(this.dataFile, {
-      minimumAgeMs: STALE_DURABLE_WRITE_TEMP_AGE_MS
-    })
+    this.profileStateAuthority = options.profileStateAuthority
+    this.staleProfileStateTempCleanup = this.profileStateAuthority
+      ? removeStaleDurableWriteTempFiles(this.dataFile, {
+          minimumAgeMs: STALE_DURABLE_WRITE_TEMP_AGE_MS
+        })
+      : Promise.resolve()
     this.staleGithubCacheTempCleanup = removeStaleDurableWriteTempFiles(
       getGithubCacheFile(this.dataFile),
       { minimumAgeMs: STALE_DURABLE_WRITE_TEMP_AGE_MS }
diff --git a/src/main/persistence/loading-store/store.ts b/src/main/persistence/loading-store/store.ts
index 017583e8f86..d60f1a7e3e1 100644
--- a/src/main/persistence/loading-store/store.ts
+++ b/src/main/persistence/loading-store/store.ts
@@ -12,28 +12,40 @@ import {
   createStoreDomains,
   installStoreDomainContexts,
   STORE_DOMAIN_OPERATION_CLASSES,
-  type StoreDomains
+  type StoreDomains,
+  type StoreDomainOperations
 } from './store-domain-composition'
 import type { PersistedState } from '../../../shared/persisted-state-types'
 import { scheduleSave } from './write-scheduling'
-import type { WriteSchedulingOperations } from './write-scheduling'
-import type { PrimaryStateWriteOperations } from './primary-state-writes'
-import type { ProjectCollectionOperations } from './project-collection-operations'
-import type { RepoLifecycleOperations } from './repo-lifecycle-operations'
-import type { MobileTabSelectionPersistence } from './mobile-tab-selection-persistence'
-import type { SparsePresetPersistence } from './sparse-preset-persistence'
-import type { AutomationPersistence } from './automation-persistence'
-import type { MetadataLineageOperations } from './metadata-lineage-operations'
-import type { ProfilePreferences } from './profile-preferences'
-import type { SessionHostPartitionOperations } from './session-host-partitions'
-import type { SessionSnapshotOperations } from './session-snapshot-operations'
-import type { PtyBindingPersistenceOperations } from './pty-binding-persistence'
-import type { SshProfileOperations } from './ssh-profile-operations'
-import type { RetiredWorktreeNamePersistence } from './retired-worktree-name-persistence'
-import type { SshLeaseRecoveryOperations } from './ssh-lease-recovery-operations'
-import type { WriteFlushBarrierOperations } from './write-flush-barriers'
+import { enqueuePrimaryStateOperation, writeToDiskAsync } from './primary-state-writes'
+import type { ProfileStateDatabaseQuarantine } from '../profile-state/profile-state-database-quarantine'
+import { writeVersionedProfileStateExport } from '../profile-state/legacy-json/profile-state-versioned-export'
+import {
+  beginProfileStateMaintenance,
+  freezeProfileStateWrites,
+  freezeProfileStateWritesAsync,
+  type ProfileStateMaintenanceOptions
+} from './profile-state-maintenance'
+import type {
+  AsyncProfileStateAuthority,
+  ProfileStateAuthorityInitialState,
+  ProfileStateStartupPaneAlias,
+  ProfileStatePersistenceAuthority,
+  ProfileStateMaintenance
+} from './profile-state-authority'
 
-export type StoreOptions = StoreRuntimeOptions
+export type StoreOptions = StoreRuntimeOptions & {
+  /** Storage-form JSON supplied by a read-only profile migration/import boundary. */
+  serializedState?: string
+  collectUnboundPaneAlias?: (entry: ProfileStateStartupPaneAlias) => void
+  /** Reuse the authority's validated startup read without retaining a cached copy. */
+  initialAuthorityState?: ProfileStateAuthorityInitialState<ProfileStatePersistenceAuthority>
+}
+
+export type PreparedProfileStateExport = {
+  readonly json: string
+  commit(): void
+}
 export type PtyBindingSourceExpectation = {
   worktreeId?: string
   tabId: string
@@ -50,12 +62,49 @@ export class Store {
   private readonly state: PersistedState
 
   constructor(options: StoreOptions = {}) {
+    if (options.profileStateAuthority !== undefined && options.serializedState !== undefined) {
+      throw new Error('Store cannot use both a profile-state authority and serialized state')
+    }
+    if (
+      options.initialAuthorityState !== undefined &&
+      (options.profileStateAuthority === undefined ||
+        options.initialAuthorityState.authority !== options.profileStateAuthority)
+    ) {
+      throw new Error('Store initial authority state must belong to its profile-state authority')
+    }
+    if (options.profileStateAuthority === undefined && options.serializedState === undefined) {
+      throw new Error('Writable Store construction requires a SQLite profile-state authority')
+    }
+    const initial = options.initialAuthorityState
+    const parsedState = initial?.takeParsedState?.()
+    const imported = options.serializedState !== undefined
     this.runtime = new StoreRuntimeState(options)
+    this.runtime.writesFrozen = imported
     this.domains = createStoreDomains(this.runtime)
     installStoreDomainContexts(this, this.domains)
     this.runtime.flushOrThrow = () => this.flushOrThrow()
-    const loaded = this.domains.loader.load()
-    const normalized = normalizePersistedPaneIdentityState(loaded)
+    this.runtime.runDurableMutation = (mutate) => this.runDurableMutation(mutate)
+    let loaded: PersistedState
+    if (options.profileStateAuthority !== undefined) {
+      if (initial !== undefined) {
+        loaded =
+          initial.takeParsedState !== undefined
+            ? this.domains.loader.loadParsedFromAuthority(parsedState)
+            : this.domains.loader.loadFromAuthority(initial.serializedState)
+      } else {
+        loaded = this.domains.loader.loadFromAuthority(
+          options.profileStateAuthority.readSerializedState()
+        )
+      }
+    } else if (options.serializedState !== undefined) {
+      loaded = this.domains.loader.loadSerialized(options.serializedState)
+    } else {
+      throw new Error('Store requires an authority or a frozen serialized import')
+    }
+    const normalized = normalizePersistedPaneIdentityState(loaded, {
+      registerAliases: !imported,
+      collectUnboundPaneAlias: options.collectUnboundPaneAlias
+    })
     this.state = normalized.state
     this.runtime.state = this.state
     this.runtime.activeViewPreference = new ActiveViewPreference(
@@ -67,27 +116,38 @@ export class Store {
     // Load is the only place an orphaned repo id can be swept: every removal path needs the repo to
     // still be registered, so rows outlive their owner without one (#17776).
     const sweptRepoIds = this.domains.repos.sweepDeregisteredRepoResidue()
-    for (const entry of normalized.migrationUnsupportedEntries) {
-      setMigrationUnsupportedPty(entry)
-    }
-    for (const entry of normalized.legacyPaneKeyAliasEntries) {
-      registerPersistedPaneKeyAlias(entry)
-    }
-    setMigrationUnsupportedPtyPersistenceListener((entries) => {
-      this.state.migrationUnsupportedPtyEntries = entries
-      scheduleSave(this.domains.scheduling)
-    })
-    agentHookServer.setPaneKeyAliasPersistenceListener((entries) => {
-      this.state.legacyPaneKeyAliasEntries = entries
-      scheduleSave(this.domains.scheduling)
-    })
-    if (
-      normalized.changed ||
-      this.runtime.loadNeedsSave ||
-      adaptedProjectGroups ||
-      sweptRepoIds.length > 0
-    ) {
-      scheduleSave(this.domains.scheduling)
+    // Imported snapshots cannot own the live hook server or write their source file.
+    if (!imported) {
+      for (const entry of initial?.unboundPaneAliases ?? []) {
+        agentHookServer.registerPaneKeyAlias(
+          entry.legacyPaneKey,
+          entry.stablePaneKey,
+          undefined,
+          entry.updatedAt
+        )
+      }
+      for (const entry of normalized.migrationUnsupportedEntries) {
+        setMigrationUnsupportedPty(entry)
+      }
+      for (const entry of normalized.legacyPaneKeyAliasEntries) {
+        registerPersistedPaneKeyAlias(entry)
+      }
+      setMigrationUnsupportedPtyPersistenceListener((entries) => {
+        this.state.migrationUnsupportedPtyEntries = entries
+        scheduleSave(this.domains.scheduling)
+      })
+      agentHookServer.setPaneKeyAliasPersistenceListener((entries) => {
+        this.state.legacyPaneKeyAliasEntries = entries
+        scheduleSave(this.domains.scheduling)
+      })
+      if (
+        normalized.changed ||
+        this.runtime.loadNeedsSave ||
+        adaptedProjectGroups ||
+        sweptRepoIds.length > 0
+      ) {
+        scheduleSave(this.domains.scheduling)
+      }
     }
   }
 
@@ -95,34 +155,159 @@ export class Store {
     return dirname(this.runtime.dataFile)
   }
 
-  freezeWrites(): void {
-    this.runtime.writesFrozen = true
-    if (this.runtime.writeTimer) {
-      clearTimeout(this.runtime.writeTimer)
-      this.runtime.writeTimer = null
+  /**
+   * Prepare a storage-form export for a database importer.
+   *
+   * Secret retention is committed only after the caller durably accepts the
+   * export. This keeps a failed migration from discarding the prior sealed
+   * value from the in-memory fallback store.
+   */
+  prepareProfileStateExport(): PreparedProfileStateExport {
+    const built = this.domains.serialization.buildStateToSave()
+    let committed = false
+    return {
+      json: built.payload.toString('utf8'),
+      commit: () => {
+        if (committed) {
+          return
+        }
+        this.runtime.protectedSecrets.commitRetentionUpdates(built.protectedSecretUpdates)
+        committed = true
+      }
     }
   }
+
+  /** Publish an explicit rollback/compatibility export after flushing current state. */
+  writeProfileStateJsonExport(targetPath: string): number {
+    this.runtime.dirtyProfileStateDomains = null
+    this.flushOrThrow()
+    const authority = this.runtime.profileStateAuthority
+    if (authority?.asynchronous) {
+      throw new Error('Live profile exports require an awaited export')
+    }
+    if (authority?.writeJsonExport) {
+      return authority.writeJsonExport(targetPath)
+    }
+
+    throw new Error('Profile state exports require a SQLite profile-state authority')
+  }
+
+  /** Publish the latest SQLite revision as a durable, versioned rollback export. */
+  writeLatestProfileStateJsonExport(): number | undefined {
+    const authority = this.runtime.profileStateAuthority
+    if (authority?.asynchronous) {
+      throw new Error('Live profile exports require an awaited export')
+    }
+    if (!authority?.writeJsonExport) {
+      return undefined
+    }
+    this.runtime.dirtyProfileStateDomains = null
+    this.flushOrThrow()
+
+    const writeExport = authority.writeJsonExport.bind(authority)
+    return writeVersionedProfileStateExport(this.runtime.dataFile, writeExport)
+  }
+
+  /** Publish recovery and canonical JSON checkpoints for older builds. */
+  writeLatestProfileStateJsonCompatibilityExport(): number | undefined {
+    const authority = this.runtime.profileStateAuthority
+    if (authority?.asynchronous) {
+      throw new Error('Live profile exports require an awaited export')
+    }
+    if (!authority?.writeJsonCompatibilityExport) {
+      return undefined
+    }
+    this.runtime.dirtyProfileStateDomains = null
+    this.flushOrThrow()
+    return authority.writeJsonCompatibilityExport(this.runtime.dataFile)
+  }
+
+  writeLatestProfileStateJsonExportAsync(): Promise<number | undefined> {
+    if (!this.runtime.profileStateAuthority?.asynchronous) {
+      return Promise.resolve(this.writeLatestProfileStateJsonExport())
+    }
+    return this.enqueueProfileExport((authority) =>
+      authority.writeLatestJsonExport(this.runtime.dataFile)
+    )
+  }
+
+  writeLatestProfileStateJsonCompatibilityExportAsync(): Promise<number | undefined> {
+    if (!this.runtime.profileStateAuthority?.asynchronous) {
+      return Promise.resolve(this.writeLatestProfileStateJsonCompatibilityExport())
+    }
+    return this.enqueueProfileExport((authority) =>
+      authority.writeJsonCompatibilityExport(this.runtime.dataFile)
+    )
+  }
+
+  private enqueueProfileExport(
+    exportState: (authority: AsyncProfileStateAuthority) => Promise<number | undefined>
+  ): Promise<number | undefined> {
+    if (
+      this.runtime.writesFrozen ||
+      this.runtime.quitFlushStarted ||
+      this.runtime.profileMaintenancePending
+    ) {
+      return Promise.reject(new Error('Cannot export finalized profile persistence'))
+    }
+    const authority = this.runtime.profileStateAuthority
+    if (!authority?.asynchronous) {
+      return Promise.resolve(undefined)
+    }
+    return enqueuePrimaryStateOperation(this.domains.writes, async () => {
+      this.runtime.dirtyProfileStateDomains = null
+      if (!(await writeToDiskAsync(this.domains.writes))) {
+        throw new Error('Profile state changed while preparing its export')
+      }
+      return exportState(authority)
+    })
+  }
+
+  /** Freeze writes, then preserve the SQLite family for an explicit recovery decision. */
+  quarantineProfileStateDatabase(
+    quarantineRoot?: string,
+    reason?: string
+  ): ProfileStateDatabaseQuarantine {
+    this.freezeWrites()
+    const authority = this.runtime.profileStateAuthority
+    if (authority?.asynchronous) {
+      throw new Error('Live profile quarantine requires an awaited close')
+    }
+    if (!authority?.quarantineDatabase) {
+      throw new Error('SQLite profile-state quarantine is unavailable')
+    }
+    return authority.quarantineDatabase(quarantineRoot, reason)
+  }
+
+  freezeWrites(): void {
+    freezeProfileStateWrites(this.runtime)
+  }
+
+  beginProfileMaintenance(
+    options?: ProfileStateMaintenanceOptions
+  ): Promise<ProfileStateMaintenance> {
+    return beginProfileStateMaintenance(this.runtime, this.domains, options)
+  }
+
+  freezeWritesAsync(): Promise<void> {
+    return freezeProfileStateWritesAsync(this.runtime)
+  }
+
+  async quarantineProfileStateDatabaseAsync(
+    quarantineRoot?: string,
+    reason?: string
+  ): Promise<ProfileStateDatabaseQuarantine> {
+    await this.beginProfileMaintenance({ flush: false })
+    const authority = this.runtime.profileStateAuthority
+    if (!authority?.quarantineDatabase) {
+      throw new Error('SQLite profile-state quarantine is unavailable')
+    }
+    return authority.quarantineDatabase(quarantineRoot, reason)
+  }
 }
 
 // oxlint-disable-next-line typescript-eslint/consistent-type-definitions -- declaration merging derives Store's prototype API directly from the exact concrete domain classes installed below
-export interface Store
-  extends
-    WriteSchedulingOperations,
-    PrimaryStateWriteOperations,
-    ProjectCollectionOperations,
-    RepoLifecycleOperations,
-    MobileTabSelectionPersistence,
-    SparsePresetPersistence,
-    AutomationPersistence,
-    MetadataLineageOperations,
-    ProfilePreferences,
-    SessionHostPartitionOperations,
-    SessionSnapshotOperations,
-    PtyBindingPersistenceOperations,
-    SshProfileOperations,
-    RetiredWorktreeNamePersistence,
-    SshLeaseRecoveryOperations,
-    WriteFlushBarrierOperations {}
+export interface Store extends StoreDomainOperations {}
 
 for (const OperationClass of STORE_DOMAIN_OPERATION_CLASSES) {
   const descriptors = Object.getOwnPropertyDescriptors(OperationClass.prototype)
diff --git a/src/main/persistence/loading-store/terminal-close-async-durability.test.ts b/src/main/persistence/loading-store/terminal-close-async-durability.test.ts
new file mode 100644
index 00000000000..090d2340932
--- /dev/null
+++ b/src/main/persistence/loading-store/terminal-close-async-durability.test.ts
@@ -0,0 +1,227 @@
+import { expect, it, vi } from 'vitest'
+import { fixture } from './profile-state-delayed-authority-fixture'
+import { OrcaRuntimeService } from '../../runtime/orca-runtime'
+import type { RuntimeMobileSessionTabsSnapshot } from '../../../shared/runtime-types'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+  leafId: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+  ptyId: 'closing-pty',
+  incarnationId: 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
+}
+const siblingLeafId = 'dddddddd-dddd-4ddd-8ddd-dddddddddddd'
+
+class CloseRuntime extends OrcaRuntimeService {
+  async closeHeadlessTab(): Promise<void> {
+    const snapshot = this.mobileSessionTabsByWorktree.get(binding.worktreeId)
+    const tab = snapshot?.tabs[0]
+    if (!snapshot || tab?.type !== 'terminal') {
+      throw new Error('missing test tab')
+    }
+    await this.closeHeadlessMobileTerminalTab(binding.worktreeId, snapshot, tab)
+  }
+  publish(): void {
+    const snapshot: RuntimeMobileSessionTabsSnapshot = {
+      worktree: binding.worktreeId,
+      publicationEpoch: 'close-test',
+      snapshotVersion: 1,
+      activeGroupId: null,
+      activeTabId: `${binding.tabId}::${binding.leafId}`,
+      activeTabType: 'terminal',
+      tabs: [
+        {
+          type: 'terminal',
+          id: `${binding.tabId}::${binding.leafId}`,
+          parentTabId: binding.tabId,
+          leafId: binding.leafId,
+          ptyId: binding.ptyId,
+          title: 'Terminal',
+          isActive: true
+        }
+      ]
+    }
+    this.storeMobileSessionSnapshot(binding.worktreeId, snapshot)
+  }
+}
+
+async function closeFixture(options: { split?: boolean } = {}) {
+  const result = await fixture()
+  await result.store.persistPtyBinding(binding)
+  if (options.split) {
+    await result.store.persistPtyBinding({
+      ...binding,
+      leafId: siblingLeafId,
+      ptyId: 'sibling-pty',
+      incarnationId: 'eeeeeeee-eeee-4eee-8eee-eeeeeeeeeeee',
+      expectedSourceBinding: binding
+    })
+  }
+  const runtime = new CloseRuntime(result.store)
+  const kill = vi.fn(() => true)
+  runtime.setPtyController({ write: () => true, kill, getForegroundProcess: async () => null })
+  return {
+    ...result,
+    runtime,
+    kill,
+    persistedLeafIds: () =>
+      Object.keys(
+        result.readState().workspaceSession.terminalLayoutsByTabId[binding.tabId]?.ptyIdsByLeafId ??
+          {}
+      ),
+    liveLeafIds: () =>
+      Object.keys(
+        result.store.getWorkspaceSession().terminalLayoutsByTabId[binding.tabId]?.ptyIdsByLeafId ??
+          {}
+      )
+  }
+}
+
+it.each([
+  ['tab', { kind: 'tab' as const, tabId: binding.tabId }, []],
+  [
+    'split pane',
+    { kind: 'pane' as const, tabId: binding.tabId, leafId: binding.leafId },
+    [siblingLeafId]
+  ]
+])('acknowledges a renderer %s close only once it is durable', async (kind, target, remaining) => {
+  const { authority, runtime, persistedLeafIds } = await closeFixture({ split: kind !== 'tab' })
+  const before = persistedLeafIds()
+  const gate = authority.pause()
+  let acknowledged = false
+  const closing = runtime
+    .closeTerminalSurfaceFromRenderer({ worktreeId: binding.worktreeId, target: target })
+    .then(() => {
+      acknowledged = true
+    })
+  try {
+    await Promise.race([gate.started.promise, closing])
+    expect(acknowledged).toBe(false)
+    expect(persistedLeafIds()).toEqual(before)
+  } finally {
+    gate.finish.resolve()
+  }
+  await closing
+  expect(persistedLeafIds()).toEqual(remaining)
+})
+
+it('keeps a phone close and still kills when its durable write fails', async () => {
+  const { authority, store, runtime, kill, persistedLeafIds, liveLeafIds } = await closeFixture()
+  runtime.registerPty(binding.ptyId, binding.worktreeId, null, binding)
+  runtime.publish()
+  const failure = vi.spyOn(console, 'error').mockImplementation(() => {})
+  const gate = authority.pause()
+  const closing = runtime.closeHeadlessTab()
+  await Promise.race([gate.started.promise, closing])
+  gate.finish.reject(new Error('close disk refused'))
+
+  await expect(closing).resolves.toBeUndefined()
+  expect(kill).toHaveBeenCalledExactlyOnceWith(binding.ptyId)
+  expect(liveLeafIds()).toEqual([])
+  expect(persistedLeafIds()).toEqual([binding.leafId])
+  expect(failure).toHaveBeenCalledWith(
+    '[runtime] failed to persist terminal close:',
+    expect.objectContaining({ message: 'close disk refused' })
+  )
+
+  // Nothing rolled the removal back, so the next write makes it durable.
+  await store.flushPendingOrThrowAsync()
+  expect(persistedLeafIds()).toEqual([])
+})
+
+it('keeps a renderer close when its durable write fails', async () => {
+  const { authority, runtime, persistedLeafIds, liveLeafIds } = await closeFixture()
+  vi.spyOn(console, 'error').mockImplementation(() => {})
+  const gate = authority.pause()
+  const closing = runtime.closeTerminalSurfaceFromRenderer({
+    worktreeId: binding.worktreeId,
+    target: {
+      kind: 'tab',
+      tabId: binding.tabId
+    }
+  })
+  await Promise.race([gate.started.promise, closing])
+  gate.finish.reject(new Error('close disk refused'))
+
+  await expect(closing).resolves.toBeUndefined()
+  expect(liveLeafIds()).toEqual([])
+  expect(persistedLeafIds()).toEqual([binding.leafId])
+})
+
+it('commits nothing for a pane that restarted while its close waited for the writer', async () => {
+  const { authority, store, runtime, liveLeafIds } = await closeFixture({ split: true })
+  const gate = authority.pause()
+  const session = store.getWorkspaceSession()
+  store.setWorkspaceSession({ ...session, activeTabIdByWorktree: { [binding.worktreeId]: null } })
+  const earlierWrite = store.flushPendingOrThrowAsync()
+  await gate.started.promise
+  // The restart is queued first, so it lands after the close captured the pane it meant.
+  const restart = store.persistPtyBinding({
+    ...binding,
+    ptyId: 'restarted-pty',
+    incarnationId: 'ffffffff-ffff-4fff-8fff-ffffffffffff'
+  })
+  const closing = runtime.closeTerminalSurfaceFromRenderer({
+    worktreeId: binding.worktreeId,
+    target: {
+      kind: 'pane',
+      tabId: binding.tabId,
+      leafId: binding.leafId
+    }
+  })
+  gate.finish.resolve()
+  await earlierWrite
+  await expect(restart).resolves.toBe(true)
+  await closing
+
+  expect(liveLeafIds()).toEqual([binding.leafId, siblingLeafId])
+})
+
+it('commits a renderer tab close whose split pane bound while the close waited for the writer', async () => {
+  const { authority, store, runtime, persistedLeafIds, liveLeafIds } = await closeFixture()
+  const gate = authority.pause()
+  const session = store.getWorkspaceSession()
+  store.setWorkspaceSession({ ...session, activeTabIdByWorktree: { [binding.worktreeId]: null } })
+  const earlierWrite = store.flushPendingOrThrowAsync()
+  await gate.started.promise
+  // The split's binding is queued first, so it grows the tab after the close was asked.
+  const split = store.persistPtyBinding({
+    ...binding,
+    leafId: siblingLeafId,
+    ptyId: 'sibling-pty',
+    incarnationId: 'eeeeeeee-eeee-4eee-8eee-eeeeeeeeeeee',
+    expectedSourceBinding: binding
+  })
+  const closing = runtime.closeTerminalSurfaceFromRenderer({
+    worktreeId: binding.worktreeId,
+    target: {
+      kind: 'tab',
+      tabId: binding.tabId
+    }
+  })
+  gate.finish.resolve()
+  await earlierWrite
+  await expect(split).resolves.toBe(true)
+  await expect(closing).resolves.toBeUndefined()
+
+  expect(persistedLeafIds()).toEqual([])
+  expect(liveLeafIds()).toEqual([])
+  expect(
+    store
+      .getWorkspaceSession()
+      .tabsByWorktree[binding.worktreeId]?.some((tab) => tab.id === binding.tabId)
+  ).toBe(false)
+  // Why: skipping the owner fence for the layout owner's own close must not skip its record.
+  expect(store.getWorkspaceSession().closedTerminalTabTombstonesByTabId?.[binding.tabId]).toEqual(
+    expect.objectContaining({ worktreeId: binding.worktreeId, reason: 'user' })
+  )
+})
diff --git a/src/main/persistence/loading-store/workspace-session-snapshot-publication.ts b/src/main/persistence/loading-store/workspace-session-snapshot-publication.ts
index 5b7f90cbb8f..96834ffbcf9 100644
--- a/src/main/persistence/loading-store/workspace-session-snapshot-publication.ts
+++ b/src/main/persistence/loading-store/workspace-session-snapshot-publication.ts
@@ -111,7 +111,19 @@ export function setLocalWorkspaceSession(
   if (deferSnapshotFiles) {
     enqueueTerminalScrollbackSnapshotWork(owner, prior, session)
   }
-  scheduleSave(context.scheduling)
+  if (
+    remappedAcknowledgements.changed ||
+    remappedActivityCutoffs.changed ||
+    remappedManualUnread.changed
+  ) {
+    // UI remaps include protected fields, so keep the complete serializer boundary.
+    scheduleSave(context.scheduling)
+  } else {
+    scheduleSave(
+      context.scheduling,
+      remappedLeases.changed ? ['workspaceSession', 'sshRemotePtyLeases'] : ['workspaceSession']
+    )
+  }
 }
 
 export function enqueueTerminalScrollbackSnapshotWork(
diff --git a/src/main/persistence/loading-store/worktree-identity-metadata.ts b/src/main/persistence/loading-store/worktree-identity-metadata.ts
index 21fea4ac15c..9515986f86a 100644
--- a/src/main/persistence/loading-store/worktree-identity-metadata.ts
+++ b/src/main/persistence/loading-store/worktree-identity-metadata.ts
@@ -15,6 +15,13 @@ import { mergeWorktreeMetaForWrite } from './worktree-meta-write-normalization'
 
 type MetadataRuntime = Pick<StoreRuntimeState, 'state'>
 
+/** Storage rows changed together by host-qualified metadata writes. */
+export const WORKTREE_METADATA_DOMAINS = [
+  'worktreeMeta',
+  'worktreeMetaByIdentity',
+  'worktreeIdentityAliases'
+] as const
+
 /** Select one readable row without discarding competing alias candidates. */
 function resolveAliasIdentityKey(state: PersistedState, alias: string): string | undefined {
   const identityKeys = state.worktreeIdentityAliases?.[alias] ?? []
@@ -161,7 +168,7 @@ export function getWorktreeMetaForHost(
   const alias = composeWorktreeHostIdentity(executionHostId, worktreeId)
   const identityKey = resolveAliasIdentityKey(state, alias)
   if (changed) {
-    scheduleSave(scheduling)
+    scheduleSave(scheduling, WORKTREE_METADATA_DOMAINS)
   }
   if (identityKey) {
     return state.worktreeMetaByIdentity?.[identityKey]
@@ -238,6 +245,6 @@ export function setWorktreeMetaForHost(
   if (!legacy || legacy.hostId === executionHostId) {
     state.worktreeMeta[worktreeId] = updated
   }
-  scheduleSave(scheduling)
+  scheduleSave(scheduling, WORKTREE_METADATA_DOMAINS)
   return updated
 }
diff --git a/src/main/persistence/loading-store/worktree-meta-alias-projection.test.ts b/src/main/persistence/loading-store/worktree-meta-alias-projection.test.ts
index f324787cdf3..1ec0bb077a3 100644
--- a/src/main/persistence/loading-store/worktree-meta-alias-projection.test.ts
+++ b/src/main/persistence/loading-store/worktree-meta-alias-projection.test.ts
@@ -1,3 +1,8 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson
+} from '../../persistence-test-harness'
 /**
  * `setWorktreeMetaForHost` puts one object in both `worktreeMeta` and `worktreeMetaByIdentity`, so
  * a heavy profile serializes every metadata row twice. On a measured 3.64 MB install 1,347 of
@@ -11,7 +16,7 @@
  * to the same state, the locator map is never reduced (which is what makes a downgrade lossless),
  * and a build with no rebuild at all recovers every row from the file the new build wrote.
  */
-import { mkdtempSync, readFileSync, realpathSync, writeFileSync } from 'node:fs'
+import { mkdtempSync, realpathSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -54,15 +59,16 @@ function seededRandom(seed: number): () => number {
 }
 
 const stores: InstanceType<typeof Store>[] = []
-afterEach(() => {
+afterEach(async () => {
   for (const store of stores.splice(0)) {
     store.freezeWrites()
   }
+  await closeTestStores()
   vi.restoreAllMocks()
 })
 
 function openStore(dataFile: string): InstanceType<typeof Store> {
-  const store = new Store({ dataFile })
+  const store = createSqliteTestStore(Store, { dataFile })
   stores.push(store)
   return store
 }
@@ -229,7 +235,7 @@ describe('worktree meta alias projection', () => {
     const loaded = openStore(dataFile)
     const before = snapshot(loaded)
     loaded.flush()
-    const rewritten = readFileSync(dataFile, 'utf-8')
+    const rewritten = readPersistedStateJson(dataFile)
     const onDisk = JSON.parse(rewritten) as PersistedState
 
     // The counter this change exists for: 401 regenerable identity rows leave the file.
@@ -257,7 +263,7 @@ describe('worktree meta alias projection', () => {
 
     // A quiet app does not rewrite the file with new content on the next flush.
     reloaded.flush()
-    expect(readFileSync(dataFile, 'utf-8')).toBe(rewritten)
+    expect(readPersistedStateJson(dataFile)).toBe(rewritten)
   })
 
   /**
@@ -277,17 +283,19 @@ describe('worktree meta alias projection', () => {
 
     // What a build without this change does with that file: parse it, run the metadata normalizer
     // it already ships (untouched here), write the result back.
-    const downgraded = JSON.parse(readFileSync(dataFile, 'utf-8')) as PersistedState
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const downgraded = JSON.parse(readPersistedStateJson(dataFile)) as PersistedState
     normalizeWorktreeLinkedItemMetadata(downgraded)
     expect(Object.keys(downgraded.worktreeMeta).sort()).toEqual(Object.keys(before.meta).sort())
     // It drops the aliases whose identity row is not there; it never touches a locator row.
     expect(downgraded.worktreeIdentityAliases).not.toHaveProperty(
       composeWorktreeHostIdentity(LOCAL, worktreeId(0))
     )
-    writeFileSync(dataFile, JSON.stringify(downgraded), 'utf-8')
+    const rollbackDataFile = tempDataFile()
+    writeFileSync(rollbackDataFile, JSON.stringify(downgraded), 'utf-8')
 
     // Every reader is where it started, with no rebuild and without touching a row first.
-    const rolledBack = openStore(dataFile)
+    const rolledBack = openStore(rollbackDataFile)
     expect(rolledBack.getAllWorktreeMeta()).toEqual(before.meta)
     expect(rolledBack.getAllWorktreeMetaForHost(LOCAL)).toEqual(before.local)
     expect(rolledBack.getAllWorktreeMetaForHost(REMOTE as never)).toEqual(before.remote)
@@ -298,7 +306,8 @@ describe('worktree meta alias projection', () => {
       before.meta[worktreeId(0)]
     )
     rolledBack.flush()
-    const reminted = JSON.parse(readFileSync(dataFile, 'utf-8')) as PersistedState
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const reminted = JSON.parse(readPersistedStateJson(rollbackDataFile)) as PersistedState
     expect(
       reminted.worktreeIdentityAliases?.[composeWorktreeHostIdentity(LOCAL, worktreeId(0))]
     ).toEqual([
@@ -338,7 +347,7 @@ describe('worktree meta alias projection', () => {
     fromLegacy.flush()
 
     const compactFile = tempDataFile()
-    writeFileSync(compactFile, readFileSync(legacyFile))
+    writeFileSync(compactFile, readPersistedStateJson(legacyFile))
     const fromCompact = openStore(compactFile)
 
     expect(fromCompact.getAllWorktreeMeta()).toEqual(fromLegacy.getAllWorktreeMeta())
@@ -366,7 +375,8 @@ describe('worktree meta alias projection', () => {
       )
       expect(store.getAllWorktreeMeta()[worktreeId(0)]?.displayName).toBe('workspace-0')
       store.flush()
-      const onDisk = JSON.parse(readFileSync(dataFile, 'utf-8')) as PersistedState
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+      const onDisk = JSON.parse(readPersistedStateJson(dataFile)) as PersistedState
       expect(Object.keys(onDisk.worktreeMeta).length).toBe(
         Object.keys(fixture.state.worktreeMeta).length
       )
@@ -409,7 +419,8 @@ describe('worktree meta alias projection', () => {
     expect(Object.keys(store.getAllWorktreeMeta())).toEqual([worktreeId(0)])
     store.flush()
 
-    const onDisk = JSON.parse(readFileSync(dataFile, 'utf-8')) as PersistedState
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const onDisk = JSON.parse(readPersistedStateJson(dataFile)) as PersistedState
     expect(Object.hasOwn(onDisk, 'worktreeMetaByIdentity')).toBe(false)
     // The locator map and its lineage companions are all still there, untouched by the projection.
     expect(Object.keys(onDisk.worktreeMeta)).toEqual([worktreeId(0)])
diff --git a/src/main/persistence/loading-store/write-flush-barriers.ts b/src/main/persistence/loading-store/write-flush-barriers.ts
index c08d4367989..b4c583666dc 100644
--- a/src/main/persistence/loading-store/write-flush-barriers.ts
+++ b/src/main/persistence/loading-store/write-flush-barriers.ts
@@ -6,6 +6,7 @@ import { getGithubCacheFile } from './user-data-path'
 import type { StoreRuntimeState } from './store-runtime-state'
 import type { PrimaryStateWriteOperations } from './primary-state-writes'
 import { enqueueWrite } from './primary-state-writes'
+import { drainProfileStateOperations, runProfileStateFlush } from './profile-state-flush-lifetime'
 
 type WriteFlushBarrierOperationsRuntime = Pick<
   StoreRuntimeState,
@@ -17,9 +18,14 @@ type WriteFlushBarrierOperationsRuntime = Pick<
   | 'githubCacheGeneration'
   | 'lastDurableWriteGeneration'
   | 'pendingGithubCacheWrite'
+  | 'pendingProfileFlushes'
+  | 'pendingProfileMaintenance'
+  | 'profileMaintenancePending'
+  | 'profileStateAuthority'
   | 'quitFlushPromise'
   | 'quitFlushStarted'
   | 'staleGithubCacheTempCleanup'
+  | 'staleProfileStateTempCleanup'
   | 'state'
   | 'writeGeneration'
   | 'writeTimer'
@@ -30,6 +36,7 @@ const writeFlushBarrierOperationsContext = Symbol('WriteFlushBarrierOperations')
 type WriteFlushBarrierOperationsContext = {
   runtime: WriteFlushBarrierOperationsRuntime
   writes: PrimaryStateWriteOperations
+  bestEffortFinalFlush?: Promise<void>
 }
 
 export class WriteFlushBarrierOperations {
@@ -40,136 +47,184 @@ export class WriteFlushBarrierOperations {
   }
 
   flush(): void {
-    this[writeFlushBarrierOperationsContext].runtime.automationListProjectionCache = null
-    if (this[writeFlushBarrierOperationsContext].runtime.quitFlushStarted) {
+    const { runtime, writes } = this[writeFlushBarrierOperationsContext]
+    runtime.automationListProjectionCache = null
+    if (runtime.quitFlushStarted || runtime.profileMaintenancePending) {
+      return
+    }
+    if (runtime.profileStateAuthority?.asynchronous) {
+      runtime.writeGeneration++
+      void flushCurrentStateAsync(this, { drainToStableGeneration: false }).catch((error) =>
+        console.error('[persistence] Failed to flush state:', error)
+      )
       return
     }
     try {
-      this[writeFlushBarrierOperationsContext].writes.flushOrThrow()
+      writes.flushOrThrow()
     } catch (err) {
       console.error('[persistence] Failed to flush state:', err)
     }
     try {
-      this[writeFlushBarrierOperationsContext].writes.flushActiveViewPreferenceOrThrow()
+      writes.flushActiveViewPreferenceOrThrow()
     } catch (err) {
       console.error('[active-view] Failed to flush preference:', err)
     }
     writeGithubCacheSnapshotSync(this)
   }
 
-  flushAsync(): Promise<void> {
-    if (this[writeFlushBarrierOperationsContext].runtime.quitFlushPromise) {
-      return this[writeFlushBarrierOperationsContext].runtime.quitFlushPromise
+  flushAsync(options: { exportJsonCompatibility?: boolean } = {}): Promise<void> {
+    const context = this[writeFlushBarrierOperationsContext]
+    context.bestEffortFinalFlush ??= this.flushFinalOrThrowAsync(options).catch((error) =>
+      console.error('[persistence] Failed to flush final state:', error)
+    )
+    return context.bestEffortFinalFlush
+  }
+
+  flushFinalOrThrowAsync(options: { exportJsonCompatibility?: boolean } = {}): Promise<void> {
+    const { runtime } = this[writeFlushBarrierOperationsContext]
+    if (runtime.quitFlushPromise) {
+      return runtime.quitFlushPromise
     }
-    this[writeFlushBarrierOperationsContext].runtime.quitFlushStarted = true
-    this[writeFlushBarrierOperationsContext].runtime.quitFlushPromise = flushCurrentStateAsync(
-      this,
-      true
-    ).catch(() => {})
-    return this[writeFlushBarrierOperationsContext].runtime.quitFlushPromise
+    runtime.quitFlushStarted = true
+    runtime.quitFlushPromise = Promise.resolve(runtime.pendingProfileMaintenance)
+      .catch((error: unknown) => {
+        // Failed maintenance may re-admit unchanged storage before this final checkpoint.
+        if (runtime.profileMaintenancePending || runtime.writesFrozen) {
+          throw error
+        }
+      })
+      .then(async () => {
+        if (runtime.profileMaintenancePending) {
+          return
+        }
+        await drainProfileStateOperations([
+          ...runtime.pendingProfileFlushes,
+          runtime.staleProfileStateTempCleanup,
+          runtime.profileStateAuthority?.drainBackups?.(true)
+        ])
+        await flushCurrentStateAsync(this, { final: true })
+        if (options.exportJsonCompatibility) {
+          await runtime.profileStateAuthority?.writeJsonCompatibilityExportAsync?.(runtime.dataFile)
+        }
+      })
+      .finally(async () => {
+        if (runtime.profileStateAuthority?.asynchronous) {
+          runtime.writesFrozen = true
+          await runtime.profileStateAuthority.close()
+        }
+      })
+    return runtime.quitFlushPromise
   }
 
   flushPendingAsync(): Promise<void> {
+    const { runtime } = this[writeFlushBarrierOperationsContext]
+    if (runtime.writesFrozen || runtime.quitFlushStarted || runtime.profileMaintenancePending) {
+      return Promise.resolve()
+    }
     // Best-effort callers must not livelock while the live app keeps mutating state.
-    return flushCurrentStateAsync(this, false, undefined, false).catch(() => {})
+    return flushCurrentStateAsync(this, { drainToStableGeneration: false }).catch(() => {})
   }
 
   flushPendingOrThrowAsync(
     options: { signal?: AbortSignal; drainToStableGeneration?: boolean } = {}
   ): Promise<void> {
-    if (
-      this[writeFlushBarrierOperationsContext].runtime.writesFrozen ||
-      this[writeFlushBarrierOperationsContext].runtime.quitFlushStarted
-    ) {
+    const { runtime } = this[writeFlushBarrierOperationsContext]
+    if (runtime.writesFrozen || runtime.profileMaintenancePending || runtime.quitFlushStarted) {
       return Promise.reject(new Error('Cannot flush while persistence is finalized'))
     }
-    return flushCurrentStateAsync(
-      this,
-      false,
-      options.signal,
-      options.drainToStableGeneration,
-      true
-    )
+    return flushCurrentStateAsync(this, {
+      signal: options.signal,
+      drainToStableGeneration: options.drainToStableGeneration,
+      requireInitialGenerationDurable: true
+    })
   }
 }
 
 export async function flushDurableStateOrThrowAsync(
   owner: WriteFlushBarrierOperations
 ): Promise<void> {
-  if (
-    owner[writeFlushBarrierOperationsContext].runtime.writesFrozen ||
-    owner[writeFlushBarrierOperationsContext].runtime.quitFlushStarted
-  ) {
+  const { runtime, writes } = owner[writeFlushBarrierOperationsContext]
+  if (runtime.writesFrozen || runtime.profileMaintenancePending || runtime.quitFlushStarted) {
     throw new Error('Cannot flush while persistence is finalized')
   }
-  for (;;) {
-    if (owner[writeFlushBarrierOperationsContext].runtime.writeTimer) {
-      clearTimeout(owner[writeFlushBarrierOperationsContext].runtime.writeTimer)
-      owner[writeFlushBarrierOperationsContext].runtime.writeTimer = null
+  return runProfileStateFlush(runtime, async () => {
+    for (;;) {
+      if (runtime.writeTimer) {
+        clearTimeout(runtime.writeTimer)
+        runtime.writeTimer = null
+      }
+      runtime.firstPendingSaveAt = null
+      const generation = runtime.writeGeneration
+      await enqueueWrite(writes)
+      if (generation === runtime.writeGeneration) {
+        break
+      }
     }
-    owner[writeFlushBarrierOperationsContext].runtime.firstPendingSaveAt = null
-    const generation = owner[writeFlushBarrierOperationsContext].runtime.writeGeneration
-    await enqueueWrite(owner[writeFlushBarrierOperationsContext].writes)
-    if (generation === owner[writeFlushBarrierOperationsContext].runtime.writeGeneration) {
-      break
-    }
-  }
+  })
 }
 
 export async function flushCurrentStateAsync(
   owner: WriteFlushBarrierOperations,
-  final: boolean,
-  signal?: AbortSignal,
-  drainToStableGeneration = true,
-  requireInitialGenerationDurable = false
+  {
+    final = false,
+    signal,
+    drainToStableGeneration = true,
+    requireInitialGenerationDurable = false,
+    fullCheckpoint = final
+  }: {
+    final?: boolean
+    signal?: AbortSignal
+    drainToStableGeneration?: boolean
+    requireInitialGenerationDurable?: boolean
+    fullCheckpoint?: boolean
+  }
 ): Promise<void> {
-  const requiredDurableGeneration = requireInitialGenerationDurable
-    ? owner[writeFlushBarrierOperationsContext].runtime.writeGeneration
-    : null
-  for (;;) {
-    if (signal?.aborted) {
-      throw new Error('Persistence flush aborted')
-    }
-    if (owner[writeFlushBarrierOperationsContext].runtime.writeTimer) {
-      clearTimeout(owner[writeFlushBarrierOperationsContext].runtime.writeTimer)
-      owner[writeFlushBarrierOperationsContext].runtime.writeTimer = null
-    }
-    owner[writeFlushBarrierOperationsContext].runtime.firstPendingSaveAt = null
-    const generation = owner[writeFlushBarrierOperationsContext].runtime.writeGeneration
-    try {
-      await enqueueWrite(owner[writeFlushBarrierOperationsContext].writes)
-    } catch (error) {
-      await (final
-        ? owner[writeFlushBarrierOperationsContext].runtime.activeViewPreference.flushAsync()
-        : owner[writeFlushBarrierOperationsContext].runtime.activeViewPreference.flushPendingAsync(
-            signal
-          ))
-      await writeGithubCacheSnapshotAsync(owner, final, signal)
-      throw error
-    }
-    await (final
-      ? owner[writeFlushBarrierOperationsContext].runtime.activeViewPreference.flushAsync()
-      : owner[writeFlushBarrierOperationsContext].runtime.activeViewPreference.flushPendingAsync(
+  const { runtime, writes } = owner[writeFlushBarrierOperationsContext]
+  return runProfileStateFlush(runtime, async () => {
+    const requiredDurableGeneration = requireInitialGenerationDurable
+      ? runtime.writeGeneration
+      : null
+    for (;;) {
+      if (signal?.aborted) {
+        throw new Error('Persistence flush aborted')
+      }
+      if (runtime.writeTimer) {
+        clearTimeout(runtime.writeTimer)
+        runtime.writeTimer = null
+      }
+      runtime.firstPendingSaveAt = null
+      const generation = runtime.writeGeneration
+      try {
+        await enqueueWrite(writes, {
+          fullCheckpoint,
           signal
-        ))
-    await writeGithubCacheSnapshotAsync(owner, final, signal)
-    if (signal?.aborted) {
-      throw new Error('Persistence flush aborted')
-    }
-    if (!drainToStableGeneration) {
-      if (
-        requiredDurableGeneration === null ||
-        owner[writeFlushBarrierOperationsContext].runtime.lastDurableWriteGeneration >=
-          requiredDurableGeneration
-      ) {
+        })
+      } finally {
+        await (final
+          ? runtime.activeViewPreference.flushAsync()
+          : runtime.activeViewPreference.flushPendingAsync(signal))
+        await writeGithubCacheSnapshotAsync(owner, final, signal)
+        if (final || runtime.profileMaintenancePending) {
+          await runtime.profileStateAuthority?.drainBackups?.(true)
+        }
+      }
+      if (signal?.aborted) {
+        throw new Error('Persistence flush aborted')
+      }
+      if (!drainToStableGeneration) {
+        if (
+          requiredDurableGeneration === null ||
+          runtime.lastDurableWriteGeneration >= requiredDurableGeneration
+        ) {
+          break
+        }
+        continue
+      }
+      if (generation === runtime.writeGeneration) {
         break
       }
-      continue
     }
-    if (generation === owner[writeFlushBarrierOperationsContext].runtime.writeGeneration) {
-      break
-    }
-  }
+  })
 }
 
 export async function writeGithubCacheSnapshotAsync(
@@ -177,39 +232,28 @@ export async function writeGithubCacheSnapshotAsync(
   drainToStableGeneration = true,
   signal?: AbortSignal
 ): Promise<void> {
-  if (!owner[writeFlushBarrierOperationsContext].runtime.githubCacheDirty) {
+  const { runtime } = owner[writeFlushBarrierOperationsContext]
+  if (!runtime.githubCacheDirty) {
     return
   }
-  const previousWrite =
-    owner[writeFlushBarrierOperationsContext].runtime.pendingGithubCacheWrite ??
-    owner[writeFlushBarrierOperationsContext].runtime.staleGithubCacheTempCleanup
+  const previousWrite = runtime.pendingGithubCacheWrite ?? runtime.staleGithubCacheTempCleanup
   const nextWrite = previousWrite
     .then(async () => {
-      while (owner[writeFlushBarrierOperationsContext].runtime.githubCacheDirty) {
+      while (runtime.githubCacheDirty) {
         if (signal?.aborted) {
           throw new Error('GitHub cache flush aborted')
         }
-        const generation = owner[writeFlushBarrierOperationsContext].runtime.githubCacheGeneration
-        const cacheFile = getGithubCacheFile(
-          owner[writeFlushBarrierOperationsContext].runtime.dataFile
-        )
+        const generation = runtime.githubCacheGeneration
+        const cacheFile = getGithubCacheFile(runtime.dataFile)
         const tmpFile = durableWriteTempPath(cacheFile)
         let renamed = false
         try {
-          await writeFile(
-            tmpFile,
-            JSON.stringify(owner[writeFlushBarrierOperationsContext].runtime.state.githubCache),
-            'utf-8'
-          )
-          if (
-            generation === owner[writeFlushBarrierOperationsContext].runtime.githubCacheGeneration
-          ) {
+          await writeFile(tmpFile, JSON.stringify(runtime.state.githubCache), 'utf-8')
+          if (generation === runtime.githubCacheGeneration) {
             await rename(tmpFile, cacheFile)
             renamed = true
-            if (
-              generation === owner[writeFlushBarrierOperationsContext].runtime.githubCacheGeneration
-            ) {
-              owner[writeFlushBarrierOperationsContext].runtime.githubCacheDirty = false
+            if (generation === runtime.githubCacheGeneration) {
+              runtime.githubCacheDirty = false
             }
           }
         } finally {
@@ -229,41 +273,36 @@ export async function writeGithubCacheSnapshotAsync(
       console.warn('[persistence] Failed to write github cache snapshot:', err)
     })
     .finally(() => {
-      if (owner[writeFlushBarrierOperationsContext].runtime.pendingGithubCacheWrite === nextWrite) {
-        owner[writeFlushBarrierOperationsContext].runtime.pendingGithubCacheWrite = null
+      if (runtime.pendingGithubCacheWrite === nextWrite) {
+        runtime.pendingGithubCacheWrite = null
       }
     })
-  owner[writeFlushBarrierOperationsContext].runtime.pendingGithubCacheWrite = nextWrite
+  runtime.pendingGithubCacheWrite = nextWrite
   await nextWrite
 }
 
 export function writeGithubCacheSnapshotSync(owner: WriteFlushBarrierOperations): void {
-  if (!owner[writeFlushBarrierOperationsContext].runtime.githubCacheDirty) {
+  const { runtime } = owner[writeFlushBarrierOperationsContext]
+  if (!runtime.githubCacheDirty) {
     return
   }
-  if (owner[writeFlushBarrierOperationsContext].runtime.pendingGithubCacheWrite) {
+  if (runtime.pendingGithubCacheWrite) {
     void writeGithubCacheSnapshotAsync(owner)
     return
   }
-  const cacheFile = getGithubCacheFile(owner[writeFlushBarrierOperationsContext].runtime.dataFile)
-  const generation = owner[writeFlushBarrierOperationsContext].runtime.githubCacheGeneration
+  const cacheFile = getGithubCacheFile(runtime.dataFile)
+  const generation = runtime.githubCacheGeneration
   const tmpFile = durableWriteTempPath(cacheFile)
   try {
-    writeFileSync(
-      tmpFile,
-      JSON.stringify(owner[writeFlushBarrierOperationsContext].runtime.state.githubCache),
-      'utf-8'
-    )
+    writeFileSync(tmpFile, JSON.stringify(runtime.state.githubCache), 'utf-8')
     renameSync(tmpFile, cacheFile)
-    if (generation === owner[writeFlushBarrierOperationsContext].runtime.githubCacheGeneration) {
-      owner[writeFlushBarrierOperationsContext].runtime.githubCacheDirty = false
+    if (generation === runtime.githubCacheGeneration) {
+      runtime.githubCacheDirty = false
     }
   } catch (err) {
     try {
       unlinkSync(tmpFile)
-    } catch {
-      // Best-effort cleanup.
-    }
+    } catch {}
     console.warn('[persistence] Failed to write github cache snapshot:', err)
   }
 }
diff --git a/src/main/persistence/loading-store/write-scheduling.ts b/src/main/persistence/loading-store/write-scheduling.ts
index 0301da34a7e..30019c5c456 100644
--- a/src/main/persistence/loading-store/write-scheduling.ts
+++ b/src/main/persistence/loading-store/write-scheduling.ts
@@ -9,11 +9,14 @@ type WriteSchedulingOperationsRuntime = Pick<
   StoreRuntimeState,
   | 'activeViewPreference'
   | 'automationListProjectionCache'
+  | 'dirtyProfileStateDomains'
   | 'firstPendingSaveAt'
   | 'pendingWrite'
+  | 'profileMaintenancePending'
   | 'quitFlushStarted'
   | 'writeGeneration'
   | 'writeTimer'
+  | 'writesFrozen'
 >
 
 const writeSchedulingOperationsContext = Symbol('WriteSchedulingOperations')
@@ -30,36 +33,44 @@ export class WriteSchedulingOperations {
   }
 
   async waitForPendingWrite(): Promise<void> {
-    await Promise.all([
-      this[writeSchedulingOperationsContext].runtime.pendingWrite,
-      this[writeSchedulingOperationsContext].runtime.activeViewPreference.waitForPendingWrite()
-    ])
+    const { runtime } = this[writeSchedulingOperationsContext]
+    await Promise.all([runtime.pendingWrite, runtime.activeViewPreference.waitForPendingWrite()])
   }
 }
 
-export function scheduleSave(owner: WriteSchedulingOperations): void {
-  owner[writeSchedulingOperationsContext].runtime.automationListProjectionCache = null
-  // Why: once the quit flush has snapshotted, a newly debounced write would fire during
-  // teardown with nothing awaiting it, and the process can exit mid-rename. The quit
-  // flush is the last write by construction.
-  if (owner[writeSchedulingOperationsContext].runtime.quitFlushStarted) {
+export function scheduleSave(
+  owner: WriteSchedulingOperations,
+  dirtyDomains?: readonly string[]
+): void {
+  const { runtime, writes } = owner[writeSchedulingOperationsContext]
+  runtime.automationListProjectionCache = null
+  const trackedDomains = runtime.dirtyProfileStateDomains
+  if (dirtyDomains === undefined) {
+    runtime.dirtyProfileStateDomains = null
+  } else if (trackedDomains !== null) {
+    for (const domain of dirtyDomains) {
+      trackedDomains.add(domain)
+    }
+  }
+  // A timer admitted after the final snapshot could outlive the awaited shutdown work.
+  if (runtime.quitFlushStarted || runtime.profileMaintenancePending) {
     return
   }
-  owner[writeSchedulingOperationsContext].runtime.writeGeneration += 1
-  const now = Date.now()
-  owner[writeSchedulingOperationsContext].runtime.firstPendingSaveAt ??= now
-  if (owner[writeSchedulingOperationsContext].runtime.writeTimer) {
-    clearTimeout(owner[writeSchedulingOperationsContext].runtime.writeTimer)
+  runtime.writeGeneration += 1
+  if (runtime.writesFrozen) {
+    return
   }
-  const untilMaxWait = Math.max(
-    0,
-    owner[writeSchedulingOperationsContext].runtime.firstPendingSaveAt + SAVE_MAX_WAIT_MS - now
-  )
+  const now = Date.now()
+  runtime.firstPendingSaveAt ??= now
+  if (runtime.writeTimer) {
+    clearTimeout(runtime.writeTimer)
+  }
+  const untilMaxWait = Math.max(0, runtime.firstPendingSaveAt + SAVE_MAX_WAIT_MS - now)
   const delay = Math.min(SAVE_DEBOUNCE_MS, untilMaxWait)
-  owner[writeSchedulingOperationsContext].runtime.writeTimer = setTimeout(() => {
-    owner[writeSchedulingOperationsContext].runtime.writeTimer = null
-    owner[writeSchedulingOperationsContext].runtime.firstPendingSaveAt = null
-    void enqueueWrite(owner[writeSchedulingOperationsContext].writes)
+  runtime.writeTimer = setTimeout(() => {
+    runtime.writeTimer = null
+    runtime.firstPendingSaveAt = null
+    void enqueueWrite(writes, { skipIfClean: true }).catch(() => {})
   }, delay)
 }
 
diff --git a/src/main/persistence/profile-state-cutover-fixture.test.ts b/src/main/persistence/profile-state-cutover-fixture.test.ts
new file mode 100644
index 00000000000..311c15ae450
--- /dev/null
+++ b/src/main/persistence/profile-state-cutover-fixture.test.ts
@@ -0,0 +1,172 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { existsSync, mkdtempSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
+import {
+  buildProfileStateCutoverFixture,
+  canonicalProfileStateJson
+} from './profile-state-cutover-fixture'
+import {
+  exportProfileStateJson,
+  importProfileStateJson
+} from './profile-state/profile-state-documents'
+import {
+  openProfileStateDatabase,
+  profileStateDatabaseFile
+} from './profile-state/profile-state-database'
+import { Store } from './loading-store/store'
+import {
+  closeTestStores,
+  createStore,
+  dataFile,
+  testState,
+  writeDataFile
+} from '../persistence-test-harness'
+
+const { trackMock, getCohortAtEmitMock } = vi.hoisted(() => ({
+  trackMock: vi.fn(),
+  getCohortAtEmitMock: vi.fn(() => ({ nth_repo_added: 2 }))
+}))
+
+vi.mock('electron', () => ({
+  app: { getPath: () => testState.dir },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (plaintext: string) => Buffer.from(`encrypted:${plaintext}`, 'utf-8'),
+    decryptString: (ciphertext: Buffer) => ciphertext.toString('utf-8').slice('encrypted:'.length)
+  }
+}))
+
+vi.mock('../telemetry/client', () => ({ track: trackMock }))
+vi.mock('../telemetry/cohort-classifier', () => ({ getCohortAtEmit: getCohortAtEmitMock }))
+vi.mock('../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: vi.fn(() => ({ hosts: [] })),
+  sshConfigHostsToTargets: vi.fn(() => [])
+}))
+
+describe('profile-state cutover fixture', () => {
+  beforeEach(() => {
+    testState.dir = mkdtempSync(join(tmpdir(), 'orca-profile-cutover-fixture-'))
+  })
+
+  afterEach(async () => {
+    await closeTestStores()
+    removeTreeSync(testState.dir)
+  })
+
+  it('keeps object insertion order out of semantic comparisons while preserving array order', () => {
+    expect(canonicalProfileStateJson({ b: 2, a: { d: 4, c: 3 }, rows: ['first', 'second'] })).toBe(
+      canonicalProfileStateJson({ rows: ['first', 'second'], a: { c: 3, d: 4 }, b: 2 })
+    )
+    expect(canonicalProfileStateJson({ rows: ['first', 'second'] })).not.toBe(
+      canonicalProfileStateJson({ rows: ['second', 'first'] })
+    )
+    expect(canonicalProfileStateJson({ missing: undefined, nullable: null })).toBe(
+      canonicalProfileStateJson({ nullable: null })
+    )
+  })
+
+  it('loads the cross-domain fixture through the legacy Store contract', () => {
+    const fixture = buildProfileStateCutoverFixture(testState.dir)
+    writeDataFile(fixture)
+
+    const store = createStore()
+    store.flushOrThrow()
+    store.freezeWrites()
+
+    expect(store.getRepos().map((repo) => repo.id)).toEqual(['repo-local', 'repo-remote'])
+    expect(store.getProjects().map((project) => project.id)).toEqual([
+      'repo:repo-local',
+      'repo:repo-remote'
+    ])
+    expect(store.getProjectHostSetups().map((setup) => setup.id)).toEqual([
+      'repo-local',
+      'repo-remote'
+    ])
+    expect(store.getWorktreeMeta('repo-local::/fixture/local')).toMatchObject({
+      instanceId: 'instance-local',
+      linkedPR: 42,
+      comment: 'Preserve this comment'
+    })
+    expect(store.getWorkspaceSession().activeTabId).toBe('tab-local')
+    expect(store.getWorkspaceSession('ssh:build-host').activeTabId).toBe('tab-remote')
+    expect(store.listAutomations().map((automation) => automation.id)).toEqual([
+      'automation-fixture'
+    ])
+    expect(store.listAutomationRuns('automation-fixture').map((run) => run.id)).toEqual([
+      'automation-run-fixture'
+    ])
+    expect(store.getSettings().opencodeSessionCookie).toBe('fixture-secret')
+
+    const persisted: unknown = JSON.parse(readFileSync(dataFile(), 'utf-8'))
+    expect(persisted).toHaveProperty('futureTopLevelExtension', {
+      keep: 'forward-compatible',
+      nullable: null
+    })
+    expect(persisted).toHaveProperty(
+      'settings.opencodeSessionCookie',
+      fixture.settings.opencodeSessionCookie
+    )
+
+    const reloaded = createStore()
+    reloaded.freezeWrites()
+    expect(reloaded.getWorkspaceSession().activeTabId).toBe('tab-local')
+    expect(reloaded.getWorkspaceSession('ssh:build-host').activeTabId).toBe('tab-remote')
+    expect(reloaded.listAutomationRuns('automation-fixture')[0]?.outputSnapshot?.content).toBe(
+      'fixture output'
+    )
+    expect(reloaded.getSettings().opencodeSessionCookie).toBe('fixture-secret')
+  })
+
+  it('imports and exports through the real Store normalization and secret boundaries', () => {
+    const fixture = buildProfileStateCutoverFixture(testState.dir)
+    writeDataFile(fixture)
+
+    const source = createStore()
+    source.flushOrThrow()
+    const prepared = source.prepareProfileStateExport()
+    const databaseDirectory = mkdtempSync(join(testState.dir, 'profile-state-db-'))
+    const opened = openProfileStateDatabase(
+      profileStateDatabaseFile(databaseDirectory),
+      'profile-cutover'
+    )
+    try {
+      importProfileStateJson(opened.db, prepared.json, { now: () => 456 })
+      const exported = exportProfileStateJson(opened.db)
+      prepared.commit()
+
+      const candidateDirectory = mkdtempSync(join(testState.dir, 'candidate-'))
+      const candidate = new Store({
+        dataFile: join(candidateDirectory, 'orca-data.json'),
+        serializedState: exported
+      })
+
+      expect(candidate.getSettings().opencodeSessionCookie).toBe('fixture-secret')
+      expect(candidate.getWorkspaceSession().activeTabId).toBe('tab-local')
+      expect(candidate.getWorkspaceSession('ssh:build-host').activeTabId).toBe('tab-remote')
+      expect(candidate.listAutomationRuns('automation-fixture')[0]?.outputSnapshot?.content).toBe(
+        'fixture output'
+      )
+      expect(candidate.getWorktreeMeta('repo-local::/fixture/local')).toMatchObject({
+        linkedPR: 42,
+        comment: 'Preserve this comment'
+      })
+
+      const persisted: unknown = JSON.parse(candidate.prepareProfileStateExport().json)
+      expect(persisted).toHaveProperty('futureTopLevelExtension', fixture.futureTopLevelExtension)
+      expect(persisted).toHaveProperty('settings.opencodeSessionCookie')
+      expect(existsSync(join(candidateDirectory, 'orca-data.json'))).toBe(false)
+    } finally {
+      opened.db.close()
+    }
+  })
+
+  it('fails closed for an invalid serialized import instead of reading a fallback file', () => {
+    writeDataFile(buildProfileStateCutoverFixture(testState.dir))
+
+    expect(() => new Store({ dataFile: dataFile(), serializedState: '{not valid json' })).toThrow(
+      'Failed to load imported profile state'
+    )
+  })
+})
diff --git a/src/main/persistence/profile-state-cutover-fixture.ts b/src/main/persistence/profile-state-cutover-fixture.ts
new file mode 100644
index 00000000000..9d3bdf7ea39
--- /dev/null
+++ b/src/main/persistence/profile-state-cutover-fixture.ts
@@ -0,0 +1,291 @@
+import { getDefaultPersistedState, getDefaultWorkspaceSession } from '../../shared/constants'
+import type { Automation, AutomationRun } from '../../shared/automations-types'
+import type { PersistedState } from '../../shared/persisted-state-types'
+import type { Project, ProjectHostSetup } from '../../shared/project-types'
+import type { Repo } from '../../shared/repo-types'
+import type { TerminalTab, TerminalLayoutSnapshot } from '../../shared/terminal-tab-types'
+import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
+import type { WorktreeMeta } from '../../shared/worktree/meta-types'
+
+const LOCAL_WORKTREE_ID = 'repo-local::/fixture/local'
+const REMOTE_WORKTREE_ID = 'repo-remote::/fixture/remote'
+const LOCAL_TAB_ID = 'tab-local'
+const REMOTE_TAB_ID = 'tab-remote'
+const LOCAL_LEAF_ID = 'leaf-local'
+const REMOTE_LEAF_ID = 'leaf-remote'
+const REMOTE_HOST_ID = 'ssh:build-host'
+
+export type ProfileStateCutoverFixture = PersistedState & {
+  futureTopLevelExtension: {
+    keep: string
+    nullable: null
+  }
+}
+
+function fixtureRepo(overrides: Partial<Repo>): Repo {
+  return {
+    id: 'repo-local',
+    path: '/fixture/local',
+    displayName: 'Fixture local',
+    badgeColor: '#737373',
+    addedAt: 1,
+    ...overrides
+  }
+}
+
+function fixtureProject(overrides: Partial<Project>): Project {
+  return {
+    id: 'project-fixture',
+    displayName: 'Fixture project',
+    badgeColor: '#737373',
+    sourceRepoIds: ['repo-local', 'repo-remote'],
+    createdAt: 1,
+    updatedAt: 2,
+    ...overrides
+  }
+}
+
+function fixtureSetup(overrides: Partial<ProjectHostSetup>): ProjectHostSetup {
+  return {
+    id: 'setup-local',
+    projectId: 'project-fixture',
+    hostId: 'local',
+    repoId: 'repo-local',
+    path: '/fixture/local',
+    displayName: 'Fixture local',
+    setupState: 'ready',
+    setupMethod: 'imported-existing-folder',
+    createdAt: 1,
+    updatedAt: 2,
+    ...overrides
+  }
+}
+
+function fixtureTab(overrides: Partial<TerminalTab>): TerminalTab {
+  return {
+    id: LOCAL_TAB_ID,
+    ptyId: 'pty-local',
+    worktreeId: LOCAL_WORKTREE_ID,
+    title: 'Fixture terminal',
+    customTitle: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 1,
+    ...overrides
+  }
+}
+
+function fixtureLayout(leafId: string, ptyId: string): TerminalLayoutSnapshot {
+  return {
+    root: { type: 'leaf', leafId },
+    activeLeafId: leafId,
+    expandedLeafId: null,
+    ptyIdsByLeafId: { [leafId]: ptyId },
+    titlesByLeafId: { [leafId]: 'Fixture pane' }
+  }
+}
+
+function fixtureSession(args: {
+  repoId: string
+  worktreeId: string
+  tab: TerminalTab
+  layout: TerminalLayoutSnapshot
+}): WorkspaceSessionState {
+  return {
+    ...getDefaultWorkspaceSession(),
+    activeRepoId: args.repoId,
+    activeWorktreeId: args.worktreeId,
+    activeTabId: args.tab.id,
+    tabsByWorktree: { [args.worktreeId]: [args.tab] },
+    terminalLayoutsByTabId: { [args.tab.id]: args.layout },
+    activeTabIdByWorktree: { [args.worktreeId]: args.tab.id },
+    activeWorktreeIdsOnShutdown: [args.worktreeId],
+    browserUrlHistory: [
+      {
+        url: 'https://fixture.test/é😀',
+        normalizedUrl: 'https://fixture.test/é😀',
+        title: 'Fixture',
+        lastVisitedAt: 3,
+        visitCount: 2
+      }
+    ]
+  }
+}
+
+function fixtureAutomation(): Automation {
+  return {
+    id: 'automation-fixture',
+    name: 'Fixture automation',
+    prompt: 'Keep the fixture valid',
+    precheck: null,
+    agentId: 'claude',
+    projectId: 'project-fixture',
+    executionTargetType: 'local',
+    executionTargetId: 'local',
+    schedulerOwner: 'local_host_service',
+    workspaceMode: 'existing',
+    workspaceId: LOCAL_WORKTREE_ID,
+    baseBranch: null,
+    reuseSession: false,
+    timezone: 'UTC',
+    rrule: 'FREQ=DAILY',
+    dtstart: 10,
+    enabled: true,
+    nextRunAt: 20,
+    missedRunPolicy: 'run_once_within_grace',
+    missedRunGraceMinutes: 5,
+    createdAt: 1,
+    updatedAt: 2
+  }
+}
+
+function fixtureAutomationRun(): AutomationRun {
+  return {
+    id: 'automation-run-fixture',
+    automationId: 'automation-fixture',
+    title: 'Fixture run',
+    scheduledFor: 20,
+    status: 'completed',
+    trigger: 'manual',
+    workspaceId: LOCAL_WORKTREE_ID,
+    workspaceDisplayName: 'Fixture local',
+    sessionKind: 'terminal',
+    chatSessionId: null,
+    terminalSessionId: 'terminal-fixture',
+    terminalPaneKey: 'pane-fixture',
+    terminalPtyId: 'pty-local',
+    outputSnapshot: {
+      format: 'plain_text',
+      content: 'fixture output',
+      capturedAt: 21,
+      truncated: false
+    },
+    precheckResult: null,
+    usage: null,
+    error: null,
+    startedAt: 20,
+    dispatchedAt: 20,
+    createdAt: 20,
+    runNumber: 1
+  }
+}
+
+function fixtureWorktreeMeta(): WorktreeMeta {
+  const now = Date.now()
+  return {
+    instanceId: 'instance-local',
+    projectId: 'project-fixture',
+    hostId: 'local',
+    projectHostSetupId: 'setup-local',
+    displayName: 'Fixture local',
+    comment: 'Preserve this comment',
+    linkedIssue: null,
+    linkedPR: 42,
+    linkedLinearIssue: null,
+    isArchived: false,
+    isUnread: true,
+    isPinned: true,
+    sortOrder: 1,
+    lastActivityAt: now,
+    createdAt: now
+  }
+}
+
+export function buildProfileStateCutoverFixture(
+  homedir = '/fixture/home'
+): ProfileStateCutoverFixture {
+  const localTab = fixtureTab({})
+  const remoteTab = fixtureTab({
+    id: REMOTE_TAB_ID,
+    ptyId: 'pty-remote',
+    worktreeId: REMOTE_WORKTREE_ID
+  })
+  const localSession = fixtureSession({
+    repoId: 'repo-local',
+    worktreeId: LOCAL_WORKTREE_ID,
+    tab: localTab,
+    layout: fixtureLayout(LOCAL_LEAF_ID, 'pty-local')
+  })
+  const remoteSession = fixtureSession({
+    repoId: 'repo-remote',
+    worktreeId: REMOTE_WORKTREE_ID,
+    tab: remoteTab,
+    layout: fixtureLayout(REMOTE_LEAF_ID, 'pty-remote')
+  })
+  const state = getDefaultPersistedState(homedir)
+  state.repos = [
+    fixtureRepo({}),
+    fixtureRepo({
+      id: 'repo-remote',
+      path: '/fixture/remote',
+      displayName: 'Fixture remote',
+      connectionId: 'build-host',
+      executionHostId: REMOTE_HOST_ID
+    })
+  ]
+  state.projects = [fixtureProject({})]
+  state.projectHostSetups = [
+    fixtureSetup({}),
+    fixtureSetup({
+      id: 'setup-remote',
+      hostId: REMOTE_HOST_ID,
+      repoId: 'repo-remote',
+      path: '/fixture/remote',
+      displayName: 'Fixture remote',
+      connectionId: 'build-host',
+      executionHostId: REMOTE_HOST_ID
+    })
+  ]
+  state.worktreeMeta = {
+    [LOCAL_WORKTREE_ID]: fixtureWorktreeMeta(),
+    [REMOTE_WORKTREE_ID]: {
+      ...fixtureWorktreeMeta(),
+      instanceId: 'instance-remote',
+      hostId: REMOTE_HOST_ID,
+      projectHostSetupId: 'setup-remote',
+      displayName: 'Fixture remote'
+    }
+  }
+  state.workspaceSession = localSession
+  state.workspaceSessionsByHostId = { [REMOTE_HOST_ID]: remoteSession }
+  state.sshTargets = [
+    {
+      id: 'build-host',
+      label: 'Build host',
+      host: 'build.example.test',
+      port: 22,
+      username: 'builder',
+      source: 'manual',
+      generation: 3
+    }
+  ]
+  state.automations = [fixtureAutomation()]
+  state.automationRuns = [fixtureAutomationRun()]
+  state.settings = {
+    ...state.settings,
+    opencodeSessionCookie: Buffer.from('vitest-sealed:fixture-secret', 'utf-8').toString('base64')
+  }
+  state.ui = { ...state.ui, activeView: 'tasks', browserKagiSessionLink: null }
+  return Object.assign(state, {
+    futureTopLevelExtension: { keep: 'forward-compatible', nullable: null }
+  })
+}
+
+function sortForStableJson(value: unknown): unknown {
+  if (Array.isArray(value)) {
+    return value.map(sortForStableJson)
+  }
+  if (!value || typeof value !== 'object') {
+    return value
+  }
+  return Object.fromEntries(
+    Object.entries(value)
+      .sort(([left], [right]) => left.localeCompare(right))
+      .map(([key, child]) => [key, sortForStableJson(child)])
+  )
+}
+
+/** Compares state semantics while ignoring object insertion order and preserving array order. */
+export function canonicalProfileStateJson(state: unknown): string {
+  return JSON.stringify(sortForStableJson(state))
+}
diff --git a/src/main/persistence/profile-state-cutover-soak.test.ts b/src/main/persistence/profile-state-cutover-soak.test.ts
new file mode 100644
index 00000000000..2a46f6aedbf
--- /dev/null
+++ b/src/main/persistence/profile-state-cutover-soak.test.ts
@@ -0,0 +1,352 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  buildProfileStateCutoverFixture,
+  canonicalProfileStateJson
+} from './profile-state-cutover-fixture'
+import {
+  readAgentHookSettingsFromProfileState,
+  updateAgentHookSettingsInProfileState,
+  type ProfileStateOfflineLocation
+} from './profile-state/profile-state-offline-settings'
+import {
+  createProfileStateStore,
+  type ProfileStateStoreFactoryOptions,
+  type ProfileStateStoreFactoryResult
+} from './profile-state/profile-state-store-factory'
+import { profileStateDatabaseFile } from './profile-state/profile-state-database'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (value: string) => Buffer.from(`encrypted:${value}`, 'utf8'),
+    decryptString: (value: Buffer) => value.toString('utf8').slice('encrypted:'.length)
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+
+vi.mock('../../telemetry/client', () => ({ track: () => {} }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const { Store } = await import('./loading-store/store')
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+
+type MigratedProfile = {
+  options: ProfileStateStoreFactoryOptions
+  location: ProfileStateOfflineLocation
+  first: ProfileStateStoreFactoryResult
+}
+
+function createProfile(profileId: string, theme: string): MigratedProfile {
+  const directory = mkdtempSync(join(tmpdir(), `orca-profile-state-cutover-${profileId}-`))
+  temporaryDirectories.push(directory)
+  const dataFile = join(directory, 'orca-data.json')
+  const databaseFile = profileStateDatabaseFile(directory)
+  const fixture = buildProfileStateCutoverFixture(directory)
+  writeFileSync(
+    dataFile,
+    JSON.stringify({
+      ...fixture,
+      settings: { ...fixture.settings, theme },
+      // Keep enough unrelated data to make repeated complete-document commits meaningful.
+      soakExtension: { bytes: 'x'.repeat(96 * 1024), nullable: null }
+    })
+  )
+  const options: ProfileStateStoreFactoryOptions = {
+    dataFile,
+    databaseFile,
+    profileId
+  }
+  const first = createProfileStateStore(options)
+  expect(first.backend).toBe('sqlite')
+  expect(first.migrated).toBe(true)
+  return {
+    options,
+    location: { dataFile, databaseFile, profileId },
+    first
+  }
+}
+
+function removeLegacyJson(profile: MigratedProfile): void {
+  profile.first.store.freezeWrites()
+  rmSync(profile.options.dataFile, { force: true })
+  expect(existsSync(profile.options.dataFile)).toBe(false)
+  expect(existsSync(profile.options.databaseFile)).toBe(true)
+}
+
+function reopen(profile: MigratedProfile): ProfileStateStoreFactoryResult {
+  return createProfileStateStore(profile.options)
+}
+
+function exportJson(store: ProfileStateStoreFactoryResult['store']): unknown {
+  return JSON.parse(store.prepareProfileStateExport().json)
+}
+
+describe('profile-state candidate cutover soak', () => {
+  it('keeps the retained JSON export usable for legacy rollback', () => {
+    const profile = createProfile('rollback-window', 'light')
+    const retainedJson = readFileSync(profile.options.dataFile)
+
+    profile.first.store.updateSettings({ theme: 'dark', terminalFontSize: 123 })
+    profile.first.store.flushOrThrow()
+    expect(readFileSync(profile.options.dataFile)).toEqual(retainedJson)
+
+    const legacyStore = new Store({
+      dataFile: profile.options.dataFile,
+      serializedState: retainedJson.toString('utf8')
+    })
+    expect(legacyStore.getSettings().theme).toBe('light')
+    expect(legacyStore.getSettings().terminalFontSize).not.toBe(123)
+    legacyStore.freezeWrites()
+    profile.first.store.freezeWrites()
+  })
+
+  it('migrates a complete profile, removes JSON, and survives restart/domain/offline churn', () => {
+    const profile = createProfile('soak-primary', 'light')
+    const initial = exportJson(profile.first.store)
+    const folderGroup = profile.first.store.createProjectGroup({
+      name: 'Fixture folders',
+      createdFrom: 'manual',
+      parentPath: '/fixture/folder',
+      connectionId: 'build-host'
+    })
+    const folderWorkspace = profile.first.store.createFolderWorkspace({
+      projectGroupId: folderGroup.id,
+      name: 'Remote folder fixture',
+      folderPath: '/fixture/folder',
+      connectionId: 'build-host'
+    })
+    const remoteAutomation = profile.first.store.createAutomation({
+      name: 'Remote fixture automation',
+      prompt: 'Keep the remote fixture valid',
+      agentId: 'claude',
+      projectId: 'repo-remote',
+      workspaceMode: 'existing',
+      workspaceId: 'repo-remote::/fixture/remote',
+      baseBranch: null,
+      reuseSession: false,
+      timezone: 'UTC',
+      rrule: 'FREQ=DAILY',
+      dtstart: 10,
+      enabled: true,
+      missedRunGraceMinutes: 5
+    })
+    profile.first.store.createAutomationRun(remoteAutomation, 30, 'manual')
+    profile.first.store.flushOrThrow()
+    removeLegacyJson(profile)
+
+    for (let round = 0; round < 8; round += 1) {
+      const reopened = reopen(profile)
+      const currentSession = reopened.store.getWorkspaceSession()
+      const currentAutomation = reopened.store.listAutomations()[0]
+      if (!currentAutomation) {
+        throw new Error('cutover fixture lost its automation')
+      }
+
+      reopened.store.updateSettings({
+        theme: round % 2 === 0 ? 'dark' : 'light',
+        terminalFontSize: reopened.store.getSettings().terminalFontSize + 1
+      })
+      reopened.store.updateUI({ activeView: round % 2 === 0 ? 'tasks' : 'terminal' })
+      reopened.store.patchWorkspaceSession({
+        browserUrlHistory: [
+          ...(currentSession.browserUrlHistory ?? []),
+          {
+            url: `https://fixture.test/soak/${round}`,
+            normalizedUrl: `https://fixture.test/soak/${round}`,
+            title: `Soak ${round}`,
+            lastVisitedAt: round + 10,
+            visitCount: 1
+          }
+        ]
+      })
+      reopened.store.setWorktreeMeta('repo-local::/fixture/local', {
+        comment: `soak-${round}`,
+        linkedPR: 100 + round
+      })
+      reopened.store.createAutomationRun(currentAutomation, 100 + round, 'manual')
+      reopened.store.flushOrThrow()
+      reopened.store.freezeWrites()
+
+      const restarted = reopen(profile)
+      expect(restarted.store.getWorkspaceSession().activeTabId).toBe('tab-local')
+      expect(restarted.store.getWorkspaceSession('ssh:build-host').activeTabId).toBe('tab-remote')
+      expect(restarted.store.getFolderWorkspace(folderWorkspace.id)).toMatchObject({
+        name: 'Remote folder fixture',
+        folderPath: '/fixture/folder',
+        connectionId: 'build-host'
+      })
+      expect(restarted.store.getWorktreeMeta('repo-local::/fixture/local')).toMatchObject({
+        comment: `soak-${round}`,
+        linkedPR: 100 + round
+      })
+      expect(restarted.store.listAutomationRuns('automation-fixture').length).toBeGreaterThan(
+        round + 1
+      )
+      const persistedRemoteAutomation = restarted.store
+        .listAutomations()
+        .find((automation) => automation.id === remoteAutomation.id)
+      expect(persistedRemoteAutomation).toMatchObject({
+        executionTargetType: 'ssh',
+        executionTargetId: 'build-host',
+        schedulerOwner: 'ssh_bridge',
+        workspaceId: 'repo-remote::/fixture/remote'
+      })
+      expect(
+        restarted.store
+          .listAutomationRuns(remoteAutomation.id)
+          .some((run) => run.trigger === 'manual')
+      ).toBe(true)
+      restarted.store.freezeWrites()
+    }
+
+    const beforeOffline = readAgentHookSettingsFromProfileState(profile.location)
+    const offlineUpdate = updateAgentHookSettingsInProfileState(profile.location, false)
+    expect(offlineUpdate.settingsPath).toBe(profile.options.databaseFile)
+    expect(readAgentHookSettingsFromProfileState(profile.location).agentStatusHooksEnabled).toBe(
+      false
+    )
+
+    const afterOffline = reopen(profile)
+    const persisted = exportJson(afterOffline.store)
+    expect(afterOffline.store.getSettings().agentStatusHooksEnabled).toBe(false)
+    expect(afterOffline.store.getSettings().opencodeSessionCookie).toBe('fixture-secret')
+    expect(afterOffline.store.getWorkspaceSession('ssh:build-host').activeTabId).toBe('tab-remote')
+    expect(afterOffline.store.getFolderWorkspace(folderWorkspace.id)).toMatchObject({
+      folderPath: '/fixture/folder',
+      connectionId: 'build-host'
+    })
+    expect(afterOffline.store.listAutomationRuns('automation-fixture').length).toBeGreaterThan(8)
+    expect(
+      afterOffline.store
+        .listAutomations()
+        .find((automation) => automation.id === remoteAutomation.id)
+    ).toMatchObject({
+      executionTargetType: 'ssh',
+      executionTargetId: 'build-host',
+      schedulerOwner: 'ssh_bridge'
+    })
+    expect(afterOffline.store.listAutomationRuns(remoteAutomation.id)).toHaveLength(1)
+    expect(persisted).toHaveProperty('soakExtension', {
+      bytes: 'x'.repeat(96 * 1024),
+      nullable: null
+    })
+    expect(beforeOffline.agentStatusHooksEnabled).toBe(true)
+    expect(existsSync(profile.options.dataFile)).toBe(false)
+    expect(canonicalProfileStateJson(persisted)).not.toBe(canonicalProfileStateJson(initial))
+    afterOffline.store.freezeWrites()
+  })
+
+  it('switches between independent SQLite profiles without crossing state', () => {
+    const first = createProfile('switch-first', 'dark')
+    const second = createProfile('switch-second', 'light')
+    removeLegacyJson(first)
+    removeLegacyJson(second)
+    const firstInitial = reopen(first)
+    const firstInitialFontSize = firstInitial.store.getSettings().terminalFontSize
+    firstInitial.store.freezeWrites()
+    const secondInitial = reopen(second)
+    const secondInitialFontSize = secondInitial.store.getSettings().terminalFontSize
+    secondInitial.store.freezeWrites()
+
+    for (let round = 0; round < 6; round += 1) {
+      const active = round % 2 === 0 ? first : second
+      const inactive = active === first ? second : first
+      const activeStore = reopen(active)
+      activeStore.store.updateSettings({
+        theme: active === first ? 'dark' : 'light',
+        terminalFontSize: (active === first ? 100 : 200) + round
+      })
+      activeStore.store.flushOrThrow()
+      activeStore.store.freezeWrites()
+
+      const inactiveStore = reopen(inactive)
+      expect(inactiveStore.store.getSettings().terminalFontSize).toBe(
+        round === 0
+          ? inactive === first
+            ? firstInitialFontSize
+            : secondInitialFontSize
+          : (inactive === first ? 100 : 200) + round - 1
+      )
+      expect(inactiveStore.store.getWorkspaceSession().activeTabId).toBe('tab-local')
+      inactiveStore.store.freezeWrites()
+    }
+
+    const firstFinal = reopen(first)
+    const secondFinal = reopen(second)
+    expect(firstFinal.store.getSettings().terminalFontSize).toBe(104)
+    expect(secondFinal.store.getSettings().terminalFontSize).toBe(205)
+    expect(firstFinal.store.getSettings().opencodeSessionCookie).toBe('fixture-secret')
+    expect(secondFinal.store.getSettings().opencodeSessionCookie).toBe('fixture-secret')
+    firstFinal.store.freezeWrites()
+    secondFinal.store.freezeWrites()
+  })
+
+  it('allows one stale complete-document writer and rejects the rest', () => {
+    const profile = createProfile('soak-cas', 'light')
+    removeLegacyJson(profile)
+    const staleWriters = Array.from({ length: 7 }, () => reopen(profile))
+
+    for (const [index, writer] of staleWriters.entries()) {
+      writer.store.updateSettings({
+        theme: index % 2 === 0 ? 'dark' : 'light',
+        terminalFontSize: 100 + index
+      })
+    }
+
+    let commits = 0
+    let conflicts = 0
+    for (const writer of staleWriters) {
+      try {
+        writer.store.flushOrThrow()
+        commits += 1
+      } catch (error) {
+        if (
+          error instanceof Error &&
+          'code' in error &&
+          error.code === 'profile-state-revision-conflict'
+        ) {
+          conflicts += 1
+        } else {
+          throw error
+        }
+      } finally {
+        writer.store.freezeWrites()
+      }
+    }
+
+    expect(commits).toBe(1)
+    expect(conflicts).toBe(staleWriters.length - 1)
+    const verifier = reopen(profile)
+    expect(verifier.store.getSettings().terminalFontSize).toBe(100)
+    expect(verifier.store.getSettings().opencodeSessionCookie).toBe('fixture-secret')
+    expect(verifier.store.getWorkspaceSession('ssh:build-host').activeTabId).toBe('tab-remote')
+    expect(readFileSync(profile.options.databaseFile)).toBeTruthy()
+    verifier.store.freezeWrites()
+  })
+})
diff --git a/src/main/persistence/profile-state/legacy-json/README.md b/src/main/persistence/profile-state/legacy-json/README.md
new file mode 100644
index 00000000000..3dfa5937815
--- /dev/null
+++ b/src/main/persistence/profile-state/legacy-json/README.md
@@ -0,0 +1,34 @@
+# Legacy profile JSON
+
+SQLite is the only ordinary writable profile backend. This folder retains the
+`orca-data.json` compatibility boundary; it does not provide a second live store.
+
+| Code                                                                   | Purpose                                                                                                                                                                                |
+| ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `profile-state-legacy-import.ts`                                       | Normalize an old profile through a frozen Store, trying the old backup ring if the primary JSON is unreadable. Publication and secret-retention commit stay with the SQLite bootstrap. |
+| `profile-state-legacy-backup-path.ts`                                  | Recognize the five old `.bak` files for import and missing-authority checks. No live JSON backup rotation remains.                                                                     |
+| `profile-state-authority-exports.ts`                                   | Export a consistent SQLite snapshot for explicit export, clean shutdown, or profile maintenance.                                                                                       |
+| `profile-state-json-acceptance.ts`                                     | Record which exact JSON bytes SQLite accepts, including both sides of an interrupted compatibility export.                                                                             |
+| `profile-state-versioned-export.ts` and `profile-state-export-path.ts` | Publish immutable recovery exports and retain the latest five.                                                                                                                         |
+| `profile-state-recovery.ts`                                            | Restore explicitly selected JSON after archiving the database and recovery evidence. The next capable startup imports it back into SQLite.                                             |
+
+Old profiles may upgrade directly; no intermediate release is required. A copy
+source can still be read as JSON, but every profile changed by a transfer or an
+offline settings command must first establish SQLite authority.
+
+Clean shutdown and maintenance refresh compatibility JSON for older builds. A
+crash or failed export can leave an older snapshot. If an older build edits that
+file, startup refuses to choose silently between it and SQLite. The explicit
+`orca profile state rollback --current-json` command selects those edits and
+archives both copies; it does not merge divergent histories.
+
+Keep import and recovery while old profiles or backups remain supported. Removing
+automatic compatibility exports is a separate compatibility decision requiring a
+policy for older builds and recovery when a database is missing. Deleting the
+ordinary JSON writer does not justify deleting these safeguards.
+
+SQLite admission, transactions, row serialization, backups, and recovery command
+dispatch stay in the parent folder. In particular, JSON payloads in SQLite are
+its document representation, not a legacy file backend. Profile-index metadata,
+move journals, caches, wire messages, and external-tool settings are also outside
+this boundary.
diff --git a/src/main/persistence/profile-state/legacy-json/profile-state-authority-exports.ts b/src/main/persistence/profile-state/legacy-json/profile-state-authority-exports.ts
new file mode 100644
index 00000000000..0dc6f0d6e90
--- /dev/null
+++ b/src/main/persistence/profile-state/legacy-json/profile-state-authority-exports.ts
@@ -0,0 +1,89 @@
+import { existsSync, mkdirSync, readFileSync } from 'node:fs'
+import { mkdir, readFile } from 'node:fs/promises'
+import { dirname } from 'node:path'
+import {
+  durableWriteTempPath,
+  writeFileDurable,
+  writeFileDurableSync
+} from '../../../durable-file-write'
+import {
+  readProfileStateSnapshot,
+  stageProfileStateJsonCompatibility,
+  acceptProfileStateJsonCompatibility
+} from '../profile-state-documents'
+import type Database from '../../../sqlite/sync-database'
+import { writeVersionedProfileStateExport } from './profile-state-versioned-export'
+import { ProfileStateRevisionConflictError } from '../profile-state-document-validation'
+
+function readExportSnapshot(db: Database.Database, expectedRevision?: number) {
+  const snapshot = readProfileStateSnapshot(db)
+  if (expectedRevision !== undefined && snapshot.revision !== expectedRevision) {
+    throw new ProfileStateRevisionConflictError(expectedRevision, snapshot.revision)
+  }
+  return snapshot
+}
+
+/** Publish a durable JSON rollback/compatibility export without changing authority. */
+export function writeProfileStateAuthorityJsonExport(
+  db: Database.Database,
+  targetPath: string,
+  expectedRevision?: number
+): number {
+  const snapshot = readExportSnapshot(db, expectedRevision)
+  mkdirSync(dirname(targetPath), { recursive: true })
+  writeFileDurableSync(durableWriteTempPath(targetPath), targetPath, snapshot.json)
+  return snapshot.revision
+}
+
+/** Stage both accepted versions before replacing canonical JSON for an older build. */
+export function writeProfileStateAuthorityCompatibilityExport(
+  db: Database.Database,
+  targetPath: string,
+  expectedRevision?: number
+): number | undefined {
+  const snapshot = readExportSnapshot(db, expectedRevision)
+  if (snapshot.revision === 0) {
+    return undefined
+  }
+  writeCompatibilityRecoveryExport(targetPath, snapshot)
+  const retained = existsSync(targetPath) ? readFileSync(targetPath, 'utf8') : undefined
+  mkdirSync(dirname(targetPath), { recursive: true })
+  stageProfileStateJsonCompatibility(db, snapshot.json, snapshot.revision, retained)
+  writeFileDurableSync(durableWriteTempPath(targetPath), targetPath, snapshot.json)
+  acceptProfileStateJsonCompatibility(db, snapshot.json, snapshot.revision)
+  return snapshot.revision
+}
+
+export async function writeProfileStateAuthorityCompatibilityExportAsync(
+  db: Database.Database,
+  targetPath: string,
+  expectedRevision?: number
+): Promise<number | undefined> {
+  const snapshot = readExportSnapshot(db, expectedRevision)
+  if (snapshot.revision === 0) {
+    return undefined
+  }
+  writeCompatibilityRecoveryExport(targetPath, snapshot)
+  const retained = await readFile(targetPath, 'utf8').catch((error: unknown) => {
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+      return undefined
+    }
+    throw error
+  })
+  await mkdir(dirname(targetPath), { recursive: true })
+  stageProfileStateJsonCompatibility(db, snapshot.json, snapshot.revision, retained)
+  await writeFileDurable(durableWriteTempPath(targetPath), targetPath, snapshot.json)
+  acceptProfileStateJsonCompatibility(db, snapshot.json, snapshot.revision)
+  return snapshot.revision
+}
+
+function writeCompatibilityRecoveryExport(
+  dataFile: string,
+  snapshot: { json: string; revision: number }
+): void {
+  writeVersionedProfileStateExport(dataFile, (path) => {
+    mkdirSync(dirname(path), { recursive: true })
+    writeFileDurableSync(durableWriteTempPath(path), path, snapshot.json)
+    return snapshot.revision
+  })
+}
diff --git a/src/main/persistence/profile-state/legacy-json/profile-state-export-path.ts b/src/main/persistence/profile-state/legacy-json/profile-state-export-path.ts
new file mode 100644
index 00000000000..34332e86fa0
--- /dev/null
+++ b/src/main/persistence/profile-state/legacy-json/profile-state-export-path.ts
@@ -0,0 +1,36 @@
+import { existsSync, readdirSync } from 'node:fs'
+import { basename, dirname, join } from 'node:path'
+
+/** Return the immutable JSON artifact created when a profile first enters SQLite authority. */
+export function profileStateJsonExportPath(dataFile: string, revision: number): string {
+  if (!Number.isSafeInteger(revision) || revision < 1) {
+    throw new Error('Profile state export revision must be a positive safe integer')
+  }
+  return `${dataFile}.sqlite-export.${revision}.json`
+}
+
+/** List retained rollback exports newest-first without opening SQLite. */
+export function profileStateJsonExportPaths(dataFile: string): readonly string[] {
+  const directory = dirname(dataFile)
+  const prefix = `${basename(dataFile)}.sqlite-export.`
+  if (!existsSync(directory)) {
+    return []
+  }
+  return readdirSync(directory)
+    .flatMap((name) => {
+      const match = new RegExp(`^${escapeRegExp(prefix)}(\\d+)\\.json$`).exec(name)
+      if (match === null) {
+        return []
+      }
+      const revision = Number(match[1])
+      return Number.isSafeInteger(revision) && revision > 0
+        ? [{ path: join(directory, name), revision }]
+        : []
+    })
+    .sort((left, right) => right.revision - left.revision)
+    .map(({ path }) => path)
+}
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
diff --git a/src/main/persistence/profile-state/legacy-json/profile-state-json-acceptance.ts b/src/main/persistence/profile-state/legacy-json/profile-state-json-acceptance.ts
new file mode 100644
index 00000000000..9c297485e0f
--- /dev/null
+++ b/src/main/persistence/profile-state/legacy-json/profile-state-json-acceptance.ts
@@ -0,0 +1,153 @@
+import { withProfileStateWriteTransaction } from '../profile-state-write-transaction'
+import type Database from '../../../sqlite/sync-database'
+import { PROFILE_STATE_META_LEGACY_JSON_ACCEPTANCE } from '../profile-state-database-schema'
+import {
+  hashProfileStatePayload,
+  isRecord,
+  parseProfileStateRoot,
+  ProfileStateDocumentCorruptionError,
+  ProfileStateRevisionConflictError
+} from '../profile-state-document-validation'
+import { readProfileStateRevision } from '../profile-state-revision'
+
+type ProfileStateJsonAcceptanceVersion = {
+  jsonHash: string
+  acceptedRevision: number
+}
+
+export type ProfileStateJsonAcceptance = ProfileStateJsonAcceptanceVersion & {
+  pending?: ProfileStateJsonAcceptanceVersion
+}
+
+/** Read the source acceptance marker, if this database has one. */
+export function readProfileStateJsonAcceptance(
+  db: Database.Database
+): ProfileStateJsonAcceptance | undefined {
+  const row = db
+    .prepare('SELECT value FROM profile_state_meta WHERE key = ?')
+    .get(PROFILE_STATE_META_LEGACY_JSON_ACCEPTANCE)
+  if (row === undefined) {
+    return undefined
+  }
+  if (!isRecord(row) || typeof row.value !== 'string') {
+    throw new ProfileStateDocumentCorruptionError('Legacy JSON acceptance marker is invalid')
+  }
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(row.value)
+  } catch {
+    throw new ProfileStateDocumentCorruptionError('Legacy JSON acceptance marker is invalid')
+  }
+  if (!isJsonAcceptanceVersion(parsed)) {
+    throw new ProfileStateDocumentCorruptionError('Legacy JSON acceptance marker is invalid')
+  }
+  let pending: ProfileStateJsonAcceptanceVersion | undefined
+  if ('pending' in parsed) {
+    if (
+      !isJsonAcceptanceVersion(parsed.pending) ||
+      parsed.pending.acceptedRevision < parsed.acceptedRevision
+    ) {
+      throw new ProfileStateDocumentCorruptionError('Legacy JSON acceptance marker is invalid')
+    }
+    pending = parsed.pending
+  }
+  return {
+    jsonHash: parsed.jsonHash,
+    acceptedRevision: parsed.acceptedRevision,
+    ...(pending === undefined ? {} : { pending })
+  }
+}
+
+function isJsonAcceptanceVersion(value: unknown): value is ProfileStateJsonAcceptanceVersion {
+  return (
+    isRecord(value) &&
+    typeof value.jsonHash === 'string' &&
+    /^[a-f0-9]{64}$/.test(value.jsonHash) &&
+    typeof value.acceptedRevision === 'number' &&
+    Number.isSafeInteger(value.acceptedRevision) &&
+    value.acceptedRevision >= 1
+  )
+}
+
+/** Accept either side of the upcoming JSON replacement before publishing it. */
+export function stageProfileStateJsonCompatibility(
+  db: Database.Database,
+  rawJson: string,
+  expectedRevision: number,
+  retainedJson?: string
+): void {
+  const retainedHash =
+    retainedJson === undefined ? undefined : hashProfileStatePayload(retainedJson)
+  updateProfileStateJsonAcceptance(db, rawJson, expectedRevision, (previous, next) => {
+    if (previous === undefined) {
+      return next
+    }
+    const retained =
+      retainedHash === undefined || retainedHash === previous.jsonHash
+        ? previous
+        : previous.pending?.jsonHash === retainedHash
+          ? previous.pending
+          : undefined
+    if (retained === undefined) {
+      throw new ProfileStateDocumentCorruptionError('Compatibility JSON changed before export')
+    }
+    return {
+      jsonHash: retained.jsonHash,
+      acceptedRevision: retained.acceptedRevision,
+      pending: next
+    }
+  })
+}
+
+/** Promote the staged JSON after publication; failures leave both versions accepted. */
+export function acceptProfileStateJsonCompatibility(
+  db: Database.Database,
+  rawJson: string,
+  expectedRevision: number
+): void {
+  updateProfileStateJsonAcceptance(db, rawJson, expectedRevision, (previous, next) => {
+    const staged = previous?.pending ?? previous
+    if (staged?.jsonHash !== next.jsonHash || staged.acceptedRevision !== next.acceptedRevision) {
+      throw new ProfileStateDocumentCorruptionError('Compatibility JSON export was not staged')
+    }
+    return next
+  })
+}
+
+function updateProfileStateJsonAcceptance(
+  db: Database.Database,
+  rawJson: string,
+  expectedRevision: number,
+  update: (
+    previous: ProfileStateJsonAcceptance | undefined,
+    next: ProfileStateJsonAcceptanceVersion
+  ) => ProfileStateJsonAcceptance
+): void {
+  parseProfileStateRoot(rawJson)
+  if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 1) {
+    throw new ProfileStateDocumentCorruptionError(
+      'Compatibility JSON acceptance revision is invalid'
+    )
+  }
+  return withProfileStateWriteTransaction(db, () => {
+    const actualRevision = readProfileStateRevision(db)
+    if (actualRevision !== expectedRevision) {
+      throw new ProfileStateRevisionConflictError(expectedRevision, actualRevision)
+    }
+    const previous = readProfileStateJsonAcceptance(db)
+    if (
+      previous &&
+      (previous.pending?.acceptedRevision ?? previous.acceptedRevision) > actualRevision
+    ) {
+      throw new ProfileStateDocumentCorruptionError('Legacy JSON acceptance marker is invalid')
+    }
+    const marker = update(previous, {
+      jsonHash: hashProfileStatePayload(rawJson),
+      acceptedRevision: expectedRevision
+    })
+    db.prepare(
+      `INSERT INTO profile_state_meta (key, value) VALUES (?, ?)
+       ON CONFLICT(key) DO UPDATE SET value = excluded.value`
+    ).run(PROFILE_STATE_META_LEGACY_JSON_ACCEPTANCE, JSON.stringify(marker))
+  })
+}
diff --git a/src/main/persistence/profile-state/legacy-json/profile-state-legacy-backup-path.ts b/src/main/persistence/profile-state/legacy-json/profile-state-legacy-backup-path.ts
new file mode 100644
index 00000000000..ba222b61fd7
--- /dev/null
+++ b/src/main/persistence/profile-state/legacy-json/profile-state-legacy-backup-path.ts
@@ -0,0 +1,16 @@
+import { existsSync } from 'node:fs'
+
+export const PROFILE_STATE_LEGACY_BACKUP_COUNT = 5
+
+export function profileStateLegacyBackupPath(dataFile: string, index: number): string {
+  return `${dataFile}.bak.${index}`
+}
+
+export function hasStateBackup(dataFile: string): boolean {
+  for (let index = 0; index < PROFILE_STATE_LEGACY_BACKUP_COUNT; index += 1) {
+    if (existsSync(profileStateLegacyBackupPath(dataFile, index))) {
+      return true
+    }
+  }
+  return false
+}
diff --git a/src/main/persistence/profile-state/legacy-json/profile-state-legacy-import.ts b/src/main/persistence/profile-state/legacy-json/profile-state-legacy-import.ts
new file mode 100644
index 00000000000..9eb5219ee6b
--- /dev/null
+++ b/src/main/persistence/profile-state/legacy-json/profile-state-legacy-import.ts
@@ -0,0 +1,42 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { Store } from '../../loading-store/store'
+import type { ProfileStateStartupPaneAlias } from '../../loading-store/profile-state-authority'
+import { ProfileStateAuthorityBootstrapError } from '../profile-state-recovery-required'
+import {
+  PROFILE_STATE_LEGACY_BACKUP_COUNT,
+  profileStateLegacyBackupPath
+} from './profile-state-legacy-backup-path'
+
+export function prepareLegacyProfileState(dataFile: string, rawJson: string) {
+  try {
+    return prepareLegacySnapshot(dataFile, rawJson)
+  } catch (error) {
+    // Import the first usable legacy backup without overwriting the damaged source.
+    for (let index = 0; index < PROFILE_STATE_LEGACY_BACKUP_COUNT; index += 1) {
+      const path = profileStateLegacyBackupPath(dataFile, index)
+      if (!existsSync(path)) {
+        continue
+      }
+      try {
+        const prepared = prepareLegacySnapshot(dataFile, readFileSync(path, 'utf8'))
+        console.warn(`[profile-state] Recovered legacy state from ${path}`)
+        return prepared
+      } catch {
+        // A corrupt backup must not prevent trying the remaining legacy ring.
+      }
+    }
+    throw new ProfileStateAuthorityBootstrapError(
+      `Failed to load imported profile state or its legacy backups: ${dataFile}. ${error instanceof Error ? error.message : String(error)}`
+    )
+  }
+}
+
+function prepareLegacySnapshot(dataFile: string, serializedState: string) {
+  const unboundPaneAliases: ProfileStateStartupPaneAlias[] = []
+  const store = new Store({
+    dataFile,
+    serializedState,
+    collectUnboundPaneAlias: (entry) => unboundPaneAliases.push(entry)
+  })
+  return { prepared: store.prepareProfileStateExport(), unboundPaneAliases }
+}
diff --git a/src/main/persistence/profile-state/legacy-json/profile-state-recovery.ts b/src/main/persistence/profile-state/legacy-json/profile-state-recovery.ts
new file mode 100644
index 00000000000..c5ee4454298
--- /dev/null
+++ b/src/main/persistence/profile-state/legacy-json/profile-state-recovery.ts
@@ -0,0 +1,88 @@
+import { profileStateDatabaseFiles } from '../profile-state-storage-classification'
+import { existsSync, mkdirSync, readFileSync, rmSync } from 'node:fs'
+import { dirname } from 'node:path'
+import { parseProfileStateRoot } from '../profile-state-document-validation'
+import { durableWriteTempPath, writeFileDurableSync } from '../../../durable-file-write'
+import { bestEffortFsyncDirectorySync } from '../../../../shared/secure-file'
+import {
+  quarantineProfileStateDatabase,
+  type ProfileStateDatabaseQuarantine
+} from '../profile-state-database-quarantine'
+import { profileStateJsonExportPaths } from './profile-state-export-path'
+import { profileStateDatabaseBackupFiles } from '../profile-state-backup-path'
+import {
+  assertProfileStateMaintenance,
+  type ProfileStateMaintenance
+} from '../profile-state-access'
+
+export type ProfileStateJsonRecoveryOptions = {
+  maintenance: ProfileStateMaintenance
+  databasePath: string
+  dataFile: string
+  exportPath: string
+  profileId: string
+  quarantineRoot?: string
+  reason?: string
+  beforeRestore?: () => void
+}
+
+export type ProfileStateJsonRecovery = {
+  quarantine: ProfileStateDatabaseQuarantine
+  removedDatabaseFiles: readonly string[]
+}
+
+/** Restore an explicitly selected JSON export after preserving a failed SQLite authority. */
+export function restoreProfileStateJsonExport(
+  options: ProfileStateJsonRecoveryOptions
+): ProfileStateJsonRecovery {
+  assertProfileStateMaintenance(options.maintenance, options)
+  const rawJson = readRecoveryExport(options.exportPath)
+  const retainedExports = profileStateJsonExportPaths(options.dataFile)
+  const retainedBackups = profileStateDatabaseBackupFiles(options.databasePath)
+  const recoveryFiles = [options.exportPath, ...retainedExports, ...retainedBackups]
+  if (existsSync(options.dataFile)) {
+    recoveryFiles.push(options.dataFile)
+  }
+  const quarantine = quarantineProfileStateDatabase(
+    options.databasePath,
+    options.profileId,
+    options.quarantineRoot,
+    options.reason ?? 'profile-state-json-rollback',
+    recoveryFiles
+  )
+
+  // Invalidate authority-dependent caches while the database and recovery exports still exist.
+  options.beforeRestore?.()
+  mkdirSync(dirname(options.dataFile), { recursive: true })
+  writeFileDurableSync(durableWriteTempPath(options.dataFile), options.dataFile, rawJson)
+
+  const removedDatabaseFiles = profileStateDatabaseFiles(options.databasePath).filter((path) =>
+    existsSync(path)
+  )
+  for (const path of removedDatabaseFiles) {
+    rmSync(path)
+  }
+  // Removing the reserved exports completes the authority transition back to JSON. Keeping one
+  // would make established startup correctly reject the restored legacy state as a stale mirror.
+  const retainedArtifacts = [...retainedBackups, ...retainedExports]
+  for (const path of retainedArtifacts) {
+    if (path !== options.exportPath) {
+      rmSync(path)
+    }
+  }
+  // Keep the selected revision retryable until no reserved artifact can block JSON startup.
+  if (retainedArtifacts.includes(options.exportPath)) {
+    rmSync(options.exportPath)
+  }
+  bestEffortFsyncDirectorySync(dirname(options.databasePath))
+  return { quarantine, removedDatabaseFiles }
+}
+
+function readRecoveryExport(exportPath: string): string {
+  if (exportPath.length === 0 || exportPath.includes('\0')) {
+    throw new Error('Profile state recovery export path is invalid')
+  }
+  const rawJson = readFileSync(exportPath, 'utf8')
+  parseProfileStateRoot(rawJson)
+  return rawJson
+}
diff --git a/src/main/persistence/profile-state/legacy-json/profile-state-versioned-export.test.ts b/src/main/persistence/profile-state/legacy-json/profile-state-versioned-export.test.ts
new file mode 100644
index 00000000000..edf3050c976
--- /dev/null
+++ b/src/main/persistence/profile-state/legacy-json/profile-state-versioned-export.test.ts
@@ -0,0 +1,113 @@
+import * as fs from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { durableWriteTempPath, writeFileDurableSync } from '../../../durable-file-write'
+import { profileStateJsonExportPath } from './profile-state-export-path'
+import { writeVersionedProfileStateExport } from './profile-state-versioned-export'
+
+vi.mock('node:fs', async (original) => ({ ...(await original<typeof fs>()) }))
+
+const roots: string[] = []
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const root of roots.splice(0)) {
+    fs.rmSync(root, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const root = fs.mkdtempSync(join(tmpdir(), 'orca-versioned-export-'))
+  roots.push(root)
+  const dataFile = join(root, 'orca-data.json')
+  const target = profileStateJsonExportPath(dataFile, 4)
+  const source = '{"settings":{"theme":"dark"}}'
+  const write = (revision = 4) =>
+    writeVersionedProfileStateExport(dataFile, (staging) => {
+      writeFileDurableSync(durableWriteTempPath(staging), staging, source)
+      return revision
+    })
+  return { root, target, source, write }
+}
+
+describe('immutable versioned profile exports', () => {
+  it('publishes once and accepts repeated identical exports', () => {
+    const { root, target, source, write } = fixture()
+    expect(write()).toBe(4)
+    expect(write()).toBe(4)
+    expect(fs.readFileSync(target, 'utf8')).toBe(source)
+    expect(fs.readdirSync(root)).toEqual([basename(target)])
+  })
+
+  it('retains only five successfully published exports and leaves unrelated entries alone', () => {
+    const { root, write } = fixture()
+    for (let revision = 1; revision <= 7; revision++) {
+      expect(write(revision)).toBe(revision)
+    }
+    const reservedDirectory = join(root, 'orca-data.json.sqlite-export.1.json')
+    fs.mkdirSync(reservedDirectory)
+    const unrelated = join(root, 'orca-data.json.sqlite-export.notes.json')
+    fs.writeFileSync(unrelated, 'keep')
+    write(8)
+    expect(fs.readdirSync(root).sort()).toEqual([
+      'orca-data.json.sqlite-export.1.json',
+      ...[4, 5, 6, 7, 8].map((revision) => `orca-data.json.sqlite-export.${revision}.json`),
+      'orca-data.json.sqlite-export.notes.json'
+    ])
+    expect(fs.lstatSync(reservedDirectory).isDirectory()).toBe(true)
+  })
+
+  it('preserves every recovery point when the next export fails', () => {
+    const { root, write } = fixture()
+    for (let revision = 1; revision <= 5; revision++) {
+      write(revision)
+    }
+    const retained = fs.readdirSync(root)
+    expect(() =>
+      writeVersionedProfileStateExport(join(root, 'orca-data.json'), () => {
+        throw new Error('disk full')
+      })
+    ).toThrow('disk full')
+    expect(fs.readdirSync(root)).toEqual(retained)
+  })
+
+  it('does not retain an empty profile export', () => {
+    const { root, write } = fixture()
+    expect(write(0)).toBeUndefined()
+    expect(fs.readdirSync(root)).toEqual([])
+  })
+
+  it.each(['identical', 'divergent'] as const)(
+    'preserves a concurrently published %s revision',
+    (kind) => {
+      const { root, target, source, write } = fixture()
+      const competing = kind === 'identical' ? source : '{"settings":{"theme":"light"}}'
+      let raced = false
+      const publishCompetitor = (path: fs.PathLike) => {
+        if (!raced && path === target) {
+          raced = true
+          fs.writeFileSync(target, competing)
+        }
+      }
+      const rename = fs.renameSync
+      vi.spyOn(fs, 'renameSync').mockImplementation((from, to) => {
+        publishCompetitor(to)
+        rename(from, to)
+      })
+      const link = fs.linkSync
+      vi.spyOn(fs, 'linkSync').mockImplementation((from, to) => {
+        publishCompetitor(to)
+        link(from, to)
+      })
+
+      if (kind === 'identical') {
+        expect(write()).toBe(4)
+      } else {
+        expect(write).toThrow('already exists with different content')
+      }
+      expect(raced).toBe(true)
+      expect(fs.readFileSync(target, 'utf8')).toBe(competing)
+      expect(fs.readdirSync(root)).toEqual([basename(target)])
+    }
+  )
+})
diff --git a/src/main/persistence/profile-state/legacy-json/profile-state-versioned-export.ts b/src/main/persistence/profile-state/legacy-json/profile-state-versioned-export.ts
new file mode 100644
index 00000000000..8947fb5c5b8
--- /dev/null
+++ b/src/main/persistence/profile-state/legacy-json/profile-state-versioned-export.ts
@@ -0,0 +1,52 @@
+import { lstatSync, mkdirSync, readFileSync, rmSync } from 'node:fs'
+import { dirname } from 'node:path'
+import { bestEffortFsyncDirectorySync, fsyncFileSync } from '../../../../shared/secure-file'
+import { durableWriteTempPath, publishFileDurableSync } from '../../../durable-file-write'
+import {
+  profileStateJsonExportPath,
+  profileStateJsonExportPaths
+} from './profile-state-export-path'
+
+/** An existing revision must never be replaced with different content. */
+export function writeVersionedProfileStateExport(
+  dataFile: string,
+  writeExport: (targetPath: string) => number
+): number | undefined {
+  const stagingPath = durableWriteTempPath(`${dataFile}.sqlite-export.pending`)
+  try {
+    const revision = writeExport(stagingPath)
+    if (revision === 0) {
+      return undefined
+    }
+    const targetPath = profileStateJsonExportPath(dataFile, revision)
+    mkdirSync(dirname(targetPath), { recursive: true })
+    if (!publishFileDurableSync(stagingPath, targetPath)) {
+      const staged = readFileSync(stagingPath)
+      const existing = readFileSync(targetPath)
+      if (!staged.equals(existing)) {
+        throw new Error(
+          `Profile state export revision ${revision} already exists with different content`
+        )
+      }
+      fsyncFileSync(targetPath)
+      bestEffortFsyncDirectorySync(dirname(targetPath))
+    }
+    pruneProfileStateJsonExports(dataFile)
+    return revision
+  } finally {
+    rmSync(stagingPath, { force: true })
+  }
+}
+
+function pruneProfileStateJsonExports(dataFile: string): void {
+  try {
+    const regularExports = profileStateJsonExportPaths(dataFile).filter((path) =>
+      lstatSync(path).isFile()
+    )
+    for (const path of regularExports.slice(5)) {
+      rmSync(path, { force: true })
+    }
+  } catch (error) {
+    console.warn('[persistence] Failed to prune retained JSON exports:', error)
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-access-identity.test.ts b/src/main/persistence/profile-state/profile-state-access-identity.test.ts
new file mode 100644
index 00000000000..a55e8610444
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-access-identity.test.ts
@@ -0,0 +1,101 @@
+import * as fs from 'node:fs'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+
+const native = vi.hoisted(() => ({
+  registry: vi.fn(),
+  creationTime: vi.fn()
+}))
+vi.mock('../../windows-native-registry', () => ({
+  WINDOWS_REG_SZ: 1,
+  loadWindowsNativeRegistry: () => ({ HK: { LM: 123 }, getRegistryKey: native.registry })
+}))
+vi.mock('../../windows/windows-process-table', () => ({
+  readWindowsProcessCreationTime: native.creationTime
+}))
+
+vi.mock('node:fs', async (importOriginal) => ({ ...(await importOriginal<typeof fs>()) }))
+
+const platform = Object.getOwnPropertyDescriptor(process, 'platform')
+
+beforeEach(() => {
+  vi.resetModules()
+  native.registry.mockReset()
+  native.creationTime.mockReset().mockReturnValue(null)
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  if (platform) {
+    Object.defineProperty(process, 'platform', platform)
+  }
+})
+
+it.each([
+  [
+    'AAAAAAAA-BBBB-4CCC-8DDD-EEEEEEEEEEEE',
+    'win32-machine-guid:aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee'
+  ],
+  ['00000000-0000-0000-0000-000000000000', null],
+  ['invalid-machine-id', null],
+  ['', null]
+] as const)('validates the Windows machine GUID %j', async (value, expected) => {
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+  native.registry.mockReturnValue({ MACHINEGUID: { type: 1, value } })
+  const { profileStateAccessMachineIdentity } = await import('./profile-state-access-identity')
+  expect(profileStateAccessMachineIdentity()).toBe(expected)
+  expect(profileStateAccessMachineIdentity()).toBe(expected)
+  expect(native.registry).toHaveBeenCalledExactlyOnceWith(123, 'SOFTWARE\\Microsoft\\Cryptography')
+})
+
+it.each([
+  null,
+  {},
+  { MachineGuid: { type: 4, value: 123 } },
+  { MachineGuid: { type: 1, value: [] } }
+])('keeps unavailable Windows machine identity unverifiable', async (values) => {
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+  native.registry.mockReturnValue(values)
+  const { profileStateAccessMachineIdentity } = await import('./profile-state-access-identity')
+  expect(profileStateAccessMachineIdentity()).toBeNull()
+})
+
+it('tolerates a denied registry query', async () => {
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+  native.registry.mockImplementation(() => {
+    throw new Error('access denied')
+  })
+  const { profileStateAccessMachineIdentity } = await import('./profile-state-access-identity')
+  expect(profileStateAccessMachineIdentity()).toBeNull()
+})
+
+it('caches only its own Windows creation time and leaves boot identity unavailable', async () => {
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+  native.creationTime.mockReturnValue(1_700_000_000_000)
+  const { profileStateAccessProcessIdentity, profileStateAccessBootIdentity } =
+    await import('./profile-state-access-identity')
+  expect(profileStateAccessBootIdentity()).toBeNull()
+  expect(profileStateAccessProcessIdentity(process.pid)).toBe('win32-creation-ms:1700000000000')
+  native.creationTime.mockReturnValue(1_800_000_000_000)
+  expect(profileStateAccessProcessIdentity(process.pid)).toBe('win32-creation-ms:1700000000000')
+  expect(profileStateAccessProcessIdentity(process.pid + 1)).toBe('win32-creation-ms:1800000000000')
+  native.creationTime.mockReturnValue(null)
+  expect(profileStateAccessProcessIdentity(process.pid + 1)).toBeNull()
+  expect(native.creationTime).toHaveBeenCalledTimes(3)
+})
+
+it.each([
+  ['8de277067b3544d4b65c267d0edab928\n', '8de277067b3544d4b65c267d0edab928'],
+  ['00000000000000000000000000000000', null],
+  ['uninitialized\n', null],
+  ['invalid-machine-id', null],
+  ['', null]
+] as const)('validates the Linux machine identity %j', async (contents, expected) => {
+  vi.resetModules()
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'linux' })
+  const read = fs.readFileSync
+  vi.spyOn(fs, 'readFileSync').mockImplementation((path, options) =>
+    path === '/etc/machine-id' ? contents : read(path, options)
+  )
+  const { profileStateAccessMachineIdentity } = await import('./profile-state-access-identity')
+  expect(profileStateAccessMachineIdentity()).toBe(expected)
+})
diff --git a/src/main/persistence/profile-state/profile-state-access-identity.ts b/src/main/persistence/profile-state/profile-state-access-identity.ts
new file mode 100644
index 00000000000..a36f220923b
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-access-identity.ts
@@ -0,0 +1,105 @@
+import { readFileSync } from 'node:fs'
+import { runProcessSync } from '../../../shared/child-process/run-process'
+import { parseLinuxProcStartTicks } from '../../daemon/daemon-process-start-time'
+import { getPsProcessIdentity } from '../../daemon/daemon-process-identity-query'
+import { loadWindowsNativeRegistry, WINDOWS_REG_SZ } from '../../windows-native-registry'
+import { readWindowsProcessCreationTime } from '../../windows/windows-process-table'
+
+let bootIdentity: string | null | undefined
+let machineIdentity: string | null | undefined
+let ownProcessIdentity: string | null | undefined
+
+/** A boot change proves exit only when the record belongs to this machine. */
+export function profileStateAccessMachineIdentity(): string | null {
+  if (machineIdentity !== undefined) {
+    return machineIdentity
+  }
+  machineIdentity = null
+  try {
+    if (process.platform === 'linux') {
+      const value = readFileSync('/etc/machine-id', 'utf8').trim()
+      machineIdentity = /^[a-f0-9]{32}$/.test(value) && !/^0+$/.test(value) ? value : null
+    } else if (process.platform === 'win32') {
+      const registry = loadWindowsNativeRegistry()
+      const values = registry.getRegistryKey(registry.HK.LM, 'SOFTWARE\\Microsoft\\Cryptography')
+      const entry = Object.entries(values ?? {}).find(
+        ([name]) => name.toLowerCase() === 'machineguid'
+      )?.[1]
+      const value =
+        entry?.type === WINDOWS_REG_SZ && typeof entry.value === 'string'
+          ? entry.value.trim().toLowerCase()
+          : ''
+      machineIdentity =
+        /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(value) &&
+        value !== '00000000-0000-0000-0000-000000000000'
+          ? `win32-machine-guid:${value}`
+          : null
+    } else if (process.platform === 'darwin') {
+      const result = runProcessSync({
+        program: '/usr/sbin/sysctl',
+        args: ['-n', 'kern.hostuuid'],
+        timeoutMs: 1_000,
+        maxOutputBytes: 1024
+      })
+      machineIdentity = result.code === 0 ? result.stdout.trim() || null : null
+    }
+  } catch {
+    // Missing machine identity cannot establish ownership across a reboot.
+  }
+  return machineIdentity
+}
+
+/** A kernel boot UUID survives hostname changes without conflating machines sharing a profile. */
+export function profileStateAccessBootIdentity(): string | null {
+  if (bootIdentity !== undefined) {
+    return bootIdentity
+  }
+  bootIdentity = null
+  try {
+    if (process.platform === 'linux') {
+      bootIdentity = readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim() || null
+    } else if (process.platform === 'darwin') {
+      const result = runProcessSync({
+        program: '/usr/sbin/sysctl',
+        args: ['-n', 'kern.bootsessionuuid'],
+        timeoutMs: 1_000,
+        maxOutputBytes: 1024
+      })
+      bootIdentity = result.code === 0 ? result.stdout.trim() || null : null
+    }
+  } catch {
+    // Unavailable identity leaves the conservative hostname and PID checks in force.
+  }
+  return bootIdentity
+}
+
+export function profileStateAccessProcessIdentity(pid: number): string | null {
+  if (pid !== process.pid) {
+    return readProcessIdentity(pid)
+  }
+  if (ownProcessIdentity === undefined) {
+    ownProcessIdentity = readProcessIdentity(pid)
+  }
+  return ownProcessIdentity
+}
+
+function readProcessIdentity(pid: number): string | null {
+  if (process.platform === 'win32') {
+    const startedAtMs = readWindowsProcessCreationTime(pid)
+    return startedAtMs === null ? null : `win32-creation-ms:${startedAtMs}`
+  }
+  if (process.platform === 'linux') {
+    try {
+      const ticks = parseLinuxProcStartTicks(readFileSync(`/proc/${pid}/stat`, 'utf8'))
+      return Number.isSafeInteger(ticks) && ticks >= 0 ? `linux-start-ticks:${ticks}` : null
+    } catch {
+      return null
+    }
+  }
+  if (process.platform !== 'darwin') {
+    return null
+  }
+  const startedAtMs = getPsProcessIdentity(pid, { utc: true })?.startedAtMs
+  // Local wall times are ambiguous during daylight-saving transitions.
+  return startedAtMs == null ? null : `darwin-utc-start-ms:${startedAtMs}`
+}
diff --git a/src/main/persistence/profile-state/profile-state-access-owner.ts b/src/main/persistence/profile-state/profile-state-access-owner.ts
new file mode 100644
index 00000000000..49d2960c6a3
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-access-owner.ts
@@ -0,0 +1,318 @@
+import { randomUUID } from 'node:crypto'
+import {
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  readlinkSync,
+  readdirSync,
+  realpathSync,
+  rmdirSync,
+  unlinkSync,
+  writeFileSync
+} from 'node:fs'
+import { hostname } from 'node:os'
+import { dirname, join } from 'node:path'
+import { bestEffortFsyncDirectorySync, fsyncFileSync } from '../../../shared/secure-file'
+import { renameFileWithWindowsRetry } from '../../codex-accounts/fs-utils'
+import {
+  START_TIME_TOLERANCE_MS,
+  startTimesWithinTolerance
+} from '../../daemon/daemon-process-start-time'
+import {
+  profileStateAccessBootIdentity,
+  profileStateAccessMachineIdentity,
+  profileStateAccessProcessIdentity
+} from './profile-state-access-identity'
+
+export class ProfileStateAccessError extends Error {
+  readonly code = 'profile-state-access-refused' as const
+
+  constructor(message: string) {
+    super(message)
+    this.name = 'ProfileStateAccessError'
+  }
+}
+
+export type ProfileStateAccessPaths = ReturnType<typeof profileStateAccessPaths>
+
+export function profileStateAccessPaths(userDataPath: string) {
+  mkdirSync(userDataPath, { recursive: true, mode: 0o700 })
+  const root = join(realpathSync(userDataPath), '.profile-state-access')
+  const paths = {
+    root,
+    participants: join(root, 'participants'),
+    candidates: join(root, 'candidates'),
+    maintenance: join(root, 'maintenance')
+  }
+  for (const path of [root, paths.participants, paths.candidates]) {
+    mkdirSync(path, { recursive: true, mode: 0o700 })
+  }
+  return paths
+}
+
+export const PROFILE_STATE_ACCESS_TOKEN = /^[a-f0-9-]{36}$/
+
+type AccessOwner = {
+  token: string
+  pid: number
+  host: string
+  platform: string
+  pidNamespace: string | null
+  bootIdentity?: string | null
+  machineIdentity?: string | null
+  processStartIdentity?: string | null
+}
+
+export function profileStateAccessPidNamespace(): string | null {
+  if (process.platform !== 'linux') {
+    return null
+  }
+  try {
+    return readlinkSync('/proc/self/ns/pid')
+  } catch {
+    return null
+  }
+}
+
+function readOwner(path: string): AccessOwner | undefined {
+  try {
+    if (!lstatSync(path).isFile()) {
+      throw new ProfileStateAccessError(`Profile state owner is not a regular file: ${path}`)
+    }
+    const owner: unknown = JSON.parse(readFileSync(path, 'utf8'))
+    if (
+      typeof owner === 'object' &&
+      owner !== null &&
+      'token' in owner &&
+      typeof owner.token === 'string' &&
+      PROFILE_STATE_ACCESS_TOKEN.test(owner.token) &&
+      'pid' in owner &&
+      typeof owner.pid === 'number' &&
+      Number.isSafeInteger(owner.pid) &&
+      owner.pid > 0 &&
+      'host' in owner &&
+      typeof owner.host === 'string' &&
+      owner.host.length > 0 &&
+      'platform' in owner &&
+      typeof owner.platform === 'string' &&
+      'pidNamespace' in owner &&
+      (owner.pidNamespace === null || typeof owner.pidNamespace === 'string')
+    ) {
+      return {
+        token: owner.token,
+        pid: owner.pid,
+        host: owner.host,
+        platform: owner.platform,
+        pidNamespace: owner.pidNamespace,
+        bootIdentity:
+          'bootIdentity' in owner && typeof owner.bootIdentity === 'string'
+            ? owner.bootIdentity
+            : null,
+        machineIdentity:
+          'machineIdentity' in owner && typeof owner.machineIdentity === 'string'
+            ? owner.machineIdentity
+            : null,
+        processStartIdentity:
+          'processStartIdentity' in owner &&
+          typeof owner.processStartIdentity === 'string' &&
+          /^(?:(?:linux-start-ticks|darwin-utc-start-ms|wall-time-ms):\d+|win32-creation-ms:[1-9]\d*)$/.test(
+            owner.processStartIdentity
+          ) &&
+          Number.isSafeInteger(Number(owner.processStartIdentity.split(':')[1]))
+            ? owner.processStartIdentity
+            : null
+      }
+    }
+  } catch (error) {
+    if (hasCode(error, 'ENOENT')) {
+      return undefined
+    }
+    throw new ProfileStateAccessError(`Profile state ownership is unverifiable: ${path}`)
+  }
+  throw new ProfileStateAccessError(`Profile state ownership is malformed: ${path}`)
+}
+
+function ownerExited(owner: AccessOwner): boolean {
+  const currentBoot = profileStateAccessBootIdentity()
+  const currentMachine = profileStateAccessMachineIdentity()
+  const sameBoot = Boolean(owner.bootIdentity && owner.bootIdentity === currentBoot)
+  const sameMachine = Boolean(owner.machineIdentity && owner.machineIdentity === currentMachine)
+  const sameHost = owner.host === hostname()
+  // Windows has no boot UUID to verify a renamed host.
+  if (
+    (process.platform === 'win32' && !sameHost) ||
+    (!sameBoot && !sameHost) ||
+    owner.platform !== process.platform ||
+    (!sameBoot && owner.machineIdentity && currentMachine && !sameMachine)
+  ) {
+    return false
+  }
+  if (
+    sameHost &&
+    sameMachine &&
+    owner.bootIdentity &&
+    currentBoot &&
+    owner.bootIdentity !== currentBoot
+  ) {
+    return true
+  }
+  // Windows/WSL and Linux PID namespaces cannot establish each other's process absence.
+  if (
+    process.platform === 'linux' &&
+    (owner.pidNamespace === null || owner.pidNamespace !== profileStateAccessPidNamespace())
+  ) {
+    return false
+  }
+  try {
+    process.kill(owner.pid, 0)
+  } catch (error) {
+    return hasCode(error, 'ESRCH')
+  }
+  const recordedStart = owner.processStartIdentity
+  // GetProcessTimes records an absolute creation time, so it also detects reuse after reboot.
+  const canCompareStart = sameBoot || (process.platform === 'win32' && sameMachine && sameHost)
+  const actualStart =
+    !canCompareStart || recordedStart == null ? null : profileStateAccessProcessIdentity(owner.pid)
+  return (
+    actualStart !== null &&
+    recordedStart != null &&
+    actualStart.split(':')[0] === recordedStart.split(':')[0] &&
+    (actualStart.startsWith('darwin-utc-start-ms:')
+      ? !startTimesWithinTolerance(
+          Number(actualStart.split(':')[1]),
+          Number(recordedStart.split(':')[1]),
+          START_TIME_TOLERANCE_MS
+        )
+      : actualStart !== recordedStart)
+  )
+}
+
+export function hasCode(error: unknown, code: string): boolean {
+  return typeof error === 'object' && error !== null && 'code' in error && error.code === code
+}
+
+export function removeOwnerEntry(path: string): void {
+  try {
+    unlinkSync(path)
+  } catch (error) {
+    if (!hasCode(error, 'ENOENT')) {
+      throw error
+    }
+  }
+}
+
+function removeEmptyOwnerDirectory(path: string): void {
+  try {
+    rmdirSync(path)
+  } catch (error) {
+    if (!['ENOENT', 'ENOTEMPTY', 'EEXIST', 'EBUSY'].some((code) => hasCode(error, code))) {
+      throw error
+    }
+  }
+}
+
+/** Only remove immutable entries whose owner is positively known to have exited. */
+export function reclaimExitedOwner(path: string): void {
+  let entries: string[]
+  try {
+    if (!lstatSync(path).isDirectory()) {
+      throw new ProfileStateAccessError(`Profile state owner is not a directory: ${path}`)
+    }
+    entries = readdirSync(path)
+  } catch (error) {
+    if (hasCode(error, 'ENOENT')) {
+      return
+    }
+    throw error
+  }
+  for (const entry of entries) {
+    const token = entry.endsWith('.owner') ? entry.slice(0, -6) : ''
+    if (!PROFILE_STATE_ACCESS_TOKEN.test(token)) {
+      throw new ProfileStateAccessError(`Profile state ownership is unverifiable: ${path}`)
+    }
+    const owner = readOwner(join(path, entry))
+    if (owner === undefined) {
+      continue
+    }
+    if (owner.token !== token || !ownerExited(owner)) {
+      throw new ProfileStateAccessError(
+        `Profile state is in use or its owner is unverifiable: ${path}. Stop Orca and orcad on every host using this profile, then retry. If this remains, verify PID ${owner.pid} on ${owner.host} has exited before removing its owner entry ${join(path, entry)}.`
+      )
+    }
+    removeOwnerEntry(join(path, entry))
+  }
+  // A replacement owner keeps the directory nonempty, even if our observation is stale.
+  removeEmptyOwnerDirectory(path)
+}
+
+export function publishAccessOwner(paths: ProfileStateAccessPaths, exclusive: boolean) {
+  const token = randomUUID()
+  const candidate = join(paths.candidates, token)
+  const target = exclusive ? paths.maintenance : join(paths.participants, token)
+  const entry = `${token}.owner`
+  mkdirSync(candidate, { mode: 0o700 })
+  let published = false
+  try {
+    writeFileSync(
+      join(candidate, entry),
+      JSON.stringify({
+        token,
+        pid: process.pid,
+        host: hostname(),
+        platform: process.platform,
+        pidNamespace: profileStateAccessPidNamespace(),
+        bootIdentity: profileStateAccessBootIdentity(),
+        machineIdentity: profileStateAccessMachineIdentity(),
+        processStartIdentity: profileStateAccessProcessIdentity(process.pid)
+      }),
+      {
+        flag: 'wx',
+        mode: 0o600
+      }
+    )
+    fsyncFileSync(join(candidate, entry))
+    bestEffortFsyncDirectorySync(candidate)
+    for (let attempt = 0; ; attempt += 1) {
+      try {
+        renameFileWithWindowsRetry(candidate, target)
+        published = true
+        break
+      } catch (error) {
+        if (!exclusive || attempt >= 2) {
+          throw error
+        }
+        reclaimExitedOwner(target)
+      }
+    }
+    bestEffortFsyncDirectorySync(dirname(target))
+    bestEffortFsyncDirectorySync(paths.candidates)
+  } catch (error) {
+    if (published) {
+      removeOwnerEntry(join(target, entry))
+      removeEmptyOwnerDirectory(target)
+    }
+    throw error
+  } finally {
+    if (!published) {
+      removeOwnerEntry(join(candidate, entry))
+      removeEmptyOwnerDirectory(candidate)
+    }
+  }
+  let released = false
+  return {
+    token,
+    assertActive(): void {
+      if (released || readOwner(join(target, entry))?.token !== token) {
+        throw new ProfileStateAccessError('Profile state access has already been released')
+      }
+    },
+    release(): void {
+      if (released) {
+        return
+      }
+      removeOwnerEntry(join(target, entry))
+      removeEmptyOwnerDirectory(target)
+      released = true
+    }
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-access-process.test.ts b/src/main/persistence/profile-state/profile-state-access-process.test.ts
new file mode 100644
index 00000000000..eef48007bf1
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-access-process.test.ts
@@ -0,0 +1,150 @@
+import { once } from 'node:events'
+import { mkdtempSync, readdirSync, rmSync, utimesSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { buildSync } from 'esbuild'
+import { afterAll, afterEach, beforeAll, describe, expect, it } from 'vitest'
+import { spawnProcess } from '../../../shared/child-process/run-process'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission
+} from './profile-state-access'
+import { profileStateAccessPaths } from './profile-state-access-owner'
+
+const fixture = mkdtempSync(join(tmpdir(), 'orca-state-access-process-'))
+const bundle = join(fixture, 'access.cjs')
+const children = new Set<ReturnType<typeof spawnProcess>>()
+
+beforeAll(() => {
+  buildSync({
+    entryPoints: [resolve(__dirname, 'profile-state-access.ts')],
+    outfile: bundle,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    packages: 'external'
+  })
+})
+
+afterEach(async () => {
+  await Promise.all([...children].map(stopChild))
+})
+
+afterAll(() => rmSync(fixture, { recursive: true, force: true }))
+
+async function stopChild(child: ReturnType<typeof spawnProcess>): Promise<void> {
+  children.delete(child)
+  if (child.exitCode !== null || child.signalCode !== null) {
+    return
+  }
+  const closed = once(child, 'close')
+  child.kill('SIGKILL')
+  await closed
+}
+
+const CHILD_SOURCE = `
+const fs = require('node:fs')
+const [root, bundle, mode] = process.argv.slice(1)
+const rename = fs.renameSync
+if (mode === 'candidate' || mode === 'published') {
+  fs.renameSync = (from, to) => {
+    if (mode === 'candidate' && String(to).endsWith('maintenance')) {
+      fs.writeSync(1, 'barrier\\n')
+      fs.readSync(0, Buffer.alloc(1), 0, 1)
+    }
+    rename(from, to)
+    if (mode === 'published' && String(to).includes('participants')) {
+      fs.writeSync(1, 'barrier\\n')
+      fs.readSync(0, Buffer.alloc(1), 0, 1)
+    }
+  }
+}
+const access = require(bundle)
+const owner = mode === 'runtime' || mode === 'published'
+  ? access.acquireProfileStateRuntimeAdmission(root)
+  : access.acquireProfileStateMaintenance(root)
+fs.writeSync(1, 'ready\\n')
+process.stdin.resume()
+`
+
+async function startChild(root: string, mode: string): Promise<ReturnType<typeof spawnProcess>> {
+  const child = spawnProcess({
+    program: process.execPath,
+    args: ['-e', CHILD_SOURCE, root, bundle, mode],
+    env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1' }
+  })
+  children.add(child)
+  let stderr = ''
+  child.stderr.on('data', (chunk: Buffer) => {
+    stderr += chunk.toString()
+  })
+  await new Promise<void>((resolveReady, reject) => {
+    let stdout = ''
+    const onData = (chunk: Buffer) => {
+      stdout += chunk.toString()
+      if (stdout.includes('ready\n') || stdout.includes('barrier\n')) {
+        cleanup()
+        resolveReady()
+      }
+    }
+    const onExit = () => {
+      cleanup()
+      reject(new Error(`Owner child exited before its barrier: ${stderr}`))
+    }
+    const onError = (error: Error) => {
+      cleanup()
+      reject(error)
+    }
+    const cleanup = () => {
+      child.stdout.off('data', onData)
+      child.off('exit', onExit)
+      child.off('error', onError)
+    }
+    child.stdout.on('data', onData)
+    child.once('exit', onExit)
+    child.once('error', onError)
+  })
+  return child
+}
+
+describe('profile state owners across actual process death', () => {
+  it('excludes recovery while a runtime lives and reclaims its registration after SIGKILL', async () => {
+    const root = join(fixture, 'runtime')
+    const child = await startChild(root, 'runtime')
+    expect(() => acquireProfileStateMaintenance(root)).toThrow('in use')
+    await stopChild(child)
+    const maintenance = acquireProfileStateMaintenance(root)
+    expect(readdirSync(profileStateAccessPaths(root).participants)).toEqual([])
+    maintenance.release()
+  })
+
+  it('never steals a live maintenance owner with arbitrarily old timestamps', async () => {
+    const root = join(fixture, 'maintenance')
+    const child = await startChild(root, 'maintenance')
+    const gate = profileStateAccessPaths(root).maintenance
+    for (const file of readdirSync(gate)) {
+      utimesSync(join(gate, file), 0, 0)
+    }
+    utimesSync(gate, 0, 0)
+    expect(() => acquireProfileStateRuntimeAdmission(root)).toThrow('in use')
+    expect(() => acquireProfileStateMaintenance(root)).toThrow('in use')
+    await stopChild(child)
+    acquireProfileStateRuntimeAdmission(root).release()
+  })
+
+  it('treats a crash before complete owner publication as an inert candidate', async () => {
+    const root = join(fixture, 'candidate')
+    const child = await startChild(root, 'candidate')
+    acquireProfileStateRuntimeAdmission(root).release()
+    await stopChild(child)
+    acquireProfileStateMaintenance(root).release()
+  })
+
+  it('excludes recovery after participant publication even before runtime admission finishes', async () => {
+    const root = join(fixture, 'published')
+    const child = await startChild(root, 'published')
+    expect(() => acquireProfileStateMaintenance(root)).toThrow('in use')
+    await stopChild(child)
+    acquireProfileStateMaintenance(root).release()
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-access-windows-native.win32.test.ts b/src/main/persistence/profile-state/profile-state-access-windows-native.win32.test.ts
new file mode 100644
index 00000000000..963bd5d48b7
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-access-windows-native.win32.test.ts
@@ -0,0 +1,56 @@
+import { randomUUID } from 'node:crypto'
+import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
+import { hostname, tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { expect, it } from 'vitest'
+import { readWindowsProcessCreationTime } from '../../windows/windows-process-table'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission
+} from './profile-state-access'
+import { profileStateAccessMachineIdentity } from './profile-state-access-identity'
+import { profileStateAccessPaths } from './profile-state-access-owner'
+import { removeTreeSync } from '../../../shared/windows-transient-lock-removal'
+
+it.runIf(process.platform === 'win32')(
+  'reclaims a previous Windows PID incarnation and retains the live owner using native identities',
+  () => {
+    const startedAt = readWindowsProcessCreationTime(process.pid)
+    const machine = profileStateAccessMachineIdentity()
+    expect(startedAt).toBeGreaterThan(0)
+    expect(machine).toMatch(/^win32-machine-guid:/)
+    if (startedAt === null) {
+      throw new Error('Native process creation-time capability is required')
+    }
+    const root = mkdtempSync(join(tmpdir(), 'orca-profile-owner-native-'))
+    try {
+      const maintenance = profileStateAccessPaths(root).maintenance
+      mkdirSync(maintenance)
+      const token = randomUUID()
+      const entry = join(maintenance, `${token}.owner`)
+      writeFileSync(
+        entry,
+        JSON.stringify({
+          token,
+          pid: process.pid,
+          host: hostname(),
+          platform: 'win32',
+          pidNamespace: null,
+          bootIdentity: null,
+          machineIdentity: machine,
+          processStartIdentity: `win32-creation-ms:${startedAt - 1}`
+        })
+      )
+      const admission = acquireProfileStateRuntimeAdmission(root)
+      try {
+        expect(existsSync(entry)).toBe(false)
+        expect(() => acquireProfileStateMaintenance(root)).toThrow('unverifiable')
+      } finally {
+        admission.release()
+      }
+      acquireProfileStateMaintenance(root).release()
+    } finally {
+      removeTreeSync(root)
+    }
+  }
+)
diff --git a/src/main/persistence/profile-state/profile-state-access-windows.test.ts b/src/main/persistence/profile-state/profile-state-access-windows.test.ts
new file mode 100644
index 00000000000..02d210523e0
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-access-windows.test.ts
@@ -0,0 +1,228 @@
+import { randomUUID } from 'node:crypto'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import { hostname, tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission
+} from './profile-state-access'
+import { profileStateAccessPaths } from './profile-state-access-owner'
+
+const identity = vi.hoisted(() => ({
+  boot: vi.fn(),
+  machine: vi.fn(),
+  process: vi.fn()
+}))
+vi.mock('./profile-state-access-identity', () => ({
+  profileStateAccessBootIdentity: identity.boot,
+  profileStateAccessMachineIdentity: identity.machine,
+  profileStateAccessProcessIdentity: identity.process
+}))
+
+const platform = Object.getOwnPropertyDescriptor(process, 'platform')
+let root: string
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'orca-state-access-windows-'))
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+  identity.boot.mockReset().mockReturnValue(null)
+  identity.machine.mockReset().mockReturnValue('win32-machine-guid:this-machine')
+  identity.process.mockReset().mockReturnValue('win32-creation-ms:2000')
+  vi.spyOn(process, 'kill').mockReturnValue(true)
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  if (platform) {
+    Object.defineProperty(process, 'platform', platform)
+  }
+  rmSync(root, { recursive: true, force: true })
+})
+
+function writeOwner(overrides: Record<string, unknown> = {}, exclusive = true): string {
+  const paths = profileStateAccessPaths(root)
+  const token = randomUUID()
+  const directory = exclusive ? paths.maintenance : join(paths.participants, token)
+  mkdirSync(directory)
+  const path = join(directory, `${token}.owner`)
+  writeFileSync(
+    path,
+    JSON.stringify({
+      token,
+      pid: 12345,
+      host: hostname(),
+      platform: 'win32',
+      pidNamespace: null,
+      bootIdentity: null,
+      machineIdentity: 'win32-machine-guid:this-machine',
+      processStartIdentity: 'win32-creation-ms:1000',
+      ...overrides
+    })
+  )
+  return path
+}
+
+it('records the machine and native creation time before publishing a runtime admission', () => {
+  const admission = acquireProfileStateRuntimeAdmission(root)
+  const participants = profileStateAccessPaths(root).participants
+  const token = readdirSync(participants)[0]
+  expect(
+    JSON.parse(readFileSync(join(participants, token, `${token}.owner`), 'utf8'))
+  ).toMatchObject({
+    pid: process.pid,
+    platform: 'win32',
+    machineIdentity: 'win32-machine-guid:this-machine',
+    processStartIdentity: 'win32-creation-ms:2000',
+    bootIdentity: null
+  })
+  admission.release()
+})
+
+it.each([true, false])(
+  'reclaims a reused PID on the same machine without a boot UUID: maintenance=%s',
+  (exclusive) => {
+    const path = writeOwner({}, exclusive)
+    acquireProfileStateMaintenance(root).release()
+    expect(existsSync(path)).toBe(false)
+    expect(identity.process).toHaveBeenCalledWith(12345)
+  }
+)
+
+it('lets runtime startup recover a stale maintenance owner', () => {
+  const path = writeOwner()
+  acquireProfileStateRuntimeAdmission(root).release()
+  expect(existsSync(path)).toBe(false)
+})
+
+it('uses exact creation times even for reuse within the POSIX timestamp tolerance', () => {
+  const path = writeOwner({ processStartIdentity: 'win32-creation-ms:1999' })
+  acquireProfileStateMaintenance(root).release()
+  expect(existsSync(path)).toBe(false)
+})
+
+it('keeps an unchanged process alive across wall-clock changes', () => {
+  const path = writeOwner({ processStartIdentity: 'win32-creation-ms:2000' })
+  vi.spyOn(Date, 'now').mockReturnValue(9_000_000)
+  expect(() => acquireProfileStateMaintenance(root)).toThrow('unverifiable')
+  expect(existsSync(path)).toBe(true)
+})
+
+it('can reclaim after reboot using the stored absolute creation time', () => {
+  const path = writeOwner({ processStartIdentity: 'win32-creation-ms:1700000000000' })
+  identity.process.mockReturnValue('win32-creation-ms:1800000000000')
+  acquireProfileStateMaintenance(root).release()
+  expect(existsSync(path)).toBe(false)
+})
+
+it.each([
+  { host: 'previous-hostname' },
+  { machineIdentity: 'win32-machine-guid:another-machine' },
+  { platform: 'linux' }
+])(
+  'keeps another or unverifiable execution host even when the PID is absent locally: %j',
+  (record) => {
+    const path = writeOwner(record)
+    vi.mocked(process.kill).mockImplementation(() => {
+      throw Object.assign(new Error('absent'), { code: 'ESRCH' })
+    })
+    expect(() => acquireProfileStateMaintenance(root)).toThrow('unverifiable')
+    expect(process.kill).not.toHaveBeenCalled()
+    expect(existsSync(path)).toBe(true)
+  }
+)
+
+it('cannot identify another host from a cloned machine GUID and a renamed hostname', () => {
+  const path = writeOwner({ host: 'other-host-with-cloned-guid' })
+  expect(() => acquireProfileStateMaintenance(root)).toThrow('unverifiable')
+  expect(process.kill).not.toHaveBeenCalled()
+  expect(existsSync(path)).toBe(true)
+})
+
+it('does not infer PID reuse from an unavailable local machine identity', () => {
+  const path = writeOwner()
+  identity.machine.mockReturnValue(null)
+  expect(() => acquireProfileStateMaintenance(root)).toThrow('unverifiable')
+  expect(process.kill).toHaveBeenCalledWith(12345, 0)
+  expect(identity.process).not.toHaveBeenCalledWith(12345)
+  expect(existsSync(path)).toBe(true)
+})
+
+it.each([null, undefined])(
+  'reclaims a legacy same-host owner with an absent PID and machine identity %s',
+  (machineIdentity) => {
+    const path = writeOwner({ machineIdentity })
+    vi.mocked(process.kill).mockImplementation(() => {
+      throw Object.assign(new Error('absent'), { code: 'ESRCH' })
+    })
+    acquireProfileStateMaintenance(root).release()
+    expect(existsSync(path)).toBe(false)
+  }
+)
+
+it('reclaims an absent same-host PID when the reader cannot load machine identity', () => {
+  const path = writeOwner()
+  identity.machine.mockReturnValue(null)
+  vi.mocked(process.kill).mockImplementation(() => {
+    throw Object.assign(new Error('absent'), { code: 'ESRCH' })
+  })
+  acquireProfileStateMaintenance(root).release()
+  expect(existsSync(path)).toBe(false)
+})
+
+it.each([null, undefined])(
+  'does not compare creation times for a legacy live PID without machine identity %s',
+  (machineIdentity) => {
+    const path = writeOwner({ machineIdentity })
+    expect(() => acquireProfileStateMaintenance(root)).toThrow('unverifiable')
+    expect(identity.process).not.toHaveBeenCalledWith(12345)
+    expect(existsSync(path)).toBe(true)
+  }
+)
+
+it.each([
+  undefined,
+  null,
+  'wall-time-ms:1000',
+  'win32-creation-ms:0',
+  'win32-creation-ms:02000',
+  'win32-creation-ms:invalid',
+  'win32-creation-ms:99999999999999999'
+])('keeps legacy, incompatible or malformed creation identities: %s', (processStartIdentity) => {
+  const path = writeOwner({ processStartIdentity })
+  expect(() => acquireProfileStateMaintenance(root)).toThrow('unverifiable')
+  expect(existsSync(path)).toBe(true)
+})
+
+it('does not infer PID reuse when the native identity getter is unavailable', () => {
+  const path = writeOwner()
+  identity.process.mockReturnValue(null)
+  expect(() => acquireProfileStateMaintenance(root)).toThrow('unverifiable')
+  expect(existsSync(path)).toBe(true)
+})
+
+it.each(['EPERM', 'EACCES', 'EINVAL'])('retains owners on signal query failure %s', (code) => {
+  const path = writeOwner()
+  vi.mocked(process.kill).mockImplementation(() => {
+    throw Object.assign(new Error(code), { code })
+  })
+  expect(() => acquireProfileStateMaintenance(root)).toThrow('unverifiable')
+  expect(existsSync(path)).toBe(true)
+})
+
+it('reclaims a positively absent PID from the same machine even without a start timestamp', () => {
+  const path = writeOwner({ processStartIdentity: null })
+  vi.mocked(process.kill).mockImplementation(() => {
+    throw Object.assign(new Error('absent'), { code: 'ESRCH' })
+  })
+  acquireProfileStateMaintenance(root).release()
+  expect(existsSync(path)).toBe(false)
+})
diff --git a/src/main/persistence/profile-state/profile-state-access.test.ts b/src/main/persistence/profile-state/profile-state-access.test.ts
new file mode 100644
index 00000000000..b551a44f053
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-access.test.ts
@@ -0,0 +1,531 @@
+import * as fs from 'node:fs'
+import { randomUUID } from 'node:crypto'
+import { tmpdir, hostname } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission,
+  assertProfileStateMaintenance,
+  type ProfileStateMaintenance
+} from './profile-state-access'
+import { profileStateAccessPaths, reclaimExitedOwner } from './profile-state-access-owner'
+import * as identity from './profile-state-access-identity'
+import * as processStart from '../../daemon/daemon-process-start-time'
+
+vi.mock('node:fs', async (importOriginal) => ({ ...(await importOriginal<typeof fs>()) }))
+vi.mock('../../daemon/daemon-process-start-time', async (importOriginal) => ({
+  ...(await importOriginal<typeof processStart>())
+}))
+vi.mock('./profile-state-access-identity', async (importOriginal) => ({
+  ...(await importOriginal<typeof identity>())
+}))
+
+const roots: string[] = []
+function root(): string {
+  const path = fs.mkdtempSync(join(tmpdir(), 'orca-state-access-'))
+  roots.push(path)
+  return path
+}
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const path of roots.splice(0)) {
+    fs.rmSync(path, { recursive: true, force: true })
+  }
+})
+
+describe('profile state admission and maintenance', () => {
+  it.skipIf(process.platform === 'win32')(
+    'releases its published owner when directory sync fails',
+    () => {
+      const path = root()
+      const syncFile = fs.fsyncSync
+      let syncCount = 0
+      const sync = vi.spyOn(fs, 'fsyncSync').mockImplementation((fd) => {
+        if (++syncCount === 3) {
+          throw new Error('directory sync failed')
+        }
+        syncFile(fd)
+      })
+      expect(() => acquireProfileStateRuntimeAdmission(path)).toThrow('directory sync failed')
+      const paths = profileStateAccessPaths(path)
+      expect(fs.readdirSync(paths.participants)).toEqual([])
+      expect(fs.readdirSync(paths.candidates)).toEqual([])
+      sync.mockRestore()
+      acquireProfileStateMaintenance(path).release()
+    }
+  )
+
+  it('does not publish an owner whose contents could not be synced', () => {
+    const path = root()
+    const sync = vi.spyOn(fs, 'fsyncSync').mockImplementationOnce(() => {
+      throw new Error('owner sync failed')
+    })
+    expect(() => acquireProfileStateRuntimeAdmission(path)).toThrow('owner sync failed')
+    const paths = profileStateAccessPaths(path)
+    expect(fs.readdirSync(paths.participants)).toEqual([])
+    expect(fs.readdirSync(paths.candidates)).toEqual([])
+    sync.mockRestore()
+    acquireProfileStateMaintenance(path).release()
+  })
+
+  it('allows concurrent normal writers and refuses maintenance until every admission releases', () => {
+    const path = root()
+    const first = acquireProfileStateRuntimeAdmission(path)
+    const second = acquireProfileStateRuntimeAdmission(path)
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('in use')
+    first.release()
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('in use')
+    second.release()
+    const maintenance = acquireProfileStateMaintenance(path)
+    expect(() => acquireProfileStateRuntimeAdmission(path)).toThrow('in use')
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('in use')
+    maintenance.release()
+    acquireProfileStateRuntimeAdmission(path).release()
+  })
+
+  it('refuses a runtime publishing after maintenance has acquired and scanned', () => {
+    const path = root()
+    const rename = fs.renameSync
+    let maintenance: ProfileStateMaintenance | undefined
+    vi.spyOn(fs, 'renameSync').mockImplementation((from, to) => {
+      if (String(to).includes('participants')) {
+        maintenance = acquireProfileStateMaintenance(path)
+      }
+      rename(from, to)
+    })
+    expect(() => acquireProfileStateRuntimeAdmission(path)).toThrow('in use')
+    expect(maintenance).toBeDefined()
+    maintenance?.release()
+    expect(fs.readdirSync(profileStateAccessPaths(path).participants)).toEqual([])
+  })
+
+  it('refuses maintenance when runtime publication precedes its final admission check', () => {
+    const path = root()
+    const rename = fs.renameSync
+    let refused = false
+    vi.spyOn(fs, 'renameSync').mockImplementation((from, to) => {
+      rename(from, to)
+      if (String(to).includes('participants')) {
+        expect(() => acquireProfileStateMaintenance(path)).toThrow('in use')
+        refused = true
+      }
+    })
+    const admission = acquireProfileStateRuntimeAdmission(path)
+    expect(refused).toBe(true)
+    admission.release()
+  })
+
+  it('rejects released and fabricated maintenance owners and binds valid owners to exact profile paths', () => {
+    const path = root()
+    const other = root()
+    const profileId = 'profile-test'
+    const profileDir = join(path, 'profiles', profileId)
+    fs.mkdirSync(profileDir, { recursive: true })
+    const files = {
+      profileId,
+      dataFile: join(profileDir, 'orca-data.json'),
+      databasePath: join(profileDir, 'profile-state.db')
+    }
+    const owner = acquireProfileStateMaintenance(path)
+    assertProfileStateMaintenance(owner, files)
+    expect(() => assertProfileStateMaintenance({ ...owner }, files)).toThrow('acquired')
+    const wrong = acquireProfileStateMaintenance(other)
+    expect(() => assertProfileStateMaintenance(wrong, files)).toThrow('paths')
+    expect(() =>
+      assertProfileStateMaintenance(owner, { ...files, profileId: '../escape' })
+    ).toThrow('acquired')
+    owner.release()
+    expect(() => assertProfileStateMaintenance(owner, files)).toThrow('released')
+    wrong.release()
+  })
+
+  it.skipIf(process.platform === 'win32')(
+    'refuses symlinked profile directories outside the protected root',
+    () => {
+      const path = root()
+      const outside = root()
+      fs.mkdirSync(join(path, 'profiles'))
+      fs.symlinkSync(outside, join(path, 'profiles', 'escaped'))
+      const owner = acquireProfileStateMaintenance(path)
+      expect(() =>
+        assertProfileStateMaintenance(owner, {
+          profileId: 'escaped',
+          dataFile: join(outside, 'orca-data.json'),
+          databasePath: join(outside, 'profile-state.db')
+        })
+      ).toThrow('paths')
+      owner.release()
+    }
+  )
+
+  it.each(['', '../outside', 'x'.repeat(129)])(
+    'rejects invalid recovery profile IDs: %s',
+    (profileId) => {
+      const path = root()
+      const owner = acquireProfileStateMaintenance(path)
+      expect(() => owner.assertProfile(profileId, path, path)).toThrow('acquired')
+      owner.release()
+      acquireProfileStateRuntimeAdmission(path).release()
+    }
+  )
+})
+
+function staleGate(
+  path: string,
+  pid = 12345,
+  host = hostname(),
+  extra: {
+    bootIdentity?: string
+    machineIdentity?: string
+    startedAtMs?: number
+    processStartIdentity?: string
+  } = {}
+): string {
+  const gate = profileStateAccessPaths(path).maintenance
+  fs.mkdirSync(gate)
+  const token = randomUUID()
+  const record = join(gate, `${token}.owner`)
+  fs.writeFileSync(
+    record,
+    JSON.stringify({
+      token,
+      pid,
+      host,
+      platform: process.platform,
+      pidNamespace: process.platform === 'linux' ? fs.readlinkSync('/proc/self/ns/pid') : null,
+      machineIdentity: identity.profileStateAccessMachineIdentity(),
+      ...extra
+    })
+  )
+  return record
+}
+
+describe('profile state owner reclamation', () => {
+  it('reclaims a local owner from a previous boot even when its PID is now live', () => {
+    const path = root()
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('current-boot')
+    vi.spyOn(identity, 'profileStateAccessMachineIdentity').mockReturnValue('same-machine')
+    const owner = staleGate(path, process.pid, hostname(), {
+      bootIdentity: 'previous-boot',
+      machineIdentity: 'same-machine'
+    })
+    const kill = vi.spyOn(process, 'kill')
+    acquireProfileStateMaintenance(path).release()
+    expect(kill).not.toHaveBeenCalled()
+    expect(fs.existsSync(owner)).toBe(false)
+  })
+
+  it('keeps a differently booted machine with the same hostname unverifiable', () => {
+    const path = root()
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('current-boot')
+    vi.spyOn(identity, 'profileStateAccessMachineIdentity').mockReturnValue('this-machine')
+    const owner = staleGate(path, process.pid, hostname(), {
+      bootIdentity: 'another-boot',
+      machineIdentity: 'another-machine'
+    })
+    const kill = vi.spyOn(process, 'kill')
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+    expect(kill).not.toHaveBeenCalled()
+    expect(fs.existsSync(owner)).toBe(true)
+  })
+
+  it.each(['current-boot', null])(
+    'does not reclaim another host with a cloned machine identity (current boot: %s)',
+    (currentBoot) => {
+      const path = root()
+      vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue(currentBoot)
+      vi.spyOn(identity, 'profileStateAccessMachineIdentity').mockReturnValue('cloned-machine')
+      const owner = staleGate(path, 12345, 'another-host', {
+        bootIdentity: 'another-boot',
+        machineIdentity: 'cloned-machine'
+      })
+      const kill = vi.spyOn(process, 'kill').mockImplementation(() => {
+        throw Object.assign(new Error('absent on this host'), { code: 'ESRCH' })
+      })
+      expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+      expect(kill).not.toHaveBeenCalled()
+      expect(fs.existsSync(owner)).toBe(true)
+    }
+  )
+
+  it('reclaims a reused PID only when its recorded process start differs on the same boot', () => {
+    const path = root()
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('same-boot')
+    vi.spyOn(identity, 'profileStateAccessProcessIdentity').mockReturnValue(
+      'linux-start-ticks:2000'
+    )
+    const owner = staleGate(path, process.pid, hostname(), {
+      bootIdentity: 'same-boot',
+      processStartIdentity: 'linux-start-ticks:1000'
+    })
+    acquireProfileStateMaintenance(path).release()
+    expect(fs.existsSync(owner)).toBe(false)
+  })
+
+  it('cannot reclaim a live Linux owner when wall-clock time changes', () => {
+    const platform = Object.getOwnPropertyDescriptor(process, 'platform')
+    if (!platform) {
+      throw new Error('Missing platform descriptor')
+    }
+    const path = root()
+    const read = fs.readFileSync
+    const fields = Array.from({ length: 20 }, () => '0')
+    fields[0] = 'S'
+    fields[19] = '987654'
+    let clock = 1_700_000_000_000
+    const wallStart = vi
+      .spyOn(processStart, 'getProcessStartedAtMs')
+      .mockImplementation(() => clock)
+    vi.spyOn(fs, 'readFileSync').mockImplementation((file, options) => {
+      if (file === '/proc/12345/stat') {
+        return `12345 (orca daemon) ${fields.join(' ')}`
+      }
+      return read(file, options)
+    })
+    vi.spyOn(fs, 'readlinkSync').mockReturnValue('pid:[same-namespace]')
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('same-boot')
+    vi.spyOn(process, 'kill').mockReturnValue(true)
+    try {
+      Object.defineProperty(process, 'platform', { configurable: true, value: 'linux' })
+      const processStartIdentity = identity.profileStateAccessProcessIdentity(12345)
+      expect(processStartIdentity).toBe('linux-start-ticks:987654')
+      if (processStartIdentity === null) {
+        throw new Error('Expected process identity')
+      }
+      const owner = staleGate(path, 12345, hostname(), {
+        bootIdentity: 'same-boot',
+        processStartIdentity
+      })
+      clock += 60_000
+      // Linux identity emulation must not change the host filesystem's publication/fsync flags.
+      expect(() => reclaimExitedOwner(profileStateAccessPaths(path).maintenance)).toThrow(
+        'unverifiable'
+      )
+      expect(fs.existsSync(owner)).toBe(true)
+      expect(wallStart).not.toHaveBeenCalled()
+    } finally {
+      Object.defineProperty(process, 'platform', platform)
+    }
+  })
+
+  it('does not compare legacy epoch timestamps with raw process identity', () => {
+    const path = root()
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('same-boot')
+    vi.spyOn(identity, 'profileStateAccessProcessIdentity').mockReturnValue(
+      'linux-start-ticks:2000'
+    )
+    const owner = staleGate(path, process.pid, hostname(), {
+      bootIdentity: 'same-boot',
+      startedAtMs: 1000
+    })
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+    expect(fs.existsSync(owner)).toBe(true)
+  })
+
+  it.each([
+    'wall-time-ms:1000',
+    'linux-start-ticks:invalid',
+    'linux-start-ticks:99999999999999999'
+  ])('does not compare incompatible or malformed identity %s', (recorded) => {
+    const path = root()
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('same-boot')
+    vi.spyOn(identity, 'profileStateAccessProcessIdentity').mockReturnValue(
+      'linux-start-ticks:2000'
+    )
+    const owner = staleGate(path, process.pid, hostname(), {
+      bootIdentity: 'same-boot',
+      processStartIdentity: recorded
+    })
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+    expect(fs.existsSync(owner)).toBe(true)
+  })
+
+  it('does not interpret an unavailable process start as proof of PID reuse', () => {
+    const path = root()
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('same-boot')
+    vi.spyOn(identity, 'profileStateAccessProcessIdentity').mockReturnValue(null)
+    const owner = staleGate(path, process.pid, hostname(), {
+      bootIdentity: 'same-boot',
+      processStartIdentity: 'linux-start-ticks:1000'
+    })
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+    expect(fs.existsSync(owner)).toBe(true)
+  })
+
+  it.each([
+    ['darwin-utc-start-ms:100000', 'darwin-utc-start-ms:101000', false],
+    ['darwin-utc-start-ms:100000', 'darwin-utc-start-ms:101501', true],
+    ['wall-time-ms:100000', 'darwin-utc-start-ms:3700000', false]
+  ] as const)('compares macOS start identities safely: %s / %s', (recorded, actual, exited) => {
+    const path = root()
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('same-boot')
+    vi.spyOn(identity, 'profileStateAccessProcessIdentity').mockReturnValue(actual)
+    const owner = staleGate(path, process.pid, hostname(), {
+      bootIdentity: 'same-boot',
+      processStartIdentity: recorded
+    })
+    if (exited) {
+      acquireProfileStateMaintenance(path).release()
+      expect(fs.existsSync(owner)).toBe(false)
+    } else {
+      expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+      expect(fs.existsSync(owner)).toBe(true)
+    }
+  })
+
+  it('retries a transient Windows owner publication lock', () => {
+    const platform = Object.getOwnPropertyDescriptor(process, 'platform')
+    if (!platform) {
+      throw new Error('Missing platform descriptor')
+    }
+    const path = root()
+    const rename = fs.renameSync
+    const publish = vi
+      .spyOn(fs, 'renameSync')
+      .mockImplementationOnce(() => {
+        throw Object.assign(new Error('scanner holds directory'), { code: 'EPERM' })
+      })
+      .mockImplementation(rename)
+    vi.spyOn(Atomics, 'wait').mockReturnValue('timed-out')
+    try {
+      Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+      const admission = acquireProfileStateRuntimeAdmission(path)
+      expect(publish).toHaveBeenCalledTimes(2)
+      admission.release()
+      expect(fs.readdirSync(profileStateAccessPaths(path).participants)).toEqual([])
+    } finally {
+      Object.defineProperty(process, 'platform', platform)
+    }
+  })
+
+  it.skipIf(process.platform === 'win32')(
+    'recognizes an exited owner after a hostname change on the same kernel boot',
+    () => {
+      const path = root()
+      vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('same-boot')
+      const owner = staleGate(path, 12345, 'previous-hostname', { bootIdentity: 'same-boot' })
+      vi.spyOn(process, 'kill').mockImplementation(() => {
+        throw Object.assign(new Error('exited'), { code: 'ESRCH' })
+      })
+      acquireProfileStateMaintenance(path).release()
+      expect(fs.existsSync(owner)).toBe(false)
+    }
+  )
+
+  it('keeps a differently booted host unverifiable after a hostname change', () => {
+    const path = root()
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('different-boot')
+    const owner = staleGate(path, 12345, 'previous-hostname', { bootIdentity: 'owner-boot' })
+    const kill = vi.spyOn(process, 'kill')
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('verify PID 12345')
+    expect(kill).not.toHaveBeenCalled()
+    expect(fs.existsSync(owner)).toBe(true)
+  })
+
+  it('does not infer exit from a PID in another platform on a shared root', () => {
+    const path = root()
+    const owner = staleGate(path)
+    const record: unknown = JSON.parse(fs.readFileSync(owner, 'utf8'))
+    if (typeof record !== 'object' || record === null) {
+      throw new Error('Owner fixture missing')
+    }
+    fs.writeFileSync(
+      owner,
+      JSON.stringify({ ...record, platform: process.platform === 'win32' ? 'linux' : 'win32' })
+    )
+    const kill = vi.spyOn(process, 'kill').mockImplementation(() => {
+      throw Object.assign(new Error('absent here'), { code: 'ESRCH' })
+    })
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+    expect(kill).not.toHaveBeenCalled()
+    expect(fs.existsSync(owner)).toBe(true)
+  })
+
+  it.skipIf(process.platform !== 'linux')(
+    'refuses a different Linux PID namespace even with the same hostname',
+    () => {
+      const path = root()
+      const owner = staleGate(path)
+      const record: unknown = JSON.parse(fs.readFileSync(owner, 'utf8'))
+      if (typeof record !== 'object' || record === null) {
+        throw new Error('Owner fixture missing')
+      }
+      fs.writeFileSync(owner, JSON.stringify({ ...record, pidNamespace: 'pid:[foreign]' }))
+      expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+      expect(fs.existsSync(owner)).toBe(true)
+    }
+  )
+
+  it.each(['EPERM', 'EINVAL', 'EACCES'])('refuses unverifiable process query %s', (code) => {
+    const path = root()
+    const owner = staleGate(path)
+    vi.spyOn(process, 'kill').mockImplementation(() => {
+      throw Object.assign(new Error(code), { code })
+    })
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+    expect(fs.existsSync(owner)).toBe(true)
+  })
+
+  it('refuses live reused PIDs regardless of old timestamps', () => {
+    const path = root()
+    const owner = staleGate(path, process.pid)
+    fs.utimesSync(owner, 0, 0)
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('in use')
+    expect(fs.existsSync(owner)).toBe(true)
+  })
+
+  it('refuses foreign host and malformed owners without reclaiming them', () => {
+    const path = root()
+    const owner = staleGate(path, process.pid, `${hostname()}-other`)
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+    fs.writeFileSync(owner, '{}')
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('malformed')
+    expect(fs.existsSync(owner)).toBe(true)
+  })
+
+  it('cannot remove a replacement published while it releases its own token', () => {
+    const path = root()
+    const original = acquireProfileStateMaintenance(path)
+    const unlink = fs.unlinkSync
+    let replacement: ProfileStateMaintenance | undefined
+    let intercepted = false
+    vi.spyOn(fs, 'unlinkSync').mockImplementation((entry) => {
+      unlink(entry)
+      if (!intercepted && String(entry).includes('maintenance')) {
+        intercepted = true
+        replacement = acquireProfileStateMaintenance(path)
+      }
+    })
+    original.release()
+    expect(replacement).toBeDefined()
+    replacement?.assertActive()
+    expect(() => acquireProfileStateRuntimeAdmission(path)).toThrow('in use')
+    replacement?.release()
+  })
+
+  it('cannot remove a replacement published after stale-owner observation', () => {
+    const path = root()
+    const old = staleGate(path)
+    const kill = process.kill
+    vi.spyOn(process, 'kill').mockImplementation((pid, signal) => {
+      if (pid === 12345) {
+        throw Object.assign(new Error('exited'), { code: 'ESRCH' })
+      }
+      return kill(pid, signal)
+    })
+    const unlink = fs.unlinkSync
+    let replacement: ProfileStateMaintenance | undefined
+    vi.spyOn(fs, 'unlinkSync').mockImplementation((entry) => {
+      unlink(entry)
+      if (entry === old) {
+        replacement = acquireProfileStateMaintenance(path)
+      }
+    })
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('in use')
+    replacement?.assertActive()
+    expect(replacement).toBeDefined()
+    replacement?.release()
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-access.ts b/src/main/persistence/profile-state/profile-state-access.ts
new file mode 100644
index 00000000000..724549dc7de
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-access.ts
@@ -0,0 +1,99 @@
+import { lstatSync, readdirSync, realpathSync } from 'node:fs'
+import { basename, dirname, join } from 'node:path'
+import {
+  ProfileStateAccessError,
+  hasCode,
+  profileStateAccessPaths,
+  publishAccessOwner,
+  reclaimExitedOwner
+} from './profile-state-access-owner'
+export { ProfileStateAccessError } from './profile-state-access-owner'
+
+export type ProfileStateRuntimeAdmission = {
+  assertActive(): void
+  release(): void
+}
+
+export type ProfileStateMaintenance = ProfileStateRuntimeAdmission & {
+  assertProfile(profileId: string, dataFile: string, databasePath: string): void
+}
+
+const maintenanceRoots = new WeakMap<ProfileStateMaintenance, string>()
+
+/** Bind destructive operations to a genuine, live maintenance owner for these exact profile paths. */
+export function assertProfileStateMaintenance(
+  maintenance: ProfileStateMaintenance,
+  profile: { profileId: string; dataFile: string; databasePath: string }
+): void {
+  const root = maintenanceRoots.get(maintenance)
+  if (root === undefined || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(profile.profileId)) {
+    throw new ProfileStateAccessError(
+      'Profile state recovery requires an acquired maintenance owner'
+    )
+  }
+  maintenance.assertActive()
+  const expectedDirectory = join(root, 'profiles', profile.profileId)
+  for (const [path, expectedName] of [
+    [profile.dataFile, 'orca-data.json'],
+    [profile.databasePath, 'profile-state.db']
+  ] as const) {
+    if (
+      !samePath(realpathSync(dirname(path)), expectedDirectory) ||
+      !samePath(basename(path), expectedName)
+    ) {
+      throw new ProfileStateAccessError(
+        'Profile state recovery paths do not belong to the maintenance root'
+      )
+    }
+    try {
+      if (lstatSync(path).isSymbolicLink()) {
+        throw new ProfileStateAccessError('Profile state recovery cannot replace a symbolic link')
+      }
+    } catch (error) {
+      if (!hasCode(error, 'ENOENT')) {
+        throw error
+      }
+    }
+  }
+}
+
+function samePath(left: string, right: string): boolean {
+  return process.platform === 'win32' ? left.toLowerCase() === right.toLowerCase() : left === right
+}
+
+/** Admit before any profile read, and retain until every Store and worker has stopped. */
+export function acquireProfileStateRuntimeAdmission(
+  userDataPath: string
+): ProfileStateRuntimeAdmission {
+  const paths = profileStateAccessPaths(userDataPath)
+  const owner = publishAccessOwner(paths, false)
+  try {
+    reclaimExitedOwner(paths.maintenance)
+    return owner
+  } catch (error) {
+    owner.release()
+    throw error
+  }
+}
+
+/** Exclude startup and all participating readers/writers through durable recovery publication. */
+export function acquireProfileStateMaintenance(userDataPath: string): ProfileStateMaintenance {
+  const paths = profileStateAccessPaths(userDataPath)
+  const owner = publishAccessOwner(paths, true)
+  try {
+    for (const entry of readdirSync(paths.participants)) {
+      reclaimExitedOwner(join(paths.participants, entry))
+    }
+    const maintenance: ProfileStateMaintenance = {
+      ...owner,
+      assertProfile(profileId, dataFile, databasePath): void {
+        assertProfileStateMaintenance(maintenance, { profileId, dataFile, databasePath })
+      }
+    }
+    maintenanceRoots.set(maintenance, dirname(paths.root))
+    return maintenance
+  } catch (error) {
+    owner.release()
+    throw error
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-active-location.ts b/src/main/persistence/profile-state/profile-state-active-location.ts
new file mode 100644
index 00000000000..15c38fe3ac1
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-active-location.ts
@@ -0,0 +1,49 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import {
+  getOrcaProfileDataFile,
+  getOrcaProfileStateDatabaseFile
+} from '../../../shared/profile-state-storage-paths'
+import type { ProfileStateOfflineLocation } from './profile-state-offline-settings'
+import { ProfileStateRecoveryCommandError } from '../../../shared/profile-state-recovery-command'
+
+/** Resolve the active profile files for offline profile-state commands. */
+export function getActiveProfileStateLocation(
+  userDataPath: string
+): ProfileStateOfflineLocation | undefined {
+  const indexPath = join(userDataPath, 'orca-profile-index.json')
+  const candidates = [indexPath, `${indexPath}.bak`].filter(existsSync)
+  if (candidates.length === 0) {
+    return undefined
+  }
+  for (const candidate of candidates) {
+    try {
+      const parsed: unknown = JSON.parse(readFileSync(candidate, 'utf-8'))
+      if (!isRecord(parsed) || !Array.isArray(parsed.profiles)) {
+        continue
+      }
+      const profileId = parsed.activeProfileId
+      if (
+        typeof profileId === 'string' &&
+        /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(profileId) &&
+        parsed.profiles.some((profile) => isRecord(profile) && profile.id === profileId)
+      ) {
+        return {
+          dataFile: getOrcaProfileDataFile(profileId, userDataPath),
+          databaseFile: getOrcaProfileStateDatabaseFile(profileId, userDataPath),
+          profileId
+        }
+      }
+    } catch {
+      // Try the profile-index backup before failing closed.
+    }
+  }
+  throw new ProfileStateRecoveryCommandError(
+    'runtime_error',
+    `Could not read active profile index ${indexPath}`
+  )
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
diff --git a/src/main/persistence/profile-state/profile-state-authority-bootstrap.test.ts b/src/main/persistence/profile-state/profile-state-authority-bootstrap.test.ts
new file mode 100644
index 00000000000..8d7b7f72674
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-authority-bootstrap.test.ts
@@ -0,0 +1,544 @@
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, dirname, join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import Database from '../../sqlite/sync-database'
+import { openProfileStateDatabase, profileStateDatabaseFile } from './profile-state-database'
+import * as profileStateDocuments from './profile-state-documents'
+import { profileStateJsonExportPath } from './legacy-json/profile-state-export-path'
+import { acquireProfileStateMaintenance } from './profile-state-access'
+import { restoreProfileStateJsonExport } from './legacy-json/profile-state-recovery'
+import {
+  bootstrapProfileStateAuthority as bootstrapProfileStateAuthorityImpl,
+  classifyProfileStateStorage,
+  ProfileStateAuthorityBootstrapError,
+  ProfileStateRecoveryRequiredError
+} from './profile-state-authority-bootstrap'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (value: string) => Buffer.from(`encrypted:${value}`, 'utf8'),
+    decryptString: (value: Buffer) => value.toString('utf8').slice('encrypted:'.length)
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: vi.fn(() => ({ nth_repo_added: 2 }))
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: vi.fn(() => ({ hosts: [] })),
+  sshConfigHostsToTargets: vi.fn(() => [])
+}))
+
+const { Store } = await import('../loading-store/store')
+
+const temporaryDirectories: string[] = []
+const authoritiesToClose: NonNullable<
+  ReturnType<typeof bootstrapProfileStateAuthorityImpl>['authority']
+>[] = []
+
+function bootstrapProfileStateAuthority(
+  options: Parameters<typeof bootstrapProfileStateAuthorityImpl>[0]
+): ReturnType<typeof bootstrapProfileStateAuthorityImpl> {
+  const result = bootstrapProfileStateAuthorityImpl(options)
+  if (result.authority !== undefined) {
+    authoritiesToClose.push(result.authority)
+  }
+  return result
+}
+
+afterEach(() => {
+  for (const authority of authoritiesToClose.splice(0)) {
+    authority.close?.()
+  }
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+
+function createDirectory(): string {
+  const root = mkdtempSync(join(tmpdir(), 'orca-profile-state-bootstrap-'))
+  temporaryDirectories.push(root)
+  const directory = join(root, 'profiles', 'profile-bootstrap-test')
+  mkdirSync(directory, { recursive: true })
+  return directory
+}
+
+function paths(directory: string): {
+  dataFile: string
+  databaseFile: string
+  profileId: string
+} {
+  return {
+    dataFile: join(directory, 'orca-data.json'),
+    databaseFile: profileStateDatabaseFile(directory),
+    profileId: 'profile-bootstrap-test'
+  }
+}
+
+describe('profile state authority bootstrap', () => {
+  it('classifies all four storage-presence states without opening SQLite', () => {
+    const directory = createDirectory()
+    const { dataFile, databaseFile } = paths(directory)
+
+    expect(classifyProfileStateStorage(dataFile, databaseFile)).toBe('neither')
+    writeFileSync(dataFile, '{}')
+    expect(classifyProfileStateStorage(dataFile, databaseFile)).toBe('json-only')
+
+    const opened = openProfileStateDatabase(databaseFile, 'profile-bootstrap-test')
+    opened.db.close()
+    expect(classifyProfileStateStorage(dataFile, databaseFile)).toBe('both')
+
+    rmSync(dataFile)
+    expect(classifyProfileStateStorage(dataFile, databaseFile)).toBe('sqlite-only')
+  })
+
+  it('imports JSON-only state through Store export and returns the SQLite authority', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(
+      options.dataFile,
+      JSON.stringify({ settings: { theme: 'dark' }, futureExtension: { keep: true } })
+    )
+
+    const result = bootstrapProfileStateAuthority(options)
+
+    expect(result.classification).toBe('json-only')
+    expect(result.migrated).toBe(true)
+    expect(result.authority?.readSerializedState()).toContain('futureExtension')
+    expect(existsSync(options.dataFile)).toBe(true)
+    expect(existsSync(profileStateJsonExportPath(options.dataFile, 1))).toBe(true)
+    expect(readFileSync(profileStateJsonExportPath(options.dataFile, 1), 'utf8')).toContain(
+      'futureExtension'
+    )
+    expect(classifyProfileStateStorage(options.dataFile, options.databaseFile)).toBe('both')
+
+    if (result.authority === undefined) {
+      throw new Error('JSON migration did not return a SQLite authority')
+    }
+    const store = new Store({
+      dataFile: options.dataFile,
+      profileStateAuthority: result.authority
+    })
+    expect(store.getSettings().theme).toBe('dark')
+
+    const repeated = bootstrapProfileStateAuthority(options)
+    expect(repeated.authority?.readSerializedState()).toContain('futureExtension')
+  })
+
+  it('fails closed when both files are present without a matching acceptance marker', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    const opened = openProfileStateDatabase(options.databaseFile, options.profileId)
+    opened.db.close()
+
+    expect(() => bootstrapProfileStateAuthority(options)).toThrowError(
+      ProfileStateAuthorityBootstrapError
+    )
+  })
+
+  it('rejects a legacy JSON edit after migration instead of selecting stale SQLite state', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    bootstrapProfileStateAuthority(options)
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'light' } }))
+
+    expect(() => bootstrapProfileStateAuthority(options)).toThrowError(
+      ProfileStateAuthorityBootstrapError
+    )
+  })
+
+  it.each([1, 2])(
+    'requires explicit recovery for unreleased schema %s without changing its bytes',
+    (version) => {
+      const options = paths(createDirectory())
+      const raw = JSON.stringify({ settings: { theme: 'dark' }, futureDomain: { retained: true } })
+      const opened = openProfileStateDatabase(options.databaseFile, options.profileId)
+      profileStateDocuments.importProfileStateJson(opened.db, raw, {
+        acceptedLegacyJsonHash: profileStateDocuments.hashProfileStateJson(raw)
+      })
+      if (version === 1) {
+        opened.db.exec(
+          'DROP TABLE profile_state_automation_runs; DROP TABLE profile_state_automation_runs_meta'
+        )
+      } else {
+        opened.db.exec('DELETE FROM profile_state_automation_runs_meta')
+      }
+      opened.db.pragma(`user_version = ${version}`)
+      opened.db.close()
+      const before = readFileSync(options.databaseFile)
+      for (const withJson of [false, true]) {
+        if (withJson) {
+          writeFileSync(options.dataFile, raw)
+        }
+        expect(() => bootstrapProfileStateAuthority(options)).toThrow(
+          ProfileStateRecoveryRequiredError
+        )
+        expect(readFileSync(options.databaseFile)).toEqual(before)
+      }
+      const exportPath = profileStateJsonExportPath(options.dataFile, 1)
+      writeFileSync(exportPath, raw)
+      restoreProfileStateJsonExport({
+        maintenance: acquireProfileStateMaintenance(dirname(dirname(dirname(options.dataFile)))),
+        databasePath: options.databaseFile,
+        dataFile: options.dataFile,
+        profileId: options.profileId,
+        exportPath
+      })
+      const recovered = bootstrapProfileStateAuthority(options)
+      expect(recovered.migrated).toBe(true)
+      expect(JSON.parse(recovered.authority?.readSerializedState() ?? '{}')).toMatchObject({
+        futureDomain: { retained: true }
+      })
+    }
+  )
+
+  it('returns no authority for a brand-new profile', () => {
+    const directory = createDirectory()
+    const result = bootstrapProfileStateAuthority(paths(directory))
+
+    expect(result).toEqual({ classification: 'neither', authority: undefined, migrated: false })
+  })
+
+  it('cleans failed empty-profile initialization before a successful retry', () => {
+    const directory = createDirectory()
+    const options = { ...paths(directory), allowEmptyProfileState: true }
+    const initializationFailure = new Error('injected initial schema failure')
+    const originalExec = Database.prototype.exec
+    const execSpy = vi.spyOn(Database.prototype, 'exec').mockImplementation(function (
+      this: Database,
+      sql
+    ) {
+      originalExec.call(this, sql)
+      if (sql.includes('CREATE TABLE')) {
+        const row = this.prepare('PRAGMA database_list').get()
+        if (typeof row?.file !== 'string') {
+          throw new Error('Expected a file-backed database during initialization')
+        }
+        expect(existsSync(`${row.file}-journal`)).toBe(true)
+        for (const suffix of ['-wal', '-shm']) {
+          writeFileSync(`${row.file}${suffix}`, 'interrupted schema initialization')
+        }
+        throw initializationFailure
+      }
+    })
+
+    expect(() => bootstrapProfileStateAuthority(options)).toThrowError(
+      expect.objectContaining({ cause: initializationFailure })
+    )
+    expect(existsSync(options.databaseFile)).toBe(false)
+    expect(classifyProfileStateStorage(options.dataFile, options.databaseFile)).toBe('neither')
+    expect(readdirSync(directory)).toEqual([])
+
+    execSpy.mockRestore()
+    const retry = bootstrapProfileStateAuthority(options)
+    expect(retry.migrated).toBe(false)
+    expect(retry.authority).toBeDefined()
+    expect(retry.authority?.readSerializedState()).toBeUndefined()
+    expect(bootstrapProfileStateAuthority(options).classification).toBe('sqlite-only')
+  })
+
+  it('preserves JSON created while an empty database is being initialized', () => {
+    const options = { ...paths(createDirectory()), allowEmptyProfileState: true }
+    const source = '{"settings":{"theme":"dark"}}'
+    const originalClose = Database.prototype.close
+    vi.spyOn(Database.prototype, 'close').mockImplementationOnce(function (this: Database) {
+      originalClose.call(this)
+      writeFileSync(options.dataFile, source)
+    })
+
+    expect(() => bootstrapProfileStateAuthority(options)).toThrow(
+      'Profile state storage changed while creating an empty database'
+    )
+    expect(readFileSync(options.dataFile, 'utf8')).toBe(source)
+    expect(readdirSync(dirname(options.dataFile))).toEqual(['orca-data.json'])
+  })
+
+  it.each(['legacy-backup', 'sqlite-export'])(
+    'preserves a %s created while an empty database is being initialized',
+    (artifact) => {
+      const options = { ...paths(createDirectory()), allowEmptyProfileState: true }
+      const path =
+        artifact === 'legacy-backup'
+          ? `${options.dataFile}.bak.0`
+          : profileStateJsonExportPath(options.dataFile, 1)
+      const source = '{"settings":{"theme":"dark"}}'
+      const originalClose = Database.prototype.close
+      vi.spyOn(Database.prototype, 'close').mockImplementationOnce(function (this: Database) {
+        originalClose.call(this)
+        writeFileSync(path, source)
+      })
+
+      expect(() => bootstrapProfileStateAuthority(options)).toThrow()
+      expect(existsSync(options.databaseFile)).toBe(false)
+      expect(existsSync(options.dataFile)).toBe(false)
+      expect(readFileSync(path, 'utf8')).toBe(source)
+      expect(readdirSync(dirname(path))).toEqual([basename(path)])
+    }
+  )
+
+  it.each(['-wal', '-shm', '-journal'])(
+    'treats an orphaned SQLite %s sidecar as authority evidence with or without JSON',
+    (suffix) => {
+      const options = paths(createDirectory())
+      const sidecar = `${options.databaseFile}${suffix}`
+      writeFileSync(sidecar, 'orphaned recovery evidence')
+
+      expect(classifyProfileStateStorage(options.dataFile, options.databaseFile)).toBe(
+        'sqlite-only'
+      )
+      expect(() => bootstrapProfileStateAuthority(options)).toThrow()
+      writeFileSync(options.dataFile, '{"settings":{"theme":"dark"}}')
+      expect(classifyProfileStateStorage(options.dataFile, options.databaseFile)).toBe('both')
+      expect(() => bootstrapProfileStateAuthority(options)).toThrow()
+      expect(existsSync(options.databaseFile)).toBe(false)
+      expect(readFileSync(sidecar, 'utf8')).toBe('orphaned recovery evidence')
+      expect(readFileSync(options.dataFile, 'utf8')).toBe('{"settings":{"theme":"dark"}}')
+    }
+  )
+
+  it('validates and returns an existing SQLite-only authority', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    const opened = openProfileStateDatabase(options.databaseFile, options.profileId)
+    opened.db.close()
+
+    const result = bootstrapProfileStateAuthority(options)
+
+    expect(result.classification).toBe('sqlite-only')
+    expect(result.migrated).toBe(false)
+    expect(result.authority?.readSerializedState()).toBeUndefined()
+  })
+
+  it('rejects malformed SQLite-only state before Store can select it', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.databaseFile, 'not sqlite')
+
+    expect(() => bootstrapProfileStateAuthority(options)).toThrow()
+  })
+
+  it('reports retained exports when an established SQLite profile needs recovery', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    const bootstrap = bootstrapProfileStateAuthority(options)
+    bootstrap.authority?.close?.()
+    const exportPath = profileStateJsonExportPath(options.dataFile, 1)
+    const exportPathRevision2 = profileStateJsonExportPath(options.dataFile, 2)
+    const exportPathRevision10 = profileStateJsonExportPath(options.dataFile, 10)
+    writeFileSync(exportPathRevision2, readFileSync(exportPath))
+    writeFileSync(exportPathRevision10, readFileSync(exportPath))
+    writeFileSync(
+      `${options.dataFile}.sqlite-export.9007199254740992.json`,
+      readFileSync(exportPath)
+    )
+    writeFileSync(options.databaseFile, 'not sqlite')
+
+    try {
+      bootstrapProfileStateAuthority(options)
+      throw new Error('expected recovery-required startup failure')
+    } catch (error) {
+      expect(error).toBeInstanceOf(ProfileStateRecoveryRequiredError)
+      if (!(error instanceof ProfileStateRecoveryRequiredError)) {
+        throw error
+      }
+      expect(error.dataFile).toBe(options.dataFile)
+      expect(error.databaseFile).toBe(options.databaseFile)
+      expect(error.exportPaths).toEqual([exportPathRevision10, exportPathRevision2, exportPath])
+    }
+  })
+
+  it('does not create a database when the legacy JSON cannot be imported', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.dataFile, '{ malformed')
+
+    expect(() => bootstrapProfileStateAuthority(options)).toThrow(
+      'Failed to load imported profile state'
+    )
+    expect(existsSync(options.databaseFile)).toBe(false)
+  })
+
+  it.each([0, 1, 2, 3, 4])(
+    'migrates usable legacy backup slot %s after a corrupt primary',
+    (slot) => {
+      const options = paths(createDirectory())
+      const damaged = '{ malformed primary'
+      const recovered = JSON.stringify({ settings: { theme: 'dark' }, retainedBackup: slot })
+      writeFileSync(options.dataFile, damaged)
+      for (let index = 0; index < slot; index += 1) {
+        writeFileSync(`${options.dataFile}.bak.${index}`, '{ damaged backup')
+      }
+      writeFileSync(`${options.dataFile}.bak.${slot}`, recovered)
+
+      const result = bootstrapProfileStateAuthority(options)
+      expect(result.migrated).toBe(true)
+      expect(JSON.parse(result.authority?.readSerializedState() ?? '{}')).toMatchObject({
+        settings: { theme: 'dark' },
+        retainedBackup: slot
+      })
+      expect(readFileSync(options.dataFile, 'utf8')).toBe(damaged)
+      expect(readFileSync(`${options.dataFile}.bak.${slot}`, 'utf8')).toBe(recovered)
+      expect(bootstrapProfileStateAuthority(options).migrated).toBe(false)
+    }
+  )
+
+  it('preserves every source when legacy primary and backups are unusable', () => {
+    const options = paths(createDirectory())
+    writeFileSync(options.dataFile, '{ malformed primary')
+    writeFileSync(`${options.dataFile}.bak.0`, '{ malformed backup')
+    expect(() => bootstrapProfileStateAuthority(options)).toThrow(
+      ProfileStateAuthorityBootstrapError
+    )
+    expect(readFileSync(options.dataFile, 'utf8')).toBe('{ malformed primary')
+    expect(readFileSync(`${options.dataFile}.bak.0`, 'utf8')).toBe('{ malformed backup')
+    expect(existsSync(options.databaseFile)).toBe(false)
+  })
+
+  it('cleans a temporary database when import fails after opening SQLite', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    const importFailure = new Error('injected import failure')
+    const importSpy = vi
+      .spyOn(profileStateDocuments, 'importProfileStateJson')
+      .mockImplementation(() => {
+        throw importFailure
+      })
+
+    expect(() => bootstrapProfileStateAuthority(options)).toThrow(importFailure)
+    expect(classifyProfileStateStorage(options.dataFile, options.databaseFile)).toBe('json-only')
+    expect(existsSync(options.databaseFile)).toBe(false)
+    expect(
+      readdirSync(directory).some((name) => name.includes('.migration.') && name.endsWith('.tmp'))
+    ).toBe(false)
+
+    importSpy.mockRestore()
+    const retry = bootstrapProfileStateAuthority(options)
+    expect(retry.migrated).toBe(true)
+    expect(retry.authority?.readSerializedState()).toContain('"dark"')
+  })
+
+  it('refuses a pre-existing retained export before migrating JSON again', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    const exportPath = profileStateJsonExportPath(options.dataFile, 1)
+    mkdirSync(exportPath)
+
+    expect(() => bootstrapProfileStateAuthority(options)).toThrow()
+    expect(existsSync(options.dataFile)).toBe(true)
+    expect(existsSync(options.databaseFile)).toBe(false)
+
+    rmSync(exportPath, { recursive: true })
+    const retry = bootstrapProfileStateAuthority(options)
+    expect(retry.classification).toBe('json-only')
+    expect(retry.migrated).toBe(true)
+    expect(retry.authority?.readSerializedState()).toContain('"dark"')
+  })
+
+  it('boots the revisioned export through the legacy Store after SQLite corruption', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    bootstrapProfileStateAuthority(options)
+    const exportPath = profileStateJsonExportPath(options.dataFile, 1)
+
+    writeFileSync(options.databaseFile, 'corrupt sqlite primary')
+    writeFileSync(options.dataFile, readFileSync(exportPath))
+    const rollbackStore = new Store({
+      dataFile: options.dataFile,
+      serializedState: readFileSync(options.dataFile, 'utf8')
+    })
+    expect(rollbackStore.getSettings().theme).toBe('dark')
+    rollbackStore.freezeWrites()
+  })
+
+  it('quarantines SQLite and restores a selected export for legacy rollback', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    const bootstrap = bootstrapProfileStateAuthority(options)
+    bootstrap.authority?.close?.()
+    const exportPath = profileStateJsonExportPath(options.dataFile, 1)
+    writeFileSync(options.databaseFile, 'corrupt sqlite primary')
+    writeFileSync(`${options.databaseFile}-wal`, 'corrupt wal sidecar')
+    const restoredJson = readFileSync(exportPath)
+
+    const result = restoreProfileStateJsonExport({
+      maintenance: acquireProfileStateMaintenance(dirname(dirname(dirname(options.dataFile)))),
+      databasePath: options.databaseFile,
+      dataFile: options.dataFile,
+      profileId: options.profileId,
+      exportPath,
+      quarantineRoot: join(directory, 'quarantine')
+    })
+
+    expect(result.removedDatabaseFiles).toEqual(
+      expect.arrayContaining([options.databaseFile, `${options.databaseFile}-wal`])
+    )
+    expect(existsSync(options.databaseFile)).toBe(false)
+    expect(readFileSync(options.dataFile)).toEqual(restoredJson)
+    expect(existsSync(exportPath)).toBe(false)
+    expect(readFileSync(join(result.quarantine.directory, 'profile-state.db'), 'utf8')).toBe(
+      'corrupt sqlite primary'
+    )
+    expect(readFileSync(join(result.quarantine.directory, 'profile-state.db-wal'), 'utf8')).toBe(
+      'corrupt wal sidecar'
+    )
+
+    const rollbackStore = new Store({
+      dataFile: options.dataFile,
+      serializedState: readFileSync(options.dataFile, 'utf8')
+    })
+    expect(rollbackStore.getSettings().theme).toBe('dark')
+    rollbackStore.freezeWrites()
+  })
+
+  it('validates the selected export before quarantining or replacing anything', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    bootstrapProfileStateAuthority(options)
+    const exportPath = profileStateJsonExportPath(options.dataFile, 1)
+    writeFileSync(exportPath, '{ malformed')
+    const databaseBytes = readFileSync(options.databaseFile)
+    const dataBytes = readFileSync(options.dataFile)
+
+    expect(() =>
+      restoreProfileStateJsonExport({
+        maintenance: acquireProfileStateMaintenance(dirname(dirname(dirname(options.dataFile)))),
+        databasePath: options.databaseFile,
+        dataFile: options.dataFile,
+        profileId: options.profileId,
+        exportPath
+      })
+    ).toThrow('Profile state JSON is invalid')
+    expect(readFileSync(options.databaseFile)).toEqual(databaseBytes)
+    expect(readFileSync(options.dataFile)).toEqual(dataBytes)
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-authority-bootstrap.ts b/src/main/persistence/profile-state/profile-state-authority-bootstrap.ts
new file mode 100644
index 00000000000..7056b8aec9f
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-authority-bootstrap.ts
@@ -0,0 +1,152 @@
+import { existsSync, mkdirSync, readFileSync, rmSync } from 'node:fs'
+import { randomUUID } from 'node:crypto'
+import { dirname } from 'node:path'
+import { publishProfileStateDatabase } from './profile-state-database-publication'
+import type { ProfileStateAuthorityInitialState } from '../loading-store/profile-state-authority'
+import { isProfileStateSqliteAvailable, openProfileStateDatabase } from './profile-state-database'
+import { ProfileStateDatabaseOpenError } from './profile-state-database-errors'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { migrateProfileStateToSqlite } from './profile-state-migration'
+import { prepareLegacyProfileState } from './legacy-json/profile-state-legacy-import'
+import {
+  assertProfileStateCanInitialize,
+  ProfileStateAuthorityBootstrapError,
+  ProfileStateRecoveryRequiredError
+} from './profile-state-recovery-required'
+export {
+  ProfileStateAuthorityBootstrapError,
+  ProfileStateRecoveryRequiredError
+} from './profile-state-recovery-required'
+import {
+  classifyProfileStateStorage,
+  profileStateDatabaseFiles,
+  type ProfileStateStorageClassification
+} from './profile-state-storage-classification'
+
+export { classifyProfileStateStorage } from './profile-state-storage-classification'
+export type { ProfileStateStorageClassification } from './profile-state-storage-classification'
+
+export type ProfileStateAuthorityBootstrapResult = {
+  classification: ProfileStateStorageClassification
+  migrated: boolean
+} & (
+  | {
+      authority: ProfileStateSqliteAuthority
+      initialState: ProfileStateAuthorityInitialState<ProfileStateSqliteAuthority>
+    }
+  | { authority: undefined; initialState?: never }
+)
+
+export type ProfileStateAuthorityBootstrapOptions = {
+  dataFile: string
+  databaseFile: string
+  profileId: string
+  /** Establish empty profiles before their first Store write. */
+  allowEmptyProfileState?: boolean
+}
+
+/** Normalize legacy state once, then hand one validated authority to Store. */
+export function bootstrapProfileStateAuthority(
+  options: ProfileStateAuthorityBootstrapOptions
+): ProfileStateAuthorityBootstrapResult {
+  const classification = classifyProfileStateStorage(options.dataFile, options.databaseFile)
+  if (classification === 'neither' && options.allowEmptyProfileState !== true) {
+    return { classification, authority: undefined, migrated: false }
+  }
+  if (!isProfileStateSqliteAvailable()) {
+    if (classification === 'neither' || classification === 'json-only') {
+      return { classification, authority: undefined, migrated: false }
+    }
+    throw new ProfileStateAuthorityBootstrapError(
+      'SQLite profile state is present but this runtime cannot validate it'
+    )
+  }
+  if (classification === 'json-only' || classification === 'neither') {
+    assertProfileStateCanInitialize(options)
+  }
+  if (classification === 'json-only') {
+    return migrateJsonOnlyProfile(options)
+  }
+  if (classification === 'neither') {
+    mkdirSync(dirname(options.databaseFile), { recursive: true })
+    createEmptyProfileStateDatabase(options)
+  } else if (classification === 'sqlite-only' && !existsSync(options.databaseFile)) {
+    throw new ProfileStateAuthorityBootstrapError(
+      'SQLite profile state has an orphaned database sidecar'
+    )
+  }
+
+  const authority = new ProfileStateSqliteAuthority(options.databaseFile, options.profileId)
+  try {
+    const initialState =
+      classification === 'both'
+        ? authority.readAcceptedState(readFileSync(options.dataFile, 'utf8'))
+        : authority.readInitialState()
+    if (initialState === undefined) {
+      throw new ProfileStateAuthorityBootstrapError(
+        'Profile state has both JSON and SQLite storage without a matching acceptance marker',
+        'diverged-json'
+      )
+    }
+    return { classification, authority, initialState, migrated: false }
+  } catch (error) {
+    authority.close()
+    if (
+      error instanceof ProfileStateAuthorityBootstrapError ||
+      (error instanceof ProfileStateDatabaseOpenError && error.code === 'newer-schema')
+    ) {
+      throw error
+    }
+    throw new ProfileStateRecoveryRequiredError(options, error)
+  }
+}
+
+function createEmptyProfileStateDatabase({
+  dataFile,
+  databaseFile,
+  profileId
+}: ProfileStateAuthorityBootstrapOptions): void {
+  const temporaryDatabaseFile = `${databaseFile}.empty.${process.pid}.${randomUUID()}.tmp`
+  let published = false
+  try {
+    const opened = openProfileStateDatabase(temporaryDatabaseFile, profileId)
+    opened.db.close()
+    if (classifyProfileStateStorage(dataFile, databaseFile) !== 'neither') {
+      throw new ProfileStateAuthorityBootstrapError(
+        'Profile state storage changed while creating an empty database'
+      )
+    }
+    assertProfileStateCanInitialize({ dataFile, databaseFile, profileId })
+    if (!publishProfileStateDatabase(temporaryDatabaseFile, databaseFile)) {
+      throw new ProfileStateAuthorityBootstrapError(
+        'Profile state storage changed while creating an empty database'
+      )
+    }
+    published = true
+  } finally {
+    if (!published) {
+      for (const path of profileStateDatabaseFiles(temporaryDatabaseFile)) {
+        rmSync(path, { force: true })
+      }
+    }
+  }
+}
+
+function migrateJsonOnlyProfile(
+  options: ProfileStateAuthorityBootstrapOptions
+): ProfileStateAuthorityBootstrapResult {
+  const rawJson = readFileSync(options.dataFile, 'utf8')
+  const { prepared, unboundPaneAliases } = prepareLegacyProfileState(options.dataFile, rawJson)
+  const migrated = migrateProfileStateToSqlite({
+    ...options,
+    expectedLegacyJson: rawJson,
+    serializedState: prepared.json
+  })
+  prepared.commit()
+  return {
+    classification: 'json-only',
+    ...migrated,
+    initialState: { ...migrated.initialState, unboundPaneAliases },
+    migrated: true
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-authority-export-fencing.test.ts b/src/main/persistence/profile-state/profile-state-authority-export-fencing.test.ts
new file mode 100644
index 00000000000..b53dc25fd69
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-authority-export-fencing.test.ts
@@ -0,0 +1,43 @@
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { ProfileStateRevisionConflictError } from './profile-state-document-validation'
+
+describe('profile export snapshot revision', () => {
+  it.each(['json', 'compatibility-sync', 'compatibility-async'] as const)(
+    'refuses a competing revision before publishing %s',
+    async (kind) => {
+      const root = mkdtempSync(join(tmpdir(), 'orca-export-fence-'))
+      const database = join(root, 'profile-state.db')
+      const target = join(root, 'retained.json')
+      const owner = new ProfileStateSqliteAuthority(database, 'export-fence')
+      const peer = new ProfileStateSqliteAuthority(database, 'export-fence')
+      try {
+        owner.writeSerializedState(Buffer.from('{"settings":{"theme":"dark"}}'))
+        writeFileSync(target, 'retained export')
+        owner.assertCurrentRevision()
+        peer.readSerializedState()
+        peer.writeSerializedDomains([{ domain: 'settings', payload: '{"theme":"light"}' }])
+        await expect(
+          Promise.resolve().then(() => {
+            if (kind === 'json') {
+              return owner.writeJsonExport(target)
+            }
+            if (kind === 'compatibility-sync') {
+              return owner.writeJsonCompatibilityExport(target)
+            }
+            return owner.writeJsonCompatibilityExportAsync(target)
+          })
+        ).rejects.toBeInstanceOf(ProfileStateRevisionConflictError)
+        expect(readFileSync(target, 'utf8')).toBe('retained export')
+        expect(JSON.parse(peer.readSerializedState() ?? '{}').settings.theme).toBe('light')
+      } finally {
+        owner.close()
+        peer.close()
+        rmSync(root, { recursive: true, force: true })
+      }
+    }
+  )
+})
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs-equality.test.ts b/src/main/persistence/profile-state/profile-state-automation-runs-equality.test.ts
new file mode 100644
index 00000000000..8ac387db9aa
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs-equality.test.ts
@@ -0,0 +1,177 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { clearProfileStateAutomationRuns } from './profile-state-automation-runs'
+import { openProfileStateDatabase } from './profile-state-database'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateRevision,
+  readProfileStateSnapshot
+} from './profile-state-documents'
+import { writeProfileStateDomains } from './profile-state-domain-writes'
+
+const databases: { db: ReturnType<typeof openProfileStateDatabase>['db']; directory: string }[] = []
+
+function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-history-equality-'))
+  const { db } = openProfileStateDatabase(join(directory, 'state.db'), 'profile')
+  const runs = [{ id: 'run', extension: { content: '雪 🐋' } }]
+  const payload = JSON.stringify(runs)
+  importProfileStateJson(db, JSON.stringify({ settings: {}, automationRuns: runs }))
+  const result = { db, directory, runs, payload }
+  databases.push(result)
+  return result
+}
+
+afterEach(() => {
+  for (const { db, directory } of databases.splice(0)) {
+    db.close()
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+describe('automation history replacement equality', () => {
+  it.each([false, true])(
+    'keeps revision and timestamp for equal history (whitespace: %s)',
+    (spaces) => {
+      const { db, payload, runs } = fixture()
+      const before = readProfileStateSnapshot(db)
+
+      expect(
+        writeProfileStateDomains(db, {
+          expectedRevision: 1,
+          replacements: [
+            {
+              domain: 'automationRuns',
+              payload: spaces ? JSON.stringify(runs, null, 2) : payload,
+              now: () => {
+                throw new Error('An unchanged replacement must not request a timestamp')
+              }
+            }
+          ]
+        })
+      ).toEqual({ changed: false, revision: 1, changedDomains: [] })
+      expect(readProfileStateSnapshot(db)).toEqual(before)
+    }
+  )
+
+  it.each([
+    {
+      payload: '[{"id":"ignored","id":"run","extension":{"value":1,"value":2}}, {"id":"next"}]',
+      presence: 'array'
+    },
+    { payload: '[{"id":"same"},{"id":"same","extension":true}]', presence: 'document' },
+    { payload: '[{"extension":true}]', presence: 'document' },
+    { payload: '[]', presence: 'array' },
+    { payload: 'null', presence: 'null' },
+    { payload: null, presence: 'absent' }
+  ])('preserves canonical JSON and storage transitions for $payload', ({ payload, presence }) => {
+    const { db } = fixture()
+
+    expect(
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [{ domain: 'automationRuns', payload }]
+      })
+    ).toEqual({ changed: true, revision: 2, changedDomains: ['automationRuns'] })
+    expect(JSON.parse(readProfileStateSnapshot(db).json)).toEqual({
+      settings: {},
+      ...(payload === null ? {} : { automationRuns: JSON.parse(payload) })
+    })
+    expect(db.prepare('SELECT presence FROM profile_state_automation_runs_meta').get()).toEqual({
+      presence
+    })
+    if (presence === 'array' || presence === 'null') {
+      expect(
+        db.prepare('SELECT content_hash FROM profile_state_automation_runs_meta').get()
+      ).toEqual({
+        content_hash: hashProfileStateJson(JSON.stringify(JSON.parse(payload ?? 'null')))
+      })
+    }
+  })
+
+  it('derives prepared history from the checked payload instead of caller metadata', () => {
+    const { db } = fixture()
+    const replacement = {
+      domain: 'automationRuns',
+      payload: '[{"id":"actual"}]',
+      automationRunsValue: [{ id: 'forged' }]
+    }
+
+    writeProfileStateDomains(db, { expectedRevision: 1, replacements: [replacement] })
+
+    expect(JSON.parse(readProfileStateSnapshot(db).json)).toEqual({
+      settings: {},
+      automationRuns: [{ id: 'actual' }]
+    })
+  })
+
+  it('fences a stale caller even when its history still matches', () => {
+    const { db, payload } = fixture()
+    writeProfileStateDomains(db, {
+      expectedRevision: 1,
+      replacements: [{ domain: 'settings', payload: '{"theme":"dark"}' }]
+    })
+
+    expect(() =>
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [{ domain: 'automationRuns', payload }]
+      })
+    ).toThrow(expect.objectContaining({ code: 'profile-state-revision-conflict' }))
+    expect(readProfileStateRevision(db)).toBe(2)
+  })
+
+  it('rejects malformed JSON before trusting an equal stored hash', () => {
+    const { db } = fixture()
+    db.prepare('UPDATE profile_state_automation_runs_meta SET content_hash = ?').run(
+      hashProfileStateJson('[')
+    )
+
+    expect(() =>
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [{ domain: 'automationRuns', payload: '[' }]
+      })
+    ).toThrow('Profile state domain payload is invalid JSON: automationRuns')
+    expect(db.isTransaction).toBe(false)
+    expect(readProfileStateRevision(db)).toBe(1)
+  })
+
+  it('normalizes an equal document payload when normalized storage is not established', () => {
+    const { db, payload } = fixture()
+    clearProfileStateAutomationRuns(db)
+    db.prepare(
+      "UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = 'automationRuns'"
+    ).run(payload, hashProfileStateJson(payload))
+    const before = readProfileStateSnapshot(db)
+
+    expect(
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [{ domain: 'automationRuns', payload }]
+      })
+    ).toEqual({ changed: true, revision: 2, changedDomains: ['automationRuns'] })
+    expect(readProfileStateSnapshot(db).json).toBe(before.json)
+    expect(db.prepare('SELECT presence FROM profile_state_automation_runs_meta').get()).toEqual({
+      presence: 'array'
+    })
+  })
+
+  it('rejects a corrupt document placeholder before accepting equal normalized history', () => {
+    const { db, payload } = fixture()
+    db.prepare(
+      "UPDATE profile_state_documents SET payload = 'true' WHERE domain = 'automationRuns'"
+    ).run()
+
+    expect(() =>
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [{ domain: 'automationRuns', payload }]
+      })
+    ).toThrow('Profile state document hash mismatch: automationRuns')
+    expect(readProfileStateRevision(db)).toBe(1)
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs-migration.ts b/src/main/persistence/profile-state/profile-state-automation-runs-migration.ts
new file mode 100644
index 00000000000..adf99619242
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs-migration.ts
@@ -0,0 +1,46 @@
+import type Database from '../../sqlite/sync-database'
+import {
+  readProfileStateRevision,
+  assertProfileStateDocumentRevision
+} from './profile-state-revision'
+import { readProfileStateAutomationRunsDocument } from './profile-state-automation-runs-reader'
+import {
+  ProfileStateDocumentCorruptionError,
+  validateProfileStateDocumentRow
+} from './profile-state-document-validation'
+import {
+  markAutomationRunsDocumentStorage,
+  compactAutomationRunsDocument
+} from './profile-state-automation-runs-storage'
+
+export function migrateAutomationRunsStorage(db: Database.Database, storedVersion: number): void {
+  if (storedVersion < 2) {
+    markAutomationRunsDocumentStorage(db)
+  } else {
+    const meta = db
+      .prepare('SELECT domain FROM profile_state_automation_runs_meta WHERE domain = ?')
+      .get('automationRuns')
+    if (meta === undefined) {
+      // Schema 2 cannot distinguish cleared history from a lost projection marker.
+      if (
+        readProfileStateRevision(db) !== 0 ||
+        db.prepare('SELECT 1 FROM profile_state_documents LIMIT 1').get() !== undefined ||
+        db.prepare('SELECT 1 FROM profile_state_automation_runs LIMIT 1').get() !== undefined
+      ) {
+        throw new ProfileStateDocumentCorruptionError(
+          'Schema 2 automationRuns storage is ambiguous; restore a validated backup or JSON export',
+          'automationRuns'
+        )
+      }
+      markAutomationRunsDocumentStorage(db)
+    }
+  }
+  const revision = readProfileStateRevision(db)
+  for (const row of db.prepare('SELECT * FROM profile_state_documents').all()) {
+    const document = validateProfileStateDocumentRow(row)
+    assertProfileStateDocumentRevision(document.revision, revision, document.domain)
+  }
+  if (readProfileStateAutomationRunsDocument(db, revision) !== undefined) {
+    compactAutomationRunsDocument(db)
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs-model.ts b/src/main/persistence/profile-state/profile-state-automation-runs-model.ts
new file mode 100644
index 00000000000..b02418cf8ea
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs-model.ts
@@ -0,0 +1,49 @@
+export const PROFILE_STATE_AUTOMATION_RUNS_TABLE = 'profile_state_automation_runs'
+export const PROFILE_STATE_AUTOMATION_RUNS_META_TABLE = 'profile_state_automation_runs_meta'
+
+export const AUTOMATION_RUNS_DOMAIN = 'automationRuns'
+export const AUTOMATION_RUNS_ABSENT = 'absent'
+export const AUTOMATION_RUNS_NULL = 'null'
+export const AUTOMATION_RUNS_ARRAY = 'array'
+export const AUTOMATION_RUNS_DOCUMENT = 'document'
+
+export type AutomationRunsPresence =
+  | typeof AUTOMATION_RUNS_DOCUMENT
+  | typeof AUTOMATION_RUNS_ABSENT
+  | typeof AUTOMATION_RUNS_NULL
+  | typeof AUTOMATION_RUNS_ARRAY
+
+export type AutomationRunsMeta = {
+  presence: AutomationRunsPresence
+  domainVersion: number
+  revision: number
+  updatedAt: number
+  contentHash: string
+}
+
+export type AutomationRunPayload = {
+  id: string
+  ordinal: number
+  payload: string
+  contentHash: string
+}
+
+export type NormalizedAutomationRunRow = AutomationRunPayload & {
+  revision: number
+  updatedAt: number
+}
+
+export type AutomationRunIdentity = {
+  id: string
+  ordinal: number
+  contentHash: string
+}
+
+export type ParsedAutomationRunsReplacement =
+  | { presence: typeof AUTOMATION_RUNS_ABSENT; contentHash: ''; runs?: undefined }
+  | { presence: typeof AUTOMATION_RUNS_NULL; contentHash: string; runs?: undefined }
+  | {
+      presence: typeof AUTOMATION_RUNS_ARRAY
+      contentHash: string
+      runs: readonly AutomationRunPayload[]
+    }
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs-payload.ts b/src/main/persistence/profile-state/profile-state-automation-runs-payload.ts
new file mode 100644
index 00000000000..32da30b8784
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs-payload.ts
@@ -0,0 +1,72 @@
+import { createHash } from 'node:crypto'
+import { hashProfileStatePayload, isRecord } from './profile-state-document-validation'
+import {
+  AUTOMATION_RUNS_ABSENT,
+  AUTOMATION_RUNS_ARRAY,
+  AUTOMATION_RUNS_NULL,
+  type AutomationRunPayload,
+  type ParsedAutomationRunsReplacement
+} from './profile-state-automation-runs-model'
+
+export function parseAutomationRunsReplacement(
+  payload: string | null
+): ParsedAutomationRunsReplacement | undefined {
+  if (payload === null) {
+    return parseAutomationRunsValue(undefined)
+  }
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(payload)
+  } catch {
+    return undefined
+  }
+  return parseAutomationRunsValue(parsed)
+}
+
+export function parseAutomationRunsValue(
+  value: unknown
+): ParsedAutomationRunsReplacement | undefined {
+  if (value === undefined) {
+    return { presence: AUTOMATION_RUNS_ABSENT, contentHash: '' }
+  }
+  if (value === null) {
+    return { presence: AUTOMATION_RUNS_NULL, contentHash: hashProfileStatePayload('null') }
+  }
+  if (!Array.isArray(value)) {
+    return undefined
+  }
+  return parseAutomationRunValues(value)
+}
+
+export function parseAutomationRunValues(
+  values: readonly unknown[]
+): ParsedAutomationRunsReplacement | undefined {
+  const ids = new Set<string>()
+  const runs: AutomationRunPayload[] = []
+  const aggregate = createHash('sha256').update('[')
+  for (const [ordinal, value] of values.entries()) {
+    if (!isRecord(value) || typeof value.id !== 'string' || ids.has(value.id)) {
+      return undefined
+    }
+    const runPayload = JSON.stringify(value)
+    if (runPayload === undefined) {
+      return undefined
+    }
+    if (ordinal > 0) {
+      aggregate.update(',')
+    }
+    aggregate.update(runPayload, 'utf8')
+    ids.add(value.id)
+    runs.push({
+      id: value.id,
+      ordinal,
+      payload: runPayload,
+      contentHash: hashProfileStatePayload(runPayload)
+    })
+  }
+  return {
+    presence: AUTOMATION_RUNS_ARRAY,
+    contentHash: aggregate.update(']').digest('hex'),
+    runs
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs-reader.ts b/src/main/persistence/profile-state/profile-state-automation-runs-reader.ts
new file mode 100644
index 00000000000..c8e4087a1a8
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs-reader.ts
@@ -0,0 +1,151 @@
+import { createHash } from 'node:crypto'
+import type Database from '../../sqlite/sync-database'
+import { readProfileStateRevision } from './profile-state-revision'
+import {
+  hashProfileStatePayload,
+  ProfileStateDocumentCorruptionError,
+  type ProfileStateDocument,
+  type ProfileStateParsedDocument,
+  type ProfileStateValidatedDocument
+} from './profile-state-document-validation'
+import {
+  AUTOMATION_RUNS_ABSENT,
+  AUTOMATION_RUNS_DOCUMENT,
+  AUTOMATION_RUNS_DOMAIN,
+  AUTOMATION_RUNS_NULL,
+  PROFILE_STATE_AUTOMATION_RUNS_TABLE,
+  type AutomationRunsMeta
+} from './profile-state-automation-runs-model'
+import {
+  assertNoNormalizedAutomationRuns,
+  parseNormalizedAutomationRunRow
+} from './profile-state-automation-runs-validation'
+
+import { readCurrentAutomationRunsState } from './profile-state-automation-runs-storage'
+
+type Representation = 'serialized' | 'parsed' | 'validated'
+type ReadDocument =
+  | ProfileStateDocument
+  | ProfileStateParsedDocument
+  | ProfileStateValidatedDocument
+
+/** Undefined means explicit document storage; null means the domain is absent. */
+export function readProfileStateAutomationRunsDocument(
+  db: Database.Database,
+  profileRevision?: number
+): ProfileStateDocument | null | undefined
+export function readProfileStateAutomationRunsDocument(
+  db: Database.Database,
+  profileRevision: number,
+  representation: 'parsed'
+): ProfileStateParsedDocument | null | undefined
+export function readProfileStateAutomationRunsDocument(
+  db: Database.Database,
+  profileRevision: number,
+  representation: 'validated'
+): ProfileStateValidatedDocument | null | undefined
+export function readProfileStateAutomationRunsDocument(
+  db: Database.Database,
+  profileRevision = readProfileStateRevision(db),
+  representation: Representation = 'serialized'
+): ReadDocument | null | undefined {
+  const meta = readCurrentAutomationRunsState(db, profileRevision)
+  if (meta.presence === AUTOMATION_RUNS_DOCUMENT) {
+    return undefined
+  }
+  if (meta.presence === AUTOMATION_RUNS_ABSENT) {
+    assertNoNormalizedAutomationRuns(db)
+    return null
+  }
+  if (meta.presence === AUTOMATION_RUNS_NULL) {
+    if (meta.contentHash !== hashProfileStatePayload('null')) {
+      throw new ProfileStateDocumentCorruptionError(
+        'Normalized automationRuns null hash mismatch',
+        AUTOMATION_RUNS_DOMAIN
+      )
+    }
+    assertNoNormalizedAutomationRuns(db)
+    return makeAutomationRunsDocument(
+      meta,
+      representation === 'validated'
+        ? {}
+        : representation === 'parsed'
+          ? { value: null }
+          : { payload: 'null' }
+    )
+  }
+
+  // Sort only stable keys; payloads stay outside the sorter and extra columns cannot shadow the key.
+  const references = db.prepare(
+    `SELECT run_id FROM ${PROFILE_STATE_AUTOMATION_RUNS_TABLE} ORDER BY ordinal`
+  )
+  const row = db.prepare(
+    `SELECT run_id, ordinal, payload, content_hash, revision, updated_at FROM ${PROFILE_STATE_AUTOMATION_RUNS_TABLE} WHERE run_id = ?`
+  )
+  const payloads: string[] = []
+  const values: unknown[] = []
+  const aggregate = createHash('sha256').update('[')
+  const ids = new Set<string>()
+  let index = 0
+  for (const reference of references.iterate()) {
+    const parsed = parseNormalizedAutomationRunRow(
+      row.get(reference.run_id),
+      representation === 'parsed'
+    )
+    if (parsed.id !== reference.run_id || parsed.ordinal !== index || ids.has(parsed.id)) {
+      throw new ProfileStateDocumentCorruptionError(
+        'Normalized automationRuns ordering is corrupt',
+        AUTOMATION_RUNS_DOMAIN
+      )
+    }
+    if (
+      parsed.revision > meta.revision ||
+      (parsed.revision === meta.revision && parsed.updatedAt !== meta.updatedAt)
+    ) {
+      throw new ProfileStateDocumentCorruptionError(
+        'Normalized automationRuns row metadata is inconsistent',
+        AUTOMATION_RUNS_DOMAIN
+      )
+    }
+    ids.add(parsed.id)
+    if (index > 0) {
+      aggregate.update(',')
+    }
+    aggregate.update(parsed.payload, 'utf8')
+    if (representation === 'parsed') {
+      values.push(parsed.value)
+    } else if (representation === 'serialized') {
+      payloads.push(parsed.payload)
+    }
+    index++
+  }
+  const contentHash = aggregate.update(']').digest('hex')
+  if (contentHash !== meta.contentHash) {
+    throw new ProfileStateDocumentCorruptionError(
+      'Normalized automationRuns aggregate hash mismatch',
+      AUTOMATION_RUNS_DOMAIN
+    )
+  }
+  return makeAutomationRunsDocument(
+    meta,
+    representation === 'validated'
+      ? {}
+      : representation === 'parsed'
+        ? { value: values }
+        : { payload: `[${payloads.join(',')}]` }
+  )
+}
+
+function makeAutomationRunsDocument(
+  meta: AutomationRunsMeta,
+  content: { payload: string } | { value: unknown } | Record<string, never>
+): ReadDocument {
+  return {
+    domain: AUTOMATION_RUNS_DOMAIN,
+    ...content,
+    domainVersion: meta.domainVersion,
+    revision: meta.revision,
+    updatedAt: meta.updatedAt,
+    contentHash: meta.contentHash
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs-serialization.test.ts b/src/main/persistence/profile-state/profile-state-automation-runs-serialization.test.ts
new file mode 100644
index 00000000000..389498aa364
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs-serialization.test.ts
@@ -0,0 +1,65 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+import { openProfileStateDatabase } from './profile-state-database'
+import { importProfileStateJson, readProfileStateSnapshot } from './profile-state-documents'
+import { writeProfileStateDomains } from './profile-state-domain-writes'
+
+describe('automation history serialization', () => {
+  it.each(['import', 'replacement', 'delta'] as const)(
+    'preserves JSON ordering, escaping and unknown fields through %s',
+    (operation) => {
+      const directory = mkdtempSync(join(tmpdir(), 'orca-automation-run-serialization-'))
+      const { db } = openProfileStateDatabase(join(directory, 'state.db'), 'profile')
+      try {
+        const fixtureRun = buildProfileStateCutoverFixture().automationRuns[0]
+        if (!fixtureRun) {
+          throw new Error('Expected an automation run fixture')
+        }
+        const runs = [
+          {
+            ...fixtureRun,
+            id: 'second',
+            extension: {
+              '3': 3,
+              '1': 1,
+              z: '雪 🐋\ud800',
+              a: ['\\', '\n', '"', null],
+              omitted: undefined
+            }
+          },
+          { ...fixtureRun, id: 'first', extension: { fractional: -0 } }
+        ]
+        const settings = { note: 'unchanged' }
+        const expected = JSON.stringify({ settings, automationRuns: runs })
+        importProfileStateJson(db, JSON.stringify({ settings, automationRuns: runs.toReversed() }))
+        if (operation === 'import') {
+          importProfileStateJson(db, expected, { expectedRevision: 1 })
+        } else {
+          writeProfileStateDomains(db, {
+            expectedRevision: 1,
+            replacements:
+              operation === 'replacement'
+                ? [{ domain: 'automationRuns', payload: JSON.stringify(runs) }]
+                : [],
+            ...(operation === 'delta' ? { automationRunsAfter: runs } : {})
+          })
+        }
+
+        expect(readProfileStateSnapshot(db)).toMatchObject({ revision: 2, json: expected })
+        expect(
+          writeProfileStateDomains(db, {
+            expectedRevision: 2,
+            replacements: [],
+            automationRunsAfter: runs
+          })
+        ).toEqual({ changed: false, revision: 2, changedDomains: [] })
+      } finally {
+        db.close()
+        rmSync(directory, { recursive: true, force: true })
+      }
+    }
+  )
+})
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs-storage.ts b/src/main/persistence/profile-state/profile-state-automation-runs-storage.ts
new file mode 100644
index 00000000000..c9ee590d369
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs-storage.ts
@@ -0,0 +1,49 @@
+import type Database from '../../sqlite/sync-database'
+import { hashProfileStatePayload } from './profile-state-document-validation'
+import { assertProfileStateDocumentRevision } from './profile-state-revision'
+import {
+  AUTOMATION_RUNS_DOCUMENT,
+  AUTOMATION_RUNS_DOMAIN,
+  PROFILE_STATE_AUTOMATION_RUNS_META_TABLE,
+  type AutomationRunsMeta
+} from './profile-state-automation-runs-model'
+import {
+  assertNoNormalizedAutomationRuns,
+  parseAutomationRunsMeta
+} from './profile-state-automation-runs-validation'
+
+export function readCurrentAutomationRunsState(
+  db: Database.Database,
+  actualRevision: number
+): AutomationRunsMeta {
+  const row = db
+    .prepare(
+      `SELECT domain, presence, domain_version, revision, updated_at, content_hash
+     FROM ${PROFILE_STATE_AUTOMATION_RUNS_META_TABLE} WHERE domain = ?`
+    )
+    .get(AUTOMATION_RUNS_DOMAIN)
+  const meta = parseAutomationRunsMeta(row)
+  assertProfileStateDocumentRevision(meta.revision, actualRevision, AUTOMATION_RUNS_DOMAIN)
+  if (meta.presence === AUTOMATION_RUNS_DOCUMENT) {
+    assertNoNormalizedAutomationRuns(db)
+  }
+  return meta
+}
+
+export function markAutomationRunsDocumentStorage(db: Database.Database): void {
+  db.prepare(
+    `INSERT INTO ${PROFILE_STATE_AUTOMATION_RUNS_META_TABLE}
+     (domain, presence, domain_version, revision, updated_at, content_hash)
+     VALUES (?, ?, 1, 0, 0, '')
+     ON CONFLICT(domain) DO UPDATE SET presence = excluded.presence,
+     domain_version = 1, revision = 0, updated_at = 0, content_hash = ''`
+  ).run(AUTOMATION_RUNS_DOMAIN, AUTOMATION_RUNS_DOCUMENT)
+}
+
+/** Retain the key's JSON position without retaining a second history payload. */
+export function compactAutomationRunsDocument(db: Database.Database): void {
+  db.prepare(
+    `UPDATE profile_state_documents SET payload = 'null', content_hash = ?
+     WHERE domain = ? AND payload <> 'null'`
+  ).run(hashProfileStatePayload('null'), AUTOMATION_RUNS_DOMAIN)
+}
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs-validation.ts b/src/main/persistence/profile-state/profile-state-automation-runs-validation.ts
new file mode 100644
index 00000000000..98d0f79cc4b
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs-validation.ts
@@ -0,0 +1,154 @@
+import type Database from '../../sqlite/sync-database'
+import {
+  hashProfileStatePayload,
+  isRecord,
+  ProfileStateDocumentCorruptionError
+} from './profile-state-document-validation'
+import {
+  AUTOMATION_RUNS_ABSENT,
+  AUTOMATION_RUNS_ARRAY,
+  AUTOMATION_RUNS_DOMAIN,
+  AUTOMATION_RUNS_DOCUMENT,
+  AUTOMATION_RUNS_NULL,
+  PROFILE_STATE_AUTOMATION_RUNS_TABLE,
+  type AutomationRunIdentity,
+  type AutomationRunsMeta,
+  type NormalizedAutomationRunRow
+} from './profile-state-automation-runs-model'
+
+export function assertNoNormalizedAutomationRuns(db: Database.Database): void {
+  const row = db
+    .prepare(`SELECT COUNT(*) AS count FROM ${PROFILE_STATE_AUTOMATION_RUNS_TABLE}`)
+    .get()
+  if (isRecord(row) && row.count !== 0) {
+    throw new ProfileStateDocumentCorruptionError(
+      'Normalized automationRuns rows exist for an empty domain',
+      AUTOMATION_RUNS_DOMAIN
+    )
+  }
+}
+
+export function parseAutomationRunsMeta(row: unknown): AutomationRunsMeta {
+  if (
+    !isRecord(row) ||
+    row.domain !== AUTOMATION_RUNS_DOMAIN ||
+    (row.presence !== AUTOMATION_RUNS_ABSENT &&
+      row.presence !== AUTOMATION_RUNS_DOCUMENT &&
+      row.presence !== AUTOMATION_RUNS_NULL &&
+      row.presence !== AUTOMATION_RUNS_ARRAY) ||
+    typeof row.domain_version !== 'number' ||
+    typeof row.revision !== 'number' ||
+    typeof row.updated_at !== 'number' ||
+    typeof row.content_hash !== 'string'
+  ) {
+    throw new ProfileStateDocumentCorruptionError(
+      'Normalized automationRuns metadata is malformed',
+      AUTOMATION_RUNS_DOMAIN
+    )
+  }
+  if (
+    !Number.isSafeInteger(row.domain_version) ||
+    row.domain_version < 1 ||
+    !Number.isSafeInteger(row.revision) ||
+    row.revision < (row.presence === AUTOMATION_RUNS_DOCUMENT ? 0 : 1) ||
+    !Number.isSafeInteger(row.updated_at) ||
+    row.updated_at < 0 ||
+    (row.presence === AUTOMATION_RUNS_ABSENT || row.presence === AUTOMATION_RUNS_DOCUMENT
+      ? row.content_hash !== ''
+      : !/^[a-f0-9]{64}$/.test(row.content_hash))
+  ) {
+    throw new ProfileStateDocumentCorruptionError(
+      'Normalized automationRuns metadata is invalid',
+      AUTOMATION_RUNS_DOMAIN
+    )
+  }
+  if (
+    row.presence === AUTOMATION_RUNS_DOCUMENT &&
+    (row.revision !== 0 || row.updated_at !== 0 || row.domain_version !== 1)
+  ) {
+    throw new ProfileStateDocumentCorruptionError(
+      'AutomationRuns document storage marker is invalid',
+      AUTOMATION_RUNS_DOMAIN
+    )
+  }
+  return {
+    presence: row.presence,
+    domainVersion: row.domain_version,
+    revision: row.revision,
+    updatedAt: row.updated_at,
+    contentHash: row.content_hash
+  }
+}
+
+export function parseNormalizedAutomationRunRow(
+  row: unknown,
+  retainParsedValue = false
+): NormalizedAutomationRunRow & { value?: unknown } {
+  if (
+    !isRecord(row) ||
+    typeof row.run_id !== 'string' ||
+    typeof row.ordinal !== 'number' ||
+    typeof row.payload !== 'string' ||
+    typeof row.content_hash !== 'string' ||
+    typeof row.revision !== 'number' ||
+    typeof row.updated_at !== 'number' ||
+    !Number.isSafeInteger(row.ordinal) ||
+    row.ordinal < 0 ||
+    !Number.isSafeInteger(row.revision) ||
+    row.revision < 1 ||
+    !Number.isSafeInteger(row.updated_at) ||
+    row.updated_at < 0 ||
+    hashProfileStatePayload(row.payload) !== row.content_hash
+  ) {
+    throw new ProfileStateDocumentCorruptionError(
+      'Normalized automationRuns row is corrupt',
+      AUTOMATION_RUNS_DOMAIN
+    )
+  }
+  // Individually invalid fragments can splice into a valid aggregate with matching IDs.
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(row.payload)
+  } catch {
+    throw new ProfileStateDocumentCorruptionError(
+      'Normalized automationRuns row is invalid JSON',
+      AUTOMATION_RUNS_DOMAIN
+    )
+  }
+  if (!isRecord(parsed) || parsed.id !== row.run_id) {
+    throw new ProfileStateDocumentCorruptionError(
+      'Normalized automationRuns row identity is corrupt',
+      AUTOMATION_RUNS_DOMAIN
+    )
+  }
+  return {
+    id: row.run_id,
+    ordinal: row.ordinal,
+    payload: row.payload,
+    contentHash: row.content_hash,
+    revision: row.revision,
+    updatedAt: row.updated_at,
+    ...(retainParsedValue ? { value: parsed } : {})
+  }
+}
+
+export function parseAutomationRunIdentity(row: unknown): AutomationRunIdentity {
+  if (
+    !isRecord(row) ||
+    typeof row.run_id !== 'string' ||
+    typeof row.ordinal !== 'number' ||
+    typeof row.content_hash !== 'string' ||
+    !Number.isSafeInteger(row.ordinal) ||
+    row.ordinal < 0
+  ) {
+    throw new ProfileStateDocumentCorruptionError(
+      'Normalized automationRuns row is malformed',
+      AUTOMATION_RUNS_DOMAIN
+    )
+  }
+  return {
+    id: row.run_id,
+    ordinal: row.ordinal,
+    contentHash: row.content_hash
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs-writer.ts b/src/main/persistence/profile-state/profile-state-automation-runs-writer.ts
new file mode 100644
index 00000000000..31f4eb4f1d1
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs-writer.ts
@@ -0,0 +1,158 @@
+import type Database from '../../sqlite/sync-database'
+import type { PreparedProfileStateMutation } from './profile-state-domain-write-validation'
+import {
+  AUTOMATION_RUNS_ARRAY,
+  AUTOMATION_RUNS_DOMAIN,
+  PROFILE_STATE_AUTOMATION_RUNS_META_TABLE,
+  PROFILE_STATE_AUTOMATION_RUNS_TABLE,
+  type AutomationRunIdentity,
+  type ParsedAutomationRunsReplacement
+} from './profile-state-automation-runs-model'
+import {
+  parseAutomationRunValues,
+  parseAutomationRunsReplacement,
+  parseAutomationRunsValue
+} from './profile-state-automation-runs-payload'
+import { parseAutomationRunIdentity } from './profile-state-automation-runs-validation'
+import {
+  readCurrentAutomationRunsState,
+  compactAutomationRunsDocument
+} from './profile-state-automation-runs-storage'
+
+export type AutomationRunsWritePreparation = {
+  changed: boolean
+  incoming: ParsedAutomationRunsReplacement
+  domainVersion: number
+  now?: () => number
+}
+
+export function rebuildProfileStateAutomationRunsProjection(
+  db: Database.Database,
+  payload: string,
+  domainVersion: number,
+  updatedAt: number,
+  revision: number
+): boolean {
+  const incoming = parseAutomationRunsReplacement(payload)
+  if (incoming === undefined) {
+    return false
+  }
+  const now = resolveAutomationRunsTimestamp(() => updatedAt)
+  applyIncomingAutomationRuns(db, incoming, domainVersion, now, revision)
+  return true
+}
+
+export function prepareProfileStateAutomationRunsReplacement(
+  db: Database.Database,
+  replacement: PreparedProfileStateMutation,
+  actualRevision: number
+): AutomationRunsWritePreparation | undefined {
+  const current = readCurrentAutomationRunsState(db, actualRevision)
+  const incoming = parseAutomationRunsValue(replacement.automationRunsValue)
+  if (incoming === undefined) {
+    return undefined
+  }
+  return {
+    changed: current.presence !== incoming.presence || current.contentHash !== incoming.contentHash,
+    incoming,
+    domainVersion: replacement.domainVersion,
+    now: replacement.now
+  }
+}
+
+export function prepareProfileStateAutomationRunsDelta(
+  db: Database.Database,
+  after: readonly unknown[],
+  domainVersion: number,
+  now: () => number,
+  actualRevision: number
+): AutomationRunsWritePreparation | undefined {
+  const incoming = parseAutomationRunValues(after)
+  if (incoming === undefined) {
+    return undefined
+  }
+  const current = readCurrentAutomationRunsState(db, actualRevision)
+  return {
+    changed: current.presence !== incoming.presence || current.contentHash !== incoming.contentHash,
+    incoming,
+    domainVersion,
+    now
+  }
+}
+
+export function applyProfileStateAutomationRuns(
+  db: Database.Database,
+  preparation: AutomationRunsWritePreparation,
+  nextRevision: number
+): void {
+  const now = resolveAutomationRunsTimestamp(preparation.now ?? Date.now)
+  applyIncomingAutomationRuns(
+    db,
+    preparation.incoming,
+    preparation.domainVersion,
+    now,
+    nextRevision
+  )
+}
+
+function applyIncomingAutomationRuns(
+  db: Database.Database,
+  incoming: ParsedAutomationRunsReplacement,
+  domainVersion: number,
+  now: number,
+  nextRevision: number
+): void {
+  const existingRows = new Map<string, AutomationRunIdentity>()
+  for (const row of db
+    .prepare(`SELECT run_id, ordinal, content_hash FROM ${PROFILE_STATE_AUTOMATION_RUNS_TABLE}`)
+    .all()) {
+    const parsed = parseAutomationRunIdentity(row)
+    existingRows.set(parsed.id, parsed)
+  }
+
+  const upsert = db.prepare(
+    `INSERT INTO ${PROFILE_STATE_AUTOMATION_RUNS_TABLE}
+     (run_id, ordinal, payload, content_hash, revision, updated_at) VALUES (?, ?, ?, ?, ?, ?)
+     ON CONFLICT(run_id) DO UPDATE SET ordinal = excluded.ordinal,
+     payload = excluded.payload, content_hash = excluded.content_hash,
+     revision = excluded.revision, updated_at = excluded.updated_at`
+  )
+  if (incoming.presence === AUTOMATION_RUNS_ARRAY) {
+    for (const run of incoming.runs) {
+      const existing = existingRows.get(run.id)
+      existingRows.delete(run.id)
+      if (existing?.ordinal === run.ordinal && existing.contentHash === run.contentHash) {
+        continue
+      }
+      upsert.run(run.id, run.ordinal, run.payload, run.contentHash, nextRevision, now)
+    }
+  }
+  const remove = db.prepare(`DELETE FROM ${PROFILE_STATE_AUTOMATION_RUNS_TABLE} WHERE run_id = ?`)
+  for (const id of existingRows.keys()) {
+    remove.run(id)
+  }
+
+  db.prepare(
+    `INSERT INTO ${PROFILE_STATE_AUTOMATION_RUNS_META_TABLE}
+     (domain, presence, domain_version, revision, updated_at, content_hash) VALUES (?, ?, ?, ?, ?, ?)
+     ON CONFLICT(domain) DO UPDATE SET presence = excluded.presence,
+     domain_version = excluded.domain_version, revision = excluded.revision,
+     updated_at = excluded.updated_at, content_hash = excluded.content_hash`
+  ).run(
+    AUTOMATION_RUNS_DOMAIN,
+    incoming.presence,
+    domainVersion,
+    nextRevision,
+    now,
+    incoming.contentHash
+  )
+  compactAutomationRunsDocument(db)
+}
+
+function resolveAutomationRunsTimestamp(nowFactory: () => number): number {
+  const now = nowFactory()
+  if (!Number.isSafeInteger(now) || now < 0) {
+    throw new Error('Profile state domain update timestamp is invalid: automationRuns')
+  }
+  return now
+}
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs.ts b/src/main/persistence/profile-state/profile-state-automation-runs.ts
new file mode 100644
index 00000000000..8b81cf07019
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs.ts
@@ -0,0 +1,22 @@
+import type Database from '../../sqlite/sync-database'
+import { markAutomationRunsDocumentStorage } from './profile-state-automation-runs-storage'
+import { PROFILE_STATE_AUTOMATION_RUNS_TABLE } from './profile-state-automation-runs-model'
+
+export {
+  PROFILE_STATE_AUTOMATION_RUNS_META_TABLE,
+  PROFILE_STATE_AUTOMATION_RUNS_TABLE
+} from './profile-state-automation-runs-model'
+export type { AutomationRunPayload } from './profile-state-automation-runs-model'
+export type { AutomationRunsWritePreparation } from './profile-state-automation-runs-writer'
+export {
+  applyProfileStateAutomationRuns,
+  prepareProfileStateAutomationRunsDelta,
+  prepareProfileStateAutomationRunsReplacement,
+  rebuildProfileStateAutomationRunsProjection
+} from './profile-state-automation-runs-writer'
+export { readProfileStateAutomationRunsDocument } from './profile-state-automation-runs-reader'
+
+export function clearProfileStateAutomationRuns(db: Database.Database): void {
+  db.prepare(`DELETE FROM ${PROFILE_STATE_AUTOMATION_RUNS_TABLE}`).run()
+  markAutomationRunsDocumentStorage(db)
+}
diff --git a/src/main/persistence/profile-state/profile-state-automation-storage-upgrade.test.ts b/src/main/persistence/profile-state/profile-state-automation-storage-upgrade.test.ts
new file mode 100644
index 00000000000..bb28c491f0e
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-storage-upgrade.test.ts
@@ -0,0 +1,380 @@
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import Database from '../../sqlite/sync-database'
+import { openProfileStateDatabase, profileStatePragmaNumber } from './profile-state-database'
+import { PROFILE_STATE_DATABASE_SCHEMA_VERSION } from './profile-state-database-schema'
+import { hashProfileStatePayload } from './profile-state-document-validation'
+import { exportProfileStateJson, importProfileStateJson } from './profile-state-documents'
+import { readProfileStateDomain } from './profile-state-domain-reader'
+import { writeProfileStateDomain } from './profile-state-domain-writes'
+
+const directories: string[] = []
+const connections: Database.Database[] = []
+const staleRuns = [{ id: 'deleted-run', status: 'running', output: 'stale history'.repeat(1_000) }]
+const liveRuns = [{ id: 'live-run', status: 'completed', future: { retained: true } }]
+
+afterEach(() => {
+  for (const db of connections.splice(0)) {
+    db.close()
+  }
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function databasePath(): string {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-automation-upgrade-'))
+  directories.push(directory)
+  return join(directory, 'profile-state.db')
+}
+
+function openDatabase(path: string): Database.Database {
+  const { db } = openProfileStateDatabase(path, 'profile-a')
+  connections.push(db)
+  return db
+}
+
+function expectRejectedDatabaseUntouched(path: string, profileId = 'profile-a'): void {
+  const before = readFileSync(path)
+  expect(() => {
+    const { db } = openProfileStateDatabase(path, profileId)
+    connections.push(db)
+  }).toThrowError(
+    expect.objectContaining({
+      code: profileId === 'profile-a' ? 'unreadable' : 'identity-mismatch'
+    })
+  )
+  expect(readFileSync(path)).toEqual(before)
+}
+
+type LegacyProjection = {
+  presence: 'array' | 'null' | 'absent'
+  runs?: readonly { id: string; [key: string]: unknown }[]
+}
+
+function seedLegacyDatabase(
+  version: 1 | 2,
+  root: Record<string, unknown>,
+  projection?: LegacyProjection,
+  revision = projection ? 2 : 1
+): string {
+  const path = databasePath()
+  const db = new Database(path)
+  try {
+    db.exec(`
+      CREATE TABLE profile_state_meta (key TEXT PRIMARY KEY NOT NULL, value TEXT NOT NULL);
+      CREATE TABLE profile_state_documents (
+        domain TEXT PRIMARY KEY NOT NULL, payload TEXT NOT NULL,
+        domain_version INTEGER NOT NULL, revision INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL, content_hash TEXT NOT NULL
+      );
+    `)
+    db.prepare('INSERT INTO profile_state_meta VALUES (?, ?)').run('profile_id', 'profile-a')
+    db.prepare('INSERT INTO profile_state_meta VALUES (?, ?)').run('revision', String(revision))
+    for (const [domain, value] of Object.entries(root)) {
+      const payload = JSON.stringify(value)
+      db.prepare('INSERT INTO profile_state_documents VALUES (?, ?, 1, 1, 100, ?)').run(
+        domain,
+        payload,
+        hashProfileStatePayload(payload)
+      )
+    }
+    if (version === 2) {
+      db.exec(`
+        CREATE TABLE profile_state_automation_runs_meta (
+          domain TEXT PRIMARY KEY NOT NULL, presence TEXT NOT NULL,
+          domain_version INTEGER NOT NULL, revision INTEGER NOT NULL,
+          updated_at INTEGER NOT NULL, content_hash TEXT NOT NULL
+        );
+        CREATE TABLE profile_state_automation_runs (
+          run_id TEXT PRIMARY KEY NOT NULL, ordinal INTEGER NOT NULL,
+          payload TEXT NOT NULL, content_hash TEXT NOT NULL,
+          revision INTEGER NOT NULL, updated_at INTEGER NOT NULL
+        );
+      `)
+      if (projection) {
+        const runs = projection.runs ?? []
+        const payload = projection.presence === 'array' ? JSON.stringify(runs) : 'null'
+        db.prepare(
+          'INSERT INTO profile_state_automation_runs_meta VALUES (?, ?, 1, 2, 200, ?)'
+        ).run(
+          'automationRuns',
+          projection.presence,
+          projection.presence === 'absent' ? '' : hashProfileStatePayload(payload)
+        )
+        for (const [ordinal, run] of runs.entries()) {
+          const runPayload = JSON.stringify(run)
+          db.prepare('INSERT INTO profile_state_automation_runs VALUES (?, ?, ?, ?, 2, 200)').run(
+            run.id,
+            ordinal,
+            runPayload,
+            hashProfileStatePayload(runPayload)
+          )
+        }
+      }
+    }
+    db.pragma(`user_version = ${version}`)
+  } finally {
+    db.close()
+  }
+  return path
+}
+
+describe('automation storage schema upgrades', () => {
+  it.each([
+    { label: 'supported runs', value: liveRuns },
+    { label: 'explicit null', value: null },
+    { label: 'unknown object', value: { futureFormat: [1, 2] } },
+    { label: 'duplicate identifiers', value: [{ id: 'same' }, { id: 'same', future: true }] }
+  ])('preserves version 1 $label and domain ordering', ({ value }) => {
+    const root = { settings: { theme: 'dark' }, automationRuns: value, futureDomain: [2, 1] }
+    const db = openDatabase(seedLegacyDatabase(1, root))
+
+    expect(profileStatePragmaNumber(db, 'user_version')).toBe(PROFILE_STATE_DATABASE_SCHEMA_VERSION)
+    expect(exportProfileStateJson(db)).toBe(JSON.stringify(root))
+    expect(db.prepare('SELECT presence FROM profile_state_automation_runs_meta').get()).toEqual({
+      presence: 'document'
+    })
+    expect(db.prepare('SELECT COUNT(*) AS count FROM profile_state_automation_runs').get()).toEqual(
+      {
+        count: 0
+      }
+    )
+  })
+
+  it('normalizes a version 1 document on replacement without duplicating its payload', () => {
+    const root = { settings: {}, automationRuns: liveRuns, futureDomain: [2, 1] }
+    const db = openDatabase(seedLegacyDatabase(1, root))
+
+    expect(
+      writeProfileStateDomain(db, {
+        domain: 'automationRuns',
+        payload: JSON.stringify(liveRuns),
+        expectedRevision: 1
+      })
+    ).toEqual({ changed: true, revision: 2 })
+
+    expect(exportProfileStateJson(db)).toBe(JSON.stringify(root))
+    expect(
+      db
+        .prepare('SELECT payload FROM profile_state_documents WHERE domain = ?')
+        .get('automationRuns')
+    ).toEqual({ payload: 'null' })
+  })
+
+  it.each([
+    { presence: 'array', runs: liveRuns, expected: liveRuns },
+    { presence: 'array', runs: [], expected: [] },
+    { presence: 'null', expected: null },
+    { presence: 'absent', expected: undefined }
+  ] as const)(
+    'keeps version 2 $presence authority while removing stale retained history',
+    (value) => {
+      const root = { settings: {}, automationRuns: staleRuns, futureDomain: { kept: true } }
+      const path = seedLegacyDatabase(2, root, value)
+      const db = openDatabase(path)
+      const expected = { ...root, automationRuns: value.expected }
+
+      expect(exportProfileStateJson(db)).toBe(JSON.stringify(expected))
+      expect(readProfileStateDomain(path, 'profile-a', 'automationRuns')).toEqual(
+        value.expected === undefined
+          ? { kind: 'missing' }
+          : { kind: 'value', value: value.expected }
+      )
+      expect(
+        db
+          .prepare('SELECT payload FROM profile_state_documents WHERE domain = ?')
+          .get('automationRuns')
+      ).toEqual({ payload: 'null' })
+      expect(profileStatePragmaNumber(db, 'user_version')).toBe(
+        PROFILE_STATE_DATABASE_SCHEMA_VERSION
+      )
+    }
+  )
+
+  it.each([
+    { label: 'stale run array', root: { automationRuns: staleRuns } },
+    { label: 'empty array', root: { automationRuns: [] } },
+    { label: 'explicit null', root: { automationRuns: null } },
+    { label: 'unknown value', root: { automationRuns: { futureFormat: true } } },
+    { label: 'absent domain', root: {} }
+  ])('refuses ambiguous version 2 $label without rewriting it', ({ root }) => {
+    const path = seedLegacyDatabase(2, root)
+    expectRejectedDatabaseUntouched(path)
+    const db = new Database(path)
+    connections.push(db)
+    expect(profileStatePragmaNumber(db, 'user_version')).toBe(2)
+    expect(db.prepare('SELECT domain FROM profile_state_automation_runs_meta').all()).toEqual([])
+    expect(
+      db.prepare('SELECT domain, payload FROM profile_state_documents ORDER BY rowid').all()
+    ).toEqual(
+      Object.entries(root).map(([domain, value]) => ({ domain, payload: JSON.stringify(value) }))
+    )
+  })
+
+  it('upgrades a genuinely empty version 2 database', () => {
+    const db = openDatabase(seedLegacyDatabase(2, {}, undefined, 0))
+    expect(exportProfileStateJson(db)).toBe('{}')
+    expect(importProfileStateJson(db, JSON.stringify({ automationRuns: liveRuns }))).toBe(1)
+    expect(JSON.parse(exportProfileStateJson(db))).toEqual({ automationRuns: liveRuns })
+  })
+
+  it.each(['legacy document', 'normalized row', 'projection metadata'])(
+    'rolls back version 2 migration with corrupt %s',
+    (target) => {
+      const path = seedLegacyDatabase(
+        2,
+        { automationRuns: staleRuns },
+        { presence: 'array', runs: liveRuns }
+      )
+      const tampered = new Database(path)
+      try {
+        if (target === 'legacy document') {
+          tampered.exec("UPDATE profile_state_documents SET content_hash = 'broken'")
+        } else if (target === 'normalized row') {
+          tampered.exec("UPDATE profile_state_automation_runs SET content_hash = 'broken'")
+        } else {
+          tampered.exec("UPDATE profile_state_automation_runs_meta SET content_hash = 'broken'")
+        }
+      } finally {
+        tampered.close()
+      }
+
+      expectRejectedDatabaseUntouched(path)
+      const db = new Database(path)
+      connections.push(db)
+      expect(profileStatePragmaNumber(db, 'user_version')).toBe(2)
+      expect(
+        db
+          .prepare('SELECT payload FROM profile_state_documents WHERE domain = ?')
+          .get('automationRuns')
+      ).toEqual({ payload: JSON.stringify(staleRuns) })
+    }
+  )
+})
+
+describe('rejected schema upgrades preserve source bytes', () => {
+  it.each([1, 2] as const)('rejects another profile in schema %s before migration', (version) => {
+    const path = seedLegacyDatabase(
+      version,
+      { automationRuns: staleRuns },
+      { presence: 'array', runs: liveRuns }
+    )
+    expectRejectedDatabaseUntouched(path, 'profile-b')
+  })
+
+  it.each([1, 2] as const)(
+    'rejects an incompatible schema %s document column before migration',
+    (version) => {
+      const path = seedLegacyDatabase(
+        version,
+        { automationRuns: staleRuns },
+        { presence: 'array', runs: liveRuns }
+      )
+      const db = new Database(path)
+      try {
+        db.exec(`
+        ALTER TABLE profile_state_documents RENAME TO old_documents;
+        CREATE TABLE profile_state_documents (
+          domain TEXT PRIMARY KEY NOT NULL, payload BLOB NOT NULL,
+          domain_version INTEGER NOT NULL, revision INTEGER NOT NULL,
+          updated_at INTEGER NOT NULL, content_hash TEXT NOT NULL
+        );
+        INSERT INTO profile_state_documents SELECT * FROM old_documents;
+        DROP TABLE old_documents;
+      `)
+      } finally {
+        db.close()
+      }
+      expectRejectedDatabaseUntouched(path)
+    }
+  )
+
+  it.each([
+    { label: 'negative schema version', sql: 'PRAGMA user_version = -1' },
+    { label: 'missing run table', sql: 'DROP TABLE profile_state_automation_runs' },
+    { label: 'missing metadata table', sql: 'DROP TABLE profile_state_automation_runs_meta' }
+  ])('rejects a version 2 database with $label before migration', ({ sql }) => {
+    const path = seedLegacyDatabase(
+      2,
+      { automationRuns: staleRuns },
+      { presence: 'array', runs: liveRuns }
+    )
+    const db = new Database(path)
+    try {
+      db.exec(sql)
+    } finally {
+      db.close()
+    }
+    expectRejectedDatabaseUntouched(path)
+  })
+})
+
+describe('required automation storage metadata', () => {
+  it.each([
+    { label: 'cleared array', payload: '[]' },
+    { label: 'explicit null', payload: 'null' },
+    { label: 'removed domain', payload: null }
+  ])('refuses lost metadata after $label instead of resurrecting retained state', ({ payload }) => {
+    const path = databasePath()
+    const db = openDatabase(path)
+    importProfileStateJson(db, JSON.stringify({ automationRuns: staleRuns }))
+    writeProfileStateDomain(db, { domain: 'automationRuns', payload, expectedRevision: 1 })
+    db.exec('DELETE FROM profile_state_automation_runs_meta')
+
+    expect(() => exportProfileStateJson(db)).toThrow()
+    expect(readProfileStateDomain(path, 'profile-a', 'automationRuns')).toMatchObject({
+      kind: 'unreadable'
+    })
+    expect(() =>
+      writeProfileStateDomain(db, {
+        domain: 'automationRuns',
+        payload: JSON.stringify(liveRuns),
+        expectedRevision: 2
+      })
+    ).toThrow()
+    expect(db.prepare('SELECT COUNT(*) AS count FROM profile_state_automation_runs').get()).toEqual(
+      { count: 0 }
+    )
+  })
+
+  it.each(['revision = 1', 'updated_at = 1', 'domain_version = 2', "content_hash = 'unexpected'"])(
+    'rejects a malformed document marker (%s)',
+    (assignment) => {
+      const db = openDatabase(databasePath())
+      importProfileStateJson(db, JSON.stringify({ automationRuns: { futureFormat: true } }))
+      db.exec(`UPDATE profile_state_automation_runs_meta SET ${assignment}`)
+      expect(() => exportProfileStateJson(db)).toThrow()
+    }
+  )
+
+  it('keeps one authority through complete imports of supported, unknown, and absent history', () => {
+    const db = openDatabase(databasePath())
+    for (const root of [
+      { settings: {}, automationRuns: liveRuns },
+      { settings: {}, automationRuns: { futureFormat: [2, 1] } },
+      { settings: {} },
+      { settings: {}, automationRuns: null },
+      { settings: {}, automationRuns: [] }
+    ]) {
+      importProfileStateJson(db, JSON.stringify(root))
+      expect(exportProfileStateJson(db)).toBe(JSON.stringify(root))
+      expect(
+        db.prepare('SELECT COUNT(*) AS count FROM profile_state_automation_runs_meta').get()
+      ).toEqual({ count: 1 })
+    }
+  })
+
+  it('rejects reopening a current database with lost metadata before changing its bytes', () => {
+    const path = databasePath()
+    const { db } = openProfileStateDatabase(path, 'profile-a')
+    db.exec('DELETE FROM profile_state_automation_runs_meta')
+    db.close()
+    const before = readFileSync(path)
+
+    expect(() => openDatabase(path)).toThrow()
+    expect(readFileSync(path)).toEqual(before)
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-backup-job.ts b/src/main/persistence/profile-state/profile-state-backup-job.ts
new file mode 100644
index 00000000000..f10ef15368c
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-job.ts
@@ -0,0 +1,33 @@
+import { openProfileStateDatabaseReadOnly } from './profile-state-database'
+import { writeProfileStateDatabaseSnapshotAsync } from './profile-state-database-snapshot'
+import { validateProfileStateSnapshot } from './profile-state-documents'
+
+export type ProfileStateBackupJob = {
+  databasePath: string
+  profileId: string
+  targetPath: string
+  temporaryPath?: string
+}
+
+/** Own every connection until the copy and its strict validation finish. */
+export async function writeProfileStateBackup(job: ProfileStateBackupJob): Promise<void> {
+  const opened = openProfileStateDatabaseReadOnly(job.databasePath, job.profileId)
+  try {
+    await writeProfileStateDatabaseSnapshotAsync(opened.db, job.targetPath, {
+      temporaryPath: job.temporaryPath,
+      validateStagedSnapshot: (stagingPath) =>
+        validateProfileStateBackup(stagingPath, job.profileId)
+    })
+  } finally {
+    opened.db.close()
+  }
+}
+
+function validateProfileStateBackup(path: string, profileId: string): void {
+  const snapshot = openProfileStateDatabaseReadOnly(path, profileId)
+  try {
+    validateProfileStateSnapshot(snapshot.db)
+  } finally {
+    snapshot.db.close()
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-backup-path.test.ts b/src/main/persistence/profile-state/profile-state-backup-path.test.ts
new file mode 100644
index 00000000000..593d490ce11
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-path.test.ts
@@ -0,0 +1,76 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupFiles,
+  profileStateDatabaseBackupPath,
+  profileStateDatabaseBackups
+} from './profile-state-backup-path'
+
+const directories: string[] = []
+afterEach(() => {
+  for (const path of directories.splice(0)) {
+    rmSync(path, { recursive: true, force: true })
+  }
+})
+
+function location(): string {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-backup-path-'))
+  directories.push(directory)
+  return join(directory, 'profile-state.db')
+}
+
+describe('profile state database backup discovery', () => {
+  it('lists immutable backup IDs newest-first without opening SQLite', () => {
+    const path = location()
+    const first = createProfileStateDatabaseBackupId(1_000)
+    const last = createProfileStateDatabaseBackupId(2_000)
+    writeFileSync(profileStateDatabaseBackupPath(path, first), 'first')
+    writeFileSync(profileStateDatabaseBackupPath(path, last), 'second')
+    writeFileSync(`${path}.backup.${last}.db.tmp`, 'incomplete staging')
+    writeFileSync(`${path}.backup.invalid.db`, 'unrelated')
+    expect(profileStateDatabaseBackups(path)).toEqual([
+      { id: last, path: profileStateDatabaseBackupPath(path, last), createdAtMs: 2_000 },
+      { id: first, path: profileStateDatabaseBackupPath(path, first), createdAtMs: 1_000 }
+    ])
+  })
+
+  it('keeps reserved artifact names visible when their type needs recovery', () => {
+    const path = location()
+    const id = createProfileStateDatabaseBackupId()
+    mkdirSync(profileStateDatabaseBackupPath(path, id))
+    expect(profileStateDatabaseBackups(path).map((backup) => backup.id)).toEqual([id])
+  })
+
+  it('includes every existing backup sidecar in the recovery archive inventory', () => {
+    const path = location()
+    const backup = profileStateDatabaseBackupPath(path, createProfileStateDatabaseBackupId())
+    const files = [backup, `${backup}-wal`, `${backup}-shm`, `${backup}-journal`]
+    for (const file of files) {
+      writeFileSync(file, 'recovery evidence')
+    }
+    expect(profileStateDatabaseBackupFiles(path)).toEqual(files)
+  })
+
+  it.each([
+    '../profile-state.db',
+    '1-../../outside',
+    '0-00000000-0000-4000-8000-000000000000',
+    '9007199254740992-00000000-0000-4000-8000-000000000000'
+  ])('rejects invalid or escaping IDs: %s', (id) =>
+    expect(() => profileStateDatabaseBackupPath(location(), id)).toThrow('ID is invalid')
+  )
+
+  it.each([0, -1, 1.5, Number.MAX_SAFE_INTEGER + 1])('rejects unsafe backup times: %s', (time) => {
+    expect(() => createProfileStateDatabaseBackupId(time)).toThrow('positive safe integer')
+  })
+
+  it('treats only a missing directory as an empty recovery inventory', () => {
+    const path = location()
+    expect(profileStateDatabaseBackups(join(path, 'profile-state.db'))).toEqual([])
+    writeFileSync(path, 'not a directory')
+    expect(() => profileStateDatabaseBackups(join(path, 'profile-state.db'))).toThrow()
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-backup-path.ts b/src/main/persistence/profile-state/profile-state-backup-path.ts
new file mode 100644
index 00000000000..c85029947c6
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-path.ts
@@ -0,0 +1,88 @@
+import { profileStateDatabaseFiles } from './profile-state-storage-classification'
+import { randomUUID } from 'node:crypto'
+import { existsSync, readdirSync } from 'node:fs'
+import { readdir } from 'node:fs/promises'
+import { basename, dirname, join } from 'node:path'
+
+const BACKUP_ID_PATTERN =
+  /^([1-9]\d*)-([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})$/
+
+export type ProfileStateDatabaseBackup = {
+  id: string
+  path: string
+  createdAtMs: number
+}
+
+export function createProfileStateDatabaseBackupId(now = Date.now()): string {
+  if (!Number.isSafeInteger(now) || now <= 0) {
+    throw new Error('Profile state backup timestamp must be a positive safe integer')
+  }
+  return `${now}-${randomUUID()}`
+}
+
+export function profileStateDatabaseBackupPath(databaseFile: string, id: string): string {
+  if (parseBackupCreatedAt(id) === undefined) {
+    throw new Error('Profile state backup ID is invalid')
+  }
+  return `${databaseFile}.backup.${id}.db`
+}
+
+/** Enumerate immutable recovery artifacts without opening the possibly damaged primary. */
+export function profileStateDatabaseBackups(
+  databaseFile: string
+): readonly ProfileStateDatabaseBackup[] {
+  let entries: string[]
+  try {
+    entries = readdirSync(dirname(databaseFile))
+  } catch (error) {
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+      return []
+    }
+    throw error
+  }
+  return parseBackupEntries(databaseFile, entries)
+}
+
+export async function profileStateDatabaseBackupsAsync(
+  databaseFile: string
+): Promise<readonly ProfileStateDatabaseBackup[]> {
+  try {
+    return parseBackupEntries(databaseFile, await readdir(dirname(databaseFile)))
+  } catch (error) {
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+      return []
+    }
+    throw error
+  }
+}
+
+function parseBackupEntries(
+  databaseFile: string,
+  entries: readonly string[]
+): readonly ProfileStateDatabaseBackup[] {
+  const directory = dirname(databaseFile)
+  const prefix = `${basename(databaseFile)}.backup.`
+  return entries
+    .flatMap((name) => {
+      if (typeof name !== 'string' || !name.startsWith(prefix) || !name.endsWith('.db')) {
+        return []
+      }
+      const id = name.slice(prefix.length, -3)
+      const createdAtMs = parseBackupCreatedAt(id)
+      return createdAtMs === undefined ? [] : [{ id, path: join(directory, name), createdAtMs }]
+    })
+    .sort((left, right) => right.createdAtMs - left.createdAtMs || right.id.localeCompare(left.id))
+}
+
+function parseBackupCreatedAt(id: string): number | undefined {
+  const match = BACKUP_ID_PATTERN.exec(id)
+  const timestamp = match ? Number(match[1]) : 0
+  return Number.isSafeInteger(timestamp) && timestamp > 0 ? timestamp : undefined
+}
+
+/** Preserve sidecars too if an external writer has opened an otherwise immutable backup. */
+export function profileStateDatabaseBackupFiles(databaseFile: string): readonly string[] {
+  return profileStateDatabaseBackups(databaseFile).flatMap(({ path }) =>
+    profileStateDatabaseFiles(path).filter(existsSync)
+  )
+}
diff --git a/src/main/persistence/profile-state/profile-state-backup-rotation.test.ts b/src/main/persistence/profile-state/profile-state-backup-rotation.test.ts
new file mode 100644
index 00000000000..eb99b1fd128
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-rotation.test.ts
@@ -0,0 +1,278 @@
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
+import * as fsPromises from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { ProfileStateBackupRotation } from './profile-state-backup-rotation'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath,
+  profileStateDatabaseBackups
+} from './profile-state-backup-path'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from './profile-state-database'
+import { importProfileStateJson, readProfileStateSnapshot } from './profile-state-documents'
+import * as backupExecution from './profile-state-backup-worker'
+
+vi.mock('node:fs/promises', async (importOriginal) => {
+  const actual = await importOriginal<typeof fsPromises>()
+  return { ...actual }
+})
+
+const directories: string[] = []
+const rotations: ProfileStateBackupRotation[] = []
+const databases: ReturnType<typeof openProfileStateDatabase>[] = []
+const HOUR = 60 * 60 * 1000
+
+beforeEach(() => {
+  vi.spyOn(backupExecution, 'runProfileStateBackup')
+})
+
+afterEach(async () => {
+  for (const rotation of rotations.splice(0)) {
+    rotation.stop()
+    await rotation.drain()
+  }
+  for (const opened of databases.splice(0)) {
+    opened.db.close()
+  }
+  vi.restoreAllMocks()
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-sqlite-backup-'))
+  directories.push(directory)
+  const databasePath = join(directory, 'profile-state.db')
+  const opened = openProfileStateDatabase(databasePath, 'backup-profile')
+  databases.push(opened)
+  const clock = { now: Date.now() }
+  const rotation = createRotation(databasePath, () => clock.now)
+  const write = (generation: number) => {
+    importProfileStateJson(opened.db, JSON.stringify({ settings: { generation } }))
+  }
+  write(1)
+  return { directory, databasePath, opened, rotation, write, clock }
+}
+
+function createRotation(databasePath: string, now: () => number = Date.now) {
+  const rotation = new ProfileStateBackupRotation(databasePath, 'backup-profile', now)
+  rotations.push(rotation)
+  return rotation
+}
+
+function readBackup(path: string) {
+  const opened = openProfileStateDatabaseReadOnly(path, 'backup-profile')
+  try {
+    return JSON.parse(readProfileStateSnapshot(opened.db).json)
+  } finally {
+    opened.db.close()
+  }
+}
+
+describe('automatic SQLite recovery generations', () => {
+  it('copies committed WAL state once, without a live JSON writer or snapshot sidecars', async () => {
+    const { directory, databasePath, rotation, write } = fixture()
+    write(2)
+    rotation.schedule()
+    rotation.schedule()
+    await rotation.drain()
+    const backups = profileStateDatabaseBackups(databasePath)
+    expect(backups).toHaveLength(1)
+    expect(readBackup(backups[0].path)).toEqual({ settings: { generation: 2 } })
+    expect(existsSync(join(directory, 'orca-data.json'))).toBe(false)
+    expect(readdirSync(directory).filter((name) => name.includes('.backup.'))).toEqual([
+      backups[0].path.slice(directory.length + 1)
+    ])
+  })
+
+  it('keeps five hourly generations and remembers cadence across reopen', async () => {
+    const { databasePath, rotation, write, clock } = fixture()
+    const beginning = Date.now()
+    clock.now = beginning
+    for (let generation = 1; generation <= 7; generation++) {
+      clock.now = beginning + (generation - 1) * HOUR
+      write(generation)
+      rotation.schedule()
+      await rotation.drain()
+    }
+    const backups = profileStateDatabaseBackups(databasePath)
+    expect(backups).toHaveLength(5)
+    expect(backups.map(({ path }) => readBackup(path).settings.generation)).toEqual([7, 6, 5, 4, 3])
+    const reopened = createRotation(databasePath, () => clock.now)
+    reopened.schedule()
+    await reopened.drain()
+    expect(profileStateDatabaseBackups(databasePath)).toEqual(backups)
+    clock.now = beginning + 7 * HOUR - 1
+    reopened.schedule()
+    await reopened.drain()
+    expect(profileStateDatabaseBackups(databasePath)).toEqual(backups)
+    clock.now = beginning + 7 * HOUR
+    write(8)
+    reopened.schedule()
+    await reopened.drain()
+    expect(
+      profileStateDatabaseBackups(databasePath).map(
+        ({ path }) => readBackup(path).settings.generation
+      )
+    ).toEqual([8, 7, 6, 5, 4])
+  })
+
+  it('preserves all earlier backups on failure and retries without rejecting a committed write', async () => {
+    const { databasePath, rotation, opened, write, clock } = fixture()
+    const beginning = Date.now()
+    clock.now = beginning
+    rotation.schedule()
+    await rotation.drain()
+    const retained = profileStateDatabaseBackups(databasePath)
+    const snapshot = vi
+      .spyOn(backupExecution, 'runProfileStateBackup')
+      .mockClear()
+      .mockRejectedValueOnce(new Error('disk full'))
+    const log = vi.spyOn(console, 'error').mockImplementation(() => {})
+    clock.now = beginning + HOUR
+    write(2)
+    rotation.schedule()
+    await expect(rotation.drain()).resolves.toBeUndefined()
+    expect(JSON.parse(readProfileStateSnapshot(opened.db).json).settings.generation).toBe(2)
+    expect(profileStateDatabaseBackups(databasePath)).toEqual(retained)
+    expect(log).toHaveBeenCalledOnce()
+    rotation.schedule()
+    await rotation.drain()
+    expect(snapshot).toHaveBeenCalledOnce()
+    clock.now = beginning + HOUR + 60_000
+    rotation.schedule()
+    await rotation.drain()
+    expect(profileStateDatabaseBackups(databasePath)).toHaveLength(2)
+  })
+
+  it('does not prune previous generations when the new copy fails strict validation', async () => {
+    const { databasePath, rotation, clock } = fixture()
+    const beginning = Date.now()
+    clock.now = beginning
+    rotation.schedule()
+    await rotation.drain()
+    const retained = profileStateDatabaseBackups(databasePath)
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    vi.spyOn(backupExecution, 'runProfileStateBackup')
+      .mockClear()
+      .mockRejectedValueOnce(new Error('staged validation failed'))
+    clock.now = beginning + HOUR
+    rotation.schedule()
+    await rotation.drain()
+    expect(profileStateDatabaseBackups(databasePath)).toEqual(retained)
+  })
+
+  it('cancels a queued backup before opening a source after Store close', async () => {
+    const { databasePath, rotation } = fixture()
+    rotation.schedule()
+    expect(() => rotation.assertIdle()).toThrow('Flush pending')
+    rotation.stop()
+    expect(() => rotation.assertIdle()).toThrow('Flush pending')
+    await rotation.drain()
+    expect(() => rotation.assertIdle()).not.toThrow()
+    expect(profileStateDatabaseBackups(databasePath)).toEqual([])
+  })
+
+  it('blocks synchronous quarantine until retention pruning finishes', async () => {
+    const { databasePath, rotation, clock } = fixture()
+    for (let generation = 0; generation < 5; generation++) {
+      rotation.schedule()
+      await rotation.drain()
+      clock.now += HOUR
+    }
+    const oldest = profileStateDatabaseBackups(databasePath)[4].path
+    const remove = fsPromises.rm
+    let begin: () => void = () => {}
+    let release: () => void = () => {}
+    const started = new Promise<void>((resolve) => {
+      begin = resolve
+    })
+    const gate = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    vi.spyOn(fsPromises, 'rm').mockImplementation(async (path, options) => {
+      if (path === oldest) {
+        begin()
+        await gate
+      }
+      await remove(path, options)
+    })
+    rotation.schedule()
+    try {
+      await started
+      rotation.stop()
+      expect(profileStateDatabaseBackups(databasePath)).toHaveLength(6)
+      expect(() => rotation.assertIdle()).toThrow('Flush pending')
+    } finally {
+      release()
+      await rotation.drain()
+    }
+    expect(() => rotation.assertIdle()).not.toThrow()
+    expect(profileStateDatabaseBackups(databasePath)).toHaveLength(5)
+  })
+
+  it('owns an in-flight source until completion and blocks synchronous quarantine', async () => {
+    const { databasePath, rotation, opened } = fixture()
+    const realSnapshot = backupExecution.runProfileStateBackup
+    let begin: () => void = () => {}
+    let release: () => void = () => {}
+    const started = new Promise<void>((resolve) => {
+      begin = resolve
+    })
+    const gate = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    vi.spyOn(backupExecution, 'runProfileStateBackup').mockImplementationOnce(async (job) => {
+      begin()
+      await gate
+      await realSnapshot(job)
+    })
+    rotation.schedule()
+    await started
+    rotation.stop()
+    opened.db.close()
+    databases.splice(databases.indexOf(opened), 1)
+    expect(() => rotation.assertIdle()).toThrow('Flush pending')
+    release()
+    await rotation.drain()
+    expect(() => rotation.assertIdle()).not.toThrow()
+    expect(readBackup(profileStateDatabaseBackups(databasePath)[0].path)).toEqual({
+      settings: { generation: 1 }
+    })
+  })
+
+  it('does not treat a reserved-name directory as a recent successful backup', async () => {
+    const { databasePath, rotation } = fixture()
+    const invalid = profileStateDatabaseBackupPath(
+      databasePath,
+      createProfileStateDatabaseBackupId()
+    )
+    mkdirSync(invalid)
+    rotation.schedule()
+    await rotation.drain()
+    expect(profileStateDatabaseBackups(databasePath)).toHaveLength(2)
+    expect(existsSync(invalid)).toBe(true)
+  })
+
+  it('preserves a backup with sidecars without counting it toward cadence or retention', async () => {
+    const { databasePath, rotation, clock } = fixture()
+    rotation.schedule()
+    await rotation.drain()
+    const original = profileStateDatabaseBackups(databasePath)[0].path
+    writeFileSync(`${original}-journal`, 'external unfinished write')
+    const reopened = createRotation(databasePath, () => clock.now)
+    for (let generation = 0; generation < 6; generation++) {
+      reopened.schedule()
+      await reopened.drain()
+      clock.now += HOUR
+    }
+    expect(existsSync(original)).toBe(true)
+    expect(existsSync(`${original}-journal`)).toBe(true)
+    expect(profileStateDatabaseBackups(databasePath)).toHaveLength(6)
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-backup-rotation.ts b/src/main/persistence/profile-state/profile-state-backup-rotation.ts
new file mode 100644
index 00000000000..d13ce4265da
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-rotation.ts
@@ -0,0 +1,131 @@
+import { lstat, rm } from 'node:fs/promises'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath,
+  profileStateDatabaseBackupsAsync,
+  type ProfileStateDatabaseBackup
+} from './profile-state-backup-path'
+import { runProfileStateBackup } from './profile-state-backup-worker'
+import { removeAbandonedProfileStateBackupFiles } from './profile-state-backup-temporary-files'
+
+const BACKUP_COUNT = 5
+const BACKUP_INTERVAL_MS = 60 * 60 * 1000
+const BACKUP_RETRY_MS = 60 * 1000
+
+/** Immutable generations keep every previous recovery point until publication succeeds. */
+export class ProfileStateBackupRotation {
+  private pending: Promise<void> | undefined
+  private stopped = false
+  private readonly cancellation = new AbortController()
+  private nextAttemptAt = 0
+
+  constructor(
+    private readonly databasePath: string,
+    private readonly profileId: string,
+    private readonly now: () => number = Date.now,
+    private readonly runBackup = runProfileStateBackup
+  ) {}
+
+  schedule(): void {
+    if (this.stopped || this.pending || this.now() < this.nextAttemptAt) {
+      return
+    }
+    const pending = Promise.resolve()
+      .then(() => this.rotate())
+      .catch((error: unknown) => {
+        this.nextAttemptAt = this.now() + BACKUP_RETRY_MS
+        if (this.stopped && (this.cancellation.signal.aborted || isMissingPath(error))) {
+          return
+        }
+        console.error('[persistence] Failed to back up profile state database:', error)
+      })
+      .finally(() => {
+        if (this.pending === pending) {
+          this.pending = undefined
+        }
+      })
+    this.pending = pending
+  }
+
+  async drain(): Promise<void> {
+    await this.pending
+  }
+
+  stop(): void {
+    this.stopped = true
+    this.cancellation.abort()
+  }
+
+  assertIdle(): void {
+    if (this.pending) {
+      throw new Error('Flush pending profile state backups before quarantining the database')
+    }
+  }
+
+  private async rotate(): Promise<void> {
+    if (this.stopped) {
+      return
+    }
+    const now = this.now()
+    await removeAbandonedProfileStateBackupFiles(this.databasePath, now)
+    const latest = (await this.regularBackups())[0]
+    if (this.stopped) {
+      return
+    }
+    if (latest && now - latest.createdAtMs < BACKUP_INTERVAL_MS) {
+      this.nextAttemptAt = Math.min(latest.createdAtMs, now) + BACKUP_INTERVAL_MS
+      return
+    }
+    const target = profileStateDatabaseBackupPath(
+      this.databasePath,
+      createProfileStateDatabaseBackupId(now)
+    )
+    await this.runBackup(
+      {
+        databasePath: this.databasePath,
+        profileId: this.profileId,
+        targetPath: target
+      },
+      this.cancellation.signal
+    )
+    this.nextAttemptAt = this.now() + BACKUP_INTERVAL_MS
+    for (const backup of (await this.regularBackups()).slice(BACKUP_COUNT)) {
+      await rm(backup.path, { force: true })
+    }
+  }
+
+  private async regularBackups(): Promise<readonly ProfileStateDatabaseBackup[]> {
+    const backups = await profileStateDatabaseBackupsAsync(this.databasePath)
+    const candidates = await Promise.all(
+      backups.map(async (backup) => {
+        try {
+          if (!(await lstat(backup.path)).isFile()) {
+            return undefined
+          }
+          for (const suffix of ['-wal', '-shm', '-journal']) {
+            const sidecar = await lstat(`${backup.path}${suffix}`).catch((error: unknown) => {
+              if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+                return undefined
+              }
+              throw error
+            })
+            if (sidecar !== undefined) {
+              return undefined
+            }
+          }
+          return backup
+        } catch (error) {
+          if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+            return undefined
+          }
+          throw error
+        }
+      })
+    )
+    return candidates.filter((backup) => backup !== undefined)
+  }
+}
+
+function isMissingPath(error: unknown): boolean {
+  return error instanceof Error && 'code' in error && error.code === 'ENOENT'
+}
diff --git a/src/main/persistence/profile-state/profile-state-backup-temporary-files.test.ts b/src/main/persistence/profile-state/profile-state-backup-temporary-files.test.ts
new file mode 100644
index 00000000000..a37de695fa5
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-temporary-files.test.ts
@@ -0,0 +1,91 @@
+import { mkdtempSync, readdirSync, rmSync, utimesSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import * as identity from './profile-state-access-identity'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath
+} from './profile-state-backup-path'
+import {
+  profileStateBackupTemporaryPath,
+  removeAbandonedProfileStateBackupFiles
+} from './profile-state-backup-temporary-files'
+
+vi.mock('./profile-state-access-identity', () => ({
+  profileStateAccessBootIdentity: () => 'test-boot'
+}))
+vi.mock('./profile-state-access-owner', () => ({
+  profileStateAccessPidNamespace: () => 'test-namespace'
+}))
+
+const roots: string[] = []
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+describe('abandoned profile database backups', () => {
+  it('does not infer ownership when kernel identity is unavailable', async () => {
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue(null)
+    const probe = vi.spyOn(process, 'kill')
+    await removeAbandonedProfileStateBackupFiles('/missing/profile-state.db', Date.now())
+    expect(probe).not.toHaveBeenCalled()
+    expect(profileStateBackupTemporaryPath('/profile/backup.db')).not.toContain('.owner-')
+  })
+
+  it('removes only old temporary files whose owner is proven exited', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'orca-backup-orphans-'))
+    roots.push(root)
+    const databasePath = join(root, 'profile-state.db')
+    const backup = profileStateDatabaseBackupPath(
+      databasePath,
+      createProfileStateDatabaseBackupId()
+    )
+    const now = Date.now()
+    const old = new Date(now - 2 * 60 * 60_000)
+    const temporary = profileStateBackupTemporaryPath(backup)
+    const orphan = temporary.replace(`.${process.pid}.`, '.12345.')
+    const live = temporary.replace(`.${process.pid}.`, '.12346.')
+    const unknown = temporary.replace(`.${process.pid}.`, '.12347.')
+    const recent = profileStateBackupTemporaryPath(backup).replace(`.${process.pid}.`, '.12345.')
+    const remote = orphan.replace(/owner-[a-f0-9]{64}/, `owner-${'0'.repeat(64)}`)
+    const legacy = `${backup}.12345.${now}.ab12.tmp`
+    const unrelated = `${databasePath}.unrelated.tmp`
+    for (const path of [
+      backup,
+      orphan,
+      `${orphan}-wal`,
+      `${orphan}-shm`,
+      `${orphan}-journal`,
+      live,
+      unknown,
+      recent,
+      remote,
+      legacy,
+      unrelated
+    ]) {
+      writeFileSync(path, 'retained')
+      if (path !== recent) {
+        utimesSync(path, old, old)
+      }
+    }
+    vi.spyOn(process, 'kill').mockImplementation((pid) => {
+      if (pid === 12345) {
+        throw Object.assign(new Error('exited'), { code: 'ESRCH' })
+      }
+      if (pid === 12347) {
+        throw Object.assign(new Error('denied'), { code: 'EPERM' })
+      }
+      return true
+    })
+    await removeAbandonedProfileStateBackupFiles(databasePath, now)
+    expect(readdirSync(root).sort()).toEqual(
+      [backup, live, unknown, recent, remote, legacy, unrelated]
+        .map((path) => basename(path))
+        .sort()
+    )
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-backup-temporary-files.ts b/src/main/persistence/profile-state/profile-state-backup-temporary-files.ts
new file mode 100644
index 00000000000..eb0424abbc2
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-temporary-files.ts
@@ -0,0 +1,71 @@
+import { createHash } from 'node:crypto'
+import { lstat, readdir, rm } from 'node:fs/promises'
+import { durableWriteTempPath } from '../../durable-file-write'
+import { profileStateAccessBootIdentity } from './profile-state-access-identity'
+import { profileStateAccessPidNamespace } from './profile-state-access-owner'
+import { basename, dirname, join } from 'node:path'
+
+const ORPHAN_AGE_MS = 60 * 60_000
+const BACKUP_TEMP_PATTERN =
+  /^([1-9]\d*)-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\.db\.owner-([a-f0-9]{64})\.([1-9]\d*)\.\d+\.[0-9a-f]+\.tmp(?:-(?:wal|shm|journal))?$/
+
+export function profileStateBackupTemporaryPath(targetPath: string): string {
+  const scope = currentProcessScope()
+  return durableWriteTempPath(scope ? `${targetPath}.owner-${scope}` : targetPath)
+}
+
+function currentProcessScope(): string | undefined {
+  const boot = profileStateAccessBootIdentity()
+  const namespace = profileStateAccessPidNamespace()
+  if (!boot || (process.platform === 'linux' && namespace === null)) {
+    return undefined
+  }
+  return createHash('sha256')
+    .update(JSON.stringify([process.platform, boot, namespace]))
+    .digest('hex')
+}
+
+/** A dead process proves the temporary database and its journals cannot still be in use. */
+export async function removeAbandonedProfileStateBackupFiles(
+  databasePath: string,
+  now: number
+): Promise<void> {
+  const scope = currentProcessScope()
+  if (!scope) {
+    return
+  }
+  const directory = dirname(databasePath)
+  const prefix = `${basename(databasePath)}.backup.`
+  for (const name of await readdir(directory)) {
+    if (!name.startsWith(prefix)) {
+      continue
+    }
+    const match = BACKUP_TEMP_PATTERN.exec(name.slice(prefix.length))
+    if (!match || match[2] !== scope || !ownerExited(Number(match[3]))) {
+      continue
+    }
+    const path = join(directory, name)
+    try {
+      const info = await lstat(path)
+      if (info.isFile() && now - info.mtimeMs >= ORPHAN_AGE_MS) {
+        await rm(path, { force: true })
+      }
+    } catch (error) {
+      if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT')) {
+        throw error
+      }
+    }
+  }
+}
+
+function ownerExited(pid: number): boolean {
+  if (!Number.isSafeInteger(pid) || pid <= 0) {
+    return false
+  }
+  try {
+    process.kill(pid, 0)
+    return false
+  } catch (error) {
+    return error instanceof Error && 'code' in error && error.code === 'ESRCH'
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-backup-worker-entry.ts b/src/main/persistence/profile-state/profile-state-backup-worker-entry.ts
new file mode 100644
index 00000000000..9213e4e0042
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-worker-entry.ts
@@ -0,0 +1,30 @@
+import { parentPort, workerData } from 'node:worker_threads'
+import { writeProfileStateBackup } from './profile-state-backup-job'
+import { isRecord } from './profile-state-document-validation'
+
+if (!parentPort) {
+  throw new Error('Profile state backup must run on a worker thread')
+}
+const port = parentPort
+const request: unknown = workerData
+if (
+  !isRecord(request) ||
+  typeof request.databasePath !== 'string' ||
+  typeof request.profileId !== 'string' ||
+  typeof request.targetPath !== 'string' ||
+  (request.temporaryPath !== undefined && typeof request.temporaryPath !== 'string')
+) {
+  throw new Error('Invalid profile state backup request')
+}
+
+void writeProfileStateBackup({
+  databasePath: request.databasePath,
+  profileId: request.profileId,
+  targetPath: request.targetPath,
+  temporaryPath: request.temporaryPath
+})
+  .then(
+    () => port.postMessage({ ok: true }),
+    (error: unknown) => port.postMessage({ ok: false, error: String(error) })
+  )
+  .finally(() => port.close())
diff --git a/src/main/persistence/profile-state/profile-state-backup-worker.test.ts b/src/main/persistence/profile-state/profile-state-backup-worker.test.ts
new file mode 100644
index 00000000000..310c1471420
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-worker.test.ts
@@ -0,0 +1,236 @@
+import { build } from 'esbuild'
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
+import { ProfileStateBackupRotation } from './profile-state-backup-rotation'
+import { profileStateDatabaseBackups } from './profile-state-backup-path'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from './profile-state-database'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateSnapshot
+} from './profile-state-documents'
+import {
+  runProfileStateBackupWorker,
+  resolveProfileStateBackupWorkerPath
+} from './profile-state-backup-worker'
+import * as backupWorker from './profile-state-backup-worker'
+
+const directories: string[] = []
+let workerDirectory: string
+let workerPath: string
+
+beforeAll(async () => {
+  workerDirectory = mkdtempSync(join(tmpdir(), 'orca-backup-worker-entry-'))
+  workerPath = join(workerDirectory, 'profile-state-backup-worker-entry.js')
+  await build({
+    entryPoints: [
+      resolve('src/main/persistence/profile-state/profile-state-backup-worker-entry.ts')
+    ],
+    outfile: workerPath,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    logLevel: 'silent'
+  })
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+afterAll(() => rmSync(workerDirectory, { recursive: true, force: true }))
+
+function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-backup-worker-'))
+  directories.push(directory)
+  const job = {
+    databasePath: join(directory, 'profile-state.db'),
+    targetPath: join(directory, 'backup.db'),
+    profileId: 'worker-test'
+  }
+  const opened = openProfileStateDatabase(job.databasePath, job.profileId)
+  importProfileStateJson(opened.db, '{"settings":{"theme":"dark"}}')
+  opened.db.close()
+  return { directory, job }
+}
+
+function script(directory: string, source: string): string {
+  const path = join(directory, 'worker.cjs')
+  writeFileSync(path, source)
+  return path
+}
+
+describe('profile state backup worker', () => {
+  it('runs the built entry and releases every handle before recovery can move its files', async () => {
+    const { directory, job } = fixture()
+    await runProfileStateBackupWorker(job, { workerPath })
+    const snapshot = openProfileStateDatabaseReadOnly(job.targetPath, job.profileId)
+    try {
+      expect(JSON.parse(readProfileStateSnapshot(snapshot.db).json)).toEqual({
+        settings: { theme: 'dark' }
+      })
+    } finally {
+      snapshot.db.close()
+    }
+    expect(readdirSync(directory).filter((name) => name.startsWith('backup.db'))).toEqual([
+      'backup.db'
+    ])
+    rmSync(directory, { recursive: true })
+    expect(existsSync(directory)).toBe(false)
+  })
+
+  it.each([
+    [
+      'a mismatched stored hash',
+      (db: ReturnType<typeof openProfileStateDatabase>['db']) => {
+        db.prepare('UPDATE profile_state_documents SET content_hash = ?').run('0'.repeat(64))
+      },
+      'hash mismatch'
+    ],
+    [
+      'an independently hashed invalid domain fragment',
+      (db: ReturnType<typeof openProfileStateDatabase>['db']) => {
+        db.prepare(
+          "UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = 'settings'"
+        ).run('{', hashProfileStateJson('{'))
+      },
+      'invalid JSON'
+    ],
+    [
+      'an independently hashed invalid normalized history fragment',
+      (db: ReturnType<typeof openProfileStateDatabase>['db']) => {
+        importProfileStateJson(db, '{"automationRuns":[{"id":"run-1","output":"ok"}]}')
+        db.prepare(
+          'UPDATE profile_state_automation_runs SET payload = ?, content_hash = ? WHERE run_id = ?'
+        ).run('{', hashProfileStateJson('{'), 'run-1')
+      },
+      'invalid JSON'
+    ]
+  ] as const)('%s', async (_description, corrupt, expectedError) => {
+    const { job } = fixture()
+    const primary = openProfileStateDatabase(job.databasePath, job.profileId)
+    corrupt(primary.db)
+    primary.db.close()
+    const before = readFileSync(job.databasePath)
+    const retained = `${job.targetPath}.prior`
+    writeFileSync(retained, 'previous recovery point')
+
+    await expect(runProfileStateBackupWorker(job, { workerPath })).rejects.toThrow(expectedError)
+    expect(existsSync(job.targetPath)).toBe(false)
+    expect(readFileSync(retained, 'utf8')).toBe('previous recovery point')
+    expect(readFileSync(job.databasePath)).toEqual(before)
+  })
+
+  it.each(['true', 'false'])('waits for actual exit after an ok=%s response', async (ok) => {
+    const { directory, job } = fixture()
+    const delayedWorker = script(
+      directory,
+      `
+      const { parentPort, workerData } = require('node:worker_threads')
+      parentPort.postMessage({ ok: ${ok}, error: 'backup failed' })
+      setTimeout(() => {
+        require('node:fs').writeFileSync(workerData.targetPath, 'handles released')
+        parentPort.close()
+      }, 50)
+    `
+    )
+    const result = runProfileStateBackupWorker(job, { workerPath: delayedWorker })
+    await (ok === 'true' ? result : expect(result).rejects.toThrow('backup failed'))
+    expect(readFileSync(job.targetPath, 'utf8')).toBe('handles released')
+  })
+
+  it.each([
+    ['throw new Error("worker boot failed")', 'worker boot failed'],
+    ['process.exit(0)', 'without completion'],
+    ['require("node:worker_threads").parentPort.postMessage({ wrong: true })', 'Invalid profile'],
+    ['setInterval(() => {}, 1000)', 'timed out']
+  ])('fails closed for worker failure: %s', async (source, error) => {
+    const { directory, job } = fixture()
+    const failedWorker = script(directory, source)
+    await expect(
+      runProfileStateBackupWorker(job, { workerPath: failedWorker, timeoutMs: 500 })
+    ).rejects.toThrow(error)
+    expect(existsSync(job.targetPath)).toBe(false)
+    rmSync(directory, { recursive: true })
+  })
+
+  it.each(['timeout', 'cancel'] as const)(
+    'cleans a terminated %s worker only after exit',
+    async (mode) => {
+      const { directory, job } = fixture()
+      const ready = join(directory, 'ready')
+      const worker = script(
+        directory,
+        `
+      const { workerData } = require('node:worker_threads')
+      const fs = require('node:fs')
+      for (const suffix of ['', '-wal', '-shm', '-journal']) fs.writeFileSync(workerData.temporaryPath + suffix, 'incomplete')
+      fs.writeFileSync(${JSON.stringify(ready)}, 'ready')
+      setInterval(() => {}, 1000)
+    `
+      )
+      const cancellation = new AbortController()
+      const pending = runProfileStateBackupWorker(job, {
+        workerPath: worker,
+        timeoutMs: 500,
+        signal: cancellation.signal
+      })
+      const failed = expect(pending).rejects.toThrow(mode === 'cancel' ? 'cancelled' : 'timed out')
+      await vi.waitFor(() => expect(existsSync(ready)).toBe(true))
+      expect(readdirSync(directory).filter((name) => name.startsWith('backup.db.'))).toHaveLength(4)
+      if (mode === 'cancel') {
+        cancellation.abort()
+      }
+      await failed
+      expect(readdirSync(directory).filter((name) => name.startsWith('backup.db.'))).toEqual([])
+      expect(existsSync(job.databasePath)).toBe(true)
+    }
+  )
+
+  it('reports a missing bundle and leaves the primary untouched', async () => {
+    const { directory, job } = fixture()
+    const before = readFileSync(job.databasePath)
+    await expect(
+      runProfileStateBackupWorker(job, { workerPath: join(directory, 'missing.js') })
+    ).rejects.toThrow()
+    expect(readFileSync(job.databasePath)).toEqual(before)
+  })
+
+  it('coalesces desktop work and drains a started backup before allowing quarantine', async () => {
+    const { directory, job } = fixture()
+    let started: () => void = () => {}
+    const beginning = new Promise<void>((resolve) => {
+      started = resolve
+    })
+    const dispatch = vi
+      .spyOn(backupWorker, 'runProfileStateBackup')
+      .mockImplementation((request) => {
+        started()
+        return runProfileStateBackupWorker(request, { workerPath })
+      })
+    const rotation = new ProfileStateBackupRotation(job.databasePath, job.profileId)
+    rotation.schedule()
+    rotation.schedule()
+    await beginning
+    rotation.stop()
+    expect(() => rotation.assertIdle()).toThrow('Flush pending')
+    await rotation.drain()
+    expect(() => rotation.assertIdle()).not.toThrow()
+    expect(dispatch).toHaveBeenCalledOnce()
+    expect(profileStateDatabaseBackups(job.databasePath)).toHaveLength(1)
+    rmSync(directory, { recursive: true })
+  })
+
+  it('finds entries beside the launcher and above Rollup shared chunks', () => {
+    expect(resolveProfileStateBackupWorkerPath(workerDirectory)).toBe(workerPath)
+    expect(resolveProfileStateBackupWorkerPath(join(workerDirectory, 'chunks'))).toBe(workerPath)
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-backup-worker.ts b/src/main/persistence/profile-state/profile-state-backup-worker.ts
new file mode 100644
index 00000000000..b671df94112
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-worker.ts
@@ -0,0 +1,87 @@
+import { existsSync } from 'node:fs'
+import { rm } from 'node:fs/promises'
+import { profileStateBackupTemporaryPath } from './profile-state-backup-temporary-files'
+import { profileStateDatabaseFiles } from './profile-state-storage-classification'
+import { dirname, join } from 'node:path'
+import { Worker } from 'node:worker_threads'
+import {
+  currentWorkerEntryLayout,
+  resolveWorkerThreadEntryPath
+} from '../../worker-thread-entry-path'
+import { type ProfileStateBackupJob, writeProfileStateBackup } from './profile-state-backup-job'
+import { isRecord } from './profile-state-document-validation'
+
+const WORKER_FILENAME = 'profile-state-backup-worker-entry.js'
+const BACKUP_TIMEOUT_MS = 10 * 60_000
+
+export function resolveProfileStateBackupWorkerPath(moduleDir = __dirname): string {
+  const entry = resolveWorkerThreadEntryPath(currentWorkerEntryLayout(moduleDir), WORKER_FILENAME)
+  // Rollup can place this launcher in a shared chunk beside the worker entries.
+  return [entry, join(dirname(entry), '..', WORKER_FILENAME)].find(existsSync) ?? entry
+}
+
+/** Bun snapshot copying and desktop validation run off the owning runtime thread. */
+export function runProfileStateBackup(
+  job: ProfileStateBackupJob,
+  signal?: AbortSignal
+): Promise<void> {
+  return process.versions.electron || process.versions.bun
+    ? runProfileStateBackupWorker(job, { signal })
+    : writeProfileStateBackup(job)
+}
+
+export async function runProfileStateBackupWorker(
+  job: ProfileStateBackupJob,
+  options: { workerPath?: string; timeoutMs?: number; signal?: AbortSignal } = {}
+): Promise<void> {
+  options.signal?.throwIfAborted()
+  const temporaryPath = profileStateBackupTemporaryPath(job.targetPath)
+  try {
+    await new Promise<void>((resolve, reject) => {
+      const workerPath = options.workerPath ?? resolveProfileStateBackupWorkerPath()
+      const worker = new Worker(workerPath, { workerData: { ...job, temporaryPath }, execArgv: [] })
+      let completed = false
+      let failure: Error | undefined
+      const terminate = (reason: Error): void => {
+        failure ??= reason
+        void worker.terminate().catch((error: unknown) => {
+          failure = error instanceof Error ? error : new Error(String(error))
+        })
+      }
+      const abort = (): void => terminate(new Error('Profile state backup cancelled'))
+      options.signal?.addEventListener('abort', abort, { once: true })
+      const timer = setTimeout(
+        () => terminate(new Error('Profile state backup worker timed out')),
+        options.timeoutMs ?? BACKUP_TIMEOUT_MS
+      )
+      worker.on('message', (response: unknown) => {
+        if (!isRecord(response) || typeof response.ok !== 'boolean') {
+          failure = new Error('Invalid profile state backup worker response')
+        } else if (!response.ok) {
+          failure = new Error(String(response.error))
+        } else {
+          completed = true
+        }
+      })
+      worker.on('error', (error) => {
+        failure = error instanceof Error ? error : new Error(String(error))
+      })
+      // Even an error response leaves handles open until the worker actually exits.
+      worker.once('exit', (code) => {
+        clearTimeout(timer)
+        options.signal?.removeEventListener('abort', abort)
+        if (failure || code !== 0 || !completed) {
+          reject(
+            failure ?? new Error(`Profile state backup worker exited without completion (${code})`)
+          )
+        } else {
+          resolve()
+        }
+      })
+    })
+  } finally {
+    await Promise.all(
+      profileStateDatabaseFiles(temporaryPath).map((path) => rm(path, { force: true }))
+    )
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-bootstrap-publication-race.test.ts b/src/main/persistence/profile-state/profile-state-bootstrap-publication-race.test.ts
new file mode 100644
index 00000000000..b93b05b1b31
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-bootstrap-publication-race.test.ts
@@ -0,0 +1,178 @@
+import * as fs from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { bootstrapProfileStateAuthority } from './profile-state-authority-bootstrap'
+import { migrateProfileStateToSqlite } from './profile-state-migration'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { profileStateJsonExportPath } from './legacy-json/profile-state-export-path'
+import type { ProfileStateAuthority } from '../loading-store/profile-state-authority'
+import { formatProfileStateStartupFailure } from './profile-state-startup-failure'
+
+vi.mock('node:fs', async (original) => ({ ...(await original<typeof fs>()) }))
+vi.mock('../../telemetry/client', () => ({ track: () => {} }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const roots: string[] = []
+const authorities: ProfileStateAuthority[] = []
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const authority of authorities.splice(0)) {
+    authority.close?.()
+  }
+  for (const root of roots.splice(0)) {
+    fs.rmSync(root, { recursive: true, force: true })
+  }
+})
+
+describe('first database publication with competing startup', () => {
+  it.each(['empty', 'legacy'])(
+    'explains unavailable hard links without publishing a partial %s database',
+    (kind) => {
+      const root = fs.mkdtempSync(join(tmpdir(), 'orca-bootstrap-no-hardlinks-'))
+      roots.push(root)
+      const options = {
+        dataFile: join(root, 'orca-data.json'),
+        databaseFile: join(root, 'profile-state.db'),
+        profileId: 'unsupported-publication',
+        allowEmptyProfileState: true
+      }
+      const json = '{"settings":{"theme":"dark"}}'
+      if (kind === 'legacy') {
+        fs.writeFileSync(options.dataFile, json)
+      }
+      const link = vi.spyOn(fs, 'linkSync').mockImplementation(() => {
+        throw Object.assign(new Error('hard links unsupported'), {
+          code: 'ENOTSUP',
+          syscall: 'link'
+        })
+      })
+      let failure: unknown
+      try {
+        bootstrapProfileStateAuthority(options)
+      } catch (error) {
+        failure = error
+      }
+      expect(failure).toMatchObject({ code: 'profile-state-publication-unavailable' })
+      const message = formatProfileStateStartupFailure(failure)
+      expect(message).toContain('hard links')
+      expect(message).toContain(root)
+      expect(message).toContain('complete Orca data directory')
+      expect(message).not.toContain('rollback')
+      expect(fs.existsSync(options.databaseFile)).toBe(false)
+      expect(fs.readdirSync(root)).toEqual(kind === 'legacy' ? ['orca-data.json'] : [])
+      if (kind === 'legacy') {
+        expect(fs.readFileSync(options.dataFile, 'utf8')).toBe(json)
+      }
+      link.mockRestore()
+      const retry = bootstrapProfileStateAuthority(options)
+      expect(retry.authority).toBeDefined()
+      if (retry.authority) {
+        authorities.push(retry.authority)
+      }
+    }
+  )
+
+  it('names its migration export after the snapshot actually captured', () => {
+    const root = fs.mkdtempSync(join(tmpdir(), 'orca-migration-export-race-'))
+    roots.push(root)
+    const options = {
+      dataFile: join(root, 'orca-data.json'),
+      databaseFile: join(root, 'profile-state.db'),
+      profileId: 'migration-export-race',
+      expectedLegacyJson: '{"settings":{"theme":"dark"}}',
+      serializedState: '{"settings":{"theme":"dark"}}'
+    }
+    fs.writeFileSync(options.dataFile, options.expectedLegacyJson)
+    const link = fs.linkSync
+    vi.spyOn(fs, 'linkSync').mockImplementation((from, to) => {
+      link(from, to)
+      if (to === options.databaseFile) {
+        const peer = new ProfileStateSqliteAuthority(options.databaseFile, options.profileId)
+        try {
+          peer.writeSerializedDomains([{ domain: 'settings', payload: '{"theme":"light"}' }])
+        } finally {
+          peer.close()
+        }
+      }
+    })
+
+    const migrated = migrateProfileStateToSqlite(options)
+    authorities.push(migrated.authority)
+    expect(migrated.authority.revision).toBe(2)
+    expect(fs.existsSync(profileStateJsonExportPath(options.dataFile, 1))).toBe(false)
+    expect(
+      JSON.parse(fs.readFileSync(profileStateJsonExportPath(options.dataFile, 2), 'utf8'))
+    ).toEqual({
+      settings: { theme: 'light' }
+    })
+    expect(fs.readFileSync(options.dataFile, 'utf8')).toBe(options.expectedLegacyJson)
+  })
+
+  it.each(['empty', 'legacy'])('cannot replace an acknowledged competing %s profile', (kind) => {
+    const root = fs.mkdtempSync(join(tmpdir(), 'orca-bootstrap-publication-race-'))
+    roots.push(root)
+    const options = {
+      dataFile: join(root, 'orca-data.json'),
+      databaseFile: join(root, 'profile-state.db'),
+      profileId: 'publication-race',
+      allowEmptyProfileState: true
+    }
+    if (kind === 'legacy') {
+      fs.writeFileSync(options.dataFile, '{"settings":{"theme":"dark"}}')
+    }
+    const committed = {
+      settings: { theme: 'light' },
+      extension: { acknowledged: true, value: null }
+    }
+    let competing = false
+    const open = () => {
+      const result = bootstrapProfileStateAuthority(options)
+      if (result.authority) {
+        authorities.push(result.authority)
+      }
+      return result
+    }
+    const race = (target: fs.PathLike) => {
+      if (competing || target !== options.databaseFile) {
+        return
+      }
+      competing = true
+      const winner = open().authority
+      if (!winner) {
+        throw new Error('Competing startup did not establish SQLite')
+      }
+      winner.writeSerializedState(Buffer.from(JSON.stringify(committed)))
+      expect(JSON.parse(winner.readSerializedState() ?? 'null')).toEqual(committed)
+      winner.close?.()
+      authorities.splice(authorities.indexOf(winner), 1)
+    }
+    const rename = fs.renameSync
+    vi.spyOn(fs, 'renameSync').mockImplementation((from, to) => {
+      race(to)
+      rename(from, to)
+    })
+    const link = fs.linkSync
+    vi.spyOn(fs, 'linkSync').mockImplementation((from, to) => {
+      race(to)
+      link(from, to)
+    })
+
+    let publicationError: unknown
+    try {
+      open()
+    } catch (error) {
+      publicationError = error
+    }
+    expect(competing).toBe(true)
+    expect(JSON.parse(open().authority?.readSerializedState() ?? 'null')).toEqual(committed)
+    expect(publicationError).toMatchObject({ message: expect.stringContaining('storage changed') })
+    expect(fs.readdirSync(root).some((name) => name.endsWith('.tmp'))).toBe(false)
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-complete-domain-writes.test.ts b/src/main/persistence/profile-state/profile-state-complete-domain-writes.test.ts
new file mode 100644
index 00000000000..177c79dd874
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-complete-domain-writes.test.ts
@@ -0,0 +1,122 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  openProfileStateDatabaseReadOnly,
+  openProfileStateDatabase
+} from './profile-state-database'
+import { readProfileStateRevision } from './profile-state-documents'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+
+const fixtures: { authority: ProfileStateSqliteAuthority; directory: string }[] = []
+
+function fixture(established: boolean) {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-complete-domain-write-'))
+  const databasePath = join(directory, 'state.db')
+  openProfileStateDatabase(databasePath, 'profile').db.close()
+  const authority = new ProfileStateSqliteAuthority(databasePath, 'profile')
+  fixtures.push({ authority, directory })
+  if (established) {
+    authority.writeSerializedState(
+      Buffer.from('{"settings":{"theme":"light"},"automationRuns":[{"id":"old"}],"removeMe":true}')
+    )
+  }
+  const readRevision = () => {
+    const { db } = openProfileStateDatabaseReadOnly(databasePath, 'profile')
+    try {
+      return readProfileStateRevision(db)
+    } finally {
+      db.close()
+    }
+  }
+  return { authority, databasePath, readRevision }
+}
+
+afterEach(() => {
+  for (const { authority, directory } of fixtures.splice(0)) {
+    authority.close()
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+const invalidReplacements = [
+  {
+    name: 'sibling-key injection',
+    value: [{ domain: 'extension', payload: 'null,"settings":{"theme":"dark"}' }]
+  },
+  {
+    name: 'duplicate domains',
+    value: [
+      { domain: 'settings', payload: '{}' },
+      { domain: 'settings', payload: 'null' }
+    ]
+  },
+  { name: 'non-string payload', value: [{ domain: 'settings', payload: true }] },
+  { name: 'missing payload', value: [{ domain: 'settings' }] },
+  { name: 'empty domain', value: [{ domain: '', payload: '{}' }] },
+  { name: 'non-array replacements', value: { settings: '{}' } }
+]
+
+describe.each([false, true])('complete domain writes (established: %s)', (established) => {
+  it.each(invalidReplacements)('rejects $name without changing state or revision', ({ value }) => {
+    const { authority, readRevision } = fixture(established)
+    const before = authority.readSerializedState()
+    const revision = readRevision()
+
+    expect(() => {
+      // @ts-expect-error Intentionally malformed input must fail runtime validation.
+      authority.writeCompleteSerializedDomains(value)
+    }).toThrow()
+
+    expect(authority.readSerializedState()).toBe(before)
+    expect(readRevision()).toBe(revision)
+  })
+
+  it('preserves null, history order and unknown fields while deleting omitted domains', () => {
+    const { authority } = fixture(established)
+    const future = { '3': 3, '1': 1, unicode: '雪 🐋\ud800', nested: { z: null, a: [] } }
+    const runs = [{ id: 'z', extension: future }, { id: 'a' }]
+
+    authority.writeCompleteSerializedDomains([
+      { domain: 'settings', payload: 'null' },
+      { domain: 'automationRuns', payload: JSON.stringify(runs) },
+      { domain: 'future', payload: JSON.stringify(future) },
+      { domain: 'deleted', payload: null }
+    ])
+
+    expect(authority.readSerializedState()).toBe(
+      JSON.stringify({ settings: null, automationRuns: runs, future })
+    )
+    authority.writeCompleteSerializedDomains([])
+    expect(authority.readSerializedState()).toBe('{}')
+  })
+
+  it('accepts an empty complete profile', () => {
+    const { authority } = fixture(established)
+
+    authority.writeCompleteSerializedDomains([])
+
+    expect(authority.readSerializedState()).toBe('{}')
+  })
+})
+
+describe('complete domain revision fencing', () => {
+  it('rejects an older complete replacement after a concurrent writer commits', () => {
+    const { authority, databasePath } = fixture(true)
+    authority.readSerializedState()
+    const other = new ProfileStateSqliteAuthority(databasePath, 'profile')
+    try {
+      other.writeCompleteSerializedDomains([{ domain: 'settings', payload: '{"theme":"dark"}' }])
+    } finally {
+      other.close()
+    }
+
+    expect(() =>
+      authority.writeCompleteSerializedDomains([
+        { domain: 'settings', payload: '{"theme":"light"}' }
+      ])
+    ).toThrow(expect.objectContaining({ code: 'profile-state-revision-conflict' }))
+    expect(authority.readSerializedState()).toBe('{"settings":{"theme":"dark"}}')
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-complete-replacements.ts b/src/main/persistence/profile-state/profile-state-complete-replacements.ts
new file mode 100644
index 00000000000..2f7ea20f537
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-complete-replacements.ts
@@ -0,0 +1,36 @@
+import type { ProfileStateDomainReplacement } from '../loading-store/profile-state-authority'
+import type { openProfileStateDatabase } from './profile-state-database'
+
+export function buildCompleteDocumentReplacements(
+  db: ReturnType<typeof openProfileStateDatabase>['db'],
+  replacements: readonly ProfileStateDomainReplacement[]
+): ProfileStateDomainReplacement[] {
+  const domains = new Set(replacements.map(({ domain }) => domain))
+  const incoming = new Set(domains)
+  for (const row of db
+    .prepare(`SELECT domain FROM profile_state_documents
+      UNION SELECT domain FROM profile_state_automation_runs_meta WHERE presence <> 'document'`)
+    .all()) {
+    if (isDomainRow(row)) {
+      domains.add(row.domain)
+    }
+  }
+
+  return [
+    ...replacements,
+    ...[...domains]
+      .filter((domain) => !incoming.has(domain))
+      .map((domain) => ({ domain, payload: null }))
+  ]
+}
+
+function isDomainRow(value: unknown): value is { domain: string } {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    !Array.isArray(value) &&
+    'domain' in value &&
+    typeof value.domain === 'string' &&
+    value.domain.length > 0
+  )
+}
diff --git a/src/main/persistence/profile-state/profile-state-crash-recovery.test.ts b/src/main/persistence/profile-state/profile-state-crash-recovery.test.ts
new file mode 100644
index 00000000000..e9d6a54e0e5
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-crash-recovery.test.ts
@@ -0,0 +1,210 @@
+import { spawnProcess } from '../../../shared/child-process/run-process'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  buildProfileStateCutoverFixture,
+  canonicalProfileStateJson
+} from '../profile-state-cutover-fixture'
+import {
+  exportProfileStateJson,
+  importProfileStateJson,
+  readProfileStateRevision
+} from './profile-state-documents'
+import { openProfileStateDatabase, profileStateDatabaseFile } from './profile-state-database'
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+const crashDuringWriteScript = `
+  const { DatabaseSync } = process.getBuiltinModule('node:sqlite')
+  const db = new DatabaseSync(process.argv[1])
+  db.exec('PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL; BEGIN IMMEDIATE')
+  db.prepare('DELETE FROM profile_state_documents').run()
+  db.prepare('DELETE FROM profile_state_automation_runs').run()
+  db.prepare('DELETE FROM profile_state_automation_runs_meta').run()
+  db.prepare(\`
+    UPDATE profile_state_meta
+    SET value = ?
+    WHERE key = 'revision'
+  \`).run('999')
+  process.stdout.write('transaction-ready\\n')
+  setInterval(() => {}, 1_000)
+`
+
+const crashAfterCommittedWriteScript = `
+  const { DatabaseSync } = process.getBuiltinModule('node:sqlite')
+  const { createHash } = require('node:crypto')
+  const db = new DatabaseSync(process.argv[1])
+  const payload = '{"theme":"committed"}'
+  const hash = createHash('sha256').update(payload).digest('hex')
+  db.exec('PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL; BEGIN IMMEDIATE')
+  db.prepare('DELETE FROM profile_state_documents').run()
+  db.prepare('DELETE FROM profile_state_automation_runs').run()
+  db.prepare("UPDATE profile_state_automation_runs_meta SET presence = 'document', domain_version = 1, revision = 0, updated_at = 0, content_hash = ''").run()
+  db.prepare(\`
+    INSERT INTO profile_state_documents
+       (domain, payload, domain_version, revision, updated_at, content_hash)
+       VALUES (?, ?, ?, ?, ?, ?)\`
+  ).run('settings', payload, 1, 999, 999, hash)
+  db.prepare(\`
+    UPDATE profile_state_meta
+    SET value = ?
+    WHERE key = 'revision'
+  \`).run('999')
+  db.exec('COMMIT')
+  process.stdout.write('transaction-committed\\n')
+  setInterval(() => {}, 1_000)
+`
+
+const crashDuringCheckpointScript = `
+  const { DatabaseSync } = process.getBuiltinModule('node:sqlite')
+  const dbPath = process.argv[1]
+  const writer = new DatabaseSync(dbPath, { timeout: 5_000 })
+  const reader = new DatabaseSync(dbPath, { timeout: 5_000 })
+  writer.exec('PRAGMA wal_autocheckpoint = 0')
+  writer.exec('BEGIN IMMEDIATE')
+  writer.prepare(
+    \`UPDATE profile_state_meta SET value = value WHERE key = 'revision'\`
+  ).run()
+  writer.exec('COMMIT')
+  reader.exec('BEGIN')
+  reader.prepare("SELECT value FROM profile_state_meta WHERE key = 'revision'").get()
+  // SQLITE_PRAGMA is action code 19; the reader keeps TRUNCATE checkpointing active after this callback returns.
+  writer.setAuthorizer((action) => {
+    if (action === 19) {
+      process.stdout.write('checkpoint-started\\n')
+    }
+    return 0
+  })
+  writer.prepare('PRAGMA wal_checkpoint(TRUNCATE)').all()
+  process.stdout.write('checkpoint-complete\\n')
+`
+
+async function killAfterChildReady(dbPath: string, script: string, marker: string): Promise<void> {
+  const child = spawnProcess({
+    program: process.execPath,
+    args: ['-e', script, dbPath],
+    timeoutMs: null
+  })
+  for (const stream of [child.stdin, child.stdout, child.stderr]) {
+    stream?.on('error', () => {})
+  }
+
+  try {
+    await new Promise<void>((resolve, reject) => {
+      let output = ''
+      const onData = (chunk: Buffer | string): void => {
+        output += String(chunk)
+        if (output.includes(marker)) {
+          resolve()
+        }
+      }
+      child.stdout.on('data', onData)
+      child.once('error', reject)
+    })
+    child.kill('SIGKILL')
+    await new Promise<void>((resolve, reject) => {
+      child.once('close', () => resolve())
+      child.once('error', reject)
+    })
+  } finally {
+    if (child.exitCode === null && child.signalCode === null) {
+      child.kill('SIGKILL')
+    }
+  }
+}
+
+async function killAfterUncommittedWrite(dbPath: string): Promise<void> {
+  await killAfterChildReady(dbPath, crashDuringWriteScript, 'transaction-ready')
+}
+
+describe('profile state crash recovery', () => {
+  it('rolls back an uncommitted SQLite write and accepts the next import', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-crash-'))
+    temporaryDirectories.push(directory)
+    const dbPath = profileStateDatabaseFile(directory)
+    const fixture = buildProfileStateCutoverFixture()
+
+    const initial = openProfileStateDatabase(dbPath, 'profile-a')
+    importProfileStateJson(initial.db, JSON.stringify(fixture), { now: () => 100 })
+    initial.db.close()
+
+    await killAfterUncommittedWrite(dbPath)
+
+    const recovered = openProfileStateDatabase(dbPath, 'profile-a')
+    try {
+      expect(recovered.readOnly).toBe(false)
+      expect(readProfileStateRevision(recovered.db)).toBe(1)
+      expect(canonicalProfileStateJson(JSON.parse(exportProfileStateJson(recovered.db)))).toBe(
+        canonicalProfileStateJson(fixture)
+      )
+
+      const replacement = {
+        ...fixture,
+        futureTopLevelExtension: { keep: 'replacement', nullable: null }
+      }
+      expect(
+        importProfileStateJson(recovered.db, JSON.stringify(replacement), { now: () => 200 })
+      ).toBe(2)
+      expect(canonicalProfileStateJson(JSON.parse(exportProfileStateJson(recovered.db)))).toBe(
+        canonicalProfileStateJson(replacement)
+      )
+    } finally {
+      recovered.db.close()
+    }
+  })
+
+  it('preserves a committed SQLite write after process termination', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-crash-'))
+    temporaryDirectories.push(directory)
+    const dbPath = profileStateDatabaseFile(directory)
+    const initial = openProfileStateDatabase(dbPath, 'profile-a')
+    importProfileStateJson(initial.db, JSON.stringify(buildProfileStateCutoverFixture()), {
+      now: () => 100
+    })
+    initial.db.close()
+
+    await killAfterChildReady(dbPath, crashAfterCommittedWriteScript, 'transaction-committed')
+
+    const recovered = openProfileStateDatabase(dbPath, 'profile-a')
+    try {
+      expect(recovered.readOnly).toBe(false)
+      expect(readProfileStateRevision(recovered.db)).toBe(999)
+      expect(JSON.parse(exportProfileStateJson(recovered.db))).toEqual({
+        settings: { theme: 'committed' }
+      })
+    } finally {
+      recovered.db.close()
+    }
+  })
+
+  it('recovers a committed database when checkpointing is interrupted', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-checkpoint-crash-'))
+    temporaryDirectories.push(directory)
+    const dbPath = profileStateDatabaseFile(directory)
+    const fixture = buildProfileStateCutoverFixture()
+    const initial = openProfileStateDatabase(dbPath, 'profile-a')
+    importProfileStateJson(initial.db, JSON.stringify(fixture), { now: () => 100 })
+    initial.db.close()
+
+    await killAfterChildReady(dbPath, crashDuringCheckpointScript, 'checkpoint-started')
+
+    const recovered = openProfileStateDatabase(dbPath, 'profile-a')
+    try {
+      expect(recovered.readOnly).toBe(false)
+      expect(readProfileStateRevision(recovered.db)).toBe(1)
+      expect(canonicalProfileStateJson(JSON.parse(exportProfileStateJson(recovered.db)))).toBe(
+        canonicalProfileStateJson(fixture)
+      )
+    } finally {
+      recovered.db.close()
+    }
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-current-json-command.test.ts b/src/main/persistence/profile-state/profile-state-current-json-command.test.ts
new file mode 100644
index 00000000000..0b1592bc9fc
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-current-json-command.test.ts
@@ -0,0 +1,171 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission
+} from './profile-state-access'
+import { rollbackProfileState } from './profile-state-recovery-command'
+import { bootstrapProfileStateAuthority } from './profile-state-authority-bootstrap'
+import { migrateProfileStateToSqlite } from './profile-state-migration'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath
+} from './profile-state-backup-path'
+import { profileStateJsonExportPath } from './legacy-json/profile-state-export-path'
+const roots: string[] = []
+const profileId = 'current-json-recovery'
+const originalState = { settings: { theme: 'dark', httpProxyUrl: 'sealed:original' } }
+const editedState = {
+  settings: {
+    theme: 'light',
+    httpProxyUrl: 'sealed:older-build',
+    electronHttp1CompatibilityMode: true
+  },
+  futureDomain: { opaque: [null, '\ud800', { futureKey: 'keep me' }] },
+  accounts: { token: 'sealed:account-token' }
+}
+const editedJson = `${JSON.stringify(editedState, null, 2)}\n`
+
+beforeEach(() => {
+  vi.spyOn(console, 'log').mockImplementation(() => {})
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), 'orca-current-json-'))
+  roots.push(root)
+  const directory = join(root, 'profiles', profileId)
+  mkdirSync(directory, { recursive: true })
+  writeFileSync(
+    join(root, 'orca-profile-index.json'),
+    JSON.stringify({ activeProfileId: profileId, profiles: [{ id: profileId }] })
+  )
+  const dataFile = join(directory, 'orca-data.json')
+  const databaseFile = join(directory, 'profile-state.db')
+  const exportPath = profileStateJsonExportPath(dataFile, 1)
+  const originalJson = JSON.stringify(originalState)
+  writeFileSync(dataFile, originalJson)
+  const migration = migrateProfileStateToSqlite({
+    dataFile,
+    databaseFile,
+    profileId,
+    expectedLegacyJson: originalJson,
+    serializedState: originalJson
+  })
+  migration.authority.close()
+  const backupPath = profileStateDatabaseBackupPath(
+    databaseFile,
+    createProfileStateDatabaseBackupId()
+  )
+  writeFileSync(backupPath, readFileSync(databaseFile))
+  writeFileSync(dataFile, editedJson)
+  return { root, directory, dataFile, databaseFile, exportPath, backupPath, profileId }
+}
+
+function rollback(profile: ReturnType<typeof fixture>) {
+  const maintenance = acquireProfileStateMaintenance(profile.root)
+  try {
+    expect(() => acquireProfileStateRuntimeAdmission(profile.root)).toThrow('in use')
+    return rollbackProfileState(profile.root, { kind: 'current-json' }, maintenance)
+  } finally {
+    maintenance.release()
+  }
+}
+
+function snapshot(profile: ReturnType<typeof fixture>) {
+  return [profile.dataFile, profile.databaseFile, profile.exportPath, profile.backupPath].map(
+    (path) => readFileSync(path)
+  )
+}
+
+describe('adopting JSON edited by an older build', () => {
+  it('preserves both authorities and retained exports before adopting exact JSON bytes', async () => {
+    const profile = fixture()
+    const before = snapshot(profile)
+    const previousQuarantine = join(profile.directory, 'profile-state-corrupt-earlier')
+    mkdirSync(previousQuarantine)
+    writeFileSync(join(previousQuarantine, 'evidence'), 'preserve earlier recovery')
+    expect(() => bootstrapProfileStateAuthority(profile)).toThrow('acceptance marker')
+    const result = rollback(profile)
+    expect(result).toMatchObject({
+      revision: null,
+      storage: 'json',
+      restoredPath: profile.dataFile
+    })
+    expect(readFileSync(profile.dataFile, 'utf8')).toBe(editedJson)
+    expect(existsSync(profile.databaseFile)).toBe(false)
+    expect(existsSync(profile.exportPath)).toBe(false)
+    expect(existsSync(profile.backupPath)).toBe(false)
+    expect(readFileSync(join(previousQuarantine, 'evidence'), 'utf8')).toBe(
+      'preserve earlier recovery'
+    )
+    for (const [index, path] of [
+      profile.dataFile,
+      profile.databaseFile,
+      profile.exportPath,
+      profile.backupPath
+    ].entries()) {
+      expect(readFileSync(join(result.quarantineDirectory, basename(path)))).toEqual(before[index])
+    }
+    const reopened = bootstrapProfileStateAuthority(profile)
+    expect(reopened.migrated).toBe(true)
+    try {
+      const restored: unknown = JSON.parse(reopened.authority?.readSerializedState() ?? 'null')
+      expect(restored).toMatchObject(editedState)
+    } finally {
+      reopened.authority?.close()
+    }
+    acquireProfileStateRuntimeAdmission(profile.root).release()
+  })
+
+  it.each(['invalid JSON', '[]', 'null'])(
+    'refuses invalid current JSON without changing either authority: %s',
+    async (raw) => {
+      const profile = fixture()
+      writeFileSync(profile.dataFile, raw)
+      const before = snapshot(profile)
+      expect(() => rollback(profile)).toThrow('Profile state JSON')
+      expect(snapshot(profile)).toEqual(before)
+    }
+  )
+
+  it('refuses a missing canonical JSON without choosing a retained export', async () => {
+    const profile = fixture()
+    rmSync(profile.dataFile)
+    const before = readFileSync(profile.databaseFile)
+    expect(() => rollback(profile)).toThrow('ENOENT')
+    expect(readFileSync(profile.databaseFile)).toEqual(before)
+    expect(existsSync(profile.exportPath)).toBe(true)
+  })
+
+  it('refuses while a profile owner holds admission', async () => {
+    const profile = fixture()
+    const before = snapshot(profile)
+    const admission = acquireProfileStateRuntimeAdmission(profile.root)
+    try {
+      expect(() => rollback(profile)).toThrow('in use')
+      expect(snapshot(profile)).toEqual(before)
+    } finally {
+      admission.release()
+    }
+  })
+
+  it('refuses an unresolved move without removing its journal', async () => {
+    const profile = fixture()
+    const before = snapshot(profile)
+    const moves = join(profile.root, 'profile-move-intents')
+    mkdirSync(moves)
+    const journal = join(moves, '00000000-0000-0000-0000-000000000001.json')
+    writeFileSync(journal, '{"partial":true}')
+    expect(() => rollback(profile)).toThrow('pending project move')
+    expect(snapshot(profile)).toEqual(before)
+    expect(readFileSync(journal, 'utf8')).toBe('{"partial":true}')
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-current-sqlite-command.test.ts b/src/main/persistence/profile-state/profile-state-current-sqlite-command.test.ts
new file mode 100644
index 00000000000..53aa67120e9
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-current-sqlite-command.test.ts
@@ -0,0 +1,147 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission
+} from './profile-state-access'
+import { rollbackProfileState } from './profile-state-recovery-command'
+import {
+  bootstrapProfileStateAuthority,
+  ProfileStateAuthorityBootstrapError
+} from './profile-state-authority-bootstrap'
+import { migrateProfileStateToSqlite } from './profile-state-migration'
+import { profileStateJsonExportPath } from './legacy-json/profile-state-export-path'
+import { isDivergedProfileStateFailure } from './profile-state-startup-failure'
+
+const roots: string[] = []
+const profileId = 'current-sqlite-recovery'
+const sqliteState = { settings: { theme: 'dark', electronHttp1CompatibilityMode: true } }
+const editedJson = JSON.stringify({ settings: { theme: 'light' } })
+
+beforeEach(() => {
+  vi.spyOn(console, 'log').mockImplementation(() => {})
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), 'orca-current-sqlite-'))
+  roots.push(root)
+  const directory = join(root, 'profiles', profileId)
+  mkdirSync(directory, { recursive: true })
+  writeFileSync(
+    join(root, 'orca-profile-index.json'),
+    JSON.stringify({ activeProfileId: profileId, profiles: [{ id: profileId }] })
+  )
+  const dataFile = join(directory, 'orca-data.json')
+  const databaseFile = join(directory, 'profile-state.db')
+  const originalJson = JSON.stringify(sqliteState)
+  writeFileSync(dataFile, originalJson)
+  migrateProfileStateToSqlite({
+    dataFile,
+    databaseFile,
+    profileId,
+    expectedLegacyJson: originalJson,
+    serializedState: originalJson
+  }).authority.close()
+  writeFileSync(dataFile, editedJson)
+  return { root, dataFile, databaseFile, profileId }
+}
+
+function rollback(profile: ReturnType<typeof fixture>) {
+  const maintenance = acquireProfileStateMaintenance(profile.root)
+  try {
+    return rollbackProfileState(profile.root, { kind: 'current-sqlite' }, maintenance)
+  } finally {
+    maintenance.release()
+  }
+}
+
+describe('keeping SQLite over JSON edited by an older build', () => {
+  it('tags the startup failure as a user-resolvable divergence', () => {
+    const profile = fixture()
+    let failure: unknown
+    try {
+      bootstrapProfileStateAuthority(profile)
+    } catch (error) {
+      failure = error
+    }
+    expect(failure).toBeInstanceOf(ProfileStateAuthorityBootstrapError)
+    expect(isDivergedProfileStateFailure(failure)).toBe(true)
+    expect(isDivergedProfileStateFailure(new ProfileStateAuthorityBootstrapError('other'))).toBe(
+      false
+    )
+  })
+
+  it('archives the diverged JSON and republishes JSON that SQLite accepts', () => {
+    const profile = fixture()
+    const databaseBefore = readFileSync(profile.databaseFile)
+    const result = rollback(profile)
+    expect(result).toMatchObject({
+      storage: 'sqlite',
+      restoredPath: profile.databaseFile,
+      revision: 1,
+      removedDatabaseFiles: []
+    })
+    expect(result.backupId).toBeUndefined()
+    expect(readFileSync(join(result.quarantineDirectory, 'orca-data.json'), 'utf8')).toBe(
+      editedJson
+    )
+    expect(readFileSync(join(result.quarantineDirectory, 'profile-state.db'))).toEqual(
+      databaseBefore
+    )
+    expect(JSON.parse(readFileSync(profile.dataFile, 'utf8'))).toEqual(sqliteState)
+
+    const reopened = bootstrapProfileStateAuthority(profile)
+    try {
+      expect(reopened.migrated).toBe(false)
+      expect(JSON.parse(reopened.authority?.readSerializedState() ?? 'null')).toEqual(sqliteState)
+    } finally {
+      reopened.authority?.close()
+    }
+    acquireProfileStateRuntimeAdmission(profile.root).release()
+  })
+
+  it('replaces JSON that an older build left unparseable', () => {
+    const profile = fixture()
+    writeFileSync(profile.dataFile, 'not json')
+    const result = rollback(profile)
+    expect(readFileSync(join(result.quarantineDirectory, 'orca-data.json'), 'utf8')).toBe(
+      'not json'
+    )
+    expect(JSON.parse(readFileSync(profile.dataFile, 'utf8'))).toEqual(sqliteState)
+  })
+
+  it('leaves both copies untouched when SQLite is unreadable', () => {
+    const profile = fixture()
+    writeFileSync(profile.databaseFile, 'broken database')
+    expect(() => rollback(profile)).toThrow()
+    expect(readFileSync(profile.databaseFile, 'utf8')).toBe('broken database')
+    expect(readFileSync(profile.dataFile, 'utf8')).toBe(editedJson)
+  })
+
+  it('restores the diverged JSON when republishing fails', () => {
+    const profile = fixture()
+    writeFileSync(profileStateJsonExportPath(profile.dataFile, 1), '{"conflicting":true}')
+    expect(() => rollback(profile)).toThrow('already exists with different content')
+    expect(readFileSync(profile.dataFile, 'utf8')).toBe(editedJson)
+  })
+
+  it('refuses while a profile owner holds admission', () => {
+    const profile = fixture()
+    const admission = acquireProfileStateRuntimeAdmission(profile.root)
+    try {
+      expect(() => rollback(profile)).toThrow('in use')
+      expect(readFileSync(profile.dataFile, 'utf8')).toBe(editedJson)
+      expect(existsSync(profile.databaseFile)).toBe(true)
+    } finally {
+      admission.release()
+    }
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-database-errors.ts b/src/main/persistence/profile-state/profile-state-database-errors.ts
new file mode 100644
index 00000000000..65b58470a5e
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-errors.ts
@@ -0,0 +1,17 @@
+export type ProfileStateDatabaseOpenErrorCode =
+  | 'unreadable'
+  | 'identity-mismatch'
+  | 'invalid-profile-id'
+  | 'newer-schema'
+
+export class ProfileStateDatabaseOpenError extends Error {
+  readonly code: ProfileStateDatabaseOpenErrorCode
+  readonly cause: unknown
+
+  constructor(code: ProfileStateDatabaseOpenErrorCode, message: string, cause?: unknown) {
+    super(message)
+    this.name = 'ProfileStateDatabaseOpenError'
+    this.code = code
+    this.cause = cause
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-database-export-crash.test.ts b/src/main/persistence/profile-state/profile-state-database-export-crash.test.ts
new file mode 100644
index 00000000000..4f82cd61a46
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-export-crash.test.ts
@@ -0,0 +1,112 @@
+import { spawnProcess } from '../../../shared/child-process/run-process'
+import { mkdirSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { build } from 'esbuild'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { importProfileStateJson } from './profile-state-documents'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly,
+  profileStateDatabaseFile
+} from './profile-state-database'
+import { writeProfileStateDatabaseSnapshotAsync } from './profile-state-database-snapshot'
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+const interruptedExportScript = `
+  import { openProfileStateDatabaseReadOnly } from './profile-state-database'
+  import { writeProfileStateDatabaseSnapshotAsync } from './profile-state-database-snapshot'
+  const { db } = openProfileStateDatabaseReadOnly(process.argv[2], 'profile-a')
+  writeProfileStateDatabaseSnapshotAsync(db, process.argv[3], {
+    validateStagedSnapshot: async (path) => {
+      process.stdout.write(path + '\\n')
+      await new Promise(() => setInterval(() => {}, 1_000))
+    }
+  }).catch((error) => { console.error(error); process.exit(1) })
+`
+
+async function killBeforePublication(sourcePath: string, targetPath: string): Promise<string> {
+  const childEntry = join(dirname(sourcePath), 'interrupted-export.cjs')
+  await build({
+    stdin: {
+      contents: interruptedExportScript,
+      resolveDir: resolve('src/main/persistence/profile-state'),
+      loader: 'ts'
+    },
+    outfile: childEntry,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    logLevel: 'silent'
+  })
+  const child = spawnProcess({
+    program: process.execPath,
+    args: [childEntry, sourcePath, targetPath],
+    timeoutMs: 10_000
+  })
+  for (const stream of [child.stdin, child.stdout, child.stderr]) {
+    stream?.on('error', () => {})
+  }
+  const exited = new Promise<void>((resolve, reject) => {
+    child.once('close', () => resolve())
+    child.once('error', reject)
+  })
+  const temporaryPath = await new Promise<string>((resolve, reject) => {
+    let output = ''
+    child.stdout.on('data', (chunk: Buffer | string) => {
+      output += String(chunk)
+      if (output.includes('\n')) {
+        resolve(output.trim())
+      }
+    })
+    child.once('close', () => reject(new Error('Export exited before staging completed')))
+    child.once('error', reject)
+  })
+  child.kill('SIGKILL')
+  await exited
+  return temporaryPath
+}
+
+describe('profile state database export crash recovery', () => {
+  it('leaves the destination intact when the production backup dies before publication', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-export-crash-'))
+    temporaryDirectories.push(directory)
+    const sourcePath = profileStateDatabaseFile(directory)
+    const source = openProfileStateDatabase(sourcePath, 'profile-a')
+    importProfileStateJson(source.db, JSON.stringify({ settings: { theme: 'dark' } }), {
+      now: () => 100
+    })
+    source.db.close()
+
+    const targetPath = join(directory, 'recovery', 'profile-state.db')
+    mkdirSync(join(directory, 'recovery'), { recursive: true })
+    writeFileSync(targetPath, 'known-good-destination')
+    const interruptedPath = await killBeforePublication(sourcePath, targetPath)
+
+    expect(readFileSync(targetPath, 'utf8')).toBe('known-good-destination')
+    expect(existsSync(interruptedPath)).toBe(true)
+    rmSync(interruptedPath, { force: true })
+
+    const recoveredSource = openProfileStateDatabase(sourcePath, 'profile-a')
+    try {
+      await writeProfileStateDatabaseSnapshotAsync(recoveredSource.db, targetPath)
+    } finally {
+      recoveredSource.db.close()
+    }
+    const snapshot = openProfileStateDatabaseReadOnly(targetPath, 'profile-a')
+    try {
+      expect(
+        snapshot.db.prepare('SELECT value FROM profile_state_meta WHERE key = ?').get('revision')
+      ).toEqual({ value: '1' })
+    } finally {
+      snapshot.db.close()
+    }
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-database-publication.ts b/src/main/persistence/profile-state/profile-state-database-publication.ts
new file mode 100644
index 00000000000..eb265b43398
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-publication.ts
@@ -0,0 +1,38 @@
+import { dirname } from 'node:path'
+import { publishFileDurableSync } from '../../durable-file-write'
+
+class ProfileStateDatabasePublicationError extends Error {
+  readonly code = 'profile-state-publication-unavailable' as const
+
+  constructor(databaseFile: string, cause: unknown) {
+    super(
+      [
+        `Orca could not safely publish profile state in ${dirname(databaseFile)}.`,
+        'This location must support hard links, and Orca needs permission to create them.',
+        'Close Orca and orcad before checking folder permissions or moving the complete Orca data directory to a writable local filesystem that supports hard links, such as APFS, NTFS, or ext4.',
+        'Keep the original directory and all recovery files.'
+      ].join('\n'),
+      { cause }
+    )
+    this.name = 'ProfileStateDatabasePublicationError'
+  }
+}
+
+/** Preserve atomic no-overwrite publication while explaining filesystem refusals. */
+export function publishProfileStateDatabase(stagingFile: string, databaseFile: string): boolean {
+  try {
+    return publishFileDurableSync(stagingFile, databaseFile)
+  } catch (error) {
+    if (
+      error instanceof Error &&
+      'syscall' in error &&
+      error.syscall === 'link' &&
+      'code' in error &&
+      typeof error.code === 'string' &&
+      ['ENOTSUP', 'EOPNOTSUPP', 'ENOSYS', 'EPERM', 'EACCES', 'EXDEV'].includes(error.code)
+    ) {
+      throw new ProfileStateDatabasePublicationError(databaseFile, error)
+    }
+    throw error
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-database-quarantine.ts b/src/main/persistence/profile-state/profile-state-database-quarantine.ts
new file mode 100644
index 00000000000..8e15f9fcf0d
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-quarantine.ts
@@ -0,0 +1,89 @@
+import { profileStateDatabaseFiles } from './profile-state-storage-classification'
+import { randomUUID } from 'node:crypto'
+import { existsSync, mkdirSync, rmSync } from 'node:fs'
+import { basename, dirname, join } from 'node:path'
+import { bestEffortFsyncDirectorySync, fsyncFileSync } from '../../../shared/secure-file'
+import { durableWriteTempPath, writeFileDurableSync } from '../../durable-file-write'
+import { hardenSqliteDatabaseFiles } from '../../sqlite/harden-database-files'
+import { copyProfileStateRecoveryFiles } from './profile-state-recovery-copy'
+
+export type ProfileStateDatabaseQuarantine = {
+  directory: string
+  manifestPath: string
+  copiedFiles: readonly string[]
+}
+
+/**
+ * Preserve a damaged profile database family before a caller attempts repair or fallback.
+ * Originals remain in place so this operation cannot turn a recovery failure into data loss.
+ */
+export function quarantineProfileStateDatabase(
+  databasePath: string,
+  profileId: string,
+  quarantineRoot = dirname(databasePath),
+  reason = 'profile-state-database-recovery',
+  recoveryFiles: readonly string[] = []
+): ProfileStateDatabaseQuarantine {
+  if (databasePath.length === 0 || databasePath.includes('\0') || profileId.length === 0) {
+    throw new Error('Profile state quarantine arguments are invalid')
+  }
+  const sourceFiles = profileStateDatabaseFiles(databasePath).filter(existsSync)
+  if (sourceFiles.length === 0 && recoveryFiles.length === 0) {
+    throw new Error('Profile state database family does not exist')
+  }
+
+  const directory = join(quarantineRoot, `profile-state-corrupt-${Date.now()}-${randomUUID()}`)
+  const targets = new Set<string>()
+  mkdirSync(directory, { recursive: true, mode: 0o700 })
+  try {
+    const copies: { source: string; target: string }[] = []
+    for (const sourcePath of sourceFiles) {
+      const targetName =
+        sourcePath === databasePath
+          ? 'profile-state.db'
+          : `profile-state.db${sourcePath.slice(databasePath.length)}`
+      const targetPath = join(directory, targetName)
+      copies.push({ source: sourcePath, target: targetPath })
+      targets.add(targetPath)
+    }
+    for (const sourcePath of new Set(recoveryFiles)) {
+      const targetPath = join(directory, basename(sourcePath))
+      if (
+        targets.has(targetPath) ||
+        existsSync(targetPath) ||
+        basename(sourcePath) === 'manifest.json'
+      ) {
+        throw new Error('Profile recovery artifact name conflicts with the quarantine manifest')
+      }
+      copies.push({ source: sourcePath, target: targetPath })
+      targets.add(targetPath)
+    }
+    copyProfileStateRecoveryFiles(copies)
+    const manifestPath = join(directory, 'manifest.json')
+    // Let the destination filesystem detect case or Unicode aliases of the manifest name.
+    if (existsSync(manifestPath)) {
+      throw new Error('Profile recovery artifact name conflicts with the quarantine manifest')
+    }
+    for (const { target } of copies) {
+      hardenSqliteDatabaseFiles(target)
+      fsyncFileSync(target)
+    }
+    writeFileDurableSync(
+      durableWriteTempPath(manifestPath),
+      manifestPath,
+      JSON.stringify({
+        schemaVersion: 1,
+        profileId,
+        reason,
+        capturedAt: new Date().toISOString(),
+        sourceFiles: sourceFiles.map((sourcePath) => sourcePath.slice(databasePath.length)),
+        recoveryFiles: [...new Set(recoveryFiles)].map((sourcePath) => basename(sourcePath))
+      })
+    )
+    bestEffortFsyncDirectorySync(directory)
+    return { directory, manifestPath, copiedFiles: [...targets] }
+  } catch (error) {
+    rmSync(directory, { recursive: true, force: true })
+    throw error
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-database-recovery.test.ts b/src/main/persistence/profile-state/profile-state-database-recovery.test.ts
new file mode 100644
index 00000000000..34f61113c0a
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-recovery.test.ts
@@ -0,0 +1,296 @@
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, dirname, join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import Database from '../../sqlite/sync-database'
+import * as durableFileWrite from '../../durable-file-write'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from './profile-state-database'
+import { exportProfileStateJson, importProfileStateJson } from './profile-state-documents'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath
+} from './profile-state-backup-path'
+import { writeProfileStateDatabaseSnapshotAsync } from './profile-state-database-snapshot'
+import { restoreProfileStateDatabaseBackup } from './profile-state-database-recovery'
+import { restoreProfileStateJsonExport } from './legacy-json/profile-state-recovery'
+import { acquireProfileStateMaintenance } from './profile-state-access'
+import { profileStateJsonExportPath } from './legacy-json/profile-state-export-path'
+
+const directories: string[] = []
+const profileId = 'profile-recovery-test'
+const savedJson = JSON.stringify({
+  settings: { theme: 'dark', httpProxyUrl: 'safe-storage-sealed-ciphertext' },
+  ui: { unknownField: { keep: true } },
+  opaqueExtension: { sequence: 71 }
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const path of directories.splice(0)) {
+    rmSync(path, { recursive: true, force: true })
+  }
+})
+
+async function fixture(options: { profileId?: string; empty?: boolean; json?: string } = {}) {
+  const root = mkdtempSync(join(tmpdir(), 'orca-database-recovery-'))
+  directories.push(root)
+  const directory = join(root, 'profiles', profileId)
+  mkdirSync(directory, { recursive: true })
+  const maintenance = acquireProfileStateMaintenance(root)
+  const databasePath = join(directory, 'profile-state.db')
+  const dataFile = join(directory, 'orca-data.json')
+  const exportPath = profileStateJsonExportPath(dataFile, 1)
+  const backupPath = profileStateDatabaseBackupPath(
+    databasePath,
+    createProfileStateDatabaseBackupId()
+  )
+  const source = openProfileStateDatabase(
+    join(directory, 'source.db'),
+    options.profileId ?? profileId
+  )
+  try {
+    if (!options.empty) {
+      importProfileStateJson(source.db, options.json ?? savedJson)
+    }
+    await writeProfileStateDatabaseSnapshotAsync(source.db, backupPath)
+  } finally {
+    source.db.close()
+  }
+  writeFileSync(dataFile, '{"settings":{"theme":"stale"}}')
+  writeFileSync(exportPath, '{"settings":{"theme":"migration"}}')
+  for (const suffix of ['', '-wal', '-shm', '-journal']) {
+    writeFileSync(`${databasePath}${suffix}`, `damaged ${suffix || 'primary'}`)
+  }
+  return { databasePath, dataFile, backupPath, exportPath, profileId, maintenance }
+}
+
+function readRestored(databasePath: string): string {
+  const opened = openProfileStateDatabaseReadOnly(databasePath, profileId)
+  try {
+    return exportProfileStateJson(opened.db)
+  } finally {
+    opened.db.close()
+  }
+}
+
+function expectOriginals(options: Awaited<ReturnType<typeof fixture>>): void {
+  expect(readFileSync(options.databasePath, 'utf8')).toBe('damaged primary')
+  expect(readFileSync(options.dataFile, 'utf8')).toContain('stale')
+  expect(existsSync(options.backupPath)).toBe(true)
+  expect(readdirSync(dirname(options.databasePath)).some((name) => name.endsWith('.tmp'))).toBe(
+    false
+  )
+}
+
+describe('profile state database backup recovery', () => {
+  it('rejects corruption in a large cloned staging file before changing recovery state', async () => {
+    const options = await fixture({
+      json: JSON.stringify({ opaqueExtension: 'x'.repeat(8 * 1024 * 1024) })
+    })
+    const backup = new Database(options.backupPath)
+    try {
+      backup.exec("UPDATE profile_state_documents SET content_hash = printf('%064d', 0)")
+    } finally {
+      backup.close()
+    }
+    const originalBackup = readFileSync(options.backupPath)
+    expect(() => restoreProfileStateDatabaseBackup(options)).toThrow()
+    expectOriginals(options)
+    expect(readFileSync(options.backupPath).equals(originalBackup)).toBe(true)
+    expect(
+      readdirSync(dirname(options.databasePath)).some((name) =>
+        name.startsWith('.orca-recovery-clone-')
+      )
+    ).toBe(false)
+  })
+
+  it.each([true, false])(
+    'restores SQLite authority with the old database present=%s',
+    async (hasDatabase) => {
+      const options = await fixture()
+      const backupBytes = readFileSync(options.backupPath)
+      if (!hasDatabase) {
+        for (const suffix of ['', '-wal', '-shm', '-journal']) {
+          rmSync(`${options.databasePath}${suffix}`)
+        }
+      }
+      const beforeRestore = vi.fn()
+
+      const result = restoreProfileStateDatabaseBackup({ ...options, beforeRestore })
+
+      expect(result.revision).toBe(1)
+      expect(beforeRestore).toHaveBeenCalledOnce()
+      expect(readRestored(options.databasePath)).toBe(savedJson)
+      expect(existsSync(options.dataFile)).toBe(false)
+      expect(readFileSync(options.backupPath)).toEqual(backupBytes)
+      expect(existsSync(options.exportPath)).toBe(false)
+      expect(readFileSync(join(result.quarantine.directory, basename(options.backupPath)))).toEqual(
+        backupBytes
+      )
+      expect(
+        readFileSync(join(result.quarantine.directory, basename(options.dataFile)), 'utf8')
+      ).toContain('stale')
+      expect(existsSync(join(result.quarantine.directory, basename(options.exportPath)))).toBe(true)
+      if (hasDatabase) {
+        for (const suffix of ['', '-wal', '-shm', '-journal']) {
+          expect(
+            readFileSync(join(result.quarantine.directory, `profile-state.db${suffix}`), 'utf8')
+          ).toBe(`damaged ${suffix || 'primary'}`)
+        }
+      }
+      for (const suffix of ['-wal', '-shm', '-journal']) {
+        expect(existsSync(`${options.databasePath}${suffix}`)).toBe(false)
+      }
+    }
+  )
+
+  it.each(['foreign identity', 'empty profile'])(
+    'rejects a %s backup before touching recovery state',
+    async (kind) => {
+      const options = await fixture(
+        kind === 'foreign identity' ? { profileId: 'other-profile' } : { empty: true }
+      )
+      const beforeRestore = vi.fn()
+      expect(() => restoreProfileStateDatabaseBackup({ ...options, beforeRestore })).toThrow()
+      expect(beforeRestore).not.toHaveBeenCalled()
+      expectOriginals(options)
+    }
+  )
+
+  it.each(['corrupt hash', 'future schema', 'WAL mode'])(
+    'rejects a backup with %s',
+    async (kind) => {
+      const options = await fixture()
+      const backup = new Database(options.backupPath)
+      try {
+        if (kind === 'corrupt hash') {
+          backup.exec("UPDATE profile_state_documents SET payload = '{}' WHERE domain = 'settings'")
+        }
+        if (kind === 'future schema') {
+          backup.pragma('user_version = 999')
+        }
+        if (kind === 'WAL mode') {
+          backup.pragma('journal_mode = WAL')
+        }
+      } finally {
+        backup.close()
+      }
+      const beforeRestore = vi.fn()
+      expect(() => restoreProfileStateDatabaseBackup({ ...options, beforeRestore })).toThrow()
+      expect(beforeRestore).not.toHaveBeenCalled()
+      expectOriginals(options)
+    }
+  )
+
+  it.each(['-wal', '-shm', '-journal'])(
+    'rejects a selected backup with a %s sidecar',
+    async (suffix) => {
+      const options = await fixture()
+      writeFileSync(`${options.backupPath}${suffix}`, 'external writer evidence')
+      expect(() => restoreProfileStateDatabaseBackup(options)).toThrow('not self-contained')
+      expectOriginals(options)
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'rejects a reserved-name symlink to a valid snapshot',
+    async () => {
+      const options = await fixture()
+      const alias = profileStateDatabaseBackupPath(
+        options.databasePath,
+        createProfileStateDatabaseBackupId()
+      )
+      symlinkSync(options.backupPath, alias)
+      expect(() => restoreProfileStateDatabaseBackup({ ...options, backupPath: alias })).toThrow(
+        'regular file'
+      )
+      expectOriginals(options)
+    }
+  )
+
+  it('refuses a backup path outside the retained profile inventory', async () => {
+    const options = await fixture()
+    expect(() =>
+      restoreProfileStateDatabaseBackup({ ...options, backupPath: options.databasePath })
+    ).toThrow('not retained')
+    expectOriginals(options)
+  })
+
+  it('keeps live state untouched when an older artifact cannot be archived', async () => {
+    const options = await fixture()
+    mkdirSync(profileStateJsonExportPath(options.dataFile, 2))
+    expect(() => restoreProfileStateDatabaseBackup(options)).toThrow()
+    expectOriginals(options)
+  })
+
+  it('keeps live state untouched when the pre-restore cache invalidation fails', async () => {
+    const options = await fixture()
+    expect(() =>
+      restoreProfileStateDatabaseBackup({
+        ...options,
+        beforeRestore: () => {
+          throw new Error('injected pre-restore failure')
+        }
+      })
+    ).toThrow('injected pre-restore failure')
+    expectOriginals(options)
+  })
+
+  it('preserves recoverable evidence when publication fails after removing a damaged family', async () => {
+    const options = await fixture()
+    const renameDurableSync = durableFileWrite.renameDurableSync
+    vi.spyOn(durableFileWrite, 'renameDurableSync').mockImplementation((source, target) => {
+      if (target === options.databasePath) {
+        throw new Error('injected snapshot publication failure')
+      }
+      return renameDurableSync(source, target)
+    })
+    expect(() => restoreProfileStateDatabaseBackup(options)).toThrow(
+      'injected snapshot publication failure'
+    )
+    expect(existsSync(options.databasePath)).toBe(false)
+    expect(existsSync(options.backupPath)).toBe(true)
+    const archives = readdirSync(dirname(options.databasePath)).filter((name) =>
+      name.startsWith('profile-state-corrupt-')
+    )
+    expect(archives).toHaveLength(1)
+    expect(
+      readFileSync(join(dirname(options.databasePath), archives[0], 'profile-state.db-wal'), 'utf8')
+    ).toBe('damaged -wal')
+    vi.restoreAllMocks()
+    options.maintenance.release()
+    options.maintenance = acquireProfileStateMaintenance(
+      dirname(dirname(dirname(options.dataFile)))
+    )
+    restoreProfileStateDatabaseBackup(options)
+    expect(readRestored(options.databasePath)).toBe(savedJson)
+  })
+
+  it('archives and removes SQLite backups and sidecars when explicitly rolling back to JSON', async () => {
+    const options = await fixture()
+    writeFileSync(`${options.backupPath}-journal`, 'backup recovery evidence')
+    const recovered = restoreProfileStateJsonExport(options)
+    expect(existsSync(options.databasePath)).toBe(false)
+    expect(existsSync(options.backupPath)).toBe(false)
+    expect(existsSync(`${options.backupPath}-journal`)).toBe(false)
+    expect(
+      readFileSync(
+        join(recovered.quarantine.directory, `${basename(options.backupPath)}-journal`),
+        'utf8'
+      )
+    ).toBe('backup recovery evidence')
+    expect(readFileSync(options.dataFile, 'utf8')).toContain('migration')
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-database-recovery.ts b/src/main/persistence/profile-state/profile-state-database-recovery.ts
new file mode 100644
index 00000000000..f561c976680
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-recovery.ts
@@ -0,0 +1,113 @@
+import { profileStateDatabaseFiles } from './profile-state-storage-classification'
+import { existsSync, lstatSync, mkdirSync, rmSync } from 'node:fs'
+import { dirname } from 'node:path'
+import { durableWriteTempPath, renameDurableSync } from '../../durable-file-write'
+import { hardenSqliteDatabaseFiles } from '../../sqlite/harden-database-files'
+import { bestEffortFsyncDirectorySync, fsyncFileSync } from '../../../shared/secure-file'
+import { openProfileStateDatabaseReadOnly } from './profile-state-database'
+import { validateProfileStateSnapshot } from './profile-state-documents'
+import { copyProfileStateRecoveryFile } from './profile-state-recovery-copy'
+import {
+  profileStateDatabaseBackups,
+  profileStateDatabaseBackupFiles
+} from './profile-state-backup-path'
+import { profileStateJsonExportPaths } from './legacy-json/profile-state-export-path'
+import { assertProfileStateMaintenance, type ProfileStateMaintenance } from './profile-state-access'
+import {
+  quarantineProfileStateDatabase,
+  type ProfileStateDatabaseQuarantine
+} from './profile-state-database-quarantine'
+
+export type ProfileStateDatabaseRecoveryOptions = {
+  maintenance: ProfileStateMaintenance
+  databasePath: string
+  dataFile: string
+  backupPath: string
+  profileId: string
+  quarantineRoot?: string
+  reason?: string
+  beforeRestore?: () => void
+}
+
+export type ProfileStateDatabaseRecovery = {
+  revision: number
+  quarantine: ProfileStateDatabaseQuarantine
+  removedDatabaseFiles: readonly string[]
+}
+
+/** Replace the database family only while startup and offline access are excluded. */
+export function restoreProfileStateDatabaseBackup(
+  options: ProfileStateDatabaseRecoveryOptions
+): ProfileStateDatabaseRecovery {
+  assertProfileStateMaintenance(options.maintenance, options)
+  const backups = profileStateDatabaseBackups(options.databasePath)
+  if (!backups.some((backup) => backup.path === options.backupPath)) {
+    throw new Error('Selected profile state database backup is not retained by this profile')
+  }
+  if (!lstatSync(options.backupPath).isFile()) {
+    throw new Error('Profile state database backup must be a regular file')
+  }
+  if (['-wal', '-shm', '-journal'].some((suffix) => existsSync(`${options.backupPath}${suffix}`))) {
+    throw new Error('Profile state database backup has sidecars and is not self-contained')
+  }
+
+  mkdirSync(dirname(options.databasePath), { recursive: true })
+  const stagingPath = durableWriteTempPath(options.databasePath)
+  try {
+    copyProfileStateRecoveryFile(options.backupPath, stagingPath)
+    hardenSqliteDatabaseFiles(stagingPath)
+    const revision = validateRecoverySnapshot(stagingPath, options.profileId)
+    fsyncFileSync(stagingPath)
+    const recoveryFiles = [
+      ...profileStateDatabaseBackupFiles(options.databasePath),
+      ...profileStateJsonExportPaths(options.dataFile),
+      ...(existsSync(options.dataFile) ? [options.dataFile] : [])
+    ]
+    const quarantine = quarantineProfileStateDatabase(
+      options.databasePath,
+      options.profileId,
+      options.quarantineRoot,
+      options.reason ?? 'profile-state-database-rollback',
+      recoveryFiles
+    )
+    options.beforeRestore?.()
+
+    // JSON exports are revisioned for the legacy authority. Remove them after
+    // archiving so a later SQLite revision can publish a fresh export at the
+    // same number without colliding with an older divergent payload.
+    const retainedJsonExports = profileStateJsonExportPaths(options.dataFile)
+    for (const exportPath of retainedJsonExports) {
+      rmSync(exportPath)
+    }
+
+    const removedDatabaseFiles = profileStateDatabaseFiles(options.databasePath).filter(existsSync)
+    // Remove the primary first: interruption must fail closed on retained backups, never replay old WAL.
+    for (const path of removedDatabaseFiles) {
+      rmSync(path)
+    }
+    rmSync(options.dataFile, { force: true })
+    bestEffortFsyncDirectorySync(dirname(options.databasePath))
+    renameDurableSync(stagingPath, options.databasePath)
+    return { revision, quarantine, removedDatabaseFiles }
+  } finally {
+    for (const path of profileStateDatabaseFiles(stagingPath)) {
+      rmSync(path, { force: true })
+    }
+  }
+}
+
+function validateRecoverySnapshot(path: string, profileId: string): number {
+  const opened = openProfileStateDatabaseReadOnly(path, profileId)
+  try {
+    if (opened.db.pragma('journal_mode', { simple: true }) !== 'delete') {
+      throw new Error('Profile state database backup must use a self-contained journal mode')
+    }
+    const revision = validateProfileStateSnapshot(opened.db)
+    if (revision === 0) {
+      throw new Error('Profile state database backup contains no committed profile state')
+    }
+    return revision
+  } finally {
+    opened.db.close()
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-database-rollback-export.test.ts b/src/main/persistence/profile-state/profile-state-database-rollback-export.test.ts
new file mode 100644
index 00000000000..29f1af65389
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-rollback-export.test.ts
@@ -0,0 +1,159 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, join } from 'node:path'
+import { expect, it, vi } from 'vitest'
+import { Store } from '../loading-store/store'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { profileStateDatabaseBackups } from './profile-state-backup-path'
+import { profileStateJsonExportPath } from './legacy-json/profile-state-export-path'
+import { acquireProfileStateMaintenance } from './profile-state-access'
+import { restoreProfileStateJsonExport } from './legacy-json/profile-state-recovery'
+import { openProfileStateDatabase } from './profile-state-database'
+import {
+  bootstrapProfileStateAuthority,
+  ProfileStateAuthorityBootstrapError
+} from './profile-state-authority-bootstrap'
+import { restoreProfileStateDatabaseBackup } from './profile-state-database-recovery'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (value: string) => Buffer.from(`encrypted:${value}`),
+    decryptString: (value: Buffer) => value.toString().slice('encrypted:'.length)
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+it('can publish an updater JSON export at a reused revision after SQLite rollback', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'orca-database-rollback-export-'))
+  const directory = join(root, 'profiles', 'rollback-export')
+  mkdirSync(directory, { recursive: true })
+  const databasePath = join(directory, 'profile-state.db')
+  const dataFile = join(directory, 'orca-data.json')
+  const profileId = 'rollback-export'
+  const stores: Store[] = []
+  try {
+    const originalAuthority = new ProfileStateSqliteAuthority(databasePath, profileId)
+    const original = new Store({
+      dataFile,
+      profileStateAuthority: originalAuthority
+    })
+    stores.push(original)
+    original.updateSettings({ theme: 'light' })
+    await original.flushPendingOrThrowAsync()
+    await originalAuthority.drainBackups()
+    const backup = profileStateDatabaseBackups(databasePath)[0]
+    expect(backup).toBeDefined()
+    original.updateSettings({ theme: 'dark' })
+    const formerRevision = original.writeLatestProfileStateJsonExport()
+    expect(formerRevision).toBeTypeOf('number')
+    if (!backup || formerRevision === undefined) {
+      throw new Error('Missing recovery fixture')
+    }
+    const exportPath = profileStateJsonExportPath(dataFile, formerRevision)
+    const previousExport = readFileSync(exportPath)
+    original.freezeWrites()
+    await original.flushAsync()
+
+    const restored = restoreProfileStateDatabaseBackup({
+      maintenance: acquireProfileStateMaintenance(root),
+      databasePath,
+      dataFile,
+      profileId,
+      backupPath: backup.path
+    })
+    expect(existsSync(exportPath)).toBe(false)
+    expect(readFileSync(join(restored.quarantine.directory, basename(exportPath)))).toEqual(
+      previousExport
+    )
+    const recovered = new Store({
+      dataFile,
+      profileStateAuthority: new ProfileStateSqliteAuthority(databasePath, profileId)
+    })
+    stores.push(recovered)
+    recovered.updateSettings({ theme: 'system' })
+    const newRevision = recovered.writeLatestProfileStateJsonExport()
+
+    expect(newRevision).toBe(formerRevision)
+    expect(JSON.parse(readFileSync(exportPath, 'utf8')).settings.theme).toBe('system')
+    expect(readFileSync(exportPath)).not.toEqual(previousExport)
+  } finally {
+    for (const store of stores) {
+      store.freezeWrites()
+      await store.flushAsync()
+    }
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+it('leaves an explicit rollback path if compatibility publication fails before acceptance', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-compat-failure-'))
+  const directory = join(root, 'profiles', 'profile-authority-test')
+  mkdirSync(directory, { recursive: true })
+  const dataFile = join(directory, 'orca-data.json')
+  const databasePath = join(directory, 'profile-state.db')
+  writeFileSync(dataFile, JSON.stringify({ settings: { theme: 'light' } }), 'utf8')
+
+  const authority = new ProfileStateSqliteAuthority(databasePath, 'profile-authority-test')
+  const store = new Store({ dataFile, profileStateAuthority: authority })
+  try {
+    store.updateSettings({ theme: 'dark' })
+    store.flushOrThrow()
+    const revisionOne = store.writeLatestProfileStateJsonExport()
+    expect(revisionOne).toBe(1)
+
+    const opened = openProfileStateDatabase(databasePath, 'profile-authority-test')
+    opened.db.exec(
+      `CREATE TRIGGER fail_compatibility_acceptance
+       BEFORE INSERT ON profile_state_meta
+       WHEN NEW.key = 'legacy_json_acceptance'
+       BEGIN SELECT RAISE(ABORT, 'injected compatibility failure'); END`
+    )
+    opened.db.close()
+
+    store.updateSettings({ theme: 'light' })
+    expect(() => store.writeLatestProfileStateJsonCompatibilityExport()).toThrow(
+      'injected compatibility failure'
+    )
+    expect(JSON.parse(readFileSync(dataFile, 'utf8')).settings.theme).toBe('light')
+    expect(() =>
+      bootstrapProfileStateAuthority({
+        dataFile,
+        databaseFile: databasePath,
+        profileId: 'profile-authority-test'
+      })
+    ).toThrow(ProfileStateAuthorityBootstrapError)
+
+    store.freezeWrites()
+    await store.flushAsync()
+    restoreProfileStateJsonExport({
+      maintenance: acquireProfileStateMaintenance(root),
+      databasePath,
+      dataFile,
+      exportPath: profileStateJsonExportPath(dataFile, revisionOne ?? 1),
+      profileId: 'profile-authority-test'
+    })
+    expect(JSON.parse(readFileSync(dataFile, 'utf8')).settings.theme).toBe('dark')
+  } finally {
+    store.freezeWrites()
+    await store.flushAsync()
+    rmSync(root, { recursive: true, force: true })
+  }
+})
diff --git a/src/main/persistence/profile-state/profile-state-database-schema.ts b/src/main/persistence/profile-state/profile-state-database-schema.ts
new file mode 100644
index 00000000000..4f6cd453825
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-schema.ts
@@ -0,0 +1,41 @@
+// Schema 3 requires explicit automation storage metadata even when history is empty.
+
+import {
+  PROFILE_STATE_AUTOMATION_RUNS_META_TABLE,
+  PROFILE_STATE_AUTOMATION_RUNS_TABLE
+} from './profile-state-automation-runs-model'
+
+export const PROFILE_STATE_DATABASE_SCHEMA_VERSION = 3
+export const PROFILE_STATE_DOCUMENT_VERSION = 1
+
+export const PROFILE_STATE_META_PROFILE_ID = 'profile_id'
+export const PROFILE_STATE_META_REVISION = 'revision'
+/** Records the legacy JSON bytes accepted by the SQLite authority bootstrap. */
+export const PROFILE_STATE_META_LEGACY_JSON_ACCEPTANCE = 'legacy_json_acceptance'
+
+export function createProfileStateTablesSql(): string {
+  return `CREATE TABLE IF NOT EXISTS profile_state_meta (
+    key TEXT PRIMARY KEY NOT NULL, value TEXT NOT NULL
+  );
+  CREATE TABLE IF NOT EXISTS profile_state_documents (
+    domain TEXT PRIMARY KEY NOT NULL, payload TEXT NOT NULL,
+    domain_version INTEGER NOT NULL, revision INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL, content_hash TEXT NOT NULL
+  );
+  CREATE TABLE IF NOT EXISTS ${PROFILE_STATE_AUTOMATION_RUNS_META_TABLE} (
+    domain TEXT PRIMARY KEY NOT NULL,
+    presence TEXT NOT NULL,
+    domain_version INTEGER NOT NULL,
+    revision INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    content_hash TEXT NOT NULL
+  );
+  CREATE TABLE IF NOT EXISTS ${PROFILE_STATE_AUTOMATION_RUNS_TABLE} (
+    run_id TEXT PRIMARY KEY NOT NULL,
+    ordinal INTEGER NOT NULL,
+    payload TEXT NOT NULL,
+    content_hash TEXT NOT NULL,
+    revision INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+  );`
+}
diff --git a/src/main/persistence/profile-state/profile-state-database-snapshot.test.ts b/src/main/persistence/profile-state/profile-state-database-snapshot.test.ts
new file mode 100644
index 00000000000..e0147cb937f
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-snapshot.test.ts
@@ -0,0 +1,328 @@
+import {
+  existsSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly,
+  profileStateDatabaseFile
+} from './profile-state-database'
+import { exportProfileStateJson, importProfileStateJson } from './profile-state-documents'
+import { writeProfileStateDatabaseSnapshotAsync } from './profile-state-database-snapshot'
+import type Database from '../../sqlite/sync-database'
+import * as durableFileWrite from '../../durable-file-write'
+import * as fsPromises from 'node:fs/promises'
+
+vi.mock('node:fs/promises', async (importOriginal) => {
+  const actual = await importOriginal<typeof fsPromises>()
+  return { ...actual }
+})
+
+const directories: string[] = []
+const databases: Database.Database[] = []
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const db of databases.splice(0)) {
+    db.close()
+  }
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-async-snapshot-'))
+  directories.push(directory)
+  const databasePath = profileStateDatabaseFile(directory)
+  const { db } = openProfileStateDatabase(databasePath, 'profile-a')
+  databases.push(db)
+  const originalJson = JSON.stringify({ settings: { theme: 'light' } })
+  importProfileStateJson(db, originalJson)
+  return { directory, databasePath, db, targetPath: join(directory, 'snapshot.db'), originalJson }
+}
+
+function readSnapshot(path: string): string {
+  const { db } = openProfileStateDatabaseReadOnly(path, 'profile-a')
+  try {
+    return exportProfileStateJson(db)
+  } finally {
+    db.close()
+  }
+}
+
+function expectNoTemporaryFiles(directory: string): void {
+  expect(readdirSync(directory).filter((name) => name.includes('.tmp'))).toEqual([])
+}
+
+describe('asynchronous profile-state database snapshots', () => {
+  it('publishes a hardened self-contained snapshot including committed WAL pages', async () => {
+    const { directory, databasePath, db, targetPath, originalJson } = fixture()
+    expect(existsSync(`${databasePath}-wal`)).toBe(true)
+    const sourceFile = readFileSync(databasePath)
+
+    await writeProfileStateDatabaseSnapshotAsync(db, targetPath)
+
+    expect(readSnapshot(targetPath)).toBe(originalJson)
+    expect(existsSync(`${targetPath}-wal`)).toBe(false)
+    expect(existsSync(`${targetPath}-shm`)).toBe(false)
+    if (process.platform !== 'win32') {
+      expect(statSync(targetPath).mode & 0o777).toBe(0o600)
+    }
+    expect(exportProfileStateJson(db)).toBe(originalJson)
+    expect(db.pragma('journal_mode', { simple: true })).toBe('wal')
+    expect(readFileSync(databasePath)).toEqual(sourceFile)
+    importProfileStateJson(db, JSON.stringify({ settings: { theme: 'dark' } }))
+    expect(readSnapshot(targetPath)).toBe(originalJson)
+    expectNoTemporaryFiles(directory)
+  })
+
+  it('never removes an existing staging file when exclusive creation fails', async () => {
+    const { db, databasePath, targetPath, originalJson } = fixture()
+    await expect(
+      writeProfileStateDatabaseSnapshotAsync(db, targetPath, { temporaryPath: databasePath })
+    ).rejects.toThrow()
+    expect(existsSync(databasePath)).toBe(true)
+    expect(exportProfileStateJson(db)).toBe(originalJson)
+    expect(existsSync(targetPath)).toBe(false)
+  })
+
+  // Node's incremental backup callback is not part of Bun's worker snapshot contract.
+  it.skipIf(!!process.versions.bun).each(['same connection', 'another connection'] as const)(
+    'keeps a consistent complete revision while writes occur from %s',
+    async (connection) => {
+      const { directory, databasePath, db, targetPath } = fixture()
+      const writer =
+        connection === 'same connection'
+          ? db
+          : openProfileStateDatabase(databasePath, 'profile-a').db
+      if (writer !== db) {
+        databases.push(writer)
+      }
+      const padding = 'x'.repeat(256_000)
+      importProfileStateJson(
+        db,
+        JSON.stringify({ settings: { value: 1 }, ui: { value: 1 }, padding })
+      )
+      const nextJson = JSON.stringify({ settings: { value: 2 }, ui: { value: 2 }, padding })
+      const nativeBackup = db.backup.bind(db)
+      let wroteDuringBackup = false
+      vi.spyOn(db, 'backup').mockImplementation((path) =>
+        nativeBackup(path, {
+          rate: 1,
+          progress: ({ remainingPages }) => {
+            if (remainingPages > 0 && !wroteDuringBackup) {
+              wroteDuringBackup = true
+              importProfileStateJson(writer, nextJson)
+            }
+          }
+        })
+      )
+
+      await writeProfileStateDatabaseSnapshotAsync(db, targetPath)
+
+      expect(wroteDuringBackup).toBe(true)
+      expect(readSnapshot(targetPath)).toBe(nextJson)
+      expect(exportProfileStateJson(db)).toBe(nextJson)
+      expectNoTemporaryFiles(directory)
+    }
+  )
+
+  it('preserves the previous destination and removes staging after native backup fails', async () => {
+    const { directory, db, targetPath, originalJson } = fixture()
+    await writeProfileStateDatabaseSnapshotAsync(db, targetPath)
+    const previous = readFileSync(targetPath)
+    vi.spyOn(db, 'backup').mockImplementation(async (path) => {
+      writeFileSync(path, 'incomplete backup')
+      writeFileSync(`${path}-journal`, 'incomplete journal')
+      throw new Error('injected native backup failure')
+    })
+
+    await expect(writeProfileStateDatabaseSnapshotAsync(db, targetPath)).rejects.toThrow(
+      'injected native backup failure'
+    )
+
+    expect(readFileSync(targetPath)).toEqual(previous)
+    expect(exportProfileStateJson(db)).toBe(originalJson)
+    expectNoTemporaryFiles(directory)
+  })
+
+  it('validates staged content before replacing the previous destination', async () => {
+    const { directory, db, targetPath } = fixture()
+    writeFileSync(targetPath, 'previous recovery artifact')
+
+    await expect(
+      writeProfileStateDatabaseSnapshotAsync(db, targetPath, {
+        validateStagedSnapshot: () => {
+          throw new Error('staged validation failed')
+        }
+      })
+    ).rejects.toThrow('staged validation failed')
+
+    expect(readFileSync(targetPath, 'utf8')).toBe('previous recovery artifact')
+    expectNoTemporaryFiles(directory)
+  })
+
+  it('preserves the previous destination when publication fails', async () => {
+    const { directory, db, targetPath } = fixture()
+    await writeProfileStateDatabaseSnapshotAsync(db, targetPath)
+    const previous = readFileSync(targetPath)
+    importProfileStateJson(db, JSON.stringify({ settings: { theme: 'dark' } }))
+    vi.spyOn(durableFileWrite, 'renameDurable').mockRejectedValue(
+      new Error('injected rename failure')
+    )
+
+    await expect(writeProfileStateDatabaseSnapshotAsync(db, targetPath)).rejects.toThrow(
+      'injected rename failure'
+    )
+
+    expect(readFileSync(targetPath)).toEqual(previous)
+    expectNoTemporaryFiles(directory)
+  })
+
+  it('rejects active transactions without publishing uncommitted state', async () => {
+    const { directory, db, targetPath, originalJson } = fixture()
+    await writeProfileStateDatabaseSnapshotAsync(db, targetPath)
+    const previous = readFileSync(targetPath)
+    db.exec('BEGIN IMMEDIATE')
+    try {
+      db.exec("UPDATE profile_state_documents SET payload = '{}' WHERE domain = 'settings'")
+      await expect(writeProfileStateDatabaseSnapshotAsync(db, targetPath)).rejects.toThrow(
+        'idle database connection'
+      )
+    } finally {
+      db.exec('ROLLBACK')
+    }
+
+    expect(readFileSync(targetPath)).toEqual(previous)
+    expect(exportProfileStateJson(db)).toBe(originalJson)
+    expectNoTemporaryFiles(directory)
+  })
+
+  it('checks again if a transaction starts while the backup is staging', async () => {
+    const { directory, db, targetPath } = fixture()
+    const nativeBackup = db.backup.bind(db)
+    vi.spyOn(db, 'backup').mockImplementation((path) => {
+      db.exec('BEGIN IMMEDIATE')
+      return nativeBackup(path)
+    })
+    try {
+      await expect(writeProfileStateDatabaseSnapshotAsync(db, targetPath)).rejects.toThrow(
+        'idle database connection'
+      )
+    } finally {
+      db.exec('ROLLBACK')
+    }
+    expect(existsSync(targetPath)).toBe(false)
+    expectNoTemporaryFiles(directory)
+  })
+
+  it('leaves the previous destination intact when the staged file cannot be fsynced', async () => {
+    const { directory, db, targetPath } = fixture()
+    writeFileSync(targetPath, 'previous recovery artifact')
+    const nativeOpen = fsPromises.open
+    vi.spyOn(fsPromises, 'open').mockImplementation(async (...args) => {
+      const file = await nativeOpen(...args)
+      if (args[1] === 'r+') {
+        vi.spyOn(file, 'sync').mockRejectedValue(new Error('injected fsync failure'))
+      }
+      return file
+    })
+
+    await expect(writeProfileStateDatabaseSnapshotAsync(db, targetPath)).rejects.toThrow(
+      'injected fsync failure'
+    )
+
+    expect(readFileSync(targetPath, 'utf8')).toBe('previous recovery artifact')
+    expectNoTemporaryFiles(directory)
+  })
+
+  it.skipIf(!!process.versions.bun)(
+    'fails clearly when native backup is unsupported without replacing the destination',
+    async () => {
+      const { directory, db, targetPath } = fixture()
+      writeFileSync(targetPath, 'previous recovery artifact')
+      const getBuiltinModule = process.getBuiltinModule.bind(process)
+      vi.spyOn(process, 'getBuiltinModule').mockImplementation((id) =>
+        id === 'node:sqlite' ? {} : getBuiltinModule(id)
+      )
+
+      await expect(writeProfileStateDatabaseSnapshotAsync(db, targetPath)).rejects.toThrow(
+        'Asynchronous SQLite backup is unavailable'
+      )
+
+      expect(readFileSync(targetPath, 'utf8')).toBe('previous recovery artifact')
+      expectNoTemporaryFiles(directory)
+    }
+  )
+
+  it.each(['', 'invalid\0path'])('rejects the invalid target %j', async (path) => {
+    const { db } = fixture()
+    await expect(writeProfileStateDatabaseSnapshotAsync(db, path)).rejects.toThrow(
+      'snapshot path is invalid'
+    )
+  })
+
+  it.each(['', '-wal', '-shm', '-journal'])(
+    'refuses to replace the source database%s',
+    async (suffix) => {
+      const { databasePath, db, originalJson } = fixture()
+      await expect(
+        writeProfileStateDatabaseSnapshotAsync(db, `${databasePath}${suffix}`)
+      ).rejects.toThrow('cannot replace a source database')
+      expect(exportProfileStateJson(db)).toBe(originalJson)
+    }
+  )
+
+  it('rejects a source database reached through a directory alias', async () => {
+    const { directory, db, originalJson } = fixture()
+    const alias = join(directory, 'alias')
+    symlinkSync(directory, alias, 'junction')
+    await expect(
+      writeProfileStateDatabaseSnapshotAsync(db, join(alias, 'profile-state.db'))
+    ).rejects.toThrow('cannot replace a source database')
+    expect(exportProfileStateJson(db)).toBe(originalJson)
+  })
+
+  it.for(['', '-WAL', '-SHM', '-JOURNAL'])(
+    'refuses source database%s case aliases on case-insensitive filesystems',
+    async (suffix, { skip }) => {
+      const { directory, db, originalJson } = fixture()
+      const alias = join(directory, 'PROFILE-STATE.DB')
+      if (!existsSync(alias)) {
+        skip()
+        return
+      }
+      await expect(writeProfileStateDatabaseSnapshotAsync(db, `${alias}${suffix}`)).rejects.toThrow(
+        'cannot replace a source database'
+      )
+      expect(exportProfileStateJson(db)).toBe(originalJson)
+    }
+  )
+
+  it.each(['-wal', '-shm', '-journal'])(
+    'preserves a destination with an existing %s sidecar',
+    async (suffix) => {
+      const { directory, db, targetPath } = fixture()
+      writeFileSync(targetPath, 'previous recovery artifact')
+      writeFileSync(`${targetPath}${suffix}`, 'retained SQLite sidecar')
+
+      await expect(writeProfileStateDatabaseSnapshotAsync(db, targetPath)).rejects.toThrow(
+        'destination has SQLite sidecars'
+      )
+
+      expect(readFileSync(targetPath, 'utf8')).toBe('previous recovery artifact')
+      expect(readFileSync(`${targetPath}${suffix}`, 'utf8')).toBe('retained SQLite sidecar')
+      expectNoTemporaryFiles(directory)
+    }
+  )
+})
diff --git a/src/main/persistence/profile-state/profile-state-database-snapshot.ts b/src/main/persistence/profile-state/profile-state-database-snapshot.ts
new file mode 100644
index 00000000000..9cc89d58b59
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-snapshot.ts
@@ -0,0 +1,123 @@
+import { profileStateDatabaseFiles } from './profile-state-storage-classification'
+import { access, mkdir, open, realpath, rm, stat } from 'node:fs/promises'
+import { basename, dirname, resolve } from 'node:path'
+import Database from '../../sqlite/sync-database'
+import { hardenSqliteDatabaseFiles } from '../../sqlite/harden-database-files'
+import { durableWriteTempPath, renameDurable } from '../../durable-file-write'
+
+/** The caller owns the destination and keeps the source open until this backup settles. */
+export async function writeProfileStateDatabaseSnapshotAsync(
+  db: Database.Database,
+  targetPath: string,
+  options: {
+    temporaryPath?: string
+    validateStagedSnapshot?: (stagingPath: string) => Promise<void> | void
+  } = {}
+): Promise<void> {
+  if (targetPath.length === 0 || targetPath.includes('\0')) {
+    throw new Error('Profile state snapshot path is invalid')
+  }
+  if (db.isTransaction) {
+    throw new Error('Profile state database snapshot requires an idle database connection')
+  }
+  await mkdir(dirname(targetPath), { recursive: true })
+  await assertSnapshotTargetIsSeparate(db, targetPath)
+  await assertNoSnapshotSidecars(targetPath)
+  const temporaryPath = options.temporaryPath ?? durableWriteTempPath(targetPath)
+  let published = false
+  let created = false
+  try {
+    // Pre-create privately: the native backup otherwise creates a world-readable temporary file.
+    const temporary = await open(temporaryPath, 'wx', 0o600)
+    created = true
+    await temporary.close()
+    await db.backup(temporaryPath)
+    // The native copy preserves WAL mode; snapshots must not create sidecars when opened read-only.
+    const snapshot = new Database(temporaryPath, { fileMustExist: true })
+    try {
+      if (snapshot.pragma('journal_mode = DELETE', { simple: true }) !== 'delete') {
+        throw new Error('Profile state snapshot could not become a self-contained database')
+      }
+    } finally {
+      snapshot.close()
+    }
+    hardenSqliteDatabaseFiles(temporaryPath)
+    const completed = await open(temporaryPath, 'r+')
+    try {
+      await completed.sync()
+    } finally {
+      await completed.close()
+    }
+    await options.validateStagedSnapshot?.(temporaryPath)
+    await assertNoSnapshotSidecars(targetPath)
+    await renameDurable(temporaryPath, targetPath)
+    published = true
+  } finally {
+    if (created && !published) {
+      await rm(temporaryPath, { force: true })
+    }
+    if (created) {
+      await Promise.all(
+        ['-wal', '-shm', '-journal'].map((suffix) =>
+          rm(`${temporaryPath}${suffix}`, { force: true })
+        )
+      )
+    }
+  }
+}
+
+async function assertSnapshotTargetIsSeparate(
+  db: Database.Database,
+  targetPath: string
+): Promise<void> {
+  const target = await realpath(targetPath).catch(async (error: unknown) => {
+    if (!isMissingPath(error)) {
+      throw error
+    }
+    return resolve(await realpath(dirname(targetPath)), basename(targetPath))
+  })
+  const databases = db.prepare('PRAGMA database_list').all()
+  for (const database of databases) {
+    if (typeof database.file !== 'string' || database.file.length === 0) {
+      continue
+    }
+    const source = await realpath(database.file)
+    if (profileStateDatabaseFiles(source).includes(target)) {
+      throw new Error('Profile state snapshot cannot replace a source database or its sidecars')
+    }
+    // realpath preserves case aliases on macOS; file identity also protects absent sidecar names.
+    const sourceInfo = await stat(source, { bigint: true })
+    for (const candidate of new Set([target, target.replace(/-(?:wal|shm|journal)$/i, '')])) {
+      const targetInfo = await stat(candidate, { bigint: true }).catch((error: unknown) => {
+        if (!isMissingPath(error)) {
+          throw error
+        }
+        return undefined
+      })
+      if (targetInfo?.dev === sourceInfo.dev && targetInfo.ino === sourceInfo.ino) {
+        throw new Error('Profile state snapshot cannot replace a source database or its sidecars')
+      }
+    }
+  }
+}
+
+async function assertNoSnapshotSidecars(targetPath: string): Promise<void> {
+  for (const suffix of ['-wal', '-shm', '-journal']) {
+    const exists = await access(`${targetPath}${suffix}`).then(
+      () => true,
+      (error: unknown) => {
+        if (!isMissingPath(error)) {
+          throw error
+        }
+        return false
+      }
+    )
+    if (exists) {
+      throw new Error('Profile state snapshot destination has SQLite sidecars')
+    }
+  }
+}
+
+function isMissingPath(error: unknown): boolean {
+  return error instanceof Error && 'code' in error && error.code === 'ENOENT'
+}
diff --git a/src/main/persistence/profile-state/profile-state-database-validation.ts b/src/main/persistence/profile-state/profile-state-database-validation.ts
new file mode 100644
index 00000000000..3bd74421965
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-validation.ts
@@ -0,0 +1,146 @@
+import { withProfileStateReadSnapshot } from './profile-state-read-snapshot'
+import type Database from '../../sqlite/sync-database'
+import { readCurrentAutomationRunsState } from './profile-state-automation-runs-storage'
+import { readProfileStateRevision } from './profile-state-revision'
+import {
+  PROFILE_STATE_META_PROFILE_ID,
+  PROFILE_STATE_DATABASE_SCHEMA_VERSION
+} from './profile-state-database-schema'
+import {
+  PROFILE_STATE_AUTOMATION_RUNS_META_TABLE,
+  PROFILE_STATE_AUTOMATION_RUNS_TABLE
+} from './profile-state-automation-runs'
+import { ProfileStateDatabaseOpenError } from './profile-state-database-errors'
+
+export function verifyProfileStateSchema(
+  db: Database.Database,
+  profileId: string,
+  schemaVersion = PROFILE_STATE_DATABASE_SCHEMA_VERSION
+): void {
+  withProfileStateReadSnapshot(db, () => {
+    const tables = profileStateTableNames(db)
+    if (
+      !tables.has('profile_state_meta') ||
+      !tables.has('profile_state_documents') ||
+      (schemaVersion >= 2 &&
+        (!tables.has(PROFILE_STATE_AUTOMATION_RUNS_META_TABLE) ||
+          !tables.has(PROFILE_STATE_AUTOMATION_RUNS_TABLE)))
+    ) {
+      throw new Error('Profile state database schema is incomplete')
+    }
+
+    verifyProfileStateColumns(db, 'profile_state_meta', {
+      key: { type: 'TEXT', notNull: true, primaryKey: true },
+      value: { type: 'TEXT', notNull: true, primaryKey: false }
+    })
+    verifyProfileStateColumns(db, 'profile_state_documents', {
+      domain: { type: 'TEXT', notNull: true, primaryKey: true },
+      payload: { type: 'TEXT', notNull: true, primaryKey: false },
+      domain_version: { type: 'INTEGER', notNull: true, primaryKey: false },
+      revision: { type: 'INTEGER', notNull: true, primaryKey: false },
+      updated_at: { type: 'INTEGER', notNull: true, primaryKey: false },
+      content_hash: { type: 'TEXT', notNull: true, primaryKey: false }
+    })
+    if (schemaVersion >= 2) {
+      verifyProfileStateColumns(db, PROFILE_STATE_AUTOMATION_RUNS_META_TABLE, {
+        domain: { type: 'TEXT', notNull: true, primaryKey: true },
+        presence: { type: 'TEXT', notNull: true, primaryKey: false },
+        domain_version: { type: 'INTEGER', notNull: true, primaryKey: false },
+        revision: { type: 'INTEGER', notNull: true, primaryKey: false },
+        updated_at: { type: 'INTEGER', notNull: true, primaryKey: false },
+        content_hash: { type: 'TEXT', notNull: true, primaryKey: false }
+      })
+      verifyProfileStateColumns(db, PROFILE_STATE_AUTOMATION_RUNS_TABLE, {
+        run_id: { type: 'TEXT', notNull: true, primaryKey: true },
+        ordinal: { type: 'INTEGER', notNull: true, primaryKey: false },
+        payload: { type: 'TEXT', notNull: true, primaryKey: false },
+        content_hash: { type: 'TEXT', notNull: true, primaryKey: false },
+        revision: { type: 'INTEGER', notNull: true, primaryKey: false },
+        updated_at: { type: 'INTEGER', notNull: true, primaryKey: false }
+      })
+    }
+
+    verifyProfileStateIdentity(db, profileId)
+    if (schemaVersion >= 3) {
+      readCurrentAutomationRunsState(db, readProfileStateRevision(db))
+    }
+  })
+}
+
+export function verifyEmptyProfileStateSchema(db: Database.Database): void {
+  if (profileStateTableNames(db).size > 0) {
+    throw new Error('Profile state database has an unexpected version-0 schema')
+  }
+}
+
+function verifyProfileStateColumns(
+  db: Database.Database,
+  table: string,
+  expected: Readonly<Record<string, { type: string; notNull: boolean; primaryKey: boolean }>>
+): void {
+  const rows = db.pragma(`table_info(${table})`)
+  if (!Array.isArray(rows)) {
+    throw new Error(`Profile state table has no readable columns: ${table}`)
+  }
+  const columns = new Map<string, { type: string; notNull: boolean; primaryKey: boolean }>()
+  for (const row of rows) {
+    if (
+      !isRecord(row) ||
+      typeof row.name !== 'string' ||
+      typeof row.type !== 'string' ||
+      typeof row.notnull !== 'number' ||
+      typeof row.pk !== 'number'
+    ) {
+      throw new Error(`Profile state table has malformed column metadata: ${table}`)
+    }
+    columns.set(row.name, {
+      type: row.type.toUpperCase(),
+      notNull: row.notnull === 1,
+      primaryKey: row.pk === 1
+    })
+  }
+  for (const [name, definition] of Object.entries(expected)) {
+    const actual = columns.get(name)
+    if (
+      actual === undefined ||
+      actual.type !== definition.type ||
+      actual.notNull !== definition.notNull ||
+      actual.primaryKey !== definition.primaryKey
+    ) {
+      throw new Error(`Profile state table has an incompatible column: ${table}.${name}`)
+    }
+  }
+}
+
+function profileStateTableNames(db: Database.Database): Set<string> {
+  return new Set(
+    db
+      .prepare("SELECT name FROM sqlite_master WHERE type = 'table'")
+      .all()
+      .map((row) => (isRecord(row) && typeof row.name === 'string' ? row.name : undefined))
+      .filter((name): name is string => name !== undefined)
+  )
+}
+
+function verifyProfileStateIdentity(db: Database.Database, profileId: string): void {
+  const storedProfileIdRow = db
+    .prepare('SELECT value FROM profile_state_meta WHERE key = ?')
+    .get(PROFILE_STATE_META_PROFILE_ID)
+  const storedProfileId =
+    isRecord(storedProfileIdRow) && typeof storedProfileIdRow.value === 'string'
+      ? storedProfileIdRow.value
+      : undefined
+  if (storedProfileId === undefined) {
+    throw new Error('Profile state database is missing its profile identity')
+  }
+  if (storedProfileId !== profileId) {
+    throw new ProfileStateDatabaseOpenError(
+      'identity-mismatch',
+      'Profile state database belongs to a different profile'
+    )
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
diff --git a/src/main/persistence/profile-state/profile-state-database.test.ts b/src/main/persistence/profile-state/profile-state-database.test.ts
new file mode 100644
index 00000000000..c3cb63fb114
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database.test.ts
@@ -0,0 +1,339 @@
+import { mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import Database from '../../sqlite/sync-database'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly,
+  profileStateDatabaseFile,
+  profileStatePragmaNumber,
+  PROFILE_STATE_BUSY_TIMEOUT_MS,
+  PROFILE_STATE_DATABASE_FILE_NAME
+} from './profile-state-database'
+import { PROFILE_STATE_DATABASE_SCHEMA_VERSION } from './profile-state-database-schema'
+import { importProfileStateJson } from './profile-state-documents'
+import { quarantineProfileStateDatabase } from './profile-state-database-quarantine'
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function createDirectory(): string {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-db-'))
+  temporaryDirectories.push(directory)
+  return directory
+}
+
+describe('profile state database', () => {
+  it('creates an isolated per-profile schema with durable pragmas', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const opened = openProfileStateDatabase(dbPath, 'profile-a')
+    try {
+      expect(dbPath).toBe(join(directory, PROFILE_STATE_DATABASE_FILE_NAME))
+      expect(opened.readOnly).toBe(false)
+      expect(opened.profileId).toBe('profile-a')
+      expect(profileStatePragmaNumber(opened.db, 'user_version')).toBe(
+        PROFILE_STATE_DATABASE_SCHEMA_VERSION
+      )
+      expect(opened.db.pragma('journal_mode', { simple: true })).toBe('wal')
+      expect(profileStatePragmaNumber(opened.db, 'synchronous')).toBe(2)
+      expect(profileStatePragmaNumber(opened.db, 'busy_timeout')).toBe(
+        PROFILE_STATE_BUSY_TIMEOUT_MS
+      )
+      expect(profileStatePragmaNumber(opened.db, 'foreign_keys')).toBe(1)
+      expect(
+        opened.db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name").all()
+      ).toEqual([
+        { name: 'profile_state_automation_runs' },
+        { name: 'profile_state_automation_runs_meta' },
+        { name: 'profile_state_documents' },
+        { name: 'profile_state_meta' }
+      ])
+      expect(
+        opened.db.prepare('SELECT value FROM profile_state_meta WHERE key = ?').get('profile_id')
+      ).toEqual({ value: 'profile-a' })
+    } finally {
+      opened.db.close()
+    }
+  })
+
+  it('migrates the version-1 document schema by adding normalized run tables', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const seeded = new Database(dbPath)
+    seeded.exec(`
+      PRAGMA user_version = 1;
+      CREATE TABLE profile_state_meta (key TEXT PRIMARY KEY NOT NULL, value TEXT NOT NULL);
+      CREATE TABLE profile_state_documents (
+        domain TEXT PRIMARY KEY NOT NULL,
+        payload TEXT NOT NULL,
+        domain_version INTEGER NOT NULL,
+        revision INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        content_hash TEXT NOT NULL
+      );
+      INSERT INTO profile_state_meta (key, value) VALUES ('profile_id', 'profile-a');
+      INSERT INTO profile_state_meta (key, value) VALUES ('revision', '1');
+      INSERT INTO profile_state_documents
+        (domain, payload, domain_version, revision, updated_at, content_hash)
+      VALUES ('settings', '{"theme":"dark"}', 1, 1, 100, '0f4f87db4567232a7f1756aa1534ec1314777b39c3bf5209f87cf9739321cddc');
+    `)
+    seeded.close()
+
+    const opened = openProfileStateDatabase(dbPath, 'profile-a')
+    try {
+      expect(profileStatePragmaNumber(opened.db, 'user_version')).toBe(
+        PROFILE_STATE_DATABASE_SCHEMA_VERSION
+      )
+      expect(
+        opened.db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name").all()
+      ).toEqual([
+        { name: 'profile_state_automation_runs' },
+        { name: 'profile_state_automation_runs_meta' },
+        { name: 'profile_state_documents' },
+        { name: 'profile_state_meta' }
+      ])
+      expect(
+        opened.db
+          .prepare('SELECT payload FROM profile_state_documents WHERE domain = ?')
+          .get('settings')
+      ).toEqual({ payload: '{"theme":"dark"}' })
+    } finally {
+      opened.db.close()
+    }
+  })
+
+  it('validates normalized tables created during migration', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const seeded = new Database(dbPath)
+    seeded.exec(`
+      PRAGMA user_version = 1;
+      CREATE TABLE profile_state_meta (key TEXT PRIMARY KEY NOT NULL, value TEXT NOT NULL);
+      CREATE TABLE profile_state_documents (
+        domain TEXT PRIMARY KEY NOT NULL,
+        payload TEXT NOT NULL,
+        domain_version INTEGER NOT NULL,
+        revision INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        content_hash TEXT NOT NULL
+      );
+      CREATE TABLE profile_state_automation_runs (
+        run_id TEXT PRIMARY KEY NOT NULL,
+        ordinal INTEGER NOT NULL,
+        payload BLOB NOT NULL,
+        content_hash TEXT NOT NULL,
+        revision INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL
+      );
+      INSERT INTO profile_state_meta (key, value) VALUES ('profile_id', 'profile-a');
+    `)
+    seeded.close()
+
+    expect(() => openProfileStateDatabase(dbPath, 'profile-a')).toThrowError(
+      expect.objectContaining({ code: 'unreadable' })
+    )
+  })
+
+  it('latches a future schema read-only without changing the database file', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const seeded = openProfileStateDatabase(dbPath, 'profile-a')
+    seeded.db.pragma(`user_version = ${PROFILE_STATE_DATABASE_SCHEMA_VERSION + 9}`)
+    seeded.db.close()
+    const before = statSync(dbPath)
+    const beforeBytes = readFileSync(dbPath)
+
+    const opened = openProfileStateDatabase(dbPath, 'profile-a')
+    try {
+      expect(opened.readOnly).toBe(true)
+      expect(profileStatePragmaNumber(opened.db, 'user_version')).toBe(
+        PROFILE_STATE_DATABASE_SCHEMA_VERSION + 9
+      )
+      expect(() => opened.db.exec("INSERT INTO profile_state_meta VALUES ('x', 'y')")).toThrow()
+    } finally {
+      opened.db.close()
+    }
+    const after = statSync(dbPath)
+    expect(after.size).toBe(before.size)
+    expect(readFileSync(dbPath)).toEqual(beforeBytes)
+  })
+
+  it('opens the current schema read-only without changing its bytes', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const seeded = openProfileStateDatabase(dbPath, 'profile-a')
+    seeded.db.close()
+    const before = readFileSync(dbPath)
+
+    const opened = openProfileStateDatabaseReadOnly(dbPath, 'profile-a')
+    try {
+      expect(opened.readOnly).toBe(true)
+      expect(() => opened.db.exec("INSERT INTO profile_state_meta VALUES ('x', 'y')")).toThrow()
+    } finally {
+      opened.db.close()
+    }
+    expect(readFileSync(dbPath)).toEqual(before)
+  })
+
+  it('rejects a database whose profile identity does not match', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const opened = openProfileStateDatabase(dbPath, 'profile-a')
+    opened.db.close()
+    const before = readFileSync(dbPath)
+
+    expect(() => openProfileStateDatabase(dbPath, 'profile-b')).toThrowError(
+      expect.objectContaining({ code: 'identity-mismatch' })
+    )
+    expect(readFileSync(dbPath)).toEqual(before)
+  })
+
+  it('rejects malformed database bytes without replacing them', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const bytes = Buffer.from('not a sqlite database')
+    writeFileSync(dbPath, bytes)
+
+    expect(() => openProfileStateDatabase(dbPath, 'profile-a')).toThrowError(
+      expect.objectContaining({ code: 'unreadable' })
+    )
+    expect(readFileSync(dbPath)).toEqual(bytes)
+  })
+
+  it('quarantines the database family without touching live recovery sources', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const opened = openProfileStateDatabase(dbPath, 'profile-a')
+    importProfileStateJson(opened.db, JSON.stringify({ settings: { theme: 'dark' } }))
+    opened.db.close()
+    writeFileSync(`${dbPath}-wal`, 'wal-preservation-sentinel')
+
+    const sourceBytes = new Map(
+      [dbPath, `${dbPath}-wal`].map((path) => [path, readFileSync(path).toString('hex')])
+    )
+    const result = quarantineProfileStateDatabase(
+      dbPath,
+      'profile-a',
+      join(directory, 'quarantine'),
+      'test-corruption'
+    )
+
+    expect(result.copiedFiles).toHaveLength(2)
+    expect(JSON.parse(readFileSync(result.manifestPath, 'utf8'))).toMatchObject({
+      schemaVersion: 1,
+      profileId: 'profile-a',
+      reason: 'test-corruption',
+      sourceFiles: expect.arrayContaining(['', '-wal'])
+    })
+    expect(readFileSync(join(result.directory, 'profile-state.db')).toString('hex')).toBe(
+      sourceBytes.get(dbPath)
+    )
+    expect(readFileSync(join(result.directory, 'profile-state.db-wal')).toString('hex')).toBe(
+      sourceBytes.get(`${dbPath}-wal`)
+    )
+    for (const [path, bytes] of sourceBytes) {
+      expect(readFileSync(path).toString('hex')).toBe(bytes)
+    }
+  })
+
+  it('rejects an unexpected version-0 schema without mutating it', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const seeded = new Database(dbPath)
+    seeded.exec('CREATE TABLE unrelated (value TEXT)')
+    seeded.close()
+    const before = readFileSync(dbPath)
+
+    expect(() => openProfileStateDatabase(dbPath, 'profile-a')).toThrowError(
+      expect.objectContaining({ code: 'unreadable' })
+    )
+    expect(readFileSync(dbPath)).toEqual(before)
+  })
+
+  it('rejects an incomplete current schema without mutating it', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const seeded = openProfileStateDatabase(dbPath, 'profile-a')
+    seeded.db.exec('DROP TABLE profile_state_documents')
+    seeded.db.close()
+    const before = readFileSync(dbPath)
+
+    expect(() => openProfileStateDatabase(dbPath, 'profile-a')).toThrowError(
+      expect.objectContaining({ code: 'unreadable' })
+    )
+    expect(readFileSync(dbPath)).toEqual(before)
+  })
+
+  it('rejects current-version tables with incompatible columns without mutating them', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const seeded = new Database(dbPath)
+    seeded.exec(`
+      PRAGMA user_version = ${PROFILE_STATE_DATABASE_SCHEMA_VERSION};
+      CREATE TABLE profile_state_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);
+      CREATE TABLE profile_state_documents (
+        domain TEXT PRIMARY KEY,
+        payload BLOB NOT NULL,
+        revision INTEGER NOT NULL
+      );
+    `)
+    seeded.close()
+    const before = readFileSync(dbPath)
+
+    expect(() => openProfileStateDatabase(dbPath, 'profile-a')).toThrowError(
+      expect.objectContaining({ code: 'unreadable' })
+    )
+    expect(readFileSync(dbPath)).toEqual(before)
+  })
+
+  it('does not create an empty database when the parent directory is absent', () => {
+    const directory = createDirectory()
+    const dbPath = join(directory, 'missing', PROFILE_STATE_DATABASE_FILE_NAME)
+
+    expect(() => openProfileStateDatabase(dbPath, 'profile-a')).toThrowError(
+      expect.objectContaining({ code: 'unreadable' })
+    )
+  })
+
+  it('rejects an empty profile identity before opening SQLite', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+
+    expect(() => openProfileStateDatabase(dbPath, '')).toThrowError(
+      expect.objectContaining({ code: 'invalid-profile-id' })
+    )
+  })
+
+  it('restricts the database and WAL sidecars on POSIX', () => {
+    if (process.platform === 'win32') {
+      return
+    }
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const opened = openProfileStateDatabase(dbPath, 'profile-a')
+    opened.db
+      .prepare('INSERT INTO profile_state_documents VALUES (?, ?, ?, ?, ?, ?)')
+      .run('settings', '{}', 1, 1, Date.now(), 'hash')
+    try {
+      for (const path of [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]) {
+        expect(statSync(path).mode & 0o777).toBe(0o600)
+      }
+    } finally {
+      opened.db.close()
+    }
+  })
+})
+
+describe('profile state database does not reuse orchestration state', () => {
+  it('uses a profile-local filename', () => {
+    const directory = createDirectory()
+    expect(profileStateDatabaseFile(directory)).not.toBe(join(directory, 'orchestration.db'))
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-database.ts b/src/main/persistence/profile-state/profile-state-database.ts
new file mode 100644
index 00000000000..e09c8c87869
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database.ts
@@ -0,0 +1,246 @@
+import { withProfileStateWriteTransaction } from './profile-state-write-transaction'
+import Database, { isSqliteAvailable } from '../../sqlite/sync-database'
+import { migrateAutomationRunsStorage } from './profile-state-automation-runs-migration'
+import { hardenSqliteDatabaseFiles } from '../../sqlite/harden-database-files'
+import {
+  createProfileStateTablesSql,
+  PROFILE_STATE_DATABASE_SCHEMA_VERSION,
+  PROFILE_STATE_META_PROFILE_ID
+} from './profile-state-database-schema'
+import { existsSync, mkdirSync } from 'node:fs'
+import { dirname } from 'node:path'
+import {
+  PROFILE_STATE_DATABASE_FILE_NAME,
+  profileStateDatabaseFile
+} from '../../../shared/profile-state-storage-paths'
+import {
+  ProfileStateDatabaseOpenError,
+  type ProfileStateDatabaseOpenErrorCode
+} from './profile-state-database-errors'
+import {
+  verifyEmptyProfileStateSchema,
+  verifyProfileStateSchema
+} from './profile-state-database-validation'
+
+export const PROFILE_STATE_BUSY_TIMEOUT_MS = 5_000
+
+// Keep relay-only Node 18 imports safe while selecting the actual database driver.
+export const isProfileStateSqliteAvailable = isSqliteAvailable
+
+export { ProfileStateDatabaseOpenError }
+export type { ProfileStateDatabaseOpenErrorCode }
+
+export type OpenProfileStateDatabase = {
+  db: Database.Database
+  readOnly: boolean
+  profileId: string
+}
+
+export { PROFILE_STATE_DATABASE_FILE_NAME, profileStateDatabaseFile }
+
+export function openWritableProfileStateDatabase(
+  databasePath: string,
+  profileId: string
+): OpenProfileStateDatabase {
+  mkdirSync(dirname(databasePath), { recursive: true })
+  const opened = openProfileStateDatabase(databasePath, profileId)
+  if (opened.readOnly) {
+    opened.db.close()
+    throw new ProfileStateDatabaseOpenError(
+      'newer-schema',
+      'This profile requires a newer version of Orca'
+    )
+  }
+  return opened
+}
+
+/**
+ * Open the database belonging to one profile.
+ *
+ * The schema version is read before WAL, busy-timeout, or DDL configuration so
+ * a newer build can leave the database byte-for-byte untouched and read it
+ * without accidentally writing through an unknown schema.
+ */
+export function openProfileStateDatabase(
+  dbPath: string,
+  profileId: string
+): OpenProfileStateDatabase {
+  if (profileId.length === 0) {
+    throw new ProfileStateDatabaseOpenError('invalid-profile-id', 'Profile ID cannot be empty')
+  }
+
+  let probe: Database.Database
+  try {
+    probe = new Database(dbPath)
+  } catch (error) {
+    throw new ProfileStateDatabaseOpenError(
+      'unreadable',
+      `Unable to open profile state database: ${dbPath}`,
+      error
+    )
+  }
+
+  let transferred = false
+  try {
+    const storedVersion = profileStatePragmaNumber(probe, 'user_version')
+    verifyProfileStateIntegrity(probe)
+    if (storedVersion > PROFILE_STATE_DATABASE_SCHEMA_VERSION) {
+      probe.close()
+      transferred = true
+      try {
+        return {
+          db: new Database(dbPath, {
+            readonly: true,
+            fileMustExist: true,
+            timeout: PROFILE_STATE_BUSY_TIMEOUT_MS
+          }),
+          readOnly: true,
+          profileId
+        }
+      } catch (error) {
+        throw new ProfileStateDatabaseOpenError(
+          'unreadable',
+          `Unable to open future profile state database read-only: ${dbPath}`,
+          error
+        )
+      }
+    }
+
+    if (storedVersion > 0) {
+      // Validate the complete current shape before WAL setup. A structurally
+      // valid but incomplete database should fail without changing its header.
+      verifyProfileStateSchema(probe, profileId, storedVersion)
+    } else if (storedVersion === 0) {
+      verifyEmptyProfileStateSchema(probe)
+    } else {
+      throw new Error(`Unsupported profile state database schema: ${storedVersion}`)
+    }
+
+    // The journal-mode pragma can update the SQLite header even when no state
+    // row is written, so all known-shape validation happens before this point.
+    migrateProfileStateSchema(probe, storedVersion, profileId)
+    configureProfileStatePragmas(probe)
+    hardenSqliteDatabaseFiles(dbPath)
+    transferred = true
+    return { db: probe, readOnly: false, profileId }
+  } catch (error) {
+    if (error instanceof ProfileStateDatabaseOpenError) {
+      throw error
+    }
+    throw new ProfileStateDatabaseOpenError(
+      'unreadable',
+      `Unable to initialize profile state database: ${dbPath}`,
+      error
+    )
+  } finally {
+    if (!transferred) {
+      probe.close()
+    }
+  }
+}
+
+/**
+ * Open an existing profile database without applying migrations or changing
+ * its journal mode. Callers use this for best-effort reads during GC, where a
+ * present database is authoritative and any failure must fail closed.
+ */
+export function openProfileStateDatabaseReadOnly(
+  dbPath: string,
+  profileId: string
+): OpenProfileStateDatabase {
+  if (profileId.length === 0) {
+    throw new ProfileStateDatabaseOpenError('invalid-profile-id', 'Profile ID cannot be empty')
+  }
+  if (!existsSync(dbPath)) {
+    throw new ProfileStateDatabaseOpenError(
+      'unreadable',
+      `Profile state database does not exist: ${dbPath}`
+    )
+  }
+
+  let db: Database.Database
+  try {
+    db = new Database(dbPath, {
+      readonly: true,
+      fileMustExist: true,
+      timeout: PROFILE_STATE_BUSY_TIMEOUT_MS
+    })
+  } catch (error) {
+    throw new ProfileStateDatabaseOpenError(
+      'unreadable',
+      `Unable to open profile state database read-only: ${dbPath}`,
+      error
+    )
+  }
+
+  try {
+    const storedVersion = profileStatePragmaNumber(db, 'user_version')
+    verifyProfileStateIntegrity(db)
+    if (storedVersion > PROFILE_STATE_DATABASE_SCHEMA_VERSION) {
+      throw new ProfileStateDatabaseOpenError(
+        'newer-schema',
+        `Profile state database schema is newer than this runtime: ${storedVersion}`
+      )
+    }
+    if (storedVersion !== PROFILE_STATE_DATABASE_SCHEMA_VERSION) {
+      throw new Error(`Unsupported profile state database schema: ${storedVersion}`)
+    }
+    verifyProfileStateSchema(db, profileId)
+    return { db, readOnly: true, profileId }
+  } catch (error) {
+    db.close()
+    if (error instanceof ProfileStateDatabaseOpenError) {
+      throw error
+    }
+    throw new ProfileStateDatabaseOpenError(
+      'unreadable',
+      `Unable to read profile state database: ${dbPath}`,
+      error
+    )
+  }
+}
+
+export function profileStatePragmaNumber(db: Database.Database, name: string): number {
+  return Number(db.pragma(name, { simple: true }) ?? 0)
+}
+
+function verifyProfileStateIntegrity(db: Database.Database): void {
+  const result = db.pragma('quick_check', { simple: true })
+  if (result !== 'ok') {
+    throw new Error(`Profile state database integrity check failed: ${String(result)}`)
+  }
+}
+
+function configureProfileStatePragmas(db: Database.Database): void {
+  const journalMode = db.pragma('journal_mode = WAL', { simple: true })
+  if (typeof journalMode !== 'string' || journalMode.toLowerCase() !== 'wal') {
+    throw new Error(`Profile state database does not support WAL (mode: ${String(journalMode)})`)
+  }
+  db.pragma(`busy_timeout = ${PROFILE_STATE_BUSY_TIMEOUT_MS}`)
+  db.pragma('foreign_keys = ON')
+  // Profile commits are user-visible state. Keep the same power-loss contract
+  // as the current temp-file + fsync writer rather than the orchestration DB's
+  // cache-oriented NORMAL setting.
+  db.pragma('synchronous = FULL')
+}
+
+function migrateProfileStateSchema(
+  db: Database.Database,
+  storedVersion: number,
+  profileId: string
+): void {
+  if (storedVersion >= PROFILE_STATE_DATABASE_SCHEMA_VERSION) {
+    return
+  }
+
+  return withProfileStateWriteTransaction(db, () => {
+    db.exec(createProfileStateTablesSql())
+    db.prepare('INSERT OR IGNORE INTO profile_state_meta (key, value) VALUES (?, ?)').run(
+      PROFILE_STATE_META_PROFILE_ID,
+      profileId
+    )
+    migrateAutomationRunsStorage(db, storedVersion)
+    verifyProfileStateSchema(db, profileId)
+    db.pragma(`user_version = ${PROFILE_STATE_DATABASE_SCHEMA_VERSION}`)
+  })
+}
diff --git a/src/main/persistence/profile-state/profile-state-document-reader.ts b/src/main/persistence/profile-state/profile-state-document-reader.ts
new file mode 100644
index 00000000000..075e4f6dc06
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-document-reader.ts
@@ -0,0 +1,99 @@
+import type Database from '../../sqlite/sync-database'
+import { readProfileStateAutomationRunsDocument } from './profile-state-automation-runs'
+import {
+  assertProfileStateDocumentRevision,
+  readProfileStateRevision
+} from './profile-state-revision'
+import {
+  ProfileStateDocumentCorruptionError,
+  validateProfileStateDocumentRow,
+  type ProfileStateDocument,
+  type ProfileStateParsedDocument,
+  type ProfileStateValidatedDocument
+} from './profile-state-document-validation'
+
+export type ReadProfileStateDocumentsOptions = {
+  /** The profile revision already read by a surrounding snapshot. */
+  profileRevision?: number
+}
+
+/** Read the authoritative rows after checking their hash, shape, and JSON payload. */
+export function readProfileStateDocuments(
+  db: Database.Database,
+  options: ReadProfileStateDocumentsOptions & { representation: 'parsed' }
+): readonly ProfileStateParsedDocument[]
+export function readProfileStateDocuments(
+  db: Database.Database,
+  options?: ReadProfileStateDocumentsOptions
+): readonly ProfileStateDocument[]
+export function readProfileStateDocuments(
+  db: Database.Database,
+  options: ReadProfileStateDocumentsOptions & { representation: 'validated' }
+): void
+export function readProfileStateDocuments(
+  db: Database.Database,
+  options: ReadProfileStateDocumentsOptions & { representation?: 'parsed' | 'validated' } = {}
+):
+  | readonly (ProfileStateDocument | ProfileStateParsedDocument | ProfileStateValidatedDocument)[]
+  | void {
+  const profileRevision = options.profileRevision ?? readProfileStateRevision(db)
+  const normalized =
+    options.representation === 'validated'
+      ? readProfileStateAutomationRunsDocument(db, profileRevision, 'validated')
+      : options.representation === 'parsed'
+        ? readProfileStateAutomationRunsDocument(db, profileRevision, 'parsed')
+        : readProfileStateAutomationRunsDocument(db, profileRevision)
+  const rows = db
+    .prepare(
+      `SELECT domain, payload, domain_version, revision, updated_at, content_hash
+       FROM profile_state_documents ORDER BY rowid`
+    )
+    .iterate()
+  const documents: (
+    | ProfileStateDocument
+    | ProfileStateParsedDocument
+    | ProfileStateValidatedDocument
+  )[] = []
+  for (const row of rows) {
+    const document = validateProfileStateDocumentRow(row, {
+      retainParsedValue: options.representation === 'parsed'
+    })
+    assertProfileStateDocumentRevision(document.revision, profileRevision, document.domain)
+    if (
+      normalized !== undefined &&
+      document.domain === 'automationRuns' &&
+      document.payload !== 'null'
+    ) {
+      throw new ProfileStateDocumentCorruptionError(
+        'Normalized automationRuns placeholder is invalid',
+        document.domain
+      )
+    }
+    if (options.representation === 'validated') {
+      continue
+    }
+    if (options.representation === 'parsed') {
+      const { payload: _payload, ...parsedDocument } = document
+      documents.push({ ...parsedDocument, value: document.value })
+    } else {
+      documents.push(document)
+    }
+  }
+  if (options.representation === 'validated') {
+    return
+  }
+  if (normalized === undefined) {
+    return documents
+  }
+  const withoutAutomationRuns = documents.filter((document) => document.domain !== 'automationRuns')
+  if (normalized === null) {
+    return withoutAutomationRuns
+  }
+  const originalIndex = documents.findIndex((document) => document.domain === 'automationRuns')
+  withoutAutomationRuns.splice(
+    originalIndex === -1 ? withoutAutomationRuns.length : originalIndex,
+    0,
+    normalized
+  )
+  return withoutAutomationRuns
+}
diff --git a/src/main/persistence/profile-state/profile-state-document-validation.ts b/src/main/persistence/profile-state/profile-state-document-validation.ts
new file mode 100644
index 00000000000..52638353921
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-document-validation.ts
@@ -0,0 +1,117 @@
+import { createHash } from 'node:crypto'
+
+export type ProfileStateDocument = {
+  domain: string
+  payload: string
+  domainVersion: number
+  revision: number
+  updatedAt: number
+  contentHash: string
+}
+
+export type ProfileStateValidatedDocument = Omit<ProfileStateDocument, 'payload'>
+export type ProfileStateParsedDocument = ProfileStateValidatedDocument & { value: unknown }
+
+export class ProfileStateDocumentCorruptionError extends Error {
+  readonly code = 'corrupt-document' as const
+  readonly domain: string | null
+
+  constructor(message: string, domain: string | null = null) {
+    super(message)
+    this.name = 'ProfileStateDocumentCorruptionError'
+    this.domain = domain
+  }
+}
+
+export class ProfileStateRevisionConflictError extends Error {
+  readonly code = 'profile-state-revision-conflict' as const
+  readonly expectedRevision: number
+  readonly actualRevision: number
+
+  constructor(expectedRevision: number, actualRevision: number) {
+    super(
+      `Profile state revision changed while importing a document (expected ${expectedRevision}, found ${actualRevision})`
+    )
+    this.name = 'ProfileStateRevisionConflictError'
+    this.expectedRevision = expectedRevision
+    this.actualRevision = actualRevision
+  }
+}
+
+export function hashProfileStatePayload(payload: string): string {
+  return createHash('sha256').update(payload, 'utf8').digest('hex')
+}
+
+export function parseProfileStateRoot(rawJson: string): Record<string, unknown> {
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(rawJson)
+  } catch {
+    throw new ProfileStateDocumentCorruptionError('Profile state JSON is invalid', null)
+  }
+  if (!isRecord(parsed)) {
+    throw new ProfileStateDocumentCorruptionError('Profile state JSON root must be an object', null)
+  }
+  return parsed
+}
+
+export function validateProfileStateDocumentRow(
+  row: unknown,
+  options: { validateJson?: boolean; retainParsedValue?: boolean } = {}
+): ProfileStateDocument & { value?: unknown } {
+  if (
+    !isRecord(row) ||
+    typeof row.domain !== 'string' ||
+    typeof row.payload !== 'string' ||
+    typeof row.domain_version !== 'number' ||
+    typeof row.revision !== 'number' ||
+    typeof row.updated_at !== 'number' ||
+    typeof row.content_hash !== 'string'
+  ) {
+    throw new ProfileStateDocumentCorruptionError('Profile state document row has invalid fields')
+  }
+  if (
+    !Number.isSafeInteger(row.domain_version) ||
+    row.domain_version < 1 ||
+    !Number.isSafeInteger(row.revision) ||
+    row.revision < 1 ||
+    !Number.isSafeInteger(row.updated_at) ||
+    row.updated_at < 0 ||
+    !/^[a-f0-9]{64}$/.test(row.content_hash)
+  ) {
+    throw new ProfileStateDocumentCorruptionError(
+      `Profile state document row metadata is invalid: ${row.domain}`,
+      row.domain
+    )
+  }
+  if (hashProfileStatePayload(row.payload) !== row.content_hash) {
+    throw new ProfileStateDocumentCorruptionError(
+      `Profile state document hash mismatch: ${row.domain}`,
+      row.domain
+    )
+  }
+  let value: unknown
+  if (options.retainParsedValue || (options.validateJson ?? true)) {
+    try {
+      value = JSON.parse(row.payload)
+    } catch {
+      throw new ProfileStateDocumentCorruptionError(
+        `Profile state document payload is invalid JSON: ${row.domain}`,
+        row.domain
+      )
+    }
+  }
+  return {
+    domain: row.domain,
+    payload: row.payload,
+    domainVersion: row.domain_version,
+    revision: row.revision,
+    updatedAt: row.updated_at,
+    contentHash: row.content_hash,
+    ...(options.retainParsedValue ? { value } : {})
+  }
+}
+
+export function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
diff --git a/src/main/persistence/profile-state/profile-state-documents.test.ts b/src/main/persistence/profile-state/profile-state-documents.test.ts
new file mode 100644
index 00000000000..1afdae3d60c
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-documents.test.ts
@@ -0,0 +1,370 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  buildProfileStateCutoverFixture,
+  canonicalProfileStateJson
+} from '../profile-state-cutover-fixture'
+import {
+  exportProfileStateJson,
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateJsonAcceptance,
+  readProfileStateDocuments,
+  readProfileStateRevision,
+  readProfileStateSnapshot,
+  readProfileStateParsedSnapshot
+} from './profile-state-documents'
+import { openProfileStateDatabase, profileStateDatabaseFile } from './profile-state-database'
+import { readProfileStateDomains } from './profile-state-domain-reader'
+import { writeProfileStateDomain } from './profile-state-domain-writes'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function openTestDatabase(): {
+  directory: string
+  db: ReturnType<typeof openProfileStateDatabase>['db']
+} {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-documents-'))
+  temporaryDirectories.push(directory)
+  return {
+    directory,
+    db: openProfileStateDatabase(profileStateDatabaseFile(directory), 'profile-a').db
+  }
+}
+
+describe('profile state document adapter', () => {
+  it('round-trips every top-level domain, including unknown keys, nulls, arrays, and sealed bytes', () => {
+    const { db } = openTestDatabase()
+    try {
+      const fixture = buildProfileStateCutoverFixture()
+      const raw = JSON.stringify(fixture)
+      expect(importProfileStateJson(db, raw, { now: () => 123 })).toBe(1)
+      const exported = exportProfileStateJson(db)
+
+      expect(canonicalProfileStateJson(JSON.parse(exported))).toBe(
+        canonicalProfileStateJson(fixture)
+      )
+      expect(JSON.parse(exported).settings.opencodeSessionCookie).toBe(
+        fixture.settings.opencodeSessionCookie
+      )
+      expect(readProfileStateRevision(db)).toBe(1)
+      expect(readProfileStateDocuments(db)).toHaveLength(Object.keys(fixture).length)
+      expect(readProfileStateDocuments(db).find((row) => row.domain === 'settings')).toMatchObject({
+        revision: 1,
+        updatedAt: 123
+      })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('preserves missing domains versus explicit null values and array order', () => {
+    const { db } = openTestDatabase()
+    try {
+      importProfileStateJson(
+        db,
+        JSON.stringify({
+          explicitNull: null,
+          ordered: ['first', 'second'],
+          unknown: { keep: true }
+        })
+      )
+      const exported = JSON.parse(exportProfileStateJson(db))
+      expect(exported).toEqual({
+        explicitNull: null,
+        ordered: ['first', 'second'],
+        unknown: { keep: true }
+      })
+      expect(Object.hasOwn(exported, 'missing')).toBe(false)
+    } finally {
+      db.close()
+    }
+  })
+
+  it('advances revision and replaces the complete document set atomically', () => {
+    const { db } = openTestDatabase()
+    try {
+      expect(importProfileStateJson(db, JSON.stringify({ first: 1, old: 2 }))).toBe(1)
+      expect(importProfileStateJson(db, JSON.stringify({ second: 3 }), { now: () => 456 })).toBe(2)
+      expect(exportProfileStateJson(db)).toBe(JSON.stringify({ second: 3 }))
+      expect(readProfileStateRevision(db)).toBe(2)
+      expect(readProfileStateDocuments(db)[0]).toMatchObject({
+        domain: 'second',
+        revision: 2,
+        updatedAt: 456
+      })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rejects a stale complete-document replacement before deleting rows', () => {
+    const { db } = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ keep: true }))
+      expect(() =>
+        importProfileStateJson(db, JSON.stringify({ replacement: true }), {
+          expectedRevision: 0
+        })
+      ).toThrowError(
+        expect.objectContaining({
+          code: 'profile-state-revision-conflict',
+          expectedRevision: 0,
+          actualRevision: 1
+        })
+      )
+      expect(exportProfileStateJson(db)).toBe(JSON.stringify({ keep: true }))
+      expect(readProfileStateRevision(db)).toBe(1)
+    } finally {
+      db.close()
+    }
+  })
+
+  it('commits the legacy JSON acceptance marker with the imported revision', () => {
+    const { db } = openTestDatabase()
+    try {
+      const raw = JSON.stringify({ settings: { theme: 'dark' } })
+      expect(
+        importProfileStateJson(db, raw, {
+          acceptedLegacyJsonHash: hashProfileStateJson(raw),
+          now: () => 123
+        })
+      ).toBe(1)
+      expect(readProfileStateJsonAcceptance(db)).toEqual({
+        jsonHash: hashProfileStateJson(raw),
+        acceptedRevision: 1
+      })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rolls back every row and the revision when one insert fails', () => {
+    const { db } = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ keep: { value: 1 } }), { now: () => 10 })
+      db.exec(
+        `CREATE TRIGGER fail_profile_state_insert
+         BEFORE INSERT ON profile_state_documents
+         WHEN NEW.domain = 'second'
+         BEGIN SELECT RAISE(ABORT, 'injected document failure'); END`
+      )
+
+      expect(() => importProfileStateJson(db, JSON.stringify({ first: 1, second: 2 }))).toThrow(
+        'injected document failure'
+      )
+      db.exec('DROP TRIGGER fail_profile_state_insert')
+      expect(exportProfileStateJson(db)).toBe(JSON.stringify({ keep: { value: 1 } }))
+      expect(readProfileStateRevision(db)).toBe(1)
+    } finally {
+      db.close()
+    }
+  })
+
+  it('does not roll back a transaction owned by the caller', () => {
+    const { db } = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ keep: true }))
+      db.exec('BEGIN IMMEDIATE')
+
+      expect(() => importProfileStateJson(db, JSON.stringify({ replacement: true }))).toThrow(
+        'requires an idle database connection'
+      )
+      expect(db.isTransaction).toBe(true)
+      db.exec('ROLLBACK')
+      expect(exportProfileStateJson(db)).toBe(JSON.stringify({ keep: true }))
+    } finally {
+      if (db.isTransaction) {
+        db.exec('ROLLBACK')
+      }
+      db.close()
+    }
+  })
+
+  it('rejects a tampered payload when its hash no longer matches', () => {
+    const { db } = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ ui: { active: 'terminal' } }))
+      db.prepare('UPDATE profile_state_documents SET payload = ? WHERE domain = ?').run(
+        JSON.stringify({ active: 'tasks' }),
+        'ui'
+      )
+
+      expect(() => readProfileStateDocuments(db)).toThrowError(
+        expect.objectContaining({ domain: 'ui' })
+      )
+      expect(() => exportProfileStateJson(db)).toThrowError(/hash mismatch: ui/)
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rejects invalid domain JSON even when its hash is correct', () => {
+    const { db } = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ settings: { theme: 'dark' } }))
+      db.prepare(
+        'UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = ?'
+      ).run('{invalid', hashProfileStateJson('{invalid'), 'settings')
+
+      expect(() => readProfileStateDocuments(db)).toThrow(/invalid JSON: settings/)
+      expect(() => readProfileStateSnapshot(db)).toThrow(/invalid JSON: settings/)
+      expect(() => readProfileStateParsedSnapshot(db)).toThrow(/invalid JSON: settings/)
+    } finally {
+      db.close()
+    }
+  })
+
+  it.each(['[]', ' null '])(
+    'rejects the noncanonical normalized history placeholder %s',
+    (payload) => {
+      const { db } = openTestDatabase()
+      try {
+        const original = {
+          settings: { theme: 'dark' },
+          automationRuns: [{ id: 'run-1', status: 'pending' }],
+          ui: { sidebarWidth: 280 }
+        }
+        importProfileStateJson(db, JSON.stringify(original))
+        expect(
+          db
+            .prepare('SELECT payload FROM profile_state_documents WHERE domain = ?')
+            .get('automationRuns')
+        ).toEqual({ payload: 'null' })
+        expect(readProfileStateSnapshot(db).json).toBe(JSON.stringify(original))
+        db.prepare(
+          'UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = ?'
+        ).run(payload, hashProfileStateJson(payload), 'automationRuns')
+        expect(() => readProfileStateSnapshot(db)).toThrow(/placeholder is invalid/)
+        expect(() => readProfileStateParsedSnapshot(db)).toThrow(/placeholder is invalid/)
+      } finally {
+        db.close()
+      }
+    }
+  )
+
+  it('rejects a retained legacy document whose revision is ahead of the profile', () => {
+    const { db } = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ automationRuns: [{ id: 'run-1' }] }))
+      db.prepare('UPDATE profile_state_documents SET revision = ? WHERE domain = ?').run(
+        999,
+        'automationRuns'
+      )
+
+      expect(() => readProfileStateDocuments(db)).toThrow(
+        /document revision 999 exceeds profile revision 1/
+      )
+      expect(() => readProfileStateParsedSnapshot(db)).toThrow(
+        /document revision 999 exceeds profile revision 1/
+      )
+    } finally {
+      db.close()
+    }
+  })
+
+  it.each(['null', 'absent'] as const)(
+    'rejects normalized %s metadata whose revision is ahead of the profile',
+    (presence) => {
+      const { directory, db } = openTestDatabase()
+      try {
+        importProfileStateJson(db, JSON.stringify({ automationRuns: [{ id: 'run-1' }] }))
+        writeProfileStateDomain(db, {
+          domain: 'automationRuns',
+          payload: presence === 'null' ? 'null' : null,
+          expectedRevision: 1
+        })
+        expect(db.prepare('SELECT presence FROM profile_state_automation_runs_meta').get()).toEqual(
+          {
+            presence
+          }
+        )
+        db.prepare('UPDATE profile_state_automation_runs_meta SET revision = ?').run(999)
+
+        expect(() => readProfileStateSnapshot(db)).toThrow(
+          /document revision 999 exceeds profile revision 2/
+        )
+        expect(() => readProfileStateParsedSnapshot(db)).toThrow(
+          /document revision 999 exceeds profile revision 2/
+        )
+        expect(
+          readProfileStateDomains(profileStateDatabaseFile(directory), 'profile-a', [
+            'automationRuns'
+          ])
+        ).toMatchObject({
+          kind: 'unreadable'
+        })
+      } finally {
+        db.close()
+      }
+    }
+  )
+
+  it.each(['missing', 'absent', 'null'] as const)(
+    'rejects %s automation metadata with remaining normalized runs on every read path',
+    (presence) => {
+      const { directory, db } = openTestDatabase()
+      try {
+        importProfileStateJson(
+          db,
+          JSON.stringify({ automationRuns: [{ id: 'run-1', status: 'pending' }] })
+        )
+        writeProfileStateDomain(db, {
+          domain: 'automationRuns',
+          payload: JSON.stringify([{ id: 'run-1', status: 'completed' }]),
+          expectedRevision: 1
+        })
+        expect(JSON.parse(readProfileStateSnapshot(db).json)).toEqual({
+          automationRuns: [{ id: 'run-1', status: 'completed' }]
+        })
+        if (presence === 'missing') {
+          db.exec('DELETE FROM profile_state_automation_runs_meta')
+        } else {
+          db.prepare(
+            'UPDATE profile_state_automation_runs_meta SET presence = ?, content_hash = ?'
+          ).run(presence, presence === 'absent' ? '' : hashProfileStateJson('null'))
+        }
+
+        const expectedError =
+          presence === 'missing'
+            ? 'Normalized automationRuns metadata is malformed'
+            : 'Normalized automationRuns rows exist for an empty domain'
+        expect(() => readProfileStateSnapshot(db)).toThrow(expectedError)
+        expect(() => readProfileStateParsedSnapshot(db)).toThrow(expectedError)
+        const databasePath = profileStateDatabaseFile(directory)
+        const authority = new ProfileStateSqliteAuthority(databasePath, 'profile-a')
+        expect(() => authority.readSerializedState()).toThrow(
+          presence === 'missing' ? /Unable to read profile state database/ : expectedError
+        )
+        expect(
+          readProfileStateDomains(databasePath, 'profile-a', ['automationRuns'])
+        ).toMatchObject({
+          kind: 'unreadable'
+        })
+      } finally {
+        db.close()
+      }
+    }
+  )
+
+  it('rejects malformed input without changing an existing revision', () => {
+    const { db } = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ keep: true }))
+      expect(() => importProfileStateJson(db, '{invalid')).toThrow('Profile state JSON is invalid')
+      expect(exportProfileStateJson(db)).toBe(JSON.stringify({ keep: true }))
+      expect(readProfileStateRevision(db)).toBe(1)
+    } finally {
+      db.close()
+    }
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-documents.ts b/src/main/persistence/profile-state/profile-state-documents.ts
new file mode 100644
index 00000000000..59e700cfab9
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-documents.ts
@@ -0,0 +1,232 @@
+import { withProfileStateWriteTransaction } from './profile-state-write-transaction'
+import { withProfileStateReadSnapshot } from './profile-state-read-snapshot'
+import type Database from '../../sqlite/sync-database'
+import { readCurrentAutomationRunsState } from './profile-state-automation-runs-storage'
+import {
+  PROFILE_STATE_META_LEGACY_JSON_ACCEPTANCE,
+  PROFILE_STATE_DOCUMENT_VERSION,
+  PROFILE_STATE_META_REVISION
+} from './profile-state-database-schema'
+import {
+  hashProfileStatePayload,
+  parseProfileStateRoot,
+  ProfileStateDocumentCorruptionError,
+  ProfileStateRevisionConflictError,
+  type ProfileStateDocument
+} from './profile-state-document-validation'
+import {
+  clearProfileStateAutomationRuns,
+  rebuildProfileStateAutomationRunsProjection
+} from './profile-state-automation-runs'
+
+import { readProfileStateDocuments } from './profile-state-document-reader'
+
+import { readProfileStateRevision } from './profile-state-revision'
+import { readProfileStateJsonAcceptance } from './legacy-json/profile-state-json-acceptance'
+
+export {
+  acceptProfileStateJsonCompatibility,
+  readProfileStateJsonAcceptance,
+  stageProfileStateJsonCompatibility,
+  type ProfileStateJsonAcceptance
+} from './legacy-json/profile-state-json-acceptance'
+
+export { readProfileStateRevision } from './profile-state-revision'
+export { readProfileStateDocuments } from './profile-state-document-reader'
+export type { ReadProfileStateDocumentsOptions } from './profile-state-document-reader'
+export { ProfileStateDocumentCorruptionError, ProfileStateRevisionConflictError }
+export type { ProfileStateDocument } from './profile-state-document-validation'
+
+export type ImportProfileStateOptions = {
+  now?: () => number
+  /** Hash of the exact legacy JSON bytes accepted by this import. */
+  acceptedLegacyJsonHash?: string
+  /** Revision observed by the caller before constructing this replacement. */
+  expectedRevision?: number
+}
+
+export type ProfileStateSnapshot = {
+  revision: number
+  documents: readonly ProfileStateDocument[]
+  json: string
+}
+
+export type ProfileStateParsedSnapshot = {
+  revision: number
+  state: Record<string, unknown>
+}
+
+/** Import a complete JSON document set atomically into one profile database. */
+export function importProfileStateJson(
+  db: Database.Database,
+  rawJson: string,
+  options: ImportProfileStateOptions = {}
+): number {
+  const parsed = parseProfileStateRoot(rawJson)
+  const entries = Object.entries(parsed).map(([domain, value]) => {
+    const payload = JSON.stringify(value)
+    if (payload === undefined) {
+      throw new ProfileStateDocumentCorruptionError(
+        `Profile state domain cannot be serialized: ${domain}`,
+        domain
+      )
+    }
+    return { domain, payload }
+  })
+
+  const now = options.now ?? Date.now
+  if (
+    options.acceptedLegacyJsonHash !== undefined &&
+    !/^[a-f0-9]{64}$/.test(options.acceptedLegacyJsonHash)
+  ) {
+    throw new ProfileStateDocumentCorruptionError('Legacy JSON acceptance hash is invalid')
+  }
+  if (
+    options.expectedRevision !== undefined &&
+    (!Number.isSafeInteger(options.expectedRevision) || options.expectedRevision < 0)
+  ) {
+    throw new ProfileStateDocumentCorruptionError('Expected profile state revision is invalid')
+  }
+  const updatedAt = now()
+  if (!Number.isSafeInteger(updatedAt) || updatedAt < 0) {
+    throw new ProfileStateDocumentCorruptionError('Profile state update timestamp is invalid')
+  }
+  return withProfileStateWriteTransaction(db, () => {
+    const actualRevision = readProfileStateRevision(db)
+    if (options.expectedRevision !== undefined && actualRevision !== options.expectedRevision) {
+      throw new ProfileStateRevisionConflictError(options.expectedRevision, actualRevision)
+    }
+    readCurrentAutomationRunsState(db, actualRevision)
+    const revision = actualRevision + 1
+    clearProfileStateAutomationRuns(db)
+    db.exec('DELETE FROM profile_state_documents')
+    const automationRuns = entries.find((entry) => entry.domain === 'automationRuns')
+    const normalizedRuns =
+      automationRuns !== undefined &&
+      rebuildProfileStateAutomationRunsProjection(
+        db,
+        automationRuns.payload,
+        PROFILE_STATE_DOCUMENT_VERSION,
+        updatedAt,
+        revision
+      )
+    const insert = db.prepare(
+      `INSERT INTO profile_state_documents
+       (domain, payload, domain_version, revision, updated_at, content_hash)
+       VALUES (?, ?, ?, ?, ?, ?)`
+    )
+    for (const entry of entries) {
+      const payload = normalizedRuns && entry.domain === 'automationRuns' ? 'null' : entry.payload
+      insert.run(
+        entry.domain,
+        payload,
+        PROFILE_STATE_DOCUMENT_VERSION,
+        revision,
+        updatedAt,
+        hashProfileStatePayload(payload)
+      )
+    }
+    db.prepare(
+      `INSERT INTO profile_state_meta (key, value) VALUES (?, ?)
+       ON CONFLICT(key) DO UPDATE SET value = excluded.value`
+    ).run(PROFILE_STATE_META_REVISION, String(revision))
+    if (options.acceptedLegacyJsonHash !== undefined) {
+      db.prepare(
+        `INSERT INTO profile_state_meta (key, value) VALUES (?, ?)
+         ON CONFLICT(key) DO UPDATE SET value = excluded.value`
+      ).run(
+        PROFILE_STATE_META_LEGACY_JSON_ACCEPTANCE,
+        JSON.stringify({ jsonHash: options.acceptedLegacyJsonHash, acceptedRevision: revision })
+      )
+    }
+    return revision
+  })
+}
+
+export function hashProfileStateJson(rawJson: string): string {
+  return hashProfileStatePayload(rawJson)
+}
+
+/** Validate that retained legacy JSON is the exact export accepted by this database. */
+export function profileStateJsonMatchesAcceptance(db: Database.Database, rawJson: string): boolean {
+  return readAcceptedProfileStateSnapshot(db, rawJson) !== undefined
+}
+
+/** Validate the retained JSON and return the same database snapshot used for acceptance. */
+export function readAcceptedProfileStateSnapshot(
+  db: Database.Database,
+  rawJson: string
+): ProfileStateSnapshot | undefined {
+  return readAcceptedSnapshot(db, rawJson, () => readProfileStateSnapshot(db))
+}
+
+export function readAcceptedProfileStateParsedSnapshot(
+  db: Database.Database,
+  rawJson: string
+): ProfileStateParsedSnapshot | undefined {
+  return readAcceptedSnapshot(db, rawJson, () => readProfileStateParsedSnapshot(db))
+}
+
+function readAcceptedSnapshot<T extends { revision: number }>(
+  db: Database.Database,
+  rawJson: string,
+  read: () => T
+): T | undefined {
+  return withProfileStateReadSnapshot(db, () => {
+    const marker = readProfileStateJsonAcceptance(db)
+    const snapshot = read()
+    const jsonHash = hashProfileStateJson(rawJson)
+    return marker !== undefined &&
+      (marker.jsonHash === jsonHash || marker.pending?.jsonHash === jsonHash) &&
+      snapshot.revision >= (marker.pending?.acceptedRevision ?? marker.acceptedRevision)
+      ? snapshot
+      : undefined
+  })
+}
+
+/** Transfer independently validated values without constructing another whole-profile string. */
+export function readProfileStateParsedSnapshot(db: Database.Database): ProfileStateParsedSnapshot {
+  return withProfileStateReadSnapshot(db, () => {
+    const revision = readProfileStateRevision(db)
+    const documents = readProfileStateDocuments(db, {
+      profileRevision: revision,
+      representation: 'parsed'
+    })
+    return {
+      revision,
+      state: Object.fromEntries(documents.map((document) => [document.domain, document.value]))
+    }
+  })
+}
+
+/** Export the row set as JSON accepted by the current loader. */
+export function exportProfileStateJson(db: Database.Database): string {
+  return readProfileStateSnapshot(db).json
+}
+
+/** Read revision, rows, and their JSON projection under one SQLite snapshot. */
+export function readProfileStateSnapshot(db: Database.Database): ProfileStateSnapshot {
+  return withProfileStateReadSnapshot(db, () => {
+    const revision = readProfileStateRevision(db)
+    const documents = readProfileStateDocuments(db, { profileRevision: revision })
+    return {
+      revision,
+      documents,
+      // Every payload was already hash- and JSON-validated above. Reusing the
+      // validated fragments avoids parsing and stringifying the full profile a
+      // second time before Store parses it at its domain boundary.
+      json: `{${documents
+        .map((document) => `${JSON.stringify(document.domain)}:${document.payload}`)
+        .join(',')}}`
+    }
+  })
+}
+
+/** Validate the complete snapshot without retaining state that recovery callers discard. */
+export function validateProfileStateSnapshot(db: Database.Database): number {
+  return withProfileStateReadSnapshot(db, () => {
+    const revision = readProfileStateRevision(db)
+    readProfileStateDocuments(db, { profileRevision: revision, representation: 'validated' })
+    return revision
+  })
+}
diff --git a/src/main/persistence/profile-state/profile-state-domain-equality.test.ts b/src/main/persistence/profile-state/profile-state-domain-equality.test.ts
new file mode 100644
index 00000000000..df9dfe3efb9
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-domain-equality.test.ts
@@ -0,0 +1,144 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { openProfileStateDatabase } from './profile-state-database'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateRevision,
+  readProfileStateSnapshot
+} from './profile-state-documents'
+import { writeProfileStateDomains } from './profile-state-domain-writes'
+
+const databases: { db: ReturnType<typeof openProfileStateDatabase>['db']; directory: string }[] = []
+
+function fixture(value: unknown = { future: { content: '雪 🐋', nullable: null } }) {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-domain-equality-'))
+  const { db } = openProfileStateDatabase(join(directory, 'state.db'), 'profile')
+  importProfileStateJson(db, JSON.stringify({ settings: {}, extension: value }))
+  databases.push({ db, directory })
+  return { db, payload: JSON.stringify(value) }
+}
+
+afterEach(() => {
+  for (const { db, directory } of databases.splice(0)) {
+    db.close()
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+describe('validated domain replacement equality', () => {
+  it.each([{ nested: { content: '雪 🐋', nullable: null } }, null])(
+    'preserves equal payload, revision and timestamp for %j',
+    (value) => {
+      const { db, payload } = fixture(value)
+      const before = readProfileStateSnapshot(db)
+      const rows = db.prepare('SELECT * FROM profile_state_documents').all()
+
+      expect(
+        writeProfileStateDomains(db, {
+          expectedRevision: 1,
+          replacements: [
+            {
+              domain: 'extension',
+              payload,
+              now: () => {
+                throw new Error('An unchanged replacement must not request a timestamp')
+              }
+            }
+          ]
+        })
+      ).toEqual({ changed: false, revision: 1, changedDomains: [] })
+      expect(readProfileStateSnapshot(db)).toEqual(before)
+      expect(db.prepare('SELECT * FROM profile_state_documents').all()).toEqual(rows)
+
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [{ domain: 'extension', payload: null }]
+      })
+      expect(JSON.parse(readProfileStateSnapshot(db).json)).toEqual({ settings: {} })
+    }
+  )
+
+  it.each([
+    ["content_hash = 'invalid'", /metadata is invalid/],
+    [`content_hash = '${'a'.repeat(64)}'`, /hash mismatch/],
+    ['domain_version = 0', /metadata is invalid/],
+    ['updated_at = -1', /metadata is invalid/],
+    ['revision = 0', /metadata is invalid/],
+    ['revision = 2', /exceeds profile revision/]
+  ] as const)('rejects equal payload with corrupt %s', (assignment, error) => {
+    const { db, payload } = fixture()
+    db.exec(`UPDATE profile_state_documents SET ${assignment} WHERE domain = 'extension'`)
+    const before = db.prepare('SELECT * FROM profile_state_documents').all()
+
+    expect(() =>
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [
+          { domain: 'settings', payload: '{"changed":true}' },
+          { domain: 'extension', payload }
+        ]
+      })
+    ).toThrow(error)
+    expect(readProfileStateRevision(db)).toBe(1)
+    expect(db.isTransaction).toBe(false)
+    expect(db.prepare('SELECT * FROM profile_state_documents').all()).toEqual(before)
+  })
+
+  it.each(['{', '{"valid":true}', null])(
+    'rejects malformed stored JSON with a matching hash on replacement %j',
+    (payload) => {
+      const { db } = fixture()
+      db.prepare(
+        "UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = 'extension'"
+      ).run('{', hashProfileStateJson('{'))
+
+      expect(() =>
+        writeProfileStateDomains(db, {
+          expectedRevision: 1,
+          replacements: [{ domain: 'extension', payload }]
+        })
+      ).toThrow(/invalid JSON: extension/)
+      expect(readProfileStateRevision(db)).toBe(1)
+      expect(db.isTransaction).toBe(false)
+      expect(
+        db.prepare("SELECT payload FROM profile_state_documents WHERE domain = 'extension'").get()
+      ).toEqual({ payload: '{' })
+    }
+  )
+
+  it('ignores caller-supplied prepared history when writing another domain', () => {
+    const { db } = fixture()
+    const replacement = {
+      domain: 'settings',
+      payload: '{"changed":true}',
+      automationRuns: { incoming: { presence: 'absent', contentHash: '' }, domainVersion: 1 }
+    }
+
+    writeProfileStateDomains(db, { expectedRevision: 1, replacements: [replacement] })
+
+    expect(JSON.parse(readProfileStateSnapshot(db).json)).toEqual({
+      settings: { changed: true },
+      extension: { future: { content: '雪 🐋', nullable: null } }
+    })
+  })
+
+  it('fences a stale writer even when its payload remains equal', () => {
+    const { db, payload } = fixture()
+    writeProfileStateDomains(db, {
+      expectedRevision: 1,
+      replacements: [{ domain: 'settings', payload: '{"changed":true}' }]
+    })
+    const before = readProfileStateSnapshot(db)
+
+    expect(() =>
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [{ domain: 'extension', payload }]
+      })
+    ).toThrow(expect.objectContaining({ code: 'profile-state-revision-conflict' }))
+    expect(readProfileStateSnapshot(db)).toEqual(before)
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-domain-reader.test.ts b/src/main/persistence/profile-state/profile-state-domain-reader.test.ts
new file mode 100644
index 00000000000..c6c9d89c6db
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-domain-reader.test.ts
@@ -0,0 +1,152 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { importProfileStateJson } from './profile-state-documents'
+import { openProfileStateDatabase, profileStateDatabaseFile } from './profile-state-database'
+import {
+  readProfileStateDomains,
+  readProfileStateDomainsWithRevisionFromDatabase
+} from './profile-state-domain-reader'
+import { writeProfileStateDomains } from './profile-state-domain-writes'
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function createDatabase(): { directory: string; databasePath: string } {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-domain-reader-'))
+  temporaryDirectories.push(directory)
+  return { directory, databasePath: profileStateDatabaseFile(directory) }
+}
+
+describe('profile state domain reader', () => {
+  it('does not parse unrelated domains', () => {
+    const { databasePath } = createDatabase()
+    const opened = openProfileStateDatabase(databasePath, 'profile-a')
+    importProfileStateJson(
+      opened.db,
+      JSON.stringify({ settings: { theme: 'dark' }, unrelated: { keep: true } })
+    )
+    opened.db
+      .prepare('UPDATE profile_state_documents SET payload = ? WHERE domain = ?')
+      .run('{invalid', 'unrelated')
+    opened.db.close()
+
+    const result = readProfileStateDomains(databasePath, 'profile-a', ['settings'])
+    expect(result).toEqual({
+      kind: 'values',
+      revision: 1,
+      values: new Map([['settings', { theme: 'dark' }]])
+    })
+  })
+
+  it('fails closed when a selected domain is corrupt', () => {
+    const { databasePath } = createDatabase()
+    const opened = openProfileStateDatabase(databasePath, 'profile-a')
+    importProfileStateJson(opened.db, JSON.stringify({ settings: { theme: 'dark' } }))
+    opened.db
+      .prepare('UPDATE profile_state_documents SET payload = ? WHERE domain = ?')
+      .run('{invalid', 'settings')
+    opened.db.close()
+
+    const result = readProfileStateDomains(databasePath, 'profile-a', ['settings'])
+    expect(result.kind).toBe('unreadable')
+  })
+
+  it('reads the normalized automation projection when selected', () => {
+    const { databasePath } = createDatabase()
+    const opened = openProfileStateDatabase(databasePath, 'profile-a')
+    importProfileStateJson(
+      opened.db,
+      JSON.stringify({ automationRuns: [{ id: 'run-1', status: 'pending' }] })
+    )
+    opened.db.close()
+
+    const result = readProfileStateDomains(databasePath, 'profile-a', ['automationRuns'])
+    expect(result).toEqual({
+      kind: 'values',
+      revision: 1,
+      values: new Map([['automationRuns', [{ id: 'run-1', status: 'pending' }]]])
+    })
+  })
+
+  it('preserves missing versus explicit null automation runs', () => {
+    const missing = createDatabase()
+    const missingOpened = openProfileStateDatabase(missing.databasePath, 'profile-a')
+    importProfileStateJson(missingOpened.db, JSON.stringify({ settings: { theme: 'dark' } }))
+    missingOpened.db.close()
+    const missingResult = readProfileStateDomains(missing.databasePath, 'profile-a', [
+      'automationRuns'
+    ])
+    expect(missingResult.kind).toBe('values')
+    expect(
+      missingResult.kind === 'values' ? missingResult.values.has('automationRuns') : true
+    ).toBe(false)
+
+    const explicitNull = createDatabase()
+    const nullOpened = openProfileStateDatabase(explicitNull.databasePath, 'profile-a')
+    importProfileStateJson(
+      nullOpened.db,
+      JSON.stringify({ settings: { theme: 'dark' }, automationRuns: null })
+    )
+    nullOpened.db.close()
+    const nullResult = readProfileStateDomains(explicitNull.databasePath, 'profile-a', [
+      'automationRuns'
+    ])
+    expect(nullResult).toEqual({
+      kind: 'values',
+      revision: 1,
+      values: new Map([['automationRuns', null]])
+    })
+  })
+
+  it('does not resurrect a stale legacy automation row after normalized deletion', () => {
+    const { databasePath } = createDatabase()
+    const opened = openProfileStateDatabase(databasePath, 'profile-a')
+    importProfileStateJson(
+      opened.db,
+      JSON.stringify({ automationRuns: [{ id: 'run-1', status: 'pending' }] })
+    )
+    writeProfileStateDomains(opened.db, {
+      expectedRevision: 1,
+      replacements: [{ domain: 'automationRuns', payload: null }]
+    })
+    opened.db.close()
+
+    const result = readProfileStateDomains(databasePath, 'profile-a', ['automationRuns'])
+    expect(result.kind).toBe('values')
+    expect(result.kind === 'values' ? result.values.has('automationRuns') : true).toBe(false)
+  })
+})
+
+it('reuses independently parsed values for selected domains and history rows', () => {
+  const { databasePath } = createDatabase()
+  const { db } = openProfileStateDatabase(databasePath, 'profile-a')
+  const settings = '{"theme":"dark"}'
+  const row = '{"id":"run-a","output":"retained"}'
+  importProfileStateJson(db, `{"settings":${settings},"automationRuns":[${row}]}`)
+  const parse = vi.spyOn(JSON, 'parse')
+  try {
+    expect(
+      readProfileStateDomainsWithRevisionFromDatabase(db, ['settings', 'automationRuns'])
+    ).toEqual({
+      kind: 'values',
+      revision: 1,
+      values: new Map<string, unknown>([
+        ['settings', { theme: 'dark' }],
+        ['automationRuns', [{ id: 'run-a', output: 'retained' }]]
+      ])
+    })
+    expect(parse.mock.calls.filter(([input]) => input === settings)).toHaveLength(1)
+    expect(parse.mock.calls.filter(([input]) => input === row)).toHaveLength(1)
+    expect(parse.mock.calls.some(([input]) => input === `[${row}]`)).toBe(false)
+  } finally {
+    parse.mockRestore()
+    db.close()
+  }
+})
diff --git a/src/main/persistence/profile-state/profile-state-domain-reader.ts b/src/main/persistence/profile-state/profile-state-domain-reader.ts
new file mode 100644
index 00000000000..2bd3a642e8e
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-domain-reader.ts
@@ -0,0 +1,115 @@
+import { withProfileStateReadSnapshot } from './profile-state-read-snapshot'
+import {
+  assertProfileStateDocumentRevision,
+  readProfileStateRevision
+} from './profile-state-revision'
+import { readProfileStateAutomationRunsDocument } from './profile-state-automation-runs'
+import { openProfileStateDatabaseReadOnly } from './profile-state-database'
+import {
+  validateProfileStateDocumentRow,
+  type ProfileStateParsedDocument
+} from './profile-state-document-validation'
+
+export type ProfileStateDomainReadResult =
+  | { kind: 'value'; value: unknown }
+  | { kind: 'missing' }
+  | { kind: 'unreadable'; error: unknown }
+
+export type ProfileStateDomainsReadResult =
+  | { kind: 'values'; revision: number; values: ReadonlyMap<string, unknown> }
+  | { kind: 'unreadable'; error: unknown }
+
+/**
+ * Read one domain from an existing profile database without opening a write
+ * handle, applying migrations, or creating the database. Any malformed selected
+ * row makes the whole read unusable so callers that prune state can fail closed.
+ */
+export function readProfileStateDomain(
+  databasePath: string,
+  profileId: string,
+  domain: string
+): ProfileStateDomainReadResult {
+  const result = readProfileStateDomains(databasePath, profileId, [domain])
+  if (result.kind === 'unreadable') {
+    return result
+  }
+  if (!result.values.has(domain)) {
+    return { kind: 'missing' }
+  }
+  return { kind: 'value', value: result.values.get(domain) }
+}
+
+/** Read several domains and the fencing revision under one SQLite snapshot. */
+export function readProfileStateDomains(
+  databasePath: string,
+  profileId: string,
+  domains: readonly string[]
+): ProfileStateDomainsReadResult {
+  let opened: ReturnType<typeof openProfileStateDatabaseReadOnly> | undefined
+  try {
+    opened = openProfileStateDatabaseReadOnly(databasePath, profileId)
+    return readProfileStateDomainsWithRevisionFromDatabase(opened.db, domains)
+  } catch (error) {
+    return { kind: 'unreadable', error }
+  } finally {
+    opened?.db.close()
+  }
+}
+
+/** Read several domains from an already-open database, keeping the caller's handle alive. */
+export function readProfileStateDomainsWithRevisionFromDatabase(
+  db: Parameters<typeof readProfileStateRevision>[0],
+  domains: readonly string[]
+): ProfileStateDomainsReadResult {
+  const wanted = new Set(domains)
+  const values = new Map<string, unknown>()
+  try {
+    return withProfileStateReadSnapshot(db, () => {
+      const revision = readProfileStateRevision(db)
+      if (wanted.size === 0) {
+        return { kind: 'values', revision, values }
+      }
+
+      const normalized = wanted.has('automationRuns')
+        ? readProfileStateAutomationRunsDocument(db, revision, 'parsed')
+        : undefined
+      const legacyDomains = [...wanted].filter(
+        (domain) => domain !== 'automationRuns' || normalized === undefined
+      )
+      for (const document of readSelectedDocuments(db, legacyDomains)) {
+        assertProfileStateDocumentRevision(document.revision, revision, document.domain)
+        values.set(document.domain, document.value)
+      }
+      if (normalized !== undefined && normalized !== null) {
+        values.set(normalized.domain, normalized.value)
+      }
+      return { kind: 'values', revision, values }
+    })
+  } catch (error) {
+    return { kind: 'unreadable', error }
+  }
+}
+
+function readSelectedDocuments(
+  db: Parameters<typeof readProfileStateRevision>[0],
+  domains: readonly string[]
+): readonly ProfileStateParsedDocument[] {
+  if (domains.length === 0) {
+    return []
+  }
+  const placeholders = domains.map(() => '?').join(',')
+  const rows = db
+    .prepare(
+      `SELECT domain, payload, domain_version, revision, updated_at, content_hash
+       FROM profile_state_documents
+       WHERE domain IN (${placeholders})
+       ORDER BY rowid`
+    )
+    .iterate(...domains)
+  return Array.from(rows, (row) => {
+    const { payload: _payload, ...document } = validateProfileStateDocumentRow(row, {
+      retainParsedValue: true
+    })
+    return { ...document, value: document.value }
+  })
+}
diff --git a/src/main/persistence/profile-state/profile-state-domain-write-validation.ts b/src/main/persistence/profile-state/profile-state-domain-write-validation.ts
new file mode 100644
index 00000000000..bac86a1610a
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-domain-write-validation.ts
@@ -0,0 +1,78 @@
+import { PROFILE_STATE_DOCUMENT_VERSION } from './profile-state-database-schema'
+import { hashProfileStateJson } from './profile-state-documents'
+import type { AutomationRunsWritePreparation } from './profile-state-automation-runs'
+import type {
+  ProfileStateDomainMutation,
+  ProfileStateDomainTransaction
+} from './profile-state-domain-writes'
+
+export type PreparedProfileStateMutation = ProfileStateDomainMutation & {
+  domainVersion: number
+  payloadHash: string | null
+  // Keep the checked history value only for this write so normalization does not parse it again.
+  automationRunsValue?: unknown
+  automationRuns?: AutomationRunsWritePreparation
+}
+
+export function validateProfileStateDomainTransaction(
+  transaction: ProfileStateDomainTransaction
+): void {
+  if (!Number.isSafeInteger(transaction.expectedRevision) || transaction.expectedRevision < 0) {
+    throw new Error('Profile state expected revision is invalid')
+  }
+  if (
+    !Array.isArray(transaction.replacements) ||
+    (transaction.replacements.length === 0 && transaction.automationRunsAfter === undefined)
+  ) {
+    throw new Error('Profile state domain transaction requires at least one replacement')
+  }
+  const domains = new Set<string>()
+  for (const replacement of transaction.replacements) {
+    validateProfileStateDomainMutation(replacement)
+    if (domains.has(replacement.domain)) {
+      throw new Error(`Profile state domain transaction repeats domain: ${replacement.domain}`)
+    }
+    domains.add(replacement.domain)
+  }
+  if (transaction.automationRunsAfter !== undefined && domains.has('automationRuns')) {
+    throw new Error('Profile state automationRuns delta repeats domain: automationRuns')
+  }
+}
+
+export function prepareProfileStateDomainMutation(
+  replacement: ProfileStateDomainMutation
+): PreparedProfileStateMutation {
+  const payloadHash =
+    replacement.payload === null ? null : hashProfileStateJson(replacement.payload)
+  let parsed: unknown
+  if (replacement.payload !== null) {
+    try {
+      parsed = JSON.parse(replacement.payload)
+    } catch {
+      throw new Error(`Profile state domain payload is invalid JSON: ${replacement.domain}`)
+    }
+  }
+  return {
+    domain: replacement.domain,
+    payload: replacement.payload,
+    now: replacement.now,
+    domainVersion: replacement.domainVersion ?? PROFILE_STATE_DOCUMENT_VERSION,
+    payloadHash,
+    automationRunsValue: replacement.domain === 'automationRuns' ? parsed : undefined
+  }
+}
+
+function validateProfileStateDomainMutation(replacement: ProfileStateDomainMutation): void {
+  if (typeof replacement.domain !== 'string' || replacement.domain.length === 0) {
+    throw new Error('Profile state domain name cannot be empty')
+  }
+  if (replacement.payload !== null && typeof replacement.payload !== 'string') {
+    throw new Error(`Profile state domain payload is invalid: ${replacement.domain}`)
+  }
+  if (
+    replacement.domainVersion !== undefined &&
+    (!Number.isSafeInteger(replacement.domainVersion) || replacement.domainVersion < 1)
+  ) {
+    throw new Error('Profile state domain version is invalid')
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-domain-writes.test.ts b/src/main/persistence/profile-state/profile-state-domain-writes.test.ts
new file mode 100644
index 00000000000..8c54ee2360f
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-domain-writes.test.ts
@@ -0,0 +1,585 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  exportProfileStateJson,
+  importProfileStateJson,
+  readProfileStateDocuments,
+  readProfileStateRevision
+} from './profile-state-documents'
+import { openProfileStateDatabase, profileStateDatabaseFile } from './profile-state-database'
+import {
+  ProfileStateRevisionConflictError,
+  writeProfileStateDomain,
+  writeProfileStateDomains
+} from './profile-state-domain-writes'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function openTestDatabase(): ReturnType<typeof openProfileStateDatabase>['db'] {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-domain-write-'))
+  temporaryDirectories.push(directory)
+  return openProfileStateDatabase(profileStateDatabaseFile(directory), 'profile-a').db
+}
+
+describe('profile state dirty-domain writes', () => {
+  it('retains logical history order when existing runs change position', () => {
+    const db = openTestDatabase()
+    const runs = [{ id: 'first' }, { id: 'second' }, { id: 'third' }] as const
+    const reordered = [runs[2], runs[0], runs[1]]
+    try {
+      importProfileStateJson(db, JSON.stringify({ automationRuns: runs }))
+      writeProfileStateDomain(db, {
+        domain: 'automationRuns',
+        payload: JSON.stringify(reordered),
+        expectedRevision: 1
+      })
+
+      expect(
+        db.prepare('SELECT run_id FROM profile_state_automation_runs ORDER BY rowid').all()
+      ).toEqual(runs.map((run) => ({ run_id: run.id })))
+      expect(JSON.parse(exportProfileStateJson(db)).automationRuns).toEqual(reordered)
+
+      db.prepare('UPDATE profile_state_automation_runs SET ordinal = 0 WHERE run_id = ?').run(
+        'first'
+      )
+      expect(() => exportProfileStateJson(db)).toThrow(
+        'Normalized automationRuns ordering is corrupt'
+      )
+    } finally {
+      db.close()
+    }
+  })
+
+  it('updates automationRuns without rewriting unrelated domains', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(
+        db,
+        JSON.stringify({
+          settings: { theme: 'dark' },
+          automationRuns: [{ id: 'run-1', status: 'pending' }]
+        }),
+        { now: () => 100 }
+      )
+      const settingsBefore = readProfileStateDocuments(db).find(
+        (document) => document.domain === 'settings'
+      )
+
+      const result = writeProfileStateDomain(db, {
+        domain: 'automationRuns',
+        payload: JSON.stringify([{ id: 'run-1', status: 'completed' }]),
+        expectedRevision: 1,
+        now: () => 200
+      })
+
+      expect(result).toEqual({ changed: true, revision: 2 })
+      expect(JSON.parse(exportProfileStateJson(db))).toEqual({
+        settings: { theme: 'dark' },
+        automationRuns: [{ id: 'run-1', status: 'completed' }]
+      })
+      expect(readProfileStateDocuments(db)).toEqual([
+        expect.objectContaining({ domain: 'settings', revision: 1, updatedAt: 100 }),
+        expect.objectContaining({ domain: 'automationRuns', revision: 2, updatedAt: 200 })
+      ])
+      const settingsAfter = readProfileStateDocuments(db).find(
+        (document) => document.domain === 'settings'
+      )
+      expect(settingsAfter).toMatchObject({
+        payload: settingsBefore?.payload,
+        contentHash: settingsBefore?.contentHash,
+        updatedAt: settingsBefore?.updatedAt
+      })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('commits changed automation runs as rows without rewriting the legacy document blob', () => {
+    const db = openTestDatabase()
+    try {
+      const fixtureRun = buildProfileStateCutoverFixture().automationRuns[0]
+      if (!fixtureRun) {
+        throw new Error('Expected automation run fixture')
+      }
+      const initialRuns = [
+        { ...fixtureRun, id: 'run-1', status: 'pending' as const },
+        { ...fixtureRun, id: 'run-2', status: 'completed' as const }
+      ]
+      importProfileStateJson(
+        db,
+        JSON.stringify({
+          settings: { theme: 'dark' },
+          automationRuns: initialRuns
+        }),
+        { now: () => 100 }
+      )
+      const legacyDocument = db
+        .prepare('SELECT payload, content_hash FROM profile_state_documents WHERE domain = ?')
+        .get('automationRuns')
+
+      const result = writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [],
+        automationRunsAfter: [{ ...initialRuns[0], status: 'dispatched' as const }, initialRuns[1]]
+      })
+
+      expect(result).toEqual({
+        changed: true,
+        revision: 2,
+        changedDomains: ['automationRuns']
+      })
+      expect(
+        db.prepare('SELECT COUNT(*) AS count FROM profile_state_automation_runs').get()
+      ).toEqual({ count: 2 })
+      expect(
+        db
+          .prepare('SELECT payload, content_hash FROM profile_state_documents WHERE domain = ?')
+          .get('automationRuns')
+      ).toEqual(legacyDocument)
+      expect(JSON.parse(exportProfileStateJson(db))).toEqual({
+        settings: { theme: 'dark' },
+        automationRuns: [{ ...initialRuns[0], status: 'dispatched' }, initialRuns[1]]
+      })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rolls back a direct automation-run delta and revision when normalized metadata rejects it', () => {
+    const db = openTestDatabase()
+    try {
+      const fixtureRun = buildProfileStateCutoverFixture().automationRuns[0]
+      if (!fixtureRun) {
+        throw new Error('Expected automation run fixture')
+      }
+      const initialRuns = [{ ...fixtureRun, id: 'run-1', status: 'pending' as const }]
+      importProfileStateJson(db, JSON.stringify({ automationRuns: initialRuns }), {
+        now: () => 100
+      })
+      const normalizedRuns = [{ ...initialRuns[0], status: 'dispatched' as const }]
+      expect(
+        writeProfileStateDomains(db, {
+          expectedRevision: 1,
+          replacements: [],
+          automationRunsAfter: normalizedRuns
+        })
+      ).toEqual({ changed: true, revision: 2, changedDomains: ['automationRuns'] })
+      db.exec(
+        `CREATE TRIGGER fail_profile_state_automation_run_delta
+         BEFORE UPDATE ON profile_state_automation_runs_meta
+         WHEN NEW.domain = 'automationRuns'
+         BEGIN SELECT RAISE(ABORT, 'injected automation delta failure'); END`
+      )
+
+      expect(() =>
+        writeProfileStateDomains(db, {
+          expectedRevision: 2,
+          replacements: [],
+          automationRunsAfter: [{ ...normalizedRuns[0], status: 'completed' as const }]
+        })
+      ).toThrow('injected automation delta failure')
+      db.exec('DROP TRIGGER fail_profile_state_automation_run_delta')
+      expect(readProfileStateRevision(db)).toBe(2)
+      expect(JSON.parse(exportProfileStateJson(db)).automationRuns).toEqual(normalizedRuns)
+    } finally {
+      db.close()
+    }
+  })
+
+  it('fails closed when a normalized automation-run row is corrupt', () => {
+    const db = openTestDatabase()
+    try {
+      const fixtureRun = buildProfileStateCutoverFixture().automationRuns[0]
+      if (!fixtureRun) {
+        throw new Error('Expected automation run fixture')
+      }
+      const runs = [{ ...fixtureRun, id: 'run-1', status: 'pending' as const }]
+      importProfileStateJson(db, JSON.stringify({ automationRuns: runs }))
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [],
+        automationRunsAfter: runs
+      })
+      db.prepare('UPDATE profile_state_automation_runs SET payload = ? WHERE run_id = ?').run(
+        JSON.stringify({ ...runs[0], status: 'tampered' }),
+        'run-1'
+      )
+
+      expect(() => exportProfileStateJson(db)).toThrow('Normalized automationRuns row is corrupt')
+    } finally {
+      db.close()
+    }
+  })
+
+  it('retains unchanged run row revisions while updating the aggregate projection', () => {
+    const db = openTestDatabase()
+    try {
+      const fixtureRuns = buildProfileStateCutoverFixture().automationRuns
+      const first = fixtureRuns[0]
+      if (!first) {
+        throw new Error('Expected automation run fixture')
+      }
+      const initialRuns = [
+        { ...first, id: 'run-1', status: 'pending' as const },
+        { ...first, id: 'run-2', status: 'dispatched' as const }
+      ]
+      importProfileStateJson(db, JSON.stringify({ automationRuns: initialRuns }))
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [],
+        automationRunsAfter: [{ ...initialRuns[0], status: 'completed' as const }, initialRuns[1]]
+      })
+      writeProfileStateDomains(db, {
+        expectedRevision: 2,
+        replacements: [],
+        automationRunsAfter: [
+          { ...initialRuns[0], status: 'dispatch_failed' as const },
+          initialRuns[1]
+        ]
+      })
+
+      expect(
+        db
+          .prepare('SELECT revision FROM profile_state_automation_runs WHERE run_id = ?')
+          .get('run-2')
+      ).toEqual({ revision: 1 })
+      expect(readProfileStateRevision(db)).toBe(3)
+      expect(JSON.parse(exportProfileStateJson(db)).automationRuns).toEqual([
+        { ...initialRuns[0], status: 'dispatch_failed' },
+        initialRuns[1]
+      ])
+    } finally {
+      db.close()
+    }
+  })
+
+  it('commits several changed domains at one shared revision', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(
+        db,
+        JSON.stringify({
+          settings: { theme: 'dark' },
+          automationRuns: [{ id: 'run-1', status: 'pending' }],
+          ui: { activeView: 'terminal' }
+        }),
+        { now: () => 100 }
+      )
+
+      expect(
+        writeProfileStateDomains(db, {
+          expectedRevision: 1,
+          replacements: [
+            {
+              domain: 'settings',
+              payload: JSON.stringify({ theme: 'light' }),
+              now: () => 200
+            },
+            {
+              domain: 'automationRuns',
+              payload: JSON.stringify([{ id: 'run-1', status: 'completed' }]),
+              now: () => 201
+            }
+          ]
+        })
+      ).toEqual({
+        changed: true,
+        revision: 2,
+        changedDomains: ['settings', 'automationRuns']
+      })
+      expect(readProfileStateRevision(db)).toBe(2)
+      expect(JSON.parse(exportProfileStateJson(db))).toEqual({
+        settings: { theme: 'light' },
+        automationRuns: [{ id: 'run-1', status: 'completed' }],
+        ui: { activeView: 'terminal' }
+      })
+      expect(readProfileStateDocuments(db)).toEqual([
+        expect.objectContaining({ domain: 'settings', revision: 2, updatedAt: 200 }),
+        expect.objectContaining({ domain: 'automationRuns', revision: 2, updatedAt: 201 }),
+        expect.objectContaining({ domain: 'ui', revision: 1, updatedAt: 100 })
+      ])
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rolls back every domain when a later mutation fails', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(
+        db,
+        JSON.stringify({
+          settings: { theme: 'dark' },
+          automationRuns: [{ id: 'run-1', status: 'pending' }]
+        }),
+        { now: () => 100 }
+      )
+      db.exec(
+        `CREATE TRIGGER fail_second_profile_state_domain_update
+         BEFORE UPDATE ON profile_state_automation_runs_meta
+         WHEN NEW.domain = 'automationRuns'
+         BEGIN SELECT RAISE(ABORT, 'injected domain failure'); END`
+      )
+
+      expect(() =>
+        writeProfileStateDomains(db, {
+          expectedRevision: 1,
+          replacements: [
+            { domain: 'settings', payload: JSON.stringify({ theme: 'light' }) },
+            {
+              domain: 'automationRuns',
+              payload: JSON.stringify([{ id: 'run-1', status: 'completed' }])
+            }
+          ]
+        })
+      ).toThrow('injected domain failure')
+      db.exec('DROP TRIGGER fail_second_profile_state_domain_update')
+      expect(readProfileStateRevision(db)).toBe(1)
+      expect(JSON.parse(exportProfileStateJson(db))).toEqual({
+        settings: { theme: 'dark' },
+        automationRuns: [{ id: 'run-1', status: 'pending' }]
+      })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('fences a stale multi-domain transaction before changing either row', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(
+        db,
+        JSON.stringify({ settings: { theme: 'dark' }, ui: { activeView: 'terminal' } })
+      )
+      writeProfileStateDomain(db, {
+        domain: 'settings',
+        payload: JSON.stringify({ theme: 'light' }),
+        expectedRevision: 1
+      })
+
+      expect(() =>
+        writeProfileStateDomains(db, {
+          expectedRevision: 1,
+          replacements: [
+            { domain: 'settings', payload: JSON.stringify({ theme: 'blue' }) },
+            { domain: 'ui', payload: JSON.stringify({ activeView: 'browser' }) }
+          ]
+        })
+      ).toThrowError(ProfileStateRevisionConflictError)
+      expect(readProfileStateRevision(db)).toBe(2)
+      expect(JSON.parse(exportProfileStateJson(db))).toEqual({
+        settings: { theme: 'light' },
+        ui: { activeView: 'terminal' }
+      })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rejects duplicate domains before opening a transaction', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ settings: { theme: 'dark' } }))
+      expect(() =>
+        writeProfileStateDomains(db, {
+          expectedRevision: 1,
+          replacements: [
+            { domain: 'settings', payload: JSON.stringify({ theme: 'light' }) },
+            { domain: 'settings', payload: JSON.stringify({ theme: 'blue' }) }
+          ]
+        })
+      ).toThrow('repeats domain: settings')
+      expect(readProfileStateRevision(db)).toBe(1)
+      expect(JSON.parse(exportProfileStateJson(db))).toEqual({ settings: { theme: 'dark' } })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('fences a stale Store and leaves the database unchanged', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ automationRuns: [{ id: 'run-1' }] }))
+      writeProfileStateDomain(db, {
+        domain: 'automationRuns',
+        payload: JSON.stringify([{ id: 'run-1', status: 'completed' }]),
+        expectedRevision: 1
+      })
+
+      expect(() =>
+        writeProfileStateDomain(db, {
+          domain: 'automationRuns',
+          payload: JSON.stringify([{ id: 'run-1', status: 'failed' }]),
+          expectedRevision: 1
+        })
+      ).toThrowError(
+        expect.objectContaining({
+          code: 'profile-state-revision-conflict',
+          expectedRevision: 1,
+          actualRevision: 2
+        })
+      )
+      expect(readProfileStateRevision(db)).toBe(2)
+      expect(JSON.parse(exportProfileStateJson(db)).automationRuns).toEqual([
+        { id: 'run-1', status: 'completed' }
+      ])
+    } finally {
+      db.close()
+    }
+  })
+
+  it('fences two independently opened database writers with the shared revision', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-domain-writer-fence-'))
+    temporaryDirectories.push(directory)
+    const databasePath = profileStateDatabaseFile(directory)
+    const first = openProfileStateDatabase(databasePath, 'profile-a').db
+    const second = openProfileStateDatabase(databasePath, 'profile-a').db
+    try {
+      importProfileStateJson(first, JSON.stringify({ automationRuns: [{ id: 'run-1' }] }))
+      expect(readProfileStateRevision(second)).toBe(1)
+      writeProfileStateDomain(first, {
+        domain: 'automationRuns',
+        payload: JSON.stringify([{ id: 'run-1', status: 'completed' }]),
+        expectedRevision: 1
+      })
+
+      expect(() =>
+        writeProfileStateDomain(second, {
+          domain: 'automationRuns',
+          payload: JSON.stringify([{ id: 'run-1', status: 'failed' }]),
+          expectedRevision: 1
+        })
+      ).toThrowError(ProfileStateRevisionConflictError)
+      expect(readProfileStateRevision(second)).toBe(2)
+    } finally {
+      first.close()
+      second.close()
+    }
+  })
+
+  it('does not advance revision for an identical replacement or absent delete', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ automationRuns: [{ id: 'run-1' }] }))
+      expect(
+        writeProfileStateDomain(db, {
+          domain: 'automationRuns',
+          payload: JSON.stringify([{ id: 'run-1' }]),
+          expectedRevision: 1
+        })
+      ).toEqual({ changed: false, revision: 1 })
+      expect(
+        writeProfileStateDomain(db, {
+          domain: 'missingDomain',
+          payload: null,
+          expectedRevision: 1
+        })
+      ).toEqual({ changed: false, revision: 1 })
+      expect(readProfileStateRevision(db)).toBe(1)
+    } finally {
+      db.close()
+    }
+  })
+
+  it('distinguishes explicit JSON null from deleting a domain', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ automationRuns: [{ id: 'run-1' }] }))
+      expect(
+        writeProfileStateDomain(db, {
+          domain: 'automationRuns',
+          payload: 'null',
+          expectedRevision: 1
+        })
+      ).toEqual({ changed: true, revision: 2 })
+      expect(JSON.parse(exportProfileStateJson(db))).toEqual({ automationRuns: null })
+
+      expect(
+        writeProfileStateDomain(db, {
+          domain: 'automationRuns',
+          payload: null,
+          expectedRevision: 2
+        })
+      ).toEqual({ changed: true, revision: 3 })
+      expect(JSON.parse(exportProfileStateJson(db))).toEqual({})
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rolls back the row and revision when SQLite rejects the replacement', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ automationRuns: [{ id: 'run-1' }] }))
+      db.exec(
+        `CREATE TRIGGER fail_profile_state_domain_update
+         BEFORE UPDATE ON profile_state_automation_runs_meta
+         WHEN NEW.domain = 'automationRuns'
+         BEGIN SELECT RAISE(ABORT, 'injected domain failure'); END`
+      )
+
+      expect(() =>
+        writeProfileStateDomain(db, {
+          domain: 'automationRuns',
+          payload: JSON.stringify([{ id: 'run-1', status: 'failed' }]),
+          expectedRevision: 1
+        })
+      ).toThrow('injected domain failure')
+      db.exec('DROP TRIGGER fail_profile_state_domain_update')
+      expect(readProfileStateRevision(db)).toBe(1)
+      expect(JSON.parse(exportProfileStateJson(db))).toEqual({
+        automationRuns: [{ id: 'run-1' }]
+      })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rejects malformed payloads before opening a transaction', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ automationRuns: [{ id: 'run-1' }] }))
+      expect(() =>
+        writeProfileStateDomain(db, {
+          domain: 'automationRuns',
+          payload: '{invalid',
+          expectedRevision: 1
+        })
+      ).toThrow('Profile state domain payload is invalid JSON: automationRuns')
+      expect(readProfileStateRevision(db)).toBe(1)
+    } finally {
+      db.close()
+    }
+  })
+
+  it('fails closed when the target row hash is already corrupt', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ automationRuns: [{ id: 'run-1' }] }))
+      db.prepare('UPDATE profile_state_documents SET payload = ? WHERE domain = ?').run(
+        JSON.stringify([{ id: 'tampered' }]),
+        'automationRuns'
+      )
+
+      expect(() =>
+        writeProfileStateDomain(db, {
+          domain: 'automationRuns',
+          payload: JSON.stringify([{ id: 'run-1', status: 'completed' }]),
+          expectedRevision: 1
+        })
+      ).toThrow('Profile state document hash mismatch: automationRuns')
+      expect(readProfileStateRevision(db)).toBe(1)
+    } finally {
+      db.close()
+    }
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-domain-writes.ts b/src/main/persistence/profile-state/profile-state-domain-writes.ts
new file mode 100644
index 00000000000..792487ef3b1
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-domain-writes.ts
@@ -0,0 +1,231 @@
+import { withProfileStateWriteTransaction } from './profile-state-write-transaction'
+import type Database from '../../sqlite/sync-database'
+import { readCurrentAutomationRunsState } from './profile-state-automation-runs-storage'
+import {
+  PROFILE_STATE_DOCUMENT_VERSION,
+  PROFILE_STATE_META_REVISION
+} from './profile-state-database-schema'
+import {
+  ProfileStateRevisionConflictError,
+  readProfileStateRevision
+} from './profile-state-documents'
+import {
+  applyProfileStateAutomationRuns,
+  clearProfileStateAutomationRuns,
+  prepareProfileStateAutomationRunsDelta,
+  prepareProfileStateAutomationRunsReplacement
+} from './profile-state-automation-runs'
+import { isRecord, validateProfileStateDocumentRow } from './profile-state-document-validation'
+import { assertProfileStateDocumentRevision } from './profile-state-revision'
+import {
+  prepareProfileStateDomainMutation,
+  validateProfileStateDomainTransaction,
+  type PreparedProfileStateMutation
+} from './profile-state-domain-write-validation'
+
+export { ProfileStateRevisionConflictError } from './profile-state-documents'
+
+/** A storage-form replacement for one top-level profile-state domain. */
+export type ProfileStateDomainReplacement = {
+  /** Non-empty top-level domain name, for example `automationRuns`. */
+  domain: string
+  /** Canonical JSON payload, or null to remove the domain row. */
+  payload: string | null
+  /** Revision observed by the caller before it built this replacement. */
+  expectedRevision: number
+  domainVersion?: number
+  now?: () => number
+}
+
+/** One row mutation inside a transaction that may update several domains. */
+export type ProfileStateDomainMutation = Omit<ProfileStateDomainReplacement, 'expectedRevision'>
+
+/**
+ * A set of domain mutations guarded by one profile revision.
+ *
+ * A profile revision is shared by every row, so checking it once at the start
+ * of the transaction gives callers an atomic cross-domain compare-and-swap.
+ */
+export type ProfileStateDomainTransaction = {
+  expectedRevision: number
+  replacements: readonly ProfileStateDomainMutation[]
+  /** Changed run projection supplied by Store for selective row updates. */
+  automationRunsAfter?: readonly unknown[]
+}
+
+export type ProfileStateDomainWriteResult = {
+  changed: boolean
+  revision: number
+}
+
+export type ProfileStateDomainTransactionResult = ProfileStateDomainWriteResult & {
+  changedDomains: readonly string[]
+}
+
+/**
+ * Replace one domain without serializing or rewriting the other domains.
+ *
+ * The caller supplies the revision it read with the domain. SQLite's
+ * `BEGIN IMMEDIATE` plus the exact revision check fences stale Store instances
+ * before the row and profile revision are changed. A null payload deletes the
+ * row; the JSON literal `null` remains an explicit domain value.
+ */
+export function writeProfileStateDomain(
+  db: Database.Database,
+  replacement: ProfileStateDomainReplacement
+): ProfileStateDomainWriteResult {
+  const result = writeProfileStateDomains(db, {
+    expectedRevision: replacement.expectedRevision,
+    replacements: [
+      {
+        domain: replacement.domain,
+        payload: replacement.payload,
+        domainVersion: replacement.domainVersion,
+        now: replacement.now
+      }
+    ]
+  })
+  return { changed: result.changed, revision: result.revision }
+}
+
+/**
+ * Replace one or more domains in one SQLite transaction.
+ *
+ * Every changed row receives the same next profile revision. If any row
+ * validation, payload write, or commit step fails, SQLite rolls back all row
+ * changes and the profile revision remains unchanged.
+ */
+export function writeProfileStateDomains(
+  db: Database.Database,
+  transaction: ProfileStateDomainTransaction
+): ProfileStateDomainTransactionResult {
+  validateProfileStateDomainTransaction(transaction)
+
+  const prepared = transaction.replacements.map(prepareProfileStateDomainMutation)
+
+  return withProfileStateWriteTransaction(db, () => {
+    const actualRevision = readProfileStateRevision(db)
+    if (actualRevision !== transaction.expectedRevision) {
+      throw new ProfileStateRevisionConflictError(transaction.expectedRevision, actualRevision)
+    }
+    const currentAutomationRuns = readCurrentAutomationRunsState(db, actualRevision)
+
+    const updates: PreparedProfileStateMutation[] = []
+    for (const mutation of prepared) {
+      const existing = db
+        .prepare(
+          `SELECT domain, payload, domain_version, revision, updated_at, content_hash
+           FROM profile_state_documents WHERE domain = ?`
+        )
+        .get(mutation.domain)
+      const existingRow =
+        existing === undefined
+          ? undefined
+          : validateProfileStateDocumentRow(existing, {
+              // An identical incoming payload has already passed JSON validation.
+              validateJson: !(isRecord(existing) && existing.payload === mutation.payload)
+            })
+      if (existingRow) {
+        assertProfileStateDocumentRevision(existingRow.revision, actualRevision, mutation.domain)
+      }
+      if (mutation.domain === 'automationRuns') {
+        // Canonical history already has this hash; unchanged rows need no new projection.
+        if (
+          currentAutomationRuns.presence === 'array' &&
+          mutation.payload?.startsWith('[') &&
+          currentAutomationRuns.contentHash === mutation.payloadHash
+        ) {
+          continue
+        }
+        const normalized = prepareProfileStateAutomationRunsReplacement(
+          db,
+          mutation,
+          actualRevision
+        )
+        if (normalized !== undefined) {
+          if (normalized.changed) {
+            updates.push({ ...mutation, automationRuns: normalized })
+          }
+          continue
+        }
+      }
+      const unchanged =
+        (mutation.payload === null && existingRow === undefined) ||
+        (mutation.payload !== null && existingRow?.payload === mutation.payload)
+      if (!unchanged) {
+        updates.push(mutation)
+      }
+    }
+    if (transaction.automationRunsAfter !== undefined) {
+      const delta = prepareProfileStateAutomationRunsDelta(
+        db,
+        transaction.automationRunsAfter,
+        PROFILE_STATE_DOCUMENT_VERSION,
+        Date.now,
+        actualRevision
+      )
+      if (delta === undefined) {
+        throw new Error('Normalized automationRuns delta is unsupported')
+      }
+      if (delta.changed) {
+        updates.push({
+          domain: 'automationRuns',
+          payload: null,
+          domainVersion: PROFILE_STATE_DOCUMENT_VERSION,
+          payloadHash: null,
+          automationRuns: delta
+        })
+      }
+    }
+
+    if (updates.length === 0) {
+      return { changed: false, revision: actualRevision, changedDomains: [] }
+    }
+
+    const nextRevision = actualRevision + 1
+    for (const mutation of updates) {
+      if (mutation.automationRuns) {
+        applyProfileStateAutomationRuns(db, mutation.automationRuns, nextRevision)
+        continue
+      }
+      if (mutation.domain === 'automationRuns') {
+        clearProfileStateAutomationRuns(db)
+      }
+      if (mutation.payload === null) {
+        db.prepare('DELETE FROM profile_state_documents WHERE domain = ?').run(mutation.domain)
+      } else {
+        const updatedAt = (mutation.now ?? Date.now)()
+        if (!Number.isSafeInteger(updatedAt) || updatedAt < 0) {
+          throw new Error(`Profile state domain update timestamp is invalid: ${mutation.domain}`)
+        }
+        db.prepare(
+          `INSERT INTO profile_state_documents
+           (domain, payload, domain_version, revision, updated_at, content_hash)
+           VALUES (?, ?, ?, ?, ?, ?)
+           ON CONFLICT(domain) DO UPDATE SET
+             payload = excluded.payload,
+             domain_version = excluded.domain_version,
+             revision = excluded.revision,
+             updated_at = excluded.updated_at,
+             content_hash = excluded.content_hash`
+        ).run(
+          mutation.domain,
+          mutation.payload,
+          mutation.domainVersion,
+          nextRevision,
+          updatedAt,
+          mutation.payloadHash
+        )
+      }
+    }
+    db.prepare(
+      `INSERT INTO profile_state_meta (key, value) VALUES (?, ?)
+       ON CONFLICT(key) DO UPDATE SET value = excluded.value`
+    ).run(PROFILE_STATE_META_REVISION, String(nextRevision))
+    return {
+      changed: true,
+      revision: nextRevision,
+      changedDomains: updates.map(({ domain }) => domain)
+    }
+  })
+}
diff --git a/src/main/persistence/profile-state/profile-state-fragment-validation.test.ts b/src/main/persistence/profile-state/profile-state-fragment-validation.test.ts
new file mode 100644
index 00000000000..1fcb85eb108
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-fragment-validation.test.ts
@@ -0,0 +1,132 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { Store } from '../loading-store/store'
+import { openProfileStateDatabase } from './profile-state-database'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateSnapshot,
+  readProfileStateParsedSnapshot,
+  validateProfileStateSnapshot
+} from './profile-state-documents'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { createProfileStateStore } from './profile-state-store-factory'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const directories: string[] = []
+
+afterEach(() => {
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture(keepJson = false) {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-fragments-'))
+  directories.push(directory)
+  const paths = {
+    dataFile: join(directory, 'orca-data.json'),
+    databaseFile: join(directory, 'profile-state.db'),
+    profileId: 'fragment-validation'
+  }
+  const source = JSON.stringify({
+    settings: { theme: 'dark' },
+    futureDomain: null,
+    automationRuns: [{ id: 'a' }, { id: 'b' }]
+  })
+  if (keepJson) {
+    writeFileSync(paths.dataFile, source)
+  }
+  const { db } = openProfileStateDatabase(paths.databaseFile, paths.profileId)
+  importProfileStateJson(db, source, { acceptedLegacyJsonHash: hashProfileStateJson(source) })
+  return { paths, db }
+}
+
+describe('independent profile state JSON fragments', () => {
+  it.each([false, true])(
+    'rejects a domain that injects a valid sibling into startup JSON (retained JSON: %s)',
+    (keepJson) => {
+      const { paths, db } = fixture(keepJson)
+      const payload = 'null,"settings":{"theme":"light"}'
+      db.prepare(
+        'UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = ?'
+      ).run(payload, hashProfileStateJson(payload), 'futureDomain')
+      expect(() => readProfileStateParsedSnapshot(db)).toThrow(/invalid JSON: futureDomain/)
+      expect(() => validateProfileStateSnapshot(db)).toThrow(/invalid JSON: futureDomain/)
+      db.close()
+
+      expect(() => {
+        const result = createProfileStateStore({ ...paths })
+        result.store.freezeWrites()
+      }).toThrow()
+    }
+  )
+
+  it('rejects a spliced domain through direct authority and Store reads', () => {
+    const { paths, db } = fixture()
+    const payload = 'null,"settings":{"theme":"light"}'
+    db.prepare(
+      'UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = ?'
+    ).run(payload, hashProfileStateJson(payload), 'futureDomain')
+    db.close()
+    const authority = new ProfileStateSqliteAuthority(paths.databaseFile, paths.profileId)
+    try {
+      expect(() => {
+        const store = new Store({ dataFile: paths.dataFile, profileStateAuthority: authority })
+        store.freezeWrites()
+      }).toThrow(/invalid JSON: futureDomain/)
+      expect(() => authority.readSerializedState()).toThrow(/invalid JSON: futureDomain/)
+    } finally {
+      authority.close()
+    }
+  })
+
+  it.each(['snapshot', 'parsed', 'validated', 'authority', 'store'] as const)(
+    'rejects history rows that form a valid array only when spliced together (%s)',
+    (boundary) => {
+      const { paths, db } = fixture()
+      const payloads = ['{"id":"a","text":"', 'b"},{"id":"b"}']
+      const aggregate = `[${payloads.join(',')}]`
+      expect(JSON.parse(aggregate)).toEqual([{ id: 'a', text: ',b' }, { id: 'b' }])
+      for (const [ordinal, payload] of payloads.entries()) {
+        expect(() => JSON.parse(payload)).toThrow()
+        db.prepare(
+          'UPDATE profile_state_automation_runs SET payload = ?, content_hash = ? WHERE ordinal = ?'
+        ).run(payload, hashProfileStateJson(payload), ordinal)
+      }
+      db.prepare('UPDATE profile_state_automation_runs_meta SET content_hash = ?').run(
+        hashProfileStateJson(aggregate)
+      )
+      const authority = new ProfileStateSqliteAuthority(paths.databaseFile, paths.profileId)
+      try {
+        expect(() => {
+          if (boundary === 'snapshot') {
+            readProfileStateSnapshot(db)
+          } else if (boundary === 'parsed') {
+            readProfileStateParsedSnapshot(db)
+          } else if (boundary === 'validated') {
+            validateProfileStateSnapshot(db)
+          } else if (boundary === 'authority') {
+            authority.readSerializedState()
+          } else {
+            const store = new Store({ dataFile: paths.dataFile, profileStateAuthority: authority })
+            store.freezeWrites()
+          }
+        }).toThrow('Normalized automationRuns row is invalid JSON')
+      } finally {
+        authority.close()
+        db.close()
+      }
+    }
+  )
+})
diff --git a/src/main/persistence/profile-state/profile-state-json-compatibility-recovery.test.ts b/src/main/persistence/profile-state/profile-state-json-compatibility-recovery.test.ts
new file mode 100644
index 00000000000..ed02b9ba43e
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-json-compatibility-recovery.test.ts
@@ -0,0 +1,239 @@
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import * as durableFiles from '../../durable-file-write'
+import { openProfileStateDatabase } from './profile-state-database'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateJsonAcceptance
+} from './profile-state-documents'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { createProfileStateStore } from './profile-state-store-factory'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: { isEncryptionAvailable: () => false },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const fixtures: { directory: string; authority: ProfileStateSqliteAuthority }[] = []
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const { authority, directory } of fixtures.splice(0)) {
+    authority.close()
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-json-compatibility-recovery-'))
+  const paths = {
+    dataFile: join(directory, 'orca-data.json'),
+    databaseFile: join(directory, 'profile-state.db'),
+    profileId: 'compatibility-recovery'
+  }
+  const retainedJson = '{"settings":{"theme":"light"}}'
+  writeFileSync(paths.dataFile, retainedJson)
+  const withDatabase = <T>(
+    run: (db: ReturnType<typeof openProfileStateDatabase>['db']) => T
+  ): T => {
+    const opened = openProfileStateDatabase(paths.databaseFile, paths.profileId)
+    try {
+      return run(opened.db)
+    } finally {
+      opened.db.close()
+    }
+  }
+  withDatabase((db) =>
+    importProfileStateJson(db, retainedJson, {
+      acceptedLegacyJsonHash: hashProfileStateJson(retainedJson)
+    })
+  )
+  const authority = new ProfileStateSqliteAuthority(paths.databaseFile, paths.profileId)
+  authority.readSerializedState()
+  authority.writeSerializedState(Buffer.from('{"settings":{"theme":"dark"}}'))
+  fixtures.push({ directory, authority })
+  return {
+    paths,
+    authority,
+    retainedJson,
+    withDatabase,
+    acceptance: () => withDatabase(readProfileStateJsonAcceptance),
+    publish: async (mode: 'sync' | 'async') =>
+      mode === 'sync'
+        ? authority.writeJsonCompatibilityExport(paths.dataFile)
+        : authority.writeJsonCompatibilityExportAsync(paths.dataFile),
+    reopen: () => {
+      const result = createProfileStateStore({ ...paths })
+      try {
+        expect(result.backend).toBe('sqlite')
+        return result.store.getSettings().theme
+      } finally {
+        result.store.freezeWrites()
+      }
+    }
+  }
+}
+
+describe.each(['sync', 'async'] as const)('%s compatibility export recovery', (mode) => {
+  it.each(['staging', 'publication', 'promotion'] as const)(
+    'reopens SQLite and permits a later export after failed %s',
+    async (phase) => {
+      const state = fixture()
+      if (phase === 'publication') {
+        if (mode === 'sync') {
+          const write = durableFiles.writeFileDurableSync
+          vi.spyOn(durableFiles, 'writeFileDurableSync').mockImplementation((...args) => {
+            if (args[1] === state.paths.dataFile) {
+              throw new Error('injected publication failure')
+            }
+            write(...args)
+          })
+        } else {
+          vi.spyOn(durableFiles, 'writeFileDurable').mockRejectedValueOnce(
+            new Error('injected publication failure')
+          )
+        }
+      } else {
+        state.withDatabase((db) =>
+          db.exec(
+            `CREATE TRIGGER reject_acceptance BEFORE INSERT ON profile_state_meta
+           WHEN NEW.key = 'legacy_json_acceptance'
+           ${phase === 'promotion' ? "AND json_type(NEW.value, '$.pending') IS NULL" : ''}
+           BEGIN SELECT RAISE(ABORT, 'injected acceptance failure'); END`
+          )
+        )
+      }
+
+      await expect(state.publish(mode)).rejects.toThrow('injected')
+
+      const published = readFileSync(state.paths.dataFile, 'utf8')
+      expect(JSON.parse(published).settings.theme).toBe(phase === 'promotion' ? 'dark' : 'light')
+      expect(state.reopen()).toBe('dark')
+      if (phase !== 'staging') {
+        expect(state.acceptance()?.pending).toEqual({
+          jsonHash: hashProfileStateJson('{"settings":{"theme":"dark"}}'),
+          acceptedRevision: 2
+        })
+      }
+      vi.restoreAllMocks()
+      state.withDatabase((db) => db.exec('DROP TRIGGER IF EXISTS reject_acceptance'))
+      state.authority.writeSerializedState(Buffer.from('{"settings":{"theme":"system"}}'))
+
+      await state.publish(mode)
+
+      expect(state.reopen()).toBe('system')
+      expect(state.acceptance()).toEqual({
+        jsonHash: hashProfileStateJson(readFileSync(state.paths.dataFile, 'utf8')),
+        acceptedRevision: 3
+      })
+    }
+  )
+
+  it('keeps the published JSON accepted when a concurrent commit prevents promotion', async () => {
+    const state = fixture()
+    const compete = () => {
+      const other = new ProfileStateSqliteAuthority(state.paths.databaseFile, state.paths.profileId)
+      try {
+        other.readSerializedState()
+        other.writeSerializedState(Buffer.from('{"settings":{"theme":"system"}}'))
+      } finally {
+        other.close()
+      }
+    }
+    if (mode === 'sync') {
+      const write = durableFiles.writeFileDurableSync
+      vi.spyOn(durableFiles, 'writeFileDurableSync').mockImplementation((...args) => {
+        write(...args)
+        if (args[1] === state.paths.dataFile) {
+          compete()
+        }
+      })
+    } else {
+      const write = durableFiles.writeFileDurable
+      vi.spyOn(durableFiles, 'writeFileDurable').mockImplementationOnce(async (...args) => {
+        await write(...args)
+        compete()
+      })
+    }
+
+    await expect(state.publish(mode)).rejects.toMatchObject({
+      code: 'profile-state-revision-conflict'
+    })
+
+    expect(JSON.parse(readFileSync(state.paths.dataFile, 'utf8')).settings.theme).toBe('dark')
+    expect(state.reopen()).toBe('system')
+    expect(state.acceptance()?.pending?.acceptedRevision).toBe(2)
+  })
+
+  it('refuses an unrelated edit even while a previous export remains staged', async () => {
+    const state = fixture()
+    if (mode === 'sync') {
+      const write = durableFiles.writeFileDurableSync
+      vi.spyOn(durableFiles, 'writeFileDurableSync').mockImplementation((...args) => {
+        if (args[1] === state.paths.dataFile) {
+          throw new Error('injected publication failure')
+        }
+        write(...args)
+      })
+    } else {
+      vi.spyOn(durableFiles, 'writeFileDurable').mockRejectedValueOnce(
+        new Error('injected publication failure')
+      )
+    }
+    await expect(state.publish(mode)).rejects.toThrow('injected')
+    expect(state.acceptance()?.pending).toEqual({
+      jsonHash: hashProfileStateJson('{"settings":{"theme":"dark"}}'),
+      acceptedRevision: 2
+    })
+    const unrelatedJson = '{"settings":{"theme":"system"},"unrelatedEdit":true}'
+    writeFileSync(state.paths.dataFile, unrelatedJson)
+
+    expect(state.reopen).toThrow('without a matching acceptance marker')
+    await expect(state.publish(mode)).rejects.toThrow('Compatibility JSON changed before export')
+    expect(readFileSync(state.paths.dataFile, 'utf8')).toBe(unrelatedJson)
+  })
+})
+
+it.each([
+  null,
+  [],
+  { jsonHash: 'invalid', acceptedRevision: 2 },
+  { jsonHash: 'a'.repeat(64), acceptedRevision: 0 },
+  { jsonHash: 'a'.repeat(64), acceptedRevision: 1.5 },
+  { jsonHash: 'a'.repeat(64), acceptedRevision: 3 }
+])('refuses malformed or impossible pending acceptance %#', (pending) => {
+  const state = fixture()
+  state.withDatabase((db) =>
+    db.prepare('UPDATE profile_state_meta SET value = ? WHERE key = ?').run(
+      JSON.stringify({
+        jsonHash: hashProfileStateJson(state.retainedJson),
+        acceptedRevision: 1,
+        pending
+      }),
+      'legacy_json_acceptance'
+    )
+  )
+  expect(state.reopen).toThrow()
+  expect(() => state.authority.writeJsonCompatibilityExport(state.paths.dataFile)).toThrow()
+  expect(readFileSync(state.paths.dataFile, 'utf8')).toBe(state.retainedJson)
+})
diff --git a/src/main/persistence/profile-state/profile-state-large-recovery-crash.test.ts b/src/main/persistence/profile-state/profile-state-large-recovery-crash.test.ts
new file mode 100644
index 00000000000..3c0096b1849
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-large-recovery-crash.test.ts
@@ -0,0 +1,149 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, join } from 'node:path'
+import { afterAll, afterEach, beforeAll, describe, expect, it } from 'vitest'
+import { acquireProfileStateMaintenance } from './profile-state-access'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath
+} from './profile-state-backup-path'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from './profile-state-database'
+import { restoreProfileStateDatabaseBackup } from './profile-state-database-recovery'
+import { writeProfileStateDatabaseSnapshotAsync } from './profile-state-database-snapshot'
+import { importProfileStateJson, readProfileStateSnapshot } from './profile-state-documents'
+import { profileStateJsonExportPath } from './legacy-json/profile-state-export-path'
+import { buildRecoveryCrashProcess, killRecoveryAt } from './profile-state-recovery-crash-process'
+
+const suite = mkdtempSync(join(tmpdir(), 'orca-large-recovery-crash-'))
+const roots: string[] = []
+const profileId = 'large-recovery'
+const oldJson = JSON.stringify({ opaque: 'x'.repeat(8 * 1024 * 1024), revision: 'old' })
+const selectedJson = JSON.stringify({ opaque: 'y'.repeat(8 * 1024 * 1024), revision: 'selected' })
+let bundle: string
+beforeAll(() => {
+  bundle = buildRecoveryCrashProcess(suite)
+})
+afterEach(() => {
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+afterAll(() => rmSync(suite, { recursive: true, force: true }))
+
+async function fixture() {
+  const root = mkdtempSync(join(suite, 'profile-'))
+  roots.push(root)
+  const directory = join(root, 'profiles', profileId)
+  mkdirSync(directory, { recursive: true })
+  const databasePath = join(directory, 'profile-state.db')
+  const dataFile = join(directory, 'orca-data.json')
+  const backupPath = profileStateDatabaseBackupPath(
+    databasePath,
+    createProfileStateDatabaseBackupId()
+  )
+  const db = openProfileStateDatabase(databasePath, profileId).db
+  try {
+    importProfileStateJson(db, oldJson)
+    importProfileStateJson(db, oldJson)
+    importProfileStateJson(db, selectedJson)
+    await writeProfileStateDatabaseSnapshotAsync(db, backupPath)
+  } finally {
+    db.close()
+  }
+  const options = {
+    root,
+    directory,
+    profileId,
+    databasePath,
+    dataFile,
+    backupPath,
+    exportPath: profileStateJsonExportPath(dataFile, 3),
+    markerPath: join(root, 'http1-compatibility.json'),
+    kind: 'sqlite' as const
+  }
+  await killRecoveryAt(bundle, options, 'seed', oldJson)
+  expect(existsSync(`${databasePath}-wal`)).toBe(true)
+  const originalFamily = new Map(
+    ['', '-wal', '-shm'].map((suffix) => [suffix, readFileSync(databasePath + suffix)])
+  )
+  return { ...options, originalFamily, backupBytes: readFileSync(backupPath) }
+}
+
+function snapshot(path: string) {
+  const db = openProfileStateDatabaseReadOnly(path, profileId).db
+  try {
+    const { json, revision } = readProfileStateSnapshot(db)
+    return { json, revision }
+  } finally {
+    db.close()
+  }
+}
+
+const boundaries = [
+  ...(process.platform === 'darwin'
+    ? [
+        'clone:1:before',
+        'clone:1:after',
+        'clone:2:before',
+        'clone:2:after',
+        'clone:3:after',
+        'clone:4:after'
+      ]
+    : []),
+  'primary',
+  'sqlite-publish:before',
+  'sqlite-publish:after'
+]
+
+describe('large independent recovery copies under process death', () => {
+  it.each(boundaries)(
+    'preserves exact backup and retry state after %s',
+    async (boundary) => {
+      const profile = await fixture()
+      const stage = boundary === 'primary' ? `removed:${profile.databasePath}` : boundary
+      await killRecoveryAt(bundle, profile, stage)
+      expect(readFileSync(profile.backupPath).equals(profile.backupBytes)).toBe(true)
+      if (boundary.startsWith('clone:')) {
+        for (const [suffix, bytes] of profile.originalFamily) {
+          expect(readFileSync(profile.databasePath + suffix).equals(bytes)).toBe(true)
+        }
+      } else {
+        const directory = readdirSync(profile.directory).find((name) =>
+          name.startsWith('profile-state-corrupt-')
+        )
+        if (directory === undefined) {
+          throw new Error('Recovery did not preserve a quarantine')
+        }
+        for (const [suffix, bytes] of profile.originalFamily) {
+          expect(
+            readFileSync(join(profile.directory, directory, `profile-state.db${suffix}`)).equals(
+              bytes
+            )
+          ).toBe(true)
+        }
+        expect(
+          readFileSync(join(profile.directory, directory, basename(profile.backupPath))).equals(
+            profile.backupBytes
+          )
+        ).toBe(true)
+        if (boundary === 'sqlite-publish:after') {
+          expect(snapshot(profile.databasePath)).toEqual({ json: selectedJson, revision: 3 })
+        } else {
+          expect(existsSync(profile.databasePath)).toBe(false)
+        }
+      }
+      const maintenance = acquireProfileStateMaintenance(profile.root)
+      try {
+        restoreProfileStateDatabaseBackup({ ...profile, maintenance })
+      } finally {
+        maintenance.release()
+      }
+      expect(snapshot(profile.databasePath)).toEqual({ json: selectedJson, revision: 3 })
+      expect(readFileSync(profile.backupPath).equals(profile.backupBytes)).toBe(true)
+    },
+    30_000
+  )
+})
diff --git a/src/main/persistence/profile-state/profile-state-live-store-factory.test.ts b/src/main/persistence/profile-state/profile-state-live-store-factory.test.ts
new file mode 100644
index 00000000000..b96d09d44f3
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-live-store-factory.test.ts
@@ -0,0 +1,215 @@
+import { build } from 'esbuild'
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
+import { agentHookServer } from '../../agent-hooks/server'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+import type { Store } from '../loading-store/store'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { createLiveProfileStateStore } from './profile-state-live-store-factory'
+import {
+  profileStateJsonExportPath,
+  profileStateJsonExportPaths
+} from './legacy-json/profile-state-export-path'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+let bundleRoot: string
+let workerOptions: { workerPath: string; backupWorkerPath: string }
+const roots: string[] = []
+const stores: Store[] = []
+
+beforeAll(async () => {
+  bundleRoot = mkdtempSync(join(tmpdir(), 'orca-live-writer-bundle-'))
+  workerOptions = {
+    workerPath: join(bundleRoot, 'profile-state-writer-worker-entry.js'),
+    backupWorkerPath: join(bundleRoot, 'profile-state-backup-worker-entry.js')
+  }
+  await build({
+    entryPoints: [
+      resolve('src/main/persistence/profile-state/profile-state-writer-worker-entry.ts'),
+      resolve('src/main/persistence/profile-state/profile-state-backup-worker-entry.ts')
+    ],
+    outdir: bundleRoot,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    logLevel: 'silent'
+  })
+})
+
+afterEach(async () => {
+  await Promise.all(stores.splice(0).map((store) => store.freezeWritesAsync()))
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+afterAll(() => rmSync(bundleRoot, { recursive: true, force: true }))
+
+function options() {
+  const root = mkdtempSync(join(tmpdir(), 'orca-live-profile-'))
+  roots.push(root)
+  return {
+    dataFile: join(root, 'orca-data.json'),
+    databaseFile: join(root, 'profile-state.db'),
+    profileId: 'live-profile-test'
+  }
+}
+
+async function open(input: ReturnType<typeof options>) {
+  const result = await createLiveProfileStateStore(input, workerOptions)
+  stores.push(result.store)
+  return result
+}
+
+function readState(input: ReturnType<typeof options>) {
+  const reader = new ProfileStateSqliteAuthority(input.databaseFile, input.profileId)
+  try {
+    return JSON.parse(reader.readSerializedState() ?? '{}')
+  } finally {
+    reader.close()
+  }
+}
+
+describe('live profile authority admission', () => {
+  it.each([false, true])(
+    'hands unbound aliases to admitted startup only (worker refused=%s)',
+    async (refused) => {
+      const input = options()
+      const source = buildProfileStateCutoverFixture(join(input.dataFile, '..'))
+      const session = source.workspaceSession
+      for (const tab of Object.values(session.tabsByWorktree).flat()) {
+        tab.ptyId = null
+      }
+      session.terminalLayoutsByTabId['tab-local'] = {
+        root: { type: 'leaf', leafId: 'pane:1' },
+        activeLeafId: 'pane:1',
+        expandedLeafId: null,
+        ptyIdsByLeafId: {}
+      }
+      writeFileSync(input.dataFile, JSON.stringify(source))
+      const register = vi.spyOn(agentHookServer, 'registerPaneKeyAlias')
+      if (refused) {
+        await expect(
+          createLiveProfileStateStore(input, {
+            workerPath: join(input.dataFile, '..', 'missing-worker.js')
+          })
+        ).rejects.toThrow()
+        expect(register).not.toHaveBeenCalled()
+        return
+      }
+      const { store } = await open(input)
+      const leafId = store.getWorkspaceSession().terminalLayoutsByTabId['tab-local'].activeLeafId
+      const userDataPath = join(input.dataFile, '..')
+      mkdirSync(join(userDataPath, 'agent-hooks'), { recursive: true })
+      writeFileSync(
+        join(userDataPath, 'agent-hooks', 'last-status.json'),
+        JSON.stringify({
+          version: 2,
+          entries: {
+            'tab-local:1': {
+              paneKey: 'tab-local:1',
+              tabId: 'tab-local',
+              worktreeId: 'repo-local::/fixture/local',
+              connectionId: null,
+              receivedAt: Date.now(),
+              stateStartedAt: Date.now(),
+              payload: { state: 'working', prompt: 'legacy cached', agentType: 'claude' }
+            }
+          }
+        })
+      )
+      try {
+        await agentHookServer.start({ env: 'production', userDataPath })
+        expect(agentHookServer.getStatusSnapshot()).toContainEqual(
+          expect.objectContaining({
+            paneKey: `tab-local:${leafId}`,
+            prompt: 'legacy cached'
+          })
+        )
+      } finally {
+        agentHookServer.stop()
+      }
+    }
+  )
+
+  it('migrates once, loads admitted state and reopens worker-acknowledged writes', async () => {
+    const input = options()
+    writeFileSync(
+      input.dataFile,
+      JSON.stringify(buildProfileStateCutoverFixture(join(input.dataFile, '..')))
+    )
+    const { store, migrated, backend } = await open(input)
+    expect({ migrated, backend }).toEqual({ migrated: true, backend: 'sqlite' })
+    store.updateSettings({ theme: 'dark' })
+    await store.flushPendingOrThrowAsync()
+    await store.freezeWritesAsync()
+    const reopened = await open(input)
+    expect(reopened.migrated).toBe(false)
+    expect(reopened.store.getSettings().theme).toBe('dark')
+    expect(readState(input).automationRuns).toHaveLength(1)
+  })
+
+  it('never adopts a competing revision between bootstrap and worker readiness', async () => {
+    const input = options()
+    const original = ProfileStateSqliteAuthority.prototype.retireForWorker
+    vi.spyOn(ProfileStateSqliteAuthority.prototype, 'retireForWorker').mockImplementation(function (
+      this: ProfileStateSqliteAuthority
+    ) {
+      const handoff = original.call(this)
+      const peer = new ProfileStateSqliteAuthority(input.databaseFile, input.profileId)
+      try {
+        peer.readSerializedState()
+        peer.writeSerializedDomains([{ domain: 'peer', payload: '{"retained":true}' }])
+      } finally {
+        peer.close()
+      }
+      return handoff
+    })
+    await expect(open(input)).rejects.toThrow('Profile state revision changed')
+    expect(readState(input).peer).toEqual({ retained: true })
+  })
+
+  it('refuses startup when the worker is unavailable without selecting JSON', async () => {
+    const input = options()
+    await expect(
+      createLiveProfileStateStore(input, { workerPath: join(bundleRoot, 'missing.js') })
+    ).rejects.toThrow('Profile state writer')
+    expect(() => readFileSync(input.dataFile)).toThrow()
+    const reopened = await open(input)
+    expect(reopened.backend).toBe('sqlite')
+  })
+
+  it('orders exports with full checkpoints and closes backup and writer handles on final flush', async () => {
+    const input = options()
+    const { store } = await open(input)
+    store.getWorkspaceSession().activeTabId = 'getter-export'
+    store.updateSettings({ theme: 'dark' })
+    const revision = await store.writeLatestProfileStateJsonExportAsync()
+    expect(revision).toBeTypeOf('number')
+    if (revision === undefined) {
+      throw new Error('Expected a persisted profile revision')
+    }
+    expect(
+      JSON.parse(readFileSync(profileStateJsonExportPath(input.dataFile, revision), 'utf8'))
+        .workspaceSession.activeTabId
+    ).toBe('getter-export')
+    store.updateSettings({ theme: 'light' })
+    await store.flushFinalOrThrowAsync({ exportJsonCompatibility: true })
+    expect(JSON.parse(readFileSync(input.dataFile, 'utf8')).settings.theme).toBe('light')
+    expect(profileStateJsonExportPaths(input.dataFile).length).toBeGreaterThan(0)
+    expect(readState(input).settings.theme).toBe('light')
+    await expect(store.flushPendingOrThrowAsync()).rejects.toThrow('finalized')
+    const reopened = await open(input)
+    expect(reopened.store.getSettings().theme).toBe('light')
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-live-store-factory.ts b/src/main/persistence/profile-state/profile-state-live-store-factory.ts
new file mode 100644
index 00000000000..8a5e29c46e8
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-live-store-factory.ts
@@ -0,0 +1,52 @@
+import { Store } from '../loading-store/store'
+import {
+  prepareProfileStateStore,
+  type ProfileStateStoreFactoryOptions,
+  type ProfileStateStoreFactoryResult
+} from './profile-state-store-factory'
+import { ProfileStateWorkerAuthority } from './profile-state-worker-authority'
+
+/** Publish live state only after its exact bootstrap revision has a worker owner. */
+export async function createLiveProfileStateStore(
+  options: ProfileStateStoreFactoryOptions,
+  workerOptions: {
+    workerPath?: string
+    backupWorkerPath?: string
+    onFailure?: (error: Error) => void
+  } = {}
+): Promise<ProfileStateStoreFactoryResult> {
+  const { initialState: initial, ...prepared } = prepareProfileStateStore(options)
+
+  // Consume before retirement: the bootstrap snapshot carries the original revision fence.
+  const parsed = initial.takeParsedState?.()
+  const serializedState = initial.serializedState
+  const authority = new ProfileStateWorkerAuthority(
+    initial.authority.retireForWorker(),
+    workerOptions
+  )
+  try {
+    await authority.ready
+    const initialAuthorityState = initial.takeParsedState
+      ? { authority, takeParsedState: () => parsed }
+      : { authority, serializedState }
+    return {
+      ...prepared,
+      store: new Store({
+        dataFile: options.dataFile,
+        storageAuthority: options.storageAuthority,
+        profileStateAuthority: authority,
+        initialAuthorityState: {
+          ...initialAuthorityState,
+          unboundPaneAliases: initial.unboundPaneAliases
+        }
+      })
+    }
+  } catch (error) {
+    try {
+      await authority.close()
+    } catch (closeError) {
+      console.error('[persistence] Failed to close a refused profile writer:', closeError)
+    }
+    throw error
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-migration.ts b/src/main/persistence/profile-state/profile-state-migration.ts
new file mode 100644
index 00000000000..43705c44dee
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-migration.ts
@@ -0,0 +1,86 @@
+import { randomUUID } from 'node:crypto'
+import { existsSync, mkdirSync, readFileSync, rmSync } from 'node:fs'
+import { dirname } from 'node:path'
+import { publishProfileStateDatabase } from './profile-state-database-publication'
+import { openProfileStateDatabase } from './profile-state-database'
+import { hashProfileStateJson, importProfileStateJson } from './profile-state-documents'
+import { writeVersionedProfileStateExport } from './legacy-json/profile-state-versioned-export'
+import { assertProfileStateCanInitialize } from './profile-state-recovery-required'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import {
+  classifyProfileStateStorage,
+  profileStateDatabaseFiles
+} from './profile-state-storage-classification'
+import type { ProfileStateAuthorityInitialState } from '../loading-store/profile-state-authority'
+
+type ProfileStateMigrationOptions = {
+  dataFile: string
+  databaseFile: string
+  profileId: string
+  expectedLegacyJson: string | undefined
+  /** Storage-form state; inactive profiles retain sealed secrets without decrypting them. */
+  serializedState: string
+}
+
+/** Publish an imported database only after its complete source has committed durably. */
+export function migrateProfileStateToSqlite(options: ProfileStateMigrationOptions): {
+  authority: ProfileStateSqliteAuthority
+  initialState: ProfileStateAuthorityInitialState<ProfileStateSqliteAuthority>
+} {
+  assertMigrationSourceUnchanged(options)
+  mkdirSync(dirname(options.databaseFile), { recursive: true })
+  const temporaryDatabaseFile = `${options.databaseFile}.migration.${process.pid}.${randomUUID()}.tmp`
+  let published = false
+  try {
+    const opened = openProfileStateDatabase(temporaryDatabaseFile, options.profileId)
+    try {
+      importProfileStateJson(
+        opened.db,
+        options.serializedState,
+        options.expectedLegacyJson === undefined
+          ? {}
+          : { acceptedLegacyJsonHash: hashProfileStateJson(options.expectedLegacyJson) }
+      )
+    } finally {
+      opened.db.close()
+    }
+
+    // Closing checkpoints the temporary database before its canonical path becomes visible.
+    assertMigrationSourceUnchanged(options)
+    if (!publishProfileStateDatabase(temporaryDatabaseFile, options.databaseFile)) {
+      throw new Error('Profile state storage changed while importing legacy JSON')
+    }
+    published = true
+    const authority = new ProfileStateSqliteAuthority(options.databaseFile, options.profileId)
+    try {
+      writeVersionedProfileStateExport(options.dataFile, (path) => authority.writeJsonExport(path))
+      const initialState = authority.readInitialState()
+      return { authority, initialState }
+    } catch (error) {
+      authority.close()
+      throw error
+    }
+  } finally {
+    if (!published) {
+      for (const path of profileStateDatabaseFiles(temporaryDatabaseFile)) {
+        rmSync(path, { force: true })
+      }
+    }
+  }
+}
+
+function assertMigrationSourceUnchanged(options: ProfileStateMigrationOptions): void {
+  assertProfileStateCanInitialize(options)
+  const expectedClassification = options.expectedLegacyJson === undefined ? 'neither' : 'json-only'
+  if (
+    classifyProfileStateStorage(options.dataFile, options.databaseFile) !== expectedClassification
+  ) {
+    throw new Error('Profile state storage changed while importing legacy JSON')
+  }
+  const currentJson = existsSync(options.dataFile)
+    ? readFileSync(options.dataFile, 'utf8')
+    : undefined
+  if (currentJson !== options.expectedLegacyJson) {
+    throw new Error('Profile state JSON changed while importing legacy JSON')
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-offline-settings.test.ts b/src/main/persistence/profile-state/profile-state-offline-settings.test.ts
new file mode 100644
index 00000000000..56f5cf0177c
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-offline-settings.test.ts
@@ -0,0 +1,135 @@
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  readAgentHookSettingsFromProfileState,
+  updateAgentHookSettingsFromProfileState
+} from './profile-state-offline-settings'
+import * as exportPaths from './legacy-json/profile-state-export-path'
+import { ProfileStateRecoveryRequiredError } from './profile-state-recovery-required'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+
+const directories: string[] = []
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function createLocation() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-offline-settings-'))
+  directories.push(directory)
+  return {
+    dataFile: join(directory, 'orca-data.json'),
+    databaseFile: join(directory, 'orca-state.db'),
+    profileId: 'profile-offline'
+  }
+}
+
+describe.each(['json', 'sqlite'] as const)('offline settings %s updates', (backend) => {
+  it('filters malformed hook settings for callers while preserving their stored values', () => {
+    const location = createLocation()
+    const original = {
+      settings: {
+        agentStatusHooksEnabled: true,
+        agentCmdOverrides: { codex: 42, claude: 'claude --model opus', gemini: null },
+        disabledTuiAgents: ['codex', false, 'future-agent', 'codex'],
+        futureSetting: { preserved: true }
+      },
+      futureDomain: { preserved: ['雪', null] }
+    }
+    const authority = new ProfileStateSqliteAuthority(location.databaseFile, location.profileId)
+    try {
+      if (backend === 'sqlite') {
+        authority.writeSerializedState(Buffer.from(JSON.stringify(original)))
+        authority.close()
+      } else {
+        writeFileSync(location.dataFile, JSON.stringify(original))
+      }
+
+      expect(updateAgentHookSettingsFromProfileState(location, false)).toEqual({
+        settingsPath: location.databaseFile,
+        settings: {
+          agentCmdOverrides: { claude: 'claude --model opus' },
+          disabledTuiAgents: ['codex', 'future-agent', 'codex']
+        }
+      })
+      const persisted = authority.readSerializedState()
+      if (backend === 'json') {
+        expect(readFileSync(location.dataFile, 'utf8')).toBe(JSON.stringify(original))
+      }
+      expect(JSON.parse(persisted ?? 'null')).toMatchObject({
+        ...original,
+        settings: { ...original.settings, agentStatusHooksEnabled: false }
+      })
+    } finally {
+      authority.close()
+    }
+  })
+})
+
+describe.each(['read', 'update'] as const)('offline settings %s recovery', (operation) => {
+  function run(location: ReturnType<typeof createLocation>) {
+    return operation === 'read'
+      ? readAgentHookSettingsFromProfileState(location)
+      : updateAgentHookSettingsFromProfileState(location, false)
+  }
+
+  it.each([true, false])('rejects retained exports with JSON present=%s', (hasJson) => {
+    const location = createLocation()
+    const source = JSON.stringify({ settings: { agentStatusHooksEnabled: true } })
+    if (hasJson) {
+      writeFileSync(location.dataFile, source)
+    }
+    const exportFile = exportPaths.profileStateJsonExportPath(location.dataFile, 1)
+    writeFileSync(exportFile, source)
+    // Recovery detection must also work in the Node 18 fallback without SQLite.
+    vi.spyOn(process, 'getBuiltinModule').mockReturnValue(undefined)
+
+    expect(() => run(location)).toThrowError(ProfileStateRecoveryRequiredError)
+    expect(existsSync(location.databaseFile)).toBe(false)
+    expect(existsSync(location.dataFile)).toBe(hasJson)
+    expect(readFileSync(exportFile, 'utf8')).toBe(source)
+    if (hasJson) {
+      expect(readFileSync(location.dataFile, 'utf8')).toBe(source)
+    }
+  })
+
+  it.each([0, 1, 2, 3, 4])('refuses defaults when only legacy backup %s remains', (slot) => {
+    const location = createLocation()
+    const backup = `${location.dataFile}.bak.${slot}`
+    const source = '{"settings":{"agentStatusHooksEnabled":false}}'
+    writeFileSync(backup, source)
+
+    expect(() => run(location)).toThrow('restore a selected backup')
+    expect(existsSync(location.dataFile)).toBe(false)
+    expect(existsSync(location.databaseFile)).toBe(false)
+    expect(readFileSync(backup, 'utf8')).toBe(source)
+  })
+
+  it('fails closed when retained exports cannot be enumerated', () => {
+    const location = createLocation()
+    vi.spyOn(exportPaths, 'profileStateJsonExportPaths').mockImplementation(() => {
+      throw new Error('permission denied')
+    })
+
+    expect(() => run(location)).toThrowError(ProfileStateRecoveryRequiredError)
+    expect(existsSync(location.dataFile)).toBe(false)
+    expect(existsSync(location.databaseFile)).toBe(false)
+  })
+
+  it.each(['-wal', '-shm', '-journal'])('rejects stale JSON when only %s remains', (suffix) => {
+    const location = createLocation()
+    const source = JSON.stringify({ settings: { agentStatusHooksEnabled: true } })
+    writeFileSync(location.dataFile, source)
+    const sidecar = `${location.databaseFile}${suffix}`
+    writeFileSync(sidecar, 'orphaned recovery evidence')
+
+    expect(() => run(location)).toThrow()
+    expect(readFileSync(location.dataFile, 'utf8')).toBe(source)
+    expect(existsSync(location.databaseFile)).toBe(false)
+    expect(readFileSync(sidecar, 'utf8')).toBe('orphaned recovery evidence')
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-offline-settings.ts b/src/main/persistence/profile-state/profile-state-offline-settings.ts
new file mode 100644
index 00000000000..1c7c85c3980
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-offline-settings.ts
@@ -0,0 +1,190 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import type { GlobalSettings } from '../../../shared/global-settings-types'
+import { getDefaultPersistedState } from '../../../shared/constants'
+import { normalizeDisabledTuiAgents } from '../../../shared/tui-agent-selection'
+import { profileStateJsonMatchesAcceptance } from './profile-state-documents'
+import { isRecord, parseProfileStateRoot } from './profile-state-document-validation'
+import {
+  isProfileStateSqliteAvailable,
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from './profile-state-database'
+import {
+  readProfileStateDomains,
+  readProfileStateDomainsWithRevisionFromDatabase
+} from './profile-state-domain-reader'
+import { writeProfileStateDomain } from './profile-state-domain-writes'
+import { assertProfileStateCanInitialize } from './profile-state-recovery-required'
+import { classifyProfileStateStorage } from './profile-state-storage-classification'
+import { migrateProfileStateToSqlite } from './profile-state-migration'
+
+export type ProfileStateOfflineLocation = {
+  dataFile: string
+  databaseFile: string
+  profileId: string
+}
+
+export type AgentHookSettings = Pick<
+  GlobalSettings,
+  'agentStatusHooksEnabled' | 'disabledTuiAgents'
+>
+
+export type AgentHookSettingsUpdate = {
+  settings: Pick<GlobalSettings, 'agentCmdOverrides' | 'disabledTuiAgents'>
+  settingsPath: string
+}
+
+/** Read the settings domain without creating SQLite for a JSON-only profile. */
+export function readAgentHookSettingsFromProfileState(
+  location: ProfileStateOfflineLocation
+): AgentHookSettings {
+  const classification = classifyProfileStateStorage(location.dataFile, location.databaseFile)
+  if (classification === 'json-only' || classification === 'neither') {
+    assertProfileStateCanInitialize(location)
+    return readAgentHookSettingsFromJson(location.dataFile)
+  }
+
+  assertSqliteCapability()
+  assertAcceptedLegacyJson(location, classification)
+  const result = readProfileStateDomains(location.databaseFile, location.profileId, ['settings'])
+  if (result.kind === 'unreadable') {
+    throw result.error
+  }
+  return readAgentHookSettingsFromSettingsValue(result.values.get('settings'))
+}
+
+/**
+ * Update only the settings row in an existing SQLite authority.
+ *
+ * The snapshot revision is checked again by BEGIN IMMEDIATE, so a runtime
+ * writer between read and update produces a conflict instead of clobbering it.
+ */
+export function updateAgentHookSettingsInProfileState(
+  location: ProfileStateOfflineLocation,
+  enabled: boolean
+): AgentHookSettingsUpdate {
+  const classification = classifyProfileStateStorage(location.dataFile, location.databaseFile)
+  if (classification === 'json-only' || classification === 'neither') {
+    throw new Error('SQLite profile state is not established for this profile')
+  }
+
+  assertSqliteCapability()
+  assertAcceptedLegacyJson(location, classification)
+  const opened = openProfileStateDatabase(location.databaseFile, location.profileId)
+  try {
+    const domains = readProfileStateDomainsWithRevisionFromDatabase(opened.db, ['settings'])
+    if (domains.kind === 'unreadable') {
+      throw domains.error
+    }
+    const persistedSettings = domains.values.get('settings')
+    const settings = {
+      ...getDefaultPersistedState(homedir()).settings,
+      ...(isRecord(persistedSettings) ? persistedSettings : {}),
+      agentStatusHooksEnabled: enabled
+    }
+    writeProfileStateDomain(opened.db, {
+      domain: 'settings',
+      payload: JSON.stringify(settings),
+      expectedRevision: domains.revision
+    })
+    return {
+      settingsPath: location.databaseFile,
+      settings: projectAgentHookSettings(settings)
+    }
+  } finally {
+    opened.db.close()
+  }
+}
+
+/** The caller holds maintenance ownership through import and the fenced settings write. */
+export function updateAgentHookSettingsFromProfileState(
+  location: ProfileStateOfflineLocation,
+  enabled: boolean
+): AgentHookSettingsUpdate {
+  const classification = classifyProfileStateStorage(location.dataFile, location.databaseFile)
+  if (classification === 'json-only' || classification === 'neither') {
+    assertProfileStateCanInitialize(location)
+    assertOfflineProfileStateMutationRuntime()
+    const rawJson = existsSync(location.dataFile)
+      ? readFileSync(location.dataFile, 'utf8')
+      : undefined
+    const migrated = migrateProfileStateToSqlite({
+      ...location,
+      expectedLegacyJson: rawJson,
+      serializedState: rawJson ?? JSON.stringify(getDefaultPersistedState(homedir()))
+    })
+    migrated.authority.close()
+  }
+  return updateAgentHookSettingsInProfileState(location, enabled)
+}
+
+export function assertOfflineProfileStateMutationRuntime(): void {
+  if (!isProfileStateSqliteAvailable()) {
+    throw new Error(
+      'Changing agent hooks offline requires the bundled Orca CLI. Run that launcher, or start Orca and retry this command.'
+    )
+  }
+}
+
+function projectAgentHookSettings(
+  settings: AgentHookSettingsUpdate['settings']
+): AgentHookSettingsUpdate['settings'] {
+  return {
+    agentCmdOverrides: isRecord(settings.agentCmdOverrides)
+      ? Object.fromEntries(
+          Object.entries(settings.agentCmdOverrides).filter(
+            ([, value]) => typeof value === 'string'
+          )
+        )
+      : {},
+    disabledTuiAgents: Array.isArray(settings.disabledTuiAgents)
+      ? settings.disabledTuiAgents.filter((value) => typeof value === 'string')
+      : []
+  }
+}
+
+function assertSqliteCapability(): void {
+  if (!isProfileStateSqliteAvailable()) {
+    throw new Error('SQLite profile state is present but this runtime cannot validate it')
+  }
+}
+
+function assertAcceptedLegacyJson(
+  location: ProfileStateOfflineLocation,
+  classification: 'sqlite-only' | 'both'
+): void {
+  if (classification === 'sqlite-only') {
+    if (!existsSync(location.databaseFile)) {
+      throw new Error('SQLite profile state has an orphaned database sidecar')
+    }
+    return
+  }
+
+  const rawJson = readFileSync(location.dataFile, 'utf8')
+  const opened = openProfileStateDatabaseReadOnly(location.databaseFile, location.profileId)
+  try {
+    if (!profileStateJsonMatchesAcceptance(opened.db, rawJson)) {
+      throw new Error(
+        'Profile state has both JSON and SQLite storage without a matching acceptance marker'
+      )
+    }
+  } finally {
+    opened.db.close()
+  }
+}
+
+function readAgentHookSettingsFromJson(dataFile: string): AgentHookSettings {
+  const settings = existsSync(dataFile)
+    ? parseProfileStateRoot(readFileSync(dataFile, 'utf8')).settings
+    : getDefaultPersistedState(homedir()).settings
+  return readAgentHookSettingsFromSettingsValue(settings)
+}
+
+function readAgentHookSettingsFromSettingsValue(value: unknown): AgentHookSettings {
+  const settings = isRecord(value) ? value : {}
+  return {
+    agentStatusHooksEnabled: settings.agentStatusHooksEnabled !== false,
+    disabledTuiAgents: normalizeDisabledTuiAgents(settings.disabledTuiAgents)
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-parsed-snapshot.test.ts b/src/main/persistence/profile-state/profile-state-parsed-snapshot.test.ts
new file mode 100644
index 00000000000..428622f8c6d
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-parsed-snapshot.test.ts
@@ -0,0 +1,158 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { openProfileStateDatabase } from './profile-state-database'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readAcceptedProfileStateParsedSnapshot,
+  readProfileStateDocuments,
+  readProfileStateParsedSnapshot,
+  readProfileStateSnapshot,
+  validateProfileStateSnapshot
+} from './profile-state-documents'
+
+const directories: string[] = []
+afterEach(() => {
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-parsed-profile-'))
+  directories.push(directory)
+  return openProfileStateDatabase(join(directory, 'profile-state.db'), 'parsed-profile').db
+}
+
+describe('checked profile state values', () => {
+  it.each([
+    [
+      'row hash',
+      "UPDATE profile_state_automation_runs SET payload = '{}' WHERE ordinal = 0",
+      'row is corrupt'
+    ],
+    [
+      'ordering',
+      'UPDATE profile_state_automation_runs SET ordinal = 3 WHERE ordinal = 0',
+      'ordering is corrupt'
+    ],
+    [
+      'revision',
+      'UPDATE profile_state_automation_runs SET revision = 99 WHERE ordinal = 0',
+      'metadata is inconsistent'
+    ],
+    [
+      'timestamp',
+      'UPDATE profile_state_automation_runs SET updated_at = updated_at + 1 WHERE ordinal = 0',
+      'metadata is inconsistent'
+    ]
+  ])('rejects corrupt normalized %s in both representations', (_, sql, message) => {
+    const db = fixture()
+    try {
+      importProfileStateJson(db, '{"automationRuns":[{"id":"a"},{"id":"b"}]}')
+      db.exec(sql)
+      expect(() => readProfileStateParsedSnapshot(db)).toThrow(message)
+      expect(() => readProfileStateSnapshot(db)).toThrow(message)
+      expect(() => validateProfileStateSnapshot(db)).toThrow(message)
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rejects a normalized identity mismatch even when the payload hash is valid', () => {
+    const db = fixture()
+    try {
+      importProfileStateJson(db, '{"automationRuns":[{"id":"a"}]}')
+      const payload = '{"id":"other"}'
+      db.prepare('UPDATE profile_state_automation_runs SET payload = ?, content_hash = ?').run(
+        payload,
+        hashProfileStateJson(payload)
+      )
+      expect(() => readProfileStateParsedSnapshot(db)).toThrow('identity is corrupt')
+      expect(() => readProfileStateSnapshot(db)).toThrow('identity is corrupt')
+      expect(() => validateProfileStateSnapshot(db)).toThrow('identity is corrupt')
+    } finally {
+      db.close()
+    }
+  })
+
+  it.each([
+    undefined,
+    null,
+    [],
+    [
+      { id: 'second', unknown: '雪 🐋\ud800' },
+      { id: 'first', unknown: null }
+    ],
+    { futureHistoryFormat: true },
+    [{ id: 'duplicate' }, { id: 'duplicate' }]
+  ])('matches serialized semantics for history %j', (automationRuns) => {
+    const db = fixture()
+    try {
+      const source = JSON.stringify(
+        Object.fromEntries([
+          ['z', { sealed: 'safeStorage:unchanged' }],
+          ['__proto__', { own: true }],
+          ['10', 'ten'],
+          ['2', 'two'],
+          ['constructor', 'own constructor'],
+          ['automationRuns', automationRuns],
+          ['a', null]
+        ])
+      )
+      importProfileStateJson(db, source, { acceptedLegacyJsonHash: hashProfileStateJson(source) })
+      const serialized = readProfileStateSnapshot(db)
+      const expected: unknown = JSON.parse(serialized.json)
+      const parsed = readProfileStateParsedSnapshot(db)
+      expect(parsed).toStrictEqual({ revision: serialized.revision, state: expected })
+      expect(Object.keys(parsed.state)).toEqual(Object.keys(JSON.parse(source)))
+      expect(Object.hasOwn(parsed.state, '__proto__')).toBe(true)
+      expect(Object.getPrototypeOf(parsed.state)).toBe(Object.prototype)
+      expect(readAcceptedProfileStateParsedSnapshot(db, source)).toStrictEqual(parsed)
+      expect(readAcceptedProfileStateParsedSnapshot(db, '{}')).toBeUndefined()
+      expect(
+        readProfileStateDocuments(db).every((document) => !Object.hasOwn(document, 'value'))
+      ).toBe(true)
+      expect(readProfileStateSnapshot(db).json).toBe(serialized.json)
+    } finally {
+      db.close()
+    }
+  })
+
+  it('validates original bytes while reusing noncanonical JSON values', () => {
+    const db = fixture()
+    try {
+      importProfileStateJson(db, '{"future":null,"automationRuns":[{"id":"a"},{"id":"b"}]}')
+      const future =
+        ' {"negativeZero":-0,"large":1e400,"duplicate":1,"duplicate":2,"text":"雪\\ud800"} '
+      db.prepare(
+        'UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = ?'
+      ).run(future, hashProfileStateJson(future), 'future')
+      const payloads = [' {"id":"a","number":-0,"large":1e400} ', '{"id":"b","text":"雪\\ud800"}']
+      for (const [ordinal, payload] of payloads.entries()) {
+        db.prepare(
+          'UPDATE profile_state_automation_runs SET payload = ?, content_hash = ? WHERE ordinal = ?'
+        ).run(payload, hashProfileStateJson(payload), ordinal)
+      }
+      const aggregate = `[${payloads.join(',')}]`
+      db.prepare('UPDATE profile_state_automation_runs_meta SET content_hash = ?').run(
+        hashProfileStateJson(aggregate)
+      )
+      const serialized = readProfileStateSnapshot(db)
+      expect(serialized.json).toBe(`{"future":${future},"automationRuns":${aggregate}}`)
+      expect(readProfileStateParsedSnapshot(db)).toStrictEqual({
+        revision: serialized.revision,
+        state: JSON.parse(serialized.json)
+      })
+      db.prepare('UPDATE profile_state_automation_runs_meta SET content_hash = ?').run(
+        hashProfileStateJson(JSON.stringify(JSON.parse(aggregate)))
+      )
+      expect(() => readProfileStateParsedSnapshot(db)).toThrow('aggregate hash mismatch')
+      expect(() => readProfileStateSnapshot(db)).toThrow('aggregate hash mismatch')
+    } finally {
+      db.close()
+    }
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-read-concurrency.test.ts b/src/main/persistence/profile-state/profile-state-read-concurrency.test.ts
new file mode 100644
index 00000000000..0f6307e47d3
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-read-concurrency.test.ts
@@ -0,0 +1,174 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from './profile-state-database'
+import { verifyProfileStateSchema } from './profile-state-database-validation'
+import {
+  importProfileStateJson,
+  readProfileStateSnapshot,
+  readProfileStateParsedSnapshot,
+  validateProfileStateSnapshot
+} from './profile-state-documents'
+import { readProfileStateDomainsWithRevisionFromDatabase } from './profile-state-domain-reader'
+import { writeProfileStateDomains } from './profile-state-domain-writes'
+import * as revisions from './profile-state-revision'
+
+const directories: string[] = []
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-read-concurrency-'))
+  directories.push(directory)
+  const path = join(directory, 'profile-state.db')
+  const { db } = openProfileStateDatabase(path, 'profile-a')
+  importProfileStateJson(db, '{"automationRuns":[{"id":"run-1","status":"pending"}]}')
+  return { path, db }
+}
+
+describe('profile state reads during concurrent commits', () => {
+  it.each([readProfileStateSnapshot, readProfileStateParsedSnapshot, validateProfileStateSnapshot])(
+    'keeps revision and documents together when a writer commits during %s',
+    (read) => {
+      const { path, db: writer } = fixture()
+      const { db: reader } = openProfileStateDatabaseReadOnly(path, 'profile-a')
+      const readRevision = revisions.readProfileStateRevision
+      let committed = false
+      vi.spyOn(revisions, 'readProfileStateRevision').mockImplementation((db) => {
+        const revision = readRevision(db)
+        if (db === reader && !committed) {
+          committed = true
+          writeProfileStateDomains(writer, {
+            expectedRevision: 1,
+            replacements: [{ domain: 'automationRuns', payload: '[]' }]
+          })
+        }
+        return revision
+      })
+      try {
+        const snapshot = read(reader)
+        expect(committed).toBe(true)
+        if (typeof snapshot === 'number') {
+          expect(snapshot).toBe(1)
+        } else {
+          expect(snapshot).toMatchObject({ revision: 1 })
+          expect(snapshot).toMatchObject(
+            read === readProfileStateSnapshot
+              ? { json: '{"automationRuns":[{"id":"run-1","status":"pending"}]}' }
+              : { state: { automationRuns: [{ id: 'run-1', status: 'pending' }] } }
+          )
+        }
+        expect(reader.isTransaction).toBe(false)
+        const next = read(reader)
+        expect(typeof next === 'number' ? next : next.revision).toBe(2)
+      } finally {
+        reader.close()
+        writer.close()
+      }
+    }
+  )
+
+  it.each([
+    ['read-only', openProfileStateDatabaseReadOnly],
+    ['writable', openProfileStateDatabase]
+  ] as const)(
+    'opens a healthy %s database when automation state changes between validation reads',
+    (_, open) => {
+      const { path, db: writer } = fixture()
+      const readRevision = revisions.readProfileStateRevision
+      let committed = false
+      vi.spyOn(revisions, 'readProfileStateRevision').mockImplementation((reader) => {
+        const revision = readRevision(reader)
+        if (reader !== writer && !committed) {
+          committed = true
+          writeProfileStateDomains(writer, {
+            expectedRevision: 1,
+            replacements: [{ domain: 'automationRuns', payload: '[]' }]
+          })
+        }
+        return revision
+      })
+      try {
+        const opened = open(path, 'profile-a')
+        try {
+          expect(committed).toBe(true)
+          expect(opened.db.isTransaction).toBe(false)
+          expect(readProfileStateParsedSnapshot(opened.db)).toEqual({
+            revision: 2,
+            state: { automationRuns: [] }
+          })
+          expect(readProfileStateSnapshot(opened.db)).toMatchObject({
+            revision: 2,
+            json: '{"automationRuns":[]}'
+          })
+        } finally {
+          opened.db.close()
+        }
+      } finally {
+        writer.close()
+      }
+    }
+  )
+
+  it('keeps caller-owned writes uncommitted through schema, full and selected reads', () => {
+    const { db } = fixture()
+    try {
+      db.exec('BEGIN IMMEDIATE')
+      db.prepare('INSERT INTO profile_state_meta (key, value) VALUES (?, ?)').run('probe', 'value')
+      verifyProfileStateSchema(db, 'profile-a')
+      expect(readProfileStateSnapshot(db).revision).toBe(1)
+      expect(readProfileStateParsedSnapshot(db).revision).toBe(1)
+      expect(readProfileStateDomainsWithRevisionFromDatabase(db, ['automationRuns'])).toEqual({
+        kind: 'values',
+        revision: 1,
+        values: new Map([['automationRuns', [{ id: 'run-1', status: 'pending' }]]])
+      })
+      expect(db.isTransaction).toBe(true)
+      db.exec('ROLLBACK')
+      expect(
+        db.prepare('SELECT value FROM profile_state_meta WHERE key = ?').get('probe')
+      ).toBeUndefined()
+    } finally {
+      db.close()
+    }
+  })
+
+  it.each(['owned', 'caller'] as const)(
+    'preserves corrupt state and releases only %s read transactions',
+    (ownership) => {
+      const { db } = fixture()
+      try {
+        if (ownership === 'caller') {
+          db.exec('BEGIN IMMEDIATE')
+        }
+        db.exec('DELETE FROM profile_state_automation_runs_meta')
+        expect(() => verifyProfileStateSchema(db, 'profile-a')).toThrow('metadata is malformed')
+        expect(() => readProfileStateSnapshot(db)).toThrow('metadata is malformed')
+        expect(() => readProfileStateParsedSnapshot(db)).toThrow('metadata is malformed')
+        expect(readProfileStateDomainsWithRevisionFromDatabase(db, ['automationRuns']).kind).toBe(
+          'unreadable'
+        )
+        expect(db.isTransaction).toBe(ownership === 'caller')
+        expect(db.prepare('SELECT domain FROM profile_state_automation_runs_meta').all()).toEqual(
+          []
+        )
+        if (ownership === 'caller') {
+          db.exec('ROLLBACK')
+          expect(readProfileStateSnapshot(db).revision).toBe(1)
+          expect(readProfileStateParsedSnapshot(db).revision).toBe(1)
+        }
+      } finally {
+        db.close()
+      }
+    }
+  )
+})
diff --git a/src/main/persistence/profile-state/profile-state-read-snapshot.ts b/src/main/persistence/profile-state/profile-state-read-snapshot.ts
new file mode 100644
index 00000000000..415c1721071
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-read-snapshot.ts
@@ -0,0 +1,37 @@
+import type Database from '../../sqlite/sync-database'
+
+export class ProfileStateReadRollbackError extends Error {
+  readonly code = 'profile-state-read-rollback-failed' as const
+
+  constructor(
+    cause: unknown,
+    readonly rollbackError: unknown
+  ) {
+    super('Profile state read failed without releasing its transaction', { cause })
+    this.name = 'ProfileStateReadRollbackError'
+  }
+}
+
+/** Reuse a caller's transaction without committing or rolling it back. */
+export function withProfileStateReadSnapshot<T>(db: Database.Database, read: () => T): T {
+  const ownsTransaction = !db.isTransaction
+  if (ownsTransaction) {
+    db.exec('BEGIN')
+  }
+  try {
+    const result = read()
+    if (ownsTransaction) {
+      db.exec('COMMIT')
+    }
+    return result
+  } catch (error) {
+    if (ownsTransaction && db.isTransaction) {
+      try {
+        db.exec('ROLLBACK')
+      } catch (rollbackError) {
+        throw new ProfileStateReadRollbackError(error, rollbackError)
+      }
+    }
+    throw error
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-recovery-batch.test.ts b/src/main/persistence/profile-state/profile-state-recovery-batch.test.ts
new file mode 100644
index 00000000000..82e4ccf708e
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-recovery-batch.test.ts
@@ -0,0 +1,227 @@
+import {
+  closeSync,
+  copyFileSync,
+  existsSync,
+  ftruncateSync,
+  mkdirSync,
+  mkdtempSync,
+  openSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+  writeSync
+} from 'node:fs'
+import type * as FileSystem from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, dirname, isAbsolute, join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import * as processes from '../../../shared/child-process/run-process'
+import { copyProfileStateRecoveryFiles } from './profile-state-recovery-copy'
+import { quarantineProfileStateDatabase } from './profile-state-database-quarantine'
+
+const publication = vi.hoisted(() => ({ unsupportedTarget: '' }))
+vi.mock('node:fs', async (original) => {
+  const actual = await original<typeof FileSystem>()
+  return {
+    ...actual,
+    linkSync: (...args: Parameters<typeof actual.linkSync>) => {
+      if (args[1] === publication.unsupportedTarget) {
+        throw Object.assign(new Error('hardlinks unavailable'), { code: 'ENOTSUP' })
+      }
+      return actual.linkSync(...args)
+    }
+  }
+})
+
+const directories: string[] = []
+afterEach(() => {
+  publication.unsupportedTarget = ''
+  vi.restoreAllMocks()
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture(names = ['primary.db', 'backup.db'], large = true) {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-recovery-batch-'))
+  directories.push(directory)
+  const files = names.map((name, index) => {
+    const sourceDirectory = join(directory, `source-${index}`)
+    mkdirSync(sourceDirectory)
+    const source = join(sourceDirectory, name)
+    const descriptor = openSync(source, 'wx', 0o600)
+    try {
+      ftruncateSync(descriptor, large ? 8 * 1024 * 1024 + 1 : 128)
+      writeSync(descriptor, Buffer.from(`retained-${index}`))
+    } finally {
+      closeSync(descriptor)
+    }
+    return { source, target: join(directory, `restored-${index}.db`) }
+  })
+  return { directory, files }
+}
+
+function expectIndependent(files: ReturnType<typeof fixture>['files']): void {
+  for (const { source, target } of files) {
+    const original = readFileSync(source)
+    expect(readFileSync(target).equals(original)).toBe(true)
+    expect(statSync(source, { bigint: true }).ino).not.toBe(statSync(target, { bigint: true }).ino)
+    writeFileSync(source, 'changed source')
+    expect(readFileSync(target).equals(original)).toBe(true)
+  }
+}
+
+function expectNoTemporary(directory: string): void {
+  expect(readdirSync(directory).some((name) => name.startsWith('.orca-recovery-clone-'))).toBe(
+    false
+  )
+}
+
+describe('batched profile recovery copies', () => {
+  it.each(['manifest.json', 'MANIFEST.JSON'])(
+    'preserves a recovery artifact named %s without overwriting it with a manifest',
+    (name) => {
+      const { directory, files } = fixture(['primary.db', name], false)
+      const artifact = files[1].source
+      const original = readFileSync(artifact)
+      const quarantine = () =>
+        quarantineProfileStateDatabase(files[0].source, 'profile', directory, 'test', [artifact])
+      if (existsSync(join(dirname(artifact), 'manifest.json'))) {
+        expect(quarantine).toThrow('conflicts with the quarantine manifest')
+        expect(
+          readdirSync(directory).some((entry) => entry.startsWith('profile-state-corrupt-'))
+        ).toBe(false)
+      } else {
+        const result = quarantine()
+        expect(readFileSync(join(result.directory, name)).equals(original)).toBe(true)
+      }
+      expect(readFileSync(artifact).equals(original)).toBe(true)
+      expect(existsSync(files[0].source)).toBe(true)
+    }
+  )
+
+  it.each([false, true])('preserves every independent file with large copies=%s', (large) => {
+    const { directory, files } = fixture(undefined, large)
+    copyProfileStateRecoveryFiles(files)
+    expectIndependent(files)
+    expectNoTemporary(directory)
+  })
+
+  it('does nothing for an empty batch', () => {
+    const run = vi.spyOn(processes, 'runProcessSync')
+    copyProfileStateRecoveryFiles([])
+    expect(run).not.toHaveBeenCalled()
+  })
+
+  describe.skipIf(process.platform !== 'darwin')('Darwin batch boundaries', () => {
+    it('shares one process with absolute arguments and the per-file timeout budget', () => {
+      const { directory, files } = fixture()
+      const run = vi.spyOn(processes, 'runProcessSync')
+      copyProfileStateRecoveryFiles(files)
+      expect(run).toHaveBeenCalledOnce()
+      const spec = run.mock.calls[0]?.[0]
+      expect(spec?.args?.slice(1).every(isAbsolute)).toBe(true)
+      expect(spec?.args).toHaveLength(4)
+      expect(spec?.timeoutMs).toBe(60_000)
+      expectIndependent(files)
+      expectNoTemporary(directory)
+    })
+
+    it('bounds a shared process when many large artifacts are retained', () => {
+      const { directory, files } = fixture(
+        Array.from({ length: 17 }, (_, index) => `backup-${index}.db`)
+      )
+      const run = vi.spyOn(processes, 'runProcessSync')
+      copyProfileStateRecoveryFiles(files)
+      expect(run).toHaveBeenCalledTimes(2)
+      expect(run.mock.calls.every(([spec]) => (spec.args?.length ?? 0) <= 18)).toBe(true)
+      expectIndependent(files)
+      expectNoTemporary(directory)
+    })
+
+    it.each([
+      ['same.db', 'same.db'],
+      ['CASE.db', 'case.db'],
+      ['é.db', 'e\u0301.db'],
+      ['suffix.db.', 'suffix.db'],
+      ['- leading space.db', 'plain.db']
+    ])('isolates ambiguous source names %s and %s', (...names) => {
+      const { directory, files } = fixture(names)
+      const run = vi.spyOn(processes, 'runProcessSync')
+      copyProfileStateRecoveryFiles(files)
+      expect(run).toHaveBeenCalledTimes(2)
+      expectIndependent(files)
+      expectNoTemporary(directory)
+    })
+
+    it.each(['timeout', 'signal', 'spawn'] as const)(
+      'publishes no cloned files after a batch %s failure',
+      (failure) => {
+        const { directory, files } = fixture()
+        vi.spyOn(processes, 'runProcessSync').mockImplementation(() => {
+          if (failure === 'spawn') {
+            throw new Error('copy process could not start')
+          }
+          return {
+            code: null,
+            signal: 'SIGTERM',
+            timedOut: failure === 'timeout',
+            stdout: '',
+            stderr: ''
+          }
+        })
+        expect(() => copyProfileStateRecoveryFiles(files)).toThrow()
+        for (const { source, target } of files) {
+          expect(existsSync(source)).toBe(true)
+          expect(existsSync(target)).toBe(false)
+        }
+        expectNoTemporary(directory)
+      }
+    )
+
+    it('discards partial process output before falling back for every source', () => {
+      const { directory, files } = fixture()
+      vi.spyOn(processes, 'runProcessSync').mockImplementation((spec) => {
+        const temporaryDirectory = spec.args?.at(-1)
+        if (!temporaryDirectory) {
+          throw new Error('Missing clone directory')
+        }
+        expect(statSync(temporaryDirectory).mode & 0o777).toBe(0o700)
+        writeFileSync(join(temporaryDirectory, basename(files[0].source)), 'incomplete')
+        return { code: 1, signal: null, timedOut: false, stdout: '', stderr: 'clone unavailable' }
+      })
+      copyProfileStateRecoveryFiles(files)
+      expectIndependent(files)
+      expectNoTemporary(directory)
+    })
+
+    it('preserves a destination created during the batch process', () => {
+      const { directory, files } = fixture()
+      vi.spyOn(processes, 'runProcessSync').mockImplementation((spec) => {
+        const temporaryDirectory = spec.args?.at(-1)
+        if (!temporaryDirectory) {
+          throw new Error('Missing clone directory')
+        }
+        for (const { source } of files) {
+          copyFileSync(source, join(temporaryDirectory, basename(source)))
+        }
+        writeFileSync(files[1].target, 'concurrent destination')
+        return { code: 0, signal: null, timedOut: false, stdout: '', stderr: '' }
+      })
+      expect(() => copyProfileStateRecoveryFiles(files)).toThrow()
+      expect(readFileSync(files[1].target, 'utf8')).toBe('concurrent destination')
+      expect(readFileSync(files[0].target).equals(readFileSync(files[0].source))).toBe(true)
+      expectNoTemporary(directory)
+    })
+
+    it('falls back independently when one destination cannot publish hardlinks', () => {
+      const { directory, files } = fixture()
+      publication.unsupportedTarget = files[1].target
+      copyProfileStateRecoveryFiles(files)
+      expectIndependent(files)
+      expectNoTemporary(directory)
+    })
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-recovery-command.ts b/src/main/persistence/profile-state/profile-state-recovery-command.ts
new file mode 100644
index 00000000000..750df221f1c
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-recovery-command.ts
@@ -0,0 +1,206 @@
+import { existsSync, readFileSync, rmSync } from 'node:fs'
+import {
+  ProfileStateRecoveryCommandError,
+  type ProfileStateRecoverySelector,
+  type ProfileStateExportsResult,
+  type ProfileStateRollbackResult
+} from '../../../shared/profile-state-recovery-command'
+import { getActiveProfileStateLocation } from './profile-state-active-location'
+import {
+  profileStateJsonExportPath,
+  profileStateJsonExportPaths
+} from './legacy-json/profile-state-export-path'
+import { profileStateDatabaseBackups } from './profile-state-backup-path'
+import { restoreProfileStateJsonExport } from './legacy-json/profile-state-recovery'
+import { restoreProfileStateDatabaseBackup } from './profile-state-database-recovery'
+import { quarantineProfileStateDatabase } from './profile-state-database-quarantine'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { durableWriteTempPath, writeFileDurableSync } from '../../durable-file-write'
+import type { ProfileStateMaintenance } from './profile-state-access'
+import { readProfileStateDomain } from './profile-state-domain-reader'
+import { isRecord } from './profile-state-document-validation'
+import { profileHasPendingProjectMove } from '../../orca-profiles/profile-project-move-record'
+import {
+  invalidateHttp1CompatibilityMarker,
+  writeHttp1CompatibilityMarker
+} from '../../startup/http1-compatibility-marker'
+
+export function getProfileStateExports(userDataPath: string): ProfileStateExportsResult {
+  const location = getActiveProfileStateLocation(userDataPath)
+  if (location === undefined) {
+    throw new ProfileStateRecoveryCommandError(
+      'runtime_error',
+      'No active profile is available for recovery.'
+    )
+  }
+  return {
+    profileId: location.profileId,
+    dataFile: location.dataFile,
+    databaseFile: location.databaseFile,
+    exportPaths: profileStateJsonExportPaths(location.dataFile),
+    backups: profileStateDatabaseBackups(location.databaseFile)
+  }
+}
+
+export function rollbackProfileState(
+  userDataPath: string,
+  selector: ProfileStateRecoverySelector,
+  maintenance: ProfileStateMaintenance
+): ProfileStateRollbackResult {
+  const result = getProfileStateExports(userDataPath)
+  if (profileHasPendingProjectMove(result.profileId, userDataPath)) {
+    throw new ProfileStateRecoveryCommandError(
+      'runtime_error',
+      'This profile has a pending project move. Resolve the move with both profiles preserved before restoring a single profile.'
+    )
+  }
+  if (selector.kind === 'sqlite') {
+    return restoreDatabaseBackup(userDataPath, result, selector.backupId, maintenance)
+  }
+  if (selector.kind === 'current-sqlite') {
+    return adoptCurrentDatabase(userDataPath, result, maintenance)
+  }
+  const revision = selector.kind === 'json' ? selector.revision : null
+  const exportPath =
+    revision === null ? result.dataFile : profileStateJsonExportPath(result.dataFile, revision)
+  if (revision !== null && !result.exportPaths.includes(exportPath)) {
+    throw new ProfileStateRecoveryCommandError(
+      'invalid_argument',
+      `Profile-state export revision ${revision} is unavailable. Use profile state exports to inspect retained revisions.`
+    )
+  }
+  const recovered = restoreProfileStateJsonExport({
+    maintenance,
+    databasePath: result.databaseFile,
+    dataFile: result.dataFile,
+    exportPath,
+    profileId: result.profileId,
+    ...(revision === null ? { reason: 'profile-state-adopt-current-json' } : {}),
+    beforeRestore: () => invalidateHttp1CompatibilityMarker(userDataPath)
+  })
+  syncHttp1CompatibilityMarkerAfterRollback(userDataPath, result.dataFile, result.profileId)
+  return {
+    ...result,
+    storage: 'json',
+    restoredPath: result.dataFile,
+    revision,
+    quarantineDirectory: recovered.quarantine.directory,
+    removedDatabaseFiles: recovered.removedDatabaseFiles
+  }
+}
+
+function restoreDatabaseBackup(
+  userDataPath: string,
+  result: ProfileStateExportsResult,
+  backupId: string,
+  maintenance: ProfileStateMaintenance
+): ProfileStateRollbackResult {
+  const backup = result.backups.find((entry) => entry.id === backupId)
+  if (!backup) {
+    throw new ProfileStateRecoveryCommandError(
+      'invalid_argument',
+      'Profile-state backup is unavailable. Use profile state exports to inspect retained backups.'
+    )
+  }
+  const recovered = restoreProfileStateDatabaseBackup({
+    maintenance,
+    databasePath: result.databaseFile,
+    dataFile: result.dataFile,
+    backupPath: backup.path,
+    profileId: result.profileId,
+    beforeRestore: () => invalidateHttp1CompatibilityMarker(userDataPath)
+  })
+  syncHttp1CompatibilityMarkerFromDatabase(userDataPath, result)
+  return {
+    ...result,
+    storage: 'sqlite',
+    restoredPath: result.databaseFile,
+    backupId: backup.id,
+    revision: recovered.revision,
+    quarantineDirectory: recovered.quarantine.directory,
+    removedDatabaseFiles: recovered.removedDatabaseFiles
+  }
+}
+
+/** Keep SQLite and replace diverged JSON (e.g. edited by an older build) with its export. */
+function adoptCurrentDatabase(
+  userDataPath: string,
+  result: ProfileStateExportsResult,
+  maintenance: ProfileStateMaintenance
+): ProfileStateRollbackResult {
+  maintenance.assertProfile(result.profileId, result.dataFile, result.databaseFile)
+  const authority = new ProfileStateSqliteAuthority(result.databaseFile, result.profileId)
+  try {
+    // Validate before archiving so an unreadable database leaves both copies untouched.
+    authority.readInitialState()
+    if (authority.revision === 0) {
+      throw new ProfileStateRecoveryCommandError(
+        'runtime_error',
+        'SQLite profile state is empty. Keep the current JSON instead.'
+      )
+    }
+    const quarantine = quarantineProfileStateDatabase(
+      result.databaseFile,
+      result.profileId,
+      undefined,
+      'profile-state-adopt-current-sqlite',
+      existsSync(result.dataFile) ? [result.dataFile] : []
+    )
+    invalidateHttp1CompatibilityMarker(userDataPath)
+    // A retained JSON the marker never accepted would fail the compatibility export's fence.
+    const divergedJson = existsSync(result.dataFile) ? readFileSync(result.dataFile) : undefined
+    rmSync(result.dataFile, { force: true })
+    let revision: number
+    try {
+      revision = authority.writeJsonCompatibilityExport(result.dataFile) ?? authority.revision
+    } catch (error) {
+      if (divergedJson !== undefined && !existsSync(result.dataFile)) {
+        writeFileDurableSync(durableWriteTempPath(result.dataFile), result.dataFile, divergedJson)
+      }
+      throw error
+    }
+    syncHttp1CompatibilityMarkerFromDatabase(userDataPath, result)
+    return {
+      ...result,
+      storage: 'sqlite',
+      restoredPath: result.databaseFile,
+      revision,
+      quarantineDirectory: quarantine.directory,
+      removedDatabaseFiles: []
+    }
+  } finally {
+    authority.close()
+  }
+}
+
+function syncHttp1CompatibilityMarkerFromDatabase(
+  userDataPath: string,
+  result: ProfileStateExportsResult
+): void {
+  const settings = readProfileStateDomain(result.databaseFile, result.profileId, 'settings')
+  if (settings.kind !== 'unreadable') {
+    const enabled =
+      settings.kind === 'value' &&
+      isRecord(settings.value) &&
+      settings.value.electronHttp1CompatibilityMode === true
+    writeHttp1CompatibilityMarker(userDataPath, enabled, result.profileId)
+  }
+}
+
+function syncHttp1CompatibilityMarkerAfterRollback(
+  userDataPath: string,
+  dataFile: string,
+  profileId: string
+): void {
+  let enabled = false
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(dataFile, 'utf8'))
+    if (isRecord(parsed) && isRecord(parsed.settings)) {
+      enabled = parsed.settings.electronHttp1CompatibilityMode === true
+    }
+  } catch {
+    // Leave the invalidated marker absent so startup reads the restored JSON itself.
+    return
+  }
+  writeHttp1CompatibilityMarker(userDataPath, enabled, profileId)
+}
diff --git a/src/main/persistence/profile-state/profile-state-recovery-copy.test.ts b/src/main/persistence/profile-state/profile-state-recovery-copy.test.ts
new file mode 100644
index 00000000000..d7bc8796be2
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-recovery-copy.test.ts
@@ -0,0 +1,193 @@
+import {
+  closeSync,
+  copyFileSync,
+  existsSync,
+  ftruncateSync,
+  mkdtempSync,
+  openSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  writeFileSync,
+  writeSync
+} from 'node:fs'
+import type * as FileSystem from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, isAbsolute, join, relative } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import * as processes from '../../../shared/child-process/run-process'
+import { copyProfileStateRecoveryFile } from './profile-state-recovery-copy'
+
+const cloneLink = vi.hoisted(() => ({ unsupported: false }))
+vi.mock('node:fs', async (original) => {
+  const actual = await original<typeof FileSystem>()
+  return {
+    ...actual,
+    linkSync: (...args: Parameters<typeof actual.linkSync>) => {
+      if (cloneLink.unsupported) {
+        throw Object.assign(new Error('hardlinks unavailable'), { code: 'ENOTSUP' })
+      }
+      return actual.linkSync(...args)
+    }
+  }
+})
+
+const directories: string[] = []
+afterEach(() => {
+  cloneLink.unsupported = false
+  vi.restoreAllMocks()
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture(large = true) {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-recovery-copy-'))
+  directories.push(directory)
+  const source = join(directory, '- source with spaces')
+  const target = join(directory, 'target')
+  const descriptor = openSync(source, 'wx', 0o600)
+  try {
+    ftruncateSync(descriptor, large ? 8 * 1024 * 1024 + 1 : 100)
+    writeSync(descriptor, Buffer.from('retained source'))
+  } finally {
+    closeSync(descriptor)
+  }
+  return { directory, source, target }
+}
+
+function expectNoTemporary(directory: string): void {
+  expect(readdirSync(directory).some((name) => name.startsWith('.orca-recovery-clone-'))).toBe(
+    false
+  )
+}
+
+describe('independent profile recovery copies', () => {
+  it.each([false, true])('preserves independent bytes with a large file=%s', (large) => {
+    const { directory, source, target } = fixture(large)
+    const before = readFileSync(source)
+    copyProfileStateRecoveryFile(source, target)
+    expect(readFileSync(target).equals(before)).toBe(true)
+    expect(statSync(target, { bigint: true }).ino).not.toBe(statSync(source, { bigint: true }).ino)
+    writeFileSync(source, 'changed source')
+    expect(readFileSync(target).equals(before)).toBe(true)
+    writeFileSync(target, 'changed target')
+    expect(readFileSync(source, 'utf8')).toBe('changed source')
+    expectNoTemporary(directory)
+  })
+
+  it.each([false, true])('never replaces an existing destination with a large file=%s', (large) => {
+    const { directory, source, target } = fixture(large)
+    writeFileSync(target, 'do not replace')
+    expect(() => copyProfileStateRecoveryFile(source, target)).toThrow()
+    expect(readFileSync(target, 'utf8')).toBe('do not replace')
+    expectNoTemporary(directory)
+  })
+
+  it('does not start a copy process for small files', () => {
+    const { source, target } = fixture(false)
+    const run = vi.spyOn(processes, 'runProcessSync')
+    copyProfileStateRecoveryFile(source, target)
+    expect(run).not.toHaveBeenCalled()
+  })
+
+  describe.skipIf(process.platform !== 'darwin')('Darwin clone failure boundaries', () => {
+    it('resolves both process arguments while preserving relative path behavior', () => {
+      const { directory, source, target } = fixture()
+      const run = vi.spyOn(processes, 'runProcessSync')
+      copyProfileStateRecoveryFile(relative(process.cwd(), source), relative(process.cwd(), target))
+      const args = run.mock.calls[0]?.[0].args
+      expect(args?.[0]).toBe('-c')
+      expect(isAbsolute(args?.[1] ?? '')).toBe(true)
+      expect(isAbsolute(args?.[2] ?? '')).toBe(true)
+      expect(readFileSync(target).equals(readFileSync(source))).toBe(true)
+      expectNoTemporary(directory)
+    })
+
+    it('keeps ordinary-copy semantics for symlinks to large recovery artifacts', () => {
+      const { directory, source, target } = fixture()
+      const alias = join(directory, 'alias')
+      symlinkSync(source, alias)
+      const run = vi.spyOn(processes, 'runProcessSync')
+      copyProfileStateRecoveryFile(alias, target)
+      expect(run).not.toHaveBeenCalled()
+      expect(readFileSync(target).equals(readFileSync(source))).toBe(true)
+      expect(statSync(target, { bigint: true }).ino).not.toBe(
+        statSync(source, { bigint: true }).ino
+      )
+      expectNoTemporary(directory)
+    })
+
+    it('cleans a failed partial clone and falls back to an independent ordinary copy', () => {
+      const { directory, source, target } = fixture()
+      vi.spyOn(processes, 'runProcessSync').mockImplementation((spec) => {
+        const temporary = spec.args?.[2]
+        if (typeof temporary !== 'string') {
+          throw new Error('Missing clone destination')
+        }
+        expect(statSync(dirname(temporary)).mode & 0o777).toBe(0o700)
+        writeFileSync(temporary, 'incomplete')
+        return { code: 1, signal: null, timedOut: false, stdout: '', stderr: 'clone unavailable' }
+      })
+      copyProfileStateRecoveryFile(source, target)
+      expect(readFileSync(target).equals(readFileSync(source))).toBe(true)
+      expect(statSync(target, { bigint: true }).ino).not.toBe(
+        statSync(source, { bigint: true }).ino
+      )
+      expectNoTemporary(directory)
+    })
+
+    it.each(['timeout', 'signal', 'spawn'] as const)(
+      'preserves originals and removes temporary copies after %s failure',
+      (failure) => {
+        const { directory, source, target } = fixture()
+        const before = readFileSync(source)
+        vi.spyOn(processes, 'runProcessSync').mockImplementation(() => {
+          if (failure === 'spawn') {
+            throw new Error('copy process could not start')
+          }
+          return {
+            code: null,
+            signal: 'SIGTERM',
+            timedOut: failure === 'timeout',
+            stdout: '',
+            stderr: ''
+          }
+        })
+        expect(() => copyProfileStateRecoveryFile(source, target)).toThrow()
+        expect(readFileSync(source).equals(before)).toBe(true)
+        expect(existsSync(target)).toBe(false)
+        expectNoTemporary(directory)
+      }
+    )
+
+    it('preserves a destination created while the clone process runs', () => {
+      const { directory, source, target } = fixture()
+      vi.spyOn(processes, 'runProcessSync').mockImplementation((spec) => {
+        const temporary = spec.args?.[2]
+        if (typeof temporary !== 'string') {
+          throw new Error('Missing clone destination')
+        }
+        copyFileSync(source, temporary)
+        writeFileSync(target, 'concurrent destination')
+        return { code: 0, signal: null, timedOut: false, stdout: '', stderr: '' }
+      })
+      expect(() => copyProfileStateRecoveryFile(source, target)).toThrow()
+      expect(readFileSync(target, 'utf8')).toBe('concurrent destination')
+      expectNoTemporary(directory)
+    })
+
+    it('falls back when the destination filesystem does not support hardlinks', () => {
+      const { directory, source, target } = fixture()
+      cloneLink.unsupported = true
+      copyProfileStateRecoveryFile(source, target)
+      expect(readFileSync(target).equals(readFileSync(source))).toBe(true)
+      expect(statSync(target, { bigint: true }).ino).not.toBe(
+        statSync(source, { bigint: true }).ino
+      )
+      expectNoTemporary(directory)
+    })
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-recovery-copy.ts b/src/main/persistence/profile-state/profile-state-recovery-copy.ts
new file mode 100644
index 00000000000..cb7a1f9315b
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-recovery-copy.ts
@@ -0,0 +1,81 @@
+import { constants, copyFileSync, linkSync, lstatSync, mkdtempSync, rmSync } from 'node:fs'
+import { basename, dirname, join, resolve } from 'node:path'
+import { runProcessSync } from '../../../shared/child-process/run-process'
+
+// Keep process startup overhead off small recovery copies.
+const MINIMUM_CLONE_BYTES = 8 * 1024 * 1024
+const MAXIMUM_CLONE_FILES = 16
+
+type RecoveryCopy = { source: string; target: string }
+
+/** Copy quiescent recovery artifacts independently; never copy an active WAL database this way. */
+export function copyProfileStateRecoveryFile(source: string, target: string): void {
+  copyProfileStateRecoveryFiles([{ source, target }])
+}
+
+/** Targets are staging files; callers validate, fsync and publish. */
+export function copyProfileStateRecoveryFiles(files: readonly RecoveryCopy[]): void {
+  const clones: RecoveryCopy[] = []
+  const names = new Set<string>()
+  for (const file of files) {
+    const info = process.platform === 'darwin' ? lstatSync(file.source) : undefined
+    const name = basename(file.source)
+    if (!info?.isFile() || info.size < MINIMUM_CLONE_BYTES) {
+      copyFileSync(file.source, file.target, constants.COPYFILE_EXCL)
+    } else if (
+      files.length > 1 &&
+      (clones.length === MAXIMUM_CLONE_FILES ||
+        !/^[a-z0-9][a-z0-9._-]*[a-z0-9]$/i.test(name) ||
+        names.has(name.toLowerCase()))
+    ) {
+      // cp derives temporary basenames; ambiguous names need their own private directory.
+      copyProfileStateRecoveryFile(file.source, file.target)
+    } else {
+      clones.push(file)
+      names.add(name.toLowerCase())
+    }
+  }
+  if (clones.length === 0) {
+    return
+  }
+  const directory = mkdtempSync(join(dirname(clones[0].target), '.orca-recovery-clone-'))
+  const temporary = (source: string) =>
+    join(directory, clones.length === 1 ? 'copy' : basename(source))
+  let cloned = false
+  try {
+    // Node's clone flag is unsupported on Darwin; cp -c falls back to ordinary copying.
+    const result = runProcessSync({
+      program: '/bin/cp',
+      args: [
+        '-c',
+        ...clones.map(({ source }) => resolve(source)),
+        resolve(clones.length === 1 ? temporary(clones[0].source) : directory)
+      ],
+      timeoutMs: 30_000 * clones.length,
+      maxOutputBytes: 16_384
+    })
+    if (result.timedOut || result.signal !== null) {
+      throw new Error('Profile recovery file copy was interrupted')
+    }
+    if (result.code === 0) {
+      for (const { source, target } of clones) {
+        try {
+          linkSync(temporary(source), target)
+        } catch (error) {
+          if (error instanceof Error && 'code' in error && error.code === 'EEXIST') {
+            throw error
+          }
+          copyFileSync(source, target, constants.COPYFILE_EXCL)
+        }
+      }
+      cloned = true
+    }
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  if (!cloned) {
+    for (const { source, target } of clones) {
+      copyFileSync(source, target, constants.COPYFILE_EXCL)
+    }
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-recovery-crash-boundaries.test.ts b/src/main/persistence/profile-state/profile-state-recovery-crash-boundaries.test.ts
new file mode 100644
index 00000000000..75e498b8d70
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-recovery-crash-boundaries.test.ts
@@ -0,0 +1,380 @@
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, dirname, join } from 'node:path'
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
+import { setSecretStore } from '../../../shared/secret-store'
+import { profileStateStorage } from '../../orca-profiles/profile-project-state-file'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission
+} from './profile-state-access'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from './profile-state-database'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateSnapshot
+} from './profile-state-documents'
+import {
+  profileStateJsonExportPath,
+  profileStateJsonExportPaths
+} from './legacy-json/profile-state-export-path'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath,
+  profileStateDatabaseBackups
+} from './profile-state-backup-path'
+import { writeProfileStateDatabaseSnapshotAsync } from './profile-state-database-snapshot'
+import { createProfileStateStore } from './profile-state-store-factory'
+import { restoreProfileStateJsonExport } from './legacy-json/profile-state-recovery'
+import { restoreProfileStateDatabaseBackup } from './profile-state-database-recovery'
+import {
+  buildRecoveryCrashProcess,
+  killRecoveryAt,
+  type RecoveryCrashOptions
+} from './profile-state-recovery-crash-process'
+
+vi.mock('../../telemetry/client', () => ({ track: () => {} }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const suiteRoot = mkdtempSync(join(tmpdir(), 'orca-recovery-crash-boundaries-'))
+const fixtureRoots: string[] = []
+let bundle: string
+const profileId = 'crash-recovery'
+const selectedState = {
+  settings: {
+    theme: 'dark',
+    httpProxyUrl: Buffer.from('sealed-selected').toString('base64'),
+    electronHttp1CompatibilityMode: true
+  },
+  ui: { extension: { origin: 'selected', value: null } },
+  extension: { nested: [null, '\ud800', 'selected'], ['__proto__']: { inert: true } },
+  opaque: null,
+  repos: [],
+  automationRuns: [],
+  automations: []
+}
+const oldState = {
+  ...selectedState,
+  settings: {
+    ...selectedState.settings,
+    theme: 'light',
+    httpProxyUrl: Buffer.from('sealed-old').toString('base64')
+  },
+  ui: { extension: { origin: 'old', value: null } },
+  extension: { nested: [null, '\ud800', 'old'], ['__proto__']: { inert: true } }
+}
+const selectedJson = JSON.stringify(selectedState)
+const oldJson = JSON.stringify(oldState)
+
+beforeAll(() => {
+  bundle = buildRecoveryCrashProcess(suiteRoot)
+})
+beforeEach(() => {
+  setSecretStore({
+    isEncryptionAvailable: () => false,
+    encryptString: () => {
+      throw new Error('Keychain unavailable')
+    },
+    decryptString: () => {
+      throw new Error('Keychain unavailable')
+    },
+    describeProtectionGap: () => null
+  })
+})
+afterEach(() => {
+  for (const root of fixtureRoots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+afterAll(() => rmSync(suiteRoot, { recursive: true, force: true }))
+
+type Fixture = RecoveryCrashOptions & { backupBytes: Buffer; originalFamily: Map<string, Buffer> }
+
+async function fixture(kind: 'json' | 'sqlite', accepted: boolean): Promise<Fixture> {
+  const root = mkdtempSync(join(suiteRoot, 'profile-'))
+  fixtureRoots.push(root)
+  const directory = join(root, 'profiles', profileId)
+  mkdirSync(directory, { recursive: true })
+  writeFileSync(
+    join(root, 'orca-profile-index.json'),
+    JSON.stringify({ activeProfileId: profileId, profiles: [{ id: profileId }] })
+  )
+  const dataFile = join(directory, 'orca-data.json')
+  const databasePath = join(directory, 'profile-state.db')
+  const exportPath = profileStateJsonExportPath(dataFile, 3)
+  const backupPath = profileStateDatabaseBackupPath(
+    databasePath,
+    createProfileStateDatabaseBackupId()
+  )
+  const options = {
+    root,
+    profileId,
+    dataFile,
+    databasePath,
+    exportPath,
+    backupPath,
+    markerPath: join(root, 'http1-compatibility.json'),
+    kind
+  }
+  const source = openProfileStateDatabase(databasePath, profileId)
+  try {
+    importProfileStateJson(source.db, oldJson)
+    importProfileStateJson(source.db, oldJson)
+    importProfileStateJson(
+      source.db,
+      selectedJson,
+      accepted ? { acceptedLegacyJsonHash: hashProfileStateJson(selectedJson) } : {}
+    )
+    await writeProfileStateDatabaseSnapshotAsync(source.db, backupPath)
+  } finally {
+    source.db.close()
+  }
+  await killRecoveryAt(bundle, options, 'seed', oldJson)
+  expect(existsSync(`${databasePath}-wal`)).toBe(true)
+  expect(existsSync(`${databasePath}-shm`)).toBe(true)
+  // An empty abandoned rollback journal is harmless, but must be removed before publication.
+  writeFileSync(`${databasePath}-journal`, '')
+  if (accepted) {
+    writeFileSync(dataFile, selectedJson)
+  }
+  writeFileSync(exportPath, selectedJson)
+  writeFileSync(
+    profileStateJsonExportPath(dataFile, 1),
+    JSON.stringify({ ...oldState, exportRevision: 1 })
+  )
+  writeFileSync(
+    profileStateJsonExportPath(dataFile, 2),
+    JSON.stringify({ ...oldState, exportRevision: 2 })
+  )
+  writeFileSync(options.markerPath, JSON.stringify({ schemeVersion: 2, enabled: false, profileId }))
+  const originalFamily = new Map(
+    ['', '-wal', '-shm', '-journal'].map((suffix) => [
+      suffix,
+      readFileSync(`${databasePath}${suffix}`)
+    ])
+  )
+  return { ...options, backupBytes: readFileSync(backupPath), originalFamily }
+}
+
+function readSqlite(path: string): unknown {
+  const opened = openProfileStateDatabaseReadOnly(path, profileId)
+  try {
+    return JSON.parse(readProfileStateSnapshot(opened.db).json)
+  } finally {
+    opened.db.close()
+  }
+}
+
+function assertQuarantine(profile: Fixture): void {
+  const quarantine = readdirSync(dirname(profile.databasePath)).find((name) =>
+    name.startsWith('profile-state-corrupt-')
+  )
+  if (quarantine === undefined) {
+    throw new Error('Recovery did not preserve a quarantine')
+  }
+  const directory = join(dirname(profile.databasePath), quarantine)
+  // Check exact family bytes before opening the copied WAL snapshot.
+  for (const [suffix, bytes] of profile.originalFamily) {
+    expect(readFileSync(join(directory, `profile-state.db${suffix}`))).toEqual(bytes)
+  }
+  expect(readFileSync(join(directory, basename(profile.exportPath)), 'utf8')).toBe(selectedJson)
+  expect(readFileSync(join(directory, basename(profile.backupPath)))).toEqual(profile.backupBytes)
+  expect(readSqlite(join(directory, 'profile-state.db'))).toEqual(oldState)
+}
+
+function assertRestart(profile: Fixture, expected: 'old' | 'selected' | 'refused'): void {
+  const admission = acquireProfileStateRuntimeAdmission(profile.root)
+  try {
+    const open = () =>
+      createProfileStateStore({
+        dataFile: profile.dataFile,
+        databaseFile: profile.databasePath,
+        profileId
+      })
+    if (expected === 'refused') {
+      expect(open).toThrow()
+      expect(() => profileStateStorage(profileId, profile.root)).toThrow()
+      return
+    }
+    const expectedState = expected === 'old' ? oldState : selectedState
+    const storage = profileStateStorage(profileId, profile.root)
+    const raw =
+      storage === 'sqlite'
+        ? readSqlite(profile.databasePath)
+        : JSON.parse(readFileSync(profile.dataFile, 'utf8'))
+    // Full raw-state equality is checked before Store normalization can hide a lost domain.
+    expect(raw).toEqual(expectedState)
+    const reopened = open()
+    try {
+      expect(reopened.backend).toBe('sqlite')
+      expect(reopened.migrated).toBe(storage === 'json')
+      expect(profileStateStorage(profileId, profile.root)).toBe('sqlite')
+      const projected: unknown = JSON.parse(reopened.store.prepareProfileStateExport().json)
+      expect(projected).toMatchObject(expectedState)
+    } finally {
+      reopened.store.freezeWrites()
+    }
+  } finally {
+    admission.release()
+  }
+}
+
+function retry(profile: Fixture): void {
+  const maintenance = acquireProfileStateMaintenance(profile.root)
+  try {
+    if (profile.kind === 'json') {
+      expect(profileStateJsonExportPaths(profile.dataFile)).toContain(profile.exportPath)
+      restoreProfileStateJsonExport({ ...profile, maintenance })
+    } else {
+      expect(
+        profileStateDatabaseBackups(profile.databasePath).some(
+          (backup) => backup.path === profile.backupPath
+        )
+      ).toBe(true)
+      restoreProfileStateDatabaseBackup({ ...profile, maintenance })
+    }
+  } finally {
+    maintenance.release()
+  }
+  assertRestart(profile, 'selected')
+}
+
+const JSON_BOUNDARIES = [
+  'marker-invalidated',
+  'json-publish:before',
+  'json-publish:after',
+  'primary',
+  'wal',
+  'shm',
+  'journal',
+  'other-export',
+  'first-export',
+  'backup',
+  'selected-export',
+  'restore-returned',
+  'marker-publish:before',
+  'marker-publish:after',
+  'marker-refreshed'
+] as const
+
+function stage(profile: Fixture, name: string): string {
+  const paths: Record<string, string> = {
+    primary: profile.databasePath,
+    wal: `${profile.databasePath}-wal`,
+    shm: `${profile.databasePath}-shm`,
+    journal: `${profile.databasePath}-journal`,
+    'other-export': profileStateJsonExportPath(profile.dataFile, 2),
+    'first-export': profileStateJsonExportPath(profile.dataFile, 1),
+    'marker-invalidated': profile.markerPath,
+    backup: profile.backupPath,
+    'selected-export': profile.exportPath,
+    json: profile.dataFile
+  }
+  const target = paths[name]
+  return target === undefined ? name : `removed:${target}`
+}
+
+describe.each([false, true])('JSON recovery process death, accepted prior JSON=%s', (accepted) => {
+  it.each(JSON_BOUNDARIES)(
+    'preserves a complete authority or exact retry at %s',
+    async (boundary) => {
+      const profile = await fixture('json', accepted)
+      await killRecoveryAt(bundle, profile, stage(profile, boundary))
+      assertQuarantine(profile)
+      const finished = [
+        'selected-export',
+        'restore-returned',
+        'marker-publish:before',
+        'marker-publish:after',
+        'marker-refreshed'
+      ].includes(boundary)
+      const expected = finished
+        ? 'selected'
+        : ['marker-invalidated', 'json-publish:before'].includes(boundary) ||
+            (boundary === 'json-publish:after' && accepted)
+          ? 'old'
+          : 'refused'
+      if (finished) {
+        expect(readFileSync(profile.dataFile, 'utf8')).toBe(selectedJson)
+        expect(profileStateJsonExportPaths(profile.dataFile)).toEqual([])
+        expect(profileStateDatabaseBackups(profile.databasePath)).toEqual([])
+      }
+      assertRestart(profile, expected)
+      if (!finished) {
+        expect(readFileSync(profile.exportPath, 'utf8')).toBe(selectedJson)
+        retry(profile)
+      }
+    }
+  )
+})
+
+describe('SQLite recovery process death', () => {
+  it.each([
+    'marker-invalidated',
+    'selected-export',
+    'other-export',
+    'first-export',
+    'primary',
+    'wal',
+    'shm',
+    'journal',
+    'json',
+    'sqlite-publish:before',
+    'sqlite-publish:after',
+    'restore-returned',
+    'marker-publish:before',
+    'marker-publish:after',
+    'marker-refreshed'
+  ])('preserves full state and its immutable retry backup at %s', async (boundary) => {
+    const profile = await fixture('sqlite', true)
+    await killRecoveryAt(bundle, profile, stage(profile, boundary))
+    assertQuarantine(profile)
+    expect(readFileSync(profile.backupPath)).toEqual(profile.backupBytes)
+    const expected = [
+      'marker-invalidated',
+      'selected-export',
+      'other-export',
+      'first-export'
+    ].includes(boundary)
+      ? 'old'
+      : [
+            'sqlite-publish:after',
+            'restore-returned',
+            'marker-publish:before',
+            'marker-publish:after',
+            'marker-refreshed'
+          ].includes(boundary)
+        ? 'selected'
+        : 'refused'
+    assertRestart(profile, expected)
+    retry(profile)
+    expect(readFileSync(profile.backupPath)).toEqual(profile.backupBytes)
+  })
+
+  it.skipIf(process.platform === 'win32')(
+    'allows clean JSON startup after final artifact cleanup is directory-synced',
+    async () => {
+      const profile = await fixture('json', true)
+      await killRecoveryAt(bundle, profile, 'cleanup-directory-synced')
+      assertQuarantine(profile)
+      assertRestart(profile, 'selected')
+    }
+  )
+})
diff --git a/src/main/persistence/profile-state/profile-state-recovery-crash-process.ts b/src/main/persistence/profile-state/profile-state-recovery-crash-process.ts
new file mode 100644
index 00000000000..5b542fff161
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-recovery-crash-process.ts
@@ -0,0 +1,178 @@
+import { once } from 'node:events'
+import { writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { buildSync } from 'esbuild'
+import { spawnProcess } from '../../../shared/child-process/run-process'
+
+export type RecoveryCrashOptions = {
+  root: string
+  profileId: string
+  dataFile: string
+  databasePath: string
+  exportPath: string
+  backupPath: string
+  markerPath: string
+  kind: 'json' | 'sqlite'
+}
+
+/** Build only the recovery graph into an isolated test directory, never shared out/. */
+export function buildRecoveryCrashProcess(directory: string): string {
+  const bundle = join(directory, 'recovery-crash-api.cjs')
+  buildSync({
+    stdin: {
+      contents: `
+        export { acquireProfileStateMaintenance } from './src/main/persistence/profile-state/profile-state-access'
+        export { restoreProfileStateJsonExport } from './src/main/persistence/profile-state/legacy-json/profile-state-recovery'
+        export { restoreProfileStateDatabaseBackup } from './src/main/persistence/profile-state/profile-state-database-recovery'
+        export { openProfileStateDatabase } from './src/main/persistence/profile-state/profile-state-database'
+        export { importProfileStateJson } from './src/main/persistence/profile-state/profile-state-documents'
+        export { invalidateHttp1CompatibilityMarker, writeHttp1CompatibilityMarker } from './src/main/startup/http1-compatibility-marker'
+      `,
+      loader: 'ts',
+      resolveDir: process.cwd()
+    },
+    outfile: bundle,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    packages: 'external'
+  })
+  return bundle
+}
+
+const CHILD_SOURCE = `
+const fs = require('node:fs')
+const [bundle, raw, stage, payloadPath] = process.argv.slice(2)
+const options = JSON.parse(raw)
+const payload = fs.readFileSync(payloadPath, 'utf8')
+const api = require(bundle)
+const barrier = label => {
+  if (label !== stage) return
+  fs.writeSync(1, label + '\\n')
+  fs.readSync(0, Buffer.alloc(1), 0, 1)
+  throw new Error('Crash barrier unexpectedly resumed')
+}
+if (stage === 'seed') {
+  const source = api.openProfileStateDatabase(options.databasePath, options.profileId)
+  api.importProfileStateJson(source.db, payload, { expectedRevision: 3 })
+  barrier('seed')
+}
+const rename = fs.renameSync
+fs.renameSync = (from, to) => {
+  if (to === options.dataFile) barrier('json-publish:before')
+  if (to === options.databasePath) barrier('sqlite-publish:before')
+  if (to === options.markerPath) barrier('marker-publish:before')
+  rename(from, to)
+  if (to === options.dataFile) barrier('json-publish:after')
+  if (to === options.databasePath) barrier('sqlite-publish:after')
+  if (to === options.markerPath) barrier('marker-publish:after')
+}
+const rm = fs.rmSync
+fs.rmSync = (target, ...rest) => {
+  rm(target, ...rest)
+  barrier('removed:' + target)
+}
+let clone = 0
+const link = fs.linkSync
+fs.linkSync = (from, to) => {
+  const isClone = from.includes('.orca-recovery-clone-')
+  if (isClone) barrier('clone:' + (++clone) + ':before')
+  link(from, to)
+  if (isClone) barrier('clone:' + clone + ':after')
+}
+const fsync = fs.fsyncSync
+fs.fsyncSync = descriptor => {
+  fsync(descriptor)
+  if (fs.fstatSync(descriptor).isDirectory() && !fs.existsSync(options.exportPath)) {
+    barrier('cleanup-directory-synced')
+  }
+}
+const maintenance = api.acquireProfileStateMaintenance(options.root)
+const recovered = (options.kind === 'json'
+  ? api.restoreProfileStateJsonExport
+  : api.restoreProfileStateDatabaseBackup)({
+    ...options, maintenance,
+    beforeRestore: () => api.invalidateHttp1CompatibilityMarker(options.root)
+  })
+barrier('restore-returned')
+api.writeHttp1CompatibilityMarker(options.root, true, options.profileId)
+barrier('marker-refreshed')
+maintenance.release()
+throw new Error('Requested crash boundary was not reached: ' + stage)
+`
+
+/** A pipe barrier proves the syscall completed before the parent sends SIGKILL. */
+export async function killRecoveryAt(
+  bundle: string,
+  options: RecoveryCrashOptions,
+  stage: string,
+  payload = ''
+): Promise<void> {
+  const childScript = join(dirname(bundle), 'recovery-crash-child.cjs')
+  const payloadPath = join(dirname(bundle), 'recovery-crash-payload.json')
+  writeFileSync(childScript, CHILD_SOURCE, 'utf8')
+  writeFileSync(payloadPath, payload, 'utf8')
+  const childEnv = {
+    ORCA_BACKGROUND_LAUNCH: '1',
+    ...(process.env.PATH ? { PATH: process.env.PATH } : {}),
+    ...(process.env.SystemRoot ? { SystemRoot: process.env.SystemRoot } : {}),
+    ...(process.env.TEMP ? { TEMP: process.env.TEMP } : {}),
+    ...(process.env.TMP ? { TMP: process.env.TMP } : {})
+  }
+  const recoveryOptions: RecoveryCrashOptions = {
+    root: options.root,
+    profileId: options.profileId,
+    dataFile: options.dataFile,
+    databasePath: options.databasePath,
+    exportPath: options.exportPath,
+    backupPath: options.backupPath,
+    markerPath: options.markerPath,
+    kind: options.kind
+  }
+  const child = spawnProcess({
+    program: process.execPath,
+    args: [childScript, bundle, JSON.stringify(recoveryOptions), stage, payloadPath],
+    env: childEnv
+  })
+  let stderr = ''
+  child.stderr.on('data', (chunk: Buffer) => {
+    stderr += chunk.toString()
+  })
+  try {
+    await new Promise<void>((resolve, reject) => {
+      let stdout = ''
+      const timer = setTimeout(
+        () => finish(new Error(`Crash boundary timed out: ${stage}; ${stderr}`)),
+        10_000
+      )
+      const onData = (chunk: Buffer) => {
+        stdout += chunk.toString()
+        if (stdout.includes(`${stage}\n`)) {
+          finish()
+        }
+      }
+      const onExit = () => finish(new Error(`Recovery exited before ${stage}: ${stderr}`))
+      const onError = (error: Error) => finish(error)
+      const finish = (error?: Error) => {
+        clearTimeout(timer)
+        child.stdout.off('data', onData)
+        child.off('exit', onExit)
+        child.off('error', onError)
+        if (error) {
+          reject(error)
+        } else {
+          resolve()
+        }
+      }
+      child.stdout.on('data', onData)
+      child.once('exit', onExit)
+      child.once('error', onError)
+    })
+  } finally {
+    if (child.exitCode === null && child.signalCode === null) {
+      const closed = once(child, 'close')
+      child.kill('SIGKILL')
+      await closed
+    }
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-recovery-required.ts b/src/main/persistence/profile-state/profile-state-recovery-required.ts
new file mode 100644
index 00000000000..12a254f7f1e
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-recovery-required.ts
@@ -0,0 +1,85 @@
+import { existsSync } from 'node:fs'
+import { hasStateBackup } from './legacy-json/profile-state-legacy-backup-path'
+import { profileStateJsonExportPaths } from './legacy-json/profile-state-export-path'
+import { profileStateDatabaseBackups } from './profile-state-backup-path'
+
+type ProfileStateRecoveryLocation = {
+  dataFile: string
+  databaseFile: string
+  profileId: string
+}
+
+export class ProfileStateAuthorityBootstrapError extends Error {
+  readonly code = 'ambiguous-profile-state' as const
+
+  /** `diverged-json`: both copies are readable, so the user can pick one at startup. */
+  constructor(
+    message: string,
+    readonly divergence?: 'diverged-json'
+  ) {
+    super(message)
+    this.name = 'ProfileStateAuthorityBootstrapError'
+  }
+}
+
+/** Never establish a new authority over evidence that the primary was lost. */
+export function assertProfileStateCanInitialize(options: ProfileStateRecoveryLocation): void {
+  assertNoRetainedProfileStateExports(options)
+  if (!existsSync(options.dataFile) && hasStateBackup(options.dataFile)) {
+    throw new ProfileStateAuthorityBootstrapError(
+      `Legacy profile JSON is missing while its .bak.0–.bak.4 backups remain. Stop Orca and restore a selected backup to ${options.dataFile} before reopening.`
+    )
+  }
+}
+
+/** Startup can surface this error with the exact artifacts an explicit rollback may use. */
+export class ProfileStateRecoveryRequiredError extends Error {
+  readonly code = 'profile-state-recovery-required' as const
+  readonly dataFile: string
+  readonly databaseFile: string
+  readonly exportPaths: readonly string[]
+  readonly backupPaths: readonly string[]
+
+  constructor(options: ProfileStateRecoveryLocation, cause: unknown) {
+    super(
+      `SQLite profile state could not be read; choose a retained backup or JSON export to recover the profile`,
+      { cause }
+    )
+    this.name = 'ProfileStateRecoveryRequiredError'
+    this.dataFile = options.dataFile
+    this.databaseFile = options.databaseFile
+    // Recovery guidance must survive a permissions failure while enumerating the directory.
+    // The startup error still names the canonical paths and remains typed for fail-closed handling.
+    try {
+      this.exportPaths = profileStateJsonExportPaths(options.dataFile)
+    } catch {
+      this.exportPaths = []
+    }
+    try {
+      this.backupPaths = profileStateDatabaseBackups(options.databaseFile).map(({ path }) => path)
+    } catch {
+      this.backupPaths = []
+    }
+  }
+}
+
+/** A retained migration export proves that absent SQLite is not a fresh profile. */
+export function assertNoRetainedProfileStateExports(options: ProfileStateRecoveryLocation): void {
+  let hasRetainedExport: boolean
+  try {
+    hasRetainedExport =
+      profileStateJsonExportPaths(options.dataFile).length > 0 ||
+      profileStateDatabaseBackups(options.databaseFile).length > 0
+  } catch {
+    throw new ProfileStateRecoveryRequiredError(
+      options,
+      new Error('Could not enumerate retained profile state exports')
+    )
+  }
+  if (hasRetainedExport) {
+    throw new ProfileStateRecoveryRequiredError(
+      options,
+      new Error('SQLite profile state is missing while retained migration exports exist')
+    )
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-revision-readmission.ts b/src/main/persistence/profile-state/profile-state-revision-readmission.ts
new file mode 100644
index 00000000000..8a3c3df338d
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-revision-readmission.ts
@@ -0,0 +1,20 @@
+import { openProfileStateDatabaseReadOnly } from './profile-state-database'
+import { readProfileStateRevision } from './profile-state-documents'
+import { ProfileStateRevisionConflictError } from './profile-state-document-validation'
+
+/** Reopening a live snapshot cannot adopt another writer's intervening revision. */
+export function assertProfileStateRevisionOnDisk(
+  databasePath: string,
+  profileId: string,
+  revision: number
+): void {
+  const admitted = openProfileStateDatabaseReadOnly(databasePath, profileId)
+  try {
+    const actual = readProfileStateRevision(admitted.db)
+    if (actual !== revision) {
+      throw new ProfileStateRevisionConflictError(revision, actual)
+    }
+  } finally {
+    admitted.db.close()
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-revision.ts b/src/main/persistence/profile-state/profile-state-revision.ts
new file mode 100644
index 00000000000..6c64714606f
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-revision.ts
@@ -0,0 +1,31 @@
+import type Database from '../../sqlite/sync-database'
+import { PROFILE_STATE_META_REVISION } from './profile-state-database-schema'
+import { isRecord, ProfileStateDocumentCorruptionError } from './profile-state-document-validation'
+
+export function readProfileStateRevision(db: Database.Database): number {
+  const row = db
+    .prepare('SELECT value FROM profile_state_meta WHERE key = ?')
+    .get(PROFILE_STATE_META_REVISION)
+  if (!isRecord(row) || typeof row.value !== 'string') {
+    return 0
+  }
+  const revision = Number(row.value)
+  if (!Number.isSafeInteger(revision) || revision < 0) {
+    throw new ProfileStateDocumentCorruptionError('Profile state revision is invalid')
+  }
+  return revision
+}
+
+/** Unchanged domains may lag the profile revision, but cannot lead it. */
+export function assertProfileStateDocumentRevision(
+  revision: number,
+  profileRevision: number,
+  domain: string
+): void {
+  if (revision > profileRevision) {
+    throw new ProfileStateDocumentCorruptionError(
+      `Profile state document revision ${revision} exceeds profile revision ${profileRevision}`,
+      domain
+    )
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-runtime-preflight.test.ts b/src/main/persistence/profile-state/profile-state-runtime-preflight.test.ts
new file mode 100644
index 00000000000..34a4b02c0a4
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-runtime-preflight.test.ts
@@ -0,0 +1,60 @@
+import { build } from 'esbuild'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { preflightProfileStateRuntime } from './profile-state-runtime-preflight'
+
+let directory: string
+let workerPath: string
+let backupWorkerPath: string
+
+beforeAll(async () => {
+  directory = mkdtempSync(join(tmpdir(), 'orca-preflight-test-'))
+  workerPath = join(directory, 'profile-state-writer-worker-entry.js')
+  backupWorkerPath = join(directory, 'profile-state-backup-worker-entry.js')
+  await build({
+    entryPoints: [
+      resolve('src/main/persistence/profile-state/profile-state-writer-worker-entry.ts'),
+      resolve('src/main/persistence/profile-state/profile-state-backup-worker-entry.ts')
+    ],
+    outdir: directory,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    logLevel: 'silent'
+  })
+})
+
+afterAll(() => rmSync(directory, { recursive: true, force: true }))
+
+describe('profile runtime preflight', () => {
+  it('requires a worker commit and an independently readable backup', async () => {
+    const result = await preflightProfileStateRuntime({ workerPath, backupWorkerPath })
+    expect(result.revision).toBe(1)
+    expect(result.sqliteVersion).toMatch(/^\d+\.\d+\.\d+$/)
+  })
+
+  it('refuses readiness when a required worker artifact is absent', async () => {
+    await expect(
+      preflightProfileStateRuntime({
+        workerPath: join(directory, 'missing.js'),
+        backupWorkerPath
+      })
+    ).rejects.toThrow('Profile state writer')
+  })
+
+  it('does not trust a backup success reply without a valid database', async () => {
+    const corruptBackup = join(directory, 'corrupt-backup.cjs')
+    writeFileSync(
+      corruptBackup,
+      `const { parentPort, workerData } = require('node:worker_threads')
+       require('node:fs').writeFileSync(workerData.targetPath, 'not a database')
+       parentPort.postMessage({ ok: true })
+       parentPort.close()`
+    )
+    await expect(
+      preflightProfileStateRuntime({ workerPath, backupWorkerPath: corruptBackup })
+    ).rejects.toThrow()
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-runtime-preflight.ts b/src/main/persistence/profile-state/profile-state-runtime-preflight.ts
new file mode 100644
index 00000000000..90a8ab1fab1
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-runtime-preflight.ts
@@ -0,0 +1,67 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { randomUUID } from 'node:crypto'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from './profile-state-database'
+import { readProfileStateSnapshot } from './profile-state-documents'
+import { runProfileStateBackupWorker } from './profile-state-backup-worker'
+import { ProfileStateWriteWorkerClient } from './profile-state-writer-worker-client'
+
+export type ProfileStateRuntimePreflightResult = {
+  sqliteVersion: string
+  revision: number
+}
+
+/** Qualify the installed writer and backup without opening an existing user profile. */
+export async function preflightProfileStateRuntime(
+  options: { workerPath?: string; backupWorkerPath?: string; timeoutMs?: number } = {}
+): Promise<ProfileStateRuntimePreflightResult> {
+  const directory = await mkdtemp(join(tmpdir(), 'orca-profile-preflight-'))
+  const databasePath = join(directory, 'profile.db')
+  const targetPath = join(directory, 'backup.db')
+  const profileId = randomUUID()
+  const payload = JSON.stringify({ witness: profileId, unicode: '雪 🐋', surrogate: '\ud800' })
+  let writer: ProfileStateWriteWorkerClient | undefined
+  try {
+    const initial = openProfileStateDatabase(databasePath, profileId)
+    let revision: number
+    try {
+      revision = readProfileStateSnapshot(initial.db).revision
+    } finally {
+      initial.db.close()
+    }
+    writer = new ProfileStateWriteWorkerClient({ databasePath, profileId, revision }, options)
+    await writer.ready
+    const committedRevision = await writer.writeCompleteSerializedDomains([
+      { domain: 'preflight', payload }
+    ])
+    await writer.close()
+    await runProfileStateBackupWorker(
+      { databasePath, profileId, targetPath },
+      { workerPath: options.backupWorkerPath, timeoutMs: options.timeoutMs }
+    )
+    const backup = openProfileStateDatabaseReadOnly(targetPath, profileId)
+    try {
+      const snapshot = readProfileStateSnapshot(backup.db)
+      if (snapshot.revision !== committedRevision || snapshot.json !== `{"preflight":${payload}}`) {
+        throw new Error('Profile runtime backup did not preserve the acknowledged state')
+      }
+      const row = backup.db.prepare('SELECT sqlite_version() AS version').get()
+      if (typeof row?.version !== 'string') {
+        throw new Error('Profile runtime did not report its SQLite version')
+      }
+      return { sqliteVersion: row.version, revision: committedRevision }
+    } finally {
+      backup.db.close()
+    }
+  } finally {
+    try {
+      await writer?.close()
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-sqlite-authority.ts b/src/main/persistence/profile-state/profile-state-sqlite-authority.ts
new file mode 100644
index 00000000000..8c1408ec511
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-sqlite-authority.ts
@@ -0,0 +1,339 @@
+import { existsSync } from 'node:fs'
+import type {
+  ProfileStateAuthority,
+  ProfileStateAuthorityInitialState,
+  ProfileStateDomainReplacement,
+  ProfileStateMaintenance
+} from '../loading-store/profile-state-authority'
+import {
+  importProfileStateJson,
+  readAcceptedProfileStateParsedSnapshot,
+  readProfileStateParsedSnapshot,
+  readProfileStateRevision,
+  readProfileStateSnapshot
+} from './profile-state-documents'
+import {
+  openWritableProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from './profile-state-database'
+import { writeProfileStateDomains } from './profile-state-domain-writes'
+import {
+  prepareProfileStateDomainMutation,
+  validateProfileStateDomainTransaction
+} from './profile-state-domain-write-validation'
+import {
+  parseProfileStateRoot,
+  ProfileStateRevisionConflictError
+} from './profile-state-document-validation'
+import { assertProfileStateRevisionOnDisk } from './profile-state-revision-readmission'
+import {
+  quarantineProfileStateDatabase,
+  type ProfileStateDatabaseQuarantine
+} from './profile-state-database-quarantine'
+import {
+  writeProfileStateAuthorityJsonExport,
+  writeProfileStateAuthorityCompatibilityExport,
+  writeProfileStateAuthorityCompatibilityExportAsync
+} from './legacy-json/profile-state-authority-exports'
+import { buildCompleteDocumentReplacements } from './profile-state-complete-replacements'
+import { ProfileStateBackupRotation } from './profile-state-backup-rotation'
+import type { ProfileStateWriterInitialization } from './profile-state-writer-protocol'
+
+/**
+ * Complete-document authority for the Store cutover.
+ *
+ * A Store authority keeps one writable handle for its lifetime so repeated
+ * domain commits do not pay connection and pragma setup costs. Store teardown
+ * calls {@link close} before profile switches or process removal. Complete
+ * payloads use one fenced domain transaction, so unchanged normalized rows are
+ * not rebuilt; Store callers can still opt into narrower dirty-domain writes.
+ */
+export class ProfileStateSqliteAuthority implements ProfileStateAuthority {
+  private retired = false
+  private observedRevision: number | undefined
+  private writableDatabase: ReturnType<typeof openWritableProfileStateDatabase> | undefined
+  private backupRotation: ProfileStateBackupRotation | undefined
+
+  constructor(
+    private readonly databasePath: string,
+    private readonly profileId: string
+  ) {}
+
+  retireForWorker(): ProfileStateWriterInitialization {
+    this.assertActive()
+    if (this.observedRevision === undefined || this.backupRotation !== undefined) {
+      throw new Error('Profile state worker handoff requires an admitted bootstrap authority')
+    }
+    const initialization = {
+      databasePath: this.databasePath,
+      profileId: this.profileId,
+      revision: this.observedRevision
+    }
+    this.close()
+    this.retired = true
+    return initialization
+  }
+
+  initializeFromRevision(revision: number): void {
+    this.assertActive()
+    if (this.observedRevision !== undefined || !Number.isSafeInteger(revision) || revision < 0) {
+      throw new Error('Invalid profile state worker revision handoff')
+    }
+    assertProfileStateRevisionOnDisk(this.databasePath, this.profileId, revision)
+    this.observedRevision = revision
+    this.assertCurrentRevision()
+  }
+
+  get revision(): number {
+    this.assertActive()
+    if (this.observedRevision === undefined) {
+      throw new Error('Profile state authority has no admitted revision')
+    }
+    return this.observedRevision
+  }
+
+  /** Keep the startup payload and write fence on the same accepted revision. */
+  readAcceptedState(
+    rawJson: string
+  ): ProfileStateAuthorityInitialState<ProfileStateSqliteAuthority> | undefined {
+    this.assertActive()
+    const opened = openProfileStateDatabaseReadOnly(this.databasePath, this.profileId)
+    try {
+      const snapshot = readAcceptedProfileStateParsedSnapshot(opened.db, rawJson)
+      if (snapshot === undefined) {
+        return undefined
+      }
+      return this.createInitialState(snapshot.revision, snapshot.state)
+    } finally {
+      opened.db.close()
+    }
+  }
+
+  readInitialState(): ProfileStateAuthorityInitialState<ProfileStateSqliteAuthority> {
+    this.assertActive()
+    if (!this.writableDatabase && !existsSync(this.databasePath)) {
+      return this.createInitialState(0, undefined)
+    }
+    const opened =
+      this.writableDatabase ?? openProfileStateDatabaseReadOnly(this.databasePath, this.profileId)
+    try {
+      const snapshot = readProfileStateParsedSnapshot(opened.db)
+      return this.createInitialState(
+        snapshot.revision,
+        snapshot.revision === 0 ? undefined : snapshot.state
+      )
+    } finally {
+      if (opened !== this.writableDatabase) {
+        opened.db.close()
+      }
+    }
+  }
+
+  readSerializedState(): string | undefined {
+    this.assertActive()
+    if (!this.writableDatabase && !existsSync(this.databasePath)) {
+      // Treat an absent database as the empty revision so a concurrent creator
+      // cannot race this authority's first commit.
+      this.observedRevision = 0
+      return undefined
+    }
+    const opened =
+      this.writableDatabase ?? openProfileStateDatabaseReadOnly(this.databasePath, this.profileId)
+    try {
+      const snapshot = readProfileStateSnapshot(opened.db)
+      this.observedRevision = snapshot.revision
+      return snapshot.revision === 0 ? undefined : snapshot.json
+    } finally {
+      if (opened !== this.writableDatabase) {
+        opened.db.close()
+      }
+    }
+  }
+
+  writeSerializedDomains(
+    replacements: readonly ProfileStateDomainReplacement[],
+    automationRunsAfter?: readonly unknown[]
+  ): void {
+    this.assertActive()
+    if (this.observedRevision === undefined) {
+      // Store normally reads before its first write. Establishing the revision
+      // here keeps direct authority callers fenced too.
+      this.readSerializedState()
+    }
+    const opened = this.openWritableDatabase()
+    this.observedRevision = writeProfileStateDomains(opened.db, {
+      expectedRevision: this.observedRevision ?? 0,
+      replacements,
+      automationRunsAfter
+    }).revision
+  }
+
+  assertCurrentRevision(): void {
+    const actualRevision = readProfileStateRevision(this.openWritableDatabase().db)
+    if (this.observedRevision === undefined || actualRevision !== this.observedRevision) {
+      throw new ProfileStateRevisionConflictError(this.observedRevision ?? 0, actualRevision)
+    }
+  }
+
+  writeSerializedAutomationRuns(
+    replacements: readonly ProfileStateDomainReplacement[],
+    runs: readonly unknown[]
+  ): void {
+    this.writeSerializedDomains(replacements, runs)
+  }
+
+  writeSerializedState(payload: Buffer): void {
+    this.assertActive()
+    const serialized = payload.toString('utf8')
+    if (!Buffer.from(serialized, 'utf8').equals(payload)) {
+      throw new Error('Profile state payload is not valid UTF-8')
+    }
+    const parsed = parseProfileStateRoot(serialized)
+    this.writeCompleteSerializedDomains(
+      Object.entries(parsed).map(([domain, value]) => {
+        const payload = JSON.stringify(value)
+        if (payload === undefined) {
+          throw new Error(`Profile state domain payload is not serializable: ${domain}`)
+        }
+        return { domain, payload }
+      })
+    )
+  }
+
+  writeCompleteSerializedDomains(replacements: readonly ProfileStateDomainReplacement[]): void {
+    this.assertActive()
+    if (this.observedRevision === undefined) {
+      this.readSerializedState()
+    }
+    if (!Array.isArray(replacements) || replacements.length > 0) {
+      validateProfileStateDomainTransaction({
+        expectedRevision: this.observedRevision ?? 0,
+        replacements
+      })
+    }
+    const opened = this.openWritableDatabase()
+    const currentRevision = readProfileStateRevision(opened.db)
+    const complete = buildCompleteDocumentReplacements(opened.db, replacements)
+    if (currentRevision === 0 || complete.length === 0) {
+      // Each fragment must be valid independently before it can become part of a root object.
+      for (const replacement of replacements) {
+        prepareProfileStateDomainMutation(replacement)
+      }
+      const rawJson = `{${replacements
+        .filter(({ payload }) => payload !== null)
+        .map(({ domain, payload }) => `${JSON.stringify(domain)}:${payload}`)
+        .join(',')}}`
+      this.observedRevision = importProfileStateJson(opened.db, rawJson, {
+        expectedRevision: this.observedRevision
+      })
+      return
+    }
+    this.observedRevision = writeProfileStateDomains(opened.db, {
+      expectedRevision: this.observedRevision ?? currentRevision,
+      replacements: complete
+    }).revision
+  }
+
+  scheduleBackup(): void {
+    this.assertActive()
+    this.backupRotation ??= new ProfileStateBackupRotation(this.databasePath, this.profileId)
+    this.backupRotation.schedule()
+  }
+
+  async drainBackups(): Promise<void> {
+    this.assertActive()
+    await this.backupRotation?.drain()
+  }
+
+  writeJsonExport(targetPath: string): number {
+    return writeProfileStateAuthorityJsonExport(
+      this.openWritableDatabase().db,
+      targetPath,
+      this.observedRevision
+    )
+  }
+
+  writeJsonCompatibilityExport(targetPath: string): number | undefined {
+    return writeProfileStateAuthorityCompatibilityExport(
+      this.openWritableDatabase().db,
+      targetPath,
+      this.observedRevision
+    )
+  }
+
+  writeJsonCompatibilityExportAsync(targetPath: string): Promise<number | undefined> {
+    return writeProfileStateAuthorityCompatibilityExportAsync(
+      this.openWritableDatabase().db,
+      targetPath,
+      this.observedRevision
+    )
+  }
+
+  quarantineDatabase(quarantineRoot?: string, reason?: string): ProfileStateDatabaseQuarantine {
+    this.assertActive()
+    this.backupRotation?.assertIdle()
+    this.close()
+    return quarantineProfileStateDatabase(this.databasePath, this.profileId, quarantineRoot, reason)
+  }
+
+  close(): void {
+    this.assertActive()
+    this.backupRotation?.stop()
+    this.writableDatabase?.db.close()
+    this.writableDatabase = undefined
+  }
+
+  async pauseForMaintenance(): Promise<ProfileStateMaintenance> {
+    const revision = this.revision
+    await this.drainBackups()
+    this.close()
+    let consumed = false
+    return {
+      resume: async () => {
+        if (consumed) {
+          throw new Error('Profile maintenance resume has already been consumed')
+        }
+        consumed = true
+        assertProfileStateRevisionOnDisk(this.databasePath, this.profileId, revision)
+        this.assertCurrentRevision()
+        this.backupRotation = undefined
+      }
+    }
+  }
+
+  private createInitialState(
+    revision: number,
+    value: Record<string, unknown> | undefined
+  ): ProfileStateAuthorityInitialState<ProfileStateSqliteAuthority> {
+    let pending: { revision: number; value: Record<string, unknown> | undefined } | undefined = {
+      revision,
+      value
+    }
+    this.observedRevision = revision
+    return {
+      authority: this,
+      takeParsedState: () => {
+        this.assertActive()
+        const snapshot = pending
+        if (snapshot === undefined) {
+          throw new Error('Profile state startup snapshot has already been consumed')
+        }
+        pending = undefined
+        this.observedRevision = snapshot.revision
+        return snapshot.value
+      }
+    }
+  }
+
+  private assertActive(): void {
+    if (this.retired) {
+      throw new Error('Profile state authority was retired for worker ownership')
+    }
+  }
+
+  private openWritableDatabase(): NonNullable<ProfileStateSqliteAuthority['writableDatabase']> {
+    this.assertActive()
+    this.writableDatabase ??= openWritableProfileStateDatabase(this.databasePath, this.profileId)
+    return this.writableDatabase
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-startup-authority.test.ts b/src/main/persistence/profile-state/profile-state-startup-authority.test.ts
new file mode 100644
index 00000000000..539556d788f
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-startup-authority.test.ts
@@ -0,0 +1,292 @@
+import { build } from 'esbuild'
+import type * as WorkerEntryPath from '../../worker-thread-entry-path'
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+import {
+  createProfileStateStoreForStartup,
+  ProfileStateStartupAuthorityError,
+  type ProfileStateStartupAuthorityOptions
+} from './profile-state-startup-authority'
+import { openProfileStateDatabase, profileStateDatabaseFile } from './profile-state-database'
+
+const bundle = vi.hoisted(() => ({ directory: '' }))
+vi.mock('../../worker-thread-entry-path', async (importOriginal) => {
+  const original = await importOriginal<typeof WorkerEntryPath>()
+  return {
+    ...original,
+    resolveWorkerThreadEntryPath: (
+      layout: Parameters<typeof original.resolveWorkerThreadEntryPath>[0],
+      name: string
+    ) =>
+      name.startsWith('profile-state-')
+        ? join(bundle.directory, name)
+        : original.resolveWorkerThreadEntryPath(layout, name)
+  }
+})
+
+beforeAll(async () => {
+  bundle.directory = mkdtempSync(join(tmpdir(), 'orca-startup-writers-'))
+  await build({
+    entryPoints: [
+      resolve('src/main/persistence/profile-state/profile-state-writer-worker-entry.ts'),
+      resolve('src/main/persistence/profile-state/profile-state-backup-worker-entry.ts')
+    ],
+    outdir: bundle.directory,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    logLevel: 'silent'
+  })
+})
+afterAll(() => rmSync(bundle.directory, { recursive: true, force: true }))
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (value: string) => Buffer.from(`encrypted:${value}`, 'utf8'),
+    decryptString: (value: Buffer) => value.toString('utf8').slice('encrypted:'.length)
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+
+vi.mock('../../telemetry/client', () => ({ track: () => {} }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+
+describe('profile-state startup authority boundary', () => {
+  it('imports legacy desktop state by default and reopens acknowledged SQLite state', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-startup-authority-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databaseFile = profileStateDatabaseFile(directory)
+    writeFileSync(dataFile, JSON.stringify(buildProfileStateCutoverFixture(directory)))
+
+    const base: Omit<ProfileStateStartupAuthorityOptions, 'runtime'> = {
+      dataFile,
+      databaseFile,
+      profileId: 'startup-authority-test',
+      storageAuthority: 'desktop'
+    }
+    const candidate = await createProfileStateStoreForStartup({
+      ...base,
+      runtime: 'desktop'
+    })
+    expect(candidate.backend).toBe('sqlite')
+    expect(candidate.migrated).toBe(true)
+    candidate.store.updateSettings({ theme: 'dark' })
+    await candidate.store.flushPendingOrThrowAsync()
+    await candidate.store.freezeWritesAsync()
+    rmSync(dataFile)
+
+    const restarted = await createProfileStateStoreForStartup({
+      ...base,
+      runtime: 'desktop'
+    })
+    expect(restarted.backend).toBe('sqlite')
+    expect(restarted.classification).toBe('sqlite-only')
+    expect(restarted.store.getSettings().theme).toBe('dark')
+    await restarted.store.freezeWritesAsync()
+
+    const packaged = await createProfileStateStoreForStartup({
+      ...base,
+      runtime: 'desktop'
+    })
+    expect(packaged.backend).toBe('sqlite')
+    expect(packaged.classification).toBe('sqlite-only')
+    expect(packaged.store.getSettings().theme).toBe('dark')
+    await packaged.store.freezeWritesAsync()
+
+    const orcad = await createProfileStateStoreForStartup({
+      ...base,
+      runtime: 'orcad',
+      storageAuthority: 'runtime'
+    })
+    expect(orcad.backend).toBe('sqlite')
+    await orcad.store.freezeWritesAsync()
+  })
+
+  it('rejects direct orcad startup on an incapable runtime', async () => {
+    const original = process.getBuiltinModule
+    vi.spyOn(process, 'getBuiltinModule').mockImplementation((id) => {
+      if (id === 'node:sqlite' || id === 'bun:sqlite') {
+        return undefined
+      }
+      return original(id)
+    })
+
+    await expect(
+      createProfileStateStoreForStartup({
+        dataFile: join(tmpdir(), 'missing-orca-data.json'),
+        databaseFile: join(tmpdir(), 'missing-profile-state.db'),
+        profileId: 'startup-authority-node18-test',
+        runtime: 'orcad',
+        storageAuthority: 'runtime'
+      })
+    ).rejects.toThrowError(ProfileStateStartupAuthorityError)
+  })
+
+  it('creates an empty desktop profile directly in SQLite and preserves its first acknowledged write', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-default-empty-profile-'))
+    temporaryDirectories.push(directory)
+    const options: ProfileStateStartupAuthorityOptions = {
+      dataFile: join(directory, 'orca-data.json'),
+      databaseFile: profileStateDatabaseFile(directory),
+      profileId: 'default-empty',
+      runtime: 'desktop',
+      storageAuthority: 'desktop'
+    }
+    const first = await createProfileStateStoreForStartup(options)
+    try {
+      expect(first.backend).toBe('sqlite')
+      expect(first.classification).toBe('neither')
+      first.store.updateSettings({ terminalFontSize: 19 })
+      await first.store.flushPendingOrThrowAsync()
+      expect(existsSync(options.databaseFile)).toBe(true)
+      expect(existsSync(options.dataFile)).toBe(false)
+    } finally {
+      await first.store.freezeWritesAsync()
+    }
+    const reopened = await createProfileStateStoreForStartup(options)
+    try {
+      expect(reopened.backend).toBe('sqlite')
+      expect(reopened.migrated).toBe(false)
+      expect(reopened.store.getSettings().terminalFontSize).toBe(19)
+    } finally {
+      await reopened.store.freezeWritesAsync()
+    }
+  })
+
+  it.each(['corrupt', 'future-schema', 'ambiguous'] as const)(
+    'refuses %s storage under the desktop default without replacing the authority',
+    async (kind) => {
+      const directory = mkdtempSync(join(tmpdir(), 'orca-default-invalid-profile-'))
+      temporaryDirectories.push(directory)
+      const options: ProfileStateStartupAuthorityOptions = {
+        dataFile: join(directory, 'orca-data.json'),
+        databaseFile: profileStateDatabaseFile(directory),
+        profileId: 'default-invalid',
+        runtime: 'desktop',
+        storageAuthority: 'desktop'
+      }
+      if (kind === 'corrupt') {
+        writeFileSync(options.databaseFile, 'not a SQLite database')
+      } else {
+        const opened = openProfileStateDatabase(options.databaseFile, options.profileId)
+        try {
+          if (kind === 'future-schema') {
+            opened.db.exec('PRAGMA user_version = 999')
+          } else {
+            writeFileSync(options.dataFile, '{"settings":{"theme":"dark"}}')
+          }
+        } finally {
+          opened.db.close()
+        }
+      }
+      const before = readFileSync(options.databaseFile)
+      await expect(createProfileStateStoreForStartup(options)).rejects.toMatchObject({
+        code:
+          kind === 'future-schema'
+            ? 'newer-schema'
+            : kind === 'ambiguous'
+              ? 'ambiguous-profile-state'
+              : 'profile-state-recovery-required'
+      })
+      expect(readFileSync(options.databaseFile)).toEqual(before)
+      if (kind === 'ambiguous') {
+        expect(readFileSync(options.dataFile, 'utf8')).toBe('{"settings":{"theme":"dark"}}')
+      }
+    }
+  )
+
+  it('migrates a JSON-only orcad profile when the runtime exposes SQLite', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-orcad-capable-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databaseFile = profileStateDatabaseFile(directory)
+    writeFileSync(dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+
+    const result = await createProfileStateStoreForStartup({
+      dataFile,
+      databaseFile,
+      profileId: 'orcad-capable-test',
+      runtime: 'orcad',
+      storageAuthority: 'runtime'
+    })
+
+    expect(result.backend).toBe('sqlite')
+    expect(result.migrated).toBe(true)
+    expect(result.store.getSettings().theme).toBe('dark')
+    await result.store.freezeWritesAsync()
+  })
+
+  it('refuses a runtime with SQLite but no native backup', async () => {
+    const original = process.getBuiltinModule
+    vi.spyOn(process, 'getBuiltinModule').mockImplementation((id) => {
+      if (id === 'bun:sqlite') {
+        return undefined
+      }
+      return id === 'node:sqlite' ? { DatabaseSync: class {} } : original(id)
+    })
+    await expect(
+      createProfileStateStoreForStartup({
+        dataFile: join(tmpdir(), 'missing-backup-orca-data.json'),
+        databaseFile: join(tmpdir(), 'missing-backup-profile-state.db'),
+        profileId: 'missing-native-backup',
+        runtime: 'orcad',
+        storageAuthority: 'runtime'
+      })
+    ).rejects.toThrowError(ProfileStateStartupAuthorityError)
+  })
+
+  it('leaves legacy JSON untouched when the runtime cannot own SQLite', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-orcad-node18-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databaseFile = profileStateDatabaseFile(directory)
+    const source = JSON.stringify({ settings: { theme: 'dark' } })
+    writeFileSync(dataFile, source)
+    const original = process.getBuiltinModule
+    vi.spyOn(process, 'getBuiltinModule').mockImplementation((id) =>
+      id === 'node:sqlite' || id === 'bun:sqlite' ? undefined : original(id)
+    )
+
+    await expect(
+      createProfileStateStoreForStartup({
+        dataFile,
+        databaseFile,
+        profileId: 'orcad-node18-test',
+        runtime: 'orcad',
+        storageAuthority: 'runtime'
+      })
+    ).rejects.toThrowError(ProfileStateStartupAuthorityError)
+
+    expect(readFileSync(dataFile, 'utf8')).toBe(source)
+    expect(existsSync(databaseFile)).toBe(false)
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-startup-authority.ts b/src/main/persistence/profile-state/profile-state-startup-authority.ts
new file mode 100644
index 00000000000..55c9a031455
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-startup-authority.ts
@@ -0,0 +1,45 @@
+import type { AutomationStorageAuthority } from '../scheduling-automations/automation-owner-projection'
+import { isProfileStateSqliteAvailable } from './profile-state-database'
+import type {
+  ProfileStateStoreFactoryOptions,
+  ProfileStateStoreFactoryResult
+} from './profile-state-store-factory'
+import { createLiveProfileStateStore } from './profile-state-live-store-factory'
+
+/** Runtime roots sharing the profile-state selection boundary. */
+export type ProfileStateStartupRuntime = 'desktop' | 'orcad'
+
+export type ProfileStateStartupAuthorityOptions = Omit<
+  ProfileStateStoreFactoryOptions,
+  'storageAuthority'
+> & {
+  runtime: ProfileStateStartupRuntime
+  storageAuthority: AutomationStorageAuthority
+  onPersistenceFailure?: (error: Error) => void
+}
+
+export class ProfileStateStartupAuthorityError extends Error {
+  readonly code = 'orcad-sqlite-authority-unsupported' as const
+
+  constructor() {
+    super(
+      'orcad requires SQLite database and backup support. Launch through its bundled Bun runtime.'
+    )
+    this.name = 'ProfileStateStartupAuthorityError'
+  }
+}
+
+/** Construct both runtimes through the same validated authority boundary. */
+export async function createProfileStateStoreForStartup(
+  options: ProfileStateStartupAuthorityOptions
+): Promise<ProfileStateStoreFactoryResult> {
+  if (options.runtime === 'orcad' && !isProfileStateSqliteAvailable()) {
+    throw new ProfileStateStartupAuthorityError()
+  }
+  return createLiveProfileStateStore(options, {
+    onFailure:
+      options.onPersistenceFailure ??
+      ((error) =>
+        console.error('[persistence] Saving has stopped. Restart Orca before continuing.', error))
+  })
+}
diff --git a/src/main/persistence/profile-state/profile-state-startup-failure.test.ts b/src/main/persistence/profile-state/profile-state-startup-failure.test.ts
new file mode 100644
index 00000000000..e82ee6ba56f
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-startup-failure.test.ts
@@ -0,0 +1,96 @@
+import { describe, expect, it } from 'vitest'
+import {
+  ProfileStateAuthorityBootstrapError,
+  ProfileStateRecoveryRequiredError
+} from './profile-state-authority-bootstrap'
+import {
+  formatProfileStateStartupFailure,
+  profileStateStartupFailureClass
+} from './profile-state-startup-failure'
+import { ProfileStateWriterError } from './profile-state-writer-errors'
+import { ProfileStateRevisionConflictError } from './profile-state-document-validation'
+import { ProfileStateDatabaseOpenError } from './profile-state-database-errors'
+
+describe('profile-state startup failure formatting', () => {
+  it('asks for a newer build instead of rollback when the schema is newer', () => {
+    const error = new ProfileStateDatabaseOpenError('newer-schema', 'Newer schema: 999')
+    expect(profileStateStartupFailureClass(error)).toBe('newer-schema')
+    const message = formatProfileStateStartupFailure(error)
+    expect(message).toContain('newer version of Orca')
+    expect(message).not.toContain('rollback')
+    expect(message).not.toContain('unreadable')
+  })
+
+  it('prints recovery paths and the offline rollback command', () => {
+    const error = new ProfileStateRecoveryRequiredError(
+      {
+        dataFile: '/profile/orca-data.json',
+        databaseFile: '/profile/profile-state.db',
+        profileId: 'profile-a'
+      },
+      new Error('database is corrupt')
+    )
+
+    expect(formatProfileStateStartupFailure(error)).toContain(
+      'orca profile state rollback --revision <revision>'
+    )
+    expect(formatProfileStateStartupFailure(error)).toContain('/profile/profile-state.db')
+    expect(profileStateStartupFailureClass(error)).toBe('recovery-required')
+  })
+
+  it('explains ambiguity and offers explicit inspection before choosing a recovery point', () => {
+    const message = formatProfileStateStartupFailure(
+      new ProfileStateAuthorityBootstrapError('both profile stores are present')
+    )
+
+    expect(message).toContain(
+      'Orca cannot safely choose a profile-state authority: both profile stores are present'
+    )
+    expect(message).toContain('neither is selected automatically')
+    expect(message).toContain('orca profile state rollback --current-json')
+    expect(message).toContain('does not merge')
+    expect(message).toContain('orca profile state exports')
+    expect(message).toContain('orca profile state rollback --backup <id>')
+    expect(
+      profileStateStartupFailureClass(new ProfileStateAuthorityBootstrapError('ambiguous'))
+    ).toBe('ambiguous-authority')
+  })
+
+  it('shows retained SQLite backups and their explicit recovery command without JSON exports', () => {
+    const message = formatProfileStateStartupFailure({
+      code: 'profile-state-recovery-required',
+      dataFile: '/profile/orca-data.json',
+      databaseFile: '/profile/profile-state.db',
+      exportPaths: [],
+      backupPaths: ['/profile/profile-state.db.backup.latest.db']
+    })
+    expect(message).toContain(
+      'Retained SQLite backups:\n  /profile/profile-state.db.backup.latest.db'
+    )
+    expect(message).toContain('orca profile state rollback --backup <id>')
+  })
+
+  it('leaves unrelated startup errors on the existing fatal path', () => {
+    expect(formatProfileStateStartupFailure(new Error('unrelated startup failure'))).toBeUndefined()
+    expect(profileStateStartupFailureClass(new Error('unrelated startup failure'))).toBeUndefined()
+  })
+
+  it('reports a missing writer without exposing its cause or suggesting database rollback', () => {
+    const error = new ProfileStateWriterError(
+      'profile-state-writer-unavailable',
+      'Profile state writer could not start',
+      'known-failure',
+      { cause: new Error('private runtime path') }
+    )
+    expect(profileStateStartupFailureClass(error)).toBe('writer-unavailable')
+    expect(formatProfileStateStartupFailure(error)).toBe(
+      'Orca could not start profile persistence. Restart Orca; if the problem continues, repair or reinstall this build.'
+    )
+  })
+
+  it('reports an admission race as a conflicting writer', () => {
+    const error = new ProfileStateRevisionConflictError(2, 3)
+    expect(profileStateStartupFailureClass(error)).toBe('revision-conflict')
+    expect(formatProfileStateStartupFailure(error)).toContain('Close other Orca processes')
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-startup-failure.ts b/src/main/persistence/profile-state/profile-state-startup-failure.ts
new file mode 100644
index 00000000000..4c8710cbca2
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-startup-failure.ts
@@ -0,0 +1,133 @@
+type ProfileStateRecoveryFailure = {
+  code: 'profile-state-recovery-required'
+  dataFile: string
+  databaseFile: string
+  exportPaths: readonly string[]
+  backupPaths?: readonly string[]
+}
+
+type ProfileStateAuthorityFailure = {
+  code: 'ambiguous-profile-state'
+  message: string
+  divergence?: unknown
+}
+
+export type ProfileStateStartupFailureClass =
+  | 'recovery-required'
+  | 'ambiguous-authority'
+  | 'revision-conflict'
+  | 'writer-unavailable'
+  | 'newer-schema'
+  | 'publication-unavailable'
+
+/** Return the bounded failure class used by startup breadcrumbs and support diagnostics. */
+export function profileStateStartupFailureClass(
+  error: unknown
+): ProfileStateStartupFailureClass | undefined {
+  if (isProfileStateRecoveryFailure(error)) {
+    return 'recovery-required'
+  }
+  if (isProfileStateAuthorityFailure(error)) {
+    return 'ambiguous-authority'
+  }
+  if (isRecord(error) && typeof error.code === 'string') {
+    if (error.code === 'profile-state-publication-unavailable') {
+      return 'publication-unavailable'
+    }
+    if (error.code === 'newer-schema') {
+      return 'newer-schema'
+    }
+    if (error.code === 'profile-state-revision-conflict') {
+      return 'revision-conflict'
+    }
+    if (error.code.startsWith('profile-state-writer-')) {
+      return 'writer-unavailable'
+    }
+  }
+  return undefined
+}
+
+/** Both copies are readable and differ only because JSON changed outside SQLite. */
+export function isDivergedProfileStateFailure(error: unknown): boolean {
+  return isProfileStateAuthorityFailure(error) && error.divergence === 'diverged-json'
+}
+
+/** Format profile-state startup failures without exposing a generic fatal-error path. */
+export function formatProfileStateStartupFailure(error: unknown): string | undefined {
+  if (isProfileStateRecoveryFailure(error)) {
+    const retainedBackups = !error.backupPaths?.length
+      ? '  (none found)'
+      : error.backupPaths.map((path) => `  ${path}`).join('\n')
+    const retainedExports =
+      error.exportPaths.length === 0
+        ? '  (none found)'
+        : error.exportPaths.map((path) => `  ${path}`).join('\n')
+    return [
+      'Orca cannot safely open the active profile because its SQLite state is unreadable.',
+      `Legacy JSON path: ${error.dataFile}`,
+      `SQLite path: ${error.databaseFile}`,
+      'Retained SQLite backups:',
+      retainedBackups,
+      'Retained JSON exports:',
+      retainedExports,
+      'Stop Orca, then run `orca profile state exports` and choose a known-good recovery artifact.',
+      'Restore SQLite with `orca profile state rollback --backup <id>`, or restore a JSON export with',
+      '`orca profile state rollback --revision <revision>`.'
+    ].join('\n')
+  }
+
+  if (isProfileStateAuthorityFailure(error)) {
+    return [
+      `Orca cannot safely choose a profile-state authority: ${error.message}`,
+      'An older build may have changed the JSON file. Both copies are preserved; neither is selected automatically.',
+      'Stop Orca and copy the profile directory before choosing which state to keep.',
+      'To keep the current JSON, including edits from an older build, run `orca profile state rollback --current-json`. This archives both copies and does not merge their contents.',
+      'Run `orca profile state exports` to inspect retained recovery points.',
+      'Use `orca profile state rollback --backup <id>` or `orca profile state rollback --revision <revision>` only after selecting the state you want to restore.'
+    ].join('\n')
+  }
+
+  const failureClass = profileStateStartupFailureClass(error)
+  if (
+    failureClass === 'publication-unavailable' &&
+    isRecord(error) &&
+    typeof error.message === 'string'
+  ) {
+    return error.message
+  }
+  if (failureClass === 'newer-schema') {
+    return 'This profile was saved by a newer version of Orca. Open it with that version or a newer release. Your profile has not been changed.'
+  }
+  if (failureClass === 'revision-conflict') {
+    return 'The active profile changed while Orca was starting. Close other Orca processes using this profile, then restart Orca.'
+  }
+  if (failureClass === 'writer-unavailable') {
+    return 'Orca could not start profile persistence. Restart Orca; if the problem continues, repair or reinstall this build.'
+  }
+
+  return undefined
+}
+
+function isProfileStateRecoveryFailure(error: unknown): error is ProfileStateRecoveryFailure {
+  return (
+    isRecord(error) &&
+    error.code === 'profile-state-recovery-required' &&
+    typeof error.dataFile === 'string' &&
+    typeof error.databaseFile === 'string' &&
+    Array.isArray(error.exportPaths) &&
+    error.exportPaths.every((path) => typeof path === 'string') &&
+    (error.backupPaths === undefined ||
+      (Array.isArray(error.backupPaths) &&
+        error.backupPaths.every((path) => typeof path === 'string')))
+  )
+}
+
+function isProfileStateAuthorityFailure(error: unknown): error is ProfileStateAuthorityFailure {
+  return (
+    isRecord(error) && error.code === 'ambiguous-profile-state' && typeof error.message === 'string'
+  )
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null
+}
diff --git a/src/main/persistence/profile-state/profile-state-startup-recovery-dialog.test.ts b/src/main/persistence/profile-state/profile-state-startup-recovery-dialog.test.ts
new file mode 100644
index 00000000000..80c8687bbcc
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-startup-recovery-dialog.test.ts
@@ -0,0 +1,99 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  chooseProfileStateCopy,
+  presentProfileStateStartupRecoveryDialog
+} from './profile-state-startup-recovery-dialog'
+
+describe('profile state startup recovery dialog', () => {
+  it('offers a copyable offline export command and does not mutate state', async () => {
+    const showMessageBox = vi.fn().mockResolvedValue({ response: 0 })
+    const copyToClipboard = vi.fn()
+
+    await presentProfileStateStartupRecoveryDialog({
+      message: 'SQLite state is unreadable.\nSQLite path: /tmp/profile-state.db',
+      recoveryCommand: 'orca profile state exports',
+      showMessageBox,
+      copyToClipboard
+    })
+
+    expect(showMessageBox).toHaveBeenCalledWith({
+      type: 'error',
+      buttons: ['Copy recovery command', 'Quit'],
+      defaultId: 1,
+      cancelId: 1,
+      title: 'Orca profile state cannot be opened',
+      message: 'Orca cannot safely open this profile.',
+      detail:
+        'SQLite state is unreadable.\nSQLite path: /tmp/profile-state.db\n\nCopy the recovery command, then run it after Orca closes.'
+    })
+    expect(copyToClipboard).toHaveBeenCalledWith('orca profile state exports')
+  })
+
+  it('leaves the clipboard untouched when the user quits', async () => {
+    const showMessageBox = vi.fn().mockResolvedValue({ response: 1 })
+    const copyToClipboard = vi.fn()
+
+    await presentProfileStateStartupRecoveryDialog({
+      message: 'ambiguous profile state',
+      recoveryCommand: 'orca profile state exports',
+      showMessageBox,
+      copyToClipboard
+    })
+
+    expect(copyToClipboard).not.toHaveBeenCalled()
+  })
+
+  it('does not offer rollback for an authority ambiguity', async () => {
+    const showMessageBox = vi.fn().mockResolvedValue({ response: 0 })
+    const copyToClipboard = vi.fn()
+
+    await presentProfileStateStartupRecoveryDialog({
+      message: 'both profile authorities are present',
+      showMessageBox,
+      copyToClipboard
+    })
+
+    expect(showMessageBox).toHaveBeenCalledWith(
+      expect.objectContaining({
+        buttons: ['Quit'],
+        defaultId: 0,
+        cancelId: 0,
+        detail:
+          'both profile authorities are present\n\nQuit Orca and resolve the profile-state authority before retrying.'
+      })
+    )
+    expect(copyToClipboard).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    [0, 'current-sqlite'],
+    [1, 'current-json'],
+    [2, undefined]
+  ] as const)('maps choice button %i to %s', async (response, expected) => {
+    const showMessageBox = vi.fn().mockResolvedValue({ response })
+    await expect(
+      chooseProfileStateCopy({
+        sqliteSavedAt: new Date(1),
+        jsonSavedAt: new Date(2),
+        formatTime: (time) => `t${time.getTime()}`,
+        showMessageBox
+      })
+    ).resolves.toBe(expected)
+    expect(showMessageBox).toHaveBeenCalledWith(
+      expect.objectContaining({
+        buttons: ['Use SQLite (Recommended)', 'Use JSON', 'Quit'],
+        defaultId: 0,
+        cancelId: 2
+      })
+    )
+    const { detail } = showMessageBox.mock.calls[0][0]
+    expect(detail).toContain('Last saved t1.')
+    expect(detail).toContain('Last saved t2.')
+  })
+
+  it('omits save times it could not read', async () => {
+    const showMessageBox = vi.fn().mockResolvedValue({ response: 2 })
+    await chooseProfileStateCopy({ showMessageBox })
+    expect(showMessageBox.mock.calls[0][0].detail).not.toContain('Last saved')
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-startup-recovery-dialog.ts b/src/main/persistence/profile-state/profile-state-startup-recovery-dialog.ts
new file mode 100644
index 00000000000..9201ab54e17
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-startup-recovery-dialog.ts
@@ -0,0 +1,100 @@
+import { statSync } from 'node:fs'
+import type { MessageBoxOptions, MessageBoxReturnValue } from 'electron'
+import { getActiveProfileStateLocation } from './profile-state-active-location'
+import { profileStateDatabaseFiles } from './profile-state-storage-classification'
+
+export type ProfileStateStartupRecoveryDialogDeps = {
+  message: string
+  recoveryCommand?: string
+  showMessageBox: (options: MessageBoxOptions) => Promise<MessageBoxReturnValue>
+  copyToClipboard: (text: string) => void
+}
+
+/** Present the only safe desktop recovery action without changing the failed authority. */
+export async function presentProfileStateStartupRecoveryDialog(
+  deps: ProfileStateStartupRecoveryDialogDeps
+): Promise<void> {
+  const buttons = deps.recoveryCommand ? ['Copy recovery command', 'Quit'] : ['Quit']
+  const detail = deps.recoveryCommand
+    ? `${deps.message}\n\nCopy the recovery command, then run it after Orca closes.`
+    : `${deps.message}\n\nQuit Orca and resolve the profile-state authority before retrying.`
+  const { response } = await deps.showMessageBox({
+    type: 'error',
+    buttons,
+    defaultId: buttons.length - 1,
+    cancelId: buttons.length - 1,
+    title: 'Orca profile state cannot be opened',
+    message: 'Orca cannot safely open this profile.',
+    detail
+  })
+  if (response === 0 && deps.recoveryCommand) {
+    deps.copyToClipboard(deps.recoveryCommand)
+  }
+}
+
+export type ProfileStateCopyChoice = 'current-sqlite' | 'current-json'
+
+export type ProfileStateCopyChoiceDialogDeps = {
+  sqliteSavedAt?: Date
+  jsonSavedAt?: Date
+  formatTime?: (time: Date) => string
+  showMessageBox: (options: MessageBoxOptions) => Promise<MessageBoxReturnValue>
+}
+
+/** Best-effort save times; SQLite's latest commit may live only in its WAL, and -shm changes on every open. */
+export function readProfileStateCopySavedTimes(userDataPath: string): {
+  sqliteSavedAt?: Date
+  jsonSavedAt?: Date
+} {
+  try {
+    const location = getActiveProfileStateLocation(userDataPath)
+    if (location === undefined) {
+      return {}
+    }
+    const sqliteTimes = profileStateDatabaseFiles(location.databaseFile)
+      .filter((path) => !path.endsWith('-shm'))
+      .map(modifiedAt)
+      .filter((time) => time !== undefined)
+    const sqliteSavedAt =
+      sqliteTimes.length === 0 ? undefined : new Date(Math.max(...sqliteTimes.map(Number)))
+    const jsonSavedAt = modifiedAt(location.dataFile)
+    return {
+      ...(sqliteSavedAt === undefined ? {} : { sqliteSavedAt }),
+      ...(jsonSavedAt === undefined ? {} : { jsonSavedAt })
+    }
+  } catch {
+    return {}
+  }
+}
+
+function modifiedAt(path: string): Date | undefined {
+  return statSync(path, { throwIfNoEntry: false })?.mtime
+}
+
+/** Ask which diverged copy to keep; undefined means quit without changing either. */
+export async function chooseProfileStateCopy(
+  deps: ProfileStateCopyChoiceDialogDeps
+): Promise<ProfileStateCopyChoice | undefined> {
+  const format = deps.formatTime ?? ((time: Date) => time.toLocaleString())
+  const savedAt = (time: Date | undefined): string =>
+    time === undefined ? '' : ` Last saved ${format(time)}.`
+  const { response } = await deps.showMessageBox({
+    type: 'warning',
+    buttons: ['Use SQLite (Recommended)', 'Use JSON', 'Quit'],
+    defaultId: 0,
+    cancelId: 2,
+    noLink: true,
+    title: 'Choose profile state',
+    message: 'This profile has two saved copies that don’t match.',
+    detail: [
+      'This usually happens after opening the profile in an older version of Orca.',
+      '',
+      `SQLite: what this version of Orca saved. Changes made in the older version are discarded.${savedAt(deps.sqliteSavedAt)}`,
+      '',
+      `JSON: includes changes made in the older version. Changes this version saved since then are discarded.${savedAt(deps.jsonSavedAt)}`,
+      '',
+      'Orca archives both copies before switching, then restarts.'
+    ].join('\n')
+  })
+  return response === 0 ? 'current-sqlite' : response === 1 ? 'current-json' : undefined
+}
diff --git a/src/main/persistence/profile-state/profile-state-startup-secrets.test.ts b/src/main/persistence/profile-state/profile-state-startup-secrets.test.ts
new file mode 100644
index 00000000000..e9fbd395bd0
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-startup-secrets.test.ts
@@ -0,0 +1,184 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  getSecretStore,
+  hasSecretStore,
+  setSecretStore,
+  _resetSecretStoreForTests
+} from '../../../shared/secret-store'
+import { Store } from '../loading-store/store'
+import * as storeDomains from '../loading-store/store-domain-composition'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+
+let keyState: 'available' | 'unavailable' | 'decrypt-fails' = 'available'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+vi.mock('../../telemetry/client', () => ({ track: () => {} }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+let originalSecretStore: ReturnType<typeof getSecretStore> | undefined
+beforeEach(() => {
+  originalSecretStore = hasSecretStore() ? getSecretStore() : undefined
+  setSecretStore({
+    isEncryptionAvailable: () => keyState !== 'unavailable',
+    encryptString: (value) => Buffer.from(`encrypted:${value}`, 'utf8'),
+    decryptString: (value) => {
+      if (keyState === 'decrypt-fails') {
+        throw new Error('keychain denied decryption')
+      }
+      return value.toString('utf8').slice('encrypted:'.length)
+    },
+    describeProtectionGap: () => null
+  })
+})
+
+const directories: string[] = []
+const stores: Store[] = []
+afterEach(async () => {
+  vi.restoreAllMocks()
+  for (const store of stores) {
+    store.freezeWrites()
+  }
+  for (const store of stores.splice(0)) {
+    await store.flushAsync()
+  }
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  keyState = 'available'
+  if (originalSecretStore) {
+    setSecretStore(originalSecretStore)
+  } else {
+    _resetSecretStoreForTests()
+  }
+})
+
+const secrets = {
+  proxy: 'http://user:password@proxy.test:8080',
+  cookie: 'startup-secret-cookie',
+  kagi: 'https://kagi.com/session?t=startup-secret',
+  lease: `startup-owner-lease-${'x'.repeat(480)}`
+}
+const sealed = (value: string) => Buffer.from(`encrypted:${value}`, 'utf8').toString('base64')
+
+it.each([false, true])(
+  'rejects reused input before Store context installation (secret=%s)',
+  (hasSecret) => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-consumed-startup-'))
+    directories.push(directory)
+    const authority = new ProfileStateSqliteAuthority(join(directory, 'profile-state.db'), 'once')
+    if (hasSecret) {
+      authority.writeSerializedState(
+        Buffer.from(
+          JSON.stringify({
+            settings: { opencodeSessionCookie: sealed(secrets.cookie) }
+          })
+        )
+      )
+    }
+    const options = {
+      dataFile: join(directory, 'orca-data.json'),
+      profileStateAuthority: authority,
+      initialAuthorityState: authority.readInitialState()
+    }
+    const store = new Store(options)
+    stores.push(store)
+    if (hasSecret) {
+      expect(store.getSettings().opencodeSessionCookie).toBe(secrets.cookie)
+    }
+    const install = vi.spyOn(storeDomains, 'installStoreDomainContexts')
+
+    expect(() => new Store(options)).toThrow('already been consumed')
+    expect(install).not.toHaveBeenCalled()
+  }
+)
+
+describe.each(['serialized', 'parsed'] as const)(
+  '%s startup secret retention',
+  (representation) => {
+    it.each(['available', 'unavailable', 'decrypt-fails'] as const)(
+      'preserves every protected slot through an unrelated save when keys are %s',
+      async (failure) => {
+        const directory = mkdtempSync(join(tmpdir(), 'orca-startup-secrets-'))
+        directories.push(directory)
+        const dataFile = join(directory, 'orca-data.json')
+        const databaseFile = join(directory, 'profile-state.db')
+        function open() {
+          const authority = new ProfileStateSqliteAuthority(databaseFile, 'startup-secrets')
+          const store = new Store({
+            dataFile,
+            profileStateAuthority: authority,
+            ...(representation === 'parsed'
+              ? { initialAuthorityState: authority.readInitialState() }
+              : {})
+          })
+          stores.push(store)
+          return { store, authority }
+        }
+
+        const seeded = open()
+        seeded.store.updateSettings({
+          httpProxyUrl: secrets.proxy,
+          opencodeSessionCookie: secrets.cookie
+        })
+        seeded.store.updateUI({ browserKagiSessionLink: secrets.kagi })
+        await seeded.store.upsertSshPtyConsumerRecovery({
+          targetId: 'ssh-1',
+          clientInstanceId: 'client-1',
+          serverBuildId: 'server-1',
+          clientGeneration: 1,
+          ownerGeneration: 1,
+          ownerLease: secrets.lease
+        })
+        await seeded.store.flushAsync()
+        seeded.store.freezeWrites()
+
+        keyState = failure
+        const reopened = open()
+        reopened.store.updateSettings({ terminalFontSize: 19 })
+        await reopened.store.flushAsync()
+        const persisted = reopened.authority.readSerializedState()
+        expect(persisted).toBeDefined()
+        for (const value of Object.values(secrets)) {
+          expect(persisted).not.toContain(value)
+        }
+        expect(JSON.parse(persisted ?? 'null')).toMatchObject({
+          settings: {
+            terminalFontSize: 19,
+            httpProxyUrl: sealed(secrets.proxy),
+            opencodeSessionCookie: sealed(secrets.cookie)
+          },
+          ui: { browserKagiSessionLink: sealed(secrets.kagi) },
+          sshPtyConsumerRecoveries: [{ ownerLease: sealed(secrets.lease) }]
+        })
+        reopened.store.freezeWrites()
+
+        keyState = 'available'
+        const restored = open().store
+        expect(restored.getSettings().httpProxyUrl).toBe(secrets.proxy)
+        expect(restored.getSettings().opencodeSessionCookie).toBe(secrets.cookie)
+        expect(restored.getUI().browserKagiSessionLink).toBe(secrets.kagi)
+        expect(restored.getSshPtyConsumerRecovery('ssh-1')?.ownerLease).toBe(secrets.lease)
+      }
+    )
+  }
+)
diff --git a/src/main/persistence/profile-state/profile-state-startup-snapshot.test.ts b/src/main/persistence/profile-state/profile-state-startup-snapshot.test.ts
new file mode 100644
index 00000000000..e53c425465d
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-startup-snapshot.test.ts
@@ -0,0 +1,309 @@
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { ProfileStateAuthority } from '../loading-store/profile-state-authority'
+import { Store } from '../loading-store/store'
+import { bootstrapProfileStateAuthority } from './profile-state-authority-bootstrap'
+import * as profileStateDatabase from './profile-state-database'
+import * as profileStateDocumentReader from './profile-state-document-reader'
+import { hashProfileStateJson, importProfileStateJson } from './profile-state-documents'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { createProfileStateStore } from './profile-state-store-factory'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (value: string) => Buffer.from(`encrypted:${value}`, 'utf8'),
+    decryptString: (value: Buffer) => value.toString('utf8').slice('encrypted:'.length)
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+
+vi.mock('../../telemetry/client', () => ({ track: () => {} }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const directories: string[] = []
+const stores: Store[] = []
+const authorities: ProfileStateAuthority[] = []
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  const openedStores = stores.splice(0)
+  const openedAuthorities = authorities.splice(0)
+  for (const store of openedStores) {
+    store.freezeWrites()
+  }
+  for (const authority of openedAuthorities) {
+    authority.close?.()
+  }
+  for (const store of openedStores) {
+    await store.flushAsync()
+  }
+  await Promise.all(openedAuthorities.map((authority) => authority.drainBackups?.()))
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function createPaths(): { dataFile: string; databaseFile: string; profileId: string } {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-startup-snapshot-'))
+  directories.push(directory)
+  return {
+    dataFile: join(directory, 'orca-data.json'),
+    databaseFile: join(directory, 'profile-state.db'),
+    profileId: 'startup-snapshot-test'
+  }
+}
+
+function createEstablishedProfile(keepJson: boolean): ReturnType<typeof createPaths> {
+  const paths = createPaths()
+  const source = JSON.stringify({ settings: { theme: 'dark' }, futureDomain: { keep: true } })
+  if (keepJson) {
+    writeFileSync(paths.dataFile, source)
+  }
+  const opened = profileStateDatabase.openProfileStateDatabase(paths.databaseFile, paths.profileId)
+  try {
+    importProfileStateJson(opened.db, source, {
+      acceptedLegacyJsonHash: hashProfileStateJson(source)
+    })
+  } finally {
+    opened.db.close()
+  }
+  return paths
+}
+
+describe('profile state startup snapshot handoff', () => {
+  it('keeps serialized-only authorities usable without SQLite capability', () => {
+    const paths = createPaths()
+    const original = process.getBuiltinModule
+    vi.spyOn(process, 'getBuiltinModule').mockImplementation((id) =>
+      id === 'node:sqlite' ? undefined : original(id)
+    )
+    let serialized = '{"settings":{"theme":"dark"},"futureDomain":{"keep":true}}'
+    const authority: ProfileStateAuthority = {
+      readSerializedState: () => serialized,
+      writeSerializedState: (payload) => {
+        serialized = payload.toString('utf8')
+      }
+    }
+    const store = new Store({ dataFile: paths.dataFile, profileStateAuthority: authority })
+    stores.push(store)
+    expect(store.getSettings().theme).toBe('dark')
+    expect(store.getSettings().terminalFontSize).toBeGreaterThan(0)
+    store.updateSettings({ theme: 'light' })
+    store.flushOrThrow()
+    expect(JSON.parse(serialized)).toMatchObject({
+      settings: { theme: 'light' },
+      futureDomain: { keep: true }
+    })
+  })
+
+  it.each([false, true])('reads established storage once with retained JSON=%s', (keepJson) => {
+    const paths = createEstablishedProfile(keepJson)
+    const open = vi.spyOn(profileStateDatabase, 'openProfileStateDatabaseReadOnly')
+    const documentRead = vi.spyOn(profileStateDocumentReader, 'readProfileStateDocuments')
+    const initialRead = vi.spyOn(ProfileStateSqliteAuthority.prototype, 'readInitialState')
+    const serializedRead = vi.spyOn(ProfileStateSqliteAuthority.prototype, 'readSerializedState')
+    const acceptedRead = vi.spyOn(ProfileStateSqliteAuthority.prototype, 'readAcceptedState')
+
+    const result = createProfileStateStore({ ...paths })
+    stores.push(result.store)
+
+    expect(open).toHaveBeenCalledTimes(1)
+    expect(documentRead).toHaveBeenCalledTimes(1)
+    expect(initialRead).toHaveBeenCalledTimes(keepJson ? 0 : 1)
+    expect(serializedRead).not.toHaveBeenCalled()
+    expect(acceptedRead).toHaveBeenCalledTimes(keepJson ? 1 : 0)
+    expect(result.store.getSettings().theme).toBe('dark')
+    expect(JSON.parse(result.store.prepareProfileStateExport().json)).toMatchObject({
+      futureDomain: { keep: true }
+    })
+  })
+
+  it('uses the validated empty snapshot without rereading SQLite or consulting JSON', () => {
+    const paths = createPaths()
+    const opened = profileStateDatabase.openProfileStateDatabase(
+      paths.databaseFile,
+      paths.profileId
+    )
+    opened.db.close()
+    const bootstrapped = bootstrapProfileStateAuthority(paths)
+    if (bootstrapped.authority === undefined) {
+      throw new Error('Expected SQLite authority')
+    }
+    authorities.push(bootstrapped.authority)
+    expect(bootstrapped.initialState.serializedState).toBeUndefined()
+    const read = vi.spyOn(bootstrapped.authority, 'readSerializedState')
+    writeFileSync(paths.dataFile, '{"settings":{"opencodeSessionCookie":"stale-json"}}')
+
+    const store = new Store({
+      dataFile: paths.dataFile,
+      profileStateAuthority: bootstrapped.authority,
+      initialAuthorityState: bootstrapped.initialState
+    })
+    stores.push(store)
+
+    expect(read).not.toHaveBeenCalled()
+    expect(store.getSettings().opencodeSessionCookie).not.toBe('stale-json')
+    store.updateSettings({ theme: 'dark' })
+    store.flushOrThrow()
+    expect(readFileSync(paths.dataFile, 'utf8')).toContain('stale-json')
+    expect(bootstrapped.authority.readSerializedState()).toContain('"dark"')
+  })
+
+  it('consumes a parsed startup snapshot once, including an empty revision', () => {
+    const paths = createPaths()
+    const opened = profileStateDatabase.openProfileStateDatabase(
+      paths.databaseFile,
+      paths.profileId
+    )
+    opened.db.close()
+    const authority = new ProfileStateSqliteAuthority(paths.databaseFile, paths.profileId)
+    authorities.push(authority)
+    const initial = authority.readInitialState()
+    expect(initial.takeParsedState?.()).toBeUndefined()
+    expect(() => initial.takeParsedState?.()).toThrow('already been consumed')
+  })
+
+  it.each([false, true])(
+    'fences a writer between bootstrap and Store construction with retained JSON=%s',
+    (keepJson) => {
+      const paths = createEstablishedProfile(keepJson)
+      const bootstrapped = bootstrapProfileStateAuthority(paths)
+      if (bootstrapped.authority === undefined) {
+        throw new Error('Expected SQLite authority')
+      }
+      authorities.push(bootstrapped.authority)
+      const opened = profileStateDatabase.openProfileStateDatabase(
+        paths.databaseFile,
+        paths.profileId
+      )
+      try {
+        importProfileStateJson(opened.db, '{"settings":{"theme":"light"}}', {
+          expectedRevision: 1
+        })
+      } finally {
+        opened.db.close()
+      }
+
+      const store = new Store({
+        dataFile: paths.dataFile,
+        profileStateAuthority: bootstrapped.authority,
+        initialAuthorityState: bootstrapped.initialState
+      })
+      stores.push(store)
+
+      expect(store.getSettings().theme).toBe('dark')
+      store.updateSettings({ theme: 'system' })
+      expect(() => store.flushOrThrow()).toThrowError(
+        expect.objectContaining({
+          code: 'profile-state-revision-conflict',
+          expectedRevision: 1,
+          actualRevision: 2
+        })
+      )
+      expect(bootstrapped.authority.readSerializedState()).toBe('{"settings":{"theme":"light"}}')
+    }
+  )
+
+  it('restores the captured fence after a same-authority refresh', () => {
+    const paths = createEstablishedProfile(true)
+    const authority = new ProfileStateSqliteAuthority(paths.databaseFile, paths.profileId)
+    authorities.push(authority)
+    const initial = authority.readInitialState()
+    const writer = new ProfileStateSqliteAuthority(paths.databaseFile, paths.profileId)
+    authorities.push(writer)
+    writer.writeSerializedState(Buffer.from('{"settings":{"theme":"light"}}'))
+    expect(authority.readSerializedState()).toContain('"light"')
+
+    const store = new Store({
+      dataFile: paths.dataFile,
+      profileStateAuthority: authority,
+      initialAuthorityState: initial
+    })
+    stores.push(store)
+    store.updateSettings({ theme: 'system' })
+    expect(() => store.flushOrThrow()).toThrowError(
+      expect.objectContaining({ code: 'profile-state-revision-conflict', actualRevision: 2 })
+    )
+    expect(writer.readSerializedState()).toContain('"light"')
+  })
+
+  it('keeps direct authority reads fresh after bootstrap', () => {
+    const paths = createEstablishedProfile(true)
+    const bootstrapped = bootstrapProfileStateAuthority(paths)
+    if (bootstrapped.authority === undefined) {
+      throw new Error('Expected SQLite authority')
+    }
+    authorities.push(bootstrapped.authority)
+    const writer = new ProfileStateSqliteAuthority(paths.databaseFile, paths.profileId)
+    authorities.push(writer)
+    writer.writeSerializedState(Buffer.from('{"settings":{"theme":"light"}}'))
+
+    expect(bootstrapped.authority.readSerializedState()).toBe('{"settings":{"theme":"light"}}')
+    writer.writeSerializedState(Buffer.from('{"settings":{"theme":"system"}}'))
+    expect(bootstrapped.authority.readSerializedState()).toBe('{"settings":{"theme":"system"}}')
+  })
+
+  it('decrypts and normalizes the startup snapshot through the existing Store loader', () => {
+    const paths = createPaths()
+    writeFileSync(paths.dataFile, '{"settings":{"theme":"dark"}}')
+    const first = createProfileStateStore({ ...paths }).store
+    stores.push(first)
+    first.updateSettings({ opencodeSessionCookie: 'startup-secret' })
+    first.flushOrThrow()
+    first.freezeWrites()
+
+    const reopened = createProfileStateStore({
+      ...paths
+    }).store
+    stores.push(reopened)
+    expect(reopened.getSettings().opencodeSessionCookie).toBe('startup-secret')
+    expect(reopened.getSettings().terminalFontSize).toBeGreaterThan(0)
+    reopened.updateSettings({ theme: 'light' })
+    reopened.flushOrThrow()
+    expect(reopened.prepareProfileStateExport().json).not.toContain('startup-secret')
+    const again = createProfileStateStore({ ...paths }).store
+    stores.push(again)
+    expect(again.getSettings().opencodeSessionCookie).toBe('startup-secret')
+    expect(again.getSettings().theme).toBe('light')
+  })
+
+  it('rejects initial state without its authority or alongside migration input', () => {
+    const paths = createPaths()
+    const authority = new ProfileStateSqliteAuthority(paths.databaseFile, paths.profileId)
+    const otherAuthority = new ProfileStateSqliteAuthority(paths.databaseFile, paths.profileId)
+    const initialAuthorityState = { authority, serializedState: '{}' }
+
+    expect(() => new Store({ dataFile: paths.dataFile, initialAuthorityState })).toThrow(
+      'must belong to its profile-state authority'
+    )
+    expect(
+      () => new Store({ profileStateAuthority: otherAuthority, initialAuthorityState })
+    ).toThrow('must belong to its profile-state authority')
+    expect(
+      () =>
+        new Store({
+          profileStateAuthority: authority,
+          initialAuthorityState,
+          serializedState: '{}'
+        })
+    ).toThrow('cannot use both a profile-state authority and serialized state')
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-storage-classification.ts b/src/main/persistence/profile-state/profile-state-storage-classification.ts
new file mode 100644
index 00000000000..987f2a7bbe7
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-storage-classification.ts
@@ -0,0 +1,32 @@
+import { existsSync } from 'node:fs'
+
+export type ProfileStateStorageClassification = 'json-only' | 'sqlite-only' | 'both' | 'neither'
+
+/** Primary first: recovery must remove it before any journal can be replayed. */
+export function profileStateDatabaseFiles(databaseFile: string): string[] {
+  return ['', '-wal', '-shm', '-journal'].map((suffix) => `${databaseFile}${suffix}`)
+}
+
+/** Any surviving database-family file rules out a fresh profile or JSON fallback. */
+export function hasProfileStateDatabaseFiles(databaseFile: string): boolean {
+  return profileStateDatabaseFiles(databaseFile).some(existsSync)
+}
+
+/** Classify storage without opening SQLite or changing either representation. */
+export function classifyProfileStateStorage(
+  dataFile: string,
+  databaseFile: string
+): ProfileStateStorageClassification {
+  const hasJson = existsSync(dataFile)
+  const hasDatabase = hasProfileStateDatabaseFiles(databaseFile)
+  if (hasJson && hasDatabase) {
+    return 'both'
+  }
+  if (hasJson) {
+    return 'json-only'
+  }
+  if (hasDatabase) {
+    return 'sqlite-only'
+  }
+  return 'neither'
+}
diff --git a/src/main/persistence/profile-state/profile-state-store-factory.test.ts b/src/main/persistence/profile-state/profile-state-store-factory.test.ts
new file mode 100644
index 00000000000..45ceade8698
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-store-factory.test.ts
@@ -0,0 +1,413 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  isProfileStateSqliteAvailable,
+  openProfileStateDatabase,
+  profileStateDatabaseFile
+} from './profile-state-database'
+import {
+  createProfileStateStore as createProfileStateStoreImpl,
+  type ProfileStateStoreFactoryOptions
+} from './profile-state-store-factory'
+import {
+  profileStateJsonExportPath,
+  profileStateJsonExportPaths
+} from './legacy-json/profile-state-export-path'
+import { ProfileStateRecoveryRequiredError } from './profile-state-authority-bootstrap'
+import { acquireProfileStateMaintenance } from './profile-state-access'
+import { restoreProfileStateJsonExport } from './legacy-json/profile-state-recovery'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { LoadedStateParsingOperations } from '../loading-store/loaded-state-parsing'
+import { hashProfileStateJson, importProfileStateJson } from './profile-state-documents'
+import { PROFILE_STATE_DATABASE_SCHEMA_VERSION } from './profile-state-database-schema'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (value: string) => Buffer.from(`encrypted:${value}`, 'utf8'),
+    decryptString: (value: Buffer) => value.toString('utf8').slice('encrypted:'.length)
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+
+vi.mock('../../telemetry/client', () => ({ track: () => {} }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const temporaryDirectories: string[] = []
+const storesToClose: ReturnType<typeof createProfileStateStoreImpl>['store'][] = []
+
+function createProfileStateStore(
+  options: ProfileStateStoreFactoryOptions
+): ReturnType<typeof createProfileStateStoreImpl> {
+  const result = createProfileStateStoreImpl(options)
+  storesToClose.push(result.store)
+  return result
+}
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  const openedStores = storesToClose.splice(0)
+  for (const store of openedStores) {
+    store.freezeWrites()
+  }
+  for (const store of openedStores) {
+    await store.flushAsync()
+  }
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function createOptions(): ProfileStateStoreFactoryOptions & { directory: string } {
+  const root = mkdtempSync(join(tmpdir(), 'orca-profile-state-store-factory-'))
+  temporaryDirectories.push(root)
+  const directory = join(root, 'profiles', 'profile-factory-test')
+  mkdirSync(directory, { recursive: true })
+  return {
+    directory,
+    dataFile: join(directory, 'orca-data.json'),
+    databaseFile: profileStateDatabaseFile(directory),
+    profileId: 'profile-factory-test'
+  }
+}
+
+describe('profile state Store authority factory', () => {
+  it.each([false, true])(
+    'refuses future schemas without changing storage (retained JSON=%s)',
+    (keepJson) => {
+      const options = createOptions()
+      const source = '{"settings":{"theme":"dark"},"futureDomain":{"keep":true}}'
+      const { db } = openProfileStateDatabase(options.databaseFile, options.profileId)
+      try {
+        importProfileStateJson(db, source, { acceptedLegacyJsonHash: hashProfileStateJson(source) })
+        db.pragma(`user_version = ${PROFILE_STATE_DATABASE_SCHEMA_VERSION + 1}`)
+      } finally {
+        db.close()
+      }
+      if (keepJson) {
+        writeFileSync(options.dataFile, source)
+      }
+      const databaseBefore = readFileSync(options.databaseFile)
+
+      expect(() => createProfileStateStore({ ...options })).toThrow(
+        expect.objectContaining({ code: 'newer-schema' })
+      )
+      expect(readFileSync(options.databaseFile)).toEqual(databaseBefore)
+      expect(existsSync(options.dataFile)).toBe(keepJson)
+      if (keepJson) {
+        expect(readFileSync(options.dataFile, 'utf8')).toBe(source)
+      }
+    }
+  )
+
+  it('closes a migrated authority when Store normalization fails', () => {
+    const options = createOptions()
+    writeFileSync(options.dataFile, '{"settings":{"theme":"dark"}}')
+    const close = vi.spyOn(ProfileStateSqliteAuthority.prototype, 'close')
+    const readInitialState = vi.spyOn(ProfileStateSqliteAuthority.prototype, 'readInitialState')
+    vi.spyOn(LoadedStateParsingOperations.prototype, 'loadParsedFromAuthority').mockImplementation(
+      () => {
+        throw new Error('injected normalization failure')
+      }
+    )
+
+    expect(() => createProfileStateStore({ ...options })).toThrow('injected normalization failure')
+    expect(close).toHaveBeenCalledOnce()
+    expect(readInitialState).toHaveBeenCalledOnce()
+    const initial = readInitialState.mock.results[0]
+    if (initial?.type !== 'return') {
+      throw new Error('Expected a startup token before normalization')
+    }
+    expect(() => initial.value.takeParsedState?.()).toThrow('already been consumed')
+  })
+
+  it('uses a capability probe that remains false on a Node 18-style host', () => {
+    const original = process.getBuiltinModule
+    vi.spyOn(process, 'getBuiltinModule').mockImplementation((id) => {
+      if (id === 'node:sqlite' || id === 'bun:sqlite') {
+        return undefined
+      }
+      return original(id)
+    })
+
+    expect(isProfileStateSqliteAvailable()).toBe(false)
+  })
+
+  it('imports legacy state by default and preserves its original bytes', () => {
+    const options = createOptions()
+    const source = JSON.stringify({ settings: { theme: 'dark' }, unknownDomain: { keep: true } })
+    writeFileSync(options.dataFile, source)
+
+    const result = createProfileStateStore(options)
+
+    expect(result.backend).toBe('sqlite')
+    expect(result.classification).toBe('json-only')
+    expect(result.migrated).toBe(true)
+    expect(result.store.getSettings().theme).toBe('dark')
+    expect(existsSync(options.databaseFile)).toBe(true)
+    expect(readFileSync(options.dataFile, 'utf8')).toBe(source)
+  })
+
+  it.each([0, 1, 2, 3, 4])(
+    'requires selected recovery when only legacy backup slot %s remains',
+    (slot) => {
+      const options = createOptions()
+      const backup = `${options.dataFile}.bak.${slot}`
+      const source = '{"settings":{"theme":"dark"},"futureDomain":{"preserved":true}}'
+      writeFileSync(backup, source)
+
+      expect(() => createProfileStateStore({ ...options })).toThrow('restore a selected backup')
+      expect(existsSync(options.databaseFile)).toBe(false)
+      expect(existsSync(options.dataFile)).toBe(false)
+      expect(readFileSync(backup, 'utf8')).toBe(source)
+
+      restoreProfileStateJsonExport({
+        maintenance: acquireProfileStateMaintenance(dirname(dirname(options.directory))),
+        databasePath: options.databaseFile,
+        dataFile: options.dataFile,
+        profileId: options.profileId,
+        exportPath: backup
+      })
+      const recovered = createProfileStateStore({ ...options })
+      expect(recovered.backend).toBe('sqlite')
+      expect(JSON.parse(recovered.store.prepareProfileStateExport().json)).toMatchObject({
+        settings: { theme: 'dark' },
+        futureDomain: { preserved: true }
+      })
+      expect(readFileSync(backup, 'utf8')).toBe(source)
+    }
+  )
+
+  it('migrates JSON and constructs a SQLite Store', () => {
+    const options = createOptions()
+    const source = JSON.stringify({ settings: { theme: 'dark' }, unknownDomain: { keep: true } })
+    writeFileSync(options.dataFile, source)
+
+    const result = createProfileStateStore({ ...options })
+
+    expect(result.backend).toBe('sqlite')
+    expect(result.classification).toBe('json-only')
+    expect(result.migrated).toBe(true)
+    expect(result.store.getSettings().theme).toBe('dark')
+    expect(existsSync(options.databaseFile)).toBe(true)
+    expect(readFileSync(options.dataFile, 'utf8')).toBe(source)
+  })
+
+  it('reuses the candidate authority after the legacy export is removed', () => {
+    const options = createOptions()
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    createProfileStateStore({ ...options })
+    rmSync(options.dataFile)
+
+    const result = createProfileStateStore({ ...options })
+
+    expect(result.backend).toBe('sqlite')
+    expect(result.classification).toBe('sqlite-only')
+    expect(result.migrated).toBe(false)
+    expect(result.store.getSettings().theme).toBe('dark')
+  })
+
+  it('reopens an established SQLite profile without the migration switch', () => {
+    const options = createOptions()
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    createProfileStateStore({ ...options })
+    rmSync(options.dataFile)
+
+    const result = createProfileStateStore({ ...options })
+
+    expect(result.backend).toBe('sqlite')
+    expect(result.classification).toBe('sqlite-only')
+    expect(result.migrated).toBe(false)
+    expect(result.store.getSettings().theme).toBe('dark')
+  })
+
+  it('fails closed instead of falling back to a stale JSON mirror when SQLite is missing', () => {
+    const options = createOptions()
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    const migrated = createProfileStateStore({ ...options })
+    const exportPath = profileStateJsonExportPath(options.dataFile, 1)
+    expect(existsSync(exportPath)).toBe(true)
+    migrated.store.freezeWrites()
+    rmSync(options.databaseFile)
+
+    expect(() => createProfileStateStore({ ...options })).toThrow(ProfileStateRecoveryRequiredError)
+  })
+
+  it('does not let candidate mode re-import JSON after SQLite was established', () => {
+    const options = createOptions()
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    const migrated = createProfileStateStore({ ...options })
+    migrated.store.freezeWrites()
+    rmSync(options.databaseFile)
+
+    expect(() => createProfileStateStore({ ...options })).toThrow(ProfileStateRecoveryRequiredError)
+  })
+
+  it('reopens JSON after an explicit rollback removes the SQLite export marker', () => {
+    const options = createOptions()
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    const migrated = createProfileStateStore({ ...options })
+    const exportPath = profileStateJsonExportPath(options.dataFile, 1)
+    migrated.store.freezeWrites()
+
+    restoreProfileStateJsonExport({
+      maintenance: acquireProfileStateMaintenance(dirname(dirname(options.directory))),
+      databasePath: options.databaseFile,
+      dataFile: options.dataFile,
+      exportPath,
+      profileId: options.profileId
+    })
+
+    const result = createProfileStateStore({ ...options })
+    expect(result.backend).toBe('sqlite')
+    expect(result.store.getSettings().theme).toBe('dark')
+  })
+
+  it('keeps a migrated profile on SQLite across mutation and restart', () => {
+    const options = createOptions()
+    const source = JSON.stringify({
+      settings: { theme: 'light' },
+      unknownDomain: { preserved: true }
+    })
+    writeFileSync(options.dataFile, source)
+    const first = createProfileStateStore({ ...options })
+
+    first.store.updateSettings({ theme: 'dark' })
+    first.store.flushOrThrow()
+
+    expect(readFileSync(options.dataFile, 'utf8')).toBe(source)
+    rmSync(options.dataFile)
+    const restarted = createProfileStateStore({ ...options })
+
+    expect(restarted.store.getSettings().theme).toBe('dark')
+    expect(JSON.parse(restarted.store.prepareProfileStateExport().json)).toMatchObject({
+      settings: { theme: 'dark' },
+      unknownDomain: { preserved: true }
+    })
+  })
+
+  it('initializes a valid empty SQLite profile instead of falling back to legacy JSON', () => {
+    const options = createOptions()
+    const opened = openProfileStateDatabase(options.databaseFile, options.profileId)
+    opened.db.close()
+
+    const result = createProfileStateStore({ ...options })
+
+    expect(result.backend).toBe('sqlite')
+    expect(result.classification).toBe('sqlite-only')
+    expect(result.store.getSettings()).toBeDefined()
+    result.store.updateSettings({ theme: 'dark' })
+    result.store.flushOrThrow()
+
+    const verifier = createProfileStateStore({ ...options })
+    expect(verifier.store.getSettings().theme).toBe('dark')
+  })
+
+  it('establishes SQLite for a fresh candidate profile before its first write', () => {
+    const options = createOptions()
+
+    const result = createProfileStateStore({ ...options })
+
+    expect(result.backend).toBe('sqlite')
+    expect(result.classification).toBe('neither')
+    expect(result.migrated).toBe(false)
+    expect(existsSync(options.databaseFile)).toBe(true)
+    result.store.updateSettings({ theme: 'dark' })
+    result.store.flushOrThrow()
+    result.store.freezeWrites()
+
+    const restarted = createProfileStateStore({ ...options })
+    expect(restarted.backend).toBe('sqlite')
+    expect(restarted.store.getSettings().theme).toBe('dark')
+    restarted.store.freezeWrites()
+  })
+
+  it('refuses a stale JSON mirror when candidate mode sees both files', () => {
+    const options = createOptions()
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    createProfileStateStore({ ...options })
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'light' } }))
+
+    expect(() => createProfileStateStore({ ...options })).toThrow('matching acceptance marker')
+  })
+
+  it.each([false, true])(
+    'refuses an incapable first writer before mutation (JSON=%s)',
+    (hasJson) => {
+      const options = createOptions()
+      const source = '{"settings":{"theme":"dark"}}'
+      if (hasJson) {
+        writeFileSync(options.dataFile, source)
+      }
+      const original = process.getBuiltinModule
+      vi.spyOn(process, 'getBuiltinModule').mockImplementation((id) =>
+        id === 'node:sqlite' || id === 'bun:sqlite' ? undefined : original(id)
+      )
+      expect(() => createProfileStateStore(options)).toThrow('Writable profiles require SQLite')
+      expect(existsSync(options.databaseFile)).toBe(false)
+      expect(existsSync(options.dataFile)).toBe(hasJson)
+      if (hasJson) {
+        expect(readFileSync(options.dataFile, 'utf8')).toBe(source)
+      }
+    }
+  )
+
+  describe('missing database recovery', () => {
+    it.each([
+      { hasJson: true, artifact: 'export' },
+      { hasJson: false, artifact: 'export' },
+      { hasJson: true, artifact: 'backup' },
+      { hasJson: false, artifact: 'backup' }
+    ])(
+      'fails closed with a retained $artifact and JSON present=$hasJson',
+      ({ hasJson, artifact }) => {
+        const options = createOptions()
+        const source = JSON.stringify({ settings: { theme: 'dark' } })
+        writeFileSync(options.dataFile, source)
+        const migrated = createProfileStateStore({
+          ...options
+        })
+        migrated.store.freezeWrites()
+        rmSync(options.databaseFile)
+        if (artifact === 'backup') {
+          for (const path of profileStateJsonExportPaths(options.dataFile)) {
+            rmSync(path)
+          }
+          writeFileSync(
+            `${options.databaseFile}.backup.1789999999999-00000000-0000-4000-8000-000000000000.db`,
+            'reserved recovery artifact'
+          )
+        }
+        if (!hasJson) {
+          rmSync(options.dataFile)
+        }
+
+        expect(() => createProfileStateStore(options)).toThrowError(
+          ProfileStateRecoveryRequiredError
+        )
+        expect(existsSync(options.databaseFile)).toBe(false)
+        expect(existsSync(options.dataFile)).toBe(hasJson)
+        if (hasJson) {
+          expect(readFileSync(options.dataFile, 'utf8')).toBe(source)
+        }
+      }
+    )
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-store-factory.ts b/src/main/persistence/profile-state/profile-state-store-factory.ts
new file mode 100644
index 00000000000..a40b19a1726
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-store-factory.ts
@@ -0,0 +1,78 @@
+import type { AutomationStorageAuthority } from '../scheduling-automations/automation-owner-projection'
+import type { ProfileStateAuthorityInitialState } from '../loading-store/profile-state-authority'
+import type { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { Store } from '../loading-store/store'
+import { bootstrapProfileStateAuthority } from './profile-state-authority-bootstrap'
+import type { ProfileStateStorageClassification } from './profile-state-storage-classification'
+
+export type ProfileStateStoreFactoryOptions = {
+  dataFile: string
+  databaseFile: string
+  profileId: string
+  storageAuthority?: AutomationStorageAuthority
+}
+
+export class ProfileStateStoreFactoryError extends Error {
+  readonly code = 'profile-state-authority-required' as const
+
+  constructor(message: string) {
+    super(message)
+    this.name = 'ProfileStateStoreFactoryError'
+  }
+}
+
+export type ProfileStateStoreFactoryResult = {
+  store: Store
+  backend: 'sqlite'
+  classification: ProfileStateStorageClassification
+  migrated: boolean
+}
+
+/** Centralize authority selection for desktop, orcad and offline callers. */
+export function createProfileStateStore(
+  options: ProfileStateStoreFactoryOptions
+): ProfileStateStoreFactoryResult {
+  const { initialState, ...prepared } = prepareProfileStateStore(options)
+  try {
+    return {
+      ...prepared,
+      store: new Store({
+        dataFile: options.dataFile,
+        storageAuthority: options.storageAuthority,
+        profileStateAuthority: initialState.authority,
+        initialAuthorityState: initialState
+      })
+    }
+  } catch (error) {
+    // Store construction owns the authority only after its load boundary succeeds.
+    initialState.authority.close?.()
+    throw error
+  }
+}
+
+type PreparedProfileStateStore = Omit<ProfileStateStoreFactoryResult, 'store'> & {
+  initialState: ProfileStateAuthorityInitialState<ProfileStateSqliteAuthority>
+}
+
+/** Admission is shared by live worker startup and synchronous offline operations. */
+export function prepareProfileStateStore(
+  options: ProfileStateStoreFactoryOptions
+): PreparedProfileStateStore {
+  const bootstrap = bootstrapProfileStateAuthority({
+    ...options,
+    allowEmptyProfileState: true
+  })
+  const authority = bootstrap.authority
+  if (authority === undefined) {
+    throw new ProfileStateStoreFactoryError(
+      'Writable profiles require SQLite database and backup support. Use Orca or its bundled Bun runtime.'
+    )
+  }
+
+  return {
+    initialState: bootstrap.initialState,
+    backend: 'sqlite',
+    classification: bootstrap.classification,
+    migrated: bootstrap.migrated
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-streaming-validation.test.ts b/src/main/persistence/profile-state/profile-state-streaming-validation.test.ts
new file mode 100644
index 00000000000..537023ac45a
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-streaming-validation.test.ts
@@ -0,0 +1,145 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { openProfileStateDatabase } from './profile-state-database'
+import { verifyProfileStateSchema } from './profile-state-database-validation'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateParsedSnapshot,
+  readProfileStateSnapshot,
+  validateProfileStateSnapshot
+} from './profile-state-documents'
+
+const fixtures: { directory: string; db: ReturnType<typeof openProfileStateDatabase>['db'] }[] = []
+afterEach(() => {
+  for (const { directory, db } of fixtures.splice(0)) {
+    db.close()
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture(source = '{"automationRuns":[{"id":"a"},{"id":"b"}],"last":null}') {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-streamed-profile-'))
+  const { db } = openProfileStateDatabase(join(directory, 'profile-state.db'), 'stream-test')
+  fixtures.push({ directory, db })
+  importProfileStateJson(db, source)
+  return db
+}
+
+const readers = [
+  readProfileStateSnapshot,
+  readProfileStateParsedSnapshot,
+  validateProfileStateSnapshot
+]
+
+describe('complete streaming profile validation', () => {
+  it('preserves history order and bytes with rowids at both SQLite integer limits', () => {
+    const source =
+      '{"before":null,"automationRuns":[{"id":"a","text":"雪\\ud800"},{"id":"b"}],"after":true}'
+    const db = fixture(source)
+    const before = readProfileStateSnapshot(db)
+    const update = db.prepare('UPDATE profile_state_automation_runs SET rowid = ? WHERE run_id = ?')
+    update.run(9223372036854775807n, 'a')
+    update.run(-9223372036854775808n, 'b')
+    expect(readProfileStateSnapshot(db)).toEqual(before)
+    expect(readProfileStateParsedSnapshot(db)).toEqual({
+      revision: before.revision,
+      state: JSON.parse(source)
+    })
+    expect(validateProfileStateSnapshot(db)).toBe(before.revision)
+    expect(db.isTransaction).toBe(false)
+  })
+
+  it('accepts extra columns that shadow every SQLite rowid alias', () => {
+    const db = fixture()
+    const before = readProfileStateSnapshot(db)
+    db.exec("ALTER TABLE profile_state_automation_runs ADD COLUMN rowid TEXT DEFAULT 'shadow'")
+    db.exec("ALTER TABLE profile_state_automation_runs ADD COLUMN _rowid_ TEXT DEFAULT 'shadow'")
+    db.exec("ALTER TABLE profile_state_automation_runs ADD COLUMN oid TEXT DEFAULT 'shadow'")
+    verifyProfileStateSchema(db, 'stream-test')
+    expect(readProfileStateSnapshot(db)).toEqual(before)
+    expect(readProfileStateParsedSnapshot(db).state).toEqual(JSON.parse(before.json))
+    expect(validateProfileStateSnapshot(db)).toBe(before.revision)
+  })
+
+  it.each([
+    '{}',
+    '{"automationRuns":null}',
+    '{"automationRuns":[]}',
+    '{"automationRuns":{"future":true}}'
+  ])('validates history presence without constructing a returned state: %s', (source) => {
+    const db = fixture(source)
+    expect(validateProfileStateSnapshot(db)).toBe(readProfileStateSnapshot(db).revision)
+    expect(readProfileStateParsedSnapshot(db).state).toEqual(JSON.parse(source))
+  })
+
+  it.each([
+    [
+      'row hash',
+      "UPDATE profile_state_automation_runs SET content_hash = printf('%064d', 0) WHERE ordinal = 1"
+    ],
+    ['ordering', 'UPDATE profile_state_automation_runs SET ordinal = 0 WHERE ordinal = 1'],
+    ['row revision', 'UPDATE profile_state_automation_runs SET revision = 99 WHERE ordinal = 1'],
+    [
+      'row timestamp',
+      'UPDATE profile_state_automation_runs SET updated_at = updated_at + 1 WHERE ordinal = 1'
+    ],
+    [
+      'aggregate hash',
+      "UPDATE profile_state_automation_runs_meta SET content_hash = printf('%064d', 0)"
+    ],
+    ['domain hash', "UPDATE profile_state_documents SET payload = 'true' WHERE domain = 'last'"],
+    ['domain revision', "UPDATE profile_state_documents SET revision = 99 WHERE domain = 'last'"]
+  ])('rejects late %s corruption in every representation', (_, sql) => {
+    const db = fixture()
+    db.exec(sql)
+    for (const read of readers) {
+      expect(() => read(db)).toThrow()
+      expect(db.isTransaction).toBe(false)
+    }
+  })
+
+  it.each([false, true])(
+    'closes failed iterators while preserving caller transaction ownership (%s)',
+    (ownsTransaction) => {
+      const db = fixture()
+      if (ownsTransaction) {
+        db.exec('BEGIN')
+      }
+      const payload = 'null,"injected":true'
+      const update = db.prepare(
+        'UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = ?'
+      )
+      update.run(payload, hashProfileStateJson(payload), 'last')
+      expect(() => validateProfileStateSnapshot(db)).toThrow('invalid JSON')
+      expect(db.isTransaction).toBe(ownsTransaction)
+      update.run('null', hashProfileStateJson('null'), 'last')
+      expect(validateProfileStateSnapshot(db)).toBe(1)
+      expect(db.isTransaction).toBe(ownsTransaction)
+      if (ownsTransaction) {
+        db.exec('ROLLBACK')
+      }
+      expect(readProfileStateSnapshot(db).json).toBe(
+        '{"automationRuns":[{"id":"a"},{"id":"b"}],"last":null}'
+      )
+    }
+  )
+
+  it('closes the ordered-history iterator when the inner lookup fails validation', () => {
+    const db = fixture()
+    const update = db.prepare(
+      'UPDATE profile_state_automation_runs SET payload = ?, content_hash = ? WHERE ordinal = 1'
+    )
+    const invalid = '{"id":"wrong"}'
+    update.run(invalid, hashProfileStateJson(invalid))
+    for (const read of readers) {
+      expect(() => read(db)).toThrow('identity is corrupt')
+      expect(db.isTransaction).toBe(false)
+    }
+    const valid = '{"id":"b"}'
+    update.run(valid, hashProfileStateJson(valid))
+    expect(validateProfileStateSnapshot(db)).toBe(1)
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-worker-authority.test.ts b/src/main/persistence/profile-state/profile-state-worker-authority.test.ts
new file mode 100644
index 00000000000..cc42f350581
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-worker-authority.test.ts
@@ -0,0 +1,76 @@
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import { ProfileStateBackupRotation } from './profile-state-backup-rotation'
+import { ProfileStateWriteWorkerClient } from './profile-state-writer-worker-client'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from '../loading-store/profile-state-maintenance-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+describe('worker authority close admission', () => {
+  it('reports a failed maintenance resume without accepting a changed database', async () => {
+    const notify = vi.fn()
+    const { authority, peer } = await createWorkerMaintenanceFixture(undefined, notify)
+    const maintenance = await authority.pauseForMaintenance()
+    const other = peer()
+    other.writeSerializedDomains([{ domain: 'ui', payload: '{"external":true}' }])
+    other.close()
+
+    await expect(maintenance.resume()).rejects.toMatchObject({
+      code: 'profile-state-revision-conflict'
+    })
+    expect(notify).toHaveBeenCalledExactlyOnceWith(
+      expect.objectContaining({ code: 'profile-state-revision-conflict' })
+    )
+    expect(() => authority.assertWritable()).toThrow()
+  })
+
+  it('refuses new commands while its existing backup drains', async () => {
+    const { authority, directory, readState } = await createWorkerMaintenanceFixture()
+    const before = readState()
+    const release = maintenanceBarrier()
+    vi.spyOn(ProfileStateBackupRotation.prototype, 'drain').mockReturnValueOnce(release.promise)
+    const closeWriter = vi.spyOn(ProfileStateWriteWorkerClient.prototype, 'close')
+
+    const closing = authority.close()
+    expect(authority.close()).toBe(closing)
+    expect(closeWriter).toHaveBeenCalledOnce()
+    expect(() => authority.assertWritable()).toThrow('closing')
+    await expect(
+      authority.writeSerializedDomains([{ domain: 'settings', payload: '{}' }])
+    ).rejects.toMatchObject({ code: 'profile-state-writer-closed', outcome: 'known-failure' })
+    await expect(
+      authority.writeJsonExport(join(directory, 'late-export.json'))
+    ).rejects.toMatchObject({
+      code: 'profile-state-writer-closed'
+    })
+
+    release.resolve()
+    await closing
+    expect(closeWriter).toHaveBeenCalledOnce()
+    expect(readState()).toEqual(before)
+  })
+
+  it('finishes an accepted write before releasing its database', async () => {
+    const { authority, readState } = await createWorkerMaintenanceFixture()
+    const accepted = authority.writeSerializedDomains([
+      { domain: 'ui', payload: '{"accepted":true}' }
+    ])
+    const closing = authority.close()
+    await expect(accepted).resolves.toBeUndefined()
+    await closing
+    expect(readState().ui).toEqual({ accepted: true })
+    await expect(authority.assertCurrentRevision()).rejects.toMatchObject({
+      code: 'profile-state-writer-closed'
+    })
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-worker-authority.ts b/src/main/persistence/profile-state/profile-state-worker-authority.ts
new file mode 100644
index 00000000000..efd93652c17
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-worker-authority.ts
@@ -0,0 +1,168 @@
+import type { AutomationRun } from '../../../shared/automations-types'
+import type {
+  AsyncProfileStateAuthority,
+  ProfileStateDomainReplacement,
+  ProfileStateMaintenance
+} from '../loading-store/profile-state-authority'
+import { ProfileStateBackupRotation } from './profile-state-backup-rotation'
+import { runProfileStateBackupWorker } from './profile-state-backup-worker'
+import { quarantineProfileStateDatabase } from './profile-state-database-quarantine'
+import {
+  ProfileStateWriteWorkerClient,
+  type ProfileStateWriterInitialization
+} from './profile-state-writer-worker-client'
+
+/** Main owns backup scheduling; the persistent worker owns every live SQL command. */
+export class ProfileStateWorkerAuthority implements AsyncProfileStateAuthority {
+  readonly asynchronous = true
+  private writer: ProfileStateWriteWorkerClient
+  private backups: ProfileStateBackupRotation
+  private closing: Promise<void> | undefined
+
+  constructor(
+    private readonly initialization: ProfileStateWriterInitialization,
+    private readonly options: {
+      workerPath?: string
+      backupWorkerPath?: string
+      onFailure?: (error: Error) => void
+    } = {}
+  ) {
+    this.writer = new ProfileStateWriteWorkerClient(initialization, options)
+    this.backups = this.createBackups()
+  }
+
+  get ready(): Promise<void> {
+    return this.writer.ready
+  }
+
+  readSerializedState(): never {
+    throw new Error('Live profile state requires its admitted startup snapshot')
+  }
+
+  assertWritable(): void {
+    this.writer.assertWritable()
+  }
+
+  abort(): Promise<void> {
+    return this.writer.abort()
+  }
+
+  assertCurrentRevision(): Promise<void> {
+    return this.writer.assertCurrentRevision().then(() => {})
+  }
+
+  writeSerializedDomains(replacements: readonly ProfileStateDomainReplacement[]): Promise<void> {
+    return this.writer.writeSerializedDomains(replacements).then(() => {})
+  }
+
+  writeSerializedAutomationRuns(
+    replacements: readonly ProfileStateDomainReplacement[],
+    runs: readonly AutomationRun[]
+  ): Promise<void> {
+    return this.writer.writeSerializedAutomationRuns(replacements, runs).then(() => {})
+  }
+
+  writeCompleteSerializedDomains(
+    replacements: readonly ProfileStateDomainReplacement[]
+  ): Promise<void> {
+    return this.writer.writeCompleteSerializedDomains(replacements).then(() => {})
+  }
+
+  writeSerializedState(payload: Buffer): Promise<void> {
+    return this.writer.writeSerializedState(payload).then(() => {})
+  }
+
+  writeJsonExport(targetPath: string): Promise<number> {
+    return this.writer.writeJsonExport(targetPath)
+  }
+
+  writeLatestJsonExport(dataFile: string): Promise<number | undefined> {
+    return this.writer.writeLatestJsonExport(dataFile)
+  }
+
+  writeJsonCompatibilityExport(targetPath: string): Promise<number | undefined> {
+    return this.writer.writeJsonCompatibilityExportAsync(targetPath)
+  }
+
+  writeJsonCompatibilityExportAsync(targetPath: string): Promise<number | undefined> {
+    return this.writeJsonCompatibilityExport(targetPath)
+  }
+
+  scheduleBackup(): void {
+    if (!this.closing) {
+      this.backups.schedule()
+    }
+  }
+
+  drainBackups(cancel = false): Promise<void> {
+    if (cancel) {
+      this.backups.stop()
+    }
+    return this.backups.drain()
+  }
+
+  close(): Promise<void> {
+    this.writer.stopAdmission()
+    this.closing ??= this.finishClose()
+    return this.closing
+  }
+
+  async pauseForMaintenance(): Promise<ProfileStateMaintenance> {
+    this.assertWritable()
+    const writer = this.writer
+    await this.close()
+    const revision = writer.acknowledgedRevision
+    let consumed = false
+    return {
+      resume: async () => {
+        if (consumed || this.writer !== writer) {
+          throw new Error('Profile maintenance resume has already been consumed')
+        }
+        consumed = true
+        this.writer = new ProfileStateWriteWorkerClient(
+          { ...this.initialization, revision },
+          { ...this.options, reportInitializationFailure: true }
+        )
+        this.backups = this.createBackups()
+        this.closing = undefined
+        try {
+          await this.writer.ready
+          this.assertWritable()
+        } catch (error) {
+          await this.close()
+          throw error
+        }
+      }
+    }
+  }
+
+  async quarantineDatabase(quarantineRoot?: string, reason?: string) {
+    await this.close()
+    return quarantineProfileStateDatabase(
+      this.initialization.databasePath,
+      this.initialization.profileId,
+      quarantineRoot,
+      reason
+    )
+  }
+
+  private async finishClose(): Promise<void> {
+    this.backups.stop()
+    const settled = await Promise.allSettled([this.backups.drain(), this.writer.close()])
+    for (const result of settled) {
+      if (result.status === 'rejected') {
+        throw result.reason
+      }
+    }
+  }
+
+  private createBackups(): ProfileStateBackupRotation {
+    return new ProfileStateBackupRotation(
+      this.initialization.databasePath,
+      this.initialization.profileId,
+      Date.now,
+      (job, signal) =>
+        runProfileStateBackupWorker(job, { workerPath: this.options.backupWorkerPath, signal })
+    )
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-worker-export-failures.test.ts b/src/main/persistence/profile-state/profile-state-worker-export-failures.test.ts
new file mode 100644
index 00000000000..56e21da43e5
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-worker-export-failures.test.ts
@@ -0,0 +1,177 @@
+import { build } from 'esbuild'
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterAll, afterEach, beforeAll, expect, it, vi } from 'vitest'
+import { openProfileStateDatabase } from './profile-state-database'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateJsonAcceptance
+} from './profile-state-documents'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { ProfileStateWriteWorkerClient } from './profile-state-writer-worker-client'
+
+let bundleRoot: string
+let workerPath: string
+const fixtures: { root: string; client: ProfileStateWriteWorkerClient }[] = []
+beforeAll(async () => {
+  bundleRoot = mkdtempSync(join(tmpdir(), 'orca-export-worker-bundle-'))
+  workerPath = join(bundleRoot, 'writer.cjs')
+  await build({
+    entryPoints: [
+      resolve('src/main/persistence/profile-state/profile-state-writer-worker-entry.ts')
+    ],
+    outfile: workerPath,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    logLevel: 'silent'
+  })
+})
+afterEach(async () => {
+  for (const { root, client } of fixtures.splice(0)) {
+    await client.close().catch(() => {})
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+afterAll(() => rmSync(bundleRoot, { recursive: true, force: true }))
+
+async function fixture(fault: 'rename' | 'commit' | 'exit' | 'read-rollback' | 'none') {
+  const root = mkdtempSync(join(tmpdir(), 'orca-export-worker-'))
+  const databasePath = join(root, 'profile-state.db')
+  const dataFile = join(root, 'orca-data.json')
+  const profileId = 'export-failure'
+  const original = '{"settings":{"theme":"light"}}'
+  writeFileSync(dataFile, original)
+  const withDatabase = <T>(
+    run: (db: ReturnType<typeof openProfileStateDatabase>['db']) => T
+  ): T => {
+    const { db } = openProfileStateDatabase(databasePath, profileId)
+    try {
+      return run(db)
+    } finally {
+      db.close()
+    }
+  }
+  withDatabase((db) =>
+    importProfileStateJson(db, original, {
+      acceptedLegacyJsonHash: hashProfileStateJson(original)
+    })
+  )
+  const bootstrap = new ProfileStateSqliteAuthority(databasePath, profileId)
+  bootstrap.readSerializedState()
+  bootstrap.writeSerializedDomains([{ domain: 'settings', payload: '{"theme":"dark"}' }])
+  const wrapper = join(root, 'fault-worker.cjs')
+  const faultSource =
+    fault === 'commit' || fault === 'read-rollback'
+      ? `
+      const DatabaseSync = process.versions.bun
+        ? require('bun:sqlite').Database
+        : require('node:sqlite').DatabaseSync
+      const { existsSync } = require('node:fs')
+      let writing = false
+      const exec = DatabaseSync.prototype.exec
+      DatabaseSync.prototype.exec = function(sql) {
+        if (${JSON.stringify(fault)} === 'read-rollback' &&
+            existsSync(${JSON.stringify(join(root, 'armed'))}) &&
+            (sql === 'COMMIT' || sql === 'ROLLBACK')) {
+          throw new Error('injected read transaction release failure')
+        }
+        const result = exec.call(this, sql)
+        if (sql === 'BEGIN IMMEDIATE' && existsSync(${JSON.stringify(join(root, 'armed'))})) writing = true
+        if (writing && sql === 'COMMIT') throw new Error('injected post-COMMIT failure')
+        return result
+      }
+    `
+      : fault === 'none'
+        ? ''
+        : `
+      const fs = require('node:fs/promises')
+      const rename = fs.rename
+      let injected = false
+      fs.rename = async function(source, target) {
+        if (!injected && target === ${JSON.stringify(dataFile)}) {
+          injected = true
+          if (${JSON.stringify(fault)} === 'exit') {
+            await rename(source, target)
+            process.exit(19)
+          }
+          throw Object.assign(new Error('injected publication failure'), { code: 'ENOSPC' })
+        }
+        return rename(source, target)
+      }
+    `
+  writeFileSync(wrapper, `${faultSource}\nrequire(${JSON.stringify(workerPath)})`)
+  const onFailure = vi.fn()
+  const client = new ProfileStateWriteWorkerClient(bootstrap.retireForWorker(), {
+    workerPath: wrapper,
+    onFailure
+  })
+  fixtures.push({ root, client })
+  await client.ready
+  writeFileSync(join(root, 'armed'), '')
+  const readAccepted = () => {
+    const reader = new ProfileStateSqliteAuthority(databasePath, profileId)
+    try {
+      return reader.readAcceptedState(readFileSync(dataFile, 'utf8'))?.takeParsedState?.()
+    } finally {
+      reader.close()
+    }
+  }
+  return { client, dataFile, original, withDatabase, readAccepted, onFailure }
+}
+
+it.each(['rename', 'staging', 'promotion'] as const)(
+  'keeps the real worker usable after known compatibility %s failure',
+  async (phase) => {
+    const f = await fixture(phase === 'rename' ? phase : 'none')
+    if (phase !== 'rename') {
+      f.withDatabase((db) =>
+        db.exec(`
+        CREATE TRIGGER reject_acceptance BEFORE INSERT ON profile_state_meta
+        WHEN NEW.key = 'legacy_json_acceptance'
+        ${phase === 'promotion' ? "AND json_type(NEW.value, '$.pending') IS NULL" : ''}
+        BEGIN SELECT RAISE(ABORT, 'injected marker failure'); END
+      `)
+      )
+    }
+    await expect(f.client.writeJsonCompatibilityExportAsync(f.dataFile)).rejects.toMatchObject({
+      outcome: 'known-failure'
+    })
+    expect(JSON.parse(readFileSync(f.dataFile, 'utf8')).settings.theme).toBe(
+      phase === 'promotion' ? 'dark' : 'light'
+    )
+    expect(f.readAccepted()).toEqual({ settings: { theme: 'dark' } })
+    expect(f.onFailure).not.toHaveBeenCalled()
+    expect(await f.client.assertCurrentRevision()).toBe(2)
+    f.withDatabase((db) => db.exec('DROP TRIGGER IF EXISTS reject_acceptance'))
+    await f.client.writeSerializedDomains([{ domain: 'settings', payload: '{"theme":"system"}' }])
+    await f.client.writeJsonCompatibilityExportAsync(f.dataFile)
+    expect(f.readAccepted()).toEqual({ settings: { theme: 'system' } })
+    expect(f.withDatabase(readProfileStateJsonAcceptance)).toEqual({
+      jsonHash: hashProfileStateJson(readFileSync(f.dataFile, 'utf8')),
+      acceptedRevision: 3
+    })
+  }
+)
+
+it.each(['commit', 'exit', 'read-rollback'] as const)(
+  'keeps an unacknowledged export %s fenced even when its files remain recoverable',
+  async (fault) => {
+    const f = await fixture(fault)
+    const failure = await f.client
+      .writeJsonCompatibilityExportAsync(f.dataFile)
+      .catch((error: unknown) => error)
+    expect(failure).toMatchObject({ outcome: 'indeterminate' })
+    await expect(
+      f.client.writeSerializedDomains([{ domain: 'settings', payload: '{}' }])
+    ).rejects.toBe(failure)
+    await f.client.close()
+    expect(f.onFailure).toHaveBeenCalledExactlyOnceWith(failure)
+    expect(f.readAccepted()).toEqual({ settings: { theme: 'dark' } })
+    expect(JSON.parse(readFileSync(f.dataFile, 'utf8')).settings.theme).toBe(
+      fault === 'exit' ? 'dark' : 'light'
+    )
+  }
+)
diff --git a/src/main/persistence/profile-state/profile-state-write-transaction.test.ts b/src/main/persistence/profile-state/profile-state-write-transaction.test.ts
new file mode 100644
index 00000000000..2f4dade139c
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-write-transaction.test.ts
@@ -0,0 +1,102 @@
+import { describe, expect, it, vi } from 'vitest'
+import Database from '../../sqlite/sync-database'
+import {
+  ProfileStateIndeterminateWriteError,
+  withProfileStateWriteTransaction
+} from './profile-state-write-transaction'
+
+describe('profile state write transaction ownership', () => {
+  it('preserves SQLITE_FULL after SQLite rolls back the transaction itself', () => {
+    const db = new Database(':memory:')
+    try {
+      db.exec('PRAGMA page_size=512; CREATE TABLE writes (data BLOB); PRAGMA max_page_count=2')
+      const rollback = vi.spyOn(db, 'exec')
+      expect(() =>
+        withProfileStateWriteTransaction(db, () => {
+          db.exec('INSERT INTO writes VALUES (zeroblob(4096))')
+        })
+      ).toThrow(/database or disk is full/)
+      expect(db.isTransaction).toBe(false)
+      expect(rollback).not.toHaveBeenCalledWith('ROLLBACK')
+      expect(db.prepare('SELECT COUNT(*) AS count FROM writes').get()).toMatchObject({ count: 0 })
+      withProfileStateWriteTransaction(db, () => db.exec("INSERT INTO writes VALUES ('small')"))
+      expect(db.prepare('SELECT COUNT(*) AS count FROM writes').get()).toMatchObject({ count: 1 })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rolls back a failed deferred commit and leaves the connection usable', () => {
+    const db = new Database(':memory:')
+    try {
+      db.exec(`
+        PRAGMA foreign_keys = ON;
+        CREATE TABLE parent (id INTEGER PRIMARY KEY);
+        CREATE TABLE child (parent_id INTEGER REFERENCES parent(id) DEFERRABLE INITIALLY DEFERRED);
+      `)
+      expect(() =>
+        withProfileStateWriteTransaction(db, () => {
+          db.exec('INSERT INTO child VALUES (1)')
+        })
+      ).toThrow(/FOREIGN KEY/)
+      expect(db.isTransaction).toBe(false)
+      expect(db.prepare('SELECT COUNT(*) AS count FROM child').get()).toMatchObject({ count: 0 })
+      withProfileStateWriteTransaction(db, () => {
+        db.exec('INSERT INTO parent VALUES (1); INSERT INTO child VALUES (1)')
+      })
+      expect(db.prepare('SELECT COUNT(*) AS count FROM child').get()).toMatchObject({ count: 1 })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('leaves a caller-owned transaction intact when a nested write is refused', () => {
+    const db = new Database(':memory:')
+    try {
+      db.exec('CREATE TABLE pending (id INTEGER); BEGIN; INSERT INTO pending VALUES (1)')
+      expect(() =>
+        withProfileStateWriteTransaction(db, () => db.exec('DELETE FROM pending'))
+      ).toThrow(/idle database/)
+      expect(db.isTransaction).toBe(true)
+      db.exec('COMMIT')
+      expect(db.prepare('SELECT id FROM pending').get()).toMatchObject({ id: 1 })
+    } finally {
+      db.close()
+    }
+  })
+  it.each([false, true])(
+    'reports failed rollback as indeterminate after commit=%s',
+    (commitFirst) => {
+      const db = new Database(':memory:')
+      db.exec('CREATE TABLE writes (id INTEGER)')
+      const exec = db.exec.bind(db)
+      const injected = vi.spyOn(db, 'exec').mockImplementation((sql) => {
+        if (sql === 'ROLLBACK') {
+          throw new Error('injected rollback failure')
+        }
+        if (sql === 'COMMIT') {
+          if (commitFirst) {
+            exec(sql)
+          }
+          throw new Error('injected commit failure')
+        }
+        exec(sql)
+      })
+      try {
+        expect(() =>
+          withProfileStateWriteTransaction(db, () => db.exec('INSERT INTO writes VALUES (1)'))
+        ).toThrow(ProfileStateIndeterminateWriteError)
+        expect(db.isTransaction).toBe(!commitFirst)
+        if (db.isTransaction) {
+          exec('ROLLBACK')
+        }
+        expect(db.prepare('SELECT COUNT(*) AS count FROM writes').get()).toMatchObject({
+          count: commitFirst ? 1 : 0
+        })
+      } finally {
+        injected.mockRestore()
+        db.close()
+      }
+    }
+  )
+})
diff --git a/src/main/persistence/profile-state/profile-state-write-transaction.ts b/src/main/persistence/profile-state/profile-state-write-transaction.ts
new file mode 100644
index 00000000000..1dbf10d5bed
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-write-transaction.ts
@@ -0,0 +1,42 @@
+import type Database from '../../sqlite/sync-database'
+
+export class ProfileStateIndeterminateWriteError extends Error {
+  readonly code = 'profile-state-write-indeterminate' as const
+
+  constructor(
+    cause: unknown,
+    readonly rollbackError: unknown
+  ) {
+    super('Profile state write failed without a confirmed rollback', { cause })
+    this.name = 'ProfileStateIndeterminateWriteError'
+  }
+}
+
+/** Own the write transaction; joining a caller's transaction would weaken its revision fence. */
+export function withProfileStateWriteTransaction<T>(db: Database.Database, write: () => T): T {
+  if (db.isTransaction) {
+    throw new Error('Profile state write requires an idle database connection')
+  }
+  db.exec('BEGIN IMMEDIATE')
+  let committing = false
+  try {
+    const result = write()
+    committing = true
+    db.exec('COMMIT')
+    return result
+  } catch (error) {
+    if (!db.isTransaction) {
+      // SQLite can roll back a failed statement itself; a failed COMMIT is ambiguous.
+      if (committing) {
+        throw new ProfileStateIndeterminateWriteError(error, undefined)
+      }
+      throw error
+    }
+    try {
+      db.exec('ROLLBACK')
+    } catch (rollbackError) {
+      throw new ProfileStateIndeterminateWriteError(error, rollbackError)
+    }
+    throw error
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-writer-capacity-errors.test.ts b/src/main/persistence/profile-state/profile-state-writer-capacity-errors.test.ts
new file mode 100644
index 00000000000..f537af8833c
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-writer-capacity-errors.test.ts
@@ -0,0 +1,47 @@
+import Database from '../../sqlite/sync-database'
+import { expect, it } from 'vitest'
+import {
+  decodeProfileStateWriterError,
+  encodeProfileStateWriterError
+} from './profile-state-writer-errors'
+import {
+  createTerminalSessionStateSaveFailureMessage,
+  isTerminalSessionStorageCapacityFailure
+} from '../../../shared/terminal-session-state-save-failure'
+
+it.each(['ENOSPC', 'EDQUOT', 'SQLITE_FULL', 'EACCES', 'SQLITE_BUSY'])(
+  'preserves capacity evidence across the writer boundary for %s',
+  (code) => {
+    const error = new Error('private path must not cross the worker boundary', {
+      cause: Object.assign(new Error('private details'), { code })
+    })
+    const encoded = encodeProfileStateWriterError(error)
+    expect(encoded.message).toBe('Profile state persistence failed')
+    const decoded = decodeProfileStateWriterError(JSON.parse(JSON.stringify(encoded)))
+    const capacity = ['ENOSPC', 'EDQUOT', 'SQLITE_FULL'].includes(code)
+    expect(
+      isTerminalSessionStorageCapacityFailure(createTerminalSessionStateSaveFailureMessage(decoded))
+    ).toBe(capacity)
+  }
+)
+
+it('classifies a real SQLite capacity failure after worker serialization', () => {
+  const db = new Database(':memory:')
+  try {
+    db.exec('PRAGMA page_size=512; CREATE TABLE writes(data BLOB); PRAGMA max_page_count=2')
+    let failure: unknown
+    try {
+      db.exec('INSERT INTO writes VALUES (zeroblob(4096))')
+    } catch (error) {
+      failure = error
+    }
+    expect(failure).toBeDefined()
+    const decoded = decodeProfileStateWriterError(encodeProfileStateWriterError(failure))
+    expect(
+      isTerminalSessionStorageCapacityFailure(createTerminalSessionStateSaveFailureMessage(decoded))
+    ).toBe(true)
+    db.exec("INSERT INTO writes VALUES ('small')")
+  } finally {
+    db.close()
+  }
+})
diff --git a/src/main/persistence/profile-state/profile-state-writer-connection.ts b/src/main/persistence/profile-state/profile-state-writer-connection.ts
new file mode 100644
index 00000000000..bd956f48592
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-writer-connection.ts
@@ -0,0 +1,302 @@
+import { Worker } from 'node:worker_threads'
+import { resolveProfileStateWriterWorkerPath } from './profile-state-writer-worker-path'
+import {
+  createProfileStateWriterRequest,
+  isExpectedProfileStateWriterSuccess,
+  type PendingProfileStateWriterRequest,
+  type SuccessfulProfileStateWriterResponse
+} from './profile-state-writer-request'
+import {
+  decodeProfileStateWriterError,
+  ProfileStateWriterError
+} from './profile-state-writer-errors'
+import {
+  isProfileStateWriterResponse,
+  type ProfileStateWriterCommand,
+  type ProfileStateWriterInitialization
+} from './profile-state-writer-protocol'
+
+const REQUEST_TIMEOUT_MS = 30_000
+
+/** One materialized command; Store owns coalescing and never queues snapshots here. */
+export class ProfileStateWriterConnection {
+  readonly ready: Promise<void>
+  private worker: Worker | undefined
+  private active: PendingProfileStateWriterRequest | undefined
+  private nextId = 1
+  private failure: Error | undefined
+  private draining = false
+  private closePromise: Promise<void> | undefined
+  private readonly exit = Promise.withResolvers<void>()
+  private didExit = false
+  private closeAcknowledged = false
+  private readonly timeoutMs: number
+  private readonly initialRevision: number
+  private latestRevision: number | undefined
+
+  constructor(
+    initialization: ProfileStateWriterInitialization,
+    private readonly options: {
+      workerPath?: string
+      timeoutMs?: number
+      onFailure?: (error: Error) => void
+      reportInitializationFailure?: boolean
+    } = {}
+  ) {
+    this.initialRevision = initialization.revision
+    this.timeoutMs = options.timeoutMs ?? REQUEST_TIMEOUT_MS
+    const pending = this.createPending(0, 'initialize')
+    this.active = pending
+    this.ready = pending.promise.then(() => {})
+    // Initialization failures remain observable through ready without an unhandled rejection.
+    void this.ready.catch(() => {})
+    try {
+      const worker = new Worker(options.workerPath ?? resolveProfileStateWriterWorkerPath(), {
+        workerData: initialization,
+        execArgv: []
+      })
+      this.worker = worker
+      worker.on('message', (response: unknown) => this.receive(response))
+      worker.on('error', (cause: Error) =>
+        this.fault(
+          new ProfileStateWriterError(
+            'profile-state-writer-exit',
+            'Profile state writer failed',
+            this.dispatchedOutcome(),
+            { cause }
+          )
+        )
+      )
+      worker.once('exit', (code) => {
+        this.didExit = true
+        this.exit.resolve()
+        if (!this.closeAcknowledged || code !== 0) {
+          this.fault(
+            new ProfileStateWriterError(
+              'profile-state-writer-exit',
+              `Profile state writer exited without a completed close (${code})`,
+              this.dispatchedOutcome()
+            )
+          )
+        }
+      })
+    } catch (cause) {
+      this.didExit = true
+      this.exit.resolve()
+      this.fault(
+        new ProfileStateWriterError(
+          'profile-state-writer-unavailable',
+          'Profile state writer could not start',
+          'known-failure',
+          { cause }
+        )
+      )
+    }
+  }
+
+  /** Abandoning an active wait cannot establish whether SQLite committed. */
+  async abort(): Promise<void> {
+    this.fault(
+      new ProfileStateWriterError(
+        'profile-state-writer-aborted',
+        'Profile state writer was aborted',
+        this.dispatchedOutcome()
+      )
+    )
+    await this.exit.promise
+  }
+
+  stopAdmission(): void {
+    this.draining = true
+  }
+
+  close(): Promise<void> {
+    this.stopAdmission()
+    this.closePromise ??= this.finishClose()
+    return this.closePromise
+  }
+
+  get acknowledgedRevision(): number {
+    if (this.failure) {
+      throw this.failure
+    }
+    if (this.latestRevision === undefined) {
+      throw new Error('Profile state writer has no acknowledged revision')
+    }
+    return this.latestRevision
+  }
+
+  private async finishClose(): Promise<void> {
+    await this.active?.promise.catch(() => {})
+    if (!this.failure && !this.didExit) {
+      try {
+        await this.dispatch({ command: 'close' })
+      } finally {
+        const timer = setTimeout(
+          () =>
+            this.fault(
+              new ProfileStateWriterError(
+                'profile-state-writer-close-timeout',
+                'Profile state writer did not exit after close',
+                'indeterminate'
+              )
+            ),
+          this.timeoutMs
+        )
+        try {
+          await this.exit.promise
+        } finally {
+          clearTimeout(timer)
+        }
+      }
+      if (this.failure) {
+        throw this.failure
+      }
+    } else {
+      await this.exit.promise
+    }
+  }
+
+  protected assertDispatchable(closing = false): void {
+    if (this.failure) {
+      throw this.failure
+    }
+    if (this.didExit || (this.draining && !closing)) {
+      throw new ProfileStateWriterError(
+        'profile-state-writer-closed',
+        'Profile state writer is closing',
+        'known-failure'
+      )
+    }
+    if (this.active) {
+      throw new ProfileStateWriterError(
+        'profile-state-writer-busy',
+        'Await the active profile state command before dispatching another snapshot',
+        'known-failure'
+      )
+    }
+  }
+
+  protected dispatch(
+    command: ProfileStateWriterCommand
+  ): Promise<SuccessfulProfileStateWriterResponse> {
+    try {
+      this.assertDispatchable(command.command === 'close')
+    } catch (error) {
+      return Promise.reject(error)
+    }
+    const pending = this.createPending(this.nextId++, command.command)
+    this.active = pending
+    try {
+      this.worker?.postMessage({ ...command, id: pending.id })
+    } catch (cause) {
+      // postMessage did not dispatch a message when serialization fails.
+      this.settle(
+        undefined,
+        new ProfileStateWriterError(
+          'profile-state-writer-message',
+          'Profile state command could not be transferred',
+          'known-failure',
+          { cause }
+        )
+      )
+    }
+    return pending.promise
+  }
+
+  private createPending(
+    id: number,
+    command: PendingProfileStateWriterRequest['command']
+  ): PendingProfileStateWriterRequest {
+    return createProfileStateWriterRequest(id, command, this.timeoutMs, () =>
+      this.fault(
+        new ProfileStateWriterError(
+          'profile-state-writer-timeout',
+          'Profile state writer command timed out',
+          this.dispatchedOutcome()
+        )
+      )
+    )
+  }
+
+  private receive(value: unknown): void {
+    if (this.failure) {
+      return
+    }
+    const pending = this.active
+    if (!isProfileStateWriterResponse(value) || !pending || value.id !== pending.id) {
+      this.invalidResponse()
+      return
+    }
+    if (!value.ok) {
+      const error = decodeProfileStateWriterError(value.error)
+      if (pending.command === 'initialize' || value.error.outcome === 'indeterminate') {
+        this.fault(error)
+      } else {
+        this.settle(undefined, error)
+      }
+      return
+    }
+    if (
+      !isExpectedProfileStateWriterSuccess(
+        pending.command,
+        value,
+        this.latestRevision ?? this.initialRevision
+      )
+    ) {
+      this.invalidResponse()
+      return
+    }
+    if (pending.command === 'close') {
+      this.closeAcknowledged = true
+    }
+    this.latestRevision = value.revision
+    this.settle(value)
+  }
+
+  private settle(response?: SuccessfulProfileStateWriterResponse, error?: Error): void {
+    const pending = this.active
+    this.active = undefined
+    if (!pending) {
+      return
+    }
+    clearTimeout(pending.timer)
+    if (response) {
+      pending.resolve(response)
+    } else {
+      pending.reject(error ?? new Error('Profile state request failed'))
+    }
+  }
+
+  private dispatchedOutcome(): 'known-failure' | 'indeterminate' {
+    return this.active?.command === 'initialize' ? 'known-failure' : 'indeterminate'
+  }
+
+  private invalidResponse(): void {
+    const error = new ProfileStateWriterError(
+      'profile-state-writer-protocol',
+      'Invalid profile state writer response',
+      this.dispatchedOutcome()
+    )
+    this.fault(error)
+  }
+
+  private fault(error: Error): void {
+    if (this.failure) {
+      return
+    }
+    this.failure = error
+    this.settle(undefined, this.failure)
+    if (!this.didExit) {
+      void this.worker?.terminate().catch(() => {})
+    }
+    // Startup failures already reject ready; admitted writers must also alert idle callers.
+    if (this.latestRevision !== undefined || this.options.reportInitializationFailure) {
+      try {
+        this.options.onFailure?.(error)
+      } catch (notificationError) {
+        console.error('[persistence] Could not report stopped saving:', notificationError)
+      }
+    }
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-writer-errors.ts b/src/main/persistence/profile-state/profile-state-writer-errors.ts
new file mode 100644
index 00000000000..afb30d520c8
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-writer-errors.ts
@@ -0,0 +1,95 @@
+import { storageCapacityErrorCode } from '../../../shared/storage-capacity-error'
+import {
+  ProfileStateDocumentCorruptionError,
+  ProfileStateRevisionConflictError
+} from './profile-state-document-validation'
+import { ProfileStateDatabaseOpenError } from './profile-state-database-errors'
+import { ProfileStateIndeterminateWriteError } from './profile-state-write-transaction'
+import { ProfileStateReadRollbackError } from './profile-state-read-snapshot'
+import type {
+  ProfileStateWriterErrorData,
+  ProfileStateWriterFailureOutcome
+} from './profile-state-writer-protocol'
+
+export class ProfileStateWriterError extends Error {
+  constructor(
+    readonly code: string,
+    message: string,
+    readonly outcome: ProfileStateWriterFailureOutcome,
+    options?: ErrorOptions
+  ) {
+    super(message, options)
+    this.name = 'ProfileStateWriterError'
+  }
+}
+
+export function profileStateWriterFailureOutcome(error: unknown): ProfileStateWriterFailureOutcome {
+  if (
+    error instanceof ProfileStateIndeterminateWriteError ||
+    error instanceof ProfileStateReadRollbackError
+  ) {
+    return 'indeterminate'
+  }
+  if (error instanceof ProfileStateWriterError) {
+    return error.outcome
+  }
+  if (error instanceof Error && error.cause !== undefined) {
+    return profileStateWriterFailureOutcome(error.cause)
+  }
+  return 'known-failure'
+}
+
+export function encodeProfileStateWriterError(
+  error: unknown,
+  forceIndeterminate = false
+): ProfileStateWriterErrorData {
+  const outcome = forceIndeterminate ? 'indeterminate' : profileStateWriterFailureOutcome(error)
+  if (error instanceof ProfileStateRevisionConflictError) {
+    return {
+      code: error.code,
+      message: error.message,
+      outcome,
+      expectedRevision: error.expectedRevision,
+      actualRevision: error.actualRevision
+    }
+  }
+  if (error instanceof ProfileStateDocumentCorruptionError) {
+    return { code: error.code, message: error.message, outcome, domain: error.domain }
+  }
+  if (
+    error instanceof ProfileStateDatabaseOpenError ||
+    error instanceof ProfileStateWriterError ||
+    error instanceof ProfileStateIndeterminateWriteError ||
+    error instanceof ProfileStateReadRollbackError
+  ) {
+    return { code: error.code, message: error.message, outcome }
+  }
+  return {
+    code: storageCapacityErrorCode(error) ?? 'profile-state-write-failed',
+    message: 'Profile state persistence failed',
+    outcome
+  }
+}
+
+export function decodeProfileStateWriterError(data: ProfileStateWriterErrorData): Error {
+  if (data.outcome === 'known-failure') {
+    if (
+      data.code === 'profile-state-revision-conflict' &&
+      data.expectedRevision !== undefined &&
+      data.actualRevision !== undefined
+    ) {
+      return new ProfileStateRevisionConflictError(data.expectedRevision, data.actualRevision)
+    }
+    if (data.code === 'corrupt-document') {
+      return new ProfileStateDocumentCorruptionError(data.message, data.domain ?? null)
+    }
+    if (
+      data.code === 'unreadable' ||
+      data.code === 'identity-mismatch' ||
+      data.code === 'invalid-profile-id'
+    ) {
+      return new ProfileStateDatabaseOpenError(data.code, data.message)
+    }
+  }
+  return new ProfileStateWriterError(data.code, data.message, data.outcome)
+}
diff --git a/src/main/persistence/profile-state/profile-state-writer-protocol-faults.test.ts b/src/main/persistence/profile-state/profile-state-writer-protocol-faults.test.ts
new file mode 100644
index 00000000000..80a92f00118
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-writer-protocol-faults.test.ts
@@ -0,0 +1,148 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { ProfileStateWriteWorkerClient } from './profile-state-writer-worker-client'
+
+const clients: ProfileStateWriteWorkerClient[] = []
+const roots: string[] = []
+afterEach(async () => {
+  await Promise.all(clients.splice(0).map((client) => client.close()))
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+function clientFor(
+  response: string,
+  initialization = '{ id: 0, ok: true, revision: 1 }',
+  onFailure?: (error: Error) => void,
+  startup = ''
+) {
+  const root = mkdtempSync(join(tmpdir(), 'orca-writer-protocol-'))
+  roots.push(root)
+  const workerPath = join(root, 'writer.cjs')
+  writeFileSync(
+    workerPath,
+    `
+    const { parentPort } = require('node:worker_threads')
+    parentPort.postMessage(${initialization})
+    parentPort.on('message', (request) => { ${response} })
+    ${startup}
+  `
+  )
+  const client = new ProfileStateWriteWorkerClient(
+    { databasePath: join(root, 'unused.db'), profileId: 'protocol-test', revision: 1 },
+    { workerPath, timeoutMs: 1000, onFailure }
+  )
+  clients.push(client)
+  return client
+}
+
+describe('writer protocol refuses uncertain acknowledgements', () => {
+  it.each([
+    '{ id: request.id + 1, ok: true, revision: 2 }',
+    '{ id: request.id, ok: true, revision: 0 }',
+    '{ id: request.id, ok: true, revision: 3 }',
+    '{ id: request.id, ok: true, revision: 2, exportedRevision: 2 }',
+    '{ id: request.id, ok: true, revision: "2" }'
+  ])('faults instead of acknowledging malformed write response %s', async (response) => {
+    const client = clientFor(`parentPort.postMessage(${response})`)
+    await client.ready
+    await expect(
+      client.writeSerializedDomains([{ domain: 'settings', payload: '{}' }])
+    ).rejects.toMatchObject({ code: 'profile-state-writer-protocol', outcome: 'indeterminate' })
+    await expect(client.assertCurrentRevision()).rejects.toMatchObject({
+      code: 'profile-state-writer-protocol'
+    })
+  })
+
+  it.each(['undefined', 'null', '0', '2'])(
+    'refuses a compatibility export with revision %s for an admitted revision of one',
+    async (exportedRevision) => {
+      const client = clientFor(`parentPort.postMessage({
+        id: request.id, ok: true, revision: 1, exportedRevision: ${exportedRevision}
+      })`)
+      await client.ready
+      await expect(client.writeJsonCompatibilityExportAsync('unused.json')).rejects.toMatchObject({
+        code: 'profile-state-writer-protocol',
+        outcome: 'indeterminate'
+      })
+    }
+  )
+
+  it('refuses a revision jump at an unchanged-state fence', async () => {
+    const client = clientFor('parentPort.postMessage({ id: request.id, ok: true, revision: 2 })')
+    await client.ready
+    await expect(client.assertCurrentRevision()).rejects.toMatchObject({
+      code: 'profile-state-writer-protocol',
+      outcome: 'indeterminate'
+    })
+  })
+
+  it('refuses an initialization acknowledgement for a different revision', async () => {
+    const client = clientFor('', '{ id: 0, ok: true, revision: 2 }')
+    await expect(client.ready).rejects.toMatchObject({
+      code: 'profile-state-writer-protocol',
+      outcome: 'known-failure'
+    })
+  })
+
+  it('faults an unanswered request and rejects later work without retry', async () => {
+    const notify = vi.fn()
+    const client = clientFor('', undefined, notify)
+    await client.ready
+    await expect(
+      client.writeSerializedDomains([{ domain: 'settings', payload: '{}' }])
+    ).rejects.toMatchObject({ code: 'profile-state-writer-timeout', outcome: 'indeterminate' })
+    await expect(client.assertCurrentRevision()).rejects.toMatchObject({
+      code: 'profile-state-writer-timeout'
+    })
+    await client.close()
+    expect(notify).toHaveBeenCalledExactlyOnceWith(
+      expect.objectContaining({ code: 'profile-state-writer-timeout' })
+    )
+  })
+
+  it('reports an idle writer exit even without a subsequent save', async () => {
+    const notify = vi.fn()
+    const client = clientFor('', undefined, notify, 'setTimeout(() => process.exit(1), 50)')
+    await client.ready
+    await vi.waitFor(() => expect(notify).toHaveBeenCalledOnce())
+    expect(notify).toHaveBeenCalledWith(
+      expect.objectContaining({ code: 'profile-state-writer-exit' })
+    )
+    await client.close()
+    expect(notify).toHaveBeenCalledOnce()
+  })
+
+  it('leaves startup failure reporting to the startup caller', async () => {
+    const notify = vi.fn()
+    const client = clientFor('', '{ id: 0, ok: true, revision: 2 }', notify)
+    await expect(client.ready).rejects.toThrow()
+    await client.close()
+    expect(notify).not.toHaveBeenCalled()
+  })
+
+  it('does not report saving stopped after a recoverable request failure or clean close', async () => {
+    const notify = vi.fn()
+    const client = clientFor(
+      `
+      if (request.command === 'close') {
+        parentPort.postMessage({ id: request.id, ok: true, revision: 1 })
+        parentPort.close()
+      } else {
+        parentPort.postMessage({ id: request.id, ok: false,
+          error: { code: 'SQLITE_BUSY', message: 'busy', outcome: 'known-failure' } })
+      }
+    `,
+      undefined,
+      notify
+    )
+    await client.ready
+    await expect(client.assertCurrentRevision()).rejects.toThrow('busy')
+    expect(() => client.assertWritable()).not.toThrow()
+    await client.close()
+    expect(notify).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-writer-protocol.ts b/src/main/persistence/profile-state/profile-state-writer-protocol.ts
new file mode 100644
index 00000000000..1a7dc665abf
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-writer-protocol.ts
@@ -0,0 +1,115 @@
+import type { ProfileStateDomainReplacement } from '../loading-store/profile-state-authority'
+import { isRecord } from './profile-state-document-validation'
+
+export type ProfileStateWriterInitialization = {
+  databasePath: string
+  profileId: string
+  revision: number
+}
+
+export type ProfileStateWriterCommand =
+  | { command: 'write-state'; payload: Uint8Array }
+  | {
+      command: 'write-complete' | 'write-domains'
+      replacements: readonly ProfileStateDomainReplacement[]
+    }
+  | {
+      command: 'write-automation'
+      replacements: readonly ProfileStateDomainReplacement[]
+      runPayloads: readonly string[]
+    }
+  | { command: 'assert-revision' | 'close' }
+  | { command: 'export-json' | 'export-latest' | 'export-compatibility'; targetPath: string }
+
+export type ProfileStateWriterRequest = ProfileStateWriterCommand & { id: number }
+export type ProfileStateWriterFailureOutcome = 'known-failure' | 'indeterminate'
+export type ProfileStateWriterErrorData = {
+  code: string
+  message: string
+  outcome: ProfileStateWriterFailureOutcome
+  expectedRevision?: number
+  actualRevision?: number
+  domain?: string | null
+}
+export type ProfileStateWriterResponse =
+  | { id: number; ok: true; revision: number; exportedRevision?: number | null }
+  | { id: number; ok: false; error: ProfileStateWriterErrorData }
+
+export function isProfileStateRevision(value: unknown): value is number {
+  return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0
+}
+
+export function isProfileStateWriterInitialization(
+  value: unknown
+): value is ProfileStateWriterInitialization {
+  return (
+    isRecord(value) &&
+    typeof value.databasePath === 'string' &&
+    value.databasePath.length > 0 &&
+    typeof value.profileId === 'string' &&
+    value.profileId.length > 0 &&
+    isProfileStateRevision(value.revision)
+  )
+}
+
+function isReplacement(value: unknown): value is ProfileStateDomainReplacement {
+  return (
+    isRecord(value) &&
+    typeof value.domain === 'string' &&
+    value.domain.length > 0 &&
+    (typeof value.payload === 'string' || value.payload === null)
+  )
+}
+
+export function isProfileStateWriterRequest(value: unknown): value is ProfileStateWriterRequest {
+  if (!isRecord(value) || !isProfileStateRevision(value.id) || value.id === 0) {
+    return false
+  }
+  switch (value.command) {
+    case 'write-state':
+      return value.payload instanceof Uint8Array
+    case 'assert-revision':
+    case 'close':
+      return true
+    case 'export-json':
+    case 'export-latest':
+    case 'export-compatibility':
+      return typeof value.targetPath === 'string' && value.targetPath.length > 0
+    case 'write-complete':
+    case 'write-domains':
+      return Array.isArray(value.replacements) && value.replacements.every(isReplacement)
+    case 'write-automation':
+      return (
+        Array.isArray(value.replacements) &&
+        value.replacements.every(isReplacement) &&
+        Array.isArray(value.runPayloads) &&
+        value.runPayloads.every((payload: unknown) => typeof payload === 'string')
+      )
+    default:
+      return false
+  }
+}
+
+function isErrorData(value: unknown): value is ProfileStateWriterErrorData {
+  return (
+    isRecord(value) &&
+    typeof value.code === 'string' &&
+    typeof value.message === 'string' &&
+    (value.outcome === 'known-failure' || value.outcome === 'indeterminate') &&
+    (value.expectedRevision === undefined || isProfileStateRevision(value.expectedRevision)) &&
+    (value.actualRevision === undefined || isProfileStateRevision(value.actualRevision)) &&
+    (value.domain === undefined || value.domain === null || typeof value.domain === 'string')
+  )
+}
+
+export function isProfileStateWriterResponse(value: unknown): value is ProfileStateWriterResponse {
+  if (!isRecord(value) || !isProfileStateRevision(value.id)) {
+    return false
+  }
+  return value.ok === true
+    ? isProfileStateRevision(value.revision) &&
+        (value.exportedRevision === undefined ||
+          value.exportedRevision === null ||
+          isProfileStateRevision(value.exportedRevision))
+    : value.ok === false && isErrorData(value.error)
+}
diff --git a/src/main/persistence/profile-state/profile-state-writer-request.ts b/src/main/persistence/profile-state/profile-state-writer-request.ts
new file mode 100644
index 00000000000..8db4c4f6580
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-writer-request.ts
@@ -0,0 +1,59 @@
+import type {
+  ProfileStateWriterCommand,
+  ProfileStateWriterResponse
+} from './profile-state-writer-protocol'
+
+export type SuccessfulProfileStateWriterResponse = Extract<ProfileStateWriterResponse, { ok: true }>
+export type PendingProfileStateWriterRequest = {
+  id: number
+  command: ProfileStateWriterCommand['command'] | 'initialize'
+  promise: Promise<SuccessfulProfileStateWriterResponse>
+  resolve: (response: SuccessfulProfileStateWriterResponse) => void
+  reject: (error: Error) => void
+  timer: ReturnType<typeof setTimeout>
+}
+
+export function isExpectedProfileStateWriterSuccess(
+  command: PendingProfileStateWriterRequest['command'],
+  response: SuccessfulProfileStateWriterResponse,
+  previousRevision: number
+): boolean {
+  const mayWrite = command.startsWith('write-')
+  if (
+    response.revision < previousRevision ||
+    response.revision > previousRevision + (mayWrite ? 1 : 0)
+  ) {
+    return false
+  }
+  if (
+    response.exportedRevision !== undefined &&
+    response.exportedRevision !== null &&
+    response.exportedRevision !== response.revision
+  ) {
+    return false
+  }
+  if (command === 'export-json') {
+    return response.exportedRevision !== undefined && response.exportedRevision !== null
+  }
+  if (command === 'export-compatibility' || command === 'export-latest') {
+    return (
+      response.exportedRevision !== undefined &&
+      (response.exportedRevision !== null || response.revision === 0)
+    )
+  }
+  return response.exportedRevision === undefined
+}
+
+export function createProfileStateWriterRequest(
+  id: number,
+  command: PendingProfileStateWriterRequest['command'],
+  timeoutMs: number,
+  onTimeout: () => void
+): PendingProfileStateWriterRequest {
+  return {
+    id,
+    command,
+    ...Promise.withResolvers<SuccessfulProfileStateWriterResponse>(),
+    timer: setTimeout(onTimeout, timeoutMs)
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-writer-worker-client.ts b/src/main/persistence/profile-state/profile-state-writer-worker-client.ts
new file mode 100644
index 00000000000..215af1f3499
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-writer-worker-client.ts
@@ -0,0 +1,75 @@
+import type { ProfileStateDomainReplacement } from '../loading-store/profile-state-authority'
+import { ProfileStateWriterConnection } from './profile-state-writer-connection'
+export { resolveProfileStateWriterWorkerPath } from './profile-state-writer-worker-path'
+export {
+  ProfileStateWriterError,
+  profileStateWriterFailureOutcome
+} from './profile-state-writer-errors'
+export type { ProfileStateWriterInitialization } from './profile-state-writer-protocol'
+
+export class ProfileStateWriteWorkerClient extends ProfileStateWriterConnection {
+  assertWritable(): void {
+    this.assertDispatchable()
+  }
+
+  writeSerializedState(payload: Buffer): Promise<number> {
+    return this.dispatch({ command: 'write-state', payload }).then((response) => response.revision)
+  }
+
+  writeCompleteSerializedDomains(
+    replacements: readonly ProfileStateDomainReplacement[]
+  ): Promise<number> {
+    return this.dispatch({ command: 'write-complete', replacements }).then(
+      (response) => response.revision
+    )
+  }
+
+  writeSerializedDomains(replacements: readonly ProfileStateDomainReplacement[]): Promise<number> {
+    return this.dispatch({ command: 'write-domains', replacements }).then(
+      (response) => response.revision
+    )
+  }
+
+  writeSerializedAutomationRuns(
+    replacements: readonly ProfileStateDomainReplacement[],
+    runs: readonly unknown[]
+  ): Promise<number> {
+    try {
+      this.assertDispatchable()
+      const runPayloads = runs.map((run) => {
+        const payload = JSON.stringify(run)
+        if (payload === undefined) {
+          throw new Error('Automation run is not serializable')
+        }
+        return payload
+      })
+      return this.dispatch({ command: 'write-automation', replacements, runPayloads }).then(
+        (response) => response.revision
+      )
+    } catch (error) {
+      return Promise.reject(error)
+    }
+  }
+
+  assertCurrentRevision(): Promise<number> {
+    return this.dispatch({ command: 'assert-revision' }).then((response) => response.revision)
+  }
+
+  writeJsonExport(targetPath: string): Promise<number> {
+    return this.dispatch({ command: 'export-json', targetPath }).then(
+      (response) => response.exportedRevision ?? response.revision
+    )
+  }
+
+  writeLatestJsonExport(dataFile: string): Promise<number | undefined> {
+    return this.dispatch({ command: 'export-latest', targetPath: dataFile }).then(
+      (response) => response.exportedRevision ?? undefined
+    )
+  }
+
+  writeJsonCompatibilityExportAsync(targetPath: string): Promise<number | undefined> {
+    return this.dispatch({ command: 'export-compatibility', targetPath }).then(
+      (response) => response.exportedRevision ?? undefined
+    )
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-writer-worker-entry.ts b/src/main/persistence/profile-state/profile-state-writer-worker-entry.ts
new file mode 100644
index 00000000000..f7917031286
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-writer-worker-entry.ts
@@ -0,0 +1,148 @@
+import { parentPort, workerData } from 'node:worker_threads'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { writeVersionedProfileStateExport } from './legacy-json/profile-state-versioned-export'
+import {
+  encodeProfileStateWriterError,
+  ProfileStateWriterError
+} from './profile-state-writer-errors'
+import {
+  isProfileStateWriterInitialization,
+  isProfileStateWriterRequest,
+  type ProfileStateWriterRequest,
+  type ProfileStateWriterResponse
+} from './profile-state-writer-protocol'
+
+if (!parentPort) {
+  throw new Error('Profile state writer requires a worker thread')
+}
+const port = parentPort
+let authority: ProfileStateSqliteAuthority | undefined
+let busy = false
+let stopping = false
+let previousId = 0
+
+function reply(response: ProfileStateWriterResponse): void {
+  port.postMessage(response)
+}
+
+function close(): void {
+  stopping = true
+  try {
+    authority?.close()
+  } finally {
+    port.close()
+  }
+}
+
+async function execute(request: ProfileStateWriterRequest): Promise<ProfileStateWriterResponse> {
+  if (!authority) {
+    throw new Error('Profile state writer is not initialized')
+  }
+  let exportedRevision: number | null | undefined
+  switch (request.command) {
+    case 'write-state':
+      authority.writeSerializedState(Buffer.from(request.payload))
+      break
+    case 'write-complete':
+      authority.writeCompleteSerializedDomains(request.replacements)
+      break
+    case 'write-domains':
+      authority.writeSerializedDomains(request.replacements)
+      break
+    case 'write-automation':
+      authority.writeSerializedAutomationRuns(
+        request.replacements,
+        request.runPayloads.map((payload): unknown => JSON.parse(payload))
+      )
+      break
+    case 'assert-revision':
+      authority.assertCurrentRevision()
+      break
+    case 'export-json':
+      authority.assertCurrentRevision()
+      exportedRevision = authority.writeJsonExport(request.targetPath)
+      break
+    case 'export-latest':
+      authority.assertCurrentRevision()
+      exportedRevision =
+        writeVersionedProfileStateExport(
+          request.targetPath,
+          authority.writeJsonExport.bind(authority)
+        ) ?? null
+      break
+    case 'export-compatibility':
+      authority.assertCurrentRevision()
+      exportedRevision =
+        (await authority.writeJsonCompatibilityExportAsync(request.targetPath)) ?? null
+      break
+    case 'close':
+      authority.close()
+      stopping = true
+      break
+  }
+  return {
+    id: request.id,
+    ok: true,
+    revision: authority.revision,
+    ...(exportedRevision === undefined ? {} : { exportedRevision })
+  }
+}
+
+async function accept(value: unknown): Promise<void> {
+  if (stopping) {
+    return
+  }
+  if (!isProfileStateWriterRequest(value) || busy || value.id <= previousId) {
+    stopping = true
+    reply({
+      id: 0,
+      ok: false,
+      error: encodeProfileStateWriterError(
+        new ProfileStateWriterError(
+          'profile-state-writer-protocol',
+          'Invalid profile state writer request',
+          'indeterminate'
+        )
+      )
+    })
+    if (!busy) {
+      close()
+    }
+    return
+  }
+  busy = true
+  previousId = value.id
+  try {
+    reply(await execute(value))
+  } catch (error) {
+    // Export staging accepts both JSON versions; only uncertain SQL outcomes retire the writer.
+    const failure = encodeProfileStateWriterError(error, value.command === 'close')
+    reply({ id: value.id, ok: false, error: failure })
+    stopping ||= failure.outcome === 'indeterminate'
+  } finally {
+    busy = false
+    if (stopping) {
+      close()
+    }
+  }
+}
+
+try {
+  const initialization: unknown = workerData
+  if (!isProfileStateWriterInitialization(initialization)) {
+    throw new ProfileStateWriterError(
+      'profile-state-writer-initialization',
+      'Invalid profile state writer initialization',
+      'known-failure'
+    )
+  }
+  authority = new ProfileStateSqliteAuthority(initialization.databasePath, initialization.profileId)
+  authority.initializeFromRevision(initialization.revision)
+  reply({ id: 0, ok: true, revision: authority.revision })
+  port.on('message', (value: unknown) => {
+    void accept(value)
+  })
+} catch (error) {
+  reply({ id: 0, ok: false, error: encodeProfileStateWriterError(error) })
+  close()
+}
diff --git a/src/main/persistence/profile-state/profile-state-writer-worker-path.ts b/src/main/persistence/profile-state/profile-state-writer-worker-path.ts
new file mode 100644
index 00000000000..d1068eb26b0
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-writer-worker-path.ts
@@ -0,0 +1,17 @@
+import { existsSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import {
+  currentWorkerEntryLayout,
+  resolveWorkerThreadEntryPath
+} from '../../worker-thread-entry-path'
+
+export function resolveProfileStateWriterWorkerPath(moduleDir = __dirname): string {
+  const entry = resolveWorkerThreadEntryPath(
+    currentWorkerEntryLayout(moduleDir),
+    'profile-state-writer-worker-entry.js'
+  )
+  return (
+    [entry, join(dirname(entry), '..', 'profile-state-writer-worker-entry.js')].find(existsSync) ??
+    entry
+  )
+}
diff --git a/src/main/persistence/profile-state/profile-state-writer-worker.test.ts b/src/main/persistence/profile-state/profile-state-writer-worker.test.ts
new file mode 100644
index 00000000000..bcf2f54ee51
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-writer-worker.test.ts
@@ -0,0 +1,355 @@
+import { build } from 'esbuild'
+import { mkdtempSync, readFileSync, rmSync, writeFileSync, existsSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { ProfileStateRevisionConflictError } from './profile-state-document-validation'
+import { openProfileStateDatabase } from './profile-state-database'
+import { readProfileStateSnapshot } from './profile-state-documents'
+import {
+  ProfileStateWriteWorkerClient,
+  profileStateWriterFailureOutcome,
+  resolveProfileStateWriterWorkerPath
+} from './profile-state-writer-worker-client'
+
+let bundleRoot: string
+let workerPath: string
+const roots: string[] = []
+const clients: ProfileStateWriteWorkerClient[] = []
+
+beforeAll(async () => {
+  bundleRoot = mkdtempSync(join(tmpdir(), 'orca-writer-bundle-'))
+  workerPath = join(bundleRoot, 'profile-state-writer-worker-entry.js')
+  await build({
+    entryPoints: [
+      resolve('src/main/persistence/profile-state/profile-state-writer-worker-entry.ts')
+    ],
+    outfile: workerPath,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    logLevel: 'silent'
+  })
+})
+
+afterEach(async () => {
+  await Promise.all(clients.splice(0).map((client) => client.close().catch(() => {})))
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+afterAll(() => rmSync(bundleRoot, { recursive: true, force: true }))
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), 'orca-writer-'))
+  roots.push(root)
+  const path = join(root, 'profile-state.db')
+  const profileId = 'writer-test'
+  const db = openProfileStateDatabase(path, profileId)
+  db.db.close()
+  const authority = new ProfileStateSqliteAuthority(path, profileId)
+  authority.readInitialState().takeParsedState?.()
+  authority.writeCompleteSerializedDomains([{ domain: 'settings', payload: '{"theme":"dark"}' }])
+  const initialization = authority.retireForWorker()
+  return { root, path, profileId, authority, initialization }
+}
+
+function clientFor(
+  initialization: ReturnType<typeof fixture>['initialization'],
+  path = workerPath,
+  timeoutMs = 5000
+) {
+  const client = new ProfileStateWriteWorkerClient(initialization, { workerPath: path, timeoutMs })
+  clients.push(client)
+  return client
+}
+
+function readState(path: string, profileId: string): unknown {
+  const db = openProfileStateDatabase(path, profileId)
+  try {
+    return JSON.parse(readProfileStateSnapshot(db.db).json)
+  } finally {
+    db.db.close()
+  }
+}
+
+function script(root: string, source: string): string {
+  const path = join(root, 'fault-worker.cjs')
+  writeFileSync(path, source)
+  return path
+}
+
+describe('persistent profile state write worker', () => {
+  it('commits full, selective, automation and byte payloads, exports and releases the database', async () => {
+    const f = fixture()
+    const client = clientFor(f.initialization)
+    await client.ready
+    expect(
+      await client.writeSerializedDomains([{ domain: 'ui', payload: '{"note":"hi \\ud800"}' }])
+    ).toBe(2)
+    const run = {
+      id: 'run-1',
+      output: 'first',
+      toJSON() {
+        return { id: this.id, output: this.output }
+      }
+    }
+    const write = client.writeSerializedAutomationRuns([], [run])
+    run.output = 'changed after capture'
+    expect(await write).toBe(3)
+    const exported = join(f.root, 'state.json')
+    expect(await client.writeJsonExport(exported)).toBe(3)
+    expect(JSON.parse(readFileSync(exported, 'utf8'))).toEqual({
+      settings: { theme: 'dark' },
+      ui: { note: 'hi \ud800' },
+      automationRuns: [{ id: 'run-1', output: 'first' }]
+    })
+    const compatibility = join(f.root, 'compatibility.json')
+    expect(await client.writeJsonCompatibilityExportAsync(compatibility)).toBe(3)
+    expect(readFileSync(compatibility, 'utf8')).toBe(readFileSync(exported, 'utf8'))
+    expect(await client.writeSerializedState(Buffer.from('{"settings":{"theme":"light"}}'))).toBe(4)
+    expect(await client.assertCurrentRevision()).toBe(4)
+    await client.close()
+    await client.close()
+    expect(readState(f.path, f.profileId)).toEqual({ settings: { theme: 'light' } })
+    rmSync(f.root, { recursive: true })
+    expect(existsSync(f.root)).toBe(false)
+  })
+
+  it('requires a present admitted database and refuses startup revision races', async () => {
+    const f = fixture()
+    const peer = new ProfileStateSqliteAuthority(f.path, f.profileId)
+    peer.readInitialState()
+    peer.writeSerializedDomains([{ domain: 'settings', payload: '{"peer":true}' }])
+    peer.close()
+    const client = clientFor(f.initialization)
+    await expect(client.ready).rejects.toBeInstanceOf(ProfileStateRevisionConflictError)
+    await client.close()
+    expect(readState(f.path, f.profileId)).toEqual({ settings: { peer: true } })
+    const missing = clientFor({ ...f.initialization, databasePath: join(f.root, 'missing.db') })
+    await expect(missing.ready).rejects.toMatchObject({ code: 'unreadable' })
+    await missing.close()
+    expect(existsSync(join(f.root, 'missing.db'))).toBe(false)
+  })
+
+  it('permanently retires bootstrap authority and refuses subsequent calls', () => {
+    const f = fixture()
+    for (const call of [
+      () => f.authority.readInitialState(),
+      () => f.authority.readAcceptedState('{}'),
+      () => f.authority.readSerializedState(),
+      () => f.authority.writeSerializedDomains([]),
+      () => f.authority.writeCompleteSerializedDomains([]),
+      () => f.authority.writeSerializedAutomationRuns([], []),
+      () => f.authority.writeSerializedState(Buffer.from('{}')),
+      () => f.authority.writeJsonExport(join(f.root, 'export.json')),
+      () => f.authority.scheduleBackup(),
+      () => f.authority.assertCurrentRevision(),
+      () => f.authority.initializeFromRevision(1),
+      () => f.authority.retireForWorker(),
+      () => f.authority.close()
+    ]) {
+      expect(call).toThrow(/retired/)
+    }
+  })
+
+  it('preserves known validation failures and rejects a peer at the no-op fence', async () => {
+    const f = fixture()
+    const client = clientFor(f.initialization)
+    await client.ready
+    await expect(
+      client.writeSerializedDomains([{ domain: 'settings', payload: '{' }])
+    ).rejects.toMatchObject({ code: 'profile-state-write-failed', outcome: 'known-failure' })
+    expect(await client.assertCurrentRevision()).toBe(1)
+    const peer = new ProfileStateSqliteAuthority(f.path, f.profileId)
+    peer.readInitialState()
+    peer.writeSerializedDomains([{ domain: 'ui', payload: '{"peer":true}' }])
+    peer.close()
+    const failure = await client.assertCurrentRevision().catch((error: unknown) => error)
+    expect(failure).toBeInstanceOf(ProfileStateRevisionConflictError)
+    expect(profileStateWriterFailureOutcome(failure)).toBe('known-failure')
+    await expect(
+      client.writeSerializedDomains([{ domain: 'settings', payload: '{}' }])
+    ).rejects.toBeInstanceOf(ProfileStateRevisionConflictError)
+  })
+
+  it('rejects a second materialized write and waits for the first before close', async () => {
+    const f = fixture()
+    const delayed = script(
+      f.root,
+      `
+      const { MessagePort } = require('node:worker_threads')
+      const send = MessagePort.prototype.postMessage
+      MessagePort.prototype.postMessage = function(value, ...rest) {
+        if (value?.id === 1 && value.ok) { setTimeout(() => send.call(this, value, ...rest), 60); return }
+        return send.call(this, value, ...rest)
+      }
+      require(${JSON.stringify(workerPath)})
+    `
+    )
+    const client = clientFor(f.initialization, delayed)
+    await client.ready
+    const first = client.writeSerializedDomains([{ domain: 'settings', payload: '{"first":true}' }])
+    await expect(
+      client.writeSerializedDomains([{ domain: 'settings', payload: '{"second":true}' }])
+    ).rejects.toMatchObject({ code: 'profile-state-writer-busy' })
+    const closing = client.close()
+    expect(await first).toBe(2)
+    await closing
+    expect(readState(f.path, f.profileId)).toEqual({ settings: { first: true } })
+    await expect(client.assertCurrentRevision()).rejects.toMatchObject({
+      code: 'profile-state-writer-closed'
+    })
+  })
+
+  it('waits for actual worker exit after receiving its close acknowledgement', async () => {
+    const f = fixture()
+    const marker = join(f.root, 'worker-exited.txt')
+    const delayedExit = script(
+      f.root,
+      `
+      const { MessagePort } = require('node:worker_threads')
+      const send = MessagePort.prototype.postMessage
+      MessagePort.prototype.postMessage = function(value, ...rest) {
+        if (value?.id === 1 && value.ok) {
+          setTimeout(() => require('node:fs').writeFileSync(${JSON.stringify(marker)}, 'released'), 60)
+        }
+        return send.call(this, value, ...rest)
+      }
+      require(${JSON.stringify(workerPath)})
+    `
+    )
+    const client = clientFor(f.initialization, delayedExit)
+    await client.ready
+    await client.close()
+    expect(readFileSync(marker, 'utf8')).toBe('released')
+  })
+
+  it('reports post-commit worker death as indeterminate without replaying the committed write', async () => {
+    const f = fixture()
+    const crashAfterCommit = script(
+      f.root,
+      `
+      const { MessagePort } = require('node:worker_threads')
+      const send = MessagePort.prototype.postMessage
+      MessagePort.prototype.postMessage = function(value, ...rest) {
+        if (value?.id === 1 && value.ok) process.exit(13)
+        return send.call(this, value, ...rest)
+      }
+      require(${JSON.stringify(workerPath)})
+    `
+    )
+    const client = clientFor(f.initialization, crashAfterCommit)
+    await client.ready
+    const failure = await client
+      .writeSerializedDomains([{ domain: 'settings', payload: '{"committed":true}' }])
+      .catch((error: unknown) => error)
+    expect(profileStateWriterFailureOutcome(failure)).toBe('indeterminate')
+    await expect(client.assertCurrentRevision()).rejects.toBe(failure)
+    await client.close()
+    expect(readState(f.path, f.profileId)).toEqual({ settings: { committed: true } })
+  })
+
+  it.each(['mismatch', 'timeout', 'exit'])(
+    'fails closed after a dispatched %s and awaits actual exit',
+    async (mode) => {
+      const f = fixture()
+      const broken = script(
+        f.root,
+        `
+      const { parentPort } = require('node:worker_threads')
+      parentPort.postMessage({ id: 0, ok: true, revision: 1 })
+      parentPort.on('message', request => {
+        if (${JSON.stringify(mode)} === 'exit') process.exit(0)
+        if (${JSON.stringify(mode)} === 'mismatch') parentPort.postMessage({ id: request.id + 1, ok: true, revision: 2 })
+      })
+    `
+      )
+      const client = clientFor(f.initialization, broken)
+      await client.ready
+      if (mode === 'timeout') {
+        vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+      }
+      try {
+        const failure = client
+          .writeSerializedDomains([{ domain: 'settings', payload: '{}' }])
+          .catch((error: unknown) => error)
+        if (mode === 'timeout') {
+          await vi.advanceTimersByTimeAsync(5000)
+        }
+        const observedFailure = await failure
+        expect(profileStateWriterFailureOutcome(observedFailure)).toBe('indeterminate')
+        if (mode === 'timeout') {
+          expect(observedFailure).toMatchObject({ code: 'profile-state-writer-timeout' })
+        }
+      } finally {
+        vi.useRealTimers()
+      }
+      await client.close()
+      expect(readState(f.path, f.profileId)).toEqual({ settings: { theme: 'dark' } })
+      rmSync(f.root, { recursive: true })
+    }
+  )
+
+  it('recovers the prior committed revision after the worker exits inside a transaction', async () => {
+    const f = fixture()
+    const interruptedPath = join(f.root, 'interrupted-worker.cjs')
+    await build({
+      entryPoints: [
+        resolve('src/main/persistence/profile-state/profile-state-writer-worker-entry.ts')
+      ],
+      outfile: interruptedPath,
+      bundle: true,
+      platform: 'node',
+      format: 'cjs',
+      logLevel: 'silent',
+      plugins: [
+        {
+          name: 'interrupt-transaction',
+          setup(builder) {
+            builder.onLoad({ filter: /profile-state-write-transaction\.ts$/ }, (args) => ({
+              contents: readFileSync(args.path, 'utf8').replace(
+                "db.exec('COMMIT')",
+                'process.exit(17)'
+              ),
+              loader: 'ts'
+            }))
+          }
+        }
+      ]
+    })
+    const client = clientFor(f.initialization, interruptedPath)
+    await client.ready
+    const failure = await client
+      .writeSerializedDomains([{ domain: 'settings', payload: '{"uncommitted":true}' }])
+      .catch((error: unknown) => error)
+    expect(profileStateWriterFailureOutcome(failure)).toBe('indeterminate')
+    await client.close()
+    expect(readState(f.path, f.profileId)).toEqual({ settings: { theme: 'dark' } })
+  })
+
+  it('aborts an active request without treating the pending write as rolled back', async () => {
+    const f = fixture()
+    const hung = script(
+      f.root,
+      `
+      const { parentPort } = require('node:worker_threads')
+      parentPort.postMessage({ id: 0, ok: true, revision: 1 })
+      parentPort.on('message', () => {})
+    `
+    )
+    const client = clientFor(f.initialization, hung)
+    await client.ready
+    const write = client.writeSerializedDomains([{ domain: 'settings', payload: '{}' }])
+    const failed = expect(write).rejects.toMatchObject({ outcome: 'indeterminate' })
+    await client.abort()
+    await failed
+    await client.close()
+  })
+
+  it('resolves flat and shared-chunk entry layouts', () => {
+    expect(resolveProfileStateWriterWorkerPath(bundleRoot)).toBe(workerPath)
+    expect(resolveProfileStateWriterWorkerPath(join(bundleRoot, 'chunks'))).toBe(workerPath)
+  })
+})
diff --git a/src/main/persistence/restoring-sessions/pane-identity-migration.ts b/src/main/persistence/restoring-sessions/pane-identity-migration.ts
index 98d97a649a3..6cd2bbf129f 100644
--- a/src/main/persistence/restoring-sessions/pane-identity-migration.ts
+++ b/src/main/persistence/restoring-sessions/pane-identity-migration.ts
@@ -1,8 +1,8 @@
+import type { ProfileStateStartupPaneAlias } from '../loading-store/profile-state-authority'
 import type { LegacyPaneKeyAliasEntry } from '../../../shared/persisted-state-types'
 import type { TerminalLayoutSnapshot, TerminalTab } from '../../../shared/terminal-tab-types'
 import type { WorkspaceSessionState } from '../../../shared/workspace-session-state-types'
 import { isTerminalLeafId, makePaneKey } from '../../../shared/stable-pane-id'
-import { agentHookServer } from '../../agent-hooks/server'
 import { collectLayoutLeafIdsInOrder, firstLayoutLeafId } from './terminal-layout-normalization'
 
 export function findWorktreeIdForTab(
@@ -67,47 +67,49 @@ export function createLazyTerminalTabLookup(session: WorkspaceSessionState): Ter
   }
 }
 
-/** Bridges a tab's legacy numeric pane keys to stable ones; returns the alias rows worth persisting. */
-export function registerLegacyPaneKeyAliasesForTab(args: {
+export type PaneAliasNormalizationOptions = {
+  registerAliases?: boolean
+  collectUnboundPaneAlias?: (entry: ProfileStateStartupPaneAlias) => void
+}
+
+type LegacyPaneKeyAlias = Omit<LegacyPaneKeyAliasEntry, 'ptyId'> & { ptyId?: string }
+
+/** Includes unbound aliases needed by the live hook server, even though they are not persisted. */
+export function collectLegacyPaneKeyAliasesForTab(args: {
   tabId: string
   tab: TerminalTab | undefined
   inputLayout: TerminalLayoutSnapshot
   normalizedLayout: TerminalLayoutSnapshot
   leafIdByInputLeafId: Map<string, string>
-}): LegacyPaneKeyAliasEntry[] {
-  const legacyPaneKeyAliasEntries: LegacyPaneKeyAliasEntry[] = []
+}): LegacyPaneKeyAlias[] {
+  const legacyPaneKeyAliasEntries: LegacyPaneKeyAlias[] = []
   const registeredLegacyPaneKeys = new Set<string>()
   const hasLeafPtyBindings = Object.keys(args.inputLayout.ptyIdsByLeafId ?? {}).length > 0
   const fallbackPtyId =
     !hasLeafPtyBindings && typeof args.tab?.ptyId === 'string' ? args.tab.ptyId : undefined
-  const registerLegacyAlias = (inputLeafId: string, leafId: string, ptyId?: string): boolean => {
+  const collectLegacyAlias = (inputLeafId: string, leafId: string, ptyId?: string): void => {
     if (!isTerminalLeafId(leafId)) {
-      return false
+      return
     }
     let paneKey: string
     try {
       paneKey = makePaneKey(args.tabId, leafId)
     } catch {
-      return false
+      return
     }
     const numeric = /^(?:pane:)?(\d+)$/.exec(inputLeafId)?.[1]
     if (!numeric) {
-      return false
+      return
     }
     // Why: PaneManager ids are 1-based; a zero-based alias in split layouts makes tab:1 ambiguous and misroutes panes.
     const legacyPaneKey = `${args.tabId}:${numeric}`
-    agentHookServer.registerPaneKeyAlias(legacyPaneKey, paneKey, ptyId)
     registeredLegacyPaneKeys.add(legacyPaneKey)
-    if (ptyId) {
-      legacyPaneKeyAliasEntries.push({
-        ptyId,
-        legacyPaneKey,
-        stablePaneKey: paneKey,
-        updatedAt: Date.now()
-      })
-      return true
-    }
-    return false
+    legacyPaneKeyAliasEntries.push({
+      ptyId,
+      legacyPaneKey,
+      stablePaneKey: paneKey,
+      updatedAt: Date.now()
+    })
   }
   const inputLeafIds = new Set([
     ...collectLayoutLeafIdsInOrder(args.inputLayout.root),
@@ -119,7 +121,7 @@ export function registerLegacyPaneKeyAliasesForTab(args: {
     }
     const leafId = args.leafIdByInputLeafId.get(inputLeafId)
     if (leafId) {
-      registerLegacyAlias(
+      collectLegacyAlias(
         inputLeafId,
         leafId,
         args.inputLayout.ptyIdsByLeafId?.[inputLeafId] ?? fallbackPtyId
@@ -142,7 +144,6 @@ export function registerLegacyPaneKeyAliasesForTab(args: {
         if (registeredLegacyPaneKeys.has(legacyPaneKey)) {
           continue
         }
-        agentHookServer.registerPaneKeyAlias(legacyPaneKey, paneKey, args.tab.ptyId)
         legacyPaneKeyAliasEntries.push({
           ptyId: args.tab.ptyId,
           legacyPaneKey,
diff --git a/src/main/persistence/restoring-sessions/session-owner-removal.ts b/src/main/persistence/restoring-sessions/session-owner-removal.ts
index 81b18ae2fe6..5fac53546c4 100644
--- a/src/main/persistence/restoring-sessions/session-owner-removal.ts
+++ b/src/main/persistence/restoring-sessions/session-owner-removal.ts
@@ -8,9 +8,9 @@ import {
 import { workspaceSessionPartitionHostId } from '../../../shared/workspace-session-partition-owner'
 import { cloneWorkspaceSessionState, deleteOwnerKeyedSessionFields } from './session-owner-fields'
 
-// Scans the pane-key-keyed maps and the shutdown list once, removing every entry
-// owned by a key matched by `isRemovedOwner` (or, for pty incarnations, whose tab
-// was removed). Kept separate from the O(1) deletes so a batch prune scans each
+// Scans the pane-key-keyed maps, the close records and the shutdown list once, removing
+// every entry owned by a key matched by `isRemovedOwner` (or, for pty incarnations, whose
+// tab was removed). Kept separate from the O(1) deletes so a batch prune scans each
 // collection a single time regardless of how many owners are being removed.
 export function deleteScannedSessionFieldsForOwners(
   next: WorkspaceSessionState,
@@ -39,6 +39,14 @@ export function deleteScannedSessionFieldsForOwners(
       }
     }
   }
+  // Why: a close record answers for its workspace; once the workspace's rows go, so does it.
+  if (next.closedTerminalTabTombstonesByTabId) {
+    for (const [tabId, record] of Object.entries(next.closedTerminalTabTombstonesByTabId)) {
+      if (isRemovedOwner(record.worktreeId)) {
+        delete next.closedTerminalTabTombstonesByTabId[tabId]
+      }
+    }
+  }
   next.activeWorktreeIdsOnShutdown = next.activeWorktreeIdsOnShutdown?.filter(
     (worktreeId) => !isRemovedOwner(worktreeId)
   )
diff --git a/src/main/persistence/restoring-sessions/terminal-layout-normalization.ts b/src/main/persistence/restoring-sessions/terminal-layout-normalization.ts
index c2cd72247f6..551d57e6e35 100644
--- a/src/main/persistence/restoring-sessions/terminal-layout-normalization.ts
+++ b/src/main/persistence/restoring-sessions/terminal-layout-normalization.ts
@@ -218,6 +218,10 @@ export function normalizeTerminalLayoutSnapshotForPersistence(
     inputSnapshot.expandedLeafId && !duplicatedInputLeafIds.has(inputSnapshot.expandedLeafId)
       ? (leafIdByInputLeafId.get(inputSnapshot.expandedLeafId) ?? null)
       : null
+  const chatLeafId =
+    inputSnapshot.chatLeafId && !duplicatedInputLeafIds.has(inputSnapshot.chatLeafId)
+      ? (leafIdByInputLeafId.get(inputSnapshot.chatLeafId) ?? null)
+      : null
   const ptyIdsByLeafId = remapLeafRecordForPersistence(
     inputSnapshot.ptyIdsByLeafId,
     leafIdByInputLeafId,
@@ -244,7 +248,9 @@ export function normalizeTerminalLayoutSnapshotForPersistence(
     !leafRecordEquivalent(inputSnapshot.scrollbackRefsByLeafId, scrollbackRefsByLeafId) ||
     !leafRecordEquivalent(inputSnapshot.titlesByLeafId, titlesByLeafId)
   const metadataChanged =
-    activeLeafId !== inputSnapshot.activeLeafId || expandedLeafId !== inputSnapshot.expandedLeafId
+    activeLeafId !== inputSnapshot.activeLeafId ||
+    expandedLeafId !== inputSnapshot.expandedLeafId ||
+    chatLeafId !== (inputSnapshot.chatLeafId ?? null)
   if (!changed && !recordsChanged && !metadataChanged) {
     return { snapshot, changed: false, leafIdByInputLeafId }
   }
@@ -253,6 +259,7 @@ export function normalizeTerminalLayoutSnapshotForPersistence(
     buffersByLeafId: _oldBuffersByLeafId,
     scrollbackRefsByLeafId: _oldScrollbackRefsByLeafId,
     titlesByLeafId: _oldTitlesByLeafId,
+    chatLeafId: _oldChatLeafId,
     ...snapshotWithoutLeafRecords
   } = inputSnapshot
   return {
@@ -261,6 +268,7 @@ export function normalizeTerminalLayoutSnapshotForPersistence(
       root,
       activeLeafId,
       expandedLeafId,
+      ...(chatLeafId ? { chatLeafId } : {}),
       ...(ptyIdsByLeafId ? { ptyIdsByLeafId } : {}),
       ...(buffersByLeafId ? { buffersByLeafId } : {}),
       ...(scrollbackRefsByLeafId ? { scrollbackRefsByLeafId } : {}),
diff --git a/src/main/persistence/restoring-sessions/workspace-pane-normalization.ts b/src/main/persistence/restoring-sessions/workspace-pane-normalization.ts
index cfc26c7bb8a..38ec014c7c9 100644
--- a/src/main/persistence/restoring-sessions/workspace-pane-normalization.ts
+++ b/src/main/persistence/restoring-sessions/workspace-pane-normalization.ts
@@ -2,6 +2,7 @@ import type { LegacyPaneKeyAliasEntry, PersistedState } from '../../../shared/pe
 import type { TerminalLayoutSnapshot } from '../../../shared/terminal-tab-types'
 import type { WorkspaceSessionState } from '../../../shared/workspace-session-state-types'
 import type { MigrationUnsupportedPtyEntry } from '../../../shared/agent-status-types'
+import { agentHookServer } from '../../agent-hooks/server'
 import {
   LOCAL_EXECUTION_HOST_ID,
   toSshExecutionHostId,
@@ -12,7 +13,8 @@ import { isTerminalLeafId, parsePaneKey } from '../../../shared/stable-pane-id'
 import { findCrossHostPaneTabIds, withoutPaneTabIds } from './cross-host-pane-tab-ids'
 import {
   createLazyTerminalTabLookup,
-  registerLegacyPaneKeyAliasesForTab
+  collectLegacyPaneKeyAliasesForTab,
+  type PaneAliasNormalizationOptions
 } from './pane-identity-migration'
 import { normalizeTerminalLayoutSnapshotForPersistence } from './terminal-layout-normalization'
 import {
@@ -37,7 +39,7 @@ export {
 export function normalizeWorkspaceSessionPaneIdentities(
   session: WorkspaceSessionState,
   priorLayoutsByTabId: Record<string, TerminalLayoutSnapshot> = {},
-  options: { skipAliasTabIds?: ReadonlySet<string> } = {}
+  options: PaneAliasNormalizationOptions & { skipAliasTabIds?: ReadonlySet<string> } = {}
 ): {
   session: WorkspaceSessionState
   changed: boolean
@@ -49,9 +51,6 @@ export function normalizeWorkspaceSessionPaneIdentities(
   let changed = false
   const leafIdByInputLeafIdByTabId = new Map<string, Map<string, string>>()
   const leafIdByPtyIdByTabId = new Map<string, Map<string, string>>()
-  // Why always empty: legacy numeric pane keys are bridged by aliases now, not persisted as
-  // restart-required rows; the field stays so callers keep clearing stale rows written by old builds.
-  const migrationUnsupportedEntries: MigrationUnsupportedPtyEntry[] = []
   const legacyPaneKeyAliasEntries: LegacyPaneKeyAliasEntry[] = []
   const terminalLayoutsByTabId: Record<string, TerminalLayoutSnapshot> = {}
   let tabsById: ReturnType<typeof createLazyTerminalTabLookup> | null = null
@@ -64,7 +63,7 @@ export function normalizeWorkspaceSessionPaneIdentities(
     leafIdByInputLeafIdByTabId.set(tabId, normalized.leafIdByInputLeafId)
     if (!options.skipAliasTabIds?.has(tabId)) {
       tabsById ??= createLazyTerminalTabLookup(session)
-      const tabAliasEntries = registerLegacyPaneKeyAliasesForTab({
+      const tabAliasEntries = collectLegacyPaneKeyAliasesForTab({
         tabId,
         tab: tabsById.get(tabId),
         inputLayout: layout,
@@ -73,7 +72,18 @@ export function normalizeWorkspaceSessionPaneIdentities(
       })
       // Why: old split layouts can generate enough alias rows to exceed V8's argument limit if spread into push().
       for (const entry of tabAliasEntries) {
-        legacyPaneKeyAliasEntries.push(entry)
+        if (options.registerAliases !== false) {
+          agentHookServer.registerPaneKeyAlias(
+            entry.legacyPaneKey,
+            entry.stablePaneKey,
+            entry.ptyId
+          )
+        }
+        if (entry.ptyId) {
+          legacyPaneKeyAliasEntries.push({ ...entry, ptyId: entry.ptyId })
+        } else {
+          options.collectUnboundPaneAlias?.(entry)
+        }
       }
     }
     const leafIdByPtyId = new Map<string, string>()
@@ -97,7 +107,8 @@ export function normalizeWorkspaceSessionPaneIdentities(
     changed,
     leafIdByInputLeafIdByTabId,
     leafIdByPtyIdByTabId,
-    migrationUnsupportedEntries,
+    // Aliases replace old restart-required rows; callers still clear that legacy field.
+    migrationUnsupportedEntries: [],
     legacyPaneKeyAliasEntries
   }
 }
@@ -163,7 +174,10 @@ function mergeAcknowledgementLeafIdMapsByTabId(
   return merged
 }
 
-export function normalizePersistedPaneIdentityState(state: PersistedState): {
+export function normalizePersistedPaneIdentityState(
+  state: PersistedState,
+  options: PaneAliasNormalizationOptions = {}
+): {
   state: PersistedState
   changed: boolean
   migrationUnsupportedEntries: MigrationUnsupportedPtyEntry[]
@@ -174,6 +188,7 @@ export function normalizePersistedPaneIdentityState(state: PersistedState): {
     state.workspaceSession,
     {},
     {
+      ...options,
       skipAliasTabIds: crossHostTabIds
     }
   )
@@ -200,6 +215,7 @@ export function normalizePersistedPaneIdentityState(state: PersistedState): {
         hostSession,
         {},
         {
+          ...options,
           skipAliasTabIds: crossHostTabIds
         }
       )
diff --git a/src/main/persistence/restoring-sessions/workspace-session-write-rollback.ts b/src/main/persistence/restoring-sessions/workspace-session-write-rollback.ts
new file mode 100644
index 00000000000..bdca21f7bbe
--- /dev/null
+++ b/src/main/persistence/restoring-sessions/workspace-session-write-rollback.ts
@@ -0,0 +1,132 @@
+import { isDeepStrictEqual } from 'node:util'
+import type { WorkspaceSessionState } from '../../../shared/workspace-session-state-types'
+
+const MISSING = Symbol('missing')
+
+/** A JSON-shaped slot of persisted session state, or the absent-key sentinel. */
+type RollbackSlot =
+  | string
+  | number
+  | boolean
+  | null
+  | undefined
+  | typeof MISSING
+  | readonly RollbackSlot[]
+  | RollbackRecord
+
+type RollbackRecord = { readonly [key: string]: RollbackSlot }
+
+function isRecord(value: RollbackSlot): value is RollbackRecord {
+  return (
+    value !== MISSING &&
+    typeof value === 'object' &&
+    value !== null &&
+    !Array.isArray(value) &&
+    Object.getPrototypeOf(value) === Object.prototype
+  )
+}
+
+type IdentifiedRecord = RollbackRecord & { readonly id: string }
+
+function identifiedRows(value: RollbackSlot): readonly IdentifiedRecord[] | null {
+  if (value === MISSING) {
+    return []
+  }
+  if (
+    !Array.isArray(value) ||
+    !value.every((row): row is IdentifiedRecord => isRecord(row) && typeof row.id === 'string')
+  ) {
+    return null
+  }
+  return new Set(value.map((row) => row.id)).size === value.length ? value : null
+}
+
+function rollbackIdentifiedRows(
+  original: RollbackSlot,
+  staged: RollbackSlot,
+  current: RollbackSlot
+): readonly RollbackSlot[] | null {
+  if (!Array.isArray(original) && !Array.isArray(staged) && !Array.isArray(current)) {
+    return null
+  }
+  const before = identifiedRows(original)
+  const written = identifiedRows(staged)
+  const latest = identifiedRows(current)
+  if (!before || !written || !latest) {
+    return null
+  }
+  const beforeById = new Map(before.map((row) => [row.id, row]))
+  const writtenById = new Map(written.map((row) => [row.id, row]))
+  const latestById = new Map(latest.map((row) => [row.id, row]))
+  const restored = new Map<string, RollbackSlot>()
+  for (const id of new Set([...beforeById.keys(), ...writtenById.keys(), ...latestById.keys()])) {
+    const value = rollbackValue(
+      beforeById.get(id) ?? MISSING,
+      writtenById.get(id) ?? MISSING,
+      latestById.get(id) ?? MISSING
+    )
+    if (value !== MISSING) {
+      restored.set(id, value)
+    }
+  }
+  const order = latest.map((row) => row.id).filter((id) => restored.has(id))
+  for (const [index, row] of before.entries()) {
+    if (restored.has(row.id) && !order.includes(row.id)) {
+      order.splice(Math.min(index, order.length), 0, row.id)
+    }
+  }
+  return order.map((id) => restored.get(id))
+}
+
+function rollbackValue(
+  original: RollbackSlot,
+  staged: RollbackSlot,
+  current: RollbackSlot
+): RollbackSlot {
+  if (isDeepStrictEqual(original, staged)) {
+    return current
+  }
+  if (isDeepStrictEqual(current, staged)) {
+    return original
+  }
+  // Terminal and unified tab rows have stable ids; unrelated row edits must survive rollback.
+  const rows = rollbackIdentifiedRows(original, staged, current)
+  if (rows) {
+    return rows
+  }
+  if (!isRecord(original) || !isRecord(staged) || !isRecord(current)) {
+    return current
+  }
+  let changed = false
+  const next: Record<string, RollbackSlot> = { ...current }
+  for (const key of new Set([
+    ...Object.keys(original),
+    ...Object.keys(staged),
+    ...Object.keys(current)
+  ])) {
+    const value = rollbackValue(
+      Object.hasOwn(original, key) ? original[key] : MISSING,
+      Object.hasOwn(staged, key) ? staged[key] : MISSING,
+      Object.hasOwn(current, key) ? current[key] : MISSING
+    )
+    if (value === MISSING) {
+      if (Object.hasOwn(next, key)) {
+        delete next[key]
+        changed = true
+      }
+    } else if (!Object.hasOwn(current, key) || !isDeepStrictEqual(current[key], value)) {
+      next[key] = value
+      changed = true
+    }
+  }
+  return changed ? next : current
+}
+
+export function rollbackWorkspaceSessionAfterFailedAsyncWrite(
+  original: WorkspaceSessionState,
+  staged: WorkspaceSessionState,
+  current: WorkspaceSessionState
+): WorkspaceSessionState {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Each restored field retains a value from the same field of a typed session.
+  return rollbackValue(original, staged, current) as WorkspaceSessionState
+}
diff --git a/src/main/persistence/runtime-authored-workspace-session-fields.ts b/src/main/persistence/runtime-authored-workspace-session-fields.ts
index e87b47cd535..80a9d30b532 100644
--- a/src/main/persistence/runtime-authored-workspace-session-fields.ts
+++ b/src/main/persistence/runtime-authored-workspace-session-fields.ts
@@ -4,9 +4,9 @@ import type { WorkspaceSessionState } from '../../shared/workspace-session-state
  * Keeps session fields the renderer persist snapshot does not author across a full write.
  *
  * A session write replaces the stored object. Zustand-built payloads omit runtime-owned
- * client-hosted pages, and they omit-when-empty the write-once default-terminal-tab marker.
- * Without this, those slices vanish on the next desktop write and only show up missing after
- * restart.
+ * client-hosted pages and terminal close records, and they omit-when-empty the write-once
+ * default-terminal-tab marker. Without this, those slices vanish on the next desktop write and
+ * only show up missing after restart.
  *
  * Callers do not opt in: the Store applies this inside setLocalWorkspaceSession and
  * setHostWorkspaceSession, so the before-unload stage path inherits it too.
@@ -44,6 +44,16 @@ export function preserveRuntimeAuthoredWorkspaceSessionFields(
       clientHostedBrowserPagesByWorktree: prior.clientHostedBrowserPagesByWorktree
     }
   }
+  // Why: close records are main's alone (its close transaction); a renderer save never carries them.
+  if (
+    next.closedTerminalTabTombstonesByTabId === undefined &&
+    prior?.closedTerminalTabTombstonesByTabId !== undefined
+  ) {
+    result = {
+      ...result,
+      closedTerminalTabTombstonesByTabId: prior.closedTerminalTabTombstonesByTabId
+    }
+  }
   // Why union: persist snapshots omit this write-once map (empty Zustand slice, omit-when-empty
   // payload). Treating omission as "never applied" re-spawns default terminals on every attach.
   return unionWriteOnceDefaultTerminalTabsApplied(result, prior)
diff --git a/src/main/persistence/scheduling-automations/automation-definition-operations.ts b/src/main/persistence/scheduling-automations/automation-definition-operations.ts
index c25315e4986..1192b7aaf39 100644
--- a/src/main/persistence/scheduling-automations/automation-definition-operations.ts
+++ b/src/main/persistence/scheduling-automations/automation-definition-operations.ts
@@ -3,6 +3,7 @@ import { invalidateLocalWorktreeMetadataPruneInputs } from '../../local-worktree
 import type {
   Automation,
   AutomationCreateInput,
+  AutomationRun,
   AutomationUpdateInput
 } from '../../../shared/automations-types'
 import type { PersistedState } from '../../../shared/persisted-state-types'
@@ -38,6 +39,7 @@ export type AutomationDefinitionOperations = {
   storageAuthority: AutomationStorageAuthority
   flush: () => void
   recordCreated: () => void
+  recordAutomationRunsMutation?: (runs: readonly AutomationRun[]) => void
 }
 
 export function listAutomations(state: PersistedState): Automation[] {
@@ -263,6 +265,7 @@ export function deleteAutomation(
   operations.state.automationRuns = (operations.state.automationRuns ?? []).filter(
     (entry) => entry.automationId !== id
   )
+  operations.recordAutomationRunsMutation?.(operations.state.automationRuns)
   // Why: the automation and its unfinished runs were pinning their workspace; both are gone (#17775).
   invalidateLocalWorktreeMetadataPruneInputs()
   operations.flush()
diff --git a/src/main/persistence/scheduling-automations/automation-run-operations.ts b/src/main/persistence/scheduling-automations/automation-run-operations.ts
index 0dc9e61731a..7415fd12cf1 100644
--- a/src/main/persistence/scheduling-automations/automation-run-operations.ts
+++ b/src/main/persistence/scheduling-automations/automation-run-operations.ts
@@ -28,6 +28,7 @@ import {
 export type AutomationRunOperations = {
   state: PersistedState
   flush: () => void
+  recordAutomationRunsMutation?: (runs: readonly AutomationRun[]) => void
   recordManualRun: () => void
   getWorkspaceDisplayName: (workspaceId: string | null | undefined) => string | null
 }
@@ -110,6 +111,7 @@ export function createAutomationRun(
     ...(operations.state.automationRuns ?? []),
     run
   ])
+  operations.recordAutomationRunsMutation?.(operations.state.automationRuns ?? [])
   if (trigger === 'manual') {
     operations.recordManualRun()
   }
@@ -149,6 +151,7 @@ export function recordRepeatedAutomationSkip(
   }
   // Replaced, not patched in place: the list projection caches on array identity.
   operations.state.automationRuns = runs.map((run) => (run.id === latest.id ? updated : run))
+  operations.recordAutomationRunsMutation?.(operations.state.automationRuns)
   touchAutomation(operations.state, automationId, now)
   operations.flush()
   return updated
@@ -202,6 +205,7 @@ export function updateAutomationRun(
   operations.state.automationRuns = operations.state.automationRuns.map((run) =>
     run.id === result.runId ? updated : run
   )
+  operations.recordAutomationRunsMutation?.(operations.state.automationRuns)
   if (!isFinalAutomationRunStatus(current.status) && isFinalAutomationRunStatus(updated.status)) {
     // Why: only a non-final run pins its workspace, so finishing releases the claim (#17775).
     invalidateLocalWorktreeMetadataPruneInputs()
@@ -229,6 +233,7 @@ export function snapshotAutomationRunWorkspaceDisplayName(
     return { ...run, workspaceDisplayName: normalizedDisplayName }
   })
   if (updatedCount > 0) {
+    operations.recordAutomationRunsMutation?.(operations.state.automationRuns ?? [])
     operations.flush()
   }
   return updatedCount
diff --git a/src/main/persistence/tracking-repos/deregistered-repo-residue.ts b/src/main/persistence/tracking-repos/deregistered-repo-residue.ts
index cf97adc11ae..e26d43c6cc7 100644
--- a/src/main/persistence/tracking-repos/deregistered-repo-residue.ts
+++ b/src/main/persistence/tracking-repos/deregistered-repo-residue.ts
@@ -142,6 +142,9 @@ export function collectDeregisteredRepoIds(state: PersistedState): Set<string> {
     for (const tombstone of Object.values(session.terminalSurfaceTombstonesByPaneKey ?? {})) {
       addWorktreeId(tombstone.worktreeId)
     }
+    for (const record of Object.values(session.closedTerminalTabTombstonesByTabId ?? {})) {
+      addWorktreeId(record.worktreeId)
+    }
   }
   return orphanRepoIds
 }
diff --git a/src/main/persistence/tracking-repos/repo-update-host-guard.test.ts b/src/main/persistence/tracking-repos/repo-update-host-guard.test.ts
new file mode 100644
index 00000000000..101cbc2e2b2
--- /dev/null
+++ b/src/main/persistence/tracking-repos/repo-update-host-guard.test.ts
@@ -0,0 +1,98 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Repo } from '../../../shared/repo-types'
+import { RepoUpdatePersistenceOperations } from './repo-update-operations'
+
+function makeRepo(overrides: Partial<Repo> & Pick<Repo, 'id'>): Repo {
+  return {
+    path: '/repos/example',
+    displayName: 'Example',
+    badgeColor: '#000000',
+    addedAt: 0,
+    kind: 'git',
+    ...overrides
+  }
+}
+
+function makeOperations(repos: Repo[]) {
+  const state = { repos, projectGroups: [] }
+  const scheduleSave = vi.fn()
+  const operations = new RepoUpdatePersistenceOperations({
+    state,
+    bumpLocalWorktreeScanGeneration: vi.fn(),
+    syncProjectHostSetupCompatibilityState: vi.fn(),
+    scheduleSave,
+    hydrateRepo: (repo) => repo
+  })
+  return { operations, scheduleSave, state }
+}
+
+describe('updateRepo host guard', () => {
+  let errors: string[]
+
+  beforeEach(() => {
+    errors = []
+    vi.spyOn(console, 'error').mockImplementation((...args: unknown[]) => {
+      errors.push(args.map(String).join(' '))
+    })
+  })
+
+  it('reports a host mismatch instead of returning the same silent null as a missing row', () => {
+    // #22421's exact shape: the row exists under `runtime:env-1`, the caller addressed the probe host.
+    const { operations, scheduleSave } = makeOperations([
+      makeRepo({ id: 'repo-1', executionHostId: 'runtime:env-1' })
+    ])
+
+    const result = operations.updateRepo('repo-1', { displayName: 'Renamed' }, 'local')
+
+    expect(result).toBeNull()
+    expect(scheduleSave).not.toHaveBeenCalled()
+    expect(errors).toHaveLength(1)
+    expect(errors[0]).toContain('repo-1')
+    expect(errors[0]).toContain('requested host local')
+    expect(errors[0]).toContain('runtime:env-1')
+  })
+
+  it('stays silent when the row genuinely does not exist', () => {
+    const { operations } = makeOperations([
+      makeRepo({ id: 'repo-1', executionHostId: 'runtime:env-1' })
+    ])
+
+    expect(operations.updateRepo('repo-missing', { displayName: 'Renamed' }, 'local')).toBeNull()
+    expect(errors).toEqual([])
+  })
+
+  it('writes when the host argument matches the row stamp', () => {
+    const { operations, scheduleSave, state } = makeOperations([
+      makeRepo({ id: 'repo-1', executionHostId: 'runtime:env-1' })
+    ])
+
+    const result = operations.updateRepo('repo-1', { displayName: 'Renamed' }, 'runtime:env-1')
+
+    expect(result?.displayName).toBe('Renamed')
+    expect(state.repos[0].displayName).toBe('Renamed')
+    expect(scheduleSave).toHaveBeenCalledTimes(1)
+    expect(errors).toEqual([])
+  })
+
+  it('still refuses a cross-host write when both hosts hold a row with the same id', () => {
+    const local = makeRepo({ id: 'repo-1', displayName: 'Local', executionHostId: 'local' })
+    const peer = makeRepo({ id: 'repo-1', displayName: 'Peer', executionHostId: 'ssh:peer' })
+    const { operations, state } = makeOperations([local, peer])
+
+    const result = operations.updateRepo('repo-1', { displayName: 'Local edit' }, 'local')
+
+    expect(result?.displayName).toBe('Local edit')
+    // The peer's row is untouched: a client-local write must never repair another host's metadata.
+    expect(state.repos[1].displayName).toBe('Peer')
+  })
+
+  it('writes without a host argument exactly as before', () => {
+    const { operations, state } = makeOperations([
+      makeRepo({ id: 'repo-1', executionHostId: 'runtime:env-1' })
+    ])
+
+    expect(operations.updateRepo('repo-1', { displayName: 'Renamed' })?.displayName).toBe('Renamed')
+    expect(state.repos[0].displayName).toBe('Renamed')
+    expect(errors).toEqual([])
+  })
+})
diff --git a/src/main/persistence/tracking-repos/repo-update-operations.ts b/src/main/persistence/tracking-repos/repo-update-operations.ts
index 399d05ac653..79444a32a19 100644
--- a/src/main/persistence/tracking-repos/repo-update-operations.ts
+++ b/src/main/persistence/tracking-repos/repo-update-operations.ts
@@ -10,17 +10,50 @@ import { invalidateGhAccountTokenCache } from '../../github/gh-account-token'
 import { sanitizeRepoUpdatesForPersistence } from './repo-sanitization'
 
 export type RepoUpdateMutationOperations = {
-  state: PersistedState
+  state: Pick<PersistedState, 'repos' | 'projectGroups'>
   bumpLocalWorktreeScanGeneration: (repoId: string) => void
   syncProjectHostSetupCompatibilityState: () => void
   scheduleSave: () => void
   hydrateRepo: (repo: Repo) => Repo
 }
 
+/**
+ * Resolve the row a host-scoped write may touch, and report the one failure the `Repo | null` return
+ * cannot express: the row exists, but under a different host stamp.
+ *
+ * `hostId` is the row's own `executionHostId`, never the host a caller probed or a user selected. A
+ * caller that passes anything else gets the same `null` as a deleted row, so its write is discarded
+ * with no error and no failing test — how #22421 shipped an enrichment pass that never persisted.
+ */
+export function findRepoRowForHostScopedWrite(
+  repos: readonly Repo[],
+  id: string,
+  hostId: ExecutionHostId | undefined
+): Repo | undefined {
+  if (!hostId) {
+    return repos.find((candidate) => candidate.id === id)
+  }
+  const matched = repos.find(
+    (candidate) => candidate.id === id && getRepoExecutionHostId(candidate) === hostId
+  )
+  if (matched) {
+    return matched
+  }
+  const storedHostIds = repos
+    .filter((candidate) => candidate.id === id)
+    .map((candidate) => getRepoExecutionHostId(candidate))
+  if (storedHostIds.length > 0) {
+    console.error(
+      `[persistence] Discarded a repo update for ${id}: requested host ${hostId}, but the row is stored on ${storedHostIds.join(', ')}. Address updateRepo by the row's own executionHostId stamp.`
+    )
+  }
+  return undefined
+}
+
 export class RepoUpdatePersistenceOperations {
   constructor(private readonly operations: RepoUpdateMutationOperations) {}
 
-  private get state(): PersistedState {
+  private get state(): Pick<PersistedState, 'repos' | 'projectGroups'> {
     return this.operations.state
   }
 
@@ -77,10 +110,7 @@ export class RepoUpdatePersistenceOperations {
     },
     hostId?: ExecutionHostId
   ): Repo | null {
-    const repo = this.state.repos.find(
-      (candidate) =>
-        candidate.id === id && (!hostId || getRepoExecutionHostId(candidate) === hostId)
-    )
+    const repo = findRepoRowForHostScopedWrite(this.state.repos, id, hostId)
     if (!repo) {
       return null
     }
diff --git a/src/main/persistence/tracking-repos/repo-worktree-pruning.ts b/src/main/persistence/tracking-repos/repo-worktree-pruning.ts
index a41f7c6319d..2382cb6a371 100644
--- a/src/main/persistence/tracking-repos/repo-worktree-pruning.ts
+++ b/src/main/persistence/tracking-repos/repo-worktree-pruning.ts
@@ -74,6 +74,11 @@ export function pruneWorktreeStateForRepo(
         (tombstone) => tombstone.worktreeId
       )
     )
+    collectPrefixedKeys(
+      Object.values(session?.closedTerminalTabTombstonesByTabId ?? {}).map(
+        (record) => record.worktreeId
+      )
+    )
   }
   collectPrefixedKeys(Object.keys(state.worktreeMeta))
   collectScannedRecordOwners(state.workspaceSession)
diff --git a/src/main/persistence/tracking-repos/worktree-identity-migration.ts b/src/main/persistence/tracking-repos/worktree-identity-migration.ts
index 31b318b3143..2bc7fa95e6f 100644
--- a/src/main/persistence/tracking-repos/worktree-identity-migration.ts
+++ b/src/main/persistence/tracking-repos/worktree-identity-migration.ts
@@ -330,6 +330,9 @@ export function migrateWorktreeIdentity(
   )) {
     changed = moveKey(selectionsByWorktree) || changed
   }
+  if (state.ui?.explorerDisplayRootByWorktree) {
+    changed = moveKey(state.ui.explorerDisplayRootByWorktree) || changed
+  }
   const showDotfiles = state.ui?.showDotfilesByWorktree
   if (showDotfiles) {
     changed = moveKey(showDotfiles) || changed
diff --git a/src/main/pi/agent-status-extension-source.ts b/src/main/pi/agent-status-extension-source.ts
index bdf9061779c..58a18b78fa5 100644
--- a/src/main/pi/agent-status-extension-source.ts
+++ b/src/main/pi/agent-status-extension-source.ts
@@ -46,7 +46,7 @@ export function getPiAgentStatusExtensionSource(kind: PiAgentKind = 'pi'): strin
           '  const sessionFile = sessionManager?.getSessionFile?.()',
           "  runtimeOmpSessionMetadata = typeof sessionId === 'string' && sessionId && typeof sessionFile === 'string' && sessionFile ? { session_id: sessionId, session_file: sessionFile } : {}",
           '  trackModelSession(runtimeOmpSessionMetadata.session_id)',
-          '  updateModelMetadata(ctx)', 
+          '  updateModelMetadata(ctx)',
           '}',
           '',
           'function getPostSessionMetadata(ompRuntime: boolean): Record<string, unknown> {',
@@ -75,7 +75,7 @@ export function getPiAgentStatusExtensionSource(kind: PiAgentKind = 'pi'): strin
           '  const sessionId = sessionManager?.getSessionId?.()',
           '  const sessionFile = sessionManager?.getSessionFile?.()',
           "  sessionMetadata = typeof sessionId === 'string' && sessionId && typeof sessionFile === 'string' && sessionFile ? { session_id: sessionId, session_file: sessionFile } : {}",
-          '  trackModelSession(sessionMetadata.session_id)', 
+          '  trackModelSession(sessionMetadata.session_id)',
           '}',
           '',
           'function updateRuntimeOmpSessionMetadata(ctx: unknown): void {',
diff --git a/src/main/pi/titlebar-extension-service.test.ts b/src/main/pi/titlebar-extension-service.test.ts
index 1240d1859a8..bc259e893a9 100644
--- a/src/main/pi/titlebar-extension-service.test.ts
+++ b/src/main/pi/titlebar-extension-service.test.ts
@@ -156,9 +156,14 @@ describe('PiTitlebarExtensionService', () => {
     homedirOverride.current = fakeHome
     vi.stubEnv('PI_CONFIG_DIR', 'host-profile')
     try {
-      const env = new PiTitlebarExtensionService().buildPtyEnv('pty-ambient-root', undefined, 'omp', {
-        materializeDefaultHome: true
-      })
+      const env = new PiTitlebarExtensionService().buildPtyEnv(
+        'pty-ambient-root',
+        undefined,
+        'omp',
+        {
+          materializeDefaultHome: true
+        }
+      )
       expect(env.ORCA_OMP_SOURCE_AGENT_DIR).toBe(join(fakeHome, '.omp', 'agent'))
       expect(existsSync(join(fakeHome, 'host-profile'))).toBe(false)
     } finally {
@@ -272,7 +277,6 @@ describe('PiTitlebarExtensionService', () => {
     const env = svc.buildPtyEnv('pty-omp-sqlite', piHome, 'omp')
 
     const sourcePath = join(piHome, 'agent.db')
-    const content = 'agent.db credentials'
 
     expect(env.PI_CODING_AGENT_DIR).toBeUndefined()
     expect(readFileSync(env.ORCA_OMP_FRESH_CONFIG, 'utf8')).toBe('autoResume: false\n')
@@ -282,9 +286,6 @@ describe('PiTitlebarExtensionService', () => {
     expect(existsSync(sourcePath)).toBe(false)
     expect(existsSync(join(userDataDir, 'omp-agent-overlays'))).toBe(false)
     expect(existsSync(join(piHome, 'history.db'))).toBe(false)
-    writeFileSync(sourcePath, content)
-
-    expect(readFileSync(sourcePath, 'utf-8')).toBe(content)
   })
 
   it('migrates missing OMP state from the old source overlay without overwriting source files', () => {
diff --git a/src/main/pi/titlebar-extension-service.ts b/src/main/pi/titlebar-extension-service.ts
index 64a021603f7..4b698c02f09 100644
--- a/src/main/pi/titlebar-extension-service.ts
+++ b/src/main/pi/titlebar-extension-service.ts
@@ -191,8 +191,7 @@ export class PiTitlebarExtensionService {
   ): Record<string, string> {
     const freshConfigEnv = kind === 'omp' ? this.buildFreshOmpEnv() : {}
     // The caller resolves the effective launch environment before this point.
-    const sourceAgentDir =
-      existingAgentDir || getDefaultPiAgentDir(kind, options?.configDirName)
+    const sourceAgentDir = existingAgentDir || getDefaultPiAgentDir(kind, options?.configDirName)
     if (kind !== 'prime-agent') {
       try {
         this.safeRemoveOverlay(this.getPtyOverlayDir(ptyId, kind), kind)
diff --git a/src/main/plugins/plugin-host-methods.test.ts b/src/main/plugins/plugin-host-methods.test.ts
index ee6e7a5b9d0..7f196c9eb81 100644
--- a/src/main/plugins/plugin-host-methods.test.ts
+++ b/src/main/plugins/plugin-host-methods.test.ts
@@ -194,10 +194,14 @@ describe('terminal.sendText explicit worktree routing', () => {
         { includeVisualLayouts: false }
       )
       expect(delegate.sendTerminal).toHaveBeenCalledTimes(1)
-      expect(delegate.sendTerminal).toHaveBeenCalledWith(terminalId, {
-        text: 'echo hi',
-        enter: true
-      })
+      expect(delegate.sendTerminal).toHaveBeenCalledWith(
+        terminalId,
+        {
+          text: 'echo hi',
+          enter: true
+        },
+        { inputKind: 'driving' }
+      )
       expect(vi.mocked(delegate.listTerminals).mock.invocationCallOrder[0]!).toBeLessThan(
         vi.mocked(delegate.sendTerminal).mock.invocationCallOrder[0]!
       )
diff --git a/src/main/plugins/plugin-host-service-bindings.ts b/src/main/plugins/plugin-host-service-bindings.ts
index 266b819dbae..731934d5595 100644
--- a/src/main/plugins/plugin-host-service-bindings.ts
+++ b/src/main/plugins/plugin-host-service-bindings.ts
@@ -3,6 +3,7 @@ import { PLUGIN_WORKSPACE_TERMINAL_LIMIT } from '../../shared/plugins/plugin-hos
 import type { PluginHostServices } from './plugin-host-methods'
 import { PluginSecretsStore } from './plugin-secrets-store'
 import { PluginKvStore } from './plugin-storage-store'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 
 /** Structural subset of OrcaRuntimeService exposed to plugin facade bindings. */
 export type PluginRuntimeDelegate = {
@@ -19,7 +20,8 @@ export type PluginRuntimeDelegate = {
   ): Promise<{ terminals: { handle: string; title: string | null }[] }>
   sendTerminal(
     handle: string,
-    action: { text?: string; enter?: boolean }
+    action: { text?: string; enter?: boolean },
+    options: { inputKind: TerminalInputKind }
   ): Promise<{ accepted: boolean }>
   dispatchPluginNotification(input: {
     pluginId: string
@@ -59,7 +61,7 @@ export function bindPluginHostServices(input: {
         .map((terminal) => ({ id: terminal.handle }))
     },
     sendTerminalText: async (terminalId, action) => {
-      const result = await delegate.sendTerminal(terminalId, action)
+      const result = await delegate.sendTerminal(terminalId, action, { inputKind: 'driving' })
       return { accepted: result.accepted }
     },
     dispatchPluginNotification: (notification) => delegate.dispatchPluginNotification(notification),
diff --git a/src/main/ports/port-scan-command-client.test.ts b/src/main/ports/port-scan-command-client.test.ts
index 37e8451a4da..d79fe80fbbd 100644
--- a/src/main/ports/port-scan-command-client.test.ts
+++ b/src/main/ports/port-scan-command-client.test.ts
@@ -1,4 +1,3 @@
-import { readFileSync } from 'node:fs'
 import { join, sep } from 'node:path'
 import { Worker } from 'node:worker_threads'
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -244,17 +243,6 @@ describe('resolveWorkerEntryPath', () => {
     expect(resolved).toBe(join(moduleDir, WORKER_ENTRY_FILENAME))
     expect(resolved).not.toContain('app.asar')
   })
-
-  // A rename in the build config would leave both branches pointing at a file
-  // that is never emitted, and only the packaged one fails silently.
-  it('names the entry the main build actually emits', () => {
-    const config = readFileSync(
-      join(import.meta.dirname, '..', '..', '..', 'electron.vite.config.ts'),
-      'utf8'
-    )
-
-    expect(config).toContain("'port-scan-command-worker-entry': resolve(")
-  })
 })
 
 const REAL_WORKER_BLOCK_MS = 800
diff --git a/src/main/ports/port-scan-command-import-boundary.test.ts b/src/main/ports/port-scan-command-import-boundary.test.ts
deleted file mode 100644
index bd9b9d05fb8..00000000000
--- a/src/main/ports/port-scan-command-import-boundary.test.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-// Why (#11161): libuv runs process creation inline on the calling event loop,
-// so the port scan only stays off CrBrowserMain while these main-thread modules
-// spawn nothing themselves. Spawning belongs to port-scan-command-execution.ts,
-// which only the worker entry imports.
-const MAIN_THREAD_MODULES = ['local-workspace-port-scanner.ts', 'port-scan-command-client.ts']
-
-describe('port scan main-thread spawn boundary', () => {
-  it.each(MAIN_THREAD_MODULES)('keeps %s free of child_process', (fileName) => {
-    const source = readFileSync(join(import.meta.dirname, fileName), 'utf8')
-
-    expect(source).not.toMatch(/from\s+['"](node:)?child_process['"]/)
-    expect(source).not.toMatch(/require\(\s*['"](node:)?child_process['"]\s*\)/)
-  })
-})
diff --git a/src/main/preflight/freebuff-remote-detection.test.ts b/src/main/preflight/freebuff-remote-detection.test.ts
new file mode 100644
index 00000000000..de8408da088
--- /dev/null
+++ b/src/main/preflight/freebuff-remote-detection.test.ts
@@ -0,0 +1,31 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+const { getActiveMultiplexerMock } = vi.hoisted(() => ({
+  getActiveMultiplexerMock: vi.fn()
+}))
+
+vi.mock('../ssh/ssh-target-registry', () => ({
+  getActiveMultiplexer: getActiveMultiplexerMock
+}))
+
+import { detectRemoteAgents } from './agent-detection'
+
+afterEach(() => vi.resetAllMocks())
+
+describe('Freebuff SSH detection', () => {
+  it('asks the execution host to detect Freebuff separately from Codebuff', async () => {
+    const request = vi.fn().mockResolvedValue({ agents: ['freebuff'] })
+    getActiveMultiplexerMock.mockReturnValue({ isDisposed: () => false, request })
+
+    await expect(detectRemoteAgents({ connectionId: 'ssh-freebuff' })).resolves.toEqual([
+      'freebuff'
+    ])
+    expect(getActiveMultiplexerMock).toHaveBeenCalledWith('ssh-freebuff')
+    expect(request).toHaveBeenCalledWith('preflight.detectAgents', {
+      commands: expect.arrayContaining([
+        { id: 'freebuff', cmd: 'freebuff' },
+        { id: 'codebuff', cmd: 'codebuff' }
+      ])
+    })
+  })
+})
diff --git a/src/main/project-groups/nested-repo-glob-budget.test.ts b/src/main/project-groups/nested-repo-glob-budget.test.ts
new file mode 100644
index 00000000000..41b051a0134
--- /dev/null
+++ b/src/main/project-groups/nested-repo-glob-budget.test.ts
@@ -0,0 +1,193 @@
+import { describe, expect, it } from 'vitest'
+import {
+  isIgnoredNestedRepoDirectory,
+  readNestedRepoGitignoreRules,
+  readNestedRepoGlobMatchSteps
+} from './nested-repo-scan-rules'
+
+async function readRules(content: string) {
+  return readNestedRepoGitignoreRules({
+    folderPath: '/synthetic',
+    entries: [{ name: '.gitignore', isDirectory: false }],
+    baseSegments: [],
+    filesystem: {
+      readDirectory: async () => [],
+      readTextFile: async () => content,
+      joinPath: (parent, child) => `${parent}/${child}`,
+      basename: (path) => path,
+      hasGitMarker: () => false,
+      isSelectedPathGitRepo: () => false
+    }
+  })
+}
+
+function strings(alphabet: string[], maxLength: number): string[] {
+  const result = ['']
+  let layer = ['']
+  for (let length = 1; length <= maxLength; length++) {
+    layer = layer.flatMap((prefix) => alphabet.map((character) => prefix + character))
+    result.push(...layer)
+  }
+  return result
+}
+
+function segmentLists(alphabet: string[], maxLength: number): string[][] {
+  const result: string[][] = []
+  let layer: string[][] = [[]]
+  for (let length = 1; length <= maxLength; length++) {
+    layer = layer.flatMap((prefix) => alphabet.map((token) => [...prefix, token]))
+    result.push(...layer)
+  }
+  return result
+}
+
+// Pre-change oracle: a regular expression per wildcard segment, plus an unmemoized `**` walk over
+// uncollapsed segments. Differential cases hold the shipped matcher to exactly this behaviour.
+function referenceSegment(pattern: string): string | RegExp {
+  if (!pattern.includes('*') && !pattern.includes('?')) {
+    return pattern
+  }
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&')
+  return new RegExp(`^${escaped.replace(/\*/g, '[^/]*').replace(/\?/g, '[^/]')}$`)
+}
+
+function referenceSegmentMatches(pattern: string | RegExp, value: string): boolean {
+  return typeof pattern === 'string' ? pattern === value : pattern.test(value)
+}
+
+function referenceIgnored(line: string, candidateSegments: string[]): boolean {
+  const anchored = line.startsWith('/')
+  const pattern = line.replace(/^\/+/, '').replace(/\/+$/, '')
+  if (!anchored && !pattern.includes('/')) {
+    const segment = referenceSegment(pattern)
+    return candidateSegments.some((candidate) => referenceSegmentMatches(segment, candidate))
+  }
+  const patternSegments = pattern
+    .split('/')
+    .map((segment) => (segment === '**' ? segment : referenceSegment(segment)))
+  const matchFrom = (patternIndex: number, candidateIndex: number): boolean => {
+    if (patternIndex >= patternSegments.length) {
+      return candidateIndex >= candidateSegments.length
+    }
+    const segment = patternSegments[patternIndex]
+    if (segment === '**') {
+      return (
+        matchFrom(patternIndex + 1, candidateIndex) ||
+        (candidateIndex < candidateSegments.length && matchFrom(patternIndex, candidateIndex + 1))
+      )
+    }
+    return (
+      candidateIndex < candidateSegments.length &&
+      referenceSegmentMatches(segment, candidateSegments[candidateIndex] ?? '') &&
+      matchFrom(patternIndex + 1, candidateIndex + 1)
+    )
+  }
+  return matchFrom(0, 0)
+}
+
+function stepsSpentOn(run: () => void): number {
+  const before = readNestedRepoGlobMatchSteps()
+  run()
+  return readNestedRepoGlobMatchSteps() - before
+}
+
+describe('nested repository wildcard work budget', () => {
+  it('bounds wildcard segment work for fifty adverse names', async () => {
+    const rules = await readRules(`${'*a'.repeat(12)}b`)
+    const name = `${'a'.repeat(24)}c`
+    let ignored = 0
+    const steps = stepsSpentOn(() => {
+      for (let index = 0; index < 50; index++) {
+        ignored += Number(isIgnoredNestedRepoDirectory(name, [name], rules))
+      }
+    })
+    expect(ignored).toBe(0)
+    // O(pattern length x name length) per name, ~51 steps in practice; the pre-change expression
+    // revisited earlier stars and needed ~25 ms for each of these names.
+    expect(steps).toBeLessThan(50 * 100)
+  })
+
+  it('bounds ** path work for a long run of double stars', async () => {
+    const rules = await readRules(`${'**/'.repeat(24)}z`)
+    const candidate = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h']
+    let ignored = true
+    // Parse-time collapse of the `**` run; uncollapsed this shape cost ~49M recursive calls.
+    const steps = stepsSpentOn(() => {
+      ignored = isIgnoredNestedRepoDirectory('h', candidate, rules)
+    })
+    expect(ignored).toBe(false)
+    expect(steps).toBeLessThan(100)
+  })
+
+  it('bounds ** path work when non-collapsible segments separate the double stars', async () => {
+    const rules = await readRules(Array.from({ length: 12 }, () => '**/*').join('/'))
+    const candidate = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h']
+    let ignored = true
+    // Memoization; without it this shape revisits pairs and costs over a thousand calls.
+    const steps = stepsSpentOn(() => {
+      ignored = isIgnoredNestedRepoDirectory('h', candidate, rules)
+    })
+    expect(ignored).toBe(false)
+    expect(steps).toBeLessThan(400)
+  })
+
+  it('accepts exactly the same paths for a collapsed and an expanded ** run', async () => {
+    const collapsed = await readRules('**/x')
+    const expanded = await readRules('**/**/**/x')
+    for (const candidate of segmentLists(['a', 'x'], 4)) {
+      const name = candidate.at(-1) ?? ''
+      const label = candidate.join('/')
+      const expectedMatch = referenceIgnored('**/x', candidate)
+      expect(isIgnoredNestedRepoDirectory(name, candidate, collapsed), label).toBe(expectedMatch)
+      expect(isIgnoredNestedRepoDirectory(name, candidate, expanded), label).toBe(expectedMatch)
+      expect(referenceIgnored('**/**/**/x', candidate), label).toBe(expectedMatch)
+    }
+  })
+
+  it('preserves wildcard results for every short pattern and name', async () => {
+    const names = strings(['a', 'b', '?'], 4)
+    for (const pattern of strings(['a', 'b', '*', '?'], 4).slice(1)) {
+      const rules = await readRules(pattern)
+      for (const name of names) {
+        expect(isIgnoredNestedRepoDirectory(name, [name], rules), `${pattern} / ${name}`).toBe(
+          referenceIgnored(pattern, [name])
+        )
+      }
+    }
+  })
+
+  it('preserves path results for every short multi-segment pattern and candidate path', async () => {
+    const candidates = segmentLists(['a', 'b', 'ab'], 3)
+    for (const patternSegments of segmentLists(['a', 'b', '*', '?', '**'], 3)) {
+      const joined = patternSegments.join('/')
+      // The leading slash anchors the rule, which is the non-basenameOnly path even at one segment.
+      for (const line of [joined, `/${joined}`]) {
+        const rules = await readRules(line)
+        for (const candidate of candidates) {
+          expect(
+            isIgnoredNestedRepoDirectory(candidate.at(-1) ?? '', candidate, rules),
+            `${line} / ${candidate.join('/')}`
+          ).toBe(referenceIgnored(line, candidate))
+        }
+      }
+    }
+  })
+
+  it.each([
+    ['[literal]+.*', '[literal]+.suffix', true],
+    ['[literal]+.*', 'literal-suffix', false],
+    ['a\\*', 'a\\suffix', true],
+    ['*', 'a/b', false],
+    ['a?', 'a\n', true],
+    ['a?b', 'a\nb', true],
+    ['a*b', 'ab\n', false],
+    ['?', '😀', false],
+    ['??', '😀', true],
+    ['*😀?', 'x😀a', true],
+    ['*?*a*', 'ba', true],
+    ['**b**', 'abca', true]
+  ])('preserves literal and code-unit matching for %s / %s', async (pattern, name, expected) => {
+    const rules = await readRules(pattern)
+    expect(isIgnoredNestedRepoDirectory(name, [name], rules)).toBe(expected)
+  })
+})
diff --git a/src/main/project-groups/nested-repo-scan-rules.ts b/src/main/project-groups/nested-repo-scan-rules.ts
index 3a839917252..d38bd1f0983 100644
--- a/src/main/project-groups/nested-repo-scan-rules.ts
+++ b/src/main/project-groups/nested-repo-scan-rules.ts
@@ -17,12 +17,15 @@ export type NestedRepoScanFilesystem = {
 
 type IgnoreRule = {
   pattern: string
-  segmentPatterns: (string | RegExp)[]
+  segmentPatterns: GlobSegment[]
+  memoizePathWalk: boolean
   negate: boolean
   basenameOnly: boolean
   baseSegments: string[]
 }
 
+type GlobSegment = string | { pattern: string }
+
 export type TraversalFolder = {
   path: string
   depth: number
@@ -83,42 +86,107 @@ function shouldSkipDirectory(name: string, depth: number): boolean {
   return depth > 0 && name.startsWith('.')
 }
 
-function compileGlobSegment(pattern: string): string | RegExp {
+function compileGlobSegment(pattern: string): GlobSegment {
   if (!pattern.includes('*') && !pattern.includes('?')) {
     return pattern
   }
-  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&')
-  return new RegExp(`^${escaped.replace(/\*/g, '[^/]*').replace(/\?/g, '[^/]')}$`)
+  return { pattern }
 }
 
-function globSegmentMatches(pattern: string | RegExp, value: string): boolean {
-  return typeof pattern === 'string' ? pattern === value : pattern.test(value)
+let globMatchSteps = 0
+
+/**
+ * Monotonic count of matcher steps taken since process start.
+ *
+ * Budget tests assert on a delta so an algorithmic regression fails deterministically instead of
+ * riding on how fast the machine running the suite happens to be.
+ */
+export function readNestedRepoGlobMatchSteps(): number {
+  return globMatchSteps
+}
+
+function globSegmentMatches(segment: GlobSegment, value: string): boolean {
+  globMatchSteps++
+  if (typeof segment === 'string') {
+    return segment === value
+  }
+  const { pattern } = segment
+  let patternIndex = 0
+  let valueIndex = 0
+  let starIndex = -1
+  let starMatchIndex = 0
+  // Retry only the latest star, avoiding combinatorial regular-expression backtracking.
+  while (valueIndex < value.length) {
+    globMatchSteps++
+    const token = pattern[patternIndex]
+    if (token === '*') {
+      starIndex = patternIndex++
+      starMatchIndex = valueIndex
+    } else if (token === value[valueIndex] || (token === '?' && value[valueIndex] !== '/')) {
+      patternIndex++
+      valueIndex++
+    } else if (starIndex !== -1 && value[starMatchIndex] !== '/') {
+      patternIndex = starIndex + 1
+      valueIndex = ++starMatchIndex
+    } else {
+      return false
+    }
+  }
+  while (pattern[patternIndex] === '*') {
+    patternIndex++
+  }
+  return patternIndex === pattern.length
 }
 
 function pathSegmentsMatch(
-  patternSegments: (string | RegExp)[],
-  candidateSegments: string[]
+  patternSegments: GlobSegment[],
+  candidateSegments: string[],
+  memoize: boolean
 ): boolean {
+  const memoStride = candidateSegments.length + 1
+  // Allocating the table costs more than the walk it would save on the overwhelmingly common
+  // shapes, so only rules that can actually revisit a pair pay for it.
+  const visited = memoize ? new Map<number, boolean>() : undefined
   const matchFrom = (patternIndex: number, candidateIndex: number): boolean => {
+    globMatchSteps++
     if (patternIndex >= patternSegments.length) {
       return candidateIndex >= candidateSegments.length
     }
-    const pattern = patternSegments[patternIndex]
-    if (pattern === '**') {
-      return (
-        matchFrom(patternIndex + 1, candidateIndex) ||
-        (candidateIndex < candidateSegments.length && matchFrom(patternIndex, candidateIndex + 1))
-      )
+    const memoKey = patternIndex * memoStride + candidateIndex
+    const memoized = visited?.get(memoKey)
+    if (memoized !== undefined) {
+      return memoized
     }
-    return (
-      candidateIndex < candidateSegments.length &&
-      globSegmentMatches(pattern, candidateSegments[candidateIndex] ?? '') &&
-      matchFrom(patternIndex + 1, candidateIndex + 1)
-    )
+    const pattern = patternSegments[patternIndex]
+    const matched =
+      pattern === '**'
+        ? matchFrom(patternIndex + 1, candidateIndex) ||
+          (candidateIndex < candidateSegments.length && matchFrom(patternIndex, candidateIndex + 1))
+        : candidateIndex < candidateSegments.length &&
+          globSegmentMatches(pattern, candidateSegments[candidateIndex] ?? '') &&
+          matchFrom(patternIndex + 1, candidateIndex + 1)
+    visited?.set(memoKey, matched)
+    return matched
   }
   return matchFrom(0, 0)
 }
 
+function compilePathSegments(pattern: string): GlobSegment[] {
+  const segments: GlobSegment[] = []
+  for (const segment of pattern.split('/')) {
+    // `**` spans zero or more segments, so `**/**` accepts exactly what `**` accepts: collapsing a
+    // run keeps one adversarial line from handing the path matcher dozens of forking segments.
+    if (segment === '**') {
+      if (segments.at(-1) !== '**') {
+        segments.push(segment)
+      }
+      continue
+    }
+    segments.push(compileGlobSegment(segment))
+  }
+  return segments
+}
+
 function parseGitignoreRules(content: string, baseSegments: string[]): IgnoreRule[] {
   return content
     .split(/\r?\n/)
@@ -130,13 +198,15 @@ function parseGitignoreRules(content: string, baseSegments: string[]): IgnoreRul
       const anchored = unprefixed.startsWith('/')
       const pattern = unprefixed.replace(/^\/+/, '').replace(/\/+$/, '')
       const basenameOnly = !anchored && !pattern.includes('/')
+      const segmentPatterns = basenameOnly
+        ? [compileGlobSegment(pattern)]
+        : compilePathSegments(pattern)
       return {
         pattern,
-        segmentPatterns: basenameOnly
-          ? [compileGlobSegment(pattern)]
-          : pattern
-              .split('/')
-              .map((segment) => (segment === '**' ? segment : compileGlobSegment(segment))),
+        segmentPatterns,
+        // One `**` walks the candidate segments once; two or more reach the same (pattern,
+        // candidate) pair by many routes, which is what turns the walk exponential.
+        memoizePathWalk: segmentPatterns.filter((segment) => segment === '**').length > 1,
         negate,
         basenameOnly,
         baseSegments
@@ -158,7 +228,7 @@ export function isIgnoredNestedRepoDirectory(
     const relativeSegments = segments.slice(rule.baseSegments.length)
     const matches = rule.basenameOnly
       ? relativeSegments.some((segment) => globSegmentMatches(rule.segmentPatterns[0], segment))
-      : pathSegmentsMatch(rule.segmentPatterns, relativeSegments)
+      : pathSegmentsMatch(rule.segmentPatterns, relativeSegments, rule.memoizePathWalk)
     if (matches) {
       ignored = !rule.negate
     }
diff --git a/src/main/protected-secret-persistence-concurrency.test.ts b/src/main/protected-secret-persistence-concurrency.test.ts
new file mode 100644
index 00000000000..1b429cdaa8b
--- /dev/null
+++ b/src/main/protected-secret-persistence-concurrency.test.ts
@@ -0,0 +1,192 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { setSecretStore } from '../shared/secret-store'
+import {
+  ProtectedSecretPersistence,
+  type ProtectedSecretRetentionUpdate
+} from './protected-secret-persistence'
+
+const cipherState = { available: true, fails: false }
+const ciphertext = (plaintext: string): string =>
+  Buffer.from(`encrypted:${plaintext}`).toString('base64')
+
+function prepare(
+  secrets: ProtectedSecretPersistence,
+  slot: string,
+  plaintext: string
+): ProtectedSecretRetentionUpdate {
+  const { retentionUpdate } = secrets.encrypt(slot, plaintext)
+  if (!retentionUpdate) {
+    throw new Error('Expected a prepared retention update')
+  }
+  return retentionUpdate
+}
+
+describe('protected secret acknowledgements', () => {
+  beforeEach(() => {
+    cipherState.available = true
+    cipherState.fails = false
+    setSecretStore({
+      isEncryptionAvailable: () => cipherState.available,
+      encryptString: (plaintext) => {
+        if (cipherState.fails) {
+          throw new Error('Keyring encryption failed')
+        }
+        return Buffer.from(`encrypted:${plaintext}`)
+      },
+      decryptString: (encrypted) => encrypted.toString().slice('encrypted:'.length),
+      describeProtectionGap: () => null
+    })
+  })
+
+  afterEach(() => vi.restoreAllMocks())
+
+  it.each(['remove', 'empty encryption', 'empty decryption'])(
+    'does not revive a secret cleared by %s while its save was in flight',
+    (clear) => {
+      const secrets = new ProtectedSecretPersistence()
+      const update = prepare(secrets, 'slot', 'first')
+      if (clear === 'remove') {
+        secrets.removeRetainedBlob('slot')
+      } else if (clear === 'empty encryption') {
+        secrets.encrypt('slot', '')
+      } else {
+        secrets.decrypt('slot', '')
+      }
+
+      secrets.commitRetentionUpdates([update])
+
+      cipherState.available = false
+      expect(secrets.encrypt('slot', 'replacement').blob).toBe('')
+    }
+  )
+
+  it.each(['replacement', ''])('preserves a reloaded sealed slot after an old %j save', (value) => {
+    const secrets = new ProtectedSecretPersistence()
+    secrets.decrypt('slot', ciphertext('original'))
+    const update = prepare(secrets, 'slot', value)
+    const reloaded = ciphertext('reloaded')
+    cipherState.available = false
+    secrets.decrypt('slot', reloaded)
+
+    secrets.commitRetentionUpdates([update])
+
+    expect(secrets.isSealed('slot', reloaded)).toBe(true)
+    expect(secrets.encrypt('slot', '').blob).toBe(reloaded)
+    expect(secrets.hasPendingEncryption()).toBe(false)
+  })
+
+  it('preserves a successfully decrypted replacement after an older save acknowledges', () => {
+    const secrets = new ProtectedSecretPersistence()
+    const update = prepare(secrets, 'slot', 'first')
+    const reloaded = ciphertext('reloaded')
+    expect(secrets.decrypt('slot', reloaded)).toBe('reloaded')
+
+    secrets.commitRetentionUpdates([update])
+
+    cipherState.available = false
+    expect(secrets.encrypt('slot', 'reloaded').blob).toBe(reloaded)
+  })
+
+  it.each(['unavailable', 'throws'])(
+    'keeps a newer %s encryption pending after an old ack',
+    (failure) => {
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      const secrets = new ProtectedSecretPersistence()
+      const original = ciphertext('original')
+      secrets.decrypt('slot', original)
+      const update = prepare(secrets, 'slot', 'first')
+      cipherState.available = failure !== 'unavailable'
+      cipherState.fails = failure === 'throws'
+      expect(secrets.encrypt('slot', 'newer')).toEqual({ blob: original, degraded: true })
+
+      secrets.commitRetentionUpdates([update])
+
+      expect(secrets.hasPendingEncryption()).toBe(true)
+      cipherState.available = false
+      expect(secrets.encrypt('slot', 'newer').blob).toBe(original)
+      cipherState.available = true
+      cipherState.fails = false
+      const retry = prepare(secrets, 'slot', 'newer')
+      secrets.commitRetentionUpdates([retry])
+      expect(secrets.hasPendingEncryption()).toBe(false)
+      cipherState.available = false
+      expect(secrets.encrypt('slot', 'newer').blob).toBe(ciphertext('newer'))
+    }
+  )
+
+  it.each([false, true])(
+    'retains only the latest prepared ciphertext, reverse ack order: %s',
+    (reverse) => {
+      const secrets = new ProtectedSecretPersistence()
+      const older = prepare(secrets, 'slot', 'older')
+      const newer = prepare(secrets, 'slot', 'newer')
+      for (const update of reverse ? [newer, older] : [older, newer]) {
+        secrets.commitRetentionUpdates([update])
+      }
+
+      cipherState.available = false
+      expect(secrets.encrypt('slot', 'replacement').blob).toBe(ciphertext('newer'))
+    }
+  )
+
+  it('retains the last same-slot value in a single acknowledged preparation batch', () => {
+    const secrets = new ProtectedSecretPersistence()
+    const updates = [prepare(secrets, 'slot', 'older'), prepare(secrets, 'slot', 'newer')]
+
+    secrets.commitRetentionUpdates(updates)
+
+    cipherState.available = false
+    expect(secrets.encrypt('slot', 'replacement').blob).toBe(ciphertext('newer'))
+  })
+
+  it('does not reuse an old acknowledgement when a removed dynamic slot is recreated', () => {
+    const secrets = new ProtectedSecretPersistence()
+    const removed = prepare(secrets, 'dynamic-slot', 'removed')
+    secrets.removeRetainedBlob('dynamic-slot')
+    const recreated = prepare(secrets, 'dynamic-slot', 'recreated')
+
+    secrets.commitRetentionUpdates([removed, recreated, removed])
+
+    cipherState.available = false
+    expect(secrets.encrypt('dynamic-slot', 'replacement').blob).toBe(ciphertext('recreated'))
+  })
+
+  it('invalidates only the changed slot in an acknowledged batch', () => {
+    const secrets = new ProtectedSecretPersistence()
+    const updates = [prepare(secrets, 'keep', 'keep'), prepare(secrets, 'remove', 'remove')]
+    secrets.removeRetainedBlob('remove')
+
+    secrets.commitRetentionUpdates(updates)
+
+    cipherState.available = false
+    expect(secrets.encrypt('keep', 'replacement').blob).toBe(ciphertext('keep'))
+    expect(secrets.encrypt('remove', 'replacement').blob).toBe('')
+  })
+
+  it('does not accept a prepared update from a replaced persistence instance', () => {
+    const previous = new ProtectedSecretPersistence()
+    const current = new ProtectedSecretPersistence()
+    const older = prepare(previous, 'slot', 'older')
+    const newer = prepare(current, 'slot', 'newer')
+
+    current.commitRetentionUpdates([older, newer])
+
+    cipherState.available = false
+    expect(current.encrypt('slot', 'replacement').blob).toBe(ciphertext('newer'))
+  })
+
+  it('keeps the previous ciphertext and pending retry when a prepared save has no confirmed ack', () => {
+    const secrets = new ProtectedSecretPersistence()
+    const original = ciphertext('original')
+    secrets.decrypt('slot', original)
+    cipherState.available = false
+    secrets.encrypt('slot', 'replacement')
+    cipherState.available = true
+
+    prepare(secrets, 'slot', 'replacement')
+
+    expect(secrets.hasPendingEncryption()).toBe(true)
+    cipherState.available = false
+    expect(secrets.encrypt('slot', 'replacement').blob).toBe(original)
+  })
+})
diff --git a/src/main/protected-secret-persistence.test.ts b/src/main/protected-secret-persistence.test.ts
index 28a9ca6cf43..cbd1561f344 100644
--- a/src/main/protected-secret-persistence.test.ts
+++ b/src/main/protected-secret-persistence.test.ts
@@ -62,6 +62,7 @@ describe('ProtectedSecretPersistence', () => {
       degraded: true,
       hashValue: ciphertext
     })
+    expect(secrets.hasPendingEncryption()).toBe(false)
 
     cipherState.available = true
     expect(secrets.encrypt(slot, '')).toEqual({
@@ -74,4 +75,34 @@ describe('ProtectedSecretPersistence', () => {
     secrets.removeRetainedBlob(slot)
     expect(secrets.encrypt(slot, '')).toEqual({ blob: '', degraded: false })
   })
+
+  it('keeps deferred encryption pending until its retention update commits', async () => {
+    const { ProtectedSecretPersistence } = await import('./protected-secret-persistence')
+    const secrets = new ProtectedSecretPersistence()
+    cipherState.available = false
+    secrets.encrypt('slot', 'pending')
+    expect(secrets.hasPendingEncryption()).toBe(true)
+    cipherState.available = true
+    const encrypted = secrets.encrypt('slot', 'pending')
+    expect(secrets.hasPendingEncryption()).toBe(true)
+    if (!encrypted.retentionUpdate) {
+      throw new Error('Expected a retention update')
+    }
+    secrets.commitRetentionUpdates([encrypted.retentionUpdate])
+    expect(secrets.hasPendingEncryption()).toBe(false)
+  })
+
+  it('retires a deferred empty secret without retaining a phantom retry', async () => {
+    const { ProtectedSecretPersistence } = await import('./protected-secret-persistence')
+    const secrets = new ProtectedSecretPersistence()
+    cipherState.available = false
+    secrets.encrypt('slot', 'pending')
+    const cleared = secrets.encrypt('slot', '')
+    expect(secrets.hasPendingEncryption()).toBe(true)
+    if (!cleared.retentionUpdate) {
+      throw new Error('Expected a retention update')
+    }
+    secrets.commitRetentionUpdates([cleared.retentionUpdate])
+    expect(secrets.hasPendingEncryption()).toBe(false)
+  })
 })
diff --git a/src/main/protected-secret-persistence.ts b/src/main/protected-secret-persistence.ts
index 90bb2ee334d..c72af096619 100644
--- a/src/main/protected-secret-persistence.ts
+++ b/src/main/protected-secret-persistence.ts
@@ -19,6 +19,7 @@ export type ProtectedSecretDecryption = {
 export type ProtectedSecretRetentionUpdate = {
   slot: string
   blob: string | null
+  epoch: symbol
 }
 
 export type LegacyPlaintextValidator = (value: string) => boolean
@@ -34,10 +35,18 @@ type ProtectedSecretEncryption = {
 export class ProtectedSecretPersistence {
   private readonly retainedBlobs = new Map<string, string>()
   private readonly sealedSlots = new Set<string>()
+  private readonly pendingEncryption = new Set<string>()
+  private readonly retentionEpochs = new Map<string, symbol>()
+
+  hasPendingEncryption(): boolean {
+    return this.pendingEncryption.size > 0
+  }
 
   removeRetainedBlob(slot: string): void {
+    this.retentionEpochs.delete(slot)
     this.retainedBlobs.delete(slot)
     this.sealedSlots.delete(slot)
+    this.pendingEncryption.delete(slot)
   }
 
   isSealed(slot: string, value: string): boolean {
@@ -46,6 +55,12 @@ export class ProtectedSecretPersistence {
 
   commitRetentionUpdates(updates: readonly ProtectedSecretRetentionUpdate[]): void {
     for (const update of updates) {
+      // A delayed save must not overwrite a newer secret decision.
+      if (this.retentionEpochs.get(update.slot) !== update.epoch) {
+        continue
+      }
+      this.retentionEpochs.delete(update.slot)
+      this.pendingEncryption.delete(update.slot)
       if (update.blob === null) {
         this.removeRetainedBlob(update.slot)
       } else {
@@ -56,11 +71,21 @@ export class ProtectedSecretPersistence {
   }
 
   encrypt(slot: string, plaintext: string): ProtectedSecretEncryption {
+    this.retentionEpochs.delete(slot)
     const retained = this.retainedBlobs.get(slot) ?? ''
     if (!plaintext && !retained) {
-      return { blob: '', degraded: false }
+      return {
+        blob: '',
+        degraded: false,
+        ...(this.pendingEncryption.has(slot)
+          ? { retentionUpdate: this.prepareRetentionUpdate(slot, null) }
+          : {})
+      }
     }
     if (!this.encryptionAvailable()) {
+      if (!this.isSealed(slot, plaintext) && (plaintext || !this.sealedSlots.has(slot))) {
+        this.pendingEncryption.add(slot)
+      }
       return {
         blob: retained,
         degraded: true,
@@ -74,7 +99,7 @@ export class ProtectedSecretPersistence {
       return {
         blob: '',
         degraded: false,
-        retentionUpdate: { slot, blob: null }
+        retentionUpdate: this.prepareRetentionUpdate(slot, null)
       }
     }
     try {
@@ -82,9 +107,10 @@ export class ProtectedSecretPersistence {
       return {
         blob,
         degraded: false,
-        retentionUpdate: { slot, blob }
+        retentionUpdate: this.prepareRetentionUpdate(slot, blob)
       }
     } catch (err) {
+      this.pendingEncryption.add(slot)
       console.error('[persistence] Encryption failed; retaining the prior protected value:', err)
       return { blob: retained, degraded: true }
     }
@@ -99,6 +125,7 @@ export class ProtectedSecretPersistence {
     ciphertext: string,
     isLegacyPlaintext?: LegacyPlaintextValidator
   ): ProtectedSecretDecryption {
+    this.retentionEpochs.delete(slot)
     if (!ciphertext) {
       this.removeRetainedBlob(slot)
       return { plaintext: '', status: 'decrypted' }
@@ -129,6 +156,15 @@ export class ProtectedSecretPersistence {
     }
   }
 
+  private prepareRetentionUpdate(
+    slot: string,
+    blob: string | null
+  ): ProtectedSecretRetentionUpdate {
+    const epoch = Symbol()
+    this.retentionEpochs.set(slot, epoch)
+    return { slot, blob, epoch }
+  }
+
   private encryptionAvailable(): boolean {
     // Why getSecretStore() sits outside the try: an uninstalled store is a startup bug,
     // not a keyring failure. Swallowing it would degrade to an empty blob and report
diff --git a/src/main/providers/agent-foreground-process-git-bash.win32.test.ts b/src/main/providers/agent-foreground-process-git-bash.win32.test.ts
index 3cd4f07c003..4133375180f 100644
--- a/src/main/providers/agent-foreground-process-git-bash.win32.test.ts
+++ b/src/main/providers/agent-foreground-process-git-bash.win32.test.ts
@@ -1,19 +1,97 @@
-import { mkdtempSync } from 'node:fs'
+import { mkdtempSync, rmdirSync, symlinkSync } from 'node:fs'
 import { tmpdir } from 'node:os'
-import { join } from 'node:path'
+import { dirname, join } from 'node:path'
 import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
 import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
 import { WINDOWS_GIT_BASH_SHELL } from '../../shared/windows-terminal-shell'
 import { confirmPtyShellForeground } from '../daemon/pty-subprocess/pty-shell-foreground-confirmation'
 import { createPtyShellLaunchPlan } from '../daemon/pty-subprocess/shell-launch-plan'
 import { spawnNativeDaemonPty } from '../daemon/pty-subprocess/native-pty-spawn'
+import { canUseBunPty, spawnBunPty } from '../daemon/pty-subprocess/bun-pty-process'
+import { createWindowsBunPtyLaunch } from '../daemon/pty-subprocess/windows-bun-pty-launch'
 import { createDaemonPtyEnvironment } from '../daemon/pty-subprocess/spawn-environment'
+import type { PtyShellLaunchPlan } from '../daemon/pty-subprocess/shell-launch-plan'
 import type { PtySubprocessOptions } from '../daemon/pty-subprocess'
-import { isGitForWindowsBashLauncherPath } from '../git-bash'
+import { isGitForWindowsBashLauncherPath, resolveGitBashPath } from '../git-bash'
 import { readWindowsPtyJobProcessIds } from './windows-pty-job-membership'
 
 const describeOnWindows = process.platform === 'win32' ? describe : describe.skip
 
+async function spawnPlannedPane(
+  plan: PtyShellLaunchPlan,
+  env: Record<string, string>,
+  opts: PtySubprocessOptions
+): ReturnType<typeof spawnNativeDaemonPty> {
+  return spawnNativeDaemonPty(
+    { ...plan, env, cols: opts.cols, rows: opts.rows },
+    {
+      canUseBunPty,
+      spawnBunPty: (args) =>
+        spawnBunPty(args, {
+          // Source tests use the TS worker; packaged hosts resolve their adjacent JS worker.
+          createWindowsLaunch: (launch) =>
+            createWindowsBunPtyLaunch(launch, {
+              workerPath: join(__dirname, '../daemon/pty-subprocess/windows-bun-pty-gate-entry.ts')
+            })
+        })
+    }
+  )
+}
+
+/** Drives a live pane through prompt -> foreground command -> interrupt -> background job. */
+async function proveIdlePromptCycle(
+  spawned: Awaited<ReturnType<typeof spawnNativeDaemonPty>>,
+  expectedJobSize: number
+): Promise<void> {
+  const proc = spawned.process
+  let output = ''
+  let dead = false
+  proc.onData((chunk) => {
+    output += chunk
+  })
+  proc.onExit(() => {
+    dead = true
+  })
+  const confirm = (): Promise<boolean> =>
+    confirmPtyShellForeground({
+      process: proc,
+      shellPath: spawned.shellPath,
+      isDead: () => dead
+    })
+  try {
+    await vi.waitFor(() => expect(output).toContain('$'), { timeout: 20_000 })
+    await vi.waitFor(() => expect(readWindowsPtyJobProcessIds(proc)?.size).toBe(expectedJobSize), {
+      timeout: 5_000
+    })
+    await vi.waitFor(async () => expect(await confirm(), 'initial prompt').toBe(true), {
+      timeout: 5_000
+    })
+
+    // Interrupt only after the child is ready, not during a transient shell fork.
+    proc.write(
+      "node -e \"console.log(['ORCA','FOREGROUND_READY'].join('_')); setInterval(() => {}, 1000)\"\r"
+    )
+    await vi.waitFor(() => expect(output).toContain('ORCA_FOREGROUND_READY'), {
+      timeout: 10_000
+    })
+    await vi.waitFor(async () => expect(await confirm()).toBe(false), { timeout: 10_000 })
+
+    proc.write('\x03')
+    await vi.waitFor(
+      async () => {
+        expect(dead, 'terminal survived foreground interrupt').toBe(false)
+        expect(await confirm(), 'prompt after interrupt').toBe(true)
+      },
+      { timeout: 10_000 }
+    )
+
+    proc.write('sleep 60 &\r')
+    await vi.waitFor(async () => expect(await confirm()).toBe(false), { timeout: 10_000 })
+  } finally {
+    proc.kill()
+  }
+}
+
 describeOnWindows("Git Bash launcher shell proof with Orca's real launch", () => {
   let userData: string
   const previousUserData = process.env.ORCA_USER_DATA_PATH
@@ -52,42 +130,40 @@ describeOnWindows("Git Bash launcher shell proof with Orca's real launch", () =>
       const plan = createPtyShellLaunchPlan(opts, env)
       expect(isGitForWindowsBashLauncherPath(plan.shellPath)).toBe(true)
       expect(plan.shellArgs.join(' ')).toContain('exec "$BASH"')
-      const spawned = spawnNativeDaemonPty({ ...plan, env, cols: opts.cols, rows: opts.rows })
-      const proc = spawned.process
-      let output = ''
-      let dead = false
-      proc.onData((chunk) => {
-        output += chunk
-      })
-      proc.onExit(() => {
-        dead = true
-      })
-      const confirm = (): Promise<boolean> =>
-        confirmPtyShellForeground({
-          process: proc,
-          shellPath: spawned.shellPath,
-          isDead: () => dead
-        })
-      try {
-        await vi.waitFor(() => expect(output).toContain('$'), { timeout: 20_000 })
-        // Launcher, exec stub, interactive bash: the shape that a size-1 or size-2 rule never matches.
-        await vi.waitFor(() => expect(readWindowsPtyJobProcessIds(proc)?.size).toBe(3), {
-          timeout: 5_000
-        })
-        await vi.waitFor(async () => expect(await confirm()).toBe(true), { timeout: 5_000 })
-
-        proc.write('sleep 60\r')
-        await vi.waitFor(async () => expect(await confirm()).toBe(false), { timeout: 10_000 })
-
-        proc.write('\x03')
-        await vi.waitFor(async () => expect(await confirm()).toBe(true), { timeout: 10_000 })
-
-        proc.write('sleep 60 &\r')
-        await vi.waitFor(async () => expect(await confirm()).toBe(false), { timeout: 10_000 })
-      } finally {
-        proc.kill()
-      }
+      // Launcher, exec stub, interactive bash: the shape that a size-1 or size-2 rule never matches.
+      await proveIdlePromptCycle(await spawnPlannedPane(plan, env, opts), 3)
     },
     60_000
   )
+
+  it('confirms an idle prompt for an install folder named neither Git nor PortableGit', async () => {
+    const discovered = resolveGitBashPath()
+    if (!discovered) {
+      throw new Error('this host has no Git for Windows install to stage')
+    }
+    expect(isGitForWindowsBashLauncherPath(discovered)).toBe(true)
+    // A junction, not a copy: the operator's install is neither modified nor duplicated.
+    const stagingRoot = mkdtempSync(join(tmpdir(), 'orca-git-renamed-'))
+    const stagedInstall = join(stagingRoot, 'Git-2.55')
+    symlinkSync(dirname(dirname(discovered)), stagedInstall, 'junction')
+    const opts: PtySubprocessOptions = {
+      sessionId: 'git-bash-renamed-shell-proof',
+      cols: 120,
+      rows: 30,
+      cwd: tmpdir(),
+      shellOverride: join(stagedInstall, 'bin', 'bash.exe')
+    }
+    try {
+      const env = createDaemonPtyEnvironment(opts)
+      const plan = createPtyShellLaunchPlan(opts, env)
+      expect(plan.shellPath).toBe(opts.shellOverride)
+      expect(isGitForWindowsBashLauncherPath(plan.shellPath)).toBe(true)
+      // No Git Bash startup args for an unrecognized folder, so no exec stub: launcher -> bash.
+      await proveIdlePromptCycle(await spawnPlannedPane(plan, env, opts), 2)
+    } finally {
+      // rmdir, never a recursive remove: it detaches the junction and cannot reach the target.
+      rmdirSync(stagedInstall)
+      removeTreeSync(stagingRoot)
+    }
+  }, 60_000)
 })
diff --git a/src/main/providers/local-pty-bun-artifact.integration.test.ts b/src/main/providers/local-pty-bun-artifact.integration.test.ts
new file mode 100644
index 00000000000..487127887a3
--- /dev/null
+++ b/src/main/providers/local-pty-bun-artifact.integration.test.ts
@@ -0,0 +1,107 @@
+import { build } from 'esbuild'
+import { existsSync } from 'node:fs'
+import { copyFile, mkdtemp } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { runProcess } from '../../shared/child-process/run-process'
+import { orcadBunRuntimeFilename } from '../../shared/orcad-artifacts'
+import { ORCAD_BUN_VERSION } from '../../shared/orcad-bun-runtime'
+import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
+
+const runtime =
+  process.env.BUN_EXECUTABLE ?? resolve('out/orcad', orcadBunRuntimeFilename(process.platform))
+
+describe.skipIf(!existsSync(runtime))('isolated Bun in-process PTY artifact', () => {
+  it('spawns, reattaches, delivers data and retires a shell without node-pty installed', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-bun-local-pty-'))
+    try {
+      const entry = join(directory, 'local-pty.cjs')
+      const external = ['node-pty', 'electron', 'bun:ffi', '@parcel/watcher', '*.node']
+      await build({
+        stdin: {
+          contents: `
+            import { LocalPtyProvider } from './src/main/providers/local-pty-provider'
+            import { setAppEnvironment } from './src/shared/app-environment'
+            import { getCmdExePath } from './src/shared/windows-batch-spawn'
+            try { require.resolve('node-pty'); throw new Error('node-pty unexpectedly available') }
+            catch (error) { if (error.code !== 'MODULE_NOT_FOUND') throw error }
+            setAppEnvironment({
+              getPath: () => process.cwd(), getAppPath: () => process.cwd(),
+              getVersion: () => 'test', isPackaged: () => true,
+              onWillQuit() {}, exit: code => process.exit(code), getAppMetrics: () => []
+            })
+            const provider = new LocalPtyProvider()
+            let output = '', resolveExit
+            const exit = new Promise(resolve => { resolveExit = resolve })
+            provider.onData(event => { output += event.data })
+            provider.onExit(event => resolveExit(event.code))
+            const deadline = setTimeout(() => { provider.killAll(); process.exit(98) }, 10_000)
+            ;(async () => {
+              const first = await provider.spawn({
+                sessionId: 'isolated-bun-fallback', cols: 80, rows: 24, cwd: process.cwd(),
+                shellOverride: process.platform === 'win32' ? getCmdExePath() : '/bin/sh'
+              })
+              const again = await provider.spawn({sessionId:first.id, cols:100, rows:30})
+              provider.write(first.id, process.platform === 'win32'
+                ? 'echo ORCA_BUN_FALLBACK_READY & exit 17\\r'
+                : 'printf ORCA_BUN_FALLBACK_READY; exit 17\\r')
+              const code = await exit
+              clearTimeout(deadline)
+              console.log(JSON.stringify({
+                version:process.versions.bun, code, output:output.includes('ORCA_BUN_FALLBACK_READY'),
+                reattached:again.isReattach === true && again.pid === first.pid,
+                retired:provider.getPtyProcess(first.id) === undefined
+              }))
+            })().catch(error => { clearTimeout(deadline); provider.killAll(); console.error(error);process.exitCode=1 })
+          `,
+          resolveDir: process.cwd(),
+          loader: 'ts'
+        },
+        bundle: true,
+        platform: 'node',
+        format: 'cjs',
+        target: 'node18',
+        external,
+        outfile: entry,
+        logLevel: 'silent'
+      })
+      if (process.platform === 'win32') {
+        await build({
+          entryPoints: ['src/main/daemon/pty-subprocess/windows-bun-pty-gate-entry.ts'],
+          bundle: true,
+          platform: 'node',
+          format: 'cjs',
+          external,
+          outfile: join(directory, 'windows-bun-pty-gate-entry.js'),
+          logLevel: 'silent'
+        })
+      }
+      const isolatedRuntime = join(directory, orcadBunRuntimeFilename(process.platform))
+      await copyFile(runtime, isolatedRuntime)
+      const result = await runProcess({
+        program: isolatedRuntime,
+        args: ['--no-install', entry],
+        cwd: directory,
+        env: {
+          ...process.env,
+          ORCA_BACKGROUND_LAUNCH: '1',
+          ORCA_DISABLE_MACOS_LOGIN_SHELL: '1',
+          ORCA_USER_DATA_PATH: directory
+        },
+        timeoutMs: 15_000,
+        terminationBarrier: true
+      })
+      expect(result.code, result.stderr).toBe(0)
+      expect(JSON.parse(result.stdout)).toEqual({
+        version: ORCAD_BUN_VERSION,
+        code: 17,
+        output: true,
+        reattached: true,
+        retired: true
+      })
+    } finally {
+      removeTreeSync(directory)
+    }
+  }, 20_000)
+})
diff --git a/src/main/providers/local-pty-bun-posix-inspection.test.ts b/src/main/providers/local-pty-bun-posix-inspection.test.ts
new file mode 100644
index 00000000000..c71e4a3fa6c
--- /dev/null
+++ b/src/main/providers/local-pty-bun-posix-inspection.test.ts
@@ -0,0 +1,153 @@
+import type { IPty } from 'node-pty'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as ProcessTableReader from '../../shared/process-table-snapshot-reader'
+import type { ProcessTableRow } from '../../shared/process-table-snapshot'
+import {
+  confirmLocalPtyForegroundProcess,
+  getLocalPtyForegroundProcess,
+  hasLocalPtyChildProcesses,
+  inspectLocalPtyChildProcesses
+} from './local-pty-foreground-inspection'
+import { LocalPtyProvider } from './local-pty-provider'
+import { ptyLastRecognizedForeground, ptyProcesses, ptyShellPath } from './local-pty-provider-state'
+
+const scans = vi.hoisted(() => ({ full: vi.fn(), fresh: vi.fn(), strict: vi.fn() }))
+vi.mock('../../shared/process-table-snapshot-reader', async (importOriginal) => ({
+  ...(await importOriginal<typeof ProcessTableReader>()),
+  getProcessTableSnapshot: scans.full,
+  getFreshProcessTableSnapshot: scans.fresh,
+  getStrictProcessTableSnapshotWithAge: scans.strict
+}))
+const platform = Object.getOwnPropertyDescriptor(process, 'platform')!
+const id = 'bun-pane'
+const provider = new LocalPtyProvider()
+let rows: ProcessTableRow[]
+
+function row(pid: number, ppid: number, command: string, foregroundPid: number): ProcessTableRow {
+  return {
+    pid,
+    ppid,
+    command,
+    pgid: pid,
+    tpgid: foregroundPid,
+    stat: pid === foregroundPid ? 'Ss+' : 'Ss',
+    tty: 'ttys002'
+  }
+}
+
+function pane(): IPty & { processNameIsSpawnFile: true } {
+  return {
+    pid: 100,
+    process: '/bin/zsh',
+    processNameIsSpawnFile: true,
+    cols: 80,
+    rows: 24,
+    handleFlowControl: false,
+    onData: () => ({ dispose() {} }),
+    onExit: () => ({ dispose() {} }),
+    resize() {},
+    clear() {},
+    write() {},
+    kill() {},
+    pause() {},
+    resume() {}
+  }
+}
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  scans.full.mockImplementation(async () => rows)
+  scans.fresh.mockImplementation(async () => rows)
+  scans.strict.mockImplementation(async () => ({ rows, capturedAgeMs: 0 }))
+  ptyProcesses.set(id, pane())
+  ptyShellPath.set(id, '/bin/zsh')
+})
+afterEach(() => {
+  ptyProcesses.clear()
+  ptyShellPath.clear()
+  ptyLastRecognizedForeground.clear()
+  Object.defineProperty(process, 'platform', platform)
+  vi.restoreAllMocks()
+})
+
+describe.each(['darwin', 'linux'])('Bun in-process %s inspection', (host) => {
+  beforeEach(() => Object.defineProperty(process, 'platform', { value: host, configurable: true }))
+
+  it('reports the actual foreground command and warns before closing a busy pane', async () => {
+    rows = [row(100, 1, '-zsh', 101), row(101, 100, 'vim notes.md', 101)]
+    expect(await provider.inspectProcess(id)).toEqual({
+      foregroundProcess: 'vim',
+      hasChildProcesses: true,
+      childProcessEvidence: 'children'
+    })
+    expect(await hasLocalPtyChildProcesses(id)).toBe(true)
+    expect(await confirmLocalPtyForegroundProcess(id)).toBe('vim')
+    expect(scans.fresh).toHaveBeenCalledOnce()
+  })
+
+  it('proves an idle shell has no children', async () => {
+    rows = [row(100, 1, '-zsh', 100)]
+    expect(await provider.inspectProcess(id)).toEqual({
+      foregroundProcess: 'zsh',
+      hasChildProcesses: false,
+      childProcessEvidence: 'no-children'
+    })
+    expect(await hasLocalPtyChildProcesses(id)).toBe(false)
+  })
+
+  it('does not mistake the login wrapper for a running user job', async () => {
+    ptyProcesses.set(id, { ...pane(), process: '/usr/bin/login' })
+    rows = [row(100, 1, '/usr/bin/login -fp test', 101), row(101, 100, '-zsh', 101)]
+    expect(await provider.inspectProcess(id)).toEqual({
+      foregroundProcess: 'zsh',
+      hasChildProcesses: false,
+      childProcessEvidence: 'no-children'
+    })
+  })
+
+  it('preserves a cached agent when the foreground scan cannot verify it', async () => {
+    rows = []
+    scans.full.mockRejectedValue(new Error('process table unavailable'))
+    scans.strict.mockRejectedValue(new Error('process table unavailable'))
+    ptyLastRecognizedForeground.set(id, { name: 'claude', pid: 101, at: Date.now() })
+    expect(await provider.inspectProcess(id)).toEqual({
+      foregroundProcess: 'claude',
+      hasChildProcesses: true,
+      childProcessEvidence: 'unverifiable'
+    })
+    expect(await hasLocalPtyChildProcesses(id)).toBe(true)
+    expect(await confirmLocalPtyForegroundProcess(id)).toBeNull()
+  })
+
+  it('returns uncertainty when the process table has no pane root', async () => {
+    rows = [row(900, 1, '-zsh', 900)]
+    expect(await getLocalPtyForegroundProcess(id)).toBeNull()
+    expect(await inspectLocalPtyChildProcesses(id)).toBe('unverifiable')
+    expect(await hasLocalPtyChildProcesses(id)).toBe(true)
+  })
+
+  it('does not resurrect an agent cache after replacement during fingerprint capture', async () => {
+    rows = [row(100, 1, '-zsh', 101), row(101, 100, 'node /usr/local/bin/claude', 101)]
+    scans.full
+      .mockImplementationOnce(async () => rows)
+      .mockImplementationOnce(async () => {
+        ptyProcesses.set(id, { ...pane(), pid: 999 })
+        return rows
+      })
+    expect(await getLocalPtyForegroundProcess(id)).toBeNull()
+    expect(ptyLastRecognizedForeground.has(id)).toBe(false)
+  })
+
+  it('does not combine an old foreground with a replacement pane during a child scan', async () => {
+    rows = [row(100, 1, '-zsh', 101), row(101, 100, 'vim notes.md', 101)]
+    scans.strict.mockImplementationOnce(async () => {
+      ptyProcesses.set(id, { ...pane(), pid: 999 })
+      return { rows, capturedAgeMs: 0 }
+    })
+    expect(await provider.inspectProcess(id)).toEqual({
+      foregroundProcess: null,
+      hasChildProcesses: true,
+      childProcessEvidence: 'unverifiable'
+    })
+  })
+})
diff --git a/src/main/providers/local-pty-bun-windows-identity.test.ts b/src/main/providers/local-pty-bun-windows-identity.test.ts
new file mode 100644
index 00000000000..43444579046
--- /dev/null
+++ b/src/main/providers/local-pty-bun-windows-identity.test.ts
@@ -0,0 +1,80 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { ptyProcesses, ptyShellPath } from './local-pty-provider-state'
+import {
+  confirmLocalPtyShellForeground,
+  inspectLocalPtyChildProcesses
+} from './local-pty-foreground-inspection'
+import { getLocalPtyCwd, sendLocalPtySignal } from './local-pty-session-operations'
+
+const { confirm, cwd, membership } = vi.hoisted(() => ({
+  confirm: vi.fn(),
+  cwd: vi.fn(),
+  membership: vi.fn()
+}))
+vi.mock('./agent-foreground-process', () => ({
+  confirmShellForegroundProcess: confirm,
+  resolveAgentForegroundProcessWithAvailability: vi.fn()
+}))
+vi.mock('./process-cwd', () => ({ resolveProcessCwd: cwd }))
+vi.mock('./windows-pty-job-membership', () => ({
+  readWindowsPtyJobProcessIds: membership,
+  isWindowsPtyJobReadable: () => true
+}))
+
+const originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform')!
+beforeEach(() => {
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+  confirm.mockResolvedValue(true)
+  cwd.mockResolvedValue('C:\\work')
+})
+afterEach(() => {
+  ptyProcesses.clear()
+  ptyShellPath.clear()
+  Object.defineProperty(process, 'platform', originalPlatform)
+  vi.restoreAllMocks()
+})
+
+describe('Bun in-process Windows shell identity', () => {
+  it('uses the child shell for cwd and foreground checks while signaling the owned job', async () => {
+    const proc = {
+      pid: 1200,
+      shellProcessId: 1201,
+      jobRootProcessIsWrapper: true as const,
+      processNameIsSpawnFile: true as const,
+      process: 'cmd.exe',
+      cols: 80,
+      rows: 24,
+      handleFlowControl: false,
+      onData: () => ({ dispose() {} }),
+      onExit: () => ({ dispose() {} }),
+      write() {},
+      clear() {},
+      pause() {},
+      resume() {},
+      resize() {},
+      kill() {},
+      signalProcess: vi.fn()
+    }
+    ptyProcesses.set('gated-shell', proc)
+    const shellPath = 'C:\\Windows\\System32\\cmd.exe'
+    ptyShellPath.set('gated-shell', shellPath)
+    const kill = vi.spyOn(process, 'kill').mockReturnValue(true)
+    expect(await getLocalPtyCwd('gated-shell')).toBe('C:\\work')
+    expect(cwd).toHaveBeenCalledWith(1201)
+    expect(await confirmLocalPtyShellForeground('gated-shell')).toBe(true)
+    expect(confirm).toHaveBeenCalledWith(1201, shellPath, expect.any(Object))
+    await sendLocalPtySignal('gated-shell', 'SIGTERM')
+    expect(proc.signalProcess).toHaveBeenCalledWith('SIGTERM')
+    expect(kill).not.toHaveBeenCalled()
+    membership.mockReturnValue(new Set([1201]))
+    expect(await inspectLocalPtyChildProcesses('gated-shell')).toBe('no-children')
+    membership.mockReturnValue(new Set([1201, 1202]))
+    expect(await inspectLocalPtyChildProcesses('gated-shell')).toBe('children')
+    membership.mockReturnValue(null)
+    expect(await inspectLocalPtyChildProcesses('gated-shell')).toBe('unverifiable')
+    Reflect.deleteProperty(proc, 'shellProcessId')
+    cwd.mockClear()
+    expect(await getLocalPtyCwd('gated-shell')).toBe('')
+    expect(cwd).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/providers/local-pty-child-process-verdict.test.ts b/src/main/providers/local-pty-child-process-verdict.test.ts
index 0338b38aaa4..857017b6671 100644
--- a/src/main/providers/local-pty-child-process-verdict.test.ts
+++ b/src/main/providers/local-pty-child-process-verdict.test.ts
@@ -99,7 +99,7 @@ describe('confirmLocalPtyShellForeground', () => {
 const describeOnPosix = process.platform === 'win32' ? describe.skip : describe
 
 describe('inspectLocalPtyChildProcesses', () => {
-  it('reports unverifiable when the pty fd cannot be read', () => {
+  it('reports unverifiable when the pty fd cannot be read', async () => {
     registerPane(
       'pty-closed',
       () => {
@@ -107,24 +107,24 @@ describe('inspectLocalPtyChildProcesses', () => {
       },
       '/bin/zsh'
     )
-    expect(inspectLocalPtyChildProcesses('pty-closed')).toBe('unverifiable')
+    expect(await inspectLocalPtyChildProcesses('pty-closed')).toBe('unverifiable')
   })
 
-  it('still answers no-children when the shell itself is in the foreground', () => {
+  it('still answers no-children when the shell itself is in the foreground', async () => {
     registerPane('pty-idle', 'zsh', '/bin/zsh')
-    expect(inspectLocalPtyChildProcesses('pty-idle')).toBe('no-children')
+    expect(await inspectLocalPtyChildProcesses('pty-idle')).toBe('no-children')
   })
 
-  it('answers children when something else is in the foreground', () => {
+  it('answers children when something else is in the foreground', async () => {
     registerPane('pty-busy', 'vim', '/bin/zsh')
-    expect(inspectLocalPtyChildProcesses('pty-busy')).toBe('children')
+    expect(await inspectLocalPtyChildProcesses('pty-busy')).toBe('children')
   })
 
-  it('treats a pane this provider does not hold as a real negative', () => {
-    expect(inspectLocalPtyChildProcesses('pty-absent')).toBe('no-children')
+  it('treats a pane this provider does not hold as a real negative', async () => {
+    expect(await inspectLocalPtyChildProcesses('pty-absent')).toBe('no-children')
   })
 
-  it('collapses uncertainty to false only in the boolean adapter', async () => {
+  it('preserves uncertainty conservatively in the boolean adapter', async () => {
     let reads = 0
     registerPane(
       'pty-closed',
@@ -134,8 +134,8 @@ describe('inspectLocalPtyChildProcesses', () => {
       },
       '/bin/zsh'
     )
-    await expect(hasLocalPtyChildProcesses('pty-closed')).resolves.toBe(false)
-    // The `false` has to come from the failed read, not from an earlier short-circuit.
+    await expect(hasLocalPtyChildProcesses('pty-closed')).resolves.toBe(true)
+    // The result must come from the failed read, not from an earlier short-circuit.
     expect(reads).toBe(1)
   })
 })
@@ -147,14 +147,14 @@ describeOnPosix('inspectLocalPtyChildProcesses on a retired master', () => {
     // The mechanism is silent: this is the same string an idle pane reports.
     expect(term.process).toBe(POSIX_SHELL)
     // Not `no-children`: the close guard reads that as "nothing is running here" and kills the pane.
-    expect(inspectLocalPtyChildProcesses('pty-retired')).toBe('unverifiable')
+    expect(await inspectLocalPtyChildProcesses('pty-retired')).toBe('unverifiable')
   }, 15000)
 
-  it('collapses uncertainty to false only in the boolean adapter', async () => {
+  it('preserves uncertainty conservatively in the boolean adapter', async () => {
     await registerRetiredPane('pty-retired')
 
     // The adapter exists for `IPtyProvider.hasChildProcesses`, which has no third slot.
-    await expect(hasLocalPtyChildProcesses('pty-retired')).resolves.toBe(false)
+    await expect(hasLocalPtyChildProcesses('pty-retired')).resolves.toBe(true)
   }, 15000)
 })
 
@@ -176,7 +176,7 @@ describe('inspectPtyProviderProcess child-process evidence', () => {
     )
     await expect(inspectPtyProviderProcess(provider, 'pty-closing')).resolves.toEqual({
       foregroundProcess: '/bin/zsh',
-      hasChildProcesses: false,
+      hasChildProcesses: true,
       childProcessEvidence: 'unverifiable'
     })
   })
@@ -216,7 +216,7 @@ describe('inspectPtyProviderProcess child-process evidence', () => {
 
     await expect(inspectPtyProviderProcess(provider, 'pty-swapped')).resolves.toEqual({
       foregroundProcess: null,
-      hasChildProcesses: false,
+      hasChildProcesses: true,
       childProcessEvidence: 'unverifiable'
     })
   })
@@ -229,7 +229,7 @@ describeOnPosix('inspectPtyProviderProcess on a retired master', () => {
     await registerRetiredPane('pty-retired')
 
     const inspection = await inspectPtyProviderProcess(provider, 'pty-retired')
-    expect(inspection.hasChildProcesses).toBe(false)
+    expect(inspection.hasChildProcesses).toBe(true)
     expect(inspection.childProcessEvidence).toBe('unverifiable')
   }, 15000)
 })
diff --git a/src/main/providers/local-pty-foreground-inspection.ts b/src/main/providers/local-pty-foreground-inspection.ts
index 1eb4876cfd0..8c3b0a6dcce 100644
--- a/src/main/providers/local-pty-foreground-inspection.ts
+++ b/src/main/providers/local-pty-foreground-inspection.ts
@@ -1,13 +1,22 @@
 import type { PtyChildProcessVerdict } from '../../shared/terminal-process-inspection'
 import { recognizeAgentProcessFromCommandLine } from '../../shared/agent-process-recognition'
 import { getCheapProcessTableSnapshot } from '../../shared/cheap-process-table-snapshot-reader'
-import { getProcessTableSnapshot } from '../../shared/process-table-snapshot-reader'
 import {
-  confirmShellForegroundProcess,
-  resolveAgentForegroundProcessWithAvailability
-} from './agent-foreground-process'
+  getProcessTableSnapshot,
+  getStrictProcessTableSnapshotWithAge
+} from '../../shared/process-table-snapshot-reader'
+import { confirmShellForegroundProcess } from './agent-foreground-process'
+import {
+  createPtyForegroundResolver,
+  ptyProcessNameIsSpawnFile
+} from '../daemon/pty-subprocess/spawn-file-foreground-process'
+import {
+  inspectSpawnFileChildProcessesFromRows,
+  inspectSpawnFileWindowsChildProcesses
+} from '../daemon/pty-subprocess/spawn-file-child-processes'
 import { buildPaneProcessFingerprint } from './posix-pane-foreground-fingerprint'
 import { isRetiredPtyMaster } from '../pty/node-pty-master-fd-retirement'
+import { ptyShellProcessId } from '../windows/windows-pty-job'
 import { resolveForegroundFallbackProcess } from './local-pty-launch-helpers'
 import {
   ptyAgentForegroundContextPaths,
@@ -29,7 +38,7 @@ import { isWindowsPtyJobReadable, readWindowsPtyJobProcessIds } from './windows-
  * equals the recorded shell and would otherwise read as a real "nothing is running here". Ask the
  * descriptor before the name, because an unreadable PTY is not evidence that its children exited.
  */
-export function inspectLocalPtyChildProcesses(id: string): PtyChildProcessVerdict {
+export async function inspectLocalPtyChildProcesses(id: string): Promise<PtyChildProcessVerdict> {
   const proc = ptyProcesses.get(id)
   if (!proc) {
     return 'no-children'
@@ -38,6 +47,19 @@ export function inspectLocalPtyChildProcesses(id: string): PtyChildProcessVerdic
     return 'unverifiable'
   }
   try {
+    if (ptyProcessNameIsSpawnFile(proc)) {
+      if (process.platform === 'win32') {
+        return inspectSpawnFileWindowsChildProcesses(proc)
+      }
+      const snapshot = await getStrictProcessTableSnapshotWithAge()
+      return ptyProcesses.get(id) === proc
+        ? inspectSpawnFileChildProcessesFromRows(
+            snapshot.rows,
+            proc.pid,
+            getPtyShellName(id) ?? null
+          )
+        : 'unverifiable'
+    }
     const foreground = proc.process
     const shell = getPtyShellName(id)
     if (!shell) {
@@ -51,7 +73,7 @@ export function inspectLocalPtyChildProcesses(id: string): PtyChildProcessVerdic
 }
 
 export async function hasLocalPtyChildProcesses(id: string): Promise<boolean> {
-  return inspectLocalPtyChildProcesses(id) === 'children'
+  return (await inspectLocalPtyChildProcesses(id)) !== 'no-children'
 }
 
 /**
@@ -89,7 +111,7 @@ export async function getLocalPtyForegroundProcess(id: string): Promise<string |
     return null
   }
   const fallbackProcess = resolveForegroundFallbackProcess(
-    proc.process || null,
+    ptyProcessNameIsSpawnFile(proc) ? (getPtyShellName(id) ?? null) : proc.process || null,
     getPtyShellName(id)
   )
   const cachedEntry = ptyLastRecognizedForeground.get(id)
@@ -112,7 +134,7 @@ export async function getLocalPtyForegroundProcess(id: string): Promise<string |
       const verdict = judgeCachedAgentJobEvidence({
         jobProcessIds: paneProcessIds,
         jobSupported: isWindowsPtyJobReadable(),
-        shellPid: proc.pid,
+        shellPid: ptyShellProcessId(proc) ?? proc.pid,
         anchorProcessId: cachedEntry?.pid ?? null,
         identityAgeMs: Date.now() - (cachedEntry?.at ?? 0)
       })
@@ -149,16 +171,12 @@ export async function getLocalPtyForegroundProcess(id: string): Promise<string |
     return cachedAgent
   }
   try {
-    const resolution = await resolveAgentForegroundProcessWithAvailability(
-      proc.pid,
-      fallbackProcess,
-      {
-        contextPaths: ptyAgentForegroundContextPaths.get(id),
-        ...(cachedEntry?.pid != null
-          ? { anchorProcessId: cachedEntry.pid, anchorProcessName: cachedEntry.name }
-          : {})
-      }
-    )
+    const resolution = await createPtyForegroundResolver(proc)(proc.pid, fallbackProcess, {
+      contextPaths: ptyAgentForegroundContextPaths.get(id),
+      ...(cachedEntry?.pid != null
+        ? { anchorProcessId: cachedEntry.pid, anchorProcessName: cachedEntry.name }
+        : {})
+    })
     // Why: the scan can outlive PTY teardown/id reuse; stale results must not resurrect cache for a foreign id.
     if (ptyProcesses.get(id) !== proc) {
       return null
@@ -181,6 +199,10 @@ export async function getLocalPtyForegroundProcess(id: string): Promise<string |
         : resolution
     const stable = resolveStableForegroundProcess(stableResolution, lastRecognizedAgent)
     if (stable.lastRecognizedAgent && stableResolution.available) {
+      const steady = await readPosixSteadyState(proc.pid, fallbackProcess)
+      if (ptyProcesses.get(id) !== proc) {
+        return null
+      }
       // Only a positive recognition restarts the age bound.
       ptyLastRecognizedForeground.set(id, {
         name: stable.lastRecognizedAgent,
@@ -189,7 +211,7 @@ export async function getLocalPtyForegroundProcess(id: string): Promise<string |
             ? (resolution.processId ?? null)
             : null,
         at: Date.now(),
-        steady: await readPosixSteadyState(proc.pid, fallbackProcess)
+        steady
       })
     } else if (stable.lastRecognizedAgent && cachedAgentAliveInJob && !anchorContradicted) {
       // The anchor pid in the job is proof of life; restamp so the
@@ -234,9 +256,12 @@ export async function confirmLocalPtyForegroundProcess(id: string): Promise<stri
     return null
   }
   try {
-    const resolution = await resolveAgentForegroundProcessWithAvailability(
+    const resolution = await createPtyForegroundResolver(proc)(
       proc.pid,
-      resolveForegroundFallbackProcess(proc.process || null, getPtyShellName(id)),
+      resolveForegroundFallbackProcess(
+        ptyProcessNameIsSpawnFile(proc) ? (getPtyShellName(id) ?? null) : proc.process || null,
+        getPtyShellName(id)
+      ),
       {
         contextPaths: ptyAgentForegroundContextPaths.get(id),
         fresh: true,
@@ -265,7 +290,7 @@ export async function confirmLocalPtyShellForeground(id: string): Promise<boolea
     return false
   }
   const confirmed = await confirmShellForegroundProcess(
-    proc.pid,
+    ptyShellProcessId(proc),
     ptyShellPath.get(id),
     process.platform === 'win32'
       ? { readWindowsPtyJobProcessIds: () => readWindowsPtyJobProcessIds(proc) }
diff --git a/src/main/providers/local-pty-launch-plan.ts b/src/main/providers/local-pty-launch-plan.ts
index c8b784e7cb3..17351325300 100644
--- a/src/main/providers/local-pty-launch-plan.ts
+++ b/src/main/providers/local-pty-launch-plan.ts
@@ -1,4 +1,5 @@
 import { win32 as pathWin32 } from 'node:path'
+import { canUseBunPty } from '../daemon/pty-subprocess/bun-pty-process-capabilities'
 import { recognizeAgentProcessFromCommandLine } from '../../shared/agent-process-recognition'
 import { WINDOWS_GIT_BASH_SHELL } from '../../shared/windows-terminal-shell'
 import { resolveWindowsGitBashShellPath } from '../git-bash'
@@ -76,7 +77,9 @@ function finalizeLocalPtyLaunchPlan(
     windowsFallbackAttempts?: ReturnType<typeof buildWindowsPowerShellSpawnAttempts>
   }
 ): LocalPtyLaunchPlan {
-  ensureNodePtySpawnHelperExecutable()
+  if (!canUseBunPty()) {
+    ensureNodePtySpawnHelperExecutable()
+  }
   if (seed.args.prevalidatedCwd !== shell.validationCwd) {
     validateWorkingDirectory(shell.validationCwd)
   }
diff --git a/src/main/providers/local-pty-pending-native-spawn.test.ts b/src/main/providers/local-pty-pending-native-spawn.test.ts
new file mode 100644
index 00000000000..7f292e41273
--- /dev/null
+++ b/src/main/providers/local-pty-pending-native-spawn.test.ts
@@ -0,0 +1,147 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { spawnLocalPty } from './local-pty-spawn'
+import { cancelPendingLocalPtySpawns } from './local-pty-spawn-state'
+import { pendingLocalPtySpawns, ptyProcesses } from './local-pty-provider-state'
+
+const { spawn, activate, destroy } = vi.hoisted(() => ({
+  spawn: vi.fn(),
+  activate: vi.fn(),
+  destroy: vi.fn()
+}))
+vi.mock('./local-pty-runtime-spawn', () => ({ loadLocalPtyRuntimeSpawn: async () => spawn }))
+vi.mock('./macos-tcc-login-shell', () => ({ prepareMacosTccLoginShell: async () => {} }))
+vi.mock('./local-pty-finalize-environment', () => ({
+  finalizeLocalPtySpawnEnvironment: () => null
+}))
+vi.mock('./local-pty-spawn-environment', () => ({
+  buildLocalPtySpawnEnvironment: () => ({}),
+  enforceLocalPtySpawnEnvironmentOverrides() {}
+}))
+vi.mock('./local-pty-launch-plan', () => ({
+  DeferredLocalPtyLaunchPlan: class {},
+  createLocalPtyLaunchPlan: () => ({
+    shellPath: '/bin/sh',
+    shellArgs: [],
+    effectiveCwd: '/tmp',
+    cwd: '/tmp',
+    windowsFallbackAttempts: []
+  })
+}))
+vi.mock('./local-pty-session-activation', () => ({ activateLocalPtySession: activate }))
+vi.mock('./local-pty-termination', () => ({ destroyPtyProcess: destroy }))
+
+function createProcess() {
+  return {
+    pid: 12345,
+    process: '/bin/sh',
+    cols: 80,
+    rows: 24,
+    handleFlowControl: false,
+    onData: () => ({ dispose() {} }),
+    onExit: () => ({ dispose() {} }),
+    write() {},
+    clear() {},
+    pause() {},
+    resume() {},
+    resize: vi.fn(),
+    kill: vi.fn()
+  }
+}
+
+function start(id = 'pending-bun-shell') {
+  return spawnLocalPty({ sessionId: id, cols: 80, rows: 24 }, () => ({}))
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  activate.mockImplementation(({ id, proc }) => {
+    ptyProcesses.set(id, proc)
+    return { id, pid: proc.pid }
+  })
+})
+afterEach(() => {
+  ptyProcesses.clear()
+  expect(pendingLocalPtySpawns.size).toBe(0)
+})
+
+describe('local PTY native spawn admission', () => {
+  it('aborts a pending receipt when the requesting client disconnects', async () => {
+    const controller = new AbortController()
+    spawn.mockImplementationOnce(
+      ({ signal }: { signal: AbortSignal }) =>
+        new Promise((_resolve, reject) => {
+          signal.addEventListener('abort', () => reject(signal.reason), { once: true })
+        })
+    )
+    const result = spawnLocalPty(
+      { sessionId: 'disconnected-shell', cols: 80, rows: 24, signal: controller.signal },
+      () => ({})
+    )
+    const rejected = expect(result).rejects.toThrow('client disconnected')
+    await vi.waitFor(() => expect(spawn).toHaveBeenCalledOnce())
+    controller.abort(new Error('client disconnected'))
+    await rejected
+    expect(activate).not.toHaveBeenCalled()
+  })
+
+  it('reserves the same session until a delayed shell receipt is activated', async () => {
+    const proc = createProcess()
+    let release!: () => void
+    spawn.mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          release = () => resolve({ process: proc, shellPath: '/bin/sh' })
+        })
+    )
+    const first = start()
+    await vi.waitFor(() => expect(spawn).toHaveBeenCalledOnce())
+    const second = start()
+    await new Promise((resolve) => setImmediate(resolve))
+    expect(spawn).toHaveBeenCalledOnce()
+    release()
+    expect(await first).toEqual({ id: 'pending-bun-shell', pid: proc.pid })
+    expect(await second).toMatchObject({ id: 'pending-bun-shell', pid: proc.pid, isReattach: true })
+    expect(activate).toHaveBeenCalledOnce()
+    expect(spawn).toHaveBeenCalledOnce()
+  })
+
+  it('aborts a pending receipt on shutdown and cancels queued same-session launches', async () => {
+    spawn.mockImplementationOnce(
+      ({ signal }: { signal: AbortSignal }) =>
+        new Promise((_resolve, reject) => {
+          signal.addEventListener('abort', () => reject(signal.reason), { once: true })
+        })
+    )
+    const first = start()
+    await vi.waitFor(() => expect(spawn).toHaveBeenCalledOnce())
+    const second = start()
+    const results = Promise.allSettled([first, second])
+    cancelPendingLocalPtySpawns('pending-bun-shell')
+    expect(await results).toEqual([
+      { status: 'rejected', reason: new Error('PTY spawn canceled: pending-bun-shell') },
+      { status: 'rejected', reason: new Error('PTY spawn canceled: pending-bun-shell') }
+    ])
+    expect(spawn).toHaveBeenCalledOnce()
+    expect(activate).not.toHaveBeenCalled()
+  })
+
+  it('cleans a confirmed process when shutdown races the receipt continuation', async () => {
+    const proc = createProcess()
+    let release!: () => void
+    spawn.mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          release = () => resolve({ process: proc, shellPath: '/bin/sh' })
+        })
+    )
+    const first = start()
+    const rejected = expect(first).rejects.toThrow('PTY spawn canceled: pending-bun-shell')
+    await vi.waitFor(() => expect(spawn).toHaveBeenCalledOnce())
+    release()
+    cancelPendingLocalPtySpawns('pending-bun-shell')
+    await rejected
+    expect(proc.kill).toHaveBeenCalledWith('SIGKILL')
+    expect(destroy).toHaveBeenCalledWith(proc)
+    expect(activate).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/providers/local-pty-provider-spawn-session.test.ts b/src/main/providers/local-pty-provider-spawn-session.test.ts
index 9dfa08d81bf..cf523a469fc 100644
--- a/src/main/providers/local-pty-provider-spawn-session.test.ts
+++ b/src/main/providers/local-pty-provider-spawn-session.test.ts
@@ -53,6 +53,10 @@ vi.mock('node-pty', () => ({
   spawn: spawnMock
 }))
 
+vi.mock('../daemon/pty-subprocess/bun-pty-process-capabilities', () => ({
+  canUseBunPty: () => false
+}))
+
 vi.mock('./macos-tcc-login-shell', async (importOriginal) => ({
   ...(await importOriginal<typeof MacosTccLoginShell>()),
   prepareMacosTccLoginShell: prepareMacosTccLoginShellMock
@@ -115,6 +119,13 @@ vi.mock('../shell-prompt-readiness-probe', () => ({
 }))
 
 import { LocalPtyProvider } from './local-pty-provider'
+import {
+  pendingLocalPtySpawns,
+  ptyDisposables,
+  ptyExitDisposables,
+  ptyPhysicalExits,
+  startupIngressByPty
+} from './local-pty-provider-state'
 import {
   applyLocalPtyProviderMockDefaults,
   createLocalPtyMockProcess,
@@ -164,6 +175,42 @@ describe('LocalPtyProvider', () => {
       expect(typeof result.id).toBe('string')
     })
 
+    it('retires buffered output and synchronous Bun exit before replying to spawn', async () => {
+      const disposeData = vi.fn()
+      const disposeExit = vi.fn()
+      const onExit = vi.fn()
+      provider.configure({ onExit })
+      mockProc.onData.mockImplementation((listener: (data: string) => void) => {
+        listener('last output')
+        return { dispose: disposeData }
+      })
+      mockProc.onExit.mockImplementation((listener: (event: { exitCode: number }) => void) => {
+        listener({ exitCode: 17 })
+        return { dispose: disposeExit }
+      })
+      const result = await provider.spawn({
+        cols: 80,
+        rows: 24,
+        sessionId: 'already-exited-bun-shell',
+        command: 'must-not-run'
+      })
+      expect(result.exitedBeforeSpawnReply).toBe(true)
+      expect(provider.getPtyProcess(result.id)).toBeUndefined()
+      for (const map of [
+        ptyDisposables,
+        ptyExitDisposables,
+        ptyPhysicalExits,
+        startupIngressByPty
+      ]) {
+        expect(map.has(result.id)).toBe(false)
+      }
+      expect(disposeData).toHaveBeenCalledOnce()
+      expect(disposeExit).toHaveBeenCalledOnce()
+      expect(onExit).toHaveBeenCalledOnce()
+      await Promise.resolve()
+      expect(mockProc.write).not.toHaveBeenCalled()
+    })
+
     it('reattaches to an existing caller-supplied session id without spawning', async () => {
       const first = await provider.spawn({ cols: 80, rows: 24, sessionId: 'serve-session-1' })
       spawnMock.mockClear()
@@ -363,41 +410,154 @@ describe('LocalPtyProvider', () => {
       expect(spawnMock).not.toHaveBeenCalled()
     })
 
-    it('registers post-build preflight before a nested-microtask shutdown', async () => {
-      spawnMock.mockClear()
-      let finishEnvBuild!: () => void
-      const envProvider = new LocalPtyProvider({
-        buildSpawnEnv: (_id, baseEnv) =>
-          new Promise<Record<string, string>>((resolve) => {
-            finishEnvBuild = () => resolve(baseEnv)
-          })
-      })
-      const spawn = envProvider.spawn({
-        cols: 80,
-        rows: 24,
-        sessionId: 'resolved-env-build-session'
-      })
-      const canceledSpawn = expect(spawn).rejects.toThrow(
-        'PTY spawn canceled: resolved-env-build-session'
-      )
-      await vi.waitFor(() => expect(finishEnvBuild).toBeTypeOf('function'))
+    it.each([1, 2])(
+      'keeps cancellation registered across %i environment-resume microtasks',
+      async (microtasks) => {
+        spawnMock.mockClear()
+        let finishEnvBuild!: () => void
+        const envProvider = new LocalPtyProvider({
+          buildSpawnEnv: (_id, baseEnv) =>
+            new Promise<Record<string, string>>((resolve) => {
+              finishEnvBuild = () => resolve(baseEnv)
+            })
+        })
+        const spawn = envProvider.spawn({
+          cols: 80,
+          rows: 24,
+          sessionId: 'resolved-env-build-session'
+        })
+        const canceledSpawn = expect(spawn).rejects.toThrow(
+          'PTY spawn canceled: resolved-env-build-session'
+        )
+        await vi.waitFor(() => expect(finishEnvBuild).toBeTypeOf('function'))
 
-      finishEnvBuild()
-      const shutdown = new Promise<void>((resolve, reject) => {
-        queueMicrotask(() => {
-          queueMicrotask(() => {
+        finishEnvBuild()
+        const shutdown = new Promise<void>((resolve, reject) => {
+          const shutdown = () => {
             envProvider
               .shutdown('resolved-env-build-session', { immediate: true })
               .then(resolve, reject)
-          })
+          }
+          queueMicrotask(() => (microtasks === 1 ? shutdown() : queueMicrotask(shutdown)))
         })
-      })
 
-      await shutdown
-      await canceledSpawn
-      expect(spawnMock).not.toHaveBeenCalled()
+        await shutdown
+        await canceledSpawn
+        expect(spawnMock).not.toHaveBeenCalled()
+      }
+    )
+
+    it.each([1, 2])(
+      'settles final-preflight shutdown without a late PTY (%i microtasks)',
+      async (microtasks) => {
+        spawnMock.mockClear()
+        let finishPreparation!: () => void
+        prepareMacosTccLoginShellMock.mockImplementationOnce(
+          () =>
+            new Promise<void>((resolve) => {
+              finishPreparation = resolve
+            })
+        )
+        const id = 'preflight-resume-session'
+        const kill = mockProc.kill
+        let committed = false
+        const outcome = provider
+          .spawn({
+            cols: 80,
+            rows: 24,
+            sessionId: id,
+            onPtySpawnCommitted: () => {
+              committed = true
+            }
+          })
+          .then(
+            (result) => ({ ok: true as const, result }),
+            (error: unknown) => ({ ok: false as const, error })
+          )
+        await import('node-pty')
+        await vi.waitFor(() => expect(finishPreparation).toBeTypeOf('function'))
+        finishPreparation()
+        let committedAtShutdown = false
+        await new Promise<void>((resolve, reject) => {
+          const shutdown = () => {
+            committedAtShutdown = committed
+            provider.shutdown(id, { immediate: true }).then(resolve, reject)
+          }
+          queueMicrotask(() => (microtasks === 1 ? shutdown() : queueMicrotask(shutdown)))
+        })
+        const settled = await outcome
+        if (committedAtShutdown) {
+          expect(settled.ok).toBe(true)
+          expect(kill).toHaveBeenCalled()
+        } else {
+          expect(settled).toEqual({ ok: false, error: new Error(`PTY spawn canceled: ${id}`) })
+          expect(spawnMock.mock.calls.length).toBe(0)
+        }
+        expect(provider.getPtyProcess(id)).toBeUndefined()
+        expect(pendingLocalPtySpawns.has(id)).toBe(false)
+      }
+    )
+
+    it('cancels deferred shell availability before finalizing a launch plan', async () => {
+      spawnMock.mockClear()
+      Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+      let finishAvailability!: (available: boolean) => void
+      const buildSpawnEnv = vi.fn((_id: string, env: Record<string, string>) => env)
+      provider.configure({
+        getWindowsShell: () => 'powershell.exe',
+        getWindowsPowerShellImplementation: () => 'auto',
+        pwshAvailable: () =>
+          new Promise<boolean>((resolve) => {
+            finishAvailability = resolve
+          }),
+        buildSpawnEnv
+      })
+      const id = 'deferred-availability-session'
+      const spawn = provider.spawn({ cols: 80, rows: 24, sessionId: id })
+      const rejected = expect(spawn).rejects.toThrow(`PTY spawn canceled: ${id}`)
+      await provider.shutdown(id, { immediate: true })
+      finishAvailability(true)
+      await rejected
+      expect(buildSpawnEnv).not.toHaveBeenCalled()
+      expect(spawnMock.mock.calls.length).toBe(0)
+      expect(pendingLocalPtySpawns.has(id)).toBe(false)
     })
 
+    it.each(['synchronous environment', 'async environment', 'preflight'])(
+      'releases cancellation state after failed %s and allows a fresh retry',
+      async (phase) => {
+        spawnMock.mockClear()
+        const id = 'failed-preparation-session'
+        let fail = true
+        provider.configure({
+          buildSpawnEnv: (_id, env) => {
+            if (fail && phase === 'synchronous environment') {
+              throw new Error('preparation failed')
+            }
+            if (fail && phase === 'async environment') {
+              return Promise.reject(new Error('preparation failed'))
+            }
+            return env
+          }
+        })
+        if (phase === 'preflight') {
+          prepareMacosTccLoginShellMock.mockRejectedValueOnce(new Error('preparation failed'))
+        }
+        await expect(provider.spawn({ cols: 80, rows: 24, sessionId: id })).rejects.toThrow(
+          'preparation failed'
+        )
+        expect(pendingLocalPtySpawns.has(id)).toBe(false)
+        expect(spawnMock.mock.calls.length).toBe(0)
+        await provider.shutdown(id, { immediate: true })
+        fail = false
+        await expect(provider.spawn({ cols: 80, rows: 24, sessionId: id })).resolves.toMatchObject({
+          id
+        })
+        expect(spawnMock.mock.calls.length).toBe(1)
+        expect(pendingLocalPtySpawns.has(id)).toBe(false)
+      }
+    )
+
     it('coalesces a concurrent same-session-id spawn before launching a redundant shell (F3)', async () => {
       spawnMock.mockClear()
       const procA = { ...mockProc, pid: 1001 }
diff --git a/src/main/providers/local-pty-provider-state.ts b/src/main/providers/local-pty-provider-state.ts
index d38175c0d2b..10cef331a62 100644
--- a/src/main/providers/local-pty-provider-state.ts
+++ b/src/main/providers/local-pty-provider-state.ts
@@ -12,7 +12,7 @@ export type PtyShutdownOperation = {
 }
 
 export type PendingLocalPtySpawn = {
-  canceled: boolean
+  cancellation: AbortController
 }
 
 export type DataCallback = (payload: {
diff --git a/src/main/providers/local-pty-provider.ts b/src/main/providers/local-pty-provider.ts
index 8dad9843ab6..728e8a1273a 100644
--- a/src/main/providers/local-pty-provider.ts
+++ b/src/main/providers/local-pty-provider.ts
@@ -118,6 +118,8 @@ export class LocalPtyProvider implements IPtyProvider {
   clearBuffer(id: string): Promise<void> {
     return clearLocalPtyBuffer(id)
   }
+  // A direct PTY keeps no terminal model of its own.
+  async resetInputModes(_id: string): Promise<void> {}
   closeStartupQueryAuthority(id: string): number {
     return closeLocalPtyStartupQueryAuthority(id)
   }
@@ -132,20 +134,18 @@ export class LocalPtyProvider implements IPtyProvider {
   async inspectProcess(id: string): Promise<PtyProcessInspection> {
     const proc = ptyProcesses.get(id)
     const foregroundProcess = await getLocalPtyForegroundProcess(id)
-    // Both fields have to describe one PTY: cleanup plus reactivation across the await above would
-    // otherwise pair the old pane's identity with the replacement's children. The child read below
-    // is synchronous, so this recheck is the last point either answer can drift.
+    const childProcessEvidence = await inspectLocalPtyChildProcesses(id)
+    // Neither asynchronous inspection may publish a replacement pane's identity.
     if (ptyProcesses.get(id) !== proc) {
       return {
         foregroundProcess: null,
-        hasChildProcesses: false,
+        hasChildProcesses: true,
         childProcessEvidence: 'unverifiable'
       }
     }
-    const childProcessEvidence = inspectLocalPtyChildProcesses(id)
     return {
       foregroundProcess,
-      hasChildProcesses: childProcessEvidence === 'children',
+      hasChildProcesses: childProcessEvidence !== 'no-children',
       childProcessEvidence
     }
   }
diff --git a/src/main/providers/local-pty-runtime-spawn.ts b/src/main/providers/local-pty-runtime-spawn.ts
new file mode 100644
index 00000000000..7d3c26d90ad
--- /dev/null
+++ b/src/main/providers/local-pty-runtime-spawn.ts
@@ -0,0 +1,44 @@
+import { canUseBunPty, spawnBunPty } from '../daemon/pty-subprocess/bun-pty-process'
+import { spawnNativeDaemonPty } from '../daemon/pty-subprocess/native-pty-spawn'
+import {
+  spawnShellWithFallback,
+  type ShellSpawnParams,
+  type ShellSpawnResult
+} from './local-pty-utils'
+
+type LocalPtySpawn = (
+  params: Omit<ShellSpawnParams, 'ptySpawn'> & { signal?: AbortSignal }
+) => ShellSpawnResult | Promise<ShellSpawnResult>
+
+/** Degraded daemon routing uses the same runtime as the packaged host. */
+export async function loadLocalPtyRuntimeSpawn(): Promise<LocalPtySpawn> {
+  if (!canUseBunPty()) {
+    const pty = await import('node-pty')
+    return (params) => spawnShellWithFallback({ ...params, ptySpawn: pty.spawn })
+  }
+  if (process.platform === 'win32') {
+    return (params) =>
+      spawnNativeDaemonPty({
+        ...params,
+        spawnCwd: params.cwd,
+        windowsFallbackAttempts: params.windowsFallbackAttempts ?? []
+      })
+  }
+  return (params) =>
+    spawnShellWithFallback({
+      ...params,
+      ptySpawn(file, args = [], options = {}) {
+        if (!Array.isArray(args)) {
+          throw new Error('POSIX PTY arguments must be an array')
+        }
+        return spawnBunPty({
+          file,
+          args,
+          cwd: options.cwd ?? params.cwd,
+          env: params.env,
+          cols: options.cols ?? params.cols,
+          rows: options.rows ?? params.rows
+        })
+      }
+    })
+}
diff --git a/src/main/providers/local-pty-session-activation.ts b/src/main/providers/local-pty-session-activation.ts
index 71c633483db..e89f0c43316 100644
--- a/src/main/providers/local-pty-session-activation.ts
+++ b/src/main/providers/local-pty-session-activation.ts
@@ -122,8 +122,11 @@ export function activateLocalPtySession(args: {
   if (onDataDisposable) {
     disposables.push(onDataDisposable)
   }
+  ptyDisposables.set(id, disposables)
 
+  let exitedBeforeSpawnReply = false
   const onExitDisposable = proc.onExit(({ exitCode, signal }) => {
+    exitedBeforeSpawnReply = true
     // Why: node-pty reports a signalled death as {exitCode: 0, signal: N}; the
     // cause is built here, where the signal and the spawn's trustworthiness
     // are both still in hand.
@@ -151,14 +154,18 @@ export function activateLocalPtySession(args: {
     }
   })
   if (onExitDisposable) {
-    ptyExitDisposables.set(id, onExitDisposable)
+    if (exitedBeforeSpawnReply) {
+      onExitDisposable.dispose()
+    } else {
+      ptyExitDisposables.set(id, onExitDisposable)
+    }
   }
-  ptyDisposables.set(id, disposables)
 
   const startupCommandDeliveredByWrapper =
     spawn.command !== undefined &&
     plan.shellReadyLaunch?.env[POSIX_SHELL_STARTUP_COMMAND_ENV] === spawn.command
   if (
+    !exitedBeforeSpawnReply &&
     spawn.command &&
     !plan.startupCommandDeliveredInShellArgs &&
     !startupCommandDeliveredByWrapper
@@ -191,6 +198,7 @@ export function activateLocalPtySession(args: {
     id,
     incarnationId,
     pid,
+    ...(exitedBeforeSpawnReply ? { exitedBeforeSpawnReply: true } : {}),
     ...(spawnedWslDistro !== undefined ? { wslDistro: spawnedWslDistro } : {})
   }
 }
diff --git a/src/main/providers/local-pty-session-operations.ts b/src/main/providers/local-pty-session-operations.ts
index 37e77081206..27a151580ce 100644
--- a/src/main/providers/local-pty-session-operations.ts
+++ b/src/main/providers/local-pty-session-operations.ts
@@ -3,6 +3,7 @@ import { basename } from 'node:path'
 import type * as pty from 'node-pty'
 import { readPtsName } from '../pty/node-pty-pts-name'
 import { signalPosixPtyForegroundGroup } from '../pty/posix-pty-foreground-group'
+import { ptyShellProcessId } from '../windows/windows-pty-job'
 import { isWslAvailableAsync } from '../wsl'
 import { resolveGitBashPath } from '../git-bash'
 import { resolveProcessCwd } from './process-cwd'
@@ -74,6 +75,10 @@ export async function sendLocalPtySignal(id: string, signal: string): Promise<vo
   if (!proc) {
     return
   }
+  if ('signalProcess' in proc && typeof proc.signalProcess === 'function') {
+    proc.signalProcess(signal)
+    return
+  }
   const signalRootPid = (): void => {
     try {
       process.kill(proc.pid, signal)
@@ -97,7 +102,8 @@ export async function getLocalPtyCwd(id: string): Promise<string> {
     return ''
   }
   // Why: let resolveProcessCwd's '' surface for the renderer fallback chain; a fabricated cwd would short-circuit it.
-  return resolveProcessCwd(proc.pid)
+  const shellPid = ptyShellProcessId(proc)
+  return shellPid === undefined ? '' : resolveProcessCwd(shellPid)
 }
 
 export async function clearLocalPtyBuffer(id: string): Promise<void> {
diff --git a/src/main/providers/local-pty-shell-ready-bash-rcfile.ts b/src/main/providers/local-pty-shell-ready-bash-rcfile.ts
index f752b75f67a..877fdda3bcc 100644
--- a/src/main/providers/local-pty-shell-ready-bash-rcfile.ts
+++ b/src/main/providers/local-pty-shell-ready-bash-rcfile.ts
@@ -5,6 +5,7 @@
  * startup-file chain, OSC 133 hooks, and the shell-ready marker all live here.
  */
 import { BASH_PROMPT_COMMAND_COMPOSITION_BLOCK } from '../bash-prompt-command-composition'
+import { WSL_MANAGED_CLI_PATH_RESTORE } from '../wsl-managed-cli-path-restore'
 import { getPosixOmpShellWrapper } from '../pty/omp-shell-wrapper'
 import { getPosixCodexShellLaunchPreflight } from '../pty/codex-shell-launch-preflight'
 import { getBashStartupCommandPromptBlock } from '../pty/posix-shell-startup-command'
@@ -45,6 +46,7 @@ __orca_restore_agent_teams_path() {
   export PATH="\${ORCA_AGENT_TEAMS_SHIM_DIR}:$PATH"
 }
 __orca_restore_agent_teams_path
+${WSL_MANAGED_CLI_PATH_RESTORE}
 # Why: user startup files may set the default OpenCode config after Orca's
 # spawn env; restore the Orca-managed config dir before the first prompt.
 [[ -n "\${ORCA_OPENCODE_CONFIG_DIR:-}" ]] && export OPENCODE_CONFIG_DIR="\${ORCA_OPENCODE_CONFIG_DIR}"
diff --git a/src/main/providers/local-pty-shell-ready-wrapper-fileset.ts b/src/main/providers/local-pty-shell-ready-wrapper-fileset.ts
index f0e3f792fc0..528dd6ee149 100644
--- a/src/main/providers/local-pty-shell-ready-wrapper-fileset.ts
+++ b/src/main/providers/local-pty-shell-ready-wrapper-fileset.ts
@@ -24,10 +24,10 @@ export function getLocalZshWrapperSpec(): ZshStartupHookSpec {
     overlayRestoreComment:
       "# Why: ~/.zshrc can export the user's default OpenCode config after spawn.",
     restores: {
+      managedWslCli: true,
       agentTeamsPath: true,
       remoteCliBinDir: false,
-      codexHome: true,
-      codexLaunchPreflight: true
+      codexHome: true
     }
   }
 }
diff --git a/src/main/providers/local-pty-spawn-environment.ts b/src/main/providers/local-pty-spawn-environment.ts
index 8290baa3dc3..645fcacb2d0 100644
--- a/src/main/providers/local-pty-spawn-environment.ts
+++ b/src/main/providers/local-pty-spawn-environment.ts
@@ -8,10 +8,10 @@ import { stripInheritedBuildModeEnv } from '../pty/build-mode-env'
 import { stripPiProcessOwnerEnv } from '../pty/pi-process-owner-env'
 import { removeInheritedNoColor } from '../pty/terminal-color-env'
 import { isWindowsGitBashShellPath } from '../git-bash'
+import { applyScrubSafeAgentEnvAliases } from '../../shared/agent-hook-scrub-safe-env'
 import { removeUnspecifiedPaneIdentityEnv } from './local-pty-launch-helpers'
 import type { LocalPtyLaunchPlan } from './local-pty-launch-plan'
 import type { LocalPtyProviderOptions } from './local-pty-provider-types'
-import { awaitCancelableLocalPtySpawn } from './local-pty-spawn-state'
 import type { PtySpawnOptions } from './types'
 
 /** Pane ownership must be fresh even when Orca itself was launched inside an agent. */
@@ -43,6 +43,8 @@ export function buildLocalPtySpawnEnvironment(args: {
   if (spawn.env?.TERM) {
     spawnEnv.TERM = spawn.env.TERM
   }
+  // Why after the strips and deletes: an alias must never outlive the value it mirrors.
+  applyScrubSafeAgentEnvAliases(spawnEnv)
 
   spawnEnv.LANG ??= 'en_US.UTF-8'
 
@@ -58,21 +60,16 @@ export function buildLocalPtySpawnEnvironment(args: {
   if (!getOptions().buildSpawnEnv) {
     return spawnEnv
   }
-  // Why (#16441): building the env now awaits Codex hook installs and trust
-  // grants, so shutdown must be able to cancel this session id here too.
-  return awaitCancelableLocalPtySpawn(
-    id,
-    getOptions().buildSpawnEnv!(id, spawnEnv, {
-      explicitEnv: spawn.env ?? {},
-      command: spawn.command,
-      launchAgent: spawn.launchAgent,
-      codexHomePathOverride: spawn.codexHomePathOverride,
-      cwd: plan.cwd,
-      shellPath: plan.shellPath,
-      isWsl: plan.isWslShell,
-      wslDistro: plan.launchWslDistro
-    })
-  )
+  return getOptions().buildSpawnEnv!(id, spawnEnv, {
+    explicitEnv: spawn.env ?? {},
+    command: spawn.command,
+    launchAgent: spawn.launchAgent,
+    codexHomePathOverride: spawn.codexHomePathOverride,
+    cwd: plan.cwd,
+    shellPath: plan.shellPath,
+    isWsl: plan.isWslShell,
+    wslDistro: plan.launchWslDistro
+  })
 }
 
 /** App-level env builders can reintroduce deleted keys; enforce isolation after they finish. */
diff --git a/src/main/providers/local-pty-spawn-state.ts b/src/main/providers/local-pty-spawn-state.ts
index 2ab145f6c39..d73d230f68b 100644
--- a/src/main/providers/local-pty-spawn-state.ts
+++ b/src/main/providers/local-pty-spawn-state.ts
@@ -7,22 +7,34 @@ import {
   type PendingLocalPtySpawn
 } from './local-pty-provider-state'
 
-/** Awaits pre-launch work that shutdown must be able to cancel: no node-pty
- *  process exists yet, so cancellation can only be observed after the await. */
-export async function awaitCancelableLocalPtySpawn<T>(
+const spawnReservations = new Map<string, Promise<unknown>>()
+
+/** A Windows shell receipt can arrive after another request reaches the same native spawn. */
+export async function reserveLocalPtySpawn<T>(id: string, operation: () => Promise<T>): Promise<T> {
+  const previous = spawnReservations.get(id)
+  const pending = previous ? previous.catch(() => {}).then(operation) : operation()
+  spawnReservations.set(id, pending)
+  try {
+    return await pending
+  } finally {
+    if (spawnReservations.get(id) === pending) {
+      spawnReservations.delete(id)
+    }
+  }
+}
+
+/** Keep shutdown visible between awaits until the native process is registered. */
+export async function runCancelableLocalPtySpawn<T>(
   id: string,
-  operation: T | Promise<T>
+  operation: (throwIfCanceled: () => void, signal: AbortSignal) => Promise<T>
 ): Promise<T> {
-  const pendingSpawn: PendingLocalPtySpawn = { canceled: false }
+  const cancellation = new AbortController()
+  const pendingSpawn: PendingLocalPtySpawn = { cancellation }
   const pending = pendingLocalPtySpawns.get(id) ?? new Set()
   pending.add(pendingSpawn)
   pendingLocalPtySpawns.set(id, pending)
   try {
-    const result = await operation
-    if (pendingSpawn.canceled) {
-      throw new Error(`PTY spawn canceled: ${id}`)
-    }
-    return result
+    return await operation(() => cancellation.signal.throwIfAborted(), cancellation.signal)
   } finally {
     pending.delete(pendingSpawn)
     if (pending.size === 0) {
@@ -37,7 +49,7 @@ export function cancelPendingLocalPtySpawns(id: string): void {
     return
   }
   for (const pendingSpawn of pending) {
-    pendingSpawn.canceled = true
+    pendingSpawn.cancellation.abort(new Error(`PTY spawn canceled: ${id}`))
   }
 }
 
diff --git a/src/main/providers/local-pty-spawn.ts b/src/main/providers/local-pty-spawn.ts
index 19436a8c405..cc3c39979a8 100644
--- a/src/main/providers/local-pty-spawn.ts
+++ b/src/main/providers/local-pty-spawn.ts
@@ -1,6 +1,5 @@
 import { randomUUID } from 'node:crypto'
 import { win32 as pathWin32 } from 'node:path'
-import * as pty from 'node-pty'
 import { SessionNotFoundError } from '../daemon/daemon-errors'
 import { prepareMacosTccLoginShell } from './macos-tcc-login-shell'
 import { finalizeLocalPtySpawnEnvironment } from './local-pty-finalize-environment'
@@ -13,9 +12,14 @@ import {
   buildLocalPtySpawnEnvironment,
   enforceLocalPtySpawnEnvironmentOverrides
 } from './local-pty-spawn-environment'
-import { awaitCancelableLocalPtySpawn, reattachLocalPty } from './local-pty-spawn-state'
-import { spawnShellWithFallback } from './local-pty-utils'
-import { updateHistoryEnvForFallback, type HistoryInjectionResult } from '../terminal-history'
+import {
+  runCancelableLocalPtySpawn,
+  reattachLocalPty,
+  reserveLocalPtySpawn
+} from './local-pty-spawn-state'
+import { loadLocalPtyRuntimeSpawn } from './local-pty-runtime-spawn'
+import { destroyPtyProcess } from './local-pty-termination'
+import { updateHistoryEnvForFallback } from '../terminal-history'
 import type { PtySpawnOptions, PtySpawnResult } from './types'
 
 export async function spawnLocalPty(
@@ -37,86 +41,108 @@ export async function spawnLocalPty(
     throw new SessionNotFoundError(args.sessionId ?? '')
   }
   const id = allocatePtyId(reattachId ?? undefined)
-  const incarnationId = randomUUID()
-  const planResult = createLocalPtyLaunchPlan(args, getOptions)
-  const plan =
-    planResult instanceof DeferredLocalPtyLaunchPlan
-      ? planResult.finish(await planResult.availability)
-      : planResult
-  const envResult = buildLocalPtySpawnEnvironment({
-    id,
-    spawn: args,
-    getOptions,
-    plan
-  })
-  const finalEnv = envResult instanceof Promise ? await envResult : envResult
-  enforceLocalPtySpawnEnvironmentOverrides(args, finalEnv)
-  const historyResult = finalizeLocalPtySpawnEnvironment({
-    spawn: args,
-    getOptions,
-    plan,
-    env: finalEnv
-  })
+  return runCancelableLocalPtySpawn(id, async (throwIfCanceled, cancellation) => {
+    const incarnationId = randomUUID()
+    let plan = createLocalPtyLaunchPlan(args, getOptions)
+    if (plan instanceof DeferredLocalPtyLaunchPlan) {
+      const available = await plan.availability
+      throwIfCanceled()
+      plan = plan.finish(available)
+    }
+    throwIfCanceled()
+    const envResult = buildLocalPtySpawnEnvironment({
+      id,
+      spawn: args,
+      getOptions,
+      plan
+    })
+    const finalEnv = envResult instanceof Promise ? await envResult : envResult
+    throwIfCanceled()
+    enforceLocalPtySpawnEnvironmentOverrides(args, finalEnv)
+    const historyResult = finalizeLocalPtySpawnEnvironment({
+      spawn: args,
+      getOptions,
+      plan,
+      env: finalEnv
+    })
 
-  // Why: the async macOS capability probe runs before node-pty exists.
-  await awaitCancelableLocalPtySpawn(id, prepareMacosTccLoginShell())
-  if (args.signal?.aborted) {
-    throw new Error('client_disconnected')
-  }
-  // Why: another same-id request can win while this one awaits preflight; attach before launching a redundant shell.
-  const concurrentWinner = reattachId ? reattachLocalPty(id, args.cols, args.rows) : null
-  if (concurrentWinner) {
-    return concurrentWinner
-  }
-  const spawnResult = spawnShellWithFallback({
-    shellPath: plan.shellPath,
-    shellArgs: plan.shellArgs,
-    cols: args.cols,
-    rows: args.rows,
-    cwd: plan.effectiveCwd,
-    env: finalEnv,
-    termName: finalEnv.TERM,
-    ptySpawn: pty.spawn,
-    getShellReadyConfig: plan.getFallbackShellReadyConfig,
-    launchEnvKeys: plan.primaryLaunchEnvKeys,
-    // Why: on zsh→bash fallback HISTFILE still points to zsh_history; update before spawn so the child inherits it (design doc §8).
-    onBeforeFallbackSpawn: historyResult?.historyDir
-      ? (env, fallbackShell) =>
-          updateHistoryEnvForFallback(env, fallbackShell, historyResult as HistoryInjectionResult)
-      : undefined,
-    windowsFallbackAttempts: plan.windowsFallbackAttempts
-  })
-  args.onPtySpawnCommitted?.()
-  plan.shellPath = spawnResult.shellPath
-  // Why: a Windows fallback embeds its startup command in argv; honor the winning shell's delivery flag to avoid a double write.
-  if (spawnResult.startupCommandDeliveredInShellArgs !== undefined) {
-    plan.startupCommandDeliveredInShellArgs = spawnResult.startupCommandDeliveredInShellArgs
-  }
-  if (args.command && plan.getFallbackShellReadyConfig) {
-    plan.shellReadyLaunch = plan.getFallbackShellReadyConfig(plan.shellPath)
-  }
+    const fallbackHistory = historyResult?.historyDir ? historyResult : undefined
+    const [spawn] = await Promise.all([loadLocalPtyRuntimeSpawn(), prepareMacosTccLoginShell()])
+    return reserveLocalPtySpawn(id, async () => {
+      const checkCanceled = (): void => {
+        throwIfCanceled()
+        if (args.signal?.aborted) {
+          throw new Error('client_disconnected')
+        }
+      }
+      checkCanceled()
+      // Why: another same-id request can win while this one awaits preflight; attach before launching a redundant shell.
+      const concurrentWinner = reattachId ? reattachLocalPty(id, args.cols, args.rows) : null
+      if (concurrentWinner) {
+        return concurrentWinner
+      }
+      const pendingSpawn = spawn({
+        shellPath: plan.shellPath,
+        shellArgs: plan.shellArgs,
+        cols: args.cols,
+        rows: args.rows,
+        cwd: plan.effectiveCwd,
+        env: finalEnv,
+        termName: finalEnv.TERM,
+        signal: args.signal ? AbortSignal.any([args.signal, cancellation]) : cancellation,
+        getShellReadyConfig: plan.getFallbackShellReadyConfig,
+        launchEnvKeys: plan.primaryLaunchEnvKeys,
+        // Why: on zsh→bash fallback HISTFILE still points to zsh_history; update before spawn so the child inherits it (design doc §8).
+        onBeforeFallbackSpawn: fallbackHistory
+          ? (env, fallbackShell) => updateHistoryEnvForFallback(env, fallbackShell, fallbackHistory)
+          : undefined,
+        windowsFallbackAttempts: plan.windowsFallbackAttempts
+      })
+      const spawnResult = pendingSpawn instanceof Promise ? await pendingSpawn : pendingSpawn
+      try {
+        checkCanceled()
+      } catch (error) {
+        try {
+          spawnResult.process.kill('SIGKILL')
+        } finally {
+          destroyPtyProcess(spawnResult.process)
+        }
+        throw error
+      }
+      args.onPtySpawnCommitted?.()
+      plan.shellPath = spawnResult.shellPath
+      // Why: a Windows fallback embeds its startup command in argv; honor the winning shell's delivery flag to avoid a double write.
+      if (spawnResult.startupCommandDeliveredInShellArgs !== undefined) {
+        plan.startupCommandDeliveredInShellArgs = spawnResult.startupCommandDeliveredInShellArgs
+      }
+      if (args.command && plan.getFallbackShellReadyConfig) {
+        plan.shellReadyLaunch = plan.getFallbackShellReadyConfig(plan.shellPath)
+      }
 
-  if (process.platform !== 'win32') {
-    finalEnv.SHELL = plan.shellPath
-  }
+      if (process.platform !== 'win32') {
+        finalEnv.SHELL = plan.shellPath
+      }
 
-  const proc = spawnResult.process
-  const spawnedShellIsWsl =
-    process.platform === 'win32' && pathWin32.basename(plan.shellPath).toLowerCase() === 'wsl.exe'
-  const spawnedWslDistro = spawnedShellIsWsl
-    ? (plan.launchWslDistro ?? undefined)
-    : process.platform === 'win32'
-      ? null
-      : undefined
-  return activateLocalPtySession({
-    id,
-    incarnationId,
-    spawn: args,
-    getOptions,
-    plan,
-    env: finalEnv,
-    proc,
-    reportsChildExitStatus: spawnResult.reportsChildExitStatus !== false,
-    spawnedWslDistro
+      const proc = spawnResult.process
+      const spawnedShellIsWsl =
+        process.platform === 'win32' &&
+        pathWin32.basename(plan.shellPath).toLowerCase() === 'wsl.exe'
+      const spawnedWslDistro = spawnedShellIsWsl
+        ? (plan.launchWslDistro ?? undefined)
+        : process.platform === 'win32'
+          ? null
+          : undefined
+      return activateLocalPtySession({
+        id,
+        incarnationId,
+        spawn: args,
+        getOptions,
+        plan,
+        env: finalEnv,
+        proc,
+        reportsChildExitStatus: spawnResult.reportsChildExitStatus !== false,
+        spawnedWslDistro
+      })
+    })
   })
 }
diff --git a/src/main/providers/local-pty-utils.ts b/src/main/providers/local-pty-utils.ts
index 735393449f2..8009260923d 100644
--- a/src/main/providers/local-pty-utils.ts
+++ b/src/main/providers/local-pty-utils.ts
@@ -2,6 +2,7 @@ import { basename, isAbsolute, join } from 'node:path'
 import { existsSync, accessSync, statSync, chmodSync, constants as fsConstants } from 'node:fs'
 import type * as pty from 'node-pty'
 import { usesNodePtySpawnHelper } from '../../shared/node-pty-spawn-helper'
+import { TERMINAL_SPAWN_ISSUE_REQUEST } from '../../shared/terminal-spawn-error-copy'
 import {
   hostReportsChildExitStatus,
   wrapShellSpawnForMacosTccAttribution
@@ -307,7 +308,6 @@ export function spawnShellWithFallback(params: ShellSpawnParams): ShellSpawnResu
 
   const diag = formatLocalPtyEnvironmentDiag({ shell: shellPath, cwd })
   throw new Error(
-    `Failed to spawn shell "${shellPath}": ${primaryError ?? 'unknown error'} (${diag}). ` +
-      `If this persists, please file an issue.`
+    `Failed to spawn shell "${shellPath}": ${primaryError ?? 'unknown error'} (${diag}). ${TERMINAL_SPAWN_ISSUE_REQUEST}`
   )
 }
diff --git a/src/main/providers/provider-dispatch.test.ts b/src/main/providers/provider-dispatch.test.ts
index cc63cfb9d09..7ac956b70fd 100644
--- a/src/main/providers/provider-dispatch.test.ts
+++ b/src/main/providers/provider-dispatch.test.ts
@@ -49,7 +49,16 @@ vi.mock('node-pty', () => ({
 }))
 
 vi.mock('../opencode/hook-service', () => ({
-  openCodeHookService: { buildPtyEnv: () => ({}), clearPty: vi.fn() }
+  openCodeHookService: {
+    buildPtyEnv: () => ({}),
+    refreshLegacySharedPlugin: vi.fn(),
+    clearPty: vi.fn()
+  },
+  openCode2HookService: {
+    buildPtyEnv: () => ({}),
+    refreshLegacySharedPlugin: vi.fn(),
+    clearPty: vi.fn()
+  }
 }))
 
 vi.mock('../pi/titlebar-extension-service', () => ({
@@ -109,6 +118,7 @@ describe('PTY provider dispatch', () => {
       getCwd: vi.fn(),
       getInitialCwd: vi.fn(),
       clearBuffer: vi.fn(),
+      resetInputModes: vi.fn(),
       acknowledgeDataEvent: vi.fn(),
       hasChildProcesses: vi.fn(),
       getForegroundProcess: vi.fn(),
@@ -155,8 +165,8 @@ describe('PTY provider dispatch', () => {
     })) as { id: string }
 
     expect(result.id).toBe('ssh-pty-1')
-    // Why: the relay host can be launched from a Claude session too, so the stamps are
-    // stripped on the SSH path as well. Compared as a set — envToDelete is consumed by
+    // Why: the relay host can be launched from a Claude or structured session too, so the
+    // stamps are stripped on the SSH path as well; a remote pane never names a local session. Compared as a set — envToDelete is consumed by
     // membership only, so a reordering of the merge sources must not fail this.
     const sshSpawnArgs = vi.mocked(mockSshProvider.spawn).mock.calls.at(-1)![0]
     expect([...(sshSpawnArgs.envToDelete ?? [])].sort()).toEqual(
@@ -167,7 +177,9 @@ describe('PTY provider dispatch', () => {
         'CLAUDE_CODE_BRIDGE_SESSION_ID',
         'ORCA_PI_STATUS_OWNED',
         'ORCA_PRIME_AGENT_STATUS_OWNED',
-        'ORCA_PI_TITLE_MARKER_OWNED'
+        'ORCA_PI_TITLE_MARKER_OWNED',
+        'ORCA_AGENT_SESSION_ID',
+        'ORCA_STRUCTURED_SESSION'
       ].sort()
     )
     expect(mockSshProvider.spawn).toHaveBeenCalledWith(
diff --git a/src/main/providers/pty-provider-contract.ts b/src/main/providers/pty-provider-contract.ts
index 4b31fbbb2c8..0d9b525e88d 100644
--- a/src/main/providers/pty-provider-contract.ts
+++ b/src/main/providers/pty-provider-contract.ts
@@ -1,4 +1,5 @@
 import type { TuiAgent } from '../../shared/tui-agent'
+import type { AgentWorkspaceTrustSpawnRequest } from '../../shared/agent-workspace-trust-spawn-request'
 import type { PtyStartupIngressIntent } from '../../shared/pty-startup-ingress'
 import type { StartupCommandDelivery } from '../../shared/codex-startup-delivery'
 import type { TerminalOscLinkRange } from '../../shared/terminal-osc-link-ranges'
@@ -77,6 +78,8 @@ export type PtySpawnOptions = {
   isNewSession?: boolean
   /** Host setting forwarded additively to the process owner; old owners ignore it. */
   historyIsolationEnabled?: boolean
+  /** SSH only: workspace the relay pre-trusts for `launchAgent` before spawning; old relays ignore it. */
+  agentWorkspaceTrust?: AgentWorkspaceTrustSpawnRequest
   /** Attach the named session atomically or fail without creating a process. */
   attachOnly?: boolean
   /** Exact persisted owner expected by an attach-only routing decision. */
@@ -224,6 +227,8 @@ export type IPtyProvider = {
   getCwd(id: string): Promise<string>
   getInitialCwd(id: string): Promise<string>
   clearBuffer(id: string): Promise<void>
+  /** Grounds the host's own terminal models (Reset Terminal); renderers ground themselves. */
+  resetInputModes(id: string): Promise<void>
   /** Ordered handoff from startup source authority to the live/hidden view authority. */
   closeStartupQueryAuthority?: (id: string) => Promise<number> | number
   acknowledgeDataEvent(id: string, charCount: number): void
diff --git a/src/main/providers/pty-spawn-result.ts b/src/main/providers/pty-spawn-result.ts
index 90b41d9656a..2886a00e8b6 100644
--- a/src/main/providers/pty-spawn-result.ts
+++ b/src/main/providers/pty-spawn-result.ts
@@ -52,8 +52,8 @@ export type PtySpawnResult = {
   }
   /** Kitty keyboard flags persisted in the daemon snapshot, threaded so the
    *  re-seeded runtime emulator answers hidden `CSI ? u` with the real flags
-   *  (terminal-query-authority.md §kitty). Never replayed into a renderer
-   *  xterm — POST_REPLAY_REATTACH_RESET's kitty reset stays authoritative. */
+   *  (terminal-query-authority.md §kitty). Renderers re-assert them in their
+   *  replay epilogue, after the payload's screen switches. */
   snapshotKittyKeyboardFlags?: number
   /** Renderer-domain sequence main reconciled for the attach boundary those
    *  flags describe. Set by main, not the provider. */
diff --git a/src/main/providers/settled-pty-writer-census.test.ts b/src/main/providers/settled-pty-writer-census.test.ts
deleted file mode 100644
index 08dd9989400..00000000000
--- a/src/main/providers/settled-pty-writer-census.test.ts
+++ /dev/null
@@ -1,94 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { execFileSync } from 'node:child_process'
-import { describe, expect, it, vi } from 'vitest'
-import { LocalPtyProvider } from './local-pty-provider'
-import { SshPtyProvider } from './ssh-pty-provider'
-import { createMockMux } from './ssh-pty-provider-mock-multiplexer'
-import { DaemonPtyRouter } from '../daemon/daemon-pty-router'
-import { DegradedDaemonPtyProvider } from '../daemon/degraded-daemon-pty-provider'
-import { DaemonPtyAdapter } from '../daemon/daemon-pty-adapter'
-
-vi.mock('electron', () => ({
-  app: { getPath: vi.fn(() => '/tmp'), isPackaged: false },
-  BrowserWindow: { fromId: vi.fn(() => null) },
-  ipcMain: { on: vi.fn(), removeListener: vi.fn() },
-  webContents: { fromId: vi.fn(() => null) }
-}))
-
-const REPO_ROOT = join(__dirname, '..', '..', '..')
-
-/**
- * Requiring the method is satisfiable by a lie: the degraded daemon router used to answer it
- * with `provider.write(...) !== false`, reproducing the fire-and-forget bug through the fix.
- * The census pins the producers and reads their bodies, so a new provider or a revived
- * fabricated handoff fails here rather than silently clearing a mailbox reservation.
- */
-const SETTLED_PTY_WRITER_FILES = [
-  'src/main/providers/local-pty-provider.ts',
-  'src/main/providers/ssh-pty-provider.ts',
-  'src/main/daemon/daemon-pty-router.ts',
-  'src/main/daemon/degraded-daemon-pty-provider.ts',
-  'src/main/daemon/daemon-pty-adapter.ts'
-]
-
-/** Where the provider-side settlement is actually decided; the adapter inherits its own. */
-const SETTLED_WRITER_DECLARATIONS = [
-  'src/main/providers/local-pty-provider.ts',
-  'src/main/providers/ssh-pty-provider.ts',
-  'src/main/providers/ssh-pty-provider-rpc-operations.ts',
-  'src/main/daemon/daemon-pty-router.ts',
-  'src/main/daemon/degraded-daemon-pty-provider.ts',
-  'src/main/daemon/daemon-pty-session-input.ts'
-]
-
-function declaredProviderFiles(): string[] {
-  const output = execFileSync('git', ['grep', '-l', '--', 'implements IPtyProvider', 'src/main'], {
-    cwd: REPO_ROOT,
-    encoding: 'utf8'
-  })
-  // Tests may name the clause while pinning it; only production declarations count.
-  return output
-    .split('\n')
-    .filter((file) => file && !file.endsWith('.test.ts'))
-    .sort()
-}
-
-function settledWriterBody(file: string): string {
-  const source = readFileSync(join(REPO_ROOT, file), 'utf8')
-  const start = source.indexOf('writeWithSettlement')
-  expect(start, `${file} declares no settled writer`).toBeGreaterThan(-1)
-  const end = source.indexOf('\n  }', start)
-  return source.slice(start, end === -1 ? source.length : end)
-}
-
-describe('settled PTY writer census', () => {
-  it('covers every production provider class that declares IPtyProvider', () => {
-    expect(declaredProviderFiles()).toEqual([...SETTLED_PTY_WRITER_FILES].sort())
-  })
-
-  it('exposes a settled writer on every production provider instance', () => {
-    const daemonClient = { isConnected: () => false, onEvent: vi.fn(() => vi.fn()) }
-    const adapter = new DaemonPtyAdapter(daemonClient as never)
-    const instances = [
-      new LocalPtyProvider({} as never),
-      new SshPtyProvider('conn-census', createMockMux() as never),
-      new DaemonPtyRouter({ current: adapter, legacy: [] }),
-      new DegradedDaemonPtyProvider({
-        current: adapter,
-        legacy: [],
-        fallback: new LocalPtyProvider({} as never)
-      }),
-      adapter
-    ]
-    for (const provider of instances) {
-      expect(typeof provider.writeWithSettlement, provider.constructor.name).toBe('function')
-    }
-  })
-
-  it('never synthesizes a settlement from the fire-and-forget write', () => {
-    for (const file of SETTLED_WRITER_DECLARATIONS) {
-      expect(settledWriterBody(file), file).not.toMatch(/\.write\(/)
-    }
-  })
-})
diff --git a/src/main/providers/ssh-filesystem-provider.test.ts b/src/main/providers/ssh-filesystem-provider.test.ts
index a20dfb98d9b..0917c4cf81a 100644
--- a/src/main/providers/ssh-filesystem-provider.test.ts
+++ b/src/main/providers/ssh-filesystem-provider.test.ts
@@ -527,18 +527,6 @@ describe('SshFilesystemProvider', () => {
   })
 
   describe('watch', () => {
-    it('sends fs.watch request and returns unsubscribe', async () => {
-      const callback = vi.fn()
-      const unsub = await provider.watch('/home/user/project', callback)
-
-      expect(mux.request).toHaveBeenCalledWith(
-        'fs.watch',
-        { rootPath: '/home/user/project', watchId: expect.any(Number) },
-        { signal: expect.any(AbortSignal) }
-      )
-      expect(typeof unsub).toBe('function')
-    })
-
     it('uses a registration-owned cancellation signal for the mux fs.watch request', async () => {
       mux.request.mockResolvedValue(undefined)
       const controller = new AbortController()
diff --git a/src/main/providers/ssh-git-noninteractive-provider.ts b/src/main/providers/ssh-git-noninteractive-provider.ts
index ee60b254134..0550b1bba39 100644
--- a/src/main/providers/ssh-git-noninteractive-provider.ts
+++ b/src/main/providers/ssh-git-noninteractive-provider.ts
@@ -27,6 +27,7 @@ export class SshGitNoninteractiveProvider extends SshGitReadProvider {
         args: plan.args,
         cwd,
         stdin: plan.stdinPayload,
+        ...(plan.env ? { env: plan.env } : {}),
         timeoutMs,
         operation
       },
diff --git a/src/main/providers/ssh-git-provider-commit-message.test.ts b/src/main/providers/ssh-git-provider-commit-message.test.ts
index 41a5003946d..be024b643c8 100644
--- a/src/main/providers/ssh-git-provider-commit-message.test.ts
+++ b/src/main/providers/ssh-git-provider-commit-message.test.ts
@@ -163,7 +163,8 @@ describe('SshGitProvider', () => {
         binary: 'codex',
         args: ['exec', 'PROMPT'],
         stdinPayload: null,
-        label: 'Codex'
+        label: 'Codex',
+        env: { FLAG: 'literal $HOME' }
       },
       '/home/user/repo',
       60_000
@@ -176,6 +177,7 @@ describe('SshGitProvider', () => {
         args: ['exec', 'PROMPT'],
         cwd: '/home/user/repo',
         stdin: null,
+        env: { FLAG: 'literal $HOME' },
         timeoutMs: 60_000,
         operation: 'commit-message'
       },
diff --git a/src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts b/src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts
index e088b21f025..61b0293f25b 100644
--- a/src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts
+++ b/src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts
@@ -57,18 +57,30 @@ function requestPayloads(transport: ReturnType<typeof createTransport>): Record<
   })
 }
 
+// Why a macrotask yield: FrameDecoder stops after FRAME_DECODER_MAX_TURN_MS of decoding and
+// resumes the rest of the fed bytes from setImmediate, and feed() refuses to drain while that
+// continuation is pending. Under load a delivered response can therefore only be decoded a
+// macrotask later, which a microtask-only poll can never reach. Matches waitForRequestCount in
+// ssh-git-provider-test-harness.
+async function waitForValue<T>(produce: () => T | undefined, what: string): Promise<T> {
+  for (let turn = 0; turn < 20; turn += 1) {
+    const value = produce()
+    if (value !== undefined) {
+      return value
+    }
+    await new Promise<void>((resolve) => setTimeout(resolve, 0))
+  }
+  throw new Error(`never observed: ${what}`)
+}
+
 async function waitForRequest(
   transport: ReturnType<typeof createTransport>,
   method: string
 ): Promise<Record<string, unknown>> {
-  for (let turn = 0; turn < 10; turn += 1) {
-    const request = requestPayloads(transport).find((payload) => payload.method === method)
-    if (request) {
-      return request
-    }
-    await Promise.resolve()
-  }
-  throw new Error(`request not dispatched: ${method}`)
+  return waitForValue(
+    () => requestPayloads(transport).find((payload) => payload.method === method),
+    `request ${method}`
+  )
 }
 
 describe('SSH fresh agent-session create operations', () => {
@@ -377,6 +389,8 @@ describe('SSH fresh agent-session create operations', () => {
       ])
     )
     await expect(replacement).resolves.toMatchObject({ incarnationId: 'incarnation-new' })
+    // The same-buffer data frame can decode a decoder turn after the spawn response resolves.
+    await waitForValue(() => onData.mock.calls.at(0), 'replacement source data')
     expect(onData.mock.calls.map(([payload]) => payload.data)).toEqual(['new'])
 
     transport.deliver(
diff --git a/src/main/providers/ssh-pty-provider-rpc-operations.ts b/src/main/providers/ssh-pty-provider-rpc-operations.ts
index bcd847de27b..361bdc15715 100644
--- a/src/main/providers/ssh-pty-provider-rpc-operations.ts
+++ b/src/main/providers/ssh-pty-provider-rpc-operations.ts
@@ -34,6 +34,9 @@ export function createSshPtyProviderRpcOperations({ mux, toRelayPtyId }: SshPtyP
     clearBuffer: async (id: string): Promise<void> => {
       await mux.request('pty.clearBuffer', { id: toRelayPtyId(id) })
     },
+    resetInputModes: async (id: string): Promise<void> => {
+      await mux.request('pty.resetInputModes', { id: toRelayPtyId(id) })
+    },
     closeStartupQueryAuthority: async (id: string): Promise<number> => {
       const result = (await mux.request('pty.closeStartupQueryAuthority', {
         id: toRelayPtyId(id)
diff --git a/src/main/providers/ssh-pty-provider.ts b/src/main/providers/ssh-pty-provider.ts
index 76b5d9f85e4..854e076cec5 100644
--- a/src/main/providers/ssh-pty-provider.ts
+++ b/src/main/providers/ssh-pty-provider.ts
@@ -55,6 +55,7 @@ export class SshPtyProvider implements IPtyProvider {
   getCwd = (id: string): Promise<string> => this.rpcOperations.getCwd(id)
   getInitialCwd = (id: string): Promise<string> => this.rpcOperations.getInitialCwd(id)
   clearBuffer = (id: string): Promise<void> => this.rpcOperations.clearBuffer(id)
+  resetInputModes = (id: string): Promise<void> => this.rpcOperations.resetInputModes(id)
   closeStartupQueryAuthority = (id: string): Promise<number> =>
     this.rpcOperations.closeStartupQueryAuthority(id)
   acknowledgeDataEvent = (id: string, charCount: number): void =>
diff --git a/src/main/providers/ssh-pty-spawn-request.ts b/src/main/providers/ssh-pty-spawn-request.ts
index 9f493d9e778..170a50bb7bd 100644
--- a/src/main/providers/ssh-pty-spawn-request.ts
+++ b/src/main/providers/ssh-pty-spawn-request.ts
@@ -26,6 +26,7 @@ export function buildSshPtySpawnRequest(args: {
     ...(options.historyIsolationEnabled !== undefined
       ? { historyIsolationEnabled: options.historyIsolationEnabled }
       : {}),
+    ...(options.agentWorkspaceTrust ? { agentWorkspaceTrust: options.agentWorkspaceTrust } : {}),
     ...(options.shellOverride !== undefined ? { shellOverride: options.shellOverride } : {}),
     ...(options.terminalWindowsWslDistro !== undefined
       ? { terminalWindowsWslDistro: options.terminalWindowsWslDistro }
diff --git a/src/main/providers/windows-pty-job-membership.ts b/src/main/providers/windows-pty-job-membership.ts
index 99bcf7ef2c2..7bb37323b39 100644
--- a/src/main/providers/windows-pty-job-membership.ts
+++ b/src/main/providers/windows-pty-job-membership.ts
@@ -1,5 +1,9 @@
 import type { IPty } from 'node-pty'
-import { isPtyJobOwnershipAvailable, listPtyJobProcessIds } from '../windows/windows-pty-job'
+import {
+  isPtyJobOwnershipAvailable,
+  listPtyJobProcessIds,
+  ptyShellProcessId
+} from '../windows/windows-pty-job'
 
 /**
  * Processes still running under a pane, or null when there is no answer.
@@ -30,7 +34,14 @@ export function readWindowsPtyJobProcessIds(
   const membership = new Set(pids.filter((pid) => Number.isSafeInteger(pid) && pid > 0))
   // Without the shell, a size-1 set would read as "shell alone, retire" when it
   // means the opposite. The forked probe this replaced refused the same way.
-  return membership.has(proc.pid) ? membership : null
+  const shellPid = ptyShellProcessId(proc)
+  if (shellPid === undefined || !membership.has(proc.pid) || !membership.has(shellPid)) {
+    return null
+  }
+  if (shellPid !== proc.pid) {
+    membership.delete(proc.pid)
+  }
+  return membership
 }
 
 /**
diff --git a/src/main/providers/windows-shell-args.test.ts b/src/main/providers/windows-shell-args.test.ts
index c71b9b06722..38352a1b6d4 100644
--- a/src/main/providers/windows-shell-args.test.ts
+++ b/src/main/providers/windows-shell-args.test.ts
@@ -308,6 +308,31 @@ describe('resolveWindowsShellLaunchArgs', () => {
     expect(result.startupCommandDeliveredInShellArgs).toBeUndefined()
   })
 
+  it('keeps a plain Git Bash tab a login shell and wraps one with a startup command', () => {
+    const plain = resolveWindowsShellLaunchArgs(
+      'C:\\Program Files\\Git\\bin\\bash.exe',
+      'C:\\Users\\alice',
+      'C:\\Users\\alice'
+    )
+    const launched = resolveWindowsShellLaunchArgs(
+      'C:\\Program Files\\Git\\bin\\bash.exe',
+      'C:\\Users\\alice',
+      'C:\\Users\\alice',
+      undefined,
+      "codex 'fix the bug'"
+    )
+
+    expect(plain.shellArgs).toEqual([
+      '-c',
+      'chcp.com 65001 >/dev/null 2>&1; exec "$BASH" --login -i'
+    ])
+    // Why: without a preflight, only the rcfile carries the codex --no-daemon wrapper.
+    expect(readFileSync(getGitBashRcfilePath(launched.shellArgs[1]), 'utf8')).toContain(
+      'set -- --no-daemon "$@"'
+    )
+    expect(launched.startupCommandDeliveredInShellArgs).toBeUndefined()
+  })
+
   it('quotes a spaced preflight path through each shell environment', () => {
     const cmd = resolveWindowsShellLaunchArgs(
       'cmd.exe',
diff --git a/src/main/providers/windows-shell-args.ts b/src/main/providers/windows-shell-args.ts
index 70fd22a06ad..c5ceade00a4 100644
--- a/src/main/providers/windows-shell-args.ts
+++ b/src/main/providers/windows-shell-args.ts
@@ -29,8 +29,9 @@ const CMD_CODEX_LAUNCH_PREFLIGHT = `if defined ORCA_CODEX_LAUNCH_PREFLIGHT call
 // `&&`) keeps startup working even if chcp.com is missing.
 const GIT_BASH_UTF8_LOGIN_COMMAND = 'chcp.com 65001 >/dev/null 2>&1; exec "$BASH" --login -i'
 
-function getGitBashLaunchCommand(codexLaunchPreflightCommand?: string): string {
-  if (!codexLaunchPreflightCommand) {
+// Why the rcfile for a startup command: it defines the codex wrapper Orca's launches need.
+function getGitBashLaunchCommand(useWrapper: boolean): string {
+  if (!useWrapper) {
     return GIT_BASH_UTF8_LOGIN_COMMAND
   }
 
@@ -216,7 +217,10 @@ export function resolveWindowsShellLaunchArgs(
 
   if (isWindowsGitBashShellPath(shellPath)) {
     return {
-      shellArgs: ['-c', getGitBashLaunchCommand(codexLaunchPreflightCommand)],
+      shellArgs: [
+        '-c',
+        getGitBashLaunchCommand(Boolean(codexLaunchPreflightCommand) || Boolean(startupCommand))
+      ],
       effectiveCwd: nativeCwd,
       validationCwd: nativeCwd
     }
diff --git a/src/main/pty-descendant-exit-verification.test.ts b/src/main/pty-descendant-exit-verification.test.ts
index 4b92a6444c0..72b331492ad 100644
--- a/src/main/pty-descendant-exit-verification.test.ts
+++ b/src/main/pty-descendant-exit-verification.test.ts
@@ -32,9 +32,9 @@ describe('descendant exit verification across partial process-table reads', () =
     const snapshot = collectDescendantRows(10, [row(10, 1), first, later], CAPTURED_AT)
     const readTable = vi
       .fn()
-      .mockResolvedValueOnce(capture([first]))
-      .mockResolvedValueOnce(capture([first, later]))
-      .mockResolvedValue(capture([]))
+      .mockImplementationOnce(async () => capture([first]))
+      .mockImplementationOnce(async () => capture([first, later]))
+      .mockImplementation(async () => capture([]))
     const sendSignal = vi.fn()
     const pending = terminateDescendantSnapshotWithVerdict(snapshot, {
       readTable,
@@ -52,16 +52,37 @@ describe('descendant exit verification across partial process-table reads', () =
     ])
   })
 
-  it('keeps an omitted target unverifiable when partial reads never show its identity', async () => {
-    const first = row(20)
-    const omitted = row(30)
-    const snapshot = collectDescendantRows(10, [row(10, 1), first, omitted], CAPTURED_AT)
+  it('proves a target gone that only the snapshot saw, once two later reads miss it', async () => {
+    // A root that exits on its own takes a short-lived child with it before the first poll.
+    const snapshot = collectDescendantRows(10, [row(10, 1), row(20)], CAPTURED_AT)
     const sendSignal = vi.fn()
     const pending = terminateDescendantSnapshotWithVerdict(snapshot, {
-      readTable: vi
-        .fn()
-        .mockResolvedValueOnce(capture([first]))
-        .mockResolvedValue(capture([])),
+      readTable: vi.fn().mockImplementation(async () => capture([])),
+      sendSignal,
+      requireIdentityBeforeSignal: true,
+      graceMs: 0,
+      verifyMs: 3_500
+    })
+    let verdict: string | undefined
+    void pending.then((value) => {
+      verdict = value
+    })
+    // Proven within a few polls, not by waiting out the verification window.
+    await vi.advanceTimersByTimeAsync(200)
+
+    expect(verdict).toBe('exited')
+    expect(sendSignal).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(4_000)
+  })
+
+  it('does not count an absence from a read that started before the target was seen', async () => {
+    const unseen = row(30)
+    const snapshot = collectDescendantRows(10, [row(10, 1), unseen], CAPTURED_AT)
+    const sendSignal = vi.fn()
+    // A shared read already in flight when the snapshot ran cannot list a descendant forked since.
+    const staleRead = { rows: [], capturedAtMs: CAPTURED_AT - 1 }
+    const pending = terminateDescendantSnapshotWithVerdict(snapshot, {
+      readTable: vi.fn().mockResolvedValue(staleRead),
       sendSignal,
       requireIdentityBeforeSignal: true,
       graceMs: 0,
@@ -70,8 +91,45 @@ describe('descendant exit verification across partial process-table reads', () =
     await vi.advanceTimersByTimeAsync(200)
 
     await expect(pending).resolves.toBe('unverifiable')
-    expect(sendSignal).toHaveBeenCalledWith(first.pid, 'SIGTERM')
-    expect(sendSignal).not.toHaveBeenCalledWith(omitted.pid, 'SIGTERM')
+    expect(sendSignal).not.toHaveBeenCalled()
+  })
+
+  it('keeps the latest sighting when an earlier-started read that matches resolves later', async () => {
+    const target = row(20)
+    const snapshot = collectDescendantRows(10, [row(10, 1), target], CAPTURED_AT)
+    const readTable = vi
+      .fn()
+      .mockResolvedValueOnce({ rows: [target], capturedAtMs: CAPTURED_AT + 300 })
+      .mockResolvedValueOnce({ rows: [target], capturedAtMs: CAPTURED_AT + 100 })
+      // Began between the two sightings, so it cannot prove the later one gone.
+      .mockResolvedValue({ rows: [], capturedAtMs: CAPTURED_AT + 200 })
+    const pending = terminateDescendantSnapshotWithVerdict(snapshot, {
+      readTable,
+      sendSignal: vi.fn(),
+      requireIdentityBeforeSignal: true,
+      graceMs: 10_000,
+      verifyMs: 300
+    })
+    await vi.advanceTimersByTimeAsync(400)
+
+    await expect(pending).resolves.toBe('unverifiable')
+  })
+
+  it('counts the read after the deadline as an absence', async () => {
+    const snapshot = collectDescendantRows(10, [row(10, 1), row(20)], CAPTURED_AT)
+    const readTable = vi.fn().mockImplementation(async () => capture([]))
+    // One poll fits in the window; the final read supplies the second absence.
+    const pending = terminateDescendantSnapshotWithVerdict(snapshot, {
+      readTable,
+      sendSignal: vi.fn(),
+      requireIdentityBeforeSignal: true,
+      graceMs: 0,
+      verifyMs: 50
+    })
+    await vi.advanceTimersByTimeAsync(100)
+
+    await expect(pending).resolves.toBe('exited')
+    expect(readTable).toHaveBeenCalledTimes(2)
   })
 
   it('escalates a survivor omitted at the first force-kill read when it reappears', async () => {
@@ -80,10 +138,10 @@ describe('descendant exit verification across partial process-table reads', () =
     const snapshot = collectDescendantRows(10, [row(10, 1), first, later], CAPTURED_AT)
     const readTable = vi
       .fn()
-      .mockResolvedValueOnce(capture([first, later]))
-      .mockResolvedValueOnce(capture([first]))
-      .mockResolvedValueOnce(capture([first, later]))
-      .mockResolvedValue(capture([]))
+      .mockImplementationOnce(async () => capture([first, later]))
+      .mockImplementationOnce(async () => capture([first]))
+      .mockImplementationOnce(async () => capture([first, later]))
+      .mockImplementation(async () => capture([]))
     const sendSignal = vi.fn()
     const pending = terminateDescendantSnapshotWithVerdict(snapshot, {
       readTable,
diff --git a/src/main/pty-descendant-exit-verification.ts b/src/main/pty-descendant-exit-verification.ts
index 27ed62ca0a0..bc23faf2958 100644
--- a/src/main/pty-descendant-exit-verification.ts
+++ b/src/main/pty-descendant-exit-verification.ts
@@ -124,7 +124,32 @@ export async function terminateDescendantSnapshotWithVerdict(
   const forced = new Set<number>()
   const signalled = new Set<number>()
   const missingObservations = new Map(snapshot.descendants.map((row) => [row.pid, 0]))
-  const observedPids = new Set<number>()
+  // The snapshot is itself a table read that saw each target alive. An absence is evidence only
+  // from a read that started after the target was last seen: a shared or in-flight read begun
+  // earlier can miss a descendant forked since, but a later full scan cannot miss a live one.
+  const lastSeenAtMs = new Map(
+    snapshot.descendants.map((row) => [
+      row.pid,
+      snapshot.capturedAtMsByPid?.[String(row.pid)] ?? snapshot.capturedAtMs
+    ])
+  )
+  const recordIdentityObservation = (
+    capture: ProcessTableCapture,
+    live: readonly ProcessTableRow[]
+  ): void => {
+    for (const row of snapshot.descendants) {
+      const lastSeen = lastSeenAtMs.get(row.pid) ?? Infinity
+      if (live.some((current) => current.pid === row.pid)) {
+        missingObservations.set(row.pid, 0)
+        // A read that started earlier but resolved later must not move the sighting back.
+        lastSeenAtMs.set(row.pid, Math.max(lastSeen, capture.capturedAtMs))
+      } else if (capture.capturedAtMs > lastSeen) {
+        missingObservations.set(row.pid, (missingObservations.get(row.pid) ?? 0) + 1)
+      }
+    }
+  }
+  const provenAbsent = (): boolean =>
+    snapshot.descendants.every((row) => (missingObservations.get(row.pid) ?? 0) >= 2)
   if (!deps.requireIdentityBeforeSignal) {
     for (const row of snapshot.descendants) {
       sendSignal(row.pid, 'SIGTERM')
@@ -148,30 +173,14 @@ export async function terminateDescendantSnapshotWithVerdict(
       }
       const live = matchingSnapshotRows(snapshot, capture.rows, deps.requireIdentityBeforeSignal)
       if (deps.requireIdentityBeforeSignal) {
-        const rowsByPid = new Set(capture.rows.map((row) => row.pid))
-        for (const row of snapshot.descendants) {
-          if (rowsByPid.has(row.pid)) {
-            observedPids.add(row.pid)
-          }
-          if (live.some((current) => current.pid === row.pid)) {
-            missingObservations.set(row.pid, 0)
-          } else {
-            missingObservations.set(row.pid, (missingObservations.get(row.pid) ?? 0) + 1)
-          }
-        }
+        recordIdentityObservation(capture, live)
       }
       if (live.length === 0) {
         // Before a signal has been sent, an empty identity match means the
         // snapshotted descendants already exited or were replaced. Signalling
-        // those old numeric pids would be unsafe. Partial reads are not proof
-        // that a never-observed target exited, so every identity needs two
-        // bounded absences after it has appeared in a table.
-        if (
-          deps.requireIdentityBeforeSignal &&
-          !snapshot.descendants.every(
-            (row) => observedPids.has(row.pid) && (missingObservations.get(row.pid) ?? 0) >= 2
-          )
-        ) {
+        // those old numeric pids would be unsafe. Every identity needs two
+        // absences from reads that started after it was last seen.
+        if (deps.requireIdentityBeforeSignal && !provenAbsent()) {
           await waitForDelay(50, deps.keepAlive)
           continue
         }
@@ -235,10 +244,8 @@ export async function terminateDescendantSnapshotWithVerdict(
     return 'live'
   }
   if (deps.requireIdentityBeforeSignal) {
-    const everyTargetAbsent = snapshot.descendants.every(
-      (row) => observedPids.has(row.pid) && (missingObservations.get(row.pid) ?? 0) >= 2
-    )
-    return everyTargetAbsent ? 'exited' : 'unverifiable'
+    recordIdentityObservation(finalCapture, finalLive)
+    return provenAbsent() ? 'exited' : 'unverifiable'
   }
   return 'exited'
 }
diff --git a/src/main/pty-descendant-termination.test.ts b/src/main/pty-descendant-termination.test.ts
index f6b8e066983..6261ec92fc2 100644
--- a/src/main/pty-descendant-termination.test.ts
+++ b/src/main/pty-descendant-termination.test.ts
@@ -453,7 +453,8 @@ describe('terminateDescendantSnapshotAndWait', () => {
       snapshot([row(20, 10, 20, 'Tue Jul 14 12:00:00 2026')]),
       {
         sendSignal,
-        readTable: vi.fn().mockResolvedValue(tableCapture([recycled])),
+        // Reads begin after the walk that produced the snapshot, as every fresh scan does.
+        readTable: vi.fn().mockResolvedValue(tableCapture([recycled], CAPTURED_AT_MS + 1_000)),
         requireIdentityBeforeSignal: true,
         verifyMs: 100
       }
diff --git a/src/main/pty/codex-launch-shell-wrapping.test.ts b/src/main/pty/codex-launch-shell-wrapping.test.ts
new file mode 100644
index 00000000000..02d6c223a2f
--- /dev/null
+++ b/src/main/pty/codex-launch-shell-wrapping.test.ts
@@ -0,0 +1,80 @@
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { shouldUseShellReadyStartupDelivery } from '../../shared/codex-startup-delivery'
+import { selectShellStartupFeatures } from '../shell-startup-features'
+
+// Why: the codex --no-daemon wrapper only reaches shells Orca wraps. Orca's own
+// Codex launches carry a startup command, so each launch shell must be wrapped.
+const COMMAND = "codex 'fix the bug'"
+const NO_DAEMON = 'set -- --no-daemon "$@"'
+const FISH_NO_DAEMON = 'set argv --no-daemon $argv'
+
+function codexLaunchFeatures(shellPath: string) {
+  // Why an empty env: a system-default Codex home, with hooks off, carries no overlay key.
+  const waitsForShellReady = shouldUseShellReadyStartupDelivery({ command: COMMAND, shellPath })
+  return selectShellStartupFeatures({
+    shellPath,
+    env: {},
+    hasStartupCommand: true,
+    waitsForShellReady,
+    emitsStartupIdentity: waitsForShellReady
+  })
+}
+
+function wrapperText(config: { args: string[] | null; env: Record<string, string> }): string {
+  if (config.env.ZDOTDIR) {
+    return readFileSync(join(config.env.ZDOTDIR, '.zshenv'), 'utf8')
+  }
+  const rcfile = config.args?.[config.args.indexOf('--rcfile') + 1]
+  return rcfile && config.args?.includes('--rcfile')
+    ? readFileSync(rcfile, 'utf8')
+    : (config.args ?? []).join('\n')
+}
+
+describe.skipIf(process.platform === 'win32')('Orca Codex launch shells carry the wrapper', () => {
+  let userData: string
+  const original = process.env.ORCA_USER_DATA_PATH
+
+  beforeEach(() => {
+    userData = mkdtempSync(join(tmpdir(), 'orca-codex-launch-wrap-'))
+    process.env.ORCA_USER_DATA_PATH = userData
+    vi.resetModules()
+  })
+
+  afterEach(() => {
+    if (original === undefined) {
+      delete process.env.ORCA_USER_DATA_PATH
+    } else {
+      process.env.ORCA_USER_DATA_PATH = original
+    }
+    rmSync(userData, { recursive: true, force: true })
+  })
+
+  it.each([
+    ['/bin/bash', NO_DAEMON],
+    ['/bin/zsh', NO_DAEMON],
+    ['/usr/bin/fish', FISH_NO_DAEMON]
+  ])('daemon transport wraps %s', async (shell, marker) => {
+    const { getShellLaunchConfig } = await import('../daemon/shell-ready')
+
+    expect(
+      wrapperText(
+        getShellLaunchConfig(shell, codexLaunchFeatures(shell), { hasStartupCommand: true })
+      )
+    ).toContain(marker)
+  })
+
+  it.each([
+    ['/bin/bash', NO_DAEMON],
+    ['/bin/zsh', NO_DAEMON],
+    ['/usr/bin/fish', FISH_NO_DAEMON]
+  ])('local transport wraps %s', async (shell, marker) => {
+    const { getShellLaunchConfig } = await import('../providers/local-pty-shell-ready')
+
+    expect(wrapperText(getShellLaunchConfig(shell, codexLaunchFeatures(shell), COMMAND))).toContain(
+      marker
+    )
+  })
+})
diff --git a/src/main/pty/codex-no-daemon-binary-contract.test.ts b/src/main/pty/codex-no-daemon-binary-contract.test.ts
new file mode 100644
index 00000000000..e02301fa6a2
--- /dev/null
+++ b/src/main/pty/codex-no-daemon-binary-contract.test.ts
@@ -0,0 +1,75 @@
+import { execFile } from 'node:child_process'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { promisify } from 'node:util'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { CODEX_SHARED_SERVER_ARGS } from './codex-shell-launch-preflight'
+
+// Why: Orca's codex shell wrapper puts --no-daemon first for every subcommand but
+// agents/queue (codex-shell-launch-preflight.ts). Its tests use a fake codex, so
+// only the real binary can catch a renamed flag or a new subcommand rejecting it.
+
+const execFileAsync = promisify(execFile)
+const binary = process.env.ORCA_CODEX_NO_DAEMON_CONTRACT_BINARY
+const expectedVersion = process.env.ORCA_CODEX_NO_DAEMON_CONTRACT_VERSION
+const WRAPPER_SKIPPED_SUBCOMMANDS: ReadonlySet<string> = new Set(CODEX_SHARED_SERVER_ARGS)
+const TIMEOUT_MS = 30_000
+
+describe.runIf(process.env.ORCA_CODEX_NO_DAEMON_CONTRACT_REQUIRED === '1' && !binary)(
+  'codex --no-daemon contract prerequisites',
+  () => {
+    it('was given a Codex binary to run against', () => {
+      expect.fail('ORCA_CODEX_NO_DAEMON_CONTRACT_REQUIRED=1 but no binary was given')
+    })
+  }
+)
+
+describe.runIf(binary)('codex --no-daemon binary contract', { timeout: 120_000 }, () => {
+  let home: string
+  let help: string
+
+  beforeAll(async () => {
+    // Why a disposable home: never read or start anything under the user's ~/.codex.
+    home = mkdtempSync(join(tmpdir(), 'orca-codex-no-daemon-contract-'))
+    const version = await run(['--version'])
+    expect(version.stdout.trim()).toBe(`codex-cli ${expectedVersion}`)
+    help = (await run(['--help'])).stdout
+  })
+
+  afterAll(() => {
+    rmSync(home, { recursive: true, force: true })
+  })
+
+  function run(args: string[]): Promise<{ stdout: string; stderr: string }> {
+    return execFileAsync(binary!, args, {
+      timeout: TIMEOUT_MS,
+      env: { ...process.env, CODEX_HOME: home }
+    })
+  }
+
+  function listedSubcommands(): string[] {
+    const section = help.split(/^Commands:\n/m)[1]?.split(/\n\s*\n/)[0] ?? ''
+    return [...section.matchAll(/^ {2}([a-z][a-z0-9-]*)\s/gm)].map((match) => match[1])
+  }
+
+  it('lists --no-daemon in --help, which is what the wrapper probes', () => {
+    expect(help).toContain('--no-daemon')
+  })
+
+  it('accepts --no-daemon first for every listed subcommand the wrapper does not skip', async () => {
+    const subcommands = listedSubcommands()
+    // Why a floor: a help layout change must fail here, not shrink the check to nothing.
+    expect(subcommands.length).toBeGreaterThan(20)
+    expect(subcommands).toEqual(expect.arrayContaining(['exec', 'resume', 'agents', 'queue']))
+    const rejected: string[] = []
+    for (const subcommand of subcommands.filter((name) => !WRAPPER_SKIPPED_SUBCOMMANDS.has(name))) {
+      // Why bare `help`: clap's help subcommand treats `--help` as a command name.
+      const args = subcommand === 'help' ? ['help'] : [subcommand, '--help']
+      await run(['--no-daemon', ...args]).catch((error: { stderr?: string }) =>
+        rejected.push(`${subcommand}: ${error.stderr?.trim() ?? String(error)}`)
+      )
+    }
+    expect(rejected).toEqual([])
+  })
+})
diff --git a/src/main/pty/codex-shell-launch-preflight.test.ts b/src/main/pty/codex-shell-launch-preflight.test.ts
index f0673fc9c95..3056deeac78 100644
--- a/src/main/pty/codex-shell-launch-preflight.test.ts
+++ b/src/main/pty/codex-shell-launch-preflight.test.ts
@@ -309,9 +309,8 @@ describe.skipIf(process.platform === 'win32')('Codex shell launch preflight', ()
 
   // Regression for #16893: an unquoted `(type -t codex)` expands to zero words when
   // codex is absent, so `test` saw `= file` (2 args) and printed "Missing argument
-  // at index 3" on every fish pane launch. Needs a valid executable
-  // ORCA_CODEX_LAUNCH_PREFLIGHT so the `and` chain reaches the second `test`, and
-  // the real `-l -C` launch shape both shell-ready call sites use.
+  // at index 3" on every fish pane launch. Uses the real `-l -C` launch shape both
+  // shell-ready call sites use.
   it.skipIf(!fishAvailable)('stays silent and installs no wrapper when codex is absent', () => {
     const { bin, preflight } = createFishSandbox('orca-codex-fish-absent-')
 
diff --git a/src/main/pty/codex-shell-launch-preflight.ts b/src/main/pty/codex-shell-launch-preflight.ts
index 87e5df75827..0fcd0c37c07 100644
--- a/src/main/pty/codex-shell-launch-preflight.ts
+++ b/src/main/pty/codex-shell-launch-preflight.ts
@@ -65,6 +65,11 @@ function isExecutableFileOnDisk(path: string, platform: NodeJS.Platform): boolea
   }
 }
 
+// Why --no-daemon: Codex 0.156+ otherwise shares one server per CODEX_HOME that runs every tab's
+// hooks with the first tab's Orca env and dies with it (#22873). These args need that server or exit 2.
+export const CODEX_SHARED_SERVER_ARGS = ['agents', 'queue', '--no-daemon', '--remote'] as const
+const CODEX_SHARED_SERVER_ARG_PATTERN = `^(${CODEX_SHARED_SERVER_ARGS.join('|')}|--remote=.*)$`
+
 export function getPosixCodexShellLaunchPreflight(): string {
   return `# Why: a typed alias expands inside the shell, after pane launch prep.
 # Why unalias inside the substitution: an alias named codex makes command -v
@@ -72,11 +77,22 @@ export function getPosixCodexShellLaunchPreflight(): string {
 # Why || : twice — zsh alone aborts inside the substitution, but every shell's
 # assignment adopts its exit status, so an absent codex trips set -e in bash too.
 __orca_codex_binary="$(unalias codex 2>/dev/null || :; command -v codex 2>/dev/null || :)"
-if [[ -n "\${ORCA_CODEX_LAUNCH_PREFLIGHT:-}" && -x "\${ORCA_CODEX_LAUNCH_PREFLIGHT}" && -n "\${__orca_codex_binary:-}" && -x "\${__orca_codex_binary}" ]]; then
+if [[ -n "\${__orca_codex_binary:-}" && -x "\${__orca_codex_binary}" ]]; then
   # Why the function reserved word: it suppresses alias expansion of the name,
   # which otherwise rewrites this header at parse time and aborts the whole file.
   function codex {
-    "\${ORCA_CODEX_LAUNCH_PREFLIGHT}" agent hooks prepare-codex >/dev/null 2>&1 || :
+    # Why local: zsh's warn_create_global warns for each global a function creates.
+    local __orca_codex_arg __orca_codex_isolate="\${ORCA_CODEX_ISOLATE:-1}"
+    if [[ -n "\${ORCA_CODEX_LAUNCH_PREFLIGHT:-}" && -x "\${ORCA_CODEX_LAUNCH_PREFLIGHT}" ]]; then
+      "\${ORCA_CODEX_LAUNCH_PREFLIGHT}" agent hooks prepare-codex >/dev/null 2>&1 || :
+    fi
+    for __orca_codex_arg in "$@"; do
+      case "$__orca_codex_arg" in ${CODEX_SHARED_SERVER_ARGS.join('|')}|--remote=*) __orca_codex_isolate=0 ;; esac
+    done
+    # Why probe every launch: a cached answer goes stale across an upgrade, and 0.155 and older exit 2 on the flag.
+    if [[ "$__orca_codex_isolate" != 0 ]]; then
+      case "$(command codex --help 2>/dev/null </dev/null)" in *--no-daemon*) set -- --no-daemon "$@" ;; esac
+    fi
     command codex "$@"
   }
 fi
@@ -89,9 +105,14 @@ export function getFishCodexShellLaunchPreflight(): string {
 # absent, leaving "test = file" — fish then errors instead of failing closed.
 # Quoting in place is not the fix; fish never substitutes inside double quotes.
 set -l __orca_codex_type (type -t codex 2>/dev/null)
-if test -x "$ORCA_CODEX_LAUNCH_PREFLIGHT"; and test "$__orca_codex_type" = file
+if test "$__orca_codex_type" = file
   function codex
-    command "$ORCA_CODEX_LAUNCH_PREFLIGHT" agent hooks prepare-codex >/dev/null 2>&1; or true
+    if test -x "$ORCA_CODEX_LAUNCH_PREFLIGHT"
+      command "$ORCA_CODEX_LAUNCH_PREFLIGHT" agent hooks prepare-codex >/dev/null 2>&1; or true
+    end
+    if test "$ORCA_CODEX_ISOLATE" != 0; and not string match -qr -- '${CODEX_SHARED_SERVER_ARG_PATTERN}' $argv; and command codex --help 2>/dev/null </dev/null | string match -q -- '*--no-daemon*'
+      set argv --no-daemon $argv
+    end
     command codex $argv
   end
 end
@@ -100,20 +121,37 @@ set -e __orca_codex_type`
 
 export function getPowerShellCodexShellLaunchPreflight(): string {
   return `$orcaCodexCommand = Get-Command codex -ErrorAction SilentlyContinue | Select-Object -First 1
-if ($env:ORCA_CODEX_LAUNCH_PREFLIGHT -and $orcaCodexCommand -and
+if ($orcaCodexCommand -and
     $orcaCodexCommand.CommandType -in @("Application", "ExternalScript")) {
     function Global:codex {
-        try {
-            & $env:ORCA_CODEX_LAUNCH_PREFLIGHT agent hooks prepare-codex *> $null
-        } catch {
-        }
         $orcaCodexExecutable = Get-Command codex -CommandType Application,ExternalScript -ErrorAction SilentlyContinue | Select-Object -First 1
         if (-not $orcaCodexExecutable) {
             Write-Error "codex executable not found"
             $global:LASTEXITCODE = 127
             return
         }
-        & $orcaCodexExecutable.Source @args
+        $orcaCodexFlags = @()
+        # Why try/catch: under the user's $ErrorActionPreference = 'Stop', a failing prep or probe must not abort the launch.
+        if ($env:ORCA_CODEX_LAUNCH_PREFLIGHT) {
+            try {
+                & $env:ORCA_CODEX_LAUNCH_PREFLIGHT agent hooks prepare-codex *> $null
+            } catch {
+            }
+        }
+        if ($env:ORCA_CODEX_ISOLATE -ne '0' -and -not (@($args) -cmatch '${CODEX_SHARED_SERVER_ARG_PATTERN}')) {
+            try {
+                if ((& $orcaCodexExecutable.Source --help 2>$null) -match '--no-daemon') {
+                    $orcaCodexFlags = @('--no-daemon')
+                }
+            } catch {
+            }
+        }
+        # Why: a native command inside a function never sees the function's pipeline input on its own.
+        if ($MyInvocation.ExpectingInput) {
+            $input | & $orcaCodexExecutable.Source @orcaCodexFlags @args
+        } else {
+            & $orcaCodexExecutable.Source @orcaCodexFlags @args
+        }
         $global:LASTEXITCODE = $LASTEXITCODE
     }
 }
diff --git a/src/main/pty/codex-shell-no-daemon.test.ts b/src/main/pty/codex-shell-no-daemon.test.ts
new file mode 100644
index 00000000000..53f978e8360
--- /dev/null
+++ b/src/main/pty/codex-shell-no-daemon.test.ts
@@ -0,0 +1,353 @@
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { delimiter, join } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  getFishCodexShellLaunchPreflight,
+  getPosixCodexShellLaunchPreflight,
+  getPowerShellCodexShellLaunchPreflight
+} from './codex-shell-launch-preflight'
+import { resolveFishBinary } from '../../shared/fish-binary-requirement'
+
+const isWindows = process.platform === 'win32'
+const fishLookup = resolveFishBinary()
+const canRun = (command: string): boolean =>
+  spawnSync(command, ['-NoLogo', '-NoProfile', '-Command', 'exit 0']).status === 0
+const pwshAvailable = canRun('pwsh')
+
+const HELP_WITH_FLAG = 'Usage: codex [OPTIONS] [PROMPT]\n      --no-daemon  Run in-process\n'
+const HELP_WITHOUT_FLAG = 'Usage: codex [OPTIONS] [PROMPT]\n      --no-alt-screen\n'
+
+// Why argv as whole words: the rule is a whole-argument denylist (plan §4).
+const ADDED: string[][] = [
+  [],
+  ['fix the bug'],
+  ['exec the plan'],
+  ['-m', 'gpt-5', '--yolo', 'x'],
+  ['resume'],
+  ['resume', '--last'],
+  ['--yolo', 'resume', '--last'],
+  ['fork', '--last'],
+  ['-a', 'never', 'resume'],
+  ['-c', 'model=o3'],
+  ['archive', 'S'],
+  ['delete', 'S'],
+  ['exec', 'x'],
+  ['e', 'x'],
+  ['-m', 'x', 'exec', 'x'],
+  ['review'],
+  ['login'],
+  ['mcp', 'list']
+]
+const UNCHANGED: string[][] = [
+  ['agents'],
+  ['-m', 'x', 'agents'],
+  ['-c', 'k=v', 'agents'],
+  ['--image=a.png', 'agents'],
+  ['agents', '--remote', 'X'],
+  ['queue', '--thread', 'T', '--message', 'M'],
+  ['-c', 'k=v', 'queue'],
+  ['--no-daemon'],
+  ['resume', '--no-daemon'],
+  ['-m', 'x', '--no-daemon'],
+  ['--remote', 'unix://'],
+  ['--remote=ws://h:1'],
+  ['resume', '--remote', 'X'],
+  ['-m', 'agents'],
+  ['--', 'agents'],
+  ['--', '--remote']
+]
+const ALL = [...ADDED, ...UNCHANGED]
+
+type Shell = 'bash' | 'zsh' | 'fish' | 'pwsh' | 'powershell'
+const isPowerShell = (shell: Shell): boolean => shell === 'pwsh' || shell === 'powershell'
+const roots: string[] = []
+
+afterEach(() => {
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+function writeExecutable(path: string, content: string): void {
+  writeFileSync(path, content)
+  chmodSync(path, 0o755)
+}
+
+type Sandbox = { bin: string; codex: string; helpFile: string; helpLog: string }
+
+/** Fake codex: `--help` prints the help file and logs the probe; any other call prints its argv. */
+function makeSandbox(help: string): Sandbox {
+  const root = mkdtempSync(join(tmpdir(), 'orca-codex-no-daemon-'))
+  roots.push(root)
+  const bin = join(root, 'bin')
+  mkdirSync(bin)
+  const helpFile = join(root, 'help.txt')
+  const helpLog = join(root, 'help.log')
+  writeFileSync(helpFile, help)
+  writeFileSync(helpLog, '')
+  if (isWindows) {
+    // Why a .cmd shim over node: the shape npm installs, and what Get-Command resolves.
+    writeFileSync(
+      join(bin, 'fake.js'),
+      `const fs = require('fs')
+const a = process.argv.slice(2)
+if (a.length === 1 && a[0] === '--help') {
+  fs.appendFileSync(${JSON.stringify(helpLog)}, 'help\\n')
+  process.stdout.write(fs.readFileSync(${JSON.stringify(helpFile)}, 'utf8'))
+  process.exit(0)
+}
+let out = ['ARGV', ...a].join('|')
+if (process.env.FAKE_CODEX_READ_STDIN === '1') out += '|stdin=' + fs.readFileSync(0, 'utf8').trim()
+console.log(out)
+process.exit(Number(process.env.FAKE_CODEX_EXIT || 0))
+`
+    )
+    const codex = join(bin, 'codex.cmd')
+    writeFileSync(codex, '@node "%~dp0fake.js" %*\r\n')
+    return { bin, codex, helpFile, helpLog }
+  }
+  const codex = join(bin, 'codex')
+  writeExecutable(
+    codex,
+    `#!/bin/sh
+if [ "$#" -eq 1 ] && [ "$1" = --help ]; then echo help >> ${JSON.stringify(helpLog)}; cat ${JSON.stringify(helpFile)}; exit 0; fi
+out=ARGV
+for a in "$@"; do out="$out|$a"; done
+[ "\${FAKE_CODEX_READ_STDIN:-}" = 1 ] && out="$out|stdin=$(cat)"
+printf '%s\\n' "$out"
+exit "\${FAKE_CODEX_EXIT:-0}"
+`
+  )
+  return { bin, codex, helpFile, helpLog }
+}
+
+function helpProbes(sandbox: Sandbox): number {
+  return readFileSync(sandbox.helpLog, 'utf8').split('\n').filter(Boolean).length
+}
+
+function quote(shell: Shell, word: string): string {
+  if (isPowerShell(shell)) {
+    return `'${word.replace(/'/g, "''")}'`
+  }
+  if (shell === 'fish') {
+    return `'${word.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`
+  }
+  return `'${word.replace(/'/g, `'\\''`)}'`
+}
+
+function codexCall(shell: Shell, argv: string[]): string {
+  return ['codex', ...argv.map((word) => quote(shell, word))].join(' ')
+}
+
+function run(
+  shell: Shell,
+  script: string,
+  sandbox: Sandbox,
+  env: Record<string, string> = {},
+  preamble = ''
+): { status: number | null; stdout: string; stderr: string } {
+  const template =
+    shell === 'fish'
+      ? getFishCodexShellLaunchPreflight()
+      : isPowerShell(shell)
+        ? getPowerShellCodexShellLaunchPreflight()
+        : getPosixCodexShellLaunchPreflight()
+  // Why the guard: rows include `login`, which a real codex would run against the host's account.
+  const guard = isPowerShell(shell)
+    ? `if ((Get-Command codex -CommandType Application | Select-Object -First 1).Source -ne ${quote(shell, sandbox.codex)}) { exit 97 }`
+    : shell === 'fish'
+      ? `test (command -s codex) = ${quote(shell, sandbox.codex)}; or exit 97`
+      : `[ "$(command -v codex)" = ${quote(shell, sandbox.codex)} ] || exit 97`
+  const body = `${guard}\n${preamble}\n${template}\n${script}`
+  // Why a file for bash/zsh: it is read line by line like a startup file, so an alias it defines applies.
+  const scriptFile = join(sandbox.bin, '..', 'script.sh')
+  writeFileSync(scriptFile, body)
+  const [command, args]: [string, string[]] =
+    shell === 'bash'
+      ? ['/bin/bash', ['--noprofile', '--norc', scriptFile]]
+      : shell === 'zsh'
+        ? ['/bin/zsh', ['-f', scriptFile]]
+        : shell === 'fish'
+          ? [String(fishLookup.path), ['--no-config', '-c', body]]
+          : [shell, ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', body]]
+  const result = spawnSync(command, args, {
+    encoding: 'utf-8',
+    env: {
+      ...process.env,
+      PATH: `${sandbox.bin}${delimiter}${process.env.PATH ?? ''}`,
+      CODEX_HOME: join(sandbox.bin, '..', 'codex-home'),
+      ...env
+    }
+  })
+  return { status: result.status, stdout: result.stdout, stderr: result.stderr }
+}
+
+function lines(output: string): string[] {
+  return output.trimEnd().split(/\r?\n/)
+}
+
+function expectedLine(argv: string[], added: boolean): string {
+  return ['ARGV', ...(added ? ['--no-daemon'] : []), ...argv].join('|')
+}
+
+const shells: [Shell, boolean][] = [
+  ['bash', !isWindows && existsSync('/bin/bash')],
+  ['zsh', !isWindows && existsSync('/bin/zsh')],
+  ['fish', fishLookup.available],
+  ['pwsh', pwshAvailable],
+  // Why: Windows PowerShell 5.1 turns redirected native stderr into errors, unlike pwsh.
+  ['powershell', isWindows && canRun('powershell')]
+]
+
+describe('codex wrapper --no-daemon rule', () => {
+  it('has pwsh when CI demanded it', () => {
+    expect(process.env.ORCA_REQUIRE_PWSH !== '1' || pwshAvailable).toBe(true)
+  })
+
+  for (const [shell, available] of shells) {
+    describe.skipIf(!available)(shell, () => {
+      it('adds --no-daemon first unless an argument is denylisted', () => {
+        const sandbox = makeSandbox(HELP_WITH_FLAG)
+        const result = run(shell, ALL.map((argv) => codexCall(shell, argv)).join('\n'), sandbox)
+
+        expect(result.stderr).toBe('')
+        expect(lines(result.stdout)).toEqual([
+          ...ADDED.map((argv) => expectedLine(argv, true)),
+          ...UNCHANGED.map((argv) => expectedLine(argv, false))
+        ])
+        // Why: a denylisted launch must not pay for, or depend on, the --help probe.
+        expect(helpProbes(sandbox)).toBe(ADDED.length)
+      })
+
+      it('adds nothing when --help does not list the flag (0.155 and older)', () => {
+        const sandbox = makeSandbox(HELP_WITHOUT_FLAG)
+        const result = run(shell, ALL.map((argv) => codexCall(shell, argv)).join('\n'), sandbox)
+
+        expect(lines(result.stdout)).toEqual(ALL.map((argv) => expectedLine(argv, false)))
+      })
+
+      it('adds nothing with ORCA_CODEX_ISOLATE=0, read on every call', () => {
+        const sandbox = makeSandbox(HELP_WITH_FLAG)
+        const setIsolate = (value: string): string =>
+          isPowerShell(shell)
+            ? `$env:ORCA_CODEX_ISOLATE = '${value}'`
+            : shell === 'fish'
+              ? `set -gx ORCA_CODEX_ISOLATE ${value}`
+              : `export ORCA_CODEX_ISOLATE=${value}`
+        const result = run(
+          shell,
+          ['codex a', setIsolate('1'), 'codex b', setIsolate('0'), 'codex c'].join('\n'),
+          sandbox,
+          { ORCA_CODEX_ISOLATE: '0' }
+        )
+
+        expect(lines(result.stdout)).toEqual(['ARGV|a', 'ARGV|--no-daemon|b', 'ARGV|c'])
+      })
+
+      it('re-probes --help when Codex changes version mid-shell', () => {
+        const sandbox = makeSandbox(HELP_WITH_FLAG)
+        const swap = (help: string): string =>
+          isPowerShell(shell)
+            ? `Set-Content -NoNewline -LiteralPath ${quote(shell, sandbox.helpFile)} -Value ${quote(shell, help)}`
+            : `printf '%s' ${quote(shell, help)} > ${quote(shell, sandbox.helpFile)}`
+        const result = run(
+          shell,
+          ['codex a', swap(HELP_WITHOUT_FLAG), 'codex b', swap(HELP_WITH_FLAG), 'codex c'].join(
+            '\n'
+          ),
+          sandbox
+        )
+
+        expect(lines(result.stdout)).toEqual(['ARGV|--no-daemon|a', 'ARGV|b', 'ARGV|--no-daemon|c'])
+      })
+
+      it("keeps piped stdin for Codex and returns Codex's exit status", () => {
+        const sandbox = makeSandbox(HELP_WITH_FLAG)
+        const script = isPowerShell(shell)
+          ? `'piped' | codex exec -\n"status=$LASTEXITCODE"`
+          : shell === 'fish'
+            ? `printf piped | codex exec -\necho status=$status`
+            : `printf piped | codex exec -\necho status=$?`
+        const result = run(shell, script, sandbox, {
+          FAKE_CODEX_READ_STDIN: '1',
+          FAKE_CODEX_EXIT: '3'
+        })
+
+        expect(lines(result.stdout)).toEqual(['ARGV|--no-daemon|exec|-|stdin=piped', 'status=3'])
+      })
+    })
+  }
+
+  for (const [shell, enableAliases] of [
+    ['bash', 'shopt -s expand_aliases'],
+    ['zsh', 'setopt aliases']
+  ] as const) {
+    it.skipIf(isWindows || !existsSync(`/bin/${shell}`))(
+      `applies a user alias named codex defined before the wrapper in ${shell}`,
+      () => {
+        const sandbox = makeSandbox(HELP_WITH_FLAG)
+        const result = run(
+          shell,
+          'codex x',
+          sandbox,
+          {},
+          `${enableAliases}\nalias codex='codex --alias-flag'`
+        )
+
+        expect(result.status, result.stderr).toBe(0)
+        expect(result.stdout.trim()).toBe('ARGV|--no-daemon|--alias-flag|x')
+      }
+    )
+  }
+
+  it.skipIf(isWindows || !existsSync('/bin/zsh'))(
+    'creates no globals under warn_create_global',
+    () => {
+      const sandbox = makeSandbox(HELP_WITH_FLAG)
+      const result = run('zsh', 'setopt warn_create_global no_unset\ncodex x', sandbox)
+
+      expect(result.stderr).toBe('')
+      expect(result.stdout.trim()).toBe('ARGV|--no-daemon|x')
+    }
+  )
+
+  for (const [shell, available] of shells.filter(([name]) => isPowerShell(name))) {
+    it.skipIf(!available)(
+      `${shell} runs under StrictMode and Stop with a failing, noisy hook prep`,
+      () => {
+        const sandbox = makeSandbox(HELP_WITH_FLAG)
+        const prep = join(sandbox.bin, isWindows ? 'orca-prep.cmd' : 'orca-prep')
+        writeExecutable(
+          prep,
+          isWindows
+            ? '@echo prep-noise 1>&2\r\n@exit /b 7\r\n'
+            : '#!/bin/sh\necho prep-noise >&2\nexit 7\n'
+        )
+        const result = run(
+          shell,
+          'codex x\n"status=$LASTEXITCODE"',
+          sandbox,
+          { ORCA_CODEX_LAUNCH_PREFLIGHT: prep },
+          [
+            'Set-StrictMode -Version Latest',
+            '$ErrorActionPreference = "Stop"',
+            '$PSNativeCommandUseErrorActionPreference = $true'
+          ].join('\n')
+        )
+
+        expect(result.status, result.stderr).toBe(0)
+        expect(lines(result.stdout)).toEqual(['ARGV|--no-daemon|x', 'status=0'])
+      }
+    )
+  }
+})
diff --git a/src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts b/src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts
index 1f9cae275c3..6d8b6411ba5 100644
--- a/src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts
+++ b/src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts
@@ -84,7 +84,7 @@ describe('node-pty patch: pseudoconsole close on the self-exit path', () => {
       [
         '+      baton->shellExited = true;',
         '+      if (baton->consoleClosed) {',
-        '+        const bool removed = remove_pty_baton(baton->id);',
+        '+        const bool removed = remove_pty_baton_locked(baton->id);',
         '+        assert(removed);',
         '+        (void)removed;',
         '+      }'
@@ -138,7 +138,7 @@ describe('node-pty patch: pseudoconsole close on the self-exit path', () => {
     expect(ptyKillHunk).toContain(
       [
         '+      if (handle->shellExited) {',
-        '+        const bool removed = remove_pty_baton(id);',
+        '+        const bool removed = remove_pty_baton_locked(id);',
         '+        assert(removed);',
         '+        (void)removed;'
       ].join('\n')
diff --git a/src/main/pty/posix-pty-process-groups.test.ts b/src/main/pty/posix-pty-process-groups.test.ts
index ef9acf05030..f0b3727c6ee 100644
--- a/src/main/pty/posix-pty-process-groups.test.ts
+++ b/src/main/pty/posix-pty-process-groups.test.ts
@@ -1,19 +1,33 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ProcessResult } from '../../shared/child-process/run-process'
 
-const { recordSelfInitiatedTreeKillMock } = vi.hoisted(() => ({
-  recordSelfInitiatedTreeKillMock: vi.fn()
+const { recordSelfInitiatedTreeKillMock, runProcessMock, runProcessSyncMock } = vi.hoisted(() => ({
+  recordSelfInitiatedTreeKillMock: vi.fn(),
+  runProcessMock: vi.fn(),
+  runProcessSyncMock: vi.fn()
 }))
 vi.mock('../crash-reporting/self-initiated-tree-kill-log', () => ({
   recordSelfInitiatedTreeKill: recordSelfInitiatedTreeKillMock
 }))
+vi.mock('../../shared/child-process/run-process', () => ({
+  runProcess: runProcessMock,
+  runProcessSync: runProcessSyncMock
+}))
 
 import {
   forceKillPosixPtyProcessGroups,
-  getPosixPtyProcessGroups
+  getPosixPtyProcessGroups,
+  isPosixPtyRootStopped,
+  readPosixPtyProcessTable,
+  resetPosixPtyProcessTableDialectForTests,
+  signalPosixPtyProcessGroups
 } from './posix-pty-process-groups'
 
 beforeEach(() => {
   recordSelfInitiatedTreeKillMock.mockReset()
+  runProcessMock.mockReset()
+  runProcessSyncMock.mockReset()
+  resetPosixPtyProcessTableDialectForTests()
 })
 
 const TABLE = `
@@ -25,6 +39,265 @@ const TABLE = `
   300  300 ??
 `
 
+const ALL_PROCESS_ARGS = [
+  '-e',
+  '-o',
+  'pid=PROCESS_ID,pgid=PROCESS_GID,tty=TERMINAL_DEVICE_NUMBER,stat=PROCESS_STATE'
+]
+const BUSYBOX_TABLE = `
+PROCESS_ID PROCESS_GID TERMINAL_DEVICE_NUMBER
+100 100 136,100
+101 101 136,100
+200 200 136,10
+201 201 136,10
+999 999 ?
+`
+const unsupportedSelection = (stderr = 'ps: unrecognized option: p\n'): ProcessResult => ({
+  code: 1,
+  signal: null,
+  stdout: '',
+  stderr,
+  timedOut: false
+})
+
+describe('ps selection compatibility', () => {
+  it.each([
+    ['p', 'ps: unrecognized option: p\nBusyBox v1.37\nUsage: ps'],
+    ['p', "ps: invalid option -- 'p'\n"],
+    ['p', 'ps: illegal option -- p\n'],
+    ['t', 'ps: unrecognized option: t\n']
+  ])(
+    'falls back after a rejected %s selector and caches only the dialect (%s)',
+    async (option, stderr) => {
+      if (option === 't') {
+        runProcessMock.mockResolvedValueOnce({ code: 0, stdout: '100 100 pts/100' })
+      }
+      runProcessMock
+        .mockResolvedValueOnce(unsupportedSelection(stderr))
+        .mockResolvedValueOnce({ code: 0, stdout: BUSYBOX_TABLE })
+        .mockResolvedValueOnce({
+          code: 0,
+          stdout: BUSYBOX_TABLE.replace('201 201 136,10', '202 202 136,10')
+        })
+
+      const first = await readPosixPtyProcessTable(100)
+      const second = await readPosixPtyProcessTable(200)
+      expect(first).toBe(BUSYBOX_TABLE)
+      expect(getPosixPtyProcessGroups(first, 100, 999)).toEqual([101, 100])
+      expect(getPosixPtyProcessGroups(second, 200, 999)).toEqual([202, 200])
+      expect(runProcessMock.mock.calls.map(([spec]) => spec.args)).toEqual([
+        ['-p', '100', '-o', 'pid=,pgid=,tty=,stat='],
+        ...(option === 't' ? [['-t', 'pts/100', '-o', 'pid=,pgid=,tty=,stat=']] : []),
+        ALL_PROCESS_ARGS,
+        ALL_PROCESS_ARGS
+      ])
+      expect(
+        runProcessMock.mock.calls.every(
+          ([spec]) => spec.maxOutputBytes === 1048576 && spec.timeoutMs === 1000
+        )
+      ).toBe(true)
+    }
+  )
+
+  it('shares the initial unsupported probe across concurrent callers and cancels waiting independently', async () => {
+    let resolveProbe: (result: ProcessResult) => void = () => {}
+    runProcessMock
+      .mockImplementationOnce(
+        () =>
+          new Promise<ProcessResult>((resolve) => {
+            resolveProbe = resolve
+          })
+      )
+      .mockResolvedValue({ code: 0, stdout: BUSYBOX_TABLE })
+    const first = readPosixPtyProcessTable(100)
+    const second = readPosixPtyProcessTable(200)
+    const controller = new AbortController()
+    const cancelled = readPosixPtyProcessTable(300, controller.signal)
+    expect(runProcessMock).toHaveBeenCalledOnce()
+    controller.abort()
+    await expect(cancelled).rejects.toThrow()
+    resolveProbe(unsupportedSelection())
+
+    expect(getPosixPtyProcessGroups(await first, 100, 999)).toEqual([101, 100])
+    expect(getPosixPtyProcessGroups(await second, 200, 999)).toEqual([201, 200])
+    expect(runProcessMock.mock.calls.map(([spec]) => spec.args)).toEqual([
+      ['-p', '100', '-o', 'pid=,pgid=,tty=,stat='],
+      ALL_PROCESS_ARGS,
+      ALL_PROCESS_ARGS
+    ])
+  })
+
+  it('uses the cached async dialect for synchronous teardown with fresh membership', async () => {
+    runProcessMock
+      .mockResolvedValueOnce(unsupportedSelection())
+      .mockResolvedValueOnce({ code: 0, stdout: BUSYBOX_TABLE })
+    await readPosixPtyProcessTable(100)
+    runProcessSyncMock.mockReturnValue({
+      code: 0,
+      stdout: BUSYBOX_TABLE.replace('101 101 136,100', '102 102 136,100')
+    })
+    const signalProcessGroup = vi.fn()
+    const fallback = vi.fn()
+    forceKillPosixPtyProcessGroups(100, fallback, {
+      platform: 'linux',
+      currentPid: 999,
+      signalProcessGroup
+    })
+    expect(runProcessSyncMock.mock.calls.map(([spec]) => spec.args)).toEqual([ALL_PROCESS_ARGS])
+    expect(signalProcessGroup.mock.calls).toEqual([[102], [100]])
+    expect(fallback).not.toHaveBeenCalled()
+  })
+
+  it('discovers unsupported selection during teardown and shares it with async readers', async () => {
+    runProcessSyncMock
+      .mockReturnValueOnce(unsupportedSelection())
+      .mockReturnValueOnce({ code: 0, stdout: BUSYBOX_TABLE })
+    const signalProcessGroup = vi.fn()
+    const fallback = vi.fn()
+    forceKillPosixPtyProcessGroups(100, fallback, {
+      platform: 'linux',
+      currentPid: 999,
+      signalProcessGroup
+    })
+    expect(signalProcessGroup.mock.calls).toEqual([[101], [100]])
+    expect(fallback).not.toHaveBeenCalled()
+    runProcessMock.mockResolvedValueOnce({ code: 0, stdout: BUSYBOX_TABLE })
+    await readPosixPtyProcessTable(200)
+    expect(runProcessMock.mock.calls.map(([spec]) => spec.args)).toEqual([ALL_PROCESS_ARGS])
+  })
+
+  it.each([
+    { stderr: 'ps: permission denied' },
+    { stderr: 'ps: unrecognized option: o' },
+    { stderr: 'ps: unrecognized option: t' },
+    { timedOut: true },
+    { outputTruncated: true },
+    { code: null, signal: 'SIGTERM' }
+  ])('does not turn an unrelated failure into a full-host scan: %j', async (failure) => {
+    runProcessMock.mockResolvedValueOnce({ ...unsupportedSelection(), ...failure })
+    await expect(readPosixPtyProcessTable(100)).rejects.toThrow('unavailable')
+    expect(runProcessMock).toHaveBeenCalledOnce()
+    runProcessMock
+      .mockResolvedValueOnce({ code: 0, stdout: '100 100 ttys001' })
+      .mockResolvedValueOnce({ code: 0, stdout: TABLE })
+    await readPosixPtyProcessTable(100)
+    expect(runProcessMock.mock.calls[1][0].args).toEqual([
+      '-p',
+      '100',
+      '-o',
+      'pid=,pgid=,tty=,stat='
+    ])
+  })
+
+  it.each([{ code: 1 }, { code: 0, timedOut: true }, { code: 0, outputTruncated: true }])(
+    'rejects incomplete fallback snapshots for async discovery and sync teardown: %j',
+    async (failure) => {
+      runProcessMock
+        .mockResolvedValueOnce(unsupportedSelection())
+        .mockResolvedValueOnce({ stdout: BUSYBOX_TABLE, ...failure })
+      await expect(readPosixPtyProcessTable(100)).rejects.toThrow('unavailable')
+      runProcessSyncMock.mockReturnValue({ stdout: BUSYBOX_TABLE, ...failure })
+      const signalProcessGroup = vi.fn()
+      const fallback = vi.fn()
+      forceKillPosixPtyProcessGroups(100, fallback, {
+        platform: 'linux',
+        currentPid: 999,
+        signalProcessGroup
+      })
+      expect(fallback).toHaveBeenCalledOnce()
+      expect(signalProcessGroup).not.toHaveBeenCalled()
+    }
+  )
+
+  it('does not cache a rejected selector if the caller has already cancelled', async () => {
+    const controller = new AbortController()
+    runProcessMock.mockImplementationOnce(async () => {
+      controller.abort()
+      return unsupportedSelection()
+    })
+    await expect(readPosixPtyProcessTable(100, controller.signal)).rejects.toThrow()
+    expect(runProcessMock).toHaveBeenCalledOnce()
+    runProcessMock.mockResolvedValueOnce({ code: 0, stdout: '100 100 ?' })
+    await readPosixPtyProcessTable(100)
+    expect(runProcessMock.mock.calls[1][0].args[0]).toBe('-p')
+  })
+
+  it.each(['?', '??', '-', '0', '0,0'])(
+    'refuses to group processes without a controlling terminal (%s)',
+    (tty) => {
+      expect(getPosixPtyProcessGroups(`100 100 ${tty}\n101 101 ${tty}`, 100, 999)).toBeNull()
+    }
+  )
+
+  it('preserves full numeric terminal identity and the daemon terminal guard', () => {
+    expect(getPosixPtyProcessGroups(BUSYBOX_TABLE, 100, 999)).toEqual([101, 100])
+    expect(getPosixPtyProcessGroups(BUSYBOX_TABLE, 200, 999)).toEqual([201, 200])
+    expect(getPosixPtyProcessGroups(BUSYBOX_TABLE, 100, 101)).toBeNull()
+  })
+})
+
+describe('asynchronous PTY process discovery', () => {
+  it('requires a stopped state for the exact shell process', () => {
+    expect(isPosixPtyRootStopped('100 100 pts/test Ts\n101 101 pts/test R+', 100)).toBe(true)
+    expect(isPosixPtyRootStopped('100 100 pts/test S\n101 101 pts/test T', 100)).toBe(false)
+    expect(isPosixPtyRootStopped('101 101 pts/test T', 100)).toBe(false)
+    expect(isPosixPtyRootStopped('100 100 pts/test\n101 101 pts/test T', 100)).toBe(false)
+  })
+
+  it('bounds each lookup and selects the root terminal without synchronous subprocesses', async () => {
+    const controller = new AbortController()
+    runProcessMock
+      .mockResolvedValueOnce({ code: 0, stdout: '100 100 ttys001' })
+      .mockResolvedValueOnce({ code: 0, stdout: TABLE })
+
+    expect(await readPosixPtyProcessTable(100, controller.signal)).toBe(`100 100 ttys001\n${TABLE}`)
+    expect(
+      runProcessMock.mock.calls.map(([spec]) => [{ ...spec, env: { LC_ALL: spec.env.LC_ALL } }])
+    ).toEqual([
+      [
+        {
+          program: 'ps',
+          env: { LC_ALL: 'C' },
+          args: ['-p', '100', '-o', 'pid=,pgid=,tty=,stat='],
+          timeoutMs: 1000,
+          maxOutputBytes: 1048576,
+          signal: controller.signal
+        }
+      ],
+      [
+        {
+          program: 'ps',
+          env: { LC_ALL: 'C' },
+          args: ['-t', 'ttys001', '-o', 'pid=,pgid=,tty=,stat='],
+          timeoutMs: 1000,
+          maxOutputBytes: 1048576,
+          signal: controller.signal
+        }
+      ]
+    ])
+    expect(runProcessSyncMock).not.toHaveBeenCalled()
+  })
+
+  it.each([{ code: 1 }, { code: 0, timedOut: true }, { code: 0, outputTruncated: true }])(
+    'rejects incomplete process evidence: %j',
+    async (result) => {
+      runProcessMock.mockResolvedValue({ stdout: TABLE, ...result })
+      await expect(readPosixPtyProcessTable(100)).rejects.toThrow('unavailable')
+      expect(runProcessMock).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('does not start the second lookup after cancellation', async () => {
+    const controller = new AbortController()
+    runProcessMock.mockImplementation(async () => {
+      controller.abort()
+      return { code: 0, stdout: '100 100 ttys001' }
+    })
+    await expect(readPosixPtyProcessTable(100, controller.signal)).rejects.toThrow()
+    expect(runProcessMock).toHaveBeenCalledOnce()
+  })
+})
+
 describe('POSIX PTY process-group termination', () => {
   it('returns every group attached to the root PTY with the root group last', () => {
     expect(getPosixPtyProcessGroups(TABLE, 100, 999)).toEqual([101, 103, 100])
@@ -51,6 +324,43 @@ describe('POSIX PTY process-group termination', () => {
     expect(fallback).not.toHaveBeenCalled()
   })
 
+  it.each([
+    ['SIGSTOP', [99, 101, 103]],
+    ['SIGCONT', [101, 103, 99]]
+  ] as const)('orders shell and job groups safely for %s', (signal, expected) => {
+    const signalProcessGroup = vi.fn()
+    signalPosixPtyProcessGroups(100, signal, vi.fn(), {
+      platform: 'linux',
+      currentPid: 999,
+      readProcessTable: () => TABLE.replace('100  100', '100  99'),
+      signalProcessGroup
+    })
+    expect(signalProcessGroup.mock.calls.map(([pgid]) => pgid)).toEqual(expected)
+  })
+
+  it.each(['EPERM', 'ESRCH'])(
+    'does not stop jobs when stopping the shell fails with %s',
+    (code) => {
+      const error = Object.assign(new Error('stop failed'), { code })
+      const signalProcessGroup = vi.fn(() => {
+        throw error
+      })
+      const stop = () =>
+        signalPosixPtyProcessGroups(100, 'SIGSTOP', vi.fn(), {
+          platform: 'linux',
+          currentPid: 999,
+          readProcessTable: () => TABLE,
+          signalProcessGroup
+        })
+      if (code === 'ESRCH') {
+        expect(stop).not.toThrow()
+      } else {
+        expect(stop).toThrow(error)
+      }
+      expect(signalProcessGroup.mock.calls).toEqual([[100]])
+    }
+  )
+
   it('falls back when the process table cannot prove PTY ownership', () => {
     const fallback = vi.fn()
 
diff --git a/src/main/pty/posix-pty-process-groups.ts b/src/main/pty/posix-pty-process-groups.ts
index c34e7ff8123..1f7f05f73a1 100644
--- a/src/main/pty/posix-pty-process-groups.ts
+++ b/src/main/pty/posix-pty-process-groups.ts
@@ -1,13 +1,35 @@
-import { execFileSync } from 'node:child_process'
 import { recordSelfInitiatedTreeKill } from '../crash-reporting/self-initiated-tree-kill-log'
+import { waitForPromiseWithSignal } from '../../shared/abort-signal-reason'
+import {
+  runProcess,
+  runProcessSync,
+  type ProcessResult
+} from '../../shared/child-process/run-process'
 
 const PROCESS_TABLE_TIMEOUT_MS = 1_000
 const PROCESS_TABLE_MAX_BYTES = 1024 * 1024
+const SELECTED_COLUMNS = 'pid=,pgid=,tty=,stat='
+// Explicit widths prevent BusyBox from truncating device numbers into another terminal's identity.
+const ALL_PROCESS_ARGS = [
+  '-e',
+  '-o',
+  'pid=PROCESS_ID,pgid=PROCESS_GID,tty=TERMINAL_DEVICE_NUMBER,stat=PROCESS_STATE'
+]
+let psDialect: 'selected' | 'all' | undefined
+let dialectProbe: Promise<void> | undefined
+
+class UnsupportedPsSelectionError extends Error {}
+
+export function resetPosixPtyProcessTableDialectForTests(): void {
+  psDialect = undefined
+  dialectProbe = undefined
+}
 
 type ProcessRow = {
   pid: number
   pgid: number
   tty: string
+  state?: string
 }
 
 export type PosixPtyProcessGroupTerminationDeps = {
@@ -17,41 +39,149 @@ export type PosixPtyProcessGroupTerminationDeps = {
   signalProcessGroup?: (pgid: number) => void
 }
 
-function runPs(args: string[]): string {
-  return execFileSync('ps', args, {
-    encoding: 'utf8',
-    timeout: PROCESS_TABLE_TIMEOUT_MS,
-    maxBuffer: PROCESS_TABLE_MAX_BYTES
-  })
+function readProcessTableResult(result: ProcessResult): string {
+  if (result.code !== 0 || result.timedOut || result.outputTruncated) {
+    throw new Error('PTY process table is unavailable')
+  }
+  return result.stdout
+}
+
+function readSelectionResult(result: ProcessResult, option: 'p' | 't'): string {
+  const rejectedOption =
+    /^ps: (?:invalid|illegal|unrecognized) option(?: -- |: | )['"]?-?([pt])['"]?\s*$/m.exec(
+      result.stderr ?? ''
+    )?.[1]
+  if (
+    result.code !== null &&
+    result.code !== 0 &&
+    !result.signal &&
+    !result.timedOut &&
+    !result.outputTruncated &&
+    rejectedOption === option
+  ) {
+    throw new UnsupportedPsSelectionError()
+  }
+  const output = readProcessTableResult(result)
+  if (psDialect === 'all') {
+    throw new UnsupportedPsSelectionError()
+  }
+  return output
+}
+
+function hasControllingTty(tty: string): boolean {
+  return tty !== '?' && tty !== '??' && tty !== '-' && tty !== '0' && !/^0,\d+$/.test(tty)
+}
+
+function* processTableQueries(rootPid: number): Generator<string[], string, ProcessResult> {
+  if (psDialect !== 'all') {
+    try {
+      const root = readSelectionResult(yield ['-p', String(rootPid), '-o', SELECTED_COLUMNS], 'p')
+      const rootRow = parseProcessRows(root).find((row) => row.pid === rootPid)
+      if (!rootRow || !hasControllingTty(rootRow.tty)) {
+        return root
+      }
+      const terminal = readSelectionResult(yield ['-t', rootRow.tty, '-o', SELECTED_COLUMNS], 't')
+      psDialect ??= 'selected'
+      return `${root}\n${terminal}`
+    } catch (error) {
+      if (!(error instanceof UnsupportedPsSelectionError)) {
+        throw error
+      }
+      psDialect = 'all'
+    }
+  }
+  return readProcessTableResult(yield ALL_PROCESS_ARGS)
+}
+
+function processTableSpec(args: string[]) {
+  return {
+    program: 'ps',
+    args,
+    env: { ...process.env, LC_ALL: 'C' },
+    timeoutMs: PROCESS_TABLE_TIMEOUT_MS,
+    maxOutputBytes: PROCESS_TABLE_MAX_BYTES
+  }
 }
 
 function readPtyProcessTable(rootPid: number): string {
-  const root = runPs(['-p', String(rootPid), '-o', 'pid=,pgid=,tty='])
-  const rootRow = parseProcessRows(root).find((row) => row.pid === rootPid)
-  if (!rootRow || rootRow.tty === '?' || rootRow.tty === '??') {
-    return root
+  const queries = processTableQueries(rootPid)
+  let next = queries.next()
+  while (!next.done) {
+    next = queries.next(runProcessSync(processTableSpec(next.value)))
+  }
+  return next.value
+}
+
+export async function readPosixPtyProcessTable(
+  rootPid: number,
+  signal?: AbortSignal
+): Promise<string> {
+  while (dialectProbe) {
+    await waitForPromiseWithSignal(dialectProbe, signal)
+  }
+  signal?.throwIfAborted()
+  let releaseProbe: (() => void) | undefined
+  if (psDialect === undefined) {
+    dialectProbe = new Promise<void>((resolve) => {
+      releaseProbe = resolve
+    })
+  }
+  try {
+    const queries = processTableQueries(rootPid)
+    let next = queries.next()
+    while (!next.done) {
+      signal?.throwIfAborted()
+      const result = await runProcess({ ...processTableSpec(next.value), signal })
+      signal?.throwIfAborted()
+      next = queries.next(result)
+    }
+    return next.value
+  } finally {
+    if (releaseProbe) {
+      dialectProbe = undefined
+      releaseProbe()
+    }
   }
-  // Why: a whole-host `ps -ax` takes nearly a second on large machines. TTY
-  // selection keeps forced terminal teardown proportional to one terminal.
-  return `${root}\n${runPs(['-t', rootRow.tty, '-o', 'pid=,pgid=,tty='])}`
 }
 
 function parseProcessRows(output: string): ProcessRow[] {
   const rows: ProcessRow[] = []
   for (const line of output.split(/\r?\n/)) {
-    const match = /^\s*(\d+)\s+(\d+)\s+(\S+)/.exec(line)
+    const match = /^\s*(\d+)\s+(\d+)\s+(\S+)(?:\s+(\S+))?/.exec(line)
     if (!match) {
       continue
     }
     const pid = Number(match[1])
     const pgid = Number(match[2])
     if (pid > 0 && pgid > 1) {
-      rows.push({ pid, pgid, tty: match[3] })
+      rows.push({ pid, pgid, tty: match[3], state: match[4] })
     }
   }
   return rows
 }
 
+export function isPosixPtyRootStopped(output: string, rootPid: number): boolean {
+  return (
+    parseProcessRows(output)
+      .find((row) => row.pid === rootPid)
+      ?.state?.startsWith('T') === true
+  )
+}
+
+/** The root was stopped by flow control; preserve independently stopped jobs. */
+export function getPosixPtyStoppedJobGroups(output: string, rootPid: number): Set<number> {
+  const rows = parseProcessRows(output)
+  const root = rows.find((row) => row.pid === rootPid)
+  return new Set(
+    rows
+      .filter(
+        (row) =>
+          root && row.tty === root.tty && row.pgid !== root.pgid && /^[Tt]/.test(row.state ?? '')
+      )
+      .map((row) => row.pgid)
+  )
+}
+
 export function getPosixPtyProcessGroups(
   output: string,
   rootPid: number,
@@ -59,7 +189,7 @@ export function getPosixPtyProcessGroups(
 ): number[] | null {
   const rows = parseProcessRows(output)
   const root = rows.find((row) => row.pid === rootPid)
-  if (!root || root.tty === '?' || root.tty === '??') {
+  if (!root || !hasControllingTty(root.tty)) {
     return null
   }
   // Why: a development daemon can inherit its launch TTY. Never group-signal
@@ -91,6 +221,16 @@ export function forceKillPosixPtyProcessGroups(
   rootPid: number,
   fallback: () => void,
   deps: PosixPtyProcessGroupTerminationDeps = {}
+): void {
+  signalPosixPtyProcessGroups(rootPid, 'SIGKILL', fallback, deps)
+}
+
+/** Signal every process group proven to belong to one POSIX PTY. */
+export function signalPosixPtyProcessGroups(
+  rootPid: number,
+  signal: NodeJS.Signals,
+  fallback: () => void,
+  deps: PosixPtyProcessGroupTerminationDeps = {}
 ): void {
   if ((deps.platform ?? process.platform) === 'win32') {
     fallback()
@@ -110,14 +250,24 @@ export function forceKillPosixPtyProcessGroups(
     fallback()
     return
   }
+  if (signal === 'SIGSTOP') {
+    // Stop the shell before its jobs so it cannot treat their suspension as completion.
+    groups.unshift(...groups.splice(-1))
+  }
 
   const signalProcessGroup =
-    deps.signalProcessGroup ?? ((pgid: number) => process.kill(-pgid, 'SIGKILL'))
+    deps.signalProcessGroup ?? ((pgid: number) => process.kill(-pgid, signal))
   let firstError: unknown
   for (const pgid of groups) {
     try {
       signalProcessGroup(pgid)
     } catch (error) {
+      if (signal === 'SIGSTOP' && pgid === groups[0]) {
+        if (isProcessAlreadyGone(error)) {
+          return
+        }
+        throw error
+      }
       // Why: the PTY exit callback may reap a group between `ps` and killpg.
       // ESRCH is proof that this captured owner is already gone, not failure.
       if (!isProcessAlreadyGone(error) && firstError === undefined) {
@@ -127,11 +277,13 @@ export function forceKillPosixPtyProcessGroups(
     }
     // Outside the try: this catch is the ESRCH contract, and a throw from the
     // breadcrumb path would be rethrown as a failed kill.
-    recordSelfInitiatedTreeKill({
-      pid: pgid,
-      site: 'posix-pty-process-group-sweep',
-      scope: 'posix-process-group'
-    })
+    if (signal === 'SIGKILL') {
+      recordSelfInitiatedTreeKill({
+        pid: pgid,
+        site: 'posix-pty-process-group-sweep',
+        scope: 'posix-process-group'
+      })
+    }
   }
   if (firstError !== undefined) {
     throw firstError
diff --git a/src/main/pty/wsl-orca-env.test.ts b/src/main/pty/wsl-orca-env.test.ts
index e56146ea991..1df30613076 100644
--- a/src/main/pty/wsl-orca-env.test.ts
+++ b/src/main/pty/wsl-orca-env.test.ts
@@ -62,6 +62,7 @@ describe('addOrcaWslInteropEnv', () => {
       ORCA_TERMINAL_HANDLE: 'term_wsl',
       ORCA_USER_DATA_PATH: 'C:\\Users\\jin\\AppData\\Roaming\\Orca',
       ORCA_CLI_COMMAND: 'orca-ide',
+      ORCA_WSL_CLI_DIR: 'C:\\Users\\jin\\AppData\\Roaming\\Orca\\wsl-managed-cli\\hash',
       ORCA_CODEX_LAUNCH_PREFLIGHT: 'C:\\Program Files\\Orca\\resources\\bin\\orca.exe',
       ORCA_OMP_FRESH_CONFIG: 'C:\\Orca\\fresh-session.yml',
       ORCA_OMP_STATUS_EXTENSION: 'C:\\Users\\jin\\.omp\\agent\\extensions\\orca-agent-status.ts',
@@ -87,6 +88,7 @@ describe('addOrcaWslInteropEnv', () => {
     expect(env.WSLENV).toContain('ORCA_TERMINAL_HANDLE/u')
     expect(env.WSLENV).toContain('ORCA_USER_DATA_PATH/p')
     expect(env.WSLENV).toContain('ORCA_CLI_COMMAND/u')
+    expect(env.WSLENV).toContain('ORCA_WSL_CLI_DIR/p')
     expect(env.WSLENV).toContain('ORCA_CODEX_LAUNCH_PREFLIGHT/p')
     expect(env.WSLENV).toContain('ORCA_OMP_STATUS_EXTENSION/p')
     expect(env.WSLENV).toContain('ORCA_OMP_FRESH_CONFIG/p')
diff --git a/src/main/pty/wsl-orca-env.ts b/src/main/pty/wsl-orca-env.ts
index 04035a957ca..0044399009f 100644
--- a/src/main/pty/wsl-orca-env.ts
+++ b/src/main/pty/wsl-orca-env.ts
@@ -79,7 +79,10 @@ export function addOrcaWslInteropEnv(env: Record<string, string>): void {
     // and it cannot derive the hash segment from ORCA_USER_DATA_PATH alone.
     'ORCA_SHELL_READY_ROOT/p',
     'ORCA_CLI_COMMAND/u',
+    // Why /p: the managed CLI launcher lives in the host's userData tree.
+    'ORCA_WSL_CLI_DIR/p',
     'ORCA_CODEX_LAUNCH_PREFLIGHT/p',
+    'ORCA_CODEX_ISOLATE/u',
     'ORCA_PANE_KEY/u',
     'ORCA_TAB_ID/u',
     'ORCA_WORKTREE_ID/u',
diff --git a/src/main/qoder/hook-service.test.ts b/src/main/qoder/hook-service.test.ts
new file mode 100644
index 00000000000..3af282ecd76
--- /dev/null
+++ b/src/main/qoder/hook-service.test.ts
@@ -0,0 +1,102 @@
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import type * as OsModule from 'node:os'
+import { join } from 'node:path'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+const sandbox = vi.hoisted(() => ({ home: '' }))
+vi.mock('node:os', async (importOriginal) => ({
+  ...(await importOriginal<typeof OsModule>()),
+  homedir: () => sandbox.home
+}))
+vi.mock('electron', () => ({ app: { getPath: () => sandbox.home } }))
+import { getManagedLifecycleHook, hasSameManagedHookInvocation } from '../claude/hook-settings'
+import { createManagedCommandMatcher } from '../agent-hooks/installer-utils'
+import { qoderHookService, QODER_HOOK_EVENTS } from './hook-service'
+import { markQoderWorkspaceTrusted, withQoderTrustedWorkspace } from './workspace-trust'
+
+beforeAll(() => {
+  sandbox.home = mkdtempSync(join(tmpdir(), 'orca-qoder-test-'))
+  mkdirSync(join(sandbox.home, '.qoder'))
+})
+afterAll(() => {
+  rmSync(sandbox.home, { recursive: true, force: true })
+})
+
+describe('Qoder managed configuration', () => {
+  it('preserves user hooks and trust, installs idempotently, then removes only Orca hooks', () => {
+    const path = join(sandbox.home, '.qoder', 'settings.json')
+    const userHook = { hooks: [{ type: 'command', command: 'echo user-hook' }] }
+    writeFileSync(
+      path,
+      JSON.stringify({
+        model: 'custom',
+        hooks: { Stop: [userHook] },
+        permissions: { trustDirectories: ['/existing'] }
+      })
+    )
+    expect(qoderHookService.install().state).toBe('installed')
+    expect(qoderHookService.install().state).toBe('installed')
+    const installed = JSON.parse(readFileSync(path, 'utf8'))
+    for (const event of QODER_HOOK_EVENTS) {
+      expect(installed.hooks[event]).toHaveLength(event === 'Stop' ? 2 : 1)
+    }
+    expect(installed.hooks.TeammateIdle).toBeUndefined()
+    expect(installed.statusLine).toBeUndefined()
+    markQoderWorkspaceTrusted('/new-workspace')
+    const trusted = JSON.parse(readFileSync(path, 'utf8'))
+    expect(trusted.permissions.trustDirectories).toEqual(['/existing', '/new-workspace'])
+    expect(trusted.hooks).toEqual(installed.hooks)
+    expect(qoderHookService.remove().state).toBe('not_installed')
+    expect(JSON.parse(readFileSync(path, 'utf8'))).toMatchObject({
+      model: 'custom',
+      hooks: { Stop: [userHook] }
+    })
+  })
+
+  it("writes every Qoder event whatever Claude version is passed, since Claude's table never applies", () => {
+    const path = join(sandbox.home, '.qoder', 'settings.json')
+    writeFileSync(path, JSON.stringify({ hooks: {} }))
+    expect(qoderHookService.install({ claudeVersion: '1.0.62' }).state).toBe('installed')
+    const installed = JSON.parse(readFileSync(path, 'utf8'))
+    expect(Object.keys(installed.hooks).sort()).toEqual([...QODER_HOOK_EVENTS].sort())
+    expect(installed.statusLine).toBeUndefined()
+    expect(qoderHookService.remove().state).toBe('not_installed')
+  })
+
+  it('refuses malformed settings instead of overwriting them', () => {
+    const path = join(sandbox.home, '.qoder', 'settings.json')
+    writeFileSync(path, '{broken')
+    expect(qoderHookService.install().state).toBe('error')
+    markQoderWorkspaceTrusted('/new-workspace')
+    expect(readFileSync(path, 'utf8')).toBe('{broken')
+    expect(withQoderTrustedWorkspace({ permissions: 'invalid' }, '/workspace')).toBeNull()
+    expect(
+      withQoderTrustedWorkspace({ permissions: { trustDirectories: true } }, '/workspace')
+    ).toBeNull()
+  })
+})
+
+describe('Qoder Windows hook shell', () => {
+  it('uses the documented explicit shell without relying on Git Bash or another PowerShell hop', () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+    try {
+      const hook = getManagedLifecycleHook(
+        'C:\\Users\\a b\\.orca\\agent-hooks\\qoder-hook.cmd',
+        {
+          configDirName: '.qoder',
+          scriptBaseName: 'qoder-hook',
+          usesWindowsCompatLauncher: true,
+          windowsHookShell: 'powershell'
+        },
+        { gitBashAvailable: true }
+      )
+      expect(hook.shell).toBe('powershell')
+      expect(hook.command).toContain('$env:USERPROFILE')
+      expect(hook.command).not.toMatch(/EncodedCommand|ExecutionPolicy|\|\|/)
+      expect(createManagedCommandMatcher('qoder-hook.cmd')(hook.command)).toBe(true)
+      expect(hasSameManagedHookInvocation({ ...hook, shell: undefined }, hook)).toBe(false)
+    } finally {
+      vi.restoreAllMocks()
+    }
+  })
+})
diff --git a/src/main/qoder/hook-service.ts b/src/main/qoder/hook-service.ts
new file mode 100644
index 00000000000..ac9e869638c
--- /dev/null
+++ b/src/main/qoder/hook-service.ts
@@ -0,0 +1,38 @@
+import type { ClaudeManagedHookPlan } from '../claude/claude-managed-hook-events'
+import { ClaudeHookService } from '../claude/hook-service'
+
+// Qoder documents Claude-shaped hooks at https://docs.qoder.com/cli/hooks.
+export const QODER_HOOK_EVENTS = [
+  'SessionStart',
+  'SessionEnd',
+  'UserPromptSubmit',
+  'PreToolUse',
+  'PostToolUse',
+  'PostToolUseFailure',
+  'PermissionRequest',
+  'Stop',
+  'StopFailure',
+  'Notification',
+  'PostCompact'
+] as const
+
+// Why: Qoder's own CLI reads these events, so Claude's version table never applies; the statusline
+// usage feed is Claude-only.
+export const QODER_MANAGED_HOOK_PLAN: ClaudeManagedHookPlan = {
+  install: QODER_HOOK_EVENTS.map((eventName) => ({ eventName, definition: {} })),
+  retire: [],
+  statusLine: 'leave'
+}
+
+export const qoderHookService = new ClaudeHookService({
+  agent: 'qoder',
+  source: 'qoder',
+  displayName: 'Qoder CLI',
+  settings: {
+    configDirName: '.qoder',
+    scriptBaseName: 'qoder-hook',
+    usesWindowsCompatLauncher: true,
+    windowsHookShell: 'powershell'
+  },
+  hookPlan: QODER_MANAGED_HOOK_PLAN
+})
diff --git a/src/main/qoder/workspace-trust.ts b/src/main/qoder/workspace-trust.ts
new file mode 100644
index 00000000000..8862a76dd75
--- /dev/null
+++ b/src/main/qoder/workspace-trust.ts
@@ -0,0 +1,44 @@
+import { realpathSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import { isPlainObject, readHooksJson, writeHooksJson } from '../agent-hooks/installer-utils'
+
+// Qoder 1.1.64 writes this exact shape after accepting its folder-trust prompt.
+export function withQoderTrustedWorkspace(
+  config: Record<string, unknown>,
+  workspacePath: string
+): Record<string, unknown> | null {
+  if (config.permissions !== undefined && !isPlainObject(config.permissions)) {
+    return null
+  }
+  const permissions = isPlainObject(config.permissions) ? config.permissions : {}
+  if (permissions.trustDirectories !== undefined && !Array.isArray(permissions.trustDirectories)) {
+    return null
+  }
+  const existing = Array.isArray(permissions.trustDirectories) ? permissions.trustDirectories : []
+  if (existing.includes(workspacePath)) {
+    return config
+  }
+  return {
+    ...config,
+    permissions: { ...permissions, trustDirectories: [...existing, workspacePath] }
+  }
+}
+
+export function markQoderWorkspaceTrusted(workspacePath: string): void {
+  let canonicalPath = workspacePath
+  try {
+    canonicalPath = realpathSync.native(workspacePath)
+  } catch {
+    /* Keep the supplied path when absent. */
+  }
+  const configPath = join(homedir(), '.qoder', 'settings.json')
+  const config = readHooksJson(configPath)
+  if (!config) {
+    return
+  }
+  const updated = withQoderTrustedWorkspace(config, canonicalPath)
+  if (updated && updated !== config) {
+    writeHooksJson(configPath, updated)
+  }
+}
diff --git a/src/main/quit-path-durable-write-blocking.test.ts b/src/main/quit-path-durable-write-blocking.test.ts
index 5d09e2057a7..11bea685c7e 100644
--- a/src/main/quit-path-durable-write-blocking.test.ts
+++ b/src/main/quit-path-durable-write-blocking.test.ts
@@ -1,10 +1,11 @@
+import { createWorkerMaintenanceFixture } from './persistence/loading-store/profile-state-maintenance-fixture'
+import type { Store } from './persistence/loading-store/store'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { mkdtempSync, readFileSync, existsSync, rmSync, utimesSync, writeFileSync } from 'node:fs'
 import type * as NodeFs from 'node:fs'
 import type * as NodeFsPromises from 'node:fs/promises'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
-import { installFakeAppEnvironment } from '../../config/scripts/vitest-host-ports-setup'
 
 // Why these tests exist: will-quit used to run stats.flush() and store.flush() synchronously,
 // before preventDefault(). On a stalled network profile mount those fsync/rename syscalls park
@@ -108,37 +109,68 @@ vi.mock('electron', () => ({
   }
 }))
 
-type TestStore = {
-  updateUI(updates: { sidebarWidth?: number; activeView?: string }): void
-  setGitHubCache(cache: unknown): void
-  waitForPendingWrite(): Promise<void>
-  flushAsync(): Promise<void>
-  flushOrThrow(): void
-  stageWorkspaceSessionBeforeUnload(session: Record<string, unknown>): void
-}
-
 type TestStatsCollector = {
   onAgentStart(ptyId: string, at: number, repo?: string, worktree?: string): void
   getSummary(): { totalAgentsSpawned: number; totalAgentTimeMs: number }
   flushAsync(): Promise<void>
 }
 
-async function createStore(dir: string): Promise<TestStore> {
+const profiles = new Map<string, Awaited<ReturnType<typeof createWorkerMaintenanceFixture>>>()
+const stores: Store[] = []
+const statsCollectors: TestStatsCollector[] = []
+const releases: (() => void)[] = []
+
+async function createStore(dir: string): Promise<Store> {
   testState.dir = dir
-  vi.resetModules()
-  const { Store, initDataPath } = await import('./persistence')
-  // Why: userData resolves through AppEnvironment; point it at this file's temp dir.
-  installFakeAppEnvironment({ getPath: () => testState.dir })
-  initDataPath()
-  return new Store() as unknown as TestStore
+  const fixture = await createWorkerMaintenanceFixture({ directory: dir, profileId: 'quit-test' })
+  profiles.set(dir, fixture)
+  stores.push(fixture.store)
+  fixture.store.updateUI({ activeView: 'terminal' })
+  await fixture.store.flushPendingOrThrowAsync()
+  await fixture.authority.drainBackups()
+  return fixture.store
+}
+
+function readState(dir: string) {
+  const profile = profiles.get(dir)
+  if (!profile) {
+    throw new Error('Missing test profile')
+  }
+  return profile.readState()
+}
+
+function stallFilesystem(): void {
+  const gate = Promise.withResolvers<void>()
+  releases.push(gate.resolve)
+  fsCalls.holdAsync = gate.promise
+}
+
+function stallCommit(dir: string) {
+  const profile = profiles.get(dir)
+  if (!profile) {
+    throw new Error('Missing test profile')
+  }
+  const started = Promise.withResolvers<void>()
+  const finish = Promise.withResolvers<void>()
+  releases.push(finish.resolve)
+  const original = profile.authority.writeCompleteSerializedDomains.bind(profile.authority)
+  vi.spyOn(profile.authority, 'writeCompleteSerializedDomains').mockImplementationOnce(
+    async (rows) => {
+      started.resolve()
+      await finish.promise
+      await original(rows)
+    }
+  )
+  return { started: started.promise, release: finish.resolve }
 }
 
 async function createStatsCollector(dir: string): Promise<TestStatsCollector> {
   testState.dir = dir
-  vi.resetModules()
   const { StatsCollector, initStatsPath } = await import('./stats/collector')
   initStatsPath()
-  return new StatsCollector() as unknown as TestStatsCollector
+  const stats = new StatsCollector()
+  statsCollectors.push(stats)
+  return stats
 }
 
 const dataFile = (dir: string): string => join(dir, 'orca-data.json')
@@ -165,8 +197,17 @@ describe('quit-path durable writes never park the main thread', () => {
     fsCalls.reset()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    fsCalls.recording = false
+    for (const release of releases.splice(0)) {
+      release()
+    }
+    fsCalls.holdAsync = null
+    fsCalls.waitAsync = null
     vi.useRealTimers()
+    await Promise.all(stores.splice(0).map((store) => store.freezeWritesAsync()))
+    await Promise.all(statsCollectors.splice(0).map((stats) => stats.flushAsync()))
+    profiles.clear()
     for (const dir of dirs.splice(0)) {
       rmSync(dir, { recursive: true, force: true })
     }
@@ -183,7 +224,7 @@ describe('quit-path durable writes never park the main thread', () => {
     fsCalls.recording = false
 
     expect(fsCalls.syncCalls).toEqual([])
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(321)
+    expect(readState(dir).ui.sidebarWidth).toBe(321)
   })
 
   it('renderer unload staging issues no synchronous fs syscalls', async () => {
@@ -194,6 +235,9 @@ describe('quit-path durable writes never park the main thread', () => {
     fsCalls.recording = true
     const leafId = '11111111-1111-4111-8111-111111111111'
     store.stageWorkspaceSessionBeforeUnload({
+      activeRepoId: null,
+      activeWorktreeId: null,
+      activeTabId: null,
       tabsByWorktree: {
         'remote-repo::/remote': [
           {
@@ -222,8 +266,7 @@ describe('quit-path durable writes never park the main thread', () => {
 
     expect(fsCalls.syncCalls).toEqual([])
     await store.flushAsync()
-    const layout = JSON.parse(readFileSync(dataFile(dir), 'utf-8')).workspaceSession
-      .terminalLayoutsByTabId['remote-tab']
+    const layout = readState(dir).workspaceSession.terminalLayoutsByTabId['remote-tab']
     const ref = layout.scrollbackRefsByLeafId[leafId]
     expect(layout.buffersByLeafId).toBeUndefined()
     expect(readFileSync(join(dir, 'terminal-scrollback', `${ref}.bin`), 'utf-8')).toBe(
@@ -239,7 +282,7 @@ describe('quit-path durable writes never park the main thread', () => {
     utimesSync(staleCacheTemp, staleSeconds, staleSeconds)
     const store = await createStore(dir)
     store.updateUI({ activeView: 'activity' })
-    store.setGitHubCache({ pullRequestsByWorktree: {} })
+    store.setGitHubCache({ pr: {}, issue: {} })
 
     fsCalls.dirPrefix = dir
     fsCalls.recording = true
@@ -270,7 +313,6 @@ describe('quit-path durable writes never park the main thread', () => {
     const dir = makeDir()
     const previousGrokHome = process.env.GROK_HOME
     process.env.GROK_HOME = dir
-    vi.resetModules()
     const { GrokHookService } = await import('./grok/hook-service')
     const service = new GrokHookService()
     try {
@@ -314,7 +356,7 @@ describe('quit-path durable writes never park the main thread', () => {
     stats.onAgentStart('pty-1', Date.now() - 4_000)
 
     fsCalls.dirPrefix = dir
-    fsCalls.holdAsync = new Promise(() => {})
+    stallFilesystem()
     const pending = stats.flushAsync()
 
     expect(stats.getSummary().totalAgentTimeMs).toBeGreaterThan(0)
@@ -327,9 +369,9 @@ describe('quit-path durable writes never park the main thread', () => {
     store.updateUI({ sidebarWidth: 654 })
 
     fsCalls.dirPrefix = dir
-    // Every fs call from here on never resolves — the mount is gone.
-    fsCalls.holdAsync = new Promise(() => {})
+    const gate = stallCommit(dir)
     const pending = store.flushAsync()
+    await gate.started
 
     // The whole point: timers still fire, so the app still repaints and the quit
     // deadline below can still be reached. A sync flush would have blocked here.
@@ -344,8 +386,10 @@ describe('quit-path durable writes never park the main thread', () => {
     store.updateUI({ sidebarWidth: 999 })
 
     fsCalls.dirPrefix = dir
-    fsCalls.holdAsync = new Promise(() => {})
+    const before = readState(dir).ui.sidebarWidth
+    const gate = stallCommit(dir)
     const pending = store.flushAsync()
+    await gate.started
 
     const outstanding = await settleTeardownWithinDeadline(
       [{ name: 'state', promise: pending }],
@@ -353,23 +397,28 @@ describe('quit-path durable writes never park the main thread', () => {
     )
 
     expect(outstanding).toEqual(['state'])
-    // Cut short before the rename, so the previous file is still whole — bounded loss, no corruption.
-    expect(existsSync(dataFile(dir))).toBe(false)
+    expect(readState(dir).ui.sidebarWidth).toBe(before)
+    gate.release()
+    await pending
+    expect(readState(dir).ui.sidebarWidth).toBe(999)
   })
 
   it('store.flushAsync() drains an in-flight debounced write before writing', async () => {
-    vi.useFakeTimers()
     const dir = makeDir()
     const store = await createStore(dir)
+    const gate = stallCommit(dir)
+    vi.useFakeTimers()
     store.updateUI({ sidebarWidth: 100 })
     await vi.advanceTimersByTimeAsync(1_000)
+    await gate.started
 
     store.updateUI({ sidebarWidth: 200 })
     const flushed = store.flushAsync()
-    await vi.runAllTimersAsync()
+    vi.useRealTimers()
+    gate.release()
     await flushed
 
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(200)
+    expect(readState(dir).ui.sidebarWidth).toBe(200)
   })
 
   it('store.flushAsync() is one idempotent final barrier', async () => {
@@ -383,7 +432,7 @@ describe('quit-path durable writes never park the main thread', () => {
     expect(second).toBe(first)
     expect(() => store.flushOrThrow()).toThrow('final persistence')
     await first
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(777)
+    expect(readState(dir).ui.sidebarWidth).toBe(777)
   })
 
   it('serializes github-cache snapshots and keeps the newest generation', async () => {
@@ -394,6 +443,7 @@ describe('quit-path durable writes never park the main thread', () => {
       releaseWrite = resolve
     })
     let signalWrite!: () => void
+    releases.push(releaseWrite)
     const writeStarted = new Promise<void>((resolve) => {
       signalWrite = resolve
     })
@@ -409,17 +459,18 @@ describe('quit-path durable writes never park the main thread', () => {
       return writeRelease
     }
 
-    store.setGitHubCache({ version: 1 })
+    store.setGitHubCache({ pr: { test: { data: null, fetchedAt: 1 } }, issue: {} })
     const finalFlush = store.flushAsync()
     await writeStarted
-    store.setGitHubCache({ version: 2 })
+    store.setGitHubCache({ pr: { test: { data: null, fetchedAt: 2 } }, issue: {} })
 
     releaseWrite()
     await finalFlush
     fsCalls.recording = false
 
     expect(JSON.parse(readFileSync(join(dir, 'orca-github-cache.json'), 'utf-8'))).toEqual({
-      version: 2
+      pr: { test: { data: null, fetchedAt: 2 } },
+      issue: {}
     })
   })
 
@@ -444,9 +495,9 @@ describe('quit-path durable writes never park the main thread', () => {
   it('the quit flush is the last write — later mutations do not schedule another', async () => {
     // A teardown step that touches the store would otherwise arm a debounced write with
     // nothing awaiting it, leaving a rename to race the process exit.
-    vi.useFakeTimers()
     const dir = makeDir()
     const store = await createStore(dir)
+    vi.useFakeTimers()
     store.updateUI({ sidebarWidth: 10 })
     await store.flushAsync()
 
@@ -457,11 +508,11 @@ describe('quit-path durable writes never park the main thread', () => {
     fsCalls.recording = false
 
     expect(fsCalls.syncCalls).toEqual([])
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(10)
+    expect(readState(dir).ui.sidebarWidth).toBe(10)
     expect(JSON.parse(readFileSync(activeViewFile(dir), 'utf-8')).activeView).toBe('terminal')
   })
 
-  it('sweeps orphaned state and stats temp files before the final write', async () => {
+  it('sweeps orphaned state and stats temps while retaining fresh process temps', async () => {
     const dir = makeDir()
     const stateTemp = `${dataFile(dir)}.999999.1.orphan.tmp`
     const statsTemp = `${statsFile(dir)}.999999.1.orphan.tmp`
@@ -480,6 +531,7 @@ describe('quit-path durable writes never park the main thread', () => {
     await Promise.all([store.flushAsync(), stats.flushAsync()])
 
     expect(existsSync(stateTemp)).toBe(false)
+    expect(existsSync(dataFile(dir))).toBe(false)
     expect(existsSync(statsTemp)).toBe(false)
     expect(existsSync(freshOtherProcessTemp)).toBe(true)
   })
@@ -488,7 +540,13 @@ describe('quit-path durable writes never park the main thread', () => {
     const dir = makeDir()
     const store = await createStore(dir)
     store.updateUI({ sidebarWidth: 42 })
-    rmSync(dir, { recursive: true, force: true })
+    const profile = profiles.get(dir)
+    if (!profile) {
+      throw new Error('Missing test profile')
+    }
+    vi.spyOn(profile.authority, 'writeCompleteSerializedDomains').mockRejectedValueOnce(
+      new Error('profile mount rejected write')
+    )
 
     // It joins the teardown barrier; a rejection there is noise that must not cancel the quit.
     await expect(store.flushAsync()).resolves.toBeUndefined()
diff --git a/src/main/quit-teardown-agent-browser-daemons.test.ts b/src/main/quit-teardown-agent-browser-daemons.test.ts
deleted file mode 100644
index 315eba73aa0..00000000000
--- a/src/main/quit-teardown-agent-browser-daemons.test.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-/**
- * agent-browser forks a daemon per browser tab that Orca holds no handle on, and
- * `destroyAllSessions` closes each one by spawning another agent-browser child —
- * hundreds of ms apiece. Left off the will-quit barrier, `app.quit()` fired first and
- * every open tab's daemon outlived the app (#16367).
- */
-const source = readFileSync(join(__dirname, 'startup', 'main-process-quit.ts'), 'utf8')
-
-function teardownBarrierMembers(): string {
-  const start = source.indexOf('settleTeardownWithinDeadline([')
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = source.indexOf('])', start)
-  expect(end).toBeGreaterThan(start)
-  return source.slice(start, end)
-}
-
-describe('quit teardown of agent-browser daemons', () => {
-  it('joins the will-quit teardown barrier', () => {
-    expect(teardownBarrierMembers()).toContain("{ name: 'browser', promise: browserShutdown }")
-  })
-
-  it('captures the destroyAllSessions promise instead of firing and forgetting', () => {
-    expect(source).toMatch(
-      /const browserShutdown = \(async \(\): Promise<void> => \{[\s\S]*?await state\.runtime\?\.getAgentBrowserBridge\(\)\?\.destroyAllSessions\(\)\s+\}\)\(\)/
-    )
-    // Why: a second, uncaptured call site is the pre-fix shape — it loses the race to app.quit().
-    expect(source.match(/getAgentBrowserBridge\(\)\?\.destroyAllSessions\(\)/g)).toHaveLength(1)
-  })
-})
diff --git a/src/main/rate-limits/cursor-auth-paths.ts b/src/main/rate-limits/cursor-auth-paths.ts
new file mode 100644
index 00000000000..72a3006a8ae
--- /dev/null
+++ b/src/main/rate-limits/cursor-auth-paths.ts
@@ -0,0 +1,34 @@
+import os from 'node:os'
+import { join } from 'node:path'
+
+/** Where a Cursor credential was found. */
+export type CursorAuthSource = 'keychain' | 'cli' | 'desktop'
+
+function cursorConfigRoot(source: Exclude<CursorAuthSource, 'keychain'>): string {
+  if (process.platform === 'darwin') {
+    return source === 'desktop'
+      ? join(os.homedir(), 'Library', 'Application Support', 'Cursor')
+      : join(os.homedir(), '.cursor')
+  }
+  if (process.platform === 'win32') {
+    const root = process.env.APPDATA?.trim() || join(os.homedir(), 'AppData', 'Roaming')
+    return join(root, 'Cursor')
+  }
+  const root = process.env.XDG_CONFIG_HOME?.trim() || join(os.homedir(), '.config')
+  return join(root, source === 'desktop' ? 'Cursor' : 'cursor')
+}
+
+/** Cursor IDE global storage; holds `cursorAuth/*` keys in an `ItemTable` row. */
+export function getCursorDesktopStateDbPath(): string {
+  return join(cursorConfigRoot('desktop'), 'User', 'globalStorage', 'state.vscdb')
+}
+
+/** Pre-2026.06 `cursor-agent` token file; newer CLIs keep the token in the OS keychain. */
+export function getCursorCliAuthPath(): string {
+  return join(cursorConfigRoot('cli'), 'auth.json')
+}
+
+/** `cursor-agent` settings file; its `authInfo` block carries the signed-in identity, never a token. */
+export function getCursorCliConfigPath(): string {
+  return join(cursorConfigRoot('cli'), 'cli-config.json')
+}
diff --git a/src/main/rate-limits/cursor-auth.test.ts b/src/main/rate-limits/cursor-auth.test.ts
new file mode 100644
index 00000000000..8280bf984cd
--- /dev/null
+++ b/src/main/rate-limits/cursor-auth.test.ts
@@ -0,0 +1,230 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const keychainState = vi.hoisted<{ token: string | null; error: Error | null }>(() => ({
+  token: null,
+  error: null
+}))
+const files = vi.hoisted<() => Map<string, string | Error>>(() => {
+  const map = new Map<string, string | Error>()
+  return () => map
+})
+const desktopState = vi.hoisted<{
+  result: { status: string; profile?: unknown; error?: string }
+}>(() => ({ result: { status: 'missing' } }))
+
+vi.mock('../macos-keychain/generic-password', () => ({
+  readKeychainPassword: async () => {
+    if (keychainState.error) {
+      throw keychainState.error
+    }
+    return keychainState.token
+  }
+}))
+
+vi.mock('node:fs', () => ({
+  existsSync: (path: string) => files().has(path),
+  readFileSync: (path: string) => {
+    const entry = files().get(path)
+    if (entry instanceof Error) {
+      throw entry
+    }
+    if (entry === undefined) {
+      throw new Error('ENOENT')
+    }
+    return entry
+  }
+}))
+
+vi.mock('./cursor-desktop-state-db', () => ({
+  readCursorDesktopProfile: () => desktopState.result
+}))
+
+import { readCursorAuthSession, readCursorCliIdentity } from './cursor-auth'
+
+type JwtSegment = Record<string, unknown>
+
+function expiredJwt(sub: string): string {
+  const encode = (value: JwtSegment): string =>
+    Buffer.from(JSON.stringify(value)).toString('base64url')
+  return `${encode({ alg: 'RS256' })}.${encode({ sub, exp: 1_000 })}.signature`
+}
+
+function jwt(sub: string): string {
+  const encode = (value: JwtSegment): string =>
+    Buffer.from(JSON.stringify(value)).toString('base64url')
+  return `${encode({ alg: 'RS256' })}.${encode({ sub, exp: 2_000_000_000 })}.signature`
+}
+
+const CLI_AUTH = '/cli/auth.json'
+const CLI_CONFIG = '/cli/cli-config.json'
+const DESKTOP_DB = '/desktop/state.vscdb'
+const options = {
+  cliAuthPath: CLI_AUTH,
+  cliConfigPath: CLI_CONFIG,
+  desktopStateDbPath: DESKTOP_DB
+}
+
+const originalPlatform = process.platform
+
+function setPlatform(platform: NodeJS.Platform): void {
+  Object.defineProperty(process, 'platform', { value: platform, configurable: true })
+}
+
+beforeEach(() => {
+  // Why: the keychain source is macOS-only by an explicit platform check, so
+  // these cases must pin the platform rather than inherit the CI runner's.
+  setPlatform('darwin')
+  keychainState.token = null
+  keychainState.error = null
+  files().clear()
+  desktopState.result = { status: 'missing' }
+})
+
+afterEach(() => {
+  setPlatform(originalPlatform)
+  vi.restoreAllMocks()
+})
+
+describe('readCursorAuthSession', () => {
+  it('prefers the keychain session cursor-agent 2026.06+ writes', async () => {
+    keychainState.token = jwt('auth0|user_keychain')
+    files().set(CLI_AUTH, JSON.stringify({ accessToken: jwt('auth0|user_file') }))
+    const result = await readCursorAuthSession(options)
+    expect(result.status).toBe('ok')
+    expect(result.status === 'ok' && result.session.source).toBe('keychain')
+    expect(result.status === 'ok' && result.session.token.subject).toBe('auth0|user_keychain')
+  })
+
+  it('names the signed-in account from cli-config.json, which holds no token', async () => {
+    keychainState.token = jwt('auth0|user_1')
+    files().set(
+      CLI_CONFIG,
+      JSON.stringify({ authInfo: { email: 'dev@example.com', displayName: 'Dev' } })
+    )
+    const result = await readCursorAuthSession(options)
+    expect(result.status === 'ok' && result.session.email).toBe('dev@example.com')
+    expect(result.status === 'ok' && result.session.displayName).toBe('Dev')
+  })
+
+  it('falls back to the legacy CLI auth file when the keychain holds nothing', async () => {
+    files().set(CLI_AUTH, JSON.stringify({ accessToken: jwt('auth0|user_file') }))
+    const result = await readCursorAuthSession(options)
+    expect(result.status === 'ok' && result.session.source).toBe('cli')
+  })
+
+  it('falls back to Cursor IDE when no CLI session exists', async () => {
+    desktopState.result = {
+      status: 'ok',
+      profile: {
+        accessToken: jwt('auth0|user_ide'),
+        email: 'ide@example.com',
+        membershipType: 'pro',
+        subscriptionStatus: 'active'
+      }
+    }
+    const result = await readCursorAuthSession(options)
+    expect(result.status === 'ok' && result.session.source).toBe('desktop')
+    expect(result.status === 'ok' && result.session.membershipType).toBe('pro')
+  })
+
+  it('does not let a locked keychain hide a readable CLI session', async () => {
+    keychainState.error = new Error('User interaction is not allowed')
+    files().set(CLI_AUTH, JSON.stringify({ accessToken: jwt('auth0|user_file') }))
+    const result = await readCursorAuthSession(options)
+    expect(result.status === 'ok' && result.session.source).toBe('cli')
+  })
+
+  it('reports the first read failure when no source yields a session', async () => {
+    keychainState.error = new Error('User interaction is not allowed')
+    const result = await readCursorAuthSession(options)
+    expect(result).toEqual({
+      status: 'error',
+      error: 'Unable to read the Cursor login from the macOS Keychain'
+    })
+  })
+
+  it('reports signed out when nothing is stored anywhere', async () => {
+    expect(await readCursorAuthSession(options)).toEqual({ status: 'missing' })
+  })
+
+  it('treats a signed-out CLI auth file as missing, not as an error', async () => {
+    files().set(CLI_AUTH, JSON.stringify({}))
+    expect(await readCursorAuthSession(options)).toEqual({ status: 'missing' })
+  })
+
+  it('keeps the local auth path out of the surfaced error', async () => {
+    files().set(
+      CLI_AUTH,
+      new Error('EACCES: permission denied, open /Users/someone/.cursor/auth.json')
+    )
+    const result = await readCursorAuthSession(options)
+    expect(result).toEqual({ status: 'error', error: 'Unable to read the Cursor CLI auth file' })
+  })
+
+  it('reports invalid JSON distinctly from an unreadable file', async () => {
+    files().set(CLI_AUTH, '{ not json')
+    const result = await readCursorAuthSession(options)
+    expect(result).toEqual({ status: 'error', error: 'Cursor CLI auth file is invalid' })
+  })
+
+  it('prefers a live desktop session over an expired keychain one', async () => {
+    // Why: a user who signed the CLI in once and now works only in the IDE would
+    // otherwise be told "sign-in expired" forever while a usable session sat below.
+    keychainState.token = expiredJwt('auth0|user_stale')
+    desktopState.result = {
+      status: 'ok',
+      profile: {
+        accessToken: jwt('auth0|user_ide'),
+        email: 'ide@example.com',
+        membershipType: 'pro',
+        subscriptionStatus: 'active'
+      }
+    }
+    const result = await readCursorAuthSession(options)
+    expect(result.status === 'ok' && result.session.source).toBe('desktop')
+    expect(result.status === 'ok' && result.session.token.subject).toBe('auth0|user_ide')
+  })
+
+  it('still returns the expired session when no live one exists anywhere', async () => {
+    // Why: the expiry message is the actionable answer in that case.
+    keychainState.token = expiredJwt('auth0|user_stale')
+    const result = await readCursorAuthSession(options)
+    expect(result.status === 'ok' && result.session.source).toBe('keychain')
+  })
+
+  it('never reads the keychain off macOS and falls through to the CLI file', async () => {
+    setPlatform('linux')
+    keychainState.token = jwt('auth0|user_keychain')
+    files().set(CLI_AUTH, JSON.stringify({ accessToken: jwt('auth0|user_file') }))
+    const result = await readCursorAuthSession(options)
+    expect(result.status === 'ok' && result.session.source).toBe('cli')
+  })
+
+  it('reports signed out off macOS when only a keychain session exists', async () => {
+    setPlatform('win32')
+    keychainState.token = jwt('auth0|user_keychain')
+    expect(await readCursorAuthSession(options)).toEqual({ status: 'missing' })
+  })
+
+  it('skips a stored token that carries no subject', async () => {
+    keychainState.token = 'not-a-jwt'
+    expect(await readCursorAuthSession(options)).toEqual({ status: 'missing' })
+  })
+})
+
+describe('readCursorCliIdentity', () => {
+  it('returns empty identity for a config with no authInfo', () => {
+    files().set(CLI_CONFIG, JSON.stringify({ version: 1 }))
+    expect(readCursorCliIdentity(CLI_CONFIG)).toEqual({
+      email: null,
+      displayName: null,
+      membershipType: null,
+      subscriptionStatus: null
+    })
+  })
+
+  it('survives a corrupt config file', () => {
+    files().set(CLI_CONFIG, '{{{')
+    expect(readCursorCliIdentity(CLI_CONFIG).email).toBeNull()
+  })
+})
diff --git a/src/main/rate-limits/cursor-auth.ts b/src/main/rate-limits/cursor-auth.ts
new file mode 100644
index 00000000000..8ef86f0ba73
--- /dev/null
+++ b/src/main/rate-limits/cursor-auth.ts
@@ -0,0 +1,211 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { z } from 'zod'
+import { readKeychainPassword } from '../macos-keychain/generic-password'
+import {
+  getCursorCliAuthPath,
+  getCursorCliConfigPath,
+  getCursorDesktopStateDbPath,
+  type CursorAuthSource
+} from './cursor-auth-paths'
+import { readCursorDesktopProfile, type CursorDesktopProfile } from './cursor-desktop-state-db'
+import {
+  isCursorSessionTokenExpired,
+  parseCursorSessionToken,
+  type CursorSessionToken
+} from './cursor-session-token'
+
+// Why: cursor-agent 2026.06+ stores the session in the login keychain, not auth.json.
+const KEYCHAIN_SERVICE = 'cursor-access-token'
+const KEYCHAIN_ACCOUNT = 'cursor-user'
+
+export type CursorIdentity = {
+  email: string | null
+  displayName: string | null
+  membershipType: string | null
+  subscriptionStatus: string | null
+}
+
+export type CursorAuthSession = CursorIdentity & {
+  token: CursorSessionToken
+  source: CursorAuthSource
+}
+
+export type CursorAuthReadResult =
+  | { status: 'missing' }
+  | { status: 'error'; error: string }
+  | { status: 'ok'; session: CursorAuthSession }
+
+function emptyIdentity(): CursorIdentity {
+  return { email: null, displayName: null, membershipType: null, subscriptionStatus: null }
+}
+
+function nonEmpty(value: unknown): string | null {
+  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null
+}
+
+const cliConfigSchema = z.object({
+  authInfo: z.object({ email: z.unknown(), displayName: z.unknown() }).partial().optional()
+})
+
+const cliAuthFileSchema = z.object({ accessToken: z.unknown() }).partial()
+
+/** `cli-config.json` carries the signed-in identity for keychain-backed CLI sessions. */
+export function readCursorCliIdentity(configPath = getCursorCliConfigPath()): CursorIdentity {
+  if (!existsSync(configPath)) {
+    return emptyIdentity()
+  }
+  try {
+    const parsed = cliConfigSchema.safeParse(JSON.parse(readFileSync(configPath, 'utf8')))
+    if (!parsed.success) {
+      return emptyIdentity()
+    }
+    return {
+      ...emptyIdentity(),
+      email: nonEmpty(parsed.data.authInfo?.email),
+      displayName: nonEmpty(parsed.data.authInfo?.displayName)
+    }
+  } catch {
+    return emptyIdentity()
+  }
+}
+
+type TokenReadResult =
+  | { status: 'missing' }
+  | { status: 'error'; error: string }
+  | { status: 'ok'; token: string }
+
+async function readKeychainToken(): Promise<TokenReadResult> {
+  if (process.platform !== 'darwin') {
+    return { status: 'missing' }
+  }
+  try {
+    const token = await readKeychainPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT)
+    return token ? { status: 'ok', token } : { status: 'missing' }
+  } catch {
+    // Why: a denied or locked keychain must not mask a readable auth.json below it.
+    return { status: 'error', error: 'Unable to read the Cursor login from the macOS Keychain' }
+  }
+}
+
+function readCliFileToken(authPath: string): TokenReadResult {
+  if (!existsSync(authPath)) {
+    return { status: 'missing' }
+  }
+  try {
+    const parsed = cliAuthFileSchema.safeParse(JSON.parse(readFileSync(authPath, 'utf8')))
+    const token = parsed.success ? parsed.data.accessToken : null
+    return typeof token === 'string' && token.length > 0
+      ? { status: 'ok', token }
+      : { status: 'missing' }
+  } catch (error) {
+    // Why: filesystem errors quote the full path; account state must not leak local usernames.
+    return {
+      status: 'error',
+      error:
+        error instanceof SyntaxError
+          ? 'Cursor CLI auth file is invalid'
+          : 'Unable to read the Cursor CLI auth file'
+    }
+  }
+}
+
+function sessionFrom(
+  raw: string,
+  source: CursorAuthSource,
+  identity: CursorIdentity
+): CursorAuthSession | null {
+  const token = parseCursorSessionToken(raw)
+  return token ? { ...identity, token, source } : null
+}
+
+function desktopIdentity(profile: CursorDesktopProfile): CursorIdentity {
+  return {
+    email: profile.email,
+    displayName: null,
+    membershipType: profile.membershipType,
+    subscriptionStatus: profile.subscriptionStatus
+  }
+}
+
+export type CursorAuthReadOptions = {
+  cliAuthPath?: string
+  cliConfigPath?: string
+  desktopStateDbPath?: string
+}
+
+/**
+ * Resolve the Cursor session Orca should poll with, preferring the CLI login
+ * (keychain, then legacy auth.json) over the Cursor IDE's own session. Read-only:
+ * Orca never writes, refreshes, or rotates the user's Cursor credentials.
+ */
+export async function readCursorAuthSession(
+  options: CursorAuthReadOptions = {}
+): Promise<CursorAuthReadResult> {
+  const cliAuthPath = options.cliAuthPath ?? getCursorCliAuthPath()
+  const cliConfigPath = options.cliConfigPath ?? getCursorCliConfigPath()
+  const desktopDbPath = options.desktopStateDbPath ?? getCursorDesktopStateDbPath()
+  const errors: string[] = []
+  // Why a live session wins over precedence: a user who signed the CLI in once and
+  // now works only in the IDE has an expired keychain token in front of a fresh
+  // desktop one. Returning the first token that parses would report "sign-in
+  // expired" forever while a usable session sat one source below.
+  let expired: CursorAuthSession | null = null
+  const takeLive = (session: CursorAuthSession | null): CursorAuthSession | null => {
+    if (!session) {
+      return null
+    }
+    if (isCursorSessionTokenExpired(session.token)) {
+      expired ??= session
+      return null
+    }
+    return session
+  }
+
+  const keychainRead = await readKeychainToken()
+  if (keychainRead.status === 'error') {
+    errors.push(keychainRead.error)
+  }
+  if (keychainRead.status === 'ok') {
+    const session = takeLive(
+      sessionFrom(keychainRead.token, 'keychain', readCursorCliIdentity(cliConfigPath))
+    )
+    if (session) {
+      return { status: 'ok', session }
+    }
+  }
+
+  const cliRead = readCliFileToken(cliAuthPath)
+  if (cliRead.status === 'error') {
+    errors.push(cliRead.error)
+  }
+  if (cliRead.status === 'ok') {
+    const session = takeLive(
+      sessionFrom(cliRead.token, 'cli', readCursorCliIdentity(cliConfigPath))
+    )
+    if (session) {
+      return { status: 'ok', session }
+    }
+  }
+
+  // Why not pushed to `errors`: the IDE holds a lock on state.vscdb while it runs,
+  // so a busy open is transient. Reporting it would pin an alert-triangle bar on
+  // every Cursor IDE user who never set Cursor up in Orca.
+  const desktopRead = readCursorDesktopProfile(desktopDbPath)
+  if (desktopRead.status === 'ok' && desktopRead.profile.accessToken) {
+    const session = takeLive(
+      sessionFrom(desktopRead.profile.accessToken, 'desktop', desktopIdentity(desktopRead.profile))
+    )
+    if (session) {
+      return { status: 'ok', session }
+    }
+  }
+
+  // Why still returned: with no live session anywhere, the expired one is what the
+  // user must act on, and the fetcher turns it into "run cursor-agent login".
+  if (expired) {
+    return { status: 'ok', session: expired }
+  }
+
+  const firstError = errors[0]
+  return firstError === undefined ? { status: 'missing' } : { status: 'error', error: firstError }
+}
diff --git a/src/main/rate-limits/cursor-desktop-state-db.ts b/src/main/rate-limits/cursor-desktop-state-db.ts
new file mode 100644
index 00000000000..bdc50c7390d
--- /dev/null
+++ b/src/main/rate-limits/cursor-desktop-state-db.ts
@@ -0,0 +1,73 @@
+import { existsSync } from 'node:fs'
+import { z } from 'zod'
+import SyncDatabase from '../sqlite/sync-database'
+
+const TOKEN_KEY = 'cursorAuth/accessToken'
+const EMAIL_KEY = 'cursorAuth/cachedEmail'
+const MEMBERSHIP_KEY = 'cursorAuth/stripeMembershipType'
+const SUBSCRIPTION_KEY = 'cursorAuth/stripeSubscriptionStatus'
+const OPEN_TIMEOUT_MS = 250
+
+export type CursorDesktopProfile = {
+  accessToken: string | null
+  email: string | null
+  membershipType: string | null
+  subscriptionStatus: string | null
+}
+
+export type CursorDesktopProfileReadResult =
+  | { status: 'missing' }
+  | { status: 'error'; error: string }
+  | { status: 'ok'; profile: CursorDesktopProfile }
+
+const rowsSchema = z.array(z.object({ key: z.unknown(), value: z.unknown() }).partial())
+
+function valueAsString(value: unknown): string | null {
+  if (typeof value === 'string' && value.length > 0) {
+    return value
+  }
+  if (value instanceof Uint8Array) {
+    return Buffer.from(value).toString('utf8').trim() || null
+  }
+  return null
+}
+
+/** Reads the Cursor IDE's stored session. Opens read-only in place; state.vscdb can be multi-GB. */
+export function readCursorDesktopProfile(dbPath: string): CursorDesktopProfileReadResult {
+  if (!existsSync(dbPath)) {
+    return { status: 'missing' }
+  }
+  let db: SyncDatabase | null = null
+  try {
+    db = new SyncDatabase(dbPath, {
+      readonly: true,
+      fileMustExist: true,
+      timeout: OPEN_TIMEOUT_MS
+    })
+    const rows = rowsSchema.parse(
+      db
+        .prepare('SELECT key, value FROM ItemTable WHERE key IN (?, ?, ?, ?)')
+        .all(TOKEN_KEY, EMAIL_KEY, MEMBERSHIP_KEY, SUBSCRIPTION_KEY)
+    )
+    const byKey = new Map<string, string>()
+    for (const row of rows) {
+      const value = valueAsString(row.value)
+      if (typeof row.key === 'string' && value) {
+        byKey.set(row.key, value)
+      }
+    }
+    return {
+      status: 'ok',
+      profile: {
+        accessToken: byKey.get(TOKEN_KEY) ?? null,
+        email: byKey.get(EMAIL_KEY) ?? null,
+        membershipType: byKey.get(MEMBERSHIP_KEY) ?? null,
+        subscriptionStatus: byKey.get(SUBSCRIPTION_KEY) ?? null
+      }
+    }
+  } catch {
+    return { status: 'error', error: 'Unable to read the Cursor desktop login' }
+  } finally {
+    db?.close()
+  }
+}
diff --git a/src/main/rate-limits/cursor-fetcher.test.ts b/src/main/rate-limits/cursor-fetcher.test.ts
new file mode 100644
index 00000000000..b334713a9af
--- /dev/null
+++ b/src/main/rate-limits/cursor-fetcher.test.ts
@@ -0,0 +1,217 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const netFetchMock = vi.hoisted(() => vi.fn())
+
+vi.mock('electron', () => ({ net: { fetch: netFetchMock } }))
+
+import { fetchCursorRateLimits } from './cursor-fetcher'
+import type { CursorAuthReadResult } from './cursor-auth'
+import { parseCursorSessionToken } from './cursor-session-token'
+
+type JwtSegment = Record<string, unknown>
+
+function jwt(exp: number): string {
+  const encode = (value: JwtSegment): string =>
+    Buffer.from(JSON.stringify(value)).toString('base64url')
+  return `${encode({ alg: 'RS256' })}.${encode({ sub: 'auth0|user_1', exp })}.signature`
+}
+
+function session(expSeconds = 4_000_000_000): CursorAuthReadResult {
+  return {
+    status: 'ok',
+    session: {
+      token: parseCursorSessionToken(jwt(expSeconds))!,
+      source: 'keychain',
+      email: 'dev@example.com',
+      displayName: 'Dev',
+      membershipType: null,
+      subscriptionStatus: null
+    }
+  }
+}
+
+type FakeResponse = Pick<Response, 'ok' | 'status'> & {
+  headers: Pick<Headers, 'get'>
+  json: () => Promise<unknown>
+}
+
+function fakeResponse(response: FakeResponse): Response {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the fetcher only reads ok/status/headers.get/json, all of which FakeResponse provides.
+  return response as unknown as Response
+}
+
+function jsonResponse(body: unknown, status = 200, headers: Record<string, string> = {}): Response {
+  return fakeResponse({
+    ok: status >= 200 && status < 300,
+    status,
+    headers: { get: (name: string) => headers[name.toLowerCase()] ?? null },
+    json: async () => body
+  })
+}
+
+const SUMMARY = {
+  billingCycleStart: '2026-09-01T00:00:00.000Z',
+  billingCycleEnd: '2026-10-01T00:00:00.000Z',
+  membershipType: 'pro',
+  individualUsage: {
+    plan: { enabled: true, used: 2_500, limit: 5_000, autoPercentUsed: 40, apiPercentUsed: 12 }
+  }
+}
+
+beforeEach(() => {
+  netFetchMock.mockReset()
+})
+
+describe('fetchCursorRateLimits', () => {
+  it('publishes both plan pools and the cycle reset', async () => {
+    netFetchMock.mockResolvedValueOnce(jsonResponse(SUMMARY))
+    const limits = await fetchCursorRateLimits({ authReadResult: session() })
+    expect(limits.status).toBe('ok')
+    expect(limits.monthly?.usedPercent).toBe(50)
+    expect(limits.buckets?.map((bucket) => bucket.name)).toEqual(['Cursor Models', 'Other Models'])
+    expect(limits.planType).toBe('pro')
+    expect(limits.usageMetadata).toMatchObject({ source: 'cli', credentialSource: 'keychain' })
+  })
+
+  it('sends the origin headers the dashboard checks as CSRF defence', async () => {
+    netFetchMock.mockResolvedValueOnce(jsonResponse(SUMMARY))
+    await fetchCursorRateLimits({ authReadResult: session() })
+    const [url, init] = netFetchMock.mock.calls[0] ?? []
+    expect(url).toBe('https://cursor.com/api/usage-summary')
+    expect(init?.headers).toMatchObject({
+      Origin: 'https://cursor.com',
+      Referer: 'https://cursor.com/dashboard',
+      Cookie: expect.stringContaining('WorkosCursorSessionToken=auth0%7Cuser_1%3A%3A')
+    })
+  })
+
+  it('reports an expired session without spending a request that must 401', async () => {
+    const limits = await fetchCursorRateLimits({ authReadResult: session(1_000) })
+    expect(netFetchMock).not.toHaveBeenCalled()
+    expect(limits.status).toBe('error')
+    expect(limits.usageMetadata?.failureKind).toBe('stale-token')
+    expect(limits.error).toContain('cursor-agent login')
+  })
+
+  it('tells a signed-out user how to sign in, without painting an error bar', async () => {
+    const limits = await fetchCursorRateLimits({ authReadResult: { status: 'missing' } })
+    expect(limits.status).toBe('unavailable')
+    expect(limits.usageMetadata?.failureKind).toBe('missing-credentials')
+  })
+
+  it('surfaces a credential read failure', async () => {
+    const limits = await fetchCursorRateLimits({
+      authReadResult: { status: 'error', error: 'Unable to read the Cursor CLI auth file' }
+    })
+    expect(limits.status).toBe('error')
+    expect(limits.error).toBe('Unable to read the Cursor CLI auth file')
+  })
+
+  it('treats a rejected session as expired sign-in and records Retry-After on 429', async () => {
+    netFetchMock.mockResolvedValueOnce(jsonResponse({}, 401))
+    expect(
+      (await fetchCursorRateLimits({ authReadResult: session() })).usageMetadata?.failureKind
+    ).toBe('stale-token')
+
+    netFetchMock.mockResolvedValueOnce(jsonResponse({}, 429, { 'retry-after': '60' }))
+    const limited = await fetchCursorRateLimits({ authReadResult: session() })
+    expect(limited.usageMetadata?.failureKind).toBe('rate-limited')
+    expect(limited.usageMetadata?.retryAtMs).toBeGreaterThan(Date.now())
+  })
+
+  it('treats a redirect to the login page as an expired sign-in', async () => {
+    // Why: the dashboard bounces an unusable session to /login. With
+    // redirect:'error' that surfaced as a generic network failure, hiding the
+    // one message that tells the user what to do.
+    netFetchMock.mockResolvedValueOnce(jsonResponse({}, 302, { location: '/login' }))
+    const limits = await fetchCursorRateLimits({ authReadResult: session() })
+    expect(limits.usageMetadata?.failureKind).toBe('stale-token')
+    expect(limits.error).toContain('cursor-agent login')
+  })
+
+  it('names the account on failures too, so an account switch can clear stale figures', async () => {
+    // Why: the service drops a previous account's numbers only when the fresh
+    // result names an account. A switch whose first refresh fails is exactly when
+    // that matters, so every failure holding a readable session carries it.
+    const ok = jsonResponse(SUMMARY)
+    netFetchMock.mockResolvedValueOnce(ok)
+    const success = await fetchCursorRateLimits({ authReadResult: session() })
+    const fingerprint = success.usageMetadata?.authProvenance
+    expect(fingerprint).toBeTruthy()
+
+    for (const [status, headers] of [
+      [401, {}],
+      [429, { 'retry-after': '60' }],
+      [503, {}]
+    ] as const) {
+      netFetchMock.mockResolvedValueOnce(jsonResponse({}, status, headers))
+      const failure = await fetchCursorRateLimits({ authReadResult: session() })
+      expect(failure.status).toBe('error')
+      expect(failure.usageMetadata?.authProvenance).toBe(fingerprint)
+    }
+
+    const expired = await fetchCursorRateLimits({ authReadResult: session(1_000) })
+    expect(expired.usageMetadata?.authProvenance).toBe(fingerprint)
+  })
+
+  it('leaves the account unnamed when no session could be read', async () => {
+    const missing = await fetchCursorRateLimits({ authReadResult: { status: 'missing' } })
+    expect(missing.usageMetadata?.authProvenance).toBeUndefined()
+  })
+
+  it('reports a server failure with its status code', async () => {
+    netFetchMock.mockResolvedValueOnce(jsonResponse({}, 503))
+    const limits = await fetchCursorRateLimits({ authReadResult: session() })
+    expect(limits.error).toBe('Cursor usage request failed (HTTP 503)')
+    expect(limits.usageMetadata?.failureKind).toBe('server')
+  })
+
+  it('classifies an unparseable body as a parse failure, not as usage', async () => {
+    netFetchMock.mockResolvedValueOnce(
+      fakeResponse({
+        ok: true,
+        status: 200,
+        headers: { get: () => null },
+        json: async () => {
+          throw new Error('invalid json')
+        }
+      })
+    )
+    const limits = await fetchCursorRateLimits({ authReadResult: session() })
+    expect(limits.usageMetadata?.failureKind).toBe('parse')
+  })
+
+  it('publishes an unlimited plan with no misleading bar', async () => {
+    netFetchMock.mockResolvedValueOnce(jsonResponse({ isUnlimited: true, membershipType: 'ultra' }))
+    const limits = await fetchCursorRateLimits({ authReadResult: session() })
+    expect(limits.status).toBe('ok')
+    expect(limits.monthly).toBeUndefined()
+    expect(limits.planType).toBe('ultra')
+  })
+
+  it('falls back to the request-quota endpoint before declaring no allowance', async () => {
+    netFetchMock
+      .mockResolvedValueOnce(jsonResponse({ membershipType: 'free' }))
+      .mockResolvedValueOnce(jsonResponse({ 'gpt-4': { numRequests: 25, maxRequestUsage: 50 } }))
+    const limits = await fetchCursorRateLimits({ authReadResult: session() })
+    expect(limits.status).toBe('ok')
+    expect(limits.monthly?.usedPercent).toBe(50)
+    expect(netFetchMock.mock.calls[1]?.[0]).toBe('https://cursor.com/api/usage?user=auth0%7Cuser_1')
+  })
+
+  it('hides the bar for an account with no quota rather than alerting forever', async () => {
+    netFetchMock
+      .mockResolvedValueOnce(jsonResponse({ membershipType: 'free' }))
+      .mockResolvedValueOnce(jsonResponse({}))
+    const limits = await fetchCursorRateLimits({ authReadResult: session() })
+    expect(limits.status).toBe('unavailable')
+    expect(limits.usageMetadata?.failureKind).toBe('usage-unavailable')
+  })
+
+  it('reports a network failure without leaking the request internals', async () => {
+    netFetchMock.mockRejectedValueOnce(new Error('getaddrinfo ENOTFOUND cursor.com'))
+    const limits = await fetchCursorRateLimits({ authReadResult: session() })
+    expect(limits.error).toBe('Cursor usage request failed')
+    expect(limits.usageMetadata?.failureKind).toBe('network')
+  })
+})
diff --git a/src/main/rate-limits/cursor-fetcher.ts b/src/main/rate-limits/cursor-fetcher.ts
new file mode 100644
index 00000000000..d188127a19a
--- /dev/null
+++ b/src/main/rate-limits/cursor-fetcher.ts
@@ -0,0 +1,251 @@
+import { createHash } from 'node:crypto'
+import { net } from 'electron'
+import type { ProviderRateLimits, UsageRateLimitSource } from '../../shared/rate-limit-types'
+import {
+  readCursorAuthSession,
+  type CursorAuthReadResult,
+  type CursorAuthSession
+} from './cursor-auth'
+import { cursorSessionCookie, isCursorSessionTokenExpired } from './cursor-session-token'
+import {
+  mapCursorLegacyRequestQuota,
+  mapCursorUsageSummary,
+  parseCursorUsageSummary
+} from './cursor-usage-mapping'
+
+const DASHBOARD_ORIGIN = 'https://cursor.com'
+const USAGE_SUMMARY_URL = `${DASHBOARD_ORIGIN}/api/usage-summary`
+const LEGACY_USAGE_URL = `${DASHBOARD_ORIGIN}/api/usage`
+const API_TIMEOUT_MS = 10_000
+
+const SIGNED_OUT_MESSAGE =
+  'No Cursor sign-in on this computer — sign in with Cursor IDE or `cursor-agent login`'
+const EXPIRED_MESSAGE = 'Cursor sign-in expired — run `cursor-agent login` again'
+
+function usageSource(session: CursorAuthSession): UsageRateLimitSource {
+  return session.source === 'desktop' ? 'web' : 'cli'
+}
+
+/**
+ * Stable, non-secret fingerprint of the signed-in account. Hashed because this
+ * rides `usageMetadata` into the renderer and mobile snapshots, where the raw
+ * WorkOS subject would be an account identifier nobody needs to see. Readers
+ * only compare it, so a digest is enough.
+ */
+function accountFingerprint(session: CursorAuthSession): string {
+  return createHash('sha256').update(session.token.subject).digest('hex').slice(0, 12)
+}
+
+function result(
+  status: ProviderRateLimits['status'],
+  error: string | null,
+  extra: Partial<ProviderRateLimits> = {}
+): ProviderRateLimits {
+  return {
+    provider: 'cursor',
+    session: null,
+    weekly: null,
+    updatedAt: Date.now(),
+    error,
+    status,
+    ...extra
+  }
+}
+
+/**
+ * Dashboard routes answer 403 to a bare session cookie — they check the request
+ * origin as CSRF defence. Sending what the dashboard itself sends is what they
+ * expect; without these headers every /api route fails on a valid session.
+ */
+function requestHeaders(session: CursorAuthSession): Record<string, string> {
+  return {
+    Cookie: cursorSessionCookie(session.token),
+    Accept: 'application/json',
+    Origin: DASHBOARD_ORIGIN,
+    Referer: `${DASHBOARD_ORIGIN}/dashboard`
+  }
+}
+
+type FetchOutcome = { kind: 'data'; data: unknown } | { kind: 'result'; result: ProviderRateLimits }
+
+async function fetchDashboardJson(
+  url: string,
+  session: CursorAuthSession,
+  signal?: AbortSignal
+): Promise<FetchOutcome> {
+  const source = usageSource(session)
+  // Why on failures too: the account-switch guard downstream can only drop a
+  // previous account's figures when the fresh result names an account, and a
+  // switch whose first refresh 401s or 5xxs is exactly when it must.
+  const provenance = accountFingerprint(session)
+  const requestSignal = signal
+    ? AbortSignal.any([signal, AbortSignal.timeout(API_TIMEOUT_MS)])
+    : AbortSignal.timeout(API_TIMEOUT_MS)
+  const res = await net.fetch(url, {
+    // Why manual: the dashboard bounces an unusable session to /login, and
+    // 'error' would surface that as a generic network failure instead of the
+    // actionable sign-in message below.
+    redirect: 'manual',
+    headers: requestHeaders(session),
+    signal: requestSignal
+  })
+  if (res.status === 401 || res.status === 403 || (res.status >= 300 && res.status < 400)) {
+    return {
+      kind: 'result',
+      result: result('error', EXPIRED_MESSAGE, {
+        usageMetadata: {
+          source,
+          credentialSource: session.source,
+          authProvenance: provenance,
+          failureKind: 'stale-token'
+        }
+      })
+    }
+  }
+  if (res.status === 429) {
+    const retryAfterSeconds = Number(res.headers.get('retry-after'))
+    return {
+      kind: 'result',
+      result: result('error', 'Cursor usage is rate limited right now', {
+        usageMetadata: {
+          source,
+          credentialSource: session.source,
+          authProvenance: provenance,
+          failureKind: 'rate-limited',
+          ...(Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0
+            ? { retryAtMs: Date.now() + retryAfterSeconds * 1000 }
+            : {})
+        }
+      })
+    }
+  }
+  if (!res.ok) {
+    return {
+      kind: 'result',
+      result: result('error', `Cursor usage request failed (HTTP ${res.status})`, {
+        usageMetadata: {
+          source,
+          credentialSource: session.source,
+          authProvenance: provenance,
+          failureKind: 'server'
+        }
+      })
+    }
+  }
+  try {
+    return { kind: 'data', data: await res.json() }
+  } catch {
+    return {
+      kind: 'result',
+      result: result('error', 'Cursor usage response could not be parsed', {
+        usageMetadata: {
+          source,
+          credentialSource: session.source,
+          authProvenance: provenance,
+          failureKind: 'parse'
+        }
+      })
+    }
+  }
+}
+
+function credentialFailure(readResult: CursorAuthReadResult): ProviderRateLimits | null {
+  if (readResult.status === 'missing') {
+    return result('unavailable', SIGNED_OUT_MESSAGE, {
+      usageMetadata: { failureKind: 'missing-credentials' }
+    })
+  }
+  if (readResult.status === 'error') {
+    return result('error', readResult.error, {
+      usageMetadata: { failureKind: 'missing-credentials' }
+    })
+  }
+  // Why: cursor-agent refreshes its own token on use; Orca only reads, so a
+  // lapsed session is reported instead of spending a request that must 401.
+  if (isCursorSessionTokenExpired(readResult.session.token)) {
+    return result('error', EXPIRED_MESSAGE, {
+      usageMetadata: {
+        source: usageSource(readResult.session),
+        credentialSource: readResult.session.source,
+        authProvenance: accountFingerprint(readResult.session),
+        failureKind: 'stale-token'
+      }
+    })
+  }
+  return null
+}
+
+/**
+ * Reads the Cursor plan allowance for the account this machine is signed into.
+ * Orca never runs `cursor-agent login` and never writes Cursor's credentials.
+ */
+export async function fetchCursorRateLimits(
+  options: { signal?: AbortSignal; authReadResult?: CursorAuthReadResult } = {}
+): Promise<ProviderRateLimits> {
+  const readResult = options.authReadResult ?? (await readCursorAuthSession())
+  const failure = credentialFailure(readResult)
+  if (failure || readResult.status !== 'ok') {
+    return failure ?? result('unavailable', SIGNED_OUT_MESSAGE)
+  }
+  const session = readResult.session
+  const source = usageSource(session)
+  const metadata = {
+    source,
+    credentialSource: session.source,
+    authProvenance: accountFingerprint(session)
+  }
+
+  try {
+    const outcome = await fetchDashboardJson(USAGE_SUMMARY_URL, session, options.signal)
+    if (outcome.kind === 'result') {
+      return outcome.result
+    }
+    const mapped = mapCursorUsageSummary(parseCursorUsageSummary(outcome.data))
+
+    // Why: an unlimited plan has no ceiling to divide by. Publish the plan so the
+    // roster still lists the account, with no misleading bar.
+    if (mapped.isUnlimited) {
+      return result('ok', null, { planType: mapped.planType, usageMetadata: metadata })
+    }
+    if (mapped.monthly || mapped.buckets.length > 0) {
+      return result('ok', null, {
+        ...(mapped.monthly ? { monthly: mapped.monthly } : {}),
+        ...(mapped.buckets.length > 0 ? { buckets: mapped.buckets } : {}),
+        planType: mapped.planType,
+        usageMetadata: metadata
+      })
+    }
+
+    // Why: accounts still on request-quota billing report nothing under
+    // individualUsage, so try the older per-model endpoint before concluding
+    // the account has no visible quota.
+    const legacy = await fetchDashboardJson(
+      `${LEGACY_USAGE_URL}?user=${encodeURIComponent(session.token.subject)}`,
+      session,
+      options.signal
+    )
+    if (legacy.kind === 'result') {
+      return legacy.result
+    }
+    const legacyWindow = mapCursorLegacyRequestQuota(legacy.data)
+    if (legacyWindow) {
+      return result('ok', null, {
+        monthly: legacyWindow,
+        planType: mapped.planType,
+        usageMetadata: metadata
+      })
+    }
+
+    // Why: a 200 with no allowance means the plan exposes no quota (API-key or
+    // team-billed accounts). 'unavailable' hides the bar the way Claude does on
+    // API-key billing; 'error' would paint a permanent alert for a healthy account.
+    return result('unavailable', 'Cursor reported no usage allowance for this account', {
+      planType: mapped.planType,
+      usageMetadata: { ...metadata, failureKind: 'usage-unavailable' }
+    })
+  } catch {
+    return result('error', 'Cursor usage request failed', {
+      usageMetadata: { ...metadata, failureKind: 'network' }
+    })
+  }
+}
diff --git a/src/main/rate-limits/cursor-session-token.test.ts b/src/main/rate-limits/cursor-session-token.test.ts
new file mode 100644
index 00000000000..61bb7d8221a
--- /dev/null
+++ b/src/main/rate-limits/cursor-session-token.test.ts
@@ -0,0 +1,64 @@
+import { describe, expect, it } from 'vitest'
+import {
+  cursorSessionCookie,
+  isCursorSessionTokenExpired,
+  parseCursorSessionToken
+} from './cursor-session-token'
+
+type JwtSegment = Record<string, unknown>
+
+function jwt(payload: Record<string, unknown>): string {
+  const encode = (value: JwtSegment): string =>
+    Buffer.from(JSON.stringify(value)).toString('base64url')
+  return `${encode({ alg: 'RS256' })}.${encode(payload)}.signature`
+}
+
+describe('parseCursorSessionToken', () => {
+  it('reads the WorkOS subject and expiry from a cursor-agent session token', () => {
+    const token = parseCursorSessionToken(
+      jwt({ sub: 'auth0|user_01ABC', exp: 1_800_000_000, aud: 'https://cursor.com' })
+    )
+    expect(token?.subject).toBe('auth0|user_01ABC')
+    expect(token?.expiresAtMs).toBe(1_800_000_000_000)
+  })
+
+  it('rejects a token without a subject, which cannot address the dashboard', () => {
+    expect(parseCursorSessionToken(jwt({ exp: 1_800_000_000 }))).toBeNull()
+  })
+
+  it('rejects blank and malformed tokens instead of throwing', () => {
+    expect(parseCursorSessionToken('   ')).toBeNull()
+    expect(parseCursorSessionToken('not-a-jwt')).toBeNull()
+    expect(parseCursorSessionToken('a.!!!.c')).toBeNull()
+  })
+
+  it('leaves expiry null when the token omits exp', () => {
+    expect(parseCursorSessionToken(jwt({ sub: 'auth0|user_1' }))?.expiresAtMs).toBeNull()
+  })
+})
+
+describe('isCursorSessionTokenExpired', () => {
+  const token = parseCursorSessionToken(jwt({ sub: 'auth0|user_1', exp: 2_000 }))
+
+  it('reports a lapsed session', () => {
+    expect(isCursorSessionTokenExpired(token!, 2_000_001)).toBe(true)
+  })
+
+  it('reports a live session', () => {
+    expect(isCursorSessionTokenExpired(token!, 1_999_999)).toBe(false)
+  })
+
+  it('never expires a token with no exp claim', () => {
+    const noExpiry = parseCursorSessionToken(jwt({ sub: 'auth0|user_1' }))
+    expect(isCursorSessionTokenExpired(noExpiry!, Number.MAX_SAFE_INTEGER)).toBe(false)
+  })
+})
+
+describe('cursorSessionCookie', () => {
+  it('escapes the subject and joins it to the token the way the dashboard does', () => {
+    const token = parseCursorSessionToken(jwt({ sub: 'auth0|user_01ABC' }))
+    expect(cursorSessionCookie(token!)).toBe(
+      `WorkosCursorSessionToken=auth0%7Cuser_01ABC%3A%3A${token!.raw}`
+    )
+  })
+})
diff --git a/src/main/rate-limits/cursor-session-token.ts b/src/main/rate-limits/cursor-session-token.ts
new file mode 100644
index 00000000000..8db148c61ff
--- /dev/null
+++ b/src/main/rate-limits/cursor-session-token.ts
@@ -0,0 +1,57 @@
+import { z } from 'zod'
+
+const jwtPayloadSchema = z.object({ sub: z.unknown(), exp: z.unknown() }).partial()
+
+export type CursorSessionToken = {
+  raw: string
+  /** WorkOS subject (`auth0|user_…`), the first half of the dashboard session cookie. */
+  subject: string
+  expiresAtMs: number | null
+}
+
+function decodeJwtPayload(token: string): z.infer<typeof jwtPayloadSchema> | null {
+  const parts = token.split('.')
+  if (parts.length < 2 || !parts[1]) {
+    return null
+  }
+  try {
+    const base64 = parts[1].replace(/-/g, '+').replace(/_/g, '/')
+    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4)
+    const parsed = jwtPayloadSchema.safeParse(
+      JSON.parse(Buffer.from(padded, 'base64').toString('utf8'))
+    )
+    return parsed.success ? parsed.data : null
+  } catch {
+    return null
+  }
+}
+
+export function parseCursorSessionToken(raw: string): CursorSessionToken | null {
+  const trimmed = raw.trim()
+  if (!trimmed) {
+    return null
+  }
+  const payload = decodeJwtPayload(trimmed)
+  const subject = payload?.sub
+  if (typeof subject !== 'string' || subject.trim().length === 0) {
+    return null
+  }
+  const exp = payload?.exp
+  return {
+    raw: trimmed,
+    subject: subject.trim(),
+    expiresAtMs: typeof exp === 'number' && Number.isFinite(exp) ? exp * 1000 : null
+  }
+}
+
+export function isCursorSessionTokenExpired(
+  token: CursorSessionToken,
+  nowMs: number = Date.now()
+): boolean {
+  return token.expiresAtMs !== null && token.expiresAtMs <= nowMs
+}
+
+/** Cookie the cursor.com dashboard sends: `<subject>::<jwt>`, URL-escaped. */
+export function cursorSessionCookie(token: CursorSessionToken): string {
+  return `WorkosCursorSessionToken=${encodeURIComponent(token.subject)}%3A%3A${token.raw}`
+}
diff --git a/src/main/rate-limits/cursor-usage-mapping.test.ts b/src/main/rate-limits/cursor-usage-mapping.test.ts
new file mode 100644
index 00000000000..8e1b5192fde
--- /dev/null
+++ b/src/main/rate-limits/cursor-usage-mapping.test.ts
@@ -0,0 +1,182 @@
+import { describe, expect, it } from 'vitest'
+import {
+  mapCursorLegacyRequestQuota,
+  mapCursorUsageSummary,
+  parseCursorUsageSummary
+} from './cursor-usage-mapping'
+
+const CYCLE = {
+  billingCycleStart: '2026-09-01T00:00:00.000Z',
+  billingCycleEnd: '2026-10-01T00:00:00.000Z'
+}
+
+describe('mapCursorUsageSummary', () => {
+  it('maps both plan pools Cursor bills individual accounts from', () => {
+    const mapped = mapCursorUsageSummary({
+      ...CYCLE,
+      membershipType: 'pro',
+      individualUsage: {
+        plan: { enabled: true, used: 1_250, limit: 5_000, autoPercentUsed: 40, apiPercentUsed: 10 }
+      }
+    })
+    expect(mapped.planType).toBe('pro')
+    expect(mapped.buckets.map((bucket) => [bucket.name, bucket.usedPercent])).toEqual([
+      ['Cursor Models', 40],
+      ['Other Models', 10]
+    ])
+    expect(mapped.monthly?.usedPercent).toBe(25)
+    expect(mapped.monthly?.resetsAt).toBe(Date.parse(CYCLE.billingCycleEnd))
+  })
+
+  it('prefers the used/limit pair over the rounded percentage Cursor renders', () => {
+    const mapped = mapCursorUsageSummary({
+      ...CYCLE,
+      individualUsage: { plan: { enabled: true, used: 1_000, limit: 3_000, totalPercentUsed: 33 } }
+    })
+    expect(mapped.monthly?.usedPercent).toBeCloseTo(33.333, 3)
+  })
+
+  it('falls back to the percentage when no cents allowance is reported', () => {
+    const mapped = mapCursorUsageSummary({
+      ...CYCLE,
+      individualUsage: { plan: { enabled: true, totalPercentUsed: 62 } }
+    })
+    expect(mapped.monthly?.usedPercent).toBe(62)
+  })
+
+  it('adds an on-demand bucket only once the user has enabled on-demand spend', () => {
+    const disabled = mapCursorUsageSummary({
+      ...CYCLE,
+      individualUsage: {
+        plan: { enabled: true, totalPercentUsed: 5 },
+        onDemand: { used: 900, limit: 1_000 }
+      }
+    })
+    expect(disabled.buckets).toHaveLength(0)
+
+    const enabled = mapCursorUsageSummary({
+      ...CYCLE,
+      individualUsage: {
+        plan: { enabled: true, totalPercentUsed: 5 },
+        onDemand: { enabled: true, used: 900, limit: 1_000 }
+      }
+    })
+    expect(enabled.buckets).toEqual([
+      expect.objectContaining({ name: 'On-demand', usedPercent: 90 })
+    ])
+  })
+
+  it('clamps an over-consumed pool to 100% instead of overflowing the bar', () => {
+    const mapped = mapCursorUsageSummary({
+      ...CYCLE,
+      individualUsage: { plan: { enabled: true, used: 7_000, limit: 5_000 } }
+    })
+    expect(mapped.monthly?.usedPercent).toBe(100)
+  })
+
+  it('publishes no pools for a plan the account does not own', () => {
+    // Why: a team-billed account still reports 0% pools. Publishing them would
+    // paint a healthy 0% meter and skip the request-quota fallback.
+    const mapped = mapCursorUsageSummary({
+      ...CYCLE,
+      individualUsage: {
+        plan: { enabled: false, autoPercentUsed: 0, apiPercentUsed: 0, totalPercentUsed: 0 }
+      }
+    })
+    expect(mapped.buckets).toHaveLength(0)
+    expect(mapped.monthly).toBeNull()
+  })
+
+  it('reports an unlimited plan without inventing a percentage', () => {
+    const mapped = mapCursorUsageSummary({ ...CYCLE, isUnlimited: true, membershipType: 'ultra' })
+    expect(mapped.isUnlimited).toBe(true)
+    expect(mapped.monthly).toBeNull()
+    expect(mapped.buckets).toHaveLength(0)
+  })
+
+  it('accepts epoch seconds and milliseconds for the billing cycle', () => {
+    const seconds = mapCursorUsageSummary({
+      billingCycleEnd: 1_790_000_000,
+      individualUsage: { plan: { enabled: true, totalPercentUsed: 1 } }
+    })
+    const millis = mapCursorUsageSummary({
+      billingCycleEnd: 1_790_000_000_000,
+      individualUsage: { plan: { enabled: true, totalPercentUsed: 1 } }
+    })
+    expect(seconds.monthly?.resetsAt).toBe(1_790_000_000_000)
+    expect(millis.monthly?.resetsAt).toBe(1_790_000_000_000)
+  })
+
+  it('keeps the plan when a sibling pool arrives as null', () => {
+    // Why: the route sends `null` for an absent sub-object, and a stricter schema
+    // would drop the whole body — plan pools and billing cycle included.
+    const mapped = mapCursorUsageSummary(
+      parseCursorUsageSummary({
+        ...CYCLE,
+        membershipType: 'pro',
+        individualUsage: { plan: { enabled: true, totalPercentUsed: 40 }, onDemand: null }
+      })
+    )
+    expect(mapped.monthly?.usedPercent).toBe(40)
+    expect(mapped.planType).toBe('pro')
+  })
+
+  it('survives a null individualUsage block', () => {
+    const mapped = mapCursorUsageSummary(
+      parseCursorUsageSummary({ ...CYCLE, membershipType: 'free', individualUsage: null })
+    )
+    expect(mapped.planType).toBe('free')
+    expect(mapped.monthly).toBeNull()
+  })
+
+  it('returns nothing to publish for an empty payload', () => {
+    const mapped = mapCursorUsageSummary({})
+    expect(mapped.monthly).toBeNull()
+    expect(mapped.buckets).toHaveLength(0)
+    expect(mapped.planType).toBeNull()
+  })
+
+  it('derives the window from the reported cycle rather than assuming 30 days', () => {
+    const mapped = mapCursorUsageSummary({
+      billingCycleStart: '2026-09-01T00:00:00.000Z',
+      billingCycleEnd: '2026-09-08T00:00:00.000Z',
+      individualUsage: { plan: { enabled: true, totalPercentUsed: 10 } }
+    })
+    expect(mapped.monthly?.windowMinutes).toBe(7 * 24 * 60)
+  })
+})
+
+describe('mapCursorLegacyRequestQuota', () => {
+  it('uses the premium gpt-4 bucket on request-quota plans', () => {
+    const window = mapCursorLegacyRequestQuota({
+      'gpt-4': { numRequests: 250, maxRequestUsage: 500 },
+      'gpt-3.5-turbo': { numRequests: 10, maxRequestUsage: 9_999 },
+      startOfMonth: '2026-09-01T00:00:00.000Z'
+    })
+    expect(window?.usedPercent).toBe(50)
+    expect(window?.resetsAt).toBe(new Date('2026-10-01T00:00:00.000Z').getTime())
+  })
+
+  it('falls back to the largest ceiling when no gpt-4 bucket is present', () => {
+    const window = mapCursorLegacyRequestQuota({
+      small: { numRequests: 1, maxRequestUsage: 10 },
+      large: { numRequests: 20, maxRequestUsage: 100 }
+    })
+    expect(window?.usedPercent).toBe(20)
+  })
+
+  it('clamps a month-end cycle start instead of overflowing into the next month', () => {
+    const window = mapCursorLegacyRequestQuota({
+      'gpt-4': { numRequests: 1, maxRequestUsage: 10 },
+      startOfMonth: '2026-01-31T00:00:00.000Z'
+    })
+    expect(window?.resetsAt).toBe(Date.parse('2026-02-28T00:00:00.000Z'))
+  })
+
+  it('ignores unmetered buckets and returns null when nothing is metered', () => {
+    expect(
+      mapCursorLegacyRequestQuota({ free: { numRequests: 3, maxRequestUsage: null } })
+    ).toBeNull()
+    expect(mapCursorLegacyRequestQuota(null)).toBeNull()
+  })
+})
diff --git a/src/main/rate-limits/cursor-usage-mapping.ts b/src/main/rate-limits/cursor-usage-mapping.ts
new file mode 100644
index 00000000000..66a29d46469
--- /dev/null
+++ b/src/main/rate-limits/cursor-usage-mapping.ts
@@ -0,0 +1,234 @@
+import { z } from 'zod'
+import {
+  CURSOR_MODELS_BUCKET_NAME,
+  CURSOR_ON_DEMAND_BUCKET_NAME,
+  CURSOR_OTHER_MODELS_BUCKET_NAME
+} from '../../shared/cursor-usage-buckets'
+import type { RateLimitBucket, RateLimitWindow } from '../../shared/rate-limit-types'
+
+const MONTHLY_WINDOW_MINUTES = 43_200
+
+const cursorPoolSchema = z
+  .object({
+    enabled: z.unknown(),
+    used: z.unknown(),
+    limit: z.unknown(),
+    totalPercentUsed: z.unknown(),
+    autoPercentUsed: z.unknown(),
+    apiPercentUsed: z.unknown()
+  })
+  .partial()
+
+const cursorUsageSummarySchema = z
+  .object({
+    billingCycleStart: z.unknown(),
+    billingCycleEnd: z.unknown(),
+    membershipType: z.unknown(),
+    isUnlimited: z.unknown(),
+    // Why nullish and not optional: this route is undocumented and sends `null`
+    // for an absent sub-object. With `.optional()` one null pool fails the parse
+    // for the whole body, discarding valid pools and the billing cycle with it.
+    individualUsage: z
+      .object({ plan: cursorPoolSchema.nullish(), onDemand: cursorPoolSchema.nullish() })
+      .partial()
+      .nullish()
+  })
+  .partial()
+
+type CursorPool = z.infer<typeof cursorPoolSchema>
+export type CursorUsageSummary = z.infer<typeof cursorUsageSummarySchema>
+
+/** Accepts the raw dashboard body; an unrecognised shape maps to "nothing reported". */
+export function parseCursorUsageSummary(data: unknown): CursorUsageSummary {
+  const parsed = cursorUsageSummarySchema.safeParse(data)
+  return parsed.success ? parsed.data : {}
+}
+
+export type CursorUsageMapping = {
+  monthly: RateLimitWindow | null
+  buckets: RateLimitBucket[]
+  planType: string | null
+  isUnlimited: boolean
+}
+
+function finiteNumber(value: unknown): number | null {
+  if (typeof value === 'number' && Number.isFinite(value)) {
+    return value
+  }
+  if (typeof value !== 'string' || !value.trim()) {
+    return null
+  }
+  const parsed = Number(value)
+  return Number.isFinite(parsed) ? parsed : null
+}
+
+export function parseCursorTimestampMs(value: unknown): number | null {
+  if (typeof value === 'number' && Number.isFinite(value)) {
+    // Why: Cursor mixes epoch seconds and milliseconds across billing fields.
+    return value > 1e12 ? value : value * 1000
+  }
+  if (typeof value !== 'string' || !value.trim()) {
+    return null
+  }
+  const trimmed = value.trim()
+  if (/^\d+$/.test(trimmed)) {
+    return parseCursorTimestampMs(Number(trimmed))
+  }
+  const parsed = Date.parse(trimmed)
+  return Number.isFinite(parsed) ? parsed : null
+}
+
+function clampPercent(value: number): number {
+  return Math.min(100, Math.max(0, value))
+}
+
+function resetDescription(resetsAtMs: number | null): string | null {
+  if (resetsAtMs === null) {
+    return null
+  }
+  const date = new Date(resetsAtMs)
+  if (Number.isNaN(date.getTime())) {
+    return null
+  }
+  return date.toLocaleDateString(undefined, { month: 'short', day: 'numeric' })
+}
+
+function windowMinutesFor(startMs: number | null, endMs: number | null): number {
+  if (startMs === null || endMs === null || endMs <= startMs) {
+    return MONTHLY_WINDOW_MINUTES
+  }
+  return Math.max(1, Math.round((endMs - startMs) / 60_000))
+}
+
+/**
+ * Percent consumed for one pool. `used / limit` wins over the sibling percentage
+ * fields: the raw pair is internally consistent, while the percentages are
+ * pre-rounded for the dashboard's own copy and disagree with it on real accounts.
+ */
+function poolPercent(
+  pool: CursorPool | null | undefined,
+  percentField: keyof CursorPool
+): number | null {
+  if (!pool) {
+    return null
+  }
+  const used = finiteNumber(pool.used)
+  const limit = finiteNumber(pool.limit)
+  if (used !== null && limit !== null && limit > 0) {
+    return (used / limit) * 100
+  }
+  return finiteNumber(pool[percentField])
+}
+
+export function mapCursorUsageSummary(summary: CursorUsageSummary): CursorUsageMapping {
+  const startMs = parseCursorTimestampMs(summary.billingCycleStart)
+  const endMs = parseCursorTimestampMs(summary.billingCycleEnd)
+  const windowMinutes = windowMinutesFor(startMs, endMs)
+  const description = resetDescription(endMs)
+  const toWindow = (percent: number): RateLimitWindow => ({
+    usedPercent: clampPercent(percent),
+    windowMinutes,
+    resetsAt: endMs,
+    resetDescription: description
+  })
+
+  const plan = summary.individualUsage?.plan
+  // Why: a team-billed account still reports 0% pools it does not own. Publishing
+  // them as buckets would paint a healthy 0% meter and skip the legacy fallback.
+  const planEnabled = plan?.enabled !== false
+  const buckets: RateLimitBucket[] = []
+  const cursorModels = planEnabled ? finiteNumber(plan?.autoPercentUsed) : null
+  if (cursorModels !== null) {
+    buckets.push({ name: CURSOR_MODELS_BUCKET_NAME, ...toWindow(cursorModels) })
+  }
+  const otherModels = planEnabled ? finiteNumber(plan?.apiPercentUsed) : null
+  if (otherModels !== null) {
+    buckets.push({ name: CURSOR_OTHER_MODELS_BUCKET_NAME, ...toWindow(otherModels) })
+  }
+
+  const onDemand = summary.individualUsage?.onDemand
+  const onDemandPercent =
+    onDemand?.enabled === true ? poolPercent(onDemand, 'totalPercentUsed') : null
+  if (onDemandPercent !== null) {
+    buckets.push({ name: CURSOR_ON_DEMAND_BUCKET_NAME, ...toWindow(onDemandPercent) })
+  }
+
+  const planPercent = planEnabled ? poolPercent(plan, 'totalPercentUsed') : null
+  const membership = summary.membershipType
+  return {
+    monthly: planPercent === null ? null : toWindow(planPercent),
+    buckets,
+    planType: typeof membership === 'string' && membership.trim() ? membership.trim() : null,
+    isUnlimited: summary.isUnlimited === true
+  }
+}
+
+/**
+ * Advances a cycle start by one month in UTC, clamping the day so a Jan 31 start
+ * lands on Feb 28/29 instead of overflowing into March.
+ */
+function addOneMonthUtc(startMs: number): number {
+  const start = new Date(startMs)
+  const year = start.getUTCFullYear()
+  const month = start.getUTCMonth()
+  const lastDayOfNextMonth = new Date(Date.UTC(year, month + 2, 0)).getUTCDate()
+  return Date.UTC(
+    year,
+    month + 1,
+    Math.min(start.getUTCDate(), lastDayOfNextMonth),
+    start.getUTCHours(),
+    start.getUTCMinutes(),
+    start.getUTCSeconds(),
+    start.getUTCMilliseconds()
+  )
+}
+
+const legacyBucketSchema = z
+  .object({ numRequests: z.unknown(), maxRequestUsage: z.unknown() })
+  .partial()
+
+const legacyQuotaSchema = z.record(z.string(), z.union([legacyBucketSchema, z.unknown()]))
+
+/**
+ * Request-quota plans predate spend-based billing and report a per-model ceiling
+ * instead of a cents allowance, so those accounts still get a bar.
+ */
+export function mapCursorLegacyRequestQuota(payload: unknown): RateLimitWindow | null {
+  const parsed = legacyQuotaSchema.safeParse(payload)
+  if (!parsed.success) {
+    return null
+  }
+  const quotas: { name: string; used: number; limit: number }[] = []
+  for (const [name, value] of Object.entries(parsed.data)) {
+    const entry = legacyBucketSchema.safeParse(value)
+    if (!entry.success) {
+      continue
+    }
+    const limit = finiteNumber(entry.data.maxRequestUsage)
+    const used = finiteNumber(entry.data.numRequests)
+    if (limit === null || limit <= 0 || used === null) {
+      continue
+    }
+    quotas.push({ name, used, limit })
+  }
+  if (quotas.length === 0) {
+    return null
+  }
+  // Why: 'gpt-4' is the premium bucket on legacy plans; otherwise the largest
+  // ceiling is the headline quota on every shape seen so far.
+  const quota =
+    quotas.find((entry) => entry.name === 'gpt-4') ??
+    quotas.sort((left, right) => right.limit - left.limit)[0]
+  if (!quota) {
+    return null
+  }
+
+  const startOfMonth = parseCursorTimestampMs(parsed.data.startOfMonth)
+  const resetsAt = startOfMonth === null ? null : addOneMonthUtc(startOfMonth)
+  return {
+    usedPercent: clampPercent((quota.used / quota.limit) * 100),
+    windowMinutes: MONTHLY_WINDOW_MINUTES,
+    resetsAt,
+    resetDescription: resetDescription(resetsAt)
+  }
+}
diff --git a/src/main/rate-limits/grok-fetcher.ts b/src/main/rate-limits/grok-fetcher.ts
index 33c4fac9aec..b776613a335 100644
--- a/src/main/rate-limits/grok-fetcher.ts
+++ b/src/main/rate-limits/grok-fetcher.ts
@@ -109,12 +109,11 @@ function usageScalars(config: GrokBillingConfig): (GrokMoneyVal | undefined)[] {
   ]
 }
 
-// Why: proto3 JSON drops default zeros, so an omitted percent can mean zero —
-// but only an explicitly-emitted zero proves this encoder keeps them. #15740
-// ships `onDemandUsed: {val: 0}`, so there the omission means "not reported"
-// and must never render as 0%. Non-zero money fields prove nothing either way,
-// so #9214/#9219 accounts that carry only those keep their genuine 0%.
-function emitsExplicitZeroScalar(config: GrokBillingConfig): boolean {
+function omittedPercentIsUnreported(config: GrokBillingConfig): boolean {
+  // A strict zero cap rejects numeric prefixes like "0invalid" accepted by parseMoneyVal.
+  if (parseMoneyVal(config.onDemandCap) === 0 && Number(config.onDemandCap?.val) === 0) {
+    return [config.onDemandUsed, config.used].some((value) => (parseMoneyVal(value) ?? 0) > 0)
+  }
   return usageScalars(config).some((value) => parseMoneyVal(value) === 0)
 }
 
@@ -130,10 +129,8 @@ function resolveWeeklyPercent(config: GrokBillingConfig): number | null {
   if (reported !== undefined) {
     return null
   }
-  // Why: infer the dropped zero only when nothing else in the payload speaks
-  // for consumption — an explicit zero proves the encoder keeps defaults, and a
-  // computable budget pair is a real monthly number this must not shadow.
-  if (emitsExplicitZeroScalar(config) || mapMonthlyUsage(config) !== null) {
+  // A computable monthly budget must not be relabelled as weekly zero usage.
+  if (omittedPercentIsUnreported(config) || mapMonthlyUsage(config) !== null) {
     return null
   }
   return hasConfirmedWeeklyPeriod(config) ? 0 : null
diff --git a/src/main/rate-limits/grok-weekly-zero.test.ts b/src/main/rate-limits/grok-weekly-zero.test.ts
new file mode 100644
index 00000000000..f8c8b098ebf
--- /dev/null
+++ b/src/main/rate-limits/grok-weekly-zero.test.ts
@@ -0,0 +1,225 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const netFetchMock = vi.hoisted(() => vi.fn())
+vi.mock('electron', () => ({ net: { fetch: netFetchMock } }))
+vi.mock('./grok-auth', () => ({
+  readGrokAuthSession: () => {
+    throw new Error('Tests must supply synthetic auth')
+  },
+  isGrokAccessTokenFresh: () => true
+}))
+
+import { fetchGrokRateLimits } from './grok-fetcher'
+
+const START = '2026-09-13T16:33:14.392197+00:00'
+const END = '2026-09-20T16:33:14.392197+00:00'
+const PERIOD = { type: 'USAGE_PERIOD_TYPE_WEEKLY', start: START, end: END }
+const CONFIRMED_PERIOD = {
+  currentPeriod: PERIOD,
+  billingPeriodStart: START,
+  billingPeriodEnd: END
+}
+// Reporter deminit02-hue's #20657 payload; authentication is synthetic.
+const REPORTER_CONFIG = {
+  ...CONFIRMED_PERIOD,
+  onDemandCap: { val: 0 },
+  onDemandUsed: { val: 0 },
+  prepaidBalance: { val: 0 },
+  isUnifiedBillingUser: true
+}
+const AUTH = {
+  status: 'ok',
+  session: {
+    accessToken: 'fixture-only',
+    userId: 'fixture-user',
+    email: 'grok@example.invalid',
+    teamId: null,
+    oidcClientId: null,
+    expiresAtMs: Date.parse('2099-01-01T00:00:00Z')
+  }
+} as const
+
+function jsonResponse(body: unknown, status = 200) {
+  return { ok: status >= 200 && status < 300, status, json: async () => body }
+}
+
+async function fetchConfig(config: Record<string, unknown>, flat = false) {
+  netFetchMock
+    .mockResolvedValueOnce(jsonResponse(flat ? config : { config }))
+    .mockResolvedValueOnce(jsonResponse({ config: {} }))
+  return fetchGrokRateLimits({ authReadResult: AUTH })
+}
+
+describe('Grok weekly zero evidence', () => {
+  beforeEach(() => netFetchMock.mockReset())
+
+  it.each([false, true])('maps the reporter payload with flat=%s', async (flat) => {
+    const result = await fetchConfig(REPORTER_CONFIG, flat)
+    expect(result.status).toBe('ok')
+    expect(result.weekly).toMatchObject({
+      usedPercent: 0,
+      windowMinutes: 10_080,
+      resetsAt: Date.parse(END)
+    })
+    expect(result.monthly).toBeUndefined()
+    expect(netFetchMock).toHaveBeenCalledTimes(1)
+  })
+
+  it.each([0, '0', '0.00'])('accepts money zero encoded as %s', async (val) => {
+    const result = await fetchConfig({
+      ...REPORTER_CONFIG,
+      onDemandCap: { val },
+      onDemandUsed: { val },
+      prepaidBalance: { val }
+    })
+    expect(result.weekly?.usedPercent).toBe(0)
+    expect(netFetchMock).toHaveBeenCalledTimes(1)
+  })
+
+  it.each([
+    { name: 'absent', cap: undefined },
+    { name: 'empty', cap: {} },
+    { name: 'malformed', cap: { val: 'unknown' } },
+    { name: 'zero prefix', cap: { val: '0invalid' } },
+    { name: 'negative', cap: { val: -1 } },
+    { name: 'nonfinite', cap: { val: Infinity } },
+    { name: 'positive', cap: { val: 250 } }
+  ])('keeps $name cap with explicit money zeros unknown', async ({ cap }) => {
+    const result = await fetchConfig({ ...REPORTER_CONFIG, onDemandCap: cap })
+    expect(result.status).toBe('unavailable')
+    expect(result.weekly).toBeNull()
+    expect(netFetchMock).toHaveBeenCalledTimes(2)
+  })
+
+  it.each(['onDemandUsed', 'used'])('does not infer zero beside positive %s', async (field) => {
+    const result = await fetchConfig({ ...REPORTER_CONFIG, [field]: { val: '37.5' } })
+    expect(result.status).toBe('unavailable')
+    expect(result.weekly).toBeNull()
+    expect(netFetchMock).toHaveBeenCalledTimes(2)
+  })
+
+  it.each([
+    { name: 'absent cap and no money', config: CONFIRMED_PERIOD },
+    { name: 'prepaid only', config: { ...CONFIRMED_PERIOD, prepaidBalance: { val: 25 } } },
+    { name: 'zero cap and prepaid', config: { ...REPORTER_CONFIG, prepaidBalance: { val: 25 } } }
+  ])('preserves $name zero inference', async ({ config }) => {
+    const result = await fetchConfig(config)
+    expect(result.weekly?.usedPercent).toBe(0)
+    expect(netFetchMock).toHaveBeenCalledTimes(1)
+  })
+
+  it.each([0, 23, -10, 150])(
+    'honors finite explicit percent %s before money evidence',
+    async (percent) => {
+      const result = await fetchConfig({
+        ...REPORTER_CONFIG,
+        creditUsagePercent: percent,
+        onDemandUsed: { val: 37.5 },
+        monthlyLimit: { val: 100 },
+        used: { val: 25 },
+        billingPeriodStart: undefined
+      })
+      expect(result.weekly?.usedPercent).toBe(Math.min(100, Math.max(0, percent)))
+      expect(result.monthly).toBeUndefined()
+      expect(netFetchMock).toHaveBeenCalledTimes(1)
+    }
+  )
+
+  it.each([null, '0', 'invalid', Number.NaN, Infinity, -Infinity])(
+    'does not infer an invalid explicit percent %s',
+    async (percent) => {
+      const result = await fetchConfig({ ...REPORTER_CONFIG, creditUsagePercent: percent })
+      expect(result.status).toBe('unavailable')
+      expect(result.weekly).toBeNull()
+      expect(netFetchMock).toHaveBeenCalledTimes(2)
+    }
+  )
+
+  it.each([
+    { billingPeriodStart: undefined },
+    { billingPeriodEnd: undefined },
+    { billingPeriodStart: 'invalid' },
+    { billingPeriodEnd: 'invalid' },
+    { billingPeriodStart: END },
+    { billingPeriodEnd: START },
+    { currentPeriod: undefined },
+    { currentPeriod: { ...PERIOD, type: 'USAGE_PERIOD_TYPE_MONTHLY' } },
+    { currentPeriod: { ...PERIOD, start: 'invalid' } },
+    { currentPeriod: { ...PERIOD, end: 'invalid' } }
+  ])('requires confirmed weekly bounds: %o', async (period) => {
+    const result = await fetchConfig({ ...REPORTER_CONFIG, ...period })
+    expect(result.status).toBe('unavailable')
+    expect(result.weekly).toBeNull()
+    expect(netFetchMock).toHaveBeenCalledTimes(2)
+  })
+
+  it.each([0, 25])('keeps a computable monthly pair with used=%s monthly', async (used) => {
+    const result = await fetchConfig({
+      ...REPORTER_CONFIG,
+      monthlyLimit: { val: '100' },
+      used: { val: used }
+    })
+    expect(result.status).toBe('ok')
+    expect(result.weekly).toBeNull()
+    expect(result.monthly).toMatchObject({ usedPercent: used, windowMinutes: 43_200 })
+    expect(netFetchMock).toHaveBeenCalledTimes(1)
+  })
+
+  it.each([0, '0', -1, 'invalid', null, Infinity, Number.NaN])(
+    'rejects invalid monthly denominator %s',
+    async (val) => {
+      netFetchMock
+        .mockResolvedValueOnce(jsonResponse({ config: { subscriptionTier: 'Fixture' } }))
+        .mockResolvedValueOnce(
+          jsonResponse({ config: { monthlyLimit: { val }, used: { val: 12 } } })
+        )
+      const result = await fetchGrokRateLimits({ authReadResult: AUTH })
+      expect(result.status).toBe('unavailable')
+      expect(result.weekly).toBeNull()
+      expect(result.monthly).toBeUndefined()
+      expect(netFetchMock).toHaveBeenCalledTimes(2)
+    }
+  )
+
+  it.each([false, true])('preserves monthly fallback with flat=%s', async (flat) => {
+    const config = { monthlyLimit: { val: 200 }, used: { val: 50 }, billingPeriodEnd: END }
+    netFetchMock
+      .mockResolvedValueOnce(
+        jsonResponse({ config: { ...REPORTER_CONFIG, onDemandCap: { val: 250 } } })
+      )
+      .mockResolvedValueOnce(jsonResponse(flat ? config : { config }))
+    const result = await fetchGrokRateLimits({ authReadResult: AUTH })
+    expect(result.status).toBe('ok')
+    expect(result.weekly).toBeNull()
+    expect(result.monthly).toMatchObject({ usedPercent: 25, resetsAt: Date.parse(END) })
+    expect(netFetchMock).toHaveBeenCalledTimes(2)
+  })
+
+  it.each([401, 403, 500])('preserves fallback HTTP %s errors', async (status) => {
+    netFetchMock
+      .mockResolvedValueOnce(jsonResponse({ config: { subscriptionTier: 'Fixture' } }))
+      .mockResolvedValueOnce(jsonResponse({}, status))
+    const result = await fetchGrokRateLimits({ authReadResult: AUTH })
+    expect(result.status).toBe('error')
+    expect(result.error).toContain(`HTTP ${status}`)
+    expect(netFetchMock).toHaveBeenCalledTimes(2)
+  })
+
+  it('aborts the default billing fallback with the caller signal', async () => {
+    const controller = new AbortController()
+    let signal: AbortSignal | null | undefined
+    netFetchMock
+      .mockResolvedValueOnce(jsonResponse({ config: { subscriptionTier: 'Fixture' } }))
+      .mockImplementationOnce((_url, init: RequestInit) => {
+        signal = init.signal
+        return new Promise((_resolve, reject) => {
+          signal?.addEventListener('abort', () => reject(new Error('aborted')), { once: true })
+        })
+      })
+    const pending = fetchGrokRateLimits({ authReadResult: AUTH, signal: controller.signal })
+    await vi.waitFor(() => expect(netFetchMock).toHaveBeenCalledTimes(2))
+    controller.abort()
+    expect(signal?.aborted).toBe(true)
+    expect(await pending).toMatchObject({ status: 'error', error: 'aborted' })
+  })
+})
diff --git a/src/main/rate-limits/minimax/minimax-fetcher.test.ts b/src/main/rate-limits/minimax/minimax-fetcher.test.ts
index d587c6b9256..d03c6a7c589 100644
--- a/src/main/rate-limits/minimax/minimax-fetcher.test.ts
+++ b/src/main/rate-limits/minimax/minimax-fetcher.test.ts
@@ -19,12 +19,7 @@ vi.mock('electron', () => ({
   session: { fromPartition: sessionFromPartitionMock }
 }))
 
-import {
-  extractMiniMaxCookieValue,
-  fetchMiniMaxRateLimits,
-  normalizeMiniMaxCookieHeader,
-  redactMiniMaxSecret
-} from './minimax-fetcher'
+import { fetchMiniMaxRateLimits } from './minimax-fetcher'
 
 const MINIMAX_URL = 'https://platform.minimax.io/v1/api/openplatform/coding_plan/remains'
 
@@ -646,54 +641,3 @@ describe('fetchMiniMaxRateLimits', () => {
     })
   })
 })
-
-describe('normalizeMiniMaxCookieHeader', () => {
-  it('preserves all cookie pairs from a browser Cookie header', () => {
-    const normalized = normalizeMiniMaxCookieHeader(
-      '_token=tok; session=other; ak_bmsc=ak; minimax_group_id_v2=42; random=xyz'
-    )
-    expect(normalized).toBe(
-      '_token=tok; session=other; ak_bmsc=ak; minimax_group_id_v2=42; random=xyz'
-    )
-  })
-
-  it('normalizes quoted MiniMax cookie storage syntax', () => {
-    expect(normalizeMiniMaxCookieHeader('_token:"tok" minimax_group_id_v2:"42"')).toBe(
-      '_token=tok; minimax_group_id_v2=42'
-    )
-  })
-
-  it('accepts a copied Cookie header line', () => {
-    expect(normalizeMiniMaxCookieHeader('Cookie: session=abc; other=xyz')).toBe(
-      'session=abc; other=xyz'
-    )
-  })
-})
-
-describe('extractMiniMaxCookieValue', () => {
-  it('returns the value for a given cookie name', () => {
-    expect(extractMiniMaxCookieValue(FULL_COOKIE, 'minimax_group_id_v2')).toBe('12345')
-  })
-  it('returns null when the name is absent', () => {
-    expect(extractMiniMaxCookieValue('_token=tok', 'minimax_group_id_v2')).toBeNull()
-  })
-})
-
-describe('redactMiniMaxSecret', () => {
-  it('redacts _token values', () => {
-    expect(redactMiniMaxSecret('cookie _token=eyJhABCDEF')).toContain('_token=[REDACTED]')
-    expect(redactMiniMaxSecret('cookie _token=eyJhABCDEF')).not.toContain('eyJhABCDEF')
-  })
-  it('redacts minimax_group_id_v2 values', () => {
-    expect(redactMiniMaxSecret('minimax_group_id_v2=99999 trailing')).not.toContain('99999')
-  })
-  it('redacts MiniMax anti-bot cookie values', () => {
-    const redacted = redactMiniMaxSecret('ak_bmsc=secret bm_sv:"secret2"')
-    expect(redacted).not.toContain('secret')
-    expect(redacted).toContain('ak_bmsc=[REDACTED]')
-    expect(redacted).toContain('bm_sv:[REDACTED]')
-  })
-  it('redacts Cookie: header lines', () => {
-    expect(redactMiniMaxSecret('X-Cookie: _token=secret')).toContain('[REDACTED]')
-  })
-})
diff --git a/src/main/rate-limits/rate-limit-service-test-harness.ts b/src/main/rate-limits/rate-limit-service-test-harness.ts
index 25f7baeb78d..f51839d108b 100644
--- a/src/main/rate-limits/rate-limit-service-test-harness.ts
+++ b/src/main/rate-limits/rate-limit-service-test-harness.ts
@@ -8,7 +8,10 @@ import { fetchKimiRateLimits } from './kimi-fetcher'
 import { fetchMiniMaxRateLimits } from './minimax/minimax-fetcher'
 import { fetchGrokRateLimits } from './grok-fetcher'
 import { readGrokAuthSession } from './grok-auth'
+import { fetchCursorRateLimits } from './cursor-fetcher'
+import { readCursorAuthSession } from './cursor-auth'
 import { fetchOpenCodeGoUsage } from './opencode-go-usage-source-selection'
+import { fetchZcodeRateLimits } from './zcode-usage-fetcher'
 import { hasMiniMaxSessionCookie } from '../minimax/minimax-cookie-store'
 
 export type Deferred<T> = {
@@ -89,6 +92,8 @@ export function mockFreshBackgroundProviderFetches(): void {
   vi.mocked(fetchKimiRateLimits).mockImplementation(async () => okProvider('kimi', 0))
   vi.mocked(fetchMiniMaxRateLimits).mockImplementation(async () => okProvider('minimax', 0))
   vi.mocked(fetchGrokRateLimits).mockImplementation(async () => unavailableProvider('grok'))
+  vi.mocked(fetchCursorRateLimits).mockImplementation(async () => unavailableProvider('cursor'))
+  vi.mocked(fetchZcodeRateLimits).mockImplementation(async () => unavailableProvider('zcode'))
 }
 
 /** Shared `beforeEach` body: healthy stubs for every provider the service polls. */
@@ -106,8 +111,11 @@ export function resetRateLimitProviderMocks(): void {
     error: null,
     status: 'unavailable'
   })
+  vi.mocked(fetchCursorRateLimits).mockResolvedValue(unavailableProvider('cursor'))
+  vi.mocked(fetchZcodeRateLimits).mockResolvedValue(unavailableProvider('zcode'))
   vi.mocked(hasMiniMaxSessionCookie).mockReturnValue(false)
   vi.mocked(readGrokAuthSession).mockReturnValue({ status: 'missing' })
+  vi.mocked(readCursorAuthSession).mockResolvedValue({ status: 'missing' })
 }
 
 type RateLimitWindow = Parameters<RateLimitService['attach']>[0]
diff --git a/src/main/rate-limits/service-account-target-selection.test.ts b/src/main/rate-limits/service-account-target-selection.test.ts
index 16373024614..bb5de4b6485 100644
--- a/src/main/rate-limits/service-account-target-selection.test.ts
+++ b/src/main/rate-limits/service-account-target-selection.test.ts
@@ -32,6 +32,10 @@ vi.mock('./opencode-go-usage-source-selection', () => ({
   fetchOpenCodeGoUsage: vi.fn()
 }))
 
+vi.mock('./zcode-usage-fetcher', () => ({
+  fetchZcodeRateLimits: vi.fn()
+}))
+
 vi.mock('./minimax/minimax-fetcher', () => ({
   fetchMiniMaxRateLimits: vi.fn()
 }))
@@ -40,6 +44,14 @@ vi.mock('./grok-fetcher', () => ({
   fetchGrokRateLimits: vi.fn()
 }))
 
+vi.mock('./cursor-fetcher', () => ({
+  fetchCursorRateLimits: vi.fn()
+}))
+
+vi.mock('./cursor-auth', () => ({
+  readCursorAuthSession: vi.fn()
+}))
+
 vi.mock('./grok-auth', () => ({
   readGrokAuthSession: vi.fn(() => ({ status: 'missing' }))
 }))
diff --git a/src/main/rate-limits/service-antigravity-usage.test.ts b/src/main/rate-limits/service-antigravity-usage.test.ts
index 9f5afe9423d..3696f434dec 100644
--- a/src/main/rate-limits/service-antigravity-usage.test.ts
+++ b/src/main/rate-limits/service-antigravity-usage.test.ts
@@ -39,6 +39,16 @@ vi.mock('./grok-fetcher', () => ({
   fetchGrokRateLimits: vi.fn()
 }))
 
+vi.mock('./zcode-usage-fetcher', () => ({ fetchZcodeRateLimits: vi.fn() }))
+
+vi.mock('./cursor-fetcher', () => ({
+  fetchCursorRateLimits: vi.fn()
+}))
+
+vi.mock('./cursor-auth', () => ({
+  readCursorAuthSession: vi.fn()
+}))
+
 vi.mock('./grok-auth', () => ({
   readGrokAuthSession: vi.fn(() => ({ status: 'missing' }))
 }))
diff --git a/src/main/rate-limits/service-cursor-usage.test.ts b/src/main/rate-limits/service-cursor-usage.test.ts
new file mode 100644
index 00000000000..3646f9f8586
--- /dev/null
+++ b/src/main/rate-limits/service-cursor-usage.test.ts
@@ -0,0 +1,165 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { RateLimitService } from './service'
+import { fetchCursorRateLimits } from './cursor-fetcher'
+import { readCursorAuthSession } from './cursor-auth'
+import { parseCursorSessionToken } from './cursor-session-token'
+import { fetchClaudeRateLimits } from './claude-fetcher'
+import { fetchCodexRateLimits } from './codex-fetcher'
+import { okProvider, resetRateLimitProviderMocks } from './rate-limit-service-test-harness'
+
+vi.mock('./claude-fetcher', () => ({
+  fetchClaudeRateLimits: vi.fn(),
+  fetchManagedAccountUsage: vi.fn()
+}))
+
+vi.mock('./codex-fetcher', () => ({
+  consumeCodexRateLimitResetCredit: vi.fn(),
+  fetchCodexRateLimits: vi.fn()
+}))
+
+vi.mock('./gemini-usage-fetcher', () => ({ fetchGeminiRateLimits: vi.fn() }))
+vi.mock('./kimi-fetcher', () => ({ fetchKimiRateLimits: vi.fn() }))
+vi.mock('./opencode-go-usage-source-selection', () => ({ fetchOpenCodeGoUsage: vi.fn() }))
+vi.mock('./minimax/minimax-fetcher', () => ({ fetchMiniMaxRateLimits: vi.fn() }))
+vi.mock('./grok-fetcher', () => ({ fetchGrokRateLimits: vi.fn() }))
+vi.mock('./grok-auth', () => ({ readGrokAuthSession: vi.fn(() => ({ status: 'missing' })) }))
+vi.mock('./zcode-usage-fetcher', () => ({ fetchZcodeRateLimits: vi.fn() }))
+
+vi.mock('./cursor-fetcher', () => ({ fetchCursorRateLimits: vi.fn() }))
+vi.mock('./cursor-auth', () => ({ readCursorAuthSession: vi.fn() }))
+vi.mock('../minimax/minimax-cookie-store', () => ({ hasMiniMaxSessionCookie: vi.fn(() => false) }))
+
+type JwtSegment = Record<string, unknown>
+
+function jwt(): string {
+  const encode = (value: JwtSegment): string =>
+    Buffer.from(JSON.stringify(value)).toString('base64url')
+  return `${encode({ alg: 'RS256' })}.${encode({ sub: 'auth0|user_1', exp: 4_000_000_000 })}.sig`
+}
+
+function signedInResult(): Awaited<ReturnType<typeof readCursorAuthSession>> {
+  return {
+    status: 'ok',
+    session: {
+      token: parseCursorSessionToken(jwt())!,
+      source: 'keychain',
+      email: 'dev@example.com',
+      displayName: 'Dev',
+      membershipType: 'pro',
+      subscriptionStatus: 'active'
+    }
+  }
+}
+
+describe('RateLimitService Cursor usage', () => {
+  beforeEach(() => {
+    resetRateLimitProviderMocks()
+    vi.mocked(fetchClaudeRateLimits).mockResolvedValue(okProvider('claude', 0))
+    vi.mocked(fetchCodexRateLimits).mockResolvedValue(okProvider('codex', 0))
+  })
+
+  it('does not probe the Cursor keychain while callers read state snapshots', () => {
+    const service = new RateLimitService()
+    service.getState()
+    service.getState()
+    expect(readCursorAuthSession).not.toHaveBeenCalled()
+  })
+
+  it('reports Cursor as unconfigured until a fetch cycle finds a session', async () => {
+    const service = new RateLimitService()
+    expect(service.getState().cursorAuthConfigured).toBe(false)
+
+    vi.mocked(readCursorAuthSession).mockResolvedValue(signedInResult())
+    vi.mocked(fetchCursorRateLimits).mockResolvedValue(okProvider('cursor', 42))
+    await service.refresh()
+
+    expect(service.getState().cursorAuthConfigured).toBe(true)
+    expect(service.getState().cursor?.status).toBe('ok')
+  })
+
+  it('passes the resolved session to the fetcher instead of reading it twice', async () => {
+    const authReadResult = signedInResult()
+    vi.mocked(readCursorAuthSession).mockResolvedValue(authReadResult)
+    vi.mocked(fetchCursorRateLimits).mockResolvedValue(okProvider('cursor', 7))
+
+    await new RateLimitService().refresh()
+
+    expect(readCursorAuthSession).toHaveBeenCalledTimes(1)
+    expect(fetchCursorRateLimits).toHaveBeenCalledWith(expect.objectContaining({ authReadResult }))
+  })
+
+  it('publishes an error snapshot instead of dropping the cycle when the fetch throws', async () => {
+    vi.mocked(readCursorAuthSession).mockResolvedValue({ status: 'missing' })
+    vi.mocked(fetchCursorRateLimits).mockRejectedValue(new Error('boom'))
+
+    const service = new RateLimitService()
+    await service.refresh()
+
+    const state = service.getState()
+    expect(state.cursor).toMatchObject({ provider: 'cursor', status: 'error', error: 'boom' })
+    // Why: a Cursor failure must not take the rest of the cycle down with it.
+    expect(state.gemini?.status).toBe('ok')
+  })
+
+  it("drops a previous account's usage when the signed-in account changes", async () => {
+    // Why: the stale policy keeps a recent snapshot through a failed refresh. Across
+    // an account switch that would name the new account beside the old one's figures.
+    vi.mocked(readCursorAuthSession).mockResolvedValue(signedInResult())
+    vi.mocked(fetchCursorRateLimits).mockResolvedValue({
+      ...okProvider('cursor', 80),
+      usageMetadata: { source: 'cli', authProvenance: 'account-a' }
+    })
+    const service = new RateLimitService()
+    await service.refresh()
+    expect(service.getState().cursor?.session?.usedPercent).toBe(80)
+
+    vi.mocked(fetchCursorRateLimits).mockResolvedValue({
+      provider: 'cursor',
+      session: null,
+      weekly: null,
+      updatedAt: Date.now(),
+      error: 'Cursor sign-in expired — run `cursor-agent login` again',
+      status: 'error',
+      // Why this exact shape: it is what cursor-fetcher returns for a readable but
+      // rejected session, which is the failure an account switch actually hits.
+      usageMetadata: { source: 'cli', failureKind: 'stale-token', authProvenance: 'account-b' }
+    })
+    await service.refresh()
+    expect(service.getState().cursor?.session).toBeNull()
+    expect(service.getState().cursor?.status).toBe('error')
+  })
+
+  it('keeps the last reading when a refresh fails without naming an account', async () => {
+    vi.mocked(readCursorAuthSession).mockResolvedValue(signedInResult())
+    vi.mocked(fetchCursorRateLimits).mockResolvedValue({
+      ...okProvider('cursor', 60),
+      usageMetadata: { source: 'cli', authProvenance: 'account-a' }
+    })
+    const service = new RateLimitService()
+    await service.refresh()
+
+    vi.mocked(fetchCursorRateLimits).mockResolvedValue({
+      provider: 'cursor',
+      session: null,
+      weekly: null,
+      updatedAt: Date.now(),
+      error: 'Cursor usage request failed',
+      status: 'error',
+      usageMetadata: { source: 'cli' }
+    })
+    await service.refresh()
+    expect(service.getState().cursor?.session?.usedPercent).toBe(60)
+  })
+
+  it('clears cursorAuthConfigured once the local session goes away', async () => {
+    vi.mocked(readCursorAuthSession).mockResolvedValue(signedInResult())
+    vi.mocked(fetchCursorRateLimits).mockResolvedValue(okProvider('cursor', 5))
+    const service = new RateLimitService()
+    await service.refresh()
+    expect(service.getState().cursorAuthConfigured).toBe(true)
+
+    vi.mocked(readCursorAuthSession).mockResolvedValue({ status: 'missing' })
+    await service.refresh()
+    expect(service.getState().cursorAuthConfigured).toBe(false)
+  })
+})
diff --git a/src/main/rate-limits/service-inactive-account-previews.test.ts b/src/main/rate-limits/service-inactive-account-previews.test.ts
index 1dee94e8c99..23f0a0e6bba 100644
--- a/src/main/rate-limits/service-inactive-account-previews.test.ts
+++ b/src/main/rate-limits/service-inactive-account-previews.test.ts
@@ -39,6 +39,10 @@ vi.mock('./opencode-go-usage-source-selection', () => ({
   fetchOpenCodeGoUsage: vi.fn()
 }))
 
+vi.mock('./zcode-usage-fetcher', () => ({
+  fetchZcodeRateLimits: vi.fn()
+}))
+
 vi.mock('./minimax/minimax-fetcher', () => ({
   fetchMiniMaxRateLimits: vi.fn()
 }))
@@ -47,6 +51,14 @@ vi.mock('./grok-fetcher', () => ({
   fetchGrokRateLimits: vi.fn()
 }))
 
+vi.mock('./cursor-fetcher', () => ({
+  fetchCursorRateLimits: vi.fn()
+}))
+
+vi.mock('./cursor-auth', () => ({
+  readCursorAuthSession: vi.fn()
+}))
+
 vi.mock('./grok-auth', () => ({
   readGrokAuthSession: vi.fn(() => ({ status: 'missing' }))
 }))
diff --git a/src/main/rate-limits/service-live-claude-usage.test.ts b/src/main/rate-limits/service-live-claude-usage.test.ts
index 9b9137568fb..07f6ccf0d27 100644
--- a/src/main/rate-limits/service-live-claude-usage.test.ts
+++ b/src/main/rate-limits/service-live-claude-usage.test.ts
@@ -36,6 +36,10 @@ vi.mock('./opencode-go-usage-source-selection', () => ({
   fetchOpenCodeGoUsage: vi.fn()
 }))
 
+vi.mock('./zcode-usage-fetcher', () => ({
+  fetchZcodeRateLimits: vi.fn()
+}))
+
 vi.mock('./minimax/minimax-fetcher', () => ({
   fetchMiniMaxRateLimits: vi.fn()
 }))
@@ -44,6 +48,14 @@ vi.mock('./grok-fetcher', () => ({
   fetchGrokRateLimits: vi.fn()
 }))
 
+vi.mock('./cursor-fetcher', () => ({
+  fetchCursorRateLimits: vi.fn()
+}))
+
+vi.mock('./cursor-auth', () => ({
+  readCursorAuthSession: vi.fn()
+}))
+
 vi.mock('./grok-auth', () => ({
   readGrokAuthSession: vi.fn(() => ({ status: 'missing' }))
 }))
diff --git a/src/main/rate-limits/service-minimax-usage.test.ts b/src/main/rate-limits/service-minimax-usage.test.ts
index 89b311827b6..93f95de7847 100644
--- a/src/main/rate-limits/service-minimax-usage.test.ts
+++ b/src/main/rate-limits/service-minimax-usage.test.ts
@@ -33,6 +33,10 @@ vi.mock('./opencode-go-usage-source-selection', () => ({
   fetchOpenCodeGoUsage: vi.fn()
 }))
 
+vi.mock('./zcode-usage-fetcher', () => ({
+  fetchZcodeRateLimits: vi.fn()
+}))
+
 vi.mock('./minimax/minimax-fetcher', () => ({
   fetchMiniMaxRateLimits: vi.fn()
 }))
@@ -41,6 +45,14 @@ vi.mock('./grok-fetcher', () => ({
   fetchGrokRateLimits: vi.fn()
 }))
 
+vi.mock('./cursor-fetcher', () => ({
+  fetchCursorRateLimits: vi.fn()
+}))
+
+vi.mock('./cursor-auth', () => ({
+  readCursorAuthSession: vi.fn()
+}))
+
 vi.mock('./grok-auth', () => ({
   readGrokAuthSession: vi.fn(() => ({ status: 'missing' }))
 }))
diff --git a/src/main/rate-limits/service-refresh-orchestration.test.ts b/src/main/rate-limits/service-refresh-orchestration.test.ts
index 9b70fa0ea51..9577a87d6a3 100644
--- a/src/main/rate-limits/service-refresh-orchestration.test.ts
+++ b/src/main/rate-limits/service-refresh-orchestration.test.ts
@@ -7,6 +7,7 @@ import { fetchGeminiRateLimits } from './gemini-usage-fetcher'
 import { fetchKimiRateLimits } from './kimi-fetcher'
 import { fetchMiniMaxRateLimits } from './minimax/minimax-fetcher'
 import { fetchGrokRateLimits } from './grok-fetcher'
+import { fetchZcodeRateLimits } from './zcode-usage-fetcher'
 import { readGrokAuthSession } from './grok-auth'
 import { fetchOpenCodeGoUsage } from './opencode-go-usage-source-selection'
 import {
@@ -40,6 +41,10 @@ vi.mock('./opencode-go-usage-source-selection', () => ({
   fetchOpenCodeGoUsage: vi.fn()
 }))
 
+vi.mock('./zcode-usage-fetcher', () => ({
+  fetchZcodeRateLimits: vi.fn()
+}))
+
 vi.mock('./minimax/minimax-fetcher', () => ({
   fetchMiniMaxRateLimits: vi.fn()
 }))
@@ -48,6 +53,14 @@ vi.mock('./grok-fetcher', () => ({
   fetchGrokRateLimits: vi.fn()
 }))
 
+vi.mock('./cursor-fetcher', () => ({
+  fetchCursorRateLimits: vi.fn()
+}))
+
+vi.mock('./cursor-auth', () => ({
+  readCursorAuthSession: vi.fn()
+}))
+
 vi.mock('./grok-auth', () => ({
   readGrokAuthSession: vi.fn(() => ({ status: 'missing' }))
 }))
@@ -65,6 +78,57 @@ describe('RateLimitService', () => {
     resetRateLimitProviderMocks()
   })
 
+  it('publishes a ZCode quota snapshot alongside the other providers', async () => {
+    vi.mocked(fetchClaudeRateLimits).mockResolvedValue(okProvider('claude', 7))
+    vi.mocked(fetchCodexRateLimits).mockResolvedValue(okProvider('codex', 8))
+    vi.mocked(fetchZcodeRateLimits).mockResolvedValue(okProvider('zcode', 42))
+    const service = new RateLimitService()
+
+    await service.refresh()
+
+    expect(fetchZcodeRateLimits).toHaveBeenCalledTimes(1)
+    expect(service.getState().zcode?.session?.usedPercent).toBe(42)
+    expect(service.getState().codex?.session?.usedPercent).toBe(8)
+  })
+
+  it('does not keep a previous ZCode account quota after a failed account switch', async () => {
+    vi.mocked(fetchZcodeRateLimits)
+      .mockResolvedValueOnce({
+        ...okProvider('zcode', 42),
+        usageMetadata: { source: 'web', authProvenance: 'account-a' }
+      })
+      .mockResolvedValueOnce({
+        ...errorProvider('zcode', 'request failed'),
+        usageMetadata: { source: 'web', authProvenance: 'account-b', failureKind: 'network' }
+      })
+    const service = new RateLimitService()
+
+    await service.refresh()
+    await service.refresh()
+
+    expect(service.getState().zcode?.status).toBe('error')
+    expect(service.getState().zcode?.session).toBeNull()
+  })
+
+  it('keeps a recent ZCode quota after a failed retry for the same account', async () => {
+    vi.mocked(fetchZcodeRateLimits)
+      .mockResolvedValueOnce({
+        ...okProvider('zcode', 42),
+        usageMetadata: { source: 'web', authProvenance: 'account-a' }
+      })
+      .mockResolvedValueOnce({
+        ...errorProvider('zcode', 'request failed'),
+        usageMetadata: { source: 'web', authProvenance: 'account-a', failureKind: 'network' }
+      })
+    const service = new RateLimitService()
+
+    await service.refresh()
+    await service.refresh()
+
+    expect(service.getState().zcode?.status).toBe('error')
+    expect(service.getState().zcode?.session?.usedPercent).toBe(42)
+  })
+
   it('does not reread Grok auth when callers read state snapshots', () => {
     vi.mocked(readGrokAuthSession).mockReturnValue({
       status: 'ok',
diff --git a/src/main/rate-limits/service-window-activation.test.ts b/src/main/rate-limits/service-window-activation.test.ts
index 2b53c0919a1..54296c396b9 100644
--- a/src/main/rate-limits/service-window-activation.test.ts
+++ b/src/main/rate-limits/service-window-activation.test.ts
@@ -41,6 +41,10 @@ vi.mock('./opencode-go-usage-source-selection', () => ({
   fetchOpenCodeGoUsage: vi.fn()
 }))
 
+vi.mock('./zcode-usage-fetcher', () => ({
+  fetchZcodeRateLimits: vi.fn()
+}))
+
 vi.mock('./minimax/minimax-fetcher', () => ({
   fetchMiniMaxRateLimits: vi.fn()
 }))
@@ -49,6 +53,14 @@ vi.mock('./grok-fetcher', () => ({
   fetchGrokRateLimits: vi.fn()
 }))
 
+vi.mock('./cursor-fetcher', () => ({
+  fetchCursorRateLimits: vi.fn()
+}))
+
+vi.mock('./cursor-auth', () => ({
+  readCursorAuthSession: vi.fn()
+}))
+
 vi.mock('./grok-auth', () => ({
   readGrokAuthSession: vi.fn(() => ({ status: 'missing' }))
 }))
diff --git a/src/main/rate-limits/service/service-configuration.ts b/src/main/rate-limits/service/service-configuration.ts
index f2629aa4fea..2a788b1cf93 100644
--- a/src/main/rate-limits/service/service-configuration.ts
+++ b/src/main/rate-limits/service/service-configuration.ts
@@ -127,6 +127,7 @@ export abstract class RateLimitServiceConfiguration extends RateLimitServiceAcco
       minimaxApiKeyConfigured: hasMiniMaxApiKey(),
       opencodeGoApiKeyConfigured: this.openCodeGoApiKeyConfigured,
       grokAuthConfigured: this.grokAuthConfigured,
+      cursorAuthConfigured: this.cursorAuthConfigured,
       claudeTarget: this.claudeFetchTarget,
       codexTarget: this.codexFetchTarget,
       inactiveClaudeAccounts: this.buildInactiveArray(
diff --git a/src/main/rate-limits/service/service-full-cycle-application.ts b/src/main/rate-limits/service/service-full-cycle-application.ts
index 7104face38f..70b58933c16 100644
--- a/src/main/rate-limits/service/service-full-cycle-application.ts
+++ b/src/main/rate-limits/service/service-full-cycle-application.ts
@@ -1,5 +1,6 @@
 import { RateLimitServiceFullCyclePreparation } from './service-full-cycle-preparation'
 import { deriveAntigravityRateLimits } from '../antigravity-usage-mirror'
+import { settleSiblingProviderResult } from './service-sibling-provider-result'
 import type { ProviderRateLimits } from './service-types'
 
 export abstract class RateLimitServiceFullCycleApplication extends RateLimitServiceFullCyclePreparation {
@@ -34,7 +35,9 @@ export abstract class RateLimitServiceFullCycleApplication extends RateLimitServ
         kimiResult,
         miniMaxResult
       ],
-      grokResultPromise
+      grokResultPromise,
+      cursorResultPromise,
+      zcodeResultPromise
     } = prepared
     if (signal.aborted) {
       return
@@ -191,25 +194,45 @@ export abstract class RateLimitServiceFullCycleApplication extends RateLimitServ
         : this.state.minimax
     })
 
-    const grokResult = await grokResultPromise
+    const [grokSettled, cursorSettled, zcodeSettled] = await Promise.all([
+      grokResultPromise,
+      cursorResultPromise,
+      zcodeResultPromise
+    ])
     if (signal.aborted) {
       return
     }
-    const grok =
-      grokResult.status === 'fulfilled'
-        ? grokResult.value
-        : ({
-            provider: 'grok',
-            session: null,
-            weekly: null,
-            updatedAt: Date.now(),
-            error: grokResult.reason instanceof Error ? grokResult.reason.message : 'Unknown error',
-            status: 'error'
-          } satisfies ProviderRateLimits)
+    const grok = settleSiblingProviderResult('grok', grokSettled)
+    const cursor = settleSiblingProviderResult('cursor', cursorSettled)
+    const zcode = settleSiblingProviderResult('zcode', zcodeSettled)
+    // Why: the stale policy keeps a recent snapshot through a failed refresh, but
+    // a snapshot belonging to a different Cursor account must not survive the
+    // switch — the Accounts pane would name the new account beside the old
+    // account's figures. Only a known-and-changed identity clears it, so an
+    // errored refresh that reports no account still keeps its own last reading.
+    const previousCursorAccount = previousState.cursor?.usageMetadata?.authProvenance
+    const cursorAccount = cursor.usageMetadata?.authProvenance
+    const cursorAccountChanged =
+      previousCursorAccount !== undefined &&
+      cursorAccount !== undefined &&
+      previousCursorAccount !== cursorAccount
+    const previousZcodeAccount = previousState.zcode?.usageMetadata?.authProvenance
+    const zcodeAccount = zcode.usageMetadata?.authProvenance
+    const sameZcodeAccount =
+      previousZcodeAccount !== undefined &&
+      zcodeAccount !== undefined &&
+      previousZcodeAccount === zcodeAccount
     this.trackActiveFailureStreak('grok', grok)
+    this.trackActiveFailureStreak('cursor', cursor)
+    this.trackActiveFailureStreak('zcode', zcode)
     this.updateState({
       ...this.state,
-      grok: this.applyStalePolicy(grok, previousState.grok)
+      grok: this.applyStalePolicy(grok, previousState.grok),
+      cursor: cursorAccountChanged ? cursor : this.applyStalePolicy(cursor, previousState.cursor),
+      zcode:
+        zcode.status === 'error' && !sameZcodeAccount
+          ? zcode
+          : this.applyStalePolicy(zcode, previousState.zcode)
     })
   }
 }
diff --git a/src/main/rate-limits/service/service-full-cycle-preparation.ts b/src/main/rate-limits/service/service-full-cycle-preparation.ts
index 3e4f77b906d..55a2cc2a062 100644
--- a/src/main/rate-limits/service/service-full-cycle-preparation.ts
+++ b/src/main/rate-limits/service/service-full-cycle-preparation.ts
@@ -3,10 +3,14 @@ import { fetchCodexRateLimits } from '../codex-fetcher'
 import { fetchGeminiRateLimits } from '../gemini-usage-fetcher'
 import { fetchGrokRateLimits } from '../grok-fetcher'
 import { readGrokAuthSession } from '../grok-auth'
+import { fetchCursorRateLimits } from '../cursor-fetcher'
+import { readCursorAuthSession } from '../cursor-auth'
+import { fetchZcodeRateLimits } from '../zcode-usage-fetcher'
 import { fetchMiniMaxRateLimits } from '../minimax/minimax-fetcher'
 import { createHash } from 'node:crypto'
 import { fetchOpenCodeGoUsage } from '../opencode-go-usage-source-selection'
 import { RateLimitServiceFetchPolicy } from './service-fetch-policy'
+import type { SettledProviderResult } from './service-sibling-provider-result'
 import type {
   ClaudeRuntimeAuthPreparation,
   InternalRateLimitState,
@@ -39,9 +43,9 @@ export type FetchAllCyclePrepared = {
     PromiseSettledResult<ProviderRateLimits>,
     PromiseSettledResult<ProviderRateLimits>
   ]
-  grokResultPromise: Promise<
-    { status: 'fulfilled'; value: ProviderRateLimits } | { status: 'rejected'; reason: unknown }
-  >
+  grokResultPromise: Promise<SettledProviderResult>
+  cursorResultPromise: Promise<SettledProviderResult>
+  zcodeResultPromise: Promise<SettledProviderResult>
 }
 
 export abstract class RateLimitServiceFullCyclePreparation extends RateLimitServiceFetchPolicy {
@@ -127,9 +131,28 @@ export abstract class RateLimitServiceFullCyclePreparation extends RateLimitServ
       minimax: miniMaxConfigChanged
         ? this.withFetchingStatus(null, 'minimax')
         : this.withFetchingStatus(previousState.minimax, 'minimax'),
-      grok: this.withFetchingStatus(previousState.grok, 'grok')
+      grok: this.withFetchingStatus(previousState.grok, 'grok'),
+      cursor: this.withFetchingStatus(previousState.cursor, 'cursor'),
+      zcode: this.withFetchingStatus(previousState.zcode, 'zcode')
     })
 
+    // Why: the Cursor probe reads the macOS Keychain, so it is awaited inside the
+    // provider's own promise instead of blocking the rest of the cycle on it.
+    const cursorResultPromise = readCursorAuthSession()
+      .then((authReadResult) => {
+        this.cursorAuthConfigured = authReadResult.status === 'ok'
+        return fetchCursorRateLimits({ signal, authReadResult })
+      })
+      .then(
+        (value) => ({ status: 'fulfilled', value }) as const,
+        (reason) => ({ status: 'rejected', reason }) as const
+      )
+
+    const zcodeResultPromise = fetchZcodeRateLimits({ signal }).then(
+      (value) => ({ status: 'fulfilled', value }) as const,
+      (reason) => ({ status: 'rejected', reason }) as const
+    )
+
     const missingWslCodexHome =
       codexFetchGated || codexHomePath ? null : this.getMissingWslCodexHomeResult(codexTarget)
     const grokResultPromise = fetchGrokRateLimits({
@@ -215,7 +238,9 @@ export abstract class RateLimitServiceFullCyclePreparation extends RateLimitServ
         kimiResult,
         miniMaxResult
       ],
-      grokResultPromise
+      grokResultPromise,
+      cursorResultPromise,
+      zcodeResultPromise
     }
   }
 }
diff --git a/src/main/rate-limits/service/service-polling.ts b/src/main/rate-limits/service/service-polling.ts
index c861726cc52..402495080c2 100644
--- a/src/main/rate-limits/service/service-polling.ts
+++ b/src/main/rate-limits/service/service-polling.ts
@@ -78,7 +78,9 @@ export abstract class RateLimitServicePolling extends RateLimitServiceFetchQueue
       kimi: this.state.kimi,
       minimax: this.state.minimax,
       grok: this.state.grok,
-      antigravity: this.state.antigravity
+      antigravity: this.state.antigravity,
+      cursor: this.state.cursor,
+      zcode: this.state.zcode
     }
     return Object.entries(byProvider).map(([provider, limits]) => ({
       provider: provider as ActiveRateLimitProvider,
diff --git a/src/main/rate-limits/service/service-result-policy.ts b/src/main/rate-limits/service/service-result-policy.ts
index db00053fdcf..75f032159fa 100644
--- a/src/main/rate-limits/service/service-result-policy.ts
+++ b/src/main/rate-limits/service/service-result-policy.ts
@@ -83,15 +83,7 @@ export abstract class RateLimitServiceResultPolicy extends RateLimitServiceFetch
 
   protected withFetchingStatus(
     current: ProviderRateLimits | null,
-    provider:
-      | 'claude'
-      | 'codex'
-      | 'gemini'
-      | 'opencode-go'
-      | 'kimi'
-      | 'minimax'
-      | 'grok'
-      | 'antigravity'
+    provider: ActiveRateLimitProvider
   ): ProviderRateLimits {
     if (!current) {
       return {
diff --git a/src/main/rate-limits/service/service-sibling-provider-result.ts b/src/main/rate-limits/service/service-sibling-provider-result.ts
new file mode 100644
index 00000000000..ff5337c7f70
--- /dev/null
+++ b/src/main/rate-limits/service/service-sibling-provider-result.ts
@@ -0,0 +1,26 @@
+import type { ProviderRateLimits } from './service-types'
+
+export type SettledProviderResult =
+  | { status: 'fulfilled'; value: ProviderRateLimits }
+  | { status: 'rejected'; reason: unknown }
+
+/**
+ * Collapses a provider that resolves on its own promise (outside the main
+ * `Promise.allSettled` tuple) into a publishable snapshot.
+ */
+export function settleSiblingProviderResult(
+  provider: ProviderRateLimits['provider'],
+  settled: SettledProviderResult
+): ProviderRateLimits {
+  if (settled.status === 'fulfilled') {
+    return settled.value
+  }
+  return {
+    provider,
+    session: null,
+    weekly: null,
+    updatedAt: Date.now(),
+    error: settled.reason instanceof Error ? settled.reason.message : 'Unknown error',
+    status: 'error'
+  }
+}
diff --git a/src/main/rate-limits/service/service-state.ts b/src/main/rate-limits/service/service-state.ts
index 5cea2a26338..7af82c6c313 100644
--- a/src/main/rate-limits/service/service-state.ts
+++ b/src/main/rate-limits/service/service-state.ts
@@ -31,9 +31,14 @@ export abstract class RateLimitServiceState {
     kimi: null,
     antigravity: null,
     minimax: null,
-    grok: null
+    grok: null,
+    cursor: null,
+    zcode: null
   }
   protected grokAuthConfigured = readGrokAuthSession().status === 'ok'
+  // Why: the Cursor probe reads the macOS Keychain, so it cannot run synchronously
+  // at construction the way Grok's auth-file probe does; each fetch cycle sets it.
+  protected cursorAuthConfigured = false
   protected openCodeGoApiKeyConfigured = false
   protected pollInterval: number = DEFAULT_POLL_MS
   protected timer: ReturnType<typeof setInterval> | null = null
@@ -47,7 +52,9 @@ export abstract class RateLimitServiceState {
     kimi: 0,
     minimax: 0,
     grok: 0,
-    antigravity: 0
+    antigravity: 0,
+    cursor: 0,
+    zcode: 0
   }
   // Why: consecutive failures drive exponential backoff of the fast activation-retry lane; reset on any success/unavailable result.
   protected activeFailureStreakByProvider: Record<ActiveRateLimitProvider, number> = {
@@ -58,7 +65,9 @@ export abstract class RateLimitServiceState {
     kimi: 0,
     minimax: 0,
     grok: 0,
-    antigravity: 0
+    antigravity: 0,
+    cursor: 0,
+    zcode: 0
   }
   protected mainWindow: BrowserWindow | null = null
   protected detachWindowListeners: (() => void) | null = null
diff --git a/src/main/rate-limits/service/service-types.ts b/src/main/rate-limits/service/service-types.ts
index 92204150d9a..a3998c13abe 100644
--- a/src/main/rate-limits/service/service-types.ts
+++ b/src/main/rate-limits/service/service-types.ts
@@ -109,6 +109,8 @@ export type InternalRateLimitState = {
   antigravity: ProviderRateLimits | null
   minimax: ProviderRateLimits | null
   grok: ProviderRateLimits | null
+  cursor: ProviderRateLimits | null
+  zcode: ProviderRateLimits | null
 }
 
 export function normalizePollingInterval(ms: number): number {
diff --git a/src/main/rate-limits/zcode-usage-fetcher.test.ts b/src/main/rate-limits/zcode-usage-fetcher.test.ts
new file mode 100644
index 00000000000..b587d196be0
--- /dev/null
+++ b/src/main/rate-limits/zcode-usage-fetcher.test.ts
@@ -0,0 +1,292 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { fetchZcodeRateLimits } from './zcode-usage-fetcher'
+
+let dir: string
+let configPath: string
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'orca-zcode-usage-'))
+  configPath = join(dir, 'config.json')
+  vi.stubGlobal('fetch', vi.fn())
+  vi.useFakeTimers()
+  vi.setSystemTime(new Date('2026-08-12T06:00:00.000Z'))
+})
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+  vi.useRealTimers()
+  rmSync(dir, { recursive: true, force: true })
+})
+
+function writeConfig(overrides: Record<string, unknown> = {}): void {
+  mkdirSync(dir, { recursive: true })
+  writeFileSync(
+    configPath,
+    JSON.stringify({
+      model: { main: 'bigmodel-coding-plan/GLM-5.2' },
+      provider: {
+        other: { options: { apiKey: 'ignored', baseURL: 'https://example.com/v1' } },
+        'bigmodel-coding-plan': {
+          options: {
+            apiKey: 'test-secret',
+            baseURL: 'https://open.bigmodel.cn/api/anthropic'
+          }
+        }
+      },
+      ...overrides
+    })
+  )
+}
+
+describe('fetchZcodeRateLimits', () => {
+  it('returns unavailable without a supported Coding Plan credential', async () => {
+    writeFileSync(configPath, JSON.stringify({ provider: {} }))
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(result).toMatchObject({ provider: 'zcode', status: 'unavailable' })
+    expect(fetch).not.toHaveBeenCalled()
+  })
+
+  it('does not infer an account from the only configured provider without a selected model', async () => {
+    writeConfig({
+      model: {},
+      provider: {
+        zai: { options: { apiKey: 'sole-account', baseURL: 'https://api.z.ai/v1' } }
+      }
+    })
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(result.status).toBe('unavailable')
+    expect(fetch).not.toHaveBeenCalled()
+  })
+
+  it('queries the matching quota endpoint and maps rolling, weekly, and MCP limits', async () => {
+    writeConfig()
+    vi.mocked(fetch).mockResolvedValue(
+      new Response(
+        JSON.stringify({
+          success: true,
+          data: {
+            level: 'max',
+            limits: [
+              {
+                type: 'TIME_LIMIT',
+                unit: 5,
+                number: 1,
+                percentage: 3,
+                nextResetTime: 1_787_000_000_000
+              },
+              {
+                type: 'TOKENS_LIMIT',
+                unit: 6,
+                number: 1,
+                percentage: 44,
+                nextResetTime: 1_786_600_000_000
+              },
+              {
+                type: 'TOKENS_LIMIT',
+                unit: 3,
+                number: 5,
+                percentage: 12,
+                nextResetTime: 1_786_500_000_000
+              }
+            ]
+          }
+        })
+      )
+    )
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(fetch).toHaveBeenCalledWith(
+      'https://open.bigmodel.cn/api/monitor/usage/quota/limit',
+      expect.objectContaining({
+        method: 'GET',
+        redirect: 'error',
+        headers: expect.objectContaining({ Authorization: 'test-secret' })
+      })
+    )
+    expect(result).toMatchObject({ provider: 'zcode', status: 'ok', planType: 'max' })
+    expect(result.session).toEqual({
+      usedPercent: 12,
+      windowMinutes: 300,
+      resetsAt: 1_786_500_000_000,
+      resetDescription: null
+    })
+    expect(result.weekly?.usedPercent).toBe(44)
+    expect(result.monthly?.usedPercent).toBe(3)
+  })
+
+  it('uses CREDIT_LIMIT counts when the reported percentage is stale', async () => {
+    writeConfig()
+    vi.mocked(fetch).mockResolvedValue(
+      new Response(
+        JSON.stringify({
+          success: true,
+          code: 200,
+          data: {
+            limits: [
+              {
+                type: 'CREDIT_LIMIT',
+                unit: 3,
+                number: 5,
+                usage: 2_000,
+                currentValue: 500,
+                remaining: 1_500,
+                percentage: 1
+              },
+              {
+                type: 'CREDIT_LIMIT',
+                unit: 6,
+                number: 1,
+                usage: 10_000,
+                remaining: 8_000,
+                percentage: 0
+              }
+            ]
+          }
+        })
+      )
+    )
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(result.status).toBe('ok')
+    expect(result.session?.usedPercent).toBe(25)
+    expect(result.weekly?.usedPercent).toBe(20)
+    expect(result.monthly).toBeNull()
+  })
+
+  it('drops an implausible five-hour reset without discarding the quota value', async () => {
+    writeConfig()
+    vi.mocked(fetch).mockResolvedValue(
+      new Response(
+        JSON.stringify({
+          success: true,
+          data: {
+            limits: [
+              {
+                type: 'CREDIT_LIMIT',
+                unit: 3,
+                number: 5,
+                percentage: 25,
+                nextResetTime: Date.now() + 10 * 60 * 60_000
+              }
+            ]
+          }
+        })
+      )
+    )
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(result.session?.usedPercent).toBe(25)
+    expect(result.session?.resetsAt).toBeNull()
+  })
+
+  it('selects the legacy string model provider when several accounts are configured', async () => {
+    writeConfig({
+      model: 'zai/GLM-5.3',
+      provider: {
+        zai: { options: { apiKey: 'selected-key', baseURL: 'https://api.z.ai/v1' } },
+        bigmodel: { options: { apiKey: 'other-key', baseURL: 'https://open.bigmodel.cn/v1' } }
+      }
+    })
+    vi.mocked(fetch).mockResolvedValue(
+      new Response(
+        JSON.stringify({
+          success: true,
+          data: { limits: [{ type: 'CREDIT_LIMIT', unit: 3, number: 5, percentage: 20 }] }
+        })
+      )
+    )
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(result.status).toBe('ok')
+    expect(fetch).toHaveBeenCalledWith(
+      'https://api.z.ai/api/monitor/usage/quota/limit',
+      expect.objectContaining({
+        headers: expect.objectContaining({ Authorization: 'selected-key' })
+      })
+    )
+  })
+
+  it('does not substitute a different account when the selected provider lacks a key', async () => {
+    writeConfig({
+      model: { main: 'unconfigured/GLM-5.3' },
+      provider: { zai: { options: { apiKey: 'other-account', baseURL: 'https://api.z.ai/v1' } } }
+    })
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(result.status).toBe('unavailable')
+    expect(fetch).not.toHaveBeenCalled()
+  })
+
+  it('rejects a nonstandard HTTPS port before sending the key', async () => {
+    writeConfig({
+      provider: { zai: { options: { apiKey: 'secret', baseURL: 'https://api.z.ai:4444/v1' } } }
+    })
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(result.status).toBe('unavailable')
+    expect(fetch).not.toHaveBeenCalled()
+  })
+
+  it('supports the Z.AI endpoint without exposing credentials in errors', async () => {
+    writeConfig({
+      model: { main: 'zai/GLM-5.2' },
+      provider: {
+        zai: { options: { apiKey: 'never-log-me', baseURL: 'https://api.z.ai/api/anthropic' } }
+      }
+    })
+    vi.mocked(fetch).mockResolvedValue(new Response('denied', { status: 401 }))
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(fetch).toHaveBeenCalledWith(
+      'https://api.z.ai/api/monitor/usage/quota/limit',
+      expect.any(Object)
+    )
+    expect(result.status).toBe('error')
+    expect(result.error).toBe('ZCode quota request failed (401)')
+    expect(JSON.stringify(result)).not.toContain('never-log-me')
+  })
+
+  it('changes the non-secret account identity when the selected key changes', async () => {
+    writeConfig()
+    vi.mocked(fetch).mockResolvedValue(new Response('denied', { status: 401 }))
+
+    const first = await fetchZcodeRateLimits({ configPath })
+    writeConfig({
+      provider: {
+        'bigmodel-coding-plan': {
+          options: { apiKey: 'new-key', baseURL: 'https://open.bigmodel.cn/api/anthropic' }
+        }
+      }
+    })
+    const second = await fetchZcodeRateLimits({ configPath })
+
+    expect(first.usageMetadata?.authProvenance).toMatch(/^[a-f0-9]{64}$/)
+    expect(second.usageMetadata?.authProvenance).not.toBe(first.usageMetadata?.authProvenance)
+    expect(JSON.stringify(first)).not.toContain('test-secret')
+    expect(JSON.stringify(second)).not.toContain('new-key')
+  })
+
+  it('rejects malformed successful responses', async () => {
+    writeConfig()
+    vi.mocked(fetch).mockResolvedValue(new Response(JSON.stringify({ success: true, data: {} })))
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(result.status).toBe('error')
+    expect(result.usageMetadata?.failureKind).toBe('parse')
+  })
+})
diff --git a/src/main/rate-limits/zcode-usage-fetcher.ts b/src/main/rate-limits/zcode-usage-fetcher.ts
new file mode 100644
index 00000000000..852def603e3
--- /dev/null
+++ b/src/main/rate-limits/zcode-usage-fetcher.ts
@@ -0,0 +1,277 @@
+import { createHmac, randomBytes } from 'node:crypto'
+import { readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import { cancelUnreadResponseBody } from '../lib/unread-response-body'
+import type { ProviderRateLimits, RateLimitWindow } from '../../shared/rate-limit-types'
+
+const API_TIMEOUT_MS = 15_000
+const SUPPORTED_HOSTS = new Set(['api.z.ai', 'open.bigmodel.cn', 'dev.bigmodel.cn'])
+const CREDENTIAL_IDENTITY_KEY = randomBytes(32)
+
+type QuotaLimit = {
+  type?: unknown
+  unit?: unknown
+  number?: unknown
+  usage?: unknown
+  currentValue?: unknown
+  remaining?: unknown
+  percentage?: unknown
+  nextResetTime?: unknown
+}
+
+type ZcodeUsageCredentials = {
+  apiKey: string
+  quotaUrl: string
+  authProvenance: string
+}
+
+// Why readers and not casts: both JSON sources are outside our control — a user-edited
+// config file and a remote response — so their shape is a guess until something checks it.
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function readRecord(value: unknown): Record<string, unknown> | null {
+  return isRecord(value) ? value : null
+}
+
+function readMainProvider(model: unknown): string | null {
+  const name = typeof model === 'string' ? model : readRecord(model)?.main
+  if (typeof name !== 'string') {
+    return null
+  }
+  const delimiter = name.indexOf('/')
+  return delimiter > 0 && delimiter < name.length - 1 ? name.slice(0, delimiter) : null
+}
+
+function unavailable(error: string): ProviderRateLimits {
+  return {
+    provider: 'zcode',
+    session: null,
+    weekly: null,
+    monthly: null,
+    updatedAt: Date.now(),
+    error,
+    status: 'unavailable',
+    usageMetadata: { source: 'web', failureKind: 'missing-credentials' }
+  }
+}
+
+function failed(
+  error: string,
+  failureKind: 'network' | 'server' | 'parse',
+  authProvenance: string
+): ProviderRateLimits {
+  return {
+    provider: 'zcode',
+    session: null,
+    weekly: null,
+    monthly: null,
+    updatedAt: Date.now(),
+    error,
+    status: 'error',
+    usageMetadata: { source: 'web', failureKind, authProvenance }
+  }
+}
+
+function readCredentials(configPath: string): ZcodeUsageCredentials | null {
+  let config: Record<string, unknown> | null
+  try {
+    config = readRecord(JSON.parse(readFileSync(configPath, 'utf8')))
+  } catch {
+    return null
+  }
+
+  if (!config) {
+    return null
+  }
+  // A quota from another configured account must never appear as the selected model's quota.
+  const mainProvider = readMainProvider(config.model)
+  if (!mainProvider) {
+    return null
+  }
+  const options = readRecord(readRecord(readRecord(config.provider)?.[mainProvider])?.options)
+  const apiKey = options?.apiKey
+  const baseURL = options?.baseURL
+  if (
+    typeof apiKey !== 'string' ||
+    !apiKey.trim() ||
+    /[\r\n]/.test(apiKey) ||
+    typeof baseURL !== 'string'
+  ) {
+    return null
+  }
+  try {
+    const parsed = new URL(baseURL)
+    if (
+      parsed.protocol !== 'https:' ||
+      !SUPPORTED_HOSTS.has(parsed.hostname) ||
+      (parsed.port !== '' && parsed.port !== '443')
+    ) {
+      return null
+    }
+    return {
+      apiKey: apiKey.trim(),
+      quotaUrl: `${parsed.origin}/api/monitor/usage/quota/limit`,
+      authProvenance: createHmac('sha256', CREDENTIAL_IDENTITY_KEY)
+        .update(JSON.stringify([mainProvider, parsed.origin, apiKey.trim()]))
+        .digest('hex')
+    }
+  } catch {
+    return null
+  }
+}
+
+function asNumber(value: unknown): number | null {
+  return typeof value === 'number' && Number.isFinite(value) ? value : null
+}
+
+function asUsedPercent(limit: QuotaLimit): number | null {
+  const total = asNumber(limit.usage)
+  if (total !== null && total > 0) {
+    const current = asNumber(limit.currentValue)
+    const remaining = asNumber(limit.remaining)
+    if (current !== null || remaining !== null) {
+      const used = current ?? total - (remaining ?? 0)
+      return Math.min(100, Math.max(0, (used / total) * 100))
+    }
+  }
+  const reported = asNumber(limit.percentage)
+  return reported === null ? null : Math.min(100, Math.max(0, reported))
+}
+
+function asResetTime(value: unknown): number | null {
+  return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : null
+}
+
+function asWindowMinutes(limit: QuotaLimit): number | null {
+  if (limit.type === 'TIME_LIMIT' && limit.unit === 5 && limit.number === 1) {
+    // Z.ai's monthly MCP marker is encoded as one minute.
+    return 30 * 24 * 60
+  }
+  const multipliers: Record<number, number> = { 1: 1440, 3: 60, 5: 1, 6: 10080 }
+  const unit = asNumber(limit.unit)
+  const count = asNumber(limit.number)
+  if (unit === null || count === null || !Number.isInteger(count) || count <= 0) {
+    return null
+  }
+  const multiplier = multipliers[unit]
+  return multiplier ? count * multiplier : null
+}
+
+function asWindow(limit: QuotaLimit | undefined): RateLimitWindow | null {
+  if (!limit) {
+    return null
+  }
+  const usedPercent = asUsedPercent(limit)
+  const windowMinutes = asWindowMinutes(limit)
+  if (usedPercent === null || windowMinutes === null) {
+    return null
+  }
+  const reset = asResetTime(limit.nextResetTime)
+  return {
+    usedPercent,
+    windowMinutes,
+    resetsAt:
+      windowMinutes === 300 && reset !== null && reset > Date.now() + 301 * 60_000 ? null : reset,
+    resetDescription: null
+  }
+}
+
+export async function fetchZcodeRateLimits(
+  options: {
+    configPath?: string
+    signal?: AbortSignal
+  } = {}
+): Promise<ProviderRateLimits> {
+  const configPath = options.configPath ?? join(homedir(), '.zcode', 'cli', 'config.json')
+  const credentials = readCredentials(configPath)
+  if (!credentials) {
+    return unavailable('ZCode Coding Plan credentials are not configured')
+  }
+
+  let response: Response
+  try {
+    const signal = options.signal
+      ? AbortSignal.any([options.signal, AbortSignal.timeout(API_TIMEOUT_MS)])
+      : AbortSignal.timeout(API_TIMEOUT_MS)
+    response = await fetch(credentials.quotaUrl, {
+      method: 'GET',
+      redirect: 'error',
+      headers: {
+        Authorization: credentials.apiKey,
+        'Accept-Language': 'en-US,en',
+        'Content-Type': 'application/json'
+      },
+      signal
+    })
+  } catch (error) {
+    return failed(
+      error instanceof Error ? error.message : 'ZCode quota request failed',
+      'network',
+      credentials.authProvenance
+    )
+  }
+
+  if (!response.ok) {
+    await cancelUnreadResponseBody(response)
+    return failed(
+      `ZCode quota request failed (${response.status})`,
+      'server',
+      credentials.authProvenance
+    )
+  }
+
+  let payload: Record<string, unknown> | null
+  try {
+    payload = readRecord(await response.json())
+  } catch {
+    return failed('Could not parse ZCode quota response', 'parse', credentials.authProvenance)
+  }
+  const data = readRecord(payload?.data)
+  const code = payload?.code
+  const reported = data?.limits
+  if (
+    payload?.success !== true ||
+    (code !== undefined && code !== 0 && code !== 200) ||
+    !Array.isArray(reported)
+  ) {
+    const msg = payload?.msg
+    const message = typeof msg === 'string' ? msg : 'Invalid ZCode quota response'
+    return failed(message, 'parse', credentials.authProvenance)
+  }
+
+  const limits = reported.filter((value): value is QuotaLimit => isRecord(value))
+  const planLimits = limits
+    .filter((limit) => limit.type === 'TOKENS_LIMIT' || limit.type === 'CREDIT_LIMIT')
+    .map(asWindow)
+    .filter((limit): limit is RateLimitWindow => limit !== null)
+    .sort((left, right) => left.windowMinutes - right.windowMinutes)
+  const session = planLimits.find((limit) => limit.windowMinutes === 300) ?? null
+  const weekly = planLimits.find((limit) => limit.windowMinutes === 10080) ?? null
+  const monthly = asWindow(limits.find((limit) => limit.type === 'TIME_LIMIT'))
+  if (!session && !weekly && !monthly) {
+    return failed(
+      'ZCode quota response contained no usable limits',
+      'parse',
+      credentials.authProvenance
+    )
+  }
+
+  return {
+    provider: 'zcode',
+    session,
+    weekly,
+    monthly,
+    planType: typeof data?.level === 'string' ? data.level : null,
+    updatedAt: Date.now(),
+    error: null,
+    status: 'ok',
+    usageMetadata: {
+      source: 'web',
+      credentialSource: configPath,
+      authProvenance: credentials.authProvenance
+    }
+  }
+}
diff --git a/src/main/remote-agent-trust-presets.test.ts b/src/main/remote-agent-trust-presets.test.ts
deleted file mode 100644
index d1ff9ee24ca..00000000000
--- a/src/main/remote-agent-trust-presets.test.ts
+++ /dev/null
@@ -1,162 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-
-const mocks = vi.hoisted(() => ({
-  getActiveMultiplexer: vi.fn(),
-  getSshFilesystemProvider: vi.fn()
-}))
-
-vi.mock('./ssh/ssh-target-registry', () => ({
-  getActiveMultiplexer: mocks.getActiveMultiplexer
-}))
-
-vi.mock('./providers/ssh-filesystem-dispatch', () => ({
-  getSshFilesystemProvider: mocks.getSshFilesystemProvider
-}))
-
-const { markRemoteAgentWorkspaceTrusted } = await import('./remote-agent-trust-presets')
-
-function makeFsProvider(overrides: Record<string, unknown> = {}) {
-  return {
-    realpath: vi.fn(async (path: string) => `/real${path}`),
-    readFile: vi.fn(async () => ({ content: '', isBinary: false })),
-    createDir: vi.fn(async () => undefined),
-    writeFile: vi.fn(async () => undefined),
-    stat: vi.fn(async () => {
-      throw new Error('missing')
-    }),
-    ...overrides
-  }
-}
-
-describe('markRemoteAgentWorkspaceTrusted', () => {
-  beforeEach(() => {
-    vi.clearAllMocks()
-    mocks.getActiveMultiplexer.mockReturnValue({
-      request: vi.fn(async () => ({ resolvedPath: '/home/u/' }))
-    })
-  })
-
-  it('writes Codex trust to the remote home and canonicalized workspace path', async () => {
-    const fsProvider = makeFsProvider()
-    mocks.getSshFilesystemProvider.mockReturnValue(fsProvider)
-
-    await markRemoteAgentWorkspaceTrusted({
-      preset: 'codex',
-      connectionId: 'ssh-1',
-      workspacePath: '/repo/worktree'
-    })
-
-    expect(mocks.getActiveMultiplexer).toHaveBeenCalledWith('ssh-1')
-    expect(fsProvider.realpath).toHaveBeenCalledWith('/repo/worktree')
-    expect(fsProvider.createDir).toHaveBeenCalledWith('/home/u/.codex')
-    expect(fsProvider.writeFile).toHaveBeenCalledWith(
-      '/home/u/.codex/config.toml',
-      expect.stringContaining('[projects."/real/repo/worktree"]')
-    )
-  })
-
-  it('writes Codex trust when the remote home is a Windows absolute path', async () => {
-    const fsProvider = makeFsProvider({
-      realpath: vi.fn(async () => 'C:/Users/alice/platform')
-    })
-    mocks.getActiveMultiplexer.mockReturnValue({
-      request: vi.fn(async () => ({ resolvedPath: 'C:\\Users\\alice\\' }))
-    })
-    mocks.getSshFilesystemProvider.mockReturnValue(fsProvider)
-
-    await markRemoteAgentWorkspaceTrusted({
-      preset: 'codex',
-      connectionId: 'ssh-windows',
-      workspacePath: 'C:\\Users\\alice\\platform'
-    })
-
-    expect(fsProvider.createDir).toHaveBeenCalledWith('C:/Users/alice/.codex')
-    expect(fsProvider.writeFile).toHaveBeenCalledWith(
-      'C:/Users/alice/.codex/config.toml',
-      expect.stringContaining('[projects."C:/Users/alice/platform"]')
-    )
-  })
-
-  it('writes Cursor trust marker on the remote host', async () => {
-    const fsProvider = makeFsProvider()
-    mocks.getSshFilesystemProvider.mockReturnValue(fsProvider)
-
-    await markRemoteAgentWorkspaceTrusted({
-      preset: 'cursor',
-      connectionId: 'ssh-1',
-      workspacePath: '/repo/worktree'
-    })
-
-    expect(fsProvider.createDir).toHaveBeenCalledWith('/home/u/.cursor/projects/real-repo-worktree')
-    expect(fsProvider.writeFile).toHaveBeenCalledWith(
-      '/home/u/.cursor/projects/real-repo-worktree/.workspace-trusted',
-      expect.stringContaining('"workspacePath": "/real/repo/worktree"')
-    )
-  })
-
-  it('sanitizes Windows path characters in remote Cursor trust marker paths', async () => {
-    const fsProvider = makeFsProvider({
-      realpath: vi.fn(async () => 'C:/Users/alice/platform')
-    })
-    mocks.getActiveMultiplexer.mockReturnValue({
-      request: vi.fn(async () => ({ resolvedPath: 'C:/Users/alice/' }))
-    })
-    mocks.getSshFilesystemProvider.mockReturnValue(fsProvider)
-
-    await markRemoteAgentWorkspaceTrusted({
-      preset: 'cursor',
-      connectionId: 'ssh-windows',
-      workspacePath: 'C:\\Users\\alice\\platform'
-    })
-
-    expect(fsProvider.createDir).toHaveBeenCalledWith(
-      'C:/Users/alice/.cursor/projects/C-Users-alice-platform'
-    )
-    expect(fsProvider.writeFile).toHaveBeenCalledWith(
-      'C:/Users/alice/.cursor/projects/C-Users-alice-platform/.workspace-trusted',
-      expect.stringContaining('"workspacePath": "C:/Users/alice/platform"')
-    )
-  })
-
-  it('appends Copilot trusted folder remotely without clobbering config keys', async () => {
-    const writeFile = vi.fn(async (_filePath: string, _content: string) => undefined)
-    const fsProvider = makeFsProvider({
-      readFile: vi.fn(async () => ({
-        content: JSON.stringify({ firstLaunchAt: '2026-01-01', trustedFolders: ['/old'] }),
-        isBinary: false
-      })),
-      writeFile
-    })
-    mocks.getSshFilesystemProvider.mockReturnValue(fsProvider)
-
-    await markRemoteAgentWorkspaceTrusted({
-      preset: 'copilot',
-      connectionId: 'ssh-1',
-      workspacePath: '/repo/worktree'
-    })
-
-    expect(fsProvider.createDir).toHaveBeenCalledWith('/home/u/.copilot')
-    const written = writeFile.mock.calls[0]?.[1]
-    expect(typeof written).toBe('string')
-    expect(JSON.parse(written as string)).toEqual({
-      firstLaunchAt: '2026-01-01',
-      trustedFolders: ['/old', '/real/repo/worktree']
-    })
-  })
-
-  it('does nothing when the SSH home cannot be resolved safely', async () => {
-    const fsProvider = makeFsProvider()
-    mocks.getActiveMultiplexer.mockReturnValue({
-      request: vi.fn(async () => ({ resolvedPath: 'relative/home' }))
-    })
-    mocks.getSshFilesystemProvider.mockReturnValue(fsProvider)
-
-    await markRemoteAgentWorkspaceTrusted({
-      preset: 'codex',
-      connectionId: 'ssh-1',
-      workspacePath: '/repo/worktree'
-    })
-
-    expect(fsProvider.writeFile).not.toHaveBeenCalled()
-  })
-})
diff --git a/src/main/remote-agent-trust-presets.ts b/src/main/remote-agent-trust-presets.ts
deleted file mode 100644
index a9ccb382c09..00000000000
--- a/src/main/remote-agent-trust-presets.ts
+++ /dev/null
@@ -1,154 +0,0 @@
-import type { AgentTrustPreset } from './agent-trust-presets'
-import { upsertProjectTrustLevelInContent } from './codex/config-toml-trust'
-import { getActiveMultiplexer } from './ssh/ssh-target-registry'
-import { getSshFilesystemProvider } from './providers/ssh-filesystem-dispatch'
-import type { IFilesystemProvider } from './providers/types'
-import {
-  isWindowsAbsolutePathLike,
-  normalizeRuntimePathSeparators
-} from '../shared/cross-platform-path'
-
-export async function markRemoteAgentWorkspaceTrusted(args: {
-  preset: AgentTrustPreset
-  connectionId: string
-  workspacePath: string
-}): Promise<void> {
-  const home = await resolveRemoteHome(args.connectionId)
-  const fsProvider = getSshFilesystemProvider(args.connectionId)
-  if (!home || !fsProvider) {
-    return
-  }
-
-  const workspacePath = await canonicalizeRemoteWorkspacePath(fsProvider, args.workspacePath)
-  if (args.preset === 'codex') {
-    await markRemoteCodexProjectTrusted(fsProvider, home, workspacePath)
-  } else if (args.preset === 'cursor') {
-    await markRemoteCursorWorkspaceTrusted(fsProvider, home, workspacePath)
-  } else if (args.preset === 'copilot') {
-    await markRemoteCopilotFolderTrusted(fsProvider, home, workspacePath)
-  }
-  // KNOWN GAP: 'antigravity' is deliberately absent. The local preset writes
-  // ~/.gemini/antigravity-cli/settings.json, and the remote equivalent has not been verified
-  // against an SSH execution host, so an agy worker launched over SSH still raises its
-  // first-launch trust prompt and will stall at agent_readiness. Falling through silently
-  // matches the pre-existing behaviour for agy; it is recorded here rather than left as an
-  // unexplained omission. Mirror markRemoteCopilotFolderTrusted once it can be tested.
-}
-
-async function resolveRemoteHome(connectionId: string): Promise<string | null> {
-  const mux = getActiveMultiplexer(connectionId)
-  if (!mux || mux.isDisposed?.()) {
-    return null
-  }
-  const result = (await mux.request('session.resolveHome', { path: '~' })) as {
-    resolvedPath?: unknown
-  }
-  const home =
-    typeof result.resolvedPath === 'string'
-      ? normalizeRuntimePathSeparators(result.resolvedPath.trim())
-      : ''
-  return home &&
-    (home.startsWith('/') || isWindowsAbsolutePathLike(home)) &&
-    !hasRemotePathControlCharacter(home)
-    ? home.replace(/\/$/, '')
-    : null
-}
-
-function hasRemotePathControlCharacter(value: string): boolean {
-  return value.includes(String.fromCharCode(0)) || value.includes('\r') || value.includes('\n')
-}
-
-async function canonicalizeRemoteWorkspacePath(
-  fsProvider: IFilesystemProvider,
-  workspacePath: string
-): Promise<string> {
-  try {
-    return await fsProvider.realpath(workspacePath)
-  } catch {
-    return workspacePath
-  }
-}
-
-async function readRemoteTextFile(
-  fsProvider: IFilesystemProvider,
-  filePath: string
-): Promise<string> {
-  try {
-    const result = await fsProvider.readFile(filePath)
-    return result.isBinary ? '' : result.content
-  } catch {
-    return ''
-  }
-}
-
-async function markRemoteCodexProjectTrusted(
-  fsProvider: IFilesystemProvider,
-  remoteHome: string,
-  workspacePath: string
-): Promise<void> {
-  const codexDir = `${remoteHome}/.codex`
-  const configPath = `${codexDir}/config.toml`
-  const existing = await readRemoteTextFile(fsProvider, configPath)
-  const updated = upsertProjectTrustLevelInContent(existing, workspacePath, 'trusted', {
-    // Why: workspacePath was resolved by the remote filesystem provider; local
-    // realpath would canonicalize the wrong machine on SSH.
-    alreadyCanonical: true
-  })
-  if (updated === existing) {
-    return
-  }
-  await fsProvider.createDir(codexDir)
-  await fsProvider.writeFile(configPath, updated)
-}
-
-async function markRemoteCursorWorkspaceTrusted(
-  fsProvider: IFilesystemProvider,
-  remoteHome: string,
-  workspacePath: string
-): Promise<void> {
-  const slug = workspacePath.replace(/^[\\/]+/, '').replace(/[\\/:*?"<>|]+/g, '-')
-  if (!slug) {
-    return
-  }
-  const trustDir = `${remoteHome}/.cursor/projects/${slug}`
-  const trustFile = `${trustDir}/.workspace-trusted`
-  try {
-    await fsProvider.stat(trustFile)
-    return
-  } catch {
-    // Missing marker: write the same shape the local trust preset writes.
-  }
-  await fsProvider.createDir(trustDir)
-  await fsProvider.writeFile(
-    trustFile,
-    `${JSON.stringify({ trustedAt: new Date().toISOString(), workspacePath }, null, 2)}\n`
-  )
-}
-
-async function markRemoteCopilotFolderTrusted(
-  fsProvider: IFilesystemProvider,
-  remoteHome: string,
-  workspacePath: string
-): Promise<void> {
-  const configDir = `${remoteHome}/.copilot`
-  const configPath = `${configDir}/config.json`
-  const raw = await readRemoteTextFile(fsProvider, configPath)
-  let config: Record<string, unknown> = {}
-  if (raw.trim()) {
-    try {
-      const parsed = JSON.parse(raw)
-      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
-        config = parsed as Record<string, unknown>
-      }
-    } catch {
-      return
-    }
-  }
-  const existing = Array.isArray(config.trustedFolders) ? (config.trustedFolders as unknown[]) : []
-  if (existing.includes(workspacePath)) {
-    return
-  }
-  config.trustedFolders = [...existing.filter((entry) => typeof entry === 'string'), workspacePath]
-  await fsProvider.createDir(configDir)
-  await fsProvider.writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`)
-}
diff --git a/src/main/repo-execution-host.ts b/src/main/repo-execution-host.ts
new file mode 100644
index 00000000000..dae5b0e48d4
--- /dev/null
+++ b/src/main/repo-execution-host.ts
@@ -0,0 +1,21 @@
+import {
+  getRepoExecutionHostId,
+  getSshTargetIdForExecutionHost,
+  LOCAL_EXECUTION_HOST_ID,
+  type ExecutionHostId
+} from '../shared/execution-host'
+import type { Repo } from '../shared/repo-types'
+
+/** Only for rows from this process's Store: runtime stamps address files registered here. */
+export function getStoredRepoExecutionHostId(
+  repo: Pick<Repo, 'connectionId' | 'executionHostId'>
+): ExecutionHostId {
+  const hostId = getRepoExecutionHostId(repo)
+  return getSshTargetIdForExecutionHost(hostId) ? hostId : LOCAL_EXECUTION_HOST_ID
+}
+
+export function getStoredRepoSshConnectionId(
+  repo: Pick<Repo, 'connectionId' | 'executionHostId'>
+): string | null {
+  return getSshTargetIdForExecutionHost(getStoredRepoExecutionHostId(repo))
+}
diff --git a/src/main/repo-git-remote-avatar-refresh.test.ts b/src/main/repo-git-remote-avatar-refresh.test.ts
new file mode 100644
index 00000000000..a787f5501bf
--- /dev/null
+++ b/src/main/repo-git-remote-avatar-refresh.test.ts
@@ -0,0 +1,339 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import { getRepoExecutionHostId, type ExecutionHostId } from '../shared/execution-host'
+import { deriveGitRemoteIdentity } from '../shared/git-remote-identity'
+import { projectHostSetupProjectionFromRepos } from '../shared/project-host-setup-projection'
+import { githubAvatarIcon, type RepoIcon } from '../shared/repo-icon'
+import type { Repo } from '../shared/repo-types'
+import { probeGitRemoteIdentity, type GitRemoteIdentityProbe } from './repo-git-remote-identity'
+import {
+  enrichMissingRepoGitRemoteIdentities,
+  flushRepoGitRemoteIdentityEnrichmentForTests,
+  resetRepoGitRemoteIdentityEnrichmentForTests
+} from './repo-git-remote-identity-enrichment'
+
+vi.mock('./repo-git-remote-identity', () => ({ probeGitRemoteIdentity: vi.fn() }))
+
+function identity(remote = 'https://github.com/org-b/app.git') {
+  const parsed = deriveGitRemoteIdentity(`origin\t${remote} (fetch)`)
+  if (!parsed) {
+    throw new Error('Fixture remote must parse')
+  }
+  return parsed
+}
+
+function repo(overrides: Partial<Repo> = {}): Repo {
+  return {
+    id: 'app',
+    path: '/workspace/app',
+    displayName: 'app',
+    kind: 'git',
+    badgeColor: '',
+    addedAt: 1,
+    upstream: null,
+    gitRemoteIdentity: identity(),
+    repoIcon: githubAvatarIcon({ owner: 'owner-a', repo: 'app' }),
+    ...overrides
+  }
+}
+
+function storeFor(repos: Repo[]) {
+  const getRepo = (id: string, hostId?: ExecutionHostId) =>
+    repos.find((row) => row.id === id && (!hostId || getRepoExecutionHostId(row) === hostId))
+  const updateRepo = vi.fn((id: string, updates: Partial<Repo>, hostId?: ExecutionHostId) => {
+    const current = getRepo(id, hostId)
+    if (!current) {
+      return null
+    }
+    Object.assign(current, updates)
+    return current
+  })
+  return { getRepos: () => repos, getRepo, updateRepo }
+}
+
+async function sweep(store: ReturnType<typeof storeFor>, onChanged = vi.fn()) {
+  enrichMissingRepoGitRemoteIdentities(store, { onChanged })
+  for (let i = 0; i < 8; i++) {
+    await flushRepoGitRemoteIdentityEnrichmentForTests()
+  }
+}
+
+async function refresh(store: ReturnType<typeof storeFor>, onChanged = vi.fn()) {
+  vi.useFakeTimers()
+  vi.setSystemTime(1_000)
+  await sweep(store, onChanged)
+  expect(probeGitRemoteIdentity).not.toHaveBeenCalled()
+  vi.setSystemTime(301_001)
+  await sweep(store, onChanged)
+}
+
+afterEach(() => {
+  resetRepoGitRemoteIdentityEnrichmentForTests()
+  vi.useRealTimers()
+  vi.clearAllMocks()
+})
+
+it.each(['already-current', 'changed'])(
+  'repairs a stale avatar when the canonical key is %s',
+  async (mode) => {
+    const local = repo({
+      gitRemoteIdentity:
+        mode === 'changed' ? identity('https://github.com/owner-a/app.git') : identity()
+    })
+    const peer = repo({
+      id: 'peer',
+      path: '/workspace/app',
+      connectionId: 'build',
+      repoIcon: githubAvatarIcon({ owner: 'org-b', repo: 'app' })
+    })
+    const store = storeFor([local, peer])
+    const onChanged = vi.fn()
+    vi.mocked(probeGitRemoteIdentity).mockResolvedValue({
+      status: 'resolved',
+      identity: identity()
+    })
+
+    expect(projectHostSetupProjectionFromRepos(store.getRepos()).projects).toHaveLength(2)
+    await refresh(store, onChanged)
+
+    expect(local.repoIcon).toEqual(githubAvatarIcon({ owner: 'org-b', repo: 'app' }))
+    expect(store.updateRepo).toHaveBeenCalledTimes(1)
+    expect(onChanged).toHaveBeenCalledTimes(1)
+    const projected = projectHostSetupProjectionFromRepos(store.getRepos())
+    expect(projected.projects.map(({ id }) => id)).toEqual(['github:org-b/app'])
+    expect(projected.setups.map(({ hostId, path }) => ({ hostId, path }))).toEqual([
+      { hostId: 'local', path: '/workspace/app' },
+      { hostId: 'ssh:build', path: '/workspace/app' }
+    ])
+    vi.setSystemTime(301_001 + 6 * 60 * 60 * 1000)
+    await sweep(store, onChanged)
+    expect(store.updateRepo).toHaveBeenCalledTimes(1)
+  }
+)
+
+it.each([
+  'https://github.company.test:8443/org-b/app.git',
+  'ssh://git@ssh.github.com:443/org-b/app.git'
+])('preserves GitHub endpoint identity for %s', async (remote) => {
+  const row = repo({ gitRemoteIdentity: identity(remote) })
+  const store = storeFor([row])
+  vi.mocked(probeGitRemoteIdentity).mockResolvedValue({
+    status: 'resolved',
+    identity: identity(remote)
+  })
+  await refresh(store)
+  expect(projectHostSetupProjectionFromRepos([row]).projects[0]?.id).toBe(
+    remote.includes('company') ? 'github:github.company.test:8443/org-b/app' : 'github:org-b/app'
+  )
+})
+
+it.each([
+  'git@github-work:org/app.git',
+  'ssh://git@ghe-work/org/app.git',
+  'https://gitlab.com/team/sub/app.git',
+  'https://forgejo.test/team/app.git',
+  'https://gitea.test/team/app.git',
+  'https://code.company.test/team/app.git'
+])('leaves provider metadata intact for unresolved or other-provider remote %s', async (remote) => {
+  const row = repo({ gitRemoteIdentity: identity(remote) })
+  const original = row.repoIcon
+  const store = storeFor([row])
+  vi.mocked(probeGitRemoteIdentity).mockResolvedValue({
+    status: 'resolved',
+    identity: identity(remote)
+  })
+  await refresh(store)
+  expect(row.repoIcon).toBe(original)
+  expect(store.updateRepo).not.toHaveBeenCalled()
+})
+
+const customIcons: (RepoIcon | null | undefined)[] = [
+  { type: 'emoji', emoji: '🐙' },
+  { type: 'lucide', name: 'Folder' },
+  { type: 'image', source: 'upload', src: 'data:image/png;base64,fixture', label: 'custom' },
+  { type: 'image', source: 'file', src: 'data:image/png;base64,fixture', label: 'custom' },
+  { type: 'image', source: 'favicon', src: 'https://website.test/favicon.png', label: 'custom' },
+  null,
+  undefined
+]
+
+it.each(customIcons)('preserves custom or cleared icon %j', async (repoIcon) => {
+  const row = repo({ repoIcon })
+  const store = storeFor([row])
+  vi.mocked(probeGitRemoteIdentity).mockResolvedValue({ status: 'resolved', identity: identity() })
+  await refresh(store)
+  expect(row.repoIcon).toBe(repoIcon)
+  expect(store.updateRepo).not.toHaveBeenCalled()
+})
+
+it('preserves explicit upstream even when the remote disagrees', async () => {
+  const row = repo({ upstream: { owner: 'parent', repo: 'app', host: 'github.parent.test' } })
+  const original = row.repoIcon
+  const store = storeFor([row])
+  vi.mocked(probeGitRemoteIdentity).mockResolvedValue({ status: 'resolved', identity: identity() })
+  await refresh(store)
+  expect(row.repoIcon).toBe(original)
+  expect(projectHostSetupProjectionFromRepos([row]).projects[0]?.id).toBe(
+    'github:github.parent.test/parent/app'
+  )
+  expect(store.updateRepo).not.toHaveBeenCalled()
+})
+
+it.each(['unavailable', 'no-remote'] as const)(
+  'preserves the last avatar when a refresh is %s',
+  async (status) => {
+    const row = repo()
+    const original = row.repoIcon
+    const store = storeFor([row])
+    vi.mocked(probeGitRemoteIdentity).mockResolvedValue({ status })
+    await refresh(store)
+    expect(row.repoIcon).toBe(original)
+    expect(store.updateRepo).not.toHaveBeenCalled()
+  }
+)
+
+it.each(['same', 'different', 'missing'] as const)(
+  'never probes or writes peer-owned metadata when identity is %s',
+  async (kind) => {
+    const row = repo({
+      executionHostId: 'runtime:peer',
+      connectionId: 'nested',
+      gitRemoteIdentity:
+        kind === 'missing'
+          ? undefined
+          : identity(kind === 'different' ? 'https://github.com/peer-only/app.git' : undefined)
+    })
+    const originalIcon = row.repoIcon
+    const originalIdentity = row.gitRemoteIdentity
+    const store = storeFor([row])
+    vi.mocked(probeGitRemoteIdentity).mockResolvedValue({
+      status: 'resolved',
+      identity: identity()
+    })
+    await (kind === 'missing' ? sweep(store) : refresh(store))
+    expect(probeGitRemoteIdentity).not.toHaveBeenCalled()
+    expect(row.repoIcon).toBe(originalIcon)
+    expect(row.gitRemoteIdentity).toBe(originalIdentity)
+    expect(store.updateRepo).not.toHaveBeenCalled()
+  }
+)
+
+it('repairs only the matching owner when repo IDs and paths collide across hosts', async () => {
+  const local = repo({ repoIcon: githubAvatarIcon({ owner: 'org-b', repo: 'app' }) })
+  const ssh = repo({ executionHostId: 'ssh:build' })
+  const store = storeFor([local, ssh])
+  vi.mocked(probeGitRemoteIdentity).mockResolvedValue({ status: 'resolved', identity: identity() })
+  await refresh(store)
+  expect(store.updateRepo).toHaveBeenCalledWith(
+    'app',
+    { repoIcon: githubAvatarIcon({ owner: 'org-b', repo: 'app' }) },
+    'ssh:build'
+  )
+  expect(projectHostSetupProjectionFromRepos([local, ssh]).projects).toHaveLength(1)
+})
+
+it('keeps local metadata writes scoped when a same-id ssh:build row comes first', async () => {
+  const foreignIdentity = identity('https://github.com/foreign/app.git')
+  const foreignIcon = githubAvatarIcon({ owner: 'foreign', repo: 'app' })
+  const foreign = repo({
+    executionHostId: 'ssh:build',
+    gitRemoteIdentity: foreignIdentity,
+    repoIcon: foreignIcon
+  })
+  const local = repo({ gitRemoteIdentity: identity('https://github.com/old-local/app.git') })
+  const store = storeFor([foreign, local])
+  vi.mocked(probeGitRemoteIdentity).mockImplementation(async (_path, probeHostId) => ({
+    status: 'resolved',
+    identity: probeHostId === 'local' ? identity() : foreignIdentity
+  }))
+  await refresh(store)
+  expect(foreign.gitRemoteIdentity).toBe(foreignIdentity)
+  expect(foreign.repoIcon).toBe(foreignIcon)
+  expect(local.gitRemoteIdentity).toEqual(identity())
+  expect(local.repoIcon).toEqual(githubAvatarIcon({ owner: 'org-b', repo: 'app' }))
+  expect(store.updateRepo).toHaveBeenCalledExactlyOnceWith(
+    'app',
+    { gitRemoteIdentity: identity(), repoIcon: local.repoIcon },
+    'local'
+  )
+})
+
+// Why this row is repaired where the `ssh:build` one above is not: a `runtime:` stamp reaches this
+// store only from a client addressing *this* host, so the files are here and `local` is the only
+// host that can answer for them (`getStoredRepoExecutionHostId`). Both rows are written, each
+// addressed by its own stamp, because that is what the store matches a write against.
+it('repairs a same-id runtime-addressed row under its own stamp', async () => {
+  const runtimeRow = repo({
+    executionHostId: 'runtime:env-a',
+    gitRemoteIdentity: identity('https://github.com/old-runtime/app.git'),
+    repoIcon: githubAvatarIcon({ owner: 'old-runtime', repo: 'app' })
+  })
+  const local = repo({ gitRemoteIdentity: identity('https://github.com/old-local/app.git') })
+  const store = storeFor([runtimeRow, local])
+  vi.mocked(probeGitRemoteIdentity).mockResolvedValue({ status: 'resolved', identity: identity() })
+  await refresh(store)
+  expect(probeGitRemoteIdentity).toHaveBeenCalledWith(
+    '/workspace/app',
+    'local',
+    expect.objectContaining({ signal: expect.any(AbortSignal) })
+  )
+  const repaired = {
+    gitRemoteIdentity: identity(),
+    repoIcon: githubAvatarIcon({ owner: 'org-b', repo: 'app' })
+  }
+  expect(runtimeRow).toMatchObject(repaired)
+  expect(local).toMatchObject(repaired)
+  expect(store.updateRepo).toHaveBeenCalledWith('app', repaired, 'runtime:env-a')
+  expect(store.updateRepo).toHaveBeenCalledWith('app', repaired, 'local')
+})
+
+it('does not write after a pending local probe becomes peer-owned', async () => {
+  let answer: ((value: GitRemoteIdentityProbe) => void) | undefined
+  const row = repo({ gitRemoteIdentity: undefined })
+  const originalIcon = row.repoIcon
+  const store = storeFor([row])
+  vi.mocked(probeGitRemoteIdentity).mockImplementation(
+    () =>
+      new Promise((resolve) => {
+        answer = resolve
+      })
+  )
+  enrichMissingRepoGitRemoteIdentities(store)
+  row.executionHostId = 'runtime:peer'
+  if (!answer) {
+    throw new Error('Expected pending probe')
+  }
+  answer({ status: 'resolved', identity: identity() })
+  await flushRepoGitRemoteIdentityEnrichmentForTests()
+  expect(row.gitRemoteIdentity).toBeUndefined()
+  expect(row.repoIcon).toBe(originalIcon)
+  expect(store.updateRepo).not.toHaveBeenCalled()
+})
+
+it('does not overwrite a custom icon selected while the probe is pending', async () => {
+  let answer: ((value: GitRemoteIdentityProbe) => void) | undefined
+  const row = repo({ gitRemoteIdentity: undefined })
+  const store = storeFor([row])
+  vi.mocked(probeGitRemoteIdentity).mockImplementation(
+    () =>
+      new Promise((resolve) => {
+        answer = resolve
+      })
+  )
+  enrichMissingRepoGitRemoteIdentities(store)
+  const selected: RepoIcon = { type: 'emoji', emoji: '🐙' }
+  row.repoIcon = selected
+  if (!answer) {
+    throw new Error('Expected pending probe')
+  }
+  answer({ status: 'resolved', identity: identity() })
+  await flushRepoGitRemoteIdentityEnrichmentForTests()
+  expect(row.repoIcon).toBe(selected)
+  expect(store.updateRepo).toHaveBeenCalledWith('app', { gitRemoteIdentity: identity() }, 'local')
+})
+
+it('never probes folder workspaces for an avatar repair', async () => {
+  const store = storeFor([repo({ kind: 'folder' })])
+  await refresh(store)
+  expect(probeGitRemoteIdentity).not.toHaveBeenCalled()
+  expect(store.updateRepo).not.toHaveBeenCalled()
+})
diff --git a/src/main/repo-git-remote-identity-enrichment.test.ts b/src/main/repo-git-remote-identity-enrichment.test.ts
index a52d110aa02..d1e54e11de8 100644
--- a/src/main/repo-git-remote-identity-enrichment.test.ts
+++ b/src/main/repo-git-remote-identity-enrichment.test.ts
@@ -1,4 +1,5 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
+import { getRepoExecutionHostId, type ExecutionHostId } from '../shared/execution-host'
 import type { GitRemoteIdentity } from '../shared/git-remote-identity'
 import type { Repo } from '../shared/repo-types'
 import { type GitRemoteIdentityProbe, probeGitRemoteIdentity } from './repo-git-remote-identity'
@@ -15,7 +16,11 @@ vi.mock('./repo-git-remote-identity', () => ({
 type RepoIdentityStore = {
   getRepos: () => Repo[]
   getRepo: (id: string) => Repo | undefined
-  updateRepo: (id: string, updates: Pick<Partial<Repo>, 'gitRemoteIdentity'>) => Repo | null
+  updateRepo: (
+    id: string,
+    updates: Pick<Partial<Repo>, 'gitRemoteIdentity'>,
+    hostId?: ExecutionHostId
+  ) => Repo | null
 }
 
 const remoteIdentity: GitRemoteIdentity = {
@@ -42,8 +47,13 @@ function makeStore(...repos: Repo[]): RepoIdentityStore & { updateRepo: ReturnTy
   return {
     getRepos: () => repos,
     getRepo: (id) => repos.find((candidate) => candidate.id === id),
-    updateRepo: vi.fn((id, updates) => {
-      const target = repos.find((candidate) => candidate.id === id)
+    // Mirrors the real store: `hostId` is matched against the row's own stamp, so a write
+    // addressed to the wrong host finds no row (src/main/persistence/tracking-repos).
+    updateRepo: vi.fn((id, updates, hostId) => {
+      const target = repos.find(
+        (candidate) =>
+          candidate.id === id && (!hostId || getRepoExecutionHostId(candidate) === hostId)
+      )
       if (!target) {
         return null
       }
@@ -129,23 +139,43 @@ describe('enrichMissingRepoGitRemoteIdentities', () => {
     await flushRepoGitRemoteIdentityEnrichmentForTests()
   })
 
-  it('never hands a runtime row nested SSH target to this client dispatch table', async () => {
+  it('never probes a runtime row that names a nested SSH target', async () => {
     // Why: `connectionId` on a `runtime:` row names a target inside that server's namespace, so
-    // dialing it here reaches a same-named box of ours. The row keeps the probe this process has
-    // always run for it; what it must never do is dial our same-named target.
+    // dialing it here reaches a same-named box of ours, and the same path on this machine is a
+    // different checkout. Neither host is probeable from here, so the row is skipped outright.
     vi.mocked(probeGitRemoteIdentity).mockResolvedValue({ status: 'unavailable' })
     const store = makeStore(
       makeRepo({ connectionId: 'nested-1', executionHostId: 'runtime:env-a' })
     )
 
-    enrichMissingRepoGitRemoteIdentities(store)
+    await sweep(store)
+
+    expect(probeGitRemoteIdentity).not.toHaveBeenCalled()
+    expect(store.updateRepo).not.toHaveBeenCalled()
+  })
+
+  it('probes a self-addressed runtime row here and writes it back under its own stamp', async () => {
+    // Why: a bare `runtime:` stamp is how a paired client addresses a repo registered in *this*
+    // process, so its files are local. Skipping it left `gitRemoteIdentity` unset forever, which
+    // consumers read as pending. The write must carry the row's stamp, not the probe host — the
+    // store matches that argument against the stamp, so `local` would match no row.
+    vi.mocked(probeGitRemoteIdentity).mockResolvedValue(resolvedProbe)
+    const repo = makeRepo({ executionHostId: 'runtime:env-a' })
+    const store = makeStore(repo)
+
+    await sweep(store)
 
     expect(probeGitRemoteIdentity).toHaveBeenCalledWith(
       '/workspace/sample-app',
       'local',
       expect.objectContaining({ signal: expect.any(AbortSignal) })
     )
-    await flushRepoGitRemoteIdentityEnrichmentForTests()
+    expect(store.updateRepo).toHaveBeenCalledWith(
+      'repo-1',
+      { gitRemoteIdentity: remoteIdentity },
+      'runtime:env-a'
+    )
+    expect(repo.gitRemoteIdentity).toEqual(remoteIdentity)
   })
 
   it('keeps same-path rows on two different SSH hosts from sharing one backoff', async () => {
@@ -208,7 +238,7 @@ describe('enrichMissingRepoGitRemoteIdentities', () => {
     enrichMissingRepoGitRemoteIdentities(store)
     await flushRepoGitRemoteIdentityEnrichmentForTests()
 
-    expect(store.updateRepo).toHaveBeenCalledWith('repo-1', { gitRemoteIdentity: null })
+    expect(store.updateRepo).toHaveBeenCalledWith('repo-1', { gitRemoteIdentity: null }, 'local')
     expect(repo.gitRemoteIdentity).toBeNull()
   })
 
@@ -243,7 +273,11 @@ describe('enrichMissingRepoGitRemoteIdentities', () => {
     enrichMissingRepoGitRemoteIdentities(store)
     await flushRepoGitRemoteIdentityEnrichmentForTests()
 
-    expect(store.updateRepo).toHaveBeenCalledWith('repo-1', { gitRemoteIdentity: remoteIdentity })
+    expect(store.updateRepo).toHaveBeenCalledWith(
+      'repo-1',
+      { gitRemoteIdentity: remoteIdentity },
+      'local'
+    )
   })
 
   it('does not re-probe a resolved identity before the refresh window elapses', async () => {
@@ -296,7 +330,11 @@ describe('enrichMissingRepoGitRemoteIdentities', () => {
     enrichMissingRepoGitRemoteIdentities(store, { onChanged })
     await drainEnrichmentSweep()
 
-    expect(store.updateRepo).toHaveBeenCalledWith('repo-1', { gitRemoteIdentity: movedIdentity })
+    expect(store.updateRepo).toHaveBeenCalledWith(
+      'repo-1',
+      { gitRemoteIdentity: movedIdentity },
+      'local'
+    )
     expect(repo.gitRemoteIdentity).toEqual(movedIdentity)
     expect(onChanged).toHaveBeenCalledTimes(1)
   })
diff --git a/src/main/repo-git-remote-identity-enrichment.ts b/src/main/repo-git-remote-identity-enrichment.ts
index a97961fe59f..f1cea725efc 100644
--- a/src/main/repo-git-remote-identity-enrichment.ts
+++ b/src/main/repo-git-remote-identity-enrichment.ts
@@ -1,10 +1,14 @@
 import {
   getRepoExecutionHostId,
-  getSshTargetIdForExecutionHost,
+  getRepoSshConnectionId,
   LOCAL_EXECUTION_HOST_ID,
   type ExecutionHostId
 } from '../shared/execution-host'
 import type { Repo } from '../shared/repo-types'
+import { githubAvatarIcon, type RepoIcon } from '../shared/repo-icon'
+import { isUnresolvedSshHostAlias } from '../shared/git-remote-host-alias'
+import { getProjectProviderIdentity } from '../shared/project-host-setup-projection'
+import { getStoredRepoExecutionHostId } from './repo-execution-host'
 import { probeGitRemoteIdentity } from './repo-git-remote-identity'
 
 const NO_IDENTITY_RETRY_TTL_MS = 5 * 60 * 1000
@@ -21,8 +25,12 @@ const MAX_IDENTITY_REFRESHES_PER_SWEEP = 4
 
 type RepoIdentityStore = {
   getRepos(): Repo[]
-  getRepo?(id: string): Repo | undefined
-  updateRepo(id: string, updates: Pick<Partial<Repo>, 'gitRemoteIdentity'>): Repo | null
+  getRepo?(id: string, hostId?: ExecutionHostId): Repo | undefined
+  updateRepo(
+    id: string,
+    updates: Pick<Partial<Repo>, 'gitRemoteIdentity' | 'repoIcon'>,
+    hostId?: ExecutionHostId
+  ): Repo | null
 }
 
 type EnrichmentOptions = {
@@ -51,18 +59,23 @@ function getRepoLocationKey(repo: Pick<Repo, 'path' | 'connectionId' | 'executio
   return `${getRepoExecutionHostId(repo)}\0${repo.path}`
 }
 
-/**
- * The host *this* process may run the probe on. `getSshTargetIdForExecutionHost`, not the row's
- * file-holding target: a `runtime:` row's nested SSH target lives in that server's namespace, so
- * dialing it here would reach a same-named box of ours — a wrong-host answer, not a local one.
- */
-function getRepoProbeHostId(repo: Repo): ExecutionHostId {
-  const hostId = getRepoExecutionHostId(repo)
-  return getSshTargetIdForExecutionHost(hostId) ? hostId : LOCAL_EXECUTION_HOST_ID
+// A peer's nested SSH targets belong to its dispatch table, never this client's, so a `runtime:`
+// row that names one has no host here to probe. A `runtime:` stamp on its own is how a paired
+// client addresses files registered in *this* process (`getStoredRepoExecutionHostId`), so that row
+// keeps the local probe it has always had — dropping it leaves its identity permanently pending.
+function getRepoProbeHostId(repo: Repo): ExecutionHostId | null {
+  const hostId = getStoredRepoExecutionHostId(repo)
+  return hostId === LOCAL_EXECUTION_HOST_ID && getRepoSshConnectionId(repo) ? null : hostId
 }
 
-function getCurrentRepo(store: RepoIdentityStore, id: string): Repo | undefined {
-  return store.getRepo?.(id) ?? store.getRepos().find((repo) => repo.id === id)
+function getCurrentRepo(store: RepoIdentityStore, snapshot: Repo): Repo | undefined {
+  const hostId = getRepoExecutionHostId(snapshot)
+  const found = store.getRepo?.(snapshot.id, hostId)
+  return found && getRepoExecutionHostId(found) === hostId
+    ? found
+    : store
+        .getRepos()
+        .find((repo) => repo.id === snapshot.id && getRepoExecutionHostId(repo) === hostId)
 }
 
 function isSameProbedRepo(snapshot: Repo, current: Repo | undefined): current is Repo {
@@ -87,22 +100,67 @@ function shouldWriteProbedIdentity(current: Repo, probed: Repo['gitRemoteIdentit
   return !!probed && probed.canonicalKey !== existing.canonicalKey
 }
 
+function getAutomaticGitHubIconRefresh(
+  current: Repo,
+  probed: NonNullable<Repo['gitRemoteIdentity']>
+): RepoIcon | undefined {
+  if (
+    (current.upstream?.owner && current.upstream.repo) ||
+    current.repoIcon?.type !== 'image' ||
+    current.repoIcon.source !== 'github'
+  ) {
+    return undefined
+  }
+  const identity = getProjectProviderIdentity({
+    upstream: null,
+    repoIcon: undefined,
+    gitRemoteIdentity: probed
+  })
+  if (!identity || (identity.host && isUnresolvedSshHostAlias(identity.host))) {
+    return undefined
+  }
+  const icon = githubAvatarIcon(identity)
+  return icon.type === 'image' &&
+    current.repoIcon.src === icon.src &&
+    current.repoIcon.label === icon.label
+    ? undefined
+    : icon
+}
+
 function writeIdentity(
   store: RepoIdentityStore,
   snapshot: Repo,
   gitRemoteIdentity: Repo['gitRemoteIdentity']
 ): boolean {
-  const current = getCurrentRepo(store, snapshot.id)
-  if (
-    !isSameProbedRepo(snapshot, current) ||
-    !shouldWriteProbedIdentity(current, gitRemoteIdentity)
-  ) {
+  // A peer's repo metadata must never be repaired from a client-local probe.
+  if (!getRepoProbeHostId(snapshot)) {
     return false
   }
-  return !!store.updateRepo(snapshot.id, { gitRemoteIdentity })
+  const current = getCurrentRepo(store, snapshot)
+  if (!isSameProbedRepo(snapshot, current)) {
+    return false
+  }
+  const writeRemote = shouldWriteProbedIdentity(current, gitRemoteIdentity)
+  const icon = gitRemoteIdentity
+    ? getAutomaticGitHubIconRefresh(current, gitRemoteIdentity)
+    : undefined
+  // The row's own host, not the probe's: the store matches this argument against the row's stamp,
+  // so a `runtime:` row probed locally is only addressable here under that stamp.
+  const storeHostId = getRepoExecutionHostId(snapshot)
+  const update = (updates: Pick<Partial<Repo>, 'gitRemoteIdentity' | 'repoIcon'>): Repo | null => {
+    return store.updateRepo(snapshot.id, updates, storeHostId)
+  }
+  if (icon) {
+    return !!update({ ...(writeRemote ? { gitRemoteIdentity } : {}), repoIcon: icon })
+  }
+  return writeRemote && !!update({ gitRemoteIdentity })
 }
 
 async function enrichRepoGitRemoteIdentity(store: RepoIdentityStore, repo: Repo): Promise<boolean> {
+  const hostId = getRepoProbeHostId(repo)
+  if (!hostId) {
+    return false
+  }
   const locationKey = getRepoLocationKey(repo)
   const retryAfter = probeRetryAfterByLocation.get(locationKey) ?? 0
   if (retryAfter > Date.now()) {
@@ -119,7 +177,7 @@ async function enrichRepoGitRemoteIdentity(store: RepoIdentityStore, repo: Repo)
     : NO_IDENTITY_RETRY_TTL_MS
   const controller = new AbortController()
   const promise = (async () => {
-    const result = await probeGitRemoteIdentity(repo.path, getRepoProbeHostId(repo), {
+    const result = await probeGitRemoteIdentity(repo.path, hostId, {
       signal: controller.signal
     })
     // Why the signal and not a catch: probeGitRemoteIdentity swallows the AbortError and RESOLVES
@@ -187,7 +245,9 @@ function retireRemovedLocations(allRepos: Repo[]): void {
 
 function selectEnrichmentCandidates(store: RepoIdentityStore): Repo[] {
   const now = Date.now()
-  const repos = store.getRepos().filter((repo) => repo.kind !== 'folder')
+  const repos = store
+    .getRepos()
+    .filter((repo) => repo.kind !== 'folder' && getRepoProbeHostId(repo) !== null)
   // Why: the settled `null` marker stays a candidate on purpose — a repo that
   // gains a remote later must still resolve. Do not tighten this to
   // `=== undefined`; the retry TTL already bounds the cost and `writeIdentity`
diff --git a/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-answered.meta.json b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-answered.meta.json
new file mode 100644
index 00000000000..ce80eebc6a7
--- /dev/null
+++ b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-answered.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-25T21:10:00.000Z",
+  "platform": "darwin",
+  "command": ["claude"],
+  "cols": 120,
+  "rows": 40,
+  "note": "Claude Code v2.1.280, macOS arm64, first launch in an untrusted folder with an isolated CLAUDE_CONFIG_DIR (the trust answer went to a throwaway config); Down then Enter picked 'Yes, I trust this folder' and the capture ends on the idle composer; API-key auth",
+  "exitCode": null
+}
diff --git a/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-answered.txt b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-answered.txt
new file mode 100644
index 00000000000..80b75267b38
--- /dev/null
+++ b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-answered.txt
@@ -0,0 +1,21 @@
+78[?25h[?25l[?2004h[?2031h[?1004h

+────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

+Accessingworkspace:

+

+/private/tmp/claude-trust-review/proj

+

+Quicksafetycheck:Isthisaprojectyoucreatedoroneyoutrust?(Likeyourowncode,awell-knownopensource

+project,orworkfromyourteam).Ifnot,takeamomenttoreviewwhat'sinthisfolderfirst.

+

+ClaudeCode'llbeabletoread,edit,andexecutefileshere.

+

+]8;id=zaxmda;https://code.claude.com/docs/en/securitySecurity guide]8;;

+

+❯No,exit

+Yes,Itrustthisfolder

+

+Entertoconfirm·Esctocancel

+[>0q[?u(B
 No, exit
❯Yes, I trust this folder

+
+
+[>4m[<u[?1004l[?2031l[?2004l
















[?2004h[?2031h[?1004h[?1049h[?1000h[?1002h[?1003h[?1006h[?25l]0;✳ Claude Code
 ▐▛███▛█Claude Codev2.1.280
▝▜██████▀Opus 5.5 (1M context) · API Usage Billing
  ▝▝ ▝▝  /private/tmp/claude-trust-review/proj
◐ medium · /effort
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
❯  
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
⏸ manual mode on · ? for shortcuts · ← for agents[>0q
        
 ▐▛▛█ 
·▜██████·
~~
▗▟▛███▛█▄
▜███▘
  ▝▝ ▝▝  
 ▐ 
▝▀
        
 ▐▛▛█ 
·▜██████·
~~
▗▟▛███▛█▄
▜███▘
  ▝▝ ▝▝  
 ▐ 
▝▀

\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-narrow.meta.json b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-narrow.meta.json
new file mode 100644
index 00000000000..5841c7e6694
--- /dev/null
+++ b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-narrow.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-25T21:03:00.000Z",
+  "platform": "darwin",
+  "command": ["claude"],
+  "cols": 60,
+  "rows": 30,
+  "note": "Claude Code v2.1.280, macOS arm64, first launch in an untrusted folder with an isolated CLAUDE_CONFIG_DIR (no operator config touched); a narrow pane, where Claude wraps the dialog's opening question across lines; capture ends with the trust dialog owning the screen",
+  "exitCode": null
+}
diff --git a/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-narrow.txt b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-narrow.txt
new file mode 100644
index 00000000000..9e15b7b1e85
--- /dev/null
+++ b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-narrow.txt
@@ -0,0 +1,21 @@
+78[?25h[?25l[?2004h[?2031h[?1004h

+────────────────────────────────────────────────────────────

+Accessingworkspace:

+

+/private/tmp/claude-trust-review/proj

+

+Quicksafetycheck:Isthisaprojectyoucreatedorone

+youtrust?(Likeyourowncode,awell-knownopensource

+project,orworkfromyourteam).Ifnot,takeamomentto

+reviewwhat'sinthisfolderfirst.

+

+ClaudeCode'llbeabletoread,edit,andexecutefiles

+here.

+

+]8;id=zaxmda;https://code.claude.com/docs/en/securitySecurity guide]8;;

+

+❯No,exit

+Yes,Itrustthisfolder

+

+Entertoconfirm·Esctocancel

+[>0q[?u
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/claude-dialog-trust-workspace.meta.json b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace.meta.json
new file mode 100644
index 00000000000..ecfd36098d2
--- /dev/null
+++ b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-25T20:03:23.885Z",
+  "platform": "darwin",
+  "command": ["claude", "--dangerously-skip-permissions"],
+  "cols": 120,
+  "rows": 40,
+  "note": "Claude Code v2.1.280, macOS arm64, first launch in an untrusted git worktree; API-key auth; capture ends with the trust dialog owning the screen",
+  "exitCode": 129
+}
diff --git a/src/main/runtime/__fixtures__/claude-dialog-trust-workspace.txt b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace.txt
new file mode 100644
index 00000000000..c8eb94c6b5c
--- /dev/null
+++ b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace.txt
@@ -0,0 +1,18 @@
+78[?25h[?25l[?2004h[?2031h[?1004h

+────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

+Accessingworkspace:

+

+/Users/xxxxxxxxxxxxx/orca/workspaces/repo/qa-untrusted-raw

+

+Quicksafetycheck:Isthisaprojectyoucreatedoroneyoutrust?(Likeyourowncode,awell-knownopensource

+project,orworkfromyourteam).Ifnot,takeamomenttoreviewwhat'sinthisfolderfirst.

+

+ClaudeCode'llbeabletoread,edit,andexecutefileshere.

+

+]8;id=zaxmda;https://code.claude.com/docs/en/securitySecurity guide]8;;

+

+❯No,exit

+Yes,Itrustthisfolder

+

+Entertoconfirm·Esctocancel

+[>0q[?u
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0-150-1-turn.meta.json b/src/main/runtime/__fixtures__/codex-0-150-1-turn.meta.json
new file mode 100644
index 00000000000..21b39d7625b
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0-150-1-turn.meta.json
@@ -0,0 +1,16 @@
+{
+  "capturedAt": "2026-09-29T01:35:32.695Z",
+  "platform": "darwin",
+  "command": [
+    "codex",
+    "-c",
+    "check_for_update_on_startup=false",
+    "--dangerously-bypass-approvals-and-sandbox",
+    "-m",
+    "gpt-5.6-sol"
+  ],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.150.1: launch, one short turn, settled idle after it. STA-8834.",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/codex-0-150-1-turn.txt b/src/main/runtime/__fixtures__/codex-0-150-1-turn.txt
new file mode 100644
index 00000000000..4d4c5dacccf
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0-150-1-turn.txt
@@ -0,0 +1,18 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h╭───────────────────────────────────────╮│ >_ OpenAI Codex (v0.150.1)            ││                                       ││ model:     loading   /model to change ││ directory: loading                    │╰───────────────────────────────────────╯  › Ask Codex to do anything   ? for shortcuts[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h╭──────────────────────────────────────────────────╮│ >_ OpenAI Codex (v0.150.1)                       ││                                                  ││ model:       loading   /model to change          ││ directory:   ~/orca-lanes/sta8834/corpus/scratch ││ permissions: YOLO mode                           │╰──────────────────────────────────────────────────╯  › Ask Codex to do anything   ? for shortcuts[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;scratch[?2026h[0 q[?25h[?2026l[?2026hgpt-5.6-sol default · ~/orca-lanes/sta8834/corpus/scratch[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠋ scratch]0;⠙ scratch[?2026hMMMMMMMMM
+╭────────────────────────────────────────────────────╮
+│ >_ OpenAI Codex (v0.150.1)                         │
+│                                                    │
+│ model:       gpt-5.6-sol medium   /model to change │
+│ directory:   ~/orca-lanes/sta8834/corpus/scratch   │
+│ permissions: YOLO mode                             │
+╰────────────────────────────────────────────────────╯
+
+  Tip: Try the Desktop app. Run 'codex app' or visit https://chatgpt.com/codex?app-landing-page=true • Booting MCP server: node_repl (0s • esc to interrupt)  › Ask Codex to do anything   gpt-5.6-sol medium · ~/orca-lanes/sta8834/corpus/scratch[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;scratch[?2026h  › Ask Codex to do anything   gpt-5.6-sol medium · ~/orca-lanes/sta8834/corpus/scratch[0 q[?25h[?2026l[?2026hMM
+
+• You have 3 usage limit resets available. Run /usage to use one.[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026hReply with the single wordOK.[0 q[?25h[?2026l[?2026hMMMM
+
+
+› Reply with the single word OK.
+Ask Codex to do anything[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠋ scratch[?2026h • Working (0s • esc to interrupt)  › Ask Codex to do anything   gpt-5.6-sol medium · ~/orca-lanes/sta8834/corpus/scratch[0 q[?25h[?2026l]0;⠙ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠹ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠸ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠼ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠴ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026hW[0 q[?25h[?2026l]0;⠦ scratch[?2026h[0 q[?25h[?2026l[?2026hWo[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠧ scratch[?2026h•Wor[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠇ scratch[?2026h•Work[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h•Worki[0 q[?25h[?2026l]0;⠏ scratch[?2026h[0 q[?25h[?2026l[?2026hWorkin[0 q[?25h[?2026l[?2026h•[0 q[?25h[?2026l]0;⠋ scratch[?2026hWorking[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h•Working1[0 q[?25h[?2026l]0;⠙ scratch[?2026h[0 q[?25h[?2026l[?2026hWorking[0 q[?25h[?2026l[?2026h•[0 q[?25h[?2026l]0;⠹ scratch[?2026h[0 q[?25h[?2026l[?2026hWorking[0 q[?25h[?2026l[?2026h•[0 q[?25h[?2026l]0;⠸ scratch[?2026horking[0 q[?25h[?2026l[?2026h•[0 q[?25h[?2026l[?2026hrking[0 q[?25h[?2026l]0;⠼ scratch[?2026h[0 q[?25h[?2026l[?2026h•king[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠴ scratch[?2026hing[0 q[?25h[?2026l[?2026h•[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠦ scratch[?2026hng[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠧ scratch[?2026hg[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠇ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠏ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠋ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠙ scratch[?2026h2[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠹ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠸ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠼ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠴ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026hW[0 q[?25h[?2026l]0;⠦ scratch[?2026h[0 q[?25h[?2026l[?2026hWo[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠧ scratch[?2026h•Wor[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠇ scratch[?2026h•Work[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h•Worki[0 q[?25h[?2026l]0;⠏ scratch[?2026h[0 q[?25h[?2026l[?2026hWorkin[0 q[?25h[?2026l[?2026h•[0 q[?25h[?2026l]0;⠋ scratch[?2026hWorking[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h•Working3[0 q[?25h[?2026l]0;⠙ scratch[?2026h[0 q[?25h[?2026l[?2026hWorking[0 q[?25h[?2026l[?2026h•[0 q[?25h[?2026l]0;⠹ scratch[?2026h[0 q[?25h[?2026l[?2026hWorking[0 q[?25h[?2026l[?2026h•[0 q[?25h[?2026l]0;⠸ scratch[?2026horking[0 q[?25h[?2026l[?2026h•[0 q[?25h[?2026l[?2026hrking[0 q[?25h[?2026l]0;⠼ scratch[?2026h[0 q[?25h[?2026l[?2026h•king[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠴ scratch[?2026hing[0 q[?25h[?2026l[?2026h•[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠦ scratch[?2026hng[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026hg[0 q[?25h[?2026l]0;⠧ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠇ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠏ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠋ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠙ scratch[?2026h4[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠹ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠸ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠼ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠴ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026hW[0 q[?25h[?2026l]0;⠦ scratch[?2026h[0 q[?25h[?2026l[?2026hWo[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠧ scratch[?2026h•Wor[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠇ scratch[?2026h•Work[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026hWorki[0 q[?25h[?2026l]0;⠏ scratch[?2026h•[0 q[?25h[?2026l[?2026hWorkin[0 q[?25h[?2026l[?2026h•[0 q[?25h[?2026l]0;⠋ scratch[?2026hWorking[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h•[0 q[?25h[?2026l]0;⠙ scratch[?2026hWorking5[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h•Working[0 q[?25h[?2026l]0;⠹ scratch[?2026h[0 q[?25h[?2026l[?2026hWorking[0 q[?25h[?2026l[?2026h•[0 q[?25h[?2026l]0;⠸ scratch[?2026horking[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h•rking[0 q[?25h[?2026l]0;⠼ scratch[?2026h[0 q[?25h[?2026l[?2026h•king[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠴ scratch[?2026h[0 q[?25h[?2026l[?2026h•ing[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠦ scratch[?2026hng[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026hg[0 q[?25h[?2026l]0;⠧ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠇ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠏ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠋ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h6[0 q[?25h[?2026l]0;⠙ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠹ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠸ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠼ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠴ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026hW[0 q[?25h[?2026l]0;⠦ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026hWo[0 q[?25h[?2026l]0;⠧ scratch[?2026h•[0 q[?25h[?2026l[?2026hWor[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠇ scratch[?2026h•Work[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l[?2026hMM
+
+• OK  › Ask Codex to do anything   gpt-5.6-sol medium · ~/orca-lanes/sta8834/corpus/scratch[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;⠏ scratch[?2026h[0 q[?25h[?2026l[?2026h[0 q[?25h[?2026l]0;scratch[?2026h[0 q[?25h[?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0-155-1-timed-turn.meta.json b/src/main/runtime/__fixtures__/codex-0-155-1-timed-turn.meta.json
new file mode 100644
index 00000000000..ca6db1a3254
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0-155-1-timed-turn.meta.json
@@ -0,0 +1,14 @@
+{
+  "capturedAt": "2026-09-29T01:44:01.149Z",
+  "platform": "darwin",
+  "command": [
+    "codex",
+    "-c",
+    "check_for_update_on_startup=false",
+    "--dangerously-bypass-approvals-and-sandbox"
+  ],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.155.1, default tui animations. One tool-using turn sent once the composer had been quiet 2.5s; cut 20s past the last busy frame, before exit. <name>.timing.json holds each PTY chunk as [ms since spawn, UTF-16 length] and the prompt-submit time. STA-8834.",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/codex-0-155-1-timed-turn.timing.json b/src/main/runtime/__fixtures__/codex-0-155-1-timed-turn.timing.json
new file mode 100644
index 00000000000..8258e899ce0
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0-155-1-timed-turn.timing.json
@@ -0,0 +1 @@
+{"promptSentAtMs":4478.2,"chunks":[[63.6,8],[63.7,47],[164.3,17],[164.5,730],[164.6,8],[164.6,78],[164.8,78],[165.4,78],[171.5,78],[172.5,78],[174.7,17],[174.8,794],[174.9,132],[175.2,79],[175.7,79],[197.3,79],[197.5,79],[203.1,79],[205.8,71],[205.8,8],[206,71],[206.2,87],[636.8,79],[641.5,79],[642.3,12],[642.6,202],[642.8,71],[642.9,8],[671.8,79],[728.1,14],[749.8,31],[749.8,767],[749.9,506],[750.9,77],[792.1,12],[793.2,77],[995.7,72],[995.7,178],[1340.2,77],[3899.1,153],[4478.5,104],[4478.5,94],[4478.6,160],[4483.3,77],[4488.7,77],[4510.6,14],[4511.7,18],[4511.9,509],[4545.3,14],[4545.4,77],[4579.4,77],[4613,77],[4646.2,14],[4646.3,77],[4679.2,77],[4712.4,77],[4721.2,77],[4732.5,77],[4741.8,77],[4755.1,14],[4755.2,77],[4756.4,30],[4763.7,132],[4798.3,77],[4831.8,77],[4865.3,30],[4865.4,77],[4898,77],[4931.8,77],[4965.6,30],[4965.7,77],[4998.3,77],[5032,77],[5066.6,30],[5066.7,77],[5100.6,111],[5134.7,77],[5168.8,30],[5168.8,77],[5202.5,111],[5235.8,77],[5269.8,30],[5269.9,77],[5304,111],[5338,77],[5372.6,30],[5372.7,111],[5406.4,77],[5440.5,77],[5474.5,30],[5474.6,111],[5508.1,77],[5542.1,30],[5542.2,82],[5542.2,8],[5576.7,111],[5610.9,77],[5645.1,30],[5645.3,77],[5678.4,111],[5712.5,77],[5745.7,30],[5745.9,77],[5779,111],[5812.7,77],[5845.4,30],[5845.6,111],[5879.6,77],[5913.5,77],[5945.9,30],[5946,111],[5980.4,77],[6014.5,77],[6048.6,30],[6048.7,77],[6082,77],[6116.5,77],[6150.1,30],[6150.2,77],[6183.5,77],[6217.5,77],[6251.7,30],[6252.1,77],[6285.1,77],[6318.6,77],[6352.7,30],[6352.9,77],[6386.1,77],[6425.6,77],[6459.8,30],[6460,77],[6493.6,77],[6527.3,90],[6561.3,30],[6561.4,77],[6594.4,77],[6627.4,77],[6661,30],[6661.2,77],[6695,77],[6729.1,77],[6763.1,30],[6763.2,77],[6797.2,77],[6831.3,77],[6865.4,30],[6865.5,77],[6898.9,77],[6933.1,77],[6967.1,30],[6967.2,77],[7001.2,77],[7035.3,77],[7068.9,30],[7069,77],[7102.2,111],[7136.6,77],[7169.9,30],[7170.3,77],[7204.3,111],[7238.4,77],[7272.3,30],[7272.3,77],[7305.3,111],[7339,77],[7373,30],[7373.2,111],[7407.1,77],[7441.1,77],[7474.7,30],[7474.9,111],[7508.5,77],[7542.6,30],[7542.8,90],[7576.9,111],[7610,77],[7644.6,30],[7644.7,77],[7679,111],[7712.9,77],[7746.6,30],[7746.8,77],[7779.2,111],[7813,77],[7847,30],[7847.1,111],[7881.2,77],[7915.3,77],[7949.3,30],[7949.4,111],[7982.8,77],[8016.8,77],[8050.1,30],[8050.1,29],[8050.1,48],[8083.8,77],[8117.9,77],[8151.5,30],[8151.5,77],[8185.7,77],[8219.4,77],[8252.2,30],[8252.3,77],[8286.4,77],[8320.4,77],[8354.4,30],[8354.5,77],[8388,77],[8422,77],[8456,30],[8456,77],[8490.2,77],[8524.5,90],[8558.4,30],[8558.6,77],[8592.8,77],[8626.1,77],[8659.8,30],[8660.1,77],[8694.5,77],[8727.9,77],[8761.8,30],[8762,77],[8796.8,77],[8830.8,77],[8864.1,30],[8864.3,77],[8897.6,77],[8931.7,77],[8965.2,30],[8965.3,77],[8999.4,77],[9032.6,77],[9066.7,30],[9066.8,77],[9101.1,111],[9135.1,77],[9169,30],[9169.2,77],[9202.6,111],[9236.7,77],[9270.7,30],[9270.8,77],[9305,111],[9339.3,77],[9373.7,30],[9373.9,111],[9407.8,77],[9441,77],[9474.5,30],[9474.6,111],[9507,77],[9540.9,90],[9574.4,30],[9574.5,111],[9608.6,77],[9642.6,30],[9642.7,77],[9676.7,111],[9710.9,77],[9744.2,30],[9744.2,77],[9778.4,111],[9812.5,77],[9846.5,30],[9846.6,111],[9880.7,77],[9914.9,77],[9948.5,30],[9948.6,111],[9982.6,77],[10015.9,77],[10049.2,30],[10049.2,77],[10082.8,69],[10082.8,8],[10116.3,77],[10149.7,30],[10149.8,77],[10183.7,77],[10218.2,77],[10251,30],[10251.1,77],[10284.1,77],[10317.7,77],[10352.3,30],[10352.3,69],[10352.4,8],[10386.5,77],[10420.5,77],[10454.8,30],[10455.1,77],[10488.6,77],[10521.9,90],[10555.8,30],[10556.1,77],[10590.5,77],[10624.7,77],[10658.7,30],[10658.9,77],[10692.4,69],[10692.5,8],[10726.2,77],[10760.1,30],[10760.2,77],[10794.4,77],[10828.5,77],[10861.6,30],[10861.8,77],[10894.7,77],[10928.6,77],[10962.6,30],[10962.8,77],[10995.4,77],[11029.6,77],[11063.4,30],[11063.5,77],[11097.3,111],[11131.7,77],[11165,30],[11165.1,77],[11199.2,111],[11233.1,77],[11266.3,30],[11266.4,77],[11299.6,111],[11333.2,77],[11367.2,30],[11367.3,77],[11401.5,111],[11435.5,77],[11469.4,30],[11469.5,111],[11503.6,77],[11537.7,90],[11571.7,30],[11571.8,111],[11606,77],[11639.6,77],[11672.8,30],[11672.9,111],[11695.8,77],[11730.1,77],[11764.1,30],[11764.2,111],[11798.4,77],[11832.2,77],[11864.9,30],[11865,111],[11898.6,77],[11932.3,77],[11966.4,30],[11966.5,97],[11966.5,14],[12000.2,77],[12033.5,77],[12067.5,30],[12067.6,77],[12101.2,77],[12135.4,69],[12135.5,8],[12168.8,30],[12168.9,69],[12169,8],[12203.1,77],[12237.2,77],[12270.6,30],[12270.8,63],[12270.8,14],[12304.9,77],[12339.7,77],[12373.6,30],[12373.8,77],[12406.9,77],[12441.1,77],[12475.2,30],[12475.4,77],[12509.1,77],[12543.1,30],[12543.4,90],[12577.4,77],[12611.4,77],[12644.6,30],[12644.8,77],[12678.6,77],[12712.7,77],[12746.3,30],[12746.4,77],[12779.6,77],[12812.5,77],[12846.1,30],[12846.2,77],[12880.3,77],[12914.3,77],[12948.3,30],[12948.4,77],[12982.7,77],[13016.9,77],[13049.9,30],[13050.1,77],[13083.6,111],[13117.1,77],[13151.1,30],[13151.2,77],[13184.2,111],[13217.4,77],[13250.7,30],[13250.8,77],[13284.9,111],[13301.8,77],[13336.6,77],[13370.1,30],[13370.1,111],[13403.8,77],[13438.1,77],[13472,30],[13472.2,111],[13505.2,77],[13539.6,90],[13572.7,30],[13572.8,111],[13607.6,77],[13641.8,77],[13675.5,30],[13675.6,111],[13709.7,77],[13742.2,30],[13742.3,63],[13742.3,14],[13776.5,111],[13810.3,77],[13844.3,30],[13844.6,77],[13877.7,111],[13911.7,77],[13944.4,30],[13944.6,111],[13978,77],[14012.1,77],[14046.6,30],[14046.8,77],[14080.9,77],[14115,77],[14148.5,30],[14148.7,63],[14148.7,14],[14182.8,77],[14217,77],[14250.6,30],[14250.7,77],[14284.9,77],[14319,77],[14353.5,30],[14353.5,77],[14387.7,77],[14421.9,77],[14456,30],[14456.2,77],[14490.3,77],[14523.9,119],[14558.3,30],[14558.3,77],[14592.5,77],[14626.6,77],[14660,30],[14660,77],[14694.1,77],[14728,77],[14761.6,30],[14761.6,69],[14761.7,8],[14771.2,73],[14771.3,192],[14805.5,77],[14839.7,77],[14873.5,30],[14873.7,77],[14907.8,77],[14941.4,77],[14974,30],[14974.1,77],[15007.3,77],[15040.5,77],[15074.5,30],[15074.6,77],[15106.9,111],[15140.6,77],[15172.8,30],[15172.9,77],[15180,14],[15182.8,41],[15183,177],[15192.7,77],[15226.5,77],[15260.2,41],[15260.2,77],[15294.3,111],[15328.5,77],[15361.7,41],[15361.9,63],[15362,14],[15395.9,111],[15429.6,77],[15463.6,41],[15463.8,77],[15496.8,111],[15531.1,90],[15565,41],[15565.2,111],[15599.4,77],[15632.9,77],[15666.2,41],[15666.4,111],[15700.3,77],[15734.5,77],[15768.5,41],[15768.6,111],[15802.6,77],[15835.4,77],[15869.2,41],[15869.3,111],[15903.2,77],[15935.8,77],[15969.9,41],[15970,111],[16003.5,77],[16037.5,77],[16071.6,41],[16071.8,77],[16105.7,77],[16138.7,77],[16172.9,41],[16172.9,77],[16207,77],[16241.4,77],[16275.4,41],[16275.4,69],[16275.5,8],[16309.6,77],[16343.6,41],[16343.8,77],[16377.8,77],[16411.9,77],[16445.8,41],[16445.9,77],[16480.1,77],[16513.3,90],[16547.1,41],[16547.2,77],[16580.9,77],[16615.2,77],[16648.6,41],[16648.7,77],[16682,77],[16715.1,77],[16748.6,41],[16748.7,77],[16781.9,77],[16816.1,77],[16850.1,41],[16850.2,77],[16884.8,77],[16919,77],[16952.9,41],[16953,77],[16987.7,77],[17021.1,77],[17054.5,41],[17054.5,69],[17054.6,8],[17088.6,103],[17088.7,8],[17122.5,77],[17155.9,41],[17156,77],[17190.1,111],[17224.3,77],[17258.3,41],[17258.4,69],[17258.4,8],[17292.3,111],[17326.3,77],[17360.7,41],[17360.8,77],[17395.7,111],[17429.9,77],[17463.9,41],[17464.1,77],[17498,111],[17531.3,90],[17564.9,41],[17565.1,111],[17599.1,77],[17633.1,77],[17666.7,41],[17666.7,111],[17700.9,77],[17734.8,77],[17768.8,41],[17768.9,103],[17769,8],[17803,77],[17837.1,77],[17871.1,41],[17871.1,111],[17904.8,77],[17939,77],[17973.1,41],[17973.2,111],[18006.8,77],[18040.7,77],[18074.5,41],[18074.5,63],[18074.5,14],[18108.6,77],[18142,41],[18142.1,77],[18175.5,77],[18209.1,69],[18209.2,8],[18242.3,41],[18242.4,77],[18276.6,77],[18310.2,77],[18344.2,41],[18344.3,77],[18378.4,77],[18412.6,77],[18446.6,41],[18446.7,77],[18479.9,69],[18479.9,8],[18513.5,90],[18546.9,41],[18547,77],[18576.3,77],[18609.3,77],[18642.9,41],[18643,77],[18677.1,77],[18711.2,77],[18744.2,41],[18744.3,77],[18777.3,77],[18787.6,18],[18787.8,759],[18797.1,77],[18813.8,77],[18823.3,77],[18856.4,41],[18856.4,77],[18890.3,77],[18924.4,77],[18958.4,41],[18958.5,77],[18992.4,77],[19026.6,77],[19060.6,41],[19060.7,77],[19094.9,111],[19129,77],[19162.9,41],[19163,69],[19163,8],[19197.1,111],[19231.5,77],[19264.7,41],[19264.9,69],[19265,8],[19299.2,111],[19332.9,77],[19366.9,41],[19367.1,29],[19367.1,48],[19401.3,111],[19435.4,77],[19469.5,41],[19469.6,63],[19469.6,48],[19503.8,77],[19537,90],[19571,41],[19571.1,111],[19605.3,77],[19639.3,77],[19672.5,41],[19672.5,111],[19716,77],[19746.1,41],[19746.1,77],[19779.7,111],[19813.8,77],[19847.7,41],[19847.7,97],[19847.8,14],[19881.8,77],[19916,77],[19950.1,41],[19950.1,103],[19950.2,8],[19984.4,77],[20018.7,77],[20052.7,41],[20052.9,77],[20087.2,77],[20121.5,77],[20155.6,41],[20155.8,69],[20155.8,8],[20189,77],[20223.5,77],[20257.4,41],[20257.6,63],[20257.6,14],[20291.2,69],[20291.3,8],[20324.7,77],[20358.1,41],[20358.2,77],[20392.4,77],[20426.5,77],[20460.6,41],[20460.7,77],[20494.8,77],[20528.9,90],[20562.9,41],[20563,77],[20597.2,77],[20630.5,77],[20664.6,41],[20664.7,77],[20699.5,77],[20733.6,77],[20766.9,41],[20767,77],[20800.2,77],[20834.6,77],[20867.8,41],[20868,77],[20901.6,77],[20935.6,77],[20968.8,41],[20969,29],[20969.1,48],[21003.3,69],[21003.4,8],[21037.4,77],[21071.4,41],[21071.6,69],[21071.6,8],[21105.8,111],[21139.9,77],[21174,41],[21174.1,77],[21207.6,111],[21218.4,77],[21251.8,41],[21251.9,77],[21286.2,111],[21320.1,77],[21354.2,41],[21354.3,63],[21354.3,14],[21388.7,111],[21422.8,77],[21456.1,41],[21456.2,77],[21490.3,111],[21524.4,90],[21558.6,41],[21558.9,77],[21593.2,111],[21627.5,77],[21661.5,41],[21661.6,63],[21661.6,48],[21695.9,77],[21730,77],[21763.4,41],[21763.4,103],[21763.5,8],[21797.6,77],[21831.4,77],[21865.4,41],[21865.4,97],[21865.4,14],[21899.6,77],[21933.7,77],[21967.8,41],[21967.8,111],[22002,77],[22036.1,77],[22070.2,41],[22070.2,29],[22070.3,48],[22104.2,77],[22138.5,77],[22171.9,41],[22172.1,77],[22206.3,77],[22240.6,77],[22273.1,41],[22273.2,77],[22307.3,77],[22341.1,77],[22375,41],[22375.1,69],[22375.1,8],[22409.4,77],[22443.5,41],[22443.6,63],[22443.7,14],[22477.9,77],[22511.2,90],[22544.7,41],[22544.8,77],[22579,77],[22612.5,77],[22646.4,41],[22646.5,77],[22679.8,77],[22713.9,77],[22748.5,41],[22748.6,69],[22748.6,8],[22782.7,77],[22817,77],[22850.2,41],[22850.3,63],[22850.3,14],[22883.7,77],[22894.2,18],[22894.2,117],[22894.3,673],[22894.3,8],[22928.5,77],[22962,41],[22962,77],[22996.5,77],[23030.5,77],[23064.6,41],[23064.7,29],[23064.7,48],[23098.2,111],[23133,77],[23166.4,41],[23166.5,77],[23193.2,18],[23193.2,65],[23193.3,561],[23193.3,8],[23295.2,41],[23397.5,41],[23499.7,41],[23601.5,41],[23703.1,41],[23805.7,41],[23908.4,41],[24010.6,41],[24048,41],[24048.1,245],[24057.7,77],[24083.3,77],[24083.7,39],[24092.3,73],[24092.4,108],[24092.4,14]]}
diff --git a/src/main/runtime/__fixtures__/codex-0-155-1-timed-turn.txt b/src/main/runtime/__fixtures__/codex-0-155-1-timed-turn.txt
new file mode 100644
index 00000000000..6064224f724
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0-155-1-timed-turn.txt
@@ -0,0 +1,26 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h╭───────────────────────────────────────╮│ >_ OpenAI Codex (v0.155.1)            ││                                       ││ model:     loading   /model to change ││ directory: loading                    │╰───────────────────────────────────────╯  › Ask Codex to do anything   ? for shortcuts[0 q╭[?25h[?2026l[?2026h[0 q╭[?25h[?2026l[?2026h[0 q╭[?25h[?2026l[?2026h[0 q╭[?25h[?2026l[?2026h[0 q╭[?25h[?2026l[?2026h[0 q╭[?25h[?2026l[?2026h╭──────────────────────────────────────────────────╮│ >_ OpenAI Codex (v0.155.1)                       ││                                                  ││ model:       loading   /model to change          ││ directory:   ~/orca-lanes/sta8834/corpus/scratch ││ permissions: YOLO mode                           │╰──────────────────────────────────────────────────╯  › Ask Codex to do anything   ? for shortcuts[0 q╭[?25h[?2026l[?2026h[0 q╭[?25h[?2026l[?2026h[0 q╭[?25h[?2026l[?2026h[0 q╭[?25h[?2026l[?2026h[0 q╭[?25h[?2026l[?2026h[0 q╭[?25h[?2026l[?2026h[0 q╭[?25h[?2026l[?2026h[0 q╭[?25h[?2026l[?2026h[0 q╭[?25h[?2026l[?2026h[0 q╭[?25h[?2026l[?2026h[0 q╭[?25h[?2026l]0;scratch[?2026hgpt-6-sol default · ~/orca-lanes/sta8834/corpus/scratch[0 q╭[?25h[?2026l[?2026h[0 q╭[?25h[?2026l[?2026h[0 q╭[?25h[?2026l]0;⠋ scratch]0;⠙ scratch[?2026hMMMMMMMMM
+╭──────────────────────────────────────────────────╮
+│ >_ OpenAI Codex (v0.155.1)                       │
+│                                                  │
+│ model:       gpt-6-sol medium   /model to change │
+│ directory:   ~/orca-lanes/sta8834/corpus/scratch │
+│ permissions: YOLO mode                           │
+╰──────────────────────────────────────────────────╯
+
+  Tip: New Use /fast to enable our fastest inference with increased plan usage.  › Ask Codex to do anything   gpt-6-sol medium · ~/orca-lanes/sta8834/corpus/scratch[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;scratch[?2026h[0 q [?25h[?2026l[?2026hMM
+
+• You have 3 usage limit resets available. Run /usage to use one.[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026hList the files here and summarizein2bullets.[0 q [?25h[?2026l[?2026hMMMM
+
+
+› List the files here and summarize in 2 bullets.
+Ask Codex to do anything[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠇ scratch[?2026h • Working (0s • esc to interrupt)  › Ask Codex to do anything   gpt-6-sol medium · ~/orca-lanes/sta8834/corpus/scratch[0 q [?25h[?2026l]0;⠏ scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠋ scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠙ scratch[?2026h[0 q [?25h[?2026l]0;⠙ renaming... ⠙ | scratch[?2026h · renaming... ⠙[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠹ renaming... ⠹ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠸ renaming... ⠸ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠼ renaming... ⠼ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠴ renaming... ⠴ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠦ renaming... ⠦ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠧ renaming... ⠧ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠇ renaming... ⠇ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠏ renaming... ⠏ | scratch[?2026h1[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠋ renaming... ⠋ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠙ renaming... ⠙ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠹ renaming... ⠹ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠸ renaming... ⠸ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠼ renaming... ⠼ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠴ renaming... ⠴ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠦ renaming... ⠦ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠧ renaming... ⠧ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠇ renaming... ⠇ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h2[0 q [?25h[?2026l]0;⠏ renaming... ⠏ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠋ renaming... ⠋ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠙ renaming... ⠙ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠹ renaming... ⠹ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠸ renaming... ⠸ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠼ renaming... ⠼ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠴ renaming... ⠴ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠦ renaming... ⠦ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠧ renaming... ⠧ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠇ renaming... ⠇ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠏ renaming... ⠏ | scratch[?2026h3[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠋ renaming... ⠋ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠙ renaming... ⠙ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠹ renaming... ⠹ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠸ renaming... ⠸ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠼ renaming... ⠼ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠴ renaming... ⠴ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠦ renaming... ⠦ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠧ renaming... ⠧ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠇ renaming... ⠇ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h4[0 q [?25h[?2026l]0;⠏ renaming... ⠏ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠋ renaming... ⠋ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠙ renaming... ⠙ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠹ renaming... ⠹ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠸ renaming... ⠸ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠼ renaming... ⠼ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠴ renaming... ⠴ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠦ renaming... ⠦ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠧ renaming... ⠧ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠇ renaming... ⠇ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h5[0 q [?25h[?2026l]0;⠏ renaming... ⠏ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠋ renaming... ⠋ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠙ renaming... ⠙ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠹ renaming... ⠹ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠸ renaming... ⠸ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠼ renaming... ⠼ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠴ renaming... ⠴ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠦ renaming... ⠦ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠧ renaming... ⠧ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠇ renaming... ⠇ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h6[0 q [?25h[?2026l]0;⠏ renaming... ⠏ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠋ renaming... ⠋ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠙ renaming... ⠙ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠹ renaming... ⠹ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠸ renaming... ⠸ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠼ renaming... ⠼ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠴ renaming... ⠴ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠦ renaming... ⠦ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠧ renaming... ⠧ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠇ renaming... ⠇ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h7[0 q [?25h[?2026l]0;⠏ renaming... ⠏ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠋ renaming... ⠋ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠙ renaming... ⠙ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠹ renaming... ⠹ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠸ renaming... ⠸ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠼ renaming... ⠼ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠴ renaming... ⠴ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠦ renaming... ⠦ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠧ renaming... ⠧ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠇ renaming... ⠇ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠏ renaming... ⠏ | scratch[?2026h8[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠋ renaming... ⠋ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠙ renaming... ⠙ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠹ renaming... ⠹ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠸ renaming... ⠸ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠼ renaming... ⠼ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠴ renaming... ⠴ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠦ renaming... ⠦ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠧ renaming... ⠧ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠇ renaming... ⠇ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h9[0 q [?25h[?2026l]0;⠏ renaming... ⠏ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠋ renaming... ⠋ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠙ renaming... ⠙ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠹ renaming... ⠹ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠸ renaming... ⠸ | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠼ renaming... ⠼ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠴ renaming... ⠴ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠦ renaming... ⠦ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠧ renaming... ⠧ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠇ renaming... ⠇ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h10s • esc to interupt)[0 q [?25h[?2026l]0;⠏ renaming... ⠏ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠋ renaming... ⠋ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠙ renaming... ⠙ | scratch[?2026h[0 q [?25h[?2026l[?2026hMM
+
+• I’ll inspect the current directory and summarize what’s there in two bullets.[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠹ renaming... ⠹ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠸ renaming... ⠸ | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠼ renaming... ⠼ | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠴ renaming... ⠴ | scratch[?2026h[0 q [?25h[?2026l]0;⠴ scratch]0;⠴ List and summarize files | scratch[?2026h•List ad summarize files[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠦ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠧ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠇ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h1[0 q [?25h[?2026l]0;⠏ List and summarize files | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠋ List and summarize files | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠙ List and summarize files | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠹ List and summarize files | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠸ List and summarize files | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠼ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠴ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠦ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠧ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠇ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h2[0 q [?25h[?2026l]0;⠏ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠋ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠙ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠹ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠸ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠼ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠴ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠦ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠧ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠇ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h3[0 q [?25h[?2026l]0;⠏ List and summarize files | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠋ List and summarize files | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠙ List and summarize files | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠹ List and summarize files | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠸ List and summarize files | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠼ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠴ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠦ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠧ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠇ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h4[0 q [?25h[?2026l]0;⠏ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠋ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠙ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h • Explored  └ List rg --files -g '*' -g '!*/.git/*' • Working (14s • esc to interrupt)  › Ask Codex to do anything   gpt-6-sol medium · ~/orca-lanes/sta8834/corpus/scratch · List and summarize files[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠹ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠸ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠼ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠴ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠦ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠧ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠇ List and summarize files | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h5[0 q [?25h[?2026l]0;⠏ List and summarize files | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠋ List and summarize files | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠙ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠹ List and summarize files | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠸ List and summarize files | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠼ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠴ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠦ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠧ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠇ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h6[0 q [?25h[?2026l]0;⠏ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠋ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠙ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠹ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠸ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠼ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠴ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠦ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠧ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠇ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h7[0 q [?25h[?2026l]0;⠏ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠋ List and summarize files | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠙ List and summarize files | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠹ List and summarize files | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠸ List and summarize files | scratch[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠼ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠴ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠦ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠧ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠇ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h8[0 q [?25h[?2026l]0;⠏ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠋ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠙ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠹ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026hMMM
+
+• Explored
+  └ List rg --files -g '*' -g '!*/.git/*' • Working (18s • esc to interrupt)  › Ask Codex to do anything   gpt-6-sol medium · ~/orca-lanes/sta8834/corpus/scratch · List and summarize files[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠸ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠼ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026h•[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;⠴ List and summarize files | scratch[?2026h[0 q [?25h[?2026l[?2026hMM
+
+• - README.md and notes.txt are the two working files.  › Ask Codex to do anything   gpt-6-sol medium · ~/orca-lanes/sta8834/corpus/scratch · List and summarize files[0 q [?25h[?2026l]0;⠦ List and summarize files | scratch]0;⠧ List and summarize files | scratch]0;⠇ List and summarize files | scratch]0;⠏ List and summarize files | scratch]0;⠋ List and summarize files | scratch]0;⠙ List and summarize files | scratch]0;⠹ List and summarize files | scratch]0;⠸ List and summarize files | scratch]0;⠼ List and summarize files | scratch[?2026hM
+  - A .git/ directory is present, containing repository metadata and history.[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l[?2026h[0 q [?25h[?2026l]0;List and summarize files | scratch[?2026hMM
+
+  done 9:43 PM[0 q [?25h[?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0-157-1-update-dialog.meta.json b/src/main/runtime/__fixtures__/codex-0-157-1-update-dialog.meta.json
new file mode 100644
index 00000000000..f43deccb966
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0-157-1-update-dialog.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-29T01:41:43.328Z",
+  "platform": "darwin",
+  "command": ["codex", "--no-daemon", "--dangerously-bypass-approvals-and-sandbox"],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.157.1: launch with the update check on; the update dialog owns the screen. STA-8834.",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/codex-0-157-1-update-dialog.txt b/src/main/runtime/__fixtures__/codex-0-157-1-update-dialog.txt
new file mode 100644
index 00000000000..4bd32773735
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0-157-1-update-dialog.txt
@@ -0,0 +1 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l╭───────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.1)            ││                                       ││ model:     loading   /model to change ││ directory: loading                    │╰───────────────────────────────────────╯›Ask Codex to do anything?forshortcuts[0 q╭[?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l───────────╮           │           │  loading  /model to change          │  ~/orca-lanes/sta8834/corpus/scratch ││ permissions: YOLO mode                           │╰──────────────────────────────────────────────────╯[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l   Updat available · 0.157.1→0.158.0  Releasenotes:]8;;https://github.com/openai/codex/releases/latesthttps://github.com/openai/codex/releases/latest]8;; › 1. Update now (runs `npm install -g @openai/codex`)                                                                     2. Skip  3. Skip until next versionenter continue · esc skip [?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0-158-0-approval.meta.json b/src/main/runtime/__fixtures__/codex-0-158-0-approval.meta.json
new file mode 100644
index 00000000000..a333bd29473
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0-158-0-approval.meta.json
@@ -0,0 +1,18 @@
+{
+  "capturedAt": "2026-09-29T01:43:13.919Z",
+  "platform": "darwin",
+  "command": [
+    "codex",
+    "--no-daemon",
+    "-c",
+    "check_for_update_on_startup=false",
+    "-a",
+    "on-request",
+    "-s",
+    "read-only"
+  ],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.158.0: read-only sandbox with on-request approvals; a command approval dialog owns the screen at the end. STA-8834.",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/codex-0-158-0-approval.txt b/src/main/runtime/__fixtures__/codex-0-158-0-approval.txt
new file mode 100644
index 00000000000..925a5165fc5
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0-158-0-approval.txt
@@ -0,0 +1 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l>_ OpenAI Codex (v0.158.0)loadingAll right. What have you got?⣀⣤⣤⣤⣀⣀⣠⣶⣿⣿⣿⣿⣿⣿⣿⣿⣦⣤⣤⣤⣤⣤⣤⡀⢀⣾⣿⣿⠿⠋⠉⠉⢉⣭⣿⣿⣿⣿⣿⠿⣿⣿⣿⣿⣷⣄⣀⣾⣿⣿⠃⣀⣴⣾⣿⣿⡿⠟⠋⣀⡀⠈⠙⢿⣿⣿⣧⣀⣶⣿⣿⣿⣿⡇⢸⣿⣿⡿⠛⠉⢀⣠⣴⣿⣿⣿⣷⣦⣀⠈⢻⣿⣿⡇⣰⣿⣿⡿⢿⣿⣿⡇⢸⣿⣿⢀⣤⣶⣿⣿⣿⠟⠛⠻⣿⣿⣿⣿⣮⣿⣿⡷⢰⣿⣿⡟⠁⢸⣿⣿⡇⢸⣿⣿⣿⣿⠿⠿⣿⣿⣿⣦⣄⡀⠈⠛⠿⣿⣿⣿⣧⡀⣾⣿⣿⠃⢸⣿⣿⡇⢸⣿⣿⠋⠁⠈⠙⢻⣿⣿⣿⣶⣤⡀⠹⢿⣿⣷⡄⢸⣿⣿⣇⠸⣿⣿⣷⣦⣼⣿⣿⢸⣿⣿⠻⢿⣿⣿⡇⠘⣿⣿⣿⠈⢿⣿⣿⣦⡀⠈⠛⠿⣿⣿⣿⣿⣄⡀⢀⣠⣼⣿⣿⣿⣿⡇⣿⣿⣿⠇⢻⣿⣿⣿⣷⣦⣀⠈⠙⠻⣿⣿⣿⣶⣶⣿⣿⣿⣿⣿⣿⣿⡇⣠⣿⣿⣿⢸⣿⣿⡿⢿⣿⣿⣿⣦⣠⣴⣿⣿⣿⡿⠟⠋⢸⣿⣿⣿⣿⣷⣴⣿⣿⣿⠃⠘⣿⣿⣷⠈⠛⢿⣿⣿⣿⠿⠋⠉⣠⣴⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠻⣿⣿⣿⣤⣀⠈⠉⢀⣤⣶⣿⣿⣿⠿⠟⠁⣰⣿⣿⡟⠋⠁⠈⠿⣿⣿⣿⣿⣶⣾⣿⣿⣿⣿⠟⠋⠁⣠⣼⣿⣿⡟⠙⠛⠛⠛⠻⠛⢿⣿⣿⣿⣿⣷⣾⣿⣿⣿⡿⠏⠈⠙⠛⠿⠿⠿⠿⠛⠉›Ask Codex to do anything?forshortcuts[0 q [?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l~/orca-lanes/sta8834/corpus/scratch[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;scratch[?2026h[?25lGPT-6-Sol default·~/orca-lanes/sta8834/corpus/scratch[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠋ scratch]0;⠙ scratch[?2026h[?25lmdim · ~/orca-lanes/sta834/corpus/scratch[?25h[?2026l[?2026h[?25h[?2026l]0;scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25lRun `touch approved.txt`.[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l› Run`touchapproved.txt`.Ask Codex to do anything?forshortcuts[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠇ scratch[?2026h[?25l•Working(0s • esc to interrupt)[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠏ scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠋ scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ scratch[?2026h[?25h[?2026l]0;⠙ ⠙ | scratch[?2026h[?25l·⠙[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠹ ⠹ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠸ ⠸ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠼ ⠼ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠴ ⠴ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠦ ⠦ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠧ ⠧ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠇ ⠇ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25l1[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠏ ⠏ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠋ ⠋ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠙ ⠙ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠹ ⠹ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠸ ⠸ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠼ ⠼ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠴ ⠴ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠦ ⠦ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠧ ⠧ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠇ ⠇ | scratch[?2026h[?25h[?2026l[?2026h[?25l2[?25h[?2026l[?2026h[?25h[?2026l]0;⠏ ⠏ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠋ ⠋ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ ⠙ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠹ ⠹ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠸ ⠸ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠼ ⠼ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠴ ⠴ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠦ ⠦ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠧ ⠧ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠇ ⠇ | scratch[?2026h[?25l3[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠏ ⠏ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠋ ⠋ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠙ ⠙ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠹ ⠹ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠸ ⠸ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠼ ⠼ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠴ ⠴ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠦ ⠦ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠧ ⠧ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠇ ⠇ | scratch[?2026h[?25h[?2026l[?2026h[?25l4[?25h[?2026l[?2026h[?25h[?2026l]0;⠏ ⠏ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠋ ⠋ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ ⠙ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠹ ⠹ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠸ ⠸ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠼ ⠼ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠴ ⠴ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠦ ⠦ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠧ ⠧ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠇ ⠇ | scratch[?2026h[?25h[?2026l[?2026h[?25l5[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠏ ⠏ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠋ ⠋ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠙ ⠙ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠹ ⠹ | scratch[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l]0;⠸ ⠸ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠼ ⠼ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠴ ⠴ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠦ ⠦ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠧ ⠧ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠇ ⠇ | scratch[?2026h[?25l6[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠏ ⠏ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠋ ⠋ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ ⠙ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠹ ⠹ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠸ ⠸ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠼ ⠼ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠴ ⠴ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠦ ⠦ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠧ ⠧ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠇ ⠇ | scratch[?2026h[?25h[?2026l[?2026h[?25l7[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠏ ⠏ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠋ ⠋ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠙ ⠙ | scratch[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l]0;⠹ ⠹ | scratch[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l]0;⠸ ⠸ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠼ ⠼ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠴ ⠴ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠦ ⠦ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠧ ⠧ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠇ ⠇ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l8[?25h[?2026l[?2026h[?25h[?2026l]0;⠏ ⠏ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠋ ⠋ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ ⠙ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠹ ⠹ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠸ ⠸ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠼ ⠼ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠴ ⠴ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠦ ⠦ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠧ ⠧ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠇ ⠇ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25l9[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠏ ⠏ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠋ ⠋ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠙ ⠙ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠹ ⠹ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠸ ⠸ | scratch[?2026h[?25l• I [?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l’ll[?25h[?2026l]0;⠼ ⠼ | scratch[?2026h[?25lcreate[?25h[?2026l]0;⠴ ⠴ | scratch[?2026h[?25l⠴[?25h[?2026l[?2026h[?25lthe[?25h[?2026l]0;⠦ ⠦ | scratch[?2026h[?25l⠦[?25h[?2026l[?2026h[?25lfile[?25h[?2026l[?2026h[?25linthecurrent[?25h[?2026l]0;⠧ ⠧ | scratch[?2026h[?25l⠧[?25h[?2026l[?2026h[?25lworkspace;[?25h[?2026l]0;⠇ ⠇ | scratch[?2026h[?25l⠇[?25h[?2026l[?2026h[?25lthis[?25h[?2026l]0;⠏ ⠏ | scratch[?2026h[?25lrequires[?25h[?2026l]0;⠋ ⠋ | scratch[?2026h[?25l⠋[?25h[?2026l[?2026h[?25lwrite[?25h[?2026l[?2026h[?25laccess[?25h[?2026l]0;⠙ ⠙ | scratch[?2026h[?25l⠙[?25h[?2026l[?2026h[?25lbeyond[?25h[?2026l[?2026h[?25lthe[?25h[?2026l]0;⠹ ⠹ | scratch[?2026h[?25l⠹[?25h[?2026l[?2026h[?25lread-only[?25h[?2026l]0;⠸ ⠸ | scratch[?2026h[?25lsandbox.[?25h[?2026l]0;⠼ ⠼ | scratch[?2026h[?25l⠼[?25h[?2026l]0;⠴ ⠴ | scratch[?2026h[?25l⠴[?25h[?2026l]0;⠦ ⠦ | scratch[?2026h[?25l⠦[?25h[?2026l]0;⠧ ⠧ | scratch[?2026h[?25l⠧[?25h[?2026l]0;⠇ ⠇ | scratch[?2026h[?25l⠇[?25h[?2026l]0;⠏ ⠏ | scratch[?2026h[?25l⠏[?25h[?2026l[?2026h[?25l•Working(11s • esc to interrupt)[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠋ ⠋ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠙ ⠙ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠹ ⠹ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠸ ⠸ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠼ ⠼ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠴ ⠴ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠦ ⠦ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠧ ⠧ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠇ ⠇ | scratch[?2026h[?25l2[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠏ ⠏ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠋ ⠋ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ ⠙ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠹ ⠹ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠸ ⠸ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠼ ⠼ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠴ ⠴ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠦ ⠦ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠧ ⠧ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠇ ⠇ | scratch[?2026h[?25h[?2026l[?2026h[?25l3[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠏ ⠏ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠋ ⠋ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠙ ⠙ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠹ ⠹ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;[ . ] Action Required | ⠸ | scratch[?2026h[?25l•Runningtouch approved.txtWould you like to run the following command?Environment:localReason:May I create approved.txt in the current workspace as requested?$touch approved.txt › 1. Yes, proceed (y)                                                                                                    2. Yes, and don't ask againforcommandsthatstartwith`touchapproved.txt`(p)3.No,andtellCodexwhattododifferently(esc)Press enter to confirm or esc to cancel                                                                               [?2026l]0;[ . ] Action Required | ⠼ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠴ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠦ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠧ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠇ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠏ | scratch[?2026h[?2026l]0;[ ! ] Action Required | ⠋ | scratch[?2026h[?2026l]0;[ ! ] Action Required | ⠙ | scratch[?2026h[?2026l]0;[ ! ] Action Required | ⠹ | scratch[?2026h[?2026l]0;[ ! ] Action Required | ⠸ | scratch[?2026h[?2026l]0;[ ! ] Action Required | ⠼ | scratch[?2026h[?2026l]0;[ ! ] Action Required | ⠴ | scratch[?2026h[?2026l]0;[ ! ] Action Required | ⠦ | scratch[?2026h[?2026l]0;[ ! ] Action Required | ⠧ | scratch[?2026h[?2026l]0;[ ! ] Action Required | ⠇ | scratch[?2026h[?2026l]0;[ ! ] Action Required | ⠏ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠋ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠙ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠹ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠸ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠼ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠴ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠦ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠧ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠇ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠏ | scratch[?2026h[?2026l]0;[ ! ] Action Required | ⠋ | scratch[?2026h[?2026l]0;[ ! ] Action Required | ⠙ | scratch[?2026h[?2026l]0;[ ! ] Action Required | ⠹ | scratch]0;[ ! ] Action Required | ⠸ | scratch[?2026h[?2026l]0;[ ! ] Action Required | ⠼ | scratch[?2026h[?2026l]0;[ ! ] Action Required | ⠴ | scratch[?2026h[?2026l]0;[ ! ] Action Required | ⠦ | scratch[?2026h[?2026l]0;[ ! ] Action Required | ⠧ | scratch[?2026h[?2026l]0;[ ! ] Action Required | ⠇ | scratch[?2026h[?2026l]0;[ ! ] Action Required | ⠏ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠋ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠙ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠹ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠸ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠼ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠴ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠦ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠧ | scratch[?2026h[?2026l]0;[ . ] Action Required | ⠇ | scratch[?2026h[?2026l]0;[ . ] Action Required | scratch]0;[ . ] Action Required | Create approved.txt | scratch[?2026h[?2026l]0;[ ! ] Action Required | Create approved.txt | scratch]0;[ . ] Action Required | Create approved.txt | scratch]0;[ ! ] Action Required | Create approved.txt | scratch]0;[ . ] Action Required | Create approved.txt | scratch]0;[ ! ] Action Required | Create approved.txt | scratch]0;[ . ] Action Required | Create approved.txt | scratch]0;[ ! ] Action Required | Create approved.txt | scratch]0;[ . ] Action Required | Create approved.txt | scratch]0;[ ! ] Action Required | Create approved.txt | scratch]0;[ . ] Action Required | Create approved.txt | scratch]0;[ ! ] Action Required | Create approved.txt | scratch]0;[ . ] Action Required | Create approved.txt | scratch]0;[ ! ] Action Required | Create approved.txt | scratch
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0-158-0-timed-turn.meta.json b/src/main/runtime/__fixtures__/codex-0-158-0-timed-turn.meta.json
new file mode 100644
index 00000000000..2c3defda30a
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0-158-0-timed-turn.meta.json
@@ -0,0 +1,15 @@
+{
+  "capturedAt": "2026-09-29T01:46:36.717Z",
+  "platform": "darwin",
+  "command": [
+    "codex",
+    "--no-daemon",
+    "-c",
+    "check_for_update_on_startup=false",
+    "--dangerously-bypass-approvals-and-sandbox"
+  ],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.158.0, default tui animations. One tool-using turn sent once the composer had been quiet 2.5s; cut 20s past the last busy frame, before exit. <name>.timing.json holds each PTY chunk as [ms since spawn, UTF-16 length] and the prompt-submit time. STA-8834.",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/codex-0-158-0-timed-turn.timing.json b/src/main/runtime/__fixtures__/codex-0-158-0-timed-turn.timing.json
new file mode 100644
index 00000000000..02745d043e1
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0-158-0-timed-turn.timing.json
@@ -0,0 +1 @@
+{"promptSentAtMs":7226.9,"chunks":[[70.2,28],[70.4,27],[321.3,80],[321.5,9],[324.7,14],[324.8,578],[325.8,494],[327,43],[329.1,43],[331.5,43],[333.5,43],[335.5,43],[340.4,216],[340.5,8],[342.3,43],[344,43],[346,43],[372.5,43],[374.1,43],[385.8,43],[1330.3,43],[1332.2,35],[1332.2,8],[1334.4,43],[1336.3,43],[1338.5,43],[1340.5,43],[2820.3,43],[2829.5,43],[2831.2,12],[2833.5,43],[2835.6,169],[2835.7,8],[2842.6,43],[2866,43],[2922.5,14],[2944.6,14],[2946.2,14],[2946.2,180],[2947.8,43],[2949.3,43],[3006.8,12],[3009.4,43],[3941,43],[4089.1,43],[6627.2,43],[6627.3,377],[6627.3,14],[6627.4,35],[6627.4,8],[6627.6,43],[6627.7,43],[6627.8,43],[6627.9,43],[6628,43],[6628.2,43],[6628.3,43],[6628.4,35],[6628.4,8],[6628.5,35],[6628.5,8],[6628.6,43],[6628.7,43],[6628.9,43],[6629,43],[6629.1,43],[6629.2,43],[6629.3,43],[6629.4,35],[6629.4,8],[6629.5,43],[6629.7,43],[6629.8,43],[6629.9,35],[6629.9,8],[6630,35],[6630,8],[6630.1,43],[6630.2,35],[6630.3,8],[6630.4,43],[6630.5,35],[6630.5,8],[6630.6,35],[6630.6,8],[6630.7,43],[6630.8,35],[6630.9,8],[6630.9,43],[6631.1,43],[6631.2,35],[6631.2,8],[6631.3,35],[6631.3,8],[6631.4,35],[6631.4,8],[6631.5,35],[6631.5,8],[6631.6,35],[6631.6,8],[6631.7,35],[6631.7,8],[6631.9,35],[6631.9,8],[6632,35],[6632,8],[6632.1,43],[6632.2,35],[6632.2,8],[6632.3,43],[6632.4,43],[6632.5,43],[6659.2,117],[6659.3,8],[7227.9,44],[7228.6,138],[7228.7,14],[7229,161],[7229.2,8],[7239.4,43],[7247.7,43],[7271.8,14],[7273,163],[7273.1,8],[7306.6,43],[7339.4,14],[7339.5,35],[7339.6,8],[7374.3,43],[7407.9,43],[7441.3,14],[7441.5,43],[7474.6,43],[7490.5,43],[7513.7,43],[7535.2,14],[7535.3,35],[7535.3,8],[7536.4,18],[7545.7,89],[7578.7,43],[7611.6,43],[7646,18],[7646.1,43],[7679.3,43],[7713.6,43],[7747,18],[7747.2,35],[7747.2,8],[7780,43],[7813.5,43],[7846.7,18],[7846.8,75],[7846.9,8],[7879.7,43],[7912.9,43],[7946.5,18],[7946.7,83],[7980.7,43],[8015.1,43],[8048.9,18],[8049.1,83],[8083.6,43],[8116.9,43],[8150.3,18],[8150.5,69],[8150.6,14],[8185.3,43],[8219.4,35],[8219.5,8],[8253.4,18],[8253.5,75],[8253.5,8],[8287.5,62],[8321.7,83],[8354.9,18],[8355,43],[8388.5,43],[8422.7,83],[8456.2,18],[8456.4,35],[8456.4,8],[8489.6,43],[8522.9,83],[8534.4,18],[8534.6,43],[8568.8,43],[8603.1,43],[8637.1,18],[8637.4,69],[8637.4,14],[8672.2,43],[8706.4,83],[8738.4,18],[8738.6,43],[8772.8,43],[8806.7,43],[8840,18],[8840.2,35],[8840.3,8],[8874.6,43],[8908,43],[8941.4,18],[8941.7,35],[8941.7,8],[8976.8,43],[9010.8,43],[9044.4,18],[9044.7,43],[9077.8,43],[9112.4,43],[9146.4,18],[9146.5,35],[9146.5,8],[9179.7,43],[9213.5,43],[9247,18],[9247.2,35],[9247.2,8],[9281.4,54],[9281.4,8],[9315.9,43],[9349.2,18],[9349.4,35],[9349.4,8],[9383.7,43],[9418,43],[9446.6,18],[9446.8,90],[9447,8],[9456.9,43],[9493.4,63],[9502.6,60],[9519.3,82],[9534.9,18],[9535.1,52],[9535.2,8],[9555.5,58],[9555.7,8],[9575.4,61],[9597.6,59],[9619.5,64],[9629.8,51],[9629.9,8],[9643,18],[9643.2,52],[9643.3,8],[9668.1,56],[9668.4,8],[9684.5,58],[9786.6,18],[9788.1,72],[9788.2,8],[9889.3,18],[9890.6,80],[9918.4,171],[9953.3,101],[9985.2,43],[10018.5,43],[10051.6,18],[10051.8,75],[10051.8,8],[10085.6,43],[10119.4,43],[10152.9,18],[10153.1,75],[10153.1,8],[10186.5,43],[10220.8,43],[10254.6,18],[10254.8,69],[10254.9,14],[10289.8,54],[10290,8],[10324.3,83],[10357.6,18],[10357.9,43],[10391.4,43],[10424,83],[10457.5,18],[10457.7,35],[10457.7,8],[10491,43],[10524.9,83],[10558.6,18],[10559,35],[10559.1,8],[10592.5,43],[10626.9,83],[10660.9,18],[10661.1,43],[10694.8,43],[10729.4,83],[10763.4,18],[10763.5,43],[10798.4,43],[10833.1,18],[10833.2,43],[10866.5,43],[10900.5,43],[10933.6,18],[10933.7,43],[10966.9,43],[11000.6,43],[11034.6,18],[11034.9,43],[11069.1,43],[11103,43],[11137.1,18],[11137.2,35],[11137.3,8],[11169.2,43],[11199,43],[11231.3,18],[11231.4,43],[11260.7,338],[11260.8,8],[11270.5,43],[11286.1,62],[11296.4,72],[11296.5,8],[11330.4,43],[11364.5,18],[11364.7,43],[11398.1,43],[11432.1,18],[11432.3,35],[11432.3,8],[11465.9,43],[11498.9,43],[11532.8,18],[11533,35],[11533,8],[11566.1,43],[11598.9,43],[11633,18],[11633.2,35],[11633.2,8],[11667.1,43],[11700.9,43],[11735,18],[11735.2,43],[11769.5,43],[11802.8,43],[11835.7,18],[11835.9,35],[11835.9,8],[11869.6,83],[11903.7,43],[11937.8,18],[11938.1,35],[11938.1,8],[11961.5,119],[11962.2,14],[11965.3,41],[11970.6,103],[12004.5,43],[12038.7,41],[12038.9,75],[12039,8],[12073.3,43],[12107.2,43],[12141,41],[12141.3,14],[12141.4,69],[12174.7,43],[12208.4,43],[12241.5,41],[12241.8,14],[12241.8,69],[12276.1,62],[12309.7,43],[12343.6,41],[12343.7,69],[12343.8,14],[12378,43],[12412.2,43],[12445.3,41],[12445.4,75],[12445.4,8],[12479.1,43],[12512.6,75],[12512.7,8],[12545.6,41],[12545.8,35],[12545.9,8],[12579.3,43],[12612.8,83],[12646.7,41],[12647,35],[12647,8],[12664.5,43],[12698.5,43],[12731.6,41],[12732,14],[12732,69],[12766.1,43],[12799.5,43],[12833.8,41],[12834.3,35],[12834.3,8],[12867.9,43],[12902.4,43],[12935.2,41],[12935.7,35],[12935.8,8],[12969.7,43],[13003.8,43],[13037.5,41],[13037.7,43],[13071.9,43],[13104.8,43],[13137.8,41],[13138,43],[13171.4,43],[13205.7,43],[13240.2,41],[13240.3,43],[13274.4,62],[13307.9,43],[13341.3,41],[13341.5,35],[13341.5,8],[13376.5,43],[13409.8,43],[13443.1,41],[13443.3,43],[13476.8,43],[13510.5,43],[13544.3,41],[13544.5,35],[13544.5,8],[13578.7,43],[13612.2,43],[13645.2,41],[13645.4,35],[13645.4,8],[13679.6,43],[13714.4,43],[13747.5,41],[13747.8,35],[13747.9,8],[13781.8,43],[13814.6,43],[13848,41],[13848.3,69],[13848.3,14],[13881.6,43],[13916.7,43],[13950.2,41],[13950.4,69],[13950.4,14],[13984.6,43],[14018.3,43],[14052.6,41],[14052.7,69],[14052.7,14],[14086.4,43],[14120.6,43],[14154.9,41],[14155,69],[14155,14],[14181.8,43],[14211.3,43],[14244.5,41],[14244.7,75],[14244.7,8],[14277.6,54],[14277.7,8],[14287.3,273],[14287.3,8],[14305.4,43],[14315.6,43],[14349.5,41],[14349.6,75],[14349.7,8],[14383.6,43],[14417.1,75],[14417.2,8],[14451.1,41],[14451.3,35],[14451.3,8],[14485.5,43],[14520.1,75],[14520.2,8],[14554.3,41],[14554.5,35],[14554.6,8],[14589.7,43],[14624.4,83],[14656.7,41],[14657,35],[14657,8],[14691.2,43],[14724.7,83],[14758.2,41],[14758.3,35],[14758.3,8],[14792.3,43],[14826.5,43],[14859.9,41],[14860,35],[14860,8],[14893.7,43],[14927.8,43],[14961.2,41],[14961.4,43],[14971.2,43],[14981.8,89],[14981.8,14],[14992.9,54],[14993,8],[15014.7,52],[15014.8,8],[15038.6,41],[15038.8,93],[15038.9,14],[15060.8,50],[15060.8,8],[15078.9,68],[15078.9,8],[15100.6,56],[15100.7,8],[15120.6,50],[15120.6,8],[15148.5,41],[15148.8,56],[15148.8,8],[15158.6,51],[15158.6,8],[15211.6,65],[15223,53],[15223.1,8],[15232,41],[15232.3,53],[15232.3,8],[15333.7,41],[15435.2,41],[15436.8,14],[15436.9,136],[15447.1,59],[15485.9,43],[15524.5,43],[15534.6,41],[15534.7,43],[15551,43],[15551.2,39],[15559.7,180]]}
diff --git a/src/main/runtime/__fixtures__/codex-0-158-0-timed-turn.txt b/src/main/runtime/__fixtures__/codex-0-158-0-timed-turn.txt
new file mode 100644
index 00000000000..f589f998bb8
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0-158-0-timed-turn.txt
@@ -0,0 +1 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l>_ OpenAI Codex (v0.158.0)loadingShall we see where this goes?⣀⣤⣤⣤⣀⣀⣠⣶⣿⣿⣿⣿⣿⣿⣿⣿⣦⣤⣤⣤⣤⣤⣤⡀⢀⣾⣿⣿⠿⠋⠉⠉⢉⣭⣿⣿⣿⣿⣿⠿⣿⣿⣿⣿⣷⣄⣀⣾⣿⣿⠃⣀⣴⣾⣿⣿⡿⠟⠋⣀⡀⠈⠙⢿⣿⣿⣧⣀⣶⣿⣿⣿⣿⡇⢸⣿⣿⡿⠛⠉⢀⣠⣴⣿⣿⣿⣷⣦⣀⠈⢻⣿⣿⡇⣰⣿⣿⡿⢿⣿⣿⡇⢸⣿⣿⢀⣤⣶⣿⣿⣿⠟⠛⠻⣿⣿⣿⣿⣮⣿⣿⡷⢰⣿⣿⡟⠁⢸⣿⣿⡇⢸⣿⣿⣿⣿⠿⠿⣿⣿⣿⣦⣄⡀⠈⠛⠿⣿⣿⣿⣧⡀⣾⣿⣿⠃⢸⣿⣿⡇⢸⣿⣿⠋⠁⠈⠙⢻⣿⣿⣿⣶⣤⡀⠹⢿⣿⣷⡄⢸⣿⣿⣇⠸⣿⣿⣷⣦⣼⣿⣿⢸⣿⣿⠻⢿⣿⣿⡇⠘⣿⣿⣿⠈⢿⣿⣿⣦⡀⠈⠛⠿⣿⣿⣿⣿⣄⡀⢀⣠⣼⣿⣿⣿⣿⡇⣿⣿⣿⠇⢻⣿⣿⣿⣷⣦⣀⠈⠙⠻⣿⣿⣿⣶⣶⣿⣿⣿⣿⣿⣿⣿⡇⣠⣿⣿⣿⢸⣿⣿⡿⢿⣿⣿⣿⣦⣠⣴⣿⣿⣿⡿⠟⠋⢸⣿⣿⣿⣿⣷⣴⣿⣿⣿⠃⠘⣿⣿⣷⠈⠛⢿⣿⣿⣿⠿⠋⠉⣠⣴⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠻⣿⣿⣿⣤⣀⠈⠉⢀⣤⣶⣿⣿⣿⠿⠟⠁⣰⣿⣿⡟⠋⠁⠈⠿⣿⣿⣿⣿⣶⣾⣿⣿⣿⣿⠟⠋⠁⣠⣼⣿⣿⡟⠙⠛⠛⠛⠻⠛⢿⣿⣿⣿⣿⣷⣾⣿⣿⣿⡿⠏⠈⠙⠛⠿⠿⠿⠿⠛⠉›Ask Codex to do anything?forshortcuts[0 q [?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l~/orca-lanes/sta8834/corpus/scratch  permissions: YOLO modeShall we see where this goes?[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;scratch[?2026h[?25h[?2026l[?2026h[?25lGPT-6-Sol default·~/orca-lanes/sta8834/corpus/scratch[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠋ scratch]0;⠙ scratch[?2026h[?25lmdim · ~/orca-lanes/sta834/corpus/scratch[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25lList the files here and summarizein2bullets.[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25lAsk Codex to do anything?forshortcuts[?25h[?2026l[?2026h[?25l› Listthefileshereandsummarizein2bullets.[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠼ scratch[?2026h[?25l•Working(0s • esc to interrupt)[?25h[?2026l[?2026h[?25h[?2026l]0;⠴ scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠦ scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠧ scratch[?2026h[?25h[?2026l]0;⠧ ⠧ | scratch[?2026h[?25l·⠧[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠇ ⠇ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠏ ⠏ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠋ ⠋ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ ⠙ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠹ ⠹ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠸ ⠸ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠼ ⠼ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25l1[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠴ ⠴ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠦ ⠦ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠧ ⠧ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠇ ⠇ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠏ ⠏ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠋ ⠋ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ ⠙ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠹ ⠹ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠸ ⠸ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠼ ⠼ | scratch[?2026h[?25h[?2026l[?2026h[?25l2[?25h[?2026l[?2026h[?25h[?2026l]0;⠴ ⠴ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠦ ⠦ | scratch[?2026h[?25l• I’ll [?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25linspect[?25h[?2026l[?2026h[?25lthe[?25h[?2026l[?2026h[?25ldirectorycontents[?25h[?2026l]0;⠧ ⠧ | scratch[?2026h[?25land[?25h[?2026l[?2026h[?25lsummarize[?25h[?2026l[?2026h[?25lwhat[?25h[?2026l[?2026h[?25l’s[?25h[?2026l[?2026h[?25lpresent[?25h[?2026l[?2026h[?25lin[?25h[?2026l]0;⠇ ⠇ | scratch[?2026h[?25ltwo[?25h[?2026l[?2026h[?25lbullets[?25h[?2026l[?2026h[?25l.[?25h[?2026l]0;⠏ ⠏ | scratch[?2026h[?25l⠏[?25h[?2026l]0;⠋ ⠋ | scratch[?2026h[?25l⠋[?25h[?2026l[?2026h[?25l•Working(2s • esc to interrupt)[?25h[?2026l]0;⠙ ⠙ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠹ ⠹ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠸ ⠸ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠼ ⠼ | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25l3[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠴ ⠴ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠦ ⠦ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠧ ⠧ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠇ ⠇ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠏ ⠏ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠋ ⠋ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ ⠙ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠹ ⠹ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠸ ⠸ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠼ ⠼ | scratch[?2026h[?25h[?2026l[?2026h[?25l•Explored  └ Listrg--files-g'*'-g'.*'    + Show details                                                                                                      [?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l4[?25h[?2026l[?2026h[?25l⠼[?25h[?2026l[?2026h[?25h[?2026l]0;⠴ ⠴ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠦ ⠦ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠧ ⠧ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠇ ⠇ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠏ ⠏ | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠋ ⠋ | scratch[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ ⠙ | scratch[?2026h[?25h[?2026l[?2026h[?25l•⠙[?25h[?2026l]0;⠙ scratch]0;⠙ List and summarize files | scratch[?2026h[?25lList and summarize files[?25h[?2026l[?2026h[?25h[?2026l]0;⠹ List and summarize files | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠸ List and summarize files | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠼ List and summarize files | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25l5[?25h[?2026l[?2026h[?25h[?2026l]0;⠴ List and summarize files | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠦ List and summarize files | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠧ List and summarize files | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠇ List and summarize files | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠏ List and summarize files | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠋ List and summarize files | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ List and summarize files | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠹ List and summarize files | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠸ List and summarize files | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠼ List and summarize files | scratch[?2026h[?25h[?2026l[?2026h[?25l6[?25h[?2026l[?2026h[?25h[?2026l]0;⠴ List and summarize files | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠦ List and summarize files | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠧ List and summarize files | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠇ List and summarize files | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠏ List and summarize files | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠋ List and summarize files | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ List and summarize files | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠹ List and summarize files | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠸ List and summarize files | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠼ List and summarize files | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25l7[?25h[?2026l[?2026h[?25l    Read README.md,notes.txt    + Show details                                                                                                      [?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠴ List and summarize files | scratch[?2026h[?25l•[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠦ List and summarize files | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠧ List and summarize files | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠇ List and summarize files | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l•[?25h[?2026l]0;⠏ List and summarize files | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠋ List and summarize files | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ List and summarize files | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l• •` [?25h[?2026l[?2026h[?25lREADME[?25h[?2026l[?2026h[?25l.md[?25h[?2026l]0;⠹ List and summarize files | scratch[?2026h[?25lREADME.md[?25h[?2026l[?2026h[?25l—[?25h[?2026l[?2026h[?25lcontainsthe[?25h[?2026l[?2026h[?25lheading[?25h[?2026l[?2026h[?25l“[?25h[?2026l]0;⠸ List and summarize files | scratch[?2026h[?25lscratch[?25h[?2026l[?2026h[?25l.”[?25h[?2026l[?2026h[?25l•`[?25h[?2026l[?2026h[?25lnotes[?25h[?2026l]0;⠼ List and summarize files | scratch[?2026h[?25l.txt[?25h[?2026l]0;⠴ List and summarize files | scratch]0;⠦ List and summarize files | scratch[?2026h[?25lnotes.txt —containsthetext“hello[?25h[?2026l[?2026h[?25l.”[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠧ List and summarize files | scratch[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;List and summarize files | scratch[?2026h[?25l  9:46 PM                                                                                                               [?25h[?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0-158-0-trustprompt.meta.json b/src/main/runtime/__fixtures__/codex-0-158-0-trustprompt.meta.json
new file mode 100644
index 00000000000..a80d88f5af9
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0-158-0-trustprompt.meta.json
@@ -0,0 +1,15 @@
+{
+  "capturedAt": "2026-09-29T01:32:55.701Z",
+  "platform": "darwin",
+  "command": [
+    "codex",
+    "--no-daemon",
+    "-c",
+    "check_for_update_on_startup=false",
+    "--dangerously-bypass-approvals-and-sandbox"
+  ],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.158.0: launch in an untrusted folder; the recording ends on the unanswered trust dialog. STA-8834.",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/codex-0-158-0-trustprompt.txt b/src/main/runtime/__fixtures__/codex-0-158-0-trustprompt.txt
new file mode 100644
index 00000000000..fd002b0fe04
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0-158-0-trustprompt.txt
@@ -0,0 +1 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l>_ OpenAI Codex (v0.158.0)loadingHello, world. Hello, you.⣀⣤⣤⣤⣀⣀⣠⣶⣿⣿⣿⣿⣿⣿⣿⣿⣦⣤⣤⣤⣤⣤⣤⡀⢀⣾⣿⣿⠿⠋⠉⠉⢉⣭⣿⣿⣿⣿⣿⠿⣿⣿⣿⣿⣷⣄⣀⣾⣿⣿⠃⣀⣴⣾⣿⣿⡿⠟⠋⣀⡀⠈⠙⢿⣿⣿⣧⣀⣶⣿⣿⣿⣿⡇⢸⣿⣿⡿⠛⠉⢀⣠⣴⣿⣿⣿⣷⣦⣀⠈⢻⣿⣿⡇⣰⣿⣿⡿⢿⣿⣿⡇⢸⣿⣿⢀⣤⣶⣿⣿⣿⠟⠛⠻⣿⣿⣿⣿⣮⣿⣿⡷⢰⣿⣿⡟⠁⢸⣿⣿⡇⢸⣿⣿⣿⣿⠿⠿⣿⣿⣿⣦⣄⡀⠈⠛⠿⣿⣿⣿⣧⡀⣾⣿⣿⠃⢸⣿⣿⡇⢸⣿⣿⠋⠁⠈⠙⢻⣿⣿⣿⣶⣤⡀⠹⢿⣿⣷⡄⢸⣿⣿⣇⠸⣿⣿⣷⣦⣼⣿⣿⢸⣿⣿⠻⢿⣿⣿⡇⠘⣿⣿⣿⠈⢿⣿⣿⣦⡀⠈⠛⠿⣿⣿⣿⣿⣄⡀⢀⣠⣼⣿⣿⣿⣿⡇⣿⣿⣿⠇⢻⣿⣿⣿⣷⣦⣀⠈⠙⠻⣿⣿⣿⣶⣶⣿⣿⣿⣿⣿⣿⣿⡇⣠⣿⣿⣿⢸⣿⣿⡿⢿⣿⣿⣿⣦⣠⣴⣿⣿⣿⡿⠟⠋⢸⣿⣿⣿⣿⣷⣴⣿⣿⣿⠃⠘⣿⣿⣷⠈⠛⢿⣿⣿⣿⠿⠋⠉⣠⣴⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠻⣿⣿⣿⣤⣀⠈⠉⢀⣤⣶⣿⣿⣿⠿⠟⠁⣰⣿⣿⡟⠋⠁⠈⠿⣿⣿⣿⣿⣶⣾⣿⣿⣿⣿⠟⠋⠁⣠⣼⣿⣿⡟⠙⠛⠛⠛⠻⠛⢿⣿⣿⣿⣿⣷⣾⣿⣿⣿⡿⠏⠈⠙⠛⠿⠿⠿⠿⠛⠉›Ask Codex to do anything?forshortcuts[0 q [?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l~/orca-lanes/sta8834/corpus/scratch  permissions: YOLO modeHello, world. Hello, you.[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?1006l[?1015l[?1003l[?1002l[?1000l[?1007h[?2026h[?25l  Folder access/Users/xxxxxx/orca-lanes/sta8834/corpus/scratch                                                                      Trustthisfolder?Codexcanread,edit,andrunfileshere,subjecttoyourpermissionsettings.Foldersettingscan run code automatically,evenwithoutamodelrequest.Continueonlyifyoutrustthesefiles.Yourtrustdecisionwillbesaved.› 1. Trust and continue                                                                                                 2.Quitenter continue · esc quit [?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0157-config-override-embedded-warning.meta.json b/src/main/runtime/__fixtures__/codex-0157-config-override-embedded-warning.meta.json
new file mode 100644
index 00000000000..9adb710aced
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-config-override-embedded-warning.meta.json
@@ -0,0 +1,14 @@
+{
+  "capturedAt": "2026-09-27T20:00:34.230Z",
+  "platform": "darwin",
+  "command": [
+    "codex",
+    "--dangerously-bypass-approvals-and-sandbox",
+    "-c",
+    "model_reasoning_effort=high"
+  ],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.157.1 with only -c model_reasoning_effort. Same embedded-warning cell-diff header repaint as the -m/-c launch (STA-8628). Worktree-path leaf redacted by the recorder scan.",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/codex-0157-config-override-embedded-warning.txt b/src/main/runtime/__fixtures__/codex-0157-config-override-embedded-warning.txt
new file mode 100644
index 00000000000..8a5d933c1cc
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-config-override-embedded-warning.txt
@@ -0,0 +1 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l╭───────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.1)            ││                                       ││ model:     loading   /model to change ││ directory: loading                    │╰───────────────────────────────────────╯›Ask Codex to do anything?forshortcuts[0 q╭[?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l───────────────────╮                   │                   │  loading  /model to change                  │  ~/orca/…/orca/…start-for-codex-times-out-at ││ permissions: YOLO mode                                   │╰──────────────────────────────────────────────────────────╯[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;sta-8628-bug-worker-s...[?2026h[?25l ╭──────────────────────────────────────────────────────────╮>_OpenAI Codex(v0.157.1)                           modl:    loading   /model to change                 diectory:  ~/orca/…/orca/…start-for-codex-times-out-at│ permissions: YOLO mode                                   │╰──────────────────────────────────────────────────────────╯Tip:Use/inittocreateanAGENTS.mdwithproject-specificguidance.GPT-6-Sol default·~/orca/workspaces/orca/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX⚠1 warning·f2toview[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ sta-8628-bug-worker-s...[?2026h[?25l╭──────────────────────────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.1)                               │                        model:GPT-6-Sol high/modeltochangedirctory:~/orca/…/orca/…start-for-codex-times-out-atpemissions:YOLO mode                                  ╰──────────────────────────────────────────────────────────╯ high · ~/orca/workspaces/orca/sta-862-bug-worke-star-for-codex-times-out-a[?25h[?2026l[?2026h[?25h[?2026l]0;sta-8628-bug-worker-s...[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0157-effort-override-embedded-warning.meta.json b/src/main/runtime/__fixtures__/codex-0157-effort-override-embedded-warning.meta.json
new file mode 100644
index 00000000000..602cf71904b
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-effort-override-embedded-warning.meta.json
@@ -0,0 +1,16 @@
+{
+  "capturedAt": "2026-09-27T19:35:31.761Z",
+  "platform": "darwin",
+  "command": [
+    "codex",
+    "--dangerously-bypass-approvals-and-sandbox",
+    "-m",
+    "gpt-6-sol",
+    "-c",
+    "model_reasoning_effort=high"
+  ],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.157.1 with -m and -c model_reasoning_effort (the worker-start argv). Embedded mode shows a startup warning and redraws the header by cell diff, so a line-folded tail reads `dirctory:` (STA-8628). Worktree-path leaf redacted by the recorder scan.",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/codex-0157-effort-override-embedded-warning.txt b/src/main/runtime/__fixtures__/codex-0157-effort-override-embedded-warning.txt
new file mode 100644
index 00000000000..04777d9a88c
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-effort-override-embedded-warning.txt
@@ -0,0 +1 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l╭───────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.1)            ││                                       ││ model:     loading   /model to change ││ directory: loading                    │╰───────────────────────────────────────╯›Ask Codex to do anything?forshortcuts[0 q╭[?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l───────────────────╮                   │                   │  loading  /model to change                  │  ~/orca/…/orca/…start-for-codex-times-out-at ││ permissions: YOLO mode                                   │╰──────────────────────────────────────────────────────────╯[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;sta-8628-bug-worker-s...[?2026h[?25h[?2026l[?2026h[?25l ╭──────────────────────────────────────────────────────────╮>_OpenAI Codex(v0.157.1)                           modl:    loading   /model to change                 diectory:  ~/orca/…/orca/…start-for-codex-times-out-at│ permissions: YOLO mode                                   │╰──────────────────────────────────────────────────────────╯Tip:Use/agentstoopentheagentcommandcenter.GPT-6-Sol default·~/orca/workspaces/orca/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX⚠1 warning·f2toview[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ sta-8628-bug-worker-s...[?2026h[?25l╭──────────────────────────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.1)                               │                        model:GPT-6-Sol high/modeltochangedirctory:~/orca/…/orca/…start-for-codex-times-out-atpemissions:YOLO mode                                  ╰──────────────────────────────────────────────────────────╯ high · ~/orca/workspaces/orca/sta-862-bug-worke-star-for-codex-times-out-a[?25h[?2026l[?2026h[?25h[?2026l]0;sta-8628-bug-worker-s...[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0157-fresh-home-daemon-install.meta.json b/src/main/runtime/__fixtures__/codex-0157-fresh-home-daemon-install.meta.json
new file mode 100644
index 00000000000..04203db4fbe
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-fresh-home-daemon-install.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-28T21:45:00.000Z",
+  "platform": "darwin",
+  "command": ["codex", "--dangerously-bypass-approvals-and-sandbox"],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.157.0, plain launch (no -m/-c) on a fresh CODEX_HOME. The provisional screen reads `model: loading` while Codex installs and starts its shared daemon (`Installing daemon from CLI version 0.157.0`); 0.157 discards typed input during that start. The live header fills in at the end. Cut 6 s after spawn. Home-directory user name redacted by hand, same length.",
+  "exitCode": null
+}
diff --git a/src/main/runtime/__fixtures__/codex-0157-fresh-home-daemon-install.txt b/src/main/runtime/__fixtures__/codex-0157-fresh-home-daemon-install.txt
new file mode 100644
index 00000000000..a6aa2c9af2c
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-fresh-home-daemon-install.txt
@@ -0,0 +1,2 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l╭───────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.0)            ││                                       ││ model:     loading   /model to change ││ directory: loading                    │╰───────────────────────────────────────╯ › Ask Codex to do anything ? for shortcuts[0 q╭[?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l─────────────╮             │             │  loading  /model to change            │  /Users/user1/cr/rounds/x157fresh/repo ││ permissions: YOLO mode                             │╰────────────────────────────────────────────────────╯[?25h[?2026l[?2026h[?25h[?2026l[?1006l[?1015l[?1003l[?1002l[?1000l[<1u[?1007l[?1049l[<1u[>4;0m[?2004l[?1004l[0 q[?25hInstalling daemon from CLI version 0.157.0 into /Users/user1/cr/rounds/x157fresh/home/.codex/packages/app-server-daemon...
+[?2004h[>4;0m[>7u[?1004h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l╭────────────────────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.0)                         ││                                                    ││ model:       loading   /model to change            ││ directory:   /Users/user1/cr/rounds/x157fresh/repo ││ permissions: YOLO mode                             │╰────────────────────────────────────────────────────╯ › Ask Codex to do anything ? for shortcuts[0 q╭[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;repo[?2026h[?25h[?2026l[?2026h[?25lTip: Visit the ]8;;https://community.openai.com/c/codex/37Codex community forum]8;; (]8;;https://community.openai.com/c/codex/37https://community.openai.com/c/codex/37]8;;).GPT-6-Astra default · /Users/user1/cr/rounds/x157fresh/repo←agens · ? for shortcuts[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ repo]0;repo[?2026h[?25lGPT-6-Astra   /model to change⠈⢀⠁⠂⠄⠈⠁⠈⠁⠈⢀⠠⠄⠠⢀⠠⡀⠠⠁⢀⠁[?25h[?2026l[?2026h[?25l⠄[?25h[?2026l[?2026h[?25l⠄[?25h[?2026l[?2026h[?25l⠈⢀⠁⠐⠂⠄⠈⠁⠈⠁⠈⢀⠠⠄⠠⢀⠠⠄⡀⠈⠠⠁⢀⠁[?25h[?2026l[?2026h[?25l⠈⢀⠁⠐⠂⠄⠈⠁⠈⠁⠈⢀⠠⠄⠠⢀⠠⠄⡀⠈⠠⠁⢀[?25h[?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0157-hooks-review-dialog.meta.json b/src/main/runtime/__fixtures__/codex-0157-hooks-review-dialog.meta.json
new file mode 100644
index 00000000000..ebc2a471a20
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-hooks-review-dialog.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-29T03:30:27.000Z",
+  "platform": "darwin",
+  "command": ["codex", "--dangerously-bypass-approvals-and-sandbox"],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.157.0, plain launch on a fresh CODEX_HOME with a hooks.json of 8 command hooks that were never trusted. Over the provisional screen Codex paints `Hooks need review`, `1. Review hooks` / `2. Trust all and continue` / `3. Continue without trusting (hooks won't run)` and the key row `enter confirm · esc skip`, where older builds wrote `Press enter to confirm`. No key was sent (only automatic terminal-query replies). Cut 6 s after spawn. Home-directory user name redacted by hand, same length.",
+  "exitCode": null
+}
diff --git a/src/main/runtime/__fixtures__/codex-0157-hooks-review-dialog.txt b/src/main/runtime/__fixtures__/codex-0157-hooks-review-dialog.txt
new file mode 100644
index 00000000000..14b1ad743e1
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-hooks-review-dialog.txt
@@ -0,0 +1,2 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l╭───────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.0)            ││                                       ││ model:     loading   /model to change ││ directory: loading                    │╰───────────────────────────────────────╯ › Ask Codex to do anything ? for shortcuts[0 q╭[?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l───────────╮           │           │  loading  /model to change          │  /Users/user1/cr/rounds/dlg-h57/repo ││ permissions: YOLO mode                           │╰──────────────────────────────────────────────────╯[?25h[?2026l[?1006l[?1015l[?1003l[?1002l[?1000l[<1u[?1007l[?1049l[<1u[>4;0m[?2004l[?1004l[0 q[?25hInstalling daemon from CLI version 0.157.0 into /Users/user1/cr/rounds/dlg-h57/home/.codex/packages/app-server-daemon...
+[?2004h[>4;0m[>7u[?1004h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l╭──────────────────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.0)                       ││                                                  ││ model:       loading   /model to change          ││ directory:   /Users/user1/cr/rounds/dlg-h57/repo ││ permissions: YOLO mode                           │╰──────────────────────────────────────────────────╯ › Ask Codex to do anything ? for shortcuts[0 q╭[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l   Hooks need review  8 hooks are new or changed.  Hooks can run outside the sandbox after you trust them.  › 1. Review hooks                                                                                                         2. Trust all and continue  3. Continue without trusting (hooks won't run) enter confirm · esc skip                                                                                                 [?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0157-model-retired-dialog.meta.json b/src/main/runtime/__fixtures__/codex-0157-model-retired-dialog.meta.json
new file mode 100644
index 00000000000..0e97bbe4715
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-model-retired-dialog.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-29T03:31:06.000Z",
+  "platform": "darwin",
+  "command": ["codex", "--dangerously-bypass-approvals-and-sandbox"],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.157.0, plain launch on a fresh CODEX_HOME whose config.toml sets model = \"gpt-5.4-mini\", a model missing from 0.157's catalog, so Codex shows its retired-model notice without choices: `GPT-5.4 Mini is no longer available`, `Switch to GPT-6 Luna to continue.` and the key row `enter/esc continue · ctrl+c quit`. Enter or Esc switches the model; the heading comes from the model catalog, not the older `Codex just got an upgrade` wording. No key was sent (only automatic terminal-query replies). Cut 6 s after spawn. Home-directory user name redacted by hand, same length.",
+  "exitCode": null
+}
diff --git a/src/main/runtime/__fixtures__/codex-0157-model-retired-dialog.txt b/src/main/runtime/__fixtures__/codex-0157-model-retired-dialog.txt
new file mode 100644
index 00000000000..776b261a2d6
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-model-retired-dialog.txt
@@ -0,0 +1,2 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l╭───────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.0)            ││                                       ││ model:     loading   /model to change ││ directory: loading                    │╰───────────────────────────────────────╯ › Ask Codex to do anything ? for shortcuts[0 q╭[?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l───────────╮           │           │  loading  /model to change          │  /Users/user1/cr/rounds/dlg-m57/repo ││ permissions: YOLO mode                           │╰──────────────────────────────────────────────────╯[?25h[?2026l[?1006l[?1015l[?1003l[?1002l[?1000l[<1u[?1007l[?1049l[<1u[>4;0m[?2004l[?1004l[0 q[?25hInstalling daemon from CLI version 0.157.0 into /Users/user1/cr/rounds/dlg-m57/home/.codex/packages/app-server-daemon...
+[?2004h[>4;0m[>7u[?1004h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l╭──────────────────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.0)                       ││                                                  ││ model:       loading   /model to change          ││ directory:   /Users/user1/cr/rounds/dlg-m57/repo ││ permissions: YOLO mode                           │╰──────────────────────────────────────────────────╯ › Ask Codex to do anything ? for shortcuts[0 q╭[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l   GPT-5.4 Mini is no longer available   Codex now uses GPT-6 Luna in place of GPT-5.4 Mini. Switch to GPT-6 Luna to continue.  enter/esc continue · ctrl+c quit     [?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0157-no-daemon-effort-override.meta.json b/src/main/runtime/__fixtures__/codex-0157-no-daemon-effort-override.meta.json
new file mode 100644
index 00000000000..91a98c0b0c7
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-no-daemon-effort-override.meta.json
@@ -0,0 +1,17 @@
+{
+  "capturedAt": "2026-09-27T20:48:19.864Z",
+  "platform": "darwin",
+  "command": [
+    "codex",
+    "--no-daemon",
+    "--dangerously-bypass-approvals-and-sandbox",
+    "-m",
+    "gpt-6-sol",
+    "-c",
+    "model_reasoning_effort=high"
+  ],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.157.1 with --no-daemon, -m and -c model_reasoning_effort. No startup warning; header fills in from `loading`. Worktree-path leaf redacted by the recorder scan.",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/codex-0157-no-daemon-effort-override.txt b/src/main/runtime/__fixtures__/codex-0157-no-daemon-effort-override.txt
new file mode 100644
index 00000000000..e6e8d151af5
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-no-daemon-effort-override.txt
@@ -0,0 +1 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l╭───────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.1)            ││                                       ││ model:     loading   /model to change ││ directory: loading                    │╰───────────────────────────────────────╯›Ask Codex to do anything?forshortcuts[0 q╭[?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l───────────────────╮                   │                   │  loading  /model to change                  │  ~/orca/…/orca/…start-for-codex-times-out-at ││ permissions: YOLO mode                                   │╰──────────────────────────────────────────────────────────╯[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;sta-8628-bug-worker-s...[?2026h[?25lTip:NEW:Preventsleepwhilerunningisnowavailablein/experimental.GPT-6-Sol default·~/orca/workspaces/orca/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ sta-8628-bug-worker-s...[?2026h[?25lGPT-6-Sol high  /model tochangehigh · ~/orca/workspaces/orca/sta-862-bug-worke-star-for-codex-times-out-a[?25h[?2026l[?2026h[?25h[?2026l]0;⠹ sta-8628-bug-worker-s...]0;sta-8628-bug-worker-s...[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0157-plain-ready.meta.json b/src/main/runtime/__fixtures__/codex-0157-plain-ready.meta.json
new file mode 100644
index 00000000000..07d30431d7b
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-plain-ready.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-27T19:35:31.758Z",
+  "platform": "darwin",
+  "command": ["codex", "--dangerously-bypass-approvals-and-sandbox"],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.157.1, plain launch (no -m/-c). Header paints with `loading` rows, then fills in; the ready baseline for STA-8628. Worktree-path leaf redacted by the recorder scan.",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/codex-0157-plain-ready.txt b/src/main/runtime/__fixtures__/codex-0157-plain-ready.txt
new file mode 100644
index 00000000000..c346994bd91
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-plain-ready.txt
@@ -0,0 +1 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l╭───────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.1)            ││                                       ││ model:     loading   /model to change ││ directory: loading                    │╰───────────────────────────────────────╯›Ask Codex to do anything?forshortcuts[0 q╭[?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l───────────────────╮                   │                   │  loading  /model to change                  │  ~/orca/…/orca/…start-for-codex-times-out-at ││ permissions: YOLO mode                                   │╰──────────────────────────────────────────────────────────╯[?25h[?2026l[?1006l[?1015l[?1003l[?1002l[?1000l[<1u[?1007l[?1049l[<1u[>4;0m[?2004l[?1004l[0 q[?25h[?2004h[>4;0m[>7u[?1004h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l╭──────────────────────────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.1)                               ││                                                          ││ model:       loading   /model to change                  ││ directory:   ~/orca/…/orca/…start-for-codex-times-out-at ││ permissions: YOLO mode                                   │╰──────────────────────────────────────────────────────────╯›Ask Codex to do anything?forshortcuts[0 q╭[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;sta-8628-bug-worker-s...[?2026h[?25h[?2026l[?2026h[?25lTip:Use/agentstoopentheagentcommandcenter.GPT-6-Sol default·~/orca/workspaces/orca/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX←agens · ?forshortcuts[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ sta-8628-bug-worker-s...[?2026h[?25lGPT-6-Sol medium  /model tochangemdim · ~/orca/workspaces/orca/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;sta-8628-bug-worker-s...[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0157-update-available-dialog.meta.json b/src/main/runtime/__fixtures__/codex-0157-update-available-dialog.meta.json
new file mode 100644
index 00000000000..a81301d2215
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-update-available-dialog.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-29T03:29:52.000Z",
+  "platform": "darwin",
+  "command": ["codex", "--dangerously-bypass-approvals-and-sandbox"],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.157.0, plain launch on a fresh CODEX_HOME whose config.toml sets check_for_update_on_startup = true, with a version.json cache naming 0.159.0 checked moments earlier (so no network check) and CODEX_MANAGED_BY_NPM=1 so Codex offers an update command. Over the provisional screen Codex paints `Update available · 0.157.0 → 0.159.0`, `1. Update now (runs `npm install -g @openai/codex`)` / `2. Skip` / `3. Skip until next version` and the key row `enter continue · esc skip`, where older builds wrote `Press enter to continue`. Enter picks Update now. No key was sent (only automatic terminal-query replies). Cut 6 s after spawn. Home-directory user name redacted by hand, same length.",
+  "exitCode": null
+}
diff --git a/src/main/runtime/__fixtures__/codex-0157-update-available-dialog.txt b/src/main/runtime/__fixtures__/codex-0157-update-available-dialog.txt
new file mode 100644
index 00000000000..4701e63af24
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-update-available-dialog.txt
@@ -0,0 +1,2 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l╭───────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.0)            ││                                       ││ model:     loading   /model to change ││ directory: loading                    │╰───────────────────────────────────────╯ › Ask Codex to do anything ? for shortcuts[0 q╭[?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l───────────╮           │           │  loading  /model to change          │  /Users/user1/cr/rounds/dlg-u57/repo ││ permissions: YOLO mode                           │╰──────────────────────────────────────────────────╯[?25h[?2026l[?2026h[?25h[?2026l[?1006l[?1015l[?1003l[?1002l[?1000l[<1u[?1007l[?1049l[<1u[>4;0m[?2004l[?1004l[0 q[?25hInstalling daemon from CLI version 0.157.0 into /Users/user1/cr/rounds/dlg-u57/home/.codex/packages/app-server-daemon...
+[?2004h[>4;0m[>7u[?1004h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l╭──────────────────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.0)                       ││                                                  ││ model:       loading   /model to change          ││ directory:   /Users/user1/cr/rounds/dlg-u57/repo ││ permissions: YOLO mode                           │╰──────────────────────────────────────────────────╯ › Ask Codex to do anything ? for shortcuts[0 q╭[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l   Update available · 0.157.0 → 0.159.0  Release notes: ]8;;https://github.com/openai/codex/releases/latesthttps://github.com/openai/codex/releases/latest]8;; › 1. Update now (runs `npm install -g @openai/codex`)                                                                     2. Skip  3. Skip until next version   enter continue · esc skip    [?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0158-fresh-home-greeting.meta.json b/src/main/runtime/__fixtures__/codex-0158-fresh-home-greeting.meta.json
new file mode 100644
index 00000000000..ea7d9513a9f
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0158-fresh-home-greeting.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-28T21:44:00.000Z",
+  "platform": "darwin",
+  "command": ["codex", "--dangerously-bypass-approvals-and-sandbox"],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.158.0, plain launch (no -m/-c) on a fresh CODEX_HOME. Greeting layout: an unboxed `>_ OpenAI Codex (v0.158.0)` header with no model:/directory: labels, starting from a provisional screen whose directory reads `loading`; the live status row under the composer appears last. Braille logo animation frames included. Cut 4.6 s after spawn. Home-directory user name redacted by hand, same length.",
+  "exitCode": null
+}
diff --git a/src/main/runtime/__fixtures__/codex-0158-fresh-home-greeting.txt b/src/main/runtime/__fixtures__/codex-0158-fresh-home-greeting.txt
new file mode 100644
index 00000000000..72670b00f4b
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0158-fresh-home-greeting.txt
@@ -0,0 +1 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l>_ OpenAI Codex (v0.158.0)loadingShall we see where this goes?⣀⣤⣤⣤⣀⣀⣠⣶⣿⣿⣿⣿⣿⣿⣿⣿⣦⣤⣤⣤⣤⣤⣤⡀⢀⣾⣿⣿⠿⠋⠉⠉⢉⣭⣿⣿⣿⣿⣿⠿⣿⣿⣿⣿⣷⣄⣀⣾⣿⣿⠃⣀⣴⣾⣿⣿⡿⠟⠋⣀⡀⠈⠙⢿⣿⣿⣧⣀⣶⣿⣿⣿⣿⡇⢸⣿⣿⡿⠛⠉⢀⣠⣴⣿⣿⣿⣷⣦⣀⠈⢻⣿⣿⡇⣰⣿⣿⡿⢿⣿⣿⡇⢸⣿⣿⢀⣤⣶⣿⣿⣿⠟⠛⠻⣿⣿⣿⣿⣮⣿⣿⡷⢰⣿⣿⡟⠁⢸⣿⣿⡇⢸⣿⣿⣿⣿⠿⠿⣿⣿⣿⣦⣄⡀⠈⠛⠿⣿⣿⣿⣧⡀⣾⣿⣿⠃⢸⣿⣿⡇⢸⣿⣿⠋⠁⠈⠙⢻⣿⣿⣿⣶⣤⡀⠹⢿⣿⣷⡄⢸⣿⣿⣇⠸⣿⣿⣷⣦⣼⣿⣿⢸⣿⣿⠻⢿⣿⣿⡇⠘⣿⣿⣿⠈⢿⣿⣿⣦⡀⠈⠛⠿⣿⣿⣿⣿⣄⡀⢀⣠⣼⣿⣿⣿⣿⡇⣿⣿⣿⠇⢻⣿⣿⣿⣷⣦⣀⠈⠙⠻⣿⣿⣿⣶⣶⣿⣿⣿⣿⣿⣿⣿⡇⣠⣿⣿⣿⢸⣿⣿⡿⢿⣿⣿⣿⣦⣠⣴⣿⣿⣿⡿⠟⠋⢸⣿⣿⣿⣿⣷⣴⣿⣿⣿⠃⠘⣿⣿⣷⠈⠛⢿⣿⣿⣿⠿⠋⠉⣠⣴⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠻⣿⣿⣿⣤⣀⠈⠉⢀⣤⣶⣿⣿⣿⠿⠟⠁⣰⣿⣿⡟⠋⠁⠈⠿⣿⣿⣿⣿⣶⣾⣿⣿⣿⣿⠟⠋⠁⣠⣼⣿⣿⡟⠙⠛⠛⠛⠻⠛⢿⣿⣿⣿⣿⣷⣾⣿⣿⣿⡿⠏⠈⠙⠛⠿⠿⠿⠿⠛⠉ › Ask Codex to do anything ? for shortcuts[0 q [?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l/Users/user1/cr/rounds/x158fresh/repo  permissions: YOLO modeShall we see where this goes?[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;repo[?2026h[?25h[?2026l[?2026h[?25lGPT-6-Astra default · /Users/user1/cr/rounds/x158fresh/repo←agens · ? for shortcuts[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠋ repo[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ repo[?2026h[?25h[?2026l]0;repo[?2026h[?25l⠈⢀⠁⠂⠄⠈⠁⠈⠁⠈⢀⠠⠄⠠⢀⠠⡀⠠⠁⢀⠁[?25h[?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0158-hooks-review-dialog.meta.json b/src/main/runtime/__fixtures__/codex-0158-hooks-review-dialog.meta.json
new file mode 100644
index 00000000000..896d3474482
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0158-hooks-review-dialog.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-29T03:30:46.000Z",
+  "platform": "darwin",
+  "command": ["codex", "--dangerously-bypass-approvals-and-sandbox"],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.158.0, plain launch on a fresh CODEX_HOME with a hooks.json of 8 command hooks that were never trusted. Over the provisional screen Codex paints `Hooks need review`, `1. Review hooks` / `2. Trust all and continue` / `3. Continue without trusting (hooks won't run)` and the key row `enter confirm · esc skip`, where older builds wrote `Press enter to confirm`. No key was sent (only automatic terminal-query replies). Cut 6 s after spawn. Home-directory user name redacted by hand, same length.",
+  "exitCode": null
+}
diff --git a/src/main/runtime/__fixtures__/codex-0158-hooks-review-dialog.txt b/src/main/runtime/__fixtures__/codex-0158-hooks-review-dialog.txt
new file mode 100644
index 00000000000..ad25e6eda6e
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0158-hooks-review-dialog.txt
@@ -0,0 +1 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l>_ OpenAI Codex (v0.158.0)loadingBring your unfinished thoughts.⣀⣤⣤⣤⣀⣀⣠⣶⣿⣿⣿⣿⣿⣿⣿⣿⣦⣤⣤⣤⣤⣤⣤⡀⢀⣾⣿⣿⠿⠋⠉⠉⢉⣭⣿⣿⣿⣿⣿⠿⣿⣿⣿⣿⣷⣄⣀⣾⣿⣿⠃⣀⣴⣾⣿⣿⡿⠟⠋⣀⡀⠈⠙⢿⣿⣿⣧⣀⣶⣿⣿⣿⣿⡇⢸⣿⣿⡿⠛⠉⢀⣠⣴⣿⣿⣿⣷⣦⣀⠈⢻⣿⣿⡇⣰⣿⣿⡿⢿⣿⣿⡇⢸⣿⣿⢀⣤⣶⣿⣿⣿⠟⠛⠻⣿⣿⣿⣿⣮⣿⣿⡷⢰⣿⣿⡟⠁⢸⣿⣿⡇⢸⣿⣿⣿⣿⠿⠿⣿⣿⣿⣦⣄⡀⠈⠛⠿⣿⣿⣿⣧⡀⣾⣿⣿⠃⢸⣿⣿⡇⢸⣿⣿⠋⠁⠈⠙⢻⣿⣿⣿⣶⣤⡀⠹⢿⣿⣷⡄⢸⣿⣿⣇⠸⣿⣿⣷⣦⣼⣿⣿⢸⣿⣿⠻⢿⣿⣿⡇⠘⣿⣿⣿⠈⢿⣿⣿⣦⡀⠈⠛⠿⣿⣿⣿⣿⣄⡀⢀⣠⣼⣿⣿⣿⣿⡇⣿⣿⣿⠇⢻⣿⣿⣿⣷⣦⣀⠈⠙⠻⣿⣿⣿⣶⣶⣿⣿⣿⣿⣿⣿⣿⡇⣠⣿⣿⣿⢸⣿⣿⡿⢿⣿⣿⣿⣦⣠⣴⣿⣿⣿⡿⠟⠋⢸⣿⣿⣿⣿⣷⣴⣿⣿⣿⠃⠘⣿⣿⣷⠈⠛⢿⣿⣿⣿⠿⠋⠉⣠⣴⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠻⣿⣿⣿⣤⣀⠈⠉⢀⣤⣶⣿⣿⣿⠿⠟⠁⣰⣿⣿⡟⠋⠁⠈⠿⣿⣿⣿⣿⣶⣾⣿⣿⣿⣿⠟⠋⠁⣠⣼⣿⣿⡟⠙⠛⠛⠛⠻⠛⢿⣿⣿⣿⣿⣷⣾⣿⣿⣿⡿⠏⠈⠙⠛⠿⠿⠿⠿⠛⠉ › Ask Codex to do anything ? for shortcuts[0 q [?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l/Users/user1/cr/rounds/dlg-h58/repo  permissions: YOLO modeBring your unfinished thoughts.[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l   Hooks need review  8 hooks are new or changed.  Hooks can run outside the sandbox after you trust them.  › 1. Review hooks                                                                                                         2. Trust all and continue  3. Continue without trusting (hooks won't run) enter confirm · esc skip                                                                                                 [?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0158-model-announcement-dialog.meta.json b/src/main/runtime/__fixtures__/codex-0158-model-announcement-dialog.meta.json
new file mode 100644
index 00000000000..05790b10e95
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0158-model-announcement-dialog.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-28T21:44:30.000Z",
+  "platform": "darwin",
+  "command": ["codex", "--dangerously-bypass-approvals-and-sandbox"],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.158.0, plain launch on a fresh CODEX_HOME whose config.toml sets an older model with an available upgrade. After the provisional screen, Codex paints its model announcement (`Meet GPT-6 Sol`, `1. Try new model` / `2. Use existing model`, `enter/esc confirm`), which owns Enter. Cut 6 s after spawn. Home-directory user name redacted by hand, same length.",
+  "exitCode": null
+}
diff --git a/src/main/runtime/__fixtures__/codex-0158-model-announcement-dialog.txt b/src/main/runtime/__fixtures__/codex-0158-model-announcement-dialog.txt
new file mode 100644
index 00000000000..a5c88157d74
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0158-model-announcement-dialog.txt
@@ -0,0 +1 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l>_ OpenAI Codex (v0.158.0)loadingHere for a quick fix or the extended edition?⣀⣤⣤⣤⣀⣀⣠⣶⣿⣿⣿⣿⣿⣿⣿⣿⣦⣤⣤⣤⣤⣤⣤⡀⢀⣾⣿⣿⠿⠋⠉⠉⢉⣭⣿⣿⣿⣿⣿⠿⣿⣿⣿⣿⣷⣄⣀⣾⣿⣿⠃⣀⣴⣾⣿⣿⡿⠟⠋⣀⡀⠈⠙⢿⣿⣿⣧⣀⣶⣿⣿⣿⣿⡇⢸⣿⣿⡿⠛⠉⢀⣠⣴⣿⣿⣿⣷⣦⣀⠈⢻⣿⣿⡇⣰⣿⣿⡿⢿⣿⣿⡇⢸⣿⣿⢀⣤⣶⣿⣿⣿⠟⠛⠻⣿⣿⣿⣿⣮⣿⣿⡷⢰⣿⣿⡟⠁⢸⣿⣿⡇⢸⣿⣿⣿⣿⠿⠿⣿⣿⣿⣦⣄⡀⠈⠛⠿⣿⣿⣿⣧⡀⣾⣿⣿⠃⢸⣿⣿⡇⢸⣿⣿⠋⠁⠈⠙⢻⣿⣿⣿⣶⣤⡀⠹⢿⣿⣷⡄⢸⣿⣿⣇⠸⣿⣿⣷⣦⣼⣿⣿⢸⣿⣿⠻⢿⣿⣿⡇⠘⣿⣿⣿⠈⢿⣿⣿⣦⡀⠈⠛⠿⣿⣿⣿⣿⣄⡀⢀⣠⣼⣿⣿⣿⣿⡇⣿⣿⣿⠇⢻⣿⣿⣿⣷⣦⣀⠈⠙⠻⣿⣿⣿⣶⣶⣿⣿⣿⣿⣿⣿⣿⡇⣠⣿⣿⣿⢸⣿⣿⡿⢿⣿⣿⣿⣦⣠⣴⣿⣿⣿⡿⠟⠋⢸⣿⣿⣿⣿⣷⣴⣿⣿⣿⠃⠘⣿⣿⣷⠈⠛⢿⣿⣿⣿⠿⠋⠉⣠⣴⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠻⣿⣿⣿⣤⣀⠈⠉⢀⣤⣶⣿⣿⣿⠿⠟⠁⣰⣿⣿⡟⠋⠁⠈⠿⣿⣿⣿⣿⣶⣾⣿⣿⣿⣿⠟⠋⠁⣠⣼⣿⣿⡟⠙⠛⠛⠛⠻⠛⢿⣿⣿⣿⣿⣷⣾⣿⣿⣿⡿⠏⠈⠙⠛⠿⠿⠿⠿⠛⠉ › Ask Codex to do anything ? for shortcuts[0 q [?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l/Users/user1/cr/rounds/x158mig/repo  permissions: YOLO modeHere for a quick fix or the extended edition?[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l   Meet GPT-6 Sol   Our latest Sol is more intelligent and more efficient so your usage limits go further. This model is a great daily  driver for complex tasks, especially coding. › 1. Try new model                                                                                                        2. Use existing model   enter/esc confirm · ctrl+c quit    [?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0158-model-retired-dialog.meta.json b/src/main/runtime/__fixtures__/codex-0158-model-retired-dialog.meta.json
new file mode 100644
index 00000000000..92137927416
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0158-model-retired-dialog.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-29T03:31:56.000Z",
+  "platform": "darwin",
+  "command": ["codex", "--dangerously-bypass-approvals-and-sandbox"],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.158.0, plain launch on a fresh CODEX_HOME whose config.toml sets model_provider = \"amazon-bedrock\" and model = \"openai.gpt-5.4\" (0.158 keeps the notice for a model missing from its catalog only on the OpenAI and Bedrock providers, and the OpenAI provider asks for a sign-in first, which the rig does not have). Codex shows the notice without choices: `GPT-5.4 on Amazon Bedrock is no longer offered in Codex`, `Switch to GPT-6 Sol on Amazon Bedrock to continue.` and the key row `enter/esc continue · ctrl+c quit`. Enter or Esc switches the model. No key was sent (only automatic terminal-query replies). Cut 6 s after spawn. Home-directory user name redacted by hand, same length.",
+  "exitCode": null
+}
diff --git a/src/main/runtime/__fixtures__/codex-0158-model-retired-dialog.txt b/src/main/runtime/__fixtures__/codex-0158-model-retired-dialog.txt
new file mode 100644
index 00000000000..fd9fac82c43
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0158-model-retired-dialog.txt
@@ -0,0 +1 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l>_ OpenAI Codex (v0.158.0)loadingBring a question. Bonus points if it’s a weird one.⣀⣤⣤⣤⣀⣀⣠⣶⣿⣿⣿⣿⣿⣿⣿⣿⣦⣤⣤⣤⣤⣤⣤⡀⢀⣾⣿⣿⠿⠋⠉⠉⢉⣭⣿⣿⣿⣿⣿⠿⣿⣿⣿⣿⣷⣄⣀⣾⣿⣿⠃⣀⣴⣾⣿⣿⡿⠟⠋⣀⡀⠈⠙⢿⣿⣿⣧⣀⣶⣿⣿⣿⣿⡇⢸⣿⣿⡿⠛⠉⢀⣠⣴⣿⣿⣿⣷⣦⣀⠈⢻⣿⣿⡇⣰⣿⣿⡿⢿⣿⣿⡇⢸⣿⣿⢀⣤⣶⣿⣿⣿⠟⠛⠻⣿⣿⣿⣿⣮⣿⣿⡷⢰⣿⣿⡟⠁⢸⣿⣿⡇⢸⣿⣿⣿⣿⠿⠿⣿⣿⣿⣦⣄⡀⠈⠛⠿⣿⣿⣿⣧⡀⣾⣿⣿⠃⢸⣿⣿⡇⢸⣿⣿⠋⠁⠈⠙⢻⣿⣿⣿⣶⣤⡀⠹⢿⣿⣷⡄⢸⣿⣿⣇⠸⣿⣿⣷⣦⣼⣿⣿⢸⣿⣿⠻⢿⣿⣿⡇⠘⣿⣿⣿⠈⢿⣿⣿⣦⡀⠈⠛⠿⣿⣿⣿⣿⣄⡀⢀⣠⣼⣿⣿⣿⣿⡇⣿⣿⣿⠇⢻⣿⣿⣿⣷⣦⣀⠈⠙⠻⣿⣿⣿⣶⣶⣿⣿⣿⣿⣿⣿⣿⡇⣠⣿⣿⣿⢸⣿⣿⡿⢿⣿⣿⣿⣦⣠⣴⣿⣿⣿⡿⠟⠋⢸⣿⣿⣿⣿⣷⣴⣿⣿⣿⠃⠘⣿⣿⣷⠈⠛⢿⣿⣿⣿⠿⠋⠉⣠⣴⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠻⣿⣿⣿⣤⣀⠈⠉⢀⣤⣶⣿⣿⣿⠿⠟⠁⣰⣿⣿⡟⠋⠁⠈⠿⣿⣿⣿⣿⣶⣾⣿⣿⣿⣿⠟⠋⠁⣠⣼⣿⣿⡟⠙⠛⠛⠛⠻⠛⢿⣿⣿⣿⣿⣷⣾⣿⣿⣿⡿⠏⠈⠙⠛⠿⠿⠿⠿⠛⠉ › Ask Codex to do anything ? for shortcuts[0 q [?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l/Users/user1/cr/rounds/dlg-m58b/repo  permissions: YOLO modeBring a question. Bonus points if it’s a weird one.[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l   GPT-5.4 on Amazon Bedrock is no longer offered in Codex   Codex now uses GPT-6 Sol on Amazon Bedrock in place of GPT-5.4 on Amazon Bedrock. Switch to GPT-6 Sol on Amazon  Bedrock to continue.  enter/esc continue · ctrl+c quit    [?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0158-update-available-dialog.meta.json b/src/main/runtime/__fixtures__/codex-0158-update-available-dialog.meta.json
new file mode 100644
index 00000000000..db18029d308
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0158-update-available-dialog.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-29T03:30:10.000Z",
+  "platform": "darwin",
+  "command": ["codex", "--dangerously-bypass-approvals-and-sandbox"],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.158.0, plain launch on a fresh CODEX_HOME whose config.toml sets check_for_update_on_startup = true, with a version.json cache naming 0.159.0 checked moments earlier (so no network check) and CODEX_MANAGED_BY_NPM=1 so Codex offers an update command. Over the provisional screen Codex paints `Update available · 0.158.0 → 0.159.0`, `1. Update now (runs `npm install -g @openai/codex`)` / `2. Skip` / `3. Skip until next version` and the key row `enter continue · esc skip`, where older builds wrote `Press enter to continue`. Enter picks Update now. No key was sent (only automatic terminal-query replies). Cut 6 s after spawn. Home-directory user name redacted by hand, same length.",
+  "exitCode": null
+}
diff --git a/src/main/runtime/__fixtures__/codex-0158-update-available-dialog.txt b/src/main/runtime/__fixtures__/codex-0158-update-available-dialog.txt
new file mode 100644
index 00000000000..2c92e766ae2
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0158-update-available-dialog.txt
@@ -0,0 +1 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l>_ OpenAI Codex (v0.158.0)loadingHere for a quick fix or the extended edition?⣀⣤⣤⣤⣀⣀⣠⣶⣿⣿⣿⣿⣿⣿⣿⣿⣦⣤⣤⣤⣤⣤⣤⡀⢀⣾⣿⣿⠿⠋⠉⠉⢉⣭⣿⣿⣿⣿⣿⠿⣿⣿⣿⣿⣷⣄⣀⣾⣿⣿⠃⣀⣴⣾⣿⣿⡿⠟⠋⣀⡀⠈⠙⢿⣿⣿⣧⣀⣶⣿⣿⣿⣿⡇⢸⣿⣿⡿⠛⠉⢀⣠⣴⣿⣿⣿⣷⣦⣀⠈⢻⣿⣿⡇⣰⣿⣿⡿⢿⣿⣿⡇⢸⣿⣿⢀⣤⣶⣿⣿⣿⠟⠛⠻⣿⣿⣿⣿⣮⣿⣿⡷⢰⣿⣿⡟⠁⢸⣿⣿⡇⢸⣿⣿⣿⣿⠿⠿⣿⣿⣿⣦⣄⡀⠈⠛⠿⣿⣿⣿⣧⡀⣾⣿⣿⠃⢸⣿⣿⡇⢸⣿⣿⠋⠁⠈⠙⢻⣿⣿⣿⣶⣤⡀⠹⢿⣿⣷⡄⢸⣿⣿⣇⠸⣿⣿⣷⣦⣼⣿⣿⢸⣿⣿⠻⢿⣿⣿⡇⠘⣿⣿⣿⠈⢿⣿⣿⣦⡀⠈⠛⠿⣿⣿⣿⣿⣄⡀⢀⣠⣼⣿⣿⣿⣿⡇⣿⣿⣿⠇⢻⣿⣿⣿⣷⣦⣀⠈⠙⠻⣿⣿⣿⣶⣶⣿⣿⣿⣿⣿⣿⣿⡇⣠⣿⣿⣿⢸⣿⣿⡿⢿⣿⣿⣿⣦⣠⣴⣿⣿⣿⡿⠟⠋⢸⣿⣿⣿⣿⣷⣴⣿⣿⣿⠃⠘⣿⣿⣷⠈⠛⢿⣿⣿⣿⠿⠋⠉⣠⣴⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠻⣿⣿⣿⣤⣀⠈⠉⢀⣤⣶⣿⣿⣿⠿⠟⠁⣰⣿⣿⡟⠋⠁⠈⠿⣿⣿⣿⣿⣶⣾⣿⣿⣿⣿⠟⠋⠁⣠⣼⣿⣿⡟⠙⠛⠛⠛⠻⠛⢿⣿⣿⣿⣿⣷⣾⣿⣿⣿⡿⠏⠈⠙⠛⠿⠿⠿⠿⠛⠉ › Ask Codex to do anything ? for shortcuts[0 q [?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l/Users/user1/cr/rounds/dlg-u58/repo  permissions: YOLO modeHere for a quick fix or the extended edition?[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l   Update available · 0.158.0 → 0.159.0  Release notes: ]8;;https://github.com/openai/codex/releases/latesthttps://github.com/openai/codex/releases/latest]8;; › 1. Update now (runs `npm install -g @openai/codex`)                                                                     2. Skip  3. Skip until next version   enter continue · esc skip    [?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/dsh-tui-ready-no-key.meta.json b/src/main/runtime/__fixtures__/dsh-tui-ready-no-key.meta.json
new file mode 100644
index 00000000000..5c5284b5056
--- /dev/null
+++ b/src/main/runtime/__fixtures__/dsh-tui-ready-no-key.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-23T07:34:39.531Z",
+  "platform": "darwin",
+  "command": ["dsh-tui"],
+  "cols": 120,
+  "rows": 40,
+  "note": "dsh-tui 0.10.2 on @deepseek-ai/dsh 0.1.5-rc.1, macOS arm64, no DEEPSEEK_API_KEY, empty workspace, DSH_TUI_LANG=en",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/dsh-tui-ready-no-key.txt b/src/main/runtime/__fixtures__/dsh-tui-ready-no-key.txt
new file mode 100644
index 00000000000..34f9432049a
--- /dev/null
+++ b/src/main/runtime/__fixtures__/dsh-tui-ready-no-key.txt
@@ -0,0 +1 @@
+[?25l[?2004h[?1004h]11;?[>0q[?1049h[?1000h[?1002h[?1003h[?1006h]0;✦ 🐋 ]8;;
✦ dsh-TUI  v0.10.2
█▀▀▀▄█▀▀▀▀█▀▀▀▀█▀▀▀▄█▀▀▀▀█▀▀▀▀█▀▀▀▀██
███████████
▄▀▄▄███▀▀▀█▀▀▀█▄▄▄▀▀▀▀▄█▀▀▀█▀▀▀██
▀▀▀▀▄▄▄▀▀▀██████████
▄▄▄▄▄▄▄▄▄▀▀▀▀▀▀▀▀▀▀▀▀█▄▄▄▀█▄▄▄▄█▄▄▄▄██▄▄▄▀█▄▄▄▄█▄▄▄▄██
▄▀▀▀▀▀▀▀▀▀▀▀▀▄▄▀▀▀▀▀▀▀▀▀██▄▀▄█▀▀▀▄███▀▀▀▀█▀▀▀▀█▀▀▀▀
▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▄▀▀▀▀▀████████████
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀█▀▀▀██▀▀▀██▄▄▄▀████▀▀▀▀▀▀▄▀▀▀▄
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀████████████
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀█████████▄▄▄▄█▄▄▄▀█▄▄▄▀
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀deepseek-flash · Max effort
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄/private/tmp/dsh-ws
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀Tip: Clicktool/thinking/summaryrowstofold;subagentcardsopendetail;…
⚠ The dsh engine (0.1.5-rc.3) is newer than the 0.1.5-rc.1 this UI is 
validated against, so issues are possible; downgrade via npm i -g 
@deepseek-ai/dsh@0.1.5-rc.1 for stability, or wait for a dsh-tui update.
Explore the uncharted!
▶（Ctrl+P to expand）Contextloaded·Systemprompt18sections·Runtimecontext2items·Skills14·Tools27
╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
❯  ⛶
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
deepseek-flash · max · dsh-ws]8;;
✦
█
█
█
█
█
█
█
█
█
█
E]8;;
✦ 
█▀
█
█
█
█▄
█
█
█▀
█
█
Ex]8;;
✦ ds
█▀▀▀
█
█
█
█▄▄▄
█
█
█▀▀▀
█
█
Expl]8;;
✦ dsh
█▀▀▀▄
██
██
██
█▄▄▄▀
██
██
█▀▀▀█
██
██
Explo]8;;
✦ dsh-
█▀▀▀▄
██
██
██
█▄▄▄▀
██
██
█▀▀▀█
██
██
Explor]8;;
▀▀]8;;
✦ dsh-T
█▀▀▀▄█
███
███
███
█▄▄▄▀█
██
███
█▀▀▀██
███
███
Explore]8;;
✦ dsh-TU
█▀▀▀▄█▀
███
███▀
███
█▄▄▄▀█▄
██▄
███
█▀▀▀██▀
███
███
Explore ]8;;
✦ dsh-TU
█▀▀▀▄█▀
███
███▀
███
█▄▄▄▀█▄
██▄
███
█▀▀▀██▀
███
███
Explore ]8;;
✦ dsh-TUI
▀▀▄█▀▀▀
██
██▀▀▀
██
▄▄▀█▄▄▄
█▄▀▄
██
▀▀██▀▀▀
██
██
Explore th]8;;
▀▀]8;;
✦ dsh-TUI
▀▀▄█▀▀▀▀
██
██▀▀▀
██
▄▄▀█▄▄▄▄
█▄▀▄
███
▀▀██▀▀▀█
███
███
Explore the]8;;
 dsh-TUI
▀▄█▀▀▀▀
██
██▀▀▀
██
▄▀█▄▄▄▄
█▄▀▄
███
▀██▀▀▀█
███
███
xplore the ]8;;
dsh-TUI
▄█▀▀▀▀█▀
███
██▀▀▀█▀
███
▀█▄▄▄▄█▄
█▄▀▄█▀
████
██▀▀▀██▄
████
████
plore the un]8;;
h-TUI
█▀▀▀▀█▀▀
██
█▀▀▀█▀▀
██
█▄▄▄▄█▄▄
▄▀▄█▀▀
███
█▀▀▀██▄▄
████
███
ore the unc]8;;
-
▀▀▀▀█▀▀▀
█
▀▀▀█▀▀▀
█
▄▄▄▄█▄▄▄
▄▀
▀▄
re the unch]8;;
▄▄▄
▀]8;;
TUI
▀▀▀█▀▀▀▀
█
▀▀█▀▀▀
█
▄▄▄█▄▄▄▄
▀▄█▀▀▀▄
███
▀▀██▄▄▄▀
███
███
e the uncha]8;;
UI
▀▀█▀▀▀▀
█
▀█▀▀▀
█
▄▄█▄▄▄▄
▄█▀▀▀▄
███
▀██▄▄▄▀
███
███
 the unchar]8;;
▄
▀▀▀▀▀]8;;
I
▀█▀▀▀▀█
██
█▀▀▀█
██
▄█▄▄▄▄█
█▀▀▀▄█
████
██▄▄▄▀█
████
████
the unchart]8;;
█▀▀▀▀█▀
██
█▀▀▀█▄
██
█▄▄▄▄█
█▀▀▀▄█
████
█▄▄▄▀█
███
███
he uncharte]8;;
▄▄▀▄▄
▀▀▀▀]8;;
█▀▀▀▀█▀
██
█▀▀▀█▄
██
█▄▄▄▄█
█▀▀▀▄█
████
█▄▄▄▀█
███
███
e uncharte]8;;
▀▀█▀▀▀▄
██
▀█▄▄▄▀
█
▄▄█
▀▄██
████
▄▀███
███
███
ncharted!]8;;
▄
▄▄▀▀▀▀▀▀▄▄
▀   ▀▀   ▀
▄]8;;
▀▀█▀▀▀▄
██
▀█▄▄▄▀
█
▄▄█
▀▄██
████
▄▀███
███
███
ncharted!]8;;
▀█▀▀▀▄█
███
█▄▄▄▀
█
▄██
▄███
█████
▀████
████
████
charted!]8;;
█▀▀▀▄█▀
███
█▄▄▄▀▀
█
██▄
███▀
████
████▀
████
███▄
harted!]8;;
▄▄▄▄
▄▀▀▀▀▄▄▀▀▀▀▄
▀  ▀  ▀]8;;
█▀▀▀▄█▀▀
███
█▄▄▄▀▀▀
█
██▄▄
███▀▀
████
████▀▀
████
███▄▄
arted!]8;;
▀▀▀▄█▀▀▀
██
▄▄▄▀▀▀▀
█▄▄▄
██▀▀
███
███▀▀
███
██▄▄
rted!]8;;
▄  ▄
▄▀    ▀▄
▀  ▀]8;;
▀▀▄█▀▀▀▀
██
▄▄▀▀▀▀▄
█
█▄▄▄▀
██▀▀▀▀
██
███▀▀▀
███
██▄▄▄▄
ted!]8;;
✦
▀▄█▀▀▀▀
██
▄▀▀▀▀▄
█
█▄▄▄▀
██▀▀▀▀
██
██▀▀▀
███
██▄▄▄▄
ed!]8;;
     
           
   ]8;;
✦ d
▄█▀▀▀▀█▀
███
▀▀▀▀▄█▀
██
█▄▄▄▀█▄
██▀▀▀▀█▀
███
██▀▀▀▀
██
██▄▄▄▄█▄
d!]8;;
✦ ds
█▀▀▀▀█▀▀
██
▀▀▀▄█▀▀
██
█▄▄▄▀█▄▄
█▀▀▀▀█▀
██
█▀▀▀▀
█
█▄▄▄▄█▄]8;;
✦ ds
▀▀▀▀█▀▀
█
▀▀▀▄█▀▀
██
▄▄▄▀█▄▄
▀▀▀▀█▀
█
▀▀▀▀
▄▄▄▄█▄]8;;
✦ dsh-
▀▀█▀▀▀▀
█
▀▄█▀▀▀
██
▄▀█▄▄▄▄
▀▀
▀
▄▄]8;;
 ▄▀▄ ▄
 ▀▀▀▄ ▄▀▀▀
  ▀▀▀▀▀▀
 ▀▀▀▀
 ▄▀▀▀
▀▀▀
▀▀
▀▀]8;;
✦ dsh-T
▀▀█▀▀▀▀
█
▀▄█▀▀▀
██
▄▀█▄▄▄▄
▀▀█▀▀
█
▀▀▀
▄▄█▄▄]8;;
✦ dsh-TU
▀█▀▀▀▀█
██
▄█▀▀▀█
███
▀█▄▄▄▄█
▀█▀▀█
██
▀▄
█
▄█▄▀█]8;;
  ▀▄ ▄
  ▀▀▀▀   ▄▀▀▀
 ▀▀▄▀▀▀▀▀▀
 ▀▀▀▀▀▀
▄▄▀▀▀▀▀
▀▀▀▀
▀▀]8;;
✦ dsh-TUI
█▀▀▀▀█▀
██
█▀▀▀█▀
██
█▄▄▄▄█▄
█▀▀▀▀█▀
██
▀▀▀▄▀
█
█▄▄▄▀█▄]8;;
✦ dsh-TUI
█▀▀▀▀█▀▀
██
█▀▀▀█▀▀
██
█▄▄▄▄█▄▄
█▀▀█▀▀
██
▀▀▀▀
█▄▄█▄▄]8;;
   ▄ 
  ▀▀▀    
 ▀   ▄▀▀▄
▀▄▀▀▀▀▀
 ▀▀▀▀▀
▀▀▀▀▀
▀▀
▀▀
▀]8;;
✦ dsh-TUI
▀▀▀▀█▀▀▀▀
█
▀▀▀█▀▀▀
█
▄▄▄▄█▄▄▄▄
▀▀▀▀▀
▀▀▀▀▄
█
▄▄▄▄▀]8;;
dsh-TUI
▀▀█▀▀▀▀
█
▀█▀▀▀
█
▄▄█▄▄▄▄
▀█▀▀▀▀
█
▀▀▀▀▄
█
▄█▄▄▄▀]8;;
sh-TUI
▀█▀▀▀▀█
██
█▀▀▀█
██
▄█▄▄▄▄█
▀█▀▀▀▀
█
▄▀▀▀▄
██
▀█▄▄▄▀
E]8;;
 
   ▄▀▄
   ▀▀▀▀    
  ▀▀▀▀    ▄
  ▄▀▀▀▀▀▀▀
▀▀▀▀▀▀▀▀▀
▀▀▀▀▀▀
▀▀▀▀
▀]8;;
h-TUI
█▀▀▀▀█
██
█▀▀▀██
██
█▄▄▄▄█
█▀▀▀▀
█
▀▀▀▄
█
█▄▄▄▀
Ex]8;;
-TUI
█▀▀▀▀█
███
█▀▀▀██
███
█▄▄▄▄█
█▀▀▀▀
█
▀▀▀▄
█
█▄▄▄▀
Exp]8;;
▄
▀▀▀   
▀▀▀▀▄  ▄▀▀▄
▀▀▀▀▄▀▀▀▀▀ 
▄▄▀▀▀▀▀   
▀▀▀▀▀    
▀     
▀▀▀ 
 ]8;;
TUI
▀▀▀▀█
██
▀▀▀██
██
▄▄▄▄█
▀▀▀▀
▀▀▀▄
█
▄▄▄▀
Expl]8;;
UI
▀▀▀██
██
▀▀██
██
▄▄▄██
Explo]8;;
I
▀▀██
██
▀██
██
▄▄██
▀
▄
█
▀
Explor]8;;
▄▀▄ ▄
▀▀▀▀ ▄▀▀▀
▀▀▀▀▀▀▀▀ 
▀▀▀▀▀▀ 
▄▀▀▀  
▀▀▀  
▀ 
▀ 
 ]8;;
▀██
██
██
██
▄██
▀
▄
█
▀
Explore]8;;
██
██
██
██
██
Explore t]8;;
▄▀  ▄ 
▀▀▀▀▄ ▄▄▀▀▀  
▀▀▀▀▀▀▀▀  
▀▀▀▀▀  
 ▀▀▀   
▀▀▀ 
▀▀]8;;
█
█
█
█
█
Explore th]8;;
█
█
█
█
Explore the]8;;
▄▀▄ ▄ 
▀▀▀▄ ▄▀▀▀ 
▀▀▀▀▀▀▀ 
▀▀▀▀ 
▄▀▀▀ 
▀▀ 
▀ 
▀ ]8;;
█
█
xplore the ]8;;
█
█
plore the u]8;;
lore the un]8;;
ore the unc]8;;
re the unch]8;;
e the unch]8;;
▀▀
▀▀▀▀▄
▀ ]8;;
▀
▀▀▀▄▄
▀▀▀▀▀
 ]8;;
▀
▀▀▀  
▀▀▀▄ 
▀]8;;
▀▀
▀▀▀▄ 
 ▀]8;;
 ▄▀▄ ▄
 ▀▀▀▄ ▄▀▀▀
  ▀▀▀▀▀▀
 ▀▀▀▀
 ▄▀▀▀
▀▀▀
▀▀
▀▀]8;;
  ▀▄ ▄
  ▀▀▀▀   ▄▀▀▀
 ▀▀▄▀▀▀▀▀▀
 ▀▀▀▀▀▀
▄▄▀▀▀▀▀
▀▀▀▀
▀▀]8;;
   ▄ 
  ▀▀▀    
 ▀   ▄▀▀▄
▀▄▀▀▀▀▀
 ▀▀▀▀▀
▀▀▀▀▀
▀▀
▀▀
▀]8;;
 
   ▄▀▄
   ▀▀▀▀    
  ▀▀▀▀    ▄
  ▄▀▀▀▀▀▀▀
▀▀▀▀▀▀▀▀▀
▀▀▀▀▀▀
▀▀▀▀
▀]8;;
▄
▀▀▀   
▀▀▀▀▄  ▄▀▀▄
▀▀▀▀▄▀▀▀▀▀ 
▄▄▀▀▀▀▀   
▀▀▀▀▀    
▀     
▀▀▀ 
 ]8;;
▀▀
▀▀▀▀▄
▀ ]8;;
▄▀▄ ▄
▀▀▀▀ ▄▀▀▀
▀▀▀▀▀▀▀▀ 
▀▀▀▀▀▀ 
▄▀▀▀  
▀▀▀  
▀ 
▀▀ 
▀▀▀▄▄
▀▀▀▀▀
 ]8;;
▀▀]8;;
▀
▀▀▀  
▀▀▀▄ 
▀]8;;
▀▀]8;;
▄▀  ▄ 
▀▀▀▀▄ ▄▄▀▀▀  
▀▀▀▀▀▀▀▀  
▀▀▀▀▀  
 ▀▀▀   
▀▀▀ 
▀▀]8;;
▀▀
▀▀▀▄ 
 ▀]8;;
▄▀▄ ▄ 
▀▀▀▄ ▄▀▀▀ 
▀▀▀▀▀▀▀ 
▀▀▀▀ 
▄▀▀▀ 
▀▀ 
▀ 
▀ ]8;;
▀▀
▀▀▀▀▄
▀ ]8;;
▀
▀▀▀▄▄
▀▀▀▀▀
 ]8;;
▀
▀▀▀  
▀▀▀▄ 
▀]8;;
▀▀
▀▀▀▄ 
 ▀]8;;
 ▄▀▄ ▄
 ▀▀▀▄ ▄▀▀▀
  ▀▀▀▀▀▀
 ▀▀▀▀
 ▄▀▀▀
▀▀▀
▀▀
▀▀]8;;
  ▀▄ ▄
  ▀▀▀▀   ▄▀▀▀
 ▀▀▄▀▀▀▀▀▀
 ▀▀▀▀▀▀
▄▄▀▀▀▀▀
▀▀▀▀
▀▀]8;;
   ▄ 
  ▀▀▀    
 ▀   ▄▀▀▄
▀▄▀▀▀▀▀
 ▀▀▀▀▀
▀▀▀▀▀
▀▀
▀▀
▀]8;;
 
   ▄▀▄
   ▀▀▀▀    
  ▀▀▀▀    ▄
  ▄▀▀▀▀▀▀▀
▀▀▀▀▀▀▀▀▀
▀▀▀▀▀▀
▀▀▀▀
▀]8;;
▀▀
▀▀▀▀▄
▀ ]8;;
▄
▀▀▀   
▀▀▀▀▄  ▄▀▀▄
▀▀▀▀▄▀▀▀▀▀ 
▄▄▀▀▀▀▀   
▀▀▀▀▀    
▀     
▀▀▀ 
 ]8;;
▀▀]8;;
▀
▀▀▀▀▄
▀▀▀▀▀
 ]8;;
▀▀]8;;
▀
▀▀▀▀ 
▀▀▀▄ 
▀]8;;
▄▀▄ ▄
▀▀▀▀ ▄▀▀▀
▀▀▀▀▀▀▀▀ 
▀▀▀▀▀▀ 
▄▀▀▀  
▀▀▀  
▀ 
▀ 
 ]8;;
▀▀▀▀
▀▀▀▀
▄▀▄▄]8;;
▀▀
▀▀▀▄ 
 ▀]8;;
▄▀  ▄ 
▀▀▀▀▄ ▄▄▀▀▀  
▀▀▀▀▀▀▀▀  
▀▀▀▀▀  
 ▀▀▀   
▀▀▀ 
▀▀]8;;
▄▄▄▄    
  ▄
 ▀▀▀▀
▀▀▀▀]8;;
▄▀▄ ▄ 
▀▀▀▄ ▄▀▀▀ 
▀▀▀▀▀▀▀ 
▀▀▀▀ 
▄▀▀▀ 
▀▀ 
▀ 
▀ ]8;;
 ▀▀▀▀
▀▄▄
▄▄▄▄    
▄▄▄]8;;
  ▄
 ▀▀▀▀
 ▀▀▀▀]8;;
▀▄▄
▄▄▄▄    
  ▄
▀▀▀]8;;
 ▀▀▀▀
 ▀▀▀▀
▀▄▄
▄▄▄ ]8;;
▀▀
▀▀▀▀▄
▀ ]8;;
▄▄▄▄    
  ▄
 ▀▀▀▀
▀▀▀▀]8;;
▀
▀▀▀▄▄
▀▀▀▀▀
 ]8;;
 ▀▀▀▀
▀▄▄
▄▄▄▄    
▄▄▄]8;;
▀
▀▀▀  
▀▀▀▄ 
▀]8;;
▀▀
▀▀▀▄ 
 ▀]8;;
  ▄
 ▀▀▀▀
 ▀▀▀▀]8;;
▀▄▄
▄▄▄▄    
  ▄
▀▀▀]8;;
 ▀▀▀▀
 ▀▀▀▀
▀▄▄
▄▄▄ ]8;;
 ▄▀▄ ▄
 ▀▀▀▄ ▄▀▀▀
  ▀▀▀▀▀▀
 ▀▀▀▀
 ▄▀▀▀
▀▀▀
▀▀
▀▀]8;;
▄▄▄▄    
  ▄
 ▀▀▀▀
▀▀▀▀]8;;
  ▀▄ ▄
  ▀▀▀▀   ▄▀▀▀
 ▀▀▄▀▀▀▀▀▀
 ▀▀▀▀▀▀
▄▄▀▀▀▀▀
▀▀▀▀
▀▀]8;;
 ▀▀▀▀
▀▄▄
▄▄▄▄    
▄▄▄]8;;
   ▄ 
  ▀▀▀    
 ▀   ▄▀▀▄
▀▄▀▀▀▀▀
 ▀▀▀▀▀
▀▀▀▀▀
▀▀
▀▀
▀]8;;
  ▄
 ▀▀▀▀
 ▀▀▀▀]8;;
▀▀]8;;
▀▀
▀▀▀▀▄
▀ ]8;;
 
   ▄▀▄
   ▀▀▀▀    
  ▀▀▀▀    ▄
  ▄▀▀▀▀▀▀▀
▀▀▀▀▀▀▀▀▀
▀▀▀▀▀▀
▀▀▀▀
▀]8;;
▀▀]8;;
▀
▀▀▀▀▀
▀▀▀▀▀
 ]8;;
▀▄▄
▄▄▄▄    
  ▄
▀▀▀]8;;
▄
▀▀▀   
▀▀▀▀▄  ▄▀▀▄
▀▀▀▀▄▀▀▀▀▀ 
▄▄▀▀▀▀▀   
▀▀▀▀▀    
▀     
▀▀▀ 
▄
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/freebuff-lifecycle.meta.json b/src/main/runtime/__fixtures__/freebuff-lifecycle.meta.json
new file mode 100644
index 00000000000..57f6174485f
--- /dev/null
+++ b/src/main/runtime/__fixtures__/freebuff-lifecycle.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-28T07:56:49.813Z",
+  "platform": "darwin",
+  "command": ["freebuff", "--cwd", "/tmp/orca-freebuff-folder-workspace"],
+  "cols": 120,
+  "rows": 40,
+  "note": "Freebuff 0.1.2 authenticated free plan; choice, answer, tool, interruption, tool error",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/freebuff-lifecycle.txt b/src/main/runtime/__fixtures__/freebuff-lifecycle.txt
new file mode 100644
index 00000000000..0f965581bce
--- /dev/null
+++ b/src/main/runtime/__fixtures__/freebuff-lifecycle.txt
@@ -0,0 +1 @@
+]11;?]10;?[?2031h]10;?]11;?[>0q[?25l[?1016$p[?2027$p[?2031$p[?1004$p[?2004$p[?2026$p[?u]99;i=opentui-notifications:p=?;\]1337;Capabilities\]66;w=1; \]66;s=2; \[?1049h[>4;1m[?2027h[?2004h[?1000h[?1002h[?1003h[?1006h]4;0;?[?2026h[?25l ███████████                        ██                 ▄████  ▄██                                                        ███▀▀▀▀▀▀▀▀                        ██                 ██    ██▀                                                         ███ █████  ██████ ▄█████   ▄████▄  ██████▄  ██   ██ ████████████                                                        ███ ███▀▀  ██▀   ███▄▄▄██ ██▄▄▄███ ██   ▀██ ██   ██   ██    ██                                                          ███ ███    ███   ███▀▀▀▀▀ ██▀▀▀▀▀  ██▄  ▄██ ██▄  ██   ██    ██                                                          ███ ██▀    ██▀    ▀█████   ▀████▀  ██████▀   ▀████▀   ██    ██                                                                                                                                                                                  ┌──────────────────────────────────────────────────────────────────┐                                                    │ Your first message starts the session.                           │                                                    │ Some models aren't available on this connection                  │                                                    └──────────────────────────────────────────────────────────────────┘                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│                                                                                                                      ││  ▍Enter a coding task or / for commands                                                                              ││                                                                                                                      │╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ GLM 5.3 Flash • max · /private/tmp/orca-freebuff-folder-workspace · /model to change · Chat: New chat                   ← for history · ? for help                                                                                             [?2026l[?1004h[?2026h[?25l│ 1 day streak                                                     │└──────────────────────────────────────────────────────────────────┘[?2026l[?2026h[?25l100/100 Freebucks remaining                    │                                                                  ││✦ Refer friends → earn Freebucks:││││⎘ Copy invite link  Learn More ↵│└──────────────────────────────────────────────────────────────────┘[?2026l[?2026h[?25l ███████████                        ██                 ▄████  ▄██                                                        ███▀▀▀▀▀▀▀▀                        ██                 ██    ██▀                                                         ███ █████  ██████ ▄█████   ▄████▄  ██████▄  ██   ██ ████████████                                                        ███ ███▀▀  ██▀   ███▄▄▄██ ██▄▄▄███ ██   ▀██ ██   ██   ██    ██                                                          ███ ███    ███   ███▀▀▀▀▀ ██▀▀▀▀▀  ██▄  ▄██ ██▄  ██   ██    ██                                                          ███ ██▀    ██▀    ▀█████   ▀████▀  ██████▀   ▀████▀   ██    ██                                                                                                                                                                                  ┌──────────────────────────────────────────────────────────────────┐                                                    │ Your first message starts the session.                           │                                                    │ 100/100 Freebucks remaining                                      │                                                    │ 1 day streak                                                     │                                                    │                                                                  │                                                    │ ✦ Refer friends → earn Freebucks:                                │                                                    │                                                                  │                                                    │ ⎘ Copy invite link  Learn More ↵                                 │                                                    └──────────────────────────────────────────────────────────────────┘                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│                                                                                                                      ││  ▍Enter a coding task or / for commands                                                                              ││                                                                                                                      │╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ GLM 5.3 Flash • max · /private/tmp/orca-freebuff-folder-workspace · /model to change · Chat: New chat                   ← for history · ? for help                                                                                             [?2026l[?2026h[?25l╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│Geo Daniela — La primera IA de remuneraciones de Chile  Ad││Liquidaciones PDF, Previred CSV, LRE CSV y portal del trabajador. Demo 30 min para PYME.││ Learn more geodaniela.cl│╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯[?2026l[?2026h[?25lUse ask_user to ask me to choose blue orgreen.Waitformyreply.Donotmodifyfiles.▍[?2026l]0;Freebuff: Use ask_user to ask me to choose blue or green. W…[?2026h[?25l                                                                                                                        ┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐│Starting your model session… Your message is saved.                               ││Esc: back to draft│└──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘[?2026l[?2026h[?25lSession active                        └──────────────────────────────────────────────────────────────────┘                                    [12:55 AM]  Use ask_user to ask me to choose blue or green. Wait for my reply. Do not modify files. ⎘                                                                    ╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│Geo Daniela — La primera IA de remuneraciones de Chile  Ad││ Liquidaciones PDF, Previred CSV, LRE CSV y portal del trabajador. Demo 30 min para PYME.                           │ Learn more  geodaniela.cl                                ╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ 44m left                                                                                                ✕ End session  ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│││  ▍Enter a coding task or / for commands                                                                              ││                                                   │╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ GLM 5.3 Flash • max · /private/tmp/orca-freebuff-folder-workspace · /model to change · Chat: Use ask_user to ask me to choose blue or green.Wait for my reply. Do not modify files.                                        [?2026l[?2026h[?25lthinking...        ■ Esc[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25l1s[?2026l[?2026h[?25lthinkig...[?2026l[?2026h[?25lthinkin...[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25l2[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25lthinkig...[?2026l[?2026h[?25l3[?2026l[?2026h[?25lthinkin...[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25l4[?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25lthinkig...[?2026l[?2026h[?25lthinkin...[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25l5[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25l6[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25lworking... [?2026l[?2026h[?25l• ThinkingThe user wants me to ask them to choose between blue and green using the ask_user tool. This is straightforward — I should call ask_user with a single question offering those two options, then wait for their reply. No file modifications needed.[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l ▀▀  ██▀███▄▄▄████▄▄▄███▀███████   ██   ███    ██████▀▀▀▀▀██▀▀▀▀▀▄▄████▄██ ▀  ▀   ▀▀▀▀ ▀███▀                                                                      ┌──────────────────────────────────────────────────────────────────┐│ Session active                                              ││100/100 Freebucks remaining││ 1 day streak                                                     │└──────────────────────────────────────────────────────────────────┘                              [12:55 AM]     Use ask_user to ask me to choose blue or green. Wait for my reply. Do not modify files. ⎘ • Thinking   The user wants me to ask them to choose between blue and green using the ask_user tool. This is straightforward — I should call ask_user with a single question offering those two options, then wait for   their reply. No file modifications needed.                                                                                                ╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│Geo Daniela — La primera IA de remuneraciones de Chile  Ad││Liquidaciones PDF, Previred CSV, LRE CSV y portal del trabajador. Demo 30 min para PYME.││ Learn more geodaniela.cl│╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯                                                                                                                     6s ╭─────────────────────────────────────────────── Some questions for you ───────────────────────────────────────────────╮│Close ✕││                                                                                                                      ││▼ Which color would you like to choose?                      ││  ○ Blue                                                                                                              ││    Pick blue as the color                                                                                            ││  ○ Green                                                                                                             ││  ○ Custom                                                                                                            ││                                                                                                                      ││╭──────────╮│││ Submit  │    ↑↓ navigate • Enter select││╰──────────╯│╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯[?2026l[?2026h[?25l7[?2026l[?2026h[?25l [?2026l[?2026h[?25l█████                          ▄███ ▄██▀▀▀▀▀▀▀▀                           ▀███████▄▄▄▄██   ████████████ ███▀▀  ██▀   ███▄▄▄██ ██▄▄▄███ ██   ▀██ ██   ██   ██    █████ ███    ███   ███▀▀▀▀▀ ██▀▀▀▀▀  ██▄  ▄██ ██▄  ██   ██    ██      ███ ██▀    ██▀    ▀█████   ▀████▀  ██████▀   ▀████▀   ██    ██                              ┌──────────────────────────────────────────────────────────────────┐│ Session active                                                   ││100/100 Freebucks remaining││1 day streak│└──────────────────────────────────────────────────────────────────┘                         [12:55 AM] Use ask_user to ask me to choose blue or green. Wait for my reply. Do not modify files. ⎘                                                                                                                  • Thinking                                  The user wants me to ask them to choose between blue and green using the ask_user tool. This is    straightforward — I should call ask_user with a single question offering those two options, then wait for            their reply. No file modifications needed.                                                                                                          ╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│ Geo Daniela — La primera IA de remuneraciones de Chile                                                          Ad │ │ Liquidaciones PDF, Previred CSV, LRE CSV y portal del trabajador. Demo 30 min para PYME.                           │  │  Learn more  geodaniela.cl                                                                                         │  ╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯                                                                                                                      7s ╭─────────────────────────────────────────────── Some questions for you ───────────────────────────────────────────────╮                                                                                                               Close ✕                                                                                                                      ▶ Which color would you like to choose? ↳ "Blue"╭──────────╮│Submit│╰──────────╯[?2026l[?2026h[?25l                                                                                                                                                                                                                                                                                                                                                                                                                              ╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮  │ Geo Daniela — La primera IA de remuneraciones de Chile                                                          Ad │  │Liquidaciones PDF, Previred CSV, LRE CSV y portal del trabajador. Demo 30 min para PYME.      │  │ Learn more geodaniela.cl│  ╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯  working...                                                                                                  7s  ■ Esc  ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│            ││ ▍Enter a coding task or / for commands  ││            │╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯[?2026l[?2026h[?25l ▀    ██▀▀█████▀████▀████▀▀████▀█   ██                                                                 ┌──────────────────────────────────────────────────────────────────┐│ Session active                                              ││ 100/100 Freebucks remaining                                 ││ 1 day streak                                                │└──────────────────────────────────────────────────────────────────┘                                                                     [12:55 AM]      Use ask_user to ask me to choose blue or green. Wait for my reply. Do not modify files. ⎘               • Thinking                                                         The user wants me to ask them to choose between blue and green using the ask_user tool. This is   straightforward — I should call ask_user with a single question offering those two options, then wait for   their reply. No file modifications needed.                                                        ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│                                                                                                          ││Your answer:                              ││││1. Which color would you like to choose?││↳ Blue│││╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l8[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l9[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l10[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l└──────────────────────────────────────────────────────────────────┘  [12:55 AM]                                                         Use ask_user to ask me to choose blue or green. Wait for my reply. Do not modify files. ⎘                              • Thinking       The user wants me to ask them to choose between blue and green using the ask_user tool. This is straightforward — I should call ask_user with a single question offering those two options, then wait for   their reply. No file modifications needed.                                                                                          ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│                                                                                                ││Your answer:                                                                                              ││                                          ││1. Which color would you like to choose?││↳ Blue││                                                                                                                  │╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯                • Thinking                                  The user chose Blue. They asked me to wait for their reply and not modify files. I've received their answer.   I should acknowledge it simply and not do anything else.                                                                                                                     You chose Blue. Noted — and I haven't modified any files, as requested.[?2026l[?2026h[?25l                                                                      [12:55 AM] Use ask_user to ask me to choose blue or green. Wait for my reply. Do not modify files. ⎘                                                                                            • Thinking   The user wants me to ask them to choose between blue and green using the ask_user tool. This is  straightforward —I should call ask_ur with asingle question offeringthose two ptions, then wait for  their reply. Nofile mdifition needed.                                                                                                             ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │                                                                                                                  │ Your answer:              1. Which color would you like to choose?   ↳ Blue                                        ╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯                                                                                                                       • Thinking   The user chose Blue. They asked me to wait for their reply and not modify files. I've received their answer.  I shouldacknowledgeit simply andnt do anything els.                                                                                                               You chose Blue. Noted — and I haven't modified any files, as requested.█                                                                       ⎘•20s•△▽█44m left · 13.2K (1%)✕ End session[?2026l[?2026h[?25lThe user wants me to ask them to choose between blue and green using the ask_user tool. This is   straightforward — I should call ask_user with a single question offering those two options, then wait for   their reply. No file modifications needed.                                                        ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│                                                                                                          ││Your answer:                              ││││1. Which color would you like to choose?││   ↳ Blue                                                                                                         │╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯                                            ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │Looooooong running AI agentsAd│ │ Build and run AI agents that don't time out on Trigger.dev                                        trigger.dev ↗ │ ╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ [?2026l[?2026h[?25lRun sleep 20 then say done. Do not modify files.▍[?2026l]0;Freebuff: Run sleep 20 then say done. Do not modify files.[?2026h[?25l                                                                                                                                                                                                          ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│││Your answer:││                                                                                                                  │1. Which color would you like to choose?  ↳ Blue    ╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯          ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │Looooooong running AI agentsAd││Build and run AI agents that don't time out on Trigger.devtrigger.dev ↗│╰╯                                • Thinking                                                                  The user chose Blue. They asked me to wait for their reply and not modify files. I've received their answer.     I should acknowledge it simply and not do anything else.          You chose Blue. Noted — and I haven't modified any files, as requested.                                                                                                ⎘•20s•△▽  [12:56 AM]                                                             Run sleep 20 then say done. Do not modify files. ⎘        ▍Enter a coding task or / for commands           [?2026l[?2026h[?25l▸ Thinking                                                                                                                       ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮              Your answer:                                          1. Which color would you like to choose? ↳ Blue │                                                                                                                  │ ╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯                                                                                                                      ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ Looooooong running AI agents                                         Ad │ Build and run AI agents that don't time out on Trigger.dev                                        trigger.dev ↗ │ ╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯            ▸ Thinking                                                                                                                                                               You chose Blue. Noted — and I haven't modified any files, as requested.                                                                        ⎘•20s•△▽           [12:56 AM] Run sleep 20 then say done. Do not modify files. ⎘                                                     thinking...                  ■ Esc[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25l1s[?2026l[?2026h[?25lthinkig...[?2026l[?2026h[?25lthinkin...[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25l2[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25lthinkig...[?2026l[?2026h[?25l3[?2026l[?2026h[?25lthinkin...[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25l4[?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25lthinkig...[?2026l[?2026h[?25lthinkin...[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25l5[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25l [?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25l6[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25lthinkig...[?2026l[?2026h[?25lthinkin...[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25l7[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25lworking... [?2026l[?2026h[?25l│ Your answer:││││1. Which color would you like to choose?││   ↳ Blue                                                                                                         │╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯                                            ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │Looooooong running AI agentsAd│ │ Build and run AI agents that don't time out on Trigger.dev                                        trigger.dev ↗ │ ╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯▸ Thinking                                                                                                                                         You chose Blue. Noted — and I haven't modified any files, as requested.                                                                                                                     ⎘ • 20s • △▽  [12:56 AM] Run sleep 20 then say done. Do not modify files. ⎘                                                                       • Thinking        The user wants me to run `sleep 20` in the terminal and then say "done". This is a simple, harmless command —   it just waits 20 seconds. No files modified. The tool guidance says to ask permission for commands other   than the listed use cases, but this is trivially safe and the user explicitly requested it, which is explicit permission itself. Let[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l me run it with an appropriate timeout (default is[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l  ↳ Blue    ╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯          ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │Looooooong running AI agentsAd││Build and run AI agents that don't time out on Trigger.devtrigger.dev ↗│╰╯                                ▸ Thinking                                                                                                                                                                                   You chose Blue. Noted — and I haven't modified any files, as requested.          ⎘•20s•△▽  [12:56 AM]                                                             Run sleep 20 then say done. Do not modify files. ⎘         • Thinking   The user wants me to run `sleep 20` in the terminal and then say "done". This is a simple, harmless command — it just waits 20 seconds. No files modified. The tool guidance says to ask permission for commands other   than the listed use cases, but this is trivially safe and the user explicitly requested it, which is explicit prmission itself. Let me run it withan appopriate timeout (default is 30, which is fine for a 20-second sleep).                                                                                                                                                                                                                $ sleep 20                                                                 8[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l            ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮  │Looooooong running AI agentsAd│ │Build and run AI agents that don't time out on Trigger.devtrigger.dev ↗│ ╰╯                                  ▸ Thinking                                                                                                                                                                                     You chose Blue. Noted — and I haven't modified any files, as requested.           ⎘•20s•△▽    [12:56 AM]                                                              Run sleep 20 then say done. Do not modify files. ⎘           • Thinking    The user wants me to run `sleep 20` in the terminal and then say "done". This is a simple, harmless command —  it just waits 20 seconds. No files modified. The tool guidance says to ask permission for commands other    than the listed use cases, but this is trivially safe and the user explicitly requested it, which is explicit  prmission itself. Let me run it withan appopriate timeout (default is 30, which is fine for a 20-second  sleep).                                                                                                                                                                                                                  $ sleep 20                                                                                                              [response interrupted]           ⎘•△▽▄44m left · 13.2K (1%)✕ End session[?2026l[?2026h[?25l╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯▸ Thinking                                                                                                                                         You chose Blue. Noted — and I haven't modified any files, as requested.                                                                                                                    ⎘ • 20s • △▽   [12:56 AM] Run sleep 20 then say done. Do not modify files. ⎘                                                                       • Thinking        The user wants me to run `sleep 20` in the terminal and then say "done". This is a simple, harmless command —   it just waits 20 seconds. No files modified. The tool guidance says to ask permission for commands other   than the listed use cases, but this is trivially safe and the user explicitly requested it, which is explicit permission itself. Let me run it with an appropriate timeout (default is 30s, which is fine for a 20-second   sleep).                                                                                                              $ sleep 20                                                                                                                                                                                                               ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│Looooooong running AI agentsAd││Build and run AI agents that don't time out on Trigger.devtrigger.dev ↗│╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯[?2026l[?2026h[?25lRun sh -c "exit 7" and report the result. Do not modify files.▍[?2026l]0;Freebuff: Run sh -c "exit 7" and report the result. Do not …[?2026h[?25l                                                                                                                   You chose Blue. Noted — and I haven't modified any files, as requested.          ⎘•20s•△▽  [12:56 AM]                                                             Run sleep 20 then say done. Do not modify files. ⎘         • Thinking   The user wants me to run `sleep 20` in the terminal and then say "done". This is a simple, harmless command — it just waits 20 seconds. No files modified. The tool guidance says to ask permission for commands other   than the listed use cases, but this is trivially safe and the user explicitly requested it, which is explicit prmission itself. Let me run it withan appopriate timeout (default is 30, which is fine for a 20-second sleep).                                                                                                                                                                                                                $ sleep 20                                                                                                            ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│ Looooooong running AI agentsAd││Build and run AI agents that don't time out on Trigger.devtrigger.dev ↗│╰╯                                [response interrupted]                                                                                                                                                                ⎘ • △▽   [12:56 AM]            Run sh -c "exit 7" and report the result. Do not modify files. ⎘    ▍Enter a coding task or / for commands                         [?2026l[?2026h[?25l│Build and run AI agents that don't time out on Trigger.devtrigger.dev ↗│ ╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯          ▸ Thinking              You chose Blue. Noted — and I haven't modified any files, as requested. ⎘•20s•△▽             [12:56 AM]                                                                                                      Run sleep 20 then say done. Do not modify files. ⎘                                                                                                                                                                        ▸ Thinking                                                                                                              $ sleep 20            ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │ Looooooong running AI agents                                                                                 Ad │ Build and run AI agents that don't time out on Trigger.devtrigger.dev ↗ ╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯                                                                                                                     [response interrupted]                       ⎘•△▽       [12:56 AM] Run sh -c "exit 7" and report the result. Do not modify files. ⎘                                                                   thinking...                  ■ Esc[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25l1s[?2026l[?2026h[?25lthinkig...[?2026l[?2026h[?25lthinkin...[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25l2[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25lManaged Postgresthat keepsupwith your machins     Scale your production wokloads withTigerData'smanaged, unfked PstgreSQL ndhigh-availability multi-AZ…SttFreTrial  tigerdata.com[?2026l[?2026h[?25lthinkig...[?2026l[?2026h[?25l3[?2026l[?2026h[?25lthinkin...[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lworking.. [?2026l[?2026h[?25lYou chose Blue. Noted — and I haven't modified any files, as requested.                                                                                                                     ⎘ • 20s • △▽  [12:56 AM] Run sleep 20 then say done. Do not modify files. ⎘                                                                       ▸ Thinking         $ sleep 20                                                    ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│ Looooooong running AI agentsAd││Build and run AI agents that don't time out on Trigger.devtrigger.dev ↗│╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯[response interrupted]                                                                                                                          ⎘• △▽                                                                           [12:56 AM]                                                                                                         Run sh -c "exit 7" and report the result. Do not modify files. ⎘                      • Thinking    The user wants me to run `sh -c "exit 7"` and report the result. This is a harmless command — it just exits   with code 7. It doesn't modify files. Let me run it with the run_terminal_command tool.                                                                 $ sh -c "exit 7"[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l  [12:56 AM]                                                             Run sleep 20 then say done. Do not modify files. ⎘         ▸ Thinking                                                    $ sleep 20          ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│ Looooooong running AI agentsAd││Build and run AI agents that don't time out on Trigger.devtrigger.dev ↗│╰╯                                [response interrupted]                                                                                                                                                                 ⎘ • △▽  [12:56 AM]            Run sh -c "exit 7" and report the result. Do not modify files. ⎘     • Thinking   The user wants me to run `sh -c "exit 7"` and report the result. This is a harmless command — it just exits with code 7. It doesn't modify files. Let me run it with the run_terminal_command tool.          $ sh -c "exit 7"                                                                                              command: sh -c "exit 7"                                                                  stdout: exitCode: 7     [?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l4[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l5[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l6[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l7[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l8[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l9[?2026l[?2026h[?25l            [response interrupted]                             ⎘•△▽           [12:56 AM]  Run sh -c "exit 7" and report the result. Do not modify files. ⎘• Thinking                                                                                                          The user wants me to run `sh -c "exit 7"` and report the result. This is a harmless command — it just exits     with code 7. It doesn't modify files. Let me run it with the run_terminal_command tool.                                                                                                                                 $ sh -c "exit 7"command: sh -c "exit 7"stdout:     exitCode: 7            • Thinking                                                       The command `sh -c "exit 7"` was run. It exited with code 7, no stdout output. I should report the result. No   files modified.                                                                                                            The command ran and completed with:                                                      - Exit code: 7 (as expected, since  exit 7  was explicitly called)- stdout: empty - stderr: none                 No files were modified.[?2026l[?2026h[?25l[response interrupted]                       ⎘•△▽       [12:56 AM] Run sh -c "exit 7" and report the result. Do not modify files. ⎘                                                                   • Thinking   The user wants me to run `sh -c "exit 7"` and report the result. This is a harmless command — it just exits  with code 7. It doesn't modify files.Letme run it withthe run_terminal_command tool.                                                                                                              $ sh -c "exit 7" command: sh -c "exit 7" stdout:                 exitCode: 7             • Thinking   The command `sh -c "exit 7"` was run. It exited with code 7, no stdout output. I should report the result. No  files odified.                                                                                                               The command ran and completed with: - Exit code: 7 (s expectd, since  exit 7  was explicitly called) stdout: empty                                                    errnone                 No files were modified.                        ⎘•9s•△▽▄43m left · 13.3K (1%)✕ End session[?2026l[?2026h[?25l                      • Thinking    The user wants me to run `sh -c "exit 7"` and report the result. This is a harmless command — it just exits   with code 7. It doesn't modify files. Let me run it with the run_terminal_command tool.                                                                 $ sh -c "exit 7"command: sh -c "exit 7"stdout:                                                                                                       exitCode: 7                                                                              ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│ Your AI Agent’s Data Layer, Built on MongoDB AtlasAd││ Power your agentic workflows with MongoDB Atlas for reliable, scalable session memory and real-…mongodb.com ↗│╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯[?2026l[?2026h[?25l [?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/freebuff-login.meta.json b/src/main/runtime/__fixtures__/freebuff-login.meta.json
new file mode 100644
index 00000000000..390bcedba90
--- /dev/null
+++ b/src/main/runtime/__fixtures__/freebuff-login.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-28T07:20:19.119Z",
+  "platform": "darwin",
+  "command": ["freebuff", "--cwd", "/tmp/orca-freebuff-verify"],
+  "cols": 100,
+  "rows": 32,
+  "note": "Freebuff npm 0.1.2, unauthenticated, macOS arm64; no model inference",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/freebuff-login.txt b/src/main/runtime/__fixtures__/freebuff-login.txt
new file mode 100644
index 00000000000..d90d8905ceb
--- /dev/null
+++ b/src/main/runtime/__fixtures__/freebuff-login.txt
@@ -0,0 +1 @@
+]11;?]10;?[?2031h]10;?]11;?[>0q[?25l[?1016$p[?2027$p[?2031$p[?1004$p[?2004$p[?2026$p[?u]99;i=opentui-notifications:p=?;\]1337;Capabilities\]66;w=1; \]66;s=2; \[?1049h[>4;1m[?2027h[?2004h[?1000h[?1002h[?1003h[?1006h]4;0;?[?2026h[?25l ███████████                        ██                 ▄████  ▄██                                    ███▀▀▀▀▀▀▀▀                        ██                 ██    ██▀                                     ███ █████  ██████ ▄█████   ▄████▄  ██████▄  ██   ██ ████████████                                    ███ ███▀▀  ██▀   ███▄▄▄██ ██▄▄▄███ ██   ▀██ ██   ██   ██    ██                                      ███ ███    ███   ███▀▀▀▀▀ ██▀▀▀▀▀  ██▄  ▄██ ██▄  ██   ██    ██                                      ███ ██▀    ██▀    ▀█████   ▀████▀  ██████▀   ▀████▀   ██    ██                                                                                                                                          ┌──────────────────────────────────────────────────────────────────┐                                │ Your first message starts the session.                           │                                │ Some models aren't available on this connection                  │                                └──────────────────────────────────────────────────────────────────┘                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Try one of these:                                                                                   → Explain this codebase                                                                             → Find opportunities to refactor                                                                    → Improve my test coverage                                                                                                                                                                             ╭──────────────────────────────────────────────────────────────────────────────────────────────────╮│                                                                                                  ││  ▍Enter a coding task or / for commands                                                          ││                                                                                                  │╰──────────────────────────────────────────────────────────────────────────────────────────────────╯ GLM 5.3 Flash • max · /private/tmp/orca-freebuff-verify · /model to change · Chat: New chat         ← for history · ? for help                                                                         [?2026l[?1004h[?2026h[?25l                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ███████████                        ██                 ▄████  ▄██                                    ███▀▀▀▀▀▀▀▀                        ██                 ██    ██▀                                     ███ █████  ██████ ▄█████   ▄████▄  ██████▄  ██   ██ ████████████                                    ███ ███▀▀  ██▀   ███▄▄▄██ ██▄▄▄███ ██   ▀██ ██   ██   ██    ██                                      ███ ███    ███   ███▀▀▀▀▀ ██▀▀▀▀▀  ██▄  ▄██ ██▄  ██   ██    ██                                      ███ ██▀    ██▀    ▀█████   ▀████▀  ██████▀   ▀████▀   ██    ██                                                                                                                                                               Press ENTER to login...                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      [?2026l[?2026h[?25l                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ███████████                        ██                 ▄████  ▄██                                    ███▀▀▀▀▀▀▀▀                        ██                 ██    ██▀                                     ███ █████  ██████ ▄█████   ▄████▄  ██████▄  ██   ██ ████████████                                    ███ ███▀▀  ██▀   ███▄▄▄██ ██▄▄▄███ ██   ▀██ ██   ██   ██    ██                                      ███ ███    ███   ███▀▀▀▀▀ ██▀▀▀▀▀  ██▄  ▄██ ██▄  ██   ██    ██                                      ███ ██▀    ██▀    ▀█████   ▀████▀  ██████▀   ▀████▀   ██    ██                                                                                                                                                               Press ENTER to login...                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      [?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/freebuff-ready.meta.json b/src/main/runtime/__fixtures__/freebuff-ready.meta.json
new file mode 100644
index 00000000000..4555254cd8f
--- /dev/null
+++ b/src/main/runtime/__fixtures__/freebuff-ready.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-28T08:15:15.356Z",
+  "platform": "darwin",
+  "command": ["freebuff", "--cwd", "/tmp/orca-freebuff-trust"],
+  "cols": 120,
+  "rows": 40,
+  "note": "Freebuff 0.1.2 authenticated, declined repository agent files; waiting for first message",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/freebuff-ready.txt b/src/main/runtime/__fixtures__/freebuff-ready.txt
new file mode 100644
index 00000000000..150521f88b9
--- /dev/null
+++ b/src/main/runtime/__fixtures__/freebuff-ready.txt
@@ -0,0 +1,11 @@
+]11;?]10;?
+freebuff found agent files in this repository it has not run before:
+
+  /private/tmp/orca-freebuff-trust/.agents
+    agents: demo.ts
+
+These run with your permissions and can read your environment. Only load them if you trust this repository.
+
+Load and run these? [y/N] n
+Skipped agents and mcp.json in /private/tmp/orca-freebuff-trust/.agents for this run. Re-run and answer y to trust it, or set CODEBUFF_TRUST_AGENT_DIRS=1 (or pass --trust-agents).
+[?2031h]10;?]11;?[>0q[?25l[?1016$p[?2027$p[?2031$p[?1004$p[?2004$p[?2026$p[?u]99;i=opentui-notifications:p=?;\]1337;Capabilities\]66;w=1; \]66;s=2; \[?1049h[>4;1m[?2027h[?2004h[?1000h[?1002h[?1003h[?1006h]4;0;?[?2026h[?25l ███████████                        ██                 ▄████  ▄██                                                        ███▀▀▀▀▀▀▀▀                        ██                 ██    ██▀                                                         ███ █████  ██████ ▄█████   ▄████▄  ██████▄  ██   ██ ████████████                                                        ███ ███▀▀  ██▀   ███▄▄▄██ ██▄▄▄███ ██   ▀██ ██   ██   ██    ██                                                          ███ ███    ███   ███▀▀▀▀▀ ██▀▀▀▀▀  ██▄  ▄██ ██▄  ██   ██    ██                                                          ███ ██▀    ██▀    ▀█████   ▀████▀  ██████▀   ▀████▀   ██    ██                                                                                                                                                                                  ┌──────────────────────────────────────────────────────────────────┐                                                    │ Your first message starts the session.                           │                                                    │ Some models aren't available on this connection                  │                                                    └──────────────────────────────────────────────────────────────────┘                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│                                                                                                                      ││  ▍Enter a coding task or / for commands                                                                              ││                                                                                                                      │╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ GLM 5.3 Flash • max · /private/tmp/orca-freebuff-trust · /model to change · Chat: New chat                              ← for history · ? for help                                                                                             [?2026l[?1004h[?2026h[?25l95/100 Freebucks remaining                     │                                                                  ││✦ Refer friends → earn Freebucks:││││⎘ Copy invite link  Learn More ↵│└──────────────────────────────────────────────────────────────────┘[?2026l[?2026h[?25l1 day streak                                 ✦ Refer friends → earn Freebucks:                                │ ⎘ Copy invite link  Learn More ↵                                 │└──────────────────────────────────────────────────────────────────┘[?2026l[?2026h[?25l ███████████                        ██                 ▄████  ▄██                                                        ███▀▀▀▀▀▀▀▀                        ██                 ██    ██▀                                                         ███ █████  ██████ ▄█████   ▄████▄  ██████▄  ██   ██ ████████████                                                        ███ ███▀▀  ██▀   ███▄▄▄██ ██▄▄▄███ ██   ▀██ ██   ██   ██    ██                                                          ███ ███    ███   ███▀▀▀▀▀ ██▀▀▀▀▀  ██▄  ▄██ ██▄  ██   ██    ██                                                          ███ ██▀    ██▀    ▀█████   ▀████▀  ██████▀   ▀████▀   ██    ██                                                                                                                                                                                  ┌──────────────────────────────────────────────────────────────────┐                                                    │ Your first message starts the session.                           │                                                    │ 95/100 Freebucks remaining                                       │                                                    │ 1 day streak                                                     │                                                    │                                                                  │                                                    │ ✦ Refer friends → earn Freebucks:                                │                                                    │                                                                  │                                                    │ ⎘ Copy invite link  Learn More ↵                                 │                                                    └──────────────────────────────────────────────────────────────────┘                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│                                                                                                                      ││  ▍Enter a coding task or / for commands                                                                              ││                                                                                                                      │╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ GLM 5.3 Flash • max · /private/tmp/orca-freebuff-trust · /model to change · Chat: New chat                              ← for history · ? for help                                                                                             [?2026l[?2026h[?25l╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│MARS | A robot to build physical AI agents  Ad││A mobile robot with an arm to run agents for $995. Start in simulation. Bring it to life.││ Learn more innate.bot│╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯[?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/freebuff-trust.meta.json b/src/main/runtime/__fixtures__/freebuff-trust.meta.json
new file mode 100644
index 00000000000..d4513cba70e
--- /dev/null
+++ b/src/main/runtime/__fixtures__/freebuff-trust.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-28T08:09:19.020Z",
+  "platform": "darwin",
+  "command": ["freebuff", "--cwd", "/tmp/orca-freebuff-trust"],
+  "cols": 120,
+  "rows": 40,
+  "note": "Freebuff 0.1.2; harmless repository agent file trust prompt, not accepted",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/freebuff-trust.txt b/src/main/runtime/__fixtures__/freebuff-trust.txt
new file mode 100644
index 00000000000..48ca2e77160
--- /dev/null
+++ b/src/main/runtime/__fixtures__/freebuff-trust.txt
@@ -0,0 +1,9 @@
+]11;?]10;?
+freebuff found agent files in this repository it has not run before:
+
+  /private/tmp/orca-freebuff-trust/.agents
+    agents: demo.ts
+
+These run with your permissions and can read your environment. Only load them if you trust this repository.
+
+Load and run these? [y/N] 
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/orca-runtime-terminal-close-continuity-fixtures.ts b/src/main/runtime/__fixtures__/orca-runtime-terminal-close-continuity-fixtures.ts
index 94528481622..c0053bc75ae 100644
--- a/src/main/runtime/__fixtures__/orca-runtime-terminal-close-continuity-fixtures.ts
+++ b/src/main/runtime/__fixtures__/orca-runtime-terminal-close-continuity-fixtures.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { vi, type Mock } from 'vitest'
 import { makePaneKey } from '../../../shared/stable-pane-id'
 import type { WorkspaceSessionState } from '../../../shared/workspace-session-state-types'
@@ -20,6 +21,7 @@ import {
   WORKTREE_ID,
   WORKTREE_PATH,
   canaryProcess,
+  makeDeferred,
   makeSession
 } from './orca-runtime-terminal-close-continuity-state-fixture'
 import { createCloseContinuityGraphFixture } from './orca-runtime-terminal-close-continuity-graph-fixture'
@@ -45,18 +47,11 @@ export {
   makeSession
 } from './orca-runtime-terminal-close-continuity-state-fixture'
 
-function makeDeferred() {
-  let resolve!: () => void
-  const promise = new Promise<void>((settle) => {
-    resolve = settle
-  })
-  return { promise, resolve }
-}
-
 export type CloseContinuityHarness = {
   runtime: OrcaRuntimeService
   acknowledged: ReturnType<typeof makeDeferred>
   closeTerminal: Mock<(...args: unknown[]) => unknown>
+  closeTerminalPane: Mock<(...args: unknown[]) => unknown>
   closeTerminalTab: Mock<(...args: unknown[]) => unknown>
   flushOrThrow: Mock<() => void>
   kill: Mock<(ptyId: string) => boolean>
@@ -67,6 +62,7 @@ export type CloseContinuityHarness = {
   syncFixtureTabWithoutLeaf: () => void
   syncSplitFixtureGraph: () => void
   getSession: () => WorkspaceSessionState
+  editSession: (edit: (session: WorkspaceSessionState) => WorkspaceSessionState) => void
   makeSessionUnavailable: () => void
   removeVictimFromInventory: () => void
   retirePersistedTab: () => void
@@ -101,7 +97,7 @@ function createHarness(
     badgeColor: '#000000',
     addedAt: 1
   }
-  const store = {
+  const store = withDurableRuntimeStore({
     getRepos: () => [repo],
     getRepo: (id: string) => (id === REPO_ID ? repo : undefined),
     getAllWorktreeMeta: () => ({}),
@@ -117,11 +113,12 @@ function createHarness(
         throw flushError
       }
     })
-  }
+  })
   const acknowledged = makeDeferred()
   let closeTerminalTabError: Error | null = null
   let closeTerminalTabAction: (() => void | Promise<void>) | null = null
   const closeTerminal = vi.fn()
+  const closeTerminalPane = vi.fn()
   const closeTerminalTab = vi.fn(() => {
     if (closeTerminalTabError) {
       return Promise.reject(closeTerminalTabError)
@@ -162,7 +159,8 @@ function createHarness(
     ...(options.includeCanary ? [canaryProcess] : [])
   ])
   const runtime = new OrcaRuntimeService(store as never)
-  runtime.setNotifier({ closeTerminal, closeTerminalTab } as never)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: these close paths call only the listed notifier methods.
+  runtime.setNotifier({ closeTerminal, closeTerminalPane, closeTerminalTab } as never)
   runtime.setPtyController({
     write: () => true,
     kill,
@@ -201,16 +199,20 @@ function createHarness(
     }
   }
   graph.syncFixtureGraph()
-  return {
+  return withDurableRuntimeStore({
     runtime,
     acknowledged,
     closeTerminal,
+    closeTerminalPane,
     closeTerminalTab,
     flushOrThrow: store.flushOrThrow,
     kill,
     stopAndWait,
     ...graph,
     getSession: () => session,
+    editSession: (edit) => {
+      session = edit(session)
+    },
     makeSessionUnavailable: () => {
       sessionAvailable = false
     },
@@ -264,7 +266,7 @@ function createHarness(
         }
       }
     }
-  }
+  })
 }
 
 function createPtyBackedPublishedSurfaceHarness(): CloseContinuityHarness {
diff --git a/src/main/runtime/__fixtures__/orca-runtime-terminal-close-continuity-state-fixture.ts b/src/main/runtime/__fixtures__/orca-runtime-terminal-close-continuity-state-fixture.ts
index d304ff57d23..21013296daf 100644
--- a/src/main/runtime/__fixtures__/orca-runtime-terminal-close-continuity-state-fixture.ts
+++ b/src/main/runtime/__fixtures__/orca-runtime-terminal-close-continuity-state-fixture.ts
@@ -106,3 +106,11 @@ export function makeSession(ptyId = PTY_ID, includeCanary = false): WorkspaceSes
     }
   }
 }
+
+export function makeDeferred() {
+  let resolve!: () => void
+  const promise = new Promise<void>((settle) => {
+    resolve = settle
+  })
+  return { promise, resolve }
+}
diff --git a/src/main/runtime/__fixtures__/qoder-no-account.meta.json b/src/main/runtime/__fixtures__/qoder-no-account.meta.json
new file mode 100644
index 00000000000..e434627627c
--- /dev/null
+++ b/src/main/runtime/__fixtures__/qoder-no-account.meta.json
@@ -0,0 +1,17 @@
+{
+  "capturedAt": "2026-09-28T08:03:27.131Z",
+  "platform": "darwin",
+  "command": [
+    "qodercli",
+    "--config-dir",
+    "/tmp/orca-qoder-probe/config",
+    "--cwd",
+    "/tmp/orca-qoder-probe/workspace",
+    "--prompt-interactive",
+    "Reply with hello."
+  ],
+  "cols": 100,
+  "rows": 32,
+  "note": "Qoder CLI 1.1.64; isolated trusted folder; no account; lifecycle hook capture",
+  "exitCode": 129
+}
diff --git a/src/main/runtime/__fixtures__/qoder-no-account.txt b/src/main/runtime/__fixtures__/qoder-no-account.txt
new file mode 100644
index 00000000000..9c675342559
--- /dev/null
+++ b/src/main/runtime/__fixtures__/qoder-no-account.txt
@@ -0,0 +1,66 @@
+[?u]11;?\[>q[>4;?m
]0;◇ Qoder CLI | Ready                                                             ]8;;78

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+[?25h[?25l[?1006l[?1002l[?1004h]0;◇ Qoder CLI | Ready                                                             [?2004h[?2004h[?1004h

+ ██████╭─Tipsforgettingstarted────────────────────────────────╮

+████│1.UseAGENTS.mdfilestocustomizeinteractions│

+██████QoderCLIv1.1.64│2./helpformoreinformation│

+████│3.Askcodingquestions,editcodeorruncommands│

+ ██████NotLoginPleaseAuth│4.Bespecificforthebestresults│

+╰───────────────────────────────────────────────────────────╯

+

+

+ Authenticating

+────────────────────────────────────────────────────────────────────────────────────────────────────

+

+⠋Waitingforauthentication...

+

+Escback

+[>0q
Welcome to Qoder CLI
Signintogetstarted,orexittheapplication.

❯1.Signintocontinue
   2. Exittheapplication

+

+↑/↓navigate·Enterselect·Escback

+]0;✦ Qoder CLI | Working                                                           
 > Reply with hello.

 Welcome to Qoder CLI
────────────────────────────────────────────────────────────────────────────────────────────────────
Sign in toget started, orexittheapplication.

❯1.Signintocontinue
   2. Exit the application

+

+↑/↓navigate·Enterselect·Escback

+]0;✦ Reply with hello. | Working                                                   ]0;◇ Reply with hello. | Ready                                                     
 x Qoder authenticationisnotready.Pleasesigninagain(e.g.via/login)beforesendinga
   message.
 Welcome to Qoder CLI
────────────────────────────────────────────────────────────────────────────────────────────────────
Sign in toget started, orexittheapplication.

❯1.Signintocontinue
   2. Exit the application

+

+↑/↓navigate·Enterselect·Escback

+


+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/qoder-ready.meta.json b/src/main/runtime/__fixtures__/qoder-ready.meta.json
new file mode 100644
index 00000000000..d197b691db4
--- /dev/null
+++ b/src/main/runtime/__fixtures__/qoder-ready.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-28T08:15:00.339Z",
+  "platform": "darwin",
+  "command": ["qodercli", "--cwd", "/tmp/orca-qoder-probe/workspace"],
+  "cols": 100,
+  "rows": 32,
+  "note": "Qoder CLI 1.1.64; existing browser-login config; credit limit reached; no prompt submitted",
+  "exitCode": 129
+}
diff --git a/src/main/runtime/__fixtures__/qoder-ready.txt b/src/main/runtime/__fixtures__/qoder-ready.txt
new file mode 100644
index 00000000000..e198f8ff3bb
--- /dev/null
+++ b/src/main/runtime/__fixtures__/qoder-ready.txt
@@ -0,0 +1,66 @@
+[?u]11;?\[>q[>4;?m
]0;◇ Qoder CLI | Ready                                                             ]8;;78

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+[?25h[?25l[?1006l[?1002l[?1004h]0;◇ Qoder CLI | Ready                                                             [?2004h[?2004h[?1004h

+ ██████╭─Tipsforgettingstarted──────────────────────────────╮

+████│1.UseAGENTS.mdfilestocustomizeinteractions│

+██████QoderCLIv1.1.64│2./helpformoreinformation│

+████│3.Askcodingquestions,editcodeorruncommands│

+ ██████SignedinBrowserLogin│4.Bespecificforthebestresults│

+╰─────────────────────────────────────────────────────────╯

+

+

+?forshortcuts

+────────────────────────────────────────────────────────────────────────────────────────────────────

+Shift+TabtoAcceptEdits

+────────────────────────────────────────────────────────────────────────────────────────────────────

+> Typeyourmessageor@path/to/file

+────────────────────────────────────────────────────────────────────────────────────────────────────

+Model·ctx░░░░░░░░░░0%·/private/tmp/orca-qoder-probe/workspace

+[>0q
Qwen3.8-Max Model · ctx░░░░░░░░░░ 0% · /privte/tmp/oca-qoder-robe/workspace

+
●Warning:Truecolor(24-bit)supportnotdetected.Usingaterminalwithtruecolor enabled will
   result in a better visual experience.

                                                                                    ? for shortcuts
────────────────────────────────────────────────────────────────────────────────────────────────────
 Shift+Tab to Accept Edits                                                             1 MCP server
────────────────────────────────────────────────────────────────────────────────────────────────────

+> Typeyourmessageor@path/to/file

+────────────────────────────────────────────────────────────────────────────────────────────────────

+Qwen3.8-MaxModel·ctx░░░░░░░░░░0%·/private/tmp/orca-qoder-probe/workspace

+
1MCPserver · 34kills

+
+
+
+
+
Creditsexhausted.Use/usagefordetailsor/upgradefor more.

+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/qoder-trust-dialog.meta.json b/src/main/runtime/__fixtures__/qoder-trust-dialog.meta.json
new file mode 100644
index 00000000000..f028a668af3
--- /dev/null
+++ b/src/main/runtime/__fixtures__/qoder-trust-dialog.meta.json
@@ -0,0 +1,15 @@
+{
+  "capturedAt": "2026-09-28T07:56:42.619Z",
+  "platform": "darwin",
+  "command": [
+    "qodercli",
+    "--config-dir",
+    "/tmp/orca-qoder-probe/config",
+    "--cwd",
+    "/tmp/orca-qoder-probe/workspace"
+  ],
+  "cols": 100,
+  "rows": 32,
+  "note": "Qoder CLI 1.1.64; isolated configuration; no account",
+  "exitCode": 129
+}
diff --git a/src/main/runtime/__fixtures__/qoder-trust-dialog.txt b/src/main/runtime/__fixtures__/qoder-trust-dialog.txt
new file mode 100644
index 00000000000..039f945f776
--- /dev/null
+++ b/src/main/runtime/__fixtures__/qoder-trust-dialog.txt
@@ -0,0 +1,58 @@
+[?u]11;?\[>q[>4;?m
]0;◇ Qoder CLI | Ready                                                             ]8;;78

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+[?25h[?25l[?1006l[?1002l[?1004h]0;◇ Qoder CLI | Ready                                                             [?2004h[?2004h[?1004h

+ ██████╭─Tipsforgettingstarted────────────────────────────────╮

+████│1.UseAGENTS.mdfilestocustomizeinteractions│

+██████QoderCLIv1.1.64│2./helpformoreinformation│

+████│3.Askcodingquestions,editcodeorruncommands│

+ ██████NotLoginPleaseAuth│4.Bespecificforthebestresults│

+╰───────────────────────────────────────────────────────────╯

+

+

+ Doyoutrustthefilesinthisfolder?

+────────────────────────────────────────────────────────────────────────────────────────────────────

+Pleaseconfirmthisisyourownprojectorfromatrustedsource.Oncetrusted,QoderCLIcan

+read,modify,andexecutefileshere,andwillloadlocalconfigurations(commands,hooks,MCP

+servers,agents,skills,settings).

+

+/private/tmp/orca-qoder-probe/workspace

+

+❯1.Trustfolder

+2.Don'ttrustandexit

+

+↑/↓navigate·Enterselect·Escback

+[>0q
 ● Warning: True color (24-bit) supportnotdetected.Usingaterminalwithtruecolorenabledwill
   result in a better visual experience.

 Do you trust the files in this folder?
────────────────────────────────────────────────────────────────────────────────────────────────────
Pleaseconfirmthisisyourownprojectorfromatrustedsource.Oncetrusted,QoderCLIcan
read, modify, and execute files here, andwillloadlocalconfigurations(commands,hooks,MCP
servers,agents,skills,settings).

/private/tmp/orca-qoder-probe/workspace
 ❯ 1. Trust folder

+2.Don'ttrustandexit

+

+↑/↓navigate·Enterselect·Escback

+
\ No newline at end of file
diff --git a/src/main/runtime/acknowledged-terminal-tab-retirement-fixture.ts b/src/main/runtime/acknowledged-terminal-tab-retirement-fixture.ts
index 2173d080dcb..12b3340d2ac 100644
--- a/src/main/runtime/acknowledged-terminal-tab-retirement-fixture.ts
+++ b/src/main/runtime/acknowledged-terminal-tab-retirement-fixture.ts
@@ -3,8 +3,11 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { vi } from 'vitest'
 import { getDefaultWorkspaceSession } from '../../shared/constants'
+import type { PersistedState } from '../../shared/persisted-state-types'
 import type { RuntimeSyncWindowGraph } from '../../shared/runtime-types'
 import { closeTerminalTabInWorkspaceSession } from '../../shared/workspace-session-terminal-tab-close'
+import { ProfileStateSqliteAuthority } from '../persistence/profile-state/profile-state-sqlite-authority'
+import { DelayedAuthority } from '../persistence/loading-store/profile-state-delayed-authority-fixture'
 import { Store } from '../persistence/loading-store/store'
 import { OrcaRuntimeService } from './orca-runtime'
 import { buildHeadlessMobileSessionTerminalTabs } from './mobile-session-terminal-projection'
@@ -28,7 +31,14 @@ function deferred(): { promise: Promise<void>; resolve: () => void } {
 
 export function createAcknowledgedTabRetirementFixture(bound = false) {
   const directory = mkdtempSync(join(tmpdir(), 'orca-close-ack-'))
-  const store = new Store({ dataFile: join(directory, 'orca-data.json') })
+  const databasePath = join(directory, 'profile-state.db')
+  const authority = new DelayedAuthority(
+    new ProfileStateSqliteAuthority(databasePath, 'ack-retirement')
+  )
+  const store = new Store({
+    dataFile: join(directory, 'orca-data.json'),
+    profileStateAuthority: authority
+  })
   store.addRepo({
     id: 'repo1',
     path: '/tmp/worktree',
@@ -141,6 +151,7 @@ export function createAcknowledgedTabRetirementFixture(bound = false) {
   store.setWorkspaceSession(
     advanceTerminalTopologyRevision(store.getWorkspaceSession(), ACK_WORKTREE)
   )
+  let finalFlush: Promise<void> | undefined
   const entered = deferred()
   const acknowledgement = deferred()
   const closeTerminalTab = vi.fn(async () => {
@@ -150,7 +161,7 @@ export function createAcknowledgedTabRetirementFixture(bound = false) {
       ACK_TAB
     )
     store.setWorkspaceSession({ ...closed.session, terminalTopologyRevisionByRepoId: undefined })
-    store.flushOrThrow()
+    await store.flushPendingOrThrowAsync()
     entered.resolve()
     await acknowledgement.promise
   })
@@ -171,20 +182,35 @@ export function createAcknowledgedTabRetirementFixture(bound = false) {
   return {
     runtime,
     store,
+    authority,
     entered,
     acknowledgement,
     closeTerminalTab,
     publish,
+    /** Reads what a relaunch would load, independent of the store's in-memory state. */
+    readDisk: (): PersistedState => {
+      const reader = new ProfileStateSqliteAuthority(databasePath, 'ack-retirement')
+      try {
+        return JSON.parse(reader.readSerializedState() ?? '{}')
+      } finally {
+        reader.close()
+      }
+    },
     hasTab: () =>
       store.getWorkspaceSession().tabsByWorktree[ACK_WORKTREE].some((tab) => tab.id === ACK_TAB),
     close: (options: { force?: boolean } = {}) =>
       runtime.closeMobileSessionTab(`id:${ACK_WORKTREE}`, ACK_TAB, { reason: 'user', ...options }),
+    /** The app-quit flush; it finalizes persistence, so dispose must not flush again. */
+    quit: () => (finalFlush ??= store.flushFinalOrThrowAsync()),
     dispose: async () => {
       runtime.setNotifier(null)
       runtime.syncWindowGraph(1, { tabs: [], leaves: [], mobileSessionTabs: [] })
-      store.flush()
-      store.freezeWrites()
-      await store.waitForPendingWrite()
+      if (finalFlush) {
+        await finalFlush
+      } else {
+        await store.flushPendingOrThrowAsync()
+        await store.freezeWritesAsync()
+      }
       setRuntimeDesktopSurface(null)
       rmSync(directory, { recursive: true, force: true })
     }
diff --git a/src/main/runtime/acknowledged-terminal-tab-retirement.test.ts b/src/main/runtime/acknowledged-terminal-tab-retirement.test.ts
index 91c3cb1b1d6..179dba29bd1 100644
--- a/src/main/runtime/acknowledged-terminal-tab-retirement.test.ts
+++ b/src/main/runtime/acknowledged-terminal-tab-retirement.test.ts
@@ -8,6 +8,7 @@ import {
   createAcknowledgedTabRetirementFixture
 } from './acknowledged-terminal-tab-retirement-fixture'
 import { advanceTerminalTopologyRevision } from './workspace-session-terminal-membership-authority'
+import { delegatedMobileSessionTabClose } from './mobile-session-tab-close-outcome'
 
 const fixtures: ReturnType<typeof createAcknowledgedTabRetirementFixture>[] = []
 afterEach(async () => {
@@ -78,7 +79,7 @@ it.each([false, true])(
     }
     const pending = f.close()
     await f.entered.promise
-    f.runtime.onPtyExit('pty-a', 0, ACK_INCARNATION, { providerExitObserved: true })
+    await f.runtime.onPtyExit('pty-a', 0, ACK_INCARNATION, { providerExitObserved: true })
     expect(f.store.getWorkspaceSession().terminalLayoutsByTabId[ACK_TAB].ptyIdsByLeafId).toEqual({
       [ACK_SECOND_LEAF]: 'pty-b'
     })
@@ -103,7 +104,7 @@ it('protects a persisted incarnation replacement on the same leaf and raw PTY ID
   const f = fixture(true)
   const pending = f.close()
   await f.entered.promise
-  f.store.persistPtyBinding({
+  await f.store.persistPtyBinding({
     worktreeId: ACK_WORKTREE,
     tabId: ACK_TAB,
     leafId: ACK_LEAF,
@@ -133,13 +134,27 @@ it('rechecks current pins after renderer acknowledgement', async () => {
   f.acknowledgement.resolve()
   await expect(pending).rejects.toThrow('terminal_tab_pinned')
   expect(f.hasTab()).toBe(true)
+  await expect(f.store.flushPendingOrThrowAsync()).resolves.toBeUndefined()
+})
+
+it('keeps persistence writable when worktree teardown finds remaining terminal rows', async () => {
+  const f = fixture()
+  f.store.updateRepo('repo1', { executionHostId: 'ssh:target' })
+  f.store.setWorktreeMeta(ACK_WORKTREE, { hostId: 'ssh:target' })
+  f.store.setWorkspaceSession(f.store.getWorkspaceSession(), 'ssh:target')
+  vi.spyOn(f.runtime, 'closeMobileSessionTab').mockResolvedValue(delegatedMobileSessionTabClose())
+  await expect(f.runtime.closeTerminalsForWorktree(`id:${ACK_WORKTREE}`)).rejects.toThrow(
+    'terminal_close_incomplete'
+  )
+  expect(f.hasTab()).toBe(true)
+  await expect(f.store.flushPendingOrThrowAsync()).resolves.toBeUndefined()
 })
 
 it('preserves dormant SSH kill IDs when the acknowledged tab becomes headless', async () => {
   const f = fixture()
   const visible = 'ssh:target@@visible'
   const dormant = 'ssh:target@@persisted-only'
-  f.store.persistPtyBinding({
+  await f.store.persistPtyBinding({
     worktreeId: ACK_WORKTREE,
     tabId: ACK_TAB,
     leafId: ACK_LEAF,
diff --git a/src/main/runtime/agent-prompt-line-settle.test.ts b/src/main/runtime/agent-prompt-line-settle.test.ts
index 45d8bca53a6..4ac0d9648ee 100644
--- a/src/main/runtime/agent-prompt-line-settle.test.ts
+++ b/src/main/runtime/agent-prompt-line-settle.test.ts
@@ -37,7 +37,7 @@ describe('agent prompt line-settle scheduling', () => {
       () => undefined,
       'antigravity'
     )
-    const submission = runtime.sendTerminalAgentPrompt(handle, prompt)
+    const submission = runtime.sendTerminalAgentPrompt(handle, prompt, { inputKind: 'driving' })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.advanceTimersByTimeAsync(submitDelayMs - 1)
diff --git a/src/main/runtime/agent-prompt-receipt-correlation.test.ts b/src/main/runtime/agent-prompt-receipt-correlation.test.ts
index e6b6d7f2793..77e8967b6d3 100644
--- a/src/main/runtime/agent-prompt-receipt-correlation.test.ts
+++ b/src/main/runtime/agent-prompt-receipt-correlation.test.ts
@@ -34,6 +34,7 @@ describe('agent prompt receipt correlation', () => {
     runtime.onPtyData('pty-prompt', '\x1b]0;Codex working\x07', Date.now())
 
     const firstPromise = runtime.sendTerminalAgentPrompt(handle, 'first prompt', {
+      inputKind: 'driving',
       acceptQueued: true,
       requestId: 'historical-first',
       observationTimeoutMs: 0
@@ -41,6 +42,7 @@ describe('agent prompt receipt correlation', () => {
     await vi.runAllTimersAsync()
     const first = await firstPromise
     const secondPromise = runtime.sendTerminalAgentPrompt(handle, 'second prompt', {
+      inputKind: 'driving',
       acceptQueued: true,
       requestId: 'historical-second',
       observationTimeoutMs: 0
diff --git a/src/main/runtime/agent-prompt-submission-runtime-hook-and-generation.test.ts b/src/main/runtime/agent-prompt-submission-runtime-hook-and-generation.test.ts
index c893623a18a..3d0c317a31b 100644
--- a/src/main/runtime/agent-prompt-submission-runtime-hook-and-generation.test.ts
+++ b/src/main/runtime/agent-prompt-submission-runtime-hook-and-generation.test.ts
@@ -102,7 +102,9 @@ describe('agent prompt submission runtime hook and generation cases', () => {
       getForegroundProcess: async () => null
     })
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
 
     await expect(submission).resolves.toMatchObject({ accepted: true })
@@ -130,6 +132,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
     })
 
     const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving',
       acceptQueued: true,
       requestId: 'antigravity-pre-invocation',
       observationTimeoutMs: 20_000
@@ -156,7 +159,9 @@ describe('agent prompt submission runtime hook and generation cases', () => {
       stateStartedAt: 1_000
     })
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('agent_prompt_stalled')
     await vi.runAllTimersAsync()
 
@@ -171,6 +176,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
     const { runtime, handle, writes } = await createHookOnlyPromptRuntime(hook, 'codex')
 
     const firstPromise = runtime.sendTerminalAgentPrompt(handle, 'first prompt', {
+      inputKind: 'driving',
       acceptQueued: true,
       requestId: 'hook-queued-first',
       observationTimeoutMs: 0
@@ -193,6 +199,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
       getForegroundProcess: async () => null
     })
     const secondPromise = runtime.sendTerminalAgentPrompt(handle, 'second prompt', {
+      inputKind: 'driving',
       acceptQueued: true,
       requestId: 'hook-queued-second',
       observationTimeoutMs: 500
@@ -219,7 +226,9 @@ describe('agent prompt submission runtime hook and generation cases', () => {
   it('does not write Enter after the PTY generation changes during settlement', async () => {
     vi.useFakeTimers()
     const { runtime, handle, writes } = await createPromptRuntime(() => undefined)
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('terminal_handle_stale')
 
     await vi.advanceTimersByTimeAsync(0)
@@ -256,6 +265,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
     )
 
     const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving',
       signal: controller.signal
     })
     const rejected = expect(submission).rejects.toThrow('request_aborted')
@@ -291,7 +301,9 @@ describe('agent prompt submission runtime hook and generation cases', () => {
       sequenceAtSpawnStart
     )
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
 
     await expect(submission).resolves.toMatchObject({ accepted: true })
@@ -318,9 +330,9 @@ describe('agent prompt submission runtime hook and generation cases', () => {
       sequenceAtSpawnStart
     )
 
-    await expect(runtime.sendTerminalAgentPrompt(handle, 'review this')).rejects.toThrow(
-      'agent_prompt_blocked'
-    )
+    await expect(
+      runtime.sendTerminalAgentPrompt(handle, 'review this', { inputKind: 'driving' })
+    ).rejects.toThrow('agent_prompt_blocked')
     expect(writes).toEqual([])
   })
 
@@ -331,7 +343,9 @@ describe('agent prompt submission runtime hook and generation cases', () => {
         runtime.onPtyData('pty-prompt', '\x1b]0;Codex waiting for permission\x07', Date.now())
       }
     })
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('agent_prompt_blocked')
 
     await vi.runAllTimersAsync()
@@ -351,8 +365,10 @@ describe('agent prompt submission runtime hook and generation cases', () => {
       }
     })
 
-    const first = runtime.sendTerminalAgentPrompt(handle, 'first prompt')
-    const second = runtime.sendTerminalAgentPrompt(handle, 'second prompt')
+    const first = runtime.sendTerminalAgentPrompt(handle, 'first prompt', { inputKind: 'driving' })
+    const second = runtime.sendTerminalAgentPrompt(handle, 'second prompt', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
     await Promise.all([first, second])
 
@@ -373,6 +389,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
     runtime.onPtyData('pty-prompt', '\x1b]0;Codex working\x07', Date.now())
 
     const firstPromise = runtime.sendTerminalAgentPrompt(handle, 'first prompt', {
+      inputKind: 'driving',
       acceptQueued: true,
       requestId: 'queued-first',
       observationTimeoutMs: 0
@@ -380,6 +397,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
     await vi.runAllTimersAsync()
     const first = await firstPromise
     const secondPromise = runtime.sendTerminalAgentPrompt(handle, 'second prompt', {
+      inputKind: 'driving',
       acceptQueued: true,
       requestId: 'queued-second',
       observationTimeoutMs: 0
@@ -418,6 +436,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
     })
 
     const first = runtime.sendTerminalAgentPrompt(handle, 'obsolete prompt', {
+      inputKind: 'driving',
       beforeWrite: async () => {
         firstWriteReached()
         await firstGate
@@ -430,7 +449,9 @@ describe('agent prompt submission runtime hook and generation cases', () => {
       0
     )
 
-    const replacement = runtime.sendTerminalAgentPrompt(handle, 'replacement prompt')
+    const replacement = runtime.sendTerminalAgentPrompt(handle, 'replacement prompt', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
     await expect(replacement).resolves.toMatchObject({ accepted: true })
     expect(writes.some((data) => data.includes('replacement prompt'))).toBe(true)
@@ -444,6 +465,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
     let writeChecks = 0
 
     const submission = runtime.sendTerminalAgentPrompt(handle, 'x'.repeat(20_000), {
+      inputKind: 'driving',
       beforeWrite: () => {
         writeChecks += 1
         if (writeChecks === 2) {
@@ -466,6 +488,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
     const controller = new AbortController()
     const { runtime, handle, writes } = await createPromptRuntime(() => undefined)
     const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving',
       signal: controller.signal
     })
     const rejected = expect(submission).rejects.toThrow('request_aborted')
@@ -483,6 +506,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
     const controller = new AbortController()
     const { runtime, handle, writes } = await createPromptRuntime(() => undefined)
     const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving',
       signal: controller.signal
     })
     const rejected = expect(submission).rejects.toThrow('request_aborted')
diff --git a/src/main/runtime/agent-prompt-submission-runtime.test.ts b/src/main/runtime/agent-prompt-submission-runtime.test.ts
index 873863ada75..700445483a9 100644
--- a/src/main/runtime/agent-prompt-submission-runtime.test.ts
+++ b/src/main/runtime/agent-prompt-submission-runtime.test.ts
@@ -43,7 +43,9 @@ describe('agent prompt submission runtime', () => {
       }
     )
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
 
     await expect(submission).resolves.toMatchObject({ accepted: true })
@@ -59,7 +61,9 @@ describe('agent prompt submission runtime', () => {
       }
     })
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
 
     await expect(submission).resolves.toMatchObject({ accepted: true })
@@ -75,7 +79,9 @@ describe('agent prompt submission runtime', () => {
         runtime.onPtyData('pty-prompt', '\x1b[2J\x1b[H› review this', Date.now())
       }
     })
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.runAllTimersAsync()
@@ -93,7 +99,9 @@ describe('agent prompt submission runtime', () => {
       }
     })
     runtime.onPtyData('pty-prompt', '\x1b]0;Codex idle\x07', Date.now())
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.runAllTimersAsync()
@@ -109,7 +117,9 @@ describe('agent prompt submission runtime', () => {
         runtime.onPtyData('pty-prompt', '\x1b]0;Codex waiting for permission\x07', Date.now())
       }
     })
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('agent_prompt_blocked')
 
     await vi.runAllTimersAsync()
@@ -122,9 +132,9 @@ describe('agent prompt submission runtime', () => {
     const { runtime, handle, writes } = await createPromptRuntime(() => undefined)
     runtime.onPtyData('pty-prompt', '\x1b]0;Codex waiting for permission\x07', Date.now())
 
-    await expect(runtime.sendTerminalAgentPrompt(handle, 'review this')).rejects.toThrow(
-      'agent_prompt_blocked'
-    )
+    await expect(
+      runtime.sendTerminalAgentPrompt(handle, 'review this', { inputKind: 'driving' })
+    ).rejects.toThrow('agent_prompt_blocked')
     expect(writes).toEqual([])
   })
 
@@ -140,9 +150,9 @@ describe('agent prompt submission runtime', () => {
       Date.now()
     )
 
-    await expect(runtime.sendTerminalAgentPrompt(handle, 'review this')).rejects.toThrow(
-      'agent_prompt_blocked'
-    )
+    await expect(
+      runtime.sendTerminalAgentPrompt(handle, 'review this', { inputKind: 'driving' })
+    ).rejects.toThrow('agent_prompt_blocked')
     expect(writes).toEqual([])
   })
 
@@ -155,9 +165,9 @@ describe('agent prompt submission runtime', () => {
       Date.now()
     )
 
-    await expect(runtime.sendTerminalAgentPrompt(handle, 'review this')).rejects.toThrow(
-      'agent_prompt_blocked'
-    )
+    await expect(
+      runtime.sendTerminalAgentPrompt(handle, 'review this', { inputKind: 'driving' })
+    ).rejects.toThrow('agent_prompt_blocked')
     expect(writes).toEqual([])
   })
 
@@ -175,7 +185,9 @@ describe('agent prompt submission runtime', () => {
     )
     runtime.onPtyData('pty-prompt', '}\x07\x07', Date.now())
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('agent_prompt_blocked')
     await vi.runAllTimersAsync()
 
@@ -197,9 +209,9 @@ describe('agent prompt submission runtime', () => {
       Date.now()
     )
 
-    await expect(runtime.sendTerminalAgentPrompt(handle, 'review this')).rejects.toThrow(
-      'agent_prompt_blocked'
-    )
+    await expect(
+      runtime.sendTerminalAgentPrompt(handle, 'review this', { inputKind: 'driving' })
+    ).rejects.toThrow('agent_prompt_blocked')
     expect(writes).toEqual([])
   })
 
@@ -214,7 +226,9 @@ describe('agent prompt submission runtime', () => {
       text: 'Permission required\r\nAllow once\r\nAllow always\r\nReject\r\n'
     })
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
 
     await expect(submission).resolves.toMatchObject({ accepted: true })
@@ -235,7 +249,9 @@ describe('agent prompt submission runtime', () => {
       }
     })
     runtime.onPtyData('pty-prompt', '\x1b]0;Codex idle\x07', Date.now())
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('agent_prompt_blocked')
 
     await vi.runAllTimersAsync()
@@ -257,7 +273,9 @@ describe('agent prompt submission runtime', () => {
         runtime.onPtyData('pty-prompt', output, Date.now())
       }
     })
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('agent_prompt_blocked')
 
     await vi.runAllTimersAsync()
@@ -271,6 +289,7 @@ describe('agent prompt submission runtime', () => {
     let writeChecks = 0
 
     const submission = runtime.sendTerminalAgentPrompt(handle, 'x'.repeat(20_000), {
+      inputKind: 'driving',
       beforeWrite: () => {
         writeChecks += 1
         if (writeChecks === 2) {
@@ -291,6 +310,7 @@ describe('agent prompt submission runtime', () => {
     let writeChecks = 0
 
     const submission = runtime.sendTerminalAgentPrompt(handle, 'x'.repeat(20_000), {
+      inputKind: 'driving',
       beforeWrite: () => {
         writeChecks += 1
         if (writeChecks === 2) {
@@ -319,9 +339,9 @@ describe('agent prompt submission runtime', () => {
     )
     runtime.onPtyData('pty-prompt', '\x1b]0;Codex waiting for permission\x07', Date.now())
 
-    await expect(runtime.sendTerminalAgentPrompt(handle, 'review this')).rejects.toThrow(
-      'agent_prompt_blocked'
-    )
+    await expect(
+      runtime.sendTerminalAgentPrompt(handle, 'review this', { inputKind: 'driving' })
+    ).rejects.toThrow('agent_prompt_blocked')
     expect(writes).toEqual([])
   })
 
@@ -369,7 +389,9 @@ describe('agent prompt submission runtime', () => {
     )
     vi.setSystemTime(2_000)
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
 
     await expect(submission).resolves.toMatchObject({ accepted: true })
@@ -389,7 +411,9 @@ describe('agent prompt submission runtime', () => {
       Date.now()
     )
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
 
     await expect(submission).resolves.toMatchObject({ accepted: true })
@@ -408,7 +432,9 @@ describe('agent prompt submission runtime', () => {
       Date.now()
     )
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('agent_prompt_stalled')
     await vi.runAllTimersAsync()
 
@@ -432,7 +458,9 @@ describe('agent prompt submission runtime', () => {
       Date.now()
     )
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
 
     await expect(submission).resolves.toMatchObject({ accepted: true })
@@ -453,6 +481,7 @@ describe('agent prompt submission runtime', () => {
     )
 
     const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving',
       acceptQueued: true,
       requestId: 'queued-output-only',
       observationTimeoutMs: 0
diff --git a/src/main/runtime/agent-prompt-submission-windows-submit-delay.test.ts b/src/main/runtime/agent-prompt-submission-windows-submit-delay.test.ts
index f6298df8b17..3bc936c78a5 100644
--- a/src/main/runtime/agent-prompt-submission-windows-submit-delay.test.ts
+++ b/src/main/runtime/agent-prompt-submission-windows-submit-delay.test.ts
@@ -111,7 +111,9 @@ describe('agent prompt submit delay on a ConPTY host', () => {
     vi.useFakeTimers()
     const { runtime, handle, writes } = await createPromptRuntime()
     const delayMs = submitDelayFor('review this', 'win32')
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.advanceTimersByTimeAsync(delayMs - 1)
@@ -131,7 +133,7 @@ describe('agent prompt submit delay on a ConPTY host', () => {
     // Measured ConPTY ingest for 8 KB is 60-89 ms; the old constant charged 1_500 ms.
     const delayMs = submitDelayFor(prompt, 'win32')
     expect(delayMs).toBeLessThan(700)
-    const submission = runtime.sendTerminalAgentPrompt(handle, prompt)
+    const submission = runtime.sendTerminalAgentPrompt(handle, prompt, { inputKind: 'driving' })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.advanceTimersByTimeAsync(delayMs)
@@ -146,7 +148,7 @@ describe('agent prompt submit delay on a ConPTY host', () => {
     vi.useFakeTimers()
     const { runtime, handle, writes, submitTimes } = await createPromptRuntime()
     const prompt = 'y'.repeat(320_000)
-    const submission = runtime.sendTerminalAgentPrompt(handle, prompt)
+    const submission = runtime.sendTerminalAgentPrompt(handle, prompt, { inputKind: 'driving' })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     // Every byte is already handed to node-pty here -- the hazard is that the *host* is
@@ -167,6 +169,7 @@ describe('agent prompt submit delay on a ConPTY host', () => {
     const controller = new AbortController()
     const { runtime, handle, writes } = await createPromptRuntime()
     const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving',
       signal: controller.signal
     })
     const rejected = expect(submission).rejects.toThrow('request_aborted')
@@ -186,7 +189,9 @@ describe('agent prompt submit delay on a ConPTY host', () => {
     const { runtime, handle, writes } = await createPromptRuntime()
     const delayMs = submitDelayFor(HOST_PROBE_PROMPT, 'darwin')
     expect(delayMs).toBeLessThan(submitDelayFor(HOST_PROBE_PROMPT, 'win32'))
-    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT)
+    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT, {
+      inputKind: 'driving'
+    })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.advanceTimersByTimeAsync(delayMs - 1)
@@ -215,7 +220,9 @@ describe('agent prompt submit delay follows the execution host', () => {
     patchPtyRecord(runtime, { isWsl: true, wslDistro: 'Ubuntu' })
     const delayMs = submitDelayFor(HOST_PROBE_PROMPT, 'win32')
     expect(delayMs).toBeGreaterThan(submitDelayFor(HOST_PROBE_PROMPT, 'linux'))
-    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT)
+    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT, {
+      inputKind: 'driving'
+    })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.advanceTimersByTimeAsync(delayMs - 1)
@@ -235,7 +242,9 @@ describe('agent prompt submit delay follows the execution host', () => {
     registerSshRemotePlatform('win32')
     const clientDelayMs = submitDelayFor(HOST_PROBE_PROMPT, 'darwin')
     const hostDelayMs = submitDelayFor(HOST_PROBE_PROMPT, 'win32')
-    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT)
+    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT, {
+      inputKind: 'driving'
+    })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.advanceTimersByTimeAsync(clientDelayMs)
@@ -255,7 +264,9 @@ describe('agent prompt submit delay follows the execution host', () => {
     registerSshRemotePlatform('linux')
     const delayMs = submitDelayFor(HOST_PROBE_PROMPT, 'linux')
     expect(delayMs).toBeLessThan(submitDelayFor(HOST_PROBE_PROMPT, 'win32'))
-    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT)
+    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT, {
+      inputKind: 'driving'
+    })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.advanceTimersByTimeAsync(delayMs - 1)
@@ -277,7 +288,9 @@ describe('agent prompt submit delay follows the execution host', () => {
     })
     registerSshRemotePlatform(undefined)
     const delayMs = submitDelayFor(HOST_PROBE_PROMPT, 'win32')
-    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT)
+    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT, {
+      inputKind: 'driving'
+    })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.advanceTimersByTimeAsync(delayMs - 1)
@@ -341,7 +354,9 @@ describe('agent prompt render gate on a ConPTY host', () => {
     useHostPlatform('win32')
     vi.useFakeTimers()
     const { runtime, handle, writes, submitTimes } = await createSettlementRuntime()
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'y'.repeat(320_000))
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'y'.repeat(320_000), {
+      inputKind: 'driving'
+    })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     // Marker at 100 ms + a 1_500 ms quiet window would have submitted at ~1_600 ms, while
@@ -370,7 +385,7 @@ describe('agent prompt render gate on a ConPTY host', () => {
       markerDelayMs: ingestMs - 1_000,
       noiseUntilMs: ingestMs + 20_000
     })
-    const submission = runtime.sendTerminalAgentPrompt(handle, prompt)
+    const submission = runtime.sendTerminalAgentPrompt(handle, prompt, { inputKind: 'driving' })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.advanceTimersByTimeAsync(ingestMs + 8_000 - 1)
@@ -387,7 +402,9 @@ describe('agent prompt render gate on a ConPTY host', () => {
     useHostPlatform('win32')
     vi.useFakeTimers()
     const { runtime, handle, submitTimes } = await createSettlementRuntime()
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.runAllTimersAsync()
@@ -409,7 +426,11 @@ describe('plain terminal send suffix delay', () => {
     useHostPlatform('win32')
     vi.useFakeTimers()
     const { runtime, handle, writes, submitTimes } = await createPromptRuntime()
-    const send = runtime.sendTerminal(handle, { text: 'z'.repeat(320_000), enter: true })
+    const send = runtime.sendTerminal(
+      handle,
+      { text: 'z'.repeat(320_000), enter: true },
+      { inputKind: 'driving' }
+    )
 
     // Same hazard as the agent-prompt path: a flat 500 ms wrote Enter mid-paste here.
     await vi.advanceTimersByTimeAsync(3_342)
@@ -429,7 +450,7 @@ describe('plain terminal send suffix delay', () => {
     const send = runtime.sendTerminal(
       handle,
       { text: 'z'.repeat(320_000), enter: true },
-      { signal: controller.signal }
+      { inputKind: 'driving', signal: controller.signal }
     )
     const rejected = expect(send).rejects.toThrow('request_aborted')
 
diff --git a/src/main/runtime/agent-session-acquisition-failure-settlement.ts b/src/main/runtime/agent-session-acquisition-failure-settlement.ts
index 9335dd230bb..f6efaa890c3 100644
--- a/src/main/runtime/agent-session-acquisition-failure-settlement.ts
+++ b/src/main/runtime/agent-session-acquisition-failure-settlement.ts
@@ -15,10 +15,12 @@ import type { AgentSessionStoreState } from './agent-session-record-store-file'
  * How the failed attempt's provider process was accounted for.
  * - `exit-proven`: cleanup observed the whole tree gone.
  * - `root-exit-observed`: the owner root's exit was observed first-hand, so the
- *   identity this lease is keyed on is dead, but its descendants could not be
- *   verified. Releases the lease and says exactly that, claiming nothing more.
+ *   identity this lease is keyed on is dead, but its descendants were not proven
+ *   gone. Releases the lease and says exactly that, claiming nothing more.
  * - `processless`: the attempt failed before a process existed.
- * - `unproven`: nothing about the process was observed; the reservation latches.
+ * - `unproven`: nothing about the process was observed. A recorded owner goes to recovery, which
+ *   concludes about it; a reservation that recorded none is released, since the adapter already
+ *   closed the stdio of anything it spawned.
  */
 export type AgentSessionAcquisitionExitProof =
   | 'exit-proven'
@@ -84,34 +86,32 @@ export function settleFailedAgentSessionPostAcquisitionAttachment(
   }
   const next =
     args.exitProof === 'unproven'
-      ? withLease(record, {
-          ...record.lease,
-          handoffStage: 'recovering',
-          handoffOperationId: null,
-          lastRenewedAt: args.now
-        })
+      ? {
+          ...withLease(record, {
+            ...record.lease,
+            handoffStage: 'recovering',
+            handoffOperationId: null
+          }),
+          updatedAt: args.now
+        }
       : withLease(record, {
           ...record.lease,
           runtimeFence: nextAgentSessionFence(record.lease),
           handoffStage: null,
           ownerProcess: null,
           reservedSpawnToken: null,
-          processlessAt: null,
           claimStatus: 'released',
           lastRenewedAt: args.now,
           handoffOperationId: null,
-          deathEvidence:
-            args.exitProof === 'root-exit-observed'
-              ? {
-                  kind: 'exit-observed',
-                  detail: 'the provider process exited; its descendants were not verifiable',
-                  observedAt: args.now
-                }
-              : {
-                  kind: 'exit-observed',
-                  detail: 'post-acquisition cleanup proved no provider child remains',
-                  observedAt: args.now
-                }
+          deathEvidence: {
+            kind: 'exit-observed',
+            detail:
+              args.exitProof === 'root-exit-observed'
+                ? 'the provider process exited; its descendants were not proven gone'
+                : 'post-acquisition cleanup proved no provider child remains',
+            observedAt: args.now,
+            ownerFence: record.lease.runtimeFence
+          }
         })
   state.records.set(args.sessionId, next)
   state.operations = settleAgentSessionOperation(state.operations, args)
@@ -131,15 +131,18 @@ function settleFailedLease(
   ) {
     throw new Error('agent_session_ownership_unknown')
   }
-  if (args.exitProof === 'unproven') {
-    return withLease(record, {
-      ...record.lease,
-      handoffStage: record.lease.ownerProcess ? 'recovering' : 'manual-recovery',
-      // The operation is durably settled failed below; a lease still naming it would
-      // read as an in-flight transfer to every consumer that keys on the stage + id pair.
-      handoffOperationId: null,
-      lastRenewedAt: args.now
-    })
+  if (args.exitProof === 'unproven' && record.lease.ownerProcess) {
+    // Parking in recovery proves nothing alive, so `lastRenewedAt` keeps the spawn's proof.
+    return {
+      ...withLease(record, {
+        ...record.lease,
+        handoffStage: 'recovering',
+        // The operation is durably settled failed below; a lease still naming it would
+        // read as an in-flight transfer to every consumer that keys on the stage + id pair.
+        handoffOperationId: null
+      }),
+      updatedAt: args.now
+    }
   }
   return withLease(record, {
     ...record.lease,
@@ -147,33 +150,38 @@ function settleFailedLease(
     handoffStage: null,
     ownerProcess: null,
     reservedSpawnToken: null,
-    processlessAt: null,
     claimStatus: 'released',
     lastRenewedAt: args.now,
     handoffOperationId: null,
-    deathEvidence: acquisitionDeathEvidence(args.exitProof, args.now)
+    deathEvidence: acquisitionDeathEvidence(args.exitProof, args.now, record.lease.runtimeFence)
   })
 }
 
-/** Records only what was observed: never a tree claim the cleanup did not make. */
+/** Records only what was observed: never a tree claim the cleanup did not make, and nothing at all
+ *  when nothing was. */
 function acquisitionDeathEvidence(
   exitProof: AgentSessionAcquisitionExitProof,
-  observedAt: number
-): AgentSessionDeathEvidence {
+  observedAt: number,
+  ownerFence: number
+): AgentSessionDeathEvidence | null {
+  if (exitProof === 'unproven') {
+    return null
+  }
+  const proof = { observedAt, ownerFence }
   if (exitProof === 'processless') {
-    return { kind: 'pid-absent', detail: 'reservation failed before spawn', observedAt }
+    return { kind: 'pid-absent', detail: 'reservation failed before spawn', ...proof }
   }
   if (exitProof === 'root-exit-observed') {
     return {
       kind: 'exit-observed',
-      detail: 'the provider process exited; its descendants were not verifiable',
-      observedAt
+      detail: 'the provider process exited; its descendants were not proven gone',
+      ...proof
     }
   }
   // Cleanup proved no child of this attempt remains; it may never have spawned.
   return {
     kind: 'exit-observed',
     detail: 'acquisition cleanup proved no provider child remains',
-    observedAt
+    ...proof
   }
 }
diff --git a/src/main/runtime/agent-session-conversation-command-record.ts b/src/main/runtime/agent-session-conversation-command-record.ts
index 2e7053e8a1b..297b9dd34e7 100644
--- a/src/main/runtime/agent-session-conversation-command-record.ts
+++ b/src/main/runtime/agent-session-conversation-command-record.ts
@@ -1,4 +1,6 @@
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
 import type { AgentSessionStoreState } from './agent-session-record-store-file'
+import { AgentSessionTabTable } from './agent-session-tab-table'
 import type { AgentSessionConversationCommandRecord } from '../../shared/agent-session-conversation-command'
 
 export function commitConversationCommandRecord(
@@ -9,7 +11,7 @@ export function commitConversationCommandRecord(
 ): void {
   const record = state.records.get(sessionId)
   if (!record || record.lease.runtimeFence !== fence) {
-    throw new Error('agent_session_checkpoint_stale')
+    throw agentSessionRefusalError('agent_session_checkpoint_stale', { reason: 'leaseMoved' })
   }
   state.records.set(sessionId, { ...record, conversationCommand: command })
   if (
@@ -18,10 +20,9 @@ export function commitConversationCommandRecord(
     command.replacementSessionId
   ) {
     if (!state.records.has(command.replacementSessionId)) {
-      throw new Error('agent_session_identity_required')
+      throw agentSessionRefusalError('agent_session_identity_required', { reason: 'recordMissing' })
     }
-    state.visibleSessionIds.delete(sessionId)
-    state.visibleSessionIds.add(command.replacementSessionId)
-    state.visibleSessionIdsIndexPresent = true
+    state.sessionTabs ??= new AgentSessionTabTable()
+    state.sessionTabs.move(sessionId, command.replacementSessionId)
   }
 }
diff --git a/src/main/runtime/agent-session-death-evidence-persistence.test.ts b/src/main/runtime/agent-session-death-evidence-persistence.test.ts
new file mode 100644
index 00000000000..6e0bff8098c
--- /dev/null
+++ b/src/main/runtime/agent-session-death-evidence-persistence.test.ts
@@ -0,0 +1,228 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentSessionDeathEvidence } from '../../shared/agent-session-record'
+import {
+  agentSessionLeaseFixture,
+  agentSessionRecordFixture
+} from '../../shared/agent-session-record.test-fixture'
+import type { AgentSessionFailedAcquisitionSettlement } from './agent-session-acquisition-failure-settlement'
+import { AgentSessionRecordStore } from './agent-session-record-store'
+import { agentSessionStorePath } from './agent-session-record-store-file'
+
+const SESSION = 'session-alpha-1'
+/** The fixture lease's last renewal. */
+const LAST_RENEWED_AT = 30_000
+
+let directory: string
+
+async function seed(deathEvidence: AgentSessionDeathEvidence | null): Promise<void> {
+  const lease =
+    deathEvidence === null
+      ? agentSessionLeaseFixture()
+      : agentSessionLeaseFixture({
+          ownerProcess: null,
+          reservedSpawnToken: null,
+          claimStatus: 'released',
+          deathEvidence
+        })
+  await writeFile(
+    agentSessionStorePath(directory),
+    JSON.stringify({
+      schemaVersion: 2,
+      hostId: 'local',
+      records: { [SESSION]: agentSessionRecordFixture(lease) },
+      operations: {},
+      retiredClaimKeys: [],
+      unusableRecords: {}
+    })
+  )
+}
+
+function open(): Promise<AgentSessionRecordStore> {
+  return AgentSessionRecordStore.open({ directory, hostId: 'local' })
+}
+
+beforeEach(async () => {
+  directory = await mkdtemp(join(tmpdir(), 'orca-death-evidence-'))
+})
+
+afterEach(async () => {
+  await rm(directory, { recursive: true, force: true })
+})
+
+describe('death evidence on disk', () => {
+  it('records the last renewal before the crash and reads it back after another restart', async () => {
+    await seed(null)
+    const crashed = await open()
+    await crashed.reconcileOnRestart({
+      probe: async () => ({ outcome: 'pid-absent' }),
+      now: 90_000
+    })
+    const evidence = {
+      kind: 'pid-absent',
+      detail: 'recorded pid absent on host',
+      observedAt: 90_000,
+      ownerFence: 7,
+      lastProvenAliveAt: LAST_RENEWED_AT
+    }
+    expect(crashed.getRecord(SESSION)?.lease.deathEvidence).toEqual(evidence)
+    expect((await open()).getRecord(SESSION)?.lease.deathEvidence).toEqual(evidence)
+  })
+
+  it('loads evidence an older build wrote without a proven-alive time', async () => {
+    const olderBuild = { kind: 'pid-absent' as const, detail: 'gone', observedAt: 90_000 }
+    await seed(olderBuild)
+    const store = await open()
+    expect(store.isSessionUnreadable(SESSION)).toBe(false)
+    expect(store.getRecord(SESSION)?.lease.deathEvidence).toEqual(olderBuild)
+  })
+
+  it.each([
+    ['proves the owner alive after the probe found it gone', { lastProvenAliveAt: 90_001 }],
+    ['names no possible owner', { ownerFence: -1 }]
+  ])('quarantines evidence that %s', async (_why, field) => {
+    await seed({ kind: 'pid-absent', detail: 'gone', observedAt: 90_000, ...field })
+    expect((await open()).isSessionUnreadable(SESSION)).toBe(true)
+  })
+})
+
+describe('who is told a proof of death landed', () => {
+  it('tells a listener once the proof is committed, and never for a write that proves nothing', async () => {
+    await seed(null)
+    const store = await open()
+    const told: unknown[] = []
+    store.onDeathEvidence((sessionId) => told.push(store.getRecord(sessionId)?.lease.deathEvidence))
+    const unsubscribed = vi.fn()
+    store.onDeathEvidence(unsubscribed)()
+
+    await expect(
+      store.evictProvenDeadOwner({
+        sessionId: SESSION,
+        expectedFence: 6,
+        probe: { outcome: 'pid-absent' },
+        now: 80_000
+      })
+    ).rejects.toThrow()
+    await store.reconcileOnRestart({ probe: async () => ({ outcome: 'pid-absent' }), now: 90_000 })
+    // The proof already on the record is not news to a later write.
+    await store.setSessionTabVisibility(SESSION, true)
+
+    expect(told).toEqual([expect.objectContaining({ kind: 'pid-absent', ownerFence: 7 })])
+    expect(unsubscribed).not.toHaveBeenCalled()
+  })
+})
+
+describe('a failed acquisition', () => {
+  const NOW = 1_800_000_000_000
+  const OPERATION_ID = `${NOW}-${'1'.padStart(32, '0')}`
+
+  /** Reserve and observe the spawn at NOW, as an attach does before it can fail. */
+  async function spawnedOwner(store: AgentSessionRecordStore): Promise<number> {
+    const reserved = await store.reserveOwner({
+      sessionId: SESSION,
+      location: agentSessionRecordFixture().location,
+      provider: 'claude',
+      accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: '/home/dev/.claude' },
+      expectedFence: null,
+      spawnToken: 'spawn-a',
+      claimKeyId: 'key-1',
+      handoffOperationId: OPERATION_ID,
+      probe: { outcome: 'indeterminate', reason: 'no answer' },
+      operation: { callerKey: 'client-1', operationId: OPERATION_ID, fingerprint: 'fp-1' },
+      now: NOW
+    })
+    const fence = reserved.record.lease.runtimeFence
+    await store.commitProcessIdentity({
+      sessionId: SESSION,
+      fence,
+      process: { hostId: 'local', pid: 4242, processStartTimeMs: NOW, spawnToken: 'spawn-a' },
+      now: NOW
+    })
+    return fence
+  }
+
+  function unproven(fence: number, now: number): AgentSessionFailedAcquisitionSettlement {
+    return {
+      sessionId: SESSION,
+      fence,
+      spawnToken: 'spawn-a',
+      callerKey: 'client-1',
+      operationId: OPERATION_ID,
+      outcome: { status: 'failed', code: 'agent_session_operation_invalid', message: 'failed' },
+      exitProof: 'unproven',
+      now
+    }
+  }
+
+  it.each([
+    ['before the owner proved its handle', false],
+    ['after the owner proved its handle', true]
+  ] as const)(
+    'parks in recovery keeping the last proof of life, not the failure, %s',
+    async (_when, proved) => {
+      const store = await open()
+      const fence = await spawnedOwner(store)
+      if (proved) {
+        await store.proveOwner({
+          sessionId: SESSION,
+          fence,
+          link: {
+            linkId: 'link-1',
+            handle: { provider: 'claude', sessionId: 'provider-session-1', leafUuid: null },
+            origin: 'created',
+            mintedAtFence: fence,
+            observedAt: NOW
+          },
+          now: NOW
+        })
+        await store.settleFailedPostAcquisitionAttachment(unproven(fence, NOW + 60_000))
+      } else {
+        await store.settleFailedAcquisition(unproven(fence, NOW + 60_000))
+      }
+      expect(store.getRecord(SESSION)?.lease).toMatchObject({
+        handoffStage: 'recovering',
+        lastRenewedAt: NOW
+      })
+
+      const evicted = await store.evictProvenDeadOwner({
+        sessionId: SESSION,
+        expectedFence: fence,
+        probe: { outcome: 'pid-absent' },
+        now: NOW + 120_000
+      })
+      expect(evicted.lease.deathEvidence).toMatchObject({ lastProvenAliveAt: NOW })
+    }
+  )
+
+  it.each(['exit-proven', 'root-exit-observed', 'processless'] as const)(
+    'names its own fence in the proof when cleanup settles it %s',
+    async (exitProof) => {
+      const store = await open()
+      const fence = await spawnedOwner(store)
+      const settled =
+        exitProof === 'processless'
+          ? await store.settleFailedAcquisition({ ...unproven(fence, NOW), exitProof })
+          : await (async () => {
+              await store.proveOwner({
+                sessionId: SESSION,
+                fence,
+                link: {
+                  linkId: 'link-1',
+                  handle: { provider: 'claude', sessionId: 'provider-session-1', leafUuid: null },
+                  origin: 'created',
+                  mintedAtFence: fence,
+                  observedAt: NOW
+                },
+                now: NOW
+              })
+              return store.settleFailedPostAcquisitionAttachment({
+                ...unproven(fence, NOW),
+                exitProof
+              })
+            })()
+      expect(settled.lease.deathEvidence).toMatchObject({ ownerFence: fence })
+    }
+  )
+})
diff --git a/src/main/runtime/agent-session-eviction-settlement-latch.test.ts b/src/main/runtime/agent-session-eviction-settlement-latch.test.ts
deleted file mode 100644
index ebb893ef7e5..00000000000
--- a/src/main/runtime/agent-session-eviction-settlement-latch.test.ts
+++ /dev/null
@@ -1,141 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import {
-  agentSessionLeaseFixture,
-  agentSessionRecordFixture
-} from '../../shared/agent-session-record.test-fixture'
-import { evictAgentSessionOwner } from './agent-session-lease-transitions'
-import { applyAgentSessionRestartAdjudication } from './agent-session-restart-lease-transitions'
-
-const NOW = 1_800_000_000_000
-
-describe('proven-dead agent session eviction settlement', () => {
-  it('latches restart eviction with a stable id while keeping the lease resumable', () => {
-    const record = agentSessionRecordFixture(
-      agentSessionLeaseFixture({ runtimeKind: 'native', unreconciled: true })
-    )
-
-    const evicted = applyAgentSessionRestartAdjudication({
-      record,
-      probe: { outcome: 'pid-absent' },
-      now: NOW
-    })
-
-    expect(evicted.lease).toMatchObject({
-      claimStatus: 'released',
-      runtimeFence: 8,
-      handoffStage: null,
-      settlementRetryRequired: true,
-      settlementRetryId: 'restart-eviction:session-alpha-1:8',
-      deathEvidence: { kind: 'pid-absent', detail: 'recorded pid absent on host' }
-    })
-  })
-
-  it('owes no settlement for a start that died before proving its handle', () => {
-    const record = agentSessionRecordFixture(
-      agentSessionLeaseFixture({
-        runtimeKind: 'native',
-        claimStatus: 'reserved',
-        handoffStage: 'new-owner-proving',
-        handoffOperationId: 'attach-op-1',
-        unreconciled: true
-      })
-    )
-
-    const evicted = applyAgentSessionRestartAdjudication({
-      record,
-      probe: { outcome: 'pid-absent' },
-      now: NOW
-    })
-
-    expect(evicted.lease).toMatchObject({
-      claimStatus: 'released',
-      runtimeFence: 8,
-      handoffStage: null,
-      handoffOperationId: null
-    })
-    expect(evicted.lease).not.toHaveProperty('settlementRetryRequired')
-  })
-
-  it('latches recovery eviction from the same evicted disposition', () => {
-    const record = agentSessionRecordFixture(
-      agentSessionLeaseFixture({ runtimeKind: 'native', handoffStage: 'recovering' })
-    )
-
-    const evicted = evictAgentSessionOwner({
-      record,
-      expectedFence: 7,
-      probe: { outcome: 'identity-mismatch', field: 'process-start-time' },
-      now: NOW,
-      journalSettlement: 'required'
-    })
-
-    expect(evicted.lease).toMatchObject({
-      claimStatus: 'released',
-      runtimeFence: 8,
-      handoffStage: null,
-      settlementRetryRequired: true,
-      settlementRetryId: 'restart-eviction:session-alpha-1:8',
-      deathEvidence: { kind: 'identity-mismatch', detail: 'mismatched process-start-time' }
-    })
-  })
-
-  it('never latches an indeterminate owner', () => {
-    const restartRecord = agentSessionRecordFixture(
-      agentSessionLeaseFixture({ runtimeKind: 'native', unreconciled: true })
-    )
-    const recovered = applyAgentSessionRestartAdjudication({
-      record: restartRecord,
-      probe: { outcome: 'indeterminate', reason: 'remote host unavailable' },
-      now: NOW
-    })
-    const recoveryRecord = agentSessionRecordFixture(
-      agentSessionLeaseFixture({ runtimeKind: 'native', handoffStage: 'recovering' })
-    )
-
-    expect(recovered.lease).toMatchObject({
-      handoffStage: 'recovering',
-      ownerProcess: { pid: 4242 }
-    })
-    expect(recovered.lease).not.toHaveProperty('settlementRetryRequired')
-    expect(recovered.lease).not.toHaveProperty('settlementRetryId')
-    expect(() =>
-      evictAgentSessionOwner({
-        record: recoveryRecord,
-        expectedFence: 7,
-        probe: { outcome: 'indeterminate', reason: 'remote host unavailable' },
-        now: NOW,
-        journalSettlement: 'required'
-      })
-    ).toThrow('agent_session_ownership_unknown')
-    expect(recoveryRecord.lease).not.toHaveProperty('settlementRetryRequired')
-    expect(recoveryRecord.lease).not.toHaveProperty('settlementRetryId')
-  })
-
-  it('preserves a null handoff stage when the latch survives another restart', () => {
-    const record = agentSessionRecordFixture(
-      agentSessionLeaseFixture({
-        runtimeKind: 'native',
-        ownerProcess: null,
-        reservedSpawnToken: null,
-        claimStatus: 'released',
-        handoffStage: null,
-        settlementRetryRequired: true,
-        settlementRetryId: 'restart-eviction:session-alpha-1:8',
-        unreconciled: true
-      })
-    )
-
-    const restored = applyAgentSessionRestartAdjudication({
-      record,
-      probe: { outcome: 'indeterminate', reason: 'remote host unavailable' },
-      now: NOW
-    })
-
-    expect(restored.lease).toMatchObject({
-      handoffStage: null,
-      settlementRetryRequired: true,
-      settlementRetryId: 'restart-eviction:session-alpha-1:8',
-      unreconciled: false
-    })
-  })
-})
diff --git a/src/main/runtime/agent-session-launch-env-backfill.test.ts b/src/main/runtime/agent-session-launch-env-backfill.test.ts
deleted file mode 100644
index 50cf9e6b35c..00000000000
--- a/src/main/runtime/agent-session-launch-env-backfill.test.ts
+++ /dev/null
@@ -1,89 +0,0 @@
-import { mkdtemp, rm } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import { AgentSessionRecordStore } from './agent-session-record-store'
-import type { AgentSessionReserveRequest } from './agent-session-reservation-admission'
-
-const NOW = 1_800_000_000_000
-const SESSION = 'session-launch-env'
-let directory: string
-
-function request(overrides: Partial<AgentSessionReserveRequest> = {}): AgentSessionReserveRequest {
-  return {
-    sessionId: SESSION,
-    location: {
-      executionHostId: 'local',
-      wslDistro: null,
-      workspaceId: 'workspace-1',
-      workspaceKind: 'git-worktree'
-    },
-    provider: 'claude',
-    accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: '/home/dev/.claude' },
-    expectedFence: null,
-    spawnToken: 'spawn-a',
-    claimKeyId: 'key-1',
-    handoffOperationId: null,
-    probe: { outcome: 'reservation-unused' },
-    operation: {
-      callerKey: 'client-1',
-      operationId: `${NOW}-00000000000000000000000000000001`,
-      fingerprint: 'fp-1'
-    },
-    now: NOW,
-    ...overrides
-  }
-}
-
-beforeEach(async () => {
-  directory = await mkdtemp(join(tmpdir(), 'orca-agent-session-launch-env-'))
-})
-
-afterEach(async () => {
-  await rm(directory, { recursive: true, force: true })
-})
-
-describe('legacy agent session launch environment', () => {
-  it('durably pins the first environment resolved by a current reservation', async () => {
-    const store = await AgentSessionRecordStore.open({ directory, hostId: 'local' })
-    await store.reserveOwner(request())
-    await store.reserveOwner(
-      request({
-        expectedFence: 1,
-        spawnToken: 'spawn-b',
-        launchEnv: { ANTHROPIC_AUTH_TOKEN: 'pinned-token' },
-        operation: {
-          callerKey: 'client-1',
-          operationId: `${NOW}-00000000000000000000000000000002`,
-          fingerprint: 'fp-2'
-        }
-      })
-    )
-
-    const reopened = await AgentSessionRecordStore.open({ directory, hostId: 'local' })
-    expect(
-      (reopened.getRecord(SESSION) as { launchEnv?: Record<string, string> } | null)?.launchEnv
-    ).toBeUndefined()
-  })
-
-  it('rejects an environment that could not be reloaded before writing it', async () => {
-    const store = await AgentSessionRecordStore.open({ directory, hostId: 'local' })
-    const launchEnv = Object.fromEntries(
-      Array.from({ length: 257 }, (_, index) => [`KEY_${index}`, 'value'])
-    )
-
-    await expect(store.reserveOwner(request({ launchEnv }))).rejects.toThrow(
-      'agent_session_launch_env_invalid'
-    )
-    expect(store.getRecord(SESSION)).toBeNull()
-  })
-
-  it('rejects an overlong environment key before writing it', async () => {
-    const store = await AgentSessionRecordStore.open({ directory, hostId: 'local' })
-
-    await expect(
-      store.reserveOwner(request({ launchEnv: { ['K'.repeat(513)]: 'value' } }))
-    ).rejects.toThrow('agent_session_launch_env_invalid')
-    expect(store.getRecord(SESSION)).toBeNull()
-  })
-})
diff --git a/src/main/runtime/agent-session-lease-transitions.ts b/src/main/runtime/agent-session-lease-transitions.ts
index 580fbeda255..41e8d300e1e 100644
--- a/src/main/runtime/agent-session-lease-transitions.ts
+++ b/src/main/runtime/agent-session-lease-transitions.ts
@@ -6,9 +6,9 @@
  * observed process identity, and a proved provider handle — in that order, at one fence.
  */
 
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
 import {
   adjudicateAgentSessionRestart,
-  agentSessionRestartEvictionSettlementId,
   evaluateAgentSessionAcquisition,
   type AgentSessionOwnerProbe
 } from '../../shared/agent-session-lease-adjudication'
@@ -16,7 +16,9 @@ import {
   appendAgentSessionProviderHandleLink,
   type AgentSessionProviderHandleLink
 } from '../../shared/agent-session-provider-handle'
+import { nextAgentSessionFence } from '../../shared/agent-session-next-fence'
 import type {
+  AgentSessionDeathEvidence,
   AgentSessionJournalCheckpoint,
   AgentSessionLease,
   AgentSessionProcessIdentity,
@@ -40,10 +42,10 @@ export function withLease(
 
 export function assertFence(lease: AgentSessionLease, fence: number): void {
   if (lease.runtimeFence !== fence) {
-    throw new Error('agent_session_checkpoint_stale')
+    throw agentSessionRefusalError('agent_session_checkpoint_stale', { reason: 'leaseMoved' })
   }
   if (lease.unreconciled) {
-    throw new Error('execution_owner_reconciling')
+    throw agentSessionRefusalError('execution_owner_reconciling', { reason: 'hostReconciling' })
   }
 }
 
@@ -65,7 +67,7 @@ export function reserveAgentSessionOwner(args: {
     probe: args.probe
   })
   if (decision.decision === 'refused') {
-    throw new Error(decision.code)
+    throw agentSessionRefusalError(decision.code, decision.details)
   }
   if (decision.decision === 'retry-reservation') {
     return { record, disposition: 'retry-reservation' }
@@ -81,14 +83,11 @@ export function reserveAgentSessionOwner(args: {
       provenHandleLinkId: null,
       ownerProcess: null,
       reservedSpawnToken: reservation.spawnToken,
-      processlessAt: null,
       leaseDeadlineAt: reservation.now + reservation.leaseTtlMs,
       lastRenewedAt: reservation.now,
       handoffOperationId: reservation.handoffOperationId,
       claimKeyId: reservation.claimKeyId,
       claimStatus: 'reserved',
-      settlementRetryRequired: undefined,
-      settlementRetryId: undefined,
       deathEvidence: null
     })
   }
@@ -108,16 +107,19 @@ export function commitAgentSessionProcessIdentity(
   const { record } = args
   assertFence(record.lease, args.fence)
   if (record.lease.claimStatus !== 'reserved' || record.lease.ownerProcess !== null) {
-    throw new Error('agent_session_ownership_unknown')
+    throw agentSessionRefusalError('agent_session_ownership_unknown', {
+      reason: 'spawnIdentityMismatch'
+    })
   }
   if (record.lease.reservedSpawnToken !== args.process.spawnToken) {
     // Why: a child that cannot echo the reserved token is not the process Orca started.
-    throw new Error('agent_session_ownership_unknown')
+    throw agentSessionRefusalError('agent_session_ownership_unknown', {
+      reason: 'spawnIdentityMismatch'
+    })
   }
   return withLease(record, {
     ...record.lease,
     ownerProcess: args.process,
-    processlessAt: null,
     lastRenewedAt: args.now
   })
 }
@@ -140,7 +142,9 @@ export function proveAgentSessionOwner(args: {
     record.lease.handoffStage !== 'new-owner-proving' ||
     record.lease.ownerProcess === null
   ) {
-    throw new Error('agent_session_ownership_unknown')
+    throw agentSessionRefusalError('agent_session_ownership_unknown', {
+      reason: 'spawnIdentityMismatch'
+    })
   }
   if (args.link.handle.provider !== record.provider) {
     throw new Error('agent_session_provider_handle_provider_mismatch')
@@ -205,13 +209,9 @@ export function evictAgentSessionOwner(args: {
   expectedFence: number
   probe: AgentSessionOwnerProbe
   now: number
-  journalSettlement: 'required' | 'not-required'
 }): AgentSessionRecord {
   const { record } = args
   assertFence(record.lease, args.expectedFence)
-  if (record.lease.settlementRetryRequired) {
-    throw new Error('agent_session_ownership_unknown')
-  }
   const adjudication = adjudicateAgentSessionRestart({
     lease: record.lease,
     probe: args.probe,
@@ -224,29 +224,50 @@ export function evictAgentSessionOwner(args: {
       ...record.lease,
       handoffStage: null,
       handoffOperationId: null,
-      processlessAt: null,
       lastRenewedAt: args.now
     })
   }
   if (adjudication.disposition !== 'evicted') {
     throw new Error('agent_session_ownership_unknown')
   }
-  const settlementRequired = args.journalSettlement === 'required'
+  return releasedAgentSessionLease(record, adjudication.nextFence, adjudication.evidence, args.now)
+}
+
+/**
+ * Recovery's conclusion when proof never came: a recorded owner whose identity cannot be verified,
+ * or that survived the stop ladder. Its transport died with the runtime that held it, so nothing
+ * can drive it, and a verdict that never arrives must not hold the conversation. Nothing proved it
+ * gone, so no death evidence is written.
+ */
+export function releaseUnprovenAgentSessionOwner(args: {
+  record: AgentSessionRecord
+  expectedFence: number
+  now: number
+}): AgentSessionRecord {
+  const { record } = args
+  assertFence(record.lease, args.expectedFence)
+  if (record.lease.handoffStage !== 'recovering') {
+    throw new Error('agent_session_ownership_unknown')
+  }
+  return releasedAgentSessionLease(record, nextAgentSessionFence(record.lease), null, args.now)
+}
+
+function releasedAgentSessionLease(
+  record: AgentSessionRecord,
+  runtimeFence: number,
+  deathEvidence: AgentSessionDeathEvidence | null,
+  now: number
+): AgentSessionRecord {
   return withLease(record, {
     ...record.lease,
-    runtimeFence: adjudication.nextFence,
+    runtimeFence,
     handoffStage: null,
     ownerProcess: null,
     reservedSpawnToken: null,
-    processlessAt: null,
     claimStatus: 'released',
-    lastRenewedAt: args.now,
+    lastRenewedAt: now,
     handoffOperationId: null,
-    deathEvidence: adjudication.evidence,
-    settlementRetryRequired: settlementRequired ? true : undefined,
-    settlementRetryId: settlementRequired
-      ? agentSessionRestartEvictionSettlementId(record.lease, adjudication)
-      : undefined
+    deathEvidence
   })
 }
 
diff --git a/src/main/runtime/agent-session-operation-admission.test.ts b/src/main/runtime/agent-session-operation-admission.test.ts
index 0b8b9ff91f2..41df221ad12 100644
--- a/src/main/runtime/agent-session-operation-admission.test.ts
+++ b/src/main/runtime/agent-session-operation-admission.test.ts
@@ -48,6 +48,10 @@ describe('global agent-session operation admission', () => {
         fingerprint: 'different-send',
         now: NOW + 1
       }).decision
-    ).toEqual({ decision: 'refused', code: 'agent_session_operation_conflict' })
+    ).toEqual({
+      decision: 'refused',
+      code: 'agent_session_operation_conflict',
+      details: { reason: 'operationIdReused' }
+    })
   })
 })
diff --git a/src/main/runtime/agent-session-operation-admission.ts b/src/main/runtime/agent-session-operation-admission.ts
index 49dbab1c90d..f16d48efb9d 100644
--- a/src/main/runtime/agent-session-operation-admission.ts
+++ b/src/main/runtime/agent-session-operation-admission.ts
@@ -36,6 +36,7 @@ export type AgentSessionMutationOperationAdmission = {
   hostFingerprint: string
   now: number
   operationIdScope?: 'global'
+  conversationWrite?: true
 }
 
 export type AgentSessionMutationOperationDecision = {
@@ -132,7 +133,7 @@ function mutationOperation(
   }
 }
 
-/** Admit the ledger row and its lease/fence preconditions in one durable transaction. */
+/** Admit the ledger row and its writer-lease precondition in one durable transaction. */
 export function admitAgentSessionMutationOperation(
   state: AgentSessionStoreState,
   args: AgentSessionMutationOperationAdmission
@@ -149,7 +150,8 @@ export function admitAgentSessionMutationOperation(
     envelope: args.envelope,
     hostFingerprint: args.hostFingerprint,
     ledger: ledger.decision,
-    lease: record.lease
+    lease: record.lease,
+    ...(args.conversationWrite ? { conversationWrite: true } : {})
   })
   if (ledger.decision.decision === 'admit' && admission.decision === 'refused') {
     ledger.rows.delete(agentSessionOperationKey(operation.callerKey, operation.operationId))
diff --git a/src/main/runtime/agent-session-orphan-child-reaper.test.ts b/src/main/runtime/agent-session-orphan-child-reaper.test.ts
deleted file mode 100644
index eb837ac4a22..00000000000
--- a/src/main/runtime/agent-session-orphan-child-reaper.test.ts
+++ /dev/null
@@ -1,68 +0,0 @@
-// A child spawned under a reservation whose record was lost is invisible to the lease. Reaping
-// is bounded cleanup only; it never replaces the lease proof required to grant another writer.
-
-import { describe, expect, it, vi } from 'vitest'
-import type { AgentSessionRecordStore } from './agent-session-record-store'
-import { stopOrphanAgentSessionChildren } from './agent-session-orphan-child-reaper'
-
-function storeWithLeasedTokens(tokens: readonly string[]) {
-  return {
-    listOrphanSpawnTokens: (observed: readonly string[]) =>
-      observed.filter((token) => !tokens.includes(token))
-  } as Pick<AgentSessionRecordStore, 'listOrphanSpawnTokens'>
-}
-
-describe('orphan agent-session child reaper', () => {
-  it('stops every process whose spawn token no lease claims', async () => {
-    const stop = vi.fn()
-
-    const stopped = await stopOrphanAgentSessionChildren({
-      store: storeWithLeasedTokens(['token-owned']),
-      scan: async () =>
-        new Map([
-          ['token-owned', [101]],
-          ['token-lost', [202, 203]]
-        ]),
-      stop
-    })
-
-    expect(stopped).toEqual([202, 203])
-    expect(stop).toHaveBeenCalledWith(202, 'SIGTERM')
-    expect(stop).toHaveBeenCalledWith(203, 'SIGTERM')
-    expect(stop).not.toHaveBeenCalledWith(101, 'SIGTERM')
-  })
-
-  it('stops nothing on a host that cannot enumerate spawn tokens', async () => {
-    const stop = vi.fn()
-
-    // Null is "cannot answer", never "no tokens" — treating it as an empty scan would be a
-    // license to signal nothing, but a future empty-map reading would be a license to signal
-    // whatever the caller guessed.
-    const stopped = await stopOrphanAgentSessionChildren({
-      store: {
-        listOrphanSpawnTokens: () => {
-          throw new Error('the reaper must not ask when the host could not answer')
-        }
-      },
-      scan: async () => null,
-      stop
-    })
-
-    expect(stopped).toEqual([])
-    expect(stop).not.toHaveBeenCalled()
-  })
-
-  it('surfaces a failure to signal an observed orphan', async () => {
-    const failure = Object.assign(new Error('not permitted'), { code: 'EPERM' })
-
-    await expect(
-      stopOrphanAgentSessionChildren({
-        store: storeWithLeasedTokens([]),
-        scan: async () => new Map([['token-lost', [202]]]),
-        stop: () => {
-          throw failure
-        }
-      })
-    ).rejects.toBe(failure)
-  })
-})
diff --git a/src/main/runtime/agent-session-orphan-child-reaper.ts b/src/main/runtime/agent-session-orphan-child-reaper.ts
deleted file mode 100644
index 68d9c899024..00000000000
--- a/src/main/runtime/agent-session-orphan-child-reaper.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-/**
- * Best-effort stop for provider children that carry an Orca spawn token no lease claims.
- *
- * A child spawned under a reservation whose record was lost — the primary store file went with it,
- * or the crash beat the durable write — is unreachable but still connected to the provider session.
- * Only a token match justifies signalling a process; neither age nor CPU is evidence, and a host
- * that cannot enumerate tokens stops nothing. This never proves process exit or licenses a new
- * owner; lease adjudication remains the single-writer boundary.
- */
-
-import type { AgentSessionRecordStore } from './agent-session-record-store'
-import {
-  scanAgentSessionSpawnTokenProcesses,
-  type AgentSessionSpawnTokenScan
-} from './agent-session-spawn-token-process-scan'
-
-export type AgentSessionOrphanStopSignal = 'SIGTERM' | 'SIGKILL'
-
-function defaultStop(pid: number, signal: AgentSessionOrphanStopSignal): void {
-  try {
-    process.kill(pid, signal)
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code !== 'ESRCH') {
-      throw error
-    }
-  }
-}
-
-/** Returns the pids signalled, so the caller can report what it reaped. */
-export async function stopOrphanAgentSessionChildren(input: {
-  store: Pick<AgentSessionRecordStore, 'listOrphanSpawnTokens'>
-  scan?: () => Promise<AgentSessionSpawnTokenScan | null>
-  stop?: (pid: number, signal: AgentSessionOrphanStopSignal) => void
-}): Promise<number[]> {
-  const observed = await (input.scan ?? scanAgentSessionSpawnTokenProcesses)()
-  if (observed === null || observed.size === 0) {
-    return []
-  }
-  const stop = input.stop ?? defaultStop
-  const stopped: number[] = []
-  for (const token of input.store.listOrphanSpawnTokens([...observed.keys()])) {
-    for (const pid of observed.get(token) ?? []) {
-      stop(pid, 'SIGTERM')
-      stopped.push(pid)
-    }
-  }
-  return stopped
-}
diff --git a/src/main/runtime/agent-session-process-identity-probe.ts b/src/main/runtime/agent-session-process-identity-probe.ts
index 3fa1971b830..0fe0a16f4ee 100644
--- a/src/main/runtime/agent-session-process-identity-probe.ts
+++ b/src/main/runtime/agent-session-process-identity-probe.ts
@@ -4,8 +4,8 @@
  * Pids are reused within minutes on a busy host, and reuse happens precisely in the recovery
  * case, so a bare pid match is never proof. Every element of the identity tuple is unavailable
  * somewhere — start time costs a CIM query on Windows and is missing in some containers, /proc
- * does not exist on macOS — so an exact but unanswerable identity stays fenced in `recovering`;
- * an ownerless, unattributable reservation enters `manual-recovery`.
+ * does not exist on macOS — so an unanswerable identity reports `indeterminate` and is never read
+ * as alive or dead.
  */
 
 import { readFile } from 'node:fs/promises'
diff --git a/src/main/runtime/agent-session-processless-reservation.ts b/src/main/runtime/agent-session-processless-reservation.ts
deleted file mode 100644
index 9415ba8fcb7..00000000000
--- a/src/main/runtime/agent-session-processless-reservation.ts
+++ /dev/null
@@ -1,44 +0,0 @@
-import type { AgentSessionRecord } from '../../shared/agent-session-record'
-
-export type AgentSessionReservationProcesslessProof = {
-  sessionId: string
-  fence: number
-  spawnToken: string
-  now: number
-}
-
-function assertReservation(
-  record: AgentSessionRecord,
-  args: AgentSessionReservationProcesslessProof
-): void {
-  if (record.lease.runtimeFence !== args.fence || record.lease.unreconciled) {
-    throw new Error('agent_session_checkpoint_stale')
-  }
-  if (
-    record.lease.claimStatus !== 'reserved' ||
-    record.lease.reservedSpawnToken !== args.spawnToken
-  ) {
-    throw new Error('agent_session_ownership_unknown')
-  }
-}
-
-export function setAgentSessionReservationProcesslessProof(
-  args: AgentSessionReservationProcesslessProof & {
-    record: AgentSessionRecord
-    processlessAt: number | null
-  }
-): AgentSessionRecord {
-  const { record } = args
-  assertReservation(record, args)
-  if (args.processlessAt === null && record.lease.processlessAt == null) {
-    return record
-  }
-  if (record.lease.ownerProcess !== null) {
-    throw new Error('agent_session_ownership_unknown')
-  }
-  return {
-    ...record,
-    lease: { ...record.lease, processlessAt: args.processlessAt },
-    updatedAt: args.now
-  }
-}
diff --git a/src/main/runtime/agent-session-provider-handle-transition.ts b/src/main/runtime/agent-session-provider-handle-transition.ts
index f0408901868..57d2ecb172c 100644
--- a/src/main/runtime/agent-session-provider-handle-transition.ts
+++ b/src/main/runtime/agent-session-provider-handle-transition.ts
@@ -1,3 +1,4 @@
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
 import {
   agentSessionProviderHandleChainHead,
   appendAgentSessionProviderHandleLink,
@@ -20,7 +21,7 @@ export function recordAgentSessionProviderHandle(args: {
     throw new Error('agent_session_provider_handle_invalid')
   }
   if (record.lease.claimStatus !== 'live' && record.lease.handoffStage !== 'new-owner-proving') {
-    throw new Error('agent_session_ownership_unknown')
+    throw agentSessionRefusalError('agent_session_ownership_unknown', { reason: 'leaseMoved' })
   }
   const providerHandleChain = appendAgentSessionProviderHandleLink(
     record.providerHandleChain,
diff --git a/src/main/runtime/agent-session-record-options.ts b/src/main/runtime/agent-session-record-options.ts
index 8cf88d685f3..697b63a0422 100644
--- a/src/main/runtime/agent-session-record-options.ts
+++ b/src/main/runtime/agent-session-record-options.ts
@@ -1,3 +1,4 @@
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
 import type {
   AgentSessionOptionsReplacement,
   AgentSessionRecord
@@ -7,8 +8,11 @@ export function replaceAgentSessionRecordOptions(
   record: AgentSessionRecord,
   replacement: AgentSessionOptionsReplacement
 ): AgentSessionRecord {
-  if (record.lease.runtimeFence !== replacement.fence || record.lease.claimStatus !== 'live') {
-    throw new Error('agent_session_ownership_unknown')
+  const { lease } = record
+  // At rest the host is the only writer: a pick is intent the next start replays.
+  const atRest = lease.claimStatus === 'released' && lease.ownerProcess === null
+  if (lease.runtimeFence !== replacement.fence || (lease.claimStatus !== 'live' && !atRest)) {
+    throw agentSessionRefusalError('agent_session_ownership_unknown', { reason: 'leaseMoved' })
   }
   return { ...record, options: { ...replacement.options }, updatedAt: replacement.now }
 }
diff --git a/src/main/runtime/agent-session-record-store-file.ts b/src/main/runtime/agent-session-record-store-file.ts
index b721055e2a9..ef0f4b1ab7f 100644
--- a/src/main/runtime/agent-session-record-store-file.ts
+++ b/src/main/runtime/agent-session-record-store-file.ts
@@ -21,10 +21,9 @@ import {
   type AgentSessionRecord
 } from '../../shared/agent-session-record'
 import { normalizeLegacyHandoffRecord } from '../../shared/agent-session-legacy-handoff-lease'
-import { structuredAgentSessionTabId } from '../../shared/structured-agent-session-projection'
 import { agentSessionStoreBackupPath as backupPath } from './agent-session-record-store-write'
 export { saveAgentSessionStore } from './agent-session-record-store-write'
-import { parseVisibleSessionIds } from './agent-session-visible-tab-index'
+import { parseAgentSessionTabTable, type AgentSessionTabTable } from './agent-session-tab-table'
 import { serializeAgentSessionStoreState } from './agent-session-store-serialization'
 
 export const AGENT_SESSION_STORE_SCHEMA_VERSION = 2 as const
@@ -41,10 +40,8 @@ export type AgentSessionStoreState = {
   retiredClaimKeys: RetiredAgentSessionClaimKey[]
   /** Rows this build cannot validate, kept with a durable refusal reason. */
   unreadableRecords: Map<string, { reason: string; raw: unknown }>
-  /** Structured sessions that currently have a visible chat tab. */
-  visibleSessionIds: Set<string>
-  /** True once this store has committed the visibility index field. */
-  visibleSessionIdsIndexPresent: boolean
+  /** Chat tab id → the conversation it shows; null until this store first records a tab. */
+  sessionTabs: AgentSessionTabTable | null
 }
 
 export type LoadedAgentSessionStore = {
@@ -72,33 +69,10 @@ function emptyState(hostId: string): AgentSessionStoreState {
     operations: new Map(),
     retiredClaimKeys: [],
     unreadableRecords: new Map(),
-    visibleSessionIds: new Set(),
-    visibleSessionIdsIndexPresent: false
+    sessionTabs: null
   }
 }
 
-/**
- * Gives every record written before the host owned a chat's tab id the string clients derived for
- * it, so read state, notification ids and worker rows keyed by that id stay valid on upgrade.
- *
- * Runs once per open, after the disk revision is taken and before the load rewrite: it is not part
- * of parsing, because a parsed state must hash to what is on disk or every transaction would read
- * the file as externally changed. Returns how many records it filled.
- */
-export function backfillAgentSessionSurfaceTabIds(state: AgentSessionStoreState): number {
-  let filled = 0
-  for (const [sessionId, record] of state.records) {
-    if (record.surfaceTabId === undefined) {
-      state.records.set(sessionId, {
-        ...record,
-        surfaceTabId: structuredAgentSessionTabId(sessionId)
-      })
-      filled += 1
-    }
-  }
-  return filled
-}
-
 export function agentSessionStoreRevision(state: AgentSessionStoreState): string {
   return createHash('sha256')
     .update(String(state.schemaVersion))
@@ -131,6 +105,7 @@ function parseState(
     operations?: unknown
     retiredClaimKeys?: unknown
     unusableRecords?: unknown
+    sessionTabs?: unknown
     visibleSessionIds?: unknown
   }
   if (
@@ -245,16 +220,15 @@ function parseState(
       state.retiredClaimKeys.push({ keyId: key.keyId, retiredAt: key.retiredAt as number })
     }
   }
-  const visibleSessionIds = parseVisibleSessionIds(
-    file.visibleSessionIds,
-    schemaVersion,
-    AGENT_SESSION_STORE_SCHEMA_VERSION
+  const sessionTabs = parseAgentSessionTabTable(
+    file,
+    state.records,
+    schemaVersion === AGENT_SESSION_STORE_SCHEMA_VERSION
   )
-  if (!visibleSessionIds.valid) {
+  if (!sessionTabs.valid) {
     return null
   }
-  state.visibleSessionIdsIndexPresent = visibleSessionIds.present
-  visibleSessionIds.ids.forEach((sessionId) => state.visibleSessionIds.add(sessionId))
+  state.sessionTabs = sessionTabs.table
   return { state, needsRewrite, legacyHandoffLeasesNormalized }
 }
 
diff --git a/src/main/runtime/agent-session-record-store-legacy-handoff-lease.test.ts b/src/main/runtime/agent-session-record-store-legacy-handoff-lease.test.ts
index 3b92eeb5fe7..c614cfa5515 100644
--- a/src/main/runtime/agent-session-record-store-legacy-handoff-lease.test.ts
+++ b/src/main/runtime/agent-session-record-store-legacy-handoff-lease.test.ts
@@ -125,7 +125,7 @@ describe('a lease the removed terminal handoff wrote', () => {
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       unreconciled: false,
       claimStatus: 'conflicted',
-      handoffStage: 'manual-recovery'
+      handoffStage: 'recovering'
     })
     const settled = await readFile(agentSessionStorePath(directory), 'utf-8')
     await open()
diff --git a/src/main/runtime/agent-session-record-store-surface-tab-id.test.ts b/src/main/runtime/agent-session-record-store-surface-tab-id.test.ts
deleted file mode 100644
index f9603e7a86b..00000000000
--- a/src/main/runtime/agent-session-record-store-surface-tab-id.test.ts
+++ /dev/null
@@ -1,149 +0,0 @@
-/**
- * The host-owned id of the tab that shows a structured chat, as the record store persists it.
- * Separate from the store's main suite only because that file is at its line cap.
- */
-
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import type { AgentSessionOwnerProbe } from '../../shared/agent-session-lease-adjudication'
-import type { AgentSessionExecutionLocation } from '../../shared/agent-session-record'
-import { AgentSessionRecordStore } from './agent-session-record-store'
-import { agentSessionStorePath } from './agent-session-record-store-file'
-import type { AgentSessionReserveRequest } from './agent-session-reservation-admission'
-
-const NOW = 1_800_000_000_000
-const NATIVE: AgentSessionExecutionLocation = {
-  executionHostId: 'local',
-  wslDistro: null,
-  workspaceId: 'workspace-1',
-  workspaceKind: 'git-worktree'
-}
-const INDETERMINATE: AgentSessionOwnerProbe = { outcome: 'indeterminate', reason: 'no answer' }
-
-let directory: string
-let counter = 0
-
-beforeEach(async () => {
-  directory = await mkdtemp(join(tmpdir(), 'orca-agent-session-surface-tab-id-'))
-})
-
-afterEach(async () => {
-  await rm(directory, { recursive: true, force: true })
-})
-
-function operationId(now = NOW): string {
-  counter += 1
-  return `${now}-${String(counter)
-    .padStart(32, '0')
-    .replaceAll(/[^0-9a-f]/g, '0')}`
-}
-
-function reserveRequest(
-  overrides: Partial<AgentSessionReserveRequest> = {}
-): AgentSessionReserveRequest {
-  return {
-    sessionId: 'session-alpha',
-    location: NATIVE,
-    provider: 'claude',
-    accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: '/home/dev/.claude-work' },
-    expectedFence: null,
-    spawnToken: 'spawn-a',
-    claimKeyId: 'key-1',
-    handoffOperationId: null,
-    probe: INDETERMINATE,
-    operation: { callerKey: 'client-1', operationId: operationId(), fingerprint: 'fp-1' },
-    now: NOW,
-    ...overrides
-  }
-}
-
-async function open(): Promise<AgentSessionRecordStore> {
-  return AgentSessionRecordStore.open({ directory, hostId: 'local' })
-}
-
-describe('surface tab id', () => {
-  const LEGACY_TAB_ID = 'structured-agent-session-session-alpha'
-
-  it('records the reserved tab id and refuses a second record under it', async () => {
-    const store = await open()
-    await store.reserveOwner(reserveRequest({ surfaceTabId: 'tab-alpha' }))
-    expect(store.getRecord('session-alpha')?.surfaceTabId).toBe('tab-alpha')
-    const persisted = JSON.parse(await readFile(agentSessionStorePath(directory), 'utf-8'))
-    expect(persisted.records['session-alpha'].surfaceTabId).toBe('tab-alpha')
-
-    await expect(
-      store.reserveOwner(
-        reserveRequest({
-          sessionId: 'session-beta',
-          surfaceTabId: 'tab-alpha',
-          operation: { callerKey: 'client-1', operationId: operationId(), fingerprint: 'fp-2' }
-        })
-      )
-    ).rejects.toThrow('agent_session_conflict')
-    expect(store.getRecord('session-beta')).toBeNull()
-  })
-
-  it('refuses a tab id that could not prefix a pane key', async () => {
-    const store = await open()
-    await expect(
-      store.reserveOwner(reserveRequest({ surfaceTabId: 'agent-session:session-alpha' }))
-    ).rejects.toThrow('agent_session_operation_invalid')
-  })
-
-  it('backfills a record written before the field existed with the id clients derived', async () => {
-    const first = await open()
-    await first.reserveOwner(reserveRequest())
-    const filePath = agentSessionStorePath(directory)
-    const raw = JSON.parse(await readFile(filePath, 'utf-8'))
-    delete raw.records['session-alpha'].surfaceTabId
-    await writeFile(filePath, JSON.stringify(raw))
-
-    const reopened = await open()
-    // In memory at once, so every reader of the record sees one.
-    expect(reopened.getRecord('session-alpha')?.surfaceTabId).toBe(LEGACY_TAB_ID)
-    // Not on disk yet: an open must not write, or another holder of the file mid-restart would
-    // read it as an external change.
-    expect(
-      JSON.parse(await readFile(filePath, 'utf-8')).records['session-alpha']
-    ).not.toHaveProperty('surfaceTabId')
-
-    // The first transaction carries it to disk, and a later open finds nothing left to fill.
-    await reopened.setSessionTabVisibility('session-alpha', true)
-    expect(
-      JSON.parse(await readFile(filePath, 'utf-8')).records['session-alpha'].surfaceTabId
-    ).toBe(LEGACY_TAB_ID)
-    const settled = await readFile(filePath, 'utf-8')
-    await open()
-    expect(await readFile(filePath, 'utf-8')).toBe(settled)
-  })
-
-  it('refills the id when another holder rewrites the file, without forcing a save', async () => {
-    const store = await open()
-    await store.reserveOwner(reserveRequest({ surfaceTabId: 'tab-alpha' }))
-    const filePath = agentSessionStorePath(directory)
-    const raw = JSON.parse(await readFile(filePath, 'utf-8'))
-    // An older build's write, which never carries the field.
-    delete raw.records['session-alpha'].surfaceTabId
-    raw.visibleSessionIds = []
-    const external = JSON.stringify(raw)
-    await writeFile(filePath, external)
-
-    // A transaction that changes nothing still reloads the externally changed file first.
-    await store.setSessionTabVisibility('session-alpha', false)
-    expect(store.getRecord('session-alpha')?.surfaceTabId).toBe(LEGACY_TAB_ID)
-    // The reload marked every lease unadjudicated; a refill must not persist that verdict.
-    expect(await readFile(filePath, 'utf-8')).toBe(external)
-  })
-
-  it('quarantines a persisted record whose tab id contains a colon', async () => {
-    const first = await open()
-    await first.reserveOwner(reserveRequest())
-    const filePath = agentSessionStorePath(directory)
-    const raw = JSON.parse(await readFile(filePath, 'utf-8'))
-    raw.records['session-alpha'].surfaceTabId = 'agent-session:session-alpha'
-    await writeFile(filePath, JSON.stringify(raw))
-    expect((await open()).isSessionUnreadable('session-alpha')).toBe(true)
-  })
-})
diff --git a/src/main/runtime/agent-session-record-store-tab-table.test.ts b/src/main/runtime/agent-session-record-store-tab-table.test.ts
new file mode 100644
index 00000000000..56bcb6debb6
--- /dev/null
+++ b/src/main/runtime/agent-session-record-store-tab-table.test.ts
@@ -0,0 +1,277 @@
+/**
+ * The persisted table from chat tab id to the conversation it shows, as the record store keeps it.
+ * Separate from the store's main suite only because that file is at its line cap.
+ */
+
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import type { AgentSessionOwnerProbe } from '../../shared/agent-session-lease-adjudication'
+import type { AgentSessionExecutionLocation } from '../../shared/agent-session-record'
+import { isAgentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
+import { AgentSessionRecordStore } from './agent-session-record-store'
+import { agentSessionStorePath } from './agent-session-record-store-file'
+import type { AgentSessionReserveRequest } from './agent-session-reservation-admission'
+
+const NOW = 1_800_000_000_000
+const NATIVE: AgentSessionExecutionLocation = {
+  executionHostId: 'local',
+  wslDistro: null,
+  workspaceId: 'workspace-1',
+  workspaceKind: 'git-worktree'
+}
+const INDETERMINATE: AgentSessionOwnerProbe = { outcome: 'indeterminate', reason: 'no answer' }
+
+let directory: string
+let counter = 0
+
+beforeEach(async () => {
+  directory = await mkdtemp(join(tmpdir(), 'orca-agent-session-tab-table-'))
+})
+
+afterEach(async () => {
+  await rm(directory, { recursive: true, force: true })
+})
+
+function operationId(now = NOW): string {
+  counter += 1
+  return `${now}-${String(counter)
+    .padStart(32, '0')
+    .replaceAll(/[^0-9a-f]/g, '0')}`
+}
+
+function reserveRequest(
+  overrides: Partial<AgentSessionReserveRequest> = {}
+): AgentSessionReserveRequest {
+  return {
+    sessionId: 'session-alpha',
+    location: NATIVE,
+    provider: 'claude',
+    accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: '/home/dev/.claude-work' },
+    expectedFence: null,
+    spawnToken: 'spawn-a',
+    claimKeyId: 'key-1',
+    handoffOperationId: null,
+    probe: INDETERMINATE,
+    operation: { callerKey: 'client-1', operationId: operationId(), fingerprint: 'fp-1' },
+    now: NOW,
+    ...overrides
+  }
+}
+
+async function open(): Promise<AgentSessionRecordStore> {
+  return AgentSessionRecordStore.open({ directory, hostId: 'local' })
+}
+
+describe('chat tab table', () => {
+  const LEGACY_TAB_ID = 'structured-agent-session-session-alpha'
+  const filePath = () => agentSessionStorePath(directory)
+  const readFileJson = async () => JSON.parse(await readFile(filePath(), 'utf-8'))
+
+  it('takes a reserved id only when the tab is shown, and refuses it to a second chat', async () => {
+    const store = await open()
+    await store.reserveOwner(reserveRequest({ surfaceTabId: 'tab-alpha' }))
+    // A create that dies before its tab is shown leaves nothing to restore or release.
+    expect(store.getSessionTabId('session-alpha')).toBeNull()
+    expect((await readFileJson()).sessionTabs).toBeUndefined()
+
+    await store.setSessionTabVisibility('session-alpha', true, 'tab-alpha')
+    expect(store.getSessionTabId('session-alpha')).toBe('tab-alpha')
+    const persisted = await readFileJson()
+    expect(persisted.sessionTabs).toEqual([{ tabId: 'tab-alpha', sessionId: 'session-alpha' }])
+    // Not copied onto the record: the table is the one place the id lives.
+    expect(persisted.records['session-alpha']).not.toHaveProperty('surfaceTabId')
+
+    await expect(
+      store.reserveOwner(
+        reserveRequest({
+          sessionId: 'session-beta',
+          surfaceTabId: 'tab-alpha',
+          operation: { callerKey: 'client-1', operationId: operationId(), fingerprint: 'fp-2' }
+        })
+      )
+    ).rejects.toThrow('agent_session_conflict')
+    expect(store.getRecord('session-beta')).toBeNull()
+  })
+
+  it('refuses showing a tab with the situation typed, as every chat refusal is', async () => {
+    const store = await open()
+    await store.reserveOwner(reserveRequest({ surfaceTabId: 'tab-alpha' }))
+    await store.setSessionTabVisibility('session-alpha', true, 'tab-alpha')
+    await store.reserveOwner(
+      reserveRequest({
+        sessionId: 'session-beta',
+        operation: { callerKey: 'client-1', operationId: operationId(), fingerprint: 'fp-2' }
+      })
+    )
+
+    // The message stays the code: readers of a thrown refusal treat it as one.
+    await expect(
+      store.setSessionTabVisibility('session-beta', true, 'tab-alpha')
+    ).rejects.toSatisfy(
+      (error) =>
+        isAgentSessionRefusalError(error) &&
+        error.message === 'agent_session_conflict' &&
+        error.refusal.details?.reason === 'tabIdTaken'
+    )
+    await expect(store.setSessionTabVisibility('session-gone', true)).rejects.toSatisfy(
+      (error) =>
+        isAgentSessionRefusalError(error) &&
+        error.message === 'agent_session_identity_required' &&
+        error.refusal.details?.reason === 'recordMissing'
+    )
+  })
+
+  it('frees a reserved id once its chat is hidden', async () => {
+    const store = await open()
+    await store.reserveOwner(reserveRequest({ surfaceTabId: 'tab-alpha' }))
+    await store.setSessionTabVisibility('session-alpha', true, 'tab-alpha')
+    await store.setSessionTabVisibility('session-alpha', false)
+    await store.reserveOwner(
+      reserveRequest({
+        sessionId: 'session-beta',
+        surfaceTabId: 'tab-alpha',
+        operation: { callerKey: 'client-1', operationId: operationId(), fingerprint: 'fp-2' }
+      })
+    )
+    await store.setSessionTabVisibility('session-beta', true, 'tab-alpha')
+    expect(store.getSessionTabId('session-beta')).toBe('tab-alpha')
+  })
+
+  it('refuses a tab id that could not prefix a pane key', async () => {
+    const store = await open()
+    await expect(
+      store.reserveOwner(reserveRequest({ surfaceTabId: 'agent-session:session-alpha' }))
+    ).rejects.toThrow('agent_session_operation_invalid')
+  })
+
+  it('gives a shown chat the id clients derive, and puts a hidden one back under its old id', async () => {
+    const store = await open()
+    await store.reserveOwner(reserveRequest())
+    await store.setSessionTabVisibility('session-alpha', true)
+    expect(store.getSessionTabId('session-alpha')).toBe(LEGACY_TAB_ID)
+    await store.setSessionTabVisibility('session-alpha', false)
+    await store.setSessionTabVisibility('session-alpha', true, 'tab-restored')
+    expect(store.getSessionTabId('session-alpha')).toBe('tab-restored')
+  })
+
+  it('seeds the table from an older store, keeping each visible chat on the id it has today', async () => {
+    const first = await open()
+    await first.reserveOwner(reserveRequest())
+    await first.reserveOwner(
+      reserveRequest({
+        sessionId: 'session-beta',
+        operation: { callerKey: 'client-1', operationId: operationId(), fingerprint: 'fp-2' }
+      })
+    )
+    await first.reserveOwner(
+      reserveRequest({
+        sessionId: 'session-gamma',
+        operation: { callerKey: 'client-1', operationId: operationId(), fingerprint: 'fp-3' }
+      })
+    )
+    // What a build before the table wrote: the visible list, and a tab id on some records.
+    const raw = await readFileJson()
+    delete raw.sessionTabs
+    raw.visibleSessionIds = ['session-alpha', 'session-beta']
+    raw.records['session-alpha'].surfaceTabId = 'tab-alpha'
+    raw.records['session-beta'].surfaceTabId = 'structured-agent-session-session-beta'
+    const legacy = JSON.stringify(raw)
+    await writeFile(filePath(), legacy)
+
+    const reopened = await open()
+    expect(reopened.getSessionTabId('session-alpha')).toBe('tab-alpha')
+    expect(reopened.getSessionTabId('session-beta')).toBe('structured-agent-session-session-beta')
+    expect(reopened.getSessionTabId('session-gamma')).toBeNull()
+    // Seeding is part of reading, so an open alone writes nothing.
+    expect(await readFile(filePath(), 'utf-8')).toBe(legacy)
+
+    await reopened.setSessionTabVisibility('session-gamma', true)
+    const persisted = await readFileJson()
+    expect(persisted.sessionTabs).toEqual([
+      { tabId: 'tab-alpha', sessionId: 'session-alpha' },
+      { tabId: 'structured-agent-session-session-beta', sessionId: 'session-beta' },
+      { tabId: 'structured-agent-session-session-gamma', sessionId: 'session-gamma' }
+    ])
+    // Older builds restore from this list; the record field rides along untouched and unread.
+    expect(persisted.visibleSessionIds).toEqual(['session-alpha', 'session-beta', 'session-gamma'])
+    expect(persisted.records['session-alpha'].surfaceTabId).toBe('tab-alpha')
+  })
+
+  it('seeds a chat cleared before the upgrade under the id its tab opened with', async () => {
+    const first = await open()
+    for (const [index, sessionId] of ['session-alpha', 'clear-one', 'clear-two'].entries()) {
+      await first.reserveOwner(
+        reserveRequest({
+          sessionId,
+          operation: {
+            callerKey: 'client-1',
+            operationId: operationId(),
+            fingerprint: `fp-chain-${index}`
+          }
+        })
+      )
+    }
+    // An older build after two clears, with the first conversation reopened from history.
+    const raw = await readFileJson()
+    const cleared = (replacementSessionId: string) => ({
+      command: 'clear',
+      state: 'completed',
+      phase: 'committed',
+      operationId: operationId(),
+      callerKey: 'client-1',
+      replacementSessionId
+    })
+    raw.records['session-alpha'].conversationCommand = cleared('clear-one')
+    raw.records['clear-one'].conversationCommand = cleared('clear-two')
+    raw.records['clear-two'].surfaceTabId = 'structured-agent-session-clear-two'
+    delete raw.sessionTabs
+    raw.visibleSessionIds = ['session-alpha', 'clear-two']
+    await writeFile(filePath(), JSON.stringify(raw))
+
+    const reopened = await open()
+    expect(reopened.getSessionTabId('clear-two')).toBe(LEGACY_TAB_ID)
+    const reopenedTab = reopened.getSessionTabId('session-alpha')
+    expect(reopenedTab).not.toBe(LEGACY_TAB_ID)
+    expect(reopenedTab).not.toContain(':')
+    expect(reopened.listVisibleSessionIds()).toEqual(['session-alpha', 'clear-two'])
+    // Seeding is part of reading, so it must give the same ids on every read of the same bytes.
+    expect((await open()).getSessionTabId('session-alpha')).toBe(reopenedTab)
+  })
+
+  it('reads the table, never the record field, once the table is on disk', async () => {
+    const first = await open()
+    await first.reserveOwner(reserveRequest())
+    await first.setSessionTabVisibility('session-alpha', true, 'tab-alpha')
+    const raw = await readFileJson()
+    raw.records['session-alpha'].surfaceTabId = 'tab-stale'
+    await writeFile(filePath(), JSON.stringify(raw))
+    expect((await open()).getSessionTabId('session-alpha')).toBe('tab-alpha')
+  })
+
+  it('keeps a record whose legacy tab id is malformed, seeding it under the derived id', async () => {
+    const first = await open()
+    await first.reserveOwner(reserveRequest())
+    const raw = await readFileJson()
+    delete raw.sessionTabs
+    raw.visibleSessionIds = ['session-alpha']
+    raw.records['session-alpha'].surfaceTabId = 'agent-session:session-alpha'
+    await writeFile(filePath(), JSON.stringify(raw))
+    const reopened = await open()
+    expect(reopened.isSessionUnreadable('session-alpha')).toBe(false)
+    expect(reopened.getSessionTabId('session-alpha')).toBe(LEGACY_TAB_ID)
+  })
+
+  it('treats a malformed table as a corrupt store rather than guessing', async () => {
+    const first = await open()
+    await first.reserveOwner(reserveRequest())
+    const raw = await readFileJson()
+    raw.sessionTabs = [
+      { tabId: 'tab-alpha', sessionId: 'session-alpha' },
+      { tabId: 'tab-alpha', sessionId: 'session-beta' }
+    ]
+    await writeFile(filePath(), JSON.stringify(raw))
+    await expect(open()).rejects.toThrow('agent_session_store_corrupt')
+  })
+})
diff --git a/src/main/runtime/agent-session-record-store.test.ts b/src/main/runtime/agent-session-record-store.test.ts
index 65d689503c2..5ee25d36813 100644
--- a/src/main/runtime/agent-session-record-store.test.ts
+++ b/src/main/runtime/agent-session-record-store.test.ts
@@ -5,6 +5,7 @@ import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import type { AgentSessionOwnerProbe } from '../../shared/agent-session-lease-adjudication'
 import type {
   AgentSessionExecutionLocation,
+  AgentSessionLease,
   AgentSessionProcessIdentity,
   AgentSessionRecord
 } from '../../shared/agent-session-record'
@@ -121,6 +122,26 @@ async function establishOwner(
   })
 }
 
+/** The shape the removed conflict marker wrote, as it decodes. No shipped build called it; a record
+ *  may carry it. */
+async function markLegacyConflicted(
+  store: AgentSessionRecordStore,
+  lease: Partial<AgentSessionLease> = {}
+): Promise<void> {
+  if (!store.getRecord('session-alpha')) {
+    await store.reserveOwner(reserveRequest())
+  }
+  await store.transitionHandoff('session-alpha', (record) => ({
+    ...record,
+    lease: {
+      ...record.lease,
+      claimStatus: 'conflicted',
+      handoffStage: 'recovering',
+      ...lease
+    }
+  }))
+}
+
 beforeEach(async () => {
   directory = await mkdtemp(join(tmpdir(), 'orca-agent-session-store-'))
 })
@@ -596,10 +617,26 @@ describe('restart reconciliation', () => {
     ).rejects.toThrow('agent_session_ownership_unknown')
   })
 
-  it('keeps a conflict conflicted across a restart that proves nothing', async () => {
+  it('re-adjudicates a claim an older record marked conflicted by the owner it names', async () => {
     const first = await open()
     await establishOwner(first)
-    await first.markClaimConflicted('session-alpha', NOW)
+    await markLegacyConflicted(first)
+
+    const reopened = await open()
+    await reopened.reconcileOnRestart({
+      probe: async () => ({ outcome: 'indeterminate', reason: 'no answer' }),
+      now: NOW
+    })
+    // An unverifiable owner goes to recovery like any other; resolution concludes about it.
+    expect(reopened.getRecord('session-alpha')?.lease).toMatchObject({
+      handoffStage: 'recovering',
+      ownerProcess: { pid: expect.any(Number) }
+    })
+  })
+
+  it('releases a claim an older record marked conflicted that names no process', async () => {
+    const first = await open()
+    await markLegacyConflicted(first, { ownerProcess: null })
 
     const reopened = await open()
     await reopened.reconcileOnRestart({
@@ -607,18 +644,10 @@ describe('restart reconciliation', () => {
       now: NOW
     })
     expect(reopened.getRecord('session-alpha')?.lease).toMatchObject({
-      claimStatus: 'conflicted',
-      handoffStage: 'manual-recovery'
+      claimStatus: 'released',
+      handoffStage: null,
+      deathEvidence: null
     })
-    await expect(
-      reopened.reserveOwner(
-        reserveRequest({
-          expectedFence: 1,
-          probe: { outcome: 'pid-absent' },
-          operation: { callerKey: 'client-1', operationId: operationId(), fingerprint: 'fp-2' }
-        })
-      )
-    ).rejects.toThrow('agent_session_conflict')
   })
 
   it('releases a conflict whose named owner is proven gone at restart', async () => {
@@ -626,7 +655,7 @@ describe('restart reconciliation', () => {
     // the process the conflict names has exited leaves no claimant left to protect.
     const first = await open()
     await establishOwner(first)
-    await first.markClaimConflicted('session-alpha', NOW)
+    await markLegacyConflicted(first)
 
     const reopened = await open()
     await reopened.reconcileOnRestart({ probe: async () => ({ outcome: 'pid-absent' }), now: NOW })
@@ -724,13 +753,7 @@ describe('host and workspace isolation', () => {
   })
 })
 
-describe('orphans, claim keys, checkpoints, and unreadable rows', () => {
-  it('calls a spawn token with no lease an orphan', async () => {
-    const store = await open()
-    await establishOwner(store)
-    expect(store.listOrphanSpawnTokens(['spawn-a', 'spawn-z'])).toEqual(['spawn-z'])
-  })
-
+describe('claim keys, checkpoints, and unreadable rows', () => {
   it('keeps a retired claim key verifiable for the retention window', async () => {
     const store = await open()
     await store.retireClaimKey('key-1', NOW)
diff --git a/src/main/runtime/agent-session-record-store.ts b/src/main/runtime/agent-session-record-store.ts
index 58817a7e59c..925fa38d8d1 100644
--- a/src/main/runtime/agent-session-record-store.ts
+++ b/src/main/runtime/agent-session-record-store.ts
@@ -1,4 +1,4 @@
-import { setVisibleSessionId } from './agent-session-visible-tab-index'
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
 import { commitConversationCommandRecord } from './agent-session-conversation-command-record'
 import { setAgentSessionRecordConversationName } from './agent-session-record-conversation-name'
 /** Durable single-writer session records and their operation ledger. */
@@ -25,7 +25,6 @@ import {
   retireAgentSessionClaimKey
 } from './agent-session-claim-key-retention'
 import type { AgentSessionOwnerProbe } from '../../shared/agent-session-lease-adjudication'
-import { classifyObservedAgentSessionSpawnToken } from '../../shared/agent-session-lease-adjudication'
 import type { AgentSessionProviderHandleLink } from '../../shared/agent-session-provider-handle'
 import {
   agentSessionScopeKey,
@@ -57,10 +56,6 @@ import {
   type AgentSessionRestartProbeArgs
 } from './agent-session-restart-reconciliation'
 import { replaceAgentSessionRecordOptions } from './agent-session-record-options'
-import {
-  setAgentSessionReservationProcesslessProof,
-  type AgentSessionReservationProcesslessProof
-} from './agent-session-processless-reservation'
 import {
   commitAgentSessionReservation,
   type AgentSessionReserveRequest,
@@ -69,9 +64,9 @@ import {
 import {
   agentSessionStoreRevision,
   agentSessionStorePath,
-  type AgentSessionStoreState,
-  backfillAgentSessionSurfaceTabIds
+  type AgentSessionStoreState
 } from './agent-session-record-store-file'
+import { setAgentSessionTabVisibility } from './agent-session-tab-table'
 import { loadProtectedAgentSessionStore } from './agent-session-record-store-security'
 import {
   AgentSessionStoreTransactionQueue,
@@ -82,6 +77,8 @@ export const AGENT_SESSION_LEASE_TTL_MS = 30_000,
   AGENT_SESSION_LEASE_RENEW_INTERVAL_MS = 10_000
 
 export class AgentSessionRecordStore {
+  private readonly deathEvidenceListeners = new Set<(sessionId: string) => void>()
+
   private constructor(private readonly transactions: AgentSessionStoreTransactionQueue) {}
 
   static async open(args: { directory: string; hostId: string }): Promise<AgentSessionRecordStore> {
@@ -90,19 +87,14 @@ export class AgentSessionRecordStore {
     // Why: every persisted lease is unreconciled until this host adjudicates it, so a restart
     // grants no writer on the strength of what the previous process wrote.
     const diskRevision = agentSessionStoreRevision(loaded.state)
-    // After the revision, so the file still hashes to what was read. The filled ids, like the
-    // normalized legacy leases, reach disk with this store's first transaction rather than a write
-    // here: a rewrite at open would read as an external change to any other holder of the file
-    // mid-restart.
-    const backfilled = backfillAgentSessionSurfaceTabIds(loaded.state)
+    // The normalized legacy leases reach disk with this store's first transaction rather than a
+    // write here: a rewrite at open would read as an external change to any other holder of the
+    // file mid-restart.
     markAgentSessionStoreLeasesUnreconciled(loaded.state)
     const transactions = AgentSessionStoreTransactionQueue.fromLoadedStore(
       filePath,
       args.hostId,
-      {
-        ...loaded,
-        needsRewrite: loaded.needsRewrite || backfilled > 0 || loaded.legacyHandoffLeasesNormalized
-      },
+      { ...loaded, needsRewrite: loaded.needsRewrite || loaded.legacyHandoffLeasesNormalized },
       diskRevision
     )
     if (loaded.needsRewrite && !loaded.readOnly && !loaded.recoveredFromBackup) {
@@ -133,16 +125,25 @@ export class AgentSessionRecordStore {
   listRecords = (): AgentSessionRecord[] => [...this.state.records.values()]
 
   listVisibleSessionIds = (): string[] =>
-    [...this.state.visibleSessionIds].filter((sessionId) => this.state.records.has(sessionId))
+    (this.state.sessionTabs?.sessionIds() ?? []).filter((sessionId) =>
+      this.state.records.has(sessionId)
+    )
 
   getVisibleSessionTabIndex = (): { present: boolean; sessionIds: string[] } => ({
-    present: this.state.visibleSessionIdsIndexPresent,
+    present: this.state.sessionTabs !== null,
     sessionIds: this.listVisibleSessionIds()
   })
 
-  /** Persist the user-visible tab reference separately from the rollback-sensitive profile tabs. */
-  setSessionTabVisibility(sessionId: string, visible: boolean): Promise<void> {
-    return this.transact(() => setVisibleSessionId(this.state, sessionId, visible))
+  /** The id of the chat tab showing this conversation, if one does. */
+  getSessionTabId = (sessionId: string): string | null =>
+    this.state.sessionTabs?.tabIdFor(sessionId) ?? null
+
+  /**
+   * Persist the user-visible tab reference separately from the rollback-sensitive profile tabs.
+   * Showing keeps a tab the session already has; `tabId` puts a hidden one back under its old id.
+   */
+  setSessionTabVisibility(sessionId: string, visible: boolean, tabId?: string): Promise<void> {
+    return this.transact(() => setAgentSessionTabVisibility(this.state, sessionId, visible, tabId))
   }
 
   listByScope(location: AgentSessionExecutionLocation): AgentSessionRecord[] {
@@ -180,14 +181,6 @@ export class AgentSessionRecordStore {
   isClaimKeyVerifiable = (keyId: string, now: number): boolean =>
     isAgentSessionClaimKeyVerifiable(this.state, keyId, now)
 
-  /** Spawn tokens observed on the host with no matching lease. Stop them; never adopt them. */
-  listOrphanSpawnTokens(observedTokens: readonly string[]): string[] {
-    const leases = this.listRecords().map((record) => record.lease)
-    return observedTokens.filter(
-      (spawnToken) => classifyObservedAgentSessionSpawnToken({ spawnToken, leases }) === 'orphan'
-    )
-  }
-
   async reserveOwner(request: AgentSessionReserveRequest): Promise<AgentSessionReserveResult> {
     return this.transact(() =>
       commitAgentSessionReservation(this.state, request, AGENT_SESSION_LEASE_TTL_MS)
@@ -202,13 +195,6 @@ export class AgentSessionRecordStore {
     )
   }
 
-  setReservationProcesslessProof = (
-    args: AgentSessionReservationProcesslessProof & { processlessAt: number | null }
-  ): Promise<AgentSessionRecord> =>
-    this.mutate(args.sessionId, (record) =>
-      setAgentSessionReservationProcesslessProof({ ...args, record })
-    )
-
   async proveOwner(args: {
     sessionId: string
     fence: number
@@ -256,9 +242,7 @@ export class AgentSessionRecordStore {
     probe: AgentSessionOwnerProbe
     now: number
   }): Promise<AgentSessionRecord> {
-    return this.mutate(args.sessionId, (record) =>
-      evictAgentSessionOwner({ ...args, record, journalSettlement: 'required' })
-    )
+    return this.mutate(args.sessionId, (record) => evictAgentSessionOwner({ ...args, record }))
   }
 
   async transitionHandoff(
@@ -322,16 +306,6 @@ export class AgentSessionRecordStore {
     await this.transact(() => settleAgentSessionOperationInto(this.state, args))
   }
 
-  async markClaimConflicted(sessionId: string, now: number): Promise<AgentSessionRecord> {
-    return this.mutate(sessionId, (record) => ({
-      ...record,
-      updatedAt: now,
-      // Why: a conflicted key must stay conflicted across a restart; it cannot resolve to free
-      // merely because the process that observed the conflict is gone.
-      lease: { ...record.lease, claimStatus: 'conflicted', handoffStage: 'manual-recovery' }
-    }))
-  }
-
   replaceSessionOptions = (args: AgentSessionOptionsReplacement): Promise<AgentSessionRecord> =>
     this.mutate(args.sessionId, (record) => replaceAgentSessionRecordOptions(record, args))
 
@@ -346,11 +320,9 @@ export class AgentSessionRecordStore {
     return this.transact(() => {
       const record = this.state.records.get(sessionId)
       if (!record) {
-        throw new Error(
-          this.isSessionUnreadable(sessionId)
-            ? 'execution_owner_reconciling'
-            : 'agent_session_identity_required'
-        )
+        throw this.isSessionUnreadable(sessionId)
+          ? agentSessionRefusalError('execution_owner_reconciling', { reason: 'recordUnreadable' })
+          : agentSessionRefusalError('agent_session_identity_required', { reason: 'recordMissing' })
       }
       const next = apply(record)
       this.state.records.set(sessionId, next)
@@ -358,6 +330,32 @@ export class AgentSessionRecordStore {
     })
   }
 
+  /** Told, once committed, of each session a transaction wrote a proof of death for — whichever
+   *  transition wrote it, since every one lands here. Must not throw. */
+  onDeathEvidence(listener: (sessionId: string) => void): () => void {
+    this.deathEvidenceListeners.add(listener)
+    return () => this.deathEvidenceListeners.delete(listener)
+  }
+
   /** Serialize every mutation against the latest committed disk state. */
-  private transact = <T>(apply: () => T): Promise<T> => this.transactions.transact(apply)
+  private transact = async <T>(apply: () => T): Promise<T> => {
+    let proven: string[] = []
+    const result = await this.transactions.transact(() => {
+      if (this.deathEvidenceListeners.size === 0) {
+        return apply()
+      }
+      const before = new Map(
+        [...this.state.records].map(([id, record]) => [id, record.lease.deathEvidence])
+      )
+      const applied = apply()
+      proven = [...this.state.records]
+        .filter(([id, { lease }]) => lease.deathEvidence && lease.deathEvidence !== before.get(id))
+        .map(([id]) => id)
+      return applied
+    })
+    for (const sessionId of proven) {
+      this.deathEvidenceListeners.forEach((listener) => listener(sessionId))
+    }
+    return result
+  }
 }
diff --git a/src/main/runtime/agent-session-recovery-capsule-entries.ts b/src/main/runtime/agent-session-recovery-capsule-entries.ts
index de8a452c87a..a5d1d899723 100644
--- a/src/main/runtime/agent-session-recovery-capsule-entries.ts
+++ b/src/main/runtime/agent-session-recovery-capsule-entries.ts
@@ -4,6 +4,10 @@
 // — can be read on its own. Every value parsed here re-enters from a file this process did not
 // necessarily write, including one written by an older or newer build.
 
+import {
+  readAgentSessionRefusalReference,
+  type AgentSessionAnyRefusalDetails
+} from '../../shared/agent-session-wire-refusals'
 import { z } from 'zod'
 import {
   AGENT_SESSION_RESUME_FAILURE_OUTCOMES,
@@ -28,6 +32,7 @@ const failureSchema = z.object({
   failedAt: z.number().int().nonnegative(),
   outcome: z.enum(AGENT_SESSION_RESUME_FAILURE_OUTCOMES),
   reason: z.string().max(MAX_FAILURE_FIELD_LENGTH),
+  details: z.unknown().optional(),
   latestPrompt: z.string().max(MAX_FAILURE_FIELD_LENGTH),
   latestUserItemId: z.string().max(MAX_FAILURE_FIELD_LENGTH).nullable()
 })
@@ -47,7 +52,11 @@ export type AgentSessionResumeFailureRecord = {
   marker: AgentSessionResumeMarker
   failedAt: number
   outcome: AgentSessionResumeFailureOutcome
+  /** The refusal code, as it always was; the renderer's guidance keys on it. */
   reason: string
+  /** The refusal's details beside the code; absent on older records and non-refusals. A record
+   *  an unreleased build wrote with a `cause` instead reads as having none. */
+  details?: AgentSessionAnyRefusalDetails
   /** The prompt the offer quoted, snapshotted because the session may no longer be readable. */
   latestPrompt: string
   /** The chat's newest user message when this was filed, as the marker records it at teardown. A
@@ -109,7 +118,16 @@ function parseFailures(value: unknown): AgentSessionResumeFailureRecord[] {
   return (Array.isArray(value) ? value : []).flatMap((failure: unknown) => {
     const parsed = failureSchema.safeParse(failure)
     const marker = parsed.success ? parseAgentSessionResumeMarker(parsed.data.marker) : null
-    return parsed.success && marker ? [{ ...parsed.data, marker }] : []
+    if (!parsed.success || !marker) {
+      return []
+    }
+    const { details: stored, ...rest } = parsed.data
+    // `reason` is the refusal code, so the details are read against it.
+    const details = readAgentSessionRefusalReference({
+      code: rest.reason,
+      details: stored
+    })?.details
+    return [{ ...rest, marker, ...(details ? { details } : {}) }]
   })
 }
 
diff --git a/src/main/runtime/agent-session-recovery-capsule.test.ts b/src/main/runtime/agent-session-recovery-capsule.test.ts
index 2150e5c7d51..d70fde57af3 100644
--- a/src/main/runtime/agent-session-recovery-capsule.test.ts
+++ b/src/main/runtime/agent-session-recovery-capsule.test.ts
@@ -342,6 +342,41 @@ describe('durable restart offers', () => {
     expect(JSON.parse(await readFile(filePath, 'utf8')).failed).toEqual([readable])
   })
 
+  it('keeps refusal details beside the code, read back against that code', async () => {
+    const readable = {
+      marker: marker(),
+      failedAt: NOW,
+      outcome: 'refused',
+      reason: 'agent_session_conflict',
+      latestPrompt: '',
+      latestUserItemId: null
+    }
+    await writeFile(
+      filePath,
+      JSON.stringify({
+        version: 2,
+        entries: [],
+        failed: [
+          { ...readable, details: { reason: 'claimConflicted', note: 'dropped' } },
+          // An unreleased build wrote a cause here; it still parses, naming nothing.
+          { ...readable, marker: marker({ sessionId: 'older' }), cause: 'claimConflicted' },
+          // A reason the code does not list is not this code's.
+          {
+            ...readable,
+            marker: marker({ sessionId: 'foreign' }),
+            details: { reason: 'promptGone' }
+          }
+        ]
+      })
+    )
+
+    expect(await capsule.listFailed(NOW)).toEqual([
+      { ...readable, details: { reason: 'claimConflicted' } },
+      { ...readable, marker: marker({ sessionId: 'older' }) },
+      { ...readable, marker: marker({ sessionId: 'foreign' }) }
+    ])
+  })
+
   it('reads a malformed failure list as no failures', async () => {
     await writeFile(
       filePath,
diff --git a/src/main/runtime/agent-session-recovery-capsule.ts b/src/main/runtime/agent-session-recovery-capsule.ts
index 8b54871b9f4..80ed0bb726e 100644
--- a/src/main/runtime/agent-session-recovery-capsule.ts
+++ b/src/main/runtime/agent-session-recovery-capsule.ts
@@ -201,15 +201,20 @@ export class AgentSessionRecoveryCapsule {
 
   /** Forgets the named sessions whatever their state. Unlike `clearAll`, this is not a fence: a
    *  later teardown of the same chat may record a fresh offer. */
-  dismiss(sessionIds: readonly string[], now: number): Promise<number> {
+  dismiss(
+    sessionIds: readonly string[],
+    now: number,
+    /** A record this answers true for stays: read against the stored marker, under the lock. */
+    keep: (marker: AgentSessionResumeMarker) => boolean = () => false
+  ): Promise<number> {
     return withFileTransactionLock(this.filePath, async () => {
       const named = new Set(sessionIds)
       const state = await this.readState()
       const { entries, failed } = normalizeState(state, now)
       const dismissed = new Set(
         [...entries, ...failed]
+          .filter((record) => named.has(record.marker.sessionId) && !keep(record.marker))
           .map((record) => record.marker.sessionId)
-          .filter((sessionId) => named.has(sessionId))
       )
       if (dismissed.size > 0) {
         await this.publish(
diff --git a/src/main/runtime/agent-session-recovery-publish-fault.test.ts b/src/main/runtime/agent-session-recovery-publish-fault.test.ts
index f3f2ba91d2a..9fdbe393334 100644
--- a/src/main/runtime/agent-session-recovery-publish-fault.test.ts
+++ b/src/main/runtime/agent-session-recovery-publish-fault.test.ts
@@ -48,8 +48,7 @@ function state(generation: number): AgentSessionStoreState {
     operations: new Map(),
     retiredClaimKeys: [{ keyId: `generation-${generation}`, retiredAt: generation }],
     unreadableRecords: new Map(),
-    visibleSessionIds: new Set(),
-    visibleSessionIdsIndexPresent: false
+    sessionTabs: null
   }
 }
 
diff --git a/src/main/runtime/agent-session-released-reservation-replay.test.ts b/src/main/runtime/agent-session-released-reservation-replay.test.ts
new file mode 100644
index 00000000000..e3f9bcff74b
--- /dev/null
+++ b/src/main/runtime/agent-session-released-reservation-replay.test.ts
@@ -0,0 +1,171 @@
+// A create the host was running when it died is retried under the same operation id. Recovery has
+// released its reservation by then, so the retry continues it at the next fence; a reservation that
+// is still held keeps answering exactly as it did.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS,
+  AGENT_SESSION_OPERATION_FUTURE_SKEW_MS
+} from '../../shared/agent-session-host-authority'
+import type { AgentSessionOwnerProbe } from '../../shared/agent-session-lease-adjudication'
+import type { AgentSessionLease } from '../../shared/agent-session-record'
+import { AgentSessionRecordStore } from './agent-session-record-store'
+import type { AgentSessionReserveRequest } from './agent-session-reservation-admission'
+
+const NOW = 1_800_000_000_000
+const SESSION = 'session-alpha'
+const OPERATION = `${NOW}-${'1'.padStart(32, '0')}`
+const PAST_EXPIRY =
+  AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS + AGENT_SESSION_OPERATION_FUTURE_SKEW_MS + 60_000
+const INDETERMINATE: AgentSessionOwnerProbe = { outcome: 'indeterminate', reason: 'no answer' }
+
+let directory: string
+
+beforeEach(async () => {
+  directory = await mkdtemp(join(tmpdir(), 'orca-released-reservation-replay-'))
+})
+
+afterEach(async () => {
+  await rm(directory, { recursive: true, force: true })
+})
+
+function open(): Promise<AgentSessionRecordStore> {
+  return AgentSessionRecordStore.open({ directory, hostId: 'local' })
+}
+
+function createRequest(
+  overrides: Partial<AgentSessionReserveRequest> = {}
+): AgentSessionReserveRequest {
+  return {
+    sessionId: SESSION,
+    location: {
+      executionHostId: 'local',
+      wslDistro: null,
+      workspaceId: 'workspace-1',
+      workspaceKind: 'git-worktree'
+    },
+    provider: 'codex',
+    accountHome: { variable: 'CODEX_HOME', path: '/home/dev/.codex' },
+    expectedFence: null,
+    spawnToken: 'spawn-a',
+    claimKeyId: 'key-1',
+    handoffOperationId: OPERATION,
+    probe: INDETERMINATE,
+    operation: { callerKey: 'client-1', operationId: OPERATION, fingerprint: 'fp-1' },
+    now: NOW,
+    ...overrides
+  }
+}
+
+/** The create reserved, then a restart that could prove nothing released it at fence 2. */
+async function releasedByRestart(now: number): Promise<AgentSessionRecordStore> {
+  const first = await open()
+  await first.reserveOwner(createRequest())
+  const store = await open()
+  await store.reconcileOnRestart({ probe: async () => INDETERMINATE, now })
+  expect(store.getRecord(SESSION)?.lease).toMatchObject({
+    claimStatus: 'released',
+    handoffStage: null,
+    runtimeFence: 2
+  })
+  return store
+}
+
+describe('a create retried after recovery released its reservation', () => {
+  it.each([
+    ['its operation row is still pending', 1_000],
+    ['its operation row has expired', PAST_EXPIRY]
+  ])('continues when %s, and the old reservation can never commit', async (_case, elapsed) => {
+    const now = NOW + elapsed
+    const store = await releasedByRestart(now)
+
+    const continued = await store.reserveOwner(createRequest({ spawnToken: () => 'spawn-b', now }))
+    expect(continued.disposition).toBe('reserved')
+    expect(continued.record.lease).toMatchObject({
+      claimStatus: 'reserved',
+      handoffStage: 'new-owner-proving',
+      runtimeFence: 3,
+      reservedSpawnToken: 'spawn-b',
+      handoffOperationId: OPERATION
+    })
+    expect(store.listOperationRows()).toEqual([
+      expect.objectContaining({ operationId: OPERATION, outcome: { status: 'pending' } })
+    ])
+
+    // A spawn from the first reservation reports in late: refused at its fence, and by token.
+    const lateSpawn = { hostId: 'local', pid: 4242, processStartTimeMs: NOW, spawnToken: 'spawn-a' }
+    await expect(
+      store.commitProcessIdentity({ sessionId: SESSION, fence: 1, process: lateSpawn, now })
+    ).rejects.toThrow('agent_session_checkpoint_stale')
+    await expect(
+      store.commitProcessIdentity({ sessionId: SESSION, fence: 3, process: lateSpawn, now })
+    ).rejects.toThrow('agent_session_ownership_unknown')
+
+    // Retried again while that reservation stands: the same reservation, never a second spawn.
+    const mint = vi.fn(() => 'spawn-c')
+    const retried = await store.reserveOwner(createRequest({ spawnToken: mint, now }))
+    expect(retried.disposition).toBe('replayed')
+    expect(retried.record.lease).toMatchObject({ runtimeFence: 3, reservedSpawnToken: 'spawn-b' })
+    expect(mint).not.toHaveBeenCalled()
+  })
+
+  it('refuses an expired retry of a session that has no record', async () => {
+    const store = await open()
+    await expect(store.reserveOwner(createRequest({ now: NOW + PAST_EXPIRY }))).rejects.toThrow(
+      'agent_session_operation_expired'
+    )
+  })
+
+  it.each([
+    ['proven alive', { outcome: 'identity-matched', matchedOn: ['spawn-token'] }, 'conflict'],
+    ['one nothing could verify', INDETERMINATE, 'ownership_unknown']
+  ] as const)('still refuses a retry once its child is live and %s', async (_case, probe, code) => {
+    const store = await open()
+    await store.reserveOwner(createRequest())
+    await store.commitProcessIdentity({
+      sessionId: SESSION,
+      fence: 1,
+      process: { hostId: 'local', pid: 4242, processStartTimeMs: NOW, spawnToken: 'spawn-a' },
+      now: NOW
+    })
+    await store.proveOwner({
+      sessionId: SESSION,
+      fence: 1,
+      link: {
+        linkId: 'link-1',
+        handle: { provider: 'codex', threadId: 'thread-1' },
+        origin: 'created',
+        mintedAtFence: 1,
+        observedAt: NOW
+      },
+      now: NOW
+    })
+
+    await expect(store.reserveOwner(createRequest({ probe }))).rejects.toThrow(
+      `agent_session_${code}`
+    )
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({ claimStatus: 'live', runtimeFence: 1 })
+  })
+
+  it.each<[string, Partial<AgentSessionLease>, string]>([
+    ['in recovery', { handoffStage: 'recovering' }, 'agent_session_ownership_unknown'],
+    [
+      'held by a terminal agent',
+      { claimStatus: 'conflicted', handoffStage: 'recovering' },
+      'agent_session_conflict'
+    ]
+  ])('still refuses a retry whose reservation is %s', async (_case, lease, code) => {
+    const store = await open()
+    await store.reserveOwner(createRequest())
+    await store.transitionHandoff(SESSION, (record) => ({
+      ...record,
+      lease: { ...record.lease, ...lease }
+    }))
+
+    await expect(store.reserveOwner(createRequest())).rejects.toThrow(code)
+    expect(store.getRecord(SESSION)?.lease.runtimeFence).toBe(1)
+  })
+})
diff --git a/src/main/runtime/agent-session-reservation-admission.test.ts b/src/main/runtime/agent-session-reservation-admission.test.ts
index 83e9c610056..cad534931e6 100644
--- a/src/main/runtime/agent-session-reservation-admission.test.ts
+++ b/src/main/runtime/agent-session-reservation-admission.test.ts
@@ -69,8 +69,7 @@ function storeState(records: readonly AgentSessionRecord[] = []): AgentSessionSt
     operations: new Map(),
     retiredClaimKeys: [],
     unreadableRecords: new Map(),
-    visibleSessionIds: new Set(),
-    visibleSessionIdsIndexPresent: true
+    sessionTabs: null
   }
 }
 
@@ -205,7 +204,8 @@ describe('re-create over a failed create', () => {
     provenHandleLinkId: null,
     ownerProcess: null,
     reservedSpawnToken: null,
-    claimStatus: 'released'
+    claimStatus: 'released',
+    deathEvidence: { kind: 'exit-observed', detail: 'the create failed', observedAt: 1 }
   })
   function failedCreate(overrides: Partial<AgentSessionRecord> = {}): AgentSessionRecord {
     return {
@@ -231,10 +231,12 @@ describe('re-create over a failed create', () => {
   it('refuses when the record bound a conversation, or its attempt may still run', () => {
     const bound = failedCreate({ providerHandleChain: [adoptedLink()] })
     const unproven = failedCreate({
-      lease: { ...EXITED, claimStatus: 'reserved', handoffStage: 'manual-recovery' }
+      lease: { ...EXITED, claimStatus: 'reserved', handoffStage: 'recovering' }
     })
+    // Released so a send can start over, but nothing proved the attempt gone.
+    const releasedUnproven = failedCreate({ lease: { ...EXITED, deathEvidence: null } })
 
-    for (const record of [bound, unproven]) {
+    for (const record of [bound, unproven, releasedUnproven]) {
       expect(() =>
         applyAgentSessionReservation(storeState([record]), reserveRequest(), LEASE_TTL_MS)
       ).toThrow('agent_session_conflict')
diff --git a/src/main/runtime/agent-session-reservation-admission.ts b/src/main/runtime/agent-session-reservation-admission.ts
index 4bd3bf9b4db..d86383ddae7 100644
--- a/src/main/runtime/agent-session-reservation-admission.ts
+++ b/src/main/runtime/agent-session-reservation-admission.ts
@@ -9,14 +9,17 @@
  * inside a transaction, which is what makes the record and its operation row land together.
  */
 
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
 import {
   agentSessionOperationKey,
   evaluateAgentSessionOperation,
+  pendingAgentSessionOperationRow,
   pruneAgentSessionOperationRows,
   type AgentSessionOperationDecision,
   type AgentSessionOperationRow
 } from '../../shared/agent-session-operation-ledger'
 import {
+  agentSessionLeaseIsReleased,
   agentSessionLeaseOwnerVerdict,
   evaluateAgentSessionAcquisition,
   type AgentSessionOwnerProbe
@@ -56,8 +59,8 @@ export type AgentSessionReserveRequest = {
   launchEnv?: AgentSessionLaunchEnv
   /** Initial provider options persisted before the first process is acquired. */
   options?: Readonly<Record<string, string>>
-  /** The tab id this conversation shows under. Pinned on first reservation; a later reservation of
-   *  an existing record keeps the record's own. Refused when another record already holds it. */
+  /** The tab id a create reserved for this conversation, taken when its tab is published. An id
+   *  another session's tab holds is refused here, before anything is spawned. */
   surfaceTabId?: string
   /** Set only when this create adopts an existing provider conversation. Seeds the handle chain so
    *  the adapter resumes; without it a new record has never proved a thread and starts a fresh one. */
@@ -110,7 +113,7 @@ export function requireAgentSessionRecordForReplay(
   if (!record) {
     // Why: the recorded effect is no longer reconstructable, and re-running it would be a second
     // spawn rather than a replay.
-    throw new Error('agent_session_ownership_unknown')
+    throw agentSessionRefusalError('agent_session_ownership_unknown', { reason: 'recordMissing' })
   }
   return record
 }
@@ -126,11 +129,13 @@ export function admitPendingAgentSessionReservationReplay(
     probe: request.probe
   })
   if (decision.decision === 'refused') {
-    throw new Error(decision.code)
+    throw agentSessionRefusalError(decision.code, decision.details)
   }
   if (decision.decision !== 'retry-reservation') {
-    // A replay may continue only its still-present reservation; recovery requires a fresh intent.
-    throw new Error('agent_session_ownership_unknown')
+    // A replay may continue only its still-present reservation.
+    throw agentSessionRefusalError('agent_session_ownership_unknown', {
+      reason: 'replaySuperseded'
+    })
   }
   return record
 }
@@ -168,12 +173,12 @@ export function applyAgentSessionReservation(
   const existing = state.records.get(request.sessionId)
   if (!existing) {
     if (state.unreadableRecords.has(request.sessionId)) {
-      throw new Error('execution_owner_reconciling')
+      throw agentSessionRefusalError('execution_owner_reconciling', { reason: 'recordUnreadable' })
     }
     if (request.expectedFence !== null) {
-      throw new Error('agent_session_checkpoint_stale')
+      throw agentSessionRefusalError('agent_session_checkpoint_stale', { reason: 'recordMissing' })
     }
-    assertSurfaceTabIdUnheld(state, request)
+    assertReservedTabUnheld(state, request)
     return { record: createAgentSessionRecord(request, reservation), disposition: 'created' }
   }
   if (
@@ -183,7 +188,7 @@ export function applyAgentSessionReservation(
     existing.accountHome.path !== request.accountHome.path
   ) {
     // Why: location, provider, and account are the session identity; changing one is a fork.
-    throw new Error('agent_session_conflict')
+    throw agentSessionRefusalError('agent_session_conflict', { reason: 'identityMismatch' })
   }
   // A create may take over only a record that never bound a conversation and whose last
   // attempt is proven gone: that is the same as creating it fresh, under a fresh provider id.
@@ -192,8 +197,9 @@ export function applyAgentSessionReservation(
     !request.adoptedHandleLink &&
     agentSessionLeaseOwnerVerdict(existing.lease) === 'exited'
   if (request.expectedFence === null && !recreatable) {
-    throw new Error('agent_session_conflict')
+    throw agentSessionRefusalError('agent_session_conflict', { reason: 'sessionExists' })
   }
+  assertReservedTabUnheld(state, request)
   const pinned = {
     ...existing,
     ...(!existing.launchArgs && request.launchArgs ? { launchArgs: [...request.launchArgs] } : {}),
@@ -237,14 +243,19 @@ function assertAdoptedConversationUnowned(
       (link) => agentSessionProviderHandleRoot(link.handle) === root
     )
     if (holdsSameConversation) {
-      throw new Error('agent_session_conflict')
+      throw agentSessionRefusalError('agent_session_conflict', {
+        reason: 'conversationHeldElsewhere'
+      })
     }
   }
 }
 
-/** A tab id names one conversation. Two records under one id would give two chats one tab, one
- *  read-state key and one notification id, so the second reservation is refused as a conflict. */
-function assertSurfaceTabIdUnheld(
+/**
+ * A tab id names one conversation, so a reserved id another session's tab holds is a conflict.
+ * Checked, not claimed: the id is taken when the chat's tab is published, so a create that never
+ * gets that far leaves nothing in the table to restore or release.
+ */
+function assertReservedTabUnheld(
   state: AgentSessionStoreState,
   request: AgentSessionReserveRequest
 ): void {
@@ -252,12 +263,13 @@ function assertSurfaceTabIdUnheld(
     return
   }
   if (!isAgentSessionSurfaceTabId(request.surfaceTabId)) {
-    throw new Error('agent_session_operation_invalid')
+    throw agentSessionRefusalError('agent_session_operation_invalid', {
+      reason: 'requestMalformed'
+    })
   }
-  for (const record of state.records.values()) {
-    if (record.sessionId !== request.sessionId && record.surfaceTabId === request.surfaceTabId) {
-      throw new Error('agent_session_conflict')
-    }
+  const holder = state.sessionTabs?.sessionIdFor(request.surfaceTabId)
+  if (holder !== undefined && holder !== request.sessionId) {
+    throw agentSessionRefusalError('agent_session_conflict', { reason: 'tabIdTaken' })
   }
 }
 
@@ -276,7 +288,6 @@ function createAgentSessionRecord(
     accountHome: request.accountHome,
     ...(request.options ? { options: { ...request.options } } : {}),
     ...(request.launchArgs ? { launchArgs: [...request.launchArgs] } : {}),
-    ...(request.surfaceTabId ? { surfaceTabId: request.surfaceTabId } : {}),
     createdAt: request.now,
     updatedAt: request.now,
     lease: {
@@ -310,21 +321,43 @@ export function commitAgentSessionReservation(
   leaseTtlMs: number
 ): AgentSessionReserveResult {
   const decision = evaluateAgentSessionReserveOperation(state, request)
+  const existing = state.records.get(request.sessionId)
+  // An unfinished operation whose reservation recovery released continues under its own id at the
+  // next fence, as a resume does under a new id; the fence move stops the old spawn committing.
+  const continued =
+    existing && agentSessionLeaseIsReleased(existing.lease)
+      ? { ...request, expectedFence: existing.lease.runtimeFence }
+      : null
   if (decision.decision === 'refused') {
-    throw new Error(decision.code)
+    // An aged-out row proves nothing more: a released reservation runs no effect.
+    if (decision.code !== 'agent_session_operation_expired' || !continued) {
+      throw agentSessionRefusalError(decision.code, decision.details)
+    }
+    const row = pendingAgentSessionOperationRow({ ...request.operation, now: request.now })
+    return reserveWithOperationRow(state, continued, row, leaseTtlMs)
   }
   if (decision.decision === 'replay') {
-    let record = requireAgentSessionRecordForReplay(state, decision.row, request.sessionId)
-    if (decision.row.outcome.status === 'pending' && request.handoffOperationId !== null) {
-      record = admitPendingAgentSessionReservationReplay(record, request)
+    const record = requireAgentSessionRecordForReplay(state, decision.row, request.sessionId)
+    if (decision.row.outcome.status !== 'pending' || request.handoffOperationId === null) {
+      return { record, disposition: 'replayed', operationRow: decision.row }
     }
-    return { record, disposition: 'replayed' as const, operationRow: decision.row }
+    if (continued) {
+      return reserveWithOperationRow(state, continued, decision.row, leaseTtlMs)
+    }
+    const retried = admitPendingAgentSessionReservationReplay(record, request)
+    return { record: retried, disposition: 'replayed', operationRow: decision.row }
   }
+  return reserveWithOperationRow(state, request, decision.row, leaseTtlMs)
+}
+
+function reserveWithOperationRow(
+  state: AgentSessionStoreState,
+  request: AgentSessionReserveRequest,
+  row: AgentSessionOperationRow,
+  leaseTtlMs: number
+): AgentSessionReserveResult {
   const result = applyAgentSessionReservation(state, request, leaseTtlMs)
-  state.operations.set(
-    agentSessionOperationKey(request.operation.callerKey, request.operation.operationId),
-    decision.row
-  )
+  state.operations.set(agentSessionOperationKey(row.callerKey, row.operationId), row)
   state.records.set(result.record.sessionId, result.record)
-  return { ...result, operationRow: decision.row }
+  return { ...result, operationRow: row }
 }
diff --git a/src/main/runtime/agent-session-restart-lease-transitions.ts b/src/main/runtime/agent-session-restart-lease-transitions.ts
index 45c59e02744..b4269d21c67 100644
--- a/src/main/runtime/agent-session-restart-lease-transitions.ts
+++ b/src/main/runtime/agent-session-restart-lease-transitions.ts
@@ -8,13 +8,9 @@
 
 import {
   adjudicateAgentSessionRestart,
-  agentSessionRestartEvictionSettlementId,
   type AgentSessionOwnerProbe
 } from '../../shared/agent-session-lease-adjudication'
-import type {
-  AgentSessionHandoffStage,
-  AgentSessionRecord
-} from '../../shared/agent-session-record'
+import type { AgentSessionRecord } from '../../shared/agent-session-record'
 import { withLease } from './agent-session-lease-transitions'
 
 /** Apply one restart adjudication. Never consults deadlines — only proof moves a lease. */
@@ -29,9 +25,6 @@ export function applyAgentSessionRestartAdjudication(args: {
     probe: args.probe,
     observedAt: args.now
   })
-  if (adjudication.disposition === 'settlement-pending') {
-    return withLease(record, { ...record.lease, unreconciled: false, lastRenewedAt: args.now })
-  }
   if (adjudication.disposition === 'free') {
     // Why: an already-free lease that reloads into `recovering` is unopenable forever; clearing
     // the stage restores it without moving the fence or touching the recorded death evidence.
@@ -39,42 +32,33 @@ export function applyAgentSessionRestartAdjudication(args: {
       ...record.lease,
       handoffStage: null,
       handoffOperationId: null,
-      processlessAt: null,
       unreconciled: false,
       lastRenewedAt: args.now
     })
   }
   if (adjudication.disposition === 'evicted') {
-    // A reservation that never proved its handle ran no turn, so no journal settlement is owed.
-    const settlementOwed = record.lease.handoffStage !== 'new-owner-proving'
+    // What the dead generation left running is settled from `deathEvidence` when the journal is
+    // next opened, so nothing about it is owed here.
     return withLease(record, {
       ...record.lease,
       runtimeFence: adjudication.nextFence,
       handoffStage: null,
       ownerProcess: null,
       reservedSpawnToken: null,
-      processlessAt: null,
       claimStatus: 'released',
       unreconciled: false,
       lastRenewedAt: args.now,
       handoffOperationId: null,
-      deathEvidence: adjudication.evidence,
-      ...(settlementOwed
-        ? {
-            settlementRetryRequired: true,
-            settlementRetryId: agentSessionRestartEvictionSettlementId(record.lease, adjudication)
-          }
-        : {})
+      deathEvidence: adjudication.evidence
     })
   }
-  const stage: AgentSessionHandoffStage =
-    adjudication.disposition === 'conflicted' ? 'manual-recovery' : adjudication.stage
-  return withLease(record, {
-    ...record.lease,
-    handoffStage: stage,
-    claimStatus:
-      adjudication.disposition === 'conflicted' ? 'conflicted' : record.lease.claimStatus,
-    unreconciled: false,
-    lastRenewedAt: args.now
-  })
+  // Parking in recovery proves nothing alive, so `lastRenewedAt` keeps the pre-crash proof.
+  return {
+    ...withLease(record, {
+      ...record.lease,
+      handoffStage: adjudication.stage,
+      unreconciled: false
+    }),
+    updatedAt: args.now
+  }
 }
diff --git a/src/main/runtime/agent-session-spawn-token-process-scan.ts b/src/main/runtime/agent-session-spawn-token-process-scan.ts
index 6db1c069110..55e860f9320 100644
--- a/src/main/runtime/agent-session-spawn-token-process-scan.ts
+++ b/src/main/runtime/agent-session-spawn-token-process-scan.ts
@@ -56,7 +56,7 @@ export async function scanAgentSessionSpawnTokenProcesses(
 /**
  * Diagnostic evidence only. A null result is deliberately typed as
  * `unverifiable`, not as an empty process set; callers must never use this
- * Linux read-back as ownership or orphan-reaping proof.
+ * Linux read-back as ownership proof.
  */
 export async function scanAgentSessionSpawnTokenEvidence(
   platform: NodeJS.Platform = process.platform,
diff --git a/src/main/runtime/agent-session-store-serialization.ts b/src/main/runtime/agent-session-store-serialization.ts
index cda3e44d7ff..adc93f85c01 100644
--- a/src/main/runtime/agent-session-store-serialization.ts
+++ b/src/main/runtime/agent-session-store-serialization.ts
@@ -1,4 +1,5 @@
 import type { AgentSessionStoreState } from './agent-session-record-store-file'
+import { serializeAgentSessionTabTable } from './agent-session-tab-table'
 
 export function serializeAgentSessionStoreState(state: AgentSessionStoreState): string {
   const records: Record<string, unknown> = Object.create(null)
@@ -13,8 +14,8 @@ export function serializeAgentSessionStoreState(state: AgentSessionStoreState):
     retiredClaimKeys: state.retiredClaimKeys,
     unusableRecords: Object.fromEntries(state.unreadableRecords)
   }
-  if (state.visibleSessionIdsIndexPresent) {
-    serialized.visibleSessionIds = [...state.visibleSessionIds]
+  if (state.sessionTabs) {
+    Object.assign(serialized, serializeAgentSessionTabTable(state.sessionTabs))
   }
   return JSON.stringify(serialized)
 }
diff --git a/src/main/runtime/agent-session-store-transaction-queue.ts b/src/main/runtime/agent-session-store-transaction-queue.ts
index 08d04996d81..1a4c78e4672 100644
--- a/src/main/runtime/agent-session-store-transaction-queue.ts
+++ b/src/main/runtime/agent-session-store-transaction-queue.ts
@@ -1,5 +1,5 @@
 import type { AgentSessionOperationRow } from '../../shared/agent-session-operation-ledger'
-import type { AgentSessionRecord } from '../../shared/agent-session-record'
+import type { AgentSessionLease, AgentSessionRecord } from '../../shared/agent-session-record'
 import { raiseAgentSessionFencesAfterBackupRecovery } from './agent-session-backup-recovery-fence'
 import {
   AGENT_SESSION_STORE_SCHEMA_VERSION,
@@ -7,16 +7,30 @@ import {
   loadAgentSessionStore,
   saveAgentSessionStore,
   type AgentSessionStoreState,
-  type LoadedAgentSessionStore,
-  backfillAgentSessionSurfaceTabIds
+  type LoadedAgentSessionStore
 } from './agent-session-record-store-file'
 import { withFileTransactionLock } from '../file-transaction-lock'
 
+/** Latch fields older builds wrote. Nothing reads them, and dropping them keeps a lease this build
+ *  writes back from carrying a stale latch to an older build after a downgrade. */
+type RetiredAgentSessionLeaseFields = {
+  processlessAt?: unknown
+  settlementRetryRequired?: unknown
+  settlementRetryId?: unknown
+}
+
 function markLoadedLeasesUnreconciled(state: AgentSessionStoreState): void {
   for (const [sessionId, record] of state.records) {
+    const lease: AgentSessionLease & RetiredAgentSessionLeaseFields = record.lease
+    const {
+      processlessAt: _processlessAt,
+      settlementRetryRequired: _settlementRetryRequired,
+      settlementRetryId: _settlementRetryId,
+      ...current
+    } = lease
     state.records.set(sessionId, {
       ...record,
-      lease: { ...record.lease, unreconciled: true }
+      lease: { ...current, unreconciled: true }
     })
   }
 }
@@ -39,16 +53,15 @@ function agentSessionStoreStateChanged(
   operations: ReadonlyMap<string, AgentSessionOperationRow>,
   retiredClaimKeys: AgentSessionStoreState['retiredClaimKeys'],
   unreadableRecords: AgentSessionStoreState['unreadableRecords'],
-  visibleSessionIds: AgentSessionStoreState['visibleSessionIds'],
-  visibleSessionIdsIndexPresent: AgentSessionStoreState['visibleSessionIdsIndexPresent']
+  sessionTabs: AgentSessionStoreState['sessionTabs']
 ): boolean {
   return (
     !mapEntriesMatch(state.records, records) ||
     !mapEntriesMatch(state.operations, operations) ||
     !mapEntriesMatch(state.unreadableRecords, unreadableRecords) ||
-    state.visibleSessionIdsIndexPresent !== visibleSessionIdsIndexPresent ||
-    state.visibleSessionIds.size !== visibleSessionIds.size ||
-    [...state.visibleSessionIds].some((id) => !visibleSessionIds.has(id)) ||
+    (state.sessionTabs && sessionTabs
+      ? !state.sessionTabs.equals(sessionTabs)
+      : state.sessionTabs !== sessionTabs) ||
     state.retiredClaimKeys.length !== retiredClaimKeys.length ||
     state.retiredClaimKeys.some((entry, index) => entry !== retiredClaimKeys[index])
   )
@@ -100,8 +113,7 @@ export class AgentSessionStoreTransactionQueue {
         const operations = new Map(this.state.operations)
         const retiredClaimKeys = [...this.state.retiredClaimKeys]
         const unreadableRecords = new Map(this.state.unreadableRecords)
-        const visibleSessionIds = new Set(this.state.visibleSessionIds)
-        const visibleSessionIdsIndexPresent = this.state.visibleSessionIdsIndexPresent
+        const sessionTabs = this.state.sessionTabs?.clone() ?? null
         try {
           // The lost commit may have granted a higher fence than the backup records show. Rather
           // than refuse forever, raise every recovered fence clear of anything that commit could
@@ -120,8 +132,7 @@ export class AgentSessionStoreTransactionQueue {
               operations,
               retiredClaimKeys,
               unreadableRecords,
-              visibleSessionIds,
-              visibleSessionIdsIndexPresent
+              sessionTabs
             )
           ) {
             return result
@@ -140,8 +151,7 @@ export class AgentSessionStoreTransactionQueue {
           this.state.operations = operations
           this.state.retiredClaimKeys = retiredClaimKeys
           this.state.unreadableRecords = unreadableRecords
-          this.state.visibleSessionIds = visibleSessionIds
-          this.state.visibleSessionIdsIndexPresent = visibleSessionIdsIndexPresent
+          this.state.sessionTabs = sessionTabs
           throw error
         }
       })
@@ -170,11 +180,6 @@ export class AgentSessionStoreTransactionQueue {
       throw new Error('agent_session_legacy_required')
     }
     markLoadedLeasesUnreconciled(loaded.state)
-    // Why: a reload replaces the state wholesale, so the ids filled at open would vanish from
-    // memory until the next open; refilling keeps every in-memory record carrying one. It does
-    // not force a save: a reload marks every lease unadjudicated, and this instance must not
-    // persist that verdict on the strength of a refill.
-    backfillAgentSessionSurfaceTabIds(loaded.state)
     this.state = loaded.state
     this.diskRevision = diskRevision
     this.needsRewrite = loaded.needsRewrite
diff --git a/src/main/runtime/agent-session-surface-release-transition.test.ts b/src/main/runtime/agent-session-surface-release-transition.test.ts
index 5e671acc77f..0ea30d90197 100644
--- a/src/main/runtime/agent-session-surface-release-transition.test.ts
+++ b/src/main/runtime/agent-session-surface-release-transition.test.ts
@@ -18,5 +18,7 @@ describe('agent session surface release transition', () => {
     })
 
     expect(released.lease.runtimeFence).toBe(9)
+    // The proof names the owner it released, not the fence the floor moved to.
+    expect(released.lease.deathEvidence).toMatchObject({ kind: 'exit-observed', ownerFence: 7 })
   })
 })
diff --git a/src/main/runtime/agent-session-surface-release-transition.ts b/src/main/runtime/agent-session-surface-release-transition.ts
index a6c90d1e01f..fe98a870524 100644
--- a/src/main/runtime/agent-session-surface-release-transition.ts
+++ b/src/main/runtime/agent-session-surface-release-transition.ts
@@ -5,9 +5,10 @@
 // lease-owning provider root through the adapter. Its observed exit is sufficient because the
 // lease follows that root, even when descendants remain `unverifiable`.
 //
-// The fence still moves. A released lease at the old fence would let a mutation a client queued
-// against the dead generation land on the next one.
+// The fence still moves, so the next owner is a new generation: an attach or settlement still
+// holding the stopped owner's fence is refused as stale rather than acting on its successor.
 
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
 import type { AgentSessionRecord } from '../../shared/agent-session-record'
 import { nextAgentSessionFence } from '../../shared/agent-session-next-fence'
 import { assertFence, withLease } from './agent-session-lease-transitions'
@@ -31,28 +32,27 @@ export function releaseAgentSessionOwnerAfterSurfaceClose(args: {
   now: number
   /** Exit receipt can precede a delayed journal settlement and lease release. */
   exitObservedAt?: number
-  settlementRetry?: { settlementId: string; detail: string }
+  /** Why the provider exited, when the host saw it die on its own. */
+  exitReason?: string
 }): AgentSessionRecord {
   const { record } = args
   assertFence(record.lease, args.expectedFence)
   if (!isSurfaceReleasableAgentSessionRecord(record)) {
-    throw new Error('agent_session_ownership_unknown')
+    throw agentSessionRefusalError('agent_session_ownership_unknown', { reason: 'leaseMoved' })
   }
   return withLease(record, {
     ...record.lease,
     runtimeFence: nextAgentSessionFence(record.lease),
     ownerProcess: null,
     reservedSpawnToken: null,
-    processlessAt: null,
     claimStatus: 'released',
-    handoffStage: args.settlementRetry ? 'recovering' : null,
-    settlementRetryRequired: args.settlementRetry ? true : undefined,
-    settlementRetryId: args.settlementRetry?.settlementId,
+    handoffStage: null,
     lastRenewedAt: args.now,
     deathEvidence: {
       kind: 'exit-observed',
-      detail: args.settlementRetry?.detail ?? 'the last surface holding this session released it',
-      observedAt: args.exitObservedAt ?? args.now
+      detail: args.exitReason ?? 'the last surface holding this session released it',
+      observedAt: args.exitObservedAt ?? args.now,
+      ownerFence: record.lease.runtimeFence
     }
   })
 }
@@ -65,7 +65,7 @@ export function releaseStoredAgentSessionOwnerAfterSurfaceClose(
     expectedFence: number
     now: number
     exitObservedAt?: number
-    settlementRetry?: { settlementId: string; detail: string }
+    exitReason?: string
   }
 ): Promise<AgentSessionRecord> {
   return store.transitionHandoff(args.sessionId, (record) =>
diff --git a/src/main/runtime/agent-session-tab-table.ts b/src/main/runtime/agent-session-tab-table.ts
new file mode 100644
index 00000000000..6022aac8bf2
--- /dev/null
+++ b/src/main/runtime/agent-session-tab-table.ts
@@ -0,0 +1,259 @@
+import { isAgentSessionId, type AgentSessionRecord } from '../../shared/agent-session-record'
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
+import { isAgentSessionSurfaceTabId } from '../../shared/agent-session-surface-tab-id'
+import { structuredAgentSessionTabId } from '../../shared/structured-agent-session-projection'
+import type { AgentSessionStoreState } from './agent-session-record-store-file'
+
+/**
+ * Which conversation each structured chat tab shows, keyed by the host tab id.
+ *
+ * Membership is visibility: a session with an entry has a chat tab, and the key is that tab's id.
+ * A /clear moves the tab to the replacement conversation rather than copying its id, so an id names
+ * one conversation by construction and a session maps back to at most one tab.
+ */
+export class AgentSessionTabTable {
+  private readonly sessionByTab = new Map<string, string>()
+  private readonly tabBySession = new Map<string, string>()
+
+  constructor(entries: Iterable<readonly [tabId: string, sessionId: string]> = []) {
+    for (const [tabId, sessionId] of entries) {
+      this.put(tabId, sessionId)
+    }
+  }
+
+  tabIdFor(sessionId: string): string | undefined {
+    return this.tabBySession.get(sessionId)
+  }
+
+  sessionIdFor(tabId: string): string | undefined {
+    return this.sessionByTab.get(tabId)
+  }
+
+  /** Sessions that have a tab, in the order their tabs were given out. */
+  sessionIds(): string[] {
+    return [...this.sessionByTab.values()]
+  }
+
+  entries(): [tabId: string, sessionId: string][] {
+    return [...this.sessionByTab.entries()]
+  }
+
+  /**
+   * Gives a session a tab unless it already has one. Without a reserved id it gets the id clients
+   * derive for it, unless a cleared conversation's tab kept that id.
+   */
+  show(sessionId: string, tabId?: string): void {
+    if (this.tabBySession.has(sessionId)) {
+      return
+    }
+    const derived = structuredAgentSessionTabId(sessionId)
+    const held = (candidate: string): boolean => this.sessionByTab.has(candidate)
+    this.put(tabId ?? (held(derived) ? reopenedTabId(sessionId, held) : derived), sessionId)
+  }
+
+  /** Returns the id the session's tab had, if it had one. */
+  hide(sessionId: string): string | undefined {
+    const tabId = this.tabBySession.get(sessionId)
+    if (tabId !== undefined) {
+      this.tabBySession.delete(sessionId)
+      this.sessionByTab.delete(tabId)
+    }
+    return tabId
+  }
+
+  /** A /clear: the tab that showed `fromSessionId` shows `toSessionId`, keeping its id and place. */
+  move(fromSessionId: string, toSessionId: string): void {
+    const tabId = this.tabBySession.get(fromSessionId)
+    this.hide(toSessionId)
+    if (tabId === undefined) {
+      this.show(toSessionId)
+      return
+    }
+    this.tabBySession.delete(fromSessionId)
+    this.sessionByTab.set(tabId, toSessionId)
+    this.tabBySession.set(toSessionId, tabId)
+  }
+
+  clone(): AgentSessionTabTable {
+    return new AgentSessionTabTable(this.sessionByTab)
+  }
+
+  equals(other: AgentSessionTabTable): boolean {
+    const left = this.entries()
+    const right = other.entries()
+    return (
+      left.length === right.length &&
+      left.every(([tabId, sessionId], index) => {
+        const [otherTabId, otherSessionId] = right[index]
+        return tabId === otherTabId && sessionId === otherSessionId
+      })
+    )
+  }
+
+  private put(tabId: string, sessionId: string): void {
+    const owner = this.sessionByTab.get(tabId)
+    if (owner !== undefined && owner !== sessionId) {
+      throw agentSessionRefusalError('agent_session_conflict', { reason: 'tabIdTaken' })
+    }
+    this.hide(sessionId)
+    this.sessionByTab.set(tabId, sessionId)
+    this.tabBySession.set(sessionId, tabId)
+  }
+}
+
+/**
+ * The id a cleared conversation reopened from history takes while the tab now showing its
+ * replacement holds its own. Deterministic, so a table seeded again gives it the same id.
+ */
+function reopenedTabId(sessionId: string, held: (tabId: string) => boolean): string {
+  const base = `${structuredAgentSessionTabId(sessionId)}-reopened`
+  let tabId = base
+  for (let suffix = 2; held(tabId); suffix++) {
+    tabId = `${base}-${suffix}`
+  }
+  return tabId
+}
+
+export function setAgentSessionTabVisibility(
+  state: AgentSessionStoreState,
+  sessionId: string,
+  visible: boolean,
+  tabId?: string
+): void {
+  if (visible && !state.records.has(sessionId)) {
+    throw agentSessionRefusalError('agent_session_identity_required', { reason: 'recordMissing' })
+  }
+  state.sessionTabs ??= new AgentSessionTabTable()
+  if (visible) {
+    state.sessionTabs.show(sessionId, tabId)
+  } else {
+    state.sessionTabs.hide(sessionId)
+  }
+}
+
+export type PersistedAgentSessionTab = { tabId: string; sessionId: string }
+
+export function serializeAgentSessionTabTable(table: AgentSessionTabTable): {
+  sessionTabs: PersistedAgentSessionTab[]
+  visibleSessionIds: string[]
+} {
+  return {
+    sessionTabs: table.entries().map(([tabId, sessionId]) => ({ tabId, sessionId })),
+    // Written for older builds, which restore tabs from this list; never read beside the table.
+    visibleSessionIds: table.sessionIds()
+  }
+}
+
+/**
+ * Reads the persisted table, or seeds it from what older builds wrote: the visible session list and,
+ * for a chat created by a build that recorded one, the tab id on its record. That record field is
+ * read here and nowhere else, and only when the file carries no table.
+ *
+ * Deterministic on purpose: a parsed store must hash the same on every read of the same bytes.
+ */
+export function parseAgentSessionTabTable(
+  file: { sessionTabs?: unknown; visibleSessionIds?: unknown },
+  records: ReadonlyMap<string, AgentSessionRecord>,
+  strict: boolean
+): { valid: boolean; table: AgentSessionTabTable | null } {
+  if (file.sessionTabs !== undefined) {
+    return parsePersistedTabs(file.sessionTabs, strict)
+  }
+  if (file.visibleSessionIds === undefined) {
+    return { valid: true, table: null }
+  }
+  if (!Array.isArray(file.visibleSessionIds)) {
+    return { valid: !strict, table: null }
+  }
+  return { valid: true, table: seedFromVisibleSessions(file.visibleSessionIds, records) }
+}
+
+/**
+ * A cleared chat's tab was opened for the first conversation of its /clear chain and kept that id
+ * through every clear, so the chat now showing the chain's latest conversation seeds under the
+ * first one's id, as a /clear on this build would have left it. Those chats seed first: a cleared
+ * conversation reopened from history is the later tab, and takes a fresh id if its own is held.
+ */
+function seedFromVisibleSessions(
+  visible: readonly unknown[],
+  records: ReadonlyMap<string, AgentSessionRecord>
+): AgentSessionTabTable {
+  const sessionIds = [...new Set(visible.filter(isAgentSessionId))]
+  const clearedFrom = new Map<string, string>()
+  for (const record of records.values()) {
+    const command = record.conversationCommand
+    if (
+      command?.command === 'clear' &&
+      command.phase === 'committed' &&
+      command.replacementSessionId &&
+      !clearedFrom.has(command.replacementSessionId)
+    ) {
+      clearedFrom.set(command.replacementSessionId, record.sessionId)
+    }
+  }
+  const clearedTo = new Set(clearedFrom.values())
+  const chainRoot = (sessionId: string): string => {
+    const seen = new Set([sessionId])
+    let current = sessionId
+    let prior = clearedFrom.get(current)
+    while (prior !== undefined && !seen.has(prior)) {
+      seen.add(prior)
+      current = prior
+      prior = clearedFrom.get(current)
+    }
+    return current
+  }
+  const recordedOrDerived = (sessionId: string): string[] => {
+    const record = records.get(sessionId)
+    const recorded = record && 'surfaceTabId' in record ? record.surfaceTabId : undefined
+    return [recorded, structuredAgentSessionTabId(sessionId)].filter(isAgentSessionSurfaceTabId)
+  }
+  const tabIds = new Map<string, string>()
+  const taken = new Set<string>()
+  const held = (tabId: string): boolean => taken.has(tabId)
+  const assign = (sessionId: string, candidates: readonly string[]): void => {
+    const tabId = candidates.find((candidate) => !held(candidate)) ?? reopenedTabId(sessionId, held)
+    taken.add(tabId)
+    tabIds.set(sessionId, tabId)
+  }
+  const holdsChainTab = (sessionId: string): boolean =>
+    !clearedTo.has(sessionId) && chainRoot(sessionId) !== sessionId
+  for (const sessionId of sessionIds.filter(holdsChainTab)) {
+    assign(sessionId, [...recordedOrDerived(chainRoot(sessionId)), ...recordedOrDerived(sessionId)])
+  }
+  for (const sessionId of sessionIds.filter((sessionId) => !holdsChainTab(sessionId))) {
+    assign(sessionId, recordedOrDerived(sessionId))
+  }
+  // In the visible list's order, which is the order older builds restored tabs in.
+  return new AgentSessionTabTable(
+    sessionIds.flatMap((sessionId) => {
+      const tabId = tabIds.get(sessionId)
+      return tabId === undefined ? [] : [[tabId, sessionId] as const]
+    })
+  )
+}
+
+function parsePersistedTabs(
+  raw: unknown,
+  strict: boolean
+): { valid: boolean; table: AgentSessionTabTable | null } {
+  if (!Array.isArray(raw)) {
+    return { valid: !strict, table: null }
+  }
+  const table = new AgentSessionTabTable()
+  for (const entry of raw) {
+    const tabId: unknown = entry?.tabId
+    const sessionId: unknown = entry?.sessionId
+    const wellFormed =
+      isAgentSessionSurfaceTabId(tabId) &&
+      isAgentSessionId(sessionId) &&
+      table.sessionIdFor(tabId) === undefined &&
+      table.tabIdFor(sessionId) === undefined
+    if (wellFormed) {
+      table.show(sessionId, tabId)
+    } else if (strict) {
+      return { valid: false, table: null }
+    }
+  }
+  return { valid: true, table }
+}
diff --git a/src/main/runtime/agent-session-visible-tab-index.ts b/src/main/runtime/agent-session-visible-tab-index.ts
deleted file mode 100644
index e0f7b9b4c5c..00000000000
--- a/src/main/runtime/agent-session-visible-tab-index.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-import type { AgentSessionStoreState } from './agent-session-record-store-file'
-export function parseVisibleSessionIds(
-  raw: unknown,
-  schemaVersion: number,
-  currentSchemaVersion: number
-): { ids: string[]; present: boolean; valid: boolean } {
-  if (raw === undefined) {
-    return { ids: [], present: false, valid: true }
-  }
-  if (!Array.isArray(raw)) {
-    return { ids: [], present: false, valid: schemaVersion !== currentSchemaVersion }
-  }
-  const ids: string[] = []
-  for (const value of raw) {
-    if (typeof value === 'string' && value.length > 0) {
-      ids.push(value)
-    } else if (schemaVersion === currentSchemaVersion) {
-      return { ids: [], present: true, valid: false }
-    }
-  }
-  return { ids, present: true, valid: true }
-}
-
-export function setVisibleSessionId(
-  state: AgentSessionStoreState,
-  sessionId: string,
-  visible: boolean
-): void {
-  if (visible) {
-    if (!state.records.has(sessionId)) {
-      throw new Error('agent_session_identity_required')
-    }
-    state.visibleSessionIds.add(sessionId)
-  } else {
-    state.visibleSessionIds.delete(sessionId)
-  }
-  state.visibleSessionIdsIndexPresent = true
-}
diff --git a/src/main/runtime/agent-startup-input-assembly-census.test.ts b/src/main/runtime/agent-startup-input-assembly-census.test.ts
deleted file mode 100644
index ca05ed03648..00000000000
--- a/src/main/runtime/agent-startup-input-assembly-census.test.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-const REPO_ROOT = join(import.meta.dirname, '../../..')
-
-/**
- * The host modules that turn settings into `buildAgentStartupPlan` inputs.
- *
- * `buildAgentStartupPlan` was always shared; the input assembly was not, and the hand-rolled
- * copies drifted — one dropped `sessionOptionsOverrideAgentArgs` and let configured args defeat a
- * picked model. This pins the funnel so a sixth host site cannot re-derive the inputs by hand.
- */
-const MIGRATED_HOST_LAUNCH_MODULES = [
-  'src/main/runtime/orca-runtime-create-agent-session.ts',
-  'src/main/runtime/orca-runtime-resolve-mobile-session-terminal-command.ts',
-  'src/main/runtime/orca-runtime-resolve-worktree-removal-target.ts',
-  'src/main/runtime/runtime-worktree-agent-startup.ts'
-]
-
-/** Reading any of these next to a startup plan means the inputs are being assembled by hand. */
-const HAND_ASSEMBLY_MARKERS = [
-  'resolveTuiAgentLaunchArgs(',
-  'resolveTuiAgentLaunchEnv(',
-  'resolveLocalWindowsAgentStartupShell('
-]
-
-function read(file: string): string {
-  return readFileSync(join(REPO_ROOT, file), 'utf8')
-}
-
-describe('host agent-startup input assembly census', () => {
-  it('routes every migrated host launch site through the shared resolver', () => {
-    const missing = MIGRATED_HOST_LAUNCH_MODULES.filter(
-      (file) => !read(file).includes('resolveAgentStartupPlanInputs(')
-    )
-    expect(missing).toEqual([])
-  })
-
-  it('leaves no migrated host site assembling the settings-derived inputs by hand', () => {
-    const handAssembled = MIGRATED_HOST_LAUNCH_MODULES.filter((file) => {
-      const source = read(file)
-      return HAND_ASSEMBLY_MARKERS.some((marker) => source.includes(marker))
-    })
-    expect(handAssembled).toEqual([])
-  })
-
-  it('detects hand assembly when it is present', () => {
-    // Positive control: the markers are real names, so an empty result above is a true negative
-    // rather than a typo that can never match.
-    const resumeSite = read(
-      'src/main/runtime/orca-runtime-get-agent-session-execution-namespace.ts'
-    )
-    expect(HAND_ASSEMBLY_MARKERS.some((marker) => resumeSite.includes(marker))).toBe(true)
-  })
-})
diff --git a/src/main/runtime/agent-terminal-launch-trust-host.test.ts b/src/main/runtime/agent-terminal-launch-host.test.ts
similarity index 67%
rename from src/main/runtime/agent-terminal-launch-trust-host.test.ts
rename to src/main/runtime/agent-terminal-launch-host.test.ts
index 949b0c545fc..1925869a4e5 100644
--- a/src/main/runtime/agent-terminal-launch-trust-host.test.ts
+++ b/src/main/runtime/agent-terminal-launch-host.test.ts
@@ -1,7 +1,5 @@
-// launchAgentTerminal read `store.getRepo(worktree.repoId)?.connectionId` for the trust write —
-// host-blind, so the same repo id on two hosts wrote a remote path into the client's agent config
-// and the agent on the host never saw the trust (#11163). Every sibling call site already passes
-// the resolved `workspace.connectionId`; this was the last one that did not.
+// launchAgentTerminal once read the host-blind `store.getRepo(worktree.repoId)`, so the same repo
+// id on two hosts built the launch for the wrong one (#11163).
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('electron', () => ({
@@ -18,11 +16,6 @@ const REMOTE_PATH = '/srv/app-feature'
 type RuntimeInternals = {
   resolveWorktreeSelector: (selector: string) => Promise<unknown>
   buildStartupForAgent: (repo: unknown, agent: unknown, prompt: string) => unknown
-  markWorkspaceTrustedForAgent: (
-    agent: unknown,
-    connectionId: string | null | undefined,
-    path: string
-  ) => Promise<void>
   createTerminal: (selector: string, opts: unknown) => Promise<unknown>
 }
 
@@ -41,24 +34,22 @@ function makeRuntime(repos: readonly Record<string, unknown>[], hostId?: string)
     path: REMOTE_PATH,
     ...(hostId ? { hostId } : {})
   })
-  vi.spyOn(internals, 'buildStartupForAgent').mockReturnValue({
+  const buildStartup = vi.spyOn(internals, 'buildStartupForAgent').mockReturnValue({
     agent: 'codex',
     startup: { command: 'codex', env: {}, startupCommandDelivery: 'none', telemetry: {} }
   })
-  const markTrusted = vi.fn(async () => {})
-  vi.spyOn(internals, 'markWorkspaceTrustedForAgent').mockImplementation(markTrusted)
   vi.spyOn(internals, 'createTerminal').mockResolvedValue({ id: 'pty-1' })
-  return { runtime, markTrusted }
+  return { runtime, buildStartup }
 }
 
-describe('launchAgentTerminal trust write', () => {
+describe('launchAgentTerminal execution host', () => {
   beforeEach(() => {
     vi.restoreAllMocks()
   })
 
-  it('writes trust on the host the worktree names, not on a rival row', async () => {
+  it('builds the launch for the host the worktree names, not a rival row', async () => {
     // Two SSH hosts publish the same repo id; the worktree is on m4air.
-    const { runtime, markTrusted } = makeRuntime(
+    const { runtime, buildStartup } = makeRuntime(
       [
         { id: 'repo-shared', path: '/home/me/app', connectionId: 'openclaw' },
         { id: 'repo-shared', path: '/srv/app', connectionId: 'm4air' }
@@ -69,13 +60,13 @@ describe('launchAgentTerminal trust write', () => {
     await runtime.launchAgentTerminal('id:repo-shared::/srv/app-feature', {
       agent: 'codex',
       prompt: 'go'
-    } as never)
+    })
 
-    expect(markTrusted).toHaveBeenCalledWith('codex', 'm4air', REMOTE_PATH)
+    expect(buildStartup.mock.calls[0]?.[0]).toMatchObject({ connectionId: 'm4air' })
   })
 
-  it('writes trust locally for a local worktree even when a remote row shares the id', async () => {
-    const { runtime, markTrusted } = makeRuntime(
+  it('builds a local launch for a local worktree even when a remote row shares the id', async () => {
+    const { runtime, buildStartup } = makeRuntime(
       [
         { id: 'repo-shared', path: '/srv/app', connectionId: 'm4air' },
         { id: 'repo-shared', path: '/home/me/app' }
@@ -86,9 +77,10 @@ describe('launchAgentTerminal trust write', () => {
     await runtime.launchAgentTerminal('id:repo-shared::/srv/app-feature', {
       agent: 'codex',
       prompt: 'go'
-    } as never)
+    })
 
-    expect(markTrusted).toHaveBeenCalledWith('codex', null, REMOTE_PATH)
+    expect(buildStartup.mock.calls[0]?.[0]).toMatchObject({ path: '/home/me/app' })
+    expect(buildStartup.mock.calls[0]?.[0]).not.toHaveProperty('connectionId')
   })
 
   it('refuses rather than guessing when rival rows disagree and the worktree names no host', async () => {
@@ -101,7 +93,7 @@ describe('launchAgentTerminal trust write', () => {
       runtime.launchAgentTerminal('id:repo-shared::/srv/app-feature', {
         agent: 'codex',
         prompt: 'go'
-      } as never)
+      })
     ).rejects.toThrow('worktree_execution_host_unresolved')
   })
 })
diff --git a/src/main/runtime/agent-terminal-startup-prompt.test.ts b/src/main/runtime/agent-terminal-startup-prompt.test.ts
index 7b73571ba79..8a9f9648147 100644
--- a/src/main/runtime/agent-terminal-startup-prompt.test.ts
+++ b/src/main/runtime/agent-terminal-startup-prompt.test.ts
@@ -22,11 +22,10 @@ function runtimeWithAgentLaunch(): {
   spawn: ReturnType<typeof vi.fn>
 } {
   const runtime = new OrcaRuntimeService()
-  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the resolver under test is a protected member; the assertion names only the three internals this stub replaces, each of which is assigned before the create reaches it.
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the resolver under test is a protected member; the assertion names only the two internals this stub replaces, each of which is assigned before the create reaches it.
   const internal = runtime as unknown as {
     store: { getSettings: () => Record<string, unknown> }
     resolveTerminalWorkspaceLaunchScope: (selector: string) => Promise<unknown>
-    markWorkspaceTrustedForAgent: () => Promise<void>
   }
   internal.store = { getSettings: () => ({}) }
   vi.spyOn(internal, 'resolveTerminalWorkspaceLaunchScope').mockResolvedValue({
@@ -36,8 +35,6 @@ function runtimeWithAgentLaunch(): {
     repo: null,
     folderWorkspace: null
   })
-  // Trust presets touch the real filesystem and are not what this resolver is being asked about.
-  internal.markWorkspaceTrustedForAgent = async () => undefined
   const spawn = vi.fn().mockResolvedValue({ id: 'pty-1' })
   runtime.setPtyController({
     spawn,
diff --git a/src/main/runtime/agent-transcript-pane-test-harness.ts b/src/main/runtime/agent-transcript-pane-test-harness.ts
index 5f0c20267d9..14ad56a8d9d 100644
--- a/src/main/runtime/agent-transcript-pane-test-harness.ts
+++ b/src/main/runtime/agent-transcript-pane-test-harness.ts
@@ -18,6 +18,8 @@ export type TranscriptPaneOptions = {
   /** Simulates a PTY controller whose foreground probe never settles. */
   foregroundProbeHangs?: boolean
   onForegroundProbe?: () => void
+  /** PTY grid the controller reports; the runtime's emulator otherwise defaults to 80x24. */
+  size?: { cols: number; rows: number }
 }
 
 export async function createTranscriptPane(
@@ -39,6 +41,7 @@ export async function createTranscriptPane(
     spawn: vi.fn().mockResolvedValue({ id: TRANSCRIPT_PANE_PTY_ID, incarnationId: 'inc-1' }),
     write: () => true,
     kill: () => true,
+    getSize: () => options.size ?? null,
     getForegroundProcess: (): Promise<string | null> => {
       options.onForegroundProbe?.()
       return options.foregroundProbeHangs === true
diff --git a/src/main/runtime/agent-transcript-replay-test-harness.ts b/src/main/runtime/agent-transcript-replay-test-harness.ts
new file mode 100644
index 00000000000..5b57656ab4a
--- /dev/null
+++ b/src/main/runtime/agent-transcript-replay-test-harness.ts
@@ -0,0 +1,56 @@
+// Replays captured PTY bytes the way onPtyData does, for suites asserting a rule on every frame.
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { HeadlessEmulator } from '../daemon/headless-emulator'
+import { projectTerminalVisibleLines } from './orca-runtime-terminal-projection'
+import { normalizeTerminalChunk } from './terminal-ansi-normalization'
+import { appendNormalizedToTailBuffer } from './terminal-tail-buffer'
+import { buildPreview } from './terminal-tail-state'
+import { buildTerminalWaitText } from './terminal-wait-tail-state'
+
+const DEFAULT_CHUNK_CHARS = 64
+
+export type TranscriptReplayFrame = { screenLines: string[]; waitText: string }
+
+export function readRuntimeFixture(name: string): string {
+  return readFileSync(join(__dirname, '__fixtures__', `${name}.txt`), 'utf8')
+}
+
+/** A string is cut into fixed 64-char chunks; an array replays the recorded PTY chunks as-is. */
+export async function* replayTranscript(
+  data: string | readonly string[],
+  cols: number,
+  rows: number
+): AsyncGenerator<TranscriptReplayFrame> {
+  const chunks = typeof data === 'string' ? splitIntoChunks(data) : data
+  const emulator = new HeadlessEmulator({ cols, rows })
+  let lines: string[] = []
+  let partialLine = ''
+  let pendingAnsi = ''
+  let redrawCursor: ReturnType<typeof appendNormalizedToTailBuffer>['redrawCursor'] = null
+  try {
+    for (const chunk of chunks) {
+      await emulator.write(chunk)
+      const normalized = normalizeTerminalChunk(chunk, pendingAnsi)
+      pendingAnsi = normalized.pendingAnsi
+      const tail = appendNormalizedToTailBuffer(lines, partialLine, normalized.text, redrawCursor)
+      lines = tail.lines
+      partialLine = tail.partialLine
+      redrawCursor = tail.redrawCursor
+      yield {
+        screenLines: projectTerminalVisibleLines(emulator).lines,
+        waitText: buildTerminalWaitText(lines, partialLine, buildPreview(lines, partialLine))
+      }
+    }
+  } finally {
+    emulator.dispose()
+  }
+}
+
+function splitIntoChunks(data: string): string[] {
+  const chunks: string[] = []
+  for (let offset = 0; offset < data.length; offset += DEFAULT_CHUNK_CHARS) {
+    chunks.push(data.slice(offset, offset + DEFAULT_CHUNK_CHARS))
+  }
+  return chunks
+}
diff --git a/src/main/runtime/automation-change-publication.test.ts b/src/main/runtime/automation-change-publication.test.ts
index 5cde275d5ea..a63d56efb9b 100644
--- a/src/main/runtime/automation-change-publication.test.ts
+++ b/src/main/runtime/automation-change-publication.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 /**
  * A definition change must name the host it affected, and a change that moves a
  * record between hosts must name both — a subscriber that never hears about the
@@ -106,7 +107,7 @@ async function makeRuntime() {
   vi.resetModules()
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  const store = new Store()
+  const store = createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
   const { OrcaRuntimeService } = await import('./orca-runtime')
   const runtime = new OrcaRuntimeService(store as never)
   const published: AutomationsChangedPayload[] = []
@@ -127,14 +128,42 @@ beforeEach(() => {
   })
 })
 
-afterEach(() => {
+afterEach(async () => {
+  await closeTestStores()
   rmSync(testState.dir, { recursive: true, force: true })
 })
 
 describe('scoped automationsChanged publication', () => {
+  it.each(['update', 'delete'] as const)(
+    'waits for durable %s before publishing success',
+    async (operation) => {
+      const { store, runtime, published } = await makeRuntime()
+      const gate = Promise.withResolvers<void>()
+      vi.spyOn(store, 'flushPendingOrThrowAsync').mockReturnValue(gate.promise)
+      const pending =
+        operation === 'update'
+          ? runtime.updateAutomation('local-1', { name: 'Changed' })
+          : runtime.deleteAutomation('local-1')
+      await vi.waitFor(() => expect(store.flushPendingOrThrowAsync).toHaveBeenCalledOnce())
+      expect(published).toEqual([])
+      gate.resolve()
+      await pending
+      expect(published).toHaveLength(1)
+    }
+  )
+
+  it('rejects a failed durable definition write without publishing success', async () => {
+    const { store, runtime, published } = await makeRuntime()
+    vi.spyOn(store, 'flushPendingOrThrowAsync').mockRejectedValue(new Error('disk full'))
+    await expect(runtime.updateAutomation('local-1', { name: 'Changed' })).rejects.toThrow(
+      'disk full'
+    )
+    expect(published).toEqual([])
+  })
+
   it('names the host a delete removed a row from', async () => {
     const { runtime, published } = await makeRuntime()
-    runtime.deleteAutomation('ssh-1-a', {
+    await runtime.deleteAutomation('ssh-1-a', {
       selector: { kind: 'ssh', targetId: 'ssh-1', targetGeneration: 7 }
     })
     expect(published).toEqual([
@@ -144,7 +173,7 @@ describe('scoped automationsChanged publication', () => {
 
   it('names the orphan bucket when an unowned row is deleted', async () => {
     const { runtime, published } = await makeRuntime()
-    runtime.deleteAutomation('orphan-1', { selector: { kind: 'orphan' } })
+    await runtime.deleteAutomation('orphan-1', { selector: { kind: 'orphan' } })
     expect(published).toEqual([{ reason: 'definition', selector: { kind: 'orphan' } }])
   })
 
diff --git a/src/main/runtime/browser-tab-create-publication.test.ts b/src/main/runtime/browser-tab-create-publication.test.ts
index c04c2fbdfee..fd5560751b2 100644
--- a/src/main/runtime/browser-tab-create-publication.test.ts
+++ b/src/main/runtime/browser-tab-create-publication.test.ts
@@ -17,9 +17,7 @@ import {
   publishCreatedBrowserSessionTab,
   publishSwitchedBrowserSessionTab,
   resolveBrowserTabCreateFocus,
-  type BrowserTabCreatePlacementKind,
-  type BrowserTabCreatePublicationHost,
-  type BrowserTabSwitchPlacementKind
+  type BrowserTabCreatePublicationHost
 } from './browser-tab-create-publication'
 
 const { ipcMainOnMock, waitForTabRegistrationMock } = vi.hoisted(() => ({
@@ -99,12 +97,6 @@ function browserCommandsSource(): string {
 }
 
 describe('publishCreatedBrowserSessionTab', () => {
-  it('declares a publication rule for every placement kind', () => {
-    expect(Object.keys(BROWSER_TAB_CREATE_PUBLICATION_RULES).sort()).toEqual(
-      [...BROWSER_TAB_CREATE_PLACEMENT_KINDS].sort()
-    )
-  })
-
   // Why: the per-placement cases below read their expectation off this table, so the table itself
   // needs a literal pin — otherwise dropping a step here would silently rewrite what they assert.
   it('pins the bookkeeping each placement owns', () => {
@@ -150,15 +142,6 @@ describe('publishCreatedBrowserSessionTab', () => {
     }
   })
 
-  it('declares a host row source for every placement kind', () => {
-    for (const placementKind of BROWSER_TAB_CREATE_PLACEMENT_KINDS) {
-      expect(
-        ['create-ipc', 'session-notify', 'none'],
-        `${placementKind} must say where its host tab row comes from`
-      ).toContain(BROWSER_TAB_CREATE_PUBLICATION_RULES[placementKind].hostRowSource)
-    }
-  })
-
   it.each(BROWSER_TAB_CREATE_PLACEMENT_KINDS)(
     'moves a user-created %s tab into the clicked split group when the placement marks focus',
     (placementKind) => {
@@ -312,14 +295,6 @@ describe('browser tab-create activation defaults', () => {
     expect(browserTabCreateClientPageStartsActive(false)).toBe(false)
     expect(browserTabCreateClientPageStartsActive(undefined)).toBe(true)
   })
-
-  it('agrees with the focus rule for every explicit boolean shipped callers send', () => {
-    for (const activate of [true, false]) {
-      expect(browserTabCreateClientPageStartsActive(activate)).toBe(
-        browserTabCreateTakesFocus(activate)
-      )
-    }
-  })
 })
 
 describe('browser tab-create focus resolution', () => {
@@ -549,26 +524,9 @@ describe('browser tab-create placement census', () => {
       })
     })
   })
-
-  it('names every placement kind the command adapter can select', () => {
-    const source = browserCommandsSource()
-    const selected = new Set<BrowserTabCreatePlacementKind>()
-    for (const [, placementKind] of source.matchAll(
-      /publishCreatedBrowserSessionTab\(this\.host, \{\s*placementKind: '([a-z]+)'/g
-    )) {
-      selected.add(placementKind as BrowserTabCreatePlacementKind)
-    }
-    expect([...selected].sort()).toEqual([...BROWSER_TAB_CREATE_PLACEMENT_KINDS].sort())
-  })
 })
 
 describe('publishSwitchedBrowserSessionTab', () => {
-  it('declares a publication rule for every switch placement kind', () => {
-    expect(Object.keys(BROWSER_TAB_SWITCH_PUBLICATION_RULES).sort()).toEqual(
-      [...BROWSER_TAB_SWITCH_PLACEMENT_KINDS].sort()
-    )
-  })
-
   // Why: the cases below read their expectation off this table, so the table needs a literal pin.
   it('pins the bookkeeping each switch placement owns', () => {
     expect(BROWSER_TAB_SWITCH_PUBLICATION_RULES).toEqual({
@@ -656,14 +614,6 @@ describe('browser tab-switch focus rule', () => {
     expect(browserTabSwitchTakesFocus(false)).toBe(false)
     expect(browserTabSwitchTakesFocus(undefined)).toBe(false)
   })
-
-  // Why: switch and create are the two ways a tab becomes the session's active tab; if their
-  // focus gates diverged, the same user intent would move the snapshot on one path only.
-  it('agrees with the create focus rule', () => {
-    for (const intent of [true, false, undefined]) {
-      expect(browserTabSwitchTakesFocus(intent)).toBe(browserTabCreateTakesFocus(intent))
-    }
-  })
 })
 
 describe('browser tab-switch placement census', () => {
@@ -683,17 +633,6 @@ describe('browser tab-switch placement census', () => {
     )
   })
 
-  it('names every switch placement kind the command adapter can select', () => {
-    const source = browserCommandsSource()
-    const selected = new Set<BrowserTabSwitchPlacementKind>()
-    for (const [, placementKind] of source.matchAll(
-      /publishSwitchedBrowserSessionTab\(this\.host, \{\s*placementKind: '([a-z]+)'/g
-    )) {
-      selected.add(placementKind as BrowserTabSwitchPlacementKind)
-    }
-    expect([...selected].sort()).toEqual([...BROWSER_TAB_SWITCH_PLACEMENT_KINDS].sort())
-  })
-
   // Why: the rule-driven cases read their expectation off the table, so each branch also needs
   // its real bookkeeping observed through browserTabSwitch itself.
   describe('through browserTabSwitch', () => {
diff --git a/src/main/runtime/claude-agent-teams-tmux-dispatcher.ts b/src/main/runtime/claude-agent-teams-tmux-dispatcher.ts
index a9a3b4484a8..eb4acb14d5e 100644
--- a/src/main/runtime/claude-agent-teams-tmux-dispatcher.ts
+++ b/src/main/runtime/claude-agent-teams-tmux-dispatcher.ts
@@ -226,7 +226,7 @@ export class ClaudeAgentTeamsTmuxDispatcher {
     const pane = this.resolvePane(team, tmuxValue(parsed, '-t') ?? envPane)
     const text = tmuxSendKeysText(parsed.positional, parsed.flags.has('-l'))
     if (text) {
-      await api.sendTerminal(pane.handle, { text })
+      await api.sendTerminal(pane.handle, { text }, { inputKind: 'driving' })
     }
     return ''
   }
diff --git a/src/main/runtime/claude-agent-teams-types.ts b/src/main/runtime/claude-agent-teams-types.ts
index 10234f5226d..bddfad17d17 100644
--- a/src/main/runtime/claude-agent-teams-types.ts
+++ b/src/main/runtime/claude-agent-teams-types.ts
@@ -6,6 +6,7 @@ import type {
   RuntimeTerminalShow,
   RuntimeTerminalSplit
 } from '../../shared/runtime-types'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 
 export type AgentTeamsTmuxCompatRequest = {
   teamId: string
@@ -43,7 +44,8 @@ export type AgentTeamsTerminalApi = {
   readTerminal(handle: string, opts?: { limit?: number }): Promise<RuntimeTerminalRead>
   sendTerminal(
     handle: string,
-    action: { text?: string; enter?: boolean; interrupt?: boolean }
+    action: { text?: string; enter?: boolean; interrupt?: boolean },
+    options: { inputKind: TerminalInputKind }
   ): Promise<RuntimeTerminalSend>
   focusTerminal(handle: string): Promise<RuntimeTerminalFocus>
   closeTerminal(handle: string): Promise<RuntimeTerminalClose>
diff --git a/src/main/runtime/claude-structured-exit-mid-response.test.ts b/src/main/runtime/claude-structured-exit-mid-response.test.ts
new file mode 100644
index 00000000000..fd30df7dad0
--- /dev/null
+++ b/src/main/runtime/claude-structured-exit-mid-response.test.ts
@@ -0,0 +1,72 @@
+// A Claude CLI that exits on its own after its start landed, with a message handed to it: the chat
+// says Claude stopped, by name. Against the production runtime, adapter, record store and host,
+// with only the CLI process scripted.
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-session-mutation-envelope'
+import { hostTestMessage } from '../native-chat/agent-session-wire/structured-agent-session-host-test-data'
+import type { StructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-host'
+import { waitForStructuredAgentSessionRecovery } from './structured-agent-session-runtime'
+import {
+  createScriptedClaudeRuntime,
+  scriptedClaudeExitError
+} from './structured-claude-scripted-runtime-test-support'
+
+const SESSION = 'claude-exit-mid-response'
+const CALLER = { callerKey: 'client-1' }
+
+let claude = createScriptedClaudeRuntime([SESSION])
+let operations = 0
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  await claude.dispose()
+  claude = createScriptedClaudeRuntime([SESSION])
+})
+
+async function send(host: StructuredAgentSessionHost, text: string): Promise<void> {
+  const body = hostTestMessage(text)
+  const sent = await host.send(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: `${Date.now()}-${(++operations).toString(16).padStart(32, '0')}`,
+      expectedRuntimeFence: host.deps.store.getRecord(SESSION)?.lease.runtimeFence ?? 0,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    },
+    body
+  })
+  expect(sent, JSON.stringify(sent)).toMatchObject({ ok: true })
+}
+
+describe('a started Claude CLI that exits while a response is in progress', () => {
+  it('says Claude stopped, and that the conversation can continue', async () => {
+    const host = await claude.install()
+    await expect(host.attach(CALLER, claude.attachParams(SESSION, null))).resolves.toMatchObject({
+      ok: true
+    })
+    await send(host, 'hello')
+    await vi.waitFor(() => expect(claude.child(SESSION).calls).toContain('send'))
+
+    claude.child(SESSION).exit(scriptedClaudeExitError('claude stream-json exited (code 137)'))
+    await waitForStructuredAgentSessionRecovery()
+
+    await vi.waitFor(async () =>
+      expect(
+        (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+          item.body.kind === 'status' && item.body.failure
+            ? [{ text: item.body.text, kind: item.body.failure.kind }]
+            : []
+        )
+      ).toEqual([
+        {
+          text: 'Claude stopped while this response was in progress. You can continue in this conversation.',
+          kind: 'providerExited'
+        }
+      ])
+    )
+  })
+})
diff --git a/src/main/runtime/claude-structured-failed-start-resume.test.ts b/src/main/runtime/claude-structured-failed-start-resume.test.ts
index 32362cbafdc..cd4f44d59f8 100644
--- a/src/main/runtime/claude-structured-failed-start-resume.test.ts
+++ b/src/main/runtime/claude-structured-failed-start-resume.test.ts
@@ -55,7 +55,7 @@ describe('a Claude chat whose CLI exits the moment it is spawned', () => {
   // Before the spawn returns, the start time of a dead pid is unreadable; during that read, the
   // child is found closed afterwards. Both must answer with what the CLI said.
   it.each(['spawn', 'start-time-read'] as const)(
-    "refuses the create with the CLI's own diagnostic when it exits at %s",
+    "refuses the create in a sentence, not the CLI's diagnostic, when it exits at %s",
     async (at) => {
       const diagnostic = 'claude stream-json exited (code 1): claude: not signed in'
       claude.behave(SESSION, { exitsDuringSpawn: { diagnostic, at } })
@@ -65,7 +65,10 @@ describe('a Claude chat whose CLI exits the moment it is spawned', () => {
 
       expect(created).toMatchObject({
         ok: false,
-        refusal: { message: expect.stringContaining('not signed in'), ownerVerdict: 'exited' }
+        refusal: {
+          message: 'Claude stopped before it finished starting. Send your message to try again.',
+          ownerVerdict: 'exited'
+        }
       })
     }
   )
diff --git a/src/main/runtime/claude-structured-fake-connection-test-fixture.ts b/src/main/runtime/claude-structured-fake-connection-test-fixture.ts
index b64f6980689..3404bcbf283 100644
--- a/src/main/runtime/claude-structured-fake-connection-test-fixture.ts
+++ b/src/main/runtime/claude-structured-fake-connection-test-fixture.ts
@@ -76,7 +76,7 @@ export function fakeClaude(providerSession: string) {
         connection.calls.push({ subtype: 'interrupt', params: {} })
         return undefined
       },
-      cancelAsyncMessage: async () => {},
+      cancelAsyncMessage: async () => false,
       stopTask: async (taskId) => {
         connection.calls.push({ subtype: 'stop_task', params: { taskId } })
       },
diff --git a/src/main/runtime/claude-structured-idle-releases-unknown.test.ts b/src/main/runtime/claude-structured-idle-releases-unknown.test.ts
new file mode 100644
index 00000000000..becdc9f2b38
--- /dev/null
+++ b/src/main/runtime/claude-structured-idle-releases-unknown.test.ts
@@ -0,0 +1,108 @@
+// A Claude send whose write ended in doubt is recorded `unknown`, and a live `unknown` reads as
+// work still owed. The CLI reports `session_state_changed idle` only once its queue has drained,
+// so that report retires the doubt; a send whose dispatch is still `pending` is left alone.
+// Against the production runtime, adapter, record store and host, with only the CLI scripted.
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-session-mutation-envelope'
+import { claudeSessionIdForOrcaSession } from '../claude/claude-structured-launch-resolution'
+import { DISPATCH_DOUBT_WRITE_OUTCOME_UNKNOWN } from '../native-chat/agent-session-journal/journal-dispatch-doubt-reasons'
+import { hostTestMessage } from '../native-chat/agent-session-wire/structured-agent-session-host-test-data'
+import type { StructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-host'
+import { createScriptedClaudeRuntime } from './structured-claude-scripted-runtime-test-support'
+
+const SESSION = 'claude-idle-release'
+const PROVIDER_SESSION = claudeSessionIdForOrcaSession(SESSION)
+const CALLER = { callerKey: 'client-1' }
+
+let claude = createScriptedClaudeRuntime([SESSION])
+let operations = 0
+
+afterEach(async () => {
+  await claude.dispose()
+  claude = createScriptedClaudeRuntime([SESSION])
+})
+
+function fence(host: StructuredAgentSessionHost): number {
+  return host.deps.store.getRecord(SESSION)?.lease.runtimeFence ?? 0
+}
+
+async function send(host: StructuredAgentSessionHost, text: string): Promise<string> {
+  const body = hostTestMessage(text)
+  const sent = await host.send(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: `${Date.now()}-${(++operations).toString(16).padStart(32, '0')}`,
+      expectedRuntimeFence: fence(host),
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    },
+    body
+  })
+  expect(sent, JSON.stringify(sent)).toMatchObject({ ok: true })
+  return sent.ok ? sent.value.clientMessageId : ''
+}
+
+async function submission(host: StructuredAgentSessionHost, clientMessageId: string) {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )
+}
+
+function sessionState(state: 'running' | 'idle'): Record<string, unknown> {
+  return {
+    type: 'system',
+    subtype: 'session_state_changed',
+    state,
+    uuid: `state-${state}`,
+    session_id: PROVIDER_SESSION
+  }
+}
+
+describe('a live Claude chat whose CLI reports idle', () => {
+  it('releases a send whose write ended in doubt, and leaves a pending one alone', async () => {
+    const host = await claude.install()
+    await expect(host.attach(CALLER, claude.attachParams(SESSION, null))).resolves.toMatchObject({
+      ok: true
+    })
+    const child = claude.child(SESSION)
+    // Handed to the SDK, then the write's outcome was lost.
+    child.connection.send = async (_message, beforeDispatch) => {
+      await beforeDispatch?.()
+      throw new Error('stdin write stalled')
+    }
+    const doubted = await send(host, 'first')
+    await vi.waitFor(async () =>
+      expect(await submission(host, doubted)).toMatchObject({ dispatchState: 'unknown' })
+    )
+    // Written, never echoed: its dispatch has returned, but nothing has settled it.
+    child.connection.send = async (_message, beforeDispatch) => {
+      await beforeDispatch?.()
+    }
+    const pending = await send(host, 'second')
+    await vi.waitFor(async () =>
+      expect(await submission(host, pending)).toMatchObject({ dispatchState: 'pending' })
+    )
+
+    child.handlers.onMessage?.(sessionState('running'))
+    await new Promise((resolve) => setTimeout(resolve, 50))
+    // POSITIVE CONTROL: only idle releases it.
+    expect((await submission(host, doubted))?.recovered).toBeUndefined()
+
+    child.handlers.onMessage?.(sessionState('idle'))
+
+    await vi.waitFor(async () =>
+      expect(await submission(host, doubted)).toMatchObject({
+        dispatchState: 'unknown',
+        recovered: true,
+        // The write's own doubt is the sharper fact, so it survives the release.
+        reason: `${DISPATCH_DOUBT_WRITE_OUTCOME_UNKNOWN}: stdin write stalled`
+      })
+    )
+    expect(await submission(host, pending)).toMatchObject({ dispatchState: 'pending' })
+    expect((await submission(host, pending))?.recovered).toBeUndefined()
+  })
+})
diff --git a/src/main/runtime/claude-structured-resumed-start-failure.test.ts b/src/main/runtime/claude-structured-resumed-start-failure.test.ts
index 8fcef7e4a48..7a0c66e1b85 100644
--- a/src/main/runtime/claude-structured-resumed-start-failure.test.ts
+++ b/src/main/runtime/claude-structured-resumed-start-failure.test.ts
@@ -7,11 +7,15 @@ import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-sessio
 import type { AgentSessionSubscribeEvent } from '../../shared/agent-session-wire'
 import { hostTestMessage } from '../native-chat/agent-session-wire/structured-agent-session-host-test-data'
 import { waitForStructuredAgentSessionRecovery } from './structured-agent-session-runtime'
-import { createScriptedClaudeRuntime } from './structured-claude-scripted-runtime-test-support'
+import {
+  createScriptedClaudeRuntime,
+  scriptedClaudeExitError
+} from './structured-claude-scripted-runtime-test-support'
 
 const SESSION = 'claude-resumed-start'
 const CALLER = { callerKey: 'client-1' }
 const DIAGNOSTIC = 'claude stream-json exited (code 1): claude: not signed in'
+const STARTUP_TEXT = 'Claude stopped before it finished starting. Send your message to try again.'
 
 let claude = createScriptedClaudeRuntime([SESSION])
 
@@ -38,11 +42,11 @@ describe('a reopened Claude chat whose CLI dies before initialize', () => {
     await waitForStructuredAgentSessionRecovery()
     await host.close(SESSION)
 
-    // The user reopens it; this time the CLI never answers, then dies, and its tree is unprovable.
+    // The user reopens it and sends; this time the CLI never answers, then dies, and its tree is
+    // unprovable. Opening starts nothing: the send does.
     claude.behave(SESSION, { initHangs: true, closeUnproven: true })
-    await host.hold(SESSION, 'surface-1')
     const events: AgentSessionSubscribeEvent[] = []
-    host.subscribe({ id: 'sub-1', sessionId: SESSION, emit: (event) => events.push(event) })
+    await host.subscribe({ id: 'sub-1', sessionId: SESSION, emit: (event) => events.push(event) })
     const body = hostTestMessage('hello')
     const fence = host.deps.store.getRecord(SESSION)?.lease.runtimeFence ?? 0
     const sent = await host.send(CALLER, {
@@ -59,21 +63,22 @@ describe('a reopened Claude chat whose CLI dies before initialize', () => {
       body
     })
     expect(sent).toMatchObject({ ok: true, value: { submission: { dispatchState: 'pending' } } })
+    // Accepted first; the delivery loop starts the second child after.
+    await vi.waitFor(() => expect(claude.children(SESSION)).toHaveLength(2))
 
-    claude.child(SESSION).exit(new Error(DIAGNOSTIC))
+    claude.child(SESSION).exit(scriptedClaudeExitError(DIAGNOSTIC))
     await waitForStructuredAgentSessionRecovery()
 
-    await vi.waitFor(() =>
-      expect(statusTexts(events)).toContainEqual(
-        expect.stringMatching(/stopped before it finished starting: .*not signed in/)
-      )
-    )
+    await vi.waitFor(() => expect(statusTexts(events)).toContainEqual(STARTUP_TEXT))
     // Never written, so it did not happen: refused, not left in doubt.
-    const submission = host
-      .journalSnapshot(SESSION)
-      .submissions.find(
-        (entry) => entry.clientMessageId === (sent.ok && sent.value.clientMessageId)
-      )
-    expect(submission).toMatchObject({ dispatchState: 'rejected' })
+    const submission = (await host.journalSnapshot(SESSION)).submissions.find(
+      (entry) => entry.clientMessageId === (sent.ok && sent.value.clientMessageId)
+    )
+    // The stderr the exit carried is beside the sentence, as a log detail, and never in it.
+    expect(submission).toMatchObject({
+      dispatchState: 'rejected',
+      reason: STARTUP_TEXT,
+      rejection: { kind: 'providerStartFailed', detail: { text: DIAGNOSTIC, audience: 'log' } }
+    })
   })
 })
diff --git a/src/main/runtime/claude-structured-send-held-for-startup.test.ts b/src/main/runtime/claude-structured-send-held-for-startup.test.ts
index 19e05811055..efb8d3cde16 100644
--- a/src/main/runtime/claude-structured-send-held-for-startup.test.ts
+++ b/src/main/runtime/claude-structured-send-held-for-startup.test.ts
@@ -1,8 +1,8 @@
 // A Claude chat is published the moment its child spawns, before the CLI has answered initialize.
-// A send in that window — into a fresh start, or into the restart a send itself asked for after
-// a start that failed — is admitted and held until the child proves its start. When the CLI dies
-// first, the held message is rejected with the CLI's own diagnostic, the chat shows the cause
-// once, and nothing is left as a delivery nobody can confirm. Against the production runtime,
+// A send in that window — into a fresh start, or into the restart the delivery loop makes for a
+// send after a start that failed — is accepted and stays queued until the child proves its start.
+// When the CLI dies first, the queued message is rejected with the CLI's own diagnostic, the chat
+// shows the cause once, and nothing is left as a delivery nobody can confirm. Against the production runtime,
 // adapter, record store and host, with only the CLI process scripted.
 
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -10,11 +10,15 @@ import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-sessio
 import { hostTestMessage } from '../native-chat/agent-session-wire/structured-agent-session-host-test-data'
 import type { StructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-host'
 import { waitForStructuredAgentSessionRecovery } from './structured-agent-session-runtime'
-import { createScriptedClaudeRuntime } from './structured-claude-scripted-runtime-test-support'
+import {
+  createScriptedClaudeRuntime,
+  scriptedClaudeExitError
+} from './structured-claude-scripted-runtime-test-support'
 
 const SESSION = 'claude-send-held'
 const CALLER = { callerKey: 'client-1' }
 const DIAGNOSTIC = 'claude stream-json exited (code 1): claude: not signed in (rig)'
+const STARTUP_TEXT = 'Claude stopped before it finished starting. Send your message to try again.'
 
 let claude = createScriptedClaudeRuntime([SESSION])
 let operations = 0
@@ -39,7 +43,7 @@ async function send(host: StructuredAgentSessionHost, text: string): Promise<str
     },
     body
   })
-  // Admitted and held for the start, never refused: the message shows as sent.
+  // Accepted and queued for the start, never refused: the message shows as sent.
   expect(sent, JSON.stringify(sent)).toMatchObject({
     ok: true,
     replayed: false,
@@ -52,22 +56,22 @@ function fence(host: StructuredAgentSessionHost): number {
   return host.deps.store.getRecord(SESSION)?.lease.runtimeFence ?? 0
 }
 
-function statusRows(host: StructuredAgentSessionHost): string[] {
-  return host
-    .journalSnapshot(SESSION)
-    .items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
+async function statusRows(host: StructuredAgentSessionHost): Promise<string[]> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status' ? [item.body.text] : []
+  )
 }
 
-function submission(host: StructuredAgentSessionHost, clientMessageId: string) {
-  return host
-    .journalSnapshot(SESSION)
-    .submissions.find((entry) => entry.clientMessageId === clientMessageId)
+async function submission(host: StructuredAgentSessionHost, clientMessageId: string) {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )
 }
 
 /** The CLI keeps dying at startup: the latest child exits with the diagnostic once it exists. */
 async function failLatestStart(host: StructuredAgentSessionHost, count: number): Promise<void> {
   await vi.waitFor(() => expect(claude.children(SESSION)).toHaveLength(count))
-  claude.child(SESSION).exit(new Error(DIAGNOSTIC))
+  claude.child(SESSION).exit(scriptedClaudeExitError(DIAGNOSTIC))
   await waitForStructuredAgentSessionRecovery()
   await vi.waitFor(() =>
     expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
@@ -82,27 +86,28 @@ describe('a send into a Claude chat whose CLI keeps failing at startup', () => {
       ok: true
     })
     await failLatestStart(host, 1)
-    expect(statusRows(host)).toEqual([expect.stringContaining('not signed in')])
+    expect(await statusRows(host)).toEqual([STARTUP_TEXT])
     const releasedFence = fence(host)
 
-    // The send asks for the child back and is held for its start; the CLI dies again first.
+    // The delivery loop asks for the child back and the message waits for its start; the CLI
+    // dies again first.
     const held = await send(host, 'hello?')
-    expect(claude.children(SESSION)).toHaveLength(2)
-    expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
+    await vi.waitFor(() => expect(claude.children(SESSION)).toHaveLength(2))
+    await vi.waitFor(() =>
+      expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
+    )
     await failLatestStart(host, 2)
 
     // Rejected with the cause, not left in doubt; one row for this attempt names it.
-    await vi.waitFor(() =>
-      expect(submission(host, held)).toMatchObject({
+    await vi.waitFor(async () =>
+      expect(await submission(host, held)).toMatchObject({
         dispatchState: 'rejected',
         // Worded for the user: the red line under the composer shows it as it stands.
-        reason: `The provider stopped before it finished starting: ${DIAGNOSTIC}.`
+        reason: STARTUP_TEXT,
+        rejection: { kind: 'providerStartFailed' }
       })
     )
-    expect(statusRows(host)).toEqual([
-      expect.stringContaining('not signed in'),
-      expect.stringMatching(/stopped before it finished starting: .*not signed in \(rig\)/)
-    ])
+    expect(await statusRows(host)).toEqual([STARTUP_TEXT, STARTUP_TEXT])
     // The restart moved the fence twice: its acquisition, and the exit that released it.
     expect(fence(host)).toBe(releasedFence + 2)
     expect(claude.children(SESSION)).toHaveLength(2)
@@ -111,18 +116,18 @@ describe('a send into a Claude chat whose CLI keeps failing at startup', () => {
     // The user signs in and retries: one restart, proven, written to the CLI.
     claude.behave(SESSION, {})
     await send(host, 'hello again')
-    expect(claude.children(SESSION)).toHaveLength(3)
-    expect(fence(host)).toBe(releasedFence + 3)
+    await vi.waitFor(() => expect(claude.children(SESSION)).toHaveLength(3))
+    await vi.waitFor(() => expect(fence(host)).toBe(releasedFence + 3))
     await vi.waitFor(() => expect(claude.child(SESSION).calls).toContain('send'))
     await vi.waitFor(() =>
       expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
     )
-    expect(statusRows(host)).toHaveLength(2)
+    expect(await statusRows(host)).toHaveLength(2)
   })
 })
 
 describe('a send while the first Claude start is still answering initialize', () => {
-  it('is held, and written once the CLI proves its start', async () => {
+  it('is queued, and written once the CLI proves its start', async () => {
     claude.behave(SESSION, { initHangs: true })
     const host = await claude.install()
     await host.attach(CALLER, claude.attachParams(SESSION, null))
@@ -130,12 +135,12 @@ describe('a send while the first Claude start is still answering initialize', ()
     await send(host, 'hello')
     expect(claude.child(SESSION).calls).not.toContain('send')
 
-    // The CLI answers: startup lands and the held message is written to the proven child.
+    // The CLI answers: startup lands and the queued message is written to the proven child.
     claude.child(SESSION).answerInit()
 
     await vi.waitFor(() => expect(claude.child(SESSION).calls).toContain('send'))
     expect(claude.children(SESSION)).toHaveLength(1)
-    expect(statusRows(host)).toEqual([])
+    expect(await statusRows(host)).toEqual([])
   })
 
   it('is rejected with the diagnostic when the CLI dies first, and restarts nothing', async () => {
@@ -147,16 +152,15 @@ describe('a send while the first Claude start is still answering initialize', ()
     const held = await send(host, 'hello')
     await failLatestStart(host, 1)
 
-    await vi.waitFor(() =>
-      expect(submission(host, held)).toMatchObject({
+    await vi.waitFor(async () =>
+      expect(await submission(host, held)).toMatchObject({
         dispatchState: 'rejected',
         // Worded for the user: the red line under the composer shows it as it stands.
-        reason: `The provider stopped before it finished starting: ${DIAGNOSTIC}.`
+        reason: STARTUP_TEXT,
+        rejection: { kind: 'providerStartFailed' }
       })
     )
-    expect(statusRows(host)).toEqual([
-      expect.stringMatching(/stopped before it finished starting: .*not signed in \(rig\)/)
-    ])
+    expect(await statusRows(host)).toEqual([STARTUP_TEXT])
     expect(fence(host)).toBe(startedFence + 1)
     expect(claude.children(SESSION)).toHaveLength(1)
     expect(claude.child(SESSION).calls).not.toContain('send')
diff --git a/src/main/runtime/claude-structured-send-restart-dies-before-dispatch.test.ts b/src/main/runtime/claude-structured-send-restart-dies-before-dispatch.test.ts
index 0d4b4909637..c5b21f9027f 100644
--- a/src/main/runtime/claude-structured-send-restart-dies-before-dispatch.test.ts
+++ b/src/main/runtime/claude-structured-send-restart-dies-before-dispatch.test.ts
@@ -1,10 +1,9 @@
-// A send restarts a chat's Claude child and is admitted against it while it is still starting.
-// When that child dies before the send's dispatch reaches the adapter, the adapter has no session
-// to hold the message for, so the dispatch throws. A child that never proved its start accepted
-// nothing — input is only written after initialize — so the send settles `rejected` with the
-// child's own diagnostic, never as a delivery nobody can confirm, and a client that was
-// subscribed the whole time receives the failure row and the rejected submission over the wire.
-// Against the production runtime, adapter, record store and host, with only the CLI scripted.
+// A send is accepted into a chat whose Claude child is gone, and its delivery restarts the child.
+// When that child dies before it proves its start, the message was never handed to it — delivery
+// waits for the start — so the send settles `rejected` with the child's own diagnostic, never as a
+// delivery nobody can confirm, and a client that was subscribed the whole time receives the
+// failure row and the rejected submission over the wire. Against the production runtime, adapter,
+// record store and host, with only the CLI scripted.
 
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-session-mutation-envelope'
@@ -12,11 +11,20 @@ import type { AgentSessionSubscribeEvent } from '../../shared/agent-session-wire
 import { hostTestMessage } from '../native-chat/agent-session-wire/structured-agent-session-host-test-data'
 import type { StructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-host'
 import { waitForStructuredAgentSessionRecovery } from './structured-agent-session-runtime'
-import { createScriptedClaudeRuntime } from './structured-claude-scripted-runtime-test-support'
+import {
+  createScriptedClaudeRuntime,
+  scriptedClaudeExitError
+} from './structured-claude-scripted-runtime-test-support'
 
 const SESSION = 'claude-send-restart-dies-first'
 const CALLER = { callerKey: 'client-1' }
 const DIAGNOSTIC = 'claude stream-json exited (code 1): claude: not signed in (rig)'
+const STARTUP_TEXT = 'Claude stopped before it finished starting. Send your message to try again.'
+
+/** Delivery runs on its own serialized steps; under a loaded runner they take more than a second. */
+function eventually(assertion: () => unknown): Promise<unknown> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
 
 let claude = createScriptedClaudeRuntime([SESSION])
 let operations = 0
@@ -67,41 +75,31 @@ async function send(host: StructuredAgentSessionHost, text: string): Promise<str
     body
   })
   expect(sent, JSON.stringify(sent)).toMatchObject({ ok: true, replayed: false })
-  if (sent.ok) {
+  if (sent.ok && 'submission' in sent.value) {
     answered.set(clientOperationId, sent.value.submission.dispatchState)
   }
   return clientOperationId
 }
 
-function statusRows(host: StructuredAgentSessionHost): string[] {
-  return host
-    .journalSnapshot(SESSION)
-    .items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
-}
-
-function submission(host: StructuredAgentSessionHost, clientMessageId: string) {
-  return host
-    .journalSnapshot(SESSION)
-    .submissions.find((entry) => entry.clientMessageId === clientMessageId)
-}
-
-async function failLatestStart(host: StructuredAgentSessionHost, count: number): Promise<void> {
-  await vi.waitFor(() => expect(claude.children(SESSION)).toHaveLength(count))
-  claude.child(SESSION).exit(new Error(DIAGNOSTIC))
-  await waitForStructuredAgentSessionRecovery()
-  await vi.waitFor(() =>
-    expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
+async function statusRows(host: StructuredAgentSessionHost): Promise<string[]> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status' ? [item.body.text] : []
   )
 }
 
-/** The restarted child dies the instant the send's dispatch reaches the adapter. */
-function killChildAtDispatch(host: StructuredAgentSessionHost): void {
-  const adapter = host.deps.adapter
-  const dispatch = adapter.dispatch.bind(adapter)
-  vi.spyOn(adapter, 'dispatch').mockImplementationOnce((input) => {
-    claude.child(SESSION).exit(new Error(DIAGNOSTIC))
-    return dispatch(input)
-  })
+async function submission(host: StructuredAgentSessionHost, clientMessageId: string) {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )
+}
+
+async function failLatestStart(host: StructuredAgentSessionHost, count: number): Promise<void> {
+  await eventually(() => expect(claude.children(SESSION)).toHaveLength(count))
+  claude.child(SESSION).exit(scriptedClaudeExitError(DIAGNOSTIC))
+  await waitForStructuredAgentSessionRecovery()
+  await eventually(() =>
+    expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
+  )
 }
 
 /** Everything a subscriber received, flattened to the rows and submissions it was shown. */
@@ -129,7 +127,7 @@ function received(events: AgentSessionSubscribeEvent[]) {
   return { statusTexts, submissions, fences }
 }
 
-describe('a send whose restarted Claude child dies before the dispatch reaches the adapter', () => {
+describe('a send whose restarted Claude child dies before it proves its start', () => {
   it('settles rejected with the diagnostic, keeps one failure row, and a Retry is one new attempt', async () => {
     claude.behave(SESSION, { initHangs: true })
     const host = await claude.install()
@@ -139,28 +137,21 @@ describe('a send whose restarted Claude child dies before the dispatch reaches t
     await failLatestStart(host, 1)
     const releasedFence = fence(host)
 
-    killChildAtDispatch(host)
     const sent = await send(host, 'hello?')
-    // The send's own answer already says it was not delivered; it does not wait for the exit.
-    expect(answered.get(sent)).toBe('rejected')
-    expect(claude.children(SESSION)).toHaveLength(2)
-    await waitForStructuredAgentSessionRecovery()
-    await vi.waitFor(() =>
-      expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
-    )
+    // Accepted: the answer comes before the restart it needs.
+    expect(answered.get(sent)).toBe('pending')
+    await failLatestStart(host, 2)
 
     // Provably not delivered, with the cause; not "unconfirmed".
-    await vi.waitFor(() =>
-      expect(submission(host, sent)).toMatchObject({
+    await eventually(async () =>
+      expect(await submission(host, sent)).toMatchObject({
         dispatchState: 'rejected',
         // Worded for the user: the red line under the composer shows it as it stands.
-        reason: `The provider stopped before it finished starting: ${DIAGNOSTIC}.`
+        reason: STARTUP_TEXT,
+        rejection: { kind: 'providerStartFailed' }
       })
     )
-    expect(statusRows(host)).toEqual([
-      expect.stringContaining('not signed in'),
-      expect.stringMatching(/stopped before it finished starting: .*not signed in \(rig\)/)
-    ])
+    expect(await statusRows(host)).toEqual([STARTUP_TEXT, STARTUP_TEXT])
     expect(fence(host)).toBe(releasedFence + 2)
     expect(claude.children(SESSION)).toHaveLength(2)
     expect(claude.child(SESSION).calls).not.toContain('send')
@@ -168,40 +159,14 @@ describe('a send whose restarted Claude child dies before the dispatch reaches t
     // Retry under a new id: one restart, and once the CLI is healthy the message is written.
     claude.behave(SESSION, {})
     await send(host, 'hello again')
-    expect(claude.children(SESSION)).toHaveLength(3)
-    await vi.waitFor(() => expect(claude.child(SESSION).calls).toContain('send'))
+    await eventually(() => expect(claude.children(SESSION)).toHaveLength(3))
+    await eventually(() => expect(claude.child(SESSION).calls).toContain('send'))
     expect(claude.child(SESSION).calls.filter((call) => call === 'send')).toHaveLength(1)
-    expect(statusRows(host)).toHaveLength(2)
-  })
-
-  it('names the diagnostic even when the exit was fully processed before the dispatch arrived', async () => {
-    claude.behave(SESSION, { initHangs: true })
-    const host = await claude.install()
-    await expect(host.attach(CALLER, claude.attachParams(SESSION, null))).resolves.toMatchObject({
-      ok: true
-    })
-    await failLatestStart(host, 1)
-    const adapter = host.deps.adapter
-    const dispatch = adapter.dispatch.bind(adapter)
-    vi.spyOn(adapter, 'dispatch').mockImplementationOnce(async (input) => {
-      claude.child(SESSION).exit(new Error(DIAGNOSTIC))
-      // The adapter settles and publishes the exit; the host's own settlement waits behind this send.
-      await new Promise((resolve) => setTimeout(resolve, 300))
-      return dispatch(input)
-    })
-
-    const sent = await send(host, 'hello?')
-    expect(answered.get(sent)).toBe('rejected')
-    await waitForStructuredAgentSessionRecovery()
-    expect(submission(host, sent)).toMatchObject({
-      dispatchState: 'rejected',
-      reason: `The provider stopped before it finished starting: ${DIAGNOSTIC}.`
-    })
-    expect(statusRows(host)).toHaveLength(2)
+    expect(await statusRows(host)).toHaveLength(2)
   })
 
   // A restart refused because its child died before it was handed over leaves one row, from the
-  // send, in the words any failed start uses.
+  // delivery, in the words any failed start uses, and rejects the message with them.
   it.each(['spawn', 'start-time-read'] as const)(
     'leaves one row for a restart whose child exits at %s',
     async (at) => {
@@ -213,16 +178,17 @@ describe('a send whose restarted Claude child dies before the dispatch reaches t
       await failLatestStart(host, 1)
 
       claude.behave(SESSION, { exitsDuringSpawn: { diagnostic: DIAGNOSTIC, at } })
-      await expect(attempt(host, 'hello?')).resolves.toMatchObject({
-        ok: false,
-        refusal: { code: 'agent_session_owner_restart_failed' }
-      })
+      const sent = await send(host, 'hello?')
+      await eventually(async () =>
+        expect(await submission(host, sent)).toMatchObject({
+          dispatchState: 'rejected',
+          reason: STARTUP_TEXT,
+          rejection: { kind: 'providerStartFailed' }
+        })
+      )
       await waitForStructuredAgentSessionRecovery()
 
-      expect(statusRows(host)).toEqual([
-        `The provider stopped before it finished starting: ${DIAGNOSTIC}.`,
-        `The provider stopped before it finished starting: ${DIAGNOSTIC}.`
-      ])
+      expect(await statusRows(host)).toEqual([STARTUP_TEXT, STARTUP_TEXT])
     }
   )
 
@@ -233,7 +199,7 @@ describe('a send whose restarted Claude child dies before the dispatch reaches t
       ok: true
     })
     const events: AgentSessionSubscribeEvent[] = []
-    const unsubscribe = host.subscribe({
+    const unsubscribe = await host.subscribe({
       id: 'pane',
       sessionId: SESSION,
       emit: (event) => {
@@ -242,19 +208,13 @@ describe('a send whose restarted Claude child dies before the dispatch reaches t
     })
     try {
       await failLatestStart(host, 1)
-      killChildAtDispatch(host)
       const sent = await send(host, 'hello?')
-      await waitForStructuredAgentSessionRecovery()
-      await vi.waitFor(() =>
-        expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
-      )
+      await failLatestStart(host, 2)
 
-      await vi.waitFor(() => {
+      await eventually(() => {
         const seen = received(events)
         expect(seen.submissions.get(sent)).toBe('rejected')
-        expect(seen.statusTexts).toContainEqual(
-          expect.stringMatching(/stopped before it finished starting: .*not signed in \(rig\)/)
-        )
+        expect(seen.statusTexts).toContainEqual(STARTUP_TEXT)
         // The subscriber ended up on the fence the exit published, not the one the restart did.
         expect(seen.fences.at(-1)).toBe(fence(host))
       })
@@ -265,8 +225,8 @@ describe('a send whose restarted Claude child dies before the dispatch reaches t
 })
 
 describe('a chat whose Claude CLI keeps failing to start, seen by a subscriber open throughout', () => {
-  const STARTUP_FAILURE =
-    'The provider stopped before it finished starting: claude stream-json exited (code 1): claude: not signed in (rig).'
+  // The stderr rides beside the sentence as a log detail; the sentence is the same every time.
+  const STARTUP_FAILURE = STARTUP_TEXT
 
   /** Status rows a subscriber has been shown, one per row whatever frame carried it. */
   function shownRows(events: AgentSessionSubscribeEvent[]): Map<string, string> {
@@ -285,14 +245,14 @@ describe('a chat whose Claude CLI keeps failing to start, seen by a subscriber o
     return rows
   }
 
-  it('shows one row naming the cause per failed attempt, admitted or refused, and none once the CLI is fixed', async () => {
+  it('shows one row naming the cause per failed attempt, however the start died, and none once the CLI is fixed', async () => {
     claude.behave(SESSION, { initHangs: true })
     const host = await claude.install()
     const events: AgentSessionSubscribeEvent[] = []
     await expect(host.attach(CALLER, claude.attachParams(SESSION, null))).resolves.toMatchObject({
       ok: true
     })
-    const unsubscribe = host.subscribe({
+    const unsubscribe = await host.subscribe({
       id: 'pane',
       sessionId: SESSION,
       emit: (event) => {
@@ -301,37 +261,38 @@ describe('a chat whose Claude CLI keeps failing to start, seen by a subscriber o
     })
     try {
       await failLatestStart(host, 1)
-      await vi.waitFor(() => expect([...shownRows(events).values()]).toEqual([STARTUP_FAILURE]))
+      await eventually(() => expect([...shownRows(events).values()]).toEqual([STARTUP_FAILURE]))
 
-      // Send: admitted against the restarted child, which dies before starting.
-      killChildAtDispatch(host)
-      const sent = await attempt(host, 'hello?')
-      await waitForStructuredAgentSessionRecovery()
-      expect(sent).toMatchObject({
-        ok: true,
-        value: { submission: { dispatchState: 'rejected', reason: STARTUP_FAILURE } }
-      })
-      await vi.waitFor(() =>
+      // Send: accepted, and its delivery restarts the child, which dies before starting.
+      const sent = await send(host, 'hello?')
+      await failLatestStart(host, 2)
+      await eventually(async () =>
+        expect(await submission(host, sent)).toMatchObject({
+          dispatchState: 'rejected',
+          reason: STARTUP_FAILURE
+        })
+      )
+      await eventually(() =>
         expect([...shownRows(events).values()]).toEqual([STARTUP_FAILURE, STARTUP_FAILURE])
       )
 
-      // Retry while still broken: this restart dies before its child is handed over, so the send
-      // is refused before admission. Still one row, saying the same thing.
+      // Retry while still broken: this restart dies before its child is handed over, so the
+      // delivery's start is refused. Still one row, saying the same thing, on the rejected message.
       claude.behave(SESSION, {
         exitsDuringSpawn: {
           diagnostic: 'claude stream-json exited (code 1): claude: not signed in (rig)',
           at: 'start-time-read'
         }
       })
-      await expect(attempt(host, 'hello?')).resolves.toMatchObject({
-        ok: false,
-        refusal: {
-          code: 'agent_session_owner_restart_failed',
-          message: expect.stringMatching(/couldn't restart: .*not signed in \(rig\)/)
-        }
-      })
+      const retried = await send(host, 'hello?')
+      await eventually(async () =>
+        expect(await submission(host, retried)).toMatchObject({
+          dispatchState: 'rejected',
+          reason: STARTUP_FAILURE
+        })
+      )
       await waitForStructuredAgentSessionRecovery()
-      await vi.waitFor(() =>
+      await eventually(() =>
         expect([...shownRows(events).values()]).toEqual([
           STARTUP_FAILURE,
           STARTUP_FAILURE,
@@ -342,7 +303,7 @@ describe('a chat whose Claude CLI keeps failing to start, seen by a subscriber o
       // The CLI is fixed: Retry delivers and adds no row.
       claude.behave(SESSION, {})
       await expect(attempt(host, 'hello?')).resolves.toMatchObject({ ok: true })
-      await vi.waitFor(() => expect(claude.child(SESSION).calls).toContain('send'))
+      await eventually(() => expect(claude.child(SESSION).calls).toContain('send'))
       expect(shownRows(events).size).toBe(3)
     } finally {
       unsubscribe()
diff --git a/src/main/runtime/claude-structured-session-integration.test.ts b/src/main/runtime/claude-structured-session-integration.test.ts
index 480720da93b..82db5d6c542 100644
--- a/src/main/runtime/claude-structured-session-integration.test.ts
+++ b/src/main/runtime/claude-structured-session-integration.test.ts
@@ -349,6 +349,7 @@ describe('a structured Claude session over agentSession.*', () => {
   })
 
   it('leaves unlisted shell exports out when inheritance is off', async () => {
+    vi.stubEnv('CODEX_LB_API_KEY', undefined)
     shellEnv = { ...shellEnv, CODEX_LB_API_KEY: 'shell-exported', LISTED_ONLY: 'yes' }
     shellEnvironmentPolicy = { inheritAll: false, names: ['LISTED_ONLY'] }
 
@@ -363,9 +364,28 @@ describe('a structured Claude session over agentSession.*', () => {
     claudeAuthPolicy = { stripAuthEnv: true }
     // The default overlay carries ANTHROPIC_AUTH_TOKEN, which the terminal path
     // refuses at spawn-env.ts:25 rather than letting it beat the pinned account.
-    const refused = await call('agentSession.create', createIntentParams())
+    const params = createIntentParams()
+    const sentence =
+      'This Claude launch sets its own Anthropic sign-in variables. Remove them to use a managed Claude account.'
+    const refused = await call('agentSession.create', params)
 
-    expect(JSON.stringify(refused)).toContain('explicit Anthropic auth environment')
+    // The thrown answer keeps its wire code; only its words are the ones its replay reads.
+    expect(refused).toMatchObject({
+      ok: false,
+      error: { code: 'runtime_error', message: sentence }
+    })
+    // Its replay reads the same sentence, beside the situation it names.
+    expect(await call('agentSession.create', params)).toMatchObject({
+      ok: true,
+      result: {
+        ok: false,
+        refusal: {
+          code: 'agent_session_operation_invalid',
+          details: { reason: 'managedAccountEnvOverride' },
+          message: sentence
+        }
+      }
+    })
     // Refused before spawn: no provider child was ever opened.
     expect(claude.connections).toHaveLength(0)
   })
@@ -378,51 +398,56 @@ describe('a structured Claude session over agentSession.*', () => {
     await waitForStructuredAgentSessionRecovery()
 
     const guidance = itemsOf(await subscribe()).find((item) => item.body?.kind === 'status')
+    // The adapter typed the refusal, so the row names the situation rather than quoting Orca.
     expect(guidance?.body).toMatchObject({
       kind: 'status',
-      text: expect.stringMatching(
-        /stopped before it finished starting: .*not signed in.*Claude CLI.*CLAUDE_CONFIG_DIR/s
-      )
+      text: 'Claude is not signed in for the selected account. Sign in, then send your message again.',
+      failure: { kind: 'notSignedIn' }
     })
     expect(leaseOf(SESSION)).toMatchObject({ claimStatus: 'released', handoffStage: null })
     // A failed start is not auto-resumed into the same failure.
     expect(claude.connections).toHaveLength(1)
   })
 
-  it('releases a session whose CLI self-exited during create, with its diagnostic intact', async () => {
-    claude.setSelfExit({
-      message: 'claude stream-json exited (code 1): claude: not signed in',
-      // The root's death is first-hand; its descendants were never snapshottable.
-      exitVerdict: { root: 'exited', tree: 'unverifiable' }
-    })
+  // The root's death is first-hand. Its descendants were never snapshottable, or one was seen
+  // alive; either way the lease follows the root, so the reservation goes with it.
+  it.each(['unverifiable', 'live'] as const)(
+    'releases a session whose CLI self-exited during create with its tree %s, refused in a sentence',
+    async (tree) => {
+      claude.setSelfExit({
+        message: 'claude stream-json exited (code 1): claude: not signed in',
+        exitVerdict: { root: 'exited', tree }
+      })
 
-    const failed = await call('agentSession.create', createIntentParams())
+      const failed = await call('agentSession.create', createIntentParams())
 
-    // Answered once, as the refusal a replay of this operation gives, never thrown first.
-    expect(failed).toMatchObject({
-      ok: true,
-      result: {
-        ok: false,
-        refusal: {
-          code: 'agent_session_operation_invalid',
-          message: expect.stringContaining('claude: not signed in'),
-          ownerVerdict: 'exited'
+      // Answered once, as the refusal a replay of this operation gives, never thrown first.
+      expect(failed).toMatchObject({
+        ok: true,
+        result: {
+          ok: false,
+          refusal: {
+            code: 'agent_session_operation_invalid',
+            // The CLI's stderr is log text; the person reads what the chat's start failure says.
+            message: 'Claude stopped before it finished starting. Send your message to try again.',
+            ownerVerdict: 'exited'
+          }
         }
-      }
-    })
-    const lease = leaseOf(SESSION)
-    // Latching here would refuse every later attach with agent_session_ownership_unknown,
-    // wedging a user who only needs to sign in.
-    expect(lease).toMatchObject({ claimStatus: 'released', handoffStage: null })
-    expect(lease.deathEvidence).toMatchObject({
-      kind: 'exit-observed',
-      detail: 'the provider process exited; its descendants were not verifiable'
-    })
+      })
+      const lease = leaseOf(SESSION)
+      // Latching here would refuse every later attach with agent_session_ownership_unknown,
+      // wedging a user who only needs to sign in.
+      expect(lease).toMatchObject({ claimStatus: 'released', handoffStage: null })
+      expect(lease.deathEvidence).toMatchObject({
+        kind: 'exit-observed',
+        detail: 'the provider process exited; its descendants were not proven gone'
+      })
 
-    claude.setSelfExit(null)
-    // Signing in and reopening the chat works: the reservation was not latched.
-    await ok<{ fence: number }>('agentSession.ensure', ensureParams(lease.runtimeFence))
-  })
+      claude.setSelfExit(null)
+      // Signing in and reopening the chat works: the reservation was not latched.
+      await ok<{ fence: number }>('agentSession.ensure', ensureParams(lease.runtimeFence))
+    }
+  )
 
   it('answers a create whose whole CLI tree exited as exited on the first call', async () => {
     claude.setSelfExit({
@@ -439,7 +464,7 @@ describe('a structured Claude session over agentSession.*', () => {
         ok: false,
         refusal: {
           code: 'agent_session_operation_invalid',
-          message: expect.stringContaining('claude: not signed in'),
+          message: 'Claude stopped before it finished starting. Send your message to try again.',
           ownerVerdict: 'exited'
         }
       }
@@ -448,42 +473,52 @@ describe('a structured Claude session over agentSession.*', () => {
     claude.setSelfExit(null)
   })
 
-  it('keeps a session reserved when a descendant of the failed start was seen alive', async () => {
+  it('releases a failed start that recorded no owner without claiming it exited', async () => {
     claude.setSelfExit({
       message: 'claude stream-json exited (code 1): claude: not signed in',
-      exitVerdict: { root: 'exited', tree: 'live' }
+      // The root was never seen to exit, so nothing proves this start's process gone.
+      exitVerdict: { root: 'live', tree: 'unverifiable' }
     })
 
     await call('agentSession.create', createIntentParams())
-
-    // A live descendant still holds the provider session: releasing would hand a
-    // second writer to it.
-    expect(leaseOf(SESSION)).toMatchObject({
-      claimStatus: 'reserved',
-      handoffStage: 'manual-recovery'
-    })
     claude.setSelfExit(null)
+
+    // The adapter closed the stdio of what it spawned, and no owner was recorded to stop. The next
+    // start goes ahead; with no death evidence nothing reads the failed start as exited.
+    expect(leaseOf(SESSION)).toMatchObject({
+      claimStatus: 'released',
+      handoffStage: null,
+      deathEvidence: null
+    })
   })
 
-  it('reopens a chat whose stop saw the Claude root exit but not its descendants', async () => {
-    await ok('agentSession.create', createIntentParams())
-    const first = claude.live()
-    first.exitVerdict = { root: 'exited', tree: 'unverifiable' }
-    first.close = async () => {
-      first.closed = true
-      return false
+  it.each(['unverifiable', 'live'] as const)(
+    'restarts a chat whose stop saw the Claude root exit with its tree %s',
+    async (tree) => {
+      await ok('agentSession.create', createIntentParams())
+      const first = claude.live()
+      first.exitVerdict = { root: 'exited', tree }
+      first.close = async () => {
+        first.closed = true
+        return false
+      }
+      const host = getStructuredAgentSessionHost()
+      // The lease follows the root, so the host lets go.
+      await host?.close(SESSION)
+      expect(host?.hasSession(SESSION)).toBe(false)
+
+      // The user comes back and sends: that send is what starts Claude again.
+      const body = { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'back' }] }
+      await ok('agentSession.send', {
+        envelope: envelope('agentSession.send', { body }, leaseOf(SESSION).runtimeFence),
+        body
+      })
+
+      await vi.waitFor(() => expect(claude.connections).toHaveLength(2))
+      await vi.waitFor(() => expect(claude.live().sent).toHaveLength(1))
+      expect(host?.hasSession(SESSION)).toBe(true)
     }
-    const host = getStructuredAgentSessionHost()
-    // The idle release clock's eviction: the lease follows the root, so the host lets go.
-    await host?.close(SESSION)
-    expect(host?.hasSession(SESSION)).toBe(false)
-
-    // What the chat surface's `agentSession.hold` does when the user comes back to it.
-    await host?.hold(SESSION, 'desktop-chat:reopen')
-
-    expect(claude.connections).toHaveLength(2)
-    expect(host?.hasSession(SESSION)).toBe(true)
-  })
+  )
 
   it('routes a published Claude first-hand exit through fenced host reconciliation', async () => {
     await ok<{ fence: number }>('agentSession.create', createIntentParams())
@@ -497,46 +532,49 @@ describe('a structured Claude session over agentSession.*', () => {
     expect(leaseOf(SESSION)).toMatchObject({ claimStatus: 'released', handoffStage: null })
   })
 
-  it('restarts an open chat after a Claude crash whose descendants could not be verified', async () => {
-    const created = await ok<{ fence: number }>('agentSession.create', createIntentParams())
-    // The open chat surface is what asks the host to bring Claude back.
-    await getStructuredAgentSessionHost()?.hold(SESSION, 'desktop-chat:open')
-    const connection = claude.live()
-    connection.exitVerdict = { root: 'exited', tree: 'unverifiable' }
-    connection.close = async () => {
-      connection.closed = true
-      return false
-    }
-    // Claude takes the message but crashes before echoing it.
-    connection.send = async (message) => {
-      connection.sent.push(message)
-    }
-    const body = { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'in flight' }] }
-    const inFlight = ok<{ submission: { dispatchState: string; reason: string | null } }>(
-      'agentSession.send',
-      { envelope: envelope('agentSession.send', { body }, created.fence), body }
-    )
-    await vi.waitFor(() => expect(connection.sent).toHaveLength(1))
-    connection.handlers.onExit?.(new Error('claude stream-json exited (code 1): crashed'))
+  // A descendant seen alive is one that survived the close ladder, such as an MCP server that
+  // ignores SIGTERM; it no longer holds the chat.
+  it.each(['unverifiable', 'live'] as const)(
+    'restarts a chat on its next send after a Claude crash whose tree was %s',
+    async (tree) => {
+      const created = await ok<{ fence: number }>('agentSession.create', createIntentParams())
+      const connection = claude.live()
+      connection.exitVerdict = { root: 'exited', tree }
+      connection.close = async () => {
+        connection.closed = true
+        return false
+      }
+      // Claude takes the message but crashes before echoing it.
+      connection.send = async (message) => {
+        connection.sent.push(message)
+      }
+      const body = { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'in flight' }] }
+      const inFlight = ok<{ submission: { dispatchState: string; reason: string | null } }>(
+        'agentSession.send',
+        { envelope: envelope('agentSession.send', { body }, created.fence), body }
+      )
+      await vi.waitFor(() => expect(connection.sent).toHaveLength(1))
+      connection.handlers.onExit?.(new Error('claude stream-json exited (code 1): crashed'))
 
-    expect((await inFlight).submission).toMatchObject({
-      dispatchState: 'unknown',
-      reason: 'provider_exited_before_acknowledgement'
-    })
-    // Held back, sends failed with the crash until the idle clock stopped the chat.
-    await waitForStructuredAgentSessionRecovery()
-    expect(claude.connections).toHaveLength(2)
-    expect(claude.live().launch.options).toMatchObject({ resume: PROVIDER_SESSION })
-    const lease = leaseOf(SESSION)
-    expect(lease).toMatchObject({ claimStatus: 'live', handoffStage: null })
-    const next = { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'after' }] }
-    const sent = await ok<{ submission: { dispatchState: string } }>('agentSession.send', {
-      envelope: envelope('agentSession.send', { body: next }, lease.runtimeFence),
-      body: next
-    })
-    expect(sent.submission.dispatchState).toBe('accepted')
-    expect(claude.live().sent).toHaveLength(1)
-  })
+      expect((await inFlight).submission).toMatchObject({
+        dispatchState: 'unknown',
+        reason: 'provider_exited_before_acknowledgement'
+      })
+      // The crash releases the lease; nothing restarts Claude until the chat has work for it.
+      await waitForStructuredAgentSessionRecovery()
+      expect(claude.connections).toHaveLength(1)
+      expect(leaseOf(SESSION)).toMatchObject({ claimStatus: 'released', handoffStage: null })
+      const next = { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'after' }] }
+      await ok('agentSession.send', {
+        envelope: envelope('agentSession.send', { body: next }, leaseOf(SESSION).runtimeFence),
+        body: next
+      })
+      await vi.waitFor(() => expect(claude.connections).toHaveLength(2))
+      expect(claude.live().launch.options).toMatchObject({ resume: PROVIDER_SESSION })
+      await vi.waitFor(() => expect(claude.live().sent).toHaveLength(1))
+      expect(leaseOf(SESSION)).toMatchObject({ claimStatus: 'live', handoffStage: null })
+    }
+  )
 
   it('creates, sends, streams, approves, interrupts, and resumes from the chain head', async () => {
     shellEnv = { ...shellEnv, ANTHROPIC_API_KEY: 'sk-ant-SHELL-LEAK' }
diff --git a/src/main/runtime/claude-structured-startup-fault-is-not-an-exit.test.ts b/src/main/runtime/claude-structured-startup-fault-is-not-an-exit.test.ts
new file mode 100644
index 00000000000..863cbaeaebf
--- /dev/null
+++ b/src/main/runtime/claude-structured-startup-fault-is-not-an-exit.test.ts
@@ -0,0 +1,139 @@
+// A Claude start can fail on Orca's side while the CLI is still running: a saved option it can't
+// restore, or an init frame naming another session. Orca ends that child itself, so the chat must
+// not say Claude stopped on its own; only an exit Orca saw says that. Against the production
+// runtime, adapter, record store and host, with only the CLI process scripted.
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-session-mutation-envelope'
+import { hostTestMessage } from '../native-chat/agent-session-wire/structured-agent-session-host-test-data'
+import type { StructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-host'
+import { waitForStructuredAgentSessionRecovery } from './structured-agent-session-runtime'
+import {
+  createScriptedClaudeRuntime,
+  scriptedClaudeExitError
+} from './structured-claude-scripted-runtime-test-support'
+
+const SESSION = 'claude-startup-fault'
+const CALLER = { callerKey: 'client-1' }
+const DIAGNOSTIC = 'claude stream-json exited (code 1): claude: not signed in (rig)'
+const STOPPED_TEXT = 'Claude stopped before it finished starting. Send your message to try again.'
+
+let claude = createScriptedClaudeRuntime([SESSION])
+let operations = 0
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  await claude.dispose()
+  claude = createScriptedClaudeRuntime([SESSION])
+})
+
+function fence(host: StructuredAgentSessionHost): number {
+  return host.deps.store.getRecord(SESSION)?.lease.runtimeFence ?? 0
+}
+
+async function send(host: StructuredAgentSessionHost, text: string): Promise<string> {
+  const body = hostTestMessage(text)
+  const sent = await host.send(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: `${Date.now()}-${(++operations).toString(16).padStart(32, '0')}`,
+      expectedRuntimeFence: fence(host),
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    },
+    body
+  })
+  expect(sent, JSON.stringify(sent)).toMatchObject({
+    ok: true,
+    value: { submission: { dispatchState: 'pending' } }
+  })
+  return sent.ok ? sent.value.clientMessageId : ''
+}
+
+async function failureRows(host: StructuredAgentSessionHost) {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status' && item.body.failure
+      ? [{ text: item.body.text, kind: item.body.failure.kind }]
+      : []
+  )
+}
+
+async function submission(host: StructuredAgentSessionHost, clientMessageId: string) {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )
+}
+
+async function released(host: StructuredAgentSessionHost): Promise<void> {
+  await waitForStructuredAgentSessionRecovery()
+  await vi.waitFor(() =>
+    expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
+  )
+}
+
+describe('a Claude start that Orca fails while the CLI is still running', () => {
+  it('reads as a start that could not happen when a saved option cannot be restored', async () => {
+    claude.behave(SESSION, { optionWritesFail: true })
+    const host = await claude.install()
+    await expect(
+      host.attach(
+        CALLER,
+        claude.attachParams(SESSION, null, { options: { permissionMode: 'plan' } })
+      )
+    ).resolves.toMatchObject({ ok: true })
+    await released(host)
+
+    expect(claude.child(SESSION).calls).toContain('set_permission_mode')
+    expect(await failureRows(host)).toEqual([
+      { text: expect.stringMatching(/^Claude couldn't start\./), kind: 'startFailed' }
+    ])
+  })
+
+  it('rejects a held message as a start that could not happen when init names another session', async () => {
+    claude.behave(SESSION, { initHangs: true, initNamesForeignSession: true })
+    const host = await claude.install()
+    await expect(host.attach(CALLER, claude.attachParams(SESSION, null))).resolves.toMatchObject({
+      ok: true
+    })
+    const held = await send(host, 'hello')
+
+    claude.child(SESSION).answerInit()
+    await released(host)
+
+    await vi.waitFor(async () =>
+      expect(await submission(host, held)).toMatchObject({
+        dispatchState: 'rejected',
+        reason: expect.stringMatching(/^Claude couldn't start\./),
+        rejection: { kind: 'startFailed' }
+      })
+    )
+    expect(await failureRows(host)).toEqual([
+      { text: expect.stringMatching(/^Claude couldn't start\./), kind: 'startFailed' }
+    ])
+    expect(claude.child(SESSION).calls).not.toContain('send')
+  })
+
+  it('still says Claude stopped when the CLI exits on its own before its start lands', async () => {
+    claude.behave(SESSION, { initHangs: true })
+    const host = await claude.install()
+    await expect(host.attach(CALLER, claude.attachParams(SESSION, null))).resolves.toMatchObject({
+      ok: true
+    })
+    const held = await send(host, 'hello')
+
+    claude.child(SESSION).exit(scriptedClaudeExitError(DIAGNOSTIC))
+    await released(host)
+
+    await vi.waitFor(async () =>
+      expect(await submission(host, held)).toMatchObject({
+        dispatchState: 'rejected',
+        reason: STOPPED_TEXT,
+        rejection: { kind: 'providerStartFailed' }
+      })
+    )
+    expect(await failureRows(host)).toEqual([{ text: STOPPED_TEXT, kind: 'providerStartFailed' }])
+  })
+})
diff --git a/src/main/runtime/claude-structured-startup-unanswered-control-request.test.ts b/src/main/runtime/claude-structured-startup-unanswered-control-request.test.ts
index 38d0de314d2..ce26647ae85 100644
--- a/src/main/runtime/claude-structured-startup-unanswered-control-request.test.ts
+++ b/src/main/runtime/claude-structured-startup-unanswered-control-request.test.ts
@@ -72,10 +72,10 @@ function turnReportsModel(model: string): void {
   })
 }
 
-function statusRows(host: StructuredAgentSessionHost): string[] {
-  return host
-    .journalSnapshot(SESSION)
-    .items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
+async function statusRows(host: StructuredAgentSessionHost): Promise<string[]> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status' ? [item.body.text] : []
+  )
 }
 
 async function send(host: StructuredAgentSessionHost, text: string): Promise<void> {
@@ -119,7 +119,7 @@ describe('a Claude start whose CLI answers initialize but not a control request'
       timeout: DEADLINE_MS * 40
     })
     expect(host.deps.adapter.readOptionRestoreFailures?.(SESSION)).toEqual([])
-    expect(statusRows(host)).toEqual([])
+    expect(await statusRows(host)).toEqual([])
     expect(claude.children(SESSION)).toHaveLength(1)
 
     // The proven child takes the next message.
@@ -245,7 +245,7 @@ describe('a Claude start whose CLI answers initialize but not a control request'
       timeout: DEADLINE_MS * 40
     })
     expect(record(host)?.lease.claimStatus).toBe('live')
-    expect(statusRows(host)).toEqual([])
+    expect(await statusRows(host)).toEqual([])
     expect(claude.children(SESSION)).toHaveLength(1)
   })
 })
diff --git a/src/main/runtime/claude-trust-dialog-transcript.test.ts b/src/main/runtime/claude-trust-dialog-transcript.test.ts
new file mode 100644
index 00000000000..5913c54b019
--- /dev/null
+++ b/src/main/runtime/claude-trust-dialog-transcript.test.ts
@@ -0,0 +1,252 @@
+/**
+ * Claude Code's first-launch trust dialog, replayed byte for byte from captured transcripts
+ * (`__fixtures__/claude-dialog-trust-workspace*.txt`).
+ *
+ * The dialog parks the cursor on its highlighted option with a cursor-up, and the host's line tail
+ * drops every row below the cursor — "Yes, I trust this folder" and "Enter to confirm". The
+ * tui-idle poll therefore reads the runtime's rendered screen, which still shows them.
+ */
+
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createTranscriptPane, TRANSCRIPT_PANE_PTY_ID } from './agent-transcript-pane-test-harness'
+
+function readCapture(name: string): { data: string; size: { cols: number; rows: number } } {
+  const base = join(__dirname, '__fixtures__', name)
+  const meta: { cols: number; rows: number } = JSON.parse(readFileSync(`${base}.meta.json`, 'utf8'))
+  return { data: readFileSync(`${base}.txt`, 'utf8'), size: { cols: meta.cols, rows: meta.rows } }
+}
+
+async function waitOnReplay(
+  name: string,
+  readSize: number | null,
+  options: { after?: string; timeoutMs?: number } = {}
+) {
+  const { data, size } = readCapture(name)
+  const { runtime, handle } = await createTranscriptPane({
+    paneTitle: 'Claude Code',
+    foregroundProcess: 'claude',
+    launchAgent: 'claude',
+    size,
+    data: ''
+  })
+  // Pane creation awaits real timers; replay and polling use the virtual clock.
+  vi.useFakeTimers()
+  const bytes = Buffer.from(data, 'utf8')
+  const step = readSize ?? bytes.length
+  // Why a streaming decoder: a PTY read can end inside a multi-byte character, as a real one does.
+  const decoder = new TextDecoder()
+  for (let offset = 0; offset < bytes.length; offset += step) {
+    const read = decoder.decode(bytes.subarray(offset, offset + step), { stream: true })
+    runtime.onPtyData(TRANSCRIPT_PANE_PTY_ID, read, Date.now())
+  }
+  if (options.after) {
+    runtime.onPtyData(TRANSCRIPT_PANE_PTY_ID, options.after, Date.now())
+  }
+  const timeoutMs = options.timeoutMs ?? 15_000
+  const promise = runtime.waitForTerminal(handle, {
+    condition: 'tui-idle',
+    timeoutMs
+  })
+  // Attach before advancing so the expected timeout is never an unhandled rejection.
+  promise.catch(() => {})
+  await vi.advanceTimersByTimeAsync(timeoutMs)
+  return promise
+}
+
+describe("Claude's workspace trust dialog, from captured transcripts", () => {
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('reports the dialog as a blocking prompt instead of waiting out the whole budget', async () => {
+    await expect(waitOnReplay('claude-dialog-trust-workspace', null)).resolves.toMatchObject({
+      satisfied: false,
+      blockedReason: 'agent-trust-workspace'
+    })
+  })
+
+  it('still reports it when the dialog arrives in the 1024-byte reads a live Claude produced', async () => {
+    // Why: the tail's plain path blanks each `text\r\r\n` line of a read that carries no
+    // cursor-up, so the opening question never survives there; the screen is unaffected.
+    await expect(waitOnReplay('claude-dialog-trust-workspace', 1024)).resolves.toMatchObject({
+      satisfied: false,
+      blockedReason: 'agent-trust-workspace'
+    })
+  })
+
+  it('reports it on a narrow pane, where Claude wraps the question across lines', async () => {
+    await expect(waitOnReplay('claude-dialog-trust-workspace-narrow', null)).resolves.toMatchObject(
+      { satisfied: false, blockedReason: 'agent-trust-workspace' }
+    )
+  })
+
+  it('reports the agent ready, not blocked, once the user has answered "Yes"', async () => {
+    const wait = await waitOnReplay('claude-dialog-trust-workspace-answered', 1024)
+    expect(wait).toMatchObject({ satisfied: true })
+    expect(wait).not.toHaveProperty('blockedReason')
+  })
+
+  it('does not report a working Claude blocked for quoting the dialog in its own output', async () => {
+    // Synthetic turn painted over the answered capture: a working title, then a diff of this
+    // dialog's wording just above the status line, where the rendered screen shows it.
+    const quotedDiff = [
+      '⏺ Update(src/main/runtime/claude-trust-dialog-transcript.test.ts)',
+      '  ⎿  Added 3 lines',
+      "      12 +    '❯ No, exit',",
+      "      13 +    '  Yes, I trust this folder',",
+      "      14 +    'Enter to confirm · Esc to cancel'",
+      '✻ Working… (esc to interrupt)'
+    ]
+      .map((line, index) => `\x1b[${27 + index};1H\x1b[2K${line}`)
+      .join('')
+    // Why a timeout proves it: three poll ticks pass, and a working agent has nothing else to settle on.
+    await expect(
+      waitOnReplay('claude-dialog-trust-workspace-answered', 1024, {
+        after: `\x1b]0;⠂ Claude Code\x07${quotedDiff}`,
+        timeoutMs: 6_500
+      })
+    ).rejects.toThrow('timeout')
+  })
+})
+
+// A shell auto-title names Claude before Claude paints anything: oh-my-zsh sends the command
+// line as OSC 2 and then `claude` as OSC 1; fish's default is `claude <cwd>`. That bare name is
+// not a rest signal, so it must never let a launch type into the dialog below it.
+const OH_MY_ZSH_TITLES = ['\x1b]2;claude --dangerously-skip-permissions\x07', '\x1b]1;claude\x07']
+const FISH_TITLE = '\x1b]0;claude ~/p/repo\x07'
+// eslint-disable-next-line no-control-regex -- OSC title sequences are control characters
+const OSC_0_TITLE = /\x1b\]0;[^\x07]*\x07/g
+const POLL_INTERVAL_MS = 2_000
+const QUIESCENCE_MS = 3_000
+
+describe("Claude's trust dialog under a shell auto-title", () => {
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  async function createPane(name = 'claude-dialog-trust-workspace') {
+    const { data, size } = readCapture(name)
+    const pane = await createTranscriptPane({
+      paneTitle: 'claude',
+      foregroundProcess: 'claude',
+      launchAgent: 'claude',
+      size,
+      data: ''
+    })
+    // Why after creation: the pane's own set-up awaits real timers.
+    vi.useFakeTimers()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: both resolvers are protected methods on the runtime; the spies only count calls.
+    const internals = pane.runtime as unknown as {
+      resolveTuiIdleWaiters: (...args: unknown[]) => void
+      resolvePtyTuiIdleWaiters: (...args: unknown[]) => void
+    }
+    const titleResolves = [
+      vi.spyOn(internals, 'resolveTuiIdleWaiters'),
+      vi.spyOn(internals, 'resolvePtyTuiIdleWaiters')
+    ]
+    const write = (chunk: string) =>
+      pane.runtime.onPtyData(TRANSCRIPT_PANE_PTY_ID, chunk, Date.now())
+    const paint = (bytes = data) => {
+      const encoded = Buffer.from(bytes, 'utf8')
+      const decoder = new TextDecoder()
+      for (let offset = 0; offset < encoded.length; offset += 1024) {
+        write(decoder.decode(encoded.subarray(offset, offset + 1024), { stream: true }))
+      }
+    }
+    const wait = () => {
+      const settled = vi.fn()
+      const promise = pane.runtime.waitForTerminal(pane.handle, {
+        condition: 'tui-idle',
+        timeoutMs: 60_000
+      })
+      promise.then(settled, () => {})
+      return { promise, settled }
+    }
+    const titleResolveCount = () =>
+      titleResolves.reduce((sum, spy) => sum + spy.mock.calls.length, 0)
+    return { data, write, paint, wait, titleResolveCount }
+  }
+
+  it('reports the dialog to a wait registered after the pane has gone quiet', async () => {
+    const pane = await createPane()
+    OH_MY_ZSH_TITLES.forEach(pane.write)
+    pane.paint()
+    await vi.advanceTimersByTimeAsync(QUIESCENCE_MS + 500)
+
+    const { promise } = pane.wait()
+    await vi.advanceTimersByTimeAsync(0)
+    await expect(promise).resolves.toMatchObject({
+      satisfied: false,
+      blockedReason: 'agent-trust-workspace'
+    })
+  })
+
+  // Why the resolver differs: the command-line title reads as `permission`, and a
+  // permission-to-idle step is not offered to waiters, so oh-my-zsh reaches the poll instead.
+  it.each([
+    ['oh-my-zsh', OH_MY_ZSH_TITLES, false],
+    ['fish', [FISH_TITLE], true]
+  ])(
+    'does not settle ready when the %s title arrives before the dialog paints',
+    async (_, titles, offered) => {
+      const pane = await createPane()
+      const { promise, settled } = pane.wait()
+      titles.forEach(pane.write)
+      expect(pane.titleResolveCount() > 0).toBe(offered)
+      await vi.advanceTimersByTimeAsync(POLL_INTERVAL_MS)
+      expect(settled).not.toHaveBeenCalled()
+
+      pane.paint()
+      await vi.advanceTimersByTimeAsync(POLL_INTERVAL_MS)
+      await expect(promise).resolves.toMatchObject({
+        satisfied: false,
+        blockedReason: 'agent-trust-workspace'
+      })
+    }
+  )
+
+  it('does not settle ready when the exit probe restores the name-only title', async () => {
+    const pane = await createPane()
+    const { promise, settled } = pane.wait()
+    pane.write('\x1b]1;claude\x07')
+    const resolvesBeforeRestore = pane.titleResolveCount()
+    // A neutral title reads as the agent exiting; the probe finds `claude` still in front and
+    // restores the idle status, offering it to the waiters again.
+    pane.write('\x1b]0;~/p/repo\x07')
+    await vi.advanceTimersByTimeAsync(0)
+    expect(pane.titleResolveCount()).toBeGreaterThan(resolvesBeforeRestore)
+    expect(settled).not.toHaveBeenCalled()
+
+    pane.paint()
+    await vi.advanceTimersByTimeAsync(POLL_INTERVAL_MS)
+    await expect(promise).resolves.toMatchObject({
+      satisfied: false,
+      blockedReason: 'agent-trust-workspace'
+    })
+  })
+
+  it("reports ready at once when Claude's own idle title follows the answer", async () => {
+    const pane = await createPane('claude-dialog-trust-workspace-answered')
+    OH_MY_ZSH_TITLES.forEach(pane.write)
+    pane.paint()
+    const { promise } = pane.wait()
+    await vi.advanceTimersByTimeAsync(0)
+    await expect(promise).resolves.toMatchObject({ satisfied: true })
+  })
+
+  it('reports ready after the quiet window when Claude paints no title of its own', async () => {
+    const pane = await createPane('claude-dialog-trust-workspace-answered')
+    OH_MY_ZSH_TITLES.forEach(pane.write)
+    pane.paint(pane.data.replace(OSC_0_TITLE, ''))
+    const { promise, settled } = pane.wait()
+    await vi.advanceTimersByTimeAsync(QUIESCENCE_MS - 500)
+    expect(settled).not.toHaveBeenCalled()
+
+    await vi.advanceTimersByTimeAsync(POLL_INTERVAL_MS * 2)
+    const wait = await promise
+    expect(wait).toMatchObject({ satisfied: true })
+    expect(wait).not.toHaveProperty('blockedReason')
+  })
+})
diff --git a/src/main/runtime/client-hosted-browser-row-hydration-census.test.ts b/src/main/runtime/client-hosted-browser-row-hydration-census.test.ts
deleted file mode 100644
index e50e066a544..00000000000
--- a/src/main/runtime/client-hosted-browser-row-hydration-census.test.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-import { glob } from 'tinyglobby'
-
-const REPO_ROOT = join(import.meta.dirname, '../../..')
-const CENSUS_FILE = 'src/main/runtime/client-hosted-browser-row-hydration-census.test.ts'
-
-/**
- * `deliverHydrationSnapshot` reads like a getter and is not one: it replaces the publisher's record
- * of which workspaces the renderer holds rows for. A second caller that reasonably treats it as a
- * peek — a status panel, a diagnostic dump, a second window's look-ahead — would clear that record
- * out from under the live renderer, and the rows it is showing become unretractable. That is the
- * exact defect this round shipped a fix for, so the single-caller shape is pinned rather than
- * trusted to the name.
- */
-async function countCallSites(pattern: RegExp): Promise<Record<string, number>> {
-  const files = await glob(['src/**/*.ts', 'src/**/*.tsx'], {
-    cwd: REPO_ROOT,
-    ignore: ['**/node_modules/**', '**/*.test.ts', '**/*.test.tsx', CENSUS_FILE]
-  })
-  const counts: Record<string, number> = {}
-  for (const file of files) {
-    // Counted per file, not merely detected: two call sites in one file mask each other.
-    const hits = readFileSync(join(REPO_ROOT, file), 'utf8').match(pattern)?.length ?? 0
-    if (hits > 0) {
-      counts[file] = hits
-    }
-  }
-  return counts
-}
-
-// Anchored on the member-call shape rather than the bare name, so the declaration does not count
-// itself and prose about the method does not have to be kept out of the file.
-const DELIVER_CALL = /\.deliverHydrationSnapshot\(/g
-const LIST_CALL = /\.listClientHostedBrowserRows\(/g
-
-describe('client-hosted row hydration caller census', () => {
-  it('keeps the hydration delivery to its one runtime caller', async () => {
-    expect(await countCallSites(DELIVER_CALL)).toEqual({
-      'src/main/runtime/orca-runtime-stored-mobile-snapshot-has-stale-preserved-tab.ts': 1
-    })
-  })
-
-  // The IPC handler is the other half of the same invariant: it is what turns one renderer's
-  // hydration request into one delivery, so a second production reader would arrive through here.
-  it('keeps the runtime accessor to its one IPC caller', async () => {
-    expect(await countCallSites(LIST_CALL)).toEqual({
-      'src/main/ipc/runtime.ts': 1
-    })
-  })
-
-  // Why: the two censuses above pass by finding what is already there, so a matcher that had
-  // stopped matching would read the same as a clean repo. Prove it counts a second caller.
-  it('counts a second caller rather than reporting the same single site', () => {
-    const source = `
-      const a = runtime.deliverHydrationSnapshot()
-      const b = other.deliverHydrationSnapshot()
-    `
-    expect(source.match(DELIVER_CALL)?.length).toBe(2)
-    expect('runtime.listClientHostedBrowserRows()'.match(LIST_CALL)?.length).toBe(1)
-  })
-})
diff --git a/src/main/runtime/codex-header-readiness-transcripts.test.ts b/src/main/runtime/codex-header-readiness-transcripts.test.ts
new file mode 100644
index 00000000000..ea8dc03cef2
--- /dev/null
+++ b/src/main/runtime/codex-header-readiness-transcripts.test.ts
@@ -0,0 +1,279 @@
+import { describe, expect, it, vi } from 'vitest'
+import { createTranscriptPane } from './agent-transcript-pane-test-harness'
+import {
+  readRuntimeFixture,
+  replayTranscript,
+  type TranscriptReplayFrame
+} from './agent-transcript-replay-test-harness'
+import {
+  isKnownReadyPromptBody,
+  isKnownReadyPromptPreview,
+  isKnownReadyPromptSettled
+} from './terminal-wait-detection'
+
+vi.mock('electron', () => ({
+  BrowserWindow: { fromId: vi.fn(() => null) },
+  webContents: { fromId: vi.fn(() => null) },
+  ipcMain: { on: vi.fn(), removeListener: vi.fn() },
+  app: { getPath: vi.fn(() => '/tmp') }
+}))
+
+// codex-cli 0.157.1 recordings at 120x40 (see each .meta.json); STA-8628.
+const PLAIN = 'codex-0157-plain-ready'
+const EFFORT_OVERRIDE = 'codex-0157-effort-override-embedded-warning'
+const CONFIG_OVERRIDE = 'codex-0157-config-override-embedded-warning'
+const NO_DAEMON = 'codex-0157-no-daemon-effort-override'
+// Fresh CODEX_HOME: the provisional header stays up while Codex installs and starts its daemon.
+const FRESH_HOME = 'codex-0157-fresh-home-daemon-install'
+const ALL_FIXTURES = [PLAIN, EFFORT_OVERRIDE, CONFIG_OVERRIDE, NO_DAEMON, FRESH_HOME]
+
+async function finalFrame(
+  name: string,
+  cols: number,
+  rows: number
+): Promise<TranscriptReplayFrame> {
+  let last: TranscriptReplayFrame | null = null
+  for await (const frame of replayTranscript(readRuntimeFixture(name), cols, rows)) {
+    last = frame
+  }
+  if (!last) {
+    throw new Error(`empty fixture ${name}`)
+  }
+  return last
+}
+
+function screenShowsLoadingHeader(screenLines: string[]): boolean {
+  const screen = screenLines.join('\n').toLowerCase()
+  return screen.includes('openai codex') && /(?:model|directory):\s+loading/.test(screen)
+}
+
+// Codex's default status row opens with `<model> <effort> ·`; only the live chat paints it.
+const LIVE_STATUS_ROW_RE = /\b(?:default|minimal|low|medium|high|xhigh) ·/
+
+function screenShowsProvisionalStartup(screenLines: string[]): boolean {
+  return (
+    screenShowsLoadingHeader(screenLines) &&
+    !screenLines.some((line) => LIVE_STATUS_ROW_RE.test(line.toLowerCase()))
+  )
+}
+
+describe('Codex 0.157 header readiness from captured bytes', () => {
+  it.each([EFFORT_OVERRIDE, CONFIG_OVERRIDE])(
+    '%s: the line-folded wait text never shows a ready header',
+    async (name) => {
+      const { waitText } = await finalFrame(name, 120, 40)
+      // Why: the cell-diff repaint folds to `dirctory:` — the STA-8628 timeout.
+      expect(waitText.toLowerCase()).toContain('dirctory:')
+      expect(isKnownReadyPromptPreview(waitText)).toBe(false)
+    }
+  )
+
+  it.each(ALL_FIXTURES)(
+    '%s: the screen never adds readiness while loading, and is ready at the final screen',
+    async (name) => {
+      let sawLoadingHeader = false
+      let last: TranscriptReplayFrame | null = null
+      for await (const frame of replayTranscript(readRuntimeFixture(name), 120, 40)) {
+        if (screenShowsLoadingHeader(frame.screenLines)) {
+          sawLoadingHeader = true
+          expect(isKnownReadyPromptBody('', 'codex', () => frame.screenLines)).toBe(false)
+        }
+        last = frame
+      }
+      // Presence precondition: a loading frame was actually exercised.
+      expect(sawLoadingHeader).toBe(true)
+      expect(last).not.toBeNull()
+      expect(isKnownReadyPromptBody(last!.waitText, 'codex', () => last!.screenLines)).toBe(true)
+    }
+  )
+
+  // Why: 0.157 discards input typed during its daemon start, behind the provisional header.
+  it.each(ALL_FIXTURES)(
+    '%s: never ready while the screen shows the provisional `model: loading` startup screen',
+    async (name) => {
+      let sawTextOnlyReadiness = false
+      for await (const frame of replayTranscript(readRuntimeFixture(name), 120, 40)) {
+        if (screenShowsProvisionalStartup(frame.screenLines)) {
+          sawTextOnlyReadiness ||= isKnownReadyPromptPreview(frame.waitText)
+          expect(isKnownReadyPromptBody(frame.waitText, 'codex', () => frame.screenLines)).toBe(
+            false
+          )
+        }
+      }
+      // Presence precondition for the text-copy fixtures: the text rules alone would say ready here.
+      if (name === PLAIN || name === FRESH_HOME) {
+        expect(sawTextOnlyReadiness).toBe(true)
+      }
+    }
+  )
+
+  // Why these sizes: grids out of step with the 120x40 recording garble the header (review of #23475).
+  describe.each([
+    [120, 40],
+    [80, 24],
+    [30, 50],
+    [108, 30],
+    [60, 5]
+  ])('at %ix%i the screen never takes a settled header away from the text rules', (cols, rows) => {
+    it.each(ALL_FIXTURES)('%s', async (name) => {
+      let settledFrames = 0
+      for await (const frame of replayTranscript(readRuntimeFixture(name), cols, rows)) {
+        if (isKnownReadyPromptSettled(frame.waitText)) {
+          settledFrames += 1
+          expect(isKnownReadyPromptBody(frame.waitText, 'codex', () => frame.screenLines)).toBe(
+            true
+          )
+        }
+      }
+      // Presence precondition: the text-copy fixtures reach a settled header.
+      if (name === PLAIN || name === FRESH_HOME || name === NO_DAEMON) {
+        expect(settledFrames).toBeGreaterThan(0)
+      }
+    })
+  })
+
+  it('keeps the text rules when there is no live screen', async () => {
+    const { waitText } = await finalFrame(PLAIN, 120, 40)
+    expect(isKnownReadyPromptBody(waitText, 'codex', () => null)).toBe(
+      isKnownReadyPromptPreview(waitText)
+    )
+    expect(isKnownReadyPromptBody(waitText, 'codex', () => null)).toBe(true)
+  })
+
+  it('does not read a mid-turn composer as ready', () => {
+    const screenLines = [
+      '› Summarize the repository layout',
+      '• Working (12s • esc to interrupt)',
+      '› Ask Codex to do anything',
+      '  GPT-6-Sol high · ~/repo/app'
+    ]
+    expect(isKnownReadyPromptBody(screenLines.join('\n'), 'codex', () => screenLines)).toBe(false)
+  })
+
+  it('does not settle when a blocking dialog is painted below the header', () => {
+    const screenLines = [
+      '│ >_ OpenAI Codex (v0.157.1)                               │',
+      '│ model:       GPT-6-Sol high   /model to change           │',
+      '│ directory:   ~/repo/app                                  │',
+      'Do you trust the contents of this directory?',
+      'Press enter to continue'
+    ]
+    expect(isKnownReadyPromptBody('', 'codex', () => screenLines)).toBe(false)
+  })
+
+  it('reads only the header box, not chat below it that mentions Codex', () => {
+    const screenLines = [
+      '╭──────────────────────────────────────────────────────────╮',
+      '│ >_ OpenAI Codex (v0.157.1)                               │',
+      '│ model:       GPT-6-Sol high   /model to change           │',
+      '│ directory:   ~/repo/app                                  │',
+      '╰──────────────────────────────────────────────────────────╯',
+      '› Why does OpenAI Codex print model: loading at startup?'
+    ]
+    expect(isKnownReadyPromptBody('', 'codex', () => screenLines)).toBe(true)
+  })
+
+  it('leaves a non-codex pane on the text rules even when its screen shows the Codex header', () => {
+    const screenLines = [
+      '│ >_ OpenAI Codex (v0.157.1)                               │',
+      '│ model:       GPT-6-Sol high   /model to change           │',
+      '│ directory:   ~/repo/app                                  │'
+    ]
+    const readScreenLines = vi.fn(() => screenLines)
+    expect(isKnownReadyPromptBody('', 'claude', readScreenLines)).toBe(false)
+    expect(readScreenLines).not.toHaveBeenCalled()
+    expect(isKnownReadyPromptBody('', 'codex', readScreenLines)).toBe(true)
+  })
+
+  describe('at the 80x24 default grid the header garbles and today’s answer stands', () => {
+    it.each(ALL_FIXTURES)('%s', async (name) => {
+      const { screenLines, waitText } = await finalFrame(name, 80, 24)
+      expect(isKnownReadyPromptBody(waitText, 'codex', () => screenLines)).toBe(
+        isKnownReadyPromptPreview(waitText)
+      )
+    })
+  })
+
+  describe('through the runtime', () => {
+    async function codexPane(name: string, size?: { cols: number; rows: number }) {
+      return createTranscriptPane({
+        paneTitle: 'Terminal',
+        foregroundProcess: 'codex',
+        launchAgent: 'codex',
+        data: readRuntimeFixture(name),
+        size
+      })
+    }
+
+    it.each(ALL_FIXTURES)(
+      '%s: a tui-idle wait settles from the live screen',
+      async (name) => {
+        const { runtime, handle } = await codexPane(name, { cols: 120, rows: 40 })
+        // Why 5s: the poll re-reads the grid every 2s once the queued emulator write lands.
+        await expect(
+          runtime.waitForTerminal(handle, { condition: 'tui-idle', timeoutMs: 5_000 })
+        ).resolves.toMatchObject({ condition: 'tui-idle', satisfied: true })
+      },
+      15_000
+    )
+
+    it('does not settle while Codex is still installing its daemon behind the provisional screen', async () => {
+      const data = readRuntimeFixture(FRESH_HOME)
+      const install = data.indexOf('Installing daemon')
+      // Presence precondition: the cut keeps the provisional header and stops before the live chat.
+      expect(install).toBeGreaterThan(0)
+      const provisional = data.slice(0, data.indexOf('\n', install) + 1)
+      expect(provisional).toMatch(/model:.*loading/)
+      const { runtime, handle } = await createTranscriptPane({
+        paneTitle: 'Terminal',
+        foregroundProcess: 'codex',
+        launchAgent: 'codex',
+        data: provisional,
+        size: { cols: 120, rows: 40 }
+      })
+      await expect(
+        runtime.waitForTerminal(handle, { condition: 'tui-idle', timeoutMs: 2_500 })
+      ).rejects.toThrow(/timeout/)
+    }, 15_000)
+
+    // Why no bytes: worker-start waits on a pane that has printed nothing yet, which is when the
+    // runtime asks for a visible-screen read instead of its own text copy.
+    it('does not settle from a visible-screen read of the provisional screen', async () => {
+      const { runtime, handle } = await createTranscriptPane({
+        paneTitle: 'Terminal',
+        foregroundProcess: 'codex',
+        launchAgent: 'codex',
+        data: '',
+        size: { cols: 120, rows: 40 }
+      })
+      const readVisibleScreen = vi.spyOn(runtime, 'readTerminal').mockResolvedValue({
+        handle,
+        status: 'running',
+        tail: [
+          '╭──────────────────────────────────────────╮',
+          '│ >_ OpenAI Codex (v0.157.0)               │',
+          '│ model:       loading   /model to change  │',
+          '│ directory:   ~/repo/app                  │',
+          '╰──────────────────────────────────────────╯',
+          '› Ask Codex to do anything',
+          '  ? for shortcuts'
+        ],
+        truncated: false,
+        nextCursor: null,
+        source: 'screen'
+      })
+      await expect(
+        runtime.waitForTerminal(handle, { condition: 'tui-idle', timeoutMs: 2_500 })
+      ).rejects.toThrow(/timeout/)
+      // Presence precondition: the visible-screen probe actually ran.
+      expect(readVisibleScreen).toHaveBeenCalled()
+    }, 15_000)
+
+    it('keeps timing out on the garbled 80x24 default grid, as before', async () => {
+      const { runtime, handle } = await codexPane(EFFORT_OVERRIDE)
+      await expect(
+        runtime.waitForTerminal(handle, { condition: 'tui-idle', timeoutMs: 2_500 })
+      ).rejects.toThrow(/timeout/)
+    }, 15_000)
+  })
+})
diff --git a/src/main/runtime/codex-quiet-ready-screen.test.ts b/src/main/runtime/codex-quiet-ready-screen.test.ts
new file mode 100644
index 00000000000..50052365905
--- /dev/null
+++ b/src/main/runtime/codex-quiet-ready-screen.test.ts
@@ -0,0 +1,372 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { TuiAgent } from '../../shared/tui-agent'
+import { createTranscriptPane } from './agent-transcript-pane-test-harness'
+import {
+  readRuntimeFixture,
+  replayTranscript,
+  type TranscriptReplayFrame
+} from './agent-transcript-replay-test-harness'
+import { isCodexComposerReadyScreen } from './codex-terminal-readiness'
+import {
+  detectTerminalWaitBlockedReason,
+  isKnownReadyPromptBody,
+  isQuietReadyScreenBody
+} from './terminal-wait-detection'
+import {
+  evaluateTuiIdle,
+  hasQuietReadyScreen,
+  isTuiIdleReadyVerdict,
+  type TuiIdleEvaluationInput
+} from './tui-idle-evidence'
+
+vi.mock('electron', () => ({
+  BrowserWindow: { fromId: vi.fn(() => null) },
+  webContents: { fromId: vi.fn(() => null) },
+  ipcMain: { on: vi.fn(), removeListener: vi.fn() },
+  app: { getPath: vi.fn(() => '/tmp') }
+}))
+
+const QUIESCENCE_MS = 3000
+
+// codex-cli recordings at 120x40 (see each .meta.json); STA-8834. Each launches, runs a turn,
+// and ends idle; the timed ones also replay as plain strings here. 0.157 idles via STA-8628's.
+const TIMED_FIXTURES = ['codex-0-155-1-timed-turn', 'codex-0-158-0-timed-turn']
+const SETTLED_IDLE_FIXTURES = ['codex-0-150-1-turn', ...TIMED_FIXTURES]
+const DIALOG_FIXTURES = [
+  'codex-0-157-1-update-dialog',
+  'codex-0-158-0-approval',
+  'codex-0-158-0-trustprompt'
+]
+const STA_8628_FIXTURES = [
+  'codex-0157-plain-ready',
+  'codex-0157-effort-override-embedded-warning',
+  'codex-0157-config-override-embedded-warning',
+  'codex-0157-no-daemon-effort-override'
+]
+
+const BUSY_STATUS_RE = /to interrupt\)/
+const EMPTY_COMPOSER_RE = /^› ask codex to do anything\s*$/m
+const HEADER_LOADING_RE = /(?:model|directory):\s+loading|^\s*loading\s*$/m
+const DIALOG_RE =
+  /update available|do you trust|trust this folder|would you like to run|press enter to confirm|enter continue/
+
+function screenOf(frame: TranscriptReplayFrame): string {
+  return frame.screenLines.join('\n').toLowerCase()
+}
+
+async function collectFrames(
+  data: string | readonly string[],
+  cols = 120,
+  rows = 40
+): Promise<TranscriptReplayFrame[]> {
+  const frames: TranscriptReplayFrame[] = []
+  for await (const frame of replayTranscript(data, cols, rows)) {
+    frames.push(frame)
+  }
+  return frames
+}
+
+describe('Codex composer ready screen, frame by frame', () => {
+  it.each([...SETTLED_IDLE_FIXTURES, ...DIALOG_FIXTURES])(
+    '%s: never ready while loading, mid-turn, or under a drawn dialog',
+    async (name) => {
+      const seen = { loading: 0, busy: 0, dialog: 0 }
+      for (const frame of await collectFrames(readRuntimeFixture(name))) {
+        const screen = screenOf(frame)
+        // Why only once the composer is gone: a half-drawn dialog keeps it for a few frames,
+        // which quiescence absorbs; a drawn dialog replaces it.
+        const kind = HEADER_LOADING_RE.test(screen)
+          ? 'loading'
+          : BUSY_STATUS_RE.test(screen)
+            ? 'busy'
+            : DIALOG_RE.test(screen) && !EMPTY_COMPOSER_RE.test(screen)
+              ? 'dialog'
+              : null
+        if (kind) {
+          seen[kind] += 1
+          expect({ kind, ready: isCodexComposerReadyScreen(screenOf(frame)) }).toEqual({
+            kind,
+            ready: false
+          })
+        }
+      }
+      // Presence preconditions: each fixture exercises the states it was recorded for.
+      expect(seen.loading).toBeGreaterThan(0)
+      if (DIALOG_FIXTURES.includes(name)) {
+        expect(seen.dialog).toBeGreaterThan(0)
+      } else {
+        expect(seen.busy).toBeGreaterThan(0)
+      }
+    },
+    30_000
+  )
+
+  it.each([...SETTLED_IDLE_FIXTURES, ...STA_8628_FIXTURES])(
+    '%s: ready on the final idle screen',
+    async (name) => {
+      const frames = await collectFrames(readRuntimeFixture(name))
+      expect(isCodexComposerReadyScreen(screenOf(frames.at(-1)!))).toBe(true)
+    }
+  )
+
+  it.each(DIALOG_FIXTURES)('%s: not ready while the dialog owns the screen', async (name) => {
+    const frames = await collectFrames(readRuntimeFixture(name))
+    expect(isCodexComposerReadyScreen(screenOf(frames.at(-1)!))).toBe(false)
+  })
+
+  it('is not ready without a live screen', () => {
+    expect(isQuietReadyScreenBody('', 'codex', () => null)).toBe(false)
+  })
+
+  it('reads the placeholder only as the composer line, not quoted mid-line', () => {
+    const quoted = ['$ grep placeholder notes.txt', 'the box says › Ask Codex to do anything', '$']
+    expect(isQuietReadyScreenBody('', 'codex', () => quoted)).toBe(false)
+  })
+
+  it('reads the busy row only above the composer, not a status row quoted in the answer', () => {
+    const screenLines = [
+      '>_ OpenAI Codex (v0.158.0)',
+      '   ~/repo',
+      '',
+      '› what does the status row look like mid-turn?',
+      '',
+      '• It reads like this:',
+      '',
+      '  • Working (0s • esc to interrupt)',
+      '',
+      '  The timer counts up until the turn ends, and the row',
+      '  disappears once the answer is complete.',
+      '',
+      '› Ask Codex to do anything',
+      '',
+      '  gpt-5.6-sol medium · ~/repo',
+      '  ? for shortcuts'
+    ]
+    expect(isQuietReadyScreenBody('', 'codex', () => screenLines)).toBe(true)
+    const composer = screenLines.indexOf('› Ask Codex to do anything')
+    const busy = [
+      ...screenLines.slice(0, composer),
+      '• Working (3s • esc to interrupt)',
+      '  └ Tip: start a fresh idea with /new',
+      '',
+      ...screenLines.slice(composer)
+    ]
+    expect(isQuietReadyScreenBody('', 'codex', () => busy)).toBe(false)
+  })
+
+  it("reads 0.158's turn timestamp above the composer as the end of a quoted status row", () => {
+    // Live 0.158 screen after a worker answered with a status row verbatim (STA-8834).
+    const screenLines = [
+      '  === TASK ===',
+      '  Reply with exactly this line and nothing else: • Working (0s • esc to interrupt) — then call worker_done.',
+      '• • Working (0s • esc to interrupt)',
+      '• Ran orca-dev orchestration send --from term_f496fcd2-a874-4fa6-a9bd-550a515ac928 --dispatch-capability dcap_PTgPpvf-B…',
+      '  └ Sent msg_ff7be3f25d7e',
+      '    + Show details',
+      '• • Working (0s • esc to interrupt)',
+      '  11:15 PM',
+      '› Ask Codex to do anything',
+      '  GPT-6-Sol medium · ~/orca-lanes/sta8834/live3/scratch · Report task outcome',
+      '  ? for shortcuts'
+    ]
+    expect(isQuietReadyScreenBody('', 'codex', () => screenLines)).toBe(true)
+  })
+
+  it('settles a quiet composer under an answer asking "Would you like to proceed?"', () => {
+    const screenLines = [
+      '>_ OpenAI Codex (v0.158.0)',
+      '   ~/repo',
+      '',
+      '› tidy the README',
+      '',
+      '• Done. Would you like to proceed with the changelog too?',
+      '',
+      '› Ask Codex to do anything',
+      '',
+      '  ? for shortcuts'
+    ]
+    const waitText = screenLines.join('\n')
+    const verdict = evaluateTuiIdle({
+      record: { lastAgentStatus: null, lastOutputAt: 0, lastOscTitle: null },
+      readTailBlockedReason: () => detectTerminalWaitBlockedReason(waitText),
+      readPositiveBodyEvidence: () => isKnownReadyPromptBody(waitText, 'codex', () => screenLines),
+      readQuietReadyBodyEvidence: () =>
+        isQuietReadyScreenBody(waitText, 'codex', () => screenLines),
+      agent: 'codex',
+      firstPartyStatus: null,
+      quiescenceMs: QUIESCENCE_MS
+    })
+    expect(verdict.kind).toBe('ready-strong')
+  })
+})
+
+type Timing = { promptSentAtMs: number; chunks: [number, number][] }
+
+function readTimedFixture(name: string): { chunks: string[]; times: number[]; promptAt: number } {
+  const data = readRuntimeFixture(name)
+  const timing: Timing = JSON.parse(
+    readFileSync(join(__dirname, '__fixtures__', `${name}.timing.json`), 'utf8')
+  )
+  const chunks: string[] = []
+  let offset = 0
+  for (const [, length] of timing.chunks) {
+    chunks.push(data.slice(offset, offset + length))
+    offset += length
+  }
+  expect(offset).toBe(data.length)
+  return { chunks, times: timing.chunks.map(([at]) => at), promptAt: timing.promptSentAtMs }
+}
+
+describe('the quiet lane over recorded chunk timing (default animations)', () => {
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it.each(TIMED_FIXTURES)(
+    '%s: never settles mid-turn, and settles once the finished turn is quiet',
+    async (name) => {
+      const { chunks, times, promptAt } = readTimedFixture(name)
+      const frames = await collectFrames(chunks)
+      // Why after the replay: the emulator's write flush runs on real timers.
+      vi.useFakeTimers()
+      const lastBusy = frames.findLastIndex((frame) => BUSY_STATUS_RE.test(screenOf(frame)))
+      const firstTurnChunk = times.findIndex((at) => at >= promptAt)
+      expect(lastBusy).toBeGreaterThan(firstTurnChunk)
+      // The latest moment each frame stays on screen: just before the next chunk lands.
+      const settlesAt = (index: number, now: number): boolean => {
+        vi.setSystemTime(now)
+        return hasQuietReadyScreen(
+          { lastAgentStatus: null, lastOutputAt: times[index]!, lastOscTitle: null },
+          'codex',
+          () =>
+            isQuietReadyScreenBody(
+              frames[index]!.waitText,
+              'codex',
+              () => frames[index]!.screenLines
+            ),
+          QUIESCENCE_MS
+        )
+      }
+      let readyBodyMidTurn = 0
+      for (let index = firstTurnChunk; index <= lastBusy; index += 1) {
+        if (isCodexComposerReadyScreen(screenOf(frames[index]!))) {
+          readyBodyMidTurn += 1
+        }
+        expect({ index, settles: settlesAt(index, times[index + 1]! - 1) }).toEqual({
+          index,
+          settles: false
+        })
+      }
+      // Presence precondition: the body alone does show mid-turn, so quiescence is load-bearing.
+      expect(readyBodyMidTurn).toBeGreaterThan(0)
+      const last = frames.length - 1
+      // Why +1: the fake clock keeps whole milliseconds; the recorded times do not.
+      expect(settlesAt(last, times[last]! + QUIESCENCE_MS + 1)).toBe(true)
+    },
+    120_000
+  )
+})
+
+describe('never less ready than origin/main', () => {
+  const records = [
+    { lastAgentStatus: null, lastOutputAt: 0, lastOscTitle: null },
+    { lastAgentStatus: 'idle' as const, lastOutputAt: 0, lastOscTitle: 'codex' },
+    { lastAgentStatus: 'working' as const, lastOutputAt: 0, lastOscTitle: '⠋ repo' }
+  ]
+  describe.each([
+    [120, 40],
+    [80, 24]
+  ])('at %ix%i', (cols, rows) => {
+    it.each([...SETTLED_IDLE_FIXTURES, ...DIALOG_FIXTURES, ...STA_8628_FIXTURES])(
+      '%s',
+      async (name) => {
+        for (const frame of await collectFrames(readRuntimeFixture(name), cols, rows)) {
+          for (const agent of ['codex', null] as const) {
+            const base = {
+              readTailBlockedReason: () => detectTerminalWaitBlockedReason(frame.waitText),
+              readPositiveBodyEvidence: () =>
+                isKnownReadyPromptBody(frame.waitText, agent, () => frame.screenLines),
+              agent,
+              firstPartyStatus: null,
+              quiescenceMs: QUIESCENCE_MS
+            } satisfies Omit<TuiIdleEvaluationInput, 'record' | 'readQuietReadyBodyEvidence'>
+            for (const record of records) {
+              const before = evaluateTuiIdle({
+                ...base,
+                record,
+                // Why a withheld screen: that leaves exactly main's Muse lane, the only widening.
+                readQuietReadyBodyEvidence: () =>
+                  isQuietReadyScreenBody(frame.waitText, agent, () => null)
+              })
+              const after = evaluateTuiIdle({
+                ...base,
+                record,
+                readQuietReadyBodyEvidence: () =>
+                  isQuietReadyScreenBody(frame.waitText, agent, () => frame.screenLines)
+              })
+              if (isTuiIdleReadyVerdict(before)) {
+                expect(isTuiIdleReadyVerdict(after)).toBe(true)
+              }
+            }
+          }
+        }
+      },
+      60_000
+    )
+  })
+})
+
+describe('agent gate', () => {
+  const placeholderScreen = ['› Ask Codex to do anything', '  ? for shortcuts']
+
+  it("never reads another agent's screen, even one showing Codex's placeholder", () => {
+    const readScreenLines = vi.fn(() => placeholderScreen)
+    for (const agent of ['claude', 'muse', 'gemini'] as const) {
+      expect(isQuietReadyScreenBody('', agent, readScreenLines)).toBe(false)
+    }
+    expect(readScreenLines).not.toHaveBeenCalled()
+    expect(isQuietReadyScreenBody('', 'codex', readScreenLines)).toBe(true)
+  })
+
+  it('leaves an agent-unknown pane showing a cat-ed Codex transcript pending', () => {
+    const catted = ['$ cat session.log', '› Ask Codex to do anything', '  ? for shortcuts', '$ ']
+    const readScreenLines = vi.fn(() => catted)
+    expect(isQuietReadyScreenBody(catted.join('\n'), null, readScreenLines)).toBe(false)
+    expect(readScreenLines).not.toHaveBeenCalled()
+    expect(isQuietReadyScreenBody('', 'codex', readScreenLines)).toBe(true)
+  })
+})
+
+describe('through the runtime', () => {
+  // Why 0.158 alone: its header carries no `model:`, so only this lane settles it.
+  const CODEX_0158 = 'codex-0-158-0-timed-turn'
+  async function pane(name: string, launchAgent: TuiAgent, size?: { cols: number; rows: number }) {
+    return createTranscriptPane({
+      paneTitle: 'Terminal',
+      foregroundProcess: launchAgent,
+      launchAgent,
+      data: readRuntimeFixture(name),
+      size
+    })
+  }
+
+  // Why 8s: quiescence (3s) plus the 2s poll re-reading the grid.
+  it('codex 0.158: a tui-idle wait settles once the composer is quiet', async () => {
+    const { runtime, handle } = await pane(CODEX_0158, 'codex', { cols: 120, rows: 40 })
+    await expect(
+      runtime.waitForTerminal(handle, { condition: 'tui-idle', timeoutMs: 8_000 })
+    ).resolves.toMatchObject({ condition: 'tui-idle', satisfied: true })
+  }, 15_000)
+
+  it('keeps a Claude pane showing the same screen pending', async () => {
+    const { runtime, handle } = await pane(CODEX_0158, 'claude', {
+      cols: 120,
+      rows: 40
+    })
+    await expect(
+      runtime.waitForTerminal(handle, { condition: 'tui-idle', timeoutMs: 6_000 })
+    ).rejects.toThrow(/timeout/)
+  }, 15_000)
+})
diff --git a/src/main/runtime/codex-startup-dialog-transcripts.test.ts b/src/main/runtime/codex-startup-dialog-transcripts.test.ts
new file mode 100644
index 00000000000..01dbe447304
--- /dev/null
+++ b/src/main/runtime/codex-startup-dialog-transcripts.test.ts
@@ -0,0 +1,198 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { RuntimeTerminalWaitBlockedReason } from '../../shared/runtime-types'
+import { createTranscriptPane } from './agent-transcript-pane-test-harness'
+import {
+  readRuntimeFixture,
+  replayTranscript,
+  type TranscriptReplayFrame
+} from './agent-transcript-replay-test-harness'
+import { detectTerminalWaitBlockedReason, isKnownReadyPromptBody } from './terminal-wait-detection'
+
+vi.mock('electron', () => ({
+  BrowserWindow: { fromId: vi.fn(() => null) },
+  webContents: { fromId: vi.fn(() => null) },
+  ipcMain: { on: vi.fn(), removeListener: vi.fn() },
+  app: { getPath: vi.fn(() => '/tmp') }
+}))
+
+type StartupDialog = {
+  name: string
+  reason: RuntimeTerminalWaitBlockedReason
+  heading: string
+  keyRow: string
+}
+
+// codex-cli 0.157.0 / 0.158.0 recordings at 120x40 on a fresh CODEX_HOME (see each .meta.json).
+// Each dialog owns Enter, and none prints the `Press enter to …` wording older builds did.
+const DIALOGS: StartupDialog[] = [
+  {
+    // Recorded separately on 0.157.1 (STA-8834).
+    name: 'codex-0-157-1-update-dialog',
+    reason: 'agent-update-prompt',
+    heading: 'Update available ·',
+    keyRow: 'enter continue · esc skip'
+  },
+  {
+    name: 'codex-0157-update-available-dialog',
+    reason: 'agent-update-prompt',
+    heading: 'Update available ·',
+    keyRow: 'enter continue · esc skip'
+  },
+  {
+    name: 'codex-0158-update-available-dialog',
+    reason: 'agent-update-prompt',
+    heading: 'Update available ·',
+    keyRow: 'enter continue · esc skip'
+  },
+  {
+    name: 'codex-0157-hooks-review-dialog',
+    reason: 'agent-hooks-review-prompt',
+    heading: 'Hooks need review',
+    keyRow: 'enter confirm · esc skip'
+  },
+  {
+    name: 'codex-0158-hooks-review-dialog',
+    reason: 'agent-hooks-review-prompt',
+    heading: 'Hooks need review',
+    keyRow: 'enter confirm · esc skip'
+  },
+  {
+    name: 'codex-0157-model-retired-dialog',
+    reason: 'codex-model-migration-prompt',
+    heading: 'is no longer available',
+    keyRow: 'enter/esc continue · ctrl+c quit'
+  },
+  {
+    name: 'codex-0158-model-retired-dialog',
+    reason: 'codex-model-migration-prompt',
+    heading: 'is no longer offered',
+    keyRow: 'enter/esc continue · ctrl+c quit'
+  },
+  {
+    name: 'codex-0158-model-announcement-dialog',
+    reason: 'codex-model-migration-prompt',
+    heading: 'Try new model',
+    keyRow: 'enter/esc confirm · ctrl+c quit'
+  }
+]
+const DIALOGS_0158 = DIALOGS.filter((dialog) => dialog.name.startsWith('codex-0158-'))
+const LIVE_CHAT_FIXTURES = [
+  'codex-0157-plain-ready',
+  'codex-0157-effort-override-embedded-warning',
+  'codex-0157-config-override-embedded-warning',
+  'codex-0157-no-daemon-effort-override',
+  'codex-0157-fresh-home-daemon-install',
+  'codex-0158-fresh-home-greeting'
+]
+
+function screenText(frame: TranscriptReplayFrame): string {
+  return frame.screenLines.join('\n')
+}
+
+async function lastFrame(data: string): Promise<TranscriptReplayFrame | null> {
+  let last: TranscriptReplayFrame | null = null
+  for await (const frame of replayTranscript(data, 120, 40)) {
+    last = frame
+  }
+  return last
+}
+
+// Why stitched: no capture spans answering a dialog. Codex repaints every cell once a startup
+// dialog closes, so the 0.158 greeting capture's paints stand in for that repaint.
+function answered(name: string): string {
+  const greeting = readRuntimeFixture('codex-0158-fresh-home-greeting')
+  return readRuntimeFixture(name) + greeting.slice(greeting.indexOf('\x1b[?2026h'))
+}
+
+describe('Codex 0.157/0.158 startup dialogs from captured bytes', () => {
+  it.each(DIALOGS)(
+    '$name: reports $reason from its key row on, and never reads ready while it is up',
+    async ({ name, reason, heading, keyRow }) => {
+      let headingFrames = 0
+      let keyRowFrames = 0
+      for await (const frame of replayTranscript(readRuntimeFixture(name), 120, 40)) {
+        const screen = screenText(frame)
+        if (screen.includes(heading)) {
+          headingFrames += 1
+          expect(isKnownReadyPromptBody(frame.waitText, 'codex', () => frame.screenLines)).toBe(
+            false
+          )
+        }
+        if (keyRowFrames > 0 || screen.includes(keyRow)) {
+          keyRowFrames += 1
+          expect(detectTerminalWaitBlockedReason(frame.waitText)).toBe(reason)
+        }
+      }
+      // Presence precondition: the dialog and its key row were painted, not just parsed.
+      expect(headingFrames).toBeGreaterThan(0)
+      expect(keyRowFrames).toBeGreaterThan(0)
+    }
+  )
+
+  it.each(DIALOGS_0158)(
+    '$name: stops reporting once Codex repaints its chat after it',
+    async ({ name, heading }) => {
+      const last = await lastFrame(answered(name))
+      // Presence precondition: the answered dialog is still in the text copy.
+      expect(last?.waitText).toContain(heading.replace(' ·', ''))
+      expect(detectTerminalWaitBlockedReason(last?.waitText ?? '')).toBeNull()
+    }
+  )
+
+  it.each(DIALOGS)(
+    '$name: still reports $reason when Codex is relaunched in the same pane and shows it again',
+    async ({ name, reason }) => {
+      // Why: quitting Codex from a dialog leaves that copy in the text copy ahead of the relaunch.
+      const dialog = readRuntimeFixture(name)
+      const last = await lastFrame(`${dialog}\x1b[?1049l\r\n% codex\r\n${dialog}`)
+      expect(detectTerminalWaitBlockedReason(last?.waitText ?? '')).toBe(reason)
+      expect(
+        isKnownReadyPromptBody(last?.waitText ?? '', 'codex', () => last?.screenLines ?? null)
+      ).toBe(false)
+    }
+  )
+
+  it.each(LIVE_CHAT_FIXTURES)('%s: a live chat reports no dialog', async (name) => {
+    const waitText = (await lastFrame(readRuntimeFixture(name)))?.waitText ?? ''
+    expect(detectTerminalWaitBlockedReason(waitText)).toBeNull()
+    // Why these lines: chat can name a dialog, and Codex's own update notice and footer draw `·`.
+    const chat = [
+      '› is there an update available, and do my hooks need review?',
+      '✨ Update available! 0.158.0 -> 0.159.0',
+      'Run npm install -g @openai/codex to update.',
+      '  gpt-6-astra default · ~/repo',
+      '  ← for agents · ? for shortcuts'
+    ].join('\n')
+    expect(detectTerminalWaitBlockedReason(`${waitText}\n${chat}`)).toBeNull()
+  })
+
+  it('does not name a mid-session Codex popup a hooks review', () => {
+    // Why: Codex's rate-limit reset popup (and other pickers) ends `enter confirm · esc back`.
+    const popup = [
+      '  Use this reset?',
+      '  1. Yes, use reset  Reset your weekly and 5-hour usage limits.',
+      '› 2. No, go back     Choose a different reset',
+      '  enter confirm · esc back'
+    ].join('\n')
+    expect(detectTerminalWaitBlockedReason(popup)).not.toBe('agent-hooks-review-prompt')
+  })
+
+  describe('through the runtime', () => {
+    it.each(DIALOGS)(
+      '$name: stops a tui-idle wait as $reason instead of typing into it',
+      async ({ name, reason }) => {
+        const { runtime, handle } = await createTranscriptPane({
+          paneTitle: 'Terminal',
+          foregroundProcess: 'codex',
+          launchAgent: 'codex',
+          data: readRuntimeFixture(name),
+          size: { cols: 120, rows: 40 }
+        })
+        await expect(
+          runtime.waitForTerminal(handle, { condition: 'tui-idle', timeoutMs: 2_500 })
+        ).resolves.toMatchObject({ satisfied: false, blockedReason: reason })
+      },
+      15_000
+    )
+  })
+})
diff --git a/src/main/runtime/codex-terminal-readiness.ts b/src/main/runtime/codex-terminal-readiness.ts
new file mode 100644
index 00000000000..cdbc8903d21
--- /dev/null
+++ b/src/main/runtime/codex-terminal-readiness.ts
@@ -0,0 +1,84 @@
+// Why both shapes: 0.150-0.157 paint `model: loading` in a box, 0.158 a bare `loading` under the title.
+const CODEX_HEADER_LOADING_RE = /(?:model|directory):\s+loading|^\s*loading\s*$/m
+// Why a line cap: 0.158 draws no box, so nothing else ends its header before the chat.
+const CODEX_HEADER_LINES = 6
+// Why the whole line: a pager, a `cat`ed transcript, or chat can quote the placeholder mid-line.
+const CODEX_EMPTY_COMPOSER_RE = /^› ask codex to do anything\s*$/
+// Why not "working": reasoning summaries replace it, and a remapped key still ends this way.
+const CODEX_BUSY_STATUS_MARKER = 'to interrupt)'
+// Why only a tip: it is the one line Codex draws between its status row and the composer (120x40 corpus).
+const CODEX_STATUS_TIP_PREFIX = '└ tip:'
+
+// Why the header only: chat below it can mention "OpenAI Codex" or `model: loading`.
+function findCodexHeader(screen: string): { index: number; text: string } | null {
+  const index = screen.indexOf('openai codex')
+  if (index === -1) {
+    return null
+  }
+  const boxEnd = screen.indexOf('╰', index)
+  const text = screen
+    .slice(index, boxEnd === -1 ? undefined : boxEnd)
+    .split('\n', CODEX_HEADER_LINES)
+    .join('\n')
+  return { index, text }
+}
+
+/** Tier 1: the 0.150-0.157 header, which only a grid reassembles (see isKnownReadyPromptBody). */
+export function findCodexScreenReadyPromptIndex(screen: string): number | null {
+  const header = findCodexHeader(screen)
+  return header !== null &&
+    header.text.includes('model:') &&
+    header.text.includes('directory:') &&
+    !CODEX_HEADER_LOADING_RE.test(header.text)
+    ? header.index
+    : null
+}
+
+// Why the text copy: 0.157 leaves its alternate screen while it starts its daemon, so the live
+// screen shows no header then, while the text copy keeps the provisional one until the live chat
+// paints its footer after it (a later model repaint rewrites only the value, never the label).
+// Why `·`: every live footer row draws one (status row, `← for agents · ?`, `⚠ N warning · f2`);
+// startup dialogs draw one too, which is why startup-dialog-blocked-signals.ts matches them first.
+export function isCodexProvisionalStartupText(normalized: string): boolean {
+  const headerIndex = normalized.lastIndexOf('openai codex')
+  if (headerIndex === -1) {
+    return false
+  }
+  const loading = /model:\s+loading/.exec(normalized.slice(headerIndex))
+  return loading !== null && !normalized.includes('·', headerIndex + loading.index)
+}
+
+// Why: Codex repaints its whole screen, header included, once a startup dialog closes, and the
+// dialog never draws the header; 0.158's header has no labels, so the header alone marks it answered.
+export function findCodexHeaderIndex(normalized: string): number | null {
+  const index = normalized.lastIndexOf('openai codex (v')
+  return index === -1 ? null : index
+}
+
+/**
+ * Tier 1b, codex panes only: the empty composer with no busy status row just above it and no
+ * header load. Codex 0.158 dropped `model:`/`directory:`, and a long session scrolls the header
+ * away, so this is its only version-stable rest body. No dialog check: every Codex dialog
+ * replaces the composer, while an answer ending "Would you like to…?" must not block the lane.
+ * The mid-turn guard is the caller's quiescence, fed by the ~100 ms title spinner and status
+ * timer; `tui.animations=false` (set by a screen reader), `tui.effects.progress=false`, or a
+ * `tui.terminal_title` without activity/spinner removes it.
+ */
+export function isCodexComposerReadyScreen(screen: string): boolean {
+  const lines = screen.split('\n')
+  const composer = lines.findLastIndex((line) => CODEX_EMPTY_COMPOSER_RE.test(line))
+  if (composer === -1 || hasBusyStatusRowAbove(lines, composer)) {
+    return false
+  }
+  const header = findCodexHeader(screen)
+  return header === null || !CODEX_HEADER_LOADING_RE.test(header.text)
+}
+
+// Why only the row above the composer: a finished answer (or one above 0.158's timestamp) can quote it.
+function hasBusyStatusRowAbove(lines: readonly string[], composer: number): boolean {
+  const above = lines.slice(0, composer).filter((line) => line.trim() !== '')
+  const row = above.at(-1)?.trimStart().startsWith(CODEX_STATUS_TIP_PREFIX)
+    ? above.at(-2)
+    : above.at(-1)
+  return row?.includes(CODEX_BUSY_STATUS_MARKER) ?? false
+}
diff --git a/src/main/runtime/created-mobile-session-tab-caller-selection.test.ts b/src/main/runtime/created-mobile-session-tab-caller-selection.test.ts
new file mode 100644
index 00000000000..65fc065a5a3
--- /dev/null
+++ b/src/main/runtime/created-mobile-session-tab-caller-selection.test.ts
@@ -0,0 +1,114 @@
+/**
+ * A tab a create just published becomes one paired client's selection: the shared snapshot the host
+ * and unselected clients follow stays put, and no PTY work runs — unlike a tap, which may respawn.
+ */
+import { expect, it, vi } from 'vitest'
+import { parsePaneKey } from '../../shared/stable-pane-id'
+import type { RuntimeMobileSessionTabsResult } from '../../shared/runtime-types'
+
+// Fragments stay side-effect ordered: mocks, then lifecycle, then fixtures.
+const { OrcaRuntimeService } = await import('./orca-runtime-test-mocks.spec')
+await import('./orca-runtime-test-lifecycle.spec')
+const { store, TEST_WORKTREE_ID, HEADLESS_LEAF_ID } =
+  await import('./orca-runtime-test-fixtures.spec')
+const { makePendingAgentTabActivationRuntime } =
+  await import('./orca-runtime-test-scenario-builders.spec')
+
+const WT = TEST_WORKTREE_ID
+
+function pairedRuntime() {
+  let next = 0
+  const spawn = vi.fn(async () => ({ id: `pty-${++next}` }))
+  const runtime = new OrcaRuntimeService(store)
+  runtime.setPtyController({
+    spawn,
+    write: () => true,
+    kill: () => true,
+    getForegroundProcess: async () => null
+  })
+  const caller: RuntimeMobileSessionTabsResult[] = []
+  runtime.onMobileSessionTabsChanged((snapshot) => caller.push(snapshot), 'device-caller')
+  // A subscribed second device: selection that fans out to live clients would move it too.
+  runtime.onMobileSessionTabsChanged(() => {}, 'device-bystander')
+  return { runtime, spawn, caller }
+}
+
+async function createPane(runtime: InstanceType<typeof OrcaRuntimeService>) {
+  const created = await runtime.createTerminal(`id:${WT}`)
+  const pane = parsePaneKey(created.paneKey ?? '')
+  if (!pane) {
+    throw new Error(`createTerminal returned no pane key: ${created.paneKey}`)
+  }
+  return { tabId: pane.tabId, leafId: pane.leafId, id: `${pane.tabId}::${pane.leafId}` }
+}
+
+it('selects a launched terminal for the caller only, without spawning again', async () => {
+  const { runtime, spawn, caller } = pairedRuntime()
+  const first = await createPane(runtime)
+  const launched = await createPane(runtime)
+  expect((await runtime.listMobileSessionTabs(`id:${WT}`)).activeTabId).toBe(first.id)
+
+  expect(runtime.selectCreatedMobileSessionTabForClient(WT, launched, 'device-caller')).toBe(true)
+
+  expect(caller.at(-1)?.activeTabId).toBe(launched.id)
+  expect((await runtime.listMobileSessionTabs(`id:${WT}`, 'device-caller')).activeTabId).toBe(
+    launched.id
+  )
+  expect((await runtime.listMobileSessionTabs(`id:${WT}`)).activeTabId).toBe(first.id)
+  expect((await runtime.listMobileSessionTabs(`id:${WT}`, 'device-bystander')).activeTabId).toBe(
+    first.id
+  )
+  expect(spawn).toHaveBeenCalledTimes(2)
+})
+
+it('selects a launched chat by its session for the caller only', async () => {
+  const { runtime, caller } = pairedRuntime()
+  const first = await createPane(runtime)
+  await runtime.publishStructuredAgentSessionTab({
+    workspaceId: WT,
+    sessionId: 'sess-1',
+    agent: 'claude',
+    activate: false
+  })
+
+  expect(
+    runtime.selectCreatedMobileSessionTabForClient(WT, { sessionId: 'sess-1' }, 'device-caller')
+  ).toBe(true)
+
+  expect(caller.at(-1)?.activeTabId).toBe('agent-session:sess-1')
+  expect((await runtime.listMobileSessionTabs(`id:${WT}`)).activeTabId).toBe(first.id)
+  expect((await runtime.listMobileSessionTabs(`id:${WT}`, 'device-bystander')).activeTabId).toBe(
+    first.id
+  )
+})
+
+it('reports a tab that is not published instead of selecting something else', async () => {
+  const { runtime, caller } = pairedRuntime()
+  await createPane(runtime)
+  const before = caller.length
+
+  expect(
+    runtime.selectCreatedMobileSessionTabForClient(WT, { sessionId: 'missing' }, 'device-caller')
+  ).toBe(false)
+  expect(caller).toHaveLength(before)
+})
+
+it('never materializes a pane that is not ready, as a tap would', async () => {
+  const { runtime, spawn } = makePendingAgentTabActivationRuntime()
+  const listed = await runtime.listMobileSessionTabs(`id:${WT}`)
+  expect(listed.tabs[0]).toMatchObject({ launchAgent: 'claude', status: 'pending-handle' })
+
+  expect(
+    runtime.selectCreatedMobileSessionTabForClient(
+      WT,
+      { tabId: 'host-tab', leafId: HEADLESS_LEAF_ID },
+      'device-caller'
+    )
+  ).toBe(true)
+
+  const selected = await runtime.listMobileSessionTabs(`id:${WT}`, 'device-caller')
+  expect(selected.activeTabId).toBe(`host-tab::${HEADLESS_LEAF_ID}`)
+  // Why wait: a tap's respawn lands several awaits later, so an immediate check cannot see one.
+  await new Promise((resolve) => setTimeout(resolve, 200))
+  expect(spawn).not.toHaveBeenCalled()
+})
diff --git a/src/main/runtime/dsh-readiness-transcript.test.ts b/src/main/runtime/dsh-readiness-transcript.test.ts
new file mode 100644
index 00000000000..36608b987b0
--- /dev/null
+++ b/src/main/runtime/dsh-readiness-transcript.test.ts
@@ -0,0 +1,71 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { createDraftPasteReadyScanner } from '../../shared/draft-paste-ready-scanner'
+import {
+  getAgentLabel,
+  isGeminiTerminalTitle,
+  resolveExplicitTerminalTitleAgentType
+} from '../../shared/terminal-title-agent-type'
+
+// The committed capture of a real `dsh-tui` 0.10.2 launch on @deepseek-ai/dsh 0.1.5-rc.1.
+// Every rule below is written against these bytes rather than a remembered screen; see
+// docs/reference/agent-pty-transcript-capture.md.
+const TRANSCRIPT = readFileSync(join(__dirname, '__fixtures__', 'dsh-tui-ready-no-key.txt'), 'utf8')
+
+const ESC = String.fromCharCode(27)
+const BEL = String.fromCharCode(7)
+
+/** The OSC 0 title DSH-TUI sets, read back out of the capture. */
+function readFirstOscTitle(data: string): string {
+  // Indexed scan rather than a regex: the delimiters are control characters.
+  const open = data.indexOf(`${ESC}]0;`)
+  const bodyStart = open === -1 ? -1 : open + 4
+  const terminator = bodyStart === -1 ? -1 : data.indexOf(BEL, bodyStart)
+  if (terminator === -1) {
+    throw new Error('the captured transcript carries no BEL-terminated OSC 0 title')
+  }
+  return data.slice(bodyStart, terminator)
+}
+
+describe('DSH-TUI readiness from captured terminal bytes', () => {
+  it('fires the composer-ready signal well before the transcript ends', () => {
+    const scanner = createDraftPasteReadyScanner('dsh-composer-prompt')
+    let readyAt = -1
+    // Feed it in PTY-sized chunks so a marker split across chunk boundaries is exercised.
+    for (let offset = 0; offset < TRANSCRIPT.length; offset += 1024) {
+      const chunk = TRANSCRIPT.slice(offset, offset + 1024)
+      if (scanner.observe(chunk).ready && readyAt === -1) {
+        readyAt = offset + chunk.length
+      }
+    }
+    // The composer glyph lands at byte 5910 of ~70KB: readiness must not wait out the
+    // whale intro that keeps painting behind it (the grok failure mode this signal fixes).
+    expect(readyAt).toBeGreaterThan(0)
+    expect(readyAt).toBeLessThan(8192)
+  })
+
+  it('arms the quiet-window fallback from DECSET 2004 as well', () => {
+    const scanner = createDraftPasteReadyScanner('dsh-composer-prompt')
+    expect(scanner.observe(TRANSCRIPT.slice(0, 40)).armQuietTimer).toBe(true)
+  })
+
+  it('identifies the pane from DSH’s own title, not Gemini’s', () => {
+    const title = readFirstOscTitle(TRANSCRIPT)
+    // DSH-TUI's idle prefix is `✦`, which is Gemini CLI's WORKING glyph.
+    expect(title).toContain('✦')
+    expect(title).toContain('\u{1F40B}')
+    expect(isGeminiTerminalTitle(title)).toBe(false)
+    expect(getAgentLabel(title)).toBe('DeepSeek Harness')
+    expect(resolveExplicitTerminalTitleAgentType(title)).toBe('dsh')
+  })
+
+  it('keeps a working DSH title out of Claude’s braille-spinner lane', () => {
+    // `titlePrefix` cycles through `⠂`/`⠐` while a turn runs (Chat.js
+    // TITLE_SPINNER_FRAMES), both of which are in the braille block Claude claims.
+    for (const frame of ['⠂', '⠐']) {
+      const working = `${frame} \u{1F40B} fix the flaky test`
+      expect(getAgentLabel(working)).toBe('DeepSeek Harness')
+    }
+  })
+})
diff --git a/src/main/runtime/folder-workspace-pty-identity.test.ts b/src/main/runtime/folder-workspace-pty-identity.test.ts
index db14f74bad8..43eb15f66b3 100644
--- a/src/main/runtime/folder-workspace-pty-identity.test.ts
+++ b/src/main/runtime/folder-workspace-pty-identity.test.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
 import { describe, expect, it } from 'vitest'
 import { getDefaultWorkspaceSession } from '../../shared/constants'
 import type { RuntimeClientEvent } from '../../shared/runtime-client-events'
@@ -66,7 +67,8 @@ function createRuntimeInternals(
     [WORKSPACE_A]: { hostId: 'local' },
     [WORKSPACE_B]: { hostId: 'local' }
   }
-  const store = {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This runtime fixture supplies the persistence and graph methods exercised by the test.
+  const store = withDurableRuntimeStore({
     getRepos: () => [REPO],
     getRepo: (id: string) => (id === REPO_ID ? REPO : undefined),
     getAllWorktreeMeta: () => meta,
@@ -78,7 +80,7 @@ function createRuntimeInternals(
     getWorkspaceSession: () => options.session ?? getDefaultWorkspaceSession(),
     setWorkspaceSession: () => {},
     flushOrThrow: () => {}
-  } as never
+  }) as never
   const runtime = new OrcaRuntimeService(store)
   runtime.setPtyController({
     write: () => true,
diff --git a/src/main/runtime/freebuff-status-transcript.test.ts b/src/main/runtime/freebuff-status-transcript.test.ts
new file mode 100644
index 00000000000..04aa1e0a2ab
--- /dev/null
+++ b/src/main/runtime/freebuff-status-transcript.test.ts
@@ -0,0 +1,146 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import { createTranscriptPane, TRANSCRIPT_PANE_PTY_ID } from './agent-transcript-pane-test-harness'
+import { makeAgentStatusStoreWiring } from './agent-status-store-wiring.test-fixture'
+
+vi.mock('electron', () => ({
+  BrowserWindow: { fromId: vi.fn(() => null) },
+  webContents: { fromId: vi.fn(() => null) },
+  ipcMain: { on: vi.fn(), removeListener: vi.fn() },
+  app: { getPath: vi.fn(() => '/tmp') }
+}))
+
+const transcript = readFileSync(
+  join(import.meta.dirname, '__fixtures__/freebuff-lifecycle.txt'),
+  'utf8'
+)
+
+describe('Freebuff execution-host status', () => {
+  it('publishes real running, question, and settled screens into the canonical store', async () => {
+    const wiring = makeAgentStatusStoreWiring()
+    const { runtime } = await createTranscriptPane(
+      {
+        data: '',
+        paneTitle: 'Freebuff',
+        foregroundProcess: 'freebuff',
+        launchAgent: 'freebuff',
+        size: { cols: 120, rows: 40 }
+      },
+      wiring.deps
+    )
+    const states: string[] = []
+    const questions: string[] = []
+    try {
+      // oxlint-disable-next-line no-control-regex -- Terminal protocol delimiters contain ESC and BEL.
+      for (const frame of transcript.split(/(?<=\x1b\[\?2026l)/)) {
+        runtime.onPtyData(TRANSCRIPT_PANE_PTY_ID, frame, Date.now())
+        await runtime.serializeMainTerminalBuffer(TRANSCRIPT_PANE_PTY_ID)
+        const row = wiring.statusStore.getStatusSnapshot()[0]
+        if (row && states.at(-1) !== row.state) {
+          states.push(row.state)
+        }
+        if (row?.interactivePrompt) {
+          questions.push(row.interactivePrompt)
+        }
+      }
+      expect(states).toContain('working')
+      expect(states).toContain('waiting')
+      expect(states.at(-1)).toBe('done')
+      expect(questions.join('\n')).toMatch(/blue|green/i)
+    } finally {
+      runtime.onPtyExit(TRANSCRIPT_PANE_PTY_ID, 0)
+    }
+  })
+  it.each([
+    { name: 'login', cols: 100, rows: 32, input: 'Sign in to Freebuff' },
+    { name: 'trust', cols: 120, rows: 40, input: 'Trust repository agent files? [y/N]' }
+  ])('publishes captured $name startup as blocked', async ({ name, cols, rows, input }) => {
+    const wiring = makeAgentStatusStoreWiring()
+    const { runtime } = await createTranscriptPane(
+      {
+        data: '',
+        paneTitle: 'Freebuff',
+        foregroundProcess: 'freebuff',
+        launchAgent: 'freebuff',
+        size: { cols, rows }
+      },
+      wiring.deps
+    )
+    try {
+      runtime.onPtyData(
+        TRANSCRIPT_PANE_PTY_ID,
+        readFileSync(join(import.meta.dirname, `__fixtures__/freebuff-${name}.txt`), 'utf8'),
+        Date.now()
+      )
+      await runtime.serializeMainTerminalBuffer(TRANSCRIPT_PANE_PTY_ID)
+      expect(wiring.statusStore.getStatusSnapshot()[0]).toMatchObject({
+        state: 'blocked',
+        toolInput: input,
+        agentType: 'freebuff'
+      })
+    } finally {
+      runtime.onPtyExit(TRANSCRIPT_PANE_PTY_ID, 0)
+    }
+  })
+
+  it('clears startup blocks and starts a fresh session after an earlier completed turn', async () => {
+    const wiring = makeAgentStatusStoreWiring()
+    const { runtime } = await createTranscriptPane(
+      {
+        data: '',
+        paneTitle: 'Freebuff',
+        foregroundProcess: 'freebuff',
+        launchAgent: 'freebuff',
+        size: { cols: 120, rows: 40 }
+      },
+      wiring.deps
+    )
+    try {
+      for (const name of ['trust', 'ready', 'lifecycle', 'ready']) {
+        runtime.onPtyData(
+          TRANSCRIPT_PANE_PTY_ID,
+          readFileSync(join(import.meta.dirname, `__fixtures__/freebuff-${name}.txt`), 'utf8'),
+          Date.now()
+        )
+        await runtime.serializeMainTerminalBuffer(TRANSCRIPT_PANE_PTY_ID)
+        expect(wiring.statusStore.getStatusSnapshot()[0]?.state).toBe(
+          name === 'trust' ? 'blocked' : 'done'
+        )
+        if (name === 'ready') {
+          expect(wiring.statusStore.getStatusSnapshot()[0]).toMatchObject({
+            sessionBoundary: true,
+            prompt: ''
+          })
+        }
+        if (name === 'lifecycle') {
+          expect(wiring.statusStore.getStatusSnapshot()[0]?.sessionBoundary).not.toBe(true)
+        }
+      }
+      expect(wiring.statusStore.getStatusSnapshot()[0]?.toolInput).toBeUndefined()
+    } finally {
+      runtime.onPtyExit(TRANSCRIPT_PANE_PTY_ID, 0)
+    }
+  })
+
+  it('does not infer remote status from the client screen', async () => {
+    const wiring = makeAgentStatusStoreWiring()
+    const { runtime } = await createTranscriptPane(
+      {
+        data: '',
+        paneTitle: 'Freebuff',
+        foregroundProcess: 'freebuff',
+        connectionId: 'ssh-test',
+        size: { cols: 120, rows: 40 }
+      },
+      wiring.deps
+    )
+    try {
+      runtime.onPtyData(TRANSCRIPT_PANE_PTY_ID, transcript, Date.now())
+      await runtime.serializeMainTerminalBuffer(TRANSCRIPT_PANE_PTY_ID)
+      expect(wiring.statusStore.getStatusSnapshot()).toEqual([])
+    } finally {
+      runtime.onPtyExit(TRANSCRIPT_PANE_PTY_ID, 0)
+    }
+  })
+})
diff --git a/src/main/runtime/freebuff-terminal-status.ts b/src/main/runtime/freebuff-terminal-status.ts
new file mode 100644
index 00000000000..09ffee3d50d
--- /dev/null
+++ b/src/main/runtime/freebuff-terminal-status.ts
@@ -0,0 +1,25 @@
+import { FreebuffScreenStatusTracker } from '../../shared/freebuff-screen-status'
+import { recognizeAgentProcessFromCommandLine } from '../../shared/agent-process-recognition'
+import type { HeadlessEmulator } from '../daemon/headless-emulator'
+
+const trackers = new WeakMap<HeadlessEmulator, FreebuffScreenStatusTracker>()
+
+export function observeFreebuffTerminalStatus(
+  emulator: HeadlessEmulator,
+  data: string,
+  startupCommand: string | undefined,
+  launchAgent?: string | null
+) {
+  let tracker = trackers.get(emulator)
+  if (!tracker) {
+    const identified =
+      launchAgent === 'freebuff' ||
+      recognizeAgentProcessFromCommandLine(startupCommand)?.agent === 'freebuff'
+    tracker = new FreebuffScreenStatusTracker(identified)
+    trackers.set(emulator, tracker)
+  }
+  return tracker.observe(data, () => ({
+    lines: emulator.getVisibleLines(),
+    alternate: emulator.isAlternateScreen
+  }))
+}
diff --git a/src/main/runtime/graph-sync-live-daemon-pty-tab-preservation.test.ts b/src/main/runtime/graph-sync-live-daemon-pty-tab-preservation.test.ts
index e91f18e8c6d..a824191bb90 100644
--- a/src/main/runtime/graph-sync-live-daemon-pty-tab-preservation.test.ts
+++ b/src/main/runtime/graph-sync-live-daemon-pty-tab-preservation.test.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
 /**
  * shouldPreserveHeadlessMobileSessionTab excludes the daemon ptyId form
  * <worktreeId>@@<uuid> from its runtime-owned checks, so a host-created terminal
@@ -51,7 +52,7 @@ function createHarness() {
   // Starts empty: only the create path may put this terminal in the session.
   let session: WorkspaceSessionState = { ...getDefaultWorkspaceSession() }
   const repo = makeRepo()
-  const store = {
+  const store = withDurableRuntimeStore({
     getRepos: () => [repo],
     getRepo: (id: string) => (id === REPO_ID ? repo : undefined),
     getAllWorktreeMeta: () => ({}),
@@ -63,7 +64,7 @@ function createHarness() {
       session = next
     },
     flushOrThrow: () => {}
-  }
+  })
   const runtime = new OrcaRuntimeService(store as never)
   runtime.setNotifier({
     closeTerminal: vi.fn(),
diff --git a/src/main/runtime/headless-close-keeps-publication-epoch.test.ts b/src/main/runtime/headless-close-keeps-publication-epoch.test.ts
index b33579b783c..1a0344f393b 100644
--- a/src/main/runtime/headless-close-keeps-publication-epoch.test.ts
+++ b/src/main/runtime/headless-close-keeps-publication-epoch.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it, vi } from 'vitest'
+import type { DurableProfileStateMutation } from '../persistence/loading-store/store-runtime-state'
 import { OrcaRuntimeService } from './orca-runtime'
 import { getDefaultWorkspaceSession } from '../../shared/constants'
 import type {
@@ -25,7 +26,7 @@ function makeStore() {
   return {
     getWorkspaceSession: vi.fn(() => session),
     setWorkspaceSession: vi.fn(),
-    flushOrThrow: vi.fn(),
+    runDurableMutation: async <T>(mutate: () => DurableProfileStateMutation<T>) => mutate().value,
     getRepos: vi.fn(() => [
       {
         id: 'repo-1',
@@ -68,7 +69,7 @@ function storedSnapshot(tabs: RuntimeMobileSessionTerminalTab[]): RuntimeMobileS
   }
 }
 
-function closeOneTab(): RuntimeMobileSessionTabsSnapshot {
+async function closeOneTab(): Promise<RuntimeMobileSessionTabsSnapshot> {
   // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: makeStore covers the reads this suite drives.
   const runtime = new OrcaRuntimeService(makeStore() as never)
   const closedTab = terminalTab('tab-a', LEAF_ID)
@@ -80,11 +81,11 @@ function closeOneTab(): RuntimeMobileSessionTabsSnapshot {
       snapshot: RuntimeMobileSessionTabsSnapshot,
       tab: RuntimeMobileSessionTerminalTab,
       options?: Record<string, unknown>
-    ) => void
+    ) => Promise<void>
     mobileSessionTabsByWorktree: Map<string, RuntimeMobileSessionTabsSnapshot>
   }
   internals.mobileSessionTabsByWorktree.set(WORKTREE_ID, snapshot)
-  internals.closeHeadlessMobileTerminalTab(WORKTREE_ID, snapshot, closedTab, {
+  await internals.closeHeadlessMobileTerminalTab(WORKTREE_ID, snapshot, closedTab, {
     allowMissingPersistedTab: true,
     killPtys: false
   })
@@ -96,12 +97,12 @@ function closeOneTab(): RuntimeMobileSessionTabsSnapshot {
 }
 
 describe('closing a headless mobile terminal tab', () => {
-  it('keeps the worktree under the epoch that was already publishing it', () => {
-    expect(closeOneTab().publicationEpoch).toBe(LIVE_EPOCH)
+  it('keeps the worktree under the epoch that was already publishing it', async () => {
+    expect((await closeOneTab()).publicationEpoch).toBe(LIVE_EPOCH)
   })
 
-  it('still advances the version so clients accept the frame', () => {
-    const published = closeOneTab()
+  it('still advances the version so clients accept the frame', async () => {
+    const published = await closeOneTab()
     expect(published.snapshotVersion).toBe(5)
     expect(published.tabs.map((tab) => tab.id)).toEqual([`tab-b::${LEAF_ID}`])
   })
diff --git a/src/main/runtime/headless-seed-ownership.test.ts b/src/main/runtime/headless-seed-ownership.test.ts
index 39963e531d2..42fe9c91660 100644
--- a/src/main/runtime/headless-seed-ownership.test.ts
+++ b/src/main/runtime/headless-seed-ownership.test.ts
@@ -184,13 +184,15 @@ it.each([false, true])(
     const started = makeDeferred()
     const release = makeDeferred()
     const original = HeadlessEmulator.prototype.write
-    vi.spyOn(HeadlessEmulator.prototype, 'write').mockImplementationOnce(
-      async function (this: HeadlessEmulator, data, options) {
-        started.resolve()
-        await release.promise
-        return original.call(this, data, options)
-      }
-    )
+    vi.spyOn(HeadlessEmulator.prototype, 'write').mockImplementationOnce(async function (
+      this: HeadlessEmulator,
+      data,
+      options
+    ) {
+      started.resolve()
+      await release.promise
+      return original.call(this, data, options)
+    })
     const read = runtime.providerTail(visibleOnly)
     snapshot.resolve(PROVIDER_SNAPSHOT)
     await started.promise
diff --git a/src/main/runtime/headless-terminal-dispose-write-ordering.test.ts b/src/main/runtime/headless-terminal-dispose-write-ordering.test.ts
index b26c7bfb62c..13efbb1e80a 100644
--- a/src/main/runtime/headless-terminal-dispose-write-ordering.test.ts
+++ b/src/main/runtime/headless-terminal-dispose-write-ordering.test.ts
@@ -71,12 +71,12 @@ describe('disposeHeadlessTerminal write ordering', () => {
       events.push(`write:${emulators.indexOf(this)}:${data.trim()}`)
       return write.call(this, data, opts)
     })
-    vi.spyOn(HeadlessEmulator.prototype, 'dispose').mockImplementation(
-      function (this: HeadlessEmulator) {
-        events.push(`dispose:${emulators.indexOf(this)}`)
-        return dispose.call(this)
-      }
-    )
+    vi.spyOn(HeadlessEmulator.prototype, 'dispose').mockImplementation(function (
+      this: HeadlessEmulator
+    ) {
+      events.push(`dispose:${emulators.indexOf(this)}`)
+      return dispose.call(this)
+    })
 
     const runtime = createRuntime()
     // Queued but not yet parsed: the chain link is still pending here.
diff --git a/src/main/runtime/host-terminal-close-persistence-durability.test.ts b/src/main/runtime/host-terminal-close-persistence-durability.test.ts
index 66a34f16ea6..642edd6cf17 100644
--- a/src/main/runtime/host-terminal-close-persistence-durability.test.ts
+++ b/src/main/runtime/host-terminal-close-persistence-durability.test.ts
@@ -62,7 +62,7 @@ describe('host-created terminal close durability', () => {
 
   it('a host-created terminal does NOT push a fresh repo into host-authoritative membership', async () => {
     const store = await makeStore()
-    store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
+    await store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
     const session = store.getWorkspaceSession()
     expect(session.tabsByWorktree?.[WT]?.map((t) => t.id)).toContain(TAB)
     // advanceTopologyFence (store.ts:3284) deliberately declines to arm the
@@ -73,14 +73,14 @@ describe('host-created terminal close durability', () => {
 
   it('a renderer close write durably removes the row it persisted', async () => {
     const store = await makeStore()
-    store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
+    await store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
     store.setWorkspaceSession(rendererWriteWithout(store.getWorkspaceSession(), TAB))
     expect(store.getWorkspaceSession().tabsByWorktree?.[WT] ?? []).toEqual([])
   })
 
   it('stays removed with the PTY still connected and no exit ever delivered', async () => {
     const store = await makeStore()
-    store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
+    await store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
     store.setWorkspaceSession(rendererWriteWithout(store.getWorkspaceSession(), TAB))
     // Kill-failure shape: no retirement, no exit, just more renderer writes.
     for (let i = 0; i < 3; i += 1) {
@@ -96,7 +96,7 @@ describe('host-created terminal close durability', () => {
       ...store.getWorkspaceSession(),
       terminalTopologyRevisionByRepoId: { [REPO_ID]: 1 }
     })
-    store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
+    await store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
     store.setWorkspaceSession(rendererWriteWithout(store.getWorkspaceSession(), TAB))
     // Documents PRE-EXISTING behavior: with the fence already armed, a renderer
     // write that omits a row is treated as a stale replay and the row survives
@@ -125,7 +125,7 @@ describe('topology fence census', () => {
       { startupCwd: '/tmp/wt-cli' }
     ].entries()) {
       const store = await makeStore()
-      store.persistPtyBinding({
+      await store.persistPtyBinding({
         worktreeId: WT,
         tabId: `${TAB}-${index}`,
         leafId: LEAF,
@@ -138,8 +138,8 @@ describe('topology fence census', () => {
 
   it('a second pane in the same tab still does not arm the fence', async () => {
     const store = await makeStore()
-    store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
-    store.persistPtyBinding({
+    await store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
+    await store.persistPtyBinding({
       worktreeId: WT,
       tabId: TAB,
       leafId: '22222222-2222-4222-8222-222222222222',
@@ -154,7 +154,7 @@ describe('topology fence census', () => {
       ...store.getWorkspaceSession(),
       terminalTopologyRevisionByRepoId: { [REPO_ID]: 1 }
     })
-    store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
+    await store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
     expect(
       store.getWorkspaceSession().terminalTopologyRevisionByRepoId?.[REPO_ID] ?? 0
     ).toBeGreaterThan(1)
diff --git a/src/main/runtime/managed-worktree-create-execution-host.test.ts b/src/main/runtime/managed-worktree-create-execution-host.test.ts
index af1a73dc9cc..d33f8525741 100644
--- a/src/main/runtime/managed-worktree-create-execution-host.test.ts
+++ b/src/main/runtime/managed-worktree-create-execution-host.test.ts
@@ -1,7 +1,6 @@
 // createManagedWorktree used to pick remote-vs-local from the raw `connectionId` field, so a repo
 // stamped only `executionHostId: 'ssh:*'` ran `git worktree add` on the client against a remote
-// path — and the folder branch, which returns before that check, wrote agent trust locally for a
-// remote workspace. Both are the #11163 shape: read the execution host, never one spelling of it.
+// path. That is the #11163 shape: read the execution host, never one spelling of it.
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('electron', () => ({
@@ -21,16 +20,6 @@ vi.mock('./runtime-local-worktree-create', () => ({
   createRuntimeLocalManagedWorktree: createRuntimeLocalManagedWorktreeMock
 }))
 
-const trustMocks = vi.hoisted(() => ({
-  local: vi.fn(async () => {}),
-  remote: vi.fn(async () => {})
-}))
-vi.mock('./runtime-worktree-agent-startup', async (importOriginal) => ({
-  ...(await importOriginal<Record<string, unknown>>()),
-  markLocalWorktreeTrusted: trustMocks.local,
-  markRemoteWorktreeTrusted: trustMocks.remote
-}))
-
 import { OrcaRuntimeService } from './orca-runtime'
 
 const TARGET_ID = 'remote-1'
@@ -77,8 +66,6 @@ describe('createManagedWorktree execution-host routing', () => {
     createRuntimeLocalManagedWorktreeMock.mockRejectedValue(
       new Error('local_worktree_create_ran_for_remote_repo')
     )
-    trustMocks.local.mockClear()
-    trustMocks.remote.mockClear()
   })
 
   it('creates on the SSH host for a repo stamped executionHostId only', async () => {
@@ -115,41 +102,4 @@ describe('createManagedWorktree execution-host routing', () => {
       expect.anything()
     )
   })
-
-  it('marks a folder workspace trusted on its SSH host, not on the client', async () => {
-    const { runtime } = makeRuntime({
-      id: 'repo-folder',
-      path: REMOTE_PATH,
-      kind: 'folder',
-      connectionId: TARGET_ID,
-      executionHostId: `ssh:${TARGET_ID}`
-    })
-
-    await runtime.createManagedWorktree({ repoSelector: 'repo-folder', name: 'notes' } as never)
-
-    const deps = createRuntimeFolderWorktreeMock.mock.calls[0]?.[0]?.deps
-    await deps.markTrusted('codex', '/srv/app')
-
-    expect(trustMocks.remote).toHaveBeenCalledWith('codex', TARGET_ID, '/srv/app')
-    expect(trustMocks.local).not.toHaveBeenCalled()
-  })
-
-  it('keeps a local folder workspace trusted on the client', async () => {
-    const { runtime } = makeRuntime({
-      id: 'repo-folder-local',
-      path: '/Users/me/notes',
-      kind: 'folder'
-    })
-
-    await runtime.createManagedWorktree({
-      repoSelector: 'repo-folder-local',
-      name: 'notes'
-    } as never)
-
-    const deps = createRuntimeFolderWorktreeMock.mock.calls[0]?.[0]?.deps
-    await deps.markTrusted('codex', '/Users/me/notes')
-
-    expect(trustMocks.local).toHaveBeenCalledWith('codex', '/Users/me/notes')
-    expect(trustMocks.remote).not.toHaveBeenCalled()
-  })
 })
diff --git a/src/main/runtime/mobile-rpc-allowlist.test.ts b/src/main/runtime/mobile-rpc-allowlist.test.ts
index 06f99c594fb..841c22ae925 100644
--- a/src/main/runtime/mobile-rpc-allowlist.test.ts
+++ b/src/main/runtime/mobile-rpc-allowlist.test.ts
@@ -161,6 +161,9 @@ describe('mobile RPC allowlist', () => {
       'agentSession.reveal',
       'agentSession.send',
       'agentSession.cancel',
+      'agentSession.queuedMessageSend',
+      'agentSession.queuedMessageDelete',
+      'agentSession.queuedMessagesResume',
       'agentSession.close',
       'agentSession.respondToApproval',
       'agentSession.respondToQuestion',
diff --git a/src/main/runtime/mobile-session-layout-projection.ts b/src/main/runtime/mobile-session-layout-projection.ts
index e495116e81e..3dd92091c77 100644
--- a/src/main/runtime/mobile-session-layout-projection.ts
+++ b/src/main/runtime/mobile-session-layout-projection.ts
@@ -63,7 +63,8 @@ export function cloneTerminalLayoutSnapshot(
   const cloned: TerminalLayoutSnapshot = {
     root: layout.root,
     activeLeafId: layout.activeLeafId,
-    expandedLeafId: layout.expandedLeafId
+    expandedLeafId: layout.expandedLeafId,
+    ...(layout.chatLeafId ? { chatLeafId: layout.chatLeafId } : {})
   }
   if (layout.ptyIdsByLeafId) {
     cloned.ptyIdsByLeafId = { ...layout.ptyIdsByLeafId }
diff --git a/src/main/runtime/mobile-session-terminal-retirement.ts b/src/main/runtime/mobile-session-terminal-retirement.ts
index e8caba4ddf3..0f027e8c68d 100644
--- a/src/main/runtime/mobile-session-terminal-retirement.ts
+++ b/src/main/runtime/mobile-session-terminal-retirement.ts
@@ -115,7 +115,15 @@ function chooseGroupActiveTab(
   if (group.activeTabId && retainedTabIds.has(group.activeTabId)) {
     return group.activeTabId
   }
-  const recent = (group.recentTabIds ?? []).toReversed().find((tabId) => retainedTabIds.has(tabId))
+  // Node 18 is the orcad floor and does not provide Array.prototype.toReversed.
+  let recent: string | undefined
+  for (let index = (group.recentTabIds?.length ?? 0) - 1; index >= 0; index -= 1) {
+    const tabId = group.recentTabIds?.[index]
+    if (tabId && retainedTabIds.has(tabId)) {
+      recent = tabId
+      break
+    }
+  }
   return recent ?? group.tabOrder.find((tabId) => retainedTabIds.has(tabId)) ?? null
 }
 
diff --git a/src/main/runtime/orca-runtime-activate-managed-worktree.ts b/src/main/runtime/orca-runtime-activate-managed-worktree.ts
index 6b94e5d0ea2..1629c529921 100644
--- a/src/main/runtime/orca-runtime-activate-managed-worktree.ts
+++ b/src/main/runtime/orca-runtime-activate-managed-worktree.ts
@@ -12,9 +12,7 @@ import type {
 } from './runtime-worktree-agent-startup'
 import {
   buildWorktreeStartupForAgent,
-  buildWorktreeStartupForDraft,
-  markLocalWorktreeTrusted,
-  markRemoteWorktreeTrusted
+  buildWorktreeStartupForDraft
 } from './runtime-worktree-agent-startup'
 import type { AgentLaunchPreferences } from '../../shared/agent-session-host-authority'
 import type { Worktree } from '../../shared/worktree/types'
@@ -27,7 +25,8 @@ import type {
 import { recordCreatedWorktreeLineage as recordCreatedWorktreeLineageState } from './runtime-worktree-lineage-recording'
 import {
   pasteWorktreeStartupDraftWhenReady,
-  sendWorktreeStartupFollowupWhenReady
+  sendWorktreeStartupFollowupWhenReady,
+  waitForWorktreeStartupDraft
 } from './runtime-worktree-startup-readiness'
 import type { CreateWorktreeResult } from '../../shared/worktree/create-types'
 import { provisionWorktreeTerminals } from './runtime-worktree-terminal-provisioning'
@@ -117,7 +116,8 @@ export class OrcaRuntimeWithActivateManagedWorktree extends OrcaRuntimeWithListM
   protected async buildStartupForDraft(
     repo: Repo,
     draft: string,
-    requestedAgent?: TuiAgent
+    requestedAgent?: TuiAgent,
+    launchSource?: string
   ): Promise<{
     agent: TuiAgent
     startup: WorktreeStartupLaunch
@@ -130,6 +130,7 @@ export class OrcaRuntimeWithActivateManagedWorktree extends OrcaRuntimeWithListM
       repo,
       draft,
       ...(requestedAgent ? { requestedAgent } : {}),
+      ...(launchSource ? { launchSource } : {}),
       settings: this.store.getSettings(),
       getLaunchPlatform: () => this.getAgentLaunchPlatformForRepo(repo)
     })
@@ -161,33 +162,6 @@ export class OrcaRuntimeWithActivateManagedWorktree extends OrcaRuntimeWithListM
     })
   }
 
-  protected async markLocalWorkspaceTrustedForAgent(
-    agent: TuiAgent,
-    workspacePath: string
-  ): Promise<void> {
-    await markLocalWorktreeTrusted(agent, workspacePath)
-  }
-
-  protected async markWorkspaceTrustedForAgent(
-    agent: TuiAgent,
-    connectionId: string | null | undefined,
-    workspacePath: string
-  ): Promise<void> {
-    if (connectionId) {
-      await this.markRemoteWorkspaceTrustedForAgent(agent, connectionId, workspacePath)
-      return
-    }
-    await this.markLocalWorkspaceTrustedForAgent(agent, workspacePath)
-  }
-
-  protected async markRemoteWorkspaceTrustedForAgent(
-    agent: TuiAgent,
-    connectionId: string,
-    workspacePath: string
-  ): Promise<void> {
-    await markRemoteWorktreeTrusted(agent, connectionId, workspacePath)
-  }
-
   protected recordCreatedWorktreeLineage(
     worktree: Pick<Worktree, 'id' | 'instanceId'>,
     lineageResolution: WorktreeLineageResolution
@@ -203,6 +177,29 @@ export class OrcaRuntimeWithActivateManagedWorktree extends OrcaRuntimeWithListM
     pasteWorktreeStartupDraftWhenReady(this.getWorktreeStartupReadinessHost(), handle, draft)
   }
 
+  /** Only for a newly launched worker, before its first dispatch input. */
+  async waitForFreshWorkerComposer(
+    handle: string,
+    agent: TuiAgent,
+    timeoutMs: number
+  ): Promise<void> {
+    const initialPtyId =
+      this.getLivePtyForHandle(handle)?.pty.ptyId ?? this.getLiveLeafForHandle(handle).leaf.ptyId
+    const ptyId = await waitForWorktreeStartupDraft(
+      { ...this.getWorktreeStartupReadinessHost(), getPtyId: () => initialPtyId },
+      handle,
+      agent,
+      { timeoutMs, requireComposerMarker: true }
+    )
+    if (!ptyId) {
+      throw new Error('timeout')
+    }
+    this.assertLiveTerminalHandleTargetsPty(handle, ptyId)
+    if (!this.ptysById.get(ptyId)?.connected) {
+      throw new Error('terminal_handle_stale')
+    }
+  }
+
   protected sendStartupFollowupWhenReady(handle: string, followup: WorktreeStartupFollowup): void {
     sendWorktreeStartupFollowupWhenReady(this.getWorktreeStartupReadinessHost(), handle, followup)
   }
diff --git a/src/main/runtime/orca-runtime-adopt-terminal-orphans-from-inventory.ts b/src/main/runtime/orca-runtime-adopt-terminal-orphans-from-inventory.ts
index 5dd2908413b..3bc5b570704 100644
--- a/src/main/runtime/orca-runtime-adopt-terminal-orphans-from-inventory.ts
+++ b/src/main/runtime/orca-runtime-adopt-terminal-orphans-from-inventory.ts
@@ -4,10 +4,7 @@ import {
   spawnSurfaceClaimSequence,
   SURFACE_CLAIM_WITHOUT_STANDING
 } from './pty-recorded-surface-topology'
-import {
-  observeStructuredWorker,
-  resolveStructuredWorkerAuthority
-} from './structured-worker-authority'
+import { resolveStructuredWorkerAuthority } from './structured-worker-authority'
 import type { RuntimeLeafRecord } from './runtime-terminal-state-records'
 import { OrcaRuntimeWithSubscribeToTerminalResize } from './orca-runtime-subscribe-to-terminal-resize'
 import type {
@@ -210,12 +207,10 @@ export class OrcaRuntimeWithAdoptTerminalOrphansFromInventory extends OrcaRuntim
       this.getOrchestrationDbIfAvailable?.() ?? null
     )
     if (structured) {
-      // `resolveBareOrchestrationRecipient` routes direct mail through this, not through
-      // getTerminalPaneKey. The connected-gate below exists so mail is never routed to a corpse,
-      // so the structured answer needs a real liveness proof too, not just a registry hit.
-      return observeStructuredWorker(structured.identity).status === 'live'
-        ? structured.identity.paneKey
-        : null
+      // `resolveBareOrchestrationRecipient` routes direct mail through this. A structured worker is
+      // a recipient while this runtime owns it, running or at rest: mail to one at rest is a send,
+      // and the send starts its agent.
+      return structured.identity.paneKey
     }
     const runtimePty = this.getLivePtyForHandle(handle)
     if (runtimePty) {
diff --git a/src/main/runtime/orca-runtime-agent-session-operation.test.ts b/src/main/runtime/orca-runtime-agent-session-operation.test.ts
index 8d7d6fa6812..37b329670d2 100644
--- a/src/main/runtime/orca-runtime-agent-session-operation.test.ts
+++ b/src/main/runtime/orca-runtime-agent-session-operation.test.ts
@@ -57,16 +57,12 @@ function createRuntime(provider?: {
   )
   const internal = runtime as unknown as {
     resolveTerminalWorkspaceLaunchScope: ReturnType<typeof vi.fn>
-    markLocalWorkspaceTrustedForAgent: ReturnType<typeof vi.fn>
-    markRemoteWorkspaceTrustedForAgent: ReturnType<typeof vi.fn>
   }
   internal.resolveTerminalWorkspaceLaunchScope = vi.fn(async () => ({
     id: 'worktree-1',
     path: '/tmp/worktree-1',
     connectionId: null
   }))
-  internal.markLocalWorkspaceTrustedForAgent = vi.fn()
-  internal.markRemoteWorkspaceTrustedForAgent = vi.fn()
   return runtime
 }
 
@@ -84,7 +80,6 @@ function installRemoteReclaimHarness(
       connectionId: 'ssh-1'
     })),
     executionOwnerSupportsAgentSessionOperation: vi.fn(async () => true),
-    markWorkspaceTrustedForAgent: vi.fn(async () => {}),
     adoptControllerTerminalHandle: vi.fn((ptyId: string, handle: string) => {
       handleByPtyId.set(ptyId, handle)
     }),
@@ -149,16 +144,13 @@ describe('agent-session create operation ledger', () => {
     expect(createTerminal).toHaveBeenCalledOnce()
   })
 
-  it('selects legacy before trust, spawn, or ledger state for an old daemon', async () => {
+  it('selects legacy before spawn or ledger state for an old daemon', async () => {
     const provider = {
       supportsAgentSessionClaims: vi.fn(() => false),
       supportsAgentSessionCreateOperations: vi.fn(() => false)
     }
     const runtime = createRuntime(provider)
     const createTerminal = vi.spyOn(runtime, 'createTerminal').mockResolvedValue(terminal())
-    const internal = runtime as unknown as {
-      markLocalWorkspaceTrustedForAgent: ReturnType<typeof vi.fn>
-    }
     const id = operationId()
 
     await expect(runtime.createAgentSession(request(id))).rejects.toThrow(
@@ -174,7 +166,6 @@ describe('agent-session create operation ledger', () => {
     ).rejects.toThrow('agent_session_legacy_required')
 
     expect(createTerminal).not.toHaveBeenCalled()
-    expect(internal.markLocalWorkspaceTrustedForAgent).not.toHaveBeenCalled()
 
     provider.supportsAgentSessionCreateOperations.mockReturnValue(true)
     await expect(runtime.createAgentSession(request(id))).resolves.toMatchObject({
@@ -270,7 +261,6 @@ describe('agent-session create operation ledger', () => {
     const runtime = createRuntime()
     const internal = runtime as unknown as {
       resolveTerminalWorkspaceLaunchScope: ReturnType<typeof vi.fn>
-      markRemoteWorkspaceTrustedForAgent: ReturnType<typeof vi.fn>
     }
     internal.resolveTerminalWorkspaceLaunchScope.mockResolvedValue({
       id: 'worktree-1',
@@ -293,7 +283,6 @@ describe('agent-session create operation ledger', () => {
     ).rejects.toThrow('agent_session_legacy_required')
 
     expect(createTerminal).not.toHaveBeenCalled()
-    expect(internal.markRemoteWorkspaceTrustedForAgent).not.toHaveBeenCalled()
   })
 
   it('replays the same completed operation without spawning again', async () => {
diff --git a/src/main/runtime/orca-runtime-apply-mobile-session-tab-navigation.ts b/src/main/runtime/orca-runtime-apply-mobile-session-tab-navigation.ts
index a2552ef12c3..68101c80960 100644
--- a/src/main/runtime/orca-runtime-apply-mobile-session-tab-navigation.ts
+++ b/src/main/runtime/orca-runtime-apply-mobile-session-tab-navigation.ts
@@ -72,6 +72,31 @@ export class OrcaRuntimeWithApplyMobileSessionTabNavigation extends OrcaRuntimeW
     return snapshot
   }
 
+  /**
+   * Records a tab a create just published as one paired client's selection, as a create does for
+   * its own tab. Not the tap path: a tap is a wake gesture that may respawn a non-ready pane.
+   * Returns false when the tab is not in the snapshot.
+   */
+  selectCreatedMobileSessionTabForClient(
+    worktreeId: string,
+    surface: { tabId: string; leafId: string } | { sessionId: string },
+    clientNavigationId: string
+  ): boolean {
+    const snapshot = this.getMobileSessionTabsForWorktree(worktreeId)
+    const tab = snapshot.tabs.find((candidate) =>
+      'sessionId' in surface
+        ? candidate.type === 'agent-session' && candidate.sessionId === surface.sessionId
+        : candidate.type === 'terminal' &&
+          candidate.parentTabId === surface.tabId &&
+          candidate.leafId === surface.leafId
+    )
+    if (!tab) {
+      return false
+    }
+    this.applyMobileSessionTabNavigation(snapshot, tab.id, 'caller', clientNavigationId)
+    return true
+  }
+
   /**
    * Whether persistence proves this pane's PTY was deliberately taken down and parked
    * (workspace sleep or completed-agent hibernation) rather than lost and awaiting reconnect.
diff --git a/src/main/runtime/orca-runtime-apply-tracked-pty-title.ts b/src/main/runtime/orca-runtime-apply-tracked-pty-title.ts
index 3459c7c8b6e..f4f8826e6e7 100644
--- a/src/main/runtime/orca-runtime-apply-tracked-pty-title.ts
+++ b/src/main/runtime/orca-runtime-apply-tracked-pty-title.ts
@@ -62,10 +62,9 @@ export class OrcaRuntimeWithApplyTrackedPtyTitle extends OrcaRuntimeWithGetUnper
       // parked on its poll, so the later explicit idle is an idle→idle step that still has
       // to be offered. The resolve helper re-ranks and returns early when it is not yet
       // satisfying evidence, which is what the old edge guard was really protecting.
-      // Why also gated on a change: re-ranking an unchanged idle title cannot reach a
-      // different verdict. Tier 1 and 2 depend only on the title and the status; tier 3
-      // needs the stream to go quiet, which cannot happen on the frame that just wrote to
-      // it. Repainted frames would otherwise re-scan the pane tail for nothing.
+      // Why also gated on a change: the resolver settles only a blocked tail or strong
+      // ready, and the poll catches either between title changes; repainted frames would
+      // otherwise re-scan the pane tail for nothing.
       if (agentStatus === 'idle' && prevStatus !== 'permission' && ptyRecordChanged) {
         this.resolvePtyTuiIdleWaiters(pty, ptyId)
       }
@@ -123,8 +122,7 @@ export class OrcaRuntimeWithApplyTrackedPtyTitle extends OrcaRuntimeWithGetUnper
       // which isn't a task-completion signal.
       // Why not `prevStatus !== 'idle'`: see the pty branch — the resolve helper re-ranks,
       // so an idle→idle step that upgrades weak evidence to explicit must still be offered.
-      // Why the change gate: see the pty branch — an unchanged idle title re-ranks to the
-      // same verdict, so repainted frames must not re-scan the tail.
+      // Why the change gate: see the pty branch — repainted frames must not re-scan the tail.
       if (
         agentStatus === 'idle' &&
         prevStatus !== 'permission' &&
@@ -193,6 +191,7 @@ export class OrcaRuntimeWithApplyTrackedPtyTitle extends OrcaRuntimeWithGetUnper
       pty.managementTitleAt = null
       pty.waitBlockedAt = null
       pty.tailWaitState = undefined
+      pty.commandPaint = undefined
     }
     for (const leaf of this.getLeavesForPty(ptyId)) {
       leaf.lastOscTitle = null
diff --git a/src/main/runtime/orca-runtime-attach-remote-terminal-source-range-consumer.ts b/src/main/runtime/orca-runtime-attach-remote-terminal-source-range-consumer.ts
index f433c75793d..7cb440b4bac 100644
--- a/src/main/runtime/orca-runtime-attach-remote-terminal-source-range-consumer.ts
+++ b/src/main/runtime/orca-runtime-attach-remote-terminal-source-range-consumer.ts
@@ -182,6 +182,7 @@ export class OrcaRuntimeWithAttachRemoteTerminalSourceRangeConsumer extends Orca
     try {
       await assertTerminalInputWithinLimitWithYield(data)
       await this.writeTerminalInputChunks(ptyId, data, {
+        inputKind: 'driving',
         // Why: a phone can claim the floor while a paste yields between chunks.
         beforeWrite: () => {
           if (this.getDriver(ptyId).kind === 'mobile') {
diff --git a/src/main/runtime/orca-runtime-automation-operations.ts b/src/main/runtime/orca-runtime-automation-operations.ts
index fe65979ed1e..5064944215b 100644
--- a/src/main/runtime/orca-runtime-automation-operations.ts
+++ b/src/main/runtime/orca-runtime-automation-operations.ts
@@ -17,6 +17,7 @@ import {
 } from '../../shared/automation-list-scope'
 import { OrchestrationDb } from './orchestration/db'
 import { join } from 'node:path'
+import { existsSync } from 'node:fs'
 import { getAppEnvironment } from '../../shared/app-environment'
 import type { LegacyWorkerTerminalRecoveryPlan } from './orchestration/orchestration-legacy-worker-terminal-recovery'
 import type { LegacyWorkerTerminalRecoveryResult } from './runtime-legacy-worker-terminal-recovery-types'
@@ -120,12 +121,13 @@ export class OrcaRuntimeWithAutomationOperations extends OrcaRuntimeWithPtyForeg
   deleteAutomation(
     id: string,
     expectedOwner?: AutomationOwnerPrecondition
-  ): { removed: boolean; id: string } {
+  ): Promise<{ removed: boolean; id: string }> {
     return this.automation.withExternalProbePriority(() => {
       const selector = this.automationChangeSelector(id)
-      const result = this.automation.delete(id, expectedOwner as never)
-      this.publishAutomationDefinitionChange(selector, selector)
-      return result
+      return this.automation.delete(id, expectedOwner).then((result) => {
+        this.publishAutomationDefinitionChange(selector, selector)
+        return result
+      })
     })
   }
 
@@ -151,14 +153,24 @@ export class OrcaRuntimeWithAutomationOperations extends OrcaRuntimeWithPtyForeg
   // to inject an in-memory DB without touching the filesystem.
   getOrchestrationDb(): OrchestrationDb {
     if (!this._orchestrationDb) {
-      const dbPath = join(getAppEnvironment().getPath('userData'), 'orchestration.db')
-      this._orchestrationDb = new OrchestrationDb(dbPath)
+      this._orchestrationDb = new OrchestrationDb(this.orchestrationDbPath())
       this.ensureOrchestrationFederationRelay()
       this.scheduleRestoredMessageRepoints()
     }
     return this._orchestrationDb
   }
 
+  /** The database, opened only if it already exists: a profile without one has no mail to redrive. */
+  getExistingOrchestrationDb(): OrchestrationDb | null {
+    return this._orchestrationDb || existsSync(this.orchestrationDbPath())
+      ? this.getOrchestrationDb()
+      : null
+  }
+
+  private orchestrationDbPath(): string {
+    return join(getAppEnvironment().getPath('userData'), 'orchestration.db')
+  }
+
   setOrchestrationDb(db: OrchestrationDb): void {
     this.orchestrationFederation.resetForDatabaseChange()
     this.mailPointerRepointScheduler.clear()
diff --git a/src/main/runtime/orca-runtime-automations.test.ts b/src/main/runtime/orca-runtime-automations.test.ts
index 9c2ea907c91..26cbdec3d13 100644
--- a/src/main/runtime/orca-runtime-automations.test.ts
+++ b/src/main/runtime/orca-runtime-automations.test.ts
@@ -187,7 +187,7 @@ describe('OrcaRuntimeService automation methods', () => {
     const runtime = new OrcaRuntimeService(store as never)
 
     const updated = await runtime.updateAutomation('auto-1', { enabled: false })
-    const removed = runtime.deleteAutomation('auto-1')
+    const removed = await runtime.deleteAutomation('auto-1')
 
     expect(store.updateAutomation).toHaveBeenCalledWith('auto-1', { enabled: false }, undefined)
     expect(updated).toMatchObject({
diff --git a/src/main/runtime/orca-runtime-build-headless-mobile-session-browser-tabs.ts b/src/main/runtime/orca-runtime-build-headless-mobile-session-browser-tabs.ts
index 5aa6e46cc58..73d0e44499f 100644
--- a/src/main/runtime/orca-runtime-build-headless-mobile-session-browser-tabs.ts
+++ b/src/main/runtime/orca-runtime-build-headless-mobile-session-browser-tabs.ts
@@ -3,15 +3,27 @@ import { OrcaRuntimeWithPersistTerminalSurfaceRetirements } from './orca-runtime
 import type {
   RuntimeMobileSessionBrowserTab,
   RuntimeMobileSessionTabsResult,
-  RuntimeMobileSessionTabsSnapshot
+  RuntimeMobileSessionTabsSnapshot,
+  RuntimeMobileSessionTerminalTab
 } from '../../shared/runtime-types'
+import { parseAppSshPtyId } from '../../shared/ssh-pty-id'
 import { getRuntimeBrowserPageRegistry } from './runtime-browser-page-registry'
 import type { Tab } from '../../shared/tab-types'
-import { closeTerminalTabInWorkspaceSession } from '../../shared/workspace-session-terminal-tab-close'
-import { advanceTerminalTopologyRevision } from './workspace-session-terminal-membership-authority'
+import {
+  resolveTerminalCloseTarget,
+  terminalSurfaceCloseMutation,
+  type PaneCloseResolution,
+  type RendererTerminalClose,
+  type TerminalSurfaceCloseOptions
+} from './terminal-surface-close'
+import type {
+  TerminalPaneCloseTarget,
+  TerminalSurfaceCloseTarget
+} from '../../shared/terminal-surface-close-target'
+import { retireTerminalSurfacesFromSnapshot } from './mobile-session-terminal-retirement'
 import type { PtyControllerInventory } from './runtime-pty-controller-contract'
 import { FLOATING_TERMINAL_WORKTREE_ID } from '../../shared/constants'
-import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from './workspace-session-failed-write-rollback'
+import { captureAcknowledgedTerminalTabRetirement } from './workspace-session-terminal-tab-retirement-identity'
 
 export class OrcaRuntimeWithBuildHeadlessMobileSessionBrowserTabs extends OrcaRuntimeWithPersistTerminalSurfaceRetirements {
   // Why: headless serve backs browser panes with offscreen WebContents that live
@@ -78,44 +90,166 @@ export class OrcaRuntimeWithBuildHeadlessMobileSessionBrowserTabs extends OrcaRu
     return tab ? { color: tab.color, isPinned: tab.isPinned } : null
   }
 
-  protected commitHeadlessTerminalTabRetirement(
+  protected captureTerminalTabRetirement(worktreeId: string, tabId: string) {
+    const originalHostId = this.getWorkspaceSessionHostIdForWorktree(worktreeId)
+    return captureAcknowledgedTerminalTabRetirement(worktreeId, tabId, () => {
+      const resolvedHostId = this.getWorkspaceSessionHostIdForWorktree(worktreeId)
+      const resolvedSession = this.store?.getWorkspaceSession?.(resolvedHostId)
+      // Emptying the last tab may reroute the worktree to its catalog host.
+      const hostId = resolvedSession?.tabsByWorktree[worktreeId]?.some((tab) => tab.id === tabId)
+        ? resolvedHostId
+        : originalHostId
+      return {
+        hostId,
+        session: this.store?.getWorkspaceSession?.(hostId) ?? null,
+        snapshot: this.mobileSessionTabsByWorktree.get(worktreeId),
+        incarnationOf: (ptyId) => this.ptysById.get(ptyId)?.incarnationId
+      }
+    })
+  }
+
+  /**
+   * The one close transaction every explicit terminal close reaches: durably commits the membership
+   * removal in the owning host's partition. Callers publish and kill afterwards.
+   */
+  protected async closeTerminalSurface(
     worktreeId: string,
-    parentTabId: string,
-    options: { allowMissing?: boolean; force?: boolean } = {}
-  ): string[] {
-    const session = this.getWorkspaceSessionForWorktree(worktreeId)
-    if (!session || !this.store?.setWorkspaceSession || !this.store.flushOrThrow) {
+    target: TerminalSurfaceCloseTarget,
+    options: TerminalSurfaceCloseOptions = {}
+  ): Promise<string[]> {
+    const store = this.store
+    if (!store?.getWorkspaceSession || !store.setWorkspaceSession || !store.runDurableMutation) {
       throw new Error('workspace_session_unavailable')
     }
-    const result = closeTerminalTabInWorkspaceSession(session, worktreeId, parentTabId, {
-      force: options.force
-    })
-    if (result.pinned) {
-      throw new Error('terminal_tab_pinned')
-    }
-    if (!result.closed) {
-      if (!options.allowMissing) {
-        throw new Error('tab_not_found')
-      }
-    }
-    const persisted = result.closed
-      ? advanceTerminalTopologyRevision(result.session, worktreeId)
-      : session
-    this.setWorkspaceSessionForWorktree(worktreeId, persisted)
-    const staged = this.getWorkspaceSessionForWorktree(worktreeId)
+    // Why: a tab its layout owner already removed has no newer owner; refusing would only strand it.
+    const acknowledgeTabRetirement =
+      target.kind === 'tab' && !options.closedByLayoutOwner
+        ? this.captureTerminalTabRetirement(worktreeId, target.tabId)
+        : null
+    let ptyIdsToKill: string[] = []
+    let refusal: Error | undefined
     try {
-      this.store.flushOrThrow()
+      refusal = await store.runDurableMutation(
+        terminalSurfaceCloseMutation({
+          worktreeId,
+          target,
+          options,
+          requestedSession: this.getWorkspaceSessionForWorktree(worktreeId),
+          ownerMatches: () => !acknowledgeTabRetirement || acknowledgeTabRetirement().matches,
+          hostId: () => this.getWorkspaceSessionHostIdForWorktree(worktreeId),
+          getSession: (hostId) => store.getWorkspaceSession(hostId),
+          setSession: (session, hostId) => store.setWorkspaceSession(session, hostId),
+          onClosed: (closedPtyIds) => {
+            ptyIdsToKill = closedPtyIds
+          }
+        })
+      )
     } catch (error) {
-      const current = this.getWorkspaceSessionForWorktree(worktreeId)
-      if (staged && current) {
-        const rolledBack = rollbackWorkspaceSessionAfterFailedAsyncWrite(session, staged, current)
-        if (rolledBack !== current) {
-          this.setWorkspaceSessionForWorktree(worktreeId, rolledBack)
-        }
+      console.error('[runtime] failed to persist terminal close:', error)
+    }
+    if (refusal) {
+      throw refusal
+    }
+    return ptyIdsToKill
+  }
+
+  /** The desktop renderer's close intent: it already guarded, removed and killed; this only reports. */
+  async closeTerminalSurfaceFromRenderer({ worktreeId, target, reason }: RendererTerminalClose) {
+    const options = { allowMissing: true, force: true, closedByLayoutOwner: true, reason }
+    await this.closeTerminalSurface(worktreeId, target, options)
+  }
+
+  /** Resolves a close main started against the copy of the tab's panes its layout owner holds. */
+  protected resolveTerminalCloseTarget(
+    worktreeId: string,
+    target: TerminalSurfaceCloseTarget
+  ): PaneCloseResolution | 'tab' {
+    const graphLeafIds: string[] = []
+    for (const leaf of this.leaves.values()) {
+      if (leaf.tabId === target.tabId) {
+        graphLeafIds.push(leaf.leafId)
       }
-      throw error
+    }
+    return resolveTerminalCloseTarget(target, {
+      rendererListsTab: this.tabs.has(target.tabId),
+      snapshotRows: (this.mobileSessionTabsByWorktree.get(worktreeId)?.tabs ?? []).filter(
+        (row) => row.type === 'terminal' && row.parentTabId === target.tabId
+      ),
+      graphLeafIds,
+      sessionLayout:
+        this.getWorkspaceSessionForWorktree(worktreeId)?.terminalLayoutsByTabId?.[target.tabId]
+    })
+  }
+
+  /**
+   * Commits a split pane's close that main started, then tells the desktop renderer to drop that
+   * pane. Never touches the tab: a pane the session no longer lists commits nothing.
+   */
+  protected async closeTerminalPane(
+    worktreeId: string,
+    target: TerminalPaneCloseTarget
+  ): Promise<void> {
+    try {
+      await this.closeTerminalSurface(worktreeId, target, { allowMissing: true })
+    } catch (error) {
+      if (!(error instanceof Error) || error.message !== 'workspace_session_unavailable') {
+        throw error
+      }
+    }
+    // Why: no exit may ever arrive to remove the pane. The notice is leaf-addressed, so it and the
+    // renderer's exit handling are each a no-op after the other.
+    this.retireClosedTerminalLeafFromMobileSnapshot(worktreeId, target.tabId, target.leafId)
+    this.notifier?.closeTerminalPane?.(target.tabId, target.leafId)
+  }
+
+  /** A paired client's close of one pane: stops only that pane's process, commits only that pane. */
+  protected async closeMobileSessionTerminalPane(
+    worktreeId: string,
+    tab: RuntimeMobileSessionTerminalTab
+  ): Promise<void> {
+    // Why best-effort, as for a tab: a failed kill must not keep a pane the user closed.
+    const pty = this.findPtyForMobileTerminalTab(worktreeId, tab)
+    if (pty) {
+      this.ptyController?.kill(pty.ptyId)
+    } else if (!this.tabs.has(tab.parentTabId) && tab.ptyId && parseAppSshPtyId(tab.ptyId)) {
+      // Why: with no renderer to own the kill, a dormant SSH pane's durable id is its stop order.
+      this.ptyController?.kill(tab.ptyId)
+    }
+    await this.closeTerminalPane(worktreeId, {
+      kind: 'pane',
+      tabId: tab.parentTabId,
+      leafId: tab.leafId
+    })
+  }
+
+  private retireClosedTerminalLeafFromMobileSnapshot(
+    worktreeId: string,
+    tabId: string,
+    leafId: string
+  ): void {
+    const snapshot = this.mobileSessionTabsByWorktree.get(worktreeId)
+    const tab = snapshot?.tabs.find(
+      (candidate) =>
+        candidate.type === 'terminal' &&
+        candidate.parentTabId === tabId &&
+        candidate.leafId === leafId
+    )
+    // Why: a renderer that lists the tab republishes its own snapshot once it drops the pane.
+    if (!snapshot || !tab || this.tabs.has(tabId)) {
+      return
+    }
+    const proof = this.getMobileSessionTerminalRetirementProof(worktreeId, tab)
+    const retired = retireTerminalSurfacesFromSnapshot({
+      snapshot,
+      ptyId: tab.ptyId ?? tab.parentLayout?.ptyIdsByLeafId?.[leafId] ?? '',
+      exactSurfaces: [{ parentTabId: tabId, leafId }],
+      exactOnly: true,
+      ...(proof ? { retirementProofs: [proof] } : {})
+    })
+    if (retired) {
+      this.storeMobileSessionSnapshot(worktreeId, retired.snapshot)
+      this.notifyMobileSessionTabsChanged(worktreeId)
     }
-    return result.ptyIdsToKill
   }
 
   protected persistHeadlessTerminalTabOrder(worktreeId: string, tabOrder: readonly string[]): void {
diff --git a/src/main/runtime/orca-runtime-build-pty-terminal-summary.ts b/src/main/runtime/orca-runtime-build-pty-terminal-summary.ts
index 159a709fd3c..d7a169d00e1 100644
--- a/src/main/runtime/orca-runtime-build-pty-terminal-summary.ts
+++ b/src/main/runtime/orca-runtime-build-pty-terminal-summary.ts
@@ -1,7 +1,7 @@
 // @ts-nocheck -- mechanically split from OrcaRuntimeService; behavior is covered by AST equivalence and characterization tests.
 import { OrcaRuntimeWithGetPtyRecordForPaneKey } from './orca-runtime-get-pty-record-for-pane-key'
 import type { RuntimeLeafRecord, RuntimePtyWorktreeRecord } from './runtime-terminal-state-records'
-import type { ResolvedWorktree } from './runtime-worktree-path-identity'
+import { runtimeWorktreeIdentityKey, type ResolvedWorktree } from './runtime-worktree-path-identity'
 import type { RuntimeTerminalRead, RuntimeTerminalSummary } from '../../shared/runtime-types'
 import { getLatestPtyTitle } from './runtime-worktree-status-projection'
 import { parsePaneKey } from '../../shared/stable-pane-id'
@@ -28,6 +28,14 @@ export class OrcaRuntimeWithBuildPtyTerminalSummary extends OrcaRuntimeWithGetPt
     const title = getLatestPtyTitle(pty)
     const pane = parsePaneKey(pty.paneKey ?? '')
     const orphaned = !ptyHoldsRecordedSurface(pty, this.ptySurfaceTopology())
+    // A live process awaiting its pane binding is not evidence of an orphan.
+    if (
+      orphaned &&
+      (this.pendingPtyRegistrationIncarnations.has(pty.ptyId) ||
+        this.terminalMutationLock.hasActiveSpawns(runtimeWorktreeIdentityKey(pty.worktreeId)))
+    ) {
+      throw new Error('terminal_surface_ownership_unavailable')
+    }
     return {
       handle: this.issuePtyHandle(pty),
       ptyId: pty.ptyId,
diff --git a/src/main/runtime/orca-runtime-close-headless-mobile-terminal-tab.ts b/src/main/runtime/orca-runtime-close-headless-mobile-terminal-tab.ts
index b326d00ec6c..5ef34314e42 100644
--- a/src/main/runtime/orca-runtime-close-headless-mobile-terminal-tab.ts
+++ b/src/main/runtime/orca-runtime-close-headless-mobile-terminal-tab.ts
@@ -11,9 +11,10 @@ import { buildHeadlessMobileSessionTabGroups } from './mobile-session-layout-pro
 import { appendRetiredTerminalSurfaceProofs } from './mobile-session-terminal-retirement-proof'
 import type { RuntimePtyWorktreeRecord } from './runtime-terminal-state-records'
 import type { TerminalPaneLayoutNode } from '../../shared/terminal-tab-types'
+import type { RuntimeSessionTabCloseReason } from '../../shared/runtime-session-contracts'
 
 export class OrcaRuntimeWithCloseHeadlessMobileTerminalTab extends OrcaRuntimeWithCloseStructuredAgentSessionTab {
-  protected closeHeadlessMobileTerminalTab(
+  protected async closeHeadlessMobileTerminalTab(
     worktreeId: string,
     snapshot: RuntimeMobileSessionTabsSnapshot,
     tab: RuntimeMobileSessionTerminalTab,
@@ -22,8 +23,9 @@ export class OrcaRuntimeWithCloseHeadlessMobileTerminalTab extends OrcaRuntimeWi
       killPtys?: boolean
       authorizedPty?: RuntimePtyWorktreeRecord
       force?: boolean
+      reason?: RuntimeSessionTabCloseReason
     } = {}
-  ): void {
+  ): Promise<void> {
     const closedParentTabId = tab.parentTabId
     const retirementProofs = snapshot.tabs.flatMap((candidate) => {
       if (candidate.type !== 'terminal' || candidate.parentTabId !== closedParentTabId) {
@@ -36,11 +38,21 @@ export class OrcaRuntimeWithCloseHeadlessMobileTerminalTab extends OrcaRuntimeWi
       )
       return proof ? [proof] : []
     })
-    const projectedPtyIds = this.commitHeadlessTerminalTabRetirement(
+    const acknowledgeRetirement = this.captureTerminalTabRetirement(worktreeId, closedParentTabId)
+    const projectedPtyIds = await this.closeTerminalSurface(
       worktreeId,
-      closedParentTabId,
-      { allowMissing: options.allowMissingPersistedTab, force: options.force }
+      { kind: 'tab', tabId: closedParentTabId },
+      {
+        allowMissing: options.allowMissingPersistedTab,
+        force: options.force,
+        reason: options.reason
+      }
     )
+    if (!acknowledgeRetirement().matches) {
+      throw new Error('terminal_pane_owner_changed')
+    }
+    // Renderer frames may add other tabs while the durable close is in flight.
+    snapshot = this.mobileSessionTabsByWorktree.get(worktreeId) ?? snapshot
     this.clearRuntimeSessionOwnershipForMobileTab(worktreeId, snapshot, closedParentTabId)
     if (options.authorizedPty) {
       options.authorizedPty.runtimeSessionOwned = false
@@ -172,6 +184,7 @@ export class OrcaRuntimeWithCloseHeadlessMobileTerminalTab extends OrcaRuntimeWi
       tabId: string
       root: TerminalPaneLayoutNode | null
       expandedLeafId: string | null
+      chatLeafId?: string | null
       titlesByLeafId?: Record<string, string>
     }
   ): Promise<{ updated: true }> {
@@ -197,6 +210,7 @@ export class OrcaRuntimeWithCloseHeadlessMobileTerminalTab extends OrcaRuntimeWi
         tabId: hostTabId,
         root: acceptedLayout.root,
         expandedLeafId: acceptedLayout.expandedLeafId,
+        chatLeafId: acceptedLayout.chatLeafId ?? null,
         ...(acceptedLayout.titlesByLeafId ? { titlesByLeafId: acceptedLayout.titlesByLeafId } : {})
       })
     }
diff --git a/src/main/runtime/orca-runtime-close-mobile-session-tab.ts b/src/main/runtime/orca-runtime-close-mobile-session-tab.ts
index 2ef5b77069d..3f7047c6487 100644
--- a/src/main/runtime/orca-runtime-close-mobile-session-tab.ts
+++ b/src/main/runtime/orca-runtime-close-mobile-session-tab.ts
@@ -18,9 +18,7 @@ import {
 } from './mobile-session-tab-close-outcome'
 import { getRuntimeBrowserPageRegistry } from './runtime-browser-page-registry'
 import type { RuntimeCommandSurfaceHost } from './orca-runtime-core'
-import { structuredAgentSessionTabId } from '../../shared/structured-agent-session-projection'
 import { SESSION_TAB_NOT_FOUND_ERROR } from '../../shared/session-tab-close'
-import { captureAcknowledgedTerminalTabRetirement } from './workspace-session-terminal-tab-retirement-identity'
 import { rendererPublicationThrottle } from '../window/renderer-publication-throttle'
 
 export class OrcaRuntimeWithCloseMobileSessionTab extends OrcaRuntimeWithRefuseUnattributedMobileSessionTabClose {
@@ -120,10 +118,14 @@ export class OrcaRuntimeWithCloseMobileSessionTab extends OrcaRuntimeWithRefuseU
         closedSelectionTabIds
       )
     if (tab.type === 'terminal') {
-      const parentLeafCount = snapshot.tabs.filter(
-        (candidate) => candidate.type === 'terminal' && candidate.parentTabId === tab.parentTabId
-      ).length
-      const closingWholeParent = tab.id !== tabId || parentLeafCount <= 1
+      // Why: the wire id carries the intent — `parent::leaf` names a pane, `parent` its tab.
+      const resolution = this.resolveTerminalCloseTarget(
+        worktreeId,
+        tab.id === tabId
+          ? { kind: 'pane', tabId: tab.parentTabId, leafId: tab.leafId }
+          : { kind: 'tab', tabId: tab.parentTabId }
+      )
+      const closingWholeParent = resolution === 'tab' || resolution === 'last-pane'
       if (closingWholeParent) {
         closedSelectionTabIds = snapshot.tabs.flatMap((candidate) =>
           candidate.type === 'terminal' && candidate.parentTabId === tab.parentTabId
@@ -167,9 +169,10 @@ export class OrcaRuntimeWithCloseMobileSessionTab extends OrcaRuntimeWithRefuseU
       // the relay when no renderer owns the parent: an adopted tab needs the
       // renderer's live pin guard and durable close transaction.
       if (closingWholeParent && !this.tabs.has(tab.parentTabId)) {
-        this.closeHeadlessMobileTerminalTab(worktreeId, snapshot, tab, {
+        await this.closeHeadlessMobileTerminalTab(worktreeId, snapshot, tab, {
           allowMissingPersistedTab: Boolean(ptyCloseAuthority),
           force: options.force,
+          reason: options.reason,
           killPtys:
             options.localPtyTeardownOwnedExternally !== true &&
             (options.reason === undefined || options.reason === 'user'),
@@ -180,16 +183,7 @@ export class OrcaRuntimeWithCloseMobileSessionTab extends OrcaRuntimeWithRefuseU
       }
       if (closingWholeParent && this.notifier?.closeTerminalTab) {
         // The renderer flush can rebase its omission; the host commits the acknowledged identity.
-        const acknowledgeRetirement = captureAcknowledgedTerminalTabRetirement(
-          worktreeId,
-          tab.parentTabId,
-          () => ({
-            hostId: this.getWorkspaceSessionHostIdForWorktree(worktreeId),
-            session: this.getWorkspaceSessionForWorktree(worktreeId),
-            snapshot: this.mobileSessionTabsByWorktree.get(worktreeId),
-            incarnationOf: (ptyId) => this.ptysById.get(ptyId)?.incarnationId
-          })
-        )
+        const acknowledgeRetirement = this.captureTerminalTabRetirement(worktreeId, tab.parentTabId)
         // Wait for the renderer's pin guard, retirement and forced session flush.
         const win = this.getAvailableAuthoritativeWindow()
         if (win?.webContents.isDestroyed?.()) {
@@ -230,7 +224,7 @@ export class OrcaRuntimeWithCloseMobileSessionTab extends OrcaRuntimeWithRefuseU
             ? this.resolvePtyTabCloseSurfaceAuthority(options.expectedPtyCloseAuthority)
             : null
           // Why: after relay recovery the renderer can acknowledge a tab it no longer mirrors; the HUB must still retire its SSH-owned surface.
-          this.closeHeadlessMobileTerminalTab(worktreeId, remainingSnapshot, remainingTab, {
+          await this.closeHeadlessMobileTerminalTab(worktreeId, remainingSnapshot, remainingTab, {
             // Why: the renderer may already have durably removed the tab before acknowledging.
             allowMissingPersistedTab: true,
             force: options.force,
@@ -238,47 +232,42 @@ export class OrcaRuntimeWithCloseMobileSessionTab extends OrcaRuntimeWithRefuseU
           })
           this.notifyRendererOfHeadlessTerminalClose(tab.parentTabId)
         } else if (retirement.hasPersistedTab) {
-          this.commitHeadlessTerminalTabRetirement(worktreeId, tab.parentTabId, {
-            force: options.force
-          })
+          // Why: the renderer's close normally commits this through its own intent; this covers
+          // a renderer that acknowledged a tab it no longer listed. Missing is fine: that intent's
+          // durable write can land between this check and this commit.
+          await this.closeTerminalSurface(
+            worktreeId,
+            { kind: 'tab', tabId: tab.parentTabId },
+            { allowMissing: true, force: options.force }
+          )
+        }
+        if (!acknowledgeRetirement().matches) {
+          this.republishMobileSessionTabsSnapshot(worktreeId)
+          return refusedMobileSessionTabClose('stale-terminal', { snapshotRepublished: true })
         }
         this.clearRuntimeSessionOwnershipForMobileTab(worktreeId, snapshot, tab.parentTabId)
         return finishCommittedClose()
       }
-      // Why: notifier implementations without the acknowledged relay may expose
-      // only raw pane close. Runtime-owned parents still need de-persist + kill.
-      if (closingWholeParent && this.isRuntimeOwnedHeadlessMobileTab(worktreeId, tab)) {
-        this.closeHeadlessMobileTerminalTab(worktreeId, snapshot, tab, {
-          force: options.force,
-          ...(ptyCloseAuthority ? { authorizedPty: ptyCloseAuthority.pty } : {})
-        })
-        this.notifyRendererOfHeadlessTerminalClose(tab.parentTabId)
-        return finishCommittedClose()
-      }
-      if (!this.notifier?.closeTerminal) {
-        this.closeHeadlessMobileTerminalTab(worktreeId, snapshot, tab, {
-          force: options.force,
-          ...(ptyCloseAuthority ? { authorizedPty: ptyCloseAuthority.pty } : {})
-        })
-        return finishCommittedClose()
-      }
-      if (tab.id === tabId) {
-        const pty = this.findPtyForMobileTerminalTab(worktreeId, tab)
-        if (pty) {
-          if (this.ptyController?.kill(pty.ptyId) !== true) {
-            throw new Error('terminal_close_failed')
-          }
+      if (closingWholeParent) {
+        // Why: notifier implementations without the acknowledged relay may expose
+        // only raw pane close. Runtime-owned parents still need de-persist + kill.
+        if (
+          !this.notifier?.closeTerminal ||
+          this.isRuntimeOwnedHeadlessMobileTab(worktreeId, tab)
+        ) {
+          await this.closeHeadlessMobileTerminalTab(worktreeId, snapshot, tab, {
+            force: options.force,
+            ...(ptyCloseAuthority ? { authorizedPty: ptyCloseAuthority.pty } : {})
+          })
+          this.notifyRendererOfHeadlessTerminalClose(tab.parentTabId)
           return finishCommittedClose()
         }
         this.notifier.closeTerminal(tab.parentTabId)
+        this.clearRuntimeSessionOwnershipForMobileTab(worktreeId, snapshot, tab.parentTabId)
         return delegatedMobileSessionTabClose()
       }
-      // Why: paired web tab bars represent a split terminal with one local
-      // parent tab id. Closing that parent should close the desktop tab, not
-      // just whichever leaf happened to be first in the session snapshot.
-      this.notifier.closeTerminal(tab.parentTabId)
-      this.clearRuntimeSessionOwnershipForMobileTab(worktreeId, snapshot, tab.parentTabId)
-      return delegatedMobileSessionTabClose()
+      await this.closeMobileSessionTerminalPane(worktreeId, tab)
+      return finishCommittedClose()
     } else if (tab.type === 'browser') {
       // Why: a browser tab can be hosted by a client, by the offscreen backend,
       // or by the renderer; each surface owns a different retirement path.
@@ -302,10 +291,8 @@ export class OrcaRuntimeWithCloseMobileSessionTab extends OrcaRuntimeWithRefuseU
     } else if (tab.type === 'agent-session') {
       if (this.notifier?.closeSessionTab) {
         try {
-          await this.notifier.closeSessionTab(
-            structuredAgentSessionTabId(tab.sessionId),
-            worktreeId
-          )
+          // Why: a reopened chat's window tab id is not derivable from its session; the window maps ours.
+          await this.notifier.closeSessionTab(tab.id, worktreeId)
         } catch (error) {
           // The renderer already having removed the tab is an idempotent close, not a veto.
           if (!(error instanceof Error && error.message === SESSION_TAB_NOT_FOUND_ERROR)) {
diff --git a/src/main/runtime/orca-runtime-cold-restore-terminal-membership.test.ts b/src/main/runtime/orca-runtime-cold-restore-terminal-membership.test.ts
new file mode 100644
index 00000000000..321f4d40ae6
--- /dev/null
+++ b/src/main/runtime/orca-runtime-cold-restore-terminal-membership.test.ts
@@ -0,0 +1,577 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { getDefaultWorkspaceSession } from '../../shared/constants'
+import { LOCAL_EXECUTION_HOST_ID, type ExecutionHostId } from '../../shared/execution-host'
+import type {
+  RuntimeMobileSessionSnapshotTab,
+  RuntimeMobileSessionTabsResult,
+  RuntimeMobileSessionTabsSnapshot
+} from '../../shared/runtime-types'
+import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
+import { OrcaRuntimeService } from './orca-runtime'
+import { setRuntimeDesktopSurface } from './runtime-desktop-surface'
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
+
+const WORKTREE_ID = 'repo::/worktree'
+const REPO_ID = 'repo'
+const LEFT = '11111111-1111-4111-8111-111111111111'
+const RIGHT = '22222222-2222-4222-8222-222222222222'
+const SPLIT_ROOT = {
+  type: 'split' as const,
+  direction: 'vertical' as const,
+  first: { type: 'leaf' as const, leafId: LEFT },
+  second: { type: 'leaf' as const, leafId: RIGHT }
+}
+
+type RestoreHost = {
+  repo: {
+    id: string
+    path: string
+    displayName: string
+    badgeColor: string
+    addedAt: number
+    connectionId?: string
+    executionHostId?: ExecutionHostId
+  }
+  hostId: ExecutionHostId
+  connectionId: string | null
+  ptyIds: { left: string; right: string }
+  /** An SSH relaunch has not bound its PTY into the saved session yet. */
+  persistsPtyBindings: boolean
+}
+
+const LOCAL_HOST: RestoreHost = {
+  repo: { id: REPO_ID, path: '/worktree', displayName: 'repo', badgeColor: 'blue', addedAt: 1 },
+  hostId: LOCAL_EXECUTION_HOST_ID,
+  connectionId: null,
+  ptyIds: { left: 'pty-left', right: 'pty-right' },
+  persistsPtyBindings: true
+}
+const SSH_HOST: RestoreHost = {
+  repo: { ...LOCAL_HOST.repo, connectionId: 'ssh-1' },
+  hostId: 'ssh:ssh-1',
+  connectionId: 'ssh-1',
+  ptyIds: { left: 'ssh:ssh-1@@pty-left', right: 'ssh:ssh-1@@pty-right' },
+  persistsPtyBindings: false
+}
+const RUNTIME_HOST: RestoreHost = {
+  ...LOCAL_HOST,
+  repo: { ...LOCAL_HOST.repo, executionHostId: 'runtime:env-1' },
+  hostId: 'runtime:env-1'
+}
+
+// A cold restore: the saved split survives, and an earlier incarnation change left the repo's
+// terminal membership host-authoritative, but no PTY has registered yet.
+function makeColdRestoredSession(host: RestoreHost): WorkspaceSessionState {
+  return {
+    ...getDefaultWorkspaceSession(),
+    tabsByWorktree: {
+      [WORKTREE_ID]: [
+        {
+          id: 'tab',
+          ptyId: host.persistsPtyBindings ? host.ptyIds.left : null,
+          worktreeId: WORKTREE_ID,
+          title: 'Terminal',
+          customTitle: null,
+          color: null,
+          sortOrder: 0,
+          createdAt: 1
+        }
+      ]
+    },
+    terminalLayoutsByTabId: {
+      tab: {
+        root: SPLIT_ROOT,
+        activeLeafId: LEFT,
+        expandedLeafId: null,
+        ptyIdsByLeafId: host.persistsPtyBindings
+          ? { [LEFT]: host.ptyIds.left, [RIGHT]: host.ptyIds.right }
+          : {}
+      }
+    },
+    terminalTopologyRevisionByRepoId: { [REPO_ID]: 2 }
+  }
+}
+
+function makeRendererFrame(
+  host: RestoreHost,
+  options: {
+    version?: number
+    leaves?: readonly string[]
+    extraTabs?: readonly RuntimeMobileSessionSnapshotTab[]
+  } = {}
+): RuntimeMobileSessionTabsSnapshot {
+  const leaves = options.leaves ?? [LEFT, RIGHT]
+  const ptyIdByLeaf: Record<string, string> = {
+    [LEFT]: host.ptyIds.left,
+    [RIGHT]: host.ptyIds.right
+  }
+  const parentLayout = {
+    root: leaves.length === 2 ? SPLIT_ROOT : { type: 'leaf' as const, leafId: leaves[0] },
+    activeLeafId: leaves[0],
+    expandedLeafId: leaves[0],
+    ptyIdsByLeafId: Object.fromEntries(leaves.map((leafId) => [leafId, ptyIdByLeaf[leafId]]))
+  }
+  const extraTabs = options.extraTabs ?? []
+  return {
+    worktree: WORKTREE_ID,
+    publicationEpoch: 'renderer',
+    snapshotVersion: options.version ?? 1,
+    activeGroupId: 'group',
+    activeTabId: `tab::${leaves[0]}`,
+    activeTabType: 'terminal',
+    tabGroups: [
+      { id: 'group', activeTabId: 'tab', tabOrder: ['tab', ...extraTabs.map((tab) => tab.id)] }
+    ],
+    tabs: [
+      ...leaves.map((leafId, index) => ({
+        type: 'terminal' as const,
+        id: `tab::${leafId}`,
+        parentTabId: 'tab',
+        leafId,
+        ptyId: ptyIdByLeaf[leafId],
+        title: leafId === LEFT ? 'Left' : 'Right',
+        parentLayout,
+        isActive: index === 0
+      })),
+      ...extraTabs
+    ]
+  }
+}
+
+const RENDERER_TABS = [
+  {
+    tabId: 'tab',
+    worktreeId: WORKTREE_ID,
+    title: 'Terminal',
+    activeLeafId: LEFT,
+    layout: SPLIT_ROOT
+  }
+]
+
+function publishRendererFrame(
+  runtime: OrcaRuntimeService,
+  frame: RuntimeMobileSessionTabsSnapshot
+): ReturnType<OrcaRuntimeService['syncWindowGraph']> {
+  return runtime.syncWindowGraph(1, { tabs: RENDERER_TABS, leaves: [], mobileSessionTabs: [frame] })
+}
+
+function coldRestoredRuntime(host: RestoreHost = LOCAL_HOST): {
+  runtime: OrcaRuntimeService
+  sessions: Map<ExecutionHostId, WorkspaceSessionState>
+} {
+  const sessions = new Map<ExecutionHostId, WorkspaceSessionState>([
+    [host.hostId, makeColdRestoredSession(host)]
+  ])
+  // The desktop window is live, so main must not rebuild the list from the saved session.
+  const liveWindow = {
+    isDestroyed: () => false,
+    webContents: { isDestroyed: () => false, send: () => {} }
+  }
+  setRuntimeDesktopSurface({
+    showNotification: () => false,
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the runtime reads only liveness and send off its authoritative window on these paths.
+    findWindowById: () => liveWindow as never,
+    onIpc: () => {},
+    removeIpcListener: () => {}
+  })
+  const runtime = new OrcaRuntimeService(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the list, fence, exit and close paths read only repos and the workspace session; the rest of Store is unreached.
+    withDurableRuntimeStore({
+      getRepos: () => [host.repo],
+      getRepo: (id: string) => (id === REPO_ID ? host.repo : undefined),
+      getAllWorktreeMeta: () => ({}),
+      getWorktreeMeta: () => undefined,
+      getSettings: () => ({ workspaceDir: '/tmp/workspaces' }),
+      getProjects: () => [],
+      getWorkspaceSessionHostIds: () => [...sessions.keys()],
+      getWorkspaceSession: (hostId?: ExecutionHostId) =>
+        sessions.get(hostId ?? LOCAL_EXECUTION_HOST_ID) ?? getDefaultWorkspaceSession(),
+      setWorkspaceSession: (next: WorkspaceSessionState, hostId?: ExecutionHostId) => {
+        sessions.set(hostId ?? LOCAL_EXECUTION_HOST_ID, next)
+      },
+      flushPendingOrThrowAsync: async () => {},
+      // The production store commits asynchronously; a synchronous flush on these paths is a bug.
+      flushOrThrow: () => {
+        throw new Error('synchronous flush')
+      }
+    }) as never
+  )
+  runtime.attachWindow(1)
+  return { runtime, sessions }
+}
+
+function registerLeaf(runtime: OrcaRuntimeService, host: RestoreHost, leaf: 'left' | 'right') {
+  runtime.registerPty(host.ptyIds[leaf], WORKTREE_ID, host.connectionId, {
+    tabId: 'tab',
+    leafId: leaf === 'left' ? LEFT : RIGHT,
+    incarnationId: `incarnation-${leaf}`
+  })
+}
+
+function surfaces(result: RuntimeMobileSessionTabsResult | undefined): string[] {
+  return (result?.tabs ?? []).map((tab) => `${tab.id}:${'status' in tab ? tab.status : ''}`)
+}
+
+async function listedSurfaces(runtime: OrcaRuntimeService): Promise<string[]> {
+  return surfaces(await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`))
+}
+
+// The session-tabs notify coalescer's max wait (mobile-session-tabs-notify-coalescer.ts).
+const COALESCED_PUSH_MS = 250
+
+describe('a restored terminal published before its PTY registers', () => {
+  afterEach(() => {
+    setRuntimeDesktopSurface(null)
+    vi.useRealTimers()
+  })
+
+  it.each([
+    ['local', LOCAL_HOST],
+    ['SSH without a saved PTY binding', SSH_HOST],
+    ['runtime host', RUNTIME_HOST]
+  ])('%s: is listed pending, then pushed ready when its PTY registers', async (_label, host) => {
+    vi.useFakeTimers()
+    const { runtime } = coldRestoredRuntime(host)
+    publishRendererFrame(runtime, makeRendererFrame(host))
+    expect(await listedSurfaces(runtime)).toEqual([
+      `tab::${LEFT}:pending-handle`,
+      `tab::${RIGHT}:pending-handle`
+    ])
+    vi.advanceTimersByTime(COALESCED_PUSH_MS)
+    const published: RuntimeMobileSessionTabsResult[] = []
+    const unsubscribe = runtime.onMobileSessionTabsChanged((event) => published.push(event))
+
+    registerLeaf(runtime, host, 'left')
+    vi.advanceTimersByTime(COALESCED_PUSH_MS)
+
+    // Registration alone reaches clients: no renderer frame or graph change follows it here.
+    expect(surfaces(published.at(-1))).toEqual([
+      `tab::${LEFT}:ready`,
+      `tab::${RIGHT}:pending-handle`
+    ])
+    const pushes = published.length
+    expect(
+      runtime.syncWindowGraph(1, {
+        tabs: RENDERER_TABS,
+        leaves: [],
+        mobileSessionTabs: [],
+        unchangedMobileSessionWorktrees: [WORKTREE_ID]
+      }).mobileSessionResyncWorktrees
+    ).toBeUndefined()
+    publishRendererFrame(runtime, makeRendererFrame(host))
+    vi.advanceTimersByTime(COALESCED_PUSH_MS)
+    expect(published).toHaveLength(pushes)
+    expect(await listedSurfaces(runtime)).toEqual([
+      `tab::${LEFT}:ready`,
+      `tab::${RIGHT}:pending-handle`
+    ])
+
+    registerLeaf(runtime, host, 'right')
+    vi.advanceTimersByTime(COALESCED_PUSH_MS)
+
+    expect(surfaces(published.at(-1))).toEqual([`tab::${LEFT}:ready`, `tab::${RIGHT}:ready`])
+    unsubscribe()
+  })
+
+  it('pushes a restore of several panes once, not once per registering pane', () => {
+    vi.useFakeTimers()
+    const { runtime } = coldRestoredRuntime()
+    publishRendererFrame(runtime, makeRendererFrame(LOCAL_HOST))
+    vi.advanceTimersByTime(COALESCED_PUSH_MS)
+    const published: RuntimeMobileSessionTabsResult[] = []
+    const unsubscribe = runtime.onMobileSessionTabsChanged((event) => published.push(event))
+
+    registerLeaf(runtime, LOCAL_HOST, 'left')
+    registerLeaf(runtime, LOCAL_HOST, 'right')
+    vi.advanceTimersByTime(COALESCED_PUSH_MS)
+
+    expect(published.map(surfaces)).toEqual([[`tab::${LEFT}:ready`, `tab::${RIGHT}:ready`]])
+    unsubscribe()
+  })
+
+  it('keeps listing a restored pane whose PTY never returns as pending', async () => {
+    const { runtime } = coldRestoredRuntime()
+    publishRendererFrame(runtime, makeRendererFrame(LOCAL_HOST))
+
+    registerLeaf(runtime, LOCAL_HOST, 'left')
+    runtime.registerPty('pty-other', WORKTREE_ID, null, {
+      tabId: 'tab-other',
+      leafId: RIGHT,
+      incarnationId: 'incarnation-other'
+    })
+
+    expect(await listedSurfaces(runtime)).toEqual([
+      `tab::${LEFT}:ready`,
+      `tab::${RIGHT}:pending-handle`
+    ])
+  })
+})
+
+describe('a retired restored terminal stays out of a later renderer frame', () => {
+  afterEach(() => setRuntimeDesktopSurface(null))
+
+  it('after its process exits and the retirement is saved', async () => {
+    const { runtime, sessions } = coldRestoredRuntime()
+    registerLeaf(runtime, LOCAL_HOST, 'left')
+    publishRendererFrame(runtime, makeRendererFrame(LOCAL_HOST))
+    expect(await listedSurfaces(runtime)).toContain(`tab::${LEFT}:ready`)
+
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-left')
+
+    expect(sessions.get(LOCAL_EXECUTION_HOST_ID)?.terminalLayoutsByTabId.tab?.root).toEqual({
+      type: 'leaf',
+      leafId: RIGHT
+    })
+    // A lagging renderer still lists the exited pane, at a newer version.
+    publishRendererFrame(runtime, makeRendererFrame(LOCAL_HOST, { version: 2 }))
+    expect(await listedSurfaces(runtime)).not.toContain(`tab::${LEFT}:ready`)
+    expect(await listedSurfaces(runtime)).not.toContain(`tab::${LEFT}:pending-handle`)
+  })
+
+  it('after its last pane exits from a runtime-host partition an older copy still lists', async () => {
+    const { runtime, sessions } = coldRestoredRuntime(RUNTIME_HOST)
+    // Left behind in another partition before the catalog owner rotated.
+    sessions.set(LOCAL_EXECUTION_HOST_ID, makeColdRestoredSession(RUNTIME_HOST))
+    registerLeaf(runtime, RUNTIME_HOST, 'left')
+    registerLeaf(runtime, RUNTIME_HOST, 'right')
+    publishRendererFrame(runtime, makeRendererFrame(RUNTIME_HOST))
+
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-left')
+    await runtime.onPtyExit('pty-right', 0, 'incarnation-right')
+    // Emptying the owner's partition re-routes reads to the older copy.
+    expect(sessions.get(RUNTIME_HOST.hostId)?.tabsByWorktree[WORKTREE_ID]).toEqual([])
+
+    publishRendererFrame(runtime, makeRendererFrame(RUNTIME_HOST, { version: 2 }))
+    expect(await listedSurfaces(runtime)).toEqual([])
+  })
+
+  it('after the user closes it on the desktop', async () => {
+    const { runtime, sessions } = coldRestoredRuntime()
+    registerLeaf(runtime, LOCAL_HOST, 'left')
+    registerLeaf(runtime, LOCAL_HOST, 'right')
+    publishRendererFrame(runtime, makeRendererFrame(LOCAL_HOST))
+    expect(await listedSurfaces(runtime)).toEqual([`tab::${LEFT}:ready`, `tab::${RIGHT}:ready`])
+
+    publishRendererFrame(runtime, makeRendererFrame(LOCAL_HOST, { version: 2, leaves: [LEFT] }))
+    await runtime.onPtyExit('pty-right', 0, 'incarnation-right')
+    expect(sessions.get(LOCAL_EXECUTION_HOST_ID)?.terminalLayoutsByTabId.tab?.root).toEqual({
+      type: 'leaf',
+      leafId: LEFT
+    })
+
+    publishRendererFrame(runtime, makeRendererFrame(LOCAL_HOST, { version: 3 }))
+    expect(await listedSurfaces(runtime)).toEqual([`tab::${LEFT}:ready`])
+  })
+})
+
+// An SSH worktree: the phone closes a tab while a relaunched sibling tab has not registered yet.
+const SSH_PTY_X = 'ssh:ssh-1@@pty-x'
+const SSH_PTY_Y = 'ssh:ssh-1@@pty-y'
+
+function makeSshSession(tabIds: readonly ('tab-x' | 'tab-y')[]): WorkspaceSessionState {
+  // tab-x's relaunched PTY has not bound yet, so only tab-y saves a relay binding.
+  const specs = {
+    'tab-x': { leafId: LEFT, ptyId: null },
+    'tab-y': { leafId: RIGHT, ptyId: SSH_PTY_Y }
+  }
+  return {
+    ...getDefaultWorkspaceSession(),
+    tabsByWorktree: {
+      [WORKTREE_ID]: tabIds.map((id, index) => ({
+        id,
+        ptyId: specs[id].ptyId,
+        worktreeId: WORKTREE_ID,
+        title: id,
+        customTitle: null,
+        color: null,
+        sortOrder: index,
+        createdAt: index + 1
+      }))
+    },
+    terminalLayoutsByTabId: Object.fromEntries(
+      tabIds.map((id) => [
+        id,
+        {
+          root: { type: 'leaf' as const, leafId: specs[id].leafId },
+          activeLeafId: specs[id].leafId,
+          expandedLeafId: null,
+          ptyIdsByLeafId: specs[id].ptyId ? { [specs[id].leafId]: specs[id].ptyId } : {}
+        }
+      ])
+    ),
+    terminalTopologyRevisionByRepoId: { [REPO_ID]: 2 }
+  }
+}
+
+function publishSshRendererFrame(runtime: OrcaRuntimeService): void {
+  const tabs = [
+    { tabId: 'tab-x', leafId: LEFT, ptyId: SSH_PTY_X },
+    { tabId: 'tab-y', leafId: RIGHT, ptyId: SSH_PTY_Y }
+  ]
+  runtime.syncWindowGraph(1, {
+    tabs: tabs.map(({ tabId, leafId }) => ({
+      tabId,
+      worktreeId: WORKTREE_ID,
+      title: tabId,
+      activeLeafId: leafId,
+      layout: { type: 'leaf' as const, leafId }
+    })),
+    leaves: [],
+    mobileSessionTabs: [
+      {
+        worktree: WORKTREE_ID,
+        publicationEpoch: 'renderer',
+        snapshotVersion: 1,
+        activeGroupId: 'group',
+        activeTabId: `tab-y::${RIGHT}`,
+        activeTabType: 'terminal',
+        tabGroups: [{ id: 'group', activeTabId: 'tab-y', tabOrder: ['tab-x', 'tab-y'] }],
+        tabs: tabs.map(({ tabId, leafId, ptyId }) => ({
+          type: 'terminal' as const,
+          id: `${tabId}::${leafId}`,
+          parentTabId: tabId,
+          leafId,
+          ptyId,
+          title: tabId,
+          isActive: tabId === 'tab-y'
+        }))
+      }
+    ]
+  })
+}
+
+describe('a surface the host retired stays retired when a restored sibling registers', () => {
+  afterEach(() => setRuntimeDesktopSurface(null))
+
+  it('keeps a phone-closed SSH terminal closed while its remote PTY is still exiting', async () => {
+    const { runtime, sessions } = coldRestoredRuntime(SSH_HOST)
+    sessions.set(SSH_HOST.hostId, makeSshSession(['tab-x', 'tab-y']))
+    const kill = vi.fn(() => true)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the close path uses only these two relays.
+    runtime.setNotifier({
+      closeTerminal: vi.fn(),
+      // The renderer durably retires the tab and acks; its pruned frame is still in flight.
+      closeTerminalTab: vi.fn(async () => {
+        sessions.set(SSH_HOST.hostId, makeSshSession(['tab-x']))
+      })
+    } as never)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the close path kills and inventories only; the remote kill lands asynchronously.
+    runtime.setPtyController({
+      write: () => true,
+      kill,
+      listProcesses: vi.fn(async () =>
+        [SSH_PTY_X, SSH_PTY_Y].map((id) => ({ id, cwd: '/worktree', title: 'shell' }))
+      ),
+      getForegroundProcess: async () => null
+    } as never)
+    publishSshRendererFrame(runtime)
+    runtime.registerPty(SSH_PTY_Y, WORKTREE_ID, 'ssh-1', {
+      tabId: 'tab-y',
+      leafId: RIGHT,
+      incarnationId: 'incarnation-y'
+    })
+    expect(await listedSurfaces(runtime)).toContain(`tab-y::${RIGHT}:ready`)
+
+    await runtime.closeMobileSessionTab(`id:${WORKTREE_ID}`, 'tab-y', { reason: 'user' })
+    expect(kill).toHaveBeenCalledWith(SSH_PTY_Y)
+    runtime.registerPty(SSH_PTY_X, WORKTREE_ID, 'ssh-1', {
+      tabId: 'tab-x',
+      leafId: LEFT,
+      incarnationId: 'incarnation-x'
+    })
+
+    expect(await listedSurfaces(runtime)).not.toContain(`tab-y::${RIGHT}:ready`)
+  })
+
+  it('keeps a phone-closed chat tab closed', async () => {
+    const { runtime } = coldRestoredRuntime()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the chat close path uses only this relay.
+    runtime.setNotifier({ closeSessionTab: vi.fn(async () => {}) } as never)
+    publishRendererFrame(
+      runtime,
+      makeRendererFrame(LOCAL_HOST, {
+        extraTabs: [
+          {
+            type: 'agent-session',
+            id: 'chat',
+            title: 'Chat',
+            sessionId: 'session-chat',
+            agent: 'claude',
+            isActive: false
+          }
+        ]
+      })
+    )
+    expect(await listedSurfaces(runtime)).toContain('chat:')
+
+    await runtime.closeMobileSessionTab(`id:${WORKTREE_ID}`, 'chat', { reason: 'user' })
+    registerLeaf(runtime, LOCAL_HOST, 'left')
+
+    expect(await listedSurfaces(runtime)).not.toContain('chat:')
+  })
+})
+
+// A phone creates a terminal while the desktop's frame still lacks it: the spawn registered and the
+// host published the tab itself, as it does for a create the desktop has not published yet.
+const PHONE_LEAF = '33333333-3333-4333-8333-333333333333'
+
+async function runtimeWithUnpublishedPhoneCreate(): Promise<OrcaRuntimeService> {
+  const { runtime } = coldRestoredRuntime()
+  const handlers = new Map<string, (event: unknown, reply: unknown) => void>()
+  const webContents = {
+    isDestroyed: () => false,
+    setBackgroundThrottling: () => {},
+    send: (channel: string, payload: { requestId: string }) => {
+      if (channel !== 'terminal:requestTabCreate') {
+        return
+      }
+      runtime.registerPty('pty-phone', WORKTREE_ID, null, {
+        tabId: 'tab-phone',
+        leafId: PHONE_LEAF,
+        incarnationId: 'incarnation-phone'
+      })
+      handlers.get('terminal:tabCreateReply')?.(
+        { sender: webContents },
+        { requestId: payload.requestId, tabId: 'tab-phone', title: 'Terminal' }
+      )
+    }
+  }
+  setRuntimeDesktopSurface({
+    showNotification: () => false,
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the create path reads only liveness and these webContents members off its authoritative window.
+    findWindowById: () => ({ isDestroyed: () => false, webContents }) as never,
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only the tab-create reply channel is registered on this path.
+    onIpc: (channel, listener) => handlers.set(channel, listener as never),
+    removeIpcListener: (channel) => handlers.delete(channel)
+  })
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the create path focuses only when activating, which this create does not.
+  runtime.setNotifier({ focusTerminal: vi.fn() } as never)
+  Object.assign(runtime, {
+    resolveTerminalWorkspaceLaunchScope: vi.fn(async () => ({
+      id: WORKTREE_ID,
+      path: '/worktree',
+      connectionId: null,
+      repo: LOCAL_HOST.repo,
+      folderWorkspace: null
+    }))
+  })
+  publishRendererFrame(runtime, makeRendererFrame(LOCAL_HOST))
+  await runtime.createMobileSessionTerminal(`id:${WORKTREE_ID}`, {
+    activate: false,
+    clientNavigationId: 'phone'
+  })
+  return runtime
+}
+
+describe('a surface the host added stays listed when a restored sibling registers', () => {
+  afterEach(() => setRuntimeDesktopSurface(null))
+
+  it('keeps a phone-created terminal listed', async () => {
+    const runtime = await runtimeWithUnpublishedPhoneCreate()
+    expect(await listedSurfaces(runtime)).toContain(`tab-phone::${PHONE_LEAF}:ready`)
+
+    registerLeaf(runtime, LOCAL_HOST, 'left')
+
+    expect(await listedSurfaces(runtime)).toContain(`tab-phone::${PHONE_LEAF}:ready`)
+  })
+})
diff --git a/src/main/runtime/orca-runtime-controller-knows-pty-is-live.ts b/src/main/runtime/orca-runtime-controller-knows-pty-is-live.ts
index 391b55ac5b0..3c9c8b7eab9 100644
--- a/src/main/runtime/orca-runtime-controller-knows-pty-is-live.ts
+++ b/src/main/runtime/orca-runtime-controller-knows-pty-is-live.ts
@@ -3,6 +3,7 @@ import { OrcaRuntimeWithResolveTerminalPane } from './orca-runtime-resolve-termi
 import { PROVEN_ABSENT_LEAF_PTY_TTL_MS } from './orca-runtime-core'
 import { pruneExpiredProvenAbsentLeafPtyVerdicts } from './proven-absent-leaf-pty-verdicts'
 import type { RuntimeTerminalSend } from '../../shared/runtime-types'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 import type { RuntimeAgentPromptWriteOptions } from './runtime-terminal-contracts'
 import {
   assertTerminalInputWithinLimitWithYield,
@@ -103,7 +104,8 @@ export class OrcaRuntimeWithControllerKnowsPtyIsLive extends OrcaRuntimeWithReso
       reserveWrite?: (ptyId: string) => void
       afterWrite?: (ptyId: string) => void | Promise<void>
       suffixFailureError?: string
-    } = {}
+      inputKind: TerminalInputKind
+    }
   ): Promise<RuntimeTerminalSend> {
     const pty = this.getLivePtyForHandle(handle)
     if (pty) {
@@ -152,7 +154,7 @@ export class OrcaRuntimeWithControllerKnowsPtyIsLive extends OrcaRuntimeWithReso
   async sendTerminalAgentPrompt(
     handle: string,
     prompt: string,
-    options: RuntimeAgentPromptWriteOptions = {}
+    options: RuntimeAgentPromptWriteOptions
   ): Promise<RuntimeTerminalSend> {
     // Why the consuming agent: the foreground process reads the bytes; launchAgent covers startup.
     const payloadFor = (ptyId: string): string => {
diff --git a/src/main/runtime/orca-runtime-create-agent-session.ts b/src/main/runtime/orca-runtime-create-agent-session.ts
index 6c5d11b8349..36e4d3f41a1 100644
--- a/src/main/runtime/orca-runtime-create-agent-session.ts
+++ b/src/main/runtime/orca-runtime-create-agent-session.ts
@@ -27,6 +27,7 @@ import {
   deterministicAgentSessionUuid,
   isAgentSessionOperationOutcomeUnknown
 } from './runtime-agent-launch-resolution'
+import { agentStartedTelemetry } from '../agent-launch/agent-started-telemetry'
 
 export class OrcaRuntimeWithCreateAgentSession extends OrcaRuntimeWithGetAgentSessionExecutionNamespace {
   async createAgentSession(
@@ -169,7 +170,6 @@ export class OrcaRuntimeWithCreateAgentSession extends OrcaRuntimeWithGetAgentSe
       if (!startup) {
         throw new Error('agent_session_identity_required')
       }
-      await this.markWorkspaceTrustedForAgent(request.agent, workspace.connectionId, workspace.path)
       if (caller.signal?.aborted) {
         throw new Error('client_disconnected')
       }
@@ -201,6 +201,8 @@ export class OrcaRuntimeWithCreateAgentSession extends OrcaRuntimeWithGetAgentSe
           launchAgent: request.agent,
           terminalKittyKeyboardProtocol: request.terminalKittyKeyboardProtocol,
           startupCommandDelivery: startup.startupCommandDelivery,
+          // A fresh agent this host built; the request has no surface field, so it counts as `unknown`.
+          telemetry: agentStartedTelemetry(request.agent, undefined),
           cwd: startupCwd,
           presentation: request.presentation ?? 'background',
           tabId: operationTabId,
diff --git a/src/main/runtime/orca-runtime-create-managed-remote-worktree.ts b/src/main/runtime/orca-runtime-create-managed-remote-worktree.ts
index 5d2cea95b5e..a62527e7071 100644
--- a/src/main/runtime/orca-runtime-create-managed-remote-worktree.ts
+++ b/src/main/runtime/orca-runtime-create-managed-remote-worktree.ts
@@ -28,8 +28,6 @@ export class OrcaRuntimeWithCreateManagedRemoteWorktree extends OrcaRuntimeWithC
     return createRuntimeRemoteManagedWorktree(repo, args, {
       store: this.store,
       canSpawn: () => Boolean(this.ptyController?.spawn),
-      markTrusted: (agent, connectionId, path) =>
-        this.markRemoteWorkspaceTrustedForAgent(agent, connectionId, path),
       createTerminal: (selector, options) => this.createTerminal(selector, options),
       pasteDraft: (handle, draft) => this.pasteStartupDraftWhenReady(handle, draft),
       sendFollowup: (handle, followup) => this.sendStartupFollowupWhenReady(handle, followup),
diff --git a/src/main/runtime/orca-runtime-create-managed-worktree.ts b/src/main/runtime/orca-runtime-create-managed-worktree.ts
index 79c0b612c05..e7fb519239a 100644
--- a/src/main/runtime/orca-runtime-create-managed-worktree.ts
+++ b/src/main/runtime/orca-runtime-create-managed-worktree.ts
@@ -68,7 +68,12 @@ export class OrcaRuntimeWithCreateManagedWorktree extends OrcaRuntimeWithGetWork
         : null
     const draftStartup =
       !args.startup && !agentStartup && args.startupDraft
-        ? await this.buildStartupForDraft(repo, args.startupDraft, requestedAgent)
+        ? await this.buildStartupForDraft(
+            repo,
+            args.startupDraft,
+            requestedAgent,
+            args.startupLaunchSource
+          )
         : null
     const effectiveStartup = args.startup ?? agentStartup?.startup ?? draftStartup?.startup
     const effectiveStartupFollowup = agentStartup?.followup
@@ -83,12 +88,8 @@ export class OrcaRuntimeWithCreateManagedWorktree extends OrcaRuntimeWithGetWork
     // an `executionHostId: 'ssh:*'`-only repo down the local path, which runs `git worktree add` on
     // the client against a remote path.
     const createRoute = resolveWorktreeCreateRoute(repo)
-    // `null` on a `runtime:` host is deliberate: its nested target is addressable only inside that
-    // environment, so the trust write must not go to a same-named target in this client's table.
-    const sshConnectionId = createRoute.kind === 'ssh' ? createRoute.connectionId : null
     if (isFolderRepo(repo)) {
-      // A folder workspace is a registration, not a filesystem create, so it is host-agnostic —
-      // except for the agent trust write, which must land on the host that will run the agent.
+      // A folder workspace is a registration, not a filesystem create, so it is host-agnostic.
       return createRuntimeFolderWorktree({
         request: args,
         repo,
@@ -100,8 +101,6 @@ export class OrcaRuntimeWithCreateManagedWorktree extends OrcaRuntimeWithGetWork
           store: this.store,
           ptySpawnAvailable: Boolean(this.ptyController?.spawn),
           createTerminal: (selector, options) => this.createTerminal(selector, options),
-          markTrusted: (agent, path) =>
-            this.markWorkspaceTrustedForAgent(agent, sshConnectionId, path),
           pasteDraft: (handle, draft) => this.pasteStartupDraftWhenReady(handle, draft),
           sendFollowup: (handle, followup) => this.sendStartupFollowupWhenReady(handle, followup),
           invalidateResolvedWorktrees: () => this.invalidateResolvedWorktreeCache(),
@@ -238,7 +237,6 @@ export class OrcaRuntimeWithCreateManagedWorktree extends OrcaRuntimeWithGetWork
       warning,
       ports: {
         canSpawn: Boolean(this.ptyController?.spawn),
-        markTrusted: (agent, path) => this.markLocalWorkspaceTrustedForAgent(agent, path),
         createTerminal: (selector, options) => this.createTerminal(selector, options),
         pasteDraft: (handle, draft) => this.pasteStartupDraftWhenReady(handle, draft),
         sendFollowup: (handle, followup) => this.sendStartupFollowupWhenReady(handle, followup),
diff --git a/src/main/runtime/orca-runtime-create-pty-headless-terminal-state.ts b/src/main/runtime/orca-runtime-create-pty-headless-terminal-state.ts
index b9f35478505..4ebeed55f90 100644
--- a/src/main/runtime/orca-runtime-create-pty-headless-terminal-state.ts
+++ b/src/main/runtime/orca-runtime-create-pty-headless-terminal-state.ts
@@ -6,6 +6,7 @@ import { shouldForwardHeadlessTerminalQueryReply } from './headless-terminal-que
 import { isNativeWindowsConptyPty } from './terminal-model-query-authority'
 import { getTerminalViewAttributes } from './terminal-view-attribute-store'
 import { PtyShellOwnershipMirror } from './pty-shell-ownership-mirror'
+import { PROCESS_BOUNDARY_GROUND } from '../../shared/terminal-mode-reset-profiles'
 
 export class OrcaRuntimeWithCreatePtyHeadlessTerminalState extends OrcaRuntimeWithMaybeHydrateHeadlessFromRenderer {
   /** Shared factory for the per-PTY runtime emulators (seed, hydration, and
@@ -45,7 +46,7 @@ export class OrcaRuntimeWithCreatePtyHeadlessTerminalState extends OrcaRuntimeWi
           // pending and flushes at the ready marker or the 15s
           // SHELL_READY_TIMEOUT_MS bound (session.ts) — a spawn-time query
           // reply is delayed at most that bound, not lost.
-          this.ptyController?.write(ptyId, reply)
+          this.ptyController?.write(ptyId, reply, 'query-reply')
         }
       }
     })
@@ -195,4 +196,21 @@ export class OrcaRuntimeWithCreatePtyHeadlessTerminalState extends OrcaRuntimeWi
     state.writeChain = state.writeChain.then(() => state.emulator.clearScrollback())
     await state.writeChain
   }
+
+  // Public: Reset Terminal must ground this model too; park/reveal and mobile restore from it.
+  async resetHeadlessTerminalInputModes(ptyId: string): Promise<void> {
+    // Why now, not on the chain: onPtyData scans live bytes into these on arrival.
+    // Focus is outside their model, so the plain ground is exact.
+    this.scanProviderModeTrackers(ptyId, PROCESS_BOUNDARY_GROUND)
+    const state = this.headlessTerminals.get(ptyId)
+    if (!state) {
+      return
+    }
+    // Why on the chain: the ground must land after every PTY chunk already queued.
+    const completion = state.writeChain.then(async () => {
+      await state.emulator.write(state.ownership.groundInputModes())
+    })
+    state.writeChain = completion.catch(() => {})
+    await completion
+  }
 }
diff --git a/src/main/runtime/orca-runtime-create-terminal.ts b/src/main/runtime/orca-runtime-create-terminal.ts
index c366b6e57ef..e95431dd51c 100644
--- a/src/main/runtime/orca-runtime-create-terminal.ts
+++ b/src/main/runtime/orca-runtime-create-terminal.ts
@@ -124,6 +124,7 @@ export class OrcaRuntimeWithCreateTerminal extends OrcaRuntimeWithTerminalCreate
         }
         let result: Awaited<ReturnType<NonNullable<dependencies.RuntimePtyController['spawn']>>>
         try {
+          launchOpts.onPtySpawnDispatched?.()
           result = await this.ptyController.spawn({
             cols: 120,
             rows: 40,
@@ -292,6 +293,8 @@ export class OrcaRuntimeWithCreateTerminal extends OrcaRuntimeWithTerminalCreate
         releaseStablePaneCreate()
       }
     }
+    // The renderer owns this spawn, so this process cannot see when it is requested.
+    opts.onPtySpawnDispatched?.()
     return createDesktopTerminal(this, worktreeSelector, opts, presentation, rendererWindow)
   }
 }
diff --git a/src/main/runtime/orca-runtime-deliver-pending-messages.ts b/src/main/runtime/orca-runtime-deliver-pending-messages.ts
index 55c6a8dad5e..2cd1cc69c00 100644
--- a/src/main/runtime/orca-runtime-deliver-pending-messages.ts
+++ b/src/main/runtime/orca-runtime-deliver-pending-messages.ts
@@ -137,7 +137,7 @@ export class OrcaRuntimeWithDeliverPendingMessages extends OrcaRuntimeWithResolv
     let settlesInEnterCallback = false
     try {
       const payload = formatMessagePointer(unread.length, mailboxHandle)
-      const wrote = this.ptyController?.write(deliveryPtyId, payload) ?? false
+      const wrote = this.ptyController?.write(deliveryPtyId, payload, 'driving') ?? false
       if (!wrote) {
         return
       }
@@ -171,7 +171,7 @@ export class OrcaRuntimeWithDeliverPendingMessages extends OrcaRuntimeWithResolv
           if (!currentLeaf || currentLeaf.ptyId !== deliveryPtyId || !currentLeaf.writable) {
             return
           }
-          this.ptyController?.write(deliveryPtyId, '\r')
+          this.ptyController?.write(deliveryPtyId, '\r', 'driving')
         } catch {
           // Terminal may have closed during the delay; mail remains queued for check.
         } finally {
diff --git a/src/main/runtime/orca-runtime-emit-daemon-pty-transient-fact.ts b/src/main/runtime/orca-runtime-emit-daemon-pty-transient-fact.ts
index 635d14e60d3..cc112a78ade 100644
--- a/src/main/runtime/orca-runtime-emit-daemon-pty-transient-fact.ts
+++ b/src/main/runtime/orca-runtime-emit-daemon-pty-transient-fact.ts
@@ -51,6 +51,7 @@ export class OrcaRuntimeWithEmitDaemonPtyTransientFact extends OrcaRuntimeWithSc
     const pty = this.getOrCreatePtyWorktreeRecord(ptyId)
     if (pty) {
       pty.tailPendingAnsi = ''
+      pty.commandPaint = undefined
     }
     for (const leaf of this.getLeavesForPty(ptyId)) {
       leaf.tailPendingAnsi = ''
diff --git a/src/main/runtime/orca-runtime-get-agent-session-execution-namespace.ts b/src/main/runtime/orca-runtime-get-agent-session-execution-namespace.ts
index a15be97f8a4..7f968a6ba7d 100644
--- a/src/main/runtime/orca-runtime-get-agent-session-execution-namespace.ts
+++ b/src/main/runtime/orca-runtime-get-agent-session-execution-namespace.ts
@@ -144,7 +144,6 @@ export class OrcaRuntimeWithGetAgentSessionExecutionNamespace extends OrcaRuntim
     if (!startup) {
       throw new Error('agent_session_identity_required')
     }
-    await this.markWorkspaceTrustedForAgent(request.agent, workspace.connectionId, workspace.path)
     if (_caller.signal?.aborted) {
       throw new Error('client_disconnected')
     }
diff --git a/src/main/runtime/orca-runtime-get-orchestration-dispatch-authority.ts b/src/main/runtime/orca-runtime-get-orchestration-dispatch-authority.ts
index d61374c3466..2e52e6f0748 100644
--- a/src/main/runtime/orca-runtime-get-orchestration-dispatch-authority.ts
+++ b/src/main/runtime/orca-runtime-get-orchestration-dispatch-authority.ts
@@ -16,12 +16,13 @@ import { resolveLocalProjectRuntimeForWorktreeId } from '../local-project-runtim
 import type { RuntimePtyWorktreeRecord } from './runtime-terminal-state-records'
 import {
   resolveTerminalOrchestrationCliCommand,
+  runtimeOrchestrationCliCommand,
   type OrchestrationCliCommand
 } from './orchestration/cli-command'
-import { getAppEnvironment } from '../../shared/app-environment'
 import type { FleetAgentStatusEvidence } from '../../shared/orchestration-fleet-agent-status-evidence'
 import { readOrchestrationFleetAgentStatusSnapshot } from './orchestration-fleet-agent-status-snapshot'
 import { resolveStructuredWorkerAuthority } from './structured-worker-authority'
+import { matchesProcessIncarnation } from './orchestration/worker-terminal-process-liveness'
 
 export class OrcaRuntimeWithGetOrchestrationDispatchAuthority extends OrcaRuntimeWithVerifyOrchestrationCompatibilityCaller {
   /** Every pane key this PTY could be addressed by, including restored receipts. */
@@ -263,11 +264,44 @@ export class OrcaRuntimeWithGetOrchestrationDispatchAuthority extends OrcaRuntim
       connectionId: pty.connectionId,
       isWsl: pty.isWsl,
       worktreeId: pty.worktreeId,
-      // Dev builds run the CLI as `orca-dev`; a packaged app must not advertise it.
-      runtimeCliCommand: getAppEnvironment().isPackaged() ? undefined : 'orca-dev',
+      runtimeCliCommand: runtimeOrchestrationCliCommand(),
       projectRuntime: this.store
         ? resolveLocalProjectRuntimeForWorktreeId(this.requireStore(), pty.worktreeId)
         : undefined
     })
   }
+  /**
+   * Recover a live terminal handle for a worker whose durable handle stopped resolving
+   * (renderer graph epoch bump / handle invalidation) while its PTY is still tracked. Fences on
+   * the recorded process incarnation EXACTLY — never a bare ptyId, worktree, or pane — so a
+   * reused ptyId belonging to a different process can never be closed, and fails closed on an
+   * unknown host scope (this is also consumed by workerShow, which does no lease re-check).
+   * Returns a freshly minted live handle, or null when no live PTY carries that exact incarnation.
+   */
+  resolveTerminalHandleByProcessIncarnation(
+    processIncarnation: string,
+    serializedHostScope: string | null
+  ): string | null {
+    if (!processIncarnation || !serializedHostScope) {
+      return null
+    }
+    // Scan by the incarnation itself (startsWith + exact equality, mirroring
+    // classifyWorkerTerminalProcessIncarnation) rather than splitting on a colon, so relay/SSH
+    // ptyIds and colon-bearing incarnationIds still match. A pty with no incarnationId can never
+    // match, so the legacy `${runtimeId}:${ptyId}:${ptyGeneration}` fence stays fail-closed.
+    for (const [ptyId, pty] of this.ptysById) {
+      if (!matchesProcessIncarnation(ptyId, pty.incarnationId, processIncarnation)) {
+        continue
+      }
+      const hostScope = this.getOrchestrationCompatibilityHostScope(pty)
+      if (!hostScope || JSON.stringify(hostScope) !== serializedHostScope) {
+        // Keep scanning: a colon-ambiguous decoy pty in a different host scope that this
+        // incarnation string happens to prefix-match must not suppress the genuine same-scope
+        // pty later in ptysById. The scope check still fences the real match below.
+        continue
+      }
+      return this.issuePtyHandle(pty)
+    }
+    return null
+  }
 }
diff --git a/src/main/runtime/orca-runtime-get-pty-record-for-pane-key.ts b/src/main/runtime/orca-runtime-get-pty-record-for-pane-key.ts
index 56455551349..5906ee91866 100644
--- a/src/main/runtime/orca-runtime-get-pty-record-for-pane-key.ts
+++ b/src/main/runtime/orca-runtime-get-pty-record-for-pane-key.ts
@@ -7,6 +7,13 @@ import { recognizeAgentProcess } from '../../shared/agent-process-recognition'
 import { resolveStructuredWorkerAuthority } from './structured-worker-authority'
 import { structuredWorkerIdentities } from './structured-worker-identity'
 import type { StructuredPointerTarget } from './orchestration/structured-mailbox-pointer-delivery'
+import {
+  handleLessCoordinatorSessionId,
+  structuredSessionAddressTarget,
+  structuredSessionMailTarget,
+  structuredSessionIdleEdgeMailboxes,
+  structuredWorkerMailSessionId
+} from './orchestration/structured-session-mail-target'
 import {
   resolveTerminalIdentityFromProbes,
   type RuntimeTerminalIdentity
@@ -187,6 +194,32 @@ export class OrcaRuntimeWithGetPtyRecordForPaneKey extends OrcaRuntimeWithPruneM
     this.orchestrationStructuredMailboxPointerDelivery.onJournalActivity(sessionId)
   }
 
+  /**
+   * Every structured session's status change reaches here. At its idle edge, retry what is parked
+   * on it and re-derive the mailboxes it owns, so mail it could not take earlier (mid-turn, closed)
+   * is pointed again. Workers and chats alike: this is not per-dispatch.
+   */
+  onStructuredSessionStatusForMail(summary: {
+    sessionId: string
+    status: 'working' | 'attention' | 'idle' | null
+  }): void {
+    if (summary.status === 'working' || summary.status === 'attention') {
+      return
+    }
+    // Logged, never thrown: the same status callback goes on to the first-turn workspace rename.
+    try {
+      this.notifyStructuredSessionJournalActivity(summary.sessionId)
+      const openDb = () => this.getExistingOrchestrationDb()
+      const deliver = (mailbox: string) => this.deliverPendingMessagesForHandle(mailbox)
+      structuredSessionIdleEdgeMailboxes(summary.sessionId, openDb).forEach(deliver)
+    } catch (error) {
+      console.warn('[orchestration] structured session mail redrive failed', {
+        sessionId: summary.sessionId,
+        error: error instanceof Error ? error.message : String(error)
+      })
+    }
+  }
+
   /** Settlement drops anything parked for the session; nothing will ever redrive it again. */
   forgetStructuredSessionMail(sessionId: string): void {
     this.orchestrationStructuredMailboxPointerDelivery.forgetSession(sessionId)
@@ -205,6 +238,10 @@ export class OrcaRuntimeWithGetPtyRecordForPaneKey extends OrcaRuntimeWithPruneM
     if (mailboxHandle.startsWith('run:')) {
       return this.resolveStructuredCoordinatorMailboxTarget(mailboxHandle.slice('run:'.length))
     }
+    const addressed = structuredSessionAddressTarget(mailboxHandle, this._orchestrationDb)
+    if (addressed !== undefined) {
+      return addressed
+    }
     if (!mailboxHandle.startsWith('dispatch:')) {
       return this.resolveStructuredWorkerDirectMailboxTarget(mailboxHandle)
     }
@@ -213,8 +250,8 @@ export class OrcaRuntimeWithGetPtyRecordForPaneKey extends OrcaRuntimeWithPruneM
     if (!assignee) {
       return null
     }
-    const identity = resolveStructuredWorkerAuthority(assignee, this._orchestrationDb)?.identity
-    return identity ? { sessionId: identity.sessionId, dispatchId } : null
+    const sessionId = this.liveStructuredWorkerSessionId(assignee)
+    return sessionId ? { sessionId, dispatchId } : null
   }
 
   /**
@@ -228,12 +265,17 @@ export class OrcaRuntimeWithGetPtyRecordForPaneKey extends OrcaRuntimeWithPruneM
   protected resolveStructuredCoordinatorMailboxTarget(
     runId: string
   ): StructuredPointerTarget | null {
-    const coordinator = this._orchestrationDb?.getRun?.(runId)?.coordinator_handle
+    const run = this._orchestrationDb?.getRun?.(runId)
+    const sessionId = run ? handleLessCoordinatorSessionId(run) : null
+    if (sessionId) {
+      return structuredSessionMailTarget(sessionId, this._orchestrationDb)
+    }
+    const coordinator = run?.coordinator_handle
     if (!coordinator) {
       return null
     }
-    const identity = resolveStructuredWorkerAuthority(coordinator, this._orchestrationDb)?.identity
-    return identity ? { sessionId: identity.sessionId, dispatchId: null } : null
+    const workerSessionId = this.liveStructuredWorkerSessionId(coordinator)
+    return workerSessionId ? { sessionId: workerSessionId, dispatchId: null } : null
   }
 
   /**
@@ -246,7 +288,7 @@ export class OrcaRuntimeWithGetPtyRecordForPaneKey extends OrcaRuntimeWithPruneM
    * The worker's ACTIVE dispatch is preferred when it has one, so peer and coordinator nudges share
    * one operation-ledger budget and one set of retain rules. A worker BETWEEN dispatches is still
    * nudged, under a session-scoped budget: the mail is durable, the session is live, and a dispatch
-   * says nothing about whether delivery is safe — the idle gate and the lease fence do that.
+   * says nothing about whether delivery is safe — the idle gate and the writer lease do that.
    */
   protected resolveStructuredWorkerDirectMailboxTarget(
     handle: string
@@ -255,11 +297,19 @@ export class OrcaRuntimeWithGetPtyRecordForPaneKey extends OrcaRuntimeWithPruneM
     // Answers null for anything that is not a live structured worker of THIS runtime, so `run:`
     // and PTY handles fall through to the PTY lane exactly as before.
     const identity = resolveStructuredWorkerAuthority(handle, db)?.identity
-    if (!identity) {
+    const sessionId = identity ? structuredWorkerMailSessionId(identity.sessionId) : null
+    if (!identity || !sessionId) {
       return null
     }
     const dispatchId = db?.findActiveDispatchForAssignee?.(handle, identity.paneKey)?.id ?? null
-    return { sessionId: identity.sessionId, dispatchId }
+    return { sessionId, dispatchId }
+  }
+
+  /** The live session behind a structured worker handle of this runtime; see
+   *  `structuredWorkerMailSessionId`. */
+  private liveStructuredWorkerSessionId(handle: string): string | null {
+    const identity = resolveStructuredWorkerAuthority(handle, this._orchestrationDb)?.identity
+    return identity ? structuredWorkerMailSessionId(identity.sessionId) : null
   }
 
   protected scheduleRestoredMessageRepoints(): void {
diff --git a/src/main/runtime/orca-runtime-get-runtime-id.ts b/src/main/runtime/orca-runtime-get-runtime-id.ts
index a56825a4a85..ee7fe60e85e 100644
--- a/src/main/runtime/orca-runtime-get-runtime-id.ts
+++ b/src/main/runtime/orca-runtime-get-runtime-id.ts
@@ -180,6 +180,10 @@ export class OrcaRuntimeWithGetRuntimeId extends OrcaRuntimeWithHasExactPersiste
     return this.workspaceSessions.get(worktreeId)
   }
 
+  protected getOwnWorkspaceSessionForWorktree(worktreeId: string): WorkspaceSessionState | null {
+    return this.workspaceSessions.getOwnPartition(worktreeId)
+  }
+
   protected setWorkspaceSessionForWorktree(
     worktreeId: string,
     session: WorkspaceSessionState
diff --git a/src/main/runtime/orca-runtime-get-status.ts b/src/main/runtime/orca-runtime-get-status.ts
index 4d2219e3e56..39b8dbf0dcf 100644
--- a/src/main/runtime/orca-runtime-get-status.ts
+++ b/src/main/runtime/orca-runtime-get-status.ts
@@ -15,6 +15,7 @@ import {
   RUNTIME_CAPABILITIES,
   RUNTIME_PROTOCOL_VERSION,
   SESSION_TABS_AUTHORITATIVE_INVENTORY_RUNTIME_CAPABILITY,
+  TERMINAL_PROMPT_DELIVERY_RUNTIME_CAPABILITY,
   TERMINAL_PAIRED_PARKING_RUNTIME_CAPABILITY
 } from '../../shared/protocol-version'
 import {
@@ -46,6 +47,17 @@ type RuntimeStatusHost = {
   ): string[]
 }
 
+function supportsDurableTerminalPromptDelivery(): boolean {
+  if (typeof process.getBuiltinModule !== 'function') {
+    return false
+  }
+  try {
+    return process.getBuiltinModule('node:sqlite') !== undefined
+  } catch {
+    return false
+  }
+}
+
 export class OrcaRuntimeWithGetStatus extends OrcaRuntimeWithGetRuntimeId {
   private asRuntimeStatusHost(): RuntimeStatusHost {
     return this as unknown as RuntimeStatusHost
@@ -76,7 +88,9 @@ export class OrcaRuntimeWithGetStatus extends OrcaRuntimeWithGetRuntimeId {
         (process.env.ORCA_E2E_DISABLE_PAIRED_TERMINAL_PARKING !== '1' ||
           capability !== TERMINAL_PAIRED_PARKING_RUNTIME_CAPABILITY) &&
         (process.env.ORCA_E2E_DISABLE_AUTHORITATIVE_SESSION_TABS_INVENTORY !== '1' ||
-          capability !== SESSION_TABS_AUTHORITATIVE_INVENTORY_RUNTIME_CAPABILITY)
+          capability !== SESSION_TABS_AUTHORITATIVE_INVENTORY_RUNTIME_CAPABILITY) &&
+        (capability !== TERMINAL_PROMPT_DELIVERY_RUNTIME_CAPABILITY ||
+          supportsDurableTerminalPromptDelivery())
     )
     if (hasOffscreen || hasHeadlessCommands) {
       capabilities.push(BROWSER_HEADLESS_RUNTIME_CAPABILITY)
diff --git a/src/main/runtime/orca-runtime-get-structured-agent-session-create-support.ts b/src/main/runtime/orca-runtime-get-structured-agent-session-create-support.ts
index f2143b9772c..e2f1bd34d45 100644
--- a/src/main/runtime/orca-runtime-get-structured-agent-session-create-support.ts
+++ b/src/main/runtime/orca-runtime-get-structured-agent-session-create-support.ts
@@ -1,4 +1,5 @@
 // @ts-nocheck -- mechanically split from OrcaRuntimeService; behavior is covered by AST equivalence and characterization tests.
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
 import { OrcaRuntimeWithGetWorktreePs } from './orca-runtime-get-worktree-ps'
 import { supportsCodexStructuredLocation } from '../codex/codex-structured-location-support'
 import { supportsClaudeStructuredLocation } from '../claude/claude-structured-location-support'
@@ -21,6 +22,7 @@ import { hasPersistedStructuredAgentSessionStore as hasPersistedStructuredAgentS
 import { getProfileUserDataPath } from '../orca-profiles/profile-storage-paths'
 import { parseWslUncPath } from '../../shared/wsl-paths'
 import { parseWorkspaceKey } from '../../shared/workspace-scope'
+import { applyStructuredCodexWorkspaceTrust } from '../agent-workspace-trust-spawn'
 
 export class OrcaRuntimeWithGetStructuredAgentSessionCreateSupport extends OrcaRuntimeWithGetWorktreePs {
   async getStructuredAgentSessionCreateSupport(
@@ -92,13 +94,17 @@ export class OrcaRuntimeWithGetStructuredAgentSessionCreateSupport extends OrcaR
         })
       )
     }
-    return this.resolveStructuredAgentSessionIntent(input, ({ workspacePath, launchEnv }) =>
-      resolveStructuredCodexAccountHomePath({
+    return this.resolveStructuredAgentSessionIntent(input, async ({ launchEnv }) => {
+      await applyStructuredCodexWorkspaceTrust({
+        workspacePath: (await this.resolveRuntimeFileTarget(input.worktree)).worktree.path,
         launchEnv,
-        resolveLaunchHome: this.prepareCodexStructuredLaunchFn,
-        workspacePath
+        settings: this.requireStore().getSettings()
       })
-    )
+      return resolveStructuredCodexAccountHomePath({
+        launchEnv,
+        resolveLaunchHome: this.prepareCodexStructuredLaunchFn
+      })
+    })
   }
 
   /**
@@ -129,8 +135,7 @@ export class OrcaRuntimeWithGetStructuredAgentSessionCreateSupport extends OrcaR
       // must not sync homes, start bridges, or clear an account selection.
       path: await resolveStructuredCodexAccountHomePath({
         launchEnv,
-        resolveLaunchHome: this.resolveCodexStructuredLaunchHomeFn,
-        workspacePath: ''
+        resolveLaunchHome: this.resolveCodexStructuredLaunchHomeFn
       })
     }
   }
@@ -144,7 +149,6 @@ export class OrcaRuntimeWithGetStructuredAgentSessionCreateSupport extends OrcaR
       resumeFrom?: { providerSessionId: string }
     },
     resolveAccountHomePath: (context: {
-      workspacePath: string
       launchEnv: NodeJS.ProcessEnv
       location: {
         executionHostId: string
@@ -156,7 +160,9 @@ export class OrcaRuntimeWithGetStructuredAgentSessionCreateSupport extends OrcaR
   ): Promise<AgentSessionAttachParams> {
     const support = await this.getStructuredAgentSessionCreateSupport(input.worktree, input.agent)
     if (!support.supported) {
-      throw new Error('structured_agent_session_unsupported')
+      throw agentSessionRefusalError('structured_agent_session_unsupported', {
+        reason: 'hostUnsupported'
+      })
     }
     const settings = this.requireStore().getSettings()
     const launchEnv = resolveTuiAgentLaunchEnv(input.agent, settings.agentDefaultEnv)
@@ -165,7 +171,6 @@ export class OrcaRuntimeWithGetStructuredAgentSessionCreateSupport extends OrcaR
       input.agent
     )
     const location = await this.resolveStructuredAgentSessionLocation(input.worktree)
-    const workspacePath = (await this.resolveRuntimeFileTarget(input.worktree)).worktree.path
     const host = getStructuredAgentSessionHost()
     const committedReplay = resolveCommittedStructuredAgentSessionAdoptionIntent({
       host,
@@ -176,11 +181,7 @@ export class OrcaRuntimeWithGetStructuredAgentSessionCreateSupport extends OrcaR
     if (committedReplay) {
       return committedReplay
     }
-    const selectedAccountHomePath = await resolveAccountHomePath({
-      workspacePath,
-      launchEnv,
-      location
-    })
+    const selectedAccountHomePath = await resolveAccountHomePath({ launchEnv, location })
     // Adopting pins the account home to wherever the conversation actually lives, which is not
     // necessarily the one a fresh create would pick: Codex resolves its rollout under
     // `accountHome.path`, and Claude reads its transcript under `<home>/projects`. Resuming under
diff --git a/src/main/runtime/orca-runtime-get-worktree-ps.ts b/src/main/runtime/orca-runtime-get-worktree-ps.ts
index cf7e8e56db1..adcd47baad3 100644
--- a/src/main/runtime/orca-runtime-get-worktree-ps.ts
+++ b/src/main/runtime/orca-runtime-get-worktree-ps.ts
@@ -19,6 +19,7 @@ import { firstWorkRenameDeps } from '../agent-hooks/first-work-rename-runtime'
 import { getProfileUserDataPath } from '../orca-profiles/profile-storage-paths'
 import { LOCAL_EXECUTION_HOST_ID } from '../../shared/execution-host'
 import { buildWorktreeListingPage } from './worktree-listing-host-scope'
+import { structuredWorkerOwesWork } from './structured-worker-custody'
 import { resolveTuiAgentLaunchEnv } from '../../shared/tui-agent-launch-defaults'
 import { nativeChatShellEnvironmentPolicy } from '../../shared/native-chat-shell-environment'
 import { claudeStructuredPermissionModeForSettings } from '../claude/claude-structured-permission-mode'
@@ -165,13 +166,18 @@ export class OrcaRuntimeWithGetWorktreePs extends OrcaRuntimeWithStartTuiIdleVis
       // Structured chat has no agent CLI hooks, so this projection is what the first-work
       // workspace rename listens to instead of `agentStatus:set`.
       onSessionStatusChanged: (summary, options) => {
+        this.onStructuredSessionStatusForMail(summary)
         void maybeAutoRenameWorkspaceOnFirstStructuredTurn(
           summary,
           options,
           firstWorkRenameDeps(this.requireStore(), this)
         )
       },
-      ...(this.structuredAgentStatusSinkFn ? { statusSink: this.structuredAgentStatusSinkFn } : {})
+      ...(this.structuredAgentStatusSinkFn ? { statusSink: this.structuredAgentStatusSinkFn } : {}),
+      // Read per sweep tick from the orchestration database: a worker whose dispatch is open keeps
+      // its agent running. No database answers no.
+      hasOpenDispatch: (record) =>
+        structuredWorkerOwesWork(this.getOrchestrationDbIfAvailable?.() ?? null, record)
     })
   }
 }
diff --git a/src/main/runtime/orca-runtime-get-worktree-terminal-provisioning-host.ts b/src/main/runtime/orca-runtime-get-worktree-terminal-provisioning-host.ts
index d9d6b2acfb9..7f42304eb8b 100644
--- a/src/main/runtime/orca-runtime-get-worktree-terminal-provisioning-host.ts
+++ b/src/main/runtime/orca-runtime-get-worktree-terminal-provisioning-host.ts
@@ -36,7 +36,7 @@ export class OrcaRuntimeWithGetWorktreeTerminalProvisioningHost extends OrcaRunt
         this.ptyController!.hasChildProcesses?.(ptyId) ?? Promise.resolve(false),
       subscribeToData: (ptyId, listener) => this.subscribeToTerminalData(ptyId, listener),
       readRecentOutput: (ptyId) => this.recentPtyOutputById.get(ptyId)?.read(),
-      write: (ptyId, data) => this.ptyController?.write(ptyId, data)
+      write: (ptyId, data, inputKind) => this.ptyController?.write(ptyId, data, inputKind)
     }
   }
 
diff --git a/src/main/runtime/orca-runtime-has-exact-persisted-terminal-surface-identity.ts b/src/main/runtime/orca-runtime-has-exact-persisted-terminal-surface-identity.ts
index d0425cdc1f9..7aea8a0d0d7 100644
--- a/src/main/runtime/orca-runtime-has-exact-persisted-terminal-surface-identity.ts
+++ b/src/main/runtime/orca-runtime-has-exact-persisted-terminal-surface-identity.ts
@@ -5,6 +5,8 @@ import {
   runtimeWorktreeIdsEqual
 } from './runtime-worktree-path-identity'
 import { makePaneKey } from '../../shared/stable-pane-id'
+import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
+import { layoutContainsLeafId } from '../persistence/restoring-sessions/terminal-layout-normalization'
 import type { LegacyWorkerTerminalRecoveryPlan } from './orchestration/orchestration-legacy-worker-terminal-recovery'
 import { retireTerminalSurfacesFromSnapshot } from './mobile-session-terminal-retirement'
 import type {
@@ -27,6 +29,35 @@ import type {
 } from '../../shared/artifacts'
 
 export class OrcaRuntimeWithHasExactPersistedTerminalSurfaceIdentity extends OrcaRuntimeWithAutomationOperations {
+  /** The host's saved session, when it still lists `tabId` under this worktree. */
+  protected getPersistedSessionListingTerminalTab(
+    worktreeId: string,
+    tabId: string,
+    session = this.getWorkspaceSessionForWorktree(worktreeId)
+  ): WorkspaceSessionState | null {
+    const sessionWorktreeId = session ? resolveTerminalSessionWorktreeId(session, worktreeId) : null
+    return session &&
+      sessionWorktreeId &&
+      session.tabsByWorktree[sessionWorktreeId]?.some((candidate) => candidate.id === tabId)
+      ? session
+      : null
+  }
+
+  protected hasPersistedTerminalSurfaceMembership(
+    worktreeId: string,
+    tabId: string,
+    leafId: string
+  ): boolean {
+    // Why own partition: emptying a rotated runtime partition re-routes reads to an older copy
+    // that can still list a surface retirement just removed.
+    const layout = this.getPersistedSessionListingTerminalTab(
+      worktreeId,
+      tabId,
+      this.getOwnWorkspaceSessionForWorktree(worktreeId)
+    )?.terminalLayoutsByTabId[tabId]
+    return Boolean(layout && layoutContainsLeafId(layout.root, leafId))
+  }
+
   protected hasExactPersistedTerminalSurfaceIdentity(expected: {
     worktreeId: string
     tabId: string
@@ -34,19 +65,10 @@ export class OrcaRuntimeWithHasExactPersistedTerminalSurfaceIdentity extends Orc
     ptyId: string
     incarnationId: string
   }): boolean {
-    const session = this.getWorkspaceSessionForWorktree(expected.worktreeId)
-    const sessionWorktreeId = session
-      ? resolveTerminalSessionWorktreeId(session, expected.worktreeId)
-      : null
-    if (!session || !sessionWorktreeId) {
-      return false
-    }
-    const tab = session.tabsByWorktree[sessionWorktreeId]?.find(
-      (candidate) => candidate.id === expected.tabId
-    )
+    const session = this.getPersistedSessionListingTerminalTab(expected.worktreeId, expected.tabId)
     const paneKey = makePaneKey(expected.tabId, expected.leafId)
     return Boolean(
-      tab &&
+      session &&
       session.terminalLayoutsByTabId[expected.tabId]?.ptyIdsByLeafId?.[expected.leafId] ===
         expected.ptyId &&
       session.terminalPtyIncarnationsByPaneKey?.[paneKey] === expected.incarnationId
diff --git a/src/main/runtime/orca-runtime-maybe-hydrate-headless-from-renderer.ts b/src/main/runtime/orca-runtime-maybe-hydrate-headless-from-renderer.ts
index 63135f261b7..3e8d618e8a4 100644
--- a/src/main/runtime/orca-runtime-maybe-hydrate-headless-from-renderer.ts
+++ b/src/main/runtime/orca-runtime-maybe-hydrate-headless-from-renderer.ts
@@ -1,5 +1,7 @@
 // @ts-nocheck -- mechanically split from OrcaRuntimeService; behavior is covered by AST equivalence and characterization tests.
+import { splitFreebuffScreenUpdates } from '../../shared/freebuff-screen-status'
 import { OrcaRuntimeWithSerializeMainTerminalBuffer } from './orca-runtime-serialize-main-terminal-buffer'
+import { observeFreebuffTerminalStatus } from './freebuff-terminal-status'
 import { MOBILE_SUBSCRIBE_SCROLLBACK_ROWS } from './scrollback-limits'
 import { detectAgentStatusFromTitle, normalizeTerminalTitle } from '../../shared/agent-detection'
 import { shouldModelAnswerHiddenPtyQueries } from './terminal-model-query-authority'
@@ -171,7 +173,26 @@ export class OrcaRuntimeWithMaybeHydrateHeadlessFromRenderer extends OrcaRuntime
       // Why inside the chain: the ownership mirror must observe live bytes in
       // the same total order as seeds (seedOwner also runs on this chain).
       state.ownership.scan(data)
-      await state.emulator.write(data, { forwardQueryReplies })
+      for (const chunk of splitFreebuffScreenUpdates(data, state.emulator.partialEscapeTailAnsi)) {
+        await state.emulator.write(chunk, { forwardQueryReplies })
+        const pty = this.ptysById.get(ptyId)
+        if (pty && !pty.connectionId && this.headlessTerminals.get(ptyId) === state) {
+          const payload = observeFreebuffTerminalStatus(
+            state.emulator,
+            chunk,
+            this.terminalSpawnCommandsByPtyId.get(ptyId),
+            pty.launchAgent
+          )
+          if (payload) {
+            pty.lastExplicitAgentStatus = { state: payload.state, updatedAt: Date.now() }
+            this.emitTerminalAgentStatusEvents(ptyId, {
+              cleanData: '',
+              payloads: [payload],
+              lastPayloadCleanOffset: null
+            })
+          }
+        }
+      }
       state.outputSequence = outputSequence
     })
     // Legacy callers remain best-effort; bounded SSH admission observes the raw receipt.
diff --git a/src/main/runtime/orca-runtime-mobile-close-preserved-resurrection.test.ts b/src/main/runtime/orca-runtime-mobile-close-preserved-resurrection.test.ts
index 5780b353944..4260c8213ef 100644
--- a/src/main/runtime/orca-runtime-mobile-close-preserved-resurrection.test.ts
+++ b/src/main/runtime/orca-runtime-mobile-close-preserved-resurrection.test.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
 /**
  * STA-4593 incident: closing paired-remote tabs "worked briefly" but the tabs
  * returned seconds later and after workspace switches, on a host whose PTYs
@@ -103,7 +104,7 @@ function createHarness() {
     badgeColor: '#000000',
     addedAt: 1
   }
-  const store = {
+  const store = withDurableRuntimeStore({
     getRepos: () => [repo],
     getRepo: (id: string) => (id === REPO_ID ? repo : undefined),
     getAllWorktreeMeta: () => ({}),
@@ -115,7 +116,7 @@ function createHarness() {
       session = next
     },
     flushOrThrow: () => {}
-  }
+  })
   const relayAck = makeDeferred()
   const closeTerminal = vi.fn()
   const closeTerminalTab = vi.fn(() => relayAck.promise)
@@ -277,7 +278,7 @@ function createSplitHarness() {
     badgeColor: '#000000',
     addedAt: 1
   }
-  const store = {
+  const store = withDurableRuntimeStore({
     getRepos: () => [repo],
     getRepo: (id: string) => (id === REPO_ID ? repo : undefined),
     getAllWorktreeMeta: () => ({}),
@@ -289,7 +290,7 @@ function createSplitHarness() {
       session = next
     },
     flushOrThrow: () => {}
-  }
+  })
   const runtime = new OrcaRuntimeService(store as never)
   runtime.setNotifier({ closeTerminal: vi.fn(), closeTerminalTab: vi.fn(async () => {}) } as never)
   runtime.setPtyController({
diff --git a/src/main/runtime/orca-runtime-on-pty-data.ts b/src/main/runtime/orca-runtime-on-pty-data.ts
index 160c99f2071..52c1fb32551 100644
--- a/src/main/runtime/orca-runtime-on-pty-data.ts
+++ b/src/main/runtime/orca-runtime-on-pty-data.ts
@@ -4,6 +4,7 @@ import type { TerminalOutputSourceRange } from '../../shared/terminal-output-sou
 import { advertisedUrlWatcher } from '../ports/advertised-url-watcher'
 import { appendNormalizedToTailBuffer } from './terminal-tail-buffer'
 import { normalizeTerminalChunk } from './terminal-ansi-normalization'
+import { observeTerminalCommandPaint } from './terminal-command-paint'
 import {
   appendCompletedTerminalTranscript,
   buildPreview,
@@ -16,6 +17,14 @@ import {
 import { extractOscTitleScanTail } from '../../shared/osc-title-scan-tail'
 
 export class OrcaRuntimeWithOnPtyData extends OrcaRuntimeWithPreparePtyExecutionContext {
+  /** Arrival-order mode scan: the settled tracker plus any in-flight snapshot capture's. */
+  protected scanProviderModeTrackers(ptyId: string, data: string): void {
+    this.providerModeTrackersByPtyId.get(ptyId)?.scan(data)
+    for (const tracker of this.providerModeSnapshotScansByPtyId.get(ptyId) ?? []) {
+      tracker.scan(data)
+    }
+  }
+
   onPtyData(
     ptyId: string,
     data: string,
@@ -27,10 +36,7 @@ export class OrcaRuntimeWithOnPtyData extends OrcaRuntimeWithPreparePtyExecution
   ): number {
     const outputSequence = (this.ptyOutputSequenceById.get(ptyId) ?? 0) + sequenceChars
     this.ptyOutputSequenceById.set(ptyId, outputSequence)
-    this.providerModeTrackersByPtyId.get(ptyId)?.scan(data)
-    for (const tracker of this.providerModeSnapshotScansByPtyId.get(ptyId) ?? []) {
-      tracker.scan(data)
-    }
+    this.scanProviderModeTrackers(ptyId, data)
     const osc7Metadata = this.recordOsc7MetadataForPty(ptyId, data)
     const cwd = osc7Metadata.cwd
     const cwdChanged = osc7Metadata.cwdChanged
@@ -86,6 +92,7 @@ export class OrcaRuntimeWithOnPtyData extends OrcaRuntimeWithPreparePtyExecution
       pty.lastOutputAt = at
       const normalized = normalizeTerminalChunk(data, pty.tailPendingAnsi)
       pty.tailPendingAnsi = normalized.pendingAnsi
+      observeTerminalCommandPaint(pty, data, normalized.text)
       const nextTail = appendNormalizedToTailBuffer(
         pty.tailBuffer,
         pty.tailPartialLine,
diff --git a/src/main/runtime/orca-runtime-on-pty-exit.ts b/src/main/runtime/orca-runtime-on-pty-exit.ts
index 588a834d6e6..abcf2fcf57f 100644
--- a/src/main/runtime/orca-runtime-on-pty-exit.ts
+++ b/src/main/runtime/orca-runtime-on-pty-exit.ts
@@ -24,7 +24,7 @@ export class OrcaRuntimeWithOnPtyExit extends OrcaRuntimeWithOnClientDisconnecte
        * as -1, so the numeric code alone cannot tell a dead process from a failed stop. */
       providerExitObserved?: boolean
     } = {}
-  ): void {
+  ): void | Promise<void> {
     const pty = this.ptysById.get(ptyId)
     if (exitIncarnationId && pty?.incarnationId && exitIncarnationId !== pty.incarnationId) {
       return
@@ -68,161 +68,172 @@ export class OrcaRuntimeWithOnPtyExit extends OrcaRuntimeWithOnClientDisconnecte
       pty?.incarnationId ??
       `runtime:${this.runtimeId}:${this.getPtyLifecycleGeneration(ptyId)}`
     this.advancePtyLifecycleGeneration(ptyId)
-    this.notifyPtyExitListeners(ptyId)
-    const exactSurfaceByKey = new Map<
-      string,
-      Pick<RetiredTerminalSurface, 'worktreeId' | 'parentTabId' | 'leafId'>
-    >()
-    for (const [worktreeId, snapshot] of this.mobileSessionTabsByWorktree) {
-      for (const tab of snapshot.tabs) {
-        if (tab.type === 'terminal' && tab.ptyId === ptyId) {
-          exactSurfaceByKey.set(`${worktreeId}\0${tab.parentTabId}\0${tab.leafId}`, {
-            worktreeId,
-            parentTabId: tab.parentTabId,
-            leafId: tab.leafId
-          })
+    let retirement: Promise<void> | undefined
+    try {
+      const exactSurfaceByKey = new Map<
+        string,
+        Pick<RetiredTerminalSurface, 'worktreeId' | 'parentTabId' | 'leafId'>
+      >()
+      for (const [worktreeId, snapshot] of this.mobileSessionTabsByWorktree) {
+        for (const tab of snapshot.tabs) {
+          if (
+            tab.type === 'terminal' &&
+            (tab.ptyId === ptyId || tab.parentLayout?.ptyIdsByLeafId?.[tab.leafId] === ptyId)
+          ) {
+            exactSurfaceByKey.set(`${worktreeId}\0${tab.parentTabId}\0${tab.leafId}`, {
+              worktreeId,
+              parentTabId: tab.parentTabId,
+              leafId: tab.leafId
+            })
+          }
         }
       }
-    }
-    for (const leaf of this.getLeavesForPty(ptyId)) {
-      exactSurfaceByKey.set(`${leaf.worktreeId}\0${leaf.tabId}\0${leaf.leafId}`, {
-        worktreeId: leaf.worktreeId,
-        parentTabId: leaf.tabId,
-        leafId: leaf.leafId
-      })
-    }
-    const parsedPaneKey = parsePaneKey(pty?.paneKey ?? '')
-    if (pty?.tabId && parsedPaneKey) {
-      exactSurfaceByKey.set(`${pty.worktreeId}\0${pty.tabId}\0${parsedPaneKey.leafId}`, {
-        worktreeId: pty.worktreeId,
-        parentTabId: pty.tabId,
-        leafId: parsedPaneKey.leafId
-      })
-    }
-    const exactSurfaces = [...exactSurfaceByKey.values()]
-    const pendingIncarnation = this.pendingPtyRegistrationIncarnations.get(ptyId)
-    const exitMatchesPendingRegistration =
-      this.pendingPtyRegistrationIncarnations.has(ptyId) &&
-      (pendingIncarnation === null ||
-        exitIncarnationId === null ||
-        exitIncarnationId === undefined ||
-        pendingIncarnation === exitIncarnationId)
-    if (exitMatchesPendingRegistration) {
-      // Why: reused surfaces can look registered while their replacement incarnation still awaits admission.
-      this.earlyExitedPtyIncarnations.set(
-        ptyId,
-        exitIncarnationId ?? pendingIncarnation ?? pty?.incarnationId ?? null
-      )
-    }
-    const intentionalStopIncarnation = this.intentionalHandlelessPtyStops.get(ptyId)
-    const preservesIntentionalHandlelessSurface =
-      this.intentionalHandlelessPtyStops.has(ptyId) &&
-      (intentionalStopIncarnation === null || intentionalStopIncarnation === incarnationId)
-    advertisedUrlWatcher.unbindPty(ptyId)
-    // Clean up new mobile state for this PTY
-    this.mobileSubscribers.delete(ptyId)
-    this.terminalViewSubscribers.clearSubscribers(ptyId)
-    this.mobileDisplayModes.delete(ptyId)
-    this.resizeListeners.delete(ptyId)
-    this.lastRendererSizes.delete(ptyId)
-    this.recentPtyOutputById.delete(ptyId)
-    this.setupCompletionTokenByPtyId.delete(ptyId)
-    this.clearWaitBlockedCheckState(ptyId)
-    this.recentPtyPathCandidatesById.delete(ptyId)
-    this.ptyOutputSequenceById.delete(ptyId)
-    this.providerSequenceInitializedPtys.delete(ptyId)
-    this.providerSequenceOffsetByPtyId.delete(ptyId)
-    this.providerSnapshotPreferredPtys.delete(ptyId)
-    this.providerModeTrackersByPtyId.delete(ptyId)
-    this.providerModeSnapshotScansByPtyId.delete(ptyId)
-    this.providerBufferAcquisitionsByPtyId.delete(ptyId)
-    this.providerVisibleStateByPtyId.delete(ptyId)
-    this.providerVisibleRetryAtByPtyId.delete(ptyId)
-    this.agentPromptExplicitStatusFloorByPtyId.delete(ptyId)
-    // Safe against respawn: `getPtyLifecycleGeneration` lazily mints from the
-    // monotonic `nextPtyLifecycleGeneration`, so a re-read after this delete
-    // returns a strictly newer number — never a reused one. Every comparison a
-    // stale frame makes therefore still fails, exactly as the advance above intends.
-    this.ptyLifecycleGenerationById.delete(ptyId)
-    this.agentStatusOscProcessorsByPtyId.delete(ptyId)
-    this.terminalSpawnCommandsByPtyId.delete(ptyId)
-    this.disposePtyTitleTracker(ptyId)
-    this.oscTitleScanTailByPtyId.delete(ptyId)
-    this.osc7ScanTailByPtyId.delete(ptyId)
-    this.terminalCwdByPtyId.delete(ptyId)
-    this.terminalFileUriHostnameByPtyId.delete(ptyId)
-    this.wslDistroByPtyId.delete(ptyId)
-    // Why: a Claude agent-team leader whose PTY exits naturally (agent finished,
-    // process died, renderer reload) must release its team + nested panes map.
-    // Previously only explicit closeTerminal evicted it, so natural exits leaked
-    // one team per never-reused teamId for the runtime's lifetime.
-    const exitedTeamLeaderHandle = this.handleByPtyId.get(ptyId)
-    if (exitedTeamLeaderHandle) {
-      this.claudeAgentTeams.removeTeamForLeaderHandle(exitedTeamLeaderHandle)
-    }
-    // Layout state machine: clear `layouts` and `layoutQueues`. Any
-    // already-queued applyLayout work for this ptyId will run, but every
-    // applyLayout re-checks `layouts.has(ptyId)` (or fresh-subscribe) and
-    // short-circuits with `pty-exited`.
-    this.layouts.delete(ptyId)
-    this.layoutQueues.delete(ptyId)
-    this.freshSubscribeGuard.delete(ptyId)
-    this.cancelPendingDriverMutations(ptyId)
-    // Why: a cold restore can respawn under the same session id within the
-    // delayed-Enter window; the armed Enter would inject \r into the
-    // replacement and stamp rows it never received.
-    this.orchestrationMailboxNotifications.retirePty(ptyId)
-    // Why: the dead pty's terminal handle and any run bound to its panes still carry mailbox
-    // pointers; schedule a debounced repoint so they do not stay aimed at a retired session.
-    for (const leaf of this.getLeavesForPty(ptyId)) {
-      const mailboxHandle = this.handleByLeafKey.get(this.getLeafKey(leaf.tabId, leaf.leafId))
-      if (mailboxHandle) {
-        this.mailPointerRepointScheduler.schedule(mailboxHandle)
+      for (const leaf of this.getLeavesForPty(ptyId)) {
+        exactSurfaceByKey.set(`${leaf.worktreeId}\0${leaf.tabId}\0${leaf.leafId}`, {
+          worktreeId: leaf.worktreeId,
+          parentTabId: leaf.tabId,
+          leafId: leaf.leafId
+        })
       }
-      const boundRun = this._orchestrationDb?.getCurrentRunForPane?.(`${leaf.tabId}:${leaf.leafId}`)
-      if (boundRun) {
-        this.mailPointerRepointScheduler.schedule(`run:${boundRun.id}`)
+      const parsedPaneKey = parsePaneKey(pty?.paneKey ?? '')
+      if (pty?.tabId && parsedPaneKey) {
+        exactSurfaceByKey.set(`${pty.worktreeId}\0${pty.tabId}\0${parsedPaneKey.leafId}`, {
+          worktreeId: pty.worktreeId,
+          parentTabId: pty.tabId,
+          leafId: parsedPaneKey.leafId
+        })
+      }
+      const exactSurfaces = [...exactSurfaceByKey.values()]
+      const pendingIncarnation = this.pendingPtyRegistrationIncarnations.get(ptyId)
+      const exitMatchesPendingRegistration =
+        this.pendingPtyRegistrationIncarnations.has(ptyId) &&
+        (pendingIncarnation === null ||
+          exitIncarnationId === null ||
+          exitIncarnationId === undefined ||
+          pendingIncarnation === exitIncarnationId)
+      if (exitMatchesPendingRegistration) {
+        // Why: reused surfaces can look registered while their replacement incarnation still awaits admission.
+        this.earlyExitedPtyIncarnations.set(
+          ptyId,
+          exitIncarnationId ?? pendingIncarnation ?? pty?.incarnationId ?? null
+        )
+      }
+      // Why both kinds: a sleep keeps its wake hint, and a restart's replacement takes the pane.
+      const preservesIntentionallyStoppedSurface =
+        this.intentionalPtyStops.claimExit(ptyId, exitIncarnationId ?? pty?.incarnationId).length >
+        0
+      advertisedUrlWatcher.unbindPty(ptyId)
+      // Clean up new mobile state for this PTY
+      this.mobileSubscribers.delete(ptyId)
+      this.terminalViewSubscribers.clearSubscribers(ptyId)
+      this.mobileDisplayModes.delete(ptyId)
+      this.resizeListeners.delete(ptyId)
+      this.lastRendererSizes.delete(ptyId)
+      this.recentPtyOutputById.delete(ptyId)
+      this.setupCompletionTokenByPtyId.delete(ptyId)
+      this.clearWaitBlockedCheckState(ptyId)
+      this.recentPtyPathCandidatesById.delete(ptyId)
+      this.ptyOutputSequenceById.delete(ptyId)
+      this.providerSequenceInitializedPtys.delete(ptyId)
+      this.providerSequenceOffsetByPtyId.delete(ptyId)
+      this.providerSnapshotPreferredPtys.delete(ptyId)
+      this.providerModeTrackersByPtyId.delete(ptyId)
+      this.providerModeSnapshotScansByPtyId.delete(ptyId)
+      this.providerBufferAcquisitionsByPtyId.delete(ptyId)
+      this.providerVisibleStateByPtyId.delete(ptyId)
+      this.providerVisibleRetryAtByPtyId.delete(ptyId)
+      this.agentPromptExplicitStatusFloorByPtyId.delete(ptyId)
+      this.ptyLifecycleGenerationById.delete(ptyId)
+      this.agentStatusOscProcessorsByPtyId.delete(ptyId)
+      this.terminalSpawnCommandsByPtyId.delete(ptyId)
+      this.disposePtyTitleTracker(ptyId)
+      this.oscTitleScanTailByPtyId.delete(ptyId)
+      this.osc7ScanTailByPtyId.delete(ptyId)
+      this.terminalCwdByPtyId.delete(ptyId)
+      this.terminalFileUriHostnameByPtyId.delete(ptyId)
+      this.wslDistroByPtyId.delete(ptyId)
+      // Why: a Claude agent-team leader whose PTY exits naturally (agent finished,
+      // process died, renderer reload) must release its team + nested panes map.
+      // Previously only explicit closeTerminal evicted it, so natural exits leaked
+      // one team per never-reused teamId for the runtime's lifetime.
+      const exitedTeamLeaderHandle = this.handleByPtyId.get(ptyId)
+      if (exitedTeamLeaderHandle) {
+        this.claudeAgentTeams.removeTeamForLeaderHandle(exitedTeamLeaderHandle)
+      }
+      // Layout state machine: clear `layouts` and `layoutQueues`. Any
+      // already-queued applyLayout work for this ptyId will run, but every
+      // applyLayout re-checks `layouts.has(ptyId)` (or fresh-subscribe) and
+      // short-circuits with `pty-exited`.
+      this.layouts.delete(ptyId)
+      this.layoutQueues.delete(ptyId)
+      this.freshSubscribeGuard.delete(ptyId)
+      this.cancelPendingDriverMutations(ptyId)
+      // Why: a cold restore can respawn under the same session id within the
+      // delayed-Enter window; the armed Enter would inject \r into the
+      // replacement and stamp rows it never received.
+      this.orchestrationMailboxNotifications.retirePty(ptyId)
+      // Why: the dead pty's terminal handle and any run bound to its panes still carry mailbox
+      // pointers; schedule a debounced repoint so they do not stay aimed at a retired session.
+      for (const leaf of this.getLeavesForPty(ptyId)) {
+        const mailboxHandle = this.handleByLeafKey.get(this.getLeafKey(leaf.tabId, leaf.leafId))
+        if (mailboxHandle) {
+          this.mailPointerRepointScheduler.schedule(mailboxHandle)
+        }
+        const boundRun = this._orchestrationDb?.getCurrentRunForPane?.(
+          `${leaf.tabId}:${leaf.leafId}`
+        )
+        if (boundRun) {
+          this.mailPointerRepointScheduler.schedule(`run:${boundRun.id}`)
+        }
       }
-    }
 
-    if (this.terminalFitOverrides.has(ptyId)) {
-      this.terminalFitOverrides.delete(ptyId)
-      this.notifier?.terminalFitOverrideChanged(ptyId, 'desktop-fit', 0, 0)
-      this.notifyFitOverrideListeners(ptyId, 'desktop-fit', 0, 0)
-    }
-    // Why: clear driver state and notify the renderer so any lock banner on
-    // this dead pane unmounts. Without this, the pane shows a stuck banner
-    // until tab teardown, and `getDriver(deadPtyId)` would keep returning a
-    // stale `mobile{X}` to any caller that hasn't yet seen the exit IPC.
-    this.terminalDrivers.clear(ptyId)
-    this.remoteDesktopFloor.clearPty(ptyId)
-    this.disposeHeadlessTerminal(ptyId)
-    if (processDeathCertified) {
-      // The bounded verdict register also fences late graphs after the PTY record was pruned.
-      this.rememberPtyLivenessVerdict(ptyId, { status: 'exited' })
-    }
-    if (pty) {
-      pty.connected = false
-      pty.runtimeSessionOwned = false
-      this.setPairedRendererSessionOwnership(pty.ptyId, false)
-      pty.disconnectedAt = Date.now()
-      pty.lastExitCode = exitCode
-      pty.lastExitCause = exitCause
-      // Why: the exited process's live frames say nothing about a replacement.
-      // A same-id respawn makes the leaf writable again before any new title,
-      // so leaving this true would let push delivery type into the new process
-      // on the dead one's idle. lastAgentStatus itself stays for `ps` display.
-      pty.lastAgentStatusObservedLive = false
-      this.resolvePtyExitWaiters(pty, ptyId)
-      this.pruneDisconnectedPtyTranscript(pty)
-    }
-    if (preservesIntentionalHandlelessSurface || preservesAbnormalSshSurface) {
-      // Why: relay loss is recoverable; keep the HUB-owned pane addressable through the bounded reconnect grace.
-      this.touchMobileSessionSnapshotsForPty(ptyId, { immediate: true })
-    } else {
-      // Why: permanent process exit is absence, not a starting/sleeping tab.
-      // Retire before publishing so paired clients never persist a ghost.
-      this.retireMobileSessionSurfacesForPty(ptyId, incarnationId, exactSurfaces)
+      if (this.terminalFitOverrides.has(ptyId)) {
+        this.terminalFitOverrides.delete(ptyId)
+        this.notifier?.terminalFitOverrideChanged(ptyId, 'desktop-fit', 0, 0)
+        this.notifyFitOverrideListeners(ptyId, 'desktop-fit', 0, 0)
+      }
+      // Why: clear driver state and notify the renderer so any lock banner on
+      // this dead pane unmounts. Without this, the pane shows a stuck banner
+      // until tab teardown, and `getDriver(deadPtyId)` would keep returning a
+      // stale `mobile{X}` to any caller that hasn't yet seen the exit IPC.
+      this.terminalDrivers.clear(ptyId)
+      this.remoteDesktopFloor.clearPty(ptyId)
+      this.disposeHeadlessTerminal(ptyId)
+      if (processDeathCertified) {
+        // The bounded verdict register also fences late graphs after the PTY record was pruned.
+        this.rememberPtyLivenessVerdict(ptyId, { status: 'exited' })
+      }
+      if (pty) {
+        pty.connected = false
+        pty.runtimeSessionOwned = false
+        this.setPairedRendererSessionOwnership(pty.ptyId, false)
+        pty.disconnectedAt = Date.now()
+        pty.lastExitCode = exitCode
+        pty.lastExitCause = exitCause
+        // Why: the exited process's live frames say nothing about a replacement.
+        // A same-id respawn makes the leaf writable again before any new title,
+        // so leaving this true would let push delivery type into the new process
+        // on the dead one's idle. lastAgentStatus itself stays for `ps` display.
+        pty.lastAgentStatusObservedLive = false
+        this.resolvePtyExitWaiters(pty, ptyId)
+        this.pruneDisconnectedPtyTranscript(pty)
+      }
+      if (preservesIntentionallyStoppedSurface || preservesAbnormalSshSurface) {
+        // Why: relay loss is recoverable; keep the HUB-owned pane addressable through the bounded reconnect grace.
+        this.touchMobileSessionSnapshotsForPty(ptyId, { immediate: true })
+      } else {
+        // Why: permanent process exit is absence, not a starting/sleeping tab.
+        // Retire before publishing so paired clients never persist a ghost.
+        try {
+          retirement = this.retireMobileSessionSurfacesForPty(ptyId, incarnationId, exactSurfaces)
+        } catch (error) {
+          console.error('[runtime] failed to publish terminal retirement:', error)
+        }
+      }
+    } finally {
+      // Why last: a stream end cues clients to re-activate the pane it ended, so the retirement
+      // must precede it; a cleanup fault must still end the stream.
+      this.notifyPtyExitListeners(ptyId)
     }
 
     const exitedSurfaces: { handle: string; paneKey: string | null }[] = []
@@ -253,6 +264,7 @@ export class OrcaRuntimeWithOnPtyExit extends OrcaRuntimeWithOnClientDisconnecte
       }
     }
     this.pruneDisconnectedPtyRecords()
+    return retirement
   }
 
   private notifyPtyExitListeners(ptyId: string): void {
diff --git a/src/main/runtime/orca-runtime-persist-headless-session-tab-props.ts b/src/main/runtime/orca-runtime-persist-headless-session-tab-props.ts
index 10489c6c701..7c21c025654 100644
--- a/src/main/runtime/orca-runtime-persist-headless-session-tab-props.ts
+++ b/src/main/runtime/orca-runtime-persist-headless-session-tab-props.ts
@@ -112,6 +112,7 @@ export class OrcaRuntimeWithPersistHeadlessSessionTabProps extends OrcaRuntimeWi
       tabId: string
       root: TerminalPaneLayoutNode | null
       expandedLeafId: string | null
+      chatLeafId?: string | null
       titlesByLeafId?: Record<string, string>
     }
   ): TerminalLayoutSnapshot | undefined {
@@ -131,6 +132,7 @@ export class OrcaRuntimeWithPersistHeadlessSessionTabProps extends OrcaRuntimeWi
           ...cloneTerminalLayoutSnapshot(existing),
           root: args.root ?? existing.root,
           expandedLeafId: args.expandedLeafId,
+          ...(args.chatLeafId !== undefined ? { chatLeafId: args.chatLeafId ?? undefined } : {}),
           ...(args.titlesByLeafId ? { titlesByLeafId: args.titlesByLeafId } : {})
         }
       }
@@ -149,6 +151,7 @@ export class OrcaRuntimeWithPersistHeadlessSessionTabProps extends OrcaRuntimeWi
       tabId: string
       root: TerminalPaneLayoutNode | null
       expandedLeafId: string | null
+      chatLeafId?: string | null
       titlesByLeafId?: Record<string, string>
     }
   ): void {
@@ -168,6 +171,7 @@ export class OrcaRuntimeWithPersistHeadlessSessionTabProps extends OrcaRuntimeWi
           ...tab.parentLayout,
           root: args.root ?? tab.parentLayout.root,
           expandedLeafId: args.expandedLeafId,
+          ...(args.chatLeafId !== undefined ? { chatLeafId: args.chatLeafId ?? undefined } : {}),
           ...(args.titlesByLeafId ? { titlesByLeafId: args.titlesByLeafId } : {})
         }
       }
diff --git a/src/main/runtime/orca-runtime-persist-terminal-surface-retirements.ts b/src/main/runtime/orca-runtime-persist-terminal-surface-retirements.ts
index 6b9887d2cf8..5458543815a 100644
--- a/src/main/runtime/orca-runtime-persist-terminal-surface-retirements.ts
+++ b/src/main/runtime/orca-runtime-persist-terminal-surface-retirements.ts
@@ -1,109 +1,69 @@
 // @ts-nocheck -- mechanically split from OrcaRuntimeService; behavior is covered by AST equivalence and characterization tests.
 import { OrcaRuntimeWithTouchMobileSessionTabsForWorktree } from './orca-runtime-touch-mobile-session-tabs-for-worktree'
 import type { RetiredTerminalSurface } from './mobile-session-terminal-retirement'
-import type { ExecutionHostId } from '../../shared/execution-host'
 import type { RuntimeMobileSessionRetiredTerminalSurface } from '../../shared/runtime-types'
 import { LOCAL_EXECUTION_HOST_ID } from '../../shared/execution-host'
-import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
 import { retireTerminalSurfaceFromPersistence } from './mobile-session-terminal-persistence-retirement'
 import { retireTerminalSurfacesFromSnapshot } from './mobile-session-terminal-retirement'
 import { attachRetirementProofsToSnapshot } from './mobile-session-terminal-retirement-proof'
-import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from './workspace-session-failed-write-rollback'
 import { getRepoIdFromWorktreeId } from '../../shared/worktree/id'
 
 export class OrcaRuntimeWithPersistTerminalSurfaceRetirements extends OrcaRuntimeWithTouchMobileSessionTabsForWorktree {
   /**
-   * Retires each surface in the session partition of the host that owns its worktree.
+   * Retires each surface in the in-memory session partition of the host that owns its worktree.
    * Why: an SSH pane's durable surface lives in that connection's partition; retiring it
    * against the local partition strands the real ghost and bumps a foreign host's epoch.
-   * Returns null when nothing may be published because persistence is unavailable or failed.
+   * `accepted` held the surface; `unpersisted` had no partition to hold it (or refused the write).
    */
-  protected persistTerminalSurfaceRetirements(
-    retiredSurfaces: readonly RetiredTerminalSurface[]
-  ): { accepted: RetiredTerminalSurface[]; unpersisted: RetiredTerminalSurface[] } | null {
-    const surfacesByHostId = new Map<ExecutionHostId, RetiredTerminalSurface[]>()
+  protected stageTerminalSurfaceRetirements(retiredSurfaces: readonly RetiredTerminalSurface[]): {
+    accepted: RetiredTerminalSurface[]
+    unpersisted: RetiredTerminalSurface[]
+  } {
+    const accepted: RetiredTerminalSurface[] = []
+    const unpersisted: RetiredTerminalSurface[] = []
     for (const surface of retiredSurfaces) {
       const hostId =
         this.tryGetWorkspaceSessionHostIdForWorktree(surface.worktreeId) ?? LOCAL_EXECUTION_HOST_ID
-      const bucket = surfacesByHostId.get(hostId)
-      if (bucket) {
-        bucket.push(surface)
-      } else {
-        surfacesByHostId.set(hostId, [surface])
-      }
-    }
-    const accepted: RetiredTerminalSurface[] = []
-    const unpersisted: RetiredTerminalSurface[] = []
-    const pendingWrites: { hostId: ExecutionHostId; session: WorkspaceSessionState }[] = []
-    const originalSessions = new Map<ExecutionHostId, WorkspaceSessionState>()
-    const stagedSessions = new Map<ExecutionHostId, WorkspaceSessionState>()
-    for (const [hostId, surfaces] of surfacesByHostId) {
-      const session = this.store?.getWorkspaceSession?.(hostId)
-      if (!session) {
-        unpersisted.push(...surfaces)
+      const current = this.store?.getWorkspaceSession?.(hostId)
+      if (!current) {
+        unpersisted.push(surface)
         continue
       }
-      // Why: publishing absence before its host membership fence is durable lets a crash or
-      // stale renderer write resurrect the retired surface.
-      if (!this.store?.setWorkspaceSession || !this.store.flushOrThrow) {
-        return null
-      }
-      originalSessions.set(hostId, session)
-      let nextSession = session
-      const acceptedForHost: RetiredTerminalSurface[] = []
-      for (const surface of surfaces) {
-        const candidate = retireTerminalSurfaceFromPersistence(nextSession, surface)
-        if (candidate !== nextSession) {
-          acceptedForHost.push(surface)
-          nextSession = candidate
-        }
-      }
-      if (acceptedForHost.length === 0) {
+      const next = retireTerminalSurfaceFromPersistence(current, surface)
+      if (next === current) {
         continue
       }
-      accepted.push(...acceptedForHost)
-      pendingWrites.push({ hostId, session: nextSession })
-    }
-    if (pendingWrites.length > 0) {
       try {
-        for (const write of pendingWrites) {
-          this.store?.setWorkspaceSession?.(write.session, write.hostId)
-          const staged = this.store?.getWorkspaceSession?.(write.hostId)
-          if (staged) {
-            stagedSessions.set(write.hostId, staged)
-          }
-        }
-        this.store?.flushOrThrow?.()
+        this.store.setWorkspaceSession(next, hostId)
+        accepted.push(surface)
       } catch (error) {
-        // setWorkspaceSession mutates the in-memory partition before the flush. Restore only
-        // fields still equal to our staged write so concurrent renderer updates survive.
-        for (const [hostId, original] of originalSessions) {
-          const staged = stagedSessions.get(hostId)
-          const current = this.store?.getWorkspaceSession?.(hostId)
-          if (!staged || !current) {
-            continue
-          }
-          const rolledBack = rollbackWorkspaceSessionAfterFailedAsyncWrite(
-            original,
-            staged,
-            current
-          )
-          if (rolledBack !== current) {
-            this.store?.setWorkspaceSession?.(rolledBack, hostId)
-          }
-        }
-        console.error('[runtime] failed to persist terminal retirement:', error)
-        return null
+        // Why: the process is gone whether or not the profile admits the write (quit, maintenance).
+        console.error('[runtime] could not stage terminal retirement:', error)
+        unpersisted.push(surface)
       }
     }
     return { accepted, unpersisted }
   }
 
+  // Why no rollback: the process is gone, so a failed write leaves the retirement for the next one.
+  protected async persistStagedTerminalSurfaceRetirements(): Promise<void> {
+    if (!this.store?.runDurableMutation) {
+      return
+    }
+    try {
+      // Why if-dirty: an earlier write, or another exit's, may already carry this retirement.
+      await this.store.runDurableMutation(() => ({ value: undefined, persist: 'if-dirty' }))
+    } catch (error) {
+      console.error('[runtime] terminal retirement is not yet durable:', error)
+    }
+  }
+
+  // Why synchronous: the exit's stream end cues clients to re-activate, which must find the leaf gone.
   protected retireMobileSessionSurfacesForPty(
     ptyId: string,
     incarnationId: string,
     exactSurfaces: readonly Pick<RetiredTerminalSurface, 'worktreeId' | 'parentTabId' | 'leafId'>[]
-  ): void {
+  ): Promise<void> | undefined {
     const terminalHandle =
       this.handleByPtyId.get(ptyId) ?? this.findHandleForPtyRecord(ptyId) ?? undefined
     const retiredSurfaceByKey = new Map<string, RetiredTerminalSurface>()
@@ -133,21 +93,18 @@ export class OrcaRuntimeWithPersistTerminalSurfaceRetirements extends OrcaRuntim
     }
     const retiredSurfaces = [...retiredSurfaceByKey.values()]
     if (retiredSurfaces.length === 0) {
-      return
+      return undefined
     }
-    const persisted = this.persistTerminalSurfaceRetirements(retiredSurfaces)
-    if (!persisted) {
-      return
-    }
-    for (const surface of persisted.unpersisted) {
+    const staged = this.stageTerminalSurfaceRetirements(retiredSurfaces)
+    for (const surface of staged.unpersisted) {
       const repoId = getRepoIdFromWorktreeId(surface.worktreeId)
       this.terminalTopologyRevisionByRepoId.set(
         repoId,
         (this.terminalTopologyRevisionByRepoId.get(repoId) ?? 0) + 1
       )
     }
-    // Why: one repo epoch can cover multiple exits, but only surfaces individually accepted by persistence may disappear.
-    const removableRetiredSurfaces = [...persisted.accepted, ...persisted.unpersisted]
+    // Why: one repo epoch can cover multiple exits; a surface the session binds to another PTY or incarnation stays.
+    const removableRetiredSurfaces = [...staged.accepted, ...staged.unpersisted]
     for (const [worktreeId, snapshot] of this.mobileSessionTabsByWorktree) {
       // Why proofs aren't gated on `removable`: the exit is the attestation, and a surface the
       // renderer already de-persisted leaves persistence nothing to accept. Withholding the proof
@@ -172,7 +129,7 @@ export class OrcaRuntimeWithPersistTerminalSurfaceRetirements extends OrcaRuntim
               snapshot,
               ptyId,
               exactSurfaces: removableSurfaces,
-              // Why: discovery is broad by PTY id, but publication may remove only surfaces whose durable retirement was accepted.
+              // Why: discovery is broad by PTY id, but publication may remove only surfaces the session retired.
               exactOnly: true,
               ...(retirementProofs.length > 0 ? { retirementProofs } : {})
             })
@@ -184,6 +141,7 @@ export class OrcaRuntimeWithPersistTerminalSurfaceRetirements extends OrcaRuntim
       }
       this.publishRetiredTerminalSurfaceProofs(worktreeId, retirementProofs)
     }
+    return staged.accepted.length > 0 ? this.persistStagedTerminalSurfaceRetirements() : undefined
   }
 
   /** Ships durable retirement proofs on their own frame when no surface removal carries them. */
diff --git a/src/main/runtime/orca-runtime-preserved-branch-cleanup.ts b/src/main/runtime/orca-runtime-preserved-branch-cleanup.ts
index 7280f10a91f..404e09bf085 100644
--- a/src/main/runtime/orca-runtime-preserved-branch-cleanup.ts
+++ b/src/main/runtime/orca-runtime-preserved-branch-cleanup.ts
@@ -107,17 +107,11 @@ export class OrcaRuntimeWithPreservedBranchCleanup extends OrcaRuntimeWithTermin
     | null
 
   protected readonly prepareCodexStructuredLaunchFn:
-    | ((input: {
-        workspacePath: string
-        launchEnv: NodeJS.ProcessEnv
-      }) => string | null | Promise<string | null>)
+    | ((input: { launchEnv: NodeJS.ProcessEnv }) => string | null | Promise<string | null>)
     | null
 
   protected readonly resolveCodexStructuredLaunchHomeFn:
-    | ((input: {
-        workspacePath: string
-        launchEnv: NodeJS.ProcessEnv
-      }) => string | null | Promise<string | null>)
+    | ((input: { launchEnv: NodeJS.ProcessEnv }) => string | null | Promise<string | null>)
     | null
 
   protected readonly agentSessionClaimSigner: AgentSessionClaimSigner
diff --git a/src/main/runtime/orca-runtime-prune-mobile-session-tab-group-layout.ts b/src/main/runtime/orca-runtime-prune-mobile-session-tab-group-layout.ts
index 50b1f52d238..75005726c2d 100644
--- a/src/main/runtime/orca-runtime-prune-mobile-session-tab-group-layout.ts
+++ b/src/main/runtime/orca-runtime-prune-mobile-session-tab-group-layout.ts
@@ -216,9 +216,10 @@ export class OrcaRuntimeWithPruneMobileSessionTabGroupLayout extends OrcaRuntime
   }
 
   // Why: group address resolution (Section 4.5) queries per-handle status and must not throw on stale handles; return null on any error.
-  getAgentStatusForHandle(handle: string): string | null {
+  async getAgentStatusForHandle(handle: string): Promise<string | null> {
     // A structured worker has no pane and no title, so every PTY probe below answers null and
-    // `@idle` would enumerate it and then silently drop it. Its status is the journal's.
+    // `@idle` would enumerate it and then silently drop it. Its status is the journal's, read
+    // through a conversation the idle sweep may have closed.
     const structured = resolveStructuredWorkerAuthority(handle, this._orchestrationDb)
     if (structured) {
       return structuredWorkerAgentStatus(structured.identity.sessionId)
diff --git a/src/main/runtime/orca-runtime-refresh-floating-workspace-pty-liveness.ts b/src/main/runtime/orca-runtime-refresh-floating-workspace-pty-liveness.ts
index de98831cdd5..b09ca3b7b8d 100644
--- a/src/main/runtime/orca-runtime-refresh-floating-workspace-pty-liveness.ts
+++ b/src/main/runtime/orca-runtime-refresh-floating-workspace-pty-liveness.ts
@@ -146,6 +146,7 @@ export class OrcaRuntimeWithRefreshFloatingWorkspacePtyLiveness extends OrcaRunt
     this.providerVisibleRetryAtByPtyId.delete(ptyId)
     this.agentStatusOscProcessorsByPtyId.delete(ptyId)
     this.terminalSpawnCommandsByPtyId.delete(ptyId)
+    this.terminalRunFacts.delete(ptyId)
     this.disposePtyTitleTracker(ptyId)
     this.invalidatePtyIncarnationHandle(ptyId)
     this.oscTitleScanTailByPtyId.delete(ptyId)
diff --git a/src/main/runtime/orca-runtime-register-pty.ts b/src/main/runtime/orca-runtime-register-pty.ts
index 37a5434e5c5..bd9c96a5c0f 100644
--- a/src/main/runtime/orca-runtime-register-pty.ts
+++ b/src/main/runtime/orca-runtime-register-pty.ts
@@ -140,9 +140,17 @@ export class OrcaRuntimeWithRegisterPty extends OrcaRuntimeWithInvalidateAllHand
         currentFence.pendingRegistration = false
       }
     }
+    // Why: a listed surface's pending-handle → ready flip must not wait on a later renderer graph change.
+    this.touchMobileSessionSnapshotsForPty(ptyId)
     // Why: the renderer's own PTY spawn is the reliable signal that the pending
     // mobile create's tab is live; publish its surface main-side (#7587).
     if (binding && paneKey) {
+      if (
+        replacementHandle?.startsWith('term_') &&
+        this.handleByPtyId.get(ptyId) !== replacementHandle
+      ) {
+        this.registerPreAllocatedHandleForPty(ptyId, replacementHandle)
+      }
       this.ensurePtyBackedMobileSurfaceForRendererTab(worktreeId, binding.tabId)
     }
   }
diff --git a/src/main/runtime/orca-runtime-resolve-authoritative-terminal-wait-permission.ts b/src/main/runtime/orca-runtime-resolve-authoritative-terminal-wait-permission.ts
index ad7c81f2e87..04cb91e0281 100644
--- a/src/main/runtime/orca-runtime-resolve-authoritative-terminal-wait-permission.ts
+++ b/src/main/runtime/orca-runtime-resolve-authoritative-terminal-wait-permission.ts
@@ -61,7 +61,7 @@ export class OrcaRuntimeWithResolveAuthoritativeTerminalWaitPermission extends O
     ptyId: string,
     action: { text?: string; enter?: boolean; interrupt?: boolean },
     payload: string,
-    options: RuntimeTerminalWriteOptions = {}
+    options: RuntimeTerminalWriteOptions
   ): Promise<void> {
     return this.terminalWriter.writeAction(ptyId, action, payload, options)
   }
@@ -69,7 +69,7 @@ export class OrcaRuntimeWithResolveAuthoritativeTerminalWaitPermission extends O
   protected writeTerminalInputChunks(
     ptyId: string,
     text: string,
-    options: RuntimeTerminalWriteOptions = {}
+    options: RuntimeTerminalWriteOptions
   ): Promise<void> {
     return this.terminalWriter.writeChunks(ptyId, text, options)
   }
diff --git a/src/main/runtime/orca-runtime-resolve-exit-waiters.ts b/src/main/runtime/orca-runtime-resolve-exit-waiters.ts
index 9d2ea33a6b8..f7ead603e02 100644
--- a/src/main/runtime/orca-runtime-resolve-exit-waiters.ts
+++ b/src/main/runtime/orca-runtime-resolve-exit-waiters.ts
@@ -2,15 +2,22 @@
 // @ts-nocheck -- mechanically split from OrcaRuntimeService; behavior is covered by AST equivalence and characterization tests.
 import { OrcaRuntimeWithBindPtyIncarnationHandle } from './orca-runtime-bind-pty-incarnation-handle'
 import type { RuntimeLeafRecord, RuntimePtyWorktreeRecord } from './runtime-terminal-state-records'
-import { buildPtyTerminalWaitResult, buildTerminalWaitResult } from './terminal-wait-results'
-import type { AgentStatus } from '../../shared/agent-detection'
 import {
-  detectExplicitIdleStatusFromTitle,
-  isKnownReadyPromptPreview,
-  isMuseReadyPromptPreview
-} from './terminal-wait-detection'
+  buildPtyTerminalWaitBlockedResult,
+  buildPtyTerminalWaitResult,
+  buildTerminalWaitBlockedResult,
+  buildTerminalWaitResult
+} from './terminal-wait-results'
+import type { AgentStatus } from '../../shared/agent-detection'
+import { detectExplicitIdleStatusFromTitle } from './terminal-wait-detection'
 import { buildTerminalWaitText } from './terminal-wait-tail-state'
-import { isTuiIdleSatisfied } from './tui-idle-evidence'
+import {
+  evaluateTuiIdle,
+  isTuiIdleReadyVerdict,
+  leafTuiIdleEvidence,
+  ptyTuiIdleEvidence,
+  type TuiIdleVerdict
+} from './tui-idle-evidence'
 import { TUI_IDLE_QUIESCENCE_MS } from './orca-runtime-postlude'
 
 export class OrcaRuntimeWithResolveExitWaiters extends OrcaRuntimeWithBindPtyIncarnationHandle {
@@ -50,14 +57,20 @@ export class OrcaRuntimeWithResolveExitWaiters extends OrcaRuntimeWithBindPtyInc
     if (!waiters || waiters.size === 0) {
       return
     }
-    // Why re-rank rather than resolve outright: the transition that brought us here is
-    // only a title sample, and a name-only title arriving mid-turn is the weakest tier
-    // there is (#6011). Leave such a waiter on its poll to be corroborated instead.
-    if (!this.isTuiIdleSatisfiedForLeaf(leaf)) {
-      return
-    }
+    // Why re-rank rather than resolve outright: the transition that brought us here is only a
+    // title sample. Weak ready (a name-only title, #6011) cannot see a dialog the tail lost,
+    // so it is left to the poll, which settles it only after a rendered-screen read.
+    const verdict = this.evaluateTuiIdleForLeaf(leaf)
     for (const waiter of [...waiters]) {
-      if (waiter.condition === 'tui-idle') {
+      if (waiter.condition !== 'tui-idle') {
+        continue
+      }
+      if (verdict.kind === 'blocked') {
+        this.resolveWaiter(
+          waiter,
+          buildTerminalWaitBlockedResult(handle, 'tui-idle', leaf, verdict.reason)
+        )
+      } else if (verdict.kind === 'ready-strong') {
         this.resolveWaiter(waiter, buildTerminalWaitResult(handle, 'tui-idle', leaf))
       }
     }
@@ -92,34 +105,28 @@ export class OrcaRuntimeWithResolveExitWaiters extends OrcaRuntimeWithBindPtyInc
       return
     }
     // Why: same re-ranking as resolveTuiIdleWaiters above.
-    if (!this.isTuiIdleSatisfiedForPty(pty)) {
-      return
-    }
+    const verdict = this.evaluateTuiIdleForPty(pty)
     for (const waiter of [...waiters]) {
-      if (waiter.condition === 'tui-idle') {
+      if (waiter.condition !== 'tui-idle') {
+        continue
+      }
+      if (verdict.kind === 'blocked') {
+        this.resolveWaiter(
+          waiter,
+          buildPtyTerminalWaitBlockedResult(handle, 'tui-idle', pty, verdict.reason)
+        )
+      } else if (verdict.kind === 'ready-strong') {
         this.resolveWaiter(waiter, buildPtyTerminalWaitResult(handle, 'tui-idle', pty))
       }
     }
   }
 
-  // Why: the primary OSC-title signal can't fire for daemon-hosted terminals (no PTY data through the runtime), so this fallback polls the renderer-synced tab title + foreground-process quiescence; self-cancels when the OSC path fires.
-  protected isTuiIdleSatisfiedForLeaf(leaf: RuntimeLeafRecord): boolean {
-    return isTuiIdleSatisfied({
-      record: leaf,
-      rendererTitle: leaf.paneTitle ?? this.tabs.get(leaf.tabId)?.title ?? null,
-      readPositiveBodyEvidence: () =>
-        isKnownReadyPromptPreview(
-          buildTerminalWaitText(leaf.tailBuffer, leaf.tailPartialLine, leaf.preview)
-        ),
-      readMuseReadyBodyEvidence: () =>
-        isMuseReadyPromptPreview(
-          buildTerminalWaitText(leaf.tailBuffer, leaf.tailPartialLine, leaf.preview)
-        ),
-      agent: this.getPaneAgentForTuiIdle(leaf.ptyId),
-      firstPartyStatus:
-        (leaf.ptyId ? this.ptysById.get(leaf.ptyId)?.lastExplicitAgentStatus : null) ?? null,
-      quiescenceMs: TUI_IDLE_QUIESCENCE_MS
-    })
+  protected evaluateTuiIdleForLeaf(leaf: RuntimeLeafRecord): TuiIdleVerdict {
+    return evaluateTuiIdle(
+      leafTuiIdleEvidence(this.tuiIdleEvidenceSource, leaf, () =>
+        buildTerminalWaitText(leaf.tailBuffer, leaf.tailPartialLine, leaf.preview)
+      )
+    )
   }
 
   /**
@@ -189,25 +196,25 @@ export class OrcaRuntimeWithResolveExitWaiters extends OrcaRuntimeWithBindPtyInc
    */
   protected isAgentSettledForDelivery(leaf: { tabId: string; leafId: string }): boolean {
     const live = this.leaves.get(this.getLeafKey(leaf.tabId, leaf.leafId))
-    return live ? this.isTuiIdleSatisfiedForLeaf(live) : false
+    if (!live) {
+      return false
+    }
+    const evidence = leafTuiIdleEvidence(this.tuiIdleEvidenceSource, live, () =>
+      buildTerminalWaitText(live.tailBuffer, live.tailPartialLine, live.preview)
+    )
+    // Why no blocked reader: a refusal here re-arms a recheck that a lingering tail prompt
+    // would spin, so delivery keeps its own, blocked-blind, reading of the same ranking.
+    return isTuiIdleReadyVerdict(
+      evaluateTuiIdle({ ...evidence, readTailBlockedReason: () => null })
+    )
   }
 
-  protected isTuiIdleSatisfiedForPty(pty: RuntimePtyWorktreeRecord): boolean {
-    return isTuiIdleSatisfied({
-      record: pty,
-      readPositiveBodyEvidence: () =>
-        this.getAdoptedPtyExplicitIdleStatus(pty) === 'idle' ||
-        isKnownReadyPromptPreview(
-          buildTerminalWaitText(pty.tailBuffer, pty.tailPartialLine, pty.preview)
-        ),
-      readMuseReadyBodyEvidence: () =>
-        isMuseReadyPromptPreview(
-          buildTerminalWaitText(pty.tailBuffer, pty.tailPartialLine, pty.preview)
-        ),
-      agent: this.getPaneAgentForTuiIdle(pty.ptyId),
-      firstPartyStatus: pty.lastExplicitAgentStatus ?? null,
-      quiescenceMs: TUI_IDLE_QUIESCENCE_MS
-    })
+  protected evaluateTuiIdleForPty(pty: RuntimePtyWorktreeRecord): TuiIdleVerdict {
+    return evaluateTuiIdle(
+      ptyTuiIdleEvidence(this.tuiIdleEvidenceSource, pty, () =>
+        buildTerminalWaitText(pty.tailBuffer, pty.tailPartialLine, pty.preview)
+      )
+    )
   }
 
   protected getAdoptedPtyExplicitIdleStatus(pty: RuntimePtyWorktreeRecord): AgentStatus | null {
diff --git a/src/main/runtime/orca-runtime-resolve-mobile-session-terminal-command.ts b/src/main/runtime/orca-runtime-resolve-mobile-session-terminal-command.ts
index 281185e51dc..095ee58a37f 100644
--- a/src/main/runtime/orca-runtime-resolve-mobile-session-terminal-command.ts
+++ b/src/main/runtime/orca-runtime-resolve-mobile-session-terminal-command.ts
@@ -64,7 +64,6 @@ export class OrcaRuntimeWithResolveMobileSessionTerminalCommand extends OrcaRunt
     if (opts.agentPrompt && startupPlan.followupPrompt) {
       throw new Error(`Agent ${opts.agent} does not support startup prompt quick commands.`)
     }
-    await this.markWorkspaceTrustedForAgent(opts.agent, workspace.connectionId, workspace.path)
     return {
       command: startupPlan.launchCommand,
       env: startupPlan.env,
diff --git a/src/main/runtime/orca-runtime-resolve-terminal-pane.ts b/src/main/runtime/orca-runtime-resolve-terminal-pane.ts
index 1093319783a..60047604e43 100644
--- a/src/main/runtime/orca-runtime-resolve-terminal-pane.ts
+++ b/src/main/runtime/orca-runtime-resolve-terminal-pane.ts
@@ -184,7 +184,7 @@ export class OrcaRuntimeWithResolveTerminalPane extends OrcaRuntimeWithGetTermin
   ): Promise<RuntimeTerminalRead> {
     // Before the PTY lookup, because a structured worker has no PTY and no leaf: without this the
     // only peer read verb answers `terminal_handle_stale` for a perfectly live worker.
-    const structured = readStructuredWorkerTerminal({
+    const structured = await readStructuredWorkerTerminal({
       handle,
       db: this.getOrchestrationDbIfAvailable?.() ?? null,
       ...(opts.cursor === undefined ? {} : { cursor: opts.cursor }),
diff --git a/src/main/runtime/orca-runtime-resolve-terminal-split-source-authority.ts b/src/main/runtime/orca-runtime-resolve-terminal-split-source-authority.ts
index 49d55d96c17..167aee3e21b 100644
--- a/src/main/runtime/orca-runtime-resolve-terminal-split-source-authority.ts
+++ b/src/main/runtime/orca-runtime-resolve-terminal-split-source-authority.ts
@@ -54,12 +54,13 @@ export class OrcaRuntimeWithResolveTerminalSplitSourceAuthority extends OrcaRunt
     )
     const rendererTab = this.tabs.get(tabId)
     const rendererLeaf = this.leaves.get(this.getLeafKey(tabId, leafId))
+    // A mounted pane can publish before its PTY binds; persisted identity fences that gap.
     const rendererMounted = Boolean(
       rendererTab &&
       rendererLeaf &&
       runtimeWorktreeIdsEqual(rendererTab.worktreeId, worktreeId) &&
       runtimeWorktreeIdsEqual(rendererLeaf.worktreeId, worktreeId) &&
-      rendererLeaf.ptyId === ptyId
+      (rendererLeaf.ptyId === ptyId || (persisted && rendererLeaf.ptyId === null))
     )
     if (persisted && persistedLayout) {
       return {
@@ -100,7 +101,7 @@ export class OrcaRuntimeWithResolveTerminalSplitSourceAuthority extends OrcaRunt
     return await this.claudeAgentTeams.handleTmuxCompat(request, {
       splitTerminal: (handle, opts) => this.splitTerminal(handle, opts),
       readTerminal: (handle, opts) => this.readTerminal(handle, opts),
-      sendTerminal: (handle, action) => this.sendTerminal(handle, action),
+      sendTerminal: (handle, action, options) => this.sendTerminal(handle, action, options),
       focusTerminal: (handle) => this.focusTerminal(handle),
       closeTerminal: (handle) => this.closeTerminal(handle),
       showTerminal: (handle) => this.showTerminal(handle)
diff --git a/src/main/runtime/orca-runtime-resolve-worktree-removal-target.ts b/src/main/runtime/orca-runtime-resolve-worktree-removal-target.ts
index 94dba6bdc83..0aeacdc0e99 100644
--- a/src/main/runtime/orca-runtime-resolve-worktree-removal-target.ts
+++ b/src/main/runtime/orca-runtime-resolve-worktree-removal-target.ts
@@ -21,6 +21,7 @@ import { resolveLocalProjectRuntimeForWorktreeId } from '../local-project-runtim
 import { resolveBareAgentLaunchCommand } from './runtime-agent-launch-resolution'
 import { buildAgentStartupPlan } from '../../shared/tui-agent-startup'
 import { resolveAgentStartupPlanInputs } from '../../shared/agent-startup-plan-inputs'
+import { agentStartedTelemetry } from '../agent-launch/agent-started-telemetry'
 
 export class OrcaRuntimeWithResolveWorktreeRemovalTarget extends OrcaRuntimeWithRemoveManagedWorktree {
   protected async resolveWorktreeRemovalTarget(
@@ -242,15 +243,15 @@ export class OrcaRuntimeWithResolveWorktreeRemovalTarget extends OrcaRuntimeWith
       throw new Error(`Agent ${agent} does not take a startup prompt on its launch command.`)
     }
 
-    await this.markWorkspaceTrustedForAgent(agent, workspace.connectionId, workspace.path)
-
     return {
       ...opts,
       command: startupPlan.launchCommand,
       ...(startupPlan.env ? { env: startupPlan.env } : {}),
       launchConfig: startupPlan.launchConfig,
       launchAgent: agent,
-      startupCommandDelivery: startupPlan.startupCommandDelivery
+      startupCommandDelivery: startupPlan.startupCommandDelivery,
+      // A bare command the user typed stays out of launch accounting, as before.
+      ...(opts.startupAgent ? { telemetry: agentStartedTelemetry(agent, opts.launchSource) } : {})
     }
   }
 }
diff --git a/src/main/runtime/orca-runtime-restore-live-paired-renderer-session-owned-mobile-terminals.ts b/src/main/runtime/orca-runtime-restore-live-paired-renderer-session-owned-mobile-terminals.ts
index bfab8f0ba9a..8e9ad65dc32 100644
--- a/src/main/runtime/orca-runtime-restore-live-paired-renderer-session-owned-mobile-terminals.ts
+++ b/src/main/runtime/orca-runtime-restore-live-paired-renderer-session-owned-mobile-terminals.ts
@@ -123,9 +123,9 @@ export class OrcaRuntimeWithRestoreLivePairedRendererSessionOwnedMobileTerminals
     if (!pty || this.terminalSpawnCommandsByPtyId.has(pty.ptyId)) {
       return
     }
-    if (this.ptyController?.write(pty.ptyId, command)) {
+    if (this.ptyController?.write(pty.ptyId, command, 'launch')) {
       // Why: Enter rides its own write so a long command cannot swallow it.
-      this.ptyController.write(pty.ptyId, '\r')
+      this.ptyController.write(pty.ptyId, '\r', 'launch')
       this.noteTerminalSpawnCommand(pty.ptyId, command)
     }
   }
diff --git a/src/main/runtime/orca-runtime-restore-structured-agent-session-tabs-once.ts b/src/main/runtime/orca-runtime-restore-structured-agent-session-tabs-once.ts
index d53b465d97d..f22a09bac5e 100644
--- a/src/main/runtime/orca-runtime-restore-structured-agent-session-tabs-once.ts
+++ b/src/main/runtime/orca-runtime-restore-structured-agent-session-tabs-once.ts
@@ -95,10 +95,16 @@ export class OrcaRuntimeWithRestoreStructuredAgentSessionTabsOnce extends OrcaRu
     activate: boolean
     notify?: boolean
     replacesSessionId?: string
+    /** The host tab id a create reserved; a session that already has a tab keeps its own. */
+    tabId?: string
   }): Promise<void> {
     const host = getStructuredAgentSessionHost()
     if (typeof host?.setSessionTabVisibility === 'function') {
-      await host.setSessionTabVisibility(input.sessionId, true)
+      await host.setSessionTabVisibility(
+        input.sessionId,
+        true,
+        ...(input.tabId ? [input.tabId] : [])
+      )
     }
     const existing = this.mobileSessionTabsByWorktree.get(input.workspaceId)
     const id = `agent-session:${input.sessionId}`
diff --git a/src/main/runtime/orca-runtime-runtime-id.ts b/src/main/runtime/orca-runtime-runtime-id.ts
index 7b1811d9255..d724207f921 100644
--- a/src/main/runtime/orca-runtime-runtime-id.ts
+++ b/src/main/runtime/orca-runtime-runtime-id.ts
@@ -45,6 +45,10 @@ import { MailPointerRepointScheduler } from './orchestration/mail-pointer-repoin
 import { RuntimeTerminalWaiterRegistry } from './runtime-terminal-waiter-registry'
 import { RuntimeTerminalWriter } from './runtime-terminal-writer'
 import { RuntimeTerminalIdlePolls } from './runtime-terminal-idle-polls'
+import { TerminalIntentionalStops } from './terminal-intentional-stops'
+import { TerminalRunFactsRegister, type TerminalSpawnCommit } from './terminal-run-facts'
+import type { TuiIdleEvidenceSource } from './tui-idle-evidence'
+import { hasTerminalCommandPainted } from './terminal-command-paint'
 import {
   TUI_IDLE_DEFAULT_TIMEOUT_MS,
   TUI_IDLE_POLL_INTERVAL_MS,
@@ -232,9 +236,16 @@ export class OrcaRuntimeWithRuntimeId {
 
   protected pendingPtyRegistrationIncarnations = new Map<string, PtyIncarnationId | null>()
 
-  // Why: exact-stop is the current sleep transaction boundary; its exit must
-  // leave the renderer's intentional sleeping surface available for wake.
-  protected intentionalHandlelessPtyStops = new Map<string, string | null>()
+  // Why public: the PTY IPC layer's stop paths write it and its exit delivery reads it.
+  readonly intentionalPtyStops = new TerminalIntentionalStops()
+
+  readonly terminalRunFacts = new TerminalRunFactsRegister()
+
+  /** Both spawn-commit funnels report each committed process here, once. */
+  noteTerminalSpawnCommit(commit: TerminalSpawnCommit, expectedSourceBinding?: unknown): void {
+    this.terminalRunFacts.recordSpawnCommit(commit, expectedSourceBinding)
+    this.intentionalPtyStops.noteSpawnCommit(commit.id)
+  }
 
   // Why: coalesces title/status-driven session.tabs emits so spinner churn
   // doesn't fan out (and per-client JSON.stringify) a snapshot several times a
@@ -321,35 +332,47 @@ export class OrcaRuntimeWithRuntimeId {
   protected readonly terminalWaiters = new RuntimeTerminalWaiterRegistry()
 
   protected readonly terminalWriter = new RuntimeTerminalWriter(
-    (ptyId, data) => this.ptyController?.write(ptyId, data) ?? false,
+    (ptyId, data, inputKind) => this.ptyController?.write(ptyId, data, inputKind) ?? false,
     (ptyId) => this.getPtyWriteHostPlatform(ptyId),
     (ptyId) => this.getPtyAgent(ptyId)
   )
 
-  protected readonly terminalIdlePolls = new RuntimeTerminalIdlePolls({
-    intervalMs: TUI_IDLE_POLL_INTERVAL_MS,
+  // Why one source: every tui-idle site must read the same evidence, or they rank one pane differently.
+  protected readonly tuiIdleEvidenceSource: TuiIdleEvidenceSource = {
     quiescenceMs: TUI_IDLE_QUIESCENCE_MS,
     getTabTitle: (tabId) => this.tabs.get(tabId)?.title ?? null,
-    getForegroundProcess: (ptyId) => this.ptyController?.getForegroundProcess(ptyId) ?? null,
     getAdoptedPtyIdleStatus: (pty) => this.getAdoptedPtyExplicitIdleStatus(pty),
     getPaneAgent: (ptyId) => this.getPaneAgentForTuiIdle(ptyId),
     getFirstPartyAgentStatus: (ptyId) =>
       (ptyId ? this.ptysById.get(ptyId)?.lastExplicitAgentStatus : null) ?? null,
+    readScreenLines: (ptyId) => this.readLiveTerminalScreenLines(ptyId)
+  }
+
+  protected readonly terminalIdlePolls = new RuntimeTerminalIdlePolls({
+    ...this.tuiIdleEvidenceSource,
+    intervalMs: TUI_IDLE_POLL_INTERVAL_MS,
+    getForegroundProcess: (ptyId) => this.ptyController?.getForegroundProcess(ptyId) ?? null,
+    hasCommandPainted: (ptyId) => {
+      const pty = this.ptysById.get(ptyId)
+      return pty === undefined || hasTerminalCommandPainted(pty)
+    },
+    // Why the runtime's own emulator: a provider snapshot would be a host round trip per tick.
+    readVisibleScreen: (ptyId) =>
+      this.headlessTerminals.has(ptyId)
+        ? this.readHeadlessVisibleTerminalState(ptyId).then(
+            (screen) => screen?.lines.join('\n') ?? null
+          )
+        : null,
     getLiveLeaf: (leaf) => this.leaves.get(this.getLeafKey(leaf.tabId, leaf.leafId)) ?? leaf,
     resolve: (waiter, result) => this.terminalWaiters.resolve(waiter, result)
   })
 
   protected readonly terminalWait = new RuntimeTerminalWaitController(
     {
+      ...this.tuiIdleEvidenceSource,
       defaultTimeoutMs: TUI_IDLE_DEFAULT_TIMEOUT_MS,
       getLivePty: (handle) => this.getLivePtyForHandle(handle),
       getLiveLeaf: (handle) => this.getLiveLeafForHandle(handle),
-      getAdoptedPtyIdleStatus: (pty) => this.getAdoptedPtyExplicitIdleStatus(pty),
-      getTabTitle: (tabId) => this.tabs.get(tabId)?.title ?? null,
-      quiescenceMs: TUI_IDLE_QUIESCENCE_MS,
-      getPaneAgent: (ptyId) => this.getPaneAgentForTuiIdle(ptyId),
-      getFirstPartyAgentStatus: (ptyId) =>
-        (ptyId ? this.ptysById.get(ptyId)?.lastExplicitAgentStatus : null) ?? null,
       startVisibleReadProbe: (waiter, waiterTimeoutMs, agent) =>
         this.startTuiIdleVisibleReadProbe(waiter, waiterTimeoutMs, agent)
     },
diff --git a/src/main/runtime/orca-runtime-serialize-main-terminal-buffer.ts b/src/main/runtime/orca-runtime-serialize-main-terminal-buffer.ts
index 7994f7d8857..53a9b4ffc59 100644
--- a/src/main/runtime/orca-runtime-serialize-main-terminal-buffer.ts
+++ b/src/main/runtime/orca-runtime-serialize-main-terminal-buffer.ts
@@ -80,6 +80,16 @@ export class OrcaRuntimeWithSerializeMainTerminalBuffer extends OrcaRuntimeWithA
     return { handle, cleared: true }
   }
 
+  async resetTerminalInputModes(handle: string): Promise<{ handle: string; reset: boolean }> {
+    const leaf = this.resolveLeafForHandle(handle)
+    if (!leaf?.ptyId) {
+      throw new Error('terminal_not_found')
+    }
+    await this.ptyController?.resetInputModes?.(leaf.ptyId)
+    await this.resetHeadlessTerminalInputModes(leaf.ptyId)
+    return { handle, reset: true }
+  }
+
   getTerminalSize(ptyId: string): { cols: number; rows: number } | null {
     return this.ptyController?.getSize?.(ptyId) ?? null
   }
diff --git a/src/main/runtime/orca-runtime-sleep-resolved-worktree-terminals.ts b/src/main/runtime/orca-runtime-sleep-resolved-worktree-terminals.ts
index 7d3645473bc..0f0a856bda2 100644
--- a/src/main/runtime/orca-runtime-sleep-resolved-worktree-terminals.ts
+++ b/src/main/runtime/orca-runtime-sleep-resolved-worktree-terminals.ts
@@ -64,7 +64,7 @@ export class OrcaRuntimeWithSleepResolvedWorktreeTerminals extends OrcaRuntimeWi
     const pendingPtyIds = new Set<string>()
     let generation = 0
     let fullyCommitted = false
-    let releaseReversibleRendererStops = (): void => {}
+    const settleReversibleStops = new Map<string, (stopped: boolean) => void>()
     try {
       const resolvedWorktrees = includeTargetResolvedWorktree(
         [...(await this.getResolvedWorktreeMap()).values()],
@@ -148,16 +148,25 @@ export class OrcaRuntimeWithSleepResolvedWorktreeTerminals extends OrcaRuntimeWi
       const stopAndWait = ptyController.stopAndWait.bind(ptyController)
 
       const orderedLivePtyIds = [...livePtyIds].sort()
-      releaseReversibleRendererStops =
-        ptyController.markReversibleStops?.(orderedLivePtyIds) ?? (() => {})
-      const stopResults = await Promise.allSettled(
-        orderedLivePtyIds.map(async (ptyId) => ({
+      for (const ptyId of orderedLivePtyIds) {
+        settleReversibleStops.set(
           ptyId,
-          stopped: await stopAndWait(ptyId, {
+          this.intentionalPtyStops.mark(
+            ptyId,
+            'reversible',
+            this.ptysById.get(ptyId)?.incarnationId ?? null
+          )
+        )
+      }
+      const stopResults = await Promise.allSettled(
+        orderedLivePtyIds.map(async (ptyId) => {
+          const stopped = await stopAndWait(ptyId, {
             keepHistory: true,
             deadlineMs: teardownRpcDeadline(sleepDeadline)
           })
-        }))
+          settleReversibleStops.get(ptyId)?.(stopped)
+          return { ptyId, stopped }
+        })
       )
       const successfulStopPtyIds = orderedLivePtyIds.filter((_, index) => {
         const result = stopResults[index]
@@ -251,7 +260,9 @@ export class OrcaRuntimeWithSleepResolvedWorktreeTerminals extends OrcaRuntimeWi
         postStopVerified: true
       }
     } finally {
-      releaseReversibleRendererStops()
+      for (const settleStop of settleReversibleStops.values()) {
+        settleStop(false)
+      }
       if (!fullyCommitted && generation > 0) {
         const cancelledPtyIds = [...pendingPtyIds].sort()
         if (cancelledPtyIds.length > 0) {
diff --git a/src/main/runtime/orca-runtime-start-tui-idle-visible-read-probe.ts b/src/main/runtime/orca-runtime-start-tui-idle-visible-read-probe.ts
index bb03b17eca3..4d70572eb2a 100644
--- a/src/main/runtime/orca-runtime-start-tui-idle-visible-read-probe.ts
+++ b/src/main/runtime/orca-runtime-start-tui-idle-visible-read-probe.ts
@@ -11,7 +11,7 @@ import {
 import { withTimeout } from './runtime-async-boundaries'
 import {
   detectTerminalWaitBlockedReason,
-  isKnownReadyPromptPreview
+  isKnownReadyPromptSettled
 } from './terminal-wait-detection'
 import type {
   RuntimeTerminalWait,
@@ -80,7 +80,7 @@ export class OrcaRuntimeWithStartTuiIdleVisibleReadProbe extends OrcaRuntimeWith
         const ready =
           agent === 'antigravity'
             ? isAntigravityReadyPromptSnapshot(snapshotText)
-            : isKnownReadyPromptPreview(snapshotText)
+            : isKnownReadyPromptSettled(snapshotText)
         if (!blockedReason && !ready) {
           return
         }
diff --git a/src/main/runtime/orca-runtime-state-fields.ts b/src/main/runtime/orca-runtime-state-fields.ts
index 30093c36413..ef54b73252c 100644
--- a/src/main/runtime/orca-runtime-state-fields.ts
+++ b/src/main/runtime/orca-runtime-state-fields.ts
@@ -96,14 +96,12 @@ export class OrcaRuntimeWithStateFields extends OrcaRuntimeWithLinearCommands {
         args: AiVaultPrepareSessionResumeArgs
       ) => Promise<AiVaultPrepareSessionResumeResult>
       prepareCodexStructuredLaunch?: (input: {
-        workspacePath: string
         launchEnv: NodeJS.ProcessEnv
       }) => string | null | Promise<string | null>
       // Why a sibling of prepare: record-less catalog reads must resolve the
       // same launch home with none of launch prep's side effects (no sync, no
       // bridge, no cleared selection).
       resolveCodexStructuredLaunchHome?: (input: {
-        workspacePath: string
         launchEnv: NodeJS.ProcessEnv
       }) => string | null | Promise<string | null>
       buildAgentHookPtyEnv?: () => Record<string, string>
diff --git a/src/main/runtime/orca-runtime-stop-exact-terminals-for-worktree.ts b/src/main/runtime/orca-runtime-stop-exact-terminals-for-worktree.ts
index a96ae64e596..d854be6ec68 100644
--- a/src/main/runtime/orca-runtime-stop-exact-terminals-for-worktree.ts
+++ b/src/main/runtime/orca-runtime-stop-exact-terminals-for-worktree.ts
@@ -47,18 +47,22 @@ export class OrcaRuntimeWithStopExactTerminalsForWorktree extends OrcaRuntimeWit
 
     const stoppedPtyIds: string[] = []
     for (const ptyId of [...expected].sort()) {
-      if (opts.keepHistory) {
-        this.intentionalHandlelessPtyStops.set(
-          ptyId,
-          this.ptysById.get(ptyId)?.incarnationId ?? null
-        )
-      }
+      // Why: exact-stop is the sleep transaction boundary; its exit must leave the sleeping surface for wake.
+      const settleStop = opts.keepHistory
+        ? this.intentionalPtyStops.mark(
+            ptyId,
+            'reversible',
+            this.ptysById.get(ptyId)?.incarnationId ?? null
+          )
+        : null
+      let stopped = false
       try {
-        if (!(await this.ptyController.stopAndWait(ptyId, { keepHistory: opts.keepHistory }))) {
-          throw Object.assign(new Error('terminal_exact_stop_failed'), { ptyId })
-        }
+        stopped = await this.ptyController.stopAndWait(ptyId, { keepHistory: opts.keepHistory })
       } finally {
-        this.intentionalHandlelessPtyStops.delete(ptyId)
+        settleStop?.(stopped)
+      }
+      if (!stopped) {
+        throw Object.assign(new Error('terminal_exact_stop_failed'), { ptyId })
       }
       stoppedPtyIds.push(ptyId)
     }
diff --git a/src/main/runtime/orca-runtime-stop-explicitly-closed-tab-ptys.ts b/src/main/runtime/orca-runtime-stop-explicitly-closed-tab-ptys.ts
index 196845d09ef..a243d5ea0a6 100644
--- a/src/main/runtime/orca-runtime-stop-explicitly-closed-tab-ptys.ts
+++ b/src/main/runtime/orca-runtime-stop-explicitly-closed-tab-ptys.ts
@@ -3,20 +3,26 @@ import { OrcaRuntimeWithFocusTerminal } from './orca-runtime-focus-terminal'
 import { EXPLICIT_TERMINAL_CLOSE_STOP_TIMEOUT_MS } from './orca-runtime-core'
 import { SSH_PROVIDER_UNREGISTERED_REASON } from '../../shared/pty-liveness-verdict'
 import type { RuntimeTerminalClose } from '../../shared/runtime-types'
-import { countTerminalLayoutLeaves } from './headless-terminal-split-layout'
 import type { RuntimePtyTabCloseAuthority } from './runtime-terminal-state-records'
+import { parsePaneKey } from '../../shared/stable-pane-id'
+
+/** How an explicit close's stop of its addressed PTY ended. */
+type ExplicitCloseStop = { stopped: boolean; pendingKillRecorded: boolean }
+
+const NO_STOP: ExplicitCloseStop = { stopped: false, pendingKillRecorded: false }
 
 export class OrcaRuntimeWithStopExplicitlyClosedTabPtys extends OrcaRuntimeWithFocusTerminal {
   protected async stopExplicitlyClosedTabPtys(
     ptyIds: readonly string[],
     addressedPtyId: string
-  ): Promise<boolean> {
-    let addressedPtyStopped = false
+  ): Promise<ExplicitCloseStop> {
+    let addressedPtyStop = NO_STOP
     const deadlineMs = Date.now() + EXPLICIT_TERMINAL_CLOSE_STOP_TIMEOUT_MS
     for (const ptyId of ptyIds) {
       this.markPtyStopRequested(ptyId)
       const expectedIncarnationId = this.ptysById.get(ptyId)?.incarnationId
       let stopped = false
+      let pendingKillRecorded = false
       if (this.ptyController?.stopAndWait) {
         try {
           stopped = await this.ptyController.stopAndWait(ptyId, { deadlineMs })
@@ -41,6 +47,8 @@ export class OrcaRuntimeWithStopExplicitlyClosedTabPtys extends OrcaRuntimeWithF
             verdict?.status === 'unverifiable' &&
             verdict.reason === SSH_PROVIDER_UNREGISTERED_REASON
           if (!providerAlreadyRetiredPty) {
+            // Why before the kill: its own failure is recorded only once its RPC settles.
+            pendingKillRecorded = this.ptyController.recordUnconfirmedStop?.(ptyId) === true
             this.ptyController.kill(ptyId)
             if (!verdict || verdict.status === 'live') {
               this.markPtyLivenessUnverifiable(
@@ -54,35 +62,35 @@ export class OrcaRuntimeWithStopExplicitlyClosedTabPtys extends OrcaRuntimeWithF
         stopped = this.ptyController?.kill(ptyId) ?? false
       }
       if (ptyId === addressedPtyId) {
-        addressedPtyStopped = stopped
+        addressedPtyStop = { stopped, pendingKillRecorded }
       }
     }
-    return addressedPtyStopped
+    return addressedPtyStop
   }
 
   protected describeTerminalClose(
     handle: string,
     tabId: string,
     ptyId: string | null,
-    ptyKilled: boolean
+    stop: ExplicitCloseStop
   ): RuntimeTerminalClose {
-    if (ptyKilled || !ptyId) {
-      return { handle, tabId, ptyKilled }
+    const close: RuntimeTerminalClose = {
+      handle,
+      tabId,
+      ptyKilled: stop.stopped,
+      ...(stop.pendingKillRecorded ? { pendingKillRecorded: true as const } : {})
+    }
+    if (stop.stopped || !ptyId) {
+      return close
     }
     const verdict = this.getPtyLivenessVerdict(ptyId)
     if (verdict?.status === 'unverifiable') {
-      return {
-        handle,
-        tabId,
-        ptyKilled,
-        ptyStopVerdict: 'unverifiable',
-        ptyStopReason: verdict.reason
-      }
+      return { ...close, ptyStopVerdict: 'unverifiable', ptyStopReason: verdict.reason }
     }
     if (verdict?.status === 'live') {
-      return { handle, tabId, ptyKilled, ptyStopVerdict: 'live' }
+      return { ...close, ptyStopVerdict: 'live' }
     }
-    return { handle, tabId, ptyKilled }
+    return close
   }
 
   async closeTerminal(handle: string): Promise<RuntimeTerminalClose> {
@@ -106,11 +114,13 @@ export class OrcaRuntimeWithStopExplicitlyClosedTabPtys extends OrcaRuntimeWithF
           ? spawnSurface
           : null)
       const tabId = surface?.tab.parentTabId ?? pty.pty.tabId ?? pty.record.tabId
-      // Why: relay recovery can leave stale renderer leaves; the persisted HUB layout defines whether closing this PTY closes the whole surface.
-      const siblingCount = surface?.tab.parentLayout
-        ? countTerminalLayoutLeaves(surface.tab.parentLayout.root)
-        : this.countLeavesInTab(tabId)
-      if (siblingCount <= 1 && surface && this.tabs.has(tabId) && this.notifier?.closeTerminalTab) {
+      const leafId = surface?.tab.leafId ?? parsePaneKey(pty.pty.paneKey ?? '')?.leafId
+      const paneTarget = leafId ? { kind: 'pane' as const, tabId, leafId } : null
+      // Why: a PTY with no pane identity cannot be placed in any tab's layout, so it closes nothing.
+      const closesTab =
+        paneTarget !== null &&
+        this.resolveTerminalCloseTarget(pty.pty.worktreeId, paneTarget) === 'last-pane'
+      if (closesTab && surface && this.tabs.has(tabId) && this.notifier?.closeTerminalTab) {
         const ptyIdsToKill = this.getPtyIdsForExplicitTabClose(pty.pty.worktreeId, tabId)
         try {
           await this.closeMobileSessionTab(`id:${pty.pty.worktreeId}`, tabId, {
@@ -122,15 +132,10 @@ export class OrcaRuntimeWithStopExplicitlyClosedTabPtys extends OrcaRuntimeWithF
           }
           this.notifier.closeTerminal?.(tabId)
         }
-        const ptyKilled = await this.stopExplicitlyClosedTabPtys(ptyIdsToKill, pty.pty.ptyId)
-        return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, ptyKilled)
+        const stop = await this.stopExplicitlyClosedTabPtys(ptyIdsToKill, pty.pty.ptyId)
+        return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, stop)
       }
-      if (
-        siblingCount <= 1 &&
-        surface &&
-        ptyCloseAuthority &&
-        !this.tabs.has(surface.tab.parentTabId)
-      ) {
+      if (closesTab && surface && ptyCloseAuthority && !this.tabs.has(surface.tab.parentTabId)) {
         try {
           await this.closeMobileSessionTab(`id:${pty.pty.worktreeId}`, tabId, {
             reason: 'user',
@@ -141,59 +146,64 @@ export class OrcaRuntimeWithStopExplicitlyClosedTabPtys extends OrcaRuntimeWithF
           if (!(error instanceof Error) || error.message !== 'workspace_session_unavailable') {
             throw error
           }
-          const ptyKilled = await this.stopExplicitlyClosedTabPtys([pty.pty.ptyId], pty.pty.ptyId)
+          const stop = await this.stopExplicitlyClosedTabPtys([pty.pty.ptyId], pty.pty.ptyId)
           this.notifier?.closeTerminal(tabId)
-          return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, ptyKilled)
+          return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, stop)
         }
-        const ptyKilled = await this.stopExplicitlyClosedTabPtys([pty.pty.ptyId], pty.pty.ptyId)
-        return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, ptyKilled)
+        const stop = await this.stopExplicitlyClosedTabPtys([pty.pty.ptyId], pty.pty.ptyId)
+        return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, stop)
       }
-      if (siblingCount <= 1 && !surface && pty.pty.tabId && this.notifier?.closeTerminalTab) {
+      if (closesTab && !surface && pty.pty.tabId && this.notifier?.closeTerminalTab) {
         const ptyIdsToKill = this.getPtyIdsForExplicitTabClose(pty.pty.worktreeId, tabId)
         await this.notifier.closeTerminalTab(tabId, { localPtyTeardownOwnedExternally: true })
-        const ptyKilled = await this.stopExplicitlyClosedTabPtys(ptyIdsToKill, pty.pty.ptyId)
-        return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, ptyKilled)
+        const stop = await this.stopExplicitlyClosedTabPtys(ptyIdsToKill, pty.pty.ptyId)
+        return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, stop)
       }
-      const ptyKilled = await this.stopExplicitlyClosedTabPtys([pty.pty.ptyId], pty.pty.ptyId)
-      if (!ptyKilled || siblingCount <= 1) {
-        if (surface) {
-          // Why: paired viewers keep ended streams mounted until the HUB publishes removal, so explicit close uses the durable host-tab transaction instead of viewer-local exit handling.
-          try {
-            await this.closeMobileSessionTab(`id:${pty.pty.worktreeId}`, tabId, {
-              localPtyTeardownOwnedExternally: true
-            })
-          } catch (error) {
-            if (!(error instanceof Error) || error.message !== 'workspace_session_unavailable') {
-              throw error
-            }
-            this.notifier?.closeTerminal(tabId)
+      const stop = await this.stopExplicitlyClosedTabPtys([pty.pty.ptyId], pty.pty.ptyId)
+      if (!closesTab) {
+        // Why: the pane's removal is this close's own commit, not a side effect of its exit. An
+        // unconfirmed stop is unverifiable, never a reason to close the live siblings with it.
+        if (paneTarget) {
+          await this.closeTerminalPane(pty.pty.worktreeId, paneTarget)
+        }
+      } else if (surface) {
+        // Why: paired viewers keep ended streams mounted until the HUB publishes removal, so explicit close uses the durable host-tab transaction instead of viewer-local exit handling.
+        try {
+          await this.closeMobileSessionTab(`id:${pty.pty.worktreeId}`, tabId, {
+            localPtyTeardownOwnedExternally: true
+          })
+        } catch (error) {
+          if (!(error instanceof Error) || error.message !== 'workspace_session_unavailable') {
+            throw error
           }
-        } else {
           this.notifier?.closeTerminal(tabId)
         }
+      } else {
+        this.notifier?.closeTerminal(tabId)
       }
-      return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, ptyKilled)
+      return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, stop)
     }
     this.assertGraphReady()
     const { leaf } = this.getLiveLeafForHandle(handle)
-    // Why: in a multi-pane tab, killing the PTY is enough (renderer's exit handler closes the pane); an extra IPC close would race it and close the whole tab.
-    const siblingCount = this.countLeavesInTab(leaf.tabId)
-    const ptyIdsToKill =
-      siblingCount <= 1
-        ? this.getPtyIdsForExplicitTabClose(leaf.worktreeId, leaf.tabId)
-        : leaf.ptyId
-          ? [leaf.ptyId]
-          : []
-    if (siblingCount <= 1 && this.notifier?.closeTerminalTab) {
+    const paneTarget = { kind: 'pane' as const, tabId: leaf.tabId, leafId: leaf.leafId }
+    const closesTab = this.resolveTerminalCloseTarget(leaf.worktreeId, paneTarget) === 'last-pane'
+    const ptyIdsToKill = closesTab
+      ? this.getPtyIdsForExplicitTabClose(leaf.worktreeId, leaf.tabId)
+      : leaf.ptyId
+        ? [leaf.ptyId]
+        : []
+    if (closesTab && this.notifier?.closeTerminalTab) {
       await this.notifier.closeTerminalTab(leaf.tabId, { localPtyTeardownOwnedExternally: true })
     }
-    const ptyKilled = leaf.ptyId
+    const stop = leaf.ptyId
       ? await this.stopExplicitlyClosedTabPtys(ptyIdsToKill, leaf.ptyId)
-      : false
-    if (siblingCount > 1 ? !ptyKilled : !this.notifier?.closeTerminalTab) {
-      this.notifier?.closeTerminal(leaf.tabId, leaf.paneRuntimeId)
+      : NO_STOP
+    if (!closesTab) {
+      await this.closeTerminalPane(leaf.worktreeId, paneTarget)
+    } else if (!this.notifier?.closeTerminalTab) {
+      this.notifier?.closeTerminal(leaf.tabId)
     }
-    return this.describeTerminalClose(handle, leaf.tabId, leaf.ptyId ?? null, ptyKilled)
+    return this.describeTerminalClose(handle, leaf.tabId, leaf.ptyId ?? null, stop)
   }
 
   async closeTerminalTab(handle: string): Promise<RuntimeTerminalClose> {
diff --git a/src/main/runtime/orca-runtime-stop-requested-pty-ids.ts b/src/main/runtime/orca-runtime-stop-requested-pty-ids.ts
index 4989245fdf6..a7175383df0 100644
--- a/src/main/runtime/orca-runtime-stop-requested-pty-ids.ts
+++ b/src/main/runtime/orca-runtime-stop-requested-pty-ids.ts
@@ -1,6 +1,7 @@
 // @ts-nocheck -- mechanically split from OrcaRuntimeService; behavior is covered by AST equivalence and characterization tests.
 import { OrchestrationStructuredMailboxPointerDelivery } from './orchestration/structured-mailbox-pointer-delivery'
 import { createStructuredMailboxPointerHost } from './orchestration/structured-mailbox-pointer-host'
+import { localOrchestrationCliCommand } from './orchestration/cli-command'
 import { isStructuredWorkerHandle } from './structured-worker-identity'
 import { resolveStructuredWorkerAuthority } from './structured-worker-authority'
 import { OrcaRuntimeWithRuntimeId } from './orca-runtime-runtime-id'
@@ -221,6 +222,7 @@ export class OrcaRuntimeWithStopRequestedPtyIds extends OrcaRuntimeWithRuntimeId
       getMessageWaiters: (mailboxHandle) => this.messageWaiters.get(mailboxHandle),
       resolveStructuredTarget: (mailboxHandle) =>
         this.resolveStructuredMailboxTarget(mailboxHandle),
+      getCliCommand: localOrchestrationCliCommand,
       host: createStructuredMailboxPointerHost()
     })
 
diff --git a/src/main/runtime/orca-runtime-stop-terminals-for-worktree.ts b/src/main/runtime/orca-runtime-stop-terminals-for-worktree.ts
index 768448e2ac9..747384d2103 100644
--- a/src/main/runtime/orca-runtime-stop-terminals-for-worktree.ts
+++ b/src/main/runtime/orca-runtime-stop-terminals-for-worktree.ts
@@ -11,7 +11,8 @@ import type {
 } from '../../shared/runtime-types'
 import type { WorktreeTerminalMutationKind } from './worktree-terminal-mutation-lock'
 import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
-import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from './workspace-session-failed-write-rollback'
+import { cloneWorkspaceSessionState } from '../persistence/restoring-sessions/session-owner-fields'
+import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from '../persistence/restoring-sessions/workspace-session-write-rollback'
 import {
   getWorktreeExecutionHostId,
   parseExecutionHostId,
@@ -88,7 +89,7 @@ export class OrcaRuntimeWithStopTerminalsForWorktree extends OrcaRuntimeWithReso
         }
         closed += 1
       }
-      this.clearWorktreeTerminalResumeRecords(worktree.id, sessionHostId, parentTabIds)
+      await this.clearWorktreeTerminalResumeRecords(worktree.id, sessionHostId, parentTabIds)
       const { stopped } = await this.stopTerminalsForWorktree(`id:${worktree.id}`, {
         resolvedWorktreeId: worktree.id,
         ...hostFence
@@ -109,60 +110,65 @@ export class OrcaRuntimeWithStopTerminalsForWorktree extends OrcaRuntimeWithReso
     })
   }
 
-  private clearWorktreeTerminalResumeRecords(
+  private async clearWorktreeTerminalResumeRecords(
     worktreeId: string,
     hostId: ExecutionHostId,
     closedTabIds: readonly string[]
-  ): void {
+  ): Promise<void> {
     if (
       !this.store?.getWorkspaceSession ||
       !this.store.setWorkspaceSession ||
-      !this.store.flushOrThrow
+      !this.store.runDurableMutation
     ) {
       throw new Error('workspace_session_unavailable')
     }
-    const session = this.store.getWorkspaceSession(hostId)
-    const sleepingAgentSessionsByPaneKey = Object.fromEntries(
-      Object.entries(session.sleepingAgentSessionsByPaneKey ?? {}).filter(
-        ([, record]) => record.worktreeId !== worktreeId
+    const refusal = await this.store.runDurableMutation<Error | undefined>(() => {
+      const session = cloneWorkspaceSessionState(this.store.getWorkspaceSession(hostId))
+      const sleepingAgentSessionsByPaneKey = Object.fromEntries(
+        Object.entries(session.sleepingAgentSessionsByPaneKey ?? {}).filter(
+          ([, record]) => record.worktreeId !== worktreeId
+        )
       )
-    )
-    const terminalPtyIncarnationsByPaneKey = Object.fromEntries(
-      Object.entries(session.terminalPtyIncarnationsByPaneKey ?? {}).filter(
-        ([paneKey]) => !closedTabIds.some((tabId) => paneKey.startsWith(`${tabId}:`))
+      const terminalPtyIncarnationsByPaneKey = Object.fromEntries(
+        Object.entries(session.terminalPtyIncarnationsByPaneKey ?? {}).filter(
+          ([paneKey]) => !closedTabIds.some((tabId) => paneKey.startsWith(`${tabId}:`))
+        )
       )
-    )
-    const remainingTerminalRows = session.tabsByWorktree[worktreeId] ?? []
-    const remainingUnifiedTerminalTabs = (session.unifiedTabs?.[worktreeId] ?? []).filter(
-      (tab) => tab.contentType === 'terminal'
-    )
-    if (remainingTerminalRows.length > 0 || remainingUnifiedTerminalTabs.length > 0) {
-      throw new Error('terminal_close_incomplete')
-    }
-    const hasChanges =
-      Object.keys(sleepingAgentSessionsByPaneKey).length !==
-        Object.keys(session.sleepingAgentSessionsByPaneKey ?? {}).length ||
-      Object.keys(terminalPtyIncarnationsByPaneKey).length !==
-        Object.keys(session.terminalPtyIncarnationsByPaneKey ?? {}).length
-    if (!hasChanges) {
-      return
-    }
-    const next: WorkspaceSessionState = {
-      ...session,
-      sleepingAgentSessionsByPaneKey,
-      terminalPtyIncarnationsByPaneKey
-    }
-    this.store.setWorkspaceSession(next, hostId)
-    const staged = this.store.getWorkspaceSession(hostId)
-    try {
-      this.store.flushOrThrow()
-    } catch (error) {
-      const current = this.store.getWorkspaceSession(hostId)
-      const rolledBack = rollbackWorkspaceSessionAfterFailedAsyncWrite(session, staged, current)
-      if (rolledBack !== current) {
-        this.store.setWorkspaceSession(rolledBack, hostId)
+      const remainingTerminalRows = session.tabsByWorktree[worktreeId] ?? []
+      const remainingUnifiedTerminalTabs = (session.unifiedTabs?.[worktreeId] ?? []).filter(
+        (tab) => tab.contentType === 'terminal'
+      )
+      if (remainingTerminalRows.length > 0 || remainingUnifiedTerminalTabs.length > 0) {
+        return { value: new Error('terminal_close_incomplete'), persist: false }
       }
-      throw error
+      const hasChanges =
+        Object.keys(sleepingAgentSessionsByPaneKey).length !==
+          Object.keys(session.sleepingAgentSessionsByPaneKey ?? {}).length ||
+        Object.keys(terminalPtyIncarnationsByPaneKey).length !==
+          Object.keys(session.terminalPtyIncarnationsByPaneKey ?? {}).length
+      if (!hasChanges) {
+        return { value: undefined, persist: false }
+      }
+      const next: WorkspaceSessionState = {
+        ...session,
+        sleepingAgentSessionsByPaneKey,
+        terminalPtyIncarnationsByPaneKey
+      }
+      this.store.setWorkspaceSession(next, hostId)
+      const staged = cloneWorkspaceSessionState(this.store.getWorkspaceSession(hostId))
+      return {
+        value: undefined,
+        rollback: () => {
+          const current = this.store.getWorkspaceSession(hostId)
+          const rolledBack = rollbackWorkspaceSessionAfterFailedAsyncWrite(session, staged, current)
+          if (rolledBack !== current) {
+            this.store.setWorkspaceSession(rolledBack, hostId)
+          }
+        }
+      }
+    })
+    if (refusal) {
+      throw refusal
     }
   }
 
diff --git a/src/main/runtime/orca-runtime-structured-agent-session-create-intent.test.ts b/src/main/runtime/orca-runtime-structured-agent-session-create-intent.test.ts
index ac120a80406..c5cdf188cd4 100644
--- a/src/main/runtime/orca-runtime-structured-agent-session-create-intent.test.ts
+++ b/src/main/runtime/orca-runtime-structured-agent-session-create-intent.test.ts
@@ -1,6 +1,72 @@
-import { describe, expect, it, vi } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const applyAgentWorkspaceTrust = vi.hoisted(() => vi.fn(async () => ({})))
+vi.mock('../agent-workspace-trust', () => ({ applyAgentWorkspaceTrust }))
+
 import { OrcaRuntimeService } from './orca-runtime'
 
+beforeEach(() => {
+  applyAgentWorkspaceTrust.mockClear()
+})
+
+function createCodexIntentRuntime(settings: Record<string, unknown>) {
+  const prepareCodexStructuredLaunch = vi.fn(() => '/accounts/selected/home')
+  const runtime = new OrcaRuntimeService(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: create intent only reads getSettings from the store.
+    { getSettings: () => ({ agentDefaultEnv: { codex: {} }, ...settings }) } as never,
+    undefined,
+    { prepareCodexStructuredLaunch }
+  )
+  vi.spyOn(runtime, 'getStructuredAgentSessionCreateSupport').mockResolvedValue({
+    supported: true
+  })
+  Object.assign(runtime, {
+    resolveStructuredAgentSessionLocation: vi.fn(async () => ({
+      executionHostId: 'local',
+      wslDistro: null,
+      workspaceId: 'workspace-1',
+      workspaceKind: 'git-worktree' as const
+    })),
+    resolveRuntimeFileTarget: vi.fn(async () => ({ worktree: { path: '/repos/workspace-1' } }))
+  })
+  const createIntent = () =>
+    runtime.resolveStructuredAgentSessionCreateIntent({
+      envelope: { sessionId: 'session-1', clientOperationId: 'operation-1' },
+      worktree: 'id:workspace-1',
+      agent: 'codex'
+    })
+  return { prepareCodexStructuredLaunch, createIntent }
+}
+
+describe('structured Codex folder trust', () => {
+  it('pre-trusts the chat folder before launch preparation, as a Codex terminal launch does', async () => {
+    const { prepareCodexStructuredLaunch, createIntent } = createCodexIntentRuntime({})
+
+    await createIntent()
+
+    expect(applyAgentWorkspaceTrust).toHaveBeenCalledWith('codex', '/repos/workspace-1', {
+      env: expect.any(Object),
+      claudeAuth: null,
+      wslDistro: null,
+      connectionId: null
+    })
+    expect(applyAgentWorkspaceTrust.mock.invocationCallOrder[0]).toBeLessThan(
+      prepareCodexStructuredLaunch.mock.invocationCallOrder[0]
+    )
+  })
+
+  it('writes nothing with the setting off, and still prepares the launch', async () => {
+    const { prepareCodexStructuredLaunch, createIntent } = createCodexIntentRuntime({
+      agentWorkspaceTrustEnabled: false
+    })
+
+    await createIntent()
+
+    expect(applyAgentWorkspaceTrust).not.toHaveBeenCalled()
+    expect(prepareCodexStructuredLaunch).toHaveBeenCalledTimes(1)
+  })
+})
+
 describe('structured agent-session create intent', () => {
   it('pins the selected Codex launch home after normal launch preparation', async () => {
     const prepareCodexStructuredLaunch = vi.fn(() => '/accounts/selected/home')
@@ -52,7 +118,6 @@ describe('structured agent-session create intent', () => {
     })
 
     expect(prepareCodexStructuredLaunch).toHaveBeenCalledWith({
-      workspacePath: '/repos/workspace-1',
       launchEnv: expect.objectContaining({ CODEX_HOME: '/configured/home' })
     })
     expect(intent.accountHome).toEqual({
@@ -82,7 +147,6 @@ describe('structured agent-session create intent', () => {
     // no cleared account selection — the read-only sibling answers instead.
     expect(prepareCodexStructuredLaunch).not.toHaveBeenCalled()
     expect(resolveCodexStructuredLaunchHome).toHaveBeenCalledWith({
-      workspacePath: '',
       launchEnv: expect.objectContaining({ CODEX_HOME: '/configured/home' })
     })
     expect(accountHome).toEqual({ variable: 'CODEX_HOME', path: '/accounts/selected/home' })
@@ -138,6 +202,8 @@ describe('structured agent-session create intent', () => {
     })
 
     expect(prepareCodexStructuredLaunch).not.toHaveBeenCalled()
+    // Claude was never pre-trusted for a structured chat.
+    expect(applyAgentWorkspaceTrust).not.toHaveBeenCalled()
     expect(intent.accountHome).toEqual({
       variable: 'CLAUDE_CONFIG_DIR',
       path: '/configured/claude-home'
diff --git a/src/main/runtime/orca-runtime-structured-session-restore.test.ts b/src/main/runtime/orca-runtime-structured-session-restore.test.ts
index d6ec1e22782..1d8105d07f8 100644
--- a/src/main/runtime/orca-runtime-structured-session-restore.test.ts
+++ b/src/main/runtime/orca-runtime-structured-session-restore.test.ts
@@ -307,10 +307,7 @@ describe('structured session cold restoration', () => {
       reason: 'user'
     })
 
-    expect(closeSessionTab).toHaveBeenCalledWith(
-      'structured-agent-session-restored-session',
-      'workspace-1'
-    )
+    expect(closeSessionTab).toHaveBeenCalledWith('agent-session:restored-session', 'workspace-1')
     expect(closeStructuredSession).toHaveBeenCalledWith('restored-session')
     expect(setSessionTabVisibility).toHaveBeenCalledWith('restored-session', false)
     expect(setSessionTabVisibility.mock.invocationCallOrder[0]).toBeLessThan(
diff --git a/src/main/runtime/orca-runtime-terminal-close-continuity.test.ts b/src/main/runtime/orca-runtime-terminal-close-continuity.test.ts
index ef24301c7cf..5e100dd4dbd 100644
--- a/src/main/runtime/orca-runtime-terminal-close-continuity.test.ts
+++ b/src/main/runtime/orca-runtime-terminal-close-continuity.test.ts
@@ -72,25 +72,27 @@ describe('terminal close and handle incarnation continuity', () => {
     unsubscribe()
   })
 
-  it('publishes no retirement or absence when the durable headless close fails', async () => {
+  it('still kills and keeps the removal when the durable headless close fails to flush', async () => {
     const harness = await createStaleTabCloseHarness({ headless: true })
-    const published = vi.fn()
-    const unsubscribe = harness.runtime.onMobileSessionTabsChanged(published)
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined)
     harness.rejectPersistenceFlush(new Error('disk-full'))
 
-    await expect(harness.runtime.closeTerminalTab(harness.terminal.handle)).rejects.toThrow(
-      'disk-full'
-    )
-
-    expect(harness.kill).not.toHaveBeenCalled()
-    expect(published).not.toHaveBeenCalled()
-    expect(harness.getSession().tabsByWorktree[WORKTREE_ID]).toHaveLength(1)
-    const snapshot = await harness.runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)
-    expect(snapshot).toMatchObject({
-      tabs: [expect.objectContaining({ parentTabId: TAB_ID, leafId: LEAF_ID })]
+    await expect(harness.runtime.closeTerminalTab(harness.terminal.handle)).resolves.toMatchObject({
+      tabId: TAB_ID,
+      closeMode: 'tab'
     })
-    expect(snapshot.retiredTerminalSurfaces).toBeUndefined()
-    unsubscribe()
+
+    // Why: a failed flush is bookkeeping; the user's close still stops its process and the
+    // in-memory removal stays for the next flush to write.
+    expect(harness.kill).toHaveBeenCalledWith(RUNTIME_OWNED_PTY_ID)
+    expect(harness.getSession().tabsByWorktree[WORKTREE_ID]).toEqual([])
+    const snapshot = await harness.runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)
+    expect(snapshot.tabs).toEqual([])
+    expect(errorSpy).toHaveBeenCalledWith(
+      '[runtime] failed to persist terminal close:',
+      expect.any(Error)
+    )
+    errorSpy.mockRestore()
   })
 
   it('publishes each split leaf retirement with its own terminal handle', async () => {
@@ -366,6 +368,36 @@ describe('terminal close and handle incarnation continuity', () => {
     expect(harness.kill).toHaveBeenCalledWith(PTY_ID)
   })
 
+  it.each([true, false])(
+    'promises a retry only when the stop recorded a replayable kill (recorded: %s)',
+    async (recorded) => {
+      const harness = createHarness()
+      const [{ handle }] = (await harness.runtime.listTerminals(`id:${WORKTREE_ID}`)).terminals
+      harness.setVerifiedStopResult(false)
+      const recordUnconfirmedStop = vi.fn(() => {
+        // The order must exist before the follow-up kill, whose own failure lands only later.
+        expect(harness.kill).not.toHaveBeenCalled()
+        return recorded
+      })
+      const controller = harness.runtime['ptyController']
+      if (!controller) {
+        throw new Error('fixture has no PTY controller')
+      }
+      Object.assign(controller, { recordUnconfirmedStop })
+
+      const closing = harness.runtime.closeTerminal(handle)
+      await vi.waitFor(() => expect(harness.closeTerminalTab).toHaveBeenCalled())
+      harness.retirePersistedTab()
+      harness.acknowledged.resolve()
+
+      const close = await closing
+      expect(recordUnconfirmedStop).toHaveBeenCalledWith(PTY_ID)
+      expect(harness.kill).toHaveBeenCalledWith(PTY_ID)
+      expect(close.ptyStopVerdict).toBe('unverifiable')
+      expect(close.pendingKillRecorded).toBe(recorded ? true : undefined)
+    }
+  )
+
   it('leaves a confirmed kill receipt free of any stop verdict', async () => {
     const harness = createHarness()
     const [{ handle }] = (await harness.runtime.listTerminals(`id:${WORKTREE_ID}`)).terminals
diff --git a/src/main/runtime/orca-runtime-terminal-close-no-widening.test.ts b/src/main/runtime/orca-runtime-terminal-close-no-widening.test.ts
new file mode 100644
index 00000000000..1b98c67b8be
--- /dev/null
+++ b/src/main/runtime/orca-runtime-terminal-close-no-widening.test.ts
@@ -0,0 +1,335 @@
+import { describe, expect, it } from 'vitest'
+import {
+  LEAF_ID,
+  PTY_ID,
+  SIBLING_LEAF_ID,
+  SIBLING_PTY_ID,
+  TAB_ID,
+  WORKTREE_ID,
+  createHarness,
+  type CloseContinuityHarness
+} from './__fixtures__/orca-runtime-terminal-close-continuity-fixtures'
+import { retireTerminalSurfaceFromPersistence } from './mobile-session-terminal-persistence-retirement'
+
+const emptyLayout = { root: null, activeLeafId: null, expandedLeafId: null }
+
+/**
+ * Every explicit close of one pane, from every entry point, under every condition that has ever
+ * widened one into a whole-tab close: the live sibling survives and no tab-level close goes out.
+ */
+
+type Entry = 'renderer' | 'cli-graph' | 'cli-pty' | 'phone-desktop' | 'phone-headless'
+type Condition =
+  | 'normal'
+  | 'stop-unconfirmed'
+  | 'stop-throws'
+  | 'leaf-already-retired'
+  | 'unbound-sibling'
+  | 'pinned'
+  | 'no-saved-layout'
+  | 'no-live-pty'
+  | 'kill-fails'
+  | 'nothing-published'
+
+/** The desktop renderer's split tab as it publishes it, with the given PTY bindings. */
+function syncRendererSplit(
+  harness: CloseContinuityHarness,
+  ptyIdsByLeafId: Record<string, string>,
+  livePtyIdsByLeafId = ptyIdsByLeafId
+): void {
+  const parentLayout = {
+    root: {
+      type: 'split' as const,
+      direction: 'horizontal' as const,
+      first: { type: 'leaf' as const, leafId: LEAF_ID },
+      second: { type: 'leaf' as const, leafId: SIBLING_LEAF_ID }
+    },
+    activeLeafId: LEAF_ID,
+    expandedLeafId: null,
+    ptyIdsByLeafId
+  }
+  const leaves = [LEAF_ID, SIBLING_LEAF_ID].map((leafId, index) => ({
+    tabId: TAB_ID,
+    worktreeId: WORKTREE_ID,
+    leafId,
+    paneRuntimeId: 7 + index,
+    ptyId: livePtyIdsByLeafId[leafId] ?? null
+  }))
+  harness.runtime.syncWindowGraph(1, {
+    tabs: [
+      {
+        tabId: TAB_ID,
+        worktreeId: WORKTREE_ID,
+        title: 'Fixture shell',
+        activeLeafId: LEAF_ID,
+        layout: parentLayout.root
+      }
+    ],
+    leaves,
+    mobileSessionTabs: [
+      {
+        worktree: WORKTREE_ID,
+        publicationEpoch: 'renderer:unbound-pane',
+        snapshotVersion: 3,
+        activeGroupId: null,
+        activeTabId: `${TAB_ID}::${LEAF_ID}`,
+        activeTabType: 'terminal' as const,
+        tabs: leaves.map((leaf) => ({
+          type: 'terminal' as const,
+          id: `${TAB_ID}::${leaf.leafId}`,
+          parentTabId: TAB_ID,
+          leafId: leaf.leafId,
+          ...(ptyIdsByLeafId[leaf.leafId] ? { ptyId: ptyIdsByLeafId[leaf.leafId] } : {}),
+          title: 'Fixture shell',
+          parentLayout,
+          isActive: leaf.leafId === LEAF_ID
+        }))
+      }
+    ]
+  })
+}
+
+function arrange(entry: Entry, condition: Condition): CloseContinuityHarness {
+  const usesPtyRecord = entry !== 'cli-graph' && entry !== 'renderer' && condition !== 'no-live-pty'
+  const harness = createHarness({ publishMobileSurface: true, registerPtyBacked: usesPtyRecord })
+  if (condition === 'unbound-sibling') {
+    // A pane the renderer just split: no PTY bound yet, so main's saved layout lacks it.
+    syncRendererSplit(harness, { [LEAF_ID]: PTY_ID })
+  } else {
+    harness.syncSplitFixtureGraph()
+  }
+  if (condition === 'no-live-pty') {
+    // The closed pane's process already exited, so main holds no record of its PTY.
+    syncRendererSplit(
+      harness,
+      { [LEAF_ID]: 'pty-exited', [SIBLING_LEAF_ID]: SIBLING_PTY_ID },
+      { [SIBLING_LEAF_ID]: SIBLING_PTY_ID }
+    )
+  }
+  if (entry === 'cli-pty') {
+    // Graph without the leaf: the handle resolves through the PTY, as for a runtime-owned pane.
+    harness.syncFixtureTabWithoutLeaf()
+  }
+  if (condition === 'nothing-published') {
+    // The renderer lists the tab before its panes register and before it publishes any row.
+    harness.runtime.syncWindowGraph(1, {
+      tabs: [
+        {
+          tabId: TAB_ID,
+          worktreeId: WORKTREE_ID,
+          title: 'Fixture shell',
+          activeLeafId: null,
+          layout: null
+        }
+      ],
+      leaves: [],
+      mobileSessionTabs: [
+        {
+          worktree: WORKTREE_ID,
+          publicationEpoch: 'renderer:nothing-published',
+          snapshotVersion: 4,
+          activeGroupId: null,
+          activeTabId: null,
+          activeTabType: null,
+          tabs: []
+        }
+      ]
+    })
+  }
+  if (condition === 'kill-fails') {
+    harness.kill.mockReturnValue(false)
+  }
+  if (condition === 'stop-unconfirmed') {
+    harness.setVerifiedStopResult(false)
+  } else if (condition === 'stop-throws') {
+    harness.setVerifiedStopResult(new Error('ssh_host_unreachable'))
+  } else {
+    harness.setVerifiedStopResult(true)
+  }
+  if (condition === 'leaf-already-retired') {
+    harness.editSession((session) =>
+      retireTerminalSurfaceFromPersistence(session, {
+        worktreeId: WORKTREE_ID,
+        parentTabId: TAB_ID,
+        leafId: LEAF_ID,
+        ptyId: PTY_ID
+      })
+    )
+  } else if (condition === 'pinned') {
+    harness.editSession((session) => ({
+      ...session,
+      tabsByWorktree: {
+        [WORKTREE_ID]: (session.tabsByWorktree[WORKTREE_ID] ?? []).map((tab) => ({
+          ...tab,
+          isPinned: true
+        }))
+      }
+    }))
+  } else if (condition === 'no-saved-layout') {
+    harness.editSession((session) => ({ ...session, terminalLayoutsByTabId: {} }))
+  }
+  // A renderer that honours a whole-tab close, so a widened close shows as the lost sibling.
+  harness.setCloseTerminalTabAction(() => harness.retirePersistedTab())
+  return harness
+}
+
+async function closePane(entry: Entry, harness: CloseContinuityHarness): Promise<void> {
+  if (entry === 'renderer') {
+    await harness.runtime.closeTerminalSurfaceFromRenderer({
+      worktreeId: WORKTREE_ID,
+      target: {
+        kind: 'pane',
+        tabId: TAB_ID,
+        leafId: LEAF_ID
+      }
+    })
+    return
+  }
+  if (entry === 'cli-graph' || entry === 'cli-pty') {
+    const terminal = (await harness.runtime.listTerminals(`id:${WORKTREE_ID}`)).terminals.find(
+      (candidate) => candidate.ptyId === PTY_ID
+    )
+    if (!terminal) {
+      throw new Error('fixture pane has no terminal handle')
+    }
+    await harness.runtime.closeTerminal(terminal.handle)
+    return
+  }
+  if (entry === 'phone-headless') {
+    harness.runtime.setNotifier(null)
+    harness.syncEmptyGraph()
+  }
+  await harness.runtime.closeMobileSessionTab(`id:${WORKTREE_ID}`, `${TAB_ID}::${LEAF_ID}`, {
+    reason: 'user'
+  })
+}
+
+const rows: [Entry, Condition][] = [
+  // e.g. the exited-pane overlay's Close after main's exit handling retired that pane (fc5cac5c32).
+  ['renderer', 'leaf-already-retired'],
+  ['renderer', 'unbound-sibling'],
+  ['renderer', 'pinned'],
+  ['renderer', 'no-saved-layout'],
+  ['cli-graph', 'normal'],
+  ['cli-graph', 'stop-unconfirmed'],
+  ['cli-graph', 'leaf-already-retired'],
+  ['cli-graph', 'unbound-sibling'],
+  ['cli-pty', 'normal'],
+  // An unconfirmed stop once chose the tab close (bc8bbd7abf).
+  ['cli-pty', 'stop-unconfirmed'],
+  ['cli-pty', 'stop-throws'],
+  ['cli-pty', 'unbound-sibling'],
+  // An owner copy with no panes once read as "one pane", so the close took the whole tab.
+  ['cli-pty', 'nothing-published'],
+  ['phone-desktop', 'normal'],
+  ['phone-desktop', 'pinned'],
+  ['phone-desktop', 'unbound-sibling'],
+  ['phone-desktop', 'no-saved-layout'],
+  // A pane with no live process record once sent a tab-level close notice.
+  ['phone-desktop', 'no-live-pty'],
+  ['phone-desktop', 'kill-fails'],
+  // A host with no desktop window once closed the whole tab for one pane.
+  ['phone-headless', 'normal'],
+  ['phone-headless', 'kill-fails'],
+  ['phone-headless', 'leaf-already-retired'],
+  ['phone-headless', 'pinned'],
+  ['phone-headless', 'no-saved-layout']
+]
+
+describe('an explicit close of one pane never widens into its tab', () => {
+  it.each(rows)('%s close, %s', async (entry, condition) => {
+    const harness = arrange(entry, condition)
+    const siblingWasPersisted = Boolean(
+      harness.getSession().terminalLayoutsByTabId[TAB_ID]?.ptyIdsByLeafId?.[SIBLING_LEAF_ID]
+    )
+
+    await closePane(entry, harness)
+
+    const session = harness.getSession()
+    expect(session.tabsByWorktree[WORKTREE_ID]).toEqual([expect.objectContaining({ id: TAB_ID })])
+    if (siblingWasPersisted) {
+      expect(session.terminalLayoutsByTabId[TAB_ID]?.root).toEqual({
+        type: 'leaf',
+        leafId: SIBLING_LEAF_ID
+      })
+    }
+    expect(harness.closeTerminalTab).not.toHaveBeenCalled()
+    expect(harness.closeTerminal).not.toHaveBeenCalled()
+    expect(harness.kill).not.toHaveBeenCalledWith(SIBLING_PTY_ID)
+    if (entry === 'renderer') {
+      return
+    }
+    if (entry === 'phone-headless') {
+      const snapshot = await harness.runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)
+      expect(snapshot.tabs.map((tab) => tab.id)).toEqual([`${TAB_ID}::${SIBLING_LEAF_ID}`])
+      expect(harness.kill).toHaveBeenCalledWith(PTY_ID)
+      return
+    }
+    expect(harness.closeTerminalPane).toHaveBeenCalledExactlyOnceWith(TAB_ID, LEAF_ID)
+  })
+})
+
+describe("a close of a tab's last pane still closes the tab", () => {
+  it('on a host with no desktop window, closes the whole tab in main and for paired clients', async () => {
+    const harness = createHarness({ publishMobileSurface: true, registerPtyBacked: true })
+    harness.runtime.setNotifier(null)
+    harness.syncEmptyGraph()
+
+    await harness.runtime.closeMobileSessionTab(`id:${WORKTREE_ID}`, `${TAB_ID}::${LEAF_ID}`, {
+      reason: 'user'
+    })
+
+    expect(harness.getSession().tabsByWorktree[WORKTREE_ID]).toEqual([])
+    expect((await harness.runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)).tabs).toEqual([])
+    expect(harness.kill).toHaveBeenCalledWith(PTY_ID)
+  })
+
+  it.each([
+    ['no saved layout', () => ({})],
+    ['a layout saved before its pane mounted', () => ({ [TAB_ID]: emptyLayout })]
+  ] as const)(
+    'on a host with no desktop window, closes an unsplit tab with %s',
+    async (_name, layouts) => {
+      const harness = createHarness({ publishMobileSurface: true, registerPtyBacked: true })
+      harness.runtime.setNotifier(null)
+      harness.syncEmptyGraph()
+      harness.editSession((session) => ({ ...session, terminalLayoutsByTabId: layouts() }))
+
+      await harness.runtime.closeMobileSessionTab(`id:${WORKTREE_ID}`, `${TAB_ID}::${LEAF_ID}`, {
+        reason: 'user'
+      })
+
+      expect(harness.getSession().tabsByWorktree[WORKTREE_ID]).toEqual([])
+      expect(harness.kill).toHaveBeenCalledWith(PTY_ID)
+    }
+  )
+
+  it('from the CLI by PTY, closes an unsplit tab whose renderer graph lists no panes yet', async () => {
+    const harness = createHarness({ publishMobileSurface: true, registerPtyBacked: true })
+    harness.syncFixtureTabWithoutLeaf()
+    harness.setVerifiedStopResult(true)
+    harness.setCloseTerminalTabAction(() => harness.retirePersistedTab())
+
+    await closePane('cli-pty', harness)
+
+    expect(harness.closeTerminalTab.mock.calls.map((call) => call[0])).toEqual([TAB_ID])
+    expect(harness.closeTerminalPane).not.toHaveBeenCalled()
+  })
+
+  it.each(['phone-desktop', 'cli-graph'] as const)(
+    'from %s, goes through the renderer tab close so its pin guard still runs',
+    async (entry) => {
+      const harness = createHarness({
+        publishMobileSurface: true,
+        registerPtyBacked: entry === 'phone-desktop'
+      })
+      harness.setVerifiedStopResult(true)
+      harness.setCloseTerminalTabAction(() => harness.retirePersistedTab())
+
+      await closePane(entry, harness)
+
+      expect(harness.closeTerminalTab.mock.calls.map((call) => call[0])).toEqual([TAB_ID])
+      expect(harness.closeTerminalPane).not.toHaveBeenCalled()
+    }
+  )
+})
diff --git a/src/main/runtime/orca-runtime-terminal-close-records.test.ts b/src/main/runtime/orca-runtime-terminal-close-records.test.ts
new file mode 100644
index 00000000000..f05ac78957a
--- /dev/null
+++ b/src/main/runtime/orca-runtime-terminal-close-records.test.ts
@@ -0,0 +1,309 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { getDefaultWorkspaceSession } from '../../shared/constants'
+import {
+  CLOSED_TERMINAL_TAB_TOMBSTONE_TTL_MS,
+  MAX_CLOSED_TERMINAL_TAB_TOMBSTONES
+} from '../../shared/closed-terminal-tab-tombstones'
+import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
+import { Store } from '../persistence/loading-store/store'
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
+import { OrcaRuntimeService } from './orca-runtime'
+import {
+  LEAF_ID,
+  REPO_ID,
+  TAB_ID,
+  WORKTREE_ID,
+  WORKTREE_PATH,
+  makeSession
+} from './__fixtures__/orca-runtime-terminal-close-continuity-fixtures'
+import { advanceTerminalTopologyRevision } from './workspace-session-terminal-membership-authority'
+
+const SSH_REPO_ID = 'ssh-repo'
+const SSH_HOST_ID = 'ssh:target-1'
+const SSH_WORKTREE_ID = `${SSH_REPO_ID}::/srv/app`
+const LATE_TAB_ID = '6f0a5c8e-2b1d-4c3e-9f7a-1d2e3f4a5b6c'
+
+const directories: string[] = []
+afterEach(async () => {
+  await closeTestStores()
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function createPersistedRuntime(session: WorkspaceSessionState = makeSession()) {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-close-records-'))
+  directories.push(directory)
+  const dataFile = join(directory, 'orca-data.json')
+  const store = createSqliteTestStore(Store, { dataFile })
+  store.addRepo({
+    id: REPO_ID,
+    path: WORKTREE_PATH,
+    displayName: 'Fixture',
+    badgeColor: 'gray',
+    addedAt: 1
+  })
+  store.addRepo({
+    id: SSH_REPO_ID,
+    path: '/srv/app',
+    displayName: 'Remote',
+    badgeColor: 'gray',
+    addedAt: 1,
+    connectionId: 'target-1'
+  })
+  store.setWorkspaceSession(advanceTerminalTopologyRevision(session, WORKTREE_ID))
+  store.flushOrThrow()
+  return {
+    store,
+    runtime: new OrcaRuntimeService(store),
+    reload: async () => {
+      store.flush()
+      store.freezeWrites()
+      await store.waitForPendingWrite()
+      return createSqliteTestStore(Store, { dataFile })
+    }
+  }
+}
+
+/** A renderer save: membership as the renderer holds it, and no close records, which it never sends. */
+function rendererSave(session: WorkspaceSessionState): WorkspaceSessionState {
+  const {
+    terminalTopologyRevisionByRepoId: _hostPrivate,
+    closedTerminalTabTombstonesByTabId: _mainOwned,
+    ...rendererView
+  } = session
+  return { ...rendererView, tabsByWorktree: { [WORKTREE_ID]: [] }, terminalLayoutsByTabId: {} }
+}
+
+describe('close records', () => {
+  it.each(['user', 'cleanup'] as const)(
+    'records a %s close in main and keeps it across a renderer save and a reload',
+    async (reason) => {
+      const { store, runtime, reload } = createPersistedRuntime()
+
+      await runtime.closeTerminalSurfaceFromRenderer({
+        worktreeId: WORKTREE_ID,
+        target: { kind: 'tab', tabId: TAB_ID },
+        reason
+      })
+      store.setWorkspaceSession(rendererSave(store.getWorkspaceSession()))
+
+      const reloaded = (await reload()).getWorkspaceSession()
+      expect(reloaded.tabsByWorktree[WORKTREE_ID]).toEqual([])
+      expect(reloaded.closedTerminalTabTombstonesByTabId?.[TAB_ID]).toEqual({
+        closedAt: expect.any(Number),
+        worktreeId: WORKTREE_ID,
+        reason
+      })
+    }
+  )
+
+  // The store keeps main's map only when a write omits it; main's own writes carry it and win.
+  it("keeps main's own record writes across later store writes", async () => {
+    const { store, runtime } = createPersistedRuntime()
+
+    await runtime.closeTerminalSurfaceFromRenderer({
+      worktreeId: WORKTREE_ID,
+      target: { kind: 'tab', tabId: TAB_ID }
+    })
+    await runtime.closeTerminalSurfaceFromRenderer({
+      worktreeId: WORKTREE_ID,
+      target: { kind: 'tab', tabId: LATE_TAB_ID }
+    })
+    store.setWorkspaceSession(rendererSave(store.getWorkspaceSession()))
+
+    expect(
+      Object.keys(store.getWorkspaceSession().closedTerminalTabTombstonesByTabId ?? {}).sort()
+    ).toEqual([LATE_TAB_ID, TAB_ID].sort())
+  })
+
+  it("keeps a close's first reason when the renderer's echo closes the same tab again", async () => {
+    const { store, runtime } = createPersistedRuntime()
+
+    await runtime.closeTerminalSurfaceFromRenderer({
+      worktreeId: WORKTREE_ID,
+      target: { kind: 'tab', tabId: LATE_TAB_ID },
+      reason: 'cleanup'
+    })
+    const first = store.getWorkspaceSession().closedTerminalTabTombstonesByTabId?.[LATE_TAB_ID]
+    await runtime.closeTerminalSurfaceFromRenderer({
+      worktreeId: WORKTREE_ID,
+      target: { kind: 'tab', tabId: LATE_TAB_ID },
+      reason: 'user'
+    })
+
+    expect(first?.reason).toBe('cleanup')
+    expect(store.getWorkspaceSession().closedTerminalTabTombstonesByTabId?.[LATE_TAB_ID]).toEqual(
+      first
+    )
+  })
+
+  it('lets a close that removes a listed tab replace a record that tab already had', async () => {
+    const earlier = Date.now() - 24 * 60 * 60 * 1000
+    const { store, runtime } = createPersistedRuntime({
+      ...makeSession(),
+      closedTerminalTabTombstonesByTabId: {
+        [TAB_ID]: { closedAt: earlier, worktreeId: WORKTREE_ID, reason: 'cleanup' }
+      }
+    })
+
+    await runtime.closeTerminalSurfaceFromRenderer({
+      worktreeId: WORKTREE_ID,
+      target: { kind: 'tab', tabId: TAB_ID },
+      reason: 'user'
+    })
+
+    const record = store.getWorkspaceSession().closedTerminalTabTombstonesByTabId?.[TAB_ID]
+    expect(store.getWorkspaceSession().tabsByWorktree[WORKTREE_ID]).toEqual([])
+    expect(record?.reason).toBe('user')
+    expect(record?.closedAt).toBeGreaterThan(earlier)
+  })
+
+  it('admits a late spawn for a tab whose close record is past the TTL', async () => {
+    const expired = {
+      [LATE_TAB_ID]: {
+        closedAt: Date.now() - CLOSED_TERMINAL_TAB_TOMBSTONE_TTL_MS - 60_000,
+        worktreeId: WORKTREE_ID,
+        reason: 'user' as const
+      }
+    }
+    const { store } = createPersistedRuntime({
+      ...makeSession(),
+      closedTerminalTabTombstonesByTabId: expired
+    })
+
+    expect(
+      await store.persistPtyBinding({
+        worktreeId: WORKTREE_ID,
+        tabId: LATE_TAB_ID,
+        leafId: LEAF_ID,
+        ptyId: 'late-pty',
+        incarnationId: 'late-incarnation'
+      })
+    ).toBe(true)
+  })
+
+  it('records nothing for a split pane close, which leaves its tab open', async () => {
+    const { store, runtime } = createPersistedRuntime()
+
+    await runtime.closeTerminalSurfaceFromRenderer({
+      worktreeId: WORKTREE_ID,
+      target: {
+        kind: 'pane',
+        tabId: 'unknown-tab',
+        leafId: LEAF_ID
+      }
+    })
+
+    expect(store.getWorkspaceSession().closedTerminalTabTombstonesByTabId).toBeUndefined()
+  })
+
+  // Why: only a resolved tab close records; a pane target never widens here, even on the last pane.
+  it("records nothing for a pane close aimed at its tab's only pane", async () => {
+    const { store, runtime } = createPersistedRuntime()
+
+    await runtime.closeTerminalSurfaceFromRenderer({
+      worktreeId: WORKTREE_ID,
+      target: {
+        kind: 'pane',
+        tabId: TAB_ID,
+        leafId: LEAF_ID
+      }
+    })
+
+    expect(store.getWorkspaceSession().closedTerminalTabTombstonesByTabId).toBeUndefined()
+    expect(store.getWorkspaceSession().tabsByWorktree[WORKTREE_ID]?.map((tab) => tab.id)).toEqual([
+      TAB_ID
+    ])
+  })
+
+  // The durable half of refusing a late graft: the close lands while the tab's spawn is in
+  // flight, so main has never listed the tab, and the spawn commits only after a relaunch.
+  it('refuses a closed tab whose spawn commits after a crash and reload', async () => {
+    const { runtime, reload } = createPersistedRuntime()
+
+    await runtime.closeTerminalSurfaceFromRenderer({
+      worktreeId: WORKTREE_ID,
+      target: { kind: 'tab', tabId: LATE_TAB_ID }
+    })
+    const relaunched = await reload()
+
+    expect(
+      await relaunched.persistPtyBinding({
+        worktreeId: WORKTREE_ID,
+        tabId: LATE_TAB_ID,
+        leafId: LEAF_ID,
+        ptyId: 'late-pty',
+        incarnationId: 'late-incarnation'
+      })
+    ).toBe(false)
+    expect(
+      relaunched.getWorkspaceSession().tabsByWorktree[WORKTREE_ID]?.map((tab) => tab.id)
+    ).not.toContain(LATE_TAB_ID)
+  })
+
+  it('refuses the graft when the close was recorded in another host partition', async () => {
+    const { store, runtime } = createPersistedRuntime()
+    store.setWorkspaceSession(
+      { ...getDefaultWorkspaceSession(), tabsByWorktree: { [SSH_WORKTREE_ID]: [] } },
+      SSH_HOST_ID
+    )
+
+    await runtime.closeTerminalSurfaceFromRenderer({
+      worktreeId: SSH_WORKTREE_ID,
+      target: {
+        kind: 'tab',
+        tabId: LATE_TAB_ID
+      }
+    })
+
+    expect(
+      store.getWorkspaceSession(SSH_HOST_ID).closedTerminalTabTombstonesByTabId?.[LATE_TAB_ID]
+    ).toBeDefined()
+    // A relay reattach binds into `local`, not the partition the close was recorded in.
+    expect(
+      await store.persistPtyBinding({
+        worktreeId: SSH_WORKTREE_ID,
+        tabId: LATE_TAB_ID,
+        leafId: LEAF_ID,
+        ptyId: 'ssh:target-1@@pty2:epoch:1',
+        incarnationId: 'relay-incarnation'
+      })
+    ).toBe(false)
+  })
+
+  it('prunes each host partition alone, so local churn evicts no SSH record', async () => {
+    const { store, runtime } = createPersistedRuntime()
+    store.setWorkspaceSession(
+      { ...getDefaultWorkspaceSession(), tabsByWorktree: { [SSH_WORKTREE_ID]: [] } },
+      SSH_HOST_ID
+    )
+    await runtime.closeTerminalSurfaceFromRenderer({
+      worktreeId: SSH_WORKTREE_ID,
+      target: {
+        kind: 'tab',
+        tabId: 'ssh-tab'
+      }
+    })
+
+    for (let index = 0; index <= MAX_CLOSED_TERMINAL_TAB_TOMBSTONES; index += 1) {
+      await runtime.closeTerminalSurfaceFromRenderer({
+        worktreeId: WORKTREE_ID,
+        target: {
+          kind: 'tab',
+          tabId: `local-${index}`
+        }
+      })
+    }
+
+    expect(
+      Object.keys(store.getWorkspaceSession().closedTerminalTabTombstonesByTabId ?? {})
+    ).toHaveLength(MAX_CLOSED_TERMINAL_TAB_TOMBSTONES)
+    expect(
+      store.getWorkspaceSession(SSH_HOST_ID).closedTerminalTabTombstonesByTabId?.['ssh-tab']
+    ).toBeDefined()
+  })
+})
diff --git a/src/main/runtime/orca-runtime-terminal-create-deduplication.ts b/src/main/runtime/orca-runtime-terminal-create-deduplication.ts
index 5e196c32c71..59e13676e63 100644
--- a/src/main/runtime/orca-runtime-terminal-create-deduplication.ts
+++ b/src/main/runtime/orca-runtime-terminal-create-deduplication.ts
@@ -146,10 +146,8 @@ export class OrcaRuntimeWithTerminalCreateDeduplication extends OrcaRuntimeWithC
     opts: { agent: TuiAgent; prompt: string; title?: string }
   ): Promise<RuntimeTerminalCreate> {
     const worktree = await this.resolveWorktreeSelector(worktreeSelector)
-    // Why: the trust write lands in an agent's config on the machine that runs it, keyed by the
-    // workspace path. `getRepo(id)` is host-blind, so reading `connectionId` off it wrote a remote
-    // path into the *client's* config — the agent on the host never sees the trust (#11163).
-    // Same shape as the folder-create trust write fixed alongside this; the agent-launch half.
+    // Why: `getRepo(id)` is host-blind; the same repo id on two hosts must build the launch for the
+    // host that owns this worktree (#11163).
     const resolution = resolveWorktreeLaunchHost(this.store?.getRepos() ?? [], worktree)
     if (resolution.kind === 'ambiguous') {
       throw new Error('worktree_execution_host_unresolved')
@@ -159,7 +157,6 @@ export class OrcaRuntimeWithTerminalCreateDeduplication extends OrcaRuntimeWithC
       throw new Error('Repository for the selected workspace is no longer available.')
     }
     const startup = this.buildStartupForAgent(repo, opts.agent, opts.prompt)
-    await this.markWorkspaceTrustedForAgent(opts.agent, resolution.connectionId, worktree.path)
     return await this.createTerminal(`id:${worktree.id}`, {
       command: startup.startup.command,
       env: startup.startup.env,
diff --git a/src/main/runtime/orca-runtime-terminal-handle-incarnation.test.ts b/src/main/runtime/orca-runtime-terminal-handle-incarnation.test.ts
index bac59e614b2..101ad7d4e4e 100644
--- a/src/main/runtime/orca-runtime-terminal-handle-incarnation.test.ts
+++ b/src/main/runtime/orca-runtime-terminal-handle-incarnation.test.ts
@@ -1,11 +1,13 @@
 import { describe, expect, it, vi } from 'vitest'
 import { OrcaRuntimeService } from './orca-runtime'
+import { makePaneKey } from '../../shared/stable-pane-id'
 
 const PTY_ID = 'ssh:target@@relay-pty'
 const WORKTREE_ID = 'repo::/worktree'
 const TAB_ID = 'tab-terminal'
 const LEAF_ID = '11111111-1111-4111-8111-111111111111'
 
+/** A runtime whose pty controller captures every write for assertion. */
 function makeRuntime(): { runtime: OrcaRuntimeService; writes: string[] } {
   const writes: string[] = []
   const runtime = new OrcaRuntimeService(null)
@@ -20,6 +22,7 @@ function makeRuntime(): { runtime: OrcaRuntimeService; writes: string[] } {
   return { runtime, writes }
 }
 
+/** Attach a window and publish a one-tab, one-leaf terminal graph. */
 function syncGraph(runtime: OrcaRuntimeService): void {
   runtime.attachWindow(1)
   runtime.syncWindowGraph(1, {
@@ -44,6 +47,7 @@ function syncGraph(runtime: OrcaRuntimeService): void {
   })
 }
 
+/** (Re)register the fixture pty leaf under the given incarnation id. */
 function register(runtime: OrcaRuntimeService, incarnationId: string): void {
   runtime.registerPty(PTY_ID, WORKTREE_ID, 'target', {
     tabId: TAB_ID,
@@ -66,6 +70,8 @@ describe('runtime terminal handle incarnation fencing', () => {
       inspectProcess
     })
     expect(runtime.markRendererReloading(1)).not.toBeNull()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
     expect((runtime as unknown as { handles: Map<string, unknown> }).handles.has(handle)).toBe(
       false
     )
@@ -89,6 +95,8 @@ describe('runtime terminal handle incarnation fencing', () => {
     })
   })
 
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
   it('treats a null-to-known incarnation as the same un-fenced PTY', async () => {
     const { runtime } = makeRuntime()
     const handle = runtime.preAllocateHandleForPty(PTY_ID)
@@ -132,6 +140,8 @@ describe('runtime terminal handle incarnation fencing', () => {
 
     // Rotate the record directly so reconcile is the only fence exercised.
     // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: test reaches the runtime's protected pty record map to bypass the registerPty fence.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
     const internals = runtime as unknown as {
       ptysById: Map<string, { incarnationId: string | null }>
     }
@@ -159,12 +169,16 @@ describe('runtime terminal handle incarnation fencing', () => {
     })
     expect(replacement?.handle).not.toBe(staleHandle)
     await expect(runtime.readTerminal(staleHandle)).rejects.toThrow('terminal_handle_stale')
-    await expect(runtime.sendTerminal(staleHandle, { text: 'stale input' })).rejects.toThrow(
-      'terminal_handle_stale'
-    )
+    await expect(
+      runtime.sendTerminal(staleHandle, { text: 'stale input' }, { inputKind: 'driving' })
+    ).rejects.toThrow('terminal_handle_stale')
 
     await expect(
-      runtime.sendTerminal(replacement!.handle, { text: 'replacement input' })
+      runtime.sendTerminal(
+        replacement!.handle,
+        { text: 'replacement input' },
+        { inputKind: 'driving' }
+      )
     ).resolves.toMatchObject({
       accepted: true,
       handle: replacement!.handle
@@ -215,6 +229,8 @@ describe('runtime terminal handle incarnation fencing', () => {
     runtime.registerPreAllocatedHandleForPty(PTY_ID, replacementHandle)
     syncGraph(runtime)
 
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
     const internals = runtime as unknown as {
       handles: Map<string, unknown>
       handleByLeafKey: Map<string, string>
@@ -237,3 +253,130 @@ describe('runtime terminal handle incarnation fencing', () => {
     })
   })
 })
+
+describe('resolveTerminalHandleByProcessIncarnation direct fencing', () => {
+  const LOCAL_SCOPE = JSON.stringify({ kind: 'local', hostId: 'local' })
+  // PTY_ID ('ssh:target@@relay-pty') derives connectionId 'target' via parseAppSshPtyId, so its
+  // host scope is ssh:target rather than local.
+  const SSH_TARGET_SCOPE = JSON.stringify({ kind: 'ssh', targetId: 'target' })
+
+  /** Register a pty leaf directly, optionally under a connection and incarnation. */
+  function seedPty(
+    runtime: OrcaRuntimeService,
+    ptyId: string,
+    incarnationId: string | null,
+    connectionId: string | null = null
+  ): void {
+    runtime.registerPty(ptyId, WORKTREE_ID, connectionId, {
+      tabId: TAB_ID,
+      leafId: LEAF_ID,
+      ...(incarnationId ? { incarnationId } : {})
+    })
+  }
+
+  function resolve(
+    runtime: OrcaRuntimeService,
+    processIncarnation: string,
+    serializedHostScope: string | null
+  ): string | null {
+    return runtime.resolveTerminalHandleByProcessIncarnation(
+      processIncarnation,
+      serializedHostScope
+    )
+  }
+
+  it('mints a live handle for a pty whose exact incarnation and host scope match', () => {
+    const { runtime } = makeRuntime()
+    seedPty(runtime, PTY_ID, 'incarnation-1')
+    const handle = resolve(runtime, `${PTY_ID}:incarnation-1`, SSH_TARGET_SCOPE)
+    expect(handle).toMatch(/^term_/)
+    // Re-minting the same live pty is idempotent.
+    expect(resolve(runtime, `${PTY_ID}:incarnation-1`, SSH_TARGET_SCOPE)).toBe(handle)
+  })
+
+  it('returns null when the recorded incarnationId no longer matches the live pty', () => {
+    const { runtime } = makeRuntime()
+    seedPty(runtime, PTY_ID, 'incarnation-1')
+    expect(resolve(runtime, `${PTY_ID}:incarnation-2`, LOCAL_SCOPE)).toBeNull()
+  })
+
+  it('returns null when the live pty has no incarnationId (legacy runtimeId:ptyId:gen never reaps)', () => {
+    const { runtime } = makeRuntime()
+    seedPty(runtime, PTY_ID, null)
+    // A modern-shaped probe cannot match a pty that carries no incarnationId...
+    expect(resolve(runtime, `${PTY_ID}:incarnation-1`, LOCAL_SCOPE)).toBeNull()
+    // ...and the legacy `${runtimeId}:${ptyId}:${ptyGeneration}` shape stays fail-closed rather
+    // than reap on a ptyGeneration guess.
+    expect(resolve(runtime, `runtime_test:${PTY_ID}:0`, LOCAL_SCOPE)).toBeNull()
+  })
+
+  it('returns null when the host scope does not match', () => {
+    const { runtime } = makeRuntime()
+    seedPty(runtime, PTY_ID, 'incarnation-1')
+    expect(
+      resolve(runtime, `${PTY_ID}:incarnation-1`, JSON.stringify({ kind: 'ssh', targetId: 'nope' }))
+    ).toBeNull()
+  })
+
+  it('returns null when no host scope is supplied (fails closed)', () => {
+    const { runtime } = makeRuntime()
+    seedPty(runtime, PTY_ID, 'incarnation-1')
+    expect(resolve(runtime, `${PTY_ID}:incarnation-1`, null)).toBeNull()
+  })
+
+  it('resolves a colon-bearing SSH/relay incarnationId that lastIndexOf would mis-split', () => {
+    const { runtime } = makeRuntime()
+    // PTY_ID already carries ':' and '@@'; the incarnationId itself also carries colons.
+    seedPty(runtime, PTY_ID, 'relay:conn-3:incarnation-9', 'target')
+    const handle = resolve(
+      runtime,
+      `${PTY_ID}:relay:conn-3:incarnation-9`,
+      JSON.stringify({ kind: 'ssh', targetId: 'target' })
+    )
+    expect(handle).toMatch(/^term_/)
+  })
+
+  it('resolves a Windows repo::C:\\path@@1 ptyId', () => {
+    const { runtime } = makeRuntime()
+    const windowsPtyId = 'repo::C:\\path@@1'
+    seedPty(runtime, windowsPtyId, 'incarnation-win')
+    const handle = resolve(runtime, `${windowsPtyId}:incarnation-win`, LOCAL_SCOPE)
+    expect(handle).toMatch(/^term_/)
+  })
+
+  it('keeps scanning past a colon-ambiguous decoy in another host scope to the genuine match', () => {
+    const { runtime } = makeRuntime()
+    // One process-incarnation string, two colon-ambiguous pty ids that both satisfy the exact
+    // matcher: 'relay' + 'conn:incarnation-1' AND 'relay:conn' + 'incarnation-1' both stringify to
+    // 'relay:conn:incarnation-1'. The decoy is registered FIRST and lives in a different host scope
+    // (ssh:decoy); the genuine pty is local and registered later.
+    const processIncarnation = 'relay:conn:incarnation-1'
+    const DECOY_TAB_ID = 'tab-decoy'
+    const DECOY_LEAF_ID = '22222222-2222-4222-8222-222222222222'
+    const GENUINE_TAB_ID = 'tab-genuine'
+    const GENUINE_LEAF_ID = '33333333-3333-4333-8333-333333333333'
+    runtime.registerPty('relay', WORKTREE_ID, 'decoy', {
+      tabId: DECOY_TAB_ID,
+      leafId: DECOY_LEAF_ID,
+      incarnationId: 'conn:incarnation-1'
+    })
+    runtime.registerPty('relay:conn', WORKTREE_ID, null, {
+      tabId: GENUINE_TAB_ID,
+      leafId: GENUINE_LEAF_ID,
+      incarnationId: 'incarnation-1'
+    })
+
+    // Before the fix, the earlier decoy's host-scope mismatch returned null and suppressed the
+    // genuine same-scope pty entirely. `continue` lets the scan reach it.
+    const handle = resolve(runtime, processIncarnation, LOCAL_SCOPE)
+    expect(handle).toMatch(/^term_/)
+    // getTerminalProcessIncarnation cannot separate the two (both stringify to
+    // 'relay:conn:incarnation-1'), so pin the remint to the GENUINE pane. The paneKey is the only
+    // terminal-specific observable that distinguishes the genuine leaf from the same-incarnation
+    // decoy; this fails if the resolver ever mints the decoy's handle instead of the genuine pty's.
+    const genuinePaneKey = makePaneKey(GENUINE_TAB_ID, GENUINE_LEAF_ID)
+    const decoyPaneKey = makePaneKey(DECOY_TAB_ID, DECOY_LEAF_ID)
+    expect(runtime.getTerminalPaneKey(handle!)).toBe(genuinePaneKey)
+    expect(runtime.getTerminalPaneKey(handle!)).not.toBe(decoyPaneKey)
+  })
+})
diff --git a/src/main/runtime/orca-runtime-terminal-retirement-host-partition.test.ts b/src/main/runtime/orca-runtime-terminal-retirement-host-partition.test.ts
index 3079ce1f4da..3a91794f441 100644
--- a/src/main/runtime/orca-runtime-terminal-retirement-host-partition.test.ts
+++ b/src/main/runtime/orca-runtime-terminal-retirement-host-partition.test.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import { getDefaultWorkspaceSession } from '../../shared/constants'
 import { LOCAL_EXECUTION_HOST_ID, type ExecutionHostId } from '../../shared/execution-host'
@@ -123,7 +124,8 @@ function partitionedStore(): PartitionedStoreHarness {
   ])
   const writes: { hostId: ExecutionHostId | undefined; session: WorkspaceSessionState }[] = []
   const reads: (ExecutionHostId | undefined)[] = []
-  const store = {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This runtime fixture supplies the persistence and graph methods exercised by the test.
+  const store = withDurableRuntimeStore({
     getRepos: () => [SSH_REPO],
     getRepo: (id: string) => (id === SSH_REPO_ID ? SSH_REPO : undefined),
     getWorkspaceSessionHostIds: () => [...sessions.keys()],
@@ -136,7 +138,7 @@ function partitionedStore(): PartitionedStoreHarness {
       sessions.set(hostId ?? LOCAL_EXECUTION_HOST_ID, session)
     },
     flushOrThrow: vi.fn()
-  } as never
+  }) as never
   return { store, sessions, writes, reads }
 }
 
@@ -210,7 +212,8 @@ describe('OrcaRuntimeService terminal retirement host partitioning (STA-3463)',
         }
       ]
     ])
-    const store = {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This runtime fixture supplies the persistence and graph methods exercised by the test.
+    const store = withDurableRuntimeStore({
       getRepos: () => [{ ...SSH_REPO, executionHostId: staleHostId }],
       getRepo: () => ({ ...SSH_REPO, executionHostId: staleHostId }),
       getWorktreeMeta: () => undefined,
@@ -221,7 +224,7 @@ describe('OrcaRuntimeService terminal retirement host partitioning (STA-3463)',
       setWorkspaceSession: (session: WorkspaceSessionState, hostId?: ExecutionHostId) =>
         sessions.set(hostId ?? LOCAL_EXECUTION_HOST_ID, session),
       flushOrThrow: vi.fn()
-    } as never
+    }) as never
     const runtime = new OrcaRuntimeService(store)
     runtime.setPtyController({
       write: () => true,
@@ -285,7 +288,8 @@ describe('OrcaRuntimeService terminal retirement host partitioning (STA-3463)',
       // The SSH copy of the same `repoId::path` currently has no terminals.
       [SSH_HOST_ID, { ...getDefaultWorkspaceSession(), tabsByWorktree: { [SSH_WORKTREE_ID]: [] } }]
     ])
-    const store = {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This runtime fixture supplies the persistence and graph methods exercised by the test.
+    const store = withDurableRuntimeStore({
       getRepos: () => [SSH_REPO],
       getRepo: (id: string) => (id === SSH_REPO_ID ? SSH_REPO : undefined),
       getWorktreeMeta: () => ({ hostId: SSH_HOST_ID }),
@@ -298,7 +302,7 @@ describe('OrcaRuntimeService terminal retirement host partitioning (STA-3463)',
         sessions.set(hostId ?? LOCAL_EXECUTION_HOST_ID, session),
       flushOrThrow: vi.fn(),
       persistPtyBinding: vi.fn()
-    } as never
+    }) as never
     const runtime = new OrcaRuntimeService(store)
     const stopAndWait = vi.fn(async () => true)
     runtime.setPtyController({
@@ -334,7 +338,8 @@ describe('OrcaRuntimeService terminal retirement host partitioning (STA-3463)',
       ],
       [staleHostId, { ...getDefaultWorkspaceSession(), tabsByWorktree: { [SSH_WORKTREE_ID]: [] } }]
     ])
-    const store = {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This runtime fixture supplies the persistence and graph methods exercised by the test.
+    const store = withDurableRuntimeStore({
       getRepos: () => [{ ...SSH_REPO, executionHostId: staleHostId }],
       getRepo: () => ({ ...SSH_REPO, executionHostId: staleHostId }),
       getWorktreeMeta: () => ({}),
@@ -347,7 +352,7 @@ describe('OrcaRuntimeService terminal retirement host partitioning (STA-3463)',
         sessions.set(hostId ?? LOCAL_EXECUTION_HOST_ID, session),
       flushOrThrow: vi.fn(),
       persistPtyBinding: vi.fn()
-    } as never
+    }) as never
     const runtime = new OrcaRuntimeService(store)
     runtime.setPtyController({
       write: () => true,
@@ -408,6 +413,62 @@ describe('OrcaRuntimeService terminal retirement host partitioning (STA-3463)',
     expect(targets.get(folderWorktreeId)).toBe(localSession)
   })
 
+  it.each<[string, string, Record<string, unknown>, ExecutionHostId]>([
+    ['local repo', 'repo::/wt', { id: 'repo' }, LOCAL_EXECUTION_HOST_ID],
+    ['SSH repo', 'repo::/wt', { id: 'repo', connectionId: 'c1' }, 'ssh:c1'],
+    ['runtime repo', 'repo::/wt', { id: 'repo', executionHostId: 'runtime:e1' }, 'runtime:e1'],
+    ['local folder', 'folder:f1', { folderId: 'f1' }, LOCAL_EXECUTION_HOST_ID],
+    ['SSH folder', 'folder:f1', { folderId: 'f1', connectionId: 'c1' }, 'ssh:c1'],
+    ['explicit SSH folder', 'folder:f1', { folderId: 'f1', executionHostId: 'ssh:c2' }, 'ssh:c2'],
+    ['runtime folder', 'folder:f1', { folderId: 'f1', executionHostId: 'runtime:e1' }, 'runtime:e1']
+  ])('reads a %s own saved partition', (_label, worktreeId, owner, ownerHostId) => {
+    const listing = (id: string) => ({
+      ...getDefaultWorkspaceSession(),
+      tabsByWorktree: {
+        [worktreeId]: [
+          {
+            id,
+            ptyId: null,
+            worktreeId,
+            title: id,
+            customTitle: null,
+            color: null,
+            sortOrder: 0,
+            createdAt: 1
+          }
+        ]
+      }
+    })
+    const sessions = new Map<ExecutionHostId, WorkspaceSessionState>([
+      [ownerHostId, listing('own')],
+      ['runtime:e0', listing('rotated')]
+    ])
+    const { folderId, ...repoOrFolder } = owner
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the controller reads only repos, folder workspaces and workspace sessions.
+    const store = {
+      getRepos: () => (folderId ? [] : [repoOrFolder]),
+      getRepo: () => (folderId ? undefined : repoOrFolder),
+      getFolderWorkspaces: () => (folderId ? [{ ...repoOrFolder, id: folderId }] : []),
+      getWorkspaceSessionHostIds: () => [...sessions.keys()],
+      getWorkspaceSession: (hostId: ExecutionHostId) =>
+        sessions.get(hostId) ?? getDefaultWorkspaceSession()
+    } as never
+    const controller = new RuntimeWorkspaceSessionController({
+      getStore: () => store,
+      resolveFolderConnectionId: (workspace) => workspace.connectionId ?? null,
+      hasRuntimeOwnedPtyCandidate: () => false
+    })
+
+    expect(controller.getOwnPartition(worktreeId)).toBe(sessions.get(ownerHostId))
+    expect(controller.get(worktreeId)).toBe(sessions.get(ownerHostId))
+
+    sessions.set(ownerHostId, getDefaultWorkspaceSession())
+    const fellBack = controller.get(worktreeId) === sessions.get('runtime:e0')
+    // Only a runtime owner rotates onto another copy; that copy is never read as its own.
+    expect(fellBack).toBe(ownerHostId.startsWith('runtime:'))
+    expect(controller.getOwnPartition(worktreeId)?.tabsByWorktree[worktreeId]).toBeUndefined()
+  })
+
   it('waits for provider retirement on a direct worktree stop', async () => {
     const harness = partitionedStore()
     const runtime = new OrcaRuntimeService(harness.store)
@@ -491,7 +552,7 @@ describe('OrcaRuntimeService terminal retirement host partitioning (STA-3463)',
       incarnationId: 'incarnation-a'
     })
 
-    runtime.onPtyExit(SSH_PTY_LEFT, 0, 'incarnation-a')
+    await runtime.onPtyExit(SSH_PTY_LEFT, 0, 'incarnation-a')
 
     // The durable retirement must land in the pane's own host partition.
     expect(harness.writes.map((write) => write.hostId)).toEqual([SSH_HOST_ID])
@@ -624,7 +685,7 @@ describe('OrcaRuntimeService terminal retirement host partitioning (STA-3463)',
       incarnationId: 'incarnation-a'
     })
 
-    runtime.onPtyExit('pty-left', 0, 'incarnation-a')
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-a')
 
     expect(harness.writes.map((write) => write.hostId ?? LOCAL_EXECUTION_HOST_ID)).toEqual([
       LOCAL_EXECUTION_HOST_ID
diff --git a/src/main/runtime/orca-runtime-terminal-retirement.test.ts b/src/main/runtime/orca-runtime-terminal-retirement.test.ts
index e1a2c68242c..d6f70fd4c6e 100644
--- a/src/main/runtime/orca-runtime-terminal-retirement.test.ts
+++ b/src/main/runtime/orca-runtime-terminal-retirement.test.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import { getDefaultWorkspaceSession } from '../../shared/constants'
 import { LOCAL_EXECUTION_HOST_ID } from '../../shared/execution-host'
@@ -148,7 +149,7 @@ function makePersistedSplitSession(): WorkspaceSessionState {
 }
 
 describe('OrcaRuntimeService terminal surface retirement', () => {
-  it('releases each early-exit fence after its matching registration is rejected', () => {
+  it('releases each early-exit fence after its matching registration is rejected', async () => {
     const runtime = new OrcaRuntimeService()
     const internals = runtime as unknown as {
       earlyExitedPtyIncarnations: Map<string, string | null>
@@ -158,7 +159,7 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
       const ptyId = `pty-early-${index}`
       const incarnationId = `incarnation-${index}`
       runtime.beginPtyRegistration(ptyId, incarnationId)
-      runtime.onPtyExit(ptyId, 0, incarnationId)
+      await runtime.onPtyExit(ptyId, 0, incarnationId)
       expect(() => runtime.assertPtyRegistrationAllowed(ptyId, incarnationId)).toThrow(
         'agent_session_exited_during_start'
       )
@@ -168,7 +169,7 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
     expect(internals.earlyExitedPtyIncarnations.size).toBe(0)
   })
 
-  it('does not retain fences for completed surface-less lifecycles', () => {
+  it('does not retain fences for completed surface-less lifecycles', async () => {
     const runtime = new OrcaRuntimeService()
     const internals = runtime as unknown as {
       earlyExitedPtyIncarnations: Map<string, string | null>
@@ -179,14 +180,14 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
       runtime.onPtySpawned(`pty-headless-${index}`, `incarnation-${index}`, {
         awaitsRegistration: false
       })
-      runtime.onPtyExit(`pty-headless-${index}`, 0, `incarnation-${index}`)
+      await runtime.onPtyExit(`pty-headless-${index}`, 0, `incarnation-${index}`)
     }
 
     expect(internals.earlyExitedPtyIncarnations.size).toBe(0)
     expect(internals.pendingPtyRegistrationIncarnations.size).toBe(0)
   })
 
-  it('fences an early-exited replacement even when its pane already exists', () => {
+  it('fences an early-exited replacement even when its pane already exists', async () => {
     const runtime = new OrcaRuntimeService()
     runtime.attachWindow(1)
     syncSplit(runtime)
@@ -197,7 +198,7 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
     })
 
     runtime.onPtySpawned('pty-left', 'incarnation-replacement')
-    runtime.onPtyExit('pty-left', 0, 'incarnation-replacement')
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-replacement')
 
     expect(() =>
       runtime.assertPtyRegistrationAllowed('pty-left', 'incarnation-replacement')
@@ -224,7 +225,7 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
         ? leftBeforeExit.terminal
         : null
 
-    runtime.onPtyExit('pty-left', 0)
+    await runtime.onPtyExit('pty-left', 0)
 
     expect(await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)).toMatchObject({
       activeTabId: 'tab::right',
@@ -467,16 +468,18 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
       sleepingAgentSessionsByPaneKey: { 'tab:left': {} as never }
     }
     const runtime = new OrcaRuntimeService(
-      runtimeStore({
-        getWorkspaceSession: () => session,
-        setWorkspaceSession: vi.fn(),
-        flushOrThrow: vi.fn()
-      })
+      runtimeStore(
+        withDurableRuntimeStore({
+          getWorkspaceSession: () => session,
+          setWorkspaceSession: vi.fn(),
+          flushOrThrow: vi.fn()
+        })
+      )
     )
     runtime.attachWindow(1)
     syncSplit(runtime)
 
-    runtime.onPtyExit('pty-left', 0)
+    await runtime.onPtyExit('pty-left', 0)
 
     const result = await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)
     expect(result.tabs.find((tab) => tab.id === 'tab::left')).toBeUndefined()
@@ -506,7 +509,7 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
       incarnationId: 'incarnation-b'
     })
 
-    runtime.onPtyExit('pty-left', 0, 'incarnation-a')
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-a')
 
     expect((await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)).tabs).toEqual([
       expect.objectContaining({ id: 'tab::left', status: 'ready' }),
@@ -519,11 +522,13 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
     const session = makePersistedSplitSession()
     const setWorkspaceSession = vi.fn()
     const runtime = new OrcaRuntimeService(
-      runtimeStore({
-        getWorkspaceSession: () => session,
-        setWorkspaceSession,
-        flushOrThrow: vi.fn()
-      })
+      runtimeStore(
+        withDurableRuntimeStore({
+          getWorkspaceSession: () => session,
+          setWorkspaceSession,
+          flushOrThrow: vi.fn()
+        })
+      )
     )
     runtime.attachWindow(1)
     syncSplit(runtime)
@@ -534,7 +539,7 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
     })
 
     runtime.acceptPtyIncarnationForExit('pty-left', 'incarnation-after-reconnect')
-    runtime.onPtyExit('pty-left', 0, 'incarnation-after-reconnect')
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-after-reconnect')
 
     expect((await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)).tabs).toEqual([
       expect.objectContaining({ id: 'tab::right', status: 'ready' })
@@ -567,11 +572,13 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
       session = next
     })
     const runtime = new OrcaRuntimeService(
-      runtimeStore({
-        getWorkspaceSession: () => session,
-        setWorkspaceSession,
-        flushOrThrow: vi.fn()
-      })
+      runtimeStore(
+        withDurableRuntimeStore({
+          getWorkspaceSession: () => session,
+          setWorkspaceSession,
+          flushOrThrow: vi.fn()
+        })
+      )
     )
     runtime.attachWindow(1)
     const snapshot = makeSplitSnapshot()
@@ -601,7 +608,7 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
     const published: RuntimeMobileSessionTabsResult[] = []
     const unsubscribe = runtime.onMobileSessionTabsChanged((event) => published.push(event))
 
-    runtime.onPtyExit('pty-shared', 0, 'incarnation-exiting')
+    await runtime.onPtyExit('pty-shared', 0, 'incarnation-exiting')
 
     expect(session.terminalLayoutsByTabId.tab).toMatchObject({
       root: { type: 'leaf', leafId: 'right' },
@@ -626,16 +633,18 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
     unsubscribe()
   })
 
-  it('de-persists an exact surface even when there is no mobile snapshot', () => {
+  it('de-persists an exact surface even when there is no mobile snapshot', async () => {
     const session = makePersistedSplitSession()
     const setWorkspaceSession = vi.fn()
     const flushOrThrow = vi.fn()
     const runtime = new OrcaRuntimeService(
-      runtimeStore({
-        getWorkspaceSession: () => session,
-        setWorkspaceSession,
-        flushOrThrow
-      })
+      runtimeStore(
+        withDurableRuntimeStore({
+          getWorkspaceSession: () => session,
+          setWorkspaceSession,
+          flushOrThrow
+        })
+      )
     )
     runtime.attachWindow(1)
     runtime.syncWindowGraph(1, {
@@ -664,7 +673,7 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
       incarnationId: 'incarnation-a'
     })
 
-    runtime.onPtyExit('pty-left', 0, 'incarnation-a')
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-a')
 
     expect(setWorkspaceSession).toHaveBeenCalledWith(
       expect.objectContaining({
@@ -682,17 +691,19 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
     expect(flushOrThrow).toHaveBeenCalledOnce()
   })
 
-  it('does not publish absence when the durable retirement flush fails', async () => {
+  it('publishes absence and reports when the durable retirement flush fails', async () => {
     const session = makePersistedSplitSession()
     const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined)
     const runtime = new OrcaRuntimeService(
-      runtimeStore({
-        getWorkspaceSession: () => session,
-        setWorkspaceSession: vi.fn(),
-        flushOrThrow: vi.fn(() => {
-          throw new Error('disk unavailable')
+      runtimeStore(
+        withDurableRuntimeStore({
+          getWorkspaceSession: () => session,
+          setWorkspaceSession: vi.fn(),
+          flushOrThrow: vi.fn(() => {
+            throw new Error('disk unavailable')
+          })
         })
-      })
+      )
     )
     runtime.attachWindow(1)
     syncSplit(runtime)
@@ -704,35 +715,37 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
     const events: unknown[] = []
     const unsubscribe = runtime.onMobileSessionTabsChanged((event) => events.push(event))
 
-    runtime.onPtyExit('pty-left', 0, 'incarnation-a')
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-a')
 
+    // Why: the process is gone either way; a failed write is reported, not reinstated.
     expect((await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)).tabs).toEqual([
-      expect.objectContaining({ id: 'tab::left' }),
       expect.objectContaining({ id: 'tab::right' })
     ])
-    expect(events).toEqual([])
+    expect(events).not.toEqual([])
     expect(errorSpy).toHaveBeenCalledWith(
-      '[runtime] failed to persist terminal retirement:',
+      '[runtime] terminal retirement is not yet durable:',
       expect.any(Error)
     )
     unsubscribe()
     errorSpy.mockRestore()
   })
 
-  it('rolls back an in-memory retirement when the durable flush fails', async () => {
+  it('keeps the in-memory retirement when the durable flush fails', async () => {
     let session = makePersistedSplitSession()
     const original = structuredClone(session)
     const setWorkspaceSession = vi.fn((next: WorkspaceSessionState) => {
       session = next
     })
     const runtime = new OrcaRuntimeService(
-      runtimeStore({
-        getWorkspaceSession: () => session,
-        setWorkspaceSession,
-        flushOrThrow: vi.fn(() => {
-          throw new Error('disk unavailable')
+      runtimeStore(
+        withDurableRuntimeStore({
+          getWorkspaceSession: () => session,
+          setWorkspaceSession,
+          flushOrThrow: vi.fn(() => {
+            throw new Error('disk unavailable')
+          })
         })
-      })
+      )
     )
     runtime.attachWindow(1)
     syncSplit(runtime)
@@ -742,10 +755,14 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
       incarnationId: 'incarnation-a'
     })
 
-    runtime.onPtyExit('pty-left', 0, 'incarnation-a')
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined)
 
-    expect(session).toEqual(original)
-    expect(setWorkspaceSession).toHaveBeenLastCalledWith(original, LOCAL_EXECUTION_HOST_ID)
-    expect(setWorkspaceSession).toHaveBeenCalledTimes(2)
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-a')
+
+    // Why: the next profile write carries the staged retirement; nothing may reinstate the leaf.
+    expect(session).not.toEqual(original)
+    expect(session.terminalLayoutsByTabId.tab?.ptyIdsByLeafId).toEqual({ right: 'pty-right' })
+    expect(setWorkspaceSession).toHaveBeenCalledOnce()
+    errorSpy.mockRestore()
   })
 })
diff --git a/src/main/runtime/orca-runtime-terminal-split-authority.test.ts b/src/main/runtime/orca-runtime-terminal-split-authority.test.ts
index 9da61e59072..8369a219331 100644
--- a/src/main/runtime/orca-runtime-terminal-split-authority.test.ts
+++ b/src/main/runtime/orca-runtime-terminal-split-authority.test.ts
@@ -78,6 +78,7 @@ function createHarness(
     deferSpawn?: boolean
     includePairedSnapshot?: boolean
     rendererMounted?: boolean
+    rendererPtyId?: string | null
     graphOnlySource?: boolean
     sourceIncarnationId?: string
     stopAndWaitResult?: boolean
@@ -169,7 +170,7 @@ function createHarness(
               worktreeId: WORKTREE_ID,
               leafId: SOURCE_LEAF_ID,
               paneRuntimeId: 1,
-              ptyId: SOURCE_PTY_ID
+              ptyId: options.rendererPtyId === undefined ? SOURCE_PTY_ID : options.rendererPtyId
             }
           ]
         : [],
@@ -283,6 +284,19 @@ describe('remote runtime terminal split authority', () => {
     })
   })
 
+  it('reveals a persisted split while its mounted source is still publishing its PTY binding', async () => {
+    const harness = createHarness(true, { rendererMounted: true, rendererPtyId: null })
+    await harness.runtime.splitTerminal(harness.handle, { direction: 'vertical' })
+    expect(harness.revealTerminalSession).toHaveBeenCalledOnce()
+    expect(harness.getSession().terminalLayoutsByTabId[TAB_ID]?.root?.type).toBe('split')
+  })
+
+  it('does not reveal a persisted split into a renderer bound to a different PTY', async () => {
+    const harness = createHarness(true, { rendererMounted: true, rendererPtyId: 'replacement' })
+    await harness.runtime.splitTerminal(harness.handle, { direction: 'vertical' })
+    expect(harness.revealTerminalSession).not.toHaveBeenCalled()
+  })
+
   it('splits a persisted tab without consulting an unmounted host renderer', async () => {
     const harness = createHarness()
 
diff --git a/src/main/runtime/orca-runtime-terminal-surface-close.test.ts b/src/main/runtime/orca-runtime-terminal-surface-close.test.ts
new file mode 100644
index 00000000000..c9bd30b7199
--- /dev/null
+++ b/src/main/runtime/orca-runtime-terminal-surface-close.test.ts
@@ -0,0 +1,353 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { makePaneKey } from '../../shared/stable-pane-id'
+import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
+import { Store } from '../persistence/loading-store/store'
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
+import { OrcaRuntimeService } from './orca-runtime'
+import {
+  LEAF_ID,
+  PTY_ID,
+  REPO_ID,
+  SIBLING_LEAF_ID,
+  SIBLING_PTY_ID,
+  TAB_ID,
+  WORKTREE_ID,
+  WORKTREE_PATH,
+  createHarness,
+  makeSession
+} from './__fixtures__/orca-runtime-terminal-close-continuity-fixtures'
+import {
+  retireTerminalSurfaceFromPersistence,
+  sanitizeWorkspaceSessionTerminalRetirements
+} from './mobile-session-terminal-persistence-retirement'
+import { advanceTerminalTopologyRevision } from './workspace-session-terminal-membership-authority'
+
+const splitLayout = {
+  root: {
+    type: 'split' as const,
+    direction: 'horizontal' as const,
+    first: { type: 'leaf' as const, leafId: LEAF_ID },
+    second: { type: 'leaf' as const, leafId: SIBLING_LEAF_ID }
+  },
+  activeLeafId: LEAF_ID,
+  expandedLeafId: null,
+  ptyIdsByLeafId: { [LEAF_ID]: PTY_ID, [SIBLING_LEAF_ID]: SIBLING_PTY_ID }
+}
+
+function splitSession(): WorkspaceSessionState {
+  return { ...makeSession(), terminalLayoutsByTabId: { [TAB_ID]: splitLayout } }
+}
+
+function splitSessionAfterExitRetired(): WorkspaceSessionState {
+  return retireTerminalSurfaceFromPersistence(splitSession(), {
+    worktreeId: WORKTREE_ID,
+    parentTabId: TAB_ID,
+    leafId: LEAF_ID,
+    ptyId: PTY_ID
+  })
+}
+
+function withPinnedTab(session: WorkspaceSessionState): WorkspaceSessionState {
+  return {
+    ...session,
+    tabsByWorktree: {
+      [WORKTREE_ID]: (session.tabsByWorktree[WORKTREE_ID] ?? []).map((tab) => ({
+        ...tab,
+        isPinned: true
+      }))
+    }
+  }
+}
+
+const directories: string[] = []
+afterEach(async () => {
+  await closeTestStores()
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+/** A real store whose repo already has host-authoritative membership, as any repo with an exit does. */
+function createPersistedRuntime(session: WorkspaceSessionState) {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-surface-close-'))
+  directories.push(directory)
+  const dataFile = join(directory, 'orca-data.json')
+  const store = createSqliteTestStore(Store, { dataFile })
+  store.addRepo({
+    id: REPO_ID,
+    path: WORKTREE_PATH,
+    displayName: 'Fixture',
+    badgeColor: 'gray',
+    addedAt: 1
+  })
+  store.setWorkspaceSession(advanceTerminalTopologyRevision(session, WORKTREE_ID))
+  store.flushOrThrow()
+  return {
+    store,
+    runtime: new OrcaRuntimeService(store),
+    reload: async () => {
+      store.flush()
+      store.freezeWrites()
+      await store.waitForPendingWrite()
+      return createSqliteTestStore(Store, { dataFile }).getWorkspaceSession()
+    }
+  }
+}
+
+/** What a renderer save carries after its own close: membership without the closed surface. */
+function rendererSaveWithout(
+  session: WorkspaceSessionState,
+  leafId?: string
+): WorkspaceSessionState {
+  const { terminalTopologyRevisionByRepoId: _hostPrivate, ...rendererView } = session
+  if (!leafId) {
+    return { ...rendererView, tabsByWorktree: { [WORKTREE_ID]: [] }, terminalLayoutsByTabId: {} }
+  }
+  return {
+    ...rendererView,
+    terminalLayoutsByTabId: {
+      [TAB_ID]: {
+        root: { type: 'leaf', leafId: SIBLING_LEAF_ID },
+        activeLeafId: SIBLING_LEAF_ID,
+        expandedLeafId: null,
+        ptyIdsByLeafId: { [SIBLING_LEAF_ID]: SIBLING_PTY_ID }
+      }
+    }
+  }
+}
+
+describe('renderer close intents', () => {
+  it('keeps a closed tab closed across a renderer save and a reload', async () => {
+    const { store, runtime, reload } = createPersistedRuntime(makeSession())
+
+    await runtime.closeTerminalSurfaceFromRenderer({
+      worktreeId: WORKTREE_ID,
+      target: { kind: 'tab', tabId: TAB_ID }
+    })
+    store.setWorkspaceSession(rendererSaveWithout(store.getWorkspaceSession()))
+
+    expect((await reload()).tabsByWorktree[WORKTREE_ID]).toEqual([])
+  })
+
+  it('keeps a closed split pane closed across a renderer save and a reload', async () => {
+    const { store, runtime, reload } = createPersistedRuntime(splitSession())
+
+    await runtime.closeTerminalSurfaceFromRenderer({
+      worktreeId: WORKTREE_ID,
+      target: {
+        kind: 'pane',
+        tabId: TAB_ID,
+        leafId: LEAF_ID
+      }
+    })
+    store.setWorkspaceSession(rendererSaveWithout(store.getWorkspaceSession(), LEAF_ID))
+
+    const reloaded = await reload()
+    expect(reloaded.tabsByWorktree[WORKTREE_ID]).toEqual([expect.objectContaining({ id: TAB_ID })])
+    expect(reloaded.terminalLayoutsByTabId[TAB_ID]?.root).toEqual({
+      type: 'leaf',
+      leafId: SIBLING_LEAF_ID
+    })
+    expect(reloaded.terminalPtyIncarnationsByPaneKey?.[makePaneKey(TAB_ID, LEAF_ID)]).toBe(
+      undefined
+    )
+  })
+
+  // e.g. the exited-pane overlay's Close, after main's exit handling already retired that leaf.
+  it.each([
+    ['its exit already retired the pane', () => splitSessionAfterExitRetired()],
+    ['the tab is pinned', () => withPinnedTab(splitSessionAfterExitRetired())],
+    ['the tab has no saved layout', () => ({ ...makeSession(), terminalLayoutsByTabId: {} })]
+  ])('never widens a pane close into a tab close when %s', async (_case, session) => {
+    const { runtime, reload } = createPersistedRuntime(session())
+
+    await runtime.closeTerminalSurfaceFromRenderer({
+      worktreeId: WORKTREE_ID,
+      target: {
+        kind: 'pane',
+        tabId: TAB_ID,
+        leafId: LEAF_ID
+      }
+    })
+
+    expect((await reload()).tabsByWorktree[WORKTREE_ID]).toEqual([
+      expect.objectContaining({ id: TAB_ID })
+    ])
+  })
+})
+
+describe('CLI close of one pane in a split tab', () => {
+  it('commits the pane removal without waiting for its process exit', async () => {
+    const harness = createHarness()
+    harness.syncSplitFixtureGraph()
+    // A verified stop that never reports an exit: membership must not ride on one.
+    harness.setVerifiedStopResult(true)
+    const terminal = (await harness.runtime.listTerminals(`id:${WORKTREE_ID}`)).terminals.find(
+      (candidate) => candidate.ptyId === PTY_ID
+    )!
+
+    await expect(harness.runtime.closeTerminal(terminal.handle)).resolves.toMatchObject({
+      tabId: TAB_ID,
+      ptyKilled: true
+    })
+
+    const session = harness.getSession()
+    expect(session.tabsByWorktree[WORKTREE_ID]).toEqual([expect.objectContaining({ id: TAB_ID })])
+    expect(session.terminalLayoutsByTabId[TAB_ID]).toMatchObject({
+      root: { type: 'leaf', leafId: SIBLING_LEAF_ID },
+      ptyIdsByLeafId: { [SIBLING_LEAF_ID]: SIBLING_PTY_ID }
+    })
+    // No exit arrives to remove the pane, so the desktop renderer is told to drop that leaf.
+    expect(harness.closeTerminalPane).toHaveBeenCalledExactlyOnceWith(TAB_ID, LEAF_ID)
+    expect(harness.closeTerminalTab).not.toHaveBeenCalled()
+  })
+
+  it('commits the pane removal when the handle names a live PTY', async () => {
+    const harness = createHarness({ publishMobileSurface: true, registerPtyBacked: true })
+    harness.syncSplitFixtureGraph()
+    // Graph without the leaf: the handle resolves through the PTY, as for a runtime-owned pane.
+    harness.syncFixtureTabWithoutLeaf()
+    harness.setVerifiedStopResult(true)
+    const terminal = (await harness.runtime.listTerminals(`id:${WORKTREE_ID}`)).terminals.find(
+      (candidate) => candidate.ptyId === PTY_ID
+    )!
+
+    await expect(harness.runtime.closeTerminal(terminal.handle)).resolves.toMatchObject({
+      tabId: TAB_ID,
+      ptyKilled: true
+    })
+
+    expect(harness.getSession().terminalLayoutsByTabId[TAB_ID]?.root).toEqual({
+      type: 'leaf',
+      leafId: SIBLING_LEAF_ID
+    })
+    expect(harness.closeTerminalPane).toHaveBeenCalledExactlyOnceWith(TAB_ID, LEAF_ID)
+    expect(harness.closeTerminalTab).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    ['reports no exit', false],
+    ['throws, as an unreachable SSH host does', new Error('ssh_host_unreachable')]
+  ] as const)(
+    'closes only that pane, never the live sibling, when its stop %s',
+    async (_case, stopResult) => {
+      const harness = createHarness({ publishMobileSurface: true, registerPtyBacked: true })
+      harness.syncSplitFixtureGraph()
+      harness.syncFixtureTabWithoutLeaf()
+      harness.setVerifiedStopResult(stopResult)
+      // A renderer that honours a whole-tab close, so a widened close shows as the lost sibling.
+      harness.setCloseTerminalTabAction(() => harness.retirePersistedTab())
+      const terminal = (await harness.runtime.listTerminals(`id:${WORKTREE_ID}`)).terminals.find(
+        (candidate) => candidate.ptyId === PTY_ID
+      )!
+
+      const receipt = await harness.runtime.closeTerminal(terminal.handle)
+
+      // A stale renderer save that still lists the pane can neither restore it nor drop the sibling.
+      const saved = sanitizeWorkspaceSessionTerminalRetirements(
+        { ...harness.getSession(), terminalLayoutsByTabId: { [TAB_ID]: splitLayout } },
+        harness.getSession()
+      )
+      expect(saved.tabsByWorktree[WORKTREE_ID]).toEqual([expect.objectContaining({ id: TAB_ID })])
+      expect(saved.terminalLayoutsByTabId[TAB_ID]?.root).toEqual({
+        type: 'leaf',
+        leafId: SIBLING_LEAF_ID
+      })
+      expect(harness.closeTerminalPane).toHaveBeenCalledExactlyOnceWith(TAB_ID, LEAF_ID)
+      expect(harness.closeTerminalTab).not.toHaveBeenCalled()
+      // The owed stop still goes out through the controller's kill, which records SSH pending kills.
+      expect(harness.kill).toHaveBeenCalledWith(PTY_ID)
+      expect(harness.kill).not.toHaveBeenCalledWith(SIBLING_PTY_ID)
+      expect(receipt).toMatchObject({
+        tabId: TAB_ID,
+        ptyKilled: false,
+        ptyStopVerdict: 'unverifiable'
+      })
+    }
+  )
+
+  it('drops only that pane from paired clients on a host with no renderer listing the tab', async () => {
+    const harness = createHarness({ publishMobileSurface: true, registerPtyBacked: true })
+    harness.syncSplitFixtureGraph()
+    harness.syncFixtureTabWithoutLeaf()
+    const terminal = (await harness.runtime.listTerminals(`id:${WORKTREE_ID}`)).terminals.find(
+      (candidate) => candidate.ptyId === PTY_ID
+    )!
+    harness.syncEmptyGraph()
+    // No exit arrives to retire the pane from the published snapshot.
+    harness.setVerifiedStopResult(new Error('ssh_host_unreachable'))
+
+    await harness.runtime.closeTerminal(terminal.handle)
+
+    const snapshot = await harness.runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)
+    expect(snapshot.tabs).toEqual([
+      expect.objectContaining({ parentTabId: TAB_ID, leafId: SIBLING_LEAF_ID })
+    ])
+    expect(snapshot.retiredTerminalSurfaces).toEqual([
+      expect.objectContaining({ parentTabId: TAB_ID, leafId: LEAF_ID, ptyId: PTY_ID })
+    ])
+    expect(harness.getSession().terminalLayoutsByTabId[TAB_ID]?.root).toEqual({
+      type: 'leaf',
+      leafId: SIBLING_LEAF_ID
+    })
+  })
+
+  it('keeps the sibling when the stop delivers the exit before the pane commit', async () => {
+    const harness = createHarness()
+    harness.syncSplitFixtureGraph()
+    harness.setStopAndWaitAction((stoppingPtyId) => harness.runtime.onPtyExit(stoppingPtyId, 0))
+    harness.setVerifiedStopResult(true)
+    const terminal = (await harness.runtime.listTerminals(`id:${WORKTREE_ID}`)).terminals.find(
+      (candidate) => candidate.ptyId === PTY_ID
+    )!
+
+    await harness.runtime.closeTerminal(terminal.handle)
+
+    const session = harness.getSession()
+    expect(session.tabsByWorktree[WORKTREE_ID]).toEqual([expect.objectContaining({ id: TAB_ID })])
+    expect(session.terminalLayoutsByTabId[TAB_ID]?.root).toEqual({
+      type: 'leaf',
+      leafId: SIBLING_LEAF_ID
+    })
+  })
+})
+
+describe('mobile close of one pane in a split tab', () => {
+  it('commits the pane removal alongside its kill', async () => {
+    const harness = createHarness({ publishMobileSurface: true, registerPtyBacked: true })
+    harness.syncSplitFixtureGraph()
+
+    await expect(
+      harness.runtime.closeMobileSessionTab(`id:${WORKTREE_ID}`, `${TAB_ID}::${LEAF_ID}`, {
+        reason: 'user'
+      })
+    ).resolves.toMatchObject({ closed: true })
+
+    expect(harness.kill).toHaveBeenCalledWith(PTY_ID)
+    expect(harness.getSession().terminalLayoutsByTabId[TAB_ID]).toMatchObject({
+      root: { type: 'leaf', leafId: SIBLING_LEAF_ID }
+    })
+    expect(harness.closeTerminalPane).toHaveBeenCalledExactlyOnceWith(TAB_ID, LEAF_ID)
+  })
+})
+
+describe('mobile close of a tab the desktop renderer lists', () => {
+  // Pins are renderer presentation that main's session can lag, so only the renderer can refuse.
+  it('still asks the renderer, whose pin guard can refuse it', async () => {
+    const harness = createHarness({ publishMobileSurface: true, registerPtyBacked: true })
+    harness.rejectTerminalTabClose(new Error('terminal_tab_pinned'))
+
+    await expect(
+      harness.runtime.closeMobileSessionTab(`id:${WORKTREE_ID}`, TAB_ID, { reason: 'user' })
+    ).rejects.toThrow('terminal_tab_pinned')
+
+    expect(harness.closeTerminalTab).toHaveBeenCalledWith(TAB_ID)
+    expect(harness.kill).not.toHaveBeenCalled()
+    expect(harness.getSession().tabsByWorktree[WORKTREE_ID]).toEqual([
+      expect.objectContaining({ id: TAB_ID })
+    ])
+  })
+})
diff --git a/src/main/runtime/orca-runtime-test-fixtures.spec.ts b/src/main/runtime/orca-runtime-test-fixtures.spec.ts
index c72bde039b9..78a6089e3ed 100644
--- a/src/main/runtime/orca-runtime-test-fixtures.spec.ts
+++ b/src/main/runtime/orca-runtime-test-fixtures.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
 import { expect, vi } from 'vitest'
 import { createHash } from 'node:crypto'
 import { HeadlessEmulator } from '../daemon/headless-emulator'
@@ -25,6 +26,7 @@ import type {
 import { InMemoryOrchestrationMessages } from './orca-runtime-test-orchestration-messages.spec'
 import type { OrchestrationDb } from './orchestration/db'
 import type { PtyProcessInspection } from '../providers/pty-process-inspection'
+import type { Store } from '../persistence'
 
 type RuntimeService = InstanceType<typeof OrcaRuntimeService>
 type HeadlessTerminal = InstanceType<typeof HeadlessEmulator>
@@ -558,9 +560,9 @@ function makeRuntimeStoreWithWorkspaceSession(
 ): {
   runtimeStore: typeof store & {
     getWorkspaceSession: (hostId?: string) => WorkspaceSessionState
-    setWorkspaceSession: ReturnType<typeof vi.fn>
-    flushOrThrow: ReturnType<typeof vi.fn>
-    persistPtyBinding: ReturnType<typeof vi.fn>
+    setWorkspaceSession: ReturnType<typeof vi.fn<Store['setWorkspaceSession']>>
+    flushOrThrow: ReturnType<typeof vi.fn<() => void>>
+    persistPtyBinding: ReturnType<typeof vi.fn<Store['persistPtyBinding']>>
   }
   getSession: () => WorkspaceSessionState
   setSession: (next: WorkspaceSessionState) => void
@@ -569,7 +571,7 @@ function makeRuntimeStoreWithWorkspaceSession(
   const setSession = (next: WorkspaceSessionState): void => {
     session = next
   }
-  const runtimeStore = {
+  const runtimeStore = withDurableRuntimeStore({
     ...store,
     getWorkspaceSession: (hostId?: string) =>
       hostId === undefined || hostId === ownerHostId ? session : getDefaultWorkspaceSession(),
@@ -577,36 +579,38 @@ function makeRuntimeStoreWithWorkspaceSession(
     // Headless close is a durable transaction; keep the in-memory fixture's
     // persistence contract equivalent to the production store.
     flushOrThrow: vi.fn(),
-    persistPtyBinding: vi.fn(
-      (args: { worktreeId: string; tabId: string; leafId: string; ptyId: string }) => {
-        const tabs = session.tabsByWorktree[args.worktreeId] ?? []
-        session = {
-          ...session,
-          tabsByWorktree: {
-            ...session.tabsByWorktree,
-            [args.worktreeId]: tabs.map((tab) =>
-              tab.id === args.tabId ? { ...tab, ptyId: args.ptyId } : tab
-            )
-          },
-          terminalLayoutsByTabId: {
-            ...session.terminalLayoutsByTabId,
-            [args.tabId]: {
-              ...(session.terminalLayoutsByTabId[args.tabId] ?? {
-                root: { type: 'leaf', leafId: args.leafId },
-                activeLeafId: args.leafId,
-                expandedLeafId: null
-              }),
-              ptyIdsByLeafId: {
-                ...session.terminalLayoutsByTabId[args.tabId]?.ptyIdsByLeafId,
-                [args.leafId]: args.ptyId
-              }
+    persistPtyBinding: vi.fn<Store['persistPtyBinding']>(async (input) => {
+      const args = typeof input === 'function' ? input() : input
+      if (!args) {
+        return false
+      }
+      const tabs = session.tabsByWorktree[args.worktreeId] ?? []
+      session = {
+        ...session,
+        tabsByWorktree: {
+          ...session.tabsByWorktree,
+          [args.worktreeId]: tabs.map((tab) =>
+            tab.id === args.tabId ? { ...tab, ptyId: args.ptyId } : tab
+          )
+        },
+        terminalLayoutsByTabId: {
+          ...session.terminalLayoutsByTabId,
+          [args.tabId]: {
+            ...(session.terminalLayoutsByTabId[args.tabId] ?? {
+              root: { type: 'leaf', leafId: args.leafId },
+              activeLeafId: args.leafId,
+              expandedLeafId: null
+            }),
+            ptyIdsByLeafId: {
+              ...session.terminalLayoutsByTabId[args.tabId]?.ptyIdsByLeafId,
+              [args.leafId]: args.ptyId
             }
           }
         }
-        return true
       }
-    )
-  }
+      return true
+    })
+  })
   return { runtimeStore, getSession: () => session, setSession }
 }
 
diff --git a/src/main/runtime/orca-runtime-test-mocks/setup.spec.ts b/src/main/runtime/orca-runtime-test-mocks/setup.spec.ts
index f85c353575e..c25dc33df87 100644
--- a/src/main/runtime/orca-runtime-test-mocks/setup.spec.ts
+++ b/src/main/runtime/orca-runtime-test-mocks/setup.spec.ts
@@ -1,6 +1,7 @@
 import { expect, vi } from 'vitest'
 import type { Mock } from 'vitest'
 import type * as GitUsernameModule from '../../git/git-username'
+import type * as FilesystemPathContainmentModule from '../../ipc/filesystem-path-containment'
 import { reviewHeadRemoteRefComponent } from '../../../shared/review-head-tracking-ref'
 
 // Why: durable review-head refs are scoped by remote identity (name + URL hash).
@@ -420,10 +421,13 @@ vi.mock('../../ipc/registered-worktree-roots-cache', () => ({
   invalidateAuthorizedRootsCache: invalidateAuthorizedRootsCacheMock
 }))
 
-vi.mock('../../ipc/filesystem-path-containment', () => ({
-  isENOENT: (error: unknown) =>
-    Boolean(error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT')
-}))
+// Why: the real check also matches relay-rebuilt errors, which carry only the ENOENT message.
+vi.mock('../../ipc/filesystem-path-containment', async () => {
+  const actual = await vi.importActual<typeof FilesystemPathContainmentModule>(
+    '../../ipc/filesystem-path-containment'
+  )
+  return { isENOENT: actual.isENOENT }
+})
 
 vi.mock('../../worktree-root-preparation', () => ({
   prepareLocalWorktreeRootForRepo: prepareLocalWorktreeRootForRepoMock
diff --git a/src/main/runtime/orca-runtime-test-scenario-builders.spec.ts b/src/main/runtime/orca-runtime-test-scenario-builders.spec.ts
index 1f87d901c81..1d63e09c4c7 100644
--- a/src/main/runtime/orca-runtime-test-scenario-builders.spec.ts
+++ b/src/main/runtime/orca-runtime-test-scenario-builders.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
 import * as mocks from './orca-runtime-test-mocks.spec'
 import type { Mock } from 'vitest'
 
@@ -34,7 +35,7 @@ type MobileCreateTestNotifier = {
   revealTerminalSession: TestMock
   splitTerminal: TestMock
   renameTerminal: TestMock
-  closeTerminal: (tabId: string, paneRuntimeId?: number) => void
+  closeTerminal: (tabId: string, leafId?: string) => void
   closeSessionTab: TestMock
   sleepWorktree: TestMock
   terminalFitOverrideChanged: TestMock
@@ -211,7 +212,7 @@ function makePostRevealWorkerRecoveryHarness(
   }
   const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
   const runtime = new OrcaRuntimeService(
-    { ...runtimeStore, flushOrThrow: vi.fn() } as never,
+    withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() }),
     undefined,
     { canRecoverPersistentLocalPtys: () => true }
   )
@@ -326,7 +327,7 @@ function makePendingAgentTabActivationRuntime(opts: { disabledTuiAgents?: string
 
 // Why: the five #7587 mobile-create tests share one notifier factory so interface changes live in one place.
 function createMobileCreateTestNotifier(
-  closeTerminal: (tabId: string, paneRuntimeId?: number) => void
+  closeTerminal: (tabId: string, leafId?: string) => void
 ): MobileCreateTestNotifier {
   return {
     focusTerminal: vi.fn(),
diff --git a/src/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts b/src/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts
index 1fafc4f7a9d..b7a784e6282 100644
--- a/src/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts
@@ -357,11 +357,11 @@ describe('OrcaRuntimeService', () => {
 
   it('calls foreground confirmation with its controller receiver', async () => {
     const getForegroundProcess = vi.fn(async () => 'powershell.exe')
-    const confirmForegroundProcess = vi.fn(
-      async function (this: { getForegroundProcess: typeof getForegroundProcess }) {
-        return this.getForegroundProcess === getForegroundProcess ? 'codex' : null
-      }
-    )
+    const confirmForegroundProcess = vi.fn(async function (this: {
+      getForegroundProcess: typeof getForegroundProcess
+    }) {
+      return this.getForegroundProcess === getForegroundProcess ? 'codex' : null
+    })
     const { runtime, handle } = await createExplicitAgentStatusHarness({
       getForegroundProcess,
       confirmForegroundProcess
diff --git a/src/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts b/src/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts
index 2501d0141dd..a1bcdf4b287 100644
--- a/src/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts
@@ -85,7 +85,7 @@ describe('OrcaRuntimeService', () => {
       runtime.sendTerminal(
         terminal.handle,
         { text: 'notes', enter: true },
-        { beforeWrite, afterWrite }
+        { inputKind: 'driving', beforeWrite, afterWrite }
       )
     ).rejects.toThrow('terminal_not_writable')
     expect(writes).toEqual(['notes', '\r'])
diff --git a/src/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts b/src/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts
index 23312f49420..310a1e12c81 100644
--- a/src/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts
@@ -150,10 +150,14 @@ describe('OrcaRuntimeService', () => {
       nextCursor: expect.any(String)
     })
 
-    const send = await runtime.sendTerminal(terminal.handle, {
-      text: 'continue',
-      enter: true
-    })
+    const send = await runtime.sendTerminal(
+      terminal.handle,
+      {
+        text: 'continue',
+        enter: true
+      },
+      { inputKind: 'driving' }
+    )
     expect(send).toMatchObject({
       handle: terminal.handle,
       accepted: true
diff --git a/src/main/runtime/orca-runtime-tests/exit-retirement-activation.spec.ts b/src/main/runtime/orca-runtime-tests/exit-retirement-activation.spec.ts
new file mode 100644
index 00000000000..7da878ca2f7
--- /dev/null
+++ b/src/main/runtime/orca-runtime-tests/exit-retirement-activation.spec.ts
@@ -0,0 +1,148 @@
+import { describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeService } from '../orca-runtime-test-mocks.spec'
+import {
+  HEADLESS_LEAF_ID,
+  HEADLESS_SECOND_LEAF_ID,
+  TEST_WORKTREE_ID,
+  makeDeferred,
+  makeHeadlessTerminalLayout,
+  makeRuntimeStoreWithWorkspaceSession,
+  makeWorkspaceSessionWithHeadlessTerminal
+} from '../orca-runtime-test-fixtures.spec'
+
+async function startSplitHost() {
+  const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(
+    makeWorkspaceSessionWithHeadlessTerminal({
+      tabsByWorktree: {
+        [TEST_WORKTREE_ID]: [
+          {
+            id: 'host-tab',
+            ptyId: 'pty-a',
+            worktreeId: TEST_WORKTREE_ID,
+            title: 'Split Terminal',
+            customTitle: null,
+            color: null,
+            sortOrder: 0,
+            createdAt: 1
+          }
+        ]
+      },
+      terminalLayoutsByTabId: {
+        'host-tab': makeHeadlessTerminalLayout({
+          [HEADLESS_LEAF_ID]: 'pty-a',
+          [HEADLESS_SECOND_LEAF_ID]: 'pty-b'
+        })
+      }
+    })
+  )
+  const spawn = vi.fn(async (options: { sessionId?: string }) => ({
+    id: options.sessionId ?? 'fresh-pty'
+  }))
+  const adoptStablePane = vi.fn(async () => null)
+  const runtime = new OrcaRuntimeService(runtimeStore)
+  runtime.setPtyController({
+    spawn,
+    adoptStablePane,
+    write: () => true,
+    kill: () => true,
+    getForegroundProcess: async () => null,
+    listProcesses: async () => []
+  })
+  runtime.syncWindowGraph(0, { tabs: [], leaves: [] })
+  const activate = (leafId: string, intent: 'user' | 'automatic') =>
+    runtime.activateMobileSessionTab(`id:${TEST_WORKTREE_ID}`, 'host-tab', leafId, {
+      notifyClients: false,
+      navigation: 'caller',
+      intent
+    })
+  const terminalLeafIds = async (): Promise<string[]> =>
+    (await runtime.listMobileSessionTabs(`id:${TEST_WORKTREE_ID}`)).tabs.flatMap((tab) =>
+      tab.type === 'terminal' ? [tab.leafId] : []
+    )
+  await activate(HEADLESS_LEAF_ID, 'user')
+  await activate(HEADLESS_SECOND_LEAF_ID, 'user')
+  expect(spawn).toHaveBeenCalledTimes(2)
+  expect(adoptStablePane).toHaveBeenCalledTimes(2)
+  return { runtime, runtimeStore, getSession, spawn, adoptStablePane, activate, terminalLeafIds }
+}
+
+describe('OrcaRuntimeService', () => {
+  // Why: a paired mirror answers an exit's stream end by re-activating its pane. An activation
+  // that still finds the leaf respawns the exited session, and the retirement never publishes.
+  it('retires an exited split leaf before its stream end, while the durable write is pending', async () => {
+    const { runtime, runtimeStore, getSession, spawn, adoptStablePane, activate, terminalLeafIds } =
+      await startSplitHost()
+
+    const disk = makeDeferred()
+    Object.assign(runtimeStore, { flushPendingOrThrowAsync: () => disk.promise })
+    const published = vi.fn()
+    runtime.onMobileSessionTabsChanged(published)
+    // The stream end: the mirror's re-activation starts the moment the host releases it.
+    let reactivation: Promise<unknown> | undefined
+    let observedAtStreamEnd: { binding?: string; publications: number } | undefined
+    runtime.subscribeToPtyExit('pty-b', () => {
+      observedAtStreamEnd = {
+        binding:
+          getSession().terminalLayoutsByTabId['host-tab']?.ptyIdsByLeafId?.[
+            HEADLESS_SECOND_LEAF_ID
+          ],
+        publications: published.mock.calls.length
+      }
+      reactivation = activate(HEADLESS_SECOND_LEAF_ID, 'automatic').catch((error) => error)
+    })
+    const exiting = runtime.onPtyExit('pty-b', 0, undefined, { providerExitObserved: true })
+
+    // Why: whatever answers the stream end, over any transport, must already see the leaf retired.
+    expect(observedAtStreamEnd).toEqual({ binding: undefined, publications: 1 })
+    expect(reactivation).toBeDefined()
+    // Why: the refusal must come from the lookup, before any stable-pane adoption can revive it.
+    expect(await reactivation).toEqual(new Error('tab_not_found'))
+    expect(adoptStablePane).toHaveBeenCalledTimes(2)
+    expect(spawn).toHaveBeenCalledTimes(2)
+    expect(await terminalLeafIds()).toEqual([HEADLESS_LEAF_ID])
+    expect(
+      getSession().terminalLayoutsByTabId['host-tab']?.ptyIdsByLeafId?.[HEADLESS_SECOND_LEAF_ID]
+    ).toBeUndefined()
+
+    disk.resolve()
+    await exiting
+    expect(await terminalLeafIds()).toEqual([HEADLESS_LEAF_ID])
+  })
+
+  // Why: the process is gone whether or not the profile admits the write (quit, maintenance).
+  it('retires the pane and ends the stream when the profile refuses the staging write', async () => {
+    const { runtime, runtimeStore, activate, terminalLeafIds } = await startSplitHost()
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined)
+    runtimeStore.setWorkspaceSession.mockImplementation(() => {
+      throw new Error('Profile maintenance or finalization is blocking new terminal snapshot work')
+    })
+    const streamEnd = vi.fn()
+    runtime.subscribeToPtyExit('pty-b', streamEnd)
+
+    await runtime.onPtyExit('pty-b', 0, undefined, { providerExitObserved: true })
+
+    expect(streamEnd).toHaveBeenCalledOnce()
+    expect(await terminalLeafIds()).toEqual([HEADLESS_LEAF_ID])
+    await expect(activate(HEADLESS_SECOND_LEAF_ID, 'automatic')).rejects.toThrow('tab_not_found')
+    expect(errorSpy).toHaveBeenCalledWith(
+      '[runtime] could not stage terminal retirement:',
+      expect.any(Error)
+    )
+    errorSpy.mockRestore()
+  })
+
+  // Why: the stream end now waits behind the exit cleanup; a cleanup fault must not strand it.
+  it('still ends the stream when exit cleanup throws before the retirement', () => {
+    const runtime = new OrcaRuntimeService()
+    Object.assign(runtime, {
+      disposeHeadlessTerminal: () => {
+        throw new Error('dispose_failed')
+      }
+    })
+    const streamEnd = vi.fn()
+    runtime.subscribeToPtyExit('pty-a', streamEnd)
+
+    expect(() => runtime.onPtyExit('pty-a', 0)).toThrow('dispose_failed')
+    expect(streamEnd).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts
index 6f5410e82a8..8b6806aec2b 100644
--- a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import {
   OrcaRuntimeService,
@@ -177,13 +178,15 @@ describe('OrcaRuntimeService', () => {
     const getWorkspaceSession = vi.fn((hostId?: string | null) =>
       hostId === 'ssh:ssh-1' ? sshSession : localSession
     )
-    const runtime = new OrcaRuntimeService({
-      ...store,
-      flushOrThrow: vi.fn(),
-      getRepos: () => [remoteRepo],
-      getRepo: (id: string) => (id === TEST_REPO_ID ? remoteRepo : undefined),
-      getWorkspaceSession
-    } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({
+        ...store,
+        flushOrThrow: vi.fn(),
+        getRepos: () => [remoteRepo],
+        getRepo: (id: string) => (id === TEST_REPO_ID ? remoteRepo : undefined),
+        getWorkspaceSession
+      })
+    )
     runtime.setPtyController({
       write: () => true,
       kill: () => true,
@@ -229,15 +232,17 @@ describe('OrcaRuntimeService', () => {
       sshSession = session
     })
     const kill = vi.fn(() => true)
-    const runtime = new OrcaRuntimeService({
-      ...store,
-      getRepos: () => [remoteRepo],
-      getRepo: (id: string) => (id === TEST_REPO_ID ? remoteRepo : undefined),
-      getWorkspaceSession: (hostId?: string | null) =>
-        hostId === 'ssh:ssh-1' ? sshSession : localSession,
-      setWorkspaceSession,
-      flushOrThrow: vi.fn()
-    } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({
+        ...store,
+        getRepos: () => [remoteRepo],
+        getRepo: (id: string) => (id === TEST_REPO_ID ? remoteRepo : undefined),
+        getWorkspaceSession: (hostId?: string | null) =>
+          hostId === 'ssh:ssh-1' ? sshSession : localSession,
+        setWorkspaceSession,
+        flushOrThrow: vi.fn()
+      })
+    )
     runtime.setPtyController({
       write: () => true,
       kill,
diff --git a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts
index eb2af5c0a1b..d2861c21400 100644
--- a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import { OrcaRuntimeService, electronMocks } from '../orca-runtime-test-mocks.spec'
 import type { RuntimeMobileSessionTabsResult } from '../orca-runtime-test-mocks.spec'
@@ -181,7 +182,7 @@ describe('OrcaRuntimeService', () => {
     })
     events.length = 0
 
-    runtime.onPtyExit('laptop-created-pty', 0)
+    await runtime.onPtyExit('laptop-created-pty', 0)
 
     expect(events).toEqual([
       expect.objectContaining({
@@ -374,7 +375,9 @@ describe('OrcaRuntimeService', () => {
     const acknowledged = makeDeferred()
     const closeTerminalTab = vi.fn(() => acknowledged.promise)
     const kill = vi.fn(() => true)
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     runtime.setNotifier({ closeTerminal: vi.fn(), closeTerminalTab } as never)
     runtime.setPtyController({
       write: () => true,
@@ -510,7 +513,9 @@ describe('OrcaRuntimeService', () => {
       .mockResolvedValueOnce({ id: 'headless-left' })
       .mockResolvedValueOnce({ id: 'headless-right' })
     const kill = vi.fn(() => true)
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow })
+    )
     runtime.setPtyController({
       spawn,
       write: () => true,
diff --git a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts
index 518d6805c5b..4ac0faf4d58 100644
--- a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import type { AgentStatusIpcPayload } from '../../../shared/agent-status-types'
 import { OrcaRuntimeService, electronMocks } from '../orca-runtime-test-mocks.spec'
@@ -442,7 +443,9 @@ describe('OrcaRuntimeService', () => {
     })
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
     const closeTerminalTab = vi.fn(async () => {})
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow })
+    )
     runtime.setPtyController({
       write: () => true,
       kill,
diff --git a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts
index b37fa4963d4..6974a6f7f8f 100644
--- a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts
@@ -478,6 +478,7 @@ describe('OrcaRuntimeService', () => {
     )
     const kill = vi.fn(() => true)
     const closeTerminal = vi.fn()
+    const closeTerminalPane = vi.fn()
     const runtime = new OrcaRuntimeService(runtimeStore as never)
     runtime.setPtyController({
       write: () => true,
@@ -485,7 +486,8 @@ describe('OrcaRuntimeService', () => {
       getForegroundProcess: async () => null,
       listProcesses: async () => []
     })
-    runtime.setNotifier({ closeTerminal } as never)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: these close paths call only the listed notifier methods.
+    runtime.setNotifier({ closeTerminal, closeTerminalPane } as never)
     runtime.syncWindowGraph(1, {
       tabs: [
         {
@@ -524,8 +526,13 @@ describe('OrcaRuntimeService', () => {
     // Exact split leaf: kill only that leaf's PTY, keep the sibling, don't tear down the parent.
     expect(kill).toHaveBeenCalledWith('serve-right')
     expect(kill).not.toHaveBeenCalledWith('serve-left')
+    // Only the leaf-addressed notice for the closed pane; never a whole-tab close.
+    expect(closeTerminalPane).toHaveBeenCalledExactlyOnceWith('host-tab', HEADLESS_SECOND_LEAF_ID)
     expect(closeTerminal).not.toHaveBeenCalled()
     expect(getSession().tabsByWorktree[TEST_WORKTREE_ID]).toHaveLength(1)
-    expect(getSession().terminalLayoutsByTabId['host-tab']).toBeDefined()
+    expect(getSession().terminalLayoutsByTabId['host-tab']?.root).toEqual({
+      type: 'leaf',
+      leafId: HEADLESS_LEAF_ID
+    })
   })
 })
diff --git a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts
index 81d78d4e308..88c988929f7 100644
--- a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts
@@ -409,7 +409,7 @@ describe('OrcaRuntimeService', () => {
       // republish would re-add the dead leaf on the echoing client and feed a
       // refuse→republish→re-echo loop.
       const { runtime, getSession, kill, closeTerminal } = makeSplitLeafRuntime()
-      runtime.onPtyExit('serve-right', 0)
+      await runtime.onPtyExit('serve-right', 0)
       const events: { worktree: string }[] = []
       const unsubscribe = runtime.onMobileSessionTabsChanged((snapshot) => events.push(snapshot))
 
diff --git a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts
index 27421489aba..a47f037d40e 100644
--- a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts
@@ -602,7 +602,7 @@ describe('OrcaRuntimeService', () => {
       expect(write).toHaveBeenCalledTimes(2)
       expect(write.mock.calls[0][0]).toBe('pty-bare')
       expect(String(write.mock.calls[0][1])).toMatch(/codex/)
-      expect(write.mock.calls[1]).toEqual(['pty-bare', '\r'])
+      expect(write.mock.calls[1]).toEqual(['pty-bare', '\r', 'launch'])
     } finally {
       vi.useRealTimers()
     }
diff --git a/src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts b/src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts
index c3000e90bd2..fe8f7e08fab 100644
--- a/src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts
@@ -235,6 +235,7 @@ describe('OrcaRuntimeService', () => {
 
   it('closes the matching mobile terminal UUID leaf without closing the whole tab', async () => {
     const closeTerminal = vi.fn()
+    const closeTerminalPane = vi.fn()
     const kill = vi.fn(() => true)
     const runtime = new OrcaRuntimeService(store)
     runtime.setPtyController({
@@ -253,6 +254,7 @@ describe('OrcaRuntimeService', () => {
       renameTerminal: vi.fn(),
       focusTerminal: vi.fn(),
       closeTerminal,
+      closeTerminalPane,
       sleepWorktree: vi.fn(),
       terminalFitOverrideChanged: vi.fn(),
       terminalDriverChanged: vi.fn()
@@ -313,6 +315,8 @@ describe('OrcaRuntimeService', () => {
     await runtime.closeMobileSessionTab(`id:${TEST_WORKTREE_ID}`, `tab-1::${rightLeafId}`)
 
     expect(kill).toHaveBeenCalledWith('pty-right')
+    // Only the leaf-addressed notice for the closed pane; never a whole-tab close.
+    expect(closeTerminalPane).toHaveBeenCalledExactlyOnceWith('tab-1', rightLeafId)
     expect(closeTerminal).not.toHaveBeenCalled()
   })
 
diff --git a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-02.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-02.spec.ts
index 68479f85e4a..03b9414451e 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-02.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-02.spec.ts
@@ -4,8 +4,6 @@ import {
   getDefaultWorkspaceSession,
   join,
   makePaneKey,
-  markCodexProjectTrustedMock,
-  markCursorWorkspaceTrustedMock,
   mkdtemp,
   setPlatform,
   setTerminalViewAttributes,
@@ -374,7 +372,7 @@ describe('OrcaRuntimeService', () => {
     })
 
     const spawnCall = spawn.mock.calls[0]?.[0] as
-      | { command?: string; env?: Record<string, string> }
+      | { command?: string; launchAgent?: string; env?: Record<string, string> }
       | undefined
     expect(spawnCall?.command).toBe("codex '--dangerously-bypass-approvals-and-sandbox'")
     expect(spawnCall?.env).toMatchObject({
@@ -382,10 +380,8 @@ describe('OrcaRuntimeService', () => {
       ORCA_WORKTREE_ID: TEST_WORKTREE_ID
     })
     expect(spawnCall?.env?.ORCA_AGENT_LAUNCH_TOKEN).toMatch(UUID_RE)
-    expect(markCodexProjectTrustedMock).toHaveBeenCalledWith(TEST_WORKTREE_PATH)
-    expect(markCodexProjectTrustedMock.mock.invocationCallOrder[0]).toBeLessThan(
-      spawn.mock.invocationCallOrder[0]!
-    )
+    // The spawn builder pre-trusts the workspace for the declared launch agent.
+    expect(spawnCall?.launchAgent).toBe('codex')
   })
 
   // Why: `cursor` on PATH is the Cursor desktop launcher; only `cursor-agent` is
@@ -421,7 +417,6 @@ describe('OrcaRuntimeService', () => {
     expect(spawnCall?.command).toBe("cursor-agent '--force'")
     expect(spawnCall?.launchAgent).toBe('cursor')
     expect(spawnCall?.env).toMatchObject({ CURSOR_PROFILE: 'captured' })
-    expect(markCursorWorkspaceTrustedMock).toHaveBeenCalledWith(TEST_WORKTREE_PATH)
   })
 
   it('resolves a startupAgent to the CLI binary on Windows, where `cursor` is the IDE', async () => {
diff --git a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts
index bf3e98020e5..47d7236dd9d 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts
@@ -7,7 +7,6 @@ import {
   homedir,
   ipcMain,
   join,
-  markCodexProjectTrustedMock,
   mkdtemp,
   randomUUID,
   registerSshGitProvider,
@@ -242,10 +241,6 @@ describe('OrcaRuntimeService', () => {
         }
       })
     )
-    expect(markCodexProjectTrustedMock).toHaveBeenCalledWith(TEST_WORKTREE_PATH)
-    expect(markCodexProjectTrustedMock.mock.invocationCallOrder[0]).toBeLessThan(
-      webContents.send.mock.invocationCallOrder[0]!
-    )
   })
 
   it('injects runtime hook receiver env into terminal sessions', async () => {
diff --git a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-05.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-05.spec.ts
index 591f4e7ca97..2aba44299f2 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-05.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-05.spec.ts
@@ -333,7 +333,7 @@ describe('OrcaRuntimeService', () => {
     await vi.waitFor(() => expect(spawn).toHaveBeenCalledOnce())
 
     setSession(getDefaultWorkspaceSession())
-    runtimeStore.persistPtyBinding.mockReturnValue(false)
+    runtimeStore.persistPtyBinding.mockResolvedValue(false)
     resolveSpawn({ id: 'rejected-split-pty' })
 
     await expect(split).rejects.toThrow('terminal_split_source_not_found')
diff --git a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts
index 9145bea46f6..d90dc63031b 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts
@@ -467,7 +467,7 @@ describe('OrcaRuntimeService', () => {
     })
     const { handle } = await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`)
 
-    await runtime.sendTerminal(handle, { text: 'continue', enter: true })
+    await runtime.sendTerminal(handle, { text: 'continue', enter: true }, { inputKind: 'driving' })
 
     expect(writes).toEqual(['continue', '\r'])
   })
@@ -490,7 +490,7 @@ describe('OrcaRuntimeService', () => {
       const { handle } = await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`)
       const prompt = 'line one\nline two\x1b[201~'
 
-      const sendPromise = runtime.sendTerminalAgentPrompt(handle, prompt)
+      const sendPromise = runtime.sendTerminalAgentPrompt(handle, prompt, { inputKind: 'driving' })
       await vi.runAllTimersAsync()
       const result = await sendPromise
 
@@ -535,6 +535,7 @@ describe('OrcaRuntimeService', () => {
       )
 
       const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'the brief', {
+        inputKind: 'driving',
         leadLine: ORCA_DISPATCH_PROMPT_LEAD_LINE
       })
       await vi.runAllTimersAsync()
@@ -601,6 +602,7 @@ describe('OrcaRuntimeService', () => {
         const assertAuthority = vi.fn()
 
         const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change', {
+          inputKind: 'driving',
           beforeWrite: assertAuthority
         })
         await vi.advanceTimersByTimeAsync(500)
@@ -659,7 +661,9 @@ describe('OrcaRuntimeService', () => {
         'review this change',
         agent
       )
-      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change')
+      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change', {
+        inputKind: 'driving'
+      })
       if (agent === 'omp') {
         await sendPromise
         expect(writes).toEqual([`${buildAgentPromptPasteBytes('review this change')}\r`])
diff --git a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts
index 8b27ce9bb5d..fe3687aab0a 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts
@@ -44,7 +44,9 @@ describe('OrcaRuntimeService', () => {
       const { handle } = await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`)
 
       await expect(runtime.isTerminalRunningSettledPromptAgent(handle)).resolves.toBe(true)
-      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change')
+      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change', {
+        inputKind: 'driving'
+      })
       await vi.advanceTimersByTimeAsync(1_199)
       expect(writes).not.toContain('\r')
       await vi.advanceTimersByTimeAsync(1_500)
@@ -78,7 +80,9 @@ describe('OrcaRuntimeService', () => {
         launchAgent: 'claude'
       })
 
-      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change')
+      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change', {
+        inputKind: 'driving'
+      })
       await vi.advanceTimersByTimeAsync(renderGateCapMs('review this change') - 1)
       expect(writes).not.toContain('\r')
 
@@ -117,7 +121,9 @@ describe('OrcaRuntimeService', () => {
         launchAgent: 'codex'
       })
 
-      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change')
+      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change', {
+        inputKind: 'driving'
+      })
       await vi.advanceTimersByTimeAsync(8_000)
       expect(writes).not.toContain('\r')
       await vi.advanceTimersByTimeAsync(1_599)
@@ -159,7 +165,9 @@ describe('OrcaRuntimeService', () => {
         launchAgent: 'claude'
       })
 
-      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change')
+      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change', {
+        inputKind: 'driving'
+      })
       // The marker at 100 ms re-arms the cap, but the ingest term is absolute: a prompt this
       // small is already ingested by then, so the fallback is one flat render timeout later.
       await vi.advanceTimersByTimeAsync(100 + 8_000 - 1)
@@ -193,7 +201,7 @@ describe('OrcaRuntimeService', () => {
       })
       const prompt = `${'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES)}\ntail`
 
-      const sendPromise = runtime.sendTerminalAgentPrompt(handle, prompt)
+      const sendPromise = runtime.sendTerminalAgentPrompt(handle, prompt, { inputKind: 'driving' })
       await vi.runAllTimersAsync()
       const result = await sendPromise
 
@@ -230,7 +238,7 @@ describe('OrcaRuntimeService', () => {
       })
       const prompt = 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES + 1)
 
-      const sendPromise = runtime.sendTerminalAgentPrompt(handle, prompt)
+      const sendPromise = runtime.sendTerminalAgentPrompt(handle, prompt, { inputKind: 'driving' })
       const sendRejection = expect(sendPromise).rejects.toThrow('terminal_not_writable')
       await vi.runAllTimersAsync()
 
@@ -258,7 +266,7 @@ describe('OrcaRuntimeService', () => {
     const { handle } = await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`)
     const text = ['x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES), 'tail'].join('')
 
-    const result = await runtime.sendTerminal(handle, { text })
+    const result = await runtime.sendTerminal(handle, { text }, { inputKind: 'driving' })
 
     expect(result).toMatchObject({
       handle,
@@ -285,7 +293,7 @@ describe('OrcaRuntimeService', () => {
       const { handle } = await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`)
 
       const text = `${'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES)}\nline two\nline three`
-      await runtime.sendTerminal(handle, { text, enter: true })
+      await runtime.sendTerminal(handle, { text, enter: true }, { inputKind: 'driving' })
 
       expect(writes.at(-1)).toBe('\r')
       expect(writes.slice(0, -1).join('')).toBe(text)
@@ -312,7 +320,7 @@ describe('OrcaRuntimeService', () => {
 
     vi.useFakeTimers()
     try {
-      const sendPromise = runtime.sendTerminal(handle, { text })
+      const sendPromise = runtime.sendTerminal(handle, { text }, { inputKind: 'driving' })
 
       expect(writes).toEqual([])
 
@@ -346,7 +354,11 @@ describe('OrcaRuntimeService', () => {
     const { handle } = await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`)
 
     await expect(
-      runtime.sendTerminal(handle, { text: 'x'.repeat(TERMINAL_INPUT_MAX_BYTES + 1) })
+      runtime.sendTerminal(
+        handle,
+        { text: 'x'.repeat(TERMINAL_INPUT_MAX_BYTES + 1) },
+        { inputKind: 'driving' }
+      )
     ).rejects.toThrow(TERMINAL_INPUT_TOO_LARGE_ERROR)
     expect(writes).toEqual([])
   })
diff --git a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts
index ef0a1a96de5..ef895661c10 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts
@@ -1,5 +1,7 @@
 import { describe, expect, it, vi } from 'vitest'
 import { OrcaRuntimeService } from '../orca-runtime-test-mocks.spec'
+import type { PtyProviderBufferSnapshot } from '../../providers/pty-provider-contract'
+import { TerminalKittyKeyboardModeTracker } from '../../../shared/terminal-kitty-keyboard-mode-tracker'
 import {
   HEADLESS_LEAF_ID,
   TEST_WORKTREE_ID,
@@ -199,6 +201,79 @@ describe('OrcaRuntimeService', () => {
     expect(snapshot?.data).not.toContain('line-0')
   })
 
+  it('resets input modes through the PTY controller and the headless model', async () => {
+    const resetInputModes = vi.fn().mockResolvedValue(undefined)
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null,
+      resetInputModes
+    })
+    syncSinglePty(runtime, 'pty-1')
+    // An app armed these and crashed with no command end.
+    runtime.onPtyData('pty-1', 'prompt$ app\r\n\x1b[>31u\x1b[?1000h\x1b[?2004h', 123)
+    const [terminal] = (await runtime.listTerminals()).terminals
+    const armed = await runtime.serializeTerminalBuffer('pty-1')
+    expect(armed?.kittyKeyboardFlags).toBe(31)
+
+    await expect(runtime.resetTerminalInputModes(terminal.handle)).resolves.toEqual({
+      handle: terminal.handle,
+      reset: true
+    })
+
+    expect(resetInputModes).toHaveBeenCalledWith('pty-1')
+    const snapshot = await runtime.serializeTerminalBuffer('pty-1')
+    expect(snapshot?.kittyKeyboardFlags).toBe(0)
+    expect(snapshot?.data).not.toContain('\x1b[?1000h')
+    expect(snapshot?.data).not.toContain('\x1b[?2004h')
+  })
+
+  it('grounds the provider mode tracker before a later chunk, in the emulator order', async () => {
+    const runtime = new OrcaRuntimeService(store)
+    syncSinglePty(runtime, 'pty-1')
+    runtime.onPtyData('pty-1', 'prompt$ ', 123)
+    const tracker = new TerminalKittyKeyboardModeTracker()
+    runtime['providerModeTrackersByPtyId'].set('pty-1', tracker)
+
+    // A TUI starts while the reset still waits on the headless write chain.
+    const reset = runtime.resetHeadlessTerminalInputModes('pty-1')
+    runtime.onPtyData('pty-1', '\x1b[?1049h', 124)
+    await reset
+    await runtime['headlessTerminals'].get('pty-1')?.writeChain
+
+    expect(runtime['headlessTerminals'].get('pty-1')?.emulator.isAlternateScreen).toBe(true)
+    expect(tracker.isAlternateScreen).toBe(true)
+  })
+
+  it('grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen', async () => {
+    let resolveSnapshot: (snapshot: PtyProviderBufferSnapshot) => void = () => {}
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null,
+      serializeProviderBuffer: () => new Promise((resolve) => (resolveSnapshot = resolve))
+    })
+    syncSinglePty(runtime, 'pty-1')
+    const generation = runtime['getPtyLifecycleGeneration']('pty-1')
+
+    // The capture's daemon request left before the reset; its answer predates the ground.
+    const capture = runtime['captureProviderTerminalBuffer']('pty-1', {}, generation)
+    await runtime.resetHeadlessTerminalInputModes('pty-1')
+    resolveSnapshot({
+      data: '',
+      cols: 80,
+      rows: 24,
+      seq: 1,
+      source: 'headless',
+      alternateScreen: true
+    })
+    await capture
+
+    expect(runtime['providerModeTrackersByPtyId'].get('pty-1')?.isAlternateScreen).toBe(false)
+  })
+
   it('waits for terminal exit and resolves with the exit status', async () => {
     const runtime = new OrcaRuntimeService(store)
 
diff --git a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts
index 6aa0c6bd70f..92612c2e763 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts
@@ -223,4 +223,74 @@ describe('OrcaRuntimeService', () => {
 
     expect(spawn.mock.calls[0]?.[0]?.command).not.toMatch(/--model/)
   })
+
+  // Every agent the runtime builds is attributed, so a launch whose caller named no surface still
+  // counts; only the caller's surface is taken, the rest is derived from the agent it resolved.
+  it.each([
+    ['orchestration', 'orchestration'],
+    [undefined, 'unknown'],
+    ['a_surface_added_later', 'unknown']
+  ])('attributes a startup-agent launch named %s as %s', async (launchSource, expected) => {
+    const spawn = vi.fn().mockResolvedValue({ id: 'pty-attributed' })
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      spawn,
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null
+    })
+
+    await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`, {
+      startupAgent: 'claude',
+      ...(launchSource ? { launchSource } : {})
+    })
+
+    expect(spawn.mock.calls[0]?.[0]?.telemetry).toEqual({
+      agent_kind: 'claude-code',
+      launch_source: expected,
+      request_kind: 'new'
+    })
+  })
+
+  it('attributes a fresh agent session the host builds as unknown', async () => {
+    const spawn = vi.fn().mockResolvedValue({ id: 'pty-session' })
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      spawn,
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null
+    })
+
+    await runtime.createAgentSession(
+      {
+        clientOperationId: `${Date.now()}-${'cd'.repeat(16)}`,
+        worktree: `id:${TEST_WORKTREE_ID}`,
+        agent: 'claude'
+      },
+      { clientId: 'remote-desktop', clientKind: 'runtime' }
+    )
+
+    expect(spawn.mock.calls[0]?.[0]?.telemetry).toEqual({
+      agent_kind: 'claude-code',
+      launch_source: 'unknown',
+      request_kind: 'new'
+    })
+  })
+
+  it('leaves a bare agent command the user typed out of launch attribution', async () => {
+    const spawn = vi.fn().mockResolvedValue({ id: 'pty-bare' })
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      spawn,
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null
+    })
+
+    await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`, { command: 'claude' })
+
+    expect(spawn.mock.calls[0]?.[0]?.launchAgent).toBe('claude')
+    expect(spawn.mock.calls[0]?.[0]?.telemetry).toBeUndefined()
+  })
 })
diff --git a/src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts
index 237afc57bc9..be454a5bde8 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts
@@ -142,7 +142,7 @@ describe('OrcaRuntimeService', () => {
     syncSinglePty(runtime, 'pty-1', { paneTitle: 'claude agents' })
     const [terminal] = (await runtime.listTerminals()).terminals
 
-    expect(runtime.getAgentStatusForHandle(terminal.handle)).toBeNull()
+    await expect(runtime.getAgentStatusForHandle(terminal.handle)).resolves.toBeNull()
   })
 
   it('lists live terminals with fresh pane titles over stale tab titles', async () => {
diff --git a/src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts
index e85aeb461c6..e122effd17d 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import {
   OrcaRuntimeService,
@@ -20,7 +21,9 @@ describe('OrcaRuntimeService', () => {
       ...getDefaultWorkspaceSession(),
       tabsByWorktree: { [TEST_WORKTREE_ID]: [] }
     })
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     let process = {
       id: 'reused-pty-id',
       incarnationId: 'inc-old',
@@ -66,7 +69,9 @@ describe('OrcaRuntimeService', () => {
       ...getDefaultWorkspaceSession(),
       tabsByWorktree: { [TEST_WORKTREE_ID]: [] }
     })
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     runtime.syncWindowGraph(1, {
       tabs: [
         {
@@ -156,7 +161,9 @@ describe('OrcaRuntimeService', () => {
         [`duplicate-b:${HEADLESS_SECOND_LEAF_ID}`]: 'inc-duplicate'
       }
     })
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     runtime.setPtyController({
       write: () => true,
       kill: () => true,
@@ -223,7 +230,7 @@ describe('OrcaRuntimeService', () => {
     expect(new Set(handles).size).toBe(handles.length)
 
     await expect(
-      runtime.sendTerminal('term_victim', { text: 'for victim' })
+      runtime.sendTerminal('term_victim', { text: 'for victim' }, { inputKind: 'driving' })
     ).resolves.toMatchObject({ accepted: true })
     expect(writesByPty.get('pty-victim')).toEqual(['for victim'])
     expect(writesByPty.has('pty-imposter')).toBe(false)
@@ -253,7 +260,7 @@ describe('OrcaRuntimeService', () => {
     const listed = await runtime.listTerminals()
     expect(listed.terminals[0]?.handle).toBe('term_already_bound')
     await expect(
-      runtime.sendTerminal('term_already_bound', { text: 'still routed' })
+      runtime.sendTerminal('term_already_bound', { text: 'still routed' }, { inputKind: 'driving' })
     ).resolves.toMatchObject({ accepted: true })
     expect(writes).toEqual(['still routed'])
     // the reported-but-not-adopted handle must not resolve to the live pty
@@ -340,7 +347,9 @@ describe('OrcaRuntimeService', () => {
       handle,
       tail: ['after unavailable']
     })
-    await expect(runtime.sendTerminal(handle, { text: 'still writable' })).resolves.toMatchObject({
+    await expect(
+      runtime.sendTerminal(handle, { text: 'still writable' }, { inputKind: 'driving' })
+    ).resolves.toMatchObject({
       handle,
       accepted: true
     })
diff --git a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts
index ecf2ab53678..dffd6e971eb 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import {
   OrcaRuntimeService,
@@ -53,7 +54,7 @@ describe('OrcaRuntimeService', () => {
       tail: ['after restart']
     })
     await expect(
-      runtime.sendTerminal('term_exported', { text: 'still writable' })
+      runtime.sendTerminal('term_exported', { text: 'still writable' }, { inputKind: 'driving' })
     ).resolves.toMatchObject({
       handle: 'term_exported',
       accepted: true
@@ -76,7 +77,9 @@ describe('OrcaRuntimeService', () => {
       ['pty-setup', 'inc-setup', 'term_setup', 'Setup'],
       ['pty-shell', 'inc-shell', 'term_shell', 'Shell']
     ] as const
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     const listProcesses = vi.fn(async () =>
       processes.map(([id, incarnationId, terminalHandle, title]) => ({
         id,
@@ -176,7 +179,7 @@ describe('OrcaRuntimeService', () => {
     ])
     expect(getSession().terminalTopologyRevisionByRepoId?.[TEST_REPO_ID]).toBe(1)
 
-    await runtime.sendTerminal('term_agent', { text: 'input' })
+    await runtime.sendTerminal('term_agent', { text: 'input' }, { inputKind: 'driving' })
     await runtime.updateRemoteDesktopViewer('pty-agent', 'viewer', 'client', 132, 41)
     expect(writes).toEqual([['pty-agent', 'input']])
     expect(resize).toHaveBeenCalledWith('pty-agent', 132, 41)
@@ -247,13 +250,15 @@ describe('OrcaRuntimeService', () => {
     const { runtimeStore, getSession, setSession } = makeRuntimeStoreWithWorkspaceSession(session)
     const durableWrite = deferred<void>()
     const durableWriteStarted = deferred<void>()
-    const runtime = new OrcaRuntimeService({
-      ...runtimeStore,
-      flushPendingOrThrowAsync: vi.fn(() => {
-        durableWriteStarted.resolve()
-        return durableWrite.promise
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({
+        ...runtimeStore,
+        flushPendingOrThrowAsync: vi.fn(() => {
+          durableWriteStarted.resolve()
+          return durableWrite.promise
+        })
       })
-    } as never)
+    )
     runtime.setPtyController({
       write: vi.fn(() => true),
       kill: vi.fn(() => true),
@@ -332,10 +337,12 @@ describe('OrcaRuntimeService', () => {
         wslDistro: null
       }
     ])
-    const runtime = new OrcaRuntimeService({
-      ...runtimeStore,
-      flushPendingOrThrowAsync
-    } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({
+        ...runtimeStore,
+        flushPendingOrThrowAsync
+      })
+    )
     runtime.setPtyController({
       write: vi.fn(() => true),
       kill: vi.fn(() => true),
@@ -447,13 +454,17 @@ describe('OrcaRuntimeService', () => {
     }
     const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
     const flushOrThrow = vi.fn()
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow } as never, undefined, {
-      canRecoverPersistentLocalPtys: () => true,
-      attestAgentHookCompatibilityAuthority: ({ paneKey, launchTokenHash }) =>
-        paneKey === workerPaneKey && launchTokenHash === RESTORED_AUTHORITY_TOKEN_HASH
-          ? { paneKey, source: 'hydrated_commitment' }
-          : null
-    })
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow }),
+      undefined,
+      {
+        canRecoverPersistentLocalPtys: () => true,
+        attestAgentHookCompatibilityAuthority: ({ paneKey, launchTokenHash }) =>
+          paneKey === workerPaneKey && launchTokenHash === RESTORED_AUTHORITY_TOKEN_HASH
+            ? { paneKey, source: 'hydrated_commitment' }
+            : null
+      }
+    )
     runtime.setOrchestrationDb({
       getActiveDispatchForTerminal: () => undefined,
       listLegacyWorkerTerminalRecoveryRows: () => [
@@ -598,7 +609,10 @@ describe('OrcaRuntimeService', () => {
       condition: 'tui-idle',
       timeoutMs: 50
     })
-    await vi.waitFor(() => expect(serializeProviderBuffer).toHaveBeenCalledTimes(4))
+    // The probe's read starts a microtask late; a 50 ms poll would race the wait's 50 ms timeout.
+    await vi.waitFor(() => expect(serializeProviderBuffer).toHaveBeenCalledTimes(4), {
+      interval: 1
+    })
     runtime.onPtyData('pty-legacy', '\x1b[H', Date.now())
     lateReadySnapshot.resolve({
       data: READY_SCREEN,
diff --git a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts
index 00a08310877..51edcad7373 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import { OrcaRuntimeService, getDefaultWorkspaceSession } from '../orca-runtime-test-mocks.spec'
 import type { OrchestrationDb } from '../orchestration/db'
@@ -40,7 +41,7 @@ describe('OrcaRuntimeService', () => {
     }
     const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
     const runtime = new OrcaRuntimeService(
-      { ...runtimeStore, flushOrThrow: vi.fn() } as never,
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
@@ -451,7 +452,7 @@ describe('OrcaRuntimeService', () => {
       return durableWrite.promise
     })
     const runtime = new OrcaRuntimeService(
-      { ...runtimeStore, flushPendingOrThrowAsync } as never,
+      withDurableRuntimeStore({ ...runtimeStore, flushPendingOrThrowAsync }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
diff --git a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts
index ea70b730388..6c439089396 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import {
   OrcaRuntimeService,
@@ -50,7 +51,7 @@ describe('OrcaRuntimeService', () => {
       throw new Error('synchronous persistence must not run')
     })
     const runtime = new OrcaRuntimeService(
-      { ...runtimeStore, flushOrThrow, flushPendingOrThrowAsync } as never,
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow, flushPendingOrThrowAsync }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
@@ -160,7 +161,7 @@ describe('OrcaRuntimeService', () => {
       return retryDurableWrite.promise
     })
     const runtime = new OrcaRuntimeService(
-      { ...runtimeStore, flushPendingOrThrowAsync } as never,
+      withDurableRuntimeStore({ ...runtimeStore, flushPendingOrThrowAsync }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
@@ -272,7 +273,7 @@ describe('OrcaRuntimeService', () => {
     }
     const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
     const runtime = new OrcaRuntimeService(
-      { ...runtimeStore, flushOrThrow: vi.fn() } as never,
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
@@ -383,7 +384,7 @@ describe('OrcaRuntimeService', () => {
     }
     const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
     const runtime = new OrcaRuntimeService(
-      { ...runtimeStore, flushOrThrow: vi.fn() } as never,
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
diff --git a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts
index 389c70d4f42..756f87611f6 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import {
   OrcaRuntimeService,
@@ -74,7 +75,7 @@ describe('OrcaRuntimeService', () => {
     }
     const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
     const runtime = new OrcaRuntimeService(
-      { ...runtimeStore, flushOrThrow: vi.fn() } as never,
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
@@ -187,12 +188,12 @@ describe('OrcaRuntimeService', () => {
     const folderWorkspace = makeFolderWorkspace({ folderPath })
     const projectGroup = makeFolderProjectGroup({ parentPath: folderPath })
     const runtime = new OrcaRuntimeService(
-      {
+      withDurableRuntimeStore({
         ...runtimeStore,
         getFolderWorkspaces: () => [folderWorkspace],
         getProjectGroups: () => [projectGroup],
         flushOrThrow: vi.fn()
-      } as never,
+      }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
@@ -313,14 +314,14 @@ describe('OrcaRuntimeService', () => {
     const folderWorkspace = makeFolderWorkspace({ folderPath, connectionId })
     const projectGroup = makeFolderProjectGroup({ parentPath: folderPath })
     const runtime = new OrcaRuntimeService(
-      {
+      withDurableRuntimeStore({
         ...runtimeStore,
         getFolderWorkspaces: () => [folderWorkspace],
         getProjectGroups: () => [projectGroup],
         getWorkspaceSession,
         setWorkspaceSession,
         flushOrThrow: vi.fn()
-      } as never,
+      }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
diff --git a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-06.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-06.spec.ts
index 1907b2bb450..2100c708043 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-06.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-06.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import {
   OrcaRuntimeService,
@@ -83,14 +84,14 @@ describe('OrcaRuntimeService', () => {
       rows: 24
     })
     const runtime = new OrcaRuntimeService(
-      {
+      withDurableRuntimeStore({
         ...runtimeStore,
         getRepos: () => [remoteRepo],
         getRepo: (id: string) => (id === TEST_REPO_ID ? remoteRepo : undefined),
         getWorkspaceSession,
         setWorkspaceSession,
         flushOrThrow: vi.fn()
-      } as never,
+      }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
@@ -220,7 +221,7 @@ describe('OrcaRuntimeService', () => {
     }
     const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
     const runtime = new OrcaRuntimeService(
-      {
+      withDurableRuntimeStore({
         ...runtimeStore,
         getProjects: () => [
           {
@@ -228,17 +229,17 @@ describe('OrcaRuntimeService', () => {
             displayName: 'repo',
             badgeColor: 'blue',
             sourceRepoIds: [TEST_REPO_ID],
-            localWindowsRuntimePreference: { kind: 'wsl', distro: 'Ubuntu' },
+            localWindowsRuntimePreference: { kind: 'wsl' as const, distro: 'Ubuntu' },
             createdAt: 0,
             updatedAt: 0
           }
         ],
         getSettings: () => ({
           ...store.getSettings(),
-          localWindowsRuntimeDefault: { kind: 'windows-host' }
+          localWindowsRuntimeDefault: { kind: 'windows-host' as const }
         }),
         flushOrThrow: vi.fn()
-      } as never,
+      }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
@@ -353,7 +354,9 @@ describe('OrcaRuntimeService', () => {
       }
     }
     const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     runtime.setPtyController({
       write: () => true,
       kill: () => true,
@@ -524,7 +527,9 @@ describe('OrcaRuntimeService', () => {
       }
     }
     const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     runtime.setPtyController({
       write: () => true,
       kill: () => true,
diff --git a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts
index 79bdf13909e..b9f605ccf91 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import { OrcaRuntimeService, getDefaultWorkspaceSession } from '../orca-runtime-test-mocks.spec'
 import {
@@ -64,7 +65,7 @@ describe('OrcaRuntimeService', () => {
     const afterRestart = await restarted.listMobileSessionTabs(`id:${TEST_WORKTREE_ID}`)
     const listed = await restarted.listTerminals(`id:${TEST_WORKTREE_ID}`)
     restarted.onPtyData('persisted-pty', 'after restart\n', 1)
-    await restarted.sendTerminal('term_current', { text: 'input' })
+    await restarted.sendTerminal('term_current', { text: 'input' }, { inputKind: 'driving' })
     await restarted.updateRemoteDesktopViewer('persisted-pty', 'viewer', 'client', 132, 41)
 
     expect(beforeRestart.tabs[0]).toMatchObject({
@@ -108,7 +109,9 @@ describe('OrcaRuntimeService', () => {
       terminalTopologyRevisionByRepoId: { [TEST_REPO_ID]: 7 }
     }
     const { runtimeStore } = makeRuntimeStoreWithWorkspaceSession(session)
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     runtime.setPtyController({
       write: () => true,
       kill: () => true,
@@ -143,12 +146,66 @@ describe('OrcaRuntimeService', () => {
     ).rejects.toThrow('terminal_topology_conflict')
   })
 
+  // The client's retirement proofs die with a host restart; the close record does not.
+  it('refuses to adopt an orphan under a tab the user closed', async () => {
+    const session = {
+      ...getDefaultWorkspaceSession(),
+      tabsByWorktree: { [TEST_WORKTREE_ID]: [] },
+      terminalTopologyRevisionByRepoId: { [TEST_REPO_ID]: 7 },
+      closedTerminalTabTombstonesByTabId: {
+        'tab-closed': {
+          closedAt: Date.now(),
+          worktreeId: TEST_WORKTREE_ID,
+          reason: 'user' as const
+        }
+      }
+    }
+    const { runtimeStore } = makeRuntimeStoreWithWorkspaceSession(session)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
+    runtime.setPtyController({
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null,
+      listProcesses: async () => [
+        {
+          id: 'pty-closed',
+          incarnationId: 'inc-closed',
+          terminalHandle: 'term_closed',
+          title: 'shell',
+          cwd: TEST_WORKTREE_PATH,
+          worktreeId: TEST_WORKTREE_ID,
+          wslDistro: null
+        }
+      ]
+    })
+
+    await expect(
+      runtime.adoptTerminalOrphans({
+        worktree: `id:${TEST_WORKTREE_ID}`,
+        expectedTopologyRevision: 7,
+        claims: [
+          {
+            terminal: 'term_closed',
+            ptyId: 'pty-closed',
+            incarnationId: 'inc-closed',
+            tabId: 'tab-closed',
+            leafId: HEADLESS_LEAF_ID
+          }
+        ]
+      })
+    ).rejects.toThrow('terminal_orphan_surface_retired')
+  })
+
   it('keeps orphaned list and show writability aligned with the send gate', async () => {
     const { runtimeStore } = makeRuntimeStoreWithWorkspaceSession({
       ...getDefaultWorkspaceSession(),
       tabsByWorktree: { [TEST_WORKTREE_ID]: [] }
     })
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     const writes: [string, string][] = []
     runtime.setPtyController({
       write: (ptyId: string, data: string) => {
@@ -178,7 +235,9 @@ describe('OrcaRuntimeService', () => {
 
     const shown = await runtime.showTerminal(entry!.handle)
     expect(shown.writable).toBe(true)
-    await expect(runtime.sendTerminal(entry!.handle, { text: 'hi' })).resolves.toMatchObject({
+    await expect(
+      runtime.sendTerminal(entry!.handle, { text: 'hi' }, { inputKind: 'driving' })
+    ).resolves.toMatchObject({
       accepted: true
     })
     expect(writes).toEqual([['pty-orphan', 'hi']])
@@ -190,7 +249,9 @@ describe('OrcaRuntimeService', () => {
         ...getDefaultWorkspaceSession(),
         tabsByWorktree: { [TEST_WORKTREE_ID]: [] }
       })
-      return new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+      return new OrcaRuntimeService(
+        withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+      )
     }
     const ownerMismatch = makeRuntime()
     ownerMismatch.registerPty('pty-wrong-owner', TEST_WORKTREE_ID, 'ssh-other-host')
@@ -282,25 +343,27 @@ describe('OrcaRuntimeService', () => {
           ...getDefaultWorkspaceSession(),
           tabsByWorktree: { [TEST_WORKTREE_ID]: [] }
         })
-        const wsl = new OrcaRuntimeService({
-          ...runtimeStore,
-          flushOrThrow: vi.fn(),
-          getProjects: () => [
-            {
-              id: 'project-wsl',
-              displayName: 'WSL',
-              badgeColor: 'blue',
-              sourceRepoIds: [TEST_REPO_ID],
-              localWindowsRuntimePreference: { kind: 'wsl', distro: 'Ubuntu' },
-              createdAt: 1,
-              updatedAt: 1
-            }
-          ],
-          getSettings: () => ({
-            ...store.getSettings(),
-            localWindowsRuntimeDefault: { kind: 'windows-host' }
+        const wsl = new OrcaRuntimeService(
+          withDurableRuntimeStore({
+            ...runtimeStore,
+            flushOrThrow: vi.fn(),
+            getProjects: () => [
+              {
+                id: 'project-wsl',
+                displayName: 'WSL',
+                badgeColor: 'blue',
+                sourceRepoIds: [TEST_REPO_ID],
+                localWindowsRuntimePreference: { kind: 'wsl' as const, distro: 'Ubuntu' },
+                createdAt: 1,
+                updatedAt: 1
+              }
+            ],
+            getSettings: () => ({
+              ...store.getSettings(),
+              localWindowsRuntimeDefault: { kind: 'windows-host' as const }
+            })
           })
-        } as never)
+        )
         wsl.registerPty('pty-wsl', TEST_WORKTREE_ID, null, undefined, true)
         wsl.onPtySpawned('pty-wsl', 'inc-wsl', { awaitsRegistration: false })
         wsl.setPtyController({
@@ -356,7 +419,9 @@ describe('OrcaRuntimeService', () => {
       tabsByWorktree: { [TEST_WORKTREE_ID]: [] }
     }
     const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     const processes = [
       ['pty-left', 'inc-left', 'term_left'],
       ['pty-right', 'inc-right', 'term_right'],
diff --git a/src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts
new file mode 100644
index 00000000000..ff340199770
--- /dev/null
+++ b/src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeService } from '../orca-runtime-test-mocks.spec'
+import { TEST_WORKTREE_PATH, store } from '../orca-runtime-test-fixtures.spec'
+
+// `agent.launch` settles a launch as failed only when its create threw before this hook ran.
+describe('OrcaRuntimeService createTerminal spawn dispatch', () => {
+  it('reports the spawn request before it leaves for the pty controller', async () => {
+    const dispatched = vi.fn()
+    const spawn = vi.fn(async () => {
+      expect(dispatched).toHaveBeenCalledOnce()
+      return { id: 'pty-dispatch' }
+    })
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      spawn,
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null
+    })
+
+    await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`, {
+      command: 'codex',
+      onPtySpawnDispatched: dispatched
+    })
+
+    expect(spawn).toHaveBeenCalledOnce()
+  })
+
+  it('reports it even when the spawn itself then fails', async () => {
+    const dispatched = vi.fn()
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      spawn: vi.fn(async () => {
+        throw new Error('ssh_channel_closed')
+      }),
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null
+    })
+
+    await expect(
+      runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`, {
+        command: 'codex',
+        onPtySpawnDispatched: dispatched
+      })
+    ).rejects.toThrow('ssh_channel_closed')
+    expect(dispatched).toHaveBeenCalledOnce()
+  })
+
+  it('does not report it when the create fails before any spawn request', async () => {
+    const dispatched = vi.fn()
+    const spawn = vi.fn()
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      spawn,
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null
+    })
+
+    await expect(
+      runtime.createTerminal('path:/no/such/workspace', {
+        command: 'codex',
+        onPtySpawnDispatched: dispatched
+      })
+    ).rejects.toThrow()
+    expect(spawn).not.toHaveBeenCalled()
+    expect(dispatched).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts b/src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts
index 78c4f072bb3..10cf9b4fbb9 100644
--- a/src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts
@@ -14,14 +14,18 @@ import {
   listWorktrees,
   listWorktreesStrict,
   lstat,
+  localWorktreeFilesystem,
+  mkdir,
   mkdtemp,
+  restoreLocalWatcherAfterFailedRemovalMock,
   registerSshGitProvider,
   removeWorktree,
   removeWorktreeLinkedPathsMock,
   rm,
   runHook,
   tmpdir,
-  unregisterSshGitProvider
+  unregisterSshGitProvider,
+  writeFile
 } from '../orca-runtime-test-mocks.spec'
 import type { WorktreeMeta } from '../orca-runtime-test-mocks.spec'
 import {
@@ -344,6 +348,158 @@ describe('OrcaRuntimeService', () => {
     expect(deleteWorktreeHistoryDirMock).toHaveBeenCalledWith(TEST_WORKTREE_ID)
   })
 
+  it('retains metadata when an unproven orphan directory survives cleanup', async () => {
+    const parentDir = await mkdtemp(join(tmpdir(), 'orca-runtime-orphan-retention-'))
+    const repoPath = join(parentDir, 'repo')
+    const orphanPath = join(parentDir, 'orphan')
+    const worktreeId = `${TEST_REPO_ID}::${orphanPath}`
+    await mkdir(orphanPath, { recursive: true })
+    const { runtimeStore, removeWorktreeMeta } = createStaleRuntimeWorktreeStore(worktreeId)
+    const runtimeStoreWithRepoPath = {
+      ...runtimeStore,
+      getRepos: () => [
+        {
+          id: TEST_REPO_ID,
+          path: repoPath,
+          displayName: 'repo',
+          badgeColor: 'blue',
+          addedAt: 1
+        }
+      ],
+      getRepo: (id: string) =>
+        id === TEST_REPO_ID
+          ? {
+              id: TEST_REPO_ID,
+              path: repoPath,
+              displayName: 'repo',
+              badgeColor: 'blue',
+              addedAt: 1
+            }
+          : undefined
+    }
+    const runtime = createWorktreeRemovalRuntime(runtimeStoreWithRepoPath)
+    const registeredWorktree = {
+      path: orphanPath,
+      head: 'abc',
+      branch: 'feature/orphan',
+      isBare: false,
+      isMainWorktree: false
+    }
+    vi.mocked(listWorktrees).mockResolvedValue([registeredWorktree])
+    vi.mocked(listWorktreesStrict).mockResolvedValue([registeredWorktree])
+    vi.mocked(removeWorktree).mockRejectedValue(
+      Object.assign(new Error('git worktree remove failed'), {
+        stderr: `fatal: '${orphanPath}' is not a working tree`
+      })
+    )
+    vi.mocked(assertWorktreeCleanForRemoval).mockRejectedValue(
+      Object.assign(new Error('status failed'), {
+        stderr: 'fatal: not a git repository (or any of the parent directories): .git\n'
+      })
+    )
+    const gitSpy = vi.spyOn(gitRunner, 'gitExecFileAsync').mockResolvedValue({
+      stdout: '',
+      stderr: ''
+    })
+    const pruneCallsBefore = gitSpy.mock.calls.filter(([args]) => args[0] === 'worktree').length
+
+    try {
+      await expect(runtime.removeManagedWorktree(worktreeId)).rejects.toThrow(
+        'Worktree is no longer registered with Git but its directory remains.'
+      )
+      await expect(lstat(orphanPath)).resolves.toBeTruthy()
+      expect(removeWorktreeMeta).not.toHaveBeenCalled()
+      expect(restoreLocalWatcherAfterFailedRemovalMock).toHaveBeenCalledWith(orphanPath)
+      expect(gitSpy.mock.calls.filter(([args]) => args[0] === 'worktree')).toHaveLength(
+        pruneCallsBefore
+      )
+
+      await rm(orphanPath, { recursive: true, force: true })
+      vi.mocked(listWorktrees).mockResolvedValue([])
+      await expect(runtime.removeManagedWorktree(worktreeId)).resolves.toEqual({})
+      expect(removeWorktreeMeta).toHaveBeenCalledWith(worktreeId, 'local')
+    } finally {
+      gitSpy.mockRestore()
+      await rm(parentDir, { recursive: true, force: true })
+    }
+  })
+
+  it('retains metadata when proven orphan cleanup cannot remove the directory', async () => {
+    const parentDir = await mkdtemp(join(tmpdir(), 'orca-runtime-orphan-removal-failure-'))
+    const repoPath = join(parentDir, 'repo')
+    const orphanPath = join(parentDir, 'orphan')
+    const adminWorktreePath = join(repoPath, '.git', 'worktrees', 'orphan')
+    const worktreeId = `${TEST_REPO_ID}::${orphanPath}`
+    await mkdir(orphanPath, { recursive: true })
+    await mkdir(adminWorktreePath, { recursive: true })
+    await writeFile(join(orphanPath, '.git'), `gitdir: ${adminWorktreePath}\n`)
+    await writeFile(join(adminWorktreePath, 'gitdir'), `${join(orphanPath, '.git')}\n`)
+    const { runtimeStore, removeWorktreeMeta } = createStaleRuntimeWorktreeStore(worktreeId)
+    const runtimeStoreWithRepoPath = {
+      ...runtimeStore,
+      getRepos: () => [
+        {
+          id: TEST_REPO_ID,
+          path: repoPath,
+          displayName: 'repo',
+          badgeColor: 'blue',
+          addedAt: 1
+        }
+      ],
+      getRepo: (id: string) =>
+        id === TEST_REPO_ID
+          ? {
+              id: TEST_REPO_ID,
+              path: repoPath,
+              displayName: 'repo',
+              badgeColor: 'blue',
+              addedAt: 1
+            }
+          : undefined
+    }
+    const runtime = createWorktreeRemovalRuntime(runtimeStoreWithRepoPath)
+    const registeredWorktree = {
+      path: orphanPath,
+      head: 'abc',
+      branch: 'feature/orphan',
+      isBare: false,
+      isMainWorktree: false
+    }
+    vi.mocked(listWorktrees).mockResolvedValue([registeredWorktree])
+    vi.mocked(listWorktreesStrict).mockResolvedValue([registeredWorktree])
+    vi.mocked(removeWorktree).mockRejectedValue(
+      Object.assign(new Error('git worktree remove failed'), {
+        stderr: `fatal: '${orphanPath}' is not a working tree`
+      })
+    )
+    vi.mocked(assertWorktreeCleanForRemoval).mockRejectedValue(
+      Object.assign(new Error('status failed'), {
+        stderr: 'fatal: not a git repository (or any of the parent directories): .git\n'
+      })
+    )
+    const removePathSpy = vi
+      .spyOn(localWorktreeFilesystem, 'removeLocalWorktreePath')
+      .mockRejectedValue(new Error('injected removal failure'))
+    const gitSpy = vi.spyOn(gitRunner, 'gitExecFileAsync').mockResolvedValue({
+      stdout: '',
+      stderr: ''
+    })
+
+    try {
+      await expect(runtime.removeManagedWorktree(worktreeId)).rejects.toThrow(
+        'Worktree is no longer registered with Git but its directory remains.'
+      )
+      await expect(lstat(orphanPath)).resolves.toBeTruthy()
+      expect(removePathSpy).toHaveBeenCalledWith(orphanPath, {})
+      expect(removeWorktreeMeta).not.toHaveBeenCalled()
+      expect(gitSpy).not.toHaveBeenCalledWith(['worktree', 'prune'], expect.anything())
+    } finally {
+      removePathSpy.mockRestore()
+      gitSpy.mockRestore()
+      await rm(parentDir, { recursive: true, force: true })
+    }
+  })
+
   it('drops the bounded scan cache when orphan-cleanup removal completes', async () => {
     const runtime = createWorktreeRemovalRuntime()
     vi.mocked(getEffectiveHooks).mockReturnValue(null)
diff --git a/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts b/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts
index cc73ffa2718..5a5c9521403 100644
--- a/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts
@@ -418,7 +418,11 @@ describe('OrcaRuntimeService', () => {
     await Promise.resolve()
     await Promise.resolve()
 
-    expect(write).toHaveBeenCalledWith('pty-startup-draft', `\x1b[200~${draftUrl}\x1b[201~`)
+    expect(write).toHaveBeenCalledWith(
+      'pty-startup-draft',
+      `\x1b[200~${draftUrl}\x1b[201~`,
+      'launch'
+    )
   })
 
   it('keeps the 8s main-runtime startup readiness budget for agents without an override', async () => {
@@ -554,7 +558,11 @@ describe('OrcaRuntimeService', () => {
     await Promise.resolve()
     await Promise.resolve()
 
-    expect(write).toHaveBeenCalledWith('pty-opencode-draft-budget', `\x1b[200~${draftUrl}\x1b[201~`)
+    expect(write).toHaveBeenCalledWith(
+      'pty-opencode-draft-budget',
+      `\x1b[200~${draftUrl}\x1b[201~`,
+      'launch'
+    )
   })
 
   it('rejects explicit startup commands for disabled selected agents', async () => {
diff --git a/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-04.spec.ts b/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-04.spec.ts
index 2ec8e73f800..d3d2ee8b44a 100644
--- a/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-04.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-04.spec.ts
@@ -83,7 +83,7 @@ describe('OrcaRuntimeService', () => {
       })
     )
     await vi.waitFor(() => {
-      expect(write).toHaveBeenCalledWith('pty-cli-aider-startup', 'fix it\r')
+      expect(write).toHaveBeenCalledWith('pty-cli-aider-startup', 'fix it\r', 'launch')
     })
   })
 
@@ -509,6 +509,7 @@ describe('OrcaRuntimeService', () => {
       repoSelector: 'id:repo-1',
       name: 'runtime-explicit-draft',
       startupDraft: draftUrl,
+      startupLaunchSource: 'cli',
       createdWithAgent: 'codex',
       activate: true
     })
@@ -519,14 +520,20 @@ describe('OrcaRuntimeService', () => {
       expect.objectContaining({
         cwd: '/tmp/workspaces/runtime-explicit-draft',
         command: "codex '--dangerously-bypass-approvals-and-sandbox'",
-        worktreeId: result.worktree.id
+        worktreeId: result.worktree.id,
+        // The host picked and launched this agent, so it carries the caller's surface too.
+        telemetry: { agent_kind: 'codex', launch_source: 'cli', request_kind: 'new' }
       })
     )
     expect(metaById[result.worktree.id]).toMatchObject({ createdWithAgent: 'codex' })
 
     runtime.onPtyData('pty-explicit-draft', '\x1b[?2004h›', Date.now())
     await vi.waitFor(() => {
-      expect(write).toHaveBeenCalledWith('pty-explicit-draft', `\x1b[200~${draftUrl}\x1b[201~`)
+      expect(write).toHaveBeenCalledWith(
+        'pty-explicit-draft',
+        `\x1b[200~${draftUrl}\x1b[201~`,
+        'launch'
+      )
     })
   })
 
diff --git a/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-05.spec.ts b/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-05.spec.ts
index c4ac5ea9a84..1658c8690c7 100644
--- a/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-05.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-05.spec.ts
@@ -122,7 +122,7 @@ describe('OrcaRuntimeService', () => {
     expect(metaById[result.worktree.id]).toMatchObject({ createdWithAgent: 'claude' })
   })
 
-  it('pre-marks remote Codex workspaces trusted before pasting startup drafts', async () => {
+  it('launches a remote Codex startup draft with its declared agent on the SSH host', async () => {
     detectRemoteAgentsMock.mockResolvedValue(['codex'])
     muxRequestMock.mockResolvedValue({ resolvedPath: '/home/dev' })
     const created = {
@@ -189,7 +189,11 @@ describe('OrcaRuntimeService', () => {
     }
     const fsProvider = {
       realpath: vi.fn().mockResolvedValue('/remote/mobile-codex-draft'),
-      readFile: vi.fn().mockRejectedValue(new Error('missing config')),
+      readFile: vi
+        .fn()
+        .mockRejectedValue(
+          new Error("ENOENT: no such file or directory, stat '/home/dev/.codex/config.toml'")
+        ),
       createDir: vi.fn().mockResolvedValue(undefined),
       writeFile: vi.fn().mockResolvedValue(undefined)
     }
@@ -212,27 +216,16 @@ describe('OrcaRuntimeService', () => {
       })
 
       expect(detectRemoteAgentsMock).not.toHaveBeenCalled()
-      expect(muxRequestMock).toHaveBeenCalledWith('session.resolveHome', { path: '~' })
-      expect(fsProvider.createDir).toHaveBeenCalledWith('/home/dev/.codex')
-      expect(fsProvider.writeFile).toHaveBeenCalledWith(
-        '/home/dev/.codex/config.toml',
-        expect.stringContaining('[projects."/remote/mobile-codex-draft"]')
-      )
-      expect(fsProvider.writeFile).toHaveBeenCalledWith(
-        '/home/dev/.codex/config.toml',
-        expect.stringContaining('trust_level = "trusted"')
-      )
       expect(spawn).toHaveBeenCalledWith(
         expect.objectContaining({
           cwd: '/remote/mobile-codex-draft',
           command: "codex '--dangerously-bypass-approvals-and-sandbox'",
           connectionId: 'ssh-1',
-          worktreeId: result.worktree.id
+          worktreeId: result.worktree.id,
+          // The spawn builder pre-trusts the workspace on the SSH host for this agent.
+          launchAgent: 'codex'
         })
       )
-      expect(fsProvider.writeFile.mock.invocationCallOrder[0]).toBeLessThan(
-        spawn.mock.invocationCallOrder[0]!
-      )
       expect(metaById[result.worktree.id]).toMatchObject({ createdWithAgent: 'codex' })
     } finally {
       unregisterSshFilesystemProvider('ssh-1')
@@ -240,7 +233,7 @@ describe('OrcaRuntimeService', () => {
     }
   })
 
-  it('pre-marks remote Codex workspaces trusted before explicit startup commands', async () => {
+  it('launches a remote explicit Codex startup command with its declared agent on the SSH host', async () => {
     muxRequestMock.mockResolvedValue({ resolvedPath: '/home/dev' })
     const created = {
       path: '/remote/mobile-codex-command',
@@ -302,7 +295,11 @@ describe('OrcaRuntimeService', () => {
     }
     const fsProvider = {
       realpath: vi.fn().mockResolvedValue('/remote/mobile-codex-command'),
-      readFile: vi.fn().mockRejectedValue(new Error('missing config')),
+      readFile: vi
+        .fn()
+        .mockRejectedValue(
+          new Error("ENOENT: no such file or directory, stat '/home/dev/.codex/config.toml'")
+        ),
       createDir: vi.fn().mockResolvedValue(undefined),
       writeFile: vi.fn().mockResolvedValue(undefined)
     }
@@ -326,26 +323,16 @@ describe('OrcaRuntimeService', () => {
       })
 
       expect(detectRemoteAgentsMock).not.toHaveBeenCalled()
-      expect(muxRequestMock).toHaveBeenCalledWith('session.resolveHome', { path: '~' })
-      expect(fsProvider.writeFile).toHaveBeenCalledWith(
-        '/home/dev/.codex/config.toml',
-        expect.stringContaining('[projects."/remote/mobile-codex-command"]')
-      )
-      expect(fsProvider.writeFile).toHaveBeenCalledWith(
-        '/home/dev/.codex/config.toml',
-        expect.stringContaining('trust_level = "trusted"')
-      )
       expect(spawn).toHaveBeenCalledWith(
         expect.objectContaining({
           cwd: '/remote/mobile-codex-command',
           command: 'codex',
           connectionId: 'ssh-1',
-          worktreeId: result.worktree.id
+          worktreeId: result.worktree.id,
+          // The spawn builder pre-trusts the workspace on the SSH host for this agent.
+          launchAgent: 'codex'
         })
       )
-      expect(fsProvider.writeFile.mock.invocationCallOrder[0]).toBeLessThan(
-        spawn.mock.invocationCallOrder[0]!
-      )
       expect(metaById[result.worktree.id]).toMatchObject({ createdWithAgent: 'codex' })
     } finally {
       unregisterSshFilesystemProvider('ssh-1')
diff --git a/src/main/runtime/orca-runtime-touch-mobile-session-tabs-for-worktree.ts b/src/main/runtime/orca-runtime-touch-mobile-session-tabs-for-worktree.ts
index 7a08f8f3bac..3c18eb68def 100644
--- a/src/main/runtime/orca-runtime-touch-mobile-session-tabs-for-worktree.ts
+++ b/src/main/runtime/orca-runtime-touch-mobile-session-tabs-for-worktree.ts
@@ -27,8 +27,8 @@ export class OrcaRuntimeWithTouchMobileSessionTabsForWorktree extends OrcaRuntim
       snapshotVersion: snapshot.snapshotVersion + 1
     })
     if (options.immediate) {
-      // Why: readiness/lifecycle changes are structural and must not wait
-      // behind the title/status coalescing window.
+      // Why: an exit is structural and must not wait behind the title/status window. A
+      // registration's ready flip coalesces so it merges with the spawn's graph update.
       this.notifyMobileSessionTabsChanged(worktreeId)
       return
     }
@@ -126,7 +126,11 @@ export class OrcaRuntimeWithTouchMobileSessionTabsForWorktree extends OrcaRuntim
           tab.parentTabId,
           tab.leafId,
           tab.ptyId
-        )
+        ) ||
+        // Why: after a cold restore the saved session is the only membership record until the PTY
+        // registers. Frame-only; once listed, the surface's graph leaves pass the shared predicate
+        // like any listed surface's. Host-side single-writer membership absorbs this.
+        this.hasPersistedTerminalSurfaceMembership(snapshot.worktree, tab.parentTabId, tab.leafId)
       ) {
         continue
       }
diff --git a/src/main/runtime/orca-runtime-visible-snapshot-preview.ts b/src/main/runtime/orca-runtime-visible-snapshot-preview.ts
index ac9eb99a67b..be14a92c319 100644
--- a/src/main/runtime/orca-runtime-visible-snapshot-preview.ts
+++ b/src/main/runtime/orca-runtime-visible-snapshot-preview.ts
@@ -140,6 +140,24 @@ export class OrcaRuntimeWithVisibleSnapshotPreview extends OrcaRuntimeWithCaptur
     }
   }
 
+  /** Synchronous visible grid of the live emulator, for tui-idle body evidence. Null when the
+   *  model is not the whole screen: a provider-restored partial suffix or a pending hydration. */
+  protected readLiveTerminalScreenLines(ptyId: string | null | undefined): string[] | null {
+    if (!ptyId) {
+      return null
+    }
+    const state = this.headlessTerminals.get(ptyId)
+    if (
+      !state ||
+      this.providerSnapshotPreferredPtys.has(ptyId) ||
+      this.headlessHydrationState.get(ptyId) === 'pending'
+    ) {
+      return null
+    }
+    // Why unawaited writeChain: callers are synchronous; a grid one chunk behind is re-read next poll.
+    return projectTerminalVisibleLines(state.emulator).lines
+  }
+
   protected async parseVisibleSnapshot(snapshot: {
     data: string
     cols: number
diff --git a/src/main/runtime/orca-runtime-wait-for-leaf-pty-id.ts b/src/main/runtime/orca-runtime-wait-for-leaf-pty-id.ts
index 37ac8c5a839..b3749ec6dba 100644
--- a/src/main/runtime/orca-runtime-wait-for-leaf-pty-id.ts
+++ b/src/main/runtime/orca-runtime-wait-for-leaf-pty-id.ts
@@ -142,16 +142,6 @@ export class OrcaRuntimeWithWaitForLeafPtyId extends OrcaRuntimeWithRestoreLiveP
   }
 
   // Why: a leaf exists before its PTY spawns; a handle issued while ptyId is null gets invalidated on the next sync, so wait for a connected PTY.
-  protected countLeavesInTab(tabId: string): number {
-    let count = 0
-    for (const leaf of this.leaves.values()) {
-      if (leaf.tabId === tabId) {
-        count++
-      }
-    }
-    return count
-  }
-
   protected resolveHandleForTab(tabId: string): string | null {
     for (const leaf of this.leaves.values()) {
       if (leaf.tabId === tabId && leaf.ptyId !== null) {
diff --git a/src/main/runtime/orca-runtime-write-terminal-agent-prompt.ts b/src/main/runtime/orca-runtime-write-terminal-agent-prompt.ts
index 5e90602755c..1597084eee1 100644
--- a/src/main/runtime/orca-runtime-write-terminal-agent-prompt.ts
+++ b/src/main/runtime/orca-runtime-write-terminal-agent-prompt.ts
@@ -27,7 +27,7 @@ export class OrcaRuntimeWithWriteTerminalAgentPrompt extends OrcaRuntimeWithReso
     ptyId: string,
     generation: number,
     pastePayload: string,
-    options: RuntimeAgentPromptWriteOptions = {}
+    options: RuntimeAgentPromptWriteOptions
   ): Promise<{ submits: number; prompt?: RuntimeTerminalPromptDelivery }> {
     assertAgentPromptRequestActive(options.signal)
     this.assertAgentPromptGeneration(ptyId, generation)
@@ -62,7 +62,7 @@ export class OrcaRuntimeWithWriteTerminalAgentPrompt extends OrcaRuntimeWithReso
       // beginning when a large frame is split into independently processed chunks.
       renderGate?.arm()
       const initialWrite = submitWithPaste ? pastePayload + AGENT_PROMPT_SUBMIT : pastePayload
-      if (!this.ptyController?.write(ptyId, initialWrite)) {
+      if (!this.ptyController?.write(ptyId, initialWrite, options.inputKind)) {
         throw new Error('terminal_not_writable')
       }
     } catch (error) {
@@ -103,7 +103,7 @@ export class OrcaRuntimeWithWriteTerminalAgentPrompt extends OrcaRuntimeWithReso
     const baseline = preSubmitBaseline ?? this.getAgentPromptActivity(handle, ptyId, waitTextCache)
     this.assertAgentPromptPermissionSafe(permissionBaseline, baseline)
     if (!submitWithPaste) {
-      if (!this.ptyController?.write(ptyId, AGENT_PROMPT_SUBMIT)) {
+      if (!this.ptyController?.write(ptyId, AGENT_PROMPT_SUBMIT, options.inputKind)) {
         throw new Error(options.suffixFailureError ?? 'terminal_not_writable')
       }
     }
diff --git a/src/main/runtime/orca-runtime.test.ts b/src/main/runtime/orca-runtime.test.ts
index 13796169be0..070363fdb3f 100644
--- a/src/main/runtime/orca-runtime.test.ts
+++ b/src/main/runtime/orca-runtime.test.ts
@@ -51,6 +51,7 @@ await import('./orca-runtime-tests/terminal-creation-and-readiness-part-09.spec'
 await import('./orca-runtime-tests/terminal-creation-and-readiness-part-10.spec')
 await import('./orca-runtime-tests/terminal-creation-and-readiness-part-11.spec')
 await import('./orca-runtime-tests/terminal-creation-and-readiness-part-12.spec')
+await import('./orca-runtime-tests/terminal-spawn-dispatch.spec')
 await import('./orca-runtime-tests/terminal-output-and-worker-recovery.spec')
 await import('./orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec')
 await import('./orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec')
@@ -78,6 +79,7 @@ await import('./orca-runtime-tests/mobile-session-tabs-part-10.spec')
 await import('./orca-runtime-tests/mobile-session-tabs-part-11.spec')
 await import('./orca-runtime-tests/mobile-session-tabs-part-12.spec')
 await import('./orca-runtime-tests/mobile-session-tabs-part-13.spec')
+await import('./orca-runtime-tests/exit-retirement-activation.spec')
 await import('./orca-runtime-tests/mobile-creation-and-orchestration.spec')
 await import('./orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec')
 await import('./orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec')
diff --git a/src/main/runtime/orchestration/canonical-orca-session-id.ts b/src/main/runtime/orchestration/canonical-orca-session-id.ts
new file mode 100644
index 00000000000..4aee8cbea15
--- /dev/null
+++ b/src/main/runtime/orchestration/canonical-orca-session-id.ts
@@ -0,0 +1,38 @@
+import { isOrcaSessionId, type OrcaSessionId } from '../../../shared/orca-session-address'
+import {
+  clearedInto,
+  readAgentSessionRecordStore,
+  type AgentSessionRecordReader
+} from './structured-session-lineage'
+
+/**
+ * The Orca session id orchestration addresses a session by: the first session of its `/clear`
+ * lineage, so a cleared chat keeps the address, Runs and mail it had. Every session-to-party step
+ * calls this. Without a record store there is no lineage to read, and the id stands for itself.
+ */
+export function canonicalOrcaSessionId(
+  orcaSessionId: OrcaSessionId,
+  store: AgentSessionRecordReader | null = readAgentSessionRecordStore()
+): OrcaSessionId {
+  if (!store) {
+    return orcaSessionId
+  }
+  const clearedFrom = new Map<string, string>()
+  for (const record of store.listRecords()) {
+    const next = clearedInto(record)
+    if (next) {
+      clearedFrom.set(next, record.sessionId)
+    }
+  }
+  // A clear chain is acyclic by construction; the visited set only bounds a corrupt store.
+  let root: string = orcaSessionId
+  const earlier = new Set([root])
+  let prior = clearedFrom.get(root)
+  while (prior && !earlier.has(prior)) {
+    earlier.add(prior)
+    root = prior
+    prior = clearedFrom.get(root)
+  }
+  // Record ids are minted as Orca session ids; one that is not cannot name the conversation.
+  return isOrcaSessionId(root) ? root : orcaSessionId
+}
diff --git a/src/main/runtime/orchestration/cli-command.ts b/src/main/runtime/orchestration/cli-command.ts
index 809be9a4b88..af38b95a350 100644
--- a/src/main/runtime/orchestration/cli-command.ts
+++ b/src/main/runtime/orchestration/cli-command.ts
@@ -1,9 +1,20 @@
 import type { ProjectExecutionRuntimeResolution } from '../../../shared/project-execution-runtime'
 import { isWslUncPath } from '../../../shared/wsl-paths'
 import { splitWorktreeIdForFilesystem } from '../../../shared/worktree/id'
+import { getAppEnvironment, hasAppEnvironment } from '../../../shared/app-environment'
 
 export type OrchestrationCliCommand = 'orca' | 'orca-dev' | 'orca-ide'
 
+/** Dev builds run the CLI as `orca-dev`; a packaged app, or a process with no app, must not advertise it. */
+export function runtimeOrchestrationCliCommand(): OrchestrationCliCommand | undefined {
+  return hasAppEnvironment() && !getAppEnvironment().isPackaged() ? 'orca-dev' : undefined
+}
+
+/** What a local, non-WSL terminal is told to run; a structured session is always one. */
+export function localOrchestrationCliCommand(): OrchestrationCliCommand {
+  return runtimeOrchestrationCliCommand() ?? 'orca'
+}
+
 export function resolveTerminalOrchestrationCliCommand(args: {
   connectionId: string | null
   isWsl: boolean | null | undefined
diff --git a/src/main/runtime/orchestration/coordinator-runtime-contract.ts b/src/main/runtime/orchestration/coordinator-runtime-contract.ts
index 2f4f5bf9b5a..3c98fa30200 100644
--- a/src/main/runtime/orchestration/coordinator-runtime-contract.ts
+++ b/src/main/runtime/orchestration/coordinator-runtime-contract.ts
@@ -11,7 +11,7 @@ export type CoordinatorRuntime = {
   sendTerminalAgentPrompt(
     handle: string,
     prompt: string,
-    options?: DispatchPreambleSendOptions
+    options: DispatchPreambleSendOptions
   ): Promise<unknown>
   listTerminals(
     worktreeSelector?: string,
diff --git a/src/main/runtime/orchestration/coordinator-task-dispatch.ts b/src/main/runtime/orchestration/coordinator-task-dispatch.ts
index bb64f6dd98b..a305afedf40 100644
--- a/src/main/runtime/orchestration/coordinator-task-dispatch.ts
+++ b/src/main/runtime/orchestration/coordinator-task-dispatch.ts
@@ -32,7 +32,7 @@ export async function listAvailableWorkerTerminals(
   runtime: CoordinatorRuntime,
   coordinatorHandle: string,
   worktree: string | undefined
-): Promise<string[]> {
+): Promise<string[] | null> {
   try {
     const result = await runtime.listTerminals(worktree, undefined, {
       includeVisualLayouts: false
@@ -55,7 +55,8 @@ export async function listAvailableWorkerTerminals(
       )
       .map((t) => t.handle)
   } catch {
-    return []
+    // A failed census cannot authorize creating another worker.
+    return null
   }
 }
 
diff --git a/src/main/runtime/orchestration/coordinator-terminal-census-unavailable.test.ts b/src/main/runtime/orchestration/coordinator-terminal-census-unavailable.test.ts
new file mode 100644
index 00000000000..49b34814144
--- /dev/null
+++ b/src/main/runtime/orchestration/coordinator-terminal-census-unavailable.test.ts
@@ -0,0 +1,84 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { Coordinator } from './coordinator'
+import type { CoordinatorRuntime } from './coordinator-runtime-contract'
+import { OrchestrationDb } from './db'
+
+afterEach(() => vi.useRealTimers())
+
+describe('coordinator terminal census availability', () => {
+  it.each(['terminal_surface_ownership_unavailable', 'terminal_liveness_unavailable'])(
+    'defers dispatch on %s and reuses the existing worker after recovery',
+    async (error) => {
+      vi.useFakeTimers()
+      const db = new OrchestrationDb(':memory:')
+      const task = db.createTask({ runId: 'run_legacy_local', spec: 'implement the feature' })
+      const listTerminals = vi
+        .fn<CoordinatorRuntime['listTerminals']>()
+        .mockRejectedValueOnce(new Error(error))
+        .mockResolvedValue({
+          terminals: [
+            { handle: 'term_existing', worktreeId: 'wt1', connected: true, writable: true }
+          ]
+        })
+      const createTerminal = vi.fn<CoordinatorRuntime['createTerminal']>(async () => ({
+        handle: 'term_unnecessary',
+        worktreeId: 'wt1'
+      }))
+      const sendTerminalAgentPrompt = vi.fn<CoordinatorRuntime['sendTerminalAgentPrompt']>(
+        async () => ({ accepted: true })
+      )
+      const runtime: CoordinatorRuntime = {
+        listTerminals,
+        createTerminal,
+        sendTerminalAgentPrompt,
+        waitForTerminal: async (handle) => ({ handle, condition: 'exit' }),
+        probeWorktreeDrift: async () => null
+      }
+      const coordinator = new Coordinator(db, runtime, {
+        spec: 'go',
+        coordinatorHandle: 'coord',
+        pollIntervalMs: 1000,
+        worktree: 'wt1'
+      })
+      const run = coordinator.run()
+      try {
+        await vi.advanceTimersByTimeAsync(0)
+        expect(listTerminals).toHaveBeenCalledTimes(1)
+        expect(createTerminal).not.toHaveBeenCalled()
+        expect(sendTerminalAgentPrompt).not.toHaveBeenCalled()
+        expect(db.getTask(task.id)?.status).toBe('ready')
+        expect(db.listTasks({ status: 'dispatched' })).toEqual([])
+
+        await vi.advanceTimersByTimeAsync(1000)
+        expect(listTerminals).toHaveBeenCalledTimes(2)
+        expect(createTerminal).not.toHaveBeenCalled()
+        expect(sendTerminalAgentPrompt).toHaveBeenCalledTimes(1)
+        const dispatch = db.getDispatchContext(task.id)
+        expect(dispatch?.assignee_handle).toBe('term_existing')
+        expect(db.getTask(task.id)?.status).toBe('dispatched')
+        db.insertMessage({
+          runId: 'run_legacy_local',
+          from: 'term_existing',
+          to: 'coord',
+          subject: 'Done',
+          type: 'worker_done',
+          payload: JSON.stringify({
+            taskId: task.id,
+            dispatchId: dispatch?.id,
+            outcome: 'succeeded'
+          })
+        })
+        await vi.advanceTimersByTimeAsync(1000)
+        await expect(run).resolves.toMatchObject({ status: 'completed', completedTasks: [task.id] })
+      } finally {
+        coordinator.stop()
+        try {
+          await vi.runOnlyPendingTimersAsync()
+          await run
+        } finally {
+          db.close()
+        }
+      }
+    }
+  )
+})
diff --git a/src/main/runtime/orchestration/coordinator.ts b/src/main/runtime/orchestration/coordinator.ts
index 252c9f89ea9..915dc9e16a4 100644
--- a/src/main/runtime/orchestration/coordinator.ts
+++ b/src/main/runtime/orchestration/coordinator.ts
@@ -245,6 +245,9 @@ export class Coordinator {
       this.opts.coordinatorHandle,
       this.opts.worktree
     )
+    if (terminals === null) {
+      return
+    }
     if (terminals.length === 0 && slotsAvailable > 0) {
       // Why: create at most one terminal per tick to avoid spawning many at once.
       try {
diff --git a/src/main/runtime/orchestration/db/dispatch-context/dispatch-context-store.ts b/src/main/runtime/orchestration/db/dispatch-context/dispatch-context-store.ts
index 38905f30434..b51e5b4a8aa 100644
--- a/src/main/runtime/orchestration/db/dispatch-context/dispatch-context-store.ts
+++ b/src/main/runtime/orchestration/db/dispatch-context/dispatch-context-store.ts
@@ -9,6 +9,7 @@ import { recordedCreatorIdentity, type DispatchCreator } from '../dispatch-depth
 import type { OrchestrationDb } from '../orchestration-db'
 import { transitionLifecycleWithDb } from '../lifecycle-transition'
 import { taskNotFoundError, taskNotStartableError } from '../../task-dispatch-refusal'
+import { dispatchAssigneeOrcaSessionId } from '../../dispatch-assignee-orca-session-id'
 
 export function createDispatchContext(
   this: OrchestrationDb,
@@ -65,6 +66,7 @@ export function createDispatchContext(
       launchTokenHash: launchTokenHash ?? null,
       assigneeHandle,
       assigneePaneKey: assigneePaneKey ?? null,
+      assigneeOrcaSessionId: dispatchAssigneeOrcaSessionId(processIncarnation),
       processIncarnation: processIncarnation ?? null,
       creatorDispatchId,
       ...recordedCreatorIdentity(params.creator),
diff --git a/src/main/runtime/orchestration/db/dispatch-depth.ts b/src/main/runtime/orchestration/db/dispatch-depth.ts
index cc4ba026db9..93c5bd65fb6 100644
--- a/src/main/runtime/orchestration/db/dispatch-depth.ts
+++ b/src/main/runtime/orchestration/db/dispatch-depth.ts
@@ -7,6 +7,7 @@ import {
 import { OrchestrationError } from '../orchestration-error'
 import { isEquivalentPaneKey } from './pane-key-match'
 import type { OrchestrationDb } from './orchestration-db'
+import type { OrcaSessionId } from '../../../../shared/orca-session-address'
 import type { DispatchContextRow, RemoteDispatchAttachmentRow } from '../types'
 import { potentiallyLiveRemoteAttachmentSql } from './federation/remote-attachment-liveness'
 
@@ -26,17 +27,33 @@ export type DispatchCreator =
       paneKey?: string
       /** Remote attachment matching requires the exact incarnation; local rows do not. */
       processIncarnation?: string
+      /** A structured worker's bare Orca session id, recorded beside its handle. */
+      orcaSessionId?: OrcaSessionId | null
     }
+  /** A structured session with no terminal handle, identified by its Orca session id alone. */
+  | { kind: 'session'; orcaSessionId: OrcaSessionId }
 
 /** Creator identity to persist on a new row, so depth can later tell delegation from bookkeeping. */
 export function recordedCreatorIdentity(creator: DispatchCreator): {
   creatorHandle: string | null
   creatorPaneKey: string | null
+  creatorOrcaSessionId: OrcaSessionId | null
 } {
   if (creator.kind === 'system') {
-    return { creatorHandle: null, creatorPaneKey: null }
+    return { creatorHandle: null, creatorPaneKey: null, creatorOrcaSessionId: null }
+  }
+  if (creator.kind === 'session') {
+    return {
+      creatorHandle: null,
+      creatorPaneKey: null,
+      creatorOrcaSessionId: creator.orcaSessionId
+    }
+  }
+  return {
+    creatorHandle: creator.handle,
+    creatorPaneKey: creator.paneKey ?? null,
+    creatorOrcaSessionId: creator.orcaSessionId ?? null
   }
-  return { creatorHandle: creator.handle, creatorPaneKey: creator.paneKey ?? null }
 }
 
 /**
@@ -84,14 +101,14 @@ export function resolveCreatorDepth(this: OrchestrationDb, creator: DispatchCrea
   // Local rows match on handle/pane as they always have. process_incarnation is
   // nullable here and context-only dispatch stores null deliberately, so
   // requiring it would drop real parents.
-  const local = this.findActiveDispatchForAssignee(creator.handle, creator.paneKey) as
-    | DispatchContextRow
-    | undefined
+  const local = findActiveDispatchForCreator.call(this, creator)
   if (local && !isSelfCreatedDispatch(local)) {
     depths.push(local.depth)
   }
 
-  for (const attachment of findPotentiallyLiveAttachmentsForCreator.call(this, creator)) {
+  const attachments =
+    creator.kind === 'terminal' ? findPotentiallyLiveAttachmentsForCreator.call(this, creator) : []
+  for (const attachment of attachments) {
     depths.push(attachment.depth)
   }
 
@@ -109,16 +126,36 @@ export function resolveCreatorDispatchId(
   if (creator.kind === 'system') {
     return null
   }
-  const own = this.findActiveDispatchForAssignee(creator.handle, creator.paneKey)
+  const own = findActiveDispatchForCreator.call(this, creator)
   // Why: a self-dispatch is not a parent Attempt, so it must not be stamped as the child's creator.
   const local = own && !isSelfCreatedDispatch(own) ? own : undefined
-  const remote = findPotentiallyLiveAttachmentsForCreator.call(this, creator)
+  const remote =
+    creator.kind === 'terminal' ? findPotentiallyLiveAttachmentsForCreator.call(this, creator) : []
   if ((local ? 1 : 0) + remote.length !== 1) {
     return null
   }
   return local?.id ?? remote[0]?.dispatch_id ?? null
 }
 
+/** The live Dispatch this creator is itself working on, found the way its identity is recorded. */
+function findActiveDispatchForCreator(
+  this: OrchestrationDb,
+  creator: Exclude<DispatchCreator, { kind: 'system' }>
+): DispatchContextRow | undefined {
+  if (creator.kind === 'terminal') {
+    return this.findActiveDispatchForAssignee(creator.handle, creator.paneKey)
+  }
+  const row = this.db
+    .prepare(
+      `SELECT * FROM dispatch_contexts
+       WHERE assignee_orca_session_id = ? AND status IN ('pending', 'dispatched')
+       ORDER BY rowid DESC LIMIT 1`
+    )
+    .get(creator.orcaSessionId)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: SELECT * over this table returns the row shape its schema and row type define, like every row cast in db/.
+  return row as DispatchContextRow | undefined
+}
+
 /**
  * Remote attachments matching this caller's pane AND exact process incarnation.
  *
diff --git a/src/main/runtime/orchestration/db/dispatch-row-writer.ts b/src/main/runtime/orchestration/db/dispatch-row-writer.ts
index 84862ee343d..e8e4192e137 100644
--- a/src/main/runtime/orchestration/db/dispatch-row-writer.ts
+++ b/src/main/runtime/orchestration/db/dispatch-row-writer.ts
@@ -1,5 +1,6 @@
 import type Database from '../../../sqlite/sync-database'
 import { DISPATCH_PANE_KEY_MATCH_SUFFIX_SQL } from './pane-key-match'
+import type { OrcaSessionId } from '../../../../shared/orca-session-address'
 
 /**
  * The only place that inserts rows representing a live supervised worker.
@@ -14,11 +15,11 @@ import { DISPATCH_PANE_KEY_MATCH_SUFFIX_SQL } from './pane-key-match'
 
 export const DISPATCH_CONTEXT_CLAIM_SQL = `INSERT INTO dispatch_contexts (
   id, run_id, task_id, contract_version, launch_token_hash,
-  assignee_handle, assignee_pane_key, process_incarnation,
-  creator_dispatch_id, creator_handle, creator_pane_key,
+  assignee_handle, assignee_pane_key, assignee_orca_session_id, process_incarnation,
+  creator_dispatch_id, creator_handle, creator_pane_key, creator_orca_session_id,
   status, failure_count, depth, dispatched_at
 )
-SELECT ?, run_id, id, ?, ?, ?, ?, ?, ?, ?, ?, 'dispatched', ?, ?, datetime('now')
+SELECT ?, run_id, id, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'dispatched', ?, ?, datetime('now')
 FROM tasks
 WHERE id = ? AND status = 'ready'
   AND NOT EXISTS (
@@ -45,8 +46,9 @@ WHERE id = ? AND status = 'ready'
 
 const STARTING_DISPATCH_CONTEXT_SQL = `INSERT INTO dispatch_contexts (
    id, run_id, task_id, contract_version, launch_token_hash, retry_of_dispatch_id,
-   creator_dispatch_id, creator_handle, creator_pane_key, depth, status, dispatched_at
- ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', datetime('now'))`
+   creator_dispatch_id, creator_handle, creator_pane_key, creator_orca_session_id, depth, status,
+   dispatched_at
+ ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', datetime('now'))`
 
 const REMOTE_DISPATCH_ATTACHMENT_SQL = `INSERT INTO remote_dispatch_attachments (
    dispatch_id, home_run_id, task_id, home_peer_fingerprint, protocol_version, runtime_epoch, depth
@@ -70,10 +72,12 @@ export function claimDispatchContextRow(
     launchTokenHash: string | null
     assigneeHandle: string
     assigneePaneKey: string | null
+    assigneeOrcaSessionId?: OrcaSessionId | null
     processIncarnation: string | null
     creatorDispatchId?: string | null
     creatorHandle?: string | null
     creatorPaneKey?: string | null
+    creatorOrcaSessionId?: OrcaSessionId | null
     priorFailures: number
     depth: number
     taskId: string
@@ -89,10 +93,12 @@ export function claimDispatchContextRow(
       params.launchTokenHash,
       params.assigneeHandle,
       params.assigneePaneKey,
+      params.assigneeOrcaSessionId ?? null,
       params.processIncarnation,
       params.creatorDispatchId ?? null,
       params.creatorHandle ?? null,
       params.creatorPaneKey ?? null,
+      params.creatorOrcaSessionId ?? null,
       params.priorFailures,
       params.depth,
       params.taskId,
@@ -118,6 +124,7 @@ export function insertStartingDispatchContextRow(
     creatorDispatchId?: string | null
     creatorHandle?: string | null
     creatorPaneKey?: string | null
+    creatorOrcaSessionId?: OrcaSessionId | null
   }
 ): void {
   assertStampedDepth(params.depth)
@@ -131,6 +138,7 @@ export function insertStartingDispatchContextRow(
     params.creatorDispatchId ?? null,
     params.creatorHandle ?? null,
     params.creatorPaneKey ?? null,
+    params.creatorOrcaSessionId ?? null,
     params.depth
   )
 }
diff --git a/src/main/runtime/orchestration/db/messages/direct-mailbox-routing.ts b/src/main/runtime/orchestration/db/messages/direct-mailbox-routing.ts
index aa7d93fbea2..c1e5ee99562 100644
--- a/src/main/runtime/orchestration/db/messages/direct-mailbox-routing.ts
+++ b/src/main/runtime/orchestration/db/messages/direct-mailbox-routing.ts
@@ -1,6 +1,7 @@
 import type { MessageType } from '../../types'
 import type { OrchestrationDb } from '../orchestration-db'
 import { ORCHESTRATION_DELIVERY_BATCH_LIMIT, type MailboxRoutingPage } from './mailbox-routing-page'
+import { activeDispatchOwnsAddressSql } from '../runs/run-coordinator-mail-routing'
 
 export function hasUndeliveredDirectMessageForRun(
   this: OrchestrationDb,
@@ -48,12 +49,7 @@ export function routeDirectMessagePage(
   try {
     const throughClause = throughSequence === undefined ? '' : ' AND sequence <= ?'
     const dispatchOwnershipClause = preserveActiveDispatchOwnership
-      ? ` AND NOT EXISTS (
-           SELECT 1 FROM dispatch_contexts
-           WHERE dispatch_contexts.run_id = messages.run_id
-             AND dispatch_contexts.assignee_handle = messages.to_handle
-             AND dispatch_contexts.status IN ('pending', 'dispatched')
-         )`
+      ? ` AND NOT ${activeDispatchOwnsAddressSql('messages.run_id', 'messages.to_handle')}`
       : ''
     const params: (string | number)[] = [runId, directHandle]
     if (throughSequence !== undefined) {
diff --git a/src/main/runtime/orchestration/db/orca-session-address-sql.ts b/src/main/runtime/orchestration/db/orca-session-address-sql.ts
new file mode 100644
index 00000000000..83bb7ad2c56
--- /dev/null
+++ b/src/main/runtime/orchestration/db/orca-session-address-sql.ts
@@ -0,0 +1,10 @@
+import { ORCA_SESSION_ADDRESS_PREFIX } from '../../../../shared/orca-session-address'
+
+/**
+ * The `session:<id>` address of a bare Orca session id column or expression, NULL when it is NULL.
+ * The only way SQL compares a stored id with a mail address: the id side is formatted, never the
+ * address side stripped, so a handle or `run:` address can never equal a bare id.
+ */
+export function orcaSessionAddressSql(orcaSessionIdSql: string): string {
+  return `('${ORCA_SESSION_ADDRESS_PREFIX}' || ${orcaSessionIdSql})`
+}
diff --git a/src/main/runtime/orchestration/db/runs/run-binding.ts b/src/main/runtime/orchestration/db/runs/run-binding.ts
index c5e6f34abfa..b396b79f1ec 100644
--- a/src/main/runtime/orchestration/db/runs/run-binding.ts
+++ b/src/main/runtime/orchestration/db/runs/run-binding.ts
@@ -3,13 +3,21 @@ import { OrchestrationError } from '../../orchestration-error'
 import { LEGACY_CONTRACT_VERSION } from '../contract-constants'
 import { isEquivalentPaneKey } from '../pane-key-match'
 import type { OrchestrationDb } from '../orchestration-db'
+import type { OrcaSessionId } from '../../../../../shared/orca-session-address'
+import {
+  mailboxAddressOf,
+  runBoundToCoordinator,
+  runCoordinatorKey
+} from '../../orchestration-caller-identity'
 
 export function bindRun(
   this: OrchestrationDb,
   params: {
     runId: string
-    coordinatorHandle: string
-    coordinatorPaneKey: string
+    coordinatorHandle: string | null
+    coordinatorPaneKey: string | null
+    /** The coordinator's bare Orca session id when it is a structured session; see orca-session-address. */
+    coordinatorOrcaSessionId?: OrcaSessionId | null
     takeoverLegacy?: boolean
     legacyCoordinatorAuthority?: {
       runId: string
@@ -20,6 +28,11 @@ export function bindRun(
     }
   }
 ): RunRow | undefined {
+  const coordinator = {
+    terminalHandle: params.coordinatorHandle,
+    paneKey: params.coordinatorPaneKey,
+    orcaSessionId: params.coordinatorOrcaSessionId ?? null
+  }
   this.db.exec('BEGIN IMMEDIATE')
   try {
     const run = this.getRunRaw(params.runId)
@@ -27,9 +40,7 @@ export function bindRun(
       this.db.exec('ROLLBACK')
       return undefined
     }
-    const sameBinding =
-      run.coordinator_pane_key !== null &&
-      isEquivalentPaneKey(run.coordinator_pane_key, params.coordinatorPaneKey)
+    const sameBinding = runBoundToCoordinator(run, coordinator)
     const adoption = this.getLegacyAdoption()
     const adoptedRun = adoption?.adopted_run_id === params.runId
     const legacyAuthority = params.legacyCoordinatorAuthority
@@ -49,6 +60,7 @@ export function bindRun(
       legacyPrincipal.terminal_handle === legacyAuthority.terminalHandle &&
       isEquivalentPaneKey(legacyPrincipal.pane_key, legacyAuthority.paneKey) &&
       params.coordinatorHandle === legacyAuthority.terminalHandle &&
+      params.coordinatorPaneKey !== null &&
       isEquivalentPaneKey(params.coordinatorPaneKey, legacyAuthority.paneKey)
     )
     if (legacyAuthority && !provenLegacyBinding) {
@@ -109,14 +121,17 @@ export function bindRun(
         }
       )
     }
-    this.unbindOtherRunsForPane(params.coordinatorPaneKey, params.runId)
-    for (const handle of new Set(
-      [run.coordinator_handle, params.coordinatorHandle].filter((value): value is string =>
-        Boolean(value)
-      )
-    )) {
-      this.rememberRunCoordinatorHandle(params.runId, handle)
-      this.routeAllUnreadDirectMessagesToRunMailbox(params.runId, handle)
+    this.unbindOtherRunsForCoordinator(coordinator, params.runId)
+    // The mailbox address of the coordinator being replaced and of the one binding now.
+    for (const address of new Set([
+      mailboxAddressOf(runCoordinatorKey(run)),
+      mailboxAddressOf(coordinator)
+    ])) {
+      if (address === null) {
+        continue
+      }
+      this.rememberRunCoordinatorHandle(params.runId, address)
+      this.routeAllUnreadDirectMessagesToRunMailbox(params.runId, address)
     }
     if (
       (params.takeoverLegacy && !takeoverAlreadyApplied) ||
@@ -128,26 +143,40 @@ export function bindRun(
           coordinatorPrincipal?.status === 'committed' &&
           (params.takeoverLegacy ||
             coordinatorPrincipal.terminal_handle !== params.coordinatorHandle ||
+            params.coordinatorPaneKey === null ||
             !isEquivalentPaneKey(coordinatorPrincipal.pane_key, params.coordinatorPaneKey))
         ) {
           this.setLegacyCompatibilityPrincipalStatus(coordinatorPrincipal.id, 'revoked')
         }
       }
-      // The Orca session id belongs to the coordinator being replaced; nothing here resolves the new one's.
       this.db
         .prepare(
           `UPDATE runs
-           SET coordinator_handle = ?, coordinator_pane_key = ?, coordinator_orca_session_id = NULL,
-               coordinator_orca_session_id_generation = NULL,
+           SET coordinator_handle = ?, coordinator_pane_key = ?, coordinator_orca_session_id = ?,
+               coordinator_orca_session_id_generation = consumer_generation + 1,
                consumer_generation = consumer_generation + 1,
                updated_at = datetime('now')
            WHERE id = ?`
         )
-        .run(params.coordinatorHandle, params.coordinatorPaneKey, params.runId)
+        .run(
+          coordinator.terminalHandle,
+          coordinator.paneKey,
+          coordinator.orcaSessionId,
+          params.runId
+        )
       this.fenceUnacknowledgedMailboxDeliveries(`run:${params.runId}`)
       if (params.takeoverLegacy || replacesLegacyCoordinator) {
         this.promoteLegacyCoordinatorMailForTakeover(params.runId, retainedCoordinatorHandle)
       }
+    } else if (runCoordinatorKey(run).orcaSessionId !== coordinator.orcaSessionId) {
+      // Same coordinator, so no new consumer: correct an Orca session id a writer without the column left.
+      this.db
+        .prepare(
+          `UPDATE runs SET coordinator_orca_session_id = ?,
+             coordinator_orca_session_id_generation = consumer_generation
+           WHERE id = ?`
+        )
+        .run(coordinator.orcaSessionId, params.runId)
     }
     this.db.exec('COMMIT')
   } catch (error) {
diff --git a/src/main/runtime/orchestration/db/runs/run-coordinator-mail-routing.ts b/src/main/runtime/orchestration/db/runs/run-coordinator-mail-routing.ts
index 07a6044d5aa..d42b93dfdd9 100644
--- a/src/main/runtime/orchestration/db/runs/run-coordinator-mail-routing.ts
+++ b/src/main/runtime/orchestration/db/runs/run-coordinator-mail-routing.ts
@@ -1,6 +1,16 @@
 import type { OrchestrationDb } from '../orchestration-db'
 import { currentRunCoordinatorSessionAddressSql } from './run-coordinator-orca-session'
 
+/** Mail to an active Dispatch assignee's address in the same Run is that worker's, not coordinator mail. */
+export function activeDispatchOwnsAddressSql(runIdSql: string, addressSql: string): string {
+  return `EXISTS (
+    SELECT 1 FROM dispatch_contexts
+    WHERE dispatch_contexts.run_id = ${runIdSql}
+      AND dispatch_contexts.assignee_handle = ${addressSql}
+      AND dispatch_contexts.status IN ('pending', 'dispatched')
+  )`
+}
+
 export function rememberRunCoordinatorHandle(
   this: OrchestrationDb,
   runId: string,
@@ -43,11 +53,7 @@ export function createCoordinatorMailRoutingTrigger(this: OrchestrationDb): void
           SELECT 1 FROM run_coordinator_handles
           WHERE run_id = NEW.run_id AND terminal_handle = NEW.to_handle
         )
-        AND NOT EXISTS (
-          SELECT 1 FROM dispatch_contexts
-          WHERE run_id = NEW.run_id AND assignee_handle = NEW.to_handle
-            AND status IN ('pending', 'dispatched')
-        )
+        AND NOT ${activeDispatchOwnsAddressSql('NEW.run_id', 'NEW.to_handle')}
       BEGIN
         UPDATE messages SET to_handle = 'run:' || NEW.run_id WHERE sequence = NEW.sequence;
       END;
@@ -69,12 +75,7 @@ export function routeAllUnreadDirectMessagesToRunMailbox(
       `UPDATE messages SET to_handle = ?
        WHERE run_id = ? AND to_handle = ? AND read = 0
          AND delivery_contract = 'current_delivery'
-         AND NOT EXISTS (
-           SELECT 1 FROM dispatch_contexts
-           WHERE dispatch_contexts.run_id = messages.run_id
-             AND dispatch_contexts.assignee_handle = messages.to_handle
-             AND dispatch_contexts.status IN ('pending', 'dispatched')
-         )`
+         AND NOT ${activeDispatchOwnsAddressSql('messages.run_id', 'messages.to_handle')}`
     )
     .run(`run:${runId}`, runId, directHandle)
 }
diff --git a/src/main/runtime/orchestration/db/runs/run-coordinator-orca-session-binding.test.ts b/src/main/runtime/orchestration/db/runs/run-coordinator-orca-session-binding.test.ts
new file mode 100644
index 00000000000..3340f625b66
--- /dev/null
+++ b/src/main/runtime/orchestration/db/runs/run-coordinator-orca-session-binding.test.ts
@@ -0,0 +1,405 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  mintStructuredWorkerHandle,
+  mintStructuredWorkerPaneKey,
+  structuredWorkerProcessIncarnation
+} from '../../../structured-worker-identity'
+import { OrchestrationDb } from '../../db'
+import {
+  formatOrcaSessionAddress,
+  type OrcaSessionId
+} from '../../../../../shared/orca-session-address'
+import { testOrcaSessionId } from '../../../../../shared/orca-session-address-test-fixture'
+
+const CHAT_X_ID = testOrcaSessionId('1b6f0c3a-7d2e-4a91-8c55-2e9d4b7a0f13')
+const CHAT_X = formatOrcaSessionAddress(CHAT_X_ID)
+const CHAT_Y_ID = testOrcaSessionId('6d2a9e41-0c7b-4f38-9a15-b3e8c1d57f20')
+const CHAT_Y = formatOrcaSessionAddress(CHAT_Y_ID)
+const WORKER_SESSION = testOrcaSessionId('9c3e5a17-4b2d-4f60-8e91-0d7a6c2b5e48')
+const WORKER_ADDRESS = formatOrcaSessionAddress(WORKER_SESSION)
+const OTHER_WORKER_SESSION = testOrcaSessionId('2e8b4d61-5a3c-4e97-b0f2-7c1d9a6e3b54')
+const PTY_PANE = 'tab_pty:11111111-1111-4111-8111-111111111111'
+const OTHER_PANE = 'tab_other:22222222-2222-4222-8222-222222222222'
+const UNCAPPED = Number.MAX_SAFE_INTEGER
+
+function chat(orcaSessionId: OrcaSessionId) {
+  return { terminalHandle: null, paneKey: null, orcaSessionId }
+}
+
+describe('Run binding by Orca session id', () => {
+  let db: OrchestrationDb
+
+  afterEach(() => {
+    db?.close()
+  })
+
+  function createChatRun(orcaSessionId: OrcaSessionId, objective = 'chat run') {
+    return db.createRun({
+      objective,
+      coordinatorHandle: null,
+      coordinatorPaneKey: null,
+      coordinatorOrcaSessionId: orcaSessionId
+    })
+  }
+
+  function directMail(runId: string, to: string, subject = 'direct') {
+    return db.insertMessage({ from: 'term_sender', to, subject, body: '', runId })
+  }
+
+  function structuredWorker(sessionId = WORKER_SESSION) {
+    return {
+      terminalHandle: mintStructuredWorkerHandle(),
+      paneKey: mintStructuredWorkerPaneKey(sessionId),
+      orcaSessionId: sessionId
+    }
+  }
+
+  // A binary without the Orca session id column: its bindRun and unbindOtherRunsForPane statements.
+  function olderBinaryRebind(runId: string, handle: string, paneKey: string) {
+    db.db
+      .prepare(
+        `UPDATE runs SET coordinator_handle = ?, coordinator_pane_key = ?,
+           consumer_generation = consumer_generation + 1, updated_at = datetime('now')
+         WHERE id = ?`
+      )
+      .run(handle, paneKey, runId)
+  }
+
+  function olderBinaryUnbind(runId: string) {
+    db.db
+      .prepare(
+        `UPDATE runs SET coordinator_handle = NULL, coordinator_pane_key = NULL,
+           consumer_generation = consumer_generation + 1, updated_at = datetime('now')
+         WHERE id = ?`
+      )
+      .run(runId)
+  }
+
+  /** Unread mail addressed straight to `to`, as a row written before the address was cached. */
+  function strayMail(runId: string, to: string) {
+    const message = directMail(runId, 'term_late', `to ${to}`)
+    db.db.prepare('UPDATE messages SET to_handle = ? WHERE id = ?').run(to, message.id)
+    return message.id
+  }
+
+  it('binds a handle-less session by its Orca session id and remembers its session address', () => {
+    db = new OrchestrationDb(':memory:')
+    const run = createChatRun(CHAT_X_ID)
+
+    expect(db.getRunRaw(run.id)).toMatchObject({
+      coordinator_handle: null,
+      coordinator_pane_key: null,
+      coordinator_orca_session_id: CHAT_X_ID
+    })
+    expect(db.getCurrentRunForCoordinator(chat(CHAT_X_ID))?.id).toBe(run.id)
+    expect(db.getRunMailboxOwnerIdsForHandle(CHAT_X)).toEqual([run.id])
+    // Mail to the session's address reaches the Run mailbox, as mail to a coordinator handle does.
+    expect(directMail(run.id, CHAT_X).to_handle).toBe(`run:${run.id}`)
+  })
+
+  it("never unbinds another session's Run, and unbinds only the same session's other Runs", () => {
+    db = new OrchestrationDb(':memory:')
+    const ptyRun = db.createRun({
+      objective: 'pty',
+      coordinatorHandle: 'term_pty',
+      coordinatorPaneKey: PTY_PANE
+    })
+    const yRun = createChatRun(CHAT_Y_ID, 'y')
+    const xFirst = createChatRun(CHAT_X_ID, 'x first')
+    const pending = db.insertMessage({
+      from: 'term_sender',
+      to: 'term_late',
+      subject: 'queued before the rebind',
+      body: '',
+      runId: xFirst.id
+    })
+    // Mail addressed to the session that the cache did not reroute on insert, as a pre-cache row.
+    db.db.prepare('UPDATE messages SET to_handle = ? WHERE id = ?').run(CHAT_X, pending.id)
+    const generation = db.getRunRaw(xFirst.id)?.consumer_generation ?? 0
+
+    const xSecond = createChatRun(CHAT_X_ID, 'x second')
+
+    expect(db.getCurrentRunForCoordinator(chat(CHAT_X_ID))?.id).toBe(xSecond.id)
+    expect(db.getCurrentRunForCoordinator(chat(CHAT_Y_ID))?.id).toBe(yRun.id)
+    expect(db.getRunRaw(yRun.id)?.coordinator_orca_session_id).toBe(CHAT_Y_ID)
+    expect(db.getRunRaw(ptyRun.id)?.coordinator_pane_key).toBe(PTY_PANE)
+    expect(db.getRunRaw(xFirst.id)).toMatchObject({
+      coordinator_handle: null,
+      coordinator_orca_session_id: null,
+      consumer_generation: generation + 1
+    })
+    // Pending coordinator mail follows the Run, as it does when a pane is unbound.
+    expect(db.getMessageById(pending.id)?.to_handle).toBe(`run:${xFirst.id}`)
+  })
+
+  it('stops counting an Orca session id once a binary without the column rebinds the Run to a terminal', () => {
+    db = new OrchestrationDb(':memory:')
+    const run = createChatRun(CHAT_X_ID)
+    olderBinaryRebind(run.id, 'term_taker', PTY_PANE)
+
+    expect(db.getCurrentRunForCoordinator(chat(CHAT_X_ID))).toBeUndefined()
+    expect(
+      db.getCurrentRunForCoordinator({
+        terminalHandle: 'term_taker',
+        paneKey: PTY_PANE,
+        orcaSessionId: null
+      })?.id
+    ).toBe(run.id)
+    createChatRun(CHAT_X_ID, 'next')
+    expect(db.getRunRaw(run.id)?.coordinator_handle).toBe('term_taker')
+  })
+
+  it('does not hand a chat back a Run an older binary rebound and then unbound', () => {
+    db = new OrchestrationDb(':memory:')
+    const run = createChatRun(CHAT_X_ID)
+    olderBinaryRebind(run.id, 'term_taker', PTY_PANE)
+    olderBinaryUnbind(run.id)
+
+    // Handle and pane are gone and the id is still there: the shape of a live chat binding.
+    expect(db.getRunRaw(run.id)).toMatchObject({
+      coordinator_handle: null,
+      coordinator_pane_key: null,
+      coordinator_orca_session_id: CHAT_X_ID
+    })
+    expect(db.getCurrentRunForCoordinator(chat(CHAT_X_ID))).toBeUndefined()
+    const next = createChatRun(CHAT_X_ID, 'next')
+    expect(db.getCurrentRunForCoordinator(chat(CHAT_X_ID))?.id).toBe(next.id)
+  })
+
+  it("stops counting a structured worker's Orca session id once an older binary unbinds its Run", () => {
+    db = new OrchestrationDb(':memory:')
+    const worker = structuredWorker()
+    const run = db.createRun({
+      objective: 'worker coordinates',
+      coordinatorHandle: worker.terminalHandle,
+      coordinatorPaneKey: worker.paneKey,
+      coordinatorOrcaSessionId: worker.orcaSessionId
+    })
+    expect(db.getCurrentRunForCoordinator(worker)?.id).toBe(run.id)
+    olderBinaryUnbind(run.id)
+    expect(db.getCurrentRunForCoordinator(worker)).toBeUndefined()
+    expect(db.getCurrentRunForCoordinator(chat(worker.orcaSessionId))).toBeUndefined()
+  })
+
+  it('remembers a coordinating structured worker at its handle, and the v42 trigger its inert session address', () => {
+    db = new OrchestrationDb(':memory:')
+    const worker = structuredWorker()
+    const run = db.createRun({
+      objective: 'worker coordinates',
+      coordinatorHandle: worker.terminalHandle,
+      coordinatorPaneKey: worker.paneKey,
+      coordinatorOrcaSessionId: worker.orcaSessionId
+    })
+
+    expect(db.getRunMailboxOwnerIdsForHandle(worker.terminalHandle)).toEqual([run.id])
+    expect(db.getRunMailboxOwnerIdsForHandle(WORKER_ADDRESS)).toEqual([run.id])
+    expect(directMail(run.id, WORKER_ADDRESS).to_handle).toBe(`run:${run.id}`)
+  })
+
+  it('hands a Run to a different session like a terminal takeover: fenced, rerouted, remembered', () => {
+    db = new OrchestrationDb(':memory:')
+    const run = createChatRun(CHAT_X_ID)
+    const pending = directMail(run.id, 'term_late')
+    db.db.prepare('UPDATE messages SET to_handle = ? WHERE id = ?').run(CHAT_X, pending.id)
+    const before = db.getRunRaw(run.id)?.consumer_generation ?? 0
+
+    db.bindRun({
+      runId: run.id,
+      coordinatorHandle: null,
+      coordinatorPaneKey: null,
+      coordinatorOrcaSessionId: CHAT_Y_ID
+    })
+
+    expect(db.getRunRaw(run.id)).toMatchObject({
+      coordinator_orca_session_id: CHAT_Y_ID,
+      consumer_generation: before + 1
+    })
+    expect(db.getCurrentRunForCoordinator(chat(CHAT_X_ID))).toBeUndefined()
+    expect(db.getCurrentRunForCoordinator(chat(CHAT_Y_ID))?.id).toBe(run.id)
+    expect(db.getMessageById(pending.id)?.to_handle).toBe(`run:${run.id}`)
+    expect(db.getRunMailboxOwnerIdsForHandle(CHAT_Y)).toEqual([run.id])
+  })
+
+  it('rebinding the same session is not a new consumer, and fills a missing Orca session id in place', () => {
+    db = new OrchestrationDb(':memory:')
+    const worker = structuredWorker()
+    const run = db.createRun({
+      objective: 'worker coordinates',
+      coordinatorHandle: worker.terminalHandle,
+      coordinatorPaneKey: worker.paneKey
+    })
+    // As an older binary writes the row: no Orca session id, and no generation for one.
+    db.db
+      .prepare('UPDATE runs SET coordinator_orca_session_id_generation = NULL WHERE id = ?')
+      .run(run.id)
+    const before = db.getRunRaw(run.id)?.consumer_generation
+
+    db.bindRun({
+      runId: run.id,
+      coordinatorHandle: worker.terminalHandle,
+      coordinatorPaneKey: worker.paneKey,
+      coordinatorOrcaSessionId: worker.orcaSessionId
+    })
+
+    expect(db.getRunRaw(run.id)).toMatchObject({
+      coordinator_orca_session_id: WORKER_SESSION,
+      consumer_generation: before
+    })
+    // Written at the current generation, so the filled id counts on its own.
+    expect(db.getCurrentRunForCoordinator(chat(WORKER_SESSION))?.id).toBe(run.id)
+  })
+
+  it("reroutes and remembers each worker's one mailbox address when one takes a Run from another", () => {
+    db = new OrchestrationDb(':memory:')
+    const first = structuredWorker()
+    const second = structuredWorker(OTHER_WORKER_SESSION)
+    const run = db.createRun({
+      objective: 'first worker coordinates',
+      coordinatorHandle: first.terminalHandle,
+      coordinatorPaneKey: first.paneKey,
+      coordinatorOrcaSessionId: first.orcaSessionId
+    })
+    // A worker's mailbox address is its handle; nothing writes mail to its session address.
+    const addresses = [first.terminalHandle, second.terminalHandle]
+    const stray = addresses.map((address) => strayMail(run.id, address))
+
+    db.bindRun({
+      runId: run.id,
+      coordinatorHandle: second.terminalHandle,
+      coordinatorPaneKey: second.paneKey,
+      coordinatorOrcaSessionId: second.orcaSessionId
+    })
+
+    for (const id of stray) {
+      expect(db.getMessageById(id)?.to_handle).toBe(`run:${run.id}`)
+    }
+    for (const address of addresses) {
+      expect(db.getRunMailboxOwnerIdsForHandle(address)).toEqual([run.id])
+    }
+  })
+
+  it("reroutes a worker's mailbox address when its next Run unbinds the last", () => {
+    db = new OrchestrationDb(':memory:')
+    const worker = structuredWorker()
+    const bind = {
+      coordinatorHandle: worker.terminalHandle,
+      coordinatorPaneKey: worker.paneKey,
+      coordinatorOrcaSessionId: worker.orcaSessionId
+    }
+    const last = db.createRun({ objective: 'last', ...bind })
+    const stray = [strayMail(last.id, worker.terminalHandle)]
+
+    db.createRun({ objective: 'next', ...bind })
+
+    for (const id of stray) {
+      expect(db.getMessageById(id)?.to_handle).toBe(`run:${last.id}`)
+    }
+  })
+})
+
+describe('Dispatch Orca session ids recorded by every writer', () => {
+  let db: OrchestrationDb
+
+  afterEach(() => {
+    db?.close()
+  })
+
+  it('records the assignee Orca session id from a structured incarnation and a creator one', () => {
+    db = new OrchestrationDb(':memory:')
+    const run = db.createRun({
+      objective: 'r',
+      coordinatorHandle: null,
+      coordinatorPaneKey: null,
+      coordinatorOrcaSessionId: CHAT_X_ID
+    })
+    const handle = mintStructuredWorkerHandle()
+    const assigned = db.createDispatchContext({
+      taskId: db.createTask({ runId: run.id, spec: 'structured' }).id,
+      assigneeHandle: handle,
+      assigneePaneKey: mintStructuredWorkerPaneKey(WORKER_SESSION),
+      processIncarnation: structuredWorkerProcessIncarnation(WORKER_SESSION),
+      creator: { kind: 'session', orcaSessionId: CHAT_X_ID },
+      maxDepth: UNCAPPED
+    })
+    const pty = db.createDispatchContext({
+      taskId: db.createTask({ runId: run.id, spec: 'pty' }).id,
+      assigneeHandle: 'term_pty',
+      assigneePaneKey: PTY_PANE,
+      processIncarnation: 'pty_proc:1',
+      creator: { kind: 'terminal', handle: 'term_c', paneKey: OTHER_PANE },
+      maxDepth: UNCAPPED
+    })
+
+    expect(assigned).toMatchObject({
+      assignee_orca_session_id: WORKER_SESSION,
+      creator_handle: null,
+      creator_pane_key: null,
+      creator_orca_session_id: CHAT_X_ID
+    })
+    expect(pty).toMatchObject({ assignee_orca_session_id: null, creator_orca_session_id: null })
+  })
+
+  it('nests under the Dispatch a handle-less creator is assigned by its Orca session id', () => {
+    db = new OrchestrationDb(':memory:')
+    const run = db.createRun({
+      objective: 'r',
+      coordinatorHandle: 'term_c',
+      coordinatorPaneKey: OTHER_PANE
+    })
+    const parent = db.createDispatchContext({
+      taskId: db.createTask({ runId: run.id, spec: 'parent' }).id,
+      assigneeHandle: mintStructuredWorkerHandle(),
+      assigneePaneKey: mintStructuredWorkerPaneKey(WORKER_SESSION),
+      processIncarnation: structuredWorkerProcessIncarnation(WORKER_SESSION),
+      creator: { kind: 'system' },
+      maxDepth: UNCAPPED
+    })
+
+    const child = db.createDispatchContext({
+      taskId: db.createTask({ runId: run.id, spec: 'child' }).id,
+      assigneeHandle: 'term_child',
+      assigneePaneKey: PTY_PANE,
+      processIncarnation: 'pty_proc:2',
+      creator: { kind: 'session', orcaSessionId: WORKER_SESSION },
+      maxDepth: UNCAPPED
+    })
+
+    expect(child).toMatchObject({ creator_dispatch_id: parent.id, depth: parent.depth + 1 })
+  })
+
+  it('records the starting creator and the attached assignee of a worker-start', () => {
+    db = new OrchestrationDb(':memory:')
+    const run = db.createRun({
+      objective: 'r',
+      coordinatorHandle: null,
+      coordinatorPaneKey: null,
+      coordinatorOrcaSessionId: CHAT_X_ID
+    })
+    const started = db.createStartingWorkerDispatch({
+      creator: { kind: 'session', orcaSessionId: CHAT_X_ID },
+      maxDepth: UNCAPPED,
+      taskSpec: 'work',
+      taskRunId: run.id,
+      startOptions: {}
+    })
+    expect(started.dispatch).toMatchObject({
+      creator_orca_session_id: CHAT_X_ID,
+      assignee_orca_session_id: null
+    })
+
+    const handle = mintStructuredWorkerHandle()
+    db.prepareStartingWorkerAuthority({
+      dispatchId: started.dispatch.id,
+      handle,
+      paneKey: mintStructuredWorkerPaneKey(WORKER_SESSION),
+      processIncarnation: structuredWorkerProcessIncarnation(WORKER_SESSION),
+      worktreeId: 'wt_1',
+      effects: [],
+      setupState: 'not_applicable'
+    })
+
+    expect(db.getDispatchContextById(started.dispatch.id)?.assignee_orca_session_id).toBe(
+      WORKER_SESSION
+    )
+  })
+})
diff --git a/src/main/runtime/orchestration/db/runs/run-coordinator-orca-session.ts b/src/main/runtime/orchestration/db/runs/run-coordinator-orca-session.ts
index 2ed9d9809a2..007e979df4d 100644
--- a/src/main/runtime/orchestration/db/runs/run-coordinator-orca-session.ts
+++ b/src/main/runtime/orchestration/db/runs/run-coordinator-orca-session.ts
@@ -1,4 +1,5 @@
-import { ORCA_SESSION_ADDRESS_PREFIX } from '../../../../../shared/orca-session-address'
+import { orcaSessionAddressSql } from '../orca-session-address-sql'
+import type { OrcaSessionId } from '../../../../../shared/orca-session-address'
 import type { RunRow } from '../../types'
 
 type RunCoordinatorOrcaSessionFields = Pick<
@@ -13,7 +14,7 @@ type RunCoordinatorOrcaSessionFields = Pick<
  */
 export function currentRunCoordinatorOrcaSessionId(
   run: RunCoordinatorOrcaSessionFields
-): string | null {
+): OrcaSessionId | null {
   return run.coordinator_orca_session_id_generation === run.consumer_generation
     ? run.coordinator_orca_session_id
     : null
@@ -27,5 +28,5 @@ export function currentRunCoordinatorOrcaSessionIdSql(row: string): string {
 
 /** The coordinator's `session:<id>` address in SQL; NULL when it has no current Orca session id. */
 export function currentRunCoordinatorSessionAddressSql(row: string): string {
-  return `('${ORCA_SESSION_ADDRESS_PREFIX}' || ${currentRunCoordinatorOrcaSessionIdSql(row)})`
+  return orcaSessionAddressSql(currentRunCoordinatorOrcaSessionIdSql(row))
 }
diff --git a/src/main/runtime/orchestration/db/runs/run-create.ts b/src/main/runtime/orchestration/db/runs/run-create.ts
index 3f99e018936..9b7eab6ab0d 100644
--- a/src/main/runtime/orchestration/db/runs/run-create.ts
+++ b/src/main/runtime/orchestration/db/runs/run-create.ts
@@ -1,6 +1,8 @@
 import type { RunRow } from '../../types'
 import { generateId } from '../generated-id'
 import type { OrchestrationDb } from '../orchestration-db'
+import type { OrcaSessionId } from '../../../../../shared/orca-session-address'
+import { mailboxAddressOf } from '../../orchestration-caller-identity'
 
 // ── Runs ──
 
@@ -8,23 +10,39 @@ export function createRun(
   this: OrchestrationDb,
   params: {
     objective: string
-    coordinatorHandle: string
-    coordinatorPaneKey: string
+    coordinatorHandle: string | null
+    coordinatorPaneKey: string | null
+    /** The coordinator's bare Orca session id when it is a structured session; see orca-session-address. */
+    coordinatorOrcaSessionId?: OrcaSessionId | null
   }
 ): RunRow {
+  const coordinator = {
+    terminalHandle: params.coordinatorHandle,
+    paneKey: params.coordinatorPaneKey,
+    orcaSessionId: params.coordinatorOrcaSessionId ?? null
+  }
   const id = generateId('run')
   this.db.exec('BEGIN IMMEDIATE')
   try {
-    this.unbindOtherRunsForPane(params.coordinatorPaneKey)
+    this.unbindOtherRunsForCoordinator(coordinator)
     this.db
       .prepare(
         `INSERT INTO runs (
-           id, objective, coordinator_handle, coordinator_pane_key,
-           consumer_generation, legacy
-         ) VALUES (?, ?, ?, ?, 1, 0)`
+           id, objective, coordinator_handle, coordinator_pane_key, coordinator_orca_session_id,
+           coordinator_orca_session_id_generation, consumer_generation, legacy
+         ) VALUES (?, ?, ?, ?, ?, 1, 1, 0)`
       )
-      .run(id, params.objective, params.coordinatorHandle, params.coordinatorPaneKey)
-    this.rememberRunCoordinatorHandle(id, params.coordinatorHandle)
+      .run(
+        id,
+        params.objective,
+        coordinator.terminalHandle,
+        coordinator.paneKey,
+        coordinator.orcaSessionId
+      )
+    const address = mailboxAddressOf(coordinator)
+    if (address !== null) {
+      this.rememberRunCoordinatorHandle(id, address)
+    }
     this.db.exec('COMMIT')
   } catch (error) {
     this.db.exec('ROLLBACK')
diff --git a/src/main/runtime/orchestration/db/runs/run-lookup.ts b/src/main/runtime/orchestration/db/runs/run-lookup.ts
index 0a60b4e7f9d..94a57c345a3 100644
--- a/src/main/runtime/orchestration/db/runs/run-lookup.ts
+++ b/src/main/runtime/orchestration/db/runs/run-lookup.ts
@@ -1,4 +1,10 @@
 import type { RunRow } from '../../types'
+import {
+  mailboxAddressOf,
+  runBoundToCoordinator,
+  runCoordinatorKey,
+  type OrchestrationCoordinatorKey
+} from '../../orchestration-caller-identity'
 import { ORCHESTRATION_RUN_PAGE_LIMIT } from '../../../../../shared/orchestration-run-pagination'
 import {
   isEquivalentPaneKey,
@@ -22,6 +28,13 @@ const RUNS_BOUND_TO_PANE_SQL = `SELECT ${RUN_COLUMN_LIST} FROM runs
          WHERE coordinator_pane_key IS NOT NULL AND legacy = 0
            AND ${RUN_PANE_KEY_MATCH_SUFFIX_SQL} = ?
          ORDER BY rowid`
+// Why: one statement so pane and Orca session id matches keep a single rowid order; the JS predicate decides.
+const RUNS_BOUND_TO_COORDINATOR_SQL = `SELECT ${RUN_COLUMN_LIST} FROM runs
+         WHERE legacy = 0 AND (
+           (coordinator_pane_key IS NOT NULL AND ${RUN_PANE_KEY_MATCH_SUFFIX_SQL} = ?)
+           OR coordinator_orca_session_id = ?
+         )
+         ORDER BY rowid`
 
 export function getRun(this: OrchestrationDb, id: string): RunRow | undefined {
   const run = this.getRunRaw(id)
@@ -122,15 +135,38 @@ export function getRunRaw(this: OrchestrationDb, id: string): RunRow | undefined
   return this.db.prepare(RUN_BY_ID_SQL).get(id) as RunRow | undefined
 }
 
-export function unbindOtherRunsForPane(
+export function getCurrentRunForCoordinator(
   this: OrchestrationDb,
-  paneKey: string,
+  caller: OrchestrationCoordinatorKey
+): RunRow | undefined {
+  const run = this.runsBoundToCoordinator(caller)[0]
+  return run ? exposeRunTimestamps(run) : undefined
+}
+
+/** Runs bound to this caller by pane or by Orca session id; a caller without one matches as before. */
+export function runsBoundToCoordinator(
+  this: OrchestrationDb,
+  caller: OrchestrationCoordinatorKey
+): RunRow[] {
+  if (caller.orcaSessionId === null) {
+    return caller.paneKey === null ? [] : this.runsBoundToPane(caller.paneKey)
+  }
+  const suffix = caller.paneKey === null ? null : paneKeyMatchSuffix(caller.paneKey)
+  const rows = this.db.prepare(RUNS_BOUND_TO_COORDINATOR_SQL).all(suffix, caller.orcaSessionId)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: SELECT * over this table returns the row shape its schema and row type define, like every row cast in db/.
+  return (rows as RunRow[]).filter((run) => runBoundToCoordinator(run, caller))
+}
+
+export function unbindOtherRunsForCoordinator(
+  this: OrchestrationDb,
+  caller: OrchestrationCoordinatorKey,
   exceptRunId?: string
 ): void {
-  for (const run of this.runsBoundToPane(paneKey)) {
+  for (const run of this.runsBoundToCoordinator(caller)) {
     if (run.id !== exceptRunId) {
-      if (run.coordinator_handle) {
-        this.routeAllUnreadDirectMessagesToRunMailbox(run.id, run.coordinator_handle)
+      const address = mailboxAddressOf(runCoordinatorKey(run))
+      if (address !== null) {
+        this.routeAllUnreadDirectMessagesToRunMailbox(run.id, address)
       }
       this.db
         .prepare(
@@ -160,8 +196,10 @@ export type RunLookupMethods = {
   listRuns: typeof listRuns
   getCurrentRunForPane: typeof getCurrentRunForPane
   runsBoundToPane: typeof runsBoundToPane
+  getCurrentRunForCoordinator: typeof getCurrentRunForCoordinator
+  runsBoundToCoordinator: typeof runsBoundToCoordinator
   getRunRaw: typeof getRunRaw
-  unbindOtherRunsForPane: typeof unbindOtherRunsForPane
+  unbindOtherRunsForCoordinator: typeof unbindOtherRunsForCoordinator
   requireRun: typeof requireRun
 }
 
@@ -173,8 +211,10 @@ export function attachRunLookup(ctor: { prototype: object }): void {
     listRuns,
     getCurrentRunForPane,
     runsBoundToPane,
+    getCurrentRunForCoordinator,
+    runsBoundToCoordinator,
     getRunRaw,
-    unbindOtherRunsForPane,
+    unbindOtherRunsForCoordinator,
     requireRun
   })
 }
diff --git a/src/main/runtime/orchestration/db/schema/structured-worker-orca-session-backfill.test.ts b/src/main/runtime/orchestration/db/schema/structured-worker-orca-session-backfill.test.ts
index 57bf53e7026..273d7a09aca 100644
--- a/src/main/runtime/orchestration/db/schema/structured-worker-orca-session-backfill.test.ts
+++ b/src/main/runtime/orchestration/db/schema/structured-worker-orca-session-backfill.test.ts
@@ -96,6 +96,10 @@ describe('structured worker Orca session id backfill', () => {
       processIncarnation: structuredWorkerProcessIncarnation(SESSION_B),
       ownership: 'owned'
     })
+    // Rows a writer without the column left; a current writer records the incarnation's Orca session id.
+    db.db.exec(
+      'UPDATE dispatch_contexts SET assignee_orca_session_id = NULL, creator_orca_session_id = NULL'
+    )
 
     backfillStructuredWorkerOrcaSessionIds(db.db)
 
diff --git a/src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-authority.ts b/src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-authority.ts
index 166ccd7193e..733833c9aca 100644
--- a/src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-authority.ts
+++ b/src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-authority.ts
@@ -2,6 +2,7 @@ import { randomBytes } from 'node:crypto'
 import { OrchestrationError } from '../../orchestration-error'
 import { hashDispatchCapability } from '../dispatch-capability-hash'
 import type { OrchestrationDb } from '../orchestration-db'
+import { dispatchAssigneeOrcaSessionId } from '../../dispatch-assignee-orca-session-id'
 
 export function prepareStartingWorkerAuthority(
   this: OrchestrationDb,
@@ -53,8 +54,8 @@ export function prepareStartingWorkerAuthority(
     const contextUpdate = this.db
       .prepare(
         `UPDATE dispatch_contexts
-         SET assignee_handle = ?, assignee_pane_key = ?, process_incarnation = ?,
-             assignee_orca_session_id = NULL, host_scope = ?,
+         SET assignee_handle = ?, assignee_pane_key = ?, assignee_orca_session_id = ?,
+             process_incarnation = ?, host_scope = ?,
              capability_hash = ?, launch_token_hash = COALESCE(launch_token_hash, ?),
              capability_revoked_at = NULL,
              consumer_generation = consumer_generation + 1
@@ -63,6 +64,7 @@ export function prepareStartingWorkerAuthority(
       .run(
         params.handle,
         params.paneKey,
+        dispatchAssigneeOrcaSessionId(params.processIncarnation),
         params.processIncarnation,
         params.hostScope ?? null,
         hashDispatchCapability(capability),
diff --git a/src/main/runtime/orchestration/db/worker-terminal/failed-start-dispatch-identity.ts b/src/main/runtime/orchestration/db/worker-terminal/failed-start-dispatch-identity.ts
index c9b9b5d0afd..3d45c9a8630 100644
--- a/src/main/runtime/orchestration/db/worker-terminal/failed-start-dispatch-identity.ts
+++ b/src/main/runtime/orchestration/db/worker-terminal/failed-start-dispatch-identity.ts
@@ -1,5 +1,6 @@
 import type { WorkerDispatchRow } from '../../types'
 import type { OrchestrationDb } from '../orchestration-db'
+import { dispatchAssigneeOrcaSessionId } from '../../dispatch-assignee-orca-session-id'
 
 /**
  * A start that dies before `prepareStartingWorkerAuthority` never filled the Dispatch context in,
@@ -21,13 +22,14 @@ export function recordFailedStartDispatchIdentity(
   db.db
     .prepare(
       `UPDATE dispatch_contexts
-         SET assignee_handle = ?, assignee_pane_key = ?, process_incarnation = ?, host_scope = ?,
-             assignee_orca_session_id = NULL
+         SET assignee_handle = ?, assignee_pane_key = ?, assignee_orca_session_id = ?,
+             process_incarnation = ?, host_scope = ?
        WHERE id = ? AND status = 'failed' AND capability_hash IS NULL`
     )
     .run(
       resource.terminal_handle,
       resource.pane_key,
+      dispatchAssigneeOrcaSessionId(resource.process_incarnation),
       resource.process_incarnation,
       resource.host_scope,
       worker.dispatch_id
diff --git a/src/main/runtime/orchestration/db/worker-terminal/worker-terminal-resource-store.ts b/src/main/runtime/orchestration/db/worker-terminal/worker-terminal-resource-store.ts
index e6942503dbf..fe26380d539 100644
--- a/src/main/runtime/orchestration/db/worker-terminal/worker-terminal-resource-store.ts
+++ b/src/main/runtime/orchestration/db/worker-terminal/worker-terminal-resource-store.ts
@@ -123,6 +123,20 @@ export function getWorkerTerminalResourceByHandle(
     .get(terminalHandle) as WorkerTerminalResourceRow | undefined
 }
 
+export function getWorkerTerminalResourceByProcessIncarnation(
+  this: OrchestrationDb,
+  processIncarnation: string
+): WorkerTerminalResourceRow | undefined {
+  const row = this.db
+    .prepare(
+      `SELECT * FROM worker_terminal_resources
+        WHERE process_incarnation = ? ORDER BY updated_at DESC LIMIT 1`
+    )
+    .get(processIncarnation)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: SELECT * over this table returns the row shape its schema and row type define, like every row cast in db/.
+  return row as WorkerTerminalResourceRow | undefined
+}
+
 export function getWorkerTerminalResourceFormerlyOwnedBy(
   this: OrchestrationDb,
   dispatchId: string
@@ -238,6 +252,7 @@ export type WorkerTerminalResourceStoreMethods = {
   createWorkerTerminalResourceStatement: typeof createWorkerTerminalResourceStatement
   getWorkerTerminalResource: typeof getWorkerTerminalResource
   getWorkerTerminalResourceByHandle: typeof getWorkerTerminalResourceByHandle
+  getWorkerTerminalResourceByProcessIncarnation: typeof getWorkerTerminalResourceByProcessIncarnation
   getWorkerTerminalResourceByOwner: typeof getWorkerTerminalResourceByOwner
   getWorkerTerminalResourceFormerlyOwnedBy: typeof getWorkerTerminalResourceFormerlyOwnedBy
   recordWorkerTerminalRecoveryAttempt: typeof recordWorkerTerminalRecoveryAttempt
@@ -251,6 +266,7 @@ export function attachWorkerTerminalResourceStore(ctor: { prototype: object }):
     createWorkerTerminalResourceStatement,
     getWorkerTerminalResource,
     getWorkerTerminalResourceByHandle,
+    getWorkerTerminalResourceByProcessIncarnation,
     getWorkerTerminalResourceByOwner,
     getWorkerTerminalResourceFormerlyOwnedBy,
     recordWorkerTerminalRecoveryAttempt,
diff --git a/src/main/runtime/orchestration/db/worker-terminal/worker-terminal-transfer.ts b/src/main/runtime/orchestration/db/worker-terminal/worker-terminal-transfer.ts
index 439aca59b01..064ae577e0f 100644
--- a/src/main/runtime/orchestration/db/worker-terminal/worker-terminal-transfer.ts
+++ b/src/main/runtime/orchestration/db/worker-terminal/worker-terminal-transfer.ts
@@ -81,14 +81,30 @@ export function workerTerminalResourceHasIdentityConflict(
   )
 }
 
+/** Every resource whose process incarnation starts with `prefix`, newest first. */
+export function listWorkerTerminalResourcesByIncarnationPrefix(
+  this: OrchestrationDb,
+  prefix: string
+): WorkerTerminalResourceRow[] {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: SELECT * over this table is exactly its row shape.
+  return this.db
+    .prepare(
+      `SELECT * FROM worker_terminal_resources
+        WHERE substr(process_incarnation, 1, ?) = ? ORDER BY updated_at DESC`
+    )
+    .all(prefix.length, prefix) as WorkerTerminalResourceRow[]
+}
+
 export type WorkerTerminalTransferMethods = {
   findTransferableWorkerTerminalResource: typeof findTransferableWorkerTerminalResource
   workerTerminalResourceHasIdentityConflict: typeof workerTerminalResourceHasIdentityConflict
+  listWorkerTerminalResourcesByIncarnationPrefix: typeof listWorkerTerminalResourcesByIncarnationPrefix
 }
 
 export function attachWorkerTerminalTransfer(ctor: { prototype: object }): void {
   Object.assign(ctor.prototype, {
     findTransferableWorkerTerminalResource,
-    workerTerminalResourceHasIdentityConflict
+    workerTerminalResourceHasIdentityConflict,
+    listWorkerTerminalResourcesByIncarnationPrefix
   })
 }
diff --git a/src/main/runtime/orchestration/dispatch-assignee-orca-session-id.ts b/src/main/runtime/orchestration/dispatch-assignee-orca-session-id.ts
new file mode 100644
index 00000000000..52c75ece732
--- /dev/null
+++ b/src/main/runtime/orchestration/dispatch-assignee-orca-session-id.ts
@@ -0,0 +1,11 @@
+import type { OrcaSessionId } from '../../../shared/orca-session-address'
+import { structuredWorkerOrcaSessionIdForIncarnation } from '../structured-worker-identity'
+import { canonicalOrcaSessionId } from './canonical-orca-session-id'
+
+/** The Orca session id a Dispatch row stores for the structured worker a process incarnation names. */
+export function dispatchAssigneeOrcaSessionId(
+  processIncarnation: string | null | undefined
+): OrcaSessionId | null {
+  const orcaSessionId = structuredWorkerOrcaSessionIdForIncarnation(processIncarnation)
+  return orcaSessionId === null ? null : canonicalOrcaSessionId(orcaSessionId)
+}
diff --git a/src/main/runtime/orchestration/mailbox-pointer-pty-write.ts b/src/main/runtime/orchestration/mailbox-pointer-pty-write.ts
index 8dbedc9b33c..52016aa1465 100644
--- a/src/main/runtime/orchestration/mailbox-pointer-pty-write.ts
+++ b/src/main/runtime/orchestration/mailbox-pointer-pty-write.ts
@@ -24,7 +24,8 @@ export function writeOrchestrationPointerWithSettlement(
     return writeRefused('provider_cannot_settle')
   }
   try {
-    return settledWrite.call(args.controller, args.ptyId, args.data)
+    // Why driving: a pointer is input that tells a running agent to read its mail.
+    return settledWrite.call(args.controller, args.ptyId, args.data, 'driving')
   } catch {
     // A partial write that then threw cannot prove the transport took nothing.
     return writeUnverifiable('provider_threw_after_handoff', true)
diff --git a/src/main/runtime/orchestration/orchestration-caller-identity.ts b/src/main/runtime/orchestration/orchestration-caller-identity.ts
new file mode 100644
index 00000000000..cce3cecd548
--- /dev/null
+++ b/src/main/runtime/orchestration/orchestration-caller-identity.ts
@@ -0,0 +1,76 @@
+import type { RunRow } from './types'
+import { isEquivalentPaneKey } from './db/pane-key-match'
+import { currentRunCoordinatorOrcaSessionId } from './db/runs/run-coordinator-orca-session'
+import { formatOrcaSessionAddress, type OrcaSessionId } from '../../../shared/orca-session-address'
+
+/**
+ * Who an orchestration caller is, as Run binding and mail routing match it.
+ *
+ * A PTY agent is its terminal: a handle and a pane key, no Orca session id. An agent that is a
+ * structured session is its Orca session id, addressed as `session:<id>`; a structured worker also
+ * has the handle and pane key it was minted, and an ordinary chat has neither. Methods pass this
+ * through whole and never branch on which fields are set; the lookups below own that.
+ */
+export type OrchestrationCallerIdentity = Readonly<{
+  /** Mailbox address the caller sends from and reads: its terminal handle, else its session address. */
+  address: string
+  terminalHandle: string | null
+  paneKey: string | null
+  /** The bare Orca session id the caller is addressed by; mail spells it `session:<id>`. */
+  orcaSessionId: OrcaSessionId | null
+}>
+
+/** The part of a caller a Run binding stores and matches. */
+export type OrchestrationCoordinatorKey = Pick<
+  OrchestrationCallerIdentity,
+  'terminalHandle' | 'paneKey' | 'orcaSessionId'
+>
+
+/** A caller the dispatch entry resolved from the Orca session id in its injected environment. */
+export type OrchestrationSessionCaller = OrchestrationCallerIdentity &
+  Readonly<{
+    orcaSessionId: OrcaSessionId
+    /** The session record the request came from. */
+    sessionId: OrcaSessionId
+    /** Where the session runs, from its record; `worker-start --worktree current` places here. */
+    workspaceId: string
+  }>
+
+/** A caller with neither a pane nor an Orca session id can never be bound to a Run. */
+export function hasRunBindingKey(caller: OrchestrationCoordinatorKey): boolean {
+  return caller.paneKey !== null || caller.orcaSessionId !== null
+}
+
+/** The one address a party reads mail at and is sent mail at; null for a key naming nobody. */
+export function mailboxAddressOf(
+  party: Pick<OrchestrationCoordinatorKey, 'terminalHandle' | 'orcaSessionId'>
+): string | null {
+  // Handle first because a worker's mail and Dispatch rows are keyed by it today; flips when sessions become canonical.
+  if (party.terminalHandle !== null) {
+    return party.terminalHandle
+  }
+  return party.orcaSessionId === null ? null : formatOrcaSessionAddress(party.orcaSessionId)
+}
+
+/** Who a Run's binding names now; an Orca session id an older binding left behind is not part of it. */
+export function runCoordinatorKey(run: RunRow): OrchestrationCoordinatorKey {
+  return {
+    terminalHandle: run.coordinator_handle,
+    paneKey: run.coordinator_pane_key,
+    orcaSessionId: currentRunCoordinatorOrcaSessionId(run)
+  }
+}
+
+export function runBoundToCoordinator(run: RunRow, caller: OrchestrationCoordinatorKey): boolean {
+  if (
+    caller.paneKey !== null &&
+    run.coordinator_pane_key !== null &&
+    isEquivalentPaneKey(run.coordinator_pane_key, caller.paneKey)
+  ) {
+    return true
+  }
+  return (
+    caller.orcaSessionId !== null &&
+    currentRunCoordinatorOrcaSessionId(run) === caller.orcaSessionId
+  )
+}
diff --git a/src/main/runtime/orchestration/orchestration-orca-session-column-migration.test.ts b/src/main/runtime/orchestration/orchestration-orca-session-column-migration.test.ts
index 69186334828..b721dcc166e 100644
--- a/src/main/runtime/orchestration/orchestration-orca-session-column-migration.test.ts
+++ b/src/main/runtime/orchestration/orchestration-orca-session-column-migration.test.ts
@@ -11,6 +11,7 @@ import {
 import { OrchestrationDb } from './db'
 import { SCHEMA_VERSION } from './db/contract-constants'
 import { formatOrcaSessionAddress } from '../../../shared/orca-session-address'
+import { testOrcaSessionId } from '../../../shared/orca-session-address-test-fixture'
 import { RUN_PANE_KEY_MATCH_SUFFIX_SQL } from './db/pane-key-match'
 import {
   currentRunCoordinatorOrcaSessionId,
@@ -18,8 +19,8 @@ import {
 } from './db/runs/run-coordinator-orca-session'
 import { resolveOrchestrationMigrationStartVersion } from './orchestration-schema-version-skew'
 
-const SESSION_ID = '5f0c1d9e-2b7a-4c3e-8f61-0a9d2e7b4c11'
-const CHAT_SESSION_ID = '9a4e7c1b-3d2f-4b6a-8e5c-7f1d0b2a6c93'
+const SESSION_ID = testOrcaSessionId('5f0c1d9e-2b7a-4c3e-8f61-0a9d2e7b4c11')
+const CHAT_SESSION_ID = testOrcaSessionId('9a4e7c1b-3d2f-4b6a-8e5c-7f1d0b2a6c93')
 const CHAT_SESSION_ADDRESS = formatOrcaSessionAddress(CHAT_SESSION_ID)
 const ORCA_SESSION_ID_COLUMNS = [
   'assignee_orca_session_id',
@@ -49,6 +50,25 @@ const HANDLE_ONLY_COORDINATOR_TRIGGERS_SQL = `
     VALUES (NEW.id, NEW.coordinator_handle);
   END;`
 
+// The mail routing trigger as main recreated it on every open at v41 and before: handle-only.
+const HANDLE_ONLY_MAIL_ROUTING_TRIGGER_SQL = `
+  CREATE TRIGGER trg_messages_route_coordinator_mail
+  AFTER INSERT ON messages
+  WHEN NEW.read = 0 AND NEW.delivery_contract = 'current_delivery'
+    AND EXISTS (SELECT 1 FROM runs WHERE runs.id = NEW.run_id AND runs.legacy = 0)
+    AND EXISTS (
+      SELECT 1 FROM run_coordinator_handles
+      WHERE run_id = NEW.run_id AND terminal_handle = NEW.to_handle
+    )
+    AND NOT EXISTS (
+      SELECT 1 FROM dispatch_contexts
+      WHERE run_id = NEW.run_id AND assignee_handle = NEW.to_handle
+        AND status IN ('pending', 'dispatched')
+    )
+  BEGIN
+    UPDATE messages SET to_handle = 'run:' || NEW.run_id WHERE sequence = NEW.sequence;
+  END;`
+
 const V41_RUN_COLUMNS =
   'id, objective, home_database, coordinator_handle, coordinator_pane_key, consumer_generation, legacy, created_at, updated_at'
 
@@ -117,11 +137,13 @@ function stripOrcaSessionSchema(path: string, version: number): void {
     DROP INDEX idx_dispatch_assignee_orca_session_id;
     DROP TRIGGER trg_runs_remember_coordinator_insert;
     DROP TRIGGER trg_runs_remember_coordinator_update;
+    DROP TRIGGER trg_messages_route_coordinator_mail;
     ALTER TABLE runs DROP COLUMN coordinator_orca_session_id;
     ALTER TABLE runs DROP COLUMN coordinator_orca_session_id_generation;
     ALTER TABLE dispatch_contexts DROP COLUMN assignee_orca_session_id;
     ALTER TABLE dispatch_contexts DROP COLUMN creator_orca_session_id;
     ${HANDLE_ONLY_COORDINATOR_TRIGGERS_SQL}
+    ${HANDLE_ONLY_MAIL_ROUTING_TRIGGER_SQL}
   `)
   raw.pragma(`user_version = ${version}`)
   raw.close()
@@ -419,8 +441,11 @@ describe('orchestration Orca session id column migration', () => {
   it('fills structured-worker rows written after the stamp reached v42 on the next open', () => {
     const path = tempDbPath()
     const first = new OrchestrationDb(path)
-    // No writer records an Orca session id yet, which is also the shape a binary rolled back past v42 writes.
     const rows = seedStructuredAndPtyRows(first)
+    // The shape a binary rolled back past v42 writes: its INSERTs name no Orca session id column.
+    first.db.exec(
+      'UPDATE dispatch_contexts SET assignee_orca_session_id = NULL, creator_orca_session_id = NULL; UPDATE runs SET coordinator_orca_session_id = NULL'
+    )
     expect(
       first.getDispatchContextById(rows.structuredDispatchId)?.assignee_orca_session_id
     ).toBeNull()
diff --git a/src/main/runtime/orchestration/orchestration-party-cli-address.test.ts b/src/main/runtime/orchestration/orchestration-party-cli-address.test.ts
new file mode 100644
index 00000000000..f6f1c1e2574
--- /dev/null
+++ b/src/main/runtime/orchestration/orchestration-party-cli-address.test.ts
@@ -0,0 +1,50 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import { injectedSessionAddress } from '../../../shared/agent-session-caller-env'
+import { testOrcaSessionId } from '../../../shared/orca-session-address-test-fixture'
+import {
+  mintStructuredWorkerHandle,
+  mintStructuredWorkerPaneKey,
+  structuredWorkerIdentities,
+  structuredWorkerProcessIncarnation
+} from '../structured-worker-identity'
+import { resolveOrcaSessionParty } from './orchestration-party'
+
+// The CLI spells its own address without the host resolver (it runs before the codec's module
+// graph), so it must land on the one mailbox address the resolver gives the same session.
+const CHAT = testOrcaSessionId('f7a1c0de-1111-4222-8333-444455556666')
+const WORKER = testOrcaSessionId('a0b1c2d3-0000-4000-8000-00000000abcd')
+
+afterEach(() => {
+  structuredWorkerIdentities.clear()
+})
+
+describe("the CLI's own address", () => {
+  it("is a chat's session address, even beside a pane handle it inherited", () => {
+    const hostAddress = resolveOrcaSessionParty(CHAT, null).address
+    expect(injectedSessionAddress({ ORCA_AGENT_SESSION_ID: CHAT })).toBe(hostAddress)
+    expect(
+      injectedSessionAddress({
+        ORCA_AGENT_SESSION_ID: CHAT,
+        ORCA_TERMINAL_HANDLE: 'term_inherited'
+      })
+    ).toBe(hostAddress)
+  })
+
+  it("is a structured worker's minted handle, as the host resolves it", () => {
+    const handle = mintStructuredWorkerHandle()
+    structuredWorkerIdentities.register({
+      handle,
+      sessionId: WORKER,
+      agent: 'claude',
+      paneKey: mintStructuredWorkerPaneKey(WORKER),
+      processIncarnation: structuredWorkerProcessIncarnation(WORKER),
+      worktreeId: 'wt_1',
+      hostScope: { kind: 'local', hostId: 'local' }
+    })
+    const hostAddress = resolveOrcaSessionParty(WORKER, null).address
+    expect(hostAddress).toBe(handle)
+    expect(
+      injectedSessionAddress({ ORCA_AGENT_SESSION_ID: WORKER, ORCA_TERMINAL_HANDLE: handle })
+    ).toBe(hostAddress)
+  })
+})
diff --git a/src/main/runtime/orchestration/orchestration-party.ts b/src/main/runtime/orchestration/orchestration-party.ts
new file mode 100644
index 00000000000..65b6d7a5c5a
--- /dev/null
+++ b/src/main/runtime/orchestration/orchestration-party.ts
@@ -0,0 +1,108 @@
+// The one place an orchestration address becomes a party, so no two sites can disagree on who it names.
+import {
+  formatOrcaSessionAddress,
+  isOrcaSessionId,
+  parseOrcaSessionAddress,
+  type OrcaSessionId
+} from '../../../shared/orca-session-address'
+import { ORCHESTRATION_SESSION_CALLER_ERROR_CODES as CODES } from '../../../shared/orchestration-session-caller-codes'
+import {
+  isRecordedStructuredWorkerSession,
+  resolveStructuredWorkerIdentity,
+  resolveStructuredWorkerIdentityForSession
+} from '../structured-worker-authority'
+import { canonicalOrcaSessionId } from './canonical-orca-session-id'
+import type { OrchestrationDb } from './db'
+import { mailboxAddressOf, type OrchestrationCallerIdentity } from './orchestration-caller-identity'
+import { OrchestrationError } from './orchestration-error'
+
+/** A party as Run binding and mail routing match it; `address` is its one mailbox address. */
+export type OrchestrationParty = OrchestrationCallerIdentity
+
+/** A party named by an Orca session id: a structured worker, or a chat. */
+export type OrchestrationSessionParty = OrchestrationParty &
+  Readonly<{ orcaSessionId: OrcaSessionId }>
+
+const NO_EFFECTS = { effectsApplied: false } as const
+
+/** Every param naming a party other than the caller; a new one is added here with its own test. */
+export const ORCHESTRATION_TARGET_PARAM: Readonly<Record<string, 'to' | 'terminal'>> = {
+  'orchestration.send': 'to',
+  'orchestration.ask': 'to',
+  'orchestration.dispatch': 'to',
+  'orchestration.inbox': 'terminal'
+}
+
+/** The party an Orca session id names. Throws when it is a worker this host lost the identity of. */
+export function resolveOrcaSessionParty(
+  orcaSessionId: OrcaSessionId,
+  db: OrchestrationDb | null | undefined
+): OrchestrationSessionParty {
+  const id = canonicalOrcaSessionId(orcaSessionId)
+  const worker = resolveStructuredWorkerIdentityForSession(id, db)
+  if (!worker && db && isRecordedStructuredWorkerSession(id, db)) {
+    // Why: handle-less, it would split one worker into two parties and bind like a chat.
+    throw new OrchestrationError(
+      CODES.notLive,
+      `Agent session ${id} is a structured worker whose worker identity this host no longer has, so orchestration cannot address it. No effects were applied.`,
+      NO_EFFECTS
+    )
+  }
+  const key = { terminalHandle: worker?.handle ?? null, orcaSessionId: id }
+  return {
+    ...key,
+    address: mailboxAddressOf(key) ?? formatOrcaSessionAddress(id),
+    paneKey: worker?.paneKey ?? null
+  }
+}
+
+/** The party an address names; a PTY handle is itself and costs no lookup. */
+export function resolveOrchestrationParty(
+  address: string,
+  db: OrchestrationDb | null | undefined
+): OrchestrationParty {
+  const orcaSessionId = parseOrcaSessionAddress(address)
+  if (orcaSessionId) {
+    return resolveOrcaSessionParty(orcaSessionId, db)
+  }
+  const worker = resolveStructuredWorkerIdentity(address, db)
+  return {
+    address,
+    terminalHandle: address,
+    paneKey: worker?.paneKey ?? null,
+    orcaSessionId:
+      worker && isOrcaSessionId(worker.sessionId) ? canonicalOrcaSessionId(worker.sessionId) : null
+  }
+}
+
+/** A caller named by a param: naming a chat's address proves nothing, unlike its own session id. */
+export function resolveDeclaredCallerParty(
+  address: string,
+  db: OrchestrationDb | null | undefined
+): OrchestrationParty {
+  const party = resolveOrchestrationParty(address, db)
+  if (party.terminalHandle === null) {
+    throw new OrchestrationError(
+      CODES.chatNotDeclarable,
+      `Agent session ${party.orcaSessionId} is a chat, and a chat is identified only by the session id its own environment sends, never by naming its address. No effects were applied.`,
+      NO_EFFECTS
+    )
+  }
+  return party
+}
+
+/** A Dispatch assignee: a terminal or a structured worker, never a chat yet. */
+export function resolveDispatchAssigneeParty(
+  address: string,
+  db: OrchestrationDb | null | undefined
+): OrchestrationParty {
+  const party = resolveOrchestrationParty(address, db)
+  if (party.terminalHandle === null) {
+    throw new OrchestrationError(
+      CODES.chatNotDispatchable,
+      `Agent session ${party.orcaSessionId} is a chat, and a chat can't receive a dispatch yet. Start a worker with worker-start instead. No effects were applied.`,
+      NO_EFFECTS
+    )
+  }
+  return party
+}
diff --git a/src/main/runtime/orchestration/preamble.ts b/src/main/runtime/orchestration/preamble.ts
index 208868ce45b..a9fbb528939 100644
--- a/src/main/runtime/orchestration/preamble.ts
+++ b/src/main/runtime/orchestration/preamble.ts
@@ -147,12 +147,13 @@ ${params.taskSpec}`
 
 export type DispatchPreambleSendOptions = Pick<
   RuntimeAgentPromptWriteOptions,
-  'leadLine' | 'acceptQueued' | 'observationTimeoutMs' | 'requestId'
+  'leadLine' | 'acceptQueued' | 'observationTimeoutMs' | 'requestId' | 'inputKind'
 >
 
 export function dispatchPreambleSendOptions(requestId: string): DispatchPreambleSendOptions {
   // Why: a delayed provider hook must not revoke an accepted Dispatch.
   return {
+    inputKind: 'driving',
     leadLine: ORCA_DISPATCH_PROMPT_LEAD_LINE,
     acceptQueued: true,
     observationTimeoutMs: 0,
diff --git a/src/main/runtime/orchestration/run-coordinator-orca-session-address.test.ts b/src/main/runtime/orchestration/run-coordinator-orca-session-address.test.ts
index f93e1e4a4b5..4dd07052d6f 100644
--- a/src/main/runtime/orchestration/run-coordinator-orca-session-address.test.ts
+++ b/src/main/runtime/orchestration/run-coordinator-orca-session-address.test.ts
@@ -6,6 +6,7 @@ import {
   formatOrcaSessionAddress,
   parseOrcaSessionAddress
 } from '../../../shared/orca-session-address'
+import { testOrcaSessionId } from '../../../shared/orca-session-address-test-fixture'
 import {
   mintStructuredWorkerHandle,
   mintStructuredWorkerPaneKey,
@@ -14,9 +15,9 @@ import {
 import { OrchestrationDb } from './db'
 import { backfillStructuredWorkerOrcaSessionIds } from './db/schema/structured-worker-orca-session-backfill'
 
-const CHAT_SESSION_ID = '3a5c7e9b-1d4f-4a6c-8b0e-2f4a6c8e0b14'
+const CHAT_SESSION_ID = testOrcaSessionId('3a5c7e9b-1d4f-4a6c-8b0e-2f4a6c8e0b14')
 const CHAT_ADDRESS = formatOrcaSessionAddress(CHAT_SESSION_ID)
-const WORKER_SESSION_ID = '4b6d8f0c-2e5a-4b7d-9c1f-3a5b7d9f1c25'
+const WORKER_SESSION_ID = testOrcaSessionId('4b6d8f0c-2e5a-4b7d-9c1f-3a5b7d9f1c25')
 const WORKER_ADDRESS = formatOrcaSessionAddress(WORKER_SESSION_ID)
 const PTY_PANE = 'tab_pty:66666666-6666-4666-8666-666666666666'
 
diff --git a/src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts b/src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts
index 048fc7732e4..9b40bc08b0d 100644
--- a/src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts
+++ b/src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts
@@ -4,6 +4,11 @@ import {
   OrchestrationStructuredMailboxPointerDelivery,
   type StructuredMailboxPointerHost
 } from './structured-mailbox-pointer-delivery'
+import type { StructuredPointerOperationRow } from './db/messages/structured-pointer-operation-store'
+import {
+  structuredPointerBatchFingerprint,
+  type StructuredPointerSubmission
+} from './structured-pointer-operation-id'
 import { structuredSessionGateFacts } from './structured-session-pointer-delivery'
 import type { StructuredWorkerIdentity } from '../structured-worker-identity'
 
@@ -84,13 +89,15 @@ function harness(options: {
   const mailbox = options.mailbox ?? 'dispatch:d1'
   const dispatchId = options.dispatchId === undefined ? 'd1' : options.dispatchId
   let journal = options.journal
+  // The session's recorded sends, as its journal reports them.
+  let submissions: StructuredPointerSubmission[] = []
   const markAsDelivered = vi.fn()
   const send: StructuredMailboxPointerHost['send'] = vi.fn(async () => ({
     kind: 'sent' as const,
     state: options.dispatchState ?? ('accepted' as const)
   }))
   const sendMock = vi.mocked(send)
-  const stored = new Map<string, unknown>()
+  const stored = new Map<string, StructuredPointerOperationRow>()
   const db = {
     getDispatchContextById: () => ({ run_id: 'run_1' }),
     hasOutstandingMailboxDelivery: (handle: string) =>
@@ -99,7 +106,7 @@ function harness(options: {
     getUndeliveredUnreadMessages: () => [{ id: 'm1', type: 'status', sequence: 3 }],
     markAsDelivered,
     getStructuredPointerOperation: (key: string) => stored.get(key),
-    putStructuredPointerOperation: (row: { mailbox_handle: string }) =>
+    putStructuredPointerOperation: (row: StructuredPointerOperationRow) =>
       stored.set(row.mailbox_handle, row),
     deleteStructuredPointerOperation: (key: string) => stored.delete(key)
   }
@@ -108,8 +115,10 @@ function harness(options: {
     getMessageWaiters: () => undefined,
     resolveStructuredTarget: (mailboxHandle) =>
       mailboxHandle === mailbox ? { sessionId: IDENTITY.sessionId, dispatchId } : null,
+    getCliCommand: () => 'orca-dev',
     host: {
-      readGateFacts: () => (journal === null ? null : structuredSessionGateFacts(journal)),
+      readGateFacts: async () =>
+        journal === null ? null : { ...structuredSessionGateFacts(journal), submissions },
       currentFence: () => 4,
       send
     }
@@ -121,6 +130,9 @@ function harness(options: {
     stored,
     setJournal: (next: AgentJournalRenderItem[] | null) => {
       journal = next
+    },
+    setSubmissions: (next: StructuredPointerSubmission[]) => {
+      submissions = next
     }
   }
 }
@@ -261,9 +273,10 @@ describe('structured mailbox pointer delivery', () => {
     expect(send).not.toHaveBeenCalled()
   })
 
-  it('retries a rejected nudge on the next journal edge', async () => {
+  it('retries a rejected nudge on the next journal edge, under the same id', async () => {
     // A rejection consumes no mail and nothing else redrives this mailbox, so leaving it unparked
-    // stranded the worker until unrelated mail happened to arrive.
+    // stranded the worker until unrelated mail happened to arrive. The retry keeps the id: the host
+    // replays a recorded refusal rather than starting the agent again.
     const { delivery, send, markAsDelivered } = harness({
       journal: idleJournal(),
       dispatchState: 'rejected'
@@ -276,9 +289,143 @@ describe('structured mailbox pointer delivery', () => {
     delivery.onJournalActivity('session-1')
     await flush()
     expect(send).toHaveBeenCalledTimes(2)
+    expect(send.mock.calls[1]![0].operationId).toBe(first)
+  })
+
+  it('points again under a new id once a later send ran', async () => {
+    const { delivery, send, setSubmissions } = harness({
+      journal: idleJournal(),
+      dispatchState: 'unknown'
+    })
+    delivery.deliverForHandle('dispatch:d1')
+    await flush()
+    const first = send.mock.calls[0]![0].operationId
+    setSubmissions([
+      { clientMessageId: first, dispatchState: 'unknown', submittedAt: Date.now() },
+      { clientMessageId: 'user-turn', dispatchState: 'accepted', submittedAt: Date.now() + 1 }
+    ])
+    delivery.onJournalActivity('session-1')
+    await flush()
+    expect(send).toHaveBeenCalledTimes(2)
     expect(send.mock.calls[1]![0].operationId).not.toBe(first)
   })
 
+  it('points once more under a new id for a send an earlier process left in doubt', async () => {
+    const { delivery, send, stored, setSubmissions } = harness({
+      journal: idleJournal(),
+      dispatchState: 'unknown'
+    })
+    stored.set('dispatch:d1', {
+      mailbox_handle: 'dispatch:d1',
+      session_id: 'session-1',
+      operation_id: 'earlier-process-op',
+      batch_fingerprint: structuredPointerBatchFingerprint('session-1', ['m1']),
+      minted_at_ms: 0
+    })
+    setSubmissions([
+      { clientMessageId: 'earlier-process-op', dispatchState: 'unknown', submittedAt: Date.now() }
+    ])
+    delivery.deliverForHandle('dispatch:d1')
+    await flush()
+    expect(send).toHaveBeenCalledTimes(1)
+    const reminted = send.mock.calls[0]![0].operationId
+    expect(reminted).not.toBe('earlier-process-op')
+    // Minted by this process, the new id replays from here on.
+    setSubmissions([
+      { clientMessageId: 'earlier-process-op', dispatchState: 'unknown', submittedAt: Date.now() },
+      { clientMessageId: reminted, dispatchState: 'unknown', submittedAt: Date.now() }
+    ])
+    delivery.onJournalActivity('session-1')
+    await flush()
+    expect(send.mock.calls[1]![0].operationId).toBe(reminted)
+  })
+
+  it('keeps replaying its own send across a clock step, and re-mints only for a rewind that ran a turn', async () => {
+    vi.useFakeTimers({ toFake: ['Date'] })
+    try {
+      const { delivery, send, setSubmissions } = harness({
+        journal: idleJournal(),
+        dispatchState: 'unknown'
+      })
+      // The wall clock steps back an hour after the lane started: its own row is still its own.
+      vi.setSystemTime(Date.now() - 60 * 60 * 1000)
+      delivery.deliverForHandle('dispatch:d1')
+      await flush()
+      const first = send.mock.calls[0]![0].operationId
+      setSubmissions([
+        { clientMessageId: first, dispatchState: 'unknown', submittedAt: Date.now() }
+      ])
+      delivery.onJournalActivity('session-1')
+      await flush()
+      expect(send.mock.calls[1]![0].operationId).toBe(first)
+      // A rewind dropped that send from the journal, and the person's turn ran after it.
+      setSubmissions([
+        { clientMessageId: 'user-turn', dispatchState: 'accepted', submittedAt: Date.now() + 1 }
+      ])
+      delivery.onJournalActivity('session-1')
+      await flush()
+      expect(send.mock.calls[2]![0].operationId).not.toBe(first)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('does not read a turn from before a backward clock step as one that ran after its pointer', async () => {
+    vi.useFakeTimers({ toFake: ['Date'] })
+    try {
+      const { delivery, send, setSubmissions } = harness({
+        journal: idleJournal(),
+        dispatchState: 'unknown'
+      })
+      const personTurn = {
+        clientMessageId: 'user-turn',
+        dispatchState: 'accepted' as const,
+        submittedAt: Date.now()
+      }
+      setSubmissions([personTurn])
+      vi.setSystemTime(Date.now() - 2 * 60 * 1000)
+      delivery.deliverForHandle('dispatch:d1')
+      await flush()
+      const first = send.mock.calls[0]![0].operationId
+      setSubmissions([
+        personTurn,
+        { clientMessageId: first, dispatchState: 'unknown', submittedAt: Date.now() }
+      ])
+      for (let edge = 0; edge < 3; edge++) {
+        delivery.onJournalActivity('session-1')
+        await flush()
+      }
+      expect(send.mock.calls.map(([input]) => input.operationId)).toEqual([
+        first,
+        first,
+        first,
+        first
+      ])
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('stamps a pointer whose echo arrived after the lane stopped waiting, sending nothing more', async () => {
+    const { delivery, send, markAsDelivered, stored, setSubmissions } = harness({
+      journal: idleJournal(),
+      dispatchState: 'unknown'
+    })
+    delivery.deliverForHandle('dispatch:d1')
+    await flush()
+    const first = send.mock.calls[0]![0].operationId
+    setSubmissions([{ clientMessageId: first, dispatchState: 'pending', submittedAt: Date.now() }])
+    delivery.onJournalActivity('session-1')
+    await flush()
+    expect(send).toHaveBeenCalledTimes(1)
+    setSubmissions([{ clientMessageId: first, dispatchState: 'accepted', submittedAt: Date.now() }])
+    delivery.onJournalActivity('session-1')
+    await flush()
+    expect(send).toHaveBeenCalledTimes(1)
+    expect(markAsDelivered).toHaveBeenCalledWith(['m1'])
+    expect(stored.has('dispatch:d1')).toBe(false)
+  })
+
   it('reuses one operation id for the same batch and re-mints when it grows', async () => {
     const { delivery, send, stored } = harness({
       journal: idleJournal(),
@@ -328,8 +475,9 @@ describe('forgetting one settled worker', () => {
           ? { sessionId, dispatchId: mailboxHandle.slice('dispatch:'.length) }
           : null
       },
+      getCliCommand: () => 'orca',
       host: {
-        readGateFacts: () => structuredSessionGateFacts(journal),
+        readGateFacts: async () => ({ ...structuredSessionGateFacts(journal), submissions: [] }),
         currentFence: () => 4,
         send
       }
diff --git a/src/main/runtime/orchestration/structured-mailbox-pointer-delivery.ts b/src/main/runtime/orchestration/structured-mailbox-pointer-delivery.ts
index 62a555d4119..2a5e75a4ef8 100644
--- a/src/main/runtime/orchestration/structured-mailbox-pointer-delivery.ts
+++ b/src/main/runtime/orchestration/structured-mailbox-pointer-delivery.ts
@@ -9,17 +9,21 @@
  *
  * Coordinators are in scope here, unlike the PTY lane's reasoning: a PTY coordinator blocks in
  * `check --wait`, where a waiter preempts pointer delivery, but a structured coordinator is a chat
- * session whose turn ends — so nothing else would ever wake it for its own `run:` mail.
+ * session whose turn ends — so nothing else would ever prompt it for its own `run:` mail.
  */
 
 import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
 import type { OrchestrationDb } from './db'
 import { formatMessagePointer } from './formatter'
+import type { OrchestrationCliCommand } from './cli-command'
 import {
   selectOrchestrationPointerBatch,
   type OrchestrationMessageWaiter
 } from './mailbox-pointer-eligibility'
-import { resolveStructuredPointerOperation } from './structured-pointer-operation-id'
+import {
+  resolveStructuredPointerOperation,
+  type StructuredPointerSubmission
+} from './structured-pointer-operation-id'
 import {
   decideStructuredSessionPointerDelivery,
   retainReasonForDispatch,
@@ -48,9 +52,14 @@ export type StructuredPointerSendOutcome =
   | { kind: 'sent'; state: StructuredDispatchState }
   | { kind: 'unattached' }
 
+export type StructuredPointerGateFacts = StructuredSessionGateFacts & {
+  /** Every send the session recorded, oldest first: what the lane's own sends settled as. */
+  submissions: readonly StructuredPointerSubmission[]
+}
+
 export type StructuredMailboxPointerHost = {
-  /** The idle gate, read off the session's full reduced timeline; `null` when it is not attached. */
-  readGateFacts: (sessionId: string) => StructuredSessionGateFacts | null
+  /** The idle gate, read off the session's full reduced timeline; `null` when it cannot be read. */
+  readGateFacts: (sessionId: string) => Promise<StructuredPointerGateFacts | null>
   send: (input: {
     sessionId: string
     dispatchId: string | null
@@ -73,6 +82,8 @@ type StructuredPointerDeliveryDependencies<TWaiter extends OrchestrationMessageW
    * agents mail each other outside a dispatch, and no other lane can serve it.
    */
   resolveStructuredTarget: (mailboxHandle: string) => StructuredPointerTarget | null
+  /** The CLI name the PTY lane types for a local agent, so both lanes send the same pointer. */
+  getCliCommand: () => OrchestrationCliCommand
   host: StructuredMailboxPointerHost
   onRetain?: (input: {
     mailboxHandle: string
@@ -95,6 +106,9 @@ export class OrchestrationStructuredMailboxPointerDelivery<
    * edge until the next explicit check.
    */
   private readonly parkedUntilJournalEdge = new Map<string, ParkedPointerDelivery>()
+  /** The operation id this lane last sent per mailbox: a row holding any other id outlived the
+   *  process that minted it. A fact, not a clock reading, so no clock step can fake it. */
+  private readonly sentOperationIds = new Map<string, string>()
 
   constructor(private readonly deps: StructuredPointerDeliveryDependencies<TWaiter>) {}
 
@@ -176,6 +190,7 @@ export class OrchestrationStructuredMailboxPointerDelivery<
     }
   }
 
+  // A session whose agent is not running needs nothing first: an accepted send starts it.
   private async attempt(
     db: OrchestrationDb,
     mailboxHandle: string,
@@ -184,7 +199,7 @@ export class OrchestrationStructuredMailboxPointerDelivery<
     reservedTypes: ReadonlySet<string> | undefined
   ): Promise<void> {
     const sessionId = target.sessionId
-    const session = this.deps.host.readGateFacts(sessionId)
+    const session = await this.deps.host.readGateFacts(sessionId)
     const decision = decideStructuredSessionPointerDelivery({ session })
     if (!decision.deliver) {
       this.retain(mailboxHandle, sessionId, decision.retain, reservedTypes)
@@ -198,7 +213,12 @@ export class OrchestrationStructuredMailboxPointerDelivery<
     const body: AgentJournalMessageItem = {
       kind: 'message',
       role: 'user',
-      blocks: [{ type: 'text', text: formatMessagePointer(unread.length, mailboxHandle).trim() }]
+      blocks: [
+        {
+          type: 'text',
+          text: formatMessagePointer(unread.length, mailboxHandle, this.deps.getCliCommand()).trim()
+        }
+      ]
     }
     const staged = unread.map((message) => message.id)
     const operation = resolveStructuredPointerOperation({
@@ -206,8 +226,22 @@ export class OrchestrationStructuredMailboxPointerDelivery<
       mailboxHandle,
       sessionId,
       body,
-      messageIds: staged
+      messageIds: staged,
+      submissions: session?.submissions ?? [],
+      sentByThisProcess: this.sentOperationIds.get(mailboxHandle)
     })
+    if (operation.kind === 'stamp') {
+      // A send this lane gave up waiting on ran after all.
+      db.markAsDelivered(staged)
+      db.deleteStructuredPointerOperation(mailboxHandle)
+      this.sentOperationIds.delete(mailboxHandle)
+      return
+    }
+    if (operation.kind === 'park') {
+      this.retain(mailboxHandle, sessionId, 'turn-unsettled', reservedTypes)
+      return
+    }
+    this.sentOperationIds.set(mailboxHandle, operation.operationId)
     const outcome = await this.deps.host.send({
       sessionId,
       dispatchId: target.dispatchId,
@@ -221,21 +255,15 @@ export class OrchestrationStructuredMailboxPointerDelivery<
       return
     }
     if (!structuredDispatchDelivered(outcome.state)) {
-      if (outcome.state === 'rejected') {
-        db.deleteStructuredPointerOperation(mailboxHandle)
-      }
-      this.retain(
-        mailboxHandle,
-        sessionId,
-        retainReasonForDispatch(outcome.state as Exclude<StructuredDispatchState, 'accepted'>),
-        reservedTypes
-      )
+      // The row stays: resending under its id replays this verdict and starts nothing.
+      this.retain(mailboxHandle, sessionId, retainReasonForDispatch(outcome.state), reservedTypes)
       return
     }
     db.markAsDelivered(staged)
     // The nudge landed as its own turn, so the next settle edge is the natural retry point for
     // anything that arrives while it runs.
     db.deleteStructuredPointerOperation(mailboxHandle)
+    this.sentOperationIds.delete(mailboxHandle)
   }
 
   /**
diff --git a/src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts b/src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts
index 91bf1158e07..fee8909a445 100644
--- a/src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts
+++ b/src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts
@@ -38,30 +38,33 @@ describe('structured mailbox pointer host', () => {
     hostRef.current = null
   })
 
-  it('reads the gate facts from the FULL timeline, never a bounded tail', () => {
+  it('reads the gate facts from the FULL timeline, never a bounded tail', async () => {
     // The defect this pins: a running turn is announced by ONE lifecycle item, and settlement
     // tombstones it rather than rewriting it. A long tool-calling turn pushes that item arbitrarily
     // far from the tail, so any page-sized read reports a busy worker as idle — and the pointer is
-    // then delivered mid-turn, which Codex coalesces into the running turn and Claude queues behind
+    // then delivered mid-turn, which Codex coalesces into the running turn and Claude folds into
     // it -- either way folded into work already in flight rather than read as a new instruction.
     const items = [runningTurn(), ...transcript(500)]
-    hostRef.current = { journalSnapshot: () => ({ items }) }
-    expect(createStructuredMailboxPointerHost().readGateFacts('s1')).toEqual({
+    const submissions = [{ clientMessageId: 'op1', dispatchState: 'unknown' }]
+    hostRef.current = { journalSnapshot: () => ({ items, submissions }) }
+    // The recorded sends ride along: the lane reads what its own operation id settled as.
+    expect(await createStructuredMailboxPointerHost().readGateFacts('s1')).toEqual({
       turnRunning: true,
-      awaitingHuman: false
+      awaitingHuman: false,
+      submissions
     })
   })
 
-  it('answers null rather than idle when the session cannot be read', () => {
+  it('answers null rather than idle when the session cannot be read', async () => {
     // Null retains the pointer; `{turnRunning:false}` would deliver a nudge into a session this
     // runtime cannot see at all.
-    expect(createStructuredMailboxPointerHost().readGateFacts('s1')).toBeNull()
+    expect(await createStructuredMailboxPointerHost().readGateFacts('s1')).toBeNull()
     hostRef.current = {
       journalSnapshot: () => {
         throw new Error('agent_session_ownership_unknown')
       }
     }
-    expect(createStructuredMailboxPointerHost().readGateFacts('s1')).toBeNull()
+    expect(await createStructuredMailboxPointerHost().readGateFacts('s1')).toBeNull()
   })
 
   it('reports an unattached host rather than a rejection when nothing can be sent', async () => {
@@ -91,7 +94,7 @@ describe('structured mailbox pointer host', () => {
         value: { submission: { dispatchState } }
       })
     )
-    hostRef.current = { send }
+    hostRef.current = { send, waitForSendSettlement: async () => undefined }
     await expect(
       createStructuredMailboxPointerHost().send({
         sessionId: 's1',
@@ -107,6 +110,28 @@ describe('structured mailbox pointer host', () => {
     expect(send.mock.calls[0]![1]!.retryUnknown).toBeUndefined()
   })
 
+  it('consumes mail once an accepted nudge is delivered while the worker starts (W10)', async () => {
+    hostRef.current = {
+      send: async () => ({
+        ok: true,
+        value: { clientMessageId: 'op1', submission: { dispatchState: 'pending' } }
+      }),
+      waitForSendSettlement: async () => ({
+        value: { clientMessageId: 'op1', submission: { dispatchState: 'accepted' } }
+      })
+    }
+    await expect(
+      createStructuredMailboxPointerHost().send({
+        sessionId: 's1',
+        dispatchId: 'd1',
+        operationId: 'op1',
+        expectedRuntimeFence: 1,
+        payloadFingerprint: 'fp',
+        body: { kind: 'message', role: 'user', blocks: [] }
+      } as never)
+    ).resolves.toEqual({ kind: 'sent', state: 'accepted' })
+  })
+
   it('scopes direct peer mail to the session when there is no dispatch to scope to', async () => {
     // Direct mail is addressed to the worker's own handle, so there may be no dispatch at all.
     // The ledger is keyed on (callerKey, operationId): a key derived from the session keeps that
diff --git a/src/main/runtime/orchestration/structured-mailbox-pointer-host.ts b/src/main/runtime/orchestration/structured-mailbox-pointer-host.ts
index b722952df92..ecfdff0dff5 100644
--- a/src/main/runtime/orchestration/structured-mailbox-pointer-host.ts
+++ b/src/main/runtime/orchestration/structured-mailbox-pointer-host.ts
@@ -6,9 +6,15 @@
  * the send and reports what the host said.
  */
 
+import { ORCHESTRATION_READINESS_TIMEOUT_MS } from '../../../shared/orchestration-timing-budgets'
+import { agentSessionSendSubmission } from '../../../shared/agent-session-wire'
 import { AGENT_SESSION_NOT_ATTACHED } from '../../native-chat/agent-session-wire/structured-agent-session-mutation-admission'
 import { getStructuredAgentSessionHost } from '../../native-chat/agent-session-wire/structured-agent-session-registry'
-import type { StructuredMailboxPointerHost } from './structured-mailbox-pointer-delivery'
+import type {
+  StructuredMailboxPointerHost,
+  StructuredPointerGateFacts
+} from './structured-mailbox-pointer-delivery'
+import type { AgentJournalSnapshot } from '../../../shared/agent-session-journal-types'
 import {
   structuredSessionGateFacts,
   type StructuredSessionGateFacts
@@ -38,15 +44,29 @@ export function structuredSessionPointerCallerKey(sessionId: string): string {
  * idle-with-history is the normal steady state of a working agent. Shared so the pointer lane and
  * group addressing cannot disagree about it.
  */
-export function readStructuredSessionGateFacts(
+export async function readStructuredSessionGateFacts(
   sessionId: string
-): StructuredSessionGateFacts | null {
+): Promise<StructuredSessionGateFacts | null> {
+  const snapshot = await readSessionJournal(sessionId)
+  return snapshot ? structuredSessionGateFacts(snapshot.items) : null
+}
+
+/** The pointer lane's gate: the shared idle facts, plus what each recorded send settled as. */
+async function readPointerGateFacts(sessionId: string): Promise<StructuredPointerGateFacts | null> {
+  const snapshot = await readSessionJournal(sessionId)
+  return snapshot
+    ? { ...structuredSessionGateFacts(snapshot.items), submissions: snapshot.submissions }
+    : null
+}
+
+async function readSessionJournal(sessionId: string): Promise<AgentJournalSnapshot | null> {
   const host = getStructuredAgentSessionHost()
   if (!host) {
     return null
   }
   try {
-    return structuredSessionGateFacts(host.journalSnapshot(sessionId).items)
+    // Opens a conversation the idle sweep closed; that starts no agent.
+    return await host.journalSnapshot(sessionId)
   } catch (error) {
     // Not attached is a retain reason, not a failure; anything else is still unreadable.
     if ((error as Error)?.message !== AGENT_SESSION_NOT_ATTACHED.code) {
@@ -59,7 +79,7 @@ export function readStructuredSessionGateFacts(
 export function createStructuredMailboxPointerHost(): StructuredMailboxPointerHost {
   return {
     readGateFacts(sessionId) {
-      return readStructuredSessionGateFacts(sessionId)
+      return readPointerGateFacts(sessionId)
     },
 
     currentFence(sessionId) {
@@ -94,8 +114,22 @@ export function createStructuredMailboxPointerHost(): StructuredMailboxPointerHo
           ? { kind: 'unattached' }
           : { kind: 'sent', state: 'rejected' }
       }
-      // `pending` is not yet an acknowledgement; only `accepted` may consume mail.
-      const state = result.value.submission.dispatchState
+      // `pending` is not yet an acknowledgement; only `accepted` may consume mail. Accepted is not
+      // delivered, so wait out a start; a wait that runs out parks for the next journal edge.
+      const answered = agentSessionSendSubmission(result.value)
+      const submission =
+        answered?.dispatchState === 'pending'
+          ? (agentSessionSendSubmission(
+              (
+                await host
+                  .waitForSendSettlement(input.sessionId, result.value.clientMessageId, {
+                    budgetMs: ORCHESTRATION_READINESS_TIMEOUT_MS
+                  })
+                  .catch(() => undefined)
+              )?.value
+            ) ?? answered)
+          : answered
+      const state = submission?.dispatchState
       return {
         kind: 'sent',
         state: state === 'accepted' ? 'accepted' : state === 'rejected' ? 'rejected' : 'unknown'
diff --git a/src/main/runtime/orchestration/structured-pointer-operation-id.test.ts b/src/main/runtime/orchestration/structured-pointer-operation-id.test.ts
index 35e75c865bc..fe891ef48ba 100644
--- a/src/main/runtime/orchestration/structured-pointer-operation-id.test.ts
+++ b/src/main/runtime/orchestration/structured-pointer-operation-id.test.ts
@@ -1,9 +1,14 @@
 import { describe, expect, it } from 'vitest'
-import { AGENT_SESSION_MAX_OPERATION_REPLAY_AGE_MS } from '../../../shared/agent-session-host-authority'
+import {
+  AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS,
+  AGENT_SESSION_MAX_OPERATION_REPLAY_AGE_MS
+} from '../../../shared/agent-session-host-authority'
 import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
 import {
+  decideStructuredPointerAttempt,
   mintAgentSessionOperationId,
-  resolveStructuredPointerOperation
+  resolveStructuredPointerOperation,
+  type StructuredPointerSubmission
 } from './structured-pointer-operation-id'
 
 const OPERATION_ID_PATTERN = /^\d{13}-[0-9a-f]{32}$/
@@ -12,6 +17,27 @@ function body(text: string): AgentJournalMessageItem {
   return { kind: 'message', role: 'user', blocks: [{ type: 'text', text }] }
 }
 
+/** The id this batch resolves to, as this process sends it; unrecorded unless `submissions` say. */
+function resolveId(
+  args: Omit<
+    Parameters<typeof resolveStructuredPointerOperation>[0],
+    'submissions' | 'sentByThisProcess'
+  > & { submissions?: StructuredPointerSubmission[] }
+): {
+  operationId: string
+  payloadFingerprint: string
+} {
+  const resolved = resolveStructuredPointerOperation({
+    ...args,
+    submissions: args.submissions ?? [],
+    sentByThisProcess: args.db.getStructuredPointerOperation(args.mailboxHandle)?.operation_id
+  })
+  if (resolved.kind !== 'send') {
+    throw new Error(`expected a send, got ${resolved.kind}`)
+  }
+  return resolved
+}
+
 function fakeDb() {
   const rows = new Map<string, { mailbox_handle: string; operation_id: string }>()
   return {
@@ -30,7 +56,7 @@ describe('structured pointer operation id', () => {
 
   it('reuses one id for the same batch', () => {
     const db = fakeDb()
-    const first = resolveStructuredPointerOperation({
+    const first = resolveId({
       db,
       mailboxHandle: 'dispatch:d1',
       sessionId: 's1',
@@ -38,7 +64,7 @@ describe('structured pointer operation id', () => {
       messageIds: ['m1', 'm2'],
       now: 1_000
     })
-    const second = resolveStructuredPointerOperation({
+    const second = resolveId({
       db,
       mailboxHandle: 'dispatch:d1',
       sessionId: 's1',
@@ -52,7 +78,7 @@ describe('structured pointer operation id', () => {
 
   it('re-mints when the batch grows', () => {
     const db = fakeDb()
-    const first = resolveStructuredPointerOperation({
+    const first = resolveId({
       db,
       mailboxHandle: 'dispatch:d1',
       sessionId: 's1',
@@ -60,7 +86,7 @@ describe('structured pointer operation id', () => {
       messageIds: ['m1', 'm2'],
       now: 1_000
     })
-    const grown = resolveStructuredPointerOperation({
+    const grown = resolveId({
       db,
       mailboxHandle: 'dispatch:d1',
       sessionId: 's1',
@@ -72,8 +98,9 @@ describe('structured pointer operation id', () => {
   })
 
   it('never re-mints an ambiguous batch after the host replay window expires', () => {
+    // The host recorded the send `unknown`: whether the nudge landed is still open, however old.
     const db = fakeDb()
-    const first = resolveStructuredPointerOperation({
+    const first = resolveId({
       db,
       mailboxHandle: 'dispatch:d1',
       sessionId: 's1',
@@ -81,12 +108,15 @@ describe('structured pointer operation id', () => {
       messageIds: ['m1', 'm2'],
       now: 1_000
     })
-    const aged = resolveStructuredPointerOperation({
+    const aged = resolveId({
       db,
       mailboxHandle: 'dispatch:d1',
       sessionId: 's1',
       body: body('2 messages'),
       messageIds: ['m1', 'm2'],
+      submissions: [
+        { clientMessageId: first.operationId, dispatchState: 'unknown', submittedAt: 1_000 }
+      ],
       now: 1_000 + AGENT_SESSION_MAX_OPERATION_REPLAY_AGE_MS + 1
     })
     expect(aged.operationId).toBe(first.operationId)
@@ -98,7 +128,7 @@ describe('structured pointer operation id', () => {
     // its ledger answer — `accepted`, with no turn sent — and the lane then marks the NEW mail
     // delivered. The worker is never told, and the mail is gone.
     const db = fakeDb()
-    const first = resolveStructuredPointerOperation({
+    const first = resolveId({
       db,
       mailboxHandle: 'dispatch:d1',
       sessionId: 's1',
@@ -106,7 +136,7 @@ describe('structured pointer operation id', () => {
       messageIds: ['m1', 'm2'],
       now: 1_000
     })
-    const different = resolveStructuredPointerOperation({
+    const different = resolveId({
       db,
       mailboxHandle: 'dispatch:d1',
       sessionId: 's1',
@@ -120,7 +150,7 @@ describe('structured pointer operation id', () => {
 
   it('re-mints when a retained batch is reordered or partly consumed', () => {
     const db = fakeDb()
-    const first = resolveStructuredPointerOperation({
+    const first = resolveId({
       db,
       mailboxHandle: 'dispatch:d1',
       sessionId: 's1',
@@ -128,7 +158,7 @@ describe('structured pointer operation id', () => {
       messageIds: ['m1', 'm2'],
       now: 1_000
     })
-    const shifted = resolveStructuredPointerOperation({
+    const shifted = resolveId({
       db,
       mailboxHandle: 'dispatch:d1',
       sessionId: 's1',
@@ -141,7 +171,7 @@ describe('structured pointer operation id', () => {
 
   it('re-mints when the mailbox moves to a different session', () => {
     const db = fakeDb()
-    const first = resolveStructuredPointerOperation({
+    const first = resolveId({
       db,
       mailboxHandle: 'dispatch:d1',
       sessionId: 's1',
@@ -149,7 +179,7 @@ describe('structured pointer operation id', () => {
       messageIds: ['m1', 'm2'],
       now: 1_000
     })
-    const moved = resolveStructuredPointerOperation({
+    const moved = resolveId({
       db,
       mailboxHandle: 'dispatch:d1',
       sessionId: 's2',
@@ -160,3 +190,99 @@ describe('structured pointer operation id', () => {
     expect(moved.operationId).not.toBe(first.operationId)
   })
 })
+
+describe('what a pointer attempt does with its operation row', () => {
+  const row = {
+    mailbox_handle: 'run:r1',
+    session_id: 's1',
+    operation_id: 'op1',
+    batch_fingerprint: 'batch-1',
+    minted_at_ms: 2_000
+  }
+
+  function decide(
+    submissions: StructuredPointerSubmission[],
+    overrides: {
+      batchFingerprint?: string
+      sessionId?: string
+      mintedByThisProcess?: boolean
+      now?: number
+    } = {}
+  ) {
+    return decideStructuredPointerAttempt({
+      row,
+      sessionId: overrides.sessionId ?? 's1',
+      batchFingerprint: overrides.batchFingerprint ?? 'batch-1',
+      submissions,
+      mintedByThisProcess: overrides.mintedByThisProcess ?? true,
+      now: overrides.now ?? 3_000
+    })
+  }
+
+  const sent = (dispatchState: StructuredPointerSubmission['dispatchState']) => ({
+    clientMessageId: 'op1',
+    dispatchState,
+    submittedAt: 2_000
+  })
+  const userTurn = (dispatchState: StructuredPointerSubmission['dispatchState'], at = 2_500) => ({
+    clientMessageId: 'user-1',
+    dispatchState,
+    submittedAt: at
+  })
+
+  it('mints for a new batch, a new session, or no row at all', () => {
+    expect(decide([], { batchFingerprint: 'batch-2' })).toBe('mint')
+    expect(decide([], { sessionId: 's2' })).toBe('mint')
+    expect(
+      decideStructuredPointerAttempt({
+        row: undefined,
+        sessionId: 's1',
+        batchFingerprint: 'batch-1',
+        submissions: [],
+        mintedByThisProcess: false,
+        now: 0
+      })
+    ).toBe('mint')
+  })
+
+  it('sends under the same id when the host never recorded it', () => {
+    expect(decide([])).toBe('reuse')
+    // A turn that ran before the row was minted is no news.
+    expect(decide([userTurn('accepted', 1_500)])).toBe('reuse')
+  })
+
+  it('stamps a send that ran, and parks one still in flight', () => {
+    expect(decide([sent('accepted')])).toBe('stamp')
+    expect(decide([sent('pending')])).toBe('park')
+  })
+
+  it.each([
+    ['in doubt', sent('unknown')],
+    ['refused', sent('rejected')]
+  ])('replays a send that was %s instead of starting the agent again', (_label, failed) => {
+    expect(decide([failed])).toBe('reuse')
+    // A later send that has not run yet is no evidence the agent works again.
+    expect(decide([failed, userTurn('pending')])).toBe('reuse')
+    // Age never re-mints a recorded send.
+    expect(decide([failed], { now: 2_000 + AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS + 1 })).toBe(
+      'reuse'
+    )
+  })
+
+  it('mints once the agent ran a turn after the row was minted, recorded send or not', () => {
+    expect(decide([sent('unknown'), userTurn('accepted')])).toBe('mint')
+    expect(decide([sent('rejected'), userTurn('accepted')])).toBe('mint')
+    // A rewind dropped the row's own send from the journal.
+    expect(decide([userTurn('accepted')])).toBe('mint')
+  })
+
+  it('mints a row an earlier process left behind, recorded send or not', () => {
+    expect(decide([sent('unknown')], { mintedByThisProcess: false })).toBe('mint')
+    expect(decide([], { mintedByThisProcess: false })).toBe('mint')
+  })
+
+  it('mints an unrecorded send once the host would refuse it as too old to admit', () => {
+    expect(decide([], { now: 2_000 + AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS })).toBe('reuse')
+    expect(decide([], { now: 2_000 + AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS + 1 })).toBe('mint')
+  })
+})
diff --git a/src/main/runtime/orchestration/structured-pointer-operation-id.ts b/src/main/runtime/orchestration/structured-pointer-operation-id.ts
index 0f258ba325f..66710b3b4f4 100644
--- a/src/main/runtime/orchestration/structured-pointer-operation-id.ts
+++ b/src/main/runtime/orchestration/structured-pointer-operation-id.ts
@@ -4,8 +4,11 @@
  * Orchestration's own `msg_<hex>` ids do not match the host's `^\d{13}-[0-9a-f]{32}$` shape and are
  * refused before the first send, so the id is minted here instead. It is durable and reused across
  * retries, because the id IS the send's idempotency key: a fresh id for the same nudge would land
- * as a second turn. It is re-minted only when the send is genuinely a different call — a different
- * batch of mail, or a different session. Age cannot resolve delivery ambiguity.
+ * as a second turn, and the host replays a recorded id's verdict without reaching the provider, so
+ * a retry after a failed send starts nothing. It is re-minted only when the send is genuinely a
+ * different call: a different batch of mail or session, or one the journal shows is owed again
+ * (see `decideStructuredPointerAttempt`). Age never re-mints a send the host recorded: its verdict
+ * is the only evidence of whether the nudge landed.
  *
  * Reuse is keyed on the MESSAGE IDS in the batch, never on the pointer body: the body names only
  * how many messages are waiting, so two unrelated same-size batches share a fingerprint. Reusing a
@@ -14,9 +17,67 @@
  */
 
 import { createHash, randomBytes } from 'node:crypto'
-import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
+import type {
+  AgentJournalMessageItem,
+  AgentJournalSubmission
+} from '../../../shared/agent-session-journal-types'
+import { AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS } from '../../../shared/agent-session-host-authority'
 import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
 import type { OrchestrationDb } from './db'
+import type { StructuredPointerOperationRow } from './db/messages/structured-pointer-operation-store'
+
+/** What the pointer lane reads off a session's journal for its own sends. */
+export type StructuredPointerSubmission = Pick<
+  AgentJournalSubmission,
+  'clientMessageId' | 'dispatchState' | 'submittedAt'
+>
+
+/**
+ * What to do with a mailbox's pointer, given its operation row and the session's recorded sends.
+ *
+ * - `stamp`: the row's send ran; the batch is pointed.
+ * - `park`: the row's send is still in flight; its settlement is the next edge.
+ * - `mint`: a new send. The batch or session changed; the agent ran a turn after the row was
+ *   minted; an earlier process minted it, so its attempt died with that process; or the host never
+ *   recorded it and would now refuse it as too old to admit.
+ * - `reuse`: resend under the row's id. Unrecorded, it is a first delivery; recorded as failed, the
+ *   host replays that verdict and starts nothing, so a provider that dies on every turn is not
+ *   restarted by every status edge, and a user's Stop stays stopped.
+ */
+export type StructuredPointerAttempt = 'mint' | 'reuse' | 'stamp' | 'park'
+
+export function decideStructuredPointerAttempt(input: {
+  row: StructuredPointerOperationRow | undefined
+  sessionId: string
+  batchFingerprint: string
+  /** The session's recorded sends; a rewind may have dropped the row's. */
+  submissions: readonly StructuredPointerSubmission[]
+  /** Whether this process minted the row's id. */
+  mintedByThisProcess: boolean
+  now: number
+}): StructuredPointerAttempt {
+  const { row, submissions } = input
+  if (
+    !row ||
+    row.session_id !== input.sessionId ||
+    row.batch_fingerprint !== input.batchFingerprint
+  ) {
+    return 'mint'
+  }
+  const sent = submissions.find((entry) => entry.clientMessageId === row.operation_id)
+  if (sent?.dispatchState === 'accepted') {
+    return 'stamp'
+  }
+  if (sent?.dispatchState === 'pending') {
+    return 'park'
+  }
+  const ranSince = submissions.some(
+    (entry) => entry.dispatchState === 'accepted' && entry.submittedAt > row.minted_at_ms
+  )
+  const tooOldToAdmit =
+    !sent && input.now - row.minted_at_ms > AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS
+  return ranSince || !input.mintedByThisProcess || tooOldToAdmit ? 'mint' : 'reuse'
+}
 
 export function mintAgentSessionOperationId(now: number): string {
   return `${String(now).padStart(13, '0')}-${randomBytes(16).toString('hex')}`
@@ -43,6 +104,11 @@ export function structuredPointerPayloadFingerprint(
   })
 }
 
+export type StructuredPointerOperation =
+  | { kind: 'send'; operationId: string; payloadFingerprint: string }
+  | { kind: 'stamp' }
+  | { kind: 'park' }
+
 export function resolveStructuredPointerOperation(args: {
   db: OrchestrationDb
   mailboxHandle: string
@@ -50,18 +116,28 @@ export function resolveStructuredPointerOperation(args: {
   body: AgentJournalMessageItem
   /** The rows this nudge stands for; batch identity, not the body, decides reuse. */
   messageIds: readonly string[]
+  submissions: readonly StructuredPointerSubmission[]
+  /** The operation id this process last sent for this mailbox, if any. */
+  sentByThisProcess: string | undefined
   now?: number
-}): { operationId: string; payloadFingerprint: string } {
+}): StructuredPointerOperation {
   const now = args.now ?? Date.now()
   const payloadFingerprint = structuredPointerPayloadFingerprint(args.sessionId, args.body)
   const batchFingerprint = structuredPointerBatchFingerprint(args.sessionId, args.messageIds)
   const stored = args.db.getStructuredPointerOperation(args.mailboxHandle)
-  if (
-    stored &&
-    stored.session_id === args.sessionId &&
-    stored.batch_fingerprint === batchFingerprint
-  ) {
-    return { operationId: stored.operation_id, payloadFingerprint }
+  const attempt = decideStructuredPointerAttempt({
+    row: stored,
+    sessionId: args.sessionId,
+    batchFingerprint,
+    submissions: args.submissions,
+    mintedByThisProcess: stored?.operation_id === args.sentByThisProcess,
+    now
+  })
+  if (attempt === 'stamp' || attempt === 'park') {
+    return { kind: attempt }
+  }
+  if (attempt === 'reuse' && stored) {
+    return { kind: 'send', operationId: stored.operation_id, payloadFingerprint }
   }
   const operationId = mintAgentSessionOperationId(now)
   args.db.putStructuredPointerOperation({
@@ -69,7 +145,11 @@ export function resolveStructuredPointerOperation(args: {
     session_id: args.sessionId,
     operation_id: operationId,
     batch_fingerprint: batchFingerprint,
-    minted_at_ms: now
+    // On the journal's clock too, so a backward clock step cannot date an earlier turn after it.
+    minted_at_ms: args.submissions.reduce(
+      (latest, entry) => Math.max(latest, entry.submittedAt),
+      now
+    )
   })
-  return { operationId, payloadFingerprint }
+  return { kind: 'send', operationId, payloadFingerprint }
 }
diff --git a/src/main/runtime/orchestration/structured-session-lineage.ts b/src/main/runtime/orchestration/structured-session-lineage.ts
new file mode 100644
index 00000000000..8cf6e94f12d
--- /dev/null
+++ b/src/main/runtime/orchestration/structured-session-lineage.ts
@@ -0,0 +1,44 @@
+/**
+ * A structured session's `/clear` lineage, read off the durable session records. `/clear` continues
+ * a chat in a new session; the committed clear on the old record names the session that replaced it.
+ * Derived from the records every time; nothing is rewritten at a clear.
+ */
+
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import { getStructuredAgentSessionHost } from '../../native-chat/agent-session-wire/structured-agent-session-registry'
+
+export type AgentSessionRecordReader = {
+  getRecord: (sessionId: string) => AgentSessionRecord | null
+  listRecords: () => AgentSessionRecord[]
+  /** Absent on a store that predates tab visibility; every session then counts as open. */
+  getVisibleSessionTabIndex?: () => { present: boolean; sessionIds: string[] }
+}
+
+/** Null until the agent-session host is installed; callers that must see records ensure it first. */
+export function readAgentSessionRecordStore(): AgentSessionRecordReader | null {
+  return getStructuredAgentSessionHost()?.deps.store ?? null
+}
+
+/** The session a committed `/clear` continued this one in, if any. */
+export function clearedInto(record: AgentSessionRecord): string | null {
+  const command = record.conversationCommand
+  return command?.command === 'clear' && command.phase === 'committed'
+    ? (command.replacementSessionId ?? null)
+    : null
+}
+
+/** The session running the lineage now; null when the chain names a session with no record. */
+export function lineageLiveSession(
+  store: AgentSessionRecordReader,
+  sessionId: string
+): AgentSessionRecord | null {
+  let live = store.getRecord(sessionId)
+  const later = new Set([sessionId])
+  let next = live ? clearedInto(live) : null
+  while (live && next && !later.has(next)) {
+    later.add(next)
+    live = store.getRecord(next)
+    next = live ? clearedInto(live) : null
+  }
+  return live
+}
diff --git a/src/main/runtime/orchestration/structured-session-mail-address.ts b/src/main/runtime/orchestration/structured-session-mail-address.ts
new file mode 100644
index 00000000000..19a2a56a0ee
--- /dev/null
+++ b/src/main/runtime/orchestration/structured-session-mail-address.ts
@@ -0,0 +1,93 @@
+/**
+ * A structured agent session as a mail address: `session:<id>`, the Orca-minted id every agent is
+ * told is its public address. Recipient routing and pointer delivery both read these rules off the
+ * durable session record, so the two can never disagree about which sessions mail can reach.
+ *
+ * The address names a conversation, not one session of it: any session of a `/clear` lineage names
+ * the lineage root's address (`canonicalOrcaSessionId`), and mail reaches the lineage's live session.
+ *
+ * A released lease does not end a session: the host stops an idle chat's agent, and the send that
+ * points its mail starts it again. For mail, a conversation has ended only when its chat was closed.
+ */
+
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import { isOrcaSessionId, type OrcaSessionId } from '../../../shared/orca-session-address'
+import { ORCHESTRATION_SESSION_CALLER_ERROR_CODES as CODES } from '../../../shared/orchestration-session-caller-codes'
+import { structuredWorkerHostScope } from '../structured-worker-identity'
+import type { OrchestrationDb } from './db'
+import { OrchestrationError } from './orchestration-error'
+import { resolveOrcaSessionParty, type OrchestrationSessionParty } from './orchestration-party'
+import { lineageLiveSession, type AgentSessionRecordReader } from './structured-session-lineage'
+
+export type OrcaAgentSessionLookup =
+  | { kind: 'found'; record: AgentSessionRecord }
+  /** The id is a provider's own session id, which rotates on `/clear`; this names the Orca id. */
+  | { kind: 'provider-id'; orcaSessionId: string }
+  | { kind: 'unknown' }
+
+export function lookupOrcaAgentSession(
+  store: AgentSessionRecordReader,
+  id: string
+): OrcaAgentSessionLookup {
+  const record = store.getRecord(id)
+  if (record) {
+    return { kind: 'found', record }
+  }
+  const owner = store
+    .listRecords()
+    .find((candidate) =>
+      candidate.providerHandleChain.some(({ handle }) =>
+        handle.provider === 'claude' ? handle.sessionId === id : handle.threadId === id
+      )
+    )
+  return owner ? { kind: 'provider-id', orcaSessionId: owner.sessionId } : { kind: 'unknown' }
+}
+
+export type StructuredSessionMailReach =
+  /** `session` is the conversation's live session, the one its mail reaches now. */
+  | { kind: 'reachable'; session: AgentSessionRecord }
+  | { kind: 'other-host' }
+  | { kind: 'ended'; reason: 'closed' | 'worker-identity-lost' | 'continuation-missing' }
+
+/** Whether mail to `record`'s conversation can reach the session that runs it now. */
+export function structuredSessionMailReach(
+  store: AgentSessionRecordReader,
+  record: AgentSessionRecord,
+  db: OrchestrationDb | null | undefined
+): StructuredSessionMailReach {
+  const live = lineageLiveSession(store, record.sessionId)
+  if (!live) {
+    return { kind: 'ended', reason: 'continuation-missing' }
+  }
+  if (!structuredWorkerHostScope(live.location)) {
+    return { kind: 'other-host' }
+  }
+  if (isOrcaSessionId(live.sessionId) && !addressableSessionParty(live.sessionId, db)) {
+    // Why: it can no longer act (the caller resolver refuses it), so mail to it could never be read.
+    return { kind: 'ended', reason: 'worker-identity-lost' }
+  }
+  const visible = store.getVisibleSessionTabIndex?.()
+  if (visible?.present && !visible.sessionIds.includes(live.sessionId)) {
+    // Why: reviving a chat the user closed would run turns nobody can see; its mail waits instead.
+    return { kind: 'ended', reason: 'closed' }
+  }
+  return { kind: 'reachable', session: live }
+}
+
+/**
+ * The party a session resolves to, or null for a worker whose identity this host lost: the party
+ * resolver refuses it in every role, so it can never read mail and none is owed to it.
+ */
+export function addressableSessionParty(
+  sessionId: OrcaSessionId,
+  db: OrchestrationDb | null | undefined
+): OrchestrationSessionParty | null {
+  try {
+    return resolveOrcaSessionParty(sessionId, db)
+  } catch (error) {
+    if (error instanceof OrchestrationError && error.code === CODES.notLive) {
+      return null
+    }
+    throw error
+  }
+}
diff --git a/src/main/runtime/orchestration/structured-session-mail-target.test.ts b/src/main/runtime/orchestration/structured-session-mail-target.test.ts
new file mode 100644
index 00000000000..5ed9c1ce26f
--- /dev/null
+++ b/src/main/runtime/orchestration/structured-session-mail-target.test.ts
@@ -0,0 +1,531 @@
+import { existsSync, mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  getAppEnvironment,
+  hasAppEnvironment,
+  setAppEnvironment,
+  type AppEnvironment
+} from '../../../shared/app-environment'
+import type { AgentSessionLease, AgentSessionRecord } from '../../../shared/agent-session-record'
+import {
+  agentSessionLeaseFixture,
+  agentSessionRecordFixture
+} from '../../../shared/agent-session-record.test-fixture'
+import { formatOrcaSessionAddress, type OrcaSessionId } from '../../../shared/orca-session-address'
+import { testOrcaSessionId } from '../../../shared/orca-session-address-test-fixture'
+
+const hostRef: { current: unknown } = { current: null }
+
+vi.mock('../../native-chat/agent-session-wire/structured-agent-session-registry', () => ({
+  getStructuredAgentSessionHost: () => hostRef.current
+}))
+
+const { OrcaRuntimeWithGetPtyRecordForPaneKey } =
+  await import('../orca-runtime-get-pty-record-for-pane-key')
+const { OrchestrationDb } = await import('./db')
+const { resolveOrcaSessionParty } = await import('./orchestration-party')
+const {
+  mintStructuredWorkerHandle,
+  mintStructuredWorkerPaneKey,
+  structuredWorkerIdentities,
+  structuredWorkerProcessIncarnation
+} = await import('../structured-worker-identity')
+
+const CHAT = testOrcaSessionId('4a1f6c2e-8b3d-4e7a-9c15-0d2b6e8f1a37')
+const CHAT_ADDRESS = formatOrcaSessionAddress(CHAT)
+
+/** The real methods through the real prototype chain; a re-declared copy would pin nothing. */
+class MailTargetProbe extends OrcaRuntimeWithGetPtyRecordForPaneKey {
+  target(mailboxHandle: string): unknown {
+    return this.resolveStructuredMailboxTarget(mailboxHandle)
+  }
+}
+
+type Store = {
+  records: Map<string, AgentSessionRecord>
+  visible: { present: boolean; sessionIds: string[] }
+}
+
+function chatRecord(
+  lease: Partial<AgentSessionLease> = {},
+  extra: Partial<AgentSessionRecord> = {}
+): AgentSessionRecord {
+  return {
+    ...agentSessionRecordFixture(
+      agentSessionLeaseFixture({ sessionId: CHAT, runtimeKind: 'native', ...lease })
+    ),
+    ...extra
+  }
+}
+
+function installStore(record: AgentSessionRecord | null, visible = true): Store {
+  const store: Store = {
+    records: new Map(record ? [[record.sessionId, record]] : []),
+    visible: { present: true, sessionIds: visible && record ? [record.sessionId] : [] }
+  }
+  hostRef.current = {
+    deps: {
+      store: {
+        getRecord: (sessionId: string) => store.records.get(sessionId) ?? null,
+        listRecords: () => [...store.records.values()],
+        getVisibleSessionTabIndex: () => store.visible
+      }
+    }
+  }
+  return store
+}
+
+let db: InstanceType<typeof OrchestrationDb>
+
+function probe(extra: Record<string, unknown> = {}): MailTargetProbe {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a prototype-only probe; every field the methods read is assigned below.
+  return Object.assign(Object.create(MailTargetProbe.prototype), {
+    _orchestrationDb: db,
+    ptysById: new Map(),
+    ...extra
+  }) as MailTargetProbe
+}
+
+function chatCoordinatedRun(): string {
+  return db.createRun({
+    objective: 'o',
+    coordinatorHandle: null,
+    coordinatorPaneKey: null,
+    coordinatorOrcaSessionId: CHAT
+  }).id
+}
+
+beforeEach(() => {
+  db = new OrchestrationDb(':memory:')
+  hostRef.current = null
+})
+
+afterEach(() => {
+  db.close()
+})
+
+describe('a Run whose coordinator is a chat (an Orca session id, no handle)', () => {
+  it('delivers its mailbox to that session', () => {
+    // The defect this pins: the resolver read only `coordinator_handle`, which a chat never has, so
+    // neither lane claimed the Run mailbox and a worker's result never reached the chat.
+    installStore(chatRecord())
+    const runId = chatCoordinatedRun()
+    expect(probe().target(`run:${runId}`)).toEqual({ sessionId: CHAT, dispatchId: null })
+  })
+
+  it('still delivers once the host has evicted the chat, so the delivery can wake it', () => {
+    installStore(chatRecord({ claimStatus: 'released', ownerProcess: null }))
+    const runId = chatCoordinatedRun()
+    expect(probe().target(`run:${runId}`)).toEqual({ sessionId: CHAT, dispatchId: null })
+  })
+
+  it('does not deliver to a chat that was closed, cleared into no known session, or runs on another host', () => {
+    const runId = chatCoordinatedRun()
+    installStore(chatRecord(), false)
+    expect(probe().target(`run:${runId}`)).toBeNull()
+
+    installStore(
+      chatRecord(
+        {},
+        {
+          conversationCommand: {
+            command: 'clear',
+            state: 'completed',
+            replacementSessionId: '7e3b9d15-2c4a-4f86-a0b1-5c9e2d7f3b64',
+            operationId: 'op',
+            callerKey: 'caller',
+            phase: 'committed'
+          }
+        }
+      )
+    )
+    expect(probe().target(`run:${runId}`)).toBeNull()
+
+    const remote = chatRecord()
+    installStore({ ...remote, location: { ...remote.location, executionHostId: 'ssh:box' } })
+    expect(probe().target(`run:${runId}`)).toBeNull()
+  })
+
+  it('does not deliver to an Orca session id written at an earlier generation of the Run', () => {
+    // An older binary's rebind or unbind bumps the generation and leaves the id behind.
+    installStore(chatRecord())
+    const runId = chatCoordinatedRun()
+    db.db
+      .prepare('UPDATE runs SET consumer_generation = consumer_generation + 1 WHERE id = ?')
+      .run(runId)
+    expect(probe().target(`run:${runId}`)).toBeNull()
+  })
+
+  it('ignores an Orca session id left beside a PTY handle; the handle owns the Run', () => {
+    installStore(chatRecord())
+    const runId = db.createRun({
+      objective: 'o',
+      coordinatorHandle: 'term_coord',
+      coordinatorPaneKey: 'tab_c:11111111-1111-4111-8111-111111111111',
+      coordinatorOrcaSessionId: CHAT
+    }).id
+    expect(probe().target(`run:${runId}`)).toBeNull()
+  })
+})
+
+describe('a session addressed directly', () => {
+  it('owns its `session:<id>` mailbox', () => {
+    installStore(chatRecord())
+    expect(probe().target(CHAT_ADDRESS)).toEqual({ sessionId: CHAT, dispatchId: null })
+  })
+
+  it('claims nothing for a malformed session address', () => {
+    installStore(chatRecord())
+    expect(probe().target('session:term_abc')).toBeNull()
+  })
+})
+
+describe('the idle edge of a structured session', () => {
+  it('re-derives and delivers the mailboxes the session owns, and nothing while it works', () => {
+    installStore(chatRecord())
+    const runId = chatCoordinatedRun()
+    db.insertMessage({
+      from: 'term_worker',
+      to: `run:${runId}`,
+      subject: 'done',
+      runId,
+      type: 'status'
+    })
+    const delivered: string[] = []
+    const runtime = probe({
+      deliverPendingMessagesForHandle: (handle: string) => delivered.push(handle),
+      notifyStructuredSessionJournalActivity: vi.fn(),
+      cancelMessageWaiters: vi.fn()
+    })
+    runtime.onStructuredSessionStatusForMail({ sessionId: CHAT, status: 'working' })
+    expect(delivered).toEqual([])
+    runtime.onStructuredSessionStatusForMail({ sessionId: CHAT, status: 'idle' })
+    expect(delivered).toEqual([`run:${runId}`])
+  })
+
+  it('points direct mail at a session that coordinates nothing', () => {
+    installStore(chatRecord())
+    db.insertMessage({ from: 'term_peer', to: CHAT_ADDRESS, subject: 'hi', type: 'status' })
+    const delivered: string[] = []
+    probe({
+      deliverPendingMessagesForHandle: (handle: string) => delivered.push(handle),
+      notifyStructuredSessionJournalActivity: vi.fn(),
+      cancelMessageWaiters: vi.fn()
+    }).onStructuredSessionStatusForMail({ sessionId: CHAT, status: 'idle' })
+    expect(delivered).toEqual([CHAT_ADDRESS])
+  })
+})
+
+describe('the idle edge after a restart, before any orchestration call', () => {
+  let userData: string
+  let previousEnvironment: AppEnvironment | null
+
+  beforeEach(() => {
+    userData = mkdtempSync(join(tmpdir(), 'orca-idle-edge-db-'))
+    previousEnvironment = hasAppEnvironment() ? getAppEnvironment() : null
+    setAppEnvironment({
+      getPath: () => userData,
+      getAppPath: () => userData,
+      getVersion: () => '0.0.0-test',
+      isPackaged: () => false,
+      onWillQuit: () => {},
+      exit: () => {},
+      getAppMetrics: () => []
+    })
+  })
+
+  afterEach(() => {
+    if (previousEnvironment) {
+      setAppEnvironment(previousEnvironment)
+    }
+    rmSync(userData, { recursive: true, force: true })
+  })
+
+  /** A runtime whose database has not been opened in this process yet. */
+  function restarted(delivered: string[]): MailTargetProbe {
+    return probe({
+      _orchestrationDb: null,
+      ensureOrchestrationFederationRelay: vi.fn(),
+      scheduleRestoredMessageRepoints: vi.fn(),
+      deliverPendingMessagesForHandle: (handle: string) => delivered.push(handle),
+      notifyStructuredSessionJournalActivity: vi.fn()
+    })
+  }
+
+  it('opens an existing orchestration database itself, so mail stored before the restart is redriven', () => {
+    // The strand this pins: the edge read the raw database field, null until the first
+    // orchestration RPC opened it, so a restarted chat's idle edges silently redrove nothing.
+    installStore(chatRecord())
+    const stored = new OrchestrationDb(join(userData, 'orchestration.db'))
+    const runId = stored.createRun({
+      objective: 'o',
+      coordinatorHandle: null,
+      coordinatorPaneKey: null,
+      coordinatorOrcaSessionId: CHAT
+    }).id
+    stored.close()
+    const delivered: string[] = []
+    const runtime = restarted(delivered)
+
+    runtime.onStructuredSessionStatusForMail({ sessionId: CHAT, status: 'idle' })
+
+    expect(delivered).toEqual([`run:${runId}`])
+    runtime.getOrchestrationDb().close()
+  })
+
+  it('creates no database for a profile that never orchestrated, and says nothing', () => {
+    installStore(chatRecord())
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const delivered: string[] = []
+
+    restarted(delivered).onStructuredSessionStatusForMail({ sessionId: CHAT, status: 'idle' })
+
+    expect(delivered).toEqual([])
+    expect(existsSync(join(userData, 'orchestration.db'))).toBe(false)
+    expect(warn).not.toHaveBeenCalled()
+    warn.mockRestore()
+  })
+
+  it('says so when the database cannot be opened, instead of skipping silently', () => {
+    installStore(chatRecord())
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const deliver = vi.fn()
+    probe({
+      _orchestrationDb: null,
+      getExistingOrchestrationDb: () => {
+        throw new Error('userData unavailable')
+      },
+      deliverPendingMessagesForHandle: deliver,
+      notifyStructuredSessionJournalActivity: vi.fn()
+    }).onStructuredSessionStatusForMail({ sessionId: CHAT, status: 'idle' })
+    expect(deliver).not.toHaveBeenCalled()
+    expect(warn).toHaveBeenCalledWith(
+      '[orchestration] skipped a structured session mail edge: no database',
+      { sessionId: CHAT, error: 'userData unavailable' }
+    )
+    warn.mockRestore()
+  })
+})
+
+describe('a coordinator chat continued by /clear', () => {
+  const MIDDLE = testOrcaSessionId('clear-fedcba9876543210fedcba9876543210fedcba98')
+  const SUCCESSOR = testOrcaSessionId('clear-0123456789abcdef0123456789abcdef01234567')
+
+  function sessionRecord(sessionId: string, clearedInto?: string): AgentSessionRecord {
+    const record = agentSessionRecordFixture(
+      agentSessionLeaseFixture({
+        sessionId,
+        runtimeKind: 'native',
+        ...(clearedInto ? { claimStatus: 'released' as const, ownerProcess: null } : {})
+      })
+    )
+    return clearedInto
+      ? {
+          ...record,
+          conversationCommand: {
+            command: 'clear',
+            state: 'completed',
+            replacementSessionId: clearedInto,
+            operationId: `op-${sessionId}`,
+            callerKey: 'caller',
+            phase: 'committed'
+          }
+        }
+      : record
+  }
+
+  /** CHAT cleared into each of `chain` in turn; the last one is live and its tab is open. */
+  function installLineage(...chain: string[]): void {
+    const lineage = [CHAT, ...chain]
+    const store = installStore(null)
+    lineage.forEach((sessionId, index) =>
+      store.records.set(sessionId, sessionRecord(sessionId, lineage[index + 1]))
+    )
+    store.visible.sessionIds.push(lineage.at(-1)!)
+  }
+
+  function idleEdge(sessionId: string): string[] {
+    const delivered: string[] = []
+    probe({
+      deliverPendingMessagesForHandle: (handle: string) => delivered.push(handle),
+      notifyStructuredSessionJournalActivity: vi.fn()
+    }).onStructuredSessionStatusForMail({ sessionId, status: 'idle' })
+    return delivered
+  }
+
+  function runCreatedBy(sessionId: OrcaSessionId): string {
+    return db.createRun({
+      objective: 'o',
+      coordinatorHandle: null,
+      coordinatorPaneKey: null,
+      coordinatorOrcaSessionId: resolveOrcaSessionParty(sessionId, db).orcaSessionId
+    }).id
+  }
+
+  it('stores a Dispatch assignee by the lineage root of the session its incarnation names', () => {
+    installLineage(SUCCESSOR)
+    const dispatch = db.createDispatchContext({
+      taskId: db.createTask({ runId: chatCoordinatedRun(), spec: 'work' }).id,
+      assigneeHandle: mintStructuredWorkerHandle(),
+      assigneePaneKey: mintStructuredWorkerPaneKey(SUCCESSOR),
+      processIncarnation: structuredWorkerProcessIncarnation(SUCCESSOR),
+      creator: { kind: 'system' },
+      maxDepth: Number.MAX_SAFE_INTEGER
+    })
+    expect(db.getDispatchContextById(dispatch.id)?.assignee_orca_session_id).toBe(CHAT)
+  })
+
+  it("never unbinds the successor's own Run", () => {
+    // The strand this pins: the successor's own run-create, then its idle edge rebinding the
+    // predecessor's Run through an exclusive bind, which unbound the Run the successor created.
+    installLineage(SUCCESSOR)
+    chatCoordinatedRun()
+    const ownRun = runCreatedBy(SUCCESSOR)
+    const generation = db.getRunRaw(ownRun)!.consumer_generation
+
+    expect(idleEdge(SUCCESSOR)).toContain(`run:${ownRun}`)
+    idleEdge(SUCCESSOR)
+
+    const successor = resolveOrcaSessionParty(SUCCESSOR, db)
+    expect(db.getRunRaw(ownRun)).toMatchObject({
+      coordinator_orca_session_id: successor.orcaSessionId,
+      consumer_generation: generation
+    })
+    expect(db.getCurrentRunForCoordinator(successor)?.id).toBe(ownRun)
+  })
+
+  it('keeps a Run bound, unrewritten, across a chain of clears, and delivers it to the live end', () => {
+    installLineage(MIDDLE)
+    const runId = chatCoordinatedRun()
+    const generation = db.getRunRaw(runId)!.consumer_generation
+    idleEdge(MIDDLE)
+    installLineage(MIDDLE, SUCCESSOR)
+    expect(idleEdge(SUCCESSOR)).toContain(`run:${runId}`)
+
+    expect(db.getRunRaw(runId)).toMatchObject({
+      coordinator_orca_session_id: CHAT,
+      consumer_generation: generation
+    })
+    for (const member of [CHAT, MIDDLE, SUCCESSOR]) {
+      expect(db.getCurrentRunForCoordinator(resolveOrcaSessionParty(member, db))?.id).toBe(runId)
+    }
+    expect(probe().target(`run:${runId}`)).toEqual({ sessionId: SUCCESSOR, dispatchId: null })
+  })
+
+  it('keeps the Run a middle session created bound after the next clear', () => {
+    // The chain strand: adopting each predecessor's Run in turn unbound all but the last adopted.
+    installLineage(MIDDLE)
+    runCreatedBy(CHAT)
+    const middleRun = runCreatedBy(MIDDLE)
+    const generation = db.getRunRaw(middleRun)!.consumer_generation
+    installLineage(MIDDLE, SUCCESSOR)
+    idleEdge(SUCCESSOR)
+
+    const successor = resolveOrcaSessionParty(SUCCESSOR, db)
+    expect(db.getRunRaw(middleRun)).toMatchObject({
+      coordinator_orca_session_id: successor.orcaSessionId,
+      consumer_generation: generation
+    })
+    expect(db.getCurrentRunForCoordinator(successor)?.id).toBe(middleRun)
+  })
+
+  it('reaches the live session through any spelling of the conversation, and stores one', () => {
+    installLineage(MIDDLE, SUCCESSOR)
+    for (const member of [CHAT, MIDDLE, SUCCESSOR]) {
+      expect(resolveOrcaSessionParty(member, db)).toMatchObject({
+        orcaSessionId: CHAT,
+        address: CHAT_ADDRESS
+      })
+      expect(probe().target(`session:${member}`)).toEqual({
+        sessionId: SUCCESSOR,
+        dispatchId: null
+      })
+    }
+    const direct = db.insertMessage({
+      from: 'term_peer',
+      to: CHAT_ADDRESS,
+      subject: 'hi',
+      type: 'status'
+    })
+    expect(idleEdge(SUCCESSOR)).toEqual([CHAT_ADDRESS])
+    expect(db.getMessageById(direct.id)).toMatchObject({ to_handle: CHAT_ADDRESS, read: 0 })
+  })
+})
+
+describe('a structured worker continued by /clear', () => {
+  const WORKER = testOrcaSessionId('9c2e4a61-3f7b-4d8e-b105-6a2d8e4f1c93')
+  const WORKER_SUCCESSOR = testOrcaSessionId('clear-a1b2c3d4e5f60718293a4b5c6d7e8f9012345678')
+
+  afterEach(() => {
+    structuredWorkerIdentities.clear()
+  })
+
+  /** A worker minted for WORKER, whose conversation `/clear` continued in WORKER_SUCCESSOR. */
+  function clearedWorker(): { handle: string; paneKey: string } {
+    const store = installStore(null)
+    const minted = agentSessionRecordFixture(
+      agentSessionLeaseFixture({ sessionId: WORKER, runtimeKind: 'native' })
+    )
+    store.records.set(WORKER, {
+      ...minted,
+      conversationCommand: {
+        command: 'clear',
+        state: 'completed',
+        replacementSessionId: WORKER_SUCCESSOR,
+        operationId: 'op-worker',
+        callerKey: 'caller',
+        phase: 'committed'
+      }
+    })
+    store.records.set(
+      WORKER_SUCCESSOR,
+      agentSessionRecordFixture(
+        agentSessionLeaseFixture({ sessionId: WORKER_SUCCESSOR, runtimeKind: 'native' })
+      )
+    )
+    const identity = structuredWorkerIdentities.register({
+      handle: mintStructuredWorkerHandle(),
+      sessionId: WORKER,
+      agent: 'codex',
+      paneKey: mintStructuredWorkerPaneKey(WORKER),
+      processIncarnation: structuredWorkerProcessIncarnation(WORKER),
+      worktreeId: 'wt_1',
+      hostScope: { kind: 'local', hostId: 'local' }
+    })
+    return { handle: identity.handle, paneKey: identity.paneKey }
+  }
+
+  it("delivers mail at the worker's handle to the live successor, as a terminal keeps its handle", () => {
+    // The strand this pins: the handle resolved to the session minted for it, which `/clear`
+    // replaced, so the worker's own mail was pointed at a session that no longer runs its turns.
+    const { handle } = clearedWorker()
+    expect(probe().target(handle)).toEqual({ sessionId: WORKER_SUCCESSOR, dispatchId: null })
+  })
+
+  it("delivers the worker's dispatch mailbox and a Run it coordinates to the live successor", () => {
+    const { handle, paneKey } = clearedWorker()
+    const dispatch = db.createDispatchContext({
+      taskId: db.createTask({ runId: chatCoordinatedRun(), spec: 'work' }).id,
+      assigneeHandle: handle,
+      assigneePaneKey: paneKey,
+      processIncarnation: structuredWorkerProcessIncarnation(WORKER),
+      creator: { kind: 'system' },
+      maxDepth: Number.MAX_SAFE_INTEGER
+    })
+    expect(probe().target(`dispatch:${dispatch.id}`)).toEqual({
+      sessionId: WORKER_SUCCESSOR,
+      dispatchId: dispatch.id
+    })
+    const workerRun = db.createRun({
+      objective: 'o',
+      coordinatorHandle: handle,
+      coordinatorPaneKey: paneKey
+    }).id
+    expect(probe().target(`run:${workerRun}`)).toEqual({
+      sessionId: WORKER_SUCCESSOR,
+      dispatchId: null
+    })
+  })
+})
diff --git a/src/main/runtime/orchestration/structured-session-mail-target.ts b/src/main/runtime/orchestration/structured-session-mail-target.ts
new file mode 100644
index 00000000000..e71c08c512e
--- /dev/null
+++ b/src/main/runtime/orchestration/structured-session-mail-target.ts
@@ -0,0 +1,128 @@
+/**
+ * Where a mailbox owned by a structured session is delivered: a chat that coordinates a Run
+ * (`run:<id>` with no coordinator handle), a session addressed directly at `session:<id>`, and the
+ * live session behind a structured worker's handle. The session is resolved here, never a pane, and
+ * takes the pointer as a session turn.
+ */
+
+import {
+  ORCA_SESSION_ADDRESS_PREFIX,
+  isOrcaSessionId,
+  parseOrcaSessionAddress,
+  type OrcaSessionId
+} from '../../../shared/orca-session-address'
+import type { OrchestrationDb } from './db'
+import { currentRunCoordinatorOrcaSessionId } from './db/runs/run-coordinator-orca-session'
+import { structuredWorkerHostScope } from '../structured-worker-identity'
+import type { StructuredPointerTarget } from './structured-mailbox-pointer-delivery'
+import {
+  addressableSessionParty,
+  structuredSessionMailReach
+} from './structured-session-mail-address'
+import {
+  lineageLiveSession,
+  readAgentSessionRecordStore,
+  type AgentSessionRecordReader
+} from './structured-session-lineage'
+import type { RunRow } from './types'
+
+/**
+ * The session a Run's coordinator binding names when that binding has no handle. A structured
+ * worker coordinates by its own handle and resolves through it, so only a handle-less binding names
+ * a session here, and only by an Orca session id that still counts (see
+ * `currentRunCoordinatorOrcaSessionId`).
+ */
+export function handleLessCoordinatorSessionId(
+  run: Pick<
+    RunRow,
+    | 'coordinator_handle'
+    | 'coordinator_orca_session_id'
+    | 'coordinator_orca_session_id_generation'
+    | 'consumer_generation'
+  >
+): OrcaSessionId | null {
+  if (run.coordinator_handle !== null) {
+    return null
+  }
+  return currentRunCoordinatorOrcaSessionId(run)
+}
+
+/**
+ * The structured-lane target for `sessionId`'s conversation: its live session, whichever session of
+ * the lineage was named; null when mail cannot reach it here.
+ */
+export function structuredSessionMailTarget(
+  sessionId: string,
+  db: OrchestrationDb | null | undefined,
+  store: AgentSessionRecordReader | null = readAgentSessionRecordStore()
+): StructuredPointerTarget | null {
+  const record = store?.getRecord(sessionId)
+  const reach = store && record ? structuredSessionMailReach(store, record, db) : null
+  return reach?.kind === 'reachable'
+    ? { sessionId: reach.session.sessionId, dispatchId: null }
+    : null
+}
+
+/**
+ * The session a structured worker's mail reaches: the one minted for it, or that session's live
+ * `/clear` successor, which carries on as the worker the way a terminal keeps its handle.
+ */
+export function structuredWorkerMailSessionId(
+  mintedSessionId: string,
+  store: AgentSessionRecordReader | null = readAgentSessionRecordStore()
+): string | null {
+  const live = store ? lineageLiveSession(store, mintedSessionId) : null
+  return live && structuredWorkerHostScope(live.location) ? live.sessionId : null
+}
+
+/**
+ * The target of a `session:<id>` mailbox; `undefined` when the handle is not a session address at
+ * all, so other address forms keep their own resolution.
+ */
+export function structuredSessionAddressTarget(
+  mailboxHandle: string,
+  db: OrchestrationDb | null | undefined
+): StructuredPointerTarget | null | undefined {
+  if (!mailboxHandle.startsWith(ORCA_SESSION_ADDRESS_PREFIX)) {
+    return undefined
+  }
+  const sessionId = parseOrcaSessionAddress(mailboxHandle)
+  return sessionId ? structuredSessionMailTarget(sessionId, db) : null
+}
+
+/**
+ * Every mailbox a session reads for itself: the Runs it coordinates and its own direct mail.
+ * Re-derived from the database on each idle edge rather than remembered, so mail that arrived
+ * while the session could not take it (mid-turn, closed) is found again.
+ */
+export function structuredSessionOwnedMailboxes(sessionId: string, db: OrchestrationDb): string[] {
+  const party = isOrcaSessionId(sessionId) ? addressableSessionParty(sessionId, db) : null
+  if (!party) {
+    return []
+  }
+  const mailboxes = db.runsBoundToCoordinator(party).map((run) => `run:${run.id}`)
+  if (db.getUnreadDirectMessageTypes(party.address).length > 0) {
+    mailboxes.push(party.address)
+  }
+  return mailboxes
+}
+
+/** The mailboxes a session's idle edge re-derives, opening an existing database if nothing has
+ *  yet: after a restart this edge is what redrives mail stored before it. No database file means
+ *  no mail, so `openDb` answers null and nothing is created. */
+export function structuredSessionIdleEdgeMailboxes(
+  sessionId: string,
+  openDb: () => OrchestrationDb | null
+): string[] {
+  let db: OrchestrationDb | null
+  try {
+    db = openDb()
+  } catch (error) {
+    console.warn('[orchestration] skipped a structured session mail edge: no database', {
+      sessionId,
+      error: error instanceof Error ? error.message : String(error)
+    })
+    return []
+  }
+  return db ? structuredSessionOwnedMailboxes(sessionId, db) : []
+}
diff --git a/src/main/runtime/orchestration/structured-session-pointer-delivery.ts b/src/main/runtime/orchestration/structured-session-pointer-delivery.ts
index 4071d17a073..4e838e313f8 100644
--- a/src/main/runtime/orchestration/structured-session-pointer-delivery.ts
+++ b/src/main/runtime/orchestration/structured-session-pointer-delivery.ts
@@ -68,7 +68,8 @@ export function structuredSessionGateFacts(
  * them. Neither refuses the frame: Codex COALESCES a mid-turn `turn/start` into
  * the running turn -- measured on codex-cli 0.147.0, 0.150.1 and 0.153.4, none
  * of which refuse it and none of which fire a second `turn/started` -- and
- * Claude queues it behind the turn. Both therefore
+ * Claude folds it into the running turn (or runs it as the next turn when the
+ * turn ends first). Both therefore
  * fold the nudge into work already in flight, where it reads as part of the
  * running turn rather than a new instruction. Waiting for the turn to settle is
  * the one contract that holds for both, and it preserves orchestration's
@@ -98,7 +99,7 @@ export function decideStructuredSessionPointerDelivery(input: {
  * adapters cannot tell them apart — so it must retain. Treating it as delivered
  * would drop mail whenever a child died mid-send.
  */
-export function structuredDispatchDelivered(state: StructuredDispatchState): boolean {
+export function structuredDispatchDelivered(state: StructuredDispatchState): state is 'accepted' {
   return state === 'accepted'
 }
 
diff --git a/src/main/runtime/orchestration/structured-worker-direct-mailbox-target.test.ts b/src/main/runtime/orchestration/structured-worker-direct-mailbox-target.test.ts
index 4fff2d387d0..cc32156cc87 100644
--- a/src/main/runtime/orchestration/structured-worker-direct-mailbox-target.test.ts
+++ b/src/main/runtime/orchestration/structured-worker-direct-mailbox-target.test.ts
@@ -93,7 +93,7 @@ describe('the mailbox target for direct peer mail to a structured worker', () =>
     // claimed the mailbox — the PTY lane refuses a structured handle outright and this resolver
     // answered only `dispatch:` addresses. The worker never reacted and the peer waiting on a
     // reply hung, with nothing logged. A dispatch says nothing about whether delivery is safe;
-    // the idle gate and the lease fence do, and both still run downstream.
+    // the idle gate and the writer lease do, and both still run downstream.
     const handle = registerWorker()
     installRecord({ runtimeKind: 'native', claimStatus: 'live' })
     expect(probe(undefined).instance.probeResolveTarget(handle)).toEqual({
diff --git a/src/main/runtime/orchestration/structured-worker-group-addressing.test.ts b/src/main/runtime/orchestration/structured-worker-group-addressing.test.ts
index 93fa58fd6b5..43b7fe2be45 100644
--- a/src/main/runtime/orchestration/structured-worker-group-addressing.test.ts
+++ b/src/main/runtime/orchestration/structured-worker-group-addressing.test.ts
@@ -50,11 +50,14 @@ function installHost(options: {
   items?: AgentJournalRenderItem[]
   lease?: { runtimeKind: string; claimStatus: string }
   hasSession?: boolean
+  tabListed?: boolean
 }): void {
   const lease = options.lease ?? { runtimeKind: 'native', claimStatus: 'live' }
   hostRef.current = {
     deps: {
       store: {
+        // No committed /clear: each session is its own lineage's root.
+        listRecords: () => [],
         getRecord: (sessionId: string) =>
           ({
             sessionId,
@@ -65,21 +68,45 @@ function installHost(options: {
       }
     },
     hasSession: () => options.hasSession ?? true,
-    journalSnapshot: () => ({ items: options.items ?? [idleTurn()] })
+    getPersistedVisibleSessionTabIndex: () => ({
+      present: true,
+      sessionIds: options.tabListed ? [SESSION_ID] : []
+    }),
+    journalSnapshot: async () => ({ items: options.items ?? [idleTurn()] })
   }
 }
 
+/** The durable worker-terminal rows group addressing enumerates. */
+const rows: {
+  terminal_handle: string
+  pane_key: string
+  process_incarnation: string
+  worktree_id: string
+  host_scope: string
+}[] = []
+
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: group addressing reads only this one query off the database.
+const workerDb = { listWorkerTerminalResourcesByIncarnationPrefix: () => rows } as never
+
 function registerWorker(worktreeId = 'wt_1'): string {
   const handle = mintStructuredWorkerHandle()
+  const paneKey = mintStructuredWorkerPaneKey(SESSION_ID)
   structuredWorkerIdentities.register({
     handle,
     sessionId: SESSION_ID,
     agent: 'codex',
-    paneKey: mintStructuredWorkerPaneKey(SESSION_ID),
+    paneKey,
     processIncarnation: structuredWorkerProcessIncarnation(SESSION_ID),
     worktreeId,
     hostScope: { kind: 'local', hostId: 'local' }
   })
+  rows.push({
+    terminal_handle: handle,
+    pane_key: paneKey,
+    process_incarnation: structuredWorkerProcessIncarnation(SESSION_ID),
+    worktree_id: worktreeId,
+    host_scope: JSON.stringify({ kind: 'local', hostId: 'local' })
+  })
   return handle
 }
 
@@ -88,22 +115,28 @@ const PTY_TERMINAL = { handle: 'term_a', worktreeId: 'wt_1', agentIdentity: 'cla
 describe('group addressing and structured workers', () => {
   beforeEach(() => {
     structuredWorkerIdentities.clear()
+    rows.length = 0
     hostRef.current = null
   })
 
   it('enumerates a live structured worker as a candidate', () => {
     const handle = registerWorker()
     installHost({})
-    expect(listAddressableStructuredWorkers()).toEqual([
+    expect(listAddressableStructuredWorkers(workerDb)).toEqual([
       { handle, worktreeId: 'wt_1', agentIdentity: 'codex' }
     ])
   })
 
-  it('leaves out a worker whose session is not proven live', () => {
-    // Addressing a settled worker would store mail no lane will ever deliver.
-    registerWorker()
-    installHost({ lease: { runtimeKind: 'native', claimStatus: 'live' }, hasSession: false })
-    expect(listAddressableStructuredWorkers()).toEqual([])
+  it('keeps a worker at rest and leaves out a retired one', () => {
+    // At rest: its agent was stopped while idle, its chat tab still lists it, and mail starts it.
+    const handle = registerWorker()
+    installHost({ lease: { runtimeKind: 'native', claimStatus: 'released' }, tabListed: true })
+    expect(listAddressableStructuredWorkers(workerDb)).toEqual([
+      { handle, worktreeId: 'wt_1', agentIdentity: 'codex' }
+    ])
+    // Retired: released with its tab gone. Addressing it would store mail no lane delivers.
+    installHost({ lease: { runtimeKind: 'native', claimStatus: 'released' }, tabListed: false })
+    expect(listAddressableStructuredWorkers(workerDb)).toEqual([])
   })
 
   it('reaches a structured worker through @all', () => {
@@ -112,14 +145,14 @@ describe('group addressing and structured workers', () => {
     // machinery never ran and the sender got exit 0 with a receipt naming only who did resolve.
     const handle = registerWorker()
     installHost({})
-    const recipients = [PTY_TERMINAL, ...listAddressableStructuredWorkers()]
+    const recipients = [PTY_TERMINAL, ...listAddressableStructuredWorkers(workerDb)]
     expect(resolveGroupAddress('@all', 'term_sender', recipients, () => 'idle')).toContain(handle)
   })
 
   it('reaches a structured worker through @worktree: and @codex, but not @claude', () => {
     const handle = registerWorker('wt_2')
     installHost({})
-    const recipients = [PTY_TERMINAL, ...listAddressableStructuredWorkers()]
+    const recipients = [PTY_TERMINAL, ...listAddressableStructuredWorkers(workerDb)]
     expect(resolveGroupAddress('@worktree:wt_2', 'term_sender', recipients, () => 'idle')).toEqual([
       handle
     ])
@@ -129,20 +162,20 @@ describe('group addressing and structured workers', () => {
     ])
   })
 
-  it('reads @idle status off the FULL timeline, never a bounded tail', () => {
+  it('reads @idle status off the FULL timeline, never a bounded tail', async () => {
     // The same trap that already cost this branch once: settlement tombstones the lifecycle item
     // rather than rewriting it, so a long tool-calling turn pushes it arbitrarily far from the
     // tail and any page-sized read reports a BUSY worker as idle — then `@idle` broadcasts into a
-    // running turn, which Codex refuses outright and Claude queues behind.
+    // running turn, which Codex refuses outright and Claude folds into it.
     registerWorker()
     installHost({ items: [runningTurn(), ...transcript(500)] })
-    expect(structuredWorkerAgentStatus(SESSION_ID)).toBe('working')
+    expect(await structuredWorkerAgentStatus(SESSION_ID)).toBe('working')
   })
 
-  it('answers idle only when no turn is running and no human is awaited', () => {
+  it('answers idle only when no turn is running and no human is awaited', async () => {
     registerWorker()
     installHost({ items: [idleTurn()] })
-    expect(structuredWorkerAgentStatus(SESSION_ID)).toBe('idle')
+    expect(await structuredWorkerAgentStatus(SESSION_ID)).toBe('idle')
     installHost({
       items: [
         {
@@ -156,26 +189,27 @@ describe('group addressing and structured workers', () => {
         } as unknown as AgentJournalRenderItem
       ]
     })
-    expect(structuredWorkerAgentStatus(SESSION_ID)).toBe('attention')
+    expect(await structuredWorkerAgentStatus(SESSION_ID)).toBe('attention')
   })
 
-  it('answers null rather than idle when the session cannot be read', () => {
+  it('answers null rather than idle when the session cannot be read', async () => {
     // Unknown must never read as idle, or `@idle` wakes a worker mid-turn.
     hostRef.current = null
-    expect(structuredWorkerAgentStatus(SESSION_ID)).toBeNull()
+    expect(await structuredWorkerAgentStatus(SESSION_ID)).toBeNull()
   })
 })
 
 describe('sendGroupMessage actually composes structured workers in', () => {
   beforeEach(() => {
     structuredWorkerIdentities.clear()
+    rows.length = 0
     hostRef.current = null
   })
 
   /**
    * Drives the real `sendGroupMessage`, not `resolveGroupAddress`.
    *
-   * The suite above hand-composed `[PTY_TERMINAL, ...listAddressableStructuredWorkers()]` itself,
+   * The suite above hand-composed `[PTY_TERMINAL, ...listAddressableStructuredWorkers(workerDb)]` itself,
    * so deleting the composition at the call site left it green — the exact regression the fix
    * describes could come straight back. This test owns that seam.
    */
@@ -186,8 +220,10 @@ describe('sendGroupMessage actually composes structured workers in', () => {
     const db = {
       getLegacyAdoptedRunMailboxOwner: () => null,
       getCurrentRunForPane: () => undefined,
+      getCurrentRunForCoordinator: () => undefined,
       getActiveDispatchMailboxOwners: () => [],
       getRunMailboxOwnerIdsForHandle: () => [],
+      listWorkerTerminalResourcesByIncarnationPrefix: () => rows,
       insertMessages: (rows: { to: string }[]) => {
         inserted.push(...rows)
         return rows.map((row, index) => ({ id: `m${index}`, to_handle: row.to, type: 'status' }))
@@ -197,7 +233,7 @@ describe('sendGroupMessage actually composes structured workers in', () => {
       // No PTY terminals at all: if the call site does not compose structured workers in, the
       // group resolves empty and this throws instead of delivering.
       listTerminals: async () => ({ terminals: [] }),
-      getAgentStatusForHandle: () => 'idle',
+      getAgentStatusForHandle: async () => 'idle',
       getLiveTerminalPaneKey: () => structuredWorkerIdentities.get(handle)!.paneKey,
       notifyMessageArrived: () => {}
     }
@@ -227,9 +263,11 @@ describe('sendGroupMessage actually composes structured workers in', () => {
     const db = {
       getLegacyAdoptedRunMailboxOwner: () => null,
       getCurrentRunForPane: () => undefined,
+      getCurrentRunForCoordinator: () => undefined,
       getActiveDispatchForIdentity: () => ({ run_id: 'run_1' }),
       getActiveDispatchMailboxOwners: () => [],
       getRunMailboxOwnerIdsForHandle: () => [],
+      listWorkerTerminalResourcesByIncarnationPrefix: () => rows,
       listWorkerTerminalResources: () => [
         {
           dispatchId: 'ctx_structured',
@@ -257,17 +295,24 @@ describe('sendGroupMessage actually composes structured workers in', () => {
       listTerminals: async () => ({
         terminals: [{ handle: 'term_claude', worktreeId: 'wt_1', agentIdentity: 'claude' }]
       }),
-      getAgentStatusForHandle: () => 'idle',
+      getAgentStatusForHandle: async () => 'idle',
       getLiveTerminalPaneKey: () => null,
       getOrchestrationDb: () => db,
       notifyMessageArrived: () => {}
     }
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the stub cast is unchanged; the gate flags it only because this diff adds the sender field inside its span.
     await sendGroupMessage({
       params: { subject: 's', body: 'b', type: 'status', priority: 'normal' },
       runtime: runtime as never,
       db: db as never,
       from: 'term_sender',
       groupAddress: '@codex',
+      sender: {
+        address: 'term_sender',
+        terminalHandle: 'term_sender',
+        paneKey: null,
+        orcaSessionId: null
+      },
       senderPaneKey: undefined,
       senderRunId: 'run_1',
       explicitRunId: undefined,
diff --git a/src/main/runtime/orchestration/structured-worker-group-addressing.ts b/src/main/runtime/orchestration/structured-worker-group-addressing.ts
index 168bd870118..3a6161f8187 100644
--- a/src/main/runtime/orchestration/structured-worker-group-addressing.ts
+++ b/src/main/runtime/orchestration/structured-worker-group-addressing.ts
@@ -16,8 +16,13 @@
  */
 
 import type { TuiAgent } from '../../../shared/tui-agent'
-import { observeStructuredWorker, structuredWorkerAgent } from '../structured-worker-authority'
-import { structuredWorkerIdentities } from '../structured-worker-identity'
+import { structuredWorkerAgent } from '../structured-worker-authority'
+import { structuredWorkerAddressable } from '../structured-worker-custody'
+import {
+  STRUCTURED_WORKER_INCARNATION_PREFIX,
+  structuredWorkerIdentityFromRow
+} from '../structured-worker-identity'
+import type { OrchestrationDb } from './db'
 import { readStructuredSessionGateFacts } from './structured-mailbox-pointer-host'
 
 /** The only facts group addressing reads off a recipient. */
@@ -29,15 +34,29 @@ export type OrchestrationAddressableAgent = {
 }
 
 /**
- * Live structured workers of this runtime, as group-address candidates.
+ * Structured workers this runtime owns, as group-address candidates.
  *
- * Liveness-gated on the same observation the rest of the structured surface uses: a settled or
- * handed-off worker is not a recipient, and addressing one would store mail no lane will deliver.
+ * Read from the durable worker-terminal rows, which outlive a settled dispatch and a restart, and
+ * gated on ownership and on the orchestration not having released it — the same answer direct mail
+ * routes on — never on liveness: a worker at rest is a recipient, and the mail starts it. A retired
+ * or released one is not.
  */
-export function listAddressableStructuredWorkers(): OrchestrationAddressableAgent[] {
-  return structuredWorkerIdentities
-    .list()
-    .filter((identity) => observeStructuredWorker(identity).status === 'live')
+export function listAddressableStructuredWorkers(
+  db: OrchestrationDb | null
+): OrchestrationAddressableAgent[] {
+  const seen = new Set<string>()
+  return (
+    db?.listWorkerTerminalResourcesByIncarnationPrefix(STRUCTURED_WORKER_INCARNATION_PREFIX) ?? []
+  )
+    .flatMap((row) => {
+      const identity = structuredWorkerIdentityFromRow(row)
+      // Newest row first: a session is one recipient, under its latest handle.
+      if (!identity || seen.has(identity.sessionId)) {
+        return []
+      }
+      seen.add(identity.sessionId)
+      return structuredWorkerAddressable(db, identity.sessionId, row) === true ? [identity] : []
+    })
     .map((identity) => ({
       handle: identity.handle,
       worktreeId: identity.worktreeId,
@@ -49,11 +68,11 @@ export function listAddressableStructuredWorkers(): OrchestrationAddressableAgen
  * A structured worker's agent status, in the vocabulary `@idle` already matches on.
  *
  * Null when the session cannot be read: unknown must not read as idle, or a broadcast to `@idle`
- * would wake a worker mid-turn — which Codex coalesces into the running turn and Claude queues
- * behind it.
+ * would wake a worker mid-turn — which Codex coalesces into the running turn and Claude folds
+ * into it.
  */
-export function structuredWorkerAgentStatus(sessionId: string): string | null {
-  const facts = readStructuredSessionGateFacts(sessionId)
+export async function structuredWorkerAgentStatus(sessionId: string): Promise<string | null> {
+  const facts = await readStructuredSessionGateFacts(sessionId)
   if (!facts) {
     return null
   }
diff --git a/src/main/runtime/orchestration/structured-worker-journal-page.ts b/src/main/runtime/orchestration/structured-worker-journal-page.ts
index 35676aaf52c..8d260339fa6 100644
--- a/src/main/runtime/orchestration/structured-worker-journal-page.ts
+++ b/src/main/runtime/orchestration/structured-worker-journal-page.ts
@@ -16,14 +16,17 @@ export type StructuredJournalPage = {
   hasOlder: boolean
 }
 
-/** The newest page of a session's journal, or null when this runtime cannot read it. */
-export function readStructuredJournalPage(sessionId: string): StructuredJournalPage | null {
+/** The newest page of a session's journal, or null when this runtime cannot read it. A closed
+ *  conversation is opened for the read; that starts no agent. */
+export async function readStructuredJournalPage(
+  sessionId: string
+): Promise<StructuredJournalPage | null> {
   const host = getStructuredAgentSessionHost()
   if (!host) {
     return null
   }
   try {
-    const result = host.history({
+    const result = await host.history({
       sessionId,
       direction: 'tail',
       limit: STRUCTURED_JOURNAL_PAGE_LIMIT
diff --git a/src/main/runtime/orchestration/types.ts b/src/main/runtime/orchestration/types.ts
index d00ea480c7d..cd2b12a7da2 100644
--- a/src/main/runtime/orchestration/types.ts
+++ b/src/main/runtime/orchestration/types.ts
@@ -1,4 +1,5 @@
 import type { TerminalExitCause } from '../../../shared/terminal-exit-cause'
+import type { OrcaSessionId } from '../../../shared/orca-session-address'
 export const MESSAGE_TYPES = [
   'status',
   'dispatch',
@@ -47,7 +48,7 @@ export type RunRow = {
   coordinator_handle: string | null
   coordinator_pane_key: string | null
   /** Bare Orca session id the coordinator is addressed by, when it has one (today only structured sessions); a `/clear`ed chat's lineage root. */
-  coordinator_orca_session_id: string | null
+  coordinator_orca_session_id: OrcaSessionId | null
   /** The consumer_generation the id was written at; see currentRunCoordinatorOrcaSessionId. */
   coordinator_orca_session_id_generation: number | null
   consumer_generation: number
@@ -283,7 +284,7 @@ export type DispatchContextRow = {
   assignee_handle: string | null
   assignee_pane_key: string | null
   /** Bare Orca session id the assignee is addressed by, when it has one (today only structured sessions); a `/clear`ed chat's lineage root. */
-  assignee_orca_session_id: string | null
+  assignee_orca_session_id: OrcaSessionId | null
   capability_hash: string | null
   process_incarnation: string | null
   capability_revoked_at: string | null
@@ -294,7 +295,7 @@ export type DispatchContextRow = {
   creator_handle: string | null
   creator_pane_key: string | null
   /** Bare Orca session id the creator is addressed by, when it has one (today only structured sessions); a `/clear`ed chat's lineage root. */
-  creator_orca_session_id: string | null
+  creator_orca_session_id: OrcaSessionId | null
   host_scope: string | null
   status: DispatchStatus
   failure_count: number
diff --git a/src/main/runtime/orchestration/worker-output-archive.ts b/src/main/runtime/orchestration/worker-output-archive.ts
index d7e894cf54c..ddae515a7f2 100644
--- a/src/main/runtime/orchestration/worker-output-archive.ts
+++ b/src/main/runtime/orchestration/worker-output-archive.ts
@@ -91,7 +91,7 @@ export async function captureWorkerOutputArchive(args: {
   structuredWorker?: StructuredWorkerIdentity | null
 }): Promise<WorkerOutputArchiveCapture> {
   if (args.structuredWorker) {
-    const content = captureStructuredWorkerArchive(
+    const content = await captureStructuredWorkerArchive(
       args.structuredWorker,
       structuredWorkerAgent(args.structuredWorker)
     )
diff --git a/src/main/runtime/orchestration/worker-terminal-process-liveness.test.ts b/src/main/runtime/orchestration/worker-terminal-process-liveness.test.ts
new file mode 100644
index 00000000000..e2bc2cc7d63
--- /dev/null
+++ b/src/main/runtime/orchestration/worker-terminal-process-liveness.test.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it } from 'vitest'
+import { matchesProcessIncarnation } from './worker-terminal-process-liveness'
+
+describe('matchesProcessIncarnation', () => {
+  it.each([
+    {
+      name: 'an exact ptyId:incarnation match',
+      ptyId: 'pty-1',
+      incarnationId: 'incarnation-1',
+      processIncarnation: 'pty-1:incarnation-1',
+      expected: true
+    },
+    {
+      name: 'a Windows repo::C:\\path@@1 ptyId whose incarnation matches',
+      ptyId: 'repo::C:\\path@@1',
+      incarnationId: 'incarnation-win',
+      processIncarnation: 'repo::C:\\path@@1:incarnation-win',
+      expected: true
+    },
+    {
+      name: 'a colon-bearing relay incarnationId that a lastIndexOf split would mangle',
+      ptyId: 'relay-pty',
+      incarnationId: 'relay:conn-3:incarnation-9',
+      processIncarnation: 'relay-pty:relay:conn-3:incarnation-9',
+      expected: true
+    },
+    {
+      name: 'a whitespace-dirty incarnationId (lost contact is never a match)',
+      ptyId: 'pty-1',
+      incarnationId: ' incarnation-1',
+      processIncarnation: 'pty-1: incarnation-1',
+      expected: false
+    },
+    {
+      name: 'an empty-string incarnationId',
+      ptyId: 'pty-1',
+      incarnationId: '',
+      processIncarnation: 'pty-1:',
+      expected: false
+    },
+    {
+      name: 'an absent (null) incarnationId',
+      ptyId: 'pty-1',
+      incarnationId: null,
+      processIncarnation: 'pty-1:incarnation-1',
+      expected: false
+    },
+    {
+      name: 'an absent (undefined) incarnationId',
+      ptyId: 'pty-1',
+      incarnationId: undefined,
+      processIncarnation: 'pty-1:incarnation-1',
+      expected: false
+    },
+    {
+      name: 'a prefix-decoy ptyId (@@1) against a longer live pty (@@10)',
+      ptyId: 'repo::C:\\path@@1',
+      incarnationId: 'inc-1',
+      processIncarnation: 'repo::C:\\path@@10:inc-1',
+      expected: false
+    }
+  ])('returns $expected for $name', ({ ptyId, incarnationId, processIncarnation, expected }) => {
+    expect(matchesProcessIncarnation(ptyId, incarnationId, processIncarnation)).toBe(expected)
+  })
+
+  it('rejects a partial prefix that is not colon-delimited', () => {
+    // 'pty-10' is not the pty 'pty-1'; the `${ptyId}:` fence keeps them distinct.
+    expect(matchesProcessIncarnation('pty-1', 'inc', 'pty-10:inc')).toBe(false)
+  })
+})
diff --git a/src/main/runtime/orchestration/worker-terminal-process-liveness.ts b/src/main/runtime/orchestration/worker-terminal-process-liveness.ts
index 72c5ce07666..4e652d6286a 100644
--- a/src/main/runtime/orchestration/worker-terminal-process-liveness.ts
+++ b/src/main/runtime/orchestration/worker-terminal-process-liveness.ts
@@ -5,6 +5,24 @@ import type { PtyProcessInfo } from '../../providers/pty-process-info'
 export type { WorkerTerminalHostScope } from '../../../shared/worker-terminal-host-scope'
 export { parseWorkerTerminalHostScope } from '../../../shared/worker-terminal-host-scope'
 
+/**
+ * Does `processIncarnation` name exactly this pty's live incarnation? Requires exact
+ * `${ptyId}:${incarnationId}` equality, so it is immune to colons on either side (relay/SSH
+ * ptyIds, colon-bearing relay incarnationIds). A pty with no (or a whitespace-dirty)
+ * incarnationId can never match — the exact-incarnation fence stays intact.
+ */
+export function matchesProcessIncarnation(
+  ptyId: string,
+  incarnationId: string | null | undefined,
+  processIncarnation: string
+): boolean {
+  if (!incarnationId || incarnationId !== incarnationId.trim()) {
+    return false
+  }
+  return `${ptyId}:${incarnationId}` === processIncarnation
+}
+
+/** Classify a recorded incarnation against live sessions: live on exact match, unverifiable when a candidate pty has a dirty or absent incarnationId (lost contact is never a death certificate), else exited. */
 export function classifyWorkerTerminalProcessIncarnation(
   processIncarnation: string,
   sessions: readonly PtyProcessInfo[]
@@ -13,13 +31,9 @@ export function classifyWorkerTerminalProcessIncarnation(
     processIncarnation.startsWith(`${session.id}:`)
   )
   if (
-    possibleMatches.some((session) => {
-      const incarnationId = session.incarnationId
-      if (!incarnationId || incarnationId !== incarnationId.trim()) {
-        return false
-      }
-      return `${session.id}:${incarnationId}` === processIncarnation
-    })
+    possibleMatches.some((session) =>
+      matchesProcessIncarnation(session.id, session.incarnationId, processIncarnation)
+    )
   ) {
     return 'live'
   }
diff --git a/src/main/runtime/orchestration/worker-transcript-payload.test.ts b/src/main/runtime/orchestration/worker-transcript-payload.test.ts
index c843fe1cfa7..d0b4ce23127 100644
--- a/src/main/runtime/orchestration/worker-transcript-payload.test.ts
+++ b/src/main/runtime/orchestration/worker-transcript-payload.test.ts
@@ -1,7 +1,9 @@
 import { describe, expect, it } from 'vitest'
 import { MAX_CODEX_SUBAGENTS_PER_GROUP } from '../../codex/codex-structured-journal-limits'
+import { projectStructuredItemsToNativeChat } from '../../../shared/structured-agent-session-projection'
 import {
   boundWorkerTranscriptMessages,
+  boundWorkerTranscriptTail,
   redactWorkerTerminalLines
 } from './worker-transcript-payload'
 
@@ -177,6 +179,28 @@ describe('worker transcript wire bounds', () => {
     expect(result).toMatchObject({ limited: false, warnings: [] })
   })
 
+  it("serves a structured worker's journal rows without their list position", () => {
+    const [message] = projectStructuredItemsToNativeChat([
+      {
+        itemId: 'reply',
+        revision: 1,
+        sequence: 7,
+        sequenceIndex: 1,
+        observedAt: 1,
+        body: { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'done' }] }
+      }
+    ])
+    // Anti-vacuous: the projection itself does position the row.
+    expect(message?.journalPosition).toEqual({ sequence: 7, index: 1 })
+    for (const served of [
+      boundWorkerTranscriptMessages([message!]).messages,
+      boundWorkerTranscriptTail([message!], 262_144).messages
+    ]) {
+      expect(served).toHaveLength(1)
+      expect(served[0]).not.toHaveProperty('journalPosition')
+    }
+  })
+
   it('keeps two roster ids sharing a 512-char prefix distinct', () => {
     // The id is the roster key: a plain prefix clip would merge the two children.
     const head = 'a'.repeat(512)
@@ -275,3 +299,48 @@ describe('worker transcript wire bounds', () => {
     )
   })
 })
+
+describe("worker transcript wire bounds — a subagent's line names its agent and nothing more", () => {
+  it('serves the producing agent id, bounded like the roster key, and drops provenance', () => {
+    const longId = `task-${'x'.repeat(2_000)}`
+    const result = boundWorkerTranscriptMessages([
+      {
+        id: 'child-line',
+        role: 'assistant',
+        timestamp: null,
+        source: 'transcript',
+        blocks: [{ type: 'text', text: 'The PR is CLEAN.' }],
+        agentId: longId,
+        parentAgentId: 'task-parent',
+        providerParentRef: 'toolu_provider_call',
+        producerKind: 'agent',
+        attempt: 2
+      },
+      {
+        id: 'roster',
+        role: 'system',
+        timestamp: null,
+        source: 'transcript',
+        blocks: [
+          {
+            type: 'subagent-group',
+            groupId: 'group-1',
+            agents: [{ id: longId, label: 'review the PR', state: 'working' }]
+          }
+        ]
+      }
+    ])
+    const [child, roster] = result.messages
+    expect(child).not.toHaveProperty('providerParentRef')
+    expect(child).not.toHaveProperty('parentAgentId')
+    expect(child).not.toHaveProperty('producerKind')
+    expect(child).not.toHaveProperty('attempt')
+    // The line's agent id and the roster entry that names it bound to the same key,
+    // so the reader can still put a name to the line.
+    const rosterBlock = roster?.blocks[0]
+    expect(rosterBlock?.type).toBe('subagent-group')
+    const entryId = rosterBlock?.type === 'subagent-group' ? rosterBlock.agents[0]?.id : undefined
+    expect(child?.agentId).toBeDefined()
+    expect(child?.agentId).toBe(entryId)
+  })
+})
diff --git a/src/main/runtime/orchestration/worker-transcript-payload.ts b/src/main/runtime/orchestration/worker-transcript-payload.ts
index b4365e259c2..b62687bd813 100644
--- a/src/main/runtime/orchestration/worker-transcript-payload.ts
+++ b/src/main/runtime/orchestration/worker-transcript-payload.ts
@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto'
 import type { NativeChatBlock, NativeChatMessage } from '../../../shared/native-chat-types'
+import { agentJournalItemSubagentId } from '../../../shared/agent-session-journal-producer'
 import { boundSubagentEntryId } from '../../native-chat/subagent-entry-id-bounds'
 import { boundWorkerTranscriptActivityBlock } from './worker-transcript-activity-block-bounds'
 
@@ -108,10 +109,25 @@ function boundMessage(
   if (blocks.length < message.blocks.length) {
     markClipped(state, 'Some transcript blocks were omitted from oversized messages.')
   }
+  // The journal position only orders a live list; a worker read is already in order.
+  // Of the producer linkage only the agent's id is served, so a reader can say whose
+  // line it is; the rest is provenance.
+  const {
+    journalPosition: _journalPosition,
+    agentId: _agentId,
+    parentAgentId: _parentAgentId,
+    providerParentRef: _providerParentRef,
+    producerKind: _producerKind,
+    attempt: _attempt,
+    ...served
+  } = message
+  const subagentId = agentJournalItemSubagentId(message)
   return {
-    ...message,
+    ...served,
     id: boundIdentifier(message.id, transcriptPath, state),
     ...(message.turnId ? { turnId: boundIdentifier(message.turnId, transcriptPath, state) } : {}),
+    // Same key as the roster entry that names it, so it is bounded the same way.
+    ...(subagentId === null ? {} : { agentId: boundEntryId(subagentId, state) }),
     blocks: blocks.map((block) => boundBlock(block, state))
   }
 }
diff --git a/src/main/runtime/paired-close-retirement-proof-publication-order.test.ts b/src/main/runtime/paired-close-retirement-proof-publication-order.test.ts
index 640c54a753c..35fb16d55ea 100644
--- a/src/main/runtime/paired-close-retirement-proof-publication-order.test.ts
+++ b/src/main/runtime/paired-close-retirement-proof-publication-order.test.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import { getDefaultWorkspaceSession } from '../../shared/constants'
 import type {
@@ -88,14 +89,17 @@ function createHost(): {
 } {
   let session = makePersistedSession()
   // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the store stub carries the four members this publication-order suite drives; the rest of Store is unreached.
-  const runtime = new OrcaRuntimeService({
-    getRepos: () => [LIVE_REPO],
-    getWorkspaceSession: () => session,
-    setWorkspaceSession: (next: WorkspaceSessionState) => {
-      session = next
-    },
-    flushOrThrow: vi.fn()
-  } as never)
+  const runtime = new OrcaRuntimeService(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This runtime fixture supplies the persistence and graph methods exercised by the test.
+    withDurableRuntimeStore({
+      getRepos: () => [LIVE_REPO],
+      getWorkspaceSession: () => session,
+      setWorkspaceSession: (next: WorkspaceSessionState) => {
+        session = next
+      },
+      flushOrThrow: vi.fn()
+    }) as never
+  )
   runtime.attachWindow(1)
   runtime.syncWindowGraph(1, {
     tabs: [
@@ -159,7 +163,7 @@ describe('retirement proof publication vs. renderer republication order', () =>
   it('publishes the proof when the exit lands before the renderer drops the surface', async () => {
     const { runtime, handle } = createHost()
 
-    runtime.onPtyExit('pty-left', 0, 'incarnation-a')
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-a')
     republishWithoutTheSurface(runtime)
 
     const published = await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)
@@ -174,7 +178,7 @@ describe('retirement proof publication vs. renderer republication order', () =>
 
     retirePersistedSurface()
     republishWithoutTheSurface(runtime)
-    runtime.onPtyExit('pty-left', 0, 'incarnation-a')
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-a')
 
     const published = await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)
     expect(published.tabs).toEqual([])
@@ -185,7 +189,7 @@ describe('retirement proof publication vs. renderer republication order', () =>
 
   // Why a subscriber and not just the stored snapshot: a mirror only ever sees frames. A proof
   // that lands in state without a frame to carry it is the same silence from the client's side.
-  it('fans the proof out to a paired subscriber, not just into stored state', () => {
+  it('fans the proof out to a paired subscriber, not just into stored state', async () => {
     const { runtime, handle, retirePersistedSurface } = createHost()
     const frames: RuntimeMobileSessionTabsResult[] = []
     const unsubscribe = runtime.onMobileSessionTabsChanged(
@@ -196,7 +200,7 @@ describe('retirement proof publication vs. renderer republication order', () =>
     try {
       retirePersistedSurface()
       republishWithoutTheSurface(runtime)
-      runtime.onPtyExit('pty-left', 0, 'incarnation-a')
+      await runtime.onPtyExit('pty-left', 0, 'incarnation-a')
     } finally {
       unsubscribe()
     }
diff --git a/src/main/runtime/pty-inventory-partial-relay-liveness.test.ts b/src/main/runtime/pty-inventory-partial-relay-liveness.test.ts
index 22dc70e42c0..cf5618ab2ff 100644
--- a/src/main/runtime/pty-inventory-partial-relay-liveness.test.ts
+++ b/src/main/runtime/pty-inventory-partial-relay-liveness.test.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
 import { describe, expect, it } from 'vitest'
 import { getDefaultWorkspaceSession } from '../../shared/constants'
 import { makePaneKey } from '../../shared/stable-pane-id'
@@ -50,7 +51,8 @@ function createRuntime(options: { sessions?: unknown[]; vouchesForRetainedPty?:
   calls: ListCall[]
 } {
   const meta: Record<string, Record<string, unknown>> = { [WORKSPACE]: { hostId: 'local' } }
-  const store = {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This runtime fixture supplies the persistence and graph methods exercised by the test.
+  const store = withDurableRuntimeStore({
     getRepos: () => [REPO],
     getRepo: (id: string) => (id === REPO_ID ? REPO : undefined),
     getAllWorktreeMeta: () => meta,
@@ -62,7 +64,7 @@ function createRuntime(options: { sessions?: unknown[]; vouchesForRetainedPty?:
     getWorkspaceSession: () => getDefaultWorkspaceSession(),
     setWorkspaceSession: () => {},
     flushOrThrow: () => {}
-  } as never
+  }) as never
   const calls: ListCall[] = []
   const runtime = new OrcaRuntimeService(store)
   runtime.setPtyController({
diff --git a/src/main/runtime/pty-shell-ownership-mirror.test.ts b/src/main/runtime/pty-shell-ownership-mirror.test.ts
index 20468a194cd..b0525940a86 100644
--- a/src/main/runtime/pty-shell-ownership-mirror.test.ts
+++ b/src/main/runtime/pty-shell-ownership-mirror.test.ts
@@ -16,6 +16,24 @@ describe('PtyShellOwnershipMirror', () => {
     expect(mirror.owner).toBe('shell')
   })
 
+  it('asks at the real D after refuted stray Ds, in lockstep with the host barrier', async () => {
+    let hostGrounded = false
+    const confirm = vi.fn(async () => hostGrounded)
+    const mirror = new PtyShellOwnershipMirror(confirm)
+    mirror.scan('\x1b]133;C\x07\x1b[>1u\x1b[?1049hAGENT')
+
+    for (let index = 1; index <= 5; index += 1) {
+      mirror.scan('\x1b]133;C\x07nested\x1b]133;D;0\x07')
+      await vi.waitFor(() => expect(confirm).toHaveBeenCalledTimes(index))
+      await mirror.settle()
+    }
+    hostGrounded = true
+    mirror.scan('\x1b]133;D;137\x07')
+
+    await vi.waitFor(() => expect(mirror.owner).toBe('shell'))
+    expect(confirm).toHaveBeenCalledTimes(6)
+  })
+
   it('does not arm from a seed on the normal buffer', async () => {
     const confirm = vi.fn(async () => true)
     const mirror = new PtyShellOwnershipMirror(confirm)
diff --git a/src/main/runtime/pty-shell-ownership-mirror.ts b/src/main/runtime/pty-shell-ownership-mirror.ts
index 5c54465be75..45a7d8e8422 100644
--- a/src/main/runtime/pty-shell-ownership-mirror.ts
+++ b/src/main/runtime/pty-shell-ownership-mirror.ts
@@ -42,6 +42,11 @@ export class PtyShellOwnershipMirror {
     }
   }
 
+  /** Reset Terminal: the ground for this mirror's view of mode ownership, already scanned. */
+  groundInputModes(): string {
+    return this.scanner.groundProcessBoundary()
+  }
+
   get owner(): TerminalOwner | undefined {
     return this.scanner.owner
   }
diff --git a/src/main/runtime/qoder-terminal-readiness.ts b/src/main/runtime/qoder-terminal-readiness.ts
new file mode 100644
index 00000000000..781da3341c0
--- /dev/null
+++ b/src/main/runtime/qoder-terminal-readiness.ts
@@ -0,0 +1,11 @@
+// Captured Qoder 1.1.64 paints its idle OSC title even while the trust menu owns input.
+export function isQoderComposerReady(screenLines: readonly string[] | null): boolean {
+  if (!screenLines) {
+    return false
+  }
+  const screen = screenLines.join('\n').toLowerCase()
+  return (
+    screen.includes('type your message or @path/to/file') &&
+    !screen.includes("don't trust and exit")
+  )
+}
diff --git a/src/main/runtime/qoder-transcripts.test.ts b/src/main/runtime/qoder-transcripts.test.ts
new file mode 100644
index 00000000000..89c5881382a
--- /dev/null
+++ b/src/main/runtime/qoder-transcripts.test.ts
@@ -0,0 +1,50 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import { createTranscriptPane } from './agent-transcript-pane-test-harness'
+import { extractLastOscTitle } from '../../shared/osc-title-extraction'
+import { getAgentLabel, normalizeTerminalTitle } from '../../shared/agent-detection'
+
+vi.mock('electron', () => ({
+  BrowserWindow: { fromId: vi.fn(() => null) },
+  webContents: { fromId: vi.fn(() => null) },
+  ipcMain: { on: vi.fn(), removeListener: vi.fn() },
+  app: { getPath: vi.fn(() => '/tmp') }
+}))
+
+describe('captured Qoder 1.1.64 startup', () => {
+  it.each(['qoder-trust-dialog', 'qoder-no-account', 'qoder-ready'])(
+    'preserves Qoder identity in %s',
+    async (fixture) => {
+      const data = readFileSync(join(__dirname, '__fixtures__', `${fixture}.txt`), 'utf8')
+      // The recorder's shutdown clears the OSC title; inspect the live capture before that reset.
+      const title = extractLastOscTitle(
+        data.replaceAll(`${String.fromCharCode(27)}]0;${String.fromCharCode(7)}`, '')
+      )
+      expect(title).toContain(' | Ready')
+      expect(getAgentLabel(normalizeTerminalTitle(title ?? ''))).toBe('Qoder CLI')
+      const { runtime, handle } = await createTranscriptPane({
+        paneTitle: title ?? '',
+        foregroundProcess: 'qodercli-1.1.64',
+        launchAgent: 'qoder',
+        data,
+        size: { cols: 100, rows: 32 }
+      })
+      const shown = await runtime.showTerminal(handle)
+      expect(shown.agentIdentity).toBe('qoder')
+      if (fixture === 'qoder-trust-dialog') {
+        const readiness = await runtime
+          .waitForTerminal(handle, { condition: 'tui-idle', timeoutMs: 600 })
+          .catch(() => null)
+        expect(readiness?.satisfied ?? false).toBe(false)
+      }
+      if (fixture === 'qoder-ready') {
+        const readiness = await runtime.waitForTerminal(handle, {
+          condition: 'tui-idle',
+          timeoutMs: 1500
+        })
+        expect(readiness.satisfied).toBe(true)
+      }
+    }
+  )
+})
diff --git a/src/main/runtime/rpc/core.ts b/src/main/runtime/rpc/core.ts
index 0eae5f48bb3..1ec15933782 100644
--- a/src/main/runtime/rpc/core.ts
+++ b/src/main/runtime/rpc/core.ts
@@ -10,6 +10,7 @@ import type {
 } from '../../../shared/mobile-relay-credential-contract'
 import type { RuntimeCapability } from '../../../shared/protocol-version'
 import type { OrchestrationCompatibilityEvidence } from '../../../shared/orchestration-compatibility-evidence'
+import type { OrchestrationSessionCaller } from '../orchestration/orchestration-caller-identity'
 
 export type PairingRpcContext = {
   getEndpoints(params: PairingGetEndpointsParams): Promise<PairingGetEndpointsResult>
@@ -100,6 +101,8 @@ export type RpcContext = {
   replayedMutationReceipt?: unknown
   // Why: Run-scoped handlers must compare declared handles with request attestation.
   orchestrationCompatibilityEvidence?: OrchestrationCompatibilityEvidence
+  // Why: resolved once at the dispatch entry from the caller's Orca session id; the session wins.
+  orchestrationCaller?: OrchestrationSessionCaller
   // Why: only the compatibility authority router can set this trusted scope; user params cannot bypass Run consumer binding.
   legacyCoordinatorRunId?: string
   legacyCoordinatorAuthority?: LegacyCoordinatorAuthorityProof
@@ -228,6 +231,11 @@ export function eraseRpcMethods(
   return methods as readonly RpcAnyMethod[]
 }
 
+// Unsubscribes that must not retire a registration created after their dispatch began.
+export function isRegistrationFencedUnsubscribe(method: string): boolean {
+  return method === 'terminal.unsubscribe' || method === 'session.tabs.unsubscribe'
+}
+
 export function isStreamingMethod(method: RpcAnyMethod): method is RpcStreamingMethod {
   return 'stream' in method && method.stream === true
 }
diff --git a/src/main/runtime/rpc/dispatcher-unary-method-invocation.ts b/src/main/runtime/rpc/dispatcher-unary-method-invocation.ts
index 60d9728f152..d8bf3e25b53 100644
--- a/src/main/runtime/rpc/dispatcher-unary-method-invocation.ts
+++ b/src/main/runtime/rpc/dispatcher-unary-method-invocation.ts
@@ -82,7 +82,8 @@ export async function invokeDispatcherUnaryMethod({
     request,
     effectiveParams,
     invoke,
-    legacyCoordinator?.mutationCallerFingerprint ?? authenticatedCallerFingerprint
+    legacyCoordinator?.mutationCallerFingerprint ?? authenticatedCallerFingerprint,
+    context.orchestrationCaller?.orcaSessionId
   )
   recordRuntimeFeatureInteraction(runtime, request.method, result, undefined, request.params)
   return result
diff --git a/src/main/runtime/rpc/dispatcher.ts b/src/main/runtime/rpc/dispatcher.ts
index 6ed2f1fd9eb..83cd0e30f9c 100644
--- a/src/main/runtime/rpc/dispatcher.ts
+++ b/src/main/runtime/rpc/dispatcher.ts
@@ -1,5 +1,6 @@
 import {
   buildRegistry,
+  isRegistrationFencedUnsubscribe,
   isStreamingMethod,
   type RpcAnyMethodDeclaration,
   type RpcEnvelopeMeta,
@@ -23,6 +24,11 @@ import { mapDispatcherError } from './dispatcher-error-response'
 import { parseRpcRequestParams } from './dispatcher-request-parsing'
 import { RpcStreamingDispatcher } from './rpc-streaming-dispatcher'
 import { invokeDispatcherUnaryMethod } from './dispatcher-unary-method-invocation'
+import {
+  needsOrchestrationCallerResolution,
+  resolveOrchestrationSessionCaller,
+  type ResolvedOrchestrationRequest
+} from './orchestration-session-caller'
 
 export type DispatcherOptions = {
   runtime: OrcaRuntimeService
@@ -69,7 +75,15 @@ export class RpcDispatcher {
       return migrationFence
     }
 
-    const parsedParams = parseRpcRequestParams(request, method, meta)
+    let resolved: ResolvedOrchestrationRequest = { request }
+    if (needsOrchestrationCallerResolution(request)) {
+      try {
+        resolved = await resolveOrchestrationSessionCaller(this.runtime, request, options)
+      } catch (error) {
+        return mapDispatcherError(request, meta, error)
+      }
+    }
+    const parsedParams = parseRpcRequestParams(resolved.request, method, meta)
     if (parsedParams.error) {
       return parsedParams.error
     }
@@ -89,24 +103,25 @@ export class RpcDispatcher {
     try {
       const result = await invokeDispatcherUnaryMethod({
         runtime: this.runtime,
-        request,
+        request: resolved.request,
         method,
         params: parsedParams.value,
         context: {
           runtime: this.runtime,
           signal: options?.signal,
           connectionId: options?.connectionId,
-          subscriptionRegistrationVersion:
-            request.method === 'terminal.unsubscribe'
-              ? this.runtime.getSubscriptionRegistrationVersion()
-              : undefined,
+          // Session tabs always need this fence. COMPAT(terminal request-addressed unsubscribe): terminal only for phones without `requestId`.
+          subscriptionRegistrationVersion: isRegistrationFencedUnsubscribe(request.method)
+            ? this.runtime.getSubscriptionRegistrationVersion()
+            : undefined,
           requestId: request.id,
           clientId: options?.clientId,
           clientKind: options?.clientKind,
           clientCapabilities: options?.clientCapabilities,
           updateClientCapabilities: options?.updateClientCapabilities,
           orchestrationCapability: request.orchestrationCapability,
-          authenticatedCallerFingerprint: options?.authenticatedCallerFingerprint
+          authenticatedCallerFingerprint: options?.authenticatedCallerFingerprint,
+          orchestrationCaller: resolved.caller
         },
         orchestrationMutations: this.orchestrationMutations,
         legacyOrchestration: this.legacyOrchestration
diff --git a/src/main/runtime/rpc/errors.test.ts b/src/main/runtime/rpc/errors.test.ts
index 02ae6a335f2..624557c1f7f 100644
--- a/src/main/runtime/rpc/errors.test.ts
+++ b/src/main/runtime/rpc/errors.test.ts
@@ -15,6 +15,11 @@ import {
   nestedWorkerDepthExceededMessage
 } from '../../../shared/nested-worker-depth'
 import { OrchestrationError } from '../orchestration/orchestration-error'
+import {
+  AgentSessionRefusalError,
+  agentSessionRefusalError,
+  refuseUnclassified
+} from '../../../shared/agent-session-wire-refusals'
 
 class LineageError extends Error {
   code = 'LINEAGE_PARENT_NOT_FOUND'
@@ -297,3 +302,63 @@ describe('structured worker dispatch preamble errors', () => {
     })
   })
 })
+
+describe('thrown agent-session refusals', () => {
+  const meta = { runtimeId: 'runtime-1' }
+
+  // Released clients classify a thrown refusal by its wire code and message; both must read
+  // exactly as the bare `Error(code)` this replaced.
+  it.each([
+    [
+      'agent_session_ownership_unknown',
+      'agent_session_ownership_unknown',
+      agentSessionRefusalError('agent_session_ownership_unknown', { reason: 'noLiveOwner' })
+    ],
+    [
+      'structured_agent_session_unsupported',
+      'runtime_error',
+      agentSessionRefusalError('structured_agent_session_unsupported', { reason: 'hostDisabled' })
+    ],
+    [
+      'agent_session_checkpoint_stale',
+      'agent_session_checkpoint_stale',
+      agentSessionRefusalError('agent_session_checkpoint_stale', {
+        reason: 'fenceStale',
+        currentFence: 4
+      })
+    ]
+  ] as const)(
+    'keeps %s on the wire as it was, and adds its details in data',
+    (code, wire, error) => {
+      const before = mapRuntimeError('req_1', meta, new Error(code))
+      const after = mapRuntimeError('req_1', meta, error)
+      expect(after.error.code).toBe(before.error.code)
+      expect(after.error.code).toBe(wire)
+      expect(after.error.message).toBe(before.error.message)
+      expect(after.error.message).toBe(code)
+      expect(after.error.data).toEqual({ refusal: { code, details: error.refusal.details } })
+      expect(error.refusal.details?.reason).toBeDefined()
+    }
+  )
+
+  it('carries no details in data when the refusal named none', () => {
+    const response = mapRuntimeError(
+      'req_1',
+      meta,
+      new AgentSessionRefusalError(
+        refuseUnclassified('agent_session_conflict', 'Another process claims this session.')
+      )
+    )
+    expect(response.error).toEqual({
+      code: 'agent_session_conflict',
+      message: 'agent_session_conflict',
+      data: { refusal: { code: 'agent_session_conflict' } }
+    })
+  })
+
+  it('exposes no code property another passthrough could claim', () => {
+    expect(
+      'code' in agentSessionRefusalError('agent_session_conflict', { reason: 'claimConflicted' })
+    ).toBe(false)
+  })
+})
diff --git a/src/main/runtime/rpc/errors.ts b/src/main/runtime/rpc/errors.ts
index c2402d87849..6d122c02d45 100644
--- a/src/main/runtime/rpc/errors.ts
+++ b/src/main/runtime/rpc/errors.ts
@@ -2,7 +2,13 @@
 // runtime/browser error allowlists define the contract the CLI relies on to
 // format human-facing messages. Centralizing this mapping keeps the allowlist
 // auditable in one place instead of spread across per-method branches.
+import {
+  agentSessionRefusalReference,
+  isAgentSessionRefusalError,
+  type AgentSessionRefusalError
+} from '../../../shared/agent-session-wire-refusals'
 import type { RpcEnvelopeMeta, RpcFailure, RpcSuccess } from './core'
+import { ORCHESTRATION_SESSION_CALLER_ERROR_CODES } from '../../../shared/orchestration-session-caller-codes'
 import { computerUseErrorRecoveryData } from '../../../shared/computer-use-error-recovery'
 import { COMPUTER_ERROR_CODES } from '../../../shared/runtime-types'
 import { LINEAR_ERROR_CODES } from '../../../shared/linear/agent-access'
@@ -153,11 +159,15 @@ const STRUCTURED_RUNTIME_PASSTHROUGH_CODES: ReadonlySet<string> = new Set([
   SKILL_INSTALL_RPC_ERROR_CODE,
   // Why: an owner conflict is a distinct client decision (reload the host, re-adopt,
   // stop offering the action) — flattened to runtime_error it can only be guessed at.
-  ...Object.values(AUTOMATION_OWNER_CONFLICT_CODES)
+  ...Object.values(AUTOMATION_OWNER_CONFLICT_CODES),
+  ...Object.values(ORCHESTRATION_SESSION_CALLER_ERROR_CODES)
 ])
 
 export function mapRuntimeError(id: string, meta: RpcEnvelopeMeta, error: unknown): RpcFailure {
   const message = error instanceof Error ? error.message : String(error)
+  if (isAgentSessionRefusalError(error)) {
+    return agentSessionRefusalErrorResponse(id, meta, error)
+  }
   if (
     error instanceof Error &&
     'code' in error &&
@@ -228,6 +238,27 @@ export function mapRuntimeError(id: string, meta: RpcEnvelopeMeta, error: unknow
   return errorResponse(id, meta, 'runtime_error', message)
 }
 
+/**
+ * A thrown agent-session refusal, mapped before any `'code' in error` passthrough so no other
+ * subsystem's code set can claim it. Wire code and message are exactly what the bare `Error(code)`
+ * it replaced produced — released clients classify both — and the refusal's details ride only in
+ * `data`, which they ignore.
+ */
+function agentSessionRefusalErrorResponse(
+  id: string,
+  meta: RpcEnvelopeMeta,
+  error: AgentSessionRefusalError
+): RpcFailure {
+  const { code } = error.refusal
+  return errorResponse(
+    id,
+    meta,
+    RUNTIME_PASSTHROUGH_CODES.has(code) ? code : 'runtime_error',
+    code,
+    { refusal: agentSessionRefusalReference(error.refusal) }
+  )
+}
+
 export const computerErrorData = computerUseErrorRecoveryData
 
 // Why: browser errors carry a structured .code property (BrowserError from
diff --git a/src/main/runtime/rpc/methods/agent-hooks.ts b/src/main/runtime/rpc/methods/agent-hooks.ts
index 4d9f4a7706c..59273cf8715 100644
--- a/src/main/runtime/rpc/methods/agent-hooks.ts
+++ b/src/main/runtime/rpc/methods/agent-hooks.ts
@@ -1,3 +1,4 @@
+import { isAgentStatusHooksEnabledForAgent } from '../../../../shared/agent-status-hooks-setting'
 import { prepareManagedWslCodexHomeBeforeShellLaunch } from '../../../codex/managed-wsl-home-shell-preflight'
 import { defineMethod } from '../core'
 import { PrepareCodexForWslPaneParams } from '../../../../shared/rpc-contract/agent-hooks-params'
@@ -10,15 +11,13 @@ export const AGENT_HOOK_METHODS = [
       if (clientKind !== undefined) {
         throw new Error('Codex hook preparation is only available to the local Orca CLI.')
       }
-      const settings = runtime.getClientSettings()
       return await prepareManagedWslCodexHomeBeforeShellLaunch({
         env: {
           CODEX_HOME: params.codexHome,
           ORCA_CODEX_HOME: params.orcaCodexHome,
           WSL_DISTRO_NAME: params.wslDistro
         },
-        hooksEnabled:
-          settings.agentStatusHooksEnabled && !settings.disabledTuiAgents.includes('codex')
+        hooksEnabled: isAgentStatusHooksEnabledForAgent(runtime.getClientSettings(), 'codex')
       })
     }
   })
diff --git a/src/main/runtime/rpc/methods/agent-launch-caller-selection.test.ts b/src/main/runtime/rpc/methods/agent-launch-caller-selection.test.ts
new file mode 100644
index 00000000000..8ef0f2c904d
--- /dev/null
+++ b/src/main/runtime/rpc/methods/agent-launch-caller-selection.test.ts
@@ -0,0 +1,181 @@
+/**
+ * A launch from a paired client moves that client's view to the new tab and nobody else's: the view
+ * intent belongs to the connection that asked. In-process callers and workspace-creating launches
+ * keep today's behaviour.
+ */
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { AgentSessionRecordStore } from '../../agent-session-record-store'
+import { setStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
+import type { StructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-host'
+import type { RpcContext } from '../core'
+import {
+  CAPABLE_CLIENT,
+  STRUCTURED_PREFERENCE,
+  methodNamed,
+  rpcContext,
+  runtimeStub,
+  type AgentLaunchRuntimeStub
+} from './agent-launch.test-fixture'
+
+const createStructuredSession = vi.hoisted(() => vi.fn())
+vi.mock('./structured-agent-session-create', () => ({
+  createStructuredAgentSessionForWorktree: createStructuredSession
+}))
+
+const { AGENT_LAUNCH_METHODS } = await import('./agent-launch')
+const AGENT_LAUNCH = methodNamed(AGENT_LAUNCH_METHODS, 'agent.launch')
+const AGENT_LAUNCH_REPLAY = methodNamed(AGENT_LAUNCH_METHODS, 'agent.launchReplay')
+
+const TAB_ID = '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'
+const LEAF_ID = '3f2504e0-4f89-41d3-9a0c-0305e82c3301'
+const PANE_KEY = `${TAB_ID}:${LEAF_ID}`
+const EXISTING_LAUNCH = { agent: 'claude', target: { kind: 'existing', worktree: 'id:wt-7' } }
+const CREATE_LAUNCH = {
+  agent: 'claude',
+  target: { kind: 'create-worktree', create: { repo: 'id:repo-1', name: 'task' } }
+}
+const CALLER = 'device-1'
+
+function selectionRuntime(options: Parameters<typeof runtimeStub>[0]) {
+  return Object.assign(runtimeStub(options), {
+    selectCreatedMobileSessionTabForClient: vi.fn(() => true)
+  })
+}
+
+async function launch(
+  params: unknown,
+  runtime: AgentLaunchRuntimeStub,
+  context: Partial<RpcContext> = CAPABLE_CLIENT
+) {
+  return AGENT_LAUNCH.handler(AGENT_LAUNCH.params.parse(params), rpcContext(runtime, context))
+}
+
+function chatActivation(): unknown {
+  return createStructuredSession.mock.calls[0]?.[0]?.activate
+}
+
+beforeEach(() => {
+  createStructuredSession
+    .mockReset()
+    .mockResolvedValue({ ok: true, value: { sessionId: 'sess-1' } })
+})
+
+describe('a paired client launching into an existing workspace', () => {
+  it("selects the new terminal as that client's tab only", async () => {
+    const runtime = selectionRuntime({ settings: {}, terminalPaneKey: PANE_KEY })
+
+    await launch(EXISTING_LAUNCH, runtime)
+
+    expect(runtime.selectCreatedMobileSessionTabForClient).toHaveBeenCalledExactlyOnceWith(
+      'wt-7',
+      expect.objectContaining({ tabId: TAB_ID, leafId: LEAF_ID }),
+      CALLER
+    )
+  })
+
+  it('publishes the chat without activating it for everyone, then selects it by session for the caller', async () => {
+    const runtime = selectionRuntime({ settings: STRUCTURED_PREFERENCE })
+
+    const result = await launch(EXISTING_LAUNCH, runtime)
+
+    expect(result.outcome.kind).toBe('structured')
+    expect(chatActivation()).toBe(false)
+    expect(runtime.selectCreatedMobileSessionTabForClient).toHaveBeenCalledExactlyOnceWith(
+      'wt-7',
+      { sessionId: 'sess-1' },
+      CALLER
+    )
+  })
+
+  it('still reports the launch when selecting its tab fails', async () => {
+    const runtime = selectionRuntime({ settings: {}, terminalPaneKey: PANE_KEY })
+    runtime.selectCreatedMobileSessionTabForClient.mockImplementationOnce(() => {
+      throw new Error('selection store unavailable')
+    })
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    const result = await launch(EXISTING_LAUNCH, runtime)
+
+    expect(result.outcome).toMatchObject({ kind: 'terminal', handle: 'term_1' })
+    warn.mockRestore()
+  })
+
+  it('selects nothing when the runtime reported no pane for the terminal', async () => {
+    const runtime = selectionRuntime({ settings: {} })
+
+    await launch(EXISTING_LAUNCH, runtime)
+
+    expect(runtime.selectCreatedMobileSessionTabForClient).not.toHaveBeenCalled()
+  })
+})
+
+describe('launches that keep the host-wide behaviour', () => {
+  it('an in-process caller activates the chat and selects nothing per client', async () => {
+    const runtime = selectionRuntime({ settings: STRUCTURED_PREFERENCE })
+
+    await launch(EXISTING_LAUNCH, runtime, {})
+
+    expect(chatActivation()).toBe(true)
+    expect(runtime.selectCreatedMobileSessionTabForClient).not.toHaveBeenCalled()
+  })
+
+  it("the host's own desktop window, a runtime client with no paired device, still activates the chat", async () => {
+    const runtime = selectionRuntime({ settings: STRUCTURED_PREFERENCE })
+
+    await launch(EXISTING_LAUNCH, runtime, {
+      ...CAPABLE_CLIENT,
+      clientKind: 'runtime',
+      pairedDeviceId: undefined
+    })
+
+    expect(chatActivation()).toBe(true)
+    expect(runtime.selectCreatedMobileSessionTabForClient).not.toHaveBeenCalled()
+  })
+
+  it('a workspace-creating launch from a paired client keeps the create navigation', async () => {
+    const runtime = selectionRuntime({ settings: STRUCTURED_PREFERENCE })
+
+    await launch(CREATE_LAUNCH, runtime)
+
+    expect(chatActivation()).toBe(true)
+    expect(runtime.selectCreatedMobileSessionTabForClient).not.toHaveBeenCalled()
+  })
+})
+
+describe('a replayed launch', () => {
+  // The ledger admits against `Date.now()`, so the id must be dated now.
+  const OPERATION_ID = `${Date.now()}-000000000000000000000000000000dd`
+  let directory: string
+
+  beforeEach(async () => {
+    directory = await mkdtemp(join(tmpdir(), 'orca-agent-launch-caller-'))
+    const store = await AgentSessionRecordStore.open({ directory, hostId: 'local' })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: `deps.store` is the only member `agent.launch` reads, and a member it omits throws on call.
+    setStructuredAgentSessionHost({ deps: { store } } as unknown as StructuredAgentSessionHost)
+  })
+
+  afterEach(async () => {
+    setStructuredAgentSessionHost(null)
+    await rm(directory, { recursive: true, force: true })
+  })
+
+  it('answers from the record without moving the caller again', async () => {
+    const params = AGENT_LAUNCH_REPLAY.params.parse({
+      ...EXISTING_LAUNCH,
+      operationId: OPERATION_ID
+    })
+    const first = selectionRuntime({ settings: {}, terminalPaneKey: PANE_KEY })
+    await AGENT_LAUNCH_REPLAY.handler(params, rpcContext(first, CAPABLE_CLIENT))
+    expect(first.selectCreatedMobileSessionTabForClient).toHaveBeenCalledOnce()
+
+    const replay = selectionRuntime({ settings: {}, terminalPaneKey: PANE_KEY })
+    await AGENT_LAUNCH_REPLAY.handler(params, rpcContext(replay, CAPABLE_CLIENT))
+
+    expect(replay.createTerminal).not.toHaveBeenCalled()
+    expect(replay.selectCreatedMobileSessionTabForClient).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/runtime/rpc/methods/agent-launch-caller-selection.ts b/src/main/runtime/rpc/methods/agent-launch-caller-selection.ts
new file mode 100644
index 00000000000..b5fe4fe31f4
--- /dev/null
+++ b/src/main/runtime/rpc/methods/agent-launch-caller-selection.ts
@@ -0,0 +1,57 @@
+/**
+ * Which view a launch moves: the requesting connection's, never the host's or another client's.
+ *
+ * A paired client (a phone, or a desktop client of a remote server) that launches into an existing
+ * workspace gets the new tab as its own selection, recorded the way `session.tabs.createTerminal`
+ * selects the tab it creates for its caller. In-process callers keep today's behaviour, and a
+ * launch that creates its workspace keeps `worktree.create`'s navigation, whose host activation is
+ * what runs the new workspace's setup.
+ */
+
+import type { AgentLaunchResult, AgentLaunchTarget } from '../../../../shared/agent-launch-intent'
+import { parsePaneKey } from '../../../../shared/stable-pane-id'
+import type { OrcaRuntimeService } from '../../orca-runtime'
+import type { RpcContext } from '../core'
+
+/** The paired client whose view this launch should move, or null when it moves the host's. */
+export function agentLaunchCallerNavigationId(
+  target: AgentLaunchTarget,
+  context: Pick<RpcContext, 'clientKind' | 'pairedDeviceId'>
+): string | null {
+  if (target.kind !== 'existing' || context.clientKind === undefined) {
+    return null
+  }
+  return context.pairedDeviceId?.trim() || null
+}
+
+/** Bookkeeping, never a gate: the agent already runs, so a failure here only leaves the view as it was. */
+export function selectAgentLaunchTabForCaller(
+  runtime: Pick<OrcaRuntimeService, 'selectCreatedMobileSessionTabForClient'>,
+  result: AgentLaunchResult,
+  clientNavigationId: string
+): void {
+  const { outcome } = result
+  // Found by pane or session, never by a predicted tab id.
+  const surface =
+    outcome.kind === 'terminal'
+      ? outcome.paneKey
+        ? parsePaneKey(outcome.paneKey)
+        : null
+      : { sessionId: outcome.sessionId }
+  if (!surface) {
+    return
+  }
+  try {
+    if (
+      !runtime.selectCreatedMobileSessionTabForClient(
+        result.worktreeId,
+        surface,
+        clientNavigationId
+      )
+    ) {
+      console.warn('[agent-launch] the launch ran; its tab was not published to select')
+    }
+  } catch (error) {
+    console.warn('[agent-launch] the launch ran; selecting its tab for the caller did not', error)
+  }
+}
diff --git a/src/main/runtime/rpc/methods/agent-launch-failure-code.ts b/src/main/runtime/rpc/methods/agent-launch-failure-code.ts
new file mode 100644
index 00000000000..eac21c7c00e
--- /dev/null
+++ b/src/main/runtime/rpc/methods/agent-launch-failure-code.ts
@@ -0,0 +1,57 @@
+import type { AgentLaunchTarget } from '../../../../shared/agent-launch-intent'
+import {
+  WorktreeCreateCollisionError,
+  WORKTREE_CREATE_COLLISION_CODE
+} from '../../../../shared/new-workspace/worktree-create-collision'
+import {
+  AgentLaunchPaneAlreadyLiveError,
+  AGENT_LAUNCH_PANE_ALREADY_LIVE_CODE
+} from '../../../../shared/agent-launch-pane-already-live'
+import {
+  AgentLaunchSessionAlreadyExistsError,
+  AGENT_LAUNCH_SESSION_ALREADY_EXISTS_CODE
+} from '../../../../shared/agent-launch-session-already-exists'
+import type { TerminalSpawnDispatch } from '../../../agent-launch/agent-launch-not-started'
+
+/** Long enough for every code this path raises, with room for one a later guard adds. */
+const LAUNCH_FAILURE_CODE_MAX_LENGTH = 128
+
+/**
+ * This path raises its refusals as the thrown code, the way the method's own guards do — and the
+ * recorded code is what a replay answers with, so it is worth keeping.
+ *
+ * Bounded because a code is an identifier but `error.message` is free text: an errno sentence
+ * carrying an absolute path arrives here as one, and it would be written into a ledger file that is
+ * re-serialized whole on every subsequent operation. Bounded on the way IN only. A length check in
+ * `isAgentSessionOperationRow` would reject rows this same build wrote, and one rejected row costs
+ * the entire store.
+ */
+export function agentLaunchFailureCode(error: unknown): string {
+  const code = error instanceof Error ? error.message : ''
+  return code.length > 0 ? code.slice(0, LAUNCH_FAILURE_CODE_MAX_LENGTH) : 'agent_launch_failed'
+}
+
+/**
+ * Only a typed refusal raised before anything was created proves the claimed launch had no effects.
+ * A live reserved pane or an existing reserved session proves it only for an existing workspace; on
+ * create-worktree the workspace already exists by the time the surface is refused.
+ */
+export function launchFailureWithoutEffectsCode(
+  error: unknown,
+  targetKind: AgentLaunchTarget['kind'],
+  terminalSpawn: TerminalSpawnDispatch
+): string | null {
+  if (error instanceof WorktreeCreateCollisionError) {
+    return WORKTREE_CREATE_COLLISION_CODE
+  }
+  if (error instanceof AgentLaunchPaneAlreadyLiveError && targetKind === 'existing') {
+    return AGENT_LAUNCH_PANE_ALREADY_LIVE_CODE
+  }
+  if (error instanceof AgentLaunchSessionAlreadyExistsError && targetKind === 'existing') {
+    return AGENT_LAUNCH_SESSION_ALREADY_EXISTS_CODE
+  }
+  if (terminalSpawn.failedBeforeDispatch(error) && targetKind === 'existing') {
+    return agentLaunchFailureCode(error)
+  }
+  return null
+}
diff --git a/src/main/runtime/rpc/methods/agent-launch-floating-workspace.test.ts b/src/main/runtime/rpc/methods/agent-launch-floating-workspace.test.ts
index 5551c4de354..1df2c1f7433 100644
--- a/src/main/runtime/rpc/methods/agent-launch-floating-workspace.test.ts
+++ b/src/main/runtime/rpc/methods/agent-launch-floating-workspace.test.ts
@@ -64,7 +64,7 @@ describe('agent.launch with the real floating workspace resolver', () => {
       expect(structuredHost).not.toHaveBeenCalled()
       expect(createTerminal).toHaveBeenCalledExactlyOnceWith(
         `id:${FLOATING_TERMINAL_WORKTREE_ID}`,
-        { startupAgent: 'claude' }
+        { startupAgent: 'claude', onPtySpawnDispatched: expect.any(Function) }
       )
       expect(result).toMatchObject({
         worktreeId: FLOATING_TERMINAL_WORKTREE_ID,
diff --git a/src/main/runtime/rpc/methods/agent-launch-prestart-failure.test.ts b/src/main/runtime/rpc/methods/agent-launch-prestart-failure.test.ts
new file mode 100644
index 00000000000..6b7adb8dbfc
--- /dev/null
+++ b/src/main/runtime/rpc/methods/agent-launch-prestart-failure.test.ts
@@ -0,0 +1,171 @@
+/**
+ * A terminal launch that fails before its spawn is requested — no launch command, runtime
+ * unavailable — created nothing, so a named operation settles as failed with its real cause.
+ * Once the request has left, a failure proves nothing and the outcome stays unknown.
+ */
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { AgentSessionRecordStore } from '../../agent-session-record-store'
+import { setStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
+import type { StructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-host'
+import type { OrcaRuntimeService } from '../../orca-runtime'
+import { RpcDispatcher } from '../dispatcher'
+import { methodNamed, runtimeStub, type AgentLaunchRuntimeStub } from './agent-launch.test-fixture'
+
+vi.mock('./structured-agent-session-create', () => ({
+  createStructuredAgentSessionForWorktree: async () => ({
+    ok: true,
+    value: { sessionId: 'sess-1' }
+  })
+}))
+
+const { AGENT_LAUNCH_METHODS } = await import('./agent-launch')
+const AGENT_LAUNCH_REPLAY = methodNamed(AGENT_LAUNCH_METHODS, 'agent.launchReplay')
+
+const EXISTING_LAUNCH = { agent: 'claude', target: { kind: 'existing', worktree: 'id:wt-7' } }
+const CREATE_LAUNCH = {
+  agent: 'claude',
+  target: { kind: 'create-worktree', create: { repo: 'id:repo-1', name: 'task' } }
+}
+const NO_LAUNCH_COMMAND = 'Could not build launch command for claude.'
+type Launch = typeof EXISTING_LAUNCH | typeof CREATE_LAUNCH
+
+/** The create throws; `afterDispatch` says whether the spawn request had already left. */
+function failingCreate(runtime: AgentLaunchRuntimeStub, error: Error, afterDispatch: boolean) {
+  runtime.createTerminal.mockImplementation(
+    async (_selector: string, options?: Record<string, unknown>) => {
+      const dispatched = options?.onPtySpawnDispatched
+      if (afterDispatch && typeof dispatched === 'function') {
+        dispatched()
+      }
+      throw error
+    }
+  )
+}
+
+describe('a launch whose terminal fails', () => {
+  // The ledger admits against `Date.now()`, so the ids must be dated now.
+  const OPERATION_ID = `${Date.now()}-000000000000000000000000000000cc`
+  const OTHER_OPERATION_ID = `${Date.now()}-000000000000000000000000000000dd`
+  let directory: string
+  let store: AgentSessionRecordStore
+
+  beforeEach(async () => {
+    directory = await mkdtemp(join(tmpdir(), 'orca-agent-launch-prestart-'))
+    store = await AgentSessionRecordStore.open({ directory, hostId: 'local' })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: `deps.store` is the only member `agent.launch` reads, and a member it omits throws on call.
+    setStructuredAgentSessionHost({ deps: { store } } as unknown as StructuredAgentSessionHost)
+  })
+
+  afterEach(async () => {
+    setStructuredAgentSessionHost(null)
+    await rm(directory, { recursive: true, force: true })
+  })
+
+  function outcomeOf(operationId: string) {
+    return store.listOperationRows().find((row) => row.operationId === operationId)?.outcome
+  }
+
+  async function replay(
+    runtime: AgentLaunchRuntimeStub,
+    launch: Launch,
+    operationId: string = OPERATION_ID
+  ) {
+    const dispatcher = new RpcDispatcher({
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the fixture implements every runtime method reached by agent.launch and dispatcher metadata.
+      runtime: { ...runtime, getRuntimeId: () => 'runtime-1' } as unknown as OrcaRuntimeService,
+      methods: AGENT_LAUNCH_METHODS
+    })
+    return dispatcher.dispatch({
+      id: 'request-1',
+      authToken: 'token',
+      method: 'agent.launchReplay',
+      params: AGENT_LAUNCH_REPLAY.params.parse({ ...launch, operationId })
+    })
+  }
+
+  it('reports a failure before the spawn request with its real cause and records it', async () => {
+    const runtime = runtimeStub({ settings: {} })
+    failingCreate(runtime, new Error(NO_LAUNCH_COMMAND), false)
+
+    const response = await replay(runtime, EXISTING_LAUNCH)
+
+    expect(response).toMatchObject({ ok: false, error: { message: NO_LAUNCH_COMMAND } })
+    expect(outcomeOf(OPERATION_ID)).toMatchObject({ status: 'failed', code: NO_LAUNCH_COMMAND })
+  })
+
+  it('keeps a stable runtime code such as runtime_unavailable', async () => {
+    const runtime = runtimeStub({ settings: {} })
+    failingCreate(runtime, new Error('runtime_unavailable'), false)
+
+    const response = await replay(runtime, EXISTING_LAUNCH)
+
+    expect(response).toMatchObject({ ok: false, error: { code: 'runtime_unavailable' } })
+  })
+
+  it('answers a retry of the same operation from the record instead of launching again', async () => {
+    const first = runtimeStub({ settings: {} })
+    failingCreate(first, new Error(NO_LAUNCH_COMMAND), false)
+    await replay(first, EXISTING_LAUNCH)
+
+    const retry = runtimeStub({ settings: {} })
+    const response = await replay(retry, EXISTING_LAUNCH)
+
+    expect(retry.createTerminal).not.toHaveBeenCalled()
+    expect(response).toMatchObject({ ok: false, error: { message: NO_LAUNCH_COMMAND } })
+  })
+
+  it('stays unknown when the failure came after the spawn request left', async () => {
+    // An SSH or daemon spawn whose reply was lost may still have started an agent.
+    const runtime = runtimeStub({ settings: {} })
+    failingCreate(runtime, new Error('ssh_channel_closed'), true)
+
+    const response = await replay(runtime, EXISTING_LAUNCH)
+
+    expect(response).toMatchObject({
+      ok: false,
+      error: { code: 'agent_session_operation_unknown' }
+    })
+    expect(outcomeOf(OPERATION_ID)?.status).toBe('unknown')
+  })
+
+  it('stays unknown when another launch saw the same error before its own spawn request', async () => {
+    // A failed pane spawn rejects one error into the spawner and into a create waiting on that pane.
+    const shared = new Error('ssh_channel_closed')
+    const waiting = runtimeStub({ settings: {} })
+    failingCreate(waiting, shared, false)
+    await replay(waiting, EXISTING_LAUNCH, OTHER_OPERATION_ID)
+    expect(outcomeOf(OTHER_OPERATION_ID)?.status).toBe('failed')
+
+    const spawner = runtimeStub({ settings: {} })
+    failingCreate(spawner, shared, true)
+    const response = await replay(spawner, EXISTING_LAUNCH)
+
+    expect(response).toMatchObject({
+      ok: false,
+      error: { code: 'agent_session_operation_unknown' }
+    })
+    expect(outcomeOf(OPERATION_ID)?.status).toBe('unknown')
+  })
+
+  it('stays unknown for a launch that created its workspace first', async () => {
+    const runtime = runtimeStub({ settings: {} })
+    // No startup terminal came back, so the launch builds its own in the new workspace.
+    runtime.createManagedWorktree.mockResolvedValueOnce({
+      worktree: { id: 'wt-new' },
+      startupTerminal: undefined
+    })
+    failingCreate(runtime, new Error(NO_LAUNCH_COMMAND), false)
+
+    const response = await replay(runtime, CREATE_LAUNCH)
+
+    expect(runtime.createTerminal).toHaveBeenCalledTimes(1)
+    expect(response).toMatchObject({
+      ok: false,
+      error: { code: 'agent_session_operation_unknown' }
+    })
+  })
+})
diff --git a/src/main/runtime/rpc/methods/agent-launch-replay.test.ts b/src/main/runtime/rpc/methods/agent-launch-replay.test.ts
index 3d6981ed4a1..336cd4c212b 100644
--- a/src/main/runtime/rpc/methods/agent-launch-replay.test.ts
+++ b/src/main/runtime/rpc/methods/agent-launch-replay.test.ts
@@ -585,7 +585,8 @@ describe('the inner attach reserves under its own id', () => {
     })
     expect(forwarded).toEqual({
       decision: 'refused',
-      code: 'agent_session_operation_conflict'
+      code: 'agent_session_operation_conflict',
+      details: { reason: 'operationIdReused' }
     })
 
     const derived = deriveAgentLaunchChildOperationId(OPERATION_ID)
diff --git a/src/main/runtime/rpc/methods/agent-launch-replay.ts b/src/main/runtime/rpc/methods/agent-launch-replay.ts
index 223d4a56c9e..ec9269f4efe 100644
--- a/src/main/runtime/rpc/methods/agent-launch-replay.ts
+++ b/src/main/runtime/rpc/methods/agent-launch-replay.ts
@@ -11,8 +11,8 @@
  * resolving the caller's worktree selector, because a selector resolution is a live precondition
  * and a replay must not be able to fail on one: an operation that already ran has an answer, and
  * re-deciding it against today's world is how a recorded success becomes a fresh refusal the client
- * then retries as a second effect. `admitAgentSessionMutation` puts the ledger ahead of the lease
- * and the fence for that same reason.
+ * then retries as a second effect. `admitAgentSessionMutation` puts the ledger ahead of the writer
+ * lease for that same reason.
  */
 
 import { deriveAgentLaunchChildOperationId } from '../../../../shared/agent-launch-operation'
diff --git a/src/main/runtime/rpc/methods/agent-launch-structured-prompt.ts b/src/main/runtime/rpc/methods/agent-launch-structured-prompt.ts
index 0037d6fc35e..11762137ba2 100644
--- a/src/main/runtime/rpc/methods/agent-launch-structured-prompt.ts
+++ b/src/main/runtime/rpc/methods/agent-launch-structured-prompt.ts
@@ -63,9 +63,9 @@ export async function commitStructuredAgentSessionLaunchPrompt(args: {
     // Settlement can fail after the journal append. Re-read the authoritative row before asking
     // the caller to resend, otherwise a retry creates a duplicate turn.
     try {
-      const committed = args.host
-        .journalSnapshot(args.sessionId)
-        .submissions.find((submission) => submission.clientMessageId === clientMessageId)
+      const committed = (await args.host.journalSnapshot(args.sessionId)).submissions.find(
+        (submission) => submission.clientMessageId === clientMessageId
+      )
       if (committed) {
         return clientMessageId
       }
diff --git a/src/main/runtime/rpc/methods/agent-launch-surfaces.ts b/src/main/runtime/rpc/methods/agent-launch-surfaces.ts
index 412d947d441..3f184cd50b5 100644
--- a/src/main/runtime/rpc/methods/agent-launch-surfaces.ts
+++ b/src/main/runtime/rpc/methods/agent-launch-surfaces.ts
@@ -4,8 +4,8 @@
  * Both halves are deliberately the plain, user-facing forms: a structured session created for the
  * worktree exactly as `agentSession.create` creates one, and a terminal agent created exactly as a
  * new agent tab is. Orchestration's own factories are NOT reusable here — a worker's session
- * carries a dispatch hold, a mailbox and a background tab that a launch the user asked for must
- * not take — which is why the executor injects this rather than branching.
+ * carries a redrive subscription, a mailbox and a background tab that a launch the user asked for
+ * must not take — which is why the executor injects this rather than branching.
  *
  * Delivering the launch text is here for the same reason: it is the wire-shaped half. Each surface
  * takes it differently — a structured session commits it to a transcript, a terminal agent takes it
@@ -14,10 +14,6 @@
  */
 
 import { randomUUID } from 'node:crypto'
-import { tuiAgentToAgentKind } from '../../../../shared/agent-kind'
-import { launchSourceSchema } from '../../../../shared/telemetry-property-schemas'
-import type { TuiAgent } from '../../../../shared/tui-agent'
-import type { TerminalCreateOptions } from '../../runtime-terminal-contracts'
 import { narrowStructuredLaunchSeedOptions } from '../../../../shared/native-chat-session-option-defaults'
 import { createStructuredAgentSessionOperationId } from '../../../../shared/structured-agent-session-mutation'
 import { structuredAgentSessionTabId } from '../../../../shared/structured-agent-session-projection'
@@ -36,12 +32,19 @@ import { AgentLaunchSessionAlreadyExistsError } from '../../../../shared/agent-l
 import { createStructuredAgentSessionId } from '../../../../shared/structured-agent-session-create'
 import { toAgentLaunchPreferences } from '../../../../shared/agent-launch-preferences'
 import { paneIdentity } from '../../runtime-terminal-pane-identity'
+import {
+  trackTerminalSpawnDispatch,
+  type TerminalSpawnDispatch
+} from '../../../agent-launch/agent-launch-not-started'
 
 /** Replay-safe launches keep the nested attach in the same stable caller namespace as the launch. */
 export function agentLaunchSurfaceFactory(
   context: RpcContext,
   attachOperationId?: string,
-  operationCallerKey?: string
+  operationCallerKey?: string,
+  // False when the launch selects the chat for its paired caller instead of for everyone.
+  activateChat = true,
+  terminalSpawn: TerminalSpawnDispatch = trackTerminalSpawnDispatch()
 ): AgentLaunchSurfaceFactory {
   return {
     createStructuredSession: async ({
@@ -77,7 +80,7 @@ export function agentLaunchSurfaceFactory(
         ...(seeded ? { options: seeded } : {}),
         ...(tabId ? { tabId } : {}),
         // The user asked for this chat, so it takes the surface — unlike a dispatched worker.
-        activate: true
+        activate: activateChat
       })
       if (!created.ok) {
         // The caller named this session, so a taken id is its answer, not an opaque refusal; and not
@@ -118,7 +121,7 @@ export function agentLaunchSurfaceFactory(
       options
     }) => {
       const launchPreferences = toAgentLaunchPreferences(options)
-      const terminal = await context.runtime.createTerminal(`id:${worktreeId}`, {
+      const created = context.runtime.createTerminal(`id:${worktreeId}`, {
         // The agent id is not a shell command — `cursor` is the desktop app, its CLI is
         // `cursor-agent` — so the runtime builds the configured launcher.
         startupAgent: agent,
@@ -131,8 +134,10 @@ export function agentLaunchSurfaceFactory(
         ...(launchPreferences ? { launchPreferences } : {}),
         // A live reserved pane would be attached, not launched into, so the runtime refuses it.
         ...(paneKey ? { ...paneIdentity(paneKey), requireFreshPane: true } : {}),
-        ...agentLaunchTelemetry(agent, launchSource)
+        ...(launchSource ? { launchSource } : {}),
+        onPtySpawnDispatched: terminalSpawn.onPtySpawnDispatched
       })
+      const terminal = await created.catch(terminalSpawn.rethrow)
       return {
         handle: terminal.handle,
         // The runtime already minted this pane and baked it into the PTY's env and its own reveal;
@@ -150,34 +155,6 @@ export function agentLaunchSurfaceFactory(
   }
 }
 
-/**
- * The `agent_started` triple, of which only `launch_source` came from the caller.
- *
- * `agent_kind` and `request_kind` are derived rather than accepted — the host already knows both,
- * and a value it derives is a value a caller cannot misreport. `request_kind` is always `new`
- * because a launch reusing a terminal returns before any surface is created.
- *
- * An unrecognized `launch_source` drops the telemetry and starts the agent anyway. The wire keeps
- * the arm set open so an older host cannot refuse a newer client's launch over a label, which is
- * only honoured if the refusal does not reappear here: attribution is bookkeeping, and bookkeeping
- * must not gate the user's launch.
- */
-function agentLaunchTelemetry(
-  agent: TuiAgent,
-  launchSource: string | undefined
-): Pick<TerminalCreateOptions, 'telemetry'> {
-  const parsed = launchSourceSchema.safeParse(launchSource)
-  return parsed.success
-    ? {
-        telemetry: {
-          agent_kind: tuiAgentToAgentKind(agent),
-          launch_source: parsed.data,
-          request_kind: 'new'
-        }
-      }
-    : {}
-}
-
 function requireInstalledHost(): StructuredAgentSessionHost {
   const host = getStructuredAgentSessionHost()
   if (!host) {
diff --git a/src/main/runtime/rpc/methods/agent-launch-terminal-prompt.ts b/src/main/runtime/rpc/methods/agent-launch-terminal-prompt.ts
index 41081daeb99..ac66912e747 100644
--- a/src/main/runtime/rpc/methods/agent-launch-terminal-prompt.ts
+++ b/src/main/runtime/rpc/methods/agent-launch-terminal-prompt.ts
@@ -66,6 +66,7 @@ export async function deliverTerminalAgentLaunchPrompt(args: {
       return false
     }
     const sent = await args.runtime.sendTerminalAgentPrompt(args.handle, args.text, {
+      inputKind: 'launch',
       // Paired: together these take the queued path, which settles an unobserved turn start into
       // an `input_accepted` receipt rather than raising it. Without the id the write is verified
       // strictly and a slow first turn throws.
diff --git a/src/main/runtime/rpc/methods/agent-launch.test.ts b/src/main/runtime/rpc/methods/agent-launch.test.ts
index f44ddb4978b..75045cf74c4 100644
--- a/src/main/runtime/rpc/methods/agent-launch.test.ts
+++ b/src/main/runtime/rpc/methods/agent-launch.test.ts
@@ -331,6 +331,23 @@ describe('the worktree factory', () => {
     })
   })
 
+  it("attributes a create by the launch's own source, never a copy inside the create payload", async () => {
+    const createWithSource = {
+      ...CREATE_LAUNCH,
+      target: {
+        kind: 'create-worktree',
+        create: { ...CREATE_LAUNCH.target.create, launchSource: 'cli' }
+      }
+    }
+    const named = runtimeStub({ settings: {} })
+    await launch({ ...createWithSource, launchSource: 'onboarding' }, named)
+    expect(createArgs(named)).toMatchObject({ startupLaunchSource: 'onboarding' })
+
+    const unnamed = runtimeStub({ settings: {} })
+    await launch(createWithSource, unnamed)
+    expect(createArgs(unnamed)).not.toHaveProperty('startupLaunchSource')
+  })
+
   it('preserves an explicit no-arguments value for an agent-first worktree create', async () => {
     const runtime = runtimeStub({ settings: {} })
     await launch({ ...CREATE_LAUNCH, agentArgs: null }, runtime)
@@ -461,7 +478,10 @@ describe('the terminal factory', () => {
     const runtime = runtimeStub({ createSupport: { supported: false, reason: 'wsl' } })
     const result = await launch(CREATE_LAUNCH, runtime)
 
-    expect(runtime.createTerminal).toHaveBeenCalledWith('id:wt-new', { startupAgent: 'claude' })
+    expect(runtime.createTerminal).toHaveBeenCalledWith('id:wt-new', {
+      startupAgent: 'claude',
+      onPtySpawnDispatched: expect.any(Function)
+    })
     expect(createStructuredSession).not.toHaveBeenCalled()
     expect(result.outcome).toEqual({ kind: 'terminal', handle: 'term_1' })
     // Never a failed launch, and never a silent downgrade.
@@ -481,7 +501,10 @@ describe('the terminal factory', () => {
     expect(runtime.showManagedTerminalWorkspace).not.toHaveBeenCalled()
     // Resolved to an id first: everything below re-prefixes it, so a raw selector reaches the
     // runtime as `id:id:wt-7`.
-    expect(runtime.createTerminal).toHaveBeenCalledWith('id:wt-7', { startupAgent: 'grok' })
+    expect(runtime.createTerminal).toHaveBeenCalledWith('id:wt-7', {
+      startupAgent: 'grok',
+      onPtySpawnDispatched: expect.any(Function)
+    })
     expect(result.worktreeId).toBe('wt-7')
   })
 })
@@ -548,15 +571,14 @@ describe('launch inputs that cross the wire', () => {
     })
   })
 
-  it('derives agent_kind and request_kind, taking only launch_source from the caller', async () => {
+  it("hands the caller's launch_source to the runtime, which attributes the launch", async () => {
     const runtime = runtimeStub({ settings: {} })
     await launch({ ...EXISTING_LAUNCH, launchSource: 'source_control_recovery' }, runtime)
 
-    expect(terminalOptions(runtime).telemetry).toEqual({
-      agent_kind: 'claude-code',
-      launch_source: 'source_control_recovery',
-      request_kind: 'new'
-    })
+    // The runtime derives agent_kind and request_kind from the agent it builds, so the handler
+    // forwards only the one member it cannot know, and never a prebuilt triple.
+    expect(terminalOptions(runtime)).toMatchObject({ launchSource: 'source_control_recovery' })
+    expect(terminalOptions(runtime)).not.toHaveProperty('telemetry')
   })
 
   it('starts the agent anyway when launch_source is one this build has never heard of', async () => {
@@ -567,16 +589,16 @@ describe('launch inputs that cross the wire', () => {
     )
 
     // The whole point of the open arm set: attribution is bookkeeping, and bookkeeping must never
-    // gate a user action. The row is dropped; the launch is not.
+    // gate a user action. The runtime records it as `unknown`; the launch still starts.
     expect(result.outcome).toEqual({ kind: 'terminal', handle: 'term_1' })
-    expect(terminalOptions(runtime)).not.toHaveProperty('telemetry')
+    expect(terminalOptions(runtime)).toMatchObject({ launchSource: 'a_surface_added_later' })
   })
 
-  it('sends no telemetry at all when the caller named no launch source', async () => {
+  it('names no launch source when the caller named none', async () => {
     const runtime = runtimeStub({ settings: {} })
     await launch(EXISTING_LAUNCH, runtime)
 
-    expect(terminalOptions(runtime)).not.toHaveProperty('telemetry')
+    expect(terminalOptions(runtime)).not.toHaveProperty('launchSource')
   })
 
   it('keeps a structured preference when the cwd names the workspace root', async () => {
diff --git a/src/main/runtime/rpc/methods/agent-launch.ts b/src/main/runtime/rpc/methods/agent-launch.ts
index eee9f2a48c1..1c7448e5ca2 100644
--- a/src/main/runtime/rpc/methods/agent-launch.ts
+++ b/src/main/runtime/rpc/methods/agent-launch.ts
@@ -31,20 +31,24 @@ import {
   WorktreeCreateCollisionError,
   WORKTREE_CREATE_COLLISION_CODE
 } from '../../../../shared/new-workspace/worktree-create-collision'
-import {
-  AgentLaunchPaneAlreadyLiveError,
-  AGENT_LAUNCH_PANE_ALREADY_LIVE_CODE
-} from '../../../../shared/agent-launch-pane-already-live'
-import {
-  AgentLaunchSessionAlreadyExistsError,
-  AGENT_LAUNCH_SESSION_ALREADY_EXISTS_CODE
-} from '../../../../shared/agent-launch-session-already-exists'
 import { executeAgentLaunch } from '../../../agent-launch/agent-launch-executor'
+import {
+  trackTerminalSpawnDispatch,
+  type TerminalSpawnDispatch
+} from '../../../agent-launch/agent-launch-not-started'
 import type { OrcaRuntimeService } from '../../orca-runtime'
 import { defineMethod, type RpcContext } from '../core'
 import { admitAgentLaunchOperation, agentLaunchOperationCallerKey } from './agent-launch-replay'
 import { AgentLaunch, AgentLaunchReplay, type AgentLaunchParams } from './agent-launch-schemas'
 import { agentLaunchSurfaceFactory } from './agent-launch-surfaces'
+import {
+  agentLaunchFailureCode,
+  launchFailureWithoutEffectsCode
+} from './agent-launch-failure-code'
+import {
+  agentLaunchCallerNavigationId,
+  selectAgentLaunchTabForCaller
+} from './agent-launch-caller-selection'
 import { agentLaunchWorkspaceFactory } from './agent-launch-worktree-creation'
 
 /**
@@ -138,18 +142,30 @@ async function resolveUnlaunchedIntent(
   return intent
 }
 
-function runAgentLaunch(
+async function runAgentLaunch(
   intent: AgentLaunchIntent,
   context: RpcContext,
   attachOperationId?: string,
-  operationCallerKey?: string
+  operationCallerKey?: string,
+  terminalSpawn?: TerminalSpawnDispatch
 ): Promise<AgentLaunchResult> {
-  return executeAgentLaunch({
+  const callerNavigationId = agentLaunchCallerNavigationId(intent.target, context)
+  const result = await executeAgentLaunch({
     runtime: context.runtime,
     intent,
-    surfaces: agentLaunchSurfaceFactory(context, attachOperationId, operationCallerKey),
+    surfaces: agentLaunchSurfaceFactory(
+      context,
+      attachOperationId,
+      operationCallerKey,
+      callerNavigationId === null,
+      terminalSpawn
+    ),
     workspaces: agentLaunchWorkspaceFactory(context, intent.agent)
   })
+  if (callerNavigationId !== null) {
+    selectAgentLaunchTabForCaller(context.runtime, result, callerNavigationId)
+  }
+  return result
 }
 
 /**
@@ -184,52 +200,17 @@ function settleQuietly(settlement: Promise<void>): Promise<void> {
   })
 }
 
-/** Long enough for every code this path raises, with room for one a later guard adds. */
-const LAUNCH_FAILURE_CODE_MAX_LENGTH = 128
-
-/**
- * This path raises its refusals as the thrown code, the way the method's own guards do — and the
- * recorded code is what a replay answers with, so it is worth keeping.
- *
- * Bounded because a code is an identifier but `error.message` is free text: an errno sentence
- * carrying an absolute path arrives here as one, and it would be written into a ledger file that is
- * re-serialized whole on every subsequent operation. Bounded on the way IN only. A length check in
- * `isAgentSessionOperationRow` would reject rows this same build wrote, and one rejected row costs
- * the entire store.
- */
-function agentLaunchFailureCode(error: unknown): string {
-  const code = error instanceof Error ? error.message : ''
-  return code.length > 0 ? code.slice(0, LAUNCH_FAILURE_CODE_MAX_LENGTH) : 'agent_launch_failed'
-}
-
-/**
- * Only a typed refusal raised before anything was created proves the claimed launch had no effects.
- * A live reserved pane or an existing reserved session proves it only for an existing workspace; on
- * create-worktree the workspace already exists by the time the surface is refused.
- */
-function launchFailureWithoutEffectsCode(
-  error: unknown,
-  targetKind: AgentLaunchTarget['kind']
-): string | null {
-  if (error instanceof WorktreeCreateCollisionError) {
-    return WORKTREE_CREATE_COLLISION_CODE
-  }
-  if (error instanceof AgentLaunchPaneAlreadyLiveError && targetKind === 'existing') {
-    return AGENT_LAUNCH_PANE_ALREADY_LIVE_CODE
-  }
-  if (error instanceof AgentLaunchSessionAlreadyExistsError && targetKind === 'existing') {
-    return AGENT_LAUNCH_SESSION_ALREADY_EXISTS_CODE
-  }
-  return null
-}
-
 type ActiveAgentLaunch = {
   fingerprint: string
   promise: Promise<AgentLaunchResult>
 }
 
 class AgentLaunchExecutionError extends Error {
-  constructor(cause: unknown) {
+  constructor(
+    cause: unknown,
+    /** Decided once, by the launch that ran; a later reader cannot re-derive it from the error. */
+    readonly failedWithoutEffects: boolean
+  ) {
     super('agent_session_operation_unknown', { cause })
   }
 }
@@ -268,15 +249,26 @@ async function executeReplaySafeAgentLaunch(
     await settleQuietly(admission.fail(agentLaunchFailureCode(error)))
     throw error
   }
+  const terminalSpawn = trackTerminalSpawnDispatch()
   let result: AgentLaunchResult
   try {
-    result = await runAgentLaunch(intent, context, admission.attachOperationId, admission.callerKey)
+    result = await runAgentLaunch(
+      intent,
+      context,
+      admission.attachOperationId,
+      admission.callerKey,
+      terminalSpawn
+    )
   } catch (error) {
-    const failedWithoutEffects = launchFailureWithoutEffectsCode(error, intent.target.kind)
+    const failedWithoutEffects = launchFailureWithoutEffectsCode(
+      error,
+      intent.target.kind,
+      terminalSpawn
+    )
     if (failedWithoutEffects) {
       await settleQuietly(admission.fail(failedWithoutEffects))
     }
-    throw new AgentLaunchExecutionError(error)
+    throw new AgentLaunchExecutionError(error, failedWithoutEffects !== null)
   }
   // Settlement is bookkeeping; failure leaves the truthful `unknown` refusal for later retries.
   await settleQuietly(admission.settle(result))
@@ -327,7 +319,7 @@ export const AGENT_LAUNCH_METHODS = [
               code: WORKTREE_CREATE_COLLISION_CODE
             })
           }
-          if (launchFailureWithoutEffectsCode(error.cause, params.target.kind)) {
+          if (error.failedWithoutEffects) {
             throw error.cause
           }
           throw new Error('agent_session_operation_unknown', { cause: error.cause })
diff --git a/src/main/runtime/rpc/methods/native-chat-subscription-token.test.ts b/src/main/runtime/rpc/methods/native-chat-subscription-token.test.ts
new file mode 100644
index 00000000000..e6b3aae471e
--- /dev/null
+++ b/src/main/runtime/rpc/methods/native-chat-subscription-token.test.ts
@@ -0,0 +1,79 @@
+import { describe, expect, it, vi } from 'vitest'
+import { RuntimeSubscriptionRegistry } from '../../runtime-subscription-registry'
+import type { RpcContext } from '../core'
+
+vi.mock('../../../native-chat/transcript-watch', () => ({
+  readNativeChatTranscriptTail: vi.fn(),
+  subscribeNativeChatTranscript: () => Promise.resolve({ unsubscribe: () => {}, watching: true })
+}))
+
+import { NATIVE_CHAT_METHODS } from './native-chat'
+
+type Handler = (
+  params: unknown,
+  ctx: RpcContext,
+  emit: (value: unknown) => void
+) => Promise<unknown>
+
+function handler(name: string): Handler {
+  const method = NATIVE_CHAT_METHODS.find((candidate) => candidate.name === name)
+  if (!method) {
+    throw new Error(`${name} not registered`)
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: both methods take (params, ctx[, emit]); the test only calls them with that shape.
+  return method.handler as Handler
+}
+
+/** One phone connection on a runtime whose subscriptions live in the real registry. */
+function phoneConnection(): {
+  subscribe: (subscriptionId: string) => Promise<unknown[]>
+  unsubscribe: (subscriptionId: string) => Promise<void>
+} {
+  const registry = new RuntimeSubscriptionRegistry()
+  const context: RpcContext = {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the handlers under test only touch these three registry-backed members.
+    runtime: {
+      registerSubscriptionCleanup: registry.register.bind(registry),
+      cleanupSubscription: registry.cleanup.bind(registry),
+      cleanupSubscriptionsByPrefix: registry.cleanupByPrefix.bind(registry)
+    } as unknown as RpcContext['runtime'],
+    connectionId: 'phone-connection',
+    clientKind: 'mobile'
+  }
+  return {
+    subscribe: async (subscriptionId) => {
+      const emitted: unknown[] = []
+      await handler('nativeChat.subscribe')(
+        { agent: 'claude', sessionId: 'session', subscriptionId },
+        context,
+        (value) => emitted.push(value)
+      )
+      return emitted
+    },
+    unsubscribe: async (subscriptionId) => {
+      await handler('nativeChat.unsubscribe')({ subscriptionId }, context, () => {})
+    }
+  }
+}
+
+describe('nativeChat subscription tokens on one connection', () => {
+  it('keeps two feeds of the same chat apart when each has its own token', async () => {
+    const phone = phoneConnection()
+    const under = await phone.subscribe('claude:session:under')
+    const top = await phone.subscribe('claude:session:top')
+    expect(under).toEqual([])
+    expect(top).toEqual([])
+
+    await phone.unsubscribe('claude:session:top')
+    expect(top).toEqual([{ type: 'end' }])
+    expect(under).toEqual([])
+  })
+
+  it('ends the older feed when a second one reuses its token', async () => {
+    const phone = phoneConnection()
+    const older = await phone.subscribe('claude:session')
+    const newer = await phone.subscribe('claude:session')
+    expect(older).toEqual([{ type: 'end' }])
+    expect(newer).toEqual([])
+  })
+})
diff --git a/src/main/runtime/rpc/methods/orchestration-caller-workspace.ts b/src/main/runtime/rpc/methods/orchestration-caller-workspace.ts
index 556938eef23..a3bbe7f01a3 100644
--- a/src/main/runtime/rpc/methods/orchestration-caller-workspace.ts
+++ b/src/main/runtime/rpc/methods/orchestration-caller-workspace.ts
@@ -14,12 +14,18 @@
  */
 
 import type { OrcaRuntimeService } from '../../orca-runtime'
+import type { OrchestrationSessionCaller } from '../../orchestration/orchestration-caller-identity'
 import { isStructuredWorkerHandle } from '../../structured-worker-identity'
 
 export async function resolveDispatchCallerWorktreeId(
   runtime: Pick<OrcaRuntimeService, 'showTerminal' | 'getOrchestrationDispatchAuthority'>,
-  callerHandle: string
+  callerHandle: string,
+  callerSession: OrchestrationSessionCaller | undefined
 ): Promise<string> {
+  // A session caller's workspace is on its record, whichever owner (chat or terminal) holds it.
+  if (callerSession) {
+    return callerSession.workspaceId
+  }
   if (isStructuredWorkerHandle(callerHandle)) {
     const worktreeId = runtime.getOrchestrationDispatchAuthority?.(callerHandle)?.worktreeId ?? null
     if (worktreeId) {
diff --git a/src/main/runtime/rpc/methods/orchestration-structured-worker-abandon.test.ts b/src/main/runtime/rpc/methods/orchestration-structured-worker-abandon.test.ts
index 983bd20ad95..cf607524674 100644
--- a/src/main/runtime/rpc/methods/orchestration-structured-worker-abandon.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-structured-worker-abandon.test.ts
@@ -7,13 +7,12 @@ const released: string[] = []
 vi.mock('./orchestration-structured-worker-session', () => ({
   releaseStructuredWorkerSession: (dispatchId: string) => released.push(dispatchId),
   createStructuredWorkerSession: vi.fn(),
-  sendStructuredWorkerPreamble: vi.fn(),
-  structuredWorkerHoldId: (dispatchId: string) => `orchestration:dispatch:${dispatchId}`
+  sendStructuredWorkerPreamble: vi.fn()
 }))
 
 const harness = createOrchestrationRpcHarness()
 
-describe('workerAbandon settles the structured hold', () => {
+describe('workerAbandon settles the structured worker session', () => {
   let state: OrchestrationRpcState
 
   beforeEach(() => {
@@ -37,10 +36,10 @@ describe('workerAbandon settles the structured hold', () => {
     return started.dispatch.id
   }
 
-  it('releases the hold when the dispatch actually settles', async () => {
+  it('releases the worker session when the dispatch actually settles', async () => {
     const dispatchId = await startedDispatch()
-    // Without this, the resume-capable hold outlives settlement: the provider child can never be
-    // evicted and host crash recovery keeps respawning an abandoned worker.
+    // Without this, the redrive subscription outlives settlement and keeps nudging a session no
+    // dispatch owns.
     await harness.call('orchestration.workerAbandon', { dispatch: dispatchId }, state.ctx)
     expect(released).toEqual([dispatchId])
   })
diff --git a/src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.test.ts b/src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.test.ts
index a0d0426509b..b669233c31f 100644
--- a/src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.test.ts
@@ -47,6 +47,7 @@ function installHost(options: {
   close?: () => Promise<void>
   setSessionTabVisibility?: () => Promise<void>
   historyThrows?: boolean
+  tabListed?: boolean
 }) {
   const record =
     options.record === undefined
@@ -63,6 +64,10 @@ function installHost(options: {
   let closed = false
   hostRef.current = {
     deps: { store: { getRecord: () => record } },
+    getPersistedVisibleSessionTabIndex: () => ({
+      present: true,
+      sessionIds: options.tabListed ? [IDENTITY.sessionId] : []
+    }),
     hasSession: () => (closed ? false : (options.hasSession ?? true)),
     setSessionTabVisibility: options.setSessionTabVisibility ?? (async () => {}),
     close:
@@ -84,7 +89,7 @@ describe('structured worker observation', () => {
     hostRef.current = null
   })
 
-  it('is unverifiable, never exited, when the host is not installed', () => {
+  it('is unverifiable, never exited, when the host is not installed', async () => {
     // Not being able to look is not a death certificate.
     expect(observeStructuredWorker(IDENTITY)).toEqual({
       status: 'unverifiable',
@@ -92,12 +97,12 @@ describe('structured worker observation', () => {
     })
   })
 
-  it('is live when the host holds the session under a live native lease', () => {
+  it('is live when the host holds the session under a live native lease', async () => {
     installHost({})
     expect(observeStructuredWorker(IDENTITY).status).toBe('live')
   })
 
-  it('is exited only on a released lease with death evidence', () => {
+  it('is exited only on a released lease with death evidence', async () => {
     installHost({
       claimStatus: 'released',
       deathEvidence: { kind: 'exit-observed', detail: 'x', observedAt: 1 }
@@ -105,7 +110,7 @@ describe('structured worker observation', () => {
     expect(observeStructuredWorker(IDENTITY).status).toBe('exited')
   })
 
-  it('is unverifiable when a terminal an older build recorded holds the lease', () => {
+  it('is unverifiable when a terminal an older build recorded holds the lease', async () => {
     installHost({ claimStatus: 'conflicted' })
     expect(observeStructuredWorker(IDENTITY).status).toBe('unverifiable')
   })
@@ -127,22 +132,30 @@ describe('structured worker stop', () => {
     })
   })
 
-  it.each([
-    { hasSession: false },
-    { claimStatus: 'conflicted' },
-    { claimStatus: 'released' },
-    { record: null }
-  ])('retains without positive exit evidence: %j', async (options) => {
-    installHost({ ...options, close: async () => {} })
-    const retireStructuredAgentSessionTabFromSnapshot = vi.fn()
-    const result = await stopStructuredWorker(IDENTITY, 'd1', {
-      forgetStructuredSessionMail: vi.fn(),
-      retireStructuredAgentSessionTabFromSnapshot
+  it('settles a released lease whose stop was unproven: nothing is left running to close', async () => {
+    // A release that could not prove its stop sent no signal and left the verdict `unverifiable`;
+    // closing the chat is the user's action, so that bookkeeping does not refuse it.
+    installHost({ claimStatus: 'released', close: async () => {} })
+    await expect(stopStructuredWorker(IDENTITY, 'd1')).resolves.toEqual({
+      stopped: true,
+      closeAttempted: true
     })
-    expect(result).toMatchObject({ stopped: false, closeAttempted: true })
-    expect(retireStructuredAgentSessionTabFromSnapshot).not.toHaveBeenCalled()
   })
 
+  it.each([{ hasSession: false }, { claimStatus: 'conflicted' }, { record: null }])(
+    'retains without positive exit evidence: %j',
+    async (options) => {
+      installHost({ ...options, close: async () => {} })
+      const retireStructuredAgentSessionTabFromSnapshot = vi.fn()
+      const result = await stopStructuredWorker(IDENTITY, 'd1', {
+        forgetStructuredSessionMail: vi.fn(),
+        retireStructuredAgentSessionTabFromSnapshot
+      })
+      expect(result).toMatchObject({ stopped: false, closeAttempted: true })
+      expect(retireStructuredAgentSessionTabFromSnapshot).not.toHaveBeenCalled()
+    }
+  )
+
   it('retains when the close throws, and admits the close was issued', async () => {
     installHost({
       close: async () => {
@@ -191,9 +204,9 @@ describe('structured worker output', () => {
     hostRef.current = null
   })
 
-  it('round-trips the journal through the archive and back out of a released read', () => {
+  it('round-trips the journal through the archive and back out of a released read', async () => {
     installHost({})
-    const live = readStructuredWorkerJournal({
+    const live = await readStructuredWorkerJournal({
       identity: IDENTITY,
       dispatchId: 'd1',
       workerState: 'ready',
@@ -201,7 +214,7 @@ describe('structured worker output', () => {
       agent: 'claude'
     })
     expect(live.source).toBe('transcript')
-    const archive = captureStructuredWorkerArchive(IDENTITY, 'claude')
+    const archive = await captureStructuredWorkerArchive(IDENTITY, 'claude')
     hostRef.current = null
     const archived = readArchivedStructuredJournal({
       dispatchId: 'd1',
@@ -219,7 +232,7 @@ describe('structured worker output', () => {
     expect(archived.sourceIdentity).not.toBe(live.sourceIdentity)
   })
 
-  it('redacts dispatch capabilities from the archived journal', () => {
+  it('redacts dispatch capabilities from the archived journal', async () => {
     installHost({
       items: [
         {
@@ -233,13 +246,13 @@ describe('structured worker output', () => {
         } as unknown as AgentJournalRenderItem
       ]
     })
-    const archive = captureStructuredWorkerArchive(IDENTITY, 'claude')
+    const archive = await captureStructuredWorkerArchive(IDENTITY, 'claude')
     expect(JSON.stringify(archive)).not.toContain('dcap_aaa')
     expect(JSON.stringify(archive)).toContain('[dispatch capability redacted]')
   })
 
-  it('refuses to read a session the host no longer holds', () => {
-    expect(() =>
+  it('refuses to read a session the host no longer holds', async () => {
+    await expect(
       readStructuredWorkerJournal({
         identity: IDENTITY,
         dispatchId: 'd1',
@@ -247,15 +260,15 @@ describe('structured worker output', () => {
         liveness: 'live',
         agent: 'claude'
       })
-    ).toThrow(/not attached/)
+    ).rejects.toThrow(/not attached/)
   })
 
-  it('reports an unverifiable worker as unknown, never as running', () => {
+  it('reports an unverifiable worker as unknown, never as running', async () => {
     // The `could not look, therefore it is alive` inversion. After a restart the runtime observes
     // `unverifiable` — no attached provider child in this generation — while the journal is still
     // readable, and a coordinator reading `running` waits on a worker that may already be gone.
     installHost({})
-    const read = readStructuredWorkerJournal({
+    const read = await readStructuredWorkerJournal({
       identity: IDENTITY,
       dispatchId: 'd1',
       workerState: 'ready',
@@ -266,9 +279,9 @@ describe('structured worker output', () => {
     expect(read.status.liveness).toBe('unverifiable')
   })
 
-  it('carries each proven verdict through unchanged', () => {
+  it('carries each proven verdict through unchanged', async () => {
     installHost({})
-    const live = readStructuredWorkerJournal({
+    const live = await readStructuredWorkerJournal({
       identity: IDENTITY,
       dispatchId: 'd1',
       workerState: 'ready',
@@ -276,7 +289,7 @@ describe('structured worker output', () => {
       agent: 'claude'
     })
     expect(live.status).toMatchObject({ terminal: 'running', liveness: 'live' })
-    const exited = readStructuredWorkerJournal({
+    const exited = await readStructuredWorkerJournal({
       identity: IDENTITY,
       dispatchId: 'd1',
       workerState: 'succeeded',
@@ -286,9 +299,9 @@ describe('structured worker output', () => {
     expect(exited.status).toMatchObject({ terminal: 'exited', liveness: 'exited' })
   })
 
-  it('states that a settled release is exited', () => {
+  it('states that a settled release is exited', async () => {
     installHost({})
-    const archive = captureStructuredWorkerArchive(IDENTITY, 'claude')
+    const archive = await captureStructuredWorkerArchive(IDENTITY, 'claude')
     const archived = readArchivedStructuredJournal({
       dispatchId: 'd1',
       workerState: 'succeeded',
@@ -300,12 +313,12 @@ describe('structured worker output', () => {
     expect(archived.status).toMatchObject({ terminal: 'exited', liveness: 'exited' })
   })
 
-  it('never calls an unproven release exited', () => {
+  it('never calls an unproven release exited', async () => {
     // The archive is frozen BEFORE the close. `release_unknown` is the state that records a close
     // that did NOT land, and a coordinator reading `exited` there starts a replacement worker over
     // the same worktree while the original provider child may still be attached.
     installHost({})
-    const archive = captureStructuredWorkerArchive(IDENTITY, 'claude')
+    const archive = await captureStructuredWorkerArchive(IDENTITY, 'claude')
     for (const releaseState of ['unknown', 'releasing'] as const) {
       const archived = readArchivedStructuredJournal({
         dispatchId: 'd1',
@@ -324,7 +337,7 @@ describe('structured worker output', () => {
     // `readArchivedWorkerOutput`, and the resource row it already holds is the only thing that
     // knows whether the close landed.
     installHost({})
-    const archive = captureStructuredWorkerArchive(IDENTITY, 'claude')
+    const archive = await captureStructuredWorkerArchive(IDENTITY, 'claude')
     const db = {
       getWorkerTerminalArchive: () => ({
         dispatch_id: 'd1',
@@ -355,12 +368,12 @@ describe('structured worker output', () => {
     })
   })
 
-  it('refuses a cursor once the tail window has slid past it', () => {
+  it('refuses a cursor once the tail window has slid past it', async () => {
     // The cursor is an index into the bounded tail, and `sourceIdentity` was constant for the
     // worker's life, so a coordinator paging a growing journal resumed at the newest items and
     // skipped the middle without a word.
     installHost({ items: ITEMS })
-    const first = readStructuredWorkerJournal({
+    const first = await readStructuredWorkerJournal({
       identity: IDENTITY,
       dispatchId: 'd1',
       workerState: 'ready',
@@ -376,7 +389,7 @@ describe('structured worker output', () => {
         } as unknown as AgentJournalRenderItem
       ]
     })
-    expect(() =>
+    await expect(
       readStructuredWorkerJournal({
         identity: IDENTITY,
         dispatchId: 'd1',
@@ -385,7 +398,7 @@ describe('structured worker output', () => {
         agent: 'claude',
         cursor: first.cursor
       })
-    ).toThrow(/source changed/i)
+    ).rejects.toThrow(/source changed/i)
   })
 })
 
@@ -394,7 +407,7 @@ describe('archiving a structured worker whose journal cannot be read', () => {
     hostRef.current = null
   })
 
-  it('settles with an empty, warned archive once the session is PROVEN gone', () => {
+  it('settles with an empty, warned archive once the session is PROVEN gone', async () => {
     // Closing the worker's chat tab is a routine user action: it evicts the child and detaches the
     // journal permanently. Throwing archive_failed there wedged release on evidence that could
     // never arrive, leaving worker-abandon as the only way out.
@@ -403,7 +416,7 @@ describe('archiving a structured worker whose journal cannot be read', () => {
       claimStatus: 'released',
       deathEvidence: { kind: 'exit-observed', detail: 'surface released', observedAt: 1 }
     })
-    const archive = captureStructuredWorkerArchive(IDENTITY, 'claude')
+    const archive = await captureStructuredWorkerArchive(IDENTITY, 'claude')
     expect(archive.messages).toEqual([])
     expect(archive.processIncarnation).toBe(IDENTITY.processIncarnation)
     expect(archive.warnings).toContain(
@@ -411,12 +424,24 @@ describe('archiving a structured worker whose journal cannot be read', () => {
     )
   })
 
-  it('still retains when the journal is unreadable but nothing proves the child is gone', () => {
-    installHost({ historyThrows: true })
-    expect(() => captureStructuredWorkerArchive(IDENTITY, 'claude')).toThrow(/retained/)
+  it('retains a worker at rest: released, but its chat tab still lists it', async () => {
+    // Released is not retired now — the idle sweep releases a quiet worker's lease — so an owned
+    // worker whose journal cannot be read keeps its evidence for a later archive.
+    installHost({
+      historyThrows: true,
+      claimStatus: 'released',
+      deathEvidence: { kind: 'exit-observed', detail: 'idle stop', observedAt: 1 },
+      tabListed: true
+    })
+    await expect(captureStructuredWorkerArchive(IDENTITY, 'claude')).rejects.toThrow(/retained/)
   })
 
-  it('still retains when there is no host to look with', () => {
-    expect(() => captureStructuredWorkerArchive(IDENTITY, 'claude')).toThrow(/retained/)
+  it('still retains when the journal is unreadable but nothing proves the child is gone', async () => {
+    installHost({ historyThrows: true })
+    await expect(captureStructuredWorkerArchive(IDENTITY, 'claude')).rejects.toThrow(/retained/)
+  })
+
+  it('still retains when there is no host to look with', async () => {
+    await expect(captureStructuredWorkerArchive(IDENTITY, 'claude')).rejects.toThrow(/retained/)
   })
 })
diff --git a/src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.ts b/src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.ts
index 13d3ce1dbce..bec15537c49 100644
--- a/src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.ts
+++ b/src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.ts
@@ -40,12 +40,13 @@ import {
   structuredWorkerTerminalState,
   type StructuredWorkerObservation
 } from '../../structured-worker-authority'
+import { structuredWorkerOwned } from '../../structured-worker-custody'
 import type { StructuredWorkerIdentity } from '../../structured-worker-identity'
 import type { WorkerTerminalReleaseState } from '../../orchestration/worker-terminal-ownership'
 import { releaseStructuredWorkerSession } from './orchestration-structured-worker-session'
 import { closeStructuredAgentSessionChild } from '../../structured-agent-session-close'
 
-export { observeStructuredWorker, type StructuredWorkerObservation }
+export { observeStructuredWorker, structuredWorkerOwned, type StructuredWorkerObservation }
 
 /** The structured worker behind a dispatch, or null when a PTY worker owns it. */
 export function resolveStructuredWorkerForDispatch(
@@ -83,13 +84,13 @@ export async function stopStructuredWorker(
   return closeStructuredAgentSessionChild(identity.sessionId, {
     ...(runtime ? { runtime } : {}),
     // Between the close and the proof, never after: an unsettled close returns early, and a
-    // surviving hold keeps the provider child un-evictable for the life of the app.
+    // surviving redrive subscription keeps nudging a session no dispatch owns.
     afterClose: () => releaseStructuredWorkerSession(dispatchId, runtime)
   })
 }
 
 /** The structured half of `worker-read`, or null when a PTY worker owns the dispatch. */
-export function readStructuredWorkerOutput(args: {
+export async function readStructuredWorkerOutput(args: {
   db: OrchestrationDb
   dispatchId: string
   workerState: string
@@ -98,7 +99,7 @@ export function readStructuredWorkerOutput(args: {
   source?: 'auto' | 'transcript' | 'terminal'
   cursor?: string | number
   limit?: number
-}): OrchestrationWorkerReadTranscriptResult | null {
+}): Promise<OrchestrationWorkerReadTranscriptResult | null> {
   const identity = resolveStructuredWorkerForDispatch(args.db, args.dispatchId)
   if (!identity) {
     return null
@@ -123,7 +124,7 @@ export function readStructuredWorkerOutput(args: {
 }
 
 /** Journal page in the shape `worker-read --source transcript` already serves. */
-export function readStructuredWorkerJournal(args: {
+export async function readStructuredWorkerJournal(args: {
   identity: StructuredWorkerIdentity
   dispatchId: string
   workerState: string
@@ -131,8 +132,8 @@ export function readStructuredWorkerJournal(args: {
   agent: AgentType
   cursor?: string | number
   limit?: number
-}): OrchestrationWorkerReadTranscriptResult {
-  const page = readStructuredJournalPage(args.identity.sessionId)
+}): Promise<OrchestrationWorkerReadTranscriptResult> {
+  const page = await readStructuredJournalPage(args.identity.sessionId)
   if (!page) {
     throw new OrchestrationError(
       'transcript_required',
@@ -213,11 +214,13 @@ function structuredJournalPrefixIdentity(args: {
 }
 
 /** Freezes the journal before the session is closed, so a released worker is still readable. */
-export function captureStructuredWorkerArchive(
+export async function captureStructuredWorkerArchive(
   identity: StructuredWorkerIdentity,
   agent: AgentType
-): WorkerStructuredJournalArchive {
-  const page = readStructuredJournalPage(identity.sessionId)
+): Promise<WorkerStructuredJournalArchive> {
+  // Opens a conversation at rest or one the idle sweep closed, so a resting worker's journal is
+  // still preserved.
+  const page = await readStructuredJournalPage(identity.sessionId)
   if (page) {
     return buildStructuredJournalArchive({
       agent,
@@ -232,10 +235,9 @@ export function captureStructuredWorkerArchive(
   // the worker's chat tab is a routine user action that does exactly that, so throwing there wedges
   // release on evidence that can never come and leaves `worker-abandon` as the only exit.
   //
-  // `exited` is the only verdict that qualifies: it needs a released lease WITH death evidence.
-  // `unverifiable` — no host installed, a lease handed to a TUI owner — means we could not look,
-  // and retaining is still right.
-  if (observeStructuredWorker(identity).status !== 'exited') {
+  // Only a worker this runtime no longer owns qualifies — released with its chat tab gone. An owned
+  // one, running or at rest, keeps its journal, and so does one we could not look at.
+  if (structuredWorkerOwned(identity.sessionId) !== false) {
     throw new OrchestrationError(
       'archive_failed',
       'Output could not be preserved for this structured worker; the session was retained.'
diff --git a/src/main/runtime/rpc/methods/orchestration-structured-worker-session.test.ts b/src/main/runtime/rpc/methods/orchestration-structured-worker-session.test.ts
index 493f9d092c3..c3c69dc15fd 100644
--- a/src/main/runtime/rpc/methods/orchestration-structured-worker-session.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-structured-worker-session.test.ts
@@ -1,5 +1,8 @@
+import { join } from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { dispatchWriteFailureReason } from '../../../../shared/structured-agent-session-dispatch-rejection'
+import type { AgentJournalSubmission } from '../../../../shared/agent-session-journal-types'
+import { getAppEnvironment } from '../../../../shared/app-environment'
+import { DISPATCH_REJECTED_WRITE_FAILED } from '../../../../shared/structured-agent-session-dispatch-rejection'
 
 const hostRef: { current: unknown } = { current: null }
 const createSpy = vi.fn()
@@ -14,37 +17,34 @@ vi.mock('./structured-agent-session-create', () => ({
 const {
   createStructuredWorkerSession,
   releaseStructuredWorkerSession,
-  sendStructuredWorkerPreamble,
-  structuredWorkerHoldId
+  sendStructuredWorkerPreamble
 } = await import('./orchestration-structured-worker-session')
 const { isUnknownWorkerStartOutcome } = await import('./orchestration/worker/worker-topology')
 const { structuredWorkerIdentities } = await import('../../structured-worker-identity')
-const { structuredWorkerChildIdentityEnv } =
-  await import('../../structured-worker-child-identity-env')
+const { structuredSessionChildIdentityEnv } =
+  await import('../../structured-session-child-identity-env')
 
-function installHost() {
-  const hold = vi.fn(async () => {})
-  const release = vi.fn()
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a host stub carrying only the members the worker start reaches.
+function installHost(location = { executionHostId: 'local', wslDistro: null as string | null }) {
   const dispose = vi.fn()
+  const subscribe = vi.fn(async () => dispose)
   hostRef.current = {
     setSessionTabVisibility: async () => {},
     close: async () => {},
     deps: {
       store: {
         getRecord: () => ({
-          location: { executionHostId: 'local', wslDistro: null },
+          location,
           lease: { runtimeFence: 2, runtimeKind: 'native', claimStatus: 'live' }
         })
       }
     },
-    hold,
-    release,
-    subscribe: () => dispose
+    subscribe
   }
-  return { hold, release, dispose }
+  return { subscribe, dispose }
 }
 
-describe('structured worker session hold', () => {
+describe('structured worker session', () => {
   beforeEach(() => {
     structuredWorkerIdentities.clear()
     createSpy.mockReset()
@@ -54,8 +54,8 @@ describe('structured worker session hold', () => {
     }))
   })
 
-  it('takes a resume-capable hold at start and releases it only on settlement', async () => {
-    const { hold, release, dispose } = installHost()
+  it('binds only a redrive subscription at start, and settlement drops it', async () => {
+    const { subscribe, dispose } = installHost()
     const created = await createStructuredWorkerSession({
       runtime: { ensureStructuredAgentSessionHost: async () => {} } as never,
       worktreeId: 'wt_1',
@@ -63,18 +63,19 @@ describe('structured worker session hold', () => {
       dispatchId: 'd1',
       onJournalActivity: () => {}
     })
-    // Without the hold, the release clock evicts the provider child 15s after a user closes the
-    // worker's chat tab, killing an idle worker mid-dispatch.
-    expect(hold).toHaveBeenCalledWith(created.identity.sessionId, structuredWorkerHoldId('d1'))
-    expect(release).not.toHaveBeenCalled()
+    // No hold: while the dispatch is open the idle sweep reads it from the orchestration database.
+    expect(hostRef.current).not.toHaveProperty('hold')
+    expect(subscribe).toHaveBeenCalledWith(
+      expect.objectContaining({ sessionId: created.identity.sessionId })
+    )
+    expect(dispose).not.toHaveBeenCalled()
 
     releaseStructuredWorkerSession('d1')
-    expect(release).toHaveBeenCalledWith(created.identity.sessionId, structuredWorkerHoldId('d1'))
     expect(dispose).toHaveBeenCalledTimes(1)
     expect(structuredWorkerIdentities.get(created.identity.handle)).toBeNull()
-    // A second settlement is a no-op rather than a second release of the same holder.
+    // A second settlement is a no-op.
     releaseStructuredWorkerSession('d1')
-    expect(release).toHaveBeenCalledTimes(1)
+    expect(dispose).toHaveBeenCalledTimes(1)
   })
 
   it('registers the identity BEFORE the session is created, so the child gets the handle', async () => {
@@ -83,7 +84,7 @@ describe('structured worker session hold', () => {
     createSpy.mockImplementation(async (args: { envelope: { sessionId: string } }) => {
       // `attach` is what spawns the provider child, and the child's env is read from the registry
       // at spawn time. Registering afterwards ships a worker with no ORCA_TERMINAL_HANDLE.
-      envAtSpawn = structuredWorkerChildIdentityEnv(args.envelope.sessionId, {})
+      envAtSpawn = structuredSessionChildIdentityEnv(args.envelope.sessionId, {})
       return { ok: true, value: { sessionId: args.envelope.sessionId } }
     })
     const created = await createStructuredWorkerSession({
@@ -94,14 +95,22 @@ describe('structured worker session hold', () => {
       onJournalActivity: () => {}
     })
     expect(envAtSpawn?.ORCA_TERMINAL_HANDLE).toBe(created.identity.handle)
-    expect(envAtSpawn?.ORCA_CLI_COMMAND).toBe('orca')
+    // This app's own launcher by absolute path, so a login shell's profile cannot swap in a global.
+    expect(envAtSpawn?.ORCA_CLI_COMMAND).toBe(
+      join(
+        getAppEnvironment().getPath('userData'),
+        'cli',
+        'bin',
+        process.platform === 'win32' ? 'orca-dev.cmd' : 'orca-dev'
+      )
+    )
     expect(envAtSpawn?.ORCA_PANE_KEY).toBeUndefined()
     releaseStructuredWorkerSession('d_spawn')
   })
 
   it('forgets the identity and discards the session when the start fails', async () => {
-    const { hold } = installHost()
-    hold.mockRejectedValueOnce(new Error('hold refused'))
+    // A session that resolves outside the local host is not a worker this runtime can own.
+    installHost({ executionHostId: 'local', wslDistro: 'Ubuntu' })
     const closed: string[] = []
     ;(hostRef.current as { close: (id: string) => Promise<void> }).close = async (id) => {
       closed.push(id)
@@ -114,7 +123,7 @@ describe('structured worker session hold', () => {
         dispatchId: 'd_fail',
         onJournalActivity: () => {}
       })
-    ).rejects.toThrow('hold refused')
+    ).rejects.toThrow(/local execution host outside WSL/)
     // Neither a live provider child nor a registry entry may outlive the failed start.
     expect(closed).toHaveLength(1)
     expect(structuredWorkerIdentities.getBySessionId(closed[0]!)).toBeNull()
@@ -128,7 +137,7 @@ describe('structured worker session hold', () => {
     }
     // `commit` answers this after `attach` SUCCEEDED and only the tab publish failed, so the
     // provider child is live. Reading it as "refused, nothing created" strands that child with no
-    // hold and no binding, and nothing else in the runtime ever retires it.
+    // binding, and nothing else in the runtime ever retires it.
     createSpy.mockImplementation(async () => ({
       ok: false,
       refusal: {
@@ -224,20 +233,69 @@ describe('structured worker session hold', () => {
 })
 
 describe('structured worker dispatch preamble', () => {
-  function hostWithSubmission(submission: Record<string, unknown>) {
+  type PreambleHost = Parameters<typeof sendStructuredWorkerPreamble>[0]['host']
+  type Settled = Pick<AgentJournalSubmission, 'dispatchState' | 'reason'>
+
+  function submissionOf(settled: Settled): AgentJournalSubmission {
     return {
-      deps: { store: { getRecord: () => ({ lease: { runtimeFence: 7 } }) } },
-      send: async () => ({ ok: true, value: { clientMessageId: 'c1', submission } })
-    } as never
+      clientMessageId: 'c1',
+      fence: 7,
+      payloadFingerprint: 'fingerprint',
+      providerItemId: null,
+      submittedAt: 1,
+      resolvedAt: null,
+      ...settled
+    }
   }
 
-  const send = (host: never) =>
+  function hostWithSubmission(submission: Settled, delivered?: Settled): PreambleHost {
+    return {
+      deps: { store: { getRecord: () => ({ lease: { runtimeFence: 7 } }) } },
+      send: async () => ({
+        ok: true,
+        replayed: false,
+        fence: 7,
+        cursor: { epoch: 'epoch-1', sequence: 1 },
+        value: { clientMessageId: 'c1', submission: submissionOf(submission) }
+      }),
+      // What the submission settled as while the worker's agent started; undefined when the
+      // start outlasted the wait.
+      waitForSendSettlement: async () =>
+        delivered
+          ? {
+              cursor: { epoch: 'epoch-1', sequence: 2 },
+              value: { clientMessageId: 'c1', submission: submissionOf(delivered) }
+            }
+          : undefined
+    }
+  }
+
+  const send = (host: PreambleHost) =>
     sendStructuredWorkerPreamble({ host, sessionId: 's1', dispatchId: 'd1', preamble: 'spec' })
 
   it('reports the preamble delivered only on an accepted submission', async () => {
     await expect(
       send(hostWithSubmission({ dispatchState: 'accepted', reason: null }))
-    ).resolves.toBeUndefined()
+    ).resolves.toBe('accepted')
+  })
+
+  it('waits for an accepted preamble to be delivered, and reports that delivery (W10)', async () => {
+    await expect(
+      send(
+        hostWithSubmission(
+          { dispatchState: 'pending', reason: null },
+          { dispatchState: 'accepted', reason: null }
+        )
+      )
+    ).resolves.toBe('accepted')
+  })
+
+  it('reports a preamble still held for an agent that outlasted the wait, without failing the start (W10)', async () => {
+    // Held, not lost: the host delivers it when the agent starts. Throwing here tore the worker
+    // down, which rejected the preamble the start was about to deliver.
+    await expect(
+      send(hostWithSubmission({ dispatchState: 'pending', reason: null }))
+    ).resolves.toBe('pending')
   })
 
   it('never claims delivery for a submission the provider never acknowledged', async () => {
@@ -245,15 +303,13 @@ describe('structured worker dispatch preamble', () => {
     // into `unknown`, and `performSend` still returns ok. Reporting that as `dispatch_input:
     // accepted` marks the worker ready with no task, and the coordinator blocks in
     // `check --wait --types worker_done` until it times out.
-    for (const dispatchState of ['unknown', 'pending'] as const) {
-      const error = await send(
-        hostWithSubmission({ dispatchState, reason: 'provider child exited' })
-      ).catch((thrown: unknown) => thrown)
-      expect((error as { code?: string }).code).toBe('operation_unknown')
-      // The wiring, not just the throw: this is the code that makes the start receipt
-      // `outcome_unknown` with the worker-show / worker-abandon recovery commands.
-      expect(isUnknownWorkerStartOutcome(error, 'dispatch_input')).toBe(true)
-    }
+    const error = await send(
+      hostWithSubmission({ dispatchState: 'unknown', reason: 'provider child exited' })
+    ).catch((thrown: unknown) => thrown)
+    expect((error as { code?: string }).code).toBe('operation_unknown')
+    // The wiring, not just the throw: this is the code that makes the start receipt
+    // `outcome_unknown` with the worker-show / worker-abandon recovery commands.
+    expect(isUnknownWorkerStartOutcome(error, 'dispatch_input')).toBe(true)
   })
 
   it('keeps a rejected preamble a proven failure under a code of its own', async () => {
@@ -268,13 +324,33 @@ describe('structured worker dispatch preamble', () => {
     expect(isUnknownWorkerStartOutcome(error, 'dispatch_input')).toBe(false)
   })
 
+  it('ends the message with one period whether the reason is a sentence or a marker', async () => {
+    const sentence = await send(
+      hostWithSubmission({
+        dispatchState: 'rejected',
+        reason: 'The provider stopped before this message was sent.'
+      })
+    ).catch((thrown: unknown) => thrown)
+    expect(sentence).toMatchObject({
+      message:
+        'The dispatch preamble was not delivered: The provider stopped before this message was sent.'
+    })
+    const marker = await send(
+      hostWithSubmission({ dispatchState: 'unknown', reason: 'provider child exited' })
+    ).catch((thrown: unknown) => thrown)
+    expect(marker).toMatchObject({
+      message:
+        'The dispatch preamble was submitted but not acknowledged (unknown): provider child exited.'
+    })
+  })
+
   it('reports a refused transport write as undelivered, never as unknown', async () => {
     // The state a provably-unwritten frame now settles. Nothing reached the provider,
     // so there is no running turn for a coordinator to go and look at.
     const error = await send(
       hostWithSubmission({
         dispatchState: 'rejected',
-        reason: dispatchWriteFailureReason(new Error('broken pipe'))
+        reason: DISPATCH_REJECTED_WRITE_FAILED
       })
     ).catch((thrown: unknown) => thrown)
     expect((error as { code?: string }).code).toBe('dispatch_preamble_undelivered')
diff --git a/src/main/runtime/rpc/methods/orchestration-structured-worker-session.ts b/src/main/runtime/rpc/methods/orchestration-structured-worker-session.ts
index 5bde461a059..f5684f1ba1b 100644
--- a/src/main/runtime/rpc/methods/orchestration-structured-worker-session.ts
+++ b/src/main/runtime/rpc/methods/orchestration-structured-worker-session.ts
@@ -1,19 +1,21 @@
 /**
- * Starting, holding and retiring a worker that IS a structured agent session.
+ * Starting and retiring a worker that IS a structured agent session.
  *
  * Three things make this different from the PTY worker path, and all three live here:
  *
  * - The session is created directly as structured, so readiness is the attach returning ok. There
  *   is no boot-to-idle gap to wait on and no `tui-idle` edge to read.
- * - A structured session's provider child is evicted 15s after its last HOLDER leaves, and holds
- *   come only from bound surfaces. A dispatched worker parked on mail is exactly that state, so
- *   the dispatch takes its own resume-capable hold and keeps it until the worker settles.
+ * - Nothing here keeps its agent running. The idle sweep leaves it running while its dispatch is
+ *   open, reading that from the orchestration database; once the dispatch settles the agent rests
+ *   like any chat's, and the next mail starts it.
  * - The dispatch preamble is a turn, not keystrokes.
  */
 
 import { randomUUID } from 'node:crypto'
 import { isDefinitiveAgentSessionCreateRefusal } from '../../../../shared/agent-session-definitive-refusal'
 import type { AgentJournalMessageItem } from '../../../../shared/agent-session-journal-types'
+import { ORCHESTRATION_READINESS_TIMEOUT_MS } from '../../../../shared/orchestration-timing-budgets'
+import { agentSessionSendSubmission } from '../../../../shared/agent-session-wire'
 import type { StructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-host'
 import { getStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
 import type { OrcaRuntimeService } from '../../orca-runtime'
@@ -38,23 +40,16 @@ import { createStructuredAgentSessionForWorktree } from './structured-agent-sess
 type StructuredWorkerBinding = {
   sessionId: string
   handle: string
-  holderId: string
   disposeSubscription: () => void
 }
 
 const bindingsByDispatchId = new Map<string, StructuredWorkerBinding>()
 
-export function structuredWorkerHoldId(dispatchId: string): string {
-  return `orchestration:dispatch:${dispatchId}`
-}
-
 /**
- * Drops the dispatch's hold, its redrive subscription and its parked mail; the release clock takes
- * it from here.
+ * Drops the dispatch's redrive subscription, its registry entry and its parked mail.
  *
- * EVERY settlement has to reach this — stop, release AND abandon. A surviving hold does not just
- * leak: it keeps the provider child un-evictable for the life of the app, and makes host crash
- * recovery respawn a child for a worker that was settled long ago.
+ * EVERY settlement has to reach this — stop, release AND abandon. A surviving subscription keeps
+ * nudging a session no dispatch owns.
  */
 export function releaseStructuredWorkerSession(
   dispatchId: string,
@@ -68,11 +63,6 @@ export function releaseStructuredWorkerSession(
   binding.disposeSubscription()
   structuredWorkerIdentities.forget(binding.handle)
   runtime?.forgetStructuredSessionMail?.(binding.sessionId)
-  try {
-    getStructuredAgentSessionHost()?.release(binding.sessionId, binding.holderId)
-  } catch (error) {
-    console.warn('[orchestration] structured worker hold release failed', dispatchId, error)
-  }
 }
 
 export async function createStructuredWorkerSession(args: {
@@ -92,7 +82,7 @@ export async function createStructuredWorkerSession(args: {
   // resolves to whatever single leaf sits in the worktree — by default the COORDINATOR's pane.
   //
   // The scope is provisionally local; the record's own location is asserted local below, and a
-  // session that resolves anywhere else never reaches a hold.
+  // session that resolves anywhere else is discarded.
   const identity = structuredWorkerIdentities.register({
     handle: mintStructuredWorkerHandle(),
     sessionId,
@@ -141,13 +131,10 @@ export async function createStructuredWorkerSession(args: {
         'A structured worker must run on the local execution host outside WSL.'
       )
     }
-    const holderId = structuredWorkerHoldId(args.dispatchId)
-    await host.hold(sessionId, holderId)
-    const disposeSubscription = subscribeForRedrive(host, sessionId, args.onJournalActivity)
+    const disposeSubscription = await subscribeForRedrive(host, sessionId, args.onJournalActivity)
     bindingsByDispatchId.set(args.dispatchId, {
       sessionId,
       handle: identity.handle,
-      holderId,
       disposeSubscription
     })
     return { identity, host }
@@ -167,8 +154,8 @@ export async function createStructuredWorkerSession(args: {
  *
  * `ok` is not the test. `commit` answers `agent_session_operation_unknown` when `attach` SUCCEEDED
  * and only the tab publish failed, and a throw out of the commit half is past `attach` too — the
- * pre-commit half never throws, it refuses. Both leave a live provider child that took no hold and
- * has no binding, so nothing else in the runtime will ever retire it. Only a DEFINITIVE refusal
+ * pre-commit half never throws, it refuses. Both leave a session with a published tab and no
+ * binding, so nothing else in the runtime will ever retire it. Only a DEFINITIVE refusal
  * proves there is nothing to discard; everything else gets the best-effort close.
  */
 function structuredCreateMayHaveCommitted(
@@ -213,13 +200,27 @@ export async function discardStructuredWorkerSession(
   retireSettledStructuredWorkerTab(sessionId, runtime)
 }
 
-/** Delivers the dispatch preamble as the worker's first turn. */
+/** A submission reason as a clause: host sentences end in a period, legacy markers do not. */
+function reasonClause(reason: string | null | undefined): string {
+  return (reason ?? 'no reason given').replace(/[.\s]+$/, '')
+}
+
+/** What a preamble send reads of the host. */
+type StructuredWorkerPreambleHost = Pick<
+  StructuredAgentSessionHost,
+  'send' | 'waitForSendSettlement'
+> & {
+  deps: { store: { getRecord: (sessionId: string) => { lease: { runtimeFence: number } } | null } }
+}
+
+/** Delivers the dispatch preamble as the worker's first turn. `pending`: the worker's agent had
+ *  not taken it within the wait; the host still holds it for that agent, and never re-sends it. */
 export async function sendStructuredWorkerPreamble(args: {
-  host: StructuredAgentSessionHost
+  host: StructuredWorkerPreambleHost
   sessionId: string
   dispatchId: string
   preamble: string
-}): Promise<void> {
+}): Promise<'accepted' | 'pending'> {
   const body: AgentJournalMessageItem = {
     kind: 'message',
     role: 'user',
@@ -244,11 +245,24 @@ export async function sendStructuredWorkerPreamble(args: {
   if (!result.ok) {
     throw new Error(`The dispatch preamble was refused: ${result.refusal.message}`)
   }
-  const submission = result.value.submission
-  if (submission.dispatchState === 'accepted') {
-    return
+  // Accepted is not delivered: the worker's agent may still be starting.
+  const answered = agentSessionSendSubmission(result.value)
+  const submission =
+    answered?.dispatchState === 'pending'
+      ? (agentSessionSendSubmission(
+          (
+            await args.host
+              .waitForSendSettlement(args.sessionId, result.value.clientMessageId, {
+                budgetMs: ORCHESTRATION_READINESS_TIMEOUT_MS
+              })
+              .catch(() => undefined)
+          )?.value
+        ) ?? answered)
+      : answered
+  if (submission?.dispatchState === 'accepted' || submission?.dispatchState === 'pending') {
+    return submission.dispatchState
   }
-  if (submission.dispatchState === 'rejected') {
+  if (submission?.dispatchState === 'rejected') {
     // A rejection is a verdict, not a mystery: the preamble provably did not happen.
     // `dispatch_preamble_undelivered` says exactly that, and says it as a code rather
     // than as prose, so a coordinator can tell "we could not send it" apart from
@@ -256,7 +270,9 @@ export async function sendStructuredWorkerPreamble(args: {
     // pending receipt; only this one lets the caller retry knowing nothing landed.
     throw new OrchestrationError(
       'dispatch_preamble_undelivered',
-      `The dispatch preamble was not delivered: ${submission.reason ?? 'no reason given'}.`
+      `The dispatch preamble was not delivered${
+        submission.rejection ? ` (${submission.rejection.kind})` : ''
+      }: ${reasonClause(submission.reason)}.`
     )
   }
   // Only `accepted` is an acknowledgement — the same rule the mail lane already applies. A thrown
@@ -265,7 +281,7 @@ export async function sendStructuredWorkerPreamble(args: {
   // `outcome_unknown` receipt whose nextCommands send the coordinator to look.
   throw new OrchestrationError(
     'operation_unknown',
-    `The dispatch preamble was submitted but not acknowledged (${submission.dispatchState}): ${submission.reason ?? 'no reason given'}.`
+    `The dispatch preamble was submitted but not acknowledged (${submission?.dispatchState ?? 'unknown'}): ${reasonClause(submission?.reason)}.`
   )
 }
 
@@ -304,17 +320,17 @@ const REDRIVE_MAX_WAIT_MS = 2_000
  * idle worker — that is `deliverForHandle`, called when the message is enqueued and untouched
  * here. This is only the retry for mail already parked because the worker was busy.
  */
-function subscribeForRedrive(
+async function subscribeForRedrive(
   host: StructuredAgentSessionHost,
   sessionId: string,
   onJournalActivity: (sessionId: string) => void
-): () => void {
+): Promise<() => void> {
   const coalescer = createKeyedTrailingEdgeCoalescer(onJournalActivity, {
     flushMs: REDRIVE_FLUSH_MS,
     maxWaitMs: REDRIVE_MAX_WAIT_MS
   })
   try {
-    const unsubscribe = host.subscribe({
+    const unsubscribe = await host.subscribe({
       id: `orchestration:redrive:${sessionId}`,
       sessionId,
       emit: (event) => {
@@ -324,7 +340,7 @@ function subscribeForRedrive(
       }
     })
     // Disposal drops the pending timer rather than flushing it: every settlement reaches here, and
-    // a redrive that fires after the hold is gone would nudge a session no dispatch owns.
+    // a redrive that fires after it would nudge a session no dispatch owns.
     return () => {
       coalescer.dispose()
       unsubscribe()
diff --git a/src/main/runtime/rpc/methods/orchestration-structured-worker-start-failure.test.ts b/src/main/runtime/rpc/methods/orchestration-structured-worker-start-failure.test.ts
index 1f29dfb4904..98a843fb695 100644
--- a/src/main/runtime/rpc/methods/orchestration-structured-worker-start-failure.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-structured-worker-start-failure.test.ts
@@ -136,7 +136,7 @@ describe('a structured worker-start that fails after the session exists', () =>
       db,
       run: { id: 'run_1' } as never,
       existingTask: { id: 't1', spec: 'do the thing' } as never,
-      coordinatorPane: null,
+      coordinator: null,
       orchestrationMutation: undefined
     })
 
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-mode-opacity.test.ts b/src/main/runtime/rpc/methods/orchestration-worker-mode-opacity.test.ts
index aa8c7c58574..9531e0f468b 100644
--- a/src/main/runtime/rpc/methods/orchestration-worker-mode-opacity.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-worker-mode-opacity.test.ts
@@ -12,7 +12,6 @@
  */
 
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { setStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
 import { OrcaRuntimeService } from '../../orca-runtime'
 import { OrchestrationDb } from '../../orchestration/db'
 import {
@@ -29,6 +28,12 @@ const STRUCTURED_HANDLE = 'structworker_worker'
 const TERMINAL_HANDLE = 'term_worker'
 
 const structuredPreambles: string[] = []
+// The session host the code under test reads; a structural fake, so no host type is claimed.
+const hostRef = vi.hoisted((): { current: unknown } => ({ current: null }))
+
+vi.mock('../../../native-chat/agent-session-wire/structured-agent-session-registry', () => ({
+  getStructuredAgentSessionHost: () => hostRef.current
+}))
 
 vi.mock('./orchestration/worker/worker-topology', async (importOriginal) => ({
   ...(await importOriginal<Record<string, unknown>>()),
@@ -42,6 +47,7 @@ vi.mock('./orchestration-structured-worker-session', async (importOriginal) => (
   ...(await importOriginal<Record<string, unknown>>()),
   sendStructuredWorkerPreamble: async (args: { preamble: string }) => {
     structuredPreambles.push(args.preamble)
+    return 'accepted'
   },
   releaseStructuredWorkerSession: () => {},
   discardStructuredWorkerSession: async () => {}
@@ -69,7 +75,7 @@ function installStructuredCoordinator(handle: string, sessionId: string): string
     worktreeId: WORKTREE,
     hostScope: { kind: 'local', hostId: 'local' }
   })
-  setStructuredAgentSessionHost({
+  hostRef.current = {
     hasSession: () => true,
     deps: {
       store: {
@@ -82,10 +88,12 @@ function installStructuredCoordinator(handle: string, sessionId: string): string
             deathEvidence: null,
             runtimeFence: 1
           }
-        })
+        }),
+        // No committed /clear: each session is its own lineage's root.
+        listRecords: () => []
       }
     }
-  } as never)
+  }
   return paneKey
 }
 
@@ -149,7 +157,7 @@ describe('a worker cannot tell which mode it is running in', () => {
 
   afterEach(() => {
     db.close()
-    setStructuredAgentSessionHost(null)
+    hostRef.current = null
     structuredWorkerIdentities.clear()
     vi.restoreAllMocks()
   })
@@ -253,10 +261,14 @@ describe('a worker cannot tell which mode it is running in', () => {
         source: 'terminal'
       })
 
-    expect(read).toThrow(/has no terminal output/)
+    const refusal = await read().then(
+      () => '',
+      (error: unknown) => (error instanceof Error ? error.message : String(error))
+    )
+    expect(refusal).toMatch(/has no terminal output/)
     // The refusal names a source that works instead of naming the worker's kind.
-    expect(read).toThrow(/--source auto or --source transcript/)
-    expect(read).not.toThrow(/structured/i)
+    expect(refusal).toMatch(/--source auto or --source transcript/)
+    expect(refusal).not.toMatch(/structured/i)
   })
 
   it('never claims a structured worker was checked for a human-answerable prompt', async () => {
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-release-incarnation-fallback.test.ts b/src/main/runtime/rpc/methods/orchestration-worker-release-incarnation-fallback.test.ts
new file mode 100644
index 00000000000..e839c2e017d
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration-worker-release-incarnation-fallback.test.ts
@@ -0,0 +1,534 @@
+import { afterEach, describe, expect, it, vi, type MockInstance } from 'vitest'
+import { ORCHESTRATION_METHODS } from './orchestration'
+import { eraseRpcMethods, type RpcContext } from '../core'
+import { OrchestrationDb } from '../../orchestration/db'
+import { OrcaRuntimeService } from '../../orca-runtime'
+import { completeWorkerTerminalRelease } from './orchestration/worker/worker-release-completion'
+
+describe('orchestration worker release incarnation fallback', () => {
+  let db: OrchestrationDb
+  let dbOpen = false
+  let runtime: OrcaRuntimeService
+  let ctx: RpcContext
+  let activeRunId: string
+  let inspectProcessLiveness: MockInstance<
+    OrcaRuntimeService['inspectTerminalProcessIncarnationLiveness']
+  >
+
+  const coordinatorPaneKey = 'tab_coord:aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa'
+  const workerPaneKey = 'tab_worker:bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb'
+
+  /** Fresh in-memory db and a fully-stubbed runtime for one worker-release scenario. */
+  function setup(): void {
+    db = new OrchestrationDb(':memory:')
+    dbOpen = true
+    runtime = new OrcaRuntimeService()
+    runtime.setOrchestrationDb(db)
+    inspectProcessLiveness = vi
+      .spyOn(runtime, 'inspectTerminalProcessIncarnationLiveness')
+      .mockResolvedValue('live')
+    vi.spyOn(runtime, 'getTerminalPaneKey').mockImplementation((handle) =>
+      handle === 'term_coord'
+        ? coordinatorPaneKey
+        : handle === 'term_worker' || handle === 'term_reminted'
+          ? workerPaneKey
+          : null
+    )
+    vi.spyOn(runtime, 'getTerminalProcessIncarnation').mockImplementation((handle) =>
+      handle === 'term_worker' || handle === 'term_reminted' ? 'runtime_test:term_worker:1' : null
+    )
+    vi.spyOn(runtime, 'getOrchestrationDispatchAuthority').mockImplementation((handle) =>
+      handle === 'term_worker' || handle === 'term_reminted'
+        ? // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test fixture is deliberately shaped to exercise the private/runtime boundary.
+          ({
+            terminalHandle: handle,
+            paneKey: workerPaneKey,
+            processIncarnation: 'runtime_test:term_worker:1',
+            hostScope: { kind: 'local', hostId: 'local' }
+            // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+            // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+          } as never)
+        : null
+    )
+    vi.spyOn(runtime, 'validateOrchestrationAgentLauncher').mockImplementation(() => {})
+    vi.spyOn(runtime, 'showTerminal').mockImplementation(
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      async (handle) => ({ handle, worktreeId: 'repo::worktree', status: 'running' }) as never
+    )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    vi.spyOn(runtime, 'showManagedTerminalWorkspace').mockResolvedValue({
+      id: 'repo::worktree'
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    } as never)
+    vi.spyOn(runtime, 'createTerminal').mockResolvedValue({
+      handle: 'term_worker',
+      worktreeId: 'repo::worktree',
+      title: 'worker'
+    })
+    vi.spyOn(runtime, 'waitForTerminal').mockResolvedValue({
+      handle: 'term_worker',
+      condition: 'tui-idle',
+      satisfied: true,
+      status: 'running',
+      exitCode: null
+    })
+    vi.spyOn(runtime, 'getTerminalOrchestrationCliCommand').mockReturnValue('orca')
+    vi.spyOn(runtime, 'sendTerminalAgentPrompt').mockResolvedValue({
+      handle: 'term_worker',
+      accepted: true,
+      bytesWritten: 1
+    })
+    vi.spyOn(runtime, 'isTerminalRunningAgent').mockResolvedValue(true)
+    vi.spyOn(runtime, 'getExactWorkerProviderSession').mockReturnValue(null)
+    vi.spyOn(runtime, 'readTerminal').mockResolvedValue({
+      handle: 'term_worker',
+      status: 'running',
+      tail: ['worker output line 1', 'worker output line 2'],
+      truncated: false,
+      nextCursor: '2'
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    vi.spyOn(runtime, 'closeTerminal').mockResolvedValue({
+      handle: 'term_worker',
+      tabId: 'tab-worker',
+      ptyKilled: true
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    } as never)
+    vi.spyOn(runtime, 'notifyMessageArrived').mockImplementation(() => {})
+    activeRunId = db.createRun({
+      objective: 'Release test Run',
+      coordinatorHandle: 'term_coord',
+      coordinatorPaneKey
+    }).id
+    ctx = { runtime }
+  }
+
+  afterEach(() => {
+    if (dbOpen) {
+      dbOpen = false
+      db.close()
+    }
+    vi.restoreAllMocks()
+  })
+
+  /** Look up a registered orchestration RPC method by name. */
+  function findMethod(name: string) {
+    const method = eraseRpcMethods(ORCHESTRATION_METHODS).find((m) => m.name === name)
+    if (!method) {
+      throw new Error(`Method not found: ${name}`)
+    }
+    return method
+  }
+
+  /** Parse a method's params and invoke its handler against the shared ctx. */
+  async function call(name: string, params: Record<string, unknown>) {
+    const method = findMethod(name)
+    const parsed = method.params ? method.params.parse(params) : undefined
+    return method.handler(parsed, ctx)
+  }
+
+  /** Start a ready worker on a fresh task off the coordinator terminal. */
+  async function startWorker(options: { terminal?: string } = {}): Promise<{
+    taskId: string
+    dispatchId: string
+  }> {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const task = db.createTask({ spec: 'release fixture task', runId: activeRunId })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const result = (await call('orchestration.workerStart', {
+      task: task.id,
+      from: 'term_coord',
+      ...(options.terminal ? { terminal: options.terminal } : { agent: 'codex' })
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    })) as { dispatchId: string; state: string }
+    expect(result.state).toBe('ready')
+    return { taskId: task.id, dispatchId: result.dispatchId }
+  }
+
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+  /** Record the worker's report as settled — the precondition for release. */
+  function settle(taskId: string, dispatchId: string, outcome: 'succeeded' | 'failed'): void {
+    const settlement = db.settleWorkerReport({
+      taskId,
+      dispatchId,
+      outcome,
+      result: `worker ${outcome}`
+    })
+    expect(settlement.action).toBe('settled')
+  }
+
+  /** Start a worker and settle its report, the state a release acts on. */
+  async function startSettledWorker(
+    outcome: 'succeeded' | 'failed' = 'succeeded',
+    options: { terminal?: string } = {}
+  ): Promise<{ taskId: string; dispatchId: string }> {
+    const worker = await startWorker(options)
+    settle(worker.taskId, worker.dispatchId, outcome)
+    return worker
+  }
+
+  it('closes a live worker terminal whose durable handle no longer resolves but whose process incarnation still matches', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    // The durable handle stops resolving (renderer graph epoch bump / handle invalidation)...
+    vi.mocked(runtime.showTerminal).mockImplementation(async (handle) =>
+      handle === 'term_worker'
+        ? Promise.reject(new Error('terminal_handle_stale'))
+        : // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test fixture is deliberately shaped to exercise the private/runtime boundary.
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+          ({ handle, worktreeId: 'repo::worktree', status: 'running' } as never)
+    )
+    // ...but the recorded process incarnation still names a live PTY, re-minted to a fresh handle.
+    const resolveByIncarnation = vi.fn().mockReturnValue('term_reminted')
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const receipt = (await call('orchestration.workerRelease', { dispatch: dispatchId })) as {
+      state: string
+      processAction: string
+    }
+
+    expect(receipt).toMatchObject({ state: 'released', processAction: 'closed_agent_terminal' })
+    expect(resolveByIncarnation).toHaveBeenCalledWith(
+      'runtime_test:term_worker:1',
+      JSON.stringify({ kind: 'local', hostId: 'local' })
+    )
+    // The close targeted exactly the re-minted live handle for that PTY, never the stale one.
+    expect(runtime.closeTerminal).toHaveBeenCalledTimes(1)
+    expect(runtime.closeTerminal).toHaveBeenCalledWith('term_reminted')
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)).toMatchObject({
+      ownership_state: 'released',
+      release_state: 'released'
+    })
+  })
+
+  it('stays release_unknown and closes nothing when the recorded incarnation no longer matches a live pty', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    vi.mocked(runtime.showTerminal).mockRejectedValue(new Error('terminal_handle_stale'))
+    // A reused ptyId now belongs to a different process: the incarnation mismatch refuses a close.
+    const resolveByIncarnation = vi.fn().mockReturnValue(null)
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const receipt = (await call('orchestration.workerRelease', { dispatch: dispatchId })) as {
+      state: string
+    }
+
+    expect(receipt.state).toBe('release_unknown')
+    expect(resolveByIncarnation).toHaveBeenCalledWith(
+      'runtime_test:term_worker:1',
+      JSON.stringify({ kind: 'local', hostId: 'local' })
+    )
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)?.release_state).toBe('unknown')
+  })
+
+  it('does not plain-settle an exited missing worker when the archive was never committed', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    vi.mocked(runtime.showTerminal).mockRejectedValue(new Error('terminal_handle_stale'))
+    const resolveByIncarnation = vi.fn().mockReturnValue(null)
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+    inspectProcessLiveness.mockResolvedValue('exited')
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const receipt = (await call('orchestration.workerRelease', { dispatch: dispatchId })) as {
+      state: string
+      processAction: string
+    }
+
+    expect(receipt).toMatchObject({ state: 'release_unknown', processAction: 'none' })
+    expect(inspectProcessLiveness).toHaveBeenCalled()
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)).toMatchObject({
+      ownership_state: 'owned',
+      release_state: 'unknown'
+    })
+  })
+
+  it('settles released without a close when exited missing and an archive is already committed', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    const requested = db.requestWorkerTerminalRelease(dispatchId)
+    if (requested.disposition !== 'requested') {
+      throw new Error(`expected requested, got ${requested.disposition}`)
+    }
+    db.commitWorkerTerminalArchiveForRelease({
+      dispatchId,
+      resourceId: requested.resource.id,
+      kind: 'terminal_tail',
+      content: JSON.stringify({ lines: [] }),
+      archiveSource: 'terminal',
+      archiveStatus: 'empty'
+    })
+    vi.mocked(runtime.showTerminal).mockRejectedValue(new Error('terminal_handle_stale'))
+    const resolveByIncarnation = vi.fn().mockReturnValue(null)
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+    inspectProcessLiveness.mockResolvedValue('exited')
+
+    const receipt = await completeWorkerTerminalRelease({
+      runtime,
+      db,
+      dispatchId,
+      resource: db.getWorkerTerminalResource(requested.resource.id)!,
+      mode: 'interactive'
+    })
+
+    expect(receipt).toMatchObject({ state: 'released', processAction: 'none' })
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)).toMatchObject({
+      ownership_state: 'released',
+      release_state: 'released'
+    })
+  })
+
+  it('reaches settleDead before the lease check when a gone worker is exited with no live authority', async () => {
+    // Without a committed archive settleDead retains; lease must not run first and force
+    // retained/identity_unproven. Disposition is release_unknown (interactive) after the retain.
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    vi.mocked(runtime.showTerminal).mockRejectedValue(new Error('terminal_handle_stale'))
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const resolveByIncarnation = vi.fn().mockReturnValue(null)
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+    vi.mocked(runtime.getOrchestrationDispatchAuthority).mockReturnValue(null)
+    inspectProcessLiveness.mockResolvedValue('exited')
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const receipt = (await call('orchestration.workerRelease', { dispatch: dispatchId })) as {
+      state: string
+      processAction: string
+    }
+
+    expect(receipt).toMatchObject({ state: 'release_unknown', processAction: 'none' })
+    expect(receipt.state).not.toBe('retained')
+    expect(inspectProcessLiveness).toHaveBeenCalled()
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+  })
+
+  it('concedes release_unknown before the lease check when a gone worker has no live authority and liveness is unproven', async () => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    vi.mocked(runtime.showTerminal).mockRejectedValue(new Error('terminal_handle_stale'))
+    const resolveByIncarnation = vi.fn().mockReturnValue(null)
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+    vi.mocked(runtime.getOrchestrationDispatchAuthority).mockReturnValue(null)
+    // Liveness is unresolvable/not-exited: the process may have been re-homed, so concede rather
+    // than retain or guess at a live process.
+    inspectProcessLiveness.mockResolvedValue('live')
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const receipt = (await call('orchestration.workerRelease', { dispatch: dispatchId })) as {
+      state: string
+    }
+
+    expect(receipt.state).toBe('release_unknown')
+    expect(receipt.state).not.toBe('retained')
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)?.release_state).toBe('unknown')
+  })
+
+  it('workerStop closes a live worker via the reminted handle when the durable handle is stale', async () => {
+    setup()
+    const { dispatchId } = await startWorker()
+    // The durable handle stops resolving, but the recorded incarnation still names a live PTY.
+    vi.mocked(runtime.showTerminal).mockImplementation(async (handle) =>
+      handle === 'term_worker'
+        ? Promise.reject(new Error('terminal_handle_stale'))
+        : // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test fixture is deliberately shaped to exercise the private/runtime boundary.
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+          ({ handle, worktreeId: 'repo::worktree', status: 'running' } as never)
+    )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const resolveByIncarnation = vi.fn().mockReturnValue('term_reminted')
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const receipt = (await call('orchestration.workerStop', { dispatch: dispatchId })) as {
+      processAction: string
+    }
+
+    expect(receipt.processAction).toBe('closed_agent_terminal')
+    // The kill targeted exactly the reminted live handle, never the stale durable one — closing
+    // the stale handle would throw terminal_handle_stale and leak the PTY.
+    expect(runtime.closeTerminal).toHaveBeenCalledTimes(1)
+    expect(runtime.closeTerminal).toHaveBeenCalledWith('term_reminted')
+  })
+
+  it('workerRead reads a live worker via the reminted handle when the durable handle is stale', async () => {
+    setup()
+    const { dispatchId } = await startWorker()
+    vi.mocked(runtime.showTerminal).mockImplementation(
+      async (handle) =>
+        handle === 'term_worker'
+          ? Promise.reject(new Error('terminal_handle_stale'))
+          : // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test fixture is deliberately shaped to exercise the private/runtime boundary.
+            // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+            // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+            // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+            // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+            ({ handle, worktreeId: 'repo::worktree', status: 'running' } as never)
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    )
+    const resolveByIncarnation = vi.fn().mockReturnValue('term_reminted')
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const output = (await call('orchestration.workerRead', { dispatch: dispatchId })) as {
+      terminal?: { tail: string[] }
+    }
+
+    // Both the exact-session probe and the terminal read addressed the reminted handle.
+    expect(runtime.getExactWorkerProviderSession).toHaveBeenCalledWith(
+      'term_reminted',
+      expect.any(Number)
+    )
+    expect(runtime.readTerminal).toHaveBeenCalledWith('term_reminted', expect.anything())
+    expect(output.terminal?.tail).toEqual(['worker output line 1', 'worker output line 2'])
+  })
+
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+  it('recovery-mode: defers when exited missing has no archive rather than plain-settling', async () => {
+    // Proof of death still runs settleDead first; when it retains (no archive), recovery must
+    // stay release_pending — not plain-settle, not unknown.
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    vi.mocked(runtime.showTerminal).mockRejectedValue(new Error('terminal_handle_stale'))
+    const resolveByIncarnation = vi.fn().mockReturnValue(null)
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+    inspectProcessLiveness.mockResolvedValue('exited')
+    const requested = db.requestWorkerTerminalRelease(dispatchId)
+    if (requested.disposition !== 'requested') {
+      throw new Error(`expected a requested release, got ${requested.disposition}`)
+    }
+
+    const receipt = await completeWorkerTerminalRelease({
+      runtime,
+      db,
+      dispatchId,
+      resource: requested.resource,
+      mode: 'recovery'
+    })
+
+    expect(receipt).toMatchObject({ state: 'release_pending', processAction: 'none' })
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)).toMatchObject({
+      ownership_state: 'owned',
+      release_state: 'requested'
+    })
+  })
+
+  it('recovery-mode: settles released before the defer when exited missing already has an archive', async () => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    setup()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const { dispatchId } = await startSettledWorker()
+    vi.mocked(runtime.showTerminal).mockRejectedValue(new Error('terminal_handle_stale'))
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const resolveByIncarnation = vi.fn().mockReturnValue(null)
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+    inspectProcessLiveness.mockResolvedValue('exited')
+    const requested = db.requestWorkerTerminalRelease(dispatchId)
+    if (requested.disposition !== 'requested') {
+      throw new Error(`expected a requested release, got ${requested.disposition}`)
+    }
+    db.commitWorkerTerminalArchiveForRelease({
+      dispatchId,
+      resourceId: requested.resource.id,
+      kind: 'terminal_tail',
+      content: JSON.stringify({ lines: [] }),
+      archiveSource: 'terminal',
+      archiveStatus: 'empty'
+    })
+
+    const receipt = await completeWorkerTerminalRelease({
+      runtime,
+      db,
+      dispatchId,
+      resource: db.getWorkerTerminalResource(requested.resource.id)!,
+      mode: 'recovery'
+    })
+
+    expect(receipt).toMatchObject({ state: 'released', processAction: 'none' })
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)).toMatchObject({
+      ownership_state: 'released',
+      release_state: 'released'
+    })
+  })
+
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+  it('recovery-mode: defers release_pending when liveness is unverifiable rather than provably exited', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    vi.mocked(runtime.showTerminal).mockRejectedValue(new Error('terminal_handle_stale'))
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const resolveByIncarnation = vi.fn().mockReturnValue(null)
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+    // Not a death certificate: inventory may still be incomplete, so recovery must defer.
+    inspectProcessLiveness.mockResolvedValue('unverifiable')
+    const requested = db.requestWorkerTerminalRelease(dispatchId)
+    if (requested.disposition !== 'requested') {
+      throw new Error(`expected a requested release, got ${requested.disposition}`)
+    }
+
+    const receipt = await completeWorkerTerminalRelease({
+      runtime,
+      db,
+      dispatchId,
+      resource: requested.resource,
+      mode: 'recovery'
+    })
+
+    expect(receipt.state).toBe('release_pending')
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)?.release_state).not.toBe('released')
+  })
+})
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-release-reap-fixed.func.test.ts b/src/main/runtime/rpc/methods/orchestration-worker-release-reap-fixed.func.test.ts
new file mode 100644
index 00000000000..579f37eaf9e
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration-worker-release-reap-fixed.func.test.ts
@@ -0,0 +1,358 @@
+// PRB-0219 / upstream #18737 — FUNCTIONAL (integration) reproduction of the steady-state
+// worker-release reap LEAK.
+//
+// This is the "functional/integration" tier of the PRB-0219 test strategy. It wires the REAL
+// orchestration RPC surface (orchestration.workerStart / workerRelease / workerList), the REAL
+// OrchestrationDb, and the REAL release completion + observation modules against a fake runtime
+// that faithfully models the two identity planes involved in the bug:
+//
+//   * VOLATILE, epoch-fenced handle table  — `handleTable` keyed by terminal handle, each entry
+//     stamped with the `rendererGraphEpoch` at which it was issued. `showTerminal` resolves a
+//     handle ONLY while its stamped epoch matches the current epoch (mirrors getLiveLeafForHandle
+//     throwing 'terminal_handle_stale' on a rendererGraphEpoch bump). A relay reconnect / renderer
+//     remount on headless serve bumps the epoch.
+//   * DURABLE, incarnation-addressed process table — `ptysById` keyed by the ptyId embedded in the
+//     worker's persisted process_incarnation (`${ptyId}:${incarnationId}`). The pty stays LIVE
+//     across an epoch bump; nothing about the graph epoch kills the process.
+//
+// The bug (mechanism): when the epoch bumps, the durable db handle stops resolving through
+// showTerminal WHILE THE PTY IS STILL ALIVE. inspectWorkerTerminal swallows the throw and reports
+// `missing`; completeWorkerTerminalRelease then commits `release_unknown` and returns WITHOUT ever
+// calling runtime.closeTerminal — so the process/PTY leaks. On mtl-02 those orphans accumulate in
+// the orca-serve@factory cgroup until TasksMax=4096 is hit and Bun/omp abort() on EAGAIN.
+//
+// The observable leak signal asserted here: state 'release_unknown' + processAction 'none' +
+// closeTerminal NEVER called + the pty STILL alive in ptysById + worker-list terminalState stuck
+// on 'release_unknown' (never 'released').
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { ORCHESTRATION_METHODS } from './orchestration'
+import { eraseRpcMethods, type RpcContext } from '../core'
+import { OrchestrationDb } from '../../orchestration/db'
+import { OrcaRuntimeService } from '../../orca-runtime'
+
+describe('PRB-0219 worker-release reap FIX (functional verification)', () => {
+  let db: OrchestrationDb
+  let dbOpen = false
+  let runtime: OrcaRuntimeService
+  let ctx: RpcContext
+  let activeRunId: string
+
+  const coordinatorPaneKey = 'tab_coord:aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa'
+  const workerPaneKey = 'tab_worker:bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb'
+
+  // Dispatch/automation ptyId shape: `${repoId}::${worktreePath}@@${suffix}` (executionHostId:null).
+  const PTY_ID = 'repo-7f3a::/data/wt/factory-task-1@@a1b2c3d4'
+  const INCARNATION_ID = 1
+  const PROCESS_INCARNATION = `${PTY_ID}:${INCARNATION_ID}`
+
+  // ---- fake runtime process/handle planes (module-level so spies can mutate them) ----
+  let ptysById: Map<string, { incarnationId: number; alive: boolean }>
+  let handleTable: Map<string, { ptyId: string; epoch: number }>
+  let rendererGraphEpoch: number
+  let closedPtyIds: string[]
+
+  /** Resolve a handle to its live pty only while its stamped graph epoch is current. */
+  function resolveHandleToLivePty(
+    handle: string
+  ): { ptyId: string; pty: { incarnationId: number; alive: boolean } } | null {
+    const entry = handleTable.get(handle)
+    if (!entry) {
+      return null
+    }
+    if (entry.epoch !== rendererGraphEpoch) {
+      // rendererGraphEpoch fence: the durable handle no longer resolves to a live leaf.
+      return null
+    }
+    const pty = ptysById.get(entry.ptyId)
+    if (!pty || !pty.alive) {
+      return null
+    }
+    return { ptyId: entry.ptyId, pty }
+  }
+
+  /** Wire the real RPC surface and db against the two-plane fake runtime. */
+  function setup(): void {
+    ptysById = new Map([
+      ['coord-pty', { incarnationId: 1, alive: true }],
+      [PTY_ID, { incarnationId: INCARNATION_ID, alive: true }]
+    ])
+    handleTable = new Map([
+      ['term_coord', { ptyId: 'coord-pty', epoch: 0 }],
+      ['term_worker', { ptyId: PTY_ID, epoch: 0 }]
+    ])
+    rendererGraphEpoch = 0
+    closedPtyIds = []
+
+    db = new OrchestrationDb(':memory:')
+    dbOpen = true
+    runtime = new OrcaRuntimeService()
+    runtime.setOrchestrationDb(db)
+
+    // Incarnation-addressed liveness probe: reads the DURABLE plane, so it stays 'live' across the
+    // epoch bump (the process really is still running). Matches the real asymmetry.
+    vi.spyOn(runtime, 'inspectTerminalProcessIncarnationLiveness').mockImplementation(
+      async (incarnation: string) => {
+        const idx = incarnation.lastIndexOf(':')
+        const ptyId = incarnation.slice(0, idx)
+        const pty = ptysById.get(ptyId)
+        return pty?.alive ? 'live' : 'exited'
+      }
+    )
+
+    // The incarnation-addressed re-resolution primitive the fix adds. Present here as a spy so the
+    // same harness proves BOTH tiers: pre-fix completion never calls it (leak); post-fix completion
+    // calls it to remint a live handle (reap). Fence: EXACT incarnationId match only.
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      (incarnation: string): string | null => {
+        const idx = incarnation.lastIndexOf(':')
+        const ptyId = incarnation.slice(0, idx)
+        const inc = Number(incarnation.slice(idx + 1))
+        const pty = ptysById.get(ptyId)
+        if (!pty || !pty.alive) {
+          return null
+        }
+        if (pty.incarnationId !== inc) {
+          // Fence: a reused ptyId with a different incarnation must NOT resolve.
+          return null
+        }
+        // Remint a live handle at the current graph epoch.
+        handleTable.set('term_reminted', { ptyId, epoch: rendererGraphEpoch })
+        return 'term_reminted'
+      }
+    )
+
+    // Identity plane (durable) — answers for the original AND any reminted handle. Independent of
+    // the graph epoch, exactly like the real getTerminal* accessors that read dispatch authority.
+    const knownWorkerHandle = (handle: string): boolean =>
+      handle === 'term_worker' || handle === 'term_reminted'
+    vi.spyOn(runtime, 'getTerminalPaneKey').mockImplementation((handle) =>
+      handle === 'term_coord'
+        ? coordinatorPaneKey
+        : knownWorkerHandle(handle)
+          ? workerPaneKey
+          : null
+    )
+    vi.spyOn(runtime, 'getTerminalProcessIncarnation').mockImplementation((handle) =>
+      knownWorkerHandle(handle) ? PROCESS_INCARNATION : null
+    )
+    vi.spyOn(runtime, 'getOrchestrationDispatchAuthority').mockImplementation((handle) =>
+      knownWorkerHandle(handle)
+        ? // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test fixture is deliberately shaped to exercise the private/runtime boundary.
+          ({
+            terminalHandle: handle,
+            paneKey: workerPaneKey,
+            processIncarnation: PROCESS_INCARNATION,
+            hostScope: { kind: 'local', hostId: 'local' }
+            // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+            // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+          } as never)
+        : null
+    )
+    vi.spyOn(runtime, 'validateOrchestrationAgentLauncher').mockImplementation(() => {})
+
+    // Volatile handle resolution — epoch-fenced. Throws 'terminal_handle_stale' once the epoch
+    // moves past the epoch at which the handle was issued.
+    vi.spyOn(runtime, 'showTerminal').mockImplementation(async (handle) => {
+      if (!resolveHandleToLivePty(handle)) {
+        throw new Error('terminal_handle_stale')
+      }
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      return { handle, worktreeId: 'repo::worktree', status: 'running' } as never
+    })
+
+    // The reap: closing a handle kills exactly the pty it resolves to.
+    vi.spyOn(runtime, 'closeTerminal').mockImplementation(async (handle) => {
+      const live = resolveHandleToLivePty(handle)
+      if (!live) {
+        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+        return { handle, tabId: null, ptyKilled: false } as never
+      }
+      live.pty.alive = false
+      ptysById.delete(live.ptyId)
+      closedPtyIds.push(live.ptyId)
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      return { handle, tabId: `tab:${live.ptyId}`, ptyKilled: true } as never
+    })
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // Remaining runtime surface required to start + settle a worker (mirrors the unit harness).
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    vi.spyOn(runtime, 'showManagedTerminalWorkspace').mockResolvedValue({
+      id: 'repo::worktree'
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    } as never)
+    vi.spyOn(runtime, 'createTerminal').mockResolvedValue({
+      handle: 'term_worker',
+      worktreeId: 'repo::worktree',
+      title: 'worker'
+    })
+    vi.spyOn(runtime, 'waitForTerminal').mockResolvedValue({
+      handle: 'term_worker',
+      condition: 'tui-idle',
+      satisfied: true,
+      status: 'running',
+      exitCode: null
+    })
+    vi.spyOn(runtime, 'getTerminalOrchestrationCliCommand').mockReturnValue('orca')
+    vi.spyOn(runtime, 'sendTerminalAgentPrompt').mockResolvedValue({
+      handle: 'term_worker',
+      accepted: true,
+      bytesWritten: 1
+    })
+    vi.spyOn(runtime, 'isTerminalRunningAgent').mockResolvedValue(true)
+    vi.spyOn(runtime, 'getExactWorkerProviderSession').mockReturnValue(null)
+    vi.spyOn(runtime, 'readTerminal').mockResolvedValue({
+      handle: 'term_worker',
+      status: 'running',
+      tail: ['worker output line 1', 'worker output line 2'],
+      truncated: false,
+      nextCursor: '2'
+    })
+    vi.spyOn(runtime, 'notifyMessageArrived').mockImplementation(() => {})
+
+    activeRunId = db.createRun({
+      objective: 'PRB-0219 reap leak fixture',
+      coordinatorHandle: 'term_coord',
+      coordinatorPaneKey
+    }).id
+    ctx = { runtime }
+  }
+
+  afterEach(() => {
+    if (dbOpen) {
+      dbOpen = false
+      db.close()
+    }
+    vi.restoreAllMocks()
+  })
+
+  /** Look up a registered orchestration RPC method by name. */
+  function findMethod(name: string) {
+    const method = eraseRpcMethods(ORCHESTRATION_METHODS).find((m) => m.name === name)
+    if (!method) {
+      throw new Error(`Method not found: ${name}`)
+    }
+    return method
+  }
+
+  /** Parse a method's params and invoke its handler against the shared ctx. */
+  async function call(name: string, params: Record<string, unknown>) {
+    const method = findMethod(name)
+    const parsed = method.params ? method.params.parse(params) : undefined
+    return method.handler(parsed, ctx)
+  }
+
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+  /** Start a worker and settle its report, the state a release acts on. */
+  async function startSettledWorker(): Promise<{ taskId: string; dispatchId: string }> {
+    const task = db.createTask({ spec: 'reap-leak fixture task', runId: activeRunId })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const result = (await call('orchestration.workerStart', {
+      task: task.id,
+      from: 'term_coord',
+      agent: 'codex'
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    })) as { dispatchId: string; state: string }
+    expect(result.state).toBe('ready')
+    const settlement = db.settleWorkerReport({
+      taskId: task.id,
+      dispatchId: result.dispatchId,
+      outcome: 'succeeded',
+      result: 'worker succeeded'
+    })
+    expect(settlement.action).toBe('settled')
+    return { taskId: task.id, dispatchId: result.dispatchId }
+  }
+
+  /** The terminalState workerList projects for a dispatch, or null. */
+  async function workerTerminalState(dispatchId: string): Promise<string | null> {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const listed = (await call('orchestration.workerList', { run: activeRunId })) as {
+      workers: { dispatchId: string; terminalState: string | null }[]
+    }
+    return listed.workers.find((w) => w.dispatchId === dispatchId)?.terminalState ?? null
+  }
+
+  it('REAP (fixed): a rendererGraphEpoch bump strands the durable handle, but the incarnation fallback remints a live handle and reaps the process', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    const resource = db.getWorkerTerminalResourceByOwner(dispatchId)
+    expect(resource?.process_incarnation).toBe(PROCESS_INCARNATION)
+
+    // Relay reconnect / renderer remount bumps the graph epoch: the durable handle goes stale
+    // while the PTY stays alive.
+    rendererGraphEpoch = 1
+    await expect(runtime.showTerminal('term_worker')).rejects.toThrow('terminal_handle_stale')
+    expect(ptysById.get(PTY_ID)?.alive).toBe(true)
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const receipt = (await call('orchestration.workerRelease', { dispatch: dispatchId })) as {
+      state: string
+      processAction: string
+    }
+
+    // The fix: inspectWorkerTerminal re-resolved the live PTY by process incarnation, reminted a
+    // handle, and completion closed THAT handle — the process is actually reaped.
+    expect(receipt.state).toBe('released')
+    expect(receipt.processAction).toBe('closed_agent_terminal')
+    expect(runtime.closeTerminal).toHaveBeenCalledWith('term_reminted')
+    expect(closedPtyIds).toEqual([PTY_ID])
+    expect(ptysById.has(PTY_ID)).toBe(false)
+    expect(await workerTerminalState(dispatchId)).toBe('released')
+  })
+
+  it('CONTROL: with the graph epoch intact the same release reaps exactly that PTY', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker()
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const receipt = (await call('orchestration.workerRelease', { dispatch: dispatchId })) as {
+      state: string
+      processAction: string
+    }
+
+    expect(receipt.state).toBe('released')
+    expect(receipt.processAction).toBe('closed_agent_terminal')
+    expect(closedPtyIds).toEqual([PTY_ID])
+    expect(ptysById.has(PTY_ID)).toBe(false)
+    expect(await workerTerminalState(dispatchId)).toBe('released')
+  })
+
+  it('FENCE (fixed): a reused ptyId carrying a different incarnation must NOT remint or close — stays release_unknown', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker()
+
+    // The graph epoch bumps AND the ptyId has been reused by a different process (incarnation 2),
+    // while the worker's recorded incarnation is still 1. The exact-incarnation fence must refuse.
+    rendererGraphEpoch = 1
+    const reused = ptysById.get(PTY_ID)
+    if (reused) {
+      reused.incarnationId = 2
+    }
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const receipt = (await call('orchestration.workerRelease', { dispatch: dispatchId })) as {
+      state: string
+      processAction: string
+    }
+
+    expect(receipt.state).toBe('release_unknown')
+    expect(receipt.processAction).toBe('none')
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    // The other lane's live process is left untouched (never reaped by an over-broad match).
+    expect(ptysById.get(PTY_ID)?.alive).toBe(true)
+    expect(await workerTerminalState(dispatchId)).toBe('release_unknown')
+  })
+})
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-start-mode-selection.test.ts b/src/main/runtime/rpc/methods/orchestration-worker-start-mode-selection.test.ts
index 52cf3579016..a2beea9ea05 100644
--- a/src/main/runtime/rpc/methods/orchestration-worker-start-mode-selection.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-worker-start-mode-selection.test.ts
@@ -30,7 +30,7 @@ vi.mock('./orchestration/federation/federated-worker-start', () => ({
 }))
 vi.mock('./orchestration-structured-worker-session', async (importOriginal) => ({
   ...(await importOriginal<Record<string, unknown>>()),
-  sendStructuredWorkerPreamble: async () => {},
+  sendStructuredWorkerPreamble: async () => 'accepted',
   releaseStructuredWorkerSession: () => {},
   discardStructuredWorkerSession: async () => {}
 }))
diff --git a/src/main/runtime/rpc/methods/orchestration/federation/federated-worker-start.ts b/src/main/runtime/rpc/methods/orchestration/federation/federated-worker-start.ts
index a7c59b7064b..957b4a6dde7 100644
--- a/src/main/runtime/rpc/methods/orchestration/federation/federated-worker-start.ts
+++ b/src/main/runtime/rpc/methods/orchestration/federation/federated-worker-start.ts
@@ -1,3 +1,4 @@
+import type { OrchestrationSessionCaller } from '../../../../orchestration/orchestration-caller-identity'
 import { isTuiAgent } from '../../../../../../shared/tui-agent-config'
 import type { RuntimeStatus } from '../../../../../../shared/runtime-types'
 import {
@@ -45,6 +46,8 @@ export async function startFederatedWorker(args: {
     method: string
     payloadHash: string
   }
+  /** The coordinator's resolved session, when it is one; recorded as the Dispatch creator. */
+  callerSession?: OrchestrationSessionCaller
 }): Promise<unknown> {
   const { params, runtime, db, task, runId, orchestrationMutation } = args
   if (!isWorkerStartTimeoutWithinTimerLimit(params.timeoutMs)) {
@@ -117,7 +120,7 @@ export async function startFederatedWorker(args: {
 
   const setupDecision = createsWorktree ? (params.setup ?? 'run') : 'not_applicable'
   const started = db.createStartingWorkerDispatch({
-    creator: resolveDispatchCreator(runtime, params.from),
+    creator: resolveDispatchCreator(runtime, params.from, args.callerSession),
     maxDepth: runtime.getNestedWorkerMaxDepth(),
     taskId: task?.id,
     taskSpec: params.spec,
diff --git a/src/main/runtime/rpc/methods/orchestration/federation/federation.ts b/src/main/runtime/rpc/methods/orchestration/federation/federation.ts
index 6f7a1bba077..067f583e37b 100644
--- a/src/main/runtime/rpc/methods/orchestration/federation/federation.ts
+++ b/src/main/runtime/rpc/methods/orchestration/federation/federation.ts
@@ -114,6 +114,7 @@ export const ORCHESTRATION_FEDERATION_ATTACH_METHODS = [
             observeSetupCompletion: true,
             createdWithAgent: agent as TuiAgent,
             startupAgent: agent as TuiAgent,
+            startupLaunchSource: 'orchestration',
             ...(launch.preferences ? { startupLaunchPreferences: launch.preferences } : {}),
             activate: false,
             lineage: { noParent: true }
@@ -185,6 +186,7 @@ export const ORCHESTRATION_FEDERATION_ATTACH_METHODS = [
               // Why: agent ids are not shell commands (`cursor` is the desktop app,
               // its CLI is `cursor-agent`); resolve through the TUI agent config.
               startupAgent: agent as TuiAgent,
+              launchSource: 'orchestration',
               ...(launch.preferences ? { launchPreferences: launch.preferences } : {}),
               title: `worker-${params.taskId}`,
               presentation: 'background'
diff --git a/src/main/runtime/rpc/methods/orchestration/gates/gates.ts b/src/main/runtime/rpc/methods/orchestration/gates/gates.ts
index 29be91b4324..f0736db916c 100644
--- a/src/main/runtime/rpc/methods/orchestration/gates/gates.ts
+++ b/src/main/runtime/rpc/methods/orchestration/gates/gates.ts
@@ -84,7 +84,10 @@ export const ORCHESTRATION_GATE_METHODS = [
   defineMethod({
     name: 'orchestration.gateCreate',
     params: GateCreateParams,
-    handler: (params, { orchestrationCompatibilityEvidence, runtime, legacyCoordinatorRunId }) => {
+    handler: (
+      params,
+      { orchestrationCompatibilityEvidence, orchestrationCaller, runtime, legacyCoordinatorRunId }
+    ) => {
       const db = runtime.getOrchestrationDb()
       let options: string[] | undefined
       if (params.options) {
@@ -107,7 +110,8 @@ export const ORCHESTRATION_GATE_METHODS = [
         callerTerminalHandle: params.from,
         requireCurrentConsumer: true,
         legacyCoordinatorRunId,
-        callerEvidence: orchestrationCompatibilityEvidence
+        callerEvidence: orchestrationCompatibilityEvidence,
+        callerSession: orchestrationCaller
       })
       if (task.run_id !== run.id) {
         throw taskNotFoundError(`Task ${params.task} was not found in Run ${run.id}.`, {
@@ -127,7 +131,10 @@ export const ORCHESTRATION_GATE_METHODS = [
   defineMethod({
     name: 'orchestration.gateResolve',
     params: GateResolveParams,
-    handler: (params, { orchestrationCompatibilityEvidence, runtime, legacyCoordinatorRunId }) => {
+    handler: (
+      params,
+      { orchestrationCompatibilityEvidence, orchestrationCaller, runtime, legacyCoordinatorRunId }
+    ) => {
       const db = runtime.getOrchestrationDb()
       const existing = db.getGate(params.id)
       if (!existing) {
@@ -138,7 +145,8 @@ export const ORCHESTRATION_GATE_METHODS = [
         callerTerminalHandle: params.from,
         requireCurrentConsumer: true,
         legacyCoordinatorRunId,
-        callerEvidence: orchestrationCompatibilityEvidence
+        callerEvidence: orchestrationCompatibilityEvidence,
+        callerSession: orchestrationCaller
       })
       // Why: a gate outside the caller's Run is indistinguishable from a missing one, so probing cannot map foreign Runs.
       if (existing.run_id !== run.id) {
@@ -155,7 +163,10 @@ export const ORCHESTRATION_GATE_METHODS = [
   defineMethod({
     name: 'orchestration.gateList',
     params: GateListParams,
-    handler: (params, { orchestrationCompatibilityEvidence, runtime, legacyCoordinatorRunId }) => {
+    handler: (
+      params,
+      { orchestrationCompatibilityEvidence, orchestrationCaller, runtime, legacyCoordinatorRunId }
+    ) => {
       const db = runtime.getOrchestrationDb()
       const explicitRun = params.run ? db.getRun(params.run) : undefined
       // Why: same read posture as taskList — an explicitly named Run is inspectable, an unnamed one means the caller's own.
@@ -167,7 +178,8 @@ export const ORCHESTRATION_GATE_METHODS = [
               callerTerminalHandle: params.from,
               requireCurrentConsumer: params.run === undefined,
               legacyCoordinatorRunId,
-              callerEvidence: orchestrationCompatibilityEvidence
+              callerEvidence: orchestrationCompatibilityEvidence,
+              callerSession: orchestrationCaller
             })
       const gates = db
         .listGates({
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/ask-methods.ts b/src/main/runtime/rpc/methods/orchestration/messaging/ask-methods.ts
index ef191250a8b..9b49e7a07a1 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/ask-methods.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/ask-methods.ts
@@ -5,6 +5,11 @@ import { isGroupAddress } from '../../../../orchestration/groups'
 import { AskParams } from '../schemas'
 import { rejectFederatedExplicitTarget } from '../routing'
 import { askRemoteRunHome } from './ask-remote'
+import {
+  mailboxAddressOf,
+  runCoordinatorKey
+} from '../../../../orchestration/orchestration-caller-identity'
+import { resolveOrchestrationParty } from '../../../../orchestration/orchestration-party'
 
 export const ORCHESTRATION_ASK_METHODS = [
   defineMethod({
@@ -87,7 +92,12 @@ export const ORCHESTRATION_ASK_METHODS = [
             `Dispatch ${activeDispatch.id} belongs to Run ${run.id}, not ${params.run}.`
           )
         }
-        if (params.to && params.to !== `run:${run.id}` && params.to !== run.coordinator_handle) {
+        if (
+          params.to &&
+          params.to !== `run:${run.id}` &&
+          resolveOrchestrationParty(params.to, db).address !==
+            mailboxAddressOf(runCoordinatorKey(run))
+        ) {
           throw new OrchestrationError(
             'dispatch_run_mismatch',
             `ask from Dispatch ${activeDispatch.id} must target its owning Run ${run.id}.`
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/check-methods.ts b/src/main/runtime/rpc/methods/orchestration/messaging/check-methods.ts
index 20ac25e6512..b9aa437e179 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/check-methods.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/check-methods.ts
@@ -6,6 +6,8 @@ import { checkRunMailbox } from './check-run'
 import { checkWorkerMailbox } from './check-worker'
 import { checkDirectMailbox } from './check-direct'
 import { orchestrationSkillRecoveryData } from '../../../../../../shared/orchestration-rpc-contract'
+import { hasRunBindingKey } from '../../../../orchestration/orchestration-caller-identity'
+import { orchestrationCallerIdentity } from '../runs/run-scope'
 import {
   callerHoldsDispatchPane,
   dispatchFenced,
@@ -20,6 +22,7 @@ export const ORCHESTRATION_CHECK_METHODS = [
       params,
       {
         orchestrationCompatibilityEvidence,
+        orchestrationCaller,
         runtime,
         signal,
         legacyCoordinatorRunId,
@@ -31,9 +34,14 @@ export const ORCHESTRATION_CHECK_METHODS = [
       const handle = params.terminal ?? 'unknown'
       const typeFilter = parseMessageTypes(params.types)
 
-      // Why: a live runtime handle is authoritative; pane metadata is only the restart fallback.
-      const paneKey = runtime.getTerminalPaneKey(handle) ?? params.terminalPaneKey
-      const boundRun = paneKey ? db.getCurrentRunForPane(paneKey) : undefined
+      const caller = orchestrationCallerIdentity(runtime, {
+        handle,
+        session: orchestrationCaller,
+        // Why: a live runtime handle is authoritative; pane metadata is only the restart fallback.
+        paneKey: runtime.getTerminalPaneKey(handle) ?? params.terminalPaneKey
+      })
+      const paneKey = caller.paneKey ?? undefined
+      const boundRun = hasRunBindingKey(caller) ? db.getCurrentRunForCoordinator(caller) : undefined
       if (params.run || boundRun) {
         return checkRunMailbox({
           params,
@@ -41,6 +49,7 @@ export const ORCHESTRATION_CHECK_METHODS = [
           db,
           handle,
           paneKey,
+          callerSession: orchestrationCaller,
           typeFilter,
           signal,
           legacyCoordinatorRunId,
@@ -80,7 +89,8 @@ export const ORCHESTRATION_CHECK_METHODS = [
           typeFilter,
           signal,
           activeDispatch,
-          remoteAttachment
+          remoteAttachment,
+          recordMutationReceipt
         })
       }
       const consumingCheck = params.peek !== true && params.all !== true && params.unread !== false
@@ -93,7 +103,7 @@ export const ORCHESTRATION_CHECK_METHODS = [
       }
       // Why: a consuming check on a handle with no live pane and no Dispatch can never see
       // Run mail, so an empty inbox would read as "nothing yet" instead of a stale caller.
-      if (!paneKey && consumingCheck) {
+      if (!hasRunBindingKey(caller) && consumingCheck) {
         throw new OrchestrationError(
           'stable_pane_required',
           `Terminal ${handle} has no live pane bound to a Run, so this inbox can never receive Run mail. Rebind this terminal with orchestration run-use, or read the Run mailbox with --run <run_id>.`,
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/check-run-pending-mail.ts b/src/main/runtime/rpc/methods/orchestration/messaging/check-run-pending-mail.ts
new file mode 100644
index 00000000000..5d453616f35
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/check-run-pending-mail.ts
@@ -0,0 +1,140 @@
+import type { MessageType, OrchestrationDb, RunRow } from '../../../../orchestration/db'
+import type { OrcaRuntimeService } from '../../../../orca-runtime'
+import { interruptedAcknowledgedCheck } from '../routing'
+import { checkWorkerMailbox } from './check-worker'
+import { currentDispatchAssigneeRun } from './recipient-routing'
+import { callerHoldsDispatchPane, dispatchFenced } from './dispatch-mailbox-fence'
+import { orchestrationCallerIdentity } from '../runs/run-scope'
+import type { OrchestrationSessionCaller } from '../../../../orchestration/orchestration-caller-identity'
+import type { CheckParams } from '../schemas'
+import type { z } from 'zod'
+
+export async function checkRunPendingMail(args: {
+  params: z.infer<typeof CheckParams>
+  runtime: OrcaRuntimeService
+  db: OrchestrationDb
+  run: RunRow
+  handle: string
+  paneKey: string | undefined
+  callerSession: OrchestrationSessionCaller | undefined
+  typeFilter: MessageType[] | undefined
+  signal: AbortSignal | undefined
+  revalidateConsumer: () => void
+  recordMutationReceipt: ((receipt: unknown) => void) | undefined
+}): Promise<{ acknowledged?: string; result?: unknown }> {
+  const {
+    params,
+    runtime,
+    db,
+    run,
+    handle,
+    paneKey,
+    typeFilter,
+    signal,
+    revalidateConsumer,
+    recordMutationReceipt
+  } = args
+  const generation = run.consumer_generation
+  const address = `run:${run.id}`
+  // Drain pre-bind mail through its original Dispatch owner, never by changing its Run.
+  const residual = !params.run ? db.getActiveDispatchForIdentity(handle, paneKey) : undefined
+  const caller = orchestrationCallerIdentity(runtime, {
+    handle,
+    paneKey,
+    session: args.callerSession
+  })
+  const residualAck =
+    params.ack &&
+    residual &&
+    db.getDeliveryRaw(params.ack)?.mailbox_handle === `dispatch:${residual.id}`
+      ? params.ack
+      : undefined
+  const acknowledgeRun = () =>
+    params.ack
+      ? db.acknowledgeRunDelivery({
+          runId: run.id,
+          consumerGeneration: generation,
+          deliveryId: params.ack
+        })
+      : undefined
+  let acknowledged: { delivery: { id: string } } | undefined = residualAck
+    ? undefined
+    : acknowledgeRun()
+  const recordAcknowledged = () => {
+    if (acknowledged) {
+      recordMutationReceipt?.(
+        interruptedAcknowledgedCheck(run.id, acknowledged.delivery.id, 'outcome_unknown')
+      )
+    }
+  }
+  recordAcknowledged()
+  if (
+    residual &&
+    residual.run_id !== run.id &&
+    (residual.assignee_orca_session_id === null ||
+      residual.assignee_orca_session_id === caller.orcaSessionId) &&
+    callerHoldsDispatchPane(residual, paneKey) &&
+    currentDispatchAssigneeRun(runtime, db, residual)?.id === run.id &&
+    (residualAck || !db.hasOutstandingMailboxDelivery(address))
+  ) {
+    const result = await checkWorkerMailbox({
+      params: { ...params, ack: residualAck, wait: false },
+      runtime,
+      db,
+      handle,
+      paneKey,
+      typeFilter,
+      signal,
+      activeDispatch: residual,
+      remoteAttachment: undefined,
+      wakeTypes: params.wait ? typeFilter : undefined,
+      // Accept the original owner's ack without creating a batch ahead of Run replay.
+      deferDelivery: () => db.hasOutstandingMailboxDelivery(address),
+      revalidateConsumer: () => {
+        revalidateConsumer()
+        const current = db.getActiveDispatchForIdentity(handle, paneKey)
+        if (
+          !current ||
+          current.id !== residual.id ||
+          currentDispatchAssigneeRun(runtime, db, current)?.id !== run.id
+        ) {
+          throw dispatchFenced()
+        }
+      },
+      recordMutationReceipt
+    })
+    if (result?.acknowledged) {
+      acknowledged = { delivery: { id: result.acknowledged } }
+    }
+    recordAcknowledged()
+    try {
+      revalidateConsumer()
+    } catch (error) {
+      if (acknowledged) {
+        return {
+          acknowledged: acknowledged.delivery.id,
+          result: interruptedAcknowledgedCheck(run.id, acknowledged.delivery.id, 'consumer_fenced')
+        }
+      }
+      throw error
+    }
+    const inspectingHistory =
+      params.all === true || (params.unread === false && params.peek !== true)
+    if (
+      result &&
+      result.count > 0 &&
+      (!inspectingHistory || db.getUnreadMessages(`dispatch:${residual.id}`).length > 0)
+    ) {
+      return {
+        acknowledged: acknowledged?.delivery.id,
+        result: { ...result, acknowledged: acknowledged?.delivery.id ?? null }
+      }
+    }
+  }
+
+  // A supplied Delivery outside this caller's current Dispatch must still fail acknowledgment.
+  if (params.ack && !acknowledged) {
+    acknowledgeRun()
+  }
+  return { acknowledged: acknowledged?.delivery.id }
+}
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/check-run.ts b/src/main/runtime/rpc/methods/orchestration/messaging/check-run.ts
index 6db89cf4a20..c48141cf7dd 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/check-run.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/check-run.ts
@@ -9,6 +9,8 @@ import { routeAllMailboxPages } from '../schemas'
 import { resolveRunScope } from '../runs/run-scope'
 import type { CheckParams } from '../schemas'
 import type { z } from 'zod'
+import type { OrchestrationSessionCaller } from '../../../../orchestration/orchestration-caller-identity'
+import { checkRunPendingMail } from './check-run-pending-mail'
 
 type CheckParamsInput = z.infer<typeof CheckParams>
 
@@ -18,6 +20,7 @@ export async function checkRunMailbox(args: {
   db: OrchestrationDb
   handle: string
   paneKey: string | undefined
+  callerSession: OrchestrationSessionCaller | undefined
   typeFilter: MessageType[] | undefined
   signal: AbortSignal | undefined
   legacyCoordinatorRunId: string | undefined
@@ -31,12 +34,12 @@ export async function checkRunMailbox(args: {
     db,
     handle,
     paneKey,
+    callerSession,
     typeFilter,
     signal,
     legacyCoordinatorRunId,
     revalidateLegacyCoordinator,
-    orchestrationCompatibilityEvidence,
-    recordMutationReceipt
+    orchestrationCompatibilityEvidence
   } = args
   const routeDirectSnapshot = async (
     runId: string,
@@ -52,6 +55,7 @@ export async function checkRunMailbox(args: {
     runId: params.run,
     callerTerminalHandle: handle,
     callerPaneKey: paneKey,
+    callerSession,
     requireCurrentConsumer: true,
     legacyCoordinatorRunId,
     callerEvidence: orchestrationCompatibilityEvidence
@@ -68,40 +72,45 @@ export async function checkRunMailbox(args: {
       db.routeUnreadDirectMessagesToRunMailbox(run.id, coordinatorHandle, throughSequence)
     )
   }
-  revalidateLegacyCoordinator?.()
-  const currentRun = resolveRunScope(runtime, {
-    runId: run.id,
-    callerTerminalHandle: handle,
-    callerPaneKey: paneKey,
-    requireCurrentConsumer: true,
-    legacyCoordinatorRunId,
-    callerEvidence: orchestrationCompatibilityEvidence
-  })
-  if (currentRun.consumer_generation !== generation) {
-    throw new OrchestrationError(
-      'consumer_fenced',
-      'This mailbox consumer was replaced while routing pending mail.'
-    )
+  const revalidateConsumer = (): void => {
+    revalidateLegacyCoordinator?.()
+    const currentRun = resolveRunScope(runtime, {
+      runId: run.id,
+      callerTerminalHandle: handle,
+      callerPaneKey: paneKey,
+      callerSession,
+      requireCurrentConsumer: true,
+      legacyCoordinatorRunId,
+      callerEvidence: orchestrationCompatibilityEvidence
+    })
+    if (currentRun.consumer_generation !== generation) {
+      throw new OrchestrationError(
+        'consumer_fenced',
+        'This mailbox consumer was replaced while routing pending mail.'
+      )
+    }
   }
+  revalidateConsumer()
 
-  const acknowledged = params.ack
-    ? db.acknowledgeRunDelivery({
-        runId: run.id,
-        consumerGeneration: generation,
-        deliveryId: params.ack
-      })
-    : undefined
-  if (acknowledged) {
-    recordMutationReceipt?.(
-      interruptedAcknowledgedCheck(run.id, acknowledged.delivery.id, 'outcome_unknown')
-    )
+  const pending = await checkRunPendingMail({ ...args, run, revalidateConsumer })
+  try {
+    revalidateConsumer()
+  } catch (error) {
+    if (pending.acknowledged) {
+      return interruptedAcknowledgedCheck(run.id, pending.acknowledged, 'consumer_fenced')
+    }
+    throw error
   }
+  if (pending.result) {
+    return pending.result
+  }
+  const acknowledged = pending.acknowledged
   if (params.all || (params.unread === false && !params.peek)) {
     const messages = db.getRunMailboxHistory(run.id, 100, typeFilter)
     const result = {
       messages: exposeMessages(messages),
       count: messages.length,
-      acknowledged: acknowledged?.delivery.id ?? null
+      acknowledged: acknowledged ?? null
     }
     if (params.format || params.inject) {
       return {
@@ -117,7 +126,7 @@ export async function checkRunMailbox(args: {
     runId: run.id,
     messages: exposeMessages(messages),
     count: messages.length,
-    acknowledged: acknowledged?.delivery.id ?? null,
+    acknowledged: acknowledged ?? null,
     ...(params.format || params.inject
       ? { formatted: messages.map(formatMessageBanner).join('\n\n') }
       : {})
@@ -137,7 +146,7 @@ export async function checkRunMailbox(args: {
       messages: exposeMessages(current.messages),
       count: current.messages.length,
       replayed: current.replayed,
-      acknowledged: acknowledged?.delivery.id ?? null,
+      acknowledged: acknowledged ?? null,
       timedOut: false,
       cancelled: false,
       connectionLost: false,
@@ -155,7 +164,7 @@ export async function checkRunMailbox(args: {
       deliveryId: null,
       messages: [],
       count: 0,
-      acknowledged: acknowledged?.delivery.id ?? null,
+      acknowledged: acknowledged ?? null,
       timedOut: false,
       cancelled: false,
       connectionLost: false
@@ -169,17 +178,17 @@ export async function checkRunMailbox(args: {
     exclusive: true
   })
   try {
-    revalidateLegacyCoordinator?.()
+    revalidateConsumer()
   } catch (error) {
     if (!acknowledged) {
       throw error
     }
-    return interruptedAcknowledgedCheck(run.id, acknowledged.delivery.id, 'consumer_fenced')
+    return interruptedAcknowledgedCheck(run.id, acknowledged, 'consumer_fenced')
   }
   const latestRun = db.getRun(run.id)
   if (!latestRun || latestRun.consumer_generation !== generation) {
     if (acknowledged) {
-      return interruptedAcknowledgedCheck(run.id, acknowledged.delivery.id, 'consumer_fenced')
+      return interruptedAcknowledgedCheck(run.id, acknowledged, 'consumer_fenced')
     }
     throw new OrchestrationError(
       'consumer_fenced',
@@ -188,7 +197,7 @@ export async function checkRunMailbox(args: {
   }
   if (waitResult === 'waiter_exists') {
     if (acknowledged) {
-      return interruptedAcknowledgedCheck(run.id, acknowledged.delivery.id, 'waiter_exists')
+      return interruptedAcknowledgedCheck(run.id, acknowledged, 'waiter_exists')
     }
     throw new OrchestrationError(
       'waiter_exists',
@@ -204,7 +213,7 @@ export async function checkRunMailbox(args: {
       deliveryId: null,
       messages: [],
       count: 0,
-      acknowledged: acknowledged?.delivery.id ?? null,
+      acknowledged: acknowledged ?? null,
       timedOut: true,
       cancelled: false,
       connectionLost: false
@@ -224,7 +233,7 @@ export async function checkRunMailbox(args: {
       deliveryId: null,
       messages: [],
       count: 0,
-      acknowledged: acknowledged?.delivery.id ?? null,
+      acknowledged: acknowledged ?? null,
       timedOut: false,
       cancelled: true,
       connectionLost: signal?.aborted === true
@@ -241,7 +250,7 @@ export async function checkRunMailbox(args: {
     messages: exposeMessages(current?.messages ?? []),
     count: current?.messages.length ?? 0,
     replayed: current?.replayed ?? false,
-    acknowledged: acknowledged?.delivery.id ?? null,
+    acknowledged: acknowledged ?? null,
     timedOut: false,
     cancelled: false,
     connectionLost: false,
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/check-worker.ts b/src/main/runtime/rpc/methods/orchestration/messaging/check-worker.ts
index fc9fa6b04e9..7616f3e5cc1 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/check-worker.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/check-worker.ts
@@ -5,6 +5,8 @@ import { formatMessageBanner } from '../../../../orchestration/formatter'
 import { exposeMessages } from './mailbox-message-receipt'
 import { routeAllMailboxPages } from '../schemas'
 import { asDispatchFence, callerHoldsDispatchPane, dispatchFenced } from './dispatch-mailbox-fence'
+import { interruptedAcknowledgedCheck } from '../routing'
+import { currentDispatchAssigneeRun } from './recipient-routing'
 import type { CheckParams } from '../schemas'
 import type { z } from 'zod'
 
@@ -24,7 +26,11 @@ export async function checkWorkerMailbox(args: {
   signal: AbortSignal | undefined
   activeDispatch: ActiveDispatch | undefined
   remoteAttachment: RemoteAttachment | undefined
-}): Promise<unknown> {
+  wakeTypes?: MessageType[]
+  revalidateConsumer?: () => void
+  deferDelivery?: () => boolean
+  recordMutationReceipt?: (receipt: unknown) => void
+}) {
   const {
     params,
     runtime,
@@ -54,6 +60,7 @@ export async function checkWorkerMailbox(args: {
   }
   const deliveryRunId = workerMailbox.runId
   db.requireRun(deliveryRunId)
+  const mailboxIdentity = { runId: deliveryRunId, dispatchId: workerMailbox.dispatchId }
   const address = `dispatch:${workerMailbox.dispatchId}`
   // Why: a federated worker host has no dispatch_contexts row, so its generation lives on the
   // remote_dispatch_attachments row instead.
@@ -165,6 +172,7 @@ export async function checkWorkerMailbox(args: {
     }
   }
   await revalidateWorkerMailbox()
+  args.revalidateConsumer?.()
   let acknowledged
   try {
     acknowledged = params.ack
@@ -179,9 +187,17 @@ export async function checkWorkerMailbox(args: {
   } catch (error) {
     throw asDispatchFence(error)
   }
+  if (acknowledged) {
+    args.recordMutationReceipt?.(
+      interruptedAcknowledgedCheck(deliveryRunId, acknowledged.delivery.id, 'outcome_unknown')
+    )
+  }
   const showAll = params.all === true || (params.unread === false && params.peek !== true)
   const readPeek = () => db.getUnreadMessages(address, typeFilter)
   const readDelivery = (wakeTypes?: MessageType[]) => {
+    if (args.deferDelivery?.()) {
+      return undefined
+    }
     try {
       return db.getOrCreateMailboxDelivery({
         runId: deliveryRunId,
@@ -197,8 +213,7 @@ export async function checkWorkerMailbox(args: {
   if (showAll) {
     const messages = db.getAllMessagesForHandle(address, 100, typeFilter)
     return {
-      ...(workerMailbox.runId ? { runId: workerMailbox.runId } : {}),
-      dispatchId: workerMailbox.dispatchId,
+      ...mailboxIdentity,
       messages: exposeMessages(messages),
       count: messages.length,
       acknowledged: acknowledged?.delivery.id ?? null,
@@ -211,8 +226,7 @@ export async function checkWorkerMailbox(args: {
     const messages = readPeek()
     if (messages.length > 0 || !params.wait) {
       return {
-        ...(workerMailbox.runId ? { runId: workerMailbox.runId } : {}),
-        dispatchId: workerMailbox.dispatchId,
+        ...mailboxIdentity,
         messages: exposeMessages(messages),
         count: messages.length,
         acknowledged: acknowledged?.delivery.id ?? null,
@@ -222,11 +236,10 @@ export async function checkWorkerMailbox(args: {
       }
     }
   } else {
-    const current = readDelivery(params.wait ? typeFilter : undefined)
+    const current = readDelivery(params.wait ? typeFilter : args.wakeTypes)
     if (current || !params.wait) {
       return {
-        ...(workerMailbox.runId ? { runId: workerMailbox.runId } : {}),
-        dispatchId: workerMailbox.dispatchId,
+        ...mailboxIdentity,
         deliveryId: current?.delivery.id ?? null,
         messages: exposeMessages(current?.messages ?? []),
         count: current?.messages.length ?? 0,
@@ -241,19 +254,22 @@ export async function checkWorkerMailbox(args: {
       }
     }
   }
-  const waitResult = await runtime.waitForMessage(address, {
-    typeFilter: typeFilter as string[] | undefined,
-    timeoutMs: params.timeoutMs ?? undefined,
-    signal
-  })
+  // Binding can happen during recovery, before run-create/run-use can cancel this wait.
+  const waitResult =
+    activeDispatch && currentDispatchAssigneeRun(runtime, db, activeDispatch)
+      ? 'cancelled'
+      : await runtime.waitForMessage(address, {
+          typeFilter: typeFilter as string[] | undefined,
+          timeoutMs: params.timeoutMs ?? undefined,
+          signal
+        })
   await revalidateWorkerMailbox()
   if (readCurrentGeneration() !== workerMailbox.generation) {
     throw dispatchFenced()
   }
   if (waitResult === 'timed_out' || waitResult === 'cancelled') {
     return {
-      ...(workerMailbox.runId ? { runId: workerMailbox.runId } : {}),
-      dispatchId: workerMailbox.dispatchId,
+      ...mailboxIdentity,
       messages: [],
       count: 0,
       acknowledged: acknowledged?.delivery.id ?? null,
@@ -265,8 +281,7 @@ export async function checkWorkerMailbox(args: {
   if (params.peek) {
     const arrived = readPeek()
     return {
-      ...(workerMailbox.runId ? { runId: workerMailbox.runId } : {}),
-      dispatchId: workerMailbox.dispatchId,
+      ...mailboxIdentity,
       messages: exposeMessages(arrived),
       count: arrived.length,
       acknowledged: acknowledged?.delivery.id ?? null,
@@ -277,8 +292,7 @@ export async function checkWorkerMailbox(args: {
   }
   const arrived = readDelivery(typeFilter)
   return {
-    ...(workerMailbox.runId ? { runId: workerMailbox.runId } : {}),
-    dispatchId: workerMailbox.dispatchId,
+    ...mailboxIdentity,
     deliveryId: arrived?.delivery.id ?? null,
     messages: exposeMessages(arrived?.messages ?? []),
     count: arrived?.messages.length ?? 0,
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/dispatch-recipient-identity.test.ts b/src/main/runtime/rpc/methods/orchestration/messaging/dispatch-recipient-identity.test.ts
new file mode 100644
index 00000000000..4ab4b6555a0
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/dispatch-recipient-identity.test.ts
@@ -0,0 +1,137 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { testOrcaSessionId } from '../../../../../../shared/orca-session-address-test-fixture'
+import { createRootDispatch } from '../../../../orchestration/db/root-dispatch-test-fixture'
+import { createOrchestrationRpcHarness } from '../rpc-test-harness'
+
+const PANE = 'tab_lead:22222222-2222-4222-9222-222222222222'
+const OTHER = 'tab_other:33333333-3333-4333-8333-333333333333'
+const SESSION = testOrcaSessionId('4bd46b4a-035b-41dd-a122-a9c29122ff11')
+
+describe.each([false, true])('Dispatch recipient identity (settled=%s)', (settled) => {
+  const h = createOrchestrationRpcHarness()
+  let state: ReturnType<typeof h.setup>
+  let dispatch: ReturnType<typeof createRootDispatch>
+
+  beforeEach(() => {
+    state = h.setup()
+    const task = state.db.createTask({ spec: 'lead' })
+    dispatch = createRootDispatch(state.db, task.id, 'term_lead', PANE)
+    if (settled) {
+      state.db.completeDispatch(dispatch.id)
+    }
+    vi.spyOn(state.runtime, 'getLiveTerminalPaneKey').mockImplementation((handle) =>
+      handle === 'term_lead' ? PANE : h.coordinatorPaneKey
+    )
+  })
+  afterEach(() => h.cleanup())
+
+  function send() {
+    return h.call(
+      'orchestration.send',
+      { from: 'term_coord', to: `dispatch:${dispatch.id}`, subject: 'follow up' },
+      state.ctx
+    )
+  }
+  function sessionRun() {
+    state.db.db
+      .prepare('UPDATE dispatch_contexts SET assignee_orca_session_id = ? WHERE id = ?')
+      .run(SESSION, dispatch.id)
+    return state.db.createRun({
+      objective: 'session lead',
+      coordinatorHandle: 'term_lead',
+      coordinatorPaneKey: null,
+      coordinatorOrcaSessionId: SESSION
+    })
+  }
+  async function expectRun(runId: string) {
+    if (settled) {
+      await expect(send()).rejects.toMatchObject({
+        code: 'dispatch_inactive',
+        message: expect.stringContaining(`Send to run:${runId} instead`)
+      })
+      expect(state.db.getInbox()).toEqual([])
+    } else {
+      expect(await send()).toMatchObject({ message: { to_handle: `run:${runId}`, run_id: runId } })
+    }
+  }
+  async function expectNoRedirect(unrelatedRun: string) {
+    if (settled) {
+      await expect(send()).rejects.toMatchObject({
+        code: 'dispatch_inactive',
+        message: expect.not.stringContaining(unrelatedRun)
+      })
+      expect(state.db.getInbox()).toEqual([])
+    } else {
+      expect(await send()).toMatchObject({
+        message: { to_handle: `dispatch:${dispatch.id}`, run_id: dispatch.run_id }
+      })
+    }
+  }
+
+  it('uses a durable session binding without a live pane', async () => {
+    const run = sessionRun()
+    vi.mocked(state.runtime.getLiveTerminalPaneKey).mockReturnValue(null)
+    await expectRun(run.id)
+  })
+
+  it('uses the recorded session instead of an unrelated Run now occupying the saved pane', async () => {
+    const run = sessionRun()
+    state.db.createRun({
+      objective: 'new occupant',
+      coordinatorHandle: 'term_other',
+      coordinatorPaneKey: PANE
+    })
+    await expectRun(run.id)
+  })
+
+  it('ignores an old session column left behind by an older binary rebind', async () => {
+    const run = sessionRun()
+    state.db.db
+      .prepare(
+        'UPDATE runs SET coordinator_handle = ?, coordinator_pane_key = ?, consumer_generation = consumer_generation + 1 WHERE id = ?'
+      )
+      .run('term_other', OTHER, run.id)
+    await expectNoRedirect(run.id)
+  })
+
+  it('does not follow a closed handle to another occupant of its old pane', async () => {
+    const run = state.db.createRun({
+      objective: 'new occupant',
+      coordinatorHandle: 'term_other',
+      coordinatorPaneKey: PANE
+    })
+    vi.mocked(state.runtime.getLiveTerminalPaneKey).mockReturnValue(null)
+    await expectNoRedirect(run.id)
+  })
+
+  it.each(['replacement:pty:2', null])(
+    'does not redirect with a replaced or unverifiable process: %s',
+    async (process) => {
+      const run = state.db.createRun({
+        objective: 'pane run',
+        coordinatorHandle: 'term_lead',
+        coordinatorPaneKey: PANE
+      })
+      state.db.db
+        .prepare('UPDATE dispatch_contexts SET process_incarnation = ? WHERE id = ?')
+        .run('original:pty:1', dispatch.id)
+      vi.mocked(state.runtime.getTerminalProcessIncarnation).mockReturnValue(process)
+      await expectNoRedirect(run.id)
+      expect(state.db.getDispatchContextById(dispatch.id)?.status).toBe(
+        settled ? 'completed' : dispatch.status
+      )
+    }
+  )
+
+  it('accepts a reminted tab half with the same pane leaf and process', async () => {
+    const run = state.db.createRun({
+      objective: 'same pane',
+      coordinatorHandle: 'term_lead',
+      coordinatorPaneKey: PANE
+    })
+    vi.mocked(state.runtime.getLiveTerminalPaneKey).mockReturnValue(
+      PANE.replace('tab_lead', 'tab_restored')
+    )
+    await expectRun(run.id)
+  })
+})
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/message-methods.ts b/src/main/runtime/rpc/methods/orchestration/messaging/message-methods.ts
index 51a9d9bc0c5..e079596f80d 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/message-methods.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/message-methods.ts
@@ -4,13 +4,15 @@ import { OrchestrationError } from '../../../../orchestration/orchestration-erro
 import { ORCHESTRATION_LEGACY_RUN_ID } from '../../../../../../shared/orchestration-rpc-contract'
 import { abbreviateOrchestrationTasks } from '../../../../../../shared/orchestration-task-summary'
 import { parseOrchestrationTaskDepsFlag } from '../../../../orchestration/task-deps-flag'
-import { resolveRunScope } from '../runs/run-scope'
+import { orchestrationCallerIdentity, resolveRunScope } from '../runs/run-scope'
 import {
   readMutationReplayNudge,
   stripMutationReplayNudge
 } from '../../../orchestration-mutation-executor'
 import { exposeMessage } from './mailbox-message-receipt'
+import { resolveOrchestrationParty } from '../../../../orchestration/orchestration-party'
 import { recordReceiptBeforeNudge, replayMutationNudge } from './mutation-replay-nudge'
+import { resolveReplyRecipient } from './recipient-routing'
 import {
   ReplyParams,
   InboxParams,
@@ -27,6 +29,7 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
       params,
       {
         orchestrationCompatibilityEvidence,
+        orchestrationCaller,
         runtime,
         legacyCoordinatorRunId,
         recordMutationReceipt,
@@ -73,7 +76,8 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
           callerTerminalHandle: params.from,
           requireCurrentConsumer: true,
           legacyCoordinatorRunId,
-          callerEvidence: orchestrationCompatibilityEvidence
+          callerEvidence: orchestrationCompatibilityEvidence,
+          callerSession: orchestrationCaller
         })
         const answered = db.answerQuestion({
           messageId: question.message_id,
@@ -110,15 +114,20 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
         )
       }
 
+      const recipient = resolveReplyRecipient({
+        runtime,
+        db,
+        originalFrom: original.from_handle,
+        originalRunId: original.run_id
+      })
       db.markAsRead([original.id])
-
       const reply = db.insertMessage({
         from: params.from ?? original.to_handle,
-        to: original.from_handle,
+        to: recipient.to,
         subject: `Re: ${original.subject}`,
         body: params.body,
         threadId: original.thread_id ?? original.id,
-        runId: original.run_id
+        runId: recipient.runId
       })
 
       const receipt = { message: exposeMessage(reply) }
@@ -135,7 +144,10 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
       const db = runtime.getOrchestrationDb()
       // Why: stale/unknown handles return empty rather than error — historical rows survive handle deletion (design doc §3.3).
       const messages = params.terminal
-        ? db.getAllMessagesForHandle(params.terminal, params.limit)
+        ? db.getAllMessagesForHandle(
+            resolveOrchestrationParty(params.terminal, db).address,
+            params.limit
+          )
         : db.getInbox(params.limit)
       return { messages, count: messages.length }
     }
@@ -144,7 +156,10 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
   defineMethod({
     name: 'orchestration.taskCreate',
     params: TaskCreateParams,
-    handler: (params, { orchestrationCompatibilityEvidence, runtime, legacyCoordinatorRunId }) => {
+    handler: (
+      params,
+      { orchestrationCompatibilityEvidence, orchestrationCaller, runtime, legacyCoordinatorRunId }
+    ) => {
       const db = runtime.getOrchestrationDb()
       const deps = params.deps ? parseOrchestrationTaskDepsFlag(params.deps) : undefined
       const run = resolveRunScope(runtime, {
@@ -152,10 +167,19 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
         callerTerminalHandle: params.callerTerminalHandle,
         requireCurrentConsumer: true,
         legacyCoordinatorRunId,
-        callerEvidence: orchestrationCompatibilityEvidence
+        callerEvidence: orchestrationCompatibilityEvidence,
+        callerSession: orchestrationCaller
       })
-      const creatorAuthority = params.callerTerminalHandle
-        ? runtime.getOrchestrationDispatchAuthority(params.callerTerminalHandle)
+      // A handle-less session creates root Tasks: Task lineage is recorded by terminal only.
+      const creatorHandle = params.callerTerminalHandle
+        ? orchestrationCallerIdentity(runtime, {
+            handle: params.callerTerminalHandle,
+            session: orchestrationCaller,
+            paneKey: null
+          }).terminalHandle
+        : null
+      const creatorAuthority = creatorHandle
+        ? runtime.getOrchestrationDispatchAuthority(creatorHandle)
         : null
       const task = db.createTask({
         spec: params.spec,
@@ -163,7 +187,7 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
         displayName: params.displayName,
         deps,
         parentId: params.parent,
-        createdByTerminalHandle: params.callerTerminalHandle,
+        createdByTerminalHandle: creatorHandle ?? undefined,
         ...(creatorAuthority?.paneKey && creatorAuthority.processIncarnation
           ? {
               createdByPaneKey: creatorAuthority.paneKey,
@@ -180,7 +204,10 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
   defineMethod({
     name: 'orchestration.taskList',
     params: TaskListParams,
-    handler: (params, { orchestrationCompatibilityEvidence, runtime, legacyCoordinatorRunId }) => {
+    handler: (
+      params,
+      { orchestrationCompatibilityEvidence, orchestrationCaller, runtime, legacyCoordinatorRunId }
+    ) => {
       const db = runtime.getOrchestrationDb()
       const explicitRun = params.run ? db.getRun(params.run) : undefined
       const run =
@@ -191,7 +218,8 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
               callerTerminalHandle: params.callerTerminalHandle,
               requireCurrentConsumer: params.run === undefined,
               legacyCoordinatorRunId,
-              callerEvidence: orchestrationCompatibilityEvidence
+              callerEvidence: orchestrationCompatibilityEvidence,
+              callerSession: orchestrationCaller
             })
       // Why: listTasksWithDispatch adds assignee_handle + dispatch_id (NULL for non-dispatched), so legacy-shape consumers are unaffected.
       const joined = db.listTasksWithDispatch({
@@ -218,14 +246,18 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
   defineMethod({
     name: 'orchestration.taskUpdate',
     params: TaskUpdateParams,
-    handler: (params, { orchestrationCompatibilityEvidence, runtime, legacyCoordinatorRunId }) => {
+    handler: (
+      params,
+      { orchestrationCompatibilityEvidence, orchestrationCaller, runtime, legacyCoordinatorRunId }
+    ) => {
       const db = runtime.getOrchestrationDb()
       const run = resolveRunScope(runtime, {
         runId: params.run,
         callerTerminalHandle: params.callerTerminalHandle,
         requireCurrentConsumer: true,
         legacyCoordinatorRunId,
-        callerEvidence: orchestrationCompatibilityEvidence
+        callerEvidence: orchestrationCompatibilityEvidence,
+        callerSession: orchestrationCaller
       })
       const existing = db.getTask(params.id)
       if (!existing || existing.run_id !== run.id) {
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/recipient-routing.ts b/src/main/runtime/rpc/methods/orchestration/messaging/recipient-routing.ts
index f2b5e939a65..8828c771876 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/recipient-routing.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/recipient-routing.ts
@@ -2,6 +2,15 @@ import type { LegacyAdoptedMailboxOwner, OrchestrationDb } from '../../../../orc
 import { OrchestrationError } from '../../../../orchestration/orchestration-error'
 import type { DispatchContextRow, DispatchStatus } from '../../../../orchestration/types'
 import type { OrcaRuntimeService } from '../../../../orca-runtime'
+import { resolveOrchestrationParty } from '../../../../orchestration/orchestration-party'
+import { isEquivalentPaneKey } from '../../../../orchestration/db/pane-key-match'
+import { CURRENT_CONTRACT_VERSION } from '../../../../orchestration/db/contract-constants'
+import { readAgentSessionRecordStore } from '../../../../orchestration/structured-session-lineage'
+import {
+  readSessionRecipient,
+  refuseUndeliverableSessionRecipient,
+  type SessionRecipientRefusal
+} from './session-recipient'
 
 const ACTIVE_DISPATCH_STATUSES: readonly DispatchStatus[] = ['pending', 'dispatched']
 
@@ -12,20 +21,123 @@ const ACTIVE_DISPATCH_STATUSES: readonly DispatchStatus[] = ['pending', 'dispatc
  * mailbox, so accepting the message reports success for a delivery that cannot
  * happen. Federated targets keep their own liveness check.
  */
-export function assertDispatchMailboxDeliverable(db: OrchestrationDb, dispatchId: string): void {
+export function assertDispatchMailboxDeliverable(
+  runtime: OrcaRuntimeService,
+  db: OrchestrationDb,
+  dispatchId: string
+): void {
   const dispatch = db.getDispatchContextById(dispatchId)
   if (!dispatch || ACTIVE_DISPATCH_STATUSES.includes(dispatch.status)) {
     return
   }
+  const recipientRun = currentDispatchAssigneeRun(runtime, db, dispatch)?.id ?? dispatch.run_id
   throw new OrchestrationError(
     'dispatch_inactive',
-    `Dispatch ${dispatchId} is ${dispatch.status}; its worker will never read that mailbox. Send to run:${dispatch.run_id} instead, or start a new Dispatch for follow-up work.`
+    `Dispatch ${dispatchId} is ${dispatch.status}; its worker will never read that mailbox. Send to run:${recipientRun} instead, or start a new Dispatch for follow-up work.`
   )
 }
 
+// A saved pane alone cannot identify its occupant after reuse.
+export function currentDispatchAssigneeRun(
+  runtime: OrcaRuntimeService,
+  db: OrchestrationDb,
+  dispatch: DispatchContextRow
+) {
+  if (
+    dispatch.contract_version !== CURRENT_CONTRACT_VERSION ||
+    db.getFederatedDispatch(dispatch.id)
+  ) {
+    return undefined
+  }
+  if (dispatch.assignee_orca_session_id !== null) {
+    return db.getCurrentRunForCoordinator({
+      terminalHandle: dispatch.assignee_handle,
+      paneKey: null,
+      orcaSessionId: dispatch.assignee_orca_session_id
+    })
+  }
+  if (dispatch.assignee_handle === null) {
+    return undefined
+  }
+  const paneKey = runtime.getLiveTerminalPaneKey(dispatch.assignee_handle)
+  if (
+    !paneKey ||
+    (dispatch.assignee_pane_key && !isEquivalentPaneKey(dispatch.assignee_pane_key, paneKey)) ||
+    (dispatch.process_incarnation !== null &&
+      runtime.getTerminalProcessIncarnation(dispatch.assignee_handle) !==
+        dispatch.process_incarnation)
+  ) {
+    return undefined
+  }
+  return db.getCurrentRunForPane(paneKey)
+}
+
+// Nested coordinators receive new mail where their current Run check waits.
+export function resolveRunBoundDispatchRecipient(
+  runtime: OrcaRuntimeService,
+  db: OrchestrationDb,
+  dispatchId: string,
+  explicitRunId?: string
+): { to: string; runId: string; warning: SendRecipientWarning } | undefined {
+  const dispatch = db.getDispatchContextById(dispatchId)
+  if (!dispatch || !ACTIVE_DISPATCH_STATUSES.includes(dispatch.status)) {
+    return undefined
+  }
+  const boundRun = currentDispatchAssigneeRun(runtime, db, dispatch)
+  if (!boundRun || boundRun.id === dispatch.run_id) {
+    return undefined
+  }
+  const recipient = `dispatch:${dispatchId}`
+  const mismatch = runMismatch(recipient, boundRun.id, explicitRunId)
+  if (mismatch && !mismatch.ok) {
+    throw new OrchestrationError(mismatch.code, mismatch.message)
+  }
+  return {
+    to: `run:${boundRun.id}`,
+    runId: boundRun.id,
+    warning: {
+      code: 'recipient_run_bound_redirect',
+      recipient,
+      message: `${recipient} is assigned to a terminal that now coordinates Run ${boundRun.id}; queued for run:${boundRun.id}, the mailbox that terminal reads.`
+    }
+  }
+}
+
+// Replies share send routing; unresolved historical senders keep their original address.
+export function resolveReplyRecipient(params: {
+  runtime: OrcaRuntimeService
+  db: OrchestrationDb
+  originalFrom: string
+  originalRunId: string | undefined
+}): { to: string; runId: string | undefined } {
+  const { runtime, db, originalFrom, originalRunId } = params
+  const unchanged = { to: originalFrom, runId: originalRunId }
+  if (originalFrom.startsWith('run:')) {
+    return { to: originalFrom, runId: originalFrom.slice('run:'.length) }
+  }
+  if (originalFrom.startsWith('dispatch:')) {
+    const dispatchId = originalFrom.slice('dispatch:'.length)
+    // Federation owns its own recipient and liveness checks.
+    if (db.getFederatedDispatch(dispatchId)) {
+      return unchanged
+    }
+    assertDispatchMailboxDeliverable(runtime, db, dispatchId)
+    const runBound = resolveRunBoundDispatchRecipient(runtime, db, dispatchId)
+    return runBound ?? unchanged
+  }
+  const recipient = resolveBareOrchestrationRecipient({
+    runtime,
+    db,
+    handle: originalFrom,
+    senderRunId: originalRunId
+  })
+  return recipient.ok ? { to: recipient.to, runId: recipient.runId ?? originalRunId } : unchanged
+}
+
 export type SendRecipientWarning = {
   code:
     | 'legacy_terminal_recipient'
+    | 'recipient_run_bound_redirect'
     | 'recipient_unreachable'
     | 'recipient_ambiguous'
     | 'recipient_run_mismatch'
@@ -42,7 +154,11 @@ export type BareRecipientResolution =
     }
   | {
       ok: false
-      code: 'terminal_not_found' | 'recipient_ambiguous' | 'recipient_run_mismatch'
+      code:
+        | 'terminal_not_found'
+        | 'recipient_ambiguous'
+        | 'recipient_run_mismatch'
+        | SessionRecipientRefusal['code']
       message: string
       warning: SendRecipientWarning
     }
@@ -55,9 +171,25 @@ export function resolveBareOrchestrationRecipient(params: {
   explicitRunId?: string
   legacyAdoptedMailboxOwner?: LegacyAdoptedMailboxOwner | null
 }): BareRecipientResolution {
-  const { runtime, db, handle } = params
-  const paneKey = runtime.getLiveTerminalPaneKey(handle) ?? undefined
-  const boundRun = paneKey ? db.getCurrentRunForPane(paneKey) : undefined
+  const { runtime, db } = params
+  const sessionStore = readAgentSessionRecordStore()
+  const session = readSessionRecipient(params.handle, sessionStore)
+  if (session && 'code' in session) {
+    return refused(params.handle, session)
+  }
+  const party = resolveOrchestrationParty(session?.address ?? params.handle, db)
+  const handle = party.address
+  const paneKey =
+    party.terminalHandle === null
+      ? undefined
+      : (runtime.getLiveTerminalPaneKey(party.terminalHandle) ?? undefined)
+  // Why: a session-backed party's Run binding is durable, so it outranks whether its pane is live.
+  const boundRun =
+    party.orcaSessionId !== null
+      ? db.getCurrentRunForCoordinator(party)
+      : paneKey
+        ? db.getCurrentRunForPane(paneKey)
+        : undefined
   if (boundRun) {
     const mismatch = runMismatch(handle, boundRun.id, params.explicitRunId)
     return mismatch ?? { ok: true, to: `run:${boundRun.id}`, runId: boundRun.id }
@@ -89,6 +221,13 @@ export function resolveBareOrchestrationRecipient(params: {
     return mismatch ?? { ok: true, to: `run:${selectedRunId}`, runId: selectedRunId }
   }
 
+  if (session) {
+    const refusal = refuseUndeliverableSessionRecipient(session, sessionStore, db)
+    return refusal
+      ? refused(params.handle, refusal)
+      : { ok: true, to: handle, runId: params.senderRunId }
+  }
+
   if (paneKey) {
     return {
       ok: true,
@@ -111,6 +250,15 @@ export function resolveBareOrchestrationRecipient(params: {
   }
 }
 
+function refused(recipient: string, refusal: SessionRecipientRefusal): BareRecipientResolution {
+  return {
+    ok: false,
+    code: refusal.code,
+    message: refusal.message,
+    warning: { code: 'recipient_unreachable', recipient, message: refusal.message }
+  }
+}
+
 function selectDispatch(
   dispatches: DispatchContextRow[],
   explicitRunId: string | undefined
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-mailbox-history.test.ts b/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-mailbox-history.test.ts
new file mode 100644
index 00000000000..fba01d0d455
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-mailbox-history.test.ts
@@ -0,0 +1,69 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createRootDispatch } from '../../../../orchestration/db/root-dispatch-test-fixture'
+import { createOrchestrationRpcHarness } from '../rpc-test-harness'
+
+const LEAD = 'tab_lead:22222222-2222-4222-9222-222222222222'
+function deliveryId(result: unknown): string {
+  if (
+    typeof result === 'object' &&
+    result &&
+    'deliveryId' in result &&
+    typeof result.deliveryId === 'string'
+  ) {
+    return result.deliveryId
+  }
+  throw new Error('Expected a Delivery')
+}
+
+describe('Run history after residual Dispatch acknowledgment', () => {
+  const h = createOrchestrationRpcHarness()
+  let state: ReturnType<typeof h.setup>
+  beforeEach(() => {
+    state = h.setup()
+    vi.mocked(state.runtime.getTerminalPaneKey).mockImplementation((handle) =>
+      handle === 'term_lead' ? LEAD : h.coordinatorPaneKey
+    )
+  })
+  afterEach(() => h.cleanup())
+  it.each([
+    { mode: { all: true }, acknowledgeTogether: false },
+    { mode: { all: true }, acknowledgeTogether: true },
+    { mode: { unread: false }, acknowledgeTogether: false },
+    { mode: { unread: false }, acknowledgeTogether: true }
+  ])('shows Run history after old mail is read: %j', async ({ mode, acknowledgeTogether }) => {
+    const task = state.db.createTask({ spec: 'nested lead' })
+    const dispatch = createRootDispatch(state.db, task.id, 'term_lead', LEAD)
+    const run = state.db.createRun({
+      objective: 'child Run',
+      coordinatorHandle: 'term_lead',
+      coordinatorPaneKey: LEAD
+    })
+    const old = state.db.insertMessage({
+      from: 'term_coord',
+      to: `dispatch:${dispatch.id}`,
+      runId: dispatch.run_id,
+      subject: 'old mail'
+    })
+    const check = (params = {}) =>
+      h.call('orchestration.check', { terminal: 'term_lead', ...params }, state.ctx)
+    expect(await check(mode)).toMatchObject({ runId: dispatch.run_id, messages: [{ id: old.id }] })
+    expect(state.db.hasOutstandingMailboxDelivery(`dispatch:${dispatch.id}`)).toBe(false)
+    const delivery = deliveryId(await check())
+    if (!acknowledgeTogether) {
+      await check({ ack: delivery })
+    }
+    const fresh = state.db.insertMessage({
+      from: 'term_child',
+      to: `run:${run.id}`,
+      runId: run.id,
+      subject: 'new mail'
+    })
+    expect(
+      await check({ ...mode, ...(acknowledgeTogether ? { ack: delivery } : {}) })
+    ).toMatchObject({ runId: run.id, messages: [{ id: fresh.id }] })
+    expect(state.db.getMessageById(old.id)?.read).toBe(1)
+    expect(state.db.getMessageById(fresh.id)?.read).toBe(0)
+    expect(state.db.hasOutstandingMailboxDelivery(`dispatch:${dispatch.id}`)).toBe(false)
+    expect(state.db.hasOutstandingMailboxDelivery(`run:${run.id}`)).toBe(false)
+  })
+})
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-mailbox-interleavings.test.ts b/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-mailbox-interleavings.test.ts
new file mode 100644
index 00000000000..4e92d7c35c1
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-mailbox-interleavings.test.ts
@@ -0,0 +1,175 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createRootDispatch } from '../../../../orchestration/db/root-dispatch-test-fixture'
+import { ORCHESTRATION_DELIVERY_BATCH_LIMIT } from '../../../../orchestration/db/messages/mailbox-routing-page'
+import { createOrchestrationRpcHarness } from '../rpc-test-harness'
+
+const LEAD = 'tab_lead:22222222-2222-4222-9222-222222222222'
+const OTHER = 'tab_other:33333333-3333-4333-8333-333333333333'
+
+function deliveryId(result: unknown): string {
+  if (
+    typeof result === 'object' &&
+    result !== null &&
+    'deliveryId' in result &&
+    typeof result.deliveryId === 'string'
+  ) {
+    return result.deliveryId
+  }
+  throw new Error('Expected a Delivery')
+}
+
+describe('Run binding during Dispatch checks', () => {
+  const h = createOrchestrationRpcHarness()
+  let state: ReturnType<typeof h.setup>
+  let dispatch: ReturnType<typeof createRootDispatch>
+
+  beforeEach(() => {
+    state = h.setup()
+    vi.mocked(state.runtime.getTerminalPaneKey).mockImplementation((handle) =>
+      handle === 'term_lead' ? LEAD : handle === 'term_coord' ? h.coordinatorPaneKey : OTHER
+    )
+    dispatch = createRootDispatch(
+      state.db,
+      state.db.createTask({ spec: 'lead' }).id,
+      'term_lead',
+      LEAD
+    )
+  })
+  afterEach(() => {
+    state.runtime.cancelMessageWaiters(`dispatch:${dispatch.id}`)
+    h.cleanup()
+    vi.restoreAllMocks()
+  })
+
+  function check(params: Record<string, unknown> = {}) {
+    return h.call('orchestration.check', { terminal: 'term_lead', ...params }, state.ctx)
+  }
+  function residual(subject: string) {
+    return state.db.insertMessage({
+      from: 'term_coord',
+      to: `dispatch:${dispatch.id}`,
+      runId: dispatch.run_id,
+      subject
+    })
+  }
+  async function bind(method: 'runCreate' | 'runUse') {
+    const params =
+      method === 'runCreate'
+        ? { objective: 'child' }
+        : {
+            id: state.db.createRun({
+              objective: 'adopt',
+              coordinatorHandle: 'term_other',
+              coordinatorPaneKey: OTHER
+            }).id
+          }
+    await h.call(`orchestration.${method}`, { from: 'term_lead', ...params }, state.ctx)
+    const run = state.db.getCurrentRunForPane(LEAD)
+    if (!run) {
+      throw new Error('Expected bound Run')
+    }
+    return run
+  }
+
+  describe.each(['runCreate', 'runUse'] as const)('%s', (method) => {
+    it.each(['parked', 'recovering'] as const)(
+      'cancels a %s Dispatch wait and preserves its ack',
+      async (phase) => {
+        const old = residual('before bind')
+        const ack = deliveryId(await check())
+        const record = vi.fn()
+        state.ctx.recordMutationReceipt = record
+        const wait = vi.spyOn(state.runtime, 'waitForMessage')
+        const waiting = check({ ack, wait: true, timeoutMs: 500 })
+        if (phase === 'parked') {
+          await vi.waitFor(() =>
+            expect(wait).toHaveBeenCalledWith(`dispatch:${dispatch.id}`, expect.anything())
+          )
+        }
+        const run = await bind(method)
+        await h.call(
+          'orchestration.send',
+          {
+            from: 'term_coord',
+            to: `dispatch:${dispatch.id}`,
+            subject: 'after bind'
+          },
+          state.ctx
+        )
+        expect(await waiting).toMatchObject({ acknowledged: ack, cancelled: true, timedOut: false })
+        expect(record).toHaveBeenCalledWith(expect.objectContaining({ acknowledged: ack }))
+        expect(state.db.getMessageById(old.id)).toMatchObject({ run_id: dispatch.run_id, read: 1 })
+        expect(await check()).toMatchObject({
+          runId: run.id,
+          messages: [{ subject: 'after bind' }]
+        })
+        if (phase === 'recovering') {
+          expect(wait).not.toHaveBeenCalled()
+        }
+      }
+    )
+  })
+
+  it.each(['before', 'during recovery'] as const)(
+    'replays Run delivery created %s residual acknowledgment',
+    async (phase) => {
+      const ids = Array.from(
+        { length: ORCHESTRATION_DELIVERY_BATCH_LIMIT + 1 },
+        (_, i) => residual(`old ${i}`).id
+      )
+      const last = ids.at(-1)
+      if (!last) {
+        throw new Error('Expected residual tail')
+      }
+      const ack = deliveryId(await check())
+      const run = await bind('runCreate')
+      state.db.insertMessage({
+        from: 'term_child',
+        to: `run:${run.id}`,
+        runId: run.id,
+        subject: 'Run batch'
+      })
+      let runDelivery: string | undefined
+      const readRun = () => {
+        const result = state.db.getOrCreateRunDelivery({
+          runId: run.id,
+          consumerGeneration: run.consumer_generation
+        })
+        if (!result) {
+          throw new Error('Expected Run delivery')
+        }
+        runDelivery = result.delivery.id
+      }
+      if (phase === 'before') {
+        runDelivery = deliveryId(await check({ run: run.id }))
+      } else {
+        state.db.db.prepare('UPDATE messages SET to_handle = ? WHERE id = ?').run('term_lead', last)
+        const route = state.db.routeUnreadDirectMessagesToDispatchMailbox.bind(state.db)
+        vi.spyOn(state.db, 'routeUnreadDirectMessagesToDispatchMailbox').mockImplementationOnce(
+          (...args) => {
+            const result = route(...args)
+            readRun()
+            return result
+          }
+        )
+      }
+      const result = await check({ ack })
+      expect(result).toMatchObject({
+        runId: run.id,
+        deliveryId: runDelivery,
+        acknowledged: ack,
+        replayed: true
+      })
+      expect(state.db.hasOutstandingMailboxDelivery(`dispatch:${dispatch.id}`)).toBe(false)
+      for (const id of ids.slice(0, -1)) {
+        expect(state.db.getMessageById(id)).toMatchObject({ read: 1, run_id: dispatch.run_id })
+      }
+      expect(state.db.getMessageById(last)).toMatchObject({ read: 0, run_id: dispatch.run_id })
+      expect(await check({ ack })).toMatchObject({ deliveryId: runDelivery, replayed: true })
+      const tail = await check({ ack: runDelivery })
+      expect(tail).toMatchObject({ runId: dispatch.run_id, messages: [{ id: last }], count: 1 })
+      expect(await check({ ack: deliveryId(tail) })).toMatchObject({ count: 0 })
+      expect(state.db.getMessageById(last)?.read).toBe(1)
+    }
+  )
+})
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-mailbox-safety.test.ts b/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-mailbox-safety.test.ts
new file mode 100644
index 00000000000..f5f2c57575f
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-mailbox-safety.test.ts
@@ -0,0 +1,290 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createRootDispatch } from '../../../../orchestration/db/root-dispatch-test-fixture'
+import { createOrchestrationRpcHarness } from '../rpc-test-harness'
+
+const LEAD = 'tab_lead:22222222-2222-4222-9222-222222222222'
+const OTHER = 'tab_other:33333333-3333-4333-8333-333333333333'
+
+function deliveryId(result: unknown): string {
+  if (
+    typeof result === 'object' &&
+    result &&
+    'deliveryId' in result &&
+    typeof result.deliveryId === 'string'
+  ) {
+    return result.deliveryId
+  }
+  throw new Error('Expected a Delivery')
+}
+
+describe('Run-bound lead mailbox boundaries', () => {
+  const h = createOrchestrationRpcHarness()
+  let state: ReturnType<typeof h.setup>
+  let dispatch: ReturnType<typeof createRootDispatch>
+  let leadRun: ReturnType<typeof state.db.createRun>
+
+  beforeEach(() => {
+    state = h.setup()
+    vi.mocked(state.runtime.getTerminalPaneKey).mockImplementation((handle) =>
+      handle === 'term_lead' ? LEAD : handle === 'term_coord' ? h.coordinatorPaneKey : OTHER
+    )
+    const task = state.db.createTask({ spec: 'nested lead' })
+    dispatch = createRootDispatch(state.db, task.id, 'term_lead', LEAD)
+    leadRun = state.db.createRun({
+      objective: 'child Run',
+      coordinatorHandle: 'term_lead',
+      coordinatorPaneKey: LEAD
+    })
+  })
+  afterEach(() => h.cleanup())
+
+  function check(params: Record<string, unknown> = {}) {
+    return h.call('orchestration.check', { terminal: 'term_lead', ...params }, state.ctx)
+  }
+  function residual(subject: string, type: 'status' | 'question' = 'status') {
+    return state.db.insertMessage({
+      from: 'term_coord',
+      to: `dispatch:${dispatch.id}`,
+      runId: dispatch.run_id,
+      subject,
+      type
+    })
+  }
+  function runMail(subject = 'Run report') {
+    return state.db.insertMessage({
+      from: 'term_child',
+      to: `run:${leadRun.id}`,
+      runId: leadRun.id,
+      subject,
+      type: 'question'
+    })
+  }
+  function handoff() {
+    state.db.bindRun({
+      runId: leadRun.id,
+      coordinatorHandle: 'term_other',
+      coordinatorPaneKey: OTHER
+    })
+  }
+
+  it('recovers old raw-handle replies only from the active Dispatch Run', async () => {
+    const old = residual('old reply')
+    state.db.db.prepare('UPDATE messages SET to_handle = ? WHERE id = ?').run('term_lead', old.id)
+    const foreign = state.db.createRun({
+      objective: 'unrelated',
+      coordinatorHandle: 'term_other',
+      coordinatorPaneKey: OTHER
+    })
+    const privateMail = state.db.insertMessage({
+      from: 'term_other',
+      to: 'term_lead',
+      runId: foreign.id,
+      subject: 'foreign'
+    })
+    runMail()
+    const first = await check()
+    expect(first).toMatchObject({ runId: dispatch.run_id, messages: [{ id: old.id }] })
+    expect(await check({ ack: deliveryId(first) })).toMatchObject({
+      runId: leadRun.id,
+      messages: [{ subject: 'Run report' }]
+    })
+    expect(state.db.getMessageById(privateMail.id)).toMatchObject({ read: 0, run_id: foreign.id })
+  })
+
+  it('treats types as a wake condition and replays the entire residual FIFO batch', async () => {
+    residual('older status')
+    residual('decision needed', 'question')
+    runMail()
+    const first = await check({ wait: true, types: 'question' })
+    expect(first).toMatchObject({
+      messages: [{ subject: 'older status' }, { subject: 'decision needed' }]
+    })
+    expect(await check({ wait: true, types: 'worker_done' })).toMatchObject({
+      deliveryId: deliveryId(first),
+      replayed: true
+    })
+    expect(await check({ ack: deliveryId(first) })).toMatchObject({
+      runId: leadRun.id,
+      acknowledged: deliveryId(first),
+      messages: [{ subject: 'Run report' }]
+    })
+  })
+
+  it('does not filter a non-waiting consuming residual check', async () => {
+    residual('status')
+    expect(await check({ types: 'question' })).toMatchObject({ messages: [{ subject: 'status' }] })
+  })
+
+  it.each([{ peek: true }, { all: true }])(
+    'filters residual inspection without consuming it: %j',
+    async (mode) => {
+      const status = residual('status')
+      residual('question', 'question')
+      expect(await check({ ...mode, types: 'question' })).toMatchObject({
+        messages: [{ subject: 'question' }]
+      })
+      expect(state.db.getMessageById(status.id)?.read).toBe(0)
+      expect(state.db.hasOutstandingMailboxDelivery(`dispatch:${dispatch.id}`)).toBe(false)
+    }
+  )
+
+  it('replays an outstanding Run batch before exposing older nonmatching residual mail', async () => {
+    residual('status')
+    runMail()
+    const first = await check({ wait: true, types: 'question' })
+    expect(first).toMatchObject({ runId: leadRun.id })
+    expect(await check()).toMatchObject({ deliveryId: deliveryId(first), replayed: true })
+    expect(await check({ ack: deliveryId(first) })).toMatchObject({
+      acknowledged: deliveryId(first),
+      messages: [{ subject: 'status' }]
+    })
+  })
+
+  it('keeps explicit Run checks scoped and refuses the parent Run', async () => {
+    const pending = residual('parent mail')
+    runMail()
+    expect(await check({ run: leadRun.id })).toMatchObject({
+      runId: leadRun.id,
+      messages: [{ subject: 'Run report' }]
+    })
+    await expect(check({ run: dispatch.run_id })).rejects.toMatchObject({ code: 'consumer_fenced' })
+    expect(state.db.getMessageById(pending.id)?.read).toBe(0)
+  })
+
+  it('fences a Run handoff during residual direct-mail recovery before delivery or ack', async () => {
+    const pending = residual('raw before bind')
+    state.db.db
+      .prepare('UPDATE messages SET to_handle = ? WHERE id = ?')
+      .run('term_lead', pending.id)
+    const route = state.db.routeUnreadDirectMessagesToDispatchMailbox.bind(state.db)
+    vi.spyOn(state.db, 'routeUnreadDirectMessagesToDispatchMailbox').mockImplementationOnce(
+      (...args) => {
+        const result = route(...args)
+        handoff()
+        return result
+      }
+    )
+    await expect(check()).rejects.toMatchObject({ code: 'consumer_fenced' })
+    expect(state.db.hasOutstandingMailboxDelivery(`dispatch:${dispatch.id}`)).toBe(false)
+    expect(state.db.getMessageById(pending.id)?.read).toBe(0)
+  })
+
+  it('records a residual acknowledgment before a Run handoff interrupts the following wait', async () => {
+    residual('ack me')
+    const first = await check()
+    const record = vi.fn()
+    state.ctx.recordMutationReceipt = record
+    vi.spyOn(state.runtime, 'waitForMessage').mockImplementationOnce(async () => {
+      expect(record).toHaveBeenCalledWith(
+        expect.objectContaining({ acknowledged: deliveryId(first) })
+      )
+      handoff()
+      return 'cancelled'
+    })
+    expect(await check({ ack: deliveryId(first), wait: true })).toMatchObject({
+      acknowledged: deliveryId(first),
+      waitInterrupted: 'consumer_fenced',
+      messages: []
+    })
+    expect(state.db.getUnreadMessages(`dispatch:${dispatch.id}`)).toEqual([])
+  })
+
+  it('retains the acknowledged receipt if the wait transport throws', async () => {
+    residual('ack me')
+    const first = await check()
+    const record = vi.fn()
+    state.ctx.recordMutationReceipt = record
+    vi.spyOn(state.runtime, 'waitForMessage').mockRejectedValueOnce(
+      new Error('connection interrupted')
+    )
+    await expect(check({ ack: deliveryId(first), wait: true })).rejects.toThrow(
+      'connection interrupted'
+    )
+    expect(record).toHaveBeenCalledWith(
+      expect.objectContaining({ acknowledged: deliveryId(first) })
+    )
+    expect(state.db.getUnreadMessages(`dispatch:${dispatch.id}`)).toEqual([])
+  })
+
+  it('does not give a reused process the previous assignee mail', async () => {
+    state.db.mintDispatchCapability({
+      dispatchId: dispatch.id,
+      paneKey: LEAD,
+      processIncarnation: 'old:pty:1'
+    })
+    const pending = residual('old process mail')
+    runMail()
+    expect(await check()).toMatchObject({
+      runId: leadRun.id,
+      messages: [{ subject: 'Run report' }]
+    })
+    expect(state.db.getMessageById(pending.id)?.read).toBe(0)
+    expect(state.db.hasOutstandingMailboxDelivery(`dispatch:${dispatch.id}`)).toBe(false)
+  })
+
+  it('refuses an explicit sender Run that would silently redirect into another Run', async () => {
+    await expect(
+      h.call(
+        'orchestration.send',
+        {
+          from: 'term_coord',
+          to: `dispatch:${dispatch.id}`,
+          run: dispatch.run_id,
+          subject: 'wrong scope'
+        },
+        state.ctx
+      )
+    ).rejects.toMatchObject({ code: 'recipient_run_mismatch' })
+    expect(state.db.getInbox()).toEqual([])
+  })
+
+  it('wakes a parked Run check for Dispatch mail sent after binding', async () => {
+    const waiter = vi.spyOn(state.runtime, 'waitForMessage')
+    const waiting = check({ wait: true, timeoutMs: 1_000 })
+    await vi.waitFor(() =>
+      expect(waiter).toHaveBeenCalledWith(`run:${leadRun.id}`, expect.anything())
+    )
+    await h.call(
+      'orchestration.send',
+      { from: 'term_coord', to: `dispatch:${dispatch.id}`, subject: 'wake up' },
+      state.ctx
+    )
+    expect(await waiting).toMatchObject({ timedOut: false, messages: [{ subject: 'wake up' }] })
+  })
+
+  it('keeps a canonical Run reply in the recipient Run even across an original thread Run', async () => {
+    const note = state.db.insertMessage({
+      from: `run:${leadRun.id}`,
+      to: `run:${dispatch.run_id}`,
+      runId: dispatch.run_id,
+      subject: 'report'
+    })
+    expect(
+      await h.call(
+        'orchestration.reply',
+        { from: 'term_coord', id: note.id, body: 'decision' },
+        state.ctx
+      )
+    ).toMatchObject({ message: { to_handle: `run:${leadRun.id}`, run_id: leadRun.id } })
+    expect(await check()).toMatchObject({ messages: [{ subject: 'Re: report' }] })
+  })
+
+  it('refuses replies to an inactive canonical Dispatch before reading or inserting mail', async () => {
+    const note = state.db.insertMessage({
+      from: `dispatch:${dispatch.id}`,
+      to: `run:${dispatch.run_id}`,
+      runId: dispatch.run_id,
+      subject: 'old report'
+    })
+    state.db.completeDispatch(dispatch.id)
+    await expect(
+      h.call(
+        'orchestration.reply',
+        { from: 'term_coord', id: note.id, body: 'too late' },
+        state.ctx
+      )
+    ).rejects.toMatchObject({ code: 'dispatch_inactive' })
+    expect(state.db.getMessageById(note.id)?.read).toBe(0)
+    expect(state.db.getInbox()).toHaveLength(1)
+  })
+})
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-recipient-mail.test.ts b/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-recipient-mail.test.ts
new file mode 100644
index 00000000000..bb6c7041cee
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-recipient-mail.test.ts
@@ -0,0 +1,189 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { RpcContext } from '../../../core'
+import type { OrchestrationDb, RunRow } from '../../../../orchestration/db'
+import type { OrcaRuntimeService } from '../../../../orca-runtime'
+import type { DispatchContextRow } from '../../../../orchestration/types'
+import { createRootDispatch } from '../../../../orchestration/db/root-dispatch-test-fixture'
+import { createOrchestrationRpcHarness } from '../rpc-test-harness'
+
+// A lead is dispatched by a root coordinator and then coordinates its own Run from the same pane.
+// That pane's `check` reads its own Run mailbox, so mail meant for it must land there.
+describe('mail for a lead whose pane coordinates its own Run', () => {
+  const h = createOrchestrationRpcHarness()
+  const coordPane = 'tab_coord:11111111-1111-4111-8111-111111111111'
+  const leadPane = 'tab_lead:22222222-2222-4222-9222-222222222222'
+  let db: OrchestrationDb
+  let runtime: OrcaRuntimeService
+  let ctx: RpcContext
+  let rootRun: RunRow
+  let dispatch: DispatchContextRow
+
+  afterEach(() => {
+    h.cleanup()
+  })
+
+  function setup(): void {
+    ;({ db, runtime, ctx } = h.setup(false))
+    vi.spyOn(runtime, 'getTerminalPaneKey').mockImplementation((handle) =>
+      handle === 'term_coord' ? coordPane : handle === 'term_lead' ? leadPane : null
+    )
+    rootRun = db.createRun({
+      objective: 'root',
+      coordinatorHandle: 'term_coord',
+      coordinatorPaneKey: coordPane
+    })
+    const task = db.createTask({ spec: 'lead the sub-project', runId: rootRun.id })
+    dispatch = createRootDispatch(db, task.id, 'term_lead', leadPane)
+  }
+
+  function bindLeadRun(): RunRow {
+    return db.createRun({
+      objective: 'lead',
+      coordinatorHandle: 'term_lead',
+      coordinatorPaneKey: leadPane
+    })
+  }
+
+  async function call(name: string, params: Record<string, unknown>) {
+    return h.call(name, params, ctx)
+  }
+
+  async function leadInbox(params: Record<string, unknown> = {}): Promise<unknown> {
+    return call('orchestration.check', { terminal: 'term_lead', ...params })
+  }
+
+  function deliveryIdOf(result: unknown): string {
+    if (
+      typeof result === 'object' &&
+      result !== null &&
+      'deliveryId' in result &&
+      typeof result.deliveryId === 'string'
+    ) {
+      return result.deliveryId
+    }
+    throw new Error('check returned no delivery')
+  }
+
+  it('routes dispatch:<id> mail to the Run the assignee pane now coordinates', async () => {
+    setup()
+    const leadRun = bindLeadRun()
+
+    const result = await call('orchestration.send', {
+      from: 'term_coord',
+      to: `dispatch:${dispatch.id}`,
+      subject: 'Follow-up for the lead'
+    })
+
+    expect(result).toMatchObject({
+      message: { to_handle: `run:${leadRun.id}`, run_id: leadRun.id },
+      warnings: [{ code: 'recipient_run_bound_redirect' }]
+    })
+    expect(await leadInbox()).toMatchObject({ messages: [{ subject: 'Follow-up for the lead' }] })
+  })
+
+  it('still reads dispatch mail that arrived before the pane bound its own Run', async () => {
+    setup()
+    db.insertMessage({
+      from: 'term_coord',
+      to: `dispatch:${dispatch.id}`,
+      subject: 'Sent before the lead bound a Run',
+      runId: rootRun.id
+    })
+    const leadRun = bindLeadRun()
+    db.insertMessage({
+      from: 'term_worker',
+      to: `run:${leadRun.id}`,
+      subject: 'Sub-worker report',
+      runId: leadRun.id
+    })
+
+    const first = await leadInbox()
+    expect(first).toMatchObject({ messages: [{ subject: 'Sent before the lead bound a Run' }] })
+
+    const second = await leadInbox({ ack: deliveryIdOf(first) })
+    expect(second).toMatchObject({ messages: [{ subject: 'Sub-worker report' }] })
+  })
+
+  it('keeps the --types wake condition when older Dispatch mail does not match it', async () => {
+    setup()
+    db.insertMessage({
+      from: 'term_coord',
+      to: `dispatch:${dispatch.id}`,
+      subject: 'Older status note',
+      type: 'status',
+      runId: rootRun.id
+    })
+    const leadRun = bindLeadRun()
+    db.insertMessage({
+      from: 'term_worker',
+      to: `run:${leadRun.id}`,
+      subject: 'Sub-worker finished',
+      type: 'worker_done',
+      runId: leadRun.id
+    })
+
+    const woke = await leadInbox({ wait: true, types: 'worker_done', timeoutMs: 500 })
+
+    expect(woke).toMatchObject({
+      runId: leadRun.id,
+      messages: [{ subject: 'Sub-worker finished' }]
+    })
+  })
+
+  it('delivers a reply to a Run-bound sender and wakes its waiting check', async () => {
+    setup()
+    const leadRun = bindLeadRun()
+    const report = db.insertMessage({
+      from: 'term_lead',
+      to: `run:${rootRun.id}`,
+      subject: 'Lead report',
+      runId: rootRun.id
+    })
+
+    const waiting = leadInbox({ wait: true, timeoutMs: 2_000 })
+    const reply = await call('orchestration.reply', {
+      id: report.id,
+      from: 'term_coord',
+      body: 'Decision'
+    })
+
+    expect(reply).toMatchObject({
+      message: { to_handle: `run:${leadRun.id}`, run_id: leadRun.id }
+    })
+    expect(await waiting).toMatchObject({
+      timedOut: false,
+      messages: [{ subject: 'Re: Lead report' }]
+    })
+  })
+
+  it('keeps dispatch:<id> mail on the Dispatch mailbox while the assignee has no Run', async () => {
+    setup()
+
+    const result = await call('orchestration.send', {
+      from: 'term_coord',
+      to: `dispatch:${dispatch.id}`,
+      subject: 'Plain worker follow-up'
+    })
+
+    expect(result).toMatchObject({ message: { to_handle: `dispatch:${dispatch.id}` } })
+    expect(result).not.toHaveProperty('warnings')
+  })
+
+  it('keeps a reply on the raw handle when the sender has no Run or live pane', async () => {
+    setup()
+    const note = db.insertMessage({
+      from: 'term_offline',
+      to: `run:${rootRun.id}`,
+      subject: 'Offline note',
+      runId: rootRun.id
+    })
+
+    const reply = await call('orchestration.reply', {
+      id: note.id,
+      from: 'term_coord',
+      body: 'Ack'
+    })
+
+    expect(reply).toMatchObject({ message: { to_handle: 'term_offline', run_id: rootRun.id } })
+  })
+})
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/send-group.test.ts b/src/main/runtime/rpc/methods/orchestration/messaging/send-group.test.ts
index b076be06593..62d2b5da495 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/send-group.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/send-group.test.ts
@@ -69,7 +69,7 @@ describe('orchestration.send group addresses', () => {
       return terminal ? `${terminal.tabId}:${terminal.leafId}` : null
     })
     vi.spyOn(runtime, 'getAgentStatusForHandle').mockImplementation(
-      (handle: string) => agentStatuses?.[handle] ?? null
+      async (handle: string) => agentStatuses?.[handle] ?? null
     )
   }
 
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/send-group.ts b/src/main/runtime/rpc/methods/orchestration/messaging/send-group.ts
index d5ee366a40f..ebcff6c284e 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/send-group.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/send-group.ts
@@ -13,6 +13,7 @@ import { exposeMessages } from './mailbox-message-receipt'
 import { recordReceiptBeforeNudge } from './mutation-replay-nudge'
 import type { BareRecipientResolution, SendRecipientWarning } from './recipient-routing'
 import type { SendParams } from '../schemas'
+import type { OrchestrationCallerIdentity } from '../../../../orchestration/orchestration-caller-identity'
 import type { z } from 'zod'
 
 type SendParamsInput = z.infer<typeof SendParams>
@@ -94,6 +95,7 @@ export async function sendGroupMessage(args: {
   db: OrchestrationDb
   from: string
   groupAddress: string
+  sender: OrchestrationCallerIdentity
   senderPaneKey: string | undefined
   senderRunId: string | undefined
   explicitRunId: string | undefined
@@ -108,6 +110,7 @@ export async function sendGroupMessage(args: {
     db,
     from,
     groupAddress,
+    sender,
     senderPaneKey,
     senderRunId,
     explicitRunId,
@@ -117,7 +120,7 @@ export async function sendGroupMessage(args: {
   } = args
   // Audience follows the sender's binding, never a caller-supplied message Run or payload.
   function resolveAudienceRunId(): string {
-    const coordinated = senderPaneKey ? db.getCurrentRunForPane(senderPaneKey) : undefined
+    const coordinated = db.getCurrentRunForCoordinator(sender)
     const runId =
       coordinated?.id ??
       db.getActiveDispatchForIdentity(from, senderPaneKey)?.run_id ??
@@ -145,7 +148,7 @@ export async function sendGroupMessage(args: {
     const { terminals } = await runtime.listTerminals(undefined, undefined, {
       includeVisualLayouts: false
     })
-    agents = [...terminals, ...listAddressableStructuredWorkers()]
+    agents = [...terminals, ...listAddressableStructuredWorkers(db)]
   }
   // Revalidate after discovery before selecting recipients or writing mail.
   revalidateLegacyCoordinator?.()
@@ -164,8 +167,23 @@ export async function sendGroupMessage(args: {
           agents,
           warnings: groupWarnings
         })
-  const handles = resolveGroupAddress(groupAddress, from, candidates, (handle: string) =>
-    runtime.getAgentStatusForHandle(handle)
+  // Read up front: a structured worker's status comes from its journal, which may need opening.
+  const statuses =
+    groupAddress.toLowerCase() === '@idle'
+      ? new Map(
+          await Promise.all(
+            candidates.map(
+              async (candidate) =>
+                [candidate.handle, await runtime.getAgentStatusForHandle(candidate.handle)] as const
+            )
+          )
+        )
+      : new Map<string, string | null>()
+  const handles = resolveGroupAddress(
+    groupAddress,
+    from,
+    candidates,
+    (handle: string) => statuses.get(handle) ?? null
   )
   if (handles.length === 0) {
     // Preserve the recovery addresses even when every worker was skipped.
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/send-methods.ts b/src/main/runtime/rpc/methods/orchestration/messaging/send-methods.ts
index 7d1edb77602..58dcceb5598 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/send-methods.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/send-methods.ts
@@ -7,6 +7,7 @@ import { resolveMessageRun } from '../routing'
 import {
   assertDispatchMailboxDeliverable,
   resolveBareOrchestrationRecipient,
+  resolveRunBoundDispatchRecipient,
   type SendRecipientWarning
 } from './recipient-routing'
 import {
@@ -16,9 +17,11 @@ import {
 } from '../../../orchestration-mutation-executor'
 import { replayMutationNudge } from './mutation-replay-nudge'
 import { sendRemoteMessage } from './send-remote'
+import { mayNameSession } from './session-recipient'
 import { sendPointToPointMessage } from './send-point-to-point'
 import { sendGroupMessage } from './send-group'
 import { sendFederatedControlMail } from './send-control-mail'
+import { orchestrationCallerIdentity } from '../runs/run-scope'
 
 export const ORCHESTRATION_SEND_METHODS = [
   defineMethod({
@@ -35,6 +38,7 @@ export const ORCHESTRATION_SEND_METHODS = [
         recordMutationReceipt,
         markWorkerDoneMutationEffectFree,
         replayedMutationReceipt,
+        orchestrationCaller,
         signal
       }
     ) => {
@@ -59,7 +63,12 @@ export const ORCHESTRATION_SEND_METHODS = [
           ? orchestrationCompatibilityCallerAuthority
           : undefined
       // Why: attested hook identity survives graph remount; caller params never supply lifecycle authority.
-      const senderPaneKey = attestedCaller?.paneKey ?? runtime.getTerminalPaneKey(from) ?? undefined
+      const sender = orchestrationCallerIdentity(runtime, {
+        handle: from,
+        session: orchestrationCaller,
+        paneKey: attestedCaller?.paneKey ?? runtime.getTerminalPaneKey(from)
+      })
+      const senderPaneKey = sender.paneKey ?? undefined
       const remoteAttachment = senderPaneKey
         ? db.findActiveRemoteAttachmentForPane(senderPaneKey)
         : undefined
@@ -84,8 +93,7 @@ export const ORCHESTRATION_SEND_METHODS = [
         params.to && isGroupAddress(params.to) && !params.to.toLowerCase().startsWith('@worktree:')
       // Run groups validate their own audience; message scope cannot select a parent Dispatch.
       const routing = resolveMessageRun(runtime, {
-        from,
-        senderPaneKey,
+        sender,
         to: params.to,
         runId: runGroup ? undefined : params.run,
         payload: runGroup ? undefined : params.payload
@@ -125,6 +133,10 @@ export const ORCHESTRATION_SEND_METHODS = [
       const sendWarnings: SendRecipientWarning[] = []
       let messageRunId = routing.run?.id
       if (!isGroupAddress(to) && !to.startsWith('run:') && !to.startsWith('dispatch:')) {
+        if (mayNameSession(to)) {
+          // Recipient routing reads the session record store, which the host opens lazily.
+          await runtime.ensureStructuredAgentSessionHost().catch(() => undefined)
+        }
         const recipient = resolveBareOrchestrationRecipient({
           runtime,
           db,
@@ -156,7 +168,18 @@ export const ORCHESTRATION_SEND_METHODS = [
             : undefined
         // Federated targets perform their own liveness check before relaying.
         if (addressedDispatchId && !federatedTarget) {
-          assertDispatchMailboxDeliverable(db, addressedDispatchId)
+          assertDispatchMailboxDeliverable(runtime, db, addressedDispatchId)
+          const runBound = resolveRunBoundDispatchRecipient(
+            runtime,
+            db,
+            addressedDispatchId,
+            params.run
+          )
+          if (runBound) {
+            to = runBound.to
+            messageRunId = runBound.runId
+            sendWarnings.push(runBound.warning)
+          }
         }
         const federatedControl = sendFederatedControlMail({
           params,
@@ -199,6 +222,7 @@ export const ORCHESTRATION_SEND_METHODS = [
         db,
         from,
         groupAddress: to,
+        sender,
         senderPaneKey,
         senderRunId: routing.run?.id,
         explicitRunId: params.run,
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/session-recipient.ts b/src/main/runtime/rpc/methods/orchestration/messaging/session-recipient.ts
new file mode 100644
index 00000000000..a22975c0454
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/session-recipient.ts
@@ -0,0 +1,118 @@
+/**
+ * An agent session named as a recipient: `session:<id>`, or a bare Orca session id. Any session on
+ * this host can be addressed, not only one that coordinates a Run: an agent's id is its public
+ * address, and a user telling one agent to message another's id is a supported workflow.
+ *
+ * Mail that no Run or Dispatch owns is stored at the conversation's `session:<root id>` and pointed
+ * at its live session as a turn, so any session of a `/clear` lineage is a valid spelling. A
+ * released lease is not a refusal (the pointer's send starts its agent); a closed chat, another host,
+ * and an unknown id are, before anything is stored.
+ */
+
+import {
+  ORCA_SESSION_ADDRESS_PREFIX,
+  formatOrcaSessionAddress,
+  isOrcaSessionId,
+  parseOrcaSessionAddress,
+  type OrcaSessionAddress,
+  type OrcaSessionId
+} from '../../../../../../shared/orca-session-address'
+// The caller codes, reused: each names the same fact about a session, whichever side of the mail it is on.
+import { ORCHESTRATION_SESSION_CALLER_ERROR_CODES as CODES } from '../../../../../../shared/orchestration-session-caller-codes'
+import {
+  lookupOrcaAgentSession,
+  structuredSessionMailReach
+} from '../../../../orchestration/structured-session-mail-address'
+import type { AgentSessionRecordReader } from '../../../../orchestration/structured-session-lineage'
+import type { OrchestrationDb } from '../../../../orchestration/db'
+
+/** `address` is the named session's own spelling; the mailbox mail lands in is its identity address. */
+export type SessionRecipient = { sessionId: OrcaSessionId; address: OrcaSessionAddress }
+
+export type SessionRecipientRefusal = {
+  code: (typeof CODES)[keyof typeof CODES]
+  message: string
+}
+
+/** Whether a recipient may name a session, so the caller can install the session host first. */
+export function mayNameSession(recipient: string): boolean {
+  return recipient.startsWith(ORCA_SESSION_ADDRESS_PREFIX) || isOrcaSessionId(recipient)
+}
+
+/**
+ * The session a recipient names. A bare string names a session only when it is an Orca session id
+ * this host has a record for; anything else stays a terminal handle, exactly as before.
+ */
+export function readSessionRecipient(
+  recipient: string,
+  store: AgentSessionRecordReader | null
+): SessionRecipient | SessionRecipientRefusal | null {
+  if (recipient.startsWith(ORCA_SESSION_ADDRESS_PREFIX)) {
+    const sessionId = parseOrcaSessionAddress(recipient)
+    return sessionId
+      ? { sessionId, address: formatOrcaSessionAddress(sessionId) }
+      : {
+          code: CODES.unknown,
+          message: `${recipient} does not name an Orca agent session id. No message was sent.`
+        }
+  }
+  const sessionId = isOrcaSessionId(recipient) ? recipient : null
+  const found = sessionId && store ? lookupOrcaAgentSession(store, sessionId) : null
+  if (found?.kind === 'provider-id') {
+    return providerIdRefusal(recipient, found.orcaSessionId)
+  }
+  return sessionId && found?.kind === 'found'
+    ? { sessionId, address: formatOrcaSessionAddress(sessionId) }
+    : null
+}
+
+/** Null when mail to this session can be stored and delivered here; otherwise why not. */
+export function refuseUndeliverableSessionRecipient(
+  recipient: SessionRecipient,
+  store: AgentSessionRecordReader | null,
+  db: OrchestrationDb
+): SessionRecipientRefusal | null {
+  const { sessionId } = recipient
+  if (!store) {
+    return {
+      code: CODES.unknown,
+      message: `Agent session ${sessionId} cannot be verified: this Orca is not running its agent-session host. No message was sent.`
+    }
+  }
+  const found = lookupOrcaAgentSession(store, sessionId)
+  if (found.kind === 'provider-id') {
+    return providerIdRefusal(sessionId, found.orcaSessionId)
+  }
+  if (found.kind === 'unknown') {
+    return {
+      code: CODES.unknown,
+      message: `No Orca agent session ${sessionId} exists on this host. No message was sent.`
+    }
+  }
+  const reach = structuredSessionMailReach(store, found.record, db)
+  if (reach.kind === 'other-host') {
+    return {
+      code: CODES.hostBoundary,
+      message: `Agent session ${sessionId} runs on another host; mail reaches a session only on the host that runs it. Send from that host. No message was sent.`
+    }
+  }
+  if (reach.kind === 'ended') {
+    return {
+      code: CODES.notLive,
+      message:
+        reach.reason === 'continuation-missing'
+          ? `Agent session ${sessionId} was cleared, and this host has no record of the session that continues it. No message was sent.`
+          : reach.reason === 'worker-identity-lost'
+            ? `Agent session ${sessionId} is a structured worker whose worker identity this host no longer has, so it can never read that mail. No message was sent.`
+            : `Agent session ${sessionId} has ended: its chat was closed. No message was sent.`
+    }
+  }
+  return null
+}
+
+function providerIdRefusal(id: string, orcaSessionId: string): SessionRecipientRefusal {
+  return {
+    code: CODES.providerId,
+    message: `${id} is the provider's own session id, which changes on /clear. This session's Orca address is ${ORCA_SESSION_ADDRESS_PREFIX}${orcaSessionId}; use that instead. No message was sent.`
+  }
+}
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/settled-dispatch-mail.test.ts b/src/main/runtime/rpc/methods/orchestration/messaging/settled-dispatch-mail.test.ts
index e91614061ea..ddffed46890 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/settled-dispatch-mail.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/settled-dispatch-mail.test.ts
@@ -1,4 +1,4 @@
-import { afterEach, describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { RpcContext } from '../../../core'
 import type { OrchestrationDb } from '../../../../orchestration/db'
 import { createRootDispatch } from '../../../../orchestration/db/root-dispatch-test-fixture'
@@ -58,6 +58,38 @@ describe('orchestration.send to a settled Dispatch mailbox', () => {
     ).rejects.toThrow(new RegExp(`run:${dispatch.run_id}`))
   })
 
+  it('names the Run a settled assignee now coordinates, not the sender Run', async () => {
+    setup()
+    const leadPane = 'tab_lead:22222222-2222-4222-9222-222222222222'
+    vi.spyOn(ctx.runtime, 'getLiveTerminalPaneKey').mockReturnValue(leadPane)
+    const task = db.createTask({ spec: 'lead that settled and kept coordinating' })
+    const dispatch = createRootDispatch(db, task.id, 'term_lead', leadPane)
+    db.completeDispatch(dispatch.id)
+    const leadRun = db.createRun({
+      objective: 'lead',
+      coordinatorHandle: 'term_lead',
+      coordinatorPaneKey: leadPane
+    })
+
+    const rejection = call('orchestration.send', {
+      from: 'term_coord',
+      to: `dispatch:${dispatch.id}`,
+      subject: 'One more thing'
+    })
+
+    await expect(rejection).rejects.toMatchObject({ code: 'dispatch_inactive' })
+    await expect(rejection).rejects.toThrow(new RegExp(`run:${leadRun.id}`))
+    await expect(rejection).rejects.not.toThrow(new RegExp(`run:${dispatch.run_id}`))
+    expect(db.getInbox()).toEqual([])
+    await expect(
+      call('orchestration.check', { terminal: 'term_coord', run: leadRun.id })
+    ).rejects.toMatchObject({ code: 'consumer_fenced' })
+    // Run addresses are already visible to callers; a hint grants no consuming authority.
+    expect(await call('orchestration.runShow', { id: leadRun.id })).toMatchObject({
+      run: { id: leadRun.id }
+    })
+  })
+
   it('does not write an undeliverable message row', async () => {
     setup()
     const task = db.createTask({ spec: 'worker that already reported' })
diff --git a/src/main/runtime/rpc/methods/orchestration/routing.ts b/src/main/runtime/rpc/methods/orchestration/routing.ts
index 47001283895..5978eb60cd1 100644
--- a/src/main/runtime/rpc/methods/orchestration/routing.ts
+++ b/src/main/runtime/rpc/methods/orchestration/routing.ts
@@ -1,6 +1,7 @@
 import type { MessageType } from '../../../orchestration/db'
 import type { RunRow } from '../../../orchestration/types'
 import type { OrcaRuntimeService } from '../../../orca-runtime'
+import type { OrchestrationCallerIdentity } from '../../../orchestration/orchestration-caller-identity'
 import { MESSAGE_TYPES } from '../../../orchestration/types'
 import { OrchestrationError } from '../../../orchestration/orchestration-error'
 import { LEGACY_CONTRACT_VERSION } from '../../../orchestration/db'
@@ -20,8 +21,8 @@ export function parseMessageTypes(rawTypes: string | undefined): MessageType[] |
 export function resolveMessageRun(
   runtime: OrcaRuntimeService,
   params: {
-    from?: string
-    senderPaneKey?: string
+    /** The sender as Run binding and Dispatch identity see it. */
+    sender: OrchestrationCallerIdentity
     to?: string
     runId?: string
     payload?: string
@@ -50,9 +51,7 @@ export function resolveMessageRun(
 
   const dispatch = dispatchId
     ? db.getDispatchContextById(dispatchId)
-    : params.from
-      ? db.getActiveDispatchForIdentity(params.from, params.senderPaneKey)
-      : undefined
+    : db.getActiveDispatchForIdentity(params.sender.address, params.sender.paneKey ?? undefined)
   if (params.to?.startsWith('dispatch:') && !dispatch) {
     throw new OrchestrationError(
       'dispatch_not_found',
@@ -63,9 +62,8 @@ export function resolveMessageRun(
   const resolvedRunId = params.runId ?? targetRunId ?? dispatch?.run_id
   let run = resolvedRunId ? db.getRun(resolvedRunId) : undefined
 
-  if (!run && params.from) {
-    const paneKey = params.senderPaneKey ?? runtime.getTerminalPaneKey(params.from)
-    run = paneKey ? db.getCurrentRunForPane(paneKey) : undefined
+  if (!run) {
+    run = db.getCurrentRunForCoordinator(params.sender)
   }
   if (resolvedRunId && (!run || run.legacy === 1)) {
     throw new OrchestrationError('run_not_found', `Run ${resolvedRunId} was not found.`)
diff --git a/src/main/runtime/rpc/methods/orchestration/runs/dispatch-creator.ts b/src/main/runtime/rpc/methods/orchestration/runs/dispatch-creator.ts
index 8cdbcb8da11..0ee7f7523e7 100644
--- a/src/main/runtime/rpc/methods/orchestration/runs/dispatch-creator.ts
+++ b/src/main/runtime/rpc/methods/orchestration/runs/dispatch-creator.ts
@@ -1,5 +1,7 @@
 import type { DispatchCreator } from '../../../../orchestration/db/dispatch-depth'
+import type { OrchestrationSessionCaller } from '../../../../orchestration/orchestration-caller-identity'
 import type { OrcaRuntimeService } from '../../../../orca-runtime'
+import { orchestrationCallerIdentity } from './run-scope'
 
 /**
  * Identify a CLI caller for nesting-depth purposes.
@@ -10,18 +12,35 @@ import type { OrcaRuntimeService } from '../../../../orca-runtime'
  */
 export function resolveDispatchCreator(
   runtime: OrcaRuntimeService,
-  callerHandle: string | undefined
+  callerHandle: string | undefined,
+  callerSession: OrchestrationSessionCaller | undefined
 ): DispatchCreator {
   if (!callerHandle) {
     // No declared caller means no resolvable parent. Depth 0 is the same answer
     // the pre-existing Run-binding check already gives this case.
     return { kind: 'system' }
   }
-  const authority = runtime.getOrchestrationDispatchAuthority?.(callerHandle)
+  const caller = orchestrationCallerIdentity(runtime, {
+    handle: callerHandle,
+    session: callerSession,
+    paneKey: null
+  })
+  if (caller.terminalHandle === null) {
+    // A handle-less session: its Orca session id is its whole identity.
+    return caller.orcaSessionId
+      ? { kind: 'session', orcaSessionId: caller.orcaSessionId }
+      : { kind: 'system' }
+  }
+  const authority = runtime.getOrchestrationDispatchAuthority?.(caller.terminalHandle)
   return {
     kind: 'terminal',
-    handle: callerHandle,
-    paneKey: authority?.paneKey ?? runtime.getTerminalPaneKey(callerHandle) ?? undefined,
-    processIncarnation: authority?.processIncarnation ?? undefined
+    handle: caller.terminalHandle,
+    paneKey:
+      authority?.paneKey ??
+      caller.paneKey ??
+      runtime.getTerminalPaneKey(caller.terminalHandle) ??
+      undefined,
+    processIncarnation: authority?.processIncarnation ?? undefined,
+    ...(caller.orcaSessionId ? { orcaSessionId: caller.orcaSessionId } : {})
   }
 }
diff --git a/src/main/runtime/rpc/methods/orchestration/runs/dispatch-methods.ts b/src/main/runtime/rpc/methods/orchestration/runs/dispatch-methods.ts
index 75c83878335..843df33357a 100644
--- a/src/main/runtime/rpc/methods/orchestration/runs/dispatch-methods.ts
+++ b/src/main/runtime/rpc/methods/orchestration/runs/dispatch-methods.ts
@@ -12,6 +12,7 @@ import {
 } from '../../../../orchestration/task-dispatch-refusal'
 import { resolveRunScope } from './run-scope'
 import { DispatchParams, DispatchShowParams } from '../schemas'
+import { resolveDispatchAssigneeParty } from '../../../../orchestration/orchestration-party'
 
 export const ORCHESTRATION_DISPATCH_METHODS = [
   defineMethod({
@@ -21,6 +22,7 @@ export const ORCHESTRATION_DISPATCH_METHODS = [
       params,
       {
         orchestrationCompatibilityEvidence,
+        orchestrationCaller,
         runtime,
         legacyCoordinatorRunId,
         revalidateLegacyCoordinator,
@@ -37,7 +39,8 @@ export const ORCHESTRATION_DISPATCH_METHODS = [
         callerTerminalHandle: params.from,
         requireCurrentConsumer: true,
         legacyCoordinatorRunId,
-        callerEvidence: orchestrationCompatibilityEvidence
+        callerEvidence: orchestrationCompatibilityEvidence,
+        callerSession: orchestrationCaller
       })
       if (task.run_id !== run.id) {
         throw taskNotFoundError(`Task ${task.id} was not found in Run ${run.id}.`, {
@@ -45,12 +48,13 @@ export const ORCHESTRATION_DISPATCH_METHODS = [
           runId: run.id
         })
       }
+      const assignee = params.to ? resolveDispatchAssigneeParty(params.to, db).address : undefined
 
       // Why: dry-run previews the preamble without mutating state, so it skips the ready-status check and uses a placeholder dispatchId.
       if (params.dryRun) {
         const maxDepth = runtime.getNestedWorkerMaxDepth()
         const previewDepth = db.resolveChildDispatchDepth(
-          resolveDispatchCreator(runtime, params.from),
+          resolveDispatchCreator(runtime, params.from, orchestrationCaller),
           maxDepth
         )
         const preamble = buildDispatchPreamble({
@@ -59,19 +63,17 @@ export const ORCHESTRATION_DISPATCH_METHODS = [
           canDispatchSubWorkers: previewDepth < maxDepth,
           taskSpec: task.spec,
           coordinatorHandle: params.from ?? 'coordinator',
-          workerHandle: params.to ?? 'worker',
+          workerHandle: assignee ?? 'worker',
           devMode: params.devMode,
-          ...(params.to
-            ? { cliCommand: runtime.getTerminalOrchestrationCliCommand(params.to) }
-            : {})
+          ...(assignee ? { cliCommand: runtime.getTerminalOrchestrationCliCommand(assignee) } : {})
         })
         return { dispatch: null, injected: false, dryRun: true, preamble }
       }
 
-      if (!params.to) {
+      if (!assignee) {
         throw new Error('Missing --to')
       }
-      const to = params.to
+      const to = assignee
 
       if (task.status !== 'ready') {
         throw taskNotStartableError(
@@ -131,7 +133,7 @@ export const ORCHESTRATION_DISPATCH_METHODS = [
         assigneePaneKey,
         launchTokenHash: dispatchAuthority?.launchTokenHash ?? undefined,
         processIncarnation,
-        creator: resolveDispatchCreator(runtime, params.from),
+        creator: resolveDispatchCreator(runtime, params.from, orchestrationCaller),
         maxDepth: runtime.getNestedWorkerMaxDepth()
       })
       const dispatchCapability = params.inject
diff --git a/src/main/runtime/rpc/methods/orchestration/runs/run-receipt.test.ts b/src/main/runtime/rpc/methods/orchestration/runs/run-receipt.test.ts
index 49afdfe119a..93d6f7bdda9 100644
--- a/src/main/runtime/rpc/methods/orchestration/runs/run-receipt.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration/runs/run-receipt.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import { exposeRun } from './run-receipt'
 import type { RunRow } from '../../../../orchestration/types'
+import { testOrcaSessionId } from '../../../../../../shared/orca-session-address-test-fixture'
 
 // Why: typecheck cannot see the strip because the RPC return types are loose.
 const RUN_ROW: RunRow = {
@@ -9,7 +10,7 @@ const RUN_ROW: RunRow = {
   home_database: '/tmp/orca/orchestration.db',
   coordinator_handle: 'term_coord',
   coordinator_pane_key: 'tab_coord:11111111-1111-4111-8111-111111111111',
-  coordinator_orca_session_id: '22222222-2222-4222-8222-222222222222',
+  coordinator_orca_session_id: testOrcaSessionId('22222222-2222-4222-8222-222222222222'),
   coordinator_orca_session_id_generation: 3,
   consumer_generation: 3,
   legacy: 0,
diff --git a/src/main/runtime/rpc/methods/orchestration/runs/run-scope.ts b/src/main/runtime/rpc/methods/orchestration/runs/run-scope.ts
index 6b066723315..0496c92806e 100644
--- a/src/main/runtime/rpc/methods/orchestration/runs/run-scope.ts
+++ b/src/main/runtime/rpc/methods/orchestration/runs/run-scope.ts
@@ -6,11 +6,19 @@ import type {
   OrcaRuntimeService,
   OrchestrationCompatibilityCallerAuthority
 } from '../../../../orca-runtime'
+import {
+  hasRunBindingKey,
+  type OrchestrationCallerIdentity,
+  type OrchestrationSessionCaller
+} from '../../../../orchestration/orchestration-caller-identity'
+import { resolveDeclaredCallerParty } from '../../../../orchestration/orchestration-party'
 
 export type RunScopeParams = {
   runId?: string
   callerTerminalHandle?: string
   callerPaneKey?: string
+  /** Resolved at the dispatch entry; when set it is the caller, whatever the declared handle. */
+  callerSession: OrchestrationSessionCaller | undefined
   requireCurrentConsumer: boolean
   legacyCoordinatorRunId?: string
   // Why: the caller's declared handle is a user param; this is the attested one to check it against.
@@ -36,10 +44,30 @@ export function assertCallerHandleMatchesEvidence(
   }
 }
 
+/**
+ * The caller as Run binding and mail routing see it. A session the dispatch entry resolved is the
+ * caller outright; otherwise it is the party the declared handle names, at the pane it resolved to.
+ */
+export function orchestrationCallerIdentity(
+  runtime: OrcaRuntimeService,
+  caller: {
+    handle: string
+    paneKey: string | null | undefined
+    session: OrchestrationSessionCaller | undefined
+  }
+): OrchestrationCallerIdentity {
+  if (caller.session) {
+    return caller.session
+  }
+  const party = resolveDeclaredCallerParty(caller.handle, runtime.getOrchestrationDb())
+  return { ...party, paneKey: caller.paneKey ?? null }
+}
+
 export type OrchestrationCallerParams = {
   callerTerminalHandle: string
   callerEvidence?: OrchestrationCompatibilityEvidence
   callerAuthority?: OrchestrationCompatibilityCallerAuthority
+  callerSession: OrchestrationSessionCaller | undefined
   /** Preserve legacy callers that treated a missing pane as an ordinary fence. */
   requireStablePane?: boolean
   /**
@@ -50,33 +78,42 @@ export type OrchestrationCallerParams = {
   evidenceAssertedByCaller?: boolean
 }
 
-/** Resolve the caller's runtime pane and, by default, attest its declared handle. */
+/** Resolve the caller's identity and, by default, attest its declared handle. */
 export function resolveOrchestrationCaller(
   runtime: OrcaRuntimeService,
   params: OrchestrationCallerParams & { requireStablePane: true }
-): string
+): OrchestrationCallerIdentity
 export function resolveOrchestrationCaller(
   runtime: OrcaRuntimeService,
   params: OrchestrationCallerParams
-): string | null
+): OrchestrationCallerIdentity | null
 export function resolveOrchestrationCaller(
   runtime: OrcaRuntimeService,
   params: OrchestrationCallerParams
-): string | null {
+): OrchestrationCallerIdentity | null {
   if (!params.evidenceAssertedByCaller) {
     assertCallerHandleMatchesEvidence(runtime, params.callerTerminalHandle, params.callerEvidence)
   }
-  const paneKey =
-    params.callerAuthority?.terminalHandle === params.callerTerminalHandle
-      ? params.callerAuthority.paneKey
-      : runtime.getTerminalPaneKey(params.callerTerminalHandle)
-  if (!paneKey && params.requireStablePane) {
-    throw new OrchestrationError(
-      'stable_pane_required',
-      'The coordinator terminal has no stable pane identity. Run this command inside a live Orca terminal.'
-    )
+  const caller = orchestrationCallerIdentity(runtime, {
+    handle: params.callerTerminalHandle,
+    session: params.callerSession,
+    paneKey:
+      params.callerSession === undefined
+        ? params.callerAuthority?.terminalHandle === params.callerTerminalHandle
+          ? params.callerAuthority.paneKey
+          : runtime.getTerminalPaneKey(params.callerTerminalHandle)
+        : undefined
+  })
+  if (!hasRunBindingKey(caller)) {
+    if (params.requireStablePane) {
+      throw new OrchestrationError(
+        'stable_pane_required',
+        'The coordinator terminal has no stable pane identity. Run this command inside a live Orca terminal.'
+      )
+    }
+    return null
   }
-  return paneKey ?? null
+  return caller
 }
 
 // Why: task and gate mutations must share one Run-binding rule.
@@ -101,14 +138,21 @@ export function resolveRunScope(runtime: OrcaRuntimeService, params: RunScopePar
   if (explicit && params.legacyCoordinatorRunId === explicit.id) {
     return explicit
   }
-  const paneKey = params.callerPaneKey ?? runtime.getTerminalPaneKey(params.callerTerminalHandle)
-  if (!paneKey) {
+  const caller = orchestrationCallerIdentity(runtime, {
+    handle: params.callerTerminalHandle,
+    session: params.callerSession,
+    paneKey:
+      params.callerSession === undefined
+        ? (params.callerPaneKey ?? runtime.getTerminalPaneKey(params.callerTerminalHandle))
+        : undefined
+  })
+  if (!hasRunBindingKey(caller)) {
     throw new OrchestrationError(
       'stable_pane_required',
       'The coordinator terminal has no stable pane identity.'
     )
   }
-  const current = db.getCurrentRunForPane(paneKey)
+  const current = db.getCurrentRunForCoordinator(caller)
   if (!current) {
     if (explicit) {
       throw new OrchestrationError(
diff --git a/src/main/runtime/rpc/methods/orchestration/runs/runs.ts b/src/main/runtime/rpc/methods/orchestration/runs/runs.ts
index eab6eb2913e..88653af8ecd 100644
--- a/src/main/runtime/rpc/methods/orchestration/runs/runs.ts
+++ b/src/main/runtime/rpc/methods/orchestration/runs/runs.ts
@@ -2,6 +2,9 @@ import { defineMethod } from '../../../core'
 import { OrchestrationError } from '../../../../orchestration/orchestration-error'
 import { assertCallerHandleMatchesEvidence, resolveOrchestrationCaller } from './run-scope'
 import { exposeRun } from './run-receipt'
+import type { OrcaRuntimeService } from '../../../../orca-runtime'
+import type { OrchestrationCallerIdentity } from '../../../../orchestration/orchestration-caller-identity'
+import { currentDispatchAssigneeRun } from '../messaging/recipient-routing'
 import {
   RunCreateParams,
   RunCurrentParams,
@@ -10,24 +13,39 @@ import {
   RunUseParams
 } from '../../../../../../shared/rpc-contract/orchestration-runs-params'
 
+function cancelBoundDispatchWaiters(
+  runtime: OrcaRuntimeService,
+  caller: OrchestrationCallerIdentity,
+  runId: string
+): void {
+  const db = runtime.getOrchestrationDb()
+  const dispatch = db.getActiveDispatchForIdentity(caller.address, caller.paneKey ?? undefined)
+  if (dispatch && currentDispatchAssigneeRun(runtime, db, dispatch)?.id === runId) {
+    runtime.cancelMessageWaiters(`dispatch:${dispatch.id}`)
+  }
+}
+
 export const ORCHESTRATION_RUN_METHODS = [
   defineMethod({
     name: 'orchestration.runCreate',
     params: RunCreateParams,
-    handler: (params, { orchestrationCompatibilityEvidence, runtime }) => {
-      const paneKey = resolveOrchestrationCaller(runtime, {
+    handler: (params, { orchestrationCompatibilityEvidence, orchestrationCaller, runtime }) => {
+      const caller = resolveOrchestrationCaller(runtime, {
         callerTerminalHandle: params.from,
         callerEvidence: orchestrationCompatibilityEvidence,
+        callerSession: orchestrationCaller,
         requireStablePane: true
       })
       const db = runtime.getOrchestrationDb()
-      const priorRun = db.getCurrentRunForPane(paneKey)
+      const priorRun = db.getCurrentRunForCoordinator(caller)
       const run = db.createRun({
         objective: params.objective,
-        coordinatorHandle: params.from,
-        coordinatorPaneKey: paneKey
+        coordinatorHandle: caller.terminalHandle,
+        coordinatorPaneKey: caller.paneKey,
+        coordinatorOrcaSessionId: caller.orcaSessionId
       })
       runtime.cancelMessageWaiters(params.from)
+      cancelBoundDispatchWaiters(runtime, caller, run.id)
       if (priorRun) {
         runtime.cancelMessageWaiters(`run:${priorRun.id}`)
       }
@@ -43,19 +61,22 @@ export const ORCHESTRATION_RUN_METHODS = [
         runtime,
         legacyCoordinatorAuthority,
         orchestrationCompatibilityEvidence,
-        orchestrationCompatibilityCallerAuthority: callerAuthority
+        orchestrationCompatibilityCallerAuthority: callerAuthority,
+        orchestrationCaller
       }
     ) => {
-      const paneKey = resolveOrchestrationCaller(runtime, {
+      const caller = resolveOrchestrationCaller(runtime, {
         callerTerminalHandle: params.from,
         callerEvidence: orchestrationCompatibilityEvidence,
         callerAuthority,
+        callerSession: orchestrationCaller,
         requireStablePane: true,
         evidenceAssertedByCaller: true
       })
       if (
         params.takeoverLegacy &&
-        (callerAuthority?.terminalHandle !== params.from || callerAuthority.paneKey !== paneKey)
+        (callerAuthority?.terminalHandle !== params.from ||
+          callerAuthority.paneKey !== caller.paneKey)
       ) {
         throw new OrchestrationError(
           'legacy_read_only',
@@ -65,11 +86,12 @@ export const ORCHESTRATION_RUN_METHODS = [
       }
       assertCallerHandleMatchesEvidence(runtime, params.from, orchestrationCompatibilityEvidence)
       const db = runtime.getOrchestrationDb()
-      const priorRun = db.getCurrentRunForPane(paneKey)
+      const priorRun = db.getCurrentRunForCoordinator(caller)
       const run = db.bindRun({
         runId: params.id,
-        coordinatorHandle: params.from,
-        coordinatorPaneKey: paneKey,
+        coordinatorHandle: caller.terminalHandle,
+        coordinatorPaneKey: caller.paneKey,
+        coordinatorOrcaSessionId: caller.orcaSessionId,
         takeoverLegacy: params.takeoverLegacy,
         legacyCoordinatorAuthority
       })
@@ -80,6 +102,7 @@ export const ORCHESTRATION_RUN_METHODS = [
         )
       }
       runtime.cancelMessageWaiters(params.from)
+      cancelBoundDispatchWaiters(runtime, caller, run.id)
       runtime.cancelMessageWaiters(`run:${params.id}`)
       if (priorRun && priorRun.id !== params.id) {
         runtime.cancelMessageWaiters(`run:${priorRun.id}`)
@@ -90,13 +113,14 @@ export const ORCHESTRATION_RUN_METHODS = [
   defineMethod({
     name: 'orchestration.runCurrent',
     params: RunCurrentParams,
-    handler: (params, { orchestrationCompatibilityEvidence, runtime }) => {
-      const paneKey = resolveOrchestrationCaller(runtime, {
+    handler: (params, { orchestrationCompatibilityEvidence, orchestrationCaller, runtime }) => {
+      const caller = resolveOrchestrationCaller(runtime, {
         callerTerminalHandle: params.from,
         callerEvidence: orchestrationCompatibilityEvidence,
+        callerSession: orchestrationCaller,
         requireStablePane: true
       })
-      const run = runtime.getOrchestrationDb().getCurrentRunForPane(paneKey)
+      const run = runtime.getOrchestrationDb().getCurrentRunForCoordinator(caller)
       return { run: run ? exposeRun(run) : null }
     }
   }),
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/agent-status-producer-census.test.ts b/src/main/runtime/rpc/methods/orchestration/worker/agent-status-producer-census.test.ts
index cef9e7dd8c1..e939d8a05f7 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/agent-status-producer-census.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/agent-status-producer-census.test.ts
@@ -1,4 +1,3 @@
-import { resolve } from 'node:path'
 import { describe, expect, it, vi } from 'vitest'
 
 const { ipcHandlers } = vi.hoisted(() => ({
@@ -31,10 +30,6 @@ vi.mock('@electron-toolkit/utils', () => ({
 }))
 
 import type Database from '../../../../../sqlite/sync-database'
-import {
-  scanSourceTree,
-  stripComments
-} from '../../../../../../shared/source-scan/source-tree-scan'
 import type { AgentStatusIpcPayload } from '../../../../../../shared/agent-status-ipc-payload'
 import { toAgentStatusIpcPayload } from '../../../../../agent-hooks/server/server-status-identity'
 import type { EnrichedAgentHookEventPayload } from '../../../../../agent-hooks/server/server-types'
@@ -47,119 +42,6 @@ import { OrcaRuntimeService } from '../../../../orca-runtime'
 import { ORCHESTRATION_WORKER_LIST_METHOD } from './worker-list-method'
 import { projectFleetWorkerPage } from './worker-observation'
 
-/**
- * Census of every production site in `src/main` that turns hook-server agent-status rows into
- * something a consumer reads.
- *
- * Why a census and not a single seam test: the false-liveness bug (rework failure table L-1) was
- * one such site publishing rows that carry a pane key and nothing else, into a consumer that
- * matches on terminal identity. Fixing that site fixes nothing if a fifth one is added beside it,
- * so the list is pinned and the identity-bearing paths are each driven end to end.
- */
-type CensusRow = {
-  path: string
-  /** `produces` = mints payloads a consumer reads; `consumes` = reads them; `wiring` = neither. */
-  kind: 'produces' | 'consumes' | 'wiring'
-  role: string
-}
-
-const CENSUS: readonly CensusRow[] = [
-  {
-    path: 'main/ipc/agent-hooks.ts',
-    kind: 'produces',
-    role: 'agentStatus:getSnapshot — renderer pull, enriched (driven below)'
-  },
-  {
-    path: 'main/ipc/agent-status-ipc-boundary.ts',
-    kind: 'produces',
-    role: 'resolveAgentStatusBinding — the one identity lookup the pull and fleet paths share'
-  },
-  {
-    path: 'main/runtime/agent-status-observed-pane-identity.ts',
-    kind: 'produces',
-    role: 'captures the identity a hook row was observed under (fleet-status-observed-identity)'
-  },
-  {
-    path: 'main/runtime/orchestration-fleet-agent-status-snapshot.ts',
-    kind: 'produces',
-    role: 'readOrchestrationFleetAgentStatusSnapshot — the minted fleet evidence (driven below)'
-  },
-  {
-    path: 'main/startup/main-window-agent-status.ts',
-    kind: 'produces',
-    role: 'agentStatus:set — renderer live push, enriched inline (driven below)'
-  },
-  {
-    path: 'main/startup/main-process-runtime-service.ts',
-    kind: 'wiring',
-    role: 'binds the hook server snapshot into the runtime deps'
-  },
-  {
-    path: 'main/orcad/orcad-entry.ts',
-    kind: 'wiring',
-    role: 'binds the same snapshot, OSC producer and structured sink into the headless orcad runtime deps'
-  },
-  {
-    path: 'main/runtime/orca-runtime-state-fields.ts',
-    kind: 'wiring',
-    role: 'stores the snapshot deps on the runtime'
-  },
-  {
-    path: 'main/runtime/orca-runtime-preserved-branch-cleanup.ts',
-    kind: 'wiring',
-    role: 'declares the snapshot dep fields'
-  },
-  {
-    path: 'main/runtime/orca-runtime-get-orchestration-dispatch-authority.ts',
-    kind: 'produces',
-    role: 'getOrchestrationFleetAgentStatusSnapshot — delegates to the checked snapshot module'
-  },
-  {
-    path: 'main/runtime/orca-runtime-stop-requested-pty-ids.ts',
-    kind: 'wiring',
-    role: 'feeds the enriched fleet rows to the orchestration projection'
-  },
-  {
-    path: 'main/runtime/runtime-agent-orchestration-projection.ts',
-    kind: 'consumes',
-    role: 'indexes rows by pane key to attach dispatch context'
-  },
-  {
-    path: 'main/runtime/rpc/methods/orchestration/worker/worker-list-method.ts',
-    kind: 'consumes',
-    role: 'worker-list fleet verdict (driven below)'
-  },
-  {
-    path: 'main/runtime/rpc/methods/orchestration/worker/worker-observation.ts',
-    kind: 'consumes',
-    role: 'worker-show fleet verdict (driven below)'
-  },
-  {
-    path: 'main/runtime/orca-runtime-get-worktree-ps.ts',
-    kind: 'consumes',
-    role: 'worktree.ps inline agent rows (driven below)'
-  },
-  {
-    path: 'main/runtime/orca-runtime-get-terminal-interactive-wait.ts',
-    kind: 'consumes',
-    role: 'exact-worker provider session selection, matched on pane key'
-  },
-  {
-    path: 'main/runtime/orca-runtime-serialize-agent-prompt-submission.ts',
-    kind: 'consumes',
-    role: 'prompt-submission serialization, matched on pane key'
-  },
-  {
-    path: 'main/runtime/orca-runtime-prune-mobile-session-tab-group-layout.ts',
-    kind: 'consumes',
-    role: 'mobile tab-group pruning and its live agent row, plus the pane identity accessors'
-  }
-]
-
-/** The names a hook row travels under. A new producer has to use one of them to reach a consumer. */
-const PRODUCER_TOKENS =
-  /getAgentStatusSnapshot|getAgentProviderSessionSnapshot|enrichAgentStatusIpcPayload|mintAgentStatusFleetEvidence|resolveAgentStatusBinding|getOrchestrationFleetAgentStatusSnapshot|agentStatus:set/
-
 const PANE_KEY = 'tab-census:leaf-census'
 const TERMINAL_HANDLE = 'term_census'
 const PROCESS_INCARNATION = 'pty-census:inc-1'
@@ -258,17 +140,7 @@ function censusStore() {
   }
 }
 
-describe('agent status producer census', () => {
-  it('pins every production site that hands hook rows to a consumer', () => {
-    const root = resolve(import.meta.dirname, '../../../../../..')
-    const scanned = scanSourceTree(resolve(root, 'main'))
-      .filter((file) => PRODUCER_TOKENS.test(stripComments(file.source)))
-      .map((file) => `main/${file.relativePath}`)
-      .sort()
-
-    expect(scanned).toEqual(CENSUS.map((row) => row.path).sort())
-  })
-
+describe('agent status identity across every producer and consumer path', () => {
   it('reads live on worker-list from a hook row that carries only a pane key', async () => {
     const db = new OrchestrationDb(':memory:')
     try {
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts b/src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts
index 8459a9886e4..d265858b024 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts
@@ -155,6 +155,7 @@ describe('orchestration RPC methods', () => {
       // the tab without scrolling the sidebar to the worker's workspace.
       expect(runtime.createTerminal).toHaveBeenCalledWith('id:repo::worktree', {
         startupAgent: 'codex',
+        launchSource: 'orchestration',
         title: `worker-${task.id}`,
         surfaceOwner: false
       })
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/deliver-worker-dispatch-preamble.ts b/src/main/runtime/rpc/methods/orchestration/worker/deliver-worker-dispatch-preamble.ts
index ecb3270874e..bc2b9601ceb 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/deliver-worker-dispatch-preamble.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/deliver-worker-dispatch-preamble.ts
@@ -5,6 +5,7 @@ import {
   dispatchPreambleSendOptions
 } from '../../../../orchestration/preamble'
 import { sendStructuredWorkerPreamble } from '../../orchestration-structured-worker-session'
+import type { WorkerTurnStartObservation } from './worker-start-turn-observation'
 import type { createStructuredWorkerSessionForWorktree } from './worker-topology'
 
 type StructuredSession = Awaited<ReturnType<typeof createStructuredWorkerSessionForWorktree>> | null
@@ -14,7 +15,8 @@ type StructuredSession = Awaited<ReturnType<typeof createStructuredWorkerSession
  *
  * The preamble itself is identical for both: a worker is taught the same verbs whichever mode it
  * runs in, and only the delivery differs — a PTY write returns a queued/accepted receipt, while a
- * structured turn either is acknowledged or throws.
+ * structured turn is acknowledged, still held for an agent that has not started, or throws. Held is
+ * a turn start nobody observed yet: the start is left unknown, not torn down.
  */
 export async function deliverWorkerDispatchPreamble(args: {
   runtime: OrcaRuntimeService
@@ -28,7 +30,10 @@ export async function deliverWorkerDispatchPreamble(args: {
   dispatchCapability: string
   devMode: boolean | undefined
   requestId: string
-}): Promise<RuntimeTerminalSend['prompt']> {
+}): Promise<{
+  prompt?: RuntimeTerminalSend['prompt']
+  structuredTurnStart?: WorkerTurnStartObservation
+}> {
   const { runtime, structuredSession, terminalHandle } = args
   const preamble = buildDispatchPreamble({
     // Depth only. A worker is taught the same verbs whichever mode it runs in, so this must not
@@ -45,19 +50,32 @@ export async function deliverWorkerDispatchPreamble(args: {
     cliCommand: runtime.getTerminalOrchestrationCliCommand(terminalHandle)
   })
   if (structuredSession) {
-    await sendStructuredWorkerPreamble({
+    const delivery = await sendStructuredWorkerPreamble({
       host: structuredSession.host,
       sessionId: structuredSession.identity.sessionId,
       dispatchId: args.dispatchId,
       preamble
     })
-    return undefined
+    return {
+      structuredTurnStart:
+        delivery === 'accepted'
+          ? { verdict: 'observed' }
+          : {
+              verdict: 'unobserved',
+              reason:
+                'The dispatch preamble was accepted, but the agent had not started to take it. It ' +
+                'is delivered when the agent starts; if the worker then reports, this Dispatch ' +
+                'settles normally.'
+            }
+    }
+  }
+  return {
+    prompt: (
+      await runtime.sendTerminalAgentPrompt(
+        terminalHandle,
+        preamble,
+        dispatchPreambleSendOptions(args.requestId)
+      )
+    ).prompt
   }
-  return (
-    await runtime.sendTerminalAgentPrompt(
-      terminalHandle,
-      preamble,
-      dispatchPreambleSendOptions(args.requestId)
-    )
-  ).prompt
 }
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/explicit-worker-terminal-validation.ts b/src/main/runtime/rpc/methods/orchestration/worker/explicit-worker-terminal-validation.ts
index 6e20cc40a29..f9b9e195e21 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/explicit-worker-terminal-validation.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/explicit-worker-terminal-validation.ts
@@ -1,6 +1,7 @@
 import type { OrcaRuntimeService } from '../../../../orca-runtime'
 import { OrchestrationError } from '../../../../orchestration/orchestration-error'
 import { isStructuredWorkerHandle } from '../../../../structured-worker-identity'
+import type { OrchestrationCallerIdentity } from '../../../../orchestration/orchestration-caller-identity'
 
 /**
  * Admits a caller-supplied `--terminal` as this dispatch's worker pane.
@@ -13,18 +14,22 @@ export async function assertExplicitWorkerTerminalUsable(args: {
   runtime: OrcaRuntimeService
   terminal: string
   from: string
-  coordinatorPane: string | null
+  coordinator: OrchestrationCallerIdentity | null
   resolvedWorktreeId: string | undefined
 }): Promise<void> {
-  const { runtime, terminal, from, coordinatorPane, resolvedWorktreeId } = args
+  const { runtime, terminal, from, coordinator, resolvedWorktreeId } = args
   const explicitTerminal = await runtime.showTerminal(terminal)
   const targetPane = runtime.getTerminalPaneKey(terminal)
-  const callerPane = coordinatorPane ?? runtime.getTerminalPaneKey(from)
+  const callerPane = coordinator?.paneKey ?? runtime.getTerminalPaneKey(from)
   // A structured coordinator has no terminal to show, so its own identity is the raw handle plus
-  // the pane key; showing `from` unconditionally would throw for exactly those callers.
-  const coordinatorHandle = isStructuredWorkerHandle(from)
-    ? from
-    : (await runtime.showTerminal(from)).handle
+  // the pane key; showing `from` unconditionally would throw for exactly those callers. A
+  // handle-less session has no terminal at all, so its address is its identity.
+  const coordinatorHandle =
+    coordinator?.terminalHandle === null
+      ? coordinator.address
+      : isStructuredWorkerHandle(from)
+        ? from
+        : (await runtime.showTerminal(from)).handle
   if (
     explicitTerminal.handle === coordinatorHandle ||
     (targetPane !== null && targetPane === callerPane)
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/failed-worker-start-teardown.ts b/src/main/runtime/rpc/methods/orchestration/worker/failed-worker-start-teardown.ts
index 250b639fc60..758bc3397cb 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/failed-worker-start-teardown.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/failed-worker-start-teardown.ts
@@ -8,10 +8,10 @@ import type { createStructuredWorkerSessionForWorktree } from './worker-topology
 /**
  * Undoes what a start created before it failed.
  *
- * A start that never reached ready leaves no settlement to release the hold later, and its session
- * was already published as a chat tab — without the discard, a failed start strands a dead chat tab
- * that the durable restore index republishes on every app launch. Both halves are best-effort by
- * construction, so neither can replace the real error.
+ * A start that never reached ready leaves no settlement to release its binding later, and its
+ * session was already published as a chat tab — without the discard, a failed start strands a dead
+ * chat tab that the durable restore index republishes on every app launch. Both halves are
+ * best-effort by construction, so neither can replace the real error.
  *
  * A created PTY terminal is deliberately NOT torn down: its custody row was written at creation, so
  * `worker-release` on the failed Dispatch owns that cleanup and the coordinator decides when.
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/local-worker-start.ts b/src/main/runtime/rpc/methods/orchestration/worker/local-worker-start.ts
index f8cd1033c97..d6b265c41a9 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/local-worker-start.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/local-worker-start.ts
@@ -2,6 +2,10 @@ import type { OrcaRuntimeService } from '../../../../orca-runtime'
 import { describeTerminalWaitBlockedReason } from '../../../../../../shared/terminal-wait-blocked-reason-legacy-alias'
 import type { OrchestrationDb } from '../../../../orchestration/db'
 import type { RunRow, TaskRow } from '../../../../orchestration/types'
+import type {
+  OrchestrationCallerIdentity,
+  OrchestrationSessionCaller
+} from '../../../../orchestration/orchestration-caller-identity'
 import { resolveDispatchCreator } from '../runs/dispatch-creator'
 import { resolveDispatchCallerWorktreeId } from '../../orchestration-caller-workspace'
 import {
@@ -38,18 +42,25 @@ export async function startLocalWorker(args: {
   runtime: OrcaRuntimeService
   db: OrchestrationDb
   run: RunRow
-  coordinatorPane: string | null
+  coordinator: OrchestrationCallerIdentity | null
+  callerSession?: OrchestrationSessionCaller
   existingTask?: TaskRow
   orchestrationMutation?: WorkerStartMutation
   /** Settings-driven; the executing host still gets to refuse below. */
   mode: WorkerStartModeReceipt
 }): Promise<unknown> {
-  const { params, runtime, db, run, coordinatorPane, existingTask, orchestrationMutation } = args
+  const { params, runtime, db, run, coordinator, callerSession, existingTask } = args
+  const { orchestrationMutation } = args
+  const coordinatorPane = coordinator?.paneKey ?? null
   const requestedWorktree = params.worktree ?? 'current'
   const createsWorktree = requestedWorktree === 'new-child' || requestedWorktree === 'new-top-level'
   const { agent, launch } = prepareLocalWorkerStart({ params, createsWorktree, runtime })
 
-  const coordinatorWorktreeId = await resolveDispatchCallerWorktreeId(runtime, params.from)
+  const coordinatorWorktreeId = await resolveDispatchCallerWorktreeId(
+    runtime,
+    params.from,
+    callerSession
+  )
   const creationWorktree = createsWorktree
     ? await runtime.showManagedWorktree(`id:${coordinatorWorktreeId}`)
     : undefined
@@ -70,7 +81,7 @@ export async function startLocalWorker(args: {
       runtime,
       terminal: params.terminal,
       from: params.from,
-      coordinatorPane,
+      coordinator,
       resolvedWorktreeId: resolvedWorktree?.id
     })
   }
@@ -95,7 +106,7 @@ export async function startLocalWorker(args: {
       : 'existing_worktree'
   }
   const started = db.createStartingWorkerDispatch({
-    creator: resolveDispatchCreator(runtime, params.from),
+    creator: resolveDispatchCreator(runtime, params.from, callerSession),
     maxDepth: runtime.getNestedWorkerMaxDepth(),
     taskId: existingTask?.id,
     taskSpec: params.spec,
@@ -103,10 +114,12 @@ export async function startLocalWorker(args: {
     taskDeps: parseTaskDeps(params.deps),
     taskParentId: params.parent,
     taskRunId: run.id,
-    taskCreatedByTerminalHandle: params.from,
+    // A handle-less session creates root Tasks: Task lineage is recorded by terminal only.
+    taskCreatedByTerminalHandle: coordinator?.terminalHandle ?? undefined,
     taskCreatedByPaneKey: coordinatorPane ?? undefined,
-    taskCreatedByProcessIncarnation:
-      runtime.getTerminalProcessIncarnation(params.from) ?? undefined,
+    taskCreatedByProcessIncarnation: coordinator?.terminalHandle
+      ? (runtime.getTerminalProcessIncarnation(coordinator.terminalHandle) ?? undefined)
+      : undefined,
     taskCreatedByRunGeneration: run.consumer_generation,
     retryOf: params.retryOf,
     startOptions,
@@ -175,10 +188,17 @@ export async function startLocalWorker(args: {
           effects,
           timeoutMs: params.timeoutMs ?? 60_000
         })
-      : await runtime.waitForTerminal(terminalHandle, {
-          condition: 'tui-idle',
-          timeoutMs: params.timeoutMs ?? 60_000
-        })
+      : // ZCode emits SessionStart only after input; its first dispatch must wait for the composer.
+        agent === 'zcode' && !params.terminal
+        ? await runtime.waitForFreshWorkerComposer(
+            terminalHandle,
+            agent,
+            params.timeoutMs ?? 60_000
+          )
+        : await runtime.waitForTerminal(terminalHandle, {
+            condition: 'tui-idle',
+            timeoutMs: params.timeoutMs ?? 60_000
+          })
     if (wait) {
       persistWorkerSetupWaitOutcome({ ...setupStage, wait })
       if (!wait.satisfied) {
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/structured-worker-release-stop.ts b/src/main/runtime/rpc/methods/orchestration/worker/structured-worker-release-stop.ts
index 4a32147d1a6..91e524e4bf1 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/structured-worker-release-stop.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/structured-worker-release-stop.ts
@@ -4,15 +4,15 @@ import type { WorkerTerminalResourceRow } from '../../../../orchestration/worker
 import { stopStructuredWorker } from '../../orchestration-structured-worker-lifecycle'
 import type { StructuredWorkerIdentity } from '../../../../structured-worker-identity'
 import { archiveSummary } from './worker-terminal-resource-presentation'
-import type { WorkerReleaseReceipt } from './worker-release-completion'
+import { releaseUnknownRecovery, type WorkerReleaseReceipt } from './worker-release-completion'
 
 /**
  * The close half of a release for a worker that IS a structured session.
  *
  * Separate from the PTY close for the same reason the delivery lane is: there is no terminal to
  * close and no exit to observe, so the host's own settlement is the only proof available. Only a
- * proven close may settle; an unproven one reports `release_unknown` and stays retryable under the
- * same request id.
+ * proven close may settle; an unproven one reports `release_unknown` and stays retryable, but only
+ * under a fresh request id — replaying the prior one just returns this same receipt.
  */
 export async function stopStructuredWorkerForRelease(args: {
   structured: StructuredWorkerIdentity
@@ -36,7 +36,7 @@ export async function stopStructuredWorkerForRelease(args: {
       processAction: stop.closeAttempted ? 'closed_agent_terminal' : 'none',
       archive: { source: args.archiveSource, status: args.archiveStatus },
       lastError: unknown.release_error ?? stop.reason,
-      recovery: `Inspect with: orca orchestration worker-show --dispatch ${dispatchId} --json — then repeat worker-release with the same --retry-request.`
+      recovery: releaseUnknownRecovery(dispatchId)
     }
   }
   const settled = db.settleWorkerTerminalRelease(resource.id)
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-control.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-control.ts
index 5e8babf3c5e..a9211532626 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-control.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-control.ts
@@ -143,7 +143,10 @@ export const ORCHESTRATION_WORKER_CONTROL_METHODS = [
           `Worker Dispatch ${params.dispatch} no longer resolves to its exact process.`
         )
       }
-      const structured = readStructuredWorkerOutput({
+      // Read via the handle inspectWorkerTerminal proved live: the durable one, or a handle
+      // re-minted from the recorded incarnation after the durable handle went stale.
+      const liveHandle = observation.terminalHandle ?? terminalHandle
+      const structured = await readStructuredWorkerOutput({
         db,
         dispatchId: params.dispatch,
         workerState: worker?.state ?? 'unsupervised',
@@ -163,7 +166,7 @@ export const ORCHESTRATION_WORKER_CONTROL_METHODS = [
       const output = await readExactWorkerOutput({
         runtime,
         dispatchId: params.dispatch,
-        terminalHandle,
+        terminalHandle: liveHandle,
         workerState: worker?.state ?? 'unsupervised',
         terminalStatus:
           observation.status === 'exited'
@@ -200,9 +203,8 @@ export const ORCHESTRATION_WORKER_CONTROL_METHODS = [
       const abandoned = runtime.getOrchestrationDb().abandonWorkerDispatch(params.dispatch)
       if (abandoned.disposition === 'context_only') {
         if (!abandoned.alreadySettled) {
-          // Abandon settles the Dispatch, so it owes the same hold release stop and release do.
-          // A surviving hold pins the provider child for the life of the app and makes host crash
-          // recovery respawn a worker nobody is waiting on.
+          // Abandon settles the Dispatch, so it owes the same binding release stop and release do:
+          // a surviving redrive subscription keeps nudging a worker nobody is waiting on.
           releaseStructuredWorkerSession(params.dispatch, runtime)
           runtime.notifyMessageArrived(`dispatch:${params.dispatch}`, 'status')
         }
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-observation.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-observation.ts
index 83b3d020f4c..f1202c6e7cf 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-observation.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-observation.ts
@@ -9,12 +9,14 @@ import {
   observeStructuredWorker,
   resolveStructuredWorkerForDispatch
 } from '../../orchestration-structured-worker-lifecycle'
+import { structuredWorkerAddressable } from '../../../../structured-worker-custody'
 import type {
   DispatchContextRow,
   FederatedDispatchRow,
   WorkerDispatchRow
 } from '../../../../orchestration/types'
 
+/** Observe a worker terminal, re-minting a live handle from the recorded process incarnation when the durable handle went stale, so a still-running worker is never reported missing and leaked. */
 export async function inspectWorkerTerminal(
   runtime: OrcaRuntimeService,
   db: OrchestrationDb,
@@ -27,12 +29,18 @@ export async function inspectWorkerTerminal(
   reason?: string
   /** Set only on a proven-exact worker parked on a prompt that needs a human. */
   agentWait?: RuntimeTerminalInteractiveWait | null
+  /** Structured workers only: whether mail still reaches it — at rest included, since the mail
+   *  starts it. Absent when ownership cannot be read. `status` stays the process verdict. */
+  addressable?: boolean
+  /** The handle that actually resolved: the durable one, or a live handle re-minted from the
+   *  recorded process incarnation after the durable handle went stale. Null when none resolved. */
+  terminalHandle: string | null
 }> {
   const worker = db.getWorkerDispatch(dispatchId)
   const terminalHandle =
     worker?.agent_terminal_handle ?? db.getDispatchContextById(dispatchId)?.assignee_handle
   if (!terminalHandle) {
-    return { terminal: null, exact: false, status: 'unattached' }
+    return { terminal: null, exact: false, status: 'unattached', terminalHandle: null }
   }
   const structured = resolveStructuredWorkerForDispatch(db, dispatchId)
   if (structured) {
@@ -49,24 +57,54 @@ export async function inspectWorkerTerminal(
       processIncarnation: structured.processIncarnation
     })
     const observation = observeStructuredWorker(structured)
+    const addressable = structuredWorkerAddressable(
+      db,
+      structured.sessionId,
+      db.getWorkerTerminalResourceByHandle?.(structured.handle)
+    )
     return {
       terminal: null,
       exact,
       status: exact ? observation.status : 'identity_changed',
-      ...(exact && observation.reason ? { reason: observation.reason } : {})
+      ...(exact && observation.reason ? { reason: observation.reason } : {}),
+      ...(exact && addressable !== null ? { addressable } : {}),
+      terminalHandle: null
     }
   }
-  const terminal = await runtime.showTerminal(terminalHandle).catch(() => null)
+  let effectiveHandle = terminalHandle
+  let terminal = await runtime.showTerminal(effectiveHandle).catch(() => null)
   if (!terminal) {
-    return { terminal: null, exact: false, status: 'missing' }
+    // Why: the durable handle resolves nowhere after a renderer graph epoch bump or handle
+    // invalidation, yet the recorded process incarnation may still name a live PTY. Re-mint a
+    // live handle (incarnation-fenced) so worker-show and release act on the still-running
+    // process instead of reporting it missing — which would leak the agent process tree.
+    // (workerList is a pure DB projection and never calls inspectWorkerTerminal.)
+    const resource = db.getWorkerTerminalResourceByOwner(dispatchId)
+    const reminted = resource?.process_incarnation
+      ? runtime.resolveTerminalHandleByProcessIncarnation(
+          resource.process_incarnation,
+          resource.host_scope
+        )
+      : null
+    if (reminted) {
+      const remintedTerminal = await runtime.showTerminal(reminted).catch(() => null)
+      if (remintedTerminal) {
+        effectiveHandle = reminted
+        terminal = remintedTerminal
+      }
+    }
+  }
+  if (!terminal) {
+    // The re-mint above failed, so no live handle resolved; report the durable handle unresolved.
+    return { terminal: null, exact: false, status: 'missing', terminalHandle: null }
   }
   const exact = db.isDispatchProcessCurrent({
     dispatchId,
-    paneKey: runtime.getTerminalPaneKey(terminalHandle),
-    processIncarnation: runtime.getTerminalProcessIncarnation(terminalHandle)
+    paneKey: runtime.getTerminalPaneKey(effectiveHandle),
+    processIncarnation: runtime.getTerminalProcessIncarnation(effectiveHandle)
   })
   if (!exact) {
-    return { terminal, exact, status: 'identity_changed' }
+    return { terminal, exact, status: 'identity_changed', terminalHandle: effectiveHandle }
   }
   // Why: the aggregate inventory only iterates registered providers, so a dropped
   // relay clears `connected` for every remote PTY at once. Lost contact is not a
@@ -76,38 +114,48 @@ export async function inspectWorkerTerminal(
   // Exact-gated by the early return above: a replaced process's prompt would attribute another
   // lane's blocker to this worker.
   const agentWait = terminal.agentWait
-  const verdict = runtime.getTerminalLivenessVerdict?.(terminalHandle) ?? null
+  const verdict = runtime.getTerminalLivenessVerdict?.(effectiveHandle) ?? null
   if (verdict?.status === 'unverifiable') {
-    return { terminal, exact, status: 'unverifiable', reason: verdict.reason, agentWait }
+    return {
+      terminal,
+      exact,
+      status: 'unverifiable',
+      reason: verdict.reason,
+      agentWait,
+      terminalHandle: effectiveHandle
+    }
   }
   if (verdict?.status === 'live') {
-    return { terminal, exact, status: 'live', agentWait }
+    return { terminal, exact, status: 'live', agentWait, terminalHandle: effectiveHandle }
   }
   if (!verdict) {
     const dispatch = db.getDispatchContextById?.(dispatchId)
     const persistedHostScope = parseWorkerTerminalHostScope(dispatch?.host_scope ?? null)
-    const currentHostScope = runtime.getOrchestrationDispatchAuthority?.(terminalHandle)?.hostScope
+    const currentHostScope = runtime.getOrchestrationDispatchAuthority?.(effectiveHandle)?.hostScope
     if (persistedHostScope?.kind === 'ssh' || currentHostScope?.kind === 'ssh') {
       return {
         terminal,
         exact,
         status: 'unverifiable',
         reason: 'missing_liveness_verdict',
-        agentWait
+        agentWait,
+        terminalHandle: effectiveHandle
       }
     }
     return {
       terminal,
       exact,
       status: terminal.connected === false ? 'exited' : 'live',
-      agentWait
+      agentWait,
+      terminalHandle: effectiveHandle
     }
   }
   return {
     terminal,
     exact,
     status: 'exited',
-    agentWait
+    agentWait,
+    terminalHandle: effectiveHandle
   }
 }
 
@@ -119,7 +167,8 @@ export function exposeObservation(observation: Awaited<ReturnType<typeof inspect
     status: observation.status,
     exactWorker: observation.exact,
     ...(observation.reason ? { reason: observation.reason } : {}),
-    ...(observation.agentWait !== undefined ? { agentWait: observation.agentWait } : {})
+    ...(observation.agentWait !== undefined ? { agentWait: observation.agentWait } : {}),
+    ...(observation.addressable !== undefined ? { addressable: observation.addressable } : {})
   }
 }
 
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-release-completion.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-release-completion.ts
index b686cdfe6cd..4aca4d0420a 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-release-completion.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-release-completion.ts
@@ -98,9 +98,8 @@ async function completeWorkerTerminalReleaseOnce(
     // here is what lets the release see the session instead of reporting it unreadable.
     //
     // NOT yet handled, and deliberately follow-up: rebinding a restarted runtime to a structured
-    // worker's hold and redrive subscription. Until that exists, a worker that survives a restart
-    // keeps no hold, so its child is evictable and its parked mail waits for the next arrival
-    // rather than a settle edge.
+    // worker's redrive subscription. Until that exists, a worker that survives a restart has its
+    // parked mail wait for the next arrival rather than a settle edge.
     await runtime.ensureStructuredAgentSessionHost().catch((error: unknown) => {
       console.warn(
         '[orchestration] structured host install failed before release',
@@ -121,6 +120,9 @@ async function completeWorkerTerminalReleaseOnce(
     }
   }
   const observation = await inspectWorkerTerminal(runtime, db, dispatchId)
+  // The live handle to act on: the durable one, or a handle re-minted from the recorded process
+  // incarnation when the durable handle went stale (inspectWorkerTerminal proved it live).
+  const terminalHandle = observation.terminalHandle ?? resource.terminal_handle
   if (observation.status === 'identity_changed') {
     const retained = db.revertWorkerTerminalReleaseToRetained(resource.id, 'identity_unproven')
     return {
@@ -132,33 +134,39 @@ async function completeWorkerTerminalReleaseOnce(
     }
   }
   if (observation.status === 'missing' || observation.status === 'unattached') {
-    if (args.mode === 'recovery') {
-      // A close can succeed before the process crashes, leaving `releasing` durable state while
-      // terminal inventory no longer resolves the handle. Only a positive host liveness verdict
-      // may settle that exact incarnation; contact loss remains pending/unverifiable.
-      if (resource.process_incarnation) {
-        const processLiveness = await runtime.inspectTerminalProcessIncarnationLiveness(
-          resource.process_incarnation,
-          resource.host_scope
-        )
-        if (processLiveness === 'exited') {
-          const reconciled = db.settleDeadWorkerTerminalRelease({
-            requestingDispatchId: dispatchId,
-            resourceId: resource.id,
-            processIncarnation: resource.process_incarnation
-          })
-          if (reconciled.disposition === 'released') {
-            runtime.notifyMessageArrived(`dispatch:${dispatchId}`, 'status')
-            return {
-              dispatchId,
-              state: 'released',
-              processAction: 'closed_exited_terminal',
-              archive: archiveSummary(reconciled.resource)
-            }
+    // Re-resolution by process incarnation (inspectWorkerTerminal) already failed, so no live PTY
+    // carries this worker's exact incarnation. If that incarnation is provably gone, settle
+    // released BEFORE the recovery defer: proof of death outranks deferral, so a provably-exited
+    // worker never languishes in release_pending across recovery passes.
+    if (resource.process_incarnation) {
+      const processLiveness = await runtime.inspectTerminalProcessIncarnationLiveness(
+        resource.process_incarnation,
+        resource.host_scope
+      )
+      if (processLiveness === 'exited') {
+        // Prefer incarnation-fenced settle (dispatch relation + process_incarnation CAS).
+        const reconciled = db.settleDeadWorkerTerminalRelease({
+          requestingDispatchId: dispatchId,
+          resourceId: resource.id,
+          processIncarnation: resource.process_incarnation
+        })
+        if (reconciled.disposition === 'released') {
+          runtime.notifyMessageArrived(`dispatch:${dispatchId}`, 'status')
+          return {
+            dispatchId,
+            state: 'released',
+            processAction: 'none',
+            archive: archiveSummary(reconciled.resource)
           }
         }
+        // settleDead retains when the archive is still mandatory and missing (e.g. requested but
+        // never committed). Do NOT plain-settle: that would discard output and break recovery's
+        // "archive is mandatory" invariant. Fall through to recovery pending / unknown instead.
       }
-      // Inventory may still be incomplete during startup/reconnect discovery; defer.
+    }
+    if (args.mode === 'recovery') {
+      // No death certificate yet: inventory may still be incomplete during startup/reconnect
+      // discovery, so defer instead of guessing.
       return {
         dispatchId,
         state: 'release_pending',
@@ -184,7 +192,7 @@ async function completeWorkerTerminalReleaseOnce(
     }
   }
 
-  if (!workerTerminalLeaseIsCurrent(runtime, db, dispatchId, resource)) {
+  if (!workerTerminalLeaseIsCurrent(runtime, db, dispatchId, resource, terminalHandle)) {
     const retained = db.revertWorkerTerminalReleaseToRetained(resource.id, 'identity_unproven')
     return {
       dispatchId,
@@ -203,7 +211,7 @@ async function completeWorkerTerminalReleaseOnce(
     const captured = await captureWorkerOutputArchive({
       runtime,
       dispatchId,
-      terminalHandle: resource.terminal_handle,
+      terminalHandle,
       attachedAtMs: orchestrationTimestampToMs(worker.created_at),
       structuredWorker: structured
     })
@@ -231,7 +239,7 @@ async function completeWorkerTerminalReleaseOnce(
       archive: archiveSummary(releasing)
     }
   }
-  if (!workerTerminalLeaseIsCurrent(runtime, db, dispatchId, releasing)) {
+  if (!workerTerminalLeaseIsCurrent(runtime, db, dispatchId, releasing, terminalHandle)) {
     const retained = db.revertWorkerTerminalReleaseToRetained(resource.id, 'identity_unproven')
     return {
       dispatchId,
@@ -254,7 +262,7 @@ async function completeWorkerTerminalReleaseOnce(
         archiveStatus
       })
     }
-    const close = await runtime.closeTerminal(resource.terminal_handle)
+    const close = await runtime.closeTerminal(terminalHandle)
     if (!close.ptyKilled) {
       const reason = describeUnconfirmedAgentStop(close)
       const unknown = db.markWorkerTerminalReleaseUnknown(resource.id, reason)
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts
index dd4ce2522ea..d9798a47372 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts
@@ -100,7 +100,7 @@ it.each(['unary', 'stream'])('mobile %s bytes do no orchestration database work'
       method.handler(method.params!.parse(params) as never, { runtime } as never)
     ).resolves.toMatchObject({ send: { accepted: true } })
   }
-  expect(write).toHaveBeenCalledWith('pty-worker', 'x')
+  expect(write).toHaveBeenCalledWith('pty-worker', 'x', 'driving')
   expect(commit).toHaveBeenCalledTimes(1)
   expect(dbAccess).not.toHaveBeenCalled()
   expect(takeover).not.toHaveBeenCalled()
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-release-runtime-incarnation.test.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-release-runtime-incarnation.test.ts
new file mode 100644
index 00000000000..4caac62f5da
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-release-runtime-incarnation.test.ts
@@ -0,0 +1,79 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { inspectWorkerTerminal } from './worker-observation'
+import { createOrchestrationWorkerReleaseHarness } from './worker-release.test-support'
+import { makePaneKey } from '../../../../../../shared/stable-pane-id'
+
+const PTY_ID = 'runtime_test:term_worker'
+const LEAF_ID = 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb'
+
+describe('worker release through runtime incarnation recovery', () => {
+  const harness = createOrchestrationWorkerReleaseHarness()
+  afterEach(() => harness.cleanup())
+
+  it.each(['release', 'stop', 'read', 'replacement', 'disconnected'] as const)(
+    '%s uses runtime identity and close paths',
+    async (scenario) => {
+      harness.setup()
+      const { dispatchId } =
+        scenario === 'stop' ? await harness.startWorker() : await harness.startSettledWorker()
+      const runtime = harness.runtime
+      vi.mocked(runtime.showTerminal).mockRestore()
+      vi.mocked(runtime.getTerminalPaneKey).mockRestore()
+      vi.mocked(runtime.getTerminalProcessIncarnation).mockRestore()
+      vi.mocked(runtime.getOrchestrationDispatchAuthority).mockRestore()
+      vi.mocked(runtime.readTerminal).mockRestore()
+      vi.mocked(runtime.closeTerminal).mockRestore()
+      const kill = vi.fn(() => true)
+      runtime.setPtyController({ write: () => true, kill, getForegroundProcess: async () => null })
+      runtime.registerPty(PTY_ID, 'repo::worktree', null, {
+        tabId: 'tab_worker',
+        leafId: LEAF_ID,
+        incarnationId: scenario === 'replacement' ? '2' : '1'
+      })
+      await expect(runtime.showTerminal('term_worker')).rejects.toThrow()
+      if (scenario === 'disconnected') {
+        vi.spyOn(runtime, 'getTerminalLivenessVerdict').mockReturnValue({
+          status: 'unverifiable',
+          reason: 'transport unavailable'
+        })
+        const observed = await inspectWorkerTerminal(runtime, harness.db, dispatchId)
+        expect(observed).toMatchObject({ exact: true, status: 'unverifiable' })
+        expect(kill).not.toHaveBeenCalled()
+        return
+      }
+      if (scenario === 'stop') {
+        const receipt = await harness.call('orchestration.workerStop', { dispatch: dispatchId })
+        expect(receipt).toMatchObject({ state: 'stopped', processAction: 'closed_agent_terminal' })
+        expect(kill).toHaveBeenCalledExactlyOnceWith(PTY_ID)
+        return
+      }
+      if (scenario === 'read') {
+        const readTerminal = vi.spyOn(runtime, 'readTerminal')
+        const output = await harness.call('orchestration.workerRead', { dispatch: dispatchId })
+        // Pins the read to the reminted terminal: the handle it reached must resolve to the
+        // registered pane and incarnation, which the stale durable handle never does.
+        const [[readHandle]] = readTerminal.mock.calls
+        expect(runtime.getTerminalPaneKey(readHandle)).toBe(makePaneKey('tab_worker', LEAF_ID))
+        expect(runtime.getTerminalProcessIncarnation(readHandle)).toBe(`${PTY_ID}:1`)
+        expect(output).toMatchObject({
+          source: 'terminal',
+          fallbackReason: 'session_not_reported'
+        })
+        expect(kill).not.toHaveBeenCalled()
+        return
+      }
+      const receipt = await harness.call('orchestration.workerRelease', { dispatch: dispatchId })
+      if (scenario === 'replacement') {
+        expect(receipt).toMatchObject({ state: 'release_unknown', processAction: 'none' })
+        expect(kill).not.toHaveBeenCalled()
+        return
+      }
+      expect(receipt).toMatchObject({ state: 'released', processAction: 'closed_agent_terminal' })
+      expect(kill).toHaveBeenCalledExactlyOnceWith(PTY_ID)
+      expect(harness.db.getWorkerTerminalResourceByOwner(dispatchId)).toMatchObject({
+        ownership_state: 'released',
+        release_state: 'released'
+      })
+    }
+  )
+})
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts
index 593d097580f..526b09a6320 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts
@@ -381,6 +381,7 @@ describe('orchestration worker-start prompt contract', () => {
     const { runtime, handle } = await createAgentPromptSubmissionRuntime(() => undefined, 'codex')
     runtime.onPtyData('pty-prompt', '\x1b]0;Codex working\x07', Date.now())
     const pending = runtime.sendTerminalAgentPrompt(handle, 'queued prompt', {
+      inputKind: 'driving',
       acceptQueued: true,
       requestId: 'busy-swallowed',
       observationTimeoutMs: 0
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-start-readiness-settlement.test.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-start-readiness-settlement.test.ts
new file mode 100644
index 00000000000..e39a06110dc
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-start-readiness-settlement.test.ts
@@ -0,0 +1,90 @@
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('../../../../orchestration/preamble', () => ({ buildDispatchPreamble: () => 'preamble' }))
+vi.mock('./worker-topology', async (importOriginal) => ({
+  ...(await importOriginal<Record<string, unknown>>()),
+  monitorWorkerSetup: () => {}
+}))
+
+const { deliverAndSettleWorkerStartReadiness } = await import('./worker-start-readiness-settlement')
+
+function settle(delivered: 'accepted' | undefined) {
+  const db = {
+    getWorkerDispatch: () => ({ state: 'starting' }),
+    markWorkerStartUnknown: vi.fn(() => ({
+      stage: 'turn_start_unobserved',
+      residual_resources: '[]'
+    })),
+    markWorkerDispatchReady: vi.fn(() => ({ state: 'ready', stage: 'ready' }))
+  }
+  const host = {
+    deps: { store: { getRecord: () => ({ lease: { runtimeFence: 1 } }) } },
+    send: async () => ({
+      ok: true,
+      value: { clientMessageId: 'c1', submission: { dispatchState: 'pending', reason: null } }
+    }),
+    // undefined: the worker's agent was still starting when the wait ran out.
+    waitForSendSettlement: async () =>
+      delivered
+        ? { value: { clientMessageId: 'c1', submission: { dispatchState: delivered } } }
+        : undefined
+  }
+  const args = {
+    runtime: {
+      getNestedWorkerMaxDepth: () => 3,
+      getTerminalOrchestrationCliCommand: () => 'orca'
+    },
+    db,
+    run: { id: 'run_1' },
+    task: { id: 't1', spec: 'do the thing' },
+    dispatchId: 'd1',
+    dispatchDepth: 0,
+    structuredSession: { host, identity: { sessionId: 's1' } },
+    terminalHandle: 'structured_worker_1',
+    coordinatorHandle: 'term_c',
+    dispatchCapability: 'capability',
+    devMode: undefined,
+    requestId: 'r1',
+    agent: 'claude',
+    setupReceipt: {},
+    launchReceipt: {},
+    mode: {},
+    timeoutMs: 60_000,
+    effects: [],
+    terminalRevealWarning: undefined,
+    onStage: () => {}
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the fakes implement exactly the runtime, db and host members this settlement reaches.
+  const receipt = deliverAndSettleWorkerStartReadiness(args as never)
+  return { db, receipt }
+}
+
+describe('a structured worker whose agent outlasts the preamble wait', () => {
+  it('parks as start-unknown instead of failing the start, and never names a screen to read', async () => {
+    const { db, receipt } = settle(undefined)
+
+    // Resolving, not throwing, is what keeps the worker's session: a throw tears it down.
+    await expect(receipt).resolves.toMatchObject({
+      state: 'outcome_unknown',
+      turnStart: 'unobserved',
+      nextCommands: [
+        'orca orchestration worker-show --dispatch d1 --json',
+        'orca orchestration worker-abandon --dispatch d1 --json'
+      ]
+    })
+    expect(db.markWorkerStartUnknown).toHaveBeenCalledWith(
+      'd1',
+      'turn_start_unobserved',
+      expect.stringContaining('delivered when the agent starts'),
+      expect.anything()
+    )
+    expect(db.markWorkerDispatchReady).not.toHaveBeenCalled()
+  })
+
+  it('is ready once the agent took the preamble within the wait', async () => {
+    const { db, receipt } = settle('accepted')
+
+    await expect(receipt).resolves.toMatchObject({ state: 'ready', turnStart: 'observed' })
+    expect(db.markWorkerStartUnknown).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-start-readiness-settlement.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-start-readiness-settlement.ts
index a3c57a357d2..7e9118daffb 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-start-readiness-settlement.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-start-readiness-settlement.ts
@@ -47,7 +47,7 @@ export async function deliverAndSettleWorkerStartReadiness(args: {
   const { runtime, db, run, task, structuredSession, terminalHandle, effects } = args
 
   args.onStage('dispatch_input')
-  const promptDelivery = await deliverWorkerDispatchPreamble({
+  const delivery = await deliverWorkerDispatchPreamble({
     runtime,
     structuredSession,
     terminalHandle,
@@ -71,11 +71,11 @@ export async function deliverAndSettleWorkerStartReadiness(args: {
   // The write above was accepted without waiting on provider hooks; now demand the positive
   // evidence the receipt claims is observable. A worker whose turn never starts must not be
   // reported ready — a wedged agent and a working one looked identical before this gate.
-  // A structured preamble send is acknowledged by the provider or throws, so it is already
-  // positive evidence.
-  const turnStart: WorkerTurnStartObservation = structuredSession
-    ? { verdict: 'observed' }
-    : await observeWorkerTurnStart({ runtime, terminalHandle, prompt: promptDelivery })
+  // A structured preamble send is its own evidence: acknowledged, or still held for its agent.
+  const promptDelivery = delivery.prompt
+  const turnStart: WorkerTurnStartObservation =
+    delivery.structuredTurnStart ??
+    (await observeWorkerTurnStart({ runtime, terminalHandle, prompt: promptDelivery }))
   const deliveredPrompt = turnStart.prompt ?? promptDelivery
   monitorWorkerSetup({
     runtime,
@@ -98,7 +98,7 @@ export async function deliverAndSettleWorkerStartReadiness(args: {
       id: terminalHandle,
       state: 'turn_unobserved'
     })
-    const reason = describeUnobservedWorkerTurnStart(args.agent)
+    const reason = turnStart.reason ?? describeUnobservedWorkerTurnStart(args.agent)
     const worker = db.markWorkerStartUnknown(
       args.dispatchId,
       'turn_start_unobserved',
@@ -122,7 +122,8 @@ export async function deliverAndSettleWorkerStartReadiness(args: {
       residualResources: JSON.parse(worker.residual_resources) as unknown[],
       nextCommands: [
         `orca orchestration worker-show --dispatch ${args.dispatchId} --json`,
-        `orca terminal read --terminal ${terminalHandle} --screen`,
+        // A structured worker has no screen to read.
+        ...(structuredSession ? [] : [`orca terminal read --terminal ${terminalHandle} --screen`]),
         `orca orchestration worker-abandon --dispatch ${args.dispatchId} --json`
       ],
       ...(args.terminalRevealWarning ? { warning: args.terminalRevealWarning } : {})
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-start-turn-observation.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-start-turn-observation.ts
index d1c9e59adfa..cc648ee7dde 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-start-turn-observation.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-start-turn-observation.ts
@@ -19,6 +19,8 @@ export type WorkerTurnStartVerdict = 'observed' | 'permission' | 'unsupported' |
 export type WorkerTurnStartObservation = {
   verdict: WorkerTurnStartVerdict
   prompt?: RuntimeTerminalPromptDelivery
+  /** Why an `unobserved` start is unknown, when the default PTY wording does not fit. */
+  reason?: string
 }
 
 function classifyPromptDelivery(prompt: RuntimeTerminalPromptDelivery): WorkerTurnStartVerdict {
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-stop.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-stop.ts
index 98d3c376f61..ee0e73c904f 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-stop.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-stop.ts
@@ -141,6 +141,7 @@ export const ORCHESTRATION_WORKER_STOP_METHODS = [
           })
         }
         const observation = await inspectWorkerTerminal(runtime, db, params.dispatch)
+        const liveHandle = observation.terminalHandle ?? handle
         // The host exit can settle this stop while terminal inspection is awaiting inventory.
         if (db.getWorkerDispatch(params.dispatch)?.state === 'stopped') {
           runtime.notifyMessageArrived(`dispatch:${params.dispatch}`, 'status')
@@ -201,7 +202,7 @@ export const ORCHESTRATION_WORKER_STOP_METHODS = [
           }
         }
         const closed = await runtime
-          .closeTerminal(handle)
+          .closeTerminal(liveHandle)
           .then((close) => ({ close }) as const)
           .catch(
             (error: unknown) =>
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-terminal-release-lease.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-terminal-release-lease.ts
index 50a97c9de4b..cad0ceb4128 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-terminal-release-lease.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-terminal-release-lease.ts
@@ -9,23 +9,27 @@ export function workerTerminalLeaseIsCurrent(
   runtime: OrcaRuntimeService,
   db: OrchestrationDb,
   dispatchId: string,
-  resource: WorkerTerminalResourceRow
+  resource: WorkerTerminalResourceRow,
+  // Live (possibly reminted) handle for runtime probes. Durable identity still compares
+  // worker.agent_terminal_handle to resource.terminal_handle; after beginGraphReload the durable
+  // string is absent from the handle table, so authority/pane/incarnation must use the live one.
+  liveTerminalHandle: string
 ): boolean {
   const worker = db.getWorkerDispatch(dispatchId)
   if (isStructuredWorkerHandle(resource.terminal_handle)) {
     return structuredWorkerTerminalLeaseIsCurrent(db, dispatchId, worker, resource)
   }
-  const authority = runtime.getOrchestrationDispatchAuthority(resource.terminal_handle)
+  const authority = runtime.getOrchestrationDispatchAuthority(liveTerminalHandle)
   // Exited PTYs retain identity and host evidence but no longer mint launch authority.
   return Boolean(
     worker?.agent_terminal_handle === resource.terminal_handle &&
     (authority
       ? resource.host_scope === JSON.stringify(authority.hostScope)
-      : runtime.getTerminalLivenessVerdict(resource.terminal_handle)?.status === 'exited') &&
+      : runtime.getTerminalLivenessVerdict(liveTerminalHandle)?.status === 'exited') &&
     db.isDispatchProcessCurrent({
       dispatchId,
-      paneKey: runtime.getTerminalPaneKey(resource.terminal_handle),
-      processIncarnation: runtime.getTerminalProcessIncarnation(resource.terminal_handle)
+      paneKey: runtime.getTerminalPaneKey(liveTerminalHandle),
+      processIncarnation: runtime.getTerminalProcessIncarnation(liveTerminalHandle)
     }) &&
     !db.workerTerminalResourceHasIdentityConflict(resource.id)
   )
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-topology.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-topology.ts
index b18eb9ee6c2..3e86dea3e28 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-topology.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-topology.ts
@@ -69,6 +69,7 @@ export async function createExistingWorktreeWorkerTerminal(args: {
     // desktop app while its CLI is `cursor-agent`. Let the runtime build the
     // configured launcher instead of executing the raw id.
     startupAgent: args.agent,
+    launchSource: 'orchestration',
     ...(args.launchPreferences ? { launchPreferences: args.launchPreferences } : {}),
     title: `worker-${args.taskId}`,
     // Why: dispatching a worker is background work; it must not pull the sidebar
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-worktree-creation.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-worktree-creation.ts
index fe0c11e374d..cbdab8d1f94 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-worktree-creation.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-worktree-creation.ts
@@ -61,6 +61,7 @@ export async function createWorkerWorktree(args: {
     ...(args.withAgentTerminal
       ? {
           startupAgent: args.agent,
+          startupLaunchSource: 'orchestration',
           ...(args.launchPreferences ? { startupLaunchPreferences: args.launchPreferences } : {})
         }
       : {}),
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/workers-new-worktree.test.ts b/src/main/runtime/rpc/methods/orchestration/worker/workers-new-worktree.test.ts
index 5164ac0b22f..cda3354e816 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/workers-new-worktree.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/workers-new-worktree.test.ts
@@ -140,6 +140,7 @@ describe('orchestration new-worktree workers', () => {
     expect(runtime.createManagedWorktree).toHaveBeenCalledWith(
       expect.objectContaining({
         startupAgent: 'codex',
+        startupLaunchSource: 'orchestration',
         awaitTerminalProvisioning: true,
         observeSetupCompletion: true,
         lineage: expect.objectContaining({ noParent: true, parentWorktree: undefined })
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/workers.ts b/src/main/runtime/rpc/methods/orchestration/worker/workers.ts
index b1a1f40d45a..be4e40ab2b6 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/workers.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/workers.ts
@@ -20,7 +20,7 @@ export const ORCHESTRATION_WORKER_START_METHODS = [
     params: WorkerStartParams,
     handler: async (
       params,
-      { runtime, orchestrationMutation, orchestrationCompatibilityEvidence }
+      { runtime, orchestrationMutation, orchestrationCompatibilityEvidence, orchestrationCaller }
     ) => {
       if (!isWorkerStartTimeoutWithinTimerLimit(params.timeoutMs)) {
         throw new OrchestrationError(
@@ -30,11 +30,12 @@ export const ORCHESTRATION_WORKER_START_METHODS = [
       }
       const readinessTimeoutMs = resolveWorkerStartReadinessTimeoutMs(params.timeoutMs)
       const db = runtime.getOrchestrationDb()
-      const coordinatorPane = resolveOrchestrationCaller(runtime, {
+      const coordinator = resolveOrchestrationCaller(runtime, {
         callerTerminalHandle: params.from,
-        callerEvidence: orchestrationCompatibilityEvidence
+        callerEvidence: orchestrationCompatibilityEvidence,
+        callerSession: orchestrationCaller
       })
-      const run = coordinatorPane ? db.getCurrentRunForPane(coordinatorPane) : undefined
+      const run = coordinator ? db.getCurrentRunForCoordinator(coordinator) : undefined
       if (!run || (params.run && params.run !== run.id)) {
         throw new OrchestrationError(
           'consumer_fenced',
@@ -62,7 +63,8 @@ export const ORCHESTRATION_WORKER_START_METHODS = [
           db,
           runId: run.id,
           task: existingTask,
-          orchestrationMutation
+          orchestrationMutation,
+          callerSession: orchestrationCaller
         })
         return receipt && typeof receipt === 'object' ? { ...receipt, mode } : receipt
       }
@@ -71,7 +73,8 @@ export const ORCHESTRATION_WORKER_START_METHODS = [
         runtime,
         db,
         run,
-        coordinatorPane,
+        coordinator,
+        callerSession: orchestrationCaller,
         existingTask,
         orchestrationMutation,
         mode
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/zcode-worker-readiness.test.ts b/src/main/runtime/rpc/methods/orchestration/worker/zcode-worker-readiness.test.ts
new file mode 100644
index 00000000000..30d32c2ede8
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration/worker/zcode-worker-readiness.test.ts
@@ -0,0 +1,44 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createOrchestrationWorkerReleaseHarness } from './worker-release.test-support'
+
+describe('ZCode first dispatch readiness', () => {
+  const h = createOrchestrationWorkerReleaseHarness()
+  afterEach(() => h.cleanup())
+
+  it('waits for the new composer before delivering exactly one dispatch', async () => {
+    h.setup()
+    const gate = h.deferred<void>()
+    vi.spyOn(h.runtime, 'waitForFreshWorkerComposer').mockReturnValue(gate.promise)
+    const pending = h.startWorker({ agent: 'zcode' })
+    await vi.waitFor(() =>
+      expect(h.runtime.waitForFreshWorkerComposer).toHaveBeenCalledWith(
+        'term_worker',
+        'zcode',
+        60_000
+      )
+    )
+    expect(h.runtime.waitForTerminal).not.toHaveBeenCalled()
+    expect(h.runtime.sendTerminalAgentPrompt).not.toHaveBeenCalled()
+    gate.resolve()
+    await pending
+    expect(h.runtime.sendTerminalAgentPrompt).toHaveBeenCalledOnce()
+  })
+
+  it('keeps reused terminals on the normal idle wait', async () => {
+    h.setup()
+    vi.spyOn(h.runtime, 'waitForFreshWorkerComposer')
+    await h.startWorker({ terminal: 'term_worker' })
+    expect(h.runtime.waitForFreshWorkerComposer).not.toHaveBeenCalled()
+    expect(h.runtime.waitForTerminal).toHaveBeenCalledWith(
+      'term_worker',
+      expect.objectContaining({ condition: 'tui-idle' })
+    )
+  })
+
+  it('never delivers a task after a startup timeout', async () => {
+    h.setup()
+    vi.spyOn(h.runtime, 'waitForFreshWorkerComposer').mockRejectedValue(new Error('timeout'))
+    await expect(h.startWorker({ agent: 'zcode' })).rejects.toThrow('Expected worker-start')
+    expect(h.runtime.sendTerminalAgentPrompt).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/runtime/rpc/methods/session-tab-mutation-methods.ts b/src/main/runtime/rpc/methods/session-tab-mutation-methods.ts
index d62f50be595..95369d5830f 100644
--- a/src/main/runtime/rpc/methods/session-tab-mutation-methods.ts
+++ b/src/main/runtime/rpc/methods/session-tab-mutation-methods.ts
@@ -99,6 +99,7 @@ export const SESSION_TAB_MUTATION_METHODS = [
         tabId: params.tabId,
         root: params.root,
         expandedLeafId: params.expandedLeafId ?? null,
+        chatLeafId: params.chatLeafId,
         titlesByLeafId: params.titlesByLeafId
       })
     }
diff --git a/src/main/runtime/rpc/methods/session-tabs-inventory.ts b/src/main/runtime/rpc/methods/session-tabs-inventory.ts
index d63868844a6..3ab06a298fc 100644
--- a/src/main/runtime/rpc/methods/session-tabs-inventory.ts
+++ b/src/main/runtime/rpc/methods/session-tabs-inventory.ts
@@ -6,6 +6,7 @@ import { projectSessionTabAgentStatus } from './session-tab-agent-status-project
 import { projectSessionTabBrowserPlacements } from './session-tab-browser-placement-projection'
 import { createSessionTabsRetirementProofDelta } from './session-tabs-retirement-proof-delta'
 import { isStructuredNativeChatEnabled } from './structured-agent-session-policy'
+import { restoreStructuredTabsIfSupported } from './structured-session-tab-restore'
 
 type SessionTabsInventory = {
   snapshots: RuntimeMobileSessionTabsResult[]
@@ -241,6 +242,14 @@ export async function subscribeSessionTabsInventory(
   }
   let collected: Awaited<ReturnType<typeof collectSessionTabsInventory>> | undefined
   try {
+    // Why: restore after registering, so an unsubscribe or socket close while it runs still finds the stream.
+    const restoring = restoreStructuredTabsIfSupported(context)
+    if (restoring) {
+      await restoring
+      if (closed) {
+        return
+      }
+    }
     for (let attempt = 1; !collected; attempt += 1) {
       censusInvalidated = false
       const candidate = await collectSessionTabsInventory(
diff --git a/src/main/runtime/rpc/methods/session-tabs-subscribe-admission.test.ts b/src/main/runtime/rpc/methods/session-tabs-subscribe-admission.test.ts
new file mode 100644
index 00000000000..2652cdf12fd
--- /dev/null
+++ b/src/main/runtime/rpc/methods/session-tabs-subscribe-admission.test.ts
@@ -0,0 +1,342 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { OrcaRuntimeService } from '../../orca-runtime'
+import type { RuntimeMobileSessionTabsResult } from '../../../../shared/runtime-types'
+import { RuntimeSubscriptionRegistry } from '../../runtime-subscription-registry'
+import { RpcDispatcher } from '../dispatcher'
+import type { RpcRequest } from '../core'
+import { SESSION_TAB_METHODS } from './session-tabs'
+import { visibleSnapshot } from './session-tabs-snapshot.test-fixture'
+
+const CONNECTION = 'conn-1'
+const KEY = (requestId: string): string => `session.tabs:${CONNECTION}:wt-1:${requestId}`
+const ALL_KEY = (requestId: string): string => `session.tabs:${CONNECTION}:*:${requestId}`
+
+type Deferred<T> = { promise: Promise<T>; resolve: (value: T) => void; reject: (e: Error) => void }
+
+function deferred<T>(): Deferred<T> {
+  let resolve!: (value: T) => void
+  let reject!: (e: Error) => void
+  const promise = new Promise<T>((settle, fail) => {
+    resolve = settle
+    reject = fail
+  })
+  return { promise, resolve, reject }
+}
+
+function makeHost(options: { structuredChat?: boolean } = {}) {
+  const registry = new RuntimeSubscriptionRegistry()
+  const stopListening = vi.fn()
+  const tabListeners: ((snapshot: RuntimeMobileSessionTabsResult, sequence: number) => void)[] = []
+  const restore = vi.fn(() => Promise.resolve())
+  const listMobileSessionTabs = vi.fn(async (): Promise<RuntimeMobileSessionTabsResult> =>
+    visibleSnapshot()
+  )
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the session tab methods reach only these members; a missing one throws and fails the test.
+  const runtime = {
+    getRuntimeId: () => 'test-runtime',
+    getClientSettings: () => ({
+      experimentalStructuredNativeChat: options.structuredChat === true
+    }),
+    restoreStructuredAgentSessionTabs: restore,
+    listMobileSessionTabs,
+    supportsAuthoritativeSessionTabsInventory: () => false,
+    listAllMobileSessionTabsWithChangeSequence: async () => ({
+      snapshots: [visibleSnapshot()],
+      changeSequence: 0
+    }),
+    onMobileSessionTabsChanged: vi.fn(
+      (listener: (snapshot: RuntimeMobileSessionTabsResult, sequence: number) => void) => {
+        tabListeners.push(listener)
+        return stopListening
+      }
+    ),
+    registerSubscriptionCleanup: registry.register.bind(registry),
+    cleanupSubscription: registry.cleanup.bind(registry),
+    cleanupSubscriptionsByPrefix: registry.cleanupByPrefix.bind(registry),
+    cleanupSubscriptionsForConnection: registry.cleanupForConnection.bind(registry),
+    getSubscriptionRegistrationVersion: registry.getRegistrationVersion.bind(registry)
+  } as unknown as OrcaRuntimeService
+  const dispatcher = new RpcDispatcher({ runtime, methods: SESSION_TAB_METHODS })
+  return {
+    runtime,
+    registry,
+    restore,
+    listMobileSessionTabs,
+    stopListening,
+    tabListeners,
+    // A foreign connection never owns the entry, so this probe reads presence without releasing it.
+    isRegistered: (id: string): boolean => !registry.cleanupIfOwnedByConnection(id, 'probe'),
+    dispatch: (
+      request: RpcRequest,
+      messages: Frame[] = [],
+      extra: { signal?: AbortSignal } = {}
+    ): Promise<void> =>
+      dispatcher.dispatchStreaming(request, (message) => messages.push(JSON.parse(message)), {
+        connectionId: CONNECTION,
+        clientKind: 'mobile',
+        ...extra
+      })
+  }
+}
+
+function request(id: string, method: string, params?: unknown): RpcRequest {
+  return { id, authToken: 'tok', method, params }
+}
+
+type Frame = { ok: boolean; result?: { type?: string } }
+
+function frames(messages: Frame[]): (string | undefined)[] {
+  return messages.map((reply) => (reply.ok ? reply.result?.type : 'error'))
+}
+
+async function settle(): Promise<void> {
+  for (let index = 0; index < 10; index += 1) {
+    await Promise.resolve()
+  }
+}
+
+describe('session.tabs.subscribe registers when the request arrives', () => {
+  it.each([
+    { stage: 'restore', unsubscribe: { worktree: 'id:wt-1', subscriptionId: 'sub-1' } },
+    { stage: 'list', unsubscribe: { worktree: 'id:wt-1', subscriptionId: 'sub-1' } },
+    { stage: 'list', unsubscribe: { worktree: 'id:wt-1' } }
+  ])(
+    'an unsubscribe ($unsubscribe) during the $stage await ends the stream and leaves nothing',
+    async ({ stage, unsubscribe }) => {
+      const host = makeHost({ structuredChat: true })
+      const gate = deferred<void>()
+      const listing = deferred<RuntimeMobileSessionTabsResult>()
+      if (stage === 'restore') {
+        host.restore.mockReturnValueOnce(gate.promise)
+      } else {
+        host.listMobileSessionTabs.mockReturnValueOnce(listing.promise)
+      }
+      const messages: Frame[] = []
+      const pending = host.dispatch(
+        request('sub-1', 'session.tabs.subscribe', { worktree: 'id:wt-1' }),
+        messages
+      )
+
+      await host.dispatch(request('unsub-1', 'session.tabs.unsubscribe', unsubscribe))
+      gate.resolve()
+      listing.resolve(visibleSnapshot())
+      await pending
+      await settle()
+
+      expect(host.isRegistered(KEY('sub-1'))).toBe(false)
+      expect(host.runtime.onMobileSessionTabsChanged).not.toHaveBeenCalled()
+      expect(frames(messages)).toEqual(['end'])
+    }
+  )
+
+  it('a socket close during setup leaves no registration and no listener', async () => {
+    const host = makeHost()
+    const listing = deferred<RuntimeMobileSessionTabsResult>()
+    host.listMobileSessionTabs.mockReturnValueOnce(listing.promise)
+    const messages: Frame[] = []
+    const pending = host.dispatch(
+      request('sub-1', 'session.tabs.subscribe', { worktree: 'id:wt-1' }),
+      messages
+    )
+
+    host.runtime.cleanupSubscriptionsForConnection(CONNECTION)
+    listing.resolve(visibleSnapshot())
+    await pending
+    await settle()
+
+    expect(host.isRegistered(KEY('sub-1'))).toBe(false)
+    expect(host.runtime.onMobileSessionTabsChanged).not.toHaveBeenCalled()
+    expect(frames(messages)).toEqual(['end'])
+  })
+
+  it('a request abort during setup ends the stream and leaves nothing', async () => {
+    const host = makeHost()
+    const listing = deferred<RuntimeMobileSessionTabsResult>()
+    host.listMobileSessionTabs.mockReturnValueOnce(listing.promise)
+    const controller = new AbortController()
+    const messages: Frame[] = []
+    const pending = host.dispatch(
+      request('sub-1', 'session.tabs.subscribe', { worktree: 'id:wt-1' }),
+      messages,
+      { signal: controller.signal }
+    )
+
+    controller.abort()
+    listing.resolve(visibleSnapshot())
+    await pending
+    await settle()
+
+    expect(host.isRegistered(KEY('sub-1'))).toBe(false)
+    expect(host.runtime.onMobileSessionTabsChanged).not.toHaveBeenCalled()
+    expect(frames(messages)).toEqual(['end'])
+  })
+
+  it('a request whose socket already closed attaches nothing', async () => {
+    const host = makeHost()
+    const controller = new AbortController()
+    controller.abort()
+
+    await host.dispatch(request('sub-1', 'session.tabs.subscribe', { worktree: 'id:wt-1' }), [], {
+      signal: controller.signal
+    })
+    await settle()
+
+    expect(host.isRegistered(KEY('sub-1'))).toBe(false)
+    expect(host.runtime.onMobileSessionTabsChanged).not.toHaveBeenCalled()
+  })
+
+  it('a stream released during setup reports no error when the await then rejects', async () => {
+    const host = makeHost()
+    const listing = deferred<RuntimeMobileSessionTabsResult>()
+    host.listMobileSessionTabs.mockReturnValueOnce(listing.promise)
+    const messages: Frame[] = []
+    const pending = host.dispatch(
+      request('sub-1', 'session.tabs.subscribe', { worktree: 'id:wt-1' }),
+      messages
+    )
+
+    await host.dispatch(
+      request('unsub-1', 'session.tabs.unsubscribe', {
+        worktree: 'id:wt-1',
+        subscriptionId: 'sub-1'
+      })
+    )
+    listing.reject(new Error('list failed'))
+    await pending
+
+    expect(frames(messages)).toEqual(['end'])
+  })
+
+  it('a failed setup reports only the error and leaves no registration', async () => {
+    const host = makeHost()
+    host.listMobileSessionTabs.mockRejectedValueOnce(new Error('list failed'))
+    const messages: Frame[] = []
+
+    await host.dispatch(
+      request('sub-1', 'session.tabs.subscribe', { worktree: 'id:wt-1' }),
+      messages
+    )
+    await settle()
+
+    expect(host.isRegistered(KEY('sub-1'))).toBe(false)
+    expect(frames(messages)).toEqual(['error'])
+  })
+
+  it('streams snapshot and updates, then ends once on unsubscribe', async () => {
+    const host = makeHost()
+    const messages: Frame[] = []
+
+    await host.dispatch(
+      request('sub-1', 'session.tabs.subscribe', { worktree: 'id:wt-1' }),
+      messages
+    )
+    expect(host.isRegistered(KEY('sub-1'))).toBe(true)
+    host.tabListeners[0]?.({ ...visibleSnapshot(), snapshotVersion: 2 }, 1)
+    await host.dispatch(
+      request('unsub-1', 'session.tabs.unsubscribe', {
+        worktree: 'id:wt-1',
+        subscriptionId: 'sub-1'
+      })
+    )
+    host.runtime.cleanupSubscriptionsForConnection(CONNECTION)
+    await settle()
+
+    expect(frames(messages)).toEqual(['snapshot', 'updated', 'end'])
+    expect(host.stopListening).toHaveBeenCalledTimes(1)
+    expect(host.isRegistered(KEY('sub-1'))).toBe(false)
+  })
+
+  it('keys a non-id selector by the resolved worktree once it is known', async () => {
+    const host = makeHost()
+    const messages: Frame[] = []
+
+    await host.dispatch(
+      request('sub-1', 'session.tabs.subscribe', { worktree: 'path:/repo/wt-1' }),
+      messages
+    )
+
+    expect(host.isRegistered(KEY('sub-1'))).toBe(true)
+    expect(frames(messages)).toEqual(['snapshot'])
+  })
+
+  it('a worktree-wide unsubscribe spares a subscribe that arrives while it resolves', async () => {
+    const host = makeHost()
+    const first: Frame[] = []
+    const second: Frame[] = []
+    await host.dispatch(request('sub-1', 'session.tabs.subscribe', { worktree: 'id:wt-1' }), first)
+    const listing = deferred<RuntimeMobileSessionTabsResult>()
+    host.listMobileSessionTabs.mockReturnValueOnce(listing.promise)
+
+    // Old phones send no request id, so the host sweeps every stream for the worktree.
+    const unsubscribing = host.dispatch(
+      request('unsub-1', 'session.tabs.unsubscribe', { worktree: 'id:wt-1' })
+    )
+    await settle()
+    await host.dispatch(request('sub-2', 'session.tabs.subscribe', { worktree: 'id:wt-1' }), second)
+    listing.resolve(visibleSnapshot())
+    await unsubscribing
+    await settle()
+
+    expect(frames(first)).toEqual(['snapshot', 'end'])
+    expect(frames(second)).toEqual(['snapshot'])
+    expect(host.isRegistered(KEY('sub-1'))).toBe(false)
+    expect(host.isRegistered(KEY('sub-2'))).toBe(true)
+  })
+
+  it('a request-id unsubscribe ends only its own stream', async () => {
+    const host = makeHost()
+    const first: Frame[] = []
+    const second: Frame[] = []
+
+    await host.dispatch(request('sub-1', 'session.tabs.subscribe', { worktree: 'id:wt-1' }), first)
+    await host.dispatch(request('sub-2', 'session.tabs.subscribe', { worktree: 'id:wt-1' }), second)
+    await host.dispatch(
+      request('unsub-1', 'session.tabs.unsubscribe', {
+        worktree: 'id:wt-1',
+        subscriptionId: 'sub-1'
+      })
+    )
+    await settle()
+
+    expect(frames(first)).toEqual(['snapshot', 'end'])
+    expect(frames(second)).toEqual(['snapshot'])
+    expect(host.isRegistered(KEY('sub-1'))).toBe(false)
+    expect(host.isRegistered(KEY('sub-2'))).toBe(true)
+    expect(host.stopListening).toHaveBeenCalledTimes(1)
+  })
+})
+
+describe('session.tabs.subscribeAll registers before restoring structured tabs', () => {
+  it.each([
+    {
+      release: 'unsubscribeAll',
+      act: (host: ReturnType<typeof makeHost>) =>
+        host.dispatch(
+          request('unsub-1', 'session.tabs.unsubscribeAll', { subscriptionId: 'sub-1' })
+        )
+    },
+    {
+      release: 'socket close',
+      act: async (host: ReturnType<typeof makeHost>) =>
+        host.runtime.cleanupSubscriptionsForConnection(CONNECTION)
+    }
+  ])('a $release during the restore leaves no stream behind', async ({ act }) => {
+    const host = makeHost({ structuredChat: true })
+    const gate = deferred<void>()
+    host.restore.mockReturnValueOnce(gate.promise)
+    const messages: Frame[] = []
+    const pending = host.dispatch(request('sub-1', 'session.tabs.subscribeAll'), messages)
+
+    await act(host)
+    gate.resolve()
+    await pending
+    await settle()
+
+    expect(host.isRegistered(ALL_KEY('sub-1'))).toBe(false)
+    expect(frames(messages)).not.toContain('snapshots')
+    expect(
+      vi.mocked(host.runtime.onMobileSessionTabsChanged).mock.calls.length -
+        host.stopListening.mock.calls.length
+    ).toBe(0)
+  })
+})
diff --git a/src/main/runtime/rpc/methods/session-tabs-unsubscribe.test.ts b/src/main/runtime/rpc/methods/session-tabs-unsubscribe.test.ts
index efd353a7c91..021224bd649 100644
--- a/src/main/runtime/rpc/methods/session-tabs-unsubscribe.test.ts
+++ b/src/main/runtime/rpc/methods/session-tabs-unsubscribe.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it, vi } from 'vitest'
 import type { OrcaRuntimeService } from '../../orca-runtime'
+import { RuntimeSubscriptionRegistry } from '../../runtime-subscription-registry'
 import { RpcDispatcher } from '../dispatcher'
 import { SESSION_TAB_METHODS } from './session-tabs'
 
@@ -61,12 +62,63 @@ describe('session tab unsubscribe RPC methods', () => {
     expect(cleanupSubscription).toHaveBeenCalledWith('session.tabs:conn-1:*:sub-all-1')
     expect(cleanupSubscriptionsByPrefix).not.toHaveBeenCalled()
   })
+
+  it('ends only the named stream when a newer one watches the same worktree', async () => {
+    const { dispatcher, ends } = await subscribeTwiceToOneWorktree()
+
+    await dispatcher.dispatchStreaming(
+      request('session.tabs.unsubscribe', { worktree: 'id:wt-1', subscriptionId: 'sub-old' }),
+      vi.fn(),
+      { connectionId: 'conn-1' }
+    )
+
+    await vi.waitFor(() => expect(ends['sub-old']).toBe(1))
+    expect(ends['sub-new']).toBe(0)
+  })
+
+  it('ends every stream for the worktree when the unsubscribe names no request', async () => {
+    const { dispatcher, ends } = await subscribeTwiceToOneWorktree()
+
+    await dispatcher.dispatchStreaming(
+      request('session.tabs.unsubscribe', { worktree: 'id:wt-1' }),
+      vi.fn(),
+      { connectionId: 'conn-1' }
+    )
+
+    await vi.waitFor(() => expect(ends).toEqual({ 'sub-old': 1, 'sub-new': 1 }))
+  })
 })
 
+async function subscribeTwiceToOneWorktree() {
+  const registry = new RuntimeSubscriptionRegistry()
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Partial runtime backed by the real subscription registry; it supplies every member session.tabs subscribe/unsubscribe call.
+  const runtime = {
+    ...runtimeWithCleanup(registry.cleanup.bind(registry), registry.cleanupByPrefix.bind(registry)),
+    registerSubscriptionCleanup: registry.register.bind(registry),
+    getSubscriptionRegistrationVersion: registry.getRegistrationVersion.bind(registry),
+    onMobileSessionTabsChanged: () => () => {}
+  } as unknown as OrcaRuntimeService
+  const dispatcher = new RpcDispatcher({ runtime, methods: SESSION_TAB_METHODS })
+  const ends: Record<string, number> = { 'sub-old': 0, 'sub-new': 0 }
+  for (const id of ['sub-old', 'sub-new']) {
+    await dispatcher.dispatchStreaming(
+      { ...request('session.tabs.subscribe', { worktree: 'id:wt-1' }), id },
+      (message) => {
+        if (JSON.parse(message).result?.type === 'end') {
+          ends[id]! += 1
+        }
+      },
+      { connectionId: 'conn-1' }
+    )
+  }
+  return { dispatcher, ends }
+}
+
 function runtimeWithCleanup(
-  cleanupSubscription: ReturnType<typeof vi.fn>,
-  cleanupSubscriptionsByPrefix = vi.fn()
+  cleanupSubscription: (id: string) => void,
+  cleanupSubscriptionsByPrefix: (prefix: string, throughVersion?: number) => void = vi.fn()
 ): OrcaRuntimeService {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the unsubscribe methods reach only these members; a missing one throws and fails the test.
   return {
     getRuntimeId: () => 'test-runtime',
     listMobileSessionTabs: vi.fn().mockResolvedValue({
@@ -79,7 +131,8 @@ function runtimeWithCleanup(
       tabs: []
     }),
     cleanupSubscription,
-    cleanupSubscriptionsByPrefix
+    cleanupSubscriptionsByPrefix,
+    getSubscriptionRegistrationVersion: () => 0
   } as unknown as OrcaRuntimeService
 }
 
diff --git a/src/main/runtime/rpc/methods/session-tabs.ts b/src/main/runtime/rpc/methods/session-tabs.ts
index 40e1525f148..8d3d1af33bf 100644
--- a/src/main/runtime/rpc/methods/session-tabs.ts
+++ b/src/main/runtime/rpc/methods/session-tabs.ts
@@ -1,4 +1,5 @@
 import { resolveRuntimeNavigationTarget } from '../../../../shared/runtime-navigation'
+import { getExplicitWorktreeIdSelector } from '../../runtime-worktree-selection'
 import { defineMethod, defineStreamingMethod } from '../core'
 import {
   CreateTerminalTab,
@@ -97,78 +98,115 @@ export const SESSION_TAB_METHODS = [
     params: WorktreeTabSelector,
     handler: async (
       params,
-      { runtime, connectionId, requestId, pairedDeviceId, clientKind, clientCapabilities },
+      { runtime, connectionId, requestId, pairedDeviceId, clientKind, clientCapabilities, signal },
       emit
     ) => {
-      let subscribedWorktree: string | null = null
-      let unsubscribe = (): void => {}
-      let closed = false
-      let initialized = false
-      await restoreStructuredTabsIfSupported({ runtime, clientKind, clientCapabilities })
-      const initial = await runtime.listMobileSessionTabs(params.worktree, pairedDeviceId)
-      if (closed) {
-        return
-      }
-      subscribedWorktree = initial.worktree
-      const cleanupPrefix = `session.tabs:${connectionId ?? 'local'}:${subscribedWorktree}`
-      const subscriptionId = requestId ? `${cleanupPrefix}:${requestId}` : cleanupPrefix
-      // Why: shared-control can carry multiple subscribers for one worktree on
-      // one socket; include the RPC id so one subscriber cannot evict another.
-      runtime.registerSubscriptionCleanup(
-        subscriptionId,
-        () => {
-          closed = true
-          unsubscribe()
-          if (initialized) {
-            emit({ type: 'end' })
-          }
-        },
-        connectionId
-      )
-      if (closed) {
-        return
-      }
-      const withProofDelta = createSessionTabsRetirementProofDelta(clientCapabilities)
-      emit({
-        type: 'snapshot',
-        ...withProofDelta(
-          projectSessionTabsForClient(
-            initial,
-            clientKind,
-            clientCapabilities,
-            isStructuredNativeChatEnabled(runtime)
-          )
-        )
-      })
-      initialized = true
-      if (closed) {
-        return
-      }
-
-      unsubscribe = runtime.onMobileSessionTabsChanged((snapshot) => {
-        if (snapshot.worktree === subscribedWorktree) {
-          emit({
-            type: 'updated',
-            ...withProofDelta(
-              projectSessionTabsForClient(
-                snapshot,
-                clientKind,
-                clientCapabilities,
-                isStructuredNativeChatEnabled(runtime)
-              )
-            )
-          })
+      let subscriptionId: string | null = null
+      let released = false
+      let endOnRelease = true
+      let stopListening = (): void => {}
+      // Safe without a version check: any other release of this key runs our cleanup first, which latches `released`.
+      const release = (): void => {
+        if (!released && subscriptionId) {
+          runtime.cleanupSubscription(subscriptionId)
         }
-      }, pairedDeviceId)
-      if (closed) {
-        unsubscribe()
+      }
+      const register = (worktreeId: string): void => {
+        const cleanupPrefix = `session.tabs:${connectionId ?? 'local'}:${worktreeId}`
+        // Why: shared-control can carry multiple subscribers for one worktree on
+        // one socket; include the RPC id so one subscriber cannot evict another.
+        subscriptionId = requestId ? `${cleanupPrefix}:${requestId}` : cleanupPrefix
+        runtime.registerSubscriptionCleanup(
+          subscriptionId,
+          () => {
+            if (released) {
+              return
+            }
+            released = true
+            signal?.removeEventListener('abort', release)
+            stopListening()
+            if (endOnRelease) {
+              emit({ type: 'end' })
+            }
+          },
+          connectionId
+        )
+        if (signal?.aborted) {
+          release()
+        } else {
+          signal?.addEventListener('abort', release, { once: true })
+        }
+      }
+      // Why: register before any await so an unsubscribe or socket close during setup
+      // finds the stream; only an `id:` selector (every phone and web client) names it up front.
+      const explicitWorktreeId = getExplicitWorktreeIdSelector(params.worktree)
+      if (explicitWorktreeId) {
+        register(explicitWorktreeId)
+      }
+      try {
+        await restoreStructuredTabsIfSupported({ runtime, clientKind, clientCapabilities })
+        if (released) {
+          return
+        }
+        const initial = await runtime.listMobileSessionTabs(params.worktree, pairedDeviceId)
+        if (released) {
+          return
+        }
+        if (!subscriptionId) {
+          register(initial.worktree)
+          if (released) {
+            return
+          }
+        }
+        const subscribedWorktree = initial.worktree
+        const withProofDelta = createSessionTabsRetirementProofDelta(clientCapabilities)
+        emit({
+          type: 'snapshot',
+          ...withProofDelta(
+            projectSessionTabsForClient(
+              initial,
+              clientKind,
+              clientCapabilities,
+              isStructuredNativeChatEnabled(runtime)
+            )
+          )
+        })
+        if (released) {
+          return
+        }
+        stopListening = runtime.onMobileSessionTabsChanged((snapshot) => {
+          if (snapshot.worktree === subscribedWorktree) {
+            emit({
+              type: 'updated',
+              ...withProofDelta(
+                projectSessionTabsForClient(
+                  snapshot,
+                  clientKind,
+                  clientCapabilities,
+                  isStructuredNativeChatEnabled(runtime)
+                )
+              )
+            })
+          }
+        }, pairedDeviceId)
+      } catch (error) {
+        // A stream already ended by its release must not also report an error.
+        if (released) {
+          return
+        }
+        endOnRelease = false
+        release()
+        throw error
       }
     }
   }),
   defineMethod({
     name: 'session.tabs.unsubscribe',
     params: SessionTabsUnsubscribe,
-    handler: async (params, { runtime, connectionId, pairedDeviceId }) => {
+    handler: async (
+      params,
+      { runtime, connectionId, pairedDeviceId, subscriptionRegistrationVersion }
+    ) => {
       const snapshot = await runtime.listMobileSessionTabs(params.worktree, pairedDeviceId)
       const connection = connectionId ?? 'local'
       if (params.subscriptionId) {
@@ -179,17 +217,18 @@ export const SESSION_TAB_METHODS = [
       }
       runtime.cleanupSubscription(`session.tabs:${connection}:${params.worktree}`)
       runtime.cleanupSubscription(`session.tabs:${connection}:${snapshot.worktree}`)
-      runtime.cleanupSubscriptionsByPrefix(`session.tabs:${connection}:${snapshot.worktree}:`)
+      // Why: subscribes register on arrival, so spare any that arrived after this unsubscribe.
+      runtime.cleanupSubscriptionsByPrefix(
+        `session.tabs:${connection}:${snapshot.worktree}:`,
+        subscriptionRegistrationVersion
+      )
       return { unsubscribed: true }
     }
   }),
   defineStreamingMethod({
     name: 'session.tabs.subscribeAll',
     params: null,
-    handler: async (_params, context, emit) => {
-      await restoreStructuredTabsIfSupported(context)
-      return subscribeSessionTabsInventory(context, emit)
-    }
+    handler: (_params, context, emit) => subscribeSessionTabsInventory(context, emit)
   }),
   defineMethod({
     name: 'session.tabs.unsubscribeAll',
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-admission.test.ts b/src/main/runtime/rpc/methods/structured-agent-session-admission.test.ts
index de62b6b5b52..554c0912ff0 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-admission.test.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-admission.test.ts
@@ -32,16 +32,16 @@ describe('admission revoked while a session is still open', () => {
 
   it.each(CLEANUP_METHODS)(
     'still serves $method after the host setting is turned off',
-    async ({ method, params, hostCall }) => {
-      const response = await call(method, params, STRUCTURED_CLIENT, SETTING_OFF)
+    async (entry) => {
+      const response = await call(entry.method, entry.params, STRUCTURED_CLIENT, SETTING_OFF)
 
       expect(response).toMatchObject({ ok: true })
-      // `unsubscribe` retires runtime-owned subscriptions rather than calling the host, so its
-      // result payload is the observable effect.
-      if (hostCall === 'unsubscribe') {
-        expect(response).toMatchObject({ result: { unsubscribed: true } })
+      // `unsubscribe` retires runtime-owned subscriptions and `release` is a no-op, so neither
+      // calls the host: the result payload is the observable effect.
+      if (entry.hostCall === null) {
+        expect(response).toMatchObject({ result: entry.result })
       } else {
-        expect(hostCalls[hostCall]).toHaveBeenCalled()
+        expect(hostCalls[entry.hostCall]).toHaveBeenCalled()
       }
     }
   )
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-at-rest.test.ts b/src/main/runtime/rpc/methods/structured-agent-session-at-rest.test.ts
new file mode 100644
index 00000000000..63d24030c70
--- /dev/null
+++ b/src/main/runtime/rpc/methods/structured-agent-session-at-rest.test.ts
@@ -0,0 +1,506 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../../../shared/agent-session-journal-types'
+// A chat at rest, through the RPC surface a client actually calls: opening it starts nothing, what
+// it can answer without an agent it answers, and the first send is what starts one.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../../shared/agent-session-mutation-envelope'
+import { STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY } from '../../../../shared/protocol-version'
+import { activeStructuredAgentSessionTurnId } from '../../../../shared/structured-agent-session-projection'
+import { openJournalDatabase } from '../../../native-chat/agent-session-journal/journal-database'
+import {
+  journalDatabaseFile,
+  journalDirectoryFor
+} from '../../../native-chat/agent-session-journal/journal-paths'
+import {
+  HOST_TEST_LOCATION,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId
+} from '../../../native-chat/agent-session-wire/structured-agent-session-host-test-data'
+import { setStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
+import {
+  createRestTestRig,
+  foundRestTestChat,
+  REST_TEST_CALLER as CALLER,
+  REST_TEST_SESSION as SESSION,
+  REST_TEST_THREAD,
+  restTestSend,
+  type RestTestRig
+} from '../../../native-chat/agent-session-wire/structured-agent-session-rest-test-rig'
+import * as providerSupport from '../../../native-chat/agent-session-wire/structured-agent-session-provider-support'
+import { OrcaRuntimeService } from '../../orca-runtime'
+import type { RpcResponse } from '../core'
+import { RpcDispatcher } from '../dispatcher'
+import { closeStructuredAgentSessionChild } from '../../structured-agent-session-close'
+import { discardStructuredWorkerSession } from './orchestration-structured-worker-session'
+import { STRUCTURED_AGENT_SESSION_METHODS } from './structured-agent-session'
+
+const CLIENT = {
+  clientId: 'device-1',
+  clientKind: 'runtime' as const,
+  clientCapabilities: [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY],
+  connectionId: 'connection-1'
+}
+
+let rig: RestTestRig
+let dispatcher: RpcDispatcher
+let requests = 0
+
+async function call(method: string, params: unknown): Promise<RpcResponse[]> {
+  const replies: RpcResponse[] = []
+  requests += 1
+  await dispatcher.dispatchStreaming(
+    { id: `request-${requests}`, authToken: 'token', method, params },
+    (raw) => replies.push(JSON.parse(raw) as RpcResponse),
+    CLIENT
+  )
+  return replies
+}
+
+/** A chat that once ran, reopened by a fresh host: nothing of it is in memory. */
+async function restingChat(): Promise<void> {
+  await foundRestTestChat(rig)
+  await rig.store.replaceSessionOptions({
+    sessionId: SESSION,
+    fence: rig.store.getRecord(SESSION)!.lease.runtimeFence,
+    options: { model: 'gpt-saved', effort: 'high' },
+    now: rig.clock.now
+  })
+  await rig.restart()
+  setStructuredAgentSessionHost(rig.host)
+  rig.adapter.acquire.mockClear()
+  rig.adapter.dispatch.mockClear()
+  rig.adapter.readOptions.mockClear()
+}
+
+beforeEach(async () => {
+  requests = 0
+  rig = await createRestTestRig({ idleSweep: { intervalMs: 3_600_000 } })
+  setStructuredAgentSessionHost(rig.host)
+  const runtime = new OrcaRuntimeService()
+  vi.spyOn(runtime, 'getClientSettings').mockImplementation(
+    () =>
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the RPC gate reads only this one setting.
+      ({ experimentalStructuredNativeChat: true }) as ReturnType<
+        OrcaRuntimeService['getClientSettings']
+      >
+  )
+  dispatcher = new RpcDispatcher({ runtime, methods: STRUCTURED_AGENT_SESSION_METHODS })
+})
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  setStructuredAgentSessionHost(null)
+  await rig.dispose()
+})
+
+describe('opening a chat at rest (P2-01)', () => {
+  it('reads, subscribes and answers everything without starting an agent', async () => {
+    await restingChat()
+    expect(rig.host.hasSession(SESSION)).toBe(false)
+
+    const [history] = await call('agentSession.history', { sessionId: SESSION, direction: 'tail' })
+    const frames = await call('agentSession.subscribe', { sessionId: SESSION })
+    const [options] = await call('agentSession.options', { sessionId: SESSION })
+    const [commands] = await call('agentSession.commands', { sessionId: SESSION })
+    const [outline] = await call('agentSession.conversationOutline', { sessionId: SESSION })
+    const [status] = await call('agentSession.handoffStatus', { sessionId: SESSION })
+    const [held] = await call('agentSession.hold', { sessionId: SESSION, holderId: 'pane' })
+
+    expect(rig.adapter.acquire).not.toHaveBeenCalled()
+    expect(history).toMatchObject({ ok: true, result: { ok: true } })
+    const snapshot = frames.find((frame) => frame.ok && 'result' in frame)
+    expect(snapshot).toMatchObject({ result: { type: 'snapshot', commands: null } })
+    expect(options).toMatchObject({
+      ok: true,
+      result: { current: { model: 'gpt-saved', effort: 'high' } }
+    })
+    // Absent, never an empty list: the composer keeps its own menu.
+    expect(commands).toMatchObject({ ok: true, result: {} })
+    expect(commands?.ok && 'result' in commands && commands.result).not.toHaveProperty(
+      'commands',
+      []
+    )
+    expect(outline).toMatchObject({ ok: true })
+    expect(status).toMatchObject({ ok: true })
+    expect(held).toMatchObject({ ok: true, result: { held: true } })
+  })
+
+  // Worktree activation asks this for every chat tab in the worktree.
+  it('answers the owner check from the record without opening the chat', async () => {
+    await restingChat()
+
+    const [status] = await call('agentSession.handoffStatus', { sessionId: SESSION })
+
+    expect(status).toMatchObject({ ok: true, result: { owner: expect.any(String) } })
+    expect(rig.host.hasSession(SESSION)).toBe(false)
+  })
+
+  it('starts the agent on the first send (P2-01)', async () => {
+    await restingChat()
+    const fence = rig.store.getRecord(SESSION)!.lease.runtimeFence
+    const sent = await rig.host.send(CALLER, restTestSend('wake up', fence))
+    if (!sent.ok) {
+      throw new Error(`send refused: ${sent.refusal.code}`)
+    }
+    // Awaits the provider's answer itself rather than polling for it, however slow the start.
+    await rig.host.waitForSendSettlement(SESSION, sent.value.clientMessageId)
+    expect(rig.adapter.acquire).toHaveBeenCalledOnce()
+    expect(rig.adapter.dispatch).toHaveBeenCalledOnce()
+  })
+})
+
+describe('the accessor', () => {
+  it('opens a closed conversation once, however many readers arrive together (P2-02)', async () => {
+    // Written by the provider alone, so nothing but the readers below ever opens it here.
+    const attached = await rig.host.attach(CALLER, hostTestAttachParams(null))
+    expect(attached.ok).toBe(true)
+    rig.adapter.acquire.mock.calls
+      .at(-1)?.[0]
+      .events?.appendItem(
+        { provider: 'codex', threadId: REST_TEST_THREAD, turnId: 'turn-1', ordinal: 1 },
+        hostTestMessage('from the provider'),
+        { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+      )
+    await rig.host.flushStreamedEvents(SESSION)
+    await rig.restart()
+    setStructuredAgentSessionHost(rig.host)
+    rig.adapter.acquire.mockClear()
+    const open = vi.spyOn(rig.host.collaboratorsForTests().conversationDelivery, 'open')
+    await Promise.all([
+      ...Array.from({ length: 5 }, () =>
+        call('agentSession.history', { sessionId: SESSION, direction: 'tail' })
+      ),
+      call('agentSession.subscribe', { sessionId: SESSION })
+    ])
+    const openedJournals = new Set(
+      await Promise.all(open.mock.results.map((result) => result.value))
+    )
+    expect(openedJournals.size).toBe(1)
+    expect(rig.adapter.acquire).not.toHaveBeenCalled()
+  })
+
+  it('opens nothing once quit began, for a read that was already waiting on the lock', async () => {
+    await restingChat()
+    // The host's per-session queue, held so the read waits behind it.
+    const { serialize, lifetime } = rig.host.collaboratorsForTests()
+    let release = (): void => undefined
+    const held = new Promise<void>((started) => {
+      void serialize(SESSION, () => {
+        started()
+        return new Promise<void>((resolve) => (release = resolve))
+      })
+    })
+    await held
+    const read = rig.host.history({ sessionId: SESSION, direction: 'tail' })
+
+    // Disposed as quit's first teardown step does.
+    lifetime.dispose()
+    release()
+
+    await expect(read).rejects.toThrow()
+    expect(rig.host.hasSession(SESSION)).toBe(false)
+  })
+
+  it('refuses a read it cannot open with the reason, under the same code and message', async () => {
+    const [missing] = await call('agentSession.history', {
+      sessionId: 'session-never-created',
+      direction: 'tail'
+    })
+    expect(missing).toMatchObject({
+      ok: false,
+      error: {
+        code: 'agent_session_identity_required',
+        message: 'agent_session_identity_required',
+        data: {
+          refusal: {
+            code: 'agent_session_identity_required',
+            details: { reason: 'recordMissing' }
+          }
+        }
+      }
+    })
+
+    await restingChat()
+    vi.spyOn(providerSupport, 'adapterSupportsRecord').mockReturnValue(false)
+    const [unsupported] = await call('agentSession.history', {
+      sessionId: SESSION,
+      direction: 'tail'
+    })
+    expect(unsupported).toMatchObject({
+      ok: false,
+      error: {
+        // Not a passthrough code: released clients match the message, as before.
+        code: 'runtime_error',
+        message: 'structured_agent_session_unsupported',
+        data: { refusal: { details: { reason: 'hostUnsupported' } } }
+      }
+    })
+  })
+
+  it('refuses a read whose journal will not open with the classified reason, never the storage text', async () => {
+    await restingChat()
+    const open = vi.spyOn(rig.host.collaboratorsForTests().conversationDelivery, 'open')
+    vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    const storagePath = '/Users/someone/.orca/journals/session-1/journal.sqlite'
+    const failWith = (error: Error): void => {
+      open.mockRejectedValue(error)
+    }
+    const failures = async (): Promise<RpcResponse[]> =>
+      [
+        ...(await call('agentSession.history', { sessionId: SESSION, direction: 'tail' })),
+        ...(await call('agentSession.subscribe', { sessionId: SESSION })),
+        ...(await call('agentSession.options', { sessionId: SESSION }))
+      ].filter((reply) => !reply.ok)
+
+    failWith(
+      Object.assign(new Error(`file is not a database: ${storagePath}`), {
+        code: 'ERR_SQLITE_ERROR',
+        errcode: 26
+      })
+    )
+    const corrupt = await failures()
+    failWith(Object.assign(new Error(`EACCES: permission denied, open '${storagePath}'`), {}))
+    const unavailable = await failures()
+
+    for (const [replies, reason] of [
+      [corrupt, 'journalCorrupt'],
+      [unavailable, 'journalUnavailable']
+    ] as const) {
+      expect(replies).toHaveLength(3)
+      for (const reply of replies) {
+        expect(reply).toMatchObject({
+          ok: false,
+          error: {
+            // Not a passthrough code: released clients read the message, which stays the code.
+            code: 'runtime_error',
+            message: 'agent_session_journal_unreadable',
+            data: { refusal: { code: 'agent_session_journal_unreadable', details: { reason } } }
+          }
+        })
+        expect(JSON.stringify(reply)).not.toContain(storagePath)
+      }
+    }
+  })
+
+  it('logs a reader reconnecting to a journal that will not open once per failure', async () => {
+    await restingChat()
+    const open = vi.spyOn(rig.host.collaboratorsForTests().conversationDelivery, 'open')
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    const logged = (): unknown[] =>
+      warn.mock.calls
+        .filter(([line]) => line === '[agent-session] opening the conversation for a read failed:')
+        .map(([, error]) => error)
+    const reconnect = async (): Promise<RpcResponse[]> => [
+      ...(await call('agentSession.subscribe', { sessionId: SESSION })),
+      ...(await call('agentSession.history', { sessionId: SESSION, direction: 'tail' }))
+    ]
+    const denied = new Error('EACCES: permission denied')
+    const exhausted = new Error('EMFILE: too many open files')
+
+    open.mockRejectedValue(denied)
+    for (let attempt = 0; attempt < 4; attempt += 1) {
+      // Every attempt is still refused with its reason; only the log is quiet.
+      expect((await reconnect()).filter((reply) => !reply.ok)).toHaveLength(2)
+    }
+    expect(logged()).toEqual([denied])
+    open.mockRejectedValue(exhausted)
+    await reconnect()
+    await reconnect()
+    expect(logged()).toEqual([denied, exhausted])
+  })
+
+  it('opens a corrupt journal through the recovering open and still accepts a send (P2-03)', async () => {
+    await foundRestTestChat(rig)
+    await rig.host.flushAllStreamedEvents()
+    const directory = journalDirectoryFor(rig.root, {
+      workspaceId: HOST_TEST_LOCATION.workspaceId,
+      sessionId: SESSION
+    })
+    // A row that no longer parses: the recovering open keeps the readable prefix and rebuilds.
+    const opened = openJournalDatabase(journalDatabaseFile(directory))
+    try {
+      opened.db.prepare('UPDATE journal_rows SET row_json = ? WHERE seq = ?').run('}{', 2)
+    } finally {
+      opened.db.close()
+    }
+    await rig.restart()
+    setStructuredAgentSessionHost(rig.host)
+
+    const frames = await call('agentSession.subscribe', { sessionId: SESSION })
+    expect(frames.some((frame) => !frame.ok)).toBe(false)
+    expect(frames.find((frame) => frame.ok)).toMatchObject({ result: { type: 'snapshot' } })
+    const fence = rig.store.getRecord(SESSION)!.lease.runtimeFence
+    expect((await rig.host.send(CALLER, restTestSend('after the repair', fence))).ok).toBe(true)
+  })
+
+  it('subscribes an old mobile client that holds first even when no agent can start (P2-06)', async () => {
+    await restingChat()
+    rig.adapter.acquire.mockRejectedValue(new Error('auth expired'))
+
+    const [held] = await call('agentSession.hold', { sessionId: SESSION, holderId: 'mobile' })
+    const frames = await call('agentSession.subscribe', { sessionId: SESSION })
+    expect(held).toMatchObject({ ok: true })
+    expect(frames.find((frame) => frame.ok)).toMatchObject({ result: { type: 'snapshot' } })
+    expect(rig.adapter.acquire).not.toHaveBeenCalled()
+  })
+})
+
+describe('options at rest', () => {
+  it('records a pick as intent and replays it at the next start (P2-16)', async () => {
+    await restingChat()
+    const fields = { key: 'model', value: 'gpt-picked' }
+    const [picked] = await call('agentSession.setOption', {
+      envelope: {
+        sessionId: SESSION,
+        clientOperationId: hostTestOperationId(),
+        expectedRuntimeFence: rig.store.getRecord(SESSION)!.lease.runtimeFence,
+        payloadFingerprint: computeAgentSessionPayloadFingerprint({
+          method: 'agentSession.setOption',
+          sessionId: SESSION,
+          fields
+        })
+      },
+      ...fields
+    })
+    expect(picked).toMatchObject({ ok: true, result: { ok: true } })
+    expect(rig.store.getRecord(SESSION)?.options).toMatchObject({ model: 'gpt-picked' })
+    expect(rig.adapter.acquire).not.toHaveBeenCalled()
+
+    const fence = rig.store.getRecord(SESSION)!.lease.runtimeFence
+    await rig.host.send(CALLER, restTestSend('use the new model', fence))
+    await vi.waitFor(() => expect(rig.adapter.acquire).toHaveBeenCalledOnce())
+    expect(rig.adapter.acquire.mock.calls[0]?.[0]).toMatchObject({
+      options: expect.objectContaining({ model: 'gpt-picked' })
+    })
+  })
+
+  it('answers the provider-level features of a chat at rest (P2-17)', async () => {
+    await restingChat()
+    Object.assign(rig.host.deps.adapter, {
+      supportsThreadGoal: (_id: string, agent?: string) => agent === 'codex',
+      recordsContextUsage: (_id: string, agent?: string) => agent === 'claude',
+      rewindSupport: (_id: string, agent?: string) =>
+        agent === 'codex' ? { supported: true } : { supported: false, reason: 'unsupported' }
+    })
+    const [options] = await call('agentSession.options', { sessionId: SESSION })
+    expect(options).toMatchObject({
+      ok: true,
+      result: { threadGoal: { current: null }, rewind: { supported: true } }
+    })
+    expect(rig.adapter.acquire).not.toHaveBeenCalled()
+    expect(rig.adapter.readOptions).not.toHaveBeenCalled()
+  })
+})
+
+describe('an agent exit', () => {
+  it('is shown, not respawned; the next send starts the agent (P2-18)', async () => {
+    await foundRestTestChat(rig)
+    const running = rig.host.collaboratorsForTests().sessions.get(SESSION)!.child!
+    await rig.host.handleAdapterEvent({
+      type: 'ended',
+      sessionId: SESSION,
+      reason: 'killed',
+      cause: 'unexpected-exit',
+      fence: running.fence,
+      acquisitionGeneration: running.generation!
+    })
+    await new Promise((resolve) => setTimeout(resolve, 50))
+    expect(rig.adapter.acquire).toHaveBeenCalledOnce()
+
+    const fence = rig.store.getRecord(SESSION)!.lease.runtimeFence
+    expect(rig.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
+    await rig.host.send(CALLER, restTestSend('again', fence))
+    await vi.waitFor(() => expect(rig.adapter.acquire).toHaveBeenCalledTimes(2))
+  })
+
+  it('whose settlement write failed is settled by the next send, which is delivered', async () => {
+    await foundRestTestChat(rig)
+    const open = rig.host.collaboratorsForTests().sessions.get(SESSION)!
+    const running = open.child!
+    // A turn in flight, so the exit has something to settle.
+    rig.adapter.acquire.mock.calls
+      .at(-1)?.[0]
+      .events?.appendItem(
+        { provider: 'codex', threadId: REST_TEST_THREAD, turnId: 'working', ordinal: 50 },
+        { kind: 'turn', turnId: 'working', state: 'running' },
+        { turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+      )
+    await rig.host.flushStreamedEvents(SESSION)
+    // The exit's own write and the retry recording the exit queues are both refused.
+    vi.spyOn(open.journal, 'appendLifecycleBatch')
+      .mockRejectedValueOnce(new Error('disk full'))
+      .mockRejectedValueOnce(new Error('disk full'))
+    await rig.host.handleAdapterEvent({
+      type: 'ended',
+      sessionId: SESSION,
+      reason: 'killed',
+      cause: 'unexpected-exit',
+      fence: running.fence,
+      acquisitionGeneration: running.generation!
+    })
+    // Released with its death evidence, not latched: the next acquire settles from that evidence.
+    await vi.waitFor(() =>
+      expect(rig.store.getRecord(SESSION)?.lease).toMatchObject({
+        claimStatus: 'released',
+        deathEvidence: { kind: 'exit-observed' }
+      })
+    )
+    await rig.host.collaboratorsForTests().serialize(SESSION, async () => {})
+
+    const sent = await rig.host.send(
+      CALLER,
+      restTestSend('again', rig.store.getRecord(SESSION)!.lease.runtimeFence)
+    )
+
+    if (!sent.ok) {
+      throw new Error(`send refused: ${sent.refusal.code}`)
+    }
+    await rig.host.waitForSendSettlement(SESSION, sent.value.clientMessageId)
+    expect(rig.adapter.dispatch).toHaveBeenCalledTimes(2)
+    expect(
+      activeStructuredAgentSessionTurnId((await rig.host.journalSnapshot(SESSION)).items)
+    ).not.toBe('working')
+  })
+})
+
+describe('every close withdraws what is queued (P2-29)', () => {
+  it.each([
+    ['the close RPC', async () => void (await call('agentSession.close', { sessionId: SESSION }))],
+    ['the runtime chat close', async () => void (await closeStructuredAgentSessionChild(SESSION))],
+    [
+      'a discarded worker',
+      () =>
+        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the discard reads only this runtime member.
+        discardStructuredWorkerSession(SESSION, {
+          retireStructuredAgentSessionTabFromSnapshot: () => undefined
+        } as never)
+    ]
+  ])('%s rejects a message accepted before any start, and starts nothing', async (_, close) => {
+    await restingChat()
+    // The delivery loop has not reached its first start yet.
+    const { loop } = rig.host.collaboratorsForTests().conversationDelivery
+    vi.spyOn(loop, 'wake').mockImplementation(() => undefined)
+    const reader: unknown[] = []
+    await rig.host.subscribe({
+      id: 'reader',
+      sessionId: SESSION,
+      emit: (event) => reader.push(event)
+    })
+    const fence = rig.store.getRecord(SESSION)!.lease.runtimeFence
+    expect((await rig.host.send(CALLER, restTestSend('closed before it went', fence))).ok).toBe(
+      true
+    )
+
+    await close()
+    // A close's rejection is a sentence with its fact beside it, never a marker.
+    await vi.waitFor(() =>
+      expect(JSON.stringify(reader)).toContain(
+        '"reason":"The chat closed before this message was sent.","submittedAt"'
+      )
+    )
+    expect(JSON.stringify(reader)).toContain('"rejection":{"kind":"chatClosed"}')
+    expect(rig.host.hasSession(SESSION)).toBe(false)
+    expect(rig.adapter.acquire).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-background-task-capability.test.ts b/src/main/runtime/rpc/methods/structured-agent-session-background-task-capability.test.ts
index 2b62b00525e..8a9e2267a5a 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-background-task-capability.test.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-background-task-capability.test.ts
@@ -1,4 +1,4 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import type { AgentSessionBackgroundTaskState } from '../../../../shared/agent-session-wire'
 import {
   AGENT_SESSION_BACKGROUND_TASK_ROW_STOP_CAPABILITY,
@@ -63,7 +63,6 @@ describe('background-task stop capability at the RPC boundary', () => {
   it.each(['snapshot', 'batch', 'reset'] as const)(
     'gates the %s stream without changing the provider state',
     async (type) => {
-      hostCalls.hold = vi.fn(async () => undefined)
       hostCalls.subscribe.mockImplementation((input: AgentSessionSubscribeInput) => {
         const base = { sessionId: SESSION, fence: 1, backgroundTasks: TASKS }
         if (type === 'batch') {
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-conversation-outline.ts b/src/main/runtime/rpc/methods/structured-agent-session-conversation-outline.ts
index 99bf60da727..08ecc212ec1 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-conversation-outline.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-conversation-outline.ts
@@ -7,7 +7,7 @@
 
 import { readAgentSessionConversationOutline } from '../../../native-chat/agent-session-wire/agent-session-conversation-outline'
 import { defineMethod } from '../core'
-import { requireStructuredHost as requireHost } from './structured-agent-session-gate'
+import { requireInstalledStructuredHost } from './structured-agent-session-gate'
 import { OptionsParams } from './structured-agent-session-schemas'
 
 export const STRUCTURED_AGENT_SESSION_CONVERSATION_OUTLINE_METHODS = [
@@ -15,6 +15,8 @@ export const STRUCTURED_AGENT_SESSION_CONVERSATION_OUTLINE_METHODS = [
     name: 'agentSession.conversationOutline',
     params: OptionsParams,
     handler: async (params, ctx) =>
-      readAgentSessionConversationOutline(requireHost(ctx).journalSnapshot(params.sessionId))
+      readAgentSessionConversationOutline(
+        await (await requireInstalledStructuredHost(ctx)).journalSnapshot(params.sessionId)
+      )
   })
 ]
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-create.ts b/src/main/runtime/rpc/methods/structured-agent-session-create.ts
index ab52c2aa855..0c3b7b08713 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-create.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-create.ts
@@ -12,6 +12,7 @@
  * in. Both callers run the same two halves, so orchestration gets that guarantee too.
  */
 
+import { refuse } from '../../../../shared/agent-session-wire-refusals'
 import { computeAgentSessionPayloadFingerprint } from '../../../../shared/agent-session-mutation-envelope'
 import type {
   AgentSessionAttachResult,
@@ -43,7 +44,7 @@ export type PreparedStructuredAgentSessionCreate = {
  * intent, not a detail of it: without it a retry of "adopt this conversation" would replay as, or
  * conflict with, a blank create. `tabId` is covered so the declared digest spans the payload, but
  * replay keys on the attach fingerprint, so a retry naming another tab is answered with the one the
- * record holds. The canonicalizer drops `undefined`, so plain creates keep the digest they had.
+ * chat's tab holds. The canonicalizer drops `undefined`, so plain creates keep the digest they had.
  */
 export function structuredAgentSessionCreateIntentFingerprint(params: {
   envelope: AgentSessionMutationEnvelope
@@ -79,8 +80,8 @@ export async function prepareStructuredAgentSessionCreateForWorktree(args: {
    *  `--model`/`--effort` the dispatch asked for; a chat the user opened passes nothing and keeps
    *  the saved selection. Narrowed by the caller, so `{}` never reaches the reservation. */
   options?: Readonly<Record<string, string>>
-  /** The tab id the caller reserved for this chat, so its placement is recorded before the reply;
-   *  absent records the id clients derive. Beside `options`, after the fingerprint, likewise. */
+  /** The tab id the caller reserved for this chat, taken when its tab is published; absent, the tab
+   *  gets the id clients derive. Beside `options`, after the fingerprint, likewise. */
   tabId?: string
 }): Promise<PreparedStructuredAgentSessionCreate> {
   // Adoption replay may need the record loaded from disk before source discovery can be skipped.
@@ -131,24 +132,29 @@ export async function commitStructuredAgentSessionCreate(args: {
   if (!result.ok || !prepared.tab) {
     return result
   }
+  const surfaceTabId = prepared.attachParams.surfaceTabId
   try {
     await args.runtime.publishStructuredAgentSessionTab({
       workspaceId: prepared.tab.workspaceId,
       sessionId: result.value.sessionId,
       agent: prepared.tab.agent,
-      activate: args.activate
+      activate: args.activate,
+      ...(surfaceTabId ? { tabId: surfaceTabId } : {})
     })
   } catch (error) {
     console.warn('[agent-session] create committed before tab publication failed', error)
     return {
       ok: false,
-      refusal: {
-        code: 'agent_session_operation_unknown',
-        message: 'The chat may have been created, but its tab could not be confirmed.'
-      }
+      refusal: refuse(
+        'agent_session_operation_unknown',
+        { reason: 'tabUnconfirmed' },
+        'The chat may have been created, but its tab could not be confirmed.'
+      )
     }
   }
-  return result
+  // Read after publishing, which is what gives the chat its tab.
+  const tabId = prepared.host.getSessionTabId?.(result.value.sessionId)
+  return tabId ? { ...result, value: { ...result.value, tabId } } : result
 }
 
 export async function createStructuredAgentSessionForWorktree(args: {
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-gate-classification.test-fixture.ts b/src/main/runtime/rpc/methods/structured-agent-session-gate-classification.test-fixture.ts
index 72c52c888fd..a2876f284db 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-gate-classification.test-fixture.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-gate-classification.test-fixture.ts
@@ -21,15 +21,18 @@ export const CLEANUP_METHODS = [
     params: { envelope: envelope(), turnId: 'turn-1' },
     hostCall: 'cancel'
   },
+  // A no-op kept for older clients: it answers without reaching the host.
   {
     method: 'agentSession.release',
     params: { sessionId: SESSION, holderId: 'surface-1' },
-    hostCall: 'release'
+    hostCall: null,
+    result: { released: true }
   },
   {
     method: 'agentSession.unsubscribe',
     params: { sessionId: SESSION },
-    hostCall: 'unsubscribe'
+    hostCall: null,
+    result: { unsubscribed: true }
   }
 ] as const
 
@@ -53,6 +56,15 @@ export const ADMISSION_METHODS = [
   },
   { method: 'agentSession.ensure', params: attachParams() },
   { method: 'agentSession.send', params: sendParams() },
+  {
+    method: 'agentSession.queuedMessageSend',
+    params: { envelope: envelope(), messageId: 'queued-1' }
+  },
+  {
+    method: 'agentSession.queuedMessageDelete',
+    params: { envelope: envelope(), messageId: 'queued-1' }
+  },
+  { method: 'agentSession.queuedMessagesResume', params: { envelope: envelope() } },
   {
     method: 'agentSession.rewind',
     params: { envelope: envelope(), itemId: 'chosen', expectedEpoch: 'epoch' }
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-gate.ts b/src/main/runtime/rpc/methods/structured-agent-session-gate.ts
index 95e3e3d6eee..e4ff861d1ac 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-gate.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-gate.ts
@@ -8,6 +8,7 @@
 // for old mobile clients while structured chat is enabled so they receive a fallback row, and that
 // path constructs the host. `agentSession.*` stays refused either way, which is what this gate is for.
 
+import { agentSessionRefusalError } from '../../../../shared/agent-session-wire-refusals'
 import { getStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
 import type { StructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-host'
 import type { StructuredAgentSessionCaller } from '../../../native-chat/agent-session-wire/structured-agent-session-host-types'
@@ -27,7 +28,9 @@ export function supportsStructuredSessions(ctx: RpcContext): boolean {
 
 export function requireStructuredCapability(ctx: RpcContext): void {
   if (!supportsStructuredSessions(ctx)) {
-    throw new Error('structured_agent_session_unsupported')
+    throw agentSessionRefusalError('structured_agent_session_unsupported', {
+      reason: 'clientCapabilityMissing'
+    })
   }
 }
 
@@ -35,7 +38,9 @@ export function requireStructuredHost(ctx: RpcContext): StructuredAgentSessionHo
   requireStructuredCapability(ctx)
   const host = getStructuredAgentSessionHost()
   if (!host) {
-    throw new Error('structured_agent_session_unsupported')
+    throw agentSessionRefusalError('structured_agent_session_unsupported', {
+      reason: 'hostDisabled'
+    })
   }
   return host
 }
@@ -64,19 +69,22 @@ export function requireStructuredHost(ctx: RpcContext): StructuredAgentSessionHo
  */
 export function requireStructuredCleanupHost(ctx: RpcContext): StructuredAgentSessionHost {
   if (!supportsStructuredAgentSessionCapability(ctx)) {
-    throw new Error('structured_agent_session_unsupported')
+    throw agentSessionRefusalError('structured_agent_session_unsupported', {
+      reason: 'clientCapabilityMissing'
+    })
   }
   const host = getStructuredAgentSessionHost()
   if (!host) {
-    throw new Error('structured_agent_session_unsupported')
+    throw agentSessionRefusalError('structured_agent_session_unsupported', {
+      reason: 'hostDisabled'
+    })
   }
   return host
 }
 
-/** Builds the host for the calls that address a session by durable record rather than by live
- *  state: attach, which is the only way a session comes into being, plus hold and reveal, which
- *  each reach for a record on disk this process may not have opened yet. Every other method
- *  addresses a session that must already be attached, and correctly reports absent when none is. */
+/** Builds the host for a call that may be the first this process sees. Every session is addressed
+ *  by its durable record — a read opens a conversation at rest — so each call that reaches for one
+ *  may meet a host nothing has built yet. */
 export async function ensureStructuredHostInstalled(ctx: RpcContext): Promise<void> {
   // Gated first: a client that cannot read structured sessions must not be able
   // to make the host exist, which is an observable side effect of the surface.
@@ -89,6 +97,14 @@ export async function ensureStructuredHostInstalled(ctx: RpcContext): Promise<vo
   await ctx.runtime.ensureStructuredAgentSessionHost()
 }
 
+/** The host for a read, built first when this process has none: the read RPCs share this one. */
+export async function requireInstalledStructuredHost(
+  ctx: RpcContext
+): Promise<StructuredAgentSessionHost> {
+  await ensureStructuredHostInstalled(ctx)
+  return requireStructuredHost(ctx)
+}
+
 /** Mirrors the existing agent-session host-authority derivation so one client
  *  gets one operation namespace across both surfaces. */
 export function structuredCallerFor(ctx: RpcContext): StructuredAgentSessionCaller {
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-hold.test.ts b/src/main/runtime/rpc/methods/structured-agent-session-hold.test.ts
index c3099d843ce..140be5e1c39 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-hold.test.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-hold.test.ts
@@ -1,8 +1,8 @@
-// The wire half of a session's lifetime: who takes a hold, and what happens when they vanish.
+// `agentSession.hold` / `release` are kept answering for clients that still send them, and do
+// nothing else: a view never starts or keeps an agent.
 //
-// Run against the REAL subscription registry rather than a stub, because the backstop being tested
-// IS that registry's connection sweep — a stubbed `registerSubscriptionCleanup` would prove that
-// the handler called a function, which is not the claim.
+// Run against the REAL subscription registry rather than a stub, because the claim includes that a
+// connection closing runs nothing hold-related — a stubbed registry could not show that.
 
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
@@ -24,9 +24,10 @@ import { OrcaRuntimeService } from '../../orca-runtime'
 import type { RpcResponse } from '../core'
 import { RpcDispatcher } from '../dispatcher'
 import { STRUCTURED_AGENT_SESSION_METHODS } from './structured-agent-session'
+import { agentSessionFailureFact } from '../../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../../shared/agent-session-failure-words'
 
 const CONNECTION = 'connection-1'
-const GRACE_MS = 5
 const CLIENT = {
   clientId: 'device-1',
   clientKind: 'runtime' as const,
@@ -82,7 +83,12 @@ beforeEach(async () => {
       // acquire that throws leaves an unverifiable owner nothing may replace.
       releaseAcquisition: vi.fn(async () => true),
       closeSession,
-      dispatch: async () => ({ state: 'rejected', reason: 'unused' }),
+      dispatch: async () => ({
+        state: 'rejected',
+        ...agentSessionFailureWords(agentSessionFailureFact('providerRejected'), {
+          surface: 'rejection'
+        })
+      }),
       cancelTurn: async () => ({ cancelled: false }),
       answerPrompt: async () => undefined,
       setOption: async () => undefined
@@ -90,7 +96,6 @@ beforeEach(async () => {
     journalRoot: root,
     claimKeyId: 'key-1',
     mintSpawnToken: () => 'spawn-a',
-    releaseGraceMs: GRACE_MS,
     now: () => NOW
   })
   setStructuredAgentSessionHost(host)
@@ -114,186 +119,85 @@ afterEach(async () => {
   await rm(root, { recursive: true, force: true })
 })
 
-describe('a client that holds a session', () => {
-  it('keeps the provider child while the hold stands', async () => {
+describe('the hold surface, for clients that still call it', () => {
+  it('answers a hold without starting an agent or registering a cleanup', async () => {
+    await host.close(SESSION)
+    expect(host.hasSession(SESSION)).toBe(false)
+    const registered = vi.spyOn(runtime, 'registerOwnedSubscriptionCleanup')
+    const acquiresBefore = acquire.mock.calls.length
+
     expect(
       await call('agentSession.hold', { sessionId: SESSION, holderId: 'chat-1' })
-    ).toMatchObject({ ok: true })
+    ).toMatchObject({ ok: true, result: { held: true } })
 
-    await new Promise((resolve) => setTimeout(resolve, GRACE_MS * 20))
+    expect(acquire.mock.calls.length).toBe(acquiresBefore)
+    expect(registered).not.toHaveBeenCalled()
+    expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
+  })
+
+  it('answers a release without stopping anything, and a connection close runs nothing', async () => {
+    await call('agentSession.hold', { sessionId: SESSION, holderId: 'chat-1' })
+
+    expect(
+      await call('agentSession.release', { sessionId: SESSION, holderId: 'chat-1' })
+    ).toMatchObject({ ok: true, result: { released: true } })
+    runtime.cleanupSubscriptionsForConnection(CONNECTION)
+    await new Promise((resolve) => setTimeout(resolve, 20))
 
     expect(closeSession).not.toHaveBeenCalled()
     expect(host.hasSession(SESSION)).toBe(true)
   })
 
-  it('releases it when the client says so', async () => {
-    await call('agentSession.hold', { sessionId: SESSION, holderId: 'chat-1' })
-
-    expect(
-      await call('agentSession.release', { sessionId: SESSION, holderId: 'chat-1' })
-    ).toMatchObject({ ok: true })
-
-    await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
-    expect(closeSession).toHaveBeenCalledWith(SESSION)
-  })
-
-  it('releases its hold and cleanup after the setting is disabled', async () => {
-    const release = vi.spyOn(host, 'release')
-    await call('agentSession.hold', { sessionId: SESSION, holderId: 'chat-1' })
+  it('refuses a hold once the setting is off, and still answers a release', async () => {
     structuredNativeChatEnabled = false
 
+    expect(
+      await call('agentSession.hold', { sessionId: SESSION, holderId: 'chat-1' })
+    ).toMatchObject({ ok: false })
     expect(
       await call('agentSession.release', { sessionId: SESSION, holderId: 'chat-1' })
-    ).toMatchObject({ ok: true })
-    const releaseCallsAfterRpc = release.mock.calls.length
-    runtime.cleanupSubscriptionsForConnection(CONNECTION)
-
-    expect(releaseCallsAfterRpc).toBe(2)
-    expect(release).toHaveBeenCalledTimes(releaseCallsAfterRpc)
-    await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
-    expect(closeSession).toHaveBeenCalledWith(SESSION)
+    ).toMatchObject({ ok: true, result: { released: true } })
+    expect(closeSession).not.toHaveBeenCalled()
   })
 
-  it('does not report success when no provider child can be acquired', async () => {
-    const response = await call('agentSession.hold', {
-      sessionId: 'session-missing',
-      holderId: 'chat-missing'
-    })
+  it('answers a hold even when no agent could be started', async () => {
+    await host.close(SESSION)
+    acquire.mockRejectedValue(new Error('provider unavailable'))
+    const acquiresBefore = acquire.mock.calls.length
 
-    expect(response).toMatchObject({
-      ok: false,
-      error: { code: 'agent_session_identity_required' }
-    })
-    expect(host.isHeld('session-missing')).toBe(false)
+    expect(
+      await call('agentSession.hold', { sessionId: SESSION, holderId: 'chat-1' })
+    ).toMatchObject({ ok: true, result: { held: true } })
+    expect(acquire.mock.calls.length).toBe(acquiresBefore)
   })
 })
 
-describe('a client that disappears without cleanup', () => {
-  it('shares one child with a same-ID replacement that arrives while the first hold resumes', async () => {
+describe('a stream', () => {
+  it('reads a closed conversation without starting its agent', async () => {
     await host.close(SESSION)
-    await host.restoreReadableSessions()
-    closeSession.mockClear()
-    acquire.mockClear()
-    const entered = Promise.withResolvers<void>()
-    const gate = Promise.withResolvers<void>()
-    const spawnChild = acquire.getMockImplementation()!
-    acquire.mockImplementationOnce(async (input) => {
-      entered.resolve()
-      await gate.promise
-      return spawnChild(input)
-    })
-    try {
-      const params = { sessionId: SESSION, holderId: 'same-chat' }
-      const first = call('agentSession.hold', params)
-      await entered.promise
-      // Re-registering the cleanup id released the first hold; the replacement waits its turn
-      // behind the first hold's attach and finds the child it made.
-      const replacement = call('agentSession.hold', params)
-      gate.resolve()
+    expect(host.hasSession(SESSION)).toBe(false)
+    const acquiresBefore = acquire.mock.calls.length
+    const frames: unknown[] = []
 
-      expect(await first).toMatchObject({ ok: true })
-      expect(await replacement).toMatchObject({ ok: true })
-      expect(acquire).toHaveBeenCalledOnce()
-      expect(host.isHeld(SESSION)).toBe(true)
-      await new Promise((resolve) => setTimeout(resolve, GRACE_MS * 4))
-      expect(closeSession).not.toHaveBeenCalled()
-
-      runtime.cleanupSubscriptionsForConnection(CONNECTION)
-      await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
-      expect(closeSession).toHaveBeenCalledExactlyOnceWith(SESSION)
-    } finally {
-      gate.resolve()
-    }
-  })
-
-  it('lets a same-ID replacement make its own attempt when the first hold fails to acquire', async () => {
-    await host.close(SESSION)
-    await host.restoreReadableSessions()
-    closeSession.mockClear()
-    acquire.mockClear()
-    const entered = Promise.withResolvers<void>()
-    const gate = Promise.withResolvers<void>()
-    acquire.mockImplementationOnce(async () => {
-      entered.resolve()
-      await gate.promise
-      throw new Error('acquisition failed')
-    })
-    try {
-      const params = { sessionId: SESSION, holderId: 'same-chat' }
-      const first = call('agentSession.hold', params)
-      await entered.promise
-      const replacement = call('agentSession.hold', params)
-      gate.resolve()
-
-      expect(await first).toMatchObject({ ok: false })
-      // One attempt per hold: the replacement's own succeeds, and the holder it re-took stands.
-      const replaced = await replacement
-      expect(replaced, JSON.stringify(replaced)).toMatchObject({ ok: true })
-      expect(acquire).toHaveBeenCalledTimes(2)
-      expect(host.isHeld(SESSION)).toBe(true)
-      expect(closeSession).not.toHaveBeenCalled()
-
-      runtime.cleanupSubscriptionsForConnection(CONNECTION)
-      await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
-      expect(closeSession).toHaveBeenCalledExactlyOnceWith(SESSION)
-    } finally {
-      gate.resolve()
-    }
-  })
-
-  it('still releases the session when its transport closes', async () => {
-    await call('agentSession.hold', { sessionId: SESSION, holderId: 'chat-1' })
-
-    runtime.cleanupSubscriptionsForConnection(CONNECTION)
-
-    await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
-    expect(closeSession).toHaveBeenCalledWith(SESSION)
-  })
-
-  it('does not release a hold another connection is still holding', async () => {
-    await call('agentSession.hold', { sessionId: SESSION, holderId: 'chat-1' })
     await dispatcher.dispatchStreaming(
       {
-        id: 'request-other',
+        id: 'request-subscribe',
         authToken: 'token',
-        method: 'agentSession.hold',
-        params: { sessionId: SESSION, holderId: 'chat-1' }
+        method: 'agentSession.subscribe',
+        params: { sessionId: SESSION }
       },
-      () => {},
-      { ...CLIENT, clientId: 'device-2', connectionId: 'connection-2' }
+      (raw) => frames.push(JSON.parse(raw)),
+      CLIENT
     )
 
-    runtime.cleanupSubscriptionsForConnection(CONNECTION)
-    await new Promise((resolve) => setTimeout(resolve, GRACE_MS * 20))
-
-    expect(closeSession).not.toHaveBeenCalled()
-    expect(host.hasSession(SESSION)).toBe(true)
-  })
-
-  it('does not let an old connection sweep release its same-document replacement', async () => {
-    await call('agentSession.hold', { sessionId: SESSION, holderId: 'chat-1' })
-    await dispatcher.dispatchStreaming(
-      {
-        id: 'request-replacement',
-        authToken: 'token',
-        method: 'agentSession.hold',
-        params: { sessionId: SESSION, holderId: 'chat-1' }
-      },
-      () => {},
-      { ...CLIENT, connectionId: 'connection-2' }
+    expect(frames).toContainEqual(
+      expect.objectContaining({ result: expect.objectContaining({ type: 'snapshot' }) })
     )
-
-    runtime.cleanupSubscriptionsForConnection(CONNECTION)
-    await new Promise((resolve) => setTimeout(resolve, GRACE_MS * 20))
-
-    expect(closeSession).not.toHaveBeenCalled()
-    expect(host.hasSession(SESSION)).toBe(true)
-
-    runtime.cleanupSubscriptionsForConnection('connection-2')
-    await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
+    expect(acquire.mock.calls.length).toBe(acquiresBefore)
+    expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
   })
 
-  it('releases a desktop subscription when its renderer transport dies', async () => {
+  it('keeps nothing alive when its transport dies', async () => {
     const transport = new AbortController()
     await dispatcher.dispatchStreaming(
       {
@@ -310,56 +214,12 @@ describe('a client that disappears without cleanup', () => {
         clientCapabilities: CLIENT.clientCapabilities
       }
     )
-    expect(host.isHeld(SESSION)).toBe(true)
 
     transport.abort()
+    await new Promise((resolve) => setTimeout(resolve, 20))
 
-    await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
-    expect(closeSession).toHaveBeenCalledWith(SESSION)
-  })
-
-  it('unsubscribes and releases stream retention after the setting is disabled', async () => {
-    await dispatcher.dispatchStreaming(
-      {
-        id: 'stream-disabled-cleanup',
-        authToken: 'token',
-        method: 'agentSession.subscribe',
-        params: { sessionId: SESSION }
-      },
-      () => {},
-      CLIENT
-    )
-    expect(host.isHeld(SESSION)).toBe(true)
-    structuredNativeChatEnabled = false
-
-    expect(
-      await call('agentSession.unsubscribe', {
-        sessionId: SESSION,
-        subscriptionId: 'stream-disabled-cleanup'
-      })
-    ).toMatchObject({ ok: true })
-
-    await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
-    expect(closeSession).toHaveBeenCalledWith(SESSION)
-  })
-
-  it('does not let a stream alone resume a released session', async () => {
-    await host.close(SESSION)
-    expect(host.hasSession(SESSION)).toBe(false)
-    await host.restoreReadableSessions()
-    expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
-
-    await dispatcher.dispatchStreaming(
-      {
-        id: 'request-subscribe',
-        authToken: 'token',
-        method: 'agentSession.subscribe',
-        params: { sessionId: SESSION }
-      },
-      () => {},
-      CLIENT
-    )
-
-    expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
+    // The idle sweep, not a departing reader, is what stops an agent.
+    expect(closeSession).not.toHaveBeenCalled()
+    expect(host.hasSession(SESSION)).toBe(true)
   })
 })
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-hold.ts b/src/main/runtime/rpc/methods/structured-agent-session-hold.ts
index 54753fcb889..e1975f1c725 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-hold.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-hold.ts
@@ -1,64 +1,31 @@
-// `agentSession.hold` / `agentSession.release` — a surface saying it is bound to a session.
+// `agentSession.hold` / `agentSession.release` — kept answering for clients that still send them.
 //
-// The holder identity is scoped to the CONNECTION, not taken from the client verbatim: two clients
-// are free to name their surfaces the same thing, and a hold that collides is one that a stranger
-// can release.
-//
-// The registered cleanup is the backstop, and the ONLY thing that covers a client which vanishes —
-// a paired client that disconnects mid-turn never gets to send its release. Registering it before taking
-// the hold is deliberate: re-registering an id runs the previous cleanup synchronously, so the
-// stale release lands before this hold rather than after it.
+// A view no longer decides whether an agent runs: a send starts one, and the idle sweep stops it.
+// So both are no-ops. `hold` still builds the host, because shipped mobile builds build it through
+// `hold` before they subscribe. Delete both, and their allowlist entries, once
+// MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION passes every client that still calls them.
 
-import { defineMethod, type RpcContext } from '../core'
+import { defineMethod } from '../core'
 import {
-  ensureStructuredHostInstalled,
-  requireStructuredCleanupHost,
-  requireStructuredHost
+  requireInstalledStructuredHost,
+  requireStructuredCleanupHost
 } from './structured-agent-session-gate'
 import { HoldParams } from './structured-agent-session-schemas'
 
-const HOLD_CLEANUP_PREFIX = 'agentSession.hold'
-
-function holderKeyFor(ctx: RpcContext, holderId: string): string {
-  const client = ctx.clientId?.trim() || (ctx.clientKind ?? 'runtime')
-  return `${ctx.connectionId ?? 'local'}:${client}:${holderId}`
-}
-
-function holdCleanupIdFor(sessionId: string, holderKey: string): string {
-  return `${HOLD_CLEANUP_PREFIX}:${holderKey}:${sessionId}`
-}
-
 export const STRUCTURED_AGENT_SESSION_HOLD_METHODS = [
   defineMethod({
     name: 'agentSession.hold',
     params: HoldParams,
-    handler: async (params, ctx) => {
-      await ensureStructuredHostInstalled(ctx)
-      const host = requireStructuredHost(ctx)
-      const holderKey = holderKeyFor(ctx, params.holderId)
-      const registration = ctx.runtime.registerOwnedSubscriptionCleanup(
-        holdCleanupIdFor(params.sessionId, holderKey),
-        () => host.release(params.sessionId, holderKey),
-        ctx.connectionId
-      )
-      try {
-        await host.hold(params.sessionId, holderKey)
-      } catch (error) {
-        registration.releaseIfCurrent()
-        throw error
-      }
+    handler: async (_params, ctx) => {
+      await requireInstalledStructuredHost(ctx)
       return { held: true as const }
     }
   }),
   defineMethod({
     name: 'agentSession.release',
     params: HoldParams,
-    handler: async (params, ctx) => {
-      const host = requireStructuredCleanupHost(ctx)
-      const holderKey = holderKeyFor(ctx, params.holderId)
-      host.release(params.sessionId, holderKey)
-      // Retires the backstop too; its release is a no-op against a holder already gone.
-      ctx.runtime.cleanupSubscription(holdCleanupIdFor(params.sessionId, holderKey))
+    handler: async (_params, ctx) => {
+      requireStructuredCleanupHost(ctx)
       return { released: true as const }
     }
   })
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-options-read.ts b/src/main/runtime/rpc/methods/structured-agent-session-options-read.ts
index b74b9cacfa6..19e93689577 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-options-read.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-options-read.ts
@@ -1,22 +1,26 @@
 // The options read surface: what a session reports about itself, and the
 // host's stored model catalog behind the picker.
 //
-// `agentSession.options` serializes on the session because it asks the live
-// provider what is selected. `agentSession.modelCatalog` deliberately does
+// `agentSession.options` answers at rest from the record and the catalog, and
+// asks the live provider only when one runs. `agentSession.modelCatalog` deliberately does
 // neither — answering from the host store is what lets a picker render while
 // an attach is still running. It is additive: an older host answers
 // `method_not_found` (or `forbidden` through the mobile allowlist gate), and
 // the client keeps its static seed.
 
 import { defineMethod } from '../core'
-import { requireStructuredHost as requireHost } from './structured-agent-session-gate'
+import {
+  requireInstalledStructuredHost,
+  requireStructuredHost as requireHost
+} from './structured-agent-session-gate'
 import { ModelCatalogParams, OptionsParams } from './structured-agent-session-schemas'
 
 export const STRUCTURED_AGENT_SESSION_OPTIONS_READ_METHODS = [
   defineMethod({
     name: 'agentSession.options',
     params: OptionsParams,
-    handler: async (params, ctx) => requireHost(ctx).readOptions(params.sessionId)
+    handler: async (params, ctx) =>
+      (await requireInstalledStructuredHost(ctx)).readOptions(params.sessionId)
   }),
   defineMethod({
     name: 'agentSession.modelCatalog',
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.ts b/src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.ts
index 24d9fa2aec4..4038fe9e40d 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.ts
@@ -12,6 +12,9 @@
 
 import {
   AGENT_SESSION_WIRE_REFUSAL_CODES,
+  agentSessionRefusalFromReference,
+  isAgentSessionRefusalError,
+  refuseUnclassified,
   type AgentSessionWireRefusal,
   type AgentSessionWireRefusalCode
 } from '../../../../shared/agent-session-wire'
@@ -40,19 +43,25 @@ function wireRefusalCode(error: unknown): AgentSessionWireRefusalCode | null {
   return null
 }
 
+const PRECOMMIT_REFUSAL_MESSAGE = 'Orca cannot open a structured agent chat for this workspace.'
+
 function precommitRefusal(error: unknown): AgentSessionWireRefusal {
+  // A refusal the host raised keeps its situation; a bare code names none.
+  if (isAgentSessionRefusalError(error)) {
+    return agentSessionRefusalFromReference(error.refusal, PRECOMMIT_REFUSAL_MESSAGE)
+  }
   const code = wireRefusalCode(error)
   if (code) {
-    return { code, message: 'Orca cannot open a structured agent chat for this workspace.' }
+    return refuseUnclassified(code, PRECOMMIT_REFUSAL_MESSAGE)
   }
   const message = error instanceof Error ? error.message : String(error)
   // A code-less failure here is often a defect, not a policy answer; the refusal keeps the user
-  // moving, the log keeps the cause findable.
+  // moving, the log keeps the cause findable. Nothing names its situation, so it carries no reason.
   console.warn('[agent-session] create refused before it committed anything', error)
-  return {
-    code: UNCODED_PRECOMMIT_REFUSAL_CODE,
-    message: `Orca could not prepare a structured agent chat for this workspace: ${message}`
-  }
+  return refuseUnclassified(
+    UNCODED_PRECOMMIT_REFUSAL_CODE,
+    `Orca could not prepare a structured agent chat for this workspace: ${message}`
+  )
 }
 
 /**
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-queued-methods.ts b/src/main/runtime/rpc/methods/structured-agent-session-queued-methods.ts
new file mode 100644
index 00000000000..a4b68ccbcd3
--- /dev/null
+++ b/src/main/runtime/rpc/methods/structured-agent-session-queued-methods.ts
@@ -0,0 +1,31 @@
+// The queued-message actions: Send-now and Delete on one card, and Resume on a
+// paused queue. All gated on agent-session.queued-messages.v1; an older host
+// lacks the methods entirely.
+
+import { defineMethod } from '../core'
+import {
+  requireStructuredHost as requireHost,
+  structuredCallerFor as callerFor
+} from './structured-agent-session-gate'
+import {
+  QueuedMessageActionParams,
+  QueuedMessagesResumeParams
+} from './structured-agent-session-schemas'
+
+export const STRUCTURED_AGENT_SESSION_QUEUED_METHODS = [
+  defineMethod({
+    name: 'agentSession.queuedMessageSend',
+    params: QueuedMessageActionParams,
+    handler: async (params, ctx) => requireHost(ctx).queuedMessageSend(callerFor(ctx), params)
+  }),
+  defineMethod({
+    name: 'agentSession.queuedMessageDelete',
+    params: QueuedMessageActionParams,
+    handler: async (params, ctx) => requireHost(ctx).queuedMessageDelete(callerFor(ctx), params)
+  }),
+  defineMethod({
+    name: 'agentSession.queuedMessagesResume',
+    params: QueuedMessagesResumeParams,
+    handler: async (params, ctx) => requireHost(ctx).queuedMessagesResume(callerFor(ctx), params)
+  })
+]
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-respond-params.test.ts b/src/main/runtime/rpc/methods/structured-agent-session-respond-params.test.ts
new file mode 100644
index 00000000000..3eb7ad3db61
--- /dev/null
+++ b/src/main/runtime/rpc/methods/structured-agent-session-respond-params.test.ts
@@ -0,0 +1,106 @@
+// Wire bounds for prompt responses: a decision id for an approval, structured answers for a question.
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import {
+  call,
+  clearStructuredHostStub,
+  envelope,
+  hostCalls,
+  installStructuredHostStub,
+  STRUCTURED_CLIENT
+} from './structured-agent-session-rpc.test-fixture'
+
+beforeEach(() => {
+  installStructuredHostStub()
+})
+
+afterEach(() => {
+  clearStructuredHostStub()
+})
+
+describe('prompt response parameters', () => {
+  const rejects = async (method: string, params: unknown): Promise<void> => {
+    const response = await call(method, params, STRUCTURED_CLIENT)
+    expect(response).toMatchObject({ ok: false, error: { code: 'invalid_argument' } })
+  }
+
+  it('accepts the maximum fully encoded Claude choice group and retains a finite bound', async () => {
+    const maximumSelections = Array.from({ length: 4 }, (_, questionIndex) => ({
+      questionId: `q${questionIndex + 1}`,
+      optionIds: Array.from(
+        { length: 4 },
+        (_, optionIndex) => `q${questionIndex + 1}:choice-${optionIndex + 1}`
+      )
+    }))
+    const optionId = `question-group:${encodeURIComponent(JSON.stringify(maximumSelections))}`
+    expect(optionId.length).toBe(610)
+
+    const response = await call(
+      'agentSession.respondToQuestion',
+      {
+        envelope: envelope(),
+        itemId: 'item-1',
+        expectedRevision: 1,
+        optionId
+      },
+      STRUCTURED_CLIENT
+    )
+    expect(response).toMatchObject({ ok: true })
+    expect(hostCalls.respondToPrompt).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ optionId })
+    )
+
+    await rejects('agentSession.respondToQuestion', {
+      envelope: envelope(),
+      itemId: 'item-1',
+      expectedRevision: 1,
+      optionId: 'x'.repeat(1025)
+    })
+  })
+
+  it('takes a long typed answer as structured answers and bounds each field', async () => {
+    const answers = [
+      { questionId: 'q1', optionIds: ['q1:choice-1'] },
+      { questionId: 'q2', optionIds: [], other: 'Proceed with the replacement. '.repeat(100) }
+    ]
+    const response = await call(
+      'agentSession.respondToQuestion',
+      { envelope: envelope(), itemId: 'item-1', expectedRevision: 1, answers },
+      STRUCTURED_CLIENT
+    )
+    expect(response).toMatchObject({ ok: true })
+    expect(hostCalls.respondToPrompt).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ kind: 'question', answers })
+    )
+
+    const base = { envelope: envelope(), itemId: 'item-1', expectedRevision: 1 }
+    await rejects('agentSession.respondToQuestion', base)
+    await rejects('agentSession.respondToQuestion', { ...base, optionId: 'q1:choice-1', answers })
+    await rejects('agentSession.respondToQuestion', {
+      ...base,
+      answers: [{ questionId: 'q1', optionIds: [], other: 'x'.repeat(64 * 1024 + 1) }]
+    })
+    await rejects('agentSession.respondToQuestion', {
+      ...base,
+      answers: [{ questionId: 'q1', optionIds: [], other: 'é'.repeat(40 * 1024) }]
+    })
+    await rejects('agentSession.respondToApproval', { ...base, answers })
+    await rejects('agentSession.respondToApproval', { ...base, optionId: 'x'.repeat(1025) })
+  })
+
+  it('takes a question id exactly as the agent wrote it, including edge spaces', async () => {
+    const answers = [{ questionId: 'scope ', optionIds: [], other: 'mine' }]
+    const response = await call(
+      'agentSession.respondToQuestion',
+      { envelope: envelope(), itemId: 'item-1', expectedRevision: 1, answers },
+      STRUCTURED_CLIENT
+    )
+    expect(response).toMatchObject({ ok: true })
+    expect(hostCalls.respondToPrompt).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ kind: 'question', answers })
+    )
+  })
+})
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-restart-resume.ts b/src/main/runtime/rpc/methods/structured-agent-session-restart-resume.ts
index b3a70334f40..a48f897a005 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-restart-resume.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-restart-resume.ts
@@ -64,20 +64,15 @@ export const STRUCTURED_AGENT_SESSION_RESTART_RESUME_METHODS = [
     }
   }),
   defineMethod({
-    // Reattach only, no send. No Orca surface calls it now — the desktop prompt's single action is
-    // resume-and-continue — but it is a PUBLISHED wire method, so dropping it is a wire removal an
-    // older or non-desktop client would meet as an unknown method.
+    // Reattach only, no send. Reattaching is nothing now — an agent starts only for work — so this
+    // answers that nothing was resumed. No Orca surface calls it, but it is a PUBLISHED wire
+    // method, so dropping it is a wire removal an older client would meet as an unknown method.
     name: 'agentSession.restartResume',
     params: RestartResumeParams,
-    handler: async (params, ctx) => {
+    handler: async (_params, ctx) => {
       await ensureStructuredHostInstalled(ctx)
-      const host = requireStructuredHost(ctx)
-      return {
-        results: await host.restartResume.resume(
-          params.sessionIds,
-          structuredCallerFor(ctx).callerKey
-        )
-      }
+      requireStructuredHost(ctx)
+      return { results: [] }
     }
   })
 ]
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-reveal.ts b/src/main/runtime/rpc/methods/structured-agent-session-reveal.ts
index 47f30a5030d..903f8d440af 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-reveal.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-reveal.ts
@@ -9,7 +9,11 @@
 // reads its own record and answers with that record's workspace and provider, so a client knowing
 // only a session id cannot aim the publication somewhere else.
 
-import { isAgentSessionWireRefusalCode } from '../../../../shared/agent-session-wire'
+import {
+  agentSessionRefusalFromReference,
+  isAgentSessionRefusalError,
+  isAgentSessionWireRefusalCode
+} from '../../../../shared/agent-session-wire'
 import type { StructuredAgentSessionReveal } from '../../../native-chat/agent-session-wire/structured-agent-session-host-types'
 import { refuseAgentSessionMutation } from '../../../native-chat/agent-session-wire/structured-agent-session-mutation-admission'
 import { defineMethod } from '../core'
@@ -37,13 +41,14 @@ export const STRUCTURED_AGENT_SESSION_REVEAL_METHODS = [
         if (!isAgentSessionWireRefusalCode(code)) {
           throw error
         }
-        return refuseAgentSessionMutation({
-          code,
-          message:
+        return refuseAgentSessionMutation(
+          agentSessionRefusalFromReference(
+            isAgentSessionRefusalError(error) ? error.refusal : { code },
             code === 'structured_agent_session_unsupported'
               ? 'This host cannot open that chat.'
               : 'This chat is no longer on this host.'
-        })
+          )
+        )
       }
       await ctx.runtime.publishStructuredAgentSessionTab({
         workspaceId: revealed.workspaceId,
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-rpc.test-fixture.ts b/src/main/runtime/rpc/methods/structured-agent-session-rpc.test-fixture.ts
index a9cf5cd7957..85d3e2a5b4b 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-rpc.test-fixture.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-rpc.test-fixture.ts
@@ -191,6 +191,7 @@ export function hostStub(): StructuredAgentSessionHost {
       current: { model: 'gpt-live' }
     })),
     history: vi.fn(() => ({ ok: true, page: { items: [] } })),
+    sessionAgent: vi.fn(() => null),
     journalSnapshot: vi.fn((sessionId: string) => ({
       sessionId,
       cursor: { epoch: 'epoch-a', sequence: 0 },
@@ -203,8 +204,7 @@ export function hostStub(): StructuredAgentSessionHost {
     subscribeStatus: vi.fn((subscriber: StructuredAgentSessionStatusSubscriber) =>
       statusFeed().subscribe(subscriber)
     ),
-    unsubscribe: vi.fn(),
-    release: vi.fn()
+    unsubscribe: vi.fn()
   })
   return hostCalls as unknown as StructuredAgentSessionHost
 }
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-schemas.ts b/src/main/runtime/rpc/methods/structured-agent-session-schemas.ts
index 9daf97d55af..5930fa1e80f 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-schemas.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-schemas.ts
@@ -16,7 +16,10 @@ export {
   ModelCatalogParams,
   MutationEnvelope,
   OptionsParams,
+  QueuedMessageActionParams,
+  QueuedMessagesResumeParams,
   RespondParams,
+  RespondToQuestionParams,
   RestartResumableParams,
   RestartResumeParams,
   RewindParams,
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-send-compatibility.test.ts b/src/main/runtime/rpc/methods/structured-agent-session-send-compatibility.test.ts
new file mode 100644
index 00000000000..59bc914558e
--- /dev/null
+++ b/src/main/runtime/rpc/methods/structured-agent-session-send-compatibility.test.ts
@@ -0,0 +1,90 @@
+// Which clients get a send answered at acceptance, and which have their reply held until the
+// message is handed over: a client that cannot show a rejection after `pending` must not see one.
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import {
+  ELECTRON_REMOTE_RUNTIME_CLIENT_CAPABILITIES,
+  STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
+} from '../../../../shared/protocol-version'
+import { DESKTOP_RENDERER_RUNTIME_CLIENT_CAPABILITIES } from '../../../ipc/desktop-renderer-runtime-capabilities'
+import { STRUCTURED_AGENT_SESSION_START_WAIT_MS } from '../../../native-chat/agent-session-wire/structured-agent-session-send-settlement'
+import {
+  call,
+  clearStructuredHostStub,
+  hostCalls,
+  installStructuredHostStub,
+  SESSION,
+  sendParams,
+  STRUCTURED_CLIENT
+} from './structured-agent-session-rpc.test-fixture'
+
+beforeEach(() => {
+  installStructuredHostStub()
+})
+
+afterEach(() => {
+  clearStructuredHostStub()
+})
+
+describe('agentSession.send reply timing', () => {
+  it('holds a pending reply until handover for a client that cannot show a later rejection', async () => {
+    hostCalls.send.mockResolvedValueOnce(pendingSendResult())
+    hostCalls.waitForSendSettlement.mockResolvedValueOnce(undefined)
+
+    await call('agentSession.send', sendParams(), STRUCTURED_CLIENT)
+
+    expect(hostCalls.waitForSendSettlement).toHaveBeenCalledWith(SESSION, 'client-1', {
+      until: 'handed-over-or-behind-command',
+      budgetMs: STRUCTURED_AGENT_SESSION_START_WAIT_MS
+    })
+  })
+
+  it("marks a client's send as the user's own, which alone lifts a Stop's queue pause", async () => {
+    hostCalls.send.mockResolvedValueOnce(pendingSendResult())
+    await call('agentSession.send', sendParams(), STRUCTURED_CLIENT)
+    expect(hostCalls.send.mock.calls[0]?.[1]).toMatchObject({ userSend: true })
+  })
+
+  it('answers at acceptance for the local desktop and paired desktop clients (W2)', async () => {
+    for (const clientCapabilities of [
+      DESKTOP_RENDERER_RUNTIME_CLIENT_CAPABILITIES,
+      // A paired desktop gains the structured surface as its own capability; the reply rule rides
+      // on the list it already sends.
+      [...ELECTRON_REMOTE_RUNTIME_CLIENT_CAPABILITIES, STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY]
+    ]) {
+      hostCalls.send.mockResolvedValueOnce(pendingSendResult())
+      const response = await call('agentSession.send', sendParams(), {
+        clientKind: 'runtime',
+        clientCapabilities: [...clientCapabilities]
+      })
+      expect(response).toMatchObject({
+        ok: true,
+        result: { value: { submission: { dispatchState: 'pending' } } }
+      })
+    }
+    expect(hostCalls.waitForSendSettlement).not.toHaveBeenCalled()
+  })
+})
+
+function pendingSendResult() {
+  return {
+    ok: true,
+    replayed: false,
+    fence: 1,
+    cursor: { epoch: 'epoch-a', sequence: 1 },
+    value: {
+      clientMessageId: 'client-1',
+      submission: {
+        clientMessageId: 'client-1',
+        fence: 1,
+        payloadFingerprint: 'fingerprint',
+        dispatchState: 'pending' as const,
+        providerItemId: null,
+        reason: null,
+        submittedAt: 1,
+        resolvedAt: null,
+        handoverRecorded: true as const
+      }
+    }
+  }
+}
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-send-compatibility.ts b/src/main/runtime/rpc/methods/structured-agent-session-send-compatibility.ts
index 8b948869990..47afaa8ac73 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-send-compatibility.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-send-compatibility.ts
@@ -1,26 +1,48 @@
-import { AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY } from '../../../../shared/protocol-version'
+import {
+  AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
+  AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY
+} from '../../../../shared/protocol-version'
+import { agentSessionSendSubmission } from '../../../../shared/agent-session-wire'
 import type { StructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-host'
+import { STRUCTURED_AGENT_SESSION_START_WAIT_MS } from '../../../native-chat/agent-session-wire/structured-agent-session-send-settlement'
 import type { RpcContext } from '../core'
 import { requireStructuredHost, structuredCallerFor } from './structured-agent-session-gate'
 
+/**
+ * A send answers once the host accepts it. A client that predates that answer cannot show a
+ * message rejected after it, so its reply is held until the message is handed over or rejected —
+ * or queued behind a running command such as `/compact`, which could outlast the client's own
+ * request timeout; one that predates pending replies at all waits, as before, for the provider's
+ * answer.
+ */
 export async function sendStructuredAgentSessionForClient(
   params: Parameters<StructuredAgentSessionHost['send']>[1],
   context: RpcContext
 ) {
   const host = requireStructuredHost(context)
-  const result = await host.send(structuredCallerFor(context), params)
+  // Only a client's own send lifts a Stop's queue pause; host-internal senders never do.
+  const result = await host.send(structuredCallerFor(context), { ...params, userSend: true })
+  const capabilities = context.clientCapabilities ?? []
   if (
     !result.ok ||
-    result.value.submission.dispatchState !== 'pending' ||
+    // A queued answer only ever reaches a capable client, which renders it as-is.
+    agentSessionSendSubmission(result.value)?.dispatchState !== 'pending' ||
     context.clientKind === undefined ||
-    context.clientCapabilities?.includes(AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY)
+    capabilities.includes(AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY)
   ) {
     return result
   }
+  // The start that used to run before the reply now runs after acceptance, so both waits cover it.
   const settled = await host.waitForSendSettlement(
     params.envelope.sessionId,
     result.value.clientMessageId,
-    context.signal
+    {
+      until: capabilities.includes(AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY)
+        ? 'handed-over-or-behind-command'
+        : 'answered',
+      budgetMs: STRUCTURED_AGENT_SESSION_START_WAIT_MS,
+      ...(context.signal ? { signal: context.signal } : {})
+    }
   )
   return settled ? { ...result, ...settled } : result
 }
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.test.ts b/src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.test.ts
index 0393cf216c8..473f6331372 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.test.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.test.ts
@@ -1,4 +1,4 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import type { AgentJournalRenderItem } from '../../../../shared/agent-session-journal-types'
 import type {
   AgentSessionHistoryPage,
@@ -87,7 +87,6 @@ describe('turn item capability at the RPC boundary', () => {
   it.each(['snapshot', 'batch', 'reset'] as const)(
     'downgrades the %s stream only for a legacy reader',
     async (type) => {
-      hostCalls.hold = vi.fn(async () => undefined)
       hostCalls.subscribe.mockImplementation((input: AgentSessionSubscribeInput) => {
         const base = { sessionId: SESSION, fence: 1 }
         if (type === 'batch') {
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.ts b/src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.ts
index f0694811a9a..c6984552399 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.ts
@@ -24,7 +24,10 @@ function readsTurnItems(ctx: TurnItemReader): boolean {
   )
 }
 
-function projectItems(items: AgentJournalRenderItem[]): AgentJournalRenderItem[] {
+function projectItems(
+  items: AgentJournalRenderItem[],
+  sessionAgent: string | null
+): AgentJournalRenderItem[] {
   if (!items.some((item) => item.body.kind === 'turn')) {
     return items
   }
@@ -33,39 +36,45 @@ function projectItems(items: AgentJournalRenderItem[]): AgentJournalRenderItem[]
       return item
     }
     const { kind: _kind, ...turn } = item.body
-    return { ...item, body: legacyAgentJournalTurnStatusBody(turn, item.itemId) }
+    return { ...item, body: legacyAgentJournalTurnStatusBody(turn, item.itemId, sessionAgent) }
   })
 }
 
-function projectPage(page: AgentSessionHistoryPage): AgentSessionHistoryPage {
-  const items = projectItems(page.items)
+function projectPage(
+  page: AgentSessionHistoryPage,
+  sessionAgent: string | null
+): AgentSessionHistoryPage {
+  const items = projectItems(page.items, sessionAgent)
   return items === page.items ? page : { ...page, items }
 }
 
+/** `sessionAgent` names the agent on a turn whose key does not, such as a command's. */
 export function projectTurnItemHistory(
   result: AgentSessionHistoryResult,
-  ctx: TurnItemReader
+  ctx: TurnItemReader,
+  sessionAgent: string | null = null
 ): AgentSessionHistoryResult {
   if (readsTurnItems(ctx)) {
     return result
   }
-  const page = projectPage(result.page)
+  const page = projectPage(result.page, sessionAgent)
   return page === result.page ? result : { ...result, page }
 }
 
 export function projectTurnItemEvent(
   event: AgentSessionSubscribeEvent,
-  ctx: TurnItemReader
+  ctx: TurnItemReader,
+  sessionAgent: string | null = null
 ): AgentSessionSubscribeEvent {
   if (readsTurnItems(ctx)) {
     return event
   }
   if (event.type === 'batch') {
-    const items = projectItems(event.batch.items)
+    const items = projectItems(event.batch.items, sessionAgent)
     return items === event.batch.items ? event : { ...event, batch: { ...event.batch, items } }
   }
   if (event.type === 'snapshot' || event.type === 'reset') {
-    const page = projectPage(event.page)
+    const page = projectPage(event.page, sessionAgent)
     return page === event.page ? event : { ...event, page }
   }
   return event
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-unsubscribe.test.ts b/src/main/runtime/rpc/methods/structured-agent-session-unsubscribe.test.ts
new file mode 100644
index 00000000000..a31a8bc8d18
--- /dev/null
+++ b/src/main/runtime/rpc/methods/structured-agent-session-unsubscribe.test.ts
@@ -0,0 +1,91 @@
+// A transcript stream ends when its client says so: the host drops that subscriber, so nothing is
+// derived or sent for it any more, and a sibling stream of the same session keeps going.
+
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY } from '../../../../shared/protocol-version'
+import { setStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
+import {
+  createRestTestRig,
+  foundRestTestChat,
+  REST_TEST_CALLER as CALLER,
+  REST_TEST_SESSION as SESSION,
+  restTestSend,
+  type RestTestRig
+} from '../../../native-chat/agent-session-wire/structured-agent-session-rest-test-rig'
+import { OrcaRuntimeService } from '../../orca-runtime'
+import type { RpcResponse } from '../core'
+import { RpcDispatcher } from '../dispatcher'
+import { STRUCTURED_AGENT_SESSION_METHODS } from './structured-agent-session'
+
+const CLIENT = {
+  clientId: 'device-1',
+  clientKind: 'runtime' as const,
+  clientCapabilities: [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY],
+  connectionId: 'connection-1'
+}
+
+let rig: RestTestRig
+let dispatcher: RpcDispatcher
+
+function subscriberCount(): number {
+  return rig.host.collaboratorsForTests().subscribers.subscriberCountForTests(SESSION)
+}
+
+async function stream(id: string, frames: RpcResponse[]): Promise<void> {
+  await dispatcher.dispatchStreaming(
+    { id, authToken: 'token', method: 'agentSession.subscribe', params: { sessionId: SESSION } },
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the dispatcher writes RpcResponse JSON.
+    (raw) => frames.push(JSON.parse(raw) as RpcResponse),
+    CLIENT
+  )
+}
+
+beforeEach(async () => {
+  rig = await createRestTestRig({ idleSweep: { intervalMs: 3_600_000 } })
+  setStructuredAgentSessionHost(rig.host)
+  const runtime = new OrcaRuntimeService()
+  vi.spyOn(runtime, 'getClientSettings').mockImplementation(
+    () =>
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the RPC gate reads only this one setting.
+      ({ experimentalStructuredNativeChat: true }) as ReturnType<
+        OrcaRuntimeService['getClientSettings']
+      >
+  )
+  dispatcher = new RpcDispatcher({ runtime, methods: STRUCTURED_AGENT_SESSION_METHODS })
+})
+
+afterEach(async () => {
+  setStructuredAgentSessionHost(null)
+  await rig.dispose()
+})
+
+it('drops the subscriber a client unsubscribes, and keeps its sibling (U-02)', async () => {
+  await foundRestTestChat(rig)
+  const ended: RpcResponse[] = []
+  const kept: RpcResponse[] = []
+  await stream('frame-a', ended)
+  await stream('frame-b', kept)
+  expect(subscriberCount()).toBe(2)
+
+  const replies: RpcResponse[] = []
+  await dispatcher.dispatchStreaming(
+    {
+      id: 'frame-c',
+      authToken: 'token',
+      method: 'agentSession.unsubscribe',
+      params: { sessionId: SESSION, subscriptionId: 'frame-a' }
+    },
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the dispatcher writes RpcResponse JSON.
+    (raw) => replies.push(JSON.parse(raw) as RpcResponse),
+    CLIENT
+  )
+  expect(replies[0]).toMatchObject({ ok: true })
+  expect(subscriberCount()).toBe(1)
+
+  const before = ended.length
+  const fence = rig.store.getRecord(SESSION)!.lease.runtimeFence
+  await rig.host.send(CALLER, restTestSend('after the unsubscribe', fence))
+  await vi.waitFor(() => expect(kept.length).toBeGreaterThan(1))
+  // The ended stream's own `end` frame is all it gets.
+  expect(ended.slice(before).every((frame) => JSON.stringify(frame).includes('"end"'))).toBe(true)
+})
diff --git a/src/main/runtime/rpc/methods/structured-agent-session.test.ts b/src/main/runtime/rpc/methods/structured-agent-session.test.ts
index 2d2760832ad..d9d430f08e3 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session.test.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session.test.ts
@@ -4,6 +4,8 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { setStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
 import {
+  AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
+  AGENT_SESSION_CONVERSATION_STOP_RUNTIME_CAPABILITY,
   AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY,
   RUNTIME_CAPABILITIES,
   RUNTIME_PROTOCOL_VERSION,
@@ -12,6 +14,7 @@ import {
   STRUCTURED_AGENT_SESSION_REVEAL_RUNTIME_CAPABILITY,
   STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
 } from '../../../../shared/protocol-version'
+import { STRUCTURED_AGENT_SESSION_START_WAIT_MS } from '../../../native-chat/agent-session-wire/structured-agent-session-send-settlement'
 import { computeAgentSessionPayloadFingerprint } from '../../../../shared/agent-session-mutation-envelope'
 import { ALL_RPC_METHODS } from './index'
 import { STRUCTURED_AGENT_SESSION_METHODS } from './structured-agent-session'
@@ -149,6 +152,10 @@ describe('capability gating', () => {
   it('advertises the capability without bumping the protocol version', () => {
     expect(RUNTIME_CAPABILITIES).toContain(STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY)
     expect(RUNTIME_CAPABILITIES).toContain(AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY)
+    // A client tells a host that accepts first, and admits a writer-free Stop before a turn, by it.
+    expect(RUNTIME_CAPABILITIES).toContain(AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY)
+    // And a cancel naming no turn, which a host that only accepts first still refuses as invalid.
+    expect(RUNTIME_CAPABILITIES).toContain(AGENT_SESSION_CONVERSATION_STOP_RUNTIME_CAPABILITY)
     expect(RUNTIME_CAPABILITIES).toContain(STRUCTURED_AGENT_SESSION_HOLD_RUNTIME_CAPABILITY)
     expect(RUNTIME_CAPABILITIES).toContain(STRUCTURED_AGENT_SESSION_REVEAL_RUNTIME_CAPABILITY)
     // Separate from the structured capability on purpose: a host can serve the rest of the
@@ -167,7 +174,7 @@ describe('capability gating', () => {
     }
     // Bump deliberately: the whole agentSession.* surface is behind the structured capability,
     // so an additive method is invisible to old clients and needs no protocol bump.
-    expect(STRUCTURED_AGENT_SESSION_METHODS).toHaveLength(29)
+    expect(STRUCTURED_AGENT_SESSION_METHODS).toHaveLength(32)
   })
 
   it('hides the surface from a declared client that did not advertise it', async () => {
@@ -252,11 +259,11 @@ describe('capability gating', () => {
       signal: controller.signal
     })
 
-    expect(hostCalls.waitForSendSettlement).toHaveBeenCalledWith(
-      SESSION,
-      'client-1',
-      controller.signal
-    )
+    expect(hostCalls.waitForSendSettlement).toHaveBeenCalledWith(SESSION, 'client-1', {
+      until: 'answered',
+      budgetMs: STRUCTURED_AGENT_SESSION_START_WAIT_MS,
+      signal: controller.signal
+    })
     expect(response).toMatchObject({
       ok: true,
       result: {
@@ -302,36 +309,6 @@ describe('capability gating', () => {
     })
   })
 
-  it('returns durable pending immediately to clients that understand admission', async () => {
-    hostCalls.send.mockResolvedValueOnce({
-      ok: true,
-      replayed: false,
-      fence: 1,
-      cursor: { epoch: 'epoch-a', sequence: 1 },
-      value: {
-        clientMessageId: 'client-1',
-        submission: {
-          clientMessageId: 'client-1',
-          fence: 1,
-          payloadFingerprint: 'fingerprint',
-          dispatchState: 'pending',
-          providerItemId: null,
-          reason: null,
-          submittedAt: 1,
-          resolvedAt: null
-        }
-      }
-    })
-
-    const response = await call('agentSession.send', sendParams(), STRUCTURED_CLIENT)
-
-    expect(hostCalls.waitForSendSettlement).not.toHaveBeenCalled()
-    expect(response).toMatchObject({
-      ok: true,
-      result: { value: { submission: { dispatchState: 'pending' } } }
-    })
-  })
-
   it('requires the host structured-chat setting for mobile clients', async () => {
     const response = await call('agentSession.send', sendParams(), STRUCTURED_MOBILE_CLIENT, {
       getClientSettings: () => ({ experimentalStructuredNativeChat: false })
@@ -363,7 +340,9 @@ describe('capability gating', () => {
         ok: false,
         error: { message: expect.stringContaining('structured_agent_session_unsupported') }
       })
-      expect(hostCalls[hostCall]).not.toHaveBeenCalled()
+      if (hostCall !== null) {
+        expect(hostCalls[hostCall]).not.toHaveBeenCalled()
+      }
     }
   )
 
@@ -783,41 +762,6 @@ describe('parameter validation', () => {
     })
   })
 
-  it('accepts the maximum fully encoded Claude choice group and retains a finite bound', async () => {
-    const maximumSelections = Array.from({ length: 4 }, (_, questionIndex) => ({
-      questionId: `q${questionIndex + 1}`,
-      optionIds: Array.from(
-        { length: 4 },
-        (_, optionIndex) => `q${questionIndex + 1}:choice-${optionIndex + 1}`
-      )
-    }))
-    const optionId = `question-group:${encodeURIComponent(JSON.stringify(maximumSelections))}`
-    expect(optionId.length).toBe(610)
-
-    const response = await call(
-      'agentSession.respondToQuestion',
-      {
-        envelope: envelope(),
-        itemId: 'item-1',
-        expectedRevision: 1,
-        optionId
-      },
-      STRUCTURED_CLIENT
-    )
-    expect(response).toMatchObject({ ok: true })
-    expect(hostCalls.respondToPrompt).toHaveBeenCalledWith(
-      expect.anything(),
-      expect.objectContaining({ optionId })
-    )
-
-    await rejects('agentSession.respondToQuestion', {
-      envelope: envelope(),
-      itemId: 'item-1',
-      expectedRevision: 1,
-      optionId: 'x'.repeat(1025)
-    })
-  })
-
   it('bounds a history page and validates its cursor', async () => {
     await rejects('agentSession.history', {
       sessionId: SESSION,
diff --git a/src/main/runtime/rpc/methods/structured-agent-session.ts b/src/main/runtime/rpc/methods/structured-agent-session.ts
index 66d44d4b782..534d4967779 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session.ts
@@ -5,6 +5,7 @@
 // not exist rather than receiving the journal or mutation surface. Session-tab
 // inventory may expose only a metadata placeholder for an incapable mobile client.
 
+import { agentSessionRefusalError } from '../../../../shared/agent-session-wire-refusals'
 import { agentSessionFingerprintConflict } from '../../../../shared/agent-session-mutation-envelope'
 import type { z } from 'zod'
 import {
@@ -18,6 +19,7 @@ import {
 import { defineMethod, defineStreamingMethod, type RpcContext } from '../core'
 import {
   ensureStructuredHostInstalled as ensureHostInstalled,
+  requireInstalledStructuredHost as requireInstalledHost,
   requireStructuredCapability,
   requireStructuredCleanupHost,
   requireStructuredHost as requireHost,
@@ -32,6 +34,7 @@ import {
 } from './structured-agent-session-create'
 import { STRUCTURED_AGENT_SESSION_HOLD_METHODS } from './structured-agent-session-hold'
 import { STRUCTURED_AGENT_SESSION_REVEAL_METHODS } from './structured-agent-session-reveal'
+import { STRUCTURED_AGENT_SESSION_QUEUED_METHODS } from './structured-agent-session-queued-methods'
 import { STRUCTURED_AGENT_SESSION_RESTART_RESUME_METHODS } from './structured-agent-session-restart-resume'
 import { resolveUncommittedStructuredCreate } from './structured-agent-session-precommit-refusal'
 import {
@@ -56,6 +59,7 @@ import {
   HandoffStatusParams,
   OptionsParams,
   RespondParams,
+  RespondToQuestionParams,
   RewindParams,
   SendParams,
   SetOptionParams,
@@ -74,7 +78,9 @@ async function resolveClientSuppliedAttach(params: z.infer<typeof AttachParams>,
   await ensureHostInstalled(ctx)
   const host = requireHost(ctx)
   if (!host.supportsCreate(params.location, params.agent)) {
-    throw new Error('structured_agent_session_unsupported')
+    throw agentSessionRefusalError('structured_agent_session_unsupported', {
+      reason: 'hostUnsupported'
+    })
   }
   const { agent: _attachAgent, provider: _attachProvider, ...attachWithoutAgent } = params
   const attachParams = {
@@ -129,7 +135,9 @@ export const STRUCTURED_AGENT_SESSION_METHODS = [
     params: CreateSupportParams,
     handler: async (params, ctx) => {
       if (!supportsStructuredSessions(ctx)) {
-        throw new Error('structured_agent_session_unsupported')
+        throw agentSessionRefusalError('structured_agent_session_unsupported', {
+          reason: 'clientCapabilityMissing'
+        })
       }
       return ctx.runtime.getStructuredAgentSessionCreateSupport(params.worktree, params.agent)
     }
@@ -140,7 +148,9 @@ export const STRUCTURED_AGENT_SESSION_METHODS = [
     handler: async (params, ctx) => {
       requireStructuredCapability(ctx)
       if (params.envelope.expectedRuntimeFence !== null) {
-        throw new Error('agent_session_operation_invalid')
+        throw agentSessionRefusalError('agent_session_operation_invalid', {
+          reason: 'requestMalformed'
+        })
       }
       // Everything up to `attach` is pre-commit, and answers with a refusal rather than a throw so
       // a client can tell "nothing was created" from "the outcome is unknown".
@@ -197,6 +207,7 @@ export const STRUCTURED_AGENT_SESSION_METHODS = [
     params: CancelParams,
     handler: async (params, ctx) => requireStructuredCleanupHost(ctx).cancel(callerFor(ctx), params)
   }),
+  ...STRUCTURED_AGENT_SESSION_QUEUED_METHODS,
   defineMethod({
     // Releasing a chat view, not ending a conversation: the record and journal stay on disk so the
     // same session can be attached again. Only the provider child and the in-memory entry go.
@@ -222,7 +233,7 @@ export const STRUCTURED_AGENT_SESSION_METHODS = [
   }),
   defineMethod({
     name: 'agentSession.respondToQuestion',
-    params: RespondParams,
+    params: RespondToQuestionParams,
     handler: async (params, ctx) =>
       requireHost(ctx).respondToPrompt(callerFor(ctx), { ...params, kind: 'question' })
   }),
@@ -234,60 +245,55 @@ export const STRUCTURED_AGENT_SESSION_METHODS = [
   defineMethod({
     name: 'agentSession.handoffStatus',
     params: HandoffStatusParams,
-    handler: async (params, ctx) => requireHost(ctx).handoffStatus(params.sessionId)
+    handler: async (params, ctx) =>
+      (await requireInstalledHost(ctx)).handoffStatus(params.sessionId)
   }),
   defineMethod({
     name: 'agentSession.commands',
     params: OptionsParams,
-    handler: async (params, ctx) => requireHost(ctx).readCommands(params.sessionId)
+    handler: async (params, ctx) => (await requireInstalledHost(ctx)).readCommands(params.sessionId)
   }),
   defineMethod({
     name: 'agentSession.history',
     params: HistoryParams,
-    handler: async (params, ctx) =>
-      projectTurnItemHistory(
-        projectBackgroundTaskHistory(requireHost(ctx).history(params), ctx),
-        ctx
+    handler: async (params, ctx) => {
+      const host = await requireInstalledHost(ctx)
+      return projectTurnItemHistory(
+        projectBackgroundTaskHistory(await host.history(params), ctx),
+        ctx,
+        host.sessionAgent(params.sessionId)
       )
+    }
   }),
   defineStreamingMethod({
     name: 'agentSession.subscribe',
     params: SubscribeParams,
     handler: async (params, ctx, emit) => {
-      const host = requireHost(ctx)
+      const host = await requireInstalledHost(ctx)
       const subscriptionId = subscriptionIdFor(ctx, params.sessionId)
-      // A live stream is a surface too: it keeps a session from being evicted while it is read and
-      // releases that retention when the transport dies without a word.
-      //
-      // Retain-only: reading history must never be what starts a provider process. Current clients
-      // explicitly hold every open surface before subscribing.
-      const streamHolder = `subscription:${subscriptionId}`
+      // A stream reads; it never keeps an agent alive or starts one.
       let dispose = (): void => {}
-      const stream = bindStructuredAgentSessionStream(ctx, subscriptionId, () => {
-        dispose()
-        host.release(params.sessionId, streamHolder)
-      })
+      const stream = bindStructuredAgentSessionStream(ctx, subscriptionId, () => dispose())
       if (stream.isClosed()) {
         return
       }
-      // The host emits the opening snapshot (or the missed batch) synchronously
-      // inside open(), so nothing between here and there can interleave.
-      dispose = host.subscribe({
+      // Resolves once the conversation is open and the opening snapshot (or the missed batch) is
+      // emitted; a close that raced the open disposes what it bound.
+      dispose = await host.subscribe({
         id: subscriptionId,
         sessionId: params.sessionId,
-        emit: (event) => emit(projectTurnItemEvent(projectBackgroundTaskEvent(event, ctx), ctx)),
+        emit: (event) =>
+          emit(
+            projectTurnItemEvent(
+              projectBackgroundTaskEvent(event, ctx),
+              ctx,
+              host.sessionAgent(params.sessionId)
+            )
+          ),
         ...(params.cursor ? { cursor: params.cursor } : {})
       })
       if (stream.isClosed()) {
         dispose()
-      } else {
-        // Fire-and-forget, but never unhandled: a resume that refuses leaves the stream holding a
-        // readable session, which is exactly what the client sees anyway.
-        void host
-          .hold(params.sessionId, streamHolder, { resume: false })
-          .catch((error: unknown) =>
-            console.warn('[agent-session] stream hold failed', params.sessionId, error)
-          )
       }
     }
   }),
diff --git a/src/main/runtime/rpc/methods/structured-chat-tab-table.test.ts b/src/main/runtime/rpc/methods/structured-chat-tab-table.test.ts
new file mode 100644
index 00000000000..f76b3ae6cb7
--- /dev/null
+++ b/src/main/runtime/rpc/methods/structured-chat-tab-table.test.ts
@@ -0,0 +1,409 @@
+/**
+ * A chat tab's pointer to the conversation it shows, driven end to end: a real record store on disk,
+ * the real structured host, the real runtime, and the real RPC handlers. Only the provider is faked.
+ */
+
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../../shared/agent-session-mutation-envelope'
+import {
+  CLAUDE_STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
+  STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
+} from '../../../../shared/protocol-version'
+import type { StructuredAgentSessionAdapter } from '../../../native-chat/agent-session-wire/structured-agent-session-adapter'
+import { StructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-host'
+import {
+  HOST_TEST_LOCATION,
+  HOST_TEST_NOW,
+  HOST_TEST_SESSION,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from '../../../native-chat/agent-session-wire/structured-agent-session-host-test-data'
+import { setStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
+import { AgentSessionRecordStore } from '../../agent-session-record-store'
+import { agentSessionStorePath } from '../../agent-session-record-store-file'
+import { OrcaRuntimeService } from '../../orca-runtime'
+import { RpcDispatcher } from '../dispatcher'
+import type { RpcDispatchStreamingOptions } from '../dispatcher-stream-options'
+import { SESSION_TAB_METHODS } from './session-tabs'
+import { STRUCTURED_AGENT_SESSION_METHODS } from './structured-agent-session'
+import { commitStructuredAgentSessionCreate } from './structured-agent-session-create'
+import { closeStructuredAgentSessionChild } from '../../structured-agent-session-close'
+
+const WORKTREE = `id:${HOST_TEST_LOCATION.workspaceId}`
+const SOURCE_TAB = `structured-agent-session-${HOST_TEST_SESSION}`
+const caller = { callerKey: 'trusted-local:runtime' }
+
+let directory: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let runtime: OrcaRuntimeService
+let dispatcher: RpcDispatcher
+let acquisitions = 0
+let acquireFails = false
+let closeSession: ReturnType<typeof vi.fn<() => Promise<boolean>>>
+
+function providerAdapter(): StructuredAgentSessionAdapter {
+  return {
+    supportsLocation: (location) =>
+      location.executionHostId === 'local' && location.wslDistro === null,
+    acquire: vi.fn(async (input) => {
+      if (acquireFails) {
+        throw new Error('provider failed to start')
+      }
+      acquisitions++
+      return {
+        process: {
+          hostId: 'local',
+          pid: 4000 + acquisitions,
+          processStartTimeMs: HOST_TEST_NOW,
+          spawnToken: input.spawnToken
+        },
+        link: {
+          linkId: `link-${acquisitions}`,
+          mintedAtFence: input.fence,
+          observedAt: HOST_TEST_NOW,
+          origin: 'created' as const,
+          handle: {
+            provider: 'codex' as const,
+            threadId: `00000000-0000-4000-8000-${String(acquisitions).padStart(12, '0')}`
+          }
+        }
+      }
+    }),
+    dispatch: vi.fn(async () => ({ state: 'admitted' as const })),
+    cancelTurn: vi.fn(async () => ({ cancelled: true })),
+    answerPrompt: async () => {},
+    setOption: async () => {},
+    releaseAcquisition: async () => true,
+    closeSession,
+    readOptions: async () => ({ models: [], current: { model: 'test-model', effort: 'high' } })
+  }
+}
+
+async function openHost(): Promise<void> {
+  store = await AgentSessionRecordStore.open({
+    directory: join(directory, 'store'),
+    hostId: 'local'
+  })
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: providerAdapter(),
+    journalRoot: directory,
+    claimKeyId: 'key',
+    now: () => HOST_TEST_NOW,
+    mintSpawnToken: () => `spawn-${acquisitions}`
+  })
+  setStructuredAgentSessionHost(host)
+}
+
+type CallResponse = {
+  ok: boolean
+  result?: { ok?: boolean; value?: { replacementSessionId?: string } }
+}
+
+async function call(
+  method: string,
+  params: unknown,
+  context: RpcDispatchStreamingOptions = {}
+): Promise<CallResponse> {
+  const response = await dispatcher.dispatch(
+    { id: 'request', authToken: 'token', method, params },
+    context
+  )
+  return JSON.parse(JSON.stringify(response))
+}
+
+async function createChat(sessionId: string, tabId?: string) {
+  return commitStructuredAgentSessionCreate({
+    runtime,
+    caller,
+    activate: true,
+    prepared: {
+      host,
+      attachParams: hostTestAttachParams(null, {
+        envelope: {
+          sessionId,
+          clientOperationId: hostTestOperationId(),
+          expectedRuntimeFence: null,
+          payloadFingerprint: ''
+        },
+        ...(tabId ? { surfaceTabId: tabId } : {})
+      }),
+      tab: { workspaceId: HOST_TEST_LOCATION.workspaceId, agent: 'codex' }
+    }
+  })
+}
+
+function envelopeFor(method: string, sessionId: string, fields: Record<string, unknown>) {
+  return {
+    sessionId,
+    clientOperationId: hostTestOperationId(),
+    expectedRuntimeFence: store.getRecord(sessionId)!.lease.runtimeFence,
+    payloadFingerprint: computeAgentSessionPayloadFingerprint({ method, sessionId, fields })
+  }
+}
+
+async function clear(sessionId: string): Promise<string> {
+  const response = await call('agentSession.conversationCommand', {
+    command: 'clear',
+    envelope: envelopeFor('agentSession.conversationCommand', sessionId, { command: 'clear' })
+  })
+  expect(response).toMatchObject({ ok: true, result: { ok: true } })
+  const replacement = response.result?.value?.replacementSessionId
+  expect(replacement).toBeDefined()
+  return replacement!
+}
+
+async function send(sessionId: string, text: string) {
+  const body = hostTestMessage(text)
+  return call('agentSession.send', {
+    body,
+    envelope: envelopeFor('agentSession.send', sessionId, { body })
+  })
+}
+
+async function snapshot() {
+  return runtime.listMobileSessionTabs(WORKTREE)
+}
+
+beforeEach(async () => {
+  resetHostTestOperationIds()
+  acquisitions = 0
+  acquireFails = false
+  closeSession = vi.fn(async () => true)
+  directory = await mkdtemp(join(tmpdir(), 'orca-chat-tab-table-'))
+  runtime = new OrcaRuntimeService()
+  vi.spyOn(runtime, 'getClientSettings').mockReturnValue(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the structured-chat policy reads only this one setting on these paths.
+    { experimentalStructuredNativeChat: true } as ReturnType<
+      OrcaRuntimeService['getClientSettings']
+    >
+  )
+  dispatcher = new RpcDispatcher({
+    runtime,
+    methods: [...STRUCTURED_AGENT_SESSION_METHODS, ...SESSION_TAB_METHODS]
+  })
+  await openHost()
+})
+
+afterEach(async () => {
+  await host?.flushAllStreamedEvents()
+  setStructuredAgentSessionHost(null)
+  await rm(directory, { recursive: true, force: true })
+})
+
+describe('a chat tab across /clear', () => {
+  it('keeps sending through a second and third /clear, the tab following each replacement', async () => {
+    expect(await createChat(HOST_TEST_SESSION)).toMatchObject({ ok: true })
+    expect(store.getSessionTabId(HOST_TEST_SESSION)).toBe(SOURCE_TAB)
+    let current = HOST_TEST_SESSION
+    // A pending send blocks /clear by design, so the clears run back to back and the chat sends after.
+    for (let round = 0; round < 3; round++) {
+      const replacement = await clear(current)
+      expect(store.getSessionTabId(replacement)).toBe(SOURCE_TAB)
+      expect(store.getSessionTabId(current)).toBeNull()
+      current = replacement
+    }
+    expect(await send(current, 'after three clears')).toMatchObject({
+      ok: true,
+      result: { ok: true }
+    })
+    const tabs = (await snapshot()).tabs
+    expect(tabs).toHaveLength(1)
+    expect(tabs[0]).toMatchObject({ type: 'agent-session', sessionId: current })
+    expect(store.listVisibleSessionIds()).toEqual([current])
+  })
+
+  it('reveals a cleared conversation in its own tab without activating the current chat', async () => {
+    await createChat(HOST_TEST_SESSION)
+    const replacement = await clear(HOST_TEST_SESSION)
+
+    expect(await call('agentSession.reveal', { sessionId: HOST_TEST_SESSION })).toMatchObject({
+      ok: true
+    })
+
+    const revealedTabId = store.getSessionTabId(HOST_TEST_SESSION)
+    expect(revealedTabId).not.toBeNull()
+    expect(revealedTabId).not.toBe(SOURCE_TAB)
+    expect(revealedTabId).not.toContain(':')
+    expect(store.getSessionTabId(replacement)).toBe(SOURCE_TAB)
+    const published = await snapshot()
+    expect(published.tabs.map((tab) => tab.id)).toEqual([
+      `agent-session:${replacement}`,
+      `agent-session:${HOST_TEST_SESSION}`
+    ])
+    expect(published.activeTabId).toBe(`agent-session:${HOST_TEST_SESSION}`)
+  })
+
+  it('closes the cleared conversation and leaves the current chat and its tab', async () => {
+    await createChat(HOST_TEST_SESSION)
+    const replacement = await clear(HOST_TEST_SESSION)
+    await call('agentSession.reveal', { sessionId: HOST_TEST_SESSION })
+
+    expect(
+      await call('session.tabs.close', {
+        worktree: WORKTREE,
+        tabId: `agent-session:${HOST_TEST_SESSION}`,
+        reason: 'user'
+      })
+    ).toMatchObject({ ok: true })
+
+    expect(store.getSessionTabId(HOST_TEST_SESSION)).toBeNull()
+    expect(store.getSessionTabId(replacement)).toBe(SOURCE_TAB)
+    expect((await snapshot()).tabs.map((tab) => tab.id)).toEqual([`agent-session:${replacement}`])
+    expect(await send(replacement, 'still here')).toMatchObject({ ok: true, result: { ok: true } })
+  })
+
+  it('puts a cleared chat back under the tab id it had when its close does not land', async () => {
+    await createChat(HOST_TEST_SESSION)
+    const replacement = await clear(HOST_TEST_SESSION)
+    closeSession.mockResolvedValue(false)
+
+    const outcome = await closeStructuredAgentSessionChild(replacement)
+    expect(outcome).toMatchObject({ stopped: false })
+    expect(store.getSessionTabId(replacement)).toBe(SOURCE_TAB)
+    closeSession.mockResolvedValue(true)
+  })
+
+  it('keeps the tab id and its pointer across a restart', async () => {
+    await createChat(HOST_TEST_SESSION)
+    const replacement = await clear(await clear(HOST_TEST_SESSION))
+    await host.flushAllStreamedEvents()
+
+    await openHost()
+    expect(store.getSessionTabId(replacement)).toBe(SOURCE_TAB)
+    expect(host.getPersistedVisibleSessionTabIndex()).toEqual({
+      present: true,
+      sessionIds: [replacement]
+    })
+  })
+
+  it('gives a reopened cleared conversation the same id when an older build drops the table', async () => {
+    await createChat(HOST_TEST_SESSION)
+    const first = await clear(HOST_TEST_SESSION)
+    await call('agentSession.reveal', { sessionId: HOST_TEST_SESSION })
+    const current = await clear(first)
+    const reopenedTab = store.getSessionTabId(HOST_TEST_SESSION)
+    expect(reopenedTab).not.toBeNull()
+    await host.flushAllStreamedEvents()
+
+    // An older build rewrites the file from what it read, which drops the table.
+    const file = agentSessionStorePath(join(directory, 'store'))
+    const raw = JSON.parse(await readFile(file, 'utf-8'))
+    expect(raw.sessionTabs).toHaveLength(2)
+    delete raw.sessionTabs
+    await writeFile(file, JSON.stringify(raw))
+
+    await openHost()
+    expect(store.getSessionTabId(current)).toBe(SOURCE_TAB)
+    expect(store.getSessionTabId(HOST_TEST_SESSION)).toBe(reopenedTab)
+  })
+})
+
+describe('session tab mutations from other clients, unchanged by the table', () => {
+  it('reorders a group holding a chat for a paired client', async () => {
+    await createChat(HOST_TEST_SESSION)
+    await createChat('session-bravo')
+    const ids = (await snapshot()).tabs.map((tab) => tab.id)
+    const group = (await snapshot()).tabGroups![0]!
+
+    expect(
+      await call(
+        'session.tabs.move',
+        {
+          worktree: WORKTREE,
+          tabId: ids[1],
+          targetGroupId: group.id,
+          kind: 'reorder',
+          tabOrder: ids.toReversed()
+        },
+        {
+          clientKind: 'runtime',
+          clientCapabilities: [
+            STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
+            CLAUDE_STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
+          ]
+        }
+      )
+    ).toMatchObject({ ok: true })
+    expect((await snapshot()).tabGroups![0]!.tabOrder).toEqual(ids.toReversed())
+  })
+
+  it('refuses an old mobile client closing a chat it may only view', async () => {
+    await createChat(HOST_TEST_SESSION)
+
+    const response = await call(
+      'session.tabs.close',
+      { worktree: WORKTREE, tabId: `agent-session:${HOST_TEST_SESSION}`, reason: 'user' },
+      { clientKind: 'mobile', clientCapabilities: [] }
+    )
+
+    expect(response.ok).toBe(false)
+    expect(store.getSessionTabId(HOST_TEST_SESSION)).toBe(SOURCE_TAB)
+    expect((await snapshot()).tabs).toHaveLength(1)
+  })
+})
+
+describe('a create that reserves its tab', () => {
+  it('answers with the reserved id and refuses a second chat under it', async () => {
+    expect(await createChat(HOST_TEST_SESSION, 'reserved-tab')).toMatchObject({
+      ok: true,
+      value: { tabId: 'reserved-tab' }
+    })
+    expect(await createChat('session-bravo', 'reserved-tab')).toMatchObject({
+      ok: false,
+      refusal: { code: 'agent_session_conflict' }
+    })
+    expect(store.getSessionTabId(HOST_TEST_SESSION)).toBe('reserved-tab')
+    expect(store.getRecord('session-bravo')).toBeNull()
+  })
+
+  it('answers a create that reserved nothing with the id its tab was given', async () => {
+    expect(await createChat(HOST_TEST_SESSION)).toMatchObject({
+      ok: true,
+      value: { tabId: SOURCE_TAB }
+    })
+  })
+
+  it('restores no tab for a reserved create that stopped before its tab was published', async () => {
+    const attached = await host.attach(
+      caller,
+      hostTestAttachParams(null, {
+        envelope: {
+          sessionId: HOST_TEST_SESSION,
+          clientOperationId: hostTestOperationId(),
+          expectedRuntimeFence: null,
+          payloadFingerprint: ''
+        },
+        surfaceTabId: 'reserved-tab'
+      })
+    )
+    expect(attached).toMatchObject({ ok: true })
+    await host.flushAllStreamedEvents()
+
+    await openHost()
+    expect(host.getPersistedVisibleSessionTabIndex().sessionIds).toEqual([])
+    expect(await createChat('session-bravo', 'reserved-tab')).toMatchObject({
+      ok: true,
+      value: { tabId: 'reserved-tab' }
+    })
+  })
+
+  it('leaves no tab behind when the create fails, so nothing is restored and the id is free', async () => {
+    acquireFails = true
+    expect(await createChat(HOST_TEST_SESSION, 'reserved-tab')).toMatchObject({ ok: false })
+    expect(store.getSessionTabId(HOST_TEST_SESSION)).toBeNull()
+    expect(store.listVisibleSessionIds()).toEqual([])
+
+    acquireFails = false
+    expect(await createChat('session-bravo', 'reserved-tab')).toMatchObject({
+      ok: true,
+      value: { tabId: 'reserved-tab' }
+    })
+  })
+})
diff --git a/src/main/runtime/rpc/methods/structured-session-tab-restore.ts b/src/main/runtime/rpc/methods/structured-session-tab-restore.ts
index f9efa46d16d..6ec96241422 100644
--- a/src/main/runtime/rpc/methods/structured-session-tab-restore.ts
+++ b/src/main/runtime/rpc/methods/structured-session-tab-restore.ts
@@ -11,14 +11,16 @@ import {
  *  project after a desktop restart — no chat and no prompt. The setting still gates it, because
  *  with structured chat off there is nothing for any mobile client to reach. Restoring spawns no
  *  provider child for a cleanly closed session. */
-export async function restoreStructuredTabsIfSupported(
+export function restoreStructuredTabsIfSupported(
   context: Pick<RpcContext, 'runtime' | 'clientKind' | 'clientCapabilities'>
-): Promise<void> {
+): Promise<void> | undefined {
   const shouldRestore =
     context.clientKind === 'mobile'
       ? isStructuredNativeChatEnabled(context.runtime)
       : supportsStructuredAgentSessions(context)
   if (shouldRestore && typeof context.runtime.restoreStructuredAgentSessionTabs === 'function') {
-    await context.runtime.restoreStructuredAgentSessionTabs()
+    return context.runtime.restoreStructuredAgentSessionTabs()
   }
+  // Nothing to restore: callers skip the await, so a stream's setup keeps its timing.
+  return undefined
 }
diff --git a/src/main/runtime/rpc/methods/structured-worker-read-cursor.test.ts b/src/main/runtime/rpc/methods/structured-worker-read-cursor.test.ts
index 1a97223bc39..b376f2c80d9 100644
--- a/src/main/runtime/rpc/methods/structured-worker-read-cursor.test.ts
+++ b/src/main/runtime/rpc/methods/structured-worker-read-cursor.test.ts
@@ -79,7 +79,7 @@ function read(cursor?: string, limit?: number) {
   })
 }
 
-function textsOf(result: ReturnType<typeof read>): string[] {
+function textsOf(result: Awaited<ReturnType<typeof read>>): string[] {
   return result.transcript.messages.map((entry) =>
     entry.blocks.map((block) => ('text' in block ? block.text : '')).join('')
   )
@@ -90,57 +90,57 @@ describe('the structured worker-read cursor over a mutating journal', () => {
     hostRef.current = null
   })
 
-  it('refuses to resume when an already-delivered item was revised in place', () => {
+  it('refuses to resume when an already-delivered item was revised in place', async () => {
     // The `"hel"` / `"hello"` defect. The caller is handed a coalesced snapshot, resumes past it,
     // and the item is later revised at its original sequence — under the old anchor the resume was
     // accepted and that revision was never delivered to anyone.
     installJournal([message('i1', 'hel'), message('i2', 'second')])
-    const first = read(undefined, 1)
+    const first = await read(undefined, 1)
     expect(textsOf(first)).toEqual(['hel'])
 
     installJournal([message('i1', 'hello world', 2), message('i2', 'second')])
-    expect(() => read(first.cursor)).toThrow(/source changed/i)
+    await expect(read(first.cursor)).rejects.toThrow(/source changed/i)
   })
 
-  it('refuses to resume when a resolved prompt inserts ahead of the caller position', () => {
+  it('refuses to resume when a resolved prompt inserts ahead of the caller position', async () => {
     // Duplication. A pending approval projects to null, so resolving it inserts a message in the
     // MIDDLE; the oldest item never moved, so the old anchor accepted a now-stale index and the
     // caller re-read content it already had.
     installJournal([message('i1', 'first'), approval('i2', false), message('i3', 'second')])
-    const first = read(undefined, 2)
+    const first = await read(undefined, 2)
     expect(textsOf(first)).toEqual(['first', 'second'])
 
     installJournal([message('i1', 'first'), approval('i2', true, 2), message('i3', 'second')])
-    expect(() => read(first.cursor)).toThrow(/source changed/i)
+    await expect(read(first.cursor)).rejects.toThrow(/source changed/i)
   })
 
-  it('still resumes across a page boundary when only unread tail items change', () => {
+  it('still resumes across a page boundary when only unread tail items change', async () => {
     // The reason this is prefix-scoped and not whole-page: during an active turn the coalescer
     // revises the streaming item every 60ms. Fingerprinting the whole page would invalidate the
     // cursor continuously — a useless verb — while the worker is working.
     installJournal([message('i1', 'first'), message('i2', 'streaming')])
-    const first = read(undefined, 1)
+    const first = await read(undefined, 1)
     expect(textsOf(first)).toEqual(['first'])
 
     installJournal([message('i1', 'first'), message('i2', 'streaming more', 7)])
-    const second = read(first.cursor)
+    const second = await read(first.cursor)
     expect(textsOf(second)).toEqual(['streaming more'])
   })
 
-  it('delivers every message exactly once when nothing below the cursor changes', () => {
+  it('delivers every message exactly once when nothing below the cursor changes', async () => {
     // The property the two refusals above protect: no omission, no duplication.
     installJournal([message('i1', 'a'), message('i2', 'b'), message('i3', 'c')])
-    const first = read(undefined, 2)
-    const second = read(first.cursor, 2)
+    const first = await read(undefined, 2)
+    const second = await read(first.cursor, 2)
     expect([...textsOf(first), ...textsOf(second)]).toEqual(['a', 'b', 'c'])
   })
 
-  it('still refuses when the window slides off the front', () => {
+  it('still refuses when the window slides off the front', async () => {
     // The case the old anchor DID catch, and which the prefix scoping must not lose: a slide
     // shifts every index.
     installJournal([message('i1', 'a'), message('i2', 'b')])
-    const first = read(undefined, 1)
+    const first = await read(undefined, 1)
     installJournal([message('i2', 'b'), message('i3', 'c')])
-    expect(() => read(first.cursor)).toThrow(/source changed/i)
+    await expect(read(first.cursor)).rejects.toThrow(/source changed/i)
   })
 })
diff --git a/src/main/runtime/rpc/methods/terminal-manifest-characterization.test.ts b/src/main/runtime/rpc/methods/terminal-manifest-characterization.test.ts
index e26788d5d46..59370934057 100644
--- a/src/main/runtime/rpc/methods/terminal-manifest-characterization.test.ts
+++ b/src/main/runtime/rpc/methods/terminal-manifest-characterization.test.ts
@@ -21,6 +21,7 @@ const METHOD_CASES: readonly (readonly [string, unknown, boolean])[] = [
   ['terminal.agentStatus', { terminal: 'term' }, false],
   ['terminal.rename', { terminal: 'term', title: null }, false],
   ['terminal.clearBuffer', { terminal: 'term' }, false],
+  ['terminal.resetInputModes', { terminal: 'term' }, false],
   ['terminal.send', { terminal: 'term', text: 'x' }, false],
   ['terminal.wait', { terminal: 'term', for: 'exit' }, false],
   ['terminal.create', {}, false],
@@ -67,11 +68,11 @@ async function invoke(name: string, params: unknown, runtime: Partial<OrcaRuntim
 
 describe('terminal RPC manifest characterization', () => {
   it('preserves all method names, order, streaming flags, and parseable minimum inputs', () => {
-    expect(TERMINAL_METHODS).toHaveLength(35)
+    expect(TERMINAL_METHODS).toHaveLength(36)
     expect(TERMINAL_METHODS.map((method) => [method.name, 'stream' in method])).toEqual(
       METHOD_CASES.map(([name, _params, stream]) => [name, stream])
     )
-    expect(new Set(TERMINAL_METHODS.map((method) => method.name)).size).toBe(35)
+    expect(new Set(TERMINAL_METHODS.map((method) => method.name)).size).toBe(36)
     for (const [name, params] of METHOD_CASES) {
       expect(() => schemaFor(name).parse(params), name).not.toThrow()
     }
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-input-delivery.ts b/src/main/runtime/rpc/methods/terminal/terminal-input-delivery.ts
index 7313eb82b94..59fd827f0ce 100644
--- a/src/main/runtime/rpc/methods/terminal/terminal-input-delivery.ts
+++ b/src/main/runtime/rpc/methods/terminal/terminal-input-delivery.ts
@@ -1,9 +1,5 @@
 import { InvalidArgumentError } from '../../core'
-import type {
-  DriverState,
-  OrcaRuntimeService,
-  SubscriptionRegistration
-} from '../../../orca-runtime'
+import type { DriverState, OrcaRuntimeService } from '../../../orca-runtime'
 import {
   TERMINAL_INPUT_MAX_BYTES,
   TERMINAL_INPUT_TOO_LARGE_ERROR,
@@ -51,45 +47,6 @@ export function resolveMobileFloorClientId(
 
 export type TerminalStreamInputOutcome = 'delivered' | 'rejected' | 'failed'
 
-export function watchSubscriptionLifetime(
-  runtime: OrcaRuntimeService,
-  ptyId: string,
-  signal: AbortSignal | undefined,
-  registration: SubscriptionRegistration
-): () => void {
-  let unsubscribeExit: (() => void) | null = null
-  let removeAbort: (() => void) | null = null
-  let stopped = false
-  const stop = (): void => {
-    stopped = true
-    unsubscribeExit?.()
-    removeAbort?.()
-  }
-  const release = (): void => {
-    registration.releaseIfCurrent()
-    stop()
-  }
-  unsubscribeExit = runtime.subscribeToPtyExit(ptyId, release)
-  if (stopped) {
-    unsubscribeExit()
-    return stop
-  }
-  if (!signal) {
-    return stop
-  }
-  if (signal.aborted) {
-    release()
-    return stop
-  }
-  const onAbort = (): void => release()
-  removeAbort = () => signal.removeEventListener('abort', onAbort)
-  signal.addEventListener('abort', onAbort, { once: true })
-  if (stopped) {
-    removeAbort()
-  }
-  return stop
-}
-
 export function isTerminalStreamInputRejection(error: unknown): boolean {
   const message = error instanceof Error ? error.message : String(error)
   return message.includes('terminal_not_writable') || message.includes('terminal_handle_stale')
@@ -109,10 +66,11 @@ export async function sendTerminalStreamInput(
   const floorClaim: MobileInputFloorClaimHolder = { current: null }
   try {
     if (!clientId) {
-      const result = await runtime.sendTerminal(args.terminal, action)
+      const result = await runtime.sendTerminal(args.terminal, action, { inputKind: 'driving' })
       return result.accepted ? 'delivered' : 'rejected'
     }
     const result = await runtime.sendTerminal(args.terminal, action, {
+      inputKind: 'driving',
       reserveWrite: (writePtyId) => {
         const claim = runtime.beginMobileInputFloor(writePtyId, clientId)
         if (!claim) {
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-legacy-simple-subscriptions.ts b/src/main/runtime/rpc/methods/terminal/terminal-legacy-simple-subscriptions.ts
index ad4c7dd05da..a9bcf1af695 100644
--- a/src/main/runtime/rpc/methods/terminal/terminal-legacy-simple-subscriptions.ts
+++ b/src/main/runtime/rpc/methods/terminal/terminal-legacy-simple-subscriptions.ts
@@ -3,182 +3,115 @@ import type { TerminalOutputBatcher } from './terminal-output-batcher'
 import { isTerminalReadPayloadIncomplete } from './terminal-stream-replay'
 import { serializeBudgetedMobileSnapshot } from './terminal-snapshot-publication'
 import { updateViewportForClient } from './terminal-viewport-update'
-import { watchSubscriptionLifetime } from './terminal-input-delivery'
 import type { TerminalSubscriptionArgs } from './terminal-legacy-subscription-types'
 import { allocateTerminalSubscriptionStreamId } from './terminal-subscription-stream-id'
 
 export async function runTerminalLeaseSubscription(args: TerminalSubscriptionArgs): Promise<void> {
-  const { params, runtime, connectionId, signal, emit, ptyId, clientId } = args
+  const { registration, emit, ptyId, clientId } = args
   if (!clientId) {
     return
   }
-  let closed = false
-  let stopWatchingLifetime = (): void => {}
   let resolveStream = (): void => {}
   const streamClosed = new Promise<void>((resolve) => {
     resolveStream = resolve
   })
-  const subscriptionId = `${params.terminal}:${clientId}`
+  registration.setTeardown(resolveStream)
   // Why: chat needs the input-floor ack without registering a view subscriber or transporting duplicate PTY output.
-  const registration = runtime.registerOwnedSubscriptionCleanup(
-    subscriptionId,
-    () => {
-      stopWatchingLifetime()
-      closed = true
-      runtime.handleMobileUnsubscribe(ptyId, clientId)
-      emit({ type: 'end' })
-      resolveStream()
-    },
-    connectionId
-  )
-  stopWatchingLifetime = watchSubscriptionLifetime(runtime, ptyId, signal, registration)
-  if (closed) {
-    // Why: an already-exited pty releases synchronously, so cleanup ran before this setup registers anything.
+  // A lease-only subscriber has no terminal view, so its cached viewport must never phone-fit the PTY.
+  await registration.addMobilePresence(ptyId, clientId, undefined)
+  if (registration.released) {
     return
   }
-  try {
-    // Why: a lease-only subscriber has no terminal view, so its cached viewport must never phone-fit the PTY.
-    await runtime.handleMobileSubscribe(ptyId, clientId, undefined)
-    if (closed || signal?.aborted) {
-      // Why: a disconnect can win the awaited subscribe and resurrect mobile presence after cleanup already released it.
-      // Unguarded on purpose: this must still fire when our own cleanup already ran.
-      // Safe only because lease-only passes no viewport and both !viewport paths in
-      // handleMobileSubscribeInternal return with no await, so no rebind can land
-      // first. Adding an await there — or passing a viewport here — makes a
-      // superseded handler delete the replacement's (ptyId, clientId) presence.
-      runtime.handleMobileUnsubscribe(ptyId, clientId)
-      if (!closed) {
-        registration.releaseIfCurrent()
-      }
-      return
-    }
-    emit({ type: 'subscribed', streamId: null, lines: [], truncated: false })
-    await streamClosed
-  } catch (error) {
-    registration.releaseIfCurrent()
-    throw error
-  }
+  emit({ type: 'subscribed', streamId: null, lines: [], truncated: false })
+  await streamClosed
 }
 
 export async function runTerminalJsonSubscription(args: TerminalSubscriptionArgs): Promise<void> {
-  const {
-    params,
-    runtime,
-    connectionId,
-    signal,
-    emit,
-    ptyId,
-    clientId,
-    supportsDesktopViewportClaims
-  } = args
+  const { params, runtime, registration, emit, ptyId, clientId, supportsDesktopViewportClaims } =
+    args
   // Why: only unregister the width floor this subscription took (see the multiplex stream's registeredRemoteDesktopDriver note).
   let registeredRemoteDesktopDriver = false
-
-  // Why: a hidden watcher and a visible pane can subscribe to one terminal, so key by client so neither stream evicts the other.
-  const subscriptionId = clientId ? `${params.terminal}:${clientId}` : params.terminal
   const remoteDesktopSubscriptionKey = `json:${allocateTerminalSubscriptionStreamId()}`
-  let closed = false
   let outputBatcher: TerminalOutputBatcher | null = null
   let unsubscribeData = (): void => {}
   let unsubscribeFit = (): void => {}
-  let stopWatchingLifetime = (): void => {}
   let resolveStream = (): void => {}
   const streamClosed = new Promise<void>((resolve) => {
     resolveStream = resolve
   })
-  // Why: register before viewport/snapshot awaits so a socket close can't orphan the stream listeners or its remote-desktop width floor.
-  const registration = runtime.registerOwnedSubscriptionCleanup(
-    subscriptionId,
-    () => {
-      stopWatchingLifetime()
-      closed = true
-      outputBatcher?.flush()
-      outputBatcher?.dispose()
-      unsubscribeData()
-      unsubscribeFit()
-      if (registeredRemoteDesktopDriver && clientId) {
-        runtime.unregisterRemoteDesktopViewer(ptyId, remoteDesktopSubscriptionKey)
-      }
-      emit({ type: 'end' })
-      resolveStream()
-    },
-    connectionId
-  )
-  stopWatchingLifetime = watchSubscriptionLifetime(runtime, ptyId, signal, registration)
-  if (closed) {
-    // Why: an already-exited pty releases synchronously, so cleanup ran before this setup registers anything.
+  registration.setTeardown(() => {
+    outputBatcher?.flush()
+    outputBatcher?.dispose()
+    unsubscribeData()
+    unsubscribeFit()
+    if (registeredRemoteDesktopDriver && clientId) {
+      runtime.unregisterRemoteDesktopViewer(ptyId, remoteDesktopSubscriptionKey)
+    }
+    resolveStream()
+  })
+  if (clientId && params.client && params.viewport) {
+    registeredRemoteDesktopDriver = true
+    await updateViewportForClient(
+      runtime,
+      ptyId,
+      remoteDesktopSubscriptionKey,
+      params.client,
+      params.viewport,
+      'desktop',
+      'register',
+      !supportsDesktopViewportClaims
+    )
+  }
+  if (registration.released) {
     return
   }
-  try {
-    if (clientId && params.client && params.viewport) {
-      registeredRemoteDesktopDriver = true
-      await updateViewportForClient(
-        runtime,
-        ptyId,
-        remoteDesktopSubscriptionKey,
-        params.client,
-        params.viewport,
-        'desktop',
-        'register',
-        !supportsDesktopViewportClaims
-      )
-    }
-    if (closed || signal?.aborted) {
-      registration.releaseIfCurrent()
-      return
-    }
-    const read = await runtime.readTerminal(params.terminal)
-    const serialized = await serializeBudgetedMobileSnapshot(runtime, ptyId, false)
-    if (closed || signal?.aborted) {
-      registration.releaseIfCurrent()
-      return
-    }
-    const size = runtime.getTerminalSize(ptyId)
-    const displayMode = runtime.getMobileDisplayMode(ptyId)
-    const seq = runtime.getLayout(ptyId)?.seq
-    emit({
-      type: 'scrollback',
-      lines: read.tail,
-      truncated: isTerminalReadPayloadIncomplete(read),
-      serialized: serialized?.data,
-      oscLinks: serialized?.oscLinks,
-      cwd: serialized?.cwd,
-      // Why: an empty snapshot with no PTY size must still report the dims the fit
-      // will produce — dimless frames re-armed the mobile fit loop (STA-3337).
-      cols: serialized?.cols ?? size?.cols ?? params.viewport?.cols,
-      rows: serialized?.rows ?? size?.rows ?? params.viewport?.rows,
-      displayMode,
-      seq
-    })
-    outputBatcher = createTerminalOutputBatcher((chunk) => {
-      emit({ type: 'data', chunk })
-    })
-    const unsubscribeStreamData = runtime.subscribeToTerminalData(ptyId, (data) => {
-      outputBatcher?.push(data)
-    })
-    // Why: the legacy JSON stream can feed a live xterm view, so register as a view subscriber; worst case is a withheld model reply, safer than a double reply.
-    const releaseViewSubscriber = runtime.registerRemoteTerminalViewSubscriber(ptyId)
-    unsubscribeData = () => {
-      releaseViewSubscriber()
-      unsubscribeStreamData()
-    }
-    unsubscribeFit = runtime.subscribeToFitOverrideChanges(ptyId, (event) => {
-      outputBatcher?.flush()
-      const mode =
-        event.mode === 'mobile-fit'
-          ? event.mode
-          : (runtime.getRemoteDesktopFitHold?.(ptyId, remoteDesktopSubscriptionKey).mode ??
-            'desktop-fit')
-      emit({
-        type: 'fit-override-changed',
-        mode,
-        cols: event.cols,
-        rows: event.rows
-      })
-    })
-    await streamClosed
-  } catch (error) {
-    registration.releaseIfCurrent()
-    throw error
+  const read = await runtime.readTerminal(params.terminal)
+  const serialized = await serializeBudgetedMobileSnapshot(runtime, ptyId, false)
+  if (registration.released) {
+    return
   }
+  const size = runtime.getTerminalSize(ptyId)
+  const displayMode = runtime.getMobileDisplayMode(ptyId)
+  const seq = runtime.getLayout(ptyId)?.seq
+  emit({
+    type: 'scrollback',
+    lines: read.tail,
+    truncated: isTerminalReadPayloadIncomplete(read),
+    serialized: serialized?.data,
+    oscLinks: serialized?.oscLinks,
+    cwd: serialized?.cwd,
+    // Why: an empty snapshot with no PTY size must still report the dims the fit
+    // will produce — dimless frames re-armed the mobile fit loop (STA-3337).
+    cols: serialized?.cols ?? size?.cols ?? params.viewport?.cols,
+    rows: serialized?.rows ?? size?.rows ?? params.viewport?.rows,
+    displayMode,
+    seq
+  })
+  outputBatcher = createTerminalOutputBatcher((chunk) => {
+    emit({ type: 'data', chunk })
+  })
+  const unsubscribeStreamData = runtime.subscribeToTerminalData(ptyId, (data) => {
+    outputBatcher?.push(data)
+  })
+  // Why: the legacy JSON stream can feed a live xterm view, so register as a view subscriber; worst case is a withheld model reply, safer than a double reply.
+  const releaseViewSubscriber = runtime.registerRemoteTerminalViewSubscriber(ptyId)
+  unsubscribeData = () => {
+    releaseViewSubscriber()
+    unsubscribeStreamData()
+  }
+  unsubscribeFit = runtime.subscribeToFitOverrideChanges(ptyId, (event) => {
+    outputBatcher?.flush()
+    const mode =
+      event.mode === 'mobile-fit'
+        ? event.mode
+        : (runtime.getRemoteDesktopFitHold?.(ptyId, remoteDesktopSubscriptionKey).mode ??
+          'desktop-fit')
+    emit({
+      type: 'fit-override-changed',
+      mode,
+      cols: event.cols,
+      rows: event.rows
+    })
+  })
+  await streamClosed
 }
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscribe-binary.ts b/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscribe-binary.ts
index 08639f16f48..35d40a2d948 100644
--- a/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscribe-binary.ts
+++ b/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscribe-binary.ts
@@ -13,7 +13,6 @@ import {
 import { TERMINAL_MULTIPLEX_PENDING_MAX_BYTES } from '../../../../../shared/terminal-multiplex-flow-control'
 import { measureTerminalStreamByteLength } from '../../terminal-stream-byte-length'
 import { createTerminalOutputBatcher, type TerminalOutputBatcher } from './terminal-output-batcher'
-import { watchSubscriptionLifetime } from './terminal-input-delivery'
 import { trimPendingOutputToBudget } from './terminal-stream-replay'
 import { allocateTerminalSubscriptionStreamId } from './terminal-subscription-stream-id'
 import type {
@@ -26,8 +25,7 @@ import { activateLegacyBinarySubscription } from './terminal-legacy-subscribe-li
 import { registerLegacyBinaryControlFrames } from './terminal-legacy-binary-control-frames'
 const TERMINAL_QUERY_REPLAY_MAX_CHARS = 16 * 1024
 export async function runTerminalBinarySubscription(args: TerminalSubscriptionArgs): Promise<void> {
-  const { params, runtime, connectionId, sendBinary, signal, emit, ptyId, clientId, isMobile } =
-    args
+  const { runtime, registration, sendBinary, ptyId, clientId, isMobile } = args
   if (!sendBinary) {
     throw new Error('binary_terminal_stream_required')
   }
@@ -53,40 +51,28 @@ export async function runTerminalBinarySubscription(args: TerminalSubscriptionAr
   let unsubscribeFit = (): void => {}
   let unregisterBinaryHandler = (): void => {}
   let abortRendererMountWait = (): void => {}
-  let stopWatchingLifetime = (): void => {}
   let lateRendererReadyPromise: Promise<boolean> | null = null
   let outputBatcher: TerminalOutputBatcher | null = null
   let resolveStream = (): void => {}
   const streamClosed = new Promise<void>((resolve) => {
     resolveStream = resolve
   })
-  // Why: register cleanup before any await so a mid-subscribe disconnect still removes mobile presence; client-scoped ids also allow parallel desktop subscribers.
-  const subscriptionId = clientId ? `${params.terminal}:${clientId}` : params.terminal
-  const registration = runtime.registerOwnedSubscriptionCleanup(
-    subscriptionId,
-    () => {
-      stopWatchingLifetime()
-      outputBatcher?.flush()
-      outputBatcher?.dispose()
-      closed = true
-      unsubscribeData()
-      unsubscribeResize()
-      unsubscribeFit()
-      unregisterBinaryHandler()
-      abortRendererMountWait()
-      if (isMobile && clientId) {
-        runtime.handleMobileUnsubscribe(ptyId, clientId)
-      } else if (registeredRemoteDesktopDriver && clientId) {
-        runtime.unregisterRemoteDesktopViewer(ptyId, remoteDesktopSubscriptionKey)
-      }
-      emit({ type: 'end' })
-      resolveStream()
-    },
-    connectionId
-  )
-  stopWatchingLifetime = watchSubscriptionLifetime(runtime, ptyId, signal, registration)
-  if (closed) {
-    // Why: an already-exited pty releases synchronously, so cleanup ran before this setup registers anything.
+  registration.setTeardown(() => {
+    outputBatcher?.flush()
+    outputBatcher?.dispose()
+    closed = true
+    unsubscribeData()
+    unsubscribeResize()
+    unsubscribeFit()
+    unregisterBinaryHandler()
+    abortRendererMountWait()
+    // Why: phone presence belongs to the registration; only a desktop viewer owns a width floor here.
+    if (!isMobile && registeredRemoteDesktopDriver && clientId) {
+      runtime.unregisterRemoteDesktopViewer(ptyId, remoteDesktopSubscriptionKey)
+    }
+    resolveStream()
+  })
+  if (registration.released) {
     return
   }
   const sendFrame = (
@@ -268,19 +254,13 @@ export async function runTerminalBinarySubscription(args: TerminalSubscriptionAr
       registeredRemoteDesktopDriver = value
     },
     displayMode: 'auto',
-    registration,
     streamClosed,
     sendFrame
   }
-  try {
-    await publishLegacyBinaryInitialSnapshot(args, state)
-    if (state.closed || signal?.aborted) {
-      return
-    }
-    activateLegacyBinarySubscription(args, state)
-  } catch (error) {
-    registration.releaseIfCurrent()
-    throw error
+  await publishLegacyBinaryInitialSnapshot(args, state)
+  if (registration.released) {
+    return
   }
+  activateLegacyBinarySubscription(args, state)
   await streamClosed
 }
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscribe-snapshot.ts b/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscribe-snapshot.ts
index 7b9d45d144c..5202804c0d5 100644
--- a/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscribe-snapshot.ts
+++ b/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscribe-snapshot.ts
@@ -24,7 +24,7 @@ export async function publishLegacyBinaryInitialSnapshot(
   const {
     params,
     runtime,
-    signal,
+    registration,
     sendBinary,
     emit,
     ptyId,
@@ -34,8 +34,9 @@ export async function publishLegacyBinaryInitialSnapshot(
     rendererMountRequestedBeforePty,
     serializerGenerationBeforeMobileFit
   } = args
+  const { signal } = registration
   if (isMobile && clientId) {
-    await runtime.handleMobileSubscribe(ptyId, clientId, params.viewport)
+    await registration.addMobilePresence(ptyId, clientId, params.viewport)
   } else if (clientId && params.viewport) {
     // Why: legacy subscribe records geometry without taking ownership; only an explicit activity/claim frame may suppress the host.
     state.registeredRemoteDesktopDriver = true
@@ -60,20 +61,28 @@ export async function publishLegacyBinaryInitialSnapshot(
   if (state.closed) {
     return
   }
-  // Why: missing model state (not blank snapshot text) signals a never-attached PTY; a renderer-sourced snapshot already proves attachment, so skip the remount.
+  // Why: missing model state (not blank snapshot text) signals a never-attached PTY; any renderer answer proves a pane, and the answer is null when the host's flag is unset or stale after a pane closed over a live PTY, which falls back to the mount wait.
+  const needsRendererScreen =
+    missingHeadlessStateBeforeMobileFit && serialized?.source !== 'renderer'
+  let rendererReady =
+    needsRendererScreen &&
+    (await runtime.serializeRendererTerminalBuffer(ptyId, { scrollbackRows: 0 })) !== null
+  if (state.closed) {
+    return
+  }
   const mountRequested =
-    missingHeadlessStateBeforeMobileFit &&
-    serialized?.source !== 'renderer' &&
+    needsRendererScreen &&
+    !rendererReady &&
     (rendererMountRequestedBeforePty || runtime.requestRendererTerminalTabMount(params.terminal))
-  if (missingHeadlessStateBeforeMobileFit && mountRequested) {
+  if (mountRequested) {
     // Why: an idle legacy PTY emits no later byte, so wait for a settle proving this remount completed before replaying its screen.
     const mountWaitController = new AbortController()
     const abortMountWait = (): void => mountWaitController.abort()
     state.abortRendererMountWait = abortMountWait
-    if (signal?.aborted) {
+    if (signal.aborted) {
       abortMountWait()
     } else {
-      signal?.addEventListener('abort', abortMountWait, { once: true })
+      signal.addEventListener('abort', abortMountWait, { once: true })
     }
     const rendererReadyPromise = runtime
       .waitForRendererTerminalSerializer(
@@ -84,7 +93,7 @@ export async function publishLegacyBinaryInitialSnapshot(
       )
       .catch(() => false)
     const finishMountWait = (): void => {
-      signal?.removeEventListener('abort', abortMountWait)
+      signal.removeEventListener('abort', abortMountWait)
       if (state.abortRendererMountWait === abortMountWait) {
         state.abortRendererMountWait = () => {}
       }
@@ -97,43 +106,49 @@ export async function publishLegacyBinaryInitialSnapshot(
         deadlineTimer.unref()
       }
     })
-    const rendererReady = await Promise.race([rendererReadyPromise, initialDeadline])
+    rendererReady = await Promise.race([rendererReadyPromise, initialDeadline])
     if (deadlineTimer) {
       clearTimeout(deadlineTimer)
     }
-    if (state.closed || signal?.aborted) {
+    if (state.closed || signal.aborted) {
       return
     }
-    if (rendererReady) {
-      read = await runtime.readTerminal(params.terminal)
-      const stableRendererSnapshot = await serializeStableMobileRendererSnapshot(
-        runtime,
-        ptyId,
-        // The same frame, because this snapshot is published by the scrollback send below rather
-        // than by one of its own: the `resized` it used to name is a frame nothing here sends.
-        mobileSnapshotByteBudget(params.snapshotByteBudget, state.streamId, scrollbackFrame)
-      )
-      if (state.closed) {
-        return
-      }
-      if (stableRendererSnapshot?.data.length) {
-        serialized = stableRendererSnapshot
-        const trailingOutput = state.pendingOutput.flatMap((item) => {
-          const output = getOutputAfterSnapshotSeq(item, stableRendererSnapshot.seq)
-          const seq = item.meta?.seq
-          return output && typeof seq === 'number' ? [{ data: output.data, seq }] : []
-        })
-        runtime.replaceHeadlessTerminalFromRendererSnapshotForRecovery(
-          ptyId,
-          stableRendererSnapshot,
-          trailingOutput
-        )
-      }
-    } else {
+    if (!rendererReady) {
       // Why: a renderer can settle after the bounded initial response; keep observing so an idle PTY self-heals without bytes.
       state.lateRendererReadyPromise = rendererReadyPromise
     }
   }
+  if (rendererReady) {
+    read = await runtime.readTerminal(params.terminal)
+    const stableRendererSnapshot = await serializeStableMobileRendererSnapshot(
+      runtime,
+      ptyId,
+      // The same frame, because this snapshot is published by the scrollback send below rather
+      // than by one of its own: the `resized` it used to name is a frame nothing here sends.
+      mobileSnapshotByteBudget(params.snapshotByteBudget, state.streamId, scrollbackFrame)
+    )
+    if (state.closed) {
+      return
+    }
+    // Why: a blank screen may be a parked pane that has not hydrated, and a seq-less screen has no
+    // seam against buffered output, so it is safe only when nothing is pending to replay twice.
+    if (
+      stableRendererSnapshot?.data.length &&
+      (typeof stableRendererSnapshot.seq === 'number' || state.pendingOutput.length === 0)
+    ) {
+      serialized = stableRendererSnapshot
+      const trailingOutput = state.pendingOutput.flatMap((item) => {
+        const output = getOutputAfterSnapshotSeq(item, stableRendererSnapshot.seq)
+        const seq = item.meta?.seq
+        return output && typeof seq === 'number' ? [{ data: output.data, seq }] : []
+      })
+      runtime.replaceHeadlessTerminalFromRendererSnapshotForRecovery(
+        ptyId,
+        stableRendererSnapshot,
+        trailingOutput
+      )
+    }
+  }
   let initialOutputOverflowed = false
   if (state.pendingOutputOverflowed) {
     state.pendingOutput.splice(0)
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscription-types.ts b/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscription-types.ts
index d9eb624f0e1..595a65a5eeb 100644
--- a/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscription-types.ts
+++ b/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscription-types.ts
@@ -1,11 +1,11 @@
 import type { z } from 'zod'
 import type { RpcContext } from '../../core'
-import type { SubscriptionRegistration } from '../../../orca-runtime'
 import type { TerminalReplyQuerySequence } from '../../../../../shared/terminal-reply-query-scan'
 import type { TerminalOutputChunk } from './terminal-stream-types'
 import type { TerminalSubscribe } from './stream-schemas'
 import type { TerminalOutputBatcher } from './terminal-output-batcher'
 import type { TerminalStreamOpcode } from '../../../../../shared/terminal-stream-protocol'
+import type { TerminalSubscriptionRegistration } from './terminal-subscription-registration'
 
 export type TerminalSubscribeParams = z.infer<typeof TerminalSubscribe>
 export type TerminalSubscriptionEmit = (result: unknown) => void
@@ -13,10 +13,9 @@ export type TerminalSubscriptionEmit = (result: unknown) => void
 export type TerminalSubscriptionArgs = {
   params: TerminalSubscribeParams
   runtime: RpcContext['runtime']
-  connectionId: RpcContext['connectionId']
+  registration: TerminalSubscriptionRegistration
   sendBinary: RpcContext['sendBinary']
   registerBinaryStreamHandler: RpcContext['registerBinaryStreamHandler']
-  signal: RpcContext['signal']
   emit: TerminalSubscriptionEmit
   ptyId: string
   clientId: string | undefined
@@ -48,7 +47,6 @@ export type LegacyBinarySubscriptionState = {
   unsubscribeFit: () => void
   registeredRemoteDesktopDriver: boolean
   displayMode: string
-  readonly registration: SubscriptionRegistration
   readonly streamClosed: Promise<void>
   readonly sendFrame: (
     opcode: TerminalStreamOpcode,
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-query-methods.ts b/src/main/runtime/rpc/methods/terminal/terminal-query-methods.ts
index 52c1063b0cc..68afc1e8d19 100644
--- a/src/main/runtime/rpc/methods/terminal/terminal-query-methods.ts
+++ b/src/main/runtime/rpc/methods/terminal/terminal-query-methods.ts
@@ -121,5 +121,12 @@ export const TERMINAL_QUERY_METHODS = [
     handler: async (params, { runtime }) => ({
       clear: await runtime.clearTerminalBuffer(params.terminal)
     })
+  }),
+  defineMethod({
+    name: 'terminal.resetInputModes',
+    params: TerminalHandle,
+    handler: async (params, { runtime }) => ({
+      reset: await runtime.resetTerminalInputModes(params.terminal)
+    })
   })
 ]
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-send-method.ts b/src/main/runtime/rpc/methods/terminal/terminal-send-method.ts
index 99c01d902a4..ca7ac0aeb75 100644
--- a/src/main/runtime/rpc/methods/terminal/terminal-send-method.ts
+++ b/src/main/runtime/rpc/methods/terminal/terminal-send-method.ts
@@ -210,6 +210,7 @@ export const TERMINAL_SEND_METHODS = [
       try {
         result = useSettledAgentPrompt
           ? await runtime.sendTerminalAgentPrompt(params.terminal, params.text!, {
+              inputKind: 'driving',
               beforeWrite,
               signal,
               ...(orchestrationMutation
@@ -234,6 +235,8 @@ export const TERMINAL_SEND_METHODS = [
               {
                 beforeWrite,
                 signal,
+                // Why: a wire write carries no provenance beyond a client's own query reply.
+                inputKind: params.inputKind === 'query-reply' ? 'query-reply' : 'driving',
                 ...(reserveWrite ? { reserveWrite } : {}),
                 ...(params.inputKind !== 'query-reply' && mobileFloorClientId
                   ? { afterWrite: () => commitMobileInputFloorClaim(mobileFloorClaim) }
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-subscribe-method.ts b/src/main/runtime/rpc/methods/terminal/terminal-subscribe-method.ts
index 7572d41496f..6fa2c936c0c 100644
--- a/src/main/runtime/rpc/methods/terminal/terminal-subscribe-method.ts
+++ b/src/main/runtime/rpc/methods/terminal/terminal-subscribe-method.ts
@@ -7,6 +7,7 @@ import {
   runTerminalLeaseSubscription
 } from './terminal-legacy-simple-subscriptions'
 import type { TerminalSubscriptionArgs } from './terminal-legacy-subscription-types'
+import { registerTerminalSubscription } from './terminal-subscription-registration'
 
 export const TERMINAL_SUBSCRIBE_METHODS = [
   // Streams live terminal output over WebSocket; mobile clients pass client+viewport for server-side auto-fit.
@@ -15,81 +16,106 @@ export const TERMINAL_SUBSCRIBE_METHODS = [
     params: TerminalSubscribe,
     handler: async (
       params,
-      { runtime, connectionId, sendBinary, registerBinaryStreamHandler, signal },
+      { runtime, connectionId, requestId, sendBinary, registerBinaryStreamHandler, signal },
       emit
     ) => {
-      let leaf = runtime.resolveLeafForHandle(params.terminal)
       const isMobile = params.client?.type === 'mobile'
+      const useBinaryStream = params.capabilities?.terminalBinaryStream === 1 && Boolean(sendBinary)
+      // Why: validated before registering, so a request that can never stream can't evict the slot's live stream.
+      if (isMobile && !useBinaryStream) {
+        throw new Error('binary_terminal_stream_required')
+      }
+      if (signal?.aborted) {
+        return
+      }
+      let leaf = runtime.resolveLeafForHandle(params.terminal)
       const serializerGenerationBeforeAnyMount = isMobile
         ? (runtime.getRendererTerminalSerializerGenerationForHandle?.(params.terminal) ?? 0)
         : 0
       let rendererMountRequestedBeforePty = false
-      const useBinaryStream = params.capabilities?.terminalBinaryStream === 1 && Boolean(sendBinary)
-      if (signal?.aborted) {
-        return
-      }
-
-      if (!leaf?.ptyId && params.client) {
-        rendererMountRequestedBeforePty = runtime.requestRendererTerminalTabMount(params.terminal)
-        try {
-          const ptyId = await runtime.waitForLeafPtyId(params.terminal, 10_000, signal)
-          leaf = { ptyId }
-        } catch {
-          if (signal?.aborted) {
+      const clientId = params.client?.id
+      // Why: register before the pty wait so an unsubscribe, a same-slot replacement or a closed socket can end a pending stream.
+      // Client-scoped keys also let a hidden watcher and a visible pane subscribe to one terminal.
+      const registration = registerTerminalSubscription({
+        runtime,
+        subscriptionId: clientId ? `${params.terminal}:${clientId}` : params.terminal,
+        connectionId,
+        requestId,
+        requestSignal: signal,
+        emit
+      })
+      try {
+        if (!leaf?.ptyId && params.client) {
+          rendererMountRequestedBeforePty = runtime.requestRendererTerminalTabMount(params.terminal)
+          const ptyId = await runtime
+            .waitForLeafPtyId(params.terminal, 10_000, registration.signal)
+            .catch(() => null)
+          if (registration.released) {
             return
           }
+          leaf = { ptyId }
+        }
+        if (!leaf?.ptyId) {
+          const read = await runtime.readTerminal(params.terminal)
+          if (registration.released) {
+            return
+          }
+          emit({
+            type: 'subscribed',
+            streamId: null,
+            lines: read.tail,
+            truncated: isTerminalReadPayloadIncomplete(read)
+          })
+          return
         }
-      }
-      if (!leaf?.ptyId) {
-        const read = await runtime.readTerminal(params.terminal)
-        emit({
-          type: 'subscribed',
-          streamId: null,
-          lines: read.tail,
-          truncated: isTerminalReadPayloadIncomplete(read)
-        })
-        emit({ type: 'end' })
-        return
-      }
-      if (isMobile && (!useBinaryStream || !sendBinary)) {
-        throw new Error('binary_terminal_stream_required')
-      }
 
-      const ptyId = leaf.ptyId
-      const clientId = params.client?.id
-      const missingHeadlessStateBeforeMobileFit =
-        isMobile &&
-        (rendererMountRequestedBeforePty || runtime.hasHeadlessTerminalState?.(ptyId) === false)
-      const args: TerminalSubscriptionArgs = {
-        params,
-        runtime,
-        connectionId,
-        sendBinary,
-        registerBinaryStreamHandler,
-        signal,
-        emit,
-        ptyId,
-        clientId,
-        isMobile,
-        supportsDesktopViewportClaims: params.capabilities?.desktopViewportClaims === 1,
-        supportsWriteUnavailable: params.capabilities?.writeUnavailable === 1,
-        rendererMountRequestedBeforePty,
-        missingHeadlessStateBeforeMobileFit,
-        serializerGenerationBeforeMobileFit: missingHeadlessStateBeforeMobileFit
-          ? rendererMountRequestedBeforePty
-            ? serializerGenerationBeforeAnyMount
-            : runtime.getRendererTerminalSerializerGeneration(ptyId)
-          : 0
+        const ptyId = leaf.ptyId
+        registration.releaseOnPtyExit(ptyId)
+        if (registration.released) {
+          return
+        }
+        const missingHeadlessStateBeforeMobileFit =
+          isMobile &&
+          (rendererMountRequestedBeforePty || runtime.hasHeadlessTerminalState?.(ptyId) === false)
+        const args: TerminalSubscriptionArgs = {
+          params,
+          runtime,
+          registration,
+          sendBinary,
+          registerBinaryStreamHandler,
+          emit,
+          ptyId,
+          clientId,
+          isMobile,
+          supportsDesktopViewportClaims: params.capabilities?.desktopViewportClaims === 1,
+          supportsWriteUnavailable: params.capabilities?.writeUnavailable === 1,
+          rendererMountRequestedBeforePty,
+          missingHeadlessStateBeforeMobileFit,
+          serializerGenerationBeforeMobileFit: missingHeadlessStateBeforeMobileFit
+            ? rendererMountRequestedBeforePty
+              ? serializerGenerationBeforeAnyMount
+              : runtime.getRendererTerminalSerializerGeneration(ptyId)
+            : 0
+        }
+        if (isMobile && params.capabilities?.mobileInputLeaseOnly === 1 && Boolean(clientId)) {
+          await runTerminalLeaseSubscription(args)
+          return
+        }
+        if (!useBinaryStream) {
+          await runTerminalJsonSubscription(args)
+          return
+        }
+        await runTerminalBinarySubscription(args)
+      } catch (error) {
+        // Why: a released stream already sent `end`; an error frame after it would contradict it.
+        if (registration.released) {
+          return
+        }
+        registration.releaseSilently()
+        throw error
+      } finally {
+        registration.release()
       }
-      if (isMobile && params.capabilities?.mobileInputLeaseOnly === 1 && Boolean(clientId)) {
-        await runTerminalLeaseSubscription(args)
-        return
-      }
-      if (!useBinaryStream) {
-        await runTerminalJsonSubscription(args)
-        return
-      }
-      await runTerminalBinarySubscription(args)
     }
   })
 ]
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-subscription-registration.test.ts b/src/main/runtime/rpc/methods/terminal/terminal-subscription-registration.test.ts
new file mode 100644
index 00000000000..1af456dfdd4
--- /dev/null
+++ b/src/main/runtime/rpc/methods/terminal/terminal-subscription-registration.test.ts
@@ -0,0 +1,123 @@
+import { describe, expect, it, vi } from 'vitest'
+import { RuntimeSubscriptionRegistry } from '../../../runtime-subscription-registry'
+import { registerTerminalSubscription } from './terminal-subscription-registration'
+
+const SUBSCRIPTION_ID = 'terminal-1:phone-1'
+
+function createRegistration(
+  requestSignal?: AbortSignal,
+  registry = new RuntimeSubscriptionRegistry()
+) {
+  const runtime = {
+    registerOwnedSubscriptionCleanup: registry.registerOwned.bind(registry),
+    subscribeToPtyExit: vi.fn((_ptyId: string, _listener: () => void) => vi.fn()),
+    handleMobileSubscribe: vi.fn().mockResolvedValue(true),
+    handleMobileUnsubscribe: vi.fn()
+  }
+  const emit = vi.fn()
+  const registration = registerTerminalSubscription({
+    runtime,
+    subscriptionId: SUBSCRIPTION_ID,
+    connectionId: 'conn-a',
+    requestId: 'req-1',
+    requestSignal,
+    emit
+  })
+  return { registry, runtime, emit, registration }
+}
+
+describe('terminal subscription registration', () => {
+  it('runs its teardown once when the teardown re-enters release', () => {
+    const { registry, emit, registration } = createRegistration()
+    const teardown = vi.fn(() => {
+      registration.release()
+      registry.cleanup(SUBSCRIPTION_ID)
+    })
+    registration.setTeardown(teardown)
+
+    registration.release()
+
+    expect(teardown).toHaveBeenCalledOnce()
+    expect(emit.mock.calls).toEqual([[{ type: 'end' }]])
+    expect(registration.signal.aborted).toBe(true)
+  })
+
+  it('runs a teardown set after release immediately', () => {
+    const { registration } = createRegistration()
+    registration.release()
+    const teardown = vi.fn()
+
+    registration.setTeardown(teardown)
+
+    expect(teardown).toHaveBeenCalledOnce()
+  })
+
+  it('is released on arrival, without taking the slot, when the request signal is already aborted', () => {
+    const registry = new RuntimeSubscriptionRegistry()
+    const liveCleanup = vi.fn()
+    registry.registerOwned(SUBSCRIPTION_ID, liveCleanup, 'conn-a')
+    const request = new AbortController()
+    request.abort()
+    const { emit, registration } = createRegistration(request.signal, registry)
+
+    expect(registration.released).toBe(true)
+    expect(registration.signal.aborted).toBe(true)
+    expect(emit).not.toHaveBeenCalled()
+    expect(liveCleanup).not.toHaveBeenCalled()
+    expect(registry.cleanupIfOwnedByConnection(SUBSCRIPTION_ID, 'conn-a')).toBe(true)
+    expect(liveCleanup).toHaveBeenCalledOnce()
+  })
+
+  it('removes phone presence and aborts even when the teardown throws', async () => {
+    const { runtime, registration } = createRegistration()
+    void registration.addMobilePresence('pty-1', 'phone-1', undefined)
+    registration.setTeardown(() => {
+      throw new Error('flush_failed')
+    })
+    const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+
+    registration.release()
+
+    expect(runtime.handleMobileUnsubscribe).toHaveBeenCalledWith('pty-1', 'phone-1')
+    expect(registration.signal.aborted).toBe(true)
+    await vi.waitFor(() => expect(error).toHaveBeenCalled())
+    error.mockRestore()
+  })
+
+  it('adds no presence after release', async () => {
+    const { runtime, registration } = createRegistration()
+    registration.release()
+
+    await registration.addMobilePresence('pty-1', 'phone-1', undefined)
+
+    expect(runtime.handleMobileSubscribe).not.toHaveBeenCalled()
+    expect(runtime.handleMobileUnsubscribe).not.toHaveBeenCalled()
+  })
+
+  it('releases silently without end', () => {
+    const { emit, registration } = createRegistration()
+
+    registration.releaseSilently()
+    registration.release()
+
+    expect(registration.released).toBe(true)
+    expect(emit).not.toHaveBeenCalled()
+  })
+
+  it('stops watching for pty exit when released, and releases on exit', () => {
+    const { runtime, emit, registration } = createRegistration()
+    let onExit = (): void => {}
+    const stopWatching = vi.fn()
+    runtime.subscribeToPtyExit.mockImplementation((_ptyId: string, listener: () => void) => {
+      onExit = listener
+      return stopWatching
+    })
+    registration.releaseOnPtyExit('pty-1')
+
+    onExit()
+
+    expect(registration.released).toBe(true)
+    expect(stopWatching).toHaveBeenCalledOnce()
+    expect(emit.mock.calls).toEqual([[{ type: 'end' }]])
+  })
+})
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-subscription-registration.ts b/src/main/runtime/rpc/methods/terminal/terminal-subscription-registration.ts
new file mode 100644
index 00000000000..235088b2048
--- /dev/null
+++ b/src/main/runtime/rpc/methods/terminal/terminal-subscription-registration.ts
@@ -0,0 +1,141 @@
+import type { OrcaRuntimeService } from '../../../orca-runtime'
+
+type RegistrationRuntime = Pick<
+  OrcaRuntimeService,
+  | 'registerOwnedSubscriptionCleanup'
+  | 'subscribeToPtyExit'
+  | 'handleMobileSubscribe'
+  | 'handleMobileUnsubscribe'
+>
+
+/** One `terminal.subscribe` request, addressable from admission until it is released. */
+export type TerminalSubscriptionRegistration = {
+  readonly released: boolean
+  /** Aborted once release has torn everything down. */
+  readonly signal: AbortSignal
+  /** Runs the stream's teardown on release, or now if the registration was already released. */
+  setTeardown(teardown: () => void): void
+  releaseOnPtyExit(ptyId: string): void
+  addMobilePresence(
+    ptyId: string,
+    clientId: string,
+    viewport: { cols: number; rows: number } | undefined
+  ): Promise<void>
+  /** Releases and ends the stream. */
+  release(): void
+  /** Releases without `end`, for a handler about to fail the request instead. */
+  releaseSilently(): void
+}
+
+export function registerTerminalSubscription({
+  runtime,
+  subscriptionId,
+  connectionId,
+  requestId,
+  requestSignal,
+  emit
+}: {
+  runtime: RegistrationRuntime
+  subscriptionId: string
+  connectionId: string | undefined
+  /** With `connectionId`, lets `terminal.unsubscribe{requestId}` address this exact request. */
+  requestId: string | undefined
+  requestSignal: AbortSignal | undefined
+  emit: (result: unknown) => void
+}): TerminalSubscriptionRegistration {
+  const controller = new AbortController()
+  let released = false
+  let ended = false
+  let teardown: (() => void) | null = null
+  let stopWatchingExit = (): void => {}
+  let presence: { ptyId: string; clientId: string } | null = null
+
+  const end = (): void => {
+    if (ended) {
+      return
+    }
+    ended = true
+    emit({ type: 'end' })
+  }
+  const releaseOnce = (): void => {
+    // Why: the registry calls cleanup before recording it as in flight, so a re-entrant release must be a no-op.
+    if (released) {
+      return
+    }
+    released = true
+    requestSignal?.removeEventListener('abort', onRequestAbort)
+    try {
+      try {
+        stopWatchingExit()
+        teardown?.()
+      } finally {
+        // Why: the latch makes any retry a no-op, so a throwing teardown must not strand phone presence.
+        if (presence) {
+          runtime.handleMobileUnsubscribe(presence.ptyId, presence.clientId)
+        }
+      }
+    } finally {
+      controller.abort()
+    }
+  }
+  // Why: a closed socket hands out a pre-aborted signal; registering would evict the slot's live stream for a dead request.
+  const registryEntry = requestSignal?.aborted
+    ? null
+    : runtime.registerOwnedSubscriptionCleanup(
+        subscriptionId,
+        () => {
+          try {
+            releaseOnce()
+          } finally {
+            end()
+          }
+        },
+        connectionId,
+        requestId
+      )
+  // Why: route through the registry so the entry leaves with the release and a teardown error is contained there.
+  const release = (): void => registryEntry?.releaseIfCurrent()
+  const onRequestAbort = (): void => release()
+
+  const registration: TerminalSubscriptionRegistration = {
+    get released() {
+      return released
+    },
+    signal: controller.signal,
+    setTeardown(nextTeardown) {
+      if (released) {
+        nextTeardown()
+        return
+      }
+      teardown = nextTeardown
+    },
+    releaseOnPtyExit(ptyId) {
+      const unsubscribe = runtime.subscribeToPtyExit(ptyId, release)
+      if (released) {
+        // Why: an already-exited pty releases synchronously, before the unsubscribe exists to stop.
+        unsubscribe()
+        return
+      }
+      stopWatchingExit = unsubscribe
+    },
+    async addMobilePresence(ptyId, clientId, viewport) {
+      if (released) {
+        return
+      }
+      // Why: presence and the driver are set before the layout await, so a release during it must remove them.
+      presence = { ptyId, clientId }
+      await runtime.handleMobileSubscribe(ptyId, clientId, viewport)
+    },
+    release,
+    releaseSilently() {
+      ended = true
+      release()
+    }
+  }
+  if (registryEntry) {
+    requestSignal?.addEventListener('abort', onRequestAbort, { once: true })
+  } else {
+    releaseOnce()
+  }
+  return registration
+}
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-viewport-methods.ts b/src/main/runtime/rpc/methods/terminal/terminal-viewport-methods.ts
index da1121c89df..b977c113668 100644
--- a/src/main/runtime/rpc/methods/terminal/terminal-viewport-methods.ts
+++ b/src/main/runtime/rpc/methods/terminal/terminal-viewport-methods.ts
@@ -83,6 +83,12 @@ export const TERMINAL_VIEWPORT_METHODS_AFTER_STREAMS = [
     name: 'terminal.unsubscribe',
     params: TerminalUnsubscribe,
     handler: async (params, { runtime, connectionId, subscriptionRegistrationVersion }) => {
+      if (params.requestId !== undefined) {
+        // Why: an unknown request already ended or never registered; falling back to the slot could end a newer stream.
+        runtime.releaseSubscriptionByRequest(connectionId, params.requestId)
+        return { unsubscribed: true }
+      }
+      // COMPAT(terminal request-addressed unsubscribe): slot path for phones that predate `requestId`.
       // Fence both socket replacement and a newer subscription on the same socket.
       let unsubscribed = runtime.cleanupSubscriptionIfOwnedByConnection(
         params.subscriptionId,
diff --git a/src/main/runtime/rpc/methods/ui-state-schema-parity-checks.ts b/src/main/runtime/rpc/methods/ui-state-schema-parity-checks.ts
index a8fe8ca00c7..5f077b9d204 100644
--- a/src/main/runtime/rpc/methods/ui-state-schema-parity-checks.ts
+++ b/src/main/runtime/rpc/methods/ui-state-schema-parity-checks.ts
@@ -9,6 +9,7 @@ import type { AssertNoMissingKeys, AssertNoMissingValues } from './ui-state-sche
 // strict schema is deliberate — but it must stay deliberate rather than
 // forgotten, which is what the parity assertion below enforces.
 type MainOwnedUIState =
+  | '_explorerDisplayRootMigrated'
   | 'trayMinimizeNoticeShown'
   | 'dashboardPopoutBounds'
   | '_expandedWorktreeCardPropertiesDefaulted'
diff --git a/src/main/runtime/rpc/methods/worktree-create-args.ts b/src/main/runtime/rpc/methods/worktree-create-args.ts
index 932659758bb..c05dc906f40 100644
--- a/src/main/runtime/rpc/methods/worktree-create-args.ts
+++ b/src/main/runtime/rpc/methods/worktree-create-args.ts
@@ -78,6 +78,7 @@ export function buildManagedWorktreeCreateArgs(
       : undefined,
     ...(params.startupAgent ? { startupAgent: params.startupAgent } : {}),
     ...(params.startupPrompt !== undefined ? { startupPrompt: params.startupPrompt } : {}),
+    ...(params.launchSource ? { startupLaunchSource: params.launchSource } : {}),
     startupDraft: params.startupDraft,
     lineage: {
       parentWorkspace: params.parentWorkspace,
diff --git a/src/main/runtime/rpc/methods/worktree-create-launch-source.test.ts b/src/main/runtime/rpc/methods/worktree-create-launch-source.test.ts
new file mode 100644
index 00000000000..2cfd6c3de92
--- /dev/null
+++ b/src/main/runtime/rpc/methods/worktree-create-launch-source.test.ts
@@ -0,0 +1,41 @@
+import { describe, expect, it, vi } from 'vitest'
+import { RpcDispatcher } from '../dispatcher'
+import type { OrcaRuntimeService } from '../../orca-runtime'
+import { WORKTREE_METHODS } from './worktree'
+
+const repo = {
+  id: 'repo-1',
+  path: '/workspace/repo',
+  displayName: 'repo',
+  badgeColor: '#000',
+  addedAt: 1,
+  kind: 'git' as const
+}
+
+describe('worktree.create launch source', () => {
+  it('hands the surface that asked for a startup agent to the runtime', async () => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the fixture implements every runtime method worktree.create reaches for a create with no provenance request.
+    const runtime = {
+      getRuntimeId: () => 'test-runtime',
+      dedupeWorktreeCreate: <T>(_repo: string, _id: string | undefined, run: () => Promise<T>) =>
+        run(),
+      showRepo: vi.fn().mockResolvedValue(repo),
+      createManagedWorktree: vi.fn().mockResolvedValue({ worktree: { id: 'wt-1' } })
+    } as unknown as OrcaRuntimeService
+    const dispatcher = new RpcDispatcher({ runtime, methods: WORKTREE_METHODS })
+
+    // An open label: a surface this host has never heard of must not refuse the create.
+    for (const launchSource of ['cli', 'a_surface_added_later']) {
+      const response = await dispatcher.dispatch({
+        id: 'req-1',
+        authToken: 'tok',
+        method: 'worktree.create',
+        params: { repo: 'repo-1', name: 'agent-startup', startupAgent: 'codex', launchSource }
+      })
+      expect(response).toMatchObject({ ok: true })
+      expect(runtime.createManagedWorktree).toHaveBeenLastCalledWith(
+        expect.objectContaining({ startupAgent: 'codex', startupLaunchSource: launchSource })
+      )
+    }
+  })
+})
diff --git a/src/main/runtime/rpc/orchestration-mutation-executor.ts b/src/main/runtime/rpc/orchestration-mutation-executor.ts
index e6ad7952d8c..010541357f5 100644
--- a/src/main/runtime/rpc/orchestration-mutation-executor.ts
+++ b/src/main/runtime/rpc/orchestration-mutation-executor.ts
@@ -4,6 +4,7 @@ import {
   isTerminalPromptMutation
 } from '../../../shared/orchestration-rpc-contract'
 import type { OrcaRuntimeService } from '../orca-runtime'
+import type { OrcaSessionId } from '../../../shared/orca-session-address'
 import { OrchestrationError } from '../orchestration/orchestration-error'
 import type { RpcRequest } from './core'
 import {
@@ -53,7 +54,9 @@ export class OrchestrationMutationExecutor {
     request: RpcRequest,
     params: unknown,
     invoke: (mutation?: DurableMutationInvocation) => unknown,
-    callerFingerprintOverride?: string
+    callerFingerprintOverride?: string,
+    /** The resolved session's Orca session id; it joins the payload so another caller cannot replay it. */
+    callerOrcaSessionId?: OrcaSessionId
   ): Promise<unknown> {
     const requestId = request.orchestrationRequestId
     if (!requestId || !isDurableMutation(request.method, params)) {
@@ -61,7 +64,7 @@ export class OrchestrationMutationExecutor {
     }
     const callerFingerprint =
       callerFingerprintOverride ?? this.getLocalAuthenticatedCallerFingerprint()
-    const stableParams = replayStableCallerParams(this.runtime, params)
+    const stableParams = replayStableCallerParams(this.runtime, params, callerOrcaSessionId)
     const basePayloadHash = hashCanonical({ method: request.method, params: stableParams })
     const key = `${callerFingerprint}:${requestId}`
     const db = this.runtime.getOrchestrationDb()
diff --git a/src/main/runtime/rpc/orchestration-mutation-receipt.ts b/src/main/runtime/rpc/orchestration-mutation-receipt.ts
index 25a3fa1c177..1d94723550b 100644
--- a/src/main/runtime/rpc/orchestration-mutation-receipt.ts
+++ b/src/main/runtime/rpc/orchestration-mutation-receipt.ts
@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto'
 import { isTerminalPromptMutation } from '../../../shared/orchestration-rpc-contract'
 import { parsePaneKey } from '../../../shared/stable-pane-id'
 import type { OrcaRuntimeService } from '../orca-runtime'
+import type { OrcaSessionId } from '../../../shared/orca-session-address'
 
 export const EFFECT_FREE_WORKER_DONE_CHECKPOINT = JSON.stringify({
   pending: { effectFree: 'worker_done' }
@@ -13,12 +14,21 @@ export type MutationReplayNudge =
   | { kind: 'messages'; targets: { to: string; type: string }[] }
   | { kind: 'federation'; runId?: string }
 
-export function replayStableCallerParams(runtime: OrcaRuntimeService, params: unknown): unknown {
+const CALLER_ORCA_SESSION_ID_KEY = '__orcaCallerOrcaSessionId'
+
+export function replayStableCallerParams(
+  runtime: OrcaRuntimeService,
+  params: unknown,
+  callerOrcaSessionId?: OrcaSessionId
+): unknown {
   if (!params || typeof params !== 'object' || Array.isArray(params)) {
     return params
   }
   const source = params as Record<string, unknown>
-  const result = { ...source }
+  // Absent for terminal callers, so their payload hashes are unchanged.
+  const result: Record<string, unknown> = callerOrcaSessionId
+    ? { ...source, [CALLER_ORCA_SESSION_ID_KEY]: callerOrcaSessionId }
+    : { ...source }
   delete result.waitSubmitMs
   for (const property of ['from', 'callerTerminalHandle', 'terminal'] as const) {
     const handle = source[property]
diff --git a/src/main/runtime/rpc/orchestration-party-addressing.test.ts b/src/main/runtime/rpc/orchestration-party-addressing.test.ts
new file mode 100644
index 00000000000..5c281583f0a
--- /dev/null
+++ b/src/main/runtime/rpc/orchestration-party-addressing.test.ts
@@ -0,0 +1,321 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { formatOrcaSessionAddress } from '../../../shared/orca-session-address'
+import { testOrcaSessionId } from '../../../shared/orca-session-address-test-fixture'
+import { ORCHESTRATION_SESSION_CALLER_ERROR_CODES as CODES } from '../../../shared/orchestration-session-caller-codes'
+import { ORCHESTRATION_TARGET_PARAM } from '../orchestration/orchestration-party'
+import {
+  mintStructuredWorkerHandle,
+  mintStructuredWorkerPaneKey,
+  structuredWorkerIdentities,
+  structuredWorkerProcessIncarnation
+} from '../structured-worker-identity'
+import {
+  ADDRESS_X,
+  ADDRESS_Y,
+  createSessionCallerHarness,
+  idOf,
+  orchestrationRequest,
+  resultOf,
+  SESSION_X,
+  SESSION_Y,
+  sessionRecord,
+  WORKER_HANDLE,
+  WORKER_PANE,
+  type SessionCallerHarness
+} from './orchestration-session-caller-test-fixture'
+
+const hostRef = vi.hoisted((): { current: unknown } => ({ current: null }))
+vi.mock('../../native-chat/agent-session-wire/structured-agent-session-registry', () => ({
+  getStructuredAgentSessionHost: () => hostRef.current
+}))
+
+type Row = Record<string, unknown>
+
+const SESSION_Z = testOrcaSessionId('3f9a1c7e-6b2d-4e85-a0c4-9d1e7b3f5a26')
+const ADDRESS_Z = formatOrcaSessionAddress(SESSION_Z)
+
+/** Worker Y's two spellings; a chat has only its session address. */
+const handle = mintStructuredWorkerHandle()
+const paneKey = mintStructuredWorkerPaneKey(SESSION_Y)
+const WORKER_SPELLINGS = [
+  ['its handle', handle],
+  ['its session address', ADDRESS_Y]
+] as const
+
+let h: SessionCallerHarness
+
+beforeEach(() => {
+  h = createSessionCallerHarness(hostRef)
+  h.records.set(SESSION_Z, sessionRecord(SESSION_Z))
+  structuredWorkerIdentities.register({
+    handle,
+    sessionId: SESSION_Y,
+    agent: 'claude',
+    paneKey,
+    processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+    worktreeId: 'wt_1',
+    hostScope: { kind: 'local', hostId: 'local' }
+  })
+})
+
+afterEach(() => {
+  h.close()
+  vi.restoreAllMocks()
+})
+
+function call(sessionId: string | undefined, method: string, params: Row) {
+  return h.dispatch(orchestrationRequest(method, params, { sessionId }))
+}
+
+async function as(sessionId: string | undefined, method: string, params: Row): Promise<Row> {
+  return resultOf(await call(sessionId, method, params))
+}
+
+function chatRun(sessionId = SESSION_X): Promise<string> {
+  return as(sessionId, 'orchestration.runCreate', { objective: 'o' }).then(({ run }) => idOf(run))
+}
+
+/** Worker Y assigned a Dispatch in `runId`, as `worker-start` leaves it. */
+function assignWorker(runId: string): string {
+  return h.db.createDispatchContext({
+    taskId: h.db.createTask({ runId, spec: 'work' }).id,
+    assigneeHandle: handle,
+    assigneePaneKey: paneKey,
+    processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+    creator: { kind: 'session', orcaSessionId: SESSION_X },
+    maxDepth: Number.MAX_SAFE_INTEGER
+  }).id
+}
+
+/** The PTY terminal assigned a Dispatch in a Run, so it may ask that Run's coordinator. */
+function assignTerminal(runId: string): void {
+  h.db.createDispatchContext({
+    taskId: h.db.createTask({ runId, spec: 'sub' }).id,
+    assigneeHandle: WORKER_HANDLE,
+    assigneePaneKey: WORKER_PANE,
+    creator: { kind: 'system' },
+    maxDepth: Number.MAX_SAFE_INTEGER
+  })
+}
+
+describe('every target param resolves both spellings of a party to one canonical address', () => {
+  it('covers exactly the target params the contract lists', () => {
+    expect(Object.keys(ORCHESTRATION_TARGET_PARAM).sort()).toEqual(
+      [
+        'orchestration.send',
+        'orchestration.ask',
+        'orchestration.dispatch',
+        'orchestration.inbox'
+      ].sort()
+    )
+  })
+
+  it.each(WORKER_SPELLINGS)('send: a worker at %s gets its Dispatch mailbox', async (_l, to) => {
+    const dispatchId = assignWorker(await chatRun())
+    const { message } = await as(undefined, 'orchestration.send', {
+      from: WORKER_HANDLE,
+      to,
+      subject: 's'
+    })
+    expect(message).toMatchObject({ to_handle: `dispatch:${dispatchId}` })
+  })
+
+  it("send: a chat's session address is its own direct mailbox", async () => {
+    const { message } = await as(undefined, 'orchestration.send', {
+      from: WORKER_HANDLE,
+      to: ADDRESS_Z,
+      subject: 's'
+    })
+    expect(message).toMatchObject({ to_handle: ADDRESS_Z })
+  })
+
+  it.each(WORKER_SPELLINGS)('ask: a worker coordinator is asked at %s', async (_l, to) => {
+    assignWorker(await chatRun())
+    const childRun = idOf((await as(SESSION_Y, 'orchestration.runCreate', { objective: 'c' })).run)
+    assignTerminal(childRun)
+    const asked = await as(undefined, 'orchestration.ask', {
+      from: WORKER_HANDLE,
+      to,
+      question: 'q',
+      timeoutMs: 0
+    })
+    expect(h.db.getQuestion(String(asked.messageId))).toMatchObject({ run_id: childRun })
+  })
+
+  it("ask: a chat coordinator is asked at its session address, and not at a worker's", async () => {
+    const runId = await chatRun()
+    assignTerminal(runId)
+    const ask = (to: string) =>
+      call(undefined, 'orchestration.ask', { from: WORKER_HANDLE, to, question: 'q', timeoutMs: 0 })
+
+    expect(await ask(ADDRESS_X)).toMatchObject({ ok: true })
+    expect(await ask(ADDRESS_Y)).toMatchObject({
+      ok: false,
+      error: { code: 'dispatch_run_mismatch' }
+    })
+  })
+
+  it.each(WORKER_SPELLINGS)(
+    'dispatch: a worker named by %s is the assignee, and its check reads the Dispatch',
+    async (_l, to) => {
+      const runId = await chatRun()
+      const task = h.db.createTask({ runId, spec: 'work' })
+
+      const { dispatch } = await as(SESSION_X, 'orchestration.dispatch', { task: task.id, to })
+
+      expect(dispatch).toMatchObject({
+        assignee_handle: handle,
+        assignee_orca_session_id: SESSION_Y
+      })
+      expect(await as(SESSION_Y, 'orchestration.check', { peek: true })).toMatchObject({
+        dispatchId: idOf(dispatch)
+      })
+    }
+  )
+
+  it('dispatch: refuses a chat assignee with no row written', async () => {
+    const runId = await chatRun()
+    const task = h.db.createTask({ runId, spec: 'work' })
+
+    const response = await call(SESSION_X, 'orchestration.dispatch', {
+      task: task.id,
+      to: ADDRESS_Z
+    })
+
+    expect(response).toMatchObject({
+      ok: false,
+      error: {
+        code: CODES.chatNotDispatchable,
+        message: `Agent session ${SESSION_Z} is a chat, and a chat can't receive a dispatch yet. Start a worker with worker-start instead. No effects were applied.`,
+        data: { effectsApplied: false }
+      }
+    })
+    expect(h.db.db.prepare('SELECT COUNT(*) AS n FROM dispatch_contexts').get()).toEqual({ n: 0 })
+    expect(h.db.getTask(task.id)?.status).toBe('ready')
+  })
+
+  it.each(WORKER_SPELLINGS)('inbox: a worker named by %s lists its mail', async (_l, terminal) => {
+    const runId = await chatRun()
+    h.db.insertMessage({ from: 'term_x', to: handle, subject: 'direct', body: '', runId })
+
+    const { messages } = await as(undefined, 'orchestration.inbox', { terminal })
+
+    expect(messages).toEqual([expect.objectContaining({ subject: 'direct', to_handle: handle })])
+  })
+
+  it("inbox: a chat's session address lists its direct mail", async () => {
+    await as(undefined, 'orchestration.send', { from: WORKER_HANDLE, to: ADDRESS_Z, subject: 'z' })
+    const { messages } = await as(undefined, 'orchestration.inbox', { terminal: ADDRESS_Z })
+    expect(messages).toEqual([expect.objectContaining({ subject: 'z' })])
+  })
+})
+
+describe('a caller declared by a session address, on a request with no session id', () => {
+  it.each(WORKER_SPELLINGS)(
+    'sends as the worker named by %s, from its handle',
+    async (_l, from) => {
+      const { message } = await as(undefined, 'orchestration.send', {
+        from,
+        to: ADDRESS_Z,
+        subject: 's'
+      })
+      expect(message).toMatchObject({ from_handle: handle })
+    }
+  )
+
+  it('checks the worker named by its session address as if it had named its handle', async () => {
+    const dispatchId = assignWorker(await chatRun())
+    await as(SESSION_X, 'orchestration.send', { to: handle, subject: 'work' })
+
+    const byAddress = await as(undefined, 'orchestration.check', { terminal: ADDRESS_Y, all: true })
+    const byHandle = await as(undefined, 'orchestration.check', { terminal: handle, all: true })
+
+    expect(byAddress).toEqual(byHandle)
+    expect(byAddress).toMatchObject({ dispatchId, messages: [{ subject: 'work' }] })
+  })
+
+  it("refuses a chat's session address, with no effects", async () => {
+    const response = await call(undefined, 'orchestration.send', {
+      from: ADDRESS_Z,
+      to: WORKER_HANDLE,
+      subject: 's'
+    })
+
+    expect(response).toMatchObject({
+      ok: false,
+      error: {
+        code: CODES.chatNotDeclarable,
+        message: expect.stringContaining(`Agent session ${SESSION_Z} is a chat`),
+        data: { effectsApplied: false }
+      }
+    })
+    expect(h.db.getInbox()).toEqual([])
+  })
+})
+
+describe('a structured worker that coordinates a child Run while assigned in its parent', () => {
+  it.each(WORKER_SPELLINGS)(
+    'gets mail at %s in the child Run it reads, even with no live pane',
+    async (_l, to) => {
+      assignWorker(await chatRun())
+      const childRun = idOf(
+        (await as(SESSION_Y, 'orchestration.runCreate', { objective: 'c' })).run
+      )
+      // The harness answers no live pane for a structured handle, as for an evicted session.
+      expect(h.runtime.getLiveTerminalPaneKey(handle)).toBeNull()
+
+      for (const sender of [SESSION_X, undefined]) {
+        const { message } = await as(sender, 'orchestration.send', {
+          ...(sender ? {} : { from: WORKER_HANDLE }),
+          to,
+          subject: `from ${sender ?? 'terminal'}`
+        })
+        expect(message).toMatchObject({ to_handle: `run:${childRun}` })
+      }
+      expect(await as(SESSION_Y, 'orchestration.check', { peek: true })).toMatchObject({
+        runId: childRun,
+        count: 2
+      })
+    }
+  )
+})
+
+describe('no writer stores a structured worker under its session address', () => {
+  it('keeps every to_handle and from_handle at the canonical address across every mail writer', async () => {
+    const runId = await chatRun()
+    const task = h.db.createTask({ runId, spec: 'work' })
+    await as(SESSION_X, 'orchestration.dispatch', { task: task.id, to: ADDRESS_Y })
+    assignTerminal(runId)
+
+    for (const to of [ADDRESS_Y, handle]) {
+      await as(SESSION_X, 'orchestration.send', { to, subject: 'down' })
+    }
+    const fromWorker = await as(SESSION_Y, 'orchestration.send', {
+      from: ADDRESS_Y,
+      to: ADDRESS_X,
+      subject: 'up'
+    })
+    await as(undefined, 'orchestration.send', { from: ADDRESS_Y, to: WORKER_HANDLE, subject: 'u' })
+    await as(SESSION_X, 'orchestration.reply', {
+      id: idOf(fromWorker.message),
+      body: 'noted'
+    })
+    await as(SESSION_X, 'orchestration.send', { to: '@all', subject: 'everyone' })
+    await as(undefined, 'orchestration.ask', {
+      from: WORKER_HANDLE,
+      to: ADDRESS_X,
+      question: 'q',
+      timeoutMs: 0
+    })
+
+    const stored = h.db.db
+      .prepare(
+        `SELECT m.id FROM messages AS m JOIN dispatch_contexts AS d
+           ON d.assignee_orca_session_id IS NOT NULL
+          AND 'session:' || d.assignee_orca_session_id IN (m.to_handle, m.from_handle)`
+      )
+      .all()
+    expect(h.db.getInbox(100).length).toBeGreaterThanOrEqual(7)
+    expect(stored).toEqual([])
+  })
+})
diff --git a/src/main/runtime/rpc/orchestration-party-agreement.test.ts b/src/main/runtime/rpc/orchestration-party-agreement.test.ts
new file mode 100644
index 00000000000..b0e0d302474
--- /dev/null
+++ b/src/main/runtime/rpc/orchestration-party-agreement.test.ts
@@ -0,0 +1,207 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { formatOrcaSessionAddress, type OrcaSessionId } from '../../../shared/orca-session-address'
+import { testOrcaSessionId } from '../../../shared/orca-session-address-test-fixture'
+import { ORCHESTRATION_SESSION_CALLER_ERROR_CODES as CODES } from '../../../shared/orchestration-session-caller-codes'
+import {
+  mintStructuredWorkerHandle,
+  mintStructuredWorkerPaneKey,
+  structuredWorkerIdentities,
+  structuredWorkerProcessIncarnation
+} from '../structured-worker-identity'
+import {
+  ADDRESS_X,
+  createSessionCallerHarness,
+  idOf,
+  orchestrationRequest,
+  resultOf,
+  SESSION_X,
+  SESSION_Y,
+  sessionRecord,
+  WORKER_HANDLE,
+  type SessionCallerHarness
+} from './orchestration-session-caller-test-fixture'
+
+// A `/clear`ed member of X's lineage and of worker Y's, as a later lineage walk will map them.
+const ALIAS_X = testOrcaSessionId('5c7e2a94-1d3b-4f68-b9a0-e4c2d6f81b37')
+const ALIAS_Y = testOrcaSessionId('8a4d6f20-3e1c-4b79-a5d2-c0f7e9b3a164')
+
+const hostRef = vi.hoisted((): { current: unknown } => ({ current: null }))
+vi.mock('../../native-chat/agent-session-wire/structured-agent-session-registry', () => ({
+  getStructuredAgentSessionHost: () => hostRef.current
+}))
+vi.mock('../orchestration/canonical-orca-session-id', () => ({
+  canonicalOrcaSessionId: (id: string) =>
+    id === '5c7e2a94-1d3b-4f68-b9a0-e4c2d6f81b37'
+      ? '4a1f6c2e-8b3d-4e7a-9c15-0d2b6e8f1a37'
+      : id === '8a4d6f20-3e1c-4b79-a5d2-c0f7e9b3a164'
+        ? '7e3b9d15-2c4a-4f86-a0b1-5c9e2d7f3b64'
+        : id
+}))
+
+type Row = Record<string, unknown>
+
+const handle = mintStructuredWorkerHandle()
+const paneKey = mintStructuredWorkerPaneKey(SESSION_Y)
+let h: SessionCallerHarness
+
+beforeEach(() => {
+  h = createSessionCallerHarness(hostRef)
+  h.records.set(ALIAS_X, sessionRecord(ALIAS_X))
+  h.records.set(ALIAS_Y, sessionRecord(ALIAS_Y))
+})
+
+afterEach(() => {
+  h.close()
+  vi.restoreAllMocks()
+})
+
+function call(sessionId: string | undefined, method: string, params: Row) {
+  return h.dispatch(orchestrationRequest(method, params, { sessionId }))
+}
+
+async function as(sessionId: string | undefined, method: string, params: Row): Promise<Row> {
+  return resultOf(await call(sessionId, method, params))
+}
+
+function registerWorker(): void {
+  structuredWorkerIdentities.register({
+    handle,
+    sessionId: SESSION_Y,
+    agent: 'claude',
+    paneKey,
+    processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+    worktreeId: 'wt_1',
+    hostScope: { kind: 'local', hostId: 'local' }
+  })
+}
+
+/** A Dispatch naming Y as a structured worker, in a Run a terminal coordinates. */
+function recordWorkerDispatch(): void {
+  const run = h.db.createRun({
+    objective: 'pty',
+    coordinatorHandle: 'term_c',
+    coordinatorPaneKey: 'tab_c:13131313-1313-4313-8313-131313131313'
+  })
+  h.db.createDispatchContext({
+    taskId: h.db.createTask({ runId: run.id, spec: 'work' }).id,
+    assigneeHandle: handle,
+    assigneePaneKey: paneKey,
+    processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+    creator: { kind: 'system' },
+    maxDepth: Number.MAX_SAFE_INTEGER
+  })
+}
+
+type PartyState = { name: string; sessionId: OrcaSessionId; setup: () => Promise<void> | void }
+
+const PARTY_STATES: PartyState[] = [
+  { name: 'a chat with no Run', sessionId: SESSION_X, setup: () => {} },
+  {
+    name: 'a chat coordinating a Run',
+    sessionId: SESSION_X,
+    setup: async () => void (await as(SESSION_X, 'orchestration.runCreate', { objective: 'o' }))
+  },
+  {
+    name: 'a registered worker with a Dispatch',
+    sessionId: SESSION_Y,
+    setup: () => {
+      registerWorker()
+      recordWorkerDispatch()
+    }
+  },
+  {
+    name: 'a recorded worker whose identity is gone',
+    sessionId: SESSION_Y,
+    setup: recordWorkerDispatch
+  },
+  {
+    name: 'a chat that runs on another host',
+    sessionId: SESSION_X,
+    setup: () => {
+      h.records.set(SESSION_X, sessionRecord(SESSION_X, { location: { executionHostId: 'ssh:b' } }))
+    }
+  }
+]
+
+describe('the caller a session id resolves to and the recipient its address resolves to agree', () => {
+  it.each(PARTY_STATES.map((state) => [state.name, state] as const))('%s', async (_name, state) => {
+    await state.setup()
+    const sent = await call(undefined, 'orchestration.send', {
+      from: WORKER_HANDLE,
+      to: formatOrcaSessionAddress(state.sessionId),
+      subject: 'agree'
+    })
+    const read = await call(state.sessionId, 'orchestration.check', { peek: true })
+
+    // Both refuse, or the caller reads exactly the mail sent to its address.
+    expect(sent.ok).toBe(read.ok)
+    if (read.ok) {
+      expect(resultOf(read)).toMatchObject({ messages: [{ subject: 'agree' }] })
+    }
+  })
+
+  it('refuses a worker whose identity is gone with one code, as caller and as recipient', async () => {
+    recordWorkerDispatch()
+    const asCaller = await call(SESSION_Y, 'orchestration.runCurrent', {})
+    const asRecipient = await call(undefined, 'orchestration.send', {
+      from: WORKER_HANDLE,
+      to: formatOrcaSessionAddress(SESSION_Y),
+      subject: 's'
+    })
+    for (const response of [asCaller, asRecipient]) {
+      expect(response).toMatchObject({ ok: false, error: { code: CODES.notLive } })
+    }
+  })
+})
+
+describe('every session-to-party step goes through the canonical session id', () => {
+  it('binds a claimed alias as its canonical session', async () => {
+    const { run } = await as(ALIAS_X, 'orchestration.runCreate', { objective: 'o' })
+    expect(h.db.getRunRaw(idOf(run))?.coordinator_orca_session_id).toBe(SESSION_X)
+    expect(await as(SESSION_X, 'orchestration.runCurrent', {})).toMatchObject({
+      run: { id: idOf(run) }
+    })
+  })
+
+  it("delivers mail to an alias's address at the canonical session's mailbox", async () => {
+    const { message } = await as(undefined, 'orchestration.send', {
+      from: WORKER_HANDLE,
+      to: formatOrcaSessionAddress(ALIAS_X),
+      subject: 's'
+    })
+    expect(message).toMatchObject({ to_handle: ADDRESS_X })
+  })
+
+  it("resolves a worker alias's address to the worker's handle", async () => {
+    registerWorker()
+    const { message } = await as(undefined, 'orchestration.send', {
+      from: formatOrcaSessionAddress(ALIAS_Y),
+      to: ADDRESS_X,
+      subject: 's'
+    })
+    expect(message).toMatchObject({ from_handle: handle })
+  })
+
+  it.each([formatOrcaSessionAddress(ALIAS_X), ALIAS_X])(
+    'accepts the session declared as its alias %s',
+    async (declared) => {
+      const { run } = await as(SESSION_X, 'orchestration.runCreate', {
+        objective: 'o',
+        from: declared
+      })
+      expect(run).toMatchObject({ coordinator_handle: null })
+    }
+  )
+
+  it('refuses an alias of a chat declared on a request with no session id, naming the chat', async () => {
+    const response = await call(undefined, 'orchestration.send', {
+      from: formatOrcaSessionAddress(ALIAS_X),
+      to: WORKER_HANDLE,
+      subject: 's'
+    })
+    expect(response).toMatchObject({
+      ok: false,
+      error: { code: CODES.chatNotDeclarable, message: expect.stringContaining(SESSION_X) }
+    })
+  })
+})
diff --git a/src/main/runtime/rpc/orchestration-session-caller-test-fixture.ts b/src/main/runtime/rpc/orchestration-session-caller-test-fixture.ts
new file mode 100644
index 00000000000..396b0b2bec7
--- /dev/null
+++ b/src/main/runtime/rpc/orchestration-session-caller-test-fixture.ts
@@ -0,0 +1,167 @@
+import { vi } from 'vitest'
+import type { AgentSessionLease, AgentSessionRecord } from '../../../shared/agent-session-record'
+import {
+  agentSessionLeaseFixture,
+  agentSessionRecordFixture
+} from '../../../shared/agent-session-record.test-fixture'
+import type { OrchestrationCompatibilityEvidence } from '../../../shared/orchestration-compatibility-evidence'
+import { ORCHESTRATION_CONTRACT_VERSION } from '../../../shared/protocol-version'
+import { formatOrcaSessionAddress } from '../../../shared/orca-session-address'
+import { testOrcaSessionId } from '../../../shared/orca-session-address-test-fixture'
+import { OrcaRuntimeService } from '../orca-runtime'
+import { OrchestrationDb } from '../orchestration/db'
+import { structuredWorkerIdentities } from '../structured-worker-identity'
+import type { RpcRequest, RpcResponse } from './core'
+import { RpcDispatcher } from './dispatcher'
+import { ORCHESTRATION_METHODS } from './methods/orchestration'
+
+export const SESSION_X = testOrcaSessionId('4a1f6c2e-8b3d-4e7a-9c15-0d2b6e8f1a37')
+export const SESSION_Y = testOrcaSessionId('7e3b9d15-2c4a-4f86-a0b1-5c9e2d7f3b64')
+export const ADDRESS_X = formatOrcaSessionAddress(SESSION_X)
+export const ADDRESS_Y = formatOrcaSessionAddress(SESSION_Y)
+export const PROVIDER_ID_X = 'c0ffee11-2233-4455-8677-8899aabbccdd'
+export const WORKSPACE_X = 'repo_1::/work/tree-x'
+export const WORKER_HANDLE = 'term_worker'
+export const WORKER_PANE = 'tab_worker:77777777-7777-4777-8777-777777777777'
+
+export type SessionHostRef = { current: unknown }
+
+/** A live chat session record; the lease and location can be pushed into any state. */
+export function sessionRecord(
+  sessionId: string,
+  overrides: {
+    lease?: Partial<AgentSessionLease>
+    location?: Partial<AgentSessionRecord['location']>
+    providerId?: string
+  } = {}
+): AgentSessionRecord {
+  const base = agentSessionRecordFixture(
+    agentSessionLeaseFixture({ sessionId, runtimeKind: 'native', ...overrides.lease })
+  )
+  return {
+    ...base,
+    location: { ...base.location, workspaceId: WORKSPACE_X, ...overrides.location },
+    providerHandleChain: base.providerHandleChain.map((link) => ({
+      ...link,
+      handle: {
+        provider: 'claude' as const,
+        sessionId: overrides.providerId ?? `provider-${sessionId}`,
+        leafUuid: null
+      }
+    }))
+  }
+}
+
+export type SessionCallerHarness = {
+  runtime: OrcaRuntimeService
+  db: OrchestrationDb
+  dispatcher: RpcDispatcher
+  records: Map<string, AgentSessionRecord>
+  /** Unary socket route: what the local CLI's Unix socket and Electron IPC reach. */
+  dispatch: (request: RpcRequest) => Promise<RpcResponse>
+  /** Streaming dispatcher, optionally as a paired client on another host. */
+  dispatchStreaming: (request: RpcRequest, pairedDeviceId?: string) => Promise<unknown>
+  close: () => void
+}
+
+export function createSessionCallerHarness(hostRef: SessionHostRef): SessionCallerHarness {
+  const db = new OrchestrationDb(':memory:')
+  const runtime = new OrcaRuntimeService()
+  runtime.setOrchestrationDb(db)
+  vi.spyOn(runtime, 'ensureStructuredAgentSessionHost').mockResolvedValue()
+  vi.spyOn(runtime, 'getTerminalPaneKey').mockImplementation((handle) =>
+    handle === WORKER_HANDLE ? WORKER_PANE : null
+  )
+  vi.spyOn(runtime, 'getLiveTerminalPaneKey').mockImplementation((handle) =>
+    runtime.getTerminalPaneKey(handle)
+  )
+  const records = new Map<string, AgentSessionRecord>([
+    [SESSION_X, sessionRecord(SESSION_X, { providerId: PROVIDER_ID_X })],
+    [SESSION_Y, sessionRecord(SESSION_Y)]
+  ])
+  hostRef.current = {
+    deps: {
+      store: {
+        getRecord: (sessionId: string) => records.get(sessionId) ?? null,
+        listRecords: () => [...records.values()]
+      }
+    }
+  }
+  structuredWorkerIdentities.clear()
+  const dispatcher = new RpcDispatcher({ runtime, methods: ORCHESTRATION_METHODS })
+  return {
+    runtime,
+    db,
+    dispatcher,
+    records,
+    dispatch: (request) => dispatcher.dispatch(request),
+    dispatchStreaming: async (request, pairedDeviceId) => {
+      const replies: string[] = []
+      await dispatcher.dispatchStreaming(
+        request,
+        (reply) => replies.push(reply),
+        pairedDeviceId ? { pairedDeviceId } : {}
+      )
+      const [reply] = replies
+      if (replies.length !== 1 || reply === undefined) {
+        throw new Error(`expected exactly one reply, got ${replies.length}`)
+      }
+      const parsed: unknown = JSON.parse(reply)
+      return parsed
+    },
+    close: () => {
+      hostRef.current = null
+      structuredWorkerIdentities.clear()
+      db.close()
+    }
+  }
+}
+
+let requestCounter = 0
+
+/** An orchestration request as the CLI sends it, naming its caller by session id when given. */
+export function orchestrationRequest(
+  method: string,
+  params: Record<string, unknown>,
+  options: {
+    sessionId?: string
+    requestId?: string
+    evidence?: OrchestrationCompatibilityEvidence
+  } = {}
+): RpcRequest {
+  requestCounter += 1
+  const requestId = options.requestId ?? `req-${requestCounter}`
+  const evidence =
+    options.sessionId === undefined
+      ? options.evidence
+      : { ...options.evidence, agentSessionId: options.sessionId }
+  return {
+    id: `rpc-${requestCounter}`,
+    authToken: 'test',
+    method,
+    params,
+    orchestrationContractVersion: ORCHESTRATION_CONTRACT_VERSION,
+    orchestrationRequestId: requestId,
+    compatibilityInvocationId: requestId,
+    ...(evidence ? { orchestrationCompatibilityEvidence: evidence } : {})
+  }
+}
+
+export function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+export function resultOf(response: unknown): Record<string, unknown> {
+  if (!isRecord(response) || response.ok !== true || !isRecord(response.result)) {
+    throw new Error(`expected a successful response, got ${JSON.stringify(response)}`)
+  }
+  return response.result
+}
+
+/** The `id` of a row a receipt carries. */
+export function idOf(row: unknown): string {
+  if (!isRecord(row) || typeof row.id !== 'string') {
+    throw new Error(`expected a row with an id, got ${JSON.stringify(row)}`)
+  }
+  return row.id
+}
diff --git a/src/main/runtime/rpc/orchestration-session-caller.test.ts b/src/main/runtime/rpc/orchestration-session-caller.test.ts
new file mode 100644
index 00000000000..d6ab1ba3ccb
--- /dev/null
+++ b/src/main/runtime/rpc/orchestration-session-caller.test.ts
@@ -0,0 +1,478 @@
+import { mkdtempSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { ZodObject } from 'zod'
+import type { OrchestrationCompatibilityEvidence } from '../../../shared/orchestration-compatibility-evidence'
+import { ORCHESTRATION_SESSION_CALLER_ERROR_CODES as CODES } from '../../../shared/orchestration-session-caller-codes'
+import { DeviceRegistry } from '../device-registry'
+import { OrcaRuntimeRpcServer } from '../runtime-rpc'
+import { buildRegistry } from './core'
+import { ORCHESTRATION_METHODS } from './methods/orchestration'
+import {
+  mintStructuredWorkerHandle,
+  mintStructuredWorkerPaneKey,
+  structuredWorkerProcessIncarnation
+} from '../structured-worker-identity'
+import {
+  ADDRESS_X,
+  createSessionCallerHarness,
+  orchestrationRequest,
+  PROVIDER_ID_X,
+  idOf,
+  resultOf,
+  SESSION_X,
+  SESSION_Y,
+  sessionRecord,
+  type SessionCallerHarness
+} from './orchestration-session-caller-test-fixture'
+import {
+  needsOrchestrationCallerResolution,
+  ORCHESTRATION_CALLER_PARAM
+} from './orchestration-session-caller'
+import { ORCHESTRATION_TARGET_PARAM } from '../orchestration/orchestration-party'
+
+const hostRef = vi.hoisted((): { current: unknown } => ({ current: null }))
+vi.mock('../../native-chat/agent-session-wire/structured-agent-session-registry', () => ({
+  getStructuredAgentSessionHost: () => hostRef.current
+}))
+
+// Fields that can name a party: the caller in ORCHESTRATION_CALLER_PARAM, a target in ORCHESTRATION_TARGET_PARAM.
+const PARTY_NAMING_FIELDS = ['to', 'from', 'terminal', 'callerTerminalHandle'] as const
+// `method field` pairs with such a field that is neither, so never resolves as a party.
+const NAMES_NO_RESOLVED_PARTY: Readonly<Record<string, string>> = {
+  'orchestration.run from': 'retired; refused before any handler',
+  'orchestration.runShow from': 'reads a Run by id; `from` is unused',
+  'orchestration.dispatchShow from': '`from` only fills the preview preamble text',
+  'orchestration.workerStart terminal': 'adopts an existing PTY pane, which a session never has',
+  'orchestration.federationAttachStart terminal': 'names the remote worker terminal',
+  'orchestration.workerTerminalUserInput terminal': 'names the worker terminal'
+}
+
+/** One request per identity-consulting method, valid enough to reach the dispatcher entry. */
+const MINIMAL_PARAMS: Readonly<Record<string, Record<string, unknown>>> = {
+  'orchestration.runCreate': { objective: 'o' },
+  'orchestration.runUse': { id: 'run_missing' },
+  'orchestration.runCurrent': {},
+  'orchestration.check': {},
+  'orchestration.send': { subject: 's', to: 'term_worker' },
+  'orchestration.reply': { id: 'msg_missing', body: 'b' },
+  'orchestration.ask': { question: 'q', to: 'term_worker' },
+  'orchestration.dispatch': { task: 'task_missing', to: 'term_worker' },
+  'orchestration.gateCreate': { task: 'task_missing', question: 'q' },
+  'orchestration.gateResolve': { id: 'gate_missing', resolution: 'r' },
+  'orchestration.gateList': {},
+  'orchestration.taskCreate': { spec: 's' },
+  'orchestration.taskList': {},
+  'orchestration.taskUpdate': { id: 'task_missing', status: 'completed' },
+  'orchestration.workerStart': { spec: 's' }
+}
+
+describe('orchestration session callers at the dispatch entry', () => {
+  let h: SessionCallerHarness
+
+  beforeEach(() => {
+    h = createSessionCallerHarness(hostRef)
+  })
+
+  afterEach(() => {
+    h.close()
+    vi.restoreAllMocks()
+  })
+
+  it('classifies every party-naming field as the caller, a resolved target, or neither', () => {
+    const registry = buildRegistry(ORCHESTRATION_METHODS)
+    const partyNaming = [...registry.values()]
+      .flatMap((method) => {
+        const schema = method.params
+        return schema instanceof ZodObject
+          ? PARTY_NAMING_FIELDS.filter((field) => Object.hasOwn(schema.shape, field)).map(
+              (field) => `${method.name} ${field}`
+            )
+          : []
+      })
+      .sort()
+
+    // The population: 41 registered methods carrying 25 party-naming fields.
+    expect(registry.size).toBe(41)
+    expect(partyNaming).toHaveLength(25)
+    expect(partyNaming).toEqual(
+      [
+        ...Object.entries(ORCHESTRATION_CALLER_PARAM).map(
+          ([method, field]) => `${method} ${field}`
+        ),
+        ...Object.entries(ORCHESTRATION_TARGET_PARAM).map(
+          ([method, field]) => `${method} ${field}`
+        ),
+        ...Object.keys(NAMES_NO_RESOLVED_PARTY)
+      ].sort()
+    )
+    expect(Object.keys(MINIMAL_PARAMS).sort()).toEqual(
+      Object.keys(ORCHESTRATION_CALLER_PARAM).sort()
+    )
+  })
+
+  it.each(Object.keys(ORCHESTRATION_CALLER_PARAM))(
+    'refuses %s from a paired client before any effect, naming the host boundary',
+    async (method) => {
+      const response = await h.dispatchStreaming(
+        orchestrationRequest(method, MINIMAL_PARAMS[method] ?? {}, { sessionId: SESSION_X }),
+        'paired-device-1'
+      )
+
+      expect(response).toMatchObject({
+        ok: false,
+        error: {
+          code: CODES.hostBoundary,
+          message: expect.stringContaining('only on the host that runs that session'),
+          data: { effectsApplied: false }
+        }
+      })
+      expect(h.db.listRuns().runs.filter((run) => run.legacy === 0)).toEqual([])
+    }
+  )
+
+  it.each(Object.keys(ORCHESTRATION_CALLER_PARAM))(
+    'resolves %s on the local route as the session, never as a terminal',
+    async (method) => {
+      const spy = vi.spyOn(h.runtime, 'verifyOrchestrationCompatibilityCaller')
+      const response = await h.dispatch(
+        orchestrationRequest(method, MINIMAL_PARAMS[method] ?? {}, {
+          sessionId: SESSION_X,
+          evidence: {
+            terminalHandle: 'term_other',
+            paneKey: 'tab_other:1:2',
+            launchToken: 'secret'
+          }
+        })
+      )
+
+      // Whatever the method answers, it answered as the session: no host-boundary or session refusal,
+      // and terminal evidence on the same request never attested anyone.
+      if (!response.ok) {
+        expect(Object.values(CODES)).not.toContain(response.error.code)
+        expect(response.error.message).not.toContain('term_other')
+      }
+      for (const [evidence] of spy.mock.calls) {
+        expect(evidence?.terminalHandle).toBeUndefined()
+      }
+    }
+  )
+
+  it('admits the session on the real Unix-socket route and refuses it on the real paired route', async () => {
+    const userDataPath = mkdtempSync(join(tmpdir(), 'orca-session-caller-'))
+    const server = new OrcaRuntimeRpcServer({
+      runtime: h.runtime,
+      userDataPath,
+      enableWebSocket: false
+    })
+    server['deviceRegistry'] = new DeviceRegistry(userDataPath)
+    const device = server['deviceRegistry'].addDevice('laptop', 'runtime')
+    const request = orchestrationRequest(
+      'orchestration.runCreate',
+      { objective: 'o' },
+      {
+        sessionId: SESSION_X
+      }
+    )
+
+    const replies: string[] = []
+    await server['handleWebSocketMessage'](
+      JSON.stringify({ ...request, deviceToken: device.token }),
+      (reply) => replies.push(reply),
+      () => {},
+      undefined,
+      undefined,
+      device.token
+    )
+    expect(JSON.parse(replies[0] ?? '{}')).toMatchObject({
+      ok: false,
+      error: { code: CODES.hostBoundary }
+    })
+
+    const local = await server['handleMessage'](
+      JSON.stringify({ ...request, authToken: server['authToken'] })
+    )
+    expect(local).toMatchObject({ ok: true, result: { run: { objective: 'o' } } })
+    expect(
+      h.db.getCurrentRunForCoordinator({
+        terminalHandle: null,
+        paneKey: null,
+        orcaSessionId: SESSION_X
+      })
+    ).toMatchObject({ objective: 'o', coordinator_orca_session_id: SESSION_X })
+  })
+
+  describe('refuses a session that cannot act, before any destructive or consuming lookup', () => {
+    function seedPendingMail(): { runId: string; messageId: string } {
+      const run = h.db.createRun({
+        objective: 'x',
+        coordinatorHandle: null,
+        coordinatorPaneKey: null,
+        coordinatorOrcaSessionId: SESSION_X
+      })
+      const message = h.db.insertMessage({
+        from: 'term_worker',
+        to: ADDRESS_X,
+        subject: 'pending',
+        body: '',
+        runId: run.id
+      })
+      return { runId: run.id, messageId: message.id }
+    }
+
+    async function expectRefusedWithNoEffects(
+      sessionId: string,
+      code: string,
+      message: RegExp,
+      evidence?: OrchestrationCompatibilityEvidence
+    ): Promise<void> {
+      const { messageId } = seedPendingMail()
+      for (const [method, params] of [
+        ['orchestration.check', {}],
+        ['orchestration.reset', { messages: true }]
+      ] as const) {
+        const response = await h.dispatch(
+          orchestrationRequest(method, params, { sessionId, evidence })
+        )
+        expect(response, method).toMatchObject({
+          ok: false,
+          error: { code, message: expect.stringMatching(message) }
+        })
+      }
+      expect(h.db.getMessageById(messageId)).toMatchObject({ read: 0 })
+    }
+
+    it('an id that names no Orca session', async () => {
+      await expectRefusedWithNoEffects(
+        'ffffffff-0000-4000-8000-000000000000',
+        CODES.unknown,
+        /No Orca agent session .* exists on this host/
+      )
+    })
+
+    it('a terminal handle presented as a session id', async () => {
+      await expectRefusedWithNoEffects('term_4f2c9a0b', CODES.unknown, /not an Orca session id/)
+    })
+
+    it("a provider's session id, with a hint naming the Orca id", async () => {
+      const response = await h.dispatch(
+        orchestrationRequest('orchestration.runCurrent', {}, { sessionId: PROVIDER_ID_X })
+      )
+      expect(response).toMatchObject({
+        ok: false,
+        error: {
+          code: CODES.providerId,
+          message: expect.stringContaining(`This session's Orca id is ${SESSION_X}`),
+          data: { orcaSessionId: SESSION_X, effectsApplied: false }
+        }
+      })
+      await expectRefusedWithNoEffects(PROVIDER_ID_X, CODES.providerId, /changes on \/clear/)
+    })
+
+    it('a released lease', async () => {
+      h.records.set(SESSION_X, sessionRecord(SESSION_X, { lease: { claimStatus: 'released' } }))
+      await expectRefusedWithNoEffects(SESSION_X, CODES.notLive, /is not running right now/)
+    })
+
+    it('a lease mid owner change', async () => {
+      h.records.set(
+        SESSION_X,
+        sessionRecord(SESSION_X, {
+          lease: { handoffStage: 'new-owner-proving', handoffOperationId: 'op' }
+        })
+      )
+      await expectRefusedWithNoEffects(SESSION_X, CODES.notLive, /is changing owners/)
+    })
+
+    it('a lease the host has not reconciled since restart', async () => {
+      h.records.set(SESSION_X, sessionRecord(SESSION_X, { lease: { unreconciled: true } }))
+      await expectRefusedWithNoEffects(SESSION_X, CODES.notLive, /no live owner/)
+    })
+
+    it('a session whose record says it runs on another host', async () => {
+      h.records.set(
+        SESSION_X,
+        sessionRecord(SESSION_X, { location: { executionHostId: 'ssh:devbox' } })
+      )
+      await expectRefusedWithNoEffects(SESSION_X, CODES.hostBoundary, /runs on another host/)
+    })
+
+    it('a request from an SSH or WSL environment', async () => {
+      await expectRefusedWithNoEffects(SESSION_X, CODES.hostBoundary, /an SSH environment/, {
+        host: { kind: 'ssh', targetId: 't', connectionIncarnation: 'c', attachmentId: 'a' }
+      })
+      await expectRefusedWithNoEffects(SESSION_X, CODES.hostBoundary, /a WSL environment/, {
+        host: { kind: 'wsl', hostId: 'local', distro: 'Ubuntu' }
+      })
+    })
+
+    it('a structured worker session whose worker identity this host no longer has', async () => {
+      // A Dispatch recorded the session as a worker; no registry entry or custody row maps it now.
+      const run = h.db.createRun({
+        objective: 'pty',
+        coordinatorHandle: 'term_c',
+        coordinatorPaneKey: 'tab_c:13131313-1313-4313-8313-131313131313'
+      })
+      h.db.createDispatchContext({
+        taskId: h.db.createTask({ runId: run.id, spec: 'work' }).id,
+        assigneeHandle: mintStructuredWorkerHandle(),
+        assigneePaneKey: mintStructuredWorkerPaneKey(SESSION_Y),
+        processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+        creator: { kind: 'system' },
+        maxDepth: Number.MAX_SAFE_INTEGER
+      })
+
+      const response = await h.dispatch(
+        orchestrationRequest(
+          'orchestration.runCreate',
+          { objective: 'o' },
+          { sessionId: SESSION_Y }
+        )
+      )
+
+      expect(response).toMatchObject({
+        ok: false,
+        error: { code: CODES.notLive, message: expect.stringContaining('no longer has') }
+      })
+      expect(
+        h.db.listRuns().runs.filter((row) => row.coordinator_orca_session_id !== null)
+      ).toEqual([])
+    })
+
+    it('an agent-session host that cannot be brought up to verify it', async () => {
+      hostRef.current = null
+      await expectRefusedWithNoEffects(SESSION_X, CODES.notLive, /cannot be verified/)
+    })
+  })
+
+  describe('a declared caller must name the session', () => {
+    it('refuses a declared terminal handle that is not the session', async () => {
+      const response = await h.dispatch(
+        orchestrationRequest(
+          'orchestration.runCreate',
+          { objective: 'o', from: 'term_sibling' },
+          { sessionId: SESSION_X }
+        )
+      )
+      expect(response).toMatchObject({
+        ok: false,
+        error: {
+          code: 'consumer_fenced',
+          message: `This caller is agent session ${SESSION_X} and cannot act as term_sibling. No effects were applied.`
+        }
+      })
+      expect(h.db.listRuns().runs.filter((run) => run.legacy === 0)).toEqual([])
+    })
+
+    it("refuses a caller-supplied pane key on check, the restart fallback's substitute", async () => {
+      const response = await h.dispatch(
+        orchestrationRequest(
+          'orchestration.check',
+          { terminalPaneKey: 'tab_worker:77777777-7777-4777-8777-777777777777' },
+          { sessionId: SESSION_X }
+        )
+      )
+      expect(response).toMatchObject({ ok: false, error: { code: 'consumer_fenced' } })
+    })
+
+    it('accepts a /clear successor naming the address it had before the clear, and no other', async () => {
+      // Y continued X after a /clear, so X's address is Y's: the lineage root names the chat.
+      h.records.set(SESSION_X, {
+        ...sessionRecord(SESSION_X),
+        conversationCommand: {
+          command: 'clear',
+          state: 'completed',
+          replacementSessionId: SESSION_Y,
+          operationId: 'op',
+          callerKey: 'caller',
+          phase: 'committed'
+        }
+      })
+      const run = resultOf(
+        await h.dispatch(
+          orchestrationRequest(
+            'orchestration.runCreate',
+            { objective: 'o', from: ADDRESS_X },
+            { sessionId: SESSION_Y }
+          )
+        )
+      ).run
+      expect(h.db.getRunRaw(idOf(run))?.coordinator_orca_session_id).toBe(SESSION_X)
+
+      const stranger = 'session:0b5e2d7c-9a41-4c3e-8f62-7d1a3e5b9c08'
+      const refused = await h.dispatch(
+        orchestrationRequest(
+          'orchestration.runCreate',
+          { objective: 'o', from: stranger },
+          { sessionId: SESSION_Y }
+        )
+      )
+      expect(refused).toMatchObject({ ok: false, error: { code: 'consumer_fenced' } })
+    })
+
+    it.each(['orchestration.gateList', 'orchestration.taskList'])(
+      'checks a caller %s names beside --run: the /clear root is the chat, a stranger is refused',
+      async (method) => {
+        h.records.set(SESSION_X, {
+          ...sessionRecord(SESSION_X),
+          conversationCommand: {
+            command: 'clear',
+            state: 'completed',
+            replacementSessionId: SESSION_Y,
+            operationId: 'op',
+            callerKey: 'caller',
+            phase: 'committed'
+          }
+        })
+        const runId = idOf(
+          resultOf(
+            await h.dispatch(
+              orchestrationRequest(
+                'orchestration.runCreate',
+                { objective: 'o' },
+                { sessionId: SESSION_Y }
+              )
+            )
+          ).run
+        )
+        const param = ORCHESTRATION_CALLER_PARAM[method]!
+        const listed = await h.dispatch(
+          orchestrationRequest(method, { run: runId, [param]: ADDRESS_X }, { sessionId: SESSION_Y })
+        )
+        expect(resultOf(listed)).toMatchObject({ runId })
+
+        const stranger = 'session:0b5e2d7c-9a41-4c3e-8f62-7d1a3e5b9c08'
+        const refused = await h.dispatch(
+          orchestrationRequest(method, { run: runId, [param]: stranger }, { sessionId: SESSION_Y })
+        )
+        expect(refused).toMatchObject({ ok: false, error: { code: 'consumer_fenced' } })
+      }
+    )
+
+    it.each([ADDRESS_X, SESSION_X])('accepts the session named as %s', async (declared) => {
+      const run = resultOf(
+        await h.dispatch(
+          orchestrationRequest(
+            'orchestration.runCreate',
+            { objective: 'o', from: declared },
+            { sessionId: SESSION_X }
+          )
+        )
+      ).run
+      expect(run).toMatchObject({ objective: 'o', coordinator_handle: null })
+    })
+  })
+
+  it('leaves a terminal caller untouched: no claim, no normalization, no extra hop', async () => {
+    const request = orchestrationRequest('orchestration.runCreate', {
+      objective: 'o',
+      from: 'term_worker'
+    })
+    expect(needsOrchestrationCallerResolution(request)).toBe(false)
+
+    const run = resultOf(await h.dispatch(request)).run
+    expect(run).toMatchObject({ coordinator_handle: 'term_worker' })
+    expect(h.db.getRunRaw(idOf(run))?.coordinator_orca_session_id).toBeNull()
+  })
+})
diff --git a/src/main/runtime/rpc/orchestration-session-caller.ts b/src/main/runtime/rpc/orchestration-session-caller.ts
new file mode 100644
index 00000000000..0d2253481b4
--- /dev/null
+++ b/src/main/runtime/rpc/orchestration-session-caller.ts
@@ -0,0 +1,278 @@
+/**
+ * Resolves an orchestration caller that names itself by the Orca agent session id in its injected
+ * environment. Both dispatchers call this once, before params parse and the unary/streaming split,
+ * so it runs ahead of legacy compatibility, receipt lookup and every method. Before parsing, so a
+ * session caller need not name itself in a param that requires a caller.
+ *
+ * The id names the caller; nothing here is a credential. Every agent on this host runs as the same
+ * user, so the checks are about getting the identity right, not about keeping anyone out:
+ * - Same host only. A paired client, an SSH environment or a WSL shell is another host, where
+ *   "same machine, same user" does not hold, so a session claim from one is refused.
+ * - The Orca id, never the provider's: that one rotates on `/clear`.
+ * - A live lease: released, mid owner change or unreconciled sessions cannot act.
+ * - The session wins over any declared caller: a declared handle must name this same session, and
+ *   a structured worker's session id maps to the handle and pane it was minted.
+ * - A request with no session id that declares a `session:` caller gets the party it names: a
+ *   worker's handle, or a refusal for a chat, whose address alone identifies nobody.
+ */
+import { agentSessionLeaseAdmitsWriter } from '../../../shared/agent-session-lease-adjudication'
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import { isOrcaSessionId, parseOrcaSessionAddress } from '../../../shared/orca-session-address'
+import { ORCHESTRATION_SESSION_CALLER_ERROR_CODES as CODES } from '../../../shared/orchestration-session-caller-codes'
+import type { OrcaRuntimeService } from '../orca-runtime'
+import type { OrchestrationSessionCaller } from '../orchestration/orchestration-caller-identity'
+import { OrchestrationError } from '../orchestration/orchestration-error'
+import { canonicalOrcaSessionId } from '../orchestration/canonical-orca-session-id'
+import type { OrchestrationDb } from '../orchestration/db'
+import {
+  resolveDeclaredCallerParty,
+  resolveOrcaSessionParty,
+  resolveOrchestrationParty
+} from '../orchestration/orchestration-party'
+import { lookupOrcaAgentSession } from '../orchestration/structured-session-mail-address'
+import { readAgentSessionRecordStore } from '../orchestration/structured-session-lineage'
+import { structuredWorkerHostScope } from '../structured-worker-identity'
+import type { RpcRequest } from './core'
+
+type CallerParam = 'from' | 'terminal' | 'callerTerminalHandle'
+
+/**
+ * Every method that consults caller identity, and the param it names its caller in. This list is
+ * the contract: a method that starts reading caller identity is added here with its own test.
+ * Methods not listed carry no caller identity for any caller; a session claim on them is still
+ * validated, then they run exactly as they do for a terminal caller.
+ */
+export const ORCHESTRATION_CALLER_PARAM: Readonly<Record<string, CallerParam>> = {
+  'orchestration.runCreate': 'from',
+  'orchestration.runUse': 'from',
+  'orchestration.runCurrent': 'from',
+  'orchestration.check': 'terminal',
+  'orchestration.send': 'from',
+  'orchestration.reply': 'from',
+  'orchestration.ask': 'from',
+  'orchestration.dispatch': 'from',
+  'orchestration.gateCreate': 'from',
+  'orchestration.gateResolve': 'from',
+  'orchestration.gateList': 'from',
+  'orchestration.taskCreate': 'callerTerminalHandle',
+  'orchestration.taskList': 'callerTerminalHandle',
+  'orchestration.taskUpdate': 'callerTerminalHandle',
+  'orchestration.workerStart': 'from'
+}
+
+export type OrchestrationRequestRoute = {
+  /** Set only by the paired WebSocket route: the request came from another host's client. */
+  pairedDeviceId?: string
+}
+
+export type ResolvedOrchestrationRequest = {
+  /** The request with its declared caller bound to the session and its evidence reduced to it. */
+  request: RpcRequest
+  caller?: OrchestrationSessionCaller
+}
+
+const NO_EFFECTS = { effectsApplied: false } as const
+
+/**
+ * Whether this request names its caller by a session id, or declares a `session:` address as its
+ * caller. Synchronous, so every other request, terminal callers included, takes no extra async hop.
+ */
+export function needsOrchestrationCallerResolution(request: RpcRequest): boolean {
+  if (!request.method.startsWith('orchestration.')) {
+    return false
+  }
+  return (
+    request.orchestrationCompatibilityEvidence?.agentSessionId !== undefined ||
+    declaredSessionAddress(request) !== undefined
+  )
+}
+
+function declaredSessionAddress(request: RpcRequest): string | undefined {
+  const name = ORCHESTRATION_CALLER_PARAM[request.method]
+  const params: unknown = request.params
+  if (!name || !params || typeof params !== 'object' || Array.isArray(params)) {
+    return undefined
+  }
+  const values: Record<string, unknown> = { ...params }
+  const declared = values[name]
+  return typeof declared === 'string' && parseOrcaSessionAddress(declared) ? declared : undefined
+}
+
+/** Only for a request `needsOrchestrationCallerResolution` accepts. Throws the refusal, if any. */
+export async function resolveOrchestrationSessionCaller(
+  runtime: OrcaRuntimeService,
+  request: RpcRequest,
+  route: OrchestrationRequestRoute | undefined
+): Promise<ResolvedOrchestrationRequest> {
+  const evidence = request.orchestrationCompatibilityEvidence
+  if (evidence?.agentSessionId === undefined) {
+    return { request: bindDeclaredSessionAddress(runtime.getOrchestrationDb(), request) }
+  }
+  const claimed: unknown = evidence?.agentSessionId
+  if (route?.pairedDeviceId !== undefined) {
+    throw hostBoundary(
+      'This request reached Orca from a paired client, and an agent session id identifies a caller only on the host that runs that session.'
+    )
+  }
+  if (evidence?.host) {
+    throw hostBoundary(
+      `This command ran in ${evidence.host.kind === 'ssh' ? 'an SSH' : 'a WSL'} environment, and an agent session id identifies a caller only on the host that runs that session.`
+    )
+  }
+  if (typeof claimed !== 'string' || !isOrcaSessionId(claimed)) {
+    throw new OrchestrationError(
+      CODES.unknown,
+      'The caller named an agent session id that is not an Orca session id. No effects were applied.',
+      NO_EFFECTS
+    )
+  }
+  const sessionId = claimed
+  const record = await readSessionRecord(runtime, sessionId)
+  assertSessionCanAct(sessionId, record)
+  const db = runtime.getOrchestrationDb()
+  const caller: OrchestrationSessionCaller = Object.freeze({
+    ...resolveOrcaSessionParty(sessionId, db),
+    sessionId,
+    workspaceId: record.location.workspaceId
+  })
+  return {
+    request: {
+      ...request,
+      params: bindDeclaredCaller(request.method, request.params, caller, db),
+      // Why: the session wins, so any terminal evidence on the same request never attests.
+      orchestrationCompatibilityEvidence: { agentSessionId: sessionId }
+    },
+    caller
+  }
+}
+
+async function readSessionRecord(
+  runtime: OrcaRuntimeService,
+  sessionId: string
+): Promise<AgentSessionRecord> {
+  let store: ReturnType<typeof readAgentSessionRecordStore>
+  try {
+    await runtime.ensureStructuredAgentSessionHost()
+    store = readAgentSessionRecordStore()
+  } catch {
+    store = null
+  }
+  if (!store) {
+    throw new OrchestrationError(
+      CODES.notLive,
+      `Agent session ${sessionId} cannot be verified: this Orca is not running its agent-session host. No effects were applied.`,
+      NO_EFFECTS
+    )
+  }
+  const found = lookupOrcaAgentSession(store, sessionId)
+  if (found.kind === 'found') {
+    return found.record
+  }
+  if (found.kind === 'provider-id') {
+    throw new OrchestrationError(
+      CODES.providerId,
+      `${sessionId} is the provider's own session id, which changes on /clear. This session's Orca id is ${found.orcaSessionId}; use that instead. No effects were applied.`,
+      { ...NO_EFFECTS, orcaSessionId: found.orcaSessionId }
+    )
+  }
+  throw new OrchestrationError(
+    CODES.unknown,
+    `No Orca agent session ${sessionId} exists on this host. No effects were applied.`,
+    NO_EFFECTS
+  )
+}
+
+function assertSessionCanAct(sessionId: string, record: AgentSessionRecord): void {
+  if (!structuredWorkerHostScope(record.location)) {
+    throw hostBoundary(
+      `Agent session ${sessionId} runs on another host, and an agent session id identifies a caller only on the host that runs that session.`
+    )
+  }
+  if (agentSessionLeaseAdmitsWriter(record.lease)) {
+    return
+  }
+  const { lease } = record
+  const reason =
+    lease.claimStatus === 'released'
+      ? // Why not "ended": a released lease is evicted and wakeable; only a running process may act.
+        'is not running right now. A new message or user turn revives it; retry then.'
+      : lease.handoffStage !== null
+        ? 'is changing owners on this host. Retry when that finishes.'
+        : 'has no live owner on this host right now. Retry once it is running.'
+  throw new OrchestrationError(
+    CODES.notLive,
+    `Agent session ${sessionId} ${reason} No effects were applied.`,
+    NO_EFFECTS
+  )
+}
+
+/** A request with no session id that declares a `session:` caller: a worker's is its handle. */
+function bindDeclaredSessionAddress(db: OrchestrationDb, request: RpcRequest): RpcRequest {
+  const name = ORCHESTRATION_CALLER_PARAM[request.method]
+  const declared = declaredSessionAddress(request)
+  const params: unknown = request.params
+  if (!name || declared === undefined || !params || typeof params !== 'object') {
+    return request
+  }
+  const party = resolveDeclaredCallerParty(declared, db)
+  return { ...request, params: { ...params, [name]: party.address } }
+}
+
+/** Whether a declared caller names this session: any spelling that resolves to its party. */
+function declaredNamesCaller(
+  declared: unknown,
+  caller: OrchestrationSessionCaller,
+  db: OrchestrationDb
+): boolean {
+  if (typeof declared !== 'string') {
+    return false
+  }
+  if (isOrcaSessionId(declared)) {
+    return canonicalOrcaSessionId(declared) === caller.orcaSessionId
+  }
+  try {
+    return resolveOrchestrationParty(declared, db).address === caller.address
+  } catch {
+    return false
+  }
+}
+
+/** The declared caller, if any, must name this session; it is then replaced by its address. */
+function bindDeclaredCaller(
+  method: string,
+  params: unknown,
+  caller: OrchestrationSessionCaller,
+  db: OrchestrationDb
+): unknown {
+  const name = ORCHESTRATION_CALLER_PARAM[method]
+  if (!name || !params || typeof params !== 'object' || Array.isArray(params)) {
+    return params
+  }
+  const values: Record<string, unknown> = { ...params }
+  const declared = values[name]
+  if (declared !== undefined && !declaredNamesCaller(declared, caller, db)) {
+    throw consumerFenced(caller, String(declared))
+  }
+  // Why: check's restart fallback takes a pane key from the caller; a session has its own or none.
+  if (values.terminalPaneKey !== undefined && values.terminalPaneKey !== caller.paneKey) {
+    throw consumerFenced(caller, `pane ${String(values.terminalPaneKey)}`)
+  }
+  values[name] = caller.address
+  return values
+}
+
+function consumerFenced(caller: OrchestrationSessionCaller, declared: string): OrchestrationError {
+  return new OrchestrationError(
+    'consumer_fenced',
+    `This caller is agent session ${caller.sessionId} and cannot act as ${declared}. No effects were applied.`,
+    NO_EFFECTS
+  )
+}
+
+function hostBoundary(reason: string): OrchestrationError {
+  return new OrchestrationError(
+    CODES.hostBoundary,
+    `${reason} Run the command on that host. No effects were applied.`,
+    NO_EFFECTS
+  )
+}
diff --git a/src/main/runtime/rpc/orchestration-session-coordinator.test.ts b/src/main/runtime/rpc/orchestration-session-coordinator.test.ts
new file mode 100644
index 00000000000..a60c3a16916
--- /dev/null
+++ b/src/main/runtime/rpc/orchestration-session-coordinator.test.ts
@@ -0,0 +1,637 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  mintStructuredWorkerHandle,
+  mintStructuredWorkerPaneKey,
+  structuredWorkerIdentities,
+  structuredWorkerProcessIncarnation
+} from '../structured-worker-identity'
+import {
+  ADDRESS_X,
+  ADDRESS_Y,
+  createSessionCallerHarness,
+  orchestrationRequest,
+  idOf,
+  resultOf,
+  SESSION_X,
+  SESSION_Y,
+  WORKER_HANDLE,
+  WORKER_PANE,
+  WORKSPACE_X,
+  type SessionCallerHarness
+} from './orchestration-session-caller-test-fixture'
+
+const hostRef = vi.hoisted((): { current: unknown } => ({ current: null }))
+vi.mock('../../native-chat/agent-session-wire/structured-agent-session-registry', () => ({
+  getStructuredAgentSessionHost: () => hostRef.current
+}))
+
+type Row = Record<string, unknown>
+
+describe('a structured chat coordinates through the same verbs as a terminal', () => {
+  let h: SessionCallerHarness
+
+  beforeEach(() => {
+    h = createSessionCallerHarness(hostRef)
+  })
+
+  afterEach(() => {
+    h.close()
+    vi.restoreAllMocks()
+  })
+
+  async function as(sessionId: string | undefined, method: string, params: Row): Promise<Row> {
+    return resultOf(await h.dispatch(orchestrationRequest(method, params, { sessionId })))
+  }
+
+  async function runCreate(sessionId: string, objective = 'o'): Promise<string> {
+    const { run } = await as(sessionId, 'orchestration.runCreate', { objective })
+    return idOf(run)
+  }
+
+  it('runs the supervised loop: run, task, dispatch, worker mail in, check, send, reply, gates', async () => {
+    const runId = await runCreate(SESSION_X)
+    expect(h.db.getRunRaw(runId)).toMatchObject({
+      coordinator_handle: null,
+      coordinator_pane_key: null,
+      coordinator_orca_session_id: SESSION_X
+    })
+    expect(await as(SESSION_X, 'orchestration.runCurrent', {})).toMatchObject({
+      run: { id: runId }
+    })
+
+    const { task } = await as(SESSION_X, 'orchestration.taskCreate', { spec: 'do it' })
+    const taskId = idOf(task)
+    expect(task).toMatchObject({ run_id: runId, created_by_terminal_handle: null })
+    expect(await as(SESSION_X, 'orchestration.taskList', {})).toMatchObject({ runId, count: 1 })
+
+    const { dispatch } = await as(SESSION_X, 'orchestration.dispatch', {
+      task: taskId,
+      to: WORKER_HANDLE
+    })
+    expect(dispatch).toMatchObject({
+      assignee_handle: WORKER_HANDLE,
+      creator_handle: null,
+      creator_pane_key: null,
+      creator_orca_session_id: SESSION_X,
+      depth: 1
+    })
+
+    // The worker writes to its coordinator's public address.
+    const { message: inbound } = await as(undefined, 'orchestration.send', {
+      from: WORKER_HANDLE,
+      to: ADDRESS_X,
+      subject: 'progress'
+    })
+    expect(inbound).toMatchObject({ to_handle: `run:${runId}`, run_id: runId })
+
+    const checked = await as(SESSION_X, 'orchestration.check', {})
+    expect(checked).toMatchObject({ runId, count: 1, messages: [{ subject: 'progress' }] })
+
+    const { message: outbound } = await as(SESSION_X, 'orchestration.send', {
+      to: WORKER_HANDLE,
+      subject: 'more'
+    })
+    expect(outbound).toMatchObject({
+      from_handle: ADDRESS_X,
+      to_handle: `dispatch:${idOf(dispatch)}`,
+      run_id: runId
+    })
+
+    const replied = await as(SESSION_X, 'orchestration.reply', {
+      id: idOf(inbound),
+      body: 'ack'
+    })
+    expect(replied).toMatchObject({
+      message: {
+        from_handle: ADDRESS_X,
+        to_handle: `dispatch:${idOf(dispatch)}`,
+        run_id: runId,
+        thread_id: idOf(inbound)
+      }
+    })
+    expect(await as(undefined, 'orchestration.check', { terminal: WORKER_HANDLE })).toMatchObject({
+      runId,
+      dispatchId: idOf(dispatch),
+      count: 2,
+      messages: [{ id: idOf(outbound) }, { id: idOf(replied.message) }]
+    })
+
+    const { gate } = await as(SESSION_X, 'orchestration.gateCreate', {
+      task: taskId,
+      question: 'ship?'
+    })
+    expect(await as(SESSION_X, 'orchestration.gateList', {})).toMatchObject({ runId, count: 1 })
+    expect(
+      await as(SESSION_X, 'orchestration.gateResolve', {
+        id: idOf(gate),
+        resolution: 'yes'
+      })
+    ).toMatchObject({ gate: { status: 'resolved' } })
+
+    expect(
+      await as(SESSION_X, 'orchestration.taskUpdate', { id: taskId, status: 'completed' })
+    ).toMatchObject({ task: { status: 'completed' } })
+  })
+
+  it("files a session's mail to a plain terminal under its own Run", async () => {
+    const runId = await runCreate(SESSION_X)
+    const { message } = await as(SESSION_X, 'orchestration.send', {
+      to: WORKER_HANDLE,
+      subject: 'no dispatch here'
+    })
+    expect(message).toMatchObject({
+      from_handle: ADDRESS_X,
+      to_handle: WORKER_HANDLE,
+      run_id: runId
+    })
+  })
+
+  it("addresses a group to the session's own Run", async () => {
+    await runCreate(SESSION_X)
+    const response = await h.dispatch(
+      orchestrationRequest(
+        'orchestration.send',
+        { to: '@all', subject: 'everyone' },
+        {
+          sessionId: SESSION_X
+        }
+      )
+    )
+    // The audience resolved to the session's Run; that Run simply has no workers yet.
+    expect(response).toMatchObject({
+      ok: false,
+      error: {
+        code: 'terminal_not_found',
+        message: 'No recipients resolved for group address: @all'
+      }
+    })
+  })
+
+  it('asks as a coordinator does: only a supervised worker may ask', async () => {
+    await runCreate(SESSION_X)
+    const response = await h.dispatch(
+      orchestrationRequest(
+        'orchestration.ask',
+        { question: 'q', to: WORKER_HANDLE },
+        {
+          sessionId: SESSION_X
+        }
+      )
+    )
+    expect(response).toMatchObject({ ok: false, error: { code: 'dispatch_inactive' } })
+  })
+
+  it("lets its worker ask it at its session address, the one the worker's preamble names", async () => {
+    const runId = await runCreate(SESSION_X)
+    const taskId = idOf((await as(SESSION_X, 'orchestration.taskCreate', { spec: 'q' })).task)
+    await as(SESSION_X, 'orchestration.dispatch', { task: taskId, to: WORKER_HANDLE })
+
+    const asked = await as(undefined, 'orchestration.ask', {
+      from: WORKER_HANDLE,
+      to: ADDRESS_X,
+      question: 'which way?',
+      timeoutMs: 0
+    })
+    expect(asked).toMatchObject({ timedOut: true })
+    expect(h.db.getQuestion(String(asked.messageId))).toMatchObject({ run_id: runId })
+  })
+
+  it("places a worker-start in the session's own workspace", async () => {
+    const runId = await runCreate(SESSION_X)
+    vi.spyOn(h.runtime, 'validateOrchestrationAgentLauncher').mockImplementation(() => {})
+    const placed = vi
+      .spyOn(h.runtime, 'showManagedTerminalWorkspace')
+      .mockRejectedValue(new Error('placement reached'))
+    const response = await h.dispatch(
+      orchestrationRequest(
+        'orchestration.workerStart',
+        { spec: 'work', run: runId, agent: 'claude' },
+        {
+          sessionId: SESSION_X
+        }
+      )
+    )
+    expect(placed).toHaveBeenCalledWith(`id:${WORKSPACE_X}`)
+    expect(response).toMatchObject({ ok: false, error: { message: 'placement reached' } })
+  })
+
+  it("never lets one chat's run-create unbind another chat's Run", async () => {
+    const xFirst = await runCreate(SESSION_X, 'x first')
+    const yRun = await runCreate(SESSION_Y, 'y')
+    const xSecond = await runCreate(SESSION_X, 'x second')
+
+    expect(await as(SESSION_Y, 'orchestration.runCurrent', {})).toMatchObject({
+      run: { id: yRun }
+    })
+    expect(await as(SESSION_X, 'orchestration.runCurrent', {})).toMatchObject({
+      run: { id: xSecond }
+    })
+    expect(h.db.getRunRaw(xFirst)?.coordinator_orca_session_id).toBeNull()
+  })
+
+  it('takes over a bound Run like a terminal does, and fences the previous coordinator', async () => {
+    const runId = await runCreate(SESSION_X)
+    await as(undefined, 'orchestration.send', {
+      from: WORKER_HANDLE,
+      to: ADDRESS_X,
+      subject: 'before takeover',
+      run: runId
+    })
+
+    expect(await as(SESSION_Y, 'orchestration.runUse', { id: runId })).toMatchObject({
+      run: { id: runId }
+    })
+
+    const previous = await h.dispatch(
+      orchestrationRequest('orchestration.check', { run: runId }, { sessionId: SESSION_X })
+    )
+    expect(previous).toMatchObject({
+      ok: false,
+      error: {
+        code: 'consumer_fenced',
+        message: `This coordinator terminal is no longer bound to Run ${runId}.`
+      }
+    })
+    expect(await as(SESSION_X, 'orchestration.runCurrent', {})).toMatchObject({ run: null })
+    expect(await as(SESSION_Y, 'orchestration.check', {})).toMatchObject({
+      runId,
+      messages: [{ subject: 'before takeover' }]
+    })
+  })
+
+  it("wakes the previous coordinator's waiting check as fenced when another session takes over", async () => {
+    const runId = await runCreate(SESSION_X)
+    const waiter = vi.spyOn(h.runtime, 'waitForMessage')
+    const waiting = h.dispatch(
+      orchestrationRequest(
+        'orchestration.check',
+        { run: runId, wait: true, timeoutMs: 5_000 },
+        {
+          sessionId: SESSION_X
+        }
+      )
+    )
+    await vi.waitFor(() => expect(waiter).toHaveBeenCalledWith(`run:${runId}`, expect.anything()))
+    const deliver = vi.spyOn(h.db, 'getOrCreateRunDelivery')
+    const acknowledge = vi.spyOn(h.db, 'acknowledgeRunDelivery')
+
+    await as(SESSION_Y, 'orchestration.runUse', { id: runId })
+
+    const fenced = await waiting
+    expect(fenced).toMatchObject({ ok: false, error: { code: 'consumer_fenced' } })
+    expect(fenced).not.toHaveProperty('result')
+
+    const { message } = await as(undefined, 'orchestration.send', {
+      from: WORKER_HANDLE,
+      to: ADDRESS_Y,
+      subject: 'after takeover',
+      run: runId
+    })
+    expect(
+      await h.dispatch(
+        orchestrationRequest('orchestration.check', { run: runId }, { sessionId: SESSION_X })
+      )
+    ).toMatchObject({ ok: false, error: { code: 'consumer_fenced' } })
+    expect(deliver).not.toHaveBeenCalled()
+
+    const replacement = await as(SESSION_Y, 'orchestration.check', {})
+    expect(replacement).toMatchObject({
+      runId,
+      count: 1,
+      messages: [{ id: idOf(message), to_handle: `run:${runId}`, run_id: runId }]
+    })
+    const ack = replacement.deliveryId
+    if (typeof ack !== 'string') {
+      throw new Error('Expected a Run Delivery')
+    }
+    expect(
+      await h.dispatch(
+        orchestrationRequest('orchestration.check', { run: runId, ack }, { sessionId: SESSION_X })
+      )
+    ).toMatchObject({ ok: false, error: { code: 'consumer_fenced' } })
+    expect(acknowledge).not.toHaveBeenCalled()
+    expect(h.db.getDeliveryRaw(ack)?.acknowledged_at).toBeNull()
+    expect(await as(SESSION_Y, 'orchestration.check', {})).toMatchObject({
+      deliveryId: ack,
+      replayed: true,
+      messages: [{ id: idOf(message) }]
+    })
+    expect(await as(SESSION_Y, 'orchestration.check', { ack })).toMatchObject({
+      acknowledged: ack,
+      count: 0
+    })
+    expect(h.db.getDeliveryRaw(ack)?.status).toBe('acknowledged')
+  })
+
+  it('stops counting a coordinator Orca session id once an older binary rebinds the Run to a terminal', async () => {
+    const runId = await runCreate(SESSION_X)
+    // An older binary's bindRun rewrites handle and pane and bumps the generation, never the Orca session id.
+    h.db.db
+      .prepare(
+        `UPDATE runs SET coordinator_handle = ?, coordinator_pane_key = ?,
+           consumer_generation = consumer_generation + 1
+         WHERE id = ?`
+      )
+      .run(WORKER_HANDLE, WORKER_PANE, runId)
+
+    expect(await as(SESSION_X, 'orchestration.runCurrent', {})).toMatchObject({ run: null })
+    expect(await as(undefined, 'orchestration.runCurrent', { from: WORKER_HANDLE })).toMatchObject({
+      run: { id: runId }
+    })
+  })
+
+  it('replays an idempotent retry from the same session and refuses it from another', async () => {
+    const first = await h.dispatch(
+      orchestrationRequest(
+        'orchestration.runCreate',
+        { objective: 'o' },
+        {
+          sessionId: SESSION_X,
+          requestId: 'retry-1'
+        }
+      )
+    )
+    const retry = await h.dispatch(
+      orchestrationRequest(
+        'orchestration.runCreate',
+        { objective: 'o' },
+        {
+          sessionId: SESSION_X,
+          requestId: 'retry-1'
+        }
+      )
+    )
+    const other = await h.dispatch(
+      orchestrationRequest(
+        'orchestration.runCreate',
+        { objective: 'o' },
+        {
+          sessionId: SESSION_Y,
+          requestId: 'retry-1'
+        }
+      )
+    )
+
+    const firstRun = idOf(resultOf(first).run)
+    expect(resultOf(retry)).toMatchObject({ run: { id: firstRun }, mutation: { replayed: true } })
+    expect(other).toMatchObject({ ok: false, error: { code: 'request_mismatch' } })
+    expect(h.db.listRuns().runs.filter((run) => run.legacy === 0)).toHaveLength(1)
+  })
+})
+
+describe('a session with no Run, and receipts that carry no caller param', () => {
+  let h: SessionCallerHarness
+
+  beforeEach(() => {
+    h = createSessionCallerHarness(hostRef)
+  })
+
+  afterEach(() => {
+    h.close()
+    vi.restoreAllMocks()
+  })
+
+  it('reads its direct mailbox on a consuming check, as a terminal with a live pane does', async () => {
+    h.db.insertMessage({ from: WORKER_HANDLE, to: ADDRESS_X, subject: 'direct', body: '' })
+
+    const checked = resultOf(
+      await h.dispatch(orchestrationRequest('orchestration.check', {}, { sessionId: SESSION_X }))
+    )
+
+    expect(checked).toMatchObject({ messages: [{ subject: 'direct', to_handle: ADDRESS_X }] })
+  })
+
+  it('binds a receipt to the session even when the method names no caller', async () => {
+    const reset = (sessionId: string) =>
+      h.dispatch(
+        orchestrationRequest(
+          'orchestration.reset',
+          { messages: true },
+          {
+            sessionId,
+            requestId: 'reset-1'
+          }
+        )
+      )
+
+    expect(await reset(SESSION_X)).toMatchObject({ ok: true })
+    expect(await reset(SESSION_X)).toMatchObject({
+      ok: true,
+      result: { mutation: { replayed: true } }
+    })
+    expect(await reset(SESSION_Y)).toMatchObject({
+      ok: false,
+      error: { code: 'request_mismatch' }
+    })
+  })
+})
+
+describe('a structured worker that names itself by session id', () => {
+  let h: SessionCallerHarness
+  const workerSession = SESSION_Y
+  const handle = mintStructuredWorkerHandle()
+  const paneKey = mintStructuredWorkerPaneKey(workerSession)
+
+  beforeEach(() => {
+    h = createSessionCallerHarness(hostRef)
+    structuredWorkerIdentities.register({
+      handle,
+      sessionId: workerSession,
+      agent: 'claude',
+      paneKey,
+      processIncarnation: structuredWorkerProcessIncarnation(workerSession),
+      worktreeId: 'wt_1',
+      hostScope: { kind: 'local', hostId: 'local' }
+    })
+  })
+
+  afterEach(() => {
+    h.close()
+    vi.restoreAllMocks()
+  })
+
+  function dispatchToWorker(): { runId: string; dispatchId: string } {
+    const run = h.db.createRun({
+      objective: 'pty coordinator',
+      coordinatorHandle: 'term_coord',
+      coordinatorPaneKey: 'tab_coord:12121212-1212-4212-8212-121212121212'
+    })
+    const dispatch = h.db.createDispatchContext({
+      taskId: h.db.createTask({ runId: run.id, spec: 'work' }).id,
+      assigneeHandle: handle,
+      assigneePaneKey: paneKey,
+      processIncarnation: structuredWorkerProcessIncarnation(workerSession),
+      creator: { kind: 'system' },
+      maxDepth: Number.MAX_SAFE_INTEGER
+    })
+    h.db.insertMessage({
+      from: 'term_coord',
+      to: `dispatch:${dispatch.id}`,
+      subject: 'instructions',
+      body: '',
+      runId: run.id
+    })
+    return { runId: run.id, dispatchId: dispatch.id }
+  }
+
+  it("reads its own Dispatch mailbox: the session id wins and maps to the worker's handle", async () => {
+    const { dispatchId } = dispatchToWorker()
+    expect(h.db.getDispatchContextById(dispatchId)?.assignee_orca_session_id).toBe(SESSION_Y)
+
+    const bySession = resultOf(
+      await h.dispatch(
+        orchestrationRequest('orchestration.check', { peek: true }, { sessionId: workerSession })
+      )
+    )
+    expect(bySession).toMatchObject({ messages: [{ subject: 'instructions' }] })
+
+    const namedByHandle = resultOf(
+      await h.dispatch(
+        orchestrationRequest(
+          'orchestration.check',
+          { peek: true, terminal: handle },
+          {
+            sessionId: workerSession
+          }
+        )
+      )
+    )
+    expect(namedByHandle).toEqual(bySession)
+  })
+
+  it.each([
+    ['its handle', handle],
+    ['its session address', ADDRESS_Y],
+    ['its bare session id', workerSession]
+  ])('accepts itself declared as %s and binds by its handle', async (_label, declared) => {
+    const { run } = resultOf(
+      await h.dispatch(
+        orchestrationRequest(
+          'orchestration.runCreate',
+          { objective: 'declared', from: declared },
+          { sessionId: workerSession }
+        )
+      )
+    )
+    expect(h.db.getRunRaw(idOf(run))).toMatchObject({
+      coordinator_handle: handle,
+      coordinator_orca_session_id: SESSION_Y
+    })
+  })
+
+  it('sends mail at either of its spellings to its Dispatch once assigned in a Run it coordinated before', async () => {
+    const { run } = resultOf(
+      await h.dispatch(
+        orchestrationRequest(
+          'orchestration.runCreate',
+          { objective: 'o' },
+          { sessionId: workerSession }
+        )
+      )
+    )
+    const runId = idOf(run)
+    // A chat takes the Run over; the worker's addresses stay remembered as a former coordinator's.
+    resultOf(
+      await h.dispatch(
+        orchestrationRequest('orchestration.runUse', { id: runId }, { sessionId: SESSION_X })
+      )
+    )
+    expect(h.db.getRunMailboxOwnerIdsForHandle(ADDRESS_Y)).toEqual([runId])
+    const dispatch = h.db.createDispatchContext({
+      taskId: h.db.createTask({ runId, spec: 'work' }).id,
+      assigneeHandle: handle,
+      assigneePaneKey: paneKey,
+      processIncarnation: structuredWorkerProcessIncarnation(workerSession),
+      creator: { kind: 'session', orcaSessionId: SESSION_X },
+      maxDepth: Number.MAX_SAFE_INTEGER
+    })
+
+    // Both spellings name one party, so both land in the one mailbox it reads, not the Run's.
+    for (const to of [ADDRESS_Y, handle]) {
+      const { message } = resultOf(
+        await h.dispatch(
+          orchestrationRequest('orchestration.send', { to, subject: to }, { sessionId: SESSION_X })
+        )
+      )
+      expect(message).toMatchObject({ to_handle: `dispatch:${dispatch.id}` })
+    }
+    const read = resultOf(
+      await h.dispatch(
+        orchestrationRequest('orchestration.check', { peek: true }, { sessionId: workerSession })
+      )
+    )
+    expect(read).toMatchObject({
+      count: 2,
+      messages: expect.arrayContaining([
+        expect.objectContaining({ subject: handle }),
+        expect.objectContaining({ subject: ADDRESS_Y })
+      ])
+    })
+  })
+
+  it('coordinates with its handle, pane and Orca session id, one mailbox at both spellings', async () => {
+    const { run } = resultOf(
+      await h.dispatch(
+        orchestrationRequest(
+          'orchestration.runCreate',
+          { objective: 'nested' },
+          {
+            sessionId: workerSession
+          }
+        )
+      )
+    )
+    const runId = idOf(run)
+
+    expect(h.db.getRunRaw(runId)).toMatchObject({
+      coordinator_handle: handle,
+      coordinator_pane_key: paneKey,
+      coordinator_orca_session_id: SESSION_Y
+    })
+    expect(h.db.getRunMailboxOwnerIdsForHandle(handle)).toEqual([runId])
+    for (const to of [handle, ADDRESS_Y]) {
+      const { message } = resultOf(
+        await h.dispatch(
+          orchestrationRequest('orchestration.send', { from: WORKER_HANDLE, to, subject: to })
+        )
+      )
+      expect(message).toMatchObject({ to_handle: `run:${runId}` })
+    }
+  })
+
+  it.each([
+    ['its handle', handle],
+    ['its session address', ADDRESS_Y]
+  ])('is asked by its own worker at %s', async (_label, to) => {
+    const { run } = resultOf(
+      await h.dispatch(
+        orchestrationRequest(
+          'orchestration.runCreate',
+          { objective: 'o' },
+          { sessionId: workerSession }
+        )
+      )
+    )
+    const runId = idOf(run)
+    h.db.createDispatchContext({
+      taskId: h.db.createTask({ runId, spec: 'sub' }).id,
+      assigneeHandle: WORKER_HANDLE,
+      assigneePaneKey: WORKER_PANE,
+      creator: { kind: 'terminal', handle, paneKey, orcaSessionId: workerSession },
+      maxDepth: Number.MAX_SAFE_INTEGER
+    })
+
+    const asked = resultOf(
+      await h.dispatch(
+        orchestrationRequest('orchestration.ask', {
+          from: WORKER_HANDLE,
+          to,
+          question: 'which way?',
+          timeoutMs: 0
+        })
+      )
+    )
+    expect(asked).toMatchObject({ timedOut: true })
+    expect(h.db.getQuestion(String(asked.messageId))).toMatchObject({ run_id: runId })
+  })
+})
diff --git a/src/main/runtime/rpc/orchestration-session-recipient.test.ts b/src/main/runtime/rpc/orchestration-session-recipient.test.ts
new file mode 100644
index 00000000000..f8f2de266d4
--- /dev/null
+++ b/src/main/runtime/rpc/orchestration-session-recipient.test.ts
@@ -0,0 +1,332 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  mintStructuredWorkerHandle,
+  mintStructuredWorkerPaneKey,
+  structuredWorkerIdentities,
+  structuredWorkerProcessIncarnation
+} from '../structured-worker-identity'
+import {
+  ADDRESS_X,
+  ADDRESS_Y,
+  createSessionCallerHarness,
+  idOf,
+  isRecord,
+  orchestrationRequest,
+  resultOf,
+  PROVIDER_ID_X,
+  SESSION_X,
+  SESSION_Y,
+  sessionRecord,
+  WORKER_HANDLE,
+  type SessionCallerHarness
+} from './orchestration-session-caller-test-fixture'
+
+const hostRef = vi.hoisted((): { current: unknown } => ({ current: null }))
+vi.mock('../../native-chat/agent-session-wire/structured-agent-session-registry', () => ({
+  getStructuredAgentSessionHost: () => hostRef.current
+}))
+
+type Row = Record<string, unknown>
+
+describe('a send addressed to an agent session', () => {
+  let h: SessionCallerHarness
+  let visible: string[]
+
+  beforeEach(() => {
+    h = createSessionCallerHarness(hostRef)
+    visible = [SESSION_X, SESSION_Y]
+    hostRef.current = {
+      deps: {
+        store: {
+          getRecord: (sessionId: string) => h.records.get(sessionId) ?? null,
+          listRecords: () => [...h.records.values()],
+          getVisibleSessionTabIndex: () => ({ present: true, sessionIds: visible })
+        }
+      }
+    }
+  })
+
+  afterEach(() => {
+    h.close()
+    vi.restoreAllMocks()
+  })
+
+  async function send(to: string): Promise<Row> {
+    const response: unknown = await h.dispatch(
+      orchestrationRequest('orchestration.send', { from: 'term_worker', to, subject: 'hello' })
+    )
+    if (!isRecord(response)) {
+      throw new Error('expected an RPC response object')
+    }
+    return response
+  }
+
+  function errorMessage(response: Row): string {
+    return isRecord(response.error) ? String(response.error.message) : ''
+  }
+
+  it('stores mail to a live session that coordinates nothing at its own address, and points it', async () => {
+    // The refusal this replaces: "Terminal session:<id> has no live pane or durable Run/Dispatch
+    // mailbox." An agent's id is its public address, coordinator or not.
+    const deliver = vi.spyOn(h.runtime, 'deliverPendingMessagesForHandle')
+    const sent = await send(ADDRESS_X)
+    expect(sent).toMatchObject({ ok: true, result: { message: { to_handle: ADDRESS_X } } })
+    await vi.waitFor(() => expect(deliver).toHaveBeenCalledWith(ADDRESS_X, expect.anything()))
+  })
+
+  it('accepts a bare Orca session id and normalizes it', async () => {
+    expect(await send(SESSION_X)).toMatchObject({
+      ok: true,
+      result: { message: { to_handle: ADDRESS_X } }
+    })
+  })
+
+  it('keeps routing a coordinating session to its Run mailbox', async () => {
+    const created = await h.dispatch(
+      orchestrationRequest('orchestration.runCreate', { objective: 'o' }, { sessionId: SESSION_X })
+    )
+    const runId = idOf(resultOf(created).run)
+    expect(await send(ADDRESS_X)).toMatchObject({
+      ok: true,
+      result: { message: { to_handle: `run:${runId}` } }
+    })
+  })
+
+  it.each([
+    [
+      'an unknown session',
+      () => `session:0b0b0b0b-1111-4222-8333-444444444444`,
+      'session_caller_unknown'
+    ],
+    ['a malformed session address', () => 'session:term_abc', 'session_caller_unknown'],
+    ['a provider id', () => `session:${PROVIDER_ID_X}`, 'session_caller_provider_id'],
+    ['a bare provider id', () => PROVIDER_ID_X, 'session_caller_provider_id']
+  ])('refuses %s before storing anything', async (_label, to, code) => {
+    const sent = await send(to())
+    expect(sent).toMatchObject({ ok: false, error: { code } })
+    expect(h.db.getInbox(100)).toEqual([])
+  })
+
+  it('refuses a session on another host', async () => {
+    h.records.set(SESSION_Y, sessionRecord(SESSION_Y, { location: { executionHostId: 'ssh:box' } }))
+    expect(await send(`session:${SESSION_Y}`)).toMatchObject({
+      ok: false,
+      error: { code: 'session_caller_host_boundary' }
+    })
+    expect(h.db.getInbox(100)).toEqual([])
+  })
+
+  it('refuses a session whose chat was closed, naming why', async () => {
+    visible = [SESSION_X]
+    const sent = await send(`session:${SESSION_Y}`)
+    expect(sent).toMatchObject({ ok: false, error: { code: 'session_caller_not_live' } })
+    expect(errorMessage(sent)).toContain('its chat was closed')
+    expect(h.db.getInbox(100)).toEqual([])
+  })
+
+  it('refuses a structured worker whose worker identity is gone: nothing could ever read it', async () => {
+    // A Dispatch recorded the session as a worker; no registry entry or custody row maps it now.
+    const run = h.db.createRun({
+      objective: 'pty',
+      coordinatorHandle: 'term_c',
+      coordinatorPaneKey: 'tab_c:13131313-1313-4313-8313-131313131313'
+    })
+    h.db.createDispatchContext({
+      taskId: h.db.createTask({ runId: run.id, spec: 'work' }).id,
+      assigneeHandle: mintStructuredWorkerHandle(),
+      assigneePaneKey: mintStructuredWorkerPaneKey(SESSION_Y),
+      processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+      creator: { kind: 'system' },
+      maxDepth: Number.MAX_SAFE_INTEGER
+    })
+    structuredWorkerIdentities.clear()
+    const sent = await send(`session:${SESSION_Y}`)
+    expect(sent).toMatchObject({ ok: false, error: { code: 'session_caller_not_live' } })
+    expect(errorMessage(sent)).toContain('worker identity')
+  })
+
+  it('leaves a bare string that is no session a terminal handle, as before', async () => {
+    expect(await send('0b0b0b0b-1111-4222-8333-444444444444')).toMatchObject({
+      ok: false,
+      error: { code: 'terminal_not_found' }
+    })
+  })
+})
+
+describe('a live structured worker addressed by its session id', () => {
+  let h: SessionCallerHarness
+  const handle = mintStructuredWorkerHandle()
+  const paneKey = mintStructuredWorkerPaneKey(SESSION_Y)
+
+  beforeEach(() => {
+    h = createSessionCallerHarness(hostRef)
+    structuredWorkerIdentities.register({
+      handle,
+      sessionId: SESSION_Y,
+      agent: 'claude',
+      paneKey,
+      processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+      worktreeId: 'wt_1',
+      hostScope: { kind: 'local', hostId: 'local' }
+    })
+  })
+
+  afterEach(() => {
+    h.close()
+    vi.restoreAllMocks()
+  })
+
+  async function sendTo(to: string): Promise<Row> {
+    return resultOf(
+      await h.dispatch(
+        orchestrationRequest('orchestration.send', { from: 'term_worker', to, subject: 'hello' })
+      )
+    )
+  }
+
+  async function flaglessCheck(): Promise<Row> {
+    return resultOf(
+      await h.dispatch(
+        orchestrationRequest('orchestration.check', { peek: true }, { sessionId: SESSION_Y })
+      )
+    )
+  }
+
+  it('lands in its Dispatch mailbox, which its flagless check reads', async () => {
+    // The defect this pins: the mail was stored at `session:<id>`, pointed at the worker, and its
+    // `check` — which reads the worker's handle and Dispatch mailboxes — returned nothing.
+    const run = h.db.createRun({
+      objective: 'pty coordinator',
+      coordinatorHandle: 'term_coord',
+      coordinatorPaneKey: 'tab_coord:12121212-1212-4212-8212-121212121212'
+    })
+    const dispatch = h.db.createDispatchContext({
+      taskId: h.db.createTask({ runId: run.id, spec: 'work' }).id,
+      assigneeHandle: handle,
+      assigneePaneKey: paneKey,
+      processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+      creator: { kind: 'system' },
+      maxDepth: Number.MAX_SAFE_INTEGER
+    })
+    expect(await sendTo(`session:${SESSION_Y}`)).toMatchObject({
+      message: { to_handle: `dispatch:${dispatch.id}` }
+    })
+    expect(await flaglessCheck()).toMatchObject({ messages: [{ subject: 'hello' }] })
+  })
+
+  it('lands in its own handle mailbox between Dispatches, which its flagless check reads', async () => {
+    expect(await sendTo(SESSION_Y)).toMatchObject({ message: { to_handle: handle } })
+    expect(await flaglessCheck()).toMatchObject({ messages: [{ subject: 'hello' }] })
+  })
+})
+
+describe('mail sent to a session address reaches the mailbox that session reads', () => {
+  let h: SessionCallerHarness
+
+  beforeEach(() => {
+    h = createSessionCallerHarness(hostRef)
+  })
+
+  afterEach(() => {
+    h.close()
+    vi.restoreAllMocks()
+  })
+
+  async function as(sessionId: string | undefined, method: string, params: Row): Promise<Row> {
+    return resultOf(await h.dispatch(orchestrationRequest(method, params, { sessionId })))
+  }
+
+  function sendFromTerminal(to: string): Promise<Row> {
+    return as(undefined, 'orchestration.send', { from: WORKER_HANDLE, to, subject: 'hello' })
+  }
+
+  it("files it under the chat's current Run, as a terminal coordinator's pane does", async () => {
+    await as(SESSION_X, 'orchestration.runCreate', { objective: 'first' })
+    const current = idOf(
+      (await as(SESSION_X, 'orchestration.runCreate', { objective: 'next' })).run
+    )
+
+    const { message } = await sendFromTerminal(ADDRESS_X)
+
+    expect(message).toMatchObject({ to_handle: `run:${current}`, run_id: current })
+    expect(await as(SESSION_X, 'orchestration.check', {})).toMatchObject({
+      runId: current,
+      messages: [{ subject: 'hello' }]
+    })
+  })
+
+  it('delivers it to a chat with no Run, which reads its direct mailbox', async () => {
+    const { message } = await sendFromTerminal(ADDRESS_X)
+
+    expect(message).toMatchObject({ to_handle: ADDRESS_X })
+    expect(await as(SESSION_X, 'orchestration.check', {})).toMatchObject({
+      messages: [{ subject: 'hello' }]
+    })
+  })
+
+  it('reaches a chat with no Run after a restart, once the send has started the session host', async () => {
+    // After an app restart the agent-session host starts lazily; routing reads the session record
+    // synchronously, so the send must start the host before it resolves the recipient.
+    const store = hostRef.current
+    hostRef.current = null
+    vi.mocked(h.runtime.ensureStructuredAgentSessionHost).mockImplementation(async () => {
+      hostRef.current = store
+    })
+
+    const { message } = await sendFromTerminal(ADDRESS_X)
+
+    expect(message).toMatchObject({ to_handle: ADDRESS_X })
+  })
+
+  it('refuses an Orca session this host does not run, or has no record of', async () => {
+    h.records.set(
+      SESSION_X,
+      sessionRecord(SESSION_X, { location: { executionHostId: 'ssh:devbox' } })
+    )
+    h.records.delete(SESSION_Y)
+
+    for (const [to, code] of [
+      [ADDRESS_X, 'session_caller_host_boundary'],
+      [ADDRESS_Y, 'session_caller_unknown']
+    ]) {
+      const response = await h.dispatch(
+        orchestrationRequest('orchestration.send', { from: WORKER_HANDLE, to, subject: 's' })
+      )
+      expect(response).toMatchObject({ ok: false, error: { code } })
+    }
+  })
+
+  it("routes a structured worker's session address to the Dispatch it is working", async () => {
+    const handle = mintStructuredWorkerHandle()
+    const paneKey = mintStructuredWorkerPaneKey(SESSION_Y)
+    structuredWorkerIdentities.register({
+      handle,
+      sessionId: SESSION_Y,
+      agent: 'claude',
+      paneKey,
+      processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+      worktreeId: 'wt_1',
+      hostScope: { kind: 'local', hostId: 'local' }
+    })
+    const runId = idOf((await as(SESSION_X, 'orchestration.runCreate', { objective: 'o' })).run)
+    const dispatch = h.db.createDispatchContext({
+      taskId: h.db.createTask({ runId, spec: 'work' }).id,
+      assigneeHandle: handle,
+      assigneePaneKey: paneKey,
+      processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+      creator: { kind: 'session', orcaSessionId: SESSION_X },
+      maxDepth: Number.MAX_SAFE_INTEGER
+    })
+
+    const { message } = await as(SESSION_X, 'orchestration.send', {
+      to: ADDRESS_Y,
+      subject: 'to the worker'
+    })
+
+    expect(message).toMatchObject({ to_handle: `dispatch:${dispatch.id}`, run_id: runId })
+    expect(await as(SESSION_Y, 'orchestration.check', { peek: true })).toMatchObject({
+      dispatchId: dispatch.id,
+      messages: [{ subject: 'to the worker' }]
+    })
+  })
+})
diff --git a/src/main/runtime/rpc/orchestration-session-run-binding.test.ts b/src/main/runtime/rpc/orchestration-session-run-binding.test.ts
new file mode 100644
index 00000000000..0f6b65d6571
--- /dev/null
+++ b/src/main/runtime/rpc/orchestration-session-run-binding.test.ts
@@ -0,0 +1,138 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  mintStructuredWorkerHandle,
+  mintStructuredWorkerPaneKey,
+  structuredWorkerIdentities,
+  structuredWorkerProcessIncarnation
+} from '../structured-worker-identity'
+import {
+  createSessionCallerHarness,
+  orchestrationRequest,
+  resultOf,
+  idOf,
+  SESSION_X,
+  SESSION_Y,
+  type SessionCallerHarness
+} from './orchestration-session-caller-test-fixture'
+
+const hostRef = vi.hoisted((): { current: unknown } => ({ current: null }))
+vi.mock('../../native-chat/agent-session-wire/structured-agent-session-registry', () => ({
+  getStructuredAgentSessionHost: () => hostRef.current
+}))
+
+function deliveryId(result: Record<string, unknown>): string {
+  if (typeof result.deliveryId === 'string') {
+    return result.deliveryId
+  }
+  throw new Error('Expected a Delivery')
+}
+
+describe('structured lead Run binding through the RPC dispatcher', () => {
+  let h: SessionCallerHarness
+  let dispatchId: string
+
+  function call(sessionId: string, method: string, params: Record<string, unknown> = {}) {
+    return h
+      .dispatch(orchestrationRequest(`orchestration.${method}`, params, { sessionId }))
+      .then(resultOf)
+  }
+
+  beforeEach(async () => {
+    h = createSessionCallerHarness(hostRef)
+    const handle = mintStructuredWorkerHandle()
+    const paneKey = mintStructuredWorkerPaneKey(SESSION_Y)
+    structuredWorkerIdentities.register({
+      handle,
+      sessionId: SESSION_Y,
+      agent: 'claude',
+      paneKey,
+      processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+      worktreeId: 'folder-workspace',
+      hostScope: { kind: 'local', hostId: 'local' }
+    })
+    const runId = idOf((await call(SESSION_X, 'runCreate', { objective: 'parent' })).run)
+    dispatchId = h.db.createDispatchContext({
+      taskId: h.db.createTask({ runId, spec: 'structured lead' }).id,
+      assigneeHandle: handle,
+      assigneePaneKey: paneKey,
+      processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+      creator: { kind: 'session', orcaSessionId: SESSION_X },
+      maxDepth: Number.MAX_SAFE_INTEGER
+    }).id
+  })
+  afterEach(() => {
+    h.runtime.cancelMessageWaiters(`dispatch:${dispatchId}`)
+    h.close()
+    vi.restoreAllMocks()
+  })
+
+  it.each(['runCreate', 'runUse'] as const)(
+    'cancels a parked session Dispatch check on %s',
+    async (method) => {
+      const params =
+        method === 'runCreate'
+          ? { objective: 'child' }
+          : {
+              id: h.db.createRun({
+                objective: 'unbound',
+                coordinatorHandle: null,
+                coordinatorPaneKey: null
+              }).id
+            }
+      const wait = vi.spyOn(h.runtime, 'waitForMessage')
+      const waiting = call(SESSION_Y, 'check', { wait: true, timeoutMs: 500 })
+      await vi.waitFor(() =>
+        expect(wait).toHaveBeenCalledWith(`dispatch:${dispatchId}`, expect.anything())
+      )
+      const child = idOf((await call(SESSION_Y, method, params)).run)
+      expect(await waiting).toMatchObject({ cancelled: true, timedOut: false })
+      const sent = await call(SESSION_X, 'send', {
+        to: `dispatch:${dispatchId}`,
+        subject: 'after bind'
+      })
+      expect(sent.message).toMatchObject({ to_handle: `run:${child}`, run_id: child })
+      expect(await call(SESSION_Y, 'check')).toMatchObject({
+        messages: [{ subject: 'after bind' }]
+      })
+      expect(h.db.getInbox()).toHaveLength(1)
+    }
+  )
+
+  it.each(['cancel', 'throw'] as const)(
+    'replays a pre-bind ack receipt after the following wait ends by %s',
+    async (ending) => {
+      await call(SESSION_X, 'send', { to: `dispatch:${dispatchId}`, subject: 'ack me' })
+      const ack = deliveryId(await call(SESSION_Y, 'check'))
+      const acknowledge = vi.spyOn(h.db, 'acknowledgeMailboxDelivery')
+      const wait = vi.spyOn(h.runtime, 'waitForMessage').mockImplementationOnce(async () => {
+        await call(SESSION_Y, 'runCreate', { objective: 'child' })
+        if (ending === 'throw') {
+          throw new Error('wait transport interrupted')
+        }
+        return 'cancelled'
+      })
+      const request = orchestrationRequest(
+        'orchestration.check',
+        { ack, wait: true, timeoutMs: 500 },
+        {
+          sessionId: SESSION_Y,
+          requestId: `bind-during-ack-${ending}`
+        }
+      )
+      const first = await h.dispatch(request)
+      if (ending === 'throw') {
+        expect(first).toMatchObject({ ok: false, error: { code: 'runtime_error' } })
+      } else {
+        expect(resultOf(first)).toMatchObject({ acknowledged: ack, count: 0, cancelled: true })
+      }
+      const replay = resultOf(await h.dispatch(request))
+      expect(replay).toMatchObject({ acknowledged: ack, count: 0, mutation: { replayed: true } })
+      if (ending === 'throw') {
+        expect(replay.waitInterrupted).toBe('outcome_unknown')
+      }
+      expect(acknowledge).toHaveBeenCalledTimes(1)
+      expect(wait).toHaveBeenCalledTimes(1)
+      expect(h.db.getDeliveryRaw(ack)?.status).toBe('acknowledged')
+    }
+  )
+})
diff --git a/src/main/runtime/rpc/rpc-streaming-dispatcher.ts b/src/main/runtime/rpc/rpc-streaming-dispatcher.ts
index 1428b72d188..6c2faad902e 100644
--- a/src/main/runtime/rpc/rpc-streaming-dispatcher.ts
+++ b/src/main/runtime/rpc/rpc-streaming-dispatcher.ts
@@ -1,4 +1,10 @@
-import { isStreamingMethod, type RpcEnvelopeMeta, type RpcRegistry, type RpcRequest } from './core'
+import {
+  isRegistrationFencedUnsubscribe,
+  isStreamingMethod,
+  type RpcEnvelopeMeta,
+  type RpcRegistry,
+  type RpcRequest
+} from './core'
 
 import { errorResponse, successResponse } from './errors'
 import type { OrcaRuntimeService } from '../orca-runtime'
@@ -15,6 +21,11 @@ import { parseRpcRequestParams } from './dispatcher-request-parsing'
 import { routeDispatcherClientHostedBrowserRpc } from './dispatcher-client-browser-routing'
 import { needsLocalCallerFingerprint } from './dispatcher-caller-fingerprint'
 import { createDispatcherStreamingFeatureEmitter } from './dispatcher-streaming-feature-emitter'
+import {
+  needsOrchestrationCallerResolution,
+  resolveOrchestrationSessionCaller,
+  type ResolvedOrchestrationRequest
+} from './orchestration-session-caller'
 
 export type RpcStreamingDispatcherDependencies = {
   runtime: OrcaRuntimeService
@@ -29,10 +40,11 @@ export class RpcStreamingDispatcher {
 
   // Why: streaming dispatch sends multiple responses through the reply callback instead of a Promise.
   async dispatch(
-    request: RpcRequest,
+    rawRequest: RpcRequest,
     reply: (response: string) => void,
     options?: RpcDispatchStreamingOptions
   ): Promise<void> {
+    let request = rawRequest
     const { runtime, registry, orchestrationMutations, legacyOrchestration, meta } =
       this.dependencies
     const envelopeMeta = meta()
@@ -57,23 +69,36 @@ export class RpcStreamingDispatcher {
       return
     }
 
+    // Why: before params parse and the unary/streaming split, so both branches see one caller.
+    let resolved: ResolvedOrchestrationRequest = { request }
+    if (needsOrchestrationCallerResolution(request)) {
+      try {
+        resolved = await resolveOrchestrationSessionCaller(runtime, request, options)
+      } catch (error) {
+        reply(JSON.stringify(mapDispatcherError(request, envelopeMeta, error)))
+        return
+      }
+    }
+    request = resolved.request
+    const orchestrationCaller = resolved.caller
     const parsedParams = parseRpcRequestParams(request, method, envelopeMeta)
     if (parsedParams.error) {
       reply(JSON.stringify(parsedParams.error))
       return
     }
+    const params = parsedParams.value
 
     if (!isStreamingMethod(method)) {
       try {
+        // Session tabs always need this fence. COMPAT(terminal request-addressed unsubscribe): terminal only for phones without `requestId`.
         // Capture before middleware yields to a replacement subscribe on the same connection.
-        const subscriptionRegistrationVersion =
-          request.method === 'terminal.unsubscribe'
-            ? runtime.getSubscriptionRegistrationVersion()
-            : undefined
+        const subscriptionRegistrationVersion = isRegistrationFencedUnsubscribe(request.method)
+          ? runtime.getSubscriptionRegistrationVersion()
+          : undefined
         const clientHostedBrowser = await routeDispatcherClientHostedBrowserRpc(
           runtime,
           request.method,
-          parsedParams.value
+          params
         )
         if (clientHostedBrowser.handled) {
           recordRuntimeFeatureInteraction(
@@ -88,16 +113,12 @@ export class RpcStreamingDispatcher {
           )
           return
         }
-        const compatibility = await legacyOrchestration.tryHandle(
-          request,
-          parsedParams.value,
-          options?.signal
-        )
+        const compatibility = await legacyOrchestration.tryHandle(request, params, options?.signal)
         if (compatibility.handled) {
           reply(JSON.stringify(successResponse(request.id, envelopeMeta, compatibility.result)))
           return
         }
-        const effectiveParams = compatibility.params ?? parsedParams.value
+        const effectiveParams = compatibility.params ?? params
         const legacyCoordinator = legacyOrchestration.createCoordinatorInvocation(
           request,
           compatibility.legacyCoordinatorAuthority
@@ -136,14 +157,16 @@ export class RpcStreamingDispatcher {
             revalidateLegacyCoordinator: legacyCoordinator?.revalidate,
             orchestrationCompatibilityCallerAuthority:
               compatibility.orchestrationCompatibilityCallerAuthority,
-            orchestrationCompatibilityEvidence: request.orchestrationCompatibilityEvidence
+            orchestrationCompatibilityEvidence: request.orchestrationCompatibilityEvidence,
+            orchestrationCaller
           })
         }
         const result = await orchestrationMutations.run(
           request,
           effectiveParams,
           invoke,
-          legacyCoordinator?.mutationCallerFingerprint ?? authenticatedCallerFingerprint
+          legacyCoordinator?.mutationCallerFingerprint ?? authenticatedCallerFingerprint,
+          orchestrationCaller?.orcaSessionId
         )
         recordRuntimeFeatureInteraction(runtime, request.method, result, undefined, request.params)
         reply(JSON.stringify(successResponse(request.id, envelopeMeta, result)))
@@ -162,7 +185,7 @@ export class RpcStreamingDispatcher {
 
     try {
       const result = await method.handler(
-        parsedParams.value,
+        params,
         {
           runtime,
           signal: options?.signal,
@@ -177,7 +200,8 @@ export class RpcStreamingDispatcher {
           pairing: options?.pairing,
           sendBinary: options?.sendBinary,
           registerBinaryStreamHandler: options?.registerBinaryStreamHandler,
-          registerBinaryMessageHandler: options?.registerBinaryMessageHandler
+          registerBinaryMessageHandler: options?.registerBinaryMessageHandler,
+          orchestrationCaller
         },
         emit
       )
diff --git a/src/main/runtime/rpc/static-web-client-handler-stream.test.ts b/src/main/runtime/rpc/static-web-client-handler-stream.test.ts
new file mode 100644
index 00000000000..91bd0f52053
--- /dev/null
+++ b/src/main/runtime/rpc/static-web-client-handler-stream.test.ts
@@ -0,0 +1,255 @@
+import { once } from 'node:events'
+import type * as fs from 'node:fs'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync, type ReadStream } from 'node:fs'
+import type * as fsPromises from 'node:fs/promises'
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { PassThrough } from 'node:stream'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { createStaticWebClientHandler } from './static-web-client-handler'
+
+const observed = vi.hoisted(() => {
+  const streams: ReadStream[] = []
+  const state: {
+    statWait: Promise<void>
+    statError?: Error
+    missingPath?: string
+    onSource?: () => void
+  } = {
+    statWait: Promise.resolve()
+  }
+  return { streams, state, statCalls: 0, completedStats: 0 }
+})
+vi.mock('node:fs', async (importOriginal) => {
+  const original = await importOriginal<typeof fs>()
+  return {
+    ...original,
+    createReadStream: (...args: Parameters<typeof original.createReadStream>) => {
+      const stream = original.createReadStream(observed.state.missingPath ?? args[0], args[1])
+      observed.streams.push(stream)
+      observed.state.onSource?.()
+      return stream
+    }
+  }
+})
+vi.mock('node:fs/promises', async (importOriginal) => {
+  const original = await importOriginal<typeof fsPromises>()
+  return {
+    ...original,
+    stat: async (...args: Parameters<typeof original.stat>) => {
+      observed.statCalls++
+      const value = await original.stat(...args)
+      await observed.state.statWait
+      observed.completedStats++
+      if (observed.state.statError) {
+        throw observed.state.statError
+      }
+      return value
+    }
+  }
+})
+
+let root: string
+const servers: Server[] = []
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'orca-static-web-stream-'))
+  mkdirSync(join(root, 'assets'))
+  writeFileSync(join(root, 'assets', 'fixture.js'), Buffer.alloc(1024 * 1024, 1))
+  writeFileSync(join(root, 'web-index.html'), '<html>web</html>')
+  observed.state.statWait = Promise.resolve()
+  observed.state.statError = undefined
+  observed.state.missingPath = undefined
+  observed.state.onSource = undefined
+  observed.statCalls = 0
+  observed.completedStats = 0
+})
+afterEach(async () => {
+  await Promise.all(
+    servers.splice(0).map(async (server) => {
+      server.closeAllConnections()
+      await new Promise<void>((resolve) => server.close(() => resolve()))
+    })
+  )
+  await Promise.all(
+    observed.streams.splice(0).map(async (stream) => {
+      if (!stream.closed) {
+        const closed = new Promise<void>((resolve) => stream.once('close', resolve))
+        stream.destroy()
+        await closed
+      }
+    })
+  )
+  rmSync(root, { recursive: true, force: true })
+})
+
+function fakeResponse() {
+  return Object.assign(new PassThrough({ highWaterMark: 16 }), {
+    setHeader: vi.fn(),
+    statusCode: 0,
+    headersSent: false
+  })
+}
+function fileDescriptor(stream: ReadStream): number | null {
+  if ('fd' in stream && (typeof stream.fd === 'number' || stream.fd === null)) {
+    return stream.fd
+  }
+  throw new Error('Missing file descriptor')
+}
+function request(response = fakeResponse()) {
+  const handler = createStaticWebClientHandler(root)
+  handler(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This handler reads only these method/url fields.
+    { method: 'GET', url: '/assets/fixture.js' } as IncomingMessage,
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture implements the writable response surface used by this handler.
+    response as unknown as ServerResponse
+  )
+  return response
+}
+async function latestSource(count: number): Promise<ReadStream> {
+  await expect.poll(() => observed.streams.length).toBe(count)
+  const source = observed.streams.at(-1)
+  if (!source) {
+    throw new Error('Missing file stream')
+  }
+  return source
+}
+async function startServer(): Promise<string> {
+  const server = createServer(createStaticWebClientHandler(root))
+  servers.push(server)
+  server.listen(0, '127.0.0.1')
+  await once(server, 'listening')
+  const address = server.address()
+  if (!address || typeof address === 'string') {
+    throw new Error('Missing HTTP address')
+  }
+  return `http://127.0.0.1:${address.port}`
+}
+
+it('closes 25 abandoned file readers and removes only owned response listeners', async () => {
+  const responses: ReturnType<typeof fakeResponse>[] = []
+  const otherClose = vi.fn()
+  const otherError = vi.fn()
+  for (let index = 0; index < 25; index++) {
+    const response = fakeResponse()
+    response.on('close', otherClose)
+    response.on('error', otherError)
+    request(response)
+    responses.push(response)
+    const source = await latestSource(index + 1)
+    await expect.poll(() => source.isPaused()).toBe(true)
+    const closed = once(response, 'close')
+    response.destroy()
+    await closed
+  }
+  await expect.poll(() => observed.streams.filter((stream) => !stream.closed).length).toBe(0)
+  expect(observed.streams.every((stream) => fileDescriptor(stream) === null)).toBe(true)
+  expect(responses.every((response) => response.listeners('close').length === 1)).toBe(true)
+  expect(responses.every((response) => response.listeners('error').length === 1)).toBe(true)
+  expect(otherClose).toHaveBeenCalledTimes(25)
+  expect(otherError).not.toHaveBeenCalled()
+})
+
+it('does not stat or open assets for an already closed response', async () => {
+  const response = fakeResponse()
+  const closed = once(response, 'close')
+  response.destroy()
+  await closed
+  request(response)
+  expect(observed.statCalls).toBe(0)
+  expect(observed.streams).toHaveLength(0)
+  expect(response.setHeader).not.toHaveBeenCalled()
+})
+
+it.each(['success', 'failure'])(
+  'does not revive a response closed during stat %s',
+  async (outcome) => {
+    let releaseStat = (): void => {}
+    observed.state.statWait = new Promise<void>((resolve) => {
+      releaseStat = resolve
+    })
+    if (outcome === 'failure') {
+      observed.state.statError = new Error('stat failed after abandonment')
+    }
+    const response = request()
+    expect(observed.statCalls).toBe(1)
+    const ended = vi.spyOn(response, 'end')
+    const closed = once(response, 'close')
+    response.destroy()
+    await closed
+    releaseStat()
+    await expect.poll(() => observed.completedStats).toBe(1)
+    expect(observed.streams).toHaveLength(0)
+    expect(response.setHeader).not.toHaveBeenCalled()
+    expect(ended).not.toHaveBeenCalled()
+  }
+)
+
+it('closes a file that is still opening when its response is destroyed', async () => {
+  const response = fakeResponse()
+  observed.state.onSource = () => {
+    const source = observed.streams.at(-1)
+    expect(source && fileDescriptor(source)).toBe(null)
+    response.destroy()
+  }
+  request(response)
+  const source = await latestSource(1)
+  await expect.poll(() => source.closed).toBe(true)
+  expect(fileDescriptor(source)).toBe(null)
+  expect(response.listenerCount('close')).toBe(0)
+  expect(response.listenerCount('error')).toBe(0)
+})
+
+it('closes its file reader when the response errors', async () => {
+  const response = request()
+  const source = await latestSource(1)
+  await expect.poll(() => source.isPaused()).toBe(true)
+  response.destroy(new Error('downstream failed'))
+  await expect.poll(() => source.closed).toBe(true)
+  expect(fileDescriptor(source)).toBe(null)
+  expect(response.listenerCount('close')).toBe(0)
+  expect(response.listenerCount('error')).toBe(0)
+})
+
+it('disconnects a response when its source fails after headers', async () => {
+  const response = request()
+  const source = await latestSource(1)
+  response.headersSent = true
+  const closed = once(response, 'close')
+  source.destroy(new Error('read failed after headers'))
+  await closed
+  await expect.poll(() => source.closed).toBe(true)
+  expect(response.statusCode).toBe(200)
+  expect(response.destroyed).toBe(true)
+  expect(response.listenerCount('close')).toBe(0)
+  expect(response.listenerCount('error')).toBe(0)
+})
+
+it('preserves actual HTTP GET bytes, cache headers and HEAD without a reader', async () => {
+  const url = await startServer()
+  const head = await fetch(`${url}/assets/fixture.js`, { method: 'HEAD' })
+  expect(head.status).toBe(200)
+  expect(head.headers.get('content-length')).toBe(String(1024 * 1024))
+  expect(await head.text()).toBe('')
+  expect(observed.streams).toHaveLength(0)
+  const get = await fetch(`${url}/assets/fixture.js`)
+  expect(get.status).toBe(200)
+  expect(get.headers.get('cache-control')).toBe('public, max-age=31536000, immutable')
+  expect(get.headers.get('content-type')).toBe('text/javascript; charset=utf-8')
+  expect(Buffer.from(await get.arrayBuffer())).toEqual(Buffer.alloc(1024 * 1024, 1))
+  await expect.poll(() => observed.streams.every((source) => source.closed)).toBe(true)
+  const index = await fetch(`${url}/`)
+  expect(index.headers.get('cache-control')).toBe('no-cache')
+  expect(await index.text()).toBe('<html>web</html>')
+})
+
+it('answers an actual file-open error with an empty 500 instead of the asset length', async () => {
+  observed.state.missingPath = join(root, 'missing-after-stat.js')
+  const url = await startServer()
+  const response = await fetch(`${url}/assets/fixture.js`)
+  expect(response.status).toBe(500)
+  expect(response.headers.get('content-length')).toBe('0')
+  expect(response.headers.get('cache-control')).toBe('no-store')
+  expect(await response.text()).toBe('')
+  await expect.poll(() => observed.streams.every((source) => source.closed)).toBe(true)
+})
diff --git a/src/main/runtime/rpc/static-web-client-handler.ts b/src/main/runtime/rpc/static-web-client-handler.ts
index 53ecd85c73f..3ec8ed83919 100644
--- a/src/main/runtime/rpc/static-web-client-handler.ts
+++ b/src/main/runtime/rpc/static-web-client-handler.ts
@@ -29,6 +29,9 @@ async function handleStaticRequest(
   request: IncomingMessage,
   response: ServerResponse
 ): Promise<void> {
+  if (response.destroyed) {
+    return
+  }
   if (request.method !== 'GET' && request.method !== 'HEAD') {
     response.setHeader('Allow', 'GET, HEAD')
     writeHttpStatus(response, 405)
@@ -59,6 +62,9 @@ async function handleStaticRequest(
     writeHttpStatus(response, 404)
     return
   }
+  if (response.destroyed) {
+    return
+  }
   if (!fileStat.isFile()) {
     writeHttpStatus(response, 404)
     return
@@ -80,8 +86,22 @@ async function handleStaticRequest(
   }
 
   const stream = createReadStream(absolutePath)
+  const stopReading = (): void => {
+    stream.destroy()
+  }
+  response.once('close', stopReading)
+  response.once('error', stopReading)
+  stream.once('close', () => {
+    response.off('close', stopReading)
+    response.off('error', stopReading)
+  })
   stream.on('error', () => {
+    if (response.destroyed) {
+      return
+    }
     if (!response.headersSent) {
+      response.setHeader('Content-Length', 0)
+      response.setHeader('Cache-Control', 'no-store')
       writeHttpStatus(response, 500)
       return
     }
@@ -136,6 +156,9 @@ function isAllowedStaticWebPath(pathname: string): boolean {
 }
 
 function writeHttpStatus(response: ServerResponse, statusCode: number): void {
+  if (response.destroyed) {
+    return
+  }
   response.statusCode = statusCode
   response.end()
 }
diff --git a/src/main/runtime/rpc/subscription-registry-test-double.ts b/src/main/runtime/rpc/subscription-registry-test-double.ts
index d74e8bc329f..0ee0fc79960 100644
--- a/src/main/runtime/rpc/subscription-registry-test-double.ts
+++ b/src/main/runtime/rpc/subscription-registry-test-double.ts
@@ -1,14 +1,19 @@
 import type { SubscriptionRegistration } from '../orca-runtime'
 
 type Cleanup = () => void | Promise<void>
-type Entry = { cleanup: Cleanup; version: number }
+type Entry = {
+  cleanup: Cleanup
+  version: number
+  request?: { connectionId: string; requestId: string }
+}
 
 export type SubscriptionRegistryDouble = {
   registerSubscriptionCleanup: (id: string, cleanup: Cleanup, connectionId?: string) => void
   registerOwnedSubscriptionCleanup: (
     id: string,
     cleanup: Cleanup,
-    connectionId?: string
+    connectionId?: string,
+    requestId?: string
   ) => SubscriptionRegistration
   cleanupSubscription: (id: string) => void
   cleanupSubscriptionIfOwnedByConnection: (
@@ -17,14 +22,18 @@ export type SubscriptionRegistryDouble = {
     throughVersion?: number
   ) => boolean
   getSubscriptionRegistrationVersion: () => number
+  releaseSubscriptionByRequest: (connectionId: string | undefined, requestId: string) => void
   cleanupSubscriptionsForConnection: (connectionId: string) => void
   /** Test-only inspection; the runtime deliberately exposes no such accessor. */
   peekCleanup: (id: string) => Cleanup | undefined
+  /** Test-only inspection of the request-address index size. */
+  requestAddressCount: () => number
 }
 
 /**
  * Faithful double of the runtime subscription registry (`OrcaRuntimeService`,
- * `registerSubscriptionCleanup` through `cleanupSubscriptionsForConnection`).
+ * `registerSubscriptionCleanup` through `cleanupSubscriptionsForConnection`, plus
+ * `releaseSubscriptionByRequest`).
  *
  * This mirrors production line-for-line, so it can drift. If you change
  * `registerSubscriptionCleanup`, `cleanupSubscriptionAndWait`,
@@ -43,6 +52,20 @@ export function createSubscriptionRegistryDouble(): SubscriptionRegistryDouble {
   let registrationVersion = 0
   const byConnection = new Map<string, Set<string>>()
   const connectionByEntry = new Map<string, string>()
+  const byRequest = new Map<string, { id: string; entry: Entry }>()
+  const requestKey = (connectionId: string, requestId: string): string =>
+    JSON.stringify([connectionId, requestId])
+
+  // Mirrors removeRequestIndex: compare-and-delete, so a reused request id keeps its newer owner.
+  const removeRequestIndex = (entry: Entry): void => {
+    if (!entry.request) {
+      return
+    }
+    const key = requestKey(entry.request.connectionId, entry.request.requestId)
+    if (byRequest.get(key)?.entry === entry) {
+      byRequest.delete(key)
+    }
+  }
 
   const removeIndex = (id: string): void => {
     const connectionId = connectionByEntry.get(id)
@@ -84,6 +107,7 @@ export function createSubscriptionRegistryDouble(): SubscriptionRegistryDouble {
         }
         cleanups.delete(id)
         removeIndex(id)
+        removeRequestIndex(entry)
       })
       .finally(() => {
         if (inFlight.get(id)?.promise === promise) {
@@ -109,15 +133,21 @@ export function createSubscriptionRegistryDouble(): SubscriptionRegistryDouble {
   const registerSubscriptionCleanup = (
     id: string,
     cleanup: Cleanup,
-    connectionId?: string
+    connectionId?: string,
+    requestId?: string
   ): Entry => {
     const existing = cleanups.get(id)
     if (existing) {
       removeIndex(id)
+      removeRequestIndex(existing)
       cleanupOwned(id, existing)
     }
-    const entry = { cleanup, version: ++registrationVersion }
+    const request = connectionId && requestId ? { connectionId, requestId } : undefined
+    const entry: Entry = { cleanup, version: ++registrationVersion, request }
     cleanups.set(id, entry)
+    if (request) {
+      byRequest.set(requestKey(request.connectionId, request.requestId), { id, entry })
+    }
     if (!connectionId) {
       return entry
     }
@@ -133,14 +163,23 @@ export function createSubscriptionRegistryDouble(): SubscriptionRegistryDouble {
 
   return {
     registerSubscriptionCleanup,
-    registerOwnedSubscriptionCleanup: (id, cleanup, connectionId) => {
-      const entry = registerSubscriptionCleanup(id, cleanup, connectionId)
+    registerOwnedSubscriptionCleanup: (id, cleanup, connectionId, requestId) => {
+      const entry = registerSubscriptionCleanup(id, cleanup, connectionId, requestId)
       return {
         releaseIfCurrent: () => cleanupOwned(id, entry)
       }
     },
     cleanupSubscription,
     getSubscriptionRegistrationVersion: () => registrationVersion,
+    releaseSubscriptionByRequest: (connectionId, requestId) => {
+      if (!connectionId) {
+        return
+      }
+      const target = byRequest.get(requestKey(connectionId, requestId))
+      if (target) {
+        cleanupOwned(target.id, target.entry)
+      }
+    },
     cleanupSubscriptionIfOwnedByConnection: (id, connectionId, throughVersion) => {
       const entry = cleanups.get(id)
       // Mirrors the production early-out: an unregistered id is already gone, not refused.
@@ -173,6 +212,7 @@ export function createSubscriptionRegistryDouble(): SubscriptionRegistryDouble {
         byConnection.delete(connectionId)
       }
     },
-    peekCleanup: (id) => cleanups.get(id)?.cleanup
+    peekCleanup: (id) => cleanups.get(id)?.cleanup,
+    requestAddressCount: () => byRequest.size
   }
 }
diff --git a/src/main/runtime/rpc/terminal-agent-prompt-send.test.ts b/src/main/runtime/rpc/terminal-agent-prompt-send.test.ts
index 29254fbcf3a..824513dd999 100644
--- a/src/main/runtime/rpc/terminal-agent-prompt-send.test.ts
+++ b/src/main/runtime/rpc/terminal-agent-prompt-send.test.ts
@@ -45,6 +45,7 @@ describe('terminal agent prompt send RPC', () => {
     expect(response.ok).toBe(true)
     expect(runtime.isTerminalRunningSettledPromptAgent).toHaveBeenCalledWith('terminal-1')
     expect(sendTerminalAgentPrompt).toHaveBeenCalledWith('terminal-1', 'review this change', {
+      inputKind: 'driving',
       beforeWrite: undefined,
       signal: undefined
     })
@@ -81,7 +82,7 @@ describe('terminal agent prompt send RPC', () => {
     expect(sendTerminal).toHaveBeenCalledWith(
       'terminal-1',
       { text: 'echo x', enter: true, interrupt: false },
-      { beforeWrite: undefined, signal: undefined }
+      { inputKind: 'driving', beforeWrite: undefined, signal: undefined }
     )
     expect(sendTerminalAgentPrompt).not.toHaveBeenCalled()
   })
diff --git a/src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts b/src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts
index 3dc1f6b2918..f93b772994e 100644
--- a/src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts
+++ b/src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts
@@ -241,11 +241,15 @@ describe('terminal multiplex RPC', () => {
       )!
     )
     await vi.waitFor(() =>
-      expect(runtime.sendTerminal).toHaveBeenCalledWith('terminal-1', {
-        text: 'still interactive\r',
-        enter: false,
-        interrupt: false
-      })
+      expect(runtime.sendTerminal).toHaveBeenCalledWith(
+        'terminal-1',
+        {
+          text: 'still interactive\r',
+          enter: false,
+          interrupt: false
+        },
+        { inputKind: 'driving' }
+      )
     )
 
     handlers.get(16)?.(
@@ -434,11 +438,15 @@ describe('terminal multiplex RPC', () => {
       )!
     )
     await vi.waitFor(() =>
-      expect(runtime.sendTerminal).toHaveBeenCalledWith('terminal-8', {
-        text: 'remote-still-interactive\r',
-        enter: false,
-        interrupt: false
-      })
+      expect(runtime.sendTerminal).toHaveBeenCalledWith(
+        'terminal-8',
+        {
+          text: 'remote-still-interactive\r',
+          enter: false,
+          interrupt: false
+        },
+        { inputKind: 'driving' }
+      )
     )
 
     const frameCountBeforeAck = binaryFrames.length
diff --git a/src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts b/src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts
index 03327859c62..57abea846ae 100644
--- a/src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts
+++ b/src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts
@@ -413,11 +413,15 @@ describe('terminal multiplex RPC', () => {
       )!
     )
     await vi.waitFor(() =>
-      expect(runtime.sendTerminal).toHaveBeenCalledWith('terminal-1', {
-        text: 'still interactive\r',
-        enter: false,
-        interrupt: false
-      })
+      expect(runtime.sendTerminal).toHaveBeenCalledWith(
+        'terminal-1',
+        {
+          text: 'still interactive\r',
+          enter: false,
+          interrupt: false
+        },
+        { inputKind: 'driving' }
+      )
     )
 
     binaryFrames.splice(0)
diff --git a/src/main/runtime/rpc/terminal-multiplex-desktop-resize-routing.test.ts b/src/main/runtime/rpc/terminal-multiplex-desktop-resize-routing.test.ts
index 45ff2d77b8c..562181b2752 100644
--- a/src/main/runtime/rpc/terminal-multiplex-desktop-resize-routing.test.ts
+++ b/src/main/runtime/rpc/terminal-multiplex-desktop-resize-routing.test.ts
@@ -206,11 +206,15 @@ describe('terminal multiplex RPC', () => {
         )
       )
       await vi.waitFor(() =>
-        expect(runtime.sendTerminal).toHaveBeenCalledWith('terminal-1', {
-          text: 'ls\r',
-          enter: false,
-          interrupt: false
-        })
+        expect(runtime.sendTerminal).toHaveBeenCalledWith(
+          'terminal-1',
+          {
+            text: 'ls\r',
+            enter: false,
+            interrupt: false
+          },
+          { inputKind: 'driving' }
+        )
       )
       const sentAfterSuccessfulClaim = vi.mocked(runtime.sendTerminal).mock.calls.length
       vi.mocked(runtime.updateRemoteDesktopViewer).mockResolvedValueOnce(false)
@@ -248,11 +252,15 @@ describe('terminal multiplex RPC', () => {
         )
       }
       await vi.waitFor(() =>
-        expect(runtime.sendTerminal).toHaveBeenLastCalledWith('terminal-1', {
-          text: 'retry',
-          enter: false,
-          interrupt: false
-        })
+        expect(runtime.sendTerminal).toHaveBeenLastCalledWith(
+          'terminal-1',
+          {
+            text: 'retry',
+            enter: false,
+            interrupt: false
+          },
+          { inputKind: 'driving' }
+        )
       )
 
       dataListenerRef.current?.('a')
diff --git a/src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts b/src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts
index b7fb20b2f73..ae2298a20dc 100644
--- a/src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts
+++ b/src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts
@@ -327,11 +327,15 @@ describe('terminal multiplex RPC', () => {
     )
 
     await vi.waitFor(() =>
-      expect(runtime.sendTerminal).toHaveBeenCalledWith('terminal-1', {
-        text: 'echo one\necho two\r\n',
-        enter: false,
-        interrupt: false
-      })
+      expect(runtime.sendTerminal).toHaveBeenCalledWith(
+        'terminal-1',
+        {
+          text: 'echo one\necho two\r\n',
+          enter: false,
+          interrupt: false
+        },
+        { inputKind: 'driving' }
+      )
     )
 
     runtime.cleanupSubscription('terminal-multiplex:conn-byte-preserving')
@@ -403,11 +407,15 @@ describe('terminal multiplex RPC', () => {
     )
 
     await vi.waitFor(() =>
-      expect(runtime.sendTerminal).toHaveBeenCalledWith('terminal-1', {
-        text: 'printf a\nprintf b\r\n',
-        enter: false,
-        interrupt: false
-      })
+      expect(runtime.sendTerminal).toHaveBeenCalledWith(
+        'terminal-1',
+        {
+          text: 'printf a\nprintf b\r\n',
+          enter: false,
+          interrupt: false
+        },
+        { inputKind: 'driving' }
+      )
     )
 
     runtime.cleanupSubscription('terminal-1:desktop-1')
diff --git a/src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts b/src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts
index ef6087923bb..eecd7b03859 100644
--- a/src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts
+++ b/src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts
@@ -309,7 +309,11 @@ describe('terminal multiplex RPC', () => {
       expect(runtime.sendTerminal).toHaveBeenCalledWith(
         'terminal-1',
         { text: 'x', enter: false, interrupt: false },
-        { reserveWrite: expect.any(Function), afterWrite: expect.any(Function) }
+        {
+          inputKind: 'driving',
+          reserveWrite: expect.any(Function),
+          afterWrite: expect.any(Function)
+        }
       )
     )
     expect(beginMobileInputFloor.mock.invocationCallOrder[0]).toBeLessThan(
diff --git a/src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts b/src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts
index 778cd022068..a5b40b2f1eb 100644
--- a/src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts
+++ b/src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts
@@ -595,7 +595,11 @@ describe('terminal multiplex RPC', () => {
     // Widened gate: a desktop client must mount + await its late PTY, not skip
     // straight to the bare scrollback path the way it did under the mobile-only gate.
     expect(runtime.requestRendererTerminalTabMount).toHaveBeenCalledWith('terminal-1')
-    expect(runtime.waitForLeafPtyId).toHaveBeenCalledWith('terminal-1', 10_000, undefined)
+    expect(runtime.waitForLeafPtyId).toHaveBeenCalledWith(
+      'terminal-1',
+      10_000,
+      expect.any(AbortSignal)
+    )
     expect(messages.map((msg) => JSON.parse(msg).result?.type)).toEqual(['subscribed', 'end'])
   })
 })
diff --git a/src/main/runtime/rpc/terminal-multiplex-test-harness.ts b/src/main/runtime/rpc/terminal-multiplex-test-harness.ts
index 13368bd680d..c85e962d198 100644
--- a/src/main/runtime/rpc/terminal-multiplex-test-harness.ts
+++ b/src/main/runtime/rpc/terminal-multiplex-test-harness.ts
@@ -16,10 +16,13 @@ export const SET_OUTPUT_PAUSED_OPCODE = 16 as TerminalStreamOpcode
 export const WRITE_UNAVAILABLE_OPCODE = 17 as TerminalStreamOpcode
 
 export function stubRuntime(overrides: Partial<OrcaRuntimeService> = {}): OrcaRuntimeService {
+  // Why: every terminal subscription registers at admission, even one that never reaches a pty.
+  const registry = createSubscriptionRegistryDouble()
   const serializeAuthoritativeTerminalBuffer =
     overrides.serializeAuthoritativeTerminalBuffer ??
     ((ptyId: string, opts?: { scrollbackRows?: number }) =>
       overrides.serializeTerminalBuffer?.(ptyId, opts))
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This partial runtime supplies the terminal RPC methods these tests invoke.
   return {
     getRuntimeId: () => 'test-runtime',
     subscribeToPtyExit: vi.fn(() => vi.fn()),
@@ -40,6 +43,7 @@ export function stubRuntime(overrides: Partial<OrcaRuntimeService> = {}): OrcaRu
     isRemoteDesktopViewerOwner: vi.fn().mockReturnValue(false),
     serializeAuthoritativeTerminalBuffer,
     getPtyOutputSequence: vi.fn().mockReturnValue(0),
+    registerOwnedSubscriptionCleanup: registry.registerOwnedSubscriptionCleanup,
     ...overrides
   } as OrcaRuntimeService
 }
diff --git a/src/main/runtime/rpc/terminal-output-batching.test.ts b/src/main/runtime/rpc/terminal-output-batching.test.ts
index e597f5e5b13..214a5a2814e 100644
--- a/src/main/runtime/rpc/terminal-output-batching.test.ts
+++ b/src/main/runtime/rpc/terminal-output-batching.test.ts
@@ -347,7 +347,11 @@ describe('terminal output batching', () => {
       expect(runtime.sendTerminal).toHaveBeenCalledWith(
         'terminal-1',
         { text: 'ls\r', enter: false, interrupt: false },
-        { reserveWrite: expect.any(Function), afterWrite: expect.any(Function) }
+        {
+          inputKind: 'driving',
+          reserveWrite: expect.any(Function),
+          afterWrite: expect.any(Function)
+        }
       )
     )
     expect(beginMobileInputFloor).toHaveBeenCalledWith('pty-1', 'mobile-1')
diff --git a/src/main/runtime/rpc/terminal-send.test.ts b/src/main/runtime/rpc/terminal-send.test.ts
index e9fb481aae0..9aa55eb823e 100644
--- a/src/main/runtime/rpc/terminal-send.test.ts
+++ b/src/main/runtime/rpc/terminal-send.test.ts
@@ -232,6 +232,7 @@ describe('terminal send RPC', () => {
         interrupt: false
       },
       {
+        inputKind: 'driving',
         beforeWrite: undefined,
         reserveWrite: expect.any(Function),
         afterWrite: expect.any(Function)
@@ -370,7 +371,7 @@ describe('terminal send RPC', () => {
     expect(runtime.sendTerminal).toHaveBeenCalledWith(
       'terminal-1',
       { text: '\x1b[3;4R', enter: false, interrupt: false },
-      { beforeWrite: undefined }
+      { beforeWrite: undefined, inputKind: 'query-reply' }
     )
     expect(runtime.mobileTookFloor).not.toHaveBeenCalled()
   })
@@ -570,7 +571,7 @@ describe('terminal send RPC', () => {
         enter: false,
         interrupt: false
       },
-      { beforeWrite: undefined }
+      { inputKind: 'driving', beforeWrite: undefined }
     )
   })
 
@@ -653,7 +654,7 @@ describe('terminal send RPC', () => {
         enter: true,
         interrupt: false
       },
-      { beforeWrite: expect.any(Function) }
+      { inputKind: 'driving', beforeWrite: expect.any(Function) }
     )
   })
 
diff --git a/src/main/runtime/rpc/terminal-stream-byte-length.test.ts b/src/main/runtime/rpc/terminal-stream-byte-length.test.ts
index 60c4c86fe44..1c0f08cf33f 100644
--- a/src/main/runtime/rpc/terminal-stream-byte-length.test.ts
+++ b/src/main/runtime/rpc/terminal-stream-byte-length.test.ts
@@ -5,7 +5,6 @@ import {
   terminalStreamByteLength,
   terminalStreamByteLengthExceeds
 } from './terminal-stream-byte-length'
-import { TERMINAL_OUTPUT_BATCH_MAX_BYTES } from '../../../shared/terminal-multiplex-flow-control'
 
 // Copy of the pre-change implementation (shared/clipboard-text.ts
 // measureClipboardTextByteLength), kept here so equivalence is checked against the
@@ -323,92 +322,6 @@ describe('terminal stream byte length equivalence with the legacy code-point sca
         }
       }
     }
-    expect(MIN_NATIVE_BYTE_LENGTH_CODE_UNITS).toBeGreaterThan(0)
-  })
-})
-
-// Reproduces createTerminalOutputBatcher's byte accounting exactly, under both the
-// legacy scan and the new measurement, and asserts IDENTICAL flush boundaries. This is
-// what makes the partial-count behaviour provably unobservable at that call site.
-function simulateBatcherFlushes(
-  chunks: string[],
-  measure: (
-    data: string,
-    options: { stopAfterBytes?: number }
-  ) => { byteLength: number; exceededLimit: boolean }
-): string[] {
-  const flushes: string[] = []
-  let pending: string[] = []
-  let bytes = 0
-  const flush = (): void => {
-    if (pending.length === 0) {
-      return
-    }
-    flushes.push(pending.join(''))
-    pending = []
-    bytes = 0
-  }
-  for (const data of chunks) {
-    if (!data) {
-      continue
-    }
-    pending.push(data)
-    const remainingBudget = Math.max(1, TERMINAL_OUTPUT_BATCH_MAX_BYTES - bytes)
-    const measurement = measure(data, { stopAfterBytes: remainingBudget })
-    bytes += measurement.byteLength
-    if (measurement.exceededLimit || bytes >= TERMINAL_OUTPUT_BATCH_MAX_BYTES) {
-      flush()
-    }
-  }
-  flush()
-  return flushes
-}
-
-describe('terminal output batcher flush boundaries are unchanged', () => {
-  it(
-    'produces identical flush boundaries over randomized multi-chunk runs',
-    { timeout: 60000 },
-    () => {
-      const random = mulberry32(0x1337)
-      for (let run = 0; run < 300; run += 1) {
-        const chunks: string[] = []
-        const chunkCount = 1 + Math.floor(random() * 40)
-        for (let index = 0; index < chunkCount; index += 1) {
-          // Sizes straddle the 64KiB batch cap so single chunks both fit and blow the budget.
-          // Sizes straddle the native-call floor too, so runs mix scan-branch and
-          // native-branch measurements inside one batcher's byte accounting.
-          const scale = random()
-          const maxUnits =
-            scale < 0.25
-              ? MIN_NATIVE_BYTE_LENGTH_CODE_UNITS * 2
-              : scale < 0.5
-                ? 64
-                : scale < 0.85
-                  ? 20000
-                  : 90000
-          chunks.push(random() < 0.5 ? randomString(random, maxUnits) : rawUtf16(random, maxUnits))
-        }
-        const legacyFlushes = simulateBatcherFlushes(chunks, legacyMeasure)
-        const actualFlushes = simulateBatcherFlushes(chunks, measureTerminalStreamByteLength)
-        if (legacyFlushes.length !== actualFlushes.length) {
-          throw new Error(`flush count diverged on run ${run}`)
-        }
-        for (let index = 0; index < legacyFlushes.length; index += 1) {
-          if (legacyFlushes[index] !== actualFlushes[index]) {
-            throw new Error(`flush ${index} diverged on run ${run}`)
-          }
-        }
-      }
-      expect(true).toBe(true)
-    }
-  )
-
-  it('exercises runs that actually cross the batch budget', () => {
-    const oversized = '\u{1f600}'.repeat(TERMINAL_OUTPUT_BATCH_MAX_BYTES)
-    const chunks = ['a'.repeat(10), oversized, 'b'.repeat(10), oversized, 'c']
-    const legacyFlushes = simulateBatcherFlushes(chunks, legacyMeasure)
-    expect(legacyFlushes.length).toBeGreaterThan(1)
-    expect(simulateBatcherFlushes(chunks, measureTerminalStreamByteLength)).toEqual(legacyFlushes)
   })
 })
 
@@ -419,23 +332,8 @@ describe('resync trim byte accounting for a snapshot-sliced chunk', () => {
   it('re-measures a sliced chunk in UTF-8 bytes, not UTF-16 code units', () => {
     const data = '\u{1f600}é走a'
     const sliced = data.slice(2)
-    expect(terminalStreamByteLength(sliced)).toBe(legacyByteLength(sliced))
     // Guards the mutant: code-unit length would be 4 here, UTF-8 is 6.
     expect(terminalStreamByteLength(sliced)).toBe(6)
     expect(terminalStreamByteLength(sliced)).not.toBe(sliced.length)
   })
-
-  it('matches the legacy byte length for every suffix slice of multi-byte terminal text', () => {
-    const random = mulberry32(0x51ced)
-    for (let iteration = 0; iteration < 2000; iteration += 1) {
-      const data = iteration % 2 === 0 ? randomString(random, 24) : rawUtf16(random, 24)
-      for (let offset = 0; offset <= data.length; offset += 1) {
-        const sliced = data.slice(offset)
-        if (terminalStreamByteLength(sliced) !== legacyByteLength(sliced)) {
-          throw new Error(`sliced byte length diverged for ${JSON.stringify(data)} at ${offset}`)
-        }
-      }
-    }
-    expect(true).toBe(true)
-  })
 })
diff --git a/src/main/runtime/rpc/terminal-subscribe-admission.test.ts b/src/main/runtime/rpc/terminal-subscribe-admission.test.ts
new file mode 100644
index 00000000000..75df605d1c8
--- /dev/null
+++ b/src/main/runtime/rpc/terminal-subscribe-admission.test.ts
@@ -0,0 +1,670 @@
+import { describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeService } from '../orca-runtime'
+import type { RpcRequest } from './core'
+import { RpcDispatcher } from './dispatcher'
+import { TERMINAL_METHODS } from './methods/terminal'
+import { TerminalUnsubscribe } from '../../../shared/rpc-contract/terminal-viewport-schemas-params'
+import { createSubscriptionRegistryDouble } from './subscription-registry-test-double'
+
+const PTY_ID = 'pty-1'
+const SUBSCRIPTION_ID = 'terminal-1:phone-1'
+
+const binaryParams = {
+  terminal: 'terminal-1',
+  client: { id: 'phone-1', type: 'mobile' },
+  viewport: { cols: 40, rows: 20 },
+  capabilities: { terminalBinaryStream: 1 }
+}
+
+const leaseOnlyParams = {
+  terminal: 'terminal-1',
+  client: { id: 'phone-1', type: 'mobile' },
+  capabilities: { terminalBinaryStream: 1, mobileInputLeaseOnly: 1 }
+}
+
+let nextRequestId = 0
+const subscribeRequest = (params: unknown): RpcRequest => ({
+  id: `req-${++nextRequestId}`,
+  authToken: 'tok',
+  method: 'terminal.subscribe',
+  params
+})
+const unsubscribeRequest = (): RpcRequest => ({
+  id: `req-${++nextRequestId}`,
+  authToken: 'tok',
+  method: 'terminal.unsubscribe',
+  params: { subscriptionId: SUBSCRIPTION_ID }
+})
+
+/** What a phone that addresses its request sends; the slot fields stay for older hosts. */
+const phoneUnsubscribeParams = (requestId: string) => ({
+  subscriptionId: SUBSCRIPTION_ID,
+  client: { id: 'phone-1' },
+  requestId
+})
+const requestUnsubscribe = (requestId: string): RpcRequest => ({
+  id: `req-${++nextRequestId}`,
+  authToken: 'tok',
+  method: 'terminal.unsubscribe',
+  params: phoneUnsubscribeParams(requestId)
+})
+
+const phoneConnection = (connectionId: string, signal?: AbortSignal) => ({
+  connectionId,
+  signal,
+  sendBinary: vi.fn(),
+  registerBinaryStreamHandler: vi.fn(() => vi.fn())
+})
+
+const resultTypes = (messages: string[]): unknown[] =>
+  messages.map((message) => JSON.parse(message).result?.type)
+
+const flush = (ms = 20): Promise<unknown> => new Promise((resolve) => setTimeout(resolve, ms))
+
+/** Resolves pending `waitForLeafPtyId` calls on demand and rejects them when their signal aborts, like the runtime. */
+function createPtyWaits() {
+  const waits: { resolve: (ptyId: string) => void }[] = []
+  return {
+    waits,
+    waitForLeafPtyId: vi.fn(
+      (_handle: string, _timeoutMs?: number, signal?: AbortSignal) =>
+        new Promise<string>((resolve, reject) => {
+          if (signal?.aborted) {
+            reject(new Error('request_aborted'))
+            return
+          }
+          signal?.addEventListener('abort', () => reject(new Error('request_aborted')), {
+            once: true
+          })
+          waits.push({ resolve })
+        })
+    ),
+    spawn: () => {
+      for (const wait of waits.splice(0)) {
+        wait.resolve(PTY_ID)
+      }
+    }
+  }
+}
+
+function stubRuntime(overrides: Record<string, unknown> = {}) {
+  const registry = createSubscriptionRegistryDouble()
+  const ptyWaits = createPtyWaits()
+  let ptyReady = false
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This partial runtime supplies the terminal RPC methods these tests invoke.
+  const runtime = {
+    getRuntimeId: () => 'test-runtime',
+    registerRemoteTerminalViewSubscriber: () => () => {},
+    requestRendererTerminalTabMount: vi.fn(() => false),
+    resolveLeafForHandle: vi.fn(() => ({ ptyId: ptyReady ? PTY_ID : null })),
+    waitForLeafPtyId: ptyWaits.waitForLeafPtyId,
+    handleMobileSubscribe: vi.fn().mockResolvedValue(true),
+    handleMobileUnsubscribe: vi.fn(),
+    subscribeToTerminalData: vi.fn(() => vi.fn()),
+    readTerminal: vi.fn().mockResolvedValue({ tail: ['scrollback'], truncated: false }),
+    serializeTerminalBuffer: vi
+      .fn()
+      .mockResolvedValue({ data: 'snapshot', cols: 40, rows: 20, seq: 4 }),
+    getTerminalSize: vi.fn().mockReturnValue({ cols: 40, rows: 20 }),
+    getMobileDisplayMode: vi.fn().mockReturnValue('auto'),
+    getLayout: vi.fn().mockReturnValue({ seq: 1 }),
+    isTerminalAlternateScreen: vi.fn().mockReturnValue(false),
+    subscribeToTerminalResize: vi.fn(() => vi.fn()),
+    subscribeToFitOverrideChanges: vi.fn(() => vi.fn()),
+    subscribeToPtyExit: vi.fn(() => vi.fn()),
+    registerOwnedSubscriptionCleanup: registry.registerOwnedSubscriptionCleanup,
+    cleanupSubscriptionIfOwnedByConnection: registry.cleanupSubscriptionIfOwnedByConnection,
+    getSubscriptionRegistrationVersion: registry.getSubscriptionRegistrationVersion,
+    releaseSubscriptionByRequest: registry.releaseSubscriptionByRequest,
+    ...overrides
+  } as unknown as OrcaRuntimeService
+  const spawn = (): void => {
+    ptyReady = true
+    ptyWaits.spawn()
+  }
+  return { runtime, registry, ptyWaits, spawn }
+}
+
+/** The real runtime, with only handle resolution, the pty wait, the scrollback read and tab mounting doubled. */
+function createRealRuntime() {
+  const runtime = new OrcaRuntimeService()
+  const sizes = new Map<string, { cols: number; rows: number }>([[PTY_ID, { cols: 120, rows: 40 }]])
+  runtime.setPtyController({
+    write: () => true,
+    kill: () => true,
+    getForegroundProcess: async () => null,
+    resize: (ptyId, cols, rows) => {
+      sizes.set(ptyId, { cols, rows })
+      return true
+    },
+    getSize: (ptyId) => sizes.get(ptyId) ?? null
+  })
+  const ptyWaits = createPtyWaits()
+  let ptyReady = false
+  vi.spyOn(runtime, 'resolveLeafForHandle').mockImplementation(() => ({
+    ptyId: ptyReady ? PTY_ID : null
+  }))
+  vi.spyOn(runtime, 'waitForLeafPtyId').mockImplementation(ptyWaits.waitForLeafPtyId)
+  vi.spyOn(runtime, 'readTerminal').mockResolvedValue({
+    handle: 'terminal-1',
+    status: 'running',
+    tail: [],
+    truncated: false,
+    nextCursor: null
+  })
+  vi.spyOn(runtime, 'requestRendererTerminalTabMount').mockReturnValue(false)
+  const spawn = (): void => {
+    ptyReady = true
+    ptyWaits.spawn()
+  }
+  return { runtime, ptyWaits, spawn, sizes }
+}
+
+describe('terminal.subscribe registers at admission', () => {
+  it('lets an unsubscribe end a subscribe that is still waiting for its pty', async () => {
+    const { runtime, registry, ptyWaits, spawn } = stubRuntime()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const messages: string[] = []
+    const subscribe = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+    await vi.waitFor(() => expect(ptyWaits.waitForLeafPtyId).toHaveBeenCalled())
+
+    const replies: string[] = []
+    await dispatcher.dispatchStreaming(unsubscribeRequest(), (reply) => replies.push(reply), {
+      connectionId: 'conn-a'
+    })
+    spawn()
+    await flush()
+
+    try {
+      expect(JSON.parse(replies[0]!).result).toEqual({ unsubscribed: true })
+      expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBeUndefined()
+      expect(runtime.handleMobileSubscribe).not.toHaveBeenCalled()
+      expect(resultTypes(messages)).toEqual(['end'])
+    } finally {
+      registry.cleanupSubscriptionsForConnection('conn-a')
+      await subscribe
+    }
+  })
+
+  it('leaves the desktop driver idle when the phone leaves before the pty is ready', async () => {
+    const { runtime, ptyWaits, spawn } = createRealRuntime()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const messages: string[] = []
+    const subscribe = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+    await vi.waitFor(() => expect(ptyWaits.waitForLeafPtyId).toHaveBeenCalled())
+
+    await dispatcher.dispatchStreaming(unsubscribeRequest(), vi.fn(), { connectionId: 'conn-a' })
+    spawn()
+    await flush()
+
+    try {
+      expect(runtime.getDriver(PTY_ID).kind).toBe('idle')
+      expect(runtime.getTerminalFitOverride(PTY_ID)).toBeNull()
+      expect(resultTypes(messages)).toEqual(['end'])
+    } finally {
+      runtime.cleanupSubscriptionsForConnection('conn-a')
+      await subscribe
+    }
+  })
+
+  it('ends a pending subscribe replaced by the same slot without adding its presence', async () => {
+    const { runtime, registry, ptyWaits, spawn } = stubRuntime()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const firstMessages: string[] = []
+    const first = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => firstMessages.push(message),
+      phoneConnection('conn-a')
+    )
+    await vi.waitFor(() => expect(ptyWaits.waitForLeafPtyId).toHaveBeenCalledTimes(1))
+
+    const second = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      vi.fn(),
+      phoneConnection('conn-b')
+    )
+    await vi.waitFor(() => expect(ptyWaits.waitForLeafPtyId).toHaveBeenCalledTimes(2))
+    const replacement = registry.peekCleanup(SUBSCRIPTION_ID)
+    spawn()
+    await first
+    await vi.waitFor(() => expect(runtime.handleMobileSubscribe).toHaveBeenCalled())
+    await flush()
+
+    try {
+      expect(resultTypes(firstMessages)).toEqual(['end'])
+      // Only the replacement joins; the evicted request never adds presence behind it.
+      expect(runtime.handleMobileSubscribe).toHaveBeenCalledOnce()
+      expect(runtime.handleMobileUnsubscribe).not.toHaveBeenCalled()
+      expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBe(replacement)
+    } finally {
+      registry.cleanupSubscriptionsForConnection('conn-b')
+      await second
+    }
+  })
+
+  it('leaves the desktop driver idle when the phone leaves during the phone-fit layout', async () => {
+    const { runtime, sizes } = createRealRuntime()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    let leaveDuringLayout = true
+    runtime.setPtyController({
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null,
+      resize: (ptyId, cols, rows) => {
+        sizes.set(ptyId, { cols, rows })
+        // The phone's unsubscribe lands while handleMobileSubscribe awaits its layout.
+        if (leaveDuringLayout) {
+          leaveDuringLayout = false
+          runtime.cleanupSubscriptionIfOwnedByConnection(SUBSCRIPTION_ID, 'conn-a')
+        }
+        return true
+      },
+      getSize: (ptyId) => sizes.get(ptyId) ?? null
+    })
+    vi.spyOn(runtime, 'resolveLeafForHandle').mockReturnValue({ ptyId: PTY_ID })
+    const messages: string[] = []
+
+    const subscribe = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+    await vi.waitFor(() => expect(leaveDuringLayout).toBe(false))
+    await subscribe
+
+    await vi.waitFor(() => expect(runtime.getDriver(PTY_ID).kind).toBe('idle'), {
+      timeout: 2_000
+    })
+    expect(resultTypes(messages)).toEqual(['end'])
+  })
+
+  it('leaves no registration when the request aborts while the pty is pending', async () => {
+    const { runtime, registry, ptyWaits, spawn } = stubRuntime()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const request = new AbortController()
+    const messages: string[] = []
+    const subscribe = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => messages.push(message),
+      phoneConnection('conn-a', request.signal)
+    )
+    await vi.waitFor(() => expect(ptyWaits.waitForLeafPtyId).toHaveBeenCalled())
+
+    request.abort()
+    spawn()
+    await subscribe
+    await flush()
+
+    expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBeUndefined()
+    expect(runtime.handleMobileSubscribe).not.toHaveBeenCalled()
+    expect(runtime.subscribeToTerminalData).not.toHaveBeenCalled()
+    expect(resultTypes(messages)).toEqual(['end'])
+  })
+
+  it('does not follow a released stream end with an error', async () => {
+    let rejectSubscribe = (_error: Error): void => {}
+    const { runtime, registry } = stubRuntime({
+      resolveLeafForHandle: vi.fn(() => ({ ptyId: PTY_ID })),
+      handleMobileSubscribe: vi.fn(
+        () =>
+          new Promise<boolean>((_resolve, reject) => {
+            rejectSubscribe = reject
+          })
+      )
+    })
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const messages: string[] = []
+    const subscribe = dispatcher.dispatchStreaming(
+      subscribeRequest(leaseOnlyParams),
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+    await vi.waitFor(() => expect(runtime.handleMobileSubscribe).toHaveBeenCalled())
+
+    registry.cleanupSubscriptionIfOwnedByConnection(SUBSCRIPTION_ID, 'conn-a')
+    rejectSubscribe(new Error('subscribe_failed'))
+    await subscribe
+
+    expect(messages.map((message) => JSON.parse(message))).toEqual([
+      expect.objectContaining({ ok: true, result: { type: 'end' } })
+    ])
+  })
+
+  it('fails without end when the stream errors before anything released it', async () => {
+    const { runtime, registry } = stubRuntime({
+      resolveLeafForHandle: vi.fn(() => ({ ptyId: PTY_ID })),
+      handleMobileSubscribe: vi.fn().mockRejectedValue(new Error('subscribe_failed'))
+    })
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const messages: string[] = []
+
+    await dispatcher.dispatchStreaming(
+      subscribeRequest(leaseOnlyParams),
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+
+    expect(messages.map((message) => JSON.parse(message).ok)).toEqual([false])
+    expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBeUndefined()
+    // Presence was added before the await, so the failed request still removes it.
+    expect(runtime.handleMobileUnsubscribe).toHaveBeenCalledWith(PTY_ID, 'phone-1')
+  })
+})
+
+describe('terminal.subscribe characterization', () => {
+  it('answers a dead pty with a scrollback preview, then one end, and keeps no registration', async () => {
+    const { runtime, registry } = stubRuntime({
+      waitForLeafPtyId: vi.fn().mockRejectedValue(new Error('Timed out waiting for PTY to spawn'))
+    })
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const messages: string[] = []
+
+    await dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+
+    expect(runtime.waitForLeafPtyId).toHaveBeenCalled()
+    expect(messages.map((message) => JSON.parse(message).result)).toEqual([
+      { type: 'subscribed', streamId: null, lines: ['scrollback'], truncated: false },
+      { type: 'end' }
+    ])
+    expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBeUndefined()
+  })
+
+  it('stops listening to a long-lived IPC signal once the stream is released', async () => {
+    const { runtime, registry } = stubRuntime({
+      resolveLeafForHandle: vi.fn(() => ({ ptyId: PTY_ID }))
+    })
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    // IPC keeps one controller per subscription id and it outlives the dispatch.
+    const ipcSubscription = new AbortController()
+    const addAbort = vi.spyOn(ipcSubscription.signal, 'addEventListener')
+    const removeAbort = vi.spyOn(ipcSubscription.signal, 'removeEventListener')
+    const messages: string[] = []
+    const subscribe = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => messages.push(message),
+      { ...phoneConnection('ipc-a'), signal: ipcSubscription.signal }
+    )
+    await vi.waitFor(() => expect(runtime.handleMobileSubscribe).toHaveBeenCalled())
+    expect(addAbort).toHaveBeenCalledWith('abort', expect.any(Function), { once: true })
+
+    registry.cleanupSubscriptionIfOwnedByConnection(SUBSCRIPTION_ID, 'ipc-a')
+    await subscribe
+    expect(removeAbort).toHaveBeenCalledWith('abort', addAbort.mock.calls[0]![1])
+
+    ipcSubscription.abort()
+    await flush()
+    expect(runtime.handleMobileUnsubscribe).toHaveBeenCalledOnce()
+    expect(resultTypes(messages).filter((type) => type === 'end')).toHaveLength(1)
+  })
+
+  it('ends a stream when its IPC subscription is aborted', async () => {
+    const { runtime, registry } = stubRuntime({
+      resolveLeafForHandle: vi.fn(() => ({ ptyId: PTY_ID }))
+    })
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const ipcSubscription = new AbortController()
+    const messages: string[] = []
+    const subscribe = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => messages.push(message),
+      { ...phoneConnection('ipc-a'), signal: ipcSubscription.signal }
+    )
+    await vi.waitFor(() => expect(runtime.handleMobileSubscribe).toHaveBeenCalled())
+
+    ipcSubscription.abort()
+    await subscribe
+
+    expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBeUndefined()
+    expect(runtime.handleMobileUnsubscribe).toHaveBeenCalledWith(PTY_ID, 'phone-1')
+    expect(resultTypes(messages).at(-1)).toBe('end')
+  })
+
+  it('rejects a phone without binary streaming before it can replace the live stream', async () => {
+    const { runtime, registry } = stubRuntime({
+      waitForLeafPtyId: vi.fn().mockRejectedValue(new Error('Timed out waiting for PTY to spawn'))
+    })
+    const live = vi.fn()
+    registry.registerOwnedSubscriptionCleanup(SUBSCRIPTION_ID, live, 'conn-a')
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const messages: string[] = []
+
+    // A pre-binary phone subscribing to a pty that never spawned: this used to get a preview and end.
+    await dispatcher.dispatchStreaming(
+      subscribeRequest({ terminal: 'terminal-1', client: { id: 'phone-1', type: 'mobile' } }),
+      (message) => messages.push(message),
+      { connectionId: 'conn-b' }
+    )
+
+    expect(JSON.parse(messages[0]!)).toMatchObject({
+      ok: false,
+      error: { message: 'binary_terminal_stream_required' }
+    })
+    expect(messages).toHaveLength(1)
+    expect(runtime.waitForLeafPtyId).not.toHaveBeenCalled()
+    expect(live).not.toHaveBeenCalled()
+    expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBe(live)
+  })
+})
+
+describe('terminal.unsubscribe addressed by request', () => {
+  const liveStub = () => stubRuntime({ resolveLeafForHandle: vi.fn(() => ({ ptyId: PTY_ID })) })
+
+  it('does not let a replaced request end the newer stream on the same slot', async () => {
+    const { runtime, registry } = liveStub()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const older = subscribeRequest(binaryParams)
+    const first = dispatcher.dispatchStreaming(older, vi.fn(), phoneConnection('conn-a'))
+    await vi.waitFor(() => expect(runtime.handleMobileSubscribe).toHaveBeenCalledTimes(1))
+    const newerMessages: string[] = []
+    const second = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => newerMessages.push(message),
+      phoneConnection('conn-a')
+    )
+    await vi.waitFor(() => expect(runtime.handleMobileSubscribe).toHaveBeenCalledTimes(2))
+    const replacement = registry.peekCleanup(SUBSCRIPTION_ID)
+
+    // The phone disposes the older stream only after the newer one registered.
+    await dispatcher.dispatchStreaming(requestUnsubscribe(older.id), vi.fn(), {
+      connectionId: 'conn-a'
+    })
+    await flush()
+
+    try {
+      expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBe(replacement)
+      expect(resultTypes(newerMessages)).not.toContain('end')
+    } finally {
+      registry.cleanupSubscriptionsForConnection('conn-a')
+      await Promise.all([first, second])
+    }
+  })
+
+  it('ends a subscribe still waiting for its pty, addressed by its request id', async () => {
+    const { runtime, ptyWaits, spawn } = createRealRuntime()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const pending = subscribeRequest(binaryParams)
+    const messages: string[] = []
+    const subscribe = dispatcher.dispatchStreaming(
+      pending,
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+    await vi.waitFor(() => expect(ptyWaits.waitForLeafPtyId).toHaveBeenCalled())
+
+    await dispatcher.dispatchStreaming(requestUnsubscribe(pending.id), vi.fn(), {
+      connectionId: 'conn-a'
+    })
+    spawn()
+    await flush()
+
+    try {
+      expect(runtime.getDriver(PTY_ID).kind).toBe('idle')
+      expect(runtime.getTerminalFitOverride(PTY_ID)).toBeNull()
+      expect(resultTypes(messages)).toEqual(['end'])
+    } finally {
+      runtime.cleanupSubscriptionsForConnection('conn-a')
+      await subscribe
+    }
+  })
+
+  it.each([
+    ['an unknown request', () => 'req-unknown'],
+    ['the unsubscribe itself', (unsubscribeId: string) => unsubscribeId],
+    ['a non-terminal stream', () => 'req-tabs']
+  ])('treats %s as a no-op without touching the slot', async (_label, target) => {
+    const { runtime, registry } = liveStub()
+    const tabsCleanup = vi.fn()
+    registry.registerSubscriptionCleanup('session.tabs:conn-a:wt:req-tabs', tabsCleanup, 'conn-a')
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const messages: string[] = []
+    const subscribe = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+    await vi.waitFor(() => expect(runtime.handleMobileSubscribe).toHaveBeenCalled())
+    const live = registry.peekCleanup(SUBSCRIPTION_ID)
+
+    const unsubscribeId = `req-${++nextRequestId}`
+    const replies: string[] = []
+    await dispatcher.dispatchStreaming(
+      {
+        id: unsubscribeId,
+        authToken: 'tok',
+        method: 'terminal.unsubscribe',
+        params: phoneUnsubscribeParams(target(unsubscribeId))
+      },
+      (reply) => replies.push(reply),
+      { connectionId: 'conn-a' }
+    )
+    await flush()
+
+    try {
+      expect(JSON.parse(replies[0]!).result).toEqual({ unsubscribed: true })
+      expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBe(live)
+      expect(resultTypes(messages)).not.toContain('end')
+      expect(tabsCleanup).not.toHaveBeenCalled()
+    } finally {
+      registry.cleanupSubscriptionsForConnection('conn-a')
+      await subscribe
+    }
+  })
+
+  it('is a no-op on a socket without a connection id', async () => {
+    const { runtime, registry } = liveStub()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const live = subscribeRequest(binaryParams)
+    const subscribe = dispatcher.dispatchStreaming(live, vi.fn(), phoneConnection('conn-a'))
+    await vi.waitFor(() => expect(runtime.handleMobileSubscribe).toHaveBeenCalled())
+    const liveCleanup = registry.peekCleanup(SUBSCRIPTION_ID)
+
+    await dispatcher.dispatchStreaming(requestUnsubscribe(live.id), vi.fn())
+    await flush()
+
+    try {
+      expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBe(liveCleanup)
+    } finally {
+      registry.cleanupSubscriptionsForConnection('conn-a')
+      await subscribe
+    }
+  })
+
+  it('lets a host without the field strip it and end the slot, as before', async () => {
+    // The shape every earlier host validates `terminal.unsubscribe` with; it is not strict.
+    const legacySchema = TerminalUnsubscribe.omit({ requestId: true })
+    const legacyParams = legacySchema.parse(phoneUnsubscribeParams('req-any'))
+    expect(legacyParams).toEqual({ subscriptionId: SUBSCRIPTION_ID, client: { id: 'phone-1' } })
+
+    const { runtime, registry } = liveStub()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const messages: string[] = []
+    const subscribe = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+    await vi.waitFor(() => expect(runtime.handleMobileSubscribe).toHaveBeenCalled())
+
+    await dispatcher.dispatchStreaming(
+      {
+        id: `req-${++nextRequestId}`,
+        authToken: 'tok',
+        method: 'terminal.unsubscribe',
+        params: legacyParams
+      },
+      vi.fn(),
+      { connectionId: 'conn-a' }
+    )
+    await subscribe
+
+    expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBeUndefined()
+    expect(resultTypes(messages).at(-1)).toBe('end')
+  })
+
+  it('never lets a back-to-back unsubscribe overtake the subscribe it names', async () => {
+    const { runtime, registry } = liveStub()
+    const register = vi.spyOn(runtime, 'registerOwnedSubscriptionCleanup')
+    const release = vi.spyOn(runtime, 'releaseSubscriptionByRequest')
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const subscribe = subscribeRequest(binaryParams)
+    const messages: string[] = []
+
+    const streaming = dispatcher.dispatchStreaming(
+      subscribe,
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+    const unsubscribing = dispatcher.dispatchStreaming(requestUnsubscribe(subscribe.id), vi.fn(), {
+      connectionId: 'conn-a'
+    })
+    await Promise.all([streaming, unsubscribing])
+    await flush()
+
+    expect(register.mock.invocationCallOrder[0]).toBeLessThan(release.mock.invocationCallOrder[0]!)
+    expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBeUndefined()
+    expect(registry.requestAddressCount()).toBe(0)
+    expect(resultTypes(messages).filter((type) => type === 'end')).toHaveLength(1)
+  })
+
+  it('heals a half-open socket: the replay on a new socket is what the leave ends', async () => {
+    const { runtime, spawn } = createRealRuntime()
+    spawn()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    // Replay after a reconnect resends the same request id on the new socket.
+    const replayed = subscribeRequest(binaryParams)
+    const halfOpenMessages: string[] = []
+    const halfOpen = dispatcher.dispatchStreaming(
+      replayed,
+      (message) => halfOpenMessages.push(message),
+      phoneConnection('conn-1')
+    )
+    await vi.waitFor(() => expect(runtime.getDriver(PTY_ID).kind).toBe('mobile'))
+    const replay = dispatcher.dispatchStreaming(replayed, vi.fn(), phoneConnection('conn-2'))
+    await halfOpen
+    expect(resultTypes(halfOpenMessages).at(-1)).toBe('end')
+
+    await dispatcher.dispatchStreaming(requestUnsubscribe(replayed.id), vi.fn(), {
+      connectionId: 'conn-2'
+    })
+    await replay
+
+    await vi.waitFor(() => expect(runtime.getDriver(PTY_ID).kind).toBe('idle'), {
+      timeout: 2_000
+    })
+    // The half-open socket's eventual close finds nothing of its own left.
+    runtime.cleanupSubscriptionsForConnection('conn-1')
+    expect(runtime.getDriver(PTY_ID).kind).toBe('idle')
+  })
+})
diff --git a/src/main/runtime/rpc/terminal-subscribe-buffer.test.ts b/src/main/runtime/rpc/terminal-subscribe-buffer.test.ts
index b6c53668f2d..a08458d8be5 100644
--- a/src/main/runtime/rpc/terminal-subscribe-buffer.test.ts
+++ b/src/main/runtime/rpc/terminal-subscribe-buffer.test.ts
@@ -13,8 +13,11 @@ import {
 } from '../../../shared/terminal-stream-protocol'
 
 function stubRuntime(overrides: Partial<OrcaRuntimeService> = {}): OrcaRuntimeService {
+  const registry = createSubscriptionRegistryDouble()
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This partial runtime supplies the terminal RPC methods these tests invoke.
   return {
     getRuntimeId: () => 'test-runtime',
+    registerOwnedSubscriptionCleanup: registry.registerOwnedSubscriptionCleanup,
     subscribeToPtyExit: vi.fn(() => vi.fn()),
     // Why: subscribe streams register as remote view subscribers for Phase-5
     // query-authority suppression (terminal-query-authority.md).
@@ -76,7 +79,8 @@ describe('terminal subscribe buffering', () => {
 
       expect(await outcomePromise).toBe('settled')
       expect(runtime.readTerminal).not.toHaveBeenCalled()
-      expect(messages).toEqual([])
+      // The pending stream was registered, so its release ends it like any other.
+      expect(messages.map((msg) => JSON.parse(msg).result?.type)).toEqual(['end'])
     } finally {
       vi.useRealTimers()
     }
@@ -302,7 +306,8 @@ describe('terminal subscribe buffering', () => {
       expect(runtime.registerOwnedSubscriptionCleanup).toHaveBeenCalledWith(
         'terminal-1:desktop-1',
         expect.any(Function),
-        'conn-legacy-json'
+        'conn-legacy-json',
+        'req-1'
       )
       expect(registry.peekCleanup('terminal-1:desktop-1')).toBeUndefined()
       expect(runtime.waitForTerminal).not.toHaveBeenCalled()
diff --git a/src/main/runtime/rpc/terminal-subscribe-mount-replay.test.ts b/src/main/runtime/rpc/terminal-subscribe-mount-replay.test.ts
index c64747616cf..6dd443f1402 100644
--- a/src/main/runtime/rpc/terminal-subscribe-mount-replay.test.ts
+++ b/src/main/runtime/rpc/terminal-subscribe-mount-replay.test.ts
@@ -11,6 +11,11 @@ import { RpcDispatcher } from './dispatcher'
 import { TERMINAL_METHODS } from './methods/terminal'
 import { createSubscriptionRegistryDouble } from './subscription-registry-test-double'
 
+function asRuntime(double: Record<string, unknown>): OrcaRuntimeService {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: terminal.subscribe reads only the members the double provides.
+  return double as unknown as OrcaRuntimeService
+}
+
 const request: RpcRequest = {
   id: 'req-1',
   authToken: 'tok',
@@ -97,7 +102,7 @@ describe('terminal subscribe mount replay', () => {
     let generation = 1
     let headlessPresent = false
     let serializeCalls = 0
-    const runtime = {
+    const runtime = asRuntime({
       getRuntimeId: () => 'test-runtime',
       subscribeToPtyExit: vi.fn(() => vi.fn()),
       resolveLeafForHandle: vi.fn().mockReturnValue({ ptyId: 'pty-1' }),
@@ -110,9 +115,9 @@ describe('terminal subscribe mount replay', () => {
       waitForRendererTerminalSerializer: vi.fn(async (_ptyId, afterGeneration) => {
         return generation > afterGeneration
       }),
+      // The phone fit's redraw creates suffix-only headless state.
       handleMobileSubscribe: vi.fn(async () => {
         headlessPresent = true
-        generation = 2
         return true
       }),
       handleMobileUnsubscribe: vi.fn(),
@@ -126,12 +131,15 @@ describe('terminal subscribe mount replay', () => {
         }
         return { data: 'raced idle prompt $ ', cols: 80, rows: 24, seq: 5 }
       }),
-      serializeRendererTerminalBuffer: vi.fn(async () => ({
-        data: 'raced idle prompt $ ',
-        cols: 80,
-        rows: 24,
-        seq: 5
-      })),
+      // Baseline race: the pane settles between the attachment answer and the wait, so the wait
+      // must still count that settle against the pre-fit generation.
+      serializeRendererTerminalBuffer: vi
+        .fn()
+        .mockImplementationOnce(async () => {
+          generation = 2
+          return null
+        })
+        .mockResolvedValue({ data: 'raced idle prompt $ ', cols: 80, rows: 24, seq: 5 }),
       getTerminalSize: vi.fn().mockReturnValue({ cols: 80, rows: 24 }),
       getMobileDisplayMode: vi.fn().mockReturnValue('auto'),
       getLayout: vi.fn().mockReturnValue({ seq: 1 }),
@@ -142,7 +150,7 @@ describe('terminal subscribe mount replay', () => {
       registerOwnedSubscriptionCleanup: vi.fn(registry.registerOwnedSubscriptionCleanup),
       cleanupSubscription: vi.fn(registry.cleanupSubscription),
       waitForTerminal: vi.fn(() => new Promise<RuntimeTerminalWait>(() => {}))
-    } as unknown as OrcaRuntimeService
+    })
     const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
 
     const dispatchPromise = dispatcher.dispatchStreaming(request, vi.fn(), {
@@ -286,11 +294,8 @@ describe('terminal subscribe mount replay', () => {
     const registry = createSubscriptionRegistryDouble()
     let generation = 0
     let headlessPresent = false
-    const requestRendererTerminalTabMount = vi.fn(() => {
-      generation = 1
-      return true
-    })
-    const runtime = {
+    const requestRendererTerminalTabMount = vi.fn(() => true)
+    const runtime = asRuntime({
       getRuntimeId: () => 'test-runtime',
       subscribeToPtyExit: vi.fn(() => vi.fn()),
       resolveLeafForHandle: vi.fn().mockReturnValue(null),
@@ -320,11 +325,15 @@ describe('terminal subscribe mount replay', () => {
         rows: 24,
         seq: 1
       }),
-      serializeRendererTerminalBuffer: vi.fn().mockResolvedValue({
-        data: 'late leaf prompt $ ',
-        cols: 80,
-        rows: 24
-      }),
+      // Baseline race: the pre-PTY mount settles between the attachment answer and the wait, so the
+      // wait must still count that settle against the pre-mount generation.
+      serializeRendererTerminalBuffer: vi
+        .fn()
+        .mockImplementationOnce(async () => {
+          generation = 1
+          return null
+        })
+        .mockResolvedValue({ data: 'late leaf prompt $ ', cols: 80, rows: 24 }),
       getTerminalSize: vi.fn().mockReturnValue({ cols: 80, rows: 24 }),
       getMobileDisplayMode: vi.fn().mockReturnValue('auto'),
       getLayout: vi.fn().mockReturnValue({ seq: 1 }),
@@ -335,7 +344,7 @@ describe('terminal subscribe mount replay', () => {
       registerOwnedSubscriptionCleanup: vi.fn(registry.registerOwnedSubscriptionCleanup),
       cleanupSubscription: vi.fn(registry.cleanupSubscription),
       waitForTerminal: vi.fn(() => new Promise<RuntimeTerminalWait>(() => {}))
-    } as unknown as OrcaRuntimeService
+    })
     const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
 
     const dispatchPromise = dispatcher.dispatchStreaming(request, vi.fn(), {
diff --git a/src/main/runtime/rpc/terminal-subscribe-mounted-pane.test.ts b/src/main/runtime/rpc/terminal-subscribe-mounted-pane.test.ts
new file mode 100644
index 00000000000..56720ff5d48
--- /dev/null
+++ b/src/main/runtime/rpc/terminal-subscribe-mounted-pane.test.ts
@@ -0,0 +1,370 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { RuntimeTerminalWait } from '../../../shared/runtime-types'
+import {
+  TerminalStreamOpcode,
+  decodeTerminalStreamFrame,
+  decodeTerminalStreamText
+} from '../../../shared/terminal-stream-protocol'
+import type { OrcaRuntimeService } from '../orca-runtime'
+import type { RpcRequest } from './core'
+import { RpcDispatcher } from './dispatcher'
+import { TERMINAL_METHODS } from './methods/terminal'
+import { createSubscriptionRegistryDouble } from './subscription-registry-test-double'
+
+const request: RpcRequest = {
+  id: 'req-1',
+  authToken: 'tok',
+  method: 'terminal.subscribe',
+  params: {
+    terminal: 'terminal-1',
+    client: { id: 'phone-1', type: 'mobile' },
+    capabilities: { terminalBinaryStream: 1 }
+  }
+}
+
+function asRuntime(double: Record<string, unknown>): OrcaRuntimeService {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: terminal.subscribe reads only the members the double provides.
+  return double as unknown as OrcaRuntimeService
+}
+
+type PaneDouble = {
+  /** What the desktop renderer's serializer answers; null when no pane is registered. */
+  rendererScreen: () => string | null
+  /** How long each renderer serialize takes; the IPC answers null after 750 ms when no pane replies. */
+  rendererAnswerDelayMs?: number
+  /** PTY output high-water; a pane printing continuously advances it on every read. */
+  outputSequence?: () => number
+  /** Renderer-ordered seq; null when the pane does not order output itself. */
+  rendererSeq?: number | null
+  /** What the preference order serves before any renderer probe. */
+  chosenScreen?: string
+  /** Live output that arrives while the subscription is still buffering. */
+  pendingOutput?: string
+  /** Output offset at the end of the pending chunk. */
+  pendingOutputSeq?: number
+  waitForRendererTerminalSerializer: OrcaRuntimeService['waitForRendererTerminalSerializer']
+}
+
+function subscribeMobile(pane: PaneDouble) {
+  const binaryFrames: Uint8Array<ArrayBufferLike>[] = []
+  const registry = createSubscriptionRegistryDouble()
+  let emitData: (data: string, meta: { seq: number; rawLength: number }) => void = () => {}
+  const runtime = {
+    getRuntimeId: () => 'test-runtime',
+    subscribeToPtyExit: vi.fn(() => vi.fn()),
+    resolveLeafForHandle: vi.fn().mockReturnValue({ ptyId: 'pty-1' }),
+    // A daemon PTY reattached after a desktop restart has no headless model yet.
+    hasHeadlessTerminalState: vi.fn(() => false),
+    requestRendererTerminalTabMount: vi.fn(() => true),
+    getRendererTerminalSerializerGenerationForHandle: vi.fn(() => 1),
+    getRendererTerminalSerializerGeneration: vi.fn(() => 1),
+    getPtyOutputSequence: vi.fn(pane.outputSequence ?? (() => 4)),
+    replaceHeadlessTerminalFromRendererSnapshotForRecovery: vi.fn(),
+    waitForRendererTerminalSerializer: vi.fn(pane.waitForRendererTerminalSerializer),
+    handleMobileSubscribe: vi.fn().mockResolvedValue(true),
+    handleMobileUnsubscribe: vi.fn(),
+    subscribeToTerminalData: vi.fn((_ptyId: string, listener: typeof emitData) => {
+      emitData = listener
+      return vi.fn()
+    }),
+    registerRemoteTerminalViewSubscriber: vi.fn(() => vi.fn()),
+    readTerminal: vi.fn().mockResolvedValue({ tail: [], truncated: false }),
+    // The restored provider snapshot wins the preference order over the live renderer.
+    serializeTerminalBuffer: vi.fn(async () => {
+      if (pane.pendingOutput) {
+        emitData(pane.pendingOutput, {
+          seq: pane.pendingOutputSeq ?? 3,
+          rawLength: pane.pendingOutput.length
+        })
+      }
+      return {
+        data: pane.chosenScreen ?? 'restored provider history',
+        cols: 80,
+        rows: 24,
+        seq: 2
+      }
+    }),
+    serializeRendererTerminalBuffer: vi.fn(async () => {
+      if (pane.rendererAnswerDelayMs) {
+        await new Promise((resolve) => setTimeout(resolve, pane.rendererAnswerDelayMs))
+      }
+      const screen = pane.rendererScreen()
+      const seq = pane.rendererSeq === undefined ? 4 : pane.rendererSeq
+      return screen === null
+        ? null
+        : {
+            data: screen,
+            cols: 80,
+            rows: 24,
+            ...(seq === null ? {} : { seq }),
+            source: 'renderer' as const
+          }
+    }),
+    getTerminalSize: vi.fn().mockReturnValue({ cols: 80, rows: 24 }),
+    getMobileDisplayMode: vi.fn().mockReturnValue('auto'),
+    getLayout: vi.fn().mockReturnValue({ seq: 1 }),
+    isTerminalAlternateScreen: vi.fn().mockReturnValue(false),
+    subscribeToTerminalResize: vi.fn().mockReturnValue(vi.fn()),
+    subscribeToFitOverrideChanges: vi.fn().mockReturnValue(vi.fn()),
+    registerSubscriptionCleanup: vi.fn(registry.registerSubscriptionCleanup),
+    registerOwnedSubscriptionCleanup: vi.fn(registry.registerOwnedSubscriptionCleanup),
+    cleanupSubscription: vi.fn(registry.cleanupSubscription),
+    waitForTerminal: vi.fn(() => new Promise<RuntimeTerminalWait>(() => {}))
+  }
+  const dispatcher = new RpcDispatcher({ runtime: asRuntime(runtime), methods: TERMINAL_METHODS })
+  const done = dispatcher.dispatchStreaming(request, vi.fn(), {
+    connectionId: 'conn-phone',
+    sendBinary: (bytes) => {
+      binaryFrames.push(bytes)
+    },
+    registerBinaryStreamHandler: vi.fn(() => vi.fn())
+  })
+  const snapshotText = (): string =>
+    binaryFrames
+      .map((bytes) => decodeTerminalStreamFrame(bytes))
+      .filter((frame) => frame?.opcode === TerminalStreamOpcode.SnapshotChunk)
+      .map((frame) => decodeTerminalStreamText(frame!.payload))
+      .join('')
+  const outputText = (): string =>
+    binaryFrames
+      .map((bytes) => decodeTerminalStreamFrame(bytes))
+      .filter((frame) => frame?.opcode === TerminalStreamOpcode.Output)
+      .map((frame) => decodeTerminalStreamText(frame!.payload))
+      .join('')
+  const close = async (): Promise<void> => {
+    runtime.cleanupSubscription('terminal-1:phone-1')
+    await done
+  }
+  return { runtime, snapshotText, outputText, close }
+}
+
+describe('terminal subscribe for a pane the desktop already has mounted', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+  })
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('adopts the live renderer screen over the chosen snapshot without waiting out the mount deadline', async () => {
+    // The renderer drops a mount request for a mounted tab, so no newer serializer settle ever arrives.
+    const subscription = subscribeMobile({
+      chosenScreen: 'suffix-only redraw',
+      rendererScreen: () => 'live desktop prompt $ ',
+      waitForRendererTerminalSerializer: (_ptyId, _after, _timeout, signal) =>
+        new Promise<boolean>((resolve) => {
+          signal?.addEventListener('abort', () => resolve(false), { once: true })
+        })
+    })
+
+    await vi.advanceTimersByTimeAsync(100)
+
+    expect(subscription.snapshotText()).toContain('live desktop prompt $ ')
+    expect(subscription.snapshotText()).not.toContain('suffix-only redraw')
+    expect(subscription.runtime.requestRendererTerminalTabMount).not.toHaveBeenCalled()
+    expect(subscription.runtime.waitForRendererTerminalSerializer).not.toHaveBeenCalled()
+    expect(
+      subscription.runtime.replaceHeadlessTerminalFromRendererSnapshotForRecovery
+    ).toHaveBeenCalledWith('pty-1', expect.objectContaining({ data: 'live desktop prompt $ ' }), [])
+    await subscription.close()
+  })
+
+  it('adopts a renderer-ordered screen even while output is pending', async () => {
+    // The screen's seq (4) is an exact seam inside the pending chunk (offsets 3..5), so only `z` replays.
+    const subscription = subscribeMobile({
+      rendererScreen: () => 'ordered desktop prompt $ ',
+      pendingOutput: 'Xz',
+      pendingOutputSeq: 5,
+      waitForRendererTerminalSerializer: (_ptyId, _after, _timeout, signal) =>
+        new Promise<boolean>((resolve) => {
+          signal?.addEventListener('abort', () => resolve(false), { once: true })
+        })
+    })
+
+    await vi.advanceTimersByTimeAsync(100)
+
+    expect(subscription.runtime.requestRendererTerminalTabMount).not.toHaveBeenCalled()
+    expect(subscription.snapshotText()).toContain('ordered desktop prompt $ ')
+    expect(subscription.snapshotText()).not.toContain('restored provider history')
+    expect(
+      subscription.runtime.replaceHeadlessTerminalFromRendererSnapshotForRecovery
+    ).toHaveBeenCalledWith(
+      'pty-1',
+      expect.objectContaining({ data: 'ordered desktop prompt $ ', seq: 4 }),
+      [{ data: 'z', seq: 5 }]
+    )
+    expect(subscription.outputText()).toBe('z')
+    await subscription.close()
+  })
+
+  it('answers at once for a mounted pane whose screen is still empty', async () => {
+    // A fresh shell that has printed nothing: the serializer is registered but its screen is blank.
+    const subscription = subscribeMobile({
+      rendererScreen: () => '',
+      waitForRendererTerminalSerializer: (_ptyId, _after, _timeout, signal) =>
+        new Promise<boolean>((resolve) => {
+          signal?.addEventListener('abort', () => resolve(false), { once: true })
+        })
+    })
+
+    await vi.advanceTimersByTimeAsync(100)
+
+    expect(subscription.runtime.requestRendererTerminalTabMount).not.toHaveBeenCalled()
+    // A blank renderer must not erase history the chosen snapshot already carries.
+    expect(subscription.snapshotText()).toContain('restored provider history')
+    expect(
+      subscription.runtime.replaceHeadlessTerminalFromRendererSnapshotForRecovery
+    ).not.toHaveBeenCalled()
+    await subscription.close()
+  })
+
+  it('answers at once for a mounted pane whose output never settles', async () => {
+    // A desktop agent printing continuously: every renderer serialize races a new byte.
+    let sequence = 4
+    const subscription = subscribeMobile({
+      rendererScreen: () => `agent frame ${sequence}`,
+      outputSequence: () => (sequence += 1),
+      waitForRendererTerminalSerializer: (_ptyId, _after, _timeout, signal) =>
+        new Promise<boolean>((resolve) => {
+          signal?.addEventListener('abort', () => resolve(false), { once: true })
+        })
+    })
+
+    await vi.advanceTimersByTimeAsync(100)
+
+    expect(subscription.runtime.requestRendererTerminalTabMount).not.toHaveBeenCalled()
+    expect(subscription.runtime.waitForRendererTerminalSerializer).not.toHaveBeenCalled()
+    // An unsettled screen has no exact seam against buffered output, so the chosen snapshot goes out.
+    expect(subscription.snapshotText()).toContain('restored provider history')
+    expect(
+      subscription.runtime.replaceHeadlessTerminalFromRendererSnapshotForRecovery
+    ).not.toHaveBeenCalled()
+    await subscription.close()
+  })
+
+  it('keeps the chosen snapshot for a seq-less mounted screen while output is pending', async () => {
+    // Without a seq, the buffered chunk would replay on top of a screen that already holds it.
+    const subscription = subscribeMobile({
+      rendererScreen: () => 'unordered desktop prompt $ ',
+      rendererSeq: null,
+      pendingOutput: 'pending byte',
+      waitForRendererTerminalSerializer: (_ptyId, _after, _timeout, signal) =>
+        new Promise<boolean>((resolve) => {
+          signal?.addEventListener('abort', () => resolve(false), { once: true })
+        })
+    })
+
+    await vi.advanceTimersByTimeAsync(100)
+
+    expect(subscription.runtime.requestRendererTerminalTabMount).not.toHaveBeenCalled()
+    expect(subscription.snapshotText()).toContain('restored provider history')
+    expect(subscription.snapshotText()).not.toContain('unordered desktop prompt $ ')
+    expect(
+      subscription.runtime.replaceHeadlessTerminalFromRendererSnapshotForRecovery
+    ).not.toHaveBeenCalled()
+    await subscription.close()
+  })
+
+  it('adopts a seq-less mounted screen when no output is pending', async () => {
+    // Right after a deferred cold restore the pane is not renderer-ordered yet; nothing can replay twice.
+    const subscription = subscribeMobile({
+      rendererScreen: () => 'unordered desktop prompt $ ',
+      rendererSeq: null,
+      waitForRendererTerminalSerializer: (_ptyId, _after, _timeout, signal) =>
+        new Promise<boolean>((resolve) => {
+          signal?.addEventListener('abort', () => resolve(false), { once: true })
+        })
+    })
+
+    await vi.advanceTimersByTimeAsync(100)
+
+    expect(subscription.runtime.requestRendererTerminalTabMount).not.toHaveBeenCalled()
+    expect(subscription.snapshotText()).toContain('unordered desktop prompt $ ')
+    expect(
+      subscription.runtime.replaceHeadlessTerminalFromRendererSnapshotForRecovery
+    ).toHaveBeenCalledWith(
+      'pty-1',
+      expect.objectContaining({ data: 'unordered desktop prompt $ ' }),
+      []
+    )
+    await subscription.close()
+  })
+
+  it('still requests the mount and waits for its settle when no pane is registered', async () => {
+    let mounted = false
+    const subscription = subscribeMobile({
+      rendererScreen: () => (mounted ? 'mounted idle prompt $ ' : null),
+      waitForRendererTerminalSerializer: (_ptyId, afterGeneration) => {
+        expect(afterGeneration).toBe(1)
+        return new Promise<boolean>((resolve) => {
+          setTimeout(() => {
+            mounted = true
+            resolve(true)
+          }, 500)
+        })
+      }
+    })
+
+    await vi.advanceTimersByTimeAsync(100)
+    expect(subscription.runtime.requestRendererTerminalTabMount).toHaveBeenCalledWith('terminal-1')
+    expect(subscription.snapshotText()).toBe('')
+    // No pane is registered, so nothing may spend a terminal read (which can reach the provider) before the settle.
+    expect(subscription.runtime.readTerminal).toHaveBeenCalledTimes(1)
+
+    await vi.advanceTimersByTimeAsync(400)
+    expect(subscription.snapshotText()).toContain('mounted idle prompt $ ')
+    expect(subscription.snapshotText()).not.toContain('restored provider history')
+    await subscription.close()
+  })
+
+  it('keeps the chosen snapshot after the mount wait when a seq-less screen meets pending output', async () => {
+    let mounted = false
+    const subscription = subscribeMobile({
+      rendererScreen: () => (mounted ? 'unordered mounted prompt $ ' : null),
+      rendererSeq: null,
+      pendingOutput: 'pending byte',
+      waitForRendererTerminalSerializer: () =>
+        new Promise<boolean>((resolve) => {
+          setTimeout(() => {
+            mounted = true
+            resolve(true)
+          }, 500)
+        })
+    })
+
+    await vi.advanceTimersByTimeAsync(500)
+
+    expect(subscription.runtime.requestRendererTerminalTabMount).toHaveBeenCalledWith('terminal-1')
+    expect(subscription.snapshotText()).toContain('restored provider history')
+    expect(
+      subscription.runtime.replaceHeadlessTerminalFromRendererSnapshotForRecovery
+    ).not.toHaveBeenCalled()
+    await subscription.close()
+  })
+
+  it('falls back to the mount wait within one serialize when the flag outlives its pane', async () => {
+    // Nothing clears the flag when a tab closes over a live PTY; the IPC then answers null at its
+    // 750 ms deadline while a busy PTY moves output under every attempt.
+    let sequence = 4
+    const subscription = subscribeMobile({
+      rendererScreen: () => null,
+      rendererAnswerDelayMs: 750,
+      outputSequence: () => (sequence += 1),
+      waitForRendererTerminalSerializer: (_ptyId, _after, _timeout, signal) =>
+        new Promise<boolean>((resolve) => {
+          signal?.addEventListener('abort', () => resolve(false), { once: true })
+        })
+    })
+
+    await vi.advanceTimersByTimeAsync(750)
+    expect(subscription.runtime.requestRendererTerminalTabMount).toHaveBeenCalledWith('terminal-1')
+    await vi.advanceTimersByTimeAsync(2_999)
+    expect(subscription.snapshotText()).toBe('')
+
+    // Worst case: one serialize plus the 3 s mount deadline.
+    await vi.advanceTimersByTimeAsync(1)
+    expect(subscription.snapshotText()).toContain('restored provider history')
+    expect(subscription.runtime.serializeRendererTerminalBuffer).toHaveBeenCalledTimes(1)
+    await subscription.close()
+  })
+})
diff --git a/src/main/runtime/rpc/terminal-subscribe-ownership.test.ts b/src/main/runtime/rpc/terminal-subscribe-ownership.test.ts
index d59287639b6..fefe8efb28d 100644
--- a/src/main/runtime/rpc/terminal-subscribe-ownership.test.ts
+++ b/src/main/runtime/rpc/terminal-subscribe-ownership.test.ts
@@ -119,7 +119,7 @@ describe('terminal.subscribe teardown ownership', () => {
     expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBeUndefined()
   })
 
-  it('disposes an already-exited PTY observer before binding socket abort', async () => {
+  it('disposes an already-exited PTY observer and the request-abort listener', async () => {
     const registry = createSubscriptionRegistryDouble()
     const unsubscribeExit = vi.fn()
     const runtime = stubRuntime(registry, [], {
@@ -131,12 +131,14 @@ describe('terminal.subscribe teardown ownership', () => {
     const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
     const conn = new AbortController()
     const addAbort = vi.spyOn(conn.signal, 'addEventListener')
+    const removeAbort = vi.spyOn(conn.signal, 'removeEventListener')
     const options = streamOptions('conn-a', conn.signal)
 
     await dispatcher.dispatchStreaming(makeRequest(binaryParams), vi.fn(), options)
 
     expect(unsubscribeExit).toHaveBeenCalledOnce()
-    expect(addAbort).not.toHaveBeenCalled()
+    expect(addAbort).toHaveBeenCalledOnce()
+    expect(removeAbort).toHaveBeenCalledWith('abort', addAbort.mock.calls[0]![1])
   })
 
   // Why: the synchronous release runs cleanup before setup, so anything registered after it never gets torn down.
diff --git a/src/main/runtime/rpc/ws-transport.test.ts b/src/main/runtime/rpc/ws-transport.test.ts
index f1ac250bdc3..45798a89528 100644
--- a/src/main/runtime/rpc/ws-transport.test.ts
+++ b/src/main/runtime/rpc/ws-transport.test.ts
@@ -88,13 +88,6 @@ describe('WebSocketTransport', () => {
     })
   }
 
-  it('starts and stops cleanly', async () => {
-    const { transport } = await createTransport()
-
-    await transport.start()
-    await transport.stop()
-  })
-
   it('arms heartbeat only while accepted connections exist', async () => {
     const { transport } = await createTransport()
     await transport.start()
diff --git a/src/main/runtime/runtime-automation-controller.ts b/src/main/runtime/runtime-automation-controller.ts
index d3ac55df438..20d3725c34e 100644
--- a/src/main/runtime/runtime-automation-controller.ts
+++ b/src/main/runtime/runtime-automation-controller.ts
@@ -113,7 +113,7 @@ export class RuntimeAutomationController {
     if (input.reuseSession && target.workspaceMode !== 'existing') {
       throw new Error('Session reuse requires an existing workspace target.')
     }
-    return this.store.createAutomation(
+    const automation = this.store.createAutomation(
       {
         creationKey: input.creationKey,
         name: input.name,
@@ -138,6 +138,8 @@ export class RuntimeAutomationController {
         ? { destination: destination ?? input.destination }
         : undefined
     )
+    await this.store.flushPendingOrThrowAsync?.({ drainToStableGeneration: false })
+    return automation
   }
 
   async update(
@@ -179,18 +181,21 @@ export class RuntimeAutomationController {
     if (!targetChanged && patch.reuseSession && current.workspaceMode !== 'existing') {
       throw new Error('Session reuse requires an existing workspace target.')
     }
-    return this.store.updateAutomation(id, patch, options)
+    const automation = this.store.updateAutomation(id, patch, options)
+    await this.store.flushPendingOrThrowAsync?.({ drainToStableGeneration: false })
+    return automation
   }
 
-  delete(
+  async delete(
     id: string,
     expectedOwner?: AutomationOwnerPrecondition
-  ): { removed: boolean; id: string } {
+  ): Promise<{ removed: boolean; id: string }> {
     if (!this.store?.deleteAutomation) {
       throw new Error('runtime_unavailable')
     }
     this.show(id)
     this.store.deleteAutomation(id, expectedOwner ? { expectedOwner } : undefined)
+    await this.store.flushPendingOrThrowAsync?.({ drainToStableGeneration: false })
     return { removed: true, id }
   }
 
diff --git a/src/main/runtime/runtime-client-settings-linear-team-projection.test.ts b/src/main/runtime/runtime-client-settings-linear-team-projection.test.ts
new file mode 100644
index 00000000000..c26eecb3d95
--- /dev/null
+++ b/src/main/runtime/runtime-client-settings-linear-team-projection.test.ts
@@ -0,0 +1,51 @@
+import { describe, expect, it } from 'vitest'
+import { RuntimeClientSettingsController } from './runtime-client-settings'
+import { createGlobalSettingsFixture } from '../../shared/global-settings-test-fixture'
+import type { GlobalSettings } from '../../shared/global-settings-types'
+
+// Why: the projection is what paired clients render page.tasks from, and a
+// non-array in the host store crashed that page in 1.4.207 (0a2b6e7f).
+function projectionOf(settings: Partial<GlobalSettings>) {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: get() reads nothing but store.getSettings(); every other RuntimeStore member is unreachable from that path.
+  return new RuntimeClientSettingsController({ getSettings: () => settings } as never).get()
+}
+
+function hostSettings(overrides: Record<string, unknown>): Partial<GlobalSettings> {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the override deliberately carries the malformed on-disk shape the projection must tolerate.
+  return {
+    ...createGlobalSettingsFixture({ workspaceDir: '/w' }),
+    ...overrides
+  } as Partial<GlobalSettings>
+}
+
+describe('RuntimeClientSettingsController Linear team selection projection', () => {
+  it('publishes a saved team array unchanged', () => {
+    expect(
+      projectionOf(hostSettings({ defaultLinearTeamSelection: ['t1', 't2'] }))
+        .defaultLinearTeamSelection
+    ).toEqual(['t1', 't2'])
+  })
+
+  it('publishes sticky-all as null', () => {
+    expect(
+      projectionOf(hostSettings({ defaultLinearTeamSelection: null })).defaultLinearTeamSelection
+    ).toBeNull()
+  })
+
+  it('publishes only string team IDs from a malformed array', () => {
+    expect(
+      projectionOf(hostSettings({ defaultLinearTeamSelection: ['t1', 7, null, {}, 't2'] }))
+        .defaultLinearTeamSelection
+    ).toEqual(['t1', 't2'])
+  })
+
+  it('publishes null when the host store holds a string or an object', () => {
+    expect(
+      projectionOf(hostSettings({ defaultLinearTeamSelection: 't1' })).defaultLinearTeamSelection
+    ).toBeNull()
+    expect(
+      projectionOf(hostSettings({ defaultLinearTeamSelection: { 0: 't1' } }))
+        .defaultLinearTeamSelection
+    ).toBeNull()
+  })
+})
diff --git a/src/main/runtime/runtime-client-settings-source-control-projection.test.ts b/src/main/runtime/runtime-client-settings-source-control-projection.test.ts
new file mode 100644
index 00000000000..c1868df74bd
--- /dev/null
+++ b/src/main/runtime/runtime-client-settings-source-control-projection.test.ts
@@ -0,0 +1,53 @@
+import { describe, expect, it } from 'vitest'
+import { RuntimeClientSettingsController } from './runtime-client-settings'
+import { createGlobalSettingsFixture } from '../../shared/global-settings-test-fixture'
+import type { GlobalSettings } from '../../shared/global-settings-types'
+import { getDefaultSourceControlAiSettings } from '../../shared/source-control-ai'
+
+// Why: `settings.get` is an explicit allowlist. A paired client's AI buttons resolve their agent
+// from the saved per-action recipe, and a recipe missing here reads as "none saved" on the client.
+function projectionOf(settings: Partial<GlobalSettings>) {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: get() reads nothing but store.getSettings(); every other RuntimeStore member is unreachable from that path.
+  return new RuntimeClientSettingsController({ getSettings: () => settings } as never).get()
+}
+
+function hostSettings(sourceControlAi: GlobalSettings['sourceControlAi']): Partial<GlobalSettings> {
+  return { ...createGlobalSettingsFixture({ workspaceDir: '/w' }), sourceControlAi }
+}
+
+describe('RuntimeClientSettingsController source control launch recipes', () => {
+  it('publishes the recipe saved for a launch action', () => {
+    const projected = projectionOf(
+      hostSettings({
+        ...getDefaultSourceControlAiSettings(),
+        actions: { fixChecks: { agentId: 'codex', agentArgs: '--fast' } }
+      })
+    )
+    expect(projected.sourceControlAi.actions.fixChecks).toMatchObject({
+      agentId: 'codex',
+      agentArgs: '--fast'
+    })
+  })
+
+  it('publishes a recipe saved under the legacy launch defaults key', () => {
+    const projected = projectionOf(
+      hostSettings({
+        ...getDefaultSourceControlAiSettings(),
+        actions: undefined,
+        launchActionDefaults: { resolveConflicts: { agentId: 'claude' } }
+      })
+    )
+    expect(projected.sourceControlAi.actions.resolveConflicts).toMatchObject({ agentId: 'claude' })
+  })
+
+  it('publishes launch actions only, not the text generation recipes', () => {
+    const projected = projectionOf(hostSettings(getDefaultSourceControlAiSettings()))
+    expect(Object.keys(projected.sourceControlAi.actions).sort()).toEqual([
+      'fixChecks',
+      'fixCommitFailure',
+      'fixPushFailure',
+      'resolveComments',
+      'resolveConflicts'
+    ])
+  })
+})
diff --git a/src/main/runtime/runtime-client-settings.ts b/src/main/runtime/runtime-client-settings.ts
index 262021da0e5..d29b9afea1e 100644
--- a/src/main/runtime/runtime-client-settings.ts
+++ b/src/main/runtime/runtime-client-settings.ts
@@ -9,6 +9,11 @@ import {
   type TerminalQuickCommandMutation
 } from '../../shared/terminal-quick-commands'
 import { haveSameDisabledTuiAgents } from '../../shared/tui-agent-selection'
+import { normalizeSourceControlAiSettings } from '../../shared/source-control-ai'
+import {
+  SOURCE_CONTROL_LAUNCH_ACTION_IDS,
+  type SourceControlAiActionDefaults
+} from '../../shared/source-control-ai-actions'
 import type { GlobalSettings } from '../../shared/global-settings-types'
 import { applyNativeChatSessionOptionSettingsMutation } from '../../shared/native-chat-session-option-defaults'
 import type { NativeChatSessionOptionSettingsMutation } from '../../shared/native-chat-session-options'
@@ -17,6 +22,7 @@ import type { ExecutionHostId } from '../../shared/execution-host'
 import type { TerminalQuickCommand } from '../../shared/terminal-quick-command-types'
 import { recordManagedHookInstallFailure } from '../agent-hooks/install-telemetry'
 import { applyAgentStatusHooksEnabled } from '../agent-hooks/managed-agent-hook-controls'
+import { isAgentStatusHooksEnabledForAgent } from '../../shared/agent-status-hooks-setting'
 import type { RuntimeStore } from './runtime-store-contract'
 
 export type RuntimeClientSettings = Pick<
@@ -49,8 +55,12 @@ export type RuntimeClientSettings = Pick<
   | 'machineName'
 > & {
   hostSettingOverrides: RuntimeHostDisplayLabelOverrides
+  sourceControlAi: RuntimeClientSourceControlAi
 }
 
+/** The saved per-action launch recipes (agent, prompt template, agent args), already migrated. */
+export type RuntimeClientSourceControlAi = { actions: SourceControlAiActionDefaults }
+
 /** Safe paired projection: host labels only; filesystem defaults stay host-private. */
 export type RuntimeHostDisplayLabelOverrides = Partial<
   Record<ExecutionHostId, { displayLabel: string }>
@@ -107,7 +117,10 @@ export class RuntimeClientSettingsController {
       defaultTaskViewPreset: settings.defaultTaskViewPreset ?? 'issues',
       visibleTaskProviders: settings.visibleTaskProviders ?? [...TASK_PROVIDERS],
       defaultRepoSelection: settings.defaultRepoSelection ?? null,
-      defaultLinearTeamSelection: settings.defaultLinearTeamSelection ?? null,
+      // Persisted settings can violate the paired client's string-array contract.
+      defaultLinearTeamSelection: Array.isArray(settings.defaultLinearTeamSelection)
+        ? settings.defaultLinearTeamSelection.filter((id): id is string => typeof id === 'string')
+        : null,
       githubProjects: settings.githubProjects,
       experimentalNewWorktreeCardStyle: settings.experimentalNewWorktreeCardStyle === true,
       // The three that decide whether a new agent tab -- and so an orchestration worker -- is a
@@ -124,6 +137,9 @@ export class RuntimeClientSettingsController {
       worktreeVisibilityDefaults: settings.worktreeVisibilityDefaults ?? { external: 'hide' },
       agentSkillSharingEnabled: isAgentSkillSharingEnabled(settings),
       machineName: settings.machineName ?? '',
+      // Why projected: a paired client's AI buttons start these actions' agents, and must honour
+      // the agent saved for each one as the desktop does. Absent on older hosts.
+      sourceControlAi: projectSourceControlLaunchRecipes(settings),
       hostSettingOverrides: Object.fromEntries(
         [
           ...getHostDisplayLabelOverrides({ hostSettingOverrides: settings.hostSettingOverrides })
@@ -218,11 +234,7 @@ export class RuntimeClientSettingsController {
         onInstallError: recordManagedHookInstallFailure,
         shouldContinue: (agent) => {
           const current = this.store?.getSettings()
-          return (
-            current !== undefined &&
-            current.agentStatusHooksEnabled !== false &&
-            !current.disabledTuiAgents?.includes(agent)
-          )
+          return current !== undefined && isAgentStatusHooksEnabledForAgent(current, agent)
         }
       })
     })
@@ -230,3 +242,20 @@ export class RuntimeClientSettingsController {
     return reconciliation
   }
 }
+
+function projectSourceControlLaunchRecipes(
+  settings: Partial<Pick<GlobalSettings, 'sourceControlAi' | 'commitMessageAi'>>
+): RuntimeClientSourceControlAi {
+  const { actions } = normalizeSourceControlAiSettings(
+    settings.sourceControlAi,
+    settings.commitMessageAi
+  )
+  return {
+    actions: Object.fromEntries(
+      SOURCE_CONTROL_LAUNCH_ACTION_IDS.flatMap((actionId) => {
+        const recipe = actions?.[actionId]
+        return recipe ? [[actionId, recipe]] : []
+      })
+    )
+  }
+}
diff --git a/src/main/runtime/runtime-durable-store-fixture.ts b/src/main/runtime/runtime-durable-store-fixture.ts
new file mode 100644
index 00000000000..a5f2dc82793
--- /dev/null
+++ b/src/main/runtime/runtime-durable-store-fixture.ts
@@ -0,0 +1,40 @@
+import type { DurableProfileStateMutation } from '../persistence/loading-store/store-runtime-state'
+import { profileStateWriterFailureOutcome } from '../persistence/profile-state/profile-state-writer-errors'
+
+/** Keep runtime fakes on the same reserved, durable-before-ack contract as Store. */
+export function withDurableRuntimeStore<
+  T extends {
+    flushOrThrow?: () => void
+    flushPendingOrThrowAsync?: (options?: { drainToStableGeneration?: boolean }) => Promise<void>
+  }
+>(store: T) {
+  let pending = Promise.resolve()
+  return Object.assign(store, {
+    runDurableMutation<Value>(mutate: () => DurableProfileStateMutation<Value>): Promise<Value> {
+      const write = pending.then(async () => {
+        const mutation = mutate()
+        if (mutation.persist === false) {
+          return mutation.value
+        }
+        try {
+          if (store.flushPendingOrThrowAsync) {
+            await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+          } else {
+            store.flushOrThrow?.()
+          }
+        } catch (error) {
+          if (profileStateWriterFailureOutcome(error) !== 'indeterminate') {
+            mutation.rollback?.()
+          }
+          throw error
+        }
+        return mutation.value
+      })
+      pending = write.then(
+        () => {},
+        () => {}
+      )
+      return write
+    }
+  })
+}
diff --git a/src/main/runtime/runtime-file-commands-search-runtime-files.ts b/src/main/runtime/runtime-file-commands-search-runtime-files.ts
index fd79941c1ae..5a192c4e50d 100644
--- a/src/main/runtime/runtime-file-commands-search-runtime-files.ts
+++ b/src/main/runtime/runtime-file-commands-search-runtime-files.ts
@@ -13,6 +13,7 @@ import {
   listMarkdownDocuments,
   markdownDocumentsFromRelativePaths
 } from '../ipc/markdown-documents'
+import { getLocalGitOptionsForRegisteredWorktree } from '../ipc/local-worktree-runtime-options'
 import {
   validatePathExistenceBatch,
   type PathExistenceResult
@@ -82,7 +83,14 @@ export class RuntimeFileCommandsWithSearchRuntimeFiles extends RuntimeFileComman
       const relativePaths = await provider.listFiles(target.worktree.path)
       return markdownDocumentsFromRelativePaths(target.worktree.path, relativePaths)
     }
-    return listMarkdownDocuments(target.worktree.path)
+    return listMarkdownDocuments(
+      target.worktree.path,
+      getLocalGitOptionsForRegisteredWorktree(
+        this.host.requireStore(),
+        target.worktree.path,
+        target.worktree.path
+      )
+    )
   }
 
   async pathsExistRuntimeFiles(
diff --git a/src/main/runtime/runtime-file-commands-write-file-explorer-file.ts b/src/main/runtime/runtime-file-commands-write-file-explorer-file.ts
index 3336a86e7d7..92a356f987a 100644
--- a/src/main/runtime/runtime-file-commands-write-file-explorer-file.ts
+++ b/src/main/runtime/runtime-file-commands-write-file-explorer-file.ts
@@ -64,12 +64,12 @@ export class RuntimeFileCommandsWithWriteFileExplorerFile extends RuntimeFileCom
       expectedSshConnectionGeneration
     )
     const provider = requireRuntimeFileProvider(target)
-    const content = Buffer.from(contentBase64, 'base64')
     if (provider) {
       await provider.writeFileBase64(target.path, contentBase64)
       return { ok: true }
     }
 
+    const content = Buffer.from(contentBase64, 'base64')
     const filePath = await resolveAuthorizedPath(target.path, this.host.requireStore())
     await mkdir(dirname(filePath), { recursive: true })
     await writeFile(filePath, content, { flag: 'wx' })
@@ -93,12 +93,12 @@ export class RuntimeFileCommandsWithWriteFileExplorerFile extends RuntimeFileCom
       expectedSshConnectionGeneration
     )
     const provider = requireRuntimeFileProvider(target)
-    const content = Buffer.from(contentBase64, 'base64')
     if (provider) {
       await provider.writeFileBase64Chunk(target.path, contentBase64, append)
       return { ok: true }
     }
 
+    const content = Buffer.from(contentBase64, 'base64')
     const filePath = await resolveAuthorizedPath(target.path, this.host.requireStore())
     await mkdir(dirname(filePath), { recursive: true })
     await writeFile(filePath, content, { flag: append ? 'a' : 'wx' })
diff --git a/src/main/runtime/runtime-file-target-execution-host.test.ts b/src/main/runtime/runtime-file-target-execution-host.test.ts
index d9770b182df..40729da528c 100644
--- a/src/main/runtime/runtime-file-target-execution-host.test.ts
+++ b/src/main/runtime/runtime-file-target-execution-host.test.ts
@@ -141,7 +141,7 @@ describe('runtime file target execution host', () => {
     await runtime.listRuntimeMarkdownDocuments(`id:${WORKTREE_ID}`)
 
     expect(m4air.listFiles).not.toHaveBeenCalled()
-    expect(mocks.listMarkdownDocuments).toHaveBeenCalledWith(REMOTE_PATH)
+    expect(mocks.listMarkdownDocuments).toHaveBeenCalledWith(REMOTE_PATH, {})
   })
 
   // A `runtime:` row's `connectionId` names a target in the *server's* namespace. Reading it here
diff --git a/src/main/runtime/runtime-file-upload-decode.test.ts b/src/main/runtime/runtime-file-upload-decode.test.ts
new file mode 100644
index 00000000000..a07ce9ded3e
--- /dev/null
+++ b/src/main/runtime/runtime-file-upload-decode.test.ts
@@ -0,0 +1,236 @@
+import { dirname, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { RuntimeFileCommandHost } from './runtime-file-command-host'
+import type { SshChannelMultiplexer } from '../ssh/ssh-channel-multiplexer'
+
+const mocks = vi.hoisted(() => ({
+  resolvePath: vi.fn(),
+  expectation: vi.fn(),
+  provider: vi.fn(),
+  authorize: vi.fn(),
+  requireStore: vi.fn(),
+  mkdir: vi.fn(),
+  writeFile: vi.fn(),
+  writeBuffer: vi.fn()
+}))
+
+vi.mock('./runtime-file-commands-read-file-explorer-preview', () => ({
+  RuntimeFileCommandsWithReadFileExplorerPreview: class {
+    resolveFileExplorerPath = mocks.resolvePath
+    host = { requireStore: mocks.requireStore }
+  }
+}))
+vi.mock('./runtime-file-commands-mobile-file-list-limit', () => ({
+  assertRuntimeFileMutationExpectation: mocks.expectation
+}))
+vi.mock('./runtime-file-command-target', () => ({ requireRuntimeFileProvider: mocks.provider }))
+vi.mock('../ipc/filesystem-auth', () => ({ resolveAuthorizedPath: mocks.authorize }))
+vi.mock('node:fs/promises', async (importOriginal) => ({
+  ...(await importOriginal()),
+  mkdir: mocks.mkdir,
+  writeFile: mocks.writeFile
+}))
+
+import { RuntimeFileCommandsWithWriteFileExplorerFile } from './runtime-file-commands-write-file-explorer-file'
+import { SshFilesystemProvider } from '../providers/ssh-filesystem-provider'
+
+function unexpectedHostCall(): never {
+  throw new Error('Unexpected access beyond the isolated file command')
+}
+
+const host: RuntimeFileCommandHost = {
+  getRuntimeId: unexpectedHostCall,
+  requireStore: unexpectedHostCall,
+  resolveWorktreeSelector: unexpectedHostCall,
+  resolveRuntimeFileTarget: unexpectedHostCall,
+  resolveRuntimeGitTarget: unexpectedHostCall,
+  openFile: unexpectedHostCall,
+  openDiff: unexpectedHostCall
+}
+const commands = new RuntimeFileCommandsWithWriteFileExplorerFile(host)
+const destination = join('workspace', 'uploads', 'binary.dat')
+const target = { executionHostId: 'local', path: destination }
+let remote = false
+
+function sshProvider(): SshFilesystemProvider {
+  remote = true
+  mocks.resolvePath.mockResolvedValue({ ...target, executionHostId: 'ssh:target' })
+  const mux = { onNotification: vi.fn(() => () => {}), request: unexpectedHostCall }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: construction only subscribes; writes use the injected raw transfer and any mux request fails.
+  return new SshFilesystemProvider('target', mux as unknown as SshChannelMultiplexer, undefined, {
+    writeBuffer: mocks.writeBuffer
+  })
+}
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  remote = false
+  mocks.resolvePath.mockResolvedValue(target)
+  mocks.provider.mockReturnValue(null)
+  mocks.authorize.mockResolvedValue(destination)
+  mocks.requireStore.mockReturnValue({})
+  mocks.mkdir.mockResolvedValue(undefined)
+  mocks.writeFile.mockResolvedValue(undefined)
+  mocks.writeBuffer.mockResolvedValue(undefined)
+})
+afterEach(() => vi.restoreAllMocks())
+
+describe.each(['whole', 'first', 'append'] as const)('runtime %s base64 write', (mode) => {
+  const write = (base64: string) => {
+    if (remote) {
+      return mode === 'whole'
+        ? commands.writeFileExplorerFileBase64(
+            'folder:workspace',
+            'uploads/binary.dat',
+            base64,
+            7,
+            'target',
+            'ssh:target'
+          )
+        : commands.writeFileExplorerFileBase64Chunk(
+            'folder:workspace',
+            'uploads/binary.dat',
+            base64,
+            mode === 'append',
+            7,
+            'target',
+            'ssh:target'
+          )
+    }
+    return mode === 'whole'
+      ? commands.writeFileExplorerFileBase64(
+          'folder:workspace',
+          'uploads/binary.dat',
+          base64,
+          undefined,
+          undefined,
+          'local'
+        )
+      : commands.writeFileExplorerFileBase64Chunk(
+          'folder:workspace',
+          'uploads/binary.dat',
+          base64,
+          mode === 'append',
+          undefined,
+          undefined,
+          'local'
+        )
+  }
+
+  it.each(['', 'AAH+/w==', 'AA', '%%%'])(
+    'preserves local decoding and flags for %j',
+    async (base64) => {
+      const expected = Buffer.from(base64, 'base64')
+      const decode = vi.spyOn(Buffer, 'from')
+      await expect(write(base64)).resolves.toEqual({ ok: true })
+      expect(
+        decode.mock.calls.filter((args) => args.at(0) === base64 && args.at(1) === 'base64')
+      ).toHaveLength(1)
+      expect(mocks.expectation).toHaveBeenCalledWith('local', 'local', undefined, undefined)
+      expect(mocks.provider).toHaveBeenCalledWith(target)
+      expect(mocks.authorize).toHaveBeenCalledWith(
+        destination,
+        mocks.requireStore.mock.results[0].value
+      )
+      expect(mocks.mkdir).toHaveBeenCalledWith(dirname(destination), { recursive: true })
+      expect(mocks.writeFile).toHaveBeenCalledWith(destination, expected, {
+        flag: mode === 'append' ? 'a' : 'wx'
+      })
+      expect(mocks.writeBuffer).not.toHaveBeenCalled()
+      expect(mocks.expectation.mock.invocationCallOrder[0]).toBeLessThan(
+        mocks.provider.mock.invocationCallOrder[0]
+      )
+      expect(decode.mock.invocationCallOrder[0]).toBeLessThan(
+        mocks.authorize.mock.invocationCallOrder[0]
+      )
+    }
+  )
+
+  it.each(['', 'AAH+/w==', 'AA', '%%%'])(
+    'decodes once through the SSH provider for %j',
+    async (base64) => {
+      const expected = Buffer.from(base64, 'base64')
+      const provider = sshProvider()
+      mocks.provider.mockReturnValue(provider)
+      const decode = vi.spyOn(Buffer, 'from')
+      await expect(write(base64)).resolves.toEqual({ ok: true })
+      expect(
+        decode.mock.calls.filter((args) => args.at(0) === base64 && args.at(1) === 'base64')
+      ).toHaveLength(1)
+      expect(mocks.expectation).toHaveBeenCalledWith('ssh:target', 'ssh:target', 'target', 7)
+      expect(mocks.writeBuffer).toHaveBeenCalledWith(destination, expected, {
+        append: mode === 'append',
+        exclusive: mode !== 'append'
+      })
+      expect(mocks.authorize).not.toHaveBeenCalled()
+      expect(mocks.mkdir).not.toHaveBeenCalled()
+      expect(mocks.writeFile).not.toHaveBeenCalled()
+      provider.dispose()
+    }
+  )
+
+  it('avoids a second decoded slice for a full upload chunk', async () => {
+    mocks.provider.mockReturnValue(sshProvider())
+    const bytes = Buffer.alloc(384 * 1024, 0xb7)
+    const base64 = bytes.toString('base64')
+    const decode = vi.spyOn(Buffer, 'from')
+    await write(base64)
+    expect(
+      decode.mock.calls.filter((args) => args.at(0) === base64 && args.at(1) === 'base64')
+    ).toHaveLength(1)
+    expect(mocks.writeBuffer.mock.calls[0][1]).toEqual(bytes)
+  })
+
+  it.each(['resolve', 'expectation', 'provider'] as const)(
+    'preserves %s failure before decoding or writes',
+    async (stage) => {
+      const failure = new Error(stage)
+      if (stage === 'resolve') {
+        mocks.resolvePath.mockRejectedValue(failure)
+      } else if (stage === 'expectation') {
+        mocks.expectation.mockImplementation(() => {
+          throw failure
+        })
+      } else {
+        mocks.provider.mockImplementation(() => {
+          throw failure
+        })
+      }
+      const decode = vi.spyOn(Buffer, 'from')
+      await expect(write('AA==')).rejects.toBe(failure)
+      expect(decode).not.toHaveBeenCalled()
+      expect(mocks.authorize).not.toHaveBeenCalled()
+      expect(mocks.writeFile).not.toHaveBeenCalled()
+      expect(mocks.writeBuffer).not.toHaveBeenCalled()
+      if (stage === 'resolve') {
+        expect(mocks.expectation).not.toHaveBeenCalled()
+      }
+      if (stage !== 'provider') {
+        expect(mocks.provider).not.toHaveBeenCalled()
+      }
+    }
+  )
+
+  it.each(['authorize', 'mkdir', 'writeFile'] as const)(
+    'preserves local %s failure without a remote fallback',
+    async (stage) => {
+      const failure = new Error(stage)
+      mocks[stage].mockRejectedValue(failure)
+      await expect(write('AA==')).rejects.toBe(failure)
+      expect(mocks.writeBuffer).not.toHaveBeenCalled()
+      if (stage !== 'writeFile') {
+        expect(mocks.writeFile).not.toHaveBeenCalled()
+      }
+    }
+  )
+
+  it('propagates SSH sink errors without a local fallback', async () => {
+    mocks.provider.mockReturnValue(sshProvider())
+    const failure = new Error('SSH sink failed')
+    mocks.writeBuffer.mockRejectedValue(failure)
+    await expect(write('AA==')).rejects.toBe(failure)
+    expect(mocks.authorize).not.toHaveBeenCalled()
+    expect(mocks.mkdir).not.toHaveBeenCalled()
+    expect(mocks.writeFile).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/runtime/runtime-folder-worktree-create.test.ts b/src/main/runtime/runtime-folder-worktree-create.test.ts
index 885e61010dd..217d958d96e 100644
--- a/src/main/runtime/runtime-folder-worktree-create.test.ts
+++ b/src/main/runtime/runtime-folder-worktree-create.test.ts
@@ -28,7 +28,6 @@ function createDeps() {
     store: store as unknown as CreateArgs['deps']['store'],
     ptySpawnAvailable: true,
     createTerminal,
-    markTrusted: vi.fn(),
     pasteDraft: vi.fn(),
     sendFollowup: vi.fn(),
     invalidateResolvedWorktrees: vi.fn(),
diff --git a/src/main/runtime/runtime-folder-worktree-create.ts b/src/main/runtime/runtime-folder-worktree-create.ts
index fd13253c488..1b3cd2a829e 100644
--- a/src/main/runtime/runtime-folder-worktree-create.ts
+++ b/src/main/runtime/runtime-folder-worktree-create.ts
@@ -26,7 +26,6 @@ type RuntimeFolderWorktreeCreateDeps = {
     selector: string,
     options: TerminalCreateOptions
   ) => Promise<RuntimeTerminalCreate>
-  markTrusted: (agent: TuiAgent, path: string) => Promise<void>
   pasteDraft: (handle: string, draft: WorktreeStartupDraftPaste) => void
   sendFollowup: (handle: string, followup: WorktreeStartupFollowup) => void
   invalidateResolvedWorktrees: () => void
@@ -131,10 +130,6 @@ export async function createRuntimeFolderWorktree(args: {
   let startupTerminal: CreateWorktreeResult['startupTerminal']
   if (args.startup && deps.ptySpawnAvailable) {
     try {
-      const trustAgent = args.draftPaste?.agent ?? args.createdWithAgent
-      if (trustAgent) {
-        await deps.markTrusted(trustAgent, worktree.path)
-      }
       const terminal = await deps.createTerminal(`id:${worktree.id}`, {
         command: args.startup.command,
         ...(request.startupCwd ? { cwd: request.startupCwd } : {}),
diff --git a/src/main/runtime/runtime-git-generation-admission.test.ts b/src/main/runtime/runtime-git-generation-admission.test.ts
index 6631930082d..8e8391c10f3 100644
--- a/src/main/runtime/runtime-git-generation-admission.test.ts
+++ b/src/main/runtime/runtime-git-generation-admission.test.ts
@@ -1,3 +1,4 @@
+import { setImmediate as nextTurn } from 'node:timers/promises'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { GlobalSettings } from '../../shared/global-settings-types'
 import type { RuntimeGitCommandHost, RuntimeGitTarget } from './runtime-git-command-target'
@@ -14,13 +15,19 @@ const mocks = vi.hoisted(() => ({
   resolveHostedReviewBodyForGeneration: vi.fn()
 }))
 
+const linkedLookup = vi.hoisted(() => ({ run: (): Promise<null> => Promise.resolve(null) }))
+
 vi.mock('../git/status', () => ({ getStagedCommitContext: mocks.getStagedCommitContext }))
 vi.mock('../git/runner', () => ({ gitExecFileAsync: mocks.gitExecFileAsync }))
 vi.mock('../text-generation/pull-request-context', () => ({
   getPullRequestDraftContext: mocks.getPullRequestDraftContext
 }))
 vi.mock('../source-control/pull-request-linked-issue', () => ({
-  loadPullRequestLinkedIssue: mocks.loadPullRequestLinkedIssue
+  loadPullRequestLinkedIssue: (...args: unknown[]) => {
+    mocks.loadPullRequestLinkedIssue(...args)
+    // A mock return observer would handle the rejection being tested.
+    return linkedLookup.run()
+  }
 }))
 vi.mock('../providers/ssh-git-dispatch', () => ({
   getSshGitProvider: mocks.getSshGitProvider,
@@ -77,7 +84,7 @@ describe('RuntimeGitGenerationCommands admission', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mocks.gitExecFileAsync.mockResolvedValue({ stdout: '', stderr: '' })
-    mocks.loadPullRequestLinkedIssue.mockResolvedValue(null)
+    linkedLookup.run = () => Promise.resolve(null)
     mocks.resolveHostedReviewBodyForGeneration.mockImplementation(async ({ body }) => body)
     mocks.prepareLocalCommitMessageAgentEnv.mockResolvedValue({ ok: true, env: {} })
     mocks.generateCommitMessageFromContext.mockResolvedValue({ success: true, message: 'feat' })
@@ -167,4 +174,103 @@ describe('RuntimeGitGenerationCommands admission', () => {
       expect.objectContaining({ connectionId: 'conn-1', localGitOptions: {} })
     )
   })
+
+  describe.each(['local', 'SSH'])('linked-issue lifetime on %s', (host) => {
+    function commands(): RuntimeGitGenerationCommands {
+      mocks.getSshGitProvider.mockReturnValue({ exec: vi.fn(), executeCommitMessagePlan: vi.fn() })
+      return makeCommands(
+        makeTarget('/repo', {
+          executionHostId: host === 'SSH' ? 'ssh:conn-1' : 'local'
+        })
+      )
+    }
+
+    const input = { base: 'main', title: '', body: '', draft: false, provider: 'gitlab' as const }
+
+    it.each(['no changes', 'context error', 'template error'])(
+      'observes a late lookup rejection after %s',
+      async (outcome) => {
+        const issue = Promise.withResolvers<null>()
+        linkedLookup.run = () => issue.promise
+        const preparationError = new Error('preparation failed')
+        mocks.getPullRequestDraftContext.mockResolvedValue(pullRequestContext)
+        if (outcome === 'no changes') {
+          mocks.getPullRequestDraftContext.mockResolvedValue(null)
+        } else if (outcome === 'context error') {
+          mocks.getPullRequestDraftContext.mockRejectedValue(preparationError)
+        } else {
+          mocks.resolveHostedReviewBodyForGeneration.mockRejectedValue(preparationError)
+        }
+        const unhandled = vi.fn()
+        process.on('unhandledRejection', unhandled)
+        try {
+          await expect(
+            commands().generateRuntimePullRequestFields('id:wt-1', input, settingsOverride)
+          ).resolves.toEqual({
+            success: false,
+            error:
+              outcome === 'no changes'
+                ? 'No branch changes to summarize.'
+                : preparationError.message
+          })
+          expect(mocks.loadPullRequestLinkedIssue).toHaveBeenCalledOnce()
+          issue.reject(new Error('Timed out waiting for a GitLab operation slot.'))
+          await nextTurn()
+          expect(unhandled).not.toHaveBeenCalled()
+          expect(mocks.generatePullRequestFieldsFromContext).not.toHaveBeenCalled()
+        } finally {
+          issue.resolve(null)
+          void issue.promise.catch(() => undefined)
+          process.off('unhandledRejection', unhandled)
+        }
+      }
+    )
+
+    it('observes rejection during preparation and preserves the later caller error', async () => {
+      const issue = Promise.withResolvers<null>()
+      const preparation = Promise.withResolvers<typeof pullRequestContext>()
+      const failure = new Error('lookup admission failed')
+      linkedLookup.run = () => issue.promise
+      mocks.getPullRequestDraftContext.mockReturnValue(preparation.promise)
+      const unhandled = vi.fn()
+      process.on('unhandledRejection', unhandled)
+      const result = commands()
+        .generateRuntimePullRequestFields('id:wt-1', input, settingsOverride)
+        .catch((error: unknown) => error)
+      try {
+        await nextTurn()
+        expect(mocks.getPullRequestDraftContext).toHaveBeenCalledOnce()
+        issue.reject(failure)
+        await nextTurn()
+        expect(unhandled).not.toHaveBeenCalled()
+        preparation.resolve(pullRequestContext)
+        expect(await result).toBe(failure)
+        expect(mocks.generatePullRequestFieldsFromContext).not.toHaveBeenCalled()
+      } finally {
+        issue.resolve(null)
+        preparation.resolve(pullRequestContext)
+        await result
+        process.off('unhandledRejection', unhandled)
+      }
+    })
+
+    it('still rejects the caller after successful preparation when the lookup fails', async () => {
+      const issue = Promise.withResolvers<null>()
+      const failure = new Error('lookup failed')
+      linkedLookup.run = () => issue.promise
+      mocks.getPullRequestDraftContext.mockResolvedValue(pullRequestContext)
+      const result = commands()
+        .generateRuntimePullRequestFields('id:wt-1', input, settingsOverride)
+        .catch((error: unknown) => error)
+      try {
+        await nextTurn()
+        issue.reject(failure)
+        expect(await result).toBe(failure)
+        expect(mocks.generatePullRequestFieldsFromContext).not.toHaveBeenCalled()
+      } finally {
+        issue.resolve(null)
+        await result
+      }
+    })
+  })
 })
diff --git a/src/main/runtime/runtime-git-generation-commands.ts b/src/main/runtime/runtime-git-generation-commands.ts
index bea10b2ef7d..988e2ee096f 100644
--- a/src/main/runtime/runtime-git-generation-commands.ts
+++ b/src/main/runtime/runtime-git-generation-commands.ts
@@ -182,6 +182,7 @@ export class RuntimeGitGenerationCommands {
               admissionTier: 'interactive'
             }
     })
+    void linkedIssueDetailsPromise.catch(() => undefined)
     let context: Awaited<ReturnType<typeof getPullRequestDraftContext>>
     try {
       const currentBody = await resolveHostedReviewBodyForGeneration({
diff --git a/src/main/runtime/runtime-legacy-worker-terminal-recovery-persistence.ts b/src/main/runtime/runtime-legacy-worker-terminal-recovery-persistence.ts
index df794567737..345e2c08377 100644
--- a/src/main/runtime/runtime-legacy-worker-terminal-recovery-persistence.ts
+++ b/src/main/runtime/runtime-legacy-worker-terminal-recovery-persistence.ts
@@ -12,7 +12,8 @@ import type {
   LegacyWorkerRecoveryResolution
 } from './runtime-legacy-worker-terminal-recovery-types'
 import { runtimeWorktreeIdsEqual } from './runtime-worktree-path-identity'
-import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from './workspace-session-failed-write-rollback'
+import { cloneWorkspaceSessionState } from '../persistence/restoring-sessions/session-owner-fields'
+import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from '../persistence/restoring-sessions/workspace-session-write-rollback'
 
 export class RuntimeLegacyWorkerTerminalRecoveryPersistence {
   constructor(
@@ -29,66 +30,68 @@ export class RuntimeLegacyWorkerTerminalRecoveryPersistence {
     resolutions: readonly LegacyWorkerRecoveryResolution[]
   ): Promise<ReadonlySet<string>> {
     const store = this.getStore()
-    if (
-      !store?.getWorkspaceSession ||
-      !store.setWorkspaceSession ||
-      (!store.flushPendingOrThrowAsync && !store.flushOrThrow)
-    ) {
+    if (!store?.getWorkspaceSession || !store.setWorkspaceSession || !store.runDurableMutation) {
       return new Set()
     }
+    const getWorkspaceSession = store.getWorkspaceSession.bind(store)
+    const setWorkspaceSession = store.setWorkspaceSession.bind(store)
     const originals = new Map<ExecutionHostId, WorkspaceSessionState>()
     const staged = new Map<ExecutionHostId, WorkspaceSessionState>()
     const dispatchIds = new Set<string>()
     try {
-      for (const { candidate, resolution } of resolutions) {
-        const hostId = this.getHostId(candidate.worktreeId)
-        const session = hostId ? store.getWorkspaceSession(hostId) : null
-        if (!hostId || !session) {
-          continue
+      return await store.runDurableMutation(() => {
+        for (const { candidate, resolution } of resolutions) {
+          const hostId = this.getHostId(candidate.worktreeId)
+          const session = hostId ? getWorkspaceSession(hostId) : null
+          if (!hostId || !session) {
+            continue
+          }
+          originals.set(hostId, originals.get(hostId) ?? cloneWorkspaceSessionState(session))
+          let next =
+            resolution === 'exited'
+              ? retireTerminalSurfaceFromPersistence(session, {
+                  worktreeId: candidate.worktreeId,
+                  parentTabId: candidate.tabId,
+                  leafId: candidate.leafId,
+                  ptyId: candidate.ptyId,
+                  incarnationId: candidate.incarnationId
+                })
+              : session
+          const record = next.sleepingAgentSessionsByPaneKey?.[candidate.paneKey]
+          if (record && runtimeWorktreeIdsEqual(record.worktreeId, candidate.worktreeId)) {
+            const sleeping = { ...next.sleepingAgentSessionsByPaneKey }
+            delete sleeping[candidate.paneKey]
+            next = { ...next, sleepingAgentSessionsByPaneKey: sleeping }
+          }
+          if (next !== session) {
+            setWorkspaceSession(next, hostId)
+          }
+          staged.set(hostId, cloneWorkspaceSessionState(getWorkspaceSession(hostId)))
+          dispatchIds.add(candidate.dispatchId)
         }
-        originals.set(hostId, originals.get(hostId) ?? session)
-        let next =
-          resolution === 'exited'
-            ? retireTerminalSurfaceFromPersistence(session, {
-                worktreeId: candidate.worktreeId,
-                parentTabId: candidate.tabId,
-                leafId: candidate.leafId,
-                ptyId: candidate.ptyId,
-                incarnationId: candidate.incarnationId
-              })
-            : session
-        const record = next.sleepingAgentSessionsByPaneKey?.[candidate.paneKey]
-        if (record && runtimeWorktreeIdsEqual(record.worktreeId, candidate.worktreeId)) {
-          const sleeping = { ...next.sleepingAgentSessionsByPaneKey }
-          delete sleeping[candidate.paneKey]
-          next = { ...next, sleepingAgentSessionsByPaneKey: sleeping }
+        return {
+          value: dispatchIds,
+          persist: dispatchIds.size > 0,
+          rollback: () => {
+            for (const [hostId, original] of originals) {
+              const stagedSession = staged.get(hostId)
+              const current = getWorkspaceSession(hostId)
+              if (!stagedSession || !current) {
+                continue
+              }
+              const rolledBack = rollbackWorkspaceSessionAfterFailedAsyncWrite(
+                original,
+                stagedSession,
+                current
+              )
+              if (rolledBack !== current) {
+                setWorkspaceSession(rolledBack, hostId)
+              }
+            }
+          }
         }
-        if (next !== session) {
-          store.setWorkspaceSession(next, hostId)
-        }
-        staged.set(hostId, store.getWorkspaceSession(hostId))
-        dispatchIds.add(candidate.dispatchId)
-      }
-      if (dispatchIds.size > 0) {
-        await this.flush(store)
-      }
-      return dispatchIds
+      })
     } catch (error) {
-      for (const [hostId, original] of originals) {
-        const stagedSession = staged.get(hostId)
-        const current = store.getWorkspaceSession(hostId)
-        if (!stagedSession || !current) {
-          continue
-        }
-        const rolledBack = rollbackWorkspaceSessionAfterFailedAsyncWrite(
-          original,
-          stagedSession,
-          current
-        )
-        if (rolledBack !== current) {
-          store.setWorkspaceSession(rolledBack, hostId)
-        }
-      }
       console.warn('[orchestration] failed to persist legacy worker recovery batch', {
         dispatchIds: [...dispatchIds],
         error
@@ -124,16 +127,4 @@ export class RuntimeLegacyWorkerTerminalRecoveryPersistence {
       return null
     }
   }
-
-  private async flush(store: RuntimeStore): Promise<void> {
-    if (store.flushPendingOrThrowAsync) {
-      await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
-      return
-    }
-    if (store.flushOrThrow) {
-      store.flushOrThrow()
-      return
-    }
-    throw new Error('workspace_session_persistence_unavailable')
-  }
 }
diff --git a/src/main/runtime/runtime-local-git-worktree-create.ts b/src/main/runtime/runtime-local-git-worktree-create.ts
index 36731ac3abb..ccefaa82255 100644
--- a/src/main/runtime/runtime-local-git-worktree-create.ts
+++ b/src/main/runtime/runtime-local-git-worktree-create.ts
@@ -152,6 +152,9 @@ export async function createRuntimeLocalGitWorktree(args: {
           })
         : null
     // This path has no create-span recorder, so the miss reason is only observable on the IPC path.
+    if (preparedAttempt?.status === 'miss' && preparedAttempt.rearm) {
+      args.rearm.fire = preparedAttempt.rearm
+    }
     if (preparedAttempt?.status === 'hit') {
       addResult = preparedAttempt.result
       // Deferred, not fired: re-arming is a full `reset --hard`, and the caller still has
diff --git a/src/main/runtime/runtime-local-worktree-create.test.ts b/src/main/runtime/runtime-local-worktree-create.test.ts
index 4ad713111f5..c673da99640 100644
--- a/src/main/runtime/runtime-local-worktree-create.test.ts
+++ b/src/main/runtime/runtime-local-worktree-create.test.ts
@@ -1,4 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { resolve } from 'node:path'
 import type { Store } from '../persistence'
 import type { WorktreeMeta } from '../../shared/worktree/meta-types'
 import type { RuntimeManagedWorktreeCreateArgs } from './runtime-managed-worktree-create-types'
@@ -32,7 +33,7 @@ const mocks = vi.hoisted(() => ({
   resolveInclude: vi.fn<() => Promise<string[]>>(),
   copyPaths: vi.fn<() => Promise<string[]>>(),
   created: {
-    path: '/worktrees/app',
+    path: '',
     head: 'abc123',
     branch: 'app',
     isBare: false,
@@ -82,6 +83,8 @@ vi.mock('../ipc/worktree-symlinks', () => ({
 import { createRuntimeLocalManagedWorktree } from './runtime-local-worktree-create'
 import type { PreparationRearmHolder } from '../worktree-create-preparation'
 
+const worktreePath = resolve('/worktrees', 'app')
+
 function createWorktree(
   request: Partial<RuntimeManagedWorktreeCreateArgs> = {},
   rearm: PreparationRearmHolder = { fire: () => {} }
@@ -112,6 +115,7 @@ function createWorktree(
 
 beforeEach(() => {
   vi.resetAllMocks()
+  mocks.created.path = worktreePath
   mocks.routing.mockReturnValue({})
   mocks.defaultBase.mockImplementation(async () => {
     expect(resolveGitAdmissionTier()).toBe('interactive')
@@ -142,6 +146,36 @@ beforeEach(() => {
 })
 
 describe('runtime prepared-worktree replenishment', () => {
+  it('keeps a failed claim reserved through the normal-add fallback', async () => {
+    mocks.consume.mockResolvedValue({
+      status: 'miss',
+      reason: 'finalize_failed',
+      rearm: mocks.rearm
+    })
+    const rearm: PreparationRearmHolder = { fire: () => {} }
+    await createWorktree({}, rearm)
+
+    expect(mocks.add).toHaveBeenCalledOnce()
+    expect(mocks.rearm).not.toHaveBeenCalled()
+    rearm.fire()
+    expect(mocks.rearm).toHaveBeenCalledOnce()
+  })
+
+  it('keeps the failed claim release available when the fallback also fails', async () => {
+    mocks.consume.mockResolvedValue({
+      status: 'miss',
+      reason: 'prepare_failed',
+      rearm: mocks.rearm
+    })
+    mocks.add.mockRejectedValue(new Error('normal add failed'))
+    const rearm: PreparationRearmHolder = { fire: () => {} }
+    await expect(createWorktree({}, rearm)).rejects.toThrow('normal add failed')
+
+    expect(mocks.rearm).not.toHaveBeenCalled()
+    rearm.fire()
+    expect(mocks.rearm).toHaveBeenCalledOnce()
+  })
+
   it('leaves the re-arm holder armed but unfired once probes and include copies finish', async () => {
     const rearm: PreparationRearmHolder = { fire: () => {} }
     let finishProbe!: (paths: string[]) => void
@@ -207,8 +241,8 @@ describe('runtime create Git priority', () => {
       expect(mocks.remoteBase).toHaveBeenCalledWith('/repo', 'main', options)
       expect(mocks.hasBase).toHaveBeenCalledWith('/repo', 'main', options)
       expect(mocks.consume).toHaveBeenCalledWith(expect.objectContaining({ options }))
-      expect(mocks.pushTarget).toHaveBeenCalledWith('/worktrees/app', 'app', target, options)
-      expect(mocks.listing).toHaveBeenCalledWith('/repo', '/worktrees/app', 'app', options)
+      expect(mocks.pushTarget).toHaveBeenCalledWith(worktreePath, 'app', target, options)
+      expect(mocks.listing).toHaveBeenCalledWith('/repo', worktreePath, 'app', options)
       expect(mocks.resolveShared).toHaveBeenCalledWith('/repo', options)
       expect(mocks.resolveInclude).toHaveBeenCalledWith('/repo', options)
     }
@@ -240,7 +274,7 @@ describe('runtime create Git priority', () => {
       }
     )
     try {
-      await expect(createWorktree()).resolves.toHaveProperty('worktreePath', '/worktrees/app')
+      await expect(createWorktree()).resolves.toHaveProperty('worktreePath', worktreePath)
       expect(mocks.add).toHaveBeenCalledOnce()
     } finally {
       blocker.release()
@@ -262,7 +296,7 @@ describe('runtime create Git priority', () => {
     expect(mocks.refresh).toHaveBeenCalledWith('/repo', base, options)
     expect(mocks.addSparse).toHaveBeenCalledWith(
       '/repo',
-      '/worktrees/app',
+      worktreePath,
       'app',
       ['src'],
       'origin/main',
diff --git a/src/main/runtime/runtime-local-worktree-terminal-startup.test.ts b/src/main/runtime/runtime-local-worktree-terminal-startup.test.ts
index 1e590f22973..a80351c6af1 100644
--- a/src/main/runtime/runtime-local-worktree-terminal-startup.test.ts
+++ b/src/main/runtime/runtime-local-worktree-terminal-startup.test.ts
@@ -41,7 +41,6 @@ function createPorts() {
   })
   const ports: StartupArgs['ports'] = {
     canSpawn: true,
-    markTrusted: vi.fn(),
     createTerminal,
     pasteDraft: vi.fn(),
     sendFollowup: vi.fn(),
diff --git a/src/main/runtime/runtime-local-worktree-terminal-startup.ts b/src/main/runtime/runtime-local-worktree-terminal-startup.ts
index b3cb5e71850..e878eaa4b16 100644
--- a/src/main/runtime/runtime-local-worktree-terminal-startup.ts
+++ b/src/main/runtime/runtime-local-worktree-terminal-startup.ts
@@ -20,7 +20,6 @@ import type {
 
 type Ports = {
   canSpawn: boolean
-  markTrusted: (agent: TuiAgent, path: string) => Promise<void>
   createTerminal: (
     selector: string,
     options: TerminalCreateOptions
@@ -94,10 +93,6 @@ export async function startRuntimeLocalWorktreeTerminals(args: {
 
   if (sequencedStartup && ports.canSpawn) {
     try {
-      const trustAgent = args.draftPaste?.agent ?? args.createdWithAgent
-      if (trustAgent) {
-        await ports.markTrusted(trustAgent, worktree.path)
-      }
       const terminal = await ports.createTerminal(`id:${worktree.id}`, {
         command: sequencedStartup.command,
         ...(request.startupCwd ? { cwd: request.startupCwd } : {}),
diff --git a/src/main/runtime/runtime-managed-worktree-create-types.ts b/src/main/runtime/runtime-managed-worktree-create-types.ts
index bdc8c2a0a12..9edd5b23836 100644
--- a/src/main/runtime/runtime-managed-worktree-create-types.ts
+++ b/src/main/runtime/runtime-managed-worktree-create-types.ts
@@ -54,6 +54,7 @@ export type RuntimeManagedWorktreeCreateArgs = {
   /** Per-launch inputs used when `startupAgent` is the created terminal surface. */
   startupAgentArgs?: string | null
   startupCwd?: string
+  /** The surface behind a host-built startup agent (`startupAgent` or `startupDraft`). */
   startupLaunchSource?: string
   /** A caller-minted `tabId:leafId` for the startup terminal's pane. */
   startupPaneKey?: string
diff --git a/src/main/runtime/runtime-notifier-contract.ts b/src/main/runtime/runtime-notifier-contract.ts
index 9cdc365e1ba..fa87d839cd5 100644
--- a/src/main/runtime/runtime-notifier-contract.ts
+++ b/src/main/runtime/runtime-notifier-contract.ts
@@ -117,7 +117,10 @@ export type RuntimeNotifier = {
     baseVersion: string,
     content: string
   ): Promise<RuntimeMarkdownSaveTabResult>
-  closeTerminal(tabId: string, paneRuntimeId?: number): void
+  /** Closes the whole tab. */
+  closeTerminal(tabId: string): void
+  /** Drops one split pane main already closed; never closes its tab. */
+  closeTerminalPane?(tabId: string, leafId: string): void
   closeTerminalTab?(
     tabId: string,
     options?: { localPtyTeardownOwnedExternally?: boolean; force?: boolean }
diff --git a/src/main/runtime/runtime-pty-controller-contract.ts b/src/main/runtime/runtime-pty-controller-contract.ts
index bb23548ae6f..60c1e18cf10 100644
--- a/src/main/runtime/runtime-pty-controller-contract.ts
+++ b/src/main/runtime/runtime-pty-controller-contract.ts
@@ -12,6 +12,7 @@ import type { ExecutionHostId } from '../../shared/execution-host'
 import type { PtyProviderBufferSnapshot, PtyProcessInfo, PtySpawnResult } from '../providers/types'
 import type { PtyProcessInspection } from '../providers/pty-process-inspection'
 import type { WriteSettlement } from '../../shared/pty-write-settlement'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 
 export type RuntimePtyController = {
   claimStablePaneCreate?(args: {
@@ -93,9 +94,13 @@ export type RuntimePtyController = {
     stablePaneOwner?: { handle: string; tabId: string; leafId: string }
     agentSessionEnsure?: AgentSessionClaimedSpawnResult
   }>
-  write(ptyId: string, data: string): boolean
+  write(ptyId: string, data: string, inputKind: TerminalInputKind): boolean
   /** Three-valued settlement; local providers settle synchronously. */
-  writeWithSettlement?(ptyId: string, data: string): WriteSettlement | Promise<WriteSettlement>
+  writeWithSettlement?(
+    ptyId: string,
+    data: string,
+    inputKind: TerminalInputKind
+  ): WriteSettlement | Promise<WriteSettlement>
   /** Attach-only adoption of a live local daemon session so its output streams
    *  to main without a renderer pane; never creates, resizes, or focuses.
    *  False on doubt (absent session, SSH-scoped id, non-daemon provider). */
@@ -106,7 +111,9 @@ export type RuntimePtyController = {
     ptyId: string,
     opts?: { keepHistory?: boolean; deadlineMs?: number }
   ): Promise<boolean>
-  markReversibleStops?(ptyIds: readonly string[]): () => void
+  /** Durably records a kill order for an explicit close's unconfirmed stop, replayed when its SSH
+   *  host reconnects. True only when an order was written; local PTYs have no later host to ask. */
+  recordUnconfirmedStop?(ptyId: string): boolean
   getCwd?(ptyId: string): Promise<string | null>
   getForegroundProcess(ptyId: string): Promise<string | null>
   inspectProcess?(
@@ -117,6 +124,7 @@ export type RuntimePtyController = {
   confirmShellForeground?(ptyId: string): Promise<boolean>
   hasChildProcesses?(ptyId: string): Promise<boolean>
   clearBuffer?(ptyId: string): Promise<void>
+  resetInputModes?(ptyId: string): Promise<void>
   resize?(ptyId: string, cols: number, rows: number): boolean
   // Why: exact-id mobile polls should not enumerate every local and SSH PTY.
   hasPty?(ptyId: string): boolean | null
diff --git a/src/main/runtime/runtime-registered-local-worktree-removal.ts b/src/main/runtime/runtime-registered-local-worktree-removal.ts
index e6658b73ef2..011d30207fe 100644
--- a/src/main/runtime/runtime-registered-local-worktree-removal.ts
+++ b/src/main/runtime/runtime-registered-local-worktree-removal.ts
@@ -20,16 +20,9 @@ import {
   isOrphanCompatiblePreflightError,
   isOrphanedWorktreeError
 } from '../ipc/worktree-logic'
-import {
-  getLocalWorktreePathAccess,
-  removeLocalWorktreePath,
-  toLocalWorktreeRuntimePath
-} from '../local-worktree-filesystem'
+import { cleanupLocalOrphanedWorktreeDirectory } from '../local-orphaned-worktree-cleanup'
 import { recoverLocalWindowsWorktreeRemoval } from '../local-worktree-removal-recovery'
-import {
-  canSafelyRemoveOrphanedWorktreeDirectory,
-  findRegisteredDeletableWorktree
-} from '../worktree-removal-safety'
+import { findRegisteredDeletableWorktree } from '../worktree-removal-safety'
 import { CLIENT_REMOVAL_HOME } from '../worktree-removal-home-guard'
 import type { RuntimeStore } from './runtime-store-contract'
 import type { RuntimeWorktreeRemovalTarget } from './runtime-worktree-selection'
@@ -160,7 +153,12 @@ export async function removeRuntimeRegisteredLocalWorktree(args: {
         removalResult = recovered
         completed = true
       } else if (isOrphanedWorktreeError(error)) {
-        await cleanupOrphanedDirectory(repo, canonicalPath, localOptions, args.closeWatchers)
+        await cleanupLocalOrphanedWorktreeDirectory(
+          repo.path,
+          canonicalPath,
+          localOptions,
+          args.closeWatchers
+        )
         await gitExecFileAsync(['worktree', 'prune'], { cwd: repo.path, ...localOptions }).catch(
           () => {}
         )
@@ -190,29 +188,6 @@ export async function removeRuntimeRegisteredLocalWorktree(args: {
   }
 }
 
-async function cleanupOrphanedDirectory(
-  repo: Repo,
-  path: string,
-  options: LocalProjectWorktreeGitOptions,
-  closeWatchers: (path: string) => Promise<void>
-): Promise<void> {
-  const access = getLocalWorktreePathAccess(options)
-  if (
-    await canSafelyRemoveOrphanedWorktreeDirectory(
-      toLocalWorktreeRuntimePath(path, options),
-      toLocalWorktreeRuntimePath(repo.path, options),
-      CLIENT_REMOVAL_HOME,
-      access.statPath,
-      access.readPath
-    )
-  ) {
-    await closeWatchers(path)
-    await removeLocalWorktreePath(path, options).catch(() => {})
-  } else {
-    console.warn(`[worktrees] Refusing recursive cleanup for unproven worktree directory: ${path}`)
-  }
-}
-
 async function cleanupPushTarget(
   args: Parameters<typeof removeRuntimeRegisteredLocalWorktree>[0]
 ): Promise<void> {
diff --git a/src/main/runtime/runtime-remote-managed-worktree-create.test.ts b/src/main/runtime/runtime-remote-managed-worktree-create.test.ts
index 4dfa1ba2647..f642a07aeab 100644
--- a/src/main/runtime/runtime-remote-managed-worktree-create.test.ts
+++ b/src/main/runtime/runtime-remote-managed-worktree-create.test.ts
@@ -37,7 +37,6 @@ function createDeps() {
     // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the create only forwards the store to the mocked request helper, which never reads it.
     store: {} as unknown as CreateParams[2]['store'],
     canSpawn: () => true,
-    markTrusted: vi.fn(),
     createTerminal,
     pasteDraft: vi.fn(),
     sendFollowup: vi.fn(),
diff --git a/src/main/runtime/runtime-remote-managed-worktree-create.ts b/src/main/runtime/runtime-remote-managed-worktree-create.ts
index 85ff97f10a0..8d5b4a60a3d 100644
--- a/src/main/runtime/runtime-remote-managed-worktree-create.ts
+++ b/src/main/runtime/runtime-remote-managed-worktree-create.ts
@@ -19,11 +19,6 @@ import { finishRuntimeRemoteWorktreeCreate } from './runtime-remote-worktree-cre
 type Dependencies = {
   store: RuntimeStore
   canSpawn(): boolean
-  markTrusted(
-    agent: NonNullable<RuntimeRemoteWorktreeCreateArgs['createdWithAgent']>,
-    connectionId: string,
-    path: string
-  ): Promise<void>
   createTerminal(
     selector: string,
     options: TerminalCreateOptions
@@ -105,10 +100,6 @@ export async function createRuntimeRemoteManagedWorktree(
 
   if (sequencedStartup && deps.canSpawn()) {
     try {
-      const startupTrustAgent = args.startupDraftPaste?.agent ?? args.createdWithAgent
-      if (startupTrustAgent) {
-        await deps.markTrusted(startupTrustAgent, repo.connectionId!, result.worktree.path)
-      }
       const terminal = await deps.createTerminal(`path:${result.worktree.path}`, {
         command: sequencedStartup.command,
         ...(args.startupCwd ? { cwd: args.startupCwd } : {}),
diff --git a/src/main/runtime/runtime-repository-hooks-commands.ts b/src/main/runtime/runtime-repository-hooks-commands.ts
index f5518b8e59a..334def348d5 100644
--- a/src/main/runtime/runtime-repository-hooks-commands.ts
+++ b/src/main/runtime/runtime-repository-hooks-commands.ts
@@ -1,3 +1,4 @@
+import { getStoredRepoSshConnectionId } from '../repo-execution-host'
 import { createHash } from 'node:crypto'
 import { readFile } from 'node:fs/promises'
 import type { Repo } from '../../shared/repo-types'
@@ -27,8 +28,9 @@ export class RuntimeRepositoryHooksCommands {
 
   async getRepoHooks(repoSelector: string) {
     const repo = await this.deps.resolveRepo(repoSelector)
-    if (repo.connectionId) {
-      const fsProvider = getSshFilesystemProvider(repo.connectionId)
+    const connectionId = getStoredRepoSshConnectionId(repo)
+    if (connectionId) {
+      const fsProvider = getSshFilesystemProvider(connectionId)
       if (!fsProvider) {
         return {
           hasHooksFile: false,
@@ -73,8 +75,9 @@ export class RuntimeRepositoryHooksCommands {
     if (isFolderRepo(repo)) {
       return { status: 'ok' as const, hasHooks: false, hooks: null, mayNeedUpdate: false }
     }
-    if (repo.connectionId) {
-      const fsProvider = getSshFilesystemProvider(repo.connectionId)
+    const connectionId = getStoredRepoSshConnectionId(repo)
+    if (connectionId) {
+      const fsProvider = getSshFilesystemProvider(connectionId)
       if (!fsProvider) {
         return { status: 'error' as const, hasHooks: false, hooks: null, mayNeedUpdate: false }
       }
@@ -115,8 +118,9 @@ export class RuntimeRepositoryHooksCommands {
     }
     return inspectSetupScriptImportCandidates(async (relativePath) => {
       const filePath = joinWorktreeRelativePath(repo.path, relativePath)
-      if (repo.connectionId) {
-        const fsProvider = getSshFilesystemProvider(repo.connectionId)
+      const connectionId = getStoredRepoSshConnectionId(repo)
+      if (connectionId) {
+        const fsProvider = getSshFilesystemProvider(connectionId)
         if (!fsProvider) {
           return null
         }
diff --git a/src/main/runtime/runtime-repository-issue-command.ts b/src/main/runtime/runtime-repository-issue-command.ts
index 84509b8b159..730dbe69e9d 100644
--- a/src/main/runtime/runtime-repository-issue-command.ts
+++ b/src/main/runtime/runtime-repository-issue-command.ts
@@ -1,3 +1,4 @@
+import { getStoredRepoSshConnectionId } from '../repo-execution-host'
 import type { GitRuntimeOptions } from '../git/git-runtime-options'
 import type { Repo } from '../../shared/repo-types'
 import { parseOrcaYaml } from '../hooks'
@@ -31,11 +32,12 @@ export class RuntimeRepositoryIssueCommand {
         source: 'none' as const
       }
     }
-    if (!repo.connectionId) {
+    const connectionId = getStoredRepoSshConnectionId(repo)
+    if (!connectionId) {
       return readIssueCommand(repo.path)
     }
     const issueCommandPath = joinWorktreeRelativePath(repo.path, '.orca/issue-command')
-    const fsProvider = getSshFilesystemProvider(repo.connectionId)
+    const fsProvider = getSshFilesystemProvider(connectionId)
     if (!fsProvider) {
       return {
         localContent: null,
@@ -66,12 +68,13 @@ export class RuntimeRepositoryIssueCommand {
     if (isFolderRepo(repo)) {
       return { ok: true }
     }
-    if (!repo.connectionId) {
+    const connectionId = getStoredRepoSshConnectionId(repo)
+    if (!connectionId) {
       await writeIssueCommand(repo.path, content, () => this.deps.getLocalGitArgs(repo)[0] ?? {})
       return { ok: true }
     }
     const issueCommandPath = joinWorktreeRelativePath(repo.path, '.orca/issue-command')
-    const fsProvider = getSshFilesystemProvider(repo.connectionId)
+    const fsProvider = getSshFilesystemProvider(connectionId)
     if (!fsProvider) {
       return { ok: true }
     }
@@ -85,7 +88,7 @@ export class RuntimeRepositoryIssueCommand {
       return { ok: true }
     }
     await fsProvider.createDir(joinWorktreeRelativePath(repo.path, '.orca'))
-    if (!(await isIssueCommandIgnoredByGit(repo.path, repo.connectionId))) {
+    if (!(await isIssueCommandIgnoredByGit(repo.path, connectionId))) {
       await ensureRemoteOrcaDirIgnored(fsProvider, repo.path)
     }
     await fsProvider.writeFile(issueCommandPath, `${trimmed}\n`)
diff --git a/src/main/runtime/runtime-rpc/runtime-rpc-mobile-method-allowlist.ts b/src/main/runtime/runtime-rpc/runtime-rpc-mobile-method-allowlist.ts
index ce67fb94aff..d544dc6720b 100644
--- a/src/main/runtime/runtime-rpc/runtime-rpc-mobile-method-allowlist.ts
+++ b/src/main/runtime/runtime-rpc/runtime-rpc-mobile-method-allowlist.ts
@@ -218,6 +218,9 @@ export const MOBILE_RPC_METHOD_ALLOWLIST = new Set([
   'agentSession.reveal',
   'agentSession.send',
   'agentSession.cancel',
+  'agentSession.queuedMessageSend',
+  'agentSession.queuedMessageDelete',
+  'agentSession.queuedMessagesResume',
   'agentSession.close',
   'agentSession.respondToApproval',
   'agentSession.respondToQuestion',
@@ -230,6 +233,8 @@ export const MOBILE_RPC_METHOD_ALLOWLIST = new Set([
   'agentSession.history',
   'agentSession.subscribe',
   'agentSession.unsubscribe',
+  // No-ops on a current host; kept until MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION passes the
+  // mobile builds that still call them.
   'agentSession.hold',
   'agentSession.release',
   'nativeChat.readSession',
diff --git a/src/main/runtime/runtime-service-command-surface.ts b/src/main/runtime/runtime-service-command-surface.ts
index 27a5ebdbdf9..82b3204da52 100644
--- a/src/main/runtime/runtime-service-command-surface.ts
+++ b/src/main/runtime/runtime-service-command-surface.ts
@@ -26,6 +26,7 @@ export type RuntimeServiceCommandSurface = {
   cleanupSubscriptionsForConnection: RuntimeSubscriptionRegistry['cleanupForConnection']
   cleanupSubscriptionIfOwnedByConnection: RuntimeSubscriptionRegistry['cleanupIfOwnedByConnection']
   getSubscriptionRegistrationVersion: RuntimeSubscriptionRegistry['getRegistrationVersion']
+  releaseSubscriptionByRequest: RuntimeSubscriptionRegistry['releaseByRequest']
   onNotificationDispatched: RuntimeMobileNotificationController['onDispatched']
   getMobileNotificationListenerCount: RuntimeMobileNotificationController['getListenerCount']
   dispatchMobileNotification: RuntimeMobileNotificationController['dispatch']
@@ -116,6 +117,7 @@ export function installRuntimeServiceCommandSurface(
     cleanupSubscriptionIfOwnedByConnection:
       subscriptions.cleanupIfOwnedByConnection.bind(subscriptions),
     getSubscriptionRegistrationVersion: subscriptions.getRegistrationVersion.bind(subscriptions),
+    releaseSubscriptionByRequest: subscriptions.releaseByRequest.bind(subscriptions),
     onNotificationDispatched: notifications.onDispatched.bind(notifications),
     getMobileNotificationListenerCount: notifications.getListenerCount.bind(notifications),
     dispatchMobileNotification: notifications.dispatch.bind(notifications),
diff --git a/src/main/runtime/runtime-store-contract.ts b/src/main/runtime/runtime-store-contract.ts
index 6c1436395f1..43fe59b34e1 100644
--- a/src/main/runtime/runtime-store-contract.ts
+++ b/src/main/runtime/runtime-store-contract.ts
@@ -48,6 +48,7 @@ export type RuntimeStore = {
   getWorkspaceSession?: Store['getWorkspaceSession']
   getWorkspaceSessionHostIds?: Store['getWorkspaceSessionHostIds']
   setWorkspaceSession?: Store['setWorkspaceSession']
+  runDurableMutation?: Store['runDurableMutation']
   flushOrThrow?: Store['flushOrThrow']
   flushPendingOrThrowAsync?: Store['flushPendingOrThrowAsync']
   persistPtyBinding?: Store['persistPtyBinding']
@@ -124,6 +125,8 @@ export type RuntimeStore = {
     nativeChatInheritShellEnvironment?: GlobalSettings['nativeChatInheritShellEnvironment']
     nativeChatShellEnvironmentVariables?: GlobalSettings['nativeChatShellEnvironmentVariables']
     aiVaultSearch?: GlobalSettings['aiVaultSearch']
+    sourceControlAi?: GlobalSettings['sourceControlAi']
+    commitMessageAi?: GlobalSettings['commitMessageAi']
   }
   // Why: narrow to `unknown` return so test mocks can return void without
   // a cast. The runtime never reads the return value — the persisted value
diff --git a/src/main/runtime/runtime-subscription-registry.test.ts b/src/main/runtime/runtime-subscription-registry.test.ts
index 093b855d483..0d3a3e3f4d8 100644
--- a/src/main/runtime/runtime-subscription-registry.test.ts
+++ b/src/main/runtime/runtime-subscription-registry.test.ts
@@ -123,3 +123,106 @@ describe('subscription registration versions', () => {
     expect(cleanup).toHaveBeenCalledTimes(2)
   })
 })
+
+describe('request-addressed release', () => {
+  const requestAddresses = (registry: RuntimeSubscriptionRegistry): number =>
+    registry['subscriptionsByRequest'].size
+  // Never `cleanupAndWait` here: it would run the cleanup itself and hide a missed release.
+  const settle = (): Promise<void> => new Promise((resolve) => setTimeout(resolve, 0))
+
+  it('releases the registration a request created, and forgets the address', async () => {
+    const registry = new RuntimeSubscriptionRegistry()
+    const cleanup = vi.fn()
+    registry.registerOwned('terminal:slot', cleanup, 'conn-a', 'req-1')
+    expect(requestAddresses(registry)).toBe(1)
+
+    registry.releaseByRequest('conn-a', 'req-1')
+    await settle()
+
+    expect(cleanup).toHaveBeenCalledOnce()
+    expect(requestAddresses(registry)).toBe(0)
+  })
+
+  it('ignores the request a same-slot replacement superseded', async () => {
+    const registry = new RuntimeSubscriptionRegistry()
+    const replacement = vi.fn()
+    registry.registerOwned('terminal:slot', vi.fn(), 'conn-a', 'req-old')
+    registry.registerOwned('terminal:slot', replacement, 'conn-a', 'req-new')
+    expect(requestAddresses(registry)).toBe(1)
+
+    registry.releaseByRequest('conn-a', 'req-old')
+    await settle()
+    expect(replacement).not.toHaveBeenCalled()
+
+    registry.releaseByRequest('conn-a', 'req-new')
+    await settle()
+    expect(replacement).toHaveBeenCalledOnce()
+  })
+
+  it('does not grow across replace and release cycles', async () => {
+    const registry = new RuntimeSubscriptionRegistry()
+    const cleanup = vi.fn()
+    for (let i = 0; i < 50; i++) {
+      registry.registerOwned('terminal:slot', cleanup, 'conn-a', `req-${2 * i}`)
+      registry.registerOwned('terminal:slot', cleanup, 'conn-a', `req-${2 * i + 1}`)
+      expect(requestAddresses(registry)).toBe(1)
+      registry.releaseByRequest('conn-a', `req-${2 * i + 1}`)
+      await settle()
+    }
+    expect(cleanup).toHaveBeenCalledTimes(100)
+    expect(requestAddresses(registry)).toBe(0)
+  })
+
+  it('keeps the newer owner when a reused request id outlives the old release', async () => {
+    const registry = new RuntimeSubscriptionRegistry()
+    const gate = Promise.withResolvers<void>()
+    const newer = vi.fn()
+    // IPC aborts a subscription and reuses its id before the old teardown settles.
+    const old = registry.registerOwned('terminal:old', () => gate.promise, 'ipc', 'sub-1')
+    old.releaseIfCurrent()
+    registry.registerOwned('terminal:new', newer, 'ipc', 'sub-1')
+    gate.resolve()
+    await settle()
+
+    registry.releaseByRequest('ipc', 'sub-1')
+    await settle()
+    expect(newer).toHaveBeenCalledOnce()
+    expect(requestAddresses(registry)).toBe(0)
+  })
+
+  it('keeps the address of a registration whose cleanup failed, so a retry still reaches it', async () => {
+    const registry = new RuntimeSubscriptionRegistry()
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {})
+    const cleanup = vi.fn().mockRejectedValueOnce(new Error('teardown failed'))
+    registry.registerOwned('terminal:slot', cleanup, 'conn-a', 'req-1')
+
+    registry.releaseByRequest('conn-a', 'req-1')
+    await settle()
+    expect(cleanup).toHaveBeenCalledOnce()
+    expect(requestAddresses(registry)).toBe(1)
+
+    registry.releaseByRequest('conn-a', 'req-1')
+    await settle()
+    expect(cleanup).toHaveBeenCalledTimes(2)
+    expect(requestAddresses(registry)).toBe(0)
+    consoleError.mockRestore()
+  })
+
+  it('addresses nothing without both a connection and a request id', async () => {
+    const registry = new RuntimeSubscriptionRegistry()
+    const unaddressed = vi.fn()
+    const addressed = vi.fn()
+    registry.registerOwned('terminal:no-conn', unaddressed, undefined, 'req-1')
+    registry.registerOwned('terminal:no-req', vi.fn(), 'conn-a')
+    registry.registerOwned('terminal:addressed', addressed, 'conn-a', 'req-1')
+    expect(requestAddresses(registry)).toBe(1)
+
+    registry.releaseByRequest(undefined, 'req-1')
+    registry.releaseByRequest('conn-b', 'req-1')
+    await settle()
+
+    expect(unaddressed).not.toHaveBeenCalled()
+    expect(addressed).not.toHaveBeenCalled()
+    await registry.cleanupAndWait('terminal:addressed')
+  })
+})
diff --git a/src/main/runtime/runtime-subscription-registry.ts b/src/main/runtime/runtime-subscription-registry.ts
index 93e04619618..eaa41dba1af 100644
--- a/src/main/runtime/runtime-subscription-registry.ts
+++ b/src/main/runtime/runtime-subscription-registry.ts
@@ -1,6 +1,15 @@
 type SubscriptionCleanup = () => void | Promise<void>
 
-type SubscriptionEntry = { cleanup: SubscriptionCleanup; version: number }
+type RequestAddress = { connectionId: string; requestId: string }
+
+const requestKey = ({ connectionId, requestId }: RequestAddress): string =>
+  JSON.stringify([connectionId, requestId])
+
+type SubscriptionEntry = {
+  cleanup: SubscriptionCleanup
+  version: number
+  request?: RequestAddress
+}
 
 export type SubscriptionRegistration = {
   releaseIfCurrent(): void
@@ -14,19 +23,35 @@ export class RuntimeSubscriptionRegistry {
   >()
   private readonly subscriptionsByConnection = new Map<string, Set<string>>()
   private readonly connectionBySubscription = new Map<string, string>()
+  private readonly subscriptionsByRequest = new Map<
+    string,
+    { subscriptionId: string; version: number }
+  >()
   private registrationVersion = 0
 
   getRegistrationVersion(): number {
     return this.registrationVersion
   }
 
-  register(subscriptionId: string, cleanup: SubscriptionCleanup, connectionId?: string): void {
+  register(
+    subscriptionId: string,
+    cleanup: SubscriptionCleanup,
+    connectionId?: string,
+    requestId?: string
+  ): void {
     const existing = this.cleanups.get(subscriptionId)
     if (existing) {
       this.removeConnectionIndex(subscriptionId)
+      this.removeRequestIndex(existing)
       this.cleanup(subscriptionId)
     }
-    this.cleanups.set(subscriptionId, { cleanup, version: ++this.registrationVersion })
+    const version = ++this.registrationVersion
+    const request = connectionId && requestId ? { connectionId, requestId } : undefined
+    this.cleanups.set(subscriptionId, { cleanup, version, request })
+    if (request) {
+      // Why: IPC reuses a request id after aborting its previous subscription, so the newer one owns the address.
+      this.subscriptionsByRequest.set(requestKey(request), { subscriptionId, version })
+    }
     if (!connectionId) {
       return
     }
@@ -42,13 +67,26 @@ export class RuntimeSubscriptionRegistry {
   registerOwned(
     subscriptionId: string,
     cleanup: SubscriptionCleanup,
-    connectionId?: string
+    connectionId?: string,
+    requestId?: string
   ): SubscriptionRegistration {
-    this.register(subscriptionId, cleanup, connectionId)
+    this.register(subscriptionId, cleanup, connectionId, requestId)
     const version = this.registrationVersion
     return { releaseIfCurrent: () => this.cleanupOwned(subscriptionId, version) }
   }
 
+  /** Releases the registration a request created; an unknown, ended or replaced request is a no-op. */
+  releaseByRequest(connectionId: string | undefined, requestId: string): void {
+    // Why: some non-phone sockets carry no connection id, and a bare request id is not unique across sockets.
+    if (!connectionId) {
+      return
+    }
+    const target = this.subscriptionsByRequest.get(requestKey({ connectionId, requestId }))
+    if (target) {
+      this.cleanupOwned(target.subscriptionId, target.version)
+    }
+  }
+
   cleanupIfOwnedByConnection(
     subscriptionId: string,
     connectionId?: string,
@@ -121,6 +159,7 @@ export class RuntimeSubscriptionRegistry {
         }
         this.cleanups.delete(subscriptionId)
         this.removeConnectionIndex(subscriptionId)
+        this.removeRequestIndex(entry)
       })
       .finally(() => {
         if (this.cleanupPromises.get(subscriptionId)?.promise === promise) {
@@ -131,8 +170,13 @@ export class RuntimeSubscriptionRegistry {
     return promise
   }
 
-  cleanupByPrefix(prefix: string): void {
-    const ids = Array.from(this.cleanups.keys()).filter((id) => id.startsWith(prefix))
+  cleanupByPrefix(prefix: string, throughVersion?: number): void {
+    const ids = Array.from(this.cleanups.entries())
+      .filter(
+        ([id, entry]) =>
+          id.startsWith(prefix) && (throughVersion === undefined || entry.version <= throughVersion)
+      )
+      .map(([id]) => id)
     for (const id of ids) {
       this.cleanup(id)
     }
@@ -162,6 +206,17 @@ export class RuntimeSubscriptionRegistry {
     this.cleanup(subscriptionId)
   }
 
+  /** Compare-and-delete: a newer registration that reused the request id keeps its address. */
+  private removeRequestIndex(entry: SubscriptionEntry): void {
+    if (!entry.request) {
+      return
+    }
+    const key = requestKey(entry.request)
+    if (this.subscriptionsByRequest.get(key)?.version === entry.version) {
+      this.subscriptionsByRequest.delete(key)
+    }
+  }
+
   private removeConnectionIndex(subscriptionId: string): void {
     const connectionId = this.connectionBySubscription.get(subscriptionId)
     if (!connectionId) {
diff --git a/src/main/runtime/runtime-terminal-contracts.ts b/src/main/runtime/runtime-terminal-contracts.ts
index 5ee2cc8e7fc..e08fffa273c 100644
--- a/src/main/runtime/runtime-terminal-contracts.ts
+++ b/src/main/runtime/runtime-terminal-contracts.ts
@@ -16,6 +16,7 @@ import type { TuiAgent } from '../../shared/tui-agent'
 import type { WorktreeStartupLaunch } from '../../shared/worktree/launch-types'
 import type { RuntimeTerminalSend } from '../../shared/runtime-terminal-contracts'
 import type { RuntimeTerminalWriteOptions } from './runtime-terminal-writer'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 import type { RuntimePtyController } from './runtime-pty-controller-contract'
 import type { RuntimeAgentRowSnapshot } from './runtime-worktree-agent-rows'
 import type { WorkerTerminalHostScope } from './orchestration/worker-terminal-process-liveness'
@@ -61,6 +62,9 @@ export type TerminalCreateOptions = {
   viewMode?: 'terminal' | 'chat'
   startupCommandDelivery?: WorktreeStartupLaunch['startupCommandDelivery']
   telemetry?: WorktreeStartupLaunch['telemetry']
+  /** The surface that asked for this `startupAgent` launch; the runtime attributes every one it
+   *  builds, as `unknown` when this is absent or unrecognized. Ignored without `startupAgent`. */
+  launchSource?: string
   title?: string
   focus?: boolean
   rendererBacked?: boolean
@@ -79,6 +83,8 @@ export type TerminalCreateOptions = {
   agentSessionCreateOperationId?: string
   signal?: AbortSignal
   onPtySpawnCommitted?: () => void
+  /** Called before the spawn request leaves this process; a throw before it proves nothing spawned. */
+  onPtySpawnDispatched?: () => void
   deferMobileSessionPublish?: boolean
 }
 
@@ -201,7 +207,9 @@ export type RuntimeProviderSnapshotReadOptions = {
 }
 
 /** Agent-prompt writes add the correlation inputs a queued-acceptance receipt needs. */
-export type RuntimeAgentPromptWriteOptions = RuntimeTerminalWriteOptions & {
+export type RuntimeAgentPromptWriteOptions = Omit<RuntimeTerminalWriteOptions, 'inputKind'> & {
+  /** `launch` for the prompt an agent starts with; `driving` for any prompt sent to a running one. */
+  inputKind: Exclude<TerminalInputKind, 'query-reply'>
   /** Raw prompt text for submit scheduling; not written, only used for line-aware delays. */
   promptForSchedule?: string
   /** See buildAgentPromptPasteBytes. */
diff --git a/src/main/runtime/runtime-terminal-idle-polls.test.ts b/src/main/runtime/runtime-terminal-idle-polls.test.ts
index 99622ce42df..5149c63da22 100644
--- a/src/main/runtime/runtime-terminal-idle-polls.test.ts
+++ b/src/main/runtime/runtime-terminal-idle-polls.test.ts
@@ -3,6 +3,8 @@ import { RuntimeTerminalIdlePolls } from './runtime-terminal-idle-polls'
 import type { TerminalWaiter } from './runtime-terminal-contracts'
 import type { RuntimeLeafRecord, RuntimePtyWorktreeRecord } from './runtime-terminal-state-records'
 import type { RuntimeTerminalWait } from '../../shared/runtime-types'
+import type { TuiAgent } from '../../shared/tui-agent'
+import { TUI_AGENT_CONFIG } from '../../shared/tui-agent-config'
 
 const INTERVAL_MS = 2000
 
@@ -70,9 +72,12 @@ describe('RuntimeTerminalIdlePolls timer budget', () => {
       quiescenceMs: 1500,
       getTabTitle: () => null,
       getForegroundProcess: () => null,
+      hasCommandPainted: () => true,
       getAdoptedPtyIdleStatus: () => null,
       getPaneAgent: () => null,
       getFirstPartyAgentStatus: () => null,
+      readScreenLines: () => null,
+      readVisibleScreen: () => null,
       getLiveLeaf: (leaf) => leaf,
       resolve: (waiter, result) => resolved.push({ handle: waiter.handle, result })
     })
@@ -105,9 +110,12 @@ describe('RuntimeTerminalIdlePolls timer budget', () => {
       quiescenceMs: 1500,
       getTabTitle: () => null,
       getForegroundProcess: () => null,
+      hasCommandPainted: () => true,
       getAdoptedPtyIdleStatus: () => null,
       getPaneAgent: () => null,
       getFirstPartyAgentStatus: () => null,
+      readScreenLines: () => null,
+      readVisibleScreen: () => null,
       getLiveLeaf: (leaf) => leaf,
       resolve: () => {}
     })
@@ -130,9 +138,12 @@ describe('RuntimeTerminalIdlePolls timer budget', () => {
       quiescenceMs: 1500,
       getTabTitle: () => null,
       getForegroundProcess: () => null,
+      hasCommandPainted: () => true,
       getAdoptedPtyIdleStatus: () => null,
       getPaneAgent: () => null,
       getFirstPartyAgentStatus: () => null,
+      readScreenLines: () => null,
+      readVisibleScreen: () => null,
       getLiveLeaf: (leaf) => leaf,
       resolve: () => {}
     })
@@ -160,9 +171,12 @@ describe('RuntimeTerminalIdlePolls timer budget', () => {
         new Promise<string | null>((resolve) => {
           gates.push(resolve)
         }),
+      hasCommandPainted: () => true,
       getAdoptedPtyIdleStatus: () => null,
       getPaneAgent: () => null,
       getFirstPartyAgentStatus: () => null,
+      readScreenLines: () => null,
+      readVisibleScreen: () => null,
       getLiveLeaf: (leaf) => leaf,
       resolve: (waiter) => resolved.push(waiter.handle)
     })
@@ -185,3 +199,238 @@ describe('RuntimeTerminalIdlePolls timer budget', () => {
     expect(polls.activeTimerCount).toBe(0)
   })
 })
+
+describe('RuntimeTerminalIdlePolls rendered-screen blocked prompts', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  const TRUST_SCREEN = [
+    'Accessing workspace:',
+    '/repo/app',
+    'Quick safety check: Is this a project you created or one you trust?',
+    '❯ No, exit',
+    '  Yes, I trust this folder',
+    'Enter to confirm · Esc to cancel'
+  ].join('\n')
+
+  function createPolls(
+    readVisibleScreen: (ptyId: string) => Promise<string | null> | null,
+    resolved: RuntimeTerminalWait[],
+    foreground: string | null = 'claude',
+    agent: TuiAgent | null = null
+  ): RuntimeTerminalIdlePolls {
+    return new RuntimeTerminalIdlePolls({
+      intervalMs: INTERVAL_MS,
+      quiescenceMs: 1500,
+      getTabTitle: () => null,
+      // Unknown agent + quiet pane: without the screen check this would settle idle.
+      getForegroundProcess: () => (foreground ? Promise.resolve(foreground) : null),
+      hasCommandPainted: () => true,
+      getAdoptedPtyIdleStatus: () => null,
+      getPaneAgent: () => agent,
+      getFirstPartyAgentStatus: () => null,
+      readScreenLines: () => null,
+      readVisibleScreen,
+      getLiveLeaf: (leaf) => leaf,
+      resolve: (_waiter, result) => resolved.push(result)
+    })
+  }
+
+  it('reports a dialog the tail lost but the screen still shows, ahead of a quiet-pane idle', async () => {
+    const resolved: RuntimeTerminalWait[] = []
+    const polls = createPolls(() => Promise.resolve(TRUST_SCREEN), resolved)
+    polls.startPty(makeWaiter('pty'), makePty('pty-1', { lastOutputAt: Date.now() - 10_000 }))
+    polls.startLeaf(makeWaiter('leaf'), makeLeaf('tab-1', { lastOutputAt: Date.now() - 10_000 }))
+
+    await vi.advanceTimersByTimeAsync(INTERVAL_MS)
+
+    expect(resolved).toHaveLength(2)
+    expect(resolved).toEqual([
+      expect.objectContaining({ satisfied: false, blockedReason: 'agent-trust-workspace' }),
+      expect.objectContaining({ satisfied: false, blockedReason: 'agent-trust-workspace' })
+    ])
+    expect(polls.activeTimerCount).toBe(0)
+  })
+
+  it('does not read the screen of an agent whose title says it is working', async () => {
+    const resolved: RuntimeTerminalWait[] = []
+    const reads: string[] = []
+    const polls = createPolls((ptyId) => {
+      reads.push(ptyId)
+      return Promise.resolve(TRUST_SCREEN)
+    }, resolved)
+    polls.startPty(makeWaiter('pty'), makePty('pty-1', { lastAgentStatus: 'working' }))
+    polls.startLeaf(makeWaiter('leaf'), makeLeaf('tab-1', { lastAgentStatus: 'working' }))
+
+    await vi.advanceTimersByTimeAsync(INTERVAL_MS * 3)
+
+    expect(reads).toEqual([])
+    expect(resolved).toEqual([])
+    expect(polls.activeTimerCount).toBe(1)
+  })
+
+  it('does not resolve a waiter that was cancelled while its screen read was pending', async () => {
+    const resolved: RuntimeTerminalWait[] = []
+    const finishRead = new Map<string, (screen: string) => void>()
+    const reads: string[] = []
+    const polls = createPolls(
+      (ptyId) => {
+        reads.push(ptyId)
+        return new Promise<string>((resolve) => {
+          finishRead.set(ptyId, resolve)
+        })
+      },
+      resolved,
+      null
+    )
+    const waiter = makeWaiter('pty')
+    polls.startPty(waiter, makePty('pty-1'))
+    polls.startPty(makeWaiter('other'), makePty('pty-2'))
+
+    await vi.advanceTimersByTimeAsync(INTERVAL_MS * 2)
+    // One read per waiter: the second sweep must not stack reads behind a pending one.
+    expect(reads).toEqual(['pty-1', 'pty-2'])
+
+    waiter.cancelIdlePoll?.()
+    finishRead.get('pty-1')?.(TRUST_SCREEN)
+    await vi.advanceTimersByTimeAsync(0)
+    expect(resolved).toEqual([])
+  })
+
+  // Why: a name-only title is the only rest signal these agents emit, but it cannot see a
+  // dialog the tail lost, so it settles only once the screen read comes back clear.
+  it.each(['grok', 'copilot', 'aider'] as const)(
+    "settles %s's name-only title only after its screen read",
+    async (agent) => {
+      const resolved: RuntimeTerminalWait[] = []
+      const screens: ((screen: string) => void)[] = []
+      const polls = createPolls(
+        () => new Promise<string>((resolve) => screens.push(resolve)),
+        resolved,
+        null,
+        agent
+      )
+      const pty = makePty('pty-1', { lastAgentStatus: 'idle', lastOscTitle: agent })
+      polls.startPty(makeWaiter('pty'), pty, { kind: 'ready-weak' })
+
+      await vi.advanceTimersByTimeAsync(0)
+      expect(screens).toHaveLength(1)
+      expect(resolved).toEqual([])
+
+      screens[0](`${agent} ready for input`)
+      await vi.advanceTimersByTimeAsync(0)
+      expect(resolved).toEqual([expect.objectContaining({ satisfied: true })])
+    }
+  )
+
+  it('reports a dialog on screen under a name-only title instead of settling ready', async () => {
+    const resolved: RuntimeTerminalWait[] = []
+    const polls = createPolls(() => Promise.resolve(TRUST_SCREEN), resolved, null, 'grok')
+    const pty = makePty('pty-1', { lastAgentStatus: 'idle', lastOscTitle: 'grok' })
+    polls.startPty(makeWaiter('pty'), pty, { kind: 'ready-weak' })
+
+    await vi.advanceTimersByTimeAsync(0)
+    expect(resolved).toEqual([
+      expect.objectContaining({ satisfied: false, blockedReason: 'agent-trust-workspace' })
+    ])
+  })
+
+  it("lets an agent's own idle title outrank dialog wording on its screen", async () => {
+    const resolved: RuntimeTerminalWait[] = []
+    const reads: string[] = []
+    const polls = createPolls(
+      (ptyId) => {
+        reads.push(ptyId)
+        return Promise.resolve(TRUST_SCREEN)
+      },
+      resolved,
+      null,
+      'claude'
+    )
+    const pty = makePty('pty-1', { lastAgentStatus: 'idle', lastOscTitle: '✳ Claude Code' })
+    polls.startPty(makeWaiter('pty'), pty)
+
+    await vi.advanceTimersByTimeAsync(INTERVAL_MS)
+    expect(reads).toEqual([])
+    expect(resolved).toEqual([expect.objectContaining({ satisfied: true })])
+  })
+})
+
+describe('RuntimeTerminalIdlePolls quiet foreground for a launched agent', () => {
+  const QUIESCENCE_MS = 1500
+
+  beforeEach(() => {
+    vi.useFakeTimers()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  function createPolls(
+    agent: TuiAgent,
+    resolved: string[],
+    foregroundReads: string[] = []
+  ): RuntimeTerminalIdlePolls {
+    return new RuntimeTerminalIdlePolls({
+      intervalMs: INTERVAL_MS,
+      quiescenceMs: QUIESCENCE_MS,
+      getTabTitle: () => null,
+      getForegroundProcess: (ptyId) => {
+        foregroundReads.push(ptyId)
+        return Promise.resolve(TUI_AGENT_CONFIG[agent].expectedProcess)
+      },
+      hasCommandPainted: () => true,
+      getAdoptedPtyIdleStatus: () => null,
+      getPaneAgent: () => agent,
+      getFirstPartyAgentStatus: () => null,
+      readScreenLines: () => null,
+      readVisibleScreen: () => null,
+      getLiveLeaf: (leaf) => leaf,
+      resolve: (waiter) => resolved.push(waiter.handle)
+    })
+  }
+
+  // Why: amp's title never classifies, so this lane is its only rest signal; closing it for
+  // every launched agent failed `worker start` at agent_readiness after 60s (STA-7440).
+  it('settles an agent with no other rest signal once it has painted and gone quiet', async () => {
+    const resolved: string[] = []
+    const foregroundReads: string[] = []
+    const polls = createPolls('amp', resolved, foregroundReads)
+    const pty = makePty('pty-amp')
+    const leaf = makeLeaf('tab-amp')
+    polls.startPty(makeWaiter('pty'), pty)
+    polls.startLeaf(makeWaiter('leaf'), leaf)
+
+    // Booting: the agent owns the foreground but has painted nothing (#9976).
+    await vi.advanceTimersByTimeAsync(INTERVAL_MS * 5)
+    expect(resolved).toEqual([])
+
+    await vi.advanceTimersByTimeAsync(INTERVAL_MS / 2)
+    pty.lastOutputAt = Date.now()
+    leaf.lastOutputAt = Date.now()
+    // The next sweep lands inside the quiet window measured from that paint.
+    await vi.advanceTimersByTimeAsync(INTERVAL_MS / 2)
+    expect(resolved).toEqual([])
+    // A pane that cannot settle yet costs no process inspection.
+    expect(foregroundReads).toEqual([])
+
+    await vi.advanceTimersByTimeAsync(INTERVAL_MS)
+    expect(resolved).toEqual(['pty', 'leaf'])
+    expect(polls.activeTimerCount).toBe(0)
+  })
+
+  it('does not settle an agent that will announce rest itself on a quiet foreground', async () => {
+    const resolved: string[] = []
+    const polls = createPolls('claude', resolved)
+    polls.startPty(makeWaiter('pty'), makePty('pty-claude', { lastOutputAt: Date.now() }))
+
+    await vi.advanceTimersByTimeAsync(INTERVAL_MS * 5)
+    expect(resolved).toEqual([])
+  })
+})
diff --git a/src/main/runtime/runtime-terminal-idle-polls.ts b/src/main/runtime/runtime-terminal-idle-polls.ts
index 8960dc79d26..d63b59974ee 100644
--- a/src/main/runtime/runtime-terminal-idle-polls.ts
+++ b/src/main/runtime/runtime-terminal-idle-polls.ts
@@ -1,10 +1,9 @@
-import { isShellProcess, type AgentStatus } from '../../shared/agent-detection'
-import type { RuntimeTerminalWait } from '../../shared/runtime-types'
-import {
-  detectTerminalWaitBlockedReason,
-  isKnownReadyPromptPreview,
-  isMuseReadyPromptPreview
-} from './terminal-wait-detection'
+import { isShellProcess } from '../../shared/agent-detection'
+import type {
+  RuntimeTerminalWait,
+  RuntimeTerminalWaitBlockedReason
+} from '../../shared/runtime-types'
+import { detectTerminalWaitBlockedReason } from './terminal-wait-detection'
 import {
   buildPtyTerminalWaitBlockedResult,
   buildPtyTerminalWaitResult,
@@ -13,53 +12,71 @@ import {
 } from './terminal-wait-results'
 import { buildTerminalWaitText } from './terminal-wait-tail-state'
 import {
-  isTuiIdleSatisfied,
-  quietForegroundProcessProvesTuiIdle,
-  type FirstPartyAgentStatus
+  evaluateTuiIdle,
+  leafTuiIdleEvidence,
+  ptyTuiIdleEvidence,
+  type QuietForegroundLane,
+  type TuiIdleEvidenceSource,
+  type TuiIdleVerdict
 } from './tui-idle-evidence'
-import type { TuiAgent } from '../../shared/tui-agent'
 
 /**
- * Why null counts as quiet: a record with no output timestamp has produced nothing the
- * RUNTIME OBSERVED since it was created. That is not the same as silence — the reachable
- * case is a daemon-hosted pane whose bytes never reach the runtime, which may still be
- * streaming. The trade is deliberate: "never settles" becomes "settles uncorroborated",
+ * Why null counts as quiet on an `open` lane: a record with no output timestamp has produced
+ * nothing the RUNTIME OBSERVED since it was created. That is not the same as silence — the
+ * reachable case is a daemon-hosted pane whose bytes never reach the runtime, which may still
+ * be streaming. The trade is deliberate: "never settles" becomes "settles uncorroborated",
  * the caller keeps its timeout, and delivery cannot reach this lane. Reading it as `0ms since output`
  * inverted that — `0 >= quiescenceMs` is false forever, so an adopted pane that never
  * emitted could not settle no matter how long the caller waited.
+ * Why not on `after-paint`: that pane runs a known agent, whose TUI must paint before it can
+ * take input, so until the command has painted it is still booting. The shell's prompt and
+ * echoed command line are not the agent's paint (see terminal-command-paint.ts).
  */
-function isQuietForQuiescence(lastOutputAt: number | null, quiescenceMs: number): boolean {
-  return lastOutputAt === null ? true : Date.now() - lastOutputAt >= quiescenceMs
+function isQuietForQuiescence(
+  lastOutputAt: number | null,
+  quiescenceMs: number,
+  lane: QuietForegroundLane,
+  commandPainted: () => boolean
+): boolean {
+  if (lane === 'after-paint' && !commandPainted()) {
+    return false
+  }
+  if (lastOutputAt === null) {
+    return lane === 'open'
+  }
+  return Date.now() - lastOutputAt >= quiescenceMs
 }
 import type { TerminalWaiter } from './runtime-terminal-contracts'
 import type { RuntimeLeafRecord, RuntimePtyWorktreeRecord } from './runtime-terminal-state-records'
 
-type RuntimeTerminalIdlePollDependencies = {
+type RuntimeTerminalIdlePollDependencies = TuiIdleEvidenceSource & {
   intervalMs: number
-  quiescenceMs: number
-  getTabTitle(tabId: string): string | null
   getForegroundProcess(ptyId: string): Promise<string | null> | null
-  getAdoptedPtyIdleStatus(pty: RuntimePtyWorktreeRecord): AgentStatus | null
-  getPaneAgent(ptyId: string | null | undefined): TuiAgent | null
-  getFirstPartyAgentStatus(ptyId: string | null | undefined): FirstPartyAgentStatus
-  /** Re-read the record the waiter registered against; see `liveLeaf` below. */
+  /** Whether the pane's running command has painted anything of its own. */
+  hasCommandPainted(ptyId: string): boolean
+  /** The pane's rendered viewport, or null when the runtime holds no screen model for it. */
+  readVisibleScreen(ptyId: string): Promise<string | null> | null
+  /** Re-read the record the waiter registered against; see `sample` below. */
   getLiveLeaf(leaf: RuntimeLeafRecord): RuntimeLeafRecord
   resolve(waiter: TerminalWaiter, result: RuntimeTerminalWait): void
 }
 
-type IdlePollEntry =
-  | {
-      kind: 'leaf'
-      waiter: TerminalWaiter
-      leaf: RuntimeLeafRecord
-      foregroundPollInFlight: boolean
-    }
-  | {
-      kind: 'pty'
-      waiter: TerminalWaiter
-      pty: RuntimePtyWorktreeRecord
-      foregroundPollInFlight: boolean
-    }
+type IdlePollEntry = {
+  waiter: TerminalWaiter
+  foregroundPollInFlight: boolean
+  screenReadInFlight: boolean
+} & ({ kind: 'leaf'; leaf: RuntimeLeafRecord } | { kind: 'pty'; pty: RuntimePtyWorktreeRecord })
+
+/** One reading of a waiter's pane, and the results it would settle with. */
+type IdlePollSample = {
+  verdict: TuiIdleVerdict
+  ptyId: string | null
+  ready(): RuntimeTerminalWait
+  blocked(reason: RuntimeTerminalWaitBlockedReason): RuntimeTerminalWait
+  isQuiet(lane: QuietForegroundLane): boolean
+}
+
+const IDLE_ENTRY_FLAGS = { foregroundPollInFlight: false, screenReadInFlight: false }
 
 export class RuntimeTerminalIdlePolls {
   private readonly entries = new Set<IdlePollEntry>()
@@ -67,12 +84,13 @@ export class RuntimeTerminalIdlePolls {
 
   constructor(private readonly deps: RuntimeTerminalIdlePollDependencies) {}
 
-  startLeaf(waiter: TerminalWaiter, leaf: RuntimeLeafRecord): void {
-    this.start({ kind: 'leaf', waiter, leaf, foregroundPollInFlight: false })
+  /** `verdict` is what the caller just evaluated; weak ready is checked at once, not a sweep later. */
+  startLeaf(waiter: TerminalWaiter, leaf: RuntimeLeafRecord, verdict?: TuiIdleVerdict): void {
+    this.start({ kind: 'leaf', waiter, leaf, ...IDLE_ENTRY_FLAGS }, verdict)
   }
 
-  startPty(waiter: TerminalWaiter, pty: RuntimePtyWorktreeRecord): void {
-    this.start({ kind: 'pty', waiter, pty, foregroundPollInFlight: false })
+  startPty(waiter: TerminalWaiter, pty: RuntimePtyWorktreeRecord, verdict?: TuiIdleVerdict): void {
+    this.start({ kind: 'pty', waiter, pty, ...IDLE_ENTRY_FLAGS }, verdict)
   }
 
   /** Test/diagnostic seam: live sweep handles, which must stay at most one. */
@@ -80,7 +98,7 @@ export class RuntimeTerminalIdlePolls {
     return this.sweepTimer ? 1 : 0
   }
 
-  private start(entry: IdlePollEntry): void {
+  private start(entry: IdlePollEntry, verdict: TuiIdleVerdict | undefined): void {
     this.entries.add(entry)
     entry.waiter.cancelIdlePoll = () => this.stop(entry)
     // Why one shared timer for every waiter: a per-waiter interval multiplied idle
@@ -89,6 +107,11 @@ export class RuntimeTerminalIdlePolls {
     if (!this.sweepTimer) {
       this.sweepTimer = setInterval(() => this.sweep(), this.deps.intervalMs)
     }
+    // Why: the evidence is already in hand and only needs its screen read; a probe that
+    // times out under one interval (the automation start probe) would otherwise never see it.
+    if (verdict?.kind === 'ready-weak') {
+      void this.tick(entry)
+    }
   }
 
   private sweep(): void {
@@ -97,69 +120,102 @@ export class RuntimeTerminalIdlePolls {
     // slow `ps` must never delay another waiter's checks, and a waiter registered by a
     // resolve inside this sweep must wait for the next tick, as a fresh interval would.
     for (const entry of Array.from(this.entries)) {
-      void (entry.kind === 'leaf' ? this.tickLeaf(entry) : this.tickPty(entry))
+      void this.tick(entry)
     }
   }
 
-  private async tickLeaf(entry: IdlePollEntry & { kind: 'leaf' }): Promise<void> {
-    if (!this.entries.has(entry)) {
-      return
+  private sample(entry: IdlePollEntry): IdlePollSample {
+    const { handle } = entry.waiter
+    if (entry.kind === 'pty') {
+      // Why no re-read here: `ptysById` has a single create-once `set` site, so PTY
+      // records are mutated in place rather than swapped, and a capture stays live.
+      const { pty } = entry
+      const readWaitText = () =>
+        buildTerminalWaitText(pty.tailBuffer, pty.tailPartialLine, pty.preview)
+      return {
+        verdict: evaluateTuiIdle(ptyTuiIdleEvidence(this.deps, pty, readWaitText)),
+        ptyId: pty.ptyId,
+        ready: () => buildPtyTerminalWaitResult(handle, 'tui-idle', pty),
+        blocked: (reason) => buildPtyTerminalWaitBlockedResult(handle, 'tui-idle', pty, reason),
+        isQuiet: (lane) =>
+          isQuietForQuiescence(pty.lastOutputAt, this.deps.quiescenceMs, lane, () =>
+            this.deps.hasCommandPainted(pty.ptyId)
+          )
+      }
     }
-    const { waiter } = entry
     // Why re-read: `syncWindowGraph` rebuilds `this.leaves` with fresh objects on every
     // renderer publish, so the record captured at registration stops advancing. Its
-    // `lastOutputAt` freezes, the quiescence gate below then reads an ever-growing
-    // elapsed time, and the waiter settles while the pane is in fact still streaming.
+    // `lastOutputAt` freezes, the quiescence gate then reads an ever-growing elapsed
+    // time, and the waiter settles while the pane is in fact still streaming.
     const leaf = this.deps.getLiveLeaf(entry.leaf)
-    const agent = this.deps.getPaneAgent(leaf.ptyId)
+    const readWaitText = () =>
+      buildTerminalWaitText(leaf.tailBuffer, leaf.tailPartialLine, leaf.preview)
+    const live = () => this.deps.getLiveLeaf(entry.leaf)
+    return {
+      verdict: evaluateTuiIdle(leafTuiIdleEvidence(this.deps, leaf, readWaitText)),
+      ptyId: leaf.ptyId,
+      ready: () => buildTerminalWaitResult(handle, 'tui-idle', live()),
+      blocked: (reason) => buildTerminalWaitBlockedResult(handle, 'tui-idle', live(), reason),
+      isQuiet: (lane) =>
+        isQuietForQuiescence(
+          live().lastOutputAt,
+          this.deps.quiescenceMs,
+          lane,
+          () => !leaf.ptyId || this.deps.hasCommandPainted(leaf.ptyId)
+        )
+    }
+  }
+
+  private async tick(entry: IdlePollEntry): Promise<void> {
+    if (!this.entries.has(entry)) {
+      return
+    }
     let startedForegroundPoll = false
     try {
-      const waitText = buildTerminalWaitText(leaf.tailBuffer, leaf.tailPartialLine, leaf.preview)
-      const blockedReason = detectTerminalWaitBlockedReason(waitText)
-      if (blockedReason) {
-        this.stop(entry)
-        this.deps.resolve(
-          waiter,
-          buildTerminalWaitBlockedResult(waiter.handle, 'tui-idle', leaf, blockedReason)
-        )
+      const sample = this.sample(entry)
+      const { verdict, ptyId } = sample
+      if (verdict.kind === 'blocked') {
+        this.settle(entry, sample.blocked(verdict.reason))
         return
       }
-      if (
-        isTuiIdleSatisfied({
-          record: leaf,
-          rendererTitle: leaf.paneTitle ?? this.deps.getTabTitle(leaf.tabId),
-          readPositiveBodyEvidence: () => isKnownReadyPromptPreview(waitText),
-          readMuseReadyBodyEvidence: () => isMuseReadyPromptPreview(waitText),
-          agent,
-          firstPartyStatus: this.deps.getFirstPartyAgentStatus(leaf.ptyId),
-          quiescenceMs: this.deps.quiescenceMs
-        })
-      ) {
-        this.stop(entry)
-        this.deps.resolve(waiter, buildTerminalWaitResult(waiter.handle, 'tui-idle', leaf))
+      // Why strong ready outranks the screen: the detector is not scoped to a region, so dialog
+      // wording anywhere on a finished agent's screen would otherwise read as blocked.
+      if (verdict.kind === 'ready-strong') {
+        this.settle(entry, sample.ready())
         return
       }
-      if (
-        leaf.lastAgentStatus === null &&
-        quietForegroundProcessProvesTuiIdle(agent) &&
-        leaf.ptyId &&
-        !entry.foregroundPollInFlight
-      ) {
-        const foregroundRead = this.deps.getForegroundProcess(leaf.ptyId)
+      // Why no screen read while working: its output can quote dialog wording (a diff of this
+      // detector), and the dialogs only the screen shows are start-up ones, painted before any title.
+      if (verdict.kind === 'working' || entry.screenReadInFlight) {
+        return
+      }
+      const screenRead = ptyId ? this.readScreenBlockedReason(entry, ptyId) : null
+      // Why await only a real read: a pane with no screen model keeps its tick synchronous.
+      const screenBlockedReason = screenRead ? await screenRead : null
+      if (!this.entries.has(entry)) {
+        return
+      }
+      if (screenBlockedReason) {
+        this.settle(entry, sample.blocked(screenBlockedReason))
+        return
+      }
+      if (verdict.kind === 'ready-weak') {
+        this.settle(entry, sample.ready())
+        return
+      }
+      const lane = verdict.quietForeground
+      // Why quiet before the read too: a streaming or not-yet-painted pane cannot settle, so it
+      // must not pay a process inspection every tick for a whole turn.
+      if (lane !== 'closed' && ptyId && !entry.foregroundPollInFlight && sample.isQuiet(lane)) {
+        const foregroundRead = this.deps.getForegroundProcess(ptyId)
         if (!foregroundRead) {
           return
         }
         entry.foregroundPollInFlight = true
         startedForegroundPoll = true
         const foreground = await foregroundRead
-        const live = this.deps.getLiveLeaf(entry.leaf)
-        if (
-          foreground &&
-          !isShellProcess(foreground) &&
-          isQuietForQuiescence(live.lastOutputAt, this.deps.quiescenceMs)
-        ) {
-          this.stop(entry)
-          this.deps.resolve(waiter, buildTerminalWaitResult(waiter.handle, 'tui-idle', live))
+        if (foreground && !isShellProcess(foreground) && sample.isQuiet(lane)) {
+          this.settle(entry, sample.ready())
         }
       }
     } catch {
@@ -171,70 +227,27 @@ export class RuntimeTerminalIdlePolls {
     }
   }
 
-  private async tickPty(entry: IdlePollEntry & { kind: 'pty' }): Promise<void> {
-    if (!this.entries.has(entry)) {
-      return
-    }
-    const { waiter, pty } = entry
-    // Why no re-read here: `ptysById` has a single create-once `set` site, so PTY
-    // records are mutated in place rather than swapped, and a capture stays live.
-    const agent = this.deps.getPaneAgent(pty.ptyId)
-    let startedForegroundPoll = false
-    try {
-      const waitText = buildTerminalWaitText(pty.tailBuffer, pty.tailPartialLine, pty.preview)
-      const blockedReason = detectTerminalWaitBlockedReason(waitText)
-      if (blockedReason) {
-        this.stop(entry)
-        this.deps.resolve(
-          waiter,
-          buildPtyTerminalWaitBlockedResult(waiter.handle, 'tui-idle', pty, blockedReason)
-        )
-        return
-      }
-      if (
-        isTuiIdleSatisfied({
-          record: pty,
-          readPositiveBodyEvidence: () =>
-            this.deps.getAdoptedPtyIdleStatus(pty) === 'idle' ||
-            isKnownReadyPromptPreview(waitText),
-          readMuseReadyBodyEvidence: () => isMuseReadyPromptPreview(waitText),
-          agent,
-          firstPartyStatus: this.deps.getFirstPartyAgentStatus(pty.ptyId),
-          quiescenceMs: this.deps.quiescenceMs
-        })
-      ) {
-        this.stop(entry)
-        this.deps.resolve(waiter, buildPtyTerminalWaitResult(waiter.handle, 'tui-idle', pty))
-        return
-      }
-      if (
-        pty.lastAgentStatus === null &&
-        quietForegroundProcessProvesTuiIdle(agent) &&
-        !entry.foregroundPollInFlight
-      ) {
-        const foregroundRead = this.deps.getForegroundProcess(pty.ptyId)
-        if (!foregroundRead) {
-          return
-        }
-        entry.foregroundPollInFlight = true
-        startedForegroundPoll = true
-        const foreground = await foregroundRead
-        if (
-          foreground &&
-          !isShellProcess(foreground) &&
-          isQuietForQuiescence(pty.lastOutputAt, this.deps.quiescenceMs)
-        ) {
-          this.stop(entry)
-          this.deps.resolve(waiter, buildPtyTerminalWaitResult(waiter.handle, 'tui-idle', pty))
-        }
-      }
-    } catch {
-      // Transient process inspection errors do not retire the waiter.
-    } finally {
-      if (startedForegroundPoll) {
-        entry.foregroundPollInFlight = false
-      }
+  /** Why the screen too: a dialog that parks the cursor above its own options (Claude's
+   *  workspace trust) loses those rows from the line tail; the rendered screen still has them. */
+  private readScreenBlockedReason(
+    entry: IdlePollEntry,
+    ptyId: string
+  ): Promise<RuntimeTerminalWaitBlockedReason | null> | null {
+    const screenRead = this.deps.readVisibleScreen(ptyId)
+    if (!screenRead) {
+      return null
     }
+    entry.screenReadInFlight = true
+    return screenRead
+      .then((screen) => (screen ? detectTerminalWaitBlockedReason(screen) : null))
+      .finally(() => {
+        entry.screenReadInFlight = false
+      })
+  }
+
+  private settle(entry: IdlePollEntry, result: RuntimeTerminalWait): void {
+    this.stop(entry)
+    this.deps.resolve(entry.waiter, result)
   }
 
   private stop(entry: IdlePollEntry): void {
diff --git a/src/main/runtime/runtime-terminal-orphan-adoption.ts b/src/main/runtime/runtime-terminal-orphan-adoption.ts
index 59fbf76b857..51e56d0b508 100644
--- a/src/main/runtime/runtime-terminal-orphan-adoption.ts
+++ b/src/main/runtime/runtime-terminal-orphan-adoption.ts
@@ -5,6 +5,7 @@ import type {
   RuntimeTerminalOrphanAdoptionResult
 } from '../../shared/runtime-types'
 import { makePaneKey } from '../../shared/stable-pane-id'
+import { hasClosedTerminalTabRecord } from '../../shared/closed-terminal-tab-tombstones'
 import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
 import { terminalOrphanExecutionOwnersEqual } from './terminal-orphan-owner'
 import type { TerminalWorkspaceLaunchScope } from './runtime-legacy-worker-terminal-recovery-types'
@@ -13,7 +14,7 @@ import { buildRuntimeTerminalOrphanSession } from './runtime-terminal-orphan-ses
 import { validateRuntimeTerminalOrphanTopology } from './runtime-terminal-orphan-topology-validation'
 import type { RuntimeLeafRecord, RuntimePtyWorktreeRecord } from './runtime-terminal-state-records'
 import { runtimeWorktreeIdsEqual } from './runtime-worktree-path-identity'
-import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from './workspace-session-failed-write-rollback'
+import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from '../persistence/restoring-sessions/workspace-session-write-rollback'
 
 type RuntimeTerminalOrphanAdoptionPorts = {
   getPty: (handle: string) => RuntimePtyWorktreeRecord | null
@@ -185,7 +186,11 @@ export async function adoptRuntimeTerminalOrphansFromInventory(args: {
     ) {
       throw new Error('terminal_orphan_surface_occupied')
     }
-    if (session.terminalSurfaceTombstonesByPaneKey?.[paneKey]) {
+    // Why the close record too: it outlives a host restart, which the client's retirement proofs do not.
+    if (
+      session.terminalSurfaceTombstonesByPaneKey?.[paneKey] ||
+      hasClosedTerminalTabRecord(session.closedTerminalTabTombstonesByTabId, claim.tabId)
+    ) {
       throw new Error('terminal_orphan_surface_retired')
     }
     for (const snapshot of ports.getMobileSnapshots()) {
diff --git a/src/main/runtime/runtime-terminal-state-records.ts b/src/main/runtime/runtime-terminal-state-records.ts
index 82e5124bf40..d030b896da9 100644
--- a/src/main/runtime/runtime-terminal-state-records.ts
+++ b/src/main/runtime/runtime-terminal-state-records.ts
@@ -11,6 +11,7 @@ import type { HeadlessEmulator } from '../daemon/headless-emulator'
 import type { PtyProviderBufferSnapshot } from '../providers/types'
 import type { RetainedTailRedrawCursor } from './terminal-tail-redraw-buffer'
 import type { TerminalTailWaitState } from './terminal-wait-tail-state'
+import type { TerminalCommandPaint } from './terminal-command-paint'
 import type { PtyShellOwnershipMirror } from './pty-shell-ownership-mirror'
 import type { TerminalExitCause } from '../../shared/terminal-exit-cause'
 import type { AgentSessionOwnerBinding } from '../../shared/agent-session-host-authority'
@@ -87,6 +88,8 @@ export type RuntimePtyWorktreeRecord = RuntimeTerminalTailState & {
   title: string | null
   titleUpdatedAt: number | null
   lastOutputAt: number | null
+  /** See terminal-command-paint.ts; absent until the pane's first output, and again after a gap or a new process. */
+  commandPaint?: TerminalCommandPaint
 }
 
 export type RuntimePtyTabCloseAuthority = {
diff --git a/src/main/runtime/runtime-terminal-wait.ts b/src/main/runtime/runtime-terminal-wait.ts
index 23d112c8e9f..240f5508581 100644
--- a/src/main/runtime/runtime-terminal-wait.ts
+++ b/src/main/runtime/runtime-terminal-wait.ts
@@ -3,11 +3,6 @@ import type {
   RuntimeTerminalWaitCondition
 } from '../../shared/runtime-types'
 import { hasAntigravityTerminalHeader } from './antigravity-terminal-readiness'
-import {
-  detectTerminalWaitBlockedReason,
-  isKnownReadyPromptPreview,
-  isMuseReadyPromptPreview
-} from './terminal-wait-detection'
 import {
   buildPtyTerminalWaitBlockedResult,
   buildPtyTerminalWaitResult,
@@ -16,23 +11,23 @@ import {
   getTerminalState
 } from './terminal-wait-results'
 import { buildTerminalWaitText } from './terminal-wait-tail-state'
-import { isTuiIdleSatisfied, type FirstPartyAgentStatus } from './tui-idle-evidence'
+import {
+  evaluateTuiIdle,
+  leafTuiIdleEvidence,
+  ptyTuiIdleEvidence,
+  type TuiIdleEvidenceSource,
+  type TuiIdleVerdict
+} from './tui-idle-evidence'
 import type { TuiAgent } from '../../shared/tui-agent'
 import type { TerminalWaiter } from './runtime-terminal-contracts'
 import type { RuntimeLeafRecord, RuntimePtyWorktreeRecord } from './runtime-terminal-state-records'
-import type { AgentStatus } from '../../shared/agent-detection'
 import type { RuntimeTerminalIdlePolls } from './runtime-terminal-idle-polls'
 import type { RuntimeTerminalWaiterRegistry } from './runtime-terminal-waiter-registry'
 
-type RuntimeTerminalWaitDependencies = {
+type RuntimeTerminalWaitDependencies = TuiIdleEvidenceSource & {
   defaultTimeoutMs: number
   getLivePty(handle: string): { pty: RuntimePtyWorktreeRecord } | null
   getLiveLeaf(handle: string): { leaf: RuntimeLeafRecord }
-  getAdoptedPtyIdleStatus(pty: RuntimePtyWorktreeRecord): AgentStatus | null
-  getTabTitle(tabId: string): string | null
-  quiescenceMs: number
-  getPaneAgent(ptyId: string | null | undefined): TuiAgent | null
-  getFirstPartyAgentStatus(ptyId: string | null | undefined): FirstPartyAgentStatus
   startVisibleReadProbe(
     waiter: TerminalWaiter,
     waiterTimeoutMs: number,
@@ -49,28 +44,12 @@ export class RuntimeTerminalWait {
 
   /** Why one helper per record kind: every satisfaction site must rank the same way,
    *  or the immediate check and the poll disagree about the same pane. */
-  private ptySatisfied(pty: RuntimePtyWorktreeRecord, waitText: string): boolean {
-    return isTuiIdleSatisfied({
-      record: pty,
-      readPositiveBodyEvidence: () =>
-        this.deps.getAdoptedPtyIdleStatus(pty) === 'idle' || isKnownReadyPromptPreview(waitText),
-      readMuseReadyBodyEvidence: () => isMuseReadyPromptPreview(waitText),
-      agent: this.deps.getPaneAgent(pty.ptyId),
-      firstPartyStatus: this.deps.getFirstPartyAgentStatus(pty.ptyId),
-      quiescenceMs: this.deps.quiescenceMs
-    })
+  private evaluatePty(pty: RuntimePtyWorktreeRecord, waitText: string): TuiIdleVerdict {
+    return evaluateTuiIdle(ptyTuiIdleEvidence(this.deps, pty, () => waitText))
   }
 
-  private leafSatisfied(leaf: RuntimeLeafRecord, waitText: string): boolean {
-    return isTuiIdleSatisfied({
-      record: leaf,
-      rendererTitle: leaf.paneTitle ?? this.deps.getTabTitle(leaf.tabId),
-      readPositiveBodyEvidence: () => isKnownReadyPromptPreview(waitText),
-      readMuseReadyBodyEvidence: () => isMuseReadyPromptPreview(waitText),
-      agent: this.deps.getPaneAgent(leaf.ptyId),
-      firstPartyStatus: this.deps.getFirstPartyAgentStatus(leaf.ptyId),
-      quiescenceMs: this.deps.quiescenceMs
-    })
+  private evaluateLeaf(leaf: RuntimeLeafRecord, waitText: string): TuiIdleVerdict {
+    return evaluateTuiIdle(leafTuiIdleEvidence(this.deps, leaf, () => waitText))
   }
 
   async wait(
@@ -92,11 +71,13 @@ export class RuntimeTerminalWait {
         pty.pty.tailPartialLine,
         pty.pty.preview
       )
-      const ptyBlockedReason = detectTerminalWaitBlockedReason(ptyWaitText)
-      if (condition === 'tui-idle' && ptyBlockedReason) {
-        return buildPtyTerminalWaitBlockedResult(handle, condition, pty.pty, ptyBlockedReason)
+      // Why strong verdicts only, here and at every other synchronous site: weak evidence
+      // cannot see a dialog the tail lost, so it settles only on the poll, after a screen read.
+      const ptyVerdict = condition === 'tui-idle' ? this.evaluatePty(pty.pty, ptyWaitText) : null
+      if (ptyVerdict?.kind === 'blocked') {
+        return buildPtyTerminalWaitBlockedResult(handle, condition, pty.pty, ptyVerdict.reason)
       }
-      if (condition === 'tui-idle' && this.ptySatisfied(pty.pty, ptyWaitText)) {
+      if (ptyVerdict?.kind === 'ready-strong') {
         return buildPtyTerminalWaitResult(handle, condition, pty.pty)
       }
       return await new Promise<RuntimeTerminalWaitResult>((resolve, reject) => {
@@ -138,16 +119,16 @@ export class RuntimeTerminalWait {
             live.pty.tailPartialLine,
             live.pty.preview
           )
-          const blockedReason = detectTerminalWaitBlockedReason(livePtyWaitText)
-          if (blockedReason) {
+          const verdict = this.evaluatePty(live.pty, livePtyWaitText)
+          if (verdict.kind === 'blocked') {
             this.waiters.resolve(
               waiter,
-              buildPtyTerminalWaitBlockedResult(handle, condition, live.pty, blockedReason)
+              buildPtyTerminalWaitBlockedResult(handle, condition, live.pty, verdict.reason)
             )
-          } else if (this.ptySatisfied(live.pty, livePtyWaitText)) {
+          } else if (verdict.kind === 'ready-strong') {
             this.waiters.resolve(waiter, buildPtyTerminalWaitResult(handle, condition, live.pty))
           } else {
-            this.polls.startPty(waiter, live.pty)
+            this.polls.startPty(waiter, live.pty, verdict)
             const paneAgent = this.deps.getPaneAgent(live.pty.ptyId)
             if (
               // AGY can retain a stale working/blocked status after a trust dialog was
@@ -173,17 +154,15 @@ export class RuntimeTerminalWait {
     }
 
     const leafWaitText = buildTerminalWaitText(leaf.tailBuffer, leaf.tailPartialLine, leaf.preview)
-    const leafBlockedReason = detectTerminalWaitBlockedReason(leafWaitText)
-    if (condition === 'tui-idle' && leafBlockedReason) {
-      return buildTerminalWaitBlockedResult(handle, condition, leaf, leafBlockedReason)
+    const leafVerdict = condition === 'tui-idle' ? this.evaluateLeaf(leaf, leafWaitText) : null
+    if (leafVerdict?.kind === 'blocked') {
+      return buildTerminalWaitBlockedResult(handle, condition, leaf, leafVerdict.reason)
     }
 
-    // Why: if the agent already transitioned to idle (or permission) before the
-    // waiter was registered, resolve immediately. This uses the same OSC title
-    // detection that powers the renderer's "Task complete" notifications.
-    // Why: only 'idle' satisfies tui-idle, not 'permission'. Permission means the
+    // Why: if the agent already announced rest before the waiter was registered, resolve
+    // immediately. Only 'idle' satisfies tui-idle, not 'permission'. Permission means the
     // agent is blocked on user approval, not finished with its task.
-    if (condition === 'tui-idle' && this.leafSatisfied(leaf, leafWaitText)) {
+    if (leafVerdict?.kind === 'ready-strong') {
       return buildTerminalWaitResult(handle, condition, leaf)
     }
 
@@ -235,13 +214,13 @@ export class RuntimeTerminalWait {
             live.leaf.tailPartialLine,
             live.leaf.preview
           )
-          const blockedReason = detectTerminalWaitBlockedReason(liveLeafWaitText)
-          if (blockedReason) {
+          const verdict = this.evaluateLeaf(live.leaf, liveLeafWaitText)
+          if (verdict.kind === 'blocked') {
             this.waiters.resolve(
               waiter,
-              buildTerminalWaitBlockedResult(handle, condition, live.leaf, blockedReason)
+              buildTerminalWaitBlockedResult(handle, condition, live.leaf, verdict.reason)
             )
-          } else if (this.leafSatisfied(live.leaf, liveLeafWaitText)) {
+          } else if (verdict.kind === 'ready-strong') {
             // Why: don't clear lastAgentStatus here. It's a factual record of the
             // last detected OSC state, not a one-shot signal. Clearing it causes
             // subsequent tui-idle waiters to hang even though the agent is idle —
@@ -251,7 +230,7 @@ export class RuntimeTerminalWait {
             // Why: renderer-synced previews can show a known ready prompt even
             // while the last OSC title is still "working"; keep polling the
             // preview/title until the waiter resolves or hits its timeout.
-            this.polls.startLeaf(waiter, live.leaf)
+            this.polls.startLeaf(waiter, live.leaf, verdict)
             const paneAgent = this.deps.getPaneAgent(live.leaf.ptyId)
             if (
               (paneAgent === 'antigravity' ||
diff --git a/src/main/runtime/runtime-terminal-writer.ts b/src/main/runtime/runtime-terminal-writer.ts
index 7ff6ba4a7f3..10e94f3747f 100644
--- a/src/main/runtime/runtime-terminal-writer.ts
+++ b/src/main/runtime/runtime-terminal-writer.ts
@@ -1,8 +1,10 @@
 import { resolveAgentPromptSubmitDelayForAgent } from '../../shared/agent-prompt-injection'
 import type { TuiAgent } from '../../shared/tui-agent'
 import { iterateTerminalInputChunks } from '../../shared/terminal-input'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 
 export type RuntimeTerminalWriteOptions = {
+  inputKind: TerminalInputKind
   signal?: AbortSignal
   beforeWrite?: (ptyId: string) => void | Promise<void>
   reserveWrite?: (ptyId: string) => void
@@ -12,7 +14,7 @@ export type RuntimeTerminalWriteOptions = {
 
 export class RuntimeTerminalWriter {
   constructor(
-    private readonly write: (ptyId: string, data: string) => boolean,
+    private readonly write: (ptyId: string, data: string, inputKind: TerminalInputKind) => boolean,
     private readonly getWriteHostPlatform: (ptyId: string) => NodeJS.Platform = () =>
       process.platform,
     private readonly getAgent: (ptyId: string) => TuiAgent | null = () => null
@@ -22,7 +24,7 @@ export class RuntimeTerminalWriter {
     ptyId: string,
     action: { text?: string; enter?: boolean; interrupt?: boolean },
     payload: string,
-    options: RuntimeTerminalWriteOptions = {}
+    options: RuntimeTerminalWriteOptions
   ): Promise<void> {
     // Why: direct terminal.send can carry paste-sized text from RPC/mobile
     // clients; chunk text before PTY/ConPTY while preserving suffix separation.
@@ -54,7 +56,7 @@ export class RuntimeTerminalWriter {
         throw error
       }
       options.reserveWrite?.(ptyId)
-      if (!this.write(ptyId, suffix)) {
+      if (!this.write(ptyId, suffix, options.inputKind)) {
         throw new Error(options.suffixFailureError ?? 'terminal_not_writable')
       }
       await options.afterWrite?.(ptyId)
@@ -65,7 +67,7 @@ export class RuntimeTerminalWriter {
     }
     await options.beforeWrite?.(ptyId)
     options.reserveWrite?.(ptyId)
-    if (!this.write(ptyId, payload)) {
+    if (!this.write(ptyId, payload, options.inputKind)) {
       throw new Error('terminal_not_writable')
     }
     await options.afterWrite?.(ptyId)
@@ -74,14 +76,14 @@ export class RuntimeTerminalWriter {
   async writeChunks(
     ptyId: string,
     text: string,
-    options: RuntimeTerminalWriteOptions = {}
+    options: RuntimeTerminalWriteOptions
   ): Promise<void> {
     const chunks = iterateTerminalInputChunks(text)
     let chunk = chunks.next()
     while (!chunk.done) {
       await options.beforeWrite?.(ptyId)
       options.reserveWrite?.(ptyId)
-      if (!this.write(ptyId, chunk.value)) {
+      if (!this.write(ptyId, chunk.value, options.inputKind)) {
         throw new Error('terminal_not_writable')
       }
       await options.afterWrite?.(ptyId)
diff --git a/src/main/runtime/runtime-workspace-session-controller.ts b/src/main/runtime/runtime-workspace-session-controller.ts
index c7472b914d2..e45425b8dd3 100644
--- a/src/main/runtime/runtime-workspace-session-controller.ts
+++ b/src/main/runtime/runtime-workspace-session-controller.ts
@@ -107,6 +107,15 @@ export class RuntimeWorkspaceSessionController {
     return hostId ? (this.deps.getStore()?.getWorkspaceSession?.(hostId) ?? null) : null
   }
 
+  /** The session only when the worktree's own host partition owns it, not a rotated-owner fallback. */
+  getOwnPartition(worktreeId: string): WorkspaceSessionState | null {
+    const store = this.deps.getStore()
+    const hostId = store ? this.getPreferredHostId(worktreeId, store) : null
+    return hostId && hostId === this.tryGetHostId(worktreeId)
+      ? (store?.getWorkspaceSession?.(hostId) ?? null)
+      : null
+  }
+
   set(worktreeId: string, session: WorkspaceSessionState): void {
     this.deps.getStore()?.setWorkspaceSession?.(session, this.getHostId(worktreeId))
   }
diff --git a/src/main/runtime/runtime-worktree-agent-rows-verdict.test.ts b/src/main/runtime/runtime-worktree-agent-rows-verdict.test.ts
new file mode 100644
index 00000000000..f4baa90da20
--- /dev/null
+++ b/src/main/runtime/runtime-worktree-agent-rows-verdict.test.ts
@@ -0,0 +1,225 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../shared/agent-session-journal-types'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { agentSessionFailureFact } from '../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../shared/agent-session-failure-words'
+import { makeStructuredAgentStatusSubject } from '../../shared/agent-status-subject'
+import { agentSessionRecordFixture } from '../../shared/agent-session-record.test-fixture'
+import type {
+  AgentSessionStatusEvent,
+  AgentSessionStatusSummary
+} from '../../shared/agent-session-wire'
+import type { RuntimeWorktreePsSummary } from '../../shared/runtime-types'
+import { AgentHookServer, _internals } from '../agent-hooks/server'
+import { createTrackedJournalOpener } from '../native-chat/agent-session-journal/journal-store-test-open'
+import type { AgentSessionJournal } from '../native-chat/agent-session-journal/journal-store'
+import { StructuredAgentSessionStatusFeed } from '../native-chat/agent-session-wire/structured-agent-session-status-feed'
+import { indexedStatusFeedSession } from '../native-chat/agent-session-wire/structured-agent-session-status-feed-test-session'
+import { attachRuntimeWorktreeAgentRows } from './runtime-worktree-agent-rows'
+import { collectRuntimeWorktreeAgentSources } from './runtime-worktree-agent-sources'
+
+vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: vi.fn(() => ({ nth_repo_added: 2 }))
+}))
+
+// A request that failed reads as failed on every surface the host feeds: the journal's verdict
+// travels the real feed, the status-store ingest and `worktree ps`, never just the projection.
+const SESSION = 'verdict-session'
+const WORKSPACE_ID = 'workspace-1'
+const SUBJECT = makeStructuredAgentStatusSubject(
+  {
+    executionHostId: 'local',
+    wslDistro: null,
+    workspaceId: WORKSPACE_ID,
+    workspaceKind: 'git-worktree'
+  },
+  SESSION
+)
+const TURN_IDENTITY = {
+  provider: 'codex',
+  threadId: 'thread-1',
+  turnId: 'turn-1',
+  ordinal: 0
+} as const
+
+let root: string
+const journals = createTrackedJournalOpener()
+
+beforeEach(async () => {
+  _internals.resetCachesForTests()
+  root = await mkdtemp(join(tmpdir(), 'orca-verdict-rows-'))
+})
+
+afterEach(async () => {
+  await journals.closeAll()
+  await rm(root, { recursive: true, force: true })
+})
+
+async function openJournal(): Promise<AgentSessionJournal> {
+  return journals.open({
+    identity: {
+      sessionId: SESSION,
+      workspaceId: WORKSPACE_ID,
+      hostId: 'local',
+      agent: 'codex',
+      providerHandle: { kind: 'codex', threadId: 'thread-1' }
+    },
+    journalDir: join(root, SESSION)
+  })
+}
+
+/** What the host's real feed publishes for this journal. */
+function publishedSummary(journal: AgentSessionJournal): AgentSessionStatusSummary {
+  const session = indexedStatusFeedSession({ journal })
+  const feed = new StructuredAgentSessionStatusFeed({
+    sessions: new Map([[SESSION, session]]),
+    getRecord: () => agentSessionRecordFixture(),
+    now: () => 1_000
+  })
+  const events: AgentSessionStatusEvent[] = []
+  feed.subscribe({ id: 'list', emit: (event) => events.push(event) })
+  const snapshot = events.find((event) => event.type === 'snapshot')
+  const summary = snapshot?.type === 'snapshot' ? snapshot.sessions[0] : undefined
+  if (!summary) {
+    throw new Error('the feed published no session')
+  }
+  return summary
+}
+
+function ingest(summary: AgentSessionStatusSummary) {
+  const store = new AgentHookServer()
+  store.ingestStructuredStatus(summary, SUBJECT)
+  const hookSnapshots = store.getStatusSnapshot()
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: attaching agent rows reads and writes only `worktreeId`, `status`, `hasHostSidebarActivity` and `agents`.
+  const row = {
+    worktreeId: WORKSPACE_ID,
+    status: 'inactive',
+    hasHostSidebarActivity: false,
+    agents: []
+  } as unknown as RuntimeWorktreePsSummary
+  attachRuntimeWorktreeAgentRows({
+    summaries: new Map([[WORKSPACE_ID, row]]),
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: `getSummary` below resolves every row by id, so the path index is never read.
+    pathIndex: { byPath: new Map(), byRealPath: new Map() } as never,
+    missingWorktreeIds: new Set(),
+    workingTerminalEvidenceByWorktreeId: new Map(),
+    rowSources: collectRuntimeWorktreeAgentSources({
+      mirroredWorktreeIdByTabId: new Map(),
+      connectedPtyEvidence: {
+        tabIds: new Set(),
+        paneKeys: new Set(),
+        ptyIdByTerminalHandle: new Map()
+      },
+      hookSnapshots
+    }),
+    orchestrationByPaneKey: null,
+    getSummary: (map, _p, _m, id) => map.get(id) ?? null
+  })
+  return { status: hookSnapshots[0], ps: row.agents[0] }
+}
+
+describe('a request that failed reads as failed through the feed, the ingest and worktree ps', () => {
+  it('reads a chat whose only send the agent start refused as failed, not interrupted', async () => {
+    const journal = await openJournal()
+    await journal.appendSubmission({
+      clientMessageId: 'first',
+      payloadFingerprint: 'fp',
+      body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
+      fence: 1,
+      handoverRecorded: true
+    })
+    await journal.rejectQueuedSubmissions(
+      1,
+      agentSessionFailureWords(agentSessionFailureFact('notSignedIn'), {
+        surface: 'rejection',
+        agentName: 'Claude'
+      })
+    )
+
+    const summary = publishedSummary(journal)
+    expect(summary).toMatchObject({ status: 'idle', turnOutcome: 'failure', latestPrompt: 'hello' })
+    const { status, ps } = ingest(summary)
+    expect(status).toMatchObject({
+      state: 'done',
+      mainAgent: { state: 'done', outcome: 'failure' }
+    })
+    expect(status?.interrupted).not.toBe(true)
+    expect(ps).toMatchObject({
+      state: 'done',
+      mainAgent: { state: 'done', outcome: 'failure' },
+      interrupted: false
+    })
+  })
+
+  it('reads a cancelled structured turn as interrupted for readers that predate the verdict', async () => {
+    const journal = await openJournal()
+    await journal.appendItem(
+      TURN_IDENTITY,
+      {
+        kind: 'turn',
+        turnId: 'turn-1',
+        state: 'interrupted',
+        outcome: 'cancellation',
+        completedAt: 5
+      },
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
+
+    const { status, ps } = ingest(publishedSummary(journal))
+    expect(status).toMatchObject({ state: 'done', interrupted: true })
+    expect(ps).toMatchObject({
+      mainAgent: { state: 'done', outcome: 'cancellation' },
+      interrupted: true
+    })
+  })
+
+  it('publishes a main agent that failed while its subagent runs, on the row that still works', async () => {
+    const journal = await openJournal()
+    await journal.appendItem(
+      TURN_IDENTITY,
+      { kind: 'turn', turnId: 'turn-1', state: 'completed', outcome: 'failure', completedAt: 5 },
+      { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
+    )
+    const summary: AgentSessionStatusSummary = {
+      ...publishedSummary(journal),
+      backgroundTasks: [{ id: 'child-1', kind: 'agent', state: 'working' }]
+    }
+
+    const { status, ps } = ingest(summary)
+    expect(status).toMatchObject({
+      state: 'working',
+      mainAgent: { state: 'done', outcome: 'failure' }
+    })
+    // The row carries the main agent's own clock, which dates the failure apart from the working row.
+    expect(ps).toMatchObject({
+      state: 'working',
+      mainAgent: {
+        state: 'done',
+        outcome: 'failure',
+        stateStartedAt: status?.mainAgent?.stateStartedAt
+      },
+      interrupted: false
+    })
+  })
+
+  it('lists nothing for a chat whose only send the user withdrew', async () => {
+    const journal = await openJournal()
+    await journal.appendSubmission({
+      clientMessageId: 'first',
+      payloadFingerprint: 'fp',
+      body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
+      fence: 1,
+      handoverRecorded: true
+    })
+    await journal.rejectQueuedSubmissions(
+      1,
+      agentSessionFailureWords(agentSessionFailureFact('cancelled'), { surface: 'rejection' })
+    )
+
+    expect(publishedSummary(journal)).toMatchObject({ status: null })
+    expect(ingest(publishedSummary(journal)).ps).toBeUndefined()
+  })
+})
diff --git a/src/main/runtime/runtime-worktree-agent-rows.ts b/src/main/runtime/runtime-worktree-agent-rows.ts
index 20c17f9b01a..310b0f6bc52 100644
--- a/src/main/runtime/runtime-worktree-agent-rows.ts
+++ b/src/main/runtime/runtime-worktree-agent-rows.ts
@@ -60,6 +60,7 @@ export function attachRuntimeWorktreeAgentRows(args: {
       toolName: source.toolName,
       toolInput: source.toolInput,
       interrupted: source.interrupted,
+      ...(source.mainAgent ? { mainAgent: source.mainAgent } : {}),
       stateStartedAt: source.stateStartedAt,
       updatedAt: source.updatedAt,
       ...(source.structuredHost === 'owned' ? { structuredHostOwned: true as const } : {})
diff --git a/src/main/runtime/runtime-worktree-agent-source.ts b/src/main/runtime/runtime-worktree-agent-source.ts
index 984f20e0955..fd98d7914b1 100644
--- a/src/main/runtime/runtime-worktree-agent-source.ts
+++ b/src/main/runtime/runtime-worktree-agent-source.ts
@@ -1,5 +1,6 @@
 import type { StructuredHostStatus } from '../../shared/agent-hook-listener/listener-event'
 import type { ParsedAgentStatusPayload } from '../../shared/agent-status-types'
+import type { AgentMainAgentStatus } from '../../shared/main-agent-status'
 
 export type RuntimeWorktreeAgentSource = {
   paneKey: string
@@ -15,6 +16,7 @@ export type RuntimeWorktreeAgentSource = {
   toolName: string | null
   toolInput: string | null
   interrupted: boolean
+  mainAgent?: AgentMainAgentStatus
   stateStartedAt: number
   updatedAt: number
   /** Projected by the structured session host; `owned` rows stay fresh past the staleness window. */
diff --git a/src/main/runtime/runtime-worktree-agent-startup.test.ts b/src/main/runtime/runtime-worktree-agent-startup.test.ts
index e901555fa07..5fa98186449 100644
--- a/src/main/runtime/runtime-worktree-agent-startup.test.ts
+++ b/src/main/runtime/runtime-worktree-agent-startup.test.ts
@@ -1,22 +1,12 @@
 import { describe, expect, it, vi } from 'vitest'
 import type { Repo } from '../../shared/repo-types'
+import { tuiAgentToAgentKind } from '../../shared/agent-kind'
 
 const mocks = vi.hoisted(() => ({
-  markAntigravityWorkspaceTrusted: vi.fn(),
-  markCodexProjectTrusted: vi.fn(),
-  markCopilotFolderTrusted: vi.fn(),
-  markCursorWorkspaceTrusted: vi.fn(),
   detectRemoteAgents: vi.fn(),
   detectInstalledAgentsWithShellPathHydration: vi.fn()
 }))
 
-vi.mock('../agent-trust-presets', () => ({
-  markAntigravityWorkspaceTrusted: mocks.markAntigravityWorkspaceTrusted,
-  markCodexProjectTrusted: mocks.markCodexProjectTrusted,
-  markCopilotFolderTrusted: mocks.markCopilotFolderTrusted,
-  markCursorWorkspaceTrusted: mocks.markCursorWorkspaceTrusted
-}))
-
 vi.mock('../preflight/agent-detection', () => ({
   detectRemoteAgents: mocks.detectRemoteAgents,
   detectInstalledAgentsWithShellPathHydration: mocks.detectInstalledAgentsWithShellPathHydration
@@ -24,8 +14,7 @@ vi.mock('../preflight/agent-detection', () => ({
 
 import {
   buildWorktreeStartupForAgent,
-  buildWorktreeStartupForDraft,
-  markLocalWorktreeTrusted
+  buildWorktreeStartupForDraft
 } from './runtime-worktree-agent-startup'
 
 function makeRepo(fields: Partial<Repo>): Repo {
@@ -101,6 +90,22 @@ describe('buildWorktreeStartupForAgent host resolution', () => {
       request_kind: 'new'
     })
   })
+
+  it('attributes a startup agent whose caller named no surface as unknown', () => {
+    const result = buildWorktreeStartupForAgent({
+      repo: makeRepo({}),
+      settings,
+      agent: 'claude',
+      getLaunchPlatform: () => 'linux',
+      toSessionOptions: () => undefined
+    })
+
+    expect(result.startup.telemetry).toEqual({
+      agent_kind: 'claude-code',
+      launch_source: 'unknown',
+      request_kind: 'new'
+    })
+  })
 })
 
 describe('buildWorktreeStartupForDraft agent detection', () => {
@@ -134,56 +139,32 @@ describe('buildWorktreeStartupForDraft agent detection', () => {
     expect(mocks.detectRemoteAgents).not.toHaveBeenCalled()
     expect(result?.agent).toBe('claude')
   })
-})
 
-describe('markLocalWorktreeTrusted', () => {
-  it('waits for the Codex trust write before resolving', async () => {
-    let finish!: () => void
-    mocks.markCodexProjectTrusted.mockReturnValue(
-      new Promise<void>((resolve) => {
-        finish = resolve
+  // The host picks and launches this agent itself, so it is attributed like any other it builds,
+  // whether the draft rides the launch command or is pasted once the agent is up.
+  it.each([
+    ['claude', 'cli', 'cli', false],
+    ['claude', undefined, 'unknown', false],
+    ['claude-agent-teams', 'orchestration', 'orchestration', true],
+    ['claude-agent-teams', undefined, 'unknown', true]
+  ] as const)(
+    'attributes a %s draft launch named %s as %s',
+    async (agent, launchSource, expected, pasted) => {
+      const result = await buildWorktreeStartupForDraft({
+        repo: makeRepo({}),
+        settings,
+        draft: 'ship it',
+        requestedAgent: agent,
+        getLaunchPlatform: () => 'linux',
+        ...(launchSource ? { launchSource } : {})
       })
-    )
-    let settled = false
-    const marking = markLocalWorktreeTrusted('codex', '/workspace/app').then(() => {
-      settled = true
-    })
 
-    await Promise.resolve()
-    expect(settled).toBe(false)
-    finish()
-    await marking
-    expect(mocks.markCodexProjectTrusted).toHaveBeenCalledWith('/workspace/app')
-  })
-
-  it('contains a rejected Codex trust write', async () => {
-    mocks.markCodexProjectTrusted.mockRejectedValueOnce(new Error('write failed'))
-
-    await expect(markLocalWorktreeTrusted('codex', '/workspace/app')).resolves.toBeUndefined()
-  })
-
-  /**
-   * Why this test exists: Orca has two trust dispatch chains — the renderer's
-   * preflightAgentTrust (via the agentTrust:markTrusted IPC) and this main-process
-   * one, which is the only path `orchestration worker-start` takes. Adding
-   * `preflightTrust: 'antigravity'` to TUI_AGENT_CONFIG clears the `!preset` guard
-   * here but matched none of the cursor/copilot/codex branches, so every supervised
-   * agy worker still failed at agent_readiness with 'agent-trust-workspace' while
-   * the renderer-side unit tests passed. Verified live: with the branch added, the
-   * worktree is appended to ~/.gemini/antigravity-cli/settings.json and the dispatch
-   * reaches worker_done.
-   */
-  it('writes the agy workspace trust artifact on the orchestration path', async () => {
-    await markLocalWorktreeTrusted('antigravity', '/workspace/app')
-
-    expect(mocks.markAntigravityWorkspaceTrusted).toHaveBeenCalledWith('/workspace/app')
-  })
-
-  it('contains a throwing agy trust write', async () => {
-    mocks.markAntigravityWorkspaceTrusted.mockImplementationOnce(() => {
-      throw new Error('write failed')
-    })
-
-    await expect(markLocalWorktreeTrusted('antigravity', '/workspace/app')).resolves.toBeUndefined()
-  })
+      expect(result?.draftPaste !== undefined).toBe(pasted)
+      expect(result?.startup.telemetry).toEqual({
+        agent_kind: tuiAgentToAgentKind(agent),
+        launch_source: expected,
+        request_kind: 'new'
+      })
+    }
+  )
 })
diff --git a/src/main/runtime/runtime-worktree-agent-startup.ts b/src/main/runtime/runtime-worktree-agent-startup.ts
index f71a81521a7..a65f2527357 100644
--- a/src/main/runtime/runtime-worktree-agent-startup.ts
+++ b/src/main/runtime/runtime-worktree-agent-startup.ts
@@ -1,31 +1,28 @@
+import { agentStartedTelemetry } from '../agent-launch/agent-started-telemetry'
 import type { AgentLaunchPreferences } from '../../shared/agent-session-host-authority'
-import { tuiAgentToAgentKind } from '../../shared/agent-kind'
 import type { Repo } from '../../shared/repo-types'
 import type { TuiAgent } from '../../shared/tui-agent'
 import type { WorktreeStartupLaunch } from '../../shared/worktree/launch-types'
-import { launchSourceSchema } from '../../shared/telemetry-property-schemas'
 import { repoIsRemote } from '../../shared/agent-launch-remote'
 import { getRepoSshConnectionId } from '../../shared/execution-host'
-import { isTuiAgent, TUI_AGENT_CONFIG } from '../../shared/tui-agent-config'
+import { isTuiAgent } from '../../shared/tui-agent-config'
 import { isTuiAgentEnabled, pickTuiAgent } from '../../shared/tui-agent-selection'
 import { resolveAgentStartupPlanInputs } from '../../shared/agent-startup-plan-inputs'
 import { buildAgentDraftLaunchPlan, buildAgentStartupPlan } from '../../shared/tui-agent-startup'
-import {
-  markAntigravityWorkspaceTrusted,
-  markCodexProjectTrusted,
-  markCopilotFolderTrusted,
-  markCursorWorkspaceTrusted
-} from '../agent-trust-presets'
 import {
   detectInstalledAgentsWithShellPathHydration,
   detectRemoteAgents
 } from '../preflight/agent-detection'
-import { markRemoteAgentWorkspaceTrusted } from '../remote-agent-trust-presets'
 import type { RuntimeStore } from './runtime-store-contract'
 
 export type WorktreeStartupDraftPaste = { agent: TuiAgent; content: string }
 export type WorktreeStartupFollowup = { expectedProcess: string; prompt: string }
 
+/** A fresh agent the host builds always carries its `agent_started` record; dropping it fails to compile. */
+type AttributedWorktreeStartupLaunch = WorktreeStartupLaunch & {
+  telemetry: NonNullable<WorktreeStartupLaunch['telemetry']>
+}
+
 type StartupEnvironment = {
   repo: Repo
   settings: ReturnType<RuntimeStore['getSettings']>
@@ -40,7 +37,7 @@ export async function buildWorktreeStartupForDraft(
   environment: StartupEnvironment & { draft: string; requestedAgent?: TuiAgent }
 ): Promise<{
   agent: TuiAgent
-  startup: WorktreeStartupLaunch
+  startup: AttributedWorktreeStartupLaunch
   draftPaste?: WorktreeStartupDraftPaste
 } | null> {
   const content = environment.draft.trim()
@@ -83,6 +80,7 @@ export async function buildWorktreeStartupForDraft(
     isRemote: repoIsRemote(repo),
     ...(environment.agentArgs !== undefined ? { agentArgs: environment.agentArgs } : {})
   })
+  const telemetry = agentStartedTelemetry(agent, environment.launchSource)
   const draftPlan = buildAgentDraftLaunchPlan({ ...launchArgs, draft: content })
   if (draftPlan) {
     return {
@@ -93,7 +91,8 @@ export async function buildWorktreeStartupForDraft(
         ...(draftPlan.startupCommandDelivery
           ? { startupCommandDelivery: draftPlan.startupCommandDelivery }
           : {}),
-        ...(draftPlan.env ? { env: draftPlan.env } : {})
+        ...(draftPlan.env ? { env: draftPlan.env } : {}),
+        telemetry
       }
     }
   }
@@ -113,7 +112,8 @@ export async function buildWorktreeStartupForDraft(
       ...(startupPlan.startupCommandDelivery
         ? { startupCommandDelivery: startupPlan.startupCommandDelivery }
         : {}),
-      ...(startupPlan.env ? { env: startupPlan.env } : {})
+      ...(startupPlan.env ? { env: startupPlan.env } : {}),
+      telemetry
     },
     draftPaste: { agent, content }
   }
@@ -128,7 +128,11 @@ export function buildWorktreeStartupForAgent(
       preferences?: AgentLaunchPreferences
     ) => Parameters<typeof buildAgentStartupPlan>[0]['sessionOptions'] | undefined
   }
-): { agent: TuiAgent; startup: WorktreeStartupLaunch; followup?: WorktreeStartupFollowup } {
+): {
+  agent: TuiAgent
+  startup: AttributedWorktreeStartupLaunch
+  followup?: WorktreeStartupFollowup
+} {
   const { agent, repo, settings } = environment
   if (!isTuiAgentEnabled(agent, settings.disabledTuiAgents)) {
     throw new Error('Selected agent is disabled. Choose an enabled agent before creating.')
@@ -148,7 +152,6 @@ export function buildWorktreeStartupForAgent(
   if (!startupPlan) {
     throw new Error(`Could not build launch command for ${agent}.`)
   }
-  const telemetry = agentLaunchTelemetry(agent, environment.launchSource)
   return {
     agent,
     startup: {
@@ -158,7 +161,7 @@ export function buildWorktreeStartupForAgent(
         ? { startupCommandDelivery: startupPlan.startupCommandDelivery }
         : {}),
       ...(startupPlan.env ? { env: startupPlan.env } : {}),
-      ...(telemetry ? { telemetry } : {})
+      telemetry: agentStartedTelemetry(agent, environment.launchSource)
     },
     ...(startupPlan.followupPrompt
       ? {
@@ -170,57 +173,3 @@ export function buildWorktreeStartupForAgent(
       : {})
   }
 }
-
-function agentLaunchTelemetry(
-  agent: TuiAgent,
-  launchSource: string | undefined
-): WorktreeStartupLaunch['telemetry'] | undefined {
-  const parsed = launchSourceSchema.safeParse(launchSource)
-  return parsed.success
-    ? {
-        agent_kind: tuiAgentToAgentKind(agent),
-        launch_source: parsed.data,
-        request_kind: 'new'
-      }
-    : undefined
-}
-
-export async function markLocalWorktreeTrusted(
-  agent: TuiAgent,
-  workspacePath: string
-): Promise<void> {
-  const preset = TUI_AGENT_CONFIG[agent].preflightTrust
-  if (!preset) {
-    return
-  }
-  try {
-    if (preset === 'cursor') {
-      markCursorWorkspaceTrusted(workspacePath)
-    } else if (preset === 'copilot') {
-      markCopilotFolderTrusted(workspacePath)
-    } else if (preset === 'codex') {
-      // Why: the Codex write queues behind any in-flight hook grant, so the agent must not launch until it lands.
-      await markCodexProjectTrusted(workspacePath)
-    } else if (preset === 'antigravity') {
-      markAntigravityWorkspaceTrusted(workspacePath)
-    }
-  } catch {
-    // Best-effort: the user can still accept the agent trust prompt manually.
-  }
-}
-
-export async function markRemoteWorktreeTrusted(
-  agent: TuiAgent,
-  connectionId: string,
-  workspacePath: string
-): Promise<void> {
-  const preset = TUI_AGENT_CONFIG[agent].preflightTrust
-  if (!preset) {
-    return
-  }
-  try {
-    await markRemoteAgentWorkspaceTrusted({ preset, connectionId, workspacePath })
-  } catch {
-    // Best-effort: the user can still accept the remote agent trust prompt manually.
-  }
-}
diff --git a/src/main/runtime/runtime-worktree-pty-agent-sources.ts b/src/main/runtime/runtime-worktree-pty-agent-sources.ts
index 058d378df11..e03f458134f 100644
--- a/src/main/runtime/runtime-worktree-pty-agent-sources.ts
+++ b/src/main/runtime/runtime-worktree-pty-agent-sources.ts
@@ -4,6 +4,7 @@ import {
   type ParsedAgentStatusPayload
 } from '../../shared/agent-status-types'
 import { parseLegacyNumericPaneKey, parsePaneKey } from '../../shared/stable-pane-id'
+import { agentVerdictFields } from '../../shared/agent-main-agent-verdict'
 import { isWslHookRelayConnectionId } from '../../shared/wsl-hook-relay-contract'
 import type { RuntimeWorktreeAgentSource } from './runtime-worktree-agent-source'
 
@@ -47,7 +48,8 @@ export function collectRuntimeWorktreePtyAgentSources(args: {
       lastAssistantMessage: entry.lastAssistantMessage ?? null,
       toolName: entry.toolName ?? null,
       toolInput: entry.toolInput ?? null,
-      interrupted: entry.interrupted ?? false,
+      interrupted: false,
+      ...agentVerdictFields(entry),
       stateStartedAt: entry.stateStartedAt,
       // A replay advances delivery order, not the age of the evidence shown by worktree.ps.
       updatedAt: entry.evidenceObservedAt ?? entry.receivedAt,
diff --git a/src/main/runtime/runtime-worktree-startup-readiness.test.ts b/src/main/runtime/runtime-worktree-startup-readiness.test.ts
new file mode 100644
index 00000000000..e96a072f7ed
--- /dev/null
+++ b/src/main/runtime/runtime-worktree-startup-readiness.test.ts
@@ -0,0 +1,71 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  waitForWorktreeStartupDraft,
+  type WorktreeStartupReadinessHost
+} from './runtime-worktree-startup-readiness'
+
+describe('fresh worker composer readiness', () => {
+  afterEach(() => vi.useRealTimers())
+
+  function fixture(replay?: string) {
+    let listener = (_data: string): void => {}
+    const unsubscribe = vi.fn()
+    const host: WorktreeStartupReadinessHost = {
+      getPtyId: () => 'pty-1',
+      getForegroundProcess: async () => 'zcode',
+      subscribeToData: (_ptyId, onData) => {
+        listener = onData
+        return unsubscribe
+      },
+      readRecentOutput: () => replay,
+      write: vi.fn()
+    }
+    return { host, emit: (data: string) => listener(data), unsubscribe }
+  }
+
+  it('accepts the captured composer while the banner continues repainting', async () => {
+    vi.useFakeTimers()
+    const h = fixture()
+    const pending = waitForWorktreeStartupDraft(h.host, 'term-1', 'zcode', {
+      timeoutMs: 45_000,
+      requireComposerMarker: true
+    })
+    const data = readFileSync(join(__dirname, '__fixtures__', 'zcode-composer-ready.txt'), 'utf8')
+    for (let offset = 0; offset < data.length; offset += 4096) {
+      h.emit(data.slice(offset, offset + 4096))
+    }
+    await expect(pending).resolves.toBe('pty-1')
+    expect(h.unsubscribe).toHaveBeenCalledOnce()
+    expect(h.host.write).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('cleans up the deadline when the composer was already captured', async () => {
+    vi.useFakeTimers()
+    const h = fixture('\x1b[?1049h╭')
+    await expect(
+      waitForWorktreeStartupDraft(h.host, 'term-1', 'zcode', {
+        timeoutMs: 45_000,
+        requireComposerMarker: true
+      })
+    ).resolves.toBe('pty-1')
+    expect(h.unsubscribe).toHaveBeenCalledOnce()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('does not accept shell decoration or a square startup dialog', async () => {
+    vi.useFakeTimers()
+    const h = fixture('╭ shell\n\x1b[?1049h\x1b[?2004h┌ Sign in ┐')
+    const pending = waitForWorktreeStartupDraft(h.host, 'term-1', 'zcode', {
+      timeoutMs: 45_000,
+      requireComposerMarker: true
+    })
+    await vi.advanceTimersByTimeAsync(44_999)
+    expect(h.unsubscribe).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(1)
+    await expect(pending).resolves.toBeNull()
+    expect(h.unsubscribe).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/runtime/runtime-worktree-startup-readiness.ts b/src/main/runtime/runtime-worktree-startup-readiness.ts
index 77b4e1315db..779f16ec6a4 100644
--- a/src/main/runtime/runtime-worktree-startup-readiness.ts
+++ b/src/main/runtime/runtime-worktree-startup-readiness.ts
@@ -4,6 +4,7 @@ import { createDraftPasteReadyScanner } from '../../shared/draft-paste-ready-sca
 import { resolveDraftPasteReadyTimeoutMs } from '../../shared/draft-paste-ready-timeout'
 import { TUI_AGENT_CONFIG } from '../../shared/tui-agent-config'
 import type { TuiAgent } from '../../shared/tui-agent'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 import type {
   WorktreeStartupDraftPaste,
   WorktreeStartupFollowup
@@ -19,7 +20,7 @@ export type WorktreeStartupReadinessHost = {
   hasChildProcesses?: (ptyId: string) => Promise<boolean>
   subscribeToData: (ptyId: string, listener: (data: string) => void) => () => void
   readRecentOutput: (ptyId: string) => string | undefined
-  write: (ptyId: string, data: string) => void
+  write: (ptyId: string, data: string, inputKind: TerminalInputKind) => void
 }
 
 export function pasteWorktreeStartupDraftWhenReady(
@@ -33,7 +34,7 @@ export function pasteWorktreeStartupDraftWhenReady(
         console.warn('[worktree-create] agent did not become ready for draft paste')
         return
       }
-      host.write(ptyId, `${BRACKETED_PASTE_BEGIN}${draft.content}${BRACKETED_PASTE_END}`)
+      host.write(ptyId, `${BRACKETED_PASTE_BEGIN}${draft.content}${BRACKETED_PASTE_END}`, 'launch')
     })
     .catch((error) => console.warn('[worktree-create] failed to paste startup draft:', error))
 }
@@ -49,7 +50,7 @@ export function sendWorktreeStartupFollowupWhenReady(
         console.warn('[worktree-create] agent did not become ready for follow-up prompt')
         return
       }
-      host.write(ptyId, `${followup.prompt}\r`)
+      host.write(ptyId, `${followup.prompt}\r`, 'launch')
     })
     .catch((error) =>
       console.warn('[worktree-create] failed to send startup follow-up prompt:', error)
@@ -89,7 +90,8 @@ export async function waitForWorktreeStartupFollowup(
 export function waitForWorktreeStartupDraft(
   host: WorktreeStartupReadinessHost,
   handle: string,
-  agent: TuiAgent
+  agent: TuiAgent,
+  options: { timeoutMs?: number; requireComposerMarker?: boolean } = {}
 ): Promise<string | null> {
   const ptyId = host.getPtyId(handle)
   if (!ptyId) {
@@ -118,11 +120,14 @@ export function waitForWorktreeStartupDraft(
       resolve(value)
     }
     const observe = (data: string): void => {
+      if (settled) {
+        return
+      }
       const result = scanner.observe(data)
       if (result.ready) {
         return finish(ptyId)
       }
-      if (result.armQuietTimer) {
+      if (result.armQuietTimer && !options.requireComposerMarker) {
         if (quietTimer) {
           clearTimeout(quietTimer)
         }
@@ -130,10 +135,13 @@ export function waitForWorktreeStartupDraft(
       }
     }
     unsubscribe = host.subscribeToData(ptyId, observe)
+    hardTimer = setTimeout(
+      () => finish(null),
+      options.timeoutMs ?? resolveDraftPasteReadyTimeoutMs(agent)
+    )
     const replay = host.readRecentOutput(ptyId)
     if (replay) {
       observe(replay)
     }
-    hardTimer = setTimeout(() => finish(null), resolveDraftPasteReadyTimeoutMs(agent))
   })
 }
diff --git a/src/main/runtime/runtime-worktree-structured-agent-rows-liveness.test.ts b/src/main/runtime/runtime-worktree-structured-agent-rows-liveness.test.ts
index b1e43a9025d..5b081d1e5df 100644
--- a/src/main/runtime/runtime-worktree-structured-agent-rows-liveness.test.ts
+++ b/src/main/runtime/runtime-worktree-structured-agent-rows-liveness.test.ts
@@ -1,3 +1,4 @@
+import { AGENT_JOURNAL_THREAD_SCOPE } from '../../shared/agent-session-journal-types'
 import { makeStructuredAgentStatusSubject } from '../../shared/agent-status-subject'
 import { collectRuntimeWorktreeAgentSources } from './runtime-worktree-agent-sources'
 import { mkdtemp, rm } from 'node:fs/promises'
@@ -71,7 +72,7 @@ async function awaitingApproval() {
   await journal.appendItem(
     { ...IDENTITY, ordinal: 1 },
     { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'rm the branch' }] },
-    { fence: 1 }
+    { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
   await journal.appendItem(
     { ...IDENTITY, ordinal: 2 },
@@ -82,14 +83,14 @@ async function awaitingApproval() {
       options: [{ id: 'allow', label: 'Allow' }],
       resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
     },
-    { fence: 1 }
+    { fence: 1, turnScope: AGENT_JOURNAL_THREAD_SCOPE }
   )
   const sessions = new Map([
     [
       SESSION,
       {
         journal,
-        hasProviderChild: true,
+        child: { phase: 'ready' as const, generation: 'child-1', fence: 1 },
         params: {
           location: {
             executionHostId: 'local' as const,
diff --git a/src/main/runtime/startup-dialog-blocked-signals.ts b/src/main/runtime/startup-dialog-blocked-signals.ts
new file mode 100644
index 00000000000..e964205a9cc
--- /dev/null
+++ b/src/main/runtime/startup-dialog-blocked-signals.ts
@@ -0,0 +1,76 @@
+import type { RuntimeTerminalWaitBlockedReason } from '../../shared/runtime-types'
+
+// Why rows, from each dialog's first `·` on: codex-terminal-readiness.ts takes a `·` after the
+// startup header for the live chat's footer, so each dialog must be matched by the time that `·`
+// lands. Why not headings: Codex 0.157+ paints them by cell diff over its startup screen, so the
+// text copy can lose letters and spaces (`updat available`); these rows are fixed literals.
+// Update: `Update available · 0.157.1 → 0.158.0`, then `enter continue · esc skip`.
+const CODEX_UPDATE_ROW_RE = /available\s*·\s*\d+\.\d+|enter\s*continue\s*·\s*esc\s*skip/g
+// Why not `esc back`: Codex's mid-session pickers end `enter confirm · esc back`.
+const CODEX_HOOKS_REVIEW_KEY_ROW_RE = /enter\s*confirm\s*·(?!\s*esc\s*back)/g
+// Why both verbs: the retired-model notice says `continue`, the new-model announcement `confirm`.
+const CODEX_MODEL_MIGRATION_KEY_ROW_RE = /enter\/esc\s*(?:continue|confirm)\s*·/g
+
+function lastMatchIndex(text: string, row: RegExp): number {
+  let index = -1
+  for (const match of text.matchAll(row)) {
+    index = match.index
+  }
+  return index
+}
+
+// Why the last match, and the legacy wording too: an answered dialog stays in the text copy, and
+// builds before 0.157 wrote `Press enter to continue/confirm`.
+function findDialogIndex(
+  normalized: string,
+  legacyHeading: string,
+  legacyKeys: string,
+  row: RegExp
+): number {
+  const rowIndex = lastMatchIndex(normalized, row)
+  const headingIndex = normalized.lastIndexOf(legacyHeading)
+  const legacyIndex =
+    headingIndex !== -1 && normalized.includes(legacyKeys, headingIndex) ? headingIndex : -1
+  return Math.max(rowIndex, legacyIndex)
+}
+
+// Why together: each startup dialog owns Enter before the chat exists, so a brief typed into one
+// answers it (Codex's update dialog defaults to `Update now`).
+export function findStartupDialogBlockedSignals(
+  normalized: string
+): { reason: RuntimeTerminalWaitBlockedReason; index: number }[] {
+  const candidates: { reason: RuntimeTerminalWaitBlockedReason; index: number }[] = []
+  const updateIndex = findDialogIndex(
+    normalized,
+    'update available',
+    'press enter to continue',
+    CODEX_UPDATE_ROW_RE
+  )
+  if (updateIndex !== -1) {
+    candidates.push({ reason: 'agent-update-prompt', index: updateIndex })
+  }
+  const cwdIndex = normalized.lastIndexOf('choose working directory to')
+  if (cwdIndex !== -1 && normalized.includes('press enter to continue', cwdIndex)) {
+    candidates.push({ reason: 'agent-cwd-prompt', index: cwdIndex })
+  }
+  const modelMigrationIndex = findDialogIndex(
+    normalized,
+    'codex just got an upgrade',
+    'press enter to continue',
+    CODEX_MODEL_MIGRATION_KEY_ROW_RE
+  )
+  if (modelMigrationIndex !== -1) {
+    candidates.push({ reason: 'codex-model-migration-prompt', index: modelMigrationIndex })
+  }
+  const hooksIndex = findDialogIndex(
+    normalized,
+    'hooks need review',
+    'press enter to confirm',
+    CODEX_HOOKS_REVIEW_KEY_ROW_RE
+  )
+  if (hooksIndex !== -1) {
+    // Why neutral: this matcher never inspects the agent -- 'hooks need review' is not Codex-only wording.
+    candidates.push({ reason: 'agent-hooks-review-prompt', index: hooksIndex })
+  }
+  return candidates
+}
diff --git a/src/main/runtime/structured-agent-account-home.ts b/src/main/runtime/structured-agent-account-home.ts
index 6190ad3bd00..060fbea5b1f 100644
--- a/src/main/runtime/structured-agent-account-home.ts
+++ b/src/main/runtime/structured-agent-account-home.ts
@@ -38,23 +38,15 @@ export type StructuredCodexAccountHomeDeps = {
    * null → system-home mapping below, so the two paths cannot drift.
    */
   resolveLaunchHome:
-    | ((input: {
-        workspacePath: string
-        launchEnv: NodeJS.ProcessEnv
-      }) => string | null | Promise<string | null>)
+    | ((input: { launchEnv: NodeJS.ProcessEnv }) => string | null | Promise<string | null>)
     | null
-  /** Empty for a record-less read; only launch preparation consumes it. */
-  workspacePath: string
 }
 
 export async function resolveStructuredCodexAccountHomePath(
   deps: StructuredCodexAccountHomeDeps
 ): Promise<string> {
   // A create has no process yet, so the current selection is what it must follow.
-  const resolvedHome = await deps.resolveLaunchHome?.({
-    workspacePath: deps.workspacePath,
-    launchEnv: deps.launchEnv
-  })
+  const resolvedHome = await deps.resolveLaunchHome?.({ launchEnv: deps.launchEnv })
   const configuredHome = deps.launchEnv.CODEX_HOME
   return (
     resolvedHome?.trim() ||
diff --git a/src/main/runtime/structured-agent-session-close.test.ts b/src/main/runtime/structured-agent-session-close.test.ts
index 531ca0aa129..948bb01cce2 100644
--- a/src/main/runtime/structured-agent-session-close.test.ts
+++ b/src/main/runtime/structured-agent-session-close.test.ts
@@ -19,6 +19,7 @@ vi.mock('../native-chat/agent-session-wire/structured-agent-session-registry', (
 const { closeStructuredAgentSessionChild } = await import('./structured-agent-session-close')
 
 const SESSION = 'session-1'
+const TAB_ID = 'tab-of-session-1'
 
 function record(sessionId: string): AgentSessionRecord {
   return {
@@ -85,14 +86,18 @@ function installHost(options: HostOptions = {}) {
     }
   })
   hostRef.current = {
-    deps: { store: { getRecord: (id: string) => (id === SESSION ? entry : null) } },
-    hasSession: (sessionId: string) => held.has(sessionId),
-    getPersistedVisibleSessionTabIndex: () => {
-      if (options.indexThrows) {
-        throw new Error('visible tab index unreadable')
+    deps: {
+      store: {
+        getRecord: (id: string) => (id === SESSION ? entry : null),
+        getSessionTabId: (id: string) => {
+          if (options.indexThrows) {
+            throw new Error('visible tab index unreadable')
+          }
+          return visible.has(id) ? TAB_ID : null
+        }
       }
-      return { present: true, sessionIds: [...visible] }
     },
+    hasSession: (sessionId: string) => held.has(sessionId),
     setSessionTabVisibility,
     close
   }
@@ -133,7 +138,7 @@ describe('closeStructuredAgentSessionChild tab-visibility rollback', () => {
     expect(host.visible.has(SESSION)).toBe(true)
     expect(host.setSessionTabVisibility.mock.calls).toEqual([
       [SESSION, false],
-      [SESSION, true]
+      [SESSION, true, TAB_ID]
     ])
   })
 
@@ -147,7 +152,7 @@ describe('closeStructuredAgentSessionChild tab-visibility rollback', () => {
     expect(host.visible.has(SESSION)).toBe(true)
     expect(host.setSessionTabVisibility.mock.calls).toEqual([
       [SESSION, false],
-      [SESSION, true]
+      [SESSION, true, TAB_ID]
     ])
   })
 
diff --git a/src/main/runtime/structured-agent-session-close.ts b/src/main/runtime/structured-agent-session-close.ts
index f65d1204db9..668b7f21890 100644
--- a/src/main/runtime/structured-agent-session-close.ts
+++ b/src/main/runtime/structured-agent-session-close.ts
@@ -3,8 +3,8 @@
  *
  * Extracted from `stopStructuredWorker` so that orchestration settlement and worktree teardown
  * close a session the SAME way rather than one of them inventing a shorter version. Everything
- * dispatch-shaped — dropping the hold, the redrive subscription and the parked mail — stays with
- * the caller that has a dispatch; this is only the child.
+ * dispatch-shaped — dropping the redrive subscription, the registry entry and the parked mail —
+ * stays with the caller that has a dispatch; this is only the child.
  *
  * `host.close` returns void and keeps a failed close indexed for retry, so the only settlement
  * evidence is the observation AFTER it: a session the host no longer holds and whose lease is no
@@ -15,7 +15,10 @@ import type { StructuredAgentSessionHost } from '../native-chat/agent-session-wi
 import { getStructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-registry'
 import type { OrcaRuntimeService } from './orca-runtime'
 import { retireSettledStructuredWorkerTab } from './structured-agent-session-tab-retirement'
-import { observeStructuredWorker } from './structured-worker-authority'
+import {
+  observeStructuredWorker,
+  structuredSessionCloseSettled
+} from './structured-worker-authority'
 
 export type StructuredAgentSessionCloseOutcome = {
   stopped: boolean
@@ -32,8 +35,8 @@ export type StructuredAgentSessionCloseOptions = {
   /**
    * Runs after the close is issued and BEFORE the proof is read.
    *
-   * Not after: an unsettled close returns early, so a dispatch that released its hold there would
-   * keep the child un-evictable for the life of the app. Every settlement has to reach it.
+   * Not after: an unsettled close returns early, so a dispatch released there would keep its
+   * redrive subscription nudging a session no dispatch owns. Every settlement has to reach it.
    */
   afterClose?: () => void
   /**
@@ -60,11 +63,11 @@ export async function closeStructuredAgentSessionChild(
       reason: 'The structured agent-session host is not installed; no session was closed.'
     }
   }
-  // Read BEFORE the hide, so a rollback puts the tab back exactly as it was. Restoring
-  // unconditionally would publish a tab for a session that was already hidden — a worker started
-  // without a chat tab, or one the user had closed — which is a new side effect, not an undo.
+  // Read BEFORE the hide, so a rollback puts the tab back exactly as it was, under the same id.
+  // Restoring unconditionally would publish a tab for a session that was already hidden — a worker
+  // started without a chat tab, or one the user had closed — which is a new side effect, not an undo.
   const restoreTabIfCloseFails =
-    options.restoreTabOnUnprovenClose !== false && readPersistedTabVisibility(host, sessionId)
+    options.restoreTabOnUnprovenClose !== false ? readPersistedTabId(host, sessionId) : null
   // Set only once the close is actually issued: `setSessionTabVisibility` throwing first leaves a
   // running child, and a receipt that still said `closed_agent_terminal` for it would be the
   // close-that-never-happened this flag exists to rule out.
@@ -86,8 +89,8 @@ export async function closeStructuredAgentSessionChild(
     }
   }
   options.afterClose?.()
-  const observation = observeStructuredWorker({ sessionId })
-  if (observation.status !== 'exited') {
+  if (!structuredSessionCloseSettled(sessionId)) {
+    const observation = observeStructuredWorker({ sessionId })
     await restorePersistedTabVisibility(host, sessionId, restoreTabIfCloseFails)
     return {
       stopped: false,
@@ -101,13 +104,13 @@ export async function closeStructuredAgentSessionChild(
   return { stopped: true, closeAttempted: true }
 }
 
-function readPersistedTabVisibility(host: StructuredAgentSessionHost, sessionId: string): boolean {
+function readPersistedTabId(host: StructuredAgentSessionHost, sessionId: string): string | null {
   try {
-    return host.getPersistedVisibleSessionTabIndex?.().sessionIds.includes(sessionId) ?? false
+    return host.deps.store.getSessionTabId(sessionId)
   } catch {
     // Unreadable index: claim nothing. A rollback that cannot prove the tab was visible must not
     // publish one, for the same reason the read exists at all.
-    return false
+    return null
   }
 }
 
@@ -135,13 +138,13 @@ function readPersistedTabVisibility(host: StructuredAgentSessionHost, sessionId:
 async function restorePersistedTabVisibility(
   host: StructuredAgentSessionHost,
   sessionId: string,
-  restoreTab: boolean
+  tabId: string | null
 ): Promise<void> {
-  if (!restoreTab || observeStructuredWorker({ sessionId }).status === 'exited') {
+  if (tabId === null || structuredSessionCloseSettled(sessionId)) {
     return
   }
   try {
-    await host.setSessionTabVisibility?.(sessionId, true)
+    await host.setSessionTabVisibility?.(sessionId, true, tabId)
   } catch (error) {
     console.warn(
       `[structured-session-close] could not restore the chat tab for ${sessionId} after a failed close`,
diff --git a/src/main/runtime/structured-agent-session-codex-compact-exit.test.ts b/src/main/runtime/structured-agent-session-codex-compact-exit.test.ts
new file mode 100644
index 00000000000..ee3876301df
--- /dev/null
+++ b/src/main/runtime/structured-agent-session-codex-compact-exit.test.ts
@@ -0,0 +1,154 @@
+// A Codex child that exits, or that Stop ends, while `/compact` runs, observed the way the shipping
+// adapter observes it: the app-server connection's own exit, not a hand-fed compaction result.
+
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { readAgentJournalTurn } from '../../shared/agent-session-turn-record'
+import { DESKTOP_RENDERER_RUNTIME_CLIENT_CAPABILITIES } from '../ipc/desktop-renderer-runtime-capabilities'
+import { structuredAgentSessionCommandTurn } from '../native-chat/agent-session-wire/structured-agent-session-command-turn'
+import { ensureStructuredAgentSessionHost } from './structured-agent-session-runtime'
+import {
+  openStructuredCodexRpcHarness,
+  SESSION,
+  type FakeCodexConnection,
+  type StructuredCodexRpcHarness
+} from './structured-codex-session-rpc-test-harness'
+
+let harness: StructuredCodexRpcHarness
+
+beforeEach(async () => {
+  // The desktop's own client: a send answers at acceptance, so one queued behind the command
+  // returns while the command still runs.
+  harness = await openStructuredCodexRpcHarness(DESKTOP_RENDERER_RUNTIME_CLIENT_CAPABILITIES)
+})
+
+afterEach(async () => {
+  await harness.dispose()
+})
+
+async function snapshot() {
+  return (await ensureStructuredAgentSessionHost(harness.hostConfig())).journalSnapshot(SESSION)
+}
+
+/** The connections that received `method`, once per call. */
+function calls(method: string): FakeCodexConnection[] {
+  return harness.codex.connections.flatMap((connection) =>
+    connection.calls.filter((entry) => entry.method === method).map(() => connection)
+  )
+}
+
+/** The child serving the thread; a model-list probe opens connections of its own. */
+function threadChild(): FakeCodexConnection {
+  const child = harness.codex.connections.findLast((connection) =>
+    connection.calls.some(
+      (entry) => entry.method === 'thread/start' || entry.method === 'thread/resume'
+    )
+  )
+  if (!child) {
+    throw new Error('no codex child opened the thread')
+  }
+  return child
+}
+
+async function startCompact(fence: number): Promise<string> {
+  const params = {
+    command: 'compact',
+    envelope: harness.envelope('agentSession.conversationCommand', { command: 'compact' }, fence)
+  }
+  await harness.ok('agentSession.conversationCommand', params)
+  return params.envelope.clientOperationId
+}
+
+async function send(text: string): Promise<void> {
+  const body = { kind: 'message' as const, role: 'user' as const, blocks: [{ type: 'text', text }] }
+  await harness.ok('agentSession.send', {
+    envelope: harness.envelope('agentSession.send', { body }, null),
+    body
+  })
+}
+
+function exitChild(): FakeCodexConnection {
+  const child = threadChild()
+  child.handlers.onExit?.(new Error('codex app-server exited'))
+  return child
+}
+
+it('delivers what waited behind the command once its child dies mid-command, with one exit row', async () => {
+  const created = await harness.ok<{ fence: number }>(
+    'agentSession.create',
+    harness.createIntentParams()
+  )
+  const command = await startCompact(created.fence)
+  await vi.waitFor(() => expect(calls('thread/compact/start')).toHaveLength(1))
+  await send('after the exit')
+
+  const dead = exitChild()
+
+  await vi.waitFor(() => expect(calls('turn/start')).toHaveLength(1))
+  expect(calls('turn/start')[0]).not.toBe(dead)
+  const settled = await snapshot()
+  const turn = settled.items.find(
+    (item) => item.itemId === structuredAgentSessionCommandTurn(command).itemId
+  )
+  expect(readAgentJournalTurn(turn?.body)?.state).toBe('interrupted')
+  expect(
+    settled.items.filter((item) => item.body.kind === 'status' && item.body.tone === 'error')
+  ).toHaveLength(1)
+})
+
+it('runs a later command after Stop named the one whose child died', async () => {
+  const created = await harness.ok<{ fence: number }>(
+    'agentSession.create',
+    harness.createIntentParams()
+  )
+  const command = await startCompact(created.fence)
+  await vi.waitFor(() => expect(calls('thread/compact/start')).toHaveLength(1))
+
+  const dead = exitChild()
+  await vi.waitFor(async () => {
+    const turn = (await snapshot()).items.find(
+      (item) => item.itemId === structuredAgentSessionCommandTurn(command).itemId
+    )
+    expect(readAgentJournalTurn(turn?.body)?.state).toBe('interrupted')
+  })
+  const { turnId } = structuredAgentSessionCommandTurn(command)
+  await harness.ok('agentSession.cancel', {
+    envelope: harness.envelope('agentSession.cancel', { turnId }, null),
+    turnId
+  })
+
+  // Nothing the dead command left behind holds the queue or refuses the next one.
+  const later = await startCompact(created.fence)
+  await vi.waitFor(() => expect(calls('thread/compact/start')).toHaveLength(2))
+  expect(calls('thread/compact/start')[1]).not.toBe(dead)
+  const turn = (await snapshot()).items.find(
+    (item) => item.itemId === structuredAgentSessionCommandTurn(later).itemId
+  )
+  expect(readAgentJournalTurn(turn?.body)?.state).toBe('running')
+})
+
+it('ends a command Codex has not opened a turn for by stopping its child, and the next send gets a fresh one', async () => {
+  const created = await harness.ok<{ fence: number }>(
+    'agentSession.create',
+    harness.createIntentParams()
+  )
+  const command = await startCompact(created.fence)
+  await vi.waitFor(() => expect(calls('thread/compact/start')).toHaveLength(1))
+  const first = threadChild()
+  const { itemId, turnId } = structuredAgentSessionCommandTurn(command)
+
+  // No `turn/started` yet, so there is no provider turn to interrupt.
+  await expect(
+    harness.ok('agentSession.cancel', {
+      envelope: harness.envelope('agentSession.cancel', { turnId }, null),
+      turnId
+    })
+  ).resolves.toMatchObject({ cancelled: true })
+
+  expect(first.closed).toBe(true)
+  expect(first.calls.some((entry) => entry.method === 'turn/interrupt')).toBe(false)
+  const turn = (await snapshot()).items.find((item) => item.itemId === itemId)
+  expect(readAgentJournalTurn(turn?.body)?.state).toBe('interrupted')
+  await send('after the stop')
+  await vi.waitFor(() => expect(calls('turn/start')).toHaveLength(1))
+  expect(calls('turn/start')[0]).not.toBe(first)
+})
diff --git a/src/main/runtime/structured-agent-session-codex-turn-end-settlement.test.ts b/src/main/runtime/structured-agent-session-codex-turn-end-settlement.test.ts
new file mode 100644
index 00000000000..c86f7c85242
--- /dev/null
+++ b/src/main/runtime/structured-agent-session-codex-turn-end-settlement.test.ts
@@ -0,0 +1,324 @@
+// A Codex send the turn it went into never took: the Stop that interrupts that turn
+// withdraws it, and nothing reads as working after. A Stop sent before Codex opens that
+// turn waits for it to open, since Codex refuses an interrupt until then. Driven through the shipped host,
+// journal and Codex adapter; only the Codex child is fake, keeping Codex 0.157's
+// turn bookkeeping.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type {
+  CodexAppServerConnection,
+  CodexAppServerConnectionHandlers,
+  openCodexAppServerConnection
+} from '../codex/codex-app-server-connection'
+import { codexTurnLifecycleFake } from '../codex/codex-turn-lifecycle-fake'
+import { settledWithin } from '../codex/codex-structured-dispatch-test-support'
+import { CODEX_STOP_TURN_OPEN_WAIT_MS } from '../codex/codex-structured-prompt-ownership'
+import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-session-mutation-envelope'
+import type { AgentJournalSubmission } from '../../shared/agent-session-journal-types'
+import { classifyDispatchRejection } from '../../shared/structured-agent-session-dispatch-rejection'
+import { owesStructuredAgentSessionWork } from '../../shared/structured-agent-session-owed-work'
+import {
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestMessage
+} from '../native-chat/agent-session-wire/structured-agent-session-host-test-data'
+import type { StructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-host'
+import { CHILD_EVICTION_TIMEOUT_MS } from '../native-chat/agent-session-wire/structured-agent-session-host-teardown'
+import {
+  ensureStructuredAgentSessionHost,
+  stopStructuredAgentSessionRuntime
+} from './structured-agent-session-runtime'
+
+// A Stop must never reach for real processes on this machine under a made-up pid.
+vi.mock('../codex/codex-structured-turn-processes', () => ({
+  captureCodexTurnProcesses: async () => null,
+  terminateCodexTurnProcesses: async () => true
+}))
+
+const CALLER = { callerKey: 'codex-turn-end-test' }
+const MODEL = {
+  model: 'gpt-test',
+  displayName: 'GPT Test',
+  hidden: false,
+  supportedReasoningEfforts: [],
+  defaultReasoningEffort: null,
+  isDefault: true
+}
+
+let root: string
+let host: StructuredAgentSessionHost
+let fence: number
+let handlers: CodexAppServerConnectionHandlers | undefined
+let answers: number
+let interrupts: number
+let childCloses: number
+let turns: ReturnType<typeof codexTurnLifecycleFake>
+let operations = 0
+
+/** The durable ledger stamps its own clock and refuses an id far from it. */
+const operationId = (): string => `${Date.now()}-${(++operations).toString(16).padStart(32, '0')}`
+
+function envelope(method: string, fields: Record<string, unknown>) {
+  return {
+    sessionId: SESSION,
+    clientOperationId: operationId(),
+    expectedRuntimeFence: fence,
+    payloadFingerprint: computeAgentSessionPayloadFingerprint({
+      method,
+      sessionId: SESSION,
+      fields
+    })
+  }
+}
+
+async function send(text: string): Promise<string> {
+  const body = hostTestMessage(text)
+  const sent = await host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
+  if (!sent.ok) {
+    throw new Error(JSON.stringify(sent.refusal))
+  }
+  return sent.value.clientMessageId
+}
+
+async function stop(turnId?: string): Promise<void> {
+  const stopped = await host.cancel(CALLER, {
+    envelope: envelope('agentSession.cancel', turnId === undefined ? {} : { turnId }),
+    ...(turnId === undefined ? {} : { turnId })
+  })
+  if (!stopped.ok) {
+    throw new Error(JSON.stringify(stopped.refusal))
+  }
+}
+
+async function settled(): Promise<{
+  submissions: readonly AgentJournalSubmission[]
+  owesWork: boolean
+}> {
+  await host.flushStreamedEvents(SESSION)
+  const snapshot = await host.journalSnapshot(SESSION)
+  return {
+    submissions: snapshot.submissions,
+    // The shared rule every surface reads "working" from.
+    owesWork: owesStructuredAgentSessionWork(snapshot.items, snapshot.submissions, fence)
+  }
+}
+
+function verdictOf(submissions: readonly AgentJournalSubmission[], clientMessageId: string) {
+  const submission = submissions.find((entry) => entry.clientMessageId === clientMessageId)
+  return submission?.dispatchState === 'rejected'
+    ? classifyDispatchRejection(submission).category
+    : submission?.dispatchState
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-codex-turn-end-'))
+  answers = 0
+  interrupts = 0
+  childCloses = 0
+  turns = codexTurnLifecycleFake(
+    THREAD,
+    () => (method, params) => handlers?.onNotification?.(method, params)
+  )
+  const openConnection: typeof openCodexAppServerConnection = async (
+    _launch,
+    connectionHandlers = {}
+  ) => {
+    handlers = connectionHandlers
+    const connection: CodexAppServerConnection = {
+      pid: 4321,
+      closed: false,
+      request: async (method, params) => {
+        if (method === 'thread/start' || method === 'thread/resume') {
+          return { thread: { id: THREAD } }
+        }
+        if (method === 'model/list') {
+          return { data: [MODEL], nextCursor: null }
+        }
+        if (method === 'turn/start') {
+          answers += 1
+          return turns.routes['turn/start']()
+        }
+        if (method === 'turn/interrupt') {
+          interrupts += 1
+          return turns.routes['turn/interrupt'](params)
+        }
+        return {}
+      },
+      notify: () => {},
+      respond: () => {},
+      respondWithError: () => {},
+      close: async () => {
+        childCloses += 1
+        return true
+      }
+    }
+    return connection
+  }
+  host = await ensureStructuredAgentSessionHost({
+    stateDirectory: root,
+    hostId: 'local',
+    claimKeyId: 'key-1',
+    resolveWorkspacePath: async () => root,
+    resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true }),
+    resolveCodexCommand: () => 'codex',
+    resolveEnvironment: async () => ({ PATH: process.env.PATH }),
+    openCodexConnection: openConnection,
+    readProcessStartTime: async () => 1_700_000_000_000
+  })
+  const attachParams = hostTestAttachParams(null, { providerHandle: undefined })
+  attachParams.envelope.clientOperationId = operationId()
+  const attached = await host.attach(CALLER, attachParams)
+  if (!attached.ok) {
+    throw new Error(JSON.stringify(attached.refusal))
+  }
+  fence = attached.value.fence
+})
+
+afterEach(async () => {
+  await stopStructuredAgentSessionRuntime()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('a Codex send its turn ended without taking it', () => {
+  it('is withdrawn by a Stop before any echo, and nothing reads as working after', async () => {
+    const sent = await send('look around')
+    await vi.waitFor(() => expect(answers).toBe(1))
+    turns.start()
+
+    await stop('turn-1')
+
+    await vi.waitFor(async () =>
+      expect(verdictOf((await settled()).submissions, sent)).not.toBe('pending')
+    )
+    const after = await settled()
+    expect(verdictOf(after.submissions, sent)).toBe('withdrawn')
+    expect(after.owesWork).toBe(false)
+
+    // Codex echoing it late changes nothing: a settled answer stands.
+    await host.settleLateDispatch({
+      sessionId: SESSION,
+      clientMessageId: sent,
+      providerIdentity: { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 0 }
+    })
+    expect(verdictOf((await settled()).submissions, sent)).toBe('withdrawn')
+  })
+
+  it('withdraws a follow-up Codex steered into the turn a Stop ends, with no working latch', async () => {
+    const opening = await send('look around')
+    await vi.waitFor(() => expect(answers).toBe(1))
+    turns.start()
+    turns.echo(opening)
+    const followUp = await send('and check the tests')
+    // Steered: Codex answers with the running turn, and fires no second turn/started.
+    await vi.waitFor(() => expect(answers).toBe(2))
+
+    await stop('turn-1')
+
+    await vi.waitFor(async () =>
+      expect(verdictOf((await settled()).submissions, followUp)).not.toBe('pending')
+    )
+    const after = await settled()
+    expect(verdictOf(after.submissions, opening)).toBe('accepted')
+    expect(verdictOf(after.submissions, followUp)).toBe('withdrawn')
+    expect(after.owesWork).toBe(false)
+  })
+})
+
+describe('a Stop sent after Codex answered a cold send, before it opened the turn', () => {
+  it('waits for the turn to open, then stops it and withdraws the send', async () => {
+    const sent = await send('look around')
+    await vi.waitFor(() => expect(answers).toBe(1))
+
+    const stopping = stop()
+    // Without the wait, it would reach Codex now, which would refuse it, and be done.
+    expect(await settledWithin(stopping, 1_000)).toBe('held')
+    expect(interrupts).toBe(0)
+    turns.start()
+    await stopping
+
+    expect(interrupts).toBe(1)
+    expect(turns.turnId).toBeNull()
+    await vi.waitFor(async () =>
+      expect(verdictOf((await settled()).submissions, sent)).toBe('withdrawn')
+    )
+    expect((await settled()).owesWork).toBe(false)
+  })
+})
+
+describe('a Stop in that window that the turn never opens for', () => {
+  async function statusRows(): Promise<string[]> {
+    return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+      item.body.kind === 'status' ? [item.body.text] : []
+    )
+  }
+
+  async function waitingStop(): Promise<{ stopping: Promise<void> }> {
+    await send('look around')
+    await vi.waitFor(() => expect(answers).toBe(1))
+    const stopping = stop()
+    expect(await settledWithin(stopping, 200)).toBe('held')
+    return { stopping }
+  }
+
+  it('says Codex had no turn running when that turn ends first', async () => {
+    const { stopping } = await waitingStop()
+
+    turns.end('interrupted')
+    await stopping
+
+    expect(interrupts).toBe(0)
+    expect(await statusRows()).toContain('Codex had no turn running to stop.')
+  })
+
+  it('lets a chat closed behind it close within its bound and one eviction', async () => {
+    const { stopping } = await waitingStop()
+
+    const closing = host.close(SESSION)
+
+    expect(
+      await settledWithin(closing, CODEX_STOP_TURN_OPEN_WAIT_MS + CHILD_EVICTION_TIMEOUT_MS)
+    ).not.toBe('held')
+    expect(await settledWithin(stopping, 0)).not.toBe('held')
+    expect(childCloses).toBe(1)
+    expect(interrupts).toBe(0)
+    expect(await statusRows()).toContain('Codex had no turn running to stop.')
+  })
+
+  it('lets the app quit behind it within the eviction budget, and still close the child', async () => {
+    await waitingStop()
+
+    expect(
+      await settledWithin(stopStructuredAgentSessionRuntime(), CHILD_EVICTION_TIMEOUT_MS)
+    ).not.toBe('held')
+    expect(childCloses).toBe(1)
+  })
+})
+
+describe('a cold send with no Stop behind it', () => {
+  /** Well inside one eviction step's budget, and far inside the bound a Stop waits. */
+  const PROMPTLY_MS = 1_000
+
+  async function answeredColdSend(): Promise<void> {
+    await send('look around')
+    await vi.waitFor(() => expect(answers).toBe(1))
+    expect(turns.turnId).toBe('turn-1')
+  }
+
+  it('never delays closing the chat', async () => {
+    await answeredColdSend()
+
+    expect(await settledWithin(host.close(SESSION), PROMPTLY_MS)).not.toBe('held')
+    expect(childCloses).toBe(1)
+  })
+
+  it('never delays quitting the app', async () => {
+    await answeredColdSend()
+
+    expect(await settledWithin(stopStructuredAgentSessionRuntime(), PROMPTLY_MS)).not.toBe('held')
+    expect(childCloses).toBe(1)
+  })
+})
diff --git a/src/main/runtime/structured-agent-session-integration-replay.test.ts b/src/main/runtime/structured-agent-session-integration-replay.test.ts
index 4fa390be0fb..29dbdf59302 100644
--- a/src/main/runtime/structured-agent-session-integration-replay.test.ts
+++ b/src/main/runtime/structured-agent-session-integration-replay.test.ts
@@ -6,234 +6,27 @@
 // that ship. The fake app-server answers the same JSON-RPC calls the real one
 // does and pushes the same notifications and blocking requests back.
 
-import { mkdtemp, rm } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type {
-  CodexAppServerConnection,
-  CodexAppServerConnectionHandlers,
-  openCodexAppServerConnection
-} from '../codex/codex-app-server-connection'
 import type { CodexStructuredSessionAdapter } from '../codex/codex-structured-session-adapter'
-import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-session-mutation-envelope'
-import {
-  AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY,
-  STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
-} from '../../shared/protocol-version'
 import type { AgentJournalRenderItem } from '../../shared/agent-session-journal-types'
-import { attachFingerprintFields } from '../native-chat/agent-session-wire/structured-agent-session-attach'
 import { journalDirectoryFor } from '../native-chat/agent-session-journal/journal-paths'
 import { createTrackedJournalOpener } from '../native-chat/agent-session-journal/journal-store-test-open'
-import type { OrcaRuntimeService } from './orca-runtime'
-import type { RpcRequest, RpcResponse } from './rpc/core'
-import { RpcDispatcher } from './rpc/dispatcher'
-import { STRUCTURED_AGENT_SESSION_METHODS } from './rpc/methods/structured-agent-session'
 import {
   ensureStructuredAgentSessionHost,
   stopStructuredAgentSessionRuntime
 } from './structured-agent-session-runtime'
+import {
+  openStructuredCodexRpcHarness,
+  SESSION,
+  THREAD,
+  TURN,
+  type StructuredCodexRpcHarness
+} from './structured-codex-session-rpc-test-harness'
 
 const journals = createTrackedJournalOpener()
-
-const SESSION = 'session-integration-1'
-const THREAD = 'thread-integration'
-const TURN = 'turn-1'
 const WORKSPACE = 'workspace-1'
-// The capability set the desktop renderer advertises. Without the pending-send
-// one the host holds the reply until the send settles, which is a shim for
-// clients too old to render a pending bubble — not what this suite models.
-const CLIENT = {
-  clientId: 'device-a',
-  clientKind: 'runtime' as const,
-  clientCapabilities: [
-    AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY,
-    STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
-  ]
-}
 
-// ─── the fake `codex app-server` ────────────────────────────────────────────
-
-type CodexScript = {
-  connections: FakeConnection[]
-  openConnection: typeof openCodexAppServerConnection
-  live: () => FakeConnection
-  notify: (method: string, params: unknown) => void
-  ask: (id: number, method: string, params: unknown) => void
-}
-
-// `closed` is readonly on the real connection; the fake flips it so the test can
-// see the takeover reap the previous child.
-type FakeConnection = Omit<CodexAppServerConnection, 'closed'> & {
-  closed: boolean
-  handlers: CodexAppServerConnectionHandlers
-  calls: { method: string; params?: Record<string, unknown> }[]
-  replies: { id: number | string; result?: unknown; code?: number }[]
-  resumedThreadId: string | null
-  launch: Parameters<typeof openCodexAppServerConnection>[0]
-}
-
-function fakeCodex(): CodexScript {
-  const connections: FakeConnection[] = []
-  const openConnection = (async (launch, handlers = {}) => {
-    const connection: FakeConnection = {
-      launch,
-      handlers,
-      calls: [],
-      replies: [],
-      resumedThreadId: null,
-      pid: 4321,
-      closed: false,
-      request: async (method, params) => {
-        connection.calls.push({ method, params })
-        if (method === 'thread/start') {
-          return { thread: { id: THREAD, path: '/rollouts/integration.jsonl' } }
-        }
-        if (method === 'thread/resume') {
-          connection.resumedThreadId = (params as { threadId: string }).threadId
-          return { thread: { id: connection.resumedThreadId } }
-        }
-        if (method === 'turn/start') {
-          return { turn: { id: TURN } }
-        }
-        if (method === 'model/list') {
-          return {
-            data: [
-              {
-                model: 'gpt-live',
-                displayName: 'GPT Live',
-                hidden: false,
-                supportedReasoningEfforts: [
-                  { reasoningEffort: 'medium', description: 'Balanced' },
-                  { reasoningEffort: 'high', description: 'Deep reasoning' }
-                ],
-                defaultReasoningEffort: 'medium',
-                isDefault: true
-              }
-            ],
-            nextCursor: null
-          }
-        }
-        return {}
-      },
-      notify: () => {},
-      respond: (id, result) => connection.replies.push({ id, result }),
-      respondWithError: (id, code) => connection.replies.push({ id, code }),
-      close: async () => {
-        connection.closed = true
-        return true
-      }
-    }
-    connections.push(connection)
-    return connection
-  }) as typeof openCodexAppServerConnection
-  const live = (): FakeConnection => {
-    const connection = connections.at(-1)
-    if (!connection) {
-      throw new Error('no codex app-server has been opened')
-    }
-    return connection
-  }
-  return {
-    connections,
-    openConnection,
-    live,
-    notify: (method, params) => live().handlers.onNotification?.(method, params),
-    ask: (id, method, params) => live().handlers.onServerRequest?.({ id, method, params })
-  }
-}
-
-// ─── the RPC client ─────────────────────────────────────────────────────────
-
-let operations = 0
-
-/** `<13-digit ms>-<32 hex>`, the only shape the durable ledger accepts. Real
- *  time, not a frozen constant: the runtime under test stamps the ledger with
- *  its own clock and refuses a future-dated id. */
-function operationId(): string {
-  operations += 1
-  return `${Date.now()}-${operations.toString(16).padStart(32, '0')}`
-}
-
-function envelope(method: string, fields: Record<string, unknown>, fence: number | null) {
-  return {
-    sessionId: SESSION,
-    clientOperationId: operationId(),
-    expectedRuntimeFence: fence,
-    payloadFingerprint: computeAgentSessionPayloadFingerprint({
-      method,
-      sessionId: SESSION,
-      fields
-    })
-  }
-}
-
-function attachParams(fence: number | null) {
-  const params = {
-    location: {
-      executionHostId: 'local',
-      wslDistro: null,
-      workspaceId: WORKSPACE,
-      workspaceKind: 'git-worktree' as const
-    },
-    provider: 'codex' as const,
-    agent: 'codex',
-    accountHome: { variable: 'CODEX_HOME' as const, path: '/home/dev/.codex' },
-    runtimeKind: 'native' as const,
-    providerHandle: { kind: 'codex' as const, threadId: THREAD }
-  }
-  const envelope = {
-    sessionId: SESSION,
-    clientOperationId: operationId(),
-    expectedRuntimeFence: fence,
-    payloadFingerprint: ''
-  }
-  return {
-    ...params,
-    envelope: {
-      ...envelope,
-      payloadFingerprint: computeAgentSessionPayloadFingerprint({
-        method: 'agentSession.attach',
-        sessionId: SESSION,
-        fields: attachFingerprintFields({ ...params, envelope } as never)
-      })
-    }
-  }
-}
-
-function createIntentParams() {
-  const worktree = `id:${WORKSPACE}`
-  const fields = { worktree, agent: 'codex' }
-  return { envelope: envelope('agentSession.create', fields, null), ...fields }
-}
-
-let codex: CodexScript
-let root: string
-let dispatcher: RpcDispatcher
-let bootEnvironmentReads: number
-let codexOverrideReads: number
-let configuredCodexProfile: string
-
-/** Runs a one-shot method and returns its decoded reply. */
-async function call(method: string, params: unknown): Promise<RpcResponse> {
-  const replies: RpcResponse[] = []
-  const request: RpcRequest = { id: `req-${operations}`, authToken: 'token', method, params }
-  await dispatcher.dispatchStreaming(request, (raw) => replies.push(JSON.parse(raw)), CLIENT)
-  const first = replies[0]
-  if (!first) {
-    throw new Error(`no reply for ${method}`)
-  }
-  return first
-}
-
-/** Asserts success and unwraps the host's `{ok:true, value}` mutation result. */
-async function ok<T>(method: string, params: unknown): Promise<T> {
-  const response = await call(method, params)
-  expect(response, `${method} failed: ${JSON.stringify(response)}`).toMatchObject({ ok: true })
-  const result = (response as { result: { ok: boolean; value?: T; refusal?: unknown } }).result
-  expect(result, `${method} refused: ${JSON.stringify(result.refusal)}`).toMatchObject({ ok: true })
-  return result.value as T
-}
+let harness: StructuredCodexRpcHarness
 
 function textOf(item: AgentJournalRenderItem): string {
   const body = item.body
@@ -243,69 +36,20 @@ function textOf(item: AgentJournalRenderItem): string {
 }
 
 beforeEach(async () => {
-  operations = 0
-  root = await mkdtemp(join(tmpdir(), 'orca-structured-integration-'))
-  codex = fakeCodex()
-  bootEnvironmentReads = 0
-  codexOverrideReads = 0
-  configuredCodexProfile = 'configured'
-  const runtime = {
-    getRuntimeId: () => 'runtime-1',
-    getClientSettings: () => ({ experimentalStructuredNativeChat: true }),
-    getStructuredAgentSessionCreateSupport: async () => ({ supported: true }),
-    resolveStructuredAgentSessionCreateIntent: async () => {
-      const {
-        envelope: _envelope,
-        providerHandle: _providerHandle,
-        ...resolved
-      } = attachParams(null)
-      return resolved
-    },
-    publishStructuredAgentSessionTab: () => {},
-    ensureStructuredAgentSessionHost: () =>
-      ensureStructuredAgentSessionHost({
-        stateDirectory: root,
-        hostId: 'local',
-        claimKeyId: 'key-1',
-        resolveWorkspacePath: async (workspaceId) => `/repos/${workspaceId}`,
-        resolveCodexCommand: () => '/usr/local/bin/codex',
-        resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true }),
-        resolveEnvironment: async () => {
-          bootEnvironmentReads += 1
-          return {
-            PATH: '/shell/bin:/usr/bin',
-            EXAMPLE_GATEWAY_TOKEN: 'shell-exported',
-            CODEX_HOME: '/shell/home'
-          }
-        },
-        resolveCodexOverrides: () => {
-          codexOverrideReads += 1
-          return { CODEX_PROFILE: configuredCodexProfile }
-        },
-        openCodexConnection: codex.openConnection,
-        readProcessStartTime: async () => 1_700_000_000_000
-      }).then(() => undefined),
-    registerOwnedSubscriptionCleanup: vi.fn((_id: string, dispose: () => void) => {
-      return {
-        releaseIfCurrent: dispose
-      }
-    })
-  }
-  dispatcher = new RpcDispatcher({
-    runtime: runtime as unknown as OrcaRuntimeService,
-    methods: STRUCTURED_AGENT_SESSION_METHODS
-  })
+  harness = await openStructuredCodexRpcHarness()
 })
 
 afterEach(async () => {
   await journals.closeAll()
-  await stopStructuredAgentSessionRuntime()
-  await rm(root, { recursive: true, force: true })
+  await harness.dispose()
 })
 
 describe('a structured codex session over agentSession.*', () => {
   it('replays a durable image send without dispatching it twice', async () => {
-    const created = await ok<{ fence: number }>('agentSession.create', createIntentParams())
+    const created = await harness.ok<{ fence: number }>(
+      'agentSession.create',
+      harness.createIntentParams()
+    )
     const path = '/tmp/orca-paste-image.png'
     const body = {
       kind: 'message' as const,
@@ -313,28 +57,23 @@ describe('a structured codex session over agentSession.*', () => {
       blocks: [{ type: 'image-ref' as const, path }]
     }
     const params = {
-      envelope: envelope('agentSession.send', { body }, created.fence),
+      envelope: harness.envelope('agentSession.send', { body }, created.fence),
       body
     }
 
-    await ok('agentSession.send', params)
-    const replay = await call('agentSession.send', params)
+    const turnStarts = () =>
+      harness.codex.live().calls.filter((entry) => entry.method === 'turn/start')
+    await harness.ok('agentSession.send', params)
+    // Accepted first; the delivery loop hands it over once.
+    await vi.waitFor(() => expect(turnStarts()).toHaveLength(1))
+    const replay = await harness.call('agentSession.send', params)
 
     expect(replay).toMatchObject({ ok: true, result: { ok: true, replayed: true } })
-    expect(codex.live().calls.filter((entry) => entry.method === 'turn/start')).toHaveLength(1)
+    expect(turnStarts()).toHaveLength(1)
   })
 
   it('joins an acquired attach through journal bind before draining final rows', async () => {
-    const host = await ensureStructuredAgentSessionHost({
-      stateDirectory: root,
-      hostId: 'local',
-      claimKeyId: 'key-1',
-      resolveWorkspacePath: async (workspaceId) => `/repos/${workspaceId}`,
-      resolveCodexCommand: () => '/usr/local/bin/codex',
-      resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true }),
-      openCodexConnection: codex.openConnection,
-      readProcessStartTime: async () => 1_700_000_000_000
-    })
+    const host = await ensureStructuredAgentSessionHost(harness.hostConfig())
     const adapter = (host as unknown as { deps: { adapter: CodexStructuredSessionAdapter } }).deps
       .adapter
     const historyEntered = Promise.withResolvers<void>()
@@ -346,15 +85,18 @@ describe('a structured codex session over agentSession.*', () => {
       return originalHistoryFilePath(input)
     })
 
-    const creating = ok<{ fence: number }>('agentSession.create', createIntentParams())
+    const creating = harness.ok<{ fence: number }>(
+      'agentSession.create',
+      harness.createIntentParams()
+    )
     await historyEntered.promise
-    codex.notify('turn/started', { threadId: THREAD, turn: { id: TURN } })
-    codex.notify('item/started', {
+    harness.codex.notify('turn/started', { threadId: THREAD, turn: { id: TURN } })
+    harness.codex.notify('item/started', {
       threadId: THREAD,
       turnId: TURN,
       item: { type: 'agentMessage', id: 'item-bind-window', text: '' }
     })
-    codex.notify('item/agentMessage/delta', {
+    harness.codex.notify('item/agentMessage/delta', {
       threadId: THREAD,
       turnId: TURN,
       itemId: 'item-bind-window',
@@ -381,7 +123,7 @@ describe('a structured codex session over agentSession.*', () => {
     }
     const reopened = await journals.open({
       identity,
-      journalDir: journalDirectoryFor(root, identity)
+      journalDir: journalDirectoryFor(harness.root, identity)
     })
     expect(reopened.snapshot().items.map(textOf)).toContain('Buffered while the journal opens.')
     expect(
diff --git a/src/main/runtime/structured-agent-session-integration.test.ts b/src/main/runtime/structured-agent-session-integration.test.ts
index 3f8adae4906..1b7136a996d 100644
--- a/src/main/runtime/structured-agent-session-integration.test.ts
+++ b/src/main/runtime/structured-agent-session-integration.test.ts
@@ -218,6 +218,11 @@ function createIntentParams() {
 }
 
 let codex: CodexScript
+/** Accepted first; the delivery loop hands the send over as `turn/start` after the reply. */
+const handedOverAs = (params: Record<string, unknown>) =>
+  vi.waitFor(() =>
+    expect(codex.live().calls.at(-1)).toMatchObject({ method: 'turn/start', params })
+  )
 let root: string
 let dispatcher: RpcDispatcher
 let bootEnvironmentReads: number
@@ -284,10 +289,10 @@ function textOf(item: AgentJournalRenderItem): string {
 }
 
 /** The durable submission row, which settlement rewrites after the send returns. */
-function submissionOf(clientMessageId: string): AgentJournalSubmission | undefined {
-  return getStructuredAgentSessionHost()
-    ?.journalSnapshot(SESSION)
-    .submissions.find((entry) => entry.clientMessageId === clientMessageId)
+async function submissionOf(clientMessageId: string): Promise<AgentJournalSubmission | undefined> {
+  return (await getStructuredAgentSessionHost()?.journalSnapshot(SESSION))?.submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )
 }
 
 async function historyPage(
@@ -466,10 +471,7 @@ describe('a structured codex session over agentSession.*', () => {
     // send coalesced into a running turn is answered with that turn's id, so
     // which message landed where is knowable only from the echo.
     expect(sent.submission).toMatchObject({ dispatchState: 'pending', providerItemId: null })
-    expect(codex.live().calls.at(-1)).toMatchObject({
-      method: 'turn/start',
-      params: { threadId: THREAD, clientUserMessageId: sent.clientMessageId }
-    })
+    await handedOverAs({ threadId: THREAD, clientUserMessageId: sent.clientMessageId })
 
     codex.notify('turn/started', { turn: { id: TURN } })
     // Codex echoes the message back carrying the `clientId` it was sent under,
@@ -493,8 +495,8 @@ describe('a structured codex session over agentSession.*', () => {
     // The echo is the first item of this turn, so the settled key is ordinal 0 —
     // minted by the same `identityFor` a history replay computes with, rather
     // than guessed from the turn/start response.
-    await vi.waitFor(() =>
-      expect(submissionOf(sent.clientMessageId)).toMatchObject({
+    await vi.waitFor(async () =>
+      expect(await submissionOf(sent.clientMessageId)).toMatchObject({
         dispatchState: 'accepted',
         providerItemId: `codex:${THREAD}:${TURN}:0`
       })
@@ -557,14 +559,11 @@ describe('a structured codex session over agentSession.*', () => {
     // "delivery unconfirmed" — it carries no identity yet, because the response
     // to a coalesced send names the running turn rather than this message.
     expect(sent.submission).toMatchObject({ dispatchState: 'pending', providerItemId: null })
-    expect(codex.live().calls.at(-1)).toMatchObject({
-      method: 'turn/start',
-      params: {
-        threadId: THREAD,
-        clientUserMessageId: sent.clientMessageId,
-        model: 'gpt-live',
-        effort: 'high'
-      }
+    await handedOverAs({
+      threadId: THREAD,
+      clientUserMessageId: sent.clientMessageId,
+      model: 'gpt-live',
+      effort: 'high'
     })
 
     // ── stream ──────────────────────────────────────────────────────────────
@@ -585,8 +584,8 @@ describe('a structured codex session over agentSession.*', () => {
     expect(itemsOf(stream).filter((item) => textOf(item) === 'list files')).toHaveLength(1)
     // Settled from the echo's own journal identity, so it is by construction the
     // key a replay recomputes for this row.
-    await vi.waitFor(() =>
-      expect(submissionOf(sent.clientMessageId)).toMatchObject({
+    await vi.waitFor(async () =>
+      expect(await submissionOf(sent.clientMessageId)).toMatchObject({
         dispatchState: 'accepted',
         providerItemId: `codex:${THREAD}:${TURN}:0`
       })
diff --git a/src/main/runtime/structured-agent-session-legacy-send-behind-command.test.ts b/src/main/runtime/structured-agent-session-legacy-send-behind-command.test.ts
new file mode 100644
index 00000000000..fb820891ba5
--- /dev/null
+++ b/src/main/runtime/structured-agent-session-legacy-send-behind-command.test.ts
@@ -0,0 +1,106 @@
+// A client that predates accepted-send replies (every phone build) has its send reply held until
+// handover. A message queued behind `/compact` is handed over only when the compaction ends, so
+// that reply answers once the message waits behind the running command instead.
+
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import type { AgentJournalSubmission } from '../../shared/agent-session-journal-types'
+import { ensureStructuredAgentSessionHost } from './structured-agent-session-runtime'
+import {
+  openStructuredCodexRpcHarness,
+  SESSION,
+  THREAD,
+  type FakeCodexConnection,
+  type StructuredCodexRpcHarness
+} from './structured-codex-session-rpc-test-harness'
+
+const COMPACTION_TURN = 'compaction-turn'
+// Far under the phone's 15 s send timeout, and far over a handover that is already due.
+const PROMPT_REPLY_MS = 2_000
+
+let harness: StructuredCodexRpcHarness
+
+beforeEach(async () => {
+  // The harness's default client is the phone's: pending replies, but not accepted-send.
+  harness = await openStructuredCodexRpcHarness()
+})
+
+afterEach(async () => {
+  await harness.dispose()
+})
+
+function calls(method: string): FakeCodexConnection[] {
+  return harness.codex.connections.flatMap((connection) =>
+    connection.calls.filter((entry) => entry.method === method).map(() => connection)
+  )
+}
+
+function send(text: string): Promise<{ submission: AgentJournalSubmission }> {
+  const body = { kind: 'message' as const, role: 'user' as const, blocks: [{ type: 'text', text }] }
+  return harness.ok('agentSession.send', {
+    envelope: harness.envelope('agentSession.send', { body }, null),
+    body
+  })
+}
+
+function promptly<T>(reply: Promise<T>): Promise<T> {
+  return Promise.race([
+    reply,
+    new Promise<never>((_, reject) =>
+      setTimeout(() => reject(new Error('the send reply waited out the command')), PROMPT_REPLY_MS)
+    )
+  ])
+}
+
+it('answers a send queued behind /compact at once, and delivers it once after the compaction', async () => {
+  const created = await harness.ok<{ fence: number }>(
+    'agentSession.create',
+    harness.createIntentParams()
+  )
+  await harness.ok('agentSession.conversationCommand', {
+    command: 'compact',
+    envelope: harness.envelope(
+      'agentSession.conversationCommand',
+      { command: 'compact' },
+      created.fence
+    )
+  })
+  await vi.waitFor(() => expect(calls('thread/compact/start')).toHaveLength(1))
+
+  const { submission } = await promptly(send('after the compaction'))
+
+  expect(submission).toMatchObject({ dispatchState: 'pending' })
+  expect(submission.handedOverAt).toBeUndefined()
+  expect(calls('turn/start')).toHaveLength(0)
+
+  harness.codex.notify('turn/started', { threadId: THREAD, turn: { id: COMPACTION_TURN } })
+  harness.codex.notify('item/completed', {
+    threadId: THREAD,
+    turnId: COMPACTION_TURN,
+    item: { type: 'contextCompaction', id: 'compaction' }
+  })
+  harness.codex.notify('turn/completed', {
+    threadId: THREAD,
+    turn: { id: COMPACTION_TURN, status: 'completed' }
+  })
+
+  await vi.waitFor(() => expect(calls('turn/start')).toHaveLength(1))
+  const journal = await (
+    await ensureStructuredAgentSessionHost(harness.hostConfig())
+  ).journalSnapshot(SESSION)
+  expect(
+    journal.submissions.filter((entry) => entry.clientMessageId === submission.clientMessageId)
+  ).toEqual([expect.objectContaining({ handedOverAt: expect.any(Number) })])
+  // Nothing re-sent it: the host delivered the one message once.
+  await new Promise((resolve) => setTimeout(resolve, 50))
+  expect(calls('turn/start')).toHaveLength(1)
+})
+
+it('still holds the reply of a send that no command is holding until it is handed over', async () => {
+  await harness.ok('agentSession.create', harness.createIntentParams())
+
+  // The first send starts the child; the reply waits out that start and the handover.
+  const { submission } = await promptly(send('first message'))
+
+  expect(submission.handedOverAt).toEqual(expect.any(Number))
+  await vi.waitFor(() => expect(calls('turn/start')).toHaveLength(1))
+})
diff --git a/src/main/runtime/structured-agent-session-owner-probe.ts b/src/main/runtime/structured-agent-session-owner-probe.ts
index 47f92a08ca6..d42959bcd28 100644
--- a/src/main/runtime/structured-agent-session-owner-probe.ts
+++ b/src/main/runtime/structured-agent-session-owner-probe.ts
@@ -10,8 +10,7 @@ import { readEchoedAgentSessionSpawnToken } from './agent-session-spawn-token-re
 
 /**
  * The lease's only source of truth about a previous owner. Everything it cannot
- * answer PID-reuse-safely reports `indeterminate`. An exact owner stays fenced in `recovering`;
- * an ownerless, unattributable reservation enters `manual-recovery`.
+ * answer PID-reuse-safely reports `indeterminate`, and recovery resolution concludes from there.
  */
 export function createStructuredAgentSessionOwnerProbe(
   hostId: string,
@@ -21,9 +20,6 @@ export function createStructuredAgentSessionOwnerProbe(
   return async (record) => {
     const owner = record.lease.ownerProcess
     if (!owner) {
-      if (record.lease.processlessAt !== undefined && record.lease.processlessAt !== null) {
-        return { outcome: 'reservation-unused' }
-      }
       const spawnToken = record.lease.reservedSpawnToken
       if (spawnToken === null) {
         if (record.lease.claimStatus === 'reserved') {
diff --git a/src/main/runtime/structured-agent-session-runtime-exit.test.ts b/src/main/runtime/structured-agent-session-runtime-exit.test.ts
index 7a3736b9009..3da0c6f203d 100644
--- a/src/main/runtime/structured-agent-session-runtime-exit.test.ts
+++ b/src/main/runtime/structured-agent-session-runtime-exit.test.ts
@@ -32,7 +32,7 @@ describe('structured session runtime provider-exit wiring', () => {
     }
   })
 
-  it('reacquires through the production callback and accepts a distinct next message', async () => {
+  it('does not respawn after a provider exit, and the next message starts a new child', async () => {
     root = await mkdtemp(join(tmpdir(), 'orca-runtime-provider-exit-'))
     operations = 0
     const connections: {
@@ -98,16 +98,17 @@ describe('structured session runtime provider-exit wiring', () => {
         JSON.stringify({ refusal: attached.refusal, connections: connections.length })
       )
     }
-    await host.hold(SESSION, 'desktop-chat:1')
-    const exitedFence = host.deps.store.getRecord(SESSION)?.lease.runtimeFence ?? 0
     const exited = connections[0]
     exited?.handlers.onExit?.(new Error('scripted provider exit'))
-
-    await vi.waitFor(() => expect(connections).toHaveLength(2))
+    await vi.waitFor(() =>
+      expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
+    )
+    // Nothing restarts the child on its own; the exit is shown and the chat waits for a send.
+    await new Promise<void>((resolve) => setTimeout(resolve, 50))
+    expect(connections).toHaveLength(1)
     const recoveredFence = host.deps.store.getRecord(SESSION)?.lease.runtimeFence
-    expect(recoveredFence).toBeGreaterThan(exitedFence)
     if (recoveredFence === undefined) {
-      throw new Error('recovered lease omitted its fence')
+      throw new Error('released lease omitted its fence')
     }
     const body = hostTestMessage('continue with a distinct message')
     const envelope = {
@@ -128,7 +129,9 @@ describe('structured session runtime provider-exit wiring', () => {
     await expect(
       host.send({ callerKey: 'runtime-test' }, { envelope, body })
     ).resolves.toMatchObject({ ok: true, value: { submission: { dispatchState: 'pending' } } })
-    expect(turn).toBe(1)
+    // The send answers at acceptance; the delivery loop starts a new child and hands it over.
+    await vi.waitFor(() => expect(connections).toHaveLength(2))
+    await vi.waitFor(() => expect(turn).toBe(1))
   })
 
   it('does not reacquire when the production exit callback comes from a requested close', async () => {
@@ -199,7 +202,6 @@ describe('structured session runtime provider-exit wiring', () => {
         JSON.stringify({ refusal: attached.refusal, connections: connections.length })
       )
     }
-    await host.hold(SESSION, 'desktop-chat:requested-close')
 
     await stopStructuredAgentSessionRuntime()
     await new Promise<void>((resolve) => setImmediate(resolve))
@@ -223,7 +225,7 @@ describe('structured session runtime provider-exit wiring', () => {
       readProcessStartTime: async () => 1_700_000_000_000
     })
     await restarted.restoreReadableSessions()
-    const history = restarted.history({ sessionId: SESSION, direction: 'tail' })
+    const history = await restarted.history({ sessionId: SESSION, direction: 'tail' })
     expect(history.ok && history.page.items.some((item) => item.body.kind === 'status')).toBe(false)
     expect(restarted.deps.store.getRecord(SESSION)?.providerHandleChain.at(-1)?.handle).toEqual({
       provider: 'codex',
@@ -231,7 +233,7 @@ describe('structured session runtime provider-exit wiring', () => {
     })
   })
 
-  it('waits for an in-flight recovery before tearing down the runtime', async () => {
+  it('waits for a start a send began before tearing down the runtime', async () => {
     root = await mkdtemp(join(tmpdir(), 'orca-runtime-recovery-shutdown-'))
     let releaseRecovery!: () => void
     const recoveryReleased = new Promise<void>((resolve) => {
@@ -300,8 +302,28 @@ describe('structured session runtime provider-exit wiring', () => {
     attachParams.envelope.clientOperationId = operationId()
     const attached = await host.attach({ callerKey: 'runtime-test' }, attachParams)
     expect(attached.ok).toBe(true)
-    await host.hold(SESSION, 'desktop-chat:shutdown-race')
-    connections[0]?.handlers.onExit?.(new Error('recovery is still opening'))
+    connections[0]?.handlers.onExit?.(new Error('the first child exited'))
+    await vi.waitFor(() =>
+      expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
+    )
+    const body = hostTestMessage('start again')
+    await host.send(
+      { callerKey: 'runtime-test' },
+      {
+        envelope: {
+          sessionId: SESSION,
+          clientOperationId: operationId(),
+          expectedRuntimeFence: host.deps.store.getRecord(SESSION)?.lease.runtimeFence ?? 0,
+          payloadFingerprint: computeAgentSessionPayloadFingerprint({
+            method: 'agentSession.send',
+            sessionId: SESSION,
+            fields: { body }
+          })
+        },
+        body
+      }
+    )
+    // The send's start is still opening its connection when the quit begins.
     await vi.waitFor(() => expect(opens).toBe(2))
 
     let stopped = false
@@ -387,7 +409,6 @@ describe('structured session runtime provider-exit wiring', () => {
     expect(await host.attach({ callerKey: 'runtime-test' }, attachParams)).toMatchObject({
       ok: true
     })
-    await host.hold(SESSION, 'desktop-chat:backstop')
 
     await expect(stopStructuredAgentSessionRuntime()).rejects.toThrow()
     await new Promise<void>((resolve) => setImmediate(resolve))
@@ -396,7 +417,7 @@ describe('structured session runtime provider-exit wiring', () => {
     expect(closeAttempts).toBeGreaterThanOrEqual(2)
     // The callback it delivered neither reacquired nor wrote a technical row.
     expect(connections).toHaveLength(1)
-    const history = host.history({ sessionId: SESSION, direction: 'tail' })
+    const history = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(history.ok && history.page.items.some((item) => item.body.kind === 'status')).toBe(false)
 
     // The aborted eviction left the session reachable, so the next teardown is a real retry.
diff --git a/src/main/runtime/structured-agent-session-runtime-provider-started.test.ts b/src/main/runtime/structured-agent-session-runtime-provider-started.test.ts
index 602507ef4d7..91bf91738b5 100644
--- a/src/main/runtime/structured-agent-session-runtime-provider-started.test.ts
+++ b/src/main/runtime/structured-agent-session-runtime-provider-started.test.ts
@@ -1,5 +1,5 @@
-// A Claude child proving its start must not wait on another session's exit recovery, and must
-// not make that recovery, or the session's own serialized operations, wait on the CLI: the host
+// A Claude child proving its start must not wait on another session's start, and must not make
+// that start, or the session's own serialized operations, wait on the CLI: the host
 // records what the child proved from what the adapter already holds.
 
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -18,7 +18,7 @@ afterEach(async () => {
 })
 
 describe('a Claude child proving its start', () => {
-  it("never holds another session's exit recovery, or its own close, on a CLI read", async () => {
+  it("never holds another session's start, or its own close, on a CLI read", async () => {
     claude.behave(STALLED, { stallsControlReads: true })
     const host = await claude.install()
 
@@ -56,23 +56,15 @@ describe('a Claude child proving its start', () => {
     await vi.waitFor(() => expect(closed).toBe(true))
   })
 
-  it("flips to ready while another session's exit recovery is still acquiring", async () => {
+  it("flips to ready while another session's start is still acquiring", async () => {
     const host = await claude.install()
-    await expect(host.attach(CALLER, claude.attachParams(HEALTHY, null))).resolves.toMatchObject({
-      ok: true
-    })
-    await host.hold(HEALTHY, 'surface-1')
-    await waitForStructuredAgentSessionRecovery()
-
-    // Its exit recovery reacquires, and that spawn never returns. The exit hands the lease back
-    // and the restart queued behind it reserves it again at once, so `released` is not a state a
-    // poll can count on seeing; `reserved` with the spawn hanging is what "still acquiring" is.
+    // This start never returns from its spawn, so its lease stays reserved with no child.
     claude.behave(HEALTHY, { spawnHangs: true })
-    claude.child(HEALTHY).exit(new Error('claude stream-json exited (code 1): crashed'))
+    void host.attach(CALLER, claude.attachParams(HEALTHY, null)).catch(() => undefined)
     await vi.waitFor(() =>
       expect(host.deps.store.getRecord(HEALTHY)?.lease.claimStatus).toBe('reserved')
     )
-    expect(claude.children(HEALTHY)).toHaveLength(1)
+    const childrenWhileHung = claude.children(HEALTHY).length
 
     await expect(host.attach(CALLER, claude.attachParams(STALLED, null))).resolves.toMatchObject({
       ok: true
@@ -83,9 +75,9 @@ describe('a Claude child proving its start', () => {
         effort: 'high'
       })
     )
-    // The other recovery is still where it was: reserved, with no child yet.
+    // The other start is still where it was: reserved, with no new child.
     expect(host.deps.store.getRecord(HEALTHY)?.lease.claimStatus).toBe('reserved')
-    expect(claude.children(HEALTHY)).toHaveLength(1)
+    expect(claude.children(HEALTHY)).toHaveLength(childrenWhileHung)
   })
 
   it('is drained by the runtime before teardown proceeds', async () => {
diff --git a/src/main/runtime/structured-agent-session-runtime.test.ts b/src/main/runtime/structured-agent-session-runtime.test.ts
index 6b612c73d46..9f4f4e2474d 100644
--- a/src/main/runtime/structured-agent-session-runtime.test.ts
+++ b/src/main/runtime/structured-agent-session-runtime.test.ts
@@ -191,17 +191,6 @@ describe('structured agent-session owner probe', () => {
 
     expect(result.outcome).toBe('indeterminate')
   })
-
-  it('releases only a reservation carrying durable pre-spawn proof', async () => {
-    const probe = deadProbe()
-    const result = await createStructuredAgentSessionOwnerProbe(
-      HOST_ID,
-      probe
-    )(record(null, { processlessAt: 1_800_000_000_000, claimStatus: 'reserved' }))
-
-    expect(probe).not.toHaveBeenCalled()
-    expect(result).toEqual({ outcome: 'reservation-unused' })
-  })
 })
 
 describe('structured agent-session runtime install', () => {
@@ -216,36 +205,6 @@ describe('structured agent-session runtime install', () => {
     vi.restoreAllMocks()
   })
 
-  it('starts orphan reaping and reports failures without failing installation', async () => {
-    stateDirectory = await mkdtemp(join(tmpdir(), 'orca-structured-runtime-'))
-    const failure = new Error('scan failed')
-    const reapOrphanChildren = vi.fn(async () => {
-      throw failure
-    })
-    const onError = vi.fn()
-
-    await expect(
-      ensureStructuredAgentSessionHost({
-        stateDirectory,
-        hostId: HOST_ID,
-        claimKeyId: 'key-1',
-        resolveWorkspacePath: async () => stateDirectory!,
-        resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true }),
-        resolveEnvironment: async () => ({}),
-        reapOrphanChildren,
-        onError
-      })
-    ).resolves.toBeDefined()
-
-    await vi.waitFor(() =>
-      expect(onError).toHaveBeenCalledWith({
-        scope: 'agent-session-orphan-child-reaper',
-        error: failure
-      })
-    )
-    expect(reapOrphanChildren).toHaveBeenCalledWith({ store: expect.anything() })
-  })
-
   it('holds stop until the model catalog has written its coalesced save', async () => {
     stateDirectory = await mkdtemp(join(tmpdir(), 'orca-structured-runtime-'))
     await ensureStructuredAgentSessionHost({
@@ -254,8 +213,7 @@ describe('structured agent-session runtime install', () => {
       claimKeyId: 'key-1',
       resolveWorkspacePath: async () => stateDirectory!,
       resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true }),
-      resolveEnvironment: async () => ({}),
-      reapOrphanChildren: async () => []
+      resolveEnvironment: async () => ({})
     })
     let finishWrite = (): void => {}
     vi.spyOn(agentModelCatalogStore, 'flushPersistence').mockReturnValue(
@@ -276,33 +234,6 @@ describe('structured agent-session runtime install', () => {
     expect(stopped).toBe(true)
   })
 
-  it('logs an orphan-reaper failure when no reporter is configured', async () => {
-    stateDirectory = await mkdtemp(join(tmpdir(), 'orca-structured-runtime-'))
-    const failure = new Error('scan failed')
-    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {})
-
-    await expect(
-      ensureStructuredAgentSessionHost({
-        stateDirectory,
-        hostId: HOST_ID,
-        claimKeyId: 'key-1',
-        resolveWorkspacePath: async () => stateDirectory!,
-        resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true }),
-        resolveEnvironment: async () => ({}),
-        reapOrphanChildren: async () => {
-          throw failure
-        }
-      })
-    ).resolves.toBeDefined()
-
-    await vi.waitFor(() =>
-      expect(consoleError).toHaveBeenCalledWith(
-        '[structured-agent-session] orphan reaper failed',
-        failure
-      )
-    )
-  })
-
   it('does not infer Windows process identity support from an injected reader', async () => {
     stateDirectory = await mkdtemp(join(tmpdir(), 'orca-structured-runtime-'))
     const originalPlatform = process.platform
@@ -366,7 +297,6 @@ describe('a teardown that fails is retried by the next stop', () => {
       claimKeyId: 'key-1',
       resolveWorkspacePath: async () => directory!,
       resolveEnvironment: async () => ({}),
-      reapOrphanChildren: async () => [],
       resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true })
     })
 
diff --git a/src/main/runtime/structured-agent-session-runtime.ts b/src/main/runtime/structured-agent-session-runtime.ts
index a51da3f1c3c..10db8ba3bda 100644
--- a/src/main/runtime/structured-agent-session-runtime.ts
+++ b/src/main/runtime/structured-agent-session-runtime.ts
@@ -38,7 +38,6 @@ import {
 } from '../native-chat/claude-structured-managed-account-support'
 import { AgentSessionRecordStore } from './agent-session-record-store'
 import { agentSessionStorePath } from './agent-session-record-store-file'
-import { stopOrphanAgentSessionChildren } from './agent-session-orphan-child-reaper'
 import {
   createStructuredAgentSessionOwnerProbe,
   createStructuredAgentSessionOwnerProbes
@@ -104,7 +103,8 @@ export type StructuredAgentSessionRuntimeDeps = {
   onSessionStatusChanged?: StructuredAgentSessionHostDeps['onSessionStatusChanged']
   /** The agent-status store; see `StructuredAgentSessionHostDeps.statusSink`. */
   statusSink?: StructuredAgentSessionHostDeps['statusSink']
-  reapOrphanChildren?: typeof stopOrphanAgentSessionChildren
+  /** See `StructuredAgentSessionHostDeps.hasOpenDispatch`. */
+  hasOpenDispatch?: StructuredAgentSessionHostDeps['hasOpenDispatch']
   /** The account home a structured launch would pin right now, for catalog
    *  reads with no session record. Absent disables the catalog surface. */
   resolveAgentAccountHome?: RuntimeAgentAccountHomeResolver
@@ -197,21 +197,6 @@ async function install(deps: StructuredAgentSessionRuntimeDeps): Promise<Install
     directory: join(deps.stateDirectory, RECORD_STORE_DIR_NAME),
     hostId: deps.hostId
   })
-  // Why: only the durable store can identify a provider child lost before record publication.
-  void (deps.reapOrphanChildren ?? stopOrphanAgentSessionChildren)({ store }).catch((error) => {
-    try {
-      if (deps.onError) {
-        deps.onError({ scope: 'agent-session-orphan-child-reaper', error })
-      } else {
-        console.error('[structured-agent-session] orphan reaper failed', error)
-      }
-    } catch (reportingError) {
-      console.error(
-        '[structured-agent-session] orphan reaper error reporting failed',
-        reportingError
-      )
-    }
-  })
   let host: StructuredAgentSessionHost | null = null
   const lifecycle = createStructuredAgentSessionLifecycleDelivery({
     handle: (event) => host?.handleAdapterEvent(event),
@@ -230,6 +215,20 @@ async function install(deps: StructuredAgentSessionRuntimeDeps): Promise<Install
       })
     )
   }
+  // The provider going idle is what re-derives a doubted send: it can no longer be holding it.
+  const releaseUnansweredDispatches = ({ sessionId }: { sessionId: string }): void => {
+    void host
+      ?.releaseUnansweredDispatches({
+        sessionId,
+        reason: DISPATCH_DOUBT_PROVIDER_IDLE
+      })
+      .catch((error) =>
+        deps.onError?.({
+          scope: `structured-agent-session-unanswered-dispatch:${sessionId}`,
+          error
+        })
+      )
+  }
   const codex = new CodexStructuredSessionAdapter({
     resolveLaunch: createCodexStructuredLaunchResolver({
       store,
@@ -245,20 +244,10 @@ async function install(deps: StructuredAgentSessionRuntimeDeps): Promise<Install
     modelCatalog: agentModelCatalogStore,
     onBackgroundTasksChanged: (sessionId, state) =>
       host?.publishBackgroundTaskState(sessionId, state),
+    onChildWorkEvidence: (sessionId, evidence) =>
+      host?.publishChildWorkEvidence(sessionId, evidence),
     onDispatchSettledLate,
-    onPrimaryThreadStoppedRunning: ({ sessionId }) => {
-      void host
-        ?.releaseUnansweredDispatches({
-          sessionId,
-          reason: DISPATCH_DOUBT_PROVIDER_IDLE
-        })
-        .catch((error) =>
-          deps.onError?.({
-            scope: `structured-agent-session-unanswered-dispatch:${sessionId}`,
-            error
-          })
-        )
-    },
+    onPrimaryThreadStoppedRunning: releaseUnansweredDispatches,
     onEvent: (event) => {
       if (event.type === 'ended' && 'cause' in event && event.cause === 'unexpected-exit') {
         lifecycle.deliver(event)
@@ -287,6 +276,7 @@ async function install(deps: StructuredAgentSessionRuntimeDeps): Promise<Install
     onChildWorkEvidence: (sessionId, evidence) =>
       host?.publishChildWorkEvidence(sessionId, evidence),
     onDispatchSettledLate,
+    onSessionIdle: releaseUnansweredDispatches,
     ...(deps.openClaudeConnection ? { openClaudeConnection: deps.openClaudeConnection } : {}),
     ...(deps.readProcessStartTime ? { readProcessStartTime: deps.readProcessStartTime } : {}),
     modelCatalog: agentModelCatalogStore
@@ -312,6 +302,7 @@ async function install(deps: StructuredAgentSessionRuntimeDeps): Promise<Install
       deps.onError?.({ scope: `structured-agent-session-journal:${sessionId}`, error }),
     ...(deps.onSessionStatusChanged ? { onSessionStatusChanged: deps.onSessionStatusChanged } : {}),
     ...(deps.statusSink ? { statusSink: deps.statusSink } : {}),
+    ...(deps.hasOpenDispatch ? { hasOpenDispatch: deps.hasOpenDispatch } : {}),
     ...(await modelCatalogHostDeps({ store, deps, envResolvers }))
   })
   setStructuredAgentSessionHost(host)
diff --git a/src/main/runtime/structured-agent-session-spawn-token-descendants.test.ts b/src/main/runtime/structured-agent-session-spawn-token-descendants.test.ts
new file mode 100644
index 00000000000..d0650d94f49
--- /dev/null
+++ b/src/main/runtime/structured-agent-session-spawn-token-descendants.test.ts
@@ -0,0 +1,191 @@
+// The spawn token is an environment variable, so every descendant of a provider child inherits it:
+// an editor the agent opened with `code .`, a tmux server, a detached dev server. Carrying the token
+// proves descent, not being the provider child, so the host never signals a process on the token
+// alone. The token scan still answers one question soundly: whether a reservation ever spawned.
+
+import type * as NodeFsPromises from 'node:fs/promises'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { CODEX_SPAWN_TOKEN_ENV } from '../codex/codex-structured-owner-identity'
+import { AgentSessionRecordStore } from './agent-session-record-store'
+import type { AgentSessionReserveRequest } from './agent-session-reservation-admission'
+import { createStructuredAgentSessionOwnerProbe } from './structured-agent-session-owner-probe'
+import {
+  ensureStructuredAgentSessionHost,
+  stopStructuredAgentSessionRuntime
+} from './structured-agent-session-runtime'
+
+/** pid -> the NUL-separated environment block `/proc/<pid>/environ` serves. */
+const fakeProc = vi.hoisted(() => ({ environs: new Map<number, string>() }))
+
+vi.mock('node:fs/promises', async (importOriginal) => {
+  const fsp = await importOriginal<typeof NodeFsPromises>()
+  const enoent = (path: string) => Object.assign(new Error(`ENOENT: ${path}`), { code: 'ENOENT' })
+  return {
+    ...fsp,
+    readdir: async (...args: Parameters<typeof fsp.readdir>) =>
+      args[0] === '/proc' ? [...fakeProc.environs.keys()].map(String) : fsp.readdir(...args),
+    readFile: async (...args: Parameters<typeof fsp.readFile>) => {
+      const path = String(args[0])
+      if (!path.startsWith('/proc/')) {
+        return fsp.readFile(...args)
+      }
+      const environ = fakeProc.environs.get(Number(path.split('/')[2]))
+      if (environ === undefined || !path.endsWith('/environ')) {
+        throw enoent(path)
+      }
+      return environ
+    }
+  }
+})
+
+const HOST_ID = 'local'
+const NOW = 1_800_000_000_000
+const SESSION = 'session-alpha'
+const MINTED_TOKEN = 'spawn-minted-by-this-store'
+
+function environ(token: string | null): string {
+  return ['PATH=/usr/bin', ...(token ? [`${CODEX_SPAWN_TOKEN_ENV}=${token}`] : [])].join('\0')
+}
+
+function reserveRequest(): AgentSessionReserveRequest {
+  const operationId = `${NOW}-${'1'.padStart(32, '0')}`
+  return {
+    sessionId: SESSION,
+    location: {
+      executionHostId: HOST_ID,
+      wslDistro: null,
+      workspaceId: 'workspace-1',
+      workspaceKind: 'git-worktree'
+    },
+    provider: 'codex',
+    accountHome: { variable: 'CODEX_HOME', path: '/home/dev/.codex' },
+    expectedFence: null,
+    spawnToken: MINTED_TOKEN,
+    claimKeyId: 'key-1',
+    handoffOperationId: null,
+    probe: { outcome: 'indeterminate', reason: 'no previous owner' },
+    operation: { callerKey: 'client-1', operationId, fingerprint: 'fp-1' },
+    now: NOW
+  }
+}
+
+const originalPlatform = process.platform
+let stateDirectory: string
+
+beforeEach(async () => {
+  stateDirectory = await mkdtemp(join(tmpdir(), 'orca-spawn-token-descendants-'))
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'linux' })
+})
+
+afterEach(async () => {
+  await stopStructuredAgentSessionRuntime()
+  Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
+  fakeProc.environs.clear()
+  vi.restoreAllMocks()
+  await rm(stateDirectory, { recursive: true, force: true })
+})
+
+function openStore(): Promise<AgentSessionRecordStore> {
+  return AgentSessionRecordStore.open({
+    directory: join(stateDirectory, 'agent-sessions'),
+    hostId: HOST_ID
+  })
+}
+
+describe('a process that inherited a spawn token', () => {
+  it('is never signalled when the host installs and reconciles, even when this store minted the token', async () => {
+    // A chat ran and ended: its root exited and the lease was released, clearing the token.
+    const seed = await openStore()
+    const reserved = await seed.reserveOwner(reserveRequest())
+    const fence = reserved.record.lease.runtimeFence
+    await seed.commitProcessIdentity({
+      sessionId: SESSION,
+      fence,
+      process: { hostId: HOST_ID, pid: 4242, processStartTimeMs: NOW, spawnToken: MINTED_TOKEN },
+      now: NOW
+    })
+    await seed.proveOwner({
+      sessionId: SESSION,
+      fence,
+      link: {
+        linkId: 'link-1',
+        handle: { provider: 'codex', threadId: 'thread-1' },
+        origin: 'created',
+        mintedAtFence: fence,
+        observedAt: NOW
+      },
+      now: NOW
+    })
+    const released = await seed.evictProvenDeadOwner({
+      sessionId: SESSION,
+      expectedFence: fence,
+      probe: { outcome: 'pid-absent' },
+      now: NOW
+    })
+    expect(released.lease).toMatchObject({ claimStatus: 'released', reservedSpawnToken: null })
+
+    // The editor the agent opened detached into its own group and outlived the chat, still
+    // carrying the token; another descendant carries a token no store here ever minted.
+    fakeProc.environs.set(1, environ(null))
+    fakeProc.environs.set(5151, environ(MINTED_TOKEN))
+    fakeProc.environs.set(6161, environ('spawn-foreign'))
+    const kill = vi.spyOn(process, 'kill').mockImplementation(() => true)
+
+    const host = await ensureStructuredAgentSessionHost({
+      stateDirectory,
+      hostId: HOST_ID,
+      claimKeyId: 'key-1',
+      resolveWorkspacePath: async () => stateDirectory,
+      resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true }),
+      resolveEnvironment: async () => ({})
+    })
+    await host.reconcileRestartLeases()
+    // Install work that is not awaited would have run by now; nothing here waits on a timer.
+    await new Promise((resolve) => setTimeout(resolve, 50))
+
+    expect(kill.mock.calls.filter(([, signal]) => signal !== 0)).toEqual([])
+  })
+})
+
+describe('the reservation owner probe', () => {
+  async function reconcileReservation(): Promise<AgentSessionRecordStore> {
+    const crashed = await openStore()
+    await crashed.reserveOwner(reserveRequest())
+    // The restart after a crash between reservation and recorded identity.
+    const store = await openStore()
+    await store.reconcileOnRestart({
+      probe: createStructuredAgentSessionOwnerProbe(HOST_ID),
+      now: NOW
+    })
+    return store
+  }
+
+  it('proves a reservation never spawned when the host scan finds no process carrying its token', async () => {
+    fakeProc.environs.set(1, environ(null))
+    fakeProc.environs.set(6161, environ('spawn-foreign'))
+
+    const store = await reconcileReservation()
+
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
+      deathEvidence: { kind: 'pid-absent', detail: 'reservation never spawned' }
+    })
+  })
+
+  it('claims no absence when the host scan finds a process carrying the token', async () => {
+    fakeProc.environs.set(5151, environ(MINTED_TOKEN))
+    const kill = vi.spyOn(process, 'kill').mockImplementation(() => true)
+
+    const store = await reconcileReservation()
+
+    // Released without evidence, and the process carrying the token is left alone.
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
+      deathEvidence: null
+    })
+    expect(kill.mock.calls.filter(([, signal]) => signal !== 0)).toEqual([])
+  })
+})
diff --git a/src/main/runtime/structured-agent-session-support-probe.test.ts b/src/main/runtime/structured-agent-session-support-probe.test.ts
index 07a2b671f0a..ea0ab3298d9 100644
--- a/src/main/runtime/structured-agent-session-support-probe.test.ts
+++ b/src/main/runtime/structured-agent-session-support-probe.test.ts
@@ -22,19 +22,15 @@ function setPlatform(platform: NodeJS.Platform): void {
 
 type InstallEffects = {
   storeOpened: boolean
-  reaperStarted: boolean
 }
 
-/** Stands in for `install()` by performing the two effects it performs, so a probe that
+/** Stands in for `install()` by performing the effect it performs, so a probe that
  *  reinstalls the host is caught by what the install *does*, not by a call count alone. */
 function stubStructuredHostInstall(runtime: OrcaRuntimeService): {
   effects: InstallEffects
   ensure: ReturnType<typeof vi.fn>
 } {
-  const effects: InstallEffects = {
-    storeOpened: false,
-    reaperStarted: false
-  }
+  const effects: InstallEffects = { storeOpened: false }
   // `supportsCreate` answers as the real Codex adapter would, so a probe that reinstalls the host
   // still returns the right answer and fails on the install effects alone.
   const host = {
@@ -44,7 +40,6 @@ function stubStructuredHostInstall(runtime: OrcaRuntimeService): {
   }
   const ensure = vi.fn(async () => {
     effects.storeOpened = true
-    effects.reaperStarted = true
     setStructuredAgentSessionHost(host as never)
   })
   vi.spyOn(runtime, 'ensureStructuredAgentSessionHost').mockImplementation(ensure)
@@ -94,10 +89,7 @@ async function expectSupportWithoutInstall(input: {
 
   expect(answers).toEqual(Array(input.repetitions ?? 1).fill(input.expected))
   expect(ensure).not.toHaveBeenCalled()
-  expect(effects).toEqual({
-    storeOpened: false,
-    reaperStarted: false
-  })
+  expect(effects).toEqual({ storeOpened: false })
   expect(getStructuredAgentSessionHost()).toBeNull()
 }
 
@@ -193,10 +185,7 @@ describe('structured agent-session create-support probe', () => {
     await runtime.prepareStructuredAgentSessionStartupRestoration()
 
     expect(ensure).toHaveBeenCalledTimes(1)
-    expect(effects).toEqual({
-      storeOpened: true,
-      reaperStarted: true
-    })
+    expect(effects).toEqual({ storeOpened: true })
     expect(
       (getStructuredAgentSessionHost() as unknown as { reconcileRestartLeases: () => void })
         .reconcileRestartLeases
diff --git a/src/main/runtime/structured-chat-coordinator-fake-codex-fixture.ts b/src/main/runtime/structured-chat-coordinator-fake-codex-fixture.ts
new file mode 100644
index 00000000000..68756963193
--- /dev/null
+++ b/src/main/runtime/structured-chat-coordinator-fake-codex-fixture.ts
@@ -0,0 +1,175 @@
+// A fake Codex app-server for the structured chat coordinator mail tests: it answers the JSON-RPC
+// calls the adapter makes, and misbehaves on the knobs in `providerFaults`.
+
+import type {
+  CodexAppServerConnection,
+  CodexAppServerConnectionHandlers,
+  openCodexAppServerConnection
+} from '../codex/codex-app-server-connection'
+import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-session-mutation-envelope'
+import { attachFingerprintFields } from '../native-chat/agent-session-wire/structured-agent-session-attach'
+import { isRecord } from './rpc/orchestration-session-caller-test-fixture'
+
+const WORKSPACE = 'workspace-1'
+
+export type FakeConnection = Omit<CodexAppServerConnection, 'closed'> & {
+  closed: boolean
+  handlers: CodexAppServerConnectionHandlers
+  threadId: string | null
+  turns: { clientUserMessageId: string; text: string }[]
+}
+
+/** How the fake provider misbehaves; reset before each test. */
+export const providerFaults: {
+  dieBeforeEveryEcho: boolean
+  refuseTurnStarts: number
+  /** Refuses every start with this error while set. */
+  refuseStart: (() => Error) | null
+  /** How long a start takes before it answers. */
+  startDelayMs: number
+  /** Kills the app-server while it takes a turn: its exit and the failed call, in either order. */
+  crashOnTurnStart: 'off' | 'exit-then-throw' | 'throw-then-exit'
+  starts: number
+  turnStarts: number
+} = {
+  dieBeforeEveryEcho: false,
+  refuseTurnStarts: 0,
+  refuseStart: null,
+  startDelayMs: 0,
+  crashOnTurnStart: 'off',
+  starts: 0,
+  turnStarts: 0
+}
+
+export function fakeCodex() {
+  const connections: FakeConnection[] = []
+  let turnCounter = 0
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a fake answering the JSON-RPC calls the adapter makes, as the shipped integration test does.
+  const openConnection = (async (_launch, handlers = {}) => {
+    providerFaults.starts += 1
+    if (providerFaults.startDelayMs) {
+      await new Promise((resolve) => setTimeout(resolve, providerFaults.startDelayMs))
+    }
+    if (providerFaults.refuseStart) {
+      throw providerFaults.refuseStart()
+    }
+    const connection: FakeConnection = {
+      handlers,
+      threadId: null,
+      turns: [],
+      pid: 4321,
+      closed: false,
+      request: async (method, params) => {
+        const input = isRecord(params) ? params : {}
+        if (method === 'thread/start') {
+          connection.threadId = `thread-${connections.length}`
+          return { thread: { id: connection.threadId } }
+        }
+        if (method === 'thread/resume') {
+          connection.threadId = String(input.threadId)
+          return { thread: { id: connection.threadId } }
+        }
+        if (method === 'turn/start') {
+          providerFaults.turnStarts += 1
+          if (providerFaults.crashOnTurnStart === 'exit-then-throw') {
+            connection.handlers.onExit?.(new Error('app-server crashed'))
+            throw new Error('connection closed')
+          }
+          if (providerFaults.crashOnTurnStart === 'throw-then-exit') {
+            setTimeout(() => connection.handlers.onExit?.(new Error('app-server crashed')), 0)
+            throw new Error('connection closed')
+          }
+          if (providerFaults.refuseTurnStarts > 0) {
+            providerFaults.refuseTurnStarts -= 1
+            throw new Error('turn/start refused')
+          }
+          turnCounter += 1
+          connection.turns.push({
+            clientUserMessageId: String(input.clientUserMessageId),
+            text: JSON.stringify(input.input)
+          })
+          if (providerFaults.dieBeforeEveryEcho) {
+            setTimeout(() => connection.handlers.onExit?.(new Error('provider died')), 0)
+          }
+          return { turn: { id: `turn-${turnCounter}` } }
+        }
+        if (method === 'model/list') {
+          return {
+            data: [
+              {
+                model: 'gpt-live',
+                displayName: 'GPT Live',
+                hidden: false,
+                supportedReasoningEfforts: [{ reasoningEffort: 'medium', description: 'Balanced' }],
+                defaultReasoningEffort: 'medium',
+                isDefault: true
+              }
+            ],
+            nextCursor: null
+          }
+        }
+        return {}
+      },
+      notify: () => {},
+      respond: () => {},
+      respondWithError: () => {},
+      close: async () => {
+        connection.closed = true
+        return true
+      }
+    }
+    connections.push(connection)
+    return connection
+  }) as typeof openCodexAppServerConnection
+  return { connections, openConnection }
+}
+
+let operations = 0
+export function operationId(): string {
+  operations += 1
+  return `${Date.now()}-${operations.toString(16).padStart(32, '0')}`
+}
+
+export function attachParams(sessionId: string) {
+  const params = {
+    location: {
+      executionHostId: 'local' as const,
+      wslDistro: null,
+      workspaceId: WORKSPACE,
+      workspaceKind: 'git-worktree' as const
+    },
+    provider: 'codex' as const,
+    agent: 'codex' as const,
+    accountHome: { variable: 'CODEX_HOME' as const, path: '/home/dev/.codex' },
+    runtimeKind: 'native' as const
+  }
+  const envelope = {
+    sessionId,
+    clientOperationId: operationId(),
+    expectedRuntimeFence: null,
+    payloadFingerprint: ''
+  }
+  return {
+    ...params,
+    envelope: {
+      ...envelope,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.attach',
+        sessionId,
+        fields: attachFingerprintFields({ ...params, envelope })
+      })
+    }
+  }
+}
+
+/** A healthy provider and a fresh id sequence, before each test. */
+export function resetProviderFaults(): void {
+  operations = 0
+  providerFaults.dieBeforeEveryEcho = false
+  providerFaults.refuseTurnStarts = 0
+  providerFaults.refuseStart = null
+  providerFaults.startDelayMs = 0
+  providerFaults.crashOnTurnStart = 'off'
+  providerFaults.starts = 0
+  providerFaults.turnStarts = 0
+}
diff --git a/src/main/runtime/structured-chat-coordinator-mail.test.ts b/src/main/runtime/structured-chat-coordinator-mail.test.ts
new file mode 100644
index 00000000000..a36912fae95
--- /dev/null
+++ b/src/main/runtime/structured-chat-coordinator-mail.test.ts
@@ -0,0 +1,884 @@
+// A worker's result reaching the structured chat that coordinates it, end to end in one process.
+//
+// Real: the structured agent-session host, its record store, journal, lease and Codex adapter; the
+// orchestration database, RPC dispatcher and methods; the runtime's pointer lanes. Fake: only the
+// Codex app-server child, which answers the JSON-RPC calls the real one does.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentJournalRenderItem } from '../../shared/agent-session-journal-types'
+import { agentJournalSubmissionKey } from '../../shared/agent-session-journal-item-key'
+import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-session-mutation-envelope'
+import { ORCHESTRATION_CONTRACT_VERSION } from '../../shared/protocol-version'
+import {
+  AgentSessionAcquisitionRefusal,
+  AgentSessionPreSpawnError
+} from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import type { StructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-host'
+import type { AgentSessionJournal } from '../native-chat/agent-session-journal/journal-store'
+import { AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS } from '../../shared/agent-session-host-authority'
+import { refuse } from '../../shared/agent-session-wire-refusals'
+import { OrcaRuntimeService } from './orca-runtime'
+import { OrchestrationDb } from './orchestration/db'
+import { localOrchestrationCliCommand } from './orchestration/cli-command'
+import { formatMessagePointer } from './orchestration/formatter'
+import { currentRunCoordinatorOrcaSessionId } from './orchestration/db/runs/run-coordinator-orca-session'
+import type { RpcRequest } from './rpc/core'
+import { RpcDispatcher } from './rpc/dispatcher'
+import { ORCHESTRATION_METHODS } from './rpc/methods/orchestration'
+import { idOf, isRecord, resultOf } from './rpc/orchestration-session-caller-test-fixture'
+import {
+  ensureStructuredAgentSessionHost,
+  stopStructuredAgentSessionRuntime
+} from './structured-agent-session-runtime'
+import {
+  attachParams,
+  fakeCodex,
+  operationId,
+  providerFaults,
+  resetProviderFaults,
+  type FakeConnection
+} from './structured-chat-coordinator-fake-codex-fixture'
+
+const COORDINATOR = '4a1f6c2e-8b3d-4e7a-9c15-0d2b6e8f1a37'
+const PEER_CHAT = '7e3b9d15-2c4a-4f86-a0b1-5c9e2d7f3b64'
+const WORKER_PANE = 'tab_worker:bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb'
+const WORKER_2_PANE = 'tab_worker2:cccccccc-cccc-4ccc-8ccc-cccccccccccc'
+
+let codex: ReturnType<typeof fakeCodex>
+let root: string
+let runtime: OrcaRuntimeService
+let db: OrchestrationDb
+let host: StructuredAgentSessionHost
+let dispatcher: RpcDispatcher
+let requests = 0
+
+function request(
+  method: string,
+  params: Record<string, unknown>,
+  options: { sessionId?: string; capability?: string } = {}
+): RpcRequest {
+  requests += 1
+  return {
+    id: `rpc-${requests}`,
+    authToken: 'test',
+    method,
+    params,
+    orchestrationContractVersion: ORCHESTRATION_CONTRACT_VERSION,
+    orchestrationRequestId: `req-${requests}`,
+    ...(options.sessionId
+      ? { orchestrationCompatibilityEvidence: { agentSessionId: options.sessionId } }
+      : {}),
+    ...(options.capability ? { orchestrationCapability: options.capability } : {})
+  }
+}
+
+async function call(
+  method: string,
+  params: Record<string, unknown>,
+  options?: { sessionId?: string; capability?: string }
+): Promise<Record<string, unknown>> {
+  const response = await dispatcher.dispatch(request(method, params, options))
+  if (!response.ok) {
+    throw new Error(`${method} failed: ${JSON.stringify(response)}`)
+  }
+  return resultOf(response)
+}
+
+async function openChat(sessionId: string): Promise<FakeConnection> {
+  const attached = await host.attach({ callerKey: 'test-surface' }, attachParams(sessionId))
+  expect(attached, JSON.stringify(attached)).toMatchObject({ ok: true })
+  await host.setSessionTabVisibility(sessionId, true)
+  threadBySession.set(sessionId, codex.connections.at(-1)!.threadId!)
+  return connectionFor(sessionId)
+}
+
+const threadBySession = new Map<string, string>()
+
+function connectionFor(sessionId: string): FakeConnection {
+  const connection = codex.connections.findLast(
+    (candidate) => candidate.threadId === threadBySession.get(sessionId)
+  )
+  if (!connection) {
+    throw new Error(`no app-server for ${sessionId}`)
+  }
+  return connection
+}
+
+/** Codex's own sequence for a turn: it starts, echoes the user message, and completes. */
+async function settleTurn(sessionId: string, turnIndex: number): Promise<void> {
+  const connection = connectionFor(sessionId)
+  const turn = connection.turns[turnIndex]!
+  const turnId = `turn-${turnIndex + 1}`
+  const notify = (method: string, params: unknown) =>
+    connection.handlers.onNotification?.(method, params)
+  notify('turn/started', { turn: { id: turnId } })
+  notify('item/completed', {
+    item: {
+      type: 'userMessage',
+      id: `echo-${turn.clientUserMessageId}`,
+      clientId: turn.clientUserMessageId,
+      content: [{ type: 'text', text: 'pointer' }]
+    }
+  })
+  notify('turn/completed', { turn: { id: turnId } })
+  await host.flushStreamedEvents(sessionId)
+}
+
+/** A user message typed into the chat, as the chat surface sends it. */
+function sendUserMessage(sessionId: string, text: string) {
+  const body = {
+    kind: 'message' as const,
+    role: 'user' as const,
+    blocks: [{ type: 'text' as const, text }]
+  }
+  return host.send(
+    { callerKey: 'test-surface' },
+    {
+      envelope: {
+        sessionId,
+        clientOperationId: operationId(),
+        expectedRuntimeFence: host.deps.store.getRecord(sessionId)!.lease.runtimeFence,
+        payloadFingerprint: computeAgentSessionPayloadFingerprint({
+          method: 'agentSession.send',
+          sessionId,
+          fields: { body }
+        })
+      },
+      body
+    }
+  )
+}
+
+async function userTexts(sessionId: string): Promise<string[]> {
+  return (await host.journalSnapshot(sessionId)).items.flatMap((item: AgentJournalRenderItem) =>
+    item.body?.kind === 'message' && item.body.role === 'user'
+      ? item.body.blocks.map((block) => (block.type === 'text' ? block.text : ''))
+      : []
+  )
+}
+
+/** A capability-backed terminal worker under the coordinator's Run, and its worker_done. */
+async function finishWorker(
+  taskId: string,
+  worker: { handle: string; paneKey: string } = { handle: 'term_worker', paneKey: WORKER_PANE }
+): Promise<void> {
+  const started = db.createStartingWorkerDispatch({
+    creator: { kind: 'system' },
+    maxDepth: Number.MAX_SAFE_INTEGER,
+    taskId,
+    startOptions: {}
+  })
+  const capability = db.prepareStartingWorkerAuthority({
+    dispatchId: started.dispatch.id,
+    handle: worker.handle,
+    paneKey: worker.paneKey,
+    processIncarnation: `runtime_test:${worker.handle}:1`,
+    worktreeId: 'repo::worker',
+    effects: [],
+    setupState: 'not_applicable'
+  })
+  db.markWorkerDispatchReady(started.dispatch.id)
+  await call(
+    'orchestration.send',
+    {
+      from: worker.handle,
+      subject: 'Done',
+      type: 'worker_done',
+      payload: JSON.stringify({ taskId, dispatchId: started.dispatch.id, outcome: 'succeeded' })
+    },
+    { capability }
+  )
+}
+
+async function coordinatorRunAndTask(): Promise<{ runId: string; taskId: string }> {
+  const created = await call(
+    'orchestration.runCreate',
+    { objective: 'ship' },
+    {
+      sessionId: COORDINATOR
+    }
+  )
+  const runId = idOf(created.run)
+  const task = await call(
+    'orchestration.taskCreate',
+    { spec: 'build it' },
+    {
+      sessionId: COORDINATOR
+    }
+  )
+  return { runId, taskId: idOf(task.task) }
+}
+
+/** `/clear` as the chat surface runs it: the conversation continues in a new session. */
+async function clearChat(sessionId: string): Promise<string> {
+  const command = 'clear' as const
+  const cleared = await host.conversationCommand(
+    { callerKey: 'test-surface' },
+    {
+      command,
+      envelope: {
+        sessionId,
+        clientOperationId: operationId(),
+        expectedRuntimeFence: host.deps.store.getRecord(sessionId)!.lease.runtimeFence,
+        payloadFingerprint: computeAgentSessionPayloadFingerprint({
+          method: 'agentSession.conversationCommand',
+          sessionId,
+          fields: { command }
+        })
+      }
+    }
+  )
+  const successor = cleared.ok ? cleared.value.replacementSessionId : undefined
+  if (!successor) {
+    throw new Error(`clear failed: ${JSON.stringify(cleared)}`)
+  }
+  // The surface swaps the tab over to the session that continues the chat.
+  await host.setSessionTabVisibility(sessionId, false)
+  await host.setSessionTabVisibility(successor, true)
+  threadBySession.set(successor, codex.connections.at(-1)!.threadId!)
+  return successor
+}
+
+beforeEach(async () => {
+  resetProviderFaults()
+  root = await mkdtemp(join(tmpdir(), 'orca-structured-coordinator-mail-'))
+  codex = fakeCodex()
+  db = new OrchestrationDb(':memory:')
+  runtime = startRuntime()
+  host = await ensureStructuredAgentSessionHost({
+    stateDirectory: root,
+    hostId: 'local',
+    claimKeyId: 'key-1',
+    resolveWorkspacePath: async (workspaceId) => `/repos/${workspaceId}`,
+    resolveCodexCommand: () => '/usr/local/bin/codex',
+    resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true }),
+    resolveEnvironment: async () => ({ PATH: '/usr/bin' }),
+    openCodexConnection: codex.openConnection,
+    readProcessStartTime: async () => 1_700_000_000_000,
+    // The same call the runtime's own host install makes on every status change.
+    onSessionStatusChanged: (summary) => runtime.onStructuredSessionStatusForMail(summary)
+  })
+  dispatcher = new RpcDispatcher({ runtime, methods: ORCHESTRATION_METHODS })
+})
+
+/** The runtime over the shared database; a second call is what an Orca restart leaves behind. */
+function startRuntime(): OrcaRuntimeService {
+  const started = new OrcaRuntimeService()
+  started.setOrchestrationDb(db)
+  vi.spyOn(started, 'ensureStructuredAgentSessionHost').mockResolvedValue()
+  vi.spyOn(started, 'getTerminalPaneKey').mockImplementation((handle) =>
+    handle === 'term_worker' ? WORKER_PANE : handle === 'term_worker_2' ? WORKER_2_PANE : null
+  )
+  return started
+}
+
+afterEach(async () => {
+  await stopStructuredAgentSessionRuntime()
+  db.close()
+  vi.restoreAllMocks()
+  await rm(root, { recursive: true, force: true })
+})
+
+// Pointers are sent on asynchronous edges; the default 1s wait is too tight under a loaded parallel run.
+const WAIT = { timeout: 10_000 }
+
+const POINTER =
+  /You have 1 orchestration message\. Run `orca(-dev)? orchestration check --run run_\w+`\./
+
+/** The text the PTY lane types into a local terminal for this mailbox, byte for byte. */
+function ptyPointer(mailboxHandle: string): string {
+  return formatMessagePointer(1, mailboxHandle, localOrchestrationCliCommand()).trim()
+}
+
+/** The text of a turn the fake provider received. */
+function turnText(turn: { text: string }): string {
+  const input: unknown = JSON.parse(turn.text)
+  return Array.isArray(input)
+    ? input.map((item: unknown) => (isRecord(item) ? String(item.text) : '')).join('')
+    : ''
+}
+
+describe('a worker result reaches the structured chat that coordinates it', () => {
+  it('lands as a turn in the coordinator journal, and a flagless check returns the worker_done', async () => {
+    const chat = await openChat(COORDINATOR)
+    const { runId, taskId } = await coordinatorRunAndTask()
+
+    await finishWorker(taskId)
+
+    // No user action: the result itself sends the chat a turn through the host's send.
+    await vi.waitFor(() => expect(chat.turns).toHaveLength(1), WAIT)
+    expect(turnText(chat.turns[0]!)).toBe(ptyPointer(`run:${runId}`))
+    await settleTurn(COORDINATOR, 0)
+    expect(await userTexts(COORDINATOR)).toEqual([expect.stringMatching(POINTER)])
+
+    const checked = await call('orchestration.check', {}, { sessionId: COORDINATOR })
+    expect(checked).toMatchObject({
+      runId,
+      count: 1,
+      messages: [{ type: 'worker_done', from_handle: 'term_worker' }]
+    })
+  })
+
+  it('does not send a second pointer when the delivery is retried', async () => {
+    const chat = await openChat(COORDINATOR)
+    const { runId, taskId } = await coordinatorRunAndTask()
+    await finishWorker(taskId)
+    await vi.waitFor(() => expect(chat.turns).toHaveLength(1), WAIT)
+
+    // A pending send is not an acknowledgement, so the mail is retained and retried on every edge
+    // until the host confirms it: before the echo, and again at the turn's idle edge.
+    runtime.deliverPendingMessagesForHandle(`run:${runId}`)
+    await settleTurn(COORDINATOR, 0)
+    runtime.deliverPendingMessagesForHandle(`run:${runId}`)
+    await vi.waitFor(
+      () => expect(db.getUndeliveredUnreadMessages(`run:${runId}`, undefined, {})).toEqual([]),
+      WAIT
+    )
+    expect(chat.turns).toHaveLength(1)
+    expect(await userTexts(COORDINATOR)).toHaveLength(1)
+  })
+
+  /** Fires both edges and waits until every gate read they started has answered. */
+  async function edgesAnswered(): Promise<void> {
+    const reads = vi.spyOn(host, 'journalSnapshot')
+    runtime.onStructuredSessionStatusForMail({ sessionId: COORDINATOR, status: null })
+    runtime.onStructuredSessionStatusForMail({ sessionId: COORDINATOR, status: 'idle' })
+    await vi.waitFor(() => expect(reads).toHaveBeenCalled(), WAIT)
+    await Promise.all(reads.mock.results.map((read) => read.value))
+    await new Promise((resolve) => setImmediate(resolve))
+    reads.mockRestore()
+  }
+
+  /** The operation ids the coordinator's journal recorded for its pointer turns. */
+  async function pointerSends(): Promise<string[]> {
+    const snapshot = await host.journalSnapshot(COORDINATOR)
+    return snapshot.submissions
+      .filter((submission) =>
+        snapshot.items.some(
+          (item) =>
+            item.itemId === agentJournalSubmissionKey(submission.clientMessageId) &&
+            item.body?.kind === 'message' &&
+            item.body.blocks.some((block) => block.type === 'text' && POINTER.test(block.text))
+        )
+      )
+      .map((submission) => submission.clientMessageId)
+  }
+
+  it('keeps a pointer whose provider died before the echo, and points it after the next turn that runs', async () => {
+    // A provider that dies before echoing never ran the pointer: the mail stays unpointed, and
+    // neither the death's own edge nor an idle one starts the provider again for it.
+    const chat = await openChat(COORDINATOR)
+    const { runId, taskId } = await coordinatorRunAndTask()
+    await finishWorker(taskId)
+    await vi.waitFor(() => expect(chat.turns).toHaveLength(1), WAIT)
+
+    chat.handlers.onExit?.(new Error('provider died before the echo'))
+    const before = codex.connections.length
+    await edgesAnswered()
+    await edgesAnswered()
+    expect(codex.connections.length).toBe(before)
+    expect(db.getUndeliveredUnreadMessages(`run:${runId}`, undefined, {})).toHaveLength(1)
+
+    // The user's next message starts the agent; once its turn runs, the pointer follows it.
+    expect(await sendUserMessage(COORDINATOR, 'again')).toMatchObject({ ok: true })
+    await vi.waitFor(() => expect(codex.connections.length).toBe(before + 1), WAIT)
+    const revived = connectionFor(COORDINATOR)
+    await vi.waitFor(() => expect(revived.turns).toHaveLength(1), WAIT)
+    expect(revived.turns[0]!.text).toContain('again')
+    await settleTurn(COORDINATOR, 0)
+    await vi.waitFor(() => expect(revived.turns).toHaveLength(2), WAIT)
+    expect(revived.turns[1]!.text).toMatch(POINTER)
+    await settleTurn(COORDINATOR, 1)
+    await vi.waitFor(
+      () => expect(db.getUndeliveredUnreadMessages(`run:${runId}`, undefined, {})).toEqual([]),
+      WAIT
+    )
+  })
+
+  it('does not restart a provider that dies before every echo, however many edges follow', async () => {
+    // What this pins: each death's own status edge used to re-point the mail, and that send started
+    // the provider again, about once a second for as long as the mail was unread.
+    await openChat(COORDINATOR)
+    const { runId, taskId } = await coordinatorRunAndTask()
+    providerFaults.dieBeforeEveryEcho = true
+    const before = codex.connections.length
+    await finishWorker(taskId)
+    await vi.waitFor(() => expect(providerFaults.turnStarts).toBe(1), WAIT)
+    // A fixed window, not a poll: a respawn loop would restart it several times in it.
+    await new Promise((resolve) => setTimeout(resolve, 1_500))
+    await edgesAnswered()
+    expect(codex.connections.length - before).toBe(0)
+    expect(providerFaults.turnStarts).toBe(1)
+    expect(db.getUndeliveredUnreadMessages(`run:${runId}`, undefined, {})).toHaveLength(1)
+  })
+
+  it.each(['exit-then-throw', 'throw-then-exit'] as const)(
+    'does not restart a provider that crashed while taking the pointer turn (%s)',
+    async (crash) => {
+      // The crash settles the send `unknown` with the connection's own error, not as a provider
+      // exit; every status edge after it re-pointed the mail and started the provider again.
+      await openChat(COORDINATOR)
+      const { runId, taskId } = await coordinatorRunAndTask()
+      providerFaults.crashOnTurnStart = crash
+      const before = providerFaults.starts
+      await finishWorker(taskId)
+      await vi.waitFor(() => expect(providerFaults.turnStarts).toBe(1), WAIT)
+      await new Promise((resolve) => setTimeout(resolve, 1_500))
+      await edgesAnswered()
+      expect(providerFaults.starts - before).toBe(0)
+      expect(providerFaults.turnStarts).toBe(1)
+      expect(await pointerSends()).toHaveLength(1)
+      expect(db.getUndeliveredUnreadMessages(`run:${runId}`, undefined, {})).toHaveLength(1)
+    }
+  )
+
+  it('points the next result once after a transient death, then holds nothing', async () => {
+    await openChat(COORDINATOR)
+    const { runId, taskId } = await coordinatorRunAndTask()
+    const second = await call(
+      'orchestration.taskCreate',
+      { spec: 'more' },
+      { sessionId: COORDINATOR }
+    )
+    providerFaults.dieBeforeEveryEcho = true
+    await finishWorker(taskId)
+    await vi.waitFor(() => expect(providerFaults.turnStarts).toBe(1), WAIT)
+    await edgesAnswered()
+    // The death was transient. A new result is new mail: one pointer for both, one start.
+    providerFaults.dieBeforeEveryEcho = false
+    const before = providerFaults.starts
+    await finishWorker(idOf(second.task), { handle: 'term_worker_2', paneKey: WORKER_2_PANE })
+    await vi.waitFor(() => expect(providerFaults.turnStarts).toBe(2), WAIT)
+    const revived = connectionFor(COORDINATOR)
+    expect(turnText(revived.turns.at(-1)!)).toBe(
+      formatMessagePointer(2, `run:${runId}`, localOrchestrationCliCommand()).trim()
+    )
+    await settleTurn(COORDINATOR, revived.turns.length - 1)
+    await vi.waitFor(
+      () => expect(db.getUndeliveredUnreadMessages(`run:${runId}`, undefined, {})).toEqual([]),
+      WAIT
+    )
+    expect(providerFaults.starts - before).toBe(1)
+    expect(providerFaults.turnStarts).toBe(2)
+  })
+
+  it('leaves a pointer the person stopped while its agent was starting stopped', async () => {
+    await openChat(COORDINATOR)
+    const { runId, taskId } = await coordinatorRunAndTask()
+    await host.close(COORDINATOR)
+    providerFaults.startDelayMs = 400
+    const before = providerFaults.starts
+    await finishWorker(taskId)
+    await vi.waitFor(() => expect(providerFaults.starts).toBe(before + 1), WAIT)
+    // The person presses Stop while the agent is still starting.
+    const cancelled = await host.cancel(
+      { callerKey: 'test-surface' },
+      {
+        envelope: {
+          sessionId: COORDINATOR,
+          clientOperationId: operationId(),
+          expectedRuntimeFence: host.deps.store.getRecord(COORDINATOR)!.lease.runtimeFence,
+          payloadFingerprint: computeAgentSessionPayloadFingerprint({
+            method: 'agentSession.cancel',
+            sessionId: COORDINATOR,
+            fields: { turnId: 'turn-x' }
+          })
+        },
+        turnId: 'turn-x'
+      }
+    )
+    expect(cancelled).toMatchObject({ ok: true })
+    providerFaults.startDelayMs = 0
+    // A fixed window, not a poll: a re-point would start the agent again in it.
+    await new Promise((resolve) => setTimeout(resolve, 1_500))
+    expect(providerFaults.starts - before).toBe(1)
+    expect(await pointerSends()).toHaveLength(1)
+    await edgesAnswered()
+    expect(providerFaults.starts - before).toBe(1)
+    expect(providerFaults.turnStarts).toBe(0)
+    expect(db.getUndeliveredUnreadMessages(`run:${runId}`, undefined, {})).toHaveLength(1)
+  })
+
+  it('points a held pointer once more after Orca restarts, under a new id', async () => {
+    await openChat(COORDINATOR)
+    const { runId, taskId } = await coordinatorRunAndTask()
+    providerFaults.dieBeforeEveryEcho = true
+    await finishWorker(taskId)
+    await vi.waitFor(() => expect(providerFaults.turnStarts).toBe(1), WAIT)
+    await edgesAnswered()
+    const [held] = await pointerSends()
+
+    // The next process: a fresh runtime over the same database redrives restored mail. The
+    // provider still dies, so exactly one start proves it is pointed once, not in a loop.
+    runtime = startRuntime()
+    dispatcher = new RpcDispatcher({ runtime, methods: ORCHESTRATION_METHODS })
+    const before = providerFaults.starts
+    await vi.waitFor(() => expect(providerFaults.turnStarts).toBe(2), WAIT)
+    await new Promise((resolve) => setTimeout(resolve, 1_500))
+    await edgesAnswered()
+    expect(providerFaults.starts - before).toBe(1)
+    expect(providerFaults.turnStarts).toBe(2)
+    const sends = await pointerSends()
+    expect(sends).toHaveLength(2)
+    expect(sends[0]).toBe(held)
+    expect(db.getUndeliveredUnreadMessages(`run:${runId}`, undefined, {})).toHaveLength(1)
+  })
+
+  /** Mail for a chat whose agent is stopped and whose every start is refused; resolves after it. */
+  async function refusedStartsFor(
+    refusal: () => Error
+  ): Promise<{ runId: string; starts: number }> {
+    await openChat(COORDINATOR)
+    const { runId, taskId } = await coordinatorRunAndTask()
+    await host.close(COORDINATOR)
+    providerFaults.refuseStart = refusal
+    const before = providerFaults.starts
+    await finishWorker(taskId)
+    await vi.waitFor(() => expect(providerFaults.starts).toBe(before + 1), WAIT)
+    await vi.waitFor(
+      () => expect(db.getUndeliveredUnreadMessages(`run:${runId}`, undefined, {})).toHaveLength(1),
+      WAIT
+    )
+    // A fixed window, not a poll: a retry loop would start it several times in it.
+    await new Promise((resolve) => setTimeout(resolve, 1_500))
+    return { runId, starts: providerFaults.starts - before }
+  }
+
+  it.each([
+    [
+      'one the person must fix',
+      () => new AgentSessionAcquisitionRefusal('no login', 'notSignedIn')
+    ],
+    [
+      'an account switch in progress',
+      () =>
+        new AgentSessionPreSpawnError(new Error('switching accounts'), {
+          reason: 'accountSwitchInProgress'
+        })
+    ]
+  ])(
+    'holds mail after a start refused as %s until a turn runs, adding nothing on later edges',
+    async (_label, refusal) => {
+      const { runId, starts } = await refusedStartsFor(refusal)
+      expect(starts).toBe(1)
+      // Later edges replay the refusal: no start, and no new pointer and failure rows in the chat.
+      const before = providerFaults.starts
+      for (let edge = 0; edge < 5; edge += 1) {
+        runtime.onStructuredSessionStatusForMail({ sessionId: COORDINATOR, status: 'idle' })
+        await new Promise((resolve) => setTimeout(resolve, 100))
+      }
+      await edgesAnswered()
+      expect(providerFaults.starts).toBe(before)
+      expect(await pointerSends()).toHaveLength(1)
+      expect(db.getUndeliveredUnreadMessages(`run:${runId}`, undefined, {})).toHaveLength(1)
+
+      // Fixed, the person's next message starts the agent, and the pointer follows its turn.
+      providerFaults.refuseStart = null
+      expect(await sendUserMessage(COORDINATOR, 'again')).toMatchObject({ ok: true })
+      await vi.waitFor(() => expect(providerFaults.starts).toBe(before + 1), WAIT)
+      const revived = connectionFor(COORDINATOR)
+      await vi.waitFor(() => expect(revived.turns.length).toBeGreaterThanOrEqual(1), WAIT)
+      expect(revived.turns[0]!.text).toContain('again')
+      await settleTurn(COORDINATOR, 0)
+      await vi.waitFor(() => expect(revived.turns).toHaveLength(2), WAIT)
+      expect(revived.turns[1]!.text).toMatch(POINTER)
+    }
+  )
+
+  it('points held mail after the next turn that runs, even once a rewind dropped its send', async () => {
+    const chat = await openChat(COORDINATOR)
+    const { runId, taskId } = await coordinatorRunAndTask()
+    providerFaults.crashOnTurnStart = 'exit-then-throw'
+    await finishWorker(taskId)
+    await vi.waitFor(() => expect(providerFaults.turnStarts).toBe(1), WAIT)
+    await edgesAnswered()
+    // What a rewind's recovery does: the journal is rebuilt, and no send is on record any more.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the host keeps its conversations private; this is the one journal call rewind recovery makes.
+    const open = (host as unknown as { sessions: Map<string, { journal: AgentSessionJournal }> })
+      .sessions
+    const fence = host.deps.store.getRecord(COORDINATOR)!.lease.runtimeFence
+    await open.get(COORDINATOR)!.journal.replaceEpochItems('handle_forked', fence, [])
+    expect(await pointerSends()).toEqual([])
+
+    providerFaults.crashOnTurnStart = 'off'
+    expect(await sendUserMessage(COORDINATOR, 'again')).toMatchObject({ ok: true })
+    await vi.waitFor(() => expect(providerFaults.turnStarts).toBe(2), WAIT)
+    const revived = connectionFor(COORDINATOR)
+    expect(revived).not.toBe(chat)
+    await settleTurn(COORDINATOR, revived.turns.length - 1)
+    await vi.waitFor(() => expect(turnText(revived.turns.at(-1)!)).toMatch(POINTER), WAIT)
+    await settleTurn(COORDINATOR, revived.turns.length - 1)
+    await vi.waitFor(
+      () => expect(db.getUndeliveredUnreadMessages(`run:${runId}`, undefined, {})).toEqual([]),
+      WAIT
+    )
+  })
+
+  it('points again under a new id once a send the host never recorded is too old to admit', async () => {
+    const chat = await openChat(COORDINATOR)
+    const { runId, taskId } = await coordinatorRunAndTask()
+    // The first pointer is refused before the host records it, so the journal holds no verdict.
+    const realSend = host.send
+    const refused = vi.spyOn(host, 'send').mockImplementationOnce(async () => ({
+      ok: false as const,
+      refusal: refuse(
+        'agent_session_operation_invalid',
+        { reason: 'conversationCommandInFlight' },
+        'busy'
+      )
+    }))
+    refused.mockImplementation((caller, params) => realSend(caller, params))
+    await finishWorker(taskId)
+    await vi.waitFor(() => expect(refused).toHaveBeenCalledTimes(1), WAIT)
+    const held = db.getStructuredPointerOperation(`run:${runId}`)?.operation_id
+
+    // No edge for a day: the host would now refuse that id as expired, on every retry.
+    vi.useFakeTimers({ toFake: ['Date'] })
+    try {
+      vi.setSystemTime(Date.now() + AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS + 60_000)
+      await edgesAnswered()
+      await new Promise((resolve) => setTimeout(resolve, 300))
+      expect(chat.turns.map(turnText)).toEqual([ptyPointer(`run:${runId}`)])
+      expect(db.getStructuredPointerOperation(`run:${runId}`)?.operation_id).not.toBe(held)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('holds mail a refused turn left in doubt until the next result, then points it once', async () => {
+    // A failed turn/start cannot prove the turn never started, so the host records it `unknown`
+    // and a resend under its id replays that; new mail is a new send.
+    const chat = await openChat(COORDINATOR)
+    const { runId, taskId } = await coordinatorRunAndTask()
+    const second = await call(
+      'orchestration.taskCreate',
+      { spec: 'more' },
+      { sessionId: COORDINATOR }
+    )
+    providerFaults.refuseTurnStarts = 1
+    const before = codex.connections.length
+    await finishWorker(taskId)
+    await vi.waitFor(() => expect(providerFaults.turnStarts).toBe(1), WAIT)
+    await edgesAnswered()
+    expect(chat.turns).toHaveLength(0)
+
+    await finishWorker(idOf(second.task), { handle: 'term_worker_2', paneKey: WORKER_2_PANE })
+    await vi.waitFor(() => expect(chat.turns).toHaveLength(1), WAIT)
+    expect(turnText(chat.turns[0]!)).toBe(
+      formatMessagePointer(2, `run:${runId}`, localOrchestrationCliCommand()).trim()
+    )
+    expect(codex.connections.length).toBe(before)
+  })
+
+  it('points a coordinator whose agent is not running through the send alone, which starts it', async () => {
+    await openChat(COORDINATOR)
+    const { taskId } = await coordinatorRunAndTask()
+    // What the idle sweep leaves of a chat nobody is looking at: agent stopped, no map entry.
+    await host.close(COORDINATOR)
+    expect(host.hasSession(COORDINATOR)).toBe(false)
+    const before = codex.connections.length
+
+    await finishWorker(taskId)
+
+    // Nothing holds or wakes the session first: the pointer's accepted send starts its agent.
+    await vi.waitFor(() => expect(codex.connections.length).toBe(before + 1), WAIT)
+    const revived = connectionFor(COORDINATOR)
+    await vi.waitFor(() => expect(revived.turns).toHaveLength(1), WAIT)
+    expect(revived.turns[0]!.text).toMatch(POINTER)
+    await settleTurn(COORDINATOR, 0)
+    expect(await userTexts(COORDINATOR)).toEqual([expect.stringMatching(POINTER)])
+  })
+
+  it('points mail at the idle edge when it arrived mid-turn', async () => {
+    const chat = await openChat(COORDINATOR)
+    const { runId, taskId } = await coordinatorRunAndTask()
+    const first = await host.send(
+      { callerKey: 'test-surface' },
+      {
+        envelope: {
+          sessionId: COORDINATOR,
+          clientOperationId: operationId(),
+          expectedRuntimeFence: host.deps.store.getRecord(COORDINATOR)!.lease.runtimeFence,
+          payloadFingerprint: computeAgentSessionPayloadFingerprint({
+            method: 'agentSession.send',
+            sessionId: COORDINATOR,
+            fields: {
+              body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'go' }] }
+            }
+          })
+        },
+        body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'go' }] }
+      }
+    )
+    expect(first).toMatchObject({ ok: true })
+    // Accepted, then delivered: the provider sees the turn once the host hands it over.
+    await vi.waitFor(() => expect(chat.turns).toHaveLength(1), WAIT)
+    const notify = (method: string, params: unknown) =>
+      chat.handlers.onNotification?.(method, params)
+    notify('turn/started', { turn: { id: 'turn-1' } })
+    notify('item/completed', {
+      item: {
+        type: 'userMessage',
+        id: 'echo-go',
+        clientId: chat.turns[0]!.clientUserMessageId,
+        content: [{ type: 'text', text: 'go' }]
+      }
+    })
+    await host.flushStreamedEvents(COORDINATOR)
+
+    await finishWorker(taskId)
+    await new Promise((resolve) => setTimeout(resolve, 20))
+    // The coordinator is mid-turn, so nothing is folded into that turn.
+    expect(chat.turns).toHaveLength(1)
+
+    notify('turn/completed', { turn: { id: 'turn-1' } })
+    await host.flushStreamedEvents(COORDINATOR)
+    await vi.waitFor(() => expect(chat.turns).toHaveLength(2), WAIT)
+    expect(chat.turns[1]!.text).toMatch(POINTER)
+    expect(chat.turns[1]!.text).toContain(runId)
+  })
+})
+
+describe('a /clear keeps the chat its orchestration address', () => {
+  it("delivers the conversation's Run to the session that continues it, and acts as it", async () => {
+    await openChat(COORDINATOR)
+    const { runId, taskId } = await coordinatorRunAndTask()
+    const generation = db.getRunRaw(runId)!.consumer_generation
+    const successor = await clearChat(COORDINATOR)
+    const next = connectionFor(successor)
+
+    await expect(
+      call('orchestration.runCurrent', {}, { sessionId: successor })
+    ).resolves.toMatchObject({ run: { id: runId } })
+    await finishWorker(taskId)
+    await vi.waitFor(() => expect(next.turns).toHaveLength(1), WAIT)
+    expect(next.turns[0]!.text).toMatch(POINTER)
+    await settleTurn(successor, 0)
+    await expect(call('orchestration.check', {}, { sessionId: successor })).resolves.toMatchObject({
+      runId,
+      count: 1,
+      messages: [{ type: 'worker_done' }]
+    })
+    // Nothing was rewritten: the Run is bound exactly as the first session bound it.
+    expect(db.getRunRaw(runId)).toMatchObject({
+      coordinator_orca_session_id: COORDINATOR,
+      consumer_generation: generation
+    })
+  })
+
+  it("stores the successor's own Run under the conversation's address, through a chain of clears", async () => {
+    await openChat(COORDINATOR)
+    const middle = await clearChat(COORDINATOR)
+    const created = await call(
+      'orchestration.runCreate',
+      { objective: 'next' },
+      { sessionId: middle }
+    )
+    const runId = idOf(created.run)
+    expect(db.getRunRaw(runId)!.coordinator_orca_session_id).toBe(COORDINATOR)
+    const successor = await clearChat(middle)
+    runtime.onStructuredSessionStatusForMail({ sessionId: successor, status: 'idle' })
+
+    await expect(
+      call('orchestration.runCurrent', {}, { sessionId: successor })
+    ).resolves.toMatchObject({ run: { id: runId } })
+    expect(db.getRunRaw(runId)!.coordinator_orca_session_id).toBe(COORDINATOR)
+    // What it sends carries the same address.
+    await openChat(PEER_CHAT)
+    await expect(
+      call(
+        'orchestration.send',
+        { to: `session:${PEER_CHAT}`, subject: 'hi' },
+        { sessionId: successor }
+      )
+    ).resolves.toMatchObject({ message: { from_handle: `session:${COORDINATOR}` } })
+  })
+
+  it("binds a Run a cleared chat creates or uses to the conversation's root, at the Run's current generation", async () => {
+    const root = COORDINATOR
+    const boundOrcaSessionId = (runId: string): string | null =>
+      currentRunCoordinatorOrcaSessionId(db.getRunRaw(runId)!)
+    await openChat(COORDINATOR)
+    const middle = await clearChat(COORDINATOR)
+    const first = idOf(
+      (await call('orchestration.runCreate', { objective: 'first' }, { sessionId: middle })).run
+    )
+    expect(db.getRunRaw(first)).toMatchObject({
+      coordinator_orca_session_id: root,
+      coordinator_orca_session_id_generation: db.getRunRaw(first)!.consumer_generation
+    })
+    expect(boundOrcaSessionId(first)).toBe(root)
+    const second = idOf(
+      (await call('orchestration.runCreate', { objective: 'second' }, { sessionId: middle })).run
+    )
+    expect(boundOrcaSessionId(first)).toBeNull()
+
+    const successor = await clearChat(middle)
+    await call('orchestration.runUse', { id: first }, { sessionId: successor })
+    const rebound = db.getRunRaw(first)!
+    expect(rebound.coordinator_orca_session_id).toBe(root)
+    expect(rebound.coordinator_orca_session_id_generation).toBe(rebound.consumer_generation)
+    expect(boundOrcaSessionId(second)).toBeNull()
+    await expect(
+      call('orchestration.runCurrent', {}, { sessionId: successor })
+    ).resolves.toMatchObject({ run: { id: first } })
+  })
+
+  it('lands mail sent to any session of the conversation in the live one', async () => {
+    await openChat(PEER_CHAT)
+    const middle = await clearChat(PEER_CHAT)
+    const successor = await clearChat(middle)
+    const next = connectionFor(successor)
+
+    for (const [index, spelling] of [PEER_CHAT, middle, successor].entries()) {
+      const sent = await call('orchestration.send', {
+        from: 'term_worker',
+        to: `session:${spelling}`,
+        subject: `ping ${index}`
+      })
+      expect(sent).toMatchObject({ message: { to_handle: `session:${PEER_CHAT}` } })
+      await vi.waitFor(() => expect(next.turns).toHaveLength(index + 1), WAIT)
+      await settleTurn(successor, index)
+    }
+    await expect(call('orchestration.check', {}, { sessionId: successor })).resolves.toMatchObject({
+      count: 3
+    })
+  })
+})
+
+describe('any live session is addressable by its id', () => {
+  it('lands mail sent to `session:<id>` as a turn in that chat, which a flagless check reads', async () => {
+    const peer = await openChat(PEER_CHAT)
+
+    const sent = await call('orchestration.send', {
+      from: 'term_worker',
+      to: `session:${PEER_CHAT}`,
+      subject: 'ping'
+    })
+    expect(sent).toMatchObject({ message: { to_handle: `session:${PEER_CHAT}` } })
+
+    await vi.waitFor(() => expect(peer.turns).toHaveLength(1), WAIT)
+    // Direct mail is not in a Run, so the pointer names no `--run`.
+    expect(turnText(peer.turns[0]!)).toBe(ptyPointer(`session:${PEER_CHAT}`))
+    await settleTurn(PEER_CHAT, 0)
+    const checked = await call('orchestration.check', {}, { sessionId: PEER_CHAT })
+    expect(checked).toMatchObject({ count: 1, messages: [{ subject: 'ping' }] })
+  })
+
+  it('refuses mail to a chat that was closed, before storing it', async () => {
+    await openChat(PEER_CHAT)
+    await host.setSessionTabVisibility(PEER_CHAT, false)
+    const response = await dispatcher.dispatch(
+      request('orchestration.send', {
+        from: 'term_worker',
+        to: `session:${PEER_CHAT}`,
+        subject: 'ping'
+      })
+    )
+    expect(response).toMatchObject({ ok: false, error: { code: 'session_caller_not_live' } })
+    expect(db.getInbox(100)).toEqual([])
+  })
+})
diff --git a/src/main/runtime/structured-claude-auth-policy-wiring.test.ts b/src/main/runtime/structured-claude-auth-policy-wiring.test.ts
index f018dfd30da..cc2b5c3b164 100644
--- a/src/main/runtime/structured-claude-auth-policy-wiring.test.ts
+++ b/src/main/runtime/structured-claude-auth-policy-wiring.test.ts
@@ -1,4 +1,3 @@
-import { readFileSync } from 'node:fs'
 import { join } from 'node:path'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
@@ -10,28 +9,11 @@ import {
 } from './structured-agent-session-runtime'
 
 /**
- * The structured host's Claude auth policy has exactly one production wiring, and it
- * lives in `orca-runtime-get-worktree-ps.ts` — a `@ts-nocheck` file, so neither the
- * compiler nor a type test can see the field disappear. Deleting that wiring used to
- * leave ~1000 tests green while every `ANTHROPIC_*` variable in the shell reached the
- * child, because `stripAuthEnv` silently fell back to `false`.
- *
- * Two independent guards replace that silence, and this file pins both.
+ * The structured host's Claude auth policy has exactly one production wiring. Deleting it
+ * used to leave ~1000 tests green while every `ANTHROPIC_*` variable in the shell reached
+ * the child, because `stripAuthEnv` silently fell back to `false`.
  */
 describe('structured Claude auth policy wiring', () => {
-  // The behavioural version of this assertion — importing the runtime class and
-  // capturing the installed deps — costs 35s of module transform for the whole
-  // OrcaRuntime chain (measured), so the wiring itself is pinned by source and the
-  // policy's meaning by claude-structured-auth-policy.test.ts.
-  it('passes a settings-derived Claude auth policy to the host installer', () => {
-    const source = readFileSync(join(__dirname, 'orca-runtime-get-worktree-ps.ts'), 'utf8')
-
-    expect(source).toContain('claudeStructuredAuthPolicyForSettings')
-    expect(source).toMatch(
-      /resolveClaudeAuthPolicy:\s*\(\)\s*=>\s*\n?\s*claudeStructuredAuthPolicyForSettings\(/
-    )
-  })
-
   describe('installing without one', () => {
     let stateDirectory: string | null = null
 
diff --git a/src/main/runtime/structured-claude-runtime-adapter.ts b/src/main/runtime/structured-claude-runtime-adapter.ts
index b0cb51eb183..761a6835a55 100644
--- a/src/main/runtime/structured-claude-runtime-adapter.ts
+++ b/src/main/runtime/structured-claude-runtime-adapter.ts
@@ -40,6 +40,7 @@ export type StructuredClaudeRuntimeAdapterDeps = {
     state: AgentSessionBackgroundTaskState | null
   ) => void
   onDispatchSettledLate?: ClaudeStructuredSessionAdapterDeps['onDispatchSettledLate']
+  onSessionIdle?: ClaudeStructuredSessionAdapterDeps['onSessionIdle']
   onChildWorkEvidence?: ClaudeStructuredSessionAdapterDeps['onChildWorkEvidence']
 }
 
@@ -60,12 +61,12 @@ export function structuredClaudeLifecycleEvent(
       type: 'ended',
       sessionId: event.sessionId,
       reason: event.reason,
+      ...(event.failure ? { failure: event.failure } : {}),
       cause: event.cause,
       fence: event.fence,
       acquisitionGeneration: event.acquisitionGeneration,
-      ...(event.settlementRetryRequired
-        ? { settlementRetryRequired: event.settlementRetryRequired }
-        : {}),
+      // The instant the translator ended the open turn at; the host reads the exit's turn by it.
+      ...(event.observedAt === undefined ? {} : { observedAt: event.observedAt }),
       ...(event.startupUnproven ? { startupUnproven: event.startupUnproven } : {})
     }
   }
@@ -132,6 +133,7 @@ export function createStructuredClaudeRuntimeAdapter(
       ? { onBackgroundTasksChanged: deps.onBackgroundTasksChanged }
       : {}),
     ...(deps.onDispatchSettledLate ? { onDispatchSettledLate: deps.onDispatchSettledLate } : {}),
+    ...(deps.onSessionIdle ? { onSessionIdle: deps.onSessionIdle } : {}),
     ...(deps.onChildWorkEvidence ? { onChildWorkEvidence: deps.onChildWorkEvidence } : {}),
     ...(deps.openClaudeConnection ? { openConnection: deps.openClaudeConnection } : {}),
     ...(deps.readProcessStartTime ? { readProcessStartTime: deps.readProcessStartTime } : {}),
diff --git a/src/main/runtime/structured-claude-scripted-runtime-test-support.ts b/src/main/runtime/structured-claude-scripted-runtime-test-support.ts
index af1bc9a4af7..07de5e58761 100644
--- a/src/main/runtime/structured-claude-scripted-runtime-test-support.ts
+++ b/src/main/runtime/structured-claude-scripted-runtime-test-support.ts
@@ -1,6 +1,7 @@
 // A structured-session runtime whose Claude children are scripted: the production runtime,
 // adapter, record store and host, with only the CLI process replaced.
 
+import { providerDiagnostic, withProviderDiagnostic } from '../../shared/agent-session-failure'
 import { mkdir, mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -20,6 +21,10 @@ import {
   stopStructuredAgentSessionRuntime
 } from './structured-agent-session-runtime'
 
+/** The error a real CLI's exit reaches the adapter as: Orca's message, the stderr as a log detail. */
+export function scriptedClaudeExitError(diagnostic: string): Error {
+  return withProviderDiagnostic(new Error(diagnostic), providerDiagnostic(diagnostic, 'log'))
+}
 export type ScriptedClaudeBehavior = {
   /** Initialize never answers; only the child's exit settles it. */
   initHangs?: boolean
@@ -37,6 +42,11 @@ export type ScriptedClaudeBehavior = {
   optionWritesHang?: boolean
   /** Startup's own settings read goes unanswered. */
   startupSettingsReadHangs?: boolean
+  /** Every option write loses its answer while the CLI keeps running (not a refusal), so a
+   *  start that restores one faults. */
+  optionWritesFail?: boolean
+  /** The init frame names another provider session than the one launched. */
+  initNamesForeignSession?: boolean
 }
 
 export type ScriptedClaudeChild = {
@@ -86,7 +96,13 @@ export function createScriptedClaudeRuntime(sessionIds: readonly string[]) {
     const never = <T>(): Promise<T> => new Promise<T>(() => {})
     const optionWrite = (subtype: string): Promise<void> => {
       child.calls.push(subtype)
-      return control(subtype, () => (behavior.optionWritesHang ? never() : Promise.resolve()))
+      return control(subtype, () =>
+        behavior.optionWritesFail
+          ? Promise.reject(new Error('Query closed before response received'))
+          : behavior.optionWritesHang
+            ? never()
+            : Promise.resolve()
+      )
     }
     let settingsReads = 0
     const child: ScriptedClaudeChild = {
@@ -110,7 +126,7 @@ export function createScriptedClaudeRuntime(sessionIds: readonly string[]) {
             handlers.onMessage?.({
               type: 'system',
               subtype: 'init',
-              session_id: providerSessionId,
+              session_id: behavior.initNamesForeignSession ? 'foreign-session' : providerSessionId,
               model: 'claude-sonnet-5',
               apiKeySource: 'none'
             })
@@ -156,7 +172,7 @@ export function createScriptedClaudeRuntime(sessionIds: readonly string[]) {
         setPermissionMode: () => optionWrite('set_permission_mode'),
         applyFlagSettings: () => optionWrite('apply_flag_settings'),
         interrupt: async () => undefined,
-        cancelAsyncMessage: async () => {},
+        cancelAsyncMessage: async () => false,
         stopTask: async () => {},
         send: async () => {
           child.calls.push('send')
@@ -175,7 +191,7 @@ export function createScriptedClaudeRuntime(sessionIds: readonly string[]) {
   }
   const exitAtSpawn = (child: ScriptedClaudeChild, diagnostic: string): void => {
     child.connection.closed = true
-    child.exit(new Error(diagnostic))
+    child.exit(scriptedClaudeExitError(diagnostic))
   }
   /** A pid whose process is gone has no start time to read. */
   const readProcessStartTime = async (pid: number): Promise<number | null> => {
diff --git a/src/main/runtime/structured-codex-child-work-runtime.test.ts b/src/main/runtime/structured-codex-child-work-runtime.test.ts
new file mode 100644
index 00000000000..d03ab6f1be5
--- /dev/null
+++ b/src/main/runtime/structured-codex-child-work-runtime.test.ts
@@ -0,0 +1,133 @@
+// The production runtime hands a Codex session's child work to the status sink, under the address
+// the session's own row landed under, and ends it with the provider.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import type {
+  CodexAppServerConnection,
+  CodexAppServerConnectionHandlers,
+  openCodexAppServerConnection
+} from '../codex/codex-app-server-connection'
+import {
+  HOST_TEST_SESSION as SESSION,
+  hostTestAttachParams
+} from '../native-chat/agent-session-wire/structured-agent-session-host-test-data'
+import type { StructuredAgentSessionStatusSink } from '../native-chat/agent-session-wire/structured-agent-session-status-feed'
+import {
+  ensureStructuredAgentSessionHost,
+  stopStructuredAgentSessionRuntime
+} from './structured-agent-session-runtime'
+
+const THREAD = 'thread-runtime-child-work'
+const CHILD = 'thread-runtime-reviewer'
+const ROUTES: Record<string, unknown> = {
+  'thread/start': { thread: { id: THREAD } },
+  'model/list': {
+    data: [
+      {
+        model: 'gpt-test',
+        displayName: 'GPT Test',
+        hidden: false,
+        supportedReasoningEfforts: [],
+        defaultReasoningEffort: null,
+        isDefault: true
+      }
+    ],
+    nextCursor: null
+  }
+}
+
+describe('structured Codex child work through the production runtime', () => {
+  let root: string | null = null
+
+  afterEach(async () => {
+    await stopStructuredAgentSessionRuntime()
+    if (root) {
+      await rm(root, { recursive: true, force: true })
+      root = null
+    }
+  })
+
+  it("hands its subagents to the status sink under the session's own address", async () => {
+    root = await mkdtemp(join(tmpdir(), 'orca-runtime-codex-child-work-'))
+    const connections: CodexAppServerConnectionHandlers[] = []
+    const openConnection: typeof openCodexAppServerConnection = async (_launch, handlers = {}) => {
+      connections.push(handlers)
+      const connection: CodexAppServerConnection = {
+        pid: 4321,
+        closed: false,
+        request: async (method) => (method in ROUTES ? ROUTES[method] : {}),
+        notify: () => {},
+        respond: () => {},
+        respondWithError: () => {},
+        close: async () => true
+      }
+      return connection
+    }
+    const childWork: Parameters<
+      NonNullable<StructuredAgentSessionStatusSink['publishChildWork']>
+    >[] = []
+    const host = await ensureStructuredAgentSessionHost({
+      stateDirectory: root,
+      hostId: 'local',
+      claimKeyId: 'key-1',
+      resolveWorkspacePath: async () => root!,
+      resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true }),
+      resolveCodexCommand: () => 'codex',
+      resolveEnvironment: async () => ({ PATH: process.env.PATH }),
+      openCodexConnection: openConnection,
+      readProcessStartTime: async () => 1_700_000_000_000,
+      statusSink: {
+        publish: () => {},
+        forget: () => {},
+        publishChildWork: (...args) => childWork.push(args)
+      }
+    })
+    const attachParams = hostTestAttachParams(null, { providerHandle: undefined })
+    attachParams.envelope.clientOperationId = `${Date.now()}-${'1'.padStart(32, '0')}`
+    const attached = await host.attach({ callerKey: 'runtime-test' }, attachParams)
+    expect(attached).toMatchObject({ ok: true })
+    // Creating the session starts its child; nothing else has to keep it running.
+    expect(connections).toHaveLength(1)
+    const notify = (method: string, params: Record<string, unknown>) =>
+      connections[0]?.onNotification?.(method, params)
+    notify('turn/started', { threadId: THREAD, turn: { id: 'turn-1' } })
+    notify('turn/started', { threadId: CHILD, turn: { id: 'child-turn-1' } })
+    notify('item/started', {
+      threadId: THREAD,
+      turnId: 'turn-1',
+      item: {
+        type: 'subAgentActivity',
+        id: 'spawn-1',
+        kind: 'started',
+        agentThreadId: CHILD,
+        agentPath: '/root/review'
+      }
+    })
+    const subject = expect.objectContaining({ kind: 'structured-session', sessionId: SESSION })
+    expect(childWork).toEqual([
+      [
+        subject,
+        [
+          expect.objectContaining({
+            type: 'live',
+            child: expect.objectContaining({
+              handle: { idKind: 'thread_id', id: CHILD, runId: 'child-turn-1' },
+              description: 'review'
+            })
+          })
+        ],
+        'codex'
+      ]
+    ])
+    // The provider dies: its session's end is reported under the same address.
+    connections[0]?.onExit?.(new Error('scripted provider exit'))
+    expect(childWork.at(-1)).toEqual([
+      subject,
+      [expect.objectContaining({ type: 'session-ended' })],
+      'codex'
+    ])
+  })
+})
diff --git a/src/main/runtime/structured-codex-session-rpc-test-harness.ts b/src/main/runtime/structured-codex-session-rpc-test-harness.ts
new file mode 100644
index 00000000000..6b9024ba029
--- /dev/null
+++ b/src/main/runtime/structured-codex-session-rpc-test-harness.ts
@@ -0,0 +1,278 @@
+// One structured Codex session driven over `agentSession.*`, with nothing stubbed but the Codex
+// child: the RPC dispatcher, schemas, record store, journal, lease, Codex adapter and translation
+// are the ones that ship. The fake app-server answers the JSON-RPC calls the real one does, and a
+// test pushes notifications, blocking requests and the child's exit back through its handlers.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { expect, vi } from 'vitest'
+import type {
+  CodexAppServerConnection,
+  CodexAppServerConnectionHandlers,
+  openCodexAppServerConnection
+} from '../codex/codex-app-server-connection'
+import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-session-mutation-envelope'
+import {
+  AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY,
+  STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
+  type RuntimeCapability
+} from '../../shared/protocol-version'
+import { attachFingerprintFields } from '../native-chat/agent-session-wire/structured-agent-session-attach'
+import type { OrcaRuntimeService } from './orca-runtime'
+import type { RpcRequest, RpcResponse } from './rpc/core'
+import { RpcDispatcher } from './rpc/dispatcher'
+import { STRUCTURED_AGENT_SESSION_METHODS } from './rpc/methods/structured-agent-session'
+import {
+  ensureStructuredAgentSessionHost,
+  stopStructuredAgentSessionRuntime
+} from './structured-agent-session-runtime'
+
+export const SESSION = 'session-integration-1'
+export const THREAD = 'thread-integration'
+export const TURN = 'turn-1'
+const WORKSPACE = 'workspace-1'
+// Without the pending-send capability the host holds the reply until the send settles, which is a
+// shim for clients too old to render a pending bubble — not what these suites model.
+const DEFAULT_CLIENT_CAPABILITIES: readonly RuntimeCapability[] = [
+  AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY,
+  STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
+]
+
+// `closed` is readonly on the real connection; the fake flips it so a test can
+// see a takeover reap the previous child.
+export type FakeCodexConnection = Omit<CodexAppServerConnection, 'closed'> & {
+  closed: boolean
+  handlers: CodexAppServerConnectionHandlers
+  calls: { method: string; params?: Record<string, unknown> }[]
+  replies: { id: number | string; result?: unknown; code?: number }[]
+  resumedThreadId: string | null
+  launch: Parameters<typeof openCodexAppServerConnection>[0]
+}
+
+export type FakeCodex = {
+  connections: FakeCodexConnection[]
+  openConnection: typeof openCodexAppServerConnection
+  live: () => FakeCodexConnection
+  notify: (method: string, params: unknown) => void
+  ask: (id: number, method: string, params: unknown) => void
+}
+
+function fakeCodex(): FakeCodex {
+  const connections: FakeCodexConnection[] = []
+  const openConnection: typeof openCodexAppServerConnection = async (launch, handlers = {}) => {
+    const connection: FakeCodexConnection = {
+      launch,
+      handlers,
+      calls: [],
+      replies: [],
+      resumedThreadId: null,
+      pid: 4321,
+      closed: false,
+      request: async (method, params) => {
+        connection.calls.push({ method, params })
+        if (method === 'thread/start') {
+          return { thread: { id: THREAD, path: '/rollouts/integration.jsonl' } }
+        }
+        if (method === 'thread/resume') {
+          connection.resumedThreadId = (params as { threadId: string }).threadId
+          return { thread: { id: connection.resumedThreadId } }
+        }
+        if (method === 'turn/start') {
+          return { turn: { id: TURN } }
+        }
+        if (method === 'model/list') {
+          return {
+            data: [
+              {
+                model: 'gpt-live',
+                displayName: 'GPT Live',
+                hidden: false,
+                supportedReasoningEfforts: [
+                  { reasoningEffort: 'medium', description: 'Balanced' },
+                  { reasoningEffort: 'high', description: 'Deep reasoning' }
+                ],
+                defaultReasoningEffort: 'medium',
+                isDefault: true
+              }
+            ],
+            nextCursor: null
+          }
+        }
+        return {}
+      },
+      notify: () => {},
+      respond: (id, result) => connection.replies.push({ id, result }),
+      respondWithError: (id, code) => connection.replies.push({ id, code }),
+      close: async () => {
+        connection.closed = true
+        return true
+      }
+    }
+    connections.push(connection)
+    return connection
+  }
+  const live = (): FakeCodexConnection => {
+    const connection = connections.at(-1)
+    if (!connection) {
+      throw new Error('no codex app-server has been opened')
+    }
+    return connection
+  }
+  return {
+    connections,
+    openConnection,
+    live,
+    notify: (method, params) => live().handlers.onNotification?.(method, params),
+    ask: (id, method, params) => live().handlers.onServerRequest?.({ id, method, params })
+  }
+}
+
+function attachParams(operationId: () => string, fence: number | null) {
+  const params = {
+    location: {
+      executionHostId: 'local',
+      wslDistro: null,
+      workspaceId: WORKSPACE,
+      workspaceKind: 'git-worktree' as const
+    },
+    provider: 'codex' as const,
+    agent: 'codex',
+    accountHome: { variable: 'CODEX_HOME' as const, path: '/home/dev/.codex' },
+    runtimeKind: 'native' as const,
+    providerHandle: { kind: 'codex' as const, threadId: THREAD }
+  }
+  const envelope = {
+    sessionId: SESSION,
+    clientOperationId: operationId(),
+    expectedRuntimeFence: fence,
+    payloadFingerprint: ''
+  }
+  return {
+    ...params,
+    envelope: {
+      ...envelope,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.attach',
+        sessionId: SESSION,
+        fields: attachFingerprintFields({ ...params, envelope } as never)
+      })
+    }
+  }
+}
+
+export type StructuredCodexRpcHarness = {
+  codex: FakeCodex
+  root: string
+  hostConfig: () => Parameters<typeof ensureStructuredAgentSessionHost>[0]
+  envelope: (
+    method: string,
+    fields: Record<string, unknown>,
+    fence: number | null
+  ) => { sessionId: string; clientOperationId: string; expectedRuntimeFence: number | null }
+  createIntentParams: () => Record<string, unknown>
+  /** Runs a one-shot method and returns its decoded reply. */
+  call: (method: string, params: unknown) => Promise<RpcResponse>
+  /** Asserts success and unwraps the host's `{ok:true, value}` mutation result. */
+  ok: <T>(method: string, params: unknown) => Promise<T>
+  dispose: () => Promise<void>
+}
+
+export async function openStructuredCodexRpcHarness(
+  clientCapabilities: readonly RuntimeCapability[] = DEFAULT_CLIENT_CAPABILITIES
+): Promise<StructuredCodexRpcHarness> {
+  const client = { clientId: 'device-a', clientKind: 'runtime' as const, clientCapabilities }
+  let operations = 0
+  const root = await mkdtemp(join(tmpdir(), 'orca-structured-integration-'))
+  const codex = fakeCodex()
+  // `<13-digit ms>-<32 hex>`, the only shape the durable ledger accepts. Real time, not a frozen
+  // constant: the runtime under test stamps the ledger with its own clock and refuses a future id.
+  const operationId = (): string => {
+    operations += 1
+    return `${Date.now()}-${operations.toString(16).padStart(32, '0')}`
+  }
+  const envelope: StructuredCodexRpcHarness['envelope'] = (method, fields, fence) => ({
+    sessionId: SESSION,
+    clientOperationId: operationId(),
+    expectedRuntimeFence: fence,
+    payloadFingerprint: computeAgentSessionPayloadFingerprint({
+      method,
+      sessionId: SESSION,
+      fields
+    })
+  })
+  const hostConfig = (): Parameters<typeof ensureStructuredAgentSessionHost>[0] => ({
+    stateDirectory: root,
+    hostId: 'local',
+    claimKeyId: 'key-1',
+    resolveWorkspacePath: async (workspaceId) => `/repos/${workspaceId}`,
+    resolveCodexCommand: () => '/usr/local/bin/codex',
+    resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true }),
+    resolveEnvironment: async () => ({
+      PATH: '/shell/bin:/usr/bin',
+      EXAMPLE_GATEWAY_TOKEN: 'shell-exported',
+      CODEX_HOME: '/shell/home'
+    }),
+    resolveCodexOverrides: () => ({ CODEX_PROFILE: 'configured' }),
+    openCodexConnection: codex.openConnection,
+    readProcessStartTime: async () => 1_700_000_000_000
+  })
+  const runtime = {
+    getRuntimeId: () => 'runtime-1',
+    getClientSettings: () => ({ experimentalStructuredNativeChat: true }),
+    getStructuredAgentSessionCreateSupport: async () => ({ supported: true }),
+    resolveStructuredAgentSessionCreateIntent: async () => {
+      const {
+        envelope: _envelope,
+        providerHandle: _providerHandle,
+        ...resolved
+      } = attachParams(operationId, null)
+      return resolved
+    },
+    publishStructuredAgentSessionTab: () => {},
+    ensureStructuredAgentSessionHost: () =>
+      ensureStructuredAgentSessionHost(hostConfig()).then(() => undefined),
+    registerOwnedSubscriptionCleanup: vi.fn((_id: string, dispose: () => void) => ({
+      releaseIfCurrent: dispose
+    }))
+  }
+  const dispatcher = new RpcDispatcher({
+    runtime: runtime as unknown as OrcaRuntimeService,
+    methods: STRUCTURED_AGENT_SESSION_METHODS
+  })
+  const call: StructuredCodexRpcHarness['call'] = async (method, params) => {
+    const replies: RpcResponse[] = []
+    const request: RpcRequest = { id: `req-${operations}`, authToken: 'token', method, params }
+    await dispatcher.dispatchStreaming(request, (raw) => replies.push(JSON.parse(raw)), client)
+    const first = replies[0]
+    if (!first) {
+      throw new Error(`no reply for ${method}`)
+    }
+    return first
+  }
+  return {
+    codex,
+    root,
+    hostConfig,
+    envelope,
+    createIntentParams: () => {
+      const worktree = `id:${WORKSPACE}`
+      const fields = { worktree, agent: 'codex' }
+      return { envelope: envelope('agentSession.create', fields, null), ...fields }
+    },
+    call,
+    ok: async <T>(method: string, params: unknown): Promise<T> => {
+      const response = await call(method, params)
+      expect(response, `${method} failed: ${JSON.stringify(response)}`).toMatchObject({ ok: true })
+      const result = (response as { result: { ok: boolean; value?: T; refusal?: unknown } }).result
+      expect(result, `${method} refused: ${JSON.stringify(result.refusal)}`).toMatchObject({
+        ok: true
+      })
+      return result.value as T
+    },
+    dispose: async () => {
+      await stopStructuredAgentSessionRuntime()
+      await rm(root, { recursive: true, force: true })
+    }
+  }
+}
diff --git a/src/main/runtime/structured-session-child-identity-env.test.ts b/src/main/runtime/structured-session-child-identity-env.test.ts
new file mode 100644
index 00000000000..1289e979ad6
--- /dev/null
+++ b/src/main/runtime/structured-session-child-identity-env.test.ts
@@ -0,0 +1,193 @@
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { installFakeAppEnvironment } from '../../../config/scripts/vitest-host-ports-setup'
+
+const shim = vi.hoisted(() => ({ ensureLinuxTerminalOrcaCliShimDir: vi.fn() }))
+vi.mock('../cli/linux-terminal-orca-cli-shim', () => shim)
+
+import { structuredSessionChildIdentityEnv } from './structured-session-child-identity-env'
+import {
+  mintStructuredWorkerHandle,
+  mintStructuredWorkerPaneKey,
+  structuredWorkerHostScope,
+  structuredWorkerIdentities,
+  structuredWorkerProcessIncarnation
+} from './structured-worker-identity'
+
+const SESSION_ID = 'f7a1c0de-1111-4222-8333-444455556666'
+const USER_DATA = '/data/orca'
+const RESOURCES = '/app/Resources'
+const SHIM_DIR = join(USER_DATA, 'linux-orca-cli-shim')
+
+const platformDescriptor = Object.getOwnPropertyDescriptor(process, 'platform')!
+const resourcesDescriptor = Object.getOwnPropertyDescriptor(process, 'resourcesPath')
+
+function pinPlatform(platform: NodeJS.Platform): void {
+  Object.defineProperty(process, 'platform', { configurable: true, value: platform })
+}
+
+function registerWorker(): string {
+  const handle = mintStructuredWorkerHandle()
+  structuredWorkerIdentities.register({
+    handle,
+    sessionId: SESSION_ID,
+    agent: 'claude',
+    paneKey: mintStructuredWorkerPaneKey(SESSION_ID),
+    processIncarnation: structuredWorkerProcessIncarnation(SESSION_ID),
+    worktreeId: 'wt_1',
+    hostScope: { kind: 'local', hostId: 'local' }
+  })
+  return handle
+}
+
+beforeEach(() => {
+  shim.ensureLinuxTerminalOrcaCliShimDir.mockReset()
+  shim.ensureLinuxTerminalOrcaCliShimDir.mockReturnValue(SHIM_DIR)
+  Object.defineProperty(process, 'resourcesPath', { configurable: true, value: RESOURCES })
+})
+
+afterEach(() => {
+  structuredWorkerIdentities.clear()
+  Object.defineProperty(process, 'platform', platformDescriptor)
+  if (resourcesDescriptor) {
+    Object.defineProperty(process, 'resourcesPath', resourcesDescriptor)
+  } else {
+    Reflect.deleteProperty(process, 'resourcesPath')
+  }
+})
+
+describe('structuredSessionChildIdentityEnv', () => {
+  it("gives an ordinary chat session its own id and this app's CLI, and no terminal identity", () => {
+    // The id names the caller, so a bare `orca orchestration check` acts as this session instead of
+    // guessing a terminal — every guess landed on a sibling pane, and `check` consumed its mail.
+    pinPlatform('linux')
+    installFakeAppEnvironment({ isPackaged: () => true, getPath: () => USER_DATA })
+    const childEnv = { PATH: '/usr/bin' }
+    const env = structuredSessionChildIdentityEnv(SESSION_ID, childEnv)
+    expect(env).toEqual({
+      PATH: `${SHIM_DIR}:/usr/bin`,
+      ORCA_AGENT_SESSION_ID: SESSION_ID,
+      // For a CLI that predates the id, which refuses on it instead of guessing a sibling.
+      ORCA_STRUCTURED_SESSION: '1',
+      ORCA_CLI_COMMAND: join(SHIM_DIR, 'orca'),
+      // The instance that minted the id, so any current CLI dials it rather than the default.
+      ORCA_USER_DATA_PATH: USER_DATA
+    })
+    // A chat names itself by its id alone: no handle, no pane key.
+    expect(env.ORCA_TERMINAL_HANDLE).toBeUndefined()
+    expect(env.ORCA_PANE_KEY).toBeUndefined()
+    expect(childEnv).toEqual({ PATH: '/usr/bin' })
+  })
+
+  it('replaces an id inherited from an Orca launched inside another session', () => {
+    installFakeAppEnvironment({ isPackaged: () => false, getPath: () => USER_DATA })
+    const env = structuredSessionChildIdentityEnv(SESSION_ID, {
+      ORCA_AGENT_SESSION_ID: 'a0b1c2d3-0000-4000-8000-00000000abcd',
+      PATH: '/usr/bin'
+    })
+    expect(env.ORCA_AGENT_SESSION_ID).toBe(SESSION_ID)
+  })
+
+  it('gives a structured worker its id and keeps the handle it was minted', () => {
+    // For orchestration the id wins and the host maps it back to this handle, so the worker keeps
+    // one identity; the handle stays for the handle-based surfaces outside orchestration.
+    installFakeAppEnvironment({ isPackaged: () => false, getPath: () => USER_DATA })
+    const handle = registerWorker()
+    const env = structuredSessionChildIdentityEnv(SESSION_ID, { PATH: '/usr/bin' })
+    expect(env.ORCA_AGENT_SESSION_ID).toBe(SESSION_ID)
+    expect(env.ORCA_TERMINAL_HANDLE).toBe(handle)
+  })
+
+  describe.each(['chat', 'worker'] as const)("reaches this app's CLI as a %s", (kind) => {
+    beforeEach(() => {
+      if (kind === 'worker') {
+        registerWorker()
+      }
+    })
+
+    it('on packaged Linux, through the bare-orca shim, named by absolute path', () => {
+      // Without this the child's first `orca orchestration check` execs GNOME Orca — the CLI
+      // installs as `orca-ide` on Linux (stablyai/orca#7904) — and the dispatch hangs to timeout.
+      pinPlatform('linux')
+      installFakeAppEnvironment({ isPackaged: () => true, getPath: () => USER_DATA })
+      const env = structuredSessionChildIdentityEnv(SESSION_ID, { PATH: '/usr/bin:/bin' })
+      expect(env.ORCA_CLI_COMMAND).toBe(join(SHIM_DIR, 'orca'))
+      expect(env.PATH).toBe(`${SHIM_DIR}:/usr/bin:/bin`)
+    })
+
+    it('on packaged macOS, through the bundled CLI dir', () => {
+      pinPlatform('darwin')
+      installFakeAppEnvironment({ isPackaged: () => true, getPath: () => USER_DATA })
+      const env = structuredSessionChildIdentityEnv(SESSION_ID, { PATH: '/usr/bin' })
+      expect(env.PATH).toBe(`${join(RESOURCES, 'bin')}:/usr/bin`)
+      expect(env.ORCA_CLI_COMMAND).toBe(join(RESOURCES, 'bin', 'orca'))
+    })
+
+    it('on packaged Windows, through the bundled CLI dir under the env block spelling', () => {
+      pinPlatform('win32')
+      installFakeAppEnvironment({ isPackaged: () => true, getPath: () => USER_DATA })
+      const env = structuredSessionChildIdentityEnv(SESSION_ID, { Path: 'C:\\Windows' })
+      expect(env.Path).toBe(`${join(RESOURCES, 'bin')};C:\\Windows`)
+      expect(env.PATH).toBeUndefined()
+      // The native launcher: `orca.cmd` refuses message bodies cmd.exe would mangle.
+      expect(env.ORCA_CLI_COMMAND).toBe(join(RESOURCES, 'bin', 'orca.exe'))
+    })
+
+    it('unpackaged, through the dev launcher dir', () => {
+      pinPlatform('darwin')
+      installFakeAppEnvironment({ isPackaged: () => false, getPath: () => USER_DATA })
+      const env = structuredSessionChildIdentityEnv(SESSION_ID, { PATH: '/usr/bin' })
+      expect(env.PATH).toBe(`${join(USER_DATA, 'cli', 'bin')}:/usr/bin`)
+      expect(env.ORCA_CLI_COMMAND).toBe(join(USER_DATA, 'cli', 'bin', 'orca-dev'))
+    })
+  })
+
+  it('omits the CLI command when no launcher resolves, never naming a bare `orca`', () => {
+    // On packaged Linux the shim can fail to resolve (no bundled launcher, an unverified AppImage);
+    // a bare `orca` there is GNOME's screen reader, and an inherited value names another app's CLI.
+    pinPlatform('linux')
+    installFakeAppEnvironment({ isPackaged: () => true, getPath: () => USER_DATA })
+    shim.ensureLinuxTerminalOrcaCliShimDir.mockReturnValue(null)
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const env = structuredSessionChildIdentityEnv(SESSION_ID, {
+      PATH: '/usr/bin',
+      ORCA_CLI_COMMAND: '/Applications/Other Orca.app/Contents/Resources/bin/orca',
+      ORCA_USER_DATA_PATH: '/data/other-orca'
+    })
+    expect(env).not.toHaveProperty('ORCA_CLI_COMMAND')
+    expect(env.PATH).toBe('/usr/bin')
+    expect(env.ORCA_USER_DATA_PATH).toBe(USER_DATA)
+    expect(console.warn).toHaveBeenCalledOnce()
+  })
+
+  it('never puts a pane key in the child environment', () => {
+    // A pane key here flows into hook-emitted agent statuses and the attestation, agent-row and
+    // mobile-projection pipelines, all of which assume it names a live PTY leaf.
+    pinPlatform('linux')
+    installFakeAppEnvironment({ isPackaged: () => true, getPath: () => USER_DATA })
+    registerWorker()
+    const env = structuredSessionChildIdentityEnv(SESSION_ID, { PATH: '/usr/bin' })
+    expect(env.ORCA_PANE_KEY).toBeUndefined()
+    expect(Object.keys(env).filter((key) => key.includes('PANE'))).toEqual([])
+  })
+
+  it('never names the WSL-scoped launcher, because a structured worker cannot run in WSL', () => {
+    // `orca-ide` is the literal the PTY lane exports for WSL only. A structured session that
+    // resolves to a WSL distro is refused a host scope, so it never becomes a worker at all —
+    // which is why the bare-`orca` shim, not the literal, is the right fix on Linux.
+    expect(
+      structuredWorkerHostScope({
+        executionHostId: 'local',
+        workspaceId: 'wt_1',
+        workspaceKind: 'git-worktree',
+        wslDistro: 'Ubuntu'
+      })
+    ).toBeNull()
+    pinPlatform('linux')
+    installFakeAppEnvironment({ isPackaged: () => true, getPath: () => USER_DATA })
+    registerWorker()
+    expect(
+      structuredSessionChildIdentityEnv(SESSION_ID, { PATH: '/usr/bin' }).ORCA_CLI_COMMAND
+    ).not.toBe('orca-ide')
+  })
+})
diff --git a/src/main/runtime/structured-session-child-identity-env.ts b/src/main/runtime/structured-session-child-identity-env.ts
new file mode 100644
index 00000000000..4d3e85c3414
--- /dev/null
+++ b/src/main/runtime/structured-session-child-identity-env.ts
@@ -0,0 +1,93 @@
+/**
+ * The orchestration identity — and the CLI reachability — a structured session's own child needs to
+ * speak for itself. Both providers' native launches (Claude, Codex) build their child env here.
+ *
+ * Every structured session carries `ORCA_AGENT_SESSION_ID`, the id Orca minted for it — never the
+ * provider's, which rotates on `/clear`. The CLI sends it as the caller, so a bare
+ * `orca orchestration check` acts as this session instead of guessing a terminal: with no pane of
+ * its own, every guess landed on a sibling, and a destructive `check` consumed that sibling's mail.
+ * Identity by session id assumes one machine and one user; crossing a host boundary (SSH, a paired
+ * peer) re-opens that decision, and the host refuses a session claim from across one.
+ *
+ * A dispatched structured worker also keeps the `structworker_` handle it was minted, for the
+ * handle-based surfaces outside orchestration; for orchestration the id wins and the host maps it
+ * back to that handle, so the worker keeps one identity.
+ *
+ * The PATH prepend below makes bare `orca` this app's CLI, the SAME function `buildPtyHostEnv`
+ * applies, rather than a second, drifting copy of the rule. Orca's Linux CLI installs as `orca-ide`
+ * so it never claims GNOME Orca's /usr/bin/orca (stablyai/orca#7904), and on packaged macOS/Windows
+ * the bundled launcher is reachable only from the app's own resources dir.
+ *
+ * `ORCA_CLI_COMMAND` names that same launcher by absolute path, because a provider can run each
+ * command in a login shell (Codex runs `zsh -lc`) whose profile rebuilds PATH and puts a global
+ * install ahead of this app's. A bare `orca` that reaches another install still acts as this
+ * session: any current CLI sends the injected id and dials the instance `ORCA_USER_DATA_PATH` pins
+ * below, and a CLI that predates the id refuses on the marker. When no launcher resolves the key
+ * is omitted rather than naming a bare `orca`: on Linux that is GNOME's screen reader, and an
+ * inherited value names another app.
+ *
+ * `ORCA_USER_DATA_PATH` pins this instance beside the identity, so any current CLI — the session's
+ * own or a global one — dials the Orca that minted the id instead of the production default.
+ *
+ * Deliberately NOT `ORCA_PANE_KEY`. Claude structured sessions run hooks, and a pane key in their
+ * environment starts flowing into hook-emitted agent-status payloads and the hook-attestation,
+ * agent-row and mobile-projection pipelines, every one of which assumes a pane key names a live
+ * PTY leaf. It would also open `selectExactWorkerProviderSession`, which is fail-closed today
+ * precisely because a structured session emits no hook agent status.
+ *
+ * `ORCA_STRUCTURED_SESSION` stays beside the id for a CLI that predates it — one reached through a
+ * global install when a shell rc resets PATH — which would otherwise guess a sibling's terminal;
+ * such a CLI refuses on the marker. A current CLI checks the id first, so the marker never makes a
+ * session with an id identity-less.
+ *
+ * The handle is read from the registry at spawn time, so an in-host recovery respawn re-bakes the
+ * SAME handle rather than a stale or fresh one.
+ */
+
+import { getAppEnvironment, hasAppEnvironment } from '../../shared/app-environment'
+import { ORCA_AGENT_SESSION_ID_ENV } from '../../shared/agent-session-caller-env'
+import { ORCA_STRUCTURED_SESSION_ENV } from '../../shared/structured-session-marker'
+import { prependOrcaCliDirToChildPath } from '../cli/orca-cli-child-path'
+import { structuredWorkerIdentities } from './structured-worker-identity'
+
+export function structuredSessionChildIdentityEnv(
+  sessionId: string,
+  childEnv: Record<string, string>
+): Record<string, string> {
+  const identity = structuredWorkerIdentities.getBySessionId(sessionId)
+  const env: Record<string, string> = {
+    ...childEnv,
+    ...(identity ? { ORCA_TERMINAL_HANDLE: identity.handle } : {}),
+    [ORCA_AGENT_SESSION_ID_ENV]: sessionId,
+    [ORCA_STRUCTURED_SESSION_ENV]: '1'
+  }
+  applyThisAppCli(env)
+  return env
+}
+
+/**
+ * A host with no app environment installed — a plain-Node fork, or a unit test — has no userData
+ * root to resolve, and inventing one would write a shim into the wrong directory.
+ */
+function applyThisAppCli(env: Record<string, string>): void {
+  delete env.ORCA_CLI_COMMAND
+  if (!hasAppEnvironment()) {
+    return
+  }
+  const app = getAppEnvironment()
+  const userDataPath = app.getPath('userData')
+  const isPackaged = app.isPackaged()
+  env.ORCA_USER_DATA_PATH = userDataPath
+  const launcher = prependOrcaCliDirToChildPath(env, {
+    isPackaged,
+    userDataPath,
+    resourcesPath: process.resourcesPath ?? null
+  })
+  if (launcher) {
+    env.ORCA_CLI_COMMAND = launcher
+  } else {
+    console.warn(
+      "[structured-session] This app's CLI launcher did not resolve; the session's child has no ORCA_CLI_COMMAND."
+    )
+  }
+}
diff --git a/src/main/runtime/structured-session-cli-login-shell.live-shell.test.ts b/src/main/runtime/structured-session-cli-login-shell.live-shell.test.ts
new file mode 100644
index 00000000000..c5a9eb769f1
--- /dev/null
+++ b/src/main/runtime/structured-session-cli-login-shell.live-shell.test.ts
@@ -0,0 +1,34 @@
+/**
+ * The zsh arm of `structured-session-cli-login-shell.test.ts`: Codex's own shell on macOS. Runs in
+ * the real-shell lane, which installs zsh; the ordinary unit lane has none.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import {
+  createLoginShellHarness,
+  type LoginShellHarness
+} from './structured-session-login-shell-test-harness'
+
+describe.runIf(process.platform !== 'win32')('a structured session in a zsh login shell', () => {
+  let harness: LoginShellHarness
+
+  beforeEach(() => {
+    harness = createLoginShellHarness()
+  })
+
+  afterEach(() => {
+    harness.dispose()
+  })
+
+  it("resolves this app's CLI through ORCA_CLI_COMMAND in `zsh -lc`", async () => {
+    // Positive control: the profile really does put the global install first for a bare name.
+    expect(await harness.run({ program: '/bin/zsh', args: ['-lc', 'orca'] })).toBe('global')
+    expect(await harness.run({ program: '/bin/zsh', args: ['-lc', '"$ORCA_CLI_COMMAND"'] })).toBe(
+      'app'
+    )
+  })
+
+  it("keeps bare `orca` this app's CLI in a zsh that reads no login profile", async () => {
+    expect(await harness.run({ program: '/bin/zsh', args: ['-c', 'orca'] })).toBe('app')
+  })
+})
diff --git a/src/main/runtime/structured-session-cli-login-shell.test.ts b/src/main/runtime/structured-session-cli-login-shell.test.ts
new file mode 100644
index 00000000000..2079dc44eb6
--- /dev/null
+++ b/src/main/runtime/structured-session-cli-login-shell.test.ts
@@ -0,0 +1,38 @@
+/**
+ * A provider can run every command in a login shell: Codex runs `<shell> -lc <command>`. The login
+ * profile rebuilds PATH — macOS's path_helper, a user's profile — so the directory Orca prepended
+ * ends up behind a global install, and bare `orca` becomes that install, possibly an older Orca.
+ * `ORCA_CLI_COMMAND` names this app's launcher by absolute path, which no startup file can reorder.
+ * The zsh arm lives in `structured-session-cli-login-shell.live-shell.test.ts`, in the real-shell
+ * lane that installs zsh.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import {
+  createLoginShellHarness,
+  type LoginShellHarness
+} from './structured-session-login-shell-test-harness'
+
+describe.runIf(process.platform !== 'win32')('a structured session in a bash login shell', () => {
+  let harness: LoginShellHarness
+
+  beforeEach(() => {
+    harness = createLoginShellHarness()
+  })
+
+  afterEach(() => {
+    harness.dispose()
+  })
+
+  it("resolves this app's CLI through ORCA_CLI_COMMAND in `bash -lc`", async () => {
+    // Positive control: the profile really does put the global install first for a bare name.
+    expect(await harness.run({ program: '/bin/bash', args: ['-lc', 'orca'] })).toBe('global')
+    expect(await harness.run({ program: '/bin/bash', args: ['-lc', '"$ORCA_CLI_COMMAND"'] })).toBe(
+      'app'
+    )
+  })
+
+  it("keeps bare `orca` this app's CLI in a shell that reads no login profile", async () => {
+    expect(await harness.run({ program: '/bin/bash', args: ['-c', 'orca'] })).toBe('app')
+  })
+})
diff --git a/src/main/runtime/structured-session-login-shell-test-harness.ts b/src/main/runtime/structured-session-login-shell-test-harness.ts
new file mode 100644
index 00000000000..943dfe0f4d3
--- /dev/null
+++ b/src/main/runtime/structured-session-login-shell-test-harness.ts
@@ -0,0 +1,48 @@
+/**
+ * A structured session's child env beside a HOME whose login profiles put a stand-in global `orca`
+ * first, as `/usr/local/bin` often is. Shared by the bash suite (every lane) and the zsh suite
+ * (the real-shell lane, which installs zsh).
+ */
+
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { installFakeAppEnvironment } from '../../../config/scripts/vitest-host-ports-setup'
+import { runProcess } from '../../shared/child-process/run-process'
+import { structuredSessionChildIdentityEnv } from './structured-session-child-identity-env'
+
+const SESSION_ID = 'f7a1c0de-1111-4222-8333-444455556666'
+
+export type LoginShellHarness = {
+  /** Runs a shell with the structured session's env and returns its stdout. */
+  run: (spec: { program: string; args: [flag: '-lc' | '-c', script: string] }) => Promise<string>
+  dispose: () => void
+}
+
+function writeStub(path: string, says: string): void {
+  writeFileSync(path, `#!/bin/sh\nprintf '%s' '${says}'\n`)
+  chmodSync(path, 0o755)
+}
+
+export function createLoginShellHarness(): LoginShellHarness {
+  const root = mkdtempSync(join(tmpdir(), 'orca-login-shell-cli-'))
+  const home = join(root, 'home')
+  const globalBin = join(root, 'global-bin')
+  const userData = join(root, 'user-data')
+  const appCliBin = join(userData, 'cli', 'bin')
+  for (const dir of [home, globalBin, appCliBin]) {
+    mkdirSync(dir, { recursive: true })
+  }
+  writeStub(join(globalBin, 'orca'), 'global')
+  writeStub(join(appCliBin, 'orca'), 'app')
+  writeStub(join(appCliBin, 'orca-dev'), 'app')
+  const prependGlobal = `export PATH="${globalBin}:$PATH"\n`
+  writeFileSync(join(home, '.zprofile'), prependGlobal)
+  writeFileSync(join(home, '.bash_profile'), prependGlobal)
+  installFakeAppEnvironment({ isPackaged: () => false, getPath: () => userData })
+  const env = structuredSessionChildIdentityEnv(SESSION_ID, { HOME: home, PATH: '/usr/bin:/bin' })
+  return {
+    run: async (spec) => (await runProcess({ ...spec, env })).stdout,
+    dispose: () => rmSync(root, { recursive: true, force: true })
+  }
+}
diff --git a/src/main/runtime/structured-session-mail-redrive-wiring.test.ts b/src/main/runtime/structured-session-mail-redrive-wiring.test.ts
new file mode 100644
index 00000000000..d7779112cc6
--- /dev/null
+++ b/src/main/runtime/structured-session-mail-redrive-wiring.test.ts
@@ -0,0 +1,65 @@
+// The production wiring of the idle-edge mail redrive: the host the runtime installs must report
+// every status change to the runtime's mail redrive. The integration test installs its own callback,
+// so without this nothing pins the line that connects the two in the real app.
+
+import { describe, expect, it, vi } from 'vitest'
+import type { AgentSessionStatusSummary } from '../../shared/agent-session-wire'
+import type * as StructuredAgentSessionRuntime from './structured-agent-session-runtime'
+import type { StructuredAgentSessionRuntimeDeps } from './structured-agent-session-runtime'
+
+const installed = vi.hoisted((): { deps: StructuredAgentSessionRuntimeDeps | null } => ({
+  deps: null
+}))
+
+vi.mock('./structured-agent-session-runtime', async (importOriginal) => ({
+  ...(await importOriginal<typeof StructuredAgentSessionRuntime>()),
+  ensureStructuredAgentSessionHost: vi.fn(async (deps: StructuredAgentSessionRuntimeDeps) => {
+    installed.deps = deps
+    return {}
+  })
+}))
+
+const { OrcaRuntimeService } = await import('./orca-runtime')
+const { OrchestrationDb } = await import('./orchestration/db')
+
+describe("the runtime's own structured host install", () => {
+  it('reports every session status change to the mail redrive', async () => {
+    const runtime = new OrcaRuntimeService()
+    const redrive = vi
+      .spyOn(runtime, 'onStructuredSessionStatusForMail')
+      .mockImplementation(() => {})
+    await runtime.ensureStructuredAgentSessionHost()
+    const summary: AgentSessionStatusSummary = {
+      sessionId: 'claude_1234abcd',
+      workspaceId: 'workspace-1',
+      agent: 'claude',
+      status: 'idle',
+      latestPrompt: '',
+      updatedAt: 0
+    }
+    try {
+      installed.deps?.onSessionStatusChanged?.(summary, { replay: false })
+    } catch {
+      // The same callback's rename half needs a store this bare runtime does not have.
+    }
+    expect(redrive).toHaveBeenCalledWith(summary)
+  })
+
+  it('logs a redrive the database fails, so the status callback goes on to the workspace rename', () => {
+    const runtime = new OrcaRuntimeService()
+    const closed = new OrchestrationDb(':memory:')
+    closed.close()
+    vi.spyOn(runtime, 'getExistingOrchestrationDb').mockReturnValue(closed)
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    expect(() =>
+      runtime.onStructuredSessionStatusForMail({
+        sessionId: '4a1f6c2e-8b3d-4e7a-9c15-0d2b6e8f1a37',
+        status: 'idle'
+      })
+    ).not.toThrow()
+    expect(warn).toHaveBeenCalledWith(
+      '[orchestration] structured session mail redrive failed',
+      expect.objectContaining({ sessionId: '4a1f6c2e-8b3d-4e7a-9c15-0d2b6e8f1a37' })
+    )
+  })
+})
diff --git a/src/main/runtime/structured-session-worktree-teardown.test.ts b/src/main/runtime/structured-session-worktree-teardown.test.ts
index 915fbd52986..f33d7889b31 100644
--- a/src/main/runtime/structured-session-worktree-teardown.test.ts
+++ b/src/main/runtime/structured-session-worktree-teardown.test.ts
@@ -62,8 +62,8 @@ function installHost(options: {
   /**
    * Sessions this host is not holding, so they observe `unverifiable` rather than `live`.
    *
-   * The everyday shape, not an edge case: the provider child belongs to the VISIBLE pane, so any
-   * chat outside the active workspace has already been evicted by the release clock.
+   * The everyday shape, not an edge case: the idle sweep has already put to rest any chat quiet for
+   * its window, on screen or not.
    */
   detached?: Set<string>
   /**
@@ -89,7 +89,13 @@ function installHost(options: {
     }
   }
   hostRef.current = {
-    deps: { store: { listRecords: () => options.records, getRecord: () => null } },
+    deps: {
+      store: {
+        listRecords: () => options.records,
+        getRecord: () => null,
+        getSessionTabId: (sessionId: string) => (visible.has(sessionId) ? `tab-${sessionId}` : null)
+      }
+    },
     hasSession: (sessionId: string) => held.has(sessionId),
     getPersistedVisibleSessionTabIndex: () => ({ present: true, sessionIds: [...visible] }),
     setSessionTabVisibility: async (sessionId: string, isVisible: boolean) => {
diff --git a/src/main/runtime/structured-session-worktree-teardown.ts b/src/main/runtime/structured-session-worktree-teardown.ts
index 46265a16111..3f8ab31b3ec 100644
--- a/src/main/runtime/structured-session-worktree-teardown.ts
+++ b/src/main/runtime/structured-session-worktree-teardown.ts
@@ -27,7 +27,10 @@ import {
 } from '../../shared/execution-host'
 import { STILL_LIVE_DETAIL_PREFIX } from '../../shared/worktree/removal'
 import { getStructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-registry'
-import { observeStructuredWorker } from './structured-worker-authority'
+import {
+  observeStructuredWorker,
+  structuredSessionCloseSettled
+} from './structured-worker-authority'
 import { closeStructuredAgentSessionChild } from './structured-agent-session-close'
 import { retireSettledStructuredWorkerTab } from './structured-agent-session-tab-retirement'
 import type { WorktreePtyHostFence } from './worktree-pty-host-fence'
@@ -86,12 +89,9 @@ export function structuredSessionTeardownHostId(
  * The workspace's structured sessions, split into what belongs to it and what is attached.
  *
  * MEMBERSHIP and LIVENESS answer different questions, and folding them into one list is what let
- * a chat tab outlive its workspace. A provider child is scoped to a VISIBLE pane — the hold that
- * keeps one is `enabled: isVisible && isWorktreeActive`, and dropping the last hold evicts the
- * child after the release grace — so `live` really means "this chat is the visible pane in the
- * active workspace, or was moments ago". Deleting a workspace from the sidebar while a different
- * one is active makes every chat in the target non-live. Those are exactly the sessions a
- * liveness-only list never saw.
+ * a chat tab outlive its workspace. A provider child runs from a send until the idle sweep rests
+ * it, so `live` only means "this chat's agent worked recently", and every chat at rest in the
+ * target is non-live. Those are exactly the sessions a liveness-only list never saw.
  */
 export type StructuredSessionsForWorktree = {
   /** Every session bound to this workspace on the fenced host, attached or not. */
@@ -256,11 +256,10 @@ export async function closeStructuredSessionsForWorktree(
   } = {}
 ): Promise<void> {
   const { runtime, mayRefuse } = options
-  // No `afterClose` for a dispatched worker: `host.close` drops the holds, so nothing keeps a
-  // provider child un-evictable, but the dispatch's redrive subscription and registry entry do
-  // survive until it settles by another verb. That is a bounded leak, not a hazard — and passing
-  // one here would mean resolving a dispatch id per session on a teardown path that must stay
-  // inside the sweep deadline.
+  // No `afterClose` for a dispatched worker: `host.close` stops the child, but the dispatch's
+  // redrive subscription and registry entry survive until it settles by another verb. That is a
+  // bounded leak, not a hazard — and passing one here would mean resolving a dispatch id per
+  // session on a teardown path that must stay inside the sweep deadline.
   for (const session of progress.sessions) {
     // Stops ISSUING new closes once the budget is spent; an in-flight one is left to finish, since
     // nothing here can cancel a provider round trip. Without this, one slow round trip starved
@@ -279,7 +278,7 @@ export async function closeStructuredSessionsForWorktree(
       // Re-observed rather than reusing the close's own reason string: what the user is asked to
       // waive is the state AFTER the attempt, and a close that threw never reached an observation.
       const status = observeStructuredWorker({ sessionId: session.sessionId }).status
-      if (status === 'exited') {
+      if (status === 'exited' || structuredSessionCloseSettled(session.sessionId)) {
         // The re-read can PROVE the exit a failed close could not — it threw past its own
         // observation, or the record's death evidence landed after it read. Refusing on a child
         // that is demonstrably gone is the defect this sweep exists to remove, so take the proof
@@ -307,7 +306,7 @@ export async function closeStructuredSessionsForWorktree(
  * The close path already does this for a session it CLOSED. This is the complement: the members
  * with no attached child, which the close list never contained and nothing else will hide. Their
  * durable reference survives every purge a removal already performs: the renderer drops `unifiedTabsByWorktree` and the main
- * process drops the workspace metadata, and neither touches `visibleSessionIds`. Startup replays
+ * process drops the workspace metadata, and neither touches the chat tab table. Startup replays
  * that index, restores the session from it and republishes the tab, so the chat comes back at the
  * next launch pointing at a workspace that is gone. Worktree ids are path-derived and can be
  * recreated, so a later workspace at the same path inherits the tab — which is the hazard
diff --git a/src/main/runtime/structured-worker-at-rest.test.ts b/src/main/runtime/structured-worker-at-rest.test.ts
new file mode 100644
index 00000000000..28317e4da88
--- /dev/null
+++ b/src/main/runtime/structured-worker-at-rest.test.ts
@@ -0,0 +1,347 @@
+// A structured worker whose agent is at rest: its dispatch keeps it running while open, and once it
+// rests it is still this runtime's worker — mail reaches it — until its chat tab is gone. Whether
+// its process runs is a separate answer, and a close counts a released lease as done.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentSessionRecord } from '../../shared/agent-session-record'
+import { OrchestrationDb } from './orchestration/db'
+
+const hostRef: { current: unknown } = { current: null }
+
+vi.mock('../native-chat/agent-session-wire/structured-agent-session-registry', () => ({
+  getStructuredAgentSessionHost: () => hostRef.current
+}))
+
+const { observeStructuredWorker, resolveStructuredWorkerAuthority, structuredSessionCloseSettled } =
+  await import('./structured-worker-authority')
+const { structuredWorkerOwesWork, structuredWorkerOwned } =
+  await import('./structured-worker-custody')
+const {
+  mintStructuredWorkerHandle,
+  mintStructuredWorkerPaneKey,
+  structuredWorkerIdentities,
+  structuredWorkerProcessIncarnation
+} = await import('./structured-worker-identity')
+const { listAddressableStructuredWorkers } =
+  await import('./orchestration/structured-worker-group-addressing')
+const { closeStructuredAgentSessionChild } = await import('./structured-agent-session-close')
+const { resolveGroupAddress } = await import('./orchestration/groups')
+const { createRestTestRig, foundRestTestChat, IDLE_MS, REST_TEST_SESSION, sweepTicks } =
+  await import('../native-chat/agent-session-wire/structured-agent-session-rest-test-rig')
+
+const SESSION = 'a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d'
+const LOCAL = JSON.stringify({ kind: 'local', hostId: 'local' })
+
+function record(lease: Partial<AgentSessionRecord['lease']>): AgentSessionRecord {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a partial record; the ownership and liveness reads touch only lease, location and provider.
+  return {
+    sessionId: SESSION,
+    provider: 'codex',
+    location: {
+      executionHostId: 'local',
+      wslDistro: null,
+      workspaceId: 'wt_1',
+      workspaceKind: 'git-worktree'
+    },
+    lease: { claimStatus: 'live', deathEvidence: null, runtimeFence: 3, ...lease }
+  } as AgentSessionRecord
+}
+
+function installHost(current: AgentSessionRecord | null, tabs: string[]) {
+  const host = {
+    deps: { store: { getRecord: () => current } },
+    hasSession: () => false,
+    getPersistedVisibleSessionTabIndex: () => ({ present: true, sessionIds: tabs }),
+    setSessionTabVisibility: vi.fn(async (_id: string, visible: boolean) => {
+      tabs.splice(0, tabs.length, ...(visible ? [SESSION] : []))
+    }),
+    close: vi.fn(async () => undefined)
+  }
+  hostRef.current = host
+  return host
+}
+
+let paneKey = ''
+
+function registerWorker(): string {
+  const handle = mintStructuredWorkerHandle()
+  paneKey = mintStructuredWorkerPaneKey(SESSION)
+  structuredWorkerIdentities.register({
+    handle,
+    sessionId: SESSION,
+    agent: 'codex',
+    paneKey,
+    processIncarnation: structuredWorkerProcessIncarnation(SESSION),
+    worktreeId: 'wt_1',
+    hostScope: { kind: 'local', hostId: 'local' }
+  })
+  return handle
+}
+
+beforeEach(() => {
+  structuredWorkerIdentities.clear()
+  hostRef.current = null
+})
+
+describe('an open dispatch keeps its worker running (P2-19 i)', () => {
+  let db: OrchestrationDb
+  beforeEach(() => {
+    db = new OrchestrationDb(':memory:')
+  })
+  afterEach(() => db.close())
+
+  function dispatchWorker(hostScope = LOCAL) {
+    const task = db.createTask({ runId: 'run_legacy_local', spec: 'structured work' })
+    const { dispatch } = db.createStartingWorkerDispatch({
+      taskId: task.id,
+      startOptions: {},
+      creator: { kind: 'system' },
+      maxDepth: 9
+    })
+    db.prepareStartingWorkerAuthority({
+      dispatchId: dispatch.id,
+      handle: mintStructuredWorkerHandle(),
+      paneKey: mintStructuredWorkerPaneKey(SESSION),
+      processIncarnation: structuredWorkerProcessIncarnation(SESSION),
+      worktreeId: 'wt_1',
+      effects: [],
+      setupState: 'not_configured',
+      hostScope,
+      terminalOwnership: 'created'
+    })
+    return dispatch
+  }
+
+  it('answers open while the dispatch starts, runs or stops, and closed once it settles', () => {
+    const dispatch = dispatchWorker()
+    expect(structuredWorkerOwesWork(db, record({}))).toBe(true)
+    db.markWorkerDispatchReady(dispatch.id)
+    expect(structuredWorkerOwesWork(db, record({}))).toBe(true)
+    db.beginWorkerStop(dispatch.id, 'epoch_home')
+    expect(structuredWorkerOwesWork(db, record({}))).toBe(true)
+    db.settleWorkerStop(dispatch.id)
+    expect(structuredWorkerOwesWork(db, record({}))).toBe(false)
+  })
+
+  // Custody is the list state coordinators see: `active` owes work, `reclaimable` does not.
+  it('lets a worker awaiting its coordinator rest, and keeps one whose stop is in doubt', () => {
+    const done = dispatchWorker()
+    db.markWorkerDispatchReady(done.id)
+    db.settleWorkerReport({
+      taskId: done.task_id,
+      dispatchId: done.id,
+      outcome: 'succeeded',
+      result: 'done'
+    })
+    expect(structuredWorkerOwesWork(db, record({}))).toBe(false)
+
+    const doubted = dispatchWorker()
+    db.markWorkerDispatchReady(doubted.id)
+    db.beginWorkerStop(doubted.id, 'epoch_home')
+    db.markWorkerStopUnknown(doubted.id, 'the close was not proven')
+    expect(structuredWorkerOwesWork(db, record({}))).toBe(true)
+  })
+
+  it('keeps a worker at rest after its dispatch settles a group recipient, until its tab goes (P2-19 ii)', () => {
+    const dispatch = dispatchWorker()
+    db.markWorkerDispatchReady(dispatch.id)
+    db.beginWorkerStop(dispatch.id, 'epoch_home')
+    db.settleWorkerStop(dispatch.id)
+    // Settlement forgets the in-memory entry; only the durable row and the record remain.
+    structuredWorkerIdentities.clear()
+    const tabs = [SESSION]
+    installHost(
+      record({
+        claimStatus: 'released',
+        deathEvidence: { kind: 'exit-observed', detail: 'stopped by the sweep', observedAt: 1 }
+      }),
+      tabs
+    )
+    const handle = db.getWorkerTerminalResourceByOwner(dispatch.id)!.terminal_handle
+    const recipients = () => listAddressableStructuredWorkers(db)
+
+    expect(recipients()).toEqual([{ handle, worktreeId: 'wt_1', agentIdentity: 'codex' }])
+    expect(resolveGroupAddress('@codex', 'term_sender', recipients(), () => 'idle')).toEqual([
+      handle
+    ])
+    expect(resolveGroupAddress('@claude', 'term_sender', recipients(), () => 'idle')).toEqual([])
+    // Direct mail resolves the same worker through the same ownership answer.
+    expect(resolveStructuredWorkerAuthority(handle, db)?.identity.handle).toBe(handle)
+
+    tabs.length = 0
+    expect(recipients()).toEqual([])
+    expect(resolveStructuredWorkerAuthority(handle, db)).toBeNull()
+  })
+
+  it('stops routing to a worker its coordinator abandoned and then released, and keeps its tab', () => {
+    const dispatch = dispatchWorker()
+    db.markWorkerDispatchReady(dispatch.id)
+    structuredWorkerIdentities.clear()
+    const tabs = [SESSION]
+    installHost(
+      record({
+        claimStatus: 'released',
+        deathEvidence: { kind: 'exit-observed', detail: 'stopped by the sweep', observedAt: 1 }
+      }),
+      tabs
+    )
+    const resource = db.getWorkerTerminalResourceByOwner(dispatch.id)!
+    const handle = resource.terminal_handle
+    const recipients = () => listAddressableStructuredWorkers(db)
+    // At rest, its dispatch abandoned: still a recipient, as a terminal worker left running is.
+    db.abandonWorkerDispatch(dispatch.id)
+    const worktreeGroup = () =>
+      resolveGroupAddress('@worktree:wt_1', 'term_sender', recipients(), () => 'idle')
+    expect(worktreeGroup()).toEqual([handle])
+    expect(resolveStructuredWorkerAuthority(handle, db)).not.toBeNull()
+
+    // The release finds the agent at rest, so it settles as released.
+    expect(db.requestWorkerTerminalRelease(dispatch.id)).toMatchObject({ disposition: 'retained' })
+    expect(
+      db.settleDeadWorkerTerminalRelease({
+        requestingDispatchId: dispatch.id,
+        resourceId: resource.id,
+        processIncarnation: resource.process_incarnation!
+      })
+    ).toMatchObject({ disposition: 'released' })
+
+    expect(tabs).toEqual([SESSION])
+    expect(worktreeGroup()).toEqual([])
+    // Direct mail routes through the same answer.
+    expect(resolveStructuredWorkerAuthority(handle, db)).toBeNull()
+  })
+
+  it('reads only this host scope, and no database answers no', () => {
+    dispatchWorker(JSON.stringify({ kind: 'ssh', targetId: 'elsewhere' }))
+    expect(structuredWorkerOwesWork(db, record({}))).toBe(false)
+    expect(structuredWorkerOwesWork(null, record({}))).toBe(false)
+  })
+})
+
+describe('ownership, not liveness (P2-19 ii-iv, P2-26)', () => {
+  it('owns a worker at rest while its tab is listed, and routes mail to it', () => {
+    const handle = registerWorker()
+    installHost(
+      record({
+        claimStatus: 'released',
+        deathEvidence: { kind: 'exit-observed', detail: 'stopped', observedAt: 1 }
+      }),
+      [SESSION]
+    )
+
+    expect(structuredWorkerOwned(SESSION)).toBe(true)
+    expect(observeStructuredWorker({ sessionId: SESSION }).status).toBe('exited')
+    expect(resolveStructuredWorkerAuthority(handle, null)?.identity.paneKey).toBe(paneKey)
+  })
+
+  it('retires a released worker whose tab is gone', () => {
+    const handle = registerWorker()
+    installHost(record({ claimStatus: 'released' }), [])
+
+    expect(structuredWorkerOwned(SESSION)).toBe(false)
+    expect(resolveStructuredWorkerAuthority(handle, null)).toBeNull()
+  })
+
+  it('keeps authority for a live session that has no tab', () => {
+    const handle = registerWorker()
+    installHost(record({ claimStatus: 'live' }), [])
+
+    expect(structuredWorkerOwned(SESSION)).toBe(true)
+    expect(resolveStructuredWorkerAuthority(handle, null)).not.toBeNull()
+  })
+
+  it('cannot answer without a host', () => {
+    expect(structuredWorkerOwned(SESSION)).toBeNull()
+  })
+})
+
+describe('a close whose stop could not be proven (P2-30)', () => {
+  it('closes on the first attempt, keeps the tab retired and leaves the verdict alone', async () => {
+    const released = record({ claimStatus: 'released', deathEvidence: null })
+    const tabs = [SESSION]
+    const host = installHost(released, tabs)
+    expect(observeStructuredWorker({ sessionId: SESSION }).status).toBe('unverifiable')
+
+    const outcome = await closeStructuredAgentSessionChild(SESSION)
+    expect(outcome).toMatchObject({ stopped: true, closeAttempted: true })
+    expect(host.close).toHaveBeenCalledOnce()
+    expect(tabs).toEqual([])
+    expect(host.setSessionTabVisibility).not.toHaveBeenCalledWith(SESSION, true)
+    expect(released.lease.deathEvidence).toBeNull()
+    expect(structuredSessionCloseSettled(SESSION)).toBe(true)
+  })
+
+  it('still refuses a close that left the lease live', () => {
+    installHost(record({ claimStatus: 'live' }), [SESSION])
+    expect(structuredSessionCloseSettled(SESSION)).toBe(false)
+  })
+})
+
+describe('a task dispatched into a worker whose own dispatch settled', () => {
+  it('keeps the worker running while that task is open, and lets it rest once the task settles', async () => {
+    const db = new OrchestrationDb(':memory:')
+    const rig = await createRestTestRig({
+      hasOpenDispatch: (current) => structuredWorkerOwesWork(db, current)
+    })
+    try {
+      hostRef.current = rig.host
+      await foundRestTestChat(rig)
+      const incarnation = structuredWorkerProcessIncarnation(REST_TEST_SESSION)
+      const handle = mintStructuredWorkerHandle()
+      const workerPane = mintStructuredWorkerPaneKey(REST_TEST_SESSION)
+      const first = db.createTask({ runId: 'run_legacy_local', spec: 'first task' })
+      const { dispatch: started } = db.createStartingWorkerDispatch({
+        taskId: first.id,
+        startOptions: {},
+        creator: { kind: 'system' },
+        maxDepth: 9
+      })
+      db.prepareStartingWorkerAuthority({
+        dispatchId: started.id,
+        handle,
+        paneKey: workerPane,
+        processIncarnation: incarnation,
+        worktreeId: 'wt_1',
+        effects: [],
+        setupState: 'not_configured',
+        hostScope: LOCAL,
+        terminalOwnership: 'created'
+      })
+      db.markWorkerDispatchReady(started.id)
+      expect(
+        db.settleWorkerReport({
+          taskId: first.id,
+          dispatchId: started.id,
+          outcome: 'succeeded',
+          result: 'done'
+        })
+      ).toMatchObject({ action: 'settled' })
+      // The coordinator hands the same worker its next task: a dispatch with no worker row.
+      const second = db.createTask({ runId: 'run_legacy_local', spec: 'second task' })
+      const handedOn = db.createDispatchContext({
+        taskId: second.id,
+        assigneeHandle: handle,
+        assigneePaneKey: workerPane,
+        processIncarnation: incarnation,
+        creator: { kind: 'system' },
+        maxDepth: 9
+      })
+      rig.clock.now += 2 * IDLE_MS
+
+      await sweepTicks(12)
+      expect(rig.adapter.closeSession).not.toHaveBeenCalled()
+      expect(observeStructuredWorker({ sessionId: REST_TEST_SESSION }).status).toBe('live')
+
+      db.completeDispatch(handedOn.id)
+      rig.clock.now += IDLE_MS + 1
+      await vi.waitFor(() =>
+        expect(observeStructuredWorker({ sessionId: REST_TEST_SESSION }).status).toBe('exited')
+      )
+      expect(rig.adapter.closeSession).toHaveBeenCalledWith(REST_TEST_SESSION)
+    } finally {
+      hostRef.current = null
+      await rig.dispose()
+      db.close()
+    }
+  })
+})
diff --git a/src/main/runtime/structured-worker-authority.ts b/src/main/runtime/structured-worker-authority.ts
index c11119878f6..24fda6b1456 100644
--- a/src/main/runtime/structured-worker-authority.ts
+++ b/src/main/runtime/structured-worker-authority.ts
@@ -3,18 +3,22 @@
  *
  * The registry holds the handle→session mapping for this process; the durable worker-terminal
  * resource row is what survives a restart, so a miss falls back to rehydrating from it. The
- * durable agent-session record is the liveness half: a session whose claim is conflicted or
- * released, or pinned to another execution host, is no longer this runtime's structured worker.
+ * durable agent-session record, the chat's tab and the orchestration's own resource row decide
+ * custody: see `structured-worker-custody`.
+ * Whether its provider process runs is a separate fact, `observeStructuredWorker`, and routing
+ * never reads it — an agent at rest still receives mail, which starts it.
  */
 
 import type { AgentSessionRecord } from '../../shared/agent-session-record'
+import type { OrcaSessionId } from '../../shared/orca-session-address'
 import type { RuntimeTerminalState } from '../../shared/runtime-types'
 import { getStructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-registry'
 import type { OrchestrationDb } from './orchestration/db'
+import { structuredWorkerAddressable } from './structured-worker-custody'
 import {
   isStructuredWorkerHandle,
   structuredWorkerIdentities,
-  structuredWorkerRecordIsCurrent,
+  structuredWorkerProcessIncarnation,
   type StructuredWorkerIdentity
 } from './structured-worker-identity'
 
@@ -47,7 +51,41 @@ export function resolveStructuredWorkerIdentity(
   return row ? structuredWorkerIdentities.rehydrate(row) : null
 }
 
-/** Identity plus a record that still proves this runtime owns the session. */
+/** The worker identity minted for a session, if that session is a structured worker. */
+export function resolveStructuredWorkerIdentityForSession(
+  sessionId: string,
+  db: OrchestrationDb | null | undefined
+): StructuredWorkerIdentity | null {
+  const known = structuredWorkerIdentities.getBySessionId(sessionId)
+  if (known) {
+    return known
+  }
+  const row = db?.getWorkerTerminalResourceByProcessIncarnation?.(
+    structuredWorkerProcessIncarnation(sessionId)
+  )
+  return row ? structuredWorkerIdentities.rehydrate(row) : null
+}
+
+/**
+ * Whether this session was assigned a Dispatch as a structured worker. Such a session acts with its
+ * worker handle, so one whose handle is gone must not act handle-less, as a chat would.
+ */
+export function isRecordedStructuredWorkerSession(
+  sessionId: OrcaSessionId,
+  db: OrchestrationDb
+): boolean {
+  return Boolean(
+    db.db
+      .prepare(
+        `SELECT 1 FROM dispatch_contexts
+         WHERE assignee_orca_session_id = ? AND process_incarnation = ? LIMIT 1`
+      )
+      .get(sessionId, structuredWorkerProcessIncarnation(sessionId))
+  )
+}
+
+/** Identity plus a record that still proves this runtime owns the session, for a worker its
+ *  orchestration has not released. */
 export function resolveStructuredWorkerAuthority(
   handle: string,
   db: OrchestrationDb | null | undefined
@@ -57,7 +95,14 @@ export function resolveStructuredWorkerAuthority(
     return null
   }
   const record = readStructuredAgentSessionRecord(identity.sessionId)
-  return record && structuredWorkerRecordIsCurrent(record) ? { identity, record } : null
+  return record &&
+    structuredWorkerAddressable(
+      db,
+      identity.sessionId,
+      db?.getWorkerTerminalResourceByHandle?.(identity.handle)
+    )
+    ? { identity, record }
+    : null
 }
 
 /**
@@ -80,6 +125,20 @@ export type StructuredWorkerObservation = {
   reason?: string
 }
 
+/**
+ * Whether a close left nothing running: `exited`, or `unverifiable` on a released lease — a release
+ * whose stop could not be proven, which sent no signal and is left as it is. Closing a chat is the
+ * user's action, and bookkeeping about a process already released must not refuse it.
+ */
+export function structuredSessionCloseSettled(sessionId: string): boolean {
+  const status = observeStructuredWorker({ sessionId }).status
+  return (
+    status === 'exited' ||
+    (status === 'unverifiable' &&
+      readStructuredAgentSessionRecord(sessionId)?.lease.claimStatus === 'released')
+  )
+}
+
 /**
  * The observation as the terminal state every read result reports.
  *
diff --git a/src/main/runtime/structured-worker-child-identity-env.test.ts b/src/main/runtime/structured-worker-child-identity-env.test.ts
deleted file mode 100644
index e966dd55824..00000000000
--- a/src/main/runtime/structured-worker-child-identity-env.test.ts
+++ /dev/null
@@ -1,146 +0,0 @@
-import { join } from 'node:path'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { installFakeAppEnvironment } from '../../../config/scripts/vitest-host-ports-setup'
-
-const shim = vi.hoisted(() => ({ ensureLinuxTerminalOrcaCliShimDir: vi.fn() }))
-vi.mock('../cli/linux-terminal-orca-cli-shim', () => shim)
-
-import { structuredWorkerChildIdentityEnv } from './structured-worker-child-identity-env'
-import {
-  mintStructuredWorkerHandle,
-  mintStructuredWorkerPaneKey,
-  structuredWorkerHostScope,
-  structuredWorkerIdentities,
-  structuredWorkerProcessIncarnation
-} from './structured-worker-identity'
-
-const SESSION_ID = 'f7a1c0de-1111-4222-8333-444455556666'
-const USER_DATA = '/data/orca'
-const RESOURCES = '/app/Resources'
-const SHIM_DIR = join(USER_DATA, 'linux-orca-cli-shim')
-
-const platformDescriptor = Object.getOwnPropertyDescriptor(process, 'platform')!
-const resourcesDescriptor = Object.getOwnPropertyDescriptor(process, 'resourcesPath')
-
-function pinPlatform(platform: NodeJS.Platform): void {
-  Object.defineProperty(process, 'platform', { configurable: true, value: platform })
-}
-
-function registerWorker(): string {
-  const handle = mintStructuredWorkerHandle()
-  structuredWorkerIdentities.register({
-    handle,
-    sessionId: SESSION_ID,
-    agent: 'claude',
-    paneKey: mintStructuredWorkerPaneKey(SESSION_ID),
-    processIncarnation: structuredWorkerProcessIncarnation(SESSION_ID),
-    worktreeId: 'wt_1',
-    hostScope: { kind: 'local', hostId: 'local' }
-  })
-  return handle
-}
-
-beforeEach(() => {
-  shim.ensureLinuxTerminalOrcaCliShimDir.mockReset()
-  shim.ensureLinuxTerminalOrcaCliShimDir.mockReturnValue(SHIM_DIR)
-  Object.defineProperty(process, 'resourcesPath', { configurable: true, value: RESOURCES })
-})
-
-afterEach(() => {
-  structuredWorkerIdentities.clear()
-  Object.defineProperty(process, 'platform', platformDescriptor)
-  if (resourcesDescriptor) {
-    Object.defineProperty(process, 'resourcesPath', resourcesDescriptor)
-  } else {
-    Reflect.deleteProperty(process, 'resourcesPath')
-  }
-})
-
-describe('structuredWorkerChildIdentityEnv', () => {
-  it('marks an ordinary chat session as having NO identity, and grants it nothing', () => {
-    // The marker names nothing — no handle, no pane key, no session id, no token — so it cannot be
-    // replayed or impersonated, and it does not reach the hook, agent-row or mobile-projection
-    // pipelines a pane key would. Its only job is to let the CLI REFUSE instead of guessing: this
-    // session has no pane, so every implicit-terminal guess resolved to a sibling, and a
-    // destructive `check` then consumed that sibling's mail.
-    pinPlatform('linux')
-    installFakeAppEnvironment({ isPackaged: () => true, getPath: () => USER_DATA })
-    const childEnv = { PATH: '/usr/bin' }
-    const env = structuredWorkerChildIdentityEnv(SESSION_ID, childEnv)
-    expect(env).toEqual({ PATH: '/usr/bin', ORCA_STRUCTURED_SESSION: '1' })
-    expect(env.ORCA_TERMINAL_HANDLE).toBeUndefined()
-    expect(env.ORCA_PANE_KEY).toBeUndefined()
-    expect(env.ORCA_CLI_COMMAND).toBeUndefined()
-    // Still no CLI reachability granted, so packaged builds keep today's exposure.
-    expect(childEnv.PATH).toBe('/usr/bin')
-    expect(shim.ensureLinuxTerminalOrcaCliShimDir).not.toHaveBeenCalled()
-  })
-
-  it('gives a packaged-Linux worker the bare-orca shim its ORCA_CLI_COMMAND assumes', () => {
-    // Without this the child's first `orca orchestration check` execs GNOME Orca — the CLI
-    // installs as `orca-ide` on Linux (stablyai/orca#7904) — and the dispatch hangs to timeout.
-    pinPlatform('linux')
-    installFakeAppEnvironment({ isPackaged: () => true, getPath: () => USER_DATA })
-    const handle = registerWorker()
-    const env = structuredWorkerChildIdentityEnv(SESSION_ID, { PATH: '/usr/bin:/bin' })
-    expect(env.ORCA_TERMINAL_HANDLE).toBe(handle)
-    expect(env.ORCA_CLI_COMMAND).toBe('orca')
-    expect(env.PATH).toBe(`${SHIM_DIR}:/usr/bin:/bin`)
-  })
-
-  it('gives a packaged-macOS worker the bundled CLI dir', () => {
-    pinPlatform('darwin')
-    installFakeAppEnvironment({ isPackaged: () => true, getPath: () => USER_DATA })
-    registerWorker()
-    const env = structuredWorkerChildIdentityEnv(SESSION_ID, { PATH: '/usr/bin' })
-    expect(env.PATH).toBe(`${join(RESOURCES, 'bin')}:/usr/bin`)
-  })
-
-  it('gives a packaged-Windows worker the bundled CLI dir under the env block spelling', () => {
-    pinPlatform('win32')
-    installFakeAppEnvironment({ isPackaged: () => true, getPath: () => USER_DATA })
-    registerWorker()
-    const env = structuredWorkerChildIdentityEnv(SESSION_ID, { Path: 'C:\\Windows' })
-    expect(env.Path).toBe(`${join(RESOURCES, 'bin')};C:\\Windows`)
-    expect(env.PATH).toBeUndefined()
-  })
-
-  it('gives an unpackaged worker the dev launcher dir', () => {
-    pinPlatform('darwin')
-    installFakeAppEnvironment({ isPackaged: () => false, getPath: () => USER_DATA })
-    registerWorker()
-    const env = structuredWorkerChildIdentityEnv(SESSION_ID, { PATH: '/usr/bin' })
-    expect(env.PATH).toBe(`${join(USER_DATA, 'cli', 'bin')}:/usr/bin`)
-  })
-
-  it('never puts a pane key in the child environment', () => {
-    // A pane key here flows into hook-emitted agent statuses and the attestation, agent-row and
-    // mobile-projection pipelines, all of which assume it names a live PTY leaf.
-    pinPlatform('linux')
-    installFakeAppEnvironment({ isPackaged: () => true, getPath: () => USER_DATA })
-    registerWorker()
-    const env = structuredWorkerChildIdentityEnv(SESSION_ID, { PATH: '/usr/bin' })
-    expect(env.ORCA_PANE_KEY).toBeUndefined()
-    expect(Object.keys(env).filter((key) => key.includes('PANE'))).toEqual([])
-  })
-
-  it('never names the WSL-scoped launcher, because a structured worker cannot run in WSL', () => {
-    // `orca-ide` is the literal the PTY lane exports for WSL only. A structured session that
-    // resolves to a WSL distro is refused a host scope, so it never becomes a worker at all —
-    // which is why the bare-`orca` shim, not the literal, is the right fix on Linux.
-    expect(
-      structuredWorkerHostScope({
-        executionHostId: 'local',
-        workspaceId: 'wt_1',
-        workspaceKind: 'git-worktree',
-        wslDistro: 'Ubuntu'
-      })
-    ).toBeNull()
-    pinPlatform('linux')
-    installFakeAppEnvironment({ isPackaged: () => true, getPath: () => USER_DATA })
-    registerWorker()
-    expect(
-      structuredWorkerChildIdentityEnv(SESSION_ID, { PATH: '/usr/bin' }).ORCA_CLI_COMMAND
-    ).not.toBe('orca-ide')
-  })
-})
diff --git a/src/main/runtime/structured-worker-child-identity-env.ts b/src/main/runtime/structured-worker-child-identity-env.ts
deleted file mode 100644
index 6cf9f46e910..00000000000
--- a/src/main/runtime/structured-worker-child-identity-env.ts
+++ /dev/null
@@ -1,74 +0,0 @@
-/**
- * The orchestration identity — and the CLI reachability — a structured worker's own child needs
- * to speak for itself.
- *
- * Without `ORCA_TERMINAL_HANDLE` the worker's Bash tool has nothing to pass as `--from`, and
- * `resolveOrchestrationTerminalHandle` falls back to a cwd lookup that returns whichever leaf in
- * the worktree comes first. Two attacks follow from that: a bare `check` reads and consumes a
- * SIBLING's dispatch mailbox, and a bare `send --type worker_done` can settle a sibling's
- * context-only dispatch, a tier that has no capability token to reject on.
- *
- * `ORCA_CLI_COMMAND: 'orca'` is honest ONLY because of the PATH prepend below. Orca's Linux CLI
- * installs as `orca-ide` so it never claims GNOME Orca's /usr/bin/orca (stablyai/orca#7904), and
- * on packaged macOS/Windows the bundled launcher is reachable only from the app's own resources
- * dir. A PTY worker gets that treatment from `buildPtyHostEnv`; a structured worker has no PTY,
- * so it applies the SAME function here rather than a second, drifting copy of the rule.
- *
- * Deliberately NOT `ORCA_PANE_KEY`. Claude structured sessions run hooks, and a pane key in their
- * environment starts flowing into hook-emitted agent-status payloads and the hook-attestation,
- * agent-row and mobile-projection pipelines, every one of which assumes a pane key names a live
- * PTY leaf. It would also open `selectExactWorkerProviderSession`, which is fail-closed today
- * precisely because a structured session emits no hook agent status. The CLI needs none of it once
- * the handle is present.
- *
- * A session that is not a dispatched worker gets ONE variable, `ORCA_STRUCTURED_SESSION`, and it
- * names nothing: no handle, no pane key, no session id, no token. Its only meaning is "this child
- * is a structured session with no orchestration identity", which is what a verb needs in order to
- * REFUSE rather than guess one. Because it names nothing it cannot be replayed, cannot impersonate,
- * and cannot flow into the hook, agent-row or mobile-projection pipelines the way a pane key would
- * — which is why it is a different decision from withholding `ORCA_PANE_KEY`, not a reversal of it.
- * Without it, `check` fell through to the active-terminal guess and destructively consumed a
- * SIBLING pane's oldest unread batch; `requireUnambiguous` only narrows that, because with exactly
- * one terminal pane in the worktree the guess still resolves — to a sibling.
- *
- * The handle is read from the registry at spawn time, so an in-host recovery respawn re-bakes the
- * SAME handle rather than a stale or fresh one.
- */
-
-import { getAppEnvironment, hasAppEnvironment } from '../../shared/app-environment'
-import { prependOrcaCliDirToChildPath } from '../cli/orca-cli-child-path'
-import { ORCA_STRUCTURED_SESSION_ENV } from '../../shared/structured-session-marker'
-import { structuredWorkerIdentities } from './structured-worker-identity'
-
-export function structuredWorkerChildIdentityEnv(
-  sessionId: string,
-  childEnv: Record<string, string>
-): Record<string, string> {
-  const identity = structuredWorkerIdentities.getBySessionId(sessionId)
-  if (!identity) {
-    return { ...childEnv, [ORCA_STRUCTURED_SESSION_ENV]: '1' }
-  }
-  const env: Record<string, string> = {
-    ...childEnv,
-    ORCA_TERMINAL_HANDLE: identity.handle,
-    ORCA_CLI_COMMAND: 'orca'
-  }
-  applyOrcaCliPath(env)
-  return env
-}
-
-/**
- * A host with no app environment installed — a plain-Node fork, or a unit test — has no userData
- * root to resolve, and inventing one would write a shim into the wrong directory.
- */
-function applyOrcaCliPath(env: Record<string, string>): void {
-  if (!hasAppEnvironment()) {
-    return
-  }
-  const app = getAppEnvironment()
-  prependOrcaCliDirToChildPath(env, {
-    isPackaged: app.isPackaged(),
-    userDataPath: app.getPath('userData'),
-    resourcesPath: process.resourcesPath ?? null
-  })
-}
diff --git a/src/main/runtime/structured-worker-custody.ts b/src/main/runtime/structured-worker-custody.ts
new file mode 100644
index 00000000000..54e42b24d80
--- /dev/null
+++ b/src/main/runtime/structured-worker-custody.ts
@@ -0,0 +1,133 @@
+/**
+ * Whether orchestration still holds a structured worker, the one answer every reader derives from.
+ *
+ * Custody is the orchestration's own worker-terminal state, the list state `worker-list` shows
+ * coordinators, never whether the worker's process runs: a worker at rest is still held, and mail
+ * starts it. Routing, group addressing and `worker-show` ask whether it is addressable; the idle
+ * sweep asks whether it still owes work.
+ *
+ * Two policy decisions live here and nowhere else: only `released` ends addressability (a release
+ * pending or in doubt still routes, as for a terminal worker), and a settled worker awaiting its
+ * coordinator's decision (`reclaimable`) owes no work, so it may rest.
+ */
+
+import type { AgentSessionRecord } from '../../shared/agent-session-record'
+import type { OrchestrationDb } from './orchestration/db'
+import type { WorkerDispatchState } from './orchestration/types'
+import {
+  deriveWorkerTerminalListState,
+  type WorkerTerminalResourceRow
+} from './orchestration/worker-terminal-ownership'
+import { getStructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-registry'
+import {
+  structuredWorkerHostScope,
+  structuredWorkerProcessIncarnation,
+  structuredWorkerRecordIsCurrent
+} from './structured-worker-identity'
+
+/**
+ * Whether this runtime still owns the worker's session: routing, addressing and authority ask
+ * this, never whether its process runs. Null when the host is not installed, because reading the
+ * record store would install it — not being able to look is not an answer.
+ */
+export function structuredWorkerOwned(sessionId: string): boolean | null {
+  const host = getStructuredAgentSessionHost()
+  if (!host) {
+    return null
+  }
+  let record: AgentSessionRecord | null
+  try {
+    record = host.deps.store.getRecord(sessionId)
+  } catch {
+    record = null
+  }
+  return structuredWorkerRecordIsCurrent(
+    record,
+    record?.lease.claimStatus === 'released' && structuredWorkerTabListed(host, sessionId)
+  )
+}
+
+/** Retirement is the tab index: every path that ends a chat for good hides its tab. */
+function structuredWorkerTabListed(
+  host: NonNullable<ReturnType<typeof getStructuredAgentSessionHost>>,
+  sessionId: string
+): boolean {
+  try {
+    return host.getPersistedVisibleSessionTabIndex?.().sessionIds.includes(sessionId) ?? false
+  } catch {
+    return false
+  }
+}
+
+type CustodyRow = Pick<
+  WorkerTerminalResourceRow,
+  'owner_dispatch_id' | 'terminal_handle' | 'ownership_state' | 'release_state'
+>
+
+function ownerState(
+  db: OrchestrationDb | null | undefined,
+  row: CustodyRow
+): WorkerDispatchState | undefined {
+  return (
+    db?.getWorkerDispatch?.(row.owner_dispatch_id)?.state ??
+    db?.getRemoteDispatchAttachment?.(row.owner_dispatch_id)?.state
+  )
+}
+
+/**
+ * The user still owns the chat and orchestration has not released the worker, as with a terminal
+ * worker whose terminal closed. Null when ownership cannot be read. A released worker's chat stays
+ * the user's; nothing routes to it.
+ */
+export function structuredWorkerAddressable(
+  db: OrchestrationDb | null | undefined,
+  sessionId: string,
+  row: CustodyRow | undefined
+): boolean | null {
+  const owned = structuredWorkerOwned(sessionId)
+  if (owned === null) {
+    return null
+  }
+  // Release is read off the row alone, so an owner whose state is unreadable still answers.
+  const custody = row
+    ? deriveWorkerTerminalListState({
+        workerState: ownerState(db, row) ?? 'unsupervised',
+        agentTerminalHandle: row.terminal_handle,
+        resource: row
+      })
+    : null
+  return owned && custody !== 'released'
+}
+
+/**
+ * Work orchestration still owes on this worker, read per sweep tick: any unsettled dispatch
+ * addressed to its incarnation, on a process this host owns a terminal for. That covers its own
+ * worker-start dispatch (whose context stays open while the worker is active, a stop in doubt
+ * included, because a supervised worker's context settles only with it) and any task later
+ * dispatched to it. A `reclaimable` worker's dispatch has settled, so it owes nothing.
+ */
+export function structuredWorkerOwesWork(
+  db: OrchestrationDb | null,
+  record: AgentSessionRecord
+): boolean {
+  const hostScope = structuredWorkerHostScope(record.location)
+  if (!db || !hostScope) {
+    return false
+  }
+  const incarnation = structuredWorkerProcessIncarnation(record.sessionId)
+  const owned = db.db
+    .prepare(
+      `SELECT 1 FROM worker_terminal_resources
+        WHERE process_incarnation = ? AND host_scope IS ? AND ownership_state = 'owned' LIMIT 1`
+    )
+    .get(incarnation, JSON.stringify(hostScope))
+  return (
+    owned !== undefined &&
+    db.db
+      .prepare(
+        `SELECT 1 FROM dispatch_contexts
+          WHERE process_incarnation = ? AND status IN ('pending', 'dispatched') LIMIT 1`
+      )
+      .get(incarnation) !== undefined
+  )
+}
diff --git a/src/main/runtime/structured-worker-identity.test.ts b/src/main/runtime/structured-worker-identity.test.ts
index 98989a85891..17ba897de47 100644
--- a/src/main/runtime/structured-worker-identity.test.ts
+++ b/src/main/runtime/structured-worker-identity.test.ts
@@ -5,7 +5,7 @@ import {
   structuredAgentSessionTabId
 } from '../../shared/structured-agent-session-projection'
 import { selectExactWorkerProviderSession } from './orchestration/worker-provider-session'
-import { structuredWorkerChildIdentityEnv } from './structured-worker-child-identity-env'
+import { structuredSessionChildIdentityEnv } from './structured-session-child-identity-env'
 import {
   StructuredWorkerIdentityRegistry,
   isStructuredWorkerHandle,
@@ -176,18 +176,24 @@ describe('structured worker identity', () => {
   it('keeps a recovered session current across a fence bump', () => {
     // The host bumps the fence on its own transparent crash recovery; fencing identity on it
     // would wedge the SAME worker as identity_unproven forever.
-    expect(structuredWorkerRecordIsCurrent(record({ runtimeFence: 1 }))).toBe(true)
-    expect(structuredWorkerRecordIsCurrent(record({ runtimeFence: 9 }))).toBe(true)
+    expect(structuredWorkerRecordIsCurrent(record({ runtimeFence: 1 }), false)).toBe(true)
+    expect(structuredWorkerRecordIsCurrent(record({ runtimeFence: 9 }), false)).toBe(true)
     expect(structuredWorkerProcessIncarnation(SESSION_ID)).toBe(
       structuredWorkerProcessIncarnation(SESSION_ID)
     )
   })
 
-  it('refuses a conflicted or released session', () => {
+  it('refuses a conflicted session, and a released one whose chat tab is gone', () => {
     // A terminal owner an older build recorded loads conflicted; it is not this worker.
-    expect(structuredWorkerRecordIsCurrent(record({ claimStatus: 'conflicted' }))).toBe(false)
-    expect(structuredWorkerRecordIsCurrent(record({ claimStatus: 'released' }))).toBe(false)
-    expect(structuredWorkerRecordIsCurrent(null)).toBe(false)
+    expect(structuredWorkerRecordIsCurrent(record({ claimStatus: 'conflicted' }), true)).toBe(false)
+    expect(structuredWorkerRecordIsCurrent(record({ claimStatus: 'released' }), false)).toBe(false)
+    expect(structuredWorkerRecordIsCurrent(null, true)).toBe(false)
+  })
+
+  it('keeps a released session with a listed tab: that worker is at rest, not gone', () => {
+    expect(structuredWorkerRecordIsCurrent(record({ claimStatus: 'released' }), true)).toBe(true)
+    // A live lease is owned whether or not a tab shows it.
+    expect(structuredWorkerRecordIsCurrent(record({ claimStatus: 'live' }), false)).toBe(true)
   })
 })
 
@@ -294,9 +300,9 @@ describe('structured workers stay outside the PTY-only fail-closed paths', () =>
       hostScope: { kind: 'local', hostId: 'local' }
     })
     try {
-      const env = structuredWorkerChildIdentityEnv(SESSION_ID, {})
-      // Registered, so this is a populated env — not the empty one an unregistered session gets,
-      // which would satisfy the pane-key assertion for the wrong reason.
+      const env = structuredSessionChildIdentityEnv(SESSION_ID, {})
+      // Registered, so the worker's handle is present; without it the pane-key assertion would pass
+      // for the wrong reason.
       expect(env.ORCA_TERMINAL_HANDLE).toBe(handle)
       expect(Object.keys(env)).not.toContain('ORCA_PANE_KEY')
     } finally {
diff --git a/src/main/runtime/structured-worker-identity.ts b/src/main/runtime/structured-worker-identity.ts
index 5be84c336ae..22a49e11abb 100644
--- a/src/main/runtime/structured-worker-identity.ts
+++ b/src/main/runtime/structured-worker-identity.ts
@@ -25,14 +25,20 @@ import {
   structuredAgentSessionTabId
 } from '../../shared/structured-agent-session-projection'
 import { isTerminalLeafId, makePaneKey, parsePaneKey } from '../../shared/stable-pane-id'
+import { isOrcaSessionId, type OrcaSessionId } from '../../shared/orca-session-address'
+import {
+  STRUCTURED_WORKER_HANDLE_PREFIX,
+  isStructuredWorkerHandle
+} from '../../shared/structured-worker-handle'
 import {
   parseWorkerTerminalHostScope,
   type WorkerTerminalHostScope
 } from './orchestration/worker-terminal-process-liveness'
 
-// Deliberately not `term_`: `issueHandle` revalidates the renderer graph epoch against the
-// renderer-driven leaves map, so a main-minted `term_` leaf evaporates on the next window reload.
-export const STRUCTURED_WORKER_HANDLE_PREFIX = 'structworker_'
+export {
+  STRUCTURED_WORKER_HANDLE_PREFIX,
+  isStructuredWorkerHandle
+} from '../../shared/structured-worker-handle'
 export const STRUCTURED_WORKER_INCARNATION_PREFIX = 'structured:'
 
 export type StructuredWorkerIdentity = {
@@ -46,10 +52,6 @@ export type StructuredWorkerIdentity = {
   hostScope: WorkerTerminalHostScope
 }
 
-export function isStructuredWorkerHandle(handle: string | null | undefined): boolean {
-  return typeof handle === 'string' && handle.startsWith(STRUCTURED_WORKER_HANDLE_PREFIX)
-}
-
 export function mintStructuredWorkerHandle(): string {
   return `${STRUCTURED_WORKER_HANDLE_PREFIX}${randomUUID()}`
 }
@@ -57,12 +59,13 @@ export function mintStructuredWorkerHandle(): string {
 /**
  * A RANDOM leaf, minted once per worker and persisted with the rest of the identity.
  *
- * Emphatically not `structuredAgentSessionPaneKey`, which is a sha256 of the session id. A pane
- * key is an identity credential on its own: `orchestration.check` is identity-gated, not
- * capability-gated, and accepts a caller-supplied `terminalPaneKey` that `getActiveDispatchForIdentity`
- * matches by leaf suffix. A derivable pane key would therefore let anyone who learns a session id —
- * which the tab id embeds in plain text — read and consume that worker's mailbox with no token.
- * PTY pane keys are safe only because their leaf UUID is random; this one has to be too.
+ * Emphatically not `structuredAgentSessionPaneKey`, which is a sha256 of the session id. A request
+ * that names no session — a PTY agent's, or any on the paired-client route, which refuses session
+ * ids — identifies its caller by pane: `orchestration.check` accepts a caller-supplied
+ * `terminalPaneKey` that `getActiveDispatchForIdentity` matches by leaf suffix. A pane key derivable
+ * from the session id, which the tab id embeds in plain text, would let such a request read and
+ * consume this worker's mailbox. On the same-host socket route the session id itself names the
+ * worker with no token, by design; the pane key is no credential there and must not become one.
  *
  * Restart stability comes from persisting the minted key, not from re-deriving it.
  */
@@ -122,6 +125,14 @@ export function sessionIdFromStructuredWorkerIncarnation(
   return sessionId.length > 0 ? sessionId : null
 }
 
+/** The Orca session id a `structured:<sessionId>` incarnation names; null for any other. */
+export function structuredWorkerOrcaSessionIdForIncarnation(
+  processIncarnation: string | null | undefined
+): OrcaSessionId | null {
+  const sessionId = sessionIdFromStructuredWorkerIncarnation(processIncarnation)
+  return sessionId !== null && isOrcaSessionId(sessionId) ? sessionId : null
+}
+
 /** Structured sessions can only exist local and outside WSL; anything else is not our authority. */
 export function structuredWorkerHostScope(
   location: AgentSessionExecutionLocation
@@ -131,19 +142,62 @@ export function structuredWorkerHostScope(
     : null
 }
 
-/** Whether the durable record still describes THIS worker under this host. */
+/**
+ * Whether the durable record still describes THIS worker under this host — ownership, not whether
+ * its process runs. A released lease is a worker at rest while its chat tab is listed; released
+ * with the tab gone is retired. `tabListed` is the persisted tab index's answer.
+ */
 export function structuredWorkerRecordIsCurrent(
-  record: AgentSessionRecord | null | undefined
+  record: AgentSessionRecord | null | undefined,
+  tabListed: boolean
 ): boolean {
   return Boolean(
     record &&
     // Why: a conflicted claim may name a terminal an older build recorded as owner, not this worker.
     record.lease.claimStatus !== 'conflicted' &&
-    record.lease.claimStatus !== 'released' &&
+    (record.lease.claimStatus !== 'released' || tabListed) &&
     structuredWorkerHostScope(record.location)
   )
 }
 
+type StructuredWorkerResourceRow = {
+  terminal_handle: string
+  pane_key: string | null
+  process_incarnation: string | null
+  worktree_id: string | null
+  host_scope: string | null
+}
+
+/** A worker's identity as its durable worker-terminal resource row records it, or null for a row
+ *  that is not a structured worker's or whose pane key does not belong to its own session. */
+export function structuredWorkerIdentityFromRow(
+  row: StructuredWorkerResourceRow
+): StructuredWorkerIdentity | null {
+  const sessionId = sessionIdFromStructuredWorkerIncarnation(row.process_incarnation)
+  const hostScope = parseWorkerTerminalHostScope(row.host_scope)
+  const paneKey = row.pane_key
+  if (
+    !sessionId ||
+    !hostScope ||
+    !row.worktree_id ||
+    !paneKey ||
+    !isStructuredWorkerHandle(row.terminal_handle) ||
+    !persistedStructuredWorkerPaneKeyIsValid(paneKey, sessionId)
+  ) {
+    return null
+  }
+  return {
+    handle: row.terminal_handle,
+    sessionId,
+    // The row does not carry the provider; callers that need it read the durable record.
+    agent: null,
+    paneKey,
+    processIncarnation: structuredWorkerProcessIncarnation(sessionId),
+    worktreeId: row.worktree_id,
+    hostScope
+  }
+}
+
 export class StructuredWorkerIdentityRegistry {
   private readonly byHandle = new Map<string, StructuredWorkerIdentity>()
   private readonly bySessionId = new Map<string, StructuredWorkerIdentity>()
@@ -183,35 +237,9 @@ export class StructuredWorkerIdentityRegistry {
    * only place a structured worker's pane key and host scope outlive this process. A row whose
    * pane key does not belong to its own recorded session is refused rather than trusted.
    */
-  rehydrate(row: {
-    terminal_handle: string
-    pane_key: string | null
-    process_incarnation: string | null
-    worktree_id: string | null
-    host_scope: string | null
-  }): StructuredWorkerIdentity | null {
-    const sessionId = sessionIdFromStructuredWorkerIncarnation(row.process_incarnation)
-    const hostScope = parseWorkerTerminalHostScope(row.host_scope)
-    if (
-      !sessionId ||
-      !hostScope ||
-      !row.worktree_id ||
-      !isStructuredWorkerHandle(row.terminal_handle) ||
-      // The durable row bootstraps the registry after restart, so validate it before registration.
-      !persistedStructuredWorkerPaneKeyIsValid(row.pane_key, sessionId)
-    ) {
-      return null
-    }
-    return this.register({
-      handle: row.terminal_handle,
-      sessionId,
-      // The row does not carry the provider; callers that need it read the durable record.
-      agent: null,
-      paneKey: row.pane_key,
-      processIncarnation: structuredWorkerProcessIncarnation(sessionId),
-      worktreeId: row.worktree_id,
-      hostScope
-    })
+  rehydrate(row: StructuredWorkerResourceRow): StructuredWorkerIdentity | null {
+    const identity = structuredWorkerIdentityFromRow(row)
+    return identity ? this.register(identity) : null
   }
 
   clear(): void {
diff --git a/src/main/runtime/structured-worker-mail-routing.test.ts b/src/main/runtime/structured-worker-mail-routing.test.ts
index c426132b848..0413c7b6fa6 100644
--- a/src/main/runtime/structured-worker-mail-routing.test.ts
+++ b/src/main/runtime/structured-worker-mail-routing.test.ts
@@ -20,9 +20,16 @@ const prototype = OrcaRuntimeWithAdoptTerminalOrphansFromInventory.prototype
 const getLivePaneKey = prototype.getLiveTerminalPaneKey
 const resolveActiveTerminal = prototype.resolveActiveTerminal
 
-function installRecord(lease: { runtimeKind: string; claimStatus: string } | null): void {
+function installRecord(
+  lease: { runtimeKind: string; claimStatus: string } | null,
+  tabListed = false
+): void {
   hostRef.current = lease
     ? {
+        getPersistedVisibleSessionTabIndex: () => ({
+          present: true,
+          sessionIds: tabListed ? [SESSION_ID] : []
+        }),
         deps: {
           store: {
             getRecord: () => ({
@@ -73,10 +80,19 @@ describe('bare-handle direct mail to a structured session', () => {
     )
   })
 
-  it('withholds the pane key when the session is not proven live', () => {
-    // The PTY branch is connected-gated so mail is never routed to a corpse; so is this one.
+  it('routes to a worker at rest, whose agent the mail starts', () => {
+    // Released by the idle sweep with its chat tab still listed: owned, so mail reaches it.
     const handle = registerWorker()
-    installRecord({ runtimeKind: 'native', claimStatus: 'reserved' })
+    installRecord({ runtimeKind: 'native', claimStatus: 'released' }, true)
+    expect(getLivePaneKey.call(paneKeyStub, handle)).toBe(
+      structuredWorkerIdentities.get(handle)!.paneKey
+    )
+  })
+
+  it('withholds the pane key from a retired worker: released, with its tab gone', () => {
+    // Mail is never routed to a worker this runtime no longer owns.
+    const handle = registerWorker()
+    installRecord({ runtimeKind: 'native', claimStatus: 'released' }, false)
     expect(getLivePaneKey.call(paneKeyStub, handle)).toBeNull()
   })
 
diff --git a/src/main/runtime/structured-worker-terminal-read.test.ts b/src/main/runtime/structured-worker-terminal-read.test.ts
index 802b23733bc..e49f24ba1a1 100644
--- a/src/main/runtime/structured-worker-terminal-read.test.ts
+++ b/src/main/runtime/structured-worker-terminal-read.test.ts
@@ -75,22 +75,22 @@ describe('reading a structured worker through the terminal-read path', () => {
     hostRef.current = null
   })
 
-  it('serves the journal as terminal lines, with no dispatch and no capability', () => {
+  it('serves the journal as terminal lines, with no dispatch and no capability', async () => {
     // The defect this pins: a peer has no dispatch id and no coordinator standing, so `worker-read`
     // is closed to it, and `terminal read` threw `terminal_handle_stale` for a perfectly live
     // worker. A peer could not see a structured agent's recent output at all.
     const handle = registerWorker()
     installHost({ items: [message('i1', 'first line\nsecond line'), message('i2', 'done')] })
-    const read = readStructuredWorkerTerminal({ handle, db: null })
+    const read = await readStructuredWorkerTerminal({ handle, db: null })
     expect(read?.tail).toEqual(['[assistant] first line', 'second line', '[assistant] done'])
     expect(read?.status).toBe('running')
     expect(read?.truncated).toBe(false)
   })
 
-  it('honours limit, and claims no cursor space it cannot honour', () => {
+  it('honours limit, and claims no cursor space it cannot honour', async () => {
     const handle = registerWorker()
     installHost({ items: [message('i1', 'a'), message('i2', 'b'), message('i3', 'c')] })
-    const read = readStructuredWorkerTerminal({ handle, db: null, limit: 2 })
+    const read = await readStructuredWorkerTerminal({ handle, db: null, limit: 2 })
     expect(read?.tail).toEqual(['[assistant] b', '[assistant] c'])
     // No index is advertised: the next read re-projects a sliding window, so 0/length would name
     // positions that address different lines by then.
@@ -99,7 +99,7 @@ describe('reading a structured worker through the terminal-read path', () => {
     expect(read?.latestCursor).toBeUndefined()
   })
 
-  it('refuses a cursor read rather than silently misdelivering lines', () => {
+  it('refuses a cursor read rather than silently misdelivering lines', async () => {
     // The PTY cursor indexes an append-only completed-line buffer with a monotone count. This
     // window is a bounded tail re-projected every read, so a saved index addresses different lines
     // as the journal grows — and `truncated` could never fire to say so, because it tests
@@ -107,14 +107,10 @@ describe('reading a structured worker through the terminal-read path', () => {
     // duplicated lines with `truncated:false`.
     const handle = registerWorker()
     installHost({ items: [message('i1', 'a')] })
-    const refusal = (() => {
-      try {
-        readStructuredWorkerTerminal({ handle, db: null, cursor: 0 })
-        return ''
-      } catch (error) {
-        return (error as Error).message
-      }
-    })()
+    const refusal = await readStructuredWorkerTerminal({ handle, db: null, cursor: 0 }).then(
+      () => '',
+      (error: unknown) => (error instanceof Error ? error.message : String(error))
+    )
     expect(refusal).toMatch(/not line-addressable/)
     // Tells the caller what DOES work here. Polling a bounded newest-last tail and diffing fails
     // safe — a harmless re-read — where a broken cursor fails unsafe, as a silent hole.
@@ -125,35 +121,35 @@ describe('reading a structured worker through the terminal-read path', () => {
     expect(refusal).not.toContain('worker-read')
   })
 
-  it('reports dropped history as truncated rather than pretending the page is whole', () => {
+  it('reports dropped history as truncated rather than pretending the page is whole', async () => {
     const handle = registerWorker()
     installHost({ items: [message('i1', 'tail only')], hasOlder: true })
-    expect(readStructuredWorkerTerminal({ handle, db: null })?.truncated).toBe(true)
+    expect((await readStructuredWorkerTerminal({ handle, db: null }))?.truncated).toBe(true)
   })
 
-  it('redacts dispatch capability tokens the same way the archive path does', () => {
+  it('redacts dispatch capability tokens the same way the archive path does', async () => {
     const handle = registerWorker()
     const token = `dcap_${'a'.repeat(32)}`
     installHost({ items: [message('i1', `token is ${token} here`)] })
-    const tail = readStructuredWorkerTerminal({ handle, db: null })?.tail.join('\n') ?? ''
+    const tail = (await readStructuredWorkerTerminal({ handle, db: null }))?.tail.join('\n') ?? ''
     expect(tail).not.toContain(token)
     expect(tail).toContain('[dispatch capability redacted]')
   })
 
-  it('refuses when the session is not attached rather than answering an empty tail', () => {
+  it('refuses when the session is not attached rather than answering an empty tail', async () => {
     // An empty tail is the claim "this worker has produced no output", which is a different and
     // false statement — and the one a caller cannot tell apart from a real silence.
     const handle = registerWorker()
     installHost({ items: 'unreadable' })
-    expect(() => readStructuredWorkerTerminal({ handle, db: null })).toThrow(
+    await expect(readStructuredWorkerTerminal({ handle, db: null })).rejects.toThrow(
       'agent_session_ownership_unknown'
     )
   })
 
-  it('reports a session it cannot verify as unknown, never as running', () => {
+  it('reports a session it cannot verify as unknown, never as running', async () => {
     const handle = registerWorker()
     installHost({ items: [message('i1', 'said something')], hasSession: false })
-    expect(readStructuredWorkerTerminal({ handle, db: null })?.status).toBe('unknown')
+    expect((await readStructuredWorkerTerminal({ handle, db: null }))?.status).toBe('unknown')
   })
 
   it('is what `terminal read` answers with, ahead of the PTY lookup', async () => {
@@ -182,15 +178,15 @@ describe('reading a structured worker through the terminal-read path', () => {
     })
   })
 
-  it('leaves every handle that is not a live structured worker to the PTY path', () => {
+  it('leaves every handle that is not a live structured worker to the PTY path', async () => {
     const handle = registerWorker()
     installHost({ items: [message('i1', 'x')] })
-    expect(readStructuredWorkerTerminal({ handle: 'term_abc', db: null })).toBeNull()
+    expect(await readStructuredWorkerTerminal({ handle: 'term_abc', db: null })).toBeNull()
     // A terminal owner an older build recorded loads conflicted: not this runtime's worker.
     installHost({
       items: [message('i1', 'x')],
       lease: { runtimeKind: 'native', claimStatus: 'conflicted' }
     })
-    expect(readStructuredWorkerTerminal({ handle, db: null })).toBeNull()
+    expect(await readStructuredWorkerTerminal({ handle, db: null })).toBeNull()
   })
 })
diff --git a/src/main/runtime/structured-worker-terminal-read.ts b/src/main/runtime/structured-worker-terminal-read.ts
index 9b4a118b8ae..60dd1126067 100644
--- a/src/main/runtime/structured-worker-terminal-read.ts
+++ b/src/main/runtime/structured-worker-terminal-read.ts
@@ -29,7 +29,7 @@
  */
 
 import type { RuntimeTerminalRead } from '../../shared/runtime-types'
-import { formatWorkerTranscriptMessage } from '../../shared/worker-transcript-text'
+import { formatWorkerTranscriptMessages } from '../../shared/worker-transcript-text'
 import { AGENT_SESSION_NOT_ATTACHED } from '../native-chat/agent-session-wire/structured-agent-session-mutation-admission'
 import type { OrchestrationDb } from './orchestration/db'
 import { boundStructuredJournalTail } from './orchestration/structured-worker-journal-archive'
@@ -48,12 +48,12 @@ import { readTerminalTail } from './terminal-tail-read'
  * IS a structured worker never falls through: an unreadable journal refuses rather than answering
  * an empty tail, which a caller cannot tell from a worker that has said nothing.
  */
-export function readStructuredWorkerTerminal(args: {
+export async function readStructuredWorkerTerminal(args: {
   handle: string
   db: OrchestrationDb | null
   cursor?: number
   limit?: number
-}): RuntimeTerminalRead | null {
+}): Promise<RuntimeTerminalRead | null> {
   const identity = resolveStructuredWorkerAuthority(args.handle, args.db)?.identity
   if (!identity) {
     return null
@@ -76,7 +76,7 @@ export function readStructuredWorkerTerminal(args: {
         'A structured session has no durable line anchor to page from — nothing else does either.'
     )
   }
-  const page = readStructuredJournalPage(identity.sessionId)
+  const page = await readStructuredJournalPage(identity.sessionId)
   if (!page) {
     // Honest refusal, and the same one the send lane reports: an empty tail would read as "this
     // worker has produced no output", which is a different and false claim.
@@ -84,9 +84,7 @@ export function readStructuredWorkerTerminal(args: {
   }
   // Redacts dispatch capabilities and clips oversized blocks under the archive path's byte bound.
   const bounded = boundStructuredJournalTail(page.items)
-  const lines = bounded.messages.flatMap((message) =>
-    formatWorkerTranscriptMessage(message).split('\n')
-  )
+  const lines = formatWorkerTranscriptMessages(bounded.messages).flatMap((text) => text.split('\n'))
   const read = readTerminalTail({
     handle: args.handle,
     status: structuredWorkerTerminalState(observeStructuredWorker(identity).status),
diff --git a/src/main/runtime/terminal-chat-owner-persistence.test.ts b/src/main/runtime/terminal-chat-owner-persistence.test.ts
new file mode 100644
index 00000000000..a489285d27e
--- /dev/null
+++ b/src/main/runtime/terminal-chat-owner-persistence.test.ts
@@ -0,0 +1,53 @@
+import { describe, expect, it } from 'vitest'
+import { OrcaRuntimeService } from './orca-runtime-test-mocks.spec'
+import {
+  HEADLESS_LEAF_ID,
+  TEST_WORKTREE_ID,
+  makeRuntimeStoreWithWorkspaceSession,
+  makeWorkspaceSessionWithHeadlessTerminal
+} from './orca-runtime-test-fixtures.spec'
+import { UpdatePaneLayout } from '../../shared/rpc-contract/session-tabs-schemas-params'
+import type { RuntimeStore } from './runtime-store-contract'
+
+describe('remote terminal chat ownership', () => {
+  it('preserves, changes, and explicitly clears the owner across the RPC and restart boundary', async () => {
+    const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(
+      makeWorkspaceSessionWithHeadlessTerminal()
+    )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The shared fixture implements RuntimeStore; its annotation erases the Vitest mock call signatures.
+    const runtime = new OrcaRuntimeService(runtimeStore as RuntimeStore)
+    const update = (owner: string | null | undefined) => {
+      const params = UpdatePaneLayout.parse({
+        worktree: `id:${TEST_WORKTREE_ID}`,
+        tabId: 'host-tab',
+        root: getSession().terminalLayoutsByTabId['host-tab']!.root,
+        expandedLeafId: null,
+        ...(owner !== undefined ? { chatLeafId: owner } : {})
+      })
+      return runtime.updateMobileSessionPaneLayout(params.worktree, {
+        ...params,
+        expandedLeafId: params.expandedLeafId ?? null
+      })
+    }
+    await update(HEADLESS_LEAF_ID)
+    expect(getSession().terminalLayoutsByTabId['host-tab']?.chatLeafId).toBe(HEADLESS_LEAF_ID)
+    // An older client changing geometry must not clear the owner.
+    await update(undefined)
+    expect(getSession().terminalLayoutsByTabId['host-tab']?.chatLeafId).toBe(HEADLESS_LEAF_ID)
+    runtime['mobileSessionTabsByWorktree'].delete(TEST_WORKTREE_ID)
+    runtime['hydrateHeadlessMobileSessionTabsFromWorkspaceSession'](TEST_WORKTREE_ID)
+    const rehydrated = await runtime.listMobileSessionTabs(`id:${TEST_WORKTREE_ID}`)
+    const surface = rehydrated.tabs.find(
+      (tab) => tab.type === 'terminal' && tab.parentTabId === 'host-tab'
+    )
+    expect(surface?.type === 'terminal' && surface.parentLayout?.chatLeafId).toBe(HEADLESS_LEAF_ID)
+    await update(null)
+    expect(getSession().terminalLayoutsByTabId['host-tab']?.chatLeafId).toBeUndefined()
+    const cleared = await runtime.listMobileSessionTabs(`id:${TEST_WORKTREE_ID}`)
+    expect(
+      cleared.tabs
+        .filter((tab) => tab.type === 'terminal')
+        .every((tab) => !tab.parentLayout?.chatLeafId)
+    ).toBe(true)
+  })
+})
diff --git a/src/main/runtime/terminal-close-observed-exit-test-fixture.ts b/src/main/runtime/terminal-close-observed-exit-test-fixture.ts
index 468508f896d..81287bafc59 100644
--- a/src/main/runtime/terminal-close-observed-exit-test-fixture.ts
+++ b/src/main/runtime/terminal-close-observed-exit-test-fixture.ts
@@ -37,8 +37,7 @@ export async function runObservedExitSocketScenario(scenario: ObservedExitSocket
       rememberSyntheticKillExit: harness.session.rememberSyntheticKillExit,
       sendPtyExitToRenderer: harness.session.sendPtyExitToRenderer,
       finishPtyShutdown,
-      retiredRejectedPtyIds: new Map<string, NodeJS.Timeout>(),
-      reversibleStopOwnersByPtyId: new Map<string, number>()
+      retiredRejectedPtyIds: new Map<string, NodeJS.Timeout>()
     }
     // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: stop/kill read only these controller ports and optional store; spawn ports are unused.
     const deps = ports as unknown as PtyRuntimeControllerDeps
@@ -103,8 +102,8 @@ const BINDING = {
 }
 
 class ObservedExitRuntime extends OrcaRuntimeService {
-  closeControl(): Promise<boolean> {
-    return this.stopExplicitlyClosedTabPtys([CONTROL_PTY_ID], CONTROL_PTY_ID)
+  async closeControl(): Promise<boolean> {
+    return (await this.stopExplicitlyClosedTabPtys([CONTROL_PTY_ID], CONTROL_PTY_ID)).stopped
   }
 }
 
diff --git a/src/main/runtime/terminal-command-paint.test.ts b/src/main/runtime/terminal-command-paint.test.ts
new file mode 100644
index 00000000000..54493da686f
--- /dev/null
+++ b/src/main/runtime/terminal-command-paint.test.ts
@@ -0,0 +1,52 @@
+import { describe, expect, it } from 'vitest'
+import {
+  hasTerminalCommandPainted,
+  observeTerminalCommandPaint,
+  type TerminalCommandPaintRecord
+} from './terminal-command-paint'
+import { normalizeTerminalChunk } from './terminal-ansi-normalization'
+
+function observe(record: TerminalCommandPaintRecord, data: string): void {
+  observeTerminalCommandPaint(record, data, normalizeTerminalChunk(data).text)
+}
+
+describe('terminal command paint', () => {
+  it('reads a pane with no command-start marker as painted', () => {
+    const record: TerminalCommandPaintRecord = {}
+    observe(record, '~/repo % ')
+    expect(hasTerminalCommandPainted(record)).toBe(true)
+  })
+
+  it('does not count the prompt, the echoed command, or a title set after the marker', () => {
+    const record: TerminalCommandPaintRecord = {}
+    observe(record, '\x1b]133;A\x07~/repo % amp\r\n\x1b]133;C\x07\x1b]0;amp\x07')
+    expect(hasTerminalCommandPainted(record)).toBe(false)
+    observe(record, '\x1b[?1049h\x1b[?25l\r\n')
+    expect(hasTerminalCommandPainted(record)).toBe(false)
+    observe(record, '\x1b[2;3H╭─ Amp')
+    expect(hasTerminalCommandPainted(record)).toBe(true)
+  })
+
+  it('counts a paint that arrives in the same chunk as the marker', () => {
+    const record: TerminalCommandPaintRecord = {}
+    observe(record, '\x1b]133;C\x1b\\\x1b[?1049hLIVE-TUI')
+    expect(hasTerminalCommandPainted(record)).toBe(true)
+  })
+
+  it('finds a marker split across chunks, and counts only output after it', () => {
+    const record: TerminalCommandPaintRecord = {}
+    observe(record, '~/repo % amp\r\n\x1b]13')
+    observe(record, '3;C\x07')
+    expect(hasTerminalCommandPainted(record)).toBe(false)
+    observe(record, '\x1b]133;C;cmdline_url=')
+    observe(record, 'amp\x07╭─ Amp')
+    expect(hasTerminalCommandPainted(record)).toBe(true)
+  })
+
+  it('starts over at the next command', () => {
+    const record: TerminalCommandPaintRecord = {}
+    observe(record, '\x1b]133;C\x07goose> ')
+    observe(record, '\x1b]133;D;0\x07\x1b]133;A\x07% goose\r\n\x1b]133;C\x07')
+    expect(hasTerminalCommandPainted(record)).toBe(false)
+  })
+})
diff --git a/src/main/runtime/terminal-command-paint.ts b/src/main/runtime/terminal-command-paint.ts
new file mode 100644
index 00000000000..d415d52dae7
--- /dev/null
+++ b/src/main/runtime/terminal-command-paint.ts
@@ -0,0 +1,66 @@
+import { stripAnsiEscapeSequences } from '../../shared/ansi-escape-sequences'
+import { createOsc133CommandFinishedScanner } from '../../shared/terminal-osc133-command-finished'
+import { normalizeTerminalChunk } from './terminal-ansi-normalization'
+
+// eslint-disable-next-line no-control-regex -- control bytes are exactly what is not visible.
+const VISIBLE_CHARACTER_RE = /[^\s\u0000-\u001f\u007f-\u009f]/
+
+function hasVisibleText(normalizedText: string): boolean {
+  return VISIBLE_CHARACTER_RE.test(stripAnsiEscapeSequences(normalizedText))
+}
+
+/**
+ * Where the running command's own output begins. Orca's shell integration prints OSC 133;C
+ * after the prompt and the echoed command line, right before the command runs, so only
+ * visible output after it can be the command's.
+ */
+export class TerminalCommandPaint {
+  private awaitingPaint = false
+  private markerEndInChunk = -1
+  private readonly scanner = createOsc133CommandFinishedScanner(
+    () => {},
+    (endInChunk) => {
+      this.markerEndInChunk = endInChunk
+    }
+  )
+
+  observe(data: string, normalizedText: string): void {
+    this.markerEndInChunk = -1
+    this.scanner.scan(data)
+    if (this.markerEndInChunk !== -1) {
+      // Why the rest of this chunk counts: a fast binary can paint in the same read as the marker.
+      this.awaitingPaint = !hasVisibleText(
+        normalizeTerminalChunk(data.slice(this.markerEndInChunk)).text
+      )
+      return
+    }
+    if (this.awaitingPaint && hasVisibleText(normalizedText)) {
+      this.awaitingPaint = false
+    }
+  }
+
+  hasPainted(): boolean {
+    return !this.awaitingPaint
+  }
+}
+
+export type TerminalCommandPaintRecord = { commandPaint?: TerminalCommandPaint }
+
+/** `normalizedText` is the chunk as the tail buffer received it (pending escapes resolved). */
+export function observeTerminalCommandPaint(
+  record: TerminalCommandPaintRecord,
+  data: string,
+  normalizedText: string
+): void {
+  record.commandPaint ??= new TerminalCommandPaint()
+  record.commandPaint.observe(data, normalizedText)
+}
+
+/**
+ * Why no marker reads as painted: some launches get no command boundary (older fish, SSH relay
+ * zsh, shells Orca could not wrap, and Windows launches that pass the command in shell args), so
+ * any output is all the evidence there is.
+ */
+export function hasTerminalCommandPainted(record: TerminalCommandPaintRecord): boolean {
+  return record.commandPaint?.hasPainted() ?? true
+}
diff --git a/src/main/runtime/terminal-input-kind-unchecked-call-sites.test.ts b/src/main/runtime/terminal-input-kind-unchecked-call-sites.test.ts
new file mode 100644
index 00000000000..e806e88320c
--- /dev/null
+++ b/src/main/runtime/terminal-input-kind-unchecked-call-sites.test.ts
@@ -0,0 +1,80 @@
+import { resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { scanSourceTree } from '../../shared/source-scan/source-tree-scan'
+import {
+  findCallsMissingArgument,
+  type RequiredCallArgument
+} from '../../shared/source-scan/call-argument-scan'
+
+/**
+ * Every PTY write names its input kind, and the compiler enforces that everywhere except the
+ * runtime files split out with `@ts-nocheck`. There a missing kind would compile and silently
+ * record nothing, so this scan is the ratchet for them.
+ */
+const MAIN_ROOT = resolve(__dirname, '..')
+
+const namesInputKind = (literal: string): boolean => /\binputKind\b|\.\.\./.test(literal)
+const kindAt = (index: number, receiver?: RegExp): RequiredCallArgument => ({
+  index,
+  ...(receiver ? { receiver } : {}),
+  acceptsObjectLiteral: namesInputKind
+})
+const CONTROLLER = /[Cc]ontroller\??\s*$/
+
+const KIND_ARGUMENT_BY_METHOD: Record<string, RequiredCallArgument> = {
+  write: kindAt(2, CONTROLLER),
+  writeWithSettlement: kindAt(2, CONTROLLER),
+  sendTerminal: kindAt(2),
+  sendTerminalAgentPrompt: kindAt(2),
+  writeTerminalAction: kindAt(3),
+  writeTerminalInputChunks: kindAt(2),
+  writeTerminalAgentPrompt: kindAt(4),
+  writeAction: kindAt(3),
+  writeChunks: kindAt(2)
+}
+
+// Why multiline: some unchecked files open with a lint directive before `@ts-nocheck`.
+const uncheckedSources = scanSourceTree(MAIN_ROOT).filter((file) =>
+  /^\/\/ @ts-nocheck\b/m.test(file.source)
+)
+
+describe('PTY write call sites the compiler cannot check', () => {
+  it('scans the unchecked runtime files that write to a PTY', () => {
+    expect(uncheckedSources.map((file) => file.relativePath)).toEqual(
+      expect.arrayContaining([
+        'runtime/orca-runtime-deliver-pending-messages.ts',
+        'runtime/orca-runtime-create-pty-headless-terminal-state.ts',
+        'runtime/orca-runtime-write-terminal-agent-prompt.ts',
+        'runtime/orca-runtime-sync-window-graph.ts'
+      ])
+    )
+  })
+
+  it('finds a write, prompt or send that leaves out its kind', () => {
+    const planted = [
+      '',
+      'this.ptyController?.write(ptyId, reply)',
+      "this.ptyController.write(ptyId, '\\r', 'launch')",
+      "await this.sendTerminal(handle, { text: 'a, b' }, { beforeWrite })",
+      'await this.sendTerminalAgentPrompt(handle, prompt, { ...options })',
+      'other.write(ptyId, data)',
+      'const controller = this.ptyController; controller.write(ptyId, data)'
+    ].join('\n')
+
+    expect(findCallsMissingArgument(planted, KIND_ARGUMENT_BY_METHOD)).toEqual([
+      '2: .write(ptyId, reply)',
+      "4: .sendTerminal(handle, { text: 'a, b' }, { beforeWrite })",
+      '7: .write(ptyId, data)'
+    ])
+  })
+
+  it('passes an input kind at every write', () => {
+    const missing = uncheckedSources.flatMap((file) =>
+      findCallsMissingArgument(file.source, KIND_ARGUMENT_BY_METHOD).map(
+        (site) => `${file.relativePath}:${site}`
+      )
+    )
+
+    expect(missing).toEqual([])
+  })
+})
diff --git a/src/main/runtime/terminal-intentional-stop-exit.test.ts b/src/main/runtime/terminal-intentional-stop-exit.test.ts
new file mode 100644
index 00000000000..0c3f996153f
--- /dev/null
+++ b/src/main/runtime/terminal-intentional-stop-exit.test.ts
@@ -0,0 +1,288 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import type { BrowserWindow } from 'electron'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { makePaneKey } from '../../shared/stable-pane-id'
+import { Store } from '../persistence/loading-store/store'
+import { ProfileStateSqliteAuthority } from '../persistence/profile-state/profile-state-sqlite-authority'
+import { wirePtyIpcSession } from '../ipc/pty/delivery/wire-session'
+import { SYNTHETIC_KILL_EXIT_DUPLICATE_WINDOW_MS } from '../ipc/pty/delivery/visibility-state'
+import { bindProviderListeners } from '../ipc/pty/provider/bind-listeners'
+import {
+  stopRendererOwnedPty,
+  stopReplacedPanePty,
+  type PtyKillIpcDeps
+} from '../ipc/pty/ipc/renderer-kill'
+import { ptyIncarnationById, ptyOwnership } from '../ipc/pty/provider/ownership-state'
+import { getLocalPtyProvider, setLocalPtyProvider } from '../ipc/pty/provider/registry'
+import { createPtyIpcSession } from '../ipc/pty/session'
+import type { IPtyProvider } from '../providers/types'
+import { OrcaRuntimeService } from './orca-runtime'
+import {
+  INCARNATION_ID,
+  LEAF_ID,
+  PTY_ID,
+  REPO_ID,
+  TAB_ID,
+  WORKTREE_ID,
+  WORKTREE_PATH,
+  makeSession
+} from './__fixtures__/orca-runtime-terminal-close-continuity-state-fixture'
+import { advanceTerminalTopologyRevision } from './workspace-session-terminal-membership-authority'
+
+const REPLACEMENT_PTY_ID = 'pty-close-continuity-replacement'
+const REPLACEMENT_INCARNATION_ID = '77777777-7777-4777-8777-777777777777'
+const LATER_INCARNATION_ID = '88888888-8888-4888-8888-888888888888'
+
+const directories: string[] = []
+const stores: Store[] = []
+const priorProvider = getLocalPtyProvider()
+afterEach(() => {
+  vi.useRealTimers()
+  setLocalPtyProvider(priorProvider)
+  ptyOwnership.delete(PTY_ID)
+  ptyIncarnationById.delete(PTY_ID)
+  for (const store of stores.splice(0)) {
+    store.freezeWrites()
+  }
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+/** A real store and runtime with one bound pane, and main's exit delivery to a renderer stub.
+ *  `lateProviderExit`: the kill's reply overtakes the exit, so main synthesizes one and the
+ *  provider's own exit arrives later through its listener. */
+function createHarness(opts: { lateProviderExit?: boolean; folder?: boolean } = {}) {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-intentional-stop-'))
+  directories.push(directory)
+  const store = new Store({
+    dataFile: join(directory, 'orca-data.json'),
+    profileStateAuthority: new ProfileStateSqliteAuthority(
+      join(directory, 'profile-state.db'),
+      'intentional-stop'
+    )
+  })
+  stores.push(store)
+  store.addRepo({
+    id: REPO_ID,
+    path: WORKTREE_PATH,
+    displayName: 'Fixture',
+    badgeColor: 'gray',
+    addedAt: 1,
+    // Why: a folder workspace resolves without git, which the sleep transaction needs.
+    ...(opts.folder ? { kind: 'folder' as const } : {})
+  })
+  store.setWorkspaceSession(advanceTerminalTopologyRevision(makeSession(), WORKTREE_ID))
+  store.flushOrThrow()
+  const runtime = new OrcaRuntimeService(store)
+  runtime.registerPty(PTY_ID, WORKTREE_ID, null, {
+    tabId: TAB_ID,
+    leafId: LEAF_ID,
+    incarnationId: INCARNATION_ID
+  })
+  ptyOwnership.set(PTY_ID, null)
+  ptyIncarnationById.set(PTY_ID, INCARNATION_ID)
+  let emitProviderExit:
+    | ((payload: { id: string; code: number; incarnationId?: string }) => void)
+    | undefined
+  const provider = {
+    onData: () => () => {},
+    onExit: (listener: typeof emitProviderExit) => {
+      emitProviderExit = listener
+      return () => {}
+    }
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the listeners bind only onData and onExit, and the renderer kill hands the provider to the shutdown port below.
+  setLocalPtyProvider(provider as unknown as IPtyProvider)
+  const rendererSend = vi.fn()
+  const window = { isDestroyed: () => false, webContents: { send: rendererSend } }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: exit delivery reads only isDestroyed and webContents.send.
+  const session = createPtyIpcSession({ mainWindow: window as unknown as BrowserWindow, runtime })
+  wirePtyIpcSession(session)
+  bindProviderListeners(session)
+  const deps: PtyKillIpcDeps = {
+    store,
+    runtime,
+    getLocalPtyProviderStartupPromise: () => undefined,
+    // The provider's own exit, delivered the way its listener delivers it.
+    shutdownProviderAndDetectExit: async (_provider, id) => {
+      if (opts.lateProviderExit) {
+        return false
+      }
+      runtime.onPtyExit(id, 0, INCARNATION_ID, { providerExitObserved: true })
+      session.sendPtyExitToRenderer({ id, code: 0, incarnationId: INCARNATION_ID })
+      return true
+    },
+    rememberSyntheticKillExit: session.rememberSyntheticKillExit,
+    sendPtyExitToRenderer: session.sendPtyExitToRenderer
+  }
+  return {
+    store,
+    runtime,
+    deps,
+    emitProviderExit: (incarnationId: string) =>
+      emitProviderExit?.({ id: PTY_ID, code: 0, incarnationId }),
+    boundPtyId: () =>
+      store.getWorkspaceSession().terminalLayoutsByTabId[TAB_ID]?.ptyIdsByLeafId?.[LEAF_ID] ?? null,
+    tabIds: () => (store.getWorkspaceSession().tabsByWorktree[WORKTREE_ID] ?? []).map((t) => t.id),
+    rendererExits: () =>
+      rendererSend.mock.calls.filter(([channel]) => channel === 'pty:exit').map(([, p]) => p)
+  }
+}
+
+describe('intentional stops keep the pane through the exit', () => {
+  it('retires the pane when an ordinary close ends the process', async () => {
+    const harness = createHarness()
+
+    await stopRendererOwnedPty(harness.deps, { id: PTY_ID })
+
+    expect(harness.boundPtyId()).toBeNull()
+    expect(harness.rendererExits()).toEqual([
+      { id: PTY_ID, code: 0, incarnationId: INCARNATION_ID }
+    ])
+  })
+
+  it('keeps the tab and its wake binding when the renderer hibernates the pane', async () => {
+    const harness = createHarness()
+
+    await stopRendererOwnedPty(harness.deps, { id: PTY_ID, keepHistory: true })
+
+    expect(harness.tabIds()).toEqual([TAB_ID])
+    expect(harness.boundPtyId()).toBe(PTY_ID)
+    expect(harness.rendererExits()).toEqual([
+      { id: PTY_ID, code: 0, incarnationId: INCARNATION_ID, preserveRendererBinding: true }
+    ])
+  })
+
+  it('keeps a typed pane that a restart replaces, and binds the replacement', async () => {
+    const harness = createHarness()
+    harness.runtime.terminalRunFacts.recordSpawnCommit({
+      id: PTY_ID,
+      incarnationId: INCARNATION_ID
+    })
+    harness.runtime.terminalRunFacts.recordInput(PTY_ID, 'driving', 'ls\r')
+
+    await stopReplacedPanePty(harness.deps, PTY_ID)
+    expect(harness.boundPtyId()).toBe(PTY_ID)
+    await harness.store.persistPtyBinding({
+      worktreeId: WORKTREE_ID,
+      tabId: TAB_ID,
+      leafId: LEAF_ID,
+      ptyId: REPLACEMENT_PTY_ID,
+      incarnationId: REPLACEMENT_INCARNATION_ID,
+      origin: 'spawn'
+    })
+
+    expect(harness.tabIds()).toEqual([TAB_ID])
+    expect(harness.boundPtyId()).toBe(REPLACEMENT_PTY_ID)
+    expect(
+      harness.store.getWorkspaceSession().terminalPtyIncarnationsByPaneKey?.[
+        makePaneKey(TAB_ID, LEAF_ID)
+      ]
+    ).toBe(REPLACEMENT_INCARNATION_ID)
+    expect(harness.rendererExits()).toEqual([
+      { id: PTY_ID, code: 0, incarnationId: INCARNATION_ID, replacedByRestart: true }
+    ])
+  })
+
+  it('labels the exit for both a sleep and a restart that stop the same process', async () => {
+    const harness = createHarness()
+    const settleSleep = harness.runtime.intentionalPtyStops.mark(
+      PTY_ID,
+      'reversible',
+      INCARNATION_ID
+    )
+
+    await stopReplacedPanePty(harness.deps, PTY_ID)
+    settleSleep(true)
+
+    expect(harness.boundPtyId()).toBe(PTY_ID)
+    expect(harness.rendererExits()).toEqual([
+      {
+        id: PTY_ID,
+        code: 0,
+        incarnationId: INCARNATION_ID,
+        preserveRendererBinding: true,
+        replacedByRestart: true
+      }
+    ])
+  })
+
+  it('keeps the pane through the synthetic exit and the provider exit that follows it', async () => {
+    const harness = createHarness({ lateProviderExit: true })
+
+    await stopRendererOwnedPty(harness.deps, { id: PTY_ID, keepHistory: true })
+    harness.emitProviderExit(INCARNATION_ID)
+
+    expect(harness.tabIds()).toEqual([TAB_ID])
+    expect(harness.boundPtyId()).toBe(PTY_ID)
+    expect(harness.rendererExits()).toEqual([
+      { id: PTY_ID, code: -1, incarnationId: INCARNATION_ID, preserveRendererBinding: true }
+    ])
+  })
+
+  it('never reads the exit of a later process on the same id as the stop', async () => {
+    const harness = createHarness({ lateProviderExit: true })
+    await stopRendererOwnedPty(harness.deps, { id: PTY_ID, keepHistory: true })
+    harness.runtime.registerPty(PTY_ID, WORKTREE_ID, null, {
+      tabId: TAB_ID,
+      leafId: LEAF_ID,
+      incarnationId: LATER_INCARNATION_ID
+    })
+    ptyIncarnationById.set(PTY_ID, LATER_INCARNATION_ID)
+    await harness.store.persistPtyBinding({
+      worktreeId: WORKTREE_ID,
+      tabId: TAB_ID,
+      leafId: LEAF_ID,
+      ptyId: PTY_ID,
+      incarnationId: LATER_INCARNATION_ID,
+      origin: 'reattach'
+    })
+
+    harness.emitProviderExit(LATER_INCARNATION_ID)
+
+    // Why wait: an unstopped exit retires the pane through an async durable save.
+    await vi.waitFor(() => expect(harness.boundPtyId()).toBeNull())
+    expect(harness.rendererExits().at(-1)).toEqual({
+      id: PTY_ID,
+      code: 0,
+      incarnationId: LATER_INCARNATION_ID
+    })
+  })
+
+  it('forgets the stop once the duplicate-exit window after it closes', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createHarness({ lateProviderExit: true })
+    await stopRendererOwnedPty(harness.deps, { id: PTY_ID, keepHistory: true })
+
+    vi.advanceTimersByTime(SYNTHETIC_KILL_EXIT_DUPLICATE_WINDOW_MS - 1)
+    expect(harness.runtime.intentionalPtyStops.claimExit(PTY_ID, INCARNATION_ID)).toEqual([
+      'reversible'
+    ])
+    vi.advanceTimersByTime(1)
+
+    expect(harness.runtime.intentionalPtyStops.claimExit(PTY_ID, INCARNATION_ID)).toEqual([])
+  })
+
+  it('keeps the tab and its wake binding when the runtime puts the worktree to sleep', async () => {
+    const harness = createHarness({ folder: true })
+    const inventories = [[{ id: PTY_ID, worktreeId: WORKTREE_ID, cwd: WORKTREE_PATH, title: 'a' }]]
+    harness.runtime.setPtyController({
+      write: () => true,
+      kill: () => true,
+      stopAndWait: async (ptyId) => {
+        harness.runtime.onPtyExit(ptyId, -1, INCARNATION_ID, { providerExitObserved: true })
+        return true
+      },
+      getForegroundProcess: async () => null,
+      listProcesses: async () => inventories.shift() ?? []
+    })
+
+    await harness.runtime.sleepTerminalsForWorktree(`id:${WORKTREE_ID}`)
+
+    expect(harness.tabIds()).toEqual([TAB_ID])
+    expect(harness.boundPtyId()).toBe(PTY_ID)
+  })
+})
diff --git a/src/main/runtime/terminal-intentional-stops.test.ts b/src/main/runtime/terminal-intentional-stops.test.ts
new file mode 100644
index 00000000000..d37fc4147e8
--- /dev/null
+++ b/src/main/runtime/terminal-intentional-stops.test.ts
@@ -0,0 +1,112 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { SYNTHETIC_KILL_EXIT_DUPLICATE_WINDOW_MS } from '../ipc/pty/delivery/visibility-state'
+import { TerminalIntentionalStops } from './terminal-intentional-stops'
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('terminal intentional stops', () => {
+  it('keeps the mark while a second overlapping owner still holds it', () => {
+    const stops = new TerminalIntentionalStops()
+    const settleFirst = stops.mark('pty-1', 'reversible', 'inc-1')
+    const settleSecond = stops.mark('pty-1', 'reversible', 'inc-1')
+
+    settleFirst(false)
+
+    expect(stops.isReversibleStopInFlight('pty-1')).toBe(true)
+    expect(stops.claimExit('pty-1', 'inc-1')).toEqual(['reversible'])
+    settleSecond(false)
+    expect(stops.claimExit('pty-1', 'inc-1')).toEqual([])
+  })
+
+  it('still reads an exit that lands after the stop settled, until the window closes', () => {
+    vi.useFakeTimers()
+    const stops = new TerminalIntentionalStops()
+    const settle = stops.mark('pty-ssh', 'reversible', 'inc-1')
+
+    settle(true)
+    vi.advanceTimersByTime(SYNTHETIC_KILL_EXIT_DUPLICATE_WINDOW_MS - 1)
+
+    expect(stops.isReversibleStopInFlight('pty-ssh')).toBe(false)
+    expect(stops.claimExit('pty-ssh', 'inc-1')).toEqual(['reversible'])
+    vi.advanceTimersByTime(1)
+    expect(stops.claimExit('pty-ssh', 'inc-1')).toEqual([])
+  })
+
+  it('drops the mark at once when the stop fails', () => {
+    const stops = new TerminalIntentionalStops()
+
+    stops.mark('pty-1', 'replaced', 'inc-1')(false)
+
+    expect(stops.claimExit('pty-1', 'inc-1')).toEqual([])
+  })
+
+  it('reads the synthetic exit and the provider exit of the same process alike', () => {
+    const stops = new TerminalIntentionalStops()
+    const settle = stops.mark('pty-1', 'replaced', null)
+
+    expect(stops.claimExit('pty-1', 'inc-1')).toEqual(['replaced'])
+    settle(true)
+
+    expect(stops.claimExit('pty-1', 'inc-1')).toEqual(['replaced'])
+    expect(stops.claimExit('pty-1', 'inc-2')).toEqual([])
+  })
+
+  it('never marks the exit of another process that reuses the id', () => {
+    const stops = new TerminalIntentionalStops()
+    stops.mark('pty-1', 'reversible', 'inc-1')
+
+    expect(stops.claimExit('pty-1', 'inc-2')).toEqual([])
+  })
+
+  it('starts a new stop of the same id fresh once the prior one settled', () => {
+    const stops = new TerminalIntentionalStops()
+    stops.mark('pty-1', 'reversible', 'inc-1')(true)
+
+    const settle = stops.mark('pty-1', 'replaced', 'inc-2')
+
+    expect(stops.claimExit('pty-1', 'inc-1')).toEqual([])
+    expect(stops.claimExit('pty-1', 'inc-2')).toEqual(['replaced'])
+    settle(false)
+    expect(stops.claimExit('pty-1', 'inc-2')).toEqual([])
+  })
+
+  it('labels one exit with every kind of stop that overlapped on it', () => {
+    const stops = new TerminalIntentionalStops()
+    const settleSleep = stops.mark('pty-1', 'reversible', 'inc-1')
+    const settleRestart = stops.mark('pty-1', 'replaced', 'inc-1')
+
+    expect(stops.isReversibleStopInFlight('pty-1')).toBe(true)
+    expect(stops.claimExit('pty-1', 'inc-1')).toEqual(['reversible', 'replaced'])
+
+    settleSleep(true)
+    expect(stops.isReversibleStopInFlight('pty-1')).toBe(false)
+    settleRestart(false)
+    expect(stops.claimExit('pty-1', 'inc-1')).toEqual(['reversible'])
+  })
+
+  it('keeps a landed stop when a later stop of the same process fails', () => {
+    const stops = new TerminalIntentionalStops()
+    stops.mark('pty-1', 'reversible', 'inc-1')(true)
+
+    stops.mark('pty-1', 'reversible', 'inc-1')(false)
+
+    expect(stops.claimExit('pty-1', 'inc-1')).toEqual(['reversible'])
+  })
+
+  it('lets a new process on the id supersede a landed stop no exit pinned', () => {
+    const stops = new TerminalIntentionalStops()
+    stops.mark('pty-unpinned', 'reversible', null)(true)
+    stops.mark('pty-pinned', 'reversible', 'inc-1')(true)
+    stops.mark('pty-in-flight', 'replaced', null)
+
+    for (const ptyId of ['pty-unpinned', 'pty-pinned', 'pty-in-flight']) {
+      stops.noteSpawnCommit(ptyId)
+    }
+
+    expect(stops.claimExit('pty-unpinned', null)).toEqual([])
+    expect(stops.claimExit('pty-pinned', 'inc-1')).toEqual(['reversible'])
+    expect(stops.claimExit('pty-in-flight', null)).toEqual(['replaced'])
+  })
+})
diff --git a/src/main/runtime/terminal-intentional-stops.ts b/src/main/runtime/terminal-intentional-stops.ts
new file mode 100644
index 00000000000..b89bc709e5f
--- /dev/null
+++ b/src/main/runtime/terminal-intentional-stops.ts
@@ -0,0 +1,122 @@
+import { SYNTHETIC_KILL_EXIT_DUPLICATE_WINDOW_MS } from '../ipc/pty/delivery/visibility-state'
+
+/**
+ * Why main stopped a PTY on purpose. Both kinds keep the pane's binding through the exit:
+ * - `reversible`: sleep or hibernation; the binding is the wake hint.
+ * - `replaced`: a restart stops the old process so a new one can take the pane.
+ */
+export type TerminalIntentionalStopKind = 'reversible' | 'replaced'
+
+type IntentionalStopOwners = { inFlight: number; stopped: boolean }
+
+type IntentionalStop = {
+  /** Null until known; the first exit that claims the stop pins it to that process. */
+  incarnationId: string | null
+  /** Why per kind: overlapping stops of different kinds each hold their own label on the exit. */
+  ownersByKind: Map<TerminalIntentionalStopKind, IntentionalStopOwners>
+  expiryTimer?: ReturnType<typeof setTimeout>
+}
+
+const NO_INTENTIONAL_STOP: readonly TerminalIntentionalStopKind[] = []
+
+function hasInFlightOwners(stop: IntentionalStop): boolean {
+  return [...stop.ownersByKind.values()].some((owners) => owners.inFlight > 0)
+}
+
+/** The one register of PTY stops main made on purpose, read by every exit path. */
+export class TerminalIntentionalStops {
+  private readonly stopsByPtyId = new Map<string, IntentionalStop>()
+
+  /** Registers one owner's stop; call the result once with whether the stop landed. */
+  mark(
+    ptyId: string,
+    kind: TerminalIntentionalStopKind,
+    incarnationId: string | null
+  ): (stopped: boolean) => void {
+    let stop = this.stopsByPtyId.get(ptyId)
+    if (stop && this.joins(stop, incarnationId)) {
+      clearTimeout(stop.expiryTimer)
+      stop.expiryTimer = undefined
+      stop.incarnationId ??= incarnationId
+    } else {
+      clearTimeout(stop?.expiryTimer)
+      stop = { incarnationId, ownersByKind: new Map() }
+      this.stopsByPtyId.set(ptyId, stop)
+    }
+    const owners = stop.ownersByKind.get(kind) ?? { inFlight: 0, stopped: false }
+    owners.inFlight += 1
+    stop.ownersByKind.set(kind, owners)
+    const owned = stop
+    let settled = false
+    return (stopped) => {
+      if (settled || this.stopsByPtyId.get(ptyId) !== owned) {
+        return
+      }
+      settled = true
+      owners.stopped ||= stopped
+      owners.inFlight -= 1
+      if (owners.inFlight === 0 && !owners.stopped) {
+        owned.ownersByKind.delete(kind)
+      }
+      this.settleIfIdle(ptyId, owned)
+    }
+  }
+
+  /** The kinds of stop this exit ends; empty when the process was not stopped on purpose. */
+  claimExit(
+    ptyId: string,
+    exitIncarnationId: string | null | undefined
+  ): readonly TerminalIntentionalStopKind[] {
+    const stop = this.stopsByPtyId.get(ptyId)
+    if (!stop) {
+      return NO_INTENTIONAL_STOP
+    }
+    if (stop.incarnationId && exitIncarnationId && stop.incarnationId !== exitIncarnationId) {
+      return NO_INTENTIONAL_STOP
+    }
+    stop.incarnationId ??= exitIncarnationId ?? null
+    return [...stop.ownersByKind.keys()]
+  }
+
+  /** Whether a stop of this PTY that may still be undone is in flight. */
+  isReversibleStopInFlight(ptyId: string): boolean {
+    return (this.stopsByPtyId.get(ptyId)?.ownersByKind.get('reversible')?.inFlight ?? 0) > 0
+  }
+
+  /** A process committed on this id. A landed stop's process is dead, so an entry no exit ever
+   *  pinned could otherwise claim the new process's exit as the stop. */
+  noteSpawnCommit(ptyId: string): void {
+    const stop = this.stopsByPtyId.get(ptyId)
+    if (stop && stop.incarnationId === null && !hasInFlightOwners(stop)) {
+      clearTimeout(stop.expiryTimer)
+      this.stopsByPtyId.delete(ptyId)
+    }
+  }
+
+  // Why: a settled entry joins only its own known process, so an id reused by a process whose
+  // incarnation is not yet known never inherits the old stop.
+  private joins(stop: IntentionalStop, incarnationId: string | null): boolean {
+    if (stop.incarnationId !== null && stop.incarnationId === incarnationId) {
+      return true
+    }
+    return hasInFlightOwners(stop) && (stop.incarnationId === null || incarnationId === null)
+  }
+
+  private settleIfIdle(ptyId: string, stop: IntentionalStop): void {
+    if (hasInFlightOwners(stop)) {
+      return
+    }
+    if (stop.ownersByKind.size === 0) {
+      this.stopsByPtyId.delete(ptyId)
+      return
+    }
+    // Why a window: an SSH exit can arrive after the stop settles, and a synthetic exit can be
+    // followed by the provider's own; both describe the same stopped process.
+    stop.expiryTimer = setTimeout(() => {
+      if (this.stopsByPtyId.get(ptyId) === stop) {
+        this.stopsByPtyId.delete(ptyId)
+      }
+    }, SYNTHETIC_KILL_EXIT_DUPLICATE_WINDOW_MS)
+    stop.expiryTimer.unref?.()
+  }
+}
diff --git a/src/main/runtime/terminal-interactive-wait-visibility.test.ts b/src/main/runtime/terminal-interactive-wait-visibility.test.ts
index 3a6470b41f9..b79ea7a3270 100644
--- a/src/main/runtime/terminal-interactive-wait-visibility.test.ts
+++ b/src/main/runtime/terminal-interactive-wait-visibility.test.ts
@@ -92,9 +92,9 @@ describe('terminal interactive-wait visibility (STA-4513, STA-3714)', () => {
       await expect(
         assertTerminalAgentSendable({ runtime, handle, assertWritable: () => {} })
       ).rejects.toThrow('terminal_guard_permission')
-      await expect(runtime.sendTerminalAgentPrompt(handle, 'coordinator preamble')).rejects.toThrow(
-        'agent_prompt_blocked'
-      )
+      await expect(
+        runtime.sendTerminalAgentPrompt(handle, 'coordinator preamble', { inputKind: 'driving' })
+      ).rejects.toThrow('agent_prompt_blocked')
     })
 
     it('lets a dispatch preamble through once the same lane is working', async () => {
diff --git a/src/main/runtime/terminal-list-pending-pty-registration.test.ts b/src/main/runtime/terminal-list-pending-pty-registration.test.ts
new file mode 100644
index 00000000000..62a5daf78e3
--- /dev/null
+++ b/src/main/runtime/terminal-list-pending-pty-registration.test.ts
@@ -0,0 +1,144 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  createInventoryRuntime,
+  deferred,
+  processRow,
+  PREDECESSOR,
+  PTY,
+  WORKTREE
+} from './pty-inventory-lifecycle-fixture'
+
+const TAB = '40000000-0000-4000-8000-000000000001'
+const LEAF = '40000000-0000-4000-8000-000000000002'
+
+afterEach(() => vi.restoreAllMocks())
+
+describe('terminal listing while a spawn binding is being persisted', () => {
+  it.each([
+    { host: 'local', ptyId: PTY, connectionId: null, phase: 'binding', incarnationId: PREDECESSOR },
+    {
+      host: 'SSH',
+      ptyId: 'ssh:host-a@@pty2:pending-spawn:1',
+      connectionId: 'host-a',
+      phase: 'binding'
+    },
+    { host: 'local', ptyId: PTY, connectionId: null, phase: 'provider' },
+    {
+      host: 'SSH',
+      ptyId: 'ssh:host-a@@pty2:pending-spawn:1',
+      connectionId: 'host-a',
+      phase: 'provider'
+    }
+  ])(
+    'does not authorize orphan adoption during $host $phase admission',
+    async ({ ptyId, connectionId, phase, incarnationId }) => {
+      const bindingPersisted = deferred<void>()
+      const { runtime } = createInventoryRuntime(async () => [processRow(ptyId)])
+      runtime.attachWindow(1)
+      runtime.syncWindowGraph(1, {
+        tabs: [{ tabId: TAB, worktreeId: WORKTREE, title: '', activeLeafId: LEAF, layout: null }],
+        leaves: [
+          {
+            tabId: TAB,
+            worktreeId: WORKTREE,
+            leafId: LEAF,
+            paneRuntimeId: 1,
+            ptyId: null,
+            paneTitle: null,
+            title: ''
+          }
+        ]
+      })
+
+      const releaseSpawn =
+        phase === 'provider' ? await runtime.acquireWorktreeTerminalSpawn(WORKTREE) : undefined
+      if (phase === 'binding') {
+        runtime.beginPtyRegistration(ptyId, incarnationId)
+      }
+      // Spawn commit awaits durable binding persistence before publishing the runtime surface.
+      const commit = bindingPersisted.promise.then(() => {
+        runtime.registerPty(ptyId, WORKTREE, connectionId, {
+          tabId: TAB,
+          leafId: LEAF,
+          incarnationId: PREDECESSOR
+        })
+      })
+      try {
+        await expect(
+          runtime.listTerminals(`id:${WORKTREE}`, undefined, {
+            requireFreshPtyLiveness: true,
+            includeVisualLayouts: false
+          })
+        ).rejects.toThrow('terminal_surface_ownership_unavailable')
+        expect(runtime.capture(ptyId).verdict).toMatchObject({ status: 'live' })
+      } finally {
+        bindingPersisted.resolve()
+        try {
+          await commit
+        } finally {
+          releaseSpawn?.()
+        }
+      }
+
+      const committed = await runtime.listTerminals(`id:${WORKTREE}`, undefined, {
+        requireFreshPtyLiveness: true,
+        includeVisualLayouts: false
+      })
+      expect(committed.terminals).toEqual([
+        expect.objectContaining({
+          ptyId,
+          tabId: TAB,
+          leafId: LEAF,
+          connected: true,
+          incarnationId: PREDECESSOR,
+          orphaned: false
+        })
+      ])
+    }
+  )
+
+  it('continues reporting a committed surface while another spawn is pending', async () => {
+    const { runtime } = createInventoryRuntime(async () => [processRow()])
+    runtime.register()
+    const releaseSpawn = await runtime.acquireWorktreeTerminalSpawn(WORKTREE)
+    try {
+      const listed = await runtime.listTerminals(`id:${WORKTREE}`)
+      expect(listed.terminals).toEqual([
+        expect.objectContaining({ ptyId: PTY, connected: true, orphaned: false })
+      ])
+    } finally {
+      releaseSpawn()
+    }
+  })
+
+  it('does not block orphan recovery in an unrelated workspace', async () => {
+    const { runtime } = createInventoryRuntime(async () => [processRow()])
+    const releaseSpawn = await runtime.acquireWorktreeTerminalSpawn('repo::/tmp/another-workspace')
+    try {
+      const listed = await runtime.listTerminals(`id:${WORKTREE}`)
+      expect(listed.terminals).toEqual([
+        expect.objectContaining({ ptyId: PTY, connected: true, orphaned: true })
+      ])
+    } finally {
+      releaseSpawn()
+    }
+  })
+
+  it('permits orphan recovery once the competing spawn admission has ended', async () => {
+    const { runtime } = createInventoryRuntime(async () => [processRow()])
+    const releaseSpawn = await runtime.acquireWorktreeTerminalSpawn(WORKTREE)
+    runtime.beginPtyRegistration(PTY, PREDECESSOR)
+    try {
+      await expect(runtime.listTerminals(`id:${WORKTREE}`)).rejects.toThrow(
+        'terminal_surface_ownership_unavailable'
+      )
+    } finally {
+      runtime.cancelPendingPtyRegistration(PTY, PREDECESSOR)
+      releaseSpawn()
+    }
+    const listed = await runtime.listTerminals(`id:${WORKTREE}`)
+    expect(listed.terminals).toEqual([
+      expect.objectContaining({ ptyId: PTY, connected: true, orphaned: true })
+    ])
+  })
+})
diff --git a/src/main/runtime/terminal-query-responder.test.ts b/src/main/runtime/terminal-query-responder.test.ts
index 9db883529a0..f479be9e47a 100644
--- a/src/main/runtime/terminal-query-responder.test.ts
+++ b/src/main/runtime/terminal-query-responder.test.ts
@@ -21,6 +21,7 @@ import {
   setTerminalViewAttributes
 } from './terminal-view-attribute-store'
 import type { TerminalViewAttributes, TerminalViewRgb } from '../../shared/terminal-view-attributes'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 
 const settingsState = {
   terminalMainSideEffectAuthority: true as boolean,
@@ -58,9 +59,11 @@ type RendererBufferStub = { data: string; cols: number; rows: number }
 function createResponderRuntime(opts: { rendererBuffer?: RendererBufferStub } = {}) {
   const runtime = new OrcaRuntimeService(store)
   const replies: { ptyId: string; data: string }[] = []
+  const inputKinds: TerminalInputKind[] = []
   runtime.setPtyController({
-    write: (ptyId, data) => {
+    write: (ptyId, data, inputKind) => {
       replies.push({ ptyId, data })
+      inputKinds.push(inputKind)
       return true
     },
     kill: () => true,
@@ -74,7 +77,7 @@ function createResponderRuntime(opts: { rendererBuffer?: RendererBufferStub } =
         }
       : {})
   })
-  return { runtime, replies }
+  return { runtime, replies, inputKinds }
 }
 
 /** Awaits the per-PTY emulator writeChain so queued chunk links (and the
@@ -146,7 +149,7 @@ describe('reply parity for hidden-dropped chunks', () => {
     ['kitty CSI ? u default flags', '\x1b[?u', ['\x1b[?0u']],
     ['kitty CSI ? u reports pushed flags', '\x1b[=5;1u\x1b[?u', ['\x1b[?5u']]
   ])('%s', async (_label, chunk, expectedReplies) => {
-    const { runtime, replies } = createResponderRuntime()
+    const { runtime, replies, inputKinds } = createResponderRuntime()
     markHiddenRendererPty('pty-q')
 
     runtime.onPtyData('pty-q', chunk, Date.now())
@@ -154,6 +157,8 @@ describe('reply parity for hidden-dropped chunks', () => {
 
     expect(replies.map((reply) => reply.data)).toEqual(expectedReplies)
     expect(replies.every((reply) => reply.ptyId === 'pty-q')).toBe(true)
+    // Why: a reply written as driving input would read the untouched run as typed.
+    expect(inputKinds).toEqual(expectedReplies.map(() => 'query-reply'))
   })
 
   it.each([
diff --git a/src/main/runtime/terminal-retirement-async-durability.test.ts b/src/main/runtime/terminal-retirement-async-durability.test.ts
new file mode 100644
index 00000000000..28d2f1603a9
--- /dev/null
+++ b/src/main/runtime/terminal-retirement-async-durability.test.ts
@@ -0,0 +1,127 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import {
+  ACK_INCARNATION,
+  ACK_LEAF,
+  ACK_SECOND_LEAF,
+  ACK_TAB,
+  createAcknowledgedTabRetirementFixture
+} from './acknowledged-terminal-tab-retirement-fixture'
+
+const fixtures: ReturnType<typeof createAcknowledgedTabRetirementFixture>[] = []
+afterEach(async () => {
+  for (const fixture of fixtures.splice(0)) {
+    await fixture.dispose()
+  }
+})
+function fixture() {
+  const result = createAcknowledgedTabRetirementFixture(true)
+  fixtures.push(result)
+  return result
+}
+
+it('withholds the acknowledged close until its host retirement is durable', async () => {
+  const f = fixture()
+  let acknowledged = false
+  const closing = f.close().then((result) => {
+    acknowledged = true
+    return result
+  })
+  await f.entered.promise
+  const gate = f.authority.pause()
+  f.acknowledgement.resolve()
+  await gate.started.promise
+  expect(acknowledged).toBe(false)
+  gate.finish.resolve()
+  await expect(closing).resolves.toEqual({ closed: true })
+  expect(f.hasTab()).toBe(false)
+})
+
+it('publishes physical-exit retirement before its durable write completes', async () => {
+  const f = fixture()
+  await f.store.flushPendingOrThrowAsync()
+  const published = vi.fn()
+  const unsubscribe = f.runtime.onMobileSessionTabsChanged(published)
+  const gate = f.authority.pause()
+  const exiting = f.runtime.onPtyExit('pty-a', 0, ACK_INCARNATION, { providerExitObserved: true })
+  await gate.started.promise
+  // Why: a client re-activating the exited pane in this window must already find it retired.
+  expect(published).toHaveBeenCalled()
+  gate.finish.resolve()
+  await exiting
+  expect(published).toHaveBeenCalled()
+  expect(
+    f.store.getWorkspaceSession().terminalLayoutsByTabId[ACK_TAB].ptyIdsByLeafId?.[ACK_LEAF]
+  ).toBeUndefined()
+  unsubscribe()
+})
+
+it('publishes nothing when the exit write lands after a replacement is admitted', async () => {
+  const f = fixture()
+  await f.store.flushPendingOrThrowAsync()
+  const published = vi.fn()
+  const unsubscribe = f.runtime.onMobileSessionTabsChanged(published)
+  const gate = f.authority.pause()
+  const exiting = f.runtime.onPtyExit('pty-a', 0, ACK_INCARNATION, { providerExitObserved: true })
+  await gate.started.promise
+  f.runtime.onPtySpawned('pty-a', 'new-incarnation')
+  published.mockClear()
+  gate.finish.resolve()
+  await exiting
+  expect(published).not.toHaveBeenCalled()
+  unsubscribe()
+})
+
+async function exitWithFailedDurableWrite(f: ReturnType<typeof fixture>): Promise<void> {
+  await f.store.flushPendingOrThrowAsync()
+  const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined)
+  f.authority.failNextWrite()
+  await f.runtime.onPtyExit('pty-a', 0, ACK_INCARNATION, { providerExitObserved: true })
+  expect(errorSpy).toHaveBeenCalledWith(
+    '[runtime] terminal retirement is not yet durable:',
+    expect.any(Error)
+  )
+  errorSpy.mockRestore()
+  // The failed write left disk untouched, so a relaunch would still load the exited leaf.
+  expect(f.readDisk().workspaceSession.terminalLayoutsByTabId[ACK_TAB]?.ptyIdsByLeafId).toEqual({
+    [ACK_LEAF]: 'pty-a',
+    [ACK_SECOND_LEAF]: 'pty-b'
+  })
+}
+
+it('persists a failed exit retirement with the next unrelated profile write', async () => {
+  const f = fixture()
+  await exitWithFailedDurableWrite(f)
+  f.store.addRepo({
+    id: 'repo2',
+    path: '/tmp/other',
+    displayName: 'Other',
+    badgeColor: 'gray',
+    addedAt: 2
+  })
+  await f.store.flushPendingOrThrowAsync()
+  expect(f.readDisk().workspaceSession.terminalLayoutsByTabId[ACK_TAB]?.ptyIdsByLeafId).toEqual({
+    [ACK_SECOND_LEAF]: 'pty-b'
+  })
+})
+
+it('persists a failed exit retirement with the final quit flush', async () => {
+  const f = fixture()
+  await exitWithFailedDurableWrite(f)
+  await f.quit()
+  expect(f.readDisk().workspaceSession.terminalLayoutsByTabId[ACK_TAB]?.ptyIdsByLeafId).toEqual({
+    [ACK_SECOND_LEAF]: 'pty-b'
+  })
+})
+
+it('writes exits retired in the same tick once', async () => {
+  const f = fixture()
+  await f.store.flushPendingOrThrowAsync()
+  const writes = f.authority.captures.length
+  await Promise.all([
+    f.runtime.onPtyExit('pty-a', 0, ACK_INCARNATION, { providerExitObserved: true }),
+    f.runtime.onPtyExit('pty-b', 0, undefined, { providerExitObserved: true })
+  ])
+  // Why: the first write already carries both retirements; the second has nothing left to fence.
+  expect(f.authority.captures.length - writes).toBe(1)
+  expect(f.readDisk().workspaceSession.terminalLayoutsByTabId[ACK_TAB]).toBeUndefined()
+})
diff --git a/src/main/runtime/terminal-run-facts-input.test.ts b/src/main/runtime/terminal-run-facts-input.test.ts
new file mode 100644
index 00000000000..a1f26d9b686
--- /dev/null
+++ b/src/main/runtime/terminal-run-facts-input.test.ts
@@ -0,0 +1,244 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
+import { writePtyFromRuntimeController } from '../ipc/pty/runtime/operations'
+import { getLocalPtyProvider, setLocalPtyProvider } from '../ipc/pty/provider/registry'
+import type { IPtyProvider } from '../providers/types'
+import { settledWriteStub } from '../providers/settled-pty-write-stub'
+import { OrcaRuntimeService } from './orca-runtime'
+import type { RuntimePtyController } from './runtime-pty-controller-contract'
+import { writeOrchestrationPointerWithSettlement } from './orchestration/mailbox-pointer-pty-write'
+import { sendTerminalStreamInput } from './rpc/methods/terminal/terminal-input-delivery'
+import { makeStore } from './runtime-rpc-worktree-store-fixtures'
+import {
+  pasteWorktreeStartupDraftWhenReady,
+  sendWorktreeStartupFollowupWhenReady,
+  type WorktreeStartupReadinessHost
+} from './runtime-worktree-startup-readiness'
+
+vi.mock('../git/worktree', () => {
+  const worktrees = [
+    {
+      path: '/tmp/worktree-a',
+      head: 'abc',
+      branch: 'feature/run-facts',
+      isBare: false,
+      isMainWorktree: false
+    }
+  ]
+  return {
+    listWorktrees: vi.fn().mockResolvedValue(worktrees),
+    listWorktreesStrict: vi.fn().mockResolvedValue(worktrees)
+  }
+})
+
+const PTY_ID = 'pty-run-facts-input'
+const priorProvider = getLocalPtyProvider()
+
+type FreshRun = {
+  runtime: OrcaRuntimeService
+  controller: RuntimePtyController
+  handle: string
+  /** The kind each provider write was sent with, and whether input was recorded by then. */
+  writes: { data: string; inputRecorded: boolean }[]
+  kinds: TerminalInputKind[]
+  firstUserInputAt: () => number | null
+}
+
+/** A fresh shell whose controller writes go through main's real write funnel to a fake provider. */
+async function createFreshRun(): Promise<FreshRun> {
+  const runtime = new OrcaRuntimeService(makeStore() as never)
+  const firstUserInputAt = (): number | null =>
+    runtime.terminalRunFacts.read(PTY_ID, null).firstUserInputAt
+  const writes: FreshRun['writes'] = []
+  const kinds: TerminalInputKind[] = []
+  const write = (_id: string, data: string): boolean => {
+    writes.push({ data, inputRecorded: firstUserInputAt() !== null })
+    if (data.endsWith('\r')) {
+      runtime.onPtyData(PTY_ID, '\x1b]0;Codex working\x07', Date.now())
+    }
+    return true
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the write funnel calls only write and writeWithSettlement on the provider.
+  setLocalPtyProvider({
+    write,
+    writeWithSettlement: settledWriteStub(write)
+  } as unknown as IPtyProvider)
+  const controller: RuntimePtyController = {
+    spawn: async () => ({ id: PTY_ID }),
+    write: (id, data, inputKind) => {
+      kinds.push(inputKind)
+      return writePtyFromRuntimeController({ runtime }, id, data, inputKind)
+    },
+    writeWithSettlement: (id, data, inputKind) => {
+      kinds.push(inputKind)
+      return writePtyFromRuntimeController({ runtime }, id, data, inputKind, {
+        waitForSettlement: true
+      })
+    },
+    kill: () => true,
+    getForegroundProcess: async () => null
+  }
+  runtime.setPtyController(controller)
+  const terminal = await runtime.createTerminal('path:/tmp/worktree-a', { launchAgent: 'aider' })
+  runtime.terminalRunFacts.recordSpawnCommit({ id: PTY_ID })
+  return { runtime, controller, handle: terminal.handle, writes, kinds, firstUserInputAt }
+}
+
+afterEach(() => {
+  vi.useRealTimers()
+  setLocalPtyProvider(priorProvider)
+})
+
+describe('run facts: the controller write funnel', () => {
+  it('records terminal.send input before the write that could end the process', async () => {
+    const run = await createFreshRun()
+
+    await run.runtime.sendTerminal(
+      run.handle,
+      { text: 'exit', enter: true },
+      { inputKind: 'driving' }
+    )
+
+    expect(run.firstUserInputAt()).not.toBeNull()
+    expect(run.writes.map((write) => write.inputRecorded)).toEqual([true, true])
+  })
+
+  it('records stream input from a client', async () => {
+    const run = await createFreshRun()
+
+    await sendTerminalStreamInput(run.runtime, {
+      terminal: run.handle,
+      text: 'l',
+      client: undefined,
+      isMobile: false
+    })
+
+    expect(run.firstUserInputAt()).not.toBeNull()
+  })
+
+  it('records a dispatched agent prompt before its first write', async () => {
+    vi.useFakeTimers()
+    const run = await createFreshRun()
+
+    const submission = run.runtime.sendTerminalAgentPrompt(run.handle, 'review this', {
+      inputKind: 'driving'
+    })
+    await vi.runAllTimersAsync()
+    await submission.catch(() => undefined)
+
+    expect(run.firstUserInputAt()).not.toBeNull()
+    expect(run.writes[0]?.inputRecorded).toBe(true)
+  })
+
+  it('reads a run launched with a prompt as untyped until someone drives it', async () => {
+    vi.useFakeTimers()
+    const run = await createFreshRun()
+
+    const submission = run.runtime.sendTerminalAgentPrompt(run.handle, 'start here', {
+      inputKind: 'launch'
+    })
+    await vi.runAllTimersAsync()
+    await submission.catch(() => undefined)
+
+    expect(run.writes.length).toBeGreaterThan(0)
+    expect(run.firstUserInputAt()).toBeNull()
+
+    await run.runtime.sendTerminal(run.handle, { text: 'y' }, { inputKind: 'driving' })
+    expect(run.firstUserInputAt()).not.toBeNull()
+  })
+
+  it('records a mailbox pointer, which drives the running agent', async () => {
+    const run = await createFreshRun()
+
+    await writeOrchestrationPointerWithSettlement({
+      ptyId: PTY_ID,
+      data: 'You have 1 unread message.',
+      controller: run.controller
+    })
+
+    expect(run.kinds).toEqual(['driving'])
+    expect(run.firstUserInputAt()).not.toBeNull()
+  })
+
+  it('records nothing for a client query reply', async () => {
+    const run = await createFreshRun()
+
+    await run.runtime.sendTerminal(run.handle, { text: 'y' }, { inputKind: 'query-reply' })
+
+    expect(run.firstUserInputAt()).toBeNull()
+  })
+
+  it.each([
+    ['a terminal reply', '\x1b[3;4R'],
+    ['focus reports', '\x1b[I\x1b[O'],
+    ['the focus-in a desktop sends on reattaching a remote pane', '\x1b[I']
+  ])('records nothing for stream input that is only %s', async (_label, text) => {
+    const run = await createFreshRun()
+
+    await sendTerminalStreamInput(run.runtime, {
+      terminal: run.handle,
+      text,
+      client: undefined,
+      isMobile: false
+    })
+
+    expect(run.writes).toHaveLength(1)
+    expect(run.firstUserInputAt()).toBeNull()
+  })
+
+  it('records a reply mixed with a keystroke', async () => {
+    const run = await createFreshRun()
+
+    await run.runtime.sendTerminal(run.handle, { text: '\x1b[3;4Rx' }, { inputKind: 'driving' })
+
+    expect(run.firstUserInputAt()).not.toBeNull()
+  })
+
+  it('records dashboard preview typing before the write that could end the process', async () => {
+    const run = await createFreshRun()
+
+    await expect(run.runtime.writeTerminalPreviewInput(PTY_ID, 'exit\r')).resolves.toBe(true)
+
+    expect(run.writes.map((write) => write.inputRecorded)).toEqual([true])
+  })
+
+  it('records nothing for dashboard preview bytes that are only a reply or focus reports', async () => {
+    const run = await createFreshRun()
+
+    await run.runtime.writeTerminalPreviewInput(PTY_ID, '\x1b[3;4R')
+    await run.runtime.writeTerminalPreviewInput(PTY_ID, '\x1b[O\x1b[I')
+
+    expect(run.writes).toHaveLength(2)
+    expect(run.firstUserInputAt()).toBeNull()
+  })
+})
+
+describe('run facts: a created worktree’s startup writes', () => {
+  function readinessHost(run: FreshRun): WorktreeStartupReadinessHost {
+    return {
+      getPtyId: () => PTY_ID,
+      getForegroundProcess: async () => 'aider',
+      subscribeToData: () => () => {},
+      // Why: bracketed paste enabled, then quiet, is the default draft-ready signal.
+      readRecentOutput: () => '\x1b[?2004h',
+      write: (ptyId, data, inputKind) => run.controller.write(ptyId, data, inputKind)
+    }
+  }
+
+  it('reads a run whose only input was its create-time draft and follow-up as untyped', async () => {
+    vi.useFakeTimers()
+    const run = await createFreshRun()
+    const host = readinessHost(run)
+
+    pasteWorktreeStartupDraftWhenReady(host, run.handle, { agent: 'aider', content: 'plan it' })
+    sendWorktreeStartupFollowupWhenReady(host, run.handle, {
+      expectedProcess: 'aider',
+      prompt: 'and ship it'
+    })
+    await vi.runAllTimersAsync()
+
+    expect(run.kinds).toEqual(['launch', 'launch'])
+    expect(run.writes).toHaveLength(2)
+    expect(run.firstUserInputAt()).toBeNull()
+  })
+})
diff --git a/src/main/runtime/terminal-run-facts.test.ts b/src/main/runtime/terminal-run-facts.test.ts
new file mode 100644
index 00000000000..e1982ebc968
--- /dev/null
+++ b/src/main/runtime/terminal-run-facts.test.ts
@@ -0,0 +1,65 @@
+import { describe, expect, it } from 'vitest'
+import { TerminalRunFactsRegister } from './terminal-run-facts'
+
+describe('terminal run facts', () => {
+  it('reads a run main never saw committed as not fresh', () => {
+    expect(new TerminalRunFactsRegister().read('pty-1', 'inc-1')).toEqual({
+      freshSpawn: false,
+      firstUserInputAt: null
+    })
+  })
+
+  it('keeps the first user input across later input and a re-registration of the same process', () => {
+    const facts = new TerminalRunFactsRegister()
+    facts.recordSpawnCommit({ id: 'pty-1', incarnationId: 'inc-1' })
+    facts.recordInput('pty-1', 'driving', 'ls\r', 100)
+    facts.recordInput('pty-1', 'driving', 'ls\r', 200)
+
+    facts.recordSpawnCommit({ id: 'pty-1', incarnationId: 'inc-1', isReattach: true })
+
+    expect(facts.read('pty-1', 'inc-1')).toEqual({ freshSpawn: true, firstUserInputAt: 100 })
+  })
+
+  it('starts a new process clean', () => {
+    const facts = new TerminalRunFactsRegister()
+    facts.recordSpawnCommit({ id: 'pty-1', incarnationId: 'inc-1' })
+    facts.recordInput('pty-1', 'driving', 'ls\r', 100)
+
+    facts.recordSpawnCommit({ id: 'pty-1', incarnationId: 'inc-2' }, { tabId: 'source-tab' })
+
+    expect(facts.read('pty-1', 'inc-2')).toEqual({ freshSpawn: true, firstUserInputAt: null })
+    expect(facts.read('pty-1', 'inc-1')).toEqual({ freshSpawn: false, firstUserInputAt: null })
+  })
+
+  it('never reads a reattached process as fresh', () => {
+    const facts = new TerminalRunFactsRegister()
+
+    facts.recordSpawnCommit({ id: 'pty-1', incarnationId: 'inc-1', isReattach: true })
+
+    expect(facts.read('pty-1', 'inc-1').freshSpawn).toBe(false)
+  })
+
+  it('starts clean when a commit carries no incarnation to tell it from a new process', () => {
+    const facts = new TerminalRunFactsRegister()
+    facts.recordSpawnCommit({ id: 'pty-1' })
+    facts.recordInput('pty-1', 'driving', 'ls\r', 100)
+
+    facts.recordSpawnCommit({ id: 'pty-1', isReattach: true })
+
+    expect(facts.read('pty-1', null)).toEqual({ freshSpawn: false, firstUserInputAt: null })
+  })
+
+  it.each([
+    ['a launch write', 'launch', 'echo startup\r'],
+    ['a query reply', 'query-reply', '\x1b[1;1R'],
+    ['driving bytes that are only a terminal reply', 'driving', '\x1b[1;1R'],
+    ['driving bytes that are only focus reports', 'driving', '\x1b[I\x1b[O']
+  ] as const)('records nothing for %s', (_label, inputKind, data) => {
+    const facts = new TerminalRunFactsRegister()
+    facts.recordSpawnCommit({ id: 'pty-1', incarnationId: 'inc-1' })
+
+    facts.recordInput('pty-1', inputKind, data, 100)
+
+    expect(facts.read('pty-1', 'inc-1').firstUserInputAt).toBeNull()
+  })
+})
diff --git a/src/main/runtime/terminal-run-facts.ts b/src/main/runtime/terminal-run-facts.ts
new file mode 100644
index 00000000000..1fb3e411b6c
--- /dev/null
+++ b/src/main/runtime/terminal-run-facts.ts
@@ -0,0 +1,90 @@
+import {
+  spawnCommitBindingOrigin,
+  type PtySpawnCommitOrigin
+} from '../persistence/loading-store/pty-binding-span'
+import { isTerminalQueryReply } from '../../shared/terminal-query-reply'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
+
+export type TerminalRunFacts = {
+  /** This process was started for its pane, not reattached, adopted or cold-restored. */
+  freshSpawn: boolean
+  /** When input first drove this process, from any client or driver; null if none has. */
+  firstUserInputAt: number | null
+}
+
+// Why: a paired client's xterm answers focus changes (CSI I / CSI O) through input that carries no
+// provenance; the desktop renderer already excludes them via xterm's user-input signal.
+// oxlint-disable-next-line no-control-regex -- focus reports are ESC-framed sequences by definition.
+const TERMINAL_FOCUS_REPORTS_ONLY_RE = new RegExp('^(?:\\u001b\\[[IO])+$')
+
+/** Input with no provenance that no person typed: a whole terminal reply or only focus reports. */
+function isUntypedTerminalInput(payload: string): boolean {
+  return isTerminalQueryReply(payload) || TERMINAL_FOCUS_REPORTS_ONLY_RE.test(payload)
+}
+
+export type TerminalSpawnCommit = Parameters<typeof spawnCommitBindingOrigin>[0] & {
+  id: string
+  incarnationId?: string
+  coldRestore?: object
+}
+
+/** A cold restore starts a new process for a pane that had one, so it is never fresh. */
+type TerminalRunSpawnOrigin = PtySpawnCommitOrigin | 'cold-restore'
+
+type TerminalRunRecord = {
+  incarnationId: string | null
+  spawnOrigin: TerminalRunSpawnOrigin
+  firstUserInputAt: number | null
+}
+
+/** Main's per-process facts about one PTY run, keyed by the incarnation they describe. */
+export class TerminalRunFactsRegister {
+  private readonly runsByPtyId = new Map<string, TerminalRunRecord>()
+
+  /** Once per process: a re-registration of the same incarnation keeps its facts. Without an
+   *  incarnation a commit cannot be told from a new process, so it starts clean. */
+  recordSpawnCommit(commit: TerminalSpawnCommit, expectedSourceBinding?: unknown): void {
+    const incarnationId = commit.incarnationId ?? null
+    if (
+      incarnationId !== null &&
+      this.runsByPtyId.get(commit.id)?.incarnationId === incarnationId
+    ) {
+      return
+    }
+    const origin = spawnCommitBindingOrigin(commit, expectedSourceBinding)
+    this.runsByPtyId.set(commit.id, {
+      incarnationId,
+      spawnOrigin: origin === 'spawn' && commit.coldRestore !== undefined ? 'cold-restore' : origin,
+      firstUserInputAt: null
+    })
+  }
+
+  /** The one record point both write funnels call just before the provider write, because input
+   *  such as `exit` can end the process before the write returns. The payload check backs up a
+   *  writer that labels a reply or focus report as driving. */
+  recordInput(ptyId: string, inputKind: TerminalInputKind, data: string, now = Date.now()): void {
+    if (inputKind !== 'driving') {
+      return
+    }
+    const run = this.runsByPtyId.get(ptyId)
+    if (run && run.firstUserInputAt === null && !isUntypedTerminalInput(data)) {
+      run.firstUserInputAt = now
+    }
+  }
+
+  /** A run main never saw committed reads as not fresh, which keeps today's close-on-exit. */
+  read(ptyId: string, incarnationId: string | null | undefined): TerminalRunFacts {
+    const run = this.runsByPtyId.get(ptyId)
+    if (!run || (run.incarnationId && incarnationId && run.incarnationId !== incarnationId)) {
+      return { freshSpawn: false, firstUserInputAt: null }
+    }
+    return {
+      freshSpawn: run.spawnOrigin === 'spawn' || run.spawnOrigin === 'split',
+      firstUserInputAt: run.firstUserInputAt
+    }
+  }
+
+  delete(ptyId: string): void {
+    this.runsByPtyId.delete(ptyId)
+  }
+}
diff --git a/src/main/runtime/terminal-send-stale-leaf-liveness.test.ts b/src/main/runtime/terminal-send-stale-leaf-liveness.test.ts
index b7c5ed95068..a25ed9817fb 100644
--- a/src/main/runtime/terminal-send-stale-leaf-liveness.test.ts
+++ b/src/main/runtime/terminal-send-stale-leaf-liveness.test.ts
@@ -96,9 +96,9 @@ describe('sendTerminal absence gate for leaf-branch writes', () => {
     const probe = vi.fn(async () => false)
     const { runtime, handle, write } = await makeRuntimeWithLeafHandle({ probePtyLiveness: probe })
 
-    await expect(runtime.sendTerminal(handle, { text: 'ping' })).rejects.toThrow(
-      'terminal_not_writable'
-    )
+    await expect(
+      runtime.sendTerminal(handle, { text: 'ping' }, { inputKind: 'driving' })
+    ).rejects.toThrow('terminal_not_writable')
 
     expect(probe).toHaveBeenCalledWith(STALE_PTY_ID)
     expect(write).not.toHaveBeenCalled()
@@ -108,9 +108,9 @@ describe('sendTerminal absence gate for leaf-branch writes', () => {
     const probe = vi.fn(async () => false)
     const { runtime, handle, write } = await makeRuntimeWithLeafHandle({ probePtyLiveness: probe })
 
-    await expect(runtime.sendTerminalAgentPrompt(handle, 'do the thing')).rejects.toThrow(
-      'terminal_not_writable'
-    )
+    await expect(
+      runtime.sendTerminalAgentPrompt(handle, 'do the thing', { inputKind: 'driving' })
+    ).rejects.toThrow('terminal_not_writable')
 
     expect(write).not.toHaveBeenCalled()
   })
@@ -120,12 +120,14 @@ describe('sendTerminal absence gate for leaf-branch writes', () => {
       probePtyLiveness: async () => null
     })
 
-    await expect(runtime.sendTerminal(handle, { text: 'ping' })).resolves.toMatchObject({
+    await expect(
+      runtime.sendTerminal(handle, { text: 'ping' }, { inputKind: 'driving' })
+    ).resolves.toMatchObject({
       handle,
       accepted: true
     })
 
-    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping')
+    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping', 'driving')
   })
 
   it('treats a throwing probe as unknown and proceeds', async () => {
@@ -135,11 +137,13 @@ describe('sendTerminal absence gate for leaf-branch writes', () => {
       }
     })
 
-    await expect(runtime.sendTerminal(handle, { text: 'ping' })).resolves.toMatchObject({
+    await expect(
+      runtime.sendTerminal(handle, { text: 'ping' }, { inputKind: 'driving' })
+    ).resolves.toMatchObject({
       accepted: true
     })
 
-    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping')
+    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping', 'driving')
   })
 
   it('proceeds when the probe answers live (restored session before its pane remounts)', async () => {
@@ -147,21 +151,25 @@ describe('sendTerminal absence gate for leaf-branch writes', () => {
       probePtyLiveness: async () => true
     })
 
-    await expect(runtime.sendTerminal(handle, { text: 'ping' })).resolves.toMatchObject({
+    await expect(
+      runtime.sendTerminal(handle, { text: 'ping' }, { inputKind: 'driving' })
+    ).resolves.toMatchObject({
       accepted: true
     })
 
-    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping')
+    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping', 'driving')
   })
 
   it('proceeds unchanged when the controller exposes no probe', async () => {
     const { runtime, handle, write } = await makeRuntimeWithLeafHandle({})
 
-    await expect(runtime.sendTerminal(handle, { text: 'ping' })).resolves.toMatchObject({
+    await expect(
+      runtime.sendTerminal(handle, { text: 'ping' }, { inputKind: 'driving' })
+    ).resolves.toMatchObject({
       accepted: true
     })
 
-    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping')
+    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping', 'driving')
   })
 
   it('never probes when the provider synchronously knows the id (live pty)', async () => {
@@ -171,24 +179,26 @@ describe('sendTerminal absence gate for leaf-branch writes', () => {
       hasPty: (ptyId) => ptyId === STALE_PTY_ID
     })
 
-    await expect(runtime.sendTerminal(handle, { text: 'ping' })).resolves.toMatchObject({
+    await expect(
+      runtime.sendTerminal(handle, { text: 'ping' }, { inputKind: 'driving' })
+    ).resolves.toMatchObject({
       accepted: true
     })
 
     expect(probe).not.toHaveBeenCalled()
-    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping')
+    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping', 'driving')
   })
 
   it('reuses a proven-absent verdict across repeated sends instead of re-probing', async () => {
     const probe = vi.fn(async () => false)
     const { runtime, handle } = await makeRuntimeWithLeafHandle({ probePtyLiveness: probe })
 
-    await expect(runtime.sendTerminal(handle, { text: 'a' })).rejects.toThrow(
-      'terminal_not_writable'
-    )
-    await expect(runtime.sendTerminal(handle, { text: 'b' })).rejects.toThrow(
-      'terminal_not_writable'
-    )
+    await expect(
+      runtime.sendTerminal(handle, { text: 'a' }, { inputKind: 'driving' })
+    ).rejects.toThrow('terminal_not_writable')
+    await expect(
+      runtime.sendTerminal(handle, { text: 'b' }, { inputKind: 'driving' })
+    ).rejects.toThrow('terminal_not_writable')
 
     expect(probe).toHaveBeenCalledTimes(1)
   })
@@ -201,17 +211,19 @@ describe('sendTerminal absence gate for leaf-branch writes', () => {
       hasPty: (ptyId) => livePtyIds.has(ptyId)
     })
 
-    await expect(runtime.sendTerminal(handle, { text: 'a' })).rejects.toThrow(
-      'terminal_not_writable'
-    )
+    await expect(
+      runtime.sendTerminal(handle, { text: 'a' }, { inputKind: 'driving' })
+    ).rejects.toThrow('terminal_not_writable')
     // Same id recreated by a fresh spawn: provider knowledge must beat the verdict.
     livePtyIds.add(STALE_PTY_ID)
 
-    await expect(runtime.sendTerminal(handle, { text: 'b' })).resolves.toMatchObject({
+    await expect(
+      runtime.sendTerminal(handle, { text: 'b' }, { inputKind: 'driving' })
+    ).resolves.toMatchObject({
       accepted: true
     })
     expect(probe).toHaveBeenCalledTimes(1)
-    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'b')
+    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'b', 'driving')
   })
 })
 
diff --git a/src/main/runtime/terminal-surface-close.test.ts b/src/main/runtime/terminal-surface-close.test.ts
new file mode 100644
index 00000000000..e149958ff34
--- /dev/null
+++ b/src/main/runtime/terminal-surface-close.test.ts
@@ -0,0 +1,85 @@
+import { describe, expect, it } from 'vitest'
+import type { TerminalLayoutSnapshot } from '../../shared/terminal-tab-types'
+import {
+  resolveTerminalCloseTarget,
+  type TerminalCloseLayoutCopies
+} from './terminal-surface-close'
+
+const PANE = { kind: 'pane', tabId: 'tab-1', leafId: 'leaf-a' } as const
+
+function layout(...leafIds: string[]): TerminalLayoutSnapshot {
+  const [first, second] = leafIds
+  return {
+    root:
+      first === undefined
+        ? null
+        : second === undefined
+          ? { type: 'leaf', leafId: first }
+          : {
+              type: 'split',
+              direction: 'horizontal',
+              first: { type: 'leaf', leafId: first },
+              second: { type: 'leaf', leafId: second }
+            },
+    activeLeafId: first ?? null,
+    expandedLeafId: null
+  }
+}
+
+function copies(overrides: Partial<TerminalCloseLayoutCopies>): TerminalCloseLayoutCopies {
+  return {
+    rendererListsTab: false,
+    snapshotRows: [],
+    graphLeafIds: [],
+    sessionLayout: undefined,
+    ...overrides
+  }
+}
+
+describe('resolveTerminalCloseTarget', () => {
+  it('never widens a pane close when the owner copy records no panes', () => {
+    // A renderer tab registered before its panes, with nothing published for it yet.
+    expect(resolveTerminalCloseTarget(PANE, copies({ rendererListsTab: true }))).toBe('absent')
+    // A main-owned tab whose layout was saved before its pane mounted, and no other copy.
+    expect(resolveTerminalCloseTarget(PANE, copies({ sessionLayout: layout() }))).toBe('absent')
+  })
+
+  it("closes the tab only when a copy positively shows this pane as the tab's one pane", () => {
+    const cases: [string, Partial<TerminalCloseLayoutCopies>][] = [
+      ['renderer graph', { rendererListsTab: true, graphLeafIds: ['leaf-a'] }],
+      [
+        'renderer rows with no layout or graph panes',
+        { rendererListsTab: true, snapshotRows: [{ leafId: 'leaf-a' }] }
+      ],
+      ['main session layout', { sessionLayout: layout('leaf-a') }],
+      [
+        'rows published for a main-owned tab whose saved layout is empty',
+        { sessionLayout: layout(), snapshotRows: [{ leafId: 'leaf-a', parentLayout: layout() }] }
+      ]
+    ]
+    for (const [name, overrides] of cases) {
+      expect([name, resolveTerminalCloseTarget(PANE, copies(overrides))]).toEqual([
+        name,
+        'last-pane'
+      ])
+    }
+  })
+
+  it('reads past an empty copy to one that records the split', () => {
+    expect(
+      resolveTerminalCloseTarget(
+        PANE,
+        copies({
+          sessionLayout: layout(),
+          snapshotRows: [{ leafId: 'leaf-a', parentLayout: layout('leaf-a', 'leaf-b') }]
+        })
+      )
+    ).toBe('pane')
+  })
+
+  it('treats a pane the owner copy lacks as absent', () => {
+    expect(
+      resolveTerminalCloseTarget(PANE, copies({ rendererListsTab: true, graphLeafIds: ['leaf-b'] }))
+    ).toBe('absent')
+  })
+})
diff --git a/src/main/runtime/terminal-surface-close.ts b/src/main/runtime/terminal-surface-close.ts
new file mode 100644
index 00000000000..0feee12402c
--- /dev/null
+++ b/src/main/runtime/terminal-surface-close.ts
@@ -0,0 +1,245 @@
+import type { RuntimeSessionTabCloseReason } from '../../shared/runtime-session-contracts'
+import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
+import {
+  hasClosedTerminalTabRecord,
+  recordClosedTerminalTabTombstone
+} from '../../shared/closed-terminal-tab-tombstones'
+import type {
+  TerminalLayoutSnapshot,
+  TerminalPaneLayoutNode
+} from '../../shared/terminal-tab-types'
+import type { TerminalSurfaceCloseTarget } from '../../shared/terminal-surface-close-target'
+import {
+  closeTerminalTabInWorkspaceSession,
+  type WorkspaceSessionTerminalTabCloseResult
+} from '../../shared/workspace-session-terminal-tab-close'
+import { retireTerminalSurfaceFromPersistence } from './mobile-session-terminal-persistence-retirement'
+import { advanceTerminalTopologyRevision } from './workspace-session-terminal-membership-authority'
+import type { DurableProfileStateMutation } from '../persistence/loading-store/store-runtime-state'
+import type { ExecutionHostId } from '../../shared/execution-host'
+
+/** Where a pane close lands: its own removal, its tab's last pane, or a pane the copy lacks. */
+export type PaneCloseResolution = 'pane' | 'last-pane' | 'absent'
+
+export function collectTerminalLayoutLeafIds(
+  node: TerminalPaneLayoutNode | null | undefined
+): string[] {
+  if (!node) {
+    return []
+  }
+  if (node.type === 'leaf') {
+    return [node.leafId]
+  }
+  return [...collectTerminalLayoutLeafIds(node.first), ...collectTerminalLayoutLeafIds(node.second)]
+}
+
+/**
+ * Resolves a pane close against the panes one copy records. Only a copy that positively shows this
+ * pane as its tab's one pane widens the close; a copy recording no panes knows nothing about it.
+ */
+export function resolvePaneClose(
+  leafIds: readonly string[] | null,
+  leafId: string
+): PaneCloseResolution {
+  if (!leafIds?.includes(leafId)) {
+    return 'absent'
+  }
+  return leafIds.length === 1 ? 'last-pane' : 'pane'
+}
+
+/** Every copy of a tab's panes main can read when it resolves a close it started. */
+export type TerminalCloseLayoutCopies = {
+  /** The desktop renderer lists the tab, so it owns the tab's panes. */
+  rendererListsTab: boolean
+  /** The tab's rows in the published session snapshot. */
+  snapshotRows: readonly { leafId: string; parentLayout?: TerminalLayoutSnapshot }[]
+  /** The tab's panes in the renderer-published runtime graph. */
+  graphLeafIds: readonly string[]
+  sessionLayout: TerminalLayoutSnapshot | undefined
+}
+
+/** Reads the panes from whoever owns the tab's layout; `null` means no copy records any. */
+function readLayoutOwnerLeafIds(copies: TerminalCloseLayoutCopies): readonly string[] | null {
+  const published =
+    copies.snapshotRows
+      .map((row) => collectTerminalLayoutLeafIds(row.parentLayout?.root))
+      .find((leafIds) => leafIds.length > 0) ?? []
+  const rows = copies.snapshotRows.map((row) => row.leafId)
+  // Why: main's saved layout lacks a renderer split whose PTY binding has not committed yet;
+  // the published layout outranks the graph, which relay recovery can leave with stale panes.
+  const ownerCopies = copies.rendererListsTab
+    ? [published, copies.graphLeafIds, rows]
+    : [collectTerminalLayoutLeafIds(copies.sessionLayout?.root), published, rows]
+  // Why: a layout saved before its pane mounted (or a graph before its panes register) is empty.
+  return ownerCopies.find((leafIds) => leafIds.length > 0) ?? null
+}
+
+/**
+ * The only place main turns a pane close into its tab's close: `last-pane` sends callers down
+ * the tab path (and its renderer pin guard); anything else closes that pane or nothing.
+ * D1 (main as the single layout writer) collapses the owner read to main's session layout alone.
+ */
+export function resolveTerminalCloseTarget(
+  target: TerminalSurfaceCloseTarget,
+  copies: TerminalCloseLayoutCopies
+): PaneCloseResolution | 'tab' {
+  return target.kind === 'tab'
+    ? 'tab'
+    : resolvePaneClose(readLayoutOwnerLeafIds(copies), target.leafId)
+}
+
+export type TerminalSurfaceCloseResult = WorkspaceSessionTerminalTabCloseResult & {
+  resolution: PaneCloseResolution | 'tab'
+}
+
+/**
+ * The membership half of every explicit terminal close: removes a tab, or one pane of a split
+ * tab, and advances the repo's topology revision so a stale renderer save cannot restore it.
+ * A pane close only ever removes that pane; the resolution says why anything else was a no-op.
+ * Every tab close is recorded in the session it was removed from, the owning host's partition.
+ */
+export function closeTerminalSurfaceInWorkspaceSession(
+  session: WorkspaceSessionState,
+  worktreeId: string,
+  target: TerminalSurfaceCloseTarget,
+  options: {
+    force?: boolean
+    paneIncarnationId?: string
+    reason: RuntimeSessionTabCloseReason
+    now?: number
+  }
+): TerminalSurfaceCloseResult {
+  if (target.kind === 'pane') {
+    const layout = session.terminalLayoutsByTabId[target.tabId]
+    const resolution = resolvePaneClose(
+      layout ? collectTerminalLayoutLeafIds(layout.root) : null,
+      target.leafId
+    )
+    // Why: the exit may already have retired this pane, leaving only live siblings to lose.
+    if (!layout || resolution !== 'pane') {
+      return { session, ptyIdsToKill: [], closed: false, pinned: false, resolution }
+    }
+    // The pane's own binding is passed so the retirement's stale-binding fence always admits it;
+    // the incarnation seen when the close was asked refuses a pane restarted since.
+    const retired = retireTerminalSurfaceFromPersistence(session, {
+      worktreeId,
+      parentTabId: target.tabId,
+      leafId: target.leafId,
+      ptyId: layout.ptyIdsByLeafId?.[target.leafId] ?? '',
+      ...(options.paneIncarnationId ? { incarnationId: options.paneIncarnationId } : {})
+    })
+    return {
+      session: retired,
+      ptyIdsToKill: [],
+      closed: retired !== session,
+      pinned: false,
+      resolution
+    }
+  }
+  const result = closeTerminalTabInWorkspaceSession(session, worktreeId, target.tabId, {
+    force: options.force
+  })
+  if (result.pinned) {
+    return { ...result, resolution: 'tab' }
+  }
+  // Why a tab this session never listed is still recorded: its spawn may commit later and graft it.
+  const recorded: WorkspaceSessionState = {
+    ...result.session,
+    closedTerminalTabTombstonesByTabId: recordClosedTerminalTabTombstone(
+      result.session.closedTerminalTabTombstonesByTabId,
+      target.tabId,
+      { worktreeId, reason: options.reason },
+      options.now ?? Date.now()
+    )
+  }
+  return {
+    ...result,
+    session: result.closed ? advanceTerminalTopologyRevision(recorded, worktreeId) : recorded,
+    resolution: 'tab'
+  }
+}
+
+/** How one close commits; `reason` is recorded only when the close resolves to the whole tab. */
+export type TerminalSurfaceCloseOptions = {
+  allowMissing?: boolean
+  force?: boolean
+  reason?: RuntimeSessionTabCloseReason
+  /** The desktop renderer's own close: its layout owner already removed the tab. Goes away with
+   *  D1, once main owns the terminal layout. */
+  closedByLayoutOwner?: boolean
+}
+
+/** The desktop renderer's close intent as its IPC delivers it; main alone passes 'pty-exit'. */
+export type RendererTerminalClose = {
+  worktreeId: string
+  target: TerminalSurfaceCloseTarget
+  reason?: 'user' | 'cleanup'
+}
+
+/** What one close's durable mutation reads and writes, resolved when the writer admits it. */
+export type TerminalSurfaceCloseCommit = {
+  worktreeId: string
+  target: TerminalSurfaceCloseTarget
+  options: TerminalSurfaceCloseOptions
+  /** The session as it was when the close was asked, before the writer admitted it. */
+  requestedSession: WorkspaceSessionState | null | undefined
+  /** The tab's owner identity still matches the one the close was asked against. */
+  ownerMatches: () => boolean
+  hostId: () => ExecutionHostId
+  getSession: (hostId: ExecutionHostId) => WorkspaceSessionState | null | undefined
+  setSession: (session: WorkspaceSessionState, hostId: ExecutionHostId) => void
+  onClosed: (ptyIdsToKill: string[]) => void
+}
+
+/** Builds the close's durable mutation: a refusal persists nothing and is its value. */
+export function terminalSurfaceCloseMutation(
+  commit: TerminalSurfaceCloseCommit
+): () => DurableProfileStateMutation<Error | undefined> {
+  const { target } = commit
+  // Why: a pane is fenced by its own binding, so a sibling split during the write cannot refuse it.
+  const paneIncarnationId =
+    target.kind === 'pane'
+      ? commit.requestedSession?.terminalPtyIncarnationsByPaneKey?.[
+          `${target.tabId}:${target.leafId}`
+        ]
+      : undefined
+  return () => {
+    if (!commit.ownerMatches()) {
+      return { value: new Error('terminal_pane_owner_changed'), persist: false }
+    }
+    const hostId = commit.hostId()
+    const session = commit.getSession(hostId)
+    if (!session) {
+      return { value: new Error('workspace_session_unavailable'), persist: false }
+    }
+    const result = closeTerminalSurfaceInWorkspaceSession(session, commit.worktreeId, target, {
+      force: commit.options.force,
+      paneIncarnationId,
+      reason: commit.options.reason ?? 'user'
+    })
+    if (result.pinned) {
+      return { value: new Error('terminal_tab_pinned'), persist: false }
+    }
+    if (!result.closed) {
+      // Why: a tab this session never listed still records its close, so its late spawn is refused;
+      // an existing record (an echo of that close) needs no second write.
+      if (
+        commit.options.allowMissing &&
+        target.kind === 'tab' &&
+        !hasClosedTerminalTabRecord(session.closedTerminalTabTombstonesByTabId, target.tabId)
+      ) {
+        commit.setSession(result.session, hostId)
+        return { value: undefined }
+      }
+      return {
+        value: commit.options.allowMissing ? undefined : new Error('tab_not_found'),
+        persist: false
+      }
+    }
+    commit.setSession(result.session, hostId)
+    commit.onClosed(result.ptyIdsToKill)
+    // Why no rollback: bookkeeping must not undo a user's close or skip its kill; a failed write
+    // keeps the removal dirty in memory, so the next write persists it.
+    return { value: undefined }
+  }
+}
diff --git a/src/main/runtime/terminal-wait-detection.ts b/src/main/runtime/terminal-wait-detection.ts
index e2b22b10427..2618a50279c 100644
--- a/src/main/runtime/terminal-wait-detection.ts
+++ b/src/main/runtime/terminal-wait-detection.ts
@@ -1,3 +1,4 @@
+import { isQoderComposerReady } from './qoder-terminal-readiness'
 import { memoizeTitleClassification } from '../../shared/terminal-title-classification-memo'
 import {
   detectAgentStatusFromTitle,
@@ -5,7 +6,15 @@ import {
   type AgentStatus
 } from '../../shared/agent-detection'
 import type { RuntimeTerminalWaitBlockedReason } from '../../shared/runtime-types'
+import type { TuiAgent } from '../../shared/tui-agent'
 import { findAntigravityReadyPromptIndex } from './antigravity-terminal-readiness'
+import {
+  findCodexHeaderIndex,
+  findCodexScreenReadyPromptIndex,
+  isCodexComposerReadyScreen,
+  isCodexProvisionalStartupText
+} from './codex-terminal-readiness'
+import { findStartupDialogBlockedSignals } from './startup-dialog-blocked-signals'
 import { startOfLastLines, startOfLastNonBlankLines } from './terminal-wait-tail-window'
 
 const EXPLICIT_IDLE_TITLE_RE = /(^|\s)(ready|idle|done)(\s|$|[.!?])/i
@@ -43,22 +52,72 @@ export const detectExplicitIdleStatusFromTitle: (title: string) => AgentStatus |
 
 export function isKnownReadyPromptPreview(preview: string): boolean {
   const normalized = preview.toLowerCase()
-  const readyIndex = findKnownReadyPromptIndex(normalized)
-  if (readyIndex === null) {
-    return false
-  }
-  const blockedSignal = findTerminalWaitBlockedSignal(normalized)
-  if (blockedSignal !== null && blockedSignal.index > readyIndex) {
-    return false
-  }
-  return true
+  return isReadyPromptUnblocked(normalized, findKnownReadyPromptIndex(normalized))
 }
 
-// Why separate from isKnownReadyPromptPreview: that one settles tier 1 immediately, while
-// a Muse ready screen only proves the TUI is up — the ranking holds it to quiescence.
-export function isMuseReadyPromptPreview(preview: string): boolean {
+/**
+ * The ready-prompt text rules for a pane about to take input. Unlike isKnownReadyPromptPreview
+ * (agent presence), Codex's provisional startup header does not count: 0.157 discards input typed
+ * behind it while its daemon starts.
+ */
+export function isKnownReadyPromptSettled(preview: string): boolean {
   const normalized = preview.toLowerCase()
-  const readyIndex = findMuseReadyPromptIndex(normalized)
+  return (
+    isReadyPromptUnblocked(normalized, findKnownReadyPromptIndex(normalized)) &&
+    !isCodexProvisionalStartupText(normalized)
+  )
+}
+
+/**
+ * Tier 1 body evidence for every tui-idle site. `readScreenLines` yields the live emulator's
+ * visible grid, or null when the runtime has no trustworthy one.
+ *
+ * Why the screen: Codex repaints its header by cell diff (`ESC[5;3Hdir ESC[5;7Hctory:`), which
+ * only a grid reassembles — the line-folded wait text reads `dirctory:` forever.
+ * Why it can only add readiness: a grid out of step with the PTY (size mismatch, resize
+ * mid-paint) garbles the header, so the text rules keep every verdict they give today.
+ */
+export function isKnownReadyPromptBody(
+  waitText: string,
+  agent: TuiAgent | null,
+  readScreenLines: () => readonly string[] | null
+): boolean {
+  if (agent === 'qoder') {
+    return isQoderComposerReady(readScreenLines())
+  }
+  if (isKnownReadyPromptSettled(waitText)) {
+    return true
+  }
+  // Why the agent gate: another agent's screen can merely mention "OpenAI Codex".
+  if (agent !== null && agent !== 'codex') {
+    return false
+  }
+  const screen = readScreen(readScreenLines)
+  return screen !== null && isReadyPromptUnblocked(screen, findCodexScreenReadyPromptIndex(screen))
+}
+
+/**
+ * Tier 1b body evidence: a ready screen from an agent with no title rest signal. Unlike tier 1
+ * it only proves the TUI is up, so the ranking holds it to quiescence.
+ * Why codex panes only: a `cat`ed transcript or pager in an unknown pane can show the composer.
+ */
+export function isQuietReadyScreenBody(
+  waitText: string,
+  agent: TuiAgent | null,
+  readScreenLines: () => readonly string[] | null
+): boolean {
+  if (agent === 'codex') {
+    const screen = readScreen(readScreenLines)
+    return screen !== null && isCodexComposerReadyScreen(screen)
+  }
+  return (agent === null || agent === 'muse') && isMuseReadyPromptPreview(waitText)
+}
+
+function readScreen(readScreenLines: () => readonly string[] | null): string | null {
+  return readScreenLines()?.join('\n').toLowerCase() ?? null
+}
+
+function isReadyPromptUnblocked(normalized: string, readyIndex: number | null): boolean {
   if (readyIndex === null) {
     return false
   }
@@ -66,6 +125,11 @@ export function isMuseReadyPromptPreview(preview: string): boolean {
   return blockedSignal === null || blockedSignal.index <= readyIndex
 }
 
+export function isMuseReadyPromptPreview(preview: string): boolean {
+  const normalized = preview.toLowerCase()
+  return isReadyPromptUnblocked(normalized, findMuseReadyPromptIndex(normalized))
+}
+
 export function detectTerminalWaitBlockedReason(
   preview: string
 ): RuntimeTerminalWaitBlockedReason | null {
@@ -91,6 +155,7 @@ export function findActionableTerminalWaitBlockedSignal(
 function findDismissedStartupModalIndex(normalized: string): number | null {
   const indexes = [
     findCodexReadyPromptIndex(normalized),
+    findCodexHeaderIndex(normalized),
     findAntigravityReadyPromptIndex(normalized),
     findCursorActivePromptIndex(normalized),
     findMuseReadyPromptIndex(normalized)
@@ -151,7 +216,7 @@ function findCodexReadyPromptIndex(normalized: string): number | null {
 }
 
 export const TERMINAL_WAIT_BLOCKED_SENTINEL_RE =
-  /update available|choose working directory to|codex just got an upgrade|hooks need review|do you trust|trust this|trusted workspace|press enter to (?:confirm|continue|view|insert)|press t to trust|permission required|requires permission|allow once|allow always|run this command\?/i
+  /update available|choose working directory to|codex just got an upgrade|available\s*·|esc\s*skip|enter\s*confirm\s*·|enter\/esc\s*(?:continue|confirm)|hooks need review|do you trust|trust this|trusted workspace|press enter to (?:confirm|continue|view|insert)|press t to trust|permission required|requires permission|allow once|allow always|run this command\?/i
 
 // Why text at all: cursor-agent has no approval hook, so the key-bound menu is the only authority.
 const CURSOR_APPROVAL_CHOICE_MARKERS = [
@@ -220,27 +285,7 @@ function findTerminalWaitBlockedSignal(
 function findBlockedSignalInLiveWindow(
   normalized: string
 ): { reason: RuntimeTerminalWaitBlockedReason; index: number } | null {
-  const candidates: { reason: RuntimeTerminalWaitBlockedReason; index: number }[] = []
-  const updateIndex = normalized.lastIndexOf('update available')
-  if (updateIndex !== -1 && normalized.includes('press enter to continue', updateIndex)) {
-    candidates.push({ reason: 'agent-update-prompt', index: updateIndex })
-  }
-  const cwdIndex = normalized.lastIndexOf('choose working directory to')
-  if (cwdIndex !== -1 && normalized.includes('press enter to continue', cwdIndex)) {
-    candidates.push({ reason: 'agent-cwd-prompt', index: cwdIndex })
-  }
-  const modelMigrationIndex = normalized.lastIndexOf('codex just got an upgrade')
-  if (
-    modelMigrationIndex !== -1 &&
-    normalized.includes('press enter to continue', modelMigrationIndex)
-  ) {
-    candidates.push({ reason: 'codex-model-migration-prompt', index: modelMigrationIndex })
-  }
-  const hooksIndex = normalized.lastIndexOf('hooks need review')
-  if (hooksIndex !== -1 && normalized.includes('press enter to confirm', hooksIndex)) {
-    // Why neutral: this matcher never inspects the agent -- 'hooks need review' is not Codex-only wording.
-    candidates.push({ reason: 'agent-hooks-review-prompt', index: hooksIndex })
-  }
+  const candidates = findStartupDialogBlockedSignals(normalized)
   const trustIndex = Math.max(
     normalized.lastIndexOf('do you trust'),
     normalized.lastIndexOf('trust this'),
diff --git a/src/main/runtime/terminal-wait-name-only-idle.test.ts b/src/main/runtime/terminal-wait-name-only-idle.test.ts
index 95cfa54be56..cf4648bf353 100644
--- a/src/main/runtime/terminal-wait-name-only-idle.test.ts
+++ b/src/main/runtime/terminal-wait-name-only-idle.test.ts
@@ -51,12 +51,15 @@ function createWait(options: {
     getAdoptedPtyIdleStatus: () => options.adoptedIdleStatus ?? null,
     getPaneAgent: () => options.agent ?? null,
     getFirstPartyAgentStatus: () => options.firstPartyStatus ?? null,
+    readScreenLines: () => null,
+    readVisibleScreen: () => null,
     quiescenceMs: QUIESCENCE_MS
   }
   const polls = new RuntimeTerminalIdlePolls({
     ...shared,
     intervalMs: POLL_INTERVAL_MS,
     getForegroundProcess: () => Promise.resolve(options.foreground ?? null),
+    hasCommandPainted: () => true,
     getLiveLeaf: (leaf) => options.liveLeaf?.() ?? leaf,
     resolve: (waiter, result) => waiters.resolve(waiter, result)
   })
diff --git a/src/main/runtime/tui-idle-command-paint.test.ts b/src/main/runtime/tui-idle-command-paint.test.ts
new file mode 100644
index 00000000000..fda31e06ebb
--- /dev/null
+++ b/src/main/runtime/tui-idle-command-paint.test.ts
@@ -0,0 +1,57 @@
+/**
+ * An agent with no rest signal of its own (amp) settles only on a quiet foreground, and only
+ * once it has painted. The shell's prompt and the echoed launch command land first, so the
+ * runtime must tell them apart from the agent's paint by the shell's command-start marker.
+ */
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createTranscriptPane, TRANSCRIPT_PANE_PTY_ID } from './agent-transcript-pane-test-harness'
+
+const POLL_INTERVAL_MS = 2_000
+
+describe('tui-idle on an agent with no rest signal', () => {
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('waits through a silent boot after the shell echoed the command, then settles on the paint', async () => {
+    const { runtime, handle } = await createTranscriptPane({
+      paneTitle: 'Terminal',
+      foregroundProcess: 'amp',
+      launchAgent: 'amp',
+      data: ''
+    })
+    vi.useFakeTimers()
+    const write = (chunk: string) => runtime.onPtyData(TRANSCRIPT_PANE_PTY_ID, chunk, Date.now())
+    write('\x1b]133;A\x07~/repo % amp\r\n\x1b]133;C\x07\x1b]0;amp\x07')
+    const settled = vi.fn()
+    const wait = runtime.waitForTerminal(handle, { condition: 'tui-idle', timeoutMs: 60_000 })
+    wait.then(settled, () => {})
+
+    await vi.advanceTimersByTimeAsync(POLL_INTERVAL_MS * 5)
+    expect(settled).not.toHaveBeenCalled()
+
+    write('\x1b[?1049h\x1b[H╭─ Amp ─╮\r\n│ > │')
+    await vi.advanceTimersByTimeAsync(POLL_INTERVAL_MS * 3)
+    await expect(wait).resolves.toMatchObject({ satisfied: true })
+  })
+
+  it('does not finish a command-start marker cut off by dropped output', async () => {
+    const { runtime, handle } = await createTranscriptPane({
+      paneTitle: 'Terminal',
+      foregroundProcess: 'amp',
+      launchAgent: 'amp',
+      data: ''
+    })
+    vi.useFakeTimers()
+    const write = (chunk: string) => runtime.onPtyData(TRANSCRIPT_PANE_PTY_ID, chunk, Date.now())
+    // Fish's marker carries the command line, so a cut-off one can terminate on unrelated output.
+    write('~/repo % amp\r\n\x1b]133;C;cmdline_url=am')
+    runtime.notePtyDataGap(TRANSCRIPT_PANE_PTY_ID, 4096)
+    write('╭─ Amp ─╮\r\n│ > │\x1b]0;amp\x07')
+    const wait = runtime.waitForTerminal(handle, { condition: 'tui-idle', timeoutMs: 60_000 })
+
+    await vi.advanceTimersByTimeAsync(POLL_INTERVAL_MS * 3)
+    await expect(wait).resolves.toMatchObject({ satisfied: true })
+  })
+})
diff --git a/src/main/runtime/tui-idle-evidence.test.ts b/src/main/runtime/tui-idle-evidence.test.ts
index d4c9adfa6fb..ee8e908c61b 100644
--- a/src/main/runtime/tui-idle-evidence.test.ts
+++ b/src/main/runtime/tui-idle-evidence.test.ts
@@ -1,9 +1,17 @@
 import { describe, expect, it } from 'vitest'
+import { detectAgentStatusFromTitle } from '../../shared/agent-title-status'
+import { getSyntheticAgentTerminalTitle } from '../../shared/synthetic-agent-title'
+import { isTuiAgent, TUI_AGENT_CONFIG } from '../../shared/tui-agent-config'
+import { getTuiAgentRestSignal } from '../../shared/tui-agent-rest-signal'
+import { isKnownReadyPromptBody } from './terminal-wait-detection'
 import {
-  hasQuietMuseReadyPrompt,
-  isTuiIdleSatisfied,
-  type TuiIdleEvidenceRecord,
-  type TuiIdleSatisfactionInput
+  evaluateTuiIdle,
+  hasFreshDoneFirstPartyStatus,
+  hasQuietReadyScreen,
+  isTuiIdleReadyVerdict,
+  nameOnlyIdleNeedsCorroboration,
+  type TuiIdleEvaluationInput,
+  type TuiIdleEvidenceRecord
 } from './tui-idle-evidence'
 
 const QUIESCENCE_MS = 3000
@@ -17,11 +25,12 @@ function record(overrides: Partial<TuiIdleEvidenceRecord> = {}): TuiIdleEvidence
   }
 }
 
-function input(overrides: Partial<TuiIdleSatisfactionInput> = {}): TuiIdleSatisfactionInput {
+function input(overrides: Partial<TuiIdleEvaluationInput> = {}): TuiIdleEvaluationInput {
   return {
     record: record(),
+    readTailBlockedReason: () => null,
     readPositiveBodyEvidence: () => false,
-    readMuseReadyBodyEvidence: () => true,
+    readQuietReadyBodyEvidence: () => true,
     agent: 'muse',
     firstPartyStatus: null,
     quiescenceMs: QUIESCENCE_MS,
@@ -29,50 +38,238 @@ function input(overrides: Partial<TuiIdleSatisfactionInput> = {}): TuiIdleSatisf
   }
 }
 
-describe('hasQuietMuseReadyPrompt', () => {
+describe('hasQuietReadyScreen', () => {
   it('settles a Muse ready screen once the stream has gone quiet', () => {
-    expect(hasQuietMuseReadyPrompt(record(), 'muse', () => true, QUIESCENCE_MS)).toBe(true)
+    expect(hasQuietReadyScreen(record(), 'muse', () => true, QUIESCENCE_MS)).toBe(true)
   })
 
   it('refuses while the pane is still streaming', () => {
     expect(
-      hasQuietMuseReadyPrompt(
-        record({ lastOutputAt: Date.now() }),
-        'muse',
-        () => true,
-        QUIESCENCE_MS
-      )
+      hasQuietReadyScreen(record({ lastOutputAt: Date.now() }), 'muse', () => true, QUIESCENCE_MS)
     ).toBe(false)
   })
 
   it('refuses without an output clock, like the tier-3 lane', () => {
     expect(
-      hasQuietMuseReadyPrompt(record({ lastOutputAt: null }), 'muse', () => true, QUIESCENCE_MS)
+      hasQuietReadyScreen(record({ lastOutputAt: null }), 'muse', () => true, QUIESCENCE_MS)
     ).toBe(false)
   })
 
   it('refuses without a ready screen', () => {
-    expect(hasQuietMuseReadyPrompt(record(), 'muse', () => false, QUIESCENCE_MS)).toBe(false)
+    expect(hasQuietReadyScreen(record(), 'muse', () => false, QUIESCENCE_MS)).toBe(false)
   })
 
   it('covers adopted panes that carry no launch metadata', () => {
-    expect(hasQuietMuseReadyPrompt(record(), null, () => true, QUIESCENCE_MS)).toBe(true)
-    expect(hasQuietMuseReadyPrompt(record(), undefined, () => true, QUIESCENCE_MS)).toBe(true)
+    expect(hasQuietReadyScreen(record(), null, () => true, QUIESCENCE_MS)).toBe(true)
+    expect(hasQuietReadyScreen(record(), undefined, () => true, QUIESCENCE_MS)).toBe(true)
   })
 
-  it('refuses another agent quoting Muse in its scrollback', () => {
-    expect(hasQuietMuseReadyPrompt(record(), 'codex', () => true, QUIESCENCE_MS)).toBe(false)
+  it('covers Codex, whose title carries no rest signal once idle', () => {
+    expect(hasQuietReadyScreen(record(), 'codex', () => true, QUIESCENCE_MS)).toBe(true)
+  })
+
+  it('refuses another agent quoting Muse or Codex in its scrollback', () => {
+    expect(hasQuietReadyScreen(record(), 'claude', () => true, QUIESCENCE_MS)).toBe(false)
   })
 })
 
-describe('isTuiIdleSatisfied muse lane', () => {
+describe('evaluateTuiIdle muse lane', () => {
   it('settles a quiet Muse pane with no title signal at all', () => {
-    expect(isTuiIdleSatisfied(input())).toBe(true)
+    expect(evaluateTuiIdle(input())).toEqual({ kind: 'ready-strong' })
   })
 
   it('lets a fresh first-party working status veto the Muse body', () => {
     expect(
-      isTuiIdleSatisfied(input({ firstPartyStatus: { state: 'working', updatedAt: Date.now() } }))
+      evaluateTuiIdle(input({ firstPartyStatus: { state: 'working', updatedAt: Date.now() } }))
+    ).toEqual({ kind: 'working' })
+  })
+})
+
+describe('evaluateTuiIdle ranking', () => {
+  const noMuse = { readQuietReadyBodyEvidence: () => false }
+
+  it('ranks a blocking prompt in the tail above an explicit idle title', () => {
+    const verdict = evaluateTuiIdle(
+      input({
+        ...noMuse,
+        agent: 'claude',
+        record: record({ lastAgentStatus: 'idle', lastOscTitle: '✳ Claude Code' }),
+        readTailBlockedReason: () => 'agent-trust-workspace'
+      })
+    )
+    expect(verdict).toEqual({ kind: 'blocked', reason: 'agent-trust-workspace' })
+  })
+
+  it("calls an agent's own idle title strong", () => {
+    const verdict = evaluateTuiIdle(
+      input({
+        ...noMuse,
+        agent: 'claude',
+        record: record({ lastAgentStatus: 'idle', lastOscTitle: '✳ Claude Code' })
+      })
+    )
+    expect(verdict).toEqual({ kind: 'ready-strong' })
+  })
+
+  it('calls a name-only title weak, even for an agent it is the only rest signal of', () => {
+    const verdict = evaluateTuiIdle(
+      input({ ...noMuse, agent: 'grok', record: record({ lastAgentStatus: 'idle' }) })
+    )
+    expect(verdict).toEqual({ kind: 'ready-weak' })
+  })
+
+  it("holds Claude's bare name to the quiet window, as an agent that announces rest itself", () => {
+    const streaming = record({
+      lastAgentStatus: 'idle',
+      lastOscTitle: 'claude',
+      lastOutputAt: Date.now()
+    })
+    expect(evaluateTuiIdle(input({ ...noMuse, agent: 'claude', record: streaming }))).toEqual({
+      kind: 'pending',
+      quietForeground: 'closed'
+    })
+    const quiet = record({ lastAgentStatus: 'idle', lastOscTitle: 'claude' })
+    expect(evaluateTuiIdle(input({ ...noMuse, agent: 'claude', record: quiet }))).toEqual({
+      kind: 'ready-weak'
+    })
+  })
+
+  it('reads working, which suppresses the screen read, from a working title', () => {
+    const verdict = evaluateTuiIdle(
+      input({ ...noMuse, agent: 'claude', record: record({ lastAgentStatus: 'working' }) })
+    )
+    expect(verdict).toEqual({ kind: 'working' })
+  })
+
+  it('keeps a first-party blocked status pending, so the screen is still read', () => {
+    const verdict = evaluateTuiIdle(
+      input({
+        ...noMuse,
+        agent: null,
+        record: record({ lastAgentStatus: 'idle', lastOscTitle: 'claude' }),
+        firstPartyStatus: { state: 'blocked', updatedAt: Date.now() }
+      })
+    )
+    expect(verdict).toEqual({ kind: 'pending', quietForeground: 'closed' })
+  })
+
+  it('leaves the quiet-foreground lane open for an unidentified pane with no title status', () => {
+    expect(evaluateTuiIdle(input({ ...noMuse, agent: null }))).toEqual({
+      kind: 'pending',
+      quietForeground: 'open'
+    })
+  })
+
+  it('closes the quiet-foreground lane for an agent with a stronger rest signal still to come', () => {
+    for (const agent of ['claude', 'codex', 'grok', 'dsh'] as const) {
+      expect(evaluateTuiIdle(input({ ...noMuse, agent }))).toEqual({
+        kind: 'pending',
+        quietForeground: 'closed'
+      })
+    }
+  })
+
+  // Why: a launched agent whose title Orca cannot classify has no other lane; closing this
+  // one for every known agent left `worker start` failing at agent_readiness (STA-7440).
+  it('keeps the quiet-foreground lane for an agent with no other rest signal, after it paints', () => {
+    for (const agent of ['amp', 'goose', 'crush', 'kimi', 'qwen-code', 'rovo', 'aug'] as const) {
+      expect(evaluateTuiIdle(input({ ...noMuse, agent }))).toEqual({
+        kind: 'pending',
+        quietForeground: 'after-paint'
+      })
+    }
+  })
+
+  it('closes the lane once any title has classified, so a title that does arrive outranks it', () => {
+    const verdict = evaluateTuiIdle(
+      input({ ...noMuse, agent: 'amp', record: record({ lastAgentStatus: 'permission' }) })
+    )
+    expect(verdict).toEqual({ kind: 'pending', quietForeground: 'closed' })
+  })
+})
+
+// Why: `none` reopens the quiet-foreground lane, which is only safe where no stronger lane
+// could have settled the wait; the identity-keyed lanes must agree with the declared signal.
+describe('rest signal agrees with the lanes that can settle a wait', () => {
+  it.each(Object.keys(TUI_AGENT_CONFIG).filter(isTuiAgent))('%s', (agent) => {
+    const signal = getTuiAgentRestSignal(agent)
+    const hookDone = hasFreshDoneFirstPartyStatus(agent, { state: 'done', updatedAt: Date.now() })
+    expect(hookDone).toBe(signal === 'hook-done')
+    let screenRead = false
+    isKnownReadyPromptBody('', agent, () => {
+      screenRead = true
+      return null
+    })
+    const quietScreenBody = hasQuietReadyScreen(record(), agent, () => true, QUIESCENCE_MS)
+    // Why not only ready-body: Codex keeps its stronger hook-driven title beside this lane.
+    if (quietScreenBody) {
+      expect(signal).not.toBe('none')
+    }
+    // Why a screen read also counts: Qoder's ready body is its composer, read by identity.
+    if (signal === 'ready-body') {
+      expect(quietScreenBody || screenRead).toBe(true)
+    }
+    if (signal !== 'none') {
+      return
+    }
+    expect({
+      screenRead,
+      syntheticTitle: getSyntheticAgentTerminalTitle(agent, 'done'),
+      processTitle: detectAgentStatusFromTitle(TUI_AGENT_CONFIG[agent].expectedProcess)
+    }).toEqual({ screenRead: false, syntheticTitle: null, processTitle: null })
+  })
+})
+
+describe('nameOnlyIdleNeedsCorroboration', () => {
+  it('holds agents that announce rest with an explicit title, native or synthesized', () => {
+    expect(nameOnlyIdleNeedsCorroboration('claude')).toBe(true)
+    expect(nameOnlyIdleNeedsCorroboration('codex')).toBe(true)
+  })
+
+  it('exempts agents whose name is their only rest signal', () => {
+    expect(nameOnlyIdleNeedsCorroboration('grok')).toBe(false)
+  })
+
+  it("names an adopted pane's agent from a shell auto-title", () => {
+    expect(nameOnlyIdleNeedsCorroboration(null, 'claude')).toBe(true)
+    expect(nameOnlyIdleNeedsCorroboration(null, 'claude ~/p/repo')).toBe(true)
+  })
+})
+
+describe('a DSH pane settles tui-idle on its own hook', () => {
+  const base = {
+    record: { lastAgentStatus: null, lastOutputAt: null, lastOscTitle: '\u2726 \u{1F40B} repo' },
+    rendererTitle: undefined,
+    readPositiveBodyEvidence: () => false,
+    readQuietReadyBodyEvidence: () => false,
+    readTailBlockedReason: () => null,
+    agent: 'dsh' as const,
+    firstPartyStatus: { state: 'done' as const, updatedAt: Date.now() },
+    quiescenceMs: 1_000
+  } satisfies TuiIdleEvaluationInput
+
+  const ready = (over: Partial<TuiIdleEvaluationInput> = {}) =>
+    isTuiIdleReadyVerdict(evaluateTuiIdle({ ...base, ...over }))
+
+  it('settles on a fresh first-party done', () => {
+    // The regression: DSH's title carries no idle (its rest glyph is Gemini's working one),
+    // so every title-reading tier failed and `terminal wait --for tui-idle` ran to timeout
+    // against an already-ready composer.
+    expect(ready()).toBe(true)
+  })
+
+  it('does not settle while the same pane reports working', () => {
+    expect(ready({ firstPartyStatus: { state: 'working', updatedAt: Date.now() } })).toBe(false)
+  })
+
+  it('does not settle on a stale done', () => {
+    expect(
+      ready({ firstPartyStatus: { state: 'done', updatedAt: Date.now() - 31 * 60 * 1000 } })
     ).toBe(false)
+  })
+
+  it('leaves other agents on the title lanes', () => {
+    // Scoped on purpose: an agent whose hooks report child turns can emit `done` mid-turn.
+    expect(ready({ agent: 'claude' })).toBe(false)
   })
 })
diff --git a/src/main/runtime/tui-idle-evidence.ts b/src/main/runtime/tui-idle-evidence.ts
index 0ca43b15a6c..cb7dc13714b 100644
--- a/src/main/runtime/tui-idle-evidence.ts
+++ b/src/main/runtime/tui-idle-evidence.ts
@@ -1,10 +1,21 @@
 import type { AgentStatus } from '../../shared/agent-detection'
-import { isFreshNonDoneAgentStatus } from '../../shared/agent-status-freshness'
+import {
+  AGENT_STATUS_STALE_AFTER_MS,
+  isFreshNonDoneAgentStatus
+} from '../../shared/agent-status-freshness'
 import type { AgentStatusState } from '../../shared/agent-status-types'
+import type { RuntimeTerminalWaitBlockedReason } from '../../shared/runtime-types'
 import { getSyntheticAgentTerminalTitle } from '../../shared/synthetic-agent-title'
 import { resolveExplicitTerminalTitleAgentType } from '../../shared/terminal-title-agent-type'
 import type { TuiAgent } from '../../shared/tui-agent'
-import { detectExplicitIdleStatusFromTitle } from './terminal-wait-detection'
+import { getTuiAgentRestSignal } from '../../shared/tui-agent-rest-signal'
+import type { RuntimeLeafRecord, RuntimePtyWorktreeRecord } from './runtime-terminal-state-records'
+import {
+  detectExplicitIdleStatusFromTitle,
+  detectTerminalWaitBlockedReason,
+  isKnownReadyPromptBody,
+  isQuietReadyScreenBody
+} from './terminal-wait-detection'
 
 /**
  * Ranking the evidence that a `tui-idle` wait may settle on.
@@ -15,15 +26,21 @@ import { detectExplicitIdleStatusFromTitle } from './terminal-wait-detection'
  * stale spinner (#1437) — so a busy Codex/Devin pane is routinely titled idle, and
  * accepting it satisfied a wait in ~0s mid-turn (#6011).
  *
- *   1. POSITIVE — the agent states it is ready: an explicit idle marker in its own
+ *   0. BLOCKED — the tail shows a prompt waiting on the user.
+ *   1. STRONG READY — the agent states it is ready: an explicit idle marker in its own
  *      title, or a known ready-prompt body.
- *   1b. MUSE — Muse emits no title signal at all, so its ready-screen body stands in
- *      for the positive evidence, believed only once the stream has gone quiet.
- *   2. VETO — a fresh first-party agent status (OSC 9999) saying working/blocked/
- *      waiting. The agent's own account of itself outranks anything inferred.
- *   3. ABSENCE — a name-only title, or a quiet non-shell foreground process. A last
+ *   1b. QUIET READY SCREEN — Muse and an idle Codex title no rest signal, so their
+ *      ready-screen body stands in for the strong evidence, believed only once quiet.
+ *   2. WORKING — a fresh first-party agent status (OSC 9999) saying working/blocked/
+ *      waiting, or a working title. The agent's own account of itself outranks anything
+ *      inferred.
+ *   3. WEAK READY — a name-only title, or a quiet non-shell foreground process. A last
  *      resort, and only once sustained.
  *
+ * Why weak ready is a verdict class rather than a per-evidence flag: none of it can see a
+ * start-up dialog the line tail lost (Claude's workspace trust), so ONLY the poll may settle
+ * on it, after the rendered screen shows no blocker. Synchronous sites settle on tiers 0-1b.
+ *
  * Why derived here rather than stamped onto the record at write time: `syncWindowGraph`
  * rebuilds every leaf from an explicit field list, so a bespoke provenance field is
  * silently dropped on any renderer publish and the verdict silently flips. `lastOscTitle`
@@ -55,19 +72,53 @@ export function hasExplicitIdleTitle(
   return false
 }
 
+/**
+ * Tier 1, first-party: the agent's own hook says the turn ENDED.
+ *
+ * Why DSH needs its own lane: the other tiers all read the title, and DSH cannot carry idle
+ * there. Its rest prefix is `✦`, which is Gemini's WORKING glyph, so the title detector
+ * deliberately reports no status for a DSH pane at all (see agent-title-status.ts) — which
+ * left `tui-idle` with nothing to settle on, and a supervised worker waiting on a ready
+ * composer until its timeout.
+ *
+ * Why a hook `done` is trustworthy here where a title would not be: it is the agent's own
+ * account of its own turn, and `normalizeDshEvent` drops SubagentStart/SubagentStop, so a
+ * `done` row for a DSH pane is the LEAD's, never a child's finishing early.
+ *
+ * Scoped rather than general: for agents whose hooks do report child turns, a `done` row
+ * can arrive mid-turn, and settling on it is exactly the #6011 class this file exists to
+ * prevent.
+ */
+export function hasFreshDoneFirstPartyStatus(
+  agent: TuiAgent | null | undefined,
+  status: FirstPartyAgentStatus,
+  staleAfterMs = AGENT_STATUS_STALE_AFTER_MS
+): boolean {
+  if (agent !== 'dsh' || status?.state !== 'done') {
+    return false
+  }
+  return Date.now() - status.updatedAt <= staleAfterMs
+}
+
 /** Tier 2: the agent's own status stream says this turn is still open. */
 export function hasFreshWorkingFirstPartyStatus(status: FirstPartyAgentStatus): boolean {
   return isFreshNonDoneAgentStatus(status ?? undefined)
 }
 
+/** Agents that paint their own explicit rest title (Claude's `✳`). Gemini's `◇` would qualify
+ *  but is not yet held to it. */
+const NATIVE_EXPLICIT_IDLE_TITLE_AGENTS: ReadonlySet<TuiAgent> = new Set(['claude'])
+
 /**
- * Whether a name-only title from `agent` may be held to the tier-3 quiescence demand.
+ * Whether a name-only title from `agent` must be corroborated by a quiet stream.
  *
- * Only for agents that go on to announce rest with an explicit title of their own (the
- * hook-driven `Codex ready` / `Devin ready`). Grok, Copilot, Aider, Mimo, agy and
- * OpenCode emit their NAME and nothing more at rest, so holding them to it leaves no
- * settle signal at all: a real idle Grok pane repaints its banner about four times a
- * second forever, so the stream never quiesces and the wait runs to timeout.
+ * Only for agents that announce rest with an explicit title of their own: the hook-driven
+ * `Codex ready` / `Devin ready`, or Claude's `✳`. For them the bare name is not a rest signal —
+ * a shell auto-title (`claude`, `claude ~/repo`) names the agent from the moment it starts, over
+ * a start-up dialog or a busy turn alike. Grok, Copilot, Aider, Mimo, agy and OpenCode emit
+ * their NAME and nothing more at rest, so holding them to it leaves no settle signal at all:
+ * a real idle Grok pane repaints its banner about four times a second forever, so the stream
+ * never quiesces and the wait runs to timeout.
  */
 export function nameOnlyIdleNeedsCorroboration(
   agent: TuiAgent | null | undefined,
@@ -76,7 +127,11 @@ export function nameOnlyIdleNeedsCorroboration(
   // Why the title fallback: an adopted pane carries no launch metadata, but its
   // name-only title is exactly the thing that names the agent.
   const resolved = agent ?? (title ? resolveExplicitTerminalTitleAgentType(title) : null)
-  return getSyntheticAgentTerminalTitle(resolved, 'done') !== null
+  return (
+    resolved !== null &&
+    (NATIVE_EXPLICIT_IDLE_TITLE_AGENTS.has(resolved) ||
+      getSyntheticAgentTerminalTitle(resolved, 'done') !== null)
+  )
 }
 
 /** Tier 3: a title-derived idle, usable only once the stream has also gone quiet. */
@@ -103,17 +158,28 @@ export function hasSustainedTitleIdle(
 }
 
 /**
- * Tier 3, cold start: Orca launched a known agent on this PTY, so a quiet non-shell
- * foreground process is an agent still booting, not one sitting at its prompt. Resolving
- * on it is what let `dispatch --inject` write into a TUI that had not yet attached its
- * reader and silently lose the prompt (#9976).
+ * When a quiet non-shell foreground process may settle a pending wait.
+ * - `closed`: the agent has a stronger rest signal, so its silence is boot, not rest.
+ *   Resolving on it let `dispatch --inject` write into a TUI that had not yet attached
+ *   its reader and silently lose the prompt (#9976).
+ * - `after-paint`: Orca knows an agent runs here but it has no other rest signal, so this
+ *   lane is its only one. A TUI that has painted nothing yet is still booting.
+ * - `open`: nothing is known about the pane, so a missing output clock also counts as quiet
+ *   (see isQuietForQuiescence).
  */
-export function quietForegroundProcessProvesTuiIdle(agent: TuiAgent | null | undefined): boolean {
-  return !agent
+export type QuietForegroundLane = 'closed' | 'after-paint' | 'open'
+
+function quietForegroundLane(agent: TuiAgent | null | undefined): QuietForegroundLane {
+  if (!agent) {
+    return 'open'
+  }
+  return getTuiAgentRestSignal(agent) === 'none' ? 'after-paint' : 'closed'
 }
 
-export type TuiIdleSatisfactionInput = {
+export type TuiIdleEvaluationInput = {
   record: TuiIdleEvidenceRecord
+  /** Tier 0: a blocking prompt in the line tail. */
+  readTailBlockedReason: () => RuntimeTerminalWaitBlockedReason | null
   /** Renderer-synced pane/tab title, when one exists. */
   rendererTitle?: string | null
   /** Tier 1 body evidence: a known ready prompt, or an adopted pane's explicit title.
@@ -121,63 +187,174 @@ export type TuiIdleSatisfactionInput = {
    *  (~11us and a multi-KB string on a full tail); the title check below usually answers
    *  first, and then none of that has to happen at all. */
   readPositiveBodyEvidence: () => boolean
-  /** Tier 1b body evidence: a Muse ready screen. Thunk for the same reason as above. */
-  readMuseReadyBodyEvidence: () => boolean
+  /** Tier 1b body evidence: a Muse or Codex ready screen. Thunk for the same reason as above. */
+  readQuietReadyBodyEvidence: () => boolean
   agent: TuiAgent | null | undefined
   firstPartyStatus: FirstPartyAgentStatus
   quiescenceMs: number
 }
 
+export type TuiIdleVerdict =
+  | { kind: 'blocked'; reason: RuntimeTerminalWaitBlockedReason }
+  | { kind: 'ready-strong' }
+  /** Settles only on the poll, after a rendered-screen read finds no blocker. */
+  | { kind: 'ready-weak' }
+  /** The agent says it is mid-turn: nothing may settle, and its screen is not read. */
+  | { kind: 'working' }
+  | { kind: 'pending'; quietForeground: QuietForegroundLane }
+
+const READY_STRONG: TuiIdleVerdict = { kind: 'ready-strong' }
+const READY_WEAK: TuiIdleVerdict = { kind: 'ready-weak' }
+const WORKING: TuiIdleVerdict = { kind: 'working' }
+
+const QUIET_READY_SCREEN_AGENTS: ReadonlySet<TuiAgent> = new Set(['muse', 'codex'])
+
 /**
- * Tier 1b: a Muse ready screen in the body, believed only once the stream has gone quiet.
+ * Tier 1b: a ready screen in the body, believed only once the stream has gone quiet.
  *
- * Muse is the one agent with no title signal at all — its OSC title is the bare cwd and
- * never changes — so neither the explicit-idle nor the sustained-title lane can fire.
- * The ready screen proves the TUI is up; the quiescence demand keeps a mid-turn
- * streaming pane from satisfying, mirroring the codex tier-3 lane's
- * positive-evidence-plus-quiet shape. Scoped to Muse and agent-unknown panes: another
- * agent's scrollback quoting Muse must not settle its wait.
+ * Muse's OSC title is the bare cwd and never changes, and an idle Codex titles its pane with
+ * the cwd (plus a thread name) and no agent name, so neither the explicit-idle nor the
+ * sustained-title lane can fire. The ready screen proves the TUI is up; the quiescence
+ * demand keeps a mid-turn streaming pane from satisfying, mirroring the tier-3 lane's
+ * positive-evidence-plus-quiet shape. Scoped to those agents and agent-unknown panes (which
+ * read only Muse's screen): another agent's scrollback quoting them must not settle its wait.
  */
-export function hasQuietMuseReadyPrompt(
+export function hasQuietReadyScreen(
   record: TuiIdleEvidenceRecord,
   agent: TuiAgent | null | undefined,
   readBodyEvidence: () => boolean,
   quiescenceMs: number
 ): boolean {
-  if (agent !== null && agent !== undefined && agent !== 'muse') {
-    return false
-  }
-  if (!readBodyEvidence()) {
+  if (agent && !QUIET_READY_SCREEN_AGENTS.has(agent)) {
     return false
   }
   // Why: same rule as the tier-3 lane — without an output clock there is no
   // corroboration available, so hold out instead of settling.
-  if (record.lastOutputAt === null) {
+  if (record.lastOutputAt === null || Date.now() - record.lastOutputAt < quiescenceMs) {
     return false
   }
-  return Date.now() - record.lastOutputAt >= quiescenceMs
+  // Why last: a streaming pane never pays for the screen projection.
+  return readBodyEvidence()
 }
 
-/** The one place the tiers are combined; every satisfaction site routes here. */
-export function isTuiIdleSatisfied(input: TuiIdleSatisfactionInput): boolean {
+/** The one place the tiers are combined; every settle site branches only on the verdict. */
+export function evaluateTuiIdle(input: TuiIdleEvaluationInput): TuiIdleVerdict {
+  const blockedReason = input.readTailBlockedReason()
+  if (blockedReason) {
+    return { kind: 'blocked', reason: blockedReason }
+  }
+  // Qoder publishes "Ready" before its trust dialog is dismissed; only its composer proves input is live.
+  if (input.agent === 'qoder') {
+    if (
+      hasFreshWorkingFirstPartyStatus(input.firstPartyStatus) ||
+      input.record.lastAgentStatus === 'working'
+    ) {
+      return WORKING
+    }
+    return input.readPositiveBodyEvidence()
+      ? READY_STRONG
+      : { kind: 'pending', quietForeground: 'closed' }
+  }
   // Why the title before the body: both are tier 1, so either settles, but the title is a
   // memoized lookup and the body is a fresh multi-KB scan. Same verdict, cheaper order.
   if (hasExplicitIdleTitle(input.record, input.rendererTitle) || input.readPositiveBodyEvidence()) {
-    return true
+    return READY_STRONG
+  }
+  // Why beside the title lane, not after the veto: both are tier 1, and a first-party `done`
+  // and a fresh `working` cannot both hold — the same row carries one state.
+  if (hasFreshDoneFirstPartyStatus(input.agent, input.firstPartyStatus)) {
+    return READY_STRONG
   }
   if (hasFreshWorkingFirstPartyStatus(input.firstPartyStatus)) {
-    return false
+    // Why blocked/waiting stays pending: the agent says it is waiting on the user, which is
+    // when a dialog is on screen, so the screen read must still run.
+    return input.firstPartyStatus?.state === 'working'
+      ? WORKING
+      : { kind: 'pending', quietForeground: 'closed' }
   }
   // Why after the veto: a first-party working account outranks inferred body evidence.
+  // Why before the working title: Codex can leave a stale spinner title after a turn, and a
+  // live spinner emits output every ~100 ms, so a spinning pane is never quiet here.
   if (
-    hasQuietMuseReadyPrompt(
+    hasQuietReadyScreen(
       input.record,
       input.agent,
-      input.readMuseReadyBodyEvidence,
+      input.readQuietReadyBodyEvidence,
       input.quiescenceMs
     )
   ) {
-    return true
+    return READY_STRONG
+  }
+  if (input.record.lastAgentStatus === 'working') {
+    return WORKING
+  }
+  if (hasSustainedTitleIdle(input.record, input.agent, input.quiescenceMs)) {
+    return READY_WEAK
+  }
+  return {
+    kind: 'pending',
+    quietForeground:
+      input.record.lastAgentStatus === null ? quietForegroundLane(input.agent) : 'closed'
+  }
+}
+
+export function isTuiIdleReadyVerdict(verdict: TuiIdleVerdict): boolean {
+  return verdict.kind === 'ready-strong' || verdict.kind === 'ready-weak'
+}
+
+/** The runtime state every tui-idle site reads its evidence from. */
+export type TuiIdleEvidenceSource = {
+  quiescenceMs: number
+  getTabTitle(tabId: string): string | null
+  getAdoptedPtyIdleStatus(pty: RuntimePtyWorktreeRecord): AgentStatus | null
+  getPaneAgent(ptyId: string | null | undefined): TuiAgent | null
+  getFirstPartyAgentStatus(ptyId: string | null | undefined): FirstPartyAgentStatus
+  readScreenLines(ptyId: string | null | undefined): readonly string[] | null
+}
+
+function lazyWaitText(readWaitText: () => string): () => string {
+  let waitText: string | null = null
+  return () => (waitText ??= readWaitText())
+}
+
+export function leafTuiIdleEvidence(
+  source: TuiIdleEvidenceSource,
+  leaf: RuntimeLeafRecord,
+  readWaitText: () => string
+): TuiIdleEvaluationInput {
+  const waitText = lazyWaitText(readWaitText)
+  const agent = source.getPaneAgent(leaf.ptyId)
+  return {
+    record: leaf,
+    readTailBlockedReason: () => detectTerminalWaitBlockedReason(waitText()),
+    rendererTitle: leaf.paneTitle ?? source.getTabTitle(leaf.tabId),
+    readPositiveBodyEvidence: () =>
+      isKnownReadyPromptBody(waitText(), agent, () => source.readScreenLines(leaf.ptyId)),
+    readQuietReadyBodyEvidence: () =>
+      isQuietReadyScreenBody(waitText(), agent, () => source.readScreenLines(leaf.ptyId)),
+    agent,
+    firstPartyStatus: source.getFirstPartyAgentStatus(leaf.ptyId),
+    quiescenceMs: source.quiescenceMs
+  }
+}
+
+export function ptyTuiIdleEvidence(
+  source: TuiIdleEvidenceSource,
+  pty: RuntimePtyWorktreeRecord,
+  readWaitText: () => string
+): TuiIdleEvaluationInput {
+  const waitText = lazyWaitText(readWaitText)
+  const agent = source.getPaneAgent(pty.ptyId)
+  return {
+    record: pty,
+    readTailBlockedReason: () => detectTerminalWaitBlockedReason(waitText()),
+    readPositiveBodyEvidence: () =>
+      (agent !== 'qoder' && source.getAdoptedPtyIdleStatus(pty) === 'idle') ||
+      isKnownReadyPromptBody(waitText(), agent, () => source.readScreenLines(pty.ptyId)),
+    readQuietReadyBodyEvidence: () =>
+      isQuietReadyScreenBody(waitText(), agent, () => source.readScreenLines(pty.ptyId)),
+    agent,
+    firstPartyStatus: source.getFirstPartyAgentStatus(pty.ptyId),
+    quiescenceMs: source.quiescenceMs
   }
-  return hasSustainedTitleIdle(input.record, input.agent, input.quiescenceMs)
 }
diff --git a/src/main/runtime/tui-idle-name-only-real-pty.integration.test.ts b/src/main/runtime/tui-idle-name-only-real-pty.integration.test.ts
index 0d265a0a5bb..562ab23ee3e 100644
--- a/src/main/runtime/tui-idle-name-only-real-pty.integration.test.ts
+++ b/src/main/runtime/tui-idle-name-only-real-pty.integration.test.ts
@@ -109,10 +109,8 @@ async function terminalWait(
 describe.skipIf(process.platform === 'win32')('tui-idle against a real agent pty', () => {
   it('does not satisfy while the real process streams under a name-only title', async () => {
     const { runtime, transcript, handle } = await startRealAgentPane('quiet', 60_000)
-    await new Promise((resolve) => setTimeout(resolve, 500))
-
-    // The OSC title really did reach the runtime as control bytes, not literal text.
-    expect(transcript.join('')).toContain(']0;Codex')
+    // Wait for real control bytes before measuring idle behavior.
+    await expect.poll(() => transcript.join(''), { timeout: 5_000 }).toContain(']0;Codex')
 
     const outcome = await terminalWait(runtime, handle, 8_000)
     expect(outcome.satisfied).toBe(false)
diff --git a/src/main/runtime/tui-idle-weak-evidence-seam.test.ts b/src/main/runtime/tui-idle-weak-evidence-seam.test.ts
new file mode 100644
index 00000000000..d608666fbdc
--- /dev/null
+++ b/src/main/runtime/tui-idle-weak-evidence-seam.test.ts
@@ -0,0 +1,107 @@
+/**
+ * The seam a new weak-ready rank plugs into. Weak ready is a verdict class, not a per-evidence
+ * flag: no settle site may act on it before a rendered-screen read, whatever evidence produced
+ * it. The stand-in below fires over Claude's trust dialog itself, as a composer-ready signal
+ * such as bracketed paste would, and the dialog must still win.
+ */
+
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createTranscriptPane, TRANSCRIPT_PANE_PTY_ID } from './agent-transcript-pane-test-harness'
+import type * as TuiIdleEvidence from './tui-idle-evidence'
+
+const syntheticWeakEvidence = vi.hoisted(() => ({ fires: false }))
+
+vi.mock('./tui-idle-evidence', async (importOriginal) => {
+  const actual = await importOriginal<typeof TuiIdleEvidence>()
+  return {
+    ...actual,
+    evaluateTuiIdle: (
+      ...args: Parameters<typeof actual.evaluateTuiIdle>
+    ): TuiIdleEvidence.TuiIdleVerdict => {
+      const verdict = actual.evaluateTuiIdle(...args)
+      return syntheticWeakEvidence.fires && verdict.kind === 'pending'
+        ? { kind: 'ready-weak' }
+        : verdict
+    }
+  }
+})
+
+const POLL_INTERVAL_MS = 2_000
+
+function readDialog(): { data: string; size: { cols: number; rows: number } } {
+  const base = join(__dirname, '__fixtures__', 'claude-dialog-trust-workspace')
+  const meta: { cols: number; rows: number } = JSON.parse(readFileSync(`${base}.meta.json`, 'utf8'))
+  return { data: readFileSync(`${base}.txt`, 'utf8'), size: { cols: meta.cols, rows: meta.rows } }
+}
+
+async function createPane() {
+  const { data, size } = readDialog()
+  const { runtime, handle } = await createTranscriptPane({
+    paneTitle: 'Terminal',
+    foregroundProcess: 'claude',
+    launchAgent: 'claude',
+    size,
+    data: ''
+  })
+  vi.useFakeTimers()
+  const write = (chunk: string) => runtime.onPtyData(TRANSCRIPT_PANE_PTY_ID, chunk, Date.now())
+  const paintDialog = () => {
+    const bytes = Buffer.from(data, 'utf8')
+    const decoder = new TextDecoder()
+    for (let offset = 0; offset < bytes.length; offset += 1024) {
+      write(decoder.decode(bytes.subarray(offset, offset + 1024), { stream: true }))
+    }
+  }
+  const wait = () => {
+    const settled = vi.fn()
+    const promise = runtime.waitForTerminal(handle, { condition: 'tui-idle', timeoutMs: 60_000 })
+    promise.then(settled, () => {})
+    return { promise, settled }
+  }
+  return { write, paintDialog, wait }
+}
+
+describe('a new weak-ready rank', () => {
+  afterEach(() => {
+    syntheticWeakEvidence.fires = false
+    vi.useRealTimers()
+  })
+
+  it('settles a pane with nothing on screen, so the stand-in reaches the settle sites', async () => {
+    const pane = await createPane()
+    pane.write('starting\r\n')
+    syntheticWeakEvidence.fires = true
+    const { promise } = pane.wait()
+    await vi.advanceTimersByTimeAsync(0)
+    await expect(promise).resolves.toMatchObject({ satisfied: true })
+  })
+
+  it('reports the dialog to a wait registered after it painted', async () => {
+    const pane = await createPane()
+    pane.paintDialog()
+    syntheticWeakEvidence.fires = true
+    const { promise } = pane.wait()
+    await vi.advanceTimersByTimeAsync(0)
+    await expect(promise).resolves.toMatchObject({
+      satisfied: false,
+      blockedReason: 'agent-trust-workspace'
+    })
+  })
+
+  it('reports the dialog when a title change offers the evidence before it painted', async () => {
+    const pane = await createPane()
+    const { promise, settled } = pane.wait()
+    syntheticWeakEvidence.fires = true
+    pane.write('\x1b]0;claude ~/p/repo\x07')
+    await vi.advanceTimersByTimeAsync(0)
+    expect(settled).not.toHaveBeenCalled()
+    pane.paintDialog()
+    await vi.advanceTimersByTimeAsync(POLL_INTERVAL_MS)
+    await expect(promise).resolves.toMatchObject({
+      satisfied: false,
+      blockedReason: 'agent-trust-workspace'
+    })
+  })
+})
diff --git a/src/main/runtime/windows-mobile-firewall.test.ts b/src/main/runtime/windows-mobile-firewall.test.ts
index d561878a538..162f46e682b 100644
--- a/src/main/runtime/windows-mobile-firewall.test.ts
+++ b/src/main/runtime/windows-mobile-firewall.test.ts
@@ -67,6 +67,18 @@ describe('windows mobile firewall', () => {
     expect(script).toContain('$localPrefixLength = [int]$ip.PrefixLength')
   })
 
+  it('doubles typographic single quotes in the executable literal', async () => {
+    const runPowerShell = vi.fn().mockResolvedValue('not json')
+    await inspectWindowsMobileFirewall(
+      6768,
+      '192.168.0.108',
+      environment(runPowerShell, { executablePath: 'C:\\Users\\O\u2019Brien\\Orca\\Orca.exe' })
+    )
+    expect(runPowerShell.mock.calls[0]![0]).toContain(
+      "-Program 'C:\\Users\\O\u2019\u2019Brien\\Orca\\Orca.exe'"
+    )
+  })
+
   it('treats an overlapping inbound Block rule as overriding a matching Allow rule', async () => {
     const runPowerShell = vi.fn().mockResolvedValue(
       JSON.stringify({
diff --git a/src/main/runtime/windows-mobile-firewall.ts b/src/main/runtime/windows-mobile-firewall.ts
index c90a025cb14..5d17bf5f5a8 100644
--- a/src/main/runtime/windows-mobile-firewall.ts
+++ b/src/main/runtime/windows-mobile-firewall.ts
@@ -5,6 +5,7 @@ import type {
   WindowsMobileFirewallStatus,
   WindowsNetworkCategory
 } from '../../shared/windows-mobile-firewall'
+import { quotePowerShellLiteral } from '../../shared/powershell-native-argument'
 import { hasSufficientWindowsFirewallRemoteScope } from './windows-firewall-remote-scope'
 
 const FIREWALL_RULE_NAME = 'Orca.MobilePairing'
@@ -158,15 +159,11 @@ function parseNetworkCategory(value: string): WindowsNetworkCategory {
   return 'unknown'
 }
 
-function quotePowerShell(value: string): string {
-  return `'${value.replaceAll("'", "''")}'`
-}
-
 function buildInspectionScript(port: number, executablePath: string, address?: string): string {
   const addressLookup = address
     ? `
 try {
-  $ip = Get-NetIPAddress -IPAddress ${quotePowerShell(address)} -ErrorAction Stop | Select-Object -First 1
+  $ip = Get-NetIPAddress -IPAddress ${quotePowerShellLiteral(address)} -ErrorAction Stop | Select-Object -First 1
   $localAddress = [string]$ip.IPAddress
   $localPrefixLength = [int]$ip.PrefixLength
   $profile = Get-NetConnectionProfile -InterfaceIndex $ip.InterfaceIndex -ErrorAction Stop | Select-Object -First 1
@@ -180,7 +177,7 @@ try {
   return `$ErrorActionPreference = 'Stop'
 $matchingRuleScopes = @()
 $blockingRuleDetected = $false
-$rules = @(Get-NetFirewallApplicationFilter -PolicyStore ActiveStore -Program ${quotePowerShell(executablePath)} -ErrorAction SilentlyContinue | Get-NetFirewallRule | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' })
+$rules = @(Get-NetFirewallApplicationFilter -PolicyStore ActiveStore -Program ${quotePowerShellLiteral(executablePath)} -ErrorAction SilentlyContinue | Get-NetFirewallRule | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' })
 foreach ($rule in $rules) {
   $portFilter = $rule | Get-NetFirewallPortFilter
   $protocol = [string]$portFilter.Protocol
@@ -215,7 +212,7 @@ function buildRepairScript(port: number, executablePath: string): string {
   // Removal deliberately ignores the Block rule's remote-address scope,
   // mirroring the fail-closed inspection (the phone address is unknown).
   return `$ErrorActionPreference = 'Stop'
-$blockingRules = @(Get-NetFirewallApplicationFilter -Program ${quotePowerShell(executablePath)} -ErrorAction SilentlyContinue | Get-NetFirewallRule | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' -and $_.Action -eq 'Block' })
+$blockingRules = @(Get-NetFirewallApplicationFilter -Program ${quotePowerShellLiteral(executablePath)} -ErrorAction SilentlyContinue | Get-NetFirewallRule | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' -and $_.Action -eq 'Block' })
 foreach ($rule in $blockingRules) {
   $portFilter = $rule | Get-NetFirewallPortFilter
   $protocol = [string]$portFilter.Protocol
@@ -225,8 +222,8 @@ foreach ($rule in $blockingRules) {
     $rule | Remove-NetFirewallRule
   }
 }
-Get-NetFirewallRule -Name ${quotePowerShell(FIREWALL_RULE_NAME)} -ErrorAction SilentlyContinue | Remove-NetFirewallRule
-New-NetFirewallRule -Name ${quotePowerShell(FIREWALL_RULE_NAME)} -DisplayName ${quotePowerShell(FIREWALL_RULE_DISPLAY_NAME)} -Description 'Allows Orca Mobile to connect to this Orca desktop on private networks.' -Direction Inbound -Action Allow -Enabled True -Profile Private -Protocol TCP -LocalPort ${port} -Program ${quotePowerShell(executablePath)} -EdgeTraversalPolicy Block | Out-Null`
+Get-NetFirewallRule -Name ${quotePowerShellLiteral(FIREWALL_RULE_NAME)} -ErrorAction SilentlyContinue | Remove-NetFirewallRule
+New-NetFirewallRule -Name ${quotePowerShellLiteral(FIREWALL_RULE_NAME)} -DisplayName ${quotePowerShellLiteral(FIREWALL_RULE_DISPLAY_NAME)} -Description 'Allows Orca Mobile to connect to this Orca desktop on private networks.' -Direction Inbound -Action Allow -Enabled True -Profile Private -Protocol TCP -LocalPort ${port} -Program ${quotePowerShellLiteral(executablePath)} -EdgeTraversalPolicy Block | Out-Null`
 }
 
 // Why the elevated child keeps `-EncodedCommand` while the local runner does not: `Start-Process
@@ -237,7 +234,7 @@ New-NetFirewallRule -Name ${quotePowerShell(FIREWALL_RULE_NAME)} -DisplayName ${
 function buildElevationScript(powershellPath: string, encodedRepairScript: string): string {
   return `$ErrorActionPreference = 'Stop'
 try {
-  $process = Start-Process -FilePath ${quotePowerShell(powershellPath)} -ArgumentList @('-NoProfile', '-NonInteractive', '-EncodedCommand', '${encodedRepairScript}') -Verb RunAs -Wait -PassThru
+  $process = Start-Process -FilePath ${quotePowerShellLiteral(powershellPath)} -ArgumentList @('-NoProfile', '-NonInteractive', '-EncodedCommand', '${encodedRepairScript}') -Verb RunAs -Wait -PassThru
   [pscustomobject]@{ launched = $true; exitCode = $process.ExitCode } | ConvertTo-Json -Compress
 } catch {
   [pscustomobject]@{ launched = $false; nativeErrorCode = $_.Exception.NativeErrorCode } | ConvertTo-Json -Compress
diff --git a/src/main/runtime/workspace-session-failed-write-rollback.ts b/src/main/runtime/workspace-session-failed-write-rollback.ts
deleted file mode 100644
index 7234446cb9d..00000000000
--- a/src/main/runtime/workspace-session-failed-write-rollback.ts
+++ /dev/null
@@ -1,74 +0,0 @@
-import { isDeepStrictEqual } from 'node:util'
-import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
-
-const MISSING = Symbol('missing')
-
-/** A JSON-shaped slot of persisted session state, or the absent-key sentinel. */
-type RollbackSlot =
-  | string
-  | number
-  | boolean
-  | null
-  | undefined
-  | typeof MISSING
-  | readonly RollbackSlot[]
-  | RollbackRecord
-
-type RollbackRecord = { readonly [key: string]: RollbackSlot }
-
-function isRecord(value: RollbackSlot): value is RollbackRecord {
-  return (
-    value !== MISSING &&
-    typeof value === 'object' &&
-    value !== null &&
-    !Array.isArray(value) &&
-    Object.getPrototypeOf(value) === Object.prototype
-  )
-}
-
-function rollbackValue(
-  original: RollbackSlot,
-  staged: RollbackSlot,
-  current: RollbackSlot
-): RollbackSlot {
-  if (isDeepStrictEqual(original, staged)) {
-    return current
-  }
-  if (isDeepStrictEqual(current, staged)) {
-    return original
-  }
-  if (!isRecord(original) || !isRecord(staged) || !isRecord(current)) {
-    return current
-  }
-  let changed = false
-  const next: Record<string, RollbackSlot> = { ...current }
-  for (const key of new Set([
-    ...Object.keys(original),
-    ...Object.keys(staged),
-    ...Object.keys(current)
-  ])) {
-    const value = rollbackValue(
-      Object.hasOwn(original, key) ? original[key] : MISSING,
-      Object.hasOwn(staged, key) ? staged[key] : MISSING,
-      Object.hasOwn(current, key) ? current[key] : MISSING
-    )
-    if (value === MISSING) {
-      if (Object.hasOwn(next, key)) {
-        delete next[key]
-        changed = true
-      }
-    } else if (!Object.hasOwn(current, key) || !isDeepStrictEqual(current[key], value)) {
-      next[key] = value
-      changed = true
-    }
-  }
-  return changed ? next : current
-}
-
-export function rollbackWorkspaceSessionAfterFailedAsyncWrite(
-  original: WorkspaceSessionState,
-  staged: WorkspaceSessionState,
-  current: WorkspaceSessionState
-): WorkspaceSessionState {
-  return rollbackValue(original, staged, current) as WorkspaceSessionState
-}
diff --git a/src/main/runtime/workspace-session-terminal-membership-authority.ts b/src/main/runtime/workspace-session-terminal-membership-authority.ts
index 76cbcdf4dad..7798ae7831c 100644
--- a/src/main/runtime/workspace-session-terminal-membership-authority.ts
+++ b/src/main/runtime/workspace-session-terminal-membership-authority.ts
@@ -70,7 +70,7 @@ function rebaseUnifiedTabs(
     (tab) => tab.contentType !== 'terminal' || terminalUnifiedTabMatches(tab, terminalTabIds)
   )
   const representedTerminalIds = new Set(
-    result.filter((tab) => tab.contentType === 'terminal').flatMap((tab) => [tab.id, tab.entityId])
+    result.flatMap((tab) => (tab.contentType === 'terminal' ? [tab.id, tab.entityId] : []))
   )
   for (const tab of current) {
     if (
diff --git a/src/main/runtime/worktree-terminal-mutation-lock.test.ts b/src/main/runtime/worktree-terminal-mutation-lock.test.ts
index 822238034a8..b972bd02dec 100644
--- a/src/main/runtime/worktree-terminal-mutation-lock.test.ts
+++ b/src/main/runtime/worktree-terminal-mutation-lock.test.ts
@@ -16,9 +16,13 @@ describe('WorktreeTerminalMutationLock', () => {
       lock.acquire(KEY, 'shared')
     ])
     expect(releases).toHaveLength(4)
+    expect(lock.hasActiveSpawns(KEY)).toBe(true)
+    expect(lock.hasActiveSpawns('other')).toBe(false)
     for (const release of releases) {
+      expect(lock.hasActiveSpawns(KEY)).toBe(true)
       release()
     }
+    expect(lock.hasActiveSpawns(KEY)).toBe(false)
     expect(lock.trackedKeyCount).toBe(0)
   })
 
diff --git a/src/main/runtime/worktree-terminal-mutation-lock.ts b/src/main/runtime/worktree-terminal-mutation-lock.ts
index b0af98b2d3b..f76d8449826 100644
--- a/src/main/runtime/worktree-terminal-mutation-lock.ts
+++ b/src/main/runtime/worktree-terminal-mutation-lock.ts
@@ -35,6 +35,10 @@ export const WORKTREE_TERMINAL_SLEEP_TIMEOUT_ERROR = 'terminal_worktree_sleep_ti
 export class WorktreeTerminalMutationLock {
   private readonly entries = new Map<string, LockEntry>()
 
+  hasActiveSpawns(key: string): boolean {
+    return (this.entries.get(key)?.activeSpawns ?? 0) > 0
+  }
+
   /** Why exposed: entry deletion is the only thing keeping this map from
    *  becoming a per-worktree leak, so the tests assert on it directly. */
   get trackedKeyCount(): number {
diff --git a/src/main/runtime/zcode-readiness-transcript.test.ts b/src/main/runtime/zcode-readiness-transcript.test.ts
index 2319915ab68..bd9909f89de 100644
--- a/src/main/runtime/zcode-readiness-transcript.test.ts
+++ b/src/main/runtime/zcode-readiness-transcript.test.ts
@@ -21,6 +21,18 @@ function readTranscript(): string {
 }
 
 describe('ZCode readiness from captured terminal bytes', () => {
+  it('accepts a fresh composer after the renderer adopts the terminal handle', async () => {
+    const { runtime, handle } = await createTranscriptPane({
+      paneTitle: 'worker-zcode',
+      foregroundProcess: 'zcode',
+      launchAgent: 'zcode',
+      data: '\x1b[?1049h╭'
+    })
+    await expect(
+      runtime.waitForFreshWorkerComposer(handle, 'zcode', 1_000)
+    ).resolves.toBeUndefined()
+  })
+
   it('never emits an OSC title, so no title lane can settle its wait', () => {
     const data = readTranscript()
     expect(data).toContain(String.fromCharCode(27))
diff --git a/src/main/shell-wrapper-file-writer.ts b/src/main/shell-wrapper-file-writer.ts
index 1e57a210bba..a30dff1503e 100644
--- a/src/main/shell-wrapper-file-writer.ts
+++ b/src/main/shell-wrapper-file-writer.ts
@@ -14,7 +14,8 @@ export type ShellWrapperFile = readonly [path: string, content: string]
 
 export function writeShellWrapperFiles(
   files: readonly ShellWrapperFile[],
-  logPrefix: string
+  logPrefix: string,
+  consequence = 'Shell will launch unwrapped'
 ): boolean {
   try {
     for (const [path, content] of files) {
@@ -38,7 +39,7 @@ export function writeShellWrapperFiles(
         ? `${error.message} (${(error as NodeJS.ErrnoException).code || 'unknown'})`
         : String(error)
     console.error(`${logPrefix} Failed to write shell wrapper files: ${errorMessage}`)
-    console.error(`${logPrefix} Shell will launch unwrapped`)
+    console.error(`${logPrefix} ${consequence}`)
     return false
   }
 }
diff --git a/src/main/skills/discovery-filter-sharing.test.ts b/src/main/skills/discovery-filter-sharing.test.ts
index 14f755d0100..14fe9faf580 100644
--- a/src/main/skills/discovery-filter-sharing.test.ts
+++ b/src/main/skills/discovery-filter-sharing.test.ts
@@ -86,17 +86,20 @@ it('retains a newly requested name when its previously observed root becomes una
     const args = { homeDir: root, repos: [], includeCwd: false, sourceKinds: ['home' as const] }
     await repair.discoverSkills({ ...args, names: ['skill-0'] })
     const original = SkillScanCoalescer.prototype.run
-    vi.spyOn(SkillScanCoalescer.prototype, 'run').mockImplementation(
-      function (this: SkillScanCoalescer<unknown>, key, options, task) {
-        if (
-          key === `home\0${join(root, '.agents', 'skills')}` ||
-          key.startsWith(`home\0${join(root, '.agents', 'skills')}\0`)
-        ) {
-          return Promise.reject(new SkillScanShedError())
-        }
-        return original.call(this, key, options, task)
+    vi.spyOn(SkillScanCoalescer.prototype, 'run').mockImplementation(function (
+      this: SkillScanCoalescer<unknown>,
+      key,
+      options,
+      task
+    ) {
+      if (
+        key === `home\0${join(root, '.agents', 'skills')}` ||
+        key.startsWith(`home\0${join(root, '.agents', 'skills')}\0`)
+      ) {
+        return Promise.reject(new SkillScanShedError())
       }
-    )
+      return original.call(this, key, options, task)
+    })
     const next = await repair.discoverSkills({ ...args, names: ['skill-47'] })
     expect(next.skills.map((skill) => skill.name)).toEqual(['skill-47'])
     expect(next.sources.find((source) => source.id === 'home-agents')?.skippedReason).toBe(
diff --git a/src/main/source-control/hosted-review-branch-cache.ts b/src/main/source-control/hosted-review-branch-cache.ts
index 0e6f207ab9c..7a9f02e50c8 100644
--- a/src/main/source-control/hosted-review-branch-cache.ts
+++ b/src/main/source-control/hosted-review-branch-cache.ts
@@ -13,6 +13,15 @@ import {
   settleDetachedLookup,
   settleLookup
 } from './hosted-review-unsettled-lookups'
+import {
+  __resetHostedReviewInflightLookupsForTests,
+  expireOverdueInflight,
+  getInflightLookup,
+  releaseInflight,
+  retireInflightWithPrefix,
+  trackInflight,
+  type InflightToken
+} from './hosted-review-inflight-lookups'
 import {
   __resetHostedReviewScopeGenerationsForTests,
   bumpScopeGeneration,
@@ -29,7 +38,6 @@ import {
   ACTIVE_REFRESH_INTERVAL_MS,
   HOSTED_REVIEW_LOOKUP_DEADLINE_MS,
   MAX_BRANCH_MAP_ENTRIES,
-  MAX_INFLIGHT_LOOKUPS,
   NO_REVIEW_REFRESH_INTERVAL_MS
 } from './hosted-review-refresh-pacing'
 
@@ -59,22 +67,7 @@ type CacheEntry = {
   startedAt: number
 }
 
-declare const inflightTokenBrand: unique symbol
-
-/** Identity token for one lookup; only ever compared by reference. */
-type InflightToken = { readonly [inflightTokenBrand]?: never }
-
-type InflightRecord = {
-  /** Identity, so a detached lookup can only ever clear its own entry. */
-  token: InflightToken
-  startedAt: number
-  promise: Promise<HostedReviewInfo | null>
-  /** Releases the callers and unpins the branch; idempotent. */
-  expire: () => void
-}
-
 const entries = new Map<string, CacheEntry>()
-const inflight = new Map<string, InflightRecord>()
 // Why: NUL is the one byte a repo path or branch name cannot contain, so a
 // scope prefix cannot straddle a component boundary — invalidating `/a/b` must
 // not also flush the unrelated repo at `/a/b c`.
@@ -158,53 +151,6 @@ function storeEntry(key: string, entry: CacheEntry): void {
   }
 }
 
-/** Clears the key's in-flight record only if it is still this lookup's. */
-function releaseInflight(key: string, token: InflightToken): boolean {
-  if (inflight.get(key)?.token !== token) {
-    return false
-  }
-  inflight.delete(key)
-  return true
-}
-
-/**
- * Expires records that outlived the deadline without their timer firing. Main's
- * timers are suspended across a system sleep, so wall-clock age — not
- * `setTimeout` alone — is what actually bounds how long a branch stays pinned.
- *
- * The guarantee covers tracked records only: one the size cap evicted is no
- * longer reachable here and falls back to its own suspended timer.
- */
-function expireOverdueInflight(now: number): void {
-  let overdue: InflightRecord[] | undefined
-  for (const record of inflight.values()) {
-    if (now - record.startedAt >= HOSTED_REVIEW_LOOKUP_DEADLINE_MS) {
-      overdue ??= []
-      overdue.push(record)
-    }
-  }
-  // Expire after the walk: each one deletes its own entry from the map.
-  for (const record of overdue ?? []) {
-    record.expire()
-  }
-}
-
-function trackInflight(key: string, record: InflightRecord): void {
-  inflight.set(key, record)
-  while (inflight.size > MAX_INFLIGHT_LOOKUPS) {
-    const oldest = inflight.keys().next().value
-    if (oldest === undefined) {
-      break
-    }
-    // Why: drop the record without expiring it — its own deadline still
-    // releases its callers, and evicting is about memory, not about failing.
-    // It does forfeit the sweep's wall-clock release, so the cap must stay far
-    // above realistic concurrency: below it, sleep-suspended timers are all an
-    // evicted record's callers have left.
-    inflight.delete(oldest)
-  }
-}
-
 /**
  * Drops every cached answer for a repo. Called when Orca itself opens a review,
  * so the new one is visible immediately instead of after the no-review interval.
@@ -221,13 +167,14 @@ export function invalidateHostedReviewBranchCache(
       entries.delete(key)
     }
   }
+  retireInflightWithPrefix(prefix)
   dropFailuresWithPrefix(prefix)
 }
 
 /** @internal - exposed for tests only */
 export function __resetHostedReviewBranchCacheForTests(): void {
   entries.clear()
-  inflight.clear()
+  __resetHostedReviewInflightLookupsForTests()
   __resetHostedReviewLookupBackoffForTests()
   __resetHostedReviewActiveClaimsForTests()
   __resetUnsettledHostedReviewLookupsForTests()
@@ -244,7 +191,7 @@ export function __resetHostedReviewBranchCacheForTests(): void {
  * was about to give the real one.
  */
 function canAdoptDetachedAnswer(key: string, startedAt: number): boolean {
-  if (inflight.has(key)) {
+  if (getInflightLookup(key) !== undefined) {
     return false
   }
   const current = entries.get(key)
@@ -341,7 +288,7 @@ function startLookup(
       // straggler and has to prove it still outranks what is there.
       const stored =
         generation === scopeGeneration(scope) &&
-        (inflight.get(key)?.token === token || canAdoptDetachedAnswer(key, startedAt))
+        (getInflightLookup(key)?.token === token || canAdoptDetachedAnswer(key, startedAt))
       if (stored) {
         storeEntry(key, { review, fetchedAt: Date.now(), headOid, startedAt })
       }
@@ -360,7 +307,7 @@ function startLookup(
       }
       // Why: a record the size cap dropped has a live successor, and backing the
       // branch off would slow the retry that is already running.
-      if (inflight.get(key)?.token === token) {
+      if (getInflightLookup(key)?.token === token) {
         noteFailure(key)
       }
       // Why: the last good review beats an error card here just as it does on
@@ -417,7 +364,7 @@ export async function withHostedReviewBranchCache(
     return cached.review
   }
 
-  const pending = inflight.get(key)
+  const pending = getInflightLookup(key)
   if (pending) {
     return pending.promise
   }
diff --git a/src/main/source-control/hosted-review-execution-host.ts b/src/main/source-control/hosted-review-execution-host.ts
index 1def4d60492..3f2ad49b303 100644
--- a/src/main/source-control/hosted-review-execution-host.ts
+++ b/src/main/source-control/hosted-review-execution-host.ts
@@ -1,10 +1,5 @@
-import {
-  getRepoExecutionHostId,
-  getSshTargetIdForExecutionHost,
-  LOCAL_EXECUTION_HOST_ID,
-  type ExecutionHostId
-} from '../../shared/execution-host'
-import type { Repo } from '../../shared/repo-types'
+import type { ExecutionHostId } from '../../shared/execution-host'
+export { getStoredRepoExecutionHostId as getRepoHostedReviewExecutionHostId } from '../repo-execution-host'
 import {
   ExecutionHostNotDispatchableError,
   resolveGitRouteForHost
@@ -30,20 +25,3 @@ export function hostedReviewSshConnectionId(executionHostId: ExecutionHostId): s
   }
   return route.kind === 'ssh' ? route.connectionId : null
 }
-
-/**
- * The host this process may run a hosted review on for a row in *its own* store.
- *
- * `getSshTargetIdForExecutionHost` and not `getRepoSshConnectionId`: a `runtime:` stamp on a row in
- * this store is how a paired client addresses it, not a second machine holding the files. The
- * runtime registration controller only adopts that stamp onto a row with no `connectionId`
- * (`runtimeRepoMatchesExecutionHost` refuses to match an SSH row), so the checkout really is here
- * and this keeps the review that has always been created for it. A row whose files sit on an SSH
- * host keeps its own target — including one that carries only `executionHostId: ssh:…`.
- */
-export function getRepoHostedReviewExecutionHostId(
-  repo: Pick<Repo, 'connectionId' | 'executionHostId'>
-): ExecutionHostId {
-  const hostId = getRepoExecutionHostId(repo)
-  return getSshTargetIdForExecutionHost(hostId) ? hostId : LOCAL_EXECUTION_HOST_ID
-}
diff --git a/src/main/source-control/hosted-review-inflight-invalidation.test.ts b/src/main/source-control/hosted-review-inflight-invalidation.test.ts
new file mode 100644
index 00000000000..6d8653ba76b
--- /dev/null
+++ b/src/main/source-control/hosted-review-inflight-invalidation.test.ts
@@ -0,0 +1,271 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { HostedReviewInfo } from '../../shared/hosted-review'
+import {
+  __resetHostedReviewBranchCacheForTests,
+  invalidateHostedReviewBranchCache,
+  withHostedReviewBranchCache
+} from './hosted-review-branch-cache'
+import {
+  HOSTED_REVIEW_LOOKUP_DEADLINE_MS,
+  MAX_UNSETTLED_LOOKUP_KEYS,
+  MAX_UNSETTLED_LOOKUPS_PER_KEY
+} from './hosted-review-refresh-pacing'
+
+const identity = {
+  repoPath: '/repo',
+  executionHostId: 'ssh:host-a' as const,
+  branch: 'feature/review',
+  localGitExecOptions: { admissionTier: 'background' }
+}
+const options = { headOid: null }
+const review: HostedReviewInfo = {
+  provider: 'gitlab',
+  number: 7,
+  title: 'Created review',
+  state: 'open',
+  url: 'https://git.example/team/repo/merge_requests/7',
+  status: 'neutral',
+  updatedAt: '',
+  mergeable: 'UNKNOWN'
+}
+
+beforeEach(() => {
+  __resetHostedReviewBranchCacheForTests()
+  vi.useFakeTimers()
+  vi.setSystemTime(1_000_000)
+})
+
+afterEach(() => {
+  __resetHostedReviewBranchCacheForTests()
+  vi.useRealTimers()
+})
+
+describe('hosted review in-flight invalidation', () => {
+  it.each(['before', 'after'] as const)(
+    'refreshes post-create readers when the old request finishes %s its replacement',
+    async (completionOrder) => {
+      const oldResponse = Promise.withResolvers<HostedReviewInfo | null>()
+      const freshResponse = Promise.withResolvers<HostedReviewInfo | null>()
+      const oldLookup = vi.fn(() => oldResponse.promise)
+      const freshLookup = vi.fn(() => freshResponse.promise)
+      const admitted = withHostedReviewBranchCache(identity, options, oldLookup)
+      expect(
+        await withHostedReviewBranchCache(
+          { ...identity, localGitExecOptions: { admissionTier: 'interactive' } },
+          options,
+          async () => null
+        )
+      ).toBeNull()
+
+      invalidateHostedReviewBranchCache(identity.repoPath, identity.executionHostId)
+      const next = withHostedReviewBranchCache(identity, options, freshLookup)
+      const concurrent = withHostedReviewBranchCache(identity, options, freshLookup)
+      try {
+        expect(freshLookup).toHaveBeenCalledTimes(1)
+        if (completionOrder === 'before') {
+          oldResponse.resolve(null)
+          expect(await admitted).toBeNull()
+        }
+        freshResponse.resolve(review)
+        expect(await next).toEqual(review)
+        expect(await concurrent).toEqual(review)
+        if (completionOrder === 'after') {
+          oldResponse.resolve(null)
+          expect(await admitted).toBeNull()
+        }
+        expect(await withHostedReviewBranchCache(identity, options, freshLookup)).toEqual(review)
+        expect(oldLookup).toHaveBeenCalledTimes(1)
+        expect(freshLookup).toHaveBeenCalledTimes(1)
+      } finally {
+        oldResponse.resolve(null)
+        freshResponse.resolve(review)
+        await Promise.all([admitted, next, concurrent])
+      }
+    }
+  )
+
+  it('does not make a post-create reader wait for a stale request deadline', async () => {
+    const oldResponse = Promise.withResolvers<HostedReviewInfo | null>()
+    const admitted = withHostedReviewBranchCache(identity, options, () => oldResponse.promise)
+    const admittedResult = admitted.catch(() => null)
+    await vi.advanceTimersByTimeAsync(10_000)
+    invalidateHostedReviewBranchCache(identity.repoPath, identity.executionHostId)
+    const freshLookup = vi.fn(async () => review)
+    let settled = false
+    const next = withHostedReviewBranchCache(identity, options, freshLookup).then((value) => {
+      settled = true
+      return value
+    })
+    try {
+      await vi.advanceTimersByTimeAsync(0)
+      expect(settled).toBe(true)
+      expect(await next).toEqual(review)
+      expect(freshLookup).toHaveBeenCalledTimes(1)
+      await vi.advanceTimersByTimeAsync(HOSTED_REVIEW_LOOKUP_DEADLINE_MS - 10_000)
+      expect(await admittedResult).toEqual(review)
+      expect(await withHostedReviewBranchCache(identity, options, freshLookup)).toEqual(review)
+      expect(freshLookup).toHaveBeenCalledTimes(2)
+    } finally {
+      oldResponse.resolve(null)
+      await Promise.all([admittedResult, next])
+    }
+  })
+
+  it('discards a retired answer that landed with no replacement to outrank it', async () => {
+    const oldResponse = Promise.withResolvers<HostedReviewInfo | null>()
+    const admitted = withHostedReviewBranchCache(identity, options, () => oldResponse.promise)
+    invalidateHostedReviewBranchCache(identity.repoPath, identity.executionHostId)
+    // Nothing replaced it, so only the scope generation stands between this
+    // pre-invalidation "no review" and the key it no longer owns. Adopting it
+    // would read as fresh and short-circuit the lookup for the review Orca just
+    // opened.
+    oldResponse.resolve(null)
+    expect(await admitted).toBeNull()
+    const freshLookup = vi.fn(async () => review)
+    expect(await withHostedReviewBranchCache(identity, options, freshLookup)).toEqual(review)
+    expect(freshLookup).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps other hosts, paths and their pending promises isolated', async () => {
+    const others = [
+      { ...identity, executionHostId: 'local' as const },
+      { ...identity, executionHostId: 'ssh:host-b' as const },
+      { ...identity, repoPath: '/repo-other' }
+    ].map((key) => {
+      const response = Promise.withResolvers<HostedReviewInfo | null>()
+      const lookup = vi.fn(() => response.promise)
+      return { key, response, lookup, admitted: withHostedReviewBranchCache(key, options, lookup) }
+    })
+    invalidateHostedReviewBranchCache(identity.repoPath, identity.executionHostId)
+    const readers = others.map(({ key, lookup }) =>
+      withHostedReviewBranchCache(key, options, lookup)
+    )
+    for (const other of others) {
+      expect(other.lookup).toHaveBeenCalledTimes(1)
+      other.response.resolve(review)
+    }
+    expect(await Promise.all(readers)).toEqual([review, review, review])
+    await Promise.all(others.map((other) => other.admitted))
+  })
+
+  it('sweeps invalidated readers after sleep without expiring their replacement', async () => {
+    const oldResponse = Promise.withResolvers<HostedReviewInfo | null>()
+    const freshResponse = Promise.withResolvers<HostedReviewInfo | null>()
+    const admitted = withHostedReviewBranchCache(identity, options, () => oldResponse.promise)
+    const admittedResult = admitted.catch((error: unknown) => error)
+    invalidateHostedReviewBranchCache(identity.repoPath, identity.executionHostId)
+    vi.setSystemTime(Date.now() + 90_000)
+    const freshLookup = vi.fn(() => freshResponse.promise)
+    const replacement = withHostedReviewBranchCache(identity, options, freshLookup).catch(
+      (error: unknown) => error
+    )
+    vi.setSystemTime(Date.now() + 40_000)
+    const joined = withHostedReviewBranchCache(identity, options, freshLookup).catch(
+      (error: unknown) => error
+    )
+    try {
+      await vi.advanceTimersByTimeAsync(0)
+      expect(await admittedResult).toMatchObject({
+        message: expect.stringContaining('timed out')
+      })
+      expect(freshLookup).toHaveBeenCalledTimes(1)
+      freshResponse.resolve(review)
+      expect(await replacement).toEqual(review)
+      expect(await joined).toEqual(review)
+      oldResponse.resolve(null)
+      expect(await withHostedReviewBranchCache(identity, options, freshLookup)).toEqual(review)
+      expect(freshLookup).toHaveBeenCalledTimes(1)
+    } finally {
+      oldResponse.resolve(null)
+      freshResponse.resolve(review)
+      await Promise.all([admittedResult, replacement, joined])
+    }
+  })
+
+  it('keeps the two-unsettled-request cap across repeated invalidation', async () => {
+    const first = Promise.withResolvers<HostedReviewInfo | null>()
+    const second = Promise.withResolvers<HostedReviewInfo | null>()
+    const firstRead = withHostedReviewBranchCache(identity, options, () => first.promise)
+    invalidateHostedReviewBranchCache(identity.repoPath, identity.executionHostId)
+    const secondRead = withHostedReviewBranchCache(identity, options, () => second.promise)
+    invalidateHostedReviewBranchCache(identity.repoPath, identity.executionHostId)
+    const thirdLookup = vi.fn(async () => review)
+    const third = withHostedReviewBranchCache(identity, options, thirdLookup)
+    const thirdResult = third.catch((error: unknown) => error)
+    try {
+      await vi.advanceTimersByTimeAsync(0)
+      expect(thirdLookup).not.toHaveBeenCalled()
+      first.resolve(null)
+      second.resolve(null)
+      await Promise.all([firstRead, secondRead])
+      expect(await thirdResult).toMatchObject({
+        message: expect.stringContaining('never answered')
+      })
+      expect(await withHostedReviewBranchCache(identity, options, thirdLookup)).toEqual(review)
+      expect(thirdLookup).toHaveBeenCalledTimes(1)
+    } finally {
+      first.resolve(null)
+      second.resolve(null)
+      await Promise.all([firstRead, secondRead, thirdResult])
+    }
+  })
+
+  it('does not let an invalidated rejection penalize the replacement', async () => {
+    const oldResponse = Promise.withResolvers<HostedReviewInfo | null>()
+    const freshResponse = Promise.withResolvers<HostedReviewInfo | null>()
+    const admitted = withHostedReviewBranchCache(identity, options, () => oldResponse.promise)
+    const rejected = expect(admitted).rejects.toThrow('old lookup failed')
+    invalidateHostedReviewBranchCache(identity.repoPath, identity.executionHostId)
+    const fresh = withHostedReviewBranchCache(identity, options, () => freshResponse.promise)
+    oldResponse.reject(new Error('old lookup failed'))
+    await rejected
+    freshResponse.resolve(review)
+    expect(await fresh).toEqual(review)
+    await vi.advanceTimersByTimeAsync(60_001)
+    const next = vi.fn(async () => review)
+    expect(await withHostedReviewBranchCache(identity, options, next)).toEqual(review)
+    expect(next).toHaveBeenCalledTimes(1)
+  })
+
+  it('bounds retired owners by admission and sweeps all of them after sleep', async () => {
+    const requests: ReturnType<typeof Promise.withResolvers<HostedReviewInfo | null>>[] = []
+    const readers: Promise<unknown>[] = []
+    for (let index = 0; index < MAX_UNSETTLED_LOOKUP_KEYS; index += 1) {
+      for (let attempt = 0; attempt < MAX_UNSETTLED_LOOKUPS_PER_KEY; attempt += 1) {
+        const response = Promise.withResolvers<HostedReviewInfo | null>()
+        requests.push(response)
+        readers.push(
+          withHostedReviewBranchCache(
+            { ...identity, branch: `branch-${index}` },
+            options,
+            () => response.promise
+          ).catch((error: unknown) => error)
+        )
+        invalidateHostedReviewBranchCache(identity.repoPath, identity.executionHostId)
+      }
+    }
+    const freshLookup = vi.fn(async () => review)
+    try {
+      await expect(withHostedReviewBranchCache(identity, options, freshLookup)).rejects.toThrow(
+        'Too many hosted review lookups are already in progress'
+      )
+      expect(freshLookup).not.toHaveBeenCalled()
+      expect(vi.getTimerCount()).toBe(MAX_UNSETTLED_LOOKUP_KEYS * MAX_UNSETTLED_LOOKUPS_PER_KEY)
+      vi.setSystemTime(Date.now() + HOSTED_REVIEW_LOOKUP_DEADLINE_MS)
+      await expect(withHostedReviewBranchCache(identity, options, freshLookup)).rejects.toThrow()
+      expect(vi.getTimerCount()).toBe(0)
+      expect(await Promise.all(readers)).toEqual(
+        requests.map(() =>
+          expect.objectContaining({ message: expect.stringContaining('timed out') })
+        )
+      )
+    } finally {
+      for (const response of requests) {
+        response.resolve(null)
+      }
+      await Promise.all(readers)
+    }
+    expect(await withHostedReviewBranchCache(identity, options, freshLookup)).toEqual(review)
+    expect(freshLookup).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/main/source-control/hosted-review-inflight-lookups.test.ts b/src/main/source-control/hosted-review-inflight-lookups.test.ts
new file mode 100644
index 00000000000..149de43c097
--- /dev/null
+++ b/src/main/source-control/hosted-review-inflight-lookups.test.ts
@@ -0,0 +1,44 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import {
+  __resetHostedReviewInflightLookupsForTests,
+  expireOverdueInflight,
+  getInflightLookup,
+  releaseInflight,
+  retireInflightWithPrefix,
+  trackInflight
+} from './hosted-review-inflight-lookups'
+import { HOSTED_REVIEW_LOOKUP_DEADLINE_MS } from './hosted-review-refresh-pacing'
+
+afterEach(__resetHostedReviewInflightLookupsForTests)
+
+it.each(['completion', 'deadline'])(
+  'releases a retired owner on %s while preserving its successor',
+  (outcome) => {
+    const oldToken = {}
+    const oldExpire = vi.fn(() => releaseInflight('repo\0branch', oldToken))
+    trackInflight('repo\0branch', {
+      token: oldToken,
+      startedAt: 0,
+      promise: Promise.resolve(null),
+      expire: oldExpire
+    })
+    retireInflightWithPrefix('repo\0')
+    const replacement = {
+      token: {},
+      startedAt: HOSTED_REVIEW_LOOKUP_DEADLINE_MS,
+      promise: Promise.resolve(null),
+      expire: vi.fn()
+    }
+    trackInflight('repo\0branch', replacement)
+    if (outcome === 'completion') {
+      expect(releaseInflight('repo\0branch', oldToken)).toBe(false)
+    }
+    expireOverdueInflight(HOSTED_REVIEW_LOOKUP_DEADLINE_MS)
+    expect(oldExpire).toHaveBeenCalledTimes(outcome === 'deadline' ? 1 : 0)
+    expect(replacement.expire).not.toHaveBeenCalled()
+    expect(getInflightLookup('repo\0branch')).toBe(replacement)
+    expireOverdueInflight(HOSTED_REVIEW_LOOKUP_DEADLINE_MS + 1)
+    expect(oldExpire).toHaveBeenCalledTimes(outcome === 'deadline' ? 1 : 0)
+    expect(releaseInflight('repo\0branch', replacement.token)).toBe(true)
+  }
+)
diff --git a/src/main/source-control/hosted-review-inflight-lookups.ts b/src/main/source-control/hosted-review-inflight-lookups.ts
new file mode 100644
index 00000000000..79d4f12ba13
--- /dev/null
+++ b/src/main/source-control/hosted-review-inflight-lookups.ts
@@ -0,0 +1,101 @@
+import type { HostedReviewInfo } from '../../shared/hosted-review'
+import {
+  HOSTED_REVIEW_LOOKUP_DEADLINE_MS,
+  MAX_INFLIGHT_LOOKUPS
+} from './hosted-review-refresh-pacing'
+
+declare const inflightTokenBrand: unique symbol
+
+/** Identity token for one lookup; only ever compared by reference. */
+export type InflightToken = { readonly [inflightTokenBrand]?: never }
+
+export type InflightRecord = {
+  /** Identity, so a detached lookup can only ever clear its own entry. */
+  token: InflightToken
+  startedAt: number
+  promise: Promise<HostedReviewInfo | null>
+  /** Releases the callers and unpins the branch; idempotent. */
+  expire: () => void
+}
+
+const inflight = new Map<string, InflightRecord>()
+/**
+ * Owners an invalidation took off their key. They keep running — nothing here
+ * can cancel a lookup — but no new reader may join them, which is what stops a
+ * post-invalidation read from waiting out a stale request's deadline.
+ *
+ * Admission bounds these to two per key across at most 1,000 unsettled keys, so
+ * this map cannot outgrow the lookups already counted as in progress.
+ */
+const retired = new Map<InflightToken, InflightRecord>()
+
+export function getInflightLookup(key: string): InflightRecord | undefined {
+  return inflight.get(key)
+}
+
+/** Clears only this owner's records; the return value identifies the current owner. */
+export function releaseInflight(key: string, token: InflightToken): boolean {
+  retired.delete(token)
+  if (inflight.get(key)?.token !== token) {
+    return false
+  }
+  inflight.delete(key)
+  return true
+}
+
+/** Takes every owner under `prefix` off its key, without failing it. */
+export function retireInflightWithPrefix(prefix: string): void {
+  for (const [key, record] of inflight) {
+    if (key.startsWith(prefix)) {
+      retired.set(record.token, record)
+      inflight.delete(key)
+    }
+  }
+}
+
+/**
+ * Expires records that outlived the deadline without their timer firing. Main's
+ * timers are suspended across a system sleep, so wall-clock age — not
+ * `setTimeout` alone — is what actually bounds how long a branch stays pinned.
+ * Retired owners are swept too: their readers are gone, but their own callers
+ * still need releasing.
+ *
+ * The guarantee covers tracked records only: one the size cap evicted is in
+ * neither map and falls back to its own suspended timer.
+ */
+export function expireOverdueInflight(now: number): void {
+  let overdue: InflightRecord[] | undefined
+  for (const records of [inflight, retired]) {
+    for (const record of records.values()) {
+      if (now - record.startedAt >= HOSTED_REVIEW_LOOKUP_DEADLINE_MS) {
+        overdue ??= []
+        overdue.push(record)
+      }
+    }
+  }
+  for (const record of overdue ?? []) {
+    record.expire()
+  }
+}
+
+export function trackInflight(key: string, record: InflightRecord): void {
+  inflight.set(key, record)
+  while (inflight.size > MAX_INFLIGHT_LOOKUPS) {
+    const oldest = inflight.keys().next().value
+    if (oldest === undefined) {
+      break
+    }
+    // Why: drop the record without expiring it — its own deadline still releases
+    // its callers, and evicting is about memory, not about failing. It does
+    // forfeit the sweep above, so the cap must stay far above realistic
+    // concurrency: below it, sleep-suspended timers are all an evicted record's
+    // callers have left.
+    inflight.delete(oldest)
+  }
+}
+
+/** @internal - exposed for tests only */
+export function __resetHostedReviewInflightLookupsForTests(): void {
+  inflight.clear()
+  retired.clear()
+}
diff --git a/src/main/speech/stt-session-start.ts b/src/main/speech/stt-session-start.ts
index 5377699b382..eb42418cd0b 100644
--- a/src/main/speech/stt-session-start.ts
+++ b/src/main/speech/stt-session-start.ts
@@ -138,7 +138,11 @@ async function startSttSession(
     isCurrent: () => state.worker === worker,
     onMessage: (event) => state.eventSink?.(event),
     onError: (error) => handleSttWorkerFailure(state, error),
-    onExit: () => handleSttWorkerFailure(state)
+    onExit: () => {
+      const stoppedSink = state.stopInFlight?.worker === worker ? null : state.eventSink
+      handleSttWorkerFailure(state)
+      stoppedSink?.({ type: 'stopped' })
+    }
   })
   initializeSttWorker(worker, {
     modelDir: state.modelManager.getModelDir(modelId),
diff --git a/src/main/sqlite/bun-readonly-wal.test.ts b/src/main/sqlite/bun-readonly-wal.test.ts
new file mode 100644
index 00000000000..f60482c8e0e
--- /dev/null
+++ b/src/main/sqlite/bun-readonly-wal.test.ts
@@ -0,0 +1,180 @@
+import * as fs from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { runProcess } from '../../shared/child-process/run-process'
+import { initializeBunReadonlyWal } from './bun-readonly-wal'
+import Database from './sync-database'
+
+vi.mock('node:fs', async (importOriginal) => {
+  const original = await importOriginal<typeof fs>()
+  return { ...original, openSync: vi.fn(original.openSync) }
+})
+
+const directories: string[] = []
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  const original = await vi.importActual<typeof fs>('node:fs')
+  vi.mocked(fs.openSync).mockImplementation(original.openSync)
+  for (const directory of directories.splice(0)) {
+    fs.rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture(wal = true): string {
+  const directory = fs.mkdtempSync(join(tmpdir(), 'orca-readonly-wal-'))
+  directories.push(directory)
+  const file = join(directory, 'state.db')
+  const db = new Database(file)
+  db.exec('CREATE TABLE state (id INTEGER PRIMARY KEY, value TEXT)')
+  if (wal) {
+    db.pragma('journal_mode=WAL')
+  }
+  db.close()
+  return file
+}
+
+describe('readonly WAL initialization', () => {
+  it.each(['EACCES', 'EPERM', 'EROFS'])(
+    'lets SQLite decide read access when WAL creation fails with %s',
+    async (code) => {
+      const file = fixture()
+      const { openSync: open } = await vi.importActual<typeof fs>('node:fs')
+      vi.mocked(fs.openSync).mockImplementation((path, flags, ...rest) => {
+        if (path === `${file}-wal` && flags === 'wx') {
+          throw Object.assign(new Error('read-only directory'), { code })
+        }
+        return open(path, flags, ...rest)
+      })
+      expect(() => initializeBunReadonlyWal(file)).not.toThrow()
+      expect(fs.existsSync(`${file}-wal`)).toBe(false)
+    }
+  )
+
+  it('still reports unexpected WAL creation failures', async () => {
+    const file = fixture()
+    const { openSync: open } = await vi.importActual<typeof fs>('node:fs')
+    vi.mocked(fs.openSync).mockImplementation((path, flags, ...rest) => {
+      if (path === `${file}-wal` && flags === 'wx') {
+        throw Object.assign(new Error('disk failure'), { code: 'EIO' })
+      }
+      return open(path, flags, ...rest)
+    })
+    expect(() => initializeBunReadonlyWal(file)).toThrow('disk failure')
+  })
+
+  it('allows a clean WAL database to reopen without changing its bytes or admitting SQL writes', () => {
+    const file = fixture()
+    const bytes = fs.readFileSync(file)
+    initializeBunReadonlyWal(file)
+    if (process.platform !== 'win32') {
+      expect(fs.statSync(`${file}-wal`).mode & 0o777).toBe(0o600)
+    }
+    const reader = new Database(file, { readonly: true })
+    try {
+      expect(reader.prepare('SELECT COUNT(*) AS count FROM state').get()).toEqual({ count: 0 })
+      expect(() => reader.exec("INSERT INTO state VALUES(1,'write')")).toThrow()
+    } finally {
+      reader.close()
+    }
+    expect(fs.readFileSync(file)).toEqual(bytes)
+  })
+
+  it('leaves a concurrent writer’s newly published WAL intact', async () => {
+    const file = fixture()
+    const { openSync: open } = await vi.importActual<typeof fs>('node:fs')
+    vi.mocked(fs.openSync).mockImplementation((path, flags, ...rest) => {
+      if (path === `${file}-wal` && flags === 'wx') {
+        fs.writeFileSync(path, 'concurrent writer evidence')
+      }
+      return open(path, flags, ...rest)
+    })
+    initializeBunReadonlyWal(file)
+    expect(fs.readFileSync(`${file}-wal`, 'utf8')).toBe('concurrent writer evidence')
+  })
+
+  it('leaves a current writer’s WAL bytes intact', () => {
+    const file = fixture()
+    const writer = new Database(file)
+    try {
+      writer.exec("INSERT INTO state VALUES(1,'durable')")
+      const before = fs.readFileSync(`${file}-wal`)
+      initializeBunReadonlyWal(file)
+      expect(fs.readFileSync(`${file}-wal`)).toEqual(before)
+      const reader = new Database(file, { readonly: true })
+      try {
+        expect(reader.prepare('SELECT value FROM state').get()).toEqual({ value: 'durable' })
+      } finally {
+        reader.close()
+      }
+    } finally {
+      writer.close()
+    }
+  })
+
+  it.skipIf(process.platform === 'win32')('opens a cold WAL database through a symlink', () => {
+    const file = fixture()
+    const alias = join(directories[0]!, 'alias.db')
+    fs.symlinkSync(file, alias)
+    const reader = new Database(alias, { readonly: true })
+    try {
+      expect(reader.prepare('SELECT COUNT(*) AS count FROM state').get()).toEqual({ count: 0 })
+      expect(fs.existsSync(`${alias}-wal`)).toBe(false)
+    } finally {
+      reader.close()
+    }
+  })
+
+  it('does not add recovery evidence to a rollback-journal database or malformed file', () => {
+    const file = fixture(false)
+    initializeBunReadonlyWal(file)
+    expect(fs.existsSync(`${file}-wal`)).toBe(false)
+    fs.writeFileSync(file, 'not SQLite')
+    initializeBunReadonlyWal(file)
+    expect(fs.existsSync(`${file}-wal`)).toBe(false)
+  })
+
+  it.skipIf(process.platform !== 'darwin' || !process.versions.bun)(
+    'preserves another connection’s exclusive lock while inspecting the database header',
+    async () => {
+      const file = fixture(false)
+      const writer = new Database(file)
+      const probe = () =>
+        runProcess({
+          program: process.execPath,
+          args: [
+            '-e',
+            `const { Database } = require('bun:sqlite')
+             const db = new Database(process.argv[1], { readonly: true })
+             try { db.prepare('SELECT * FROM state').all(); process.stdout.write('readable') }
+             catch (error) { process.stdout.write(error.code) }
+             finally { db.close(true) }`,
+            file
+          ],
+          timeoutMs: 5_000
+        })
+      try {
+        writer.exec("BEGIN EXCLUSIVE; INSERT INTO state VALUES(1,'uncommitted')")
+        expect(await probe()).toMatchObject({ code: 0, stdout: 'SQLITE_BUSY' })
+        const reader = new Database(file, { readonly: true })
+        reader.close()
+        expect(await probe()).toMatchObject({ code: 0, stdout: 'SQLITE_BUSY' })
+      } finally {
+        writer.close()
+      }
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'does not follow an existing dangling WAL symlink',
+    () => {
+      const file = fixture()
+      const outside = join(directories[0]!, 'unrelated')
+      fs.symlinkSync(outside, `${file}-wal`)
+      initializeBunReadonlyWal(file)
+      expect(fs.existsSync(outside)).toBe(false)
+      expect(fs.lstatSync(`${file}-wal`).isSymbolicLink()).toBe(true)
+    }
+  )
+})
diff --git a/src/main/sqlite/bun-readonly-wal.ts b/src/main/sqlite/bun-readonly-wal.ts
new file mode 100644
index 00000000000..b7cbd39880a
--- /dev/null
+++ b/src/main/sqlite/bun-readonly-wal.ts
@@ -0,0 +1,37 @@
+import { closeSync, existsSync, openSync, readSync } from 'node:fs'
+
+/** Match SQLite's WAL creation without permitting writes through the database connection. */
+export function initializeBunReadonlyWal(path: string): void {
+  const wal = `${path}-wal`
+  if (existsSync(wal) || !hasWalHeader(path)) {
+    return
+  }
+  try {
+    // Apple's SQLite requires an existing WAL; exclusive creation preserves every existing byte.
+    closeSync(openSync(wal, 'wx', 0o600))
+  } catch (error) {
+    if (
+      typeof error !== 'object' ||
+      error === null ||
+      !('code' in error) ||
+      !['EEXIST', 'EACCES', 'EPERM', 'EROFS'].includes(String(error.code))
+    ) {
+      throw error
+    }
+  }
+}
+
+function hasWalHeader(path: string): boolean {
+  const file = openSync(path, 'r')
+  try {
+    const header = Buffer.alloc(20)
+    return (
+      readSync(file, header, 0, header.length, 0) === header.length &&
+      header.subarray(0, 16).toString() === 'SQLite format 3\0' &&
+      header[18] === 2 &&
+      header[19] === 2
+    )
+  } finally {
+    closeSync(file)
+  }
+}
diff --git a/src/main/sqlite/bun-sqlite-database.ts b/src/main/sqlite/bun-sqlite-database.ts
new file mode 100644
index 00000000000..b9695e08781
--- /dev/null
+++ b/src/main/sqlite/bun-sqlite-database.ts
@@ -0,0 +1,129 @@
+import type { DatabaseSync } from 'node:sqlite'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+import { BunSqliteStatement, type BunStatement } from './bun-sqlite-statement'
+import { initializeBunReadonlyWal } from './bun-readonly-wal'
+
+type BunDatabase = {
+  exec(sql: string): void
+  prepare(sql: string): BunStatement
+  readonly inTransaction: boolean
+  close(throwOnError: boolean): void
+  fileControl(command: number, value: Int32Array): number
+}
+
+type BunSqlite = {
+  Database: new (path: string, flags: number) => BunDatabase
+}
+
+const SQLITE_OPEN_READONLY = 0x01
+const SQLITE_OPEN_READWRITE = 0x02
+const SQLITE_OPEN_CREATE = 0x04
+const SQLITE_OPEN_URI = 0x40
+const SQLITE_FCNTL_PERSIST_WAL = 10
+
+export function loadBunSqlite(): BunSqlite | undefined {
+  if (!process.versions.bun || typeof process.getBuiltinModule !== 'function') {
+    return undefined
+  }
+  const sqlite: unknown = process.getBuiltinModule('bun:sqlite')
+  return isBunSqlite(sqlite) ? sqlite : undefined
+}
+
+function isBunSqlite(value: unknown): value is BunSqlite {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    'Database' in value &&
+    typeof value.Database === 'function'
+  )
+}
+
+export class BunSqliteDatabase {
+  private readonly database: BunDatabase
+
+  constructor(
+    path: ConstructorParameters<typeof DatabaseSync>[0],
+    options: { readonly?: boolean; fileMustExist?: boolean; timeout?: number } = {}
+  ) {
+    const sqlite = loadBunSqlite()
+    if (!sqlite) {
+      throw new Error('SQLite is unavailable in this runtime')
+    }
+    const filename =
+      path instanceof URL ? fileURLToPath(path) : typeof path === 'string' ? path : path.toString()
+    const flags = options.readonly
+      ? SQLITE_OPEN_READONLY
+      : SQLITE_OPEN_READWRITE | (options.fileMustExist ? 0 : SQLITE_OPEN_CREATE)
+    this.database = new sqlite.Database(
+      filename === ':memory:' || filename === '' ? filename : sqliteFileUri(filename),
+      // URI parsing defaults differ between the platform SQLite libraries.
+      flags | SQLITE_OPEN_URI
+    )
+    try {
+      if (process.platform === 'darwin' && filename !== ':memory:' && filename !== '') {
+        // Apple's default retains WAL files; match the other shipped SQLite drivers.
+        if (this.database.fileControl(SQLITE_FCNTL_PERSIST_WAL, new Int32Array(2)) !== 0) {
+          throw new Error('SQLite cannot configure WAL cleanup')
+        }
+        if (options.readonly) {
+          const statement = this.database.prepare('PRAGMA database_list')
+          try {
+            const path = statement.get()?.file
+            if (typeof path !== 'string' || path.length === 0) {
+              throw new Error('SQLite did not report its database filename')
+            }
+            // SQLite resolves symlinks before locating its sidecars.
+            initializeBunReadonlyWal(path)
+          } finally {
+            statement.finalize()
+          }
+        }
+      }
+      const timeout = options.timeout ?? 0
+      if (!Number.isSafeInteger(timeout) || timeout < 0 || timeout > 2_147_483_647) {
+        throw new RangeError('SQLite busy timeout must be a nonnegative 32-bit integer')
+      }
+      this.database.exec(`PRAGMA foreign_keys = ON; PRAGMA busy_timeout = ${timeout}`)
+    } catch (error) {
+      this.database.close(true)
+      throw error
+    }
+  }
+
+  exec(sql: string): void {
+    this.database.exec(sql)
+  }
+
+  prepare(sql: string): BunSqliteStatement {
+    return new BunSqliteStatement(this.database.prepare(sql), () => this.database.prepare(sql))
+  }
+
+  get isTransaction(): boolean {
+    return this.database.inTransaction
+  }
+
+  /** Logical snapshot; implicit rowids may change. The caller runs this in its backup worker. */
+  backup(path: string): void {
+    const statement = this.database.prepare('VACUUM INTO ?')
+    try {
+      statement.run(sqliteFileUri(path))
+    } finally {
+      statement.finalize()
+    }
+  }
+
+  close(): void {
+    this.database.close(true)
+  }
+}
+
+function sqliteFileUri(path: string): string {
+  const url = pathToFileURL(path)
+  if (url.hostname) {
+    const hostname = url.hostname
+    url.hostname = ''
+    // SQLite accepts UNC paths with an empty URI authority on Windows.
+    url.pathname = `//${hostname}${url.pathname}`
+  }
+  return url.href
+}
diff --git a/src/main/sqlite/bun-sqlite-statement.ts b/src/main/sqlite/bun-sqlite-statement.ts
new file mode 100644
index 00000000000..01b8081721a
--- /dev/null
+++ b/src/main/sqlite/bun-sqlite-statement.ts
@@ -0,0 +1,77 @@
+import type { SQLInputValue, StatementResultingChanges } from 'node:sqlite'
+import { SqliteIntegerReader } from './sqlite-integer-reader'
+import type { SqliteBindings, SqliteRow, SqliteStatement } from './sqlite-statement'
+
+type BunBindings = (SQLInputValue | SQLInputValue[])[]
+const EMPTY_BINDINGS: BunBindings = [[]]
+
+export type BunStatement = {
+  all(...parameters: BunBindings): SqliteRow[]
+  get(...parameters: BunBindings): SqliteRow | null
+  run(...parameters: BunBindings): StatementResultingChanges
+  iterate(...parameters: BunBindings): IterableIterator<SqliteRow>
+  finalize(): void
+  safeIntegers(enabled: boolean): void
+  readonly paramsCount: number
+}
+
+export class BunSqliteStatement implements SqliteStatement {
+  private readonly integers = new SqliteIntegerReader()
+  private readonly parameterCount: number
+
+  constructor(
+    private readonly statement: BunStatement,
+    private readonly prepareIterator: () => BunStatement
+  ) {
+    statement.safeIntegers(true)
+    this.parameterCount = statement.paramsCount
+  }
+
+  all(...parameters: SqliteBindings): SqliteRow[] {
+    const rows = this.statement.all(...this.bindings(parameters))
+    for (const row of rows) {
+      this.integers.row(row)
+    }
+    return rows
+  }
+
+  get(...parameters: SqliteBindings): SqliteRow | undefined {
+    const row = this.statement.get(...this.bindings(parameters))
+    return row === null ? undefined : this.integers.row(row)
+  }
+
+  run(...parameters: SqliteBindings): StatementResultingChanges {
+    return this.integers.result(this.statement.run(...this.bindings(parameters)))
+  }
+
+  *iterate(...parameters: SqliteBindings): IterableIterator<SqliteRow> {
+    // Bun leaves interrupted iterators positioned on their last row and exposes no reset.
+    const statement = this.prepareIterator()
+    try {
+      statement.safeIntegers(true)
+      for (const row of statement.iterate(...this.bindings(parameters))) {
+        yield this.integers.row(row)
+      }
+    } finally {
+      statement.finalize()
+    }
+  }
+
+  setReadBigInts(enabled: boolean): void {
+    this.integers.readBigInts = enabled
+  }
+
+  private bindings(parameters: SqliteBindings): BunBindings {
+    if (parameters.some((value) => value === undefined)) {
+      throw new TypeError('Undefined cannot be bound to a SQLite parameter')
+    }
+    // No arguments would reuse the driver's previous bindings.
+    if (parameters.length === 0) {
+      return EMPTY_BINDINGS
+    }
+    if (parameters.length >= this.parameterCount) {
+      return parameters
+    }
+    return [...parameters, ...Array<null>(this.parameterCount - parameters.length).fill(null)]
+  }
+}
diff --git a/src/main/sqlite/node-sqlite-statement.ts b/src/main/sqlite/node-sqlite-statement.ts
new file mode 100644
index 00000000000..53a83108086
--- /dev/null
+++ b/src/main/sqlite/node-sqlite-statement.ts
@@ -0,0 +1,39 @@
+import type { StatementResultingChanges } from 'node:sqlite'
+import { SqliteIntegerReader } from './sqlite-integer-reader'
+import type { SqliteBindings, SqliteRow, SqliteStatement } from './sqlite-statement'
+
+export class NodeSqliteStatement implements SqliteStatement {
+  private readonly integers = new SqliteIntegerReader()
+
+  constructor(private readonly statement: SqliteStatement) {
+    // Native number reads overflow their INT64_MIN guard on some builds and round insert rowids.
+    statement.setReadBigInts(true)
+  }
+
+  all(...parameters: SqliteBindings): SqliteRow[] {
+    const rows = this.statement.all(...parameters)
+    for (const row of rows) {
+      this.integers.row(row)
+    }
+    return rows
+  }
+
+  get(...parameters: SqliteBindings): SqliteRow | undefined {
+    const row = this.statement.get(...parameters)
+    return row === undefined ? undefined : this.integers.row(row)
+  }
+
+  run(...parameters: SqliteBindings): StatementResultingChanges {
+    return this.integers.result(this.statement.run(...parameters))
+  }
+
+  *iterate(...parameters: SqliteBindings): IterableIterator<SqliteRow> {
+    for (const row of this.statement.iterate(...parameters)) {
+      yield this.integers.row(row)
+    }
+  }
+
+  setReadBigInts(enabled: boolean): void {
+    this.integers.readBigInts = enabled
+  }
+}
diff --git a/src/main/sqlite/sqlite-integer-reader.ts b/src/main/sqlite/sqlite-integer-reader.ts
new file mode 100644
index 00000000000..e3a5821bcda
--- /dev/null
+++ b/src/main/sqlite/sqlite-integer-reader.ts
@@ -0,0 +1,40 @@
+import type { StatementResultingChanges } from 'node:sqlite'
+import type { SqliteRow } from './sqlite-statement'
+
+export class SqliteIntegerReader {
+  readBigInts = false
+
+  row(row: SqliteRow): SqliteRow {
+    if (!this.readBigInts) {
+      for (const key of Object.keys(row)) {
+        const value = row[key]
+        if (typeof value === 'bigint') {
+          row[key] = this.integer(value)
+        }
+      }
+    }
+    return row
+  }
+
+  result(result: StatementResultingChanges): StatementResultingChanges {
+    return {
+      changes: this.integer(result.changes, false),
+      lastInsertRowid: this.integer(result.lastInsertRowid, false)
+    }
+  }
+
+  private integer(value: number | bigint, requireSafeNumber = true): number | bigint {
+    if (this.readBigInts) {
+      return BigInt(value)
+    }
+    const number = Number(value)
+    if (!Number.isSafeInteger(number)) {
+      // Metadata conversion must not report failure after a write has committed.
+      if (!requireSafeNumber) {
+        return BigInt(value)
+      }
+      throw new RangeError('SQLite integer cannot be represented safely as a JavaScript number')
+    }
+    return number
+  }
+}
diff --git a/src/main/sqlite/sqlite-read-failure.test.ts b/src/main/sqlite/sqlite-read-failure.test.ts
index 8bd43d54eaa..fdb3dc88365 100644
--- a/src/main/sqlite/sqlite-read-failure.test.ts
+++ b/src/main/sqlite/sqlite-read-failure.test.ts
@@ -10,13 +10,12 @@ import { classifySqliteReadFailure, isTransientSqliteContention } from './sqlite
 // with no usable -shm reports errcode 14 ("unable to open database file"). The
 // two need opposite responses, so the classifier must never conflate them.
 
-let tempDirs: string[] = []
+const tempDirs: string[] = []
 
 afterEach(() => {
-  for (const dir of tempDirs) {
+  for (const dir of tempDirs.splice(0)) {
     rmSync(dir, { recursive: true, force: true })
   }
-  tempDirs = []
 })
 
 function contendedDatabase(): { path: string; release: () => void } {
@@ -40,18 +39,22 @@ function contendedDatabase(): { path: string; release: () => void } {
 describe('isTransientSqliteContention', () => {
   it('recognizes a real SQLITE_BUSY thrown by a read-only open', () => {
     const contended = contendedDatabase()
+    let reader: SyncDatabase | undefined
     let thrown: unknown
     try {
-      new SyncDatabase(contended.path, { readonly: true, timeout: 0 })
-        .prepare('SELECT id FROM session')
-        .all()
+      reader = new SyncDatabase(contended.path, { readonly: true, timeout: 0 })
+      reader.prepare('SELECT id FROM session').all()
     } catch (error) {
       thrown = error
     } finally {
-      contended.release()
+      try {
+        reader?.close()
+      } finally {
+        contended.release()
+      }
     }
 
-    expect((thrown as { errcode?: number }).errcode).toBe(5)
+    expect(thrown).toMatchObject({ [process.versions.bun ? 'errno' : 'errcode']: 5 })
     expect(isTransientSqliteContention(thrown)).toBe(true)
   })
 
diff --git a/src/main/sqlite/sqlite-read-failure.ts b/src/main/sqlite/sqlite-read-failure.ts
index f96176eee0a..6919bf9e9cb 100644
--- a/src/main/sqlite/sqlite-read-failure.ts
+++ b/src/main/sqlite/sqlite-read-failure.ts
@@ -6,20 +6,39 @@
 /** Primary result codes; extended codes pack the primary code in the low byte. */
 const SQLITE_BUSY = 5
 const SQLITE_LOCKED = 6
+const SQLITE_CORRUPT = 11
 const SQLITE_CANTOPEN = 14
+const SQLITE_NOTADB = 26
 
 // Shared with the Codex index-heal pass, which only ever sees a relayed message
 // string (app-server RPC drops `errcode`), so message matching is not optional.
 const CONTENTION_MESSAGE = /SQLITE_(?:BUSY|LOCKED)|database (?:is )?(?:busy|locked)/i
 
 function primaryErrcode(error: unknown): number | null {
-  if (!error || typeof error !== 'object' || !('errcode' in error)) {
+  if (!error || typeof error !== 'object') {
     return null
   }
-  const errcode = (error as { errcode?: unknown }).errcode
+  const errcode = 'errcode' in error ? error.errcode : 'errno' in error ? error.errno : undefined
   return typeof errcode === 'number' && Number.isFinite(errcode) ? errcode & 0xff : null
 }
 
+/** node:sqlite marks its errors `ERR_SQLITE_ERROR`; Bun names its class `SQLiteError`. */
+function isSqliteDriverError(error: unknown): boolean {
+  return (
+    error instanceof Error &&
+    (('code' in error && error.code === 'ERR_SQLITE_ERROR') || error.name === 'SQLiteError')
+  )
+}
+
+/** True only when SQLite itself reports the database damaged or not a database at all. */
+export function isSqliteCorruption(error: unknown): boolean {
+  if (!isSqliteDriverError(error)) {
+    return false
+  }
+  const errcode = primaryErrcode(error)
+  return errcode === SQLITE_CORRUPT || errcode === SQLITE_NOTADB
+}
+
 function errorText(error: unknown): string {
   return error instanceof Error ? error.message : String(error)
 }
diff --git a/src/main/sqlite/sqlite-statement.ts b/src/main/sqlite/sqlite-statement.ts
new file mode 100644
index 00000000000..32d1e183be0
--- /dev/null
+++ b/src/main/sqlite/sqlite-statement.ts
@@ -0,0 +1,12 @@
+import type { SQLInputValue, SQLOutputValue, StatementResultingChanges } from 'node:sqlite'
+
+export type SqliteBindings = SQLInputValue[]
+export type SqliteRow = Record<string, SQLOutputValue>
+
+export type SqliteStatement = {
+  all(...parameters: SqliteBindings): SqliteRow[]
+  get(...parameters: SqliteBindings): SqliteRow | undefined
+  run(...parameters: SqliteBindings): StatementResultingChanges
+  iterate(...parameters: SqliteBindings): IterableIterator<SqliteRow>
+  setReadBigInts(enabled: boolean): void
+}
diff --git a/src/main/sqlite/sync-database-concurrent-backup.test.ts b/src/main/sqlite/sync-database-concurrent-backup.test.ts
new file mode 100644
index 00000000000..94b6221e1d6
--- /dev/null
+++ b/src/main/sqlite/sync-database-concurrent-backup.test.ts
@@ -0,0 +1,86 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { Worker } from 'node:worker_threads'
+import { expect, it } from 'vitest'
+import SyncDatabase from './sync-database'
+
+const WRITER_SOURCE = `
+  const { parentPort, workerData } = require('node:worker_threads')
+  const Database = process.versions.bun
+    ? require('bun:sqlite').Database
+    : require('node:sqlite').DatabaseSync
+  const db = new Database(workerData.path)
+  db.exec('PRAGMA busy_timeout=5000; PRAGMA synchronous=FULL')
+  const count = new Int32Array(workerData.count)
+  let revision = 0
+  function commit() {
+    revision += 1
+    db.exec('BEGIN IMMEDIATE; UPDATE marker SET revision=' + revision + '; COMMIT')
+    Atomics.store(count, 0, revision)
+    if (revision === 1) {
+      parentPort.once('message', commit)
+      parentPort.postMessage('writing')
+      return
+    }
+    if (revision < 40) setTimeout(commit, 2)
+    else { db.close(true); parentPort.close() }
+  }
+  commit()
+`
+
+it('backs up one complete revision while another thread commits to the WAL', async () => {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-sqlite-concurrent-backup-'))
+  const path = join(directory, 'source.db')
+  const target = join(directory, 'snapshot.db')
+  const source = new SyncDatabase(path)
+  let writer: Worker | undefined
+  let snapshot: SyncDatabase | undefined
+  try {
+    source.exec(`
+      PRAGMA journal_mode=WAL;
+      PRAGMA synchronous=FULL;
+      CREATE TABLE marker(name TEXT PRIMARY KEY, revision INTEGER NOT NULL);
+      INSERT INTO marker VALUES('first',0),('second',0);
+      CREATE TABLE payload(id INTEGER PRIMARY KEY, value BLOB NOT NULL);
+      WITH RECURSIVE rows(id) AS (VALUES(1) UNION ALL SELECT id+1 FROM rows WHERE id<1024)
+      INSERT INTO payload SELECT id, zeroblob(65536) FROM rows;
+    `)
+    const sharedCount = new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT)
+    const count = new Int32Array(sharedCount)
+    writer = new Worker(WRITER_SOURCE, { eval: true, workerData: { path, count: sharedCount } })
+    const firstCommit = new Promise<void>((resolve, reject) => {
+      writer?.once('message', () => resolve())
+      writer?.once('error', reject)
+    })
+    const writerExit = new Promise<void>((resolve, reject) => {
+      writer?.once('error', reject)
+      writer?.once('exit', (code) =>
+        code === 0 ? resolve() : reject(new Error(`Writer exited ${code}`))
+      )
+    })
+    // Attach failure handling before awaiting either event.
+    void writerExit.catch(() => {})
+    await firstCommit
+    const before = Atomics.load(count, 0)
+    // Keep the writer alive until this thread is ready to start the backup.
+    writer.postMessage('continue')
+    await source.backup(target)
+    const after = Atomics.load(count, 0)
+    expect(after).toBeGreaterThan(before)
+    await writerExit
+    snapshot = new SyncDatabase(target, { readonly: true, fileMustExist: true })
+    const rows = snapshot.prepare('SELECT revision FROM marker ORDER BY name').all()
+    expect(rows).toHaveLength(2)
+    expect(rows[0]).toEqual(rows[1])
+    expect(rows[0]?.revision).toBeGreaterThanOrEqual(before)
+    expect(rows[0]?.revision).toBeLessThanOrEqual(Atomics.load(count, 0))
+    expect(snapshot.prepare('SELECT count(*) AS count FROM payload').get()).toEqual({ count: 1024 })
+    expect(snapshot.pragma('integrity_check', { simple: true })).toBe('ok')
+  } finally {
+    await writer?.terminate()
+    snapshot?.close()
+    source.close()
+    rmSync(directory, { recursive: true, force: true })
+  }
+}, 20_000)
diff --git a/src/main/sqlite/sync-database-portability.test.ts b/src/main/sqlite/sync-database-portability.test.ts
new file mode 100644
index 00000000000..fe8534eaf98
--- /dev/null
+++ b/src/main/sqlite/sync-database-portability.test.ts
@@ -0,0 +1,278 @@
+import { existsSync, mkdtempSync, renameSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { afterEach, describe, expect, it } from 'vitest'
+import SyncDatabase, { isSqliteAvailable } from './sync-database'
+
+const directories: string[] = []
+const databases: SyncDatabase[] = []
+
+function fixture(): string {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-sqlite-runtime-'))
+  directories.push(directory)
+  return directory
+}
+
+function open(path: string): SyncDatabase {
+  const db = new SyncDatabase(path)
+  databases.push(db)
+  return db
+}
+
+afterEach(() => {
+  for (const database of databases.splice(0)) {
+    try {
+      database.close()
+    } catch {
+      // A close-contract test already released this connection.
+    }
+  }
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+describe('SQLite runtime contract', () => {
+  it('restarts an interrupted cached iterator without skipping its failed row', () => {
+    const db = open(':memory:')
+    db.exec('CREATE TABLE rows(value INTEGER); INSERT INTO rows VALUES(1),(2),(3)')
+    const statement = db.prepare('SELECT value FROM rows ORDER BY value')
+    for (let attempt = 0; attempt < 3; attempt++) {
+      expect(() => {
+        for (const row of statement.iterate()) {
+          expect(row.value).toBe(1)
+          throw new Error('invalid row')
+        }
+      }).toThrow('invalid row')
+    }
+    expect([...statement.iterate()]).toEqual([{ value: 1 }, { value: 2 }, { value: 3 }])
+    db.exec('DROP TABLE rows')
+  })
+
+  it('admits the actual runtime driver', () => {
+    expect(isSqliteAvailable()).toBe(true)
+  })
+
+  it('enforces foreign keys by default', () => {
+    const db = open(':memory:')
+    db.exec(
+      'CREATE TABLE parents(id INTEGER PRIMARY KEY); CREATE TABLE children(parent INTEGER REFERENCES parents(id))'
+    )
+    expect(() => db.prepare('INSERT INTO children VALUES(?)').run(1)).toThrow()
+    expect(db.prepare('SELECT * FROM children').all()).toEqual([])
+    db.prepare('INSERT INTO parents VALUES(?)').run(1)
+    expect(db.prepare('INSERT INTO children VALUES(?)').run(1).changes).toBe(1)
+    expect(() => db.prepare('DELETE FROM parents WHERE id = ?').run(1)).toThrow()
+  })
+
+  it('returns safe integers as numbers without changing other SQLite values', () => {
+    const db = open(':memory:')
+    const row = db
+      .prepare('SELECT ? AS integer, ? AS real, ? AS text, ? AS blob, ? AS empty')
+      .get(Number.MAX_SAFE_INTEGER, 1.25, 'héllo', Buffer.from([0, 255, 17]), null)
+    expect(row).toEqual({
+      integer: Number.MAX_SAFE_INTEGER,
+      real: 1.25,
+      text: 'héllo',
+      blob: expect.any(Uint8Array),
+      empty: null
+    })
+    expect(row?.blob).toEqual(new Uint8Array([0, 255, 17]))
+  })
+
+  it('preserves 64-bit integers and rejects rounding in every reader by default', () => {
+    const db = open(':memory:')
+    const statement = db.prepare('SELECT ? AS integer')
+    for (const value of [
+      -(1n << 63n),
+      -(1n << 63n) + 1n,
+      -(1n << 53n),
+      1n << 53n,
+      (1n << 53n) + 1n,
+      (1n << 63n) - 1n
+    ]) {
+      expect(() => statement.get(value)).toThrow(RangeError)
+      expect(() => statement.all(value)).toThrow(RangeError)
+      expect(() => [...statement.iterate(value)]).toThrow(RangeError)
+      statement.setReadBigInts(true)
+      expect(statement.get(value)).toEqual({ integer: value })
+      expect(statement.all(value)).toEqual([{ integer: value }])
+      expect([...statement.iterate(value)]).toEqual([{ integer: value }])
+      statement.setReadBigInts(false)
+    }
+  })
+
+  it('distinguishes large REAL values from INTEGER values in the same column', () => {
+    const db = open(':memory:')
+    db.exec('CREATE TABLE values_by_type(value); INSERT INTO values_by_type VALUES(1)')
+    const statement = db.prepare('SELECT value FROM values_by_type')
+    for (const readBigInts of [false, true, false]) {
+      statement.setReadBigInts(readBigInts)
+      db.exec('DELETE FROM values_by_type; INSERT INTO values_by_type VALUES(9007199254740991)')
+      const safe = readBigInts ? 9007199254740991n : Number.MAX_SAFE_INTEGER
+      expect(statement.get()).toEqual({ value: safe })
+      db.exec(
+        'DELETE FROM values_by_type; INSERT INTO values_by_type VALUES(CAST(-9223372036854775808 AS REAL))'
+      )
+      const real = { value: Number(-(1n << 63n)) }
+      expect(statement.get()).toEqual(real)
+      expect(statement.all()).toEqual([real])
+      expect([...statement.iterate()]).toEqual([real])
+      db.exec('DELETE FROM values_by_type; INSERT INTO values_by_type VALUES(-9223372036854775808)')
+      if (readBigInts) {
+        expect(statement.get()).toEqual({ value: -(1n << 63n) })
+      } else {
+        expect(() => statement.get()).toThrow(RangeError)
+        expect(() => statement.all()).toThrow(RangeError)
+        expect(() => [...statement.iterate()]).toThrow(RangeError)
+      }
+    }
+  })
+
+  it('rejects integers outside SQLite range before changing rows', () => {
+    const db = open(':memory:')
+    db.exec('CREATE TABLE items(value INTEGER)')
+    const insert = db.prepare('INSERT INTO items VALUES(?)')
+    for (const value of [-(1n << 63n) - 1n, 1n << 63n]) {
+      expect(() => insert.run(value)).toThrow()
+    }
+    expect(db.prepare('SELECT count(*) AS count FROM items').get()).toEqual({ count: 0 })
+  })
+
+  it('clears old bindings and binds omitted positional values as null', () => {
+    const db = open(':memory:')
+    const statement = db.prepare('SELECT ? AS first, ? AS second')
+    expect(statement.get('old', 'secret')).toEqual({ first: 'old', second: 'secret' })
+    expect(statement.get('new')).toEqual({ first: 'new', second: null })
+    expect(statement.get()).toEqual({ first: null, second: null })
+    expect(statement.all()).toEqual([{ first: null, second: null }])
+    expect([...statement.iterate()]).toEqual([{ first: null, second: null }])
+    expect(db.prepare('SELECT 1 WHERE 0').get()).toBeUndefined()
+  })
+
+  it('reports changes and explicit rowids using the requested integer mode', () => {
+    const db = open(':memory:')
+    db.exec('CREATE TABLE items(id INTEGER PRIMARY KEY, value TEXT)')
+    const insert = db.prepare('INSERT INTO items VALUES(?, ?)')
+    expect(insert.run(3, 'first')).toEqual({ changes: 1, lastInsertRowid: 3 })
+    insert.setReadBigInts(true)
+    expect(insert.run(9007199254740993n, 'large')).toEqual({
+      changes: 1n,
+      lastInsertRowid: 9007199254740993n
+    })
+  })
+
+  it('preserves large write metadata without reporting a committed write as failed', () => {
+    const db = open(':memory:')
+    db.exec('CREATE TABLE items(id INTEGER PRIMARY KEY)')
+    const rowid = 9007199254740993n
+    expect(db.prepare('INSERT INTO items VALUES(?)').run(rowid)).toEqual({
+      changes: 1,
+      lastInsertRowid: rowid
+    })
+    expect(db.prepare('UPDATE items SET id=id').run()).toEqual({
+      changes: 1,
+      lastInsertRowid: rowid
+    })
+    const statement = db.prepare('SELECT id FROM items')
+    statement.setReadBigInts(true)
+    expect(statement.all()).toEqual([{ id: rowid }])
+  })
+
+  it('rejects explicit undefined bindings before modifying rows', () => {
+    const db = open(':memory:')
+    db.exec('CREATE TABLE items(value TEXT)')
+    const insert = db.prepare('INSERT INTO items VALUES(?)')
+    // @ts-expect-error Exercise invalid input from untyped callers.
+    expect(() => insert.run(undefined)).toThrow()
+    expect(db.prepare('SELECT count(*) AS count FROM items').get()).toEqual({ count: 0 })
+    const select = db.prepare('SELECT ? AS value')
+    // @ts-expect-error Exercise invalid input from untyped callers.
+    expect(() => select.get(undefined)).toThrow()
+    // @ts-expect-error Exercise invalid input from untyped callers.
+    expect(() => select.all(undefined)).toThrow()
+    // @ts-expect-error Exercise invalid input from untyped callers.
+    expect(() => [...select.iterate(undefined)]).toThrow()
+  })
+
+  it('releases statements and an unfinished iterator before filesystem retirement', () => {
+    const path = join(fixture(), 'database.db')
+    const db = open(path)
+    db.exec('CREATE TABLE items(id INTEGER PRIMARY KEY); INSERT INTO items VALUES(1),(2)')
+    db.exec("CREATE VIRTUAL TABLE search USING fts5(content); INSERT INTO search VALUES('needle')")
+    const statement = db.prepare('SELECT id FROM items ORDER BY id')
+    const search = db.prepare("SELECT content FROM search WHERE search MATCH 'needle'")
+    expect(search.get()).toEqual({ content: 'needle' })
+    const iterator = statement.iterate()
+    expect(iterator.next().value).toEqual({ id: 1 })
+    db.close()
+    expect(() => statement.get()).toThrow()
+    expect(() => search.get()).toThrow()
+    renameSync(path, `${path}.retired`)
+    const reopened = open(`${path}.retired`)
+    reopened.exec('DROP TABLE items')
+  })
+
+  it('opens literal filenames, URL paths and Buffer paths without treating them as data', () => {
+    const path = join(fixture(), "profile % # ' é.db")
+    const writer = open(path)
+    writer.exec('CREATE TABLE items(id INTEGER PRIMARY KEY); INSERT INTO items VALUES(9)')
+    for (const input of [pathToFileURL(path), Buffer.from(path)]) {
+      const reader = new SyncDatabase(input, { readonly: true, fileMustExist: true })
+      databases.push(reader)
+      expect(reader.prepare('SELECT id FROM items').get()).toEqual({ id: 9 })
+    }
+    expect(existsSync(path)).toBe(true)
+  })
+
+  it('refuses missing databases and changes through read-only connections', () => {
+    const path = join(fixture(), 'database.db')
+    for (const input of [path, pathToFileURL(path), Buffer.from(path)]) {
+      expect(() => new SyncDatabase(input, { fileMustExist: true })).toThrow()
+      expect(() => new SyncDatabase(input, { readonly: true, fileMustExist: true })).toThrow()
+      expect(existsSync(path)).toBe(false)
+    }
+    const writer = open(path)
+    writer.exec('CREATE TABLE items(id INTEGER PRIMARY KEY)')
+    const reader = new SyncDatabase(path, { readonly: true, timeout: 4321 })
+    databases.push(reader)
+    expect(reader.pragma('busy_timeout', { simple: true })).toBe(4321)
+    expect(() => reader.exec('INSERT INTO items VALUES(1)')).toThrow()
+    expect(writer.pragma('busy_timeout', { simple: true })).toBe(0)
+  })
+
+  it('copies committed WAL data through a read-only source into privately precreated output', async () => {
+    const directory = fixture()
+    const path = join(directory, 'database.db')
+    const target = join(directory, "snapshot % # '.db")
+    const writer = open(path)
+    writer.exec(
+      'PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL; CREATE TABLE items(id INTEGER PRIMARY KEY, value TEXT)'
+    )
+    writer.prepare('INSERT INTO items VALUES(?, ?)').run(19, 'committed in WAL')
+    expect(existsSync(`${path}-wal`)).toBe(true)
+    const source = new SyncDatabase(path, { readonly: true, fileMustExist: true })
+    databases.push(source)
+    writeFileSync(target, '', { flag: 'wx', mode: 0o600 })
+    await source.backup(target)
+    const snapshot = open(target)
+    expect(snapshot.prepare('SELECT id, value FROM items').get()).toEqual({
+      id: 19,
+      value: 'committed in WAL'
+    })
+    expect(snapshot.pragma('integrity_check', { simple: true })).toBe('ok')
+  })
+
+  it('refuses an active transaction before creating any backup destination', async () => {
+    const directory = fixture()
+    const db = open(join(directory, 'database.db'))
+    db.exec(
+      'CREATE TABLE items(id INTEGER PRIMARY KEY); BEGIN IMMEDIATE; INSERT INTO items VALUES(1)'
+    )
+    const target = join(directory, 'backup.db')
+    await expect(db.backup(target)).rejects.toThrow(/idle/)
+    expect(existsSync(target)).toBe(false)
+    db.exec('ROLLBACK')
+  })
+})
diff --git a/src/main/sqlite/sync-database.test.ts b/src/main/sqlite/sync-database.test.ts
index 39cb443aeeb..4c937197a43 100644
--- a/src/main/sqlite/sync-database.test.ts
+++ b/src/main/sqlite/sync-database.test.ts
@@ -213,7 +213,7 @@ describe('SyncDatabase read-only opens under contention', () => {
       thrown = error
     }
 
-    expect((thrown as { errcode?: number }).errcode).toBe(5)
+    expect(thrown).toMatchObject({ [process.versions.bun ? 'errno' : 'errcode']: 5 })
     expect((thrown as Error).message).toContain('database is locked')
     expect(Date.now() - startedAt).toBeLessThan(200)
   })
diff --git a/src/main/sqlite/sync-database.ts b/src/main/sqlite/sync-database.ts
index 0bfa79e43f5..5f27b52329e 100644
--- a/src/main/sqlite/sync-database.ts
+++ b/src/main/sqlite/sync-database.ts
@@ -1,5 +1,8 @@
 import { existsSync } from 'node:fs'
-import type { DatabaseSync, StatementSync, SQLInputValue } from 'node:sqlite'
+import type { backup, BackupOptions, DatabaseSync, SQLInputValue } from 'node:sqlite'
+import { BunSqliteDatabase, loadBunSqlite } from './bun-sqlite-database'
+import { NodeSqliteStatement } from './node-sqlite-statement'
+import type { SqliteStatement } from './sqlite-statement'
 
 type SqlitePath = ConstructorParameters<typeof DatabaseSync>[0]
 
@@ -13,7 +16,7 @@ type PragmaOptions = {
   simple?: boolean
 }
 
-export type SqliteStatement = StatementSync
+export type { SqliteStatement } from './sqlite-statement'
 
 // Why: dynamic `IN (?,?,…)` clauses mint a new SQL string per arity, so the cache must stay bounded.
 const STATEMENT_CACHE_LIMIT = 256
@@ -32,28 +35,60 @@ function loadDatabaseSync(): typeof DatabaseSync {
   if (typeof process.getBuiltinModule !== 'function') {
     throw new Error('node:sqlite is unavailable in this Node.js runtime')
   }
-  return (process.getBuiltinModule('node:sqlite') as { DatabaseSync: typeof DatabaseSync })
-    .DatabaseSync
+  const sqlite: unknown = process.getBuiltinModule('node:sqlite')
+  if (!hasDatabaseSync(sqlite)) {
+    throw new Error('node:sqlite is unavailable in this Node.js runtime')
+  }
+  return sqlite.DatabaseSync
+}
+
+function hasDatabaseSync(value: unknown): value is { DatabaseSync: typeof DatabaseSync } {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    'DatabaseSync' in value &&
+    typeof value.DatabaseSync === 'function'
+  )
+}
+
+function hasBackup(value: unknown): value is { backup: typeof backup } {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    'backup' in value &&
+    typeof value.backup === 'function'
+  )
+}
+
+export function isSqliteAvailable(): boolean {
+  try {
+    if (process.versions.bun) {
+      return loadBunSqlite() !== undefined
+    }
+    const sqlite: unknown = process.getBuiltinModule?.('node:sqlite')
+    return hasDatabaseSync(sqlite) && hasBackup(sqlite)
+  } catch {
+    return false
+  }
 }
 
 class SyncDatabase {
-  private readonly db: DatabaseSync
-  private readonly statementCache = new Map<string, StatementSync>()
+  private readonly db: DatabaseSync | BunSqliteDatabase
+  private readonly statementCache = new Map<string, SqliteStatement>()
 
   constructor(path: SqlitePath, options: SyncDatabaseOptions = {}) {
-    if (
-      options.fileMustExist &&
-      typeof path === 'string' &&
-      path !== ':memory:' &&
-      !existsSync(path)
-    ) {
-      throw new Error(`SQLite database does not exist: ${path}`)
+    if (options.fileMustExist && path !== ':memory:' && !existsSync(path)) {
+      throw new Error(`SQLite database does not exist: ${String(path)}`)
+    }
+    if (process.versions.bun) {
+      this.db = new BunSqliteDatabase(path, options)
+    } else {
+      const DatabaseSync = loadDatabaseSync()
+      this.db = new DatabaseSync(path, {
+        readOnly: options.readonly,
+        timeout: options.timeout
+      })
     }
-    const DatabaseSync = loadDatabaseSync()
-    this.db = new DatabaseSync(path, {
-      readOnly: options.readonly,
-      timeout: options.timeout
-    })
   }
 
   exec(sql: string): void {
@@ -64,14 +99,17 @@ class SyncDatabase {
     this.db.exec(sql)
   }
 
-  prepare(sql: string): StatementSync {
+  prepare(sql: string): SqliteStatement {
     const cached = this.statementCache.get(sql)
     if (cached) {
       this.statementCache.delete(sql)
       this.statementCache.set(sql, cached)
       return cached
     }
-    const statement = this.db.prepare(sql)
+    const statement =
+      this.db instanceof BunSqliteDatabase
+        ? this.db.prepare(sql)
+        : new NodeSqliteStatement(this.db.prepare(sql))
     if (isStatementCacheable(sql)) {
       if (this.statementCache.size >= STATEMENT_CACHE_LIMIT) {
         const oldest = this.statementCache.keys().next().value
@@ -85,7 +123,7 @@ class SyncDatabase {
   }
 
   pragma(sql: string, options?: PragmaOptions): unknown {
-    const statement = this.db.prepare(`PRAGMA ${sql}`)
+    const statement = this.prepare(`PRAGMA ${sql}`)
     if (options?.simple) {
       const row = statement.get()
       if (!row) {
@@ -100,6 +138,28 @@ class SyncDatabase {
     return this.db.isTransaction
   }
 
+  /** Keep the source open until completion; Bun's compact snapshot runs synchronously. */
+  async backup(path: string, options?: BackupOptions): Promise<void> {
+    if (this.db.isTransaction) {
+      throw new Error('SQLite backup requires an idle database connection')
+    }
+    if (this.db instanceof BunSqliteDatabase) {
+      if (options && Object.keys(options).length > 0) {
+        throw new Error('Incremental SQLite backup options are unavailable in this runtime')
+      }
+      this.db.backup(path)
+      return
+    }
+    const sqlite: unknown =
+      typeof process.getBuiltinModule === 'function'
+        ? process.getBuiltinModule('node:sqlite')
+        : undefined
+    if (!hasBackup(sqlite)) {
+      throw new Error('Asynchronous SQLite backup is unavailable in this Node.js runtime')
+    }
+    await sqlite.backup(this.db, path, options ?? {})
+  }
+
   close(): void {
     this.statementCache.clear()
     this.db.close()
diff --git a/src/main/ssh-reattach-pane-cardinality.test.ts b/src/main/ssh-reattach-pane-cardinality.test.ts
index d7179703360..889f792abd4 100644
--- a/src/main/ssh-reattach-pane-cardinality.test.ts
+++ b/src/main/ssh-reattach-pane-cardinality.test.ts
@@ -66,11 +66,11 @@ function sessionAfterClose() {
 }
 
 /** What the relay's reattach bind does per PTY — see `restoreReattachedPtyRuntime`. */
-function relayReattachBinds(
+async function relayReattachBinds(
   store: ReturnType<typeof createStore>,
   args: { tabId: string; leafId: string; ptyId: string; incarnationId?: string }
-): boolean | null {
-  return store.persistPtyBinding({
+): Promise<boolean | null> {
+  return await store.persistPtyBinding({
     worktreeId: WORKTREE,
     tabId: args.tabId,
     leafId: args.leafId,
@@ -95,10 +95,10 @@ function relayReattachBinds(
  * production uses; a raw session write is reconciled back to the attached lease's PTY by binding
  * recovery, which would make the fixture disagree with the real flow.
  */
-function paneSpawnCommits(
+async function paneSpawnCommits(
   store: ReturnType<typeof createStore>,
   args: { tabId: string; leafId: string; ptyId: string; leaseTabId?: string }
-): void {
+): Promise<void> {
   store.upsertSshRemotePtyLease({
     targetId: TARGET,
     ptyId: args.ptyId,
@@ -107,7 +107,7 @@ function paneSpawnCommits(
     leafId: args.leafId,
     state: 'attached'
   })
-  store.persistPtyBinding({
+  await store.persistPtyBinding({
     worktreeId: WORKTREE,
     tabId: args.tabId,
     leafId: args.leafId,
@@ -163,7 +163,7 @@ describe('STA-3077: an SSH reattach binds panes without grafting them back', ()
     // The user closes the tab; the remote kill never lands, so the lease survives untouched.
     store.setWorkspaceSession(sessionAfterClose())
 
-    const bound = relayReattachBinds(store, {
+    const bound = await relayReattachBinds(store, {
       tabId: TAB,
       leafId: TEST_LEAF_1,
       ptyId: 'pty-1',
@@ -189,7 +189,7 @@ describe('STA-3077: an SSH reattach binds panes without grafting them back', ()
     const resolvedTabId = findTerminalTabIdForLeaf(store.getWorkspaceSession(), TEST_LEAF_1)
     expect(resolvedTabId).toBe(OTHER_TAB)
 
-    const bound = relayReattachBinds(store, {
+    const bound = await relayReattachBinds(store, {
       tabId: resolvedTabId!,
       leafId: TEST_LEAF_1,
       ptyId: 'pty-2',
@@ -208,7 +208,7 @@ describe('STA-3077: an SSH reattach binds panes without grafting them back', ()
   it('still binds when the session is not yet authoritative for the worktree', async () => {
     const store = await createStore()
 
-    const bound = store.persistPtyBinding({
+    const bound = await store.persistPtyBinding({
       worktreeId: WORKTREE,
       tabId: TAB,
       leafId: TEST_LEAF_1,
@@ -250,7 +250,7 @@ describe('STA-3077: an SSH reattach binds panes without grafting them back', ()
 
     expect(store.getWorkspaceSession().terminalSurfaceTombstonesByPaneKey?.[paneKey]).toBeDefined()
     expect(
-      relayReattachBinds(store, {
+      await relayReattachBinds(store, {
         tabId: TAB,
         leafId: TEST_LEAF_1,
         ptyId: 'pty-1',
@@ -267,7 +267,7 @@ describe('STA-3077: an SSH reattach binds panes without grafting them back', ()
     const store = await createStore()
     store.setWorkspaceSession(sessionWithPane({ tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-1' }))
 
-    const bound = relayReattachBinds(store, {
+    const bound = await relayReattachBinds(store, {
       tabId: TAB,
       leafId: TEST_LEAF_2,
       ptyId: 'pty-2',
@@ -292,9 +292,9 @@ describe('STA-3077: an SSH reattach binds panes without grafting them back', ()
     const session = store.getWorkspaceSession()
     expect(session.terminalTopologyRevisionByRepoId?.repo1).toBeGreaterThan(0)
     expect(session.terminalSurfaceTombstonesByPaneKey ?? {}).toEqual({})
-    expect(relayReattachBinds(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-1' })).toBe(
-      false
-    )
+    expect(
+      await relayReattachBinds(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-1' })
+    ).toBe(false)
   })
 })
 
@@ -314,7 +314,7 @@ describe('STA-3077: one pane keeps at most one live remote lease', () => {
     const lease = { targetId: TARGET, worktreeId: WORKTREE, tabId: TAB, leafId: TEST_LEAF_1 }
     store.upsertSshRemotePtyLease({ ...lease, ptyId: 'pty-1', state: 'attached' })
 
-    paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
+    await paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
 
     expect(liveLeasePtyIds(store)).toEqual(['pty-2'])
   })
@@ -327,7 +327,7 @@ describe('STA-3077: one pane keeps at most one live remote lease', () => {
     const lease = { targetId: TARGET, worktreeId: WORKTREE, tabId: TAB, leafId: TEST_LEAF_1 }
     store.upsertSshRemotePtyLease({ ...lease, ptyId: 'pty-1', state: 'attached' })
 
-    paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
+    await paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
 
     const predecessor = store.getSshRemotePtyLeases(TARGET).find((entry) => entry.ptyId === 'pty-1')
     expect(predecessor?.state).toBe('expired')
@@ -339,7 +339,7 @@ describe('STA-3077: one pane keeps at most one live remote lease', () => {
     store.setWorkspaceSession(sessionWithPane({ tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-0' }))
 
     for (let reconnect = 0; reconnect < 10; reconnect++) {
-      paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: `pty-${reconnect}` })
+      await paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: `pty-${reconnect}` })
     }
 
     expect(liveLeasePtyIds(store)).toEqual(['pty-9'])
@@ -362,7 +362,7 @@ describe('STA-3077: one pane keeps at most one live remote lease', () => {
     // The successor's lease names the tab the pane sits in NOW; the predecessor's still names the
     // one it was written in. Only the leaf is common, so keying on the tab would stop the two
     // competing and leave both live — the cardinality growth.
-    paneSpawnCommits(store, {
+    await paneSpawnCommits(store, {
       tabId: TAB,
       leafId: TEST_LEAF_1,
       ptyId: 'pty-2',
@@ -401,7 +401,7 @@ describe('STA-3077: one pane keeps at most one live remote lease', () => {
     const lease = { targetId: TARGET, worktreeId: WORKTREE, tabId: TAB, leafId: TEST_LEAF_1 }
     store.upsertSshRemotePtyLease({ ...lease, ptyId: 'pty-1', state: 'attached' })
 
-    paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
+    await paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
 
     expect(liveLeasePtyIds(store).sort()).toEqual(['pty-2', 'sibling-pty'])
   })
@@ -461,7 +461,7 @@ describe('STA-3077: `expired` separates a superseded sibling from an orphan', ()
   it('never bulk-reattaches a superseded sibling', async () => {
     const store = await storeWithPane('pty-1')
 
-    paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
+    await paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
 
     const predecessor = store.getSshRemotePtyLeases(TARGET).find((entry) => entry.ptyId === 'pty-1')
     expect(predecessor).toMatchObject({ state: 'expired', supersededBy: 'pty-2' })
@@ -474,7 +474,7 @@ describe('STA-3077: `expired` separates a superseded sibling from an orphan', ()
     store.setWorkspaceSession(sessionWithPane({ tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-0' }))
 
     for (let reconnect = 0; reconnect < 10; reconnect++) {
-      paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: `pty-${reconnect}` })
+      await paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: `pty-${reconnect}` })
     }
 
     expect(bulkReattachPtyIds(store)).toEqual(['pty-9'])
@@ -500,7 +500,7 @@ describe('STA-3077: `expired` separates a superseded sibling from an orphan', ()
     store.markSshRemotePtyLease(TARGET, 'pty-1', 'expired')
     const orphanUpdatedAt = store.getSshRemotePtyLeases(TARGET)[0].updatedAt
 
-    paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
+    await paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
 
     const predecessor = store.getSshRemotePtyLeases(TARGET).find((entry) => entry.ptyId === 'pty-1')
     expect(predecessor).toMatchObject({ state: 'expired', supersededBy: 'pty-2' })
@@ -513,7 +513,7 @@ describe('STA-3077: `expired` separates a superseded sibling from an orphan', ()
   // belongs to the lease that lost, never to whatever claims the id next.
   it('clears the supersession mark when the id is re-upserted as a live lease', async () => {
     const store = await storeWithPane('pty-1')
-    paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
+    await paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
 
     // A restarted relay hands `pty-1` to a new shell for a different pane.
     store.upsertSshRemotePtyLease({
diff --git a/src/main/ssh/__tests__/ssh-connection-test-client.ts b/src/main/ssh/__tests__/ssh-connection-test-client.ts
index 5e57dea3936..46276f90c43 100644
--- a/src/main/ssh/__tests__/ssh-connection-test-client.ts
+++ b/src/main/ssh/__tests__/ssh-connection-test-client.ts
@@ -38,18 +38,32 @@ export const VALID_ED25519_HOST_KEY = Buffer.from(
 )
 
 // Knobs tests assign to; grouped because imported bindings cannot be reassigned.
-export const ssh2Mock = {
-  presentedHostKey: undefined as Buffer | undefined,
+export const ssh2Mock: {
+  presentedHostKey: Buffer | undefined
+  lastHostKeyAccepted: boolean | undefined
+  connectBehavior: 'ready' | 'error' | 'pending'
+  connectErrorMessage: string
+  connectErrorCode: string
+  destroyErrorMessage: string
+  connectSequence: ('ready' | 'silent' | Error)[]
+  execBehavior: 'callback' | 'pending'
+  sftpBehavior: 'callback' | 'pending'
+  notifyClientCreated: (() => void) | undefined
+} = {
+  presentedHostKey: undefined,
   /** What the verifier decided about the presented key on the most recent connect. */
-  lastHostKeyAccepted: undefined as boolean | undefined,
-  connectBehavior: 'ready' as 'ready' | 'error' | 'pending',
+  lastHostKeyAccepted: undefined,
+  connectBehavior: 'ready',
   connectErrorMessage: '',
   connectErrorCode: '',
   destroyErrorMessage: '',
-  connectSequence: [] as ('ready' | Error)[],
-  execBehavior: 'callback' as 'callback' | 'pending',
-  sftpBehavior: 'callback' as 'callback' | 'pending',
-  notifyClientCreated: undefined as (() => void) | undefined
+  // Why 'silent': leaves the connect attempt pending (no ready/error emitted)
+  // so a test can drive auth events (e.g. keyboard-interactive prompts)
+  // through emitSshEvent itself.
+  connectSequence: [],
+  execBehavior: 'callback',
+  sftpBehavior: 'callback',
+  notifyClientCreated: undefined
 }
 
 export const emitSshEvent = (event: string, ...args: unknown[]): void =>
@@ -137,6 +151,9 @@ export function createSsh2Module(): Ssh2ModuleMock {
           this.emit('ready')
           return
         }
+        if (next === 'silent') {
+          return
+        }
         if (ssh2Mock.connectBehavior === 'pending') {
           const configValue = this.lastConnectConfig
           const readyTimeout =
diff --git a/src/main/ssh/orcad-artifact-materializer.test.ts b/src/main/ssh/orcad-artifact-materializer.test.ts
new file mode 100644
index 00000000000..beff61176ee
--- /dev/null
+++ b/src/main/ssh/orcad-artifact-materializer.test.ts
@@ -0,0 +1,319 @@
+import { createHash } from 'node:crypto'
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  ORCAD_BUILD_TARGET_FILENAME,
+  ORCAD_EMOJI_SHORTCODE_DATASET,
+  ORCAD_RIPGREP_ARTIFACTS,
+  ORCAD_TEMPLATE_MANIFEST_FILENAME,
+  ORCAD_TEMPLATE_TARGETS_DIR,
+  ORCAD_VERSION_FILENAME,
+  orcadArtifactFilenames,
+  orcadTemplateCommonFilenames
+} from '../../shared/orcad-artifacts'
+import type { OrcadBunTarget } from '../../shared/orcad-bun-runtime'
+import { z } from 'zod'
+import { readOrcadArtifactIdentity } from '../orcad/orcad-artifact-identity'
+import {
+  assembleOrcadArtifact,
+  materializeOrcadArtifact,
+  resetOrcadArtifactMaterializationsForTests
+} from './orcad-artifact-materializer'
+import { materializeCachedOrcadBunRuntime } from './orcad-bun-runtime-materializer'
+import type * as BunRuntimeMaterializer from './orcad-bun-runtime-materializer'
+
+vi.mock('./orcad-bun-runtime-materializer', async (importOriginal) => {
+  const actual = await importOriginal<typeof BunRuntimeMaterializer>()
+  return { ...actual, materializeCachedOrcadBunRuntime: vi.fn() }
+})
+
+const TARGET = 'linux-x64-glibc' as const
+const temporaryDirs: string[] = []
+
+afterEach(() => {
+  resetOrcadArtifactMaterializationsForTests()
+  vi.clearAllMocks()
+  for (const dir of temporaryDirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+function sha256(path: string): string {
+  return createHash('sha256').update(readFileSync(path)).digest('hex')
+}
+
+function write(path: string, contents: string): void {
+  mkdirSync(dirname(path), { recursive: true })
+  writeFileSync(path, contents)
+}
+
+function createTemplate(target: OrcadBunTarget = TARGET): {
+  root: string
+  templateDir: string
+  cacheRoot: string
+  runtimePath: string
+} {
+  const root = mkdtempSync(join(tmpdir(), 'orcad-artifact-template-'))
+  temporaryDirs.push(root)
+  const templateDir = join(root, 'template')
+  const cacheRoot = join(root, 'cache')
+  const runtimePath = join(root, 'bun-runtime')
+  const common: Record<string, string> = {
+    ...Object.fromEntries(orcadTemplateCommonFilenames().map((filename) => [filename, filename])),
+    'orcad.js': 'orcad-entry',
+    'daemon-entry.js': 'daemon-entry',
+    'profile-state-writer-worker-entry.js': 'writer-entry',
+    'profile-state-backup-worker-entry.js': 'backup-entry',
+    'windows-bun-pty-gate-entry.js': 'pty-gate-entry',
+    'parcel-watcher-process-entry.js': 'watcher-process',
+    'node_modules/@parcel/watcher/index.js': 'watcher-wrapper',
+    [ORCAD_EMOJI_SHORTCODE_DATASET]: '{}'
+  }
+  for (const [filename, contents] of Object.entries(common)) {
+    write(join(templateDir, filename), contents)
+  }
+  const targetDir = join(templateDir, ORCAD_TEMPLATE_TARGETS_DIR, target)
+  write(join(targetDir, ORCAD_BUILD_TARGET_FILENAME), `${target}\n`)
+  write(join(targetDir, 'watcher.node'), 'native-watcher')
+  write(join(targetDir, 'agent-browser-linux-x64'), 'browser')
+  write(runtimePath, 'bun-executable')
+  if (target.startsWith('win32-')) {
+    write(join(templateDir, 'windows-process-tree.node'), 'process-table')
+  }
+  write(
+    join(templateDir, ORCAD_TEMPLATE_MANIFEST_FILENAME),
+    JSON.stringify({
+      schemaVersion: 2,
+      commonSha256: Object.fromEntries(
+        Object.keys(common).map((filename) => [filename, sha256(join(templateDir, filename))])
+      ),
+      targets: {
+        [target]: {
+          targetSha256: sha256(join(targetDir, ORCAD_BUILD_TARGET_FILENAME)),
+          watcherSha256: sha256(join(targetDir, 'watcher.node')),
+          browserName: 'agent-browser-linux-x64',
+          browserSha256: sha256(join(targetDir, 'agent-browser-linux-x64'))
+        }
+      }
+    })
+  )
+  return { root, templateDir, cacheRoot, runtimePath }
+}
+
+describe('assembleOrcadArtifact', () => {
+  it.skipIf(process.platform === 'win32')(
+    'restores executable search modes from a template copied without them',
+    async () => {
+      const fixture = createTemplate()
+      const filenames = ORCAD_RIPGREP_ARTIFACTS.filter((filename) => filename.endsWith('/rg'))
+      for (const filename of filenames) {
+        chmodSync(join(fixture.templateDir, filename), 0o644)
+      }
+      const artifactDir = await assembleOrcadArtifact({ ...fixture, target: TARGET })
+      for (const filename of filenames) {
+        expect(statSync(join(artifactDir, filename)).mode & 0o777).toBe(0o755)
+      }
+    }
+  )
+
+  it('gives Windows executable naming a new immutable slot identity', async () => {
+    const target = 'win32-x64' as const
+    const fixture = createTemplate(target)
+    const artifactDir = await assembleOrcadArtifact({ ...fixture, target })
+    expect(readFileSync(join(artifactDir, 'bun-runtime.exe'), 'utf8')).toBe('bun-executable')
+    expect(existsSync(join(artifactDir, 'bun-runtime'))).toBe(false)
+    const oldHash = createHash('sha256')
+    for (const filename of orcadArtifactFilenames(target)) {
+      oldHash.update(readFileSync(join(artifactDir, filename)))
+    }
+    oldHash.update('browser')
+    const oldVersion = `0.1.0+${oldHash.digest('hex').slice(0, 12)}`
+    const oldDir = join(fixture.cacheRoot, target, oldVersion)
+    write(join(oldDir, 'bun-runtime'), 'legacy-slot-must-stay-unchanged')
+    expect(artifactDir).not.toBe(oldDir)
+    await expect(assembleOrcadArtifact({ ...fixture, target })).resolves.toBe(artifactDir)
+    expect(readFileSync(join(oldDir, 'bun-runtime'), 'utf8')).toBe(
+      'legacy-slot-must-stay-unchanged'
+    )
+  })
+
+  it('assembles a complete content-addressed target directory', async () => {
+    const fixture = createTemplate()
+    const artifactDir = await assembleOrcadArtifact({
+      templateDir: fixture.templateDir,
+      cacheRoot: fixture.cacheRoot,
+      target: TARGET,
+      runtimePath: fixture.runtimePath
+    })
+
+    const version = readFileSync(join(artifactDir, ORCAD_VERSION_FILENAME), 'utf8').trim()
+    expect(version).toMatch(/^0\.1\.0\+[a-f0-9]{12}$/u)
+    expect(await readOrcadArtifactIdentity(artifactDir)).toBe(version)
+    write(join(artifactDir, 'orcad.js'), 'changed-installed-bytes')
+    expect(await readOrcadArtifactIdentity(artifactDir)).not.toBe(version)
+    expect(artifactDir).toBe(join(fixture.cacheRoot, TARGET, version))
+    expect(readFileSync(join(artifactDir, ORCAD_BUILD_TARGET_FILENAME), 'utf8').trim()).toBe(TARGET)
+    for (const filename of orcadArtifactFilenames()) {
+      expect(readFileSync(join(artifactDir, filename)).byteLength).toBeGreaterThan(0)
+    }
+    expect(readFileSync(join(artifactDir, 'agent-browser-linux-x64'), 'utf8')).toBe('browser')
+  })
+
+  it('rejects a packaged native file that does not match its manifest', async () => {
+    const fixture = createTemplate()
+    write(
+      join(fixture.templateDir, ORCAD_TEMPLATE_TARGETS_DIR, TARGET, 'watcher.node'),
+      'corrupted'
+    )
+
+    await expect(
+      assembleOrcadArtifact({
+        templateDir: fixture.templateDir,
+        cacheRoot: fixture.cacheRoot,
+        target: TARGET,
+        runtimePath: fixture.runtimePath
+      })
+    ).rejects.toThrow('watcher checksum mismatch')
+  })
+
+  it('rejects a self-consistent target marker for a different native slot', async () => {
+    const fixture = createTemplate()
+    const targetPath = join(
+      fixture.templateDir,
+      ORCAD_TEMPLATE_TARGETS_DIR,
+      TARGET,
+      ORCAD_BUILD_TARGET_FILENAME
+    )
+    write(targetPath, 'linux-x64-musl\n')
+    const manifestPath = join(fixture.templateDir, ORCAD_TEMPLATE_MANIFEST_FILENAME)
+    const manifest = z
+      .object({
+        targets: z.record(z.string(), z.object({ targetSha256: z.string() }).passthrough())
+      })
+      .passthrough()
+      .parse(JSON.parse(readFileSync(manifestPath, 'utf8')))
+    const target = manifest.targets[TARGET]
+    if (!target) {
+      throw new Error('Missing target fixture')
+    }
+    target.targetSha256 = sha256(targetPath)
+    write(manifestPath, JSON.stringify(manifest))
+
+    await expect(
+      assembleOrcadArtifact({
+        templateDir: fixture.templateDir,
+        cacheRoot: fixture.cacheRoot,
+        target: TARGET,
+        runtimePath: fixture.runtimePath
+      })
+    ).rejects.toThrow('target identity does not match')
+  })
+
+  it('repairs corrupt artifacts beside the old entry and reuses the repair', async () => {
+    const fixture = createTemplate()
+    const first = await assembleOrcadArtifact({
+      templateDir: fixture.templateDir,
+      cacheRoot: fixture.cacheRoot,
+      target: TARGET,
+      runtimePath: fixture.runtimePath
+    })
+    write(join(first, 'orcad.js'), 'corrupted-cache-entry')
+
+    const repaired = await assembleOrcadArtifact({ ...fixture, target: TARGET })
+    expect(repaired).not.toBe(first)
+    expect(readFileSync(join(repaired, 'orcad.js'))).toEqual(
+      readFileSync(join(fixture.templateDir, 'orcad.js'))
+    )
+    expect(await assembleOrcadArtifact({ ...fixture, target: TARGET })).toBe(repaired)
+    expect(readFileSync(join(first, 'orcad.js'), 'utf8')).toBe('corrupted-cache-entry')
+  })
+
+  it('rejects an optional browser without a matching manifest checksum', async () => {
+    const fixture = createTemplate()
+    const manifestPath = join(fixture.templateDir, ORCAD_TEMPLATE_MANIFEST_FILENAME)
+    const manifest = z
+      .object({ targets: z.record(z.string(), z.record(z.string(), z.unknown())) })
+      .passthrough()
+      .parse(JSON.parse(readFileSync(manifestPath, 'utf8')))
+    delete manifest.targets[TARGET]?.browserSha256
+    write(manifestPath, JSON.stringify(manifest))
+
+    await expect(
+      assembleOrcadArtifact({
+        templateDir: fixture.templateDir,
+        cacheRoot: fixture.cacheRoot,
+        target: TARGET,
+        runtimePath: fixture.runtimePath
+      })
+    ).rejects.toThrow('browserName and browserSha256')
+  })
+
+  it('rejects a manifest that omits a required common artifact checksum', async () => {
+    const fixture = createTemplate()
+    const manifestPath = join(fixture.templateDir, ORCAD_TEMPLATE_MANIFEST_FILENAME)
+    const manifest = z
+      .object({ commonSha256: z.record(z.string(), z.string()) })
+      .passthrough()
+      .parse(JSON.parse(readFileSync(manifestPath, 'utf8')))
+    delete manifest.commonSha256['orcad.js']
+    write(manifestPath, JSON.stringify(manifest))
+
+    await expect(
+      assembleOrcadArtifact({
+        templateDir: fixture.templateDir,
+        cacheRoot: fixture.cacheRoot,
+        target: TARGET,
+        runtimePath: fixture.runtimePath
+      })
+    ).rejects.toThrow('manifest omits orcad.js')
+  })
+})
+
+describe('materializeOrcadArtifact cancellation', () => {
+  it('detaches either cancelled caller without cancelling their shared cache fill', async () => {
+    const fixture = createTemplate()
+    let complete: (path: string) => void = () => {}
+    vi.mocked(materializeCachedOrcadBunRuntime).mockReturnValue(
+      new Promise((resolve) => {
+        complete = resolve
+      })
+    )
+    const first = new AbortController()
+    const second = new AbortController()
+    const one = materializeOrcadArtifact(TARGET, { ...fixture, signal: first.signal })
+    const two = materializeOrcadArtifact(TARGET, { ...fixture, signal: second.signal })
+    const three = materializeOrcadArtifact(TARGET, fixture)
+    const firstRejected = expect(one).rejects.toThrow('first cancelled')
+    const secondRejected = expect(two).rejects.toThrow('second cancelled')
+    await vi.waitFor(() => expect(materializeCachedOrcadBunRuntime).toHaveBeenCalledOnce())
+    first.abort(new Error('first cancelled'))
+    second.abort(new Error('second cancelled'))
+    await Promise.all([firstRejected, secondRejected])
+    complete(fixture.runtimePath)
+    const artifact = await three
+    expect(readFileSync(join(artifact, 'orcad.js'), 'utf8')).toBe('orcad-entry')
+    expect(materializeCachedOrcadBunRuntime).toHaveBeenCalledWith(TARGET, fixture.cacheRoot, {
+      fetcher: undefined
+    })
+  })
+
+  it('refuses an already cancelled request before reading or fetching artifacts', async () => {
+    const controller = new AbortController()
+    controller.abort(new Error('cancelled'))
+    await expect(materializeOrcadArtifact(TARGET, { signal: controller.signal })).rejects.toThrow(
+      'cancelled'
+    )
+    expect(materializeCachedOrcadBunRuntime).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/ssh/orcad-artifact-materializer.ts b/src/main/ssh/orcad-artifact-materializer.ts
new file mode 100644
index 00000000000..2efe902b504
--- /dev/null
+++ b/src/main/ssh/orcad-artifact-materializer.ts
@@ -0,0 +1,291 @@
+import { createHash, randomUUID } from 'node:crypto'
+import { createReadStream, existsSync } from 'node:fs'
+import { chmod, copyFile, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
+import { z } from 'zod'
+import { getAppEnvironment } from '../../shared/app-environment'
+import { waitForPromiseWithSignal } from '../../shared/abort-signal-reason'
+import {
+  ORCAD_BUILD_TARGET_FILENAME,
+  orcadBunRuntimeFilename,
+  orcadArtifactHashPrefix,
+  ORCAD_TEMPLATE_MANIFEST_FILENAME,
+  ORCAD_TEMPLATE_TARGETS_DIR,
+  ORCAD_VERSION,
+  ORCAD_VERSION_FILENAME,
+  ORCAD_RIPGREP_ARTIFACTS,
+  orcadArtifactFilenames,
+  orcadTemplateCommonFilenames
+} from '../../shared/orcad-artifacts'
+import type { OrcadBunTarget } from '../../shared/orcad-bun-runtime'
+import { findOrcadCachePath } from './orcad-cache-path'
+import {
+  fileSha256,
+  materializeCachedOrcadBunRuntime,
+  verifyFileSha256,
+  type OrcadBunRuntimeMaterializeOptions
+} from './orcad-bun-runtime-materializer'
+
+const TemplateTargetSchema = z
+  .object({
+    targetSha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    watcherSha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    browserName: z
+      .string()
+      .regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u)
+      .optional(),
+    browserSha256: z
+      .string()
+      .regex(/^[a-f0-9]{64}$/u)
+      .optional()
+  })
+  .refine((target) => Boolean(target.browserName) === Boolean(target.browserSha256), {
+    message: 'browserName and browserSha256 must either both be present or both be absent'
+  })
+const TemplateManifestSchema = z.object({
+  schemaVersion: z.literal(2),
+  commonSha256: z.record(z.string(), z.string().regex(/^[a-f0-9]{64}$/u)),
+  targets: z.record(z.string(), TemplateTargetSchema)
+})
+
+type MaterializeOptions = OrcadBunRuntimeMaterializeOptions & {
+  templateDir?: string
+  cacheRoot?: string
+}
+
+const materializations = new Map<string, Promise<string>>()
+
+export async function materializeOrcadArtifact(
+  target: OrcadBunTarget,
+  options: MaterializeOptions = {}
+): Promise<string> {
+  options.signal?.throwIfAborted()
+  const templateDir = options.templateDir ?? resolveOrcadTemplateDir()
+  const cacheRoot =
+    options.cacheRoot ?? join(getAppEnvironment().getPath('userData'), 'orcad-artifacts')
+  const key = `${templateDir}\0${cacheRoot}\0${target}`
+  const existing = materializations.get(key)
+  if (existing) {
+    return waitForPromiseWithSignal(existing, options.signal)
+  }
+  // Cancellation detaches one caller; the bounded cache fill still serves other deployments.
+  const pending = materializeOrcadArtifactInner(target, templateDir, cacheRoot, {
+    fetcher: options.fetcher
+  }).finally(() => materializations.delete(key))
+  materializations.set(key, pending)
+  return waitForPromiseWithSignal(pending, options.signal)
+}
+
+async function materializeOrcadArtifactInner(
+  target: OrcadBunTarget,
+  templateDir: string,
+  cacheRoot: string,
+  options: MaterializeOptions
+): Promise<string> {
+  const manifest = await readTemplateManifest(templateDir)
+  await verifyTemplate(templateDir, target, manifest)
+  const runtimePath = await materializeCachedOrcadBunRuntime(target, cacheRoot, options)
+  return await assembleOrcadArtifact({ templateDir, cacheRoot, target, runtimePath, manifest })
+}
+
+export async function assembleOrcadArtifact(args: {
+  templateDir: string
+  cacheRoot: string
+  target: OrcadBunTarget
+  runtimePath: string
+  manifest?: z.infer<typeof TemplateManifestSchema>
+}): Promise<string> {
+  const manifest = args.manifest ?? (await readTemplateManifest(args.templateDir))
+  await verifyTemplate(args.templateDir, args.target, manifest)
+  const sources = artifactSources(args.templateDir, args.target, args.runtimePath, manifest)
+  const { fullVersion, sourceHashes } = await computeArtifactIdentity(sources, args.target)
+  const targetRoot = join(args.cacheRoot, args.target)
+  const cached = await findOrcadCachePath(
+    (attempt) => join(targetRoot, `${fullVersion}${attempt ? `.repair-${attempt}` : ''}`),
+    (path) => isCompleteArtifact(path, fullVersion, sources, sourceHashes)
+  )
+  const targetDir = cached.path
+  if (cached.verified) {
+    return targetDir
+  }
+  await mkdir(targetRoot, { recursive: true })
+  const stagingDir = join(targetRoot, `.staging-${process.pid}-${randomUUID()}`)
+  try {
+    for (const source of sources) {
+      const destination = join(stagingDir, source.filename)
+      await mkdir(dirname(destination), { recursive: true })
+      await copyFile(source.path, destination)
+      if (source.executable && !args.target.startsWith('win32-')) {
+        await chmod(destination, 0o755)
+      }
+    }
+    await writeFile(join(stagingDir, ORCAD_VERSION_FILENAME), `${fullVersion}\n`, { mode: 0o600 })
+    if (!(await isCompleteArtifact(stagingDir, fullVersion, sources, sourceHashes))) {
+      throw new Error('Orcad artifact sources changed while copying')
+    }
+    try {
+      await rename(stagingDir, targetDir)
+    } catch (error) {
+      if (!(await isCompleteArtifact(targetDir, fullVersion, sources, sourceHashes))) {
+        throw new Error(`Orcad artifact cache entry is unavailable or corrupted: ${targetDir}`, {
+          cause: error
+        })
+      }
+    }
+    return targetDir
+  } finally {
+    await rm(stagingDir, { recursive: true, force: true })
+  }
+}
+
+function artifactSources(
+  templateDir: string,
+  target: OrcadBunTarget,
+  runtimePath: string,
+  manifest: z.infer<typeof TemplateManifestSchema>
+): { filename: string; path: string; executable?: boolean }[] {
+  const targetDir = join(templateDir, ORCAD_TEMPLATE_TARGETS_DIR, target)
+  const targetManifest = manifest.targets[target]
+  if (!targetManifest) {
+    throw new Error(`Packaged orcad template does not support ${target}`)
+  }
+  const required = orcadArtifactFilenames(target).map((filename) => ({
+    filename,
+    path:
+      filename === orcadBunRuntimeFilename(target)
+        ? runtimePath
+        : filename === ORCAD_BUILD_TARGET_FILENAME
+          ? join(targetDir, ORCAD_BUILD_TARGET_FILENAME)
+          : filename.endsWith('watcher.node')
+            ? join(targetDir, 'watcher.node')
+            : join(templateDir, filename),
+    executable:
+      filename === orcadBunRuntimeFilename(target) ||
+      ORCAD_RIPGREP_ARTIFACTS.some((artifact) => artifact === filename && artifact.endsWith('/rg'))
+  }))
+  if (!targetManifest.browserName) {
+    return required
+  }
+  return [
+    ...required,
+    {
+      filename: targetManifest.browserName,
+      path: join(targetDir, targetManifest.browserName),
+      executable: true
+    }
+  ]
+}
+
+async function computeArtifactIdentity(
+  sources: { filename: string; path: string }[],
+  target: OrcadBunTarget
+): Promise<{ fullVersion: string; sourceHashes: Map<string, string> }> {
+  const hash = createHash('sha256').update(orcadArtifactHashPrefix(target))
+  const sourceHashes = new Map<string, string>()
+  for (const source of sources) {
+    const sourceHash = createHash('sha256')
+    for await (const chunk of createReadStream(source.path)) {
+      hash.update(chunk)
+      sourceHash.update(chunk)
+    }
+    sourceHashes.set(source.filename, sourceHash.digest('hex'))
+  }
+  return {
+    fullVersion: `${ORCAD_VERSION}+${hash.digest('hex').slice(0, 12)}`,
+    sourceHashes
+  }
+}
+
+async function isCompleteArtifact(
+  dir: string,
+  fullVersion: string,
+  sources: { filename: string }[],
+  sourceHashes: Map<string, string>
+): Promise<boolean> {
+  try {
+    if ((await readFile(join(dir, ORCAD_VERSION_FILENAME), 'utf8')).trim() !== fullVersion) {
+      return false
+    }
+    for (const source of sources) {
+      if ((await fileSha256(join(dir, source.filename))) !== sourceHashes.get(source.filename)) {
+        return false
+      }
+    }
+    return true
+  } catch {
+    return false
+  }
+}
+
+async function readTemplateManifest(
+  templateDir: string
+): Promise<z.infer<typeof TemplateManifestSchema>> {
+  return TemplateManifestSchema.parse(
+    JSON.parse(await readFile(join(templateDir, ORCAD_TEMPLATE_MANIFEST_FILENAME), 'utf8'))
+  )
+}
+
+async function verifyTemplate(
+  templateDir: string,
+  target: OrcadBunTarget,
+  manifest: z.infer<typeof TemplateManifestSchema>
+): Promise<void> {
+  const targetManifest = manifest.targets[target]
+  if (!targetManifest) {
+    throw new Error(`Packaged orcad template does not support ${target}`)
+  }
+  const commonFilenames = orcadTemplateCommonFilenames()
+  for (const filename of commonFilenames) {
+    const expected = manifest.commonSha256[filename]
+    if (!expected) {
+      throw new Error(`Packaged orcad template manifest omits ${filename}`)
+    }
+    await verifyFileSha256(join(templateDir, filename), expected, `orcad template ${filename}`)
+  }
+  const targetDir = join(templateDir, ORCAD_TEMPLATE_TARGETS_DIR, target)
+  const targetIdentityPath = join(targetDir, ORCAD_BUILD_TARGET_FILENAME)
+  await verifyFileSha256(targetIdentityPath, targetManifest.targetSha256, `${target} build target`)
+  if ((await readFile(targetIdentityPath, 'utf8')).trim() !== target) {
+    throw new Error(`Packaged orcad template target identity does not match ${target}`)
+  }
+  await verifyFileSha256(
+    join(targetDir, 'watcher.node'),
+    targetManifest.watcherSha256,
+    `${target} watcher`
+  )
+  if (targetManifest.browserName && targetManifest.browserSha256) {
+    await verifyFileSha256(
+      join(targetDir, targetManifest.browserName),
+      targetManifest.browserSha256,
+      `${target} browser`
+    )
+  }
+}
+
+export function getOrcadTemplateCandidates(): string[] {
+  const candidates: string[] = []
+  if (process.env.ORCA_ORCAD_TEMPLATE_PATH) {
+    candidates.push(process.env.ORCA_ORCAD_TEMPLATE_PATH)
+  }
+  if (process.resourcesPath) {
+    candidates.push(join(process.resourcesPath, 'orcad-template'))
+  }
+  const appPath = getAppEnvironment().getAppPath()
+  candidates.push(
+    join(appPath, 'out', 'orcad-template'),
+    join(appPath, 'resources', 'orcad-template')
+  )
+  return [...new Set(candidates)]
+}
+
+function resolveOrcadTemplateDir(): string {
+  const found = getOrcadTemplateCandidates().find((candidate) => existsSync(candidate))
+  if (!found) {
+    throw new Error('The packaged orcad deployment template is missing')
+  }
+  return found
+}
+
+export function resetOrcadArtifactMaterializationsForTests(): void {
+  materializations.clear()
+}
diff --git a/src/main/ssh/orcad-bun-runtime-materializer.test.ts b/src/main/ssh/orcad-bun-runtime-materializer.test.ts
new file mode 100644
index 00000000000..de9ab5d939c
--- /dev/null
+++ b/src/main/ssh/orcad-bun-runtime-materializer.test.ts
@@ -0,0 +1,299 @@
+import { createHash } from 'node:crypto'
+import { access, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { ORCAD_BUN_RUNTIME_FILENAME } from '../../shared/orcad-artifacts'
+import { ORCAD_BUN_RELEASE_ASSETS, ORCAD_BUN_VERSION } from '../../shared/orcad-bun-runtime'
+import { setMainHttpClient } from '../network/http-client'
+import { runProcess } from '../../shared/child-process/run-process'
+import { materializeCachedOrcadBunRuntime } from './orcad-bun-runtime-materializer'
+
+const extraction = vi.hoisted(() => ({ executable: new Uint8Array(), executableName: 'bun' }))
+
+vi.mock('../../shared/child-process/run-process', () => ({
+  runProcess: vi.fn(async (spec: { args: string[] }) => {
+    const extracted = join(spec.args.at(-1)!, 'bun-linux-x64')
+    await mkdir(extracted, { recursive: true })
+    await writeFile(join(extracted, extraction.executableName), extraction.executable)
+    return { code: 0, stdout: '', stderr: '' }
+  })
+}))
+
+const TARGET = 'linux-x64-glibc' as const
+const originalAsset = { ...ORCAD_BUN_RELEASE_ASSETS[TARGET] }
+let cacheRoot = ''
+
+function sha256(bytes: Uint8Array): string {
+  return createHash('sha256').update(bytes).digest('hex')
+}
+
+function responseFetcher(body: Uint8Array, declaredLength = body.byteLength): typeof fetch {
+  return vi.fn<typeof fetch>(
+    async () =>
+      new Response(Buffer.from(body), {
+        status: 200,
+        headers: { 'content-length': String(declaredLength) }
+      })
+  )
+}
+
+beforeEach(async () => {
+  extraction.executableName = 'bun'
+  cacheRoot = await mkdtemp(join(tmpdir(), 'orca-bun-runtime-materializer-'))
+  Object.assign(ORCAD_BUN_RELEASE_ASSETS[TARGET], originalAsset)
+})
+
+afterEach(async () => {
+  vi.useRealTimers()
+  vi.unstubAllEnvs()
+  setMainHttpClient(null)
+  Object.assign(ORCAD_BUN_RELEASE_ASSETS[TARGET], originalAsset)
+  await rm(cacheRoot, { recursive: true, force: true })
+})
+
+describe('materializeCachedOrcadBunRuntime', () => {
+  it('caches Windows PE files as .exe without renaming a legacy cache entry', async () => {
+    const target = 'win32-x64' as const
+    const savedAsset = { ...ORCAD_BUN_RELEASE_ASSETS[target] }
+    const archive = new TextEncoder().encode('windows archive')
+    const executable = new TextEncoder().encode('windows executable')
+    extraction.executable = executable
+    extraction.executableName = 'bun.exe'
+    Object.assign(ORCAD_BUN_RELEASE_ASSETS[target], {
+      sha256: sha256(archive),
+      executableSha256: sha256(executable)
+    })
+    const runtimeDir = join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, target)
+    await mkdir(runtimeDir, { recursive: true })
+    await writeFile(join(runtimeDir, 'bun-runtime'), 'legacy')
+    try {
+      const runtimePath = await materializeCachedOrcadBunRuntime(target, cacheRoot, {
+        fetcher: responseFetcher(archive)
+      })
+      expect(runtimePath).toBe(join(runtimeDir, 'bun-runtime.exe'))
+      expect(await readFile(runtimePath)).toEqual(Buffer.from(executable))
+      expect(await readFile(join(runtimeDir, 'bun-runtime'), 'utf8')).toBe('legacy')
+    } finally {
+      Object.assign(ORCAD_BUN_RELEASE_ASSETS[target], savedAsset)
+    }
+  })
+
+  it('reuses a checksum-valid cached runtime without fetching', async () => {
+    const runtime = new TextEncoder().encode('cached bun')
+    ORCAD_BUN_RELEASE_ASSETS[TARGET].executableSha256 = sha256(runtime)
+    const runtimeDir = join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET)
+    const runtimePath = join(runtimeDir, ORCAD_BUN_RUNTIME_FILENAME)
+    await mkdir(runtimeDir, { recursive: true })
+    await writeFile(runtimePath, runtime)
+    const fetcher = vi.fn<typeof fetch>()
+
+    await expect(materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher })).resolves.toBe(
+      runtimePath
+    )
+    expect(fetcher).not.toHaveBeenCalled()
+    expect(await readFile(runtimePath)).toEqual(Buffer.from(runtime))
+  })
+
+  it('downloads, verifies, extracts, and atomically caches the runtime', async () => {
+    const archive = new TextEncoder().encode('pinned archive')
+    const executable = new TextEncoder().encode('pinned bun executable')
+    extraction.executable = executable
+    Object.assign(ORCAD_BUN_RELEASE_ASSETS[TARGET], {
+      sha256: sha256(archive),
+      executableSha256: sha256(executable)
+    })
+    const fetcher = responseFetcher(archive)
+
+    const runtimePath = await materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher })
+
+    expect(await readFile(runtimePath)).toEqual(Buffer.from(executable))
+    if (process.platform !== 'win32') {
+      expect((await stat(runtimePath)).mode & 0o111).toBe(0o111)
+    }
+    expect(fetcher).toHaveBeenCalledWith(
+      expect.stringContaining(`/bun-v${ORCAD_BUN_VERSION}/bun-linux-x64.zip`),
+      expect.objectContaining({ redirect: 'follow' })
+    )
+    expect((await readdir(join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET))).sort()).toEqual(
+      [ORCAD_BUN_RUNTIME_FILENAME]
+    )
+  })
+
+  it('refuses an oversized declared archive before reading its body', async () => {
+    const fetcher = responseFetcher(new Uint8Array([1]), 200 * 1024 * 1024 + 1)
+
+    await expect(materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher })).rejects.toThrow(
+      'Bun download exceeded the archive size limit'
+    )
+    await expect(
+      access(join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET, ORCAD_BUN_RUNTIME_FILENAME))
+    ).rejects.toThrow()
+    expect(await readdir(join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET))).toEqual([])
+  })
+
+  it('removes temporary data after an archive checksum mismatch', async () => {
+    const archive = new TextEncoder().encode('tampered archive')
+    const fetcher = responseFetcher(archive)
+
+    await expect(materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher })).rejects.toThrow(
+      'Bun archive checksum mismatch'
+    )
+    expect(await readdir(join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET))).toEqual([])
+  })
+
+  it('refuses an executable mismatch even when the archive matches its pin', async () => {
+    const archive = new TextEncoder().encode('pinned archive')
+    extraction.executable = new TextEncoder().encode('incorrect executable')
+    ORCAD_BUN_RELEASE_ASSETS[TARGET].sha256 = sha256(archive)
+    await expect(
+      materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher: responseFetcher(archive) })
+    ).rejects.toThrow('Bun executable checksum mismatch')
+    expect(await readdir(join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET))).toEqual([])
+  })
+
+  // Both cases spawn for real, so the assertion is against the errno Node actually reports:
+  // a missing program rejects asynchronously with ENOENT, while a program path whose parent is a
+  // regular file throws ENOTDIR synchronously out of `spawn` itself.
+  it.each([
+    ['absent', (): string => join(cacheRoot, 'absent-extractor')],
+    ['unreachable through a file', (): string => join(cacheRoot, 'plain-file', 'unzip')]
+  ])('names the %s extractor and the override when it cannot be launched', async (_label, path) => {
+    const archive = new TextEncoder().encode('unextractable archive')
+    ORCAD_BUN_RELEASE_ASSETS[TARGET].sha256 = sha256(archive)
+    await writeFile(join(cacheRoot, 'plain-file'), 'not a directory')
+    const { runProcess: spawnForReal } = await vi.importActual<{
+      runProcess: typeof runProcess
+    }>('../../shared/child-process/run-process')
+    vi.mocked(runProcess).mockImplementationOnce(spawnForReal)
+    vi.stubEnv('ORCA_UNZIP_BIN', path())
+
+    await expect(
+      materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher: responseFetcher(archive) })
+    ).rejects.toThrow(/install unzip, or set ORCA_UNZIP_BIN/)
+    expect(await readdir(join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET))).toEqual([])
+  })
+
+  it('cleans an aborted download before publishing any executable', async () => {
+    const controller = new AbortController()
+    controller.abort(new Error('deployment cancelled'))
+    await expect(
+      materializeCachedOrcadBunRuntime(TARGET, cacheRoot, {
+        fetcher: responseFetcher(new Uint8Array([1])),
+        signal: controller.signal
+      })
+    ).rejects.toThrow('deployment cancelled')
+    await expect(access(join(cacheRoot, 'bun'))).rejects.toThrow()
+  })
+})
+
+it('publishes concurrent runtime downloads without removing or replacing the winning executable', async () => {
+  const archive = new TextEncoder().encode('pinned archive')
+  extraction.executable = new TextEncoder().encode('pinned runtime')
+  Object.assign(ORCAD_BUN_RELEASE_ASSETS[TARGET], {
+    sha256: sha256(archive),
+    executableSha256: sha256(extraction.executable)
+  })
+  let finishSecond: (response: Response) => void = () => {}
+  const secondFetcher = vi.fn<typeof fetch>(
+    () =>
+      new Promise<Response>((resolve) => {
+        finishSecond = resolve
+      })
+  )
+  const second = materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher: secondFetcher })
+  await vi.waitFor(() => expect(secondFetcher).toHaveBeenCalledOnce())
+  const firstPath = await materializeCachedOrcadBunRuntime(TARGET, cacheRoot, {
+    fetcher: responseFetcher(archive)
+  })
+  const firstIdentity = await stat(firstPath)
+  finishSecond(new Response(Buffer.from(archive)))
+  expect(await second).toBe(firstPath)
+  expect((await stat(firstPath)).ino).toBe(firstIdentity.ino)
+  expect(await readFile(firstPath)).toEqual(Buffer.from(extraction.executable))
+})
+
+it('repairs a corrupt published runtime beside the old inode and reuses the repair', async () => {
+  const archive = new TextEncoder().encode('pinned archive')
+  extraction.executable = new TextEncoder().encode('pinned runtime')
+  Object.assign(ORCAD_BUN_RELEASE_ASSETS[TARGET], {
+    sha256: sha256(archive),
+    executableSha256: sha256(extraction.executable)
+  })
+  const runtimeDir = join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET)
+  const runtimePath = join(runtimeDir, ORCAD_BUN_RUNTIME_FILENAME)
+  await mkdir(runtimeDir, { recursive: true })
+  await writeFile(runtimePath, 'corrupt')
+  const fetcher = responseFetcher(archive)
+  const repaired = await materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher })
+  expect(repaired).not.toBe(runtimePath)
+  expect(await readFile(repaired)).toEqual(Buffer.from(extraction.executable))
+  expect(await materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher })).toBe(repaired)
+  expect(fetcher).toHaveBeenCalledOnce()
+  expect(await readFile(runtimePath, 'utf8')).toBe('corrupt')
+})
+
+it('uses the configured HTTP client for deployment downloads', async () => {
+  const archive = new TextEncoder().encode('proxy archive')
+  extraction.executable = new TextEncoder().encode('proxy runtime')
+  Object.assign(ORCAD_BUN_RELEASE_ASSETS[TARGET], {
+    sha256: sha256(archive),
+    executableSha256: sha256(extraction.executable)
+  })
+  const fetcher = responseFetcher(archive)
+  setMainHttpClient({ fetch: fetcher, proxySession: () => null })
+  await materializeCachedOrcadBunRuntime(TARGET, cacheRoot, {})
+  expect(fetcher).toHaveBeenCalledOnce()
+})
+
+it('allows a progressing download to exceed two minutes', async () => {
+  vi.useFakeTimers()
+  const first = new TextEncoder().encode('first')
+  const second = new TextEncoder().encode('second')
+  extraction.executable = new TextEncoder().encode('slow runtime')
+  Object.assign(ORCAD_BUN_RELEASE_ASSETS[TARGET], {
+    sha256: sha256(Buffer.concat([first, second])),
+    executableSha256: sha256(extraction.executable)
+  })
+  let stream: ReadableStreamDefaultController<Uint8Array> | undefined
+  let signal: AbortSignal | null | undefined
+  const fetcher = vi.fn<typeof fetch>(async (_url, options) => {
+    signal = options?.signal
+    return new Response(
+      new ReadableStream({
+        start(controller) {
+          stream = controller
+        }
+      })
+    )
+  })
+  const pending = materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher })
+  await vi.waitFor(() => expect(fetcher).toHaveBeenCalledOnce())
+  await vi.advanceTimersByTimeAsync(90_000)
+  stream!.enqueue(first)
+  await vi.waitFor(async () => {
+    const runtimeDir = join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET)
+    const temporary = (await readdir(runtimeDir)).find((entry) => entry.startsWith('.download-'))!
+    expect(
+      (await stat(join(runtimeDir, temporary, ORCAD_BUN_RELEASE_ASSETS[TARGET].filename))).size
+    ).toBe(first.length)
+  })
+  await vi.advanceTimersByTimeAsync(90_000)
+  expect(signal?.aborted).toBe(false)
+  stream!.enqueue(second)
+  stream!.close()
+  expect(await readFile(await pending)).toEqual(Buffer.from(extraction.executable))
+})
+
+it('aborts a stalled body and removes the unfinished download', async () => {
+  vi.useFakeTimers()
+  const cancel = vi.fn()
+  const fetcher = vi.fn<typeof fetch>(async () => new Response(new ReadableStream({ cancel })))
+  const pending = materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher })
+  const rejected = expect(pending).rejects.toThrow('Bun download stalled')
+  await vi.waitFor(() => expect(fetcher).toHaveBeenCalledOnce())
+  await vi.advanceTimersByTimeAsync(120_000)
+  await rejected
+  expect(cancel).toHaveBeenCalledOnce()
+  expect(await readdir(join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET))).toEqual([])
+})
diff --git a/src/main/ssh/orcad-bun-runtime-materializer.ts b/src/main/ssh/orcad-bun-runtime-materializer.ts
new file mode 100644
index 00000000000..e52a87534eb
--- /dev/null
+++ b/src/main/ssh/orcad-bun-runtime-materializer.ts
@@ -0,0 +1,228 @@
+import { createHash, randomUUID } from 'node:crypto'
+import { createReadStream, readdirSync } from 'node:fs'
+import { chmod, link, mkdir, open, rm } from 'node:fs/promises'
+import { basename, join } from 'node:path'
+import { runProcess, type ProcessResult } from '../../shared/child-process/run-process'
+import { waitForPromiseWithSignal } from '../../shared/abort-signal-reason'
+import { isDefinitiveAbsence } from '../../shared/definitive-filesystem-absence'
+import { getZipExtractorCommand } from '../../shared/zip-extractor-command'
+import { getMainHttpClient, type MainHttpClient } from '../network/http-client'
+import { findOrcadCachePath } from './orcad-cache-path'
+import { orcadBunRuntimeFilename } from '../../shared/orcad-artifacts'
+import {
+  ORCAD_BUN_RELEASE_ASSETS,
+  ORCAD_BUN_VERSION,
+  orcadBunReleaseUrl,
+  type OrcadBunTarget
+} from '../../shared/orcad-bun-runtime'
+
+const MAX_BUN_ARCHIVE_BYTES = 200 * 1024 * 1024
+
+export type OrcadBunRuntimeMaterializeOptions = {
+  fetcher?: MainHttpClient['fetch']
+  signal?: AbortSignal
+}
+
+export async function materializeCachedOrcadBunRuntime(
+  target: OrcadBunTarget,
+  cacheRoot: string,
+  options: OrcadBunRuntimeMaterializeOptions
+): Promise<string> {
+  options.signal?.throwIfAborted()
+  const asset = ORCAD_BUN_RELEASE_ASSETS[target]
+  const runtimeDir = join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, target)
+  await mkdir(runtimeDir, { recursive: true })
+  const runtime = await findOrcadCachePath(
+    (attempt) =>
+      join(runtimeDir, `${attempt ? `repair-${attempt}-` : ''}${orcadBunRuntimeFilename(target)}`),
+    async (path) => (await fileSha256(path)) === asset.executableSha256
+  )
+  const runtimePath = runtime.path
+  if (runtime.verified) {
+    if (!target.startsWith('win32-')) {
+      await chmod(runtimePath, 0o755)
+    }
+    return runtimePath
+  }
+  const temporaryDir = join(runtimeDir, `.download-${process.pid}-${randomUUID()}`)
+  await mkdir(temporaryDir, { recursive: true })
+  try {
+    const archivePath = join(temporaryDir, basename(asset.filename))
+    await downloadVerifiedArchive(
+      orcadBunReleaseUrl(asset),
+      archivePath,
+      asset.sha256,
+      options.fetcher ?? getMainHttpClient().fetch,
+      options.signal
+    )
+    options.signal?.throwIfAborted()
+    const extractedDir = join(temporaryDir, 'extracted')
+    await mkdir(extractedDir)
+    const result = await extractArchive(archivePath, extractedDir, options.signal)
+    options.signal?.throwIfAborted()
+    if (result.code !== 0) {
+      throw new Error(`Bun archive extraction failed: ${result.stderr || result.stdout}`)
+    }
+    const executable = findExtractedBun(extractedDir, target)
+    await verifyFileSha256(executable, asset.executableSha256, `${target} Bun executable`)
+    if (!target.startsWith('win32-')) {
+      await chmod(executable, 0o755)
+    }
+    options.signal?.throwIfAborted()
+    try {
+      await link(executable, runtimePath)
+    } catch (error) {
+      if ((await fileSha256(runtimePath)) !== asset.executableSha256) {
+        throw new Error(`Bun runtime cache entry is unavailable or corrupted: ${runtimePath}`, {
+          cause: error
+        })
+      }
+    }
+    await verifyFileSha256(runtimePath, asset.executableSha256, `${target} cached Bun executable`)
+    return runtimePath
+  } finally {
+    await rm(temporaryDir, { recursive: true, force: true })
+  }
+}
+
+/**
+ * Why the extractor needs a message of its own: `unzip` is absent from a minimal POSIX install,
+ * and a bare `spawn unzip ENOENT` names neither the missing tool nor the override. A misconfigured
+ * `ORCA_UNZIP_BIN` whose parent is a file reports ENOTDIR instead, which is the same verdict.
+ *
+ * The errno is the program path's, not the caller's: `runProcess` leaves cwd unset, so the child
+ * inherits the parent's without resolving it. Measured on macOS, Linux and Windows — spawn still
+ * succeeds from a deleted cwd, even though `process.cwd()` itself throws ENOENT there.
+ */
+async function extractArchive(
+  archivePath: string,
+  extractDir: string,
+  signal?: AbortSignal
+): Promise<ProcessResult> {
+  const command = getZipExtractorCommand(archivePath, extractDir)
+  try {
+    return await runProcess({
+      program: command.file,
+      args: command.args,
+      timeoutMs: 120_000,
+      signal
+    })
+  } catch (error) {
+    if (isDefinitiveAbsence(error)) {
+      throw new Error(
+        `Bun archive extraction could not run ${command.file}: install ${command.label}, ` +
+          'or set ORCA_UNZIP_BIN to an unzip-compatible extractor.',
+        { cause: error }
+      )
+    }
+    throw error
+  }
+}
+
+async function downloadVerifiedArchive(
+  url: string,
+  destination: string,
+  expectedSha256: string,
+  fetcher: MainHttpClient['fetch'],
+  signal?: AbortSignal
+): Promise<void> {
+  const stall = new AbortController()
+  const downloadSignal = signal ? AbortSignal.any([signal, stall.signal]) : stall.signal
+  const stallTimer = setTimeout(() => stall.abort(new Error('Bun download stalled')), 120_000)
+  try {
+    const response = await fetcher(url, { redirect: 'follow', signal: downloadSignal })
+    if (!response.ok || !response.body) {
+      await response.body?.cancel().catch(() => undefined)
+      throw new Error(`Bun download failed: ${response.status} ${response.statusText}`)
+    }
+    const declaredLength = Number(response.headers.get('content-length'))
+    if (Number.isFinite(declaredLength) && declaredLength > MAX_BUN_ARCHIVE_BYTES) {
+      await response.body.cancel().catch(() => undefined)
+      throw new Error('Bun download exceeded the archive size limit')
+    }
+    const handle = await open(destination, 'wx', 0o600).catch(async (error) => {
+      await response.body?.cancel().catch(() => undefined)
+      throw error
+    })
+    const reader = response.body.getReader()
+    const hash = createHash('sha256')
+    let total = 0
+    try {
+      for (;;) {
+        downloadSignal.throwIfAborted()
+        const chunk = await waitForPromiseWithSignal(reader.read(), downloadSignal)
+        if (chunk.done) {
+          break
+        }
+        if (chunk.value.byteLength > 0) {
+          stallTimer.refresh()
+        }
+        total += chunk.value.byteLength
+        if (total > MAX_BUN_ARCHIVE_BYTES) {
+          throw new Error('Bun download exceeded the archive size limit')
+        }
+        hash.update(chunk.value)
+        await writeAll(handle, chunk.value)
+      }
+    } catch (error) {
+      await reader.cancel().catch(() => undefined)
+      throw error
+    } finally {
+      await handle.close()
+    }
+    const actual = hash.digest('hex')
+    if (actual !== expectedSha256) {
+      throw new Error(`Bun archive checksum mismatch: expected ${expectedSha256}, got ${actual}`)
+    }
+  } finally {
+    clearTimeout(stallTimer)
+  }
+}
+
+async function writeAll(
+  handle: Awaited<ReturnType<typeof open>>,
+  bytes: Uint8Array
+): Promise<void> {
+  let offset = 0
+  while (offset < bytes.byteLength) {
+    const { bytesWritten } = await handle.write(bytes, offset, bytes.byteLength - offset)
+    if (bytesWritten === 0) {
+      throw new Error('Bun archive write made no progress')
+    }
+    offset += bytesWritten
+  }
+}
+
+function findExtractedBun(root: string, target: OrcadBunTarget): string {
+  const expected = target.startsWith('win32-') ? 'bun.exe' : 'bun'
+  const entry = readdirSync(root, { recursive: true, withFileTypes: true }).find(
+    (candidate) => candidate.isFile() && candidate.name === expected
+  )
+  if (!entry) {
+    throw new Error(`Downloaded Bun archive contained no ${expected}`)
+  }
+  return join(entry.parentPath, entry.name)
+}
+
+export async function verifyFileSha256(
+  path: string,
+  expected: string,
+  label: string
+): Promise<void> {
+  const actual = await fileSha256(path)
+  if (actual !== expected) {
+    throw new Error(`${label} checksum mismatch: expected ${expected}, got ${actual ?? 'missing'}`)
+  }
+}
+
+export async function fileSha256(path: string): Promise<string | null> {
+  try {
+    const hash = createHash('sha256')
+    for await (const chunk of createReadStream(path)) {
+      hash.update(chunk)
+    }
+    return hash.digest('hex')
+  } catch {
+    return null
+  }
+}
diff --git a/src/main/ssh/orcad-cache-path.ts b/src/main/ssh/orcad-cache-path.ts
new file mode 100644
index 00000000000..2b31f634642
--- /dev/null
+++ b/src/main/ssh/orcad-cache-path.ts
@@ -0,0 +1,22 @@
+import { lstat } from 'node:fs/promises'
+
+/** Recover beside corrupt entries; a published path may still belong to another reader. */
+export async function findOrcadCachePath(
+  candidate: (attempt: number) => string,
+  isValid: (path: string) => Promise<boolean>
+): Promise<{ path: string; verified: boolean }> {
+  for (let attempt = 0; ; attempt++) {
+    const path = candidate(attempt)
+    if (await isValid(path)) {
+      return { path, verified: true }
+    }
+    try {
+      await lstat(path)
+    } catch (error) {
+      if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+        return { path, verified: false }
+      }
+      throw error
+    }
+  }
+}
diff --git a/src/main/ssh/orcad-deployment-target.test.ts b/src/main/ssh/orcad-deployment-target.test.ts
new file mode 100644
index 00000000000..db5915e659c
--- /dev/null
+++ b/src/main/ssh/orcad-deployment-target.test.ts
@@ -0,0 +1,78 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { parseOrcadLinuxLibc, resolveOrcadDeploymentTarget } from './orcad-deployment-target'
+import { SshConnection } from './ssh-connection'
+import { createCallbacks, createTarget } from './ssh-connection-test-fixtures'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+
+vi.mock('./ssh-relay-deploy-helpers', () => ({ execCommand: vi.fn() }))
+beforeEach(() => vi.mocked(execCommand).mockReset())
+
+describe('deployment C library selection', () => {
+  it.each([
+    ['glibc 2.31', 'linux-x64-glibc'],
+    ['musl', 'linux-x64-musl']
+  ])('uses host fallback evidence %j when ldd is unavailable', async (evidence, target) => {
+    vi.mocked(execCommand).mockResolvedValueOnce('ldd: not found').mockResolvedValueOnce(evidence)
+    const conn = new SshConnection(createTarget(), createCallbacks())
+    await expect(
+      resolveOrcadDeploymentTarget({ conn, host: getRemoteHostPlatform('linux-x64') })
+    ).resolves.toBe(target)
+    expect(execCommand).toHaveBeenLastCalledWith(
+      conn,
+      expect.stringContaining('getconf GNU_LIBC_VERSION'),
+      expect.anything()
+    )
+  })
+
+  it('never guesses when neither probe identifies the host library', async () => {
+    vi.mocked(execCommand).mockResolvedValue('')
+    await expect(
+      resolveOrcadDeploymentTarget({
+        conn: new SshConnection(createTarget(), createCallbacks()),
+        host: getRemoteHostPlatform('linux-x64')
+      })
+    ).rejects.toThrow('Could not identify')
+  })
+
+  it('checks connection ownership again before the fallback probe', async () => {
+    const conn = new SshConnection(createTarget(), createCallbacks())
+    const generation = conn.getConnectGeneration()
+    const firstProbe = Promise.withResolvers<string>()
+    vi.mocked(execCommand).mockReturnValueOnce(firstProbe.promise)
+    const exec = vi.fn(async (command: string) => {
+      if (conn.getConnectGeneration() !== generation) {
+        throw new Error('SSH connection changed during SQLite runtime setup.')
+      }
+      return execCommand(conn, command)
+    })
+    const pending = resolveOrcadDeploymentTarget({
+      conn,
+      host: getRemoteHostPlatform('linux-x64'),
+      exec
+    })
+    expect(execCommand).toHaveBeenCalledOnce()
+
+    await conn.disconnect()
+    firstProbe.resolve('ldd: not found')
+
+    await expect(pending).rejects.toThrow('SSH connection changed')
+    expect(exec).toHaveBeenLastCalledWith(expect.stringContaining('getconf GNU_LIBC_VERSION'))
+    expect(execCommand).toHaveBeenCalledOnce()
+  })
+
+  it.each([
+    ['ldd (Ubuntu GLIBC 2.31-0ubuntu9) 2.31', 'glibc'],
+    ['ldd (GNU libc) 2.28', 'glibc'],
+    ['musl libc (x86_64)\nVersion 1.2.5', 'musl']
+  ])('recognizes %s', (output, expected) => {
+    expect(parseOrcadLinuxLibc(output)).toBe(expected)
+  })
+
+  it.each(['', 'ldd: command not found', 'Linux x86_64'])(
+    'refuses unproven target %j',
+    (output) => {
+      expect(() => parseOrcadLinuxLibc(output)).toThrow('Could not identify')
+    }
+  )
+})
diff --git a/src/main/ssh/orcad-deployment-target.ts b/src/main/ssh/orcad-deployment-target.ts
new file mode 100644
index 00000000000..9fd98fa8cfb
--- /dev/null
+++ b/src/main/ssh/orcad-deployment-target.ts
@@ -0,0 +1,39 @@
+import type { OrcadBunTarget } from '../../shared/orcad-bun-runtime'
+import type { SshConnection } from './ssh-connection'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import type { RemoteHostPlatform } from './ssh-remote-platform'
+
+export function parseOrcadLinuxLibc(output: string): 'glibc' | 'musl' {
+  if (/\bmusl\b/i.test(output)) {
+    return 'musl'
+  }
+  if (/\b(?:glibc|GNU libc|GNU C Library)\b/i.test(output)) {
+    return 'glibc'
+  }
+  throw new Error('Could not identify the host C library for the bundled Orca runtime')
+}
+
+export async function resolveOrcadDeploymentTarget(options: {
+  conn: SshConnection
+  host: RemoteHostPlatform
+  signal?: AbortSignal
+  exec?: (command: string) => Promise<string>
+}): Promise<OrcadBunTarget> {
+  const { host } = options
+  if (host.os !== 'linux') {
+    return `${host.os}-${host.arch}`
+  }
+  const exec =
+    options.exec ??
+    ((command: string) => execCommand(options.conn, command, { signal: options.signal }))
+  let output = await exec('ldd --version 2>&1 || true')
+  try {
+    return `linux-${host.arch}-${parseOrcadLinuxLibc(output)}`
+  } catch {
+    output = await exec(
+      'getconf GNU_LIBC_VERSION 2>/dev/null || ' +
+        'for loader in /lib/ld-musl-*.so.1; do [ ! -e "$loader" ] || { echo musl; break; }; done'
+    )
+  }
+  return `linux-${host.arch}-${parseOrcadLinuxLibc(output)}`
+}
diff --git a/src/main/ssh/orcad-remote-deploy-stop.ts b/src/main/ssh/orcad-remote-deploy-stop.ts
new file mode 100644
index 00000000000..8a00a1dfa03
--- /dev/null
+++ b/src/main/ssh/orcad-remote-deploy-stop.ts
@@ -0,0 +1,68 @@
+import type { SshConnection } from './ssh-connection'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import { ORCAD_INSTALL_MODEL } from './remote-install-model'
+import { computeRemoteInstallDir } from './ssh-relay-versioned-install'
+import {
+  parseOrcadStopOutcome,
+  stopOrcadCommand,
+  type OrcadStopOutcome
+} from './orcad-remote-process-control'
+import type { RemoteHostPlatform } from './ssh-remote-platform'
+import { compareOrcadStateSnapshotCommand, orcadSnapshotIsUnchanged } from './orcad-state-snapshot'
+
+export type OrcadOutgoingStopOptions = {
+  conn: SshConnection
+  host: RemoteHostPlatform
+  remoteHome: string
+  nodePath: string
+  signal?: AbortSignal
+}
+
+/** Stop the outgoing runtime and return its execution-host verdict. */
+export async function stopOutgoingOrcad(
+  options: OrcadOutgoingStopOptions,
+  outgoingVersion: string
+): Promise<OrcadStopOutcome> {
+  const outgoingDir = computeRemoteInstallDir(
+    ORCAD_INSTALL_MODEL,
+    options.remoteHome,
+    outgoingVersion
+  )
+  const output = await execCommand(
+    options.conn,
+    stopOrcadCommand(options.host, outgoingDir, { waitSeconds: 20, nodePath: options.nodePath }),
+    {
+      wrapCommand: options.host.commandDialect !== 'powershell',
+      signal: options.signal
+    }
+  )
+  return parseOrcadStopOutcome(output)
+}
+
+/** The caller must confirm candidate exit before inspecting its shared state. */
+export async function rejectedOrcadStateRecoveryRefusal(
+  options: OrcadOutgoingStopOptions & { userDataDir: string },
+  incumbentVersion: string,
+  snapshotDir: string | undefined
+): Promise<string | undefined> {
+  const unchanged = snapshotDir
+    ? orcadSnapshotIsUnchanged(
+        await execCommand(
+          options.conn,
+          compareOrcadStateSnapshotCommand(options.host, options.userDataDir, snapshotDir),
+          { wrapCommand: options.host.commandDialect !== 'powershell', signal: options.signal }
+        ).catch(() => '')
+      )
+    : false
+  if (unchanged) {
+    return undefined
+  }
+  // RPC was already exposed; a prelaunch census cannot authorize discarding candidate writes.
+  const retainedSnapshot = snapshotDir ? ` at ${snapshotDir}.` : ', which is unavailable.'
+  return (
+    'The candidate is stopped, but profile state changed or could not be verified. ' +
+    `orcad ${incumbentVersion} was not restarted against potentially incompatible state. ` +
+    'Current state and daemon terminals are preserved; recovery requires a fresh host ' +
+    `terminal census before restoring the prelaunch snapshot${retainedSnapshot}`
+  )
+}
diff --git a/src/main/ssh/orcad-remote-deploy.test.ts b/src/main/ssh/orcad-remote-deploy.test.ts
index 1d9f87b009d..38b9fc951f9 100644
--- a/src/main/ssh/orcad-remote-deploy.test.ts
+++ b/src/main/ssh/orcad-remote-deploy.test.ts
@@ -1,4 +1,8 @@
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { runProcess } from '../../shared/child-process/run-process'
 
 vi.mock('./ssh-relay-deploy-helpers', () => ({
   execCommand: vi.fn(),
@@ -21,18 +25,23 @@ import { execCommand } from './ssh-relay-deploy-helpers'
 import { acquireInstallLock } from './ssh-relay-install-lock'
 import { uploadRelayDirectory, writeRelayFile } from './ssh-relay-install-transfers'
 import { deployOrcad, type OrcadDeployOptions } from './orcad-remote-deploy'
+import { installOrcadBundle } from './orcad-remote-install'
+import {
+  abandonInstall,
+  finalizeInstall,
+  isRemoteInstallComplete
+} from './ssh-relay-versioned-install'
 import { emptyOrcadActivationRecord, withActivatedVersion } from './orcad-activation-record'
 import { getRemoteHostPlatform } from './ssh-remote-platform'
-import { finalizeInstall } from './ssh-relay-versioned-install'
 import type { SshConnection } from './ssh-connection'
 
 const mockExec = vi.mocked(execCommand)
-const NEW_VERSION = '0.2.0+bb01'
+const NEW_VERSION = '0.2.0+bb0100000000'
 const OLD_VERSION = '0.1.0+aa01'
 
 vi.mock('./ssh-relay-versioned-install', async (importOriginal) => ({
   ...(await importOriginal<Record<string, unknown>>()),
-  readLocalFullVersion: () => '0.2.0+bb01',
+  readLocalFullVersion: () => '0.2.0+bb0100000000',
   isRemoteInstallComplete: vi.fn().mockResolvedValue(false),
   finalizeInstall: vi.fn().mockResolvedValue(undefined),
   abandonInstall: vi.fn().mockResolvedValue(undefined)
@@ -82,6 +91,11 @@ type HostScript = {
   /** Readiness content per version dir, keyed by the version in the path. */
   readiness: Record<string, string>
   log: string[]
+  preflightResult?: string
+  snapshotResult?: string
+  comparisonResult?: string
+  candidateStopResult?: string
+  readinessAtMs?: number
 }
 
 function scriptHost(script: HostScript): void {
@@ -91,20 +105,42 @@ function scriptHost(script: HostScript): void {
       return script.activationRecord
     }
     if (text.includes('.orcad-readiness') && text.startsWith('cat ')) {
+      if (script.readinessAtMs !== undefined && Date.now() < script.readinessAtMs) {
+        return ''
+      }
       const version = Object.keys(script.readiness).find((v) => text.includes(v))
       return version ? script.readiness[version] : ''
     }
+    if (text.includes('--orcad-profile-state-preflight')) {
+      script.log.push('preflight')
+      return (
+        script.preflightResult ??
+        JSON.stringify({
+          type: 'orca_profile_state_ready',
+          nonce: text.match(/[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}/)?.[0],
+          runtime: 'bun',
+          runtimeVersion: '1.4.2',
+          sqliteVersion: '3.51.0',
+          artifactVersion: NEW_VERSION,
+          revision: 1
+        })
+      )
+    }
     if (text.includes('nohup')) {
       script.log.push(`launch:${text.includes(NEW_VERSION) ? NEW_VERSION : OLD_VERSION}`)
       return '9999'
     }
     if (text.includes('kill -TERM')) {
       script.log.push(`stop:${text.includes(NEW_VERSION) ? NEW_VERSION : OLD_VERSION}`)
-      return 'STOPPED'
+      return text.includes(NEW_VERSION) ? (script.candidateStopResult ?? 'STOPPED') : 'STOPPED'
     }
     if (text.includes('tar -C') && text.includes('-cf')) {
       script.log.push('snapshot')
-      return 'CAPTURED'
+      return script.snapshotResult ?? 'CAPTURED'
+    }
+    if (text.includes('verdict=UNCHANGED')) {
+      script.log.push('compare-state')
+      return script.comparisonResult ?? 'UNCHANGED'
     }
     return ''
   })
@@ -132,7 +168,105 @@ const ACTIVE_OLD = JSON.stringify(
   withActivatedVersion(emptyOrcadActivationRecord(), OLD_VERSION, null, new Date(0))
 )
 
+describe('orcad install lock ownership', () => {
+  const remoteDir = `/home/u/.orca-remote/orcad-${NEW_VERSION}`
+  const install = (signal?: AbortSignal) =>
+    installOrcadBundle(
+      { ...options({ signal }), localOrcadDir: '/local/out/orcad' },
+      NEW_VERSION,
+      remoteDir
+    )
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.mocked(isRemoteInstallComplete).mockReset().mockResolvedValue(false)
+  })
+
+  it('leaves another install lock alone when the initial probe is complete', async () => {
+    vi.mocked(isRemoteInstallComplete).mockResolvedValueOnce(true)
+    await install()
+    expect(acquireInstallLock).not.toHaveBeenCalled()
+    expect(abandonInstall).not.toHaveBeenCalled()
+    expect(uploadRelayDirectory).not.toHaveBeenCalled()
+  })
+
+  it('releases its lock when another installer completed while acquisition waited', async () => {
+    vi.mocked(isRemoteInstallComplete).mockResolvedValueOnce(false).mockResolvedValueOnce(true)
+    await install()
+    expect(acquireInstallLock).toHaveBeenCalledOnce()
+    expect(abandonInstall).toHaveBeenCalledOnce()
+    expect(abandonInstall).toHaveBeenCalledWith(expect.anything(), remoteDir, options().host)
+    expect(uploadRelayDirectory).not.toHaveBeenCalled()
+    expect(finalizeInstall).not.toHaveBeenCalled()
+  })
+
+  it('publishes a complete install before releasing its lock once', async () => {
+    await install()
+    expect(uploadRelayDirectory).toHaveBeenCalledOnce()
+    expect(finalizeInstall).toHaveBeenCalledWith(expect.anything(), remoteDir, options().host, {
+      signal: undefined,
+      releaseLock: false
+    })
+    expect(abandonInstall).toHaveBeenCalledOnce()
+    expect(vi.mocked(finalizeInstall).mock.invocationCallOrder[0]).toBeLessThan(
+      vi.mocked(abandonInstall).mock.invocationCallOrder[0]
+    )
+  })
+
+  it('releases a failed upload without publishing it or replacing its error', async () => {
+    const error = new Error('upload interrupted')
+    vi.mocked(uploadRelayDirectory).mockRejectedValueOnce(error)
+    await expect(install()).rejects.toBe(error)
+    expect(abandonInstall).toHaveBeenCalledOnce()
+    expect(finalizeInstall).not.toHaveBeenCalled()
+  })
+
+  it('releases its lock without reusing an aborted operation signal', async () => {
+    const controller = new AbortController()
+    const error = new Error('deployment canceled')
+    vi.mocked(uploadRelayDirectory).mockImplementationOnce(async () => {
+      controller.abort(error)
+      controller.signal.throwIfAborted()
+    })
+    await expect(install(controller.signal)).rejects.toBe(error)
+    expect(abandonInstall).toHaveBeenCalledOnce()
+    expect(abandonInstall).toHaveBeenCalledWith(expect.anything(), remoteDir, options().host)
+    expect(finalizeInstall).not.toHaveBeenCalled()
+  })
+
+  it('does not release a lock when acquisition failed', async () => {
+    const error = new Error('lock held by another client')
+    vi.mocked(acquireInstallLock).mockRejectedValueOnce(error)
+    await expect(install()).rejects.toBe(error)
+    expect(abandonInstall).not.toHaveBeenCalled()
+    expect(uploadRelayDirectory).not.toHaveBeenCalled()
+  })
+})
+
 describe('deployOrcad', () => {
+  it.each(['', '{"type":"orca_profile_state_ready","revision":0}'])(
+    'leaves the incumbent and shared state alone when preflight returns %j',
+    async (preflightResult) => {
+      const script: HostScript = {
+        activationRecord: ACTIVE_OLD,
+        readiness: { [NEW_VERSION]: readyLine({}) },
+        log: [],
+        preflightResult
+      }
+      scriptHost(script)
+      expect(await deployOrcad(options())).toMatchObject({
+        outcome: 'installed-not-activated',
+        code: 'orcad_candidate_preflight_failed'
+      })
+      expect(script.log).toEqual(['preflight'])
+      expect(
+        vi
+          .mocked(writeRelayFile)
+          .mock.calls.some(([, , path]) => path.includes('orcad-active.json'))
+      ).toBe(false)
+    }
+  )
+
   beforeEach(() => {
     vi.clearAllMocks()
   })
@@ -166,6 +300,7 @@ describe('deployOrcad', () => {
       )
       expect(chmod).toBeGreaterThanOrEqual(0)
       expect(mockExec.mock.calls[chmod]?.[1]).toContain(`/ripgrep/${platform}/rg'`)
+      expect(mockExec.mock.calls[chmod]?.[1]).toContain("/bun-runtime'")
       expect(vi.mocked(uploadRelayDirectory).mock.invocationCallOrder[0]).toBeLessThan(
         mockExec.mock.invocationCallOrder[chmod]
       )
@@ -177,13 +312,17 @@ describe('deployOrcad', () => {
 
   it('does not run chmod on a Windows remote', async () => {
     scriptHost({ activationRecord: '', readiness: {}, log: [] })
-    await deployOrcad(
-      options({
+    await installOrcadBundle(
+      {
+        conn: options().conn,
         host: getRemoteHostPlatform('win32-x64'),
-        remoteHome: 'C:/Users/u',
-        census: { liveSessions: 1, startedSinceActivation: 0 }
-      })
+        localOrcadDir: '/local/out/orcad'
+      },
+      NEW_VERSION,
+      `C:/Users/u/.orca-remote/orcad-${NEW_VERSION}`
     )
+    expect(uploadRelayDirectory).toHaveBeenCalledOnce()
+    expect(finalizeInstall).toHaveBeenCalledOnce()
     expect(mockExec.mock.calls.some(([, command]) => String(command).startsWith('chmod '))).toBe(
       false
     )
@@ -200,6 +339,73 @@ describe('deployOrcad', () => {
     expect(vi.mocked(finalizeInstall)).not.toHaveBeenCalled()
   })
 
+  it.skipIf(process.platform === 'win32').each([undefined, 'linux-x64', 'linux-musl-x64'])(
+    'restores uploaded executable modes with optional browser %s',
+    async (browserTarget) => {
+      const directory = mkdtempSync(join(tmpdir(), 'orcad-install-modes-'))
+      const binaries = ['bun-runtime', 'ripgrep/linux-x64/rg']
+      if (browserTarget) {
+        binaries.push(`agent-browser-${browserTarget}`)
+      }
+      try {
+        for (const filename of binaries) {
+          const path = join(directory, filename)
+          mkdirSync(dirname(path), { recursive: true })
+          writeFileSync(path, 'uploaded executable')
+          chmodSync(path, 0o644)
+        }
+        mockExec.mockImplementation(async (_conn, command) => {
+          const result = await runProcess({ program: '/bin/sh', args: ['-c', command] })
+          if (result.code !== 0) {
+            throw new Error(result.stderr)
+          }
+          return result.stdout
+        })
+        await installOrcadBundle(
+          {
+            conn: options().conn,
+            host: getRemoteHostPlatform('linux-x64'),
+            localOrcadDir: directory
+          },
+          NEW_VERSION,
+          directory
+        )
+        expect(finalizeInstall).toHaveBeenCalledOnce()
+        for (const filename of binaries) {
+          expect(statSync(join(directory, filename)).mode & 0o777).toBe(0o755)
+        }
+      } finally {
+        mockExec.mockReset()
+        rmSync(directory, { recursive: true, force: true })
+      }
+    }
+  )
+
+  it('allows startup time after a slow bundled preflight', async () => {
+    let elapsedMs = 0
+    const clock = vi.spyOn(Date, 'now').mockImplementation(() => elapsedMs)
+    scriptHost({
+      activationRecord: '',
+      readiness: { [NEW_VERSION]: readyLine({}) },
+      readinessAtMs: 100_000,
+      log: []
+    })
+    try {
+      const result = await deployOrcad(
+        options({
+          readinessTimeoutMs: undefined,
+          sleep: async () => {
+            elapsedMs += 50_000
+          }
+        })
+      )
+      expect(result.outcome).toBe('installed-and-activated')
+      expect(elapsedMs).toBe(100_000)
+    } finally {
+      clock.mockRestore()
+    }
+  })
+
   it('activates a healthy candidate and records the outgoing version as the rollback target', async () => {
     const script: HostScript = {
       activationRecord: ACTIVE_OLD,
@@ -218,7 +424,7 @@ describe('deployOrcad', () => {
     })
   })
 
-  it('snapshots the shared data root before the candidate ever runs', async () => {
+  it('stops the incumbent before snapshotting, so SQLite WAL files are quiescent', async () => {
     const script: HostScript = {
       activationRecord: ACTIVE_OLD,
       readiness: { [NEW_VERSION]: readyLine({}) },
@@ -228,6 +434,7 @@ describe('deployOrcad', () => {
     await deployOrcad(options())
     expect(script.log.indexOf('snapshot')).toBeGreaterThan(-1)
     expect(script.log.indexOf('snapshot')).toBeLessThan(script.log.indexOf(`launch:${NEW_VERSION}`))
+    expect(script.log.indexOf(`stop:${OLD_VERSION}`)).toBeLessThan(script.log.indexOf('snapshot'))
   })
 
   it('installs but does not activate when terminals are running', async () => {
@@ -278,10 +485,12 @@ describe('deployOrcad', () => {
     const result = await deployOrcad(options())
     expect(result).toMatchObject({ outcome: 'installed-not-activated' })
     expect(script.log).toEqual([
-      'snapshot',
+      'preflight',
       `stop:${OLD_VERSION}`,
+      'snapshot',
       `launch:${NEW_VERSION}`,
       `stop:${NEW_VERSION}`,
+      'compare-state',
       `launch:${OLD_VERSION}`
     ])
     expect(result.outcome === 'installed-not-activated' && result.reason).toContain(
@@ -289,6 +498,81 @@ describe('deployOrcad', () => {
     )
   })
 
+  it.each(['CHANGED', 'UNKNOWN', ''])(
+    'preserves rejected candidate state when comparison is %s',
+    async (comparisonResult) => {
+      const script: HostScript = {
+        activationRecord: ACTIVE_OLD,
+        readiness: { [NEW_VERSION]: readyLine({ selfTestOk: false }) },
+        log: [],
+        comparisonResult
+      }
+      scriptHost(script)
+
+      const result = await deployOrcad(options())
+
+      expect(result).toMatchObject({ outcome: 'installed-not-activated' })
+      expect(script.log).toEqual([
+        'preflight',
+        `stop:${OLD_VERSION}`,
+        'snapshot',
+        `launch:${NEW_VERSION}`,
+        `stop:${NEW_VERSION}`,
+        'compare-state'
+      ])
+      expect(result.outcome === 'installed-not-activated' && result.reason).toContain(
+        'recovery requires a fresh host terminal census'
+      )
+      expect(result.outcome === 'installed-not-activated' && result.reason).toContain(
+        '/home/u/.orca-remote/orcad-state-snapshots/'
+      )
+      expect(mockExec.mock.calls.some(([, command]) => command.includes('echo RESTORED'))).toBe(
+        false
+      )
+    }
+  )
+
+  it('restarts the incumbent when a quiescent snapshot cannot be captured', async () => {
+    const script: HostScript = {
+      activationRecord: ACTIVE_OLD,
+      readiness: { [OLD_VERSION]: readyLine({}) },
+      log: [],
+      snapshotResult: 'tar: write failed'
+    }
+    scriptHost(script)
+
+    await expect(deployOrcad(options())).rejects.toThrow('incumbent was stopped')
+    expect(script.log).toEqual([
+      'preflight',
+      `stop:${OLD_VERSION}`,
+      'snapshot',
+      `launch:${OLD_VERSION}`
+    ])
+  })
+
+  it.each(['NO_PID', 'STILL_RUNNING', 'SIGNAL_FAILED', ''])(
+    'does not inspect or replace state without confirmed candidate exit: %s',
+    async (candidateStopResult) => {
+      const script: HostScript = {
+        activationRecord: ACTIVE_OLD,
+        readiness: { [NEW_VERSION]: readyLine({ selfTestOk: false }) },
+        log: [],
+        candidateStopResult
+      }
+      scriptHost(script)
+
+      await deployOrcad(options())
+
+      expect(script.log).toEqual([
+        'preflight',
+        `stop:${OLD_VERSION}`,
+        'snapshot',
+        `launch:${NEW_VERSION}`,
+        `stop:${NEW_VERSION}`
+      ])
+    }
+  )
+
   it('refuses to activate when a different build answered the port', async () => {
     const script: HostScript = {
       activationRecord: ACTIVE_OLD,
diff --git a/src/main/ssh/orcad-remote-deploy.ts b/src/main/ssh/orcad-remote-deploy.ts
index 88a4d923c84..f82b4014d57 100644
--- a/src/main/ssh/orcad-remote-deploy.ts
+++ b/src/main/ssh/orcad-remote-deploy.ts
@@ -1,30 +1,14 @@
 /**
- * Installing orcad on a host and, only if it proves itself, making it the active one.
- *
- * The install half is the relay's transaction, parameterized: the same per-version lock,
- * staged SFTP write, `.install-complete` sentinel and stale-lock recovery, under
- * `orcad-<version>/` instead of `relay-<version>/`. That is what §02 marks reusable.
- *
- * The activation half has no relay equivalent, because the relay has no notion of a version
- * being *selected*. Bytes landing in a versioned directory neither picks a version nor rolls
- * one back; the activation record does, and it is written only after the candidate publishes
- * a health payload that survives `evaluateOrcadActivation`. A rejected candidate leaves the
- * previous version running and its own bytes on disk — nothing is lost, and a retry costs no
- * upload.
+ * Activate installed bytes only after the candidate proves healthy. A rejected candidate
+ * allows restarting the incumbent only when profile state is provably unchanged; otherwise
+ * preserve current state and the prelaunch snapshot for explicit recovery.
  */
 import type { SshConnection } from './ssh-connection'
+import { ORCAD_STARTUP_READINESS_TIMEOUT_MS } from '../../shared/orcad-profile-preflight'
 import { execCommand } from './ssh-relay-deploy-helpers'
-import { shellEscape } from './ssh-connection-utils'
 import { ORCAD_INSTALL_MODEL } from './remote-install-model'
-import { acquireInstallLock } from './ssh-relay-install-lock'
-import { uploadRelayDirectory, writeRelayFile } from './ssh-relay-install-transfers'
-import {
-  abandonInstall,
-  computeRemoteInstallDir,
-  finalizeInstall,
-  isRemoteInstallComplete,
-  readLocalFullVersion
-} from './ssh-relay-versioned-install'
+import { writeRelayFile } from './ssh-relay-install-transfers'
+import { computeRemoteInstallDir, readLocalFullVersion } from './ssh-relay-versioned-install'
 import { RELAY_REMOTE_DIR } from './relay-protocol'
 import {
   ORCAD_STATE_SNAPSHOT_DIR,
@@ -40,9 +24,9 @@ import {
   ORCAD_LOG_FILENAME,
   orcadLaunchCommand,
   parseOrcadReadinessOutput,
-  readOrcadReadinessCommand,
-  type OrcadLaunchSpec
+  readOrcadReadinessCommand
 } from './orcad-remote-launch'
+import { rejectedOrcadStateRecoveryRefusal, stopOutgoingOrcad } from './orcad-remote-deploy-stop'
 import {
   captureOrcadStateSnapshotCommand,
   orcadSnapshotDirName,
@@ -55,13 +39,18 @@ import {
 } from './orcad-remote-process-control'
 import { joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
 import { computeLocalOrcadBuildHash } from './orcad-local-build-hash'
+import { preflightInstalledOrcad } from './orcad-remote-preflight'
+import { assertPosixOrcadHost } from './orcad-remote-host-support'
+import { installOrcadBundle } from './orcad-remote-install'
+import { materializeOrcadArtifact } from './orcad-artifact-materializer'
+import { resolveOrcadDeploymentTarget } from './orcad-deployment-target'
 
 export type OrcadDeployOptions = {
   conn: SshConnection
   host: RemoteHostPlatform
   remoteHome: string
-  /** Local `out/orcad`, containing the artifacts and the `.version` marker. */
-  localOrcadDir: string
+  /** An already assembled bundle; otherwise materialize the packaged template for this host. */
+  localOrcadDir?: string
   nodePath: string
   userDataDir: string
   bindHost: string
@@ -84,18 +73,13 @@ export type OrcadDeployResult =
   | { outcome: 'already-active'; fullVersion: string }
   | { outcome: 'installed-not-activated'; fullVersion: string; code: string; reason: string }
 
-const DEFAULT_READINESS_TIMEOUT_MS = 90_000
 const READINESS_POLL_MS = 500
 const STOP_WAIT_SECONDS = 20
 
-function exec(
-  options: OrcadDeployOptions,
-  command: string,
-  signal = options.signal
-): Promise<string> {
+function exec(options: OrcadDeployOptions, command: string): Promise<string> {
   return execCommand(options.conn, command, {
     wrapCommand: options.host.commandDialect !== 'powershell',
-    signal
+    signal: options.signal
   })
 }
 
@@ -103,59 +87,14 @@ function baseDir(options: OrcadDeployOptions): string {
   return joinRemotePath(options.host, options.remoteHome, RELAY_REMOTE_DIR)
 }
 
-/** Install the bytes under `orcad-<version>/`, using the relay's install transaction. */
-async function installOrcadBundle(
-  options: OrcadDeployOptions,
-  fullVersion: string,
-  remoteDir: string
-): Promise<void> {
-  if (
-    await isRemoteInstallComplete(options.conn, ORCAD_INSTALL_MODEL, remoteDir, options.host, {
-      signal: options.signal
-    })
-  ) {
-    return
-  }
-  await acquireInstallLock(options.conn, remoteDir, options.host, { signal: options.signal })
-  try {
-    // Re-probe under the lock: a sibling deploy may have finished while we waited.
-    if (
-      await isRemoteInstallComplete(options.conn, ORCAD_INSTALL_MODEL, remoteDir, options.host, {
-        signal: options.signal
-      })
-    ) {
-      return
-    }
-    await uploadRelayDirectory(options.conn, options.localOrcadDir, remoteDir, options.host, {
-      signal: options.signal
-    })
-    const { host } = options
-    if (host.os !== 'win32') {
-      // SFTP creates uploaded files with 0644 even when the source binary is executable.
-      const binaryPath = joinRemotePath(host, remoteDir, 'ripgrep', host.relayPlatform, 'rg')
-      await exec(options, `chmod 755 ${shellEscape(binaryPath)}`)
-    }
-    await writeRelayFile(
-      options.conn,
-      options.host,
-      joinRemotePath(options.host, remoteDir, ORCAD_INSTALL_MODEL.versionFilename),
-      fullVersion,
-      { signal: options.signal }
-    )
-    await finalizeInstall(options.conn, remoteDir, options.host, { signal: options.signal })
-  } catch (error) {
-    // Leave a recoverable partial rather than a dir that probes complete.
-    await abandonInstall(options.conn, remoteDir, options.host)
-    throw error
-  }
-}
-
 async function captureSnapshot(
   options: OrcadDeployOptions,
   fullVersion: string,
   outgoingVersion: string | null,
   takenAt: Date
 ): Promise<OrcadStateSnapshot | null> {
+  // The caller has already stopped the outgoing runtime. This is required once profile state
+  // includes SQLite: a tar of a live WAL, main database, and SHM file is not a SQLite backup.
   const dirName = orcadSnapshotDirName(fullVersion, takenAt.getTime())
   const snapshotDir = joinRemotePath(
     options.host,
@@ -176,9 +115,8 @@ async function captureSnapshot(
         'way back. Refusing to activate.'
     )
   }
+  // Empty profiles need no rollback snapshot.
   if (capture === 'empty') {
-    // Nothing on the host to lose: a first deployment. Rollback will correctly report that
-    // it has no snapshot, rather than restoring an archive of nothing over a populated root.
     return null
   }
   return {
@@ -191,16 +129,20 @@ async function captureSnapshot(
 
 async function launchAndAwaitReadiness(
   options: OrcadDeployOptions,
-  spec: OrcadLaunchSpec
+  remoteInstallDir: string,
+  fullVersion: string
 ): Promise<ReturnType<typeof parseOrcadReadinessOutput>> {
-  await exec(options, orcadLaunchCommand(options.host, spec))
-  const deadline = Date.now() + (options.readinessTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS)
+  await exec(
+    options,
+    orcadLaunchCommand(options.host, { ...options, remoteInstallDir, fullVersion })
+  )
+  const deadline = Date.now() + (options.readinessTimeoutMs ?? ORCAD_STARTUP_READINESS_TIMEOUT_MS)
   const sleep = options.sleep ?? ((ms: number) => new Promise((r) => setTimeout(r, ms)))
   let last = parseOrcadReadinessOutput('')
   while (Date.now() < deadline) {
     options.signal?.throwIfAborted()
     last = parseOrcadReadinessOutput(
-      await exec(options, readOrcadReadinessCommand(options.host, spec.remoteInstallDir))
+      await exec(options, readOrcadReadinessCommand(options.host, remoteInstallDir))
     )
     if (last.state !== 'pending') {
       return last
@@ -210,58 +152,61 @@ async function launchAndAwaitReadiness(
   return last
 }
 
-/**
- * Put the previous version back after a rejected candidate.
- *
- * Why this exists at all: activating means swapping which process owns the data root and the
- * port, so the incumbent has to stop before the candidate can start. A gate that rejected
- * and returned would leave the host with nothing running — a careful deploy causing the
- * outage it was being careful about. The returned sentence goes into the caller's reason so
- * the operator learns the host's actual state, not just why the candidate failed.
- */
+/** Restart the incumbent only when the candidate left shared state unchanged. */
 async function restoreIncumbent(
   options: OrcadDeployOptions,
   record: OrcadActivationRecord,
-  candidateDir: string
+  candidateDir?: string,
+  snapshot?: OrcadStateSnapshot | null
 ): Promise<string> {
-  const stopped = parseOrcadStopOutcome(
-    await exec(
-      options,
-      stopOrcadCommand(options.host, candidateDir, { waitSeconds: STOP_WAIT_SECONDS })
+  if (candidateDir) {
+    const stopped = parseOrcadStopOutcome(
+      await exec(
+        options,
+        stopOrcadCommand(options.host, candidateDir, {
+          waitSeconds: STOP_WAIT_SECONDS,
+          justLaunched: true
+        })
+      )
     )
-  )
-  if (!orcadStopFreedTheHost(stopped)) {
-    return `The candidate itself did not stop (${stopped}); the host may still be serving the rejected build.`
+    if (!orcadStopFreedTheHost(stopped)) {
+      return `The candidate itself did not stop (${stopped}); the host may still be serving the rejected build.`
+    }
   }
   if (!record.active) {
     return 'No previous version was active, so this host is now serving nothing.'
   }
+  if (candidateDir) {
+    const snapshotDir = snapshot
+      ? joinRemotePath(options.host, baseDir(options), ORCAD_STATE_SNAPSHOT_DIR, snapshot.dirName)
+      : undefined
+    const refusal = await rejectedOrcadStateRecoveryRefusal(options, record.active, snapshotDir)
+    if (refusal) {
+      return refusal
+    }
+  }
   const incumbentDir = computeRemoteInstallDir(
     ORCAD_INSTALL_MODEL,
     options.remoteHome,
     record.active
   )
-  const parsed = await launchAndAwaitReadiness(options, {
-    remoteInstallDir: incumbentDir,
-    nodePath: options.nodePath,
-    fullVersion: record.active,
-    userDataDir: options.userDataDir,
-    bindHost: options.bindHost,
-    port: options.port
-  })
+  const parsed = await launchAndAwaitReadiness(options, incumbentDir, record.active)
   return parsed.state === 'ready'
     ? `orcad ${record.active} was restarted and is serving again.`
     : `orcad ${record.active} was relaunched but has not published readiness; this host may be down.`
 }
 
-/**
- * Install, then activate only on a green cross-process health verdict.
- *
- * Every early return past the install leaves the bytes on disk and the previous version
- * serving, which is why they all report `installed-not-activated` rather than throwing: a
- * refusal to switch is a successful outcome of a deploy that was asked to be careful.
- */
-export async function deployOrcad(options: OrcadDeployOptions): Promise<OrcadDeployResult> {
+/** Activate on a healthy verdict; retain changed candidate state for explicit recovery. */
+export async function deployOrcad(input: OrcadDeployOptions): Promise<OrcadDeployResult> {
+  assertPosixOrcadHost(input.host)
+  const options = {
+    ...input,
+    localOrcadDir:
+      input.localOrcadDir ??
+      (await materializeOrcadArtifact(await resolveOrcadDeploymentTarget(input), {
+        signal: input.signal
+      }))
+  }
   const now = options.now ?? ((): Date => new Date())
   const fullVersion = readLocalFullVersion(options.localOrcadDir)
   const remoteDir = computeRemoteInstallDir(ORCAD_INSTALL_MODEL, options.remoteHome, fullVersion)
@@ -287,52 +232,67 @@ export async function deployOrcad(options: OrcadDeployOptions): Promise<OrcadDep
     }
   }
 
-  const snapshot = record.active
-    ? await captureSnapshot(options, fullVersion, record.active, now())
-    : null
+  try {
+    await preflightInstalledOrcad({
+      ...options,
+      remoteInstallDir: remoteDir,
+      fullVersion
+    })
+  } catch (error) {
+    options.signal?.throwIfAborted()
+    return {
+      outcome: 'installed-not-activated',
+      fullVersion,
+      code: 'orcad_candidate_preflight_failed',
+      reason: `Candidate profile preflight failed; the incumbent was not stopped: ${
+        error instanceof Error ? error.message : String(error)
+      }`
+    }
+  }
 
   if (record.active) {
-    const outgoingDir = computeRemoteInstallDir(
-      ORCAD_INSTALL_MODEL,
-      options.remoteHome,
-      record.active
-    )
-    const stopped = parseOrcadStopOutcome(
-      await exec(
-        options,
-        stopOrcadCommand(options.host, outgoingDir, {
-          waitSeconds: STOP_WAIT_SECONDS
-        })
-      )
-    )
+    const stopped = await stopOutgoingOrcad(options, record.active)
     if (!orcadStopFreedTheHost(stopped)) {
       return {
         outcome: 'installed-not-activated',
         fullVersion,
         code: 'orcad_outgoing_stop_incomplete',
         reason:
-          `orcad ${record.active} did not exit within ${STOP_WAIT_SECONDS}s of SIGTERM ` +
-          `(${stopped}). It is still holding the data root and the port, so the candidate ` +
-          'cannot start. Not escalating to SIGKILL: that skips the shutdown that releases ' +
-          'the instance lock, and the successor would then refuse to start.'
+          `Could not verify that orcad ${record.active} exited (${stopped}). ` +
+          'No snapshot was taken and the candidate was not started. Orca requires matching ' +
+          'runtime readiness before signaling an incumbent and confirmed exit before snapshotting.'
       }
     }
   }
 
-  const parsed = await launchAndAwaitReadiness(options, {
-    remoteInstallDir: remoteDir,
-    nodePath: options.nodePath,
-    fullVersion,
-    userDataDir: options.userDataDir,
-    bindHost: options.bindHost,
-    port: options.port
-  })
+  // A live SQLite WAL is not a backup boundary: tar can observe the main file, WAL and SHM
+  // at different points and restore a set SQLite cannot recover. Stop the incumbent first so
+  // its final durable flush has completed before capturing the pre-activation state.
+  let snapshot: OrcadStateSnapshot | null = null
+  if (record.active) {
+    try {
+      snapshot = await captureSnapshot(options, fullVersion, record.active, now())
+    } catch (error) {
+      const restored = await restoreIncumbent(options, record).catch(
+        (restartError: unknown) =>
+          `The incumbent could not be restarted: ${
+            restartError instanceof Error ? restartError.message : String(restartError)
+          }`
+      )
+      throw new Error(
+        `${error instanceof Error ? error.message : String(error)} The incumbent was stopped ` +
+          `before snapshotting; ${restored}`
+      )
+    }
+  }
+
+  const parsed = await launchAndAwaitReadiness(options, remoteDir, fullVersion)
   const verdict = evaluateOrcadActivation(parsed.state === 'ready' ? parsed.readiness : null, {
     buildHash: computeLocalOrcadBuildHash(options.localOrcadDir),
     fullVersion
   })
   if (verdict.decision === 'reject') {
-    const restored = await restoreIncumbent(options, record, remoteDir)
+    const restored = await restoreIncumbent(options, record, remoteDir, snapshot)
     return {
       outcome: 'installed-not-activated',
       fullVersion,
diff --git a/src/main/ssh/orcad-remote-gc.test.ts b/src/main/ssh/orcad-remote-gc.test.ts
index b25e3bb6b6d..9d365c631ef 100644
--- a/src/main/ssh/orcad-remote-gc.test.ts
+++ b/src/main/ssh/orcad-remote-gc.test.ts
@@ -35,7 +35,7 @@ const mockExec = vi.mocked(execCommand)
  */
 function scriptHost(options: {
   listing: string[]
-  liveness?: Record<string, 'LIVE' | 'DEAD' | 'UNKNOWN'>
+  liveness?: Record<string, 'LIVE' | 'DEAD' | 'UNKNOWN' | Error>
   removed: string[]
 }): void {
   mockExec.mockImplementation(async (_conn, command: string) => {
@@ -50,7 +50,11 @@ function scriptHost(options: {
     }
     if (command.includes('.orcad-pid')) {
       const dir = Object.keys(options.liveness ?? {}).find((name) => command.includes(name))
-      return dir ? (options.liveness?.[dir] ?? 'DEAD') : 'DEAD'
+      const result = dir ? (options.liveness?.[dir] ?? 'DEAD') : 'DEAD'
+      if (result instanceof Error) {
+        throw result
+      }
+      return result
     }
     if (command.startsWith('mv ')) {
       const match = command.match(/'([^']*)'/)
@@ -152,4 +156,49 @@ describe('orcad GC', () => {
     })
     expect(removed).toEqual(['orcad-0.0.9+dead'])
   })
+
+  it('stops before later versions when liveness probe termination is unconfirmed', async () => {
+    const removed: string[] = []
+    const error = Object.assign(new Error('Liveness probe termination is unconfirmed'), {
+      sshChannelCloseConfirmed: false
+    })
+    scriptHost({
+      listing: ['orcad-0.1.0+bb0', 'orcad-0.0.9+dead'],
+      liveness: { 'orcad-0.1.0+bb0': error },
+      removed
+    })
+
+    await expect(
+      gcOldOrcadVersions({
+        conn,
+        host,
+        remoteHome: '/home/u',
+        currentDirAbsPath: '/home/u/.orca-remote/orcad-0.3.0+cc0',
+        record: emptyOrcadActivationRecord()
+      })
+    ).rejects.toBe(error)
+
+    expect(removed).toEqual([])
+    expect(mockExec).toHaveBeenCalledTimes(4)
+    expect(mockExec.mock.calls.at(-1)?.[1]).toContain('.orcad-pid')
+  })
+
+  it('keeps a version after an ordinary probe failure and checks later versions', async () => {
+    const removed: string[] = []
+    scriptHost({
+      listing: ['orcad-0.1.0+bb0', 'orcad-0.0.9+dead'],
+      liveness: { 'orcad-0.1.0+bb0': new Error('Probe failed') },
+      removed
+    })
+
+    await gcOldOrcadVersions({
+      conn,
+      host,
+      remoteHome: '/home/u',
+      currentDirAbsPath: '/home/u/.orca-remote/orcad-0.3.0+cc0',
+      record: emptyOrcadActivationRecord()
+    })
+
+    expect(removed).toEqual(['orcad-0.0.9+dead'])
+  })
 })
diff --git a/src/main/ssh/orcad-remote-gc.ts b/src/main/ssh/orcad-remote-gc.ts
index a96b386fc1b..09997dc40d3 100644
--- a/src/main/ssh/orcad-remote-gc.ts
+++ b/src/main/ssh/orcad-remote-gc.ts
@@ -15,6 +15,7 @@
  */
 import type { SshConnection } from './ssh-connection'
 import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import { ORCAD_INSTALL_MODEL } from './remote-install-model'
 import { gcOldRemoteInstallVersions } from './ssh-relay-versioned-install'
 import { orcadGcPinnedDirNames, type OrcadActivationRecord } from './orcad-activation-record'
@@ -63,7 +64,10 @@ export async function gcOldOrcadVersions(options: OrcadGcOptions): Promise<void>
             }
           )
           return orcadLivenessBlocksGc(parseOrcadLiveness(probe))
-        } catch {
+        } catch (error) {
+          if (isUnconfirmedSshCommandTermination(error)) {
+            throw error
+          }
           // Why true: an unanswered probe is not evidence a tree is idle. Same rule the
           // relay's socket probe applies, for the same reason.
           return true
diff --git a/src/main/ssh/orcad-remote-host-support.ts b/src/main/ssh/orcad-remote-host-support.ts
index dfcb0f4b6e4..7ef8548ecdf 100644
--- a/src/main/ssh/orcad-remote-host-support.ts
+++ b/src/main/ssh/orcad-remote-host-support.ts
@@ -42,9 +42,17 @@ export const ORCAD_PID_FILENAME = '.orcad-pid'
  * A host without `ps` yields an empty state, which falls through to "alive" — the safe
  * direction for both callers.
  */
-export function posixProcessAliveShellFunction(): string {
+export function posixProcessAliveShellFunction(
+  options: { refuseUnverifiable?: boolean } = {}
+): string {
+  // Destructive lifecycle steps need explicit absence; permission failures cannot prove exit.
+  const probe = options.refuseUnverifiable
+    ? 'probe_error=$(LC_ALL=C kill -0 "$1" 2>&1) || { ' +
+      'case "$probe_error" in *"No such process"*) return 1;; ' +
+      '*) echo UNKNOWN; exit 0;; esac; }; '
+    : 'kill -0 "$1" 2>/dev/null || return 1; '
   return (
-    'orcad_alive() { kill -0 "$1" 2>/dev/null || return 1; ' +
+    `orcad_alive() { ${probe}` +
     'case "$(ps -o stat= -p "$1" 2>/dev/null)" in Z*) return 1;; esac; return 0; };'
   )
 }
diff --git a/src/main/ssh/orcad-remote-install-termination.test.ts b/src/main/ssh/orcad-remote-install-termination.test.ts
new file mode 100644
index 00000000000..fbc0dcb156c
--- /dev/null
+++ b/src/main/ssh/orcad-remote-install-termination.test.ts
@@ -0,0 +1,158 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('./ssh-relay-deploy-helpers', () => ({ execCommand: vi.fn() }))
+vi.mock('./ssh-relay-install-lock', () => ({
+  acquireInstallLock: vi.fn().mockResolvedValue(undefined),
+  RELAY_INSTALL_LOCK_NAME: '.install-lock'
+}))
+vi.mock('./ssh-relay-install-transfers', () => ({
+  uploadRelayDirectory: vi.fn(),
+  writeRelayFile: vi.fn()
+}))
+
+import type { SshConnection } from './ssh-connection'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import { uploadRelayDirectory, writeRelayFile } from './ssh-relay-install-transfers'
+import { installOrcadBundle } from './orcad-remote-install'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+import { decodeRemotePowerShellScript } from './ssh-remote-powershell'
+
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: All connection operations are mocked.
+const conn = {} as SshConnection
+const mockExec = vi.mocked(execCommand)
+const mockUpload = vi.mocked(uploadRelayDirectory)
+const mockWrite = vi.mocked(writeRelayFile)
+const fullVersion = '0.2.0+abcdef123456'
+
+function issuedCommands(): string[] {
+  return mockExec.mock.calls.map(([, command]) => decodeRemotePowerShellScript(command))
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mockExec.mockReset().mockResolvedValue('')
+  mockUpload.mockReset().mockResolvedValue(undefined)
+  mockWrite.mockReset().mockResolvedValue(undefined)
+})
+
+describe.each([
+  { platform: 'linux-x64' as const, remoteDir: '/home/u/.orca-remote/orcad-version' },
+  { platform: 'win32-x64' as const, remoteDir: 'C:/Users/u/.orca-remote/orcad-version' }
+])('orcad install termination on $platform', ({ platform, remoteDir }) => {
+  const host = getRemoteHostPlatform(platform)
+  const completionCommandNumber = host.os === 'win32' ? 3 : 4
+  const stages = [
+    { stage: 'locked recheck', commands: 2 },
+    { stage: 'upload', commands: 2 },
+    { stage: 'version write', commands: completionCommandNumber - 1 },
+    { stage: 'completion marker', commands: completionCommandNumber }
+  ]
+  const install = (signal?: AbortSignal): Promise<void> =>
+    installOrcadBundle(
+      { conn, host, localOrcadDir: '/local/orcad', signal },
+      fullVersion,
+      remoteDir
+    )
+
+  function failStage(stage: string, commandNumber: number, error: Error): void {
+    if (stage === 'upload') {
+      mockUpload.mockRejectedValueOnce(error)
+    } else if (stage === 'version write') {
+      mockWrite.mockRejectedValueOnce(error)
+    } else {
+      let calls = 0
+      mockExec.mockImplementation(async () => {
+        if (++calls === commandNumber) {
+          throw error
+        }
+        return ''
+      })
+    }
+  }
+
+  it.each(stages)('retains its lock after unconfirmed $stage', async ({ stage, commands }) => {
+    const error = Object.assign(new Error('SSH teardown not confirmed'), {
+      sshChannelCloseConfirmed: false
+    })
+    failStage(stage, commands, error)
+
+    await expect(install()).rejects.toBe(error)
+
+    expect(mockExec).toHaveBeenCalledTimes(commands)
+    expect(mockUpload).toHaveBeenCalledTimes(stage === 'locked recheck' ? 0 : 1)
+    expect(mockWrite).toHaveBeenCalledTimes(
+      stage === 'locked recheck' || stage === 'upload' ? 0 : 1
+    )
+    expect(issuedCommands().some((command) => command.includes('.install-lock'))).toBe(false)
+  })
+
+  it.each(stages)(
+    'still releases its lock after confirmed $stage failure',
+    async ({ stage, commands }) => {
+      const error = Object.assign(new Error('SSH command failed after closing'), {
+        sshChannelCloseConfirmed: true
+      })
+      failStage(stage, commands, error)
+
+      if (stage === 'locked recheck') {
+        await expect(install()).resolves.toBeUndefined()
+        expect(mockExec).toHaveBeenCalledTimes(completionCommandNumber + 1)
+      } else {
+        await expect(install()).rejects.toBe(error)
+        expect(mockExec).toHaveBeenCalledTimes(commands + 1)
+      }
+      expect(issuedCommands().at(-1)).toContain('.install-lock')
+    }
+  )
+
+  it('releases its lock once after successful completion', async () => {
+    await expect(install()).resolves.toBeUndefined()
+
+    expect(mockExec).toHaveBeenCalledTimes(completionCommandNumber + 1)
+    expect(issuedCommands()[completionCommandNumber - 1]).toContain('.install-complete')
+    expect(issuedCommands().at(-1)).toContain('.install-lock')
+    expect(mockUpload).toHaveBeenCalledOnce()
+    expect(mockWrite).toHaveBeenCalledOnce()
+  })
+
+  it('preserves an uncertain locked recheck when the caller also aborts', async () => {
+    const controller = new AbortController()
+    const error = Object.assign(new Error('SSH teardown not confirmed'), {
+      sshChannelCloseConfirmed: false
+    })
+    mockExec.mockResolvedValueOnce('').mockImplementationOnce(async () => {
+      controller.abort(new Error('deploy aborted'))
+      throw error
+    })
+
+    await expect(install(controller.signal)).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(2)
+    expect(mockUpload).not.toHaveBeenCalled()
+  })
+
+  it('propagates an uncertain final lock release without retrying it', async () => {
+    const error = Object.assign(new Error('SSH teardown not confirmed'), {
+      sshChannelCloseConfirmed: false
+    })
+    failStage('release', completionCommandNumber + 1, error)
+
+    await expect(install()).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(completionCommandNumber + 1)
+    expect(issuedCommands().at(-1)).toContain('.install-lock')
+  })
+
+  it.skipIf(host.os === 'win32')(
+    'retains its lock after unconfirmed executable permissions',
+    async () => {
+      const error = Object.assign(new Error('SSH teardown not confirmed'), {
+        sshChannelCloseConfirmed: false
+      })
+      failStage('permissions', 3, error)
+
+      await expect(install()).rejects.toBe(error)
+      expect(mockExec).toHaveBeenCalledTimes(3)
+      expect(issuedCommands().at(-1)).toContain('chmod')
+      expect(mockWrite).not.toHaveBeenCalled()
+    }
+  )
+})
diff --git a/src/main/ssh/orcad-remote-install.ts b/src/main/ssh/orcad-remote-install.ts
new file mode 100644
index 00000000000..9866f666643
--- /dev/null
+++ b/src/main/ssh/orcad-remote-install.ts
@@ -0,0 +1,94 @@
+import { orcadBunRuntimeFilename } from '../../shared/orcad-artifacts'
+import { orcadAgentBrowserNativeName } from '../../shared/orcad-agent-browser-name'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
+import { shellEscape } from './ssh-connection-utils'
+import type { SshConnection } from './ssh-connection'
+import { joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
+import { ORCAD_INSTALL_MODEL } from './remote-install-model'
+import { acquireInstallLock } from './ssh-relay-install-lock'
+import { uploadRelayDirectory, writeRelayFile } from './ssh-relay-install-transfers'
+import {
+  abandonInstall,
+  finalizeInstall,
+  isRemoteInstallComplete
+} from './ssh-relay-versioned-install'
+
+/** Install the bytes under `orcad-<version>/`, using the relay's install transaction. */
+export async function installOrcadBundle(
+  options: {
+    conn: SshConnection
+    host: RemoteHostPlatform
+    localOrcadDir: string
+    signal?: AbortSignal
+  },
+  fullVersion: string,
+  remoteDir: string
+): Promise<void> {
+  if (
+    await isRemoteInstallComplete(options.conn, ORCAD_INSTALL_MODEL, remoteDir, options.host, {
+      signal: options.signal
+    })
+  ) {
+    return
+  }
+  await acquireInstallLock(options.conn, remoteDir, options.host, { signal: options.signal })
+  let preserveInstallLock = false
+  try {
+    // Re-probe under the lock: a sibling deploy may have finished while we waited.
+    if (
+      await isRemoteInstallComplete(options.conn, ORCAD_INSTALL_MODEL, remoteDir, options.host, {
+        signal: options.signal
+      })
+    ) {
+      return
+    }
+    await uploadRelayDirectory(options.conn, options.localOrcadDir, remoteDir, options.host, {
+      signal: options.signal
+    })
+    if (options.host.os !== 'win32') {
+      await execCommand(options.conn, executablePermissionsCommand(options.host, remoteDir), {
+        wrapCommand: options.host.commandDialect !== 'powershell',
+        signal: options.signal
+      })
+    }
+    await writeRelayFile(
+      options.conn,
+      options.host,
+      joinRemotePath(options.host, remoteDir, ORCAD_INSTALL_MODEL.versionFilename),
+      fullVersion,
+      { signal: options.signal }
+    )
+    await finalizeInstall(options.conn, remoteDir, options.host, {
+      signal: options.signal,
+      releaseLock: false
+    })
+  } catch (error) {
+    preserveInstallLock = isUnconfirmedSshCommandTermination(error)
+    throw error
+  } finally {
+    if (!preserveInstallLock) {
+      await abandonInstall(options.conn, remoteDir, options.host)
+    }
+  }
+}
+
+function executablePermissionsCommand(host: RemoteHostPlatform, directory: string): string {
+  const required = [
+    joinRemotePath(host, directory, orcadBunRuntimeFilename(host.os)),
+    joinRemotePath(host, directory, 'ripgrep', host.relayPlatform, 'rg')
+  ]
+  const browsers = new Set(
+    (['glibc', 'musl'] as const).map((libc) =>
+      shellEscape(
+        joinRemotePath(host, directory, orcadAgentBrowserNativeName(host.os, host.arch, libc))
+      )
+    )
+  )
+  // SFTP drops executable modes; missing optional browser binaries remain a supported install.
+  return (
+    `chmod 755 ${required.map(shellEscape).join(' ')} && ` +
+    `for executable in ${[...browsers].join(' ')}; do ` +
+    'if [ -f "$executable" ]; then chmod 755 "$executable" || exit $?; fi; done'
+  )
+}
diff --git a/src/main/ssh/orcad-remote-launch.test.ts b/src/main/ssh/orcad-remote-launch.test.ts
index 068ae588f65..0be9ddc76c1 100644
--- a/src/main/ssh/orcad-remote-launch.test.ts
+++ b/src/main/ssh/orcad-remote-launch.test.ts
@@ -100,7 +100,10 @@ describe('liveness', () => {
 
 describe('stopping a running orcad', () => {
   it('sends SIGTERM and never SIGKILL', () => {
-    const command = stopOrcadCommand(posix, SPEC.remoteInstallDir, { waitSeconds: 20 })
+    const command = stopOrcadCommand(posix, SPEC.remoteInstallDir, {
+      waitSeconds: 20,
+      nodePath: SPEC.nodePath
+    })
     expect(command).toContain('kill -TERM')
     for (const kill of ['kill -9', 'kill -KILL', 'kill -SIGKILL', 'pkill']) {
       expect(command).not.toContain(kill)
@@ -110,9 +113,10 @@ describe('stopping a running orcad', () => {
   it.each([
     ['STOPPED', 'stopped', true],
     ['ALREADY_EXITED', 'already-exited', true],
-    ['NO_PID', 'no-pid', true],
+    ['NO_PID', 'no-pid', false],
     ['STILL_RUNNING', 'still-running', false],
     ['SIGNAL_FAILED', 'signal-failed', false],
+    ['UNKNOWN', 'unknown', false],
     ['', 'unknown', false]
   ])('parses %s and frees the host = %s', (output, expected, frees) => {
     expect(parseOrcadStopOutcome(output)).toBe(expected)
diff --git a/src/main/ssh/orcad-remote-launch.ts b/src/main/ssh/orcad-remote-launch.ts
index a76010ccbce..d6c9640ad33 100644
--- a/src/main/ssh/orcad-remote-launch.ts
+++ b/src/main/ssh/orcad-remote-launch.ts
@@ -20,6 +20,7 @@ import {
   posixProcessAliveShellFunction
 } from './orcad-remote-host-support'
 import type { ServeReadiness } from '../server/serve-readiness'
+import { selectOrcadSlotRuntimeCommand } from './orcad-remote-runtime'
 
 /** Stdout of the launched candidate: exactly one `orca_server_ready` line, then nothing. */
 export const ORCAD_READINESS_FILENAME = '.orcad-readiness'
@@ -56,13 +57,15 @@ export function orcadLaunchCommand(host: RemoteHostPlatform, spec: OrcadLaunchSp
   const entry = shellEscape(joinRemotePath(host, spec.remoteInstallDir, 'orcad.js'))
   return [
     `cd ${dir} &&`,
+    `${selectOrcadSlotRuntimeCommand(host, spec.remoteInstallDir, spec.nodePath)} &&`,
     // Why truncate: a re-launch into a dir that already holds a previous readiness line would
     // otherwise let the deploy activate on the OLD process's health payload.
     `: > ${readiness} &&`,
     'umask 077 &&',
     `ORCA_VERSION=${shellEscape(spec.fullVersion)}`,
     `ORCA_USER_DATA=${shellEscape(spec.userDataDir)}`,
-    `nohup ${shellEscape(spec.nodePath)} ${entry}`,
+    // Keep $! equal to the runtime PID rather than a waiting shell's PID.
+    `exec nohup "$orcad_runtime" ${entry}`,
     `--json --bind ${shellEscape(spec.bindHost)} --port ${String(spec.port)}`,
     `> ${readiness} 2>> ${log} < /dev/null &`,
     `echo $! > ${pidFile} && cat ${pidFile}`
diff --git a/src/main/ssh/orcad-remote-preflight.ts b/src/main/ssh/orcad-remote-preflight.ts
new file mode 100644
index 00000000000..5bba386d461
--- /dev/null
+++ b/src/main/ssh/orcad-remote-preflight.ts
@@ -0,0 +1,45 @@
+import { randomUUID } from 'node:crypto'
+import { ORCAD_BUN_VERSION } from '../../shared/orcad-bun-runtime'
+import { orcadBunRuntimeFilename } from '../../shared/orcad-artifacts'
+import {
+  ORCAD_PROFILE_PREFLIGHT_FLAG,
+  ORCAD_PROFILE_PREFLIGHT_TIMEOUT_MS,
+  parseOrcadProfilePreflight
+} from '../../shared/orcad-profile-preflight'
+import { assertPosixOrcadHost } from './orcad-remote-host-support'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import { shellEscape } from './ssh-connection-utils'
+import { joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
+import type { SshConnection } from './ssh-connection'
+
+export function orcadProfilePreflightCommand(
+  host: RemoteHostPlatform,
+  directory: string,
+  nonce: string
+): string {
+  assertPosixOrcadHost(host)
+  return [
+    'ORCA_BACKGROUND_LAUNCH=1',
+    shellEscape(joinRemotePath(host, directory, orcadBunRuntimeFilename(host.os))),
+    shellEscape(joinRemotePath(host, directory, 'orcad.js')),
+    ORCAD_PROFILE_PREFLIGHT_FLAG,
+    shellEscape(nonce)
+  ].join(' ')
+}
+
+/** Failure leaves the incumbent and its data untouched, including an unconfirmed SSH exit. */
+export async function preflightInstalledOrcad(options: {
+  conn: SshConnection
+  host: RemoteHostPlatform
+  remoteInstallDir: string
+  fullVersion: string
+  signal?: AbortSignal
+}): Promise<void> {
+  const nonce = randomUUID()
+  const output = await execCommand(
+    options.conn,
+    orcadProfilePreflightCommand(options.host, options.remoteInstallDir, nonce),
+    { signal: options.signal, timeoutMs: ORCAD_PROFILE_PREFLIGHT_TIMEOUT_MS }
+  )
+  parseOrcadProfilePreflight(output, nonce, ORCAD_BUN_VERSION, options.fullVersion)
+}
diff --git a/src/main/ssh/orcad-remote-process-control.ts b/src/main/ssh/orcad-remote-process-control.ts
index 6a9038ea3d6..33fd877ba41 100644
--- a/src/main/ssh/orcad-remote-process-control.ts
+++ b/src/main/ssh/orcad-remote-process-control.ts
@@ -1,15 +1,13 @@
 /**
  * Stopping a running orcad on the host without taking its terminals with it.
  *
- * `SIGKILL` is absent on purpose. orcad's own escalation contract (`orcad-entry.ts`) is
- * SIGTERM, then a second SIGTERM meaning "your deadline elapsed, exit now"; a kill skips the
- * teardown that releases the instance lock and disconnects — rather than shuts down — the
- * terminal daemon. The daemon is detached and would survive a kill, but a stop that leaves
- * the lock file behind makes the successor refuse to start with
- * `orcad_data_root_shared`, so the update turns into an outage for no gain.
+ * SIGTERM starts one bounded durable shutdown. If it outlasts this wait, preserve the
+ * current owner; SIGKILL would skip flushing state and releasing the instance lock.
  */
 import { shellEscape } from './ssh-connection-utils'
 import { joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
+import { ORCAD_READINESS_FILENAME } from './orcad-remote-launch'
+import { selectOrcadSlotRuntimeCommand } from './orcad-remote-runtime'
 import {
   assertPosixOrcadHost as assertPosixHost,
   ORCAD_PID_FILENAME,
@@ -19,20 +17,38 @@ import {
 /**
  * Signal the orcad recorded in a version dir and wait for it to go.
  *
- * `escalate` sends the second SIGTERM orcad reads as "exit immediately". Callers use it only
- * after the first deadline elapses, so the two signals are never in the same command.
+ * `justLaunched` is only for this client's fixed exec launcher, including pre-readiness exits.
+ * Incumbents need their own readiness PID to corroborate the launcher's PID before any signal.
  */
 export function stopOrcadCommand(
   host: RemoteHostPlatform,
   remoteInstallDir: string,
-  options: { waitSeconds: number }
+  options: { waitSeconds: number } & (
+    | { justLaunched: true }
+    | { justLaunched?: false; nodePath: string }
+  )
 ): string {
   assertPosixHost(host)
   const pidFile = shellEscape(joinRemotePath(host, remoteInstallDir, ORCAD_PID_FILENAME))
+  const readiness = shellEscape(joinRemotePath(host, remoteInstallDir, ORCAD_READINESS_FILENAME))
+  const readRuntimePid = [
+    `const r = JSON.parse(require('node:fs').readFileSync(process.argv[1], 'utf8'));`,
+    `const pid = r?.type === 'orca_server_ready' ? r.health?.pid : null;`,
+    `if (!Number.isSafeInteger(pid) || pid <= 1) process.exit(1);`,
+    `process.stdout.write(String(pid));`
+  ].join(' ')
   return [
-    posixProcessAliveShellFunction(),
+    posixProcessAliveShellFunction({ refuseUnverifiable: true }),
     `pid=$(cat ${pidFile} 2>/dev/null);`,
     'case "$pid" in "" | *[!0-9]* ) echo NO_PID; exit 0;; esac;',
+    // Older launchers recorded a waiting shell, whose exit does not prove runtime exit.
+    ...(options.justLaunched
+      ? []
+      : [
+          `runtime_pid=$(${selectOrcadSlotRuntimeCommand(host, remoteInstallDir, options.nodePath)}; ` +
+            `"$orcad_runtime" -e ${shellEscape(readRuntimePid)} ${readiness} 2>/dev/null) || { echo UNKNOWN; exit 0; };`,
+          '[ "$pid" = "$runtime_pid" ] || { echo UNKNOWN; exit 0; };'
+        ]),
     'orcad_alive "$pid" || { echo ALREADY_EXITED; exit 0; };',
     'kill -TERM "$pid" 2>/dev/null || { echo SIGNAL_FAILED; exit 0; };',
     `i=0; while [ "$i" -lt ${options.waitSeconds} ]; do`,
@@ -69,5 +85,5 @@ export function parseOrcadStopOutcome(output: string): OrcadStopOutcome {
 
 /** True when the port is free and a successor may bind. */
 export function orcadStopFreedTheHost(outcome: OrcadStopOutcome): boolean {
-  return outcome === 'stopped' || outcome === 'already-exited' || outcome === 'no-pid'
+  return outcome === 'stopped' || outcome === 'already-exited'
 }
diff --git a/src/main/ssh/orcad-remote-rollback.test.ts b/src/main/ssh/orcad-remote-rollback.test.ts
index b9c74158a6d..4d2f9150a75 100644
--- a/src/main/ssh/orcad-remote-rollback.test.ts
+++ b/src/main/ssh/orcad-remote-rollback.test.ts
@@ -68,7 +68,10 @@ function readyLine(version: string): string {
   })
 }
 
-function scriptHost(log: string[], overrides: { restore?: string } = {}): void {
+function scriptHost(
+  log: string[],
+  overrides: { restore?: string; readinessAtMs?: number } = {}
+): void {
   mockExec.mockImplementation(async (_conn, command: string) => {
     const text = String(command)
     if (text.includes('state.tar') && text.includes('test -f') && !text.includes('tar -C')) {
@@ -90,6 +93,9 @@ function scriptHost(log: string[], overrides: { restore?: string } = {}): void {
       return '9999'
     }
     if (text.startsWith('cat ') && text.includes('.orcad-readiness')) {
+      if (overrides.readinessAtMs !== undefined && Date.now() < overrides.readinessAtMs) {
+        return ''
+      }
       return readyLine(TARGET)
     }
     return ''
@@ -130,6 +136,28 @@ describe('rollbackOrcad', () => {
     expect(log).toEqual([`stop:${ACTIVE}`, 'restore', `launch:${TARGET}`])
   })
 
+  it('allows rollback startup time after a slow bundled preflight', async () => {
+    let elapsedMs = 0
+    const clock = vi.spyOn(Date, 'now').mockImplementation(() => elapsedMs)
+    const log: string[] = []
+    scriptHost(log, { readinessAtMs: 100_000 })
+    try {
+      const result = await rollbackOrcad(
+        options({
+          readinessTimeoutMs: undefined,
+          sleep: async () => {
+            elapsedMs += 50_000
+          }
+        })
+      )
+      expect(result.outcome).toBe('rolled-back')
+      expect(elapsedMs).toBe(100_000)
+      expect(log).toEqual([`stop:${ACTIVE}`, 'restore', `launch:${TARGET}`])
+    } finally {
+      clock.mockRestore()
+    }
+  })
+
   it('refuses before touching anything when terminals started after activation', async () => {
     const log: string[] = []
     scriptHost(log)
diff --git a/src/main/ssh/orcad-remote-rollback.ts b/src/main/ssh/orcad-remote-rollback.ts
index 03df9479e4a..412021c2f22 100644
--- a/src/main/ssh/orcad-remote-rollback.ts
+++ b/src/main/ssh/orcad-remote-rollback.ts
@@ -14,6 +14,7 @@
  * failure this is meant to avoid, arrived at from the other side.
  */
 import type { SshConnection } from './ssh-connection'
+import { ORCAD_STARTUP_READINESS_TIMEOUT_MS } from '../../shared/orcad-profile-preflight'
 import { execCommand } from './ssh-relay-deploy-helpers'
 import { ORCAD_INSTALL_MODEL } from './remote-install-model'
 import { computeRemoteInstallDir } from './ssh-relay-versioned-install'
@@ -71,7 +72,6 @@ export type OrcadRollbackResult =
   | { outcome: 'refused'; code: string; reason: string }
   | { outcome: 'failed'; code: string; reason: string }
 
-const DEFAULT_READINESS_TIMEOUT_MS = 90_000
 const READINESS_POLL_MS = 500
 const STOP_WAIT_SECONDS = 20
 
@@ -142,7 +142,10 @@ export async function rollbackOrcad(options: OrcadRollbackOptions): Promise<Orca
     const stopped = parseOrcadStopOutcome(
       await exec(
         options,
-        stopOrcadCommand(options.host, outgoingDir, { waitSeconds: STOP_WAIT_SECONDS })
+        stopOrcadCommand(options.host, outgoingDir, {
+          waitSeconds: STOP_WAIT_SECONDS,
+          nodePath: options.nodePath
+        })
       )
     )
     if (!orcadStopFreedTheHost(stopped)) {
@@ -150,9 +153,9 @@ export async function rollbackOrcad(options: OrcadRollbackOptions): Promise<Orca
         outcome: 'failed',
         code: 'orcad_rollback_stop_incomplete',
         reason:
-          `orcad ${options.record.active} did not exit within ${STOP_WAIT_SECONDS}s of SIGTERM ` +
-          `(${stopped}). Nothing was restored — the store is untouched and the host is still ` +
-          'serving the version you tried to leave.'
+          `Could not verify that orcad ${options.record.active} exited (${stopped}). ` +
+          'Nothing was restored. Orca requires matching runtime readiness before signaling ' +
+          'an incumbent and confirmed exit before replacing its state.'
       }
     }
   }
@@ -193,7 +196,7 @@ export async function rollbackOrcad(options: OrcadRollbackOptions): Promise<Orca
       port: options.port
     })
   )
-  const deadline = Date.now() + (options.readinessTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS)
+  const deadline = Date.now() + (options.readinessTimeoutMs ?? ORCAD_STARTUP_READINESS_TIMEOUT_MS)
   const sleep = options.sleep ?? ((ms: number) => new Promise((r) => setTimeout(r, ms)))
   let parsed = parseOrcadReadinessOutput('')
   while (Date.now() < deadline && parsed.state === 'pending') {
diff --git a/src/main/ssh/orcad-remote-runtime.test.ts b/src/main/ssh/orcad-remote-runtime.test.ts
new file mode 100644
index 00000000000..637ab61e670
--- /dev/null
+++ b/src/main/ssh/orcad-remote-runtime.test.ts
@@ -0,0 +1,67 @@
+import { mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { runProcessSync } from '../../shared/child-process/run-process'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+import { selectOrcadSlotRuntimeCommand } from './orcad-remote-runtime'
+import { stopOrcadCommand } from './orcad-remote-process-control'
+
+const directories: string[] = []
+const host = getRemoteHostPlatform('linux-x64')
+
+afterEach(() => {
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture(): string {
+  const directory = mkdtempSync(join(tmpdir(), "orca 'quoted' $slot-"))
+  directories.push(directory)
+  return directory
+}
+
+function launch(directory: string, nodePath: string) {
+  return runProcessSync({
+    program: '/bin/sh',
+    args: [
+      '-c',
+      `${selectOrcadSlotRuntimeCommand(host, directory, nodePath)}; ` +
+        '"$orcad_runtime" -e \'process.stdout.write("selected")\''
+    ]
+  })
+}
+
+describe.skipIf(process.platform === 'win32')('POSIX slot runtime selection', () => {
+  it('returns an unverifiable stop result when a bundled runtime cannot execute', () => {
+    const directory = fixture()
+    writeFileSync(join(directory, '.build-target'), 'linux-x64-glibc')
+    writeFileSync(join(directory, '.orcad-pid'), String(process.pid))
+    const result = runProcessSync({
+      program: '/bin/sh',
+      args: [
+        '-c',
+        stopOrcadCommand(host, directory, { waitSeconds: 1, nodePath: process.execPath })
+      ]
+    })
+    expect(result).toMatchObject({ code: 0, stdout: 'UNKNOWN\n' })
+  })
+
+  it('uses the bundled executable when host Node does not exist', () => {
+    const directory = fixture()
+    writeFileSync(join(directory, '.build-target'), 'linux-x64-glibc')
+    symlinkSync(process.execPath, join(directory, 'bun-runtime'))
+    expect(launch(directory, '/missing-host-node')).toMatchObject({ code: 0, stdout: 'selected' })
+  })
+
+  it('refuses an incomplete Bun slot before invoking a working host Node', () => {
+    const directory = fixture()
+    writeFileSync(join(directory, '.build-target'), 'linux-x64-glibc')
+    expect(launch(directory, process.execPath)).toMatchObject({ code: 78, stdout: '' })
+  })
+
+  it('retains the original runtime for a legacy slot', () => {
+    expect(launch(fixture(), process.execPath)).toMatchObject({ code: 0, stdout: 'selected' })
+  })
+})
diff --git a/src/main/ssh/orcad-remote-runtime.ts b/src/main/ssh/orcad-remote-runtime.ts
new file mode 100644
index 00000000000..505965620a0
--- /dev/null
+++ b/src/main/ssh/orcad-remote-runtime.ts
@@ -0,0 +1,20 @@
+import { ORCAD_BUILD_TARGET_FILENAME, orcadBunRuntimeFilename } from '../../shared/orcad-artifacts'
+import { assertPosixOrcadHost } from './orcad-remote-host-support'
+import { shellEscape } from './ssh-connection-utils'
+import { joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
+
+/** Only legacy slots may use host Node; an incomplete Bun slot must not change runtimes. */
+export function selectOrcadSlotRuntimeCommand(
+  host: RemoteHostPlatform,
+  directory: string,
+  legacyNodePath: string
+): string {
+  assertPosixOrcadHost(host)
+  const runtime = shellEscape(joinRemotePath(host, directory, orcadBunRuntimeFilename(host.os)))
+  const target = shellEscape(joinRemotePath(host, directory, ORCAD_BUILD_TARGET_FILENAME))
+  return (
+    `if [ -e ${target} ] || [ -e ${runtime} ]; then ` +
+    `[ -x ${runtime} ] || exit 78; orcad_runtime=${runtime}; ` +
+    `else orcad_runtime=${shellEscape(legacyNodePath)}; fi`
+  )
+}
diff --git a/src/main/ssh/orcad-remote-shell-commands.integration.test.ts b/src/main/ssh/orcad-remote-shell-commands.integration.test.ts
index f43f82949ee..4839fd7b2c2 100644
--- a/src/main/ssh/orcad-remote-shell-commands.integration.test.ts
+++ b/src/main/ssh/orcad-remote-shell-commands.integration.test.ts
@@ -6,20 +6,42 @@
  * never matches, a `tar` invocation that silently captures nothing. These run the strings.
  */
 import { execFileSync, spawn } from 'node:child_process'
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync
+} from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import {
+  exportProfileStateJson,
+  importProfileStateJson
+} from '../persistence/profile-state/profile-state-documents'
+import { openProfileStateDatabase } from '../persistence/profile-state/profile-state-database'
 
 import {
+  orcadLaunchCommand,
   orcadLivenessProbeCommand,
   ORCAD_PID_FILENAME,
-  parseOrcadLiveness
+  ORCAD_READINESS_FILENAME,
+  parseOrcadLiveness,
+  parseOrcadReadinessOutput
 } from './orcad-remote-launch'
-import { parseOrcadStopOutcome, stopOrcadCommand } from './orcad-remote-process-control'
+import {
+  orcadStopFreedTheHost,
+  parseOrcadStopOutcome,
+  stopOrcadCommand
+} from './orcad-remote-process-control'
 import {
   captureOrcadStateSnapshotCommand,
+  compareOrcadStateSnapshotCommand,
   newestStateMtimeCommand,
+  orcadSnapshotIsUnchanged,
   parseNewestStateMtimeSeconds,
   parseOrcadSnapshotCapture,
   parseOrcadSnapshotRestore,
@@ -33,6 +55,7 @@ let root = ''
 let dataDir = ''
 let snapshotDir = ''
 let versionDir = ''
+const launchedPids = new Set<number>()
 
 function sh(command: string): string {
   return execFileSync('/bin/sh', ['-c', command], { encoding: 'utf8' })
@@ -52,10 +75,141 @@ beforeEach(() => {
 })
 
 afterEach(() => {
+  for (const pid of launchedPids) {
+    try {
+      process.kill(pid, 'SIGKILL')
+    } catch {
+      // Successful stops have already removed their test processes.
+    }
+  }
+  launchedPids.clear()
   rmSync(root, { recursive: true, force: true })
 })
 
+async function launchTestRuntime(legacyWrapper = false): Promise<{
+  runtimePid: number
+  recordedPid: number
+  terminatedFile: string
+}> {
+  const terminatedFile = join(versionDir, 'terminated')
+  writeFileSync(
+    join(versionDir, 'orcad.js'),
+    [
+      `process.on('SIGTERM', () => {`,
+      `  require('node:fs').writeFileSync(${JSON.stringify(terminatedFile)}, 'terminated');`,
+      `  process.exit(0);`,
+      `});`,
+      `console.log(JSON.stringify({type: 'orca_server_ready', health: {pid: process.pid}}));`,
+      `setTimeout(() => process.exit(1), 10_000);`
+    ].join('\n')
+  )
+  let command = orcadLaunchCommand(host, {
+    remoteInstallDir: versionDir,
+    nodePath: process.execPath,
+    fullVersion: '0.2.0+bb01',
+    userDataDir: dataDir,
+    bindHost: '127.0.0.1',
+    port: 0
+  })
+  if (legacyWrapper) {
+    // The trailing command retains the old macOS waiting-shell behavior on every POSIX shell.
+    command = command
+      .replace('exec nohup ', 'nohup ')
+      .replace('< /dev/null &', '< /dev/null && : &')
+  }
+  execFileSync('/bin/sh', ['-c', command], { stdio: 'ignore', timeout: 5_000 })
+  const recordedPid = Number(readFileSync(join(versionDir, ORCAD_PID_FILENAME), 'utf8').trim())
+  expect(recordedPid).toBeGreaterThan(1)
+  launchedPids.add(recordedPid)
+  const readRuntimePid = (): number => {
+    const parsed = parseOrcadReadinessOutput(
+      readFileSync(join(versionDir, ORCAD_READINESS_FILENAME), 'utf8')
+    )
+    return parsed.state === 'ready' ? (parsed.readiness.health?.pid ?? 0) : 0
+  }
+  await expect.poll(readRuntimePid, { timeout: 2_000, interval: 20 }).toBeGreaterThan(1)
+  const runtimePid = readRuntimePid()
+  launchedPids.add(runtimePid)
+  return { runtimePid, recordedPid, terminatedFile }
+}
+
+function stopTestRuntime(justLaunched = false): ReturnType<typeof parseOrcadStopOutcome> {
+  return parseOrcadStopOutcome(
+    execFileSync(
+      '/bin/sh',
+      [
+        '-c',
+        stopOrcadCommand(host, versionDir, {
+          waitSeconds: 3,
+          ...(justLaunched ? { justLaunched: true as const } : { nodePath: process.execPath })
+        })
+      ],
+      { encoding: 'utf8', timeout: 5_000 }
+    )
+  )
+}
+
 describe('state snapshot commands, run for real', () => {
+  it('detects candidate SQLite migration without modifying current state or the snapshot', () => {
+    sh(captureOrcadStateSnapshotCommand(host, dataDir, snapshotDir))
+    const archive = readFileSync(join(snapshotDir, 'state.tar'))
+    const compare = (): boolean =>
+      orcadSnapshotIsUnchanged(sh(compareOrcadStateSnapshotCommand(host, dataDir, snapshotDir)))
+    expect(compare()).toBe(true)
+    writeFileSync(join(dataDir, 'daemon', 'daemon.sock.token'), 'live-daemon-after-launch')
+    expect(compare()).toBe(true)
+
+    const databasePath = join(dataDir, 'profiles', 'p1', 'profile-state.db')
+    const candidate = openProfileStateDatabase(databasePath, 'p1')
+    try {
+      importProfileStateJson(candidate.db, '{"settings":{"theme":"dark"}}')
+    } finally {
+      candidate.db.close()
+    }
+    const databaseBytes = readFileSync(databasePath)
+
+    expect(compare()).toBe(false)
+    expect(readFileSync(databasePath)).toEqual(databaseBytes)
+    expect(readFileSync(join(snapshotDir, 'state.tar'))).toEqual(archive)
+    expect(readFileSync(join(dataDir, 'daemon', 'daemon.sock.token'), 'utf8')).toBe(
+      'live-daemon-after-launch'
+    )
+  })
+
+  it('requires an intact comparison snapshot before an older build can restart', () => {
+    expect(
+      orcadSnapshotIsUnchanged(sh(compareOrcadStateSnapshotCommand(host, dataDir, snapshotDir)))
+    ).toBe(false)
+    sh(captureOrcadStateSnapshotCommand(host, dataDir, snapshotDir))
+    writeFileSync(join(snapshotDir, 'state.tar'), 'not an archive')
+    expect(
+      orcadSnapshotIsUnchanged(sh(compareOrcadStateSnapshotCommand(host, dataDir, snapshotDir)))
+    ).toBe(false)
+    expect(readFileSync(join(dataDir, 'profiles', 'p1', 'orca-data.json'), 'utf8')).toBe(
+      '{"repos":"before"}'
+    )
+  })
+
+  it('rejects symlinked profile state that a tar snapshot does not preserve', () => {
+    const external = join(root, 'external-profile')
+    mkdirSync(external)
+    writeFileSync(join(external, 'orca-data.json'), '{"before":true}')
+    const profile = join(dataDir, 'profiles', 'linked')
+    symlinkSync(external, profile)
+
+    expect(
+      parseOrcadSnapshotCapture(sh(captureOrcadStateSnapshotCommand(host, dataDir, snapshotDir)))
+    ).toBe('failed')
+
+    mkdirSync(snapshotDir, { recursive: true })
+    execFileSync('tar', ['-C', dataDir, '-cf', join(snapshotDir, 'state.tar'), 'profiles'])
+    writeFileSync(join(external, 'orca-data.json'), '{"candidate":true}')
+    expect(
+      orcadSnapshotIsUnchanged(sh(compareOrcadStateSnapshotCommand(host, dataDir, snapshotDir)))
+    ).toBe(false)
+    expect(readFileSync(join(external, 'orca-data.json'), 'utf8')).toBe('{"candidate":true}')
+  })
+
   it('captures, then restores state the newer build overwrote', () => {
     expect(
       parseOrcadSnapshotCapture(sh(captureOrcadStateSnapshotCommand(host, dataDir, snapshotDir)))
@@ -74,6 +228,49 @@ describe('state snapshot commands, run for real', () => {
     expect(() => readFileSync(join(dataDir, 'profiles', 'p1', 'new-build-only.json'))).toThrow()
   })
 
+  it('round-trips a quiescent SQLite profile database with its WAL sidecars', () => {
+    const profileDirectory = join(dataDir, 'profiles', 'p1')
+    const databasePath = join(profileDirectory, 'profile-state.db')
+    const opened = openProfileStateDatabase(databasePath, 'p1')
+    try {
+      importProfileStateJson(
+        opened.db,
+        JSON.stringify({ settings: { theme: 'dark' }, snapshotMarker: 'before' })
+      )
+      // The connection remains open, so WAL/SHM are still part of the archive boundary while
+      // the generated command reads the now-quiescent files.
+      expect(existsSync(`${databasePath}-wal`)).toBe(true)
+      expect(
+        parseOrcadSnapshotCapture(sh(captureOrcadStateSnapshotCommand(host, dataDir, snapshotDir)))
+      ).toBe('captured')
+    } finally {
+      opened.db.close()
+    }
+
+    const changed = openProfileStateDatabase(databasePath, 'p1')
+    try {
+      importProfileStateJson(
+        changed.db,
+        JSON.stringify({ settings: { theme: 'light' }, snapshotMarker: 'after' })
+      )
+    } finally {
+      changed.db.close()
+    }
+    expect(
+      parseOrcadSnapshotRestore(sh(restoreOrcadStateSnapshotCommand(host, dataDir, snapshotDir)))
+    ).toBe('restored')
+
+    const restored = openProfileStateDatabase(databasePath, 'p1')
+    try {
+      expect(JSON.parse(exportProfileStateJson(restored.db))).toEqual({
+        settings: { theme: 'dark' },
+        snapshotMarker: 'before'
+      })
+    } finally {
+      restored.db.close()
+    }
+  })
+
   it('leaves the live daemon runtime dir untouched through capture and restore', () => {
     sh(captureOrcadStateSnapshotCommand(host, dataDir, snapshotDir))
     // The daemon is running across the rollback and rewrites its token; a restore that
@@ -115,7 +312,13 @@ describe('state snapshot commands, run for real', () => {
     expect(
       parseOrcadSnapshotCapture(sh(captureOrcadStateSnapshotCommand(host, nasty, snapshotDir)))
     ).toBe('captured')
+    expect(
+      orcadSnapshotIsUnchanged(sh(compareOrcadStateSnapshotCommand(host, nasty, snapshotDir)))
+    ).toBe(true)
     writeFileSync(join(nasty, 'orca-profile-index.json'), '{"v":"changed"}')
+    expect(
+      orcadSnapshotIsUnchanged(sh(compareOrcadStateSnapshotCommand(host, nasty, snapshotDir)))
+    ).toBe(false)
     expect(
       parseOrcadSnapshotRestore(sh(restoreOrcadStateSnapshotCommand(host, nasty, snapshotDir)))
     ).toBe('restored')
@@ -124,6 +327,85 @@ describe('state snapshot commands, run for real', () => {
 })
 
 describe('liveness and stop commands, run for real', () => {
+  it('records the runtime PID and waits for that runtime to exit when stopped', async () => {
+    const { runtimePid, recordedPid, terminatedFile } = await launchTestRuntime()
+    expect(recordedPid).toBe(runtimePid)
+    expect(stopTestRuntime()).toBe('stopped')
+    expect(readFileSync(terminatedFile, 'utf8')).toBe('terminated')
+    // An unreaped zombie has exited even though kill -0 still succeeds.
+    expect(sh(`ps -o stat= -p ${runtimePid} || true`).trim()).toMatch(/^(?:Z.*)?$/)
+    expect(existsSync(join(versionDir, ORCAD_PID_FILENAME))).toBe(true)
+    expect(stopTestRuntime()).toBe('already-exited')
+  })
+
+  it('refuses a legacy wrapper PID both before and after its shell exits', async () => {
+    const { runtimePid, recordedPid, terminatedFile } = await launchTestRuntime(true)
+    expect(recordedPid).not.toBe(runtimePid)
+    const beforeWrapperExit = stopTestRuntime()
+    expect(beforeWrapperExit).toBe('unknown')
+    expect(orcadStopFreedTheHost(beforeWrapperExit)).toBe(false)
+    expect(() => process.kill(recordedPid, 0)).not.toThrow()
+    expect(() => process.kill(runtimePid, 0)).not.toThrow()
+
+    process.kill(recordedPid, 'SIGTERM')
+    await expect
+      .poll(() => sh(`ps -o stat= -p ${recordedPid} || true`).trim(), { timeout: 2_000 })
+      .toMatch(/^(?:Z.*)?$/)
+    const afterWrapperExit = stopTestRuntime()
+    expect(afterWrapperExit).toBe('unknown')
+    expect(orcadStopFreedTheHost(afterWrapperExit)).toBe(false)
+    expect(() => process.kill(runtimePid, 0)).not.toThrow()
+    expect(existsSync(terminatedFile)).toBe(false)
+  })
+
+  it.each(['missing', 'malformed', 'without-health'])(
+    'refuses an incumbent with %s readiness proof',
+    async (proof) => {
+      const { runtimePid, terminatedFile } = await launchTestRuntime()
+      const readinessFile = join(versionDir, ORCAD_READINESS_FILENAME)
+      if (proof === 'missing') {
+        rmSync(readinessFile)
+      } else {
+        writeFileSync(readinessFile, proof === 'malformed' ? '{' : '{"type":"orca_server_ready"}')
+      }
+      expect(stopTestRuntime()).toBe('unknown')
+      expect(() => process.kill(runtimePid, 0)).not.toThrow()
+      expect(existsSync(terminatedFile)).toBe(false)
+    }
+  )
+
+  it('can stop a candidate just launched with exec without readiness', async () => {
+    const { runtimePid, recordedPid, terminatedFile } = await launchTestRuntime()
+    expect(recordedPid).toBe(runtimePid)
+    rmSync(join(versionDir, ORCAD_READINESS_FILENAME))
+    expect(stopTestRuntime(true)).toBe('stopped')
+    expect(readFileSync(terminatedFile, 'utf8')).toBe('terminated')
+    expect(sh(`ps -o stat= -p ${runtimePid} || true`).trim()).toMatch(/^(?:Z.*)?$/)
+  })
+
+  it.each(['before', 'after'])('refuses a permission-denied probe %s SIGTERM', async (phase) => {
+    const { runtimePid, terminatedFile } = await launchTestRuntime()
+    const deniedProbe = [
+      'term_sent=0; kill() {',
+      'if [ "$1" = -TERM ]; then term_sent=1; return 0; fi;',
+      `if [ '${phase}' = before ] || [ "$term_sent" = 1 ]; then`,
+      'echo "kill: Operation not permitted" >&2; return 1; fi;',
+      'command kill "$@"; };'
+    ].join(' ')
+    const outcome = parseOrcadStopOutcome(
+      sh(
+        `${deniedProbe} ${stopOrcadCommand(host, versionDir, {
+          waitSeconds: 1,
+          nodePath: process.execPath
+        })}`
+      )
+    )
+    expect(outcome).toBe('unknown')
+    expect(orcadStopFreedTheHost(outcome)).toBe(false)
+    expect(() => process.kill(runtimePid, 0)).not.toThrow()
+    expect(existsSync(terminatedFile)).toBe(false)
+  })
+
   it('reports UNKNOWN with no pid file, and DEAD for a pid that has exited', () => {
     expect(parseOrcadLiveness(sh(orcadLivenessProbeCommand(host, versionDir)))).toBe('UNKNOWN')
     writeFileSync(join(versionDir, ORCAD_PID_FILENAME), 'not-a-pid')
@@ -144,7 +426,9 @@ describe('liveness and stop commands, run for real', () => {
         child.once('exit', (_code, signal) => resolve(signal))
       )
       expect(
-        parseOrcadStopOutcome(sh(stopOrcadCommand(host, versionDir, { waitSeconds: 10 })))
+        parseOrcadStopOutcome(
+          sh(stopOrcadCommand(host, versionDir, { waitSeconds: 10, justLaunched: true }))
+        )
       ).toBe('stopped')
       expect(await exited).toBe('SIGTERM')
       expect(parseOrcadLiveness(sh(orcadLivenessProbeCommand(host, versionDir)))).toBe('DEAD')
@@ -166,7 +450,9 @@ describe('liveness and stop commands, run for real', () => {
       expect(sh(`kill -0 ${child.pid} 2>/dev/null && echo LIVE || echo DEAD`).trim()).toBe('LIVE')
       expect(parseOrcadLiveness(sh(orcadLivenessProbeCommand(host, versionDir)))).toBe('DEAD')
       expect(
-        parseOrcadStopOutcome(sh(stopOrcadCommand(host, versionDir, { waitSeconds: 1 })))
+        parseOrcadStopOutcome(
+          sh(stopOrcadCommand(host, versionDir, { waitSeconds: 1, justLaunched: true }))
+        )
       ).toBe('already-exited')
     } finally {
       child.unref()
@@ -176,14 +462,18 @@ describe('liveness and stop commands, run for real', () => {
   it('reports ALREADY_EXITED for a stale pid file rather than signalling a stranger', () => {
     const exited = Number(sh('sh -c "echo $$"').trim())
     writeFileSync(join(versionDir, ORCAD_PID_FILENAME), String(exited))
-    expect(parseOrcadStopOutcome(sh(stopOrcadCommand(host, versionDir, { waitSeconds: 1 })))).toBe(
-      'already-exited'
-    )
+    expect(
+      parseOrcadStopOutcome(
+        sh(stopOrcadCommand(host, versionDir, { waitSeconds: 1, justLaunched: true }))
+      )
+    ).toBe('already-exited')
   })
 
   it('reports NO_PID when the version dir was never launched', () => {
-    expect(parseOrcadStopOutcome(sh(stopOrcadCommand(host, versionDir, { waitSeconds: 1 })))).toBe(
-      'no-pid'
-    )
+    expect(
+      parseOrcadStopOutcome(
+        sh(stopOrcadCommand(host, versionDir, { waitSeconds: 1, nodePath: process.execPath }))
+      )
+    ).toBe('no-pid')
   })
 })
diff --git a/src/main/ssh/orcad-state-snapshot.test.ts b/src/main/ssh/orcad-state-snapshot.test.ts
index 0c50dc55fdb..f660e95e5a4 100644
--- a/src/main/ssh/orcad-state-snapshot.test.ts
+++ b/src/main/ssh/orcad-state-snapshot.test.ts
@@ -4,6 +4,7 @@ import {
   ORCAD_SNAPSHOT_EXCLUDED,
   ORCAD_SNAPSHOT_MEMBERS,
   captureOrcadStateSnapshotCommand,
+  compareOrcadStateSnapshotCommand,
   newestStateMtimeCommand,
   orcadSnapshotDirName,
   parseNewestStateMtimeSeconds,
@@ -93,6 +94,7 @@ describe('Windows hosts', () => {
   it.each([
     ['capture', () => captureOrcadStateSnapshotCommand(windows, ROOT, SNAP)],
     ['restore', () => restoreOrcadStateSnapshotCommand(windows, ROOT, SNAP)],
+    ['compare', () => compareOrcadStateSnapshotCommand(windows, ROOT, SNAP)],
     ['mtime', () => newestStateMtimeCommand(windows, ROOT)]
   ])('refuses %s rather than emitting a POSIX command', (_label, build) => {
     expect(build).toThrow('orcad to a Windows host is not implemented')
diff --git a/src/main/ssh/orcad-state-snapshot.ts b/src/main/ssh/orcad-state-snapshot.ts
index 78ad8b47d2a..7d062275442 100644
--- a/src/main/ssh/orcad-state-snapshot.ts
+++ b/src/main/ssh/orcad-state-snapshot.ts
@@ -27,7 +27,9 @@ export const ORCAD_SNAPSHOT_MEMBERS = [
   'orca-profile-index.json',
   // Pre-profiles layout; still read as a migration source.
   'orca-data.json',
-  'profiles'
+  'profiles',
+  // Cross-profile SQLite moves must survive an orcad rollback too.
+  'profile-move-intents'
 ] as const
 
 /** Never captured and never restored — see the module comment. */
@@ -45,6 +47,10 @@ function assertPlainMemberName(member: string): string {
   return member
 }
 
+function noSymlinkedStateCommand(path: string): string {
+  return `links=$(find ${path} -type l -print) && [ -z "$links" ]`
+}
+
 export function orcadSnapshotDirName(fullVersion: string, takenAtMs: number): string {
   // Why the version and the timestamp: two activations of one version (a re-deploy after a
   // rejected activation) must not overwrite each other's snapshot.
@@ -72,8 +78,14 @@ export function captureOrcadStateSnapshotCommand(
     // Why the accumulated name is NOT quoted: `$members` is re-split by the shell before it
     // reaches tar, so a quoted name arrives as a literal `'profiles'` that tar cannot stat.
     // `assertPlainMemberName` is what makes leaving them bare safe.
-    (member) =>
-      `[ -e ${root}/${shellEscape(member)} ] && members="$members ${assertPlainMemberName(member)}";`
+    (member) => {
+      const path = `${root}/${shellEscape(member)}`
+      return (
+        `if [ -e ${path} ] || [ -L ${path} ]; then ` +
+        `${noSymlinkedStateCommand(path)} || { echo FAILED; exit 0; }; ` +
+        `members="$members ${assertPlainMemberName(member)}"; fi;`
+      )
+    }
   ).join(' ')
   return [
     `members=;`,
@@ -145,6 +157,42 @@ export function parseOrcadSnapshotRestore(output: string): OrcadSnapshotRestore
   return value === 'MISSING' ? 'missing' : 'failed'
 }
 
+/** Compare after stopping the candidate; a changed root cannot be handed to an older build. */
+export function compareOrcadStateSnapshotCommand(
+  host: RemoteHostPlatform,
+  userDataDir: string,
+  snapshotDir: string
+): string {
+  assertPosixHost(host)
+  const root = shellEscape(userDataDir)
+  const dir = shellEscape(snapshotDir)
+  const archive = shellEscape(joinRemotePath(host, snapshotDir, 'state.tar'))
+  const comparisons = ORCAD_SNAPSHOT_MEMBERS.map((member) => {
+    const name = shellEscape(member)
+    return [
+      `if [ -e ${root}/${name} ] || [ -L ${root}/${name} ]; then`,
+      `${noSymlinkedStateCommand(`${root}/${name}`)} || { echo UNKNOWN; exit 0; };`,
+      `diff -r ${root}/${name} "$comparison"/${name} >/dev/null 2>&1 || verdict=CHANGED;`,
+      `elif [ -e "$comparison"/${name} ] || [ -L "$comparison"/${name} ]; then verdict=CHANGED; fi;`
+    ].join(' ')
+  }).join(' ')
+  return [
+    `test -d ${root} && test -r ${root} && test -x ${root} || { echo UNKNOWN; exit 0; };`,
+    `test -f ${archive} || { echo UNKNOWN; exit 0; };`,
+    `comparison=$(mktemp -d ${dir}/compare.XXXXXX) || { echo UNKNOWN; exit 0; };`,
+    `trap 'rm -rf "$comparison"' EXIT HUP INT TERM;`,
+    `tar -C "$comparison" -xf ${archive} || { echo UNKNOWN; exit 0; };`,
+    `${noSymlinkedStateCommand('"$comparison"')} || { echo UNKNOWN; exit 0; };`,
+    'verdict=UNCHANGED;',
+    comparisons,
+    'echo "$verdict"'
+  ].join(' ')
+}
+
+export function orcadSnapshotIsUnchanged(output: string): boolean {
+  return output.trim().split('\n').pop()?.trim() === 'UNCHANGED'
+}
+
 /**
  * Has the shared store been written since `activatedAt`?
  *
diff --git a/src/main/ssh/relay-bundle-paths.ts b/src/main/ssh/relay-bundle-paths.ts
new file mode 100644
index 00000000000..d20dccb4cdb
--- /dev/null
+++ b/src/main/ssh/relay-bundle-paths.ts
@@ -0,0 +1,18 @@
+import { join } from 'node:path'
+import type { RelayPlatform } from './relay-protocol'
+
+export function relayBundleCandidates(platform: RelayPlatform, appPath: string): string[] {
+  return [
+    ...new Set([
+      ...(process.env.ORCA_RELAY_PATH ? [join(process.env.ORCA_RELAY_PATH, platform)] : []),
+      ...(process.resourcesPath
+        ? [
+            join(process.resourcesPath, 'relay', platform),
+            join(process.resourcesPath, 'app.asar.unpacked', 'out', 'relay', platform)
+          ]
+        : []),
+      join(appPath, 'resources', 'relay', platform),
+      join(appPath, 'out', 'relay', platform)
+    ])
+  ]
+}
diff --git a/src/main/ssh/relay-protocol-backpressure.test.ts b/src/main/ssh/relay-protocol-backpressure.test.ts
deleted file mode 100644
index 45a869af16e..00000000000
--- a/src/main/ssh/relay-protocol-backpressure.test.ts
+++ /dev/null
@@ -1,297 +0,0 @@
-import { describe, expect, it, vi } from 'vitest'
-import {
-  FrameDecoder,
-  FrameDecoderContinuationError,
-  FRAME_DECODER_MAX_RETAINED_BYTES,
-  HEADER_LENGTH,
-  MAX_MESSAGE_SIZE,
-  MessageType,
-  encodeFrame,
-  type DecodedFrame
-} from './relay-protocol'
-
-function createScheduler(): {
-  schedule: (callback: () => void) => number
-  cancel: (handle: unknown) => void
-  runNext: () => void
-  pending: () => number
-} {
-  let nextHandle = 1
-  const callbacks = new Map<number, () => void>()
-  return {
-    schedule: (callback) => {
-      const handle = nextHandle++
-      callbacks.set(handle, callback)
-      return handle
-    },
-    cancel: (handle) => callbacks.delete(handle as number),
-    runNext: () => {
-      const entry = callbacks.entries().next().value as [number, () => void] | undefined
-      if (!entry) {
-        throw new Error('No decoder continuation scheduled')
-      }
-      callbacks.delete(entry[0])
-      entry[1]()
-    },
-    pending: () => callbacks.size
-  }
-}
-
-function frame(id: number, payload = `${id}`): Buffer {
-  return encodeFrame(MessageType.Regular, id, 0, Buffer.from(payload))
-}
-
-describe('FrameDecoder bounded turns', () => {
-  it('retains at most one maximum frame plus one MiB of partial input', () => {
-    expect(FRAME_DECODER_MAX_RETAINED_BYTES).toBe(MAX_MESSAGE_SIZE + HEADER_LENGTH + 1024 * 1024)
-    const maximumFrame = encodeFrame(MessageType.Regular, 1, 0, Buffer.alloc(MAX_MESSAGE_SIZE))
-    const acceptedError = vi.fn()
-    const accepted = new FrameDecoder(vi.fn(), acceptedError)
-
-    accepted.feed(Buffer.concat([maximumFrame, Buffer.alloc(1024 * 1024)]))
-
-    expect(acceptedError).not.toHaveBeenCalled()
-    expect(accepted.drain()).toHaveLength(1024 * 1024)
-
-    const excessError = vi.fn()
-    const excess = new FrameDecoder(vi.fn(), excessError)
-    excess.feed(Buffer.concat([maximumFrame, Buffer.alloc(1024 * 1024 + 1)]))
-
-    expect(excessError).toHaveBeenCalledWith(
-      expect.objectContaining({ message: expect.stringContaining('retained-input') })
-    )
-    expect(excess.drain()).toHaveLength(0)
-  })
-
-  it('fails closed when one delivered chunk exceeds retained-input capacity', () => {
-    const onError = vi.fn()
-    const decoder = new FrameDecoder(vi.fn(), onError)
-
-    decoder.feed(Buffer.alloc(FRAME_DECODER_MAX_RETAINED_BYTES + 1))
-
-    expect(onError).toHaveBeenCalledWith(
-      expect.objectContaining({ message: expect.stringContaining('retained-input') })
-    )
-    expect(decoder.drain()).toHaveLength(0)
-  })
-
-  it('emits the first frame synchronously and preserves order through self-pause', () => {
-    const scheduler = createScheduler()
-    const seen: number[] = []
-    let decoder: FrameDecoder
-    const pause = vi.fn(() => decoder.feed(frame(4)))
-    const resume = vi.fn()
-    decoder = new FrameDecoder((decoded) => seen.push(decoded.id), undefined, {
-      maxFramesPerTurn: 1,
-      schedule: scheduler.schedule,
-      cancelScheduled: scheduler.cancel,
-      pause,
-      resume
-    })
-
-    decoder.feed(Buffer.concat([frame(1), frame(2), frame(3)]))
-
-    expect(seen).toEqual([1])
-    expect(pause).toHaveBeenCalledTimes(1)
-    expect(scheduler.pending()).toBe(1)
-
-    scheduler.runNext()
-    scheduler.runNext()
-    scheduler.runNext()
-
-    expect(seen).toEqual([1, 2, 3, 4])
-    expect(pause).toHaveBeenCalledTimes(1)
-    expect(resume).toHaveBeenCalledTimes(1)
-    expect(scheduler.pending()).toBe(0)
-  })
-
-  it('bounds decoded bytes and time independently from the frame count', () => {
-    const byteScheduler = createScheduler()
-    const byteSeen: number[] = []
-    const first = frame(1, 'one')
-    const second = frame(2, 'two')
-    const byteDecoder = new FrameDecoder((decoded) => byteSeen.push(decoded.id), undefined, {
-      maxFramesPerTurn: 64,
-      maxBytesPerTurn: first.length,
-      schedule: byteScheduler.schedule,
-      cancelScheduled: byteScheduler.cancel
-    })
-
-    byteDecoder.feed(Buffer.concat([first, second]))
-    expect(byteSeen).toEqual([1])
-    byteScheduler.runNext()
-    expect(byteSeen).toEqual([1, 2])
-
-    const timeScheduler = createScheduler()
-    const timeSeen: number[] = []
-    let nowCalls = 0
-    const timeDecoder = new FrameDecoder((decoded) => timeSeen.push(decoded.id), undefined, {
-      maxFramesPerTurn: 64,
-      maxBytesPerTurn: MAX_MESSAGE_SIZE + HEADER_LENGTH,
-      maxTurnMs: 4,
-      now: () => (nowCalls++ === 0 ? 0 : 5),
-      schedule: timeScheduler.schedule,
-      cancelScheduled: timeScheduler.cancel
-    })
-
-    timeDecoder.feed(Buffer.concat([frame(3), frame(4)]))
-    expect(timeSeen).toEqual([3])
-    timeScheduler.runNext()
-    expect(timeSeen).toEqual([3, 4])
-  })
-
-  it('releases its pause epoch when continuation scheduling throws', () => {
-    const pause = vi.fn()
-    const resume = vi.fn()
-    const decoder = new FrameDecoder(() => {}, undefined, {
-      maxFramesPerTurn: 1,
-      pause,
-      resume,
-      schedule: () => {
-        throw new Error('scheduler unavailable')
-      }
-    })
-
-    expect(() => decoder.feed(Buffer.concat([frame(1), frame(2)]))).toThrow('scheduler unavailable')
-    expect(pause).toHaveBeenCalledTimes(1)
-    expect(resume).toHaveBeenCalledTimes(1)
-    decoder.reset()
-    expect(resume).toHaveBeenCalledTimes(1)
-  })
-
-  it('contains a throwing continuation, resets residue, and reports one typed error', () => {
-    const scheduler = createScheduler()
-    const seen: number[] = []
-    const onError = vi.fn()
-    const pause = vi.fn()
-    const resume = vi.fn()
-    const decoder = new FrameDecoder(
-      (decoded) => {
-        if (decoded.id === 2) {
-          throw new Error('frame owner failed')
-        }
-        seen.push(decoded.id)
-      },
-      onError,
-      {
-        maxFramesPerTurn: 1,
-        schedule: scheduler.schedule,
-        cancelScheduled: scheduler.cancel,
-        pause,
-        resume
-      }
-    )
-
-    decoder.feed(Buffer.concat([frame(1), frame(2), frame(3)]))
-    expect(() => scheduler.runNext()).not.toThrow()
-
-    expect(seen).toEqual([1])
-    expect(onError).toHaveBeenCalledExactlyOnceWith(expect.any(FrameDecoderContinuationError))
-    expect(onError.mock.calls[0]?.[0]).toMatchObject({
-      name: 'FrameDecoderContinuationError',
-      cause: expect.objectContaining({ message: 'frame owner failed' })
-    })
-    expect(pause).toHaveBeenCalledTimes(1)
-    expect(resume).toHaveBeenCalledTimes(1)
-    expect(scheduler.pending()).toBe(0)
-    expect(decoder.drain()).toHaveLength(0)
-
-    decoder.feed(frame(4))
-    expect(seen).toEqual([1, 4])
-  })
-
-  // feed() runs straight from a transport data handler. A frame owner that threw on the first
-  // turn used to escape feed() and reach uncaughtException. The continuation path was already
-  // contained; the synchronous path must match it.
-  it('contains a frame owner that throws on the synchronous turn and reports one typed error', () => {
-    const seen: number[] = []
-    const onError = vi.fn()
-    const pause = vi.fn()
-    const resume = vi.fn()
-    const decoder = new FrameDecoder(
-      (decoded) => {
-        if (decoded.id === 2) {
-          throw new Error('frame owner failed')
-        }
-        seen.push(decoded.id)
-      },
-      onError,
-      { pause, resume }
-    )
-
-    expect(() => decoder.feed(Buffer.concat([frame(1), frame(2), frame(3)]))).not.toThrow()
-
-    expect(seen).toEqual([1])
-    expect(onError).toHaveBeenCalledExactlyOnceWith(expect.any(FrameDecoderContinuationError))
-    expect(onError.mock.calls[0]?.[0]).toMatchObject({
-      cause: expect.objectContaining({ message: 'frame owner failed' })
-    })
-    expect(decoder.drain()).toHaveLength(0)
-    expect(pause).not.toHaveBeenCalled()
-    expect(resume).not.toHaveBeenCalled()
-
-    decoder.feed(frame(4))
-    expect(seen).toEqual([1, 4])
-  })
-
-  it('keeps reads active for partial frames and incrementally discards oversized payloads', () => {
-    const errors: Error[] = []
-    const seen: DecodedFrame[] = []
-    const pause = vi.fn()
-    const decoder = new FrameDecoder(
-      (decoded) => seen.push(decoded),
-      (error) => errors.push(error),
-      { pause }
-    )
-    const valid = frame(2, 'complete')
-
-    decoder.feed(valid.subarray(0, HEADER_LENGTH + 2))
-    expect(seen).toHaveLength(0)
-    expect(pause).not.toHaveBeenCalled()
-    decoder.feed(valid.subarray(HEADER_LENGTH + 2))
-    expect(seen.map(({ id }) => id)).toEqual([2])
-
-    const oversizedHeader = Buffer.alloc(HEADER_LENGTH)
-    oversizedHeader[0] = MessageType.Regular
-    oversizedHeader.writeUInt32BE(3, 1)
-    oversizedHeader.writeUInt32BE(MAX_MESSAGE_SIZE + 1, 9)
-    decoder.feed(Buffer.concat([oversizedHeader, Buffer.alloc(32)]))
-
-    expect(errors).toHaveLength(1)
-    expect(pause).not.toHaveBeenCalled()
-    decoder.reset()
-    decoder.feed(frame(4, 'after-reset'))
-    expect(seen.map(({ id }) => id)).toEqual([2, 4])
-  })
-
-  it('drain and reset cancel continuation ownership without replaying residue', () => {
-    const scheduler = createScheduler()
-    const seen: number[] = []
-    const resume = vi.fn()
-    const cancel = vi.fn(scheduler.cancel)
-    const decoder = new FrameDecoder((decoded) => seen.push(decoded.id), undefined, {
-      maxFramesPerTurn: 1,
-      schedule: scheduler.schedule,
-      cancelScheduled: cancel,
-      resume
-    })
-    const second = frame(2, 'residue')
-
-    decoder.feed(Buffer.concat([frame(1), second]))
-    const residue = decoder.drain()
-
-    expect(seen).toEqual([1])
-    expect(residue.equals(second)).toBe(true)
-    expect(cancel).toHaveBeenCalledTimes(1)
-    expect(resume).toHaveBeenCalledTimes(1)
-    expect(scheduler.pending()).toBe(0)
-
-    decoder.feed(Buffer.concat([frame(3), frame(4)]))
-    decoder.reset()
-    expect(cancel).toHaveBeenCalledTimes(2)
-    expect(scheduler.pending()).toBe(0)
-
-    decoder.feed(frame(5))
-    expect(seen).toEqual([1, 3, 5])
-  })
-})
diff --git a/src/main/ssh/relay-socket-path-limit.test.ts b/src/main/ssh/relay-socket-path-limit.test.ts
index ce878765e8d..8d58fbb10e0 100644
--- a/src/main/ssh/relay-socket-path-limit.test.ts
+++ b/src/main/ssh/relay-socket-path-limit.test.ts
@@ -1,5 +1,8 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', () => ({
   remoteRipgrepLayout: vi.fn().mockReturnValue(null),
   recordRemoteRipgrepReference: vi.fn().mockResolvedValue(false),
diff --git a/src/main/ssh/remote-install-gc-termination.test.ts b/src/main/ssh/remote-install-gc-termination.test.ts
new file mode 100644
index 00000000000..73b50e7b6f1
--- /dev/null
+++ b/src/main/ssh/remote-install-gc-termination.test.ts
@@ -0,0 +1,183 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as DeployHelpers from './ssh-relay-deploy-helpers'
+
+vi.mock('./ssh-relay-deploy-helpers', async (importOriginal) => ({
+  ...(await importOriginal<typeof DeployHelpers>()),
+  execCommand: vi.fn()
+}))
+
+import type { SshConnection } from './ssh-connection'
+import { gcOldRelayVersions } from './remote-install-gc'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import { gcRelayNativeDepsCache } from './ssh-relay-native-deps-cache-gc'
+import { gcRemoteRipgrepCache } from './ssh-relay-ripgrep-cache-gc'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: all connection access is replaced by execCommand's mock.
+const conn = {} as SshConnection
+const host = getRemoteHostPlatform('linux-x64')
+const home = '/home/u'
+const currentDir = `${home}/.orca-remote/relay-0.1.0+bbb`
+const nativeKey = 'linux-x64-0123456789abcdef'
+const mockExec = vi.mocked(execCommand)
+
+beforeEach(() => {
+  mockExec.mockReset()
+  mockExec.mockResolvedValue('')
+})
+
+function failAfter(replies: readonly string[], confirmed = false): Error {
+  for (const reply of replies) {
+    mockExec.mockResolvedValueOnce(reply)
+  }
+  const error = Object.assign(new Error('SSH command timed out'), {
+    sshChannelCloseConfirmed: confirmed
+  })
+  mockExec.mockRejectedValueOnce(error)
+  return error
+}
+
+function collectRelayVersions(): Promise<void> {
+  return gcOldRelayVersions(conn, home, currentDir, host, { nativeDepsCacheKeys: [nativeKey] })
+}
+
+const versionSteps = [
+  ['listing', 'relay-0.1.0+aaa\nrelay-0.1.0+ccc'],
+  ['install lock probe', 'OPEN'],
+  ['completion probe', 'COMPLETE'],
+  ['liveness probe', 'DEAD'],
+  ['claim acquisition', 'OK'],
+  ['claim owner write', ''],
+  ['claimed install lock probe', 'OPEN'],
+  ['claimed completion probe', 'COMPLETE'],
+  ['claimed liveness probe', 'DEAD'],
+  ['claim ownership probe', 'OWNED'],
+  ['rename', 'MOVED'],
+  ['claim release', 'RELEASED'],
+  ['tombstone deletion', '']
+] as const
+
+describe('version GC termination', () => {
+  it.each(versionSteps.map(([phase], index) => ({ phase, index })))(
+    'stops all cleanup after unconfirmed $phase termination',
+    async ({ index }) => {
+      const error = failAfter(versionSteps.slice(0, index).map(([, reply]) => reply))
+
+      await expect(collectRelayVersions()).rejects.toBe(error)
+
+      expect(mockExec).toHaveBeenCalledTimes(index + 1)
+    }
+  )
+
+  it.each([false, true])(
+    'stops after an unconfirmed stale lock probe with claim held: %s',
+    async (claimed) => {
+      const replies = claimed
+        ? versionSteps.slice(0, 6).map(([, reply]) => String(reply))
+        : [versionSteps[0][1]]
+      const error = failAfter([...replies, 'LOCKED'])
+
+      await expect(collectRelayVersions()).rejects.toBe(error)
+
+      expect(mockExec).toHaveBeenCalledTimes(replies.length + 2)
+    }
+  )
+
+  it('stops after unconfirmed abandoned tombstone deletion', async () => {
+    const error = failAfter([
+      'relay-0.1.0+aaa.gc-tombstone.1.1\nrelay-0.1.0+ccc.gc-tombstone.1.1\nrelay-0.1.0+ddd'
+    ])
+
+    await expect(collectRelayVersions()).rejects.toBe(error)
+
+    expect(mockExec).toHaveBeenCalledTimes(2)
+  })
+
+  it('preserves an unconfirmed native cache cleanup error for its caller', async () => {
+    const error = failAfter([''])
+
+    await expect(collectRelayVersions()).rejects.toBe(error)
+
+    expect(mockExec).toHaveBeenCalledTimes(2)
+  })
+})
+
+const caches = [
+  {
+    name: 'native dependencies',
+    collect: () => gcRelayNativeDepsCache(conn, host, home),
+    listing: `ENTRY ${nativeKey}\nENTRY linux-x64-fedcba9876543210\n__ORCA_NATIVE_CACHE__LIST_OK`,
+    references: '__ORCA_NATIVE_CACHE__REFS_OK'
+  },
+  {
+    name: 'ripgrep',
+    collect: () => gcRemoteRipgrepCache(conn, host, home),
+    listing:
+      'ENTRY 0123456789abcdef-linux-x64\nENTRY fedcba9876543210-linux-x64\n__ORCA_RG_CACHE__LIST_OK',
+    references: '__ORCA_RG_CACHE__REFS_OK'
+  }
+]
+
+describe.each(caches)('$name cache GC termination', ({ collect, listing, references }) => {
+  const steps = [
+    ['listing', listing],
+    ['reference scan', references],
+    ['rename', 'MOVED'],
+    ['reference recheck', references],
+    ['tombstone deletion', '']
+  ] as const
+
+  it.each(steps.map(([phase], index) => ({ phase, index })))(
+    'preserves unconfirmed $phase termination and stops collection',
+    async ({ index, phase }) => {
+      const error = failAfter(steps.slice(0, index).map(([, reply]) => reply))
+
+      await expect(collect()).rejects.toBe(error)
+
+      expect(mockExec).toHaveBeenCalledTimes(index + (phase === 'reference recheck' ? 2 : 1))
+      if (phase === 'reference recheck') {
+        expect(mockExec.mock.calls.at(-1)?.[1]).toContain('[ ! -e ')
+      }
+    }
+  )
+
+  it.each(steps.map(([phase], index) => ({ phase, index })))(
+    'keeps a confirmed $phase failure nonfatal',
+    async ({ index }) => {
+      failAfter(
+        steps.slice(0, index).map(([, reply]) => reply),
+        true
+      )
+
+      await expect(collect()).resolves.toBeUndefined()
+    }
+  )
+
+  it('stops when restoring a tombstone has unconfirmed termination', async () => {
+    const error = failAfter([listing, references, 'MOVED', 'unreadable references'])
+
+    await expect(collect()).rejects.toBe(error)
+
+    expect(mockExec).toHaveBeenCalledTimes(5)
+  })
+
+  it.each([false, true])(
+    'does not retry a failed restoration after an unconfirmed recheck: %s',
+    async (confirmed) => {
+      const error = failAfter([listing, references, 'MOVED'])
+      mockExec.mockRejectedValueOnce(
+        Object.assign(new Error('restore failed'), { sshChannelCloseConfirmed: confirmed })
+      )
+
+      await expect(collect()).rejects.toBe(error)
+
+      expect(mockExec).toHaveBeenCalledTimes(5)
+    }
+  )
+
+  it('keeps a confirmed restore failure nonfatal', async () => {
+    failAfter([listing, references, 'MOVED', 'unreadable references'], true)
+
+    await expect(collect()).resolves.toBeUndefined()
+  })
+})
diff --git a/src/main/ssh/remote-install-gc.ts b/src/main/ssh/remote-install-gc.ts
index a76d119cf8a..986154e356e 100644
--- a/src/main/ssh/remote-install-gc.ts
+++ b/src/main/ssh/remote-install-gc.ts
@@ -95,7 +95,10 @@ export async function gcOldRemoteInstallVersions(
       host,
       listRemoteInstallBaseDirsCommand(host, baseDir, model)
     )
-  } catch {
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     return
   }
   const entries = listing
@@ -169,6 +172,9 @@ export async function gcOldRemoteInstallVersions(
       }
       removed.push(name)
     } catch (err) {
+      if (isUnconfirmedSshCommandTermination(err)) {
+        throw err
+      }
       console.warn(
         `[${model.id}] GC failed for ${dir}: ${err instanceof Error ? err.message : String(err)}`
       )
@@ -198,7 +204,10 @@ async function isCandidateSafeToRemove(
   let lockProbe: string
   try {
     lockProbe = await execHostCommand(conn, host, probeInstallLockExistsCommand(host, lockDir))
-  } catch {
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     return false
   }
   const lockState = lockProbe.trim()
@@ -224,7 +233,12 @@ async function isCandidateSafeToRemove(
       conn,
       host,
       probeFileExistsCommand(host, completePath)
-    ).catch(() => 'PARTIAL')
+    ).catch((err) => {
+      if (isUnconfirmedSshCommandTermination(err)) {
+        throw err
+      }
+      return 'PARTIAL'
+    })
     if (completeProbe.trim() !== 'COMPLETE') {
       // Crashed-install partial; leave for the next deploy to recover.
       return false
@@ -263,7 +277,11 @@ export async function gcOldRelayVersions(
   if (options?.nativeDepsCacheKeys?.length) {
     await gcRelayNativeDepsCache(conn, host, remoteHome, {
       pinnedKeys: options.nativeDepsCacheKeys
-    }).catch(() => {})
+    }).catch((err) => {
+      if (isUnconfirmedSshCommandTermination(err)) {
+        throw err
+      }
+    })
   }
 }
 
@@ -294,7 +312,10 @@ async function hasLiveRelaySocket(
     )
     const state = out.trim()
     return state !== 'DEAD' && state !== 'WAITING'
-  } catch {
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     // Why: an inconclusive liveness probe must never authorize deletion.
     return true
   }
diff --git a/src/main/ssh/remote-install-model.test.ts b/src/main/ssh/remote-install-model.test.ts
index a12b2e8342f..fa32ea81940 100644
--- a/src/main/ssh/remote-install-model.test.ts
+++ b/src/main/ssh/remote-install-model.test.ts
@@ -21,6 +21,18 @@ import {
 const RELAY_DIRS = ['relay-0.1.0+abcdef123456', 'relay-v0.1.0', 'relay-1.2.3']
 const ORCAD_DIRS = ['orcad-0.1.0+abcdef123456', 'orcad-v0.1.0', 'orcad-1.2.3']
 
+it.each([false, true])(
+  'requires the executable and both profile workers on Windows=%s',
+  (isWindows) => {
+    const artifacts = ORCAD_INSTALL_MODEL.requiredArtifacts(isWindows)
+    expect(artifacts).toContain(isWindows ? 'bun-runtime.exe' : 'bun-runtime')
+    expect(artifacts).not.toContain(isWindows ? 'bun-runtime' : 'bun-runtime.exe')
+    expect(artifacts).toContain('profile-state-writer-worker-entry.js')
+    expect(artifacts).toContain('profile-state-backup-worker-entry.js')
+    expect(artifacts.includes('windows-process-tree.node')).toBe(isWindows)
+  }
+)
+
 describe('remote install namespace', () => {
   it('names each model its own version dir', () => {
     expect(remoteInstallDirName(RELAY_INSTALL_MODEL, '0.1.0+aa')).toBe('relay-0.1.0+aa')
@@ -30,7 +42,9 @@ describe('remote install namespace', () => {
   it('requires every shipped search binary in a completed standalone runtime install', () => {
     const required = ORCAD_INSTALL_MODEL.requiredArtifacts(false)
     expect(required).toEqual(expect.arrayContaining([...ORCAD_RIPGREP_ARTIFACTS]))
-    expect(ORCAD_INSTALL_MODEL.requiredArtifacts(true)).toEqual(required)
+    expect(ORCAD_INSTALL_MODEL.requiredArtifacts(true)).toEqual(
+      expect.arrayContaining([...ORCAD_RIPGREP_ARTIFACTS])
+    )
   })
 
   it.skipIf(process.platform === 'win32')('rejects an install missing its search binary', () => {
diff --git a/src/main/ssh/remote-install-model.ts b/src/main/ssh/remote-install-model.ts
index 54be330a55f..e2a46fda547 100644
--- a/src/main/ssh/remote-install-model.ts
+++ b/src/main/ssh/remote-install-model.ts
@@ -53,9 +53,7 @@ export const ORCAD_INSTALL_MODEL: RemoteInstallModel = {
   nativeDepsPackageName: 'orca-orcad',
   versionFilename: ORCAD_VERSION_FILENAME,
   installCompleteFilename: ORCAD_INSTALL_COMPLETE_FILENAME,
-  // Why the parameter is ignored: orcad's forked children are the same three .js files on
-  // every host. The Windows-only console-list agent patch is a relay/node-pty concern.
-  requiredArtifacts: () => orcadArtifactFilenames()
+  requiredArtifacts: (isWindows) => orcadArtifactFilenames(isWindows ? 'win32' : '')
 }
 
 export const REMOTE_INSTALL_MODELS: readonly RemoteInstallModel[] = [
diff --git a/src/main/ssh/ssh-connection-auth-fallback.test.ts b/src/main/ssh/ssh-connection-auth-fallback.test.ts
index 9e3760616c2..20c973e1b2c 100644
--- a/src/main/ssh/ssh-connection-auth-fallback.test.ts
+++ b/src/main/ssh/ssh-connection-auth-fallback.test.ts
@@ -179,6 +179,7 @@ describe('SshConnection', () => {
       'target-1',
       'password',
       'example.com',
+      undefined,
       expect.any(AbortSignal)
     )
   })
@@ -244,7 +245,7 @@ describe('SshConnection', () => {
         ],
         finish
       )
-      for (let turn = 0; turn < 8 && finish.mock.calls.length === 0; turn += 1) {
+      for (let turn = 0; turn < 20 && finish.mock.calls.length === 0; turn += 1) {
         await Promise.resolve()
       }
 
@@ -254,6 +255,7 @@ describe('SshConnection', () => {
         'target-1',
         'keyboard-interactive',
         'Duo two-factor login\nSelect push or enter a passcode.\nOption:',
+        false,
         expect.any(AbortSignal)
       )
       expect(onCredentialRequest).toHaveBeenNthCalledWith(
@@ -261,6 +263,7 @@ describe('SshConnection', () => {
         'target-1',
         'keyboard-interactive',
         'Duo two-factor login\nSelect push or enter a passcode.\nPasscode:',
+        false,
         expect.any(AbortSignal)
       )
       expect(finish).toHaveBeenCalledWith(['1', '123456'])
@@ -311,7 +314,7 @@ describe('SshConnection', () => {
 
       await vi.advanceTimersByTimeAsync(100_000)
       firstResponse.resolve('1')
-      for (let turn = 0; turn < 4 && onCredentialRequest.mock.calls.length < 2; turn += 1) {
+      for (let turn = 0; turn < 20 && onCredentialRequest.mock.calls.length < 2; turn += 1) {
         await Promise.resolve()
       }
       expect(onCredentialRequest).toHaveBeenCalledTimes(2)
@@ -321,7 +324,7 @@ describe('SshConnection', () => {
       expect(finish).not.toHaveBeenCalled()
 
       secondResponse.resolve('123456')
-      for (let turn = 0; turn < 4 && finish.mock.calls.length === 0; turn += 1) {
+      for (let turn = 0; turn < 20 && finish.mock.calls.length === 0; turn += 1) {
         await Promise.resolve()
       }
       expect(finish).toHaveBeenCalledWith(['1', '123456'])
@@ -337,7 +340,13 @@ describe('SshConnection', () => {
     ssh2Mock.connectBehavior = 'pending'
     let credentialSignal: AbortSignal | undefined
     const onCredentialRequest = vi.fn(
-      (_targetId: string, _kind: string, _detail: string, signal?: AbortSignal) => {
+      (
+        _targetId: string,
+        _kind: string,
+        _detail: string,
+        _echo?: boolean,
+        signal?: AbortSignal
+      ) => {
         credentialSignal = signal
         const response = Promise.withResolvers<string | null>()
         if (signal?.aborted) {
@@ -405,6 +414,7 @@ describe('SshConnection', () => {
         'target-1',
         'passphrase',
         keyPath,
+        undefined,
         expect.any(AbortSignal)
       )
     } finally {
diff --git a/src/main/ssh/ssh-connection-gssapi-fallback.test.ts b/src/main/ssh/ssh-connection-gssapi-fallback.test.ts
index 7dcc25410a8..8eeb6994a50 100644
--- a/src/main/ssh/ssh-connection-gssapi-fallback.test.ts
+++ b/src/main/ssh/ssh-connection-gssapi-fallback.test.ts
@@ -204,6 +204,7 @@ describe('SshConnection', () => {
       'target-1',
       'password',
       'example.com',
+      undefined,
       expect.any(AbortSignal)
     )
   })
diff --git a/src/main/ssh/ssh-connection-utils.test.ts b/src/main/ssh/ssh-connection-utils.test.ts
index 53cdbf07dd6..00abeeb2052 100644
--- a/src/main/ssh/ssh-connection-utils.test.ts
+++ b/src/main/ssh/ssh-connection-utils.test.ts
@@ -514,6 +514,11 @@ describe('buildConnectConfig', () => {
     expect(config.keepaliveInterval).toBe(15_000)
   })
 
+  it('enables keyboard-interactive auth so MFA challenges can be answered', () => {
+    const config = buildConnectConfig(makeTarget(), null)
+    expect(config.tryKeyboard).toBe(true)
+  })
+
   it('uses agent auth when no explicit key and SSH_AUTH_SOCK is set', () => {
     const config = buildConnectConfig(makeTarget(), null)
     expect(config.agent).toBe('/tmp/agent.sock')
diff --git a/src/main/ssh/ssh-connection-utils.ts b/src/main/ssh/ssh-connection-utils.ts
index 216e23e6203..48057b9c088 100644
--- a/src/main/ssh/ssh-connection-utils.ts
+++ b/src/main/ssh/ssh-connection-utils.ts
@@ -17,10 +17,13 @@ export type SshCredentialKind = 'passphrase' | 'password' | 'keyboard-interactiv
 
 export type SshConnectionCallbacks = {
   onStateChange: (targetId: string, state: SshConnectionState) => void
+  // Why: echo carries the server's RFC 4256 echo flag for keyboard-interactive
+  // prompts so the UI knows whether the typed response may be shown.
   onCredentialRequest?: (
     targetId: string,
     kind: SshCredentialKind,
     detail: string,
+    echo?: boolean,
     signal?: AbortSignal
   ) => Promise<string | null>
 }
@@ -202,6 +205,9 @@ export function buildConnectConfig(
     username: effectiveUser,
     readyTimeout: CONNECT_TIMEOUT_MS,
     keepaliveInterval: 15_000,
+    // Why: lets servers deliver keyboard-interactive challenges (RFC 4256,
+    // commonly MFA after a partial password success). SshConnection answers
+    // them through the credential prompt callback.
     tryKeyboard: true
   }
 
diff --git a/src/main/ssh/ssh-connection.test.ts b/src/main/ssh/ssh-connection.test.ts
index a20167c2f4a..5535c5e7e8e 100644
--- a/src/main/ssh/ssh-connection.test.ts
+++ b/src/main/ssh/ssh-connection.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it, vi, beforeEach } from 'vitest'
 import {
   clientInstances,
   createSsh2Module,
+  emitSshEvent,
   eventHandlers,
   resetSshConnectionMocks,
   VALID_ED25519_HOST_KEY,
@@ -277,4 +278,322 @@ describe('SshConnection', () => {
 
     await expect(conn.connect()).rejects.toThrow('Connection disposed')
   })
+
+  describe('keyboard-interactive MFA', () => {
+    it('completes password + keyboard-interactive MFA auth and forwards the prompt', async () => {
+      vi.stubEnv('SSH_AUTH_SOCK', '')
+      ssh2Mock.connectSequence = [
+        new Error('All configured authentication methods failed'),
+        'silent'
+      ]
+      const onCredentialRequest = vi.fn(async (_targetId: string, kind: string) =>
+        kind === 'password' ? 'password-123' : '1'
+      )
+      const conn = new SshConnection(createTarget(), createCallbacks({ onCredentialRequest }))
+
+      const connectPromise = conn.connect()
+      await vi.waitFor(() => {
+        expect(eventHandlers.get('keyboard-interactive')?.size ?? 0).toBeGreaterThan(0)
+        expect(clientInstances).toHaveLength(2)
+      })
+      const finish = vi.fn()
+      emitSshEvent(
+        'keyboard-interactive',
+        '',
+        'Choose a verification method:',
+        '',
+        [{ prompt: 'Passcode or option (1-2):', echo: true }],
+        finish
+      )
+      await vi.waitFor(() => expect(finish).toHaveBeenCalledWith(['1']))
+      emitSshEvent('ready')
+      await connectPromise
+
+      expect(conn.getState().status).toBe('connected')
+      expect(clientInstances[1].lastConnectConfig).toMatchObject({
+        tryKeyboard: true,
+        password: 'password-123'
+      })
+      expect(onCredentialRequest).toHaveBeenCalledWith(
+        'target-1',
+        'password',
+        'example.com',
+        undefined,
+        expect.any(AbortSignal)
+      )
+      expect(onCredentialRequest).toHaveBeenCalledWith(
+        'target-1',
+        'keyboard-interactive',
+        'Choose a verification method:\nPasscode or option (1-2):',
+        true,
+        expect.any(AbortSignal)
+      )
+    })
+
+    it('auto-answers a keyboard-interactive password prompt with the cached password (echo=false)', async () => {
+      vi.stubEnv('SSH_AUTH_SOCK', '')
+      ssh2Mock.connectSequence = [
+        new Error('All configured authentication methods failed'),
+        'silent'
+      ]
+      const onCredentialRequest = vi.fn(async () => 'password-123')
+      const conn = new SshConnection(createTarget(), createCallbacks({ onCredentialRequest }))
+
+      const connectPromise = conn.connect()
+      await vi.waitFor(() => {
+        expect(eventHandlers.get('keyboard-interactive')?.size ?? 0).toBeGreaterThan(0)
+        expect(clientInstances).toHaveLength(2)
+      })
+      const finish = vi.fn()
+      emitSshEvent(
+        'keyboard-interactive',
+        '',
+        '',
+        '',
+        [{ prompt: 'Password: ', echo: false }],
+        finish
+      )
+      await vi.waitFor(() => expect(finish).toHaveBeenCalledWith(['password-123']))
+      emitSshEvent('ready')
+      await connectPromise
+
+      expect(conn.getState().status).toBe('connected')
+      expect(onCredentialRequest).toHaveBeenCalledTimes(1)
+    })
+
+    it('caches a password collected through a keyboard-interactive prompt, but never caches an OTP', async () => {
+      vi.stubEnv('SSH_AUTH_SOCK', '')
+      ssh2Mock.connectSequence = ['silent']
+      const onCredentialRequest = vi.fn(async (_targetId: string, kind: string) =>
+        kind === 'password' ? 'password-123' : '654321'
+      )
+      const conn = new SshConnection(createTarget(), createCallbacks({ onCredentialRequest }))
+
+      const connectPromise = conn.connect()
+      await vi.waitFor(() =>
+        expect(eventHandlers.get('keyboard-interactive')?.size ?? 0).toBeGreaterThan(0)
+      )
+      const finish = vi.fn()
+      emitSshEvent(
+        'keyboard-interactive',
+        '',
+        '',
+        '',
+        [
+          { prompt: 'Password: ', echo: false },
+          { prompt: 'One-time password:', echo: false }
+        ],
+        finish
+      )
+      await vi.waitFor(() => expect(finish).toHaveBeenCalledWith(['password-123', '654321']))
+      emitSshEvent('ready')
+      await connectPromise
+
+      expect(onCredentialRequest).toHaveBeenCalledWith(
+        'target-1',
+        'password',
+        'example.com',
+        undefined,
+        expect.any(AbortSignal)
+      )
+      expect(onCredentialRequest).toHaveBeenCalledWith(
+        'target-1',
+        'keyboard-interactive',
+        'One-time password:',
+        false,
+        expect.any(AbortSignal)
+      )
+      expect(conn.hasCachedCredential()).toBe(true)
+
+      // Reconnect: the OTP prompt must be asked again (never auto-answered from a cache).
+      onCredentialRequest.mockClear()
+      ssh2Mock.connectSequence = ['silent']
+      const privateConn = conn as unknown as { attemptConnect: () => Promise<void> }
+      const reconnectPromise = privateConn.attemptConnect()
+      await vi.waitFor(() =>
+        expect(eventHandlers.get('keyboard-interactive')?.size ?? 0).toBeGreaterThan(0)
+      )
+      const finish2 = vi.fn()
+      emitSshEvent(
+        'keyboard-interactive',
+        '',
+        '',
+        '',
+        [{ prompt: 'One-time password:', echo: false }],
+        finish2
+      )
+      await vi.waitFor(() => expect(finish2).toHaveBeenCalledWith(['654321']))
+      // Why not answered from the password cache: this round only sends the
+      // OTP prompt (no password-looking prompt), so it must reach the user
+      // as a fresh 'keyboard-interactive' request every time.
+      expect(onCredentialRequest).toHaveBeenCalledWith(
+        'target-1',
+        'keyboard-interactive',
+        'One-time password:',
+        false,
+        expect.any(AbortSignal)
+      )
+      emitSshEvent('ready')
+      await reconnectPromise
+    })
+
+    it('re-prompts instead of replaying the cached password on a second keyboard-interactive round', async () => {
+      vi.stubEnv('SSH_AUTH_SOCK', '')
+      ssh2Mock.connectSequence = ['silent']
+      const onCredentialRequest = vi.fn(async () => 'password-123')
+      const conn = new SshConnection(createTarget(), createCallbacks({ onCredentialRequest }))
+
+      const connectPromise = conn.connect()
+      await vi.waitFor(() =>
+        expect(eventHandlers.get('keyboard-interactive')?.size ?? 0).toBeGreaterThan(0)
+      )
+      const finish = vi.fn()
+      emitSshEvent(
+        'keyboard-interactive',
+        '',
+        '',
+        '',
+        [{ prompt: 'Password: ', echo: false }],
+        finish
+      )
+      await vi.waitFor(() => expect(finish).toHaveBeenCalledWith(['password-123']))
+      expect(onCredentialRequest).toHaveBeenCalledTimes(1)
+
+      // The server rejected that password and opened a new round for it. Auto-answering from the
+      // cache again would replay the rejected value up to the round cap without asking the user.
+      onCredentialRequest.mockClear()
+      const finish2 = vi.fn()
+      emitSshEvent(
+        'keyboard-interactive',
+        '',
+        '',
+        '',
+        [{ prompt: 'Password: ', echo: false }],
+        finish2
+      )
+      await vi.waitFor(() => expect(finish2).toHaveBeenCalledWith(['password-123']))
+      expect(onCredentialRequest).toHaveBeenCalledWith(
+        'target-1',
+        'password',
+        'example.com',
+        undefined,
+        expect.any(AbortSignal)
+      )
+
+      emitSshEvent('ready')
+      await connectPromise
+    })
+
+    it('does not fall back to the password prompt after a cancelled keyboard-interactive prompt', async () => {
+      vi.stubEnv('SSH_AUTH_SOCK', '')
+      ssh2Mock.connectSequence = ['silent']
+      const onCredentialRequest = vi.fn(async () => null)
+      const conn = new SshConnection(createTarget(), createCallbacks({ onCredentialRequest }))
+
+      const connectPromise = conn.connect()
+      connectPromise.catch(() => {})
+      await vi.waitFor(() =>
+        expect(eventHandlers.get('keyboard-interactive')?.size ?? 0).toBeGreaterThan(0)
+      )
+      const finish = vi.fn()
+      emitSshEvent(
+        'keyboard-interactive',
+        '',
+        '',
+        '',
+        [{ prompt: 'Duo passcode:', echo: false }],
+        finish
+      )
+      await vi.waitFor(() => expect(finish).toHaveBeenCalledWith([]))
+
+      // Why no server error event: a cancelled prompt now fails the attempt
+      // immediately instead of waiting on a server round-trip that will
+      // never come from a user decision.
+      await expect(connectPromise).rejects.toThrow('Keyboard-interactive authentication cancelled')
+      expect(onCredentialRequest).toHaveBeenCalledTimes(1)
+      expect(conn.getState().status).toBe('auth-failed')
+    })
+
+    it('does not restore the password cache when a prompt resolves after disconnect', async () => {
+      vi.stubEnv('SSH_AUTH_SOCK', '')
+      ssh2Mock.connectSequence = ['silent']
+      let answer: (value: string) => void = () => {}
+      const onCredentialRequest = vi.fn(
+        () =>
+          new Promise<string>((resolve) => {
+            answer = resolve
+          })
+      )
+      const conn = new SshConnection(createTarget(), createCallbacks({ onCredentialRequest }))
+      const connecting = conn.connect()
+      connecting.catch(() => {})
+      await vi.waitFor(() => expect(eventHandlers.has('keyboard-interactive')).toBe(true))
+      const finish = vi.fn()
+      emitSshEvent(
+        'keyboard-interactive',
+        '',
+        '',
+        '',
+        [{ prompt: 'Password:', echo: false }],
+        finish
+      )
+      await vi.waitFor(() => expect(onCredentialRequest).toHaveBeenCalledOnce())
+      await conn.disconnect()
+      answer('obsolete-password')
+      await vi.waitFor(() => expect(finish).toHaveBeenCalledWith([]))
+      expect(conn.hasCachedCredential()).toBe(false)
+      expect(conn.getState().status).toBe('disconnected')
+      await expect(connecting).rejects.toThrow()
+    })
+
+    it('does not treat a missing credential callback as user cancellation', async () => {
+      vi.stubEnv('SSH_AUTH_SOCK', '')
+      ssh2Mock.connectSequence = ['silent']
+      const conn = new SshConnection(createTarget(), createCallbacks())
+      const connecting = conn.connect()
+      connecting.catch(() => {})
+      await vi.waitFor(() => expect(eventHandlers.has('keyboard-interactive')).toBe(true))
+      const finish = vi.fn()
+      emitSshEvent('keyboard-interactive', '', '', '', [{ prompt: 'Code:', echo: false }], finish)
+      await vi.waitFor(() => expect(finish).toHaveBeenCalledWith([]))
+      emitSshEvent('error', new Error('All configured authentication methods failed'))
+      await expect(connecting).rejects.toThrow('All configured authentication methods failed')
+      conn.disconnect()
+    })
+
+    it('fails auth (not cancellation) when the server rejects an incorrect MFA answer', async () => {
+      vi.stubEnv('SSH_AUTH_SOCK', '')
+      ssh2Mock.connectSequence = [
+        'silent',
+        new Error('All configured authentication methods failed')
+      ]
+      const onCredentialRequest = vi.fn(async () => '000000')
+      const conn = new SshConnection(createTarget(), createCallbacks({ onCredentialRequest }))
+
+      const connectPromise = conn.connect()
+      connectPromise.catch(() => {})
+      await vi.waitFor(() =>
+        expect(eventHandlers.get('keyboard-interactive')?.size ?? 0).toBeGreaterThan(0)
+      )
+      const finish = vi.fn()
+      emitSshEvent(
+        'keyboard-interactive',
+        '',
+        '',
+        '',
+        [{ prompt: 'Verification code:', echo: false }],
+        finish
+      )
+      await vi.waitFor(() => expect(finish).toHaveBeenCalledWith(['000000']))
+      // Why the second connectSequence entry is a plain error rather than
+      // another keyboard-interactive round: an incorrect OTP is a distinct
+      // case from cancellation — the user DID answer, the server rejected
+      // it — so this must not go through the keyboardInteractiveCancelled
+      // short-circuit at all.
+      emitSshEvent('error', new Error('All configured authentication methods failed'))
+
+      await expect(connectPromise).rejects.toThrow('All configured authentication methods failed')
+      expect(conn.getState().status).toBe('auth-failed')
+    })
+  })
 })
diff --git a/src/main/ssh/ssh-connection.ts b/src/main/ssh/ssh-connection.ts
index 98d383c5c92..448efe0ad38 100644
--- a/src/main/ssh/ssh-connection.ts
+++ b/src/main/ssh/ssh-connection.ts
@@ -45,6 +45,7 @@ import {
   type SshConnectionCallbacks,
   type SshCredentialKind
 } from './ssh-connection-utils'
+import { collectKeyboardInteractiveResponses } from './ssh-keyboard-interactive'
 import { resolveEffectiveProxy, spawnProxyCommand } from './ssh-proxy-command'
 import {
   createHostKeyVerifier,
@@ -114,7 +115,6 @@ const HOST_KEY_SOURCE_READ_TIMEOUT_MS = 5_000
 const SSH_KEYBOARD_INTERACTIVE_MAX_ROUNDS = 8
 const SSH_KEYBOARD_INTERACTIVE_READY_TIMEOUT_MS = SSH_CREDENTIAL_TIMEOUT_MS + 5_000
 const SSH_KEYBOARD_INTERACTIVE_MAX_PROMPTS = 8
-const SSH_KEYBOARD_INTERACTIVE_TEXT_MAX = 4_096
 
 // Upper bound on waiting for an aborted channel's open/close to settle before rejecting anyway.
 const ABORTED_CHANNEL_CLOSE_GRACE_MS = 5_000
@@ -206,6 +206,9 @@ export class SshConnection {
   private disposed = false
   private cachedPassphrase: string | null = null
   private cachedPassword: string | null = null
+  private keyboardInteractiveCancelled = false
+  // A rejected cached password must reach the user on the next round.
+  private keyboardInteractivePasswordState = { passwordAutoAnswered: false }
   private hostKeyFingerprint: string | undefined
   private connectGeneration = 0
 
@@ -224,6 +227,9 @@ export class SshConnection {
   getState(): SshConnectionState {
     return { ...this.state }
   }
+  getConnectGeneration(): number {
+    return this.connectGeneration
+  }
   getClient(): SshClient | null {
     return this.client
   }
@@ -733,7 +739,8 @@ export class SshConnection {
   private async requestCredential(
     kind: SshCredentialKind,
     detail: string,
-    connectGeneration: number
+    connectGeneration: number,
+    echo?: boolean
   ): Promise<string | null | undefined> {
     if (this.disposed || connectGeneration !== this.connectGeneration) {
       return undefined
@@ -742,14 +749,16 @@ export class SshConnection {
       this.target.id,
       kind,
       detail,
+      echo,
       this.credentialAbortController.signal
     )
   }
 
   private async answerKeyboardInteractive(
+    hostDetail: string,
     name: string,
     instructions: string,
-    prompts: readonly Prompt[],
+    prompts: Prompt[],
     connectGeneration: number,
     onPromptStart: () => void
   ): Promise<string[] | null> {
@@ -757,25 +766,36 @@ export class SshConnection {
       return null
     }
     const heading = [name.trim(), instructions.trim()].filter(Boolean).join('\n')
-    const responses: string[] = []
-    for (const prompt of prompts) {
-      onPromptStart()
-      const promptText = prompt.prompt.trim() || 'Verification response'
-      const detail = [heading, promptText]
-        .filter(Boolean)
-        .join('\n')
-        .slice(0, SSH_KEYBOARD_INTERACTIVE_TEXT_MAX)
-      const response = await this.requestCredential(
-        'keyboard-interactive',
-        detail,
-        connectGeneration
-      )
-      if (response === null || response === undefined) {
-        return null
-      }
-      responses.push(response)
-    }
-    return this.disposed || connectGeneration !== this.connectGeneration ? null : responses
+    const isCurrent = (): boolean => !this.disposed && connectGeneration === this.connectGeneration
+    const responses = await collectKeyboardInteractiveResponses(
+      {
+        targetId: this.target.id,
+        hostDetail,
+        // Preserve a missing prompter as a capability gap, not a cancellation.
+        requestCredential: this.callbacks.onCredentialRequest
+          ? async (_targetId, kind, detail, echo) =>
+              (await this.requestCredential(kind, detail, connectGeneration, echo)) ?? null
+          : undefined,
+        getCachedPassword: () => this.cachedPassword,
+        setCachedPassword: (value) => {
+          if (isCurrent()) {
+            this.cachedPassword = value
+          }
+        },
+        markCancelled: () => {
+          // A stale prompt must not cancel the current attempt.
+          if (isCurrent()) {
+            this.keyboardInteractiveCancelled = true
+          }
+        },
+        isCancelled: () => !isCurrent() || this.keyboardInteractiveCancelled,
+        state: this.keyboardInteractivePasswordState
+      },
+      heading,
+      prompts,
+      onPromptStart
+    )
+    return isCurrent() ? responses : null
   }
 
   private async attemptConnect(connectGeneration = ++this.connectGeneration): Promise<void> {
@@ -784,6 +804,8 @@ export class SshConnection {
     this.setState('connecting')
     this.proxyProcess?.kill()
     this.proxyProcess = null
+    this.keyboardInteractiveCancelled = false
+    this.keyboardInteractivePasswordState = { passwordAutoAnswered: false }
 
     const resolved = await resolveWithSshG(this.target.configHost || this.target.label).catch(
       () => null
@@ -871,6 +893,13 @@ export class SshConnection {
         throw err
       }
 
+      // Cancellation must stop the credential and transport fallback chain.
+      if (this.keyboardInteractiveCancelled) {
+        this.proxyProcess?.kill()
+        this.proxyProcess = null
+        throw err
+      }
+
       if (isSystemSshFallbackError(err)) {
         this.proxyProcess?.kill()
         this.proxyProcess = null
@@ -918,6 +947,12 @@ export class SshConnection {
               this.proxyProcess = null
               throw keyErr
             }
+            // Key fallback must honor the same cancellation boundary.
+            if (this.keyboardInteractiveCancelled) {
+              this.proxyProcess?.kill()
+              this.proxyProcess = null
+              throw keyErr
+            }
             authError = keyErr
             const passphraseKeyPath = getPassphrasePrivateKeyPath(keyConfig)
             // Why: with GSSAPI enabled, let the reactive system-ssh probe try a Kerberos ticket before prompting for the passphrase; the prompt still runs if it fails.
@@ -1526,10 +1561,33 @@ export class SshConnection {
           return
         }
         rearmStartupTimer(SSH_KEYBOARD_INTERACTIVE_READY_TIMEOUT_MS)
-        void this.answerKeyboardInteractive(name, instructions, prompts, connectGeneration, () =>
-          rearmStartupTimer(SSH_KEYBOARD_INTERACTIVE_READY_TIMEOUT_MS)
+        void this.answerKeyboardInteractive(
+          config.host || this.target.label,
+          name,
+          instructions,
+          prompts,
+          connectGeneration,
+          () => rearmStartupTimer(SSH_KEYBOARD_INTERACTIVE_READY_TIMEOUT_MS)
         ).then(
           (responses) => {
+            // Settle cancellation immediately, but still answer ssh2’s pending callback.
+            if (
+              responses === null &&
+              (connectGeneration !== this.connectGeneration || this.keyboardInteractiveCancelled)
+            ) {
+              finish([])
+              if (!settled) {
+                // Preserve the auth-failed state for explicit cancellation.
+                const cancelledError = Object.assign(
+                  new Error(
+                    `Keyboard-interactive authentication cancelled for ${this.target.label}`
+                  ),
+                  { level: 'client-authentication' }
+                )
+                onStartupError(cancelledError)
+              }
+              return
+            }
             const attemptIsCurrent =
               !settled && !this.disposed && connectGeneration === this.connectGeneration
             finish(attemptIsCurrent ? (responses ?? []) : [])
diff --git a/src/main/ssh/ssh-keyboard-interactive-wire.test.ts b/src/main/ssh/ssh-keyboard-interactive-wire.test.ts
new file mode 100644
index 00000000000..5f45f27a52d
--- /dev/null
+++ b/src/main/ssh/ssh-keyboard-interactive-wire.test.ts
@@ -0,0 +1,118 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { Server, utils, type Connection } from 'ssh2'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { SshConnection } from './ssh-connection'
+import { createCallbacks, createResolvedConfig, createTarget } from './ssh-connection-test-fixtures'
+import { initSshHostKeyStoreFile } from './ssh-host-key-store'
+import { resolveWithSshG } from './ssh-config-parser'
+import type * as SshConfigParser from './ssh-config-parser'
+
+vi.mock('./ssh-config-parser', async (importOriginal) => ({
+  ...(await importOriginal<typeof SshConfigParser>()),
+  resolveWithSshG: vi.fn()
+}))
+
+describe('keyboard-interactive over a real SSH socket', () => {
+  let profile: string
+  let server: Server
+  let conn: SshConnection | undefined
+  const sockets = new Set<Connection>()
+
+  beforeEach(() => {
+    profile = mkdtempSync(join(tmpdir(), 'orca-keyboard-wire-'))
+    initSshHostKeyStoreFile(join(profile, 'host-keys.json'))
+    vi.stubEnv('SSH_AUTH_SOCK', '')
+    vi.mocked(resolveWithSshG).mockResolvedValue(
+      createResolvedConfig({
+        hostname: '127.0.0.1',
+        identitiesOnly: true,
+        identityAgent: 'none',
+        proxyUseFdpass: false,
+        strictHostKeyChecking: 'no'
+      })
+    )
+  })
+
+  afterEach(async () => {
+    await conn?.disconnect()
+    for (const socket of sockets) {
+      socket.end()
+    }
+    sockets.clear()
+    if (server) {
+      await new Promise<void>((resolve) => server.close(() => resolve()))
+    }
+    vi.unstubAllEnvs()
+    rmSync(profile, { recursive: true, force: true })
+  })
+
+  it.each([false, true])(
+    'completes password then MFA with empty push response=%s',
+    async (empty) => {
+      const received: string[][] = []
+      const methods: string[] = []
+      server = new Server(
+        { hostKeys: [utils.generateKeyPairSync('ecdsa', { bits: 256 }).private] },
+        (socket) => {
+          sockets.add(socket)
+          socket.on('error', () => {})
+          socket.on('close', () => sockets.delete(socket))
+          let passwordAccepted = false
+          socket.on('authentication', (context) => {
+            methods.push(context.method)
+            if (context.method === 'password' && context.password === 'fixture-password') {
+              passwordAccepted = true
+              context.reject(['keyboard-interactive'], true)
+            } else if (context.method === 'keyboard-interactive' && passwordAccepted) {
+              context.prompt(
+                [
+                  {
+                    prompt: empty ? 'Press Enter for push:' : 'Passcode or option (1-2):',
+                    echo: true
+                  }
+                ],
+                'MFA',
+                'Choose verification:',
+                (answers) => {
+                  received.push(answers)
+                  if (answers[0] === (empty ? '' : '1')) {
+                    context.accept()
+                  } else {
+                    context.reject(['keyboard-interactive'])
+                  }
+                }
+              )
+            } else {
+              context.reject(['password'])
+            }
+          })
+        }
+      )
+      await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+      const address = server.address()
+      if (!address || typeof address === 'string') {
+        throw new Error('Fixture did not bind')
+      }
+      const onCredentialRequest = vi.fn(async (_id: string, kind: string) =>
+        kind === 'password' ? 'fixture-password' : empty ? '' : '1'
+      )
+      conn = new SshConnection(
+        createTarget({ host: '127.0.0.1', port: address.port }),
+        createCallbacks({ onCredentialRequest })
+      )
+      await conn.connect()
+      expect(conn.getState().status).toBe('connected')
+      expect(received).toEqual([[empty ? '' : '1']])
+      expect(methods).toContain('password')
+      expect(onCredentialRequest).toHaveBeenLastCalledWith(
+        'target-1',
+        'keyboard-interactive',
+        `MFA\nChoose verification:\n${empty ? 'Press Enter for push:' : 'Passcode or option (1-2):'}`,
+        true,
+        expect.any(AbortSignal)
+      )
+    }
+  )
+})
diff --git a/src/main/ssh/ssh-keyboard-interactive.test.ts b/src/main/ssh/ssh-keyboard-interactive.test.ts
new file mode 100644
index 00000000000..0c426fbdb5f
--- /dev/null
+++ b/src/main/ssh/ssh-keyboard-interactive.test.ts
@@ -0,0 +1,215 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  collectKeyboardInteractiveResponses,
+  formatKeyboardInteractivePromptDetail,
+  isKeyboardInteractivePasswordPrompt,
+  type KeyboardInteractiveSession
+} from './ssh-keyboard-interactive'
+
+function createSession(
+  overrides: Partial<KeyboardInteractiveSession> = {}
+): KeyboardInteractiveSession & { cancelled: { value: boolean } } {
+  const cancelled = { value: false }
+  return {
+    targetId: 'target-1',
+    hostDetail: 'example.com',
+    requestCredential: vi.fn(async () => 'answer'),
+    getCachedPassword: () => null,
+    setCachedPassword: vi.fn(),
+    markCancelled: () => {
+      cancelled.value = true
+    },
+    isCancelled: () => cancelled.value,
+    state: { passwordAutoAnswered: false },
+    cancelled,
+    ...overrides
+  }
+}
+
+describe('isKeyboardInteractivePasswordPrompt', () => {
+  it('matches masked password prompts', () => {
+    expect(isKeyboardInteractivePasswordPrompt({ prompt: 'Password: ', echo: false })).toBe(true)
+    expect(isKeyboardInteractivePasswordPrompt({ prompt: "user@host's PASSWORD:" })).toBe(true)
+  })
+
+  it('rejects echoed prompts even when they mention a password', () => {
+    expect(isKeyboardInteractivePasswordPrompt({ prompt: 'Password: ', echo: true })).toBe(false)
+  })
+
+  it('rejects one-time password and OTP prompts', () => {
+    expect(isKeyboardInteractivePasswordPrompt({ prompt: 'One-time password:', echo: false })).toBe(
+      false
+    )
+    expect(isKeyboardInteractivePasswordPrompt({ prompt: 'OTP password code:', echo: false })).toBe(
+      false
+    )
+  })
+
+  it('rejects verification prompts that never mention a password', () => {
+    expect(isKeyboardInteractivePasswordPrompt({ prompt: 'Passcode:', echo: false })).toBe(false)
+    expect(isKeyboardInteractivePasswordPrompt({ prompt: 'Duo push sent', echo: false })).toBe(
+      false
+    )
+  })
+})
+
+describe('formatKeyboardInteractivePromptDetail', () => {
+  it('joins instructions and prompt on separate lines', () => {
+    expect(formatKeyboardInteractivePromptDetail('Pick an option:', 'Passcode: ')).toBe(
+      'Pick an option:\nPasscode:'
+    )
+  })
+
+  it('drops the missing half', () => {
+    expect(formatKeyboardInteractivePromptDetail('', 'Passcode: ')).toBe('Passcode:')
+    expect(formatKeyboardInteractivePromptDetail('Approve the push. ', '')).toBe(
+      'Approve the push.'
+    )
+  })
+})
+
+describe('collectKeyboardInteractiveResponses', () => {
+  it('forwards verification prompts with instructions and the echo flag', async () => {
+    const requestCredential = vi.fn(async () => '1')
+    const session = createSession({ requestCredential })
+
+    const responses = await collectKeyboardInteractiveResponses(session, 'Choose an option:', [
+      { prompt: 'Passcode or option (1-2):', echo: true }
+    ])
+
+    expect(responses).toEqual(['1'])
+    expect(requestCredential).toHaveBeenCalledWith(
+      'target-1',
+      'keyboard-interactive',
+      'Choose an option:\nPasscode or option (1-2):',
+      true
+    )
+  })
+
+  it('answers a password prompt from the cache without prompting', async () => {
+    const requestCredential = vi.fn(async () => 'unused')
+    const session = createSession({
+      requestCredential,
+      getCachedPassword: () => 'password-123'
+    })
+
+    const responses = await collectKeyboardInteractiveResponses(session, '', [
+      { prompt: 'Password: ', echo: false }
+    ])
+
+    expect(responses).toEqual(['password-123'])
+    expect(requestCredential).not.toHaveBeenCalled()
+    expect(session.state.passwordAutoAnswered).toBe(true)
+  })
+
+  it('re-prompts when the server rejects the auto-answered cached password', async () => {
+    const requestCredential = vi.fn(async () => 'corrected-password')
+    const setCachedPassword = vi.fn()
+    const session = createSession({
+      requestCredential,
+      getCachedPassword: () => 'stale-password',
+      setCachedPassword,
+      state: { passwordAutoAnswered: true }
+    })
+
+    const responses = await collectKeyboardInteractiveResponses(session, '', [
+      { prompt: 'Password: ', echo: false }
+    ])
+
+    expect(responses).toEqual(['corrected-password'])
+    expect(requestCredential).toHaveBeenCalledWith('target-1', 'password', 'example.com')
+    expect(setCachedPassword).toHaveBeenCalledWith('corrected-password')
+  })
+
+  it('collects and caches the password when nothing is cached yet', async () => {
+    const requestCredential = vi.fn(async () => 'password-123')
+    const setCachedPassword = vi.fn()
+    const session = createSession({ requestCredential, setCachedPassword })
+
+    const responses = await collectKeyboardInteractiveResponses(session, '', [
+      { prompt: 'Password: ', echo: false },
+      { prompt: 'Duo push approval', echo: false }
+    ])
+
+    expect(responses).toEqual(['password-123', 'password-123'])
+    expect(requestCredential).toHaveBeenNthCalledWith(1, 'target-1', 'password', 'example.com')
+    expect(requestCredential).toHaveBeenNthCalledWith(
+      2,
+      'target-1',
+      'keyboard-interactive',
+      'Duo push approval',
+      false
+    )
+    expect(setCachedPassword).toHaveBeenCalledWith('password-123')
+  })
+
+  it('returns null and marks the session cancelled when the user dismisses a prompt', async () => {
+    const session = createSession({ requestCredential: vi.fn(async () => null) })
+
+    const responses = await collectKeyboardInteractiveResponses(session, '', [
+      { prompt: 'Duo passcode:', echo: false }
+    ])
+
+    expect(responses).toBeNull()
+    expect(session.isCancelled()).toBe(true)
+  })
+
+  it('short-circuits every later round once cancelled', async () => {
+    const requestCredential = vi.fn(async () => 'answer')
+    const session = createSession({ requestCredential })
+    session.markCancelled()
+
+    const responses = await collectKeyboardInteractiveResponses(session, '', [
+      { prompt: 'Duo passcode:', echo: false }
+    ])
+
+    expect(responses).toBeNull()
+    expect(requestCredential).not.toHaveBeenCalled()
+  })
+
+  it('returns null when no credential prompter is available', async () => {
+    const session = createSession({ requestCredential: undefined })
+
+    const responses = await collectKeyboardInteractiveResponses(session, '', [
+      { prompt: 'Password: ', echo: false }
+    ])
+
+    expect(responses).toBeNull()
+  })
+
+  it('discards a password resolved after the attempt is cancelled', async () => {
+    let answer: (value: string) => void = () => {}
+    const requestCredential = vi
+      .fn(async () => 'code')
+      .mockImplementationOnce(
+        () =>
+          new Promise<string>((resolve) => {
+            answer = resolve
+          })
+      )
+    const setCachedPassword = vi.fn()
+    const session = createSession({ requestCredential, setCachedPassword })
+    const collecting = collectKeyboardInteractiveResponses(session, '', [
+      { prompt: 'Password:', echo: false },
+      { prompt: 'Code:', echo: false }
+    ])
+    session.markCancelled()
+    answer('obsolete-password')
+    expect(await collecting).toBeNull()
+    expect(setCachedPassword).not.toHaveBeenCalled()
+    expect(requestCredential).toHaveBeenCalledTimes(1)
+  })
+
+  it('accepts an empty response without caching it as a password', async () => {
+    const requestCredential = vi.fn(async () => '')
+    const setCachedPassword = vi.fn()
+    const session = createSession({ requestCredential, setCachedPassword })
+
+    const responses = await collectKeyboardInteractiveResponses(session, '', [
+      { prompt: 'Password: ', echo: false }
+    ])
+
+    expect(responses).toEqual([''])
+    expect(setCachedPassword).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/ssh/ssh-keyboard-interactive.ts b/src/main/ssh/ssh-keyboard-interactive.ts
new file mode 100644
index 00000000000..fae20287848
--- /dev/null
+++ b/src/main/ssh/ssh-keyboard-interactive.ts
@@ -0,0 +1,111 @@
+import type { Prompt } from 'ssh2'
+import type { SshConnectionCallbacks } from './ssh-connection-utils'
+
+// Why: servers commonly reuse keyboard-interactive (RFC 4256) to collect the
+// login password itself before issuing MFA challenges. Password-looking
+// prompts route through the password credential flow (and its cache) so
+// reconnects stay silent; every other prompt needs a fresh human answer.
+const PASSWORD_PROMPT = /password/i
+// Why: a one-time code answered with the cached login password would burn MFA
+// attempts (and can lock the account) on every reconnect.
+const ONE_TIME_PROMPT = /one.?time|otp/i
+// Why: bounds a malicious/misbehaving server's prompt text before it reaches the credential dialog.
+const PROMPT_DETAIL_MAX = 4_096
+
+export function isKeyboardInteractivePasswordPrompt(prompt: Prompt): boolean {
+  return (
+    prompt.echo !== true &&
+    PASSWORD_PROMPT.test(prompt.prompt) &&
+    !ONE_TIME_PROMPT.test(prompt.prompt)
+  )
+}
+
+export function formatKeyboardInteractivePromptDetail(
+  instructions: string,
+  promptText: string
+): string {
+  const trimmedInstructions = instructions.trim()
+  const trimmedPrompt = promptText.trim()
+  const detail =
+    !trimmedInstructions || !trimmedPrompt
+      ? trimmedInstructions || trimmedPrompt
+      : `${trimmedInstructions}\n${trimmedPrompt}`
+  return detail.slice(0, PROMPT_DETAIL_MAX)
+}
+
+export type KeyboardInteractiveSession = {
+  targetId: string
+  hostDetail: string
+  requestCredential: SshConnectionCallbacks['onCredentialRequest']
+  getCachedPassword: () => string | null
+  setCachedPassword: (value: string) => void
+  markCancelled: () => void
+  isCancelled: () => boolean
+  // Why: one cached-password auto-answer per connection attempt — a second
+  // password prompt in the same attempt means the server rejected the cached
+  // value, so the user must be asked again instead of looping a bad password.
+  state: { passwordAutoAnswered: boolean }
+}
+
+// Answers one keyboard-interactive round. Returns null when the user
+// cancelled (or no prompter is available); callers respond with no answers so
+// the server fails the round and the regular auth-error flow takes over.
+export async function collectKeyboardInteractiveResponses(
+  session: KeyboardInteractiveSession,
+  instructions: string,
+  prompts: Prompt[],
+  onPromptStart?: () => void
+): Promise<string[] | null> {
+  if (session.isCancelled()) {
+    return null
+  }
+  // Why: a missing prompter is a capability gap, not a user decision — it
+  // must return null WITHOUT calling markCancelled(), or SshConnection would
+  // treat it as an explicit decline and skip its passphrase/password rungs.
+  if (!session.requestCredential) {
+    return null
+  }
+  const responses: string[] = []
+  for (const prompt of prompts) {
+    onPromptStart?.()
+    const value = isKeyboardInteractivePasswordPrompt(prompt)
+      ? await answerPasswordPrompt(session)
+      : await session.requestCredential(
+          session.targetId,
+          'keyboard-interactive',
+          formatKeyboardInteractivePromptDetail(instructions, prompt.prompt),
+          prompt.echo
+        )
+    if (session.isCancelled()) {
+      return null
+    }
+    if (value == null) {
+      session.markCancelled()
+      return null
+    }
+    responses.push(value)
+  }
+  return responses
+}
+
+async function answerPasswordPrompt(
+  session: KeyboardInteractiveSession
+): Promise<string | null | undefined> {
+  const cached = session.getCachedPassword()
+  if (cached != null && !session.state.passwordAutoAnswered) {
+    session.state.passwordAutoAnswered = true
+    return cached
+  }
+  const value = await session.requestCredential?.(session.targetId, 'password', session.hostDetail)
+  if (session.isCancelled()) {
+    return null
+  }
+  if (value == null) {
+    return value
+  }
+  session.state.passwordAutoAnswered = true
+  if (value) {
+    session.setCachedPassword(value)
+  }
+  return value
+}
diff --git a/src/main/ssh/ssh-orphan-relay-pty-sweep.test.ts b/src/main/ssh/ssh-orphan-relay-pty-sweep.test.ts
index afb365c075c..7a503f51867 100644
--- a/src/main/ssh/ssh-orphan-relay-pty-sweep.test.ts
+++ b/src/main/ssh/ssh-orphan-relay-pty-sweep.test.ts
@@ -214,7 +214,7 @@ describe('sweepOrphanedRelayPtys', () => {
       clearBindingsForTarget: () => {},
       clearBindingsForLeases: () => false,
       flush: () => {},
-      flushDurableStateOrThrowAsync: async () => {}
+      runDurableMutation: async (mutate) => mutate().value
     }
     // The same pane re-leases under a new relay id; pty-1 is expired, never terminated.
     upsertSshRemotePtyLease(operations, {
diff --git a/src/main/ssh/ssh-pending-pty-kill-replay.test.ts b/src/main/ssh/ssh-pending-pty-kill-replay.test.ts
index 7f682c6c1b6..95296aa6434 100644
--- a/src/main/ssh/ssh-pending-pty-kill-replay.test.ts
+++ b/src/main/ssh/ssh-pending-pty-kill-replay.test.ts
@@ -134,6 +134,28 @@ describe('replayPendingSshPtyKills', () => {
     expect(terminated).toEqual(['pty-1'])
   })
 
+  // An offline close across a relaunch never learned the incarnation; the epoch-scoped id is the fence.
+  it('replays an epoch-scoped stop that carries no incarnation', async () => {
+    const relayPtyId = 'pty2:epoch-a:4'
+    const { store, cleared, terminated } = createStoreStub([
+      { ptyId: relayPtyId, intent: { requestedAt: NOW, attempts: 0 } }
+    ])
+    const { provider, shutdown } = createProviderStub([{ relayPtyId, incarnationId: 'inc-live' }])
+    await replayPendingSshPtyKills({
+      targetId: TARGET,
+      store,
+      provider,
+      shouldContinue: () => true,
+      now: () => NOW
+    })
+    expect(shutdown).toHaveBeenCalledWith(`ssh:ssh-1@@${relayPtyId}`, {
+      immediate: true,
+      expectedIncarnationId: undefined
+    })
+    expect(cleared).toEqual([relayPtyId])
+    expect(terminated).toEqual([relayPtyId])
+  })
+
   // #16970: a redeployed relay renumbers from pty-1, so this id now names someone else's shell.
   it('refuses to kill a recycled relay id and expires the lease that named it', async () => {
     const { store, cleared, terminated, expired, recycled } = createStoreStub([
diff --git a/src/main/ssh/ssh-pty-consumer-recovery.ts b/src/main/ssh/ssh-pty-consumer-recovery.ts
index db49a45c399..727f293b572 100644
--- a/src/main/ssh/ssh-pty-consumer-recovery.ts
+++ b/src/main/ssh/ssh-pty-consumer-recovery.ts
@@ -96,10 +96,7 @@ export async function removeSshPtyConsumerOwnerRecovery(
   clientInstanceId: string,
   store: Store
 ): Promise<void> {
-  const persisted = store.getSshPtyConsumerRecovery(targetId)
-  if (persisted?.clientInstanceId === clientInstanceId) {
-    await store.removeSshPtyConsumerRecovery(targetId)
-  }
+  await store.removeSshPtyConsumerRecovery(targetId, clientInstanceId)
 }
 
 export function detachSshPtyConsumerRecovery(targetId: string, clientInstanceId: string): void {
diff --git a/src/main/ssh/ssh-relay-cross-version-isolation.test.ts b/src/main/ssh/ssh-relay-cross-version-isolation.test.ts
index acda3bf0d69..be66463206a 100644
--- a/src/main/ssh/ssh-relay-cross-version-isolation.test.ts
+++ b/src/main/ssh/ssh-relay-cross-version-isolation.test.ts
@@ -45,6 +45,10 @@ vi.mock('./ssh-remote-node-resolution', () => ({
   resolveRemoteNodePath: vi.fn().mockResolvedValue('/usr/bin/node')
 }))
 
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('not-needed')
+}))
+
 vi.mock('./ssh-relay-install-marker', async (importOriginal) => ({
   ...(await importOriginal<typeof RelayInstallMarkerModule>()),
   createRelayInstallMarkerFileName: () => '.sftp-namespace-00000000000000000000000000000000'
diff --git a/src/main/ssh/ssh-relay-deploy-incumbent-verdict.test.ts b/src/main/ssh/ssh-relay-deploy-incumbent-verdict.test.ts
index ef90e829f7b..4826f3c4dcc 100644
--- a/src/main/ssh/ssh-relay-deploy-incumbent-verdict.test.ts
+++ b/src/main/ssh/ssh-relay-deploy-incumbent-verdict.test.ts
@@ -1,5 +1,8 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', () => ({
   remoteRipgrepLayout: vi.fn().mockReturnValue(null),
   recordRemoteRipgrepReference: vi.fn().mockResolvedValue(false),
@@ -64,6 +67,7 @@ vi.mock('./ssh-relay-superseded-endpoints', () => ({
   sweepSupersededRelayEndpoints: vi.fn().mockResolvedValue([])
 }))
 import { sweepSupersededRelayEndpoints } from './ssh-relay-superseded-endpoints'
+import { ensureRemoteOpenCodeRuntime } from './ssh-relay-opencode-runtime'
 import { gcOldRelayVersions } from './ssh-relay-versioned-install'
 import { deployAndLaunchRelay } from './ssh-relay-deploy'
 import { execCommand, waitForSentinel } from './ssh-relay-deploy-helpers'
@@ -198,10 +202,18 @@ describe('deployAndLaunchRelay honours the incumbent verdict', () => {
         onClose: vi.fn()
       })
       vi.mocked(sweepSupersededRelayEndpoints).mockRejectedValueOnce(error)
-      await deployAndLaunchRelay(makeMockConnection())
+      vi.mocked(ensureRemoteOpenCodeRuntime).mockResolvedValueOnce('not-needed')
+      const result = await deployAndLaunchRelay(makeMockConnection())
       await vi.waitFor(() => expect(sweepSupersededRelayEndpoints).toHaveBeenCalledOnce())
       await new Promise((resolve) => setImmediate(resolve))
       expect(gcOldRelayVersions).toHaveBeenCalledTimes(expectedGcCalls)
+      const now = vi.spyOn(Date, 'now').mockReturnValue(Date.now() + 120_000)
+      try {
+        await result.prepareOpenCodeRuntime?.(new AbortController().signal)
+        expect(ensureRemoteOpenCodeRuntime).toHaveBeenCalledTimes(expectedGcCalls + 1)
+      } finally {
+        now.mockRestore()
+      }
     }
   )
 })
diff --git a/src/main/ssh/ssh-relay-deploy-staged-upload.test.ts b/src/main/ssh/ssh-relay-deploy-staged-upload.test.ts
index 467ddc5f788..26ba5a2d990 100644
--- a/src/main/ssh/ssh-relay-deploy-staged-upload.test.ts
+++ b/src/main/ssh/ssh-relay-deploy-staged-upload.test.ts
@@ -52,6 +52,9 @@ vi.mock('./ssh-remote-node-resolution', () => ({
 // Why: the post-launch ripgrep install is fire-and-forget and would drain the queued exec mocks.
 // Why: the post-launch ripgrep cache GC is fire-and-forget and would drain the queued exec mocks.
 vi.mock('./ssh-relay-ripgrep-cache-gc', () => ({ gcRemoteRipgrepCache: vi.fn() }))
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', async (importOriginal) => ({
   ...(await importOriginal<typeof RelayRipgrepInstallModule>()),
   ensureRemoteBundledRipgrep: vi.fn().mockResolvedValue('present'),
@@ -320,6 +323,70 @@ describe('deployAndLaunchRelay staged uploads', () => {
     expect(uploadStageRemovals[0]).toContain('/.orca-remote/.upload-stages/claim-0')
   })
 
+  it.each(['lock acquisition', 'locked recheck'])(
+    'preserves the stage after uncertain %s termination',
+    async (phase) => {
+      const conn = makeMockConnection()
+      const error = Object.assign(new Error('install command still running'), {
+        sshChannelCloseConfirmed: false
+      })
+      vi.mocked(isRelayAlreadyInstalled).mockResolvedValueOnce(false)
+      if (phase === 'lock acquisition') {
+        vi.mocked(acquireInstallLock).mockRejectedValueOnce(error)
+      } else {
+        vi.mocked(isRelayAlreadyInstalled).mockRejectedValueOnce(error)
+      }
+      vi.mocked(execCommand).mockImplementation(async (_conn, command) => {
+        if (command.includes('uname')) {
+          return '__ORCA_REMOTE_PLATFORM__ Linux x86_64'
+        }
+        if (command === 'echo $HOME') {
+          return '/home/user'
+        }
+        return stageCommandResponse(command) ?? ''
+      })
+      conn.writeFile = vi.fn().mockResolvedValue(undefined)
+      conn.uploadDirectory = vi.fn().mockResolvedValue(undefined)
+
+      await expect(deployAndLaunchRelay(conn)).rejects.toBe(error)
+      expect(
+        vi
+          .mocked(execCommand)
+          .mock.calls.some(
+            ([, command]) =>
+              /\.sftp-namespace-[0-9a-f]{32}/u.test(command) && command.includes('rm -rf')
+          )
+      ).toBe(false)
+      expect(conn.exec).not.toHaveBeenCalled()
+    }
+  )
+
+  it('stops before launch when owned-stage cleanup cannot confirm termination', async () => {
+    const conn = makeMockConnection()
+    const error = Object.assign(new Error('stage removal still running'), {
+      sshChannelCloseConfirmed: false
+    })
+    vi.mocked(isRelayAlreadyInstalled).mockResolvedValueOnce(false).mockResolvedValueOnce(true)
+    vi.mocked(execCommand).mockImplementation(async (_conn, command) => {
+      if (/\.sftp-namespace-[0-9a-f]{32}/u.test(command) && command.includes('rm -rf')) {
+        throw error
+      }
+      if (command.includes('uname')) {
+        return '__ORCA_REMOTE_PLATFORM__ Linux x86_64'
+      }
+      if (command === 'echo $HOME') {
+        return '/home/user'
+      }
+      return stageCommandResponse(command) ?? ''
+    })
+    conn.writeFile = vi.fn().mockResolvedValue(undefined)
+    conn.uploadDirectory = vi.fn().mockResolvedValue(undefined)
+
+    await expect(deployAndLaunchRelay(conn)).rejects.toBe(error)
+    expect(conn.exec).not.toHaveBeenCalled()
+    expect(ensureRemoteBundledRipgrep).not.toHaveBeenCalled()
+  })
+
   it('runs bounded fixed-path recovery before a fresh upload', async () => {
     const conn = makeMockConnection()
     const events: string[] = []
@@ -399,6 +466,7 @@ describe('deployAndLaunchRelay staged uploads', () => {
       await deployAndLaunchRelay(conn)
     }
 
+    await vi.waitFor(() => expect(events).toHaveLength(24))
     expect(events).toEqual(Array.from({ length: 12 }, () => ['launch-ready', 'recover']).flat())
     const commands = vi.mocked(execCommand).mock.calls.map(([, command]) => command)
     const recoveryCommands = commands.filter((command) => command.includes('deleting_old='))
@@ -575,12 +643,15 @@ describe('deployAndLaunchRelay staged uploads', () => {
     await deployAndLaunchRelay(conn)
     expect(conn.uploadDirectory).toHaveBeenCalledTimes(2)
   })
-  // Why: a cold host's rg upload is a multi-MB transfer. While the cleanup sweep was chained
-  // behind it, stale upload stages and superseded version dirs sat on the remote for that whole
-  // duration. A never-settling install stands in for that transfer.
-  it('sweeps stale upload stages without waiting for the ripgrep upload', async () => {
+  it('returns the relay before ripgrep finishes but defers stale-stage cleanup', async () => {
     const conn = makeMockConnection()
-    vi.mocked(ensureRemoteBundledRipgrep).mockReturnValueOnce(new Promise(() => {}))
+    let finishUpload = (): void => {}
+    vi.mocked(ensureRemoteBundledRipgrep).mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          finishUpload = () => resolve('present')
+        })
+    )
     let socketProbe = 0
     vi.mocked(execCommand).mockImplementation((_conn, command) => {
       if (command.includes('uname')) {
@@ -595,7 +666,15 @@ describe('deployAndLaunchRelay staged uploads', () => {
       return Promise.resolve('')
     })
 
-    await deployAndLaunchRelay(conn)
+    const deployed = await deployAndLaunchRelay(conn)
+    expect(deployed.transport).toBeDefined()
+    await new Promise<void>((resolve) => setImmediate(resolve))
+    expect(
+      vi
+        .mocked(execCommand)
+        .mock.calls.some(([, command]) => command.includes(RELAY_UPLOAD_STAGE_POOL_NAME))
+    ).toBe(false)
+    finishUpload()
 
     await vi.waitFor(() => {
       const commands = vi.mocked(execCommand).mock.calls.map(([, command]) => command)
diff --git a/src/main/ssh/ssh-relay-deploy-windows-pipe.test.ts b/src/main/ssh/ssh-relay-deploy-windows-pipe.test.ts
index 4c913234117..1a49ec11590 100644
--- a/src/main/ssh/ssh-relay-deploy-windows-pipe.test.ts
+++ b/src/main/ssh/ssh-relay-deploy-windows-pipe.test.ts
@@ -64,6 +64,9 @@ vi.mock('../ripgrep/bundled-ripgrep-path', () => ({
 // Why: the fire-and-forget ripgrep install would drain the queued exec mocks.
 // Why: the post-launch ripgrep cache GC is fire-and-forget and would drain the queued exec mocks.
 vi.mock('./ssh-relay-ripgrep-cache-gc', () => ({ gcRemoteRipgrepCache: vi.fn() }))
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', async (importOriginal) => ({
   ...(await importOriginal<typeof RelayRipgrepInstallModule>()),
   ensureRemoteBundledRipgrep: vi.fn().mockResolvedValue('present'),
@@ -310,6 +313,7 @@ describe('deployAndLaunchRelay on Windows remotes', () => {
       .mockResolvedValueOnce('')
       .mockResolvedValueOnce('READY')
       .mockResolvedValueOnce('') // persist active pipe A
+      .mockResolvedValueOnce('') // deferred stale-stage cleanup A
       .mockRejectedValueOnce(new Error('uname not found')) // tagged POSIX platform probe B
       .mockResolvedValueOnce('__ORCA_REMOTE_PLATFORM__ Windows X64')
       .mockResolvedValueOnce('C:\\Users\\me user')
@@ -321,6 +325,7 @@ describe('deployAndLaunchRelay on Windows remotes', () => {
       .mockResolvedValueOnce('') // persist active pipe B
 
     await deployAndLaunchRelay(connA, undefined, 300, 'target-a')
+    await new Promise<void>((resolve) => setImmediate(resolve))
     await deployAndLaunchRelay(connB, undefined, 300, 'target-b')
 
     const markerPaths = mockExecCommand.mock.calls
diff --git a/src/main/ssh/ssh-relay-deploy.test.ts b/src/main/ssh/ssh-relay-deploy.test.ts
index f2fdaee4ed2..27a70f60fdb 100644
--- a/src/main/ssh/ssh-relay-deploy.test.ts
+++ b/src/main/ssh/ssh-relay-deploy.test.ts
@@ -62,6 +62,9 @@ vi.mock('../ripgrep/bundled-ripgrep-path', () => ({
 // Why: the fire-and-forget ripgrep install would drain the queued exec mocks.
 // Why: the post-launch ripgrep cache GC is fire-and-forget and would drain the queued exec mocks.
 vi.mock('./ssh-relay-ripgrep-cache-gc', () => ({ gcRemoteRipgrepCache: vi.fn() }))
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', async (importOriginal) => ({
   ...(await importOriginal<typeof RelayRipgrepInstallModule>()),
   ensureRemoteBundledRipgrep: vi.fn().mockResolvedValue('present'),
@@ -97,6 +100,7 @@ vi.mock('./ssh-connection-utils', () => ({
 }))
 
 import { deployAndLaunchRelay } from './ssh-relay-deploy'
+import { ensureRemoteOpenCodeRuntime } from './ssh-relay-opencode-runtime'
 import { execCommand, waitForSentinel } from './ssh-relay-deploy-helpers'
 import { resolveRemoteNodePath } from './ssh-remote-node-resolution'
 import { isRelayAlreadyInstalled, gcOldRelayVersions } from './ssh-relay-versioned-install'
@@ -105,6 +109,7 @@ import {
   ensureRemoteBundledRipgrep,
   recordRemoteRipgrepReference
 } from './ssh-relay-ripgrep-install'
+import { gcRemoteRipgrepCache } from './ssh-relay-ripgrep-cache-gc'
 import * as DeployTiming from './ssh-relay-deploy-timing'
 import type { SshConnection } from './ssh-connection'
 import type * as SshRemoteNodeResolution from './ssh-remote-node-resolution'
@@ -162,6 +167,7 @@ function detachedLaunchCommand(conn: SshConnection): string | undefined {
 describe('deployAndLaunchRelay', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    vi.mocked(ensureRemoteOpenCodeRuntime).mockReset().mockResolvedValue('ready')
     vi.mocked(execCommand).mockReset().mockResolvedValue('__ORCA_REMOTE_PLATFORM__ Linux x86_64')
     vi.mocked(waitForSentinel).mockReset().mockResolvedValue({
       write: vi.fn(),
@@ -445,24 +451,35 @@ describe('deployAndLaunchRelay', () => {
     expect(resolveRemoteNodePath).toHaveBeenCalledTimes(1)
   })
 
-  it('does not retry when a session-limit failure races with a real install-state failure', async () => {
-    const conn = makeMockConnection()
-    const mockExecCommand = vi.mocked(execCommand)
-    const sessionLimitError = Object.assign(new Error('(SSH) Channel open failure: open failed'), {
-      reason: 4
-    })
-    const installError = new Error('permission denied while checking relay install')
-    vi.mocked(resolveRemoteNodePath).mockRejectedValueOnce(sessionLimitError)
-    vi.mocked(isRelayAlreadyInstalled).mockRejectedValueOnce(installError)
-    mockExecCommand.mockResolvedValueOnce('__ORCA_REMOTE_PLATFORM__ Linux x86_64') // tagged POSIX platform probe
-    mockExecCommand.mockResolvedValueOnce('/home/user') // concurrent install-state $HOME
+  it.each([false, true])(
+    'does not retry after a sibling failure (unconfirmed abort: %s)',
+    async (unconfirmed) => {
+      const conn = makeMockConnection()
+      const mockExecCommand = vi.mocked(execCommand)
+      const sessionLimitError = Object.assign(
+        new Error('(SSH) Channel open failure: open failed'),
+        {
+          reason: 4
+        }
+      )
+      const installError = unconfirmed
+        ? Object.assign(new Error('probe still running'), {
+            name: 'AbortError',
+            sshChannelCloseConfirmed: false
+          })
+        : new Error('permission denied while checking relay install')
+      vi.mocked(resolveRemoteNodePath).mockRejectedValueOnce(sessionLimitError)
+      vi.mocked(isRelayAlreadyInstalled).mockRejectedValueOnce(installError)
+      mockExecCommand.mockResolvedValueOnce('__ORCA_REMOTE_PLATFORM__ Linux x86_64') // tagged POSIX platform probe
+      mockExecCommand.mockResolvedValueOnce('/home/user') // concurrent install-state $HOME
 
-    await expect(deployAndLaunchRelay(conn)).rejects.toBe(installError)
-    expect(isRelayAlreadyInstalled).toHaveBeenCalledTimes(1)
-    expect(resolveRemoteNodePath).toHaveBeenCalledTimes(1)
-  })
+      await expect(deployAndLaunchRelay(conn)).rejects.toBe(installError)
+      expect(isRelayAlreadyInstalled).toHaveBeenCalledTimes(1)
+      expect(resolveRemoteNodePath).toHaveBeenCalledTimes(1)
+    }
+  )
 
-  it('does not retry until the surviving first-attempt probe settles', async () => {
+  it('lets the surviving probe finish before retrying a refused SSH session', async () => {
     const conn = makeMockConnection()
     const mockExecCommand = vi.mocked(execCommand)
     const sessionLimitError = Object.assign(new Error('(SSH) Channel open failure: open failed'), {
@@ -471,13 +488,19 @@ describe('deployAndLaunchRelay', () => {
     mockExecCommand.mockResolvedValueOnce('__ORCA_REMOTE_PLATFORM__ Linux x86_64') // tagged POSIX platform probe
     let releaseRemoteHome: (home: string) => void = () => {}
     let remoteHomeSettled = false
-    mockExecCommand.mockReturnValueOnce(
-      new Promise<string>((resolve) => {
-        releaseRemoteHome = (home: string) => {
-          remoteHomeSettled = true
-          resolve(home)
-        }
-      })
+    const cancelledProbe = Object.assign(new Error('system SSH probe cancellation unconfirmed'), {
+      name: 'AbortError',
+      sshChannelCloseConfirmed: false
+    })
+    mockExecCommand.mockImplementationOnce(
+      (_conn, _command, options) =>
+        new Promise<string>((resolve, reject) => {
+          options?.signal?.addEventListener('abort', () => reject(cancelledProbe), { once: true })
+          releaseRemoteHome = (home: string) => {
+            remoteHomeSettled = true
+            resolve(home)
+          }
+        })
     )
     vi.mocked(resolveRemoteNodePath).mockImplementationOnce(() => Promise.reject(sessionLimitError))
     vi.mocked(resolveRemoteNodePath).mockImplementationOnce(() => {
@@ -487,7 +510,7 @@ describe('deployAndLaunchRelay', () => {
       return Promise.resolve('/usr/bin/node')
     })
 
-    const deployPromise = deployAndLaunchRelay(conn)
+    const deployPromise = deployAndLaunchRelay(conn).catch((error: unknown) => error)
     await vi.waitFor(() => expect(resolveRemoteNodePath).toHaveBeenCalledTimes(1))
     await new Promise<void>((resolve) => setImmediate(resolve))
     expect(resolveRemoteNodePath).toHaveBeenCalledTimes(1)
@@ -497,7 +520,7 @@ describe('deployAndLaunchRelay', () => {
     queueLaunchNamespaceAndDeadSocketProbe()
     mockExecCommand.mockResolvedValueOnce('READY') // socket poll
     releaseRemoteHome('/home/user')
-    await deployPromise
+    await expect(deployPromise).resolves.toHaveProperty('transport')
     expect(resolveRemoteNodePath).toHaveBeenCalledTimes(2)
   })
 
@@ -525,11 +548,16 @@ describe('deployAndLaunchRelay', () => {
     expect(launchCommand).not.toContain('.pty-source-credit-policy')
   })
 
-  it.each([false, true])(
-    'waits for the ripgrep upload before cleanup (upload failure: %s)',
-    async (fails) => {
+  it.each([
+    [false, false],
+    [false, true],
+    [true, false],
+    [true, true]
+  ])(
+    'waits for ripgrep before cleanup (concurrent exec: %s, upload failure: %s)',
+    async (concurrent, fails) => {
       const conn = makeMockConnection()
-      vi.mocked(conn.canRunConcurrentExecCommands).mockReturnValue(false)
+      vi.mocked(conn.canRunConcurrentExecCommands).mockReturnValue(concurrent)
       queueFreshLinuxDeploy()
       let finishUpload = (): void => {}
       vi.mocked(ensureRemoteBundledRipgrep).mockImplementationOnce(
@@ -544,11 +572,36 @@ describe('deployAndLaunchRelay', () => {
       await new Promise<void>((resolve) => setImmediate(resolve))
       expect(execCommand).toHaveBeenCalledTimes(execCount)
       expect(gcOldRelayVersions).not.toHaveBeenCalled()
+      expect(ensureRemoteOpenCodeRuntime).toHaveBeenCalledTimes(concurrent ? 1 : 0)
       finishUpload()
       await vi.waitFor(() => expect(gcOldRelayVersions).toHaveBeenCalledOnce())
     }
   )
 
+  it.each([false, true])(
+    'waits for SQLite setup before cleanup (concurrent exec: %s)',
+    async (concurrent) => {
+      const conn = makeMockConnection()
+      vi.mocked(conn.canRunConcurrentExecCommands).mockReturnValue(concurrent)
+      queueFreshLinuxDeploy()
+      let finishSetup!: () => void
+      vi.mocked(ensureRemoteOpenCodeRuntime).mockImplementationOnce(
+        () =>
+          new Promise((resolve) => {
+            finishSetup = () => resolve('failed')
+          })
+      )
+      await deployAndLaunchRelay(conn)
+      await vi.waitFor(() => expect(ensureRemoteOpenCodeRuntime).toHaveBeenCalledOnce())
+      const execCount = vi.mocked(execCommand).mock.calls.length
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(execCommand).toHaveBeenCalledTimes(execCount)
+      expect(gcOldRelayVersions).not.toHaveBeenCalled()
+      finishSetup()
+      await vi.waitFor(() => expect(gcOldRelayVersions).toHaveBeenCalledOnce())
+    }
+  )
+
   it('does not launch or upload an unprotected binary when recording its reference fails', async () => {
     const conn = makeMockConnection()
     queueFreshLinuxDeploy()
@@ -558,6 +611,84 @@ describe('deployAndLaunchRelay', () => {
     expect(ensureRemoteBundledRipgrep).not.toHaveBeenCalled()
   })
 
+  it.each([false, true])(
+    'skips cleanup after unconfirmed SQLite teardown (concurrent exec: %s)',
+    async (concurrent) => {
+      const conn = makeMockConnection()
+      vi.mocked(conn.canRunConcurrentExecCommands).mockReturnValue(concurrent)
+      queueFreshLinuxDeploy()
+      vi.mocked(ensureRemoteOpenCodeRuntime).mockResolvedValueOnce('teardown-unconfirmed')
+      await deployAndLaunchRelay(conn)
+      await vi.waitFor(() => expect(ensureRemoteOpenCodeRuntime).toHaveBeenCalledOnce())
+      const execCount = vi.mocked(execCommand).mock.calls.length
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(execCommand).toHaveBeenCalledTimes(execCount)
+      expect(gcOldRelayVersions).not.toHaveBeenCalled()
+      expect(gcRemoteRipgrepCache).not.toHaveBeenCalled()
+    }
+  )
+
+  it('does not launch after an unconfirmed ripgrep reference write', async () => {
+    const conn = makeMockConnection()
+    queueFreshLinuxDeploy()
+    const error = Object.assign(new Error('reference write still running'), {
+      sshChannelCloseConfirmed: false
+    })
+    vi.mocked(recordRemoteRipgrepReference).mockRejectedValueOnce(error)
+
+    await expect(deployAndLaunchRelay(conn)).rejects.toBe(error)
+    expect(detachedLaunchCommand(conn)).toBeUndefined()
+    expect(ensureRemoteBundledRipgrep).not.toHaveBeenCalled()
+  })
+
+  it.each([false, true])(
+    'blocks cleanup and runtime retry after uncertain ripgrep teardown (concurrent exec: %s)',
+    async (concurrent) => {
+      const conn = makeMockConnection()
+      vi.mocked(conn.canRunConcurrentExecCommands).mockReturnValue(concurrent)
+      queueFreshLinuxDeploy()
+      vi.mocked(ensureRemoteBundledRipgrep).mockRejectedValueOnce(
+        Object.assign(new Error('upload still running'), { sshChannelCloseConfirmed: false })
+      )
+      vi.mocked(ensureRemoteOpenCodeRuntime).mockResolvedValue('failed')
+      const deployed = await deployAndLaunchRelay(conn)
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(gcOldRelayVersions).not.toHaveBeenCalled()
+      expect(gcRemoteRipgrepCache).not.toHaveBeenCalled()
+      const execCount = vi.mocked(execCommand).mock.calls.length
+      const clock = vi.spyOn(Date, 'now').mockReturnValue(Date.now() + 60_001)
+      try {
+        await deployed.prepareOpenCodeRuntime?.(new AbortController().signal)
+        expect(ensureRemoteOpenCodeRuntime).toHaveBeenCalledTimes(concurrent ? 1 : 0)
+        expect(execCommand).toHaveBeenCalledTimes(execCount)
+      } finally {
+        clock.mockRestore()
+      }
+    }
+  )
+
+  it.each([false, true])(
+    'gates later cache cleanup and runtime retry on GC termination (confirmed: %s)',
+    async (confirmed) => {
+      const conn = makeMockConnection()
+      queueFreshLinuxDeploy()
+      vi.mocked(ensureRemoteOpenCodeRuntime).mockResolvedValueOnce('failed')
+      vi.mocked(gcOldRelayVersions).mockRejectedValueOnce(
+        Object.assign(new Error('GC interrupted'), { sshChannelCloseConfirmed: confirmed })
+      )
+      const deployed = await deployAndLaunchRelay(conn)
+      await vi.waitFor(() => expect(gcOldRelayVersions).toHaveBeenCalledOnce())
+      expect(gcRemoteRipgrepCache).not.toHaveBeenCalled()
+      const clock = vi.spyOn(Date, 'now').mockReturnValue(Date.now() + 60_001)
+      try {
+        await deployed.prepareOpenCodeRuntime?.(new AbortController().signal)
+        expect(ensureRemoteOpenCodeRuntime).toHaveBeenCalledTimes(confirmed ? 2 : 1)
+      } finally {
+        clock.mockRestore()
+      }
+    }
+  )
+
   it('allows an unlimited SSH disconnect grace window', async () => {
     const conn = makeMockConnection()
     queueFreshLinuxDeploy()
diff --git a/src/main/ssh/ssh-relay-deploy.ts b/src/main/ssh/ssh-relay-deploy.ts
index aab5e6c39d3..4424adc0c01 100644
--- a/src/main/ssh/ssh-relay-deploy.ts
+++ b/src/main/ssh/ssh-relay-deploy.ts
@@ -1,7 +1,7 @@
-import { join } from 'node:path'
 /* eslint-disable max-lines -- Why: one cohesive contract (version detect, install-locked deploy, native-deps probe, launch, GC); splitting risks install/GC drift. */
 import { existsSync } from 'node:fs'
 import { app } from 'electron'
+import { relayBundleCandidates } from './relay-bundle-paths'
 import type { SshConnection } from './ssh-connection'
 import { RELAY_REMOTE_DIR, type RelayPlatform } from './relay-protocol'
 import type { MultiplexerTransport } from './ssh-channel-multiplexer'
@@ -30,6 +30,11 @@ import {
   recordRemoteRipgrepReference
 } from './ssh-relay-ripgrep-install'
 import { gcRemoteRipgrepCache } from './ssh-relay-ripgrep-cache-gc'
+import { ensureRemoteOpenCodeRuntime } from './ssh-relay-opencode-runtime'
+import {
+  createRemoteOpenCodeRuntimeRetry,
+  type RemoteOpenCodeRuntimePreparation
+} from './ssh-relay-opencode-runtime-retry'
 import {
   readLocalFullVersion,
   computeRemoteRelayDir,
@@ -131,6 +136,7 @@ export type RelayDeployResult = {
   nodePath?: string
   sockPath?: string
   credentialFile?: string
+  prepareOpenCodeRuntime?: RemoteOpenCodeRuntimePreparation
 }
 
 class RelayDirectoryGcConflictError extends Error {
@@ -322,8 +328,17 @@ async function resolveRelayBootstrapState(
     signal?.throwIfAborted()
     return { ...installState, nodePath }
   } catch (err) {
-    abortController.abort()
+    // Let an admitted probe finish before retrying a refused parallel session.
+    if (!isSshSessionLimitError(err)) {
+      abortController.abort()
+    }
     const settled = await Promise.allSettled([installStatePromise, nodePathPromise])
+    const unconfirmed = settled.find(
+      (result) => result.status === 'rejected' && isUnconfirmedSshCommandTermination(result.reason)
+    )
+    if (unconfirmed?.status === 'rejected') {
+      throw unconfirmed.reason
+    }
     signal?.throwIfAborted()
     if (!isSshSessionLimitError(err)) {
       throw err
@@ -477,32 +492,18 @@ async function deployAndLaunchRelayAttempt(
     onProgress?.('Uploading relay...')
     console.log('[ssh-relay] Uploading relay...')
     try {
-      try {
-        await uploadRelay(
-          conn,
-          platform,
-          uploadStagePayloadDir,
-          fullVersion,
-          hostPlatform,
-          deploySignal,
-          { rootDir: uploadStage.slotDir, namespace: uploadStageSftpNamespace }
-        )
-      } catch (err) {
-        if (isUnconfirmedSshCommandTermination(err)) {
-          uploadStageCleanupAllowed = false
-        }
-        throw err
-      }
+      await uploadRelay(
+        conn,
+        platform,
+        uploadStagePayloadDir,
+        fullVersion,
+        hostPlatform,
+        deploySignal,
+        { rootDir: uploadStage.slotDir, namespace: uploadStageSftpNamespace }
+      )
 
-      try {
-        await acquireInstallLock(conn, remoteRelayDir, hostPlatform, { signal: deploySignal })
-        ownsInstallLock = true
-      } catch (err) {
-        if (isUnconfirmedSshCommandTermination(err)) {
-          ownsInstallLock = true
-        }
-        throw err
-      }
+      await acquireInstallLock(conn, remoteRelayDir, hostPlatform, { signal: deploySignal })
+      ownsInstallLock = true
       try {
         // Re-probe after acquiring the lock — a sibling installer may have finished while we waited.
         if (
@@ -517,26 +518,19 @@ async function deployAndLaunchRelayAttempt(
             homeRelativeRelayDir,
             deploySignal
           )
-          try {
-            const promotion = await execHostCommand(
-              conn,
+          const promotion = await execHostCommand(
+            conn,
+            hostPlatform,
+            promoteOwnedRelayUploadStageCommand(
               hostPlatform,
-              promoteOwnedRelayUploadStageCommand(
-                hostPlatform,
-                uploadStage,
-                uploadStageOwner,
-                remoteRelayDir
-              ),
-              { signal: deploySignal }
-            )
-            if (!relayUploadStagePromotionConfirmed(uploadStageOwner, promotion)) {
-              throw new Error('Relay upload stage ownership was lost before promotion')
-            }
-          } catch (err) {
-            if (isUnconfirmedSshCommandTermination(err)) {
-              uploadStageCleanupAllowed = false
-            }
-            throw err
+              uploadStage,
+              uploadStageOwner,
+              remoteRelayDir
+            ),
+            { signal: deploySignal }
+          )
+          if (!relayUploadStagePromotionConfirmed(uploadStageOwner, promotion)) {
+            throw new Error('Relay upload stage ownership was lost before promotion')
           }
           console.log('[ssh-relay] Upload complete')
 
@@ -568,13 +562,20 @@ async function deployAndLaunchRelayAttempt(
         }
         throw err
       }
+    } catch (error) {
+      uploadStageCleanupAllowed = !isUnconfirmedSshCommandTermination(error)
+      throw error
     } finally {
       if (uploadStageCleanupAllowed) {
         await execHostCommand(
           conn,
           hostPlatform,
           cleanupOwnedRelayUploadStageCommand(hostPlatform, uploadStage, uploadStageOwner)
-        ).catch(() => {})
+        ).catch((error) => {
+          if (isUnconfirmedSshCommandTermination(error)) {
+            throw error
+          }
+        })
       }
     }
   }
@@ -588,95 +589,135 @@ async function deployAndLaunchRelayAttempt(
       remoteRelayDir,
       ripgrepLayout.entryName
     ))
-  let launched: Awaited<ReturnType<typeof launchRelay>>
-  let launchLivenessObserved = false
+  deploySignal?.throwIfAborted()
+  onProgress?.('Starting relay...')
+  console.log('[ssh-relay] Launching relay...')
+  // A failed launch retains its fences until stale recovery can establish liveness.
+  const launched = await launchRelay(
+    conn,
+    remoteRelayDir,
+    hostPlatform,
+    nodePath,
+    graceTimeSeconds,
+    relayInstanceId,
+    deploySignal,
+    ripgrepReferenced ? ripgrepLayout.binaryPath : undefined
+  )
+  let launchCleanupSettled = true
   try {
-    deploySignal?.throwIfAborted()
-    onProgress?.('Starting relay...')
-    console.log('[ssh-relay] Launching relay...')
-    launched = await launchRelay(
-      conn,
-      remoteRelayDir,
-      hostPlatform,
-      nodePath,
-      graceTimeSeconds,
-      relayInstanceId,
-      deploySignal,
-      ripgrepReferenced ? ripgrepLayout.binaryPath : undefined
-    )
-    launchLivenessObserved = true
-  } finally {
-    // Why: older clients understand only the install lock; if launch never goes live, keep it so their GC can't race a caller waiting behind this owner.
-    if (ownsInstallLock && launchLivenessObserved) {
+    if (ownsInstallLock) {
       await abandonInstall(conn, remoteRelayDir, hostPlatform)
     }
-    // The detached start may outlive a timed-out SSH command; keep the fence on failed launch until stale recovery proves the handoff ended.
-    if (launchGcClaimToken && launchLivenessObserved) {
+    if (launchGcClaimToken) {
       await releaseRelayGcClaimWithRetry(conn, remoteRelayDir, launchGcClaimToken, hostPlatform)
     }
+  } catch (error) {
+    // Keep the connected transport, but stop optional commands after uncertain fence release.
+    launchCleanupSettled = !isUnconfirmedSshCommandTermination(error)
+    console.warn('[ssh-relay] Launch fence release failed:', error)
   }
   console.log('[ssh-relay] Relay started successfully')
 
   // Keep background commands serial for SSH transports that allow only one exec at a time.
   const ripgrepEntry = ripgrepLayout?.entryName
   const ripgrepInstall = (
-    ripgrepReferenced
+    ripgrepReferenced && launchCleanupSettled
       ? ensureRemoteBundledRipgrep(conn, hostPlatform, remoteHome, { signal: deploySignal })
       : Promise.resolve()
-  ).catch(() => {})
-  const cleanupReady = conn.canRunConcurrentExecCommands() ? Promise.resolve() : ripgrepInstall
+  ).then(
+    () => launchCleanupSettled,
+    (error) => !isUnconfirmedSshCommandTermination(error)
+  )
+  const runtimeInstall = (
+    conn.canRunConcurrentExecCommands() ? Promise.resolve(launchCleanupSettled) : ripgrepInstall
+  )
+    .then((ripgrepSettled) =>
+      ripgrepSettled
+        ? ensureRemoteOpenCodeRuntime(conn, hostPlatform, remoteHome, {
+            nodePath: launched.nodePath,
+            relayDir: remoteRelayDir,
+            signal: deploySignal
+          })
+        : ('teardown-unconfirmed' as const)
+    )
+    .catch(() => 'teardown-unconfirmed' as const)
 
-  void cleanupReady
-    .then(() =>
+  const cleanupReady = Promise.all([ripgrepInstall, runtimeInstall]).then(
+    ([ripgrepSettled, runtimeOutcome]) =>
+      ripgrepSettled && runtimeOutcome !== 'teardown-unconfirmed'
+  )
+  const backgroundCleanup = cleanupReady.then((ready) => {
+    if (!ready) {
+      return false
+    }
+    return (
       execHostCommand(
         conn,
         hostPlatform,
         recoverOneStaleRelayUploadStageCommand(hostPlatform, uploadStagePoolDir)
       )
-    )
-    .catch(() => {})
-    // Why before GC: a superseded relay pins its version dir via the live-socket probe, so the
-    // sweep has to settle first or GC keeps every orphan's tree forever.
-    .then(() =>
-      sweepSupersededRelayEndpoints(conn, hostPlatform, {
-        remoteHome,
-        currentRelayDir: remoteRelayDir,
-        sockName: relaySocketNameForInstanceId(relayInstanceId),
-        // Set only when this launch relocated past sun_path; the sweep must not reap
-        // the socket the transport it just handed back is talking to.
-        ...(launched.sockPath.startsWith(SHORT_RELAY_SOCKET_DIR_PREFIX)
-          ? {
-              currentShortSocketDir: launched.sockPath.slice(0, launched.sockPath.lastIndexOf('/'))
-            }
-          : {}),
-        nodePath: launched.nodePath
-      })
-    )
-    .catch((error) => {
-      if (error instanceof RelayProbeCleanupUnconfirmedError) {
-        throw error
-      }
-    })
-    .then(() =>
-      gcOldRelayVersions(conn, remoteHome, remoteRelayDir, hostPlatform, {
-        windowsNodePath: launched.nodePath,
-        windowsSockNames: [relaySocketNameForInstanceId(relayInstanceId)],
-        // Why pin rather than rely on the symlink alone: a deploy that fell back to a
-        // per-directory install has no reference to show, and its key must still survive.
-        nativeDepsCacheKeys: [
-          resolveRelayNativeDepsCacheKey({
-            platform,
-            localRelayDir,
-            deps: RELAY_NATIVE_DEPS
+        .catch((error) => {
+          if (isUnconfirmedSshCommandTermination(error)) {
+            throw error
+          }
+        })
+        // Why before GC: a superseded relay pins its version dir via the live-socket probe, so the
+        // sweep has to settle first or GC keeps every orphan's tree forever.
+        .then(() =>
+          sweepSupersededRelayEndpoints(conn, hostPlatform, {
+            remoteHome,
+            currentRelayDir: remoteRelayDir,
+            sockName: relaySocketNameForInstanceId(relayInstanceId),
+            // Set only when this launch relocated past sun_path; the sweep must not reap
+            // the socket the transport it just handed back is talking to.
+            ...(launched.sockPath.startsWith(SHORT_RELAY_SOCKET_DIR_PREFIX)
+              ? {
+                  currentShortSocketDir: launched.sockPath.slice(
+                    0,
+                    launched.sockPath.lastIndexOf('/')
+                  )
+                }
+              : {}),
+            nodePath: launched.nodePath
           })
-        ].filter((key): key is string => key !== null)
-      })
+        )
+        .catch((error) => {
+          if (
+            error instanceof RelayProbeCleanupUnconfirmedError ||
+            isUnconfirmedSshCommandTermination(error)
+          ) {
+            throw error
+          }
+        })
+        .then(() =>
+          gcOldRelayVersions(conn, remoteHome, remoteRelayDir, hostPlatform, {
+            windowsNodePath: launched.nodePath,
+            windowsSockNames: [relaySocketNameForInstanceId(relayInstanceId)],
+            // Why pin rather than rely on the symlink alone: a deploy that fell back to a
+            // per-directory install has no reference to show, and its key must still survive.
+            nativeDepsCacheKeys: [
+              resolveRelayNativeDepsCacheKey({
+                platform,
+                localRelayDir,
+                deps: RELAY_NATIVE_DEPS
+              })
+            ].filter((key): key is string => key !== null)
+          })
+        )
+        // Why after the version GC and not beside it: that pass is what removes the relay directories
+        // holding the references, so running second is what lets a superseded build become collectable
+        // in the same connect rather than the next one.
+        .then(() =>
+          gcRemoteRipgrepCache(conn, hostPlatform, remoteHome, { pinnedEntry: ripgrepEntry })
+        )
+        .then(() => true)
+        .catch(
+          (error) =>
+            !(error instanceof RelayProbeCleanupUnconfirmedError) &&
+            !isUnconfirmedSshCommandTermination(error)
+        )
     )
-    // Why after the version GC and not beside it: that pass is what removes the relay directories
-    // holding the references, so running second is what lets a superseded build become collectable
-    // in the same connect rather than the next one.
-    .then(() => gcRemoteRipgrepCache(conn, hostPlatform, remoteHome, { pinnedEntry: ripgrepEntry }))
-    .catch(() => {})
+  })
 
   return {
     transport: launched.transport,
@@ -687,7 +728,17 @@ async function deployAndLaunchRelayAttempt(
     remoteRelayDir,
     nodePath: launched.nodePath,
     sockPath: launched.sockPath,
-    credentialFile: launched.credentialFile
+    credentialFile: launched.credentialFile,
+    prepareOpenCodeRuntime: createRemoteOpenCodeRuntimeRetry(
+      runtimeInstall,
+      backgroundCleanup,
+      (signal) =>
+        ensureRemoteOpenCodeRuntime(conn, hostPlatform, remoteHome, {
+          nodePath: launched.nodePath,
+          relayDir: remoteRelayDir,
+          signal
+        })
+    )
   }
 }
 
@@ -964,7 +1015,9 @@ async function repairInstalledNativeDeps(
         signal
       })
     } catch (err) {
-      await abandonInstall(conn, remoteDir, hostPlatform)
+      if (!isUnconfirmedSshCommandTermination(err)) {
+        await abandonInstall(conn, remoteDir, hostPlatform)
+      }
       throw err
     }
     if (!stillInstalled) {
@@ -1111,7 +1164,9 @@ async function acquireRelayLaunchGcFence(
     // Why: a caller without the install lock still needs its own durable fence; never borrow another connection's lock through launch.
     return token
   } catch (err) {
-    await releaseRelayGcClaimWithRetry(conn, remoteDir, token, hostPlatform)
+    if (!isUnconfirmedSshCommandTermination(err)) {
+      await releaseRelayGcClaimWithRetry(conn, remoteDir, token, hostPlatform)
+    }
     throw err
   }
 }
@@ -1685,24 +1740,7 @@ function getLocalRelayPath(platform: RelayPlatform): string | null {
 }
 
 export function getLocalRelayCandidates(platform: RelayPlatform): string[] {
-  const candidates: string[] = []
-  if (process.env.ORCA_RELAY_PATH) {
-    candidates.push(join(process.env.ORCA_RELAY_PATH, platform))
-  }
-
-  // Why: electron-builder copies extraResources next to the app bundle, but app.getAppPath() points at app.asar in packaged builds.
-  if (process.resourcesPath) {
-    candidates.push(join(process.resourcesPath, 'relay', platform))
-    candidates.push(join(process.resourcesPath, 'app.asar.unpacked', 'out', 'relay', platform))
-  }
-
-  const appPath = app.getAppPath()
-  candidates.push(
-    join(appPath, 'resources', 'relay', platform),
-    join(appPath, 'out', 'relay', platform)
-  )
-
-  return [...new Set(candidates)]
+  return relayBundleCandidates(platform, app.getAppPath())
 }
 
 async function launchRelay(
diff --git a/src/main/ssh/ssh-relay-gc-claim-termination.test.ts b/src/main/ssh/ssh-relay-gc-claim-termination.test.ts
new file mode 100644
index 00000000000..d460e3e94b9
--- /dev/null
+++ b/src/main/ssh/ssh-relay-gc-claim-termination.test.ts
@@ -0,0 +1,216 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('./ssh-relay-deploy-helpers', () => ({ execCommand: vi.fn() }))
+
+import type { SshConnection } from './ssh-connection'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import {
+  isRelayGcClaimOwned,
+  releaseRelayGcClaim,
+  releaseRelayGcClaimWithRetry,
+  tryAcquireRelayGcClaim,
+  waitForRelayGcClaimRelease
+} from './ssh-relay-gc-claim'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The mocked execCommand never reads the connection.
+const conn = {} as SshConnection
+const mockExec = vi.mocked(execCommand)
+const token = 'claim-owner'
+
+function unconfirmedTermination(): Error {
+  return Object.assign(new Error('SSH teardown not confirmed'), {
+    sshChannelCloseConfirmed: false
+  })
+}
+
+function confirmedFailure(): Error {
+  return Object.assign(new Error('SSH command failed after closing'), {
+    sshChannelCloseConfirmed: true
+  })
+}
+
+beforeEach(() => {
+  mockExec.mockReset()
+  mockExec.mockResolvedValue('OPEN')
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe.each([
+  { platform: 'linux-x64' as const, remoteDir: '/relay/version' },
+  { platform: 'win32-x64' as const, remoteDir: 'C:/relay/version' }
+])('relay GC claim termination on $platform', ({ platform, remoteDir }) => {
+  const host = getRemoteHostPlatform(platform)
+
+  it.each([
+    { stage: 'claim creation', replies: [] },
+    { stage: 'stale claim takeover', replies: ['BUSY'] },
+    { stage: 'new claim owner write', replies: ['OK'] },
+    { stage: 'recovered claim owner write', replies: ['BUSY', 'OK'] }
+  ])('preserves uncertainty during $stage without releasing or retrying', async ({ replies }) => {
+    const error = unconfirmedTermination()
+    for (const reply of replies) {
+      mockExec.mockResolvedValueOnce(reply)
+    }
+    mockExec.mockRejectedValueOnce(error)
+
+    await expect(tryAcquireRelayGcClaim(conn, remoteDir, host)).rejects.toBe(error)
+
+    expect(mockExec).toHaveBeenCalledTimes(replies.length + 1)
+  })
+
+  it('preserves acquisition uncertainty when the caller also aborts', async () => {
+    const controller = new AbortController()
+    const error = unconfirmedTermination()
+    mockExec.mockImplementationOnce(async () => {
+      controller.abort(new Error('deploy aborted'))
+      throw error
+    })
+
+    await expect(tryAcquireRelayGcClaim(conn, remoteDir, host, controller.signal)).rejects.toBe(
+      error
+    )
+    expect(mockExec).toHaveBeenCalledTimes(1)
+  })
+
+  it('preserves ownership probe uncertainty', async () => {
+    const error = unconfirmedTermination()
+    mockExec.mockRejectedValueOnce(error)
+
+    await expect(isRelayGcClaimOwned(conn, remoteDir, token, host)).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(1)
+  })
+
+  it('preserves release uncertainty', async () => {
+    const error = unconfirmedTermination()
+    mockExec.mockRejectedValueOnce(error)
+
+    await expect(releaseRelayGcClaim(conn, remoteDir, token, host)).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(1)
+  })
+
+  it.each([0, 1])(
+    'stops release retries after %i confirmed failures then uncertainty',
+    async (n) => {
+      const error = unconfirmedTermination()
+      for (let attempt = 0; attempt < n; attempt++) {
+        mockExec.mockRejectedValueOnce(confirmedFailure())
+      }
+      mockExec.mockRejectedValueOnce(error)
+
+      await expect(releaseRelayGcClaimWithRetry(conn, remoteDir, token, host)).rejects.toBe(error)
+      expect(mockExec).toHaveBeenCalledTimes(n + 1)
+    }
+  )
+
+  it.each([
+    { stage: 'claim probe', replies: [] },
+    { stage: 'stale claim takeover', replies: ['LOCKED'] },
+    { stage: 'owner write', replies: ['LOCKED', 'OK'] },
+    { stage: 'release', replies: ['LOCKED', 'OK', ''] }
+  ])('stops the claim waiter after an unconfirmed $stage', async ({ replies }) => {
+    const error = unconfirmedTermination()
+    for (const reply of replies) {
+      mockExec.mockResolvedValueOnce(reply)
+    }
+    mockExec.mockRejectedValueOnce(error)
+
+    await expect(waitForRelayGcClaimRelease(conn, remoteDir, host)).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(replies.length + 1)
+  })
+
+  it('preserves claim probe uncertainty when the caller also aborts', async () => {
+    const controller = new AbortController()
+    const error = unconfirmedTermination()
+    mockExec.mockImplementationOnce(async () => {
+      controller.abort(new Error('deploy aborted'))
+      throw error
+    })
+
+    await expect(waitForRelayGcClaimRelease(conn, remoteDir, host, controller.signal)).rejects.toBe(
+      error
+    )
+    expect(mockExec).toHaveBeenCalledTimes(1)
+  })
+
+  it('stops when cleanup after a confirmed owner write failure is unconfirmed', async () => {
+    const error = unconfirmedTermination()
+    mockExec
+      .mockResolvedValueOnce('OK')
+      .mockRejectedValueOnce(confirmedFailure())
+      .mockRejectedValueOnce(error)
+
+    await expect(tryAcquireRelayGcClaim(conn, remoteDir, host)).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(3)
+  })
+
+  it('keeps a confirmed acquisition failure as contention', async () => {
+    mockExec.mockRejectedValueOnce(confirmedFailure())
+
+    await expect(tryAcquireRelayGcClaim(conn, remoteDir, host)).resolves.toBeNull()
+    expect(mockExec).toHaveBeenCalledTimes(1)
+  })
+
+  it('conditionally releases after a confirmed owner write failure', async () => {
+    mockExec
+      .mockResolvedValueOnce('OK')
+      .mockRejectedValueOnce(confirmedFailure())
+      .mockResolvedValueOnce('RELEASED')
+
+    await expect(tryAcquireRelayGcClaim(conn, remoteDir, host)).resolves.toBeNull()
+    expect(mockExec).toHaveBeenCalledTimes(3)
+  })
+
+  it('keeps a confirmed ownership probe failure as lost ownership', async () => {
+    mockExec.mockRejectedValueOnce(confirmedFailure())
+
+    await expect(isRelayGcClaimOwned(conn, remoteDir, token, host)).resolves.toBe(false)
+    expect(mockExec).toHaveBeenCalledTimes(1)
+  })
+
+  it('retains bounded retries for confirmed release failures', async () => {
+    mockExec.mockRejectedValue(confirmedFailure())
+
+    await expect(releaseRelayGcClaimWithRetry(conn, remoteDir, token, host)).resolves.toBe(
+      'unknown'
+    )
+    expect(mockExec).toHaveBeenCalledTimes(3)
+  })
+
+  it('retries confirmed release failures until release succeeds', async () => {
+    mockExec.mockRejectedValueOnce(confirmedFailure()).mockResolvedValueOnce('RELEASED')
+
+    await expect(releaseRelayGcClaimWithRetry(conn, remoteDir, token, host)).resolves.toBe(
+      'released'
+    )
+    expect(mockExec).toHaveBeenCalledTimes(2)
+  })
+
+  it('still recovers a claim after a confirmed probe failure', async () => {
+    mockExec
+      .mockRejectedValueOnce(confirmedFailure())
+      .mockResolvedValueOnce('OK')
+      .mockResolvedValueOnce('')
+      .mockResolvedValueOnce('RELEASED')
+
+    await expect(waitForRelayGcClaimRelease(conn, remoteDir, host)).resolves.toBeUndefined()
+    expect(mockExec).toHaveBeenCalledTimes(4)
+  })
+
+  it('still polls after a confirmed stale takeover failure', async () => {
+    vi.useFakeTimers()
+    mockExec
+      .mockResolvedValueOnce('LOCKED')
+      .mockRejectedValueOnce(confirmedFailure())
+      .mockResolvedValueOnce('OPEN')
+
+    const waiting = waitForRelayGcClaimRelease(conn, remoteDir, host)
+    await vi.advanceTimersByTimeAsync(1_000)
+
+    await expect(waiting).resolves.toBeUndefined()
+    expect(mockExec).toHaveBeenCalledTimes(3)
+  })
+})
diff --git a/src/main/ssh/ssh-relay-gc-claim.ts b/src/main/ssh/ssh-relay-gc-claim.ts
index d0c8cc1221f..3ce807fcabb 100644
--- a/src/main/ssh/ssh-relay-gc-claim.ts
+++ b/src/main/ssh/ssh-relay-gc-claim.ts
@@ -2,6 +2,7 @@ import { randomUUID } from 'node:crypto'
 import type { SshConnection } from './ssh-connection'
 import { shellEscape } from './ssh-connection-utils'
 import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import {
   probeInstallLockExistsCommand,
   tryCreateInstallLockCommand,
@@ -91,7 +92,10 @@ export async function tryAcquireRelayGcClaim(
       return null
     }
     return writeRelayGcClaimOwner(conn, remoteRelayDir, host, signal)
-  } catch {
+  } catch (error) {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
     signal?.throwIfAborted()
     return null
   }
@@ -114,7 +118,10 @@ async function writeRelayGcClaimOwner(
   try {
     await execHostCommand(conn, host, command, signal)
     return token
-  } catch {
+  } catch (error) {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
     // Why: the write may have succeeded remotely before SSH lost its reply.
     // A conditional release removes only the claim generation with our token.
     await releaseRelayGcClaim(conn, remoteRelayDir, token, host)
@@ -134,7 +141,12 @@ export async function isRelayGcClaimOwned(
         `if ((Get-Content -LiteralPath ${powerShellLiteral(ownerPath)} -Raw -ErrorAction SilentlyContinue) -ceq ${powerShellLiteral(token)}) { 'OWNED' } else { 'LOST' }`
       )
     : `test "$(cat ${shellEscape(ownerPath)} 2>/dev/null)" = ${shellEscape(token)} && echo OWNED || echo LOST`
-  const output = await execHostCommand(conn, host, command).catch(() => 'LOST')
+  const output = await execHostCommand(conn, host, command).catch((error) => {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
+    return 'LOST'
+  })
   return output.trim() === 'OWNED'
 }
 
@@ -162,7 +174,12 @@ export async function releaseRelayGcClaim(
         `else ${removeRemoteTreeCommand(host, claimPath)} 2>/dev/null;`,
         `if test -e ${shellEscape(claimPath)}; then echo UNKNOWN; else echo RELEASED; fi; fi`
       ].join(' ')
-  const output = await execHostCommand(conn, host, command).catch(() => 'UNKNOWN')
+  const output = await execHostCommand(conn, host, command).catch((error) => {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
+    return 'UNKNOWN'
+  })
   switch (output.trim()) {
     case 'RELEASED':
       return 'released'
@@ -193,7 +210,12 @@ export async function waitForRelayGcClaimRelease(
   signal?: AbortSignal
 ): Promise<void> {
   while (true) {
-    const claimed = await isRelayGcClaimed(conn, remoteRelayDir, host, signal).catch(() => true)
+    const claimed = await isRelayGcClaimed(conn, remoteRelayDir, host, signal).catch((error) => {
+      if (isUnconfirmedSshCommandTermination(error)) {
+        throw error
+      }
+      return true
+    })
     signal?.throwIfAborted()
     if (!claimed) {
       return
@@ -204,7 +226,12 @@ export async function waitForRelayGcClaimRelease(
       host,
       tryStealInstallLockCommand(host, claimPath, RELAY_GC_CLAIM_STALE_SECONDS),
       signal
-    ).catch(() => 'BUSY')
+    ).catch((error) => {
+      if (isUnconfirmedSshCommandTermination(error)) {
+        throw error
+      }
+      return 'BUSY'
+    })
     signal?.throwIfAborted()
     if (recovered.trim().endsWith('OK')) {
       const token = await writeRelayGcClaimOwner(conn, remoteRelayDir, host, signal)
diff --git a/src/main/ssh/ssh-relay-gc-retry.test.ts b/src/main/ssh/ssh-relay-gc-retry.test.ts
index ae70ff68fa6..18d99a926a9 100644
--- a/src/main/ssh/ssh-relay-gc-retry.test.ts
+++ b/src/main/ssh/ssh-relay-gc-retry.test.ts
@@ -19,7 +19,10 @@ vi.mock('./ssh-relay-deploy-helpers', () => ({
     onData: vi.fn(),
     onClose: vi.fn()
   }),
-  isUnconfirmedSshCommandTermination: () => false,
+  isUnconfirmedSshCommandTermination: (error: unknown) =>
+    error instanceof Error &&
+    'sshChannelCloseConfirmed' in error &&
+    error.sshChannelCloseConfirmed === false,
   execCommand: vi.fn()
 }))
 vi.mock('./ssh-remote-node-resolution', () => ({
@@ -244,6 +247,72 @@ describe('relay GC deploy retry', () => {
     expect(releaseRelayGcClaimWithRetry).not.toHaveBeenCalled()
   })
 
+  it.each(['acquired', 'busy'] as const)(
+    'keeps the connected relay but stops setup after uncertain %s fence release',
+    async (lockResult) => {
+      const conn = makeConnection()
+      const error = Object.assign(new Error('release still running'), {
+        sshChannelCloseConfirmed: false
+      })
+      vi.mocked(tryAcquireRelayRepairLock).mockResolvedValueOnce(lockResult)
+      const release =
+        lockResult === 'acquired'
+          ? vi.mocked(abandonInstall)
+          : vi.mocked(releaseRelayGcClaimWithRetry)
+      release.mockRejectedValueOnce(error)
+      vi.mocked(execCommand).mockImplementation(async (_conn, command) => {
+        if (command.includes('__ORCA_REMOTE_PLATFORM__')) {
+          return '__ORCA_REMOTE_PLATFORM__ Linux x86_64'
+        }
+        if (command === 'echo $HOME') {
+          return '/home/user'
+        }
+        if (command.includes('node-pty')) {
+          return 'ORCA-NATIVE-DEPS-OK'
+        }
+        if (command.includes('var s=require("net").connect')) {
+          return 'READY'
+        }
+        return command.includes('test -S') ? 'DEAD' : ''
+      })
+
+      const deployed = await deployAndLaunchRelay(conn)
+      expect(deployed.transport).toBeDefined()
+      expect(release).toHaveBeenCalledOnce()
+      const execCount = vi.mocked(execCommand).mock.calls.length
+      await deployed.prepareOpenCodeRuntime?.(new AbortController().signal)
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(execCommand).toHaveBeenCalledTimes(execCount)
+    }
+  )
+
+  it.each(['acquired', 'busy'] as const)(
+    'preserves the %s fence after an unconfirmed installed-state recheck',
+    async (lockResult) => {
+      const conn = makeConnection()
+      const error = Object.assign(new Error('recheck still running'), {
+        sshChannelCloseConfirmed: false
+      })
+      vi.mocked(tryAcquireRelayRepairLock).mockResolvedValueOnce(lockResult)
+      vi.mocked(isRelayAlreadyInstalled).mockResolvedValueOnce(true).mockRejectedValueOnce(error)
+      vi.mocked(execCommand).mockImplementation(async (_conn, command) => {
+        if (command.includes('__ORCA_REMOTE_PLATFORM__')) {
+          return '__ORCA_REMOTE_PLATFORM__ Linux x86_64'
+        }
+        if (command === 'echo $HOME') {
+          return '/home/user'
+        }
+        return 'ORCA-NATIVE-DEPS-OK'
+      })
+
+      await expect(deployAndLaunchRelay(conn)).rejects.toBe(error)
+      expect(abandonInstall).not.toHaveBeenCalled()
+      expect(releaseRelayGcClaimWithRetry).not.toHaveBeenCalled()
+      expect(waitForRelayGcClaimRelease).not.toHaveBeenCalled()
+      expect(conn.exec).not.toHaveBeenCalled()
+    }
+  )
+
   it('keeps retrying repeated launch-claim contention within the deploy bound', async () => {
     const conn = makeConnection()
     vi.mocked(tryAcquireRelayRepairLock).mockResolvedValue('busy')
diff --git a/src/main/ssh/ssh-relay-gc-tombstone.ts b/src/main/ssh/ssh-relay-gc-tombstone.ts
index 95684d4d20e..cc117981ead 100644
--- a/src/main/ssh/ssh-relay-gc-tombstone.ts
+++ b/src/main/ssh/ssh-relay-gc-tombstone.ts
@@ -1,5 +1,6 @@
 import type { SshConnection } from './ssh-connection'
 import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import { removeRemoteTreeCommand } from './ssh-remote-commands'
 import {
   getRemoteHostPlatform,
@@ -25,6 +26,9 @@ export async function cleanupRelayGcTombstones(
     await execCommand(conn, removeRemoteTreeCommand(host, tombstone), {
       wrapCommand: !isWindowsRemoteHost(host)
     }).catch((err) => {
+      if (isUnconfirmedSshCommandTermination(err)) {
+        throw err
+      }
       console.warn(
         `[ssh-relay] GC failed to remove tombstone ${tombstone}: ${err instanceof Error ? err.message : String(err)}`
       )
diff --git a/src/main/ssh/ssh-relay-install-lock-termination.test.ts b/src/main/ssh/ssh-relay-install-lock-termination.test.ts
new file mode 100644
index 00000000000..de4c57a4977
--- /dev/null
+++ b/src/main/ssh/ssh-relay-install-lock-termination.test.ts
@@ -0,0 +1,138 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('./ssh-relay-deploy-helpers', () => ({ execCommand: vi.fn() }))
+
+import type { SshConnection } from './ssh-connection'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import { acquireInstallLock, isRelayInstallLockStale } from './ssh-relay-install-lock'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The mocked execCommand never reads the connection.
+const conn = {} as SshConnection
+const mockExec = vi.mocked(execCommand)
+const nextAcquisition = ['OPEN', '', 'OK', 'OPEN']
+
+const lockFailureStages = [
+  {
+    stage: 'claim probe after acquisition',
+    replies: ['OPEN', '', 'OK'],
+    recovery: ['', 'OK', 'OPEN']
+  },
+  {
+    stage: 'release after acquisition',
+    replies: ['OPEN', '', 'OK', 'LOCKED'],
+    recovery: ['OK', 'OPEN']
+  },
+  {
+    stage: 'stale lock takeover',
+    replies: ['OPEN', '', 'BUSY'],
+    recovery: nextAcquisition
+  },
+  {
+    stage: 'claim probe after stale takeover',
+    replies: ['OPEN', '', 'BUSY', 'OK'],
+    recovery: ['', ...nextAcquisition]
+  },
+  {
+    stage: 'release after stale takeover',
+    replies: ['OPEN', '', 'BUSY', 'OK', 'LOCKED'],
+    recovery: nextAcquisition
+  }
+]
+
+beforeEach(() => {
+  mockExec.mockReset()
+  mockExec.mockResolvedValue('OPEN')
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+  vi.spyOn(console, 'info').mockImplementation(() => {})
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+})
+
+describe.each([
+  { platform: 'linux-x64' as const, remoteDir: '/relay/version' },
+  { platform: 'win32-x64' as const, remoteDir: 'C:/relay/version' }
+])('install lock termination on $platform', ({ platform, remoteDir }) => {
+  const host = getRemoteHostPlatform(platform)
+
+  it.each(lockFailureStages)('stops after unconfirmed $stage', async ({ replies }) => {
+    const error = Object.assign(new Error('SSH teardown not confirmed'), {
+      sshChannelCloseConfirmed: false
+    })
+    for (const reply of replies) {
+      mockExec.mockResolvedValueOnce(reply)
+    }
+    mockExec.mockRejectedValueOnce(error)
+
+    await expect(acquireInstallLock(conn, remoteDir, host)).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(replies.length + 1)
+  })
+
+  it.each(lockFailureStages)(
+    'keeps recovery after confirmed $stage failure',
+    async ({ replies, recovery }) => {
+      vi.useFakeTimers()
+      for (const reply of replies) {
+        mockExec.mockResolvedValueOnce(reply)
+      }
+      mockExec.mockRejectedValueOnce(
+        Object.assign(new Error('SSH command failed after closing'), {
+          sshChannelCloseConfirmed: true
+        })
+      )
+      for (const reply of recovery) {
+        mockExec.mockResolvedValueOnce(reply)
+      }
+
+      const acquiring = acquireInstallLock(conn, remoteDir, host)
+      await vi.advanceTimersByTimeAsync(1_000)
+
+      await expect(acquiring).resolves.toBeUndefined()
+      expect(mockExec).toHaveBeenCalledTimes(replies.length + recovery.length + 1)
+    }
+  )
+
+  it('preserves takeover uncertainty when the caller also aborts', async () => {
+    const controller = new AbortController()
+    const error = Object.assign(new Error('SSH teardown not confirmed'), {
+      sshChannelCloseConfirmed: false
+    })
+    mockExec
+      .mockResolvedValueOnce('OPEN')
+      .mockResolvedValueOnce('')
+      .mockResolvedValueOnce('BUSY')
+      .mockImplementationOnce(async () => {
+        controller.abort(new Error('deploy aborted'))
+        throw error
+      })
+
+    await expect(
+      acquireInstallLock(conn, remoteDir, host, { signal: controller.signal })
+    ).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(4)
+  })
+
+  it('preserves uncertainty from the stale lock age probe', async () => {
+    const error = Object.assign(new Error('SSH teardown not confirmed'), {
+      sshChannelCloseConfirmed: false
+    })
+    mockExec.mockRejectedValueOnce(error)
+
+    await expect(isRelayInstallLockStale(conn, remoteDir, host)).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps a confirmed stale age probe failure as not stale', async () => {
+    mockExec.mockRejectedValueOnce(
+      Object.assign(new Error('SSH command failed after closing'), {
+        sshChannelCloseConfirmed: true
+      })
+    )
+
+    await expect(isRelayInstallLockStale(conn, remoteDir, host)).resolves.toBe(false)
+    expect(mockExec).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/main/ssh/ssh-relay-install-lock.ts b/src/main/ssh/ssh-relay-install-lock.ts
index 7d5b26fdfae..3831851cbe9 100644
--- a/src/main/ssh/ssh-relay-install-lock.ts
+++ b/src/main/ssh/ssh-relay-install-lock.ts
@@ -1,6 +1,7 @@
 import type { SshConnection } from './ssh-connection'
-import { execCommand, isUnconfirmedSshCommandTermination } from './ssh-relay-deploy-helpers'
+import { execCommand } from './ssh-relay-deploy-helpers'
 import { RELAY_DEPLOY_TIMEOUT_MS } from './ssh-relay-deploy-timing'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import { isRelayGcClaimed, waitForRelayGcClaimRelease } from './ssh-relay-gc-claim'
 import {
   acquireInstallLockParentCommand,
@@ -54,7 +55,10 @@ export async function isRelayInstallLockStale(
     const out = await execHostCommand(conn, host, lockAgeSecondsCommand(host, lockDir))
     const ageSec = Number.parseInt(out.trim(), 10)
     return Number.isFinite(ageSec) && ageSec >= 0 && ageSec * 1000 > INSTALL_LOCK_STALE_MS
-  } catch {
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     return false
   }
 }
@@ -95,11 +99,20 @@ export async function acquireInstallLock(
           remoteRelayDir,
           host,
           options?.signal
-        ).catch(() => true)
+        ).catch((err) => {
+          if (isUnconfirmedSshCommandTermination(err)) {
+            throw err
+          }
+          return true
+        })
         if (!claimedAfterAcquire && !options?.signal?.aborted) {
           return
         }
-        await execHostCommand(conn, host, removeRemoteTreeCommand(host, lockDir)).catch(() => {})
+        await execHostCommand(conn, host, removeRemoteTreeCommand(host, lockDir)).catch((err) => {
+          if (isUnconfirmedSshCommandTermination(err)) {
+            throw err
+          }
+        })
         options?.signal?.throwIfAborted()
       }
     } catch (err) {
@@ -119,7 +132,12 @@ export async function acquireInstallLock(
         host,
         tryStealInstallLockCommand(host, lockDir, INSTALL_LOCK_STALE_SECONDS),
         { signal: options?.signal }
-      ).catch(() => 'BUSY')
+      ).catch((err) => {
+        if (isUnconfirmedSshCommandTermination(err)) {
+          throw err
+        }
+        return 'BUSY'
+      })
       options?.signal?.throwIfAborted()
       if (steal.trim().endsWith('OK')) {
         const reason = steal.trim().endsWith('REBOOT_OK') ? 'previous-boot' : 'stale'
@@ -129,11 +147,20 @@ export async function acquireInstallLock(
           remoteRelayDir,
           host,
           options?.signal
-        ).catch(() => true)
+        ).catch((err) => {
+          if (isUnconfirmedSshCommandTermination(err)) {
+            throw err
+          }
+          return true
+        })
         if (!claimedAfterSteal && !options?.signal?.aborted) {
           return
         }
-        await execHostCommand(conn, host, removeRemoteTreeCommand(host, lockDir)).catch(() => {})
+        await execHostCommand(conn, host, removeRemoteTreeCommand(host, lockDir)).catch((err) => {
+          if (isUnconfirmedSshCommandTermination(err)) {
+            throw err
+          }
+        })
         options?.signal?.throwIfAborted()
       }
     }
diff --git a/src/main/ssh/ssh-relay-native-deps-cache-commands.ts b/src/main/ssh/ssh-relay-native-deps-cache-commands.ts
index 52d09de1b19..f2ce32a2222 100644
--- a/src/main/ssh/ssh-relay-native-deps-cache-commands.ts
+++ b/src/main/ssh/ssh-relay-native-deps-cache-commands.ts
@@ -10,6 +10,7 @@ import { shellEscape } from './ssh-connection-utils'
 import {
   RELAY_NATIVE_DEPS_CACHE_COMPLETE_NAME,
   RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX,
+  LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX,
   relayNativeDepsCacheBaseDir,
   relayNativeDepsCacheEntryDir,
   relayNativeDepsCacheNodeModulesPath,
@@ -34,9 +35,6 @@ export const RELAY_NATIVE_CACHE_REFS_ERR = '__ORCA_NATIVE_CACHE__REFS_ERR'
  */
 const CACHE_TAKEOVER_MINUTES = 120
 
-/** A crashed GC pass leaves a tombstone; it drains once no in-flight pass could still own it. */
-const CACHE_TOMBSTONE_SWEEP_MINUTES = 30
-
 /** Bounds every listing, matching `MAX_RELAY_GC_LISTING_ENTRIES`' role for version dirs. */
 export const MAX_RELAY_NATIVE_CACHE_LISTING_ENTRIES = 64
 
@@ -157,7 +155,7 @@ export function promoteRelayNativeDepsCacheCommand(paths: RelayNativeDepsCachePa
   ].join('\n')
 }
 
-/** Complete entries only; an incomplete one belongs to an installer, not to GC. */
+/** Complete entries and tombstones; deletion requires a separate reference scan. */
 export function listRelayNativeDepsCacheEntriesCommand(
   host: RemoteHostPlatform,
   remoteHome: string
@@ -166,13 +164,12 @@ export function listRelayNativeDepsCacheEntriesCommand(
   return [
     `base=${shellEscape(base)}`,
     `[ -d "$base" ] || { printf '%s\\n' ${RELAY_NATIVE_CACHE_LIST_OK}; exit 0; }`,
-    `find "$base" -maxdepth 1 -name ${shellEscape(`${RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX}*`)} -mmin +${CACHE_TOMBSTONE_SWEEP_MINUTES} -exec rm -rf {} + 2>/dev/null || true`,
     'n=0',
-    'for d in "$base"/*/; do',
+    `for d in "$base"/*/ "$base"/${RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX}*/ "$base"/${LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX}*/; do`,
     '  [ -d "$d" ] || continue',
-    `  [ -f "$d${RELAY_NATIVE_DEPS_CACHE_COMPLETE_NAME}" ] || continue`,
     '  name=${d%/}',
     '  name=${name##*/}',
+    `  case "$name" in ${RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX}*|${LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX}*) ;; *) [ -f "$d${RELAY_NATIVE_DEPS_CACHE_COMPLETE_NAME}" ] || continue ;; esac`,
     `  printf 'ENTRY %s\\n' "$name"`,
     '  n=$((n+1))',
     `  if [ "$n" -ge ${MAX_RELAY_NATIVE_CACHE_LISTING_ENTRIES} ]; then break; fi`,
@@ -196,8 +193,12 @@ export function listRelayNativeDepsCacheReferencesCommand(
   return [
     `root=${shellEscape(root)}`,
     `[ -d "$root" ] || { printf '%s\\n' ${RELAY_NATIVE_CACHE_REFS_OK}; exit 0; }`,
+    `[ -r "$root" ] && [ -x "$root" ] && ls -A "$root" >/dev/null 2>&1 || { printf '%s\\n' ${RELAY_NATIVE_CACHE_REFS_ERR}; exit 0; }`,
     'n=0',
-    'for d in "$root"/*/node_modules; do',
+    'for d in "$root"/*/; do',
+    '  [ -d "$d" ] || continue',
+    `  [ -r "$d" ] && [ -x "$d" ] || { printf '%s\\n' ${RELAY_NATIVE_CACHE_REFS_ERR}; exit 0; }`,
+    '  d="${d}node_modules"',
     '  [ -L "$d" ] || continue',
     '  t=$(readlink "$d" 2>/dev/null) || t=""',
     `  if [ -z "$t" ]; then printf '%s\\n' ${RELAY_NATIVE_CACHE_REFS_ERR}; exit 0; fi`,
@@ -208,3 +209,24 @@ export function listRelayNativeDepsCacheReferencesCommand(
     `printf '%s\\n' ${RELAY_NATIVE_CACHE_REFS_OK}`
   ].join('\n')
 }
+
+/** A missing completion marker means deletion began; leave that tree for later cleanup. */
+export function restoreRelayNativeDepsCacheTombstoneCommand(
+  tombstone: string,
+  entryDir: string
+): string {
+  const source = shellEscape(tombstone)
+  const destination = shellEscape(entryDir)
+  return `if [ -f ${source}/${RELAY_NATIVE_DEPS_CACHE_COMPLETE_NAME} ] && [ ! -e ${destination} ] && [ ! -L ${destination} ]; then mv ${source} ${destination} && echo MOVED; else echo BUSY; fi`
+}
+
+/** A symlinked tombstone is never followed, so only its own marker can be dropped. */
+export function dropRelayNativeDepsCacheCompletionMarkerCommand(tombstone: string): string {
+  const source = shellEscape(tombstone)
+  return `{ [ -L ${source} ] || rm -f ${source}/${RELAY_NATIVE_DEPS_CACHE_COMPLETE_NAME}; }`
+}
+
+/** Drops the completion marker first so an interrupted deletion can never be restored as complete. */
+export function removeRelayNativeDepsCacheTombstoneCommand(tombstone: string): string {
+  return `${dropRelayNativeDepsCacheCompletionMarkerCommand(tombstone)} && rm -rf ${shellEscape(tombstone)}`
+}
diff --git a/src/main/ssh/ssh-relay-native-deps-cache-deploy.test.ts b/src/main/ssh/ssh-relay-native-deps-cache-deploy.test.ts
index ffc859df223..8d7a1988a97 100644
--- a/src/main/ssh/ssh-relay-native-deps-cache-deploy.test.ts
+++ b/src/main/ssh/ssh-relay-native-deps-cache-deploy.test.ts
@@ -35,6 +35,9 @@ vi.mock('./ssh-relay-deploy-helpers', () => ({
   execCommand: vi.fn()
 }))
 
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', () => ({
   remoteRipgrepLayout: vi.fn().mockReturnValue(null),
   recordRemoteRipgrepReference: vi.fn().mockResolvedValue(false),
diff --git a/src/main/ssh/ssh-relay-native-deps-cache-gc-real.test.ts b/src/main/ssh/ssh-relay-native-deps-cache-gc-real.test.ts
new file mode 100644
index 00000000000..e04d4bcf6bd
--- /dev/null
+++ b/src/main/ssh/ssh-relay-native-deps-cache-gc-real.test.ts
@@ -0,0 +1,415 @@
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  readlinkSync,
+  renameSync,
+  rmSync,
+  symlinkSync,
+  utimesSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { runProcessSync } from '../../shared/child-process/run-process'
+
+const { execMock } = vi.hoisted(() => ({ execMock: vi.fn() }))
+vi.mock('./ssh-relay-deploy-helpers', () => ({ execCommand: execMock }))
+
+import type { SshConnection } from './ssh-connection'
+import { shellEscape } from './ssh-connection-utils'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+import { gcRelayNativeDepsCache } from './ssh-relay-native-deps-cache-gc'
+import { listRelayNativeDepsCacheEntriesCommand } from './ssh-relay-native-deps-cache-commands'
+import {
+  relayNativeDepsCacheBaseDir,
+  relayNativeDepsCacheEntryDir,
+  LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX,
+  RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX
+} from './ssh-relay-native-deps-cache'
+
+const host = getRemoteHostPlatform('linux-x64')
+const key = 'linux-x64-0123456789abcdef'
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: execCommand is replaced by a local shell for every connection access.
+const conn = {} as SshConnection
+const shells = ['/bin/sh', '/bin/dash'].filter(existsSync)
+
+describe.runIf(process.platform !== 'win32').each(shells)(
+  'native cache GC recovery (%s)',
+  (shell) => {
+    let home: string
+    let cache: string
+    let entry: string
+    let relay: string
+
+    function runShell(command: string): string {
+      const result = runProcessSync({ program: shell, args: ['-c', command], timeoutMs: 15_000 })
+      if (result.code !== 0) {
+        throw new Error(result.stderr || `Shell exited ${result.code}`)
+      }
+      return result.stdout
+    }
+
+    function tombstone(
+      timestamp = Date.now() - 60 * 60_000,
+      prefix = RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX
+    ): string {
+      const path = join(cache, `${prefix}${key}.123.${timestamp}`)
+      renameSync(entry, path)
+      return path
+    }
+
+    function referenceEntry(): void {
+      symlinkSync(join(entry, 'node_modules'), join(relay, 'node_modules'))
+    }
+
+    beforeEach(() => {
+      home = mkdtempSync(join(tmpdir(), 'orca native gc '))
+      cache = relayNativeDepsCacheBaseDir(host, home)
+      entry = relayNativeDepsCacheEntryDir(host, home, key)
+      relay = join(home, '.orca-remote', 'relay-0.1.0+abc')
+      mkdirSync(relay, { recursive: true })
+      mkdirSync(join(entry, 'node_modules'), { recursive: true })
+      writeFileSync(join(entry, 'node_modules', 'addon.node'), 'original')
+      writeFileSync(join(entry, '.deps-complete'), '')
+      utimesSync(entry, new Date(0), new Date(0))
+      execMock
+        .mockReset()
+        .mockImplementation(async (_conn: unknown, command: string) => runShell(command))
+    })
+
+    afterEach(() => {
+      chmodSync(join(home, '.orca-remote'), 0o755)
+      chmodSync(relay, 0o755)
+      rmSync(home, { recursive: true, force: true })
+    })
+
+    function tombstones(): string[] {
+      return readdirSync(cache).filter((name) =>
+        name.startsWith(RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX)
+      )
+    }
+
+    it('lists an ancient-mtime tombstone without deleting it and restores its live reference', async () => {
+      referenceEntry()
+      const path = tombstone()
+
+      expect(runShell(listRelayNativeDepsCacheEntriesCommand(host, home))).toContain(
+        `ENTRY ${RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX}`
+      )
+      expect(existsSync(join(path, 'node_modules', 'addon.node'))).toBe(true)
+
+      await gcRelayNativeDepsCache(conn, host, home)
+
+      expect(readFileSync(join(relay, 'node_modules', 'addon.node'), 'utf8')).toBe('original')
+      expect(readdirSync(cache)).toEqual([key])
+    })
+
+    async function runLaterPass(): Promise<void> {
+      const clock = vi.spyOn(Date, 'now').mockReturnValue(Date.now() + 31 * 60_000)
+      try {
+        await gcRelayNativeDepsCache(conn, host, home)
+      } finally {
+        clock.mockRestore()
+      }
+    }
+
+    it('claims a referenced legacy tombstone out of old sweeps but never restores it', async () => {
+      referenceEntry()
+      const path = tombstone(
+        Date.now() - 60 * 60_000,
+        LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX
+      )
+
+      await gcRelayNativeDepsCache(conn, host, home)
+
+      expect(existsSync(path)).toBe(false)
+      const [claimed] = tombstones()
+      expect(existsSync(join(cache, claimed, 'node_modules', 'addon.node'))).toBe(true)
+      expect(existsSync(join(cache, claimed, '.deps-complete'))).toBe(false)
+
+      await runLaterPass()
+
+      expect(existsSync(entry)).toBe(false)
+      expect(tombstones()).toHaveLength(1)
+    })
+
+    it('keeps a legacy tree unrestorable when its claim is interrupted after unmarking', async () => {
+      referenceEntry()
+      const path = tombstone(
+        Date.now() - 60 * 60_000,
+        LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX
+      )
+      execMock.mockImplementation(async (_conn: unknown, command: string) => {
+        if (command.startsWith(`mv ${shellEscape(path)}`)) {
+          throw new Error('claim interrupted')
+        }
+        return runShell(command)
+      })
+
+      await gcRelayNativeDepsCache(conn, host, home)
+
+      expect(existsSync(join(path, 'node_modules', 'addon.node'))).toBe(true)
+      expect(existsSync(join(path, '.deps-complete'))).toBe(false)
+
+      execMock.mockImplementation(async (_conn: unknown, command: string) => runShell(command))
+      await runLaterPass()
+      await runLaterPass()
+
+      expect(existsSync(entry)).toBe(false)
+    })
+
+    it('collects an unreferenced legacy tombstone', async () => {
+      tombstone(Date.now() - 60 * 60_000, LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX)
+
+      await gcRelayNativeDepsCache(conn, host, home)
+
+      expect(readdirSync(cache)).toEqual([])
+    })
+
+    it('lets exactly one of two passes claim the same abandoned tombstone', async () => {
+      const path = tombstone()
+      let releaseClaim!: () => void
+      const claimHeld = new Promise<void>((resolve) => {
+        releaseClaim = resolve
+      })
+      let heldPassReachedClaim!: () => void
+      const reachedClaim = new Promise<void>((resolve) => {
+        heldPassReachedClaim = resolve
+      })
+      let held = false
+      execMock.mockImplementation(async (_conn: unknown, command: string) => {
+        if (!held && command.startsWith(`mv ${shellEscape(path)}`)) {
+          held = true
+          heldPassReachedClaim()
+          await claimHeld
+        }
+        return runShell(command)
+      })
+
+      // The held pass sees the tree as unreferenced; the other pins its key and restores it.
+      const heldPass = gcRelayNativeDepsCache(conn, host, home)
+      await reachedClaim
+      await gcRelayNativeDepsCache(conn, host, home, { pinnedKeys: [key] })
+      releaseClaim()
+      await heldPass
+
+      expect(readdirSync(cache)).toEqual([key])
+      expect(readFileSync(join(entry, 'node_modules', 'addon.node'), 'utf8')).toBe('original')
+      expect(execMock.mock.calls.some(([, command]) => String(command).includes('rm -rf'))).toBe(
+        false
+      )
+    })
+
+    it('does not let another pass resurrect a tombstone while its owner deletes it', async () => {
+      tombstone()
+      let otherPass: Promise<void> | undefined
+      execMock.mockImplementation(async (_conn: unknown, command: string) => {
+        if (!otherPass && command.includes('rm -rf')) {
+          // Simulate the owner's deletion being midway: marker and one file already gone.
+          const [owned] = tombstones()
+          rmSync(join(cache, owned, '.deps-complete'))
+          rmSync(join(cache, owned, 'node_modules', 'addon.node'))
+          referenceEntry()
+          // A later pass on another client sees the owned name as stale and wants the key back.
+          const clock = vi.spyOn(Date, 'now').mockReturnValue(Date.now() + 31 * 60_000)
+          try {
+            otherPass = gcRelayNativeDepsCache(conn, host, home, { pinnedKeys: [key] })
+            await otherPass
+          } finally {
+            clock.mockRestore()
+          }
+        }
+        return runShell(command)
+      })
+
+      await gcRelayNativeDepsCache(conn, host, home)
+
+      expect(otherPass).toBeDefined()
+      expect(existsSync(entry)).toBe(false)
+      expect(
+        tombstones().filter((name) => existsSync(join(cache, name, '.deps-complete')))
+      ).toEqual([])
+    })
+
+    it('never restores a tree whose deletion was interrupted, even once its name is stale', async () => {
+      tombstone()
+      const interrupted = new Error('rm interrupted')
+      execMock.mockImplementation(async (_conn: unknown, command: string) => {
+        if (command.includes('rm -rf')) {
+          runShell(command.slice(0, command.indexOf(' && ')))
+          const [owned] = tombstones()
+          rmSync(join(cache, owned, 'node_modules', 'addon.node'))
+          throw interrupted
+        }
+        return runShell(command)
+      })
+      await gcRelayNativeDepsCache(conn, host, home)
+      const [owned] = tombstones()
+      expect(existsSync(join(cache, owned, 'node_modules'))).toBe(true)
+
+      referenceEntry()
+      execMock.mockImplementation(async (_conn: unknown, command: string) => runShell(command))
+      await runLaterPass()
+
+      expect(existsSync(entry)).toBe(false)
+      expect(tombstones()).toHaveLength(1)
+      expect(existsSync(join(cache, tombstones()[0], '.deps-complete'))).toBe(false)
+    })
+
+    it('preserves a referenced tombstone when the clock moves backward during the reference scan', async () => {
+      referenceEntry()
+      const now = Date.now()
+      const path = tombstone(now - 30 * 60_000 - 1)
+      const clock = vi.spyOn(Date, 'now').mockReturnValue(now)
+      execMock.mockImplementation(async (_conn: unknown, command: string) => {
+        if (command.includes('readlink')) {
+          clock.mockReturnValue(now - 60_000)
+        }
+        return runShell(command)
+      })
+      try {
+        await gcRelayNativeDepsCache(conn, host, home)
+        expect(readFileSync(join(relay, 'node_modules', 'addon.node'), 'utf8')).toBe('original')
+        expect(existsSync(path)).toBe(false)
+      } finally {
+        clock.mockRestore()
+      }
+    })
+
+    it('keeps new tombstones outside an old client mtime-only deletion sweep', () => {
+      const path = tombstone()
+      const legacy = join(cache, `${LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX}${key}.123.1`)
+      mkdirSync(legacy)
+      utimesSync(legacy, new Date(0), new Date(0))
+
+      runShell(
+        `find ${shellEscape(cache)} -maxdepth 1 -name '.gc-tombstone.*' -mmin +30 -exec rm -rf {} +`
+      )
+
+      expect(existsSync(join(path, 'node_modules', 'addon.node'))).toBe(true)
+      expect(existsSync(legacy)).toBe(false)
+    })
+
+    it.skipIf(process.getuid?.() === 0).each(['root', 'relay'])(
+      'preserves tombstones when the %s listing is unreadable',
+      async (scope) => {
+        const path = tombstone()
+        referenceEntry()
+        chmodSync(scope === 'root' ? join(home, '.orca-remote') : relay, 0o111)
+
+        await gcRelayNativeDepsCache(conn, host, home)
+
+        expect(existsSync(join(path, 'node_modules', 'addon.node'))).toBe(true)
+        expect(execMock.mock.calls.some(([, command]) => String(command).includes('rm -rf'))).toBe(
+          false
+        )
+      }
+    )
+
+    it('preserves tombstones when a reference cannot be attributed', async () => {
+      const path = tombstone()
+      symlinkSync('../unknown/node_modules', join(relay, 'node_modules'))
+
+      await gcRelayNativeDepsCache(conn, host, home)
+
+      expect(existsSync(join(path, 'node_modules', 'addon.node'))).toBe(true)
+      expect(execMock).toHaveBeenCalledTimes(2)
+    })
+
+    it('collects a stale tombstone only after two complete reference scans', async () => {
+      const path = tombstone()
+
+      await gcRelayNativeDepsCache(conn, host, home)
+
+      expect(existsSync(path)).toBe(false)
+      expect(
+        execMock.mock.calls.filter(([, command]) => String(command).includes('readlink'))
+      ).toHaveLength(2)
+    })
+
+    it('collects an interrupted tombstone deletion after its completion marker is gone', async () => {
+      const path = tombstone()
+      rmSync(join(path, '.deps-complete'))
+
+      await gcRelayNativeDepsCache(conn, host, home)
+
+      expect(existsSync(path)).toBe(false)
+    })
+
+    it('leaves incomplete ordinary entries owned by installers alone', async () => {
+      rmSync(join(entry, '.deps-complete'))
+
+      await gcRelayNativeDepsCache(conn, host, home)
+
+      expect(readFileSync(join(entry, 'node_modules', 'addon.node'), 'utf8')).toBe('original')
+      expect(execMock).toHaveBeenCalledTimes(1)
+    })
+
+    it.each([() => Date.now(), () => Date.now() + 60 * 60_000, () => Number.MAX_SAFE_INTEGER + 1])(
+      'keeps tombstones with a recent, future, or unsafe name timestamp despite ancient mtime',
+      async (timestamp) => {
+        const path = tombstone(timestamp())
+
+        await gcRelayNativeDepsCache(conn, host, home)
+
+        expect(existsSync(join(path, 'node_modules', 'addon.node'))).toBe(true)
+        expect(execMock).toHaveBeenCalledTimes(1)
+      }
+    )
+
+    it('restores a link created during rename when the recheck termination is unconfirmed', async () => {
+      const error = Object.assign(new Error('read-only recheck timed out'), {
+        sshChannelCloseConfirmed: false
+      })
+      let scans = 0
+      execMock.mockImplementation(async (_conn: unknown, command: string) => {
+        if (command.includes('readlink') && ++scans === 2) {
+          throw error
+        }
+        const output = runShell(command)
+        if (command.startsWith('mv ')) {
+          referenceEntry()
+        }
+        return output
+      })
+
+      await expect(gcRelayNativeDepsCache(conn, host, home)).rejects.toBe(error)
+
+      expect(readFileSync(join(relay, 'node_modules', 'addon.node'), 'utf8')).toBe('original')
+      expect(readdirSync(cache)).toEqual([key])
+      expect(execMock).toHaveBeenCalledTimes(5)
+    })
+
+    it.each(['directory', 'dangling symlink'])(
+      'does not overwrite or nest inside a recreated %s',
+      async (kind) => {
+        referenceEntry()
+        const path = tombstone()
+        if (kind === 'directory') {
+          mkdirSync(entry)
+          writeFileSync(join(entry, 'replacement'), 'new')
+        } else {
+          symlinkSync(join(cache, 'missing'), entry)
+        }
+
+        await gcRelayNativeDepsCache(conn, host, home)
+
+        expect(existsSync(path)).toBe(false)
+        const [claimed] = tombstones()
+        expect(readFileSync(join(cache, claimed, 'node_modules', 'addon.node'), 'utf8')).toBe(
+          'original'
+        )
+        if (kind === 'directory') {
+          expect(readdirSync(entry)).toEqual(['replacement'])
+        } else {
+          expect(readlinkSync(entry)).toBe(join(cache, 'missing'))
+        }
+      }
+    )
+  }
+)
diff --git a/src/main/ssh/ssh-relay-native-deps-cache-gc.ts b/src/main/ssh/ssh-relay-native-deps-cache-gc.ts
index e2349ad1bbf..0febd709cd6 100644
--- a/src/main/ssh/ssh-relay-native-deps-cache-gc.ts
+++ b/src/main/ssh/ssh-relay-native-deps-cache-gc.ts
@@ -14,23 +14,29 @@
  * linked the entry between the first listing and the rename shows up in the recheck, and its tree
  * is moved back.
  */
+import { randomInt } from 'node:crypto'
 import type { SshConnection } from './ssh-connection'
 import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import {
   isRelayNativeDepsCacheEntryName,
   relayNativeDepsCacheBaseDir,
   relayNativeDepsCacheNodeModulesPath,
   supportsRelayNativeDepsCache,
-  RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX
+  RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX,
+  LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX
 } from './ssh-relay-native-deps-cache'
 import {
   listRelayNativeDepsCacheEntriesCommand,
   listRelayNativeDepsCacheReferencesCommand,
   MAX_RELAY_NATIVE_CACHE_LISTING_ENTRIES,
   RELAY_NATIVE_CACHE_LIST_OK,
-  RELAY_NATIVE_CACHE_REFS_OK
+  RELAY_NATIVE_CACHE_REFS_OK,
+  dropRelayNativeDepsCacheCompletionMarkerCommand,
+  removeRelayNativeDepsCacheTombstoneCommand,
+  restoreRelayNativeDepsCacheTombstoneCommand
 } from './ssh-relay-native-deps-cache-commands'
-import { moveRemoteTreeCommand, removeRemoteTreeCommand } from './ssh-remote-commands'
+import { moveRemoteTreeCommand } from './ssh-remote-commands'
 import { joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
 
 type ReferenceScan =
@@ -38,12 +44,34 @@ type ReferenceScan =
   /** Anything this client could not fully account for. No entry may be deleted on it. */
   | { readable: false }
 
+function staleTombstoneKey(name: string): string | null {
+  const prefix = [
+    RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX,
+    LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX
+  ].find((value) => name.startsWith(value))
+  if (!prefix) {
+    return null
+  }
+  const match = /^(.*)\.(\d+)\.(\d+)$/.exec(name.slice(prefix.length))
+  if (
+    !match ||
+    !isRelayNativeDepsCacheEntryName(match[1]) ||
+    !Number.isSafeInteger(Number(match[3])) ||
+    Date.now() - Number(match[3]) < 30 * 60_000
+  ) {
+    return null
+  }
+  return match[1]
+}
+
 function execHostCommand(
   conn: SshConnection,
   host: RemoteHostPlatform,
   command: string
 ): Promise<string> {
-  return execCommand(conn, command, { wrapCommand: host.commandDialect !== 'powershell' })
+  return execCommand(conn, command, {
+    wrapCommand: host.commandDialect !== 'powershell'
+  })
 }
 
 /**
@@ -64,12 +92,15 @@ export async function gcRelayNativeDepsCache(
     return
   }
   const base = relayNativeDepsCacheBaseDir(host, remoteHome)
-  let entries: string[]
+  let entries: CacheEntry[]
   try {
     entries = parseCacheEntryListing(
       await execHostCommand(conn, host, listRelayNativeDepsCacheEntriesCommand(host, remoteHome))
     )
-  } catch {
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     return
   }
   if (entries.length === 0) {
@@ -80,10 +111,14 @@ export async function gcRelayNativeDepsCache(
     return
   }
   const pinned = new Set(options?.pinnedKeys ?? [])
-  const candidates = entries.filter((key) => !scan.referencedKeys.has(key) && !pinned.has(key))
   const removed: string[] = []
-  for (const key of candidates) {
-    if (await removeUnreferencedCacheEntry(conn, host, remoteHome, base, key)) {
+  for (const { name, key } of entries) {
+    const keep = scan.referencedKeys.has(key) || pinned.has(key)
+    const collected =
+      name === key
+        ? !keep && (await removeUnreferencedCacheEntry(conn, host, remoteHome, base, key))
+        : await recoverAbandonedTombstone(conn, host, remoteHome, base, name, key, keep)
+    if (collected) {
       removed.push(key)
     }
   }
@@ -94,6 +129,33 @@ export async function gcRelayNativeDepsCache(
   }
 }
 
+// Why random rather than pid + clock: passes on different clients must never rename into one path.
+function ownedTombstonePath(host: RemoteHostPlatform, base: string, key: string): string {
+  const name = `${RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX}${key}.${randomInt(1, 2 ** 47)}.${Date.now()}`
+  return joinRemotePath(host, base, name)
+}
+
+async function moveTree(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  source: string,
+  destination: string
+): Promise<boolean> {
+  try {
+    const moved = await execHostCommand(
+      conn,
+      host,
+      moveRemoteTreeCommand(host, source, destination)
+    )
+    return moved.trim() === 'MOVED'
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
+    return false
+  }
+}
+
 async function removeUnreferencedCacheEntry(
   conn: SshConnection,
   host: RemoteHostPlatform,
@@ -102,47 +164,104 @@ async function removeUnreferencedCacheEntry(
   key: string
 ): Promise<boolean> {
   const entryDir = joinRemotePath(host, base, key)
-  const tombstone = joinRemotePath(
-    host,
-    base,
-    `${RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX}${key}.${process.pid}.${Date.now()}`
-  )
-  try {
-    const moved = await execHostCommand(
-      conn,
-      host,
-      moveRemoteTreeCommand(host, entryDir, tombstone)
-    )
-    if (moved.trim() !== 'MOVED') {
-      return false
-    }
-  } catch {
+  const tombstone = ownedTombstonePath(host, base, key)
+  if (!(await moveTree(conn, host, entryDir, tombstone))) {
     return false
   }
+  return collectOwnedTombstone(conn, host, remoteHome, key, tombstone, entryDir)
+}
+
+/**
+ * Another pass may list the same abandoned tombstone, so only the pass whose rename wins may
+ * restore or delete it; the fresh name keeps every other pass off it for the stale window.
+ */
+async function recoverAbandonedTombstone(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  remoteHome: string,
+  base: string,
+  name: string,
+  key: string,
+  keep: boolean
+): Promise<boolean> {
+  const source = joinRemotePath(host, base, name)
+  // Why unmark legacy trees before claiming them: an old client's mtime sweep may have left a
+  // partial tree with its marker, and the marker is all a later pass checks before restoring.
+  if (
+    name.startsWith(LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX) &&
+    !(await runOrDecline(conn, host, dropRelayNativeDepsCacheCompletionMarkerCommand(source)))
+  ) {
+    return false
+  }
+  const tombstone = ownedTombstonePath(host, base, key)
+  if (!(await moveTree(conn, host, source, tombstone))) {
+    return false
+  }
+  const entryDir = joinRemotePath(host, base, key)
+  if (keep) {
+    await restoreCacheEntry(conn, host, tombstone, entryDir)
+    return false
+  }
+  return collectOwnedTombstone(conn, host, remoteHome, key, tombstone, entryDir)
+}
+
+async function collectOwnedTombstone(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  remoteHome: string,
+  key: string,
+  tombstone: string,
+  entryDir: string
+): Promise<boolean> {
   // Why recheck under the rename: a deploy that read `.deps-complete` before it moved can still
   // be creating its symlink. Its reference now names a path that no longer exists, so restoring
   // the tree is the only outcome that leaves that relay with working native deps.
-  let recheck: ReferenceScan
-  try {
-    recheck = await scanCacheReferences(conn, host, remoteHome)
-  } catch {
-    recheck = { readable: false }
-  }
+  const recheck = await scanCacheReferences(conn, host, remoteHome).catch(async (err: unknown) => {
+    // A read-only scan cannot conflict with restoring this pass's renamed tree.
+    await restoreCacheEntry(conn, host, tombstone, entryDir).catch(() => {})
+    throw err
+  })
   if (!recheck.readable || recheck.referencedKeys.has(key)) {
-    await execHostCommand(conn, host, moveRemoteTreeCommand(host, tombstone, entryDir)).catch(
-      () => {}
-    )
+    await restoreCacheEntry(conn, host, tombstone, entryDir)
     return false
   }
+  // A failed removal is retried by a later pass after its own recheck.
+  return runOrDecline(conn, host, removeRelayNativeDepsCacheTombstoneCommand(tombstone))
+}
+
+async function runOrDecline(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  command: string
+): Promise<boolean> {
   try {
-    await execHostCommand(conn, host, removeRemoteTreeCommand(host, tombstone))
+    await execHostCommand(conn, host, command)
     return true
-  } catch {
-    // The sweep in the entry listing drains a tombstone this pass could not remove.
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     return false
   }
 }
 
+async function restoreCacheEntry(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  tombstone: string,
+  entryDir: string
+): Promise<void> {
+  await execHostCommand(
+    conn,
+    host,
+    restoreRelayNativeDepsCacheTombstoneCommand(tombstone, entryDir)
+  ).catch((err) => {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
+  })
+}
+
 async function scanCacheReferences(
   conn: SshConnection,
   host: RemoteHostPlatform,
@@ -155,7 +274,10 @@ async function scanCacheReferences(
       host,
       listRelayNativeDepsCacheReferencesCommand(host, remoteHome)
     )
-  } catch {
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     return { readable: false }
   }
   const lines = output.split(/\r?\n/).map((line) => line.trim())
@@ -219,12 +341,14 @@ function attributeReference(
     : { kind: 'unattributable' }
 }
 
-function parseCacheEntryListing(output: string): string[] {
+type CacheEntry = { name: string; key: string }
+
+function parseCacheEntryListing(output: string): CacheEntry[] {
   const lines = output.split(/\r?\n/).map((line) => line.trim())
   if (!lines.includes(RELAY_NATIVE_CACHE_LIST_OK)) {
     return []
   }
-  const entries: string[] = []
+  const entries: CacheEntry[] = []
   for (const line of lines) {
     if (!line.startsWith('ENTRY ')) {
       continue
@@ -232,11 +356,9 @@ function parseCacheEntryListing(output: string): string[] {
     const name = line.slice('ENTRY '.length)
     // Why re-validate a name the host produced: it is about to be interpolated into `mv` and
     // `rm -rf`. Only names this client could itself have minted are eligible.
-    if (
-      isRelayNativeDepsCacheEntryName(name) &&
-      entries.length < MAX_RELAY_NATIVE_CACHE_LISTING_ENTRIES
-    ) {
-      entries.push(name)
+    const key = isRelayNativeDepsCacheEntryName(name) ? name : staleTombstoneKey(name)
+    if (key && entries.length < MAX_RELAY_NATIVE_CACHE_LISTING_ENTRIES) {
+      entries.push({ name, key })
     }
   }
   return entries
diff --git a/src/main/ssh/ssh-relay-native-deps-cache.test.ts b/src/main/ssh/ssh-relay-native-deps-cache.test.ts
index bfe0c481983..7fee587b3ec 100644
--- a/src/main/ssh/ssh-relay-native-deps-cache.test.ts
+++ b/src/main/ssh/ssh-relay-native-deps-cache.test.ts
@@ -168,7 +168,7 @@ describe('gcRelayNativeDepsCache', () => {
 
     const last = mockExec.mock.calls.at(-1)?.[1] ?? ''
     expect(last).toContain('rm -rf')
-    expect(last).toContain('.gc-tombstone.')
+    expect(last).toContain('.native-gc-')
   })
 
   it('keeps an entry a live relay depends on', async () => {
@@ -179,7 +179,7 @@ describe('gcRelayNativeDepsCache', () => {
     await gcRelayNativeDepsCache(conn, POSIX, HOME)
 
     expect(mockExec).toHaveBeenCalledTimes(2)
-    expect(mockExec.mock.calls.some(([, c]) => c.startsWith('rm -rf'))).toBe(false)
+    expect(mockExec.mock.calls.some(([, c]) => c.includes('rm -rf'))).toBe(false)
   })
 
   it('keeps every entry when the reference listing never answers', async () => {
@@ -219,7 +219,7 @@ describe('gcRelayNativeDepsCache', () => {
 
     await gcRelayNativeDepsCache(conn, POSIX, HOME)
 
-    expect(mockExec.mock.calls.some(([, c]) => c.startsWith('rm -rf'))).toBe(true)
+    expect(mockExec.mock.calls.some(([, c]) => c.includes('rm -rf'))).toBe(true)
   })
 
   it('restores the tree when a deploy links the entry after the tombstone rename', async () => {
@@ -235,7 +235,7 @@ describe('gcRelayNativeDepsCache', () => {
     const last = mockExec.mock.calls.at(-1)?.[1] ?? ''
     expect(last).toContain('mv ')
     expect(last).toContain(relayNativeDepsCacheEntryDir(POSIX, HOME, KEY))
-    expect(mockExec.mock.calls.some(([, c]) => c.startsWith('rm -rf'))).toBe(false)
+    expect(mockExec.mock.calls.some(([, c]) => c.includes('rm -rf'))).toBe(false)
   })
 
   it('restores the tree when the recheck itself cannot answer', async () => {
@@ -248,7 +248,7 @@ describe('gcRelayNativeDepsCache', () => {
 
     await gcRelayNativeDepsCache(conn, POSIX, HOME)
 
-    expect(mockExec.mock.calls.some(([, c]) => c.startsWith('rm -rf'))).toBe(false)
+    expect(mockExec.mock.calls.some(([, c]) => c.includes('rm -rf'))).toBe(false)
   })
 
   it('never removes a pinned key', async () => {
diff --git a/src/main/ssh/ssh-relay-native-deps-cache.ts b/src/main/ssh/ssh-relay-native-deps-cache.ts
index 8400a467a91..79f04221c01 100644
--- a/src/main/ssh/ssh-relay-native-deps-cache.ts
+++ b/src/main/ssh/ssh-relay-native-deps-cache.ts
@@ -41,8 +41,9 @@ export const RELAY_NATIVE_DEPS_CACHE_DIR_NAME = 'native'
 /** Written last. Its presence is the only thing that makes an entry linkable. */
 export const RELAY_NATIVE_DEPS_CACHE_COMPLETE_NAME = '.deps-complete'
 
-/** Hidden so the entry listing skips it, and swept by age so a crashed pass drains. */
-export const RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX = '.gc-tombstone.'
+/** Older clients sweep the legacy prefix by mtime without checking references. */
+export const RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX = '.native-gc-'
+export const LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX = '.gc-tombstone.'
 
 /**
  * Bump when the remote install starts mutating the installed tree in a way the hashed inputs
diff --git a/src/main/ssh/ssh-relay-native-deps-install.test.ts b/src/main/ssh/ssh-relay-native-deps-install.test.ts
index df15135963a..5c1e99eb80d 100644
--- a/src/main/ssh/ssh-relay-native-deps-install.test.ts
+++ b/src/main/ssh/ssh-relay-native-deps-install.test.ts
@@ -46,6 +46,9 @@ vi.mock('./ssh-relay-install-marker', async (importOriginal) => ({
 // Why: the post-launch ripgrep install would consume this file's queued exec mocks.
 // Why: the post-launch ripgrep cache GC is fire-and-forget and would drain the queued exec mocks.
 vi.mock('./ssh-relay-ripgrep-cache-gc', () => ({ gcRemoteRipgrepCache: vi.fn() }))
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', async (importOriginal) => ({
   ...(await importOriginal<typeof RelayRipgrepInstallModule>()),
   ensureRemoteBundledRipgrep: vi.fn().mockResolvedValue('present'),
diff --git a/src/main/ssh/ssh-relay-native-deps-probe-verdict.test.ts b/src/main/ssh/ssh-relay-native-deps-probe-verdict.test.ts
index 395aed06f95..69c7ae1d2a5 100644
--- a/src/main/ssh/ssh-relay-native-deps-probe-verdict.test.ts
+++ b/src/main/ssh/ssh-relay-native-deps-probe-verdict.test.ts
@@ -35,6 +35,9 @@ vi.mock('./ssh-relay-deploy-helpers', () => ({
   execCommand: vi.fn()
 }))
 
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', () => ({
   remoteRipgrepLayout: vi.fn().mockReturnValue(null),
   recordRemoteRipgrepReference: vi.fn().mockResolvedValue(false),
diff --git a/src/main/ssh/ssh-relay-node-pty-spawn-repair.test.ts b/src/main/ssh/ssh-relay-node-pty-spawn-repair.test.ts
index 1f8fd69b8dd..7eda53e684d 100644
--- a/src/main/ssh/ssh-relay-node-pty-spawn-repair.test.ts
+++ b/src/main/ssh/ssh-relay-node-pty-spawn-repair.test.ts
@@ -6,6 +6,9 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as RelayInstallMarkerModule from './ssh-relay-install-marker'
 
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', () => ({
   remoteRipgrepLayout: vi.fn().mockReturnValue(null),
   recordRemoteRipgrepReference: vi.fn().mockResolvedValue(false),
@@ -80,7 +83,7 @@ vi.mock('./ssh-connection-utils', () => ({
 import { deployAndLaunchRelay } from './ssh-relay-deploy'
 import { execCommand } from './ssh-relay-deploy-helpers'
 import { parseUnameToRelayPlatform } from './relay-protocol'
-import { isRelayAlreadyInstalled } from './ssh-relay-versioned-install'
+import { gcOldRelayVersions, isRelayAlreadyInstalled } from './ssh-relay-versioned-install'
 import { tryAcquireRelayRepairLock } from './ssh-relay-repair-lock'
 import {
   makeMockConnection,
@@ -221,6 +224,7 @@ describe('spawn-time node-pty repair through the locked deploy path', () => {
     feed(repairSucceedsResponses())
     const deploys = { count: 0 }
     await recover(conn, deploys)
+    await vi.waitFor(() => expect(gcOldRelayVersions).toHaveBeenCalledOnce())
     vi.mocked(execCommand).mockReset().mockResolvedValue('')
 
     const second = await recover(conn, deploys)
diff --git a/src/main/ssh/ssh-relay-opencode-runtime-commands.test.ts b/src/main/ssh/ssh-relay-opencode-runtime-commands.test.ts
new file mode 100644
index 00000000000..72b5254c322
--- /dev/null
+++ b/src/main/ssh/ssh-relay-opencode-runtime-commands.test.ts
@@ -0,0 +1,274 @@
+import { createHash } from 'node:crypto'
+import { mkdir, mkdtemp, readFile, rm, stat, utimes, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { runProcess } from '../../shared/child-process/run-process'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+import { decodeRemotePowerShellScript } from './ssh-remote-powershell'
+import {
+  parseOpenCodeRuntimeResult,
+  probeOpenCodeRuntimeCacheCommand,
+  probeOpenCodeNodeSqliteCommand,
+  promoteOpenCodeRuntimeCommand,
+  publishOpenCodeRuntimeReferenceCommand
+} from './ssh-relay-opencode-runtime-commands'
+import {
+  cleanupOwnedRelayUploadStageCommand,
+  parseReservedRelayUploadStage,
+  recoverOneStaleRelayUploadStageCommand,
+  reserveRelayUploadStageCommand
+} from './ssh-relay-upload-stage-commands'
+
+const host = getRemoteHostPlatform('linux-x64')
+const nodePath = process.execPath
+const directories: string[] = []
+const expectedHash = createHash('sha256').update('verified runtime').digest('hex')
+const markerName = '.sftp-namespace-0123456789abcdef0123456789abcdef'
+
+afterEach(async () => {
+  await Promise.all(
+    directories.splice(0).map((directory) => rm(directory, { recursive: true, force: true }))
+  )
+})
+
+async function directory(): Promise<string> {
+  const result = await mkdtemp(join(tmpdir(), "orca-runtime spaces ' $-"))
+  directories.push(result)
+  return result
+}
+
+async function command(text: string, environment: NodeJS.ProcessEnv = {}) {
+  return runProcess({
+    program: 'sh',
+    args: ['-c', text],
+    timeoutMs: 10_000,
+    env: { ...process.env, OPENCODE_DB: '', XDG_DATA_HOME: '', ...environment }
+  })
+}
+
+async function reserveStage(root: string) {
+  const pool = join(root, '.upload-stages')
+  const result = await command(reserveRelayUploadStageCommand(host, pool, markerName))
+  expect(result.code, result.stderr).toBe(0)
+  return parseReservedRelayUploadStage(host, pool, markerName, result.stdout)
+}
+
+describe.skipIf(process.platform === 'win32')('host-owned SQLite setup commands', () => {
+  it('runs an actual SQLite read and identifies the executable', async () => {
+    const home = await directory()
+    const data = join(home, '.local', 'share', 'opencode')
+    await mkdir(data, { recursive: true })
+    await writeFile(join(data, 'opencode.db'), '')
+    const result = await command(probeOpenCodeNodeSqliteCommand(host, nodePath, home))
+    expect(result.code).toBe(0)
+    expect(parseOpenCodeRuntimeResult(result.stdout)).toEqual({
+      status: 'ready',
+      executable: nodePath
+    })
+  })
+
+  it('stages, verifies by bytes, promotes and atomically publishes under quoted paths', async () => {
+    const root = await directory()
+    const stage = await reserveStage(root)
+    const stageDir = stage.slotDir
+    const executable = join(root, expectedHash, 'bun')
+    const prepared = await command(
+      probeOpenCodeRuntimeCacheCommand({
+        host,
+        nodePath,
+        executable,
+        expectedHash,
+        reference: join(root, 'runtime.json')
+      })
+    )
+    expect(parseOpenCodeRuntimeResult(prepared.stdout).status).toBe('missing')
+    expect((await stat(join(stageDir, markerName))).isFile()).toBe(true)
+    const stagedBinary = join(stageDir, 'payload', 'bun')
+    await writeFile(stagedBinary, 'verified runtime')
+    const promoted = await command(
+      promoteOpenCodeRuntimeCommand({
+        host,
+        nodePath,
+        stagedBinary,
+        executable,
+        expectedHash,
+        repairToken: 'repair'
+      })
+    )
+    expect(parseOpenCodeRuntimeResult(promoted.stdout)).toEqual({ status: 'ready', executable })
+    expect(await readFile(executable, 'utf8')).toBe('verified runtime')
+    const reference = join(root, 'opencode-sqlite-runtime.json')
+    await writeFile(reference, '{"old":true}')
+    const stagedReference = join(stageDir, 'payload', 'ref.json')
+    await writeFile(stagedReference, JSON.stringify({ protocol: 1, executable }))
+    const published = await command(
+      publishOpenCodeRuntimeReferenceCommand({
+        host,
+        nodePath,
+        stagedReference,
+        reference,
+        token: 'one'
+      })
+    )
+    expect(parseOpenCodeRuntimeResult(published.stdout).status).toBe('published')
+    expect(JSON.parse(await readFile(reference, 'utf8'))).toEqual({ protocol: 1, executable })
+    await command(cleanupOwnedRelayUploadStageCommand(host, stage, markerName))
+    await expect(stat(stageDir)).rejects.toMatchObject({ code: 'ENOENT' })
+    expect(await readFile(executable, 'utf8')).toBe('verified runtime')
+  })
+
+  it('refuses equal-sized corrupt uploads instead of accepting a size match', async () => {
+    const root = await directory()
+    const stagedBinary = join(root, 'source')
+    const executable = join(root, 'installed', 'bun')
+    await writeFile(stagedBinary, 'corrupt! runtime')
+    expect((await stat(stagedBinary)).size).toBe(Buffer.byteLength('verified runtime'))
+    const result = await command(
+      promoteOpenCodeRuntimeCommand({
+        host,
+        nodePath,
+        stagedBinary,
+        executable,
+        expectedHash,
+        repairToken: 'one'
+      })
+    )
+    expect(result.code).not.toBe(0)
+    expect(result.stderr).toContain('checksum mismatch')
+    await expect(stat(executable)).rejects.toMatchObject({ code: 'ENOENT' })
+  })
+
+  it('preserves an existing corrupt binary and reuses its verified repair reference', async () => {
+    const root = await directory()
+    const executable = join(root, expectedHash, 'bun')
+    await mkdir(join(root, expectedHash))
+    await writeFile(executable, 'old binary still owned by another process')
+    const stagedBinary = join(root, 'source')
+    await writeFile(stagedBinary, 'verified runtime')
+    const promoted = await command(
+      promoteOpenCodeRuntimeCommand({
+        host,
+        nodePath,
+        stagedBinary,
+        executable,
+        expectedHash,
+        repairToken: 'two'
+      })
+    )
+    const repaired = join(root, expectedHash, 'repair-two', 'bun')
+    expect(parseOpenCodeRuntimeResult(promoted.stdout).executable).toBe(repaired)
+    expect(await readFile(executable, 'utf8')).toBe('old binary still owned by another process')
+    const reference = join(root, 'runtime.json')
+    await writeFile(reference, JSON.stringify({ protocol: 1, executable: repaired }))
+    const prepared = await command(
+      probeOpenCodeRuntimeCacheCommand({
+        host,
+        nodePath,
+        executable,
+        expectedHash,
+        reference
+      })
+    )
+    expect(parseOpenCodeRuntimeResult(prepared.stdout)).toEqual({
+      status: 'ready',
+      executable: repaired
+    })
+  })
+
+  it('defers an empty host, honors database overrides, and ignores in-memory databases', async () => {
+    const home = await directory()
+    const probe = probeOpenCodeNodeSqliteCommand(host, nodePath, home)
+    expect(parseOpenCodeRuntimeResult((await command(probe)).stdout).status).toBe('not-needed')
+    const xdg = join(home, 'other data')
+    await mkdir(join(xdg, 'opencode'), { recursive: true })
+    await writeFile(join(xdg, 'opencode', 'opencode-team.db'), '')
+    const environment = { XDG_DATA_HOME: xdg, OPENCODE_DB: 'opencode-team.db' }
+    expect(parseOpenCodeRuntimeResult((await command(probe, environment)).stdout).status).toBe(
+      'ready'
+    )
+    expect(
+      parseOpenCodeRuntimeResult(
+        (await command(probe, { ...environment, OPENCODE_DB: ':memory:' })).stdout
+      ).status
+    ).toBe('not-needed')
+  })
+
+  it('reclaims an abandoned binary through the shared pool while preserving fresh uploads', async () => {
+    const root = await directory()
+    const abandoned = await reserveStage(root)
+    await writeFile(join(abandoned.slotDir, 'payload', 'bun'), 'partial upload')
+    const fresh = await reserveStage(root)
+    await writeFile(join(fresh.slotDir, 'payload', 'bun'), 'active upload')
+    const old = new Date(Date.now() - 3_600_000)
+    await utimes(join(abandoned.slotDir, '.orca-upload-owner'), old, old)
+    const recovered = await command(recoverOneStaleRelayUploadStageCommand(host, abandoned.poolDir))
+    expect(recovered.code, recovered.stderr).toBe(0)
+    await expect(stat(abandoned.slotDir)).rejects.toMatchObject({ code: 'ENOENT' })
+    expect(await readFile(join(fresh.slotDir, 'payload', 'bun'), 'utf8')).toBe('active upload')
+  })
+
+  it('falls back to an atomic unique rename when the host filesystem rejects hard links', async () => {
+    const root = await directory()
+    const source = join(root, 'source')
+    await writeFile(source, 'verified runtime')
+    const preload = join(root, 'disable-hardlinks.cjs')
+    await writeFile(
+      preload,
+      "require('node:fs').promises.link=async()=>{throw Object.assign(Error('unsupported'),{code:'EPERM'})}"
+    )
+    const executable = join(root, expectedHash, 'bun')
+    const result = await command(
+      promoteOpenCodeRuntimeCommand({
+        host,
+        nodePath,
+        stagedBinary: source,
+        executable,
+        expectedHash,
+        repairToken: 'fallback'
+      }),
+      { NODE_OPTIONS: `--require ${JSON.stringify(preload)}` }
+    )
+    expect(result.code, result.stderr).toBe(0)
+    const repaired = join(root, expectedHash, 'repair-fallback', 'bun')
+    expect(parseOpenCodeRuntimeResult(result.stdout)).toEqual({
+      status: 'ready',
+      executable: repaired
+    })
+    expect(await readFile(repaired, 'utf8')).toBe('verified runtime')
+    await expect(stat(source)).rejects.toMatchObject({ code: 'ENOENT' })
+  })
+})
+
+it('carries Windows JavaScript and path arguments through the established PowerShell encoder', () => {
+  const windows = getRemoteHostPlatform('win32-x64')
+  const command = promoteOpenCodeRuntimeCommand({
+    host: windows,
+    nodePath: "C:/Program Files/O'Brien/node.exe",
+    stagedBinary: 'C:/Users/a & b/.upload/bun.exe',
+    executable: 'C:/Users/a & b/cache/bun.exe',
+    expectedHash,
+    repairToken: 'one'
+  })
+  const decoded = decodeRemotePowerShellScript(command)
+  expect(decoded).toContain("& 'C:/Program Files/O''Brien/node.exe'")
+  expect(decoded).toContain('createHash')
+  expect(decoded).toContain('C:/Users/a & b/.upload/bun.exe')
+  expect(command).not.toContain('-ExecutionPolicy')
+})
+
+it('rejects missing or malformed host confirmations', () => {
+  expect(() => parseOpenCodeRuntimeResult('login banner')).toThrow('did not confirm')
+  expect(() =>
+    parseOpenCodeRuntimeResult('ORCA_VAULT_SQLITE:{"status":"ready","executable":"node"}')
+  ).toThrow('invalid executable')
+})
+
+it('accepts an absolute Windows UNC executable path', () => {
+  const executable = String.raw`\\server\profile\vault-sqlite\bun.exe`
+  expect(
+    parseOpenCodeRuntimeResult(
+      `ORCA_VAULT_SQLITE:${JSON.stringify({ status: 'ready', executable })}`
+    )
+  ).toEqual({ status: 'ready', executable })
+})
diff --git a/src/main/ssh/ssh-relay-opencode-runtime-commands.ts b/src/main/ssh/ssh-relay-opencode-runtime-commands.ts
new file mode 100644
index 00000000000..14900f15e5b
--- /dev/null
+++ b/src/main/ssh/ssh-relay-opencode-runtime-commands.ts
@@ -0,0 +1,151 @@
+import { shellEscape } from './ssh-connection-utils'
+import { posix, win32 } from 'node:path'
+import { powerShellCommand, powerShellLiteral, powerShellNativeArg } from './ssh-remote-powershell'
+import { isWindowsRemoteHost, type RemoteHostPlatform } from './ssh-remote-platform'
+
+export const OPENCODE_RUNTIME_RESULT = 'ORCA_VAULT_SQLITE:'
+
+function nodeCommand(
+  host: RemoteHostPlatform,
+  nodePath: string,
+  script: string,
+  args: string[]
+): string {
+  if (isWindowsRemoteHost(host)) {
+    return powerShellCommand(
+      `& ${powerShellLiteral(nodePath)} -e ${powerShellNativeArg(script)} -- ${args.map(powerShellNativeArg).join(' ')}; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }`
+    )
+  }
+  return `${shellEscape(nodePath)} -e ${shellEscape(script)} -- ${args.map(shellEscape).join(' ')}`
+}
+
+const SEND = `const send=(value)=>console.log(${JSON.stringify(OPENCODE_RUNTIME_RESULT)}+JSON.stringify(value));`
+const HASH = `const fs=require('node:fs');const fsp=fs.promises;const path=require('node:path');
+async function hash(file){try{const digest=require('node:crypto').createHash('sha256');for await(const chunk of fs.createReadStream(file))digest.update(chunk);return digest.digest('hex')}catch(error){if(error.code==='ENOENT')return null;throw error}}
+`
+
+export function probeOpenCodeNodeSqliteCommand(
+  host: RemoteHostPlatform,
+  nodePath: string,
+  homeDirectory: string
+): string {
+  return nodeCommand(
+    host,
+    nodePath,
+    `${SEND}
+const fs=require('node:fs/promises');const path=require('node:path');
+(async()=>{const data=path.join(process.env.XDG_DATA_HOME?.trim()||path.join(process.argv[1],'.local','share'),'opencode');
+const override=process.env.OPENCODE_DB?.trim();let present=false;
+try{if(override&&override!==':memory:'){present=(await fs.stat(path.isAbsolute(override)?override:path.join(data,override))).isFile()}
+else if(!override){const directory=await fs.opendir(data);for await(const entry of directory){if(entry.isFile()&&/^opencode(?:-[A-Za-z0-9_.-]+)?\\.db$/.test(entry.name)){present=true;break}}}}
+catch(error){if(error.code!=='ENOENT'&&error.code!=='ENOTDIR')throw error}
+if(!present){send({status:'not-needed'});return}
+let db;try{db=new(require('node:sqlite').DatabaseSync)(':memory:');
+if(db.prepare('SELECT 1 AS ready').get().ready!==1)throw Error('SQLite read failed');
+send({status:'ready',executable:process.execPath})}catch{send({status:'unsupported'})}finally{if(db)db.close()}
+})().catch(error=>{console.error(error.message);process.exitCode=1})`,
+    [homeDirectory]
+  )
+}
+
+export function probeOpenCodeRuntimeCacheCommand(args: {
+  host: RemoteHostPlatform
+  nodePath: string
+  executable: string
+  expectedHash: string
+  reference: string
+}): string {
+  return nodeCommand(
+    args.host,
+    args.nodePath,
+    `${HASH}${SEND}
+(async()=>{const [executable,expected,reference]=process.argv.slice(1);
+let candidate=executable;let digest=candidate?await hash(candidate):null;
+if(candidate&&digest!==expected){try{const ref=JSON.parse(await fsp.readFile(reference,'utf8'));
+const relative=path.relative(path.dirname(executable),ref.executable);
+if(ref.protocol===1&&relative&&!relative.startsWith('..'+path.sep)&&relative!=='..'&&!path.isAbsolute(relative)){candidate=ref.executable;digest=await hash(candidate)}}catch{}}
+if(candidate&&digest===expected){if(process.platform!=='win32')await fsp.chmod(candidate,448);send({status:'ready',executable:candidate});return}
+send({status:'missing'})})().catch(error=>{console.error(error.message);process.exitCode=1})`,
+    [args.executable, args.expectedHash, args.reference]
+  )
+}
+
+export function promoteOpenCodeRuntimeCommand(args: {
+  host: RemoteHostPlatform
+  nodePath: string
+  stagedBinary: string
+  executable: string
+  expectedHash: string
+  repairToken: string
+}): string {
+  return nodeCommand(
+    args.host,
+    args.nodePath,
+    `${HASH}${SEND}
+(async()=>{const [source,destination,expected,token]=process.argv.slice(1);
+if(await hash(source)!==expected)throw Error('Uploaded SQLite runtime checksum mismatch');
+let executable=destination;const existing=await hash(destination);
+if(existing!==expected){
+if(existing!==null)executable=path.join(path.dirname(destination),'repair-'+token,path.basename(destination));
+await fsp.mkdir(path.dirname(executable),{recursive:true,mode:448});
+if(process.platform!=='win32')await fsp.chmod(source,448);
+try{await fsp.link(source,executable)}catch(error){if(await hash(executable)!==expected){
+if(!['EPERM','EOPNOTSUPP','ENOTSUP','ENOSYS','EXDEV'].includes(error.code))throw error;
+executable=path.join(path.dirname(destination),'repair-'+token,path.basename(destination));
+await fsp.mkdir(path.dirname(executable),{recursive:true,mode:448});await fsp.rename(source,executable)
+}}
+}
+send({status:'ready',executable})})().catch(error=>{console.error(error.message);process.exitCode=1})`,
+    [args.stagedBinary, args.executable, args.expectedHash, args.repairToken]
+  )
+}
+
+export function publishOpenCodeRuntimeReferenceCommand(args: {
+  host: RemoteHostPlatform
+  nodePath: string
+  stagedReference: string
+  reference: string
+  token: string
+}): string {
+  return nodeCommand(
+    args.host,
+    args.nodePath,
+    `${SEND}
+const fs=require('node:fs/promises');const path=require('node:path');
+(async()=>{const [source,destination,token]=process.argv.slice(1);const temporary=destination+'.upload-'+token;
+try{await fs.copyFile(source,temporary,require('node:fs').constants.COPYFILE_EXCL);
+await fs.rename(temporary,destination);send({status:'published'})}
+finally{await fs.rm(temporary,{force:true})}})().catch(error=>{console.error(error.message);process.exitCode=1})`,
+    [args.stagedReference, args.reference, args.token]
+  )
+}
+
+export function parseOpenCodeRuntimeResult(output: string): {
+  status: string
+  executable?: string
+} {
+  const line = output.split(/\r?\n/).findLast((entry) => entry.startsWith(OPENCODE_RUNTIME_RESULT))
+  if (!line) {
+    throw new Error('The host did not confirm SQLite runtime setup.')
+  }
+  const result: unknown = JSON.parse(line.slice(OPENCODE_RUNTIME_RESULT.length))
+  if (
+    typeof result !== 'object' ||
+    result === null ||
+    !('status' in result) ||
+    typeof result.status !== 'string'
+  ) {
+    throw new Error('Invalid SQLite runtime setup result.')
+  }
+  if ('executable' in result) {
+    if (
+      typeof result.executable !== 'string' ||
+      !(posix.isAbsolute(result.executable) || win32.isAbsolute(result.executable)) ||
+      /[\0\r\n]/.test(result.executable)
+    ) {
+      throw new Error('SQLite runtime setup returned an invalid executable path.')
+    }
+    return { status: result.status, executable: result.executable }
+  }
+  return { status: result.status }
+}
diff --git a/src/main/ssh/ssh-relay-opencode-runtime-retry.test.ts b/src/main/ssh/ssh-relay-opencode-runtime-retry.test.ts
new file mode 100644
index 00000000000..be8fde1fc5e
--- /dev/null
+++ b/src/main/ssh/ssh-relay-opencode-runtime-retry.test.ts
@@ -0,0 +1,90 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createRemoteOpenCodeRuntimeRetry } from './ssh-relay-opencode-runtime-retry'
+
+afterEach(() => vi.useRealTimers())
+
+describe('scan-triggered SSH OpenCode runtime preparation', () => {
+  it('rechecks an empty host after the cooldown, coalesces scans, and stops once ready', async () => {
+    vi.useFakeTimers()
+    const retry = vi.fn().mockResolvedValue('ready')
+    const prepare = createRemoteOpenCodeRuntimeRetry(
+      Promise.resolve('not-needed'),
+      Promise.resolve(true),
+      retry
+    )
+    const signal = new AbortController().signal
+    await prepare(signal)
+    expect(retry).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(60_000)
+    await Promise.all([prepare(signal), prepare(signal), prepare(signal)])
+    expect(retry).toHaveBeenCalledOnce()
+    await vi.advanceTimersByTimeAsync(60_000)
+    await prepare(signal)
+    expect(retry).toHaveBeenCalledOnce()
+  })
+
+  it('waits for initial background cleanup before a scan can retry', async () => {
+    vi.useFakeTimers()
+    let finish!: () => void
+    const cleanup = new Promise<boolean>((resolve) => {
+      finish = () => resolve(true)
+    })
+    const retry = vi.fn().mockResolvedValue('ready')
+    const prepare = createRemoteOpenCodeRuntimeRetry(Promise.resolve('failed'), cleanup, retry)
+    await prepare(new AbortController().signal)
+    await vi.advanceTimersByTimeAsync(30_000)
+    const pending = prepare(new AbortController().signal)
+    await Promise.resolve()
+    expect(retry).not.toHaveBeenCalled()
+    finish()
+    await pending
+    expect(retry).toHaveBeenCalledOnce()
+  })
+
+  it('cancels a queued retry on session teardown without starting a remote command', async () => {
+    vi.useFakeTimers()
+    const retry = vi.fn()
+    const prepare = createRemoteOpenCodeRuntimeRetry(
+      Promise.resolve('not-needed'),
+      new Promise(() => {}),
+      retry
+    )
+    const controller = new AbortController()
+    await prepare(controller.signal)
+    await vi.advanceTimersByTimeAsync(60_000)
+    const pending = prepare(controller.signal)
+    controller.abort()
+    await pending
+    await prepare(controller.signal)
+    expect(retry).not.toHaveBeenCalled()
+  })
+
+  it('never retries an unconfirmed remote teardown', async () => {
+    vi.useFakeTimers()
+    const retry = vi.fn()
+    const prepare = createRemoteOpenCodeRuntimeRetry(
+      Promise.resolve('teardown-unconfirmed'),
+      Promise.resolve(true),
+      retry
+    )
+    await vi.advanceTimersByTimeAsync(3600_000)
+    await prepare(new AbortController().signal)
+    expect(retry).not.toHaveBeenCalled()
+  })
+
+  it('never retries after deployment cleanup reports an unconfirmed command', async () => {
+    vi.useFakeTimers()
+    const retry = vi.fn()
+    const prepare = createRemoteOpenCodeRuntimeRetry(
+      Promise.resolve('not-needed'),
+      Promise.resolve(false),
+      retry
+    )
+    await prepare(new AbortController().signal)
+    await vi.advanceTimersByTimeAsync(60_000)
+    await prepare(new AbortController().signal)
+    await vi.advanceTimersByTimeAsync(3600_000)
+    await prepare(new AbortController().signal)
+    expect(retry).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/ssh/ssh-relay-opencode-runtime-retry.ts b/src/main/ssh/ssh-relay-opencode-runtime-retry.ts
new file mode 100644
index 00000000000..103da40a6cd
--- /dev/null
+++ b/src/main/ssh/ssh-relay-opencode-runtime-retry.ts
@@ -0,0 +1,42 @@
+import { waitForPromiseWithSignal } from '../../shared/abort-signal-reason'
+import type { RemoteOpenCodeRuntimeOutcome } from './ssh-relay-opencode-runtime'
+
+export type RemoteOpenCodeRuntimePreparation = (signal: AbortSignal) => Promise<void>
+
+export function createRemoteOpenCodeRuntimeRetry(
+  initialSetup: Promise<RemoteOpenCodeRuntimeOutcome>,
+  backgroundCleanup: Promise<boolean>,
+  retry: (signal: AbortSignal) => Promise<RemoteOpenCodeRuntimeOutcome>
+): RemoteOpenCodeRuntimePreparation {
+  let nextAttempt = Infinity
+  let pending: Promise<void> | undefined
+  const remember = (outcome: RemoteOpenCodeRuntimeOutcome): void => {
+    nextAttempt =
+      outcome === 'ready' || outcome === 'teardown-unconfirmed'
+        ? Infinity
+        : Date.now() + (outcome === 'not-needed' ? 60_000 : 30_000)
+  }
+  const initialized = initialSetup.then(remember).catch(() => {})
+  return (signal) => {
+    if (signal.aborted) {
+      return Promise.resolve()
+    }
+    pending ??= (async () => {
+      await waitForPromiseWithSignal(initialized, signal)
+      if (Date.now() < nextAttempt) {
+        return
+      }
+      if (!(await waitForPromiseWithSignal(backgroundCleanup, signal))) {
+        nextAttempt = Infinity
+        return
+      }
+      signal.throwIfAborted()
+      remember(await retry(signal))
+    })()
+      .catch(() => {})
+      .finally(() => {
+        pending = undefined
+      })
+    return pending
+  }
+}
diff --git a/src/main/ssh/ssh-relay-opencode-runtime.test.ts b/src/main/ssh/ssh-relay-opencode-runtime.test.ts
new file mode 100644
index 00000000000..ce3da563b97
--- /dev/null
+++ b/src/main/ssh/ssh-relay-opencode-runtime.test.ts
@@ -0,0 +1,412 @@
+import { mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  exec: vi.fn(),
+  upload: vi.fn(),
+  write: vi.fn(),
+  materialize: vi.fn(),
+  target: vi.fn(),
+  warm: false,
+  checksumError: false,
+  cleanupError: false,
+  reservationError: false
+}))
+vi.mock('./ssh-relay-deploy-helpers', () => ({
+  execCommand: mocks.exec,
+  isUnconfirmedSshCommandTermination: (error: unknown) =>
+    error instanceof Error &&
+    'sshChannelCloseConfirmed' in error &&
+    error.sshChannelCloseConfirmed === false
+}))
+vi.mock('./ssh-relay-install-transfers', () => ({
+  uploadRelayDirectory: mocks.upload,
+  writeRelayFile: mocks.write
+}))
+vi.mock('./orcad-bun-runtime-materializer', () => ({
+  materializeCachedOrcadBunRuntime: mocks.materialize
+}))
+vi.mock('./orcad-deployment-target', () => ({ resolveOrcadDeploymentTarget: mocks.target }))
+
+import type { SshConnection } from './ssh-connection'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+import { ORCAD_BUN_RELEASE_ASSETS } from '../../shared/orcad-bun-runtime'
+import { ensureRemoteOpenCodeRuntime } from './ssh-relay-opencode-runtime'
+import { OPENCODE_RUNTIME_RESULT } from './ssh-relay-opencode-runtime-commands'
+
+const host = getRemoteHostPlatform('linux-x64')
+const remoteHome = '/home/ada'
+const relayDir = `${remoteHome}/.orca-remote/relay-build`
+const binary = `${remoteHome}/.orca-remote/vault-sqlite/${ORCAD_BUN_RELEASE_ASSETS['linux-x64-glibc'].executableSha256}/bun`
+let cacheRoot: string
+let runtime: string
+const frame = (status: string, executable?: string) =>
+  `${OPENCODE_RUNTIME_RESULT}${JSON.stringify({ status, executable })}\n`
+const options = () => ({ nodePath: '/usr/bin/node', relayDir, cacheRoot })
+
+function hostCommandResult(command: string): string {
+  if (command.includes('staging quota is full')) {
+    if (mocks.reservationError) {
+      throw new Error('staging quota is full')
+    }
+    return `__ORCA_UPLOAD_STAGE_SLOT__${command.match(/\.sftp-namespace-[0-9a-f]{32}/)?.[0]}:slot-0`
+  }
+  if (command.includes('SELECT 1 AS ready')) {
+    return frame('unsupported')
+  }
+  if (command.includes('checksum mismatch')) {
+    if (mocks.checksumError) {
+      throw new Error('Uploaded SQLite runtime checksum mismatch')
+    }
+    return frame('ready', binary)
+  }
+  if (command.includes('published')) {
+    return frame('published')
+  }
+  if (command.includes('status:')) {
+    return mocks.warm ? frame('ready', binary) : frame('missing')
+  }
+  if (mocks.cleanupError && command.includes('claim_identity') && !command.includes('old=')) {
+    throw Object.assign(new Error('Cleanup teardown is unconfirmed'), {
+      sshChannelCloseConfirmed: false
+    })
+  }
+  return ''
+}
+
+function connection(system = false): SshConnection {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Setup reads only the mocked transport flag and connection generation; remote I/O is mocked.
+  return {
+    usesSystemSshTransport: () => system,
+    getConnectGeneration: () => 1
+  } as unknown as SshConnection
+}
+
+beforeEach(async () => {
+  vi.resetAllMocks()
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+  cacheRoot = await mkdtemp(join(tmpdir(), 'orca-vault-runtime-'))
+  runtime = join(cacheRoot, 'repair-1-orcad-bun')
+  await writeFile(runtime, 'verified runtime')
+  mocks.materialize.mockResolvedValue(runtime)
+  mocks.target.mockResolvedValue('linux-x64-glibc')
+  mocks.warm = false
+  mocks.checksumError = false
+  mocks.cleanupError = false
+  mocks.reservationError = false
+  mocks.exec.mockImplementation(async (_conn, command: string) => hostCommandResult(command))
+})
+
+afterEach(async () => {
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+  await rm(cacheRoot, { recursive: true, force: true })
+})
+
+describe('SSH OpenCode runtime setup', () => {
+  it('publishes a capable existing Node without materializing or uploading Bun', async () => {
+    mocks.exec.mockResolvedValueOnce(frame('ready', '/opt/node 24/bin/node'))
+    expect(await ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())).toBe(
+      'ready'
+    )
+    expect(mocks.target).not.toHaveBeenCalled()
+    expect(mocks.materialize).not.toHaveBeenCalled()
+    expect(mocks.upload).not.toHaveBeenCalled()
+    expect(JSON.parse(mocks.write.mock.calls[0][3])).toEqual({
+      protocol: 1,
+      executable: '/opt/node 24/bin/node'
+    })
+  })
+
+  it('uses the verified materializer cache after Node 18 fails the actual read probe', async () => {
+    mocks.upload.mockImplementation(async (_conn, localDir: string) => {
+      expect(await readdir(localDir)).toEqual(['bun'])
+      expect(await readFile(join(localDir, 'bun'), 'utf8')).toBe('verified runtime')
+    })
+    expect(await ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())).toBe(
+      'ready'
+    )
+    expect(mocks.target).toHaveBeenCalledWith(
+      expect.objectContaining({ host, signal: expect.any(AbortSignal) })
+    )
+    expect(mocks.materialize).toHaveBeenCalledWith('linux-x64-glibc', cacheRoot, {
+      signal: expect.any(AbortSignal)
+    })
+    expect(await readdir(cacheRoot)).toEqual(['repair-1-orcad-bun'])
+    expect(JSON.parse(mocks.write.mock.calls[0][3])).toEqual({ protocol: 1, executable: binary })
+  })
+
+  it('reuses a remotely verified binary without downloading it again', async () => {
+    mocks.warm = true
+    expect(await ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())).toBe(
+      'ready'
+    )
+    expect(mocks.materialize).not.toHaveBeenCalled()
+    expect(mocks.upload).not.toHaveBeenCalled()
+  })
+
+  it('uses one staging namespace for binary uploads and atomic reference writes', async () => {
+    await ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())
+    const uploadOptions = mocks.upload.mock.calls[0][4]
+    const writeOptions = mocks.write.mock.calls[0][4]
+    expect(uploadOptions.sftpNamespace.homeRelativeNamespaceRoot).toMatch(
+      /^\.orca-remote\/\.upload-stages\/slot-0$/
+    )
+    expect(uploadOptions.sftpNamespace.shellProbePath).toBe(
+      writeOptions.sftpNamespace.shellProbePath
+    )
+    expect(writeOptions.sftpNamespace.homeRelativePath).toBe(
+      `${uploadOptions.sftpNamespace.homeRelativePath}/opencode-sqlite-runtime.json`
+    )
+  })
+
+  it('skips namespace probing on system SSH', async () => {
+    await ensureRemoteOpenCodeRuntime(connection(true), host, remoteHome, options())
+    expect(mocks.upload.mock.calls[0][4].sftpNamespace).toBeUndefined()
+    expect(mocks.write.mock.calls[0][4].sftpNamespace).toBeUndefined()
+  })
+
+  it('coalesces repeated setup for one execution connection and directory', async () => {
+    const conn = connection()
+    const result = await Promise.all([
+      ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options()),
+      ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())
+    ])
+    expect(result).toEqual(['ready', 'ready'])
+    expect(mocks.upload).toHaveBeenCalledOnce()
+  })
+
+  it('coalesces the bounded target cache fill across hosts', async () => {
+    let finish!: (path: string) => void
+    mocks.materialize.mockReturnValue(
+      new Promise<string>((resolve) => {
+        finish = resolve
+      })
+    )
+    const first = ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())
+    const second = ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())
+    await vi.waitFor(() => expect(mocks.materialize).toHaveBeenCalledOnce())
+    finish(runtime)
+    expect(await Promise.all([first, second])).toEqual(['ready', 'ready'])
+    expect(mocks.upload).toHaveBeenCalledTimes(2)
+  })
+
+  it('never publishes a reference after a failed remote checksum', async () => {
+    mocks.checksumError = true
+    expect(await ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())).toBe(
+      'failed'
+    )
+    expect(mocks.write).not.toHaveBeenCalled()
+  })
+
+  it('aborts an upload without publishing or running further host commands', async () => {
+    const controller = new AbortController()
+    mocks.upload.mockImplementation(async (_conn, _local, _remote, _host, transfer) => {
+      controller.abort()
+      transfer.signal.throwIfAborted()
+    })
+    expect(
+      await ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, {
+        ...options(),
+        signal: controller.signal
+      })
+    ).toBe('teardown-unconfirmed')
+    expect(mocks.write).not.toHaveBeenCalled()
+    expect(mocks.exec).toHaveBeenCalledTimes(4)
+  })
+
+  it('bounds even an unresponsive setup operation at 180 seconds', async () => {
+    vi.useFakeTimers()
+    mocks.exec.mockReturnValue(new Promise(() => {}))
+    const conn = connection()
+    const result = ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())
+    await vi.advanceTimersByTimeAsync(180_000)
+    expect(await result).toBe('teardown-unconfirmed')
+    expect(mocks.exec.mock.calls[0][2].signal.aborted).toBe(true)
+    expect(mocks.materialize).not.toHaveBeenCalled()
+    expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe(
+      'teardown-unconfirmed'
+    )
+    expect(mocks.exec).toHaveBeenCalledOnce()
+  })
+
+  it('admits setup on a new connection generation after an unconfirmed teardown', async () => {
+    const conn = connection()
+    const generation = vi.spyOn(conn, 'getConnectGeneration')
+    mocks.exec.mockRejectedValueOnce(
+      Object.assign(new Error('Channel teardown is unconfirmed'), {
+        sshChannelCloseConfirmed: false
+      })
+    )
+    expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe(
+      'teardown-unconfirmed'
+    )
+    expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe(
+      'teardown-unconfirmed'
+    )
+    expect(mocks.exec).toHaveBeenCalledOnce()
+    generation.mockReturnValue(2)
+    mocks.exec.mockResolvedValueOnce(frame('ready', '/usr/bin/node'))
+    expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe('ready')
+    expect(mocks.write).toHaveBeenCalledOnce()
+  })
+
+  it.each(['ready', 'not-needed'] as const)(
+    'refuses a late %s result from a superseded setup',
+    async (status) => {
+      const conn = connection()
+      const generation = vi.spyOn(conn, 'getConnectGeneration')
+      mocks.exec.mockImplementationOnce(async () => {
+        generation.mockReturnValue(2)
+        return frame(status, '/usr/bin/node')
+      })
+      expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe('failed')
+      expect(mocks.exec).toHaveBeenCalledOnce()
+      expect(mocks.write).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['publication', 'cleanup'] as const)(
+    'refuses completed setup when its generation changes during %s',
+    async (stage) => {
+      const conn = connection()
+      const generation = vi.spyOn(conn, 'getConnectGeneration')
+      const started = Promise.withResolvers<void>()
+      const finish = Promise.withResolvers<string>()
+      mocks.exec.mockImplementation(async (_conn, command: string) => {
+        if (command.includes('SELECT 1 AS ready')) {
+          return frame('ready', '/usr/bin/node')
+        }
+        const selected =
+          stage === 'publication'
+            ? command.includes('published')
+            : command.includes('claim_identity') && !command.includes('old=')
+        if (selected) {
+          started.resolve()
+          return finish.promise
+        }
+        return hostCommandResult(command)
+      })
+      const pending = ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())
+      await started.promise
+      generation.mockReturnValue(2)
+      finish.resolve(stage === 'publication' ? frame('published') : '')
+
+      expect(await pending).toBe('failed')
+      expect(mocks.exec).toHaveBeenCalledTimes(stage === 'publication' ? 4 : 5)
+      expect(mocks.write).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('keeps a newer setup registered when the superseded setup finishes late', async () => {
+    const conn = connection()
+    const generation = vi.spyOn(conn, 'getConnectGeneration')
+    const oldProbe = Promise.withResolvers<string>()
+    const currentProbe = Promise.withResolvers<string>()
+    mocks.exec.mockReturnValueOnce(oldProbe.promise).mockReturnValueOnce(currentProbe.promise)
+    const oldSetup = ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())
+    generation.mockReturnValue(2)
+    const currentSetup = ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())
+    oldProbe.resolve(frame('not-needed'))
+    expect(await oldSetup).toBe('failed')
+
+    const joined = ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())
+    expect(mocks.exec).toHaveBeenCalledTimes(2)
+    currentProbe.resolve(frame('not-needed'))
+    expect(await Promise.all([currentSetup, joined])).toEqual(['not-needed', 'not-needed'])
+  })
+
+  it.each(['deadline', 'caller'] as const)(
+    'allows retry after local download cancellation by %s without reserving a stage',
+    async (cause) => {
+      const controller = new AbortController()
+      let finish!: (path: string) => void
+      mocks.materialize.mockReturnValueOnce(
+        new Promise<string>((resolve) => {
+          finish = resolve
+        })
+      )
+      if (cause === 'deadline') {
+        vi.useFakeTimers()
+      }
+      const conn = connection()
+      const pending = ensureRemoteOpenCodeRuntime(conn, host, remoteHome, {
+        ...options(),
+        signal: controller.signal
+      })
+      await vi.waitFor(() => expect(mocks.materialize).toHaveBeenCalledOnce())
+      expect(mocks.exec).toHaveBeenCalledTimes(2)
+      if (cause === 'deadline') {
+        await vi.advanceTimersByTimeAsync(180_000)
+      } else {
+        controller.abort()
+      }
+      expect(await pending).toBe('failed')
+      finish(runtime)
+      vi.useRealTimers()
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(mocks.exec).toHaveBeenCalledTimes(2)
+      expect(mocks.upload).not.toHaveBeenCalled()
+      expect(mocks.write).not.toHaveBeenCalled()
+      expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe('ready')
+      expect(mocks.upload).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('retains the upload stage when a failed transfer may still be running', async () => {
+    mocks.upload.mockRejectedValue(
+      Object.assign(new Error('Upload teardown is unconfirmed'), {
+        sshChannelCloseConfirmed: false
+      })
+    )
+    const conn = connection()
+    expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe(
+      'teardown-unconfirmed'
+    )
+    expect(mocks.exec).toHaveBeenCalledTimes(4)
+    expect(mocks.write).not.toHaveBeenCalled()
+    expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe(
+      'teardown-unconfirmed'
+    )
+    expect(mocks.exec).toHaveBeenCalledTimes(4)
+  })
+
+  it('reports an unconfirmed stage cleanup to the deployment command queue', async () => {
+    mocks.exec.mockResolvedValueOnce(frame('ready', '/usr/bin/node'))
+    mocks.cleanupError = true
+    expect(await ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())).toBe(
+      'teardown-unconfirmed'
+    )
+    expect(mocks.exec).toHaveBeenCalledTimes(5)
+  })
+
+  it('skips installation without data and retries when a database appears on the same connection', async () => {
+    const conn = connection()
+    mocks.exec.mockResolvedValueOnce(frame('not-needed'))
+    expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe('not-needed')
+    expect(mocks.exec).toHaveBeenCalledOnce()
+    expect(mocks.materialize).not.toHaveBeenCalled()
+    expect(mocks.upload).not.toHaveBeenCalled()
+    expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe('ready')
+    expect(mocks.upload).toHaveBeenCalledOnce()
+  })
+
+  it('fails optionally without uploading when all bounded stages are occupied', async () => {
+    mocks.reservationError = true
+    expect(await ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())).toBe(
+      'failed'
+    )
+    expect(mocks.exec).toHaveBeenCalledTimes(4)
+    expect(mocks.upload).not.toHaveBeenCalled()
+  })
+
+  it('does not mistake an unanswered Node probe for an old runtime', async () => {
+    mocks.exec.mockResolvedValue('login banner only')
+    expect(await ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())).toBe(
+      'failed'
+    )
+    expect(mocks.materialize).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/ssh/ssh-relay-opencode-runtime.ts b/src/main/ssh/ssh-relay-opencode-runtime.ts
new file mode 100644
index 00000000000..83657e8b7f2
--- /dev/null
+++ b/src/main/ssh/ssh-relay-opencode-runtime.ts
@@ -0,0 +1,298 @@
+import { randomBytes } from 'node:crypto'
+import { copyFile, link, mkdtemp, rm } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
+import { getAppEnvironment } from '../../shared/app-environment'
+import { waitForPromiseWithSignal } from '../../shared/abort-signal-reason'
+import { ORCAD_BUN_RELEASE_ASSETS, type OrcadBunTarget } from '../../shared/orcad-bun-runtime'
+import type { SshConnection } from './ssh-connection'
+import { resolveOrcadDeploymentTarget } from './orcad-deployment-target'
+import { materializeCachedOrcadBunRuntime } from './orcad-bun-runtime-materializer'
+import { execCommand, isUnconfirmedSshCommandTermination } from './ssh-relay-deploy-helpers'
+import { uploadRelayDirectory, writeRelayFile } from './ssh-relay-install-transfers'
+import {
+  createRelayUploadStageNamespace,
+  relayUploadStageSftpNamespaceMapping
+} from './ssh-relay-install-namespace'
+import { isWindowsRemoteHost, joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
+import { RELAY_REMOTE_DIR } from './relay-protocol'
+import { createRelayInstallMarkerFileName } from './ssh-relay-install-marker'
+import {
+  cleanupOwnedRelayUploadStageCommand,
+  parseReservedRelayUploadStage,
+  recoverOneStaleRelayUploadStageCommand,
+  reserveRelayUploadStageCommand,
+  RELAY_UPLOAD_STAGE_POOL_NAME
+} from './ssh-relay-upload-stage-commands'
+import {
+  parseOpenCodeRuntimeResult,
+  probeOpenCodeRuntimeCacheCommand,
+  probeOpenCodeNodeSqliteCommand,
+  promoteOpenCodeRuntimeCommand,
+  publishOpenCodeRuntimeReferenceCommand
+} from './ssh-relay-opencode-runtime-commands'
+
+const SETUP_TIMEOUT_MS = 180_000
+export type RemoteOpenCodeRuntimeOutcome =
+  | 'ready'
+  | 'not-needed'
+  | 'failed'
+  | 'teardown-unconfirmed'
+const installations = new WeakMap<
+  SshConnection,
+  { generation: number; byDirectory: Map<string, Promise<RemoteOpenCodeRuntimeOutcome>> }
+>()
+const downloads = new Map<string, Promise<string>>()
+
+type SetupOptions = {
+  nodePath: string
+  relayDir: string
+  signal?: AbortSignal
+  cacheRoot?: string
+}
+type RemoteOperation = <T>(operation: () => Promise<T>) => Promise<T>
+
+/** Optional companion setup; the host's relay and terminals never depend on it. */
+export function ensureRemoteOpenCodeRuntime(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  remoteHome: string,
+  options: SetupOptions
+): Promise<RemoteOpenCodeRuntimeOutcome> {
+  const generation = conn.getConnectGeneration()
+  let current = installations.get(conn)
+  if (current?.generation !== generation) {
+    current = { generation, byDirectory: new Map() }
+    installations.set(conn, current)
+  }
+  const { byDirectory } = current
+  const active = byDirectory.get(options.relayDir)
+  if (active) {
+    return waitForPromiseWithSignal(active, options.signal).catch(() => 'teardown-unconfirmed')
+  }
+  const timeout = new AbortController()
+  const timer = setTimeout(
+    () => timeout.abort(new Error('SSH SQLite runtime setup timed out.')),
+    SETUP_TIMEOUT_MS
+  )
+  timer.unref()
+  const signal = options.signal ? AbortSignal.any([options.signal, timeout.signal]) : timeout.signal
+  let remotePending = false
+  let remoteUnconfirmed = false
+  const assertCurrentGeneration = (): void => {
+    if (conn.getConnectGeneration() !== generation) {
+      throw new Error('SSH connection changed during SQLite runtime setup.')
+    }
+  }
+  const remote: RemoteOperation = async (operation) => {
+    signal.throwIfAborted()
+    assertCurrentGeneration()
+    remotePending = true
+    try {
+      const result = await operation()
+      assertCurrentGeneration()
+      return result
+    } catch (error) {
+      remoteUnconfirmed ||= signal.aborted || isUnconfirmedSshCommandTermination(error)
+      throw error
+    } finally {
+      remotePending = false
+    }
+  }
+  const pending = waitForPromiseWithSignal(
+    install(conn, host, remoteHome, options, signal, remote),
+    signal
+  )
+    .then((outcome) => {
+      assertCurrentGeneration()
+      return outcome
+    })
+    .catch((error: unknown) => {
+      console.warn(
+        '[ssh-relay] OpenCode history runtime setup did not finish:',
+        error instanceof Error ? error.message : String(error)
+      )
+      return remotePending || remoteUnconfirmed || isUnconfirmedSshCommandTermination(error)
+        ? ('teardown-unconfirmed' as const)
+        : ('failed' as const)
+    })
+    .then((outcome) => {
+      clearTimeout(timer)
+      // An unresolved channel must not admit another installer on this connection.
+      if (outcome !== 'teardown-unconfirmed') {
+        byDirectory.delete(options.relayDir)
+      }
+      return outcome
+    })
+  byDirectory.set(options.relayDir, pending)
+  return pending
+}
+
+async function install(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  remoteHome: string,
+  options: SetupOptions,
+  signal: AbortSignal,
+  remote: RemoteOperation
+): Promise<RemoteOpenCodeRuntimeOutcome> {
+  const exec = async (command: string): Promise<string> => {
+    signal.throwIfAborted()
+    const output = await remote(() =>
+      execCommand(conn, command, {
+        signal,
+        wrapCommand: !isWindowsRemoteHost(host)
+      })
+    )
+    signal.throwIfAborted()
+    return output
+  }
+  const node = parseOpenCodeRuntimeResult(
+    await exec(probeOpenCodeNodeSqliteCommand(host, options.nodePath, remoteHome))
+  )
+  if (node.status === 'not-needed') {
+    return 'not-needed'
+  }
+  if (node.status !== 'ready' && node.status !== 'unsupported') {
+    throw new Error('The host did not complete its SQLite read probe.')
+  }
+  let executable = node.executable
+  let target: OrcadBunTarget | undefined
+  let localRuntime: string | undefined
+  if (node.status === 'unsupported') {
+    target = await resolveOrcadDeploymentTarget({ conn, host, signal, exec })
+    const expectedHash = ORCAD_BUN_RELEASE_ASSETS[target].executableSha256
+    executable = joinRemotePath(
+      host,
+      remoteHome,
+      RELAY_REMOTE_DIR,
+      'vault-sqlite',
+      expectedHash,
+      isWindowsRemoteHost(host) ? 'bun.exe' : 'bun'
+    )
+    const cached = parseOpenCodeRuntimeResult(
+      await exec(
+        probeOpenCodeRuntimeCacheCommand({
+          host,
+          nodePath: options.nodePath,
+          executable,
+          expectedHash,
+          reference: joinRemotePath(host, options.relayDir, 'opencode-sqlite-runtime.json')
+        })
+      )
+    )
+    if (cached.status === 'ready' && cached.executable) {
+      executable = cached.executable
+    } else if (cached.status === 'missing') {
+      const cacheRoot =
+        options.cacheRoot ?? join(getAppEnvironment().getPath('userData'), 'orcad-artifacts')
+      localRuntime = await cachedRuntime(target, cacheRoot, signal)
+      signal.throwIfAborted()
+    } else {
+      throw new Error('The host did not confirm its SQLite runtime cache.')
+    }
+  }
+  if (!executable) {
+    throw new Error('The host did not identify its SQLite executable.')
+  }
+  const token = randomBytes(12).toString('hex')
+  const relativePool = `${RELAY_REMOTE_DIR}/${RELAY_UPLOAD_STAGE_POOL_NAME}`
+  const poolDir = joinRemotePath(host, remoteHome, relativePool)
+  const owner = createRelayInstallMarkerFileName()
+  await exec(recoverOneStaleRelayUploadStageCommand(host, poolDir))
+  const stage = parseReservedRelayUploadStage(
+    host,
+    poolDir,
+    owner,
+    await exec(reserveRelayUploadStageCommand(host, poolDir, owner))
+  )
+  const stageDir = stage.slotDir
+  const namespace = createRelayUploadStageNamespace(`${relativePool}/${stage.slotName}`, owner)
+  const mapping = (file?: string) =>
+    !isWindowsRemoteHost(host) && conn.usesSystemSshTransport?.() !== true
+      ? relayUploadStageSftpNamespaceMapping(namespace, host, stageDir, file)
+      : undefined
+  let cleanupAllowed = true
+  try {
+    if (target && localRuntime) {
+      const localStage = await mkdtemp(join(dirname(localRuntime), '.vault-upload-'))
+      try {
+        const binaryName = isWindowsRemoteHost(host) ? 'bun.exe' : 'bun'
+        const localBinary = join(localStage, binaryName)
+        await link(localRuntime, localBinary).catch(() => copyFile(localRuntime, localBinary))
+        signal.throwIfAborted()
+        await remote(() =>
+          uploadRelayDirectory(conn, localStage, joinRemotePath(host, stageDir, 'payload'), host, {
+            signal,
+            sftpNamespace: mapping()
+          })
+        )
+        const promoted = parseOpenCodeRuntimeResult(
+          await exec(
+            promoteOpenCodeRuntimeCommand({
+              host,
+              nodePath: options.nodePath,
+              stagedBinary: joinRemotePath(host, stageDir, 'payload', binaryName),
+              executable,
+              expectedHash: ORCAD_BUN_RELEASE_ASSETS[target].executableSha256,
+              repairToken: token
+            })
+          )
+        )
+        if (promoted.status !== 'ready' || !promoted.executable) {
+          throw new Error('The host did not verify the uploaded SQLite runtime.')
+        }
+        executable = promoted.executable
+      } finally {
+        await rm(localStage, { recursive: true, force: true }).catch(() => {})
+      }
+    }
+    const referenceName = 'opencode-sqlite-runtime.json'
+    const stagedReference = joinRemotePath(host, stageDir, 'payload', referenceName)
+    signal.throwIfAborted()
+    await remote(() =>
+      writeRelayFile(conn, host, stagedReference, JSON.stringify({ protocol: 1, executable }), {
+        signal,
+        sftpNamespace: mapping(referenceName)
+      })
+    )
+    const published = parseOpenCodeRuntimeResult(
+      await exec(
+        publishOpenCodeRuntimeReferenceCommand({
+          host,
+          nodePath: options.nodePath,
+          stagedReference,
+          reference: joinRemotePath(host, options.relayDir, referenceName),
+          token
+        })
+      )
+    )
+    return published.status === 'published' ? 'ready' : 'failed'
+  } catch (error) {
+    cleanupAllowed = !isUnconfirmedSshCommandTermination(error)
+    throw error
+  } finally {
+    if (cleanupAllowed && !signal.aborted) {
+      await exec(cleanupOwnedRelayUploadStageCommand(host, stage, owner)).catch((error) => {
+        if (isUnconfirmedSshCommandTermination(error)) {
+          throw error
+        }
+      })
+    }
+  }
+}
+
+function cachedRuntime(
+  target: OrcadBunTarget,
+  cacheRoot: string,
+  signal: AbortSignal
+): Promise<string> {
+  const key = `${cacheRoot}\0${target}`
+  let pending = downloads.get(key)
+  if (!pending) {
+    pending = materializeCachedOrcadBunRuntime(target, cacheRoot, {
+      signal: AbortSignal.timeout(SETUP_TIMEOUT_MS)
+    }).finally(() => downloads.delete(key))
+    downloads.set(key, pending)
+  }
+  return waitForPromiseWithSignal(pending, signal)
+}
diff --git a/src/main/ssh/ssh-relay-pty-master-cloexec-install.test.ts b/src/main/ssh/ssh-relay-pty-master-cloexec-install.test.ts
index 5b2a42d87c7..f7fd4d65794 100644
--- a/src/main/ssh/ssh-relay-pty-master-cloexec-install.test.ts
+++ b/src/main/ssh/ssh-relay-pty-master-cloexec-install.test.ts
@@ -1,6 +1,9 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as RelayInstallMarkerModule from './ssh-relay-install-marker'
 
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', () => ({
   remoteRipgrepLayout: vi.fn().mockReturnValue(null),
   recordRemoteRipgrepReference: vi.fn().mockResolvedValue(false),
diff --git a/src/main/ssh/ssh-relay-repair-lock-termination.test.ts b/src/main/ssh/ssh-relay-repair-lock-termination.test.ts
new file mode 100644
index 00000000000..db73b92e239
--- /dev/null
+++ b/src/main/ssh/ssh-relay-repair-lock-termination.test.ts
@@ -0,0 +1,137 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('./ssh-relay-deploy-helpers', () => ({ execCommand: vi.fn() }))
+
+import type { SshConnection } from './ssh-connection'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import { tryAcquireRelayRepairLock } from './ssh-relay-repair-lock'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The mocked execCommand never reads the connection.
+const conn = {} as SshConnection
+const mockExec = vi.mocked(execCommand)
+const freshLockReplies = ['OPEN', 'LOCKED', '0']
+const contentionReplies = ['OPEN', '', 'BUSY', 'BUSY']
+
+const failureStages = [
+  { stage: 'initial claim probe', replies: [], recovery: [], result: 'error' },
+  { stage: 'parent creation', replies: ['OPEN'], recovery: freshLockReplies, result: 'busy' },
+  { stage: 'lock creation', replies: ['OPEN', ''], recovery: freshLockReplies, result: 'busy' },
+  {
+    stage: 'stale takeover',
+    replies: ['OPEN', '', 'BUSY'],
+    recovery: freshLockReplies,
+    result: 'busy'
+  },
+  {
+    stage: 'claim probe after creation',
+    replies: ['OPEN', '', 'OK'],
+    recovery: [''],
+    result: 'error'
+  },
+  {
+    stage: 'release after creation',
+    replies: ['OPEN', '', 'OK', 'LOCKED'],
+    recovery: [],
+    result: 'gc'
+  },
+  {
+    stage: 'claim probe after takeover',
+    replies: ['OPEN', '', 'BUSY', 'OK'],
+    recovery: [''],
+    result: 'error'
+  },
+  {
+    stage: 'release after takeover',
+    replies: ['OPEN', '', 'BUSY', 'OK', 'LOCKED'],
+    recovery: [],
+    result: 'gc'
+  },
+  { stage: 'contention claim probe', replies: contentionReplies, recovery: [], result: 'error' },
+  {
+    stage: 'contention lock probe',
+    replies: [...contentionReplies, 'OPEN'],
+    recovery: [],
+    result: 'error'
+  },
+  {
+    stage: 'contention lock age probe',
+    replies: [...contentionReplies, 'OPEN', 'LOCKED'],
+    recovery: [],
+    result: 'error'
+  }
+]
+
+beforeEach(() => {
+  mockExec.mockReset()
+  mockExec.mockResolvedValue('OPEN')
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+describe.each([
+  { platform: 'linux-x64' as const, remoteDir: '/relay/version' },
+  { platform: 'win32-x64' as const, remoteDir: 'C:/relay/version' }
+])('repair lock termination on $platform', ({ platform, remoteDir }) => {
+  const host = getRemoteHostPlatform(platform)
+
+  describe.each([false, true])('with caller aborted = %s', (aborted) => {
+    it.each(failureStages)('stops after unconfirmed $stage', async ({ replies }) => {
+      const controller = new AbortController()
+      const error = Object.assign(new Error('SSH teardown not confirmed'), {
+        sshChannelCloseConfirmed: false
+      })
+      for (const reply of replies) {
+        mockExec.mockResolvedValueOnce(reply)
+      }
+      mockExec.mockImplementationOnce(async () => {
+        if (aborted) {
+          controller.abort(new Error('deploy aborted'))
+        }
+        throw error
+      })
+
+      await expect(
+        tryAcquireRelayRepairLock(conn, remoteDir, host, { signal: controller.signal })
+      ).rejects.toBe(error)
+      expect(mockExec).toHaveBeenCalledTimes(replies.length + 1)
+    })
+  })
+
+  it.each(failureStages)(
+    'keeps recovery after confirmed $stage failure',
+    async ({ replies, recovery, result }) => {
+      for (const reply of replies) {
+        mockExec.mockResolvedValueOnce(reply)
+      }
+      mockExec.mockRejectedValueOnce(
+        Object.assign(new Error('SSH command failed after closing'), {
+          sshChannelCloseConfirmed: true
+        })
+      )
+      for (const reply of recovery) {
+        mockExec.mockResolvedValueOnce(reply)
+      }
+
+      await expect(tryAcquireRelayRepairLock(conn, remoteDir, host)).resolves.toBe(result)
+      expect(mockExec).toHaveBeenCalledTimes(replies.length + recovery.length + 1)
+    }
+  )
+
+  it('stops when a contention probe after a confirmed acquisition failure is unconfirmed', async () => {
+    const error = Object.assign(new Error('SSH teardown not confirmed'), {
+      sshChannelCloseConfirmed: false
+    })
+    mockExec
+      .mockResolvedValueOnce('OPEN')
+      .mockResolvedValueOnce('')
+      .mockRejectedValueOnce(new Error('lock creation failed'))
+      .mockRejectedValueOnce(error)
+
+    await expect(tryAcquireRelayRepairLock(conn, remoteDir, host)).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(4)
+  })
+})
diff --git a/src/main/ssh/ssh-relay-repair-lock.ts b/src/main/ssh/ssh-relay-repair-lock.ts
index 01d58e390e1..1e2b8b7a9d5 100644
--- a/src/main/ssh/ssh-relay-repair-lock.ts
+++ b/src/main/ssh/ssh-relay-repair-lock.ts
@@ -1,5 +1,6 @@
 import type { SshConnection } from './ssh-connection'
 import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import {
   acquireInstallLockParentCommand,
   lockAgeSecondsCommand,
@@ -49,7 +50,12 @@ export async function tryAcquireRelayRepairLock(
       remoteRelayDir,
       host,
       options?.signal
-    ).catch(() => undefined)
+    ).catch((error) => {
+      if (isUnconfirmedSshCommandTermination(error)) {
+        throw error
+      }
+      return undefined
+    })
     options?.signal?.throwIfAborted()
     if (gcClaimedBeforeAcquire === true) {
       return 'gc'
@@ -83,7 +89,10 @@ export async function tryAcquireRelayRepairLock(
       return finishRepairLockAcquire(conn, remoteRelayDir, lockDir, host, options?.signal)
     }
     return classifyRepairLockContention(conn, remoteRelayDir, lockDir, host, options?.signal)
-  } catch {
+  } catch (error) {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
     options?.signal?.throwIfAborted()
     return classifyRepairLockContention(conn, remoteRelayDir, lockDir, host, options?.signal)
   }
@@ -96,9 +105,12 @@ async function classifyRepairLockContention(
   host: RemoteHostPlatform,
   signal?: AbortSignal
 ): Promise<RelayRepairLockResult> {
-  const gcClaimed = await isRelayGcClaimed(conn, remoteRelayDir, host, signal).catch(
-    () => undefined
-  )
+  const gcClaimed = await isRelayGcClaimed(conn, remoteRelayDir, host, signal).catch((error) => {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
+    return undefined
+  })
   signal?.throwIfAborted()
   if (gcClaimed === true) {
     return 'gc'
@@ -112,7 +124,12 @@ async function classifyRepairLockContention(
     host,
     probeInstallLockExistsCommand(host, lockDir),
     signal
-  ).catch(() => '')
+  ).catch((error) => {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
+    return ''
+  })
   signal?.throwIfAborted()
   if (lockProbe.trim() !== 'LOCKED') {
     return 'error'
@@ -122,7 +139,12 @@ async function classifyRepairLockContention(
     host,
     lockAgeSecondsCommand(host, lockDir),
     signal
-  ).catch(() => '')
+  ).catch((error) => {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
+    return ''
+  })
   signal?.throwIfAborted()
   const ageSeconds = Number.parseInt(ageOutput.trim(), 10)
   // Why: GC may remove stale locks, so only a positively observed fresh lock
@@ -139,15 +161,22 @@ async function finishRepairLockAcquire(
   host: RemoteHostPlatform,
   signal?: AbortSignal
 ): Promise<RelayRepairLockResult> {
-  const gcClaimed = await isRelayGcClaimed(conn, remoteRelayDir, host, signal).catch(
-    () => undefined
-  )
+  const gcClaimed = await isRelayGcClaimed(conn, remoteRelayDir, host, signal).catch((error) => {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
+    return undefined
+  })
   if (gcClaimed === false && !signal?.aborted) {
     return 'acquired'
   }
   // Why: GC may win its stable sibling claim while this command creates the
   // in-tree lock. Back out before npm can mutate a directory being renamed.
-  await execHostCommand(conn, host, removeRemoteTreeCommand(host, lockDir)).catch(() => {})
+  await execHostCommand(conn, host, removeRemoteTreeCommand(host, lockDir)).catch((error) => {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
+  })
   signal?.throwIfAborted()
   return gcClaimed ? 'gc' : 'error'
 }
diff --git a/src/main/ssh/ssh-relay-ripgrep-cache-gc-commands.ts b/src/main/ssh/ssh-relay-ripgrep-cache-gc-commands.ts
index 509ba9a0ebd..9e0358fa4ca 100644
--- a/src/main/ssh/ssh-relay-ripgrep-cache-gc-commands.ts
+++ b/src/main/ssh/ssh-relay-ripgrep-cache-gc-commands.ts
@@ -97,17 +97,3 @@ export function listReferencesCommand(host: RemoteHostPlatform, remoteHome: stri
     `printf '%s\\n' ${REFS_OK}`
   ].join('\n')
 }
-
-// A concurrent installer may already have recreated the original directory.
-export function restoreEntryCommand(
-  host: RemoteHostPlatform,
-  source: string,
-  destination: string
-): string {
-  if (isWindowsRemoteHost(host)) {
-    return powerShellCommand(
-      `if (-not (Test-Path -LiteralPath ${powerShellLiteral(destination)})) { Move-Item -LiteralPath ${powerShellLiteral(source)} -Destination ${powerShellLiteral(destination)} -ErrorAction Stop; 'MOVED' } else { 'BUSY' }`
-    )
-  }
-  return `if [ ! -e ${shellEscape(destination)} ]; then mv ${shellEscape(source)} ${shellEscape(destination)} && echo MOVED; else echo BUSY; fi`
-}
diff --git a/src/main/ssh/ssh-relay-ripgrep-cache-gc-real.test.ts b/src/main/ssh/ssh-relay-ripgrep-cache-gc-real.test.ts
index 8b3e657e523..f29a9c52638 100644
--- a/src/main/ssh/ssh-relay-ripgrep-cache-gc-real.test.ts
+++ b/src/main/ssh/ssh-relay-ripgrep-cache-gc-real.test.ts
@@ -5,6 +5,7 @@ import {
   mkdirSync,
   mkdtempSync,
   readdirSync,
+  renameSync,
   rmSync,
   writeFileSync
 } from 'node:fs'
@@ -112,6 +113,75 @@ describe('ripgrep cache shell transactions', () => {
     expect(readdirSync(cache)).toEqual([FIRST])
   })
 
+  it('restores an abandoned tombstone that a relay still references', async () => {
+    await recordRemoteRipgrepReference(conn, host, relay, FIRST)
+    await recordRemoteRipgrepReference(conn, host, relay, SECOND)
+    const tombstone = `.rg-gc-${SECOND}.123.${Date.now() - 60 * 60_000}`
+    renameSync(join(cache, SECOND), join(cache, tombstone))
+
+    await gcRemoteRipgrepCache(conn, host, home)
+
+    expect(readdirSync(cache).sort()).toEqual([FIRST, SECOND])
+    expect(existsSync(join(cache, SECOND, 'rg'))).toBe(true)
+  })
+
+  it('preserves a referenced tombstone when the clock moves backward during the reference scan', async () => {
+    await recordRemoteRipgrepReference(conn, host, relay, FIRST)
+    await recordRemoteRipgrepReference(conn, host, relay, SECOND)
+    const now = Date.now()
+    const tombstone = `.rg-gc-${SECOND}.123.${now - 30 * 60_000 - 1}`
+    renameSync(join(cache, SECOND), join(cache, tombstone))
+    const clock = vi.spyOn(Date, 'now').mockReturnValue(now)
+    let calls = 0
+    execMock.mockImplementation(async (_conn: unknown, command: string) => {
+      if (++calls === 2) {
+        clock.mockReturnValue(now - 60_000)
+      }
+      return runShell(command)
+    })
+    try {
+      await gcRemoteRipgrepCache(conn, host, home)
+      expect(readdirSync(cache).sort()).toEqual([FIRST, SECOND])
+      expect(existsSync(join(cache, SECOND, 'rg'))).toBe(true)
+    } finally {
+      clock.mockRestore()
+    }
+  })
+
+  it('lets exactly one of two passes claim the same abandoned tombstone', async () => {
+    await recordRemoteRipgrepReference(conn, host, relay, FIRST)
+    const tombstone = `.rg-gc-${SECOND}.123.${Date.now() - 60 * 60_000}`
+    renameSync(join(cache, SECOND), join(cache, tombstone))
+    let releaseClaim!: () => void
+    const claimHeld = new Promise<void>((resolve) => {
+      releaseClaim = resolve
+    })
+    let heldPassReachedClaim!: () => void
+    const reachedClaim = new Promise<void>((resolve) => {
+      heldPassReachedClaim = resolve
+    })
+    let held = false
+    execMock.mockImplementation(async (_conn: unknown, command: string) => {
+      const script = process.platform === 'win32' ? decodeRemotePowerShellScript(command) : command
+      if (!held && script.includes(tombstone)) {
+        held = true
+        heldPassReachedClaim()
+        await claimHeld
+      }
+      return runShell(command)
+    })
+
+    // The held pass sees SECOND as unreferenced; the other pins it and restores it.
+    const heldPass = gcRemoteRipgrepCache(conn, host, home)
+    await reachedClaim
+    await gcRemoteRipgrepCache(conn, host, home, { pinnedEntry: SECOND })
+    releaseClaim()
+    await heldPass
+
+    expect(readdirSync(cache).sort()).toEqual([FIRST, SECOND])
+    expect(existsSync(join(cache, SECOND, 'rg'))).toBe(true)
+  })
+
   it('does not nest a tombstone inside a directory recreated by a concurrent installer', async () => {
     await recordRemoteRipgrepReference(conn, host, relay, FIRST)
     let raced = false
diff --git a/src/main/ssh/ssh-relay-ripgrep-cache-gc.ts b/src/main/ssh/ssh-relay-ripgrep-cache-gc.ts
index 18cca2c4f5f..0f479548499 100644
--- a/src/main/ssh/ssh-relay-ripgrep-cache-gc.ts
+++ b/src/main/ssh/ssh-relay-ripgrep-cache-gc.ts
@@ -6,15 +6,20 @@ import {
   MAX_LISTING_ENTRIES,
   cacheDir,
   listEntriesCommand,
-  listReferencesCommand,
-  restoreEntryCommand
+  listReferencesCommand
 } from './ssh-relay-ripgrep-cache-gc-commands'
 // Relay installation references protect binaries until version GC removes their owners.
 // Unknown references block deletion; tombstones are rechecked before removal.
+import { randomInt } from 'node:crypto'
 import type { SshConnection } from './ssh-connection'
 import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import { BUNDLED_RIPGREP_PLATFORMS } from '../../shared/bundled-ripgrep'
-import { moveRemoteTreeCommand, removeRemoteTreeCommand } from './ssh-remote-commands'
+import {
+  moveRemoteTreeCommand,
+  removeRemoteTreeCommand,
+  restoreRemoteTreeCommand
+} from './ssh-remote-commands'
 import { isWindowsRemoteHost, joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
 
 function entryNamePattern(): RegExp {
@@ -32,24 +37,33 @@ function staleTombstoneEntry(name: string): string | null {
     return null
   }
   const match = /^(.*)\.(\d+)\.(\d+)$/.exec(name.slice(TOMBSTONE_PREFIX.length))
-  if (!match || !ENTRY_NAME.test(match[1]) || Date.now() - Number(match[3]) < 30 * 60_000) {
+  if (
+    !match ||
+    !ENTRY_NAME.test(match[1]) ||
+    !Number.isSafeInteger(Number(match[3])) ||
+    Date.now() - Number(match[3]) < 30 * 60_000
+  ) {
     return null
   }
   return match[1]
 }
 
 function exec(conn: SshConnection, host: RemoteHostPlatform, command: string): Promise<string> {
-  return execCommand(conn, command, { wrapCommand: !isWindowsRemoteHost(host) })
+  return execCommand(conn, command, {
+    wrapCommand: !isWindowsRemoteHost(host)
+  })
 }
 
 type ReferenceScan = { readable: true; referenced: Set<string> } | { readable: false }
 
-function parseEntries(output: string): string[] {
+type CacheEntry = { name: string; entry: string }
+
+function parseEntries(output: string): CacheEntry[] {
   const lines = output.split(/\r?\n/).map((line) => line.trim())
   if (!lines.includes(LIST_OK)) {
     return []
   }
-  const entries: string[] = []
+  const entries: CacheEntry[] = []
   for (const line of lines) {
     if (!line.startsWith('ENTRY ')) {
       continue
@@ -57,11 +71,9 @@ function parseEntries(output: string): string[] {
     const name = line.slice('ENTRY '.length)
     // Why re-validate a name the host produced: it is about to be interpolated into `mv` and
     // `rm -rf`. Only names this client could itself have minted are eligible.
-    if (
-      (ENTRY_NAME.test(name) || staleTombstoneEntry(name)) &&
-      entries.length < MAX_LISTING_ENTRIES
-    ) {
-      entries.push(name)
+    const entry = ENTRY_NAME.test(name) ? name : staleTombstoneEntry(name)
+    if (entry && entries.length < MAX_LISTING_ENTRIES) {
+      entries.push({ name, entry })
     }
   }
   return entries
@@ -75,7 +87,10 @@ async function scanReferences(
   let output: string
   try {
     output = await exec(conn, host, listReferencesCommand(host, remoteHome))
-  } catch {
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     return { readable: false }
   }
   const lines = output.split(/\r?\n/).map((line) => line.trim())
@@ -99,7 +114,7 @@ async function scanReferences(
   return { readable: true, referenced }
 }
 
-/** Collect ripgrep builds that no relay installation references. Never throws. */
+/** Collect unreferenced ripgrep builds; unconfirmed termination stops the caller's cleanup. */
 export async function gcRemoteRipgrepCache(
   conn: SshConnection,
   host: RemoteHostPlatform,
@@ -116,28 +131,51 @@ export async function gcRemoteRipgrepCache(
       return
     }
     const removed: string[] = []
-    for (const name of entries) {
-      const entry = staleTombstoneEntry(name) ?? name
-      if (scan.referenced.has(entry) || entry === options.pinnedEntry) {
-        continue
-      }
-      if (
-        await removeUnreferencedEntry(
-          conn,
-          host,
-          remoteHome,
-          entry,
-          name === entry ? undefined : name
-        )
-      ) {
+    for (const { name, entry } of entries) {
+      const keep = scan.referenced.has(entry) || entry === options.pinnedEntry
+      const collected =
+        name === entry
+          ? !keep && (await removeUnreferencedEntry(conn, host, remoteHome, entry))
+          : await recoverAbandonedTombstone(conn, host, remoteHome, name, entry, keep)
+      if (collected) {
         removed.push(entry)
       }
     }
     if (removed.length > 0) {
       console.log(`[ssh-relay] ripgrep cache GC: removed ${removed.length}: ${removed.join(', ')}`)
     }
-  } catch {
-    /* Never fails a deploy; the next connect tries again. */
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
+    // Confirmed cleanup failures are optional; the next connect tries again.
+  }
+}
+
+// Why random rather than pid + clock: passes on different clients must never rename into one path.
+function ownedTombstonePath(host: RemoteHostPlatform, base: string, entry: string): string {
+  return joinRemotePath(
+    host,
+    base,
+    `${TOMBSTONE_PREFIX}${entry}.${randomInt(1, 2 ** 47)}.${Date.now()}`
+  )
+}
+
+async function moveTree(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  source: string,
+  destination: string
+): Promise<boolean> {
+  try {
+    return (
+      (await exec(conn, host, moveRemoteTreeCommand(host, source, destination))).trim() === 'MOVED'
+    )
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
+    return false
   }
 }
 
@@ -145,39 +183,80 @@ async function removeUnreferencedEntry(
   conn: SshConnection,
   host: RemoteHostPlatform,
   remoteHome: string,
-  entry: string,
-  abandonedTombstone?: string
+  entry: string
 ): Promise<boolean> {
   const base = cacheDir(host, remoteHome)
   const entryDir = joinRemotePath(host, base, entry)
-  const tombstone = joinRemotePath(
-    host,
-    base,
-    abandonedTombstone ?? `${TOMBSTONE_PREFIX}${entry}.${process.pid}.${Date.now()}`
-  )
-  try {
-    if (
-      !abandonedTombstone &&
-      (await exec(conn, host, moveRemoteTreeCommand(host, entryDir, tombstone))).trim() !== 'MOVED'
-    ) {
-      return false
-    }
-  } catch {
+  const tombstone = ownedTombstonePath(host, base, entry)
+  if (!(await moveTree(conn, host, entryDir, tombstone))) {
     return false
   }
+  return collectOwnedTombstone(conn, host, remoteHome, entry, tombstone, entryDir)
+}
+
+// Only the pass whose rename wins may restore or delete a tombstone other passes can also list.
+async function recoverAbandonedTombstone(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  remoteHome: string,
+  name: string,
+  entry: string,
+  keep: boolean
+): Promise<boolean> {
+  const base = cacheDir(host, remoteHome)
+  const tombstone = ownedTombstonePath(host, base, entry)
+  if (!(await moveTree(conn, host, joinRemotePath(host, base, name), tombstone))) {
+    return false
+  }
+  const entryDir = joinRemotePath(host, base, entry)
+  if (keep) {
+    await restoreCacheEntry(conn, host, tombstone, entryDir)
+    return false
+  }
+  return collectOwnedTombstone(conn, host, remoteHome, entry, tombstone, entryDir)
+}
+
+async function collectOwnedTombstone(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  remoteHome: string,
+  entry: string,
+  tombstone: string,
+  entryDir: string
+): Promise<boolean> {
   // Why recheck under the rename: a deploy that read this entry as present can still be writing
   // its marker. Its reference now names a path that no longer exists, so restoring the tree is
   // the only outcome that leaves that relay with a working ripgrep.
-  const recheck = await scanReferences(conn, host, remoteHome)
+  const recheck = await scanReferences(conn, host, remoteHome).catch(async (err: unknown) => {
+    // A read-only scan cannot conflict with restoring this pass's renamed tree.
+    await restoreCacheEntry(conn, host, tombstone, entryDir).catch(() => {})
+    throw err
+  })
   if (!recheck.readable || recheck.referenced.has(entry)) {
-    await exec(conn, host, restoreEntryCommand(host, tombstone, entryDir)).catch(() => {})
+    await restoreCacheEntry(conn, host, tombstone, entryDir)
     return false
   }
   try {
     await exec(conn, host, removeRemoteTreeCommand(host, tombstone))
     return true
-  } catch {
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     // A later pass retries after verifying references again.
     return false
   }
 }
+
+async function restoreCacheEntry(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  tombstone: string,
+  entryDir: string
+): Promise<void> {
+  await exec(conn, host, restoreRemoteTreeCommand(host, tombstone, entryDir)).catch((err) => {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
+  })
+}
diff --git a/src/main/ssh/ssh-relay-ripgrep-install.test.ts b/src/main/ssh/ssh-relay-ripgrep-install.test.ts
index dc41c281db2..990e0ec0d54 100644
--- a/src/main/ssh/ssh-relay-ripgrep-install.test.ts
+++ b/src/main/ssh/ssh-relay-ripgrep-install.test.ts
@@ -30,7 +30,7 @@ vi.mock('../ripgrep/bundled-ripgrep-path', () => ({
 }))
 
 import type { SshConnection } from './ssh-connection'
-import { getRemoteHostPlatform } from './ssh-remote-platform'
+import { getRemoteHostPlatform, joinRemotePath } from './ssh-remote-platform'
 import { decodeRemotePowerShellScript } from './ssh-remote-powershell'
 import { ensureRemoteBundledRipgrep, remoteRipgrepLayout } from './ssh-relay-ripgrep-install'
 
@@ -176,6 +176,85 @@ describe('ensureRemoteBundledRipgrep', () => {
     expect(execScripts()[1]).toMatch(/^rm -rf '\/home\/me\/\.orca-remote\/ripgrep\/\.upload-/)
   })
 
+  describe.each([
+    { platform: 'Linux', host: LINUX, home: '/home/me' },
+    { platform: 'Windows', host: WINDOWS, home: 'C:/Users/me user' }
+  ])('interrupted install on $platform', ({ host, home }) => {
+    it.each([
+      ['reference', 1, 0],
+      ['probe', 1, 0],
+      ['upload', 1, 1],
+      ['promotion', 2, 1],
+      ['cleanup', 2, 1]
+    ] as const)(
+      'preserves unconfirmed %s termination and starts no further operation',
+      async (phase, commands, uploads) => {
+        const error = Object.assign(new Error('Remote termination is unconfirmed'), {
+          sshChannelCloseConfirmed: false
+        })
+        if (phase === 'reference' || phase === 'probe') {
+          execCommandMock.mockRejectedValueOnce(error)
+        } else {
+          execCommandMock.mockResolvedValueOnce('ORCA-RG-STAGED\n')
+          if (phase === 'upload') {
+            uploadRelayDirectoryMock.mockRejectedValueOnce(error)
+          } else {
+            execCommandMock.mockRejectedValueOnce(error)
+            if (phase === 'cleanup') {
+              uploadRelayDirectoryMock.mockRejectedValueOnce(new Error('Upload failed'))
+            }
+          }
+        }
+
+        await expect(
+          ensureRemoteBundledRipgrep(connection(), host, home, {
+            relayDir:
+              phase === 'reference'
+                ? joinRemotePath(host, home, '.orca-remote', 'relay-1.2.3')
+                : undefined
+          })
+        ).rejects.toBe(error)
+
+        expect(execCommandMock).toHaveBeenCalledTimes(commands)
+        expect(uploadRelayDirectoryMock).toHaveBeenCalledTimes(uploads)
+      }
+    )
+
+    it.each(['upload', 'promotion'] as const)(
+      'removes the stage after confirmed %s termination and remains nonfatal',
+      async (phase) => {
+        const error = Object.assign(new Error('Remote operation stopped'), {
+          sshChannelCloseConfirmed: true
+        })
+        execCommandMock.mockResolvedValueOnce('ORCA-RG-STAGED\n')
+        if (phase === 'upload') {
+          uploadRelayDirectoryMock.mockRejectedValueOnce(error)
+        } else {
+          execCommandMock.mockRejectedValueOnce(error)
+        }
+        execCommandMock.mockResolvedValueOnce('')
+
+        await expect(ensureRemoteBundledRipgrep(connection(), host, home)).resolves.toBe('failed')
+
+        expect(execCommandMock).toHaveBeenCalledTimes(phase === 'upload' ? 2 : 3)
+        expect(execScripts().at(-1)).toContain(
+          host === WINDOWS ? 'Remove-Item -LiteralPath' : 'rm -rf'
+        )
+      }
+    )
+
+    it('keeps an ordinary stage cleanup failure nonfatal', async () => {
+      execCommandMock
+        .mockResolvedValueOnce('ORCA-RG-STAGED\n')
+        .mockRejectedValueOnce(new Error('Cleanup failed'))
+      uploadRelayDirectoryMock.mockRejectedValueOnce(new Error('Upload failed'))
+
+      await expect(ensureRemoteBundledRipgrep(connection(), host, home)).resolves.toBe('failed')
+
+      expect(execCommandMock).toHaveBeenCalledTimes(2)
+    })
+  })
+
   it('reports a failed size verification', async () => {
     execCommandMock
       .mockResolvedValueOnce('ORCA-RG-STAGED\n')
diff --git a/src/main/ssh/ssh-relay-ripgrep-install.ts b/src/main/ssh/ssh-relay-ripgrep-install.ts
index 02992ac811b..333a21801bb 100644
--- a/src/main/ssh/ssh-relay-ripgrep-install.ts
+++ b/src/main/ssh/ssh-relay-ripgrep-install.ts
@@ -6,8 +6,8 @@
  *
  * Uploads land in a private `.upload-<token>` stage and are renamed into place only after a size
  * check, so an interrupted or concurrent deploy never leaves a truncated binary at the final path.
- * Every failure is reported, never thrown: the relay falls back to PATH `rg` and its git/readdir
- * chain, which is exactly what it did before this binary existed.
+ * Ordinary failures use the relay's PATH `rg` and git/readdir fallback; unconfirmed remote stops
+ * propagate so deployment cannot start more work while the previous operation may still run.
  */
 import { randomBytes } from 'node:crypto'
 import { statSync } from 'node:fs'
@@ -15,6 +15,7 @@ import { dirname } from 'node:path'
 import type { SshConnection } from './ssh-connection'
 import { RELAY_REMOTE_DIR } from './relay-protocol'
 import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import { uploadRelayDirectory } from './ssh-relay-install-transfers'
 import {
   createRelayUploadStageNamespace,
@@ -52,7 +53,7 @@ export function remoteRipgrepRefFileName(entryName: string): string {
   return `${REMOTE_RIPGREP_REF_PREFIX}${entryName}`
 }
 
-/** Record which ripgrep build a relay directory runs against. Best-effort: never fails a deploy. */
+/** Record the relay's ripgrep build; only an unconfirmed remote stop rejects. */
 export async function recordRemoteRipgrepReference(
   conn: SshConnection,
   host: RemoteHostPlatform,
@@ -73,6 +74,9 @@ export async function recordRemoteRipgrepReference(
     )
     return true
   } catch (error) {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
     console.warn(
       '[ssh-relay] Could not record the ripgrep reference; skipping the bundled binary:',
       error instanceof Error ? error.message : String(error)
@@ -117,7 +121,7 @@ export function remoteRipgrepLayout(
   }
 }
 
-/** Make sure the host has Orca's ripgrep at `remoteRipgrepLayout().binaryPath`; never throws. */
+/** Ensure the host has Orca's ripgrep; only an unconfirmed remote stop rejects. */
 export async function ensureRemoteBundledRipgrep(
   conn: SshConnection,
   host: RemoteHostPlatform,
@@ -150,6 +154,9 @@ async function installOrReport(
     }
     return await installRemoteRipgrep(conn, host, layout, localBinary, options.signal)
   } catch (error) {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
     console.warn(
       '[ssh-relay] Bundled ripgrep install failed; the relay will use rg from PATH:',
       error instanceof Error ? error.message : String(error)
@@ -184,6 +191,7 @@ async function installRemoteRipgrep(
   }
 
   let promoted = false
+  let cleanupAllowed = true
   try {
     await uploadRelayDirectory(
       conn,
@@ -204,12 +212,19 @@ async function installRemoteRipgrep(
     }
     console.log(`[ssh-relay] Installed bundled ripgrep at ${layout.binaryPath} (${size} bytes)`)
     return 'installed'
+  } catch (error) {
+    cleanupAllowed = !isUnconfirmedSshCommandTermination(error)
+    throw error
   } finally {
-    if (!promoted) {
+    if (!promoted && cleanupAllowed) {
       // Why best-effort: the next deploy's probe also sweeps stale stages.
       await execCommand(conn, removeRemoteTreeCommand(host, stageDir), {
         wrapCommand: !isWindowsRemoteHost(host)
-      }).catch(() => {})
+      }).catch((error) => {
+        if (isUnconfirmedSshCommandTermination(error)) {
+          throw error
+        }
+      })
     }
   }
 }
diff --git a/src/main/ssh/ssh-relay-session-data-delivery.test.ts b/src/main/ssh/ssh-relay-session-data-delivery.test.ts
index e5683c0949a..da528f7f95f 100644
--- a/src/main/ssh/ssh-relay-session-data-delivery.test.ts
+++ b/src/main/ssh/ssh-relay-session-data-delivery.test.ts
@@ -344,7 +344,8 @@ describe('SshRelaySession data delivery', () => {
       })
     )
     session.dispose()
-    expect(mockStore.removeSshPtyConsumerRecovery).toHaveBeenCalledWith(targetId)
+    const removeRecovery = mockStore.removeSshPtyConsumerRecovery
+    expect(removeRecovery).toHaveBeenCalledWith(targetId, 'persisted-client')
   })
 
   it('voids checkpoints for a fresh claim without a second owner request', async () => {
diff --git a/src/main/ssh/ssh-relay-session-managed-hooks.test.ts b/src/main/ssh/ssh-relay-session-managed-hooks.test.ts
index 67351e08102..da10d8841a1 100644
--- a/src/main/ssh/ssh-relay-session-managed-hooks.test.ts
+++ b/src/main/ssh/ssh-relay-session-managed-hooks.test.ts
@@ -3,6 +3,8 @@ import {
   AGENT_HOOK_INSTALL_MANAGED_HOOKS_METHOD,
   AGENT_HOOK_INSTALL_PLUGINS_METHOD
 } from '../../shared/agent-hook-relay'
+import { getDefaultSettings } from '../../shared/constants'
+import type { Store } from '../persistence'
 import { SshRelaySession } from './ssh-relay-session'
 import type { SshConnection } from './ssh-connection'
 import { createMockDeps, mockDeploySuccess } from './ssh-relay-session-test-fixtures'
@@ -159,4 +161,45 @@ describe('SshRelaySession managed hooks', () => {
       })
     )
   })
+  it('refreshes OpenCode sources on settings changes and releases its subscription', async () => {
+    muxRequestMock.mockResolvedValue({ agents: [] })
+    const { mockStore, mockConn, mockPortForward, getMainWindow } = createMockDeps()
+    const settings = getDefaultSettings('/synthetic-home')
+    settings.disabledTuiAgents = ['opencode']
+    mockStore.getSettings = () => settings
+    let listener: Parameters<Store['onSettingsChanged']>[0] | undefined
+    const cleanup = vi.fn(() => {
+      listener = undefined
+    })
+    mockStore.onSettingsChanged = (callback) => {
+      listener = callback
+      return cleanup
+    }
+    const session = new SshRelaySession(
+      'target-settings',
+      getMainWindow,
+      mockStore,
+      mockPortForward
+    )
+    await session.establish(mockConn)
+    const lastSources = () =>
+      muxRequestMock.mock.calls.findLast(
+        ([method]) => method === AGENT_HOOK_INSTALL_PLUGINS_METHOD
+      )?.[1]
+    expect(lastSources()).toMatchObject({
+      opencodePluginSource: '',
+      opencode2PluginSource: expect.stringContaining('/hook/opencode2')
+    })
+    settings.disabledTuiAgents = ['opencode2']
+    listener?.({ disabledTuiAgents: settings.disabledTuiAgents }, settings)
+    expect(lastSources()).toMatchObject({
+      opencodePluginSource: expect.stringContaining('/hook/opencode'),
+      opencode2PluginSource: ''
+    })
+    settings.agentStatusHooksEnabled = false
+    listener?.({ agentStatusHooksEnabled: false }, settings)
+    expect(lastSources()).toMatchObject({ opencodePluginSource: '', opencode2PluginSource: '' })
+    session.dispose()
+    expect(cleanup).toHaveBeenCalledOnce()
+  })
 })
diff --git a/src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts b/src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts
index 6760a27821c..ce223ae0b9c 100644
--- a/src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts
+++ b/src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts
@@ -3,7 +3,11 @@ import { randomUUID } from 'node:crypto'
 import type * as NodeCrypto from 'node:crypto'
 import { SshRelaySession } from './ssh-relay-session'
 import { runRemoteOrcaCli } from './ssh-remote-orca-cli'
-import { createMockDeps, mockDeploySuccess } from './ssh-relay-session-test-fixtures'
+import {
+  createMockDeps,
+  mockDeploySuccess,
+  recordedPtyBindings
+} from './ssh-relay-session-test-fixtures'
 import { getDefaultWorkspaceSession } from '../../shared/constants'
 import type { SshRemotePtyLease } from '../../shared/ssh-types'
 
@@ -439,7 +443,7 @@ describe('SshRelaySession reconnect incarnation ordering', () => {
       incarnationId
     })
     expect(runtime.onPtySpawned).not.toHaveBeenCalled()
-    expect(mockStore.persistPtyBinding).toHaveBeenCalledWith({
+    expect(recordedPtyBindings(mockStore)).toContainEqual({
       worktreeId: 'worktree-1',
       tabId: 'tab-1',
       leafId: INCARNATION_LEAF_ID,
@@ -454,13 +458,21 @@ describe('SshRelaySession reconnect incarnation ordering', () => {
   })
 
   it.each([
-    { relay: 'current', incarnationId: 'inc-1', tombstonePartition: 'local' },
-    { relay: 'current', incarnationId: 'inc-1', tombstonePartition: 'host' },
-    { relay: 'legacy', incarnationId: undefined, tombstonePartition: 'local' },
-    { relay: 'legacy', incarnationId: undefined, tombstonePartition: 'host' }
+    { relay: 'current', incarnationId: 'inc-1', tombstonePartition: 'local', retiredBy: 'surface' },
+    { relay: 'current', incarnationId: 'inc-1', tombstonePartition: 'host', retiredBy: 'surface' },
+    {
+      relay: 'legacy',
+      incarnationId: undefined,
+      tombstonePartition: 'local',
+      retiredBy: 'surface'
+    },
+    { relay: 'legacy', incarnationId: undefined, tombstonePartition: 'host', retiredBy: 'surface' },
+    // A closed tab whose pane is in no tab: the close record is the backstop.
+    { relay: 'current', incarnationId: 'inc-1', tombstonePartition: 'local', retiredBy: 'close' },
+    { relay: 'current', incarnationId: 'inc-1', tombstonePartition: 'host', retiredBy: 'close' }
   ])(
-    'suppresses a $tombstonePartition-partition retired surface from a $relay relay',
-    async ({ incarnationId, tombstonePartition }) => {
+    'suppresses a $tombstonePartition-partition $retiredBy retirement from a $relay relay',
+    async ({ incarnationId, tombstonePartition, retiredBy }) => {
       const { mockConn, mockStore, mockPortForward, getMainWindow, mockWindow } = createMockDeps()
       const attachForReconnect = vi.fn().mockResolvedValue({
         ...(incarnationId ? { incarnationId } : {}),
@@ -510,10 +522,16 @@ describe('SshRelaySession reconnect incarnation ordering', () => {
           }
         }
       }
+      const closedTab: ReturnType<typeof getDefaultWorkspaceSession> = {
+        ...getDefaultWorkspaceSession(),
+        closedTerminalTabTombstonesByTabId: { [tabId]: { closedAt: Date.now(), worktreeId } }
+      }
       vi.mocked(mockStore.getWorkspaceSession).mockImplementation((hostId) =>
-        (hostId ? 'host' : 'local') === tombstonePartition
-          ? sessionWithTombstone
-          : getDefaultWorkspaceSession()
+        (hostId ? 'host' : 'local') !== tombstonePartition
+          ? getDefaultWorkspaceSession()
+          : retiredBy === 'close'
+            ? closedTab
+            : sessionWithTombstone
       )
       const runtime = { registerPty: vi.fn(), onPtySpawned: vi.fn() }
       const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
@@ -643,7 +661,7 @@ describe('SshRelaySession reconnect incarnation ordering', () => {
       leafId: INCARNATION_LEAF_ID,
       incarnationId
     })
-    expect(mockStore.persistPtyBinding).toHaveBeenCalledWith(
+    expect(recordedPtyBindings(mockStore)).toContainEqual(
       expect.objectContaining({ tabId: movedTabId, ptyId: APP_PTY_ID, incarnationId })
     )
     expect(mockStore.markSshRemotePtyLease).not.toHaveBeenCalledWith(
@@ -763,7 +781,7 @@ describe('SshRelaySession reconnect incarnation ordering', () => {
       incarnationId: currentIncarnationId
     })
     expect(setPtyOwnership).toHaveBeenCalledWith(APP_PTY_ID, 'target-1')
-    expect(mockStore.persistPtyBinding).toHaveBeenCalledWith(
+    expect(recordedPtyBindings(mockStore)).toContainEqual(
       expect.objectContaining({ ptyId: APP_PTY_ID, incarnationId: currentIncarnationId })
     )
     expect(mockWindow.webContents.send).toHaveBeenCalledWith('pty:replay', {
diff --git a/src/main/ssh/ssh-relay-session-recovery-races.test.ts b/src/main/ssh/ssh-relay-session-recovery-races.test.ts
index 26dd798ac5a..f4600bb23e6 100644
--- a/src/main/ssh/ssh-relay-session-recovery-races.test.ts
+++ b/src/main/ssh/ssh-relay-session-recovery-races.test.ts
@@ -140,17 +140,21 @@ describe('SshRelaySession recovery race fencing', () => {
     mockDeploySuccess()
   })
 
-  function emitSourceFrame(args: {
-    targetId: string
-    token: string
-    clientGeneration: number
-    ownerGeneration: number
-    sourceStartSu: number
-    sourceEndSu: number
-  }): void {
-    ptyDataHandlerRef.current?.({
+  function emitSourceFrame(
+    args: {
+      targetId: string
+      token: string
+      clientGeneration: number
+      ownerGeneration: number
+      sourceStartSu: number
+      sourceEndSu: number
+      data?: string
+    },
+    sink = ptyDataHandlerRef.current
+  ): void {
+    sink?.({
       id: `ssh:${args.targetId}@@pty-1`,
-      data: 'late',
+      data: args.data ?? 'late',
       providerGeneration: 23,
       ptyIncarnation: 'incarnation-1',
       sequenceChars: args.sourceEndSu - args.sourceStartSu,
@@ -227,6 +231,66 @@ describe('SshRelaySession recovery race fencing', () => {
     return { session, deps }
   }
 
+  it('keeps source output contiguous while the recovered pane binding waits for disk', async () => {
+    const targetId = 'recovery-binding-disk-wait'
+    const { session, deps } = await prepareRecovery(targetId)
+    const binding = Promise.withResolvers<boolean>()
+    vi.mocked(deps.mockStore.getSshRemotePtyLeases).mockReturnValue([
+      {
+        targetId,
+        ptyId: 'pty-1',
+        worktreeId: 'worktree-1',
+        tabId: 'tab-1',
+        leafId: 'leaf-1',
+        state: 'detached',
+        createdAt: 1,
+        updatedAt: 1
+      }
+    ])
+    vi.mocked(deps.mockStore.persistPtyBinding).mockReturnValue(binding.promise)
+    const emit = (sourceStartSu: number, sink = ptyDataHandlerRef.current): void =>
+      emitSourceFrame(
+        {
+          targetId,
+          token: 'new-token',
+          clientGeneration: 2,
+          ownerGeneration: 2,
+          sourceStartSu,
+          sourceEndSu: sourceStartSu + 4
+        },
+        sink
+      )
+    let recoverySink: typeof ptyDataHandlerRef.current
+    const recoveryActivationLease = { commit: vi.fn(), retire: vi.fn() }
+    attachForReconnectMock.mockResolvedValue({
+      incarnationId: 'incarnation-1',
+      sourceRecovery: pendingRecovery(8),
+      sourceActivationLease: {
+        commit: vi.fn(),
+        rollback: vi.fn(async () => true),
+        transferToRecovery: (sink: (payload: unknown) => void) => {
+          recoverySink = sink
+          emit(4, sink)
+          completeRecovery({ id: 'pty-1', ...pendingRecovery(8) })
+          return recoveryActivationLease
+        }
+      }
+    })
+
+    const reconnect = session.reconnect(deps.mockConn)
+    await vi.waitFor(() => expect(deps.mockStore.persistPtyBinding).toHaveBeenCalledOnce())
+    emit(8, recoverySink)
+    expect(recoveryActivationLease.commit).not.toHaveBeenCalled()
+    binding.resolve(true)
+    await reconnect
+    emit(12)
+
+    expect(
+      acceptOutputDataMock.mock.calls.map(([payload]) => payload.source.sourceStartSu)
+    ).toEqual([4, 8, 12])
+    expect(recoveryActivationLease.commit).toHaveBeenCalledOnce()
+  })
+
   it('publishes held recovery data before an exact exit without waiting for completion', async () => {
     const targetId = 'exit-with-complete-private-body'
     const { session, deps } = await prepareRecovery(targetId)
@@ -235,22 +299,18 @@ describe('SshRelaySession recovery race fencing', () => {
       commit: vi.fn(),
       rollback: vi.fn(async () => true),
       transferToRecovery: vi.fn((sink: (payload: unknown) => void) => {
-        sink({
-          id: `ssh:${targetId}@@pty-1`,
-          data: 'held',
-          providerGeneration: 23,
-          ptyIncarnation: 'incarnation-1',
-          sequenceChars: 4,
-          source: {
-            relayPtyId: 'pty-1',
-            spanId: 'new-token:4:8',
+        emitSourceFrame(
+          {
+            targetId,
+            token: 'new-token',
             clientGeneration: 2,
             ownerGeneration: 2,
-            deliveryToken: 'new-token',
             sourceStartSu: 4,
-            sourceEndSu: 8
-          }
-        })
+            sourceEndSu: 8,
+            data: 'held'
+          },
+          sink
+        )
         return recoveryActivationLease
       })
     }
@@ -301,22 +361,18 @@ describe('SshRelaySession recovery race fencing', () => {
       commit: vi.fn(),
       rollback: vi.fn(async () => true),
       transferToRecovery: vi.fn((sink: (payload: unknown) => void) => {
-        sink({
-          id: `ssh:${targetId}@@pty-1`,
-          data: 'partial',
-          providerGeneration: 23,
-          ptyIncarnation: 'incarnation-1',
-          sequenceChars: 2,
-          source: {
-            relayPtyId: 'pty-1',
-            spanId: 'new-token:4:6',
+        emitSourceFrame(
+          {
+            targetId,
+            token: 'new-token',
             clientGeneration: 2,
             ownerGeneration: 2,
-            deliveryToken: 'new-token',
             sourceStartSu: 4,
-            sourceEndSu: 6
-          }
-        })
+            sourceEndSu: 6,
+            data: 'partial'
+          },
+          sink
+        )
         return recoveryActivationLease
       })
     }
@@ -501,38 +557,23 @@ describe('SshRelaySession recovery race fencing', () => {
       commit: vi.fn(),
       rollback: vi.fn(),
       transferToRecovery: vi.fn((sink: (payload: unknown) => void) => {
-        sink({
-          id: `ssh:${targetId}@@pty-1`,
-          data: 'x'.repeat(2 * 1024 * 1024 + 1),
-          providerGeneration: 23,
-          ptyIncarnation: 'incarnation-1',
-          sequenceChars: 4,
-          source: {
-            relayPtyId: 'pty-1',
-            spanId: 'new-token:4:8',
-            clientGeneration: 2,
-            ownerGeneration: 2,
-            deliveryToken: 'new-token',
-            sourceStartSu: 4,
-            sourceEndSu: 8
-          }
-        })
-        sink({
-          id: `ssh:${targetId}@@pty-1`,
-          data: 'later',
-          providerGeneration: 23,
-          ptyIncarnation: 'incarnation-1',
-          sequenceChars: 4,
-          source: {
-            relayPtyId: 'pty-1',
-            spanId: 'new-token:8:12',
-            clientGeneration: 2,
-            ownerGeneration: 2,
-            deliveryToken: 'new-token',
-            sourceStartSu: 8,
-            sourceEndSu: 12
-          }
-        })
+        for (const [data, sourceStartSu] of [
+          ['x'.repeat(2 * 1024 * 1024 + 1), 4],
+          ['later', 8]
+        ] as const) {
+          emitSourceFrame(
+            {
+              targetId,
+              token: 'new-token',
+              clientGeneration: 2,
+              ownerGeneration: 2,
+              sourceStartSu,
+              sourceEndSu: sourceStartSu + 4,
+              data
+            },
+            sink
+          )
+        }
         return recoveryActivationLease
       })
     }
diff --git a/src/main/ssh/ssh-relay-session-test-fixtures.ts b/src/main/ssh/ssh-relay-session-test-fixtures.ts
index ba0782b3a20..c186e922e93 100644
--- a/src/main/ssh/ssh-relay-session-test-fixtures.ts
+++ b/src/main/ssh/ssh-relay-session-test-fixtures.ts
@@ -1,6 +1,7 @@
 import { vi, type Mock } from 'vitest'
 import type { BrowserWindow } from 'electron'
 import type { SshConnection } from './ssh-connection'
+import type { PersistPtyBindingArgs } from '../persistence/loading-store/pty-binding-persistence'
 import type { Store } from '../persistence'
 import type { SshPortForwardManager } from './ssh-port-forward'
 import { deployAndLaunchRelay } from './ssh-relay-deploy'
@@ -13,8 +14,16 @@ type SshRelaySessionTestDeps = {
   mockWindow: BrowserWindow
 }
 
+const persistedBindings = new WeakMap<Store, PersistPtyBindingArgs[]>()
+
+export function recordedPtyBindings(store: Store): readonly PersistPtyBindingArgs[] {
+  return persistedBindings.get(store) ?? []
+}
+
 export function createMockDeps(): SshRelaySessionTestDeps {
+  const bindings: PersistPtyBindingArgs[] = []
   const mockConn = {} as SshConnection
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The relay fixture implements the Store methods exercised by session establishment and teardown.
   const mockStore = {
     getRepos: vi.fn().mockReturnValue([]),
     getSshPtyConsumerRecovery: vi.fn().mockReturnValue(null),
@@ -33,8 +42,16 @@ export function createMockDeps(): SshRelaySessionTestDeps {
     recordSshRemotePtyKillIntent: vi.fn(),
     clearSshRemotePtyKillIntent: vi.fn(),
     noteSshRemotePtyKillReplayAttempt: vi.fn(),
-    persistPtyBinding: vi.fn()
+    persistPtyBinding: vi.fn(async (input: Parameters<Store['persistPtyBinding']>[0]) => {
+      const binding = typeof input === 'function' ? input() : input
+      if (!binding) {
+        return false
+      }
+      bindings.push(binding)
+      return true
+    })
   } as unknown as Store
+  persistedBindings.set(mockStore, bindings)
   const mockPortForward = {
     removeAllForwards: vi.fn()
   } as unknown as SshPortForwardManager
diff --git a/src/main/ssh/ssh-relay-session.test.ts b/src/main/ssh/ssh-relay-session.test.ts
index dc9ff181b2f..5b48337f0ab 100644
--- a/src/main/ssh/ssh-relay-session.test.ts
+++ b/src/main/ssh/ssh-relay-session.test.ts
@@ -206,6 +206,27 @@ describe('SshRelaySession', () => {
     expect(registerSshGitProvider).toHaveBeenCalledWith('target-1', expect.anything())
   })
 
+  it('rechecks OpenCode preparation from scans and aborts it when the relay session disconnects', async () => {
+    const { mockConn, mockStore, mockPortForward, getMainWindow } = createMockDeps()
+    const prepareOpenCodeRuntime = vi.fn().mockResolvedValue(undefined)
+    vi.mocked(deployAndLaunchRelay).mockResolvedValueOnce({
+      transport: { write: vi.fn(), onData: vi.fn(), onClose: vi.fn() },
+      platform: 'linux-x64',
+      prepareOpenCodeRuntime
+    })
+    const session = new SshRelaySession('target-1', getMainWindow, mockStore, mockPortForward)
+    await session.establish(mockConn)
+    await session.requestAiVaultSessionList({})
+    await session.requestSessionSearch('sessionSearch.search', {})
+    expect(prepareOpenCodeRuntime).toHaveBeenCalledTimes(2)
+    const signal = prepareOpenCodeRuntime.mock.calls[0][0]
+    expect(signal.aborted).toBe(false)
+    await session.dispose()
+    expect(signal.aborted).toBe(true)
+    await expect(session.requestAiVaultSessionList({})).rejects.toThrow('not ready')
+    expect(prepareOpenCodeRuntime).toHaveBeenCalledTimes(2)
+  })
+
   it('continues provider registration when the relay managed-hook request fails', async () => {
     process.env.ORCA_FEATURE_REMOTE_AGENT_HOOKS = '1'
     muxRequestMock.mockImplementation(async (method: string) => {
diff --git a/src/main/ssh/ssh-relay-session.ts b/src/main/ssh/ssh-relay-session.ts
index 19e102b08ed..e7911691261 100644
--- a/src/main/ssh/ssh-relay-session.ts
+++ b/src/main/ssh/ssh-relay-session.ts
@@ -4,6 +4,7 @@
 import { randomUUID } from 'node:crypto'
 import type { BrowserWindow } from 'electron'
 import { deployAndLaunchRelay } from './ssh-relay-deploy'
+import type { RemoteOpenCodeRuntimePreparation } from './ssh-relay-opencode-runtime-retry'
 import { execCommand } from './ssh-relay-deploy-helpers'
 import { writeStringsViaSftp } from './sftp-upload'
 import { isRelayVersionMismatchError } from './ssh-relay-version-mismatch-error'
@@ -22,6 +23,7 @@ import { toAppSshPtyId, toRelaySshPtyId } from '../providers/ssh-pty-id'
 import { SshFilesystemProvider } from '../providers/ssh-filesystem-provider'
 import { isMethodNotFoundError } from './ssh-filesystem-stream-reader'
 import { SshGitProvider } from '../providers/ssh-git-provider'
+import { selectOpenCodePluginSources } from '../agent-hooks/opencode-plugin-settings'
 import { agentHookServer } from '../agent-hooks/server'
 import { isAgentStatusHooksEnabled } from '../agent-hooks/managed-agent-hook-controls'
 import {
@@ -117,6 +119,7 @@ import {
 } from '../../shared/ssh-ai-vault-relay'
 import { isTerminalLeafId, makePaneKey } from '../../shared/stable-pane-id'
 import { isValidTerminalTabId } from '../../shared/terminal-tab-id'
+import { hasClosedTerminalTabRecord } from '../../shared/closed-terminal-tab-tombstones'
 import {
   openSshPtyConsumerSession,
   type OpenSshPtyConsumerSessionOptions,
@@ -317,6 +320,7 @@ export class SshRelaySession {
   private muxDisposeCleanup: (() => void) | null = null
   // Why: hold the notification-handler disposer so teardownProviders can release it on reconnect/shutdown (symmetric with muxDisposeCleanup).
   private muxNotificationCleanup: (() => void) | null = null
+  private pluginSettingsCleanup: (() => void) | null = null
   // Why: onStateChange never fires when the relay channel closes but SSH stays up; this callback lets ssh.ts drive relay-level reconnect.
   private _onRelayLost: ((targetId: string) => void) | null = null
   // Why: a version mismatch or a blocked owner admission is terminal, so it needs a separate callback
@@ -329,6 +333,10 @@ export class SshRelaySession {
   private lastGraceTimeSeconds: number | undefined = undefined
   private hostPlatform: RemoteHostPlatform | null = null
   private remoteCliBridgeEnv: RemoteCliBridgeEnv | null = null
+  private openCodeRuntimePreparation: {
+    run: RemoteOpenCodeRuntimePreparation
+    controller: AbortController
+  } | null = null
   private aiVaultListMethodSupported: boolean | null = null
   private aiVaultTitleMethodSupported: boolean | null = null
   private pendingPtyReattaches = new Map<string, PendingPtyReattach>()
@@ -460,6 +468,7 @@ export class SshRelaySession {
     if (!mux || mux.isDisposed() || this._state !== 'ready') {
       throw new Error('SSH relay is not ready')
     }
+    this.prepareOpenCodeRuntimeForScan()
     return mux.request(method, params, { timeoutMs: 15_000 })
   }
 
@@ -474,6 +483,7 @@ export class SshRelaySession {
     if (!mux || mux.isDisposed() || this._state !== 'ready') {
       throw new Error('SSH relay is not ready')
     }
+    this.prepareOpenCodeRuntimeForScan()
     try {
       const result = await mux.request(SSH_AI_VAULT_LIST_SESSIONS_METHOD, params, {
         signal: options.signal,
@@ -549,7 +559,8 @@ export class SshRelaySession {
         nodePath,
         sockPath,
         credentialFile,
-        hostPlatform
+        hostPlatform,
+        prepareOpenCodeRuntime
       } = await deployAndLaunchRelay(conn, undefined, graceTimeSeconds, this.targetId)
       this.hostPlatform = hostPlatform ?? null
       this.remoteCliBridgeEnv =
@@ -574,6 +585,9 @@ export class SshRelaySession {
       }
 
       const mux = new SshChannelMultiplexer(transport)
+      this.openCodeRuntimePreparation = prepareOpenCodeRuntime
+        ? { run: prepareOpenCodeRuntime, controller: new AbortController() }
+        : null
       this.mux = mux
       const isAttemptCurrent = (): boolean => this.mux === mux && !this.isDisposed()
       const shouldContinue = (): boolean => isAttemptCurrent() && !mux.isDisposed()
@@ -704,7 +718,8 @@ export class SshRelaySession {
         nodePath,
         sockPath,
         credentialFile,
-        hostPlatform
+        hostPlatform,
+        prepareOpenCodeRuntime
       } = await deployAndLaunchRelay(conn, undefined, graceTimeSeconds, this.targetId)
       this.hostPlatform = hostPlatform ?? null
       this.remoteCliBridgeEnv =
@@ -729,6 +744,9 @@ export class SshRelaySession {
       }
 
       const mux = new SshChannelMultiplexer(transport)
+      this.openCodeRuntimePreparation = prepareOpenCodeRuntime
+        ? { run: prepareOpenCodeRuntime, controller: new AbortController() }
+        : null
       this.mux = mux
 
       const isAttemptCurrent = (): boolean =>
@@ -1072,6 +1090,13 @@ export class SshRelaySession {
       return false
     }
 
+    this.pluginSettingsCleanup?.()
+    this.pluginSettingsCleanup =
+      this.store.onSettingsChanged?.((updates) => {
+        if ('disabledTuiAgents' in updates || 'agentStatusHooksEnabled' in updates) {
+          void this.installPluginsOnRelay(mux)
+        }
+      }) ?? null
     await this.installPluginsOnRelay(mux)
     if (shouldContinue && !shouldContinue()) {
       return false
@@ -1524,17 +1549,28 @@ export class SshRelaySession {
 
   // Why: ship plugin/extension source from Orca so agent-event changes don't force a relay redeploy — the relay is versioned independently. Best-effort: failure only costs agent status on this host.
   private async installPluginsOnRelay(mux: SshChannelMultiplexer): Promise<void> {
-    if (!isRemoteAgentHooksEnabled() || !this.areAgentStatusHooksEnabled()) {
+    if (!isRemoteAgentHooksEnabled()) {
       return
     }
     try {
-      await mux.request(AGENT_HOOK_INSTALL_PLUGINS_METHOD, {
-        opencodePluginSource: openCodeInternals.getOpenCodePluginSource(),
-        opencode2PluginSource: openCodeInternals.getOpenCode2PluginSource(),
-        piExtensionSource: getPiAgentStatusExtensionSource('pi'),
-        ompExtensionSource: getPiAgentStatusExtensionSource('omp'),
-        primeAgentExtensionSource: getPiAgentStatusExtensionSource('prime-agent')
-      })
+      const hooksEnabled = this.areAgentStatusHooksEnabled()
+      await mux.request(
+        AGENT_HOOK_INSTALL_PLUGINS_METHOD,
+        selectOpenCodePluginSources(
+          {
+            opencodePluginSource: openCodeInternals.getOpenCodePluginSource(),
+            opencode2PluginSource: openCodeInternals.getOpenCode2PluginSource(),
+            ...(hooksEnabled
+              ? {
+                  piExtensionSource: getPiAgentStatusExtensionSource('pi'),
+                  ompExtensionSource: getPiAgentStatusExtensionSource('omp'),
+                  primeAgentExtensionSource: getPiAgentStatusExtensionSource('prime-agent')
+                }
+              : {})
+          },
+          this.store.getSettings?.() ?? null
+        )
+      )
     } catch (err) {
       // Why: -32601 = older relay without the handler; CONNECTION_LOST/DISPOSED = routine mid-flight teardown — swallow both.
       const code = (err as { code?: unknown })?.code
@@ -1646,11 +1682,22 @@ export class SshRelaySession {
     })
   }
 
+  private prepareOpenCodeRuntimeForScan(): void {
+    const preparation = this.openCodeRuntimePreparation
+    if (preparation) {
+      void preparation.run(preparation.controller.signal)
+    }
+  }
+
   private teardownProviders(
     reason: 'shutdown' | 'connection_lost',
     outputGenerationReason: string = reason
   ): void {
+    this.openCodeRuntimePreparation?.controller.abort()
+    this.openCodeRuntimePreparation = null
     this.releaseRelayLossWatcher()
+    this.pluginSettingsCleanup?.()
+    this.pluginSettingsCleanup = null
     this.muxNotificationCleanup?.()
     this.muxNotificationCleanup = null
     for (const cleanup of this.ptyRecoveryNotificationCleanups) {
@@ -1799,10 +1846,6 @@ export class SshRelaySession {
       }
       const pending = this.pendingPtyReattaches.get(payload.id)
       if (pending && this.activePtyConsumerOwner()?.outputFlowControl) {
-        if (pending.livePassthrough) {
-          void this.acceptPtyData(payload).catch(() => {})
-          return
-        }
         this.quarantineReattachData(pending, payload)
         return
       }
@@ -2074,6 +2117,12 @@ export class SshRelaySession {
   }
 
   private quarantineReattachData(pending: PendingPtyReattach, payload: SshPtyDataPayload): void {
+    if (pending.livePassthrough) {
+      if (this.ownsPtyRecoveryAttempt(payload.id, pending)) {
+        void this.acceptPtyData(payload).catch(() => {})
+      }
+      return
+    }
     this.observePrivateRecoveryFrame(pending, payload)
     if (pending.restoreRequired) {
       return
@@ -2575,11 +2624,15 @@ export class SshRelaySession {
         return
       }
       if (attachResult.incarnationId) {
-        const restoreResult = this.restoreReattachedPtyRuntime(
+        const restoreResult = await this.restoreReattachedPtyRuntime(
           appPtyId,
           attachResult.incarnationId,
-          activeLease
+          activeLease,
+          () => shouldContinue() && this.ownsPtyRecoveryAttempt(appPtyId, pendingReattach)
         )
+        if (!shouldContinue() || !this.ownsPtyRecoveryAttempt(appPtyId, pendingReattach)) {
+          return
+        }
         if (restoreResult !== 'restored') {
           clearProviderPtyState(appPtyId)
           deletePtyOwnership(appPtyId)
@@ -2700,9 +2753,19 @@ export class SshRelaySession {
     if (hasLiveCurrentBinding) {
       return false
     }
-    return [lease.tabId, ...currentTabIds]
-      .filter((tabId) => isValidTerminalTabId(tabId))
-      .some(tombstoneMatches)
+    // Why only when no tab holds the leaf: a pane moved out of the tab before it closed lives on.
+    const leaseTabId = lease.tabId
+    const closedByRecord =
+      currentTabIds.length === 0 &&
+      candidates.some((candidate) =>
+        hasClosedTerminalTabRecord(candidate?.closedTerminalTabTombstonesByTabId, leaseTabId)
+      )
+    return (
+      closedByRecord ||
+      [lease.tabId, ...currentTabIds]
+        .filter((tabId) => isValidTerminalTabId(tabId))
+        .some(tombstoneMatches)
+    )
   }
 
   private async suppressRetiredReattachedPty(
@@ -2742,45 +2805,56 @@ export class SshRelaySession {
     deletePtyOwnership(appPtyId)
   }
 
-  private restoreReattachedPtyRuntime(
+  private async restoreReattachedPtyRuntime(
     appPtyId: string,
     incarnationId: string,
-    lease: SshPtyLease | undefined
-  ): ReattachedPtyRuntimeRestore {
+    lease: SshPtyLease | undefined,
+    shouldContinue: () => boolean
+  ): Promise<ReattachedPtyRuntimeRestore> {
     if (lease?.worktreeId && lease.tabId && lease.leafId) {
-      const session = this.store.getWorkspaceSession?.()
-      // The lease froze its tabId at write time; `detachTerminalPaneToTab` moves a live pane, so
-      // trusting it would fence this reattach to the tab the pane LEFT and refuse a pane that
-      // merely moved. Leaf is the identity, the tab is only where it currently sits.
-      // SSH spawns bind panes into `ssh:<target>` while this reattach binds into `local`, so a
-      // fence that consulted only one partition would read "no pane" for a pane the other holds.
-      const hostSession = this.store.getWorkspaceSession?.(toSshExecutionHostId(this.targetId))
-      const tabId =
-        findTerminalTabIdForLeaf(session, lease.leafId) ??
-        findTerminalTabIdForLeaf(hostSession, lease.leafId) ??
-        lease.tabId
-      // Absence of the pane only means "the user closed it" once the persisted membership
-      // speaks for this worktree. Before that it means the renderer has not published its
-      // layout yet, and refusing there drops a tab the user still has — the regression that
-      // reverted this fix twice. Losing a tab is worse than keeping a duplicate, so an
-      // unauthoritative session still gets the creating write.
-      // Authority is read from `local` because that is the partition this write lands in — it
-      // is local's absence we would be interpreting. But a pane the other partition still holds
-      // is not gone, so it keeps its creating write: refusing there would strand a live pane
-      // behind a binding reattach can no longer reach.
-      const mayCreate =
-        !hasHostAuthoritativeTerminalMembership(session, lease.worktreeId) ||
-        findTerminalTabIdForLeaf(hostSession, lease.leafId) !== undefined
-      const bound = this.store.persistPtyBinding({
-        worktreeId: lease.worktreeId,
-        tabId,
-        leafId: lease.leafId,
-        ptyId: appPtyId,
-        incarnationId,
-        ...(mayCreate ? {} : { mayCreate: false }),
-        mayReviveRetiredSurface: false,
-        origin: 'relay_reattach'
+      const { worktreeId, leafId, tabId: leaseTabId } = lease
+      let tabId = lease.tabId
+      const bound = await this.store.persistPtyBinding(() => {
+        if (!shouldContinue()) {
+          return null
+        }
+        const session = this.store.getWorkspaceSession?.()
+        // The lease froze its tabId at write time; `detachTerminalPaneToTab` moves a live pane, so
+        // trusting it would fence this reattach to the tab the pane LEFT and refuse a pane that
+        // merely moved. Leaf is the identity, the tab is only where it currently sits.
+        // SSH spawns bind panes into `ssh:<target>` while this reattach binds into `local`, so a
+        // fence that consulted only one partition would read "no pane" for a pane the other holds.
+        const hostSession = this.store.getWorkspaceSession?.(toSshExecutionHostId(this.targetId))
+        tabId =
+          findTerminalTabIdForLeaf(session, leafId) ??
+          findTerminalTabIdForLeaf(hostSession, leafId) ??
+          leaseTabId
+        // Absence of the pane only means "the user closed it" once the persisted membership
+        // speaks for this worktree. Before that it means the renderer has not published its
+        // layout yet, and refusing there drops a tab the user still has — the regression that
+        // reverted this fix twice. Losing a tab is worse than keeping a duplicate, so an
+        // unauthoritative session still gets the creating write.
+        // Authority is read from `local` because that is the partition this write lands in — it
+        // is local's absence we would be interpreting. But a pane the other partition still holds
+        // is not gone, so it keeps its creating write: refusing there would strand a live pane
+        // behind a binding reattach can no longer reach.
+        const mayCreate =
+          !hasHostAuthoritativeTerminalMembership(session, worktreeId) ||
+          findTerminalTabIdForLeaf(hostSession, leafId) !== undefined
+        return {
+          worktreeId: worktreeId,
+          tabId,
+          leafId: leafId,
+          ptyId: appPtyId,
+          incarnationId,
+          ...(mayCreate ? {} : { mayCreate: false }),
+          mayReviveRetiredSurface: false,
+          origin: 'relay_reattach' as const
+        }
       })
+      if (!shouldContinue()) {
+        return 'missing-surface'
+      }
       if (bound === false) {
         // Topology absence alone is not authority to kill a process, but neither refusal may
         // publish or replay into a missing pane.
diff --git a/src/main/ssh/ssh-relay-sftp-namespace-install.test.ts b/src/main/ssh/ssh-relay-sftp-namespace-install.test.ts
index 65459b8bcba..5bf0cc3ab53 100644
--- a/src/main/ssh/ssh-relay-sftp-namespace-install.test.ts
+++ b/src/main/ssh/ssh-relay-sftp-namespace-install.test.ts
@@ -7,6 +7,9 @@ import { EventEmitter } from 'node:events'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as RelayInstallMarkerModule from './ssh-relay-install-marker'
 
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', () => ({
   remoteRipgrepLayout: vi.fn().mockReturnValue(null),
   recordRemoteRipgrepReference: vi.fn().mockResolvedValue(false),
diff --git a/src/main/ssh/ssh-relay-superseded-endpoints.test.ts b/src/main/ssh/ssh-relay-superseded-endpoints.test.ts
index dc091b67762..63d5ec29ca1 100644
--- a/src/main/ssh/ssh-relay-superseded-endpoints.test.ts
+++ b/src/main/ssh/ssh-relay-superseded-endpoints.test.ts
@@ -107,6 +107,60 @@ describe('classifySupersededRelay', () => {
 })
 
 describe('sweepSupersededRelayEndpoints', () => {
+  it.each(['listing', 'reap', 'removal'] as const)(
+    'stops after unconfirmed %s termination without examining another endpoint',
+    async (phase) => {
+      const secondSock = `${HOME}/.orca-remote/relay-0.1.0+cafebabe1234/${SOCK_NAME}`
+      const error = Object.assign(new Error('Remote termination is unconfirmed'), {
+        sshChannelCloseConfirmed: false
+      })
+      if (phase !== 'listing') {
+        execCommand
+          .mockResolvedValueOnce(`${OLD_SOCK}\n${secondSock}\n`)
+          .mockResolvedValueOnce(
+            probe(
+              phase === 'reap'
+                ? ['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 2 0']
+                : ['PRESENT=yes', 'LISTEN=refused', 'HOLDERS_SOURCE=lsof']
+            )
+          )
+      }
+      execCommand.mockRejectedValueOnce(error)
+
+      await expect(sweepSupersededRelayEndpoints(CONN, HOST, SWEEP)).rejects.toBe(error)
+
+      expect(issuedCommands()).toHaveLength(phase === 'listing' ? 1 : 3)
+    }
+  )
+
+  it.each(['reap', 'removal'] as const)(
+    'keeps an ordinary %s failure nonfatal and examines later endpoints',
+    async (phase) => {
+      const secondSock = `${HOME}/.orca-remote/relay-0.1.0+cafebabe1234/${SOCK_NAME}`
+      execCommand
+        .mockResolvedValueOnce(`${OLD_SOCK}\n${secondSock}\n`)
+        .mockResolvedValueOnce(
+          probe(
+            phase === 'reap'
+              ? ['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 2 0']
+              : ['PRESENT=yes', 'LISTEN=refused', 'HOLDERS_SOURCE=lsof']
+          )
+        )
+        .mockRejectedValueOnce(new Error('Operation failed'))
+        .mockResolvedValueOnce(
+          probe(['PRESENT=yes', 'LISTEN=unknown', 'HOLDERS_SOURCE=unavailable'])
+        )
+
+      const findings = await sweepSupersededRelayEndpoints(CONN, HOST, SWEEP)
+
+      expect(findings.map((finding) => finding.outcome)).toEqual([
+        phase === 'reap' ? 'reap-unconfirmed' : 'unverifiable',
+        'unverifiable'
+      ])
+      expect(issuedCommands()).toHaveLength(4)
+    }
+  )
+
   it('stops the sweep before cleanup when probe group termination is unconfirmed', async () => {
     execCommand
       .mockResolvedValueOnce(OLD_SOCK)
diff --git a/src/main/ssh/ssh-relay-superseded-endpoints.ts b/src/main/ssh/ssh-relay-superseded-endpoints.ts
index ade50943c32..c538988f11b 100644
--- a/src/main/ssh/ssh-relay-superseded-endpoints.ts
+++ b/src/main/ssh/ssh-relay-superseded-endpoints.ts
@@ -21,6 +21,7 @@ import { shellEscape } from './ssh-connection-utils'
 import { RELAY_REMOTE_DIR } from './relay-protocol'
 import { SHORT_RELAY_SOCKET_DIR_PREFIX } from './relay-socket-path-limit'
 import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import {
   describeRelayEndpointIncumbent,
   isReapableRelayHusk,
@@ -138,6 +139,9 @@ export async function sweepSupersededRelayEndpoints(
       signal: options.signal
     })
   } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     // Same reason the Windows arm logs: an abandoned pass and an empty host are the same return
     // value, and only the log tells them apart.
     console.warn(
@@ -201,7 +205,10 @@ async function applySupersededRelayDecision(
         signal: options.signal
       })
       return 'stale-endpoint-removed'
-    } catch {
+    } catch (error) {
+      if (isUnconfirmedSshCommandTermination(error)) {
+        throw error
+      }
       return 'unverifiable'
     }
   }
diff --git a/src/main/ssh/ssh-relay-upload-stage-commands.test.ts b/src/main/ssh/ssh-relay-upload-stage-commands.test.ts
index 8afb89228d0..0b5d0a74149 100644
--- a/src/main/ssh/ssh-relay-upload-stage-commands.test.ts
+++ b/src/main/ssh/ssh-relay-upload-stage-commands.test.ts
@@ -15,6 +15,7 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it } from 'vitest'
 import { getRemoteHostPlatform, type RemoteHostPlatform } from './ssh-remote-platform'
+import { powerShellCommand, powerShellLiteral } from './ssh-remote-powershell'
 import {
   cleanupOwnedRelayUploadStageCommand,
   parseReservedRelayUploadStage,
@@ -73,17 +74,19 @@ function runCommand(host: RemoteHostPlatform, command: string, prefix = '') {
   return spawnSync('/bin/sh', ['-c', `${prefix}\n${command}`], { encoding: 'utf8' })
 }
 
-function createStage(
-  host: RemoteHostPlatform,
+function createStage(host: RemoteHostPlatform, pool: string, index: number): string {
+  const reservation = runCommand(host, reserveRelayUploadStageCommand(host, pool, owner))
+  expect(reservation.status, reservation.stderr).toBe(0)
+  return populateReservedStage(pool, index)
+}
+
+function populateReservedStage(
   pool: string,
   index: number,
-  stageOwner = owner,
+  replacementOwner?: string,
   stale = false,
   state: 'slot' | 'claim' | 'delete' = 'slot'
 ): string {
-  const reservedOwner = /^\.sftp-namespace-[0-9a-f]{32}$/u.test(stageOwner) ? stageOwner : owner
-  const reservation = runCommand(host, reserveRelayUploadStageCommand(host, pool, reservedOwner))
-  expect(reservation.status, reservation.stderr).toBe(0)
   const slot = join(pool, `slot-${index}`)
   const stage = join(pool, `${state}-${index}`)
   if (stage !== slot) {
@@ -91,8 +94,8 @@ function createStage(
     renameSync(slot, stage)
   }
   const marker = join(stage, '.orca-upload-owner')
-  if (stageOwner !== reservedOwner) {
-    writeFileSync(marker, stageOwner)
+  if (replacementOwner !== undefined) {
+    writeFileSync(marker, replacementOwner)
   }
   writeFileSync(join(stage, 'payload', 'relay.js'), `relay-${index}`)
   if (stale) {
@@ -102,16 +105,48 @@ function createStage(
   return stage
 }
 
+function createStages(host: RemoteHostPlatform, pool: string, count: number): void {
+  if (host.commandDialect !== 'powershell' || count < 2) {
+    for (let index = 0; index < count; index += 1) {
+      createStage(host, pool, index)
+    }
+    return
+  }
+  const command = reserveRelayUploadStageCommand(host, pool, owner)
+  // Only fixture setup shares a process; each unmodified script gets a fresh local scope.
+  const batch = powerShellCommand(
+    [
+      "$ErrorActionPreference = 'Stop'",
+      `$fixtureScript = ${powerShellLiteral(decodePowerShellCommand(command))}`,
+      '$reservation = [PowerShell]::Create()',
+      'try {',
+      `foreach ($fixtureIndex in 1..${count}) {`,
+      '$reservation.Commands.Clear()',
+      '$reservation.Streams.Error.Clear()',
+      '$null = $reservation.AddScript($fixtureScript, $true)',
+      '$reservation.Invoke()',
+      'if ($reservation.InvocationStateInfo.State -ne "Completed") { throw $reservation.InvocationStateInfo.Reason }',
+      '}',
+      '} finally { $reservation.Dispose() }'
+    ].join('\n')
+  )
+  const result = runCommand(host, batch)
+  expect(result.status, result.stderr).toBe(0)
+  const reservations = result.stdout.trim().split(/\r?\n/u)
+  expect(reservations).toHaveLength(count)
+  for (const [index, output] of reservations.entries()) {
+    expect(parseReservedRelayUploadStage(host, pool, owner, output).slotName).toBe(`slot-${index}`)
+    populateReservedStage(pool, index)
+  }
+}
+
 afterEach(() => {
   for (const root of roots.splice(0)) {
     rmSync(root, { recursive: true, force: true })
   }
 })
 
-// Why: every case spawns a real interpreter per command, and on non-Windows hosts the PowerShell
-// path also forks `/usr/bin/stat` per file-identity lookup — the 8-entry reservation alone measured
-// ~50s idle, nearly all of it process-spawn sys time, and the full suite multiplies that under CPU
-// contention. Sized for spawn count, not the assertions, which run in microseconds.
+// Allow for real interpreter startup and file-identity probes under full-suite contention.
 const SPAWNED_INTERPRETER_TIMEOUT_MS = 240_000
 
 describe.each([
@@ -126,9 +161,7 @@ describe.each([
   (_label, host) => {
     it.each([0, 1, 7, 8, 9])('bounds reservation with %i occupied entries', (count) => {
       const pool = createPool()
-      for (let index = 0; index < Math.min(count, RELAY_UPLOAD_STAGE_SLOT_COUNT); index += 1) {
-        createStage(host, pool, index)
-      }
+      createStages(host, pool, Math.min(count, RELAY_UPLOAD_STAGE_SLOT_COUNT))
       if (count > RELAY_UPLOAD_STAGE_SLOT_COUNT) {
         mkdirSync(join(pool, 'foreign-extra'))
       }
@@ -204,9 +237,9 @@ describe.each([
 
     it('reclaims one stale owned stage but preserves fresh and foreign stages', () => {
       const pool = createPool()
-      createStage(host, pool, 0, owner, false)
-      createStage(host, pool, 1, '.foreign-owner', true)
-      createStage(host, pool, 2, owner, true)
+      createStages(host, pool, 3)
+      populateReservedStage(pool, 1, '.foreign-owner', true)
+      populateReservedStage(pool, 2, undefined, true)
 
       const result = runCommand(host, recoverOneStaleRelayUploadStageCommand(host, pool, 60))
 
@@ -218,8 +251,9 @@ describe.each([
 
     it('drains fixed stale claim and delete states across repeated deployments', () => {
       const pool = createPool()
-      createStage(host, pool, 0, owner, true, 'claim')
-      createStage(host, pool, 1, owner, true, 'delete')
+      createStages(host, pool, 2)
+      populateReservedStage(pool, 0, undefined, true, 'claim')
+      populateReservedStage(pool, 1, undefined, true, 'delete')
 
       for (let attempt = 0; attempt < 2; attempt += 1) {
         const result = runCommand(host, recoverOneStaleRelayUploadStageCommand(host, pool, 60))
diff --git a/src/main/ssh/ssh-relay-versioned-install-termination.test.ts b/src/main/ssh/ssh-relay-versioned-install-termination.test.ts
new file mode 100644
index 00000000000..7c550175133
--- /dev/null
+++ b/src/main/ssh/ssh-relay-versioned-install-termination.test.ts
@@ -0,0 +1,114 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('./ssh-relay-deploy-helpers', () => ({ execCommand: vi.fn() }))
+
+import type { SshConnection } from './ssh-connection'
+import { REMOTE_INSTALL_MODELS } from './remote-install-model'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import {
+  abandonInstall,
+  finalizeInstall,
+  isRemoteInstallComplete
+} from './ssh-relay-versioned-install'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The mocked execCommand never reads the connection.
+const conn = {} as SshConnection
+const mockExec = vi.mocked(execCommand)
+
+beforeEach(() => {
+  mockExec.mockReset()
+})
+
+describe.each([
+  { platform: 'linux-x64' as const, remoteDir: '/relay/version' },
+  { platform: 'win32-x64' as const, remoteDir: 'C:/relay/version' }
+])('install-complete probe termination on $platform', ({ platform, remoteDir }) => {
+  const host = getRemoteHostPlatform(platform)
+
+  it.each([abandonInstall, finalizeInstall])(
+    'preserves uncertainty from lock release by %s',
+    async (release) => {
+      const error = Object.assign(new Error('release still running'), {
+        sshChannelCloseConfirmed: false
+      })
+      mockExec.mockResolvedValue('')
+      if (release === finalizeInstall) {
+        mockExec.mockResolvedValueOnce('')
+      }
+      mockExec.mockRejectedValueOnce(error)
+      await expect(release(conn, remoteDir, host)).rejects.toBe(error)
+    }
+  )
+
+  it.each([abandonInstall, finalizeInstall])(
+    'keeps confirmed release failures nonfatal in %s',
+    async (release) => {
+      if (release === finalizeInstall) {
+        mockExec.mockResolvedValueOnce('')
+      }
+      mockExec.mockRejectedValueOnce(
+        Object.assign(new Error('release failed'), {
+          sshChannelCloseConfirmed: true
+        })
+      )
+      await expect(release(conn, remoteDir, host)).resolves.toBeUndefined()
+    }
+  )
+
+  describe.each(REMOTE_INSTALL_MODELS)('$id installs', (model) => {
+    it.each([
+      { aborted: false, rethrowSessionLimitErrors: false },
+      { aborted: false, rethrowSessionLimitErrors: true },
+      { aborted: true, rethrowSessionLimitErrors: false },
+      { aborted: true, rethrowSessionLimitErrors: true }
+    ])(
+      'preserves uncertainty with aborted=$aborted and strict=$rethrowSessionLimitErrors',
+      async ({ aborted, rethrowSessionLimitErrors }) => {
+        const controller = new AbortController()
+        const error = Object.assign(new Error('SSH teardown not confirmed'), {
+          sshChannelCloseConfirmed: false
+        })
+        mockExec.mockImplementationOnce(async () => {
+          if (aborted) {
+            controller.abort(new Error('deploy aborted'))
+          }
+          throw error
+        })
+
+        await expect(
+          isRemoteInstallComplete(conn, model, remoteDir, host, {
+            signal: controller.signal,
+            rethrowSessionLimitErrors
+          })
+        ).rejects.toBe(error)
+        expect(mockExec).toHaveBeenCalledTimes(1)
+      }
+    )
+
+    it('keeps a confirmed command failure as an incomplete install', async () => {
+      mockExec.mockRejectedValueOnce(
+        Object.assign(new Error('SSH command failed after closing'), {
+          sshChannelCloseConfirmed: true
+        })
+      )
+
+      await expect(isRemoteInstallComplete(conn, model, remoteDir, host)).resolves.toBe(false)
+    })
+
+    it('keeps caller cancellation after a confirmed command failure', async () => {
+      const controller = new AbortController()
+      const abortError = new Error('deploy aborted')
+      mockExec.mockImplementationOnce(async () => {
+        controller.abort(abortError)
+        throw Object.assign(new Error('SSH command failed after closing'), {
+          sshChannelCloseConfirmed: true
+        })
+      })
+
+      await expect(
+        isRemoteInstallComplete(conn, model, remoteDir, host, { signal: controller.signal })
+      ).rejects.toBe(abortError)
+    })
+  })
+})
diff --git a/src/main/ssh/ssh-relay-versioned-install.test.ts b/src/main/ssh/ssh-relay-versioned-install.test.ts
index 482b0e8b113..1778ac1affc 100644
--- a/src/main/ssh/ssh-relay-versioned-install.test.ts
+++ b/src/main/ssh/ssh-relay-versioned-install.test.ts
@@ -1,11 +1,13 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as DeployHelpers from './ssh-relay-deploy-helpers'
 
 vi.mock('fs', () => ({
   existsSync: vi.fn(),
   readFileSync: vi.fn()
 }))
 
-vi.mock('./ssh-relay-deploy-helpers', () => ({
+vi.mock('./ssh-relay-deploy-helpers', async (importOriginal) => ({
+  ...(await importOriginal<typeof DeployHelpers>()),
   execCommand: vi.fn()
 }))
 
@@ -909,7 +911,9 @@ describe('gcOldRelayVersions', () => {
       .mockResolvedValueOnce('OWNED')
       .mockRejectedValueOnce(unconfirmed)
 
-    await gcOldRelayVersions(conn, '/home/u', '/home/u/.orca-remote/relay-0.1.0+bbb')
+    await expect(
+      gcOldRelayVersions(conn, '/home/u', '/home/u/.orca-remote/relay-0.1.0+bbb')
+    ).rejects.toBe(unconfirmed)
 
     const releaseCommands = mockExec.mock.calls
       .map(([, command]) => command)
diff --git a/src/main/ssh/ssh-relay-versioned-install.ts b/src/main/ssh/ssh-relay-versioned-install.ts
index 5bd111bdec1..ee62c3402b2 100644
--- a/src/main/ssh/ssh-relay-versioned-install.ts
+++ b/src/main/ssh/ssh-relay-versioned-install.ts
@@ -8,6 +8,7 @@ import { join } from 'node:path'
 import { existsSync, readFileSync } from 'node:fs'
 import type { SshConnection } from './ssh-connection'
 import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import { RELAY_INSTALL_LOCK_NAME } from './ssh-relay-install-lock'
 import { remoteInstallDirSegments } from './ssh-relay-install-namespace'
 import { RELAY_INSTALL_MODEL, type RemoteInstallModel } from './remote-install-model'
@@ -133,6 +134,9 @@ export async function isRemoteInstallComplete(
     )
     return probe.trim() === 'OK'
   } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     options?.signal?.throwIfAborted()
     if (options?.rethrowSessionLimitErrors && isSshSessionLimitError(err)) {
       throw err
@@ -160,7 +164,11 @@ export async function finalizeInstall(
   if (options?.releaseLock !== false) {
     await execHostCommand(conn, host, removeRemoteTreeCommand(host, lock), {
       signal: options?.signal
-    }).catch(() => {})
+    }).catch((error) => {
+      if (isUnconfirmedSshCommandTermination(error)) {
+        throw error
+      }
+    })
   }
   options?.signal?.throwIfAborted()
 }
@@ -175,13 +183,17 @@ export async function abandonInstall(
   host: RemoteHostPlatform = DEFAULT_REMOTE_HOST
 ): Promise<void> {
   const lock = joinRemotePath(host, remoteRelayDir, RELAY_INSTALL_LOCK_NAME)
-  await execHostCommand(conn, host, removeRemoteTreeCommand(host, lock)).catch(() => {})
+  await execHostCommand(conn, host, removeRemoteTreeCommand(host, lock)).catch((error) => {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
+  })
 }
 
 /**
  * Garbage-collect old version directories: remove an idle, fully-installed,
- * unlocked sibling version dir (never the current one). Best-effort — errors
- * are swallowed so GC never blocks the user from connecting.
+ * unlocked sibling version dir (never the current one). Confirmed failures are
+ * best-effort; unconfirmed command termination stops later deployment commands.
  */
 // Why re-exported rather than moved outright: deploy and the relay tests import the whole
 // versioned-install surface from here, and the split exists for file size, not to redraw an API.
diff --git a/src/main/ssh/ssh-remote-cli-host-passthrough.test.ts b/src/main/ssh/ssh-remote-cli-host-passthrough.test.ts
index 53334e3cd12..811917cf715 100644
--- a/src/main/ssh/ssh-remote-cli-host-passthrough.test.ts
+++ b/src/main/ssh/ssh-remote-cli-host-passthrough.test.ts
@@ -129,6 +129,28 @@ describe('buildHostCliEnv', () => {
     expect(env.ORCA_CLI_COMMAND).toBe('orca')
   })
 
+  it('never lets a remote command claim a local agent session', () => {
+    // The host's env carries a session id when Orca was launched inside a structured session; the
+    // remote shell's own is from another machine. Session identity is same-host only.
+    const env = buildHostCliEnv({
+      hostEnv: {
+        ORCA_AGENT_SESSION_ID: 'f7a1c0de-1111-4222-8333-444455556666',
+        ORCA_STRUCTURED_SESSION: '1'
+      },
+      remoteEnv: {
+        ORCA_TERMINAL_HANDLE: 'term_remote',
+        ORCA_AGENT_SESSION_ID: 'a0b1c2d3-0000-4000-8000-00000000abcd'
+      },
+      userDataPath: '/host/user-data',
+      remoteCwd: '/srv/repo'
+    })
+
+    expect(env.ORCA_AGENT_SESSION_ID).toBeUndefined()
+    expect(env.ORCA_STRUCTURED_SESSION).toBeUndefined()
+    // The remote command still speaks as its own terminal.
+    expect(env.ORCA_TERMINAL_HANDLE).toBe('term_remote')
+  })
+
   it('namespaces identical remote artifact paths by stable SSH target', () => {
     const artifactInput = {
       sourceKey: '/srv/repo/report.html',
diff --git a/src/main/ssh/ssh-remote-cli-host-passthrough.ts b/src/main/ssh/ssh-remote-cli-host-passthrough.ts
index d62a23d8e30..4490343504f 100644
--- a/src/main/ssh/ssh-remote-cli-host-passthrough.ts
+++ b/src/main/ssh/ssh-remote-cli-host-passthrough.ts
@@ -13,6 +13,8 @@ import {
   ORCHESTRATION_COMPATIBILITY_HOST_INCARNATION_ENV,
   ORCHESTRATION_COMPATIBILITY_HOST_KIND_ENV
 } from '../../shared/orchestration-compatibility-evidence'
+import { ORCA_AGENT_SESSION_ID_ENV } from '../../shared/agent-session-caller-env'
+import { ORCA_STRUCTURED_SESSION_ENV } from '../../shared/structured-session-marker'
 import {
   REMOTE_ARTIFACT_INPUT_ENV,
   sshArtifactSourceKey,
@@ -131,6 +133,10 @@ export function buildHostCliEnv(args: {
   delete env[ORCHESTRATION_COMPATIBILITY_HOST_INCARNATION_ENV]
   delete env[ORCHESTRATION_COMPATIBILITY_ATTACHMENT_ENV]
   delete env[REMOTE_ARTIFACT_INPUT_ENV]
+  // Why: a remote command must never claim a local agent session. The host's env carries one only
+  // when Orca was launched inside a session, and identity by session id is same-host only.
+  delete env[ORCA_AGENT_SESSION_ID_ENV]
+  delete env[ORCA_STRUCTURED_SESSION_ENV]
   if (args.runtimeAuthority) {
     env[ORCHESTRATION_COMPATIBILITY_HOST_KIND_ENV] = 'ssh'
     env[ORCHESTRATION_COMPATIBILITY_HOST_ID_ENV] = args.runtimeAuthority.targetId
diff --git a/src/main/ssh/ssh-remote-commands.test.ts b/src/main/ssh/ssh-remote-commands.test.ts
index 363a87a645d..758d4739b0f 100644
--- a/src/main/ssh/ssh-remote-commands.test.ts
+++ b/src/main/ssh/ssh-remote-commands.test.ts
@@ -20,13 +20,11 @@ import {
   tryStealInstallLockCommand
 } from './ssh-relay-install-lock-commands'
 import {
-  commandInRemoteDirectory,
   commandWithNodePath,
   listRelayBaseDirsCommand,
   MAX_RELAY_GC_LISTING_ENTRIES,
   makeRemoteDirectoryCommand,
   moveRemoteTreeCommand,
-  promoteRemoteTreeContentsCommand,
   probeDirectoryExistsCommand,
   probeRelayInstalledCommand,
   readRemoteHomeCommand,
@@ -229,29 +227,6 @@ describe('ssh remote command builders', () => {
     expect(windowsScript).toContain("'MOVED'")
   })
 
-  it('enumerates Windows staging children before copying', () => {
-    const script = decodePowerShellCommand(
-      promoteRemoteTreeContentsCommand(windows, 'C:/Users/me/relay.upload-123', 'C:/Users/me/relay')
-    )
-    expect(script).toContain('Get-ChildItem -LiteralPath')
-    expect(script).toContain(' -Force -ErrorAction Stop | Copy-Item -Destination')
-    expect(script).not.toContain('Copy-Item -LiteralPath')
-    expect(script).toContain('Remove-Item -LiteralPath')
-    expect(script).toContain("$ErrorActionPreference = 'Stop'")
-    expect(script).toContain('Copy-Item -Destination')
-  })
-
-  it('removes POSIX staging only after the copy succeeds', () => {
-    const command = promoteRemoteTreeContentsCommand(
-      posix,
-      '/home/u/relay.upload-123',
-      '/home/u/relay'
-    )
-    expect(command).toContain("cp -a '/home/u/relay.upload-123'/. '/home/u/relay'/")
-    expect(command).toContain("&& rm -rf '/home/u/relay.upload-123'")
-    expect(command.indexOf('cp -a')).toBeLessThan(command.indexOf('rm -rf'))
-  })
-
   it('emits an explicit POSIX liveness result so GC can fail closed', () => {
     const command = relayLivenessProbeCommand(posix, '/home/u/.orca-remote/relay-0.1.0')
 
@@ -659,9 +634,6 @@ describe('ssh remote command builders', () => {
   )
 
   it('makes Windows remote directory changes fail before running scoped commands', () => {
-    const scopedCommand = decodePowerShellCommand(
-      commandInRemoteDirectory(windows, 'C:/Users/me/.orca-remote/relay-0.1.0', "'READY'")
-    )
     const nodeScopedCommand = decodePowerShellCommand(
       commandWithNodePath(
         windows,
@@ -671,9 +643,6 @@ describe('ssh remote command builders', () => {
       )
     )
 
-    expect(scopedCommand).toContain(
-      "Set-Location -ErrorAction Stop -LiteralPath 'C:/Users/me/.orca-remote/relay-0.1.0'"
-    )
     expect(nodeScopedCommand).toContain(
       "Set-Location -ErrorAction Stop -LiteralPath 'C:/Users/me/.orca-remote/relay-0.1.0'"
     )
diff --git a/src/main/ssh/ssh-remote-commands.ts b/src/main/ssh/ssh-remote-commands.ts
index fc3e965193e..11e39921fc2 100644
--- a/src/main/ssh/ssh-remote-commands.ts
+++ b/src/main/ssh/ssh-remote-commands.ts
@@ -72,17 +72,18 @@ export function moveRemoteTreeCommand(
   )
 }
 
-export function promoteRemoteTreeContentsCommand(
+// A concurrent installer may already have recreated the original directory.
+export function restoreRemoteTreeCommand(
   host: RemoteHostPlatform,
-  sourcePath: string,
-  destinationPath: string
+  source: string,
+  destination: string
 ): string {
-  if (!isWindowsRemoteHost(host)) {
-    return `cp -a ${shellEscape(sourcePath)}/. ${shellEscape(destinationPath)}/ && rm -rf ${shellEscape(sourcePath)}`
+  if (isWindowsRemoteHost(host)) {
+    return powerShellCommand(
+      `if (-not (Test-Path -LiteralPath ${powerShellLiteral(destination)})) { Move-Item -LiteralPath ${powerShellLiteral(source)} -Destination ${powerShellLiteral(destination)} -ErrorAction Stop; 'MOVED' } else { 'BUSY' }`
+    )
   }
-  return powerShellCommand(
-    `$ErrorActionPreference = 'Stop'; Get-ChildItem -LiteralPath ${powerShellLiteral(sourcePath)} -Force -ErrorAction Stop | Copy-Item -Destination ${powerShellLiteral(destinationPath)} -Recurse -Force -ErrorAction Stop; Remove-Item -LiteralPath ${powerShellLiteral(sourcePath)} -Recurse -Force -ErrorAction Stop`
-  )
+  return `if [ ! -e ${shellEscape(destination)} ] && [ ! -L ${shellEscape(destination)} ]; then mv ${shellEscape(source)} ${shellEscape(destination)} && echo MOVED; else echo BUSY; fi`
 }
 
 export function writeRemoteEmptyFileCommand(host: RemoteHostPlatform, remotePath: string): string {
@@ -263,19 +264,6 @@ export function relayLivenessProbeCommand(
   )
 }
 
-export function commandInRemoteDirectory(
-  host: RemoteHostPlatform,
-  remoteDir: string,
-  command: string
-): string {
-  if (!isWindowsRemoteHost(host)) {
-    return `cd ${shellEscape(remoteDir)} && ${command}`
-  }
-  return powerShellCommand(
-    `Set-Location -ErrorAction Stop -LiteralPath ${powerShellLiteral(remoteDir)}; ${command}`
-  )
-}
-
 export function commandWithNodePath(
   host: RemoteHostPlatform,
   nodePath: string,
diff --git a/src/main/ssh/ssh-remote-orca-cli.test.ts b/src/main/ssh/ssh-remote-orca-cli.test.ts
index 276d9cad87c..637a0c55ce3 100644
--- a/src/main/ssh/ssh-remote-orca-cli.test.ts
+++ b/src/main/ssh/ssh-remote-orca-cli.test.ts
@@ -84,6 +84,7 @@ describe('runRemoteOrcaCli', () => {
       getActiveDispatchForIdentity: vi.fn(() => undefined),
       getActiveDispatchMailboxOwners: vi.fn(() => []),
       getCurrentRunForPane: vi.fn(() => undefined),
+      getCurrentRunForCoordinator: vi.fn(() => undefined),
       getRunMailboxOwnerIdsForHandle: vi.fn(() => []),
       findActiveRemoteAttachmentForPane: vi.fn(() => undefined)
     }
@@ -584,7 +585,9 @@ describe('runRemoteOrcaCli', () => {
     )
 
     expect(result.exitCode).toBe(0)
-    expect(db.getCurrentRunForPane).toHaveBeenCalledWith('tab_ssh:leaf_ssh')
+    expect(db.getCurrentRunForCoordinator).toHaveBeenCalledWith(
+      expect.objectContaining({ paneKey: 'tab_ssh:leaf_ssh' })
+    )
     expect(db.getActiveDispatchForIdentity).toHaveBeenCalledWith(
       'term_stale_ssh',
       'tab_ssh:leaf_ssh'
@@ -608,7 +611,7 @@ describe('runRemoteOrcaCli', () => {
     )
 
     expect(result.exitCode).toBe(0)
-    expect(db.getCurrentRunForPane).not.toHaveBeenCalled()
+    expect(db.getCurrentRunForCoordinator).not.toHaveBeenCalled()
     expect(db.getActiveDispatchForIdentity).toHaveBeenCalledWith('term_legacy_worker', undefined)
   })
 
diff --git a/src/main/ssh/ssh-system-fallback.test.ts b/src/main/ssh/ssh-system-fallback.test.ts
index b477ad682ef..3212a44b6fb 100644
--- a/src/main/ssh/ssh-system-fallback.test.ts
+++ b/src/main/ssh/ssh-system-fallback.test.ts
@@ -880,14 +880,6 @@ describe('spawnSystemSsh', () => {
     vi.stubEnv('PATH', '')
     expect(() => spawnSystemSsh(createTarget())).toThrow('No system ssh binary found')
   })
-
-  it('returns a process wrapper with kill and onExit', () => {
-    const result = spawnSystemSsh(createTarget())
-
-    expect(result.pid).toBe(12345)
-    expect(typeof result.kill).toBe('function')
-    expect(typeof result.onExit).toBe('function')
-  })
 })
 
 describe('system SSH operation aborts', () => {
diff --git a/src/main/startup/browser-process-user-agent-ordering.test.ts b/src/main/startup/browser-process-user-agent-ordering.test.ts
index 5913890b5cf..ee14f1a8d3e 100644
--- a/src/main/startup/browser-process-user-agent-ordering.test.ts
+++ b/src/main/startup/browser-process-user-agent-ordering.test.ts
@@ -26,19 +26,36 @@ const mocks = vi.hoisted(() => {
       events.push('is-ready')
       return false
     }),
+    whenReady: vi.fn(() => Promise.resolve()),
     setName: vi.fn((name: string) => {
       events.push(`set-name:${name}`)
     })
   }
-  return { app, events, userAgent: () => userAgent }
+  return {
+    app,
+    events,
+    userAgent: () => userAgent,
+    showErrorBox: vi.fn(),
+    backgroundLaunch: vi.fn(() => true),
+    admission: vi.fn(),
+    lock: vi.fn(() => true),
+    afterIdentity: vi.fn((): void => {
+      throw new Error('preflight-test-stop')
+    }),
+    recoverMoves: vi.fn()
+  }
 })
 
 vi.mock('electron', () => ({
   app: mocks.app,
+  dialog: { showErrorBox: mocks.showErrorBox },
   ipcMain: {},
   powerMonitor: {},
   session: { defaultSession: {} }
 }))
+vi.mock('../window/foreground-activation-policy', () => ({
+  isBackgroundLaunch: mocks.backgroundLaunch
+}))
 vi.mock('@electron-toolkit/utils', () => ({ is: { dev: true } }))
 vi.mock('./cli-launch-redirect', () => ({
   maybeRedirectCliLaunch: () => ({ redirected: false, status: 0 })
@@ -83,10 +100,7 @@ vi.mock('./dev-instance-identity', () => ({
 }))
 vi.mock('./renderer-heap-headroom')
 vi.mock('./startup-diagnostics', () => ({
-  isStartupDiagnosticsEnabled: () => {
-    mocks.events.push('continued-after-browser-identity')
-    throw new Error('preflight-test-stop')
-  },
+  isStartupDiagnosticsEnabled: () => false,
   logStartupDiagnostic: vi.fn()
 }))
 vi.mock('./event-loop-stall-probe')
@@ -100,8 +114,11 @@ vi.mock('./serve-desktop-activation', () => ({
 }))
 vi.mock('./single-instance-lock', () => ({
   shouldBypassSingleInstanceLock: () => false,
-  shouldSkipSingleInstanceLock: () => true,
-  acquireSingleInstanceLock: vi.fn(),
+  shouldSkipSingleInstanceLock: () => false,
+  acquireSingleInstanceLock: () => {
+    mocks.events.push('single-instance-lock')
+    return mocks.lock()
+  },
   logSingleInstanceLockBypass: vi.fn(),
   logSingleInstanceLockFailure: vi.fn(),
   SINGLE_INSTANCE_ALREADY_RUNNING_EXIT_CODE: 1
@@ -109,7 +126,12 @@ vi.mock('./single-instance-lock', () => ({
 vi.mock('../../shared/app-environment', () => ({ setAppEnvironment: vi.fn() }))
 vi.mock('../host/electron-app-environment', () => ({ ElectronAppEnvironment: class {} }))
 vi.mock('../own-chromium-tree-kill-guard')
-vi.mock('../../shared/secret-store')
+vi.mock('../../shared/secret-store', () => ({
+  setSecretStore: () => {
+    mocks.events.push('continued-after-browser-identity')
+    mocks.afterIdentity()
+  }
+}))
 vi.mock('../host/electron-secret-store')
 vi.mock('../ipc/pty-host-bindings')
 vi.mock('../host/electron-runtime-desktop-surface')
@@ -127,9 +149,24 @@ vi.mock('../persistence', () => ({
   initDataPath: () => mocks.events.push('init-data-path'),
   getCanonicalUserDataPath: () => '/canonical-user-data'
 }))
+vi.mock('../persistence/profile-state/profile-state-access', () => ({
+  acquireProfileStateRuntimeAdmission: (root: string) => {
+    mocks.events.push(`admission:${root}`)
+    return mocks.admission()
+  }
+}))
 vi.mock('../macos-press-and-hold-default')
 vi.mock('../ai-vault/session-parse-cache-persistence')
-vi.mock('../orca-profiles/profile-index-store')
+vi.mock('../orca-profiles/profile-index-store', () => ({ initOrcaProfilePaths: vi.fn() }))
+vi.mock('../orca-profiles/profile-storage-paths', () => ({
+  getProfileUserDataPath: () => '/canonical-user-data'
+}))
+vi.mock('../orca-profiles/profile-project-move-intent', () => ({
+  recoverPendingProfileProjectMoves: mocks.recoverMoves
+}))
+vi.mock('../persistence/profile-state/profile-state-active-location', () => ({
+  getActiveProfileStateLocation: () => ({ profileId: 'active-profile' })
+}))
 vi.mock('../stats/collector')
 vi.mock('../claude-usage/store')
 vi.mock('../codex-usage/store')
@@ -163,23 +200,65 @@ vi.mock('../browser/browser-identity-mode-store', () => ({
 }))
 
 describe('browser process user-agent startup ordering', () => {
+  it('explains admission refusal before a desktop launch exits', async () => {
+    const { runMainProcessPreflight } = await import('./main-process-preflight')
+    const platform = vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+    mocks.backgroundLaunch.mockReturnValueOnce(false)
+    mocks.admission.mockImplementationOnce(() => {
+      throw new Error('Stop Orca and orcad before retrying profile recovery')
+    })
+    const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+    try {
+      expect(
+        runMainProcessPreflight({ focusExistingWindow: vi.fn(), requestDesktopActivation: vi.fn() })
+      ).toBe(false)
+      expect(mocks.showErrorBox).toHaveBeenCalledWith(
+        'Orca could not start',
+        expect.stringContaining('Stop Orca and orcad before retrying profile recovery')
+      )
+      expect(mocks.app.isReady).not.toHaveBeenCalled()
+    } finally {
+      error.mockRestore()
+      platform.mockRestore()
+      mocks.showErrorBox.mockClear()
+      mocks.events.length = 0
+    }
+  })
+
+  it('does not acquire profile admission for a duplicate launch', async () => {
+    const { runMainProcessPreflight } = await import('./main-process-preflight')
+    mocks.events.length = 0
+    mocks.lock.mockReturnValueOnce(false)
+    expect(
+      runMainProcessPreflight({ focusExistingWindow: vi.fn(), requestDesktopActivation: vi.fn() })
+    ).toBe(false)
+    expect(mocks.events).not.toContain('admission:/canonical-user-data')
+    expect(mocks.events).not.toContain('read-mode:/canonical-user-data')
+    expect(mocks.app.exit).toHaveBeenCalledWith(1)
+    mocks.events.length = 0
+  })
+
   it('executes after the dev app name and before later preflight work', async () => {
     const { getBrowserProcessUserAgentIdentity } =
       await import('../browser/browser-process-user-agent')
     const { runMainProcessPreflight } = await import('./main-process-preflight')
 
-    expect(() =>
+    expect(
       runMainProcessPreflight({
         focusExistingWindow: vi.fn(),
         requestDesktopActivation: vi.fn()
       })
-    ).toThrow('preflight-test-stop')
+    ).toBe(false)
 
     const nameIndex = mocks.events.indexOf('set-name:Orca Development')
     const modeIndex = mocks.events.indexOf('read-mode:/canonical-user-data')
     const writeIndex = mocks.events.indexOf('write-user-agent')
     const continuationIndex = mocks.events.indexOf('continued-after-browser-identity')
     expect(mocks.events.indexOf('init-data-path')).toBeLessThan(nameIndex)
+    expect(mocks.events.indexOf('init-data-path')).toBeLessThan(
+      mocks.events.indexOf('admission:/canonical-user-data')
+    )
+    expect(mocks.events.indexOf('admission:/canonical-user-data')).toBeLessThan(modeIndex)
     expect(nameIndex).toBeLessThan(modeIndex)
     expect(modeIndex).toBeLessThan(writeIndex)
     expect(writeIndex).toBeLessThan(continuationIndex)
@@ -191,4 +270,193 @@ describe('browser process user-agent startup ordering', () => {
     expect(mocks.userAgent()).not.toMatch(/Electron/)
     expect(mocks.userAgent()).not.toMatch(/Orca|Development/)
   })
+
+  it('exits without reading profile state or revealing a window when recovery holds admission', async () => {
+    const { runMainProcessPreflight } = await import('./main-process-preflight')
+    mocks.events.length = 0
+    mocks.admission.mockImplementationOnce(() => {
+      throw new Error('Profile recovery is in progress')
+    })
+    const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+    const focusExistingWindow = vi.fn()
+    const requestDesktopActivation = vi.fn()
+    try {
+      expect(runMainProcessPreflight({ focusExistingWindow, requestDesktopActivation })).toBe(false)
+      expect(mocks.app.exit).toHaveBeenCalledWith(1)
+      expect(mocks.events).toEqual([
+        'init-data-path',
+        'set-name:Orca Development',
+        'single-instance-lock',
+        'admission:/canonical-user-data'
+      ])
+      expect(focusExistingWindow).not.toHaveBeenCalled()
+      expect(requestDesktopActivation).not.toHaveBeenCalled()
+      expect(mocks.showErrorBox).not.toHaveBeenCalled()
+    } finally {
+      error.mockRestore()
+    }
+  })
+})
+
+it('exits and releases admission after pending profile move recovery fails', async () => {
+  const { resetBrowserProcessUserAgentForTests } =
+    await import('../browser/browser-process-user-agent')
+  resetBrowserProcessUserAgentForTests()
+  const release = vi.fn()
+  mocks.admission.mockReturnValueOnce({ release })
+  mocks.afterIdentity.mockImplementationOnce(() => undefined)
+  mocks.recoverMoves.mockImplementationOnce(() => {
+    throw new Error('unreadable move journal')
+  })
+  const { runMainProcessPreflight } = await import('./main-process-preflight')
+  expect(
+    runMainProcessPreflight({ focusExistingWindow: vi.fn(), requestDesktopActivation: vi.fn() })
+  ).toBe(false)
+  expect(mocks.recoverMoves).toHaveBeenCalledWith('/canonical-user-data', 'active-profile')
+  expect(release).toHaveBeenCalledOnce()
+  expect(mocks.app.exit).toHaveBeenCalledWith(1)
+})
+
+it('defers a Linux desktop startup failure until Electron is ready', async () => {
+  const { runMainProcessPreflight } = await import('./main-process-preflight')
+  const { resetBrowserProcessUserAgentForTests } =
+    await import('../browser/browser-process-user-agent')
+  resetBrowserProcessUserAgentForTests()
+  const release = vi.fn()
+  let resolveReady: (() => void) | undefined
+  const ready = new Promise<void>((resolve) => {
+    resolveReady = resolve
+  })
+  mocks.admission.mockReturnValueOnce({ release })
+  mocks.afterIdentity.mockImplementationOnce(() => {
+    throw new Error('Linux pre-ready failure')
+  })
+  mocks.app.whenReady.mockReturnValueOnce(ready)
+  mocks.app.exit.mockClear()
+  mocks.showErrorBox.mockClear()
+  const platform = vi.spyOn(process, 'platform', 'get').mockReturnValue('linux')
+  mocks.backgroundLaunch.mockReturnValueOnce(false)
+  const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+  try {
+    expect(
+      runMainProcessPreflight({ focusExistingWindow: vi.fn(), requestDesktopActivation: vi.fn() })
+    ).toBe(false)
+    expect(release).toHaveBeenCalledOnce()
+    expect(mocks.app.whenReady).toHaveBeenCalledOnce()
+    expect(mocks.showErrorBox).not.toHaveBeenCalled()
+    expect(mocks.app.exit).not.toHaveBeenCalled()
+
+    resolveReady?.()
+    await ready
+    await Promise.resolve()
+    expect(mocks.showErrorBox).toHaveBeenCalledWith(
+      'Orca could not start',
+      expect.stringContaining('Linux pre-ready failure')
+    )
+    expect(mocks.app.exit).toHaveBeenCalledWith(1)
+  } finally {
+    error.mockRestore()
+    platform.mockRestore()
+    mocks.app.whenReady.mockClear()
+  }
+})
+
+it('exits after a Linux desktop readiness rejection without showing a dialog', async () => {
+  const { runMainProcessPreflight } = await import('./main-process-preflight')
+  const { resetBrowserProcessUserAgentForTests } =
+    await import('../browser/browser-process-user-agent')
+  resetBrowserProcessUserAgentForTests()
+  const release = vi.fn()
+  let rejectReady!: (error: Error) => void
+  const ready = new Promise<void>((_resolve, reject) => {
+    rejectReady = reject
+  })
+  mocks.admission.mockReturnValueOnce({ release })
+  mocks.afterIdentity.mockImplementationOnce(() => {
+    throw new Error('Linux pre-ready failure')
+  })
+  mocks.app.whenReady.mockReturnValueOnce(ready)
+  mocks.app.exit.mockClear()
+  mocks.showErrorBox.mockClear()
+  const platform = vi.spyOn(process, 'platform', 'get').mockReturnValue('linux')
+  mocks.backgroundLaunch.mockReturnValueOnce(false)
+  const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+  try {
+    expect(
+      runMainProcessPreflight({ focusExistingWindow: vi.fn(), requestDesktopActivation: vi.fn() })
+    ).toBe(false)
+    expect(release).toHaveBeenCalledOnce()
+    rejectReady(new Error('Electron readiness failed'))
+    await ready.catch(() => undefined)
+    await Promise.resolve()
+    expect(mocks.showErrorBox).not.toHaveBeenCalled()
+    expect(mocks.app.exit).toHaveBeenCalledWith(1)
+  } finally {
+    error.mockRestore()
+    platform.mockRestore()
+    mocks.app.whenReady.mockClear()
+  }
+})
+
+it('keeps Linux background startup failures console-only and immediate', async () => {
+  const { runMainProcessPreflight } = await import('./main-process-preflight')
+  const { resetBrowserProcessUserAgentForTests } =
+    await import('../browser/browser-process-user-agent')
+  resetBrowserProcessUserAgentForTests()
+  const release = vi.fn()
+  mocks.admission.mockReturnValueOnce({ release })
+  mocks.afterIdentity.mockImplementationOnce(() => {
+    throw new Error('Linux background failure')
+  })
+  mocks.app.whenReady.mockClear()
+  mocks.app.exit.mockClear()
+  mocks.showErrorBox.mockClear()
+  const platform = vi.spyOn(process, 'platform', 'get').mockReturnValue('linux')
+  mocks.backgroundLaunch.mockReturnValueOnce(true)
+  const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+  try {
+    expect(
+      runMainProcessPreflight({ focusExistingWindow: vi.fn(), requestDesktopActivation: vi.fn() })
+    ).toBe(false)
+    expect(release).toHaveBeenCalledOnce()
+    expect(mocks.app.whenReady).not.toHaveBeenCalled()
+    expect(mocks.showErrorBox).not.toHaveBeenCalled()
+    expect(mocks.app.exit).toHaveBeenCalledWith(1)
+  } finally {
+    error.mockRestore()
+    platform.mockRestore()
+  }
+})
+
+it('keeps Linux serve startup failures console-only and immediate', async () => {
+  const { runMainProcessPreflight } = await import('./main-process-preflight')
+  const { resetBrowserProcessUserAgentForTests } =
+    await import('../browser/browser-process-user-agent')
+  resetBrowserProcessUserAgentForTests()
+  const release = vi.fn()
+  const originalArgv = process.argv
+  process.argv = originalArgv.includes('--serve') ? [...originalArgv] : [...originalArgv, '--serve']
+  mocks.admission.mockReturnValueOnce({ release })
+  mocks.afterIdentity.mockImplementationOnce(() => {
+    throw new Error('Linux serve failure')
+  })
+  mocks.app.whenReady.mockClear()
+  mocks.app.exit.mockClear()
+  mocks.showErrorBox.mockClear()
+  const platform = vi.spyOn(process, 'platform', 'get').mockReturnValue('linux')
+  mocks.backgroundLaunch.mockReturnValueOnce(false)
+  const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+  try {
+    expect(
+      runMainProcessPreflight({ focusExistingWindow: vi.fn(), requestDesktopActivation: vi.fn() })
+    ).toBe(false)
+    expect(release).toHaveBeenCalledOnce()
+    expect(mocks.app.whenReady).not.toHaveBeenCalled()
+    expect(mocks.showErrorBox).not.toHaveBeenCalled()
+    expect(mocks.app.exit).toHaveBeenCalledWith(1)
+  } finally {
+    error.mockRestore()
+    platform.mockRestore()
+    process.argv = originalArgv
+  }
 })
diff --git a/src/main/startup/cli-command-names.ts b/src/main/startup/cli-command-names.ts
index 0c001b74f44..22d90947ced 100644
--- a/src/main/startup/cli-command-names.ts
+++ b/src/main/startup/cli-command-names.ts
@@ -48,6 +48,7 @@ export const CLI_COMMAND_NAMES = [
   'open-url',
   'orchestration',
   'pdf',
+  'profile',
   'project',
   'reload',
   'repo',
diff --git a/src/main/startup/codex-launch-per-agent-hook-opt-out.test.ts b/src/main/startup/codex-launch-per-agent-hook-opt-out.test.ts
new file mode 100644
index 00000000000..9191fb1666b
--- /dev/null
+++ b/src/main/startup/codex-launch-per-agent-hook-opt-out.test.ts
@@ -0,0 +1,189 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { GlobalSettings } from '../../shared/global-settings-types'
+import type { VerifiedCodexResumeSource } from '../codex/codex-session-resume-preparation'
+
+/**
+ * Turning Codex off in the per-agent hook settings removes Orca's Codex hook
+ * entry. Launch prep and session resume must read that same opt-out, or the
+ * next Codex launch writes the entry straight back.
+ */
+const SYSTEM_HOME = '/home/user/.codex'
+const ACCOUNT_HOME = '/accounts/one/.codex'
+
+const mocks = vi.hoisted(() => {
+  const settings: Partial<GlobalSettings> = {}
+  return {
+    settings,
+    prepareForCodexLaunchAsync: vi.fn(async (): Promise<string | null> => null),
+    isHostSystemDefaultRealHomeSelected: vi.fn(() => false),
+    prepareRuntimeHomeForLaunch: vi.fn(async () => ({ state: 'ok' as const })),
+    installForLaunchPrep: vi.fn(async () => {}),
+    refreshRuntimeUserHooksForLaunchPrep: vi.fn(async () => {}),
+    ensureRealHomeCodexHookState: vi.fn(async () => 'installed' as const),
+    prepareCodexSessionResume: vi.fn()
+  }
+})
+
+vi.mock('electron', () => ({ app: { getPath: vi.fn(() => '/tmp/orca-user-data') } }))
+vi.mock('../agent-trust-presets', () => ({ markCodexProjectTrusted: vi.fn(async () => {}) }))
+vi.mock('../codex/hook-service', () => ({
+  codexHookService: {
+    prepareRuntimeHomeForLaunch: mocks.prepareRuntimeHomeForLaunch,
+    installForLaunchPrep: mocks.installForLaunchPrep,
+    refreshRuntimeUserHooksForLaunchPrep: mocks.refreshRuntimeUserHooksForLaunchPrep
+  }
+}))
+vi.mock('../codex/codex-real-home-hook-install', () => ({
+  ensureRealHomeCodexHookState: mocks.ensureRealHomeCodexHookState
+}))
+// Why: the real predicate, without loading every agent's hook service.
+vi.mock(
+  '../agent-hooks/managed-agent-hook-controls',
+  async () => await import('../../shared/agent-status-hooks-setting')
+)
+vi.mock('../wsl', () => ({ getDefaultWslDistro: () => 'Ubuntu' }))
+vi.mock('../codex/codex-home-paths', () => ({
+  getSystemCodexHomePath: () => SYSTEM_HOME,
+  getOrcaManagedCodexHomePath: () => '/managed/.codex'
+}))
+vi.mock('../codex/codex-session-resume-preparation', () => ({
+  prepareCodexSessionResume: mocks.prepareCodexSessionResume
+}))
+vi.mock('../codex/codex-legacy-session-resume', () => ({
+  prepareLegacySharedCodexSessionResume: vi.fn(async () => ({ useRealCodexHome: false }))
+}))
+vi.mock('./main-process-state', () => ({
+  mainProcessState: {
+    codexRuntimeHome: {
+      prepareForCodexLaunchAsync: mocks.prepareForCodexLaunchAsync,
+      isHostSystemDefaultRealHomeSelected: mocks.isHostSystemDefaultRealHomeSelected,
+      isHostSystemDefaultRealHome: () => false,
+      getHostCodexHomePathsForSessionDiscovery: () => [],
+      resolveSelectedHostAccountCodexHomePathForResume: () => null
+    },
+    store: { getSettings: () => mocks.settings }
+  }
+}))
+
+import { prepareCodexRuntimeHomeForLaunch } from './codex-launch-preparation'
+import { prepareCodexSessionResumeForLaunch } from './codex-session-resume-launch'
+
+const HOOK_SETTINGS: readonly {
+  name: string
+  settings: Partial<GlobalSettings>
+  codexHooksOn: boolean
+}[] = [
+  {
+    name: 'Codex turned off per agent',
+    settings: { agentStatusHooksEnabled: true, disabledTuiAgents: ['codex'] },
+    codexHooksOn: false
+  },
+  {
+    name: 'every agent on',
+    settings: { agentStatusHooksEnabled: true, disabledTuiAgents: [] },
+    codexHooksOn: true
+  },
+  {
+    name: 'another agent turned off',
+    settings: { agentStatusHooksEnabled: true, disabledTuiAgents: ['claude'] },
+    codexHooksOn: true
+  },
+  {
+    name: 'the global switch off',
+    settings: { agentStatusHooksEnabled: false, disabledTuiAgents: [] },
+    codexHooksOn: false
+  }
+]
+
+function resumeFrom(homePath: string): Promise<unknown> {
+  mocks.prepareCodexSessionResume.mockImplementation(
+    async (args: {
+      resolveVerifiedResumeHome: (source: VerifiedCodexResumeSource) => Promise<string>
+    }) => {
+      const codexHomePath = await args.resolveVerifiedResumeHome({
+        homePath,
+        transcriptPath: `${homePath}/sessions/abc.jsonl`
+      })
+      return { outcome: 'resume' as const, codexHomePath, sessionId: 'abc' }
+    }
+  )
+  return prepareCodexSessionResumeForLaunch({
+    providerSession: { key: 'session_id', id: 'abc' },
+    target: { runtime: 'host' }
+  })
+}
+
+describe('Codex launch prep honours the per-agent hook opt-out', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.isHostSystemDefaultRealHomeSelected.mockReturnValue(false)
+    mocks.prepareForCodexLaunchAsync.mockResolvedValue(null)
+  })
+
+  it.each(HOOK_SETTINGS)(
+    'real ~/.codex launch with $name: hooks on = $codexHooksOn',
+    async ({ settings, codexHooksOn }) => {
+      mocks.settings = settings
+      mocks.isHostSystemDefaultRealHomeSelected.mockReturnValue(true)
+
+      await expect(prepareCodexRuntimeHomeForLaunch()).resolves.toBeNull()
+
+      expect(mocks.ensureRealHomeCodexHookState).toHaveBeenCalledTimes(1)
+      expect(mocks.ensureRealHomeCodexHookState).toHaveBeenCalledWith(
+        expect.objectContaining({ hooksEnabled: codexHooksOn })
+      )
+      expect(mocks.prepareRuntimeHomeForLaunch).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(HOOK_SETTINGS)(
+    'managed account home launch with $name: hooks on = $codexHooksOn',
+    async ({ settings, codexHooksOn }) => {
+      mocks.settings = settings
+      mocks.prepareForCodexLaunchAsync.mockResolvedValue(ACCOUNT_HOME)
+
+      await expect(prepareCodexRuntimeHomeForLaunch()).resolves.toBe(ACCOUNT_HOME)
+
+      expect(mocks.ensureRealHomeCodexHookState).not.toHaveBeenCalled()
+      expect(mocks.prepareRuntimeHomeForLaunch).toHaveBeenCalledWith(
+        ACCOUNT_HOME,
+        undefined,
+        codexHooksOn
+      )
+    }
+  )
+
+  it.each(HOOK_SETTINGS)(
+    'resume into the real ~/.codex with $name: hooks on = $codexHooksOn',
+    async ({ settings, codexHooksOn }) => {
+      mocks.settings = settings
+
+      await resumeFrom(SYSTEM_HOME)
+
+      expect(mocks.ensureRealHomeCodexHookState).toHaveBeenCalledTimes(1)
+      expect(mocks.ensureRealHomeCodexHookState).toHaveBeenCalledWith(
+        expect.objectContaining({ hooksEnabled: codexHooksOn })
+      )
+      expect(mocks.installForLaunchPrep).not.toHaveBeenCalled()
+      expect(mocks.refreshRuntimeUserHooksForLaunchPrep).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(HOOK_SETTINGS)(
+    'resume into a managed account home with $name: hooks on = $codexHooksOn',
+    async ({ settings, codexHooksOn }) => {
+      mocks.settings = settings
+
+      await resumeFrom(ACCOUNT_HOME)
+
+      expect(mocks.ensureRealHomeCodexHookState).not.toHaveBeenCalled()
+      if (codexHooksOn) {
+        expect(mocks.installForLaunchPrep).toHaveBeenCalledWith(ACCOUNT_HOME)
+        expect(mocks.refreshRuntimeUserHooksForLaunchPrep).not.toHaveBeenCalled()
+      } else {
+        expect(mocks.installForLaunchPrep).not.toHaveBeenCalled()
+        expect(mocks.refreshRuntimeUserHooksForLaunchPrep).toHaveBeenCalledWith(ACCOUNT_HOME)
+      }
+    }
+  )
+})
diff --git a/src/main/startup/codex-launch-preparation.ts b/src/main/startup/codex-launch-preparation.ts
index 3b94c00b11d..06e61c18836 100644
--- a/src/main/startup/codex-launch-preparation.ts
+++ b/src/main/startup/codex-launch-preparation.ts
@@ -1,10 +1,9 @@
 import { app } from 'electron'
 import type { CodexHomeLaunchContext } from '../ipc/pty'
 import type { CodexAccountSelectionTarget } from '../codex-accounts/runtime-selection'
-import { markCodexProjectTrusted } from '../agent-trust-presets'
 import { codexHookService } from '../codex/hook-service'
 import { getDefaultWslDistro } from '../wsl'
-import { isAgentStatusHooksEnabled } from '../agent-hooks/managed-agent-hook-controls'
+import { isAgentStatusHooksEnabledForAgent } from '../agent-hooks/managed-agent-hook-controls'
 import { ensureRealHomeCodexHookState } from '../codex/codex-real-home-hook-install'
 import { mainProcessState as state } from './main-process-state'
 
@@ -17,18 +16,6 @@ export async function prepareCodexRuntimeHomeForLaunch(
   if (!runtimeHome) {
     throw new Error('Codex runtime home service is not initialized')
   }
-  if (
-    target?.runtime !== 'wsl' &&
-    launchContext?.launchAgent === 'codex' &&
-    launchContext.workspacePath
-  ) {
-    try {
-      // Why: renderer quick-launch cannot await trust IPC before its PTY mounts; launch prep runs before every recognized Codex spawn.
-      await markCodexProjectTrusted(launchContext.workspacePath)
-    } catch (error) {
-      console.warn('[codex-project-trust] failed to pre-mark launch workspace:', error)
-    }
-  }
   const ensureRealHomeHooksIfSelected = async (): Promise<boolean> => {
     if (target?.runtime === 'wsl' || !runtimeHome.isHostSystemDefaultRealHomeSelected(launchEnv)) {
       return false
@@ -38,7 +25,7 @@ export async function prepareCodexRuntimeHomeForLaunch(
     // the pane spawns. An incapable grant flips the lane gate so the launch
     // below falls back to the managed home instead of a status-blind pane.
     await ensureRealHomeCodexHookState({
-      hooksEnabled: isAgentStatusHooksEnabled(state.store?.getSettings()),
+      hooksEnabled: isAgentStatusHooksEnabledForAgent(state.store?.getSettings(), 'codex'),
       userDataPath: app.getPath('userData')
     })
     return true
@@ -70,7 +57,7 @@ export async function prepareCodexRuntimeHomeForLaunch(
     target?.runtime === 'wsl'
       ? { runtime: 'wsl' as const, wslDistro: target.wslDistro?.trim() || getDefaultWslDistro() }
       : target
-  const hooksEnabled = isAgentStatusHooksEnabled(state.store?.getSettings())
+  const hooksEnabled = isAgentStatusHooksEnabledForAgent(state.store?.getSettings(), 'codex')
   try {
     // Why: honor the persisted off switch so post-startup launches can't reinstall removed hooks.
     const status = await codexHookService.prepareRuntimeHomeForLaunch(
diff --git a/src/main/startup/codex-session-resume-daemon-guard.test.ts b/src/main/startup/codex-session-resume-daemon-guard.test.ts
new file mode 100644
index 00000000000..4ac5b2fdabb
--- /dev/null
+++ b/src/main/startup/codex-session-resume-daemon-guard.test.ts
@@ -0,0 +1,143 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { VerifiedCodexResumeSource } from '../codex/codex-session-resume-preparation'
+import {
+  CODEX_DAEMON_OVERRIDE_MARKER,
+  codexDaemonSocketPathExceedsLimit
+} from '../codex/codex-daemon-socket-path-guard'
+
+const mocks = vi.hoisted(() => ({
+  hooksEnabled: false,
+  systemHomePath: '',
+  sharedHomePath: '',
+  installForLaunchPrep: vi.fn(),
+  refreshRuntimeUserHooksForLaunchPrep: vi.fn(),
+  ensureRealHomeCodexHookState: vi.fn(async () => {}),
+  prepareCodexSessionResume: vi.fn(),
+  prepareLegacySharedCodexSessionResume: vi.fn()
+}))
+
+vi.mock('electron', () => ({ app: { getPath: vi.fn(() => '/tmp/orca-user-data') } }))
+vi.mock('../codex/hook-service', () => ({
+  codexHookService: {
+    installForLaunchPrep: mocks.installForLaunchPrep,
+    refreshRuntimeUserHooksForLaunchPrep: mocks.refreshRuntimeUserHooksForLaunchPrep
+  }
+}))
+vi.mock('../codex/codex-real-home-hook-install', () => ({
+  ensureRealHomeCodexHookState: mocks.ensureRealHomeCodexHookState
+}))
+vi.mock('../agent-hooks/managed-agent-hook-controls', () => ({
+  isAgentStatusHooksEnabledForAgent: () => mocks.hooksEnabled
+}))
+vi.mock('../codex/codex-home-paths', async (importOriginal) => ({
+  ...(await importOriginal<object>()),
+  getSystemCodexHomePath: () => mocks.systemHomePath,
+  getOrcaManagedCodexHomePath: () => mocks.sharedHomePath
+}))
+vi.mock('../codex/codex-session-resume-preparation', () => ({
+  prepareCodexSessionResume: mocks.prepareCodexSessionResume
+}))
+vi.mock('../codex/codex-legacy-session-resume', () => ({
+  prepareLegacySharedCodexSessionResume: mocks.prepareLegacySharedCodexSessionResume
+}))
+vi.mock('./main-process-state', () => ({
+  mainProcessState: {
+    codexRuntimeHome: {
+      isHostSystemDefaultRealHome: () => false,
+      getHostCodexHomePathsForSessionDiscovery: () => [],
+      resolveSelectedHostAccountCodexHomePathForResume: () => null
+    },
+    store: { getSettings: () => ({}) }
+  }
+}))
+
+import { prepareCodexSessionResumeForLaunch } from './codex-session-resume-launch'
+
+// Why: long enough that the daemon socket overflows sun_path on every host OS.
+const LONG_SEGMENT = 'a'.repeat(60)
+
+describe('Codex session resume daemon socket guard', () => {
+  let root: string
+  let accountHome: string
+  let warn: ReturnType<typeof vi.spyOn>
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    root = mkdtempSync(join(tmpdir(), 'orca-resume-guard-'))
+    accountHome = join(root, 'codex-accounts', LONG_SEGMENT, 'home')
+    mocks.systemHomePath = join(root, 'system', LONG_SEGMENT, '.codex')
+    mocks.sharedHomePath = join(root, 'codex-runtime-home', 'home')
+    for (const home of [accountHome, mocks.systemHomePath, mocks.sharedHomePath]) {
+      mkdirSync(home, { recursive: true })
+    }
+    mocks.hooksEnabled = false
+    mocks.prepareLegacySharedCodexSessionResume.mockResolvedValue({ useRealCodexHome: false })
+    mocks.prepareCodexSessionResume.mockImplementation(
+      async (args: {
+        resolveVerifiedResumeHome: (source: VerifiedCodexResumeSource) => Promise<string>
+      }) => ({
+        outcome: 'resume' as const,
+        codexHomePath: await args.resolveVerifiedResumeHome({
+          homePath: accountHome,
+          transcriptPath: join(accountHome, 'sessions', 'abc.jsonl')
+        })
+      })
+    )
+    warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+  })
+
+  afterEach(() => {
+    warn.mockRestore()
+    rmSync(root, { recursive: true, force: true })
+  })
+
+  function resume(): ReturnType<typeof prepareCodexSessionResumeForLaunch> {
+    return prepareCodexSessionResumeForLaunch({
+      providerSession: { key: 'session_id', id: 'abc' },
+      target: { runtime: 'host' }
+    })
+  }
+
+  it('guards the resumed account home when hook repair fails before mirroring config', async () => {
+    expect(codexDaemonSocketPathExceedsLimit(accountHome)).toBe(true)
+    writeFileSync(join(accountHome, 'config.toml'), 'model = "gpt-5"\n', 'utf-8')
+    mocks.hooksEnabled = true
+    mocks.installForLaunchPrep.mockRejectedValue(new Error('Could not parse Codex hooks.json'))
+
+    const preparation = await resume()
+
+    expect(preparation).toMatchObject({ outcome: 'resume', codexHomePath: accountHome })
+    const config = readFileSync(join(accountHome, 'config.toml'), 'utf-8')
+    expect(config).toContain('model = "gpt-5"')
+    expect(config).toContain(`daemon_auto_start = false ${CODEX_DAEMON_OVERRIDE_MARKER}`)
+  })
+
+  it('guards the resumed account home when hooks are off and the refresh returns early', async () => {
+    mocks.refreshRuntimeUserHooksForLaunchPrep.mockResolvedValue({
+      agent: 'codex',
+      state: 'error',
+      detail: 'Could not read system Codex hooks.json'
+    })
+
+    await resume()
+
+    expect(mocks.refreshRuntimeUserHooksForLaunchPrep).toHaveBeenCalledWith(accountHome)
+    expect(readFileSync(join(accountHome, 'config.toml'), 'utf-8')).toContain(
+      `daemon_auto_start = false ${CODEX_DAEMON_OVERRIDE_MARKER}`
+    )
+  })
+
+  it('never writes the guard into the real Codex home a migrated resume runs in', async () => {
+    expect(codexDaemonSocketPathExceedsLimit(mocks.systemHomePath)).toBe(true)
+    mocks.prepareLegacySharedCodexSessionResume.mockResolvedValue({ useRealCodexHome: true })
+
+    const preparation = await resume()
+
+    expect(preparation).toMatchObject({ codexHomePath: mocks.systemHomePath })
+    expect(mocks.ensureRealHomeCodexHookState).toHaveBeenCalledTimes(1)
+    expect(existsSync(join(mocks.systemHomePath, 'config.toml'))).toBe(false)
+  })
+})
diff --git a/src/main/startup/codex-session-resume-launch.ts b/src/main/startup/codex-session-resume-launch.ts
index c537c4f75ef..a827ce2849f 100644
--- a/src/main/startup/codex-session-resume-launch.ts
+++ b/src/main/startup/codex-session-resume-launch.ts
@@ -7,8 +7,8 @@ import { prepareLegacySharedCodexSessionResume } from '../codex/codex-legacy-ses
 import { ManagedCodexHomeTemporarilyUnavailableError } from '../codex-accounts/host-codex-managed-home-ownership'
 import { codexHookService } from '../codex/hook-service'
 import { ensureRealHomeCodexHookState } from '../codex/codex-real-home-hook-install'
-import { isAgentStatusHooksEnabled } from '../agent-hooks/managed-agent-hook-controls'
-import { markCodexProjectTrusted } from '../agent-trust-presets'
+import { ensureCodexDaemonSocketGuard } from '../codex/codex-config-mirror'
+import { isAgentStatusHooksEnabledForAgent } from '../agent-hooks/managed-agent-hook-controls'
 import { getOrcaManagedCodexHomePath, getSystemCodexHomePath } from '../codex/codex-home-paths'
 import { normalizeRuntimePathForComparison } from '../../shared/cross-platform-path'
 import { mainProcessState as state } from './main-process-state'
@@ -17,7 +17,6 @@ export async function prepareCodexSessionResumeForLaunch(args: {
   providerSession: AgentProviderSessionMetadata
   target: CodexAccountSelectionTarget
   launchEnv?: NodeJS.ProcessEnv
-  workspacePath?: string
 }): Promise<CodexSessionResumePreparation | null> {
   const runtimeHome = state.codexRuntimeHome
   const store = state.store
@@ -35,7 +34,7 @@ export async function prepareCodexSessionResumeForLaunch(args: {
   // readable alias wins. A throw here refuses the whole resume instead
   // (#STA-4422).
   const selectedAccountCodexHome = runtimeHome.resolveSelectedHostAccountCodexHomePathForResume()
-  // Why: a `fresh` outcome must skip migration, trust and hook repair entirely — there is
+  // Why: a `fresh` outcome must skip migration and hook repair entirely — there is
   // no verified origin home to prepare, so the PTY layer drops the resume argv (#10793).
   const preparation = await prepareCodexSessionResume({
     sessionId: args.providerSession.id,
@@ -80,17 +79,10 @@ export async function prepareCodexSessionResumeForLaunch(args: {
         )
       }
       const resumeHome = migrated.useRealCodexHome ? systemHomePath : sessionSource.homePath
-      if (args.workspacePath) {
-        try {
-          await markCodexProjectTrusted(args.workspacePath)
-        } catch (error) {
-          console.warn('[codex-project-trust] failed to pre-mark resumed workspace:', error)
-        }
-      }
       const isSystemHome =
         normalizeRuntimePathForComparison(resumeHome) ===
         normalizeRuntimePathForComparison(systemHomePath)
-      const hooksEnabled = isAgentStatusHooksEnabled(store.getSettings())
+      const hooksEnabled = isAgentStatusHooksEnabledForAgent(store.getSettings(), 'codex')
       try {
         if (isSystemHome) {
           await ensureRealHomeCodexHookState({
@@ -106,6 +98,10 @@ export async function prepareCodexSessionResumeForLaunch(args: {
         // Why: hook repair is best-effort; session provenance must still win over the currently selected home.
         console.warn('[codex-hook-service] failed to prepare automatic resume home:', error)
       }
+      if (!isSystemHome) {
+        // Why: this pins the resumed pane's CODEX_HOME, and hook repair above can skip or fail before its config mirror applies the daemon guard.
+        ensureCodexDaemonSocketGuard(resumeHome)
+      }
       return resumeHome
     }
   })
diff --git a/src/main/startup/configure-process-profile-state.test.ts b/src/main/startup/configure-process-profile-state.test.ts
new file mode 100644
index 00000000000..08db1989c61
--- /dev/null
+++ b/src/main/startup/configure-process-profile-state.test.ts
@@ -0,0 +1,46 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: vi.fn(() => ''),
+    quit: vi.fn(),
+    exit: vi.fn(),
+    isPackaged: false,
+    disableHardwareAcceleration: vi.fn(),
+    commandLine: { appendSwitch: vi.fn(), getSwitchValue: vi.fn(() => '') }
+  }
+}))
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+describe('pre-ready profile-state recovery boundary', () => {
+  it('ignores a matching marker when SQLite is missing but an export remains', async () => {
+    const { shouldDisableHttp2ForElectronNetworking } = await import('./configure-process')
+    const { writeHttp1CompatibilityMarker } = await import('./http1-compatibility-marker')
+    const { profileStateJsonExportPath } =
+      await import('../persistence/profile-state/legacy-json/profile-state-export-path')
+    const userDataPath = mkdtempSync(join(tmpdir(), 'orca-http1-profile-'))
+    temporaryDirectories.push(userDataPath)
+    const profileDirectory = join(userDataPath, 'profiles', 'profile-b')
+    mkdirSync(profileDirectory, { recursive: true })
+    writeFileSync(
+      join(userDataPath, 'orca-profile-index.json'),
+      JSON.stringify({ activeProfileId: 'profile-b', profiles: [{ id: 'profile-b' }] })
+    )
+    const dataFile = join(profileDirectory, 'orca-data.json')
+    writeFileSync(dataFile, JSON.stringify({ settings: { electronHttp1CompatibilityMode: true } }))
+    writeHttp1CompatibilityMarker(userDataPath, true, 'profile-b')
+    writeFileSync(profileStateJsonExportPath(dataFile, 7), '{}')
+
+    expect(shouldDisableHttp2ForElectronNetworking({ env: {}, userDataPath })).toBe(false)
+  })
+})
diff --git a/src/main/startup/configure-process.test.ts b/src/main/startup/configure-process.test.ts
index 7d7e2b0cc1a..70747c926f4 100644
--- a/src/main/startup/configure-process.test.ts
+++ b/src/main/startup/configure-process.test.ts
@@ -1,4 +1,4 @@
-import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { homedir, tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -420,6 +420,22 @@ describe('configureElectronNetworkCompatibility', () => {
     return userDataPath
   }
 
+  function createProfileState(
+    userDataPath: string,
+    profileId: string,
+    settings: Record<string, unknown>
+  ): string {
+    const profileDirectory = join(userDataPath, 'profiles', profileId)
+    mkdirSync(profileDirectory, { recursive: true })
+    writeFileSync(
+      join(userDataPath, 'orca-profile-index.json'),
+      JSON.stringify({ activeProfileId: profileId, profiles: [{ id: profileId }] }),
+      'utf-8'
+    )
+    writeFileSync(join(profileDirectory, 'orca-data.json'), JSON.stringify({ settings }), 'utf-8')
+    return profileDirectory
+  }
+
   afterEach(() => {
     for (const dir of tempDirs.splice(0)) {
       rmSync(dir, { recursive: true, force: true })
@@ -504,6 +520,40 @@ describe('configureElectronNetworkCompatibility', () => {
     ).toBe(false)
   })
 
+  it('scopes a profile marker to the active profile before trusting it', async () => {
+    const { shouldDisableHttp2ForElectronNetworking } = await import('./configure-process')
+    const { writeHttp1CompatibilityMarker } = await import('./http1-compatibility-marker')
+    const userDataPath = mkdtempSync(join(tmpdir(), 'orca-http1-profile-'))
+    tempDirs.push(userDataPath)
+    createProfileState(userDataPath, 'profile-b', { electronHttp1CompatibilityMode: false })
+    writeHttp1CompatibilityMarker(userDataPath, true, 'profile-a')
+
+    expect(shouldDisableHttp2ForElectronNetworking({ env: {}, userDataPath })).toBe(false)
+  })
+
+  it('uses a matching profile marker even when the legacy JSON is stale', async () => {
+    const { shouldDisableHttp2ForElectronNetworking } = await import('./configure-process')
+    const { writeHttp1CompatibilityMarker } = await import('./http1-compatibility-marker')
+    const userDataPath = mkdtempSync(join(tmpdir(), 'orca-http1-profile-'))
+    tempDirs.push(userDataPath)
+    createProfileState(userDataPath, 'profile-b', { electronHttp1CompatibilityMode: false })
+    writeHttp1CompatibilityMarker(userDataPath, true, 'profile-b')
+
+    expect(shouldDisableHttp2ForElectronNetworking({ env: {}, userDataPath })).toBe(true)
+  })
+
+  it('fails closed when a profile database exists without a trusted marker', async () => {
+    const { shouldDisableHttp2ForElectronNetworking } = await import('./configure-process')
+    const userDataPath = mkdtempSync(join(tmpdir(), 'orca-http1-profile-'))
+    tempDirs.push(userDataPath)
+    const profileDirectory = createProfileState(userDataPath, 'profile-b', {
+      electronHttp1CompatibilityMode: true
+    })
+    writeFileSync(join(profileDirectory, 'profile-state.db'), 'sqlite-present', 'utf-8')
+
+    expect(shouldDisableHttp2ForElectronNetworking({ env: {}, userDataPath })).toBe(false)
+  })
+
   it('appends Electron disable-http2 before sessions are created', async () => {
     const { app } = await import('electron')
     const { configureElectronNetworkCompatibility } = await import('./configure-process')
@@ -892,39 +942,6 @@ describe('safe graphics mode startup switches', () => {
     )
   })
 
-  // Why: the defect was the call site, not the switch — a win32 safe-graphics launch runs
-  // `if (!gpuFallbackActiveThisLaunch) enableMainProcessGpuFeatures()` and skips everything
-  // parked inside it, so only an unconditional call site reaches the users a GPU crash already hit.
-  it('calls the throttling opt-out outside the GPU-fallback gate in preflight', () => {
-    const mainSource = readFileSync(join(__dirname, 'main-process-preflight.ts'), 'utf8')
-    const gateStart = mainSource.indexOf('if (!state.gpuFallbackActiveThisLaunch) {')
-    expect(gateStart).toBeGreaterThanOrEqual(0)
-    const gateEnd = mainSource.indexOf('\n  }', gateStart)
-    expect(gateEnd).toBeGreaterThan(gateStart)
-
-    expect(mainSource.match(/\boptOutOfHiddenPageWakeUpThrottling\(\)/g)).toHaveLength(1)
-    expect(mainSource.slice(gateStart, gateEnd)).not.toContain('optOutOfHiddenPageWakeUpThrottling')
-  })
-
-  // Why: Chromium consumes the command line at ready, so this must stay in the pre-ready
-  // top-level block and never move into the whenReady callback, where appendSwitch is a silent
-  // no-op — the same invisible failure as parking it behind the GPU gate.
-  it('appends the throttling opt-out before app ready in preflight', () => {
-    const mainSource = readFileSync(join(__dirname, 'main-process-preflight.ts'), 'utf8')
-    const entrySource = readFileSync(join(__dirname, '..', 'index.ts'), 'utf8')
-    const preflightEnd = mainSource.indexOf('\n  return true')
-    const readyStart = entrySource.indexOf('void app.whenReady()')
-    const preflightCall = entrySource.indexOf('runMainProcessPreflight({')
-    expect(preflightEnd).toBeGreaterThan(0)
-    expect(readyStart).toBeGreaterThan(0)
-    expect(preflightCall).toBeGreaterThanOrEqual(0)
-    expect(preflightCall).toBeLessThan(readyStart)
-
-    const callIndex = mainSource.indexOf('optOutOfHiddenPageWakeUpThrottling()')
-    expect(callIndex).toBeGreaterThan(0)
-    expect(callIndex).toBeLessThan(preflightEnd)
-  })
-
   // Why: Chromium enables IntensiveWakeUpThrottling on every desktop platform, so the opt-out
   // must never become reachable only through the GPU-feature path again.
   it('does not couple the throttling opt-out to GPU feature setup', async () => {
diff --git a/src/main/startup/configure-process.ts b/src/main/startup/configure-process.ts
index 13dbd70c2c3..95e1df91337 100644
--- a/src/main/startup/configure-process.ts
+++ b/src/main/startup/configure-process.ts
@@ -1,11 +1,16 @@
 import { app } from 'electron'
-import { existsSync, mkdirSync, readFileSync } from 'node:fs'
+import { mkdirSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join, resolve } from 'node:path'
 import { getVersionManagerBinPaths } from '../codex-cli/command'
 import { getMainE2EConfig } from '../e2e-config'
 import { DISABLED_CHROMIUM_FEATURES } from './disabled-chromium-features'
 import { readHttp1CompatibilityMarker } from './http1-compatibility-marker'
+import {
+  hasMissingProfileStateDatabaseWithRetainedExport,
+  readActiveProfileId,
+  readPersistedHttp1CompatibilityMode
+} from './http1-compatibility-profile-state'
 
 const DEV_PARENT_SHUTDOWN_GRACE_MS = 3000
 const HTTP1_COMPATIBILITY_ENV_VAR = 'ORCA_DISABLE_HTTP2'
@@ -32,22 +37,6 @@ function parseBooleanEnvFlag(value: string | undefined): boolean | null {
   return null
 }
 
-function readPersistedHttp1CompatibilityMode(userDataPath: string): boolean {
-  const dataFile = join(userDataPath, 'orca-data.json')
-  if (!existsSync(dataFile)) {
-    return false
-  }
-
-  try {
-    const parsed = JSON.parse(readFileSync(dataFile, 'utf-8')) as {
-      settings?: { electronHttp1CompatibilityMode?: unknown }
-    }
-    return parsed.settings?.electronHttp1CompatibilityMode === true
-  } catch {
-    return false
-  }
-}
-
 export function shouldDisableHttp2ForElectronNetworking(
   options: NetworkCompatibilityOptions = {}
 ): boolean {
@@ -56,11 +45,22 @@ export function shouldDisableHttp2ForElectronNetworking(
     return envValue
   }
   const userDataPath = options.userDataPath ?? app.getPath('userData')
+  const activeProfileId = readActiveProfileId(userDataPath)
   // Why the marker first: this runs before app.whenReady(), and the settings file is the multi-MB
-  // orca-data.json the Store parses again moments later. The marker is refreshed whenever settings
-  // change, so the full read only happens on a profile that has never written one.
+  // profile document the Store parses again moments later. The marker is refreshed whenever
+  // settings change; an untrusted SQLite profile fails closed rather than falling back to JSON.
+  if (
+    activeProfileId !== undefined &&
+    activeProfileId !== null &&
+    hasMissingProfileStateDatabaseWithRetainedExport(userDataPath, activeProfileId)
+  ) {
+    return false
+  }
   return (
-    readHttp1CompatibilityMarker(userDataPath) ?? readPersistedHttp1CompatibilityMode(userDataPath)
+    (activeProfileId === null
+      ? null
+      : readHttp1CompatibilityMarker(userDataPath, activeProfileId)) ??
+    readPersistedHttp1CompatibilityMode(userDataPath)
   )
 }
 
diff --git a/src/main/startup/desktop-startup-ordering.test.ts b/src/main/startup/desktop-startup-ordering.test.ts
index 5e4d4cfe428..40d20d73b03 100644
--- a/src/main/startup/desktop-startup-ordering.test.ts
+++ b/src/main/startup/desktop-startup-ordering.test.ts
@@ -104,6 +104,30 @@ describe('startup ordering', () => {
     expect(foundationSource.split('initializeBrowserClientHostId(')).toHaveLength(2)
   })
 
+  it('fails closed with offline recovery guidance when profile state is unreadable', () => {
+    const entrySource = readFileSync(join(process.cwd(), 'src/main/index.ts'), 'utf8')
+
+    expect(entrySource).toContain('formatProfileStateStartupFailure')
+    expect(entrySource).toContain('formatProfileStateStartupFailure(error) ??')
+    expect(entrySource).toContain('presentProfileStateStartupRecoveryDialog')
+    expect(entrySource).toContain('!state.isServeMode && !isBackgroundLaunch()')
+    expect(entrySource).toContain(
+      "console.warn('[profile-state] Recovery dialog failed; exiting safely:'"
+    )
+    expect(entrySource).toContain('app.exit(1)')
+  })
+
+  it('initializes telemetry before publishing profile-state authority selection', () => {
+    const source = readFileSync(
+      join(process.cwd(), 'src/main/startup/main-process-observers.ts'),
+      'utf8'
+    )
+    const telemetryInit = source.indexOf('initTelemetry(store)')
+    const authoritySelection = source.indexOf("track('profile_state_authority_selected'")
+    expect(telemetryInit).toBeGreaterThanOrEqual(0)
+    expect(authoritySelection).toBeGreaterThan(telemetryInit)
+  })
+
   it('requires daemon authority before restored-subagent liveness runs', () => {
     const source = readFileSync(
       join(process.cwd(), 'src/main/startup/main-process-pty-startup.ts'),
diff --git a/src/main/startup/dev-education-suppression.test.ts b/src/main/startup/dev-education-suppression.test.ts
index 534c64b3aa2..5e628920e51 100644
--- a/src/main/startup/dev-education-suppression.test.ts
+++ b/src/main/startup/dev-education-suppression.test.ts
@@ -1,10 +1,10 @@
 import { describe, expect, it, vi } from 'vitest'
+import { getDefaultUIState } from '../../shared/constants'
 import {
   getDefaultOnboardingState,
-  getDefaultUIState,
   ONBOARDING_FINAL_STEP,
   ONBOARDING_FLOW_VERSION
-} from '../../shared/constants'
+} from '../../shared/onboarding-defaults'
 import { CONTEXTUAL_TOUR_IDS } from '../../shared/contextual-tours'
 import { FEATURE_INTERACTION_IDS } from '../../shared/feature-interactions'
 import { FEATURE_TIP_IDS } from '../../shared/feature-tips'
diff --git a/src/main/startup/dev-education-suppression.ts b/src/main/startup/dev-education-suppression.ts
index bea97e7bbc8..1f6d1afe188 100644
--- a/src/main/startup/dev-education-suppression.ts
+++ b/src/main/startup/dev-education-suppression.ts
@@ -1,4 +1,4 @@
-import { ONBOARDING_FINAL_STEP, ONBOARDING_FLOW_VERSION } from '../../shared/constants'
+import { ONBOARDING_FINAL_STEP, ONBOARDING_FLOW_VERSION } from '../../shared/onboarding-defaults'
 import { CONTEXTUAL_TOUR_IDS } from '../../shared/contextual-tours'
 import {
   FEATURE_INTERACTION_IDS,
diff --git a/src/main/startup/gpu-lifecycle-install-dir-acl-guard.test.ts b/src/main/startup/gpu-lifecycle-install-dir-acl-guard.test.ts
index e35fe401cdc..7c6e7dcaaec 100644
--- a/src/main/startup/gpu-lifecycle-install-dir-acl-guard.test.ts
+++ b/src/main/startup/gpu-lifecycle-install-dir-acl-guard.test.ts
@@ -84,7 +84,7 @@ function reportProbePoisoned(): { finishRepair: () => Promise<void> } {
     release = resolve
   })
   startWindowsInstallDirAclRepairIfPoisoned(
-    { status: 'ok', matchesPoisonSignature: true, wellKnownNameCheckReliable: true },
+    { status: 'ok', matchesPoisonSignature: true },
     {
       ...recoveryOptions(),
       runProcessFn: (async () => {
@@ -115,7 +115,7 @@ async function reportProbePoisonedWithSettledRepair(
   userDataPath?: string
 ): Promise<void> {
   startWindowsInstallDirAclRepairIfPoisoned(
-    { status: 'ok', matchesPoisonSignature: true, wellKnownNameCheckReliable: true },
+    { status: 'ok', matchesPoisonSignature: true },
     {
       ...recoveryOptions(userDataPath),
       runProcessFn: (async () => ({
@@ -268,7 +268,7 @@ describe('handleGpuChildCrash vs the install-dir ACL verdict', () => {
 
     // The reading lands poisoned: the claim was false, and engagement stays withheld.
     startWindowsInstallDirAclRepairIfPoisoned(
-      { status: 'ok', matchesPoisonSignature: true, wellKnownNameCheckReliable: true },
+      { status: 'ok', matchesPoisonSignature: true },
       recoveryOptions(userData.path)
     )
     await decisive
diff --git a/src/main/startup/headless-pty-hydration-ordering.test.ts b/src/main/startup/headless-pty-hydration-ordering.test.ts
index 3b661dede99..c761ccf0409 100644
--- a/src/main/startup/headless-pty-hydration-ordering.test.ts
+++ b/src/main/startup/headless-pty-hydration-ordering.test.ts
@@ -40,7 +40,7 @@ describe('headless PTY registry hydration ordering', () => {
 
   it('hydrates orcad after Store and daemon readiness but before RPC and publication', () => {
     const source = readFileSync(join(process.cwd(), 'src/main/orcad/orcad-entry.ts'), 'utf8')
-    const store = source.indexOf('const store = new Store(')
+    const store = source.indexOf('createOrcadProfileStateStartup(runtimeUserDataPath)')
     const daemon = source.indexOf('await startOrcadDaemon()', store)
     const handlersAndHydration = source.indexOf('await registerHeadlessPtyRuntime(', daemon)
     const rpc = source.indexOf('await rpc.start()', handlersAndHydration)
@@ -57,7 +57,7 @@ describe('headless PTY registry hydration ordering', () => {
     const source = readFileSync(join(process.cwd(), 'src/main/orcad/orcad-entry.ts'), 'utf8')
     const cleanup = source.indexOf('registerCleanup(async () => {')
     const hookStop = source.indexOf('agentHookServer.stop()', cleanup)
-    const store = source.indexOf('const store = new Store(')
+    const store = source.indexOf('createOrcadProfileStateStartup(runtimeUserDataPath)')
     const hookStart = source.indexOf('await agentHookServer.start(', store)
     const daemon = source.indexOf('await startOrcadDaemon()', hookStart)
     const hookEnv = source.indexOf('buildAgentHookPtyEnv:', daemon)
diff --git a/src/main/startup/http1-compatibility-marker.ts b/src/main/startup/http1-compatibility-marker.ts
index 9e85a83be66..88de78ab808 100644
--- a/src/main/startup/http1-compatibility-marker.ts
+++ b/src/main/startup/http1-compatibility-marker.ts
@@ -1,8 +1,12 @@
-import { readFileSync, writeFileSync } from 'node:fs'
+import { readFileSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
+import { durableWriteTempPath, writeFileDurableSync } from '../durable-file-write'
+import { bestEffortFsyncDirectorySync } from '../../shared/secure-file'
 
 /**
  * Cached copy of `settings.electronHttp1CompatibilityMode` for pre-`ready` startup.
+ * Version 2 carries the active profile ID so a profile switch cannot reuse the
+ * previous profile's network compatibility choice.
  *
  * Why a standalone file (not the Store): app.commandLine.appendSwitch('disable-http2') must run
  * before the first Electron session exists, which is before the settings Store is constructed.
@@ -12,11 +16,13 @@ import { join } from 'node:path'
  */
 
 export const HTTP1_COMPATIBILITY_MARKER_FILE = 'http1-compatibility.json'
-const MARKER_SCHEME_VERSION = 1
+const LEGACY_MARKER_SCHEME_VERSION = 1
+const MARKER_SCHEME_VERSION = 2
 
 type Http1CompatibilityMarker = {
   schemeVersion: number
   enabled: boolean
+  profileId?: string
 }
 
 function markerPath(userDataPath: string): string {
@@ -24,12 +30,30 @@ function markerPath(userDataPath: string): string {
 }
 
 /** Returns null when the marker is missing or unreadable, so callers fall back to the settings file. */
-export function readHttp1CompatibilityMarker(userDataPath: string): boolean | null {
+export function readHttp1CompatibilityMarker(
+  userDataPath: string,
+  expectedProfileId?: string
+): boolean | null {
   try {
     const parsed = JSON.parse(
       readFileSync(markerPath(userDataPath), 'utf-8')
     ) as Partial<Http1CompatibilityMarker>
-    if (parsed.schemeVersion !== MARKER_SCHEME_VERSION || typeof parsed.enabled !== 'boolean') {
+    if (typeof parsed.enabled !== 'boolean') {
+      return null
+    }
+    if (parsed.schemeVersion === LEGACY_MARKER_SCHEME_VERSION) {
+      // A v1 marker predates profile-scoped state. It remains useful for a
+      // legacy install with no profile index, but cannot be trusted once the
+      // active profile is known.
+      return expectedProfileId === undefined ? parsed.enabled : null
+    }
+    if (
+      parsed.schemeVersion !== MARKER_SCHEME_VERSION ||
+      typeof parsed.profileId !== 'string' ||
+      parsed.profileId.length === 0 ||
+      expectedProfileId === undefined ||
+      parsed.profileId !== expectedProfileId
+    ) {
       return null
     }
     return parsed.enabled
@@ -38,14 +62,28 @@ export function readHttp1CompatibilityMarker(userDataPath: string): boolean | nu
   }
 }
 
-export function writeHttp1CompatibilityMarker(userDataPath: string, enabled: boolean): void {
-  if (readHttp1CompatibilityMarker(userDataPath) === enabled) {
+export function writeHttp1CompatibilityMarker(
+  userDataPath: string,
+  enabled: boolean,
+  profileId?: string
+): void {
+  if (readHttp1CompatibilityMarker(userDataPath, profileId) === enabled) {
     return
   }
-  const marker: Http1CompatibilityMarker = { schemeVersion: MARKER_SCHEME_VERSION, enabled }
+  const marker: Http1CompatibilityMarker =
+    profileId === undefined
+      ? { schemeVersion: LEGACY_MARKER_SCHEME_VERSION, enabled }
+      : { schemeVersion: MARKER_SCHEME_VERSION, enabled, profileId }
   try {
-    writeFileSync(markerPath(userDataPath), JSON.stringify(marker))
+    const targetPath = markerPath(userDataPath)
+    writeFileDurableSync(durableWriteTempPath(targetPath), targetPath, JSON.stringify(marker))
   } catch {
-    // Best effort: a missing marker just costs the next launch the settings-file fallback.
+    // Best effort: a missing marker makes the next launch fail closed or read legacy JSON.
   }
 }
+
+/** Recovery must discard the old authority's cached setting before publishing JSON authority. */
+export function invalidateHttp1CompatibilityMarker(userDataPath: string): void {
+  rmSync(markerPath(userDataPath), { force: true })
+  bestEffortFsyncDirectorySync(userDataPath)
+}
diff --git a/src/main/startup/http1-compatibility-profile-state.test.ts b/src/main/startup/http1-compatibility-profile-state.test.ts
new file mode 100644
index 00000000000..d1c9b1b08a6
--- /dev/null
+++ b/src/main/startup/http1-compatibility-profile-state.test.ts
@@ -0,0 +1,141 @@
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  hasMissingProfileStateDatabaseWithRetainedExport,
+  readActiveProfileId,
+  readPersistedHttp1CompatibilityMode
+} from './http1-compatibility-profile-state'
+import { profileStateJsonExportPath } from '../persistence/profile-state/legacy-json/profile-state-export-path'
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function createUserData(): string {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-http1-profile-state-'))
+  temporaryDirectories.push(directory)
+  return directory
+}
+
+function writeIndex(userDataPath: string, activeProfileId: string): void {
+  writeFileSync(
+    join(userDataPath, 'orca-profile-index.json'),
+    JSON.stringify({
+      schemaVersion: 1,
+      activeProfileId,
+      profiles: [{ id: activeProfileId }]
+    })
+  )
+}
+
+describe('pre-ready profile-state compatibility lookup', () => {
+  it('uses the legacy install-level JSON before a profile index exists', () => {
+    const userDataPath = createUserData()
+    writeFileSync(
+      join(userDataPath, 'orca-data.json'),
+      JSON.stringify({ settings: { electronHttp1CompatibilityMode: true } })
+    )
+
+    expect(readActiveProfileId(userDataPath)).toBeUndefined()
+    expect(readPersistedHttp1CompatibilityMode(userDataPath)).toBe(true)
+  })
+
+  it('reads only the active profile JSON once the index is valid', () => {
+    const userDataPath = createUserData()
+    writeIndex(userDataPath, 'work')
+    const profileDirectory = join(userDataPath, 'profiles', 'work')
+    mkdirSync(profileDirectory, { recursive: true })
+    writeFileSync(
+      join(userDataPath, 'orca-data.json'),
+      JSON.stringify({ settings: { electronHttp1CompatibilityMode: true } })
+    )
+    rmSync(join(userDataPath, 'orca-data.json'))
+    writeFileSync(
+      join(profileDirectory, 'orca-data.json'),
+      JSON.stringify({ settings: { electronHttp1CompatibilityMode: true } })
+    )
+
+    expect(readActiveProfileId(userDataPath)).toBe('work')
+    expect(readPersistedHttp1CompatibilityMode(userDataPath)).toBe(true)
+  })
+
+  it.each(['-wal', '-shm', '-journal'])('fails closed when only SQLite %s remains', (suffix) => {
+    const userDataPath = createUserData()
+    writeIndex(userDataPath, 'work')
+    const profileDirectory = join(userDataPath, 'profiles', 'work')
+    mkdirSync(profileDirectory, { recursive: true })
+    writeFileSync(
+      join(profileDirectory, 'orca-data.json'),
+      JSON.stringify({ settings: { electronHttp1CompatibilityMode: true } })
+    )
+    writeFileSync(join(profileDirectory, `profile-state.db${suffix}`), 'orphaned')
+
+    expect(readPersistedHttp1CompatibilityMode(userDataPath)).toBe(false)
+
+    writeFileSync(join(userDataPath, 'orca-profile-index.json'), '{ malformed')
+    writeFileSync(
+      join(userDataPath, 'orca-data.json'),
+      JSON.stringify({ settings: { electronHttp1CompatibilityMode: true } })
+    )
+    expect(readActiveProfileId(userDataPath)).toBe(null)
+    expect(readPersistedHttp1CompatibilityMode(userDataPath)).toBe(false)
+  })
+
+  it.each(['json-export', 'database-backup'])(
+    'fails closed when SQLite is missing but a retained %s remains',
+    (artifact) => {
+      const userDataPath = createUserData()
+      writeIndex(userDataPath, 'work')
+      const profileDirectory = join(userDataPath, 'profiles', 'work')
+      mkdirSync(profileDirectory, { recursive: true })
+      const dataFile = join(profileDirectory, 'orca-data.json')
+      writeFileSync(
+        dataFile,
+        JSON.stringify({ settings: { electronHttp1CompatibilityMode: true } })
+      )
+      writeFileSync(
+        artifact === 'json-export'
+          ? profileStateJsonExportPath(dataFile, 7)
+          : join(
+              profileDirectory,
+              'profile-state.db.backup.1789999999999-00000000-0000-4000-8000-000000000000.db'
+            ),
+        readFileSync(dataFile)
+      )
+
+      expect(readPersistedHttp1CompatibilityMode(userDataPath)).toBe(false)
+    }
+  )
+
+  it.each(['json-export', 'database-backup'])(
+    'detects a missing profile database with a retained %s',
+    (artifact) => {
+      const userDataPath = createUserData()
+      writeIndex(userDataPath, 'work')
+      const profileDirectory = join(userDataPath, 'profiles', 'work')
+      mkdirSync(profileDirectory, { recursive: true })
+      const dataFile = join(profileDirectory, 'orca-data.json')
+      writeFileSync(
+        dataFile,
+        JSON.stringify({ settings: { electronHttp1CompatibilityMode: true } })
+      )
+      writeFileSync(
+        artifact === 'json-export'
+          ? profileStateJsonExportPath(dataFile, 7)
+          : join(
+              profileDirectory,
+              'profile-state.db.backup.1789999999999-00000000-0000-4000-8000-000000000000.db'
+            ),
+        readFileSync(dataFile)
+      )
+
+      expect(hasMissingProfileStateDatabaseWithRetainedExport(userDataPath, 'work')).toBe(true)
+    }
+  )
+})
diff --git a/src/main/startup/http1-compatibility-profile-state.ts b/src/main/startup/http1-compatibility-profile-state.ts
new file mode 100644
index 00000000000..f63ec01dc20
--- /dev/null
+++ b/src/main/startup/http1-compatibility-profile-state.ts
@@ -0,0 +1,122 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { profileStateJsonExportPaths } from '../persistence/profile-state/legacy-json/profile-state-export-path'
+import { profileStateDatabaseBackups } from '../persistence/profile-state/profile-state-backup-path'
+import { hasProfileStateDatabaseFiles } from '../persistence/profile-state/profile-state-storage-classification'
+
+// Keep the pre-ready graph small; this stable ID mirrors DEFAULT_LOCAL_ORCA_PROFILE_ID.
+const DEFAULT_LOCAL_PROFILE_ID = 'local-default'
+
+/** `null` means malformed index; `undefined` means a pre-profile legacy install. */
+export function readActiveProfileId(userDataPath: string): string | null | undefined {
+  const indexPath = join(userDataPath, 'orca-profile-index.json')
+  const candidates = [indexPath, `${indexPath}.bak`].filter(existsSync)
+  if (candidates.length === 0) {
+    return undefined
+  }
+  for (const candidate of candidates) {
+    try {
+      const parsed: unknown = JSON.parse(readFileSync(candidate, 'utf-8'))
+      if (!isRecord(parsed) || typeof parsed.activeProfileId !== 'string') {
+        continue
+      }
+      if (
+        /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(parsed.activeProfileId) &&
+        Array.isArray(parsed.profiles) &&
+        parsed.profiles.some(
+          (profile) => isRecord(profile) && profile.id === parsed.activeProfileId
+        )
+      ) {
+        return parsed.activeProfileId
+      }
+    } catch {
+      // A torn primary can still have a valid recovery index.
+    }
+  }
+  return null
+}
+
+/** Read JSON only when no profile database is present; pre-ready cannot open SQLite safely. */
+export function readPersistedHttp1CompatibilityMode(userDataPath: string): boolean {
+  const activeProfileId = readActiveProfileId(userDataPath)
+  if (activeProfileId === null) {
+    // A malformed profile index leaves the active profile unknowable.
+    return false
+  }
+
+  const profileDataFile =
+    activeProfileId === undefined
+      ? undefined
+      : join(userDataPath, 'profiles', activeProfileId, 'orca-data.json')
+  const profileDatabaseFile =
+    activeProfileId === undefined
+      ? undefined
+      : join(userDataPath, 'profiles', activeProfileId, 'profile-state.db')
+  // SQLite is authoritative once present; a missing marker therefore fails closed.
+  if (profileDatabaseFile !== undefined && hasProfileStateDatabaseFiles(profileDatabaseFile)) {
+    return false
+  }
+
+  if (
+    activeProfileId !== undefined &&
+    activeProfileId !== DEFAULT_LOCAL_PROFILE_ID &&
+    (profileDataFile === undefined || !existsSync(profileDataFile))
+  ) {
+    // A known but unseeded non-default profile has default settings. The
+    // install-level legacy file belongs to another profile and must not leak.
+    return false
+  }
+  const dataFile = profileDataFile ?? join(userDataPath, 'orca-data.json')
+  // A retained migration export proves SQLite was established. Do not let the
+  // pre-ready path read a stale JSON mirror while recovery is required.
+  try {
+    if (
+      profileStateJsonExportPaths(dataFile).length > 0 ||
+      profileStateDatabaseBackups(
+        profileDatabaseFile ?? join(dirname(dataFile), 'profile-state.db')
+      ).length > 0
+    ) {
+      return false
+    }
+  } catch {
+    return false
+  }
+  if (!existsSync(dataFile)) {
+    return false
+  }
+
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(dataFile, 'utf-8'))
+    if (!isRecord(parsed) || !isRecord(parsed.settings)) {
+      return false
+    }
+    return parsed.settings.electronHttp1CompatibilityMode === true
+  } catch {
+    return false
+  }
+}
+
+/** Return whether a retained SQLite export makes pre-ready JSON/marker state untrusted. */
+export function hasMissingProfileStateDatabaseWithRetainedExport(
+  userDataPath: string,
+  profileId: string
+): boolean {
+  const profileDirectory = join(userDataPath, 'profiles', profileId)
+  const databaseFile = join(profileDirectory, 'profile-state.db')
+  if (hasProfileStateDatabaseFiles(databaseFile)) {
+    return false
+  }
+  const dataFile = join(profileDirectory, 'orca-data.json')
+  try {
+    return (
+      profileStateJsonExportPaths(dataFile).length > 0 ||
+      profileStateDatabaseBackups(databaseFile).length > 0
+    )
+  } catch {
+    return true
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
diff --git a/src/main/startup/main-process-account-services.ts b/src/main/startup/main-process-account-services.ts
index 7a677ed760e..42338910e2a 100644
--- a/src/main/startup/main-process-account-services.ts
+++ b/src/main/startup/main-process-account-services.ts
@@ -18,9 +18,9 @@ import { readMiniMaxApiKey } from '../minimax/minimax-api-key-store'
 import { createAccountRuntimeTargetSettingsSync } from '../rate-limits/account-runtime-target-sync'
 import { normalizeCodexRuntimeSelection } from '../codex-accounts/runtime-selection'
 import { normalizeClaudeRuntimeSelection } from '../claude-accounts/runtime-selection'
-import { isAgentStatusHooksEnabled } from '../agent-hooks/managed-agent-hook-controls'
 import { agentHookServer } from '../agent-hooks/server'
 import { setSystemCodexHomeHookSweepSuppressed } from '../codex/hook-service'
+import { shouldSuppressSystemCodexHomeHookSweep } from '../codex/codex-hook-legacy-cleanup'
 import { isRealHomeCodexHookLaneUsable } from '../codex/codex-real-home-hook-install'
 import { resolveHostCodexSessionSourceHome } from '../codex/codex-session-source-home'
 import { browserManager } from '../browser/browser-manager'
@@ -45,13 +45,13 @@ export function initializeMainProcessAccountServices(): void {
   state.codexRuntimeHome.setRealHomeLaneGate(() => isRealHomeCodexHookLaneUsable())
   // Why: while the real-home lane owns ~/.codex/hooks.json, the legacy
   // system-home sweep inside managed installs would delete the entry the
-  // real-home installer just appended. Flag OFF, hooks off, or an incapable
-  // trust lane re-arms the sweep so downgrade, opt-out, and rollback converge.
-  setSystemCodexHomeHookSweepSuppressed(
-    () =>
-      state.codexRuntimeHome !== null &&
-      state.codexRuntimeHome.isHostSystemDefaultRealHome() &&
-      isAgentStatusHooksEnabled(state.store?.getSettings())
+  // real-home installer just appended. Flag OFF, hooks off (all or Codex), or an
+  // incapable trust lane re-arms the sweep so downgrade, opt-out, and rollback converge.
+  setSystemCodexHomeHookSweepSuppressed(() =>
+    shouldSuppressSystemCodexHomeHookSweep({
+      isHostSystemDefaultRealHome: state.codexRuntimeHome?.isHostSystemDefaultRealHome() === true,
+      settings: state.store?.getSettings()
+    })
   )
   state.codexSessionMigration = createCodexSessionMigrationScheduler({
     isEligible: () =>
diff --git a/src/main/startup/main-process-observers.ts b/src/main/startup/main-process-observers.ts
index b0ee60f88c2..9f7f0639aae 100644
--- a/src/main/startup/main-process-observers.ts
+++ b/src/main/startup/main-process-observers.ts
@@ -57,6 +57,16 @@ export function initializeMainProcessObservers(): void {
   }
   // Why: telemetry must init before any IPC handler/renderer can call track(); it's a no-op in dev and while TELEMETRY_ENABLED is false, so it's safe early.
   initTelemetry(store)
+  const profileStateStartup = state.profileStateStartup
+  if (profileStateStartup) {
+    track('profile_state_authority_selected', {
+      backend: profileStateStartup.backend,
+      classification: profileStateStartup.classification,
+      authority_mode: 'sqlite-established',
+      runtime: profileStateStartup.runtime,
+      migrated: profileStateStartup.migrated
+    })
+  }
   // Why: the breadcrumb alone never leaves the machine — it rides crash reports, and a hang is not
   // a crash (the app is force-quit, so no report is ever generated). Without this the incidence
   // number the watchdog exists to produce would sit unread on the user's disk. Must run after
diff --git a/src/main/startup/main-process-preflight-failure.ts b/src/main/startup/main-process-preflight-failure.ts
new file mode 100644
index 00000000000..0fcd47935cb
--- /dev/null
+++ b/src/main/startup/main-process-preflight-failure.ts
@@ -0,0 +1,41 @@
+import { app, dialog } from 'electron'
+import { formatProfileStateStartupFailure } from '../persistence/profile-state/profile-state-startup-failure'
+import { isBackgroundLaunch } from '../window/foreground-activation-policy'
+import { mainProcessState as state } from './main-process-state'
+
+/** Ends a failed preflight without showing a Linux dialog before Electron is ready. */
+export function handleMainProcessPreflightFailure(error: unknown): void {
+  const message =
+    formatProfileStateStartupFailure(error) ??
+    (error instanceof Error ? error.message : String(error))
+  const shouldShowDialog = !state.isServeMode && !isBackgroundLaunch()
+  state.desktopActivationGate = null
+  const admission = state.profileStateAdmission
+  state.profileStateAdmission = undefined
+  try {
+    admission?.release()
+  } catch (releaseError) {
+    console.warn('[startup] Could not release profile state admission:', releaseError)
+  }
+
+  const showDialogAndExit = (): void => {
+    try {
+      dialog.showErrorBox('Orca could not start', message)
+    } catch (dialogError) {
+      console.warn('[startup] Could not show startup failure:', dialogError)
+    } finally {
+      app.exit(1)
+    }
+  }
+  if (process.platform === 'linux' && shouldShowDialog) {
+    try {
+      void app.whenReady().then(showDialogAndExit, () => app.exit(1))
+    } catch {
+      app.exit(1)
+    }
+  } else if (shouldShowDialog) {
+    showDialogAndExit()
+  } else {
+    app.exit(1)
+  }
+}
diff --git a/src/main/startup/main-process-preflight.ts b/src/main/startup/main-process-preflight.ts
index 98d41093c5f..100f1e21386 100644
--- a/src/main/startup/main-process-preflight.ts
+++ b/src/main/startup/main-process-preflight.ts
@@ -3,6 +3,7 @@ import { is } from '@electron-toolkit/utils'
 import os from 'node:os'
 import { join } from 'node:path'
 import { maybeRedirectCliLaunch } from './cli-launch-redirect'
+import { runProfileStateRecoveryPreflight } from './profile-state-recovery-preflight'
 import { argvRequestsServeMode, normalizeServeModeArgv } from './serve-mode-argv'
 import {
   configureDevUserDataPath,
@@ -67,6 +68,8 @@ import { initDataPath, getCanonicalUserDataPath } from '../persistence'
 import { applyMacPressAndHoldDefaultAtStartup } from '../macos-press-and-hold-default'
 import { initSessionParseCachePersistence } from '../ai-vault/session-parse-cache-persistence'
 import { initOrcaProfilePaths } from '../orca-profiles/profile-index-store'
+import { getProfileUserDataPath } from '../orca-profiles/profile-storage-paths'
+import { recoverPendingProfileProjectMoves } from '../orca-profiles/profile-project-move-intent'
 import { initStatsPath } from '../stats/collector'
 import { initClaudeUsagePath } from '../claude-usage/store'
 import { initCodexUsagePath } from '../codex-usage/store'
@@ -89,6 +92,9 @@ import { mainProcessState as state } from './main-process-state'
 import { initializeSyntheticTitleRuntime } from './synthetic-title-runtime'
 import { initializeBrowserProcessUserAgent } from '../browser/browser-process-user-agent'
 import { initializeBrowserIdentityModeStore } from '../browser/browser-identity-mode-store'
+import { acquireProfileStateRuntimeAdmission } from '../persistence/profile-state/profile-state-access'
+import { getActiveProfileStateLocation } from '../persistence/profile-state/profile-state-active-location'
+import { handleMainProcessPreflightFailure } from './main-process-preflight-failure'
 
 export type MainProcessPreflightOptions = {
   focusExistingWindow: () => void
@@ -97,6 +103,19 @@ export type MainProcessPreflightOptions = {
 
 /** Performs all module-scope work that must happen before Electron's ready event. */
 export function runMainProcessPreflight(options: MainProcessPreflightOptions): boolean {
+  try {
+    return initializeMainProcessPreflight(options)
+  } catch (error) {
+    console.error('[startup] Preflight failed:', error)
+    handleMainProcessPreflightFailure(error)
+    return false
+  }
+}
+
+function initializeMainProcessPreflight(options: MainProcessPreflightOptions): boolean {
+  if (runProfileStateRecoveryPreflight()) {
+    return false
+  }
   // Why: on Windows a CLI launch that lost ELECTRON_RUN_AS_NODE would boot the GUI and exit silently; redirect to node mode before the lock gate below.
   // The redirect runs before the serve-argv rewrite so it still matches on the launch argv verbatim.
   // Direct serve stays in-process so its signal handlers own all children.
@@ -128,7 +147,9 @@ export function runMainProcessPreflight(options: MainProcessPreflightOptions): b
     ? state.devInstanceIdentity.appUserModelId
     : undefined
   state.desktopActivationGate = createServeDesktopActivationGate({
-    initialState: state.isServeMode ? 'initializing' : 'ready',
+    // Why held for desktop too: an activation before the startup window exists would open a
+    // second main window and abort launch; runtime launch releases it once that window exists.
+    initialState: 'initializing',
     activateWindow: () => {
       // Why: an updater replacement must not resurrect the old app bundle.
       if (!isQuittingForUpdate()) {
@@ -186,10 +207,6 @@ export function runMainProcessPreflight(options: MainProcessPreflightOptions): b
   if (state.devInstanceIdentity && shouldApplyPreReadyAppName(state.devInstanceIdentity)) {
     app.setName(state.devInstanceIdentity.appName)
   }
-  // Why: renderer and worker defaults are process-global and must be fixed before any session exists.
-  initializeBrowserProcessUserAgent(
-    initializeBrowserIdentityModeStore(getCanonicalUserDataPath()).appliedMode
-  )
   state.startupDiagnosticsEnabled = isStartupDiagnosticsEnabled()
   if (state.startupDiagnosticsEnabled) {
     logStartupDiagnostic('before-single-instance-lock', {
@@ -229,6 +246,11 @@ export function runMainProcessPreflight(options: MainProcessPreflightOptions): b
     app.exit(SINGLE_INSTANCE_ALREADY_RUNNING_EXIT_CODE)
     return false
   }
+  state.profileStateAdmission = acquireProfileStateRuntimeAdmission(getCanonicalUserDataPath())
+  // Renderer and worker defaults must be fixed before any session exists.
+  initializeBrowserProcessUserAgent(
+    initializeBrowserIdentityModeStore(getCanonicalUserDataPath()).appliedMode
+  )
   // Why first in this block: the accessor throws until installed and everything below may read a
   // credential. The constructor does not touch `safeStorage` — it resolves lazily per call — so
   // installing here changes no timing, in particular not the pre-ready Keychain service-name
@@ -282,6 +304,13 @@ export function runMainProcessPreflight(options: MainProcessPreflightOptions): b
     appVersion: app.getVersion()
   })
   initOrcaProfilePaths()
+  // A crash can leave a cross-profile SQLite move between its two commits. Resolve
+  // that journal before any Store opens a profile, so no reader observes a half-move.
+  const profileUserDataPath = getProfileUserDataPath()
+  recoverPendingProfileProjectMoves(
+    profileUserDataPath,
+    getActiveProfileStateLocation(profileUserDataPath)?.profileId
+  )
   // Why: same timing as initDataPath — capture userData before app.setName changes it. See persistence.ts:20-28.
   initStatsPath()
   initClaudeUsagePath()
diff --git a/src/main/startup/main-process-pty-startup.ts b/src/main/startup/main-process-pty-startup.ts
index 162faf66b2f..648db87a3b6 100644
--- a/src/main/startup/main-process-pty-startup.ts
+++ b/src/main/startup/main-process-pty-startup.ts
@@ -17,7 +17,10 @@ import {
 } from '../codex/codex-pane-account-registry'
 import { reconcileRetainedCodexHookHomes } from '../codex/retained-codex-hook-state'
 import { codexHookService } from '../codex/hook-service'
-import { isAgentStatusHooksEnabled } from '../agent-hooks/managed-agent-hook-controls'
+import {
+  isAgentStatusHooksEnabled,
+  isAgentStatusHooksEnabledForAgent
+} from '../agent-hooks/managed-agent-hook-controls'
 import { agentHookServer } from '../agent-hooks/server'
 import {
   indexPersistedPaneKeyPtyIds,
@@ -146,9 +149,7 @@ export function startTerminalRuntimeStartupServices(): WindowsDesktopStartupServ
           if (hasRetainedManagedHostPane) {
             void reconcileRetainedCodexHookHomes({
               hookService: codexHookService,
-              hooksEnabled:
-                isAgentStatusHooksEnabled(settings) &&
-                settings?.disabledTuiAgents.includes('codex') !== true,
+              hooksEnabled: isAgentStatusHooksEnabledForAgent(settings, 'codex'),
               runtimeHomePaths: state.codexRuntimeHome.getRetainedHostCodexHookHomePaths(livePtyIds)
             }).catch((error) =>
               console.warn('[codex-hook-service] retained Codex home reconcile failed:', error)
diff --git a/src/main/startup/main-process-quit.ts b/src/main/startup/main-process-quit.ts
index 073791f6d3c..f104a3ec343 100644
--- a/src/main/startup/main-process-quit.ts
+++ b/src/main/startup/main-process-quit.ts
@@ -15,6 +15,7 @@ import { clearRuntimeMetadataIfOwned } from '../runtime/runtime-metadata'
 import { shutdownPairedRuntimeBrowserClientHosts } from '../browser/paired-runtime-browser-client-host-runtime'
 import { browserManager } from '../browser/browser-manager'
 import { stopCodexStateDbBackfillRecoveries } from '../codex/codex-state-db-backfill-recovery'
+import { stopCodexAccountSessionBridges } from '../codex/codex-account-session-bridge'
 import { awaitPackedRefsLockRelease } from '../git/local-repo-ref-maintenance'
 import { settleTeardownWithinDeadline, settleWithinMs } from '../quit-teardown-deadline'
 import { quitTeardownStartGate } from '../quit-teardown-start-gate'
@@ -134,6 +135,7 @@ function installWillQuitHandler(): void {
     state.pluginMarketplaceInstaller = null
     const pluginHostShutdown = state.pluginService?.dispose() ?? Promise.resolve()
     const codexBackfillRecoveryShutdown = stopCodexStateDbBackfillRecoveries()
+    stopCodexAccountSessionBridges()
     // Why before the stop: teardown stamps each working session's resume marker with why the app
     // went away, and an update install is a restart the user never chose.
     setStructuredAgentSessionTeardownTrigger(updateQuitInProgress ? 'update' : 'quit')
@@ -195,12 +197,25 @@ function installWillQuitHandler(): void {
     browserManager.setBrowserGuestStateChangedListener(null)
     const emulatorShutdown =
       state.runtime?.getEmulatorBridge()?.destroyAllSessions() ?? Promise.resolve()
-    // Why immediately before store.flushAsync() with no await in between: beginSshShutdown() marks every
+    // Why immediately before the final store flush with no await in between: beginSshShutdown() marks every
     // active SSH lease detached in memory synchronously, and that flush is what persists it.
     const sshShutdown = beginSshShutdown()
     killAllPty()
     const watcherShutdown = shutdownWatchersOnce()
-    const storeFlush = state.store?.flushAsync() ?? Promise.resolve()
+    const finalStore = state.store
+    const storeFlush = (async () => {
+      if (!finalStore) {
+        return
+      }
+      try {
+        await finalStore.flushFinalOrThrowAsync({ exportJsonCompatibility: true })
+        await finalStore.freezeWritesAsync()
+        state.profileStateAdmission?.release()
+        state.profileStateAdmission = undefined
+      } catch (error) {
+        console.error('[persistence] Failed to finalize profile state:', error)
+      }
+    })()
     // Why: usage-cache writes are queued off the main thread, so a quit right after setEnabled or a
     // scan completion would drop the final snapshot. Captured before any await; joins the barrier below.
     const usageCacheFlush = Promise.all([
diff --git a/src/main/startup/main-process-ready-activation-failure.test.ts b/src/main/startup/main-process-ready-activation-failure.test.ts
new file mode 100644
index 00000000000..b3d265b3c25
--- /dev/null
+++ b/src/main/startup/main-process-ready-activation-failure.test.ts
@@ -0,0 +1,133 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { MainProcessRuntimeLaunchOptions } from './main-process-runtime-launch'
+
+const phases = vi.hoisted(() => ({
+  foundation: vi.fn<() => Promise<void>>(),
+  runtimeServices: vi.fn<() => Promise<void>>(),
+  menu: vi.fn<() => Promise<void>>(),
+  launch: vi.fn<(options: MainProcessRuntimeLaunchOptions) => Promise<void>>()
+}))
+
+vi.mock('./main-process-ready-foundation', () => ({
+  initializeReadyFoundation: phases.foundation
+}))
+vi.mock('./main-process-ready-runtime', () => ({
+  initializeReadyRuntimeServices: phases.runtimeServices
+}))
+vi.mock('./main-process-i18n-menu', () => ({ initializeMainProcessI18nAndMenu: phases.menu }))
+vi.mock('./main-process-runtime-launch', () => ({
+  initializeMainProcessRuntimeLaunch: phases.launch
+}))
+
+const { initializeMainProcessReady } = await import('./main-process-ready')
+const { mainProcessState: state } = await import('./main-process-state')
+const { createServeDesktopActivationGate } = await import('./serve-desktop-activation')
+
+const activateWindow = vi.fn()
+const launchOptions: MainProcessRuntimeLaunchOptions = {
+  openMainWindow: vi.fn<MainProcessRuntimeLaunchOptions['openMainWindow']>(),
+  handleMacAppActivation: vi.fn()
+}
+
+describe('desktop activation after ready-phase failures', () => {
+  beforeEach(() => {
+    vi.resetAllMocks()
+    phases.foundation.mockResolvedValue(undefined)
+    phases.runtimeServices.mockResolvedValue(undefined)
+    phases.menu.mockResolvedValue(undefined)
+    phases.launch.mockResolvedValue(undefined)
+    state.isServeMode = false
+    state.desktopActivationGate = createServeDesktopActivationGate({
+      initialState: 'initializing',
+      activateWindow
+    })
+  })
+
+  afterEach(() => {
+    state.desktopActivationGate = null
+    state.isServeMode = false
+  })
+
+  it.each(['foundation', 'runtimeServices'] as const)(
+    'disables desktop activation after %s fails',
+    async (phase) => {
+      const error = new Error(`${phase} failed`)
+      phases[phase].mockRejectedValueOnce(error)
+      state.desktopActivationGate?.requestActivation()
+
+      await expect(initializeMainProcessReady(launchOptions)).rejects.toBe(error)
+
+      expect(activateWindow).not.toHaveBeenCalled()
+      expect(state.desktopActivationGate).toBeNull()
+      expect(phases.launch).not.toHaveBeenCalled()
+      state.desktopActivationGate?.requestActivation()
+      expect(activateWindow).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['foundation', 'runtimeServices'] as const)(
+    'disables serve promotion after %s fails',
+    async (phase) => {
+      const error = new Error(`${phase} failed`)
+      phases[phase].mockRejectedValueOnce(error)
+      state.isServeMode = true
+      state.desktopActivationGate?.requestActivation()
+
+      await expect(initializeMainProcessReady(launchOptions)).rejects.toBe(error)
+
+      expect(state.desktopActivationGate).toBeNull()
+      state.desktopActivationGate?.requestActivation()
+      expect(activateWindow).not.toHaveBeenCalled()
+      expect(phases.launch).not.toHaveBeenCalled()
+    }
+  )
+
+  it('keeps activations held when menu failure leaves window creation still pending', async () => {
+    const error = new Error('menu failed')
+    let finishLaunch = (): void => {
+      throw new Error('launch has not started')
+    }
+    phases.menu.mockRejectedValueOnce(error)
+    phases.launch.mockImplementationOnce(
+      (options) =>
+        new Promise<void>((resolve) => {
+          finishLaunch = () => {
+            options.openMainWindow()
+            resolve()
+          }
+        })
+    )
+    state.desktopActivationGate?.requestActivation()
+
+    const ready = initializeMainProcessReady(launchOptions)
+    const rejected = expect(ready).rejects.toBe(error)
+    await vi.waitFor(() => expect(phases.launch).toHaveBeenCalledOnce())
+
+    expect(state.desktopActivationGate?.getState()).toBe('initializing')
+    expect(activateWindow).not.toHaveBeenCalled()
+    expect(launchOptions.openMainWindow).not.toHaveBeenCalled()
+    finishLaunch()
+    expect(launchOptions.openMainWindow).toHaveBeenCalledTimes(1)
+    expect(state.desktopActivationGate?.getState()).toBe('ready')
+    expect(activateWindow).toHaveBeenCalledTimes(1)
+    await rejected
+    expect(state.desktopActivationGate).toBeNull()
+  })
+
+  it('does not replay pending activations when window creation throws', async () => {
+    const error = new Error('window creation failed')
+    vi.mocked(launchOptions.openMainWindow).mockImplementationOnce(() => {
+      throw error
+    })
+    phases.launch.mockImplementationOnce(async (options) => {
+      options.openMainWindow()
+    })
+    state.desktopActivationGate?.requestActivation()
+
+    await expect(initializeMainProcessReady(launchOptions)).rejects.toBe(error)
+
+    expect(state.desktopActivationGate).toBeNull()
+    expect(activateWindow).not.toHaveBeenCalled()
+    expect(launchOptions.openMainWindow).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/main/startup/main-process-ready-foundation.ts b/src/main/startup/main-process-ready-foundation.ts
index 3c0e01fe09e..238998bac49 100644
--- a/src/main/startup/main-process-ready-foundation.ts
+++ b/src/main/startup/main-process-ready-foundation.ts
@@ -11,7 +11,8 @@ import {
 } from '../hang-watchdog/hang-detection-marker'
 import { browserCertificateTrustController } from '../browser/browser-manager'
 import { ensureActiveOrcaProfile } from '../orca-profiles/profile-index-store'
-import { Store, getCanonicalUserDataPath } from '../persistence'
+import { getCanonicalUserDataPath } from '../persistence'
+import { createProfileStateStoreForStartup } from '../persistence/profile-state/profile-state-startup-authority'
 import { initializeBrowserClientHostId } from '../browser/browser-client-host-id'
 import { scheduleSecretProtectionGapReport } from '../host/deferred-secret-protection-report'
 import { initSshHostKeyStoreFile } from '../ssh/ssh-host-key-store'
@@ -49,6 +50,7 @@ import { updateGpuAccelerationAboutPanel } from './gpu-lifecycle'
 import { reconcileManagedWslCliRegistrations } from '../cli/wsl-cli-registration-reconciliation'
 import { createWslCliReconciliationStartupBarrier } from './wsl-cli-reconciliation-startup-barrier'
 import { isAgentStatusHooksEnabled } from '../agent-hooks/managed-agent-hook-controls'
+import { reportProfileStateWriteFailure } from './profile-state-write-failure'
 
 export async function initializeReadyFoundation(): Promise<void> {
   logStartupMilestone('app-ready')
@@ -134,10 +136,21 @@ export async function initializeReadyFoundation(): Promise<void> {
   // Why this early: the first window stamps the hosting id into its renderer's argv, so the durable
   // read has to have happened by then or the renderer and the browser-host lease disagree.
   initializeBrowserClientHostId(profile.profileDirectory)
-  const store = new Store({
+  const profileState = await createProfileStateStoreForStartup({
     dataFile: profile.dataFile,
-    storageAuthority: state.isServeMode ? 'runtime' : 'desktop'
+    databaseFile: profile.stateDatabaseFile,
+    profileId: profile.profile.id,
+    runtime: 'desktop',
+    storageAuthority: state.isServeMode ? 'runtime' : 'desktop',
+    onPersistenceFailure: reportProfileStateWriteFailure
   })
+  state.profileStateStartup = {
+    backend: profileState.backend,
+    classification: profileState.classification,
+    runtime: 'desktop',
+    migrated: profileState.migrated
+  }
+  const store = profileState.store
   state.store = store
   // Why: create pending readiness before the guard can observe the default session.
   // Why parked on state instead of awaited here: Dock/Launchpad launches don't inherit shell
@@ -197,7 +210,8 @@ export async function initializeReadyFoundation(): Promise<void> {
   // Why: pre-`ready` startup reads this flag from a marker so it never has to parse orca-data.json.
   writeHttp1CompatibilityMarker(
     canonicalUserDataPath,
-    store.getSettings().electronHttp1CompatibilityMode === true
+    store.getSettings().electronHttp1CompatibilityMode === true,
+    profile.profile.id
   )
   // Why: apply initial fallback WSL distro from store settings for global git/CLI calls.
   setDefaultWslDistroOverride(store.getSettings().terminalWindowsWslDistro ?? null)
@@ -205,7 +219,8 @@ export async function initializeReadyFoundation(): Promise<void> {
     if ('electronHttp1CompatibilityMode' in updates) {
       writeHttp1CompatibilityMarker(
         canonicalUserDataPath,
-        settings.electronHttp1CompatibilityMode === true
+        settings.electronHttp1CompatibilityMode === true,
+        profile.profile.id
       )
     }
     if ('terminalWindowsWslDistro' in updates) {
diff --git a/src/main/startup/main-process-ready-identity-write.test.ts b/src/main/startup/main-process-ready-identity-write.test.ts
index 13011ccfb6b..7f7d490dc88 100644
--- a/src/main/startup/main-process-ready-identity-write.test.ts
+++ b/src/main/startup/main-process-ready-identity-write.test.ts
@@ -82,6 +82,16 @@ vi.mock('../persistence', () => ({
   },
   getCanonicalUserDataPath: () => mocks.userDataPath
 }))
+vi.mock('../persistence/profile-state/profile-state-startup-authority', () => ({
+  createProfileStateStoreForStartup: () => ({
+    store: {
+      getSettings: () => ({}),
+      onSettingsChanged: () => {},
+      getClaudeLivePtySessionIds: () => [],
+      getSshTargets: () => []
+    }
+  })
+}))
 // The registry reads the canonical path from this module, not from '../persistence'.
 vi.mock('../persistence/loading-store/user-data-path', () => ({
   getCanonicalUserDataPath: () => mocks.userDataPath
diff --git a/src/main/startup/main-process-ready-persistence-cleanup.test.ts b/src/main/startup/main-process-ready-persistence-cleanup.test.ts
new file mode 100644
index 00000000000..6deac0e8d51
--- /dev/null
+++ b/src/main/startup/main-process-ready-persistence-cleanup.test.ts
@@ -0,0 +1,130 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  createServeDesktopActivationGate,
+  type ServeDesktopActivationGate
+} from './serve-desktop-activation'
+
+const { state, foundation, runtime, i18n, launch } = vi.hoisted(() => ({
+  state: {
+    store: { freezeWritesAsync: vi.fn(async () => {}) },
+    profileStateAdmission: initialAdmission(),
+    desktopActivationGate: initialActivationGate(),
+    mainProcessI18nReady: Promise.resolve()
+  },
+  foundation: vi.fn(async () => {}),
+  runtime: vi.fn(async () => {}),
+  i18n: vi.fn(async () => {}),
+  launch: vi.fn(async () => {})
+}))
+
+function initialAdmission(): { release(): void } | undefined {
+  return undefined
+}
+
+function initialActivationGate(): ServeDesktopActivationGate | null {
+  return null
+}
+
+vi.mock('./main-process-state', () => ({ mainProcessState: state }))
+vi.mock('./main-process-ready-foundation', () => ({ initializeReadyFoundation: foundation }))
+vi.mock('./main-process-ready-runtime', () => ({ initializeReadyRuntimeServices: runtime }))
+vi.mock('./main-process-i18n-menu', () => ({ initializeMainProcessI18nAndMenu: i18n }))
+vi.mock('./main-process-runtime-launch', () => ({ initializeMainProcessRuntimeLaunch: launch }))
+
+import { initializeMainProcessReady } from './main-process-ready'
+
+const options = {
+  openMainWindow: (): never => {
+    throw new Error('Unexpected window creation in startup cleanup test')
+  },
+  handleMacAppActivation: () => {}
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  state.profileStateAdmission = { release: vi.fn() }
+  state.desktopActivationGate = null
+})
+
+describe('startup persistence lifetime', () => {
+  it('disables activations before a failed launch closes its profile writer', async () => {
+    const activateWindow = vi.fn()
+    state.desktopActivationGate = createServeDesktopActivationGate({
+      initialState: 'ready',
+      activateWindow
+    })
+    const failure = new Error('runtime startup failed')
+    launch.mockRejectedValueOnce(failure)
+    let finishFreeze = (): void => {}
+    state.store.freezeWritesAsync.mockImplementationOnce(
+      () =>
+        new Promise<void>((resolve) => {
+          finishFreeze = resolve
+        })
+    )
+    const rejected = expect(initializeMainProcessReady(options)).rejects.toBe(failure)
+
+    await vi.waitFor(() => expect(state.store.freezeWritesAsync).toHaveBeenCalledOnce())
+
+    expect(state.desktopActivationGate).toBeNull()
+    state.desktopActivationGate?.requestActivation()
+    expect(activateWindow).not.toHaveBeenCalled()
+    finishFreeze()
+    await rejected
+  })
+
+  it('awaits writer release after a later startup phase fails', async () => {
+    const failure = new Error('runtime startup failed')
+    const admission = state.profileStateAdmission
+    runtime.mockRejectedValueOnce(failure)
+    let release = () => {}
+    state.store.freezeWritesAsync.mockImplementationOnce(
+      () =>
+        new Promise<void>((resolve) => {
+          release = resolve
+        })
+    )
+    const ready = initializeMainProcessReady(options)
+    const rejected = expect(ready).rejects.toBe(failure)
+    await vi.waitFor(() => expect(state.store.freezeWritesAsync).toHaveBeenCalledOnce())
+    expect(admission?.release).not.toHaveBeenCalled()
+    release()
+    await rejected
+    expect(admission?.release).toHaveBeenCalledOnce()
+    expect(state.profileStateAdmission).toBeUndefined()
+    expect(launch).not.toHaveBeenCalled()
+  })
+
+  it('joins concurrent startup branches before closing their Store', async () => {
+    const failure = new Error('translations failed')
+    i18n.mockRejectedValueOnce(failure)
+    let release = () => {}
+    launch.mockImplementationOnce(
+      () =>
+        new Promise<void>((resolve) => {
+          release = resolve
+        })
+    )
+    const ready = initializeMainProcessReady(options)
+    const rejected = expect(ready).rejects.toBe(failure)
+    await vi.waitFor(() => expect(launch).toHaveBeenCalledOnce())
+    expect(state.store.freezeWritesAsync).not.toHaveBeenCalled()
+    release()
+    await rejected
+    expect(state.store.freezeWritesAsync).toHaveBeenCalledOnce()
+  })
+
+  it('keeps the original startup failure when cleanup also fails', async () => {
+    const log = vi.spyOn(console, 'error').mockImplementation(() => {})
+    const failure = new Error('foundation failed')
+    foundation.mockRejectedValueOnce(failure)
+    state.store.freezeWritesAsync.mockRejectedValueOnce(new Error('close failed'))
+    try {
+      await expect(initializeMainProcessReady(options)).rejects.toBe(failure)
+      expect(log).toHaveBeenCalledOnce()
+      expect(state.profileStateAdmission?.release).not.toHaveBeenCalled()
+    } finally {
+      log.mockRestore()
+    }
+  })
+})
diff --git a/src/main/startup/main-process-ready.ts b/src/main/startup/main-process-ready.ts
index 835c1f1dd13..7c27f73a465 100644
--- a/src/main/startup/main-process-ready.ts
+++ b/src/main/startup/main-process-ready.ts
@@ -2,6 +2,7 @@ import { initializeMainProcessI18nAndMenu } from './main-process-i18n-menu'
 import { mainProcessState as state } from './main-process-state'
 import { initializeReadyFoundation } from './main-process-ready-foundation'
 import { initializeReadyRuntimeServices } from './main-process-ready-runtime'
+import { releaseDesktopActivationAfter } from './serve-desktop-activation'
 import {
   initializeMainProcessRuntimeLaunch,
   type MainProcessRuntimeLaunchOptions
@@ -9,14 +10,44 @@ import {
 
 /** Runs the ready-phase composition in the same dependency order as the legacy entry point. */
 export async function initializeMainProcessReady(
-  options: MainProcessRuntimeLaunchOptions
+  launchOptions: MainProcessRuntimeLaunchOptions
 ): Promise<void> {
-  await initializeReadyFoundation()
-  await initializeReadyRuntimeServices()
-  // Why concurrent: window creation reads no translated string and no menu item, and both the
-  // native menu and the tray only become reachable once the window shows — so serializing them
-  // ahead of openMainWindow only delayed the renderer (8 ms in English, more for a lazy locale).
-  const i18nAndMenuReady = initializeMainProcessI18nAndMenu()
-  state.mainProcessI18nReady = i18nAndMenuReady.catch(() => {})
-  await Promise.all([i18nAndMenuReady, initializeMainProcessRuntimeLaunch(options)])
+  const options: MainProcessRuntimeLaunchOptions = {
+    ...launchOptions,
+    openMainWindow: releaseDesktopActivationAfter(
+      state.desktopActivationGate,
+      launchOptions.openMainWindow
+    )
+  }
+  try {
+    await initializeReadyFoundation()
+    await initializeReadyRuntimeServices()
+    // Window creation can proceed while translations and the native menu initialize.
+    const i18nAndMenuReady = initializeMainProcessI18nAndMenu()
+    state.mainProcessI18nReady = i18nAndMenuReady.catch(() => {})
+    // Join both branches before cleanup can close the profile writer.
+    const results = await Promise.allSettled([
+      i18nAndMenuReady,
+      initializeMainProcessRuntimeLaunch(options)
+    ])
+    for (const result of results) {
+      if (result.status === 'rejected') {
+        throw result.reason
+      }
+    }
+  } catch (error) {
+    // Startup now exits after failure; reopening would use a closing profile writer.
+    state.desktopActivationGate = null
+    try {
+      await state.store?.freezeWritesAsync()
+      state.profileStateAdmission?.release()
+      state.profileStateAdmission = undefined
+    } catch (closeError) {
+      console.error(
+        '[persistence] Failed to close profile persistence after startup failure:',
+        closeError
+      )
+    }
+    throw error
+  }
 }
diff --git a/src/main/startup/main-process-runtime-launch-activation.test.ts b/src/main/startup/main-process-runtime-launch-activation.test.ts
new file mode 100644
index 00000000000..42813af450e
--- /dev/null
+++ b/src/main/startup/main-process-runtime-launch-activation.test.ts
@@ -0,0 +1,232 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const electronApp = vi.hoisted(() => ({
+  isPackaged: false,
+  on: vi.fn(),
+  getPath: vi.fn(() => '/tmp/orca-user-data'),
+  getVersion: vi.fn(() => '0.0.0-test'),
+  isReady: vi.fn(() => true),
+  focus: vi.fn()
+}))
+const launchHooks = vi.hoisted(() => ({
+  duringInstallDirRepair: (): void => {},
+  failBeforeWindow: false
+}))
+
+vi.mock('electron', () => ({ app: electronApp, powerMonitor: { on: vi.fn() } }))
+vi.mock('@electron-toolkit/utils', () => ({ is: { dev: false } }))
+vi.mock('../orca-profiles/profile-cloud-auth-config', () => ({
+  getOrcaCloudAuthConfig: () => ({ configured: false })
+}))
+vi.mock('../orca-profiles/profile-storage-paths', () => ({ getProfileUserDataPath: vi.fn() }))
+vi.mock('../persistence', () => ({
+  getCanonicalUserDataPath: () => '/tmp/orca-user-data',
+  migrateMobilePairingDataToCanonicalUserDataPath: vi.fn()
+}))
+vi.mock('../runtime/runtime-rpc', () => ({
+  OrcaRuntimeRpcServer: class {
+    start = vi.fn(async () => {})
+    setOnUnpairedDeviceAuthFailure = vi.fn()
+  }
+}))
+vi.mock('../ipc/mobile', () => ({ registerMobileHandlers: vi.fn() }))
+vi.mock('../ipc/pty', () => ({
+  getLocalPtyProvider: vi.fn(),
+  registerHeadlessPtyRuntime: vi.fn()
+}))
+vi.mock('../providers/local-pty-provider', () => ({ LocalPtyProvider: class {} }))
+vi.mock('../browser/offscreen-browser-backend', () => ({ OffscreenBrowserBackend: class {} }))
+vi.mock('../browser/browser-manager', () => ({ browserManager: {} }))
+vi.mock('./main-process-relay-status', () => ({
+  getDesktopRelayStatus: vi.fn(),
+  publishDesktopRelayStatus: vi.fn()
+}))
+vi.mock('../runtime/relay/desktop-relay-service', () => ({ DesktopRelayService: class {} }))
+vi.mock('./main-process-serve', () => ({
+  getServeOptions: vi.fn(() => null),
+  getBundledWebClientRoot: vi.fn(() => null),
+  printServeReady: vi.fn()
+}))
+vi.mock('./main-process-pty-startup', () => ({
+  bindTerminalRuntimeStartupServices: vi.fn(),
+  handleCodexHomePtySpawned: vi.fn(),
+  handlePtyExit: vi.fn(),
+  startTerminalRuntimeStartupServices: vi.fn(() => ({}))
+}))
+vi.mock('./codex-launch-preparation', () => ({ prepareCodexRuntimeHomeForLaunch: vi.fn() }))
+vi.mock('./codex-session-resume-launch', () => ({ prepareCodexSessionResumeForLaunch: vi.fn() }))
+vi.mock('./windows-install-dir-acl-recovery', () => ({
+  // The awaited gap before the first window, where a second-instance launch can land.
+  repairKnownPoisonedInstallDirBeforeWindow: vi.fn(async () => {
+    launchHooks.duringInstallDirRepair()
+    if (launchHooks.failBeforeWindow) {
+      throw new Error('install-dir repair failed')
+    }
+    return 'not-marked'
+  })
+}))
+vi.mock('./serve-signal-handlers', () => ({ registerServeSignalHandlers: vi.fn() }))
+vi.mock('../runtime/runtime-rpc-startup-failure', () => ({
+  recordRuntimeRpcStartFailure: vi.fn(),
+  showRuntimeRpcStartupFailureDialog: vi.fn()
+}))
+vi.mock('../cli/cli-installer', () => ({ CliInstaller: class {} }))
+vi.mock('../cli/linux-bare-orca-dispatcher', () => ({ installLinuxBareOrcaDispatcher: vi.fn() }))
+vi.mock('../terminal-history-deletion', () => ({ scheduleAllPendingHistoryTreeRemovals: vi.fn() }))
+vi.mock('../ipc/startup-notification-registration', () => ({
+  triggerStartupNotificationRegistration: vi.fn()
+}))
+vi.mock('./main-process-push-startup', () => ({ startDesktopPushService: vi.fn() }))
+vi.mock('./startup-diagnostics', () => ({ logStartupMilestone: vi.fn() }))
+vi.mock('../server/serve-stdout-boundary', () => ({ emitServeBrowserIdentityActionLine: vi.fn() }))
+vi.mock('../browser/browser-identity-mode-store', () => ({
+  getBrowserIdentityModeStatus: vi.fn()
+}))
+const showWindowWithoutStealingFocus = vi.hoisted(() => vi.fn())
+vi.mock('../window/foreground-activation-policy', () => ({
+  isBackgroundLaunch: () => true,
+  isWindowlessLaunch: () => false,
+  showWindowWithoutStealingFocus
+}))
+
+vi.mock('./main-process-ready-foundation', () => ({
+  initializeReadyFoundation: vi.fn(async () => {})
+}))
+vi.mock('./main-process-ready-runtime', () => ({
+  initializeReadyRuntimeServices: vi.fn(async () => {})
+}))
+vi.mock('./main-process-i18n-menu', () => ({
+  initializeMainProcessI18nAndMenu: vi.fn(async () => {})
+}))
+
+const { initializeMainProcessReady } = await import('./main-process-ready')
+const { mainProcessState: state } = await import('./main-process-state')
+const { createServeDesktopActivationGate } = await import('./serve-desktop-activation')
+const { focusExistingMainWindow } = await import('../window/focus-existing-window')
+
+type FakeWindow = {
+  id: number
+  webContents: { id: number }
+  isDestroyed: () => boolean
+  isMinimized: () => boolean
+  restore: () => void
+  once: () => void
+}
+
+const originalPlatform = process.platform
+
+describe('desktop startup activation', () => {
+  let windows: FakeWindow[]
+  let ipcHandles: Set<string>
+  let trustedRendererId: number | null
+
+  // Mirrors openMainWindow's non-idempotent side effects that broke in the field.
+  function openMainWindow(): FakeWindow {
+    const id = windows.length + 1
+    const window: FakeWindow = {
+      id,
+      webContents: { id },
+      isDestroyed: () => false,
+      isMinimized: () => false,
+      restore: vi.fn(),
+      once: vi.fn()
+    }
+    windows.push(window)
+    trustedRendererId = id
+    if (ipcHandles.has('window:isMaximized')) {
+      throw new Error("Attempted to register a second handler for 'window:isMaximized'")
+    }
+    ipcHandles.add('window:isMaximized')
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the launch only reads the fields FakeWindow provides.
+    state.mainWindow = window as unknown as NonNullable<typeof state.mainWindow>
+    return window
+  }
+
+  beforeEach(() => {
+    windows = []
+    showWindowWithoutStealingFocus.mockClear()
+    ipcHandles = new Set()
+    trustedRendererId = null
+    launchHooks.duringInstallDirRepair = () => {}
+    launchHooks.failBeforeWindow = false
+    state.mainWindow = null
+    state.isServeMode = false
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the launch only null-checks the runtime before the mocked RPC server takes it.
+    state.runtime = {} as NonNullable<typeof state.runtime>
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the launch only calls whenReady().
+    state.windowsShellPathHydration = {
+      whenReady: () => Promise.resolve()
+    } as unknown as NonNullable<typeof state.windowsShellPathHydration>
+    state.initialProxyApplicationReady = Promise.resolve()
+    // Built the way preflight builds it for a desktop launch.
+    state.desktopActivationGate = createServeDesktopActivationGate({
+      initialState: 'initializing',
+      activateWindow: () =>
+        focusExistingMainWindow({
+          app: electronApp,
+          getWindow: () => state.mainWindow,
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: focusExistingMainWindow only calls the FakeWindow methods.
+          openWindow: () => openMainWindow() as unknown as NonNullable<typeof state.mainWindow>
+        })
+    })
+  })
+
+  afterEach(() => {
+    Object.defineProperty(process, 'platform', { value: originalPlatform })
+    electronApp.isPackaged = false
+  })
+
+  it.each([
+    ['darwin', false],
+    ['linux', false],
+    ['win32', true]
+  ] as const)(
+    'focuses the startup window when a second instance lands before it exists (%s)',
+    async (platform, isPackaged) => {
+      Object.defineProperty(process, 'platform', { value: platform })
+      electronApp.isPackaged = isPackaged
+      launchHooks.duringInstallDirRepair = () => state.desktopActivationGate?.requestActivation()
+
+      await initializeMainProcessReady({
+        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the launch only calls once() on the returned window.
+        openMainWindow: () => openMainWindow() as unknown as NonNullable<typeof state.mainWindow>,
+        handleMacAppActivation: vi.fn()
+      })
+
+      expect(windows).toHaveLength(1)
+      expect(trustedRendererId).toBe(windows[0].id)
+      expect(state.mainWindow).toBe(windows[0])
+      expect(showWindowWithoutStealingFocus).toHaveBeenCalledWith(windows[0])
+      expect(state.desktopActivationGate?.getState()).toBe('ready')
+    }
+  )
+
+  it('does not replay an activation when launch fails before the startup window', async () => {
+    launchHooks.duringInstallDirRepair = () => state.desktopActivationGate?.requestActivation()
+    launchHooks.failBeforeWindow = true
+
+    await expect(
+      initializeMainProcessReady({
+        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the launch only calls once() on the returned window.
+        openMainWindow: () => openMainWindow() as unknown as NonNullable<typeof state.mainWindow>,
+        handleMacAppActivation: vi.fn()
+      })
+    ).rejects.toThrow('install-dir repair failed')
+
+    expect(windows).toHaveLength(0)
+    expect(state.desktopActivationGate).toBeNull()
+  })
+
+  it('holds every launch mode behind the gate until startup settles it', () => {
+    const preflightSource = readFileSync(
+      join(process.cwd(), 'src/main/startup/main-process-preflight.ts'),
+      'utf8'
+    )
+    expect(preflightSource).toContain("initialState: 'initializing',")
+    expect(preflightSource).not.toContain(
+      "initialState: state.isServeMode ? 'initializing' : 'ready'"
+    )
+  })
+})
diff --git a/src/main/startup/main-process-runtime-launch.ts b/src/main/startup/main-process-runtime-launch.ts
index 858c6b75786..b3df23e5861 100644
--- a/src/main/startup/main-process-runtime-launch.ts
+++ b/src/main/startup/main-process-runtime-launch.ts
@@ -208,7 +208,7 @@ async function launchServeMode(
   state.automations?.start()
   // Why: serve deletes worktrees too, and the history GC that normally drains delete tombstones is
   // armed from the main window — without this, a quit mid-removal leaks the tree until a desktop launch.
-  scheduleAllPendingHistoryTreeRemovals()
+  void scheduleAllPendingHistoryTreeRemovals()
   emitServeBrowserIdentityActionLine(getBrowserIdentityModeStatus())
   await printServeReady(serveOptions)
 }
diff --git a/src/main/startup/main-process-runtime-service.ts b/src/main/startup/main-process-runtime-service.ts
index 20ea8262c9a..a000c57760a 100644
--- a/src/main/startup/main-process-runtime-service.ts
+++ b/src/main/startup/main-process-runtime-service.ts
@@ -131,11 +131,8 @@ export function initializeMainProcessRuntime(): OrcaRuntimeService {
         runtimeHome: state.codexRuntimeHome,
         systemCodexHomePath: resolveHostCodexSessionSourceHome(store.getSettings())
       }),
-    prepareCodexStructuredLaunch: ({ workspacePath, launchEnv }) =>
-      prepareCodexRuntimeHomeForLaunch(undefined, launchEnv, {
-        launchAgent: 'codex',
-        workspacePath
-      }),
+    prepareCodexStructuredLaunch: ({ launchEnv }) =>
+      prepareCodexRuntimeHomeForLaunch(undefined, launchEnv),
     // Why throw like prepare does: a null from an uninitialized service would
     // map to the system home and key a catalog read to the wrong account.
     resolveCodexStructuredLaunchHome: ({ launchEnv }) => {
diff --git a/src/main/startup/main-process-state.ts b/src/main/startup/main-process-state.ts
index 49f86136e89..f6e86423029 100644
--- a/src/main/startup/main-process-state.ts
+++ b/src/main/startup/main-process-state.ts
@@ -45,6 +45,23 @@ import {
 } from '../crash-reporting/gpu-crash-fallback-decision'
 import type { GpuCrashDiagnosticsRecorder } from '../crash-reporting/gpu-crash-diagnostics'
 import { createWebContentsTimedFlag } from './web-contents-timed-flag'
+import type { ProfileStateStorageClassification } from '../persistence/profile-state/profile-state-storage-classification'
+import type { ProfileStateRuntimeAdmission } from '../persistence/profile-state/profile-state-access'
+
+export type ProfileStateStartupMetadata = {
+  backend: 'sqlite'
+  classification: ProfileStateStorageClassification
+  runtime: 'desktop' | 'orcad'
+  migrated: boolean
+}
+
+function createInitialProfileStateStartup(): ProfileStateStartupMetadata | null {
+  return null
+}
+
+function createInitialProfileStateAdmission(): ProfileStateRuntimeAdmission | undefined {
+  return undefined
+}
 
 /** Mutable composition-root state shared by startup, window, serve, and quit phases. */
 export const mainProcessState = {
@@ -52,6 +69,8 @@ export const mainProcessState = {
   /** Whether a manual app.quit() (Cmd+Q) is in progress; lets the close handler skip the running-process confirmation and go straight to close. */
   isQuitting: false,
   store: null as Store | null,
+  profileStateStartup: createInitialProfileStateStartup(),
+  profileStateAdmission: createInitialProfileStateAdmission(),
   stats: null as StatsCollector | null,
   claudeUsage: null as ClaudeUsageStore | null,
   codexUsage: null as CodexUsageStore | null,
diff --git a/src/main/startup/main-window-agent-status.ts b/src/main/startup/main-window-agent-status.ts
index 5899b2fe6bd..38bb380d724 100644
--- a/src/main/startup/main-window-agent-status.ts
+++ b/src/main/startup/main-window-agent-status.ts
@@ -35,6 +35,7 @@ export function installMainWindowAgentStatusListeners(options: MainWindowAgentSt
       receivedAt,
       evidenceObservedAt,
       stateStartedAt,
+      turnStartedAt,
       launchToken,
       providerSession,
       providerSessionOnly,
@@ -89,6 +90,7 @@ export function installMainWindowAgentStatusListeners(options: MainWindowAgentSt
         receivedAt,
         ...(evidenceObservedAt !== undefined ? { evidenceObservedAt } : {}),
         stateStartedAt,
+        ...(turnStartedAt !== undefined ? { turnStartedAt } : {}),
         ...(providerSession ? { providerSession } : {}),
         ...(promptInteractionKey ? { promptInteractionKey } : {}),
         ...(restoredUnconfirmed ? { restoredUnconfirmed: true } : {}),
diff --git a/src/main/startup/main-window-core-services.test.ts b/src/main/startup/main-window-core-services.test.ts
new file mode 100644
index 00000000000..50d0bd49db5
--- /dev/null
+++ b/src/main/startup/main-window-core-services.test.ts
@@ -0,0 +1,114 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  attachMainWindowServicesMock,
+  initTccPromptNoticeMock,
+  preserveAgentAuthBeforeRestartMock,
+  registerCoreHandlersMock,
+  state,
+  store
+} = vi.hoisted(() => {
+  const store = {
+    writeLatestProfileStateJsonCompatibilityExportAsync: vi.fn(async () => {}),
+    writeLatestProfileStateJsonExportAsync: vi.fn(async () => {}),
+    getSettings: vi.fn(() => ({}))
+  }
+  return {
+    attachMainWindowServicesMock: vi.fn(),
+    initTccPromptNoticeMock: vi.fn(),
+    preserveAgentAuthBeforeRestartMock: vi.fn(() => Promise.resolve()),
+    registerCoreHandlersMock: vi.fn(),
+    state: {
+      store,
+      runtime: {},
+      stats: {},
+      claudeUsage: {},
+      codexUsage: {},
+      openCodeUsage: {},
+      museUsage: {},
+      codexAccounts: {},
+      claudeAccounts: {},
+      rateLimits: { attach: vi.fn(), start: vi.fn() },
+      automations: { setWebContents: vi.fn(), start: vi.fn() },
+      keybindings: {},
+      codexRuntimeHome: {},
+      claudeRuntimeAuth: { prepareForClaudeLaunch: vi.fn() },
+      agentAwakeService: null,
+      crashReports: null,
+      pluginService: null,
+      pluginMarketplaceService: null,
+      pluginMarketplaceInstaller: null,
+      desktopRelayService: null,
+      isServeMode: false,
+      localPtyStartupReady: Promise.resolve(),
+      localPtyProviderStartupReady: Promise.resolve()
+    },
+    store
+  }
+})
+
+vi.mock('../ipc/register-core-handlers/register-core-handlers', () => ({
+  registerCoreHandlers: registerCoreHandlersMock
+}))
+vi.mock('../window/attach-main-window-services', () => ({
+  attachMainWindowServices: attachMainWindowServicesMock
+}))
+vi.mock('../macos-tcc-prompt-notice', () => ({ initTccPromptNotice: initTccPromptNoticeMock }))
+vi.mock('../updater', () => ({ resolveUpdateInstallMode: vi.fn(() => 'interactive') }))
+vi.mock('./main-process-state', () => ({ mainProcessState: state }))
+vi.mock('../agent-auth-restart-preservation', () => ({
+  preserveAgentAuthBeforeRestart: preserveAgentAuthBeforeRestartMock
+}))
+vi.mock('../codex/codex-ai-vault-session-resume', () => ({
+  prepareCodexAiVaultSessionResume: vi.fn()
+}))
+vi.mock('../codex/codex-session-source-home', () => ({
+  resolveHostCodexSessionSourceHome: vi.fn()
+}))
+vi.mock('./main-process-pty-startup', () => ({
+  emitPluginWorktreeLifecycle: vi.fn(),
+  handleCodexHomePtySpawned: vi.fn(),
+  handlePtyExit: vi.fn()
+}))
+vi.mock('./codex-launch-preparation', () => ({ prepareCodexRuntimeHomeForLaunch: vi.fn() }))
+vi.mock('./codex-session-resume-launch', () => ({ prepareCodexSessionResumeForLaunch: vi.fn() }))
+vi.mock('./main-window-lifecycle-flags', () => ({ isRecoveryReloadInFlight: vi.fn() }))
+
+const { attachMainWindowCoreServices } = await import('./main-window-core-services')
+
+describe('main window profile-state update preparation', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('publishes both recovery forms with one profile checkpoint before an update quit', async () => {
+    const window = { webContents: { id: 17 } }
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: mocked BrowserWindow only needs webContents for this composition-root wiring test.
+    attachMainWindowCoreServices(window as never, {
+      markExpectedRendererReload: vi.fn(),
+      recordRendererReload: vi.fn()
+    })
+
+    const options = attachMainWindowServicesMock.mock.calls[0]?.[5]
+    if (
+      typeof options !== 'object' ||
+      options === null ||
+      !('onBeforeUpdateQuit' in options) ||
+      typeof options.onBeforeUpdateQuit !== 'function'
+    ) {
+      throw new Error('Expected update quit cleanup to be wired')
+    }
+
+    await options.onBeforeUpdateQuit()
+
+    expect(preserveAgentAuthBeforeRestartMock).toHaveBeenCalledWith({
+      codexRuntimeHome: state.codexRuntimeHome,
+      claudeRuntimeAuth: state.claudeRuntimeAuth,
+      store
+    })
+    expect(store.writeLatestProfileStateJsonExportAsync).not.toHaveBeenCalled()
+    expect(store.writeLatestProfileStateJsonCompatibilityExportAsync).toHaveBeenCalledOnce()
+    expect(options).toHaveProperty('onBeforeUpdateQuitFailure', 'abort')
+  })
+})
diff --git a/src/main/startup/main-window-core-services.ts b/src/main/startup/main-window-core-services.ts
index 8f9ef2118df..c292a4455c7 100644
--- a/src/main/startup/main-window-core-services.ts
+++ b/src/main/startup/main-window-core-services.ts
@@ -126,8 +126,11 @@ export function attachMainWindowCoreServices(
       isRecoveryReloadInFlight,
       onCodexHomePtySpawned: handleCodexHomePtySpawned,
       onPtyExit: handlePtyExit,
-      onBeforeUpdateQuit: () =>
-        preserveAgentAuthBeforeRestart({ codexRuntimeHome, claudeRuntimeAuth, store }),
+      onBeforeUpdateQuit: async () => {
+        await preserveAgentAuthBeforeRestart({ codexRuntimeHome, claudeRuntimeAuth, store })
+        await store.writeLatestProfileStateJsonCompatibilityExportAsync()
+      },
+      onBeforeUpdateQuitFailure: 'abort',
       updateInstallMode: resolveUpdateInstallMode(state.isServeMode),
       onWorktreeLifecycle: emitPluginWorktreeLifecycle
     }
diff --git a/src/main/startup/main-window-structured-status-filter.test.ts b/src/main/startup/main-window-structured-status-filter.test.ts
index c7fe55da626..da26a593d00 100644
--- a/src/main/startup/main-window-structured-status-filter.test.ts
+++ b/src/main/startup/main-window-structured-status-filter.test.ts
@@ -94,3 +94,11 @@ it('forwards retirement acknowledgement only on live status delivery', () => {
   expect(sent[0].event).toHaveProperty('authorityRestartId', 'retirement-id')
   expect(sent[1].event).not.toHaveProperty('authorityRestartId')
 })
+
+// The live push picks fields one by one; the host's turn start must be one of them.
+it("forwards the host's turn start, and nothing when the host stamped none", () => {
+  hooks.listener!(statusPayload({ turnStartedAt: 1 }))
+  hooks.listener!(statusPayload({}))
+  expect(sent[0].event).toHaveProperty('turnStartedAt', 1)
+  expect(sent[1].event).not.toHaveProperty('turnStartedAt')
+})
diff --git a/src/main/startup/pre-gone-crash-sampling-wiring.test.ts b/src/main/startup/pre-gone-crash-sampling-wiring.test.ts
index 2a8e008c0b3..292645f874f 100644
--- a/src/main/startup/pre-gone-crash-sampling-wiring.test.ts
+++ b/src/main/startup/pre-gone-crash-sampling-wiring.test.ts
@@ -44,6 +44,8 @@ describe('pre-gone crash sampling startup wiring', () => {
     expect(readySource).toContain(
       "import { initializeReadyRuntimeServices } from './main-process-ready-runtime'"
     )
-    expect(readySource).toContain('\n  await initializeReadyRuntimeServices()')
+    expect(readySource).toContain(
+      'try {\n    await initializeReadyFoundation()\n    await initializeReadyRuntimeServices()'
+    )
   })
 })
diff --git a/src/main/startup/profile-state-recovery-preflight.test.ts b/src/main/startup/profile-state-recovery-preflight.test.ts
new file mode 100644
index 00000000000..0170025ff21
--- /dev/null
+++ b/src/main/startup/profile-state-recovery-preflight.test.ts
@@ -0,0 +1,342 @@
+import type * as NodeFs from 'node:fs'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  PROFILE_STATE_DESKTOP_RECOVERY_FLAG,
+  PROFILE_STATE_RECOVERY_FLAG,
+  PROFILE_STATE_RECOVERY_RESULT_PREFIX
+} from '../../shared/profile-state-recovery-command'
+import { acquireProfileStateRuntimeAdmission } from '../persistence/profile-state/profile-state-access'
+import { profileStateJsonExportPath } from '../persistence/profile-state/legacy-json/profile-state-export-path'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath
+} from '../persistence/profile-state/profile-state-backup-path'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from '../persistence/profile-state/profile-state-database'
+import {
+  importProfileStateJson,
+  readProfileStateSnapshot
+} from '../persistence/profile-state/profile-state-documents'
+import { writeProfileStateDatabaseSnapshotAsync } from '../persistence/profile-state/profile-state-database-snapshot'
+import * as marker from './http1-compatibility-marker'
+import {
+  profileStateDesktopRecoveryArgs,
+  runProfileStateRecoveryPreflight
+} from './profile-state-recovery-preflight'
+
+const mocks = vi.hoisted(() => ({
+  setPath: vi.fn(),
+  requestSingleInstanceLock: vi.fn(),
+  on: vi.fn(),
+  exit: vi.fn(),
+  relaunch: vi.fn(),
+  whenReady: vi.fn(),
+  showMessageBox: vi.fn(),
+  background: vi.fn(),
+  output: vi.fn()
+}))
+vi.mock('electron', () => ({
+  app: mocks,
+  dialog: { showMessageBox: mocks.showMessageBox }
+}))
+vi.mock('../window/foreground-activation-policy', () => ({
+  applyBackgroundActivationPolicy: mocks.background
+}))
+vi.mock('node:fs', async (original) => {
+  const fs = await original<typeof NodeFs>()
+  return {
+    ...fs,
+    writeFileSync: (...args: Parameters<typeof fs.writeFileSync>) => {
+      if (args[0] === 1) {
+        mocks.output(args[1])
+        return
+      }
+      return fs.writeFileSync(...args)
+    }
+  }
+})
+
+const roots: string[] = []
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.requestSingleInstanceLock.mockReturnValue(true)
+  mocks.whenReady.mockResolvedValue(undefined)
+  mocks.showMessageBox.mockResolvedValue({ response: 0 })
+  vi.stubEnv('ORCA_USER_DATA_PATH', '/stale/inherited/root')
+  vi.stubEnv('ORCA_BYPASS_SINGLE_INSTANCE_LOCK', '1')
+  vi.stubEnv('ORCA_E2E_ENFORCE_SINGLE_INSTANCE_LOCK', '0')
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.unstubAllEnvs()
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const root = realpathSync(mkdtempSync(join(tmpdir(), 'orca-recovery-bridge-')))
+  roots.push(root)
+  const profileId = 'bridge-profile'
+  const directory = join(root, 'profiles', profileId)
+  mkdirSync(directory, { recursive: true })
+  writeFileSync(
+    join(root, 'orca-profile-index.json'),
+    JSON.stringify({ activeProfileId: profileId, profiles: [{ id: profileId }] })
+  )
+  const dataFile = join(directory, 'orca-data.json')
+  const databaseFile = join(directory, 'profile-state.db')
+  const exportFile = profileStateJsonExportPath(dataFile, 1)
+  const restored = {
+    settings: { electronHttp1CompatibilityMode: true },
+    unknown: { sealed: 'unchanged', missing: null }
+  }
+  writeFileSync(dataFile, JSON.stringify({ old: true }))
+  writeFileSync(databaseFile, 'broken database')
+  writeFileSync(exportFile, JSON.stringify(restored))
+  const argv = [
+    'Orca',
+    '--serve',
+    PROFILE_STATE_RECOVERY_FLAG,
+    JSON.stringify({ userDataPath: root, selector: { kind: 'json', revision: 1 } })
+  ]
+  return { root, profileId, dataFile, databaseFile, exportFile, restored, argv }
+}
+
+function response(): unknown {
+  const output: unknown = mocks.output.mock.calls[0]?.[0]
+  expect(typeof output).toBe('string')
+  if (typeof output !== 'string') {
+    throw new Error('Missing response')
+  }
+  return JSON.parse(output.slice(PROFILE_STATE_RECOVERY_RESULT_PREFIX.length))
+}
+
+describe('Electron recovery preflight', () => {
+  it('runs the recovery branch before CLI redirect or ordinary startup admission', () => {
+    const source = readFileSync(
+      join(process.cwd(), 'src/main/startup/main-process-preflight.ts'),
+      'utf8'
+    )
+    const start = source.indexOf('export function runMainProcessPreflight(')
+    const recovery = source.indexOf('if (runProfileStateRecoveryPreflight())', start)
+    const redirect = source.indexOf('const cliLaunchRedirect = maybeRedirectCliLaunch(', start)
+    const admission = source.indexOf('acquireProfileStateRuntimeAdmission(', start)
+    expect(start).toBeGreaterThanOrEqual(0)
+    expect(recovery).toBeGreaterThan(start)
+    expect(redirect).toBeGreaterThan(recovery)
+    expect(admission).toBeGreaterThan(redirect)
+    expect(source.slice(recovery, redirect)).toContain('return false')
+  })
+
+  it('leaves ordinary startup untouched', () => {
+    expect(runProfileStateRecoveryPreflight(['Orca', '--serve'])).toBe(false)
+    expect(mocks.background).not.toHaveBeenCalled()
+    expect(mocks.setPath).not.toHaveBeenCalled()
+    expect(mocks.exit).not.toHaveBeenCalled()
+  })
+
+  it.each(['json', 'current-json'] as const)(
+    'restores %s under both locks despite ordinary singleton bypasses',
+    (kind) => {
+      const item = fixture()
+      if (kind === 'current-json') {
+        writeFileSync(item.dataFile, JSON.stringify(item.restored))
+        item.argv[3] = JSON.stringify({ userDataPath: item.root, selector: { kind } })
+      }
+      mocks.requestSingleInstanceLock.mockImplementation(() => {
+        expect(mocks.setPath).toHaveBeenCalledWith('userData', item.root)
+        expect(() => acquireProfileStateRuntimeAdmission(item.root)).toThrow()
+        expect(readFileSync(item.databaseFile, 'utf8')).toBe('broken database')
+        return true
+      })
+      expect(runProfileStateRecoveryPreflight(item.argv)).toBe(true)
+      expect(process.env.ORCA_USER_DATA_PATH).toBe(item.root)
+      expect(process.env.ORCA_BACKGROUND_LAUNCH).toBe('1')
+      expect(mocks.background).toHaveBeenCalledOnce()
+      expect(mocks.requestSingleInstanceLock).toHaveBeenCalledOnce()
+      expect(response()).toMatchObject({
+        ok: true,
+        result: {
+          storage: 'json',
+          revision: kind === 'json' ? 1 : null,
+          restoredPath: item.dataFile
+        }
+      })
+      expect(JSON.parse(readFileSync(item.dataFile, 'utf8'))).toEqual(item.restored)
+      expect(existsSync(item.databaseFile)).toBe(false)
+      expect(existsSync(item.exportFile)).toBe(false)
+      expect(mocks.exit).toHaveBeenCalledWith(0)
+      const runtime = acquireProfileStateRuntimeAdmission(item.root)
+      runtime.release()
+    }
+  )
+
+  it('refuses an old native singleton owner without modifying authority or exports', () => {
+    const item = fixture()
+    mocks.requestSingleInstanceLock.mockReturnValue(false)
+    expect(runProfileStateRecoveryPreflight(item.argv)).toBe(true)
+    expect(response()).toMatchObject({
+      ok: false,
+      code: 'runtime_error',
+      message: expect.stringContaining('Stop Orca')
+    })
+    expect(readFileSync(item.databaseFile, 'utf8')).toBe('broken database')
+    expect(JSON.parse(readFileSync(item.dataFile, 'utf8'))).toEqual({ old: true })
+    expect(existsSync(item.exportFile)).toBe(true)
+    expect(mocks.exit).toHaveBeenCalledWith(1)
+    const runtime = acquireProfileStateRuntimeAdmission(item.root)
+    runtime.release()
+  })
+
+  it('exits quietly when the CLI closes its response pipe after a successful restore', () => {
+    const item = fixture()
+    mocks.output.mockImplementationOnce(() => {
+      throw new Error('EPIPE')
+    })
+    expect(() => runProfileStateRecoveryPreflight(item.argv)).not.toThrow()
+    expect(JSON.parse(readFileSync(item.dataFile, 'utf8'))).toEqual(item.restored)
+    expect(mocks.exit).toHaveBeenCalledWith(1)
+    const runtime = acquireProfileStateRuntimeAdmission(item.root)
+    runtime.release()
+  })
+
+  it('restores a real SQLite backup and retains root exclusion through marker publication', async () => {
+    const item = fixture()
+    rmSync(item.databaseFile)
+    const source = openProfileStateDatabase(item.databaseFile, item.profileId)
+    const backupId = createProfileStateDatabaseBackupId()
+    const backupFile = profileStateDatabaseBackupPath(item.databaseFile, backupId)
+    try {
+      importProfileStateJson(source.db, JSON.stringify(item.restored))
+      await writeProfileStateDatabaseSnapshotAsync(source.db, backupFile)
+      importProfileStateJson(source.db, JSON.stringify({ newer: true }), { expectedRevision: 1 })
+    } finally {
+      source.db.close()
+    }
+    const markerWrite = marker.writeHttp1CompatibilityMarker
+    const write = vi
+      .spyOn(marker, 'writeHttp1CompatibilityMarker')
+      .mockImplementation((...args) => {
+        expect(() => acquireProfileStateRuntimeAdmission(item.root)).toThrow()
+        expect(mocks.requestSingleInstanceLock).toHaveBeenCalledOnce()
+        markerWrite(...args)
+      })
+    const argv = [
+      'Orca',
+      '--serve',
+      PROFILE_STATE_RECOVERY_FLAG,
+      JSON.stringify({ userDataPath: item.root, selector: { kind: 'sqlite', backupId } })
+    ]
+    expect(runProfileStateRecoveryPreflight(argv)).toBe(true)
+    expect(response()).toMatchObject({
+      ok: true,
+      result: { storage: 'sqlite', backupId, revision: 1 }
+    })
+    expect(write).toHaveBeenCalledWith(item.root, true, item.profileId)
+    expect(existsSync(item.dataFile)).toBe(false)
+    expect(existsSync(backupFile)).toBe(true)
+    const restored = openProfileStateDatabaseReadOnly(item.databaseFile, item.profileId)
+    try {
+      expect(JSON.parse(readProfileStateSnapshot(restored.db).json)).toEqual(item.restored)
+    } finally {
+      restored.db.close()
+    }
+    expect(mocks.exit).toHaveBeenCalledWith(0)
+  })
+
+  it('refuses a participating Node runtime before asking for the Electron lock', () => {
+    const item = fixture()
+    const runtime = acquireProfileStateRuntimeAdmission(item.root)
+    try {
+      expect(runProfileStateRecoveryPreflight(item.argv)).toBe(true)
+      expect(response()).toMatchObject({ ok: false, code: 'runtime_error' })
+      expect(mocks.requestSingleInstanceLock).not.toHaveBeenCalled()
+      expect(existsSync(item.exportFile)).toBe(true)
+    } finally {
+      runtime.release()
+    }
+  })
+
+  it.each([
+    ['Orca', PROFILE_STATE_RECOVERY_FLAG, '{}'],
+    ['Orca', '--serve', PROFILE_STATE_RECOVERY_FLAG],
+    ['Orca', '--serve', PROFILE_STATE_RECOVERY_FLAG, '{}'],
+    [
+      'Orca',
+      '--serve',
+      PROFILE_STATE_RECOVERY_FLAG,
+      JSON.stringify({ userDataPath: 'relative', selector: { kind: 'json', revision: 1 } })
+    ],
+    ['Orca', '--serve', PROFILE_STATE_RECOVERY_FLAG, '{}', PROFILE_STATE_RECOVERY_FLAG, '{}']
+  ])('fails closed for malformed launch %j', (...argv) => {
+    expect(runProfileStateRecoveryPreflight(argv)).toBe(true)
+    expect(response()).toMatchObject({ ok: false })
+    expect(mocks.setPath).not.toHaveBeenCalled()
+    expect(mocks.requestSingleInstanceLock).not.toHaveBeenCalled()
+    expect(mocks.exit).toHaveBeenCalledWith(1)
+  })
+
+  describe('desktop choice relaunch', () => {
+    function desktopArgv(item: ReturnType<typeof fixture>) {
+      writeFileSync(item.dataFile, JSON.stringify(item.restored))
+      return [
+        'Orca',
+        ...profileStateDesktopRecoveryArgs(['Orca', '--inspect', 'orca://share/1'], {
+          userDataPath: item.root,
+          selector: { kind: 'current-json' }
+        })
+      ]
+    }
+
+    it('applies the choice without writing a CLI response, then relaunches ordinary startup', () => {
+      const item = fixture()
+      expect(runProfileStateRecoveryPreflight(desktopArgv(item))).toBe(true)
+      expect(JSON.parse(readFileSync(item.dataFile, 'utf8'))).toEqual(item.restored)
+      expect(existsSync(item.databaseFile)).toBe(false)
+      expect(mocks.output).not.toHaveBeenCalled()
+      expect(mocks.background).not.toHaveBeenCalled()
+      expect(mocks.relaunch).toHaveBeenCalledWith({ args: ['--inspect', 'orca://share/1'] })
+      expect(mocks.exit).toHaveBeenCalledWith(0)
+      acquireProfileStateRuntimeAdmission(item.root).release()
+    })
+
+    it('reports a failed choice instead of relaunching', async () => {
+      const item = fixture()
+      mocks.requestSingleInstanceLock.mockReturnValue(false)
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      expect(runProfileStateRecoveryPreflight(desktopArgv(item))).toBe(true)
+      await vi.waitFor(() => expect(mocks.exit).toHaveBeenCalledWith(1))
+      expect(mocks.relaunch).not.toHaveBeenCalled()
+      expect(mocks.showMessageBox).toHaveBeenCalledWith(
+        expect.objectContaining({ detail: expect.stringContaining('Stop Orca') })
+      )
+      expect(readFileSync(item.databaseFile, 'utf8')).toBe('broken database')
+    })
+
+    it.each([
+      ['Orca', PROFILE_STATE_DESKTOP_RECOVERY_FLAG, '{}'],
+      ['Orca', '--serve', PROFILE_STATE_DESKTOP_RECOVERY_FLAG, '{}'],
+      ['Orca', PROFILE_STATE_DESKTOP_RECOVERY_FLAG, '{}', PROFILE_STATE_RECOVERY_FLAG, '{}']
+    ])('fails closed for malformed desktop launch %j', async (...argv) => {
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      expect(runProfileStateRecoveryPreflight(argv)).toBe(true)
+      await vi.waitFor(() => expect(mocks.exit).toHaveBeenCalledWith(1))
+      expect(mocks.setPath).not.toHaveBeenCalled()
+      expect(mocks.relaunch).not.toHaveBeenCalled()
+    })
+  })
+})
diff --git a/src/main/startup/profile-state-recovery-preflight.ts b/src/main/startup/profile-state-recovery-preflight.ts
new file mode 100644
index 00000000000..7629f6241b9
--- /dev/null
+++ b/src/main/startup/profile-state-recovery-preflight.ts
@@ -0,0 +1,151 @@
+import { writeFileSync, realpathSync } from 'node:fs'
+import { isAbsolute } from 'node:path'
+import { app, dialog } from 'electron'
+import {
+  PROFILE_STATE_DESKTOP_RECOVERY_FLAG,
+  PROFILE_STATE_RECOVERY_FLAG,
+  PROFILE_STATE_RECOVERY_RESULT_PREFIX,
+  ProfileStateRecoveryCommandError,
+  isProfileStateRecoveryCommandError,
+  profileStateRecoveryRequestSchema,
+  type ProfileStateRecoveryResponse
+} from '../../shared/profile-state-recovery-command'
+import { acquireProfileStateMaintenance } from '../persistence/profile-state/profile-state-access'
+import { rollbackProfileState } from '../persistence/profile-state/profile-state-recovery-command'
+import { applyBackgroundActivationPolicy } from '../window/foreground-activation-policy'
+import { acquireSingleInstanceLock } from './single-instance-lock'
+
+/** The process owning both locks performs recovery before Electron can initialize a runtime. */
+export function runProfileStateRecoveryPreflight(argv: readonly string[] = process.argv): boolean {
+  if (argv.includes(PROFILE_STATE_DESKTOP_RECOVERY_FLAG)) {
+    runDesktopRecovery(argv)
+    return true
+  }
+  const index = argv.indexOf(PROFILE_STATE_RECOVERY_FLAG)
+  if (index === -1) {
+    return false
+  }
+  process.env.ORCA_BACKGROUND_LAUNCH = '1'
+  applyBackgroundActivationPolicy()
+  const response =
+    !argv.includes('--serve') || argv.lastIndexOf(PROFILE_STATE_RECOVERY_FLAG) !== index
+      ? invalidLaunch()
+      : runRecoveryRequest(argv[index + 1])
+  let exitCode = response.ok ? 0 : 1
+  try {
+    writeFileSync(1, `${PROFILE_STATE_RECOVERY_RESULT_PREFIX}${JSON.stringify(response)}\n`)
+  } catch {
+    // The CLI may have exited while recovery held the locks; never open an Electron error dialog.
+    exitCode = 1
+  }
+  app.exit(exitCode)
+  return true
+}
+
+/** Build the relaunch argv that applies a startup-dialog choice before ordinary startup. */
+export function profileStateDesktopRecoveryArgs(
+  argv: readonly string[],
+  request: { userDataPath: string; selector: { kind: 'current-json' | 'current-sqlite' } }
+): string[] {
+  return [
+    ...stripRecoveryArgs(argv.slice(1)),
+    PROFILE_STATE_DESKTOP_RECOVERY_FLAG,
+    JSON.stringify(request)
+  ]
+}
+
+function runDesktopRecovery(argv: readonly string[]): void {
+  const index = argv.indexOf(PROFILE_STATE_DESKTOP_RECOVERY_FLAG)
+  const response =
+    argv.lastIndexOf(PROFILE_STATE_DESKTOP_RECOVERY_FLAG) !== index ||
+    argv.includes(PROFILE_STATE_RECOVERY_FLAG) ||
+    argv.includes('--serve')
+      ? invalidLaunch()
+      : runRecoveryRequest(argv[index + 1])
+  if (response.ok) {
+    // Why relaunch: ordinary startup must run in a process that never held maintenance.
+    app.relaunch({ args: stripRecoveryArgs(argv.slice(1)) })
+    app.exit(0)
+    return
+  }
+  console.error(`[profile-state] Desktop recovery failed: ${response.message}`)
+  void app
+    .whenReady()
+    .then(() =>
+      dialog.showMessageBox({
+        type: 'error',
+        buttons: ['Quit'],
+        title: 'Orca profile state was not changed',
+        message: 'Orca could not apply the selected profile state.',
+        detail: `${response.message}\n\nReopen Orca to choose again.`
+      })
+    )
+    .catch((error: unknown) => console.warn('[profile-state] Recovery error dialog failed:', error))
+    .finally(() => app.exit(1))
+}
+
+function runRecoveryRequest(payload: string | undefined): ProfileStateRecoveryResponse {
+  try {
+    let raw: unknown
+    try {
+      raw = JSON.parse(payload ?? '')
+    } catch {
+      raw = undefined
+    }
+    const parsed = profileStateRecoveryRequestSchema.safeParse(raw)
+    if (!parsed.success || !isAbsolute(parsed.data.userDataPath)) {
+      throw new ProfileStateRecoveryCommandError(
+        'invalid_argument',
+        'Invalid profile-state recovery request.'
+      )
+    }
+    const userDataPath = realpathSync(parsed.data.userDataPath)
+    app.setPath('userData', userDataPath)
+    process.env.ORCA_USER_DATA_PATH = userDataPath
+    const maintenance = acquireProfileStateMaintenance(userDataPath)
+    try {
+      // Force Electron's lock even when ordinary dev or diagnostic launches would bypass it.
+      if (!acquireSingleInstanceLock(app, () => {})) {
+        throw new ProfileStateRecoveryCommandError(
+          'runtime_error',
+          'Stop Orca before profile-state rollback so no process can write the SQLite database.'
+        )
+      }
+      return {
+        ok: true,
+        result: rollbackProfileState(userDataPath, parsed.data.selector, maintenance)
+      }
+    } finally {
+      maintenance.release()
+    }
+  } catch (error) {
+    return {
+      ok: false,
+      code: isProfileStateRecoveryCommandError(error) ? error.code : 'runtime_error',
+      message: error instanceof Error ? error.message : String(error)
+    }
+  }
+}
+
+function invalidLaunch(): ProfileStateRecoveryResponse {
+  return {
+    ok: false,
+    code: 'invalid_argument',
+    message: 'Invalid profile-state recovery launch.'
+  }
+}
+
+function stripRecoveryArgs(args: readonly string[]): string[] {
+  const kept: string[] = []
+  for (let i = 0; i < args.length; i++) {
+    if (
+      args[i] === PROFILE_STATE_DESKTOP_RECOVERY_FLAG ||
+      args[i] === PROFILE_STATE_RECOVERY_FLAG
+    ) {
+      i++
+      continue
+    }
+    kept.push(args[i])
+  }
+  return kept
+}
diff --git a/src/main/startup/profile-state-write-failure.test.ts b/src/main/startup/profile-state-write-failure.test.ts
new file mode 100644
index 00000000000..b434b3ca573
--- /dev/null
+++ b/src/main/startup/profile-state-write-failure.test.ts
@@ -0,0 +1,53 @@
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { reportProfileStateWriteFailure } from './profile-state-write-failure'
+
+const fixture = vi.hoisted(() => ({
+  show: vi.fn(),
+  background: false,
+  state: { isServeMode: false }
+}))
+vi.mock('electron', () => ({ dialog: { showMessageBox: fixture.show } }))
+vi.mock('../window/foreground-activation-policy', () => ({
+  isBackgroundLaunch: () => fixture.background
+}))
+vi.mock('./main-process-state', () => ({ mainProcessState: fixture.state }))
+
+beforeEach(() => {
+  fixture.background = false
+  fixture.state.isServeMode = false
+  fixture.show.mockResolvedValue({ response: 0 })
+  vi.spyOn(console, 'error').mockImplementation(() => {})
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.clearAllMocks()
+})
+
+it('tells desktop users saving stopped without silently restarting the writer', () => {
+  reportProfileStateWriteFailure(new Error('worker exited'))
+  expect(fixture.show).toHaveBeenCalledExactlyOnceWith({
+    type: 'error',
+    title: 'Saving stopped',
+    message: 'Orca has stopped saving this profile.',
+    detail: 'Recent changes may not be saved. Restart Orca before continuing.',
+    buttons: ['OK']
+  })
+})
+
+it.each(['background', 'serve'])('keeps %s runs free of native dialogs', (mode) => {
+  fixture.background = mode === 'background'
+  fixture.state.isServeMode = mode === 'serve'
+  reportProfileStateWriteFailure(new Error('worker exited'))
+  expect(fixture.show).not.toHaveBeenCalled()
+  expect(console.error).toHaveBeenCalledWith(
+    expect.stringContaining('stopped saving'),
+    expect.any(Error)
+  )
+})
+
+it('handles a failed dialog without an unhandled rejection', async () => {
+  fixture.show.mockRejectedValue(new Error('window system unavailable'))
+  reportProfileStateWriteFailure(new Error('worker exited'))
+  await vi.waitFor(() => expect(console.warn).toHaveBeenCalled())
+})
diff --git a/src/main/startup/profile-state-write-failure.ts b/src/main/startup/profile-state-write-failure.ts
new file mode 100644
index 00000000000..81668513ba6
--- /dev/null
+++ b/src/main/startup/profile-state-write-failure.ts
@@ -0,0 +1,18 @@
+import { dialog } from 'electron'
+import { isBackgroundLaunch } from '../window/foreground-activation-policy'
+import { mainProcessState } from './main-process-state'
+
+/** Report a retired writer without treating unacknowledged state as safe to overwrite. */
+export function reportProfileStateWriteFailure(error: Error): void {
+  const message = 'Orca has stopped saving this profile.'
+  const detail = 'Recent changes may not be saved. Restart Orca before continuing.'
+  console.error(`[persistence] ${message} ${detail}`, error)
+  if (mainProcessState.isServeMode || isBackgroundLaunch()) {
+    return
+  }
+  void dialog
+    .showMessageBox({ type: 'error', title: 'Saving stopped', message, detail, buttons: ['OK'] })
+    .catch((dialogError) =>
+      console.warn('[persistence] Could not show saving failure:', dialogError)
+    )
+}
diff --git a/src/main/startup/secure-dns-census.test.ts b/src/main/startup/secure-dns-census.test.ts
index 6393ac3f3a4..72177fc04d4 100644
--- a/src/main/startup/secure-dns-census.test.ts
+++ b/src/main/startup/secure-dns-census.test.ts
@@ -33,14 +33,4 @@ describe('secure DNS census', () => {
 
     expect(offenders).toEqual([])
   })
-
-  it('detects a DoH mode when one is present', () => {
-    // Why: the census reads real sources, so it passes vacuously today; prove the matcher on a known offender.
-    const offending = "app.configureHostResolver({ secureDnsMode: 'automatic' })"
-    const modes = [...offending.matchAll(/secureDnsMode\s*:\s*'([^']*)'/g)].map((match) => match[1])
-
-    expect(offending.includes('configureHostResolver')).toBe(true)
-    expect(modes).toEqual(['automatic'])
-    expect(modes.every((mode) => mode === 'off')).toBe(false)
-  })
 })
diff --git a/src/main/startup/serve-desktop-activation.ts b/src/main/startup/serve-desktop-activation.ts
index 2b7ad520891..0034c8859e0 100644
--- a/src/main/startup/serve-desktop-activation.ts
+++ b/src/main/startup/serve-desktop-activation.ts
@@ -27,6 +27,21 @@ export function settleServeDesktopActivation(
   gate.markReady()
 }
 
+/**
+ * Wraps the desktop startup-window opener so activations queued since preflight are let through
+ * only once that window exists: they then focus it, where earlier they would open a duplicate.
+ */
+export function releaseDesktopActivationAfter<TArgs extends unknown[], TResult>(
+  gate: ServeDesktopActivationGate | null,
+  open: (...args: TArgs) => TResult
+): (...args: TArgs) => TResult {
+  return (...args) => {
+    const result = open(...args)
+    gate?.markReady()
+    return result
+  }
+}
+
 export function createServeDesktopActivationGate(options: {
   initialState: 'initializing' | 'ready'
   activateWindow: () => void
diff --git a/src/main/startup/startup-diagnostics.test.ts b/src/main/startup/startup-diagnostics.test.ts
index dcf7a4237b3..4ba75269d6c 100644
--- a/src/main/startup/startup-diagnostics.test.ts
+++ b/src/main/startup/startup-diagnostics.test.ts
@@ -1,11 +1,24 @@
-import { describe, expect, it, vi } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import {
   isStartupDiagnosticsEnabled,
   logStartupDiagnostic,
+  logStartupMilestone,
   STARTUP_DIAGNOSTICS_ENV,
   writeStartupDiagnosticLine
 } from './startup-diagnostics'
 
+afterEach(() => vi.unstubAllEnvs())
+
+it('does not compute lazy milestone details unless diagnostics are enabled', () => {
+  vi.stubEnv(STARTUP_DIAGNOSTICS_ENV, '0')
+  const details = vi.fn(() => ({ bytes: 123 }))
+  logStartupMilestone('persistence-load-done', details)
+  expect(details).not.toHaveBeenCalled()
+  vi.stubEnv(STARTUP_DIAGNOSTICS_ENV, '1')
+  logStartupMilestone('persistence-load-done', details)
+  expect(details).toHaveBeenCalledOnce()
+})
+
 describe('writeStartupDiagnosticLine', () => {
   it('writes directly to stderr fd 2 with a newline', () => {
     const write = vi.fn()
diff --git a/src/main/startup/startup-diagnostics.ts b/src/main/startup/startup-diagnostics.ts
index d5cd7718d88..dff09612711 100644
--- a/src/main/startup/startup-diagnostics.ts
+++ b/src/main/startup/startup-diagnostics.ts
@@ -32,8 +32,12 @@ export function logStartupDiagnostic(
 
 // Why: startup benchmarking needs in-process timestamps — harness-side stderr
 // arrival times include pipe buffering jitter. `t` is ms since process start.
-export function logStartupMilestone(event: string, details: Record<string, unknown> = {}): void {
+export function logStartupMilestone(
+  event: string,
+  details: Record<string, unknown> | (() => Record<string, unknown>) = {}
+): void {
   if (isStartupDiagnosticsEnabled()) {
-    logStartupDiagnostic(event, { t: Math.round(performance.now()), ...details })
+    const t = Math.round(performance.now())
+    logStartupDiagnostic(event, { t, ...(typeof details === 'function' ? details() : details) })
   }
 }
diff --git a/src/main/startup/windows-install-dir-acl-probe.test.ts b/src/main/startup/windows-install-dir-acl-probe.test.ts
index da63e35cd77..5e1d67b12d5 100644
--- a/src/main/startup/windows-install-dir-acl-probe.test.ts
+++ b/src/main/startup/windows-install-dir-acl-probe.test.ts
@@ -1,4 +1,7 @@
+import { existsSync } from 'node:fs'
+import { tmpdir } from 'node:os'
 import { join } from 'node:path'
+import type { CrashReportBreadcrumbData } from '../../shared/crash-reporting'
 import { describe, expect, it, beforeEach, vi } from 'vitest'
 import {
   probeWindowsInstallDirAcl,
@@ -6,13 +9,10 @@ import {
   WINDOWS_INSTALL_DIR_ACL_BREADCRUMB,
   type WindowsInstallDirAclProbeOptions
 } from './windows-install-dir-acl-probe'
+import { isInstallDirAclPoisonVerdict } from './windows-install-dir-package-acl-repair'
 import {
   ALL_PACKAGES_ACE,
-  ENGLISH_BASELINE_ACES,
   fakeIcaclsSpawn,
-  FRENCH_BASELINE_ACES,
-  FRENCH_RESTRICTED_PACKAGES_ACE,
-  icaclsDacl,
   ORPHAN_PACKAGE_ACE,
   RESTRICTED_PACKAGES_ACE
 } from './windows-install-dir-acl.test-fixture'
@@ -21,10 +21,6 @@ const INSTALL_DIR = 'C:\\Users\\neil\\AppData\\Local\\Programs\\orca'
 const ORPHAN = ORPHAN_PACKAGE_ACE
 const RESTRICTED_GRANT = RESTRICTED_PACKAGES_ACE
 
-function dacl(target: string, firstAce: string, ...rest: string[]): string {
-  return icaclsDacl(target, [firstAce, ...rest])
-}
-
 const fakeSpawn = fakeIcaclsSpawn
 
 function probe(options: WindowsInstallDirAclProbeOptions): Promise<Record<string, unknown>> {
@@ -44,7 +40,7 @@ function probe(options: WindowsInstallDirAclProbeOptions): Promise<Record<string
 
 /** Every target returns the same ACE set on top of the system baseline. */
 function probeWith(...aces: string[]): Promise<Record<string, unknown>> {
-  return probe({ spawnFn: fakeSpawn((target) => dacl(target, aces[0], ...aces.slice(1))).spawnFn })
+  return probe({ spawnFn: fakeSpawn(() => aces).spawnFn })
 }
 
 describe('probeWindowsInstallDirAcl', () => {
@@ -54,7 +50,7 @@ describe('probeWindowsInstallDirAcl', () => {
 
   it('reports a clean DACL as unpoisoned', async () => {
     const data = await probe({
-      spawnFn: fakeSpawn((target) => icaclsDacl(target, [], ENGLISH_BASELINE_ACES)).spawnFn
+      spawnFn: fakeSpawn(() => []).spawnFn
     })
     expect(data.name).toBe(WINDOWS_INSTALL_DIR_ACL_BREADCRUMB)
     expect(data.status).toBe('ok')
@@ -82,8 +78,8 @@ describe('probeWindowsInstallDirAcl', () => {
   // orphan alongside it launched clean on win32 10.0.26200 / Electron 43.4.1 — so
   // it is not the reproduced state, however useless -1 is to an LPAC token.
   it.each([
-    ['the localized-safe name form', ALL_PACKAGES_ACE],
-    ['the raw SID form', 'S-1-15-2-1:(OI)(CI)(RX)']
+    ['the AC alias', ALL_PACKAGES_ACE],
+    ['the raw SID form', '(A;OICI;0x1200a9;;;S-1-15-2-1)']
   ])('clears the signature when only ALL APPLICATION PACKAGES grants (%s)', async (_l, ace) => {
     const data = await probeWith(ace, ORPHAN)
     expect(data.hasWellKnownPackageGrant).toBe(true)
@@ -94,10 +90,10 @@ describe('probeWindowsInstallDirAcl', () => {
   // The reproduced remedy was an additive *grant*; an ACE that grants nothing on
   // the object cannot satisfy the orphan, so it must not clear the signature.
   it.each([
-    ['deny', 'APPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES:(DENY)(OI)(CI)(F)'],
-    ['inherit-only', 'APPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)'],
-    ['raw-sid deny', 'S-1-15-2-2:(DENY)(F)'],
-    ['raw-sid inherit-only', 'S-1-15-2-1:(OI)(CI)(IO)(GR,GE)']
+    ['deny', '(D;OICI;FA;;;AC)'],
+    ['inherit-only', '(A;OICIIO;GRGX;;;AC)'],
+    ['restricted deny', '(D;;FA;;;S-1-15-2-2)'],
+    ['restricted inherit-only', '(A;CIOIIO;GRGX;;;S-1-15-2-2)']
   ])('does not let a %s well-known ACE satisfy an orphan', async (_label, ace) => {
     const data = await probeWith(ace, ORPHAN)
     expect(data.hasWellKnownPackageGrant).toBe(false)
@@ -108,67 +104,131 @@ describe('probeWindowsInstallDirAcl', () => {
   it('does not let a grant on one target mask its absence on another', async () => {
     const data = await probe({
       spawnFn: fakeSpawn((target) =>
-        target.endsWith('ffmpeg.dll')
-          ? dacl(target, ORPHAN)
-          : dacl(target, RESTRICTED_GRANT, ORPHAN)
+        target.endsWith('ffmpeg.dll') ? [ORPHAN] : [RESTRICTED_GRANT, ORPHAN]
       ).spawnFn
     })
     expect(data.hasWellKnownPackageGrant).toBe(true)
     expect(data.matchesPoisonSignature).toBe(true)
   })
 
-  it('reports whether the well-known name check could be trusted', async () => {
-    const english = await probeWith(ORPHAN)
-    expect(english.wellKnownNameCheckReliable).toBe(true)
-    const localized = await new Promise<Record<string, unknown>>((resolve) => {
-      resetWindowsInstallDirAclProbeForTest()
-      probeWindowsInstallDirAcl({
-        platform: 'win32',
-        installDir: INSTALL_DIR,
-        fileExists: () => false,
-        // fr-FR install that already carries the restricted grant: the name check
-        // cannot see it, so the signature is a false positive the flag must expose.
-        spawnFn: fakeSpawn((target) =>
-          icaclsDacl(target, [ORPHAN, FRENCH_RESTRICTED_PACKAGES_ACE], FRENCH_BASELINE_ACES)
-        ).spawnFn,
-        recordBreadcrumb: (_name, d) => {
-          resolve(d as Record<string, unknown>)
-          return undefined
-        }
-      })
+  // zh-CN/ja-JP/ko-KR icacls keeps "NT AUTHORITY" English but translates the package
+  // names and summary. A tree the repair just fixed read as poisoned AND reliable there,
+  // re-arming the pre-window repair and blaming the install on every launch.
+  it('reads a repaired tree as clean when icacls translates package names', async () => {
+    const zhDisplay = (target: string): string =>
+      [
+        `${target} S-1-15-2-999-999-999:(OI)(CI)(RX)`,
+        '    APPLICATION PACKAGE AUTHORITY\\所有受限制的应用程序包:(OI)(CI)(RX)',
+        '    NT AUTHORITY\\SYSTEM:(I)(OI)(CI)(F)',
+        '    BUILTIN\\Administrators:(I)(OI)(CI)(F)',
+        '',
+        '已成功处理 1 个文件; 处理 0 个文件时失败'
+      ].join('\r\n')
+    let verdict: CrashReportBreadcrumbData = {}
+    const data = await probe({
+      spawnFn: fakeSpawn(() => [ORPHAN, RESTRICTED_GRANT], zhDisplay).spawnFn,
+      onDone: (done) => (verdict = done)
     })
-    expect(localized.matchesPoisonSignature).toBe(true)
-    expect(localized.wellKnownNameCheckReliable).toBe(false)
+    expect(isInstallDirAclPoisonVerdict(verdict)).toBe(false)
+    expect(data.status).toBe('ok')
+    expect(data.orphanPackageSidCount).toBe(1)
+    expect(data.hasRestrictedPackageGrant).toBe(true)
   })
 
   it('matches the well-known SIDs exactly, not by prefix', async () => {
-    const data = await probeWith('S-1-15-2-1234567890:(OI)(CI)(RX)')
+    const data = await probeWith('(A;OICI;0x1200a9;;;S-1-15-2-1234567890)')
     expect(data.orphanPackageSidCount).toBe(1)
     expect(data.hasWellKnownPackageGrant).toBe(false)
     expect(data.matchesPoisonSignature).toBe(true)
   })
 
   it('ignores capability SIDs, which are a different family and harmless', async () => {
-    const data = await probeWith('S-1-15-3-65536-599108337-2355189375-1353122160:(S,X)')
+    const data = await probeWith('(A;;0x100020;;;S-1-15-3-65536-599108337-2355189375-1353122160)')
     expect(data.orphanPackageSidCount).toBe(0)
     expect(data.matchesPoisonSignature).toBe(false)
   })
 
   it('probes a content file, not just the directory object', async () => {
-    const fake = fakeSpawn((target) => dacl(target, ORPHAN))
+    const fake = fakeSpawn(() => [ORPHAN])
     await probe({ spawnFn: fake.spawnFn })
     expect(fake.calls.map((c) => c.args[0])).toEqual([INSTALL_DIR, join(INSTALL_DIR, 'ffmpeg.dll')])
   })
 
-  it('never passes a recursive or write flag', async () => {
-    const fake = fakeSpawn((target) => dacl(target, ORPHAN))
+  it('only saves the DACL to a temp file: no recursive or ACL-writing flag', async () => {
+    const fake = fakeSpawn(() => [ORPHAN])
     await probe({ spawnFn: fake.spawnFn })
     for (const call of fake.calls) {
-      expect(call.args).toHaveLength(1)
+      expect(call.args).toHaveLength(3)
       expect(call.args[0]).not.toMatch(/^\//)
+      expect(call.args[1]).toBe('/save')
+      expect(call.args[2].startsWith(tmpdir())).toBe(true)
+      expect(existsSync(call.args[2])).toBe(false)
     }
   })
 
+  // Verbatim `icacls <dir> /save` / `icacls <file> /save` output from win32 10.0.26200.
+  it.each([
+    [
+      'a repaired module file',
+      'ffmpeg.dll\r\nD:AI(A;;0x1200a9;;;S-1-15-2-2)(A;;0x1200a9;;;S-1-15-2-999-999-999)' +
+        '(A;ID;0x1200a9;;;S-1-15-2-999-999-999)(A;ID;FA;;;SY)(A;ID;FA;;;BA)' +
+        '(A;ID;FA;;;S-1-5-21-432636774-4279371817-3971399515-1001)\r\n',
+      false
+    ],
+    [
+      'a poisoned dir whose AC ACE denies',
+      'scan21acl\r\nD:AI(D;;0x100116;;;AC)(A;OICI;0x1200a9;;;S-1-15-2-999-999-999)' +
+        '(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)' +
+        '(A;OICIID;FA;;;S-1-5-21-432636774-4279371817-3971399515-1001)\r\n',
+      true
+    ]
+  ])('reads a real icacls /save capture: %s', async (_label, saved, poisoned) => {
+    const data = await probe({
+      fileExists: () => false,
+      spawnFn: fakeSpawn(() => Buffer.from(saved, 'utf16le')).spawnFn
+    })
+    expect(data.orphanPackageSids).toBe('S-1-15-2-999-999-999')
+    expect(data.matchesPoisonSignature).toBe(poisoned)
+  })
+
+  it('keeps a conditional DACL unreadable instead of hiding a later package grant', async () => {
+    const saved =
+      'orca\r\nD:AI(A;OICI;0x1200a9;;;S-1-15-2-999-999-999)' +
+      '(XA;OICI;FA;;;WD;(@User.Department == "Finance"))' +
+      '(A;OICIID;0x1200a9;;;S-1-15-2-2)\r\n'
+    let verdict: CrashReportBreadcrumbData = {}
+    const data = await probe({
+      fileExists: () => false,
+      spawnFn: fakeSpawn(() => Buffer.from(saved, 'utf16le')).spawnFn,
+      onDone: (done) => (verdict = done)
+    })
+    expect(data).toMatchObject({ status: 'failed', reason: 'all-targets-unreadable' })
+    expect(data.matchesPoisonSignature).toBeUndefined()
+    expect(isInstallDirAclPoisonVerdict(verdict)).toBe(false)
+  })
+
+  it.each([1, null])('ignores a saved DACL when icacls exits with %s', async (exitCode) => {
+    const fake = fakeSpawn(() => [ORPHAN], undefined, exitCode)
+    let verdict: CrashReportBreadcrumbData = {}
+    const data = await probe({
+      fileExists: () => false,
+      spawnFn: fake.spawnFn,
+      onDone: (done) => (verdict = done)
+    })
+    expect(data).toMatchObject({ status: 'failed', reason: 'all-targets-unreadable' })
+    expect(isInstallDirAclPoisonVerdict(verdict)).toBe(false)
+    expect(fake.calls.every((call) => !existsSync(call.args[2]))).toBe(true)
+  })
+
+  it('does not report malformed saved output as a clean DACL', async () => {
+    const data = await probe({
+      fileExists: () => false,
+      spawnFn: fakeSpawn(() => Buffer.from('orca\r\n', 'utf16le')).spawnFn
+    })
+    expect(data).toMatchObject({ status: 'failed', reason: 'all-targets-unreadable' })
+    expect(data.matchesPoisonSignature).toBeUndefined()
+  })
+
   it('records a failure instead of throwing when icacls cannot be read', async () => {
     const data = await probe({ spawnFn: fakeSpawn(() => null).spawnFn })
     expect(data.status).toBe('failed')
@@ -180,7 +240,7 @@ describe('probeWindowsInstallDirAcl', () => {
     ['darwin', { platform: 'darwin' as NodeJS.Platform }],
     ['serve mode', { platform: 'win32' as NodeJS.Platform, isServeMode: true }]
   ])('does no work on %s', async (_label, options) => {
-    const fake = fakeSpawn((target) => dacl(target, ORPHAN))
+    const fake = fakeSpawn(() => [ORPHAN])
     const record = vi.fn()
     const fileExists = vi.fn(() => true)
     probeWindowsInstallDirAcl({
@@ -197,7 +257,7 @@ describe('probeWindowsInstallDirAcl', () => {
   })
 
   it('runs once per process', async () => {
-    const fake = fakeSpawn((target) => dacl(target, ORPHAN))
+    const fake = fakeSpawn(() => [ORPHAN])
     await probe({ spawnFn: fake.spawnFn })
     const before = fake.calls.length
     probeWindowsInstallDirAcl({ platform: 'win32', installDir: INSTALL_DIR, spawnFn: fake.spawnFn })
diff --git a/src/main/startup/windows-install-dir-acl-probe.ts b/src/main/startup/windows-install-dir-acl-probe.ts
index 25d1e581c9b..a717c87c241 100644
--- a/src/main/startup/windows-install-dir-acl-probe.ts
+++ b/src/main/startup/windows-install-dir-acl-probe.ts
@@ -1,5 +1,7 @@
 import { spawn } from 'node:child_process'
-import { existsSync } from 'node:fs'
+import { randomUUID } from 'node:crypto'
+import { existsSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import {
   sanitizeCrashReportString,
@@ -36,23 +38,16 @@ const MODULE_SHORTLIST = ['ffmpeg.dll', 'libGLESv2.dll', 'libEGL.dll', 'icudtl.d
 
 const PROBE_BUDGET_MS = 5_000
 
-/** Raw S-1-15-2-* means icacls could not resolve it — locale-independent. */
-const RAW_PACKAGE_SID = /\bS-1-15-2-[0-9-]+\b/i
+// Why SDDL (`icacls /save`) rather than icacls's display: the display localizes
+// the well-known package names — and on zh/ja/ko even keeps "NT AUTHORITY" English
+// while doing so — so a repaired tree read as poisoned. SDDL prints SIDs on every locale.
+const PACKAGE_SID = /^S-1-15-2-[0-9-]+$/i
 /** ALL RESTRICTED APPLICATION PACKAGES: the grant the reproduced remedy added. */
-const RESTRICTED_PACKAGES_SID = 's-1-15-2-2'
-const WELL_KNOWN_PACKAGE_SIDS = new Set(['s-1-15-2-1', RESTRICTED_PACKAGES_SID])
-// icacls localizes these; the raw SID form is never printed for them. Orphan
-// detection stays SID-form and locale-independent, but this check is not — so we
-// report whether the output looked English at all, making a locale-induced
-// false positive recognizable instead of silent.
-const WELL_KNOWN_PACKAGE_NAMES = /ALL (RESTRICTED )?APPLICATION PACKAGES/i
-const RESTRICTED_PACKAGE_NAME = /ALL RESTRICTED APPLICATION PACKAGES/i
-// Not BUILTIN: fr-FR and es-ES print it verbatim while localizing the package
-// names, so it is evidence of nothing. SYSTEM's ACE is on every install tree.
-const ENGLISH_PRINCIPAL = /\b(NT AUTHORITY|APPLICATION PACKAGE AUTHORITY)\b/i
-// Why: an ACE that denies, or only propagates to children, grants nothing on this
-// object — so it cannot satisfy an orphan the way the reproduced fix did.
-const NON_GRANTING_FLAGS = /\((?:DENY|IO)\)/i
+const RESTRICTED_PACKAGES_SID = 'S-1-15-2-2'
+/** `AC` is SDDL's alias for ALL APPLICATION PACKAGES (S-1-15-2-1). */
+const WELL_KNOWN_PACKAGE_SIDS = new Set(['AC', 'S-1-15-2-1', RESTRICTED_PACKAGES_SID])
+/** (type;flags;rights;object;inheritedObject;sid[;condition]) */
+const SDDL_ACE = /\(([A-Z]+);([A-Z]*);[^;()]*;[^;()]*;[^;()]*;([^;()]+)[;)]/gi
 
 export type WindowsInstallDirAclProbeOptions = {
   platform?: NodeJS.Platform
@@ -69,80 +64,80 @@ type AclFacts = {
   orphanPackageSids: string[]
   hasWellKnownPackageGrant: boolean
   hasRestrictedPackageGrant: boolean
-  sawEnglishPrincipal: boolean
 }
 
-function readDacl(spawnFn: typeof spawn, target: string, deadlineMs: number): Promise<string> {
-  return new Promise((resolve) => {
-    // No flags: icacls with a bare path only reads. Never /T — a recursive walk on
-    // a real profile measured 62s and timed out (see windows-user-data-acl.ts).
-    const child = spawnFn(getIcaclsExePath(), [target], {
-      stdio: ['ignore', 'pipe', 'ignore'],
+function readSavedDacl(spawnFn: typeof spawn, target: string, deadlineMs: number): Promise<string> {
+  const saveFile = join(tmpdir(), `orca-install-acl-${randomUUID()}.txt`)
+  return new Promise<string>((resolve) => {
+    // /save only reads the target (it writes the temp file). Never /T — a recursive
+    // walk on a real profile measured 62s and timed out (see windows-user-data-acl.ts).
+    const child = spawnFn(getIcaclsExePath(), [target, '/save', saveFile], {
+      stdio: ['ignore', 'ignore', 'ignore'],
       windowsHide: true
     })
-    let out = ''
     let settled = false
-    const settle = (value: string): void => {
+    const settle = (read: boolean): void => {
       if (settled) {
         return
       }
       settled = true
       clearTimeout(timer)
-      resolve(value)
+      let out = ''
+      try {
+        // An empty read parses as a clean DACL, so a failed /save must stay ''.
+        out = read ? readFileSync(saveFile, 'utf16le') : ''
+      } catch {
+        out = ''
+      }
+      try {
+        // A killed icacls may still hold the file; a leftover temp file is harmless.
+        rmSync(saveFile, { force: true })
+      } catch {
+        // Nothing to do.
+      }
+      resolve(out)
     }
     const timer = setTimeout(() => {
       child.kill()
-      settle('')
+      settle(false)
     }, deadlineMs)
     timer.unref?.()
-    child.stdout?.on('data', (chunk: Buffer) => {
-      out += chunk.toString('utf-8')
-    })
-    child.on('error', () => settle(''))
-    // 'close' not 'exit': exit can fire before stdout drains, and an empty read
-    // would parse as a clean DACL — a false negative in the only case we care about.
-    child.on('close', () => settle(out))
+    child.on('error', () => settle(false))
+    child.on('close', (code) => settle(code === 0))
   })
 }
 
-function collectAclFacts(daclOutput: string): AclFacts {
+function collectAclFacts(savedDacl: string): AclFacts | null {
   const orphanPackageSids: string[] = []
   let hasWellKnownPackageGrant = false
   let hasRestrictedPackageGrant = false
-  let sawEnglishPrincipal = false
-  for (const line of daclOutput.split(/\r?\n/)) {
-    if (ENGLISH_PRINCIPAL.test(line)) {
-      sawEnglishPrincipal = true
-    }
-    // icacls glues the echoed path onto the first principal with no separator, so
-    // match the principal:(flags) tail rather than trying to split the line.
-    const ace = /([^\s:][^:]*):(\([^\s]*\))\s*$/.exec(line.trim())
-    if (!ace) {
+  // A partial DACL can hide a later grant; unsupported ACEs must stay unreadable.
+  const dacl = /^D:[A-Z]*((?:\([^()]*\))*)(?:S:.*)?$/im.exec(savedDacl)
+  if (!dacl) {
+    return null
+  }
+  for (const [, type, flags, rawSid] of dacl[1].matchAll(SDDL_ACE)) {
+    const sid = rawSid.toUpperCase()
+    if (!WELL_KNOWN_PACKAGE_SIDS.has(sid)) {
+      if (PACKAGE_SID.test(sid)) {
+        orphanPackageSids.push(rawSid)
+      }
       continue
     }
-    const [, principal, flags] = ace
-    const rawSid = RAW_PACKAGE_SID.exec(principal)?.[0]
-    const sid = rawSid?.toLowerCase()
-    if (rawSid && !WELL_KNOWN_PACKAGE_SIDS.has(rawSid.toLowerCase())) {
-      orphanPackageSids.push(rawSid)
-      continue
-    }
-    const isWellKnown = sid !== undefined || WELL_KNOWN_PACKAGE_NAMES.test(principal)
-    if (!isWellKnown || NON_GRANTING_FLAGS.test(flags)) {
+    // Why: an ACE that denies, or only propagates to children (IO), grants nothing
+    // on this object — so it cannot satisfy an orphan the way the reproduced fix did.
+    const flagTokens: string[] = flags.toUpperCase().match(/../g) ?? []
+    const inheritOnly = flagTokens.includes('IO')
+    if (type.toUpperCase() !== 'A' || inheritOnly) {
       continue
     }
     hasWellKnownPackageGrant = true
     // Reported, never the verdict: narrows which grant is present for triage.
-    if (sid === RESTRICTED_PACKAGES_SID || (!sid && RESTRICTED_PACKAGE_NAME.test(principal))) {
+    if (sid === RESTRICTED_PACKAGES_SID) {
       hasRestrictedPackageGrant = true
     }
   }
-  return {
-    orphanPackageSids,
-    hasWellKnownPackageGrant,
-    hasRestrictedPackageGrant,
-    sawEnglishPrincipal
-  }
+  return { orphanPackageSids, hasWellKnownPackageGrant, hasRestrictedPackageGrant }
 }
 
 function resolveTargets(installDir: string, fileExists: (path: string) => boolean): string[] {
@@ -162,9 +157,9 @@ async function runProbe(options: WindowsInstallDirAclProbeOptions): Promise<void
     for (const target of targets) {
       const remaining = PROBE_BUDGET_MS - (Date.now() - startedAt)
       // Why one shared budget: two targets must never cost two full timeouts.
-      outputs.push(remaining > 0 ? await readDacl(spawnFn, target, remaining) : '')
+      outputs.push(remaining > 0 ? await readSavedDacl(spawnFn, target, remaining) : '')
     }
-    const facts = outputs.map(collectAclFacts)
+    const facts = outputs.map(collectAclFacts).filter((fact) => fact !== null)
     const orphans = [...new Set(facts.flatMap((f) => f.orphanPackageSids))]
     const hasWellKnownPackageGrant = facts.some((f) => f.hasWellKnownPackageGrant)
     const hasRestrictedPackageGrant = facts.some((f) => f.hasRestrictedPackageGrant)
@@ -174,24 +169,22 @@ async function runProbe(options: WindowsInstallDirAclProbeOptions): Promise<void
     const poisoned = facts.some(
       (f) => f.orphanPackageSids.length > 0 && !f.hasWellKnownPackageGrant
     )
-    data = outputs.every((out) => out === '')
-      ? { status: 'failed', reason: 'all-targets-unreadable' }
-      : {
-          status: 'ok',
-          probedTargetCount: targets.length,
-          orphanPackageSidCount: orphans.length,
-          // Capped: correlating the same orphan across reports is what would
-          // identify the tool that left it, which is the point of recording it.
-          orphanPackageSids: sanitizeCrashReportString(orphans.slice(0, 3).join(','), 200),
-          // The verdict rides on this one: either well-known grant satisfies the orphan.
-          hasWellKnownPackageGrant,
-          // Diagnostic only — the -1-only shape launches clean on real hardware.
-          hasRestrictedPackageGrant,
-          // False positives are possible on a non-English Windows, where the
-          // well-known ACE resolves to a localized name this cannot match.
-          wellKnownNameCheckReliable: facts.some((f) => f.sawEnglishPrincipal),
-          matchesPoisonSignature: poisoned
-        }
+    data =
+      facts.length === 0
+        ? { status: 'failed', reason: 'all-targets-unreadable' }
+        : {
+            status: 'ok',
+            probedTargetCount: targets.length,
+            orphanPackageSidCount: orphans.length,
+            // Capped: correlating the same orphan across reports is what would
+            // identify the tool that left it, which is the point of recording it.
+            orphanPackageSids: sanitizeCrashReportString(orphans.slice(0, 3).join(','), 200),
+            // The verdict rides on this one: either well-known grant satisfies the orphan.
+            hasWellKnownPackageGrant,
+            // Diagnostic only — the -1-only shape launches clean on real hardware.
+            hasRestrictedPackageGrant,
+            matchesPoisonSignature: poisoned
+          }
   } catch (error) {
     data = { status: 'failed', reason: sanitizeCrashReportString(`probe: ${String(error)}`, 200) }
   }
diff --git a/src/main/startup/windows-install-dir-acl-recovery.test.ts b/src/main/startup/windows-install-dir-acl-recovery.test.ts
index 7641cdc0700..23ca9de5062 100644
--- a/src/main/startup/windows-install-dir-acl-recovery.test.ts
+++ b/src/main/startup/windows-install-dir-acl-recovery.test.ts
@@ -32,9 +32,6 @@ import {
 import {
   ALL_PACKAGES_ACE,
   fakeIcaclsSpawn,
-  FRENCH_BASELINE_ACES,
-  FRENCH_RESTRICTED_PACKAGES_ACE,
-  icaclsDacl,
   ORPHAN_PACKAGE_ACE,
   RESTRICTED_PACKAGES_ACE
 } from './windows-install-dir-acl.test-fixture'
@@ -49,7 +46,7 @@ type Runner = (spec: ProcessSpec) => Promise<ProcessResult>
  * which decides whether icacls ever runs. Only the two process seams are faked.
  */
 function probeThenRecover(
-  dacl: (target: string) => string,
+  savedAces: (target: string) => string[],
   options: { failRepair?: boolean } = {}
 ): Promise<ProcessSpec[]> {
   const specs: ProcessSpec[] = []
@@ -68,7 +65,7 @@ function probeThenRecover(
       platform: 'win32',
       installDir: INSTALL_DIR,
       fileExists: (path) => path.endsWith('ffmpeg.dll'),
-      spawnFn: fakeIcaclsSpawn(dacl).spawnFn,
+      spawnFn: fakeIcaclsSpawn(savedAces).spawnFn,
       recordBreadcrumb: () => undefined,
       onDone: (data) => {
         startWindowsInstallDirAclRepairIfPoisoned(data, {
@@ -95,7 +92,7 @@ describe('startWindowsInstallDirAclRepairIfPoisoned', () => {
   })
 
   it('repairs when the probe sees an orphan package ACE and no well-known grant', async () => {
-    const specs = await probeThenRecover((target) => icaclsDacl(target, [ORPHAN_PACKAGE_ACE]))
+    const specs = await probeThenRecover(() => [ORPHAN_PACKAGE_ACE])
     expect(specs.map((spec) => spec.args?.[2])).toEqual([
       '*S-1-15-2-2:(OI)(CI)(RX)',
       '*S-1-15-2-2:(RX)'
@@ -106,27 +103,13 @@ describe('startWindowsInstallDirAclRepairIfPoisoned', () => {
   // win32 10.0.26200 / Electron 43.4.1, so it earns neither an ACL write nor the
   // accusing dialog copy.
   it('leaves an install whose package grant is ALL APPLICATION PACKAGES alone', async () => {
-    const specs = await probeThenRecover((target) =>
-      icaclsDacl(target, [ORPHAN_PACKAGE_ACE, ALL_PACKAGES_ACE])
-    )
+    const specs = await probeThenRecover(() => [ORPHAN_PACKAGE_ACE, ALL_PACKAGES_ACE])
     expect(specs).toHaveLength(0)
     expect(describeInstallDirAclPoison()).toBeNull()
   })
 
   it('does not touch an install that already carries the restricted grant', async () => {
-    const specs = await probeThenRecover((target) =>
-      icaclsDacl(target, [ORPHAN_PACKAGE_ACE, RESTRICTED_PACKAGES_ACE])
-    )
-    expect(specs).toHaveLength(0)
-    expect(describeInstallDirAclPoison()).toBeNull()
-  })
-
-  // A localized icacls prints the grant under a name the probe cannot match, so
-  // the signature is unproven: neither icacls nor the accusing dialog copy.
-  it('does not act on a signature from a non-English icacls', async () => {
-    const specs = await probeThenRecover((target) =>
-      icaclsDacl(target, [ORPHAN_PACKAGE_ACE, FRENCH_RESTRICTED_PACKAGES_ACE], FRENCH_BASELINE_ACES)
-    )
+    const specs = await probeThenRecover(() => [ORPHAN_PACKAGE_ACE, RESTRICTED_PACKAGES_ACE])
     expect(specs).toHaveLength(0)
     expect(describeInstallDirAclPoison()).toBeNull()
   })
@@ -169,7 +152,7 @@ describe('describeInstallDirAclPoison', () => {
   })
 
   it('offers the copyable commands, and drops them once the repair lands', async () => {
-    await probeThenRecover((target) => icaclsDacl(target, [ORPHAN_PACKAGE_ACE]))
+    await probeThenRecover(() => [ORPHAN_PACKAGE_ACE])
     const repaired = describeInstallDirAclPoison()
     expect(repaired?.detail).toContain('Orca repaired the permissions')
     expect(repaired?.detail).not.toContain('Administrator Command Prompt')
@@ -180,7 +163,7 @@ describe('describeInstallDirAclPoison', () => {
   })
 
   it('walks a standard user through icacls when the repair could not write', async () => {
-    await probeThenRecover((target) => icaclsDacl(target, [ORPHAN_PACKAGE_ACE]), {
+    await probeThenRecover(() => [ORPHAN_PACKAGE_ACE], {
       failRepair: true
     })
     const failed = describeInstallDirAclPoison()
@@ -190,7 +173,7 @@ describe('describeInstallDirAclPoison', () => {
 
   it('reports the repair as in flight before icacls has answered', () => {
     startWindowsInstallDirAclRepairIfPoisoned(
-      { status: 'ok', matchesPoisonSignature: true, wellKnownNameCheckReliable: true },
+      { status: 'ok', matchesPoisonSignature: true },
       {
         platform: 'win32',
         installDir: INSTALL_DIR,
@@ -206,8 +189,7 @@ describe('describeInstallDirAclPoison', () => {
 
 const POISON_VERDICT: CrashReportBreadcrumbData = {
   status: 'ok',
-  matchesPoisonSignature: true,
-  wellKnownNameCheckReliable: true
+  matchesPoisonSignature: true
 }
 const GPU_ENV = { appVersion: APP_VERSION, electronVersion: '43.4.1', platform: 'win32' } as const
 
@@ -897,7 +879,7 @@ describe('the probe-pending grace window', () => {
       platform: 'win32' as const,
       installDir: INSTALL_DIR,
       fileExists: () => false,
-      spawnFn: fakeIcaclsSpawn((target) => icaclsDacl(target, [RESTRICTED_PACKAGES_ACE])).spawnFn,
+      spawnFn: fakeIcaclsSpawn(() => [RESTRICTED_PACKAGES_ACE]).spawnFn,
       recordBreadcrumb: () => undefined
     }
     let settleVerdict: () => void = () => undefined
diff --git a/src/main/startup/windows-install-dir-acl.test-fixture.ts b/src/main/startup/windows-install-dir-acl.test-fixture.ts
index ecbfec808f0..f28fe9c3d67 100644
--- a/src/main/startup/windows-install-dir-acl.test-fixture.ts
+++ b/src/main/startup/windows-install-dir-acl.test-fixture.ts
@@ -1,64 +1,69 @@
 import { EventEmitter } from 'node:events'
+import { writeFileSync } from 'node:fs'
+import { basename } from 'node:path'
 import type { spawn } from 'node:child_process'
 
-/** Shared icacls doubles for the install-dir DACL probe, repair, and recovery tests. */
+/**
+ * Shared icacls doubles for the install-dir DACL probe, repair, and recovery tests.
+ * ACEs are SDDL, the shape `icacls <target> /save <file>` writes (captured on
+ * win32 10.0.26200: the leaf name, CRLF, then `D:AI(...)(...)`, UTF-16LE).
+ */
 
-export const ORPHAN_PACKAGE_ACE = 'S-1-15-2-999-999-999:(OI)(CI)(RX)'
-export const RESTRICTED_PACKAGES_ACE =
-  'APPLICATION PACKAGE AUTHORITY\\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(RX)'
-/** The Program Files default: present on healthy installs, which launch clean. */
-export const ALL_PACKAGES_ACE = 'APPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES:(RX)'
+export const ORPHAN_PACKAGE_ACE = '(A;OICI;0x1200a9;;;S-1-15-2-999-999-999)'
+/** ALL RESTRICTED APPLICATION PACKAGES; SDDL has no alias for it. */
+export const RESTRICTED_PACKAGES_ACE = '(A;OICI;0x1200a9;;;S-1-15-2-2)'
+/** ALL APPLICATION PACKAGES (`AC`), the Program Files default: healthy installs launch clean. */
+export const ALL_PACKAGES_ACE = '(A;;0x1200a9;;;AC)'
 
-export const ENGLISH_BASELINE_ACES = [
-  'NT AUTHORITY\\SYSTEM:(I)(OI)(CI)(F)',
-  'BUILTIN\\Administrators:(I)(OI)(CI)(F)',
-  'awin\\neil:(I)(OI)(CI)(F)'
+export const BASELINE_ACES = [
+  '(A;OICIID;FA;;;SY)',
+  '(A;OICIID;FA;;;BA)',
+  '(A;OICIID;FA;;;S-1-5-21-432636774-4279371817-3971399515-1001)'
 ]
-/** fr-FR icacls: no principal the English name check can recognize. */
-export const FRENCH_BASELINE_ACES = [
-  'AUTORITE NT\\Systeme:(I)(OI)(CI)(F)',
-  'BUILTIN\\Administrateurs:(I)(OI)(CI)(F)'
-]
-export const FRENCH_RESTRICTED_PACKAGES_ACE =
-  "AUTORITE DE PACKAGE D'APPLICATION\\TOUS LES PACKAGES D'APPLICATION RESTREINTS:(RX)"
 
-/** Real icacls shape: the echoed path is glued onto the first principal. */
-export function icaclsDacl(
-  target: string,
-  aces: string[],
-  baseline: string[] = ENGLISH_BASELINE_ACES
-): string {
-  const [first, ...rest] = [...aces, ...baseline]
-  return [
-    `${target} ${first}`,
-    ...rest.map((ace) => `                    ${ace}`),
-    '',
-    'Successfully processed 1 files'
-  ].join('\r\n')
+/** The file `icacls <target> /save` writes for a target carrying these ACEs. */
+export function icaclsSavedAcl(target: string, aces: string[]): Buffer {
+  const leaf = basename(target.replaceAll('\\', '/'))
+  return Buffer.from(`${leaf}\r\nD:AI${[...aces, ...BASELINE_ACES].join('')}\r\n`, 'utf16le')
 }
 
-/** `null` output makes the spawn fail, as an unreadable target does. */
-export function fakeIcaclsSpawn(output: (target: string) => string | null): {
+/**
+ * `saved` returns the target's extra ACEs, or the raw saved file; `null` makes the
+ * spawn fail, as an unreadable target does. `display` is what a bare
+ * `icacls <target>` prints.
+ */
+export function fakeIcaclsSpawn(
+  saved: (target: string) => string[] | Buffer | null,
+  display: (target: string) => string = () => '',
+  exitCode: number | null = 0
+): {
   spawnFn: typeof spawn
   calls: { file: string; args: string[] }[]
 } {
   const calls: { file: string; args: string[] }[] = []
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: test double; the probe only touches kill/stdout/on of the child.
   const spawnFn = ((file: string, args: string[]) => {
     calls.push({ file, args })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: both fields are assigned on the next two lines.
     const child = new EventEmitter() as EventEmitter & {
       stdout: EventEmitter
       kill: () => void
     }
     child.stdout = new EventEmitter()
     child.kill = () => undefined
-    const out = output(args[0])
+    const [target, verb, saveFile] = args
+    const aces = saved(target)
     setImmediate(() => {
-      if (out === null) {
+      if (aces === null) {
         child.emit('error', new Error('ENOENT'))
         return
       }
-      child.stdout.emit('data', Buffer.from(out, 'utf-8'))
-      child.emit('close', 0)
+      if (verb === '/save') {
+        writeFileSync(saveFile, Buffer.isBuffer(aces) ? aces : icaclsSavedAcl(target, aces))
+      } else {
+        child.stdout.emit('data', Buffer.from(display(target), 'utf-8'))
+      }
+      child.emit('close', exitCode)
     })
     return child
   }) as unknown as typeof spawn
diff --git a/src/main/startup/windows-install-dir-package-acl-repair.test.ts b/src/main/startup/windows-install-dir-package-acl-repair.test.ts
index cc41388b811..e7222b016c0 100644
--- a/src/main/startup/windows-install-dir-package-acl-repair.test.ts
+++ b/src/main/startup/windows-install-dir-package-acl-repair.test.ts
@@ -312,8 +312,7 @@ describe('isInstallDirAclPoisonVerdict', () => {
     expect(
       isInstallDirAclPoisonVerdict({
         status: 'ok',
-        matchesPoisonSignature: true,
-        wellKnownNameCheckReliable: true
+        matchesPoisonSignature: true
       })
     ).toBe(true)
     expect(
@@ -324,16 +323,4 @@ describe('isInstallDirAclPoisonVerdict', () => {
     ).toBe(false)
     expect(isInstallDirAclPoisonVerdict({ status: 'failed', reason: 'unreadable' })).toBe(false)
   })
-
-  // A localized icacls hides the well-known grants behind translated names, so the
-  // signature there is unproven: repairing and blaming the install would be wrong.
-  it('refuses a signature the probe could not name-check', () => {
-    expect(
-      isInstallDirAclPoisonVerdict({
-        status: 'ok',
-        matchesPoisonSignature: true,
-        wellKnownNameCheckReliable: false
-      })
-    ).toBe(false)
-  })
 })
diff --git a/src/main/startup/windows-install-dir-package-acl-repair.ts b/src/main/startup/windows-install-dir-package-acl-repair.ts
index 6bd6505a2cb..878f7c47411 100644
--- a/src/main/startup/windows-install-dir-package-acl-repair.ts
+++ b/src/main/startup/windows-install-dir-package-acl-repair.ts
@@ -103,13 +103,11 @@ const MAX_REPAIR_ATTEMPTS = 3
 
 /**
  * The probe's verdict is the only trigger: an orphan package ACE with no
- * well-known package grant to satisfy it. A localized icacls prints those grants
- * under translated names the probe cannot match, so an unreliable name check is
- * not evidence of poison — acting on it would spawn icacls and tell a user with a
- * healthy install that their permissions are broken.
+ * well-known package grant to satisfy it. The probe reads SDDL, so the verdict
+ * holds on every Windows display language.
  */
 export function isInstallDirAclPoisonVerdict(data: CrashReportBreadcrumbData): boolean {
-  return data.matchesPoisonSignature === true && data.wellKnownNameCheckReliable !== false
+  return data.matchesPoisonSignature === true
 }
 
 /** The commands to hand a user whose account cannot write the install ACL. */
diff --git a/src/main/telemetry/client.ts b/src/main/telemetry/client.ts
index dc92cf1461d..50fb8cfaa3b 100644
--- a/src/main/telemetry/client.ts
+++ b/src/main/telemetry/client.ts
@@ -160,35 +160,47 @@ function waitForCaptureEnqueue(client: PostHog, event: EventName, uuid: string):
   })
 }
 
+/** Lets producers avoid preparing usage payloads when transmission is disabled. */
+export function isTelemetryEnabled(): boolean {
+  return (
+    (testTransportEnabled || (IS_OFFICIAL_BUILD && TELEMETRY_ENABLED)) &&
+    !shuttingDown &&
+    posthog !== null &&
+    commonProps !== null &&
+    storeRef !== null &&
+    resolveConsent(storeRef.getSettings()).effective === 'enabled'
+  )
+}
+
 // No-op in contributor / non-official builds; only official stable/rc builds (CI-injected `ORCA_BUILD_IDENTITY` + `ORCA_POSTHOG_WRITE_KEY`) transmit.
-export function track<N extends EventName>(name: N, props: EventProps<N>): void {
+export function track<N extends EventName>(name: N, props: EventProps<N>): boolean {
   if (!testTransportEnabled && (!IS_OFFICIAL_BUILD || !TELEMETRY_ENABLED)) {
-    return
+    return false
   }
 
   // (1) Shutdown gate: late IPC arrivals must not enqueue against a flushing client.
   if (shuttingDown) {
-    return
+    return false
   }
   if (!posthog || !commonProps || !storeRef) {
-    return
+    return false
   }
 
   // (2) Burst cap before consent: the O(1) cap drops floods before the costly settings read, so a compromised opted-out renderer can't burn CPU.
   if (!consumeBurstToken(name)) {
-    return
+    return false
   }
 
   // (3) Consent resolve — reads live settings every call so it can't drift from persisted state / env-var precedence.
   const consent = resolveConsent(storeRef.getSettings())
   if (consent.effective !== 'enabled') {
-    return
+    return false
   }
 
   // (4) Validator — single enforcement point for schema, enum, key set, and length caps.
   const result = validate(name, props)
   if (!result.ok) {
-    return
+    return false
   }
 
   // (5) Capture. `$process_person_profile: false` stops posthog-node creating a person per install_id (no init-time equivalent).
@@ -201,6 +213,7 @@ export function track<N extends EventName>(name: N, props: EventProps<N>): void
       $process_person_profile: false
     }
   })
+  return true
 }
 
 export async function setOptIn(via: OptInVia, optedIn: boolean): Promise<void> {
diff --git a/src/main/telemetry/onboarding-cohort-classifier.test.ts b/src/main/telemetry/onboarding-cohort-classifier.test.ts
index e74b0deb8d5..c6ea7c848ed 100644
--- a/src/main/telemetry/onboarding-cohort-classifier.test.ts
+++ b/src/main/telemetry/onboarding-cohort-classifier.test.ts
@@ -4,7 +4,7 @@
 // session. See docs/onboarding-telemetry-extensions.md §2.
 
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { ONBOARDING_FINAL_STEP } from '../../shared/constants'
+import { ONBOARDING_FINAL_STEP } from '../../shared/onboarding-defaults'
 import type { GlobalSettings } from '../../shared/global-settings-types'
 import type { OnboardingState } from '../../shared/onboarding-state-types'
 import type { Store } from '../persistence'
diff --git a/src/main/telemetry/onboarding-cohort-classifier.ts b/src/main/telemetry/onboarding-cohort-classifier.ts
index 8b840dc0e17..ec368fbbb74 100644
--- a/src/main/telemetry/onboarding-cohort-classifier.ts
+++ b/src/main/telemetry/onboarding-cohort-classifier.ts
@@ -2,7 +2,7 @@
 // Known limitation: upgrade_backfill's "completed" shape (persistence.ts:362-369) is also written by live completion, so an existing live-completer flips fresh_install→upgrade_backfill; dashboards forward-fill cohort from _started. TODO: a wasBackfilledByMigration sentinel would disambiguate.
 // Never throws: returns { cohort: undefined } on any read/uninit error, which the schema's .optional() cohort still validates. Mirrors sibling getCohortAtEmit's never-crash contract.
 
-import { ONBOARDING_FINAL_STEP } from '../../shared/constants'
+import { ONBOARDING_FINAL_STEP } from '../../shared/onboarding-defaults'
 import type { OnboardingCohort } from '../../shared/telemetry-events'
 import type { Store } from '../persistence'
 
diff --git a/src/main/terminal-history-deletion.ts b/src/main/terminal-history-deletion.ts
index 1fea1128ebe..97650a78ac3 100644
--- a/src/main/terminal-history-deletion.ts
+++ b/src/main/terminal-history-deletion.ts
@@ -1,5 +1,6 @@
 import { basename, dirname, join } from 'node:path'
-import { existsSync, mkdirSync, readdirSync, renameSync } from 'node:fs'
+import { existsSync, mkdirSync, renameSync } from 'node:fs'
+import { readdir } from 'node:fs/promises'
 import { removeHostTree } from './host-tree-removal'
 import { deleteFishHistoryFile, resolveFishHistoryDir } from './fish-history-session'
 import { readHistoryMeta } from './terminal-history'
@@ -20,6 +21,112 @@ const historyTreeRemovalAttempts = new Map<string, number>()
 const historyTreeRemovalRetryTimers = new Map<string, ReturnType<typeof setTimeout>>()
 const wslDistroByTombstone = new Map<string, string>()
 
+/** One root's undrained tombstone names from the last enumeration, plus its in-flight re-read. */
+type HistoryRemovalQueue = { names: string[]; refill: Promise<void> | null }
+// Why hold the names instead of re-reading per completion: one `readdir` already materialises every
+// name, so keeping it until it runs out makes a backlog of N tombstones cost a handful of reads, not N.
+const historyRemovalQueues = new Map<string, HistoryRemovalQueue>()
+
+function historyRemovalQueueFor(historyRoot: string): HistoryRemovalQueue {
+  const existing = historyRemovalQueues.get(historyRoot)
+  if (existing) {
+    return existing
+  }
+  const queue: HistoryRemovalQueue = { names: [], refill: null }
+  historyRemovalQueues.set(historyRoot, queue)
+  return queue
+}
+
+function historyTreeRemovalsAtCapacity(): boolean {
+  return (
+    pendingHistoryTreeRemovals.size + historyTreeRemovalRetryTimers.size >=
+    MAX_PENDING_HISTORY_TREE_REMOVALS
+  )
+}
+
+function isHistoryTreeRemovalTracked(dir: string): boolean {
+  return pendingHistoryTreeRemovals.has(dir) || historyTreeRemovalRetryTimers.has(dir)
+}
+
+/** Admit already-enumerated tombstones up to the admission cap; the rest stay queued for a later slot. */
+function admitQueuedHistoryTreeRemovals(historyRoot: string, queue: HistoryRemovalQueue): void {
+  const pendingRoot = getPendingDeleteRoot(historyRoot)
+  const wslDistro = wslDistroForHistoryRoot(historyRoot)
+  while (!historyTreeRemovalsAtCapacity()) {
+    const name = queue.names.pop()
+    if (name === undefined) {
+      return
+    }
+    // Safe to re-admit a name removed since enumeration: `removeHostTree` forces the rm.
+    scheduleHistoryTreeRemoval(join(pendingRoot, name), wslDistro)
+  }
+}
+
+/** Re-read one root's tombstone directory, coalescing concurrent requests onto a single readdir. */
+function refillHistoryRemovalQueue(historyRoot: string, queue: HistoryRemovalQueue): Promise<void> {
+  if (queue.refill) {
+    return queue.refill
+  }
+  const pendingRoot = getPendingDeleteRoot(historyRoot)
+  // Why snapshot rather than only test tracking when the read lands: a removal under way now can
+  // still show up in the read and also finish before it resolves, which would look admissible again.
+  const removalsUnderWay = new Set(pendingHistoryTreeRemovals.keys())
+  queue.refill = readTombstoneNames(historyRoot).then((names) => {
+    // A teardown that dropped this queue must not resurrect its removals.
+    if (historyRemovalQueues.get(historyRoot) !== queue) {
+      return
+    }
+    queue.refill = null
+    try {
+      // Dropping names already handled keeps the read that confirms a drained directory from
+      // re-queueing work, so the tail of a backlog does not cost one read per completion.
+      queue.names = names.filter((name) => {
+        const dir = join(pendingRoot, name)
+        return !removalsUnderWay.has(dir) && !isHistoryTreeRemovalTracked(dir)
+      })
+      admitQueuedHistoryTreeRemovals(historyRoot, queue)
+    } catch (err) {
+      // Non-fatal, and never a rejection: callers fire this off without awaiting it.
+      console.warn(
+        `[pty:history] Failed to queue pending history removals: ${err instanceof Error ? err.message : String(err)}`
+      )
+    }
+  })
+  return queue.refill
+}
+
+async function readTombstoneNames(historyRoot: string): Promise<string[]> {
+  try {
+    return await readdir(getPendingDeleteRoot(historyRoot))
+  } catch (err) {
+    // An absent root is the normal steady state; anything else means tombstones may linger until a
+    // later completion re-reads, so it is worth a line.
+    const code = err && typeof err === 'object' && 'code' in err ? String(err.code) : ''
+    if (code !== 'ENOENT') {
+      console.warn(
+        `[pty:history] Failed to read pending history removals for ${historyRoot}: ${err instanceof Error ? err.message : String(err)}`
+      )
+    }
+    return []
+  }
+}
+
+/** Reopen the admission window after a completion — from the queues, or one read once they empty. */
+function replenishHistoryTreeRemovals(historyRoot: string): void {
+  const queue = historyRemovalQueueFor(historyRoot)
+  admitQueuedHistoryTreeRemovals(historyRoot, queue)
+  // Why other roots too: a slot this root cannot fill is the only thing a sibling root displaced at
+  // the cap is waiting for, and nothing else would offer it one before the next startup.
+  for (const [otherRoot, otherQueue] of historyRemovalQueues) {
+    if (otherQueue !== queue) {
+      admitQueuedHistoryTreeRemovals(otherRoot, otherQueue)
+    }
+  }
+  if (queue.names.length === 0 && !historyTreeRemovalsAtCapacity()) {
+    void refillHistoryRemovalQueue(historyRoot, queue)
+  }
+}
+
 function wslDistroForHistoryRoot(historyRoot: string): string | undefined {
   return basename(dirname(historyRoot)) === 'terminal-history-wsl'
     ? basename(historyRoot)
@@ -83,10 +190,7 @@ function scheduleHistoryTreeRemoval(dir: string, wslDistro?: string): void {
     return
   }
   // Leave excess tombstones on disk; admission is intentionally bounded.
-  if (
-    pendingHistoryTreeRemovals.size + historyTreeRemovalRetryTimers.size >=
-    MAX_PENDING_HISTORY_TREE_REMOVALS
-  ) {
+  if (historyTreeRemovalsAtCapacity()) {
     return
   }
   // A rescan must not cancel a delayed retry for a real failure.
@@ -130,7 +234,7 @@ function scheduleHistoryTreeRemoval(dir: string, wslDistro?: string): void {
         pendingHistoryTreeRemovals.delete(dir)
       }
       if (removalSucceeded) {
-        schedulePendingHistoryTreeRemovals(historyRootForTombstone(dir))
+        replenishHistoryTreeRemovals(historyRootForTombstone(dir))
       }
     })
   pendingHistoryTreeRemovals.set(dir, removal)
@@ -159,31 +263,26 @@ export function scheduleWorktreeHistoryTreeDeletion(dir: string, historyRoot: st
   return true
 }
 
-/** Schedule tombstoned trees under one history root for async removal — the retry after a quit mid-rm. */
-export function schedulePendingHistoryTreeRemovals(historyRoot: string): void {
-  const pendingRoot = getPendingDeleteRoot(historyRoot)
-  if (!existsSync(pendingRoot)) {
-    return
-  }
-  try {
-    for (const entry of readdirSync(pendingRoot)) {
-      scheduleHistoryTreeRemoval(join(pendingRoot, entry), wslDistroForHistoryRoot(historyRoot))
-    }
-  } catch {
-    // Non-fatal.
-  }
+/** Schedule tombstoned trees under one history root for async removal — the retry after a quit mid-rm.
+ *  Resolves once the enumeration landed; the removals it admitted keep draining in the background. */
+export function schedulePendingHistoryTreeRemovals(historyRoot: string): Promise<void> {
+  return refillHistoryRemovalQueue(historyRoot, historyRemovalQueueFor(historyRoot))
 }
 
 /** Schedule tombstoned trees under every history root, native and WSL. */
-export function scheduleAllPendingHistoryTreeRemovals(): void {
-  schedulePendingHistoryTreeRemovals(getHistoryRoot())
-  for (const distroRoot of listWslHistoryRoots()) {
-    schedulePendingHistoryTreeRemovals(distroRoot)
-  }
+export async function scheduleAllPendingHistoryTreeRemovals(): Promise<void> {
+  await Promise.all([
+    schedulePendingHistoryTreeRemovals(getHistoryRoot()),
+    ...listWslHistoryRoots().map((distroRoot) => schedulePendingHistoryTreeRemovals(distroRoot))
+  ])
 }
 
-/** Drop every armed retry timer so a fixture teardown cannot resurrect a removal. Tests only. */
+/** Drop queued tombstone names and retries so fixture teardown cannot resurrect a removal. Tests only. */
 export function cancelPendingHistoryTreeRemovalRetries(): void {
+  historyRemovalQueues.clear()
+  // Why also the in-flight map: a fixture that never settles a held removal would otherwise leave it
+  // for the next test's flush to wait on forever.
+  pendingHistoryTreeRemovals.clear()
   for (const timer of historyTreeRemovalRetryTimers.values()) {
     clearTimeout(timer)
   }
@@ -195,11 +294,22 @@ export function cancelPendingHistoryTreeRemovalRetries(): void {
 /** Drain every history root's tombstones and await the in-flight removals. Tests only: production
  *  schedules the same drain from startup GC and headless serve without ever blocking on it. */
 export async function flushPendingWorktreeHistoryDeletions(): Promise<void> {
-  scheduleAllPendingHistoryTreeRemovals()
+  await scheduleAllPendingHistoryTreeRemovals()
   // Why loop: awaiting one snapshot of the map would return with a removal scheduled mid-batch still
-  // in flight. Each pass settles its batch and drains whatever was added while it ran.
-  while (pendingHistoryTreeRemovals.size > 0) {
-    await Promise.all(pendingHistoryTreeRemovals.values())
+  // in flight. Each pass admits every queued name the cap allows, then settles what is outstanding.
+  while (true) {
+    for (const [root, queue] of historyRemovalQueues) {
+      admitQueuedHistoryTreeRemovals(root, queue)
+    }
+    const outstanding = [
+      ...pendingHistoryTreeRemovals.values(),
+      ...[...historyRemovalQueues.values()].flatMap((queue) => (queue.refill ? [queue.refill] : []))
+    ]
+    if (outstanding.length === 0) {
+      // Nothing in flight and nothing admissible: only delayed retries can still make progress.
+      return
+    }
+    await Promise.all(outstanding)
   }
 }
 
diff --git a/src/main/terminal-history-gc-fs-call-count.test.ts b/src/main/terminal-history-gc-fs-call-count.test.ts
index d6c10b57951..4ed0cb816cd 100644
--- a/src/main/terminal-history-gc-fs-call-count.test.ts
+++ b/src/main/terminal-history-gc-fs-call-count.test.ts
@@ -167,15 +167,20 @@ describe('history GC filesystem request count', () => {
 
     await runHistoryGc(live)
 
+    const tombstoneLists = fsCalls.readdir.filter((p) => p.endsWith(PENDING_DELETE_DIR_NAME))
+    const scanLists = fsCalls.readdir.filter((p) => !p.endsWith(PENDING_DELETE_DIR_NAME))
     // The size estimation walked into every directory; the pass now only lists the root.
-    expect(fsCalls.readdir).toEqual([historyRoot])
+    expect(scanLists).toEqual([historyRoot])
+    // The tombstone drain (formerly a blocking readdirSync per completion) lists pending-delete a
+    // bounded number of times, never once per entry it removes.
+    expect(tombstoneLists.length).toBeLessThanOrEqual(12)
     // No stat on the entries themselves: the root dirent already carries the type.
     expect(statsOnEntries()).toEqual([])
     // The one surviving stat per directory is readHistoryMetaAsync enforcing its size cap.
     expect(statsInsideEntries().sort()).toEqual(
       Array.from({ length: DIR_COUNT }, (_, i) => join(historyRoot, `wt-${i}`, 'meta.json')).sort()
     )
-    expect(fsCalls.readdir.length + fsCalls.stat.length).toBe(1 + DIR_COUNT)
+    expect(scanLists.length + fsCalls.stat.length).toBe(1 + DIR_COUNT)
 
     const after = survivingDirs()
     expect(expected.size).toBe(DIR_COUNT / ORPHAN_EVERY)
diff --git a/src/main/terminal-history-gc.ts b/src/main/terminal-history-gc.ts
index f62ebab9ee5..7882ec963a4 100644
--- a/src/main/terminal-history-gc.ts
+++ b/src/main/terminal-history-gc.ts
@@ -148,7 +148,7 @@ async function executeHistoryGc(liveWorktreeIds: Set<string>, signal: AbortSigna
     // Why: finish tombstones left by quit mid-rm before scanning live worktree hashes.
     // Safe ahead of the guard below: these entries were already condemned by a
     // completed GC, and leaving them renamed-but-present strands disk forever.
-    schedulePendingHistoryTreeRemovals(getHistoryRoot())
+    await schedulePendingHistoryTreeRemovals(getHistoryRoot())
     // Why refuse rather than treat every entry as orphaned: an empty live set is
     // what a store that fell back to default state looks like, and it cannot be
     // told apart from a user who genuinely has no worktrees — who also has no
@@ -169,7 +169,7 @@ async function executeHistoryGc(liveWorktreeIds: Set<string>, signal: AbortSigna
       if (signal.aborted) {
         break
       }
-      schedulePendingHistoryTreeRemovals(distroRoot)
+      await schedulePendingHistoryTreeRemovals(distroRoot)
       const r = await gcScanRoot(distroRoot, liveWorktreeIds, signal)
       wslTotals.totalDirs += r.totalDirs
       wslTotals.orphaned += r.orphaned
diff --git a/src/main/terminal-history-tombstone-retry.test.ts b/src/main/terminal-history-tombstone-retry.test.ts
index 1d7a606206a..cbfb10cc2b7 100644
--- a/src/main/terminal-history-tombstone-retry.test.ts
+++ b/src/main/terminal-history-tombstone-retry.test.ts
@@ -30,6 +30,16 @@ import {
   schedulePendingHistoryTreeRemovals
 } from './terminal-history-deletion'
 
+// Captured before any fake clock replaces the global: refilling the removal queue reads the
+// tombstone directory for real, and only a turn of the actual event loop can land that read.
+const realSetImmediate = setImmediate
+
+async function settleTombstoneDirectoryReads(): Promise<void> {
+  for (let index = 0; index < 10; index++) {
+    await new Promise((resolve) => realSetImmediate(resolve))
+  }
+}
+
 /** A tombstone whose rm fails once used to sit on disk for the rest of the session — only the next
  *  process start re-queued it. Prove the failure re-arms in-process, and that it stays bounded. */
 describe('tombstoned history removal retries', () => {
@@ -124,9 +134,11 @@ describe('tombstoned history removal retries', () => {
     expect(deleteWslFishHistoryFileMock).toHaveBeenCalledTimes(64)
     expect(releases).toHaveLength(64)
 
-    while (releases.length > 0) {
+    for (let pass = 0; removeHostTreeMock.mock.calls.length < 1_000; pass++) {
+      expect(pass).toBeLessThan(200)
       releases.splice(0).forEach((release) => release())
       await vi.advanceTimersByTimeAsync(0)
+      await settleTombstoneDirectoryReads()
     }
     expect(removeHostTreeMock).toHaveBeenCalledTimes(1_000)
     expect(deleteWslFishHistoryFileMock).toHaveBeenCalledTimes(1_000)
diff --git a/src/main/terminal-history-tombstone-scan-cost.test.ts b/src/main/terminal-history-tombstone-scan-cost.test.ts
new file mode 100644
index 00000000000..002763750d6
--- /dev/null
+++ b/src/main/terminal-history-tombstone-scan-cost.test.ts
@@ -0,0 +1,280 @@
+import { mkdirSync, mkdtempSync, readdirSync, rmSync } from 'node:fs'
+import type * as NodeFsPromises from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { installFakeAppEnvironment } from '../../config/scripts/vitest-host-ports-setup'
+
+const reads = vi.hoisted(() => ({ count: 0, names: 0, failNext: 0 }))
+const { removeHostTreeMock } = vi.hoisted(() => ({
+  removeHostTreeMock: vi.fn<(dir: string) => Promise<void>>()
+}))
+
+vi.mock('node:fs/promises', async (importOriginal) => {
+  const fsp = await importOriginal<typeof NodeFsPromises>()
+  return {
+    ...fsp,
+    readdir: async (...args: Parameters<typeof fsp.readdir>) => {
+      if (!String(args[0]).endsWith('.pending-delete')) {
+        return fsp.readdir(...args)
+      }
+      reads.count++
+      if (reads.failNext > 0) {
+        reads.failNext--
+        throw new Error('EACCES: permission denied, scandir')
+      }
+      const result = await fsp.readdir(...args)
+      reads.names += Array.isArray(result) ? result.length : 0
+      return result
+    }
+  }
+})
+
+vi.mock('./host-tree-removal', () => ({ removeHostTree: removeHostTreeMock }))
+
+import {
+  cancelPendingHistoryTreeRemovalRetries,
+  flushPendingWorktreeHistoryDeletions,
+  HISTORY_TREE_REMOVAL_RETRY_DELAYS_MS,
+  MAX_PENDING_HISTORY_TREE_REMOVALS,
+  schedulePendingHistoryTreeRemovals
+} from './terminal-history-deletion'
+
+describe('terminal history tombstone scan cost', () => {
+  let userDataDir: string
+
+  beforeEach(() => {
+    userDataDir = mkdtempSync(join(tmpdir(), 'orca-history-scan-cost-'))
+    installFakeAppEnvironment({ getPath: () => userDataDir })
+    reads.count = 0
+    reads.names = 0
+    reads.failNext = 0
+    removeHostTreeMock.mockReset()
+  })
+
+  afterEach(() => {
+    cancelPendingHistoryTreeRemovalRetries()
+    vi.useRealTimers()
+    rmSync(userDataDir, { recursive: true, force: true })
+  })
+
+  function seedTombstones(root: string, count: number): void {
+    for (let index = 0; index < count; index++) {
+      mkdirSync(join(root, '.pending-delete', `old-session-${index}`), {
+        recursive: true
+      })
+    }
+  }
+
+  function holdRemovals(): (() => void)[] {
+    const releases: (() => void)[] = []
+    removeHostTreeMock.mockImplementation(
+      (dir) =>
+        new Promise<void>((resolve) =>
+          releases.push(() => {
+            rmSync(dir, { recursive: true, force: true })
+            resolve()
+          })
+        )
+    )
+    return releases
+  }
+
+  /** Drain only the microtask queue, so no queued directory read can land yet. */
+  async function settleRemovalPromises(): Promise<void> {
+    for (let index = 0; index < 8; index++) {
+      await Promise.resolve()
+    }
+  }
+
+  /** Let real filesystem reads land. Callers using fake timers must drive the clock instead. */
+  async function waitFor(label: string, condition: () => boolean): Promise<void> {
+    for (let index = 0; index < 500; index++) {
+      if (condition()) {
+        return
+      }
+      await new Promise((resolve) => setTimeout(resolve, 2))
+    }
+    throw new Error(`Timed out waiting for ${label}`)
+  }
+
+  it('drains 1024 tombstones without re-reading the directory per completion', async () => {
+    const root = join(userDataDir, 'terminal-history')
+    const pendingRoot = join(root, '.pending-delete')
+    seedTombstones(root, 1024)
+    const releases = holdRemovals()
+
+    await schedulePendingHistoryTreeRemovals(root)
+    expect(reads.count).toBe(1)
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(MAX_PENDING_HISTORY_TREE_REMOVALS)
+    while (releases.length > 0) {
+      expect(releases.length).toBeLessThanOrEqual(MAX_PENDING_HISTORY_TREE_REMOVALS)
+      releases.splice(0).forEach((release) => release())
+      await settleRemovalPromises()
+    }
+
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(1024)
+    expect(readdirSync(pendingRoot)).toEqual([])
+    // One read fills the queue; the handful after it only confirm the directory drained, so the
+    // count must stay flat in the backlog size rather than tracking completion batches.
+    expect(reads.count).toBeLessThanOrEqual(8)
+    expect(reads.names).toBeLessThanOrEqual(1024 + MAX_PENDING_HISTORY_TREE_REMOVALS)
+  })
+
+  it('picks up a tombstone created after the queued names were read', async () => {
+    const root = join(userDataDir, 'terminal-history')
+    const pendingRoot = join(root, '.pending-delete')
+    seedTombstones(root, 1)
+    const releases = holdRemovals()
+
+    await schedulePendingHistoryTreeRemovals(root)
+    mkdirSync(join(pendingRoot, 'late-session'))
+    releases.splice(0).forEach((release) => release())
+
+    // The completion exhausted the queue, so its refill read discovers the late arrival.
+    await waitFor('late tombstone admission', () => removeHostTreeMock.mock.calls.length === 2)
+    releases.splice(0).forEach((release) => release())
+    await flushPendingWorktreeHistoryDeletions()
+    expect(readdirSync(pendingRoot)).toEqual([])
+  })
+
+  it('drains both roots within the shared admission cap without per-completion reads', async () => {
+    const nativeRoot = join(userDataDir, 'terminal-history')
+    const wslRoot = join(userDataDir, 'terminal-history-wsl', 'Ubuntu')
+    seedTombstones(nativeRoot, 160)
+    seedTombstones(wslRoot, 160)
+    let inFlight = 0
+    let peakInFlight = 0
+    removeHostTreeMock.mockImplementation(async (dir) => {
+      inFlight++
+      peakInFlight = Math.max(peakInFlight, inFlight)
+      await new Promise((resolve) => setTimeout(resolve, 0))
+      rmSync(dir, { recursive: true, force: true })
+      inFlight--
+    })
+
+    await flushPendingWorktreeHistoryDeletions()
+
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(320)
+    expect(peakInFlight).toBeLessThanOrEqual(MAX_PENDING_HISTORY_TREE_REMOVALS)
+    expect(readdirSync(join(nativeRoot, '.pending-delete'))).toEqual([])
+    expect(readdirSync(join(wslRoot, '.pending-delete'))).toEqual([])
+    // Two roots, so a couple of reads each rather than one per completion.
+    expect(reads.count).toBeLessThanOrEqual(12)
+  })
+
+  it('keeps draining after a directory read fails mid-drain', async () => {
+    const root = join(userDataDir, 'terminal-history')
+    const pendingRoot = join(root, '.pending-delete')
+    seedTombstones(root, MAX_PENDING_HISTORY_TREE_REMOVALS + 1)
+    const releases = holdRemovals()
+
+    await schedulePendingHistoryTreeRemovals(root)
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(MAX_PENDING_HISTORY_TREE_REMOVALS)
+
+    // The refill these completions request is the one that fails.
+    reads.failNext = 1
+    releases.splice(0).forEach((release) => release())
+    await settleRemovalPromises()
+    // The queued 65th still came from memory, so the failed read cost no progress.
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(MAX_PENDING_HISTORY_TREE_REMOVALS + 1)
+
+    mkdirSync(join(pendingRoot, 'late-after-failed-read'))
+    releases.splice(0).forEach((release) => release())
+    // A later completion must be able to read again rather than stay wedged on the failure.
+    await waitFor(
+      'recovery after failed read',
+      () => removeHostTreeMock.mock.calls.length === MAX_PENDING_HISTORY_TREE_REMOVALS + 2
+    )
+    releases.splice(0).forEach((release) => release())
+    await flushPendingWorktreeHistoryDeletions()
+    expect(readdirSync(pendingRoot)).toEqual([])
+  })
+
+  it('drops an in-flight refill during fixture cleanup', async () => {
+    const root = join(userDataDir, 'terminal-history')
+    seedTombstones(root, MAX_PENDING_HISTORY_TREE_REMOVALS + 1)
+    const releases = holdRemovals()
+
+    await schedulePendingHistoryTreeRemovals(root)
+    mkdirSync(join(root, '.pending-delete', 'late-session'))
+    releases.splice(0).forEach((release) => release())
+    await settleRemovalPromises()
+    const admittedBeforeCleanup = removeHostTreeMock.mock.calls.length
+
+    cancelPendingHistoryTreeRemovalRetries()
+    await waitFor('the dropped refill to land', () => reads.count >= 2)
+    await new Promise((resolve) => setTimeout(resolve, 10))
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(admittedBeforeCleanup)
+  })
+
+  it('preserves delayed failure retries while successful removals replenish the queue', async () => {
+    // Fake timers must be armed before the failure so its retry lands on the test clock.
+    vi.useFakeTimers()
+    const root = join(userDataDir, 'terminal-history')
+    seedTombstones(root, 130)
+    const failedDir = join(root, '.pending-delete', 'old-session-0')
+    removeHostTreeMock.mockImplementation(async (dir) => {
+      if (dir === failedDir) {
+        throw new Error('EBUSY')
+      }
+      rmSync(dir, { recursive: true, force: true })
+    })
+    await flushPendingWorktreeHistoryDeletions()
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(130)
+    expect(readdirSync(join(root, '.pending-delete'))).toEqual(['old-session-0'])
+
+    await vi.advanceTimersByTimeAsync(HISTORY_TREE_REMOVAL_RETRY_DELAYS_MS[0] - 1)
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(130)
+    await vi.advanceTimersByTimeAsync(1)
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(131)
+    await vi.advanceTimersByTimeAsync(HISTORY_TREE_REMOVAL_RETRY_DELAYS_MS[1])
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(132)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('does not retry a tombstone past its attempt budget when another root frees slots', async () => {
+    vi.useFakeTimers()
+    const nativeRoot = join(userDataDir, 'terminal-history')
+    const wslRoot = join(userDataDir, 'terminal-history-wsl', 'Ubuntu')
+    seedTombstones(nativeRoot, 32)
+    seedTombstones(wslRoot, 130)
+    const releases: (() => void)[] = []
+    const attemptsByDir = new Map<string, number>()
+    removeHostTreeMock.mockImplementation((dir) => {
+      attemptsByDir.set(dir, (attemptsByDir.get(dir) ?? 0) + 1)
+      if (dir.startsWith(wslRoot)) {
+        return Promise.reject(new Error('EBUSY'))
+      }
+      return new Promise<void>((resolve) =>
+        releases.push(() => {
+          rmSync(dir, { recursive: true, force: true })
+          resolve()
+        })
+      )
+    })
+    await schedulePendingHistoryTreeRemovals(nativeRoot)
+    await schedulePendingHistoryTreeRemovals(wslRoot)
+
+    // Every WSL tombstone that was admitted exhausts its retries while native removals stay in flight.
+    for (const delay of HISTORY_TREE_REMOVAL_RETRY_DELAYS_MS) {
+      await vi.advanceTimersByTimeAsync(delay)
+    }
+    expect(vi.getTimerCount()).toBe(0)
+    const maxAttempts = 1 + HISTORY_TREE_REMOVAL_RETRY_DELAYS_MS.length
+    const exhausted = [...attemptsByDir.entries()].filter(([, count]) => count === maxAttempts)
+    expect(exhausted.length).toBeGreaterThan(0)
+
+    releases.splice(0).forEach((release) => release())
+    await vi.advanceTimersByTimeAsync(0)
+    await vi.advanceTimersByTimeAsync(0)
+    // Freeing another root's slots may give untried tombstones a first attempt, but must never hand
+    // an exhausted one a fresh attempt.
+    for (const count of attemptsByDir.values()) {
+      expect(count).toBeLessThanOrEqual(maxAttempts)
+    }
+    for (const [dir] of exhausted) {
+      expect(attemptsByDir.get(dir)).toBe(maxAttempts)
+    }
+  })
+})
diff --git a/src/main/terminal-history.test.ts b/src/main/terminal-history.test.ts
index 8dd25ea7ddf..c5ce990f32c 100644
--- a/src/main/terminal-history.test.ts
+++ b/src/main/terminal-history.test.ts
@@ -62,7 +62,9 @@ vi.mock('fs', () => ({
 // transitive readFile/mkdir would otherwise resolve to undefined.
 vi.mock('node:fs/promises', async () => ({
   ...(await vi.importActual<typeof FsPromises>('node:fs/promises')),
-  rm: rmAsyncMock
+  rm: rmAsyncMock,
+  // The tombstone drain lists pending-delete asynchronously; same fixture as the sync reads.
+  readdir: async (path: string) => readdirSyncMock(path) ?? []
 }))
 
 const { parseWslPathMock, toLinuxPathMock } = vi.hoisted(() => ({
diff --git a/src/main/text-generation/command-environment-process.test.ts b/src/main/text-generation/command-environment-process.test.ts
new file mode 100644
index 00000000000..bdc04daca3f
--- /dev/null
+++ b/src/main/text-generation/command-environment-process.test.ts
@@ -0,0 +1,160 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { afterAll, describe, expect, it, vi } from 'vitest'
+import {
+  withCodexHomeProcessLock,
+  resolveCodexHomeProcessLockKey
+} from '../codex-cli/codex-home-process-lock'
+import { spawnSourceControlAgent } from './source-control-agent-launch'
+import { generateCommitMessage } from './source-control-text-generation-requests'
+import { discoverModelsLocal } from './commit-message-model-discovery'
+import {
+  discoverCommitMessageModelsLocal,
+  generateBranchNameFromContext,
+  generateCommitMessageFromContext,
+  generatePullRequestFieldsFromContext
+} from './commit-message-text-generation'
+
+const folder = mkdtempSync(join(tmpdir(), 'orca-command-env-'))
+const script = join(folder, 'agent.cjs')
+const literal = 'spaces $HOME;$(echo unsafe) `echo unsafe` * = value'
+writeFileSync(
+  script,
+  `
+let prompt = ''
+process.stdin.on('data', chunk => prompt += chunk)
+process.stdin.on('end', () => {
+  if (process.env.ORCA_COMMAND_VALUE !== ${JSON.stringify(literal)}) {
+    console.error('command environment missing or expanded')
+    process.exitCode = 3
+    return
+  }
+  if (process.argv.includes('debug')) console.log(JSON.stringify({models:[{slug:'gpt-5.5',display_name:'GPT-5.5'}]}))
+  else if (process.argv.includes('models')) console.log('anthropic/claude-sonnet-4')
+  else if (prompt.includes('branch name')) console.log('honor-command-environment')
+  else if (prompt.includes('JSON')) console.log(JSON.stringify({base:'main',title:'Honor command environment',body:'Passed environment.',draft:true}))
+  else console.log('Honor command environment')
+})
+`
+)
+afterAll(() => rmSync(folder, { recursive: true, force: true }))
+
+// Forward slashes remain valid Windows paths and avoid POSIX command-template escaping.
+const override = `ORCA_COMMAND_VALUE='${literal}' "${process.execPath.replaceAll('\\', '/')}" "${script.replaceAll('\\', '/')}"`
+const target = {
+  kind: 'local',
+  cwd: folder,
+  env: { ...process.env, ORCA_COMMAND_VALUE: 'base' }
+} as const
+const params = { agentId: 'custom', model: '', customAgentCommand: override } as const
+
+describe('environment-prefixed commands with real child processes', () => {
+  it.each(['generation', 'discovery'] as const)(
+    'queues Codex %s on the overridden home before spawning',
+    async (operation) => {
+      const home = join(folder, operation).replaceAll('\\', '/')
+      let release!: () => void
+      const held = withCodexHomeProcessLock(
+        resolveCodexHomeProcessLockKey(home),
+        () =>
+          new Promise<void>((resolve) => {
+            release = resolve
+          })
+      )
+      await Promise.resolve()
+      const spawnAgent = vi.fn(spawnSourceControlAgent)
+      const command = `CODEX_HOME="${home}" ${override}`
+      const pending =
+        operation === 'generation'
+          ? generateCommitMessage({
+              context: { branch: 'main', stagedSummary: 'M README.md', stagedPatch: '+test' },
+              params: { agentId: 'codex', model: 'gpt-5.5', agentCommandOverride: command },
+              target,
+              spawnAgent
+            })
+          : discoverModelsLocal({
+              agentId: 'codex',
+              env: target.env,
+              agentCommandOverride: command,
+              options: { cwd: folder },
+              backslash: process.platform === 'win32' ? 'literal' : 'escape',
+              spawnAgent
+            })
+      try {
+        await new Promise<void>((resolve) => setImmediate(resolve))
+        expect(spawnAgent).not.toHaveBeenCalled()
+      } finally {
+        release()
+        await held
+      }
+      await expect(pending).resolves.toMatchObject(
+        operation === 'discovery' ? { success: true, catalogOrigin: 'probe' } : { success: true }
+      )
+      expect(spawnAgent).toHaveBeenCalledWith(
+        expect.objectContaining({ env: expect.objectContaining({ CODEX_HOME: home }) })
+      )
+    }
+  )
+
+  it('generates commits from a custom command in a plain folder', async () => {
+    await expect(
+      generateCommitMessageFromContext(
+        { branch: 'main', stagedSummary: 'M README.md', stagedPatch: '+test' },
+        params,
+        target
+      )
+    ).resolves.toMatchObject({ success: true, message: 'Honor command environment' })
+  })
+
+  it('generates commits from a preset override', async () => {
+    await expect(
+      generateCommitMessageFromContext(
+        { branch: 'main', stagedSummary: 'M README.md', stagedPatch: '+test' },
+        { agentId: 'claude', model: 'sonnet', agentCommandOverride: override },
+        target
+      )
+    ).resolves.toMatchObject({ success: true, message: 'Honor command environment' })
+  })
+
+  it('generates branch names', async () => {
+    await expect(
+      generateBranchNameFromContext({ firstPrompt: 'Honor command environment' }, params, target)
+    ).resolves.toMatchObject({ success: true, slug: 'honor-command-environment' })
+  })
+
+  it.each(['github', 'gitlab'] as const)('generates %s review fields', async (provider) => {
+    await expect(
+      generatePullRequestFieldsFromContext(
+        {
+          branch: 'test',
+          base: 'main',
+          branchChangedByPreparation: false,
+          currentTitle: '',
+          currentBody: '',
+          currentDraft: true,
+          commitSummary: 'Change',
+          changeSummary: 'M README.md',
+          patch: '+test',
+          provider
+        },
+        params,
+        target
+      )
+    ).resolves.toMatchObject({
+      success: true,
+      fields: {
+        title: 'Honor command environment',
+        body: 'Passed environment.',
+        base: 'main',
+        draft: true
+      }
+    })
+  })
+
+  it('discovers models through the same override environment', async () => {
+    await expect(
+      discoverCommitMessageModelsLocal('opencode', target.env, override, { cwd: folder })
+    ).resolves.toMatchObject({ success: true, models: [{ id: 'anthropic/claude-sonnet-4' }] })
+  })
+})
diff --git a/src/main/text-generation/command-environment-wsl.test.ts b/src/main/text-generation/command-environment-wsl.test.ts
new file mode 100644
index 00000000000..e7408a2e059
--- /dev/null
+++ b/src/main/text-generation/command-environment-wsl.test.ts
@@ -0,0 +1,49 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { wslAwareSpawn } from '../git/runner'
+import { spawnSourceControlAgent } from './source-control-agent-launch'
+import { withPlatform } from './commit-message-text-generation-test-harness'
+import { resolveCodexHomeProcessLockKeyForSpawnEnv } from '../codex-cli/codex-home-process-lock'
+
+vi.mock('../git/runner', () => ({ wslAwareSpawn: vi.fn() }))
+afterEach(() => vi.unstubAllEnvs())
+
+describe('command environment on WSL', () => {
+  it('applies literal assignments in the guest after the login shell, without changing launcher PATH', () => {
+    withPlatform('win32', () => {
+      spawnSourceControlAgent({
+        binary: 'claude',
+        args: ['-p'],
+        cwd: '\\\\wsl$\\Ubuntu\\repo',
+        wslDistro: 'Ubuntu',
+        env: undefined,
+        commandEnv: { PATH: '/guest/bin', VALUE: '$HOME;$(echo unsafe)' },
+        stdinMode: 'pipe',
+        useCwdForNative: true
+      })
+    })
+    expect(wslAwareSpawn).toHaveBeenCalledWith(
+      '/usr/bin/env',
+      ['PATH=/guest/bin', 'VALUE=$HOME;$(echo unsafe)', 'claude', '-p'],
+      expect.objectContaining({ wslDistro: 'Ubuntu', windowsHide: true, useWslLoginShell: true })
+    )
+    const options = vi.mocked(wslAwareSpawn).mock.calls[0][2]
+    expect(options.env?.PATH).not.toBe('/guest/bin')
+    expect(options.env?.VALUE).toBeUndefined()
+  })
+
+  it('locks an explicitly assigned guest Codex home even when it matches the host value', () => {
+    vi.stubEnv('CODEX_HOME', '/same/home')
+    const explicit = resolveCodexHomeProcessLockKeyForSpawnEnv(
+      { CODEX_HOME: '/same/home' },
+      'Ubuntu',
+      { CODEX_HOME: '/same/home' }
+    )
+    const managed = resolveCodexHomeProcessLockKeyForSpawnEnv(
+      { CODEX_HOME: '/other/home' },
+      'Ubuntu'
+    )
+    expect(explicit).toContain('/same/home')
+    expect(explicit).not.toContain('.orca-default-codex-home')
+    expect(explicit).not.toBe(managed)
+  })
+})
diff --git a/src/main/text-generation/commit-message-model-discovery-policy.ts b/src/main/text-generation/commit-message-model-discovery-policy.ts
index 88b8e1680e1..fa2b8869a37 100644
--- a/src/main/text-generation/commit-message-model-discovery-policy.ts
+++ b/src/main/text-generation/commit-message-model-discovery-policy.ts
@@ -61,8 +61,8 @@ export function finalizeModelDiscoveryOutput(
   // should keep its configured provider even when discovery lists concrete models.
   const defaultModelId =
     spec.defaultModelId === 'default' || models.some((model) => model.id === spec.defaultModelId)
-    ? spec.defaultModelId
-    : models[0].id
+      ? spec.defaultModelId
+      : models[0].id
   return staticModelDiscoveryResult(spec, models, defaultModelId, 'probe')
 }
 
@@ -85,7 +85,8 @@ export function planModelDiscovery(
       binary: command.binary,
       args: [...command.prefixArgs, ...modelDiscovery.args],
       stdinPayload: modelDiscovery.stdinPayload ?? null,
-      label: spec.label
+      label: spec.label,
+      ...(command.env ? { env: command.env } : {})
     }
   }
 }
diff --git a/src/main/text-generation/commit-message-model-discovery.ts b/src/main/text-generation/commit-message-model-discovery.ts
index ec6be0f12bb..80dbbb205a3 100644
--- a/src/main/text-generation/commit-message-model-discovery.ts
+++ b/src/main/text-generation/commit-message-model-discovery.ts
@@ -1,3 +1,4 @@
+import { mergeCommandEnvironment } from '../../shared/command-environment'
 import type { CommandTemplateBackslash } from '../../shared/commit-message-prompt'
 import type { CommitMessagePlan } from '../../shared/commit-message-plan'
 import { getAgentModelProbeSpec } from '../../shared/agent-model-probe-spec'
@@ -46,6 +47,16 @@ export async function discoverModelsLocal(input: {
     return staticModelDiscoveryResult(spec)
   }
 
+  const planned = planModelDiscovery(spec, input.agentCommandOverride, input.backslash)
+  if (!planned.ok) {
+    return { success: false, error: planned.error }
+  }
+  const env = mergeCommandEnvironment(
+    input.env,
+    planned.plan.env,
+    input.options.wslDistro ? 'linux' : process.platform
+  )
+
   const startDiscovery = (): LocalProcessExecution<DiscoverCommitMessageModelsResult> => {
     let markProcessClosed!: () => void
     const processClosed = new Promise<void>((resolve) => {
@@ -53,18 +64,13 @@ export async function discoverModelsLocal(input: {
     })
     const result = new Promise<DiscoverCommitMessageModelsResult>((resolve) => {
       let child: SpawnedSourceControlAgentProcess
-      const planned = planModelDiscovery(spec, input.agentCommandOverride, input.backslash)
-      if (!planned.ok) {
-        markProcessClosed()
-        resolve({ success: false, error: planned.error })
-        return
-      }
       try {
         child = input.spawnAgent({
           binary: planned.plan.binary,
           args: planned.plan.args,
           cwd: input.options.cwd,
-          env: input.env,
+          env: input.options.wslDistro ? input.env : env,
+          commandEnv: planned.plan.env,
           wslDistro: input.options.wslDistro,
           stdinMode: planned.plan.stdinPayload === null ? 'ignore' : 'pipe',
           useCwdForNative: false
@@ -172,7 +178,7 @@ export async function discoverModelsLocal(input: {
   }
   return input.agentId === 'codex'
     ? runCodexProcessWithHomeLock(
-        resolveCodexHomeProcessLockKeyForSpawnEnv(input.env, input.options.wslDistro),
+        resolveCodexHomeProcessLockKeyForSpawnEnv(env, input.options.wslDistro, planned.plan.env),
         startDiscovery
       )
     : startDiscovery().result
diff --git a/src/main/text-generation/source-control-agent-launch.ts b/src/main/text-generation/source-control-agent-launch.ts
index 8587497d318..709c0481390 100644
--- a/src/main/text-generation/source-control-agent-launch.ts
+++ b/src/main/text-generation/source-control-agent-launch.ts
@@ -39,15 +39,23 @@ function buildWslLauncherEnv(explicitEnv: NodeJS.ProcessEnv | undefined): NodeJS
 export const spawnSourceControlAgent: SpawnSourceControlAgent = (input) => {
   const spawnEnv = input.env ?? process.env
   if (process.platform === 'win32' && input.wslDistro) {
-    // Same contract as spawnProcess: stdout/stderr are piped; stdin matches stdinMode.
-    return wslAwareSpawn(input.binary, input.args, {
-      cwd: input.cwd,
-      env: buildWslLauncherEnv(input.env),
-      stdio: [input.stdinMode, 'pipe', 'pipe'],
-      windowsHide: true,
-      wslDistro: input.wslDistro,
-      useWslLoginShell: true
-    }) as SpawnedSourceControlAgentProcess
+    // Apply assignments in the guest after its login shell, not to the Windows launcher.
+    const assignments = Object.entries(input.commandEnv ?? {}).map(
+      ([key, value]) => `${key}=${value}`
+    )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: WSL spawn pipes both output streams and supplies the configured stdin stream.
+    return wslAwareSpawn(
+      assignments.length ? '/usr/bin/env' : input.binary,
+      assignments.length ? [...assignments, input.binary, ...input.args] : input.args,
+      {
+        cwd: input.cwd,
+        env: buildWslLauncherEnv(input.env),
+        stdio: [input.stdinMode, 'pipe', 'pipe'],
+        windowsHide: true,
+        wslDistro: input.wslDistro,
+        useWslLoginShell: true
+      }
+    ) as SpawnedSourceControlAgentProcess
   }
   const resolvedBinary =
     process.platform === 'win32'
diff --git a/src/main/text-generation/source-control-local-generation.ts b/src/main/text-generation/source-control-local-generation.ts
index f388fd1b03a..d918b1ef487 100644
--- a/src/main/text-generation/source-control-local-generation.ts
+++ b/src/main/text-generation/source-control-local-generation.ts
@@ -1,3 +1,4 @@
+import { mergeCommandEnvironment } from '../../shared/command-environment'
 import type { CommitMessagePlan } from '../../shared/commit-message-plan'
 import {
   resolveCodexHomeProcessLockKeyForSpawnEnv,
@@ -25,13 +26,21 @@ export function runLocalPlanForAgent(input: {
   operation: TextGenerationOperation
   spawnAgent: SpawnSourceControlAgent
 }): Promise<InternalTextGenerationResult> {
+  const target = {
+    ...input.target,
+    env: mergeCommandEnvironment(
+      input.target.env,
+      input.plan.env,
+      input.target.wslDistro ? 'linux' : process.platform
+    )
+  }
   const start = (
     holdHomeLockUntilExit = false
   ): LocalProcessExecution<InternalTextGenerationResult> =>
     runLocalSourceControlPlan({
       plan: input.plan,
       cwd: input.target.cwd,
-      env: input.target.env,
+      env: input.target.wslDistro ? input.target.env : target.env,
       emptyResultName: input.emptyResultName,
       operation: input.operation,
       wslDistro: input.target.wslDistro,
@@ -41,13 +50,14 @@ export function runLocalPlanForAgent(input: {
   if (input.agentId !== 'codex') {
     return start().result
   }
-  return runCodexLocalPlanUnderHomeLock(start, input.target, input.operation)
+  return runCodexLocalPlanUnderHomeLock(start, target, input.operation, input.plan.env)
 }
 
 function runCodexLocalPlanUnderHomeLock(
   start: (holdHomeLockUntilExit: boolean) => LocalProcessExecution<InternalTextGenerationResult>,
   target: LocalGenerationTarget,
-  operation: TextGenerationOperation
+  operation: TextGenerationOperation,
+  commandEnv?: Record<string, string>
 ): Promise<InternalTextGenerationResult> {
   const laneKey = localGenerationLaneKey(operation, target.cwd)
   let canceledWhileQueued = false
@@ -69,7 +79,7 @@ function runCodexLocalPlanUnderHomeLock(
   }
   setLocalGenerationCancelToken(laneKey, queuedCancel)
   void withCodexHomeProcessLock(
-    resolveCodexHomeProcessLockKeyForSpawnEnv(target.env, target.wslDistro),
+    resolveCodexHomeProcessLockKeyForSpawnEnv(target.env, target.wslDistro, commandEnv),
     async () => {
       if (canceledWhileQueued) {
         publishResult({ success: false, error: 'Generation canceled.', canceled: true })
diff --git a/src/main/text-generation/source-control-local-process.ts b/src/main/text-generation/source-control-local-process.ts
index 3f046494f0f..da1a2f9a139 100644
--- a/src/main/text-generation/source-control-local-process.ts
+++ b/src/main/text-generation/source-control-local-process.ts
@@ -66,6 +66,7 @@ export function runLocalSourceControlPlan(input: {
         args: plan.args,
         cwd,
         env: input.env,
+        commandEnv: plan.env,
         wslDistro: input.wslDistro,
         stdinMode: 'pipe',
         useCwdForNative: true
diff --git a/src/main/text-generation/source-control-text-generation-types.ts b/src/main/text-generation/source-control-text-generation-types.ts
index 2a8f2c9b8c6..a7b74c35d3a 100644
--- a/src/main/text-generation/source-control-text-generation-types.ts
+++ b/src/main/text-generation/source-control-text-generation-types.ts
@@ -88,6 +88,8 @@ export type SpawnSourceControlAgent = (input: {
   cwd?: string
   env?: NodeJS.ProcessEnv
   wslDistro?: string
+  // WSL applies these in the guest; native callers already merge them into env.
+  commandEnv?: Record<string, string>
   stdinMode: 'ignore' | 'pipe'
   useCwdForNative: boolean
 }) => SpawnedSourceControlAgentProcess
diff --git a/src/main/updater-test-harness.leaked-timers.test.ts b/src/main/updater-test-harness.leaked-timers.test.ts
deleted file mode 100644
index 6857852c0e2..00000000000
--- a/src/main/updater-test-harness.leaked-timers.test.ts
+++ /dev/null
@@ -1,123 +0,0 @@
-import { setTimeout as sleep } from 'node:timers/promises'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { Mock } from 'vitest'
-import { loadUpdaterModule, warmUpdaterModule } from './updater-test-module-loader'
-
-const { autoUpdaterMock, fetchNewerReleaseTagsMock, moduleFactories, resetUpdaterMocks } =
-  await vi.hoisted(async () => (await import('./updater-test-harness')).createUpdaterMocks())
-
-vi.mock('electron', () => moduleFactories.electron())
-vi.mock('electron-updater', () => moduleFactories.electronUpdater())
-vi.mock('./electron-updater-loader', () => moduleFactories.electronUpdaterLoader())
-vi.mock('@electron-toolkit/utils', () => moduleFactories.electronToolkitUtils())
-vi.mock('./ipc/pty', () => moduleFactories.ipcPty())
-vi.mock('./linux-update-package-type', () => moduleFactories.linuxUpdatePackageType())
-vi.mock('./updater-lifecycle-diagnostics', () => moduleFactories.updaterLifecycleDiagnostics())
-vi.mock('./updater-changelog', () => moduleFactories.updaterChangelog())
-vi.mock('./updater-nudge', () => moduleFactories.updaterNudge())
-vi.mock('./update-install-exit-watchdog', () => moduleFactories.updateInstallExitWatchdog())
-vi.mock('./updater-prerelease-feed', () => moduleFactories.updaterPrereleaseFeed())
-vi.mock('./local-builds/local-build-switch', () => moduleFactories.localBuildSwitch())
-vi.mock('./local-builds/local-build-feed-server', () => moduleFactories.localBuildFeedServer())
-
-const SILENT_SETTLE_DELAY_MS = 1_000
-const AUTO_UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000
-
-warmUpdaterModule()
-
-describe('updater test harness real-timer tracking', () => {
-  beforeEach(() => {
-    resetUpdaterMocks()
-  })
-
-  it('cancels a real timer armed before the reset', async () => {
-    let fired = false
-    setTimeout(() => {
-      fired = true
-    }, 20)
-
-    resetUpdaterMocks()
-
-    await sleep(150)
-    expect(fired).toBe(false)
-  })
-
-  it('still arms real timers after the reset', async () => {
-    let fired = false
-    setTimeout(() => {
-      fired = true
-    }, 10)
-
-    await sleep(150)
-    expect(fired).toBe(true)
-  })
-
-  it('hands back the untouched Node timeout handle', () => {
-    const handle = setTimeout(() => {}, 60_000)
-
-    // Why: production code calls unref() on these; the tracker must not swap in a plain id.
-    expect(typeof handle.unref).toBe('function')
-    handle.unref()
-    clearTimeout(handle)
-  })
-})
-
-// Why: this pair reproduces the cross-test leak, so it depends on running in file order — the first
-// test arms the timer and the second one is the later test it used to fire into.
-describe('abandoned updater instance', () => {
-  let leakedStatusSend: Mock = vi.fn()
-
-  beforeEach(() => {
-    resetUpdaterMocks()
-  })
-
-  it('leaves a silent-settle timer armed when its module instance is abandoned', async () => {
-    let resolveCheck: (value: unknown) => void = () => {}
-    autoUpdaterMock.checkForUpdates.mockImplementation(() => {
-      // Why: the checking status is what makes the silent settle publish 'not-available' later.
-      autoUpdaterMock.emit('checking-for-update')
-      return new Promise((resolve) => {
-        resolveCheck = resolve
-      })
-    })
-    leakedStatusSend = vi.fn()
-
-    const { setupAutoUpdater } = await loadUpdaterModule()
-
-    setupAutoUpdater({ webContents: { send: leakedStatusSend } } as never, {
-      getLastUpdateCheckAt: () => Date.now() - 25 * 60 * 60 * 1000
-    })
-
-    await vi.waitFor(() => {
-      expect(autoUpdaterMock.checkForUpdates).toHaveBeenCalledTimes(1)
-    })
-
-    // Why: resolving without a terminal event is what arms the 1s silent settle; do it here so the
-    // full delay is still ahead of us and the timer is guaranteed to be pending when this test ends.
-    resolveCheck(undefined)
-    await sleep(0)
-
-    expect(leakedStatusSend).not.toHaveBeenCalledWith(
-      'updater:status',
-      expect.objectContaining({ state: 'not-available' })
-    )
-  })
-
-  it('never reaches the shared spies once the next test owns the clock', async () => {
-    vi.useFakeTimers()
-
-    // Why: real time past the settle delay — the abandoned instance would settle here and re-arm its
-    // 24h auto check on this test's fake clock at its epoch.
-    await sleep(SILENT_SETTLE_DELAY_MS + 300)
-    await vi.advanceTimersByTimeAsync(AUTO_UPDATE_CHECK_INTERVAL_MS)
-
-    expect(leakedStatusSend).not.toHaveBeenCalledWith(
-      'updater:status',
-      expect.objectContaining({ state: 'not-available' })
-    )
-    // Why: the generation fence stops at the autoUpdater spies; this one sits past it on the
-    // pinDefaultReleaseFeed chain that the stale instance's re-armed background check still reached.
-    expect(fetchNewerReleaseTagsMock).not.toHaveBeenCalled()
-    expect(autoUpdaterMock.checkForUpdates).not.toHaveBeenCalled()
-  })
-})
diff --git a/src/main/updater.feed-attempt-lifetime.test.ts b/src/main/updater.feed-attempt-lifetime.test.ts
new file mode 100644
index 00000000000..3df242dfa13
--- /dev/null
+++ b/src/main/updater.feed-attempt-lifetime.test.ts
@@ -0,0 +1,124 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { loadUpdaterModule, warmUpdaterModule } from './updater-test-module-loader'
+
+const { autoUpdaterMock, fetchNewerReleaseTagsMock, moduleFactories, resetUpdaterMocks } =
+  await vi.hoisted(async () => (await import('./updater-test-harness')).createUpdaterMocks())
+
+vi.mock('electron', () => moduleFactories.electron())
+vi.mock('electron-updater', () => moduleFactories.electronUpdater())
+vi.mock('./electron-updater-loader', () => moduleFactories.electronUpdaterLoader())
+vi.mock('@electron-toolkit/utils', () => moduleFactories.electronToolkitUtils())
+vi.mock('./ipc/pty', () => moduleFactories.ipcPty())
+vi.mock('./linux-update-package-type', () => moduleFactories.linuxUpdatePackageType())
+vi.mock('./updater-lifecycle-diagnostics', () => moduleFactories.updaterLifecycleDiagnostics())
+vi.mock('./updater-changelog', () => moduleFactories.updaterChangelog())
+vi.mock('./updater-nudge', () => moduleFactories.updaterNudge())
+vi.mock('./update-install-exit-watchdog', () => moduleFactories.updateInstallExitWatchdog())
+vi.mock('./updater-prerelease-feed', () => moduleFactories.updaterPrereleaseFeed())
+vi.mock('./local-builds/local-build-switch', () => moduleFactories.localBuildSwitch())
+vi.mock('./local-builds/local-build-feed-server', () => moduleFactories.localBuildFeedServer())
+
+warmUpdaterModule()
+
+type FeedResult =
+  | { tags: string[]; state: 'ready' | 'no-newer' }
+  | { tags: string[]; state: 'not-ready'; lastGoodTag: string }
+
+const expiredResults: FeedResult[] = [
+  { tags: ['v2.0.0'], state: 'ready' },
+  { tags: [], state: 'no-newer' },
+  { tags: [], state: 'not-ready', lastGoodTag: 'v1.9.0' }
+]
+
+function holdFirstPreflight(): (value: FeedResult) => void {
+  let finish = (_value: FeedResult): void => {}
+  fetchNewerReleaseTagsMock.mockImplementationOnce(
+    () =>
+      new Promise<FeedResult>((resolve) => {
+        finish = resolve
+      })
+  )
+  return (value) => finish(value)
+}
+
+async function setup() {
+  const updater = await loadUpdaterModule()
+  const mainWindow = { webContents: { send: vi.fn() } }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Only webContents.send is used; all native Electron APIs are mocked.
+  updater.setupAutoUpdater(mainWindow as never, { getLastUpdateCheckAt: () => Date.now() })
+  return updater
+}
+
+describe('updater feed preflight ownership', () => {
+  beforeEach(() => {
+    resetUpdaterMocks()
+    vi.useFakeTimers()
+    autoUpdaterMock.checkForUpdates.mockImplementation(() => new Promise(() => {}))
+  })
+
+  it.each(expiredResults)('does not repin after a timed-out $state result', async (result) => {
+    const finish = holdFirstPreflight()
+    const updater = await setup()
+    updater.checkForUpdatesFromMenu()
+    await vi.advanceTimersByTimeAsync(45_000)
+    const settledStatus = updater.getUpdateStatus()
+    expect(settledStatus.state).toBe('error')
+    autoUpdaterMock.setFeedURL.mockClear()
+
+    finish(result)
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(autoUpdaterMock.setFeedURL).not.toHaveBeenCalled()
+    expect(autoUpdaterMock.checkForUpdates).not.toHaveBeenCalled()
+    expect(updater.getUpdateStatus()).toBe(settledStatus)
+  })
+
+  it.each(['manual', 'background'] as const)(
+    'preserves a newer feed after an older %s preflight resolves',
+    async (kind) => {
+      const finishOld = holdFirstPreflight()
+      fetchNewerReleaseTagsMock.mockResolvedValueOnce({ tags: ['v3.0.0'], state: 'ready' })
+      const updater = await setup()
+      if (kind === 'manual') {
+        updater.checkForUpdatesFromMenu()
+      } else {
+        updater.checkForUpdates()
+      }
+      await vi.advanceTimersByTimeAsync(45_000)
+      updater.checkForUpdatesFromMenu()
+      await vi.advanceTimersByTimeAsync(0)
+      expect(autoUpdaterMock.checkForUpdates).toHaveBeenCalledTimes(1)
+      expect(autoUpdaterMock.setFeedURL).toHaveBeenLastCalledWith({
+        provider: 'generic',
+        url: 'https://github.com/stablyai/orca/releases/download/v3.0.0'
+      })
+      autoUpdaterMock.setFeedURL.mockClear()
+
+      finishOld({ tags: ['v2.0.0'], state: 'ready' })
+      await vi.advanceTimersByTimeAsync(0)
+
+      expect(autoUpdaterMock.setFeedURL).not.toHaveBeenCalled()
+      expect(autoUpdaterMock.checkForUpdates).toHaveBeenCalledTimes(1)
+    }
+  )
+
+  it.each([
+    {
+      result: { tags: ['v3.0.0'], state: 'ready' },
+      url: 'https://github.com/stablyai/orca/releases/download/v3.0.0'
+    },
+    {
+      result: { tags: [], state: 'no-newer' },
+      url: 'https://github.com/stablyai/orca/releases/latest/download'
+    }
+  ])('keeps the active $result.state feed choice', async ({ result, url }) => {
+    fetchNewerReleaseTagsMock.mockResolvedValueOnce(result)
+    const updater = await setup()
+    autoUpdaterMock.setFeedURL.mockClear()
+    updater.checkForUpdatesFromMenu()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(autoUpdaterMock.setFeedURL).toHaveBeenCalledTimes(1)
+    expect(autoUpdaterMock.setFeedURL).toHaveBeenLastCalledWith({ provider: 'generic', url })
+    expect(autoUpdaterMock.checkForUpdates).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/main/updater.quit-and-install.test.ts b/src/main/updater.quit-and-install.test.ts
index 0080db58991..d5ba376e02e 100644
--- a/src/main/updater.quit-and-install.test.ts
+++ b/src/main/updater.quit-and-install.test.ts
@@ -183,6 +183,98 @@ describe('updater', () => {
     )
   })
 
+  it('aborts native install when required pre-quit cleanup fails', async () => {
+    vi.useFakeTimers()
+
+    const onBeforeQuit = vi.fn().mockRejectedValue(new Error('profile state export failed'))
+    const sendMock = vi.fn()
+    const mainWindow = { webContents: { send: sendMock } }
+    const { setupAutoUpdater, quitAndInstall, isQuittingForUpdate } = await loadUpdaterModule()
+
+    setupAutoUpdater(mainWindow as never, {
+      onBeforeQuit,
+      onBeforeQuitFailure: 'abort'
+    })
+    quitAndInstall()
+
+    await vi.advanceTimersByTimeAsync(100)
+
+    expect(onBeforeQuit).toHaveBeenCalledTimes(1)
+    expect(autoUpdaterMock.quitAndInstall).not.toHaveBeenCalled()
+    expect(killAllPtyMock).not.toHaveBeenCalled()
+    expect(isQuittingForUpdate()).toBe(false)
+    expect(sendMock).toHaveBeenCalledWith(
+      'updater:status',
+      expect.objectContaining({
+        state: 'error',
+        message: expect.stringContaining('Could not restart to install the update')
+      })
+    )
+  })
+
+  it('keeps optional pre-quit cleanup fail-and-continue behavior by default', async () => {
+    vi.useFakeTimers()
+
+    const onBeforeQuit = vi.fn().mockRejectedValue(new Error('optional cleanup failed'))
+    const mainWindow = { webContents: { send: vi.fn() } }
+    const { setupAutoUpdater, quitAndInstall } = await loadUpdaterModule()
+
+    setupAutoUpdater(mainWindow as never, { onBeforeQuit })
+    quitAndInstall()
+
+    await vi.advanceTimersByTimeAsync(100)
+
+    expect(onBeforeQuit).toHaveBeenCalledTimes(1)
+    expect(autoUpdaterMock.quitAndInstall).toHaveBeenCalledTimes(1)
+    expect(killAllPtyMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('allows a required profile export to finish beyond the optional cleanup budget', async () => {
+    vi.useFakeTimers()
+    const onBeforeQuit = vi.fn(() => new Promise<void>((resolve) => setTimeout(resolve, 5_000)))
+    const mainWindow = { webContents: { send: vi.fn() } }
+    const { setupAutoUpdater, quitAndInstall } = await loadUpdaterModule()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: updater only reads the mocked webContents.send in this lifecycle test.
+    setupAutoUpdater(mainWindow as never, { onBeforeQuit, onBeforeQuitFailure: 'abort' })
+    quitAndInstall()
+    await vi.advanceTimersByTimeAsync(2_600)
+    expect(autoUpdaterMock.quitAndInstall).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(2_500)
+    expect(autoUpdaterMock.quitAndInstall).toHaveBeenCalledOnce()
+  })
+
+  it('aborts native install when required pre-quit cleanup times out', async () => {
+    vi.useFakeTimers()
+
+    const onBeforeQuit = vi.fn(() => new Promise<void>(() => {}))
+    const sendMock = vi.fn()
+    const mainWindow = { webContents: { send: sendMock } }
+    const { setupAutoUpdater, quitAndInstall, isQuittingForUpdate } = await loadUpdaterModule()
+
+    setupAutoUpdater(mainWindow as never, {
+      onBeforeQuit,
+      onBeforeQuitFailure: 'abort'
+    })
+    quitAndInstall()
+
+    await vi.advanceTimersByTimeAsync(100)
+    expect(autoUpdaterMock.quitAndInstall).not.toHaveBeenCalled()
+
+    await vi.advanceTimersByTimeAsync(90_000)
+
+    expect(onBeforeQuit).toHaveBeenCalledTimes(1)
+    expect(autoUpdaterMock.quitAndInstall).not.toHaveBeenCalled()
+    expect(killAllPtyMock).not.toHaveBeenCalled()
+    expect(isQuittingForUpdate()).toBe(false)
+    expect(sendMock).toHaveBeenCalledWith(
+      'updater:status',
+      expect.objectContaining({
+        state: 'error',
+        message: expect.stringContaining('Could not restart to install the update')
+      })
+    )
+  })
+
   it('ignores duplicate quitAndInstall requests while the shared delay is pending', async () => {
     vi.useFakeTimers()
 
diff --git a/src/main/updater.ts b/src/main/updater.ts
index cc9f0fc2c98..95c457b82c3 100644
--- a/src/main/updater.ts
+++ b/src/main/updater.ts
@@ -12,12 +12,12 @@ import type {
 import type { ReleaseBuild, ReleaseChannel } from '../shared/release-channel'
 import type { ReleaseBuildListOptions } from './updater-release-build-cache'
 import { UpdaterSetup, type UpdaterSetupOptions } from './updater/updater-setup'
-import type { UpdateInstallMode } from './updater/updater-state'
+import type { PreQuitCleanupFailureMode, UpdateInstallMode } from './updater/updater-state'
 
 // Keep one service instance so all public API calls share updater state and event listeners.
 const updater = new UpdaterSetup()
 
-export type { UpdateInstallMode, UpdaterSetupOptions }
+export type { PreQuitCleanupFailureMode, UpdateInstallMode, UpdaterSetupOptions }
 
 export function resolveUpdateInstallMode(isServeMode: boolean): UpdateInstallMode {
   return updater.resolveUpdateInstallMode(isServeMode)
diff --git a/src/main/updater/updater-install-support.ts b/src/main/updater/updater-install-support.ts
index 175362dad05..2da273e152e 100644
--- a/src/main/updater/updater-install-support.ts
+++ b/src/main/updater/updater-install-support.ts
@@ -10,7 +10,7 @@ import { disarmUpdateInstallExitWatchdog } from '../update-install-exit-watchdog
 import { resetMacInstallState } from '../updater-mac-install'
 import type { LinuxPackageInstallRecovery, UpdateStatus } from '../../shared/update-status-types'
 import { compareVersions } from '../updater-fallback'
-import { PRE_QUIT_CLEANUP_TIMEOUT_MS } from './updater-state'
+import { PRE_QUIT_CLEANUP_TIMEOUT_MS, REQUIRED_PRE_QUIT_CLEANUP_TIMEOUT_MS } from './updater-state'
 import { UpdaterCheckState } from './updater-check-state'
 
 export abstract class UpdaterInstallSupport extends UpdaterCheckState {
@@ -137,6 +137,10 @@ export abstract class UpdaterInstallSupport extends UpdaterCheckState {
       return
     }
 
+    const timeoutMs =
+      this.onBeforeQuitFailure === 'abort'
+        ? REQUIRED_PRE_QUIT_CLEANUP_TIMEOUT_MS
+        : PRE_QUIT_CLEANUP_TIMEOUT_MS
     let timeout: ReturnType<typeof setTimeout> | null = null
     const cleanup = Promise.resolve()
       .then(() => this.onBeforeQuitCleanup?.())
@@ -146,29 +150,42 @@ export abstract class UpdaterInstallSupport extends UpdaterCheckState {
           { errorType: error instanceof Error ? error.name : typeof error },
           {
             level: 'warn',
-            message: 'Pre-quit cleanup failed; continuing update install'
+            message:
+              this.onBeforeQuitFailure === 'abort'
+                ? 'Pre-quit cleanup failed; aborting update install'
+                : 'Pre-quit cleanup failed; continuing update install'
           }
         )
+        if (this.onBeforeQuitFailure === 'abort') {
+          throw error
+        }
       })
     const timeoutResult = new Promise<'timeout'>((resolve) => {
-      timeout = setTimeout(() => resolve('timeout'), PRE_QUIT_CLEANUP_TIMEOUT_MS)
+      timeout = setTimeout(() => resolve('timeout'), timeoutMs)
     })
 
-    const result = await Promise.race([cleanup.then(() => 'done' as const), timeoutResult])
-    if (result === 'timeout') {
-      recordUpdaterLifecycle(
-        'pre_quit_cleanup_timeout',
-        { timeoutMs: PRE_QUIT_CLEANUP_TIMEOUT_MS },
-        {
-          level: 'warn',
-          message: `Pre-quit cleanup exceeded ${PRE_QUIT_CLEANUP_TIMEOUT_MS}ms; continuing update install`
+    try {
+      const result = await Promise.race([cleanup.then(() => 'done' as const), timeoutResult])
+      if (result === 'timeout') {
+        recordUpdaterLifecycle(
+          'pre_quit_cleanup_timeout',
+          { timeoutMs },
+          {
+            level: 'warn',
+            message:
+              this.onBeforeQuitFailure === 'abort'
+                ? `Pre-quit cleanup exceeded ${timeoutMs}ms; aborting update install`
+                : `Pre-quit cleanup exceeded ${timeoutMs}ms; continuing update install`
+          }
+        )
+        if (this.onBeforeQuitFailure === 'abort') {
+          throw new Error(`Pre-quit cleanup exceeded ${timeoutMs}ms before update install`)
         }
-      )
-      return
-    }
-
-    if (timeout) {
-      clearTimeout(timeout)
+      }
+    } finally {
+      if (timeout) {
+        clearTimeout(timeout)
+      }
     }
   }
 
diff --git a/src/main/updater/updater-release-feed.ts b/src/main/updater/updater-release-feed.ts
index 46a34eb49ed..a06af6e669b 100644
--- a/src/main/updater/updater-release-feed.ts
+++ b/src/main/updater/updater-release-feed.ts
@@ -114,6 +114,7 @@ export abstract class UpdaterReleaseFeed extends UpdaterInstallExecution {
   protected async pinDefaultReleaseFeed(
     variant: UpdateCheckVariant = 'default'
   ): Promise<'ready' | 'not-available'> {
+    const attemptId = this.activeUpdateCheckAttemptId
     const autoUpdater = this.getAutoUpdater()
     // Why: the latest/download redirect can move between check and download, so pin the concrete tag (prerelease users resolve any channel, stable only stable).
     const currentVersion = app.getVersion()
@@ -128,6 +129,10 @@ export abstract class UpdaterReleaseFeed extends UpdaterInstallExecution {
         ...(isPerfCheck ? { releaseFilter: 'perf' as const } : {})
       }
     )
+    // A timed-out preflight must not overwrite a newer check's feed.
+    if (attemptId === null || !this.isActiveUpdateCheckAttempt(attemptId)) {
+      return 'not-available'
+    }
     const newerTag = releaseTagsResult.tags[0] ?? null
     const fallbackTag = includePrerelease ? (releaseTagsResult.tags[1] ?? null) : null
     this.pendingPrereleaseFallback =
diff --git a/src/main/updater/updater-setup.ts b/src/main/updater/updater-setup.ts
index 8ebbc49b169..2b43964d5c0 100644
--- a/src/main/updater/updater-setup.ts
+++ b/src/main/updater/updater-setup.ts
@@ -20,7 +20,7 @@ import { getServeUpdateHandoffFailure } from '../serve-update-handoff'
 import { recordUpdaterLifecycle } from '../updater-lifecycle-diagnostics'
 import { AUTO_UPDATE_CHECK_INTERVAL_MS } from './updater-state'
 import { UpdaterDownloadInstall } from './updater-download-install'
-import type { UpdateInstallMode } from './updater-state'
+import type { PreQuitCleanupFailureMode, UpdateInstallMode } from './updater-state'
 
 export type UpdaterSetupOptions = {
   getLastUpdateCheckAt?: () => number | null
@@ -32,6 +32,7 @@ export type UpdaterSetupOptions = {
   setDismissedUpdateNudgeId?: (id: string | null) => void
   getReleaseChannelOverride?: () => ReleaseChannel | null
   installMode?: UpdateInstallMode
+  onBeforeQuitFailure?: PreQuitCleanupFailureMode
 }
 
 /** Initializes electron-updater and attaches lifecycle/event bridges. */
@@ -113,6 +114,7 @@ export class UpdaterSetup extends UpdaterDownloadInstall {
   setupAutoUpdater(mainWindow: BrowserWindow, opts?: UpdaterSetupOptions): void {
     this.mainWindowRef = mainWindow
     this.onBeforeQuitCleanup = opts?.onBeforeQuit ?? null
+    this.onBeforeQuitFailure = opts?.onBeforeQuitFailure ?? 'continue'
     this.persistLastUpdateCheckAt = opts?.setLastUpdateCheckAt ?? null
     this._getLastUpdateCheckAt = opts?.getLastUpdateCheckAt ?? null
     this._getPendingUpdateNudgeId = opts?.getPendingUpdateNudgeId ?? null
diff --git a/src/main/updater/updater-state.ts b/src/main/updater/updater-state.ts
index d15ce42520c..32177e3183c 100644
--- a/src/main/updater/updater-state.ts
+++ b/src/main/updater/updater-state.ts
@@ -13,6 +13,8 @@ export const NUDGE_POLL_INTERVAL_MS = 30 * 60 * 1000
 export const NUDGE_ACTIVATION_COOLDOWN_MS = 5 * 60 * 1000
 export const QUIT_AND_INSTALL_DELAY_MS = 100
 export const PRE_QUIT_CLEANUP_TIMEOUT_MS = 2_500
+// Required profile exports may each wait for a bounded writer request.
+export const REQUIRED_PRE_QUIT_CLEANUP_TIMEOUT_MS = 90_000
 export const UPDATE_CHECK_SILENT_SETTLE_DELAY_MS = 1_000
 export const UPDATE_CHECK_STALL_TIMEOUT_MS = 45_000
 
@@ -24,6 +26,7 @@ export type UpdateInstallMode =
   | 'interactive'
   | 'supervised-headless-serve'
   | 'unsupported-headless-serve'
+export type PreQuitCleanupFailureMode = 'continue' | 'abort'
 
 // Why: expected preflight outcomes need typed context so UI routing never depends on matching error text.
 export class ReleaseFeedPreflightError extends Error {
@@ -42,6 +45,7 @@ export abstract class UpdaterState {
   protected currentStatus: UpdateStatus = { state: 'idle' }
   protected userInitiatedCheck = false
   protected onBeforeQuitCleanup: (() => void | Promise<void>) | null = null
+  protected onBeforeQuitFailure: PreQuitCleanupFailureMode = 'continue'
   protected autoUpdaterInitialized = false
   // Why: modifier-clicking "Check for Updates" targets prerelease manifests; the feed still pins a concrete tag so cancelled prereleases without manifests are skipped.
   protected includePrereleaseActive = false
diff --git a/src/main/usage/agent-token-usage-reporter.test.ts b/src/main/usage/agent-token-usage-reporter.test.ts
new file mode 100644
index 00000000000..8ecf487838c
--- /dev/null
+++ b/src/main/usage/agent-token-usage-reporter.test.ts
@@ -0,0 +1,168 @@
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { agentTokenUsageSchema } from '../../shared/telemetry-agent-token-usage-schema'
+import { _enableTransportForTests, _setShuttingDownForTests } from '../telemetry/client'
+import {
+  cleanupTelemetryClientTest,
+  setupTelemetryClientTest,
+  type TelemetryClientTestState
+} from '../telemetry/client-test-harness'
+import { resetBurstCapsForSession } from '../telemetry/burst-cap'
+import { UsageCacheSnapshotWriter } from '../usage-cache-snapshot-writer'
+import { AgentTokenUsageReporter } from './agent-token-usage-reporter'
+
+const ID = '00000000-0000-4000-8000-000000000001'
+const row = {
+  providerSessionId: 'private-provider-session',
+  input_tokens: 100,
+  output_tokens: 20,
+  cached_input_tokens: 50,
+  cache_write_input_tokens: 10
+}
+let directory: string
+let file: string
+let telemetry: TelemetryClientTestState
+let reporters: AgentTokenUsageReporter[]
+const identity = vi.fn(async (ids: readonly string[]) => ids.map(() => ID))
+function reporter(): AgentTokenUsageReporter {
+  const instance = new AgentTokenUsageReporter(file, 'claude', identity)
+  reporters.push(instance)
+  return instance
+}
+function captures() {
+  return telemetry.mock.capture.mock.calls.map(([message]) => message.properties)
+}
+beforeEach(() => {
+  directory = mkdtempSync(join(tmpdir(), 'orca-token-usage-'))
+  file = join(directory, 'tokens.json')
+  telemetry = setupTelemetryClientTest()
+  reporters = []
+  identity.mockReset().mockImplementation(async (ids) => ids.map(() => ID))
+})
+afterEach(async () => {
+  await Promise.all(reporters.map((instance) => instance.flush()))
+  cleanupTelemetryClientTest(telemetry.envStash)
+  vi.restoreAllMocks()
+  rmSync(directory, { recursive: true, force: true })
+})
+
+describe('agent token usage', () => {
+  it('persists before capture, omits provider IDs, and retains revisions across restarts', async () => {
+    telemetry.mock.capture.mockImplementation(() => {
+      expect(JSON.parse(readFileSync(file, 'utf8')).snapshots[0].revision).toBeGreaterThan(0)
+    })
+    const original = reporter()
+    await original.report([row])
+    await original.report([row])
+    expect(captures()).toHaveLength(1)
+    expect(captures()[0]).toMatchObject({
+      analytics_session_id: ID,
+      revision: 1,
+      input_tokens: 100
+    })
+    expect(JSON.stringify(captures())).not.toContain(row.providerSessionId)
+    await original.report([{ ...row, input_tokens: 150 }])
+    expect(captures()[1]).toMatchObject({ revision: 2, input_tokens: 150 })
+    await reporter().report([{ ...row, input_tokens: 150 }])
+    expect(captures()[2]).toMatchObject({ revision: 2, input_tokens: 150 })
+    await reporter().report([{ ...row, input_tokens: 90 }])
+    expect(captures()[3]).toMatchObject({ revision: 3, input_tokens: 90 })
+  })
+
+  it.each(['opt-out', 'pending', 'environment', 'build', 'shutdown'])(
+    'does no identity or disk work for %s',
+    async (gate) => {
+      if (gate === 'opt-out' && telemetry.settings.telemetry) {
+        telemetry.settings.telemetry.optedIn = false
+      }
+      if (gate === 'pending' && telemetry.settings.telemetry) {
+        telemetry.settings.telemetry.optedIn = null
+      }
+      if (gate === 'environment') {
+        process.env.DO_NOT_TRACK = '1'
+      }
+      if (gate === 'build') {
+        _enableTransportForTests(false)
+      }
+      if (gate === 'shutdown') {
+        _setShuttingDownForTests(true)
+      }
+      await reporter().report([row])
+      expect(identity).not.toHaveBeenCalled()
+      expect(existsSync(file)).toBe(false)
+      expect(captures()).toEqual([])
+    }
+  )
+
+  it('rechecks consent after asynchronous identity persistence', async () => {
+    identity.mockImplementation(async (ids) => {
+      if (telemetry.settings.telemetry) {
+        telemetry.settings.telemetry.optedIn = false
+      }
+      return ids.map(() => ID)
+    })
+    await reporter().report([row])
+    expect(captures()).toEqual([])
+  })
+
+  it('resolves every session identity in one batch', async () => {
+    const second = '00000000-0000-4000-8000-000000000002'
+    identity.mockImplementation(async (ids) =>
+      ids.map((id) => (id === 'second-session' ? second : ID))
+    )
+    await reporter().report([
+      row,
+      { ...row, providerSessionId: 'invalid-session', input_tokens: -1 },
+      { ...row, providerSessionId: 'second-session', input_tokens: 7 }
+    ])
+    expect(identity).toHaveBeenCalledOnce()
+    expect(identity).toHaveBeenCalledWith([row.providerSessionId, 'second-session'])
+    expect(captures()).toEqual([
+      expect.objectContaining({ analytics_session_id: ID, input_tokens: 100 }),
+      expect.objectContaining({ analytics_session_id: second, input_tokens: 7 })
+    ])
+  })
+
+  it('does not publish a revision whose write failed and retries it', async () => {
+    const instance = reporter()
+    const write = vi
+      .spyOn(UsageCacheSnapshotWriter.prototype, 'write')
+      .mockRejectedValueOnce(new Error('disk full'))
+    await expect(instance.report([row])).rejects.toThrow('disk full')
+    expect(captures()).toEqual([])
+    write.mockRestore()
+    await instance.report([row])
+    expect(captures()[0]).toMatchObject({ revision: 1 })
+  })
+
+  it('retries rate-limited snapshots without incrementing their revision', async () => {
+    const instance = reporter()
+    for (let count = 1; count <= 31; count++) {
+      await instance.report([{ ...row, input_tokens: count }])
+    }
+    expect(captures()).toHaveLength(30)
+    resetBurstCapsForSession()
+    await instance.report([{ ...row, input_tokens: 31 }])
+    expect(captures().at(-1)).toMatchObject({ revision: 31, input_tokens: 31 })
+  })
+
+  it('rejects corrupt saved revisions without replacing them', async () => {
+    writeFileSync(file, '{broken')
+    await expect(reporter().report([row])).rejects.toThrow()
+    expect(readFileSync(file, 'utf8')).toBe('{broken')
+    expect(captures()).toEqual([])
+  })
+
+  it('rejects invalid counts and unexpected content fields', async () => {
+    await reporter().report([{ ...row, input_tokens: -1 }])
+    const payload = { ...row, analytics_session_id: ID, revision: 1, provider: 'claude' }
+    expect(agentTokenUsageSchema.safeParse(payload).success).toBe(false)
+    const { providerSessionId: _, ...valid } = payload
+    expect(agentTokenUsageSchema.safeParse(valid).success).toBe(true)
+    for (const field of ['prompt', 'path', 'model', 'activity_timestamp', 'estimated_cost']) {
+      expect(agentTokenUsageSchema.safeParse({ ...valid, [field]: 'private' }).success).toBe(false)
+    }
+  })
+})
diff --git a/src/main/usage/agent-token-usage-reporter.ts b/src/main/usage/agent-token-usage-reporter.ts
new file mode 100644
index 00000000000..12322f4eb55
--- /dev/null
+++ b/src/main/usage/agent-token-usage-reporter.ts
@@ -0,0 +1,123 @@
+import { readFile } from 'node:fs/promises'
+import { z } from 'zod'
+import {
+  agentTokenCountsSchema,
+  agentTokenUsageSchema,
+  type AgentTokenUsage
+} from '../../shared/telemetry-agent-token-usage-schema'
+import { isTelemetryEnabled, track } from '../telemetry/client'
+import { UsageCacheSnapshotWriter } from '../usage-cache-snapshot-writer'
+import type { AgentTokenSession } from './agent-token-usage'
+
+const stateSchema = z
+  .object({
+    schemaVersion: z.literal(1),
+    snapshots: z.array(agentTokenUsageSchema)
+  })
+  .strict()
+
+/** Cumulative snapshots: consumers select the highest revision per provider/session, never sum retries. */
+export class AgentTokenUsageReporter {
+  private snapshots: Map<string, AgentTokenUsage> | null = null
+  private readonly sent = new Map<string, number>()
+  private readonly writer: UsageCacheSnapshotWriter
+  private pending: Promise<void> = Promise.resolve()
+
+  constructor(
+    private readonly file: string,
+    private readonly provider: AgentTokenUsage['provider'],
+    private readonly getSessionIds: (providerSessionIds: readonly string[]) => Promise<string[]>
+  ) {
+    this.writer = new UsageCacheSnapshotWriter('[agent-token-usage]', () => file)
+  }
+
+  report(sessions: AgentTokenSession[]): Promise<void> {
+    const operation = this.pending.then(() => this.publish(sessions))
+    this.pending = operation.catch(() => {})
+    return operation
+  }
+
+  async flush(): Promise<void> {
+    await this.pending
+    await this.writer.flush()
+  }
+
+  private async publish(sessions: AgentTokenSession[]): Promise<void> {
+    if (!isTelemetryEnabled()) {
+      return
+    }
+    const rows = sessions.flatMap(({ providerSessionId, ...counts }) => {
+      const parsed = agentTokenCountsSchema.safeParse(counts)
+      return parsed.success ? [{ providerSessionId, counts: parsed.data }] : []
+    })
+    const ids = await this.getSessionIds(rows.map((row) => row.providerSessionId))
+    if (!isTelemetryEnabled()) {
+      return
+    }
+    const previous = this.snapshots ?? (await this.load())
+    const next = new Map(previous)
+    let changed = false
+    for (const [index, { counts }] of rows.entries()) {
+      const id = ids[index]
+      const existing = next.get(id)
+      if (
+        existing &&
+        existing.input_tokens === counts.input_tokens &&
+        existing.output_tokens === counts.output_tokens &&
+        existing.cached_input_tokens === counts.cached_input_tokens &&
+        existing.cache_write_input_tokens === counts.cache_write_input_tokens
+      ) {
+        continue
+      }
+      next.set(
+        id,
+        agentTokenUsageSchema.parse({
+          ...counts,
+          provider: this.provider,
+          analytics_session_id: id,
+          revision: (existing?.revision ?? 0) + 1
+        })
+      )
+      changed = true
+    }
+    // Persist revisions before capture so a restart can only retry the same snapshot or a newer one.
+    if (changed) {
+      await this.writer.write(() =>
+        JSON.stringify({ schemaVersion: 1, snapshots: [...next.values()] })
+      )
+    }
+    this.snapshots = next
+    for (const snapshot of next.values()) {
+      if (this.sent.get(snapshot.analytics_session_id) === snapshot.revision) {
+        continue
+      }
+      if (!track('agent_token_usage', snapshot)) {
+        break
+      }
+      this.sent.set(snapshot.analytics_session_id, snapshot.revision)
+    }
+  }
+
+  private async load(): Promise<Map<string, AgentTokenUsage>> {
+    let content: string
+    try {
+      content = await readFile(this.file, 'utf8')
+    } catch (error) {
+      if (error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT') {
+        return new Map()
+      }
+      throw error
+    }
+    const state = stateSchema.parse(JSON.parse(content))
+    const snapshots = new Map(
+      state.snapshots.map((snapshot) => [snapshot.analytics_session_id, snapshot])
+    )
+    if (
+      snapshots.size !== state.snapshots.length ||
+      state.snapshots.some((snapshot) => snapshot.provider !== this.provider)
+    ) {
+      throw new Error('Invalid agent token usage state')
+    }
+    return snapshots
+  }
+}
diff --git a/src/main/usage/agent-token-usage.test.ts b/src/main/usage/agent-token-usage.test.ts
new file mode 100644
index 00000000000..e18c825212a
--- /dev/null
+++ b/src/main/usage/agent-token-usage.test.ts
@@ -0,0 +1,117 @@
+import { describe, expect, it } from 'vitest'
+import type { ClaudeUsageSession } from '../claude-usage/types'
+import type { CodexUsageSession } from '../codex-usage/types'
+import type { OpenCodeUsageSession } from '../opencode-usage/types'
+import { claudeTokenSessions, codexOpenCodeTokenSessions } from './agent-token-usage'
+
+const claudeLocation = {
+  locationKey: '/private/path',
+  projectLabel: 'private-repo',
+  repoId: 'repo',
+  worktreeId: 'folder',
+  turnCount: 1,
+  inputTokens: 100,
+  outputTokens: 20,
+  cacheReadTokens: 30,
+  cacheWriteTokens: 10,
+  cacheWrite1hTokens: 5
+}
+const claude: ClaudeUsageSession = {
+  sessionId: 'session',
+  firstTimestamp: 'private-start',
+  lastTimestamp: 'private-end',
+  model: 'private-model',
+  lastCwd: '/private/path',
+  lastGitBranch: 'private-branch',
+  primaryWorktreeId: 'folder',
+  primaryRepoId: 'repo',
+  turnCount: 2,
+  totalInputTokens: 200,
+  totalOutputTokens: 40,
+  totalCacheReadTokens: 60,
+  totalCacheWriteTokens: 20,
+  totalCacheWrite1hTokens: 10,
+  locationBreakdown: [claudeLocation, { ...claudeLocation, worktreeId: null }]
+}
+const codexLocation = {
+  locationKey: '/private/path',
+  projectLabel: 'private-repo',
+  repoId: 'repo',
+  worktreeId: 'folder',
+  eventCount: 1,
+  inputTokens: 100,
+  cachedInputTokens: 30,
+  outputTokens: 20,
+  reasoningOutputTokens: 5,
+  totalTokens: 120,
+  hasInferredPricing: false,
+  longContextInputTokens: 0,
+  longContextCachedInputTokens: 0,
+  longContextOutputTokens: 0,
+  estimatedCostUsd: 1
+}
+const codex: CodexUsageSession = {
+  sessionId: 'session',
+  firstTimestamp: 'private-start',
+  lastTimestamp: 'private-end',
+  primaryModel: 'private-model',
+  hasMixedModels: false,
+  primaryProjectLabel: 'private-repo',
+  hasMixedLocations: true,
+  primaryWorktreeId: 'folder',
+  primaryRepoId: 'repo',
+  eventCount: 2,
+  totalInputTokens: 200,
+  totalCachedInputTokens: 60,
+  totalOutputTokens: 40,
+  totalReasoningOutputTokens: 10,
+  totalTokens: 240,
+  hasInferredPricing: false,
+  longContextInputTokens: 0,
+  longContextCachedInputTokens: 0,
+  longContextOutputTokens: 0,
+  locationBreakdown: [codexLocation, { ...codexLocation, worktreeId: null }],
+  modelBreakdown: [],
+  locationModelBreakdown: []
+}
+const opencode: OpenCodeUsageSession = {
+  ...codex,
+  estimatedCostUsd: 2,
+  locationBreakdown: [codexLocation, { ...codexLocation, worktreeId: null }],
+  modelBreakdown: [],
+  locationModelBreakdown: []
+}
+
+describe('Orca token projections', () => {
+  it('counts Claude cache writes once including the 1-hour subset and excludes outside usage', () => {
+    expect(claudeTokenSessions([claude])).toEqual([
+      {
+        providerSessionId: 'session',
+        input_tokens: 100,
+        output_tokens: 20,
+        cached_input_tokens: 30,
+        cache_write_input_tokens: 10
+      }
+    ])
+  })
+  it.each([codex, opencode])('separates cache reads from inclusive input counts', (session) => {
+    expect(codexOpenCodeTokenSessions([session])).toEqual([
+      {
+        providerSessionId: 'session',
+        input_tokens: 70,
+        output_tokens: 20,
+        cached_input_tokens: 30,
+        cache_write_input_tokens: 0
+      }
+    ])
+  })
+  it('does not fall back to unscoped session totals when attribution is missing', () => {
+    expect(claudeTokenSessions([{ ...claude, locationBreakdown: [] }])).toEqual([])
+    expect(codexOpenCodeTokenSessions([{ ...codex, locationBreakdown: [] }])).toEqual([])
+    expect(
+      codexOpenCodeTokenSessions([
+        { ...codex, locationBreakdown: [{ ...codexLocation, worktreeId: null }] }
+      ])
+    ).toEqual([])
+  })
+})
diff --git a/src/main/usage/agent-token-usage.ts b/src/main/usage/agent-token-usage.ts
new file mode 100644
index 00000000000..36cada6cf01
--- /dev/null
+++ b/src/main/usage/agent-token-usage.ts
@@ -0,0 +1,48 @@
+import type { AgentTokenCounts } from '../../shared/telemetry-agent-token-usage-schema'
+import type { ClaudeUsageSession } from '../claude-usage/types'
+import type { CodexUsageSession } from '../codex-usage/types'
+import type { OpenCodeUsageSession } from '../opencode-usage/types'
+
+export type AgentTokenSession = AgentTokenCounts & { providerSessionId: string }
+
+export function claudeTokenSessions(sessions: ClaudeUsageSession[]): AgentTokenSession[] {
+  return sessions.flatMap((session) => {
+    const locations = session.locationBreakdown.filter((entry) => entry.worktreeId !== null)
+    if (locations.length === 0) {
+      return []
+    }
+    return [
+      {
+        providerSessionId: session.sessionId,
+        input_tokens: locations.reduce((sum, entry) => sum + entry.inputTokens, 0),
+        output_tokens: locations.reduce((sum, entry) => sum + entry.outputTokens, 0),
+        cached_input_tokens: locations.reduce((sum, entry) => sum + entry.cacheReadTokens, 0),
+        cache_write_input_tokens: locations.reduce((sum, entry) => sum + entry.cacheWriteTokens, 0)
+      }
+    ]
+  })
+}
+
+export function codexOpenCodeTokenSessions(
+  sessions: (CodexUsageSession | OpenCodeUsageSession)[]
+): AgentTokenSession[] {
+  return sessions.flatMap((session) => {
+    const locations = session.locationBreakdown.filter((entry) => entry.worktreeId !== null)
+    if (locations.length === 0) {
+      return []
+    }
+    return [
+      {
+        providerSessionId: session.sessionId,
+        // Codex/OpenCode include cache hits in input; Claude records them separately.
+        input_tokens: locations.reduce(
+          (sum, entry) => sum + entry.inputTokens - entry.cachedInputTokens,
+          0
+        ),
+        output_tokens: locations.reduce((sum, entry) => sum + entry.outputTokens, 0),
+        cached_input_tokens: locations.reduce((sum, entry) => sum + entry.cachedInputTokens, 0),
+        cache_write_input_tokens: 0
+      }
+    ]
+  })
+}
diff --git a/src/main/usage/analytics-session-id-store.test.ts b/src/main/usage/analytics-session-id-store.test.ts
new file mode 100644
index 00000000000..02cd747104a
--- /dev/null
+++ b/src/main/usage/analytics-session-id-store.test.ts
@@ -0,0 +1,218 @@
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import type * as FsPromises from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { UsageCacheSnapshotWriter } from '../usage-cache-snapshot-writer'
+import { AnalyticsSessionIdStore } from './analytics-session-id-store'
+
+type WriteGate = { entered: (() => void) | null; wait: Promise<void> | null; fail: boolean }
+
+const { writeGate } = vi.hoisted((): { writeGate: WriteGate } => ({
+  writeGate: {
+    entered: null,
+    wait: null,
+    fail: false
+  }
+}))
+vi.mock('node:fs/promises', async () => {
+  const actual = await vi.importActual<typeof FsPromises>('node:fs/promises')
+  return {
+    ...actual,
+    open: async (...args: Parameters<typeof actual.open>) => {
+      if (args[1] === 'w') {
+        writeGate.entered?.()
+        if (writeGate.wait) {
+          await writeGate.wait
+        }
+        if (writeGate.fail) {
+          throw new Error('simulated disk failure')
+        }
+      }
+      return actual.open(...args)
+    }
+  }
+})
+
+const UUID_V4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
+let directory: string
+let file: string
+let stores: AnalyticsSessionIdStore[]
+/** Registers every instance for flush-before-cleanup, including simulated restarts. */
+function createStore(path = file): AnalyticsSessionIdStore {
+  const store = new AnalyticsSessionIdStore(path)
+  stores.push(store)
+  return store
+}
+async function idFor(store: AnalyticsSessionIdStore, key: string) {
+  const [id] = await store.getOrCreate([key])
+  return id
+}
+beforeEach(() => {
+  directory = mkdtempSync(join(tmpdir(), 'orca-analytics-session-id-'))
+  file = join(directory, 'identities.json')
+  stores = []
+  writeGate.entered = null
+  writeGate.wait = null
+  writeGate.fail = false
+})
+afterEach(async () => {
+  await Promise.all(stores.map((store) => store.flush()))
+  rmSync(directory, { recursive: true, force: true })
+  vi.restoreAllMocks()
+})
+
+describe('AnalyticsSessionIdStore', () => {
+  it('is lazy and persists a random ID before returning it', async () => {
+    const store = createStore()
+    expect(existsSync(file)).toBe(false)
+    const id = await idFor(store, 'provider-session-123')
+    expect(id).toMatch(UUID_V4)
+    expect(id).not.toContain('provider-session')
+    expect(JSON.parse(readFileSync(file, 'utf8'))).toEqual({
+      schemaVersion: 1,
+      entries: [['provider-session-123', id]]
+    })
+    expect(await idFor(store, 'provider-session-123')).toBe(id)
+  })
+
+  it('persists a batch with one durable write and returns IDs in input order', async () => {
+    const store = createStore()
+    const [known] = await store.getOrCreate(['known'])
+    const write = vi.spyOn(UsageCacheSnapshotWriter.prototype, 'write')
+    const ids = await store.getOrCreate(['a', 'known', 'b', 'a'])
+    expect(write).toHaveBeenCalledOnce()
+    expect(ids[1]).toBe(known)
+    expect(ids[3]).toBe(ids[0])
+    expect(new Set(ids).size).toBe(3)
+    expect(await createStore().getOrCreate(['b', 'a', 'known'])).toEqual([ids[2], ids[0], known])
+    await store.getOrCreate(['known', 'a', 'b'])
+    expect(write).toHaveBeenCalledOnce()
+  })
+
+  it('restores the ID after a restart or session resume', async () => {
+    const original = createStore()
+    const id = await idFor(original, 'resumed-session')
+    await original.flush()
+    expect(await idFor(createStore(), 'resumed-session')).toBe(id)
+  })
+
+  it('handles concurrent requests for the same and different sessions without lost writes', async () => {
+    const store = createStore()
+    const ids = await Promise.all(
+      Array.from({ length: 20 }, (_, index) => idFor(store, `session-${index % 10}`))
+    )
+    expect(new Set(ids).size).toBe(10)
+    expect(ids.slice(0, 10)).toEqual(ids.slice(10))
+    const restored = createStore()
+    for (let index = 0; index < 10; index++) {
+      expect(await idFor(restored, `session-${index}`)).toBe(ids[index])
+    }
+  })
+
+  it('isolates identical provider session IDs across provider and host/profile files', async () => {
+    const ids = await Promise.all([
+      idFor(createStore(join(directory, 'host-a', 'claude.json')), 'same-session'),
+      idFor(createStore(join(directory, 'host-a', 'codex.json')), 'same-session'),
+      idFor(createStore(join(directory, 'host-b', 'claude.json')), 'same-session')
+    ])
+    expect(new Set(ids).size).toBe(3)
+  })
+
+  it.each(['', '   ', 'x'.repeat(1025)])(
+    'rejects a batch with an invalid key without minting any ID',
+    async (key) => {
+      await expect(createStore().getOrCreate(['valid', key])).rejects.toThrow(
+        'Invalid provider session ID'
+      )
+      expect(existsSync(file)).toBe(false)
+    }
+  )
+
+  it('handles prototype names and delimiter characters as ordinary opaque keys', async () => {
+    const store = createStore()
+    const keys = ['__proto__', 'constructor', 'a::b/c', 'a/b::c']
+    const ids = await Promise.all(keys.map((key) => idFor(store, key)))
+    expect(new Set(ids).size).toBe(keys.length)
+    const restored = createStore()
+    expect(await Promise.all(keys.map((key) => idFor(restored, key)))).toEqual(ids)
+  })
+
+  it.each([
+    '{broken',
+    JSON.stringify({ schemaVersion: 2, entries: [] }),
+    JSON.stringify({ schemaVersion: 1, entries: [['session', 'provider-id']] }),
+    JSON.stringify({ schemaVersion: 1, entries: [], extra: 'secret' })
+  ])('fails closed on invalid persisted state without overwriting it', async (content) => {
+    writeFileSync(file, content)
+    await expect(idFor(createStore(), 'new-session')).rejects.toThrow(
+      'Invalid analytics session identity file'
+    )
+    expect(readFileSync(file, 'utf8')).toBe(content)
+  })
+
+  it('rejects conflicting provider keys and analytics IDs', async () => {
+    const first = '00000000-0000-4000-8000-000000000001'
+    const second = '00000000-0000-4000-8000-000000000002'
+    for (const entries of [
+      [
+        ['a', first],
+        ['a', second]
+      ],
+      [
+        ['a', first],
+        ['b', first]
+      ]
+    ]) {
+      writeFileSync(file, JSON.stringify({ schemaVersion: 1, entries }))
+      await expect(idFor(createStore(), 'new-session')).rejects.toThrow(
+        'Duplicate analytics session identity'
+      )
+    }
+  })
+
+  it('keeps all callers and shutdown waiting until the ID write completes', async () => {
+    let release!: () => void
+    let entered!: () => void
+    writeGate.wait = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    const writing = new Promise<void>((resolve) => {
+      entered = resolve
+    })
+    writeGate.entered = entered
+    const store = createStore()
+    let resolved = false
+    let flushed = false
+    const first = idFor(store, 'session').then((id) => {
+      resolved = true
+      return id
+    })
+    await writing
+    const second = idFor(store, 'session')
+    const flush = store.flush().then(() => {
+      flushed = true
+    })
+    try {
+      await Promise.resolve()
+      expect(resolved).toBe(false)
+      expect(flushed).toBe(false)
+    } finally {
+      release()
+    }
+    expect(await first).toBe(await second)
+    await flush
+    expect(flushed).toBe(true)
+  })
+
+  it('does not return an unpersisted ID on write failure and allows retry', async () => {
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const store = createStore()
+    writeGate.fail = true
+    await expect(idFor(store, 'session')).rejects.toThrow('simulated disk failure')
+    expect(existsSync(file)).toBe(false)
+    writeGate.fail = false
+    const id = await idFor(store, 'session')
+    expect(await idFor(createStore(), 'session')).toBe(id)
+  })
+})
diff --git a/src/main/usage/analytics-session-id-store.ts b/src/main/usage/analytics-session-id-store.ts
new file mode 100644
index 00000000000..1624732b131
--- /dev/null
+++ b/src/main/usage/analytics-session-id-store.ts
@@ -0,0 +1,94 @@
+import { randomUUID } from 'node:crypto'
+import { readFile } from 'node:fs/promises'
+import { z } from 'zod'
+import { UsageCacheSnapshotWriter } from '../usage-cache-snapshot-writer'
+
+const providerSessionIdSchema = z
+  .string()
+  .min(1)
+  .max(1024)
+  .refine((id) => id.trim().length > 0)
+const analyticsSessionIdSchema = z.uuidv4().brand<'AnalyticsSessionId'>()
+export type AnalyticsSessionId = z.infer<typeof analyticsSessionIdSchema>
+const identityFileSchema = z
+  .object({
+    schemaVersion: z.literal(1),
+    entries: z.array(z.tuple([providerSessionIdSchema, analyticsSessionIdSchema]))
+  })
+  .strict()
+
+/** One owner per file, scoped to a provider's usage store on its execution host. */
+export class AnalyticsSessionIdStore {
+  private identities: Map<string, AnalyticsSessionId> | null = null
+  private pending: Promise<void> = Promise.resolve()
+  private writer: UsageCacheSnapshotWriter | null = null
+
+  constructor(private readonly file: string) {}
+
+  /** IDs in input order; resolves only after persistence succeeds, so an uploaded ID survives a restart. */
+  async getOrCreate(providerSessionIds: readonly string[]): Promise<AnalyticsSessionId[]> {
+    if (providerSessionIds.some((id) => !providerSessionIdSchema.safeParse(id).success)) {
+      throw new Error('Invalid provider session ID')
+    }
+    if (providerSessionIds.length === 0) {
+      return []
+    }
+    // Serialize reads as well as writes so no caller sees an ID before it is durable.
+    const operation = this.pending.then(async () => {
+      const identities = this.identities ?? (await this.load())
+      this.identities = identities
+      const updated = new Map(identities)
+      const ids = providerSessionIds.map((providerSessionId) => {
+        const id = updated.get(providerSessionId) ?? analyticsSessionIdSchema.parse(randomUUID())
+        updated.set(providerSessionId, id)
+        return id
+      })
+      // One durable write per batch: a first scan of N sessions must not rewrite the file N times.
+      if (updated.size > identities.size) {
+        this.writer ??= new UsageCacheSnapshotWriter('[analytics-session-id]', () => this.file)
+        await this.writer.write(() => JSON.stringify({ schemaVersion: 1, entries: [...updated] }))
+        this.identities = updated
+      }
+      return ids
+    })
+    this.pending = operation.then(
+      () => {},
+      () => {}
+    )
+    return operation
+  }
+
+  /** Includes queued lookups that have not reached the durable writer yet. */
+  async flush(): Promise<void> {
+    await this.pending
+    await this.writer?.flush()
+  }
+
+  private async load(): Promise<Map<string, AnalyticsSessionId>> {
+    let content: string
+    try {
+      content = await readFile(this.file, 'utf8')
+    } catch (error) {
+      if (error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT') {
+        return new Map()
+      }
+      throw error
+    }
+    let raw: unknown
+    try {
+      raw = JSON.parse(content)
+    } catch {
+      throw new Error('Invalid analytics session identity file')
+    }
+    const parsed = identityFileSchema.safeParse(raw)
+    if (!parsed.success) {
+      throw new Error('Invalid analytics session identity file')
+    }
+    const identities = new Map(parsed.data.entries)
+    const analyticsIds = new Set(parsed.data.entries.map(([, id]) => id))
+    if (identities.size !== parsed.data.entries.length || analyticsIds.size !== identities.size) {
+      throw new Error('Duplicate analytics session identity')
+    }
+    return identities
+  }
+}
diff --git a/src/main/usage/usage-provider-store-lifecycle.test.ts b/src/main/usage/usage-provider-store-lifecycle.test.ts
index 02a5571363d..cef33bf6d89 100644
--- a/src/main/usage/usage-provider-store-lifecycle.test.ts
+++ b/src/main/usage/usage-provider-store-lifecycle.test.ts
@@ -1,3 +1,7 @@
+import {
+  setupTelemetryClientTest,
+  cleanupTelemetryClientTest
+} from '../telemetry/client-test-harness'
 import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
 import type * as FsPromises from 'node:fs/promises'
 import { tmpdir } from 'node:os'
@@ -106,6 +110,17 @@ class TestUsageStore extends UsageProviderStoreLifecycle<
         getAllWorktreeMeta: () => ({})
       },
       {
+        tokenUsage: {
+          provider: 'claude',
+          selectSessions: (state) =>
+            state.sessions.map((session) => ({
+              providerSessionId: session.id,
+              input_tokens: 10,
+              output_tokens: 2,
+              cached_input_tokens: 3,
+              cache_write_input_tokens: 1
+            }))
+        },
         logTag: '[test-usage]',
         resolveCacheFile: () => cacheFile,
         createDefaultState: makeState,
@@ -156,6 +171,77 @@ describe('UsageProviderStoreLifecycle', () => {
     vi.restoreAllMocks()
   })
 
+  it('reports enabled scans and preserves revisions when the usage cache is rebuilt', async () => {
+    const telemetry = setupTelemetryClientTest()
+    try {
+      const cacheFile = join(tempDirectory, 'provider.json')
+      scan.mockResolvedValue({ ...emptyScanResult(), sessions: [{ id: 'provider-session' }] })
+      const original = createStore(cacheFile)
+      await original.refresh(true)
+      expect(telemetry.mock.capture).not.toHaveBeenCalled()
+      await original.setEnabled(true)
+      await original.refresh(true)
+      const first = telemetry.mock.capture.mock.calls[0]?.[0]
+      expect(first).toMatchObject({
+        event: 'agent_token_usage',
+        properties: { revision: 1, input_tokens: 10 }
+      })
+      await original.flush()
+      rmSync(cacheFile)
+      const rebuilt = createStore(cacheFile)
+      await rebuilt.setEnabled(true)
+      await rebuilt.refresh(true)
+      expect(telemetry.mock.capture.mock.calls[1]?.[0]).toEqual(first)
+    } finally {
+      cleanupTelemetryClientTest(telemetry.envStash)
+    }
+  })
+
+  it('persists identities for a whole first scan with one write', async () => {
+    const telemetry = setupTelemetryClientTest()
+    try {
+      const sessions = Array.from({ length: 20 }, (_, index) => ({ id: `session-${index}` }))
+      scan.mockResolvedValue({ ...emptyScanResult(), sessions })
+      const store = createStore(join(tempDirectory, 'provider.json'))
+      await store.setEnabled(true)
+      writeProbe.opens = 0
+      await store.refresh(true)
+      // Usage cache, identity file, and token-usage snapshot: one write each.
+      expect(writeProbe.opens).toBe(3)
+      expect(telemetry.mock.capture).toHaveBeenCalledTimes(sessions.length)
+    } finally {
+      cleanupTelemetryClientTest(telemetry.envStash)
+    }
+  })
+
+  it('keeps analytics identity separate from usage cache rebuilds and never puts it in snapshots', async () => {
+    const cacheFile = join(tempDirectory, 'provider.json')
+    const identityFile = join(tempDirectory, 'provider-analytics-session-ids.json')
+    const original = createStore(cacheFile)
+    expect(existsSync(identityFile)).toBe(false)
+    const [id] = await original.getAnalyticsSessionIds(['provider-session'])
+    expect(existsSync(identityFile)).toBe(true)
+    await original.setEnabled(true)
+    await original.refresh(true)
+    await original.flush()
+    expect(JSON.stringify(original.getState())).not.toContain(id)
+    expect(readFileSync(cacheFile, 'utf8')).not.toContain(id)
+    rmSync(cacheFile)
+    const rebuilt = createStore(cacheFile)
+    expect(await rebuilt.getAnalyticsSessionIds(['provider-session'])).toEqual([id])
+    expect(await createStore().getAnalyticsSessionIds(['provider-session'])).not.toEqual([id])
+  })
+
+  it('flush waits for queued analytics identity creation', async () => {
+    const store = createStore()
+    const identity = store.getAnalyticsSessionIds(['session'])
+    await store.flush()
+    const [id] = await identity
+    expect(
+      readFileSync(join(tempDirectory, 'usage-0-analytics-session-ids.json'), 'utf8')
+    ).toContain(id)
+  })
+
   it('skips disabled and fresh matching states', async () => {
     const store = createStore()
 
diff --git a/src/main/usage/usage-provider-store-lifecycle.ts b/src/main/usage/usage-provider-store-lifecycle.ts
index 850d9e61bda..550f79e3ce5 100644
--- a/src/main/usage/usage-provider-store-lifecycle.ts
+++ b/src/main/usage/usage-provider-store-lifecycle.ts
@@ -1,4 +1,10 @@
 import { existsSync, readFileSync } from 'node:fs'
+import { AgentTokenUsageReporter } from './agent-token-usage-reporter'
+import type { AgentTokenSession } from './agent-token-usage'
+import type { AgentTokenUsage } from '../../shared/telemetry-agent-token-usage-schema'
+import { isTelemetryEnabled } from '../telemetry/client'
+import { join, parse } from 'node:path'
+import { AnalyticsSessionIdStore, type AnalyticsSessionId } from './analytics-session-id-store'
 import type { Store } from '../persistence'
 import { UsageCacheSnapshotWriter } from '../usage-cache-snapshot-writer'
 import { loadKnownUsageWorktreesByRepo } from '../usage-worktree-metadata'
@@ -38,6 +44,10 @@ type UsageProviderStoreLifecycleConfig<
   sourceKey: SourceKey
   dataPresenceKey: DataPresenceKey
   jsonIndent?: number
+  tokenUsage?: {
+    provider: AgentTokenUsage['provider']
+    selectSessions: (state: State) => AgentTokenSession[]
+  }
   scan: (
     worktrees: UsageScanWorktreeRef[],
     previous: State[SourceKey]
@@ -55,6 +65,8 @@ export abstract class UsageProviderStoreLifecycle<
 > {
   protected state: State
   private scanPromise: Promise<void> | null = null
+  private tokenReporter: AgentTokenUsageReporter | null = null
+  private analyticsSessionIds: AnalyticsSessionIdStore | null = null
   private readonly writer: UsageCacheSnapshotWriter
 
   constructor(
@@ -74,9 +86,21 @@ export abstract class UsageProviderStoreLifecycle<
     } as PublicUsageProviderScanState<DataPresenceKey>
   }
 
+  /** Local identity only; callers must use the usage store on the execution host. */
+  getAnalyticsSessionIds(providerSessionIds: readonly string[]): Promise<AnalyticsSessionId[]> {
+    if (!this.analyticsSessionIds) {
+      const { dir, name } = parse(this.config.resolveCacheFile())
+      this.analyticsSessionIds = new AnalyticsSessionIdStore(
+        join(dir, `${name}-analytics-session-ids.json`)
+      )
+    }
+    return this.analyticsSessionIds.getOrCreate(providerSessionIds)
+  }
+
   /** Await queued cache writes so quit does not drop the final snapshot. */
-  flush(): Promise<void> {
-    return this.writer.flush()
+  async flush(): Promise<void> {
+    await this.tokenReporter?.flush()
+    await Promise.all([this.writer.flush(), this.analyticsSessionIds?.flush()])
   }
 
   async setEnabled(enabled: boolean): Promise<PublicUsageProviderScanState<DataPresenceKey>> {
@@ -152,6 +176,7 @@ export abstract class UsageProviderStoreLifecycle<
         this.state.scanState.lastScanError = null
         // Persistence failures do not turn a successful source scan into a scan failure.
         await this.writeToDisk().catch(() => {})
+        await this.reportTokenUsage()
       } catch (error) {
         this.state.scanState.lastScanError = error instanceof Error ? error.message : String(error)
         await this.writeToDisk().catch(() => {})
@@ -163,6 +188,29 @@ export abstract class UsageProviderStoreLifecycle<
     await this.scanPromise
   }
 
+  private async reportTokenUsage(): Promise<void> {
+    const config = this.config.tokenUsage
+    if (!config || !isTelemetryEnabled() || !this.state.scanState.enabled) {
+      return
+    }
+    try {
+      if (!this.tokenReporter) {
+        const { dir, name } = parse(this.config.resolveCacheFile())
+        this.tokenReporter = new AgentTokenUsageReporter(
+          join(dir, `${name}-token-usage.json`),
+          config.provider,
+          (ids) => this.getAnalyticsSessionIds(ids)
+        )
+      }
+      await this.tokenReporter.report(config.selectSessions(this.state))
+    } catch {
+      // Reporting failures must not invalidate a successful local usage scan.
+      console.warn(
+        '[agent-token-usage] Could not report token usage; will retry after the next scan'
+      )
+    }
+  }
+
   private async getCurrentWorktreeFingerprint(): Promise<string> {
     const repos = this.store.getRepos()
     return getUsageWorktreeFingerprint(loadKnownUsageWorktreesByRepo(this.store, repos))
diff --git a/src/main/usage/usage-scan-worker-client.test.ts b/src/main/usage/usage-scan-worker-client.test.ts
index 7b34b5a80f4..09c6f378f00 100644
--- a/src/main/usage/usage-scan-worker-client.test.ts
+++ b/src/main/usage/usage-scan-worker-client.test.ts
@@ -1,4 +1,3 @@
-import { readFileSync } from 'node:fs'
 import { join, sep } from 'node:path'
 import { describe, expect, it, vi } from 'vitest'
 import { resolveWorkerThreadEntryPath } from '../worker-thread-entry-path'
@@ -235,16 +234,4 @@ describe('usage scan worker entry path', () => {
       USAGE_SCAN_WORKER_ENTRY_FILENAME
     ])
   })
-
-  // A rename in the build config would leave both branches pointing at a file
-  // that is never emitted, and only the packaged one fails silently.
-  it('names the entry the main build actually emits', () => {
-    const config = readFileSync(
-      join(import.meta.dirname, '..', '..', '..', 'electron.vite.config.ts'),
-      'utf8'
-    )
-
-    expect(USAGE_SCAN_WORKER_ENTRY_FILENAME).toBe('usage-scan-worker-entry.js')
-    expect(config).toContain("'usage-scan-worker-entry': resolve(")
-  })
 })
diff --git a/src/main/window/attach-main-window-services.test.ts b/src/main/window/attach-main-window-services.test.ts
index ae83f5b7712..9e5c5493f09 100644
--- a/src/main/window/attach-main-window-services.test.ts
+++ b/src/main/window/attach-main-window-services.test.ts
@@ -1,5 +1,6 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { Store } from '../persistence'
+import type { RuntimeNotifier } from '../runtime/runtime-notifier-contract'
 
 const {
   onMock,
@@ -154,7 +155,7 @@ type MainWindowStub = {
 
 type RuntimeStub = {
   attachWindow: MockFn
-  setNotifier: MockFn
+  setNotifier: ReturnType<typeof vi.fn<(notifier: RuntimeNotifier | null) => void>>
   markRendererReloading: MockFn
   markRendererReloadCancelled: MockFn
   markGraphReloadFailed: MockFn
@@ -195,7 +196,7 @@ function createStore(): Store & { flushPendingAsync: MockFn } {
 function createRuntime(): RuntimeStub {
   return {
     attachWindow: vi.fn(),
-    setNotifier: vi.fn(),
+    setNotifier: vi.fn<(notifier: RuntimeNotifier | null) => void>(),
     markRendererReloading: vi.fn(),
     markRendererReloadCancelled: vi.fn(),
     markGraphReloadFailed: vi.fn(),
@@ -290,8 +291,7 @@ describe('attachMainWindowServices', () => {
     await providerStartup.promise
     await Promise.resolve()
 
-    expect(hydrateLocalPtyRegistryAtBootMock).toHaveBeenCalledOnce()
-    expect(hydrateLocalPtyRegistryAtBootMock).toHaveBeenCalledWith(store)
+    expect(hydrateLocalPtyRegistryAtBootMock).toHaveBeenCalledExactlyOnceWith(store)
   })
 
   it('passes injected update quit cleanup to the auto-updater', async () => {
@@ -305,17 +305,23 @@ describe('attachMainWindowServices', () => {
       createRuntime() as never,
       undefined,
       undefined,
-      { onBeforeUpdateQuit, updateInstallMode: 'supervised-headless-serve' }
+      {
+        onBeforeUpdateQuit,
+        onBeforeUpdateQuitFailure: 'abort',
+        updateInstallMode: 'supervised-headless-serve'
+      }
     )
 
     // Deferred to first paint — must not be configured at attach time.
     expect(setupAutoUpdaterMock).not.toHaveBeenCalled()
     await fireReadyToShow(mainWindow)
     expect(setupAutoUpdaterMock).toHaveBeenCalledTimes(1)
-    expect(setupAutoUpdaterMock).toHaveBeenCalledWith(
-      mainWindow,
-      expect.objectContaining({ installMode: 'supervised-headless-serve' })
-    )
+    const [updaterWindow, updaterOptions] = setupAutoUpdaterMock.mock.calls[0]
+    expect(updaterWindow).toBe(mainWindow)
+    expect(updaterOptions).toMatchObject({
+      installMode: 'supervised-headless-serve',
+      onBeforeQuitFailure: 'abort'
+    })
     await setupAutoUpdaterMock.mock.calls[0][1].onBeforeQuit()
 
     expect(onBeforeUpdateQuit).toHaveBeenCalledTimes(1)
@@ -758,14 +764,9 @@ describe('attachMainWindowServices', () => {
     attachMainWindowServices(mainWindow as never, createStore(), runtime as never)
 
     expect(runtime.setNotifier).toHaveBeenCalledTimes(1)
-    const notifier = runtime.setNotifier.mock.calls[0][0] as {
-      worktreesChanged: (repoId: string) => void
-      reposChanged: () => void
-      activateWorktree: (
-        repoId: string,
-        worktreeId: string,
-        setup?: { runnerScriptPath: string; envVars: Record<string, string> }
-      ) => void
+    const notifier = runtime.setNotifier.mock.calls[0][0]
+    if (!notifier) {
+      throw new Error('Missing runtime notifier')
     }
 
     notifier.worktreesChanged('repo-1')
diff --git a/src/main/window/attach-main-window-services.ts b/src/main/window/attach-main-window-services.ts
index 78496abc1fc..5a7aab6b145 100644
--- a/src/main/window/attach-main-window-services.ts
+++ b/src/main/window/attach-main-window-services.ts
@@ -24,7 +24,7 @@ import { registerRemoteWorkspaceHandlers } from '../ipc/remote-workspace'
 import { browserManager } from '../browser/browser-manager'
 import { hasSystemMediaAccess, requestSystemMediaAccess } from '../browser/browser-media-access'
 import type { OrcaRuntimeService, RuntimeWorktreeLifecycleEvent } from '../runtime/orca-runtime'
-import type { UpdateInstallMode } from '../updater'
+import type { PreQuitCleanupFailureMode, UpdateInstallMode } from '../updater'
 import { scheduleHistoryGc } from '../terminal-history-gc'
 import { hydrateLocalPtyRegistryAtBoot } from '../memory/hydrate-local-pty-registry'
 import type { ClaudeRuntimeAuthPreparation } from '../claude-accounts/runtime-auth-service'
@@ -64,6 +64,7 @@ export function attachMainWindowServices(
     onCodexHomePtySpawned?: (args: CodexHomePtySpawnedLifecycleArgs) => void
     onPtyExit?: (id: string, exitSequence: number) => void
     onBeforeUpdateQuit?: () => void | Promise<void>
+    onBeforeUpdateQuitFailure?: PreQuitCleanupFailureMode
     updateInstallMode?: UpdateInstallMode
     onWorktreeLifecycle?: (event: RuntimeWorktreeLifecycleEvent) => void
   }
diff --git a/src/main/window/clipboard-file-copy.test.ts b/src/main/window/clipboard-file-copy.test.ts
index d1142705a92..dfc58eb7e1c 100644
--- a/src/main/window/clipboard-file-copy.test.ts
+++ b/src/main/window/clipboard-file-copy.test.ts
@@ -91,6 +91,17 @@ describe('writeFileToClipboard', () => {
     expect(args.join(' ')).toContain("Set-Clipboard -LiteralPath '/repo/o''brien.png'")
   })
 
+  it('doubles typographic single quotes, which PowerShell also treats as delimiters', async () => {
+    const runCommand = vi.fn(async (_command: string, _args: string[]) => {})
+    await writeFileToClipboard(
+      '/repo/o\u2019brien.png',
+      makeDeps({ platform: 'win32', runCommand })
+    )
+    expect(runCommand.mock.calls[0][1].join(' ')).toContain(
+      "Set-Clipboard -LiteralPath '/repo/o\u2019\u2019brien.png'"
+    )
+  })
+
   it('reports a failure (never throws) when PowerShell rejects on Windows', async () => {
     const runCommand = vi.fn(async (_command: string, _args: string[]) => {
       throw new Error('powershell.exe not found')
diff --git a/src/main/window/clipboard-file-copy.ts b/src/main/window/clipboard-file-copy.ts
index 63f5594f279..bc09c27c19c 100644
--- a/src/main/window/clipboard-file-copy.ts
+++ b/src/main/window/clipboard-file-copy.ts
@@ -1,5 +1,6 @@
 import { isAbsolute } from 'node:path'
 import { pathToFileURL } from 'node:url'
+import { quotePowerShellLiteral } from '../../shared/powershell-native-argument'
 
 export type ClipboardFileResult = { ok: boolean; reason?: string }
 
@@ -47,15 +48,14 @@ export async function writeFileToClipboard(
 
   if (deps.platform === 'win32') {
     // Set-Clipboard -LiteralPath populates CF_HDROP, which Explorer pastes as a
-    // file. Single-quote escaping for the PowerShell string literal. Guard the
-    // spawn so a missing/erroring PowerShell surfaces as a result, not a throw.
-    const escaped = clipboardPath.replace(/'/g, "''")
+    // file. Guard the spawn so a missing/erroring PowerShell surfaces as a
+    // result, not a throw.
     try {
       await deps.runCommand('powershell.exe', [
         '-NoProfile',
         '-NonInteractive',
         '-Command',
-        `Set-Clipboard -LiteralPath '${escaped}'`
+        `Set-Clipboard -LiteralPath ${quotePowerShellLiteral(clipboardPath)}`
       ])
       return { ok: true }
     } catch {
diff --git a/src/main/window/history-gc-profile-worktree-ids.test.ts b/src/main/window/history-gc-profile-worktree-ids.test.ts
index b3f0960eab9..3c01d0f2ea2 100644
--- a/src/main/window/history-gc-profile-worktree-ids.test.ts
+++ b/src/main/window/history-gc-profile-worktree-ids.test.ts
@@ -3,11 +3,14 @@
  * segment, while the Store the GC consults holds one profile's ids. Without
  * these, switching profiles makes every other profile's history look orphaned.
  */
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs'
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it } from 'vitest'
 import { folderWorkspaceKey } from '../../shared/workspace-scope'
+import { importProfileStateJson } from '../persistence/profile-state/profile-state-documents'
+import { openProfileStateDatabase } from '../persistence/profile-state/profile-state-database'
+import { getOrcaProfileStateDatabaseFile } from '../orca-profiles/profile-storage-paths'
 import { getOtherProfileWorktreeIdsForHistoryGc } from './history-gc-profile-worktree-ids'
 
 const roots: string[] = []
@@ -103,6 +106,153 @@ describe('getOtherProfileWorktreeIdsForHistoryGc', () => {
     expect(getOtherProfileWorktreeIdsForHistoryGc(root).unreadableProfiles).toBe(1)
   })
 
+  it('prefers the profile database over a stale JSON export', () => {
+    const root = userDataWithProfiles('active', [
+      { id: 'active', state: {} },
+      {
+        id: 'other',
+        state: { worktreeMeta: { 'repo::/json': {} }, folderWorkspaces: [] }
+      }
+    ])
+    const database = openProfileStateDatabase(
+      getOrcaProfileStateDatabaseFile('other', root),
+      'other'
+    )
+    try {
+      importProfileStateJson(
+        database.db,
+        JSON.stringify({
+          worktreeMeta: { 'repo::/database': {} },
+          folderWorkspaces: [{ id: 'folder-database' }]
+        })
+      )
+    } finally {
+      database.db.close()
+    }
+
+    expect(getOtherProfileWorktreeIdsForHistoryGc(root)).toEqual({
+      unreadableProfiles: 0,
+      ids: new Set(['repo::/database', folderWorkspaceKey('folder-database')])
+    })
+  })
+
+  it('falls back to JSON without creating a database', () => {
+    const root = userDataWithProfiles('active', [
+      { id: 'active', state: {} },
+      { id: 'other', state: { worktreeMeta: { 'repo::/json': {} } } }
+    ])
+    const databaseFile = getOrcaProfileStateDatabaseFile('other', root)
+
+    expect(getOtherProfileWorktreeIdsForHistoryGc(root)).toEqual({
+      unreadableProfiles: 0,
+      ids: new Set(['repo::/json'])
+    })
+    expect(existsSync(databaseFile)).toBe(false)
+  })
+
+  it.each([true, false])(
+    'refuses history pruning when SQLite is missing but a retained export exists (JSON: %s)',
+    (hasJson) => {
+      const state = { worktreeMeta: { 'repo::/stale-json': {} } }
+      const root = userDataWithProfiles('active', [
+        { id: 'active', state: {} },
+        { id: 'other', ...(hasJson ? { state } : {}) }
+      ])
+      const dataFile = join(root, 'profiles', 'other', 'orca-data.json')
+      const exportPath = `${dataFile}.sqlite-export.1.json`
+      const exportJson = JSON.stringify({ worktreeMeta: { 'repo::/export': {} } })
+      writeFileSync(exportPath, exportJson)
+
+      expect(getOtherProfileWorktreeIdsForHistoryGc(root)).toEqual({
+        unreadableProfiles: 1,
+        ids: new Set()
+      })
+      expect(existsSync(getOrcaProfileStateDatabaseFile('other', root))).toBe(false)
+      expect(existsSync(dataFile)).toBe(hasJson)
+      if (hasJson) {
+        expect(readFileSync(dataFile, 'utf8')).toBe(JSON.stringify(state))
+      }
+      expect(readFileSync(exportPath, 'utf8')).toBe(exportJson)
+    }
+  )
+
+  it('reads SQLite-only profiles with retained exports without blocking history pruning', () => {
+    const root = userDataWithProfiles('active', [{ id: 'active', state: {} }, { id: 'other' }])
+    const database = openProfileStateDatabase(
+      getOrcaProfileStateDatabaseFile('other', root),
+      'other'
+    )
+    try {
+      importProfileStateJson(
+        database.db,
+        JSON.stringify({ worktreeMeta: { 'repo::/database': {} } })
+      )
+    } finally {
+      database.db.close()
+    }
+    const dataFile = join(root, 'profiles', 'other', 'orca-data.json')
+    writeFileSync(
+      `${dataFile}.sqlite-export.1.json`,
+      JSON.stringify({ worktreeMeta: { 'repo::/stale-export': {} } })
+    )
+
+    expect(getOtherProfileWorktreeIdsForHistoryGc(root)).toEqual({
+      unreadableProfiles: 0,
+      ids: new Set(['repo::/database'])
+    })
+    expect(existsSync(dataFile)).toBe(false)
+  })
+
+  it('does not fall back to JSON when an existing database is corrupt', () => {
+    const root = userDataWithProfiles('active', [
+      { id: 'active', state: {} },
+      { id: 'other', state: { worktreeMeta: { 'repo::/json': {} } } }
+    ])
+    writeFileSync(getOrcaProfileStateDatabaseFile('other', root), 'not a sqlite database')
+
+    expect(getOtherProfileWorktreeIdsForHistoryGc(root)).toEqual({
+      unreadableProfiles: 1,
+      ids: new Set()
+    })
+  })
+
+  it.each(['-wal', '-shm', '-journal'])(
+    'does not fall back to JSON when only %s remains',
+    (suffix) => {
+      const root = userDataWithProfiles('active', [
+        { id: 'active', state: {} },
+        { id: 'other', state: { worktreeMeta: { 'repo::/json': {} } } }
+      ])
+      writeFileSync(
+        `${getOrcaProfileStateDatabaseFile('other', root)}${suffix}`,
+        'orphaned evidence'
+      )
+
+      expect(getOtherProfileWorktreeIdsForHistoryGc(root)).toEqual({
+        unreadableProfiles: 1,
+        ids: new Set()
+      })
+    }
+  )
+
+  it('refuses history pruning for a future profile database schema', () => {
+    const root = userDataWithProfiles('active', [
+      { id: 'active', state: {} },
+      { id: 'other', state: { worktreeMeta: { 'repo::/json': {} } } }
+    ])
+    const database = openProfileStateDatabase(
+      getOrcaProfileStateDatabaseFile('other', root),
+      'other'
+    )
+    database.db.pragma('user_version = 99')
+    database.db.close()
+
+    expect(getOtherProfileWorktreeIdsForHistoryGc(root)).toEqual({
+      unreadableProfiles: 1,
+      ids: new Set()
+    })
+  })
+
   // A single-profile install must not pay for this, and no index at all is the
   // pre-profiles layout rather than an error.
   it('is empty and complete when there is no profile index', () => {
diff --git a/src/main/window/history-gc-profile-worktree-ids.ts b/src/main/window/history-gc-profile-worktree-ids.ts
index 6f82b96fc37..07a115b0ad8 100644
--- a/src/main/window/history-gc-profile-worktree-ids.ts
+++ b/src/main/window/history-gc-profile-worktree-ids.ts
@@ -1,10 +1,13 @@
-import { readFileSync } from 'node:fs'
+import { lstatSync, readFileSync } from 'node:fs'
 import { folderWorkspaceKey } from '../../shared/workspace-scope'
 import {
   getOrcaProfileDataFile,
+  getOrcaProfileStateDatabaseFile,
   getProfileUserDataPath
 } from '../orca-profiles/profile-storage-paths'
 import { getOrcaProfileIndexPath, readProfileIndex } from '../orca-profiles/profile-index-store'
+import { readProfileStateDomains } from '../persistence/profile-state/profile-state-domain-reader'
+import { assertNoRetainedProfileStateExports } from '../persistence/profile-state/profile-state-recovery-required'
 
 /**
  * Worktree ids owned by Orca profiles OTHER than the running one.
@@ -16,7 +19,7 @@ import { getOrcaProfileIndexPath, readProfileIndex } from '../orca-profiles/prof
  * switch every other profile's history looks orphaned, and the GC deletes shell
  * history those profiles are still using.
  *
- * Reading their data files directly is deliberate: a Store per profile would
+ * Reading their persisted state directly is deliberate: a Store per profile would
  * run migrations and normalization against state another profile owns. Only the
  * two id-bearing collections are read, and any unreadable profile is skipped —
  * a profile whose ids cannot be established must widen the live set's
@@ -37,7 +40,7 @@ export function getOtherProfileWorktreeIdsForHistoryGc(userDataPath = getProfile
     if (profile.id === index.activeProfileId) {
       continue
     }
-    const collected = readProfileWorktreeIds(getOrcaProfileDataFile(profile.id, userDataPath))
+    const collected = readProfileWorktreeIds(profile.id, userDataPath)
     if (!collected) {
       unreadableProfiles += 1
       continue
@@ -49,7 +52,99 @@ export function getOtherProfileWorktreeIdsForHistoryGc(userDataPath = getProfile
   return { ids, unreadableProfiles }
 }
 
-function readProfileWorktreeIds(dataFile: string): Set<string> | null {
+function readProfileWorktreeIds(profileId: string, userDataPath: string): Set<string> | null {
+  const databaseFile = getOrcaProfileStateDatabaseFile(profileId, userDataPath)
+  // A present database is authoritative. In particular, do not fall back to a
+  // stale JSON export after corruption or a future schema, because that could
+  // make live history look orphaned and delete it.
+  const databasePresence = profileStateDatabasePresence(databaseFile)
+  if (databasePresence === 'present') {
+    return readProfileWorktreeIdsFromDatabase(databaseFile, profileId)
+  }
+  if (databasePresence === 'unreadable') {
+    return null
+  }
+  const dataFile = getOrcaProfileDataFile(profileId, userDataPath)
+  try {
+    assertNoRetainedProfileStateExports({ dataFile, databaseFile, profileId })
+  } catch {
+    return null
+  }
+  return readProfileWorktreeIdsFromJson(dataFile)
+}
+
+function profileStateDatabasePresence(path: string): 'absent' | 'present' | 'unreadable' {
+  let mainDatabasePresent = false
+  try {
+    lstatSync(path)
+    mainDatabasePresent = true
+  } catch (error) {
+    if (error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT') {
+      mainDatabasePresent = false
+    } else {
+      return 'unreadable'
+    }
+  }
+  if (mainDatabasePresent) {
+    return 'present'
+  }
+  for (const sidecar of [`${path}-wal`, `${path}-shm`, `${path}-journal`]) {
+    try {
+      lstatSync(sidecar)
+      return 'unreadable'
+    } catch (error) {
+      if (!error || typeof error !== 'object' || !('code' in error) || error.code !== 'ENOENT') {
+        return 'unreadable'
+      }
+    }
+  }
+  return 'absent'
+}
+
+function readProfileWorktreeIdsFromDatabase(
+  databaseFile: string,
+  profileId: string
+): Set<string> | null {
+  const domains = readProfileStateDomains(databaseFile, profileId, [
+    'worktreeMeta',
+    'folderWorkspaces'
+  ])
+  if (domains.kind === 'unreadable') {
+    return null
+  }
+
+  const ids = new Set<string>()
+  const worktreeMeta = domains.values.get('worktreeMeta')
+  if (worktreeMeta !== undefined) {
+    if (worktreeMeta === null) {
+      // Explicit null is a valid legacy state value and means no metadata.
+    } else if (!isRecord(worktreeMeta)) {
+      return null
+    } else {
+      for (const id of Object.keys(worktreeMeta)) {
+        ids.add(id)
+      }
+    }
+  }
+  const folderWorkspaces = domains.values.get('folderWorkspaces')
+  if (folderWorkspaces !== undefined) {
+    if (folderWorkspaces === null) {
+      // Explicit null is a valid legacy state value and means no workspaces.
+    } else if (!Array.isArray(folderWorkspaces)) {
+      return null
+    } else {
+      for (const workspace of folderWorkspaces) {
+        const id = isRecord(workspace) ? workspace.id : undefined
+        if (typeof id === 'string' && id) {
+          ids.add(folderWorkspaceKey(id))
+        }
+      }
+    }
+  }
+  return ids
+}
+
+function readProfileWorktreeIdsFromJson(dataFile: string): Set<string> | null {
   let parsed: unknown
   try {
     parsed = JSON.parse(readFileSync(dataFile, 'utf8'))
@@ -78,3 +173,7 @@ function readProfileWorktreeIds(dataFile: string): Set<string> | null {
   }
   return ids
 }
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
diff --git a/src/main/window/main-window-updater.ts b/src/main/window/main-window-updater.ts
index f0298ed115d..7cdcdd8cd73 100644
--- a/src/main/window/main-window-updater.ts
+++ b/src/main/window/main-window-updater.ts
@@ -16,6 +16,7 @@ import {
   quitAndInstall,
   setupAutoUpdater,
   showLinuxPackage,
+  type PreQuitCleanupFailureMode,
   type UpdateInstallMode
 } from '../updater'
 
@@ -33,6 +34,7 @@ export function scheduleMainWindowAutoUpdaterSetup(
   store: Store,
   options?: {
     onBeforeUpdateQuit?: () => void | Promise<void>
+    onBeforeUpdateQuitFailure?: PreQuitCleanupFailureMode
     updateInstallMode?: UpdateInstallMode
   }
 ): void {
@@ -69,6 +71,7 @@ export function scheduleMainWindowAutoUpdaterSetup(
         store.updateUI({ dismissedUpdateNudgeId: id })
       },
       getReleaseChannelOverride: () => store.getUI().releaseChannelOverride ?? null,
+      onBeforeQuitFailure: options?.onBeforeUpdateQuitFailure,
       installMode: options?.updateInstallMode
     })
     logStartupMilestone('updater-setup-done')
diff --git a/src/main/window/runtime-window-lifecycle.ts b/src/main/window/runtime-window-lifecycle.ts
index 78c5f2ec426..142389099c0 100644
--- a/src/main/window/runtime-window-lifecycle.ts
+++ b/src/main/window/runtime-window-lifecycle.ts
@@ -198,7 +198,8 @@ export function registerRuntimeWindowLifecycle(
         baseVersion,
         content
       }) as Promise<RuntimeMarkdownSaveTabResult>,
-    closeTerminal: (tabId, paneRuntimeId) => send('ui:closeTerminal', { tabId, paneRuntimeId }),
+    closeTerminal: (tabId) => send('ui:closeTerminal', { kind: 'tab', tabId }),
+    closeTerminalPane: (tabId, leafId) => send('ui:closeTerminal', { kind: 'pane', tabId, leafId }),
     closeTerminalTab: (tabId, options) =>
       requestTerminalTabCloseFromRenderer(mainWindow, tabId, options),
     sleepWorktree: (worktreeId) => send('ui:sleepWorktree', { worktreeId }),
diff --git a/src/main/windows/windows-msys-job.win32.test.ts b/src/main/windows/windows-msys-job.win32.test.ts
index e7e0bee950a..9bf5485102e 100644
--- a/src/main/windows/windows-msys-job.win32.test.ts
+++ b/src/main/windows/windows-msys-job.win32.test.ts
@@ -37,8 +37,12 @@ describeOnWindows('MSYS terminal job ownership', () => {
     })
     let output = ''
     let childPid: number | undefined
+    let exit: { exitCode: number; signal?: number } | undefined
+    proc.onExit((event) => {
+      exit = event
+    })
     proc.onData((chunk) => {
-      output += chunk
+      output = (output + chunk).slice(-32_768)
       const match = /MSYS_OWNED_CHILD=(\d+)/.exec(output)
       if (match) {
         childPid = Number(match[1])
@@ -48,7 +52,14 @@ describeOnWindows('MSYS terminal job ownership', () => {
       proc.write(
         `${quotePosixShell(process.execPath.replace(/\\/g, '/'))} ${quotePosixShell(script.replace(/\\/g, '/'))}\r`
       )
-      await vi.waitFor(() => expect(childPid).toBeDefined(), { timeout: 15_000 })
+      try {
+        await vi.waitFor(() => expect(childPid).toBeDefined(), { timeout: 15_000 })
+      } catch (cause) {
+        throw new Error(
+          JSON.stringify({ shellPid: proc.pid, exit, jobPids: listPtyJobProcessIds(proc), output }),
+          { cause }
+        )
+      }
       expect(isAlive(childPid!)).toBe(true)
       expect(listPtyJobProcessIds(proc)).toContain(childPid)
       expect(terminatePtyJob(proc)).toBe('terminated')
diff --git a/src/main/windows/windows-process-creation-time.test.ts b/src/main/windows/windows-process-creation-time.test.ts
new file mode 100644
index 00000000000..3a316613b2b
--- /dev/null
+++ b/src/main/windows/windows-process-creation-time.test.ts
@@ -0,0 +1,88 @@
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import {
+  __setWindowsProcessTreeLoaderForTests,
+  __setWindowsProcessTreeRequireForTests,
+  readWindowsProcessCreationTime
+} from './windows-process-table'
+
+const platform = Object.getOwnPropertyDescriptor(process, 'platform')
+const read = vi.fn<(pid: number) => number | undefined>()
+const scan = vi.fn()
+
+beforeEach(() => {
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+  read.mockReset().mockReturnValue(1_700_000_000_000)
+  scan.mockReset()
+  __setWindowsProcessTreeLoaderForTests(() => ({
+    ProcessDataFlag: { None: 0, CommandLine: 2, CreationTime: 4 },
+    getAllProcesses: scan,
+    getProcessCreationTime: read
+  }))
+})
+
+afterEach(() => {
+  __setWindowsProcessTreeRequireForTests()
+  if (platform) {
+    Object.defineProperty(process, 'platform', platform)
+  }
+})
+
+it('reads one PID afresh on each call without enumerating the table', () => {
+  expect(readWindowsProcessCreationTime(12)).toBe(1_700_000_000_000)
+  read.mockReturnValue(1_800_000_000_000)
+  expect(readWindowsProcessCreationTime(12)).toBe(1_800_000_000_000)
+  expect(read.mock.calls).toEqual([[12], [12]])
+  expect(scan).not.toHaveBeenCalled()
+})
+
+it.each([undefined, 0, -1, Number.NaN, Infinity, 1.5, Number.MAX_SAFE_INTEGER + 1])(
+  'keeps an unavailable or invalid native creation time unverifiable: %s',
+  (value) => {
+    read.mockReturnValue(value)
+    expect(readWindowsProcessCreationTime(12)).toBeNull()
+  }
+)
+
+it.each([0, -1, Number.NaN, Infinity, 1.5, 0x100000000])('refuses an invalid PID %s', (pid) => {
+  expect(readWindowsProcessCreationTime(pid)).toBeNull()
+  expect(read).not.toHaveBeenCalled()
+})
+
+it('keeps denied or failed native queries unverifiable', () => {
+  read.mockImplementation(() => {
+    throw Object.assign(new Error('access denied'), { code: 'EPERM' })
+  })
+  expect(readWindowsProcessCreationTime(12)).toBeNull()
+})
+
+it('does not invoke the reader off Windows', () => {
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'linux' })
+  expect(readWindowsProcessCreationTime(12)).toBeNull()
+  expect(read).not.toHaveBeenCalled()
+})
+
+it.each([true, false])('does not scan or fork when native capability is missing: %s', (loaded) => {
+  __setWindowsProcessTreeLoaderForTests(() =>
+    loaded
+      ? {
+          ProcessDataFlag: { None: 0, CommandLine: 2, CreationTime: 4 },
+          supportedProcessDataFlags: 7,
+          getAllProcesses: scan
+        }
+      : null
+  )
+  expect(readWindowsProcessCreationTime(12)).toBeNull()
+  expect(scan).not.toHaveBeenCalled()
+})
+
+it('adapts the same identity getter from the staged relay addon', () => {
+  __setWindowsProcessTreeRequireForTests((specifier) => {
+    if (specifier === '@vscode/windows-process-tree') {
+      throw new Error('no package')
+    }
+    return { getProcessList: scan, getProcessCreationTime: read }
+  })
+  expect(readWindowsProcessCreationTime(12)).toBe(1_700_000_000_000)
+  expect(read).toHaveBeenCalledWith(12)
+  expect(scan).not.toHaveBeenCalled()
+})
diff --git a/src/main/windows/windows-process-table-native-addon.win32.test.ts b/src/main/windows/windows-process-table-native-addon.win32.test.ts
index 1120d8173b4..64045b5b779 100644
--- a/src/main/windows/windows-process-table-native-addon.win32.test.ts
+++ b/src/main/windows/windows-process-table-native-addon.win32.test.ts
@@ -1,6 +1,7 @@
 import { expect, it } from 'vitest'
 import {
   isWindowsProcessStartTimeAvailable,
+  readWindowsProcessCreationTime,
   readWindowsProcessTableFresh
 } from './windows-process-table'
 
@@ -22,5 +23,7 @@ it.runIf(process.platform === 'win32')(
     expect(typeof self?.creationTimeMs).toBe('number')
     expect(self?.creationTimeMs).toBeGreaterThan(Date.parse('2020-01-01T00:00:00Z'))
     expect(self?.creationTimeMs).toBeLessThanOrEqual(Date.now())
+    expect(readWindowsProcessCreationTime(process.pid)).toBe(self?.creationTimeMs)
+    expect(readWindowsProcessCreationTime(process.pid)).toBe(self?.creationTimeMs)
   }
 )
diff --git a/src/main/windows/windows-process-table.test.ts b/src/main/windows/windows-process-table.test.ts
index 16c411ceb71..959a0092ff0 100644
--- a/src/main/windows/windows-process-table.test.ts
+++ b/src/main/windows/windows-process-table.test.ts
@@ -481,6 +481,29 @@ describe('PowerShell fallback when the native binding is absent', () => {
     expect(cimScan).not.toHaveBeenCalled()
   })
 
+  it('says so in the log, once, rather than falling back silently', async () => {
+    // #16905 was this path running as the daemon's steady state with nothing to
+    // notice it. Absence is legitimate on a relay; being quiet about it is not.
+    const fallbackWarnings = (): number =>
+      warn.mock.calls.filter((call) =>
+        String(call[0]).includes('falling back to a powershell.exe CIM scan')
+      ).length
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    __setWindowsProcessTreeLoaderForTests(() => null)
+
+    await readWindowsProcessTableFresh()
+    await readWindowsProcessTableFresh()
+    expect(fallbackWarnings()).toBe(1)
+
+    // Re-injecting resets the reader, so the next process-equivalent warns again.
+    // Asserting only the first count passes even with that reset removed, as long
+    // as an earlier test in this file happened to trip the fallback first.
+    __setWindowsProcessTreeLoaderForTests(() => null)
+    await readWindowsProcessTableFresh()
+    expect(fallbackWarnings()).toBe(2)
+    warn.mockRestore()
+  })
+
   it('rejects a scan missing our own pid instead of reporting an idle machine', async () => {
     __setWindowsProcessTreeLoaderForTests(() => null)
     cimScan.mockResolvedValue([{ pid: 200, ppid: 4, name: 'claude.exe', command: 'claude' }])
diff --git a/src/main/windows/windows-process-table.ts b/src/main/windows/windows-process-table.ts
index e3064560174..20f1ca000c2 100644
--- a/src/main/windows/windows-process-table.ts
+++ b/src/main/windows/windows-process-table.ts
@@ -82,6 +82,7 @@ type WindowsProcessTreeModule = {
    * prebuilt `.node` in place.
    */
   supportedProcessDataFlags?: number
+  getProcessCreationTime?: (pid: number) => number | undefined
   getAllProcesses: (
     callback: (processes: NativeProcessInfo[] | undefined) => void,
     flags?: number
@@ -112,6 +113,7 @@ let requireNative: NativeRequire = requireFromMain
  * binding straight to the addon drops a duplicate rather than losing a guard.
  */
 type WindowsProcessTreeAddon = {
+  getProcessCreationTime?: (pid: number) => number | undefined
   getProcessList: (
     callback: (processes: NativeProcessInfo[] | undefined) => void,
     flags: number
@@ -168,6 +170,13 @@ function stagedRelayAddonIsUnpatched(): boolean {
   }
 }
 
+/**
+ * Once per process, for the main and relay processes whose console is real. The
+ * daemon's stderr is destroyed once it reports ready, so it logs this capability
+ * to daemonLog at startup instead (daemon-entry.ts).
+ */
+let warnedAboutCimFallback = false
+
 let cachedModule: WindowsProcessTreeModule | null | undefined
 let moduleLoader: () => WindowsProcessTreeModule | null = loadWindowsProcessTree
 let cimScan: () => Promise<WindowsProcessRow[]> = readWindowsProcessRowsWithCim
@@ -177,6 +186,7 @@ function adaptAddon(addon: WindowsProcessTreeAddon): WindowsProcessTreeModule {
   return {
     ProcessDataFlag: PROCESS_DATA_FLAG,
     supportedProcessDataFlags: addon.supportedProcessDataFlags,
+    getProcessCreationTime: addon.getProcessCreationTime,
     getAllProcesses: (callback, flags) => addon.getProcessList(callback, flags ?? 0)
   }
 }
@@ -293,6 +303,7 @@ let nativeReadGate: Promise<unknown> = Promise.resolve()
 
 function resetNativeReaderState(): void {
   nativeReaderEpoch += 1
+  warnedAboutCimFallback = false
   unreturnedReads.clear()
   // Chain, never replace. Dropping the old chain lets a waiter still holding it
   // run against a read queued on the new one -- two concurrent calls into one
@@ -367,6 +378,12 @@ function readOneSnapshot<Row>(projection: ProcessRowProjection<Row>): Promise<Ro
       // never silently start forking shells at the caller's poll rate. Absence
       // is the one condition that can never resolve itself — see
       // docs/reference/windows-process-enumeration.md.
+      if (!warnedAboutCimFallback) {
+        warnedAboutCimFallback = true
+        console.warn(
+          '[windows-process-table] no native binding; falling back to a powershell.exe CIM scan at each caller poll. See docs/reference/windows-process-enumeration.md.'
+        )
+      }
       return projection.cimFallback()
     }
     // Reject rather than resolve empty: an empty table is a claim that nothing
@@ -528,6 +545,19 @@ export function isWindowsProcessStartTimeAvailable(): boolean {
   )
 }
 
+/** Fresh identity for synchronous profile admission; opens one PID without taking a table snapshot. */
+export function readWindowsProcessCreationTime(pid: number): number | null {
+  if (process.platform !== 'win32' || !Number.isSafeInteger(pid) || pid <= 0 || pid > 0xffffffff) {
+    return null
+  }
+  try {
+    const value = moduleLoader()?.getProcessCreationTime?.(pid)
+    return typeof value === 'number' && Number.isSafeInteger(value) && value > 0 ? value : null
+  } catch {
+    return null
+  }
+}
+
 function resetSnapshotReaders(): void {
   identityReader.reset()
   detailedReader.reset()
diff --git a/src/main/windows/windows-pty-job.ts b/src/main/windows/windows-pty-job.ts
index 169db375f3b..814f2dbaa8a 100644
--- a/src/main/windows/windows-pty-job.ts
+++ b/src/main/windows/windows-pty-job.ts
@@ -1,4 +1,6 @@
 import type { IPty } from 'node-pty'
+import { canUseBunPty } from '../daemon/pty-subprocess/bun-pty-process-capabilities'
+import { loadWindowsBunPtyJobNative } from '../daemon/pty-subprocess/windows-bun-pty-native'
 import { createRequire } from 'node:module'
 import { recordSelfInitiatedTreeKill } from '../crash-reporting/self-initiated-tree-kill-log'
 
@@ -33,6 +35,19 @@ type ConptyNative = {
   assignCurrentProcessToJob: () => boolean
 }
 
+type SelfOwnedPty = IPty & {
+  jobRootProcessIsWrapper?: true
+  shellProcessId?: number
+  terminateOwnedTree?: () => JobTerminationOutcome
+  listOwnedProcessIds?: () => readonly number[] | null
+}
+
+/** The gate's pid never proves that its user shell remains alive. */
+export function ptyShellProcessId(proc: IPty): number | undefined {
+  const owned: SelfOwnedPty = proc
+  return owned.jobRootProcessIsWrapper ? owned.shellProcessId : proc.pid
+}
+
 let cachedNative: ConptyNative | null | undefined
 let nativeLoader: () => ConptyNative | null = loadConptyNative
 
@@ -89,6 +104,23 @@ export type JobTerminationOutcome = 'terminated' | 'unavailable'
  * to be misread as "nothing to kill".
  */
 export function terminatePtyJob(proc: IPty): JobTerminationOutcome {
+  const owned: SelfOwnedPty = proc
+  if (typeof owned.terminateOwnedTree === 'function') {
+    let outcome: JobTerminationOutcome
+    try {
+      outcome = owned.terminateOwnedTree()
+    } catch {
+      return 'unavailable'
+    }
+    if (outcome === 'terminated') {
+      recordSelfInitiatedTreeKill({
+        pid: proc.pid,
+        site: 'windows-pty-job-teardown',
+        scope: 'win-pty-job'
+      })
+    }
+    return outcome
+  }
   const target = ptyJobTarget(proc)
   const native = nativeLoader()
   if (!target || !native) {
@@ -132,6 +164,14 @@ export function terminatePtyJob(proc: IPty): JobTerminationOutcome {
  * including children that detached from the console.
  */
 export function listPtyJobProcessIds(proc: IPty): readonly number[] | null {
+  const owned: SelfOwnedPty = proc
+  if (typeof owned.listOwnedProcessIds === 'function') {
+    try {
+      return owned.listOwnedProcessIds()
+    } catch {
+      return null
+    }
+  }
   const target = ptyJobTarget(proc)
   const native = nativeLoader()
   if (!target || !native) {
@@ -193,7 +233,7 @@ function assignHostProcessOnce(): boolean {
 
 /** Whether this build can own PTY trees with job objects at all. */
 export function isPtyJobOwnershipAvailable(): boolean {
-  return nativeLoader() !== null
+  return canUseBunPty() ? loadWindowsBunPtyJobNative() !== null : nativeLoader() !== null
 }
 
 /** Test-only: substitute the native module (it is resolved via createRequire). */
diff --git a/src/main/windows/windows-pty-job.win32.test.ts b/src/main/windows/windows-pty-job.win32.test.ts
index c5f408f7311..cb15463bff8 100644
--- a/src/main/windows/windows-pty-job.win32.test.ts
+++ b/src/main/windows/windows-pty-job.win32.test.ts
@@ -3,6 +3,7 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { IPty } from 'node-pty'
+import { runProcess } from '../../shared/child-process/run-process'
 import {
   isPtyJobOwnershipAvailable,
   listPtyJobProcessIds,
@@ -102,6 +103,21 @@ describeOnWindows('ConPTY job ownership', () => {
     expect(isPtyJobOwnershipAvailable()).toBe(true)
   })
 
+  it('keeps the native table intact while shell cleanup overlaps new terminals', async () => {
+    const result = await runProcess({
+      program: process.execPath,
+      args: [join(process.cwd(), 'config', 'scripts', 'windows-pty-table-stress.cjs')],
+      env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1' },
+      timeoutMs: 90_000
+    })
+    const status = result.code === null ? 'null' : `0x${(result.code >>> 0).toString(16)}`
+    expect(
+      result,
+      `Native host exited ${status} (${result.signal}); timedOut=${result.timedOut}\n${result.stdout}\n${result.stderr}`
+    ).toMatchObject({ code: 0, timedOut: false })
+    expect(result.stdout).toContain('"phase":"complete"')
+  }, 100_000)
+
   it('counts a detached grandchild as part of the pane tree', async () => {
     const { proc, grandchildPid } = await spawnShellWithDetachedGrandchild()
 
diff --git a/src/main/worker-thread-entry-path.ts b/src/main/worker-thread-entry-path.ts
index 9c9de40eb80..265c3048b3a 100644
--- a/src/main/worker-thread-entry-path.ts
+++ b/src/main/worker-thread-entry-path.ts
@@ -46,7 +46,10 @@ export function resolveWorkerThreadEntryPath(
 export function currentWorkerEntryLayout(moduleDir: string): WorkerEntryLayout {
   return {
     isPackaged: hasAppEnvironment() && getAppEnvironment().isPackaged(),
-    resourcesPath: process.resourcesPath,
+    resourcesPath:
+      'resourcesPath' in process && typeof process.resourcesPath === 'string'
+        ? process.resourcesPath
+        : undefined,
     moduleDir
   }
 }
diff --git a/src/main/worker-thread-request-queue.test.ts b/src/main/worker-thread-request-queue.test.ts
index d7f29266acd..1c1616d8839 100644
--- a/src/main/worker-thread-request-queue.test.ts
+++ b/src/main/worker-thread-request-queue.test.ts
@@ -1,4 +1,5 @@
 import type { Worker } from 'node:worker_threads'
+import { getEventListeners } from 'node:events'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { WorkerThreadRequestQueue } from './worker-thread-request-queue'
 
@@ -103,6 +104,88 @@ describe('WorkerThreadRequestQueue', () => {
     vi.useRealTimers()
   })
 
+  it('cancels queued requests without retiring active work and retires active cancellation', async () => {
+    const workers: FakeWorker[] = []
+    const queue = makeQueue(workers)
+    const active = new AbortController()
+    const queued = new AbortController()
+    const first = settle(
+      queue.dispatch((id) => ({ id, label: 'active' }), TIMEOUT_MS, active.signal)
+    )
+    const second = settle(
+      queue.dispatch((id) => ({ id, label: 'queued' }), TIMEOUT_MS, queued.signal)
+    )
+    const third = send(queue, 'survivor')
+    queued.abort(new Error('queued cancelled'))
+    await expect(second).resolves.toMatchObject({ message: 'queued cancelled' })
+    expect(workers[0].terminated).toBe(false)
+    active.abort(new Error('active cancelled'))
+    await expect(first).resolves.toMatchObject({ message: 'active cancelled' })
+    expect(workers[0].terminated).toBe(true)
+    expect(workers).toHaveLength(2)
+    expect(labels(workers[1])).toEqual(['survivor'])
+    workers[0].respond()
+    workers[1].respond()
+    await expect(third).resolves.toMatchObject({ label: 'survivor' })
+    queue.dispose()
+  })
+
+  it('never starts an already aborted request and rejects all work on disposal', async () => {
+    const workers: FakeWorker[] = []
+    const queue = makeQueue(workers)
+    await expect(
+      queue.dispatch(
+        (id) => ({ id, label: 'aborted' }),
+        TIMEOUT_MS,
+        AbortSignal.abort(new Error('cancelled'))
+      )
+    ).rejects.toThrow('cancelled')
+    expect(workers).toHaveLength(0)
+    const active = settle(send(queue, 'active'))
+    const queued = settle(send(queue, 'queued'))
+    queue.dispose()
+    await expect(active).resolves.toMatchObject({ message: 'Worker request queue disposed' })
+    await expect(queued).resolves.toMatchObject({ message: 'Worker request queue disposed' })
+    await expect(send(queue, 'later')).rejects.toThrow('disposed')
+    expect(workers[0].terminated).toBe(true)
+  })
+
+  it.each([false, true])(
+    'does not respawn for queued calls sharing the cancelled active signal (survivor: %s)',
+    async (hasSurvivor) => {
+      const workers: FakeWorker[] = []
+      const queue = makeQueue(workers)
+      const controller = new AbortController()
+      const reason = new Error('scan cancelled')
+      const pending = Array.from({ length: 8 }, (_, index) =>
+        settle(
+          queue.dispatch(
+            (id) => ({ id, label: `cancelled-${index}` }),
+            TIMEOUT_MS,
+            controller.signal
+          )
+        )
+      )
+      const survivor = hasSurvivor ? send(queue, 'survivor') : undefined
+      expect(getEventListeners(controller.signal, 'abort')).toHaveLength(8)
+
+      controller.abort(reason)
+
+      expect(await Promise.all(pending)).toEqual(Array.from({ length: 8 }, () => reason))
+      expect(workers[0].terminated).toBe(true)
+      expect(workers).toHaveLength(hasSurvivor ? 2 : 1)
+      expect(workers.flatMap(labels)).toEqual(
+        hasSurvivor ? ['cancelled-0', 'survivor'] : ['cancelled-0']
+      )
+      expect(getEventListeners(controller.signal, 'abort')).toHaveLength(0)
+      if (survivor) {
+        workers[1].respond()
+        await expect(survivor).resolves.toMatchObject({ label: 'survivor' })
+      }
+      queue.dispose()
+    }
+  )
+
   it('posts one request at a time and in the order it was dispatched', async () => {
     const workers: FakeWorker[] = []
     const queue = makeQueue(workers)
diff --git a/src/main/worker-thread-request-queue.ts b/src/main/worker-thread-request-queue.ts
index 3c8f6d0a711..08c27e0eda4 100644
--- a/src/main/worker-thread-request-queue.ts
+++ b/src/main/worker-thread-request-queue.ts
@@ -43,6 +43,8 @@ type PendingCall<TRequest, TResponse> = {
   resolve: (value: TResponse) => void
   reject: (error: Error) => void
   timer: NodeJS.Timeout | null
+  signal?: AbortSignal
+  cleanupAbort: () => void
 }
 
 export class WorkerThreadRequestQueue<
@@ -53,6 +55,7 @@ export class WorkerThreadRequestQueue<
   private queue: PendingCall<TRequest, TResponse>[] = []
   private consecutiveDeaths = 0
   private nextId = 1
+  private disposed = false
   private readonly host: LazyWorkerThreadHost<TResponse>
 
   constructor(private readonly options: WorkerThreadRequestQueueOptions<TRequest>) {
@@ -73,8 +76,20 @@ export class WorkerThreadRequestQueue<
    * @param timeoutMs - Deadline measured from dispatch, not from enqueue.
    * @returns The worker's response; rejects on timeout, crash, or an unspawnable worker.
    */
-  dispatch(buildRequest: (id: number) => TRequest, timeoutMs: number): Promise<TResponse> {
+  dispatch(
+    buildRequest: (id: number) => TRequest,
+    timeoutMs: number,
+    signal?: AbortSignal
+  ): Promise<TResponse> {
     return new Promise((resolve, reject) => {
+      if (this.disposed) {
+        reject(new Error('Worker request queue disposed'))
+        return
+      }
+      if (signal?.aborted) {
+        reject(signal.reason ?? new Error('Worker request aborted'))
+        return
+      }
       // Built before the cap check so a rejection can name the dropped work;
       // the id it burns is only a correlation token, so a gap costs nothing.
       const request = buildRequest(this.nextId++)
@@ -88,21 +103,57 @@ export class WorkerThreadRequestQueue<
       if (!this.active && this.queue.length === 0) {
         this.consecutiveDeaths = 0
       }
-      this.queue.push({
+      const call: PendingCall<TRequest, TResponse> = {
         request,
         timeoutMs,
         resolve,
         reject,
-        timer: null
-      })
+        timer: null,
+        signal,
+        cleanupAbort: () => signal?.removeEventListener('abort', abort)
+      }
+      const abort = (): void => {
+        if (this.active === call) {
+          this.host.destroy()
+        } else {
+          this.queue = this.queue.filter((queued) => queued !== call)
+        }
+        this.settle(call, () => reject(signal?.reason ?? new Error('Worker request aborted')))
+        this.afterSettle()
+      }
+      signal?.addEventListener('abort', abort, { once: true })
+      this.queue.push(call)
       this.pump()
     })
   }
 
+  dispose(): void {
+    this.disposed = true
+    this.host.destroy()
+    const pending = this.active ? [this.active, ...this.queue] : this.queue
+    this.queue = []
+    for (const call of pending) {
+      this.settle(call, () => call.reject(new Error('Worker request queue disposed')))
+    }
+  }
+
   private pump(): void {
     if (this.active || this.queue.length === 0) {
       return
     }
+    // A shared signal is already aborted before its remaining listeners run.
+    while (this.queue[0]?.signal?.aborted) {
+      const cancelled = this.queue.shift()
+      if (cancelled) {
+        this.settle(cancelled, () =>
+          cancelled.reject(cancelled.signal?.reason ?? new Error('Worker request aborted'))
+        )
+      }
+    }
+    if (this.queue.length === 0) {
+      this.host.scheduleIdleTeardown()
+      return
+    }
     const worker = this.host.ensure()
     if (!worker) {
       this.failQueuedAsUnavailable()
@@ -115,7 +166,11 @@ export class WorkerThreadRequestQueue<
     this.active = call
     this.host.clearIdleTimer()
     this.armDeadline(call)
-    worker.postMessage(call.request)
+    try {
+      worker.postMessage(call.request)
+    } catch (error) {
+      this.onWorkerFault(error instanceof Error ? error : new Error(String(error)))
+    }
   }
 
   /**
@@ -199,6 +254,7 @@ export class WorkerThreadRequestQueue<
   }
 
   private settle(call: PendingCall<TRequest, TResponse>, run: () => void): void {
+    call.cleanupAbort()
     if (call.timer) {
       clearTimeout(call.timer)
       call.timer = null
diff --git a/src/main/workspace-trust-test-fixtures.ts b/src/main/workspace-trust-test-fixtures.ts
new file mode 100644
index 00000000000..273c1449329
--- /dev/null
+++ b/src/main/workspace-trust-test-fixtures.ts
@@ -0,0 +1,32 @@
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import type { AgentTrustPreset } from './agent-trust-presets'
+
+/** Whether any trust entry for `preset` landed under `home` (Claude's config lives in the home). */
+export function workspaceTrustWritten(home: string, preset: AgentTrustPreset): boolean {
+  switch (preset) {
+    case 'claude':
+      return 'projects' in JSON.parse(readFileSync(join(home, '.claude.json'), 'utf-8'))
+    case 'codex':
+      return existsSync(join(home, '.codex', 'config.toml'))
+    case 'cursor': {
+      const projects = join(home, '.cursor', 'projects')
+      return existsSync(projects) && readdirSync(projects).length > 0
+    }
+    case 'copilot':
+      return existsSync(join(home, '.copilot', 'config.json'))
+    case 'qoder':
+      return existsSync(join(home, '.qoder', 'settings.json'))
+    case 'antigravity':
+      return existsSync(join(home, '.gemini', 'antigravity-cli', 'settings.json'))
+  }
+}
+
+/** A linked worktree at `worktree` whose main checkout is `mainCheckout`, as git lays it out. */
+export function linkGitWorktree(mainCheckout: string, worktree: string): void {
+  const gitDir = join(mainCheckout, '.git', 'worktrees', 'feature')
+  mkdirSync(gitDir, { recursive: true })
+  mkdirSync(worktree, { recursive: true })
+  writeFileSync(join(worktree, '.git'), `gitdir: ${gitDir}\n`)
+  writeFileSync(join(gitDir, 'gitdir'), join(worktree, '.git'))
+}
diff --git a/src/main/worktree-create-preparation-contention.test.ts b/src/main/worktree-create-preparation-contention.test.ts
new file mode 100644
index 00000000000..9535d63cdee
--- /dev/null
+++ b/src/main/worktree-create-preparation-contention.test.ts
@@ -0,0 +1,369 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Store } from './persistence'
+import type { Repo } from '../shared/repo-types'
+import type { AddWorktreeResult } from './git/worktree'
+
+const mocks = vi.hoisted(() => ({
+  mkdir: vi.fn(),
+  listWorktreeGraph: vi.fn(),
+  prepare: vi.fn(),
+  finalize: vi.fn(),
+  discard: vi.fn(),
+  computeWorkspaceRootAsync: vi.fn(),
+  getWorktreeOptions: vi.fn(),
+  resolveBaseRef: vi.fn(),
+  measureDivergence: vi.fn()
+}))
+
+vi.mock('node:fs/promises', () => ({ mkdir: mocks.mkdir }))
+vi.mock('./git/worktree', () => ({ listWorktreeGraph: mocks.listWorktreeGraph }))
+vi.mock('./git/worktree-create-preparation', () => ({
+  prepareWorktreeCreateCheckout: mocks.prepare,
+  finalizePreparedWorktree: mocks.finalize,
+  discardPreparedWorktree: mocks.discard,
+  unlockPreparedWorktree: vi.fn()
+}))
+vi.mock('./git/worktree-base-ref-probe', () => ({
+  resolveLocalWorktreeBaseRef: mocks.resolveBaseRef
+}))
+vi.mock('./git/worktree-base-divergence', () => ({
+  measureRetargetDivergence: mocks.measureDivergence
+}))
+vi.mock('./project-runtime-git-options', () => ({
+  getLocalProjectWorktreeGitOptions: mocks.getWorktreeOptions,
+  getWorktreeMirrorDistro: () => undefined
+}))
+vi.mock('./ipc/worktree-logic', () => ({
+  computeWorkspaceRootAsync: mocks.computeWorkspaceRootAsync,
+  getWorktreePathSettings: () => ({ workspaceDir: '/workspace', nestWorkspaces: false })
+}))
+
+import {
+  _resetWorktreeCreatePreparationsForTests,
+  consumePreparedWorktreeCreate,
+  hasPendingWorktreeCreatePreparations,
+  prepareWorktreeCreateForRepo
+} from './worktree-create-preparation'
+import {
+  listPreparations,
+  releasePreparationClaim,
+  startPreparation,
+  takePreparation
+} from './worktree-create-preparation-pool'
+
+const repo: Repo = {
+  id: 'repo-1',
+  path: '/repo',
+  displayName: 'Repo',
+  badgeColor: 'blue',
+  addedAt: 0
+}
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The tested path reads only getSettings from Store.
+const store = { getSettings: () => ({}) } as unknown as Store
+const flushBackgroundWork = (): Promise<void> => new Promise((resolve) => setTimeout(resolve, 0))
+
+function consume(baseBranch = 'origin/main') {
+  return consumePreparedWorktreeCreate({
+    repoPath: repo.path,
+    workspaceRoot: '/workspace',
+    worktreePath: '/workspace/new-worktree',
+    branch: 'feature/new-worktree',
+    baseBranch
+  })
+}
+
+beforeEach(() => {
+  mocks.mkdir.mockReset().mockResolvedValue(undefined)
+  mocks.listWorktreeGraph.mockReset().mockResolvedValue([])
+  mocks.prepare.mockReset().mockResolvedValue(undefined)
+  mocks.finalize.mockReset().mockResolvedValue({})
+  mocks.discard.mockReset().mockResolvedValue(undefined)
+  mocks.computeWorkspaceRootAsync.mockReset().mockResolvedValue('/workspace')
+  mocks.getWorktreeOptions.mockReset().mockReturnValue({})
+  mocks.resolveBaseRef
+    .mockReset()
+    .mockImplementation(async (_path: string, base: string) =>
+      base === 'main'
+        ? 'refs/heads/main'
+        : base === 'other/main'
+          ? 'refs/remotes/other/main'
+          : 'refs/remotes/origin/main'
+    )
+  mocks.measureDivergence.mockReset().mockResolvedValue('within')
+})
+
+afterEach(async () => {
+  await _resetWorktreeCreatePreparationsForTests()
+})
+
+describe('claimed worktree preparation', () => {
+  it('defers prefetch through checkout, finalization, and the remaining create work', async () => {
+    const checkout = Promise.withResolvers<void>()
+    const checkoutStarted = Promise.withResolvers<void>()
+    const finalize = Promise.withResolvers<AddWorktreeResult>()
+    const finalizeStarted = Promise.withResolvers<void>()
+    mocks.prepare.mockImplementationOnce(() => {
+      checkoutStarted.resolve()
+      return checkout.promise
+    })
+    mocks.finalize.mockImplementationOnce(() => {
+      finalizeStarted.resolve()
+      return finalize.promise
+    })
+    const preparation = prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    await checkoutStarted.promise
+    const create = consume()
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+
+    checkout.resolve()
+    await preparation
+    await finalizeStarted.promise
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+
+    finalize.resolve({})
+    const result = await create
+    expect(result.status).toBe('hit')
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+    result.rearm?.()
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+  })
+
+  it('coalesces mid-create prefetches and releases once at create completion', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const result = await consume()
+    expect(result.status).toBe('hit')
+    expect(hasPendingWorktreeCreatePreparations()).toBe(true)
+
+    await Promise.all([
+      prepareWorktreeCreateForRepo(store, repo, 'origin/main'),
+      prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    ])
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+    if (result.status === 'hit') {
+      result.rearm()
+      result.rearm()
+    }
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+    expect(hasPendingWorktreeCreatePreparations()).toBe(true)
+  })
+
+  it('does not let two creates claim the same prepared checkout', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const [first, second] = await Promise.all([consume(), consume()])
+
+    expect([first.status, second.status].sort()).toEqual(['hit', 'miss'])
+    expect(mocks.finalize).toHaveBeenCalledOnce()
+    expect(hasPendingWorktreeCreatePreparations()).toBe(true)
+    first.rearm?.()
+    second.rearm?.()
+    expect(hasPendingWorktreeCreatePreparations()).toBe(false)
+  })
+
+  it('keeps an explicit prefetch ahead of an automatic replacement for the same key', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const entry = listPreparations()[0]
+    if (!entry) {
+      throw new Error('expected a prepared checkout')
+    }
+    const claim = takePreparation(entry)
+    const base = {
+      repoPath: repo.path,
+      workspaceRoot: '/workspace',
+      baseBranch: 'origin/main',
+      canonicalBase: 'refs/remotes/origin/main'
+    }
+    await startPreparation({ ...base, options: {} }, 'automatic')
+    await startPreparation({ ...base, options: { admissionTier: 'background' } })
+    await startPreparation({ ...base, options: {} }, 'automatic')
+
+    const released = releasePreparationClaim(claim)
+    expect(released.pendingPreparations).toEqual([
+      {
+        kind: 'explicit',
+        args: { ...base, options: { admissionTier: 'background' } }
+      }
+    ])
+    expect(releasePreparationClaim(claim)).toEqual({ released: false, pendingPreparations: [] })
+  })
+
+  it('allows a fresh prefetch after an isolated create completes', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const result = await consume()
+    expect(result.status).toBe('hit')
+    if (result.status === 'hit') {
+      result.rearm()
+    }
+    expect(hasPendingWorktreeCreatePreparations()).toBe(false)
+
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not repeat a burst replacement when release runs twice', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const first = await consume()
+    if (first.status === 'hit') {
+      first.rearm()
+    }
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const second = await consume()
+    expect(second.status).toBe('hit')
+    if (second.status === 'hit') {
+      second.rearm()
+      second.rearm()
+    }
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(3)
+  })
+
+  it('reserves both the prepared and requested canonical bases on a retarget', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const result = await consume('main')
+    expect(result).toMatchObject({ status: 'hit', retargeted: true })
+
+    await prepareWorktreeCreateForRepo(store, repo, 'main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+    if (result.status === 'hit') {
+      result.rearm()
+    }
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+    expect(mocks.prepare.mock.calls[1]?.[2]).toBe('refs/heads/main')
+  })
+
+  it('preserves distinct prefetch bases while a retargeted create finishes', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const result = await consume('main')
+    expect(result.status).toBe('hit')
+
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    await prepareWorktreeCreateForRepo(store, repo, 'main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+    if (result.status === 'hit') {
+      result.rearm()
+    }
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(3)
+  })
+
+  it('passes a pending prefetch to another create claiming the same requested base', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    await prepareWorktreeCreateForRepo(store, repo, 'other/main')
+    const first = await consume('main')
+    const second = await consume('main')
+    expect(first.status).toBe('hit')
+    expect(second.status).toBe('hit')
+
+    await prepareWorktreeCreateForRepo(store, repo, 'main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+    if (second.status === 'hit') {
+      second.rearm()
+    }
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+    if (first.status === 'hit') {
+      first.rearm()
+    }
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(3)
+  })
+
+  it('keeps a burst replacement when the remaining claim is isolated', async () => {
+    let timestamp = 1_000
+    const now = vi.spyOn(Date, 'now').mockImplementation(() => timestamp++)
+    try {
+      await prepareWorktreeCreateForRepo(store, repo, 'other/main')
+      const seed = await consume('other/main')
+      expect(seed.status).toBe('hit')
+      seed.rearm?.()
+
+      await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+      await prepareWorktreeCreateForRepo(store, repo, 'other/main')
+      const burst = await consume('main')
+      const isolated = await consume('main')
+      expect(burst).toMatchObject({ status: 'hit', retargeted: true })
+      expect(isolated).toMatchObject({ status: 'hit', retargeted: true })
+      expect(mocks.prepare).toHaveBeenCalledTimes(3)
+
+      burst.rearm?.()
+      await flushBackgroundWork()
+      expect(mocks.prepare).toHaveBeenCalledTimes(3)
+      isolated.rearm?.()
+      await flushBackgroundWork()
+      expect(mocks.prepare).toHaveBeenCalledTimes(4)
+      expect(mocks.prepare.mock.calls[3]?.[2]).toBe('refs/heads/main')
+    } finally {
+      now.mockRestore()
+    }
+  })
+
+  it('does not hold another repo, workspace root, or Git host behind the claim', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const result = await consume()
+    expect(result.status).toBe('hit')
+
+    await prepareWorktreeCreateForRepo(store, { ...repo, path: '/other-repo' }, 'origin/main')
+    mocks.computeWorkspaceRootAsync.mockResolvedValueOnce('/other-workspace')
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    mocks.getWorktreeOptions.mockReturnValue({ wslDistro: 'Ubuntu' })
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(4)
+    if (result.status === 'hit') {
+      result.rearm()
+    }
+  })
+
+  it('releases after failed finalization has discarded the claimed checkout', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    let failFinalization!: (error: Error) => void
+    mocks.finalize.mockReturnValueOnce(
+      new Promise((_resolve, reject) => {
+        failFinalization = reject
+      })
+    )
+    const create = consume()
+    await flushBackgroundWork()
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+
+    failFinalization(new Error('finalize failed'))
+    const result = await create
+    expect(result).toMatchObject({ status: 'miss', reason: 'finalize_failed' })
+    expect(mocks.discard).toHaveBeenCalledTimes(1)
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+    result.rearm?.()
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+  })
+
+  it('holds an explicit prefetch through a claimed checkout failure', async () => {
+    let failPreparation!: (error: Error) => void
+    mocks.prepare.mockReturnValueOnce(
+      new Promise((_resolve, reject) => {
+        failPreparation = reject
+      })
+    )
+    const initialPreparation = prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const preparationFailure = initialPreparation.catch(() => {})
+    await flushBackgroundWork()
+    const create = consume()
+    await flushBackgroundWork()
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+
+    failPreparation(new Error('checkout failed'))
+    const result = await create
+    await preparationFailure
+    expect(result).toMatchObject({ status: 'miss', reason: 'prepare_failed' })
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+    result.rearm?.()
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+  })
+})
diff --git a/src/main/worktree-create-preparation-pool.ts b/src/main/worktree-create-preparation-pool.ts
index 7a040373c57..a72972c9d20 100644
--- a/src/main/worktree-create-preparation-pool.ts
+++ b/src/main/worktree-create-preparation-pool.ts
@@ -51,7 +51,18 @@ export type StartPreparationArgs = {
   options: AddWorktreeOptions
 }
 
+export type DeferredPreparation = {
+  args: StartPreparationArgs
+  kind: 'explicit' | 'automatic'
+}
+
 const preparations = new Map<string, PreparationEntry>()
+export type PreparationClaim = {
+  entry: PreparationEntry
+  requestedKey: string
+  pendingPreparations: Map<string, DeferredPreparation>
+}
+const claims = new Set<PreparationClaim>()
 
 /** One repo on one Git host: the scope a stranded discard is retried under. */
 function preparationHostKey(repoPathKey: string, wslDistro: string): string {
@@ -60,7 +71,7 @@ function preparationHostKey(repoPathKey: string, wslDistro: string): string {
 
 /** A prepared checkout is a create that is either in flight or imminent. */
 export function hasPendingPreparations(): boolean {
-  return preparations.size > 0 || hasPendingStalePreparationCleanup()
+  return preparations.size > 0 || claims.size > 0 || hasPendingStalePreparationCleanup()
 }
 
 function pathOps(path: string): Pick<typeof posix, 'dirname' | 'join'> {
@@ -147,12 +158,83 @@ export function findPreparation(
 
 /** Removes an entry from the pool so no other create can claim it. Callers must run this in the
  *  same synchronous turn as the selection that produced `entry`. */
-export function takePreparation(entry: PreparationEntry): void {
+export function takePreparation(
+  entry: PreparationEntry,
+  requestedCanonicalBase = entry.canonicalBase
+): PreparationClaim {
   preparations.delete(entry.key)
   clearTimeout(entry.expiration)
+  const requestedKey = preparationEntryKey(
+    entry.repoPathKey,
+    entry.workspaceRootKey,
+    requestedCanonicalBase,
+    entry.wslDistro
+  )
+  const claim = { entry, requestedKey, pendingPreparations: new Map<string, DeferredPreparation>() }
+  claims.add(claim)
+  return claim
 }
 
-export function startPreparation(args: StartPreparationArgs): Promise<void> {
+function matchingClaim(args: StartPreparationArgs): PreparationClaim | undefined {
+  const key = preparationEntryKey(
+    preparationPathKey(args.repoPath),
+    preparationPathKey(args.workspaceRoot),
+    args.canonicalBase,
+    args.options.wslDistro ?? ''
+  )
+  return [...claims]
+    .toReversed()
+    .find((claim) => claim.entry.key === key || claim.requestedKey === key)
+}
+
+/** Preserve one request per canonical key, with explicit prefetch taking precedence. */
+function deferPreparationForClaim(
+  args: StartPreparationArgs,
+  kind: DeferredPreparation['kind']
+): boolean {
+  const matching = matchingClaim(args)
+  if (!matching) {
+    return false
+  }
+  const key = preparationEntryKey(
+    preparationPathKey(args.repoPath),
+    preparationPathKey(args.workspaceRoot),
+    args.canonicalBase,
+    args.options.wslDistro ?? ''
+  )
+  if (kind === 'explicit' || !matching.pendingPreparations.has(key)) {
+    matching.pendingPreparations.set(key, { args, kind })
+  }
+  return true
+}
+
+/** A second release is inert, including after a test reset. */
+export function releasePreparationClaim(claim: PreparationClaim): {
+  released: boolean
+  pendingPreparations: DeferredPreparation[]
+} {
+  if (!claims.delete(claim)) {
+    return { released: false, pendingPreparations: [] }
+  }
+  return { released: true, pendingPreparations: [...claim.pendingPreparations.values()] }
+}
+
+export function startPreparation(
+  args: StartPreparationArgs,
+  kind: DeferredPreparation['kind'] = 'explicit'
+): Promise<void> {
+  const existing = findPreparation(
+    preparationPathKey(args.repoPath),
+    preparationPathKey(args.workspaceRoot),
+    args.canonicalBase,
+    args.options.wslDistro ?? ''
+  )
+  if (existing) {
+    return existing.ready
+  }
+  if (deferPreparationForClaim(args, kind)) {
+    return Promise.resolve()
+  }
   return worktreePreparationGit.run(() => startBackgroundPreparation(args))
 }
 
@@ -227,6 +309,7 @@ function startBackgroundPreparation({
 export async function _resetPreparationPoolForTests(): Promise<void> {
   const entries = [...preparations.values()]
   preparations.clear()
+  claims.clear()
   await resetStalePreparationCleanupForTests()
   await Promise.all(
     entries.map(async (entry) => {
diff --git a/src/main/worktree-create-preparation-timing.test.ts b/src/main/worktree-create-preparation-timing.test.ts
new file mode 100644
index 00000000000..bd78f506201
--- /dev/null
+++ b/src/main/worktree-create-preparation-timing.test.ts
@@ -0,0 +1,168 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AddWorktreeResult } from './git/worktree'
+
+const mocks = vi.hoisted(() => ({
+  mkdir: vi.fn(),
+  prepare: vi.fn(),
+  finalize: vi.fn(),
+  discard: vi.fn(),
+  listWorktreeGraph: vi.fn()
+}))
+
+vi.mock('node:fs/promises', () => ({ mkdir: mocks.mkdir }))
+vi.mock('./git/worktree', () => ({ listWorktreeGraph: mocks.listWorktreeGraph }))
+vi.mock('./git/worktree-create-preparation', () => ({
+  prepareWorktreeCreateCheckout: mocks.prepare,
+  finalizePreparedWorktree: mocks.finalize,
+  discardPreparedWorktree: mocks.discard,
+  unlockPreparedWorktree: vi.fn()
+}))
+vi.mock('./git/worktree-base-ref-probe', () => ({ resolveLocalWorktreeBaseRef: vi.fn() }))
+vi.mock('./git/worktree-base-divergence', () => ({ measureRetargetDivergence: vi.fn() }))
+vi.mock('./project-runtime-git-options', () => ({
+  getLocalProjectWorktreeGitOptions: vi.fn(),
+  getWorktreeMirrorDistro: vi.fn()
+}))
+vi.mock('./ipc/worktree-logic', () => ({
+  computeWorkspaceRootAsync: vi.fn(),
+  getWorktreePathSettings: vi.fn()
+}))
+
+import {
+  _resetWorktreeCreatePreparationsForTests,
+  consumePreparedWorktreeCreate
+} from './worktree-create-preparation'
+import { startPreparation } from './worktree-create-preparation-pool'
+import { createWorktreeCreateTimingRecorder } from './worktree-create-timing'
+
+const request = {
+  repoPath: '/repo',
+  workspaceRoot: '/workspace',
+  worktreePath: '/workspace/feature',
+  branch: 'feature',
+  baseBranch: 'origin/main'
+}
+
+function prepare() {
+  return startPreparation({
+    repoPath: request.repoPath,
+    workspaceRoot: request.workspaceRoot,
+    baseBranch: request.baseBranch,
+    canonicalBase: 'refs/remotes/origin/main',
+    options: {}
+  })
+}
+
+beforeEach(() => {
+  mocks.mkdir.mockReset().mockResolvedValue(undefined)
+  mocks.prepare.mockReset().mockResolvedValue(undefined)
+  mocks.finalize.mockReset().mockResolvedValue({})
+  mocks.discard.mockReset().mockResolvedValue(undefined)
+  mocks.listWorktreeGraph.mockReset().mockResolvedValue([])
+})
+
+afterEach(async () => {
+  await _resetWorktreeCreatePreparationsForTests()
+  vi.restoreAllMocks()
+})
+
+describe('prepared checkout create timing', () => {
+  it('separates the remaining preparation wait from finalization', async () => {
+    const checkoutStarted = Promise.withResolvers<void>()
+    const checkout = Promise.withResolvers<void>()
+    const finalizeStarted = Promise.withResolvers<void>()
+    const finalize = Promise.withResolvers<AddWorktreeResult>()
+    mocks.prepare.mockImplementation(() => {
+      checkoutStarted.resolve()
+      return checkout.promise
+    })
+    mocks.finalize.mockImplementation(() => {
+      finalizeStarted.resolve()
+      return finalize.promise
+    })
+    const preparation = prepare()
+    await checkoutStarted.promise
+
+    let now = 40
+    const timing = createWorktreeCreateTimingRecorder(() => now)
+    const create = timing.time('git_worktree_add', () =>
+      consumePreparedWorktreeCreate({ ...request, timing })
+    )
+    now = 150
+    checkout.resolve()
+    await finalizeStarted.promise
+    now = 180
+    finalize.resolve({})
+
+    expect(await create).toMatchObject({ status: 'hit', retargeted: false })
+    await preparation
+    expect(timing.finish()).toEqual({
+      totalDurationMs: 140,
+      phases: [
+        { phase: 'prepared_checkout_wait', startedAtMs: 0, durationMs: 110 },
+        { phase: 'prepared_checkout_finalize', startedAtMs: 110, durationMs: 30 },
+        { phase: 'git_worktree_add', startedAtMs: 0, durationMs: 140 }
+      ]
+    })
+  })
+
+  it('records the wait when preparation fails and the create must fall back', async () => {
+    const checkoutStarted = Promise.withResolvers<void>()
+    const checkout = Promise.withResolvers<void>()
+    mocks.prepare.mockImplementation(() => {
+      checkoutStarted.resolve()
+      return checkout.promise
+    })
+    const preparation = Promise.allSettled([prepare()])
+    await checkoutStarted.promise
+    let now = 0
+    const timing = createWorktreeCreateTimingRecorder(() => now)
+    const create = consumePreparedWorktreeCreate({ ...request, timing })
+    now = 250
+    checkout.reject(new Error('checkout failed'))
+
+    expect(await create).toEqual({
+      status: 'miss',
+      reason: 'prepare_failed',
+      rearm: expect.any(Function)
+    })
+    await preparation
+    expect(timing.finish().phases).toEqual([
+      { phase: 'prepared_checkout_wait', startedAtMs: 0, durationMs: 250 }
+    ])
+    expect(mocks.finalize).not.toHaveBeenCalled()
+  })
+
+  it('records a failed finalization before its fallback cleanup', async () => {
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    await prepare()
+    let now = 0
+    const timing = createWorktreeCreateTimingRecorder(() => now)
+    mocks.finalize.mockImplementation(async () => {
+      now = 80
+      throw new Error('move failed')
+    })
+    mocks.discard.mockImplementation(async () => {
+      now = 100
+    })
+
+    expect(await consumePreparedWorktreeCreate({ ...request, timing })).toEqual({
+      status: 'miss',
+      reason: 'finalize_failed',
+      rearm: expect.any(Function)
+    })
+    expect(timing.finish().phases).toEqual([
+      { phase: 'prepared_checkout_wait', startedAtMs: 0, durationMs: 0 },
+      { phase: 'prepared_checkout_finalize', startedAtMs: 0, durationMs: 80 }
+    ])
+  })
+
+  it('does not report a preparation wait when no checkout was armed', async () => {
+    const timing = createWorktreeCreateTimingRecorder(() => 0)
+    expect(await consumePreparedWorktreeCreate({ ...request, timing })).toEqual({
+      status: 'miss',
+      reason: 'none_armed'
+    })
+    expect(timing.finish().phases).toEqual([])
+  })
+})
diff --git a/src/main/worktree-create-preparation.test.ts b/src/main/worktree-create-preparation.test.ts
index 9b3291bc463..e8c2bb97bce 100644
--- a/src/main/worktree-create-preparation.test.ts
+++ b/src/main/worktree-create-preparation.test.ts
@@ -555,7 +555,7 @@ describe('worktree create preparation registry', () => {
         branch: 'feature/test',
         baseBranch: 'origin/main'
       })
-    ).resolves.toEqual({ status: 'miss', reason: 'finalize_failed' })
+    ).resolves.toMatchObject({ status: 'miss', reason: 'finalize_failed' })
     expect(mocks.mkdir).toHaveBeenCalledWith('/workspace', { recursive: true })
     expect(mocks.discard).toHaveBeenCalledTimes(1)
   })
@@ -637,9 +637,7 @@ describe('worktree create preparation registry', () => {
     expect(mocks.prepareCheckout).toHaveBeenCalledTimes(1)
   })
 
-  // `startPreparation` overwrites the map entry outright, so a thunk that armed over a prefetch
-  // would leave that prefetch's locked checkout on disk with nothing holding a reference to it.
-  it('skips the deferred re-arm when a prefetch armed the same key mid-create', async () => {
+  it('starts one explicit prefetch after the create completes', async () => {
     await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
     await consumeOnce('first')
     await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
@@ -655,6 +653,7 @@ describe('worktree create preparation registry', () => {
 
     // The user reopens the composer while the create is still finishing.
     await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    expect(mocks.prepareCheckout).toHaveBeenCalledTimes(2)
     mocks.prepareCheckout.mockClear()
 
     if (attempt.status === 'hit') {
@@ -662,7 +661,7 @@ describe('worktree create preparation registry', () => {
     }
     await flushBackgroundWork()
 
-    expect(mocks.prepareCheckout).not.toHaveBeenCalled()
+    expect(mocks.prepareCheckout).toHaveBeenCalledTimes(1)
   })
 
   it('does not re-arm when finalization failed', async () => {
diff --git a/src/main/worktree-create-preparation.ts b/src/main/worktree-create-preparation.ts
index be7ea0d5a36..3ac022910eb 100644
--- a/src/main/worktree-create-preparation.ts
+++ b/src/main/worktree-create-preparation.ts
@@ -12,11 +12,13 @@ import { resolveLocalWorktreeBaseRef } from './git/worktree-base-ref-probe'
 import { preparationPathKey, selectPreparationForCreate } from './worktree-create-preparation-claim'
 import {
   _resetPreparationPoolForTests,
-  findPreparation,
   hasPendingPreparations,
   listPreparations,
+  releasePreparationClaim,
   startPreparation,
   takePreparation,
+  type DeferredPreparation,
+  type PreparationClaim,
   type PreparationEntry
 } from './worktree-create-preparation-pool'
 import {
@@ -33,6 +35,7 @@ import {
   resetPreparationConsumeHistoryForTests
 } from './worktree-create-preparation-burst'
 import { toHostFilesystemPath } from './host-tree-removal'
+import type { WorktreeCreateTimingRecorder } from './worktree-create-timing'
 
 export {
   WORKTREE_CREATE_PREPARATION_LIMIT,
@@ -56,7 +59,7 @@ export type PreparedWorktreeCreateAttempt =
       /** Run after materialization/startup completes, before returning the create result. */
       rearm: () => void
     }
-  | { status: 'miss'; reason: PreparedCheckoutMissReason }
+  | { status: 'miss'; reason: PreparedCheckoutMissReason; rearm?: () => void }
 
 type ConsumePreparedWorktreeArgs = {
   repoPath: string
@@ -66,6 +69,7 @@ type ConsumePreparedWorktreeArgs = {
   baseBranch: string
   refreshLocalBaseRef?: boolean
   options?: AddWorktreeOptions
+  timing?: Pick<WorktreeCreateTimingRecorder, 'time'>
 }
 
 function canonicalBaseRef(
@@ -107,16 +111,6 @@ async function prepareWorktreeCreateInBackground(
     getWorktreePathSettings(repo, store.getSettings(), getWorktreeMirrorDistro(store, repo))
   )
   const canonicalBase = await canonicalBaseRef(repo.path, baseBranch, options)
-  const existing = findPreparation(
-    preparationPathKey(repo.path),
-    preparationPathKey(workspaceRoot),
-    canonicalBase,
-    options.wslDistro ?? ''
-  )
-  if (existing) {
-    return existing.ready
-  }
-
   return startPreparation({
     repoPath: repo.path,
     workspaceRoot,
@@ -127,8 +121,14 @@ async function prepareWorktreeCreateInBackground(
 }
 
 type ClaimedPreparation =
-  | { status: 'claimed'; entry: PreparationEntry; retargeted: boolean; canonicalBase: string }
-  | { status: 'miss'; reason: PreparedCheckoutMissReason }
+  | {
+      status: 'claimed'
+      entry: PreparationEntry
+      reservation: PreparationClaim
+      retargeted: boolean
+      canonicalBase: string
+    }
+  | { status: 'miss'; reason: PreparedCheckoutMissReason; rearm?: () => void }
 
 async function claimPreparedWorktree(
   args: ConsumePreparedWorktreeArgs,
@@ -187,17 +187,34 @@ async function claimPreparedWorktree(
     }
   }
   const entry = selection.candidate
-  takePreparation(entry)
+  const reservation = takePreparation(entry, selection.canonicalBase)
   try {
-    await entry.ready
+    await (args.timing
+      ? args.timing.time('prepared_checkout_wait', () => entry.ready)
+      : entry.ready)
     return {
       status: 'claimed',
       entry,
+      reservation,
       retargeted: selection.kind === 'retarget',
       canonicalBase: selection.canonicalBase
     }
   } catch {
-    return { status: 'miss', reason: 'prepare_failed' }
+    return { status: 'miss', reason: 'prepare_failed', rearm: releaseClaimAfterCreate(reservation) }
+  }
+}
+
+function startDeferredPreparation(preparation: DeferredPreparation): void {
+  void startPreparation(preparation.args, preparation.kind).catch(() => {
+    // A later create still has the normal add path if speculative preparation fails.
+  })
+}
+
+function releaseClaimAfterCreate(reservation: PreparationClaim): () => void {
+  return () => {
+    for (const preparation of releasePreparationClaim(reservation).pendingPreparations) {
+      startDeferredPreparation(preparation)
+    }
   }
 }
 
@@ -209,37 +226,38 @@ async function claimPreparedWorktree(
  *  Returns a thunk rather than launching: the replacement is a full `reset --hard`, which on a
  *  large repo holds a general admission slot for tens of seconds. Started mid-create it competes
  *  with the create's own git, so the caller runs it after materialization/startup completes. The burst
- *  bookkeeping still happens here — a prefetch that re-armed this key while we finalized would
- *  otherwise swallow the consume, and the next create would look isolated when it is really the
- *  middle of a burst. */
+ *  bookkeeping still happens here so a later create is recognized as part of a burst. An explicit
+ *  prefetch during this create takes precedence over the burst replacement at release. */
 function deferRearmPreparation(
   entry: PreparationEntry,
+  reservation: PreparationClaim,
   baseBranch: string,
   canonicalBase: string
 ): () => void {
   const continuesBurst = recordPreparationConsume(entry.key)
-  const alreadyArmed = (): boolean =>
-    findPreparation(entry.repoPathKey, entry.workspaceRootKey, canonicalBase, entry.wslDistro) !==
-    undefined
-  if (!continuesBurst || alreadyArmed()) {
-    return () => {}
-  }
   return () => {
-    // Re-checked here, not only at consume time: `startPreparation` overwrites the map entry
-    // outright, so arming over a prefetch that landed during the create would strand its
-    // checkout on disk with no owner to discard it.
-    if (alreadyArmed()) {
+    const { released, pendingPreparations } = releasePreparationClaim(reservation)
+    if (!released) {
       return
     }
-    void startPreparation({
-      repoPath: entry.repoPath,
-      workspaceRoot: entry.workspaceRoot,
-      baseBranch,
-      canonicalBase,
-      options: entry.options
-    }).catch(() => {
-      // Why: a warm-up failure is recovered by the normal add on the next create.
-    })
+    const requestedBaseArmed = pendingPreparations.some(
+      (preparation) => preparation.args.canonicalBase === canonicalBase
+    )
+    for (const preparation of pendingPreparations) {
+      startDeferredPreparation(preparation)
+    }
+    if (continuesBurst && !requestedBaseArmed) {
+      startDeferredPreparation({
+        args: {
+          repoPath: entry.repoPath,
+          workspaceRoot: entry.workspaceRoot,
+          baseBranch,
+          canonicalBase,
+          options: entry.options
+        },
+        kind: 'automatic'
+      })
+    }
   }
 }
 
@@ -249,9 +267,9 @@ export async function consumePreparedWorktreeCreate(
   const options = args.options ?? {}
   const claim = await claimPreparedWorktree(args, options)
   if (claim.status === 'miss') {
-    return { status: 'miss', reason: claim.reason }
+    return { status: 'miss', reason: claim.reason, ...(claim.rearm ? { rearm: claim.rearm } : {}) }
   }
-  const { entry } = claim
+  const { entry, reservation } = claim
   try {
     const parentDir = isWindowsAbsolutePathLike(args.worktreePath)
       ? win32.dirname(args.worktreePath)
@@ -259,18 +277,22 @@ export async function consumePreparedWorktreeCreate(
     await mkdir(toHostFilesystemPath(parentDir), { recursive: true })
     // Finalize resolves the requested base itself and resets the prepared checkout onto that
     // commit, so a retargeted claim is handed over at the requested commit or not at all.
-    const result = await finalizePreparedWorktree(
-      args.repoPath,
-      entry.preparedPath,
-      args.worktreePath,
-      args.branch,
-      args.baseBranch,
-      args.refreshLocalBaseRef,
-      options
-    )
+    const finalize = (): Promise<AddWorktreeResult> =>
+      finalizePreparedWorktree(
+        args.repoPath,
+        entry.preparedPath,
+        args.worktreePath,
+        args.branch,
+        args.baseBranch,
+        args.refreshLocalBaseRef,
+        options
+      )
+    const result = args.timing
+      ? await args.timing.time('prepared_checkout_finalize', finalize)
+      : await finalize()
     // Consuming the only prepared checkout leaves the next create cold. Re-arm for a user who is
     // creating in a burst; the TTL and the preparation limit still bound an unused replacement.
-    const rearm = deferRearmPreparation(entry, args.baseBranch, claim.canonicalBase)
+    const rearm = deferRearmPreparation(entry, reservation, args.baseBranch, claim.canonicalBase)
     return { status: 'hit', retargeted: claim.retargeted, result, rearm }
   } catch (error) {
     await discardPreparedWorktree(args.repoPath, entry.preparedPath, options).catch(() => {})
@@ -278,7 +300,11 @@ export async function consumePreparedWorktreeCreate(
       '[worktree-create] prepared checkout could not be finalized; using normal add',
       error
     )
-    return { status: 'miss', reason: 'finalize_failed' }
+    return {
+      status: 'miss',
+      reason: 'finalize_failed',
+      rearm: releaseClaimAfterCreate(reservation)
+    }
   }
 }
 
diff --git a/src/main/worktree-removal-close-records.test.ts b/src/main/worktree-removal-close-records.test.ts
new file mode 100644
index 00000000000..9d2d2e32e71
--- /dev/null
+++ b/src/main/worktree-removal-close-records.test.ts
@@ -0,0 +1,225 @@
+import { closeTestStores, createSqliteTestStore } from './persistence-test-harness'
+// Why this file exists: removing a workspace's session rows must take its close records with it,
+// or they hold cap slots until the TTL and read as "emptied on purpose" for a new workspace at the
+// same path.
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { getDefaultWorkspaceSession } from '../shared/constants'
+import { toSshExecutionHostId } from '../shared/execution-host'
+import { folderWorkspaceKey } from '../shared/workspace-scope'
+import {
+  MAX_CLOSED_TERMINAL_TAB_TOMBSTONES,
+  recordClosedTerminalTabTombstone,
+  type ClosedTerminalTabTombstonesByTabId
+} from '../shared/closed-terminal-tab-tombstones'
+
+const testState = { dir: '' }
+
+vi.mock('./ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: vi.fn(),
+  sshConfigHostsToTargets: vi.fn()
+}))
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => testState.dir
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => false,
+    encryptString: (plaintext: string) => Buffer.from(plaintext, 'utf-8'),
+    decryptString: (ciphertext: Buffer) => ciphertext.toString('utf-8')
+  }
+}))
+
+vi.mock('./telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('./telemetry/cohort-classifier', () => ({ getCohortAtEmit: vi.fn().mockReturnValue({}) }))
+
+async function createStore() {
+  vi.resetModules()
+  const { Store, initDataPath } = await import('./persistence')
+  initDataPath()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
+}
+
+const REMOVED = 'repo-a::/workspace/removed'
+const KEPT = 'repo-a::/workspace/kept'
+const OTHER_REPO = 'repo-b::/workspace/other'
+const SSH_HOST = toSshExecutionHostId('target-1')
+
+function records(
+  entries: [tabId: string, worktreeId: string][],
+  now = Date.now()
+): ClosedTerminalTabTombstonesByTabId {
+  return Object.fromEntries(
+    entries.map(([tabId, worktreeId]) => [
+      tabId,
+      { closedAt: now, worktreeId, reason: 'user' as const }
+    ])
+  )
+}
+
+function sessionWithRecords(map: ClosedTerminalTabTombstonesByTabId) {
+  return {
+    ...getDefaultWorkspaceSession(),
+    tabsByWorktree: { [REMOVED]: [], [KEPT]: [] },
+    closedTerminalTabTombstonesByTabId: map
+  }
+}
+
+describe('close records on workspace removal', () => {
+  beforeEach(() => {
+    testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
+  })
+
+  afterEach(async () => {
+    await closeTestStores()
+    rmSync(testState.dir, { recursive: true, force: true })
+  })
+
+  it('drops only the removed worktree’s records', async () => {
+    const store = await createStore()
+    store.setWorktreeMeta(REMOVED, {})
+    store.setWorkspaceSession(
+      sessionWithRecords(
+        records([
+          ['closed-removed', REMOVED],
+          ['closed-kept', KEPT]
+        ])
+      )
+    )
+
+    store.removeWorktreeMeta(REMOVED)
+
+    expect(
+      Object.keys(store.getWorkspaceSession().closedTerminalTabTombstonesByTabId ?? {})
+    ).toEqual(['closed-kept'])
+  })
+
+  it('drops the records in the SSH host’s partition on a remote removal', async () => {
+    const store = await createStore()
+    store.setWorktreeMeta(REMOVED, { hostId: SSH_HOST })
+    store.setWorkspaceSession(
+      sessionWithRecords(
+        records([
+          ['closed-removed', REMOVED],
+          ['closed-kept', KEPT]
+        ])
+      ),
+      SSH_HOST
+    )
+
+    store.removeWorktreeMeta(REMOVED, SSH_HOST)
+
+    expect(
+      Object.keys(store.getWorkspaceSession(SSH_HOST).closedTerminalTabTombstonesByTabId ?? {})
+    ).toEqual(['closed-kept'])
+  })
+
+  // Why: repo ids and paths repeat across hosts; the local owner of the same id is still live.
+  it('keeps a same-id worktree’s records on another host when one host’s copy is removed', async () => {
+    const store = await createStore()
+    const repo = { id: 'repo-a', displayName: 'A', badgeColor: 'gray', addedAt: 1 }
+    store.addRepo({ ...repo, path: '/workspace/repo-a' })
+    store.addRepo({
+      ...repo,
+      path: '/remote/repo-a',
+      connectionId: 'target-1',
+      executionHostId: SSH_HOST
+    })
+    store.setWorktreeMeta(REMOVED, { hostId: SSH_HOST })
+    store.setWorkspaceSession(sessionWithRecords(records([['local-tab', REMOVED]])))
+    store.setWorkspaceSession(sessionWithRecords(records([['ssh-tab', REMOVED]])), SSH_HOST)
+
+    store.removeWorktreeMeta(REMOVED, SSH_HOST)
+
+    expect(
+      Object.keys(store.getWorkspaceSession().closedTerminalTabTombstonesByTabId ?? {})
+    ).toEqual(['local-tab'])
+    expect(store.getWorkspaceSession(SSH_HOST).closedTerminalTabTombstonesByTabId).toEqual({})
+  })
+
+  it('drops a removed folder workspace’s records from every partition', async () => {
+    const store = await createStore()
+    const group = store.createProjectGroup({
+      name: 'Platform',
+      parentPath: '/workspace/platform',
+      createdFrom: 'folder-scan'
+    })
+    const folder = store.createFolderWorkspace({ projectGroupId: group.id, name: 'Scratch' })
+    const folderKey = folderWorkspaceKey(folder.id)
+    store.setWorkspaceSession(
+      sessionWithRecords(
+        records([
+          ['closed-folder', folderKey],
+          ['closed-kept', KEPT]
+        ])
+      )
+    )
+    store.setWorkspaceSession(sessionWithRecords(records([['ssh-folder', folderKey]])), SSH_HOST)
+
+    expect(store.removeFolderWorkspace(folder.id)).toBe(true)
+
+    expect(
+      Object.keys(store.getWorkspaceSession().closedTerminalTabTombstonesByTabId ?? {})
+    ).toEqual(['closed-kept'])
+    expect(store.getWorkspaceSession(SSH_HOST).closedTerminalTabTombstonesByTabId).toEqual({})
+  })
+
+  // Why the removed worktree has no meta here: records alone must still mark it as the repo's.
+  it('drops every worktree’s records when its project is removed, and keeps other projects’', async () => {
+    const store = await createStore()
+    store.addRepo({
+      id: 'repo-a',
+      path: '/workspace/repo-a',
+      displayName: 'A',
+      badgeColor: 'gray',
+      addedAt: 1
+    })
+    store.setWorkspaceSession({
+      ...getDefaultWorkspaceSession(),
+      closedTerminalTabTombstonesByTabId: records([
+        ['closed-a', REMOVED],
+        ['closed-a2', KEPT],
+        ['closed-b', OTHER_REPO]
+      ])
+    })
+
+    store.removeProject('repo-a')
+
+    expect(
+      Object.keys(store.getWorkspaceSession().closedTerminalTabTombstonesByTabId ?? {})
+    ).toEqual(['closed-b'])
+  })
+
+  // Why: dead records used to hold cap slots until their TTL, so fresh closes evicted a live one.
+  it('frees the removed worktree’s cap slots, so later closes keep a live worktree’s record', async () => {
+    const store = await createStore()
+    const now = Date.now()
+    const dead = Array.from(
+      { length: MAX_CLOSED_TERMINAL_TAB_TOMBSTONES - 1 },
+      (_, index): [string, string] => [`dead-${index}`, REMOVED]
+    )
+    store.setWorktreeMeta(REMOVED, {})
+    store.setWorkspaceSession(
+      sessionWithRecords({
+        ...records(dead, now),
+        ...records([['live-kept', KEPT]], now - 60_000)
+      })
+    )
+
+    store.removeWorktreeMeta(REMOVED)
+    let map = store.getWorkspaceSession().closedTerminalTabTombstonesByTabId
+    for (let index = 0; index < 2; index += 1) {
+      map = recordClosedTerminalTabTombstone(
+        map,
+        `fresh-${index}`,
+        { worktreeId: KEPT },
+        now + index
+      )
+    }
+
+    expect(map?.['live-kept']).toBeDefined()
+  })
+})
diff --git a/src/main/worktree-removal-safety.test.ts b/src/main/worktree-removal-safety.test.ts
index 9aa9775de44..d32289a5fc7 100644
--- a/src/main/worktree-removal-safety.test.ts
+++ b/src/main/worktree-removal-safety.test.ts
@@ -6,7 +6,8 @@ import {
   canSafelyRemoveOrphanedWorktreeDirectory,
   findRegisteredDeletableWorktree,
   getRegisteredDeletableWorktree,
-  isDangerousWorktreeRemovalPath
+  isDangerousWorktreeRemovalPath,
+  isWorktreePathMissing
 } from './worktree-removal-safety'
 import { CLIENT_REMOVAL_HOME, executionHostRemovalHome } from './worktree-removal-home-guard'
 
@@ -349,6 +350,16 @@ describe('canSafelyRemoveOrphanedWorktreeDirectory', () => {
   })
 })
 
+describe('isWorktreePathMissing', () => {
+  it('does not treat an unreadable path as absent', async () => {
+    await expect(
+      isWorktreePathMissing('/workspaces/locked', async () => {
+        throw Object.assign(new Error('permission denied'), { code: 'EACCES' })
+      })
+    ).resolves.toBe(false)
+  })
+})
+
 describe('canCleanupUnregisteredOrcaLeftoverDirectory', () => {
   const repo = { path: '/repos/main' }
   const ownedMeta = { orcaCreatedAt: 1, orcaCreationSource: 'runtime' as const }
diff --git a/src/main/worktree-removal-session-partition-fencing.test.ts b/src/main/worktree-removal-session-partition-fencing.test.ts
index 89b7feafee6..03dc50a3dd5 100644
--- a/src/main/worktree-removal-session-partition-fencing.test.ts
+++ b/src/main/worktree-removal-session-partition-fencing.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from './persistence-test-harness'
 // Why this file exists: worktree removal writes to host session partitions, and the two hazards below
 // are only visible across a removal followed by a renderer session write — persistence.test.ts covers
 // removal and partitioning separately, so neither suite catches the interaction.
@@ -34,7 +35,7 @@ async function createStore() {
   vi.resetModules()
   const { Store, initDataPath } = await import('./persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 const makeTerminalTab = (overrides: Partial<TerminalTab> = {}): TerminalTab => ({
@@ -58,7 +59,8 @@ describe('worktree removal across host session partitions', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/wsl-home-cache.ts b/src/main/wsl-home-cache.ts
index 368bf163102..c833b14bdae 100644
--- a/src/main/wsl-home-cache.ts
+++ b/src/main/wsl-home-cache.ts
@@ -1,19 +1,26 @@
 const MAX_WSL_HOME_CACHE_ENTRIES = 64
 const wslHomeCache = new Map<string, string>()
 
+// Why: WSL distro names are case-insensitive, and paths and callers spell them differently.
+function cacheKey(distro: string): string {
+  return distro.toLowerCase()
+}
+
 export function getCachedWslHome(distro: string): string | undefined {
-  const home = wslHomeCache.get(distro)
+  const key = cacheKey(distro)
+  const home = wslHomeCache.get(key)
   if (home === undefined) {
     return undefined
   }
-  wslHomeCache.delete(distro)
-  wslHomeCache.set(distro, home)
+  wslHomeCache.delete(key)
+  wslHomeCache.set(key, home)
   return home
 }
 
 export function rememberWslHome(distro: string, home: string): string {
-  wslHomeCache.delete(distro)
-  wslHomeCache.set(distro, home)
+  const key = cacheKey(distro)
+  wslHomeCache.delete(key)
+  wslHomeCache.set(key, home)
   while (wslHomeCache.size > MAX_WSL_HOME_CACHE_ENTRIES) {
     const oldest = wslHomeCache.keys().next().value
     if (oldest === undefined) {
@@ -25,7 +32,7 @@ export function rememberWslHome(distro: string, home: string): string {
 }
 
 export function hasCachedWslHome(distro: string): boolean {
-  return wslHomeCache.has(distro)
+  return wslHomeCache.has(cacheKey(distro))
 }
 
 export function clearWslHomeCache(): void {
diff --git a/src/main/wsl-managed-cli-path-restore.test.ts b/src/main/wsl-managed-cli-path-restore.test.ts
new file mode 100644
index 00000000000..01d80390099
--- /dev/null
+++ b/src/main/wsl-managed-cli-path-restore.test.ts
@@ -0,0 +1,59 @@
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterAll, describe, expect, it } from 'vitest'
+import { runProcessSync } from '../shared/child-process/run-process'
+import { WSL_MANAGED_CLI_PATH_RESTORE } from './wsl-managed-cli-path-restore'
+
+const posix = process.platform !== 'win32'
+const hasZsh = posix && runProcessSync({ program: 'sh', args: ['-c', 'command -v zsh'] }).code === 0
+const root = posix ? mkdtempSync(join(tmpdir(), 'orca managed cli restore ')) : ''
+if (posix) {
+  writeFileSync(join(root, 'orca-dev'), '#!/bin/sh\n')
+  chmodSync(join(root, 'orca-dev'), 0o755)
+  writeFileSync(join(root, 'orca-ide'), '#!/bin/sh\n')
+  chmodSync(join(root, 'orca-ide'), 0o644)
+}
+afterAll(() => {
+  if (root) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+// Mirrors how each shell embeds the snippet: bash rcfile top level, zsh first-prompt hook.
+const SHELLS = [
+  { name: 'bash', enabled: posix, args: (body: string) => ['--norc', '--noprofile', '-uc', body] },
+  {
+    name: 'zsh',
+    enabled: hasZsh,
+    args: (body: string) => ['-fuc', `__orca_hook() {\n  emulate -L zsh\n${body}\n}\n__orca_hook`]
+  }
+] as const
+
+function run(
+  shell: (typeof SHELLS)[number],
+  env: Record<string, string>
+): { code: number | null; stdout: string; stderr: string } {
+  return runProcessSync({
+    program: shell.name,
+    args: shell.args(`${WSL_MANAGED_CLI_PATH_RESTORE}\nprintf '%s' "$PATH"`),
+    env: { PATH: '/usr/bin:/bin', ...env }
+  })
+}
+
+describe.each(SHELLS)('WSL_MANAGED_CLI_PATH_RESTORE in $name', (shell) => {
+  it.skipIf(!shell.enabled)('leads PATH with a directory holding an executable CLI', () => {
+    const result = run(shell, { ORCA_WSL_CLI_DIR: root, ORCA_CLI_COMMAND: 'orca-dev' })
+    expect(result).toMatchObject({ code: 0, stdout: `${root}:/usr/bin:/bin`, stderr: '' })
+  })
+
+  it.skipIf(!shell.enabled)('warns and keeps PATH when the CLI cannot run', () => {
+    const result = run(shell, { ORCA_WSL_CLI_DIR: root, ORCA_CLI_COMMAND: 'orca-ide' })
+    expect(result).toMatchObject({ code: 0, stdout: '/usr/bin:/bin' })
+    expect(result.stderr).toContain('Orca CLI unavailable')
+  })
+
+  it.skipIf(!shell.enabled)('does nothing without a managed directory', () => {
+    expect(run(shell, {})).toMatchObject({ code: 0, stdout: '/usr/bin:/bin', stderr: '' })
+  })
+})
diff --git a/src/main/wsl-managed-cli-path-restore.ts b/src/main/wsl-managed-cli-path-restore.ts
new file mode 100644
index 00000000000..d3091433a71
--- /dev/null
+++ b/src/main/wsl-managed-cli-path-restore.ts
@@ -0,0 +1,8 @@
+/** Leads PATH with the managed WSL CLI after startup files ran; an unusable CLI only warns. */
+export const WSL_MANAGED_CLI_PATH_RESTORE = `if [ -n "\${ORCA_WSL_CLI_DIR:-}" ]; then
+  if [ -x "$ORCA_WSL_CLI_DIR/\${ORCA_CLI_COMMAND:-}" ]; then
+    export PATH="$ORCA_WSL_CLI_DIR\${PATH:+:$PATH}"
+  else
+    printf 'Orca CLI unavailable: cannot run %s. Check WSL Windows-drive mount options.\\n' "$ORCA_WSL_CLI_DIR/\${ORCA_CLI_COMMAND:-}" >&2
+  fi
+fi`
diff --git a/src/main/wsl-running-distro-cache.ts b/src/main/wsl-running-distro-cache.ts
index 436fbe419cb..07a55a47bcd 100644
--- a/src/main/wsl-running-distro-cache.ts
+++ b/src/main/wsl-running-distro-cache.ts
@@ -8,7 +8,8 @@ import { wslDistroListRetryDelayMs } from './wsl-distro-retry'
 let cache: string[] | null = null
 let retryAfterMs = 0
 let failureStreak = 0
-let inFlightProbe: Promise<string[]> | null = null
+type RunningDistroObservation = { distros: string[]; confirmed: boolean }
+let inFlightProbe: Promise<RunningDistroObservation> | null = null
 
 function armRetryAfterFailure(): void {
   const now = Date.now()
@@ -28,24 +29,37 @@ function armRetryAfterFailure(): void {
  * back to the cache and arms backoff. Bounds wsl.exe spawns under both IPC fan-out and a
  * broken/degraded host.
  */
-export function resolveRunningWslDistros(probe: () => Promise<string[]>): Promise<string[]> {
+export async function resolveRunningWslDistros(
+  probe: () => Promise<string[]>,
+  options: { requireConfirmed?: boolean } = {}
+): Promise<string[]> {
+  const observation = await observeRunningWslDistros(probe)
+  if (options.requireConfirmed && !observation.confirmed) {
+    throw new Error('WSL running-distro discovery is unavailable. Retry when WSL is reachable.')
+  }
+  return observation.distros
+}
+
+function observeRunningWslDistros(
+  probe: () => Promise<string[]>
+): Promise<RunningDistroObservation> {
   if (inFlightProbe) {
     return inFlightProbe
   }
   if (Date.now() < retryAfterMs) {
-    return Promise.resolve(cache ?? [])
+    return Promise.resolve({ distros: cache ?? [], confirmed: false })
   }
   const result = probe()
     .then((distros) => {
       cache = distros
       retryAfterMs = 0
       failureStreak = 0
-      return cache
+      return { distros, confirmed: true }
     })
     .catch((error: unknown) => {
       armRetryAfterFailure()
       console.warn('[wsl] running-distro probe failed; falling back to last-known-good list', error)
-      return cache ?? []
+      return { distros: cache ?? [], confirmed: false }
     })
     .finally(() => {
       if (inFlightProbe === result) {
diff --git a/src/main/wsl-running-distros.test.ts b/src/main/wsl-running-distros.test.ts
index 049c2f2e379..4f80e5eb5c2 100644
--- a/src/main/wsl-running-distros.test.ts
+++ b/src/main/wsl-running-distros.test.ts
@@ -67,6 +67,65 @@ describe('running WSL distro discovery', () => {
     })
   })
 
+  it('rejects stale running state for launch admission through failure and backoff', async () => {
+    vi.useFakeTimers()
+    execFileMock.mockImplementationOnce((_command, _args, _options, callback) => {
+      callback(null, 'Ubuntu\n')
+    })
+
+    await withPlatform('win32', async () => {
+      await expect(listRunningWslDistrosAsync()).resolves.toEqual(['Ubuntu'])
+      execFileMock.mockImplementation((_command, _args, _options, callback) => {
+        callback(new Error('wsl unavailable'), '')
+      })
+      const paths = ['\\\\wsl.localhost\\Ubuntu\\home\\ada']
+      await expect(
+        filterPathsToRunningWslDistrosAsync(paths, { requireConfirmed: true })
+      ).rejects.toThrow('discovery is unavailable')
+      await expect(listRunningWslDistrosAsync()).resolves.toEqual(['Ubuntu'])
+      await expect(listRunningWslDistrosAsync({ requireConfirmed: true })).rejects.toThrow(
+        'discovery is unavailable'
+      )
+      expect(execFileMock).toHaveBeenCalledTimes(2)
+
+      execFileMock.mockImplementation((_command, _args, _options, callback) => {
+        callback(null, '')
+      })
+      await vi.advanceTimersByTimeAsync(15_001)
+      await expect(
+        filterPathsToRunningWslDistrosAsync(paths, { requireConfirmed: true })
+      ).resolves.toEqual([])
+      expect(execFileMock).toHaveBeenCalledTimes(3)
+    })
+  })
+
+  it.each([true, false])(
+    'shares the probe while preserving admission and observer failure policies (strict first: %s)',
+    async (strictFirst) => {
+      execFileMock.mockImplementationOnce((_command, _args, _options, callback) => {
+        callback(null, 'Ubuntu\n')
+      })
+
+      await withPlatform('win32', async () => {
+        await listRunningWslDistrosAsync()
+        let finishProbe: ((error: Error | null, output: string) => void) | undefined
+        execFileMock.mockImplementationOnce((_command, _args, _options, callback) => {
+          finishProbe = callback
+        })
+        const first = listRunningWslDistrosAsync({ requireConfirmed: strictFirst })
+        const second = listRunningWslDistrosAsync({ requireConfirmed: !strictFirst })
+        const strict = strictFirst ? first : second
+        const observer = strictFirst ? second : first
+        const rejected = expect(strict).rejects.toThrow('discovery is unavailable')
+        expect(execFileMock).toHaveBeenCalledTimes(2)
+        finishProbe?.(new Error('wsl unavailable'), '')
+        await rejected
+        await expect(observer).resolves.toEqual(['Ubuntu'])
+        expect(execFileMock).toHaveBeenCalledTimes(2)
+      })
+    }
+  )
+
   it('resolves homes only for the running distro set', async () => {
     execFileMock.mockImplementation((_command, args, _options, callback) => {
       callback(null, args.includes('--running') ? 'Ubuntu\n' : '/home/ada\n')
@@ -139,6 +198,21 @@ describe('running WSL distro discovery', () => {
     })
   })
 
+  it('shares a confirmed fresh probe between discovery and launch admission', async () => {
+    execFileMock.mockImplementationOnce((_command, _args, _options, callback) =>
+      callback(null, 'Ubuntu\n')
+    )
+    await withPlatform('win32', async () => {
+      expect(
+        await Promise.all([
+          listRunningWslDistrosAsync(),
+          listRunningWslDistrosAsync({ requireConfirmed: true })
+        ])
+      ).toEqual([['Ubuntu'], ['Ubuntu']])
+      expect(execFileMock).toHaveBeenCalledOnce()
+    })
+  })
+
   it('filters stopped-distro UNC paths while preserving host paths', async () => {
     execFileMock.mockImplementation((_command, _args, _options, callback) => {
       callback(null, 'Ubuntu\n')
diff --git a/src/main/wsl-running-path-filter.ts b/src/main/wsl-running-path-filter.ts
index 7384229757f..370e5b4783c 100644
--- a/src/main/wsl-running-path-filter.ts
+++ b/src/main/wsl-running-path-filter.ts
@@ -14,11 +14,12 @@ export function filterPathsToWslDistros(
 
 /** Keep host paths and WSL paths whose distro is running now. */
 export async function filterPathsToRunningWslDistrosAsync(
-  paths: readonly string[]
+  paths: readonly string[],
+  options?: { requireConfirmed?: boolean }
 ): Promise<string[]> {
   if (process.platform !== 'win32') {
     return [...paths]
   }
-  const runningDistros = paths.some(isWslUncPath) ? await listRunningWslDistrosAsync() : []
+  const runningDistros = paths.some(isWslUncPath) ? await listRunningWslDistrosAsync(options) : []
   return filterPathsToWslDistros(paths, runningDistros)
 }
diff --git a/src/main/wsl.ts b/src/main/wsl.ts
index be69dde401a..007b2f1c8bc 100644
--- a/src/main/wsl.ts
+++ b/src/main/wsl.ts
@@ -230,15 +230,19 @@ export async function listWslDistrosAsync(): Promise<string[]> {
 
 /** Running user distros only — see `resolveRunningWslDistros` for the fallback/backoff and
  *  single-flight contract shared by every caller. */
-export async function listRunningWslDistrosAsync(): Promise<string[]> {
+export async function listRunningWslDistrosAsync(
+  options: { requireConfirmed?: boolean } = {}
+): Promise<string[]> {
   if (process.platform !== 'win32') {
     return []
   }
-  return resolveRunningWslDistros(() =>
-    execFileUtf8('wsl.exe', ['--list', '--running', '--quiet'], {
-      ...process.env,
-      WSL_UTF8: '1'
-    }).then((output) => filterUserWslDistros(parseWslDistros(output)))
+  return resolveRunningWslDistros(
+    () =>
+      execFileUtf8('wsl.exe', ['--list', '--running', '--quiet'], {
+        ...process.env,
+        WSL_UTF8: '1'
+      }).then((output) => filterUserWslDistros(parseWslDistros(output))),
+    options
   )
 }
 
diff --git a/src/main/zsh-startup-wrapper-builder.ts b/src/main/zsh-startup-wrapper-builder.ts
index 27a1e0b7615..12a92b6bb45 100644
--- a/src/main/zsh-startup-wrapper-builder.ts
+++ b/src/main/zsh-startup-wrapper-builder.ts
@@ -27,6 +27,7 @@
  * hook restores zsh option semantics for the body at call time.
  */
 import { getPosixOmpShellWrapper } from './pty/omp-shell-wrapper'
+import { WSL_MANAGED_CLI_PATH_RESTORE } from './wsl-managed-cli-path-restore'
 import { getPosixCodexShellLaunchPreflight } from './pty/codex-shell-launch-preflight'
 import {
   getZshShellReadyMarkerRegistrationBlock,
@@ -38,14 +39,14 @@ import {
 
 /** Runtime values the hook re-exports after the user's own startup files ran. */
 export type ZshWrapperRestoreSpec = {
+  /** The managed WSL CLI dir onto PATH — local wrappers only; a no-op outside WSL. */
+  managedWslCli: boolean
   /** Orca's agent-teams shim dir back onto PATH. */
   agentTeamsPath: boolean
   /** Remote CLI bin dir onto PATH — relay hosts only. */
   remoteCliBinDir: boolean
   /** Orca's runtime CODEX_HOME. */
   codexHome: boolean
-  /** The `codex()` wrapper that runs Orca's launch preflight. */
-  codexLaunchPreflight: boolean
 }
 
 export type ZshStartupHookSpec = {
@@ -124,8 +125,7 @@ function getOverlayRestoreBlocks(spec: ZshStartupHookSpec): (string | null)[] {
     MIMOCODE_HOME_RESTORE,
     spec.restores.remoteCliBinDir ? REMOTE_CLI_BIN_DIR_RESTORE : null,
     getPosixOmpShellWrapper(),
-    spec.restores.codexHome ? CODEX_HOME_RESTORE : null,
-    spec.restores.codexLaunchPreflight ? getPosixCodexShellLaunchPreflight() : null
+    spec.restores.codexHome ? CODEX_HOME_RESTORE : null
   ]
 }
 
@@ -170,7 +170,10 @@ ${indentBlock(getZshShellReadyMarkerRegistrationBlock(spec.readyMarkerEscaped, t
   builtin typeset -g precmd_functions
 ${permanentPrecmd}
 ${joinBlocks([
+  spec.restores.managedWslCli ? indentBlock(WSL_MANAGED_CLI_PATH_RESTORE, '  ') : null,
   featureGuard('overlay', getOverlayRestoreBlocks(spec)),
+  // Why outside the overlay guard: a system-default Codex home carries no overlay key.
+  indentBlock(getPosixCodexShellLaunchPreflight(), '  ').replace(/\n$/, ''),
   // Why no /etc/zshrc repair branch: ZDOTDIR was handed back before that file
   // ran, so the value it derives is the user's own path. #11044 is unreachable.
   `  if [[ -n "\${_orca_histfile:-}" ]]; then
diff --git a/src/preload/api-types.ts b/src/preload/api-types.ts
index 26527b9a1e5..220b90c18a6 100644
--- a/src/preload/api-types.ts
+++ b/src/preload/api-types.ts
@@ -2,12 +2,13 @@ import type {
   ClaudeAccountsApi,
   CodexAccountsApi,
   CodexConfigSyncApi,
+  CursorAccountsApi,
   GrokAccountsApi,
   MinimaxCredentialsApi
 } from './api/agent-account-api'
 import type { HooksApi } from './api/agent-hook-api'
 import type { SkillsApi } from './api/agent-skill-api'
-import type { AgentAwakeApi, AgentStatusApi, AgentTrustApi } from './api/agent-status-api'
+import type { AgentAwakeApi, AgentStatusApi } from './api/agent-status-api'
 import type {
   ClaudeUsageApi,
   CodexUsageApi,
@@ -105,7 +106,6 @@ export type PreloadApi = {
   claudeAccounts: ClaudeAccountsApi
   cli: CliApi
   codexConfigSync: CodexConfigSyncApi
-  agentTrust: AgentTrustApi
   preflight: PreflightApi
   notifications: NotificationsApi
   onboarding: OnboardingApi
@@ -143,6 +143,7 @@ export type PreloadApi = {
   rateLimits: RateLimitsApi
   minimaxCredentials: MinimaxCredentialsApi
   grokAccounts: GrokAccountsApi
+  cursorAccounts: CursorAccountsApi
   ssh: SshApi
   automations: AutomationsApi
   wsl: RuntimeApi['wsl']
diff --git a/src/preload/api/agent-account-api.ts b/src/preload/api/agent-account-api.ts
index f041e41f8b7..e8d574c285b 100644
--- a/src/preload/api/agent-account-api.ts
+++ b/src/preload/api/agent-account-api.ts
@@ -3,7 +3,7 @@ import type {
   CodexRateLimitAccountsState
 } from '../../shared/managed-account-types'
 import type { CodexConfigSyncStatus } from '../../shared/codex-config-sync-types'
-import type { GrokAccountStatus } from '../../shared/rate-limit-types'
+import type { CursorAccountStatus, GrokAccountStatus } from '../../shared/rate-limit-types'
 
 export type CodexAccountsApi = {
   list: () => Promise<CodexRateLimitAccountsState>
@@ -62,6 +62,10 @@ export type GrokAccountsApi = {
   getStatus: () => Promise<GrokAccountStatus>
 }
 
+export type CursorAccountsApi = {
+  getStatus: () => Promise<CursorAccountStatus>
+}
+
 export type MinimaxCredentialsApi = {
   // Why: cookie + API key each live in their own safeStorage file, so the
   // status separates them. 'configured' stays as the OR so existing callers
diff --git a/src/preload/api/agent-status-api.ts b/src/preload/api/agent-status-api.ts
index 7c538a990f1..909f0fd20fb 100644
--- a/src/preload/api/agent-status-api.ts
+++ b/src/preload/api/agent-status-api.ts
@@ -48,14 +48,6 @@ export type AgentStatusApi = {
   transferPaneAuthority: (args: { fromPaneKey: string; toPaneKey: string; ptyId?: string }) => void
 }
 
-export type AgentTrustApi = {
-  markTrusted: (args: {
-    preset: 'cursor' | 'copilot' | 'codex' | 'antigravity'
-    workspacePath: string
-    connectionId?: string
-  }) => Promise<void>
-}
-
 export type AgentAwakeApi = {
   getStatus: () => Promise<ComputerAwakeStatus>
   onChanged: (callback: (status: ComputerAwakeStatus) => void) => () => void
diff --git a/src/preload/api/agent-trust-bridge.ts b/src/preload/api/agent-trust-bridge.ts
deleted file mode 100644
index a9afa9c363d..00000000000
--- a/src/preload/api/agent-trust-bridge.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-import { ipcRenderer } from 'electron'
-import type { PreloadApi } from '../api-types'
-
-export const agentTrustApi = {
-  markTrusted: (args: {
-    preset: 'cursor' | 'copilot' | 'codex' | 'antigravity'
-    workspacePath: string
-    connectionId?: string
-  }): Promise<void> => ipcRenderer.invoke('agentTrust:markTrusted', args)
-} satisfies PreloadApi['agentTrust']
diff --git a/src/preload/api/cursor-accounts-bridge.ts b/src/preload/api/cursor-accounts-bridge.ts
new file mode 100644
index 00000000000..20f8d5d6a00
--- /dev/null
+++ b/src/preload/api/cursor-accounts-bridge.ts
@@ -0,0 +1,7 @@
+import { ipcRenderer } from 'electron'
+import type { CursorAccountStatus } from '../../shared/rate-limit-types'
+import type { PreloadApi } from '../api-types'
+
+export const cursorAccountsApi = {
+  getStatus: (): Promise<CursorAccountStatus> => ipcRenderer.invoke('cursorAccounts:getStatus')
+} satisfies PreloadApi['cursorAccounts']
diff --git a/src/preload/api/filesystem-api.ts b/src/preload/api/filesystem-api.ts
index 2a8f0612905..d8b74cd9304 100644
--- a/src/preload/api/filesystem-api.ts
+++ b/src/preload/api/filesystem-api.ts
@@ -170,6 +170,8 @@ export type FilesystemApi = {
     listPythonEnvironments: (args: {
       filePath: string
       rootPath: string | null
+      /** False until the notebook is trusted: workspace envs are then listed without running them. */
+      runWorkspaceInterpreters: boolean
     }) => Promise<PythonEnvironments>
     describePython: (args: { path: string }) => Promise<PythonEnvironment | null>
     startKernel: (args: { filePath: string; python: string }) => Promise<KernelStartResult>
diff --git a/src/preload/api/orca-profiles-bridge.ts b/src/preload/api/orca-profiles-bridge.ts
index da58b2d9def..201b6be9799 100644
--- a/src/preload/api/orca-profiles-bridge.ts
+++ b/src/preload/api/orca-profiles-bridge.ts
@@ -1,6 +1,13 @@
 import { ipcRenderer } from 'electron'
 import type { PreloadApi } from '../api-types'
-import { ORCA_PROFILE_AUTH_STATUS_CHANGED_CHANNEL } from '../../shared/orca-profiles'
+import {
+  ORCA_PROFILE_AUTH_STATUS_CHANGED_CHANNEL,
+  type OrcaProfileListResult,
+  type SwitchOrcaProfileResult,
+  type TransferOrcaProfileProjectResult
+} from '../../shared/orca-profiles'
+import { prepareAndInvokeAppRestart } from '../renderer-restart-wiring'
+import { awaitBeforeUnloadCheckpoint } from '../preload-runtime-support'
 
 export const orcaProfilesApi = {
   list: () => ipcRenderer.invoke('orcaProfiles:list'),
@@ -12,8 +19,30 @@ export const orcaProfilesApi = {
   },
   createLocal: (args) => ipcRenderer.invoke('orcaProfiles:createLocal', args),
   createCloudLinked: (args) => ipcRenderer.invoke('orcaProfiles:createCloudLinked', args),
-  switchProfile: (args) => ipcRenderer.invoke('orcaProfiles:switch', args),
-  transferProject: (args) => ipcRenderer.invoke('orcaProfiles:transferProject', args),
+  switchProfile: (args) =>
+    prepareAndInvokeAppRestart(
+      window,
+      (): Promise<SwitchOrcaProfileResult> => ipcRenderer.invoke('orcaProfiles:switch', args),
+      awaitBeforeUnloadCheckpoint,
+      (result) => result.status === 'relaunching'
+    ),
+  transferProject: async (args) => {
+    const invoke = (): Promise<TransferOrcaProfileProjectResult> =>
+      ipcRenderer.invoke('orcaProfiles:transferProject', args)
+    if (args.mode !== 'move') {
+      return invoke()
+    }
+    const current: OrcaProfileListResult = await ipcRenderer.invoke('orcaProfiles:list')
+    if (args.sourceProfileId !== current.activeProfileId) {
+      return invoke()
+    }
+    return prepareAndInvokeAppRestart(
+      window,
+      invoke,
+      awaitBeforeUnloadCheckpoint,
+      (result) => result.status === 'transferred' && result.willRelaunch === true
+    )
+  },
   findProjectProfiles: (args) => ipcRenderer.invoke('orcaProfiles:findProjectProfiles', args),
   connectCurrent: () => ipcRenderer.invoke('orcaProfiles:connectCurrent'),
   refreshAuth: () => ipcRenderer.invoke('orcaProfiles:refreshAuth'),
diff --git a/src/preload/api/pty-api.ts b/src/preload/api/pty-api.ts
index ca273aee07d..eb45c4dba68 100644
--- a/src/preload/api/pty-api.ts
+++ b/src/preload/api/pty-api.ts
@@ -3,6 +3,7 @@ import type {
   SleepingAgentLaunchConfig
 } from '../../shared/agent-session-resume'
 import type { StartupCommandDelivery } from '../../shared/codex-startup-delivery'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 import type { ProjectExecutionRuntimeResolution } from '../../shared/project-execution-runtime'
 import type { PtyListedSession, PtySessionListScope } from '../../shared/pty-listed-session'
 import type { PtyMainDeliveryDiagnostics } from '../../shared/pty-delivery-diagnostics'
@@ -75,14 +76,15 @@ export type PtyApi = {
     /** Host verdict on the shell-ready marker; absent when the execution host predates the field. */
     shellReadyArmed?: boolean
   }>
-  write: (id: string, data: string) => void
-  writeAccepted: (id: string, data: string) => Promise<boolean>
+  write: (id: string, data: string, inputKind: TerminalInputKind) => void
+  writeAccepted: (id: string, data: string, inputKind: TerminalInputKind) => Promise<boolean>
   onWriteUnavailable?: (callback: (payload: { id: string }) => void) => () => void
   resize: (id: string, cols: number, rows: number) => void
   claimViewport: (id: string, cols: number, rows: number) => void
   reportGeometry: (id: string, cols: number, rows: number) => void
   signal: (id: string, signal: string) => void
   clearBuffer: (id: string) => void
+  resetInputModes: (id: string) => void
   kill: (id: string, opts?: { keepHistory?: boolean }) => Promise<void>
   ackColdRestore: (id: string) => void
   ackData: (id: string, charCount: number, processedChars?: number) => void
@@ -228,6 +230,7 @@ export type PtyApi = {
     }) => void
   ) => () => void
   onClearBufferRequest: (callback: (data: { ptyId: string }) => void) => () => void
+  onResetInputModesRequest: (callback: (data: { ptyId: string }) => void) => () => void
   sendSerializedBuffer: (
     requestId: string,
     snapshot: {
diff --git a/src/preload/api/pty-bridge-session-control.ts b/src/preload/api/pty-bridge-session-control.ts
index e9b19dbe43a..1f8639c58be 100644
--- a/src/preload/api/pty-bridge-session-control.ts
+++ b/src/preload/api/pty-bridge-session-control.ts
@@ -1,6 +1,7 @@
 import { ipcRenderer } from 'electron'
 import type { ProjectExecutionRuntimeResolution } from '../../shared/project-execution-runtime'
 import type { StartupCommandDelivery } from '../../shared/codex-startup-delivery'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 import type {
   AgentProviderSessionMetadata,
   SleepingAgentLaunchConfig
@@ -71,11 +72,11 @@ export const ptySessionControlApi = {
     /** Host verdict on the shell-ready marker; absent when the execution host predates the field. */
     shellReadyArmed?: boolean
   }> => ipcRenderer.invoke('pty:spawn', opts),
-  write: (id: string, data: string): void => {
-    ipcRenderer.send('pty:write', { id, data })
+  write: (id: string, data: string, inputKind: TerminalInputKind): void => {
+    ipcRenderer.send('pty:write', { id, data, inputKind })
   },
-  writeAccepted: (id: string, data: string): Promise<boolean> =>
-    ipcRenderer.invoke('pty:writeAccepted', { id, data }),
+  writeAccepted: (id: string, data: string, inputKind: TerminalInputKind): Promise<boolean> =>
+    ipcRenderer.invoke('pty:writeAccepted', { id, data, inputKind }),
   onWriteUnavailable: (callback: (payload: { id: string }) => void): (() => void) => {
     const handler = (_event: Electron.IpcRendererEvent, payload: { id: string }): void =>
       callback(payload)
@@ -97,6 +98,9 @@ export const ptySessionControlApi = {
   clearBuffer: (id: string): void => {
     ipcRenderer.send('pty:clearBuffer', { id })
   },
+  resetInputModes: (id: string): void => {
+    ipcRenderer.send('pty:resetInputModes', { id })
+  },
   ackColdRestore: (id: string): void => {
     ipcRenderer.send('pty:ackColdRestore', { id })
   },
diff --git a/src/preload/api/pty-bridge-stream-and-serialization.ts b/src/preload/api/pty-bridge-stream-and-serialization.ts
index 49e2189fd53..557570c8eab 100644
--- a/src/preload/api/pty-bridge-stream-and-serialization.ts
+++ b/src/preload/api/pty-bridge-stream-and-serialization.ts
@@ -120,6 +120,11 @@ export const ptyStreamAndSerializationApi = {
     ipcRenderer.on('pty:clearBuffer:request', listener)
     return () => ipcRenderer.removeListener('pty:clearBuffer:request', listener)
   },
+  onResetInputModesRequest: (callback: (data: { ptyId: string }) => void): (() => void) => {
+    const listener = (_event: Electron.IpcRendererEvent, data: { ptyId: string }) => callback(data)
+    ipcRenderer.on('pty:resetInputModes:request', listener)
+    return () => ipcRenderer.removeListener('pty:resetInputModes:request', listener)
+  },
   sendSerializedBuffer: (
     requestId: string,
     snapshot: {
diff --git a/src/preload/api/session-bridge.ts b/src/preload/api/session-bridge.ts
index 22d342cd2c1..537e15179dd 100644
--- a/src/preload/api/session-bridge.ts
+++ b/src/preload/api/session-bridge.ts
@@ -7,6 +7,7 @@ export const sessionApi = {
   listHostIds: () => ipcRenderer.invoke('session:list-host-ids'),
   set: (args, hostId) => ipcRenderer.invoke('session:set', args, hostId),
   patch: (args, hostId) => ipcRenderer.invoke('session:patch', args, hostId),
+  closeTerminalSurface: (args) => ipcRenderer.invoke('session:close-terminal-surface', args),
   flush: () => ipcRenderer.invoke('session:flush'),
   readTerminalScrollback: (args) =>
     ipcRenderer.sendSync('session:read-terminal-scrollback-sync', args),
diff --git a/src/preload/api/ssh-api.ts b/src/preload/api/ssh-api.ts
index af198ad1080..5fc64c030e5 100644
--- a/src/preload/api/ssh-api.ts
+++ b/src/preload/api/ssh-api.ts
@@ -71,6 +71,7 @@ export type SshApi = {
       targetId: string
       kind: 'passphrase' | 'password' | 'keyboard-interactive'
       detail: string
+      echo?: boolean
     }) => void
   ) => () => void
   onCredentialResolved: (callback: (data: { requestId: string }) => void) => () => void
diff --git a/src/preload/api/ssh-bridge.ts b/src/preload/api/ssh-bridge.ts
index 03c10f9bc07..240da3c9508 100644
--- a/src/preload/api/ssh-bridge.ts
+++ b/src/preload/api/ssh-bridge.ts
@@ -158,6 +158,7 @@ export const sshApi = {
       targetId: string
       kind: 'passphrase' | 'password' | 'keyboard-interactive'
       detail: string
+      echo?: boolean
     }) => void
   ): (() => void) => {
     const listener = (
@@ -167,6 +168,7 @@ export const sshApi = {
         targetId: string
         kind: 'passphrase' | 'password' | 'keyboard-interactive'
         detail: string
+        echo?: boolean
       }
     ) => callback(data)
     ipcRenderer.on('ssh:credential-request', listener)
diff --git a/src/preload/api/ui-bridge-clipboard-and-window-controls.ts b/src/preload/api/ui-bridge-clipboard-and-window-controls.ts
index 1738cb46d2a..80f2c2dd383 100644
--- a/src/preload/api/ui-bridge-clipboard-and-window-controls.ts
+++ b/src/preload/api/ui-bridge-clipboard-and-window-controls.ts
@@ -10,6 +10,7 @@ import {
   type RichMarkdownContextMenuTableTarget
 } from '../../shared/rich-markdown-context-menu'
 import type { NativeFileDropPayload } from '../../shared/native-file-drop'
+import type { TerminalSurfaceCloseTarget } from '../../shared/terminal-surface-close-target'
 import type { ClipboardImageThumbnail } from '../../shared/clipboard-image'
 import type { ReadClipboardTextOptions } from '../../shared/clipboard-text'
 import { subscribeNativeFileDrop } from '../preload-runtime-support'
@@ -49,13 +50,9 @@ export const uiClipboardAndWindowControlsApi = {
   respondMobileMarkdownRequest: (response: RuntimeMobileMarkdownResponse): void => {
     ipcRenderer.send('ui:mobileMarkdownResponse', response)
   },
-  onCloseTerminal: (
-    callback: (data: { tabId: string; paneRuntimeId?: number }) => void
-  ): (() => void) => {
-    const listener = (
-      _event: Electron.IpcRendererEvent,
-      data: { tabId: string; paneRuntimeId?: number }
-    ) => callback(data)
+  onCloseTerminal: (callback: (target: TerminalSurfaceCloseTarget) => void): (() => void) => {
+    const listener = (_event: Electron.IpcRendererEvent, target: TerminalSurfaceCloseTarget) =>
+      callback(target)
     ipcRenderer.on('ui:closeTerminal', listener)
     return () => ipcRenderer.removeListener('ui:closeTerminal', listener)
   },
diff --git a/src/preload/api/ui-command-event-api.ts b/src/preload/api/ui-command-event-api.ts
index d20ce87718b..f6bb247bf91 100644
--- a/src/preload/api/ui-command-event-api.ts
+++ b/src/preload/api/ui-command-event-api.ts
@@ -1,6 +1,7 @@
 import type { MarkdownDocument } from '../../shared/filesystem-entry-types'
 import type { PersistedUIState } from '../../shared/persisted-ui-state-types'
 import type { TuiAgent } from '../../shared/tui-agent'
+import type { TerminalSurfaceCloseTarget } from '../../shared/terminal-surface-close-target'
 import type {
   WorktreeDefaultTabsLaunch,
   WorktreeSetupLaunch,
@@ -236,9 +237,7 @@ export type UiCommandEventApi = {
   ) => () => void
   onMobileMarkdownRequest: (callback: (request: RuntimeMobileMarkdownRequest) => void) => () => void
   respondMobileMarkdownRequest: (response: RuntimeMobileMarkdownResponse) => void
-  onCloseTerminal: (
-    callback: (data: { tabId: string; paneRuntimeId?: number }) => void
-  ) => () => void
+  onCloseTerminal: (callback: (target: TerminalSurfaceCloseTarget) => void) => () => void
   onTerminalTabCloseRequest: (callback: (request: TerminalTabCloseRequest) => void) => () => void
   respondTerminalTabClose: (response: TerminalTabCloseResponse) => void
   onSleepWorktree: (callback: (data: { worktreeId: string }) => void) => () => void
diff --git a/src/preload/api/workspace-session-api.ts b/src/preload/api/workspace-session-api.ts
index 4c31b6e5db8..d621e5dc7db 100644
--- a/src/preload/api/workspace-session-api.ts
+++ b/src/preload/api/workspace-session-api.ts
@@ -4,6 +4,7 @@ import type {
   WorkspaceSessionState
 } from '../../shared/workspace-session-state-types'
 import type { ExecutionHostId } from '../../shared/execution-host'
+import type { TerminalSurfaceCloseTarget } from '../../shared/terminal-surface-close-target'
 import type {
   RemoteWorkspaceChangedEvent,
   RemoteWorkspaceConnectedClient,
@@ -19,6 +20,12 @@ export type WorkspaceSessionApi = {
     listHostIds: () => Promise<ExecutionHostId[]>
     set: (args: WorkspaceSessionState, hostId?: ExecutionHostId) => Promise<void>
     patch: (args: WorkspaceSessionPatch, hostId?: ExecutionHostId) => Promise<void>
+    /** Commits a terminal tab or split-pane close into main's membership. */
+    closeTerminalSurface: (args: {
+      worktreeId: string
+      target: TerminalSurfaceCloseTarget
+      reason?: 'user' | 'cleanup'
+    }) => Promise<void>
     flush: () => Promise<void>
     readTerminalScrollback: (args: { ref: string }) => string | null
     setSync: (args: WorkspaceSessionState, hostId?: ExecutionHostId) => void
diff --git a/src/preload/app-restart-checkpoint-routing.test.ts b/src/preload/app-restart-checkpoint-routing.test.ts
index b68f55989f5..2c44b9a5b7f 100644
--- a/src/preload/app-restart-checkpoint-routing.test.ts
+++ b/src/preload/app-restart-checkpoint-routing.test.ts
@@ -124,4 +124,99 @@ describe('native preload destructive app actions', () => {
     expect(onKeyboardLayoutChanged).toHaveBeenCalledExactlyOnceWith(payload)
     expect(removeListener).toHaveBeenCalledWith(KEYBOARD_LAYOUT_CHANGED_CHANNEL, listener)
   })
+
+  it('awaits renderer durability before profile maintenance and preserves its result', async () => {
+    const api = await loadApi()
+    const started = vi.fn()
+    eventTarget.addEventListener(ORCA_APP_RESTART_STARTED_EVENT, started)
+    let finishCheckpoint = (_result: { ok: boolean }): void => {}
+    const checkpoint = new Promise((resolve) => {
+      finishCheckpoint = resolve
+    })
+    const result = { status: 'relaunching' }
+    invoke.mockImplementation((channel: string) =>
+      channel === 'app:await-before-unload-checkpoint' ? checkpoint : Promise.resolve(result)
+    )
+
+    const switching = api.orcaProfiles.switchProfile({ profileId: 'target' })
+    await vi.waitFor(() =>
+      expect(invoke).toHaveBeenCalledWith('app:await-before-unload-checkpoint')
+    )
+    expect(started).toHaveBeenCalledOnce()
+    expect(invoke).not.toHaveBeenCalledWith('orcaProfiles:switch', expect.anything())
+    finishCheckpoint({ ok: true })
+    await expect(switching).resolves.toBe(result)
+    expect(invoke).toHaveBeenLastCalledWith('orcaProfiles:switch', { profileId: 'target' })
+  })
+
+  it.each(['checkpoint-failed', 'switch-failed', 'already-active'])(
+    'resets restart preparation when profile switching returns %s',
+    async (outcome) => {
+      const api = await loadApi()
+      const aborted = vi.fn()
+      eventTarget.addEventListener(ORCA_APP_RESTART_ABORTED_EVENT, aborted)
+      invoke.mockImplementation(async (channel: string) => {
+        if (channel === 'app:await-before-unload-checkpoint') {
+          return { ok: outcome !== 'checkpoint-failed' }
+        }
+        if (outcome === 'switch-failed') {
+          throw new Error('switch failed')
+        }
+        return { status: 'already-active' }
+      })
+      const switching = api.orcaProfiles.switchProfile({ profileId: 'target' })
+      await (outcome === 'already-active'
+        ? expect(switching).resolves.toEqual({ status: 'already-active' })
+        : expect(switching).rejects.toThrow())
+      expect(aborted).toHaveBeenCalledOnce()
+      if (outcome === 'checkpoint-failed') {
+        expect(invoke).not.toHaveBeenCalledWith('orcaProfiles:switch', expect.anything())
+      }
+    }
+  )
+
+  it.each(['move', 'copy', 'inactive', 'duplicate', 'recovery'] as const)(
+    'prepares only a potentially relaunching project transfer: %s',
+    async (outcome) => {
+      const api = await loadApi()
+      const started = vi.fn()
+      const aborted = vi.fn()
+      eventTarget.addEventListener(ORCA_APP_RESTART_STARTED_EVENT, started)
+      eventTarget.addEventListener(ORCA_APP_RESTART_ABORTED_EVENT, aborted)
+      const args = {
+        sourceProfileId: outcome === 'inactive' ? 'inactive' : 'active',
+        targetProfileId: 'target',
+        repoId: 'repo',
+        mode: outcome === 'copy' ? ('copy' as const) : ('move' as const)
+      }
+      const result =
+        outcome === 'duplicate'
+          ? { status: 'duplicate-target' }
+          : { status: 'transferred', willRelaunch: outcome === 'move' }
+      invoke.mockImplementation(async (channel: string) => {
+        if (channel === 'orcaProfiles:list') {
+          return { activeProfileId: 'active' }
+        }
+        if (channel === 'app:await-before-unload-checkpoint') {
+          return { ok: true }
+        }
+        if (outcome === 'recovery') {
+          const listener = on.mock.calls.find(([name]) => name === 'app:restart-committed')?.[1]
+          expect(listener).toBeTypeOf('function')
+          listener()
+          throw new Error('move requires recovery')
+        }
+        return result
+      })
+
+      const transfer = api.orcaProfiles.transferProject(args)
+      await (outcome === 'recovery'
+        ? expect(transfer).rejects.toThrow('move requires recovery')
+        : expect(transfer).resolves.toBe(result))
+      const needsPreparation = outcome !== 'copy' && outcome !== 'inactive'
+      expect(started).toHaveBeenCalledTimes(needsPreparation ? 1 : 0)
+      expect(aborted).toHaveBeenCalledTimes(outcome === 'duplicate' ? 1 : 0)
+      expect(invoke).toHaveBeenLastCalledWith('orcaProfiles:transferProject', args)
+    }
+  )
 })
diff --git a/src/preload/index.ts b/src/preload/index.ts
index 3267b981775..42cf236c14d 100644
--- a/src/preload/index.ts
+++ b/src/preload/index.ts
@@ -40,7 +40,6 @@ import { codexAccountsApi } from './api/codex-accounts-bridge'
 import { claudeAccountsApi } from './api/claude-accounts-bridge'
 import { cliApi } from './api/cli-bridge'
 import { codexConfigSyncApi } from './api/codex-config-sync-bridge'
-import { agentTrustApi } from './api/agent-trust-bridge'
 import { preflightApi } from './api/preflight-bridge'
 import { notificationsApi } from './api/notifications-bridge'
 import { onboardingApi } from './api/onboarding-bridge'
@@ -78,6 +77,7 @@ import { runtimeEnvironmentsApi } from './api/runtime-environments-bridge'
 import { rateLimitsApi } from './api/rate-limits-bridge'
 import { minimaxCredentialsApi } from './api/minimax-credentials-bridge'
 import { grokAccountsApi } from './api/grok-accounts-bridge'
+import { cursorAccountsApi } from './api/cursor-accounts-bridge'
 import { sshApi } from './api/ssh-bridge'
 import { automationsApi } from './api/automations-bridge'
 import { e2eApi } from './api/e2e-bridge'
@@ -139,7 +139,6 @@ const api = {
   claudeAccounts: claudeAccountsApi,
   cli: cliApi,
   codexConfigSync: codexConfigSyncApi,
-  agentTrust: agentTrustApi,
   preflight: preflightApi,
   notifications: notificationsApi,
   onboarding: onboardingApi,
@@ -177,6 +176,7 @@ const api = {
   rateLimits: rateLimitsApi,
   minimaxCredentials: minimaxCredentialsApi,
   grokAccounts: grokAccountsApi,
+  cursorAccounts: cursorAccountsApi,
   ssh: sshApi,
   automations: automationsApi,
   e2e: e2eApi,
diff --git a/src/preload/renderer-restart-wiring.test.ts b/src/preload/renderer-restart-wiring.test.ts
index bd896109b57..ba97195a5f5 100644
--- a/src/preload/renderer-restart-wiring.test.ts
+++ b/src/preload/renderer-restart-wiring.test.ts
@@ -1,38 +1,140 @@
 import { describe, expect, it, vi } from 'vitest'
+import { EventEmitter } from 'node:events'
 import { ORCA_RENDERER_UNLOAD_PREVENTED_EVENT } from '../shared/renderer-shutdown-events'
 import {
   ORCA_APP_RESTART_ABORTED_EVENT,
+  ORCA_APP_RESTART_STARTED_EVENT,
   ORCA_UPDATER_QUIT_AND_INSTALL_STARTED_EVENT
 } from '../shared/updater-renderer-events'
 import {
+  prepareAndInvokeAppRestart,
   prepareAndInvokeUpdaterInstall,
   registerRendererRestartIpcRelays
 } from './renderer-restart-wiring'
 
+function restartIpc(eventTarget: EventTarget) {
+  const ipcRenderer = Object.assign(new EventEmitter(), {
+    invoke: vi.fn(async () => {}),
+    postMessage: vi.fn(),
+    send: vi.fn(),
+    sendSync: vi.fn(),
+    sendToHost: vi.fn()
+  })
+  const relay = { handleStatus: vi.fn(), abort: vi.fn() }
+  registerRendererRestartIpcRelays(ipcRenderer, eventTarget, relay)
+  return { ipcRenderer, ...relay }
+}
+
 describe('renderer restart wiring', () => {
+  it.each(['no-op', 'failure'] as const)(
+    'keeps a committed restart prepared after a later %s',
+    async (outcome) => {
+      const eventTarget = new EventTarget()
+      const { ipcRenderer } = restartIpc(eventTarget)
+      const aborted = vi.fn()
+      const started = vi.fn()
+      const checkpoint = vi.fn(async () => {})
+      eventTarget.addEventListener(ORCA_APP_RESTART_ABORTED_EVENT, aborted)
+      eventTarget.addEventListener(ORCA_APP_RESTART_STARTED_EVENT, started)
+      await prepareAndInvokeAppRestart(
+        eventTarget,
+        async () => {
+          ipcRenderer.emit('app:restart-committed')
+          return true
+        },
+        checkpoint,
+        Boolean
+      )
+      const subsequent = prepareAndInvokeAppRestart(
+        eventTarget,
+        async () => {
+          if (outcome === 'failure') {
+            throw new Error('already finalized')
+          }
+          return false
+        },
+        checkpoint,
+        Boolean
+      )
+      await (outcome === 'failure'
+        ? expect(subsequent).rejects.toThrow('already finalized')
+        : expect(subsequent).resolves.toBe(false))
+      expect(checkpoint).toHaveBeenCalledOnce()
+      expect(started).toHaveBeenCalledOnce()
+      expect(aborted).not.toHaveBeenCalled()
+    }
+  )
+
+  it('refuses overlapping preparation without abandoning the accepted restart', async () => {
+    const eventTarget = new EventTarget()
+    const aborted = vi.fn()
+    eventTarget.addEventListener(ORCA_APP_RESTART_ABORTED_EVENT, aborted)
+    const checkpoint = Promise.withResolvers<void>()
+    const invoke = vi.fn(async () => true)
+    const first = prepareAndInvokeAppRestart(eventTarget, invoke, () => checkpoint.promise)
+    const refused = vi.fn(async () => false)
+    await expect(
+      prepareAndInvokeAppRestart(eventTarget, refused, async () => {}, Boolean)
+    ).rejects.toThrow('already in progress')
+    expect(refused).not.toHaveBeenCalled()
+    expect(aborted).not.toHaveBeenCalled()
+    checkpoint.resolve()
+    await expect(first).resolves.toBe(true)
+    expect(invoke).toHaveBeenCalledOnce()
+  })
+
+  it('retains late commitment across an unrelated unload veto', async () => {
+    const eventTarget = new EventTarget()
+    const abandoned = vi.fn()
+    eventTarget.addEventListener(ORCA_APP_RESTART_ABORTED_EVENT, abandoned)
+    eventTarget.addEventListener(ORCA_RENDERER_UNLOAD_PREVENTED_EVENT, abandoned)
+    const { ipcRenderer } = restartIpc(eventTarget)
+    const checkpoint = vi.fn(async () => {})
+    await prepareAndInvokeAppRestart(eventTarget, async () => true, checkpoint, Boolean)
+    ipcRenderer.emit('app:restart-committed')
+    await prepareAndInvokeAppRestart(eventTarget, async () => false, checkpoint, Boolean)
+    expect(checkpoint).toHaveBeenCalledOnce()
+    ipcRenderer.emit('window:unload-prevented')
+    await prepareAndInvokeAppRestart(eventTarget, async () => true, checkpoint, Boolean)
+    expect(checkpoint).toHaveBeenCalledOnce()
+    expect(abandoned).not.toHaveBeenCalled()
+  })
+
+  it('releases preparation ownership and its listener after checkpoint failure', async () => {
+    const eventTarget = new EventTarget()
+    const add = vi.spyOn(eventTarget, 'addEventListener')
+    const remove = vi.spyOn(eventTarget, 'removeEventListener')
+    await expect(
+      prepareAndInvokeAppRestart(
+        eventTarget,
+        async () => {},
+        async () => {
+          throw new Error('checkpoint failed')
+        }
+      )
+    ).rejects.toThrow('checkpoint failed')
+    await prepareAndInvokeAppRestart(
+      eventTarget,
+      async () => {},
+      async () => {}
+    )
+    expect(add.mock.calls).toHaveLength(2)
+    expect(remove.mock.calls).toEqual(add.mock.calls)
+  })
+
   it('relays updater status, aborted installs, and prevented unload events', () => {
     const eventTarget = new EventTarget()
     const unloadPrevented = vi.fn()
     const restartAborted = vi.fn()
-    const handleStatus = vi.fn()
-    const abort = vi.fn()
-    const listeners = new Map<string, (...args: unknown[]) => void>()
-    const ipcRenderer = {
-      on: vi.fn((channel: string, listener: (...args: unknown[]) => void) => {
-        listeners.set(channel, listener)
-        return ipcRenderer
-      })
-    } as unknown as Parameters<typeof registerRendererRestartIpcRelays>[0]
+    const { ipcRenderer, handleStatus, abort } = restartIpc(eventTarget)
     eventTarget.addEventListener(ORCA_RENDERER_UNLOAD_PREVENTED_EVENT, unloadPrevented)
     eventTarget.addEventListener(ORCA_APP_RESTART_ABORTED_EVENT, restartAborted)
-
-    registerRendererRestartIpcRelays(ipcRenderer, eventTarget, { handleStatus, abort })
-    listeners.get('updater:status')?.({}, { state: 'error', message: 'install failed' })
+    ipcRenderer.emit('updater:status', {}, { state: 'error', message: 'install failed' })
     // Why: main abandons an install without any status when its verdict outlived the cycle.
-    listeners.get('updater:quitAndInstallAborted')?.({})
-    listeners.get('window:unload-prevented')?.({})
+    ipcRenderer.emit('updater:quitAndInstallAborted')
+    ipcRenderer.emit('window:unload-prevented')
 
-    expect(ipcRenderer.on).toHaveBeenCalledTimes(3)
+    expect(ipcRenderer.eventNames()).toHaveLength(4)
     expect(handleStatus).toHaveBeenCalledWith({ state: 'error', message: 'install failed' })
     expect(abort).toHaveBeenCalledTimes(1)
     expect(unloadPrevented).toHaveBeenCalledTimes(1)
diff --git a/src/preload/renderer-restart-wiring.ts b/src/preload/renderer-restart-wiring.ts
index 2dd0ad316aa..38ea1882b9f 100644
--- a/src/preload/renderer-restart-wiring.ts
+++ b/src/preload/renderer-restart-wiring.ts
@@ -12,6 +12,18 @@ import {
   ORCA_UPDATER_QUIT_AND_INSTALL_STARTED_EVENT
 } from '../shared/updater-renderer-events'
 
+type AppRestartState = { committed: boolean; pending: boolean }
+const appRestartStates = new WeakMap<EventTarget, AppRestartState>()
+
+function appRestartState(eventTarget: EventTarget): AppRestartState {
+  let state = appRestartStates.get(eventTarget)
+  if (!state) {
+    state = { committed: false, pending: false }
+    appRestartStates.set(eventTarget, state)
+  }
+  return state
+}
+
 export function registerRendererRestartIpcRelays(
   ipcRenderer: Pick<IpcRenderer, 'on'>,
   eventTarget: EventTarget,
@@ -24,7 +36,14 @@ export function registerRendererRestartIpcRelays(
   ipcRenderer.on('updater:quitAndInstallAborted', () => {
     relay.abort()
   })
+  ipcRenderer.on('app:restart-committed', () => {
+    appRestartState(eventTarget).committed = true
+  })
   ipcRenderer.on('window:unload-prevented', () => {
+    // A quit veto cannot reopen a profile whose maintenance has already committed.
+    if (appRestartState(eventTarget).committed) {
+      return
+    }
     eventTarget.dispatchEvent(new Event(ORCA_RENDERER_UNLOAD_PREVENTED_EVENT))
     eventTarget.dispatchEvent(new Event(ORCA_APP_RESTART_ABORTED_EVENT))
   })
@@ -50,20 +69,39 @@ export async function prepareAndInvokeUpdaterInstall(
   }
 }
 
-export async function prepareAndInvokeAppRestart(
+export async function prepareAndInvokeAppRestart<T>(
   eventTarget: EventTarget,
-  invoke: () => Promise<unknown>,
-  awaitCheckpoint: () => Promise<void>
-): Promise<void> {
-  await prepareRendererForAppRestart(eventTarget, {
-    startedEventName: ORCA_APP_RESTART_STARTED_EVENT,
-    abortedEventName: ORCA_APP_RESTART_ABORTED_EVENT,
-    awaitCheckpoint
-  })
+  invoke: () => Promise<T>,
+  awaitCheckpoint: () => Promise<void>,
+  willRestart: (result: T) => boolean = () => true
+): Promise<T> {
+  const state = appRestartState(eventTarget)
+  if (state.pending) {
+    throw new Error('App restart preparation is already in progress')
+  }
+  state.pending = true
   try {
-    await invoke()
-  } catch (error) {
-    eventTarget.dispatchEvent(new Event(ORCA_APP_RESTART_ABORTED_EVENT))
-    throw error
+    if (!state.committed) {
+      await prepareRendererForAppRestart(eventTarget, {
+        startedEventName: ORCA_APP_RESTART_STARTED_EVENT,
+        abortedEventName: ORCA_APP_RESTART_ABORTED_EVENT,
+        awaitCheckpoint
+      })
+    }
+    try {
+      const result = await invoke()
+      if (!state.committed && !willRestart(result)) {
+        eventTarget.dispatchEvent(new Event(ORCA_APP_RESTART_ABORTED_EVENT))
+      }
+      return result
+    } catch (error) {
+      // A failed profile move can require recovery after its writer has already closed.
+      if (!state.committed) {
+        eventTarget.dispatchEvent(new Event(ORCA_APP_RESTART_ABORTED_EVENT))
+      }
+      throw error
+    }
+  } finally {
+    state.pending = false
   }
 }
diff --git a/src/relay/agent-exec-handler.test.ts b/src/relay/agent-exec-handler.test.ts
index 42a79469d42..87a2ef0403b 100644
--- a/src/relay/agent-exec-handler.test.ts
+++ b/src/relay/agent-exec-handler.test.ts
@@ -36,6 +36,7 @@ describe('AgentExecHandler', () => {
   })
 
   afterEach(() => {
+    vi.unstubAllEnvs()
     for (const [key, value] of Object.entries(ambientGuardEnv)) {
       if (value !== undefined) {
         process.env[key] = value
@@ -84,6 +85,7 @@ describe('AgentExecHandler', () => {
   })
 
   it('merges caller-supplied provider environment into the spawned command environment', async () => {
+    vi.stubEnv('ORCA_EXEC_INHERITED', 'inherited-value')
     const child = createFakeChild()
     spawnMock.mockReturnValue(child as never)
     const handlers = createHandlers()
@@ -112,7 +114,7 @@ describe('AgentExecHandler', () => {
     expect(spawnMock).toHaveBeenCalledWith('codex', ['exec'], {
       cwd: '/repo',
       env: expect.objectContaining({
-        ...process.env,
+        ORCA_EXEC_INHERITED: 'inherited-value',
         CODEX_HOME: '/managed/codex-home',
         PATH: '/managed/bin'
       }),
@@ -121,6 +123,59 @@ describe('AgentExecHandler', () => {
     })
   })
 
+  it('honors Windows override casing while replacing indexed Git configuration', async () => {
+    const child = createFakeChild()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This fixture supplies every child event and stream used by the handler.
+    spawnMock.mockReturnValue(child as never)
+    const originalPlatform = process.platform
+    const originalPath = process.env.PATH
+    process.env.PATH = 'inherited-path'
+    process.env.GIT_CONFIG_COUNT = '2'
+    process.env.GIT_CONFIG_KEY_1 = 'stale.key'
+    process.env.GIT_CONFIG_VALUE_1 = 'stale-value'
+    try {
+      Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+      const handlers = createHandlers()
+      const pending = handlers.get('agent.execNonInteractive')!(
+        {
+          binary: 'agent.exe',
+          args: [],
+          env: {
+            Path: 'override-path',
+            token: 'override-token',
+            git_config_count: '1',
+            git_config_key_0: 'http.proxy',
+            git_config_value_0: 'proxy-value'
+          }
+        },
+        requestContext()
+      )
+      child.emit('close', 0)
+      await expect(pending).resolves.toMatchObject({ exitCode: 0 })
+      const env = spawnMock.mock.calls[0][2]?.env
+      expect(env).toMatchObject({
+        PATH: 'override-path',
+        TOKEN: 'override-token',
+        GIT_CONFIG_KEY_0: 'http.proxy',
+        GIT_CONFIG_VALUE_0: 'proxy-value'
+      })
+      expect(env).not.toHaveProperty('Path')
+      expect(env).not.toHaveProperty('git_config_count')
+      expect(Object.values(env ?? {})).not.toContain('stale.key')
+      expect(Object.values(env ?? {})).not.toContain('stale-value')
+    } finally {
+      Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
+      if (originalPath === undefined) {
+        delete process.env.PATH
+      } else {
+        process.env.PATH = originalPath
+      }
+      delete process.env.GIT_CONFIG_COUNT
+      delete process.env.GIT_CONFIG_KEY_1
+      delete process.env.GIT_CONFIG_VALUE_1
+    }
+  })
+
   it('consumes an unattended marker and applies the full Git guard on the relay host', async () => {
     const child = createFakeChild()
     spawnMock.mockReturnValue(child as never)
diff --git a/src/relay/agent-exec-handler.ts b/src/relay/agent-exec-handler.ts
index a82791dcf45..152e8bd72fb 100644
--- a/src/relay/agent-exec-handler.ts
+++ b/src/relay/agent-exec-handler.ts
@@ -1,3 +1,4 @@
+import { mergeCommandEnvironment } from '../shared/command-environment'
 import { spawn, type ChildProcess } from 'node:child_process'
 import { existsSync } from 'node:fs'
 import { delimiter, join } from 'node:path'
@@ -148,10 +149,17 @@ export class AgentExecHandler {
       params.env && typeof params.env === 'object' && !Array.isArray(params.env)
         ? (params.env as Record<string, string>)
         : null
-    const spawnEnv = mergeGitConfigEnvProtocol(process.env, extraEnv ?? undefined) as Record<
-      string,
-      string
-    >
+    const baseEnv = mergeCommandEnvironment(
+      process.env,
+      extraEnv ? {} : undefined,
+      process.platform
+    )
+    const overrides = mergeCommandEnvironment({}, extraEnv ?? undefined, process.platform)
+    const spawnEnv = Object.fromEntries(
+      Object.entries(mergeGitConfigEnvProtocol(baseEnv ?? process.env, overrides)).filter(
+        (entry): entry is [string, string] => typeof entry[1] === 'string'
+      )
+    )
     // Why: this RPC has no interactive terminal, regardless of which wrapper
     // launches the agent or hook command.
     applyTerminalGitCredentialPromptGuard(spawnEnv, {
diff --git a/src/relay/agent-hook-integration.test.ts b/src/relay/agent-hook-integration.test.ts
index b5a0f1066e4..7e5b21365e1 100644
--- a/src/relay/agent-hook-integration.test.ts
+++ b/src/relay/agent-hook-integration.test.ts
@@ -168,6 +168,77 @@ describe('Integration: relay hook server → mux → AgentHookServer.ingestRemot
     expect(payload.agentType).toBe(agent)
   })
 
+  it.each([0, 1, 2, 3])(
+    'delivers Cursor form payloads with %i BOMs to the host-owned status store',
+    async (count) => {
+      const { port, token } = hookServer.getCoordinates()
+      for (const [hookEventName, state] of [
+        ['beforeSubmitPrompt', 'working'],
+        ['stop', 'done']
+      ]) {
+        const payload = Buffer.concat([
+          ...Array.from({ length: count }, () => Buffer.from([0xef, 0xbb, 0xbf])),
+          Buffer.from(
+            JSON.stringify({
+              hook_event_name: hookEventName,
+              prompt: 'Synthetic café 😀',
+              status: 'completed'
+            })
+          )
+        ])
+        const response = await fetch(`http://127.0.0.1:${port}/hook/cursor`, {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            'X-Orca-Agent-Hook-Token': token
+          },
+          body: new URLSearchParams({
+            paneKey: `tab-7:${LEAF_7}`,
+            worktreeId: 'folder:synthetic-cursor',
+            payload: payload.toString('utf8')
+          }).toString()
+        })
+        expect(response.status).toBe(204)
+        await expect
+          .poll(() => orcaServer.getStatusSnapshot())
+          .toEqual([
+            expect.objectContaining({
+              paneKey: `tab-7:${LEAF_7}`,
+              worktreeId: 'folder:synthetic-cursor',
+              connectionId: 'conn-test',
+              state,
+              agentType: 'cursor',
+              prompt: 'Synthetic café 😀'
+            })
+          ])
+      }
+    }
+  )
+
+  it('acknowledges malformed Cursor form payloads without publishing status', async () => {
+    const { port, token } = hookServer.getCoordinates()
+    for (const payload of [
+      '',
+      '\uFEFF\uFEFFnot json',
+      ' \uFEFF{}',
+      '{\uFEFF"hook_event_name":"stop"}',
+      '\uFEFF\uFEFF{"hook_event_name":"unknown"}'
+    ]) {
+      const response = await fetch(`http://127.0.0.1:${port}/hook/cursor`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          'X-Orca-Agent-Hook-Token': token
+        },
+        body: new URLSearchParams({ paneKey: `tab-7:${LEAF_7}`, payload }).toString()
+      })
+      expect(response.status).toBe(204)
+    }
+    await new Promise((resolve) => setImmediate(resolve))
+    expect(hookServer.replayCachedPayloadsForPanes()).toBe(0)
+    expect(orcaServer.getStatusSnapshot()).toEqual([])
+  })
+
   it('sheds an oversized assistant message through the production publication path', async () => {
     const events: { payload: { state: string; lastAssistantMessage?: string } }[] = []
     orcaServer.setListener((event) => {
diff --git a/src/relay/agent-workspace-trust-spawn-guard-failure.test.ts b/src/relay/agent-workspace-trust-spawn-guard-failure.test.ts
new file mode 100644
index 00000000000..d207da0e07b
--- /dev/null
+++ b/src/relay/agent-workspace-trust-spawn-guard-failure.test.ts
@@ -0,0 +1,23 @@
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('../shared/home-or-filesystem-root', () => ({
+  isTooBroadToPreTrust: () => {
+    throw new Error('homedir unavailable')
+  }
+}))
+
+import { applyRelayAgentWorkspaceTrust } from './agent-workspace-trust-spawn'
+
+describe('applyRelayAgentWorkspaceTrust when the breadth guard fails', () => {
+  it.each(['claude', 'copilot', 'qoder'] as const)(
+    'skips %s trust and never fails the spawn',
+    async (agent) => {
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+      await expect(
+        applyRelayAgentWorkspaceTrust({ workspacePath: '/srv/wt' }, agent, {}, { wslShell: false })
+      ).resolves.toBeUndefined()
+      expect(warn).toHaveBeenCalled()
+      warn.mockRestore()
+    }
+  )
+})
diff --git a/src/relay/agent-workspace-trust-spawn.test.ts b/src/relay/agent-workspace-trust-spawn.test.ts
new file mode 100644
index 00000000000..ca83e5a0ee1
--- /dev/null
+++ b/src/relay/agent-workspace-trust-spawn.test.ts
@@ -0,0 +1,268 @@
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync
+} from 'node:fs'
+import type * as Os from 'node:os'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentTrustPreset } from '../main/agent-trust-presets'
+import type { TuiAgent } from '../shared/tui-agent'
+import { linkGitWorktree, workspaceTrustWritten } from '../main/workspace-trust-test-fixtures'
+
+const state = vi.hoisted(() => ({ home: '' }))
+
+// Why: the non-Claude writers resolve their files from this process's home, as on a real relay.
+vi.mock('node:os', async (importOriginal) => {
+  const actual = await importOriginal<typeof Os>()
+  return { ...actual, homedir: () => state.home }
+})
+
+import { applyRelayAgentWorkspaceTrust } from './agent-workspace-trust-spawn'
+import { buildSshPtySpawnRequest } from '../main/providers/ssh-pty-spawn-request'
+
+const HOST_SHELL = { wslShell: false }
+const ORIGINAL_CLAUDE_CONFIG = '{"oauthAccount":{"x":1}}'
+const AGENTS_WITH_A_RELAY_WRITER: [TuiAgent, AgentTrustPreset][] = [
+  ['claude', 'claude'],
+  ['claude-agent-teams', 'claude'],
+  ['codex', 'codex'],
+  ['cursor', 'cursor'],
+  ['copilot', 'copilot'],
+  ['qoder', 'qoder']
+]
+const AGENTS_THAT_INHERIT_TRUST = AGENTS_WITH_A_RELAY_WRITER.filter(([, preset]) =>
+  ['claude', 'copilot', 'qoder'].includes(preset)
+)
+const ALL_PRESETS: AgentTrustPreset[] = [
+  'claude',
+  'codex',
+  'cursor',
+  'copilot',
+  'qoder',
+  'antigravity'
+]
+
+let root: string
+let home: string
+let workspace: string
+
+beforeEach(() => {
+  root = realpathSync(mkdtempSync(join(tmpdir(), 'orca-relay-agent-trust-')))
+  home = join(root, 'home', 'me')
+  mkdirSync(home, { recursive: true })
+  state.home = home
+  writeFileSync(join(home, '.claude.json'), ORIGINAL_CLAUDE_CONFIG, { mode: 0o600 })
+  workspace = join(root, 'wt')
+  mkdirSync(workspace)
+})
+
+afterEach(() => {
+  rmSync(root, { recursive: true, force: true })
+})
+
+function nothingWritten(): boolean {
+  return ALL_PRESETS.every((preset) => !workspaceTrustWritten(home, preset))
+}
+
+describe('applyRelayAgentWorkspaceTrust', () => {
+  it.each(AGENTS_WITH_A_RELAY_WRITER)(
+    "writes %s trust on the relay host's own disk",
+    async (agent, preset) => {
+      await applyRelayAgentWorkspaceTrust(
+        { workspacePath: workspace },
+        agent,
+        { HOME: home },
+        HOST_SHELL
+      )
+      expect(workspaceTrustWritten(home, preset)).toBe(true)
+    }
+  )
+
+  it("grants Claude in the remote host's own config, named by the merged spawn env", async () => {
+    const configDir = join(root, 'cfg')
+    mkdirSync(configDir)
+    writeFileSync(join(configDir, '.claude.json'), ORIGINAL_CLAUDE_CONFIG, { mode: 0o600 })
+    await applyRelayAgentWorkspaceTrust(
+      { workspacePath: workspace },
+      'claude',
+      { CLAUDE_CONFIG_DIR: configDir, HOME: home },
+      HOST_SHELL
+    )
+    expect(JSON.parse(readFileSync(join(configDir, '.claude.json'), 'utf-8'))).toEqual({
+      oauthAccount: { x: 1 },
+      projects: { [workspace]: { hasTrustDialogAccepted: true } }
+    })
+    expect(readFileSync(join(home, '.claude.json'), 'utf-8')).toBe(ORIGINAL_CLAUDE_CONFIG)
+  })
+
+  it('never creates a Claude config file Claude has not written', async () => {
+    const emptyHome = join(root, 'empty-home')
+    mkdirSync(emptyHome)
+    await applyRelayAgentWorkspaceTrust(
+      { workspacePath: workspace },
+      'claude',
+      { HOME: emptyHome },
+      HOST_SHELL
+    )
+    expect(existsSync(join(emptyHome, '.claude.json'))).toBe(false)
+  })
+
+  it('writes Codex trust into the CODEX_HOME the spawn env names', async () => {
+    const codexHome = join(root, 'codex-home')
+    await applyRelayAgentWorkspaceTrust(
+      { workspacePath: workspace },
+      'codex',
+      { HOME: home, CODEX_HOME: codexHome },
+      HOST_SHELL
+    )
+    expect(readFileSync(join(codexHome, 'config.toml'), 'utf-8')).toContain(
+      `[projects."${workspace}"]`
+    )
+    expect(workspaceTrustWritten(home, 'codex')).toBe(false)
+  })
+
+  it("trusts a worktree's main checkout for Codex, as a local launch does", async () => {
+    const mainCheckout = join(root, 'repo')
+    const worktree = join(root, 'worktrees', 'feature')
+    linkGitWorktree(mainCheckout, worktree)
+    await applyRelayAgentWorkspaceTrust(
+      { workspacePath: worktree },
+      'codex',
+      { HOME: home },
+      HOST_SHELL
+    )
+    const written = readFileSync(join(home, '.codex', 'config.toml'), 'utf-8')
+    expect(written).toContain(`[projects."${mainCheckout}"]`)
+    expect(written).not.toContain(`[projects."${worktree}"]`)
+  })
+
+  it('trusts a Codex worktree whose main checkout is the relay home, as a local launch does', async () => {
+    const worktree = join(root, 'worktrees', 'feature')
+    linkGitWorktree(home, worktree)
+    await applyRelayAgentWorkspaceTrust(
+      { workspacePath: worktree },
+      'codex',
+      { HOME: home },
+      HOST_SHELL
+    )
+    expect(readFileSync(join(home, '.codex', 'config.toml'), 'utf-8')).toContain(
+      `[projects."${home}"]`
+    )
+  })
+
+  it.each([
+    ['codex', 'codex'],
+    ['cursor', 'cursor']
+  ] as const)(
+    'trusts the relay home for %s, whose trust there covers only the home',
+    async (agent, preset) => {
+      await applyRelayAgentWorkspaceTrust(
+        { workspacePath: home },
+        agent,
+        { HOME: home },
+        HOST_SHELL
+      )
+      expect(workspaceTrustWritten(home, preset)).toBe(true)
+    }
+  )
+
+  const tooBroad: [string, () => string][] = [
+    ['the relay home', () => home],
+    ['a folder containing the relay home', () => join(root, 'home')],
+    [
+      'a symlink to the relay home',
+      () => {
+        symlinkSync(home, join(workspace, 'home-link'), 'junction')
+        return join(workspace, 'home-link')
+      }
+    ]
+  ]
+  describe.each(tooBroad)('for %s', (_label, arrange) => {
+    it.each(AGENTS_THAT_INHERIT_TRUST)('writes no %s trust', async (agent) => {
+      await applyRelayAgentWorkspaceTrust(
+        { workspacePath: arrange() },
+        agent,
+        { HOME: home },
+        HOST_SHELL
+      )
+      expect(nothingWritten()).toBe(true)
+    })
+  })
+
+  it.each(AGENTS_WITH_A_RELAY_WRITER)(
+    "never writes this host's files for %s started in a WSL guest",
+    async (agent) => {
+      await applyRelayAgentWorkspaceTrust(
+        { workspacePath: workspace },
+        agent,
+        { HOME: home },
+        { wslShell: true }
+      )
+      expect(nothingWritten()).toBe(true)
+    }
+  )
+
+  it('leaves Antigravity to ask, since its writer is unverified on SSH hosts', async () => {
+    await applyRelayAgentWorkspaceTrust(
+      { workspacePath: workspace },
+      'antigravity',
+      { HOME: home },
+      HOST_SHELL
+    )
+    expect(workspaceTrustWritten(home, 'antigravity')).toBe(false)
+  })
+
+  it.each([
+    ['no request', () => undefined, 'claude'],
+    ['a malformed request', () => ({ workspacePath: 42 }), 'claude'],
+    ['an earlier-shaped request', () => ({ worktreeRoot: workspace, trusted: true }), 'codex'],
+    ['an agent with no trust preset', () => ({ workspacePath: workspace }), 'gemini'],
+    ['no declared agent', () => ({ workspacePath: workspace }), undefined]
+  ] as const)('writes nothing, so the agent asks, for %s', async (_label, request, agent) => {
+    await applyRelayAgentWorkspaceTrust(request(), agent, { HOME: home }, HOST_SHELL)
+    expect(nothingWritten()).toBe(true)
+  })
+
+  it('never fails the spawn when a writer throws', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const codexHome = join(root, 'codex-home')
+    // Why: a config.toml that cannot be read as a file makes the Codex writer throw.
+    mkdirSync(join(codexHome, 'config.toml'), { recursive: true })
+    await expect(
+      applyRelayAgentWorkspaceTrust(
+        { workspacePath: workspace },
+        'codex',
+        { HOME: home, CODEX_HOME: codexHome },
+        HOST_SHELL
+      )
+    ).resolves.toBeUndefined()
+    expect(warn).toHaveBeenCalled()
+    warn.mockRestore()
+  })
+})
+
+describe('buildSshPtySpawnRequest', () => {
+  it('forwards the workspace to trust as an optional field an old relay ignores', () => {
+    const request = buildSshPtySpawnRequest({
+      options: {
+        cols: 80,
+        rows: 24,
+        launchAgent: 'codex',
+        agentWorkspaceTrust: { workspacePath: '/w' }
+      },
+      supportsCreateOperation: false
+    })
+    expect(request.agentWorkspaceTrust).toEqual({ workspacePath: '/w' })
+    expect(request.launchAgent).toBe('codex')
+    expect(
+      buildSshPtySpawnRequest({ options: { cols: 80, rows: 24 }, supportsCreateOperation: false })
+    ).not.toHaveProperty('agentWorkspaceTrust')
+  })
+})
diff --git a/src/relay/agent-workspace-trust-spawn.ts b/src/relay/agent-workspace-trust-spawn.ts
new file mode 100644
index 00000000000..51eaaa28485
--- /dev/null
+++ b/src/relay/agent-workspace-trust-spawn.ts
@@ -0,0 +1,47 @@
+import { existsSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import { parseAgentWorkspaceTrustSpawnRequest } from '../shared/agent-workspace-trust-spawn-request'
+import { TUI_AGENT_CONFIG } from '../shared/tui-agent-config'
+import type { TuiAgent } from '../shared/tui-agent'
+import { resolveClaudeGlobalConfigFile } from '../main/claude/claude-folder-trust-file'
+import { SHORT_AGENT_TRUST_WRITE_DEADLINE_MS } from '../main/agent-trust-write-deadline'
+import { applyWorkspaceTrustOnThisHost } from '../main/execution-host-workspace-trust'
+
+/**
+ * Why here: this host owns the files the agent reads, so each writer's lock, re-read, atomic
+ * rename and refusal rules act on local disk, with no round trip across the SSH link.
+ */
+export async function applyRelayAgentWorkspaceTrust(
+  rawRequest: unknown,
+  launchAgent: TuiAgent | undefined,
+  spawnEnv: Record<string, string | undefined>,
+  launch: { wslShell: boolean }
+): Promise<void> {
+  const request = parseAgentWorkspaceTrustSpawnRequest(rawRequest)
+  const preset = launchAgent ? TUI_AGENT_CONFIG[launchAgent].preflightTrust : undefined
+  // Why: an agent inside a WSL guest reads the guest's files, not this Windows host's, and
+  // Antigravity's writer is unverified on SSH hosts, so it still asks there.
+  if (!request || !preset || preset === 'antigravity' || launch.wslShell) {
+    return
+  }
+  await applyWorkspaceTrustOnThisHost(preset, request.workspacePath, () => {
+    const keyStyle = process.platform === 'win32' ? 'win32' : 'posix'
+    const homeDir = (keyStyle === 'win32' ? spawnEnv.USERPROFILE : spawnEnv.HOME) || homedir()
+    return {
+      homes: [homeDir, homedir()],
+      claudeConfig: () => ({
+        configFile: resolveClaudeGlobalConfigFile({
+          env: spawnEnv,
+          homeDir,
+          style: keyStyle,
+          exists: existsSync
+        }),
+        keyStyle
+      }),
+      codexConfigFiles: () => [join(spawnEnv.CODEX_HOME || join(homeDir, '.codex'), 'config.toml')],
+      // Why: every write here is on the relay's own disk, so each preset gets the local budget.
+      deadlineMs: SHORT_AGENT_TRUST_WRITE_DEADLINE_MS
+    }
+  })
+}
diff --git a/src/relay/ai-vault-handler.test.ts b/src/relay/ai-vault-handler.test.ts
index eb90958d0a2..3951b58ea5f 100644
--- a/src/relay/ai-vault-handler.test.ts
+++ b/src/relay/ai-vault-handler.test.ts
@@ -393,7 +393,10 @@ function createTestService(
   return {
     listSessions: (params, signal) =>
       scan({
-        provider: createRelayAiVaultFilesystemProvider(),
+        provider: createRelayAiVaultFilesystemProvider({
+          homeDirectory: remoteHome,
+          environment: {}
+        }),
         executionHostId: 'local',
         remoteHome,
         hostPlatform,
diff --git a/src/relay/ai-vault-opencode-reader.test.ts b/src/relay/ai-vault-opencode-reader.test.ts
new file mode 100644
index 00000000000..3d082205d5d
--- /dev/null
+++ b/src/relay/ai-vault-opencode-reader.test.ts
@@ -0,0 +1,253 @@
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { AiVaultScanIssue } from '../shared/ai-vault-types'
+import { getRemoteHostPlatform } from '../main/ssh/ssh-remote-platform'
+import { scanRemoteAiVaultSessions } from '../main/ai-vault/remote-session-scanner'
+import { resetRemoteSessionParseCacheForTests } from '../main/ai-vault/remote-session-parse-cache'
+import { listOpenCodeSqliteSessions } from '../main/ai-vault/session-scanner-opencode-sqlite-list'
+import { listOpenCode2SqliteSessions } from '../main/ai-vault/session-scanner-opencode2-sqlite-list'
+import { parseOpenCodeSqliteSession } from '../main/ai-vault/session-scanner-opencode-sqlite'
+import { parseOpenCode2SqliteSession } from '../main/ai-vault/session-scanner-opencode2-sqlite'
+import { writeOpenCodeSqliteDatabase } from '../main/ai-vault/session-scanner-opencode-sqlite-fixture'
+import { createRelayAiVaultFilesystemProvider } from './ai-vault-service-filesystem'
+import {
+  createRelayOpenCodeReader,
+  type RelayOpenCodeReaderOptions
+} from './ai-vault-opencode-reader'
+
+const directories: string[] = []
+const disposables: { dispose(): void }[] = []
+
+afterEach(async () => {
+  for (const disposable of disposables.splice(0)) {
+    disposable.dispose()
+  }
+  await Promise.all(directories.splice(0).map((path) => rm(path, { recursive: true, force: true })))
+  resetRemoteSessionParseCacheForTests()
+})
+
+async function temporaryDirectory(): Promise<string> {
+  const path = await mkdtemp(join(tmpdir(), 'orca-relay-opencode-'))
+  directories.push(path)
+  return path
+}
+
+function factory() {
+  const reader = { list: vi.fn(async () => []), parse: vi.fn(async () => null), dispose: vi.fn() }
+  return {
+    reader,
+    create: vi.fn(
+      (_options: Parameters<NonNullable<RelayOpenCodeReaderOptions['readerFactory']>>[0]) => reader
+    )
+  }
+}
+
+describe('relay OpenCode reader', () => {
+  it('coalesces a persistent reader selected by the provisioned runtime reference', async () => {
+    const baseDir = await temporaryDirectory()
+    const executable = join(baseDir, 'runtime', 'bun')
+    await writeFile(
+      join(baseDir, 'opencode-sqlite-runtime.json'),
+      JSON.stringify({ protocol: 1, executable })
+    )
+    const { reader, create } = factory()
+    const probe = vi.fn(() => false)
+    const provider = createRelayAiVaultFilesystemProvider({
+      baseDir,
+      readerFactory: create,
+      canReadSqlite: probe,
+      environment: {
+        HOME: baseDir,
+        NODE_OPTIONS: '--require=bad',
+        XDG_DATA_HOME: join(baseDir, 'data')
+      }
+    })
+    disposables.push(provider)
+    const issues: AiVaultScanIssue[] = []
+    const args = { dbPaths: [join(baseDir, 'opencode.db')], limit: 10, issues }
+    await Promise.all([provider.openCode?.list(args), provider.openCode?.list(args)])
+    expect(issues).toEqual([])
+    expect(create).toHaveBeenCalledTimes(1)
+    expect(create).toHaveBeenCalledWith(
+      expect.objectContaining({ executable, args: [join(baseDir, 'opencode-sqlite-reader.cjs')] })
+    )
+    expect(create.mock.calls[0]?.[0]?.env?.NODE_OPTIONS).toBeUndefined()
+    expect(probe).not.toHaveBeenCalled()
+    provider.dispose()
+    expect(reader.dispose).toHaveBeenCalledTimes(1)
+  })
+
+  it('reports an unavailable reader once per source and retries after provisioning', async () => {
+    const baseDir = await temporaryDirectory()
+    const { create } = factory()
+    const reader = createRelayOpenCodeReader({
+      baseDir,
+      readerFactory: create,
+      canReadSqlite: () => false
+    })
+    disposables.push(reader)
+    const issues: AiVaultScanIssue[] = []
+    const args = {
+      dbPaths: [join(baseDir, 'opencode.db'), join(baseDir, 'opencode-other.db')],
+      limit: 10,
+      issues
+    }
+    await reader.list(args)
+    expect(issues).toHaveLength(1)
+    expect(issues[0]).toMatchObject({
+      agent: 'opencode',
+      kind: 'scope',
+      message: expect.stringContaining('waiting')
+    })
+    expect(create).not.toHaveBeenCalled()
+    await writeFile(
+      join(baseDir, 'opencode-sqlite-runtime.json'),
+      JSON.stringify({ protocol: 1, executable: join(baseDir, 'bun') })
+    )
+    await reader.list({ ...args, issues: [] })
+    expect(create).toHaveBeenCalledTimes(1)
+  })
+
+  it('uses the current runtime only after a successful SQLite read probe', async () => {
+    const baseDir = await temporaryDirectory()
+    const { create } = factory()
+    const reader = createRelayOpenCodeReader({
+      baseDir,
+      readerFactory: create,
+      currentExecutable: process.execPath
+    })
+    disposables.push(reader)
+    const issues: AiVaultScanIssue[] = []
+    await reader.list({ dbPaths: [join(baseDir, 'opencode.db')], limit: 1, issues })
+    expect(issues).toEqual([])
+    expect(create).toHaveBeenCalledWith(expect.objectContaining({ executable: process.execPath }))
+  })
+
+  it('replaces the persistent reader after a repaired runtime reference changes', async () => {
+    const baseDir = await temporaryDirectory()
+    const referencePath = join(baseDir, 'opencode-sqlite-runtime.json')
+    await writeFile(
+      referencePath,
+      JSON.stringify({ protocol: 1, executable: join(baseDir, 'old-bun') })
+    )
+    const first = factory()
+    const second = factory()
+    const create = vi
+      .fn<NonNullable<RelayOpenCodeReaderOptions['readerFactory']>>()
+      .mockReturnValueOnce(first.reader)
+      .mockReturnValueOnce(second.reader)
+    const reader = createRelayOpenCodeReader({ baseDir, readerFactory: create })
+    disposables.push(reader)
+    const args = { dbPaths: [join(baseDir, 'opencode.db')], limit: 1, issues: [] }
+    await reader.list(args)
+    await writeFile(
+      referencePath,
+      JSON.stringify({ protocol: 1, executable: join(baseDir, 'repaired-bun') })
+    )
+    await reader.list(args)
+    expect(first.reader.dispose).toHaveBeenCalledOnce()
+    expect(second.reader.list).toHaveBeenCalledOnce()
+    expect(create).toHaveBeenLastCalledWith(
+      expect.objectContaining({ executable: join(baseDir, 'repaired-bun') })
+    )
+  })
+
+  it.each([
+    { protocol: 2, executable: '/runtime/bun' },
+    { protocol: 1, executable: 'bun' },
+    { protocol: 1, executable: '/runtime/bun\0bad' }
+  ])('refuses an invalid runtime reference: %j', async (reference) => {
+    const baseDir = await temporaryDirectory()
+    await writeFile(join(baseDir, 'opencode-sqlite-runtime.json'), JSON.stringify(reference))
+    const { create } = factory()
+    const reader = createRelayOpenCodeReader({
+      baseDir,
+      readerFactory: create,
+      canReadSqlite: () => true
+    })
+    disposables.push(reader)
+    const issues: AiVaultScanIssue[] = []
+    await reader.list({ dbPaths: ['opencode.db'], limit: 1, issues })
+    expect(issues).toHaveLength(1)
+    expect(create).not.toHaveBeenCalled()
+  })
+
+  it('retains the host database overrides including relative and in-memory paths', async () => {
+    const baseDir = await temporaryDirectory()
+    const data = join(baseDir, 'data')
+    const reader = createRelayOpenCodeReader({
+      baseDir,
+      environment: { XDG_DATA_HOME: data, OPENCODE_DB: 'opencode-team.db' }
+    })
+    expect(reader.dataDirectory).toBe(join(data, 'opencode'))
+    expect(reader.databasePath).toBe(join(data, 'opencode', 'opencode-team.db'))
+    expect(
+      createRelayOpenCodeReader({ environment: { OPENCODE_DB: ':memory:' } }).databasePath
+    ).toBeNull()
+  })
+
+  it('does not start a child for empty or cancelled scans', async () => {
+    const baseDir = await temporaryDirectory()
+    const { create } = factory()
+    const reader = createRelayOpenCodeReader({ baseDir, readerFactory: create })
+    disposables.push(reader)
+    await reader.list({ dbPaths: [], limit: 1, issues: [] })
+    const controller = new AbortController()
+    controller.abort()
+    await expect(
+      reader.list({ dbPaths: ['opencode.db'], limit: 1, issues: [], signal: controller.signal })
+    ).rejects.toMatchObject({ name: 'AbortError' })
+    expect(create).not.toHaveBeenCalled()
+  })
+
+  it('scans the host database and legacy JSON through the existing readers', async () => {
+    const baseDir = await temporaryDirectory()
+    const xdg = join(baseDir, 'data')
+    const dbPath = join(xdg, 'opencode', 'opencode-team.db')
+    writeOpenCodeSqliteDatabase(dbPath, [
+      { id: 'migrated', turns: [{ role: 'user', parts: ['Database prompt'] }] }
+    ])
+    const sessionDir = join(xdg, 'opencode', 'storage', 'session', 'project')
+    await mkdir(sessionDir, { recursive: true })
+    await writeFile(
+      join(sessionDir, 'migrated.json'),
+      JSON.stringify({ id: 'migrated', title: 'Stale title' })
+    )
+    await writeFile(
+      join(sessionDir, 'legacy.json'),
+      JSON.stringify({ id: 'legacy', title: 'Legacy title', directory: '/project' })
+    )
+    const readerFactory: NonNullable<RelayOpenCodeReaderOptions['readerFactory']> = () => ({
+      list: (args) =>
+        args.agent === 'opencode2'
+          ? listOpenCode2SqliteSessions(args)
+          : listOpenCodeSqliteSessions({ ...args, agent: 'opencode' }),
+      parse: async (args) =>
+        args.agent === 'opencode2'
+          ? parseOpenCode2SqliteSession(args)
+          : parseOpenCodeSqliteSession({ ...args, agent: 'opencode' }),
+      dispose() {}
+    })
+    const provider = createRelayAiVaultFilesystemProvider({
+      baseDir,
+      environment: { XDG_DATA_HOME: xdg, OPENCODE_DB: 'opencode-team.db' },
+      readerFactory
+    })
+    disposables.push(provider)
+    const result = await scanRemoteAiVaultSessions({
+      provider,
+      remoteHome: baseDir,
+      executionHostId: 'ssh:actual',
+      hostPlatform: getRemoteHostPlatform('linux-x64')
+    })
+    expect(result.issues).toEqual([])
+    expect(result.sessions.map((entry) => entry.sessionId).sort()).toEqual(['legacy', 'migrated'])
+    expect(result.sessions.find((entry) => entry.sessionId === 'migrated')).toMatchObject({
+      filePath: dbPath,
+      executionHostId: 'ssh:actual',
+      previewMessages: [expect.objectContaining({ text: 'Database prompt' })]
+    })
+  })
+})
diff --git a/src/relay/ai-vault-opencode-reader.ts b/src/relay/ai-vault-opencode-reader.ts
new file mode 100644
index 00000000000..d90f2e08cd1
--- /dev/null
+++ b/src/relay/ai-vault-opencode-reader.ts
@@ -0,0 +1,159 @@
+import { open } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { isAbsolute, join } from 'node:path'
+import type { RemoteOpenCodeSessionReader } from '../main/ai-vault/remote-session-scanner-types'
+import { throwIfAiVaultScanCancelled } from '../main/ai-vault/ai-vault-scan-cancellation'
+import { isMissingRemoteSessionPathError } from '../main/ai-vault/remote-session-file-stat'
+import { parseOpenCodeSessionFile } from '../main/ai-vault/session-scanner-opencode-parser'
+import { createOpenCodeSqliteProcessClient } from '../main/ai-vault/session-scanner-opencode-sqlite-process-client'
+import { buildRelayAiVaultServiceEnv } from '../main/ai-vault/session-scanner-service-env'
+import { resolveOpenCodeDataDirectory } from '../main/opencode/opencode-data-directory'
+import SyncDatabase from '../main/sqlite/sync-database'
+
+type Reader = Pick<RemoteOpenCodeSessionReader, 'list' | 'parse'> & { dispose(): void }
+
+export type RelayOpenCodeReaderOptions = {
+  baseDir?: string
+  environment?: NodeJS.ProcessEnv
+  homeDirectory?: string
+  currentExecutable?: string
+  readerFactory?: (options: Parameters<typeof createOpenCodeSqliteProcessClient>[0]) => Reader
+  canReadSqlite?: () => boolean
+}
+
+export function createRelayOpenCodeReader(
+  options: RelayOpenCodeReaderOptions = {}
+): RemoteOpenCodeSessionReader & { dispose(): void } {
+  const environment = options.environment ?? process.env
+  const dataDirectory = resolveOpenCodeDataDirectory(
+    environment,
+    options.homeDirectory ?? homedir()
+  )
+  const override = environment.OPENCODE_DB?.trim()
+  const baseDir = options.baseDir ?? __dirname
+  let reader: Reader | undefined
+  let executable: string | undefined
+  let pending: Promise<Reader> | undefined
+  let disposed = false
+  const getReader = (refreshRuntime = false): Promise<Reader> => {
+    if (disposed) {
+      return Promise.reject(new Error('OpenCode database reader was disposed.'))
+    }
+    if (reader && !refreshRuntime) {
+      return Promise.resolve(reader)
+    }
+    pending ??= (async () => {
+      const configured = await readRuntimeExecutable(join(baseDir, 'opencode-sqlite-runtime.json'))
+      if (!configured && !(options.canReadSqlite ?? canCurrentRuntimeReadSqlite)()) {
+        throw new Error('OpenCode history is waiting for its database reader on this host.')
+      }
+      if (disposed) {
+        throw new Error('OpenCode database reader was disposed.')
+      }
+      const nextExecutable = configured ?? options.currentExecutable ?? process.execPath
+      if (!reader || executable !== nextExecutable) {
+        reader?.dispose()
+        reader = (options.readerFactory ?? createOpenCodeSqliteProcessClient)({
+          executable: nextExecutable,
+          args: [join(baseDir, 'opencode-sqlite-reader.cjs')],
+          env: buildRelayAiVaultServiceEnv(environment)
+        })
+        executable = nextExecutable
+      }
+      return reader
+    })().finally(() => {
+      pending = undefined
+    })
+    return pending
+  }
+  return {
+    dataDirectory,
+    ...(override
+      ? {
+          databasePath:
+            override === ':memory:'
+              ? null
+              : isAbsolute(override)
+                ? override
+                : join(dataDirectory, override)
+        }
+      : {}),
+    async list(args) {
+      throwIfAiVaultScanCancelled(args.signal)
+      if (args.dbPaths.length === 0) {
+        return []
+      }
+      try {
+        return await (await getReader(true)).list(args)
+      } catch (error) {
+        throwIfAiVaultScanCancelled(args.signal)
+        args.issues.push({
+          agent: args.agent ?? 'opencode',
+          kind: 'scope',
+          path: args.dbPaths[0] ?? dataDirectory,
+          message: error instanceof Error ? error.message : String(error)
+        })
+        return []
+      }
+    },
+    async parse(args) {
+      throwIfAiVaultScanCancelled(args.signal)
+      return (await getReader()).parse(args)
+    },
+    parseLegacy: parseOpenCodeSessionFile,
+    dispose() {
+      if (disposed) {
+        return
+      }
+      disposed = true
+      reader?.dispose()
+    }
+  }
+}
+
+async function readRuntimeExecutable(path: string): Promise<string | undefined> {
+  let file
+  try {
+    file = await open(path, 'r')
+  } catch (error) {
+    if (isMissingRemoteSessionPathError(error)) {
+      return undefined
+    }
+    throw error
+  }
+  try {
+    const bytes = Buffer.alloc(16_385)
+    const { bytesRead } = await file.read(bytes, 0, bytes.length, 0)
+    if (bytesRead > 16_384) {
+      throw new Error('OpenCode database runtime reference exceeds its size limit.')
+    }
+    const reference: unknown = JSON.parse(bytes.subarray(0, bytesRead).toString('utf8'))
+    if (
+      typeof reference !== 'object' ||
+      reference === null ||
+      !('protocol' in reference) ||
+      reference.protocol !== 1 ||
+      !('executable' in reference) ||
+      typeof reference.executable !== 'string' ||
+      !isAbsolute(reference.executable) ||
+      reference.executable.includes('\0')
+    ) {
+      throw new Error('OpenCode database runtime reference is invalid.')
+    }
+    return reference.executable
+  } finally {
+    await file.close()
+  }
+}
+
+function canCurrentRuntimeReadSqlite(): boolean {
+  let db: SyncDatabase | undefined
+  try {
+    db = new SyncDatabase(':memory:')
+    return db.prepare('SELECT 1 AS ready').get()?.ready === 1
+  } catch {
+    return false
+  } finally {
+    db?.close()
+  }
+}
diff --git a/src/relay/ai-vault-service-client-state.ts b/src/relay/ai-vault-service-client-state.ts
index de623d19b07..11cab3763d7 100644
--- a/src/relay/ai-vault-service-client-state.ts
+++ b/src/relay/ai-vault-service-client-state.ts
@@ -28,6 +28,18 @@ export function relayAiVaultError(error: unknown): Error {
   return error instanceof Error ? error : new Error(String(error))
 }
 
+export function armRelayAiVaultCallTimeout(
+  call: RelayAiVaultServiceCall,
+  onExpired: (timeout: number) => void
+): void {
+  const timeout =
+    call.request.operation === 'list'
+      ? RELAY_AI_VAULT_SCAN_TIMEOUT_MS
+      : RELAY_AI_VAULT_TITLE_TIMEOUT_MS
+  call.timer = setTimeout(() => onExpired(timeout), timeout)
+  call.timer.unref?.()
+}
+
 export function armRelayAiVaultCancellationTimeout(
   call: RelayAiVaultServiceCall,
   onExpired: () => void
@@ -53,7 +65,8 @@ export function createRelayAiVaultServiceCall(args: {
     onAbort: null,
     settled: false,
     sent: false,
-    startRetried: false
+    startRetried: false,
+    startAttempt: 0
   }
 }
 
@@ -110,6 +123,7 @@ export type RelayAiVaultServiceCall = {
   /** Whether the sidecar received the request; an unsent call gets no reply. */
   sent: boolean
   startRetried: boolean
+  startAttempt: number
 }
 
 export type RelayAiVaultServiceApi = {
diff --git a/src/relay/ai-vault-service-client.ts b/src/relay/ai-vault-service-client.ts
index c873c380506..9197bce1080 100644
--- a/src/relay/ai-vault-service-client.ts
+++ b/src/relay/ai-vault-service-client.ts
@@ -1,4 +1,5 @@
 import type { ChildProcess } from 'node:child_process'
+import { PromiseSettlementWaiters } from '../shared/promise-settlement-waiters'
 import type { AiVaultListResult } from '../shared/ai-vault-types'
 import type {
   AiVaultSessionTitleRequest,
@@ -9,8 +10,7 @@ import {
   RELAY_AI_VAULT_MAX_CALLS,
   RELAY_AI_VAULT_IDLE_TIMEOUT_MS,
   RELAY_AI_VAULT_READY_TIMEOUT_MS,
-  RELAY_AI_VAULT_SCAN_TIMEOUT_MS,
-  RELAY_AI_VAULT_TITLE_TIMEOUT_MS,
+  armRelayAiVaultCallTimeout,
   armRelayAiVaultCancellationTimeout,
   createRelayAiVaultServiceCall,
   relayAiVaultAbortError,
@@ -37,7 +37,7 @@ import { relayLogLine } from './relay-diagnostic-log'
 
 export class RelayAiVaultServiceClient implements RelayAiVaultServiceApi {
   private child: ChildProcess | null = null
-  private ready: Promise<ChildProcess> | null = null
+  private ready: PromiseSettlementWaiters<ChildProcess> | null = null
   private readyReject: ((error: Error) => void) | null = null
   private readyTimer: NodeJS.Timeout | null = null
   private readonly active = new Map<RelayAiVaultServiceLane, RelayAiVaultServiceCall>()
@@ -74,6 +74,9 @@ export class RelayAiVaultServiceClient implements RelayAiVaultServiceApi {
     this.clearReadyTimer()
     this.restartPolicy.dispose()
     const error = new Error('Relay AI Vault service was disposed.')
+    this.readyReject?.(error)
+    this.readyReject = null
+    this.ready = null
     for (const call of [...this.active.values(), ...this.queue.splice(0)]) {
       settleRelayAiVaultServiceCall(call, error)
     }
@@ -128,17 +131,22 @@ export class RelayAiVaultServiceClient implements RelayAiVaultServiceApi {
       }
       const call = this.queue.splice(index, 1)[0]!
       this.active.set(lane, call)
-      void this.ensureChild(call.forceStart).then(
-        (child) => this.sendCall(child, call),
-        (error: Error) => {
-          if (this.active.get(lane) !== call) {
+      const attempt = ++call.startAttempt
+      const readiness = this.ensureChild(call.forceStart)
+      void readiness
+        .wait({
+          signal: call.signal,
+          createAbortError: relayAiVaultAbortError,
+          onFulfilled: (child) => this.sendCall(child, call)
+        })
+        .catch((error: Error) => {
+          if (this.active.get(lane) !== call || call.startAttempt !== attempt) {
             return
           }
           this.active.delete(lane)
           this.retryStartOrSettle(call, error)
           this.pump()
-        }
-      )
+        })
     }
     this.scheduleIdleIfNeeded()
   }
@@ -147,15 +155,9 @@ export class RelayAiVaultServiceClient implements RelayAiVaultServiceApi {
     if (this.active.get(call.lane) !== call || call.settled) {
       return
     }
-    const timeout =
-      call.request.operation === 'list'
-        ? RELAY_AI_VAULT_SCAN_TIMEOUT_MS
-        : RELAY_AI_VAULT_TITLE_TIMEOUT_MS
-    call.timer = setTimeout(
-      () => this.onFault(new Error(`Relay AI Vault service timed out after ${timeout}ms.`)),
-      timeout
+    armRelayAiVaultCallTimeout(call, (timeout) =>
+      this.onFault(new Error(`Relay AI Vault service timed out after ${timeout}ms.`))
     )
-    call.timer.unref?.()
     call.sent = true
     child.send(call.request)
   }
@@ -166,44 +168,46 @@ export class RelayAiVaultServiceClient implements RelayAiVaultServiceApi {
     }
   }
 
-  private ensureChild(forceStart: boolean): Promise<ChildProcess> {
+  private ensureChild(forceStart: boolean): PromiseSettlementWaiters<ChildProcess> {
     if (this.child && !this.ready) {
-      return Promise.resolve(this.child)
+      return new PromiseSettlementWaiters(Promise.resolve(this.child))
     }
     if (this.ready) {
       return this.ready
     }
     const startError = this.restartPolicy.startError(forceStart)
     if (startError) {
-      return Promise.reject(startError)
+      return new PromiseSettlementWaiters(Promise.reject(startError))
     }
     let child: ChildProcess
     try {
       child = this.options.processFactory()
     } catch (error) {
-      return Promise.reject(relayAiVaultError(error))
+      return new PromiseSettlementWaiters(Promise.reject(relayAiVaultError(error)))
     }
     this.child = child
-    this.ready = new Promise<ChildProcess>((resolve, reject) => {
-      this.readyReject = reject
-      // Why: held on the instance so a crash before ready cannot leave the deadline
-      // armed, where it would later fault the healthy replacement sidecar.
-      this.readyTimer = setTimeout(
-        () => this.onFault(new Error('Relay AI Vault service did not become ready.')),
-        RELAY_AI_VAULT_READY_TIMEOUT_MS
-      )
-      this.readyTimer.unref?.()
-      child.on('message', (message) => {
-        if (isRelayAiVaultServiceChildMessage(message) && message.type === 'ready') {
-          this.clearReadyTimer()
-          this.ready = null
-          this.readyReject = null
-          resolve(child)
-          return
-        }
-        this.onMessage(message)
+    this.ready = new PromiseSettlementWaiters(
+      new Promise<ChildProcess>((resolve, reject) => {
+        this.readyReject = reject
+        // Why: held on the instance so a crash before ready cannot leave the deadline
+        // armed, where it would later fault the healthy replacement sidecar.
+        this.readyTimer = setTimeout(
+          () => this.onFault(new Error('Relay AI Vault service did not become ready.')),
+          RELAY_AI_VAULT_READY_TIMEOUT_MS
+        )
+        this.readyTimer.unref?.()
+        child.on('message', (message) => {
+          if (isRelayAiVaultServiceChildMessage(message) && message.type === 'ready') {
+            this.clearReadyTimer()
+            this.ready = null
+            this.readyReject = null
+            resolve(child)
+            return
+          }
+          this.onMessage(message)
+        })
       })
-    })
+    )
     child.on('error', (error) => this.onFault(error))
     child.on('disconnect', () => this.onFault(new Error('Relay AI Vault service disconnected.')))
     child.on('exit', (code) => this.onFault(new Error(`Relay AI Vault service exited (${code}).`)))
diff --git a/src/relay/ai-vault-service-entry.ts b/src/relay/ai-vault-service-entry.ts
index 9bd3ea35786..3f0a2b02aaf 100644
--- a/src/relay/ai-vault-service-entry.ts
+++ b/src/relay/ai-vault-service-entry.ts
@@ -19,7 +19,7 @@ if (!process.send) {
 const controllers = new Map<number, AbortController>()
 const cancelled = new Set<number>()
 const pending = new Set<number>()
-const provider = createRelayAiVaultFilesystemProvider()
+let provider: ReturnType<typeof createRelayAiVaultFilesystemProvider> | null = null
 let init: RelayAiVaultServiceInit | null = null
 let cacheLane = Promise.resolve()
 let interactiveLane = Promise.resolve()
@@ -36,7 +36,7 @@ async function execute(request: RelayAiVaultServiceRequest): Promise<void> {
     controller.abort()
   }
   try {
-    if (!init) {
+    if (!init || !provider) {
       throw new Error('Relay AI Vault service is not initialized.')
     }
     if (request.operation === 'titles') {
@@ -79,6 +79,7 @@ async function shutdown(): Promise<void> {
     controller.abort()
   }
   await Promise.allSettled([cacheLane, interactiveLane])
+  provider?.dispose()
   process.disconnect?.()
 }
 
@@ -89,6 +90,7 @@ process.on('message', (raw: RelayAiVaultServiceParentMessage) => {
       return
     }
     init = raw
+    provider = createRelayAiVaultFilesystemProvider({ homeDirectory: raw.remoteHome })
     send({ type: 'ready', protocol: RELAY_AI_VAULT_SERVICE_PROTOCOL, pid: process.pid })
     return
   }
diff --git a/src/relay/ai-vault-service-filesystem.ts b/src/relay/ai-vault-service-filesystem.ts
index fd5ff90a755..58b1b1f2d6e 100644
--- a/src/relay/ai-vault-service-filesystem.ts
+++ b/src/relay/ai-vault-service-filesystem.ts
@@ -2,9 +2,18 @@ import { readRelayTranscriptBytes } from './ai-vault-transcript-stream'
 import { lstat, readdir } from 'node:fs/promises'
 import type { RemoteSessionFilesystemProvider } from '../main/ai-vault/remote-session-scanner-types'
 import { readRelayFileContent } from './fs-handler-file-read'
+import {
+  createRelayOpenCodeReader,
+  type RelayOpenCodeReaderOptions
+} from './ai-vault-opencode-reader'
 
-export function createRelayAiVaultFilesystemProvider(): RemoteSessionFilesystemProvider {
+export function createRelayAiVaultFilesystemProvider(
+  options: RelayOpenCodeReaderOptions = {}
+): RemoteSessionFilesystemProvider & { dispose(): void } {
+  const openCode = createRelayOpenCodeReader(options)
   return {
+    openCode,
+    dispose: () => openCode.dispose(),
     async readDir(dirPath) {
       const entries = await readdir(dirPath, { withFileTypes: true })
       return entries.map((entry) => ({
diff --git a/src/relay/ai-vault-service-ready-retention.test.ts b/src/relay/ai-vault-service-ready-retention.test.ts
new file mode 100644
index 00000000000..53f845a4e90
--- /dev/null
+++ b/src/relay/ai-vault-service-ready-retention.test.ts
@@ -0,0 +1,202 @@
+import { setImmediate } from 'node:timers/promises'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { getRemoteHostPlatform } from '../main/ssh/ssh-remote-platform'
+import {
+  AiVaultServiceTestChild,
+  readyAiVaultServiceChild
+} from '../main/ai-vault/session-scanner-service-test-child'
+import type { AiVaultSessionTitleRequest } from '../shared/ai-vault-session-title'
+import { RelayAiVaultServiceClient } from './ai-vault-service-client'
+
+function fixture() {
+  const child = new AiVaultServiceTestChild()
+  const processFactory = vi.fn(() => child.asChildProcess())
+  const client = new RelayAiVaultServiceClient({
+    processFactory,
+    init: { remoteHome: '/home/ada', hostPlatform: getRemoteHostPlatform('linux-x64') }
+  })
+  return { client, child, processFactory }
+}
+
+async function collect(): Promise<void> {
+  if (!global.gc) {
+    throw new Error('This regression requires --expose-gc')
+  }
+  for (let turn = 0; turn < 3; turn++) {
+    await setImmediate()
+    global.gc()
+  }
+}
+
+function titleRequests(): AiVaultSessionTitleRequest[] {
+  return [{ agent: 'claude', sessionId: 'session', transcriptPath: '/home/ada/session.jsonl' }]
+}
+
+beforeEach(() => vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] }))
+afterEach(() => {
+  vi.clearAllTimers()
+  vi.useRealTimers()
+})
+
+describe('AI Vault readiness ownership', () => {
+  it('releases canceled request payloads while readiness remains pending', async () => {
+    const { client, child, processFactory } = fixture()
+    const canceled = await (async () => {
+      const refs: WeakRef<AiVaultSessionTitleRequest[]>[] = []
+      for (let index = 0; index < 1000; index++) {
+        const requests = titleRequests()
+        refs.push(new WeakRef(requests))
+        const controller = new AbortController()
+        const result = client.resolveSessionTitles(requests, controller.signal)
+        controller.abort()
+        const error = await result.catch((reason: unknown) => reason)
+        if (!(error instanceof Error) || error.name !== 'AbortError') {
+          throw new Error('Canceled title request did not reject with AbortError')
+        }
+      }
+      return refs
+    })()
+    await collect()
+    expect(canceled.filter((ref) => ref.deref() !== undefined)).toHaveLength(0)
+    expect(child.sent).toHaveLength(1)
+    expect(processFactory).toHaveBeenCalledOnce()
+
+    const live = client.resolveSessionTitles(titleRequests())
+    readyAiVaultServiceChild(child)
+    await Promise.resolve()
+    expect(child.sent.at(-1)).toMatchObject({ type: 'request', id: 1001, operation: 'titles' })
+    child.emit('message', { type: 'result', id: 1001, operation: 'titles', value: { titles: [] } })
+    await expect(live).resolves.toEqual({ titles: [] })
+    const disposed = client.dispose()
+    child.emit('exit', 0)
+    await disposed
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('releases uncanceled readiness payloads when the client is disposed', async () => {
+    const { client, child } = fixture()
+    const discarded = await (async () => {
+      const requests = titleRequests()
+      const ref = new WeakRef(requests)
+      const result = client.resolveSessionTitles(requests)
+      const rejection = expect(result).rejects.toThrow('disposed')
+      const disposed = client.dispose()
+      child.emit('exit', 0)
+      await disposed
+      await rejection
+      return ref
+    })()
+    await collect()
+    expect(discarded.deref() === undefined).toBe(true)
+    expect(child.sent).toEqual([expect.objectContaining({ type: 'init' }), { type: 'shutdown' }])
+    expect(vi.getTimerCount()).toBe(0)
+    await expect(client.resolveSessionTitles([])).rejects.toThrow('disposed')
+  })
+
+  it('does not send a call canceled in the turn that readiness arrives', async () => {
+    const { client, child } = fixture()
+    const controller = new AbortController()
+    const canceled = client.resolveSessionTitles(titleRequests(), controller.signal)
+    readyAiVaultServiceChild(child)
+    controller.abort()
+    const live = client.resolveSessionTitles([])
+    await expect(canceled).rejects.toMatchObject({ name: 'AbortError' })
+    expect(child.sent).toEqual([
+      expect.objectContaining({ type: 'init' }),
+      { type: 'request', id: 2, operation: 'titles', requests: [] }
+    ])
+    child.emit('message', { type: 'result', id: 2, operation: 'titles', value: { titles: [] } })
+    await expect(live).resolves.toEqual({ titles: [] })
+    const disposed = client.dispose()
+    child.emit('exit', 0)
+    await disposed
+  })
+})
+
+it('retries an unsent lane after spawn fails while the other lane starts a child', async () => {
+  const child = new AiVaultServiceTestChild()
+  const processFactory = vi.fn(() => child.asChildProcess())
+  processFactory.mockImplementationOnce(() => {
+    throw new Error('temporary spawn failure')
+  })
+  const client = new RelayAiVaultServiceClient({
+    processFactory,
+    init: { remoteHome: '/home/ada', hostPlatform: getRemoteHostPlatform('linux-x64') }
+  })
+  const list = client.listSessions({})
+  const titles = client.resolveSessionTitles([])
+  void list.catch(() => undefined)
+  void titles.catch(() => undefined)
+  try {
+    readyAiVaultServiceChild(child)
+    await vi.waitFor(() => {
+      expect(child.sent).toContainEqual({ type: 'request', id: 1, operation: 'list', params: {} })
+    })
+    expect(processFactory).toHaveBeenCalledTimes(2)
+    expect(child.sent).toContainEqual({ type: 'request', id: 1, operation: 'list', params: {} })
+    expect(child.sent).toContainEqual({ type: 'request', id: 2, operation: 'titles', requests: [] })
+    child.emit('message', {
+      type: 'result',
+      id: 1,
+      operation: 'list',
+      value: { sessions: [], issues: [], scannedAt: '2026-09-25T00:00:00.000Z' }
+    })
+    child.emit('message', { type: 'result', id: 2, operation: 'titles', value: { titles: [] } })
+    await expect(list).resolves.toMatchObject({ sessions: [] })
+    await expect(titles).resolves.toEqual({ titles: [] })
+  } finally {
+    const disposed = client.dispose()
+    child.emit('exit', 0)
+    await disposed
+  }
+})
+
+it('ignores an earlier readiness rejection after a replacement startup begins', async () => {
+  const first = new AiVaultServiceTestChild()
+  const replacement = new AiVaultServiceTestChild()
+  const processFactory = vi.fn(() => replacement.asChildProcess())
+  processFactory.mockImplementationOnce(() => first.asChildProcess())
+  const client = new RelayAiVaultServiceClient({
+    processFactory,
+    init: { remoteHome: '/home/ada', hostPlatform: getRemoteHostPlatform('linux-x64') }
+  })
+  const list = client.listSessions({})
+  void list.catch(() => undefined)
+  try {
+    first.emit('exit', 1)
+    // Start the replacement before the old readiness rejection's microtasks run.
+    vi.advanceTimersByTime(250)
+    const titles = client.resolveSessionTitles([])
+    void titles.catch(() => undefined)
+    readyAiVaultServiceChild(replacement)
+    await setImmediate()
+
+    expect(processFactory).toHaveBeenCalledTimes(2)
+    expect(first.sent).toEqual([expect.objectContaining({ type: 'init' })])
+    expect(replacement.sent).toEqual([
+      expect.objectContaining({ type: 'init' }),
+      { type: 'request', id: 1, operation: 'list', params: {} },
+      { type: 'request', id: 2, operation: 'titles', requests: [] }
+    ])
+    replacement.emit('message', {
+      type: 'result',
+      id: 1,
+      operation: 'list',
+      value: { sessions: [], issues: [], scannedAt: '2026-09-25T00:00:00.000Z' }
+    })
+    replacement.emit('message', {
+      type: 'result',
+      id: 2,
+      operation: 'titles',
+      value: { titles: [] }
+    })
+    await expect(list).resolves.toMatchObject({ sessions: [] })
+    await expect(titles).resolves.toEqual({ titles: [] })
+    expect(processFactory).toHaveBeenCalledTimes(2)
+  } finally {
+    const disposed = client.dispose()
+    replacement.emit('exit', 0)
+    await disposed
+  }
+  expect(vi.getTimerCount()).toBe(0)
+})
diff --git a/src/relay/freebuff-status-projection.test.ts b/src/relay/freebuff-status-projection.test.ts
new file mode 100644
index 00000000000..b10214ef801
--- /dev/null
+++ b/src/relay/freebuff-status-projection.test.ts
@@ -0,0 +1,43 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { FreebuffStatusProjection } from './freebuff-status-projection'
+import { createAgentStatusOscProcessor } from '../shared/agent-status-osc'
+
+const transcript = readFileSync(
+  join(import.meta.dirname, '../main/runtime/__fixtures__/freebuff-lifecycle.txt'),
+  'utf8'
+)
+
+describe('Freebuff relay status projection', () => {
+  it.each([1, 137, 4096, transcript.length])(
+    'publishes host-observed states with %i-character PTY chunks',
+    (size) => {
+      const projection = new FreebuffStatusProjection(120, 40)
+      const parse = createAgentStatusOscProcessor()
+      const states: string[] = []
+      try {
+        for (let index = 0; index < transcript.length; index += size) {
+          const raw = transcript.slice(index, index + size)
+          const projected = projection.project(raw)
+          // oxlint-disable-next-line no-control-regex -- Terminal protocol delimiters contain ESC and BEL.
+          expect(projected.replace(/\x1b\]9999;[^\x07]*\x07/g, '')).toBe(raw)
+          for (const payload of parse(projected).payloads) {
+            expect(payload.agentType).toBe('freebuff')
+            if (states.at(-1) !== payload.state) {
+              states.push(payload.state)
+            }
+          }
+        }
+        expect(states).toContain('working')
+        expect(states).toContain('waiting')
+        expect(states.at(-1)).toBe('done')
+        projection.resize(90, 30)
+        projection.dispose()
+        expect(projection.project('later output')).toBe('later output')
+      } finally {
+        projection.dispose()
+      }
+    }
+  )
+})
diff --git a/src/relay/freebuff-status-projection.ts b/src/relay/freebuff-status-projection.ts
new file mode 100644
index 00000000000..6e8ea7d9de3
--- /dev/null
+++ b/src/relay/freebuff-status-projection.ts
@@ -0,0 +1,45 @@
+import { HeadlessEmulator } from '../main/daemon/headless-emulator'
+import {
+  FreebuffScreenStatusTracker,
+  splitFreebuffScreenUpdates
+} from '../shared/freebuff-screen-status'
+
+/** Emits the existing status OSC on the execution host, preserving the PTY's raw byte credit. */
+export class FreebuffStatusProjection {
+  private readonly emulator: HeadlessEmulator
+  private readonly tracker = new FreebuffScreenStatusTracker(true)
+  private disposed = false
+
+  constructor(cols: number, rows: number) {
+    this.emulator = new HeadlessEmulator({ cols, rows, scrollback: 0 })
+  }
+
+  project(data: string): string {
+    if (this.disposed) {
+      return data
+    }
+    return splitFreebuffScreenUpdates(data, this.emulator.partialEscapeTailAnsi)
+      .map((chunk) => {
+        if (!this.emulator.writeSync(chunk)) {
+          return chunk
+        }
+        const status = this.tracker.observe(chunk, () => ({
+          lines: this.emulator.getVisibleLines(),
+          alternate: this.emulator.isAlternateScreen
+        }))
+        return status ? `${chunk}\x1b]9999;${JSON.stringify(status)}\x07` : chunk
+      })
+      .join('')
+  }
+
+  resize(cols: number, rows: number): void {
+    if (!this.disposed) {
+      this.emulator.resize(cols, rows)
+    }
+  }
+
+  dispose(): void {
+    this.disposed = true
+    this.emulator.dispose()
+  }
+}
diff --git a/src/relay/fs-handler-git-fallback.ts b/src/relay/fs-handler-git-fallback.ts
index 6e1144cdf4f..3298f369c9e 100644
--- a/src/relay/fs-handler-git-fallback.ts
+++ b/src/relay/fs-handler-git-fallback.ts
@@ -6,10 +6,8 @@
  * and git grep as universal fallbacks — git is always available since this is
  * a git-focused app.
  */
-import { SearchSubprocessLineAccumulator } from '../shared/search-subprocess-lines'
 import { spawn } from 'node:child_process'
 import { fileListingCancellationError } from '../shared/file-listing-cancellation'
-import type { SearchOptions, SearchResult } from './fs-handler-utils'
 import {
   buildGitLsFilesArgsForQuickOpen,
   shouldExcludeQuickOpenRelPath,
@@ -19,14 +17,6 @@ import {
   expandQuickOpenGitFileListing,
   parseQuickOpenGitLsFilesEntry
 } from '../shared/quick-open-readdir-walk'
-import {
-  buildGitGrepArgs,
-  buildSubmatchRegex,
-  createAccumulator,
-  finalize,
-  ingestGitGrepLine,
-  SEARCH_TIMEOUT_MS
-} from '../shared/text-search'
 import { buildRelayGitEnv } from './relay-command-env'
 
 /**
@@ -266,81 +256,4 @@ export function listFilesWithGit(
     })
 }
 
-/**
- * Text search using `git grep`. Fallback when rg is not installed.
- */
-export function searchWithGitGrep(
-  rootPath: string,
-  query: string,
-  opts: SearchOptions
-): Promise<SearchResult> {
-  return new Promise((resolve) => {
-    const gitArgs = buildGitGrepArgs(query, opts)
-    const matchRegex = buildSubmatchRegex(query, opts)
-    const acc = createAccumulator()
-    const lines = new SearchSubprocessLineAccumulator(Number.MAX_SAFE_INTEGER)
-    let done = false
-
-    const child = spawn('git', gitArgs, {
-      cwd: rootPath,
-      env: buildRelayGitEnv(),
-      stdio: ['ignore', 'pipe', 'pipe']
-    })
-    let killTimeout: ReturnType<typeof setTimeout>
-
-    function resolveOnce(): void {
-      if (done) {
-        return
-      }
-      done = true
-      lines.clear()
-      clearTimeout(killTimeout)
-      // Why: child.kill() is advisory. If git ignores it, detach our
-      // closures so repeated relay searches do not retain old scans.
-      child.stdout!.off('data', handleStdoutData)
-      child.stderr!.off('data', handleStderrData)
-      child.off('error', handleError)
-      child.off('close', handleClose)
-      resolve(finalize(acc))
-    }
-
-    function processLine(line: string): void {
-      const verdict = ingestGitGrepLine(line, rootPath, matchRegex, acc, opts.maxResults)
-      if (verdict === 'stop') {
-        child.kill()
-      }
-    }
-
-    function handleStdoutData(chunk: string): void {
-      lines.push(chunk, processLine)
-    }
-
-    function handleStderrData(): void {
-      /* drain */
-    }
-
-    function handleError(): void {
-      resolveOnce()
-    }
-
-    function handleClose(): void {
-      const tail = lines.finish()
-      if (tail !== null) {
-        processLine(tail)
-      }
-      resolveOnce()
-    }
-
-    child.stdout!.setEncoding('utf-8')
-    child.stdout!.on('data', handleStdoutData)
-    child.stderr!.on('data', handleStderrData)
-    child.once('error', handleError)
-    child.once('close', handleClose)
-
-    killTimeout = setTimeout(() => {
-      acc.truncated = true
-      child.kill()
-      resolveOnce()
-    }, SEARCH_TIMEOUT_MS)
-  })
-}
+export { searchWithGitGrep } from './fs-handler-git-search'
diff --git a/src/relay/fs-handler-git-search.ts b/src/relay/fs-handler-git-search.ts
new file mode 100644
index 00000000000..c448c17d476
--- /dev/null
+++ b/src/relay/fs-handler-git-search.ts
@@ -0,0 +1,130 @@
+import { SearchSubprocessLineAccumulator } from '../shared/search-subprocess-lines'
+import { spawnProcess } from '../shared/child-process/run-process'
+import { abortSignalReason } from '../shared/abort-signal-reason'
+import type { SearchOptions, SearchResult } from './fs-handler-utils'
+import {
+  buildGitGrepArgs,
+  buildSubmatchRegex,
+  createAccumulator,
+  finalize,
+  ingestGitGrepLine,
+  SEARCH_TIMEOUT_MS
+} from '../shared/text-search'
+import {
+  absorbPendingRipgrepSpawnError,
+  killSpawnedRipgrepProcess
+} from '../shared/ripgrep-process-availability'
+import { buildRelayGitEnv } from './relay-command-env'
+
+/**
+ * Text search using `git grep`. Fallback when rg is not installed.
+ */
+export function searchWithGitGrep(
+  rootPath: string,
+  query: string,
+  opts: SearchOptions
+): Promise<SearchResult> {
+  const { signal } = opts
+  if (signal?.aborted) {
+    return Promise.reject(abortSignalReason(signal))
+  }
+  return new Promise((resolve, reject) => {
+    const gitArgs = buildGitGrepArgs(query, opts)
+    const matchRegex = buildSubmatchRegex(query, opts)
+    const acc = createAccumulator()
+    const lines = new SearchSubprocessLineAccumulator(Number.MAX_SAFE_INTEGER)
+    let done = false
+    let processErrorObserved = false
+
+    const child = spawnProcess({
+      program: 'git',
+      args: gitArgs,
+      cwd: rootPath,
+      env: buildRelayGitEnv(),
+      stdio: ['ignore', 'pipe', 'pipe']
+    })
+    let killTimeout: ReturnType<typeof setTimeout>
+
+    function settle(): boolean {
+      if (done) {
+        return false
+      }
+      done = true
+      signal?.removeEventListener('abort', onAbort)
+      lines.clear()
+      clearTimeout(killTimeout)
+      // Why: child.kill() is advisory. If git ignores it, detach our
+      // closures so repeated relay searches do not retain old scans.
+      child.stdout!.off('data', handleStdoutData)
+      child.stderr!.off('data', handleStderrData)
+      child.off('error', handleError)
+      child.off('close', handleClose)
+      absorbPendingRipgrepSpawnError(child, {
+        errorObserved: processErrorObserved,
+        unavailableExitObserved: false
+      })
+      return true
+    }
+
+    function resolveOnce(): void {
+      if (settle()) {
+        resolve(finalize(acc))
+      }
+    }
+
+    function onAbort(): void {
+      if (signal && settle()) {
+        try {
+          killSpawnedRipgrepProcess(child)
+        } catch {
+          // A refused kill must still release the canceled request.
+        }
+        reject(abortSignalReason(signal))
+      }
+    }
+
+    function processLine(line: string): void {
+      const verdict = ingestGitGrepLine(line, rootPath, matchRegex, acc, opts.maxResults)
+      if (verdict === 'stop') {
+        child.kill()
+      }
+    }
+
+    function handleStdoutData(chunk: string): void {
+      lines.push(chunk, processLine)
+    }
+
+    function handleStderrData(): void {
+      /* drain */
+    }
+
+    function handleError(): void {
+      processErrorObserved = true
+      resolveOnce()
+    }
+
+    function handleClose(): void {
+      const tail = lines.finish()
+      if (tail !== null) {
+        processLine(tail)
+      }
+      resolveOnce()
+    }
+
+    child.stdout!.setEncoding('utf-8')
+    child.stdout!.on('data', handleStdoutData)
+    child.stderr!.on('data', handleStderrData)
+    child.once('error', handleError)
+    child.once('close', handleClose)
+
+    killTimeout = setTimeout(() => {
+      acc.truncated = true
+      child.kill()
+      resolveOnce()
+    }, SEARCH_TIMEOUT_MS)
+    signal?.addEventListener('abort', onAbort, { once: true })
+    if (signal?.aborted) {
+      onAbort()
+    }
+  })
+}
diff --git a/src/relay/fs-handler-list-files-ignored.test.ts b/src/relay/fs-handler-list-files-ignored.test.ts
index 3123d35241a..483afec1c4c 100644
--- a/src/relay/fs-handler-list-files-ignored.test.ts
+++ b/src/relay/fs-handler-list-files-ignored.test.ts
@@ -670,7 +670,12 @@ describe('relay quick open ignored file listing', () => {
       'rg',
       ['--version'],
       // windowsHide: the probe must never flash a console window on Windows.
-      { env: buildRelayCommandEnv(), stdio: 'ignore', windowsHide: true }
+      expect.objectContaining({
+        env: buildRelayCommandEnv(),
+        stdio: 'ignore',
+        windowsHide: true,
+        shell: false
+      })
     ])
     listProbe.emit('close', 0, null)
     await expect(listing).rejects.toThrow(`Search root is not reachable: ${missingRoot}`)
diff --git a/src/relay/fs-handler-utils.ts b/src/relay/fs-handler-utils.ts
index 8b93c6ac82e..a3b2234ced0 100644
--- a/src/relay/fs-handler-utils.ts
+++ b/src/relay/fs-handler-utils.ts
@@ -6,7 +6,8 @@
  * so they are straightforward to test independently.
  */
 import { SearchSubprocessLineAccumulator } from '../shared/search-subprocess-lines'
-import { spawn } from 'node:child_process'
+import { spawnProcess } from '../shared/child-process/run-process'
+import { abortSignalReason } from '../shared/abort-signal-reason'
 import { open } from 'node:fs/promises'
 import {
   buildRgArgs,
@@ -83,6 +84,7 @@ export type SearchOptions = {
   includePattern?: string
   excludePattern?: string
   maxResults: number
+  signal?: AbortSignal
 }
 
 export type SearchResult = SharedSearchResult
@@ -104,6 +106,10 @@ export function searchWithRg(
   query: string,
   opts: SearchOptions
 ): Promise<SearchResult> {
+  const { signal } = opts
+  if (signal?.aborted) {
+    return Promise.reject(abortSignalReason(signal))
+  }
   return new Promise((resolve, reject) => {
     const rgArgs = buildRgArgs(query, rootPath, opts)
     const acc = createAccumulator()
@@ -127,13 +133,14 @@ export function searchWithRg(
     // Why a second binding: the closures below capture it, and narrowing does not reach them.
     const command: string = resolvedRgCommand
     const env = buildRelayCommandEnv()
-    let child: ReturnType<typeof spawn>
+    let child: ReturnType<typeof spawnProcess>
     try {
-      child = spawn(command, rgArgs, {
+      child = spawnProcess({
+        program: command,
+        args: rgArgs,
         cwd: rootPath,
         env,
-        stdio: ['ignore', 'pipe', 'pipe'],
-        windowsHide: true
+        stdio: ['ignore', 'pipe', 'pipe']
       })
     } catch {
       resolve(finalize(acc))
@@ -147,6 +154,7 @@ export function searchWithRg(
         return false
       }
       resolved = true
+      signal?.removeEventListener('abort', onAbort)
       lines.clear()
       clearTimeout(killTimeout)
       // Why: child.kill() is advisory over SSH; detach listeners if the
@@ -162,6 +170,17 @@ export function searchWithRg(
       return true
     }
 
+    function onAbort(): void {
+      if (signal && settle()) {
+        try {
+          killSpawnedRipgrepProcess(child)
+        } catch {
+          // A refused kill must still release the canceled request.
+        }
+        reject(abortSignalReason(signal))
+      }
+    }
+
     function resolveOnce(): void {
       if (settle()) {
         resolve(finalize(acc))
@@ -172,8 +191,11 @@ export function searchWithRg(
       if (launchFailureCheck) {
         return
       }
-      launchFailureCheck = retryRipgrepOnPathAfterLaunchFailure(command, rootPath, error).then(
-        async (retryOnPath) => {
+      launchFailureCheck = retryRipgrepOnPathAfterLaunchFailure(command, rootPath, error)
+        .then(async (retryOnPath) => {
+          if (resolved) {
+            return
+          }
           if (retryOnPath) {
             // Why: a launch failure produced no output, so rerunning on PATH rg loses nothing.
             if (settle()) {
@@ -184,19 +206,25 @@ export function searchWithRg(
           // Why not resolveOnce() on an unreachable root: an empty result reads as "no matches"
           // and the git/readdir chain never engages, because it only triggers on an unavailable
           // ripgrep. The workspace moving would otherwise look like a successful empty scan.
+          const failure = await classifyRipgrepLaunchFailure(
+            rootPath,
+            [command, pathRipgrepCommand()],
+            env,
+            signal
+          )
           if (settle()) {
             reject(
-              (await classifyRipgrepLaunchFailure(
-                rootPath,
-                [command, pathRipgrepCommand()],
-                env
-              )) === 'cwd-unreachable'
+              failure === 'cwd-unreachable'
                 ? ripgrepMissingCwdError(rootPath)
                 : new RipgrepUnavailableError()
             )
           }
-        }
-      )
+        })
+        .catch((error: unknown) => {
+          if (settle()) {
+            reject(error)
+          }
+        })
     }
 
     function processLine(line: string): void {
@@ -251,6 +279,10 @@ export function searchWithRg(
       killSpawnedRipgrepProcess(child)
       resolveOnce()
     }, SEARCH_TIMEOUT_MS)
+    signal?.addEventListener('abort', onAbort, { once: true })
+    if (signal?.aborted) {
+      onAbort()
+    }
   })
 }
 
diff --git a/src/relay/fs-handler.ts b/src/relay/fs-handler.ts
index 6286c71941e..36765721ef3 100644
--- a/src/relay/fs-handler.ts
+++ b/src/relay/fs-handler.ts
@@ -101,7 +101,7 @@ export class FsHandler {
     this.dispatcher.onRequest('fs.renameNoClobber', (p) => renameRelayPathNoClobber(p))
     this.dispatcher.onRequest('fs.copy', (p) => copyRelayPath(p))
     this.dispatcher.onRequest('fs.realpath', (p) => realpathRelayPath(p))
-    this.dispatcher.onRequest('fs.search', (p) => this.search(p))
+    this.dispatcher.onRequest('fs.search', (p, context) => this.search(p, context))
     this.dispatcher.onRequest('fs.getCapabilities', async () => ({
       quickOpenSearchVersion: 1,
       rangedReadVersion: 1,
@@ -185,7 +185,7 @@ export class FsHandler {
     })
   }
 
-  private async search(params: Record<string, unknown>) {
+  private async search(params: Record<string, unknown>, context?: RequestContext) {
     const query = params.query as string
     const rootPath = expandTilde(params.rootPath as string)
     const caseSensitive = params.caseSensitive as boolean | undefined
@@ -204,7 +204,8 @@ export class FsHandler {
       useRegex,
       includePattern,
       excludePattern,
-      maxResults
+      maxResults,
+      signal: context?.signal
     }
     try {
       return await searchWithRg(rootPath, query, options)
diff --git a/src/relay/fs-search-cancellation.test.ts b/src/relay/fs-search-cancellation.test.ts
new file mode 100644
index 00000000000..329c74f07b4
--- /dev/null
+++ b/src/relay/fs-search-cancellation.test.ts
@@ -0,0 +1,239 @@
+import { ChildProcess } from 'node:child_process'
+import type * as ChildProcessModule from 'node:child_process'
+import type * as RipgrepAvailability from '../shared/ripgrep-process-availability'
+import { getEventListeners } from 'node:events'
+import { PassThrough } from 'node:stream'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { spawnMock, resolveCommand, retryOnPath, classifyFailure } = vi.hoisted(() => ({
+  spawnMock: vi.fn(),
+  resolveCommand: vi.fn((): string | null => '/tools/rg'),
+  retryOnPath: vi.fn(async () => false),
+  classifyFailure: vi.fn(
+    async (): Promise<'cwd-unreachable' | 'ripgrep-unavailable'> => 'ripgrep-unavailable'
+  )
+}))
+vi.mock('node:child_process', async (importOriginal) => ({
+  ...(await importOriginal<typeof ChildProcessModule>()),
+  spawn: spawnMock
+}))
+vi.mock('../shared/ripgrep-process-availability', async (importOriginal) => ({
+  ...(await importOriginal<typeof RipgrepAvailability>()),
+  classifyRipgrepLaunchFailure: classifyFailure
+}))
+vi.mock('./relay-bundled-ripgrep', () => ({
+  resolveRelayRipgrepCommand: resolveCommand,
+  pathRipgrepCommand: () => '/tools/rg',
+  retryRipgrepOnPathAfterLaunchFailure: retryOnPath
+}))
+
+import { searchWithRg } from './fs-handler-utils'
+import { searchWithGitGrep } from './fs-handler-git-fallback'
+import { RelayDispatcher } from './dispatcher'
+import { FsHandler } from './fs-handler'
+import { RelayContext } from './context'
+import { encodeJsonRpcFrame } from './protocol'
+
+function createProcess(spawned = true) {
+  const child = new ChildProcess()
+  child.stdout = new PassThrough()
+  child.stderr = new PassThrough()
+  Object.defineProperty(child, 'pid', { value: spawned ? 4321 : undefined })
+  child.kill = vi.fn(() => true)
+  return child
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  spawnMock.mockReset()
+  resolveCommand.mockReturnValue('/tools/rg')
+  retryOnPath.mockResolvedValue(false)
+  classifyFailure.mockResolvedValue('ripgrep-unavailable')
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+})
+
+describe.each([
+  { name: 'ripgrep', search: searchWithRg },
+  { name: 'git grep', search: searchWithGitGrep }
+])('relay $name search cancellation', ({ search }) => {
+  it('does not start a child for an already canceled request', async () => {
+    const controller = new AbortController()
+    controller.abort()
+    await expect(
+      search('/remote/root', 'needle', { maxResults: 100, signal: controller.signal })
+    ).rejects.toMatchObject({ name: 'AbortError' })
+    expect(spawnMock).not.toHaveBeenCalled()
+  })
+
+  it('releases a canceled search even when its child never reports an exit', async () => {
+    const child = createProcess()
+    spawnMock.mockReturnValue(child)
+    const controller = new AbortController()
+    const result = search('/remote/root', 'needle', { maxResults: 100, signal: controller.signal })
+    const rejected = expect(result).rejects.toMatchObject({ name: 'AbortError' })
+    child.stdout?.emit('data', 'unfinished output')
+
+    controller.abort()
+    await rejected
+
+    expect(child.kill).toHaveBeenCalledOnce()
+    expect(child.stdout?.listenerCount('data')).toBe(0)
+    expect(child.stderr?.listenerCount('data')).toBe(0)
+    expect(child.listenerCount('close')).toBe(0)
+    expect(child.listenerCount('error')).toBe(0)
+    expect(getEventListeners(controller.signal, 'abort')).toHaveLength(0)
+    expect(vi.getTimerCount()).toBe(0)
+    child.emit('close', 0, null)
+    expect(spawnMock).toHaveBeenCalledOnce()
+  })
+
+  it('removes the abort listener after normal completion', async () => {
+    const child = createProcess()
+    spawnMock.mockReturnValue(child)
+    const controller = new AbortController()
+    const result = search('/remote/root', 'needle', { maxResults: 100, signal: controller.signal })
+    child.emit('close', 0, null)
+    await expect(result).resolves.toEqual({ files: [], totalMatches: 0, truncated: false })
+    expect(getEventListeners(controller.signal, 'abort')).toHaveLength(0)
+    controller.abort()
+    expect(child.kill).not.toHaveBeenCalled()
+  })
+
+  it('absorbs a queued spawn error after cancellation without signaling a missing PID', async () => {
+    const child = createProcess(false)
+    spawnMock.mockReturnValue(child)
+    const controller = new AbortController()
+    const result = search('/remote/root', 'needle', { maxResults: 100, signal: controller.signal })
+    const rejected = expect(result).rejects.toMatchObject({ name: 'AbortError' })
+    controller.abort()
+    await rejected
+    expect(child.kill).not.toHaveBeenCalled()
+    expect(() => child.emit('error', new Error('spawn ENOENT'))).not.toThrow()
+    expect(child.listenerCount('error')).toBe(0)
+  })
+})
+
+it('does not retry on PATH after cancellation during launch-failure diagnosis', async () => {
+  let finishRetry: (retry: boolean) => void = () => undefined
+  retryOnPath.mockReturnValueOnce(
+    new Promise<boolean>((resolve) => {
+      finishRetry = resolve
+    })
+  )
+  const child = createProcess(false)
+  spawnMock.mockReturnValue(child)
+  const controller = new AbortController()
+  const result = searchWithRg('/remote/root', 'needle', {
+    maxResults: 100,
+    signal: controller.signal
+  })
+  const rejected = expect(result).rejects.toMatchObject({ name: 'AbortError' })
+  child.emit('error', new Error('spawn ENOENT'))
+  controller.abort()
+  await rejected
+  finishRetry(true)
+  await Promise.resolve()
+  expect(spawnMock).toHaveBeenCalledOnce()
+})
+
+it('settles cancellation while launch-failure classification is still pending', async () => {
+  let finishClassification: (failure: 'ripgrep-unavailable') => void = () => undefined
+  classifyFailure.mockReturnValueOnce(
+    new Promise((resolve) => {
+      finishClassification = resolve
+    })
+  )
+  const child = createProcess(false)
+  spawnMock.mockReturnValue(child)
+  const controller = new AbortController()
+  const result = searchWithRg('/remote/root', 'needle', {
+    maxResults: 100,
+    signal: controller.signal
+  })
+  const rejected = expect(result).rejects.toMatchObject({ name: 'AbortError' })
+  child.emit('error', new Error('spawn ENOENT'))
+  await Promise.resolve()
+  controller.abort()
+  await rejected
+  finishClassification('ripgrep-unavailable')
+  await Promise.resolve()
+  expect(spawnMock).toHaveBeenCalledOnce()
+  expect(getEventListeners(controller.signal, 'abort')).toHaveLength(0)
+  expect(vi.getTimerCount()).toBe(0)
+})
+
+describe.each(['ripgrep', 'git grep'])('relay dispatcher cancels %s', (backend) => {
+  it.each(['detach', 'rpc.cancel', 'dispose'])(
+    'removes every search child and listener on %s',
+    async (cause) => {
+      if (backend === 'git grep') {
+        resolveCommand.mockReturnValue(null)
+      }
+      const children: ReturnType<typeof createProcess>[] = []
+      spawnMock.mockImplementation(() => {
+        const child = createProcess()
+        children.push(child)
+        return child
+      })
+      const dispatcher = new RelayDispatcher(() => true)
+      const handler = new FsHandler(dispatcher, new RelayContext(), {
+        dispose: vi.fn(),
+        forgetRoot: vi.fn(),
+        subscribe: vi.fn()
+      })
+      try {
+        const client = dispatcher.attachClient(() => true)
+        for (let id = 1; id <= 25; id++) {
+          dispatcher.feedClient(
+            client,
+            encodeJsonRpcFrame(
+              {
+                jsonrpc: '2.0',
+                id,
+                method: 'fs.search',
+                params: { rootPath: '/remote/root', query: 'needle' }
+              },
+              id,
+              0
+            )
+          )
+        }
+        await Promise.resolve()
+        expect(children).toHaveLength(25)
+        if (cause === 'detach') {
+          dispatcher.detachClient(client)
+        } else if (cause === 'dispose') {
+          dispatcher.dispose()
+        } else {
+          for (let id = 1; id <= 25; id++) {
+            dispatcher.feedClient(
+              client,
+              encodeJsonRpcFrame(
+                { jsonrpc: '2.0', method: 'rpc.cancel', params: { id } },
+                id + 25,
+                0
+              )
+            )
+          }
+        }
+        await Promise.resolve()
+        for (const child of children) {
+          expect(child.kill).toHaveBeenCalledOnce()
+          expect(child.stdout?.listenerCount('data')).toBe(0)
+          expect(child.listenerCount('close')).toBe(0)
+        }
+        expect(spawnMock).toHaveBeenCalledTimes(25)
+      } finally {
+        handler.dispose()
+        dispatcher.dispose()
+        for (const child of children) {
+          child.emit('close', 0, null)
+        }
+      }
+      expect(vi.getTimerCount()).toBe(0)
+    }
+  )
+})
diff --git a/src/relay/fs-search-diagnosis-cancellation.test.ts b/src/relay/fs-search-diagnosis-cancellation.test.ts
new file mode 100644
index 00000000000..e545c68485a
--- /dev/null
+++ b/src/relay/fs-search-diagnosis-cancellation.test.ts
@@ -0,0 +1,190 @@
+import { ChildProcess } from 'node:child_process'
+import type * as ChildProcessModule from 'node:child_process'
+import type * as FsPromises from 'node:fs/promises'
+import { PassThrough } from 'node:stream'
+import { getEventListeners } from 'node:events'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+
+const { spawnMock, statMock } = vi.hoisted(() => ({ spawnMock: vi.fn(), statMock: vi.fn() }))
+vi.mock('node:child_process', async (importOriginal) => ({
+  ...(await importOriginal<typeof ChildProcessModule>()),
+  spawn: spawnMock
+}))
+vi.mock('node:fs/promises', async (importOriginal) => ({
+  ...(await importOriginal<typeof FsPromises>()),
+  stat: statMock,
+  access: vi.fn(async () => undefined)
+}))
+vi.mock('./relay-bundled-ripgrep', () => ({
+  resolveRelayRipgrepCommand: () => '/tools/rg',
+  pathRipgrepCommand: () => '/tools/rg',
+  retryRipgrepOnPathAfterLaunchFailure: async () => false
+}))
+import { searchWithRg } from './fs-handler-utils'
+import { classifyRipgrepLaunchFailure } from '../shared/ripgrep-process-availability'
+import { searchWithGitGrep } from './fs-handler-git-search'
+
+function child(spawned: boolean) {
+  const result = new ChildProcess()
+  result.stdout = new PassThrough()
+  result.stderr = new PassThrough()
+  Object.defineProperty(result, 'pid', { value: spawned ? 4321 : undefined })
+  result.kill = vi.fn(() => true)
+  return result
+}
+beforeEach(() => {
+  vi.useFakeTimers()
+  spawnMock.mockReset()
+  statMock.mockReset().mockResolvedValue({ isDirectory: () => false })
+})
+afterEach(() => vi.useRealTimers())
+it('does not start a version probe after canceled launch diagnosis resumes', async () => {
+  vi.useFakeTimers()
+  let completeStat: (value: { isDirectory: () => boolean }) => void = () => undefined
+  statMock.mockReturnValue(
+    new Promise((resolve) => {
+      completeStat = resolve
+    })
+  )
+  const failed = child(false)
+  const probe = child(true)
+  spawnMock.mockReturnValueOnce(failed).mockReturnValue(probe)
+  const controller = new AbortController()
+  const search = searchWithRg('/missing/root', 'needle', {
+    maxResults: 100,
+    signal: controller.signal
+  })
+  const canceled = expect(search).rejects.toMatchObject({ name: 'AbortError' })
+  failed.emit('error', new Error('spawn ENOENT'))
+  for (let tick = 0; tick < 5; tick += 1) {
+    await Promise.resolve()
+  }
+  expect(statMock).toHaveBeenCalledOnce()
+  controller.abort()
+  await canceled
+  completeStat({ isDirectory: () => false })
+  for (let tick = 0; tick < 10; tick += 1) {
+    await Promise.resolve()
+  }
+  const observed = spawnMock.mock.calls.map((args) => [args[0], args[1]])
+  probe.emit('close', 0)
+  expect(observed).toEqual([['/tools/rg', expect.not.arrayContaining(['--version'])]])
+})
+
+for (const [name, search] of [
+  ['rg', searchWithRg],
+  ['git', searchWithGitGrep]
+] as const) {
+  it.each(['emit', 'throw'])(
+    `settles ${name} cancellation when kill fails via %s`,
+    async (mode) => {
+      const process = child(true)
+      process.kill = vi.fn(() => {
+        const error = Object.assign(new Error('kill EPERM'), { code: 'EPERM' })
+        if (mode === 'throw') {
+          throw error
+        }
+        process.emit('error', error)
+        return false
+      })
+      spawnMock.mockReturnValue(process)
+      const controller = new AbortController()
+      const result = search('/root', 'needle', { maxResults: 100, signal: controller.signal })
+      const canceled = expect(result).rejects.toMatchObject({ name: 'AbortError' })
+      expect(() => controller.abort()).not.toThrow()
+      await canceled
+      expect(process.kill).toHaveBeenCalledOnce()
+      expect(process.stdout?.listenerCount('data')).toBe(0)
+      expect(getEventListeners(controller.signal, 'abort')).toHaveLength(0)
+      expect(vi.getTimerCount()).toBe(0)
+    }
+  )
+}
+
+it('terminates an active version probe and skips remaining candidates on abort', async () => {
+  const probe = child(true)
+  spawnMock.mockReturnValue(probe)
+  const controller = new AbortController()
+  const diagnosis = classifyRipgrepLaunchFailure(
+    '/missing/root',
+    ['/tools/rg', '/fallback/rg'],
+    {},
+    controller.signal
+  )
+  const canceled = expect(diagnosis).rejects.toMatchObject({ name: 'AbortError' })
+  for (let tick = 0; tick < 5; tick += 1) {
+    await Promise.resolve()
+  }
+  expect(spawnMock).toHaveBeenCalledOnce()
+  controller.abort()
+  await canceled
+  expect(probe.kill).toHaveBeenCalledOnce()
+  expect(probe.listenerCount('close')).toBe(0)
+  expect(getEventListeners(controller.signal, 'abort')).toHaveLength(0)
+  expect(vi.getTimerCount()).toBe(0)
+  probe.emit('close', 0)
+  expect(spawnMock).toHaveBeenCalledOnce()
+})
+
+it('preserves candidate fallback and cwd classification for a live caller', async () => {
+  const missing = child(true)
+  const available = child(true)
+  spawnMock.mockReturnValueOnce(missing).mockReturnValueOnce(available)
+  const controller = new AbortController()
+  const diagnosis = classifyRipgrepLaunchFailure(
+    '/missing/root',
+    ['/tools/rg', '/fallback/rg'],
+    {},
+    controller.signal
+  )
+  for (let tick = 0; tick < 5; tick += 1) {
+    await Promise.resolve()
+  }
+  missing.emit('close', 1)
+  for (let tick = 0; tick < 5; tick += 1) {
+    await Promise.resolve()
+  }
+  available.emit('close', 0)
+  await expect(diagnosis).resolves.toBe('cwd-unreachable')
+  expect(spawnMock.mock.calls.map(([program, args]) => [program, args])).toEqual([
+    ['/tools/rg', ['--version']],
+    ['/fallback/rg', ['--version']]
+  ])
+  expect(getEventListeners(controller.signal, 'abort')).toHaveLength(0)
+  expect(vi.getTimerCount()).toBe(0)
+  expect(missing.kill).not.toHaveBeenCalled()
+  expect(available.kill).not.toHaveBeenCalled()
+})
+
+it.each(['emit', 'throw'])(
+  'settles version-probe cancellation when kill fails via %s',
+  async (mode) => {
+    const probe = child(true)
+    probe.kill = vi.fn(() => {
+      const error = Object.assign(new Error('kill EPERM'), { code: 'EPERM' })
+      if (mode === 'throw') {
+        throw error
+      }
+      probe.emit('error', error)
+      return false
+    })
+    spawnMock.mockReturnValue(probe)
+    const controller = new AbortController()
+    const diagnosis = classifyRipgrepLaunchFailure(
+      '/missing/root',
+      ['/tools/rg', '/fallback/rg'],
+      {},
+      controller.signal
+    )
+    const canceled = expect(diagnosis).rejects.toMatchObject({ name: 'AbortError' })
+    for (let tick = 0; tick < 5; tick += 1) {
+      await Promise.resolve()
+    }
+    expect(() => controller.abort()).not.toThrow()
+    await canceled
+    expect(probe.kill).toHaveBeenCalledOnce()
+    expect(spawnMock).toHaveBeenCalledOnce()
+    expect(getEventListeners(controller.signal, 'abort')).toHaveLength(0)
+    expect(vi.getTimerCount()).toBe(0)
+  }
+)
diff --git a/src/relay/managed-hook-installer.ts b/src/relay/managed-hook-installer.ts
index 3fa57dd5ed8..e88089f486a 100644
--- a/src/relay/managed-hook-installer.ts
+++ b/src/relay/managed-hook-installer.ts
@@ -6,7 +6,7 @@ import {
 import type { RelayDispatcher, RequestContext } from './dispatcher'
 import type { AgentHookTarget } from '../shared/agent-hook-types'
 import { isManagedAgentHookTarget } from '../shared/managed-agent-hook-targets'
-import { parseClaudeCliVersion } from '../main/claude/claude-session-end-hook-capability'
+import { parseClaudeCliVersion } from '../main/claude/claude-hook-event-versions'
 
 export type ManagedHookInstallSummary = {
   installers: number
diff --git a/src/relay/omp-fresh-launch-environment.test.ts b/src/relay/omp-fresh-launch-environment.test.ts
index 5f7cd57681f..8697368567f 100644
--- a/src/relay/omp-fresh-launch-environment.test.ts
+++ b/src/relay/omp-fresh-launch-environment.test.ts
@@ -91,7 +91,7 @@ it('prepares the execution host OMP config and status extension for a guarded la
     source.mockReturnValue(false)
     expect(
       await augment.mock.calls[1][0]({ id: 'other', shell: '/bin/bash', env: {}, command: 'codex' })
-    ).toEqual({ ORCA_OPENCODE_AGENT: 'opencode' })
+    ).toEqual({})
   } finally {
     runtime.stop()
     dispatcher.dispose()
diff --git a/src/relay/opencode-canonical-config.ts b/src/relay/opencode-canonical-config.ts
index 4bcb9f3e151..38682d3f274 100644
--- a/src/relay/opencode-canonical-config.ts
+++ b/src/relay/opencode-canonical-config.ts
@@ -1,6 +1,7 @@
 import { mkdirSync, unlinkSync, writeFileSync } from 'node:fs'
 import { isAbsolute, join, relative, resolve } from 'node:path'
 import { resolveOpenCodeConfigDirectory } from '../shared/opencode-config-directory'
+import { isInstalledOpenCodePluginCurrent } from '../shared/opencode-installed-plugin'
 
 const RELAY_HOOKS_DIR = '.orca-relay'
 
@@ -18,12 +19,14 @@ export function installOpenCodePluginInCanonicalConfig(
       agent === 'opencode2' ? 'orca-opencode2-status.js' : 'orca-opencode-status.js'
     const pluginPath = join(configDir, 'plugins', pluginFileName)
     mkdirSync(join(configDir, 'plugins'), { recursive: true })
-    try {
-      unlinkSync(pluginPath)
-    } catch {
-      // The file may not exist on the first install.
+    if (!isInstalledOpenCodePluginCurrent(pluginPath, source)) {
+      try {
+        unlinkSync(pluginPath)
+      } catch {
+        // The file may not exist on the first install.
+      }
+      writeFileSync(pluginPath, source)
     }
-    writeFileSync(pluginPath, source)
     return true
   } catch (err) {
     process.stderr.write(
diff --git a/src/relay/opencode-hook-selection.test.ts b/src/relay/opencode-hook-selection.test.ts
new file mode 100644
index 00000000000..336db284a47
--- /dev/null
+++ b/src/relay/opencode-hook-selection.test.ts
@@ -0,0 +1,188 @@
+import './mock-descendant-sweep'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { beginPtyHandlerTest, endPtyHandlerTest } from './pty-handler-test-harness'
+import { RelayAgentHookRuntime } from './relay-agent-hook-runtime'
+import type { RelayDispatcher } from './dispatcher'
+import { AGENT_HOOK_INSTALL_PLUGINS_METHOD } from '../shared/agent-hook-relay'
+
+const mocks = vi.hoisted(() => ({
+  mockPtySpawn: vi.fn(),
+  mockCreateShellPromptReadinessProbe: vi.fn(),
+  mockPtyInstance: {
+    pid: process.pid,
+    onData: vi.fn(),
+    onExit: vi.fn(),
+    write: vi.fn(),
+    resize: vi.fn(),
+    kill: vi.fn(),
+    clear: vi.fn(),
+    pause: vi.fn(),
+    resume: vi.fn()
+  }
+}))
+vi.mock('node-pty', () => ({ spawn: mocks.mockPtySpawn }))
+vi.mock('../main/shell-prompt-readiness-probe', () => ({
+  createShellPromptReadinessProbe: mocks.mockCreateShellPromptReadinessProbe
+}))
+vi.mock('../main/pty/posix-pty-process-groups', () => ({
+  forceKillPosixPtyProcessGroups: vi.fn((_pid: number, fallback: () => void) => fallback())
+}))
+vi.mock('./agent-hook-server', () => ({
+  RelayAgentHookServer: class {
+    start = async () => {}
+    stop = () => {}
+    buildPtyEnv = () => ({ ORCA_AGENT_HOOK_PORT: '12345' })
+    clearPaneState = () => {}
+  }
+}))
+let root: string
+let harness: ReturnType<typeof beginPtyHandlerTest>
+let runtime: RelayAgentHookRuntime
+let custom: string
+const plugin = (dir: string, agent: string) => join(dir, 'plugins', `orca-${agent}-status.js`)
+
+beforeEach(async () => {
+  root = mkdtempSync(join(tmpdir(), 'orca-relay-disabled-'))
+  custom = join(root, 'custom')
+  mkdirSync(custom)
+  writeFileSync(join(custom, 'opencode.json'), '{"model":"fixture"}')
+  vi.stubEnv('HOME', root)
+  vi.stubEnv('XDG_CONFIG_HOME', join(root, 'xdg'))
+  for (const key of [
+    'OPENCODE_CONFIG_DIR',
+    'ORCA_OPENCODE_CONFIG_DIR',
+    'ORCA_OPENCODE_SOURCE_CONFIG_DIR',
+    'ORCA_OPENCODE_AGENT',
+    'ZDOTDIR'
+  ]) {
+    vi.stubEnv(key, undefined)
+  }
+  harness = beginPtyHandlerTest(mocks)
+  runtime = new RelayAgentHookRuntime(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: this harness implements the request registration used by the runtime; PTY and disk paths are real.
+    harness.dispatcher as unknown as RelayDispatcher,
+    harness.handler,
+    join(root, 'relay.sock')
+  )
+  await runtime.start()
+})
+afterEach(async () => {
+  runtime.stop()
+  await endPtyHandlerTest(harness.handler, harness.originalPlatform)
+  vi.unstubAllEnvs()
+  rmSync(root, { recursive: true, force: true })
+})
+async function install(v1: string, v2: string): Promise<void> {
+  await harness.dispatcher.callRequest(AGENT_HOOK_INSTALL_PLUGINS_METHOD, {
+    opencodePluginSource: v1,
+    opencode2PluginSource: v2
+  })
+}
+async function spawn(params: Record<string, unknown> = {}): Promise<Record<string, string>> {
+  await harness.dispatcher.callRequest('pty.spawn', {
+    cwd: root,
+    shell: '/bin/bash',
+    cols: 80,
+    rows: 24,
+    command: 'echo fixture',
+    ...params
+  })
+  return mocks.mockPtySpawn.mock.calls.at(-1)?.[2].env
+}
+
+describe('relay OpenCode source selection on real fixture files', () => {
+  it('leaves a standalone relay without supplied sources unconfigured', async () => {
+    const env = await spawn()
+    expect(env.ORCA_OPENCODE_AGENT).toBeUndefined()
+    expect(existsSync(join(root, 'xdg', 'opencode'))).toBe(false)
+  })
+  it.each([
+    { v1: '// v1', v2: '// v2', selected: 'opencode' },
+    { v1: '', v2: '// v2', selected: 'opencode2' },
+    { v1: '// v1', v2: '', selected: 'opencode' },
+    { v1: '', v2: '', selected: undefined }
+  ])('ordinary terminal with sources $v1 / $v2', async ({ v1, v2, selected }) => {
+    await install(v1, v2)
+    const env = await spawn()
+    expect(env.ORCA_OPENCODE_AGENT).toBe(selected)
+    for (const agent of ['opencode', 'opencode2']) {
+      expect(existsSync(plugin(join(root, 'xdg', 'opencode'), agent))).toBe(agent === selected)
+    }
+  })
+  it.each(['opencode', 'opencode2'] as const)(
+    'does not substitute another plugin for disabled explicit %s',
+    async (agent) => {
+      await install(agent === 'opencode' ? '' : '// v1', agent === 'opencode2' ? '' : '// v2')
+      for (const params of [{ command: `${agent} --session fixture` }, { launchAgent: agent }]) {
+        const env = await spawn(params)
+        expect(env.ORCA_OPENCODE_AGENT).toBeUndefined()
+        expect(existsSync(join(root, 'xdg', 'opencode'))).toBe(false)
+      }
+    }
+  )
+  it('updates cached sources on one runtime and leaves old plugin files intact', async () => {
+    await install('// v1', '// v2')
+    await spawn()
+    const original = plugin(join(root, 'xdg', 'opencode'), 'opencode')
+    writeFileSync(original, '// sentinel')
+    await install('', '// v2')
+    expect((await spawn()).ORCA_OPENCODE_AGENT).toBe('opencode2')
+    expect(readFileSync(original, 'utf8')).toBe('// sentinel')
+    await install('// refreshed v1', '// v2')
+    expect((await spawn()).ORCA_OPENCODE_AGENT).toBe('opencode')
+    expect(readFileSync(original, 'utf8')).toBe('// refreshed v1')
+  })
+  it('restores the real custom source when all OpenCode sources are revoked', async () => {
+    await install('// v1', '// v2')
+    const first = await spawn({ env: { OPENCODE_CONFIG_DIR: custom } })
+    const path = plugin(first.OPENCODE_CONFIG_DIR, 'opencode')
+    expect(readFileSync(path, 'utf8')).toBe('// v1')
+    await install('', '')
+    const env = await spawn({ env: first })
+    expect(env.OPENCODE_CONFIG_DIR).toBe(custom)
+    expect(env.ORCA_OPENCODE_AGENT).toBeUndefined()
+    expect(env.ORCA_OPENCODE_CONFIG_DIR).toBeUndefined()
+    expect(env.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBeUndefined()
+    expect(readFileSync(path, 'utf8')).toBe('// v1')
+    expect(env.ORCA_AGENT_HOOK_PORT).toBe('12345')
+  })
+})
+
+it.each([true, false])(
+  'preserves explicit config over inherited relay markers with hooks %s',
+  async (enabled) => {
+    await install(enabled ? '// v1' : '', '')
+    const stale = join(root, 'stale-source')
+    mkdirSync(stale)
+    writeFileSync(join(stale, 'opencode.json'), '{"model":"stale"}')
+    vi.stubEnv('ORCA_OPENCODE_CONFIG_DIR', join(root, 'old-overlay'))
+    vi.stubEnv('ORCA_OPENCODE_SOURCE_CONFIG_DIR', stale)
+    const env = await spawn({ env: { OPENCODE_CONFIG_DIR: custom } })
+    expect(readFileSync(join(env.OPENCODE_CONFIG_DIR, 'opencode.json'), 'utf8')).toBe(
+      '{"model":"fixture"}'
+    )
+    expect(env.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBe(enabled ? custom : undefined)
+    expect(existsSync(plugin(stale, 'opencode'))).toBe(false)
+  }
+)
+
+it.each([true, false])(
+  'restores legacy source-only overlay markers with hooks %s',
+  async (enabled) => {
+    await install('// v1', '')
+    const parent = await spawn({ env: { OPENCODE_CONFIG_DIR: custom } })
+    delete parent.ORCA_OPENCODE_CONFIG_DIR
+    if (!enabled) {
+      await install('', '')
+    }
+    const env = await spawn({ env: parent })
+    expect(env.OPENCODE_CONFIG_DIR).toEqual(enabled ? expect.any(String) : custom)
+    expect(readFileSync(join(env.OPENCODE_CONFIG_DIR, 'opencode.json'), 'utf8')).toBe(
+      '{"model":"fixture"}'
+    )
+    expect(env.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBe(enabled ? custom : undefined)
+  }
+)
diff --git a/src/relay/plugin-overlay.test.ts b/src/relay/plugin-overlay.test.ts
index 14feb631876..d4d38a31fba 100644
--- a/src/relay/plugin-overlay.test.ts
+++ b/src/relay/plugin-overlay.test.ts
@@ -1,12 +1,15 @@
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import {
   existsSync,
+  lstatSync,
   mkdirSync,
   mkdtempSync,
   readFileSync,
   readdirSync,
   rmSync,
+  statSync,
   symlinkSync,
+  utimesSync,
   writeFileSync
 } from 'node:fs'
 import { tmpdir } from 'node:os'
@@ -74,6 +77,50 @@ describe('PluginOverlayManager', () => {
     ).toBe('v2 plugin')
   })
 
+  // Why: OpenCode 2 reloads a plugin whose file mtime changed, even with unchanged bytes.
+  it('leaves a current canonical plugin untouched and replaces a stale one', () => {
+    const env = { XDG_CONFIG_HOME: join(homeDir, 'xdg') }
+    const pluginPath = join(homeDir, 'xdg', 'opencode', 'plugins', 'orca-opencode2-status.js')
+    manager.setSources({ opencode2PluginSource: 'v2 plugin' })
+    manager.installOpenCodePlugin('opencode2', env)
+    const past = new Date('2020-01-01T00:00:00Z')
+    utimesSync(pluginPath, past, past)
+
+    expect(manager.installOpenCodePlugin('opencode2', env)).toBe(true)
+    expect(statSync(pluginPath).mtimeMs).toBe(past.getTime())
+
+    manager.setSources({ opencode2PluginSource: 'v2 plugin, next release' })
+    expect(manager.installOpenCodePlugin('opencode2', env)).toBe(true)
+    expect(readFileSync(pluginPath, 'utf8')).toBe('v2 plugin, next release')
+  })
+
+  // Why: OpenCode 2 loads through a file-level symlink (dotfile managers) and stats its target.
+  it.skipIf(process.platform === 'win32')(
+    'leaves a symlinked canonical plugin with current bytes untouched',
+    () => {
+      const env = { XDG_CONFIG_HOME: join(homeDir, 'xdg') }
+      const pluginsDir = join(homeDir, 'xdg', 'opencode', 'plugins')
+      const pluginPath = join(pluginsDir, 'orca-opencode2-status.js')
+      const targetPath = join(homeDir, 'dotfiles-orca-opencode2-status.js')
+      mkdirSync(pluginsDir, { recursive: true })
+      writeFileSync(targetPath, 'v2 plugin')
+      symlinkSync(targetPath, pluginPath)
+      const past = new Date('2020-01-01T00:00:00Z')
+      utimesSync(targetPath, past, past)
+      manager.setSources({ opencode2PluginSource: 'v2 plugin' })
+
+      expect(manager.installOpenCodePlugin('opencode2', env)).toBe(true)
+      expect(lstatSync(pluginPath).isSymbolicLink()).toBe(true)
+      expect(statSync(targetPath).mtimeMs).toBe(past.getTime())
+
+      manager.setSources({ opencode2PluginSource: 'v2 plugin, next release' })
+      expect(manager.installOpenCodePlugin('opencode2', env)).toBe(true)
+      expect(lstatSync(pluginPath).isFile()).toBe(true)
+      expect(readFileSync(pluginPath, 'utf8')).toBe('v2 plugin, next release')
+      expect(readFileSync(targetPath, 'utf8')).toBe('v2 plugin')
+    }
+  )
+
   it('mirrors a preexisting remote OpenCode config dir before adding Orca plugin', () => {
     const userConfigDir = join(homeDir, 'company-opencode')
     mkdirSync(join(userConfigDir, 'plugins'), { recursive: true })
diff --git a/src/relay/plugin-overlay.ts b/src/relay/plugin-overlay.ts
index 1c1c5200033..001309c1f93 100644
--- a/src/relay/plugin-overlay.ts
+++ b/src/relay/plugin-overlay.ts
@@ -79,7 +79,7 @@ function isUsableId(id: string): boolean {
   return typeof id === 'string' && id.length > 0 && id.length <= 1024
 }
 export type PluginSources = {
-  /** Source body of `orca-opencode-status.js` to drop into <overlay>/plugins/. */
+  /** Empty string revokes future installs; omission preserves the cached source. */
   opencodePluginSource?: string
   /** Source body of OpenCode 2's status plugin. */
   opencode2PluginSource?: string
@@ -158,7 +158,7 @@ export class PluginOverlayManager {
     }
   }
   hasOpenCodeSource(agent: 'opencode' | 'opencode2' = 'opencode'): boolean {
-    return (agent === 'opencode2' ? this.opencode2PluginSource : this.opencodePluginSource) !== null
+    return Boolean(agent === 'opencode2' ? this.opencode2PluginSource : this.opencodePluginSource)
   }
   hasPiSource(kind?: PiAgentKind): boolean {
     if (kind) {
diff --git a/src/relay/preflight-handler.ts b/src/relay/preflight-handler.ts
index b84166e76ba..1be1a63f9d4 100644
--- a/src/relay/preflight-handler.ts
+++ b/src/relay/preflight-handler.ts
@@ -39,10 +39,7 @@ const CONSERVATIVE_SYSTEM_SHELL_DIRS = new Set(['/bin', '/usr/bin'])
 const AGENT_PATH_PREFIX = '__ORCA_AGENT_PATH__'
 
 export class PreflightHandler {
-  private dispatcher: RelayDispatcher
-
-  constructor(dispatcher: RelayDispatcher) {
-    this.dispatcher = dispatcher
+  constructor(private readonly dispatcher: RelayDispatcher) {
     this.registerHandlers()
   }
 
@@ -53,9 +50,7 @@ export class PreflightHandler {
     )
   }
 
-  // Why: the client sends the command list rather than importing TUI_AGENT_CONFIG
-  // on the relay side. This keeps the relay bundle minimal and makes the protocol
-  // self-describing — the relay doesn't need to know the agent catalog.
+  // Why: client-supplied commands keep the relay independent of the agent catalog.
   private async detectAgents(params: Record<string, unknown>): Promise<{
     agents: string[]
     versions?: Record<string, string>
@@ -66,9 +61,11 @@ export class PreflightHandler {
     }
     const probeCommands = [
       ...new Set(
-        commands
-          .filter((command) => !isDetectionUnsupportedInRuntime(command, process.platform))
-          .flatMap((command) => [command.cmd, ...(command.requiredCommands ?? [])])
+        commands.flatMap((command) =>
+          isDetectionUnsupportedInRuntime(command, process.platform)
+            ? []
+            : [command.cmd, ...(command.requiredCommands ?? [])]
+        )
       )
     ]
 
diff --git a/src/relay/pty-handler-agent-workspace-trust.test.ts b/src/relay/pty-handler-agent-workspace-trust.test.ts
new file mode 100644
index 00000000000..3acdda6ab2e
--- /dev/null
+++ b/src/relay/pty-handler-agent-workspace-trust.test.ts
@@ -0,0 +1,96 @@
+import './mock-descendant-sweep'
+import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+const { mockPtySpawn, mockPtyInstance, mockCreateShellPromptReadinessProbe, mockApplyTrust } =
+  vi.hoisted(() => ({
+    mockPtySpawn: vi.fn(),
+    mockCreateShellPromptReadinessProbe: vi.fn(),
+    mockApplyTrust: vi.fn(),
+    mockPtyInstance: {
+      pid: process.pid,
+      onData: vi.fn(),
+      onExit: vi.fn(),
+      write: vi.fn(),
+      resize: vi.fn(),
+      kill: vi.fn(),
+      clear: vi.fn(),
+      pause: vi.fn(),
+      resume: vi.fn()
+    }
+  }))
+
+vi.mock('node-pty', () => ({
+  spawn: mockPtySpawn
+}))
+
+vi.mock('../main/pty/posix-pty-process-groups', () => ({
+  forceKillPosixPtyProcessGroups: vi.fn((_pid: number, fallback: () => void) => fallback())
+}))
+
+vi.mock('../main/shell-prompt-readiness-probe', () => ({
+  createShellPromptReadinessProbe: mockCreateShellPromptReadinessProbe
+}))
+
+vi.mock('./agent-workspace-trust-spawn', () => ({
+  applyRelayAgentWorkspaceTrust: mockApplyTrust
+}))
+
+import type { PtyHandler } from './pty-handler'
+import { beginPtyHandlerTest, endPtyHandlerTest } from './pty-handler-test-harness'
+import type { MockDispatcher } from './pty-handler-test-harness'
+
+describe('relay pty.spawn agent workspace trust', () => {
+  let dispatcher: MockDispatcher
+  let handler: PtyHandler
+  let originalPlatform: PropertyDescriptor | undefined
+  let root: string
+
+  beforeEach(() => {
+    ;({ dispatcher, handler, originalPlatform } = beginPtyHandlerTest({
+      mockPtySpawn,
+      mockPtyInstance,
+      mockCreateShellPromptReadinessProbe
+    }))
+    mockApplyTrust.mockReset()
+    root = mkdtempSync(join(tmpdir(), 'orca-relay-trust-spawn-'))
+  })
+
+  afterEach(async () => {
+    await endPtyHandlerTest(handler, originalPlatform)
+    rmSync(root, { recursive: true, force: true })
+  })
+
+  it("writes the launch's trust with its final env before the agent's process starts", async () => {
+    let finishTrust = (): void => {}
+    mockApplyTrust.mockReturnValue(
+      new Promise<void>((resolve) => {
+        finishTrust = resolve
+      })
+    )
+    const request = { workspacePath: root }
+
+    const spawned = dispatcher.callRequest('pty.spawn', {
+      cols: 80,
+      rows: 24,
+      cwd: root,
+      launchAgent: 'codex',
+      env: { CODEX_HOME: '/remote/codex-home' },
+      agentWorkspaceTrust: request
+    })
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(mockApplyTrust).toHaveBeenCalledWith(
+      request,
+      'codex',
+      expect.objectContaining({ CODEX_HOME: '/remote/codex-home' }),
+      { wslShell: false }
+    )
+    expect(mockPtySpawn).not.toHaveBeenCalled()
+    finishTrust()
+    await spawned
+    expect(mockPtySpawn).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/relay/pty-handler-attach-replay.test.ts b/src/relay/pty-handler-attach-replay.test.ts
index 5ec55a6eb2a..571290e59cf 100644
--- a/src/relay/pty-handler-attach-replay.test.ts
+++ b/src/relay/pty-handler-attach-replay.test.ts
@@ -501,26 +501,10 @@ describe('PtyHandler', () => {
 })
 
 describe('attachIdentityMismatches', () => {
-  it('rejects a paneKey collision across relay generations', () => {
-    // Old lease expects tab-a's pane; the reset relay's pty-1 belongs to tab-b.
-    expect(
-      attachIdentityMismatches({ paneKey: 'tab-a:0' }, { paneKey: 'tab-b:0', tabId: 'tab-b' })
-    ).toBe(true)
-  })
-
   it('rejects a tabId collision when only tab identity is known', () => {
     expect(attachIdentityMismatches({ tabId: 'tab-a' }, { tabId: 'tab-b' })).toBe(true)
   })
 
-  it('accepts a matching identity', () => {
-    expect(
-      attachIdentityMismatches(
-        { paneKey: 'tab-a:0', tabId: 'tab-a' },
-        { paneKey: 'tab-a:0', tabId: 'tab-a' }
-      )
-    ).toBe(false)
-  })
-
   it('stays permissive when the caller supplies no identity', () => {
     expect(attachIdentityMismatches({}, { paneKey: 'tab-a:0', tabId: 'tab-a' })).toBe(false)
   })
diff --git a/src/relay/pty-handler-output-streaming.test.ts b/src/relay/pty-handler-output-streaming.test.ts
index af0a4cbdfaa..1030d98ca42 100644
--- a/src/relay/pty-handler-output-streaming.test.ts
+++ b/src/relay/pty-handler-output-streaming.test.ts
@@ -1,3 +1,5 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
 import './mock-descendant-sweep'
 import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest'
 import { PTY_STARTUP_INGRESS_VERSION } from '../shared/pty-startup-ingress'
@@ -150,6 +152,34 @@ describe('PtyHandler', () => {
     expect(dispatcher.notify).toHaveBeenCalledWith('pty.data', { id: PTY_1, data: 'hello world' })
   })
 
+  it('publishes Freebuff host status without charging synthetic OSC bytes to the PTY', async () => {
+    let onData: ((data: string) => void) | undefined
+    mockPtySpawn.mockReturnValue({
+      ...mockPtyInstance,
+      onData: vi.fn((callback: (data: string) => void) => {
+        onData = callback
+      })
+    })
+    await dispatcher.callRequest('pty.spawn', { launchAgent: 'freebuff', cols: 120, rows: 40 })
+    const raw = readFileSync(
+      join(import.meta.dirname, '../main/runtime/__fixtures__/freebuff-trust.txt'),
+      'utf8'
+    )
+    onData!(raw)
+    vi.advanceTimersByTime(8)
+    expect(dispatcher.notify).toHaveBeenCalledWith('pty.data', {
+      id: PTY_1,
+      data: expect.stringContaining('"state":"blocked"'),
+      rawLength: raw.length,
+      seq: raw.length,
+      transformed: true
+    })
+    dispatcher.notify.mockClear()
+    onData!('more output')
+    vi.advanceTimersByTime(8)
+    expect(dispatcher.notify).toHaveBeenCalledWith('pty.data', { id: PTY_1, data: 'more output' })
+  })
+
   it('consumes capable startup queries before relay replay and fanout', async () => {
     let dataCallback: ((data: string) => void) | undefined
     const term = {
diff --git a/src/relay/pty-handler-shell-recovery.test.ts b/src/relay/pty-handler-shell-recovery.test.ts
new file mode 100644
index 00000000000..54497cd1763
--- /dev/null
+++ b/src/relay/pty-handler-shell-recovery.test.ts
@@ -0,0 +1,209 @@
+import './mock-descendant-sweep'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { PROCESS_BOUNDARY_GROUND } from '../shared/terminal-mode-reset-profiles'
+import { RelayDispatcher, type RelayClientSessionIdentity } from './dispatcher'
+import { encodeJsonRpcFrame, MessageType } from './protocol'
+import { PtyHandler } from './pty-handler'
+import { TEST_PTY_ID_MINT_EPOCH } from './pty-handler-test-harness'
+import { RelayPtySourcePublication } from './relay-pty-source-publication'
+import { SshPtyConsumerSessionAdapter } from './ssh-pty-consumer-session-adapter'
+
+const { mockPtySpawn, mockConfirmShellForeground } = vi.hoisted(() => ({
+  mockPtySpawn: vi.fn(),
+  mockConfirmShellForeground: vi.fn()
+}))
+
+vi.mock('node-pty', () => ({ spawn: mockPtySpawn }))
+vi.mock('../main/daemon/pty-subprocess/pty-shell-foreground-confirmation', () => ({
+  confirmPtyShellForeground: mockConfirmShellForeground
+}))
+
+const endpointIdentity: RelayClientSessionIdentity = {
+  principal: 'endpoint-principal',
+  authenticated: true,
+  allowSessionOwner: true,
+  authenticationKind: 'endpoint-credential'
+}
+
+// A command that pushed kitty keyboard flags and died without popping them.
+const DYING_COMMAND = '\x1b]133;C\x07\x1b[>1u'
+const COMMAND_DONE = '\x1b]133;D;130\x07'
+const PROMPT = '$ '
+
+type Frame = {
+  method?: string
+  id?: number
+  params?: Record<string, unknown>
+  result?: Record<string, unknown>
+}
+
+function requestFrame(id: number, method: string, params: Record<string, unknown>): Buffer {
+  return encodeJsonRpcFrame({ jsonrpc: '2.0', id, method, params }, id, 0)
+}
+
+function decode(buffer: Buffer): Frame | null {
+  if (buffer[0] !== MessageType.Regular) {
+    return null
+  }
+  const length = buffer.readUInt32BE(9)
+  return JSON.parse(buffer.subarray(13, 13 + length).toString('utf8'))
+}
+
+describe.each([
+  ['source-credit delivery', true],
+  ['legacy delivery', false]
+])('PtyHandler shell recovery over %s', (_, sourceCredit) => {
+  let dispatcher: RelayDispatcher
+  let handler: PtyHandler
+  let writes: Buffer[]
+  let emitData: (data: string) => void
+  let emitExit: (event: { exitCode: number }) => void
+  let ptyId: string
+  let originalPlatform: PropertyDescriptor | undefined
+
+  beforeEach(async () => {
+    vi.useFakeTimers()
+    originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform')
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'linux' })
+    writes = []
+    mockConfirmShellForeground.mockReset()
+    mockPtySpawn.mockReset()
+    mockPtySpawn.mockReturnValue({
+      pid: process.pid,
+      onData: vi.fn((callback: (data: string) => void) => (emitData = callback)),
+      onExit: vi.fn((callback: (event: { exitCode: number }) => void) => (emitExit = callback)),
+      write: vi.fn(),
+      resize: vi.fn(),
+      kill: vi.fn(),
+      clear: vi.fn(),
+      pause: vi.fn(),
+      resume: vi.fn(),
+      destroy: vi.fn()
+    })
+    dispatcher = new RelayDispatcher(
+      (data, settle) => {
+        writes.push(Buffer.from(data))
+        queueMicrotask(() => settle({ ok: true }))
+        return true
+      },
+      { supportsWriteCallback: true, writableHighWaterMark: () => 0 },
+      endpointIdentity
+    )
+    handler = new PtyHandler(dispatcher, undefined, TEST_PTY_ID_MINT_EPOCH)
+    if (sourceCredit) {
+      let publication: RelayPtySourcePublication | undefined
+      const adapter = new SshPtyConsumerSessionAdapter(dispatcher, 'build-a', undefined, (id) =>
+        publication?.onCreditAvailable(id)
+      )
+      publication = new RelayPtySourcePublication(dispatcher, adapter, (id) =>
+        handler.handleSourcePublicationCapacity(id)
+      )
+      handler.setSourcePublication(publication)
+      dispatcher.feed(
+        requestFrame(1, 'pty.openClient', {
+          protocolVersion: 1,
+          clientInstanceId: 'client-1',
+          requestedRole: 'session-owner',
+          capabilities: { outputFlowControl: { versions: [1], requestedWindowSu: 256 * 1024 } }
+        })
+      )
+      await vi.advanceTimersByTimeAsync(0)
+    }
+    dispatcher.feed(requestFrame(2, 'pty.spawn', {}))
+    await vi.advanceTimersByTimeAsync(0)
+    ptyId = String(response(2)?.id)
+  })
+
+  afterEach(async () => {
+    await handler.dispose({ waitForPhysicalExit: false }).catch(() => {})
+    dispatcher.dispose()
+    if (originalPlatform) {
+      Object.defineProperty(process, 'platform', originalPlatform)
+    }
+    vi.useRealTimers()
+  })
+
+  function response(id: number): Record<string, unknown> | undefined {
+    return writes.map(decode).find((frame) => frame?.id === id)?.result
+  }
+
+  function published(): string {
+    const frames = writes.map(decode).filter((frame) => frame?.method === 'pty.data')
+    if (sourceCredit) {
+      expect(frames.every((frame) => frame?.params?.sourceLengthSu !== undefined)).toBe(true)
+    }
+    return frames.map((frame) => frame?.params?.data).join('')
+  }
+
+  async function replay(): Promise<string> {
+    dispatcher.feed(
+      requestFrame(3, 'pty.attach', {
+        id: ptyId,
+        requireReplay: true,
+        suppressReplayNotification: true
+      })
+    )
+    await vi.advanceTimersByTimeAsync(0)
+    return String(response(3)?.replay ?? '')
+  }
+
+  async function stream(...chunks: string[]): Promise<void> {
+    for (const chunk of chunks) {
+      emitData(chunk)
+    }
+    await vi.advanceTimersByTimeAsync(50)
+  }
+
+  it('grounds a dead command before the prompt, live and in replay alike', async () => {
+    mockConfirmShellForeground.mockResolvedValue(true)
+    await stream(DYING_COMMAND, `${COMMAND_DONE}${PROMPT}`)
+
+    const expected = `${DYING_COMMAND}${COMMAND_DONE}${PROCESS_BOUNDARY_GROUND}${PROMPT}`
+    expect(mockConfirmShellForeground).toHaveBeenCalledOnce()
+    expect(published()).toBe(expected)
+    expect(await replay()).toBe(expected)
+  })
+
+  it('leaves the bytes unchanged when the shell does not own the foreground', async () => {
+    mockConfirmShellForeground.mockResolvedValue(false)
+    await stream(DYING_COMMAND, `${COMMAND_DONE}${PROMPT}`)
+
+    const expected = `${DYING_COMMAND}${COMMAND_DONE}${PROMPT}`
+    expect(published()).toBe(expected)
+    expect(await replay()).toBe(expected)
+  })
+
+  it('delivers a dying app’s oversized final frame and the ground behind it', async () => {
+    mockConfirmShellForeground.mockResolvedValue(true)
+    const finalFrame = 'x'.repeat(20 * 1024)
+    await stream(DYING_COMMAND, `${finalFrame}${COMMAND_DONE}${PROMPT}`)
+
+    const expected = `${DYING_COMMAND}${finalFrame}${COMMAND_DONE}${PROCESS_BOUNDARY_GROUND}${PROMPT}`
+    expect(published()).toBe(expected)
+    expect(await replay()).toBe(expected)
+  })
+
+  it('flushes the held prompt when the shell exits mid-proof', async () => {
+    mockConfirmShellForeground.mockReturnValue(new Promise(() => {}))
+    await stream(DYING_COMMAND, `${COMMAND_DONE}${PROMPT}`)
+    expect(published()).not.toContain(PROMPT)
+
+    emitExit({ exitCode: 0 })
+    await vi.advanceTimersByTimeAsync(50)
+
+    expect(published()).toBe(`${DYING_COMMAND}${COMMAND_DONE}${PROMPT}`)
+  })
+
+  it('grounds replay, not the live stream, on Reset Terminal after an unhooked crash', async () => {
+    // Armed with no command end: nothing the host barrier could ground at.
+    const unhookedCrash = '\x1b[>1u\x1b[?1000h'
+    await stream(unhookedCrash, PROMPT)
+
+    dispatcher.feed(requestFrame(4, 'pty.resetInputModes', { id: ptyId }))
+    await vi.advanceTimersByTimeAsync(50)
+
+    // The client grounds its own view; a zero-raw span would not cross the credit window.
+    expect(published()).toBe(`${unhookedCrash}${PROMPT}`)
+    expect(await replay()).toBe(`${unhookedCrash}${PROMPT}${PROCESS_BOUNDARY_GROUND}`)
+  })
+})
diff --git a/src/relay/pty-handler-spawn-environment.test.ts b/src/relay/pty-handler-spawn-environment.test.ts
index eff0f68f2fa..57f041c2b8f 100644
--- a/src/relay/pty-handler-spawn-environment.test.ts
+++ b/src/relay/pty-handler-spawn-environment.test.ts
@@ -336,6 +336,33 @@ describe('PtyHandler', () => {
       }
     )
 
+    it.each(['process', 'client'])(
+      'drops an ORCA_CODEX_LAUNCH_PREFLIGHT from the relay %s env',
+      async (source) => {
+        const inherited = '/opt/orca/bin/orca'
+        const previous = process.env.ORCA_CODEX_LAUNCH_PREFLIGHT
+        if (source === 'process') {
+          process.env.ORCA_CODEX_LAUNCH_PREFLIGHT = inherited
+        }
+        try {
+          await dispatcher.callRequest('pty.spawn', {
+            cols: 80,
+            rows: 24,
+            ...(source === 'client' ? { env: { ORCA_CODEX_LAUNCH_PREFLIGHT: inherited } } : {})
+          })
+        } finally {
+          if (previous === undefined) {
+            delete process.env.ORCA_CODEX_LAUNCH_PREFLIGHT
+          } else {
+            process.env.ORCA_CODEX_LAUNCH_PREFLIGHT = previous
+          }
+        }
+
+        const spawnEnv = mockPtySpawn.mock.calls.at(-1)?.[2]?.env as Record<string, string>
+        expect(spawnEnv.ORCA_CODEX_LAUNCH_PREFLIGHT).toBeUndefined()
+      }
+    )
+
     it('drops an ORCA_HISTFILE handed over in the client env', async () => {
       await dispatcher.callRequest('pty.spawn', {
         cols: 80,
@@ -606,6 +633,54 @@ describe('PtyHandler', () => {
     expect(callArgs.env.ORCA_TAB_ID).toBe('tab-1')
   })
 
+  it('mirrors pane identity onto its scrub-safe aliases for a remote spawn', async () => {
+    // Why the relay and not just the shared helper: a remote pane's env is built here, and an
+    // agent whose harness drops KEY/TOKEN names (DSH) has nothing to attribute its hooks to.
+    await dispatcher.callRequest('pty.spawn', {
+      cols: 80,
+      rows: 24,
+      env: { ORCA_PANE_KEY: 'tab-1:0', ORCA_AGENT_LAUNCH_TOKEN: 't' }
+    })
+
+    const callArgs = mockPtySpawn.mock.calls[0][2] as { env: Record<string, string> }
+    expect(callArgs.env.ORCA_AGENT_PANE).toBe('tab-1:0')
+    expect(callArgs.env.ORCA_AGENT_LAUNCH).toBe('t')
+    expect(callArgs.env.ORCA_PANE_KEY).toBe('tab-1:0')
+  })
+
+  it("drops an alias the relay's own env carries when the spawn claims no identity", async () => {
+    // Why: the relay is itself startable from an Orca pane, so inheriting either name would
+    // attribute this pane's hooks to whichever row started the relay.
+    const previous = {
+      pane: process.env.ORCA_PANE_KEY,
+      launch: process.env.ORCA_AGENT_LAUNCH_TOKEN,
+      paneAlias: process.env.ORCA_AGENT_PANE
+    }
+    process.env.ORCA_PANE_KEY = 'relays-own-pane'
+    process.env.ORCA_AGENT_LAUNCH_TOKEN = 'relays-own-launch'
+    process.env.ORCA_AGENT_PANE = 'stale-alias'
+    try {
+      await dispatcher.callRequest('pty.spawn', { cols: 80, rows: 24 })
+    } finally {
+      for (const [key, value] of [
+        ['ORCA_PANE_KEY', previous.pane],
+        ['ORCA_AGENT_LAUNCH_TOKEN', previous.launch],
+        ['ORCA_AGENT_PANE', previous.paneAlias]
+      ] as const) {
+        if (value === undefined) {
+          delete process.env[key]
+        } else {
+          process.env[key] = value
+        }
+      }
+    }
+
+    const callArgs = mockPtySpawn.mock.calls[0][2] as { env: Record<string, string> }
+    expect(callArgs.env.ORCA_PANE_KEY).toBeUndefined()
+    expect(callArgs.env.ORCA_AGENT_PANE).toBeUndefined()
+    expect(callArgs.env.ORCA_AGENT_LAUNCH).toBeUndefined()
+  })
+
   it('passes PTY and explicit launch identity to env augmenters', async () => {
     const seenContexts: {
       id: string
diff --git a/src/relay/pty-handler.ts b/src/relay/pty-handler.ts
index 2daa4311234..58a98785202 100644
--- a/src/relay/pty-handler.ts
+++ b/src/relay/pty-handler.ts
@@ -1,3 +1,5 @@
+import { FreebuffStatusProjection } from './freebuff-status-projection'
+import { applyRelayAgentWorkspaceTrust } from './agent-workspace-trust-spawn'
 /* oxlint-disable max-lines */
 import type { IPty } from 'node-pty'
 import { killWithDescendantSweep } from '../main/pty-descendant-termination'
@@ -18,6 +20,7 @@ import {
 import { inspectPtyChildProcesses, processHasChildren } from './pty-child-process-inspection'
 import { getRelayShellLaunchConfig, isRelayWslShell } from './pty-shell-launch'
 import { RetiredPaneSurfaceRegistry } from './retired-pane-surfaces'
+import { applyScrubSafeAgentEnvAliases } from '../shared/agent-hook-scrub-safe-env'
 import { addWslEnvKeys } from '../shared/wsl-env'
 import {
   ORCA_IMAGE_PROTOCOL_ENV,
@@ -76,6 +79,8 @@ import {
 } from '../shared/pty-startup-ingress'
 import { resolvePtyOwnerBackend, type PtyOwnerBackend } from '../shared/pty-owner-backend'
 import { RecentPtyOutputBuffer } from '../main/runtime/recent-pty-output-buffer'
+import { TerminalShellRecoveryBarrier } from '../main/daemon/terminal-shell-recovery-barrier'
+import { confirmPtyShellForeground } from '../main/daemon/pty-subprocess/pty-shell-foreground-confirmation'
 import {
   resolveAgentForegroundProcessesBatch,
   resolveRemoteForegroundEvidence,
@@ -202,6 +207,7 @@ function parseSourceRecoveryRequest(value: unknown): PtySourceRecoveryRequest |
 }
 
 type ManagedPty = {
+  freebuffStatus?: FreebuffStatusProjection
   id: string
   incarnationId: string
   pty: IPty
@@ -246,6 +252,7 @@ type ManagedPty = {
   forceKillSent?: boolean
   gracefulKillSent?: boolean
   startupIngress?: PtyStartupIngress
+  recoveryBarrier?: TerminalShellRecoveryBarrier
   startupIngressIntent?: ReturnType<typeof parsePtyStartupIngressIntent>
   ownerBackend: PtyOwnerBackend
   agentSessionOwners?: AgentSessionOwnerBinding[]
@@ -839,6 +846,8 @@ export class PtyHandler {
     // pane to another worktree's history file — and wrapping a zsh pane that
     // nothing asked to wrap, since `history` is selected on its presence.
     delete result.ORCA_HISTFILE
+    // Why: the codex wrapper runs this path as hook prep, and a relay pane never gets one of its own.
+    delete result.ORCA_CODEX_LAUNCH_PREFLIGHT
     // Why: match local/daemon precedence so defaults/augmenters can't resurrect explicitly-removed values.
     for (const key of envToDelete) {
       delete result[key]
@@ -850,6 +859,22 @@ export class PtyHandler {
     if (!result.TERM) {
       result.TERM = 'xterm-256color'
     }
+    // Why: the relay's own process env can carry pane identity (it is itself startable from
+    // an Orca pane), and unlike the local and daemon builders this one never dropped it. A
+    // spawn that specified no identity would then inherit someone else's, and every agent's
+    // hook would report against that pane. Drop it before mirroring, so an alias can only
+    // ever carry identity this spawn actually asked for.
+    for (const key of ['ORCA_PANE_KEY', 'ORCA_AGENT_LAUNCH_TOKEN'] as const) {
+      if (!rendererEnv || !Object.hasOwn(rendererEnv, key)) {
+        delete result[key]
+      }
+    }
+    // Why here and not only in the local/daemon builders: a remote pane's env is built HERE,
+    // and the client forwards only the canonical pane-identity names. An agent whose harness
+    // scrubs those names (DSH drops any env var whose name contains KEY or TOKEN) would find
+    // nothing to attribute its hooks to, so remote status would silently never appear even
+    // with the remote hook installed.
+    applyScrubSafeAgentEnvAliases(result)
     // Why last, not beside the scrubbers above: the relay runs those BEFORE envToDelete,
     // so an envToDelete of CONDA_PREFIX would otherwise re-create the broken pair.
     dropIncoherentCondaActivationEnv(result, process.platform)
@@ -951,20 +976,29 @@ export class PtyHandler {
     this.notifyPoolListener(this.ptyPoolActiveListener, 'pty-pool-active')
     const emitIngressData = (emission: PtyIngressEmission): void => {
       const rawLength = emission.rawEndSeq - emission.rawStartSeq
-      this.appendReplayBuffer(managed, emission.data)
+      const data = managed.freebuffStatus?.project(emission.data) ?? emission.data
+      this.appendReplayBuffer(managed, data)
       this.enqueuePtyOutput(
         managed.id,
-        emission.data,
-        emission.transformed || rawLength !== emission.data.length
+        data,
+        emission.transformed || rawLength !== data.length
           ? { rawLength, seq: emission.rawEndSeq, transformed: true }
           : {}
       )
     }
-    managed.startupIngress ??= new PtyStartupIngress({
+    const isDead = (): boolean => managed.disposed === true
+    const recoveryBarrier = new TerminalShellRecoveryBarrier({
+      confirmShellForeground: () =>
+        confirmPtyShellForeground({ process: managed.pty, shellPath: managed.shellPath, isDead }),
+      release: emitIngressData,
+      isAlive: () => !isDead()
+    })
+    managed.recoveryBarrier = recoveryBarrier
+    managed.startupIngress = new PtyStartupIngress({
       ...(managed.startupIngressIntent ? { intent: managed.startupIngressIntent } : {}),
       ownerBackend: managed.ownerBackend,
       write: (data) => managed.pty.write(data),
-      onEmission: emitIngressData
+      onEmission: (emission) => recoveryBarrier.accept(emission)
     })
     const startup = managed.startupCommand
     if (startup?.waitForShellReady) {
@@ -1054,6 +1088,11 @@ export class PtyHandler {
       managed.startupCommand = undefined
     }
     managed.startupIngress?.drainAndClose()
+    // Why after drainAndClose: drained ingress bytes re-enter the barrier; a
+    // teardown mid-proof must still deliver the held prompt before exit.
+    managed.recoveryBarrier?.flushPending()
+    managed.recoveryBarrier?.dispose()
+    managed.freebuffStatus?.dispose()
   }
 
   private notifyExitListener(managed: ManagedPty): void {
@@ -1082,6 +1121,7 @@ export class PtyHandler {
     this.dispatcher.onRequest('pty.getInitialCwd', (p) => this.getInitialCwd(p))
     this.dispatcher.onRequest('pty.getSize', (p) => this.getSize(p))
     this.dispatcher.onRequest('pty.clearBuffer', (p) => this.clearBuffer(p))
+    this.dispatcher.onRequest('pty.resetInputModes', (p) => this.resetInputModes(p))
     this.dispatcher.onRequest('pty.hasChildProcesses', (p) => this.hasChildProcesses(p))
     this.dispatcher.onRequest('pty.getForegroundProcess', (p) => this.getForegroundProcess(p))
     this.dispatcher.onRequest('pty.inspectProcess', (p) => this.inspectProcess(p))
@@ -1883,6 +1923,9 @@ export class PtyHandler {
       { id, paneKey, shell, command, launchAgent },
       envToDelete
     )
+    await applyRelayAgentWorkspaceTrust(params.agentWorkspaceTrust, launchAgent, spawnEnv, {
+      wslShell: isRelayWslShell(shell)
+    })
     const worktreeId =
       typeof params.worktreeId === 'string' ? params.worktreeId : env?.ORCA_WORKTREE_ID
     const historyIsolationEnabled = params.historyIsolationEnabled === true
@@ -1979,6 +2022,9 @@ export class PtyHandler {
     const ownerClientInstanceId =
       context === undefined ? null : (this.consumerIdentityResolver?.(context.clientId) ?? null)
     const managed: ManagedPty = {
+      ...(launchAgent === 'freebuff'
+        ? { freebuffStatus: new FreebuffStatusProjection(cols, rows) }
+        : {}),
       id,
       incarnationId: randomUUID(),
       pty: term,
@@ -2225,6 +2271,7 @@ export class PtyHandler {
     // npm, where the patch is not applied. So the catch below stays.
     try {
       managed.pty.resize(cols, rows)
+      managed.freebuffStatus?.resize(cols, rows)
     } catch (err) {
       // A failed ioctl observed the handle, not the host's process table, so on
       // its own it is `unverifiable`. Re-probe: a now-absent pid retires the
@@ -2646,6 +2693,15 @@ export class PtyHandler {
     }
   }
 
+  // Why the replay buffer and not the stream: a zero-raw span never crosses the
+  // credit window, and the client grounds its own view; reattach replays this.
+  private async resetInputModes(params: Record<string, unknown>): Promise<void> {
+    const managed = this.ptys.get(params.id as string)
+    if (managed?.recoveryBarrier && !managed.disposed) {
+      this.appendReplayBuffer(managed, managed.recoveryBarrier.groundInputModes())
+    }
+  }
+
   private async hasChildProcesses(params: Record<string, unknown>): Promise<boolean> {
     const id = params.id as string
     const managed = this.ptys.get(id)
diff --git a/src/relay/pty-shell-overlay-wrappers.ts b/src/relay/pty-shell-overlay-wrappers.ts
index 376d422f073..55251883661 100644
--- a/src/relay/pty-shell-overlay-wrappers.ts
+++ b/src/relay/pty-shell-overlay-wrappers.ts
@@ -1,6 +1,7 @@
 import { readFileSync, statSync } from 'node:fs'
 import { join } from 'node:path'
 import { getPosixOmpShellWrapper } from '../main/pty/omp-shell-wrapper'
+import { getPosixCodexShellLaunchPreflight } from '../main/pty/codex-shell-launch-preflight'
 import {
   BASH_FEATURE_CHANNEL_BLOCK,
   BASH_PROMPT_COMMAND_COMPOSITION_BLOCK,
@@ -32,10 +33,10 @@ function getRelayZshWrapperSpec(): ZshStartupHookSpec {
     overlayRestoreComment:
       '# Why: remote startup files can re-export user defaults after relay spawn.',
     restores: {
+      managedWslCli: false,
       agentTeamsPath: false,
       remoteCliBinDir: true,
-      codexHome: false,
-      codexLaunchPreflight: false
+      codexHome: false
     }
   }
 }
@@ -73,7 +74,7 @@ fi
 [[ -n "\${ORCA_MIMOCODE_HOME:-}" ]] && export MIMOCODE_HOME="\${ORCA_MIMOCODE_HOME}"
 [[ -n "\${ORCA_REMOTE_CLI_BIN_DIR:-}" ]] && case ":$PATH:" in *:"\${ORCA_REMOTE_CLI_BIN_DIR}":*) ;; *) export PATH="\${ORCA_REMOTE_CLI_BIN_DIR}:$PATH" ;; esac
 ${getPosixOmpShellWrapper()}
-${BASH_HISTFILE_RESTORE_BLOCK}
+${getPosixCodexShellLaunchPreflight()}${BASH_HISTFILE_RESTORE_BLOCK}
 # Why: SSH bash sessions need the same command lifecycle markers as local
 # bash so agent rows stop showing "working" when the foreground command exits.
 __orca_initializing_wrapper=1
diff --git a/src/relay/relay-agent-hook-runtime.ts b/src/relay/relay-agent-hook-runtime.ts
index 7ab4bf01162..bc1cef97137 100644
--- a/src/relay/relay-agent-hook-runtime.ts
+++ b/src/relay/relay-agent-hook-runtime.ts
@@ -19,8 +19,9 @@ import {
   isPiCompatibleAgentType
 } from '../shared/pi-agent-kind'
 import { resolveSetupAgentSequenceLaunchCommand } from '../shared/setup-agent-sequencing'
-import { isOpenCode2LaunchCommand } from '../shared/opencode-launch-command'
+import { selectOpenCodeHookAgent } from '../shared/opencode-launch-command'
 import { relayLogLine } from './relay-diagnostic-log'
+import { restoreOrStripOverlayEnv } from '../shared/agent-overlay-env'
 import { registerManagedHookInstaller } from './managed-hook-installer'
 
 export class RelayAgentHookRuntime {
@@ -85,12 +86,22 @@ export class RelayAgentHookRuntime {
     const env: Record<string, string> = {}
     const overlayId = context.paneKey ?? context.id
     const launchCommandHint = resolveSetupAgentSequenceLaunchCommand(context.env, context.command)
-    const opencodeAgent =
-      context.launchAgent === 'opencode2' || isOpenCode2LaunchCommand(launchCommandHint)
-        ? 'opencode2'
-        : 'opencode'
-    env.ORCA_OPENCODE_AGENT = opencodeAgent
-    if (this.pluginOverlay.hasOpenCodeSource(opencodeAgent)) {
+    const opencodeAgent = selectOpenCodeHookAgent(context.launchAgent, launchCommandHint, (agent) =>
+      this.pluginOverlay.hasOpenCodeSource(agent)
+    )
+    restoreOrStripOverlayEnv(
+      context.env,
+      {
+        primary: 'OPENCODE_CONFIG_DIR',
+        overlay: 'ORCA_OPENCODE_CONFIG_DIR',
+        source: 'ORCA_OPENCODE_SOURCE_CONFIG_DIR',
+        preserveExplicitPrimary: true
+      },
+      {}
+    )
+    delete context.env.ORCA_OPENCODE_AGENT
+    if (opencodeAgent) {
+      env.ORCA_OPENCODE_AGENT = opencodeAgent
       const sourceDir = resolveOpenCodeSourceConfigDir(context.env, context.shell)
       const inheritedRelayOverlay = sourceDir
         ? this.pluginOverlay.isRelayOverlayPath(sourceDir)
diff --git a/src/relay/relay-watch-root-capacity-gate.ts b/src/relay/relay-watch-root-capacity-gate.ts
index 4e430332be2..c275e303507 100644
--- a/src/relay/relay-watch-root-capacity-gate.ts
+++ b/src/relay/relay-watch-root-capacity-gate.ts
@@ -63,11 +63,19 @@ export class RelayWatchRootCapacityGate {
     this.waiting.add(rootKey)
     // Once, and never past the caller: a genuinely full cap must still reach the refusal that sends
     // the client dormant, and an unsubscribe that never settles must not park the request with it.
-    return (signal ? Promise.race([released, abortSignalSettled(signal)]) : released).finally(
-      () => {
-        this.waiting.delete(rootKey)
+    let onAbort = (): void => {}
+    const abandoned = new Promise<void>((resolve) => {
+      onAbort = () => resolve()
+      if (signal?.aborted) {
+        resolve()
+      } else {
+        signal?.addEventListener('abort', onAbort, { once: true })
       }
-    )
+    })
+    return (signal ? Promise.race([released, abandoned]) : released).finally(() => {
+      signal?.removeEventListener('abort', onAbort)
+      this.waiting.delete(rootKey)
+    })
   }
 
   /** Setup roots that currently hold a slot — a parked capacity waiter holds none. */
@@ -75,12 +83,3 @@ export class RelayWatchRootCapacityGate {
     return [...this.setupRoots.keys()].filter((key) => key === rootKey || !this.waiting.has(key))
   }
 }
-
-/** Resolves (never rejects) when the request is abandoned, so a race can drop out of a wait. */
-function abortSignalSettled(signal: AbortSignal): Promise<void> {
-  return signal.aborted
-    ? Promise.resolve()
-    : new Promise<void>((resolve) =>
-        signal.addEventListener('abort', () => resolve(), { once: true })
-      )
-}
diff --git a/src/relay/relay-watch-root-capacity.test.ts b/src/relay/relay-watch-root-capacity.test.ts
index de5a5fc2b4b..12f70234c1d 100644
--- a/src/relay/relay-watch-root-capacity.test.ts
+++ b/src/relay/relay-watch-root-capacity.test.ts
@@ -8,6 +8,7 @@ import type { RelayDispatcher } from './dispatcher'
 import { FsHandler } from './fs-handler'
 import { subscribeWithInProcessWatcher } from '../main/ipc/parcel-watcher-in-process-fallback'
 import { createMockDispatcher } from './relay-fs-test-dispatcher'
+import { RelayWatchRootCapacityGate } from './relay-watch-root-capacity-gate'
 
 const { mockSubscribe } = vi.hoisted(() => ({
   mockSubscribe: vi.fn()
@@ -39,6 +40,50 @@ describe('relay watch-root capacity', () => {
     await fs.rm(tmpDir, { recursive: true, force: true })
   })
 
+  it('removes an abort listener after capacity teardown settles', async () => {
+    const activeRoots = new Map(Array.from({ length: 20 }, (_, index) => [`active-${index}`, {}]))
+    let resolveTeardown!: () => void
+    const teardown = new Promise<void>((resolve) => {
+      resolveTeardown = resolve
+    })
+    const gate = new RelayWatchRootCapacityGate(activeRoots, new Map(), () => ({
+      rootPaths: () => ['retiring'],
+      settlePending: () => teardown
+    }))
+    const controller = new AbortController()
+    const addListener = vi.spyOn(controller.signal, 'addEventListener')
+    const removeListener = vi.spyOn(controller.signal, 'removeEventListener')
+
+    const waiting = gate.release('new-root', controller.signal)
+    expect(waiting).toBeDefined()
+    expect(addListener).toHaveBeenCalledTimes(1)
+    resolveTeardown()
+    await waiting
+
+    expect(removeListener).toHaveBeenCalledTimes(1)
+  })
+
+  it.each([false, true])(
+    'resolves abandoned capacity waits (already aborted=%s)',
+    async (alreadyAborted) => {
+      const activeRoots = new Map(Array.from({ length: 20 }, (_, index) => [`active-${index}`, {}]))
+      const gate = new RelayWatchRootCapacityGate(activeRoots, new Map(), () => ({
+        rootPaths: () => ['retiring'],
+        settlePending: () => new Promise<void>(() => {})
+      }))
+      const controller = new AbortController()
+      if (alreadyAborted) {
+        controller.abort()
+      }
+      const removeListener = vi.spyOn(controller.signal, 'removeEventListener')
+      const waiting = gate.release('new-root', controller.signal)
+      expect(waiting).toBeDefined()
+      controller.abort()
+      await expect(waiting).resolves.toBeUndefined()
+      expect(removeListener).toHaveBeenCalledTimes(1)
+    }
+  )
+
   it('blocks replacement watches behind physical unsubscribe and counts the pending slot', async () => {
     let resolveUnsubscribe: () => void = () => {}
     const unsubscribe = vi.fn(
diff --git a/src/relay/relay-watcher-event-emitter.test.ts b/src/relay/relay-watcher-event-emitter.test.ts
index 0f0991e5c01..82b10e2fdf3 100644
--- a/src/relay/relay-watcher-event-emitter.test.ts
+++ b/src/relay/relay-watcher-event-emitter.test.ts
@@ -1,5 +1,3 @@
-import { readFileSync } from 'node:fs'
-import { fileURLToPath } from 'node:url'
 import { describe, expect, it, vi } from 'vitest'
 import type { WatcherProcessEvent } from '../main/ipc/parcel-watcher-process-protocol'
 import { RelayDispatcher } from './dispatcher'
@@ -200,13 +198,6 @@ describe('relay watcher writer admission', () => {
 })
 
 describe('relay watcher overflow suppression key', () => {
-  it('keeps the source free of NUL bytes so git and grep still see text', () => {
-    const source = readFileSync(
-      fileURLToPath(new URL('./relay-watcher-event-emitter.ts', import.meta.url))
-    )
-    expect(source.includes(0)).toBe(false)
-  })
-
   it('scopes the outstanding marker per client as well as per root', () => {
     const primary = createRecordingSink(65536)
     const secondary = createRecordingSink(65536)
diff --git a/src/renderer/src/app-shell/use-app-session-persistence.ts b/src/renderer/src/app-shell/use-app-session-persistence.ts
index e187ecb19d5..4d1e9987a09 100644
--- a/src/renderer/src/app-shell/use-app-session-persistence.ts
+++ b/src/renderer/src/app-shell/use-app-session-persistence.ts
@@ -4,6 +4,7 @@ import {
   isDirectSshRemoteWorkspaceApplyInProgress,
   onDirectSshRemoteWorkspaceApplyWindowClosed
 } from '../hooks/remote-workspace-snapshot-apply'
+import { terminalLayoutNodeEqual } from '../lib/terminal-layout-equality'
 import { createSessionWriteSubscriber } from '../lib/session-write-subscriber'
 import { buildActiveViewUnloadPatch } from '../lib/active-view-persist'
 import {
@@ -37,6 +38,8 @@ import {
   ORCA_RENDERER_UNLOAD_PREVENTED_EVENT
 } from '../../../shared/renderer-shutdown-events'
 import type { AppState } from '../store/types'
+import type { DirectSshLayoutEdit } from '../store/terminals/terminal-state'
+import type { RemoteWorkspaceObservedPatchResult } from '../../../shared/remote-workspace-types'
 import { applyRemoteWorkspacePushStatus } from '../hooks/remote-workspace-push-status'
 
 // Why: bound the resume-record loss window on a hard kill to ~1 min; capture skips unchanged records so per-tick cost is negligible.
@@ -89,6 +92,26 @@ function remoteWorkspaceUploadAuthorityIsCurrent(
   )
 }
 
+function captureUploadedDirectSshLayoutEdits(
+  pendingLayoutEdits: AppState['pendingDirectSshLayoutEditsByTabId'],
+  targetId: string,
+  result: RemoteWorkspaceObservedPatchResult | undefined
+): Record<string, DirectSshLayoutEdit> {
+  if (!result?.ok) {
+    return {}
+  }
+  return Object.fromEntries(
+    Object.entries(pendingLayoutEdits).flatMap(([tabId, entry]) => {
+      const uploaded = result.snapshot.session.terminalLayoutsByTabId[tabId]
+      return entry.targetId === targetId &&
+        uploaded &&
+        terminalLayoutNodeEqual(entry.root, uploaded.root)
+        ? [[tabId, entry]]
+        : []
+    })
+  )
+}
+
 /**
  * Writes durable renderer session state to disk: the debounced per-host writer, the remote
  * workspace upload chain, and the synchronous shutdown checkpoint.
@@ -108,6 +131,7 @@ export function useAppSessionPersistence(): void {
         const localWrite = patchWorkspaceSessionByHost(window.api.session, patch, state)
         void localWrite
         const uploadAuthorities = captureRemoteWorkspaceUploadAuthorities(state)
+        const pendingLayoutEdits = state.pendingDirectSshLayoutEditsByTabId
         if (uploadAuthorities.length > 0) {
           void (async () => {
             try {
@@ -141,6 +165,11 @@ export function useAppSessionPersistence(): void {
               for (const { targetId, result } of results ?? []) {
                 const authority = currentAuthorityByTargetId.get(targetId)
                 if (authority && remoteWorkspaceUploadAuthorityIsCurrent(resultState, authority)) {
+                  if (result?.ok) {
+                    resultState.acknowledgeDirectSshLayoutEdits(
+                      captureUploadedDirectSshLayoutEdits(pendingLayoutEdits, targetId, result)
+                    )
+                  }
                   applyRemoteWorkspacePushStatus(resultState, targetId, result, authority)
                 }
               }
diff --git a/src/renderer/src/app-shell/use-floating-workspace-panel.ts b/src/renderer/src/app-shell/use-floating-workspace-panel.ts
index 49daaec55d8..7cd3763e401 100644
--- a/src/renderer/src/app-shell/use-floating-workspace-panel.ts
+++ b/src/renderer/src/app-shell/use-floating-workspace-panel.ts
@@ -1,4 +1,11 @@
-import { useCallback, useEffect, useRef, useState, type SetStateAction } from 'react'
+import {
+  useCallback,
+  useEffect,
+  useLayoutEffect,
+  useRef,
+  useState,
+  type SetStateAction
+} from 'react'
 import {
   TOGGLE_FLOATING_TERMINAL_EVENT,
   requestFloatingTerminalOpenMaximized
@@ -111,7 +118,8 @@ export function useFloatingWorkspacePanel() {
     setOpenWithFocus(true)
   }, [setOpenWithFocus])
 
-  useEffect(() => {
+  // Why layout: enable-then-toggle callers dispatch a frame later, which a passive rebind can miss.
+  useLayoutEffect(() => {
     const toggleFloatingTerminal = (): void => {
       if (enabled) {
         setOpenWithFocus((current) => !current)
diff --git a/src/renderer/src/app-shell/use-persisted-ui-writer.ts b/src/renderer/src/app-shell/use-persisted-ui-writer.ts
index 19109c25eb2..168fb87f302 100644
--- a/src/renderer/src/app-shell/use-persisted-ui-writer.ts
+++ b/src/renderer/src/app-shell/use-persisted-ui-writer.ts
@@ -161,6 +161,7 @@ export function usePersistedUIWriter(): void {
       hideDetachedHeadWorkspaces: s.hideDetachedHeadWorkspaces,
       hideWorkspacesFromOtherDevices: s.hideWorkspacesFromOtherDevices,
       alwaysShowDefaultBranchWorkspace: s.alwaysShowDefaultBranchWorkspace,
+      explorerDisplayRootByWorktree: s.explorerDisplayRootByWorktree,
       showDotfilesByWorktree: s.showDotfilesByWorktree,
       filterRepoIds: s.filterRepoIds,
       // Why: dashboard auto-acks (fire on focus/visibility) and the in-memory ack cleanup
diff --git a/src/renderer/src/app-shell/workspace-view-cross-client-sync.test.tsx b/src/renderer/src/app-shell/workspace-view-cross-client-sync.test.tsx
index 314977a17aa..f5d404b4e10 100644
--- a/src/renderer/src/app-shell/workspace-view-cross-client-sync.test.tsx
+++ b/src/renderer/src/app-shell/workspace-view-cross-client-sync.test.tsx
@@ -6,16 +6,11 @@
 //   authority (main)  = real updatePersistedUI/getPersistedUI merge
 //   broadcast         = controlled queue modeling the async ui:stateChanged IPC send
 //   mobile client     = mobile/src/worktree/workspace-view-settings mapping; the ui.set
-//                       payload uses the shipping buildWorkspaceViewSettingsUpdate when
-//                       exported, else the legacy whole-snapshot shape — the source-pin
-//                       test asserts use-host-view-settings.ts matches whichever path is
-//                       active, so the model stays tethered to shipping code.
+//                       payload mirrors the shipping buildWorkspaceViewSettingsUpdate.
 //
 // Invariant: when two independently identified clients change DISJOINT workspace-view
 // fields concurrently or across stale-mirror windows, both changes survive and all
 // mirrors converge; no client may restore a stale sibling field.
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
 import { StrictMode, act, createElement } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
@@ -84,8 +79,7 @@ function createAuthority() {
 type Authority = ReturnType<typeof createAuthority>
 
 // Local model of mobile/src/worktree/workspace-view-settings.ts (the desktop test
-// runner cannot transform Expo-configured sources). The source-pin test at the
-// bottom fails if the shipping module stops matching this model.
+// runner cannot transform Expo-configured sources).
 type MobileViewState = {
   groupMode: 'none' | 'workspaceStatus' | 'repo' | 'prStatus'
   sortMode: 'smart' | 'name' | 'recent' | 'repo' | 'manual'
@@ -96,10 +90,6 @@ type MobileViewState = {
   collapsedGroups: string[]
 }
 
-function mobileHasPatchOnlyBuilder(): boolean {
-  return readMobileViewSettingsSource().includes('export function buildWorkspaceViewSettingsUpdate')
-}
-
 /** Mirrors buildWorkspaceViewSettingsUpdate (candidate) — only touched fields. */
 function patchOnlyUpdate(
   patch: Partial<MobileViewState>,
@@ -127,18 +117,6 @@ function patchOnlyUpdate(
   return update
 }
 
-/** Mirrors the pre-fix persistViewSettings payload — the full snapshot on every tap. */
-function legacyWholeSnapshotUpdate(next: MobileViewState): Partial<PersistedUIState> {
-  return {
-    groupBy: next.groupMode === 'workspaceStatus' ? 'workspace-status' : 'repo',
-    sortBy: next.sortMode,
-    hideSleepingWorkspaces: next.hideSleeping,
-    hideDefaultBranchWorkspace: next.hideDefaultBranch,
-    filterRepoIds: next.filterRepoIds,
-    collapsedGroups: next.collapsedGroups
-  }
-}
-
 /** Model of the mobile host screen's view-settings client (persistViewSettings et al.). */
 function createMobileClient(authority: Authority) {
   let view: MobileViewState = {
@@ -171,28 +149,12 @@ function createMobileClient(authority: Authority) {
     /** A user tap: apply locally, then push through the shipping payload shape. */
     tap(patch: Partial<MobileViewState>) {
       view = { ...view, ...patch }
-      const payload = mobileHasPatchOnlyBuilder()
-        ? patchOnlyUpdate(patch, view)
-        : legacyWholeSnapshotUpdate(view)
+      const payload = patchOnlyUpdate(patch, view)
       authority.set(omitPairingLocalUiFields(payload) as Partial<PersistedUIState>)
     }
   }
 }
 
-function readMobileViewSettingsHookSource(): string {
-  return readFileSync(
-    join(__dirname, '../../../../mobile/src/host-screen/use-host-view-settings.ts'),
-    'utf-8'
-  )
-}
-
-function readMobileViewSettingsSource(): string {
-  return readFileSync(
-    join(__dirname, '../../../../mobile/src/worktree/workspace-view-settings.ts'),
-    'utf-8'
-  )
-}
-
 describe('workspace view preferences: cross-client persistence (STA-5781)', () => {
   let authority: Authority
   let store: StoreApi<AppState>
@@ -710,35 +672,4 @@ describe('workspace view preferences: cross-client persistence (STA-5781)', () =
     expect(authority.get().hideDefaultBranchWorkspace).toBe(false)
     expect(store.getState().hideDefaultBranchWorkspace).toBe(false)
   })
-
-  it('pins the modeled mobile ui.set payload to the shipping source', async () => {
-    const source = readMobileViewSettingsHookSource()
-    if (mobileHasPatchOnlyBuilder()) {
-      // Candidate: the persistence hook must push through the patch-only builder this model uses.
-      expect(source).toContain('buildWorkspaceViewSettingsUpdate(patch, next)')
-      const builderSource = readMobileViewSettingsSource()
-      for (const guard of [
-        "if ('groupMode' in patch)",
-        "if ('sortMode' in patch)",
-        "if ('hideSleeping' in patch)",
-        "if ('hideDefaultBranch' in patch)",
-        "if ('filterRepoIds' in patch)",
-        "if ('collapsedGroups' in patch)"
-      ]) {
-        expect(builderSource).toContain(guard)
-      }
-    } else {
-      // Baseline: persistViewSettings pushes exactly this whole-snapshot payload.
-      for (const key of [
-        'groupBy: groupModeToDesktop(next.groupMode)',
-        'sortBy: next.sortMode',
-        'hideSleepingWorkspaces: next.hideSleeping',
-        'hideDefaultBranchWorkspace: next.hideDefaultBranch',
-        'filterRepoIds: next.filterRepoIds',
-        'collapsedGroups: next.collapsedGroups'
-      ]) {
-        expect(source).toContain(key)
-      }
-    }
-  })
 })
diff --git a/src/renderer/src/assets/diff-comment-draft-card-shadow-style.test.ts b/src/renderer/src/assets/diff-comment-draft-card-shadow-style.test.ts
new file mode 100644
index 00000000000..3a28acf95c6
--- /dev/null
+++ b/src/renderer/src/assets/diff-comment-draft-card-shadow-style.test.ts
@@ -0,0 +1,39 @@
+import fs from 'node:fs'
+import { describe, expect, it } from 'vitest'
+
+const mainCss = fs.readFileSync(new URL('./main.css', import.meta.url), 'utf8')
+
+function getCssRuleBody(selector: string): string {
+  const ruleMarker = mainCss.indexOf(`\n${selector} {`)
+  expect(ruleMarker).toBeGreaterThanOrEqual(0)
+
+  const ruleStart = ruleMarker + 1
+  const bodyStart = mainCss.indexOf('{', ruleStart) + 1
+  const bodyEnd = mainCss.indexOf('}', bodyStart)
+  return mainCss.slice(bodyStart, bodyEnd)
+}
+
+describe('diff comment draft card shadow', () => {
+  it('uses the documented shadow-xs tier instead of a hand-rolled fourth tier', () => {
+    const draftCard = getCssRuleBody('.orca-diff-comment-inline > .orca-diff-comment-draft-card')
+
+    // STYLEGUIDE.md caps elevation at border / shadow-xs / shadow-floating —
+    // no invented per-component shadow values.
+    expect(draftCard).toContain('shadow-xs')
+    expect(draftCard).not.toMatch(/box-shadow:\s*\n?\s*0/)
+    expect(draftCard).not.toContain('rgba(0, 0, 0,')
+  })
+
+  it('keeps the dark override at shadow-xs, not a hand-rolled or missing shadow', () => {
+    const darkDraftCard = getCssRuleBody(
+      '.dark .orca-diff-comment-inline > .orca-diff-comment-draft-card'
+    )
+
+    // Same selector specificity as `.dark .orca-diff-comment-popover` (its
+    // ancestor via the shared draft-card component), which sits later in the
+    // file — dropping this rule lets that popover's much larger floating
+    // shadow win the cascade in dark mode instead of shadow-xs.
+    expect(darkDraftCard).toContain('shadow-xs')
+    expect(darkDraftCard).not.toContain('rgba(0, 0, 0,')
+  })
+})
diff --git a/src/renderer/src/assets/main.css b/src/renderer/src/assets/main.css
index e0d1791606b..2d999cc48db 100644
--- a/src/renderer/src/assets/main.css
+++ b/src/renderer/src/assets/main.css
@@ -409,7 +409,14 @@
 
 [data-sonner-toaster] {
   font-family: var(--font-sans);
-  z-index: 40 !important;
+  z-index: var(--toaster-z-index, 40) !important;
+}
+
+/* Keep errors above standard modal backdrops at the existing popover tier.
+   Why: overlays portal straight into body, and `>` plus a :has() on body alone (not in the toaster's
+   selector) keeps unrelated DOM changes from rescanning the page; the old form froze large diffs. */
+body:has(> [data-slot='dialog-overlay'], > [data-slot='sheet-overlay']) {
+  --toaster-z-index: 60;
 }
 
 [data-sonner-toaster] [data-sonner-toast][data-styled='true'] {
@@ -719,7 +726,9 @@
   mask-image: linear-gradient(to right, transparent, #000 1.5rem, #000 100%);
 }
 
-.terminal-tab-strip--fade-end:not(.terminal-tab-strip--fade-start) {
+/* Why: the status bar's usage cluster reuses the end fade so a clipped cluster never cuts a glyph. */
+.terminal-tab-strip--fade-end:not(.terminal-tab-strip--fade-start),
+.status-bar-usage-cluster[data-overflowing='true'] {
   -webkit-mask-image: linear-gradient(to right, #000 0, #000 calc(100% - 1.5rem), transparent);
   mask-image: linear-gradient(to right, #000 0, #000 calc(100% - 1.5rem), transparent);
 }
@@ -1619,6 +1628,31 @@ html.native-shell .app-layout {
   animation: compact-agent-expansion-reveal 180ms cubic-bezier(0.16, 1, 0.3, 1) both;
 }
 
+/* Keep the disclosure in the timestamp slot without moving adjacent content. */
+.agent-child-disclosure-time {
+  visibility: hidden;
+}
+
+@media (hover: hover) {
+  .agent-child-disclosure[data-expanded='false'] .agent-child-disclosure-time {
+    visibility: visible;
+  }
+
+  .agent-child-disclosure[data-expanded='false'] [data-agent-child-disclosure-button] {
+    opacity: 0;
+  }
+
+  .agent-disclosure-row:hover .agent-child-disclosure-time,
+  .agent-disclosure-row:focus-within .agent-child-disclosure-time {
+    visibility: hidden;
+  }
+
+  .agent-disclosure-row:hover [data-agent-child-disclosure-button],
+  .agent-disclosure-row:focus-within [data-agent-child-disclosure-button] {
+    opacity: 1;
+  }
+}
+
 /* Why: the collapsed summary still uses pill spacing, while expanded compact
    agents read as a quiet tree inside the existing worktree card. */
 .compact-agent-summary-panel {
@@ -2858,6 +2892,39 @@ html.native-shell .app-layout {
   max-width: 420px;
 }
 
+/* Why: embedded card in the diff flow, not a floating popup — use the
+   documented "subtle lift" tier (shadow-xs) rather than a hand-rolled shadow.
+   Restated under `.dark` (same value) so this still outranks the base
+   `.orca-diff-comment-popover` dark shadow at equal selector specificity. */
+.orca-diff-comment-inline > .orca-diff-comment-draft-card {
+  position: relative;
+  left: auto;
+  right: auto;
+  width: 100%;
+  max-width: 420px;
+  z-index: 1;
+  @apply shadow-xs;
+}
+
+.dark .orca-diff-comment-inline > .orca-diff-comment-draft-card {
+  @apply shadow-xs;
+}
+
+.orca-diff-comment-draft-margin {
+  width: 100%;
+  height: 100%;
+  display: flex;
+  justify-content: flex-end;
+}
+
+.orca-diff-comment-draft-margin::after {
+  content: '';
+  width: 3px;
+  height: 100%;
+  background: var(--primary);
+  border-radius: 1px;
+}
+
 /* Why: the saved note used to blend into the editor background because it
    reused the same muted/background mix the editor itself uses. Stay
    grayscale to match the rest of the UI, but lift the card off the editor
diff --git a/src/renderer/src/components/AgentChildRowContent.tsx b/src/renderer/src/components/AgentChildRowContent.tsx
new file mode 100644
index 00000000000..717b8438a0b
--- /dev/null
+++ b/src/renderer/src/components/AgentChildRowContent.tsx
@@ -0,0 +1,58 @@
+import React from 'react'
+import type { AgentChildRowModel } from '../../../shared/agent-child-row-model'
+import { AgentStateDot } from '@/components/AgentStateDot'
+import type { StateIndicatorTooltipSide } from '@/components/StateIndicatorTooltip'
+import { agentChildRowText } from './agent-child-row-text'
+
+type AgentChildRowContentProps = {
+  row: AgentChildRowModel
+  now: number
+  /** Surface tone for the name and the detail; the words themselves are the row's. */
+  leadClassName: string
+  trailClassName: string
+  separator: string
+  /** Overrides the dot's hover label; null suppresses it for an existing tooltip. */
+  dotTitle?: string | null
+  tooltipSide?: StateIndicatorTooltipSide
+  /** Name the whole line on hover, for surfaces that truncate it tightly. */
+  lineTitle?: boolean
+}
+
+/**
+ * A child row's state dot, name and detail: the one piece the sidebar's child rows and the chat
+ * strip's rows both render, so the same child reads the same on both.
+ */
+export const AgentChildRowContent = React.memo(function AgentChildRowContent({
+  row,
+  now,
+  leadClassName,
+  trailClassName,
+  separator,
+  dotTitle,
+  tooltipSide,
+  lineTitle = false
+}: AgentChildRowContentProps): React.JSX.Element {
+  const { lead, trail } = agentChildRowText(row, now)
+  return (
+    <>
+      <AgentStateDot
+        state={row.displayState}
+        size="sm"
+        title={dotTitle}
+        tooltipSide={tooltipSide}
+      />
+      <span
+        className="min-w-0 flex-1 truncate"
+        title={lineTitle ? `${lead}${trail ? `${separator}${trail}` : ''}` : undefined}
+      >
+        <span className={leadClassName}>{lead}</span>
+        {trail ? (
+          <span className={trailClassName}>
+            {separator}
+            {trail}
+          </span>
+        ) : null}
+      </span>
+    </>
+  )
+})
diff --git a/src/renderer/src/components/AgentStateDot.test.ts b/src/renderer/src/components/AgentStateDot.test.ts
index 33642542d79..a767a61ccf4 100644
--- a/src/renderer/src/components/AgentStateDot.test.ts
+++ b/src/renderer/src/components/AgentStateDot.test.ts
@@ -47,15 +47,9 @@ describe('AgentStateDot', () => {
   it('renders working as a yellow spinner', () => {
     const markup = renderMarkup('working')
 
-    expect(markup).toContain('border-yellow-500')
-    expect(markup).toContain('border-t-transparent')
-    // Why: rotation must come from the compositor-driven CSS animation, not a
-    // JS clock writing per-element styles on the input thread (STA-3328).
-    expect(markup).toContain('agent-working-spinner')
+    // The spinner's own classes and animation contract belong to AgentWorkingSpinner.test.tsx;
+    // this pins only that 'working' reaches for it.
     expect(markup).toContain('data-agent-spinner')
-    // Why: under reduced motion the top border is filled so the static ring
-    // reads as a complete marker, not a broken partial spinner (#9515).
-    expect(markup).toContain('motion-reduce:border-t-yellow-500')
   })
 
   it('renders monitoring as a static yellow heartbeat glyph', () => {
diff --git a/src/renderer/src/components/NativeChatResumeOnRestartModal.test.tsx b/src/renderer/src/components/NativeChatResumeOnRestartModal.test.tsx
index 11f2bddc122..1a139b18d26 100644
--- a/src/renderer/src/components/NativeChatResumeOnRestartModal.test.tsx
+++ b/src/renderer/src/components/NativeChatResumeOnRestartModal.test.tsx
@@ -12,6 +12,7 @@ import { TooltipProvider } from './ui/tooltip'
 import type { ResumeCandidate } from './native-chat-resume-on-restart-grouping'
 import {
   consumeNativeChatResumeOnRestartDialogRequest,
+  getNativeChatResumeOnRestartDialogRequest,
   requestNativeChatResumeOnRestartDialog
 } from './native-chat-resume-on-restart-dialog'
 import {
@@ -271,6 +272,103 @@ it('never re-offers a resumed chat when the status entry reopens the dialog', as
   expect(document.querySelectorAll('[role="checkbox"]')).toHaveLength(2)
 })
 
+// The resume outlives the dialog, as a skill update does: the status bar carries it while in flight.
+it('closes on Resume and shows the resume in the status bar until the host answers', async () => {
+  const continued = Promise.withResolvers<unknown>()
+  rpc.mockImplementation((_target, method) =>
+    method === 'agentSession.restartResumable'
+      ? Promise.resolve({ sessions: offered })
+      : continued.promise
+  )
+  await mount(
+    <>
+      <NativeChatResumeOnRestartModal />
+      <NativeChatResumeStatusSegment iconOnly={false} />
+    </>
+  )
+  await act(async () => button('Resume 2 chats').click())
+  expect(document.querySelector('[role="dialog"]')).toBeNull()
+  expect(button('Resuming 2 chats. Click to open details.').textContent).toBe('Resuming 2 chats')
+  // Counted once, as in flight, not also as still to resume.
+  expect(document.body.textContent).not.toContain('chats to resume')
+
+  // Reopening mid-run shows the run, without a re-read that could race the host's answer.
+  const reads = rpc.mock.calls.length
+  await act(async () => button('Resuming 2 chats').click())
+  expect(rpc.mock.calls.length).toBe(reads)
+  expect(button('Resuming…').disabled).toBe(true)
+
+  await act(async () =>
+    continued.resolve({
+      resumed: offered.map(({ sessionId }) => ({ sessionId, outcome: 'resumed' })),
+      continued: offered.map(({ sessionId }) => ({ sessionId, outcome: 'continued' })),
+      sessions: []
+    })
+  )
+  expect(document.body.textContent).not.toContain('Resuming')
+  expect(document.querySelector('[role="dialog"]')).toBeNull()
+  // Nothing is left to show, so the reopen request is retired rather than left to latch.
+  expect(getNativeChatResumeOnRestartDialogRequest()).toBe(false)
+  expect(toast).toHaveBeenCalledWith('Resumed 2 chats and asked them to continue')
+})
+
+// A dialog the user reopened mid-run is theirs: the run's answer must not close it over a chat
+// they left out of the resume and can now act on.
+it('keeps a dialog reopened mid-resume open over the chats still offered', async () => {
+  const third = { ...offered[1]!, sessionId: 'c', latestPrompt: 'Prompt c' }
+  const continued = Promise.withResolvers<unknown>()
+  rpc.mockImplementation((_target, method) =>
+    method === 'agentSession.restartResumable'
+      ? Promise.resolve({ sessions: [...offered, third] })
+      : continued.promise
+  )
+  await mount(
+    <>
+      <NativeChatResumeOnRestartModal />
+      <NativeChatResumeStatusSegment iconOnly={false} />
+    </>
+  )
+  await act(async () => checkbox(2).click())
+  await act(async () => button('Resume 2 chats').click())
+  expect(document.querySelector('[role="dialog"]')).toBeNull()
+  await act(async () => button('1 chat to resume').click())
+  expect(document.querySelector('[role="dialog"]')).not.toBeNull()
+  // Mid-run the ticks say what is running, so the chat left out reads as left out.
+  const rowC = () => document.querySelector('[role="checkbox"][aria-label*="Prompt c"]')
+  expect(checkbox(0).getAttribute('data-state')).toBe('checked')
+  expect(checkbox(1).getAttribute('data-state')).toBe('checked')
+  expect(rowC()?.getAttribute('data-state')).toBe('unchecked')
+
+  await act(async () =>
+    continued.resolve({
+      resumed: offered.map(({ sessionId }) => ({ sessionId, outcome: 'resumed' })),
+      continued: offered.map(({ sessionId }) => ({ sessionId, outcome: 'continued' })),
+      sessions: [third]
+    })
+  )
+  expect(rowC()?.getAttribute('data-state')).toBe('checked')
+  const dialog = document.querySelector('[role="dialog"]')
+  expect(dialog?.textContent).toContain('Prompt c')
+  expect(dialog?.textContent).not.toContain('Prompt a')
+  // The run is over, so the chat left out is actionable again, and this opening ticks it afresh.
+  expect(button('Dismiss all').disabled).toBe(false)
+  expect(checkbox(0).getAttribute('data-state')).toBe('checked')
+  expect(button('Resume 1 chat').disabled).toBe(false)
+})
+
+it('starts each opening from the default ticks, not the ones left at the last close', async () => {
+  rpc.mockResolvedValue({ sessions: offered })
+  await mount(<NativeChatResumeOnRestartModal />)
+  await act(async () => checkbox(1).click())
+  expect(button('Resume 1 chat')).toBeTruthy()
+  await act(async () => button('Close').click())
+  expect(document.querySelector('[role="dialog"]')).toBeNull()
+
+  await act(async () => requestNativeChatResumeOnRestartDialog())
+  expect(checkbox(1).getAttribute('data-state')).toBe('checked')
+  expect(button('Resume 2 chats').disabled).toBe(false)
+})
+
 // Resuming spends the host's claims, so the offer has to shrink with it. A count left standing over
 // chats the host already handed back sends the user to a status entry that re-reads, finds nothing,
 // and does nothing.
@@ -336,6 +434,35 @@ it('resumes and continues once when the launch begins opted in', async () => {
   expect(document.querySelector('[role="dialog"]')).toBeNull()
 })
 
+// No dialog to watch, so the status bar is the only sign an automatic resume is running.
+it('shows an opted-in launch resume in the status bar while it runs', async () => {
+  useAppStore.setState({
+    settings: {
+      ...getDefaultSettings(''),
+      experimentalStructuredNativeChat: true,
+      nativeChatResumeWorkOnRestart: true
+    }
+  })
+  const continued = Promise.withResolvers<unknown>()
+  rpc.mockImplementation((_target, method) =>
+    method === 'agentSession.restartResumable'
+      ? Promise.resolve({ sessions: offered })
+      : continued.promise
+  )
+  await mount(<NativeChatResumeStatusSegment iconOnly={false} />)
+  expect(button('Resuming 2 chats').getAttribute('aria-label')).toBe(
+    'Resuming 2 chats. Click to open details.'
+  )
+  await act(async () =>
+    continued.resolve({
+      resumed: offered.map(({ sessionId }) => ({ sessionId, outcome: 'resumed' })),
+      continued: offered.map(({ sessionId }) => ({ sessionId, outcome: 'continued' })),
+      sessions: []
+    })
+  )
+  expect(document.body.textContent).not.toContain('Resuming')
+})
+
 // An opted-in launch reports the chats the host would not take, exactly as the button does.
 it('reports refused and newly ineligible chats on an opted-in launch', async () => {
   useAppStore.setState({
@@ -507,7 +634,7 @@ function dialogControls(): (string | null)[] {
 
 // The old toast said "1 chat could not be continued" and vanished. The chat now stays in the same
 // dialog — same title, checkboxes and footer — with its row saying what went wrong and what to do.
-it('keeps a chat the resume could not carry on in the same dialog, with what to do', async () => {
+it('lists a chat the resume could not carry on when the dialog reopens, with what to do', async () => {
   let remaining: unknown[] = []
   rpc.mockImplementation(async (_target, method) =>
     method === 'agentSession.restartResumable'
@@ -525,6 +652,9 @@ it('keeps a chat the resume could not carry on in the same dialog, with what to
   )
   await mount(<NativeChatResumeOnRestartModal />)
   await act(async () => button('Resume 2 chats').click())
+  // Resume hands off to the status bar; its failure entry (or the toast's Show) reopens the list.
+  expect(document.querySelector('[role="dialog"]')).toBeNull()
+  await act(async () => requestNativeChatResumeOnRestartDialog())
   const dialog = document.querySelector('[role="dialog"]')
   expect(dialog).not.toBeNull()
   // Unchanged chrome: the title, the preference box, and the two footer actions.
@@ -594,6 +724,68 @@ it.each(['footer', 'row'] as const)(
   }
 )
 
+// A row action acts on its row, as Dismiss does: a retry that clears the last failure must not close
+// the dialog over a chat still offered.
+it('keeps the dialog open over the chats still offered after a row Retry succeeds', async () => {
+  let failed = [failure('b', 'agent_session_conflict')]
+  rpc.mockImplementation(async (_target, method) =>
+    method === 'agentSession.restartResumable'
+      ? { sessions: [offered[0]], failed }
+      : ((failed = []),
+        {
+          resumed: [{ sessionId: 'b', outcome: 'resumed' }],
+          continued: [{ sessionId: 'b', outcome: 'continued' }],
+          sessions: [offered[0]],
+          failed
+        })
+  )
+  await mount(<NativeChatResumeOnRestartModal />)
+  await act(async () => button('Retry').click())
+  const dialog = document.querySelector('[role="dialog"]')
+  expect(dialog?.textContent).toContain('Prompt a')
+  expect(dialog?.textContent).not.toContain('Prompt b')
+})
+
+// A dialog closed and reopened mid-retry is the user's again: the retry settling must not close it.
+it('keeps a dialog reopened mid-retry open when the retry settles', async () => {
+  const continued = Promise.withResolvers<unknown>()
+  rpc.mockImplementation((_target, method) =>
+    method === 'agentSession.restartResumable'
+      ? Promise.resolve({
+          sessions: [offered[0]],
+          failed: [failure('b', 'agent_session_conflict')]
+        })
+      : continued.promise
+  )
+  await mount(
+    <>
+      <NativeChatResumeOnRestartModal />
+      <NativeChatResumeStatusSegment iconOnly={false} />
+    </>
+  )
+  await act(async () => button('Retry').click())
+  await act(async () => button('Close').click())
+  expect(document.querySelector('[role="dialog"]')).toBeNull()
+  await act(async () => button('1 chat to resume').click())
+  expect(document.querySelector('[role="dialog"]')).not.toBeNull()
+  // Only the retried row is running, so only it reads as ticked until the retry settles.
+  const tick = (prompt: string) =>
+    document.querySelector(`[role="checkbox"][aria-label*="${prompt}"]`)?.getAttribute('data-state')
+  expect(tick('Prompt a')).toBe('unchecked')
+  expect(tick('Prompt b')).toBe('checked')
+
+  await act(async () =>
+    continued.resolve({
+      resumed: [{ sessionId: 'b', outcome: 'resumed' }],
+      continued: [{ sessionId: 'b', outcome: 'continued' }],
+      sessions: [offered[0]],
+      failed: []
+    })
+  )
+  expect(document.querySelector('[role="dialog"]')?.textContent).toContain('Prompt a')
+  expect(tick('Prompt a')).toBe('checked')
+})
+
 // The user's case: the only row is a failure the host says a retry cannot fix. Ticking it could
 // only fail again, so the row's own action is the way on and the box cannot be ticked.
 it('keeps a failure the host marks unretryable out of Resume, even after a tick', async () => {
diff --git a/src/renderer/src/components/NativeChatResumeOnRestartModal.tsx b/src/renderer/src/components/NativeChatResumeOnRestartModal.tsx
index 5cce3f2aa1a..315a19e3170 100644
--- a/src/renderer/src/components/NativeChatResumeOnRestartModal.tsx
+++ b/src/renderer/src/components/NativeChatResumeOnRestartModal.tsx
@@ -28,8 +28,8 @@ import {
 import {
   continueNativeChatRestartOffer,
   dismissNativeChatRestartOffer,
-  getNativeChatRestartOffer,
-  useNativeChatRestartOffer
+  useNativeChatRestartOffer,
+  useNativeChatRestartResuming
 } from './native-chat-resume-on-restart-store'
 
 /**
@@ -42,9 +42,13 @@ import {
  * The "don't ask again" box removes the PROMPT, never a safety check — an opted-in launch calls
  * the same RPC, which re-derives the same predicate and staggers the same way.
  *
+ * Resume closes the dialog at once and the status-bar entry carries the run, then any chat it could
+ * not carry on. The run lives in the store, as a skill update's does, so the dialog is one view of it.
+ *
  * A chat an earlier resume could not carry on is listed too, as the same row plus what went wrong
  * and what to do; selecting it and resuming is a retry, unless the host says a retry cannot run.
- * The dialog stays open while any remain, so the outcome is never left to a toast.
+ * Row actions (Retry, Dismiss) act on their row and leave the dialog open. It closes only on the
+ * user's own way out, or once the host confirms nothing is left; a resume settling never closes it.
  *
  * Closing is a SNOOZE, so looking around before deciding cannot remove the recovery. Dismiss all is
  * the explicit path that deletes the durable records.
@@ -78,11 +82,22 @@ export function NativeChatResumeOnRestartModal(): React.JSX.Element | null {
   )
   const updateSettings = useAppStore((store) => store.updateSettings)
   const [dontAskAgain, setDontAskAgain] = useState(false)
-  const [busy, setBusy] = useState(false)
+  // The store's: the resume outlives this dialog, which can close or reopen mid-run.
+  const resuming = useNativeChatRestartResuming()
+  const busy = resuming.length > 0
   /** The user's own ticks and unticks, over each row's default. Tracked as OVERRIDES rather than a
    *  selection because the list is the host's and arrives — and shrinks — under an open dialog; a
    *  stored selection would need seeding from an effect every time it changed. */
   const [overrides, setOverrides] = useState<ReadonlyMap<string, boolean>>(() => new Map())
+  // Each opening starts from the rows' defaults. This component never unmounts, so an untick made
+  // before a close would otherwise greet a reopen, e.g. as "Resume 0 chats" over what a run left.
+  const [openedWith, setOpenedWith] = useState(open)
+  if (openedWith !== open) {
+    setOpenedWith(open)
+    if (open) {
+      setOverrides(new Map())
+    }
+  }
   /** Derived from the host's own list, so an action can never name a chat it did not list. */
   const chosen = useMemo(
     () =>
@@ -99,6 +114,8 @@ export function NativeChatResumeOnRestartModal(): React.JSX.Element | null {
     [rows, overrides, failureBySession]
   )
   const selected = useMemo(() => new Set(chosen), [chosen])
+  // Mid-run the ticks show what is running; this opening's own ticks may name chats left out of it.
+  const ticked = useMemo(() => (busy ? new Set(resuming) : selected), [busy, resuming, selected])
 
   const toggleSelected = useCallback((sessionId: string, checked: boolean) => {
     setOverrides((current) => new Map(current).set(sessionId, checked))
@@ -111,19 +128,11 @@ export function NativeChatResumeOnRestartModal(): React.JSX.Element | null {
     }
   }, [dontAskAgain, updateSettings])
 
+  // Never closes the dialog: only the user's own ways out do, and the store once nothing is left.
   const resume = useCallback(
     async (sessionIds: string[]): Promise<void> => {
-      setBusy(true)
-      try {
-        void persistPreference()
-        await continueNativeChatRestartOffer(sessionIds)
-      } finally {
-        setBusy(false)
-        // Stays open when a chat did not carry on: its row now says what to do about it.
-        if (getNativeChatRestartOffer().failed.length === 0) {
-          consumeNativeChatResumeOnRestartDialogRequest()
-        }
-      }
+      void persistPreference()
+      await continueNativeChatRestartOffer(sessionIds)
     },
     [persistPreference]
   )
@@ -173,7 +182,7 @@ export function NativeChatResumeOnRestartModal(): React.JSX.Element | null {
     <Dialog
       open
       onOpenChange={(next) => {
-        if (!next && !busy) {
+        if (!next) {
           snooze()
         }
       }}
@@ -217,7 +226,7 @@ export function NativeChatResumeOnRestartModal(): React.JSX.Element | null {
             candidates={rows}
             listedAt={listedAt}
             busy={busy}
-            selected={selected}
+            selected={ticked}
             onToggle={toggleSelected}
             failureFor={(sessionId) => failureBySession.get(sessionId)}
             onFailureAction={(action, sessionId) => void actOnFailure(action, sessionId)}
@@ -258,7 +267,11 @@ export function NativeChatResumeOnRestartModal(): React.JSX.Element | null {
             variant="default"
             size="sm"
             disabled={busy || chosen.length === 0}
-            onClick={() => void resume(chosen)}
+            onClick={() => {
+              // Resume hands the run to the status bar.
+              consumeNativeChatResumeOnRestartDialogRequest()
+              void resume(chosen)
+            }}
           >
             {busy
               ? translate('auto.components.NativeChatResumeOnRestartModal.resuming', 'Resuming…')
diff --git a/src/renderer/src/components/NewWorkspaceComposerCard.test.tsx b/src/renderer/src/components/NewWorkspaceComposerCard.test.tsx
index 6d143777e35..fa16bc7d247 100644
--- a/src/renderer/src/components/NewWorkspaceComposerCard.test.tsx
+++ b/src/renderer/src/components/NewWorkspaceComposerCard.test.tsx
@@ -69,7 +69,11 @@ vi.mock('@/components/new-workspace/SetProjectLocationDialog', () => ({
 }))
 
 vi.mock('@/components/sparse/SparseCheckoutPresetSelect', () => ({
-  default: () => <div data-testid="sparse-select" />
+  default: ({ onEditingChange }: { onEditingChange?: (editing: boolean) => void }) => (
+    <div data-testid="sparse-select">
+      <button onClick={() => onEditingChange?.(true)}>Begin preset</button>
+    </div>
+  )
 }))
 
 vi.mock('@/components/new-workspace/SmartWorkspaceNameField', () => ({
@@ -373,6 +377,19 @@ describe('NewWorkspaceComposerCard folder task source mode', () => {
     expect(advancedButton?.className).toContain('focus-visible:ring-inset')
   })
 
+  it('shows only preset actions while editing and prevents hiding the draft', () => {
+    current = renderCard({
+      advancedOpen: true,
+      sparseControlsEnabled: true,
+      canUseSparseCheckout: true
+    })
+    const buttons = [...current.container.querySelectorAll('button')]
+    const button = (label: string) => buttons.find((node) => node.textContent?.includes(label))
+    act(() => button('Begin preset')?.click())
+    expect(button('Advanced')?.disabled).toBe(true)
+    expect(current.container.textContent).not.toContain('Create workspace')
+  })
+
   it('removes collapsed Advanced controls from the Tab order', () => {
     current = renderCard({ advancedOpen: false, branchesEnabled: true })
 
diff --git a/src/renderer/src/components/NewWorkspaceComposerCard.tsx b/src/renderer/src/components/NewWorkspaceComposerCard.tsx
index b406fb0aeb8..5dac7dc8246 100644
--- a/src/renderer/src/components/NewWorkspaceComposerCard.tsx
+++ b/src/renderer/src/components/NewWorkspaceComposerCard.tsx
@@ -95,6 +95,7 @@ export default function NewWorkspaceComposerCard(
   const nameInputFocusFrameRef = React.useRef<number | null>(null)
   const branchNameInputId = React.useId()
   const projectDescriptionId = React.useId()
+  const [sparseEditing, setSparseEditing] = React.useState(false)
   const [addRemoteHostMode, setAddRemoteHostMode] = React.useState<AddRemoteHostMode | null>(null)
   const [setLocationOption, setSetLocationOption] = React.useState<NeedsProjectHostOption | null>(
     null
@@ -287,6 +288,7 @@ export default function NewWorkspaceComposerCard(
     <div
       ref={setComposerNode}
       data-workspace-composer-root="true"
+      data-sparse-preset-editing={sparseEditing ? 'true' : undefined}
       data-native-file-drop-target="composer"
       onDragEnter={dragHandlers.onDragEnter}
       onDragLeave={dragHandlers.onDragLeave}
@@ -299,6 +301,7 @@ export default function NewWorkspaceComposerCard(
       <div className={cn('min-h-0 min-w-0 space-y-4 pt-3', contentClassName)}>
         <NewWorkspaceComposerProjectSection
           {...props}
+          disabled={sparseEditing}
           projectOptions={projectOptions}
           projectHostSetupOptions={projectHostSetupOptions}
           ephemeralVmRecipes={ephemeralVmRecipes}
@@ -318,12 +321,16 @@ export default function NewWorkspaceComposerCard(
         <NewWorkspaceComposerNameSection {...props} onNamePlainEnter={handleNamePlainEnter} />
         <NewWorkspaceComposerAgentSection
           {...props}
+          createDisabled={props.createDisabled || sparseEditing}
+          advancedLocked={sparseEditing}
           visibleQuickAgents={visibleQuickAgents}
           defaultTuiAgent={defaultTuiAgent}
           handleSetDefaultAgent={handleSetDefaultAgent}
         />
         <NewWorkspaceComposerAdvancedSection
           {...props}
+          onSparseEditingChange={setSparseEditing}
+          sparseEditing={sparseEditing}
           branchNameInputId={branchNameInputId}
           setupConfigLabel={setupConfigLabel}
           setupRunLabel={setupRunLabel}
@@ -338,12 +345,14 @@ export default function NewWorkspaceComposerCard(
           activeFolderWorkspaceId={activeFolderWorkspaceId}
         />
       </div>
-      <div className="shrink-0 space-y-1">
-        <NewWorkspaceComposerFooter
-          {...props}
-          submitShortcutModifierLabel={getScreenSubmitModifierLabel()}
-        />
-      </div>
+      {!sparseEditing ? (
+        <div className="shrink-0 space-y-1">
+          <NewWorkspaceComposerFooter
+            {...props}
+            submitShortcutModifierLabel={getScreenSubmitModifierLabel()}
+          />
+        </div>
+      ) : null}
       <AddRemoteHostDialog mode={addRemoteHostMode} onOpenChange={setAddRemoteHostMode} />
       {setLocationDialogMounted ? (
         <React.Suspense fallback={null}>
diff --git a/src/renderer/src/components/NewWorkspaceComposerModal.tsx b/src/renderer/src/components/NewWorkspaceComposerModal.tsx
index 37d20b831e8..5d38cb0739c 100644
--- a/src/renderer/src/components/NewWorkspaceComposerModal.tsx
+++ b/src/renderer/src/components/NewWorkspaceComposerModal.tsx
@@ -73,6 +73,7 @@ function ComposerModalBody({
   modalData: ComposerModalData
   onClose: () => void
 }): React.JSX.Element {
+  const dialogRef = useRef<HTMLDivElement>(null)
   const submitCancelledRef = useRef(false)
   const handleDismiss = useCallback(() => {
     submitCancelledRef.current = true
@@ -83,7 +84,13 @@ function ComposerModalBody({
   return (
     <Dialog open onOpenChange={(open) => !open && handleDismiss()}>
       <DialogContent
+        ref={dialogRef}
         className="flex max-h-[calc(100vh-2rem)] flex-col overflow-hidden sm:max-w-lg"
+        onEscapeKeyDown={(event) => {
+          if (dialogRef.current?.querySelector('[data-sparse-preset-editor]')) {
+            event.preventDefault()
+          }
+        }}
         onOpenAutoFocus={(event) => {
           // Why: Radix's FocusScope fires this once the dialog has mounted.
           // preventDefault stops it from focusing whatever first-tabbable it
@@ -261,7 +268,7 @@ function QuickTabBody({
       if (!shouldAllowComposerEnterSubmitTarget(target, composerRef.current)) {
         return
       }
-      if (createDisabled) {
+      if (createDisabled || composerRef.current?.hasAttribute('data-sparse-preset-editing')) {
         return
       }
       event.preventDefault()
diff --git a/src/renderer/src/components/TerminalLegacyTerminalPanes.tsx b/src/renderer/src/components/TerminalLegacyTerminalPanes.tsx
index f095b77e0e1..b054a05b717 100644
--- a/src/renderer/src/components/TerminalLegacyTerminalPanes.tsx
+++ b/src/renderer/src/components/TerminalLegacyTerminalPanes.tsx
@@ -1,5 +1,6 @@
 import { createPortal } from 'react-dom'
 import TerminalPane from './terminal-pane/TerminalPane'
+import { TerminalRestoringPlaceholder } from './terminal-pane/TerminalRestoringPlaceholder'
 import { findActivityTerminalPortal } from './activity/activity-terminal-portal'
 import { shouldMountBackgroundWorktreeTab } from './terminal/background-terminal-worktree-mount'
 import type { TerminalController } from './use-terminal-controller'
@@ -59,51 +60,54 @@ export function TerminalLegacyTerminalPanes({
               }
               aria-hidden={!isVisible}
             >
-              {(tabsByWorktree[workspace.id] ?? [])
-                .filter((tab) =>
-                  shouldMountBackgroundWorktreeTab(
+              {(tabsByWorktree[workspace.id] ?? []).map((tab) => {
+                const isActiveTerminalTab =
+                  isVisible && tab.id === activeTabId && activeTabType === 'terminal'
+                if (
+                  !shouldMountBackgroundWorktreeTab(
                     backgroundMountTabIdsByWorktreeRef.current.get(workspace.id) ?? null,
                     tab.id
                   )
+                ) {
+                  // Why only the startup hold lands here visible: reveal admits every other
+                  // visible deferred tab in the same render pass.
+                  return isActiveTerminalTab ? <TerminalRestoringPlaceholder key={tab.id} /> : null
+                }
+                const activityTerminalPortal = findActivityTerminalPortal(activityTerminalPortals, {
+                  worktreeId: workspace.id,
+                  tabId: tab.id
+                })
+                const isActivityPortalTab = activityTerminalPortal !== null
+                if (
+                  shouldColdParkTerminalPanes &&
+                  !isActivityPortalTab &&
+                  !evictionExemptTerminalTabIds.has(tab.id)
+                ) {
+                  return null
+                }
+                const terminalPane = (
+                  <TerminalPane
+                    key={`${tab.id}-${tab.generation ?? 0}`}
+                    tabId={tab.id}
+                    worktreeId={workspace.id}
+                    cwd={tab.startupCwd ?? workspace.path}
+                    isActive={isActiveTerminalTab || activityTerminalPortal?.active === true}
+                    isVisible={isActiveTerminalTab || isActivityPortalTab}
+                    isWorktreeActive={isVisible || isActivityPortalTab}
+                    isolatedPaneKey={activityTerminalPortal?.paneKey ?? null}
+                    onPtyExit={(ptyId, exitCode) => handlePtyExit(tab.id, ptyId, exitCode)}
+                    onCloseTab={() => handleCloseTab(tab.id)}
+                  />
                 )
-                .map((tab) => {
-                  const activityTerminalPortal = findActivityTerminalPortal(
-                    activityTerminalPortals,
-                    { worktreeId: workspace.id, tabId: tab.id }
+                if (activityTerminalPortal) {
+                  return createPortal(
+                    terminalPane,
+                    activityTerminalPortal.target,
+                    `activity-terminal-${tab.id}`
                   )
-                  const isActivityPortalTab = activityTerminalPortal !== null
-                  const isActiveTerminalTab =
-                    isVisible && tab.id === activeTabId && activeTabType === 'terminal'
-                  if (
-                    shouldColdParkTerminalPanes &&
-                    !isActivityPortalTab &&
-                    !evictionExemptTerminalTabIds.has(tab.id)
-                  ) {
-                    return null
-                  }
-                  const terminalPane = (
-                    <TerminalPane
-                      key={`${tab.id}-${tab.generation ?? 0}`}
-                      tabId={tab.id}
-                      worktreeId={workspace.id}
-                      cwd={tab.startupCwd ?? workspace.path}
-                      isActive={isActiveTerminalTab || activityTerminalPortal?.active === true}
-                      isVisible={isActiveTerminalTab || isActivityPortalTab}
-                      isWorktreeActive={isVisible || isActivityPortalTab}
-                      isolatedPaneKey={activityTerminalPortal?.paneKey ?? null}
-                      onPtyExit={(ptyId, exitCode) => handlePtyExit(tab.id, ptyId, exitCode)}
-                      onCloseTab={() => handleCloseTab(tab.id)}
-                    />
-                  )
-                  if (activityTerminalPortal) {
-                    return createPortal(
-                      terminalPane,
-                      activityTerminalPortal.target,
-                      `activity-terminal-${tab.id}`
-                    )
-                  }
-                  return terminalPane
-                })}
+                }
+                return terminalPane
+              })}
             </div>
           )
         })}
diff --git a/src/renderer/src/components/TerminalSplitWorkspaceSurfaces.tsx b/src/renderer/src/components/TerminalSplitWorkspaceSurfaces.tsx
index 5c3145360f6..cfe381ccce9 100644
--- a/src/renderer/src/components/TerminalSplitWorkspaceSurfaces.tsx
+++ b/src/renderer/src/components/TerminalSplitWorkspaceSurfaces.tsx
@@ -1,5 +1,6 @@
 import { useAnyBrowserGuestNeedsPaint } from './browser-pane/host-guest/browser-guest-paint-retention'
 import { WorktreeSplitSurface } from './TerminalWorktreeSplitSurface'
+import { selectParkedEquivalentMountTabIds } from './terminal/startup-terminal-tab-hold'
 import type { TerminalController } from './use-terminal-controller'
 
 export function TerminalSplitWorkspaceSurfaces({
@@ -21,6 +22,7 @@ export function TerminalSplitWorkspaceSurfaces({
     measurableBackgroundWorktreeIdsRef,
     mountedWorktreeIdsRef,
     renderedActiveWorktreeId,
+    startupTerminalTabHold,
     workspaceSurfaces
   } = controller
   // Why: this and TerminalSurface are both strict ancestors of every browser <webview>, so a
@@ -69,9 +71,11 @@ export function TerminalSplitWorkspaceSurfaces({
               backgroundMountTabIds={
                 backgroundMountTabIdsByWorktreeRef.current.get(workspace.id) ?? null
               }
-              activationDeferredMountTabIds={
-                activationDeferredMountTabIdsByWorktreeRef.current.get(workspace.id) ?? null
-              }
+              activationDeferredMountTabIds={selectParkedEquivalentMountTabIds(
+                activationDeferredMountTabIdsByWorktreeRef.current.get(workspace.id),
+                startupTerminalTabHold,
+                workspace.id
+              )}
             />
           )
         })}
diff --git a/src/renderer/src/components/WorktreeJumpPalette.test.tsx b/src/renderer/src/components/WorktreeJumpPalette.test.tsx
index 0881dd10d78..cfe5de95832 100644
--- a/src/renderer/src/components/WorktreeJumpPalette.test.tsx
+++ b/src/renderer/src/components/WorktreeJumpPalette.test.tsx
@@ -421,6 +421,7 @@ describe('WorktreeJumpPalette', () => {
     // The first row names ITS OWN host — the wrong-host open is gone.
     await act(async () => fireEvent.click(rows[0]!))
     expect(activateAndRevealWorktree).toHaveBeenLastCalledWith('shared', {
+      navigationIntent: 'user-open',
       executionHostId: 'local'
     })
   })
@@ -443,6 +444,7 @@ describe('WorktreeJumpPalette', () => {
 
     await act(async () => fireEvent.click(rows[1]!))
     expect(activateAndRevealWorktree).toHaveBeenLastCalledWith('shared', {
+      navigationIntent: 'user-open',
       executionHostId: 'ssh:box'
     })
   })
@@ -487,6 +489,7 @@ describe('WorktreeJumpPalette', () => {
 
     await act(async () => fireEvent.click(hubARow!))
     expect(activateAndRevealWorktree).toHaveBeenLastCalledWith('shared-runtime', {
+      navigationIntent: 'user-open',
       executionHostId: 'runtime:hub-a'
     })
   })
diff --git a/src/renderer/src/components/activity/activity-clear-completed.test.ts b/src/renderer/src/components/activity/activity-clear-completed.test.ts
index e0cee5aa9d8..79191ce3252 100644
--- a/src/renderer/src/components/activity/activity-clear-completed.test.ts
+++ b/src/renderer/src/components/activity/activity-clear-completed.test.ts
@@ -61,6 +61,7 @@ import {
   isClearableActivityThread,
   planClearCompletedActivity
 } from './activity-clear-completed'
+import { activityThreadStatusId } from './activity-thread-presentation'
 
 function makeThread(paneKey: string, overrides: Partial<AgentPaneThread> = {}): AgentPaneThread {
   return {
@@ -81,7 +82,7 @@ function makeThread(paneKey: string, overrides: Partial<AgentPaneThread> = {}):
   }
 }
 
-function doneEvent(interrupted: boolean): ActivityEvent {
+function doneEvent(interrupted: boolean, outcome?: 'failure'): ActivityEvent {
   return {
     id: 'evt',
     state: 'done',
@@ -89,7 +90,16 @@ function doneEvent(interrupted: boolean): ActivityEvent {
     observedAt: 5_000,
     worktree: makeWorktree(),
     repo: null,
-    entry: { interrupted } as ActivityEvent['entry'],
+    entry: {
+      paneKey: 'evt-pane',
+      state: 'done',
+      prompt: '',
+      updatedAt: 5_000,
+      stateStartedAt: 5_000,
+      stateHistory: [],
+      interrupted,
+      ...(outcome ? { mainAgent: { state: 'done', outcome, stateStartedAt: 5_000 } } : {})
+    },
     tab: makeTab(),
     agentType: 'claude',
     agentAlive: false,
@@ -102,6 +112,7 @@ const blockedThread = makeThread('t-blocked:1', { currentAgentState: 'blocked' }
 const waitingThread = makeThread('t-waiting:1', { currentAgentState: 'waiting' })
 const doneThread = makeThread('t-done:1', { latestEvent: doneEvent(false) })
 const interruptedThread = makeThread('t-interrupted:1', { latestEvent: doneEvent(true) })
+const failedThread = makeThread('t-failed:1', { latestEvent: doneEvent(false, 'failure') })
 
 function makeRetained(paneKey: string): RetainedAgentEntry {
   return {
@@ -125,10 +136,34 @@ describe('isClearableActivityThread', () => {
   it('clears only completed and interrupted threads', () => {
     expect(isClearableActivityThread(doneThread)).toBe(true)
     expect(isClearableActivityThread(interruptedThread)).toBe(true)
+    expect(activityThreadStatusId(failedThread)).toBe('failed')
+    expect(isClearableActivityThread(failedThread)).toBe(true)
     expect(isClearableActivityThread(workingThread)).toBe(false)
     expect(isClearableActivityThread(blockedThread)).toBe(false)
     expect(isClearableActivityThread(waitingThread)).toBe(false)
   })
+
+  it('reads a live thread whose main agent failed as failed, but keeps it while subagents run', () => {
+    const heldEntry = {
+      ...doneEvent(false).entry,
+      state: 'working' as const,
+      mainAgent: { state: 'done' as const, outcome: 'failure' as const, stateStartedAt: 5_000 }
+    }
+    const held = makeThread('t-held:1', {
+      currentAgentState: 'working',
+      currentAgentEntry: heldEntry
+    })
+    expect(activityThreadStatusId(held)).toBe('failed')
+    expect(isClearableActivityThread(held)).toBe(false)
+    const succeeded = makeThread('t-ok:1', {
+      currentAgentState: 'working',
+      currentAgentEntry: {
+        ...heldEntry,
+        mainAgent: { state: 'done', outcome: 'success', stateStartedAt: 5_000 }
+      }
+    })
+    expect(activityThreadStatusId(succeeded)).toBe('working')
+  })
 })
 
 describe('clearCompletedActivity', () => {
diff --git a/src/renderer/src/components/activity/activity-clear-completed.ts b/src/renderer/src/components/activity/activity-clear-completed.ts
index 2bb39fdff43..e365152c9bb 100644
--- a/src/renderer/src/components/activity/activity-clear-completed.ts
+++ b/src/renderer/src/components/activity/activity-clear-completed.ts
@@ -18,11 +18,15 @@ export type ClearCompletedActivityPlan = {
   clearedThreadCount: number
 }
 
-/** A thread is clearable when it needs nothing from the user: completed or interrupted,
+/** A thread is clearable when it needs nothing from the user: completed, failed or interrupted,
  *  with no fresh live working/monitoring/blocked/waiting state. */
 export function isClearableActivityThread(thread: AgentPaneThread): boolean {
   const id = activityThreadStatusId(thread)
-  return id === 'done' || id === 'interrupted'
+  // Why: a failed main agent reads failed while its subagents still run; that thread is still live.
+  if (thread.currentAgentState) {
+    return false
+  }
+  return id === 'done' || id === 'failed' || id === 'interrupted'
 }
 
 export function planClearCompletedActivity(
diff --git a/src/renderer/src/components/activity/activity-pane-events.ts b/src/renderer/src/components/activity/activity-pane-events.ts
index 6a147beac81..0ee287af187 100644
--- a/src/renderer/src/components/activity/activity-pane-events.ts
+++ b/src/renderer/src/components/activity/activity-pane-events.ts
@@ -27,7 +27,9 @@ function historyEntrySnapshot(
     toolName: undefined,
     toolInput: undefined,
     lastAssistantMessage: undefined,
-    interrupted: history.interrupted
+    interrupted: history.interrupted,
+    // The live row's main agent belongs to its current state, not to this snapshot.
+    mainAgent: history.mainAgent
   }
 }
 
diff --git a/src/renderer/src/components/activity/activity-thread-actions.test.ts b/src/renderer/src/components/activity/activity-thread-actions.test.ts
index 07f50bce92d..ce546f03697 100644
--- a/src/renderer/src/components/activity/activity-thread-actions.test.ts
+++ b/src/renderer/src/components/activity/activity-thread-actions.test.ts
@@ -1,4 +1,6 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
+import { TOGGLE_FLOATING_TERMINAL_EVENT } from '@/lib/floating-terminal'
 import { makeRepo, makeTab, makeWorktree } from './ActivityPrototypePage-test-fixtures'
 import type { AgentPaneThread } from './activity-thread-types'
 
@@ -6,7 +8,9 @@ const mocks = vi.hoisted(() => ({
   getState: vi.fn(),
   activateTabAndFocusPane: vi.fn(),
   activateStructuredAgentSessionTab: vi.fn(),
-  activateAndRevealWorkspace: vi.fn()
+  activateAndRevealWorkspace: vi.fn(),
+  isFloatingWorkspacePanelVisible: vi.fn(),
+  dispatchEvent: vi.fn()
 }))
 
 vi.mock('@/store', () => ({ useAppStore: { getState: mocks.getState } }))
@@ -19,6 +23,9 @@ vi.mock('@/lib/structured-agent-session-tab-activation', () => ({
 vi.mock('@/lib/worktree-activation', () => ({
   activateAndRevealWorkspace: mocks.activateAndRevealWorkspace
 }))
+vi.mock('@/lib/floating-workspace-terminal-actions', () => ({
+  isFloatingWorkspacePanelVisible: mocks.isFloatingWorkspacePanelVisible
+}))
 
 import { createActivityThreadActions, hasActivityThreadWorkspace } from './activity-thread-actions'
 
@@ -62,6 +69,8 @@ describe('activity thread host routing', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    vi.stubGlobal('window', { dispatchEvent: mocks.dispatchEvent })
+    mocks.isFloatingWorkspacePanelVisible.mockReturnValue(false)
     mocks.activateStructuredAgentSessionTab.mockReturnValue(false)
     mocks.activateAndRevealWorkspace.mockReturnValue({ primaryTabId: null })
     getKnownWorktreeById.mockReturnValue(thread.worktree)
@@ -92,6 +101,76 @@ describe('activity thread host routing', () => {
     mocks.getState.mockImplementation(() => state)
   })
 
+  afterEach(() => vi.unstubAllGlobals())
+
+  function makeFloatingThread(): AgentPaneThread {
+    return {
+      ...thread,
+      worktree: { ...thread.worktree, id: FLOATING_TERMINAL_WORKTREE_ID },
+      repo: null,
+      tab: { ...thread.tab, worktreeId: FLOATING_TERMINAL_WORKTREE_ID }
+    }
+  }
+
+  it.each([false, true])(
+    'reveals the floating agent pane when the panel is open=%s without switching workspace',
+    (open) => {
+      const floatingThread = makeFloatingThread()
+      state.settings = { floatingTerminalEnabled: true }
+      state.tabsByWorktree = { [FLOATING_TERMINAL_WORKTREE_ID]: [floatingThread.tab] }
+      mocks.activateAndRevealWorkspace.mockReturnValue(false)
+      mocks.isFloatingWorkspacePanelVisible.mockReturnValue(open)
+
+      makeActions().selectThread(floatingThread)
+
+      expect(setSelectedPaneKey).toHaveBeenCalledWith(floatingThread.paneKey)
+      expect(mocks.activateAndRevealWorkspace).not.toHaveBeenCalled()
+      expect(setActiveWorktree).not.toHaveBeenCalled()
+      expect(mocks.dispatchEvent).toHaveBeenCalledTimes(open ? 0 : 1)
+      if (!open) {
+        expect(mocks.dispatchEvent).toHaveBeenCalledWith(
+          expect.objectContaining({ type: TOGGLE_FLOATING_TERMINAL_EVENT })
+        )
+      }
+      expect(mocks.activateTabAndFocusPane).toHaveBeenCalledWith(
+        floatingThread.tab.id,
+        '11111111-1111-4111-8111-111111111111',
+        { flashFocusedPane: true, scrollToBottomIfOutputSinceLastView: true }
+      )
+    }
+  )
+
+  it('enables a disabled floating workspace before revealing its agent pane', async () => {
+    const floatingThread = makeFloatingThread()
+    const updateSettings = vi.fn().mockResolvedValue(undefined)
+    const requestAnimationFrame = vi.fn((callback: FrameRequestCallback) => {
+      callback(0)
+      return 1
+    })
+    vi.stubGlobal('requestAnimationFrame', requestAnimationFrame)
+    state.settings = { floatingTerminalEnabled: false }
+    state.updateSettings = updateSettings
+    state.tabsByWorktree = { [FLOATING_TERMINAL_WORKTREE_ID]: [floatingThread.tab] }
+
+    makeActions().selectThread(floatingThread)
+
+    expect(updateSettings).toHaveBeenCalledWith({ floatingTerminalEnabled: true })
+    expect(mocks.dispatchEvent).not.toHaveBeenCalled()
+    expect(mocks.activateTabAndFocusPane).toHaveBeenCalled()
+    await vi.waitFor(() => expect(requestAnimationFrame).toHaveBeenCalledTimes(1))
+    expect(mocks.dispatchEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ type: TOGGLE_FLOATING_TERMINAL_EVENT })
+    )
+  })
+
+  it('does not open the floating panel for a retained thread whose tab was closed', () => {
+    makeActions().selectThread(makeFloatingThread())
+
+    expect(mocks.activateAndRevealWorkspace).not.toHaveBeenCalled()
+    expect(mocks.dispatchEvent).not.toHaveBeenCalled()
+    expect(mocks.activateTabAndFocusPane).not.toHaveBeenCalled()
+  })
+
   it('routes the row click through the full activation sequence for the matching host', () => {
     makeActions().selectThread(thread)
 
@@ -179,6 +258,7 @@ describe('activity thread host routing', () => {
 
     expect(acknowledgeAgents).toHaveBeenCalledWith([thread.paneKey])
     expect(mocks.activateAndRevealWorkspace).toHaveBeenCalledWith(thread.worktree.id, {
+      navigationIntent: 'user-open',
       executionHostId: REMOTE_HOST
     })
   })
diff --git a/src/renderer/src/components/activity/activity-thread-actions.ts b/src/renderer/src/components/activity/activity-thread-actions.ts
index 6e0d167a5a3..c2d99c23fc2 100644
--- a/src/renderer/src/components/activity/activity-thread-actions.ts
+++ b/src/renderer/src/components/activity/activity-thread-actions.ts
@@ -1,8 +1,11 @@
 import { activateTabAndFocusPane } from '@/lib/activate-tab-and-focus-pane'
+import { TOGGLE_FLOATING_TERMINAL_EVENT } from '@/lib/floating-terminal'
+import { isFloatingWorkspacePanelVisible } from '@/lib/floating-workspace-terminal-actions'
 import { activateStructuredAgentSessionTab } from '@/lib/structured-agent-session-tab-activation'
 import { activateAndRevealWorkspace } from '@/lib/worktree-activation'
 import { jumpToWorktreeFromSidebar } from '@/lib/worktree-jump-navigation'
 import { useAppStore } from '@/store'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
 import {
   getSettingsFocusedExecutionHostId,
   getWorktreeExecutionHostId,
@@ -45,6 +48,25 @@ export function hasActivityThreadWorkspace(
   )
 }
 
+function toggleFloatingWorkspacePanelIfHidden(): void {
+  if (!isFloatingWorkspacePanelVisible()) {
+    window.dispatchEvent(new Event(TOGGLE_FLOATING_TERMINAL_EVENT))
+  }
+}
+
+// Why enable first: floating tabs outlive a feature disable, and the panel ignores the toggle
+// while disabled, so a live floating agent row would otherwise be a silent no-op.
+function revealFloatingWorkspacePanel(state: AppState): void {
+  if (state.settings?.floatingTerminalEnabled === true) {
+    toggleFloatingWorkspacePanelIfHidden()
+    return
+  }
+  void state.updateSettings({ floatingTerminalEnabled: true }).then(() => {
+    // Why deferred a frame: the panel only honors the toggle once the enabled flag has reached React.
+    requestAnimationFrame(toggleFloatingWorkspacePanelIfHidden)
+  })
+}
+
 export function createActivityThreadActions({
   getMarkAllReadThreads,
   acknowledgeAgents,
@@ -75,6 +97,7 @@ export function createActivityThreadActions({
   }
 
   const activateThreadTarget = (thread: AgentPaneThread): void => {
+    const isFloatingTerminal = thread.worktree.id === FLOATING_TERMINAL_WORKTREE_ID
     const executionHostId = getActivityThreadExecutionHostId(
       thread,
       getSettingsFocusedExecutionHostId(useAppStore.getState().settings)
@@ -84,6 +107,7 @@ export function createActivityThreadActions({
     // resumeSleepingAgentSessionsForWorktree/ensureWorktreeHasInitialTerminal run inside here.
     // Probing tab residency first is what made a remote row click a silent no-op (#16731).
     if (
+      !isFloatingTerminal &&
       activateAndRevealWorkspace(thread.worktree.id, {
         executionHostId,
         revealInSidebar: false,
@@ -105,6 +129,10 @@ export function createActivityThreadActions({
       // no pane to focus and focusing a sibling would be worse than focusing nothing.
       return
     }
+    // Floating tabs have no catalog workspace; reveal their panel without changing the main workspace.
+    if (isFloatingTerminal) {
+      revealFloatingWorkspacePanel(activated)
+    }
     activated.setActiveTabType('terminal', thread.worktree.id)
     const parsed = parsePaneKey(thread.paneKey)
     activateTabAndFocusPane(
diff --git a/src/renderer/src/components/activity/activity-thread-grouping.ts b/src/renderer/src/components/activity/activity-thread-grouping.ts
index cab4fbcf8c3..9bf99cc67cf 100644
--- a/src/renderer/src/components/activity/activity-thread-grouping.ts
+++ b/src/renderer/src/components/activity/activity-thread-grouping.ts
@@ -21,11 +21,11 @@ const ACTIVITY_STATUS_GROUP_RANK: Record<ActivityThreadStatusId, number> = {
   waiting: 0,
   blocked: 1,
   permission: 2,
-  interrupted: 3,
-  working: 4,
-  monitoring: 5,
-  unverifiable: 6,
-  failed: 7,
+  failed: 3,
+  interrupted: 4,
+  working: 5,
+  monitoring: 6,
+  unverifiable: 7,
   done: 8,
   idle: 9
 }
diff --git a/src/renderer/src/components/activity/activity-thread-presentation.ts b/src/renderer/src/components/activity/activity-thread-presentation.ts
index 5541b3da493..e38c802f867 100644
--- a/src/renderer/src/components/activity/activity-thread-presentation.ts
+++ b/src/renderer/src/components/activity/activity-thread-presentation.ts
@@ -2,6 +2,10 @@ import type { AgentDotState } from '@/components/AgentStateDot'
 import { formatAgentTypeLabel } from '@/lib/agent-status'
 import { getAgentRowPrimaryText } from '@/lib/agent-row-primary-text'
 import { showsAgentToolPreview } from '@/lib/agent-row-tool-preview'
+import {
+  agentMainAgentVerdict,
+  agentVerdictDisplayMark
+} from '../../../../shared/agent-main-agent-verdict'
 import {
   getActivityThreadTaskTitle,
   getActivityThreadWorkspaceTitle,
@@ -68,7 +72,12 @@ export function agentTitle(event: ActivityEvent): string {
     return 'Agent working'
   }
   if (event.state === 'done') {
-    return event.entry.interrupted ? 'Agent interrupted' : 'Agent finished'
+    const verdict = agentMainAgentVerdict(event.entry)
+    return verdict === 'failure'
+      ? 'Agent failed'
+      : verdict === 'cancellation'
+        ? 'Agent interrupted'
+        : 'Agent finished'
   }
   return event.state === 'waiting' ? 'Agent waiting for input' : 'Agent needs input'
 }
@@ -91,7 +100,12 @@ export function agentMeta(event: ActivityEvent): string {
     return `${agent} ${event.state}`
   }
   if (event.state === 'done') {
-    return event.entry.interrupted ? `${agent} interrupted` : `${agent} completed`
+    const verdict = agentMainAgentVerdict(event.entry)
+    return verdict === 'failure'
+      ? `${agent} failed`
+      : verdict === 'cancellation'
+        ? `${agent} interrupted`
+        : `${agent} completed`
   }
   return event.state === 'waiting' ? `${agent} waiting` : `${agent} blocked`
 }
@@ -120,13 +134,18 @@ export function statusPreviewForEntry(
 export type ActivityThreadStatusId = AgentDotState
 
 /** Single classifier behind grouping, labels, and clear-completed; the only place the
- *  interrupted predicate is spelled. */
+ *  verdict predicate is spelled. */
 export function activityThreadStatusId(thread: AgentPaneThread): ActivityThreadStatusId {
+  // Why: a failed main agent outranks the subagent work still holding its row live.
+  if (thread.currentAgentEntry && agentVerdictDisplayMark(thread.currentAgentEntry) === 'failed') {
+    return 'failed'
+  }
   const paneEntry = paneActivityEntry(thread)
   const state = threadCurrentState(thread) ?? 'done'
-  const interrupted = paneEntry ? paneEntry.interrupted : thread.latestEvent?.entry.interrupted
-  if (!thread.currentAgentState && state === 'done' && interrupted) {
-    return 'interrupted'
+  const verdictEntry = paneEntry ?? thread.latestEvent?.entry
+  const verdictDot = verdictEntry ? agentVerdictDisplayMark(verdictEntry) : null
+  if (!thread.currentAgentState && state === 'done' && verdictDot) {
+    return verdictDot
   }
   return state
 }
@@ -149,7 +168,7 @@ function threadCurrentState(
   )
 }
 
-// Interrupted rows deliberately keep the done glyph (#2569).
+// Interrupted rows deliberately keep the done glyph (#2569); a failure is a fault and does not.
 export function threadAgentState(thread: AgentPaneThread): AgentDotState {
   const id = activityThreadStatusId(thread)
   return id === 'interrupted' ? 'done' : id
diff --git a/src/renderer/src/components/agent-child-row-parity.test.tsx b/src/renderer/src/components/agent-child-row-parity.test.tsx
new file mode 100644
index 00000000000..c8e3b4bd190
--- /dev/null
+++ b/src/renderer/src/components/agent-child-row-parity.test.tsx
@@ -0,0 +1,631 @@
+/** @vitest-environment happy-dom */
+import { renderToStaticMarkup } from 'react-dom/server'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  agentChildRowContextForParent,
+  type AgentChildRowContext
+} from '../../../shared/agent-child-row-model'
+import type { AgentSessionBackgroundTask } from '../../../shared/agent-session-wire'
+import type { AgentChildWorkView } from '../../../shared/agent-status-child-work-view'
+import type { AgentStatusEntry } from '../../../shared/agent-status-types'
+import type { TerminalTab } from '../../../shared/terminal-tab-types'
+import DashboardAgentRow from '@/components/dashboard/DashboardAgentRow'
+import { NativeChatBackgroundTasksStatus } from '@/components/native-chat/NativeChatBackgroundTasksStatus'
+import { buildBackgroundTaskGroupsFromViews } from '@/components/native-chat/background-task-roster'
+import { CompactAgentRow } from '@/components/sidebar/worktree-card-compact-agent-row'
+import { buildSubagentChildRows } from '@/components/sidebar/worktree-subagent-child-rows'
+import { TooltipProvider } from '@/components/ui/tooltip'
+
+vi.mock('@/components/dashboard/use-agent-row-conversation-name', () => ({
+  useAgentRowConversationName: () => null
+}))
+
+vi.mock('@/components/sidebar/CacheTimer', () => ({
+  default: () => null,
+  usePromptCacheCountdownForPane: () => null
+}))
+
+const NOW = 1_000_000
+const MINUTE = 60_000
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.setSystemTime(NOW)
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+const tab: TerminalTab = {
+  id: 'parent-tab',
+  ptyId: null,
+  worktreeId: 'wt-1',
+  title: 'Parent',
+  customTitle: null,
+  color: null,
+  sortOrder: 0,
+  createdAt: 1
+}
+
+function view(id: string, overrides: Partial<AgentChildWorkView> = {}): AgentChildWorkView {
+  return {
+    id,
+    providerId: `task-${id}`,
+    kind: 'agent',
+    description: 'Audit the parser',
+    agentType: 'general-purpose',
+    state: 'working',
+    membership: 'live',
+    firstObservedAt: NOW - 5 * MINUTE,
+    observedAt: NOW - 2 * MINUTE,
+    stoppable: true,
+    invocation: { invocationId: `spawn-${id}`, generation: 1 },
+    ...overrides
+  }
+}
+
+function settled(
+  outcome: NonNullable<AgentChildWorkView['outcome']>,
+  overrides: Partial<AgentChildWorkView> = {}
+): AgentChildWorkView {
+  return view('child', {
+    state: 'done',
+    membership: 'settled',
+    outcome,
+    settledAt: NOW - 3 * MINUTE,
+    ...overrides
+  })
+}
+
+const OWNED_SHELL = view('shell', {
+  kind: 'command',
+  description: 'npm run dev',
+  agentType: undefined,
+  state: 'monitoring',
+  parentChildWorkId: 'child'
+})
+
+function parentWith(children: AgentChildWorkView[], updatedAt = NOW): AgentStatusEntry {
+  return {
+    paneKey: 'parent-tab:leaf-1',
+    tabId: tab.id,
+    worktreeId: tab.worktreeId,
+    state: 'done',
+    prompt: 'parent prompt',
+    updatedAt,
+    stateStartedAt: NOW - 20 * MINUTE,
+    stateHistory: [],
+    children
+  }
+}
+
+type RenderedRow = { dot: string; lead: string; trail: string }
+
+function readRow(root: Element, separator: string): RenderedRow {
+  const text = root.querySelector('span.truncate')
+  const [lead, trail] = [...(text?.children ?? [])].map((span) => span.textContent ?? '')
+  return {
+    dot: root.querySelector('[aria-label]')?.getAttribute('aria-label') ?? '',
+    lead: lead ?? '',
+    trail: trail?.startsWith(separator) ? trail.slice(separator.length) : (trail ?? '')
+  }
+}
+
+function mount(markup: string): HTMLElement {
+  const container = document.createElement('div')
+  container.innerHTML = markup
+  return container
+}
+
+function sidebarRows(parent: AgentStatusEntry, parentIsFresh = true): RenderedRow[] {
+  return buildSubagentChildRows({ parentEntry: parent, tab, parentIsFresh }).map((agent) =>
+    readRow(
+      mount(
+        renderToStaticMarkup(
+          <TooltipProvider>
+            <CompactAgentRow agent={agent} now={NOW} onActivate={() => {}} />
+          </TooltipProvider>
+        )
+      ),
+      ' - '
+    )
+  )
+}
+
+function stripRows(
+  children: AgentChildWorkView[] | undefined,
+  childRowContext?: AgentChildRowContext,
+  tasks: AgentSessionBackgroundTask[] = []
+): RenderedRow[] {
+  const root = mount(
+    renderToStaticMarkup(
+      <NativeChatBackgroundTasksStatus
+        tasks={tasks}
+        settledTasks={[]}
+        childViews={children}
+        childRowContext={childRowContext}
+        supportsTaskStop
+        supportsStopAll
+        stoppingTaskIds={new Set()}
+        stoppingAll={false}
+        indicatorActive
+        isVisible
+        expanded
+        onExpandedChange={() => {}}
+        onStop={() => {}}
+      />
+    )
+  )
+  return [...root.querySelectorAll('li')]
+    .filter((row) => row.querySelector(':scope > span.truncate'))
+    .map((row) => readRow(row, ' · '))
+}
+
+/** The full sidebar row: every dot label it carries, and its whole text. */
+function fullRow(parent: AgentStatusEntry): { labels: string[]; text: string } {
+  const [agent] = buildSubagentChildRows({ parentEntry: parent, tab, parentIsFresh: true })
+  const root = mount(
+    renderToStaticMarkup(
+      <TooltipProvider>
+        <DashboardAgentRow
+          agent={agent}
+          now={NOW}
+          onActivate={() => {}}
+          onDismiss={() => {}}
+          stateDotSize="sm"
+          hideExpand
+        />
+      </TooltipProvider>
+    )
+  )
+  return {
+    labels: [...root.querySelectorAll('[aria-label]')].map(
+      (element) => element.getAttribute('aria-label') ?? ''
+    ),
+    text: root.textContent ?? ''
+  }
+}
+
+const SCENARIOS: [string, AgentChildWorkView[], RenderedRow][] = [
+  [
+    'working, no known operation',
+    [view('child')],
+    { dot: 'Working', lead: 'Audit the parser', trail: 'general-purpose' }
+  ],
+  [
+    'working with a tool',
+    [
+      view('child', {
+        operation: { toolName: 'Read', input: 'src/parser.ts', basis: 'open', observedAt: NOW }
+      })
+    ],
+    { dot: 'Working', lead: 'Audit the parser', trail: 'Read: src/parser.ts' }
+  ],
+  [
+    'running a shell in the foreground',
+    [
+      view('child', {
+        operation: { toolName: 'Bash', input: 'npm test', basis: 'open', observedAt: NOW }
+      })
+    ],
+    { dot: 'Working', lead: 'Audit the parser', trail: 'Bash: npm test' }
+  ],
+  [
+    'finished, while a shell it launched still runs',
+    [settled('succeeded', { lastMessage: 'All green' }), OWNED_SHELL],
+    {
+      dot: 'Monitoring background tasks',
+      lead: 'Monitoring background tasks',
+      trail: 'Audit the parser'
+    }
+  ],
+  [
+    'waiting on an approval',
+    [
+      view('child', {
+        state: 'waiting',
+        operation: { toolName: 'Edit', input: 'src/parser.ts', basis: 'open', observedAt: NOW }
+      })
+    ],
+    { dot: 'Waiting for input', lead: 'Audit the parser', trail: 'Edit: src/parser.ts' }
+  ],
+  [
+    'blocked',
+    [view('child', { state: 'blocked', lastMessage: 'Rate limited, retrying' })],
+    { dot: 'Blocked', lead: 'Audit the parser', trail: 'Rate limited, retrying' }
+  ],
+  [
+    'finished',
+    [settled('succeeded', { lastMessage: 'Found 3 call sites' })],
+    { dot: 'Done', lead: 'Audit the parser', trail: 'Found 3 call sites' }
+  ],
+  [
+    'failed',
+    [settled('failed', { lastMessage: 'Exit code 1' })],
+    { dot: 'Failed', lead: 'Audit the parser', trail: 'Exit code 1' }
+  ],
+  [
+    'cancelled',
+    [settled('cancelled')],
+    { dot: 'Interrupted', lead: 'Audit the parser', trail: 'general-purpose' }
+  ],
+  [
+    'ended, outcome unknown',
+    [settled('unknown')],
+    { dot: 'Idle', lead: 'Audit the parser', trail: 'Ended' }
+  ],
+  [
+    'unverifiable',
+    [view('child', { state: 'unverifiable' })],
+    { dot: 'No recent update', lead: 'Audit the parser', trail: 'No update in 2m' }
+  ],
+  [
+    'parked, still live',
+    [view('child', { state: 'idle' })],
+    { dot: 'Idle', lead: 'Audit the parser', trail: 'general-purpose' }
+  ]
+]
+
+/** What the full sidebar row, the CLI row's own layout, shows of the same detail. */
+const FULL_ROW_DETAIL: Record<string, { shows: string[]; hides?: string[] }> = {
+  'working, no known operation': { shows: [] },
+  'working with a tool': { shows: ['Read', 'src/parser.ts'] },
+  'running a shell in the foreground': { shows: ['Bash', 'npm test'] },
+  'finished, while a shell it launched still runs': { shows: [], hides: ['All green'] },
+  'waiting on an approval': { shows: ['Edit', 'src/parser.ts'] },
+  blocked: { shows: ['Rate limited, retrying'] },
+  finished: { shows: ['Found 3 call sites'] },
+  failed: { shows: ['Exit code 1'] },
+  cancelled: { shows: [] },
+  'ended, outcome unknown': { shows: ['Ended'] },
+  unverifiable: { shows: ['No update in 2m'] },
+  'parked, still live': { shows: [] }
+}
+
+describe('a child reads the same in the sidebar and the chat strip', () => {
+  it.each(SCENARIOS)('%s', (name, children, expected) => {
+    const [sidebar] = sidebarRows(parentWith(children))
+    const [strip] = stripRows(children)
+    expect(sidebar).toEqual(expected)
+    expect(strip).toEqual(expected)
+    const full = fullRow(parentWith(children))
+    expect(full.labels).toContain(expected.dot)
+    expect(full.text).toContain(expected.lead === expected.dot ? expected.trail : expected.lead)
+    for (const text of FULL_ROW_DETAIL[name].shows) {
+      expect(full.text).toContain(text)
+    }
+    for (const text of FULL_ROW_DETAIL[name].hides ?? []) {
+      expect(full.text).not.toContain(text)
+    }
+  })
+
+  it('names an unlabeled child by the same state on every surface', () => {
+    const children = [
+      settled('failed', { description: undefined, agentType: undefined, lastMessage: 'Exit 2' })
+    ]
+    const [sidebar] = sidebarRows(parentWith(children))
+    const [strip] = stripRows(children)
+    expect(sidebar.lead).toBe('Failed')
+    expect(strip.lead).toBe('Failed')
+    expect(fullRow(parentWith(children)).text).toContain('Failed')
+  })
+
+  it('shows the monitoring icon on the full sidebar row too', () => {
+    const [agent] = buildSubagentChildRows({
+      parentEntry: parentWith([settled('succeeded'), OWNED_SHELL]),
+      tab,
+      parentIsFresh: true
+    })
+    const root = mount(
+      renderToStaticMarkup(
+        <TooltipProvider>
+          <DashboardAgentRow
+            agent={agent}
+            now={NOW}
+            onActivate={() => {}}
+            onDismiss={() => {}}
+            stateDotSize="sm"
+            hideExpand
+          />
+        </TooltipProvider>
+      )
+    )
+    expect(root.querySelector('[aria-label]')?.getAttribute('aria-label')).toBe(
+      'Monitoring background tasks'
+    )
+    // The finished child's last tool line is stale; neither row names it.
+    expect(root.textContent).not.toContain('Bash')
+  })
+
+  it('never shows a monitoring child tool text on either surface', () => {
+    const children = [
+      settled('succeeded', { lastMessage: 'Bash: npm test finished' }),
+      { ...OWNED_SHELL, description: 'tail -f server.log' }
+    ]
+    const [sidebar] = sidebarRows(parentWith(children))
+    const [strip] = stripRows(children)
+    for (const row of [sidebar, strip]) {
+      expect(row.dot).toBe('Monitoring background tasks')
+      expect(`${row.lead} ${row.trail}`).not.toContain('npm test')
+    }
+  })
+})
+
+describe('a child running a shell in its turn', () => {
+  // The host records the running shell both as the child's operation and as a live command it owns.
+  const children = [
+    view('child', {
+      operation: { toolName: 'Bash', input: 'npm run dev', basis: 'open', observedAt: NOW }
+    }),
+    {
+      ...OWNED_SHELL,
+      state: 'working' as const,
+      stoppable: false,
+      firstObservedAt: NOW - MINUTE
+    }
+  ]
+  const childRow: RenderedRow = {
+    dot: 'Working',
+    lead: 'Audit the parser',
+    trail: 'Bash: npm run dev'
+  }
+
+  it('reads as the child working its shell, with the shell nested beneath it in the strip', () => {
+    const groups = buildBackgroundTaskGroupsFromViews(children)
+    expect(groups.map((group) => group.kind)).toEqual(['agent'])
+    expect(groups[0].tasks.map((entry) => entry.row.owned.map((owned) => owned.id))).toEqual([
+      ['shell']
+    ])
+    expect(stripRows(children)).toEqual([
+      childRow,
+      { dot: 'Working', lead: 'npm run dev', trail: '' }
+    ])
+  })
+
+  it('shows the sidebar only the child, saying what the strip says of it', () => {
+    expect(sidebarRows(parentWith(children))).toEqual([childRow])
+  })
+})
+
+describe('one child reads the same from every shape a host publishes', () => {
+  it('names and details it identically from views, the subagents snapshot and the task roster', () => {
+    // A placeholder description falls through to the child's real label on every path.
+    const children = [view('child', { description: 'task', agentType: 'Explore' })]
+    const snapshotParent: AgentStatusEntry = {
+      ...parentWith([]),
+      children: undefined,
+      subagents: [
+        {
+          id: 'child',
+          state: 'working',
+          startedAt: NOW - 5 * MINUTE,
+          description: 'task',
+          agentType: 'Explore'
+        }
+      ]
+    }
+    const roster: AgentSessionBackgroundTask[] = [
+      { id: 'child', kind: 'agent', description: 'task', name: 'Explore', state: 'working' }
+    ]
+    const expected: RenderedRow = { dot: 'Working', lead: 'Explore', trail: '' }
+    expect(sidebarRows(parentWith(children))).toEqual([expected])
+    expect(sidebarRows(snapshotParent)).toEqual([expected])
+    expect(stripRows(children)).toEqual([expected])
+    expect(stripRows(undefined, undefined, roster)).toEqual([expected])
+  })
+})
+
+describe('a mirrored parent and its children read one silence', () => {
+  const SKEW = 20 * MINUTE
+  // The host's clock runs 20 minutes ahead; this machine received its last word 3 minutes ago.
+  function mirroredParent(overrides: Partial<AgentStatusEntry>): AgentStatusEntry {
+    return {
+      ...parentWith([]),
+      state: 'working',
+      updatedAt: NOW - 3 * MINUTE + SKEW,
+      mirroredEvidenceReceivedAt: NOW - 3 * MINUTE,
+      ...overrides
+    }
+  }
+
+  it('times a snapshot child on the receipt clock the parent decays on', () => {
+    const parent = mirroredParent({
+      children: undefined,
+      subagents: [
+        { id: 'child', state: 'working', startedAt: NOW - 9 * MINUTE, description: 'Audit' }
+      ]
+    })
+    expect(sidebarRows(parent, false)[0].trail).toBe('No update in 3m')
+  })
+
+  it('times a view child by its own host-clock age, never across machines', () => {
+    const children = [view('child', { observedAt: NOW - 5 * MINUTE + SKEW })]
+    const parent = mirroredParent({ children })
+    expect(sidebarRows(parent, false)[0].trail).toBe('No update in 5m')
+    expect(stripRows(children, agentChildRowContextForParent(parent, false))[0].trail).toBe(
+      'No update in 5m'
+    )
+    const [agent] = buildSubagentChildRows({ parentEntry: parent, tab, parentIsFresh: false })
+    const full = mount(
+      renderToStaticMarkup(
+        <TooltipProvider>
+          <DashboardAgentRow
+            agent={agent}
+            now={NOW}
+            onActivate={() => {}}
+            onDismiss={() => {}}
+            stateDotSize="sm"
+            hideExpand
+          />
+        </TooltipProvider>
+      )
+    )
+    expect(full.textContent).toContain('No update in 5m')
+  })
+})
+
+describe('a lost or stale parent reads the same on both surfaces', () => {
+  const children = [
+    view('child', {
+      operation: { toolName: 'Bash', input: 'npm test', basis: 'open', observedAt: NOW }
+    })
+  ]
+  const lost: RenderedRow = {
+    dot: 'No recent update',
+    lead: 'Audit the parser',
+    trail: 'No update in 2m'
+  }
+
+  it('when the transport to the host is lost', () => {
+    const parent = { ...parentWith(children), subagentObservation: 'unverifiable' as const }
+    const [sidebar] = sidebarRows(parent)
+    const [strip] = stripRows(children, agentChildRowContextForParent(parent, true))
+    expect(sidebar).toEqual(lost)
+    expect(strip).toEqual(lost)
+  })
+
+  it('when the parent row has gone stale', () => {
+    const parent = parentWith([settled('succeeded'), OWNED_SHELL], NOW - 40 * MINUTE)
+    const [sidebar] = sidebarRows(parent, false)
+    const [strip] = stripRows(parent.children ?? [], agentChildRowContextForParent(parent, false))
+    const stale = { dot: 'No recent update', lead: 'Audit the parser', trail: 'No update in 2m' }
+    expect(sidebar).toEqual(stale)
+    expect(strip).toEqual(stale)
+  })
+
+  it('without a context the strip reports what the host last said', () => {
+    expect(stripRows(children)[0].dot).toBe('Working')
+  })
+})
+
+describe('sibling child rows keep their own clocks', () => {
+  it('reads each sibling from its own evidence, not the parent clock', () => {
+    const parent = parentWith(
+      [
+        view('busy', { description: 'Busy child', observedAt: NOW - 30_000 }),
+        view('quiet', {
+          description: 'Quiet child',
+          firstObservedAt: NOW - 15 * MINUTE,
+          observedAt: NOW - 10 * MINUTE
+        })
+      ],
+      NOW - 40 * MINUTE
+    )
+    const rows = buildSubagentChildRows({ parentEntry: parent, tab, parentIsFresh: false })
+    expect(rows.map((row) => row.entry.evidenceObservedAt)).toEqual([
+      NOW - 30_000,
+      NOW - 10 * MINUTE
+    ])
+    expect(rows.map((row) => row.startedAt)).toEqual([NOW - 5 * MINUTE, NOW - 15 * MINUTE])
+    expect(sidebarRows(parent, false).map((row) => row.trail)).toEqual([
+      'No update in 0m',
+      'No update in 10m'
+    ])
+  })
+
+  it('times a settled child from when it ended in the sidebar, and freezes its run in the strip', () => {
+    const [agent] = buildSubagentChildRows({
+      parentEntry: parentWith([settled('succeeded')]),
+      tab,
+      parentIsFresh: true
+    })
+    const text = mount(
+      renderToStaticMarkup(
+        <TooltipProvider>
+          <CompactAgentRow agent={agent} now={NOW} onActivate={() => {}} />
+        </TooltipProvider>
+      )
+    ).textContent
+    expect(text?.endsWith('3m')).toBe(true)
+    const strip = mount(
+      renderToStaticMarkup(
+        <NativeChatBackgroundTasksStatus
+          tasks={[]}
+          settledTasks={[]}
+          childViews={[settled('succeeded')]}
+          supportsTaskStop
+          supportsStopAll
+          stoppingTaskIds={new Set()}
+          stoppingAll={false}
+          indicatorActive
+          isVisible
+          expanded
+          onExpandedChange={() => {}}
+          onStop={() => {}}
+        />
+      )
+    )
+    // Ran from 5m ago until it settled 3m ago; a finished row never ticks.
+    expect(strip.querySelector('li')?.textContent).toMatch(/2m 0s$/)
+  })
+})
+
+describe('the chat strip from views', () => {
+  it('nests a child-owned shell under its owner and stops by the provider id', () => {
+    const children = [
+      view('child', { description: 'Dev server owner' }),
+      view('shell', {
+        kind: 'command',
+        description: 'npm run dev',
+        agentType: undefined,
+        state: 'monitoring',
+        parentChildWorkId: 'child'
+      }),
+      view('main-shell', {
+        kind: 'command',
+        description: 'tail -f log',
+        agentType: undefined,
+        state: 'monitoring'
+      })
+    ]
+    const root = mount(
+      renderToStaticMarkup(
+        <NativeChatBackgroundTasksStatus
+          tasks={[]}
+          settledTasks={[]}
+          childViews={children}
+          supportsTaskStop
+          supportsStopAll
+          stoppingTaskIds={new Set(['task-shell'])}
+          stoppingAll={false}
+          indicatorActive
+          isVisible
+          expanded
+          onExpandedChange={() => {}}
+          onStop={() => {}}
+        />
+      )
+    )
+    const groups = [...root.querySelectorAll('ul[aria-label]')].map((list) =>
+      list.getAttribute('aria-label')
+    )
+    expect(groups).toEqual(['Agents', 'Shell'])
+    const nested = root.querySelector('ul[aria-label="Agents"] ul')
+    expect(nested?.textContent).toContain('npm run dev')
+    expect(root.querySelector('ul[aria-label="Shell"]')?.textContent).not.toContain('npm run dev')
+    const stopShell = root.querySelector('button[aria-label="Stop npm run dev"]')
+    expect(stopShell?.hasAttribute('disabled')).toBe(true)
+  })
+})
+
+describe('one lifecycle word for a child, on the sidebar row and the strip header', () => {
+  it.each<[string, AgentChildWorkView[], string, string]>([
+    ['failed', [settled('failed')], 'blocked', 'blocked'],
+    ['cancelled', [settled('cancelled')], 'idle', 'idle'],
+    ['ended, outcome unknown', [settled('unknown')], 'idle', 'idle'],
+    ['finished', [settled('succeeded')], 'done', 'done'],
+    ['monitoring its own shell', [settled('succeeded'), OWNED_SHELL], 'working', 'monitoring'],
+    ['waiting', [view('child', { state: 'waiting' })], 'waiting', 'waiting']
+  ])('%s', (_name, children, sidebarState, headerState) => {
+    const [sidebar] = buildSubagentChildRows({
+      parentEntry: parentWith(children),
+      tab,
+      parentIsFresh: true
+    })
+    const [group] = buildBackgroundTaskGroupsFromViews(children)
+    // A CLI row carries monitoring as `working` plus its working mode; every other word is shared.
+    expect(sidebar.state).toBe(sidebarState)
+    expect(group.tasks[0].state).toBe(headerState)
+  })
+})
diff --git a/src/renderer/src/components/agent-child-row-text.ts b/src/renderer/src/components/agent-child-row-text.ts
new file mode 100644
index 00000000000..96ef7d1d5c7
--- /dev/null
+++ b/src/renderer/src/components/agent-child-row-text.ts
@@ -0,0 +1,69 @@
+import type { AgentChildRowModel } from '../../../shared/agent-child-row-model'
+import { formatAgentTypeLabel } from '../../../shared/agent-type-label'
+import { agentStateLabel } from '@/components/AgentStateDot'
+import { backgroundTaskStateReason } from '@/components/native-chat/background-task-roster'
+import { translate } from '@/i18n/i18n'
+import { agentNoUpdateLabel } from '@/lib/agent-row-decay-state'
+import { formatAgentToolPreview } from '@/lib/agent-row-tool-preview'
+
+export type AgentChildRowText = {
+  /** Leads the line; kept when the row truncates. */
+  lead: string
+  /** Follows the separator; '' when there is nothing more to say. */
+  trail: string
+}
+
+/** How long this child has been silent, on the reader's clock the model measured it on. */
+export function agentChildRowNoUpdateLabel(row: AgentChildRowModel, now: number): string {
+  return agentNoUpdateLabel({ updatedAt: row.recencyAt }, now)
+}
+
+/** The words for a row's detail, reusing the phrasing a CLI agent row uses for the same fact. */
+export function agentChildRowDetailText(row: AgentChildRowModel, now: number): string {
+  const detail = row.detail
+  if (!detail) {
+    return ''
+  }
+  switch (detail.kind) {
+    case 'operation':
+      return formatAgentToolPreview(
+        { toolName: detail.toolName, toolInput: detail.input },
+        'working'
+      )
+    case 'monitoring':
+      return agentStateLabel('monitoring')
+    case 'message':
+      return detail.text
+    case 'ended':
+      return translate('components.agentChildRow.ended', 'Ended')
+    case 'no-update':
+      return agentChildRowNoUpdateLabel(row, now)
+    case 'role':
+      return formatAgentTypeLabel(detail.agentType)
+    case 'reason':
+      return backgroundTaskStateReason(detail.state) ?? ''
+  }
+}
+
+/** The line beneath a full-width row: what the child said, or that it ended; '' otherwise. */
+export function agentChildRowMessageLine(row: AgentChildRowModel): string {
+  if (row.detail?.kind === 'message') {
+    return row.detail.text
+  }
+  return row.detail?.kind === 'ended' ? translate('components.agentChildRow.ended', 'Ended') : ''
+}
+
+/** The row's name, or its state when the child reported none. */
+export function agentChildRowName(row: AgentChildRowModel): string {
+  return row.name.trim() || agentStateLabel(row.displayState)
+}
+
+export function agentChildRowText(row: AgentChildRowModel, now: number): AgentChildRowText {
+  const name = agentChildRowName(row)
+  const detail = agentChildRowDetailText(row, now)
+  // Why: a monitoring row leads with its state so truncation keeps passive distinct from active.
+  if (row.displayState === 'monitoring' && detail) {
+    return { lead: detail, trail: detail === name ? '' : name }
+  }
+  return { lead: name, trail: detail }
+}
diff --git a/src/renderer/src/components/agent-session-continuation/AgentSessionContinuationDialog.tsx b/src/renderer/src/components/agent-session-continuation/AgentSessionContinuationDialog.tsx
index aa752c4b50f..1f7b2ebb391 100644
--- a/src/renderer/src/components/agent-session-continuation/AgentSessionContinuationDialog.tsx
+++ b/src/renderer/src/components/agent-session-continuation/AgentSessionContinuationDialog.tsx
@@ -134,7 +134,6 @@ export function AgentSessionContinuationDialog({
       prompt,
       worktreeId: request.worktreeId,
       groupId: request.groupId,
-      workspacePath: request.workspacePath,
       initialCwd: request.initialCwd,
       launchSource: request.launchSource
     })
diff --git a/src/renderer/src/components/artifacts/ArtifactCollection.test.tsx b/src/renderer/src/components/artifacts/ArtifactCollection.test.tsx
index 7a275441885..7639cf82f9d 100644
--- a/src/renderer/src/components/artifacts/ArtifactCollection.test.tsx
+++ b/src/renderer/src/components/artifacts/ArtifactCollection.test.tsx
@@ -185,11 +185,11 @@ describe('ArtifactCollection', () => {
   // Why: happy-dom has no layout, and the virtualizer sizes its window from the scroller's
   // offsetHeight — left at 0 it mounts no rows at all and the assertions below would be vacuous.
   function stubScrollerViewport(): void {
-    vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(
-      function (this: HTMLElement) {
-        return this.classList.contains('overflow-auto') ? 600 : 53
-      }
-    )
+    vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(function (
+      this: HTMLElement
+    ) {
+      return this.classList.contains('overflow-auto') ? 600 : 53
+    })
   }
 
   function announcedSetSizes(container: HTMLElement): string[] {
diff --git a/src/renderer/src/components/artifacts/ArtifactPublishButton.test.tsx b/src/renderer/src/components/artifacts/ArtifactPublishButton.test.tsx
index 77f64b0217c..2b79aa81d31 100644
--- a/src/renderer/src/components/artifacts/ArtifactPublishButton.test.tsx
+++ b/src/renderer/src/components/artifacts/ArtifactPublishButton.test.tsx
@@ -1,12 +1,28 @@
 // @vitest-environment happy-dom
 
 import '@testing-library/jest-dom/vitest'
-import type { ReactNode } from 'react'
+import { createRef, type ReactNode } from 'react'
 import { cleanup, render, screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const mocks = vi.hoisted(() => ({
+type ArtifactPublishButtonMocks = {
+  connect: ReturnType<typeof vi.fn>
+  openSettingsPage: ReturnType<typeof vi.fn>
+  openSettingsTarget: ReturnType<typeof vi.fn>
+  getPublishedLink: ReturnType<typeof vi.fn>
+  copyLink: ReturnType<typeof vi.fn>
+  openLink: ReturnType<typeof vi.fn>
+  publish: ReturnType<typeof vi.fn>
+  openPopover: ((open: boolean) => void) | null
+  closePopover: ((event: Event) => void) | null
+  state: {
+    orcaProfileAuthStatus: Record<string, unknown>
+    settings: { artifactSharingEnabled: boolean }
+  }
+}
+
+const mocks = vi.hoisted<ArtifactPublishButtonMocks>(() => ({
   connect: vi.fn(),
   openSettingsPage: vi.fn(),
   openSettingsTarget: vi.fn(),
@@ -14,9 +30,10 @@ const mocks = vi.hoisted(() => ({
   copyLink: vi.fn(),
   openLink: vi.fn(),
   publish: vi.fn(),
-  openPopover: null as ((open: boolean) => void) | null,
+  openPopover: null,
+  closePopover: null,
   state: {
-    orcaProfileAuthStatus: { configured: true, state: 'connected' } as Record<string, unknown>,
+    orcaProfileAuthStatus: { configured: true, state: 'connected' },
     settings: { artifactSharingEnabled: true }
   }
 }))
@@ -42,7 +59,17 @@ vi.mock('@/components/ui/popover', () => ({
     mocks.openPopover = onOpenChange ?? null
     return <>{children}</>
   },
-  PopoverContent: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  PopoverAnchor: ({ children }: { children?: ReactNode }) => <>{children}</>,
+  PopoverContent: ({
+    children,
+    onCloseAutoFocus
+  }: {
+    children: ReactNode
+    onCloseAutoFocus?: (event: Event) => void
+  }) => {
+    mocks.closePopover = onCloseAutoFocus ?? null
+    return <div>{children}</div>
+  },
   PopoverTrigger: ({ children }: { children: ReactNode }) => (
     <span onClick={() => mocks.openPopover?.(true)}>{children}</span>
   )
@@ -81,6 +108,7 @@ describe('ArtifactPublishButton', () => {
     mocks.getPublishedLink.mockResolvedValue(null)
     mocks.copyLink.mockResolvedValue(true)
     mocks.openPopover = null
+    mocks.closePopover = null
     mocks.state.orcaProfileAuthStatus = { configured: true, state: 'connected' }
     mocks.state.settings = { artifactSharingEnabled: true }
   })
@@ -101,6 +129,31 @@ describe('ArtifactPublishButton', () => {
     expect(screen.getByRole('button', { name: 'Update shared content' })).toBeInTheDocument()
   })
 
+  it('supports a controlled virtual anchor without rendering a second trigger', async () => {
+    const anchorRef = createRef<HTMLButtonElement>()
+    render(
+      <>
+        <button ref={anchorRef}>Overflow</button>
+        <ArtifactPublishButton
+          sourceKey="/repo/report.md"
+          createRequest={vi.fn()}
+          anchorRef={anchorRef}
+          open
+          onOpenChange={vi.fn()}
+        />
+      </>
+    )
+
+    expect(screen.queryByRole('button', { name: 'Share as artifact' })).toBeNull()
+    expect(await screen.findByRole('button', { name: 'Generate link' })).toBeInTheDocument()
+
+    const focus = vi.spyOn(anchorRef.current!, 'focus')
+    const closeEvent = new Event('close', { cancelable: true })
+    mocks.closePopover?.(closeEvent)
+    expect(closeEvent.defaultPrevented).toBe(true)
+    expect(focus).toHaveBeenCalledWith({ preventScroll: true })
+  })
+
   it('offers sign-in and blocks confirmation while signed out', async () => {
     const user = userEvent.setup()
     mocks.state.orcaProfileAuthStatus = { configured: true, state: 'local' }
diff --git a/src/renderer/src/components/artifacts/ArtifactPublishButton.tsx b/src/renderer/src/components/artifacts/ArtifactPublishButton.tsx
index bf6fb236003..a90c1c037a9 100644
--- a/src/renderer/src/components/artifacts/ArtifactPublishButton.tsx
+++ b/src/renderer/src/components/artifacts/ArtifactPublishButton.tsx
@@ -1,8 +1,8 @@
-import { useEffect, useRef, useState } from 'react'
+import { useEffect, useRef, useState, type RefObject } from 'react'
 import { ArrowRight, Loader2, Share2 } from 'lucide-react'
 import type { ArtifactWriteRequest } from '../../../../shared/artifacts'
 import { Button } from '@/components/ui/button'
-import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover'
+import { Popover, PopoverAnchor, PopoverContent, PopoverTrigger } from '@/components/ui/popover'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
 import { translate } from '@/i18n/i18n'
 import { cn } from '@/lib/utils'
@@ -21,14 +21,26 @@ export function ArtifactPublishButton({
   sourceKey,
   createRequest,
   className,
-  disabled
+  disabled,
+  anchorRef,
+  open: controlledOpen,
+  onOpenChange
 }: {
   sourceKey: string
   createRequest: () => Promise<ArtifactWriteRequest>
   className?: string
   disabled?: boolean
-}): React.JSX.Element {
-  const [open, setOpen] = useState(false)
+} & (
+  | { anchorRef?: never; open?: never; onOpenChange?: never }
+  | {
+      anchorRef?: RefObject<HTMLButtonElement | null>
+      open: boolean
+      onOpenChange: (open: boolean) => void
+    }
+)): React.JSX.Element {
+  const [ownOpen, setOwnOpen] = useState(false)
+  const open = controlledOpen ?? ownOpen
+  const setOpen = onOpenChange ?? setOwnOpen
   const [publishing, setPublishing] = useState(false)
   const [lookupRevision, setLookupRevision] = useState(0)
   const [linkLookup, setLinkLookup] = useState<PublishedLinkLookup | null>(null)
@@ -111,25 +123,32 @@ export function ArtifactPublishButton({
   )
   return (
     <Popover open={open} onOpenChange={(nextOpen) => !busy && setOpen(nextOpen)}>
-      <Tooltip>
-        <TooltipTrigger asChild>
-          <PopoverTrigger asChild>
-            <Button
-              type="button"
-              variant="ghost"
-              size="icon-sm"
-              className={cn('shrink-0', className)}
-              disabled={blocked}
-              aria-label={label}
-            >
-              {publishing ? <Loader2 className="animate-spin" /> : <Share2 />}
-            </Button>
-          </PopoverTrigger>
-        </TooltipTrigger>
-        <TooltipContent side="bottom" sideOffset={4}>
-          {label}
-        </TooltipContent>
-      </Tooltip>
+      {anchorRef ? (
+        <PopoverAnchor
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: DOM refs are transiently null before mount, though Radix's virtualRef type omits that lifecycle state.
+          virtualRef={anchorRef as RefObject<HTMLButtonElement>}
+        />
+      ) : (
+        <Tooltip>
+          <TooltipTrigger asChild>
+            <PopoverTrigger asChild>
+              <Button
+                type="button"
+                variant="ghost"
+                size="icon-sm"
+                className={cn('shrink-0', className)}
+                disabled={blocked}
+                aria-label={label}
+              >
+                {publishing ? <Loader2 className="animate-spin" /> : <Share2 />}
+              </Button>
+            </PopoverTrigger>
+          </TooltipTrigger>
+          <TooltipContent side="bottom" sideOffset={4}>
+            {label}
+          </TooltipContent>
+        </Tooltip>
+      )}
 
       <PopoverContent
         ref={popoverContentRef}
@@ -141,6 +160,13 @@ export function ArtifactPublishButton({
           event.preventDefault()
           popoverContentRef.current?.focus({ preventScroll: true })
         }}
+        onCloseAutoFocus={(event) => {
+          if (!anchorRef) {
+            return
+          }
+          event.preventDefault()
+          anchorRef.current?.focus({ preventScroll: true })
+        }}
       >
         <div className="space-y-1 border-b border-border/60 px-4 py-3.5">
           <h3 className="text-sm font-semibold">
diff --git a/src/renderer/src/components/artifacts/artifact-list-windowing.test.tsx b/src/renderer/src/components/artifacts/artifact-list-windowing.test.tsx
index 4723af3d015..ca8a4a916c0 100644
--- a/src/renderer/src/components/artifacts/artifact-list-windowing.test.tsx
+++ b/src/renderer/src/components/artifacts/artifact-list-windowing.test.tsx
@@ -303,11 +303,11 @@ beforeEach(() => {
   root = createRoot(host)
 
   vi.stubGlobal('ResizeObserver', MockResizeObserver)
-  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(
-    function (this: HTMLElement) {
-      return elementHeight(this)
-    }
-  )
+  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(function (
+    this: HTMLElement
+  ) {
+    return elementHeight(this)
+  })
   vi.spyOn(Element.prototype, 'getBoundingClientRect').mockImplementation(function (this: Element) {
     const top = topsByElement.get(this) ?? 0
     const height = elementHeight(this)
diff --git a/src/renderer/src/components/automations/AutomationEditorPromptEditor.tsx b/src/renderer/src/components/automations/AutomationEditorPromptEditor.tsx
index 69de2374d27..2772a6ae24d 100644
--- a/src/renderer/src/components/automations/AutomationEditorPromptEditor.tsx
+++ b/src/renderer/src/components/automations/AutomationEditorPromptEditor.tsx
@@ -5,7 +5,7 @@ import { installMonacoEditorFindShortcut } from '@/components/editor/editor-shor
 import { syncContentOnMount, syncContentUpdate } from '@/components/editor/monaco-content-sync'
 import { isMonacoFindWidgetOpen } from '@/components/editor/monaco-find-widget'
 import { computeEditorFontSize, resolveEditorFontFamily } from '@/lib/editor-font-zoom'
-import { resolveDocumentTheme } from '@/lib/document-theme'
+import { useDocumentDarkTheme } from '@/hooks/use-document-dark-theme'
 import '@/lib/monaco-setup'
 import { useAppStore } from '@/store'
 import { cn } from '@/lib/utils'
@@ -74,7 +74,7 @@ export function AutomationEditorPromptEditor({
 
   const fontSize = computeEditorFontSize(settings?.terminalFontSize ?? 13, editorFontZoomLevel)
   const fontFamily = resolveEditorFontFamily(settings)
-  const isDark = resolveDocumentTheme(settings?.theme ?? 'system')
+  const isDark = useDocumentDarkTheme()
   const options = useMemo(
     () =>
       buildAutomationPromptEditorOptions({
diff --git a/src/renderer/src/components/automations/AutomationPromptDisclosure.test.tsx b/src/renderer/src/components/automations/AutomationPromptDisclosure.test.tsx
index 6ac693aea82..e47619cf81f 100644
--- a/src/renderer/src/components/automations/AutomationPromptDisclosure.test.tsx
+++ b/src/renderer/src/components/automations/AutomationPromptDisclosure.test.tsx
@@ -70,21 +70,21 @@ describe('AutomationPromptDisclosure', () => {
   beforeEach(async () => {
     await i18n.changeLanguage('en')
     vi.stubGlobal('ResizeObserver', PromptResizeObserver)
-    vi.spyOn(HTMLElement.prototype, 'clientHeight', 'get').mockImplementation(
-      function (this: HTMLElement) {
-        if (this.tagName !== 'P') {
-          return 0
-        }
-        return this.classList.contains('line-clamp-4')
-          ? Math.min(promptNaturalHeight, 80)
-          : promptNaturalHeight
+    vi.spyOn(HTMLElement.prototype, 'clientHeight', 'get').mockImplementation(function (
+      this: HTMLElement
+    ) {
+      if (this.tagName !== 'P') {
+        return 0
       }
-    )
-    vi.spyOn(HTMLElement.prototype, 'scrollHeight', 'get').mockImplementation(
-      function (this: HTMLElement) {
-        return this.tagName === 'P' ? promptNaturalHeight : 0
-      }
-    )
+      return this.classList.contains('line-clamp-4')
+        ? Math.min(promptNaturalHeight, 80)
+        : promptNaturalHeight
+    })
+    vi.spyOn(HTMLElement.prototype, 'scrollHeight', 'get').mockImplementation(function (
+      this: HTMLElement
+    ) {
+      return this.tagName === 'P' ? promptNaturalHeight : 0
+    })
   })
 
   afterEach(async () => {
diff --git a/src/renderer/src/components/automations/automation-list-search.test.ts b/src/renderer/src/components/automations/automation-list-search.test.ts
index 5e9e880726f..3a9b3844164 100644
--- a/src/renderer/src/components/automations/automation-list-search.test.ts
+++ b/src/renderer/src/components/automations/automation-list-search.test.ts
@@ -8,15 +8,11 @@ import {
   AUTOMATION_LIST_SEARCH_QUERY_MAX_BYTES,
   AUTOMATION_LIST_SEARCH_WORKSPACE_MAX_CODE_UNITS,
   AUTOMATION_LIST_SEARCH_UNKNOWN_PROJECT,
-  automationListSearchFieldsMatch,
   automationListSearchIndexMatches,
   buildAutomationListSearchFingerprint,
   buildAutomationListSearchIndex,
   buildAutomationProjectSearchText,
   clampAutomationListSearchQueryInput,
-  filterByActiveAutomationListSearchQuery,
-  filterByAutomationListSearch,
-  filterByAutomationListSearchIndex,
   getActiveAutomationListSearchQuery,
   isAutomationListSearchQueryTooLarge,
   normalizeAutomationListSearchField,
@@ -38,19 +34,6 @@ describe('automation-list-search', () => {
     expect(isAutomationListSearchQueryTooLarge(oversized)).toBe(true)
     expect(getActiveAutomationListSearchQuery(oversized)).toBeNull()
     expect(resolveAutomationListSearchQuery(oversized)).toEqual({ status: 'too_large' })
-    expect(
-      automationListSearchFieldsMatch(
-        { name: 'Auto PR', project: 'orca', prompt: 'nudge' },
-        oversized
-      )
-    ).toBe(false)
-
-    const items = [
-      { id: '1', name: 'Auto PR', project: 'orca', prompt: 'nudge' },
-      { id: '2', name: 'Nightly', project: 'mobile', prompt: 'ship' }
-    ]
-    // Why: oversized paste must leave the list unfiltered, not blank it.
-    expect(filterByAutomationListSearch(items, oversized, (item) => item)).toBe(items)
   })
 
   it('rejects queries over the byte limit but under the code-unit limit', () => {
@@ -64,8 +47,6 @@ describe('automation-list-search', () => {
   it('treats whitespace-only queries as inactive (no search work)', () => {
     expect(getActiveAutomationListSearchQuery('   \t  ')).toBeNull()
     expect(resolveAutomationListSearchQuery('   ')).toEqual({ status: 'inactive' })
-    const items = [{ name: 'A', project: 'p1', prompt: 'one' }]
-    expect(filterByAutomationListSearch(items, '  ', (item) => item)).toBe(items)
   })
 
   it('clamps stored query input so multi-MB pastes are discarded', () => {
@@ -128,21 +109,6 @@ describe('automation-list-search', () => {
     expect(AUTOMATION_LIST_SEARCH_PROMPT_MAX_CODE_UNITS).toBe(2048)
   })
 
-  it('matches workspace, agent, and host alongside name, project, and prompt', () => {
-    const fields = {
-      name: 'Auto PR assignment',
-      project: 'orca / main',
-      workspace: 'feature/login-retry',
-      agent: 'Claude Code',
-      host: 'build-box',
-      prompt: 'Assign reviewers for open PRs'
-    }
-    for (const query of ['assignment', 'ORCA', 'login-retry', 'claude', 'build-box', 'reviewers']) {
-      expect(automationListSearchFieldsMatch(fields, query)).toBe(true)
-    }
-    expect(automationListSearchFieldsMatch(fields, 'missing')).toBe(false)
-  })
-
   it('bounds every indexed field, so no axis grows with its source', () => {
     const index = buildAutomationListSearchIndex({
       name: 'n'.repeat(10_000),
@@ -192,53 +158,6 @@ describe('automation-list-search', () => {
     )
   })
 
-  it('matches name, project, or prompt', () => {
-    const fields = {
-      name: 'Auto PR assignment',
-      project: 'orca / main',
-      prompt: 'Assign reviewers for open PRs'
-    }
-    expect(automationListSearchFieldsMatch(fields, 'assignment')).toBe(true)
-    expect(automationListSearchFieldsMatch(fields, 'ORCA')).toBe(true)
-    expect(automationListSearchFieldsMatch(fields, 'reviewers')).toBe(true)
-    expect(automationListSearchFieldsMatch(fields, 'missing')).toBe(false)
-  })
-
-  it('filters by active query without re-resolving bounds', () => {
-    const items = [
-      { id: '1', name: 'Auto Issue assignment', project: 'orca', prompt: 'triage issues' },
-      { id: '2', name: 'Nightly deploy', project: 'mobile', prompt: 'ship apk' },
-      { id: '3', name: 'PR nudge', project: 'orca', prompt: 'remind reviewers' }
-    ]
-    const indexes = items.map((item) =>
-      buildAutomationListSearchIndex({
-        name: item.name,
-        project: item.project,
-        prompt: item.prompt
-      })
-    )
-    expect(
-      filterByActiveAutomationListSearchQuery(items, indexes, 'apk').map((item) => item.id)
-    ).toEqual(['2'])
-    expect(
-      filterByAutomationListSearchIndex(items, indexes, 'orca').map((item) => item.id)
-    ).toEqual(['1', '3'])
-    expect(filterByAutomationListSearchIndex(items, indexes, '   ')).toBe(items)
-    expect(
-      filterByAutomationListSearchIndex(
-        items,
-        indexes,
-        'a'.repeat(AUTOMATION_LIST_SEARCH_QUERY_MAX_BYTES + 1)
-      )
-    ).toBe(items)
-    // Why: a desynchronized index must leave the list unfiltered, not blank it.
-    expect(
-      filterByActiveAutomationListSearchQuery(items, indexes.slice(0, 1), 'apk').map(
-        (item) => item.id
-      )
-    ).toEqual(['1', '2', '3'])
-  })
-
   it('builds a stable fingerprint from search sources only', () => {
     const sources = [
       { name: 'A', project: 'p1', prompt: 'one' },
diff --git a/src/renderer/src/components/automations/automation-list-search.ts b/src/renderer/src/components/automations/automation-list-search.ts
index 68df699c0c0..944fab58786 100644
--- a/src/renderer/src/components/automations/automation-list-search.ts
+++ b/src/renderer/src/components/automations/automation-list-search.ts
@@ -1,8 +1,3 @@
-import {
-  getActiveAutomationListSearchQuery,
-  resolveAutomationListSearchQuery
-} from './automation-list-search-query'
-
 export {
   AUTOMATION_LIST_SEARCH_QUERY_MAX_BYTES,
   clampAutomationListSearchQueryInput,
@@ -111,81 +106,6 @@ export function automationListSearchIndexMatches(
   return false
 }
 
-export function automationListSearchFieldsMatch(
-  fields: AutomationListSearchFields,
-  rawQuery: string
-): boolean {
-  const resolved = resolveAutomationListSearchQuery(rawQuery)
-  if (resolved.status === 'too_large') {
-    return false
-  }
-  if (resolved.status === 'inactive') {
-    return true
-  }
-  return automationListSearchIndexMatches(buildAutomationListSearchIndex(fields), resolved.query)
-}
-
-/**
- * Filters with an already-resolved active query. Callers must pass null/skip
- * when search is inactive or too large so this never runs "for free".
- */
-export function filterByActiveAutomationListSearchQuery<T>(
-  items: readonly T[],
-  indexes: readonly AutomationListSearchIndex[],
-  activeQuery: string
-): T[] {
-  if (indexes.length !== items.length) {
-    return [...items]
-  }
-  const matches: T[] = []
-  for (let i = 0; i < items.length; i += 1) {
-    const item = items[i]
-    const index = indexes[i]
-    if (item !== undefined && index && automationListSearchIndexMatches(index, activeQuery)) {
-      matches.push(item)
-    }
-  }
-  return matches
-}
-
-/**
- * Filters items by a prebuilt index. Empty and oversized queries leave the
- * original array reference untouched so the list stays unfiltered and search
- * work is skipped entirely.
- */
-export function filterByAutomationListSearchIndex<T>(
-  items: readonly T[],
-  indexes: readonly AutomationListSearchIndex[],
-  rawQuery: string
-): readonly T[] {
-  const activeQuery = getActiveAutomationListSearchQuery(rawQuery)
-  if (activeQuery === null) {
-    return items
-  }
-  return filterByActiveAutomationListSearchQuery(items, indexes, activeQuery)
-}
-
-/** Builds indexes then filters. Prefer prebuilt indexes when filtering often. */
-export function filterByAutomationListSearch<T>(
-  items: readonly T[],
-  rawQuery: string,
-  getFields: (item: T) => AutomationListSearchFields
-): readonly T[] {
-  const activeQuery = getActiveAutomationListSearchQuery(rawQuery)
-  if (activeQuery === null) {
-    return items
-  }
-  const matches: T[] = []
-  for (const item of items) {
-    if (
-      automationListSearchIndexMatches(buildAutomationListSearchIndex(getFields(item)), activeQuery)
-    ) {
-      matches.push(item)
-    }
-  }
-  return matches
-}
-
 /**
  * Content fingerprint for search-relevant fields only. Used so list refresh
  * ticks that replace arrays with equivalent search content do not rebuild
diff --git a/src/renderer/src/components/automations/automation-orca-save-operations.ts b/src/renderer/src/components/automations/automation-orca-save-operations.ts
index b12874d0036..914a6b47843 100644
--- a/src/renderer/src/components/automations/automation-orca-save-operations.ts
+++ b/src/renderer/src/components/automations/automation-orca-save-operations.ts
@@ -33,6 +33,7 @@ import type { AutomationHostTarget } from './automation-host-client'
 import type { AutomationAuthorityChangeReason } from './automation-host-invalidation'
 import type { AutomationSaveContext } from './automation-save-context'
 import { automationAuthorityCatalogKey } from './automation-host-catalog-types'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export type AutomationMoveOperationContext = {
   automationDispatchContext: AutomationDispatchContext
@@ -165,7 +166,7 @@ export async function moveAutomationToDestination(
   }
 
   const operationKey = `${source.id}:${target.entry.stableKey}`
-  const creationKey = context.moveCreationKeysRef.current.get(operationKey) ?? crypto.randomUUID()
+  const creationKey = context.moveCreationKeysRef.current.get(operationKey) ?? createBrowserUuid()
   context.moveCreationKeysRef.current.set(operationKey, creationKey)
   const created = toDispatchResult(
     await createAutomationAtDestination(
diff --git a/src/renderer/src/components/automations/automation-scoped-list-client.test.ts b/src/renderer/src/components/automations/automation-scoped-list-client.test.ts
index e07399319fb..43319886180 100644
--- a/src/renderer/src/components/automations/automation-scoped-list-client.test.ts
+++ b/src/renderer/src/components/automations/automation-scoped-list-client.test.ts
@@ -288,7 +288,7 @@ describe('owner-fenced mutations', () => {
   })
 
   it('fences a desktop mutation over the local runtime target with the same precondition', async () => {
-    const { deleteAutomationForOwner, updateAutomationForOwner } = await client()
+    const { updateAutomationForOwner } = await client()
     callRuntimeRpc.mockResolvedValue({ automation: { id: 'a1' } })
     await updateAutomationForOwner({ authority: DESKTOP, selector: { kind: 'self' } }, 'a1', {
       enabled: true
@@ -300,7 +300,6 @@ describe('owner-fenced mutations', () => {
       expect.anything()
     )
     expect(getRuntimeEnvironmentStatus).not.toHaveBeenCalled()
-    expect(typeof deleteAutomationForOwner).toBe('function')
   })
 })
 
diff --git a/src/renderer/src/components/browser-cookie-import-google-disclosure.test.tsx b/src/renderer/src/components/browser-cookie-import-google-disclosure.test.tsx
index b7c210c3818..ed8cc04c31f 100644
--- a/src/renderer/src/components/browser-cookie-import-google-disclosure.test.tsx
+++ b/src/renderer/src/components/browser-cookie-import-google-disclosure.test.tsx
@@ -4,7 +4,7 @@
  * STA-3811: imports never touch the Google cookie family, so every import menu must disclose it
  * at the moment of decision.
  */
-import { act, type ReactNode } from 'react'
+import { act, createRef, type ReactNode } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import en from '@/i18n/locales/en.json'
@@ -67,6 +67,12 @@ describe('cookie-import Google disclosure footer', () => {
           onImportFromFile={vi.fn()}
           viewportPresetId={null}
           onApplyViewportPreset={vi.fn()}
+          overflow={{
+            triggerRef: createRef<HTMLButtonElement>(),
+            tools: [],
+            deferUntilClose: vi.fn(),
+            onMenuCloseAutoFocus: vi.fn()
+          }}
         />
       )
     ],
diff --git a/src/renderer/src/components/browser-pane/annotate/BrowserAnnotationSendMenuContent.test.tsx b/src/renderer/src/components/browser-pane/annotate/BrowserAnnotationSendMenuContent.test.tsx
index 4eb4174211b..24524a10dc7 100644
--- a/src/renderer/src/components/browser-pane/annotate/BrowserAnnotationSendMenuContent.test.tsx
+++ b/src/renderer/src/components/browser-pane/annotate/BrowserAnnotationSendMenuContent.test.tsx
@@ -1,6 +1,4 @@
 import React from 'react'
-import { readFileSync } from 'node:fs'
-import { fileURLToPath } from 'node:url'
 import { describe, expect, it, vi } from 'vitest'
 import { BrowserAnnotationSendMenuContent } from './BrowserAnnotationSendMenuContent'
 
@@ -92,19 +90,4 @@ describe('BrowserAnnotationSendMenuContent', () => {
       onPromptDelivered
     })
   })
-
-  it('is wired into both browser annotation send surfaces', () => {
-    const bannerSource = readFileSync(
-      fileURLToPath(new URL('../assemble-chrome/browser-page-chrome-banners.tsx', import.meta.url)),
-      'utf8'
-    )
-    const traySource = readFileSync(
-      fileURLToPath(new URL('./browser-page-annotation-tray.tsx', import.meta.url)),
-      'utf8'
-    )
-    const sendSurfaces = `${bannerSource}\n${traySource}`
-
-    expect(sendSurfaces.match(/<BrowserAnnotationSendMenuContent\b/g)).toHaveLength(2)
-    expect(sendSurfaces).not.toContain('<QuickLaunchAgentMenuItems')
-  })
 })
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/BrowserImportHintButton.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/BrowserImportHintButton.tsx
index 8e606c8a0e1..701430e1971 100644
--- a/src/renderer/src/components/browser-pane/assemble-chrome/BrowserImportHintButton.tsx
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/BrowserImportHintButton.tsx
@@ -26,10 +26,12 @@ import { translate } from '@/i18n/i18n'
 
 type BrowserImportHintButtonProps = {
   profileId: string | null
+  compact?: boolean
 }
 
 export function BrowserImportHintButton({
-  profileId
+  profileId,
+  compact = false
 }: BrowserImportHintButtonProps): React.JSX.Element | null {
   const [open, setOpen] = useState(false)
   const [importMenuOpen, setImportMenuOpen] = useState(false)
@@ -178,7 +180,12 @@ export function BrowserImportHintButton({
           data-contextual-tour-target="browser-import-hint"
         >
           <Import className="size-3.5" />
-          {translate('auto.components.browser.pane.BrowserImportHintButton.b24fef25be', 'Import')}
+          {compact
+            ? null
+            : translate(
+                'auto.components.browser.pane.BrowserImportHintButton.b24fef25be',
+                'Import'
+              )}
         </Button>
       </PopoverTrigger>
       <PopoverContent align="end" side="bottom" sideOffset={6} className="w-80 p-3">
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.remote-link-routing.test.ts b/src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.remote-link-routing.test.ts
deleted file mode 100644
index 856ac24c725..00000000000
--- a/src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.remote-link-routing.test.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { fileURLToPath } from 'node:url'
-import { describe, expect, it } from 'vitest'
-
-describe('remote browser link routing', () => {
-  it('pins context-menu opens to the runtime that owns the pane', () => {
-    const source = readFileSync(
-      fileURLToPath(new URL('../stream-remote/remote-browser-page-pane.tsx', import.meta.url)),
-      'utf8'
-    )
-    const paneStart = source.indexOf('function RemoteBrowserPagePane')
-    const actionStart = source.indexOf('void openWorkspaceBrowserTab({', paneStart)
-    const actionEnd = source.indexOf('}).catch((error) => {', actionStart)
-    const openRequest = source.slice(actionStart, actionEnd)
-
-    expect(openRequest).toContain('workspaceId: worktreeId')
-    expect(openRequest).toContain('expectedRuntimeEnvironmentId: runtimeEnvironmentId')
-    expect(openRequest).toContain("placementPreference: 'server'")
-  })
-})
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.render-ipc.test.ts b/src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.render-ipc.test.ts
deleted file mode 100644
index 9e42075283c..00000000000
--- a/src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.render-ipc.test.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { fileURLToPath } from 'node:url'
-import { describe, expect, it } from 'vitest'
-
-describe('BrowserPagePane render IPC boundary', () => {
-  it('derives toolbar URLs without querying the webview', () => {
-    const source = readFileSync(
-      fileURLToPath(new URL('./browser-page-pane.tsx', import.meta.url)),
-      'utf8'
-    )
-    const start = source.indexOf('const isBlankTab =', source.indexOf('function BrowserPagePane'))
-    const end = source.indexOf('useEffect(() => {', start)
-    const renderUrlDerivation = source.slice(start, end)
-
-    expect(renderUrlDerivation).toContain('getLiveBrowserUrl(browserTab.id)')
-    expect(renderUrlDerivation).not.toContain('webviewRef')
-    expect(renderUrlDerivation).not.toContain('.getURL(')
-  })
-})
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/BrowserToolbarMenu.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/BrowserToolbarMenu.tsx
index 026931d2554..c964a3fb6f3 100644
--- a/src/renderer/src/components/browser-pane/assemble-chrome/BrowserToolbarMenu.tsx
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/BrowserToolbarMenu.tsx
@@ -12,6 +12,7 @@ import {
 import { BrowserToolbarMenuDropdown } from './browser-toolbar-menu-dropdown'
 import { BrowserToolbarProfileDialogs } from './browser-toolbar-profile-dialogs'
 import { translate } from '@/i18n/i18n'
+import type { BrowserChromeOverflowMenuProps } from './browser-chrome-folded-tools'
 
 type BrowserToolbarMenuProps = {
   currentProfileId: string | null
@@ -20,6 +21,7 @@ type BrowserToolbarMenuProps = {
   viewportPresetId: BrowserViewportPresetId | null
   onDestroyWebview: () => void
   isActive: boolean
+  overflow: BrowserChromeOverflowMenuProps
 }
 
 export function BrowserToolbarMenu({
@@ -28,7 +30,8 @@ export function BrowserToolbarMenu({
   browserPageId,
   viewportPresetId,
   onDestroyWebview,
-  isActive
+  isActive,
+  overflow
 }: BrowserToolbarMenuProps): React.JSX.Element {
   const browserSessionProfiles = useAppStore((s) => s.browserSessionProfiles)
   const detectedBrowsers = useAppStore((s) => s.detectedBrowsers)
@@ -241,6 +244,7 @@ export function BrowserToolbarMenu({
         onImportFromFile={() => void handleImportFromFile()}
         viewportPresetId={viewportPresetId}
         onApplyViewportPreset={applyViewportPreset}
+        overflow={overflow}
       />
 
       <BrowserToolbarProfileDialogs
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-element-tool-buttons.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-element-tool-buttons.tsx
new file mode 100644
index 00000000000..b8c9bd5132d
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-element-tool-buttons.tsx
@@ -0,0 +1,109 @@
+import { Crosshair, MessageSquarePlus } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { translate } from '@/i18n/i18n'
+import { cn } from '@/lib/utils'
+import type { GrabIntent } from '../describe-page/browser-page-types'
+
+/** The in-guest element picker, driving both Grab (copy) and Annotate (comment). */
+export type BrowserChromeElementTools = {
+  /** The intent the picker is armed for right now, or null when it is idle. */
+  activeIntent: GrabIntent | null
+  onStartIntent: (intent: GrabIntent) => void
+  disabled: boolean
+  grabShortcutLabel: string
+  annotationCount: number
+}
+
+export function BrowserChromeElementToolButtons({
+  tools,
+  showGrab,
+  showAnnotate,
+  showTourAnchors
+}: {
+  tools: BrowserChromeElementTools
+  showGrab: boolean
+  showAnnotate: boolean
+  showTourAnchors: boolean
+}): React.JSX.Element {
+  return (
+    <>
+      {showGrab ? (
+        <Tooltip>
+          <TooltipTrigger asChild>
+            <span className="inline-flex">
+              <Button
+                size="icon"
+                variant={tools.activeIntent === 'copy' ? 'default' : 'ghost'}
+                className={cn(
+                  'h-8 w-8',
+                  tools.activeIntent === 'copy' &&
+                    'bg-foreground/80 text-background hover:bg-foreground/90'
+                )}
+                onClick={() => tools.onStartIntent('copy')}
+                disabled={tools.disabled}
+                aria-label={translate(
+                  'auto.components.browser.pane.BrowserPane.fdfc7fe0ef',
+                  'Grab page element'
+                )}
+                {...(showTourAnchors
+                  ? { 'data-contextual-tour-target': 'browser-grab-control' }
+                  : {})}
+              >
+                <Crosshair className="size-4" />
+              </Button>
+            </span>
+          </TooltipTrigger>
+          <TooltipContent side="bottom" sideOffset={4}>
+            {translate(
+              'auto.components.browser.pane.BrowserPane.acbe79fd01',
+              'Grab page element ({{value0}})',
+              { value0: tools.grabShortcutLabel }
+            )}
+          </TooltipContent>
+        </Tooltip>
+      ) : null}
+
+      {showAnnotate ? (
+        <Tooltip>
+          <TooltipTrigger asChild>
+            {/* Why: disabled buttons drop hover events, so the tooltip needs an enabled wrapper. */}
+            <span className="inline-flex">
+              <Button
+                size="icon"
+                variant={tools.activeIntent === 'annotate' ? 'default' : 'ghost'}
+                className={cn(
+                  'relative h-8 w-8',
+                  tools.activeIntent === 'annotate' &&
+                    'bg-foreground/80 text-background hover:bg-foreground/90'
+                )}
+                onClick={() => tools.onStartIntent('annotate')}
+                disabled={tools.disabled}
+                aria-label={translate(
+                  'auto.components.browser.pane.BrowserPane.fc9be38f6f',
+                  'Annotate page element'
+                )}
+                {...(showTourAnchors
+                  ? { 'data-contextual-tour-target': 'browser-annotation-control' }
+                  : {})}
+              >
+                <MessageSquarePlus className="size-4" />
+                {tools.annotationCount > 0 ? (
+                  <span className="absolute -top-1 -right-1 flex min-w-4 items-center justify-center rounded-full bg-primary px-1 text-[10px] leading-4 text-primary-foreground">
+                    {tools.annotationCount}
+                  </span>
+                ) : null}
+              </Button>
+            </span>
+          </TooltipTrigger>
+          <TooltipContent side="bottom" sideOffset={4}>
+            {translate(
+              'auto.components.browser.pane.BrowserPane.fc9be38f6f',
+              'Annotate page element'
+            )}
+          </TooltipContent>
+        </Tooltip>
+      ) : null}
+    </>
+  )
+}
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-folded-tools.test.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-folded-tools.test.tsx
new file mode 100644
index 00000000000..0247f46509b
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-folded-tools.test.tsx
@@ -0,0 +1,107 @@
+// @vitest-environment happy-dom
+import { cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { Share2 } from 'lucide-react'
+
+vi.mock('@/components/ui/dropdown-menu', () => ({
+  DropdownMenuItem: ({
+    children,
+    onSelect,
+    role,
+    'aria-checked': ariaChecked
+  }: {
+    children: React.ReactNode
+    onSelect: () => void
+    role?: string
+    'aria-checked'?: boolean
+  }) => (
+    <button role={role} aria-checked={ariaChecked} onClick={onSelect}>
+      {children}
+    </button>
+  ),
+  DropdownMenuSeparator: () => <hr />,
+  DropdownMenuShortcut: ({ children }: { children: React.ReactNode }) => <span>{children}</span>
+}))
+
+import { BrowserChromeFoldedMenuItems } from './browser-chrome-folded-tools'
+
+afterEach(cleanup)
+
+describe('BrowserChromeFoldedMenuItems', () => {
+  it('runs ordinary actions directly', () => {
+    const onSelect = vi.fn()
+    render(
+      <BrowserChromeFoldedMenuItems
+        tools={[{ stage: 'share', label: 'Share', icon: Share2, onSelect }]}
+        deferUntilClose={vi.fn()}
+      />
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'Share' }))
+    expect(onSelect).toHaveBeenCalledOnce()
+  })
+
+  it('defers popover actions until the menu closes', () => {
+    const onSelect = vi.fn()
+    const deferUntilClose = vi.fn()
+    render(
+      <BrowserChromeFoldedMenuItems
+        tools={[
+          {
+            stage: 'share',
+            label: 'Share',
+            icon: Share2,
+            onSelect,
+            deferUntilMenuClose: true
+          }
+        ]}
+        deferUntilClose={deferUntilClose}
+      />
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'Share' }))
+    expect(onSelect).not.toHaveBeenCalled()
+    expect(deferUntilClose).toHaveBeenCalledWith(onSelect)
+  })
+
+  it('preserves active state for folded toggle tools', () => {
+    render(
+      <BrowserChromeFoldedMenuItems
+        tools={[
+          {
+            stage: 'draw',
+            label: 'Draw',
+            icon: Share2,
+            onSelect: vi.fn(),
+            active: true
+          }
+        ]}
+        deferUntilClose={vi.fn()}
+      />
+    )
+
+    expect(
+      screen.getByRole('menuitemcheckbox', { name: 'Draw' }).getAttribute('aria-checked')
+    ).toBe('true')
+  })
+
+  it('gives toggle tools their own section, split from the actions by a divider', () => {
+    const { container } = render(
+      <BrowserChromeFoldedMenuItems
+        tools={[
+          { stage: 'draw', label: 'Draw', icon: Share2, onSelect: vi.fn(), active: false },
+          { stage: 'share', label: 'Share', icon: Share2, onSelect: vi.fn() }
+        ]}
+        deferUntilClose={vi.fn()}
+      />
+    )
+
+    // Rendered order: Draw, divider, Share, closing divider.
+    expect(Array.from(container.querySelectorAll('button, hr')).map((el) => el.tagName)).toEqual([
+      'BUTTON',
+      'HR',
+      'BUTTON',
+      'HR'
+    ])
+  })
+})
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-folded-tools.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-folded-tools.tsx
new file mode 100644
index 00000000000..3b6c4fd55e0
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-folded-tools.tsx
@@ -0,0 +1,106 @@
+import { Check } from 'lucide-react'
+import type { LucideIcon } from 'lucide-react'
+import {
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuShortcut
+} from '@/components/ui/dropdown-menu'
+import type { BrowserChromeFoldStage } from './use-browser-chrome-tool-fold'
+
+export type BrowserChromeFoldedTool = {
+  stage: BrowserChromeFoldStage
+  label: string
+  icon: LucideIcon
+  onSelect: () => void
+  disabled?: boolean
+  shortcut?: string
+  count?: number
+  /** Present for toggle tools, including false, so the menu preserves their pressed state. */
+  active?: boolean
+  /**
+   * Run only after the menu has closed and skip its focus return. A tool that opens its own
+   * popover needs this: focus landing back on the ⋯ trigger would dismiss that popover at once.
+   */
+  deferUntilMenuClose?: boolean
+}
+
+export type BrowserChromeOverflowMenuProps = {
+  triggerRef: React.RefObject<HTMLButtonElement | null>
+  tools: readonly BrowserChromeFoldedTool[]
+  deferUntilClose: (action: () => void) => void
+  onMenuCloseAutoFocus: (event: Event) => void
+}
+
+function FoldedToolContent({ tool }: { tool: BrowserChromeFoldedTool }): React.JSX.Element {
+  const showActiveCheck = tool.active === true
+  const showTrailing = showActiveCheck || Boolean(tool.count) || Boolean(tool.shortcut)
+  return (
+    <>
+      <tool.icon className="size-3.5" />
+      {tool.label}
+      {showTrailing ? (
+        // Why: a leading check column would push these icon rows out of line with the plain rows.
+        <span className="ml-auto flex items-center gap-2">
+          {showActiveCheck ? <Check className="size-3.5 text-foreground" /> : null}
+          {tool.count ? (
+            <span className="flex min-w-4 items-center justify-center rounded-full bg-primary px-1 text-[10px] leading-4 text-primary-foreground">
+              {tool.count}
+            </span>
+          ) : tool.shortcut ? (
+            <DropdownMenuShortcut>{tool.shortcut}</DropdownMenuShortcut>
+          ) : null}
+        </span>
+      ) : null}
+    </>
+  )
+}
+
+function FoldedToolRow({
+  tool,
+  deferUntilClose
+}: {
+  tool: BrowserChromeFoldedTool
+  deferUntilClose: (action: () => void) => void
+}): React.JSX.Element {
+  const onSelect = (): void =>
+    tool.deferUntilMenuClose ? deferUntilClose(tool.onSelect) : tool.onSelect()
+  return (
+    <DropdownMenuItem
+      disabled={tool.disabled}
+      onSelect={onSelect}
+      // Why: keeps toggle semantics without the checkbox item's reserved leading column,
+      // which would misalign this row's icon against the plain rows in the same menu.
+      {...(tool.active === undefined
+        ? {}
+        : { role: 'menuitemcheckbox', 'aria-checked': tool.active })}
+    >
+      <FoldedToolContent tool={tool} />
+    </DropdownMenuItem>
+  )
+}
+
+/** The toolbar tools that no longer fit, rendered at the top of a surface's ⋯ menu. */
+export function BrowserChromeFoldedMenuItems({
+  tools,
+  deferUntilClose
+}: Pick<BrowserChromeOverflowMenuProps, 'tools' | 'deferUntilClose'>): React.JSX.Element | null {
+  if (tools.length === 0) {
+    return null
+  }
+  // Why: the element/markup toggles fold first and carry on/off state, so they read as their own
+  // section ahead of the one-shot actions below rather than as one flat tool list.
+  const toggleTools = tools.filter((tool) => tool.active !== undefined)
+  const actionTools = tools.filter((tool) => tool.active === undefined)
+  return (
+    <>
+      {toggleTools.map((tool) => (
+        <FoldedToolRow key={tool.stage} tool={tool} deferUntilClose={deferUntilClose} />
+      ))}
+      {toggleTools.length > 0 && actionTools.length > 0 ? <DropdownMenuSeparator /> : null}
+      {actionTools.map((tool) => (
+        <FoldedToolRow key={tool.stage} tool={tool} deferUntilClose={deferUntilClose} />
+      ))}
+      <DropdownMenuSeparator />
+    </>
+  )
+}
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-toolbar.test.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-toolbar.test.tsx
new file mode 100644
index 00000000000..5e014d3a8bf
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-toolbar.test.tsx
@@ -0,0 +1,158 @@
+// @vitest-environment happy-dom
+import { cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { useState } from 'react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { BrowserChromeFoldStage } from './use-browser-chrome-tool-fold'
+import type { BrowserChromeFoldedTool } from './browser-chrome-folded-tools'
+
+const mocks = vi.hoisted(() => {
+  const stages: readonly BrowserChromeFoldStage[] = []
+  return { folded: new Set<BrowserChromeFoldStage>(), stages }
+})
+
+vi.mock('./use-browser-chrome-tool-fold', () => ({
+  BROWSER_CHROME_FOLD_ORDER: [
+    'import-label',
+    'external',
+    'devtools',
+    'share',
+    'import',
+    'draw',
+    'grab',
+    'annotate'
+  ],
+  useBrowserChromeToolFold: (_rowRef: unknown, stages: readonly BrowserChromeFoldStage[]) => {
+    mocks.stages = stages
+    return mocks.folded
+  }
+}))
+
+vi.mock('./browser-navigation-control-row', () => ({
+  BrowserNavigationControlRow: ({ children }: { children: React.ReactNode }) => (
+    <div>{children}</div>
+  )
+}))
+
+vi.mock('../annotate/MarkupDrawButton', () => ({
+  MarkupDrawButton: () => <button>Draw</button>
+}))
+
+vi.mock('./browser-chrome-element-tool-buttons', () => ({
+  BrowserChromeElementToolButtons: () => null
+}))
+
+import { BrowserChromeToolbar } from './browser-chrome-toolbar'
+
+const controls = {
+  canGoBack: false,
+  canGoForward: false,
+  loading: false,
+  goBack: vi.fn(),
+  goForward: vi.fn(),
+  reload: vi.fn(),
+  navigate: vi.fn()
+}
+const emptyOverflowMenu = (): null => null
+
+beforeEach(() => {
+  mocks.folded = new Set()
+  mocks.stages = []
+})
+
+afterEach(cleanup)
+
+describe('BrowserChromeToolbar', () => {
+  it('does not duplicate an action already provided by the surface menu', () => {
+    mocks.folded = new Set(['devtools', 'external'])
+    let foldedTools: readonly BrowserChromeFoldedTool[] = []
+
+    render(
+      <BrowserChromeToolbar
+        controls={controls}
+        addressSlot={null}
+        elementTools={null}
+        markup={{ active: false, disabled: false, onToggle: vi.fn(), canShowDiscoveryHint: false }}
+        viewSource={{
+          label: 'Open source file',
+          onSelect: vi.fn(),
+          alreadyInOverflowMenu: true
+        }}
+        openExternal={{ label: 'Open with default app', onSelect: vi.fn() }}
+        overflowMenu={(overflow) => {
+          foldedTools = overflow.tools
+          return null
+        }}
+      />
+    )
+
+    expect(foldedTools.map((tool) => tool.stage)).toEqual(['external'])
+  })
+
+  it('compacts the import hint before removing it', () => {
+    mocks.folded = new Set(['import-label'])
+    const importControl = vi.fn(() => null)
+
+    render(
+      <BrowserChromeToolbar
+        controls={controls}
+        addressSlot={null}
+        importControl={importControl}
+        elementTools={null}
+        markup={{ active: false, disabled: false, onToggle: vi.fn(), canShowDiscoveryHint: false }}
+        viewSource={null}
+        openExternal={null}
+        overflowMenu={emptyOverflowMenu}
+      />
+    )
+
+    expect(importControl).toHaveBeenCalledWith(true)
+  })
+
+  it('keeps the active tour control out of the fold sequence', () => {
+    render(
+      <BrowserChromeToolbar
+        controls={controls}
+        addressSlot={null}
+        pinnedStage="grab"
+        elementTools={{
+          activeIntent: null,
+          onStartIntent: vi.fn(),
+          disabled: false,
+          grabShortcutLabel: 'Cmd+Shift+C',
+          annotationCount: 0
+        }}
+        markup={{ active: false, disabled: false, onToggle: vi.fn(), canShowDiscoveryHint: false }}
+        viewSource={null}
+        openExternal={null}
+        overflowMenu={emptyOverflowMenu}
+      />
+    )
+
+    expect(mocks.stages).not.toContain('grab')
+    expect(mocks.stages).toContain('annotate')
+  })
+
+  it('keeps the same share control mounted when it moves into overflow', () => {
+    function StatefulShare(): React.JSX.Element {
+      const [clicks, setClicks] = useState(0)
+      return <button onClick={() => setClicks((count) => count + 1)}>Share state {clicks}</button>
+    }
+    const props = {
+      controls,
+      addressSlot: null,
+      elementTools: null,
+      markup: { active: false, disabled: false, onToggle: vi.fn(), canShowDiscoveryHint: false },
+      shareControl: () => <StatefulShare />,
+      viewSource: null,
+      openExternal: null,
+      overflowMenu: emptyOverflowMenu
+    }
+    const view = render(<BrowserChromeToolbar {...props} />)
+    fireEvent.click(screen.getByRole('button', { name: 'Share state 0' }))
+
+    mocks.folded = new Set(['share'])
+    view.rerender(<BrowserChromeToolbar {...props} />)
+
+    expect(screen.getByRole('button', { name: 'Share state 1' })).not.toBeNull()
+  })
+})
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-toolbar.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-toolbar.tsx
index a314ed69215..59db797397d 100644
--- a/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-toolbar.tsx
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-toolbar.tsx
@@ -1,24 +1,35 @@
-import { cn } from '@/lib/utils'
-import { Crosshair, ExternalLink, MessageSquarePlus, SquareCode } from 'lucide-react'
+import { useRef, useState } from 'react'
+import {
+  Crosshair,
+  ExternalLink,
+  MessageSquarePlus,
+  PenTool,
+  Share2,
+  SquareCode
+} from 'lucide-react'
+import type { LucideIcon } from 'lucide-react'
 import { Button } from '@/components/ui/button'
-import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
 import { translate } from '@/i18n/i18n'
 import {
   BrowserNavigationControlRow,
   type BrowserNavigationControls
 } from './browser-navigation-control-row'
 import { MarkupDrawButton } from '../annotate/MarkupDrawButton'
-import type { GrabIntent } from '../describe-page/browser-page-types'
+import type {
+  BrowserChromeFoldedTool,
+  BrowserChromeOverflowMenuProps
+} from './browser-chrome-folded-tools'
+import {
+  BROWSER_CHROME_FOLD_ORDER,
+  useBrowserChromeToolFold,
+  type BrowserChromeFoldStage
+} from './use-browser-chrome-tool-fold'
+import {
+  BrowserChromeElementToolButtons,
+  type BrowserChromeElementTools
+} from './browser-chrome-element-tool-buttons'
 
-/** The in-guest element picker, driving both Grab (copy) and Annotate (comment). */
-export type BrowserChromeElementTools = {
-  /** The intent the picker is armed for right now, or null when it is idle. */
-  activeIntent: GrabIntent | null
-  onStartIntent: (intent: GrabIntent) => void
-  disabled: boolean
-  grabShortcutLabel: string
-  annotationCount: number
-}
+export type { BrowserChromeElementTools } from './browser-chrome-element-tool-buttons'
 
 export type BrowserChromeMarkupTool = {
   active: boolean
@@ -33,10 +44,40 @@ export type BrowserChromeMarkupTool = {
   canShowDiscoveryHint: boolean
 }
 
+export type BrowserChromeShareControl = {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  anchorRef?: React.RefObject<HTMLButtonElement | null>
+}
+
 export type BrowserChromeToolAction = {
   onSelect: () => void
   label: string
   disabled?: boolean
+  /** True when the surface's overflow menu already exposes this action. */
+  alreadyInOverflowMenu?: boolean
+}
+
+function BrowserChromeActionButton({
+  action,
+  icon: Icon
+}: {
+  action: BrowserChromeToolAction
+  icon: LucideIcon
+}): React.JSX.Element {
+  return (
+    <Button
+      size="icon"
+      variant="ghost"
+      className="h-7 w-7"
+      onClick={action.onSelect}
+      title={action.label}
+      aria-label={action.label}
+      disabled={action.disabled}
+    >
+      <Icon className="size-4" />
+    </Button>
+  )
 }
 
 /**
@@ -59,148 +100,170 @@ export function BrowserChromeToolbar({
   viewSource,
   openExternal,
   overflowMenu,
-  showTourAnchors = false
+  showTourAnchors = false,
+  pinnedStage
 }: {
   controls: BrowserNavigationControls
   addressSlot: React.ReactNode
   reloadControl?: React.ReactNode
   reloadLabel?: string
   /** Cookie import — a browsing session concept; null where there is no session to import into. */
-  importControl?: React.ReactNode
+  importControl?: ((compact: boolean) => React.ReactNode) | null
   elementTools: BrowserChromeElementTools | null
   markup: BrowserChromeMarkupTool
-  shareControl?: React.ReactNode
+  shareControl?: (control: BrowserChromeShareControl) => React.ReactNode
   viewSource: BrowserChromeToolAction | null
   openExternal: BrowserChromeToolAction | null
-  overflowMenu?: React.ReactNode
+  overflowMenu: (props: BrowserChromeOverflowMenuProps) => React.ReactNode
   /** Only the browsing pane anchors the contextual tour; a second anchor would steal its steps. */
   showTourAnchors?: boolean
+  /** Keeps the active contextual-tour control measurable while the remaining tools still fold. */
+  pinnedStage?: BrowserChromeFoldStage
 }): React.JSX.Element {
+  const rowRef = useRef<HTMLDivElement>(null)
+  const overflowTriggerRef = useRef<HTMLButtonElement>(null)
+  const present: Record<BrowserChromeFoldStage, boolean> = {
+    'import-label': importControl != null,
+    import: importControl != null,
+    external: openExternal !== null,
+    devtools: viewSource !== null,
+    share: shareControl != null,
+    draw: true,
+    grab: elementTools !== null,
+    annotate: elementTools !== null
+  }
+  const stages = BROWSER_CHROME_FOLD_ORDER.filter(
+    (stage) => present[stage] && stage !== pinnedStage
+  )
+  const folded = useBrowserChromeToolFold(rowRef, stages)
+
+  const [sharePopoverOpen, setSharePopoverOpen] = useState(false)
+  const afterMenuCloseRef = useRef<(() => void) | null>(null)
+
+  const foldedTools: BrowserChromeFoldedTool[] = []
+  if (elementTools && folded.has('grab')) {
+    foldedTools.push({
+      stage: 'grab',
+      label: translate('auto.components.browser.pane.BrowserPane.fdfc7fe0ef', 'Grab page element'),
+      icon: Crosshair,
+      onSelect: () => elementTools.onStartIntent('copy'),
+      disabled: elementTools.disabled,
+      shortcut: elementTools.grabShortcutLabel,
+      active: elementTools.activeIntent === 'copy'
+    })
+  }
+  if (elementTools && folded.has('annotate')) {
+    foldedTools.push({
+      stage: 'annotate',
+      label: translate(
+        'auto.components.browser.pane.BrowserPane.fc9be38f6f',
+        'Annotate page element'
+      ),
+      icon: MessageSquarePlus,
+      onSelect: () => elementTools.onStartIntent('annotate'),
+      disabled: elementTools.disabled,
+      count: elementTools.annotationCount,
+      active: elementTools.activeIntent === 'annotate'
+    })
+  }
+  if (folded.has('draw')) {
+    foldedTools.push({
+      stage: 'draw',
+      label: translate('auto.components.browser-pane.markup.drawButton', 'Draw on screenshot'),
+      icon: PenTool,
+      onSelect: markup.onToggle,
+      disabled: markup.disabled,
+      active: markup.active
+    })
+  }
+  if (shareControl && folded.has('share')) {
+    foldedTools.push({
+      stage: 'share',
+      label: translate(
+        'auto.components.artifacts.ArtifactPublishButton.a4a49da6af',
+        'Share as artifact'
+      ),
+      icon: Share2,
+      onSelect: () => setSharePopoverOpen(true),
+      deferUntilMenuClose: true
+    })
+  }
+  if (viewSource && folded.has('devtools') && !viewSource.alreadyInOverflowMenu) {
+    foldedTools.push({ stage: 'devtools', icon: SquareCode, ...viewSource })
+  }
+  if (openExternal && folded.has('external') && !openExternal.alreadyInOverflowMenu) {
+    foldedTools.push({ stage: 'external', icon: ExternalLink, ...openExternal })
+  }
+
+  const runAfterMenuClose = (action: () => void): void => {
+    afterMenuCloseRef.current = action
+  }
+  const onMenuCloseAutoFocus = (event: Event): void => {
+    const action = afterMenuCloseRef.current
+    if (!action) {
+      return
+    }
+    afterMenuCloseRef.current = null
+    event.preventDefault()
+    action()
+  }
+  const showFoldedAnnotationDot = folded.has('annotate') && (elementTools?.annotationCount ?? 0) > 0
+
   return (
     <BrowserNavigationControlRow
+      rowRef={rowRef}
       controls={controls}
       addressSlot={addressSlot}
       reloadControl={reloadControl}
       reloadLabel={reloadLabel}
       showTourAnchors={showTourAnchors}
     >
-      {importControl}
+      {folded.has('import') ? null : importControl?.(folded.has('import-label'))}
 
       {elementTools ? (
-        <>
-          <Tooltip>
-            <TooltipTrigger asChild>
-              <span className="inline-flex">
-                <Button
-                  size="icon"
-                  variant={elementTools.activeIntent === 'copy' ? 'default' : 'ghost'}
-                  className={cn(
-                    'h-8 w-8',
-                    elementTools.activeIntent === 'copy' &&
-                      'bg-foreground/80 text-background hover:bg-foreground/90'
-                  )}
-                  onClick={() => elementTools.onStartIntent('copy')}
-                  disabled={elementTools.disabled}
-                  aria-label={translate(
-                    'auto.components.browser.pane.BrowserPane.fdfc7fe0ef',
-                    'Grab page element'
-                  )}
-                  {...(showTourAnchors
-                    ? { 'data-contextual-tour-target': 'browser-grab-control' }
-                    : {})}
-                >
-                  <Crosshair className="size-4" />
-                </Button>
-              </span>
-            </TooltipTrigger>
-            <TooltipContent side="bottom" sideOffset={4}>
-              {translate(
-                'auto.components.browser.pane.BrowserPane.acbe79fd01',
-                'Grab page element ({{value0}})',
-                { value0: elementTools.grabShortcutLabel }
-              )}
-            </TooltipContent>
-          </Tooltip>
-
-          <Tooltip>
-            <TooltipTrigger asChild>
-              {/* Why: disabled <button> drops hover events, so wrap in a span so the tooltip trigger still fires. */}
-              <span className="inline-flex">
-                <Button
-                  size="icon"
-                  variant={elementTools.activeIntent === 'annotate' ? 'default' : 'ghost'}
-                  className={cn(
-                    'relative h-8 w-8',
-                    elementTools.activeIntent === 'annotate' &&
-                      'bg-foreground/80 text-background hover:bg-foreground/90'
-                  )}
-                  onClick={() => elementTools.onStartIntent('annotate')}
-                  disabled={elementTools.disabled}
-                  aria-label={translate(
-                    'auto.components.browser.pane.BrowserPane.fc9be38f6f',
-                    'Annotate page element'
-                  )}
-                  {...(showTourAnchors
-                    ? { 'data-contextual-tour-target': 'browser-annotation-control' }
-                    : {})}
-                >
-                  <MessageSquarePlus className="size-4" />
-                  {elementTools.annotationCount > 0 ? (
-                    <span className="absolute -top-1 -right-1 flex min-w-4 items-center justify-center rounded-full bg-primary px-1 text-[10px] leading-4 text-primary-foreground">
-                      {elementTools.annotationCount}
-                    </span>
-                  ) : null}
-                </Button>
-              </span>
-            </TooltipTrigger>
-            <TooltipContent side="bottom" sideOffset={4}>
-              {translate(
-                'auto.components.browser.pane.BrowserPane.fc9be38f6f',
-                'Annotate page element'
-              )}
-            </TooltipContent>
-          </Tooltip>
-        </>
+        <BrowserChromeElementToolButtons
+          tools={elementTools}
+          showGrab={!folded.has('grab')}
+          showAnnotate={!folded.has('annotate')}
+          showTourAnchors={showTourAnchors}
+        />
       ) : null}
 
-      <MarkupDrawButton
-        onClick={markup.onToggle}
-        disabled={markup.disabled}
-        active={markup.active}
-        surfaceActive={markup.canShowDiscoveryHint}
-      />
+      {folded.has('draw') ? null : (
+        <MarkupDrawButton
+          onClick={markup.onToggle}
+          disabled={markup.disabled}
+          active={markup.active}
+          surfaceActive={markup.canShowDiscoveryHint}
+        />
+      )}
 
-      {shareControl}
+      {shareControl?.({
+        open: sharePopoverOpen,
+        onOpenChange: setSharePopoverOpen,
+        anchorRef: folded.has('share') ? overflowTriggerRef : undefined
+      })}
 
-      {viewSource ? (
-        <Button
-          size="icon"
-          variant="ghost"
-          className="h-7 w-7"
-          onClick={viewSource.onSelect}
-          title={viewSource.label}
-          aria-label={viewSource.label}
-          disabled={viewSource.disabled}
-        >
-          <SquareCode className="size-4" />
-        </Button>
+      {viewSource && !folded.has('devtools') ? (
+        <BrowserChromeActionButton action={viewSource} icon={SquareCode} />
       ) : null}
 
-      {openExternal ? (
-        <Button
-          size="icon"
-          variant="ghost"
-          className="h-7 w-7"
-          onClick={openExternal.onSelect}
-          title={openExternal.label}
-          aria-label={openExternal.label}
-          disabled={openExternal.disabled}
-        >
-          <ExternalLink className="size-4" />
-        </Button>
+      {openExternal && !folded.has('external') ? (
+        <BrowserChromeActionButton action={openExternal} icon={ExternalLink} />
       ) : null}
 
-      {overflowMenu}
+      <span className="relative inline-flex">
+        {overflowMenu({
+          triggerRef: overflowTriggerRef,
+          tools: foldedTools,
+          deferUntilClose: runAfterMenuClose,
+          onMenuCloseAutoFocus
+        })}
+        {/* Why: keeps pending annotations visible once the annotate button has folded into ⋯. */}
+        {showFoldedAnnotationDot ? (
+          <span className="pointer-events-none absolute top-1 right-1 size-1.5 rounded-full bg-primary ring-2 ring-background" />
+        ) : null}
+      </span>
     </BrowserNavigationControlRow>
   )
 }
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/browser-navigation-control-row.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/browser-navigation-control-row.tsx
index 236251c64ef..999f890a37f 100644
--- a/src/renderer/src/components/browser-pane/assemble-chrome/browser-navigation-control-row.tsx
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/browser-navigation-control-row.tsx
@@ -36,6 +36,7 @@ export function BrowserNavigationControlRow({
   reloadControl,
   reloadLabel,
   showTourAnchors = true,
+  rowRef,
   children
 }: {
   controls: BrowserNavigationControls
@@ -46,10 +47,12 @@ export function BrowserNavigationControlRow({
   reloadLabel?: string
   /** Off for surfaces the browsing tour does not cover — a second anchor would steal its steps. */
   showTourAnchors?: boolean
+  rowRef?: React.Ref<HTMLDivElement>
   children?: React.ReactNode
 }): React.JSX.Element {
   return (
     <div
+      ref={rowRef}
       className="relative z-10 flex shrink-0 items-center gap-2 border-b border-border/70 bg-background/95 px-3 py-1.5"
       {...(showTourAnchors ? { 'data-contextual-tour-target': 'browser-toolbar' } : {})}
     >
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-context-menu.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-context-menu.tsx
index fb1830bd41f..22f12bfea4e 100644
--- a/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-context-menu.tsx
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-context-menu.tsx
@@ -11,6 +11,7 @@ import { createPortal } from 'react-dom'
 import { useAppStore } from '@/store'
 import { translate } from '@/i18n/i18n'
 import { normalizeExternalBrowserUrl } from '../../../../../shared/browser-url'
+import { resolveBrowserSourceUnifiedTab } from '@/lib/browser-workspace-source-resolution'
 import type { BrowserPageContextMenuState } from '../describe-page/browser-page-types'
 
 // `focus:` rather than `focus-visible:` — items are only ever focused programmatically
@@ -186,9 +187,18 @@ export function BrowserPageContextMenu({
               role="menuitem"
               className={MENU_ITEM_CLASS}
               onClick={() => {
+                const sourceUnifiedTab = resolveBrowserSourceUnifiedTab(
+                  useAppStore.getState(),
+                  browserPageId,
+                  worktreeId
+                )
                 createBrowserTab(worktreeId, contextMenu.linkUrl!, {
                   title: contextMenu.linkUrl!,
-                  activate: false
+                  activate: false,
+                  ...(sourceUnifiedTab ? { afterTabId: sourceUnifiedTab.id } : {}),
+                  ...(sourceUnifiedTab?.executionHostId
+                    ? { executionHostId: sourceUnifiedTab.executionHostId }
+                    : {})
                 })
                 closeMenu()
               }}
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-toolbar.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-toolbar.tsx
index 616cca726ec..f684e9a1b46 100644
--- a/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-toolbar.tsx
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-toolbar.tsx
@@ -1,6 +1,7 @@
 import type { Dispatch, RefObject, SetStateAction } from 'react'
 import { ArtifactPublishButton } from '@/components/artifacts/ArtifactPublishButton'
 import { translate } from '@/i18n/i18n'
+import { useAppStore } from '@/store'
 import type { BrowserReloadTrigger } from '../navigate/browser-reload-action'
 import BrowserAddressBar from './BrowserAddressBar'
 import { BrowserChromeToolbar } from './browser-chrome-toolbar'
@@ -102,9 +103,20 @@ export function BrowserPageToolbar({
   currentBrowserUrl: string
   externalUrl: string | null
 }): React.JSX.Element {
+  const browserTourStep = useAppStore((state) =>
+    state.activeContextualTourId === 'browser' ? state.activeContextualTourStepIndex : null
+  )
+  const pinnedStage =
+    browserTourStep === 0
+      ? ('grab' as const)
+      : browserTourStep === 1
+        ? ('annotate' as const)
+        : undefined
+
   return (
     <BrowserChromeToolbar
       showTourAnchors
+      pinnedStage={pinnedStage}
       controls={{
         canGoBack: canGoBack || Boolean(convertedFrom),
         canGoForward: canGoForward || Boolean(convertedTo),
@@ -161,7 +173,9 @@ export function BrowserPageToolbar({
           onHardReload={() => runReloadTrigger('hard-reload')}
         />
       }
-      importControl={<BrowserImportHintButton profileId={sessionProfileId} />}
+      importControl={(compact) => (
+        <BrowserImportHintButton profileId={sessionProfileId} compact={compact} />
+      )}
       elementTools={{
         activeIntent: grab.state !== 'idle' ? grabIntent : null,
         onStartIntent: startGrabIntent,
@@ -176,13 +190,16 @@ export function BrowserPageToolbar({
         canShowDiscoveryHint: isActive
       }}
       shareControl={
-        shareableArtifactFile ? (
-          <ArtifactPublishButton
-            sourceKey={shareableArtifactFile.filePath}
-            className="h-7 w-7"
-            createRequest={() => readBrowserHtmlArtifactRequest(currentBrowserUrl)}
-          />
-        ) : null
+        shareableArtifactFile
+          ? (control) => {
+              const props = {
+                sourceKey: shareableArtifactFile.filePath,
+                className: 'h-7 w-7',
+                createRequest: () => readBrowserHtmlArtifactRequest(currentBrowserUrl)
+              }
+              return <ArtifactPublishButton {...props} {...control} />
+            }
+          : undefined
       }
       viewSource={{
         onSelect: () => void window.api.browser.openDevTools({ browserPageId }),
@@ -204,7 +221,7 @@ export function BrowserPageToolbar({
         ),
         disabled: !externalUrl
       }}
-      overflowMenu={
+      overflowMenu={(overflow) => (
         <BrowserToolbarMenu
           currentProfileId={sessionProfileId}
           workspaceId={workspaceId}
@@ -212,8 +229,9 @@ export function BrowserPageToolbar({
           viewportPresetId={viewportPresetId}
           onDestroyWebview={() => destroyPersistentWebview(browserPageId)}
           isActive={isActive}
+          overflow={overflow}
         />
-      }
+      )}
     />
   )
 }
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/browser-toolbar-menu-dropdown.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/browser-toolbar-menu-dropdown.tsx
index 0d088a44edd..63098b9b2b4 100644
--- a/src/renderer/src/components/browser-pane/assemble-chrome/browser-toolbar-menu-dropdown.tsx
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/browser-toolbar-menu-dropdown.tsx
@@ -30,6 +30,10 @@ type DetectedBrowserEntry = {
 }
 import { BROWSER_VIEWPORT_PRESETS } from '../../../../../shared/browser-viewport-presets'
 import { translate } from '@/i18n/i18n'
+import {
+  BrowserChromeFoldedMenuItems,
+  type BrowserChromeOverflowMenuProps
+} from './browser-chrome-folded-tools'
 
 type BrowserToolbarMenuDropdownProps = {
   menuOpen: boolean
@@ -45,6 +49,7 @@ type BrowserToolbarMenuDropdownProps = {
   onImportFromFile: () => void
   viewportPresetId: BrowserViewportPresetId | null
   onApplyViewportPreset: (nextId: BrowserViewportPresetId | null) => void
+  overflow: BrowserChromeOverflowMenuProps
 }
 
 export function BrowserToolbarMenuDropdown({
@@ -60,12 +65,14 @@ export function BrowserToolbarMenuDropdown({
   onImportFromBrowser,
   onImportFromFile,
   viewportPresetId,
-  onApplyViewportPreset
+  onApplyViewportPreset,
+  overflow
 }: BrowserToolbarMenuDropdownProps): React.JSX.Element {
   return (
     <DropdownMenu modal={false} open={menuOpen} onOpenChange={onMenuOpenChange}>
       <DropdownMenuTrigger asChild>
         <Button
+          ref={overflow.triggerRef}
           size="icon"
           variant="ghost"
           className="h-8 w-8"
@@ -77,7 +84,15 @@ export function BrowserToolbarMenuDropdown({
           <Ellipsis className="size-4" />
         </Button>
       </DropdownMenuTrigger>
-      <DropdownMenuContent align="end" className="w-56">
+      <DropdownMenuContent
+        align="end"
+        className="w-56"
+        onCloseAutoFocus={overflow.onMenuCloseAutoFocus}
+      >
+        <BrowserChromeFoldedMenuItems
+          tools={overflow.tools}
+          deferUntilClose={overflow.deferUntilClose}
+        />
         {allProfiles.map((profile) => {
           const isSelectedProfile = profile.id === effectiveProfileId
           return (
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/use-browser-chrome-tool-fold.test.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/use-browser-chrome-tool-fold.test.tsx
new file mode 100644
index 00000000000..6edb0570a8c
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/use-browser-chrome-tool-fold.test.tsx
@@ -0,0 +1,159 @@
+// @vitest-environment happy-dom
+import { act, cleanup, render } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { useRef } from 'react'
+import { BROWSER_CHROME_ADDRESS_SLOT_ATTRIBUTE } from './browser-chrome-address-slot'
+import {
+  BROWSER_CHROME_ADDRESS_MIN_WIDTH_PX,
+  BROWSER_CHROME_FOLD_ORDER,
+  useBrowserChromeToolFold
+} from './use-browser-chrome-tool-fold'
+
+const FIXED_WIDTH = 100
+const TOOL_WIDTH = 30
+
+// A flex row where the address takes whatever the fixed controls and visible tools leave over.
+const layout = { rowWidth: 600, visibleTools: BROWSER_CHROME_FOLD_ORDER.length }
+let resizeCallbacks: (() => void)[] = []
+
+function Host({
+  onFolded,
+  stages = BROWSER_CHROME_FOLD_ORDER
+}: {
+  onFolded: (count: number) => void
+  stages?: readonly (typeof BROWSER_CHROME_FOLD_ORDER)[number][]
+}): React.JSX.Element {
+  const rowRef = useRef<HTMLDivElement>(null)
+  const folded = useBrowserChromeToolFold(rowRef, stages)
+  layout.visibleTools = stages.length - folded.size
+  onFolded(folded.size)
+  return (
+    <div ref={rowRef} data-testid="row">
+      <div {...{ [BROWSER_CHROME_ADDRESS_SLOT_ATTRIBUTE]: 'true' }} />
+    </div>
+  )
+}
+
+function contentWidth(): number {
+  return FIXED_WIDTH + TOOL_WIDTH * layout.visibleTools
+}
+
+beforeEach(() => {
+  resizeCallbacks = []
+  vi.stubGlobal(
+    'ResizeObserver',
+    class {
+      constructor(callback: () => void) {
+        resizeCallbacks.push(callback)
+      }
+      observe(): void {}
+      disconnect(): void {}
+    }
+  )
+  vi.spyOn(HTMLElement.prototype, 'clientWidth', 'get').mockImplementation(() => layout.rowWidth)
+  vi.spyOn(HTMLElement.prototype, 'scrollWidth', 'get').mockImplementation(() =>
+    Math.max(layout.rowWidth, contentWidth())
+  )
+  vi.spyOn(HTMLElement.prototype, 'getBoundingClientRect').mockImplementation(() =>
+    DOMRect.fromRect({ width: Math.max(0, layout.rowWidth - contentWidth()) })
+  )
+})
+
+afterEach(() => {
+  cleanup()
+  vi.restoreAllMocks()
+  vi.unstubAllGlobals()
+})
+
+function resizeTo(width: number): void {
+  layout.rowWidth = width
+  act(() => resizeCallbacks.forEach((callback) => callback()))
+}
+
+function expectedFolded(width: number): number {
+  const room = width - FIXED_WIDTH - BROWSER_CHROME_ADDRESS_MIN_WIDTH_PX
+  const fits = Math.max(0, Math.floor(room / TOOL_WIDTH))
+  return Math.max(0, BROWSER_CHROME_FOLD_ORDER.length - fits)
+}
+
+describe('useBrowserChromeToolFold', () => {
+  it('keeps every tool inline when the address has its minimum width', () => {
+    let folded = -1
+    layout.rowWidth = 600
+    render(<Host onFolded={(count) => (folded = count)} />)
+    expect(folded).toBe(0)
+  })
+
+  it('folds just enough tools to give the address its minimum width', () => {
+    let folded = -1
+    layout.rowWidth = 300
+    render(<Host onFolded={(count) => (folded = count)} />)
+    expect(folded).toBe(expectedFolded(300))
+    expect(folded).toBeGreaterThan(0)
+  })
+
+  it('unfolds as the row widens and refolds as it narrows', () => {
+    let folded = -1
+    layout.rowWidth = 600
+    render(<Host onFolded={(count) => (folded = count)} />)
+
+    resizeTo(260)
+    expect(folded).toBe(expectedFolded(260))
+
+    resizeTo(400)
+    expect(folded).toBe(expectedFolded(400))
+
+    resizeTo(700)
+    expect(folded).toBe(0)
+  })
+
+  it('folds everything but lets the address shrink once no tool is left', () => {
+    let folded = -1
+    layout.rowWidth = 150
+    render(<Host onFolded={(count) => (folded = count)} />)
+    expect(folded).toBe(BROWSER_CHROME_FOLD_ORDER.length)
+  })
+
+  it('leaves a hidden (zero-width) row alone', () => {
+    let folded = -1
+    layout.rowWidth = 0
+    render(<Host onFolded={(count) => (folded = count)} />)
+    expect(folded).toBe(0)
+  })
+
+  it('measures when a hidden row becomes visible', () => {
+    let folded = -1
+    layout.rowWidth = 0
+    render(<Host onFolded={(count) => (folded = count)} />)
+
+    resizeTo(300)
+    expect(folded).toBe(expectedFolded(300))
+  })
+
+  it('discards measurements when the available tools change', () => {
+    let folded = -1
+    layout.rowWidth = 300
+    const view = render(<Host onFolded={(count) => (folded = count)} />)
+    expect(folded).toBeGreaterThan(0)
+
+    view.rerender(<Host onFolded={(count) => (folded = count)} stages={['grab', 'annotate']} />)
+    expect(folded).toBe(0)
+
+    resizeTo(150)
+    expect(folded).toBe(2)
+  })
+
+  it('does not restore an obsolete fold level when a tool set returns', () => {
+    let folded = -1
+    layout.rowWidth = 300
+    const view = render(<Host onFolded={(count) => (folded = count)} />)
+    expect(folded).toBeGreaterThan(0)
+
+    layout.rowWidth = 600
+    view.rerender(<Host onFolded={(count) => (folded = count)} stages={['grab']} />)
+    expect(folded).toBe(0)
+
+    view.rerender(<Host onFolded={(count) => (folded = count)} />)
+    expect(folded).toBe(0)
+  })
+})
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/use-browser-chrome-tool-fold.ts b/src/renderer/src/components/browser-pane/assemble-chrome/use-browser-chrome-tool-fold.ts
new file mode 100644
index 00000000000..02b1fa7e9ec
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/use-browser-chrome-tool-fold.ts
@@ -0,0 +1,115 @@
+import { useLayoutEffect, useRef, useState, type RefObject } from 'react'
+import { BROWSER_CHROME_ADDRESS_SLOT_ATTRIBUTE } from './browser-chrome-address-slot'
+
+/**
+ * One step of toolbar compaction. Steps apply in this order as the row narrows, so the least-used
+ * tools leave first and the page tools the chrome exists for (grab, annotate) leave last.
+ */
+export type BrowserChromeFoldStage =
+  | 'import-label'
+  | 'external'
+  | 'devtools'
+  | 'share'
+  | 'import'
+  | 'draw'
+  | 'grab'
+  | 'annotate'
+
+export const BROWSER_CHROME_FOLD_ORDER: readonly BrowserChromeFoldStage[] = [
+  'import-label',
+  'external',
+  'devtools',
+  'share',
+  'import',
+  'draw',
+  'grab',
+  'annotate'
+]
+
+/** Below this the URL stops being readable, so tools fold before the address shrinks further. */
+export const BROWSER_CHROME_ADDRESS_MIN_WIDTH_PX = 120
+
+type RowMeasure = { address: number; overflow: number }
+
+function measureRow(row: HTMLElement | null): RowMeasure | null {
+  const slot = row?.querySelector(`[${BROWSER_CHROME_ADDRESS_SLOT_ATTRIBUTE}]`)
+  // Why: a hidden pane measures zero; folding everything there would flash on reveal.
+  if (!row || !slot || row.clientWidth === 0) {
+    return null
+  }
+  return {
+    address: slot.getBoundingClientRect().width,
+    overflow: Math.max(0, row.scrollWidth - row.clientWidth)
+  }
+}
+
+/**
+ * Folds `stages` one at a time until the address slot keeps its minimum width and the row stops
+ * overflowing, and unfolds as room returns.
+ *
+ * Why record the width each fold freed instead of re-measuring from zero on every resize: resetting
+ * would re-render the toolbar once per stage per resize frame. A fold is undone only when the
+ * address has that much slack, so an unfold can never immediately re-trigger its own fold.
+ */
+export function useBrowserChromeToolFold(
+  rowRef: RefObject<HTMLElement | null>,
+  stages: readonly BrowserChromeFoldStage[]
+): ReadonlySet<BrowserChromeFoldStage> {
+  const stagesKey = stages.join(',')
+  const [foldedCount, setFoldedCount] = useState(0)
+  const level = Math.min(foldedCount, stages.length)
+  const freedRef = useRef<{ stagesKey: string; widths: number[] }>({ stagesKey, widths: [] })
+  const pendingRef = useRef<(RowMeasure & { level: number }) | null>(null)
+
+  const checkRef = useRef<() => void>(() => {})
+  checkRef.current = () => {
+    if (freedRef.current.stagesKey !== stagesKey) {
+      freedRef.current = { stagesKey, widths: [] }
+      pendingRef.current = null
+    }
+    const measure = measureRow(rowRef.current)
+    if (!measure) {
+      return
+    }
+    const freed = freedRef.current.widths
+    const pending = pendingRef.current
+    if (pending && pending.level === level) {
+      freed[level - 1] = measure.address - pending.address + (pending.overflow - measure.overflow)
+      pendingRef.current = null
+    }
+    const shortfall =
+      Math.max(0, BROWSER_CHROME_ADDRESS_MIN_WIDTH_PX - measure.address) + measure.overflow
+    if (shortfall > 0.5 && level < stages.length) {
+      pendingRef.current = { ...measure, level: level + 1 }
+      setFoldedCount(level + 1)
+      return
+    }
+    const slack = measure.address - BROWSER_CHROME_ADDRESS_MIN_WIDTH_PX
+    if (shortfall <= 0.5 && level > 0 && slack >= (freed[level - 1] ?? 0)) {
+      setFoldedCount(level - 1)
+    }
+  }
+
+  // Why layout effect: each fold step re-measures before paint, so a squeeze never flashes clipped.
+  useLayoutEffect(() => {
+    checkRef.current()
+  }, [level, stagesKey])
+
+  useLayoutEffect(() => {
+    const row = rowRef.current
+    const slot = row?.querySelector(`[${BROWSER_CHROME_ADDRESS_SLOT_ATTRIBUTE}]`)
+    if (!row || typeof ResizeObserver === 'undefined') {
+      return
+    }
+    // Why both: the slot resizes when a sibling tool appears or hides, but stops resizing once it
+    // hits zero while the row keeps overflowing.
+    const observer = new ResizeObserver(() => checkRef.current())
+    observer.observe(row)
+    if (slot) {
+      observer.observe(slot)
+    }
+    return () => observer.disconnect()
+  }, [rowRef])
+
+  return new Set(stages.slice(0, level))
+}
diff --git a/src/renderer/src/components/browser-pane/browser-client-page-metadata-route-census.test.ts b/src/renderer/src/components/browser-pane/browser-client-page-metadata-route-census.test.ts
deleted file mode 100644
index 6937de9e6e4..00000000000
--- a/src/renderer/src/components/browser-pane/browser-client-page-metadata-route-census.test.ts
+++ /dev/null
@@ -1,43 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { fileURLToPath } from 'node:url'
-import { describe, expect, it } from 'vitest'
-
-/**
- * Page metadata has exactly one way out of this renderer: main, which owns the browser-host lease.
- *
- * Why a census and not a behavioural test: the failure this guards is silent. The runtime accepts
- * page traffic only on the connection its lease attached on, so a publish sent as an ordinary
- * runtime call is refused as a stale lease and simply never lands — the pane keeps working, the
- * guest keeps navigating, and only the runtime's copy of the URL stays frozen at the create URL.
- * Nothing in the rendered result changes, so only the route itself can be asserted.
- */
-const ROUTE_PATH = fileURLToPath(
-  new URL('./browser-client-page-metadata-reporting.ts', import.meta.url)
-)
-const PANE_PATH = fileURLToPath(new URL('./ClientHostedBrowserPagePane.tsx', import.meta.url))
-
-describe('client-hosted page metadata route', () => {
-  const route = readFileSync(ROUTE_PATH, 'utf8')
-  const pane = readFileSync(PANE_PATH, 'utf8')
-
-  it('publishes through main and never through a plain runtime call', () => {
-    expect(occurrences(route, 'window.api.browser.publishClientPageMetadata')).toBe(1)
-    expect(occurrences(route, 'runtimeEnvironments.call')).toBe(0)
-    expect(occurrences(pane, 'runtimeEnvironments.call')).toBe(0)
-  })
-
-  it('reports a publish that did not land', () => {
-    expect(occurrences(route, 'onUnpublished:')).toBe(1)
-  })
-
-  // The pane must not build its own publisher around the route: a second construction site is a
-  // second chance to wire the transport wrongly, and it would not be covered by the counts above.
-  it('leaves the pane one way to start publishing', () => {
-    expect(occurrences(pane, 'createBrowserClientPageMetadataPublisher(')).toBe(0)
-    expect(occurrences(pane, 'startBrowserClientPageMetadataPublisher(')).toBe(1)
-  })
-})
-
-function occurrences(source: string, needle: string): number {
-  return source.split(needle).length - 1
-}
diff --git a/src/renderer/src/components/browser-pane/host-guest/browser-guest-paint-retention.ts b/src/renderer/src/components/browser-pane/host-guest/browser-guest-paint-retention.ts
index 0d1364c139b..941c527b38f 100644
--- a/src/renderer/src/components/browser-pane/host-guest/browser-guest-paint-retention.ts
+++ b/src/renderer/src/components/browser-pane/host-guest/browser-guest-paint-retention.ts
@@ -61,7 +61,6 @@ export function useBrowserGuestPaintRetention(browserPageIds: readonly string[])
 // Why one exported predicate rather than the same OR-list at each site: a hand-rolled copy stays
 // green when a term is added — nothing typechecks a site that never names the new signal — and the
 // remote-viewer term reached the panes while four copies in Terminal.tsx still had three terms.
-// browser-guest-retention-site-census.test.ts holds the sites to this function.
 export function browserPageNeedsPaintRetention(browserPageId: string): boolean {
   return (
     isBrowserAutomationVisible(browserPageId) ||
diff --git a/src/renderer/src/components/browser-pane/host-guest/browser-guest-retention-site-census.test.ts b/src/renderer/src/components/browser-pane/host-guest/browser-guest-retention-site-census.test.ts
deleted file mode 100644
index 5d8c6028329..00000000000
--- a/src/renderer/src/components/browser-pane/host-guest/browser-guest-retention-site-census.test.ts
+++ /dev/null
@@ -1,223 +0,0 @@
-import { readdirSync, readFileSync } from 'node:fs'
-import { join, relative, sep } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-// Guest retention is an OR over several independent signals, and every container from the app
-// shell down to the guest has to agree on the list — Chromium stops painting inside a display:none
-// subtree, so the *most* pinched ancestor wins. Adding a term (the remote-viewer signal, STA-4150)
-// reached the panes while four hand-rolled copies still listed three: nothing typechecks a site
-// that never names the new symbol. So the terms live behind one helper, and this census holds the
-// sites to it — the classification is enforced here, not by review.
-
-const RENDERER_SRC = join(__dirname, '..', '..', '..')
-
-// The three term stores.
-const RETENTION_TERM_STORES = [
-  'components/browser-pane/host-guest/browser-automation-visibility.ts',
-  'lib/pane-manager/browser-mobile-driver-state.ts',
-  'lib/pane-manager/browser-remote-viewer-state.ts'
-]
-
-// ...plus the single module allowed to OR their terms together.
-const RETENTION_TERM_OWNERS = [
-  ...RETENTION_TERM_STORES,
-  'components/browser-pane/host-guest/browser-guest-paint-retention.ts'
-]
-
-// Every way a term store lets a caller read one term. A site that hand-rolls the OR-list from
-// readers missing here would pass the census, so the last check holds this list to the exports.
-const RETENTION_TERM_SYMBOLS = [
-  'isBrowserAutomationVisible',
-  'useBrowserAutomationVisibilityForAny',
-  'getBrowserAutomationVisiblePageIds',
-  'onBrowserAutomationVisibilityChange',
-  'isBrowserPageMobileDriven',
-  'hasMobileDriverForAnyBrowserPage',
-  'useBrowserMobileDriverForAny',
-  'getBrowserMobileDrivenPageIds',
-  'getDriverForBrowserPage',
-  'useBrowserDriverForPage',
-  'onBrowserDriverChange',
-  'isBrowserPageRemotelyViewed',
-  'hasRemoteViewerForAnyBrowserPage',
-  'useBrowserRemoteViewerForAny',
-  'getBrowserRemotelyViewedPageIds',
-  'onBrowserRemoteViewerChange'
-]
-
-const RETENTION_HELPER_SYMBOLS = [
-  'useAnyBrowserGuestNeedsPaint',
-  'useBrowserGuestPaintRetention',
-  'browserPageNeedsPaintRetention',
-  'onBrowserGuestPaintRetentionChange',
-  'browserTabsVetoGuestEviction'
-]
-
-// Every place that decides whether a browser guest keeps painting, and the helper it must use.
-const RETENTION_SITES = new Map<string, readonly string[]>([
-  ['components/TerminalWorkbenchContainer.tsx', ['useAnyBrowserGuestNeedsPaint']],
-  // The two outermost workbench wrappers: strict ancestors of every guest, so the per-worktree
-  // surface hatch below cannot rescue a guest either one parked with `hidden`.
-  ['components/TerminalSurface.tsx', ['useAnyBrowserGuestNeedsPaint']],
-  ['components/TerminalSplitWorkspaceSurfaces.tsx', ['useAnyBrowserGuestNeedsPaint']],
-  ['components/TerminalWorktreeSplitSurface.tsx', ['useBrowserGuestPaintRetention']],
-  [
-    'components/browser-pane/assemble-chrome/BrowserPaneOverlayLayer.tsx',
-    ['useBrowserGuestPaintRetention']
-  ],
-  [
-    'components/browser-pane/host-guest/browser-guest-worktree-retention.ts',
-    ['browserPageNeedsPaintRetention']
-  ],
-  [
-    'components/use-terminal-browser-retention.ts',
-    ['browserTabsVetoGuestEviction', 'onBrowserGuestPaintRetentionChange']
-  ]
-])
-
-// The per-page threading hooks are the carve-out: they hand one boolean per page to
-// browser-page-paintability's required fields, so a missing term IS a typecheck error there. They
-// still travel as a set — a caller that reads two of the three is the same omission bug.
-const PER_PAGE_RETENTION_HOOKS = [
-  'useBrowserAutomationVisiblePageIds',
-  'useBrowserMobileDrivenPageIds',
-  'useBrowserRemotelyViewedPageIds'
-]
-
-// One production read of a term is not a retention decision: the pane reads *who* drives the active
-// page to label the overlay and lock input. Naming the exception per file rather than dropping the
-// symbol keeps every other file that reads it a census failure.
-const NON_RETENTION_TERM_READERS = new Map<string, readonly string[]>([
-  [
-    'components/browser-pane/assemble-chrome/browser-workspace-pane.tsx',
-    ['useBrowserDriverForPage']
-  ]
-])
-
-// Writers, hydrators and the idle sentinel: they set or seed a term rather
-// than read it, so naming one is not a retention decision.
-const NON_READER_TERM_EXPORTS = [
-  'acquireBrowserAutomationVisibility',
-  'releaseBrowserAutomationVisibility',
-  'setDriverForBrowserPage',
-  'hydrateBrowserDrivers',
-  'IDLE_BROWSER_DRIVER',
-  'setRemoteViewersForBrowserPage',
-  'hydrateBrowserRemoteViewerPages'
-]
-
-function productionSources(): Map<string, string> {
-  const sources = new Map<string, string>()
-  for (const entry of readdirSync(RENDERER_SRC, { recursive: true, withFileTypes: true })) {
-    if (!entry.isFile() || !/\.tsx?$/.test(entry.name) || entry.name.endsWith('.d.ts')) {
-      continue
-    }
-    if (/\.test\.tsx?$/.test(entry.name) || /test-(harness|rig|fixtures)/.test(entry.name)) {
-      continue
-    }
-    const filePath = join(entry.parentPath, entry.name)
-    sources.set(
-      relative(RENDERER_SRC, filePath).split(sep).join('/'),
-      readFileSync(filePath, 'utf8')
-    )
-  }
-  return sources
-}
-
-function namedSymbols(source: string, symbols: readonly string[]): string[] {
-  return symbols.filter((symbol) => new RegExp(`\\b${symbol}\\b`).test(source))
-}
-
-describe('browser guest retention site census', () => {
-  const sources = productionSources()
-
-  it('keeps every individual retention term behind the shared helper', () => {
-    const offenders = [...sources]
-      .filter(([file]) => !RETENTION_TERM_OWNERS.includes(file))
-      .map(([file, source]) => ({
-        file,
-        terms: namedSymbols(source, RETENTION_TERM_SYMBOLS).filter(
-          (term) => !(NON_RETENTION_TERM_READERS.get(file) ?? []).includes(term)
-        )
-      }))
-      .filter(({ terms }) => terms.length > 0)
-      .map(({ file, terms }) => `${file}: ${terms.join(', ')}`)
-      .sort()
-
-    expect(
-      offenders,
-      'A retention site that names terms one by one silently keeps its old list when a new signal ' +
-        'is added. Call useBrowserGuestPaintRetention / browserPageNeedsPaintRetention instead, ' +
-        'and register the site in RETENTION_SITES.'
-    ).toEqual([])
-  })
-
-  it('registers every consumer of the shared retention helper', () => {
-    const consumers = [...sources]
-      .filter(
-        ([file]) => file !== 'components/browser-pane/host-guest/browser-guest-paint-retention.ts'
-      )
-      .filter(([, source]) => namedSymbols(source, RETENTION_HELPER_SYMBOLS).length > 0)
-      .map(([file]) => file)
-      .sort()
-
-    expect(consumers, 'New retention sites must be listed in RETENTION_SITES.').toEqual(
-      [...RETENTION_SITES.keys()].sort()
-    )
-  })
-
-  it('keeps each registered site consulting retention through its helper', () => {
-    const missing: string[] = []
-    for (const [file, requiredSymbols] of RETENTION_SITES) {
-      const source = sources.get(file)
-      expect(source, `${file} is registered as a retention site but no longer exists`).toBeDefined()
-      for (const symbol of requiredSymbols) {
-        if (!new RegExp(`\\b${symbol}\\b`).test(source ?? '')) {
-          missing.push(`${file}: ${symbol}`)
-        }
-      }
-    }
-    expect(missing, 'A registered retention site stopped consulting retention.').toEqual([])
-  })
-
-  it('keeps the per-page threading hooks travelling as a full set', () => {
-    const partial = [...sources]
-      .filter(([file]) => !RETENTION_TERM_OWNERS.includes(file))
-      .map(([file, source]) => ({ file, hooks: namedSymbols(source, PER_PAGE_RETENTION_HOOKS) }))
-      .filter(({ hooks }) => hooks.length > 0 && hooks.length < PER_PAGE_RETENTION_HOOKS.length)
-      .map(({ file, hooks }) => `${file}: only ${hooks.join(', ')}`)
-      .sort()
-
-    expect(
-      partial,
-      'A pane that threads some retention terms per page must thread all of them.'
-    ).toEqual([])
-  })
-
-  // Keeps the symbol lists above from going stale: a term store that grows a new reader nobody
-  // classified would otherwise be a free way to hand-roll the OR-list.
-  it('classifies every value a term store exports', () => {
-    const classified = new Set([
-      ...RETENTION_TERM_SYMBOLS,
-      ...PER_PAGE_RETENTION_HOOKS,
-      ...NON_READER_TERM_EXPORTS
-    ])
-    const unclassified: string[] = []
-    for (const file of RETENTION_TERM_STORES) {
-      const source = sources.get(file)
-      expect(source, `${file} is registered as a term store but no longer exists`).toBeDefined()
-      for (const [, name] of (source ?? '').matchAll(/^export (?:function|const|let) (\w+)/gm)) {
-        if (!classified.has(name)) {
-          unclassified.push(`${file}: ${name}`)
-        }
-      }
-    }
-
-    expect(
-      unclassified,
-      'A term store exports something this census does not classify. Add a reader to ' +
-        'RETENTION_TERM_SYMBOLS (or PER_PAGE_RETENTION_HOOKS, for the per-page hooks typecheck ' +
-        'already covers) so hand-rolled sites keep failing, and a writer to NON_READER_TERM_EXPORTS.'
-    ).toEqual([])
-  })
-})
diff --git a/src/renderer/src/components/browser-pane/navigate/browser-address-bar-navigation.test.ts b/src/renderer/src/components/browser-pane/navigate/browser-address-bar-navigation.test.ts
index a2f4cdc38cc..2faf06e4929 100644
--- a/src/renderer/src/components/browser-pane/navigate/browser-address-bar-navigation.test.ts
+++ b/src/renderer/src/components/browser-pane/navigate/browser-address-bar-navigation.test.ts
@@ -16,6 +16,17 @@ vi.mock('@/i18n/i18n', () => ({
 import { resolveBrowserAddressBarSubmission } from './browser-address-bar-navigation'
 
 describe('resolveBrowserAddressBarSubmission', () => {
+  it.each([
+    ['example.com:8443/docs', 'https://example.com:8443/docs'],
+    ['app.localhost:3000', 'http://app.localhost:3000/']
+  ])('submits %s as a navigation for local and client-hosted panes', (input, url) => {
+    expect(resolveBrowserAddressBarSubmission(input)).toEqual({ status: 'navigate', url })
+    expect(resolveBrowserAddressBarSubmission(input, { allowFileUrls: false })).toEqual({
+      status: 'navigate',
+      url
+    })
+  })
+
   it('falls back to the configured search engine instead of parsing a query as a host', () => {
     storeState.browserDefaultSearchEngine = 'google'
     expect(resolveBrowserAddressBarSubmission('google maps')).toEqual({
diff --git a/src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.tsx b/src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.tsx
index fb563f4c54b..f447b5432d1 100644
--- a/src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.tsx
+++ b/src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.tsx
@@ -5,6 +5,7 @@ import type { BrowserPage as BrowserPageState } from '../../../../../shared/brow
 import { runtimeEnvironmentSupportsCapability } from '@/runtime/runtime-rpc-client'
 import { convertBrowserPageToWorkspaceDoc } from '@/lib/file-preview'
 import { openWorkspaceBrowserTab } from '@/lib/workspace-browser-tab-open'
+import { resolveBrowserSourceUnifiedTab } from '@/lib/browser-workspace-source-resolution'
 import { useBrowserPageChromeFocus } from '../assemble-chrome/use-browser-page-chrome-focus'
 import { useBrowserAddressBarEditSession } from '../assemble-chrome/use-browser-address-bar-edit-session'
 import { useElementGuestFocus } from '../assemble-chrome/browser-page-guest-focus'
@@ -354,10 +355,17 @@ export function RemoteBrowserPagePane({
           onOpenLinkInOrcaBrowser={() => {
             const linkUrl = contextMenu.linkUrl!
             setContextMenu(null)
+            const sourceUnifiedTab = resolveBrowserSourceUnifiedTab(
+              useAppStore.getState(),
+              browserTab.id,
+              worktreeId
+            )
             void openWorkspaceBrowserTab({
               workspaceId: worktreeId,
               url: linkUrl,
+              ...(sourceUnifiedTab ? { afterTabId: sourceUnifiedTab.id } : {}),
               focusOnCreate: false,
+              selectWorktree: false,
               intent: { kind: 'url' },
               expectedRuntimeEnvironmentId: runtimeEnvironmentId,
               placementPreference: 'server'
diff --git a/src/renderer/src/components/browser-pane/use-ssh-workspace-browser-route.host-connection.test.tsx b/src/renderer/src/components/browser-pane/use-ssh-workspace-browser-route.host-connection.test.tsx
new file mode 100644
index 00000000000..26ee11c77ce
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/use-ssh-workspace-browser-route.host-connection.test.tsx
@@ -0,0 +1,225 @@
+// @vitest-environment happy-dom
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { WorktreeHostConnection } from '@/lib/worktree-host-connection-phase'
+import type { SshConnectionStatus } from '../../../../shared/ssh-types'
+
+const mocks = vi.hoisted(() => {
+  const hostConnection: WorktreeHostConnection = {
+    phase: 'connecting',
+    targetId: 'target-a',
+    environmentId: null,
+    publishedStatus: 'connecting',
+    connectedEpoch: null
+  }
+  const route: { executionHostId: string | null } = { executionHostId: 'ssh:target-a' }
+  return { hostConnection, ...route, prepare: vi.fn() }
+})
+
+vi.mock('@/lib/worktree-runtime-owner', () => ({
+  getExecutionHostIdForWorktree: () => mocks.executionHostId
+}))
+vi.mock('@/lib/worktree-host-connection-phase', () => ({
+  selectWorktreeHostConnectionPhase: () => mocks.hostConnection,
+  useWorktreeHostConnection: () => mocks.hostConnection
+}))
+
+import { useSshWorkspaceBrowserRoute } from './use-ssh-workspace-browser-route'
+
+const READY_PARTITION = 'persist:orca-browser-v1-routed'
+
+const settle = () =>
+  act(async () => {
+    await new Promise((resolve) => setTimeout(resolve, 0))
+  })
+
+const STATUS_BY_PHASE: Record<WorktreeHostConnection['phase'], SshConnectionStatus | null> = {
+  local: null,
+  connecting: 'connecting',
+  connected: 'connected',
+  unavailable: 'disconnected',
+  unverifiable: null
+}
+
+function setHost(
+  phase: WorktreeHostConnection['phase'],
+  connectionGeneration: number | null = null
+): void {
+  mocks.hostConnection = {
+    phase,
+    targetId: 'target-a',
+    environmentId: null,
+    publishedStatus: STATUS_BY_PHASE[phase],
+    connectedEpoch: phase === 'connected' ? `target-a:${connectionGeneration}` : null
+  }
+}
+
+describe('useSshWorkspaceBrowserRoute under a reconnecting SSH host', () => {
+  beforeEach(() => {
+    mocks.prepare.mockReset()
+    mocks.executionHostId = 'ssh:target-a'
+    Object.defineProperty(window, 'api', {
+      configurable: true,
+      value: { browser: { prepareSshWorkspacePartition: mocks.prepare } }
+    })
+  })
+  afterEach(() => cleanup())
+
+  it('waits while the host connects, then prepares exactly once when it connects', async () => {
+    setHost('connecting')
+    mocks.prepare.mockResolvedValue({ partition: READY_PARTITION })
+    const { result, rerender } = renderHook(() => useSshWorkspaceBrowserRoute('wt-1', null))
+    await settle()
+    expect(result.current.state).toEqual({ kind: 'preparing' })
+    expect(mocks.prepare).not.toHaveBeenCalled()
+
+    setHost('connected', 1)
+    rerender()
+    await settle()
+    expect(mocks.prepare).toHaveBeenCalledOnce()
+    expect(result.current.state).toEqual({
+      kind: 'ready',
+      partition: READY_PARTITION,
+      targetId: 'target-a'
+    })
+  })
+
+  it('re-derives an ssh-unavailable error without Retry once the host connects', async () => {
+    setHost('unavailable')
+    mocks.prepare.mockRejectedValueOnce(new Error('browser_local_route_ssh_unavailable'))
+    mocks.prepare.mockResolvedValueOnce({ partition: READY_PARTITION })
+    const { result, rerender } = renderHook(() => useSshWorkspaceBrowserRoute('wt-1', null))
+    await settle()
+    expect(result.current.state.kind).toBe('error')
+
+    setHost('connecting')
+    rerender()
+    await settle()
+    // Why: a dial is a transient; the classified card stays until the host actually connects.
+    expect(result.current.state.kind).toBe('error')
+    expect(mocks.prepare).toHaveBeenCalledOnce()
+
+    setHost('connected', 1)
+    rerender()
+    await settle()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+    expect(result.current.state.kind).toBe('ready')
+  })
+
+  it('re-prepares a failed route when the host reconnects under a new generation', async () => {
+    setHost('connected', 1)
+    mocks.prepare.mockRejectedValueOnce(new Error('browser_local_route_ssh_unavailable'))
+    mocks.prepare.mockResolvedValueOnce({ partition: READY_PARTITION })
+    const { result, rerender } = renderHook(() => useSshWorkspaceBrowserRoute('wt-1', null))
+    await settle()
+    expect(result.current.state.kind).toBe('error')
+
+    setHost('connected', 2)
+    rerender()
+    await settle()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+    expect(result.current.state.kind).toBe('ready')
+  })
+
+  it('prepares once while connected and keeps a ready page mounted across a reconnect', async () => {
+    setHost('connected', 1)
+    mocks.prepare.mockResolvedValue({ partition: READY_PARTITION })
+    const { result, rerender } = renderHook(() => useSshWorkspaceBrowserRoute('wt-1', null))
+    await settle()
+    rerender()
+    rerender()
+    await settle()
+    expect(mocks.prepare).toHaveBeenCalledOnce()
+
+    setHost('connecting', 1)
+    rerender()
+    await settle()
+    expect(result.current.state.kind).toBe('ready')
+
+    setHost('connected', 2)
+    rerender()
+    await settle()
+    expect(mocks.prepare).toHaveBeenCalledOnce()
+    expect(result.current.state.kind).toBe('ready')
+  })
+
+  it('keeps a failed route on its card while another pane redials the host, then recovers on connect', async () => {
+    // The e2e sequence: the user disconnects, a browser tab classifies the dead host, and the
+    // workspace's terminal redials it. Dial transients must not swap the card for "preparing".
+    setHost('unavailable')
+    mocks.prepare.mockRejectedValueOnce(new Error('browser_local_route_ssh_unavailable'))
+    mocks.prepare.mockResolvedValueOnce({ partition: READY_PARTITION })
+    const { result, rerender } = renderHook(() => useSshWorkspaceBrowserRoute('wt-1', null))
+    await settle()
+    const card = result.current.state
+    expect(card).toMatchObject({ kind: 'error', errorKind: 'ssh-unavailable' })
+
+    for (const phase of ['connecting', 'unavailable', 'connecting', 'unavailable'] as const) {
+      setHost(phase)
+      rerender()
+      await settle()
+      expect(result.current.state).toEqual(card)
+    }
+    expect(mocks.prepare).toHaveBeenCalledOnce()
+
+    setHost('connected', 2)
+    rerender()
+    await settle()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+    expect(result.current.state.kind).toBe('ready')
+  })
+
+  it('waits for the connect when Retry is pressed while the host dials', async () => {
+    setHost('unavailable')
+    mocks.prepare.mockRejectedValueOnce(new Error('browser_local_route_ssh_unavailable'))
+    mocks.prepare.mockResolvedValueOnce({ partition: READY_PARTITION })
+    const { result, rerender } = renderHook(() => useSshWorkspaceBrowserRoute('wt-1', null))
+    await settle()
+    expect(result.current.state.kind).toBe('error')
+
+    setHost('connecting')
+    rerender()
+    await settle()
+    act(() => result.current.retry())
+    await settle()
+    expect(result.current.state).toEqual({ kind: 'preparing' })
+    expect(mocks.prepare).toHaveBeenCalledOnce()
+
+    setHost('connected', 1)
+    rerender()
+    await settle()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+    expect(result.current.state.kind).toBe('ready')
+  })
+
+  it('waits for a dialing host when the route becomes routed mid-dial', async () => {
+    // Why: an unrouted route is not an answer for the target it just gained.
+    mocks.executionHostId = null
+    setHost('connecting')
+    mocks.prepare.mockResolvedValue({ partition: READY_PARTITION })
+    const { result, rerender } = renderHook(() => useSshWorkspaceBrowserRoute('wt-1', null))
+    await settle()
+    expect(result.current.state).toEqual({ kind: 'unrouted' })
+
+    mocks.executionHostId = 'ssh:target-a'
+    rerender()
+    await settle()
+    expect(result.current.state).toEqual({ kind: 'preparing' })
+    expect(mocks.prepare).not.toHaveBeenCalled()
+
+    setHost('connected', 1)
+    rerender()
+    await settle()
+    expect(mocks.prepare).toHaveBeenCalledOnce()
+    expect(result.current.state.kind).toBe('ready')
+  })
+
+  it('prepares normally for a host it cannot verify instead of waiting on it', async () => {
+    setHost('unverifiable')
+    mocks.prepare.mockResolvedValue({ partition: READY_PARTITION })
+    const { result } = renderHook(() => useSshWorkspaceBrowserRoute('wt-1', null))
+    await settle()
+    expect(mocks.prepare).toHaveBeenCalledOnce()
+    expect(result.current.state.kind).toBe('ready')
+  })
+})
diff --git a/src/renderer/src/components/browser-pane/use-ssh-workspace-browser-route.ts b/src/renderer/src/components/browser-pane/use-ssh-workspace-browser-route.ts
index b7a1e432664..6af3275c14c 100644
--- a/src/renderer/src/components/browser-pane/use-ssh-workspace-browser-route.ts
+++ b/src/renderer/src/components/browser-pane/use-ssh-workspace-browser-route.ts
@@ -1,6 +1,7 @@
 import { useEffect, useState } from 'react'
 import { useAppStore } from '@/store'
 import { getExecutionHostIdForWorktree } from '@/lib/worktree-runtime-owner'
+import { useWorktreeHostConnection } from '@/lib/worktree-host-connection-phase'
 import { resolveSshWorkspaceBrowserRouteEligibility } from '@/lib/ssh-workspace-browser-route-eligibility'
 
 export type SshWorkspaceBrowserRouteErrorKind = 'forwarding-blocked' | 'ssh-unavailable' | 'unknown'
@@ -64,6 +65,24 @@ export function useSshWorkspaceBrowserRoute(
   const [state, setState] = useState<SshWorkspaceBrowserRouteState>(
     targetId ? { kind: 'preparing' } : { kind: 'unrouted' }
   )
+  const hostConnection = useWorktreeHostConnection(worktreeId)
+  const routeHost =
+    targetId !== null && hostConnection.targetId === targetId ? hostConnection : null
+  // Why only an unsettled route waits: a dial is a transient, so it must not unmount a ready
+  // page or swap a failed route's card for "preparing". A connect (below) re-derives a failed one.
+  // Unrouted and another target's page are unsettled too: neither answers for this target.
+  const routeReady = state.kind === 'ready' && state.targetId === targetId
+  const awaitingHost = routeHost?.phase === 'connecting' && state.kind !== 'error' && !routeReady
+  const connectedHostEpoch = routeHost?.connectedEpoch ?? null
+  const [seenConnectedHostEpoch, setSeenConnectedHostEpoch] = useState(connectedHostEpoch)
+  if (connectedHostEpoch !== seenConnectedHostEpoch) {
+    setSeenConnectedHostEpoch(connectedHostEpoch)
+    // Why: a host that connects — or reconnects under a new generation — re-derives a route
+    // it failed or held, the same as Retry, but keeps the user's probe choice.
+    if (connectedHostEpoch !== null && !routeReady) {
+      setAttempt((current) => ({ ...current, count: current.count + 1 }))
+    }
+  }
 
   // Why: a persisted "Try anyway" means the user vouched for this host once
   // (e.g. PermitOpen allows their sites while the loopback probe is refused);
@@ -74,8 +93,13 @@ export function useSshWorkspaceBrowserRoute(
       setState({ kind: 'unrouted' })
       return
     }
-    let cancelled = false
     setState({ kind: 'preparing' })
+    // Why: the SSH connection is still being established, so prepare could only fail with
+    // ssh-unavailable; the connected transition above restarts it.
+    if (awaitingHost) {
+      return
+    }
+    let cancelled = false
     window.api.browser
       .prepareSshWorkspacePartition({
         targetId,
@@ -100,7 +124,7 @@ export function useSshWorkspaceBrowserRoute(
     return () => {
       cancelled = true
     }
-  }, [targetId, browserProfileId, attempt, skipProbe])
+  }, [targetId, browserProfileId, attempt, skipProbe, awaitingHost])
 
   // Why (review P1-1): `state` lags one commit behind a targetId transition on
   // an already-mounted instance; returning stale 'unrouted' (or a stale
@@ -109,13 +133,21 @@ export function useSshWorkspaceBrowserRoute(
   // routed/unrouted decision must be derived from targetId in-render.
   const effectiveState: SshWorkspaceBrowserRouteState = !targetId
     ? { kind: 'unrouted' }
-    : state.kind === 'unrouted' || (state.kind === 'ready' && state.targetId !== targetId)
+    : awaitingHost ||
+        state.kind === 'unrouted' ||
+        (state.kind === 'ready' && state.targetId !== targetId)
       ? { kind: 'preparing' }
       : state
+  const rederive = (nextSkipProbe: boolean): void => {
+    // Why: landing on preparing with the new attempt lets the effect's first run see a dialing
+    // host and wait, instead of starting a prepare that its own preparing write then cancels.
+    setState({ kind: 'preparing' })
+    setAttempt((current) => ({ count: current.count + 1, skipProbe: nextSkipProbe }))
+  }
   return {
     state: effectiveState,
     targetId: sshTargetId,
-    retry: () => setAttempt((current) => ({ count: current.count + 1, skipProbe: false })),
+    retry: () => rederive(false),
     tryWithoutProbe: () => {
       // Persist the override so this host isn't re-nagged on every launch.
       if (sshTargetId && probeSkippedTargetIds?.includes(sshTargetId) !== true) {
@@ -126,7 +158,7 @@ export function useSshWorkspaceBrowserRoute(
           ]
         })
       }
-      setAttempt((current) => ({ count: current.count + 1, skipProbe: true }))
+      rederive(true)
     },
     browseFromThisDevice: () => {
       if (!sshTargetId) {
diff --git a/src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx b/src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx
index aaee9c6243f..602581dc16d 100644
--- a/src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx
+++ b/src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx
@@ -621,11 +621,11 @@ describe('HtmlDocPreview guest focus', () => {
 
   beforeEach(() => {
     focused = []
-    focusSpy = vi
-      .spyOn(HTMLElement.prototype, 'focus')
-      .mockImplementation(function (this: HTMLElement) {
-        focused.push(this)
-      })
+    focusSpy = vi.spyOn(HTMLElement.prototype, 'focus').mockImplementation(function (
+      this: HTMLElement
+    ) {
+      focused.push(this)
+    })
     container = document.createElement('div')
     document.body.appendChild(container)
     root = createRoot(container)
diff --git a/src/renderer/src/components/browser-pane/workspace-doc/doc-preview-overflow-menu.tsx b/src/renderer/src/components/browser-pane/workspace-doc/doc-preview-overflow-menu.tsx
index 801d153b28b..29e35d8f87e 100644
--- a/src/renderer/src/components/browser-pane/workspace-doc/doc-preview-overflow-menu.tsx
+++ b/src/renderer/src/components/browser-pane/workspace-doc/doc-preview-overflow-menu.tsx
@@ -8,6 +8,10 @@ import {
   DropdownMenuTrigger
 } from '@/components/ui/dropdown-menu'
 import { translate } from '@/i18n/i18n'
+import {
+  BrowserChromeFoldedMenuItems,
+  type BrowserChromeOverflowMenuProps
+} from '../assemble-chrome/browser-chrome-folded-tools'
 
 /**
  * The preview's overflow menu. It carries the document actions rather than the browsing pane's
@@ -18,7 +22,8 @@ export function DocPreviewOverflowMenu({
   onHardReload,
   onOpenSource,
   onCopyPath,
-  onCopyRelativePath
+  onCopyRelativePath,
+  overflow
 }: {
   onReload: () => void
   onHardReload: () => void
@@ -26,11 +31,13 @@ export function DocPreviewOverflowMenu({
   onCopyPath: () => void
   /** Why it lives here: the preview hides the editor's path header, which was the only way to copy it. */
   onCopyRelativePath: () => void
+  overflow: BrowserChromeOverflowMenuProps
 }): React.JSX.Element {
   return (
     <DropdownMenu>
       <DropdownMenuTrigger asChild>
         <Button
+          ref={overflow.triggerRef}
           size="icon"
           variant="ghost"
           className="h-7 w-7"
@@ -42,7 +49,11 @@ export function DocPreviewOverflowMenu({
           <MoreHorizontal className="size-4" />
         </Button>
       </DropdownMenuTrigger>
-      <DropdownMenuContent align="end">
+      <DropdownMenuContent align="end" onCloseAutoFocus={overflow.onMenuCloseAutoFocus}>
+        <BrowserChromeFoldedMenuItems
+          tools={overflow.tools}
+          deferUntilClose={overflow.deferUntilClose}
+        />
         <DropdownMenuItem onSelect={onReload}>
           <RefreshCw className="size-3.5" />
           {translate('auto.components.browser.pane.BrowserPane.0e080d820e', 'Reload')}
diff --git a/src/renderer/src/components/browser-pane/workspace-doc/doc-preview-toolbar.tsx b/src/renderer/src/components/browser-pane/workspace-doc/doc-preview-toolbar.tsx
index df8f9116ca2..871323a9aef 100644
--- a/src/renderer/src/components/browser-pane/workspace-doc/doc-preview-toolbar.tsx
+++ b/src/renderer/src/components/browser-pane/workspace-doc/doc-preview-toolbar.tsx
@@ -102,7 +102,8 @@ export function DocPreviewToolbar({
         label: translate(
           'auto.components.editor.HtmlDocPreview.openSourceControl',
           'Open source file'
-        )
+        ),
+        alreadyInOverflowMenu: true
       }}
       openExternal={{
         onSelect: onOpenExternally,
@@ -111,15 +112,16 @@ export function DocPreviewToolbar({
           'Open with default app'
         )
       }}
-      overflowMenu={
+      overflowMenu={(overflow) => (
         <DocPreviewOverflowMenu
           onReload={onReload}
           onHardReload={onHardReload}
           onOpenSource={onOpenSource}
           onCopyPath={onCopyPath}
           onCopyRelativePath={onCopyRelativePath}
+          overflow={overflow}
         />
-      }
+      )}
     />
   )
 }
diff --git a/src/renderer/src/components/confirmation-dialog-refresh-boundary.test.ts b/src/renderer/src/components/confirmation-dialog-refresh-boundary.test.ts
index 952cb21e23d..b2f1db2de1f 100644
--- a/src/renderer/src/components/confirmation-dialog-refresh-boundary.test.ts
+++ b/src/renderer/src/components/confirmation-dialog-refresh-boundary.test.ts
@@ -1,33 +1,11 @@
 // @vitest-environment happy-dom
-import { createRequire } from 'node:module'
 import { createElement, type ReactNode } from 'react'
 import { renderHook } from '@testing-library/react'
 import { describe, expect, it } from 'vitest'
-import * as contextModule from '@/components/confirmation-dialog-context'
-import * as providerModule from '@/components/confirmation-dialog'
 import { ConfirmationDialogProvider } from '@/components/confirmation-dialog'
 import { useConfirmationDialog } from '@/components/confirmation-dialog-context'
 
-// react-refresh ships no types; take the one binding this needs.
-const { isLikelyComponentType } = createRequire(import.meta.url)('react-refresh/runtime') as {
-  isLikelyComponentType: (value: unknown) => boolean
-}
-
 describe('confirmation dialog Fast Refresh boundary', () => {
-  it('exports nothing from the provider module that invalidates the refresh boundary', () => {
-    expect(Object.keys(providerModule)).toEqual(['ConfirmationDialogProvider'])
-    expect(isLikelyComponentType(providerModule.ConfirmationDialogProvider)).toBe(true)
-  })
-
-  it('keeps the context and hook in a component-free module', () => {
-    const components = Object.entries(contextModule)
-      .filter(([, value]) => isLikelyComponentType(value))
-      .map(([name]) => name)
-
-    expect(components).toEqual([])
-    expect(typeof contextModule.useConfirmationDialog).toBe('function')
-  })
-
   it('resolves the hook against the context the provider publishes', () => {
     const wrapper = ({ children }: { children: ReactNode }) =>
       createElement(ConfirmationDialogProvider, null, children)
diff --git a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.clipboard-routes.test.tsx b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.clipboard-routes.test.tsx
index f95815b2552..06e2cb38721 100644
--- a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.clipboard-routes.test.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.clipboard-routes.test.tsx
@@ -88,6 +88,7 @@ vi.mock('@xterm/xterm', () => ({
     scrollToBottom = vi.fn()
     selectAll = vi.fn()
     getSelection = vi.fn(() => this.selectionText)
+    hasSelection = vi.fn(() => this.selectionText !== '')
     attachCustomKeyEventHandler = vi.fn((handler: (event: KeyboardEvent) => boolean) => {
       this.customKeyHandler = handler
     })
diff --git a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx
index 62f5b5b2a1d..65e7026291b 100644
--- a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx
@@ -37,6 +37,7 @@ vi.mock('@xterm/xterm', () => ({
     scrollToBottom = vi.fn()
     selectAll = vi.fn()
     getSelection = vi.fn(() => '')
+    hasSelection = vi.fn(() => false)
     attachCustomKeyEventHandler = vi.fn((handler: (event: KeyboardEvent) => boolean) => {
       this.customKeyHandler = handler
     })
diff --git a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-geometry.test.tsx b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-geometry.test.tsx
new file mode 100644
index 00000000000..8ddb8a8ae75
--- /dev/null
+++ b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-geometry.test.tsx
@@ -0,0 +1,254 @@
+// @vitest-environment happy-dom
+
+import { act, cleanup, render } from '@testing-library/react'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import type { ITerminalOptions } from '@xterm/xterm'
+import type { GlobalSettings } from '../../../../shared/global-settings-types'
+import type { TerminalPreviewConnectResult } from '../../../../shared/terminal-preview'
+import { createGlobalSettingsFixture } from '../../../../shared/global-settings-test-fixture'
+import { useAppStore } from '@/store'
+import { AgentTerminalPreview } from './AgentTerminalPreview'
+
+type PreviewInstance = {
+  options: ITerminalOptions
+  container: HTMLElement | null
+  dispose: ReturnType<typeof vi.fn>
+}
+const harness = vi.hoisted(() => ({ instances: new Array<PreviewInstance>() }))
+
+vi.mock('@xterm/xterm', () => ({
+  Terminal: class {
+    cols = 80
+    rows = 24
+    buffer = { active: { cursorY: 14 } }
+    container: HTMLElement | null = null
+    screen = document.createElement('div')
+    write = vi.fn((_data: string, callback?: () => void) => callback?.())
+    focus = vi.fn()
+    resize = vi.fn()
+    reset = vi.fn()
+    onData = vi.fn(() => ({ dispose: vi.fn() }))
+    dispose = vi.fn(() => this.screen.remove())
+    constructor(public options: ITerminalOptions) {
+      harness.instances.push(this)
+    }
+    open(container: HTMLElement): void {
+      this.container = container
+      this.screen.className = 'xterm-screen'
+      Object.defineProperties(this.screen, {
+        offsetWidth: {
+          get: () =>
+            this.cols *
+            (this.options.fontSize === 18 ||
+            this.options.fontFamily?.includes('Fira Code') ||
+            this.options.fontWeight === 900 ||
+            this.options.fontWeightBold === 900
+              ? 12
+              : 10)
+        },
+        offsetHeight: { get: () => this.rows * 16 * (this.options.lineHeight ?? 1) }
+      })
+      const box = container.parentElement
+      if (!box) {
+        throw new Error('Missing preview box')
+      }
+      Object.defineProperties(box, {
+        clientWidth: { configurable: true, value: 600 },
+        clientHeight: { configurable: true, value: 240 }
+      })
+      container.append(this.screen)
+    }
+  }
+}))
+vi.mock('@/components/terminal-pane/terminal-user-input-signal', () => ({
+  subscribeToTerminalUserInput: () => ({ dispose: vi.fn() })
+}))
+vi.mock('@/components/terminal-pane/use-system-prefers-dark', () => ({
+  useSystemPrefersDark: () => false
+}))
+vi.mock('@/lib/keyboard-layout/use-effective-mac-option-as-alt', () => ({
+  useEffectiveMacOptionAsAlt: (value: string) => value
+}))
+vi.mock('./preview-terminal-ligatures', () => ({ syncPreviewTerminalLigatures: vi.fn() }))
+vi.mock('./preview-terminal-compatibility', () => ({
+  installPreviewTerminalCompatibility: () => vi.fn()
+}))
+vi.mock('./preview-terminal-ime-bridge', () => ({
+  installPreviewImeBridge: () => ({ claimKeyEvent: () => false, dispose: vi.fn() })
+}))
+vi.mock('./preview-terminal-key-handler', () => ({
+  installPreviewTerminalKeyHandler: () => vi.fn()
+}))
+vi.mock('@/components/terminal-pane/terminal-native-copy-gutter', () => ({
+  installTerminalNativeCopyGutterTrim: () => ({ dispose: vi.fn() })
+}))
+vi.mock('./preview-terminal-app-menu-clipboard', () => ({
+  installPreviewTerminalAppMenuClipboard: () => vi.fn()
+}))
+vi.mock('./preview-terminal-right-click-paste', () => ({
+  installPreviewTerminalRightClickPaste: () => vi.fn()
+}))
+
+const initial = useAppStore.getInitialState()
+const connect = vi.fn<Window['api']['terminalPreview']['connect']>()
+const fit = vi.fn(async (_ptyId: string, cols: number, rows: number) => ({ cols, rows }))
+const unsubscribe = vi.fn(async () => {})
+let settings: GlobalSettings
+let originalApi: PropertyDescriptor | undefined
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.clearAllMocks()
+  harness.instances.length = 0
+  // No resize notification or later output: replay must perform its own fit and grid claim.
+  vi.stubGlobal(
+    'ResizeObserver',
+    class {
+      observe = vi.fn()
+      disconnect = vi.fn()
+    }
+  )
+  settings = createGlobalSettingsFixture({
+    theme: 'dark',
+    activeRuntimeEnvironmentId: null,
+    terminalFontSize: 14,
+    terminalFontFamily: 'JetBrains Mono',
+    terminalFontWeight: 500,
+    terminalFontWeightBold: 700,
+    terminalLineHeight: 1,
+    terminalLigatures: 'off'
+  })
+  connect
+    .mockReset()
+    .mockResolvedValue({ snapshot: { data: '', cols: 80, rows: 24, seq: 1 }, replay: [] })
+  originalApi = Object.getOwnPropertyDescriptor(window, 'api')
+  Object.defineProperty(window, 'api', {
+    configurable: true,
+    value: {
+      settings: {
+        set: async (updates: Partial<GlobalSettings>) => {
+          settings = structuredClone({ ...settings, ...updates })
+          return settings
+        }
+      },
+      terminalPreview: { connect, fit, unsubscribe, onData: () => vi.fn() }
+    }
+  })
+  useAppStore.setState({ ...initial, settings }, true)
+})
+
+afterEach(() => {
+  cleanup()
+  for (const instance of harness.instances) {
+    expect(instance.dispose).toHaveBeenCalledOnce()
+  }
+  useAppStore.setState(initial, true)
+  if (originalApi) {
+    Object.defineProperty(window, 'api', originalApi)
+  } else {
+    Reflect.deleteProperty(window, 'api')
+  }
+  vi.unstubAllGlobals()
+  vi.useRealTimers()
+})
+
+async function settleGeometry(): Promise<void> {
+  await act(async () => {
+    await vi.advanceTimersByTimeAsync(250)
+  })
+}
+
+it.each([
+  {
+    updates: { terminalFontSize: 18 },
+    cols: 50,
+    rows: 15,
+    scale: 'scale(0.625)',
+    anchor: 'top left'
+  },
+  {
+    updates: { terminalFontFamily: 'Fira Code' },
+    cols: 50,
+    rows: 15,
+    scale: 'scale(0.625)',
+    anchor: 'top left'
+  },
+  {
+    updates: { terminalFontWeight: 900 },
+    cols: 50,
+    rows: 15,
+    scale: 'scale(0.625)',
+    anchor: 'top left'
+  },
+  {
+    updates: { terminalFontWeightBold: 900 },
+    cols: 50,
+    rows: 15,
+    scale: 'scale(0.625)',
+    anchor: 'top left'
+  },
+  {
+    updates: { terminalLineHeight: 1.5 },
+    cols: 60,
+    rows: 10,
+    scale: 'scale(0.75)',
+    anchor: 'bottom left'
+  },
+  {
+    updates: { terminalLigatures: 'on' },
+    cols: 60,
+    rows: 15,
+    scale: 'scale(0.75)',
+    anchor: 'top left'
+  }
+] satisfies {
+  updates: Partial<GlobalSettings>
+  cols: number
+  rows: number
+  scale: string
+  anchor: string
+}[])(
+  'recreates the owner and fits the new geometry for $updates',
+  async ({ updates, cols, rows, scale, anchor }) => {
+    render(<AgentTerminalPreview ptyId="pty-1" />)
+    await settleGeometry()
+    expect(fit).toHaveBeenLastCalledWith('pty-1', 60, 15)
+    await act(async () => useAppStore.getState().updateSettings(updates))
+    await settleGeometry()
+
+    expect(fit).toHaveBeenCalledTimes(2)
+    expect(fit).toHaveBeenLastCalledWith('pty-1', cols, rows)
+    expect(harness.instances).toHaveLength(2)
+    expect(connect).toHaveBeenCalledTimes(2)
+    expect(unsubscribe).toHaveBeenCalledExactlyOnceWith('pty-1')
+    expect(harness.instances[1]?.container?.style.transform).toBe(scale)
+    expect(harness.instances[1]?.container?.style.transformOrigin).toBe(anchor)
+  }
+)
+
+it('ignores a pending connection retired by a metric change', async () => {
+  const gate = Promise.withResolvers<TerminalPreviewConnectResult>()
+  connect.mockReturnValueOnce(gate.promise)
+  render(<AgentTerminalPreview ptyId="pty-1" />)
+  await act(async () => useAppStore.getState().updateSettings({ terminalFontSize: 18 }))
+  await settleGeometry()
+  await act(async () =>
+    gate.resolve({ snapshot: { data: '', cols: 80, rows: 24, seq: 1 }, replay: [] })
+  )
+  await settleGeometry()
+  expect(connect).toHaveBeenCalledTimes(2)
+  expect(harness.instances).toHaveLength(1)
+  expect(harness.instances[0]?.options.fontSize).toBe(18)
+  expect(fit).toHaveBeenCalledExactlyOnceWith('pty-1', 50, 15)
+})
+
+it('cancels an obsolete metric owner grid claim before the next change', async () => {
+  render(<AgentTerminalPreview ptyId="pty-1" />)
+  await settleGeometry()
+  await act(async () => useAppStore.getState().updateSettings({ terminalFontSize: 18 }))
+  await act(async () => useAppStore.getState().updateSettings({ terminalLineHeight: 1.5 }))
+  await settleGeometry()
+  expect(harness.instances).toHaveLength(3)
+  expect(fit).toHaveBeenCalledTimes(2)
+  expect(fit).toHaveBeenLastCalledWith('pty-1', 50, 10)
+})
diff --git a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-lifetime.test.tsx b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-lifetime.test.tsx
new file mode 100644
index 00000000000..84c0242e186
--- /dev/null
+++ b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-lifetime.test.tsx
@@ -0,0 +1,292 @@
+// @vitest-environment happy-dom
+
+import { act, cleanup, render } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ITerminalOptions } from '@xterm/xterm'
+import type { GlobalSettings } from '../../../../shared/global-settings-types'
+import type { TerminalPreviewConnectResult } from '../../../../shared/terminal-preview'
+import { createGlobalSettingsFixture } from '../../../../shared/global-settings-test-fixture'
+import { makeCustomTerminalThemeSelection } from '../../../../shared/terminal-custom-themes'
+import { useAppStore } from '@/store'
+import { AgentTerminalPreview } from './AgentTerminalPreview'
+
+type PreviewInstance = {
+  options: ITerminalOptions
+  dispose: ReturnType<typeof vi.fn>
+  reset: ReturnType<typeof vi.fn>
+}
+
+const harness = vi.hoisted(() => ({
+  instances: new Array<PreviewInstance>(),
+  systemPrefersDark: false
+}))
+
+vi.mock('@xterm/xterm', () => ({
+  Terminal: class {
+    cols = 80
+    rows = 24
+    buffer = { active: { cursorY: 0 } }
+    options: ITerminalOptions
+    write = vi.fn((_data: string, callback?: () => void) => callback?.())
+    open = vi.fn()
+    focus = vi.fn()
+    dispose = vi.fn()
+    resize = vi.fn()
+    reset = vi.fn()
+    onData = vi.fn(() => ({ dispose: vi.fn() }))
+    constructor(options: ITerminalOptions) {
+      this.options = options
+      harness.instances.push(this)
+    }
+  }
+}))
+vi.mock('@/components/terminal-pane/terminal-user-input-signal', () => ({
+  subscribeToTerminalUserInput: () => ({ dispose: vi.fn() })
+}))
+vi.mock('@/components/terminal-pane/use-system-prefers-dark', () => ({
+  useSystemPrefersDark: () => harness.systemPrefersDark
+}))
+vi.mock('@/lib/keyboard-layout/use-effective-mac-option-as-alt', () => ({
+  useEffectiveMacOptionAsAlt: (value: string) => value
+}))
+vi.mock('./preview-grid-claim', () => ({
+  createPreviewGridClaim: () => ({ schedule: vi.fn(), dispose: vi.fn() })
+}))
+vi.mock('./preview-terminal-box-fit', () => ({
+  createPreviewBoxFit: () => ({ schedule: vi.fn() })
+}))
+vi.mock('./preview-terminal-ligatures', () => ({ syncPreviewTerminalLigatures: vi.fn() }))
+vi.mock('./preview-terminal-compatibility', () => ({
+  installPreviewTerminalCompatibility: () => vi.fn()
+}))
+vi.mock('./preview-terminal-ime-bridge', () => ({
+  installPreviewImeBridge: () => ({ claimKeyEvent: () => false, dispose: vi.fn() })
+}))
+vi.mock('./preview-terminal-key-handler', () => ({
+  installPreviewTerminalKeyHandler: () => vi.fn()
+}))
+vi.mock('@/components/terminal-pane/terminal-native-copy-gutter', () => ({
+  installTerminalNativeCopyGutterTrim: () => ({ dispose: vi.fn() })
+}))
+vi.mock('./preview-terminal-app-menu-clipboard', () => ({
+  installPreviewTerminalAppMenuClipboard: () => vi.fn()
+}))
+vi.mock('./preview-terminal-right-click-paste', () => ({
+  installPreviewTerminalRightClickPaste: () => vi.fn()
+}))
+
+const initial = useAppStore.getInitialState()
+const connect = vi.fn<Window['api']['terminalPreview']['connect']>()
+const unsubscribe = vi.fn(async () => {})
+const offData = vi.fn()
+const onData = vi.fn((listener: Parameters<Window['api']['terminalPreview']['onData']>[0]) => {
+  emitData = listener
+  return offData
+})
+const connection: TerminalPreviewConnectResult = {
+  snapshot: { data: 'agent prompt', cols: 80, rows: 24, seq: 1 },
+  replay: []
+}
+let settings: GlobalSettings
+let originalApi: PropertyDescriptor | undefined
+let emitData: Parameters<Window['api']['terminalPreview']['onData']>[0] | undefined
+
+async function updateSettings(updates: Partial<GlobalSettings>): Promise<void> {
+  await act(async () => useAppStore.getState().updateSettings(updates))
+}
+
+function terminal(index = 0): PreviewInstance {
+  const instance = harness.instances[index]
+  if (!instance) {
+    throw new Error(`Missing terminal ${index}`)
+  }
+  return instance
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  harness.instances.length = 0
+  harness.systemPrefersDark = false
+  emitData = undefined
+  settings = createGlobalSettingsFixture({ theme: 'dark', activeRuntimeEnvironmentId: null })
+  connect.mockReset().mockResolvedValue(connection)
+  originalApi = Object.getOwnPropertyDescriptor(window, 'api')
+  Object.defineProperty(window, 'api', {
+    configurable: true,
+    value: {
+      settings: {
+        set: async (updates: Partial<GlobalSettings>) => {
+          settings = structuredClone({ ...settings, ...updates })
+          return settings
+        }
+      },
+      terminalPreview: {
+        connect,
+        unsubscribe,
+        onData
+      }
+    }
+  })
+  useAppStore.setState({ ...initial, settings }, true)
+})
+
+afterEach(() => {
+  cleanup()
+  for (const instance of harness.instances) {
+    expect(instance.dispose).toHaveBeenCalledOnce()
+  }
+  expect(offData).toHaveBeenCalledTimes(onData.mock.calls.length)
+  useAppStore.setState(initial, true)
+  if (originalApi) {
+    Object.defineProperty(window, 'api', originalApi)
+  } else {
+    Reflect.deleteProperty(window, 'api')
+  }
+})
+
+describe('preview terminal settings lifetime', () => {
+  it('keeps one preview connection across ten unrelated settings snapshots', async () => {
+    render(<AgentTerminalPreview ptyId="pty-1" />)
+    await act(async () => {})
+    const theme = terminal().options.theme
+    for (let index = 1; index <= 10; index += 1) {
+      await updateSettings({ editorAutoSaveDelayMs: 1000 + index })
+    }
+    expect(connect).toHaveBeenCalledExactlyOnceWith('pty-1', { scrollbackRows: 24 })
+    expect(harness.instances).toHaveLength(1)
+    expect(terminal().options.theme).toBe(theme)
+    expect(unsubscribe).not.toHaveBeenCalled()
+  })
+
+  it('updates cursor options on the existing terminal', async () => {
+    render(<AgentTerminalPreview ptyId="pty-1" />)
+    await act(async () => {})
+    await updateSettings({
+      terminalCursorStyle: 'bar',
+      terminalCursorBlink: false
+    })
+    expect(connect).toHaveBeenCalledOnce()
+    expect(terminal().options).toMatchObject({
+      cursorStyle: 'bar',
+      cursorBlink: false
+    })
+  })
+
+  it.each([
+    { terminalThemeDark: 'Builtin Tango Light' },
+    { terminalColorOverrides: { background: '#123456' } },
+    { terminalBackgroundOpacity: 0.5 },
+    { terminalCursorOpacity: 0.5 },
+    { terminalMinimumContrastRatio: 7 }
+  ] satisfies Partial<GlobalSettings>[])(
+    'replaces the terminal when theme or contrast changes: %o',
+    async (updates) => {
+      render(<AgentTerminalPreview ptyId="pty-1" />)
+      await act(async () => {})
+      await updateSettings(updates)
+      expect(connect).toHaveBeenCalledTimes(2)
+      expect(unsubscribe).toHaveBeenCalledExactlyOnceWith('pty-1')
+      expect(terminal().dispose).toHaveBeenCalledOnce()
+      expect(harness.instances).toHaveLength(2)
+      if ('terminalMinimumContrastRatio' in updates) {
+        expect(terminal(1).options.minimumContrastRatio).toBe(7)
+      } else {
+        expect(terminal(1).options.theme).not.toEqual(terminal().options.theme)
+      }
+    }
+  )
+
+  it('keeps a cloned imported theme but reconnects when its selected colors change', async () => {
+    const custom = {
+      id: 'manual:preview',
+      name: 'Preview',
+      source: 'manual' as const,
+      mode: 'dark' as const,
+      terminal: { background: '#123456', foreground: '#eeeeee', red: '#ff0000' },
+      importedAt: '2026-09-25'
+    }
+    await updateSettings({
+      terminalCustomThemes: [custom],
+      terminalThemeDark: makeCustomTerminalThemeSelection(custom.id)
+    })
+    render(<AgentTerminalPreview ptyId="pty-1" />)
+    await act(async () => {})
+    expect(terminal().options.theme?.background).toBe('#123456')
+    await updateSettings({ editorAutoSaveDelayMs: 1234 })
+    expect(connect).toHaveBeenCalledOnce()
+    await updateSettings({
+      terminalCustomThemes: [{ ...custom, terminal: { ...custom.terminal, background: '#654321' } }]
+    })
+    expect(connect).toHaveBeenCalledTimes(2)
+    expect(terminal(1).options.theme?.background).toBe('#654321')
+  })
+
+  it('reconnects when the effective OS theme changes', async () => {
+    await updateSettings({ theme: 'system' })
+    const view = render(<AgentTerminalPreview ptyId="pty-1" />)
+    await act(async () => {})
+    harness.systemPrefersDark = true
+    view.rerender(<AgentTerminalPreview ptyId="pty-1" />)
+    await act(async () => {})
+    expect(connect).toHaveBeenCalledTimes(2)
+    expect(terminal(1).options.theme).not.toEqual(terminal().options.theme)
+  })
+
+  it('uses current live options when an unrelated update arrives during connect', async () => {
+    const gate = Promise.withResolvers<TerminalPreviewConnectResult>()
+    connect.mockReturnValueOnce(gate.promise)
+    render(<AgentTerminalPreview ptyId="pty-1" />)
+    await updateSettings({ terminalCursorStyle: 'bar' })
+    expect(connect).toHaveBeenCalledOnce()
+    await act(async () => gate.resolve(connection))
+    expect(harness.instances).toHaveLength(1)
+    expect(terminal().options.cursorStyle).toBe('bar')
+  })
+
+  it('ignores an old pending connection after a relevant theme change', async () => {
+    const gate = Promise.withResolvers<TerminalPreviewConnectResult>()
+    connect.mockReturnValueOnce(gate.promise)
+    render(<AgentTerminalPreview ptyId="pty-1" />)
+    await updateSettings({ terminalMinimumContrastRatio: 7 })
+    expect(connect).toHaveBeenCalledTimes(2)
+    expect(harness.instances).toHaveLength(1)
+    await act(async () => gate.resolve(connection))
+    expect(harness.instances).toHaveLength(1)
+    expect(terminal().options.minimumContrastRatio).toBe(7)
+  })
+
+  it('does not install a terminal after unmounting a pending connection', async () => {
+    const gate = Promise.withResolvers<TerminalPreviewConnectResult>()
+    connect.mockReturnValueOnce(gate.promise)
+    const view = render(<AgentTerminalPreview ptyId="ssh:host@@pty-1" />)
+    await updateSettings({ editorAutoSaveDelayMs: 1234 })
+    view.unmount()
+    await act(async () => gate.resolve(connection))
+    expect(harness.instances).toHaveLength(0)
+    expect(connect).toHaveBeenCalledOnce()
+    expect(unsubscribe).toHaveBeenCalledExactlyOnceWith('ssh:host@@pty-1')
+  })
+
+  it('keeps a hidden mounted preview connected through unrelated settings updates', async () => {
+    render(
+      <div hidden>
+        <AgentTerminalPreview ptyId="pty-1" />
+      </div>
+    )
+    await act(async () => {})
+    await updateSettings({ editorAutoSaveDelayMs: 1234 })
+    expect(connect).toHaveBeenCalledOnce()
+    expect(unsubscribe).not.toHaveBeenCalled()
+  })
+
+  it('still resyncs the same terminal after unrelated settings updates', async () => {
+    render(<AgentTerminalPreview ptyId="pty-1" />)
+    await act(async () => {})
+    await updateSettings({ editorAutoSaveDelayMs: 1234 })
+    await act(async () => emitData?.({ type: 'resync', ptyId: 'pty-1' }))
+    expect(connect).toHaveBeenCalledTimes(2)
+    expect(harness.instances).toHaveLength(1)
+    expect(terminal().reset).toHaveBeenCalledOnce()
+    expect(unsubscribe).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx
index 4a63a289551..d31f7293e76 100644
--- a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx
@@ -80,6 +80,7 @@ vi.mock('@xterm/xterm', () => ({
     scrollToBottom = vi.fn()
     selectAll = vi.fn()
     getSelection = vi.fn(() => this.selectionText)
+    hasSelection = vi.fn(() => this.selectionText !== '')
     attachCustomKeyEventHandler = vi.fn((handler: (event: KeyboardEvent) => boolean) => {
       this.customKeyHandler = handler
     })
@@ -213,7 +214,8 @@ describe('AgentTerminalPreview', () => {
     expect(input).toHaveBeenCalledTimes(1)
     expect(input).toHaveBeenCalledWith('pty-1', 'k')
 
-    act(() => terminal.writeCallbacks.shift()?.())
+    // Why drain all: the connection's kitty restore write queues ahead of the live chunk.
+    act(() => terminal.writeCallbacks.splice(0).forEach((callback) => callback()))
     expect(ack).toHaveBeenCalledWith('pty-1', 4)
   })
 
@@ -271,6 +273,11 @@ describe('AgentTerminalPreview', () => {
     render(<AgentTerminalPreview ptyId="pty-1" />)
     await waitFor(() => expect(imeHarness.forwarders).toHaveLength(1))
     await waitFor(() => expect(imeHarness.forwarders[0]!.getKittyKeyboardFlags()).toBe(8))
+    // The popout xterm gets the same flags, so its encoder agrees with the mirror.
+    expect(terminalHarness.instances[0]!.write).toHaveBeenCalledWith(
+      '\x1b[<99u\x1b[=8u',
+      expect.any(Function)
+    )
 
     // Live output keeps advancing the same mirror the forwarder reads.
     act(() => {
@@ -358,6 +365,37 @@ describe('AgentTerminalPreview', () => {
     expect(writeTerminalClipboardText).not.toHaveBeenCalled()
   })
 
+  it('hands unselected Cmd+C to a kitty app and copies a selection instead', async () => {
+    platformState.value = 'darwin'
+    render(<AgentTerminalPreview ptyId="pty-1" />)
+    await waitFor(() => expect(terminalHarness.instances).toHaveLength(1))
+    const terminal = terminalHarness.instances[0]!
+    await waitFor(() => expect(terminal.customKeyHandler).not.toBeNull())
+    const cmdC = (type: string): KeyboardEvent =>
+      new KeyboardEvent(type, { key: 'c', code: 'KeyC', metaKey: true, cancelable: true })
+
+    // A plain shell's unselected Cmd+C sends nothing.
+    expect(terminal.customKeyHandler!(cmdC('keydown'))).toBe(false)
+    expect(terminal.customKeyHandler!(cmdC('keyup'))).toBe(false)
+
+    act(() => {
+      emitData?.({ type: 'data', ptyId: 'pty-1', data: '\x1b[>1u', bytes: 5 })
+    })
+    expect(terminal.customKeyHandler!(cmdC('keydown'))).toBe(true)
+    expect(terminal.customKeyHandler!(cmdC('keyup'))).toBe(true)
+
+    // A highlight of blank cells copies no text but is still Orca's selection, as in the pane.
+    Object.assign(terminal, { hasSelection: () => true })
+    expect(terminal.customKeyHandler!(cmdC('keydown'))).toBe(false)
+    expect(terminal.customKeyHandler!(cmdC('keyup'))).toBe(false)
+    expect(writeTerminalClipboardText).not.toHaveBeenCalled()
+
+    terminal.selectionText = 'selected text'
+    expect(terminal.customKeyHandler!(cmdC('keydown'))).toBe(false)
+    expect(terminal.customKeyHandler!(cmdC('keyup'))).toBe(false)
+    expect(writeTerminalClipboardText).toHaveBeenCalledWith('selected text')
+  })
+
   it('selects all terminal text on Cmd+A and blocks xterm handling', async () => {
     platformState.value = 'darwin'
     render(<AgentTerminalPreview ptyId="pty-1" />)
diff --git a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.tsx b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.tsx
index f0360d2b795..875f13a96f4 100644
--- a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.tsx
@@ -1,5 +1,6 @@
 import { useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react'
-import { Terminal } from '@xterm/xterm'
+import { Terminal, type ITheme } from '@xterm/xterm'
+import { useShallow } from 'zustand/react/shallow'
 import '@xterm/xterm/css/xterm.css'
 import { getShortcutPlatform } from '@/lib/shortcut-platform'
 import { subscribeToTerminalUserInput } from '@/components/terminal-pane/terminal-user-input-signal'
@@ -10,7 +11,8 @@ import { replayPreviewConnectionSnapshot } from './preview-terminal-snapshot-rep
 import { useEffectiveMacOptionAsAlt } from '@/lib/keyboard-layout/use-effective-mac-option-as-alt'
 import {
   buildPreviewAppearanceOptions,
-  buildPreviewTerminalOptions
+  buildPreviewTerminalOptions,
+  previewAdvertisesKittyKeyboard
 } from './preview-terminal-options'
 import { syncPreviewTerminalLigatures } from './preview-terminal-ligatures'
 import { installPreviewTerminalCompatibility } from './preview-terminal-compatibility'
@@ -71,7 +73,7 @@ export function AgentTerminalPreview({
   const settingsRef = useRef(settings)
   const macOptionAsAltRef = useRef(macOptionAsAlt)
   const terminalInputRef = useRef(terminalInput)
-  const { terminalTheme, terminalMode } = useMemo(() => {
+  const { terminalTheme: composedTheme, terminalMode } = useMemo(() => {
     if (!settings) {
       return { terminalTheme: null, terminalMode: 'dark' as const }
     }
@@ -82,6 +84,10 @@ export function AgentTerminalPreview({
     )
     return { terminalTheme: theme, terminalMode: appearance.mode }
   }, [settings, systemPrefersDark])
+  // Settings arrive as cloned snapshots; compare theme values before reconnecting.
+  const retainTheme = useShallow((theme: ITheme | null) => theme)
+  const terminalTheme = retainTheme(composedTheme)
+  const terminalMinimumContrastRatio = settings?.terminalMinimumContrastRatio
   // A null snapshot means no serializer knows this pty (it died or was never
   // spawned this session) — say so instead of painting a silent blank terminal.
   const [ptyGone, setPtyGone] = useState(false)
@@ -96,6 +102,7 @@ export function AgentTerminalPreview({
     terminalInputRef.current = terminalInput
   }, [settings, macOptionAsAlt, terminalInput])
 
+  // Font changes retain the replay-driven fit, grid claim and input-owner reset.
   useEffect(() => {
     setPtyGone(false)
     const container = containerRef.current
@@ -110,9 +117,13 @@ export function AgentTerminalPreview({
     let disposeKeyHandler: (() => void) | null = null
     let disposeNativeCopyGutterTrim: (() => void) | null = null
     let disposeTerminalCompatibility: (() => void) | null = null
+    // Why one read: the xterm's advertisement and its mirror must never disagree.
+    const mountTerminalInput = terminalInputRef.current
     // Why: mirrors the pane's tracker — the policy needs the flags the TUI
     // negotiated, and this preview parses the same output stream the pane does.
-    const kittyKeyboardModes = new TerminalKittyKeyboardModeTracker()
+    const kittyKeyboardModes = new TerminalKittyKeyboardModeTracker({
+      kittyKeyboard: previewAdvertisesKittyKeyboard(mountTerminalInput)
+    })
     let refreshInFlight = false
     let refreshAgain = false
     let retryTimer: ReturnType<typeof setTimeout> | null = null
@@ -217,22 +228,6 @@ export function AgentTerminalPreview({
       })
     }
 
-    const installNativeCopyGutterTrim = (): void => {
-      if (!terminal) {
-        return
-      }
-      disposeNativeCopyGutterTrim = installTerminalNativeCopyGutterTrim(terminal).dispose
-    }
-
-    const installTerminalCompatibility = (): void => {
-      if (!terminal) {
-        return
-      }
-      disposeTerminalCompatibility = installPreviewTerminalCompatibility(terminal, {
-        getSettings: () => settingsRef.current
-      })
-    }
-
     const installInputRouting = (): void => {
       if (!terminal) {
         return
@@ -264,7 +259,7 @@ export function AgentTerminalPreview({
         terminal = new Terminal(
           buildPreviewTerminalOptions({
             settings: settingsRef.current,
-            terminalInput: terminalInputRef.current,
+            terminalInput: mountTerminalInput,
             macOptionIsMeta: macOptionAsAltRef.current === 'true',
             theme: terminalTheme,
             themeMode: terminalMode,
@@ -281,8 +276,10 @@ export function AgentTerminalPreview({
           return
         }
         terminalRef.current = terminal
-        installTerminalCompatibility()
-        installNativeCopyGutterTrim()
+        disposeTerminalCompatibility = installPreviewTerminalCompatibility(terminal, {
+          getSettings: () => settingsRef.current
+        })
+        disposeNativeCopyGutterTrim = installTerminalNativeCopyGutterTrim(terminal).dispose
         installInputRouting()
         installImeNativeTextBridge()
         installKeyHandler()
@@ -412,7 +409,18 @@ export function AgentTerminalPreview({
       terminal?.dispose()
       terminalRef.current = null
     }
-  }, [ptyId, terminalTheme, terminalMode])
+  }, [
+    ptyId,
+    terminalTheme,
+    terminalMode,
+    terminalMinimumContrastRatio,
+    settings?.terminalFontSize,
+    settings?.terminalFontFamily,
+    settings?.terminalFontWeight,
+    settings?.terminalFontWeightBold,
+    settings?.terminalLineHeight,
+    settings?.terminalLigatures
+  ])
 
   // Why: appearance settings must land on the open terminal, and the OS input
   // source can flip Option-as-Alt with no settings change at all. A remount
diff --git a/src/renderer/src/components/dashboard-popout/preview-terminal-key-handler.ts b/src/renderer/src/components/dashboard-popout/preview-terminal-key-handler.ts
index 1b263144a53..faaeb0048dc 100644
--- a/src/renderer/src/components/dashboard-popout/preview-terminal-key-handler.ts
+++ b/src/renderer/src/components/dashboard-popout/preview-terminal-key-handler.ts
@@ -14,6 +14,7 @@ import {
   type PreviewShortcutContext
 } from './preview-terminal-shortcuts'
 import { readTerminalClipboardSelection } from '@/components/terminal-pane/terminal-clipboard-selection-text'
+import { isAppOwnedCopyChord } from '@/components/terminal-pane/xterm-bypass-policy'
 
 /**
  * Installs the preview terminal's ONE custom key handler (xterm allows a single
@@ -110,6 +111,15 @@ export function installPreviewTerminalKeyHandler(args: {
     nativeOnlyShortcutTracker.prepareKeyDown(event)
     const keybindings = useAppStore.getState().keybindings
     if (keybindingMatchesAction('terminal.copySelection', event, platform, keybindings)) {
+      if (
+        isAppOwnedCopyChord(event, {
+          isMac: platform === 'darwin',
+          hasSelection: terminal.hasSelection(),
+          kittyKeyboardFlags: args.getShortcutContext().getKittyKeyboardFlags()
+        })
+      ) {
+        return true
+      }
       const selection = readTerminalClipboardSelection(terminal)
       if (
         !selection &&
diff --git a/src/renderer/src/components/dashboard-popout/preview-terminal-options.ts b/src/renderer/src/components/dashboard-popout/preview-terminal-options.ts
index c27f085029d..3bf324e385d 100644
--- a/src/renderer/src/components/dashboard-popout/preview-terminal-options.ts
+++ b/src/renderer/src/components/dashboard-popout/preview-terminal-options.ts
@@ -45,6 +45,13 @@ export function buildPreviewAppearanceOptions(
   }
 }
 
+// Why: local ConPTY CLIs read the advertisement but can't decode CSI-u (#2434); mirror the pane's withhold.
+export function previewAdvertisesKittyKeyboard(
+  terminalInput: DashboardCardTerminalInput | null
+): boolean {
+  return !terminalInput || terminalInput.kittyKeyboardAdvertised
+}
+
 /**
  * Full option set for the preview's xterm: the same defaults, user appearance,
  * and host compatibility flags a pane resolves, so the agent's TUI negotiates
@@ -65,10 +72,9 @@ export function buildPreviewTerminalOptions(args: {
     ...(args.terminalInput?.localWindowsConpty
       ? buildLocalConptyTerminalOptions(args.terminalInput.osRelease)
       : {}),
-    // Why: local ConPTY CLIs read the advertisement but can't decode CSI-u (#2434); mirror the pane's withhold.
-    ...(args.terminalInput && !args.terminalInput.kittyKeyboardAdvertised
-      ? { vtExtensions: { kittyKeyboard: false } }
-      : {})
+    ...(previewAdvertisesKittyKeyboard(args.terminalInput)
+      ? {}
+      : { vtExtensions: { kittyKeyboard: false } })
   }
   return {
     ...buildDefaultTerminalOptions(),
diff --git a/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts b/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts
index 3e288626259..f3b3ed4f800 100644
--- a/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts
+++ b/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts
@@ -110,7 +110,7 @@ describe('replayPreviewConnectionSnapshot', () => {
     expect(modes.snapshotFlags).toBe(0)
   })
 
-  it('writes scrollback, frame, escape tail, then replay, in that order', () => {
+  it('writes scrollback, frame, kitty restore, escape tail, then replay, in that order', () => {
     const { written } = apply(
       {
         scrollbackAnsi: 'history',
@@ -119,6 +119,6 @@ describe('replayPreviewConnectionSnapshot', () => {
       },
       [{ data: 'tail', mode: 'live' }]
     )
-    expect(written).toEqual(['history', 'frame', '\x1b[', 'tail'])
+    expect(written).toEqual(['history', 'frame', '\x1b[<99u', '\x1b[', 'tail'])
   })
 })
diff --git a/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.ts b/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.ts
index 43d4333cc17..9e684353eb7 100644
--- a/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.ts
+++ b/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.ts
@@ -1,5 +1,6 @@
 import type { TerminalKittyKeyboardModeTracker } from '../../../../shared/terminal-kitty-keyboard-mode-tracker'
 import { parseTerminalKittyKeyboardFlags } from '../../../../shared/terminal-kitty-keyboard-flags'
+import { buildKittyKeyboardRestore } from '../../../../shared/terminal-mode-reset-profiles'
 import type {
   TerminalPreviewReplayChunk,
   TerminalPreviewSnapshot
@@ -7,7 +8,7 @@ import type {
 
 /**
  * Apply snapshot + buffered replay, restoring proven kitty flags after the
- * snapshot scan (snapshot ANSI omits kitty pushes). Synchronous so no browser
+ * snapshot bytes (snapshot ANSI omits kitty pushes). Synchronous so no browser
  * event observes the temporary reset.
  */
 export function replayPreviewConnectionSnapshot(args: {
@@ -29,12 +30,11 @@ export function replayPreviewConnectionSnapshot(args: {
   if (snapshot.data) {
     args.write(snapshot.data, false)
   }
+  // Why as bytes: the popout xterm must parse the same restore its mirror scans.
+  args.write(buildKittyKeyboardRestore(provenFlags), false)
   if (snapshot.pendingEscapeTailAnsi) {
     args.write(snapshot.pendingEscapeTailAnsi, false)
   }
-  if (provenFlags !== undefined) {
-    kittyKeyboardModes.restoreSnapshotFlags(provenFlags)
-  }
   for (const chunk of args.replay) {
     args.write(chunk.data, chunk.mode === 'live')
   }
diff --git a/src/renderer/src/components/dashboard/DashboardAgentChildDisclosure.test.tsx b/src/renderer/src/components/dashboard/DashboardAgentChildDisclosure.test.tsx
new file mode 100644
index 00000000000..6d0994eb760
--- /dev/null
+++ b/src/renderer/src/components/dashboard/DashboardAgentChildDisclosure.test.tsx
@@ -0,0 +1,157 @@
+/** @vitest-environment happy-dom */
+import { fireEvent, render, screen, cleanup } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { CompactAgentRow } from '../sidebar/worktree-card-compact-agent-row'
+import { TooltipProvider } from '../ui/tooltip'
+import DashboardAgentRow from './DashboardAgentRow'
+import type { DashboardAgentRow as AgentRow } from './useDashboardData'
+import { DashboardAgentChildDisclosure } from './DashboardAgentChildDisclosure'
+
+vi.mock('./use-agent-row-conversation-name', () => ({ useAgentRowConversationName: () => null }))
+vi.mock('../sidebar/CacheTimer', () => ({
+  default: () => null,
+  usePromptCacheCountdownForPane: () => null
+}))
+
+afterEach(cleanup)
+
+const agent: AgentRow = {
+  paneKey: 'tab:leaf',
+  agentType: 'claude',
+  state: 'working',
+  startedAt: 60000,
+  entry: {
+    paneKey: 'tab:leaf',
+    state: 'working',
+    prompt: 'Review the change',
+    updatedAt: 60000,
+    stateStartedAt: 60000,
+    stateHistory: []
+  },
+  tab: {
+    id: 'tab',
+    ptyId: null,
+    worktreeId: 'workspace',
+    title: 'Agent',
+    customTitle: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 1
+  }
+}
+
+describe('agent child disclosure', () => {
+  it('toggles children without activating the surrounding agent or workspace', () => {
+    const activate = vi.fn()
+    const toggle = vi.fn()
+    const pointerDown = vi.fn()
+    const keyDown = vi.fn()
+    render(
+      <div onClick={activate} onPointerDown={pointerDown} onKeyDown={keyDown}>
+        <DashboardAgentChildDisclosure
+          childAgentCount={2}
+          childAgentsExpanded={false}
+          onToggleChildAgents={toggle}
+          timestamp="5m"
+        />
+      </div>
+    )
+    const button = screen.getByRole('button', { name: 'Show 2 child agents' })
+    fireEvent.pointerDown(button)
+    fireEvent.keyDown(button, { key: 'Enter' })
+    fireEvent.keyDown(button, { key: ' ' })
+    fireEvent.click(button)
+    expect(toggle).toHaveBeenCalledTimes(1)
+    expect(activate).not.toHaveBeenCalled()
+    expect(pointerDown).not.toHaveBeenCalled()
+    expect(keyDown).not.toHaveBeenCalled()
+  })
+
+  it('updates the accessible action and retains the timestamp when expanded', () => {
+    const toggle = vi.fn()
+    const { rerender } = render(
+      <DashboardAgentChildDisclosure
+        childAgentCount={1}
+        childAgentsExpanded={false}
+        onToggleChildAgents={toggle}
+        timestamp="5m"
+      />
+    )
+    expect(
+      screen.getByRole('button', { name: 'Show 1 child agent' }).getAttribute('aria-expanded')
+    ).toBe('false')
+    rerender(
+      <DashboardAgentChildDisclosure
+        childAgentCount={1}
+        childAgentsExpanded
+        onToggleChildAgents={toggle}
+        timestamp="5m"
+      />
+    )
+    expect(
+      screen.getByRole('button', { name: 'Hide 1 child agent' }).getAttribute('aria-expanded')
+    ).toBe('true')
+    expect(screen.getByText('5m')).toBeTruthy()
+  })
+
+  it('does not offer a disclosure without children or a toggle action', () => {
+    const { rerender } = render(
+      <DashboardAgentChildDisclosure
+        childAgentCount={0}
+        childAgentsExpanded={false}
+        onToggleChildAgents={vi.fn()}
+      />
+    )
+    expect(screen.queryByRole('button')).toBeNull()
+    rerender(<DashboardAgentChildDisclosure childAgentCount={2} childAgentsExpanded={false} />)
+    expect(screen.queryByRole('button')).toBeNull()
+  })
+})
+
+describe.each(['compact', 'full'] as const)('%s row disclosure actions', (mode) => {
+  it.each([undefined, 'eligible'] as const)(
+    'keeps child expansion separate from row actions in %s send mode',
+    (sendTargetStatus) => {
+      const onActivate = vi.fn(),
+        onSendTargetClick = vi.fn(),
+        onDismiss = vi.fn(),
+        onToggleChildAgents = vi.fn()
+      const props = {
+        agent,
+        now: 120000,
+        childAgentCount: 2,
+        childAgentsExpanded: false,
+        onToggleChildAgents,
+        onActivate,
+        sendTargetStatus,
+        onSendTargetClick
+      }
+      render(
+        <TooltipProvider>
+          {mode === 'compact' ? (
+            <CompactAgentRow {...props} />
+          ) : (
+            <DashboardAgentRow {...props} onDismiss={onDismiss} hideExpand />
+          )}
+        </TooltipProvider>
+      )
+      fireEvent.click(screen.getByRole('button', { name: 'Show 2 child agents' }))
+      expect(onToggleChildAgents).toHaveBeenCalledTimes(1)
+      expect(onActivate).not.toHaveBeenCalled()
+      expect(onSendTargetClick).not.toHaveBeenCalled()
+      expect(onDismiss).not.toHaveBeenCalled()
+      fireEvent.click(screen.getByText('Review the change'))
+      if (sendTargetStatus) {
+        expect(onSendTargetClick).toHaveBeenCalledWith(agent.paneKey)
+        expect(onActivate).not.toHaveBeenCalled()
+      } else {
+        expect(onActivate).toHaveBeenCalledWith(agent.tab.id, agent.paneKey)
+        if (mode === 'full') {
+          fireEvent.click(screen.getByRole('button', { name: 'Dismiss agent' }))
+          expect(onDismiss).toHaveBeenCalledWith(agent.paneKey)
+          expect(onActivate).toHaveBeenCalledTimes(1)
+        }
+      }
+    }
+  )
+})
diff --git a/src/renderer/src/components/dashboard/DashboardAgentChildDisclosure.tsx b/src/renderer/src/components/dashboard/DashboardAgentChildDisclosure.tsx
index fb8e45b4216..4e225a287dd 100644
--- a/src/renderer/src/components/dashboard/DashboardAgentChildDisclosure.tsx
+++ b/src/renderer/src/components/dashboard/DashboardAgentChildDisclosure.tsx
@@ -1,18 +1,21 @@
 import React, { useCallback } from 'react'
-import { ChevronRight } from 'lucide-react'
+import { ChevronDown } from 'lucide-react'
 import { cn } from '@/lib/utils'
+import { Button } from '@/components/ui/button'
 import { translate } from '@/i18n/i18n'
 
 type Props = {
   childAgentCount?: number
   childAgentsExpanded: boolean
   onToggleChildAgents?: () => void
+  timestamp?: React.ReactNode
 }
 
 export function DashboardAgentChildDisclosure({
   childAgentCount,
   childAgentsExpanded,
-  onToggleChildAgents
+  onToggleChildAgents,
+  timestamp
 }: Props) {
   const hasChildDisclosure =
     typeof childAgentCount === 'number' &&
@@ -40,29 +43,46 @@ export function DashboardAgentChildDisclosure({
   }
 
   return (
-    <button
-      type="button"
-      onClick={handleToggleChildren}
-      onMouseDown={stopMouseDown}
-      onKeyDown={stopKeyDown}
-      className="-ml-0.5 inline-flex size-4 shrink-0 items-center justify-center rounded-sm border border-sidebar-border/80 bg-sidebar text-foreground/80 shadow-xs hover:bg-sidebar-accent hover:text-foreground"
-      aria-label={translate(
-        'auto.components.dashboard.DashboardAgentChildDisclosure.1b57ce9fa4',
-        '{{value0}} {{value1}} child {{value2}}',
-        {
-          value0: childAgentsExpanded ? 'Hide' : 'Show',
-          value1: childAgentCount,
-          value2: childAgentCount === 1 ? 'agent' : 'agents'
-        }
-      )}
-      aria-expanded={childAgentsExpanded}
+    <span
+      className="agent-child-disclosure relative inline-grid h-5 min-w-5 shrink-0 items-center justify-items-end"
+      data-expanded={childAgentsExpanded}
     >
-      <ChevronRight
-        className={cn(
-          'size-3 transition-transform duration-150',
-          childAgentsExpanded && 'rotate-90'
+      <span
+        className="agent-child-disclosure-time col-start-1 row-start-1 pointer-events-none"
+        aria-hidden
+      >
+        {timestamp}
+      </span>
+      {/* Why: align the 12px icon with adjacent row icons while keeping its 24px hit target. */}
+      <Button
+        variant="ghost"
+        size="icon-xs"
+        type="button"
+        onClick={handleToggleChildren}
+        onMouseDown={stopMouseDown}
+        onPointerDown={(event) => event.stopPropagation()}
+        onKeyDown={stopKeyDown}
+        data-agent-child-disclosure-button=""
+        className="col-start-1 row-start-1 -mr-1.5"
+        aria-label={translate(
+          'auto.components.dashboard.DashboardAgentChildDisclosure.1b57ce9fa4',
+          '{{value0}} {{value1}} child {{value2}}',
+          {
+            value0: childAgentsExpanded ? 'Hide' : 'Show',
+            value1: childAgentCount,
+            value2: childAgentCount === 1 ? 'agent' : 'agents'
+          }
         )}
-      />
-    </button>
+        aria-expanded={childAgentsExpanded}
+      >
+        <ChevronDown
+          className={cn(
+            'size-3 transition-transform duration-150',
+            childAgentsExpanded && 'rotate-180'
+          )}
+          aria-hidden
+        />
+      </Button>
+    </span>
   )
 }
diff --git a/src/renderer/src/components/dashboard/DashboardAgentRow.tsx b/src/renderer/src/components/dashboard/DashboardAgentRow.tsx
index fb80712e65f..426fe8b57aa 100644
--- a/src/renderer/src/components/dashboard/DashboardAgentRow.tsx
+++ b/src/renderer/src/components/dashboard/DashboardAgentRow.tsx
@@ -4,17 +4,21 @@ import { AgentStateDot, agentStateLabel, type AgentDotState } from '@/components
 import { AgentIcon } from '@/lib/agent-catalog'
 import { agentTypeToIconAgent, formatAgentTypeLabel } from '@/lib/agent-status'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
-import { DashboardAgentChildDisclosure } from './DashboardAgentChildDisclosure'
 import { DashboardAgentRowMessage } from './DashboardAgentRowMessage'
 import { DashboardAgentRowTrailingControls } from './DashboardAgentRowTrailingControls'
 import { DashboardAgentRowToolStep } from './DashboardAgentRowToolStep'
 import { showsAgentToolPreview } from '@/lib/agent-row-tool-preview'
 import { agentNoUpdateLabel, formatCompactDuration } from '@/lib/agent-row-decay-state'
-import { agentRowDotState as asDotState } from '@/lib/agent-row-dot-state'
+import { agentRowDisplayDotState, agentRowDotState as asDotState } from '@/lib/agent-row-dot-state'
+import { agentVerdictDisplayMark } from '../../../../shared/agent-main-agent-verdict'
 import type { DashboardAgentRow as DashboardAgentRowData } from './useDashboardData'
 import { getAgentRowPrimaryText } from '@/lib/agent-row-primary-text'
 import { useAgentRowConversationName } from './use-agent-row-conversation-name'
 import { lastEnteredDoneAt } from './agent-finished-timestamp'
+import {
+  agentChildRowMessageLine,
+  agentChildRowNoUpdateLabel
+} from '@/components/agent-child-row-text'
 
 function formatTimeAgo(ts: number, now: number): string {
   const delta = now - ts
@@ -24,19 +28,24 @@ function formatTimeAgo(ts: number, now: number): string {
   return `${formatCompactDuration(delta)} ago`
 }
 
+// A child row's silence is the model's, on the clock its compact row and the strip read.
+function rowNoUpdateLabel(agent: DashboardAgentRowData, now: number): string {
+  return agent.childRow
+    ? agentChildRowNoUpdateLabel(agent.childRow, now)
+    : agentNoUpdateLabel(agent.entry, now)
+}
+
 function stateDotTooltipLabel(
   agent: DashboardAgentRowData,
   dotState: AgentDotState,
   now: number
 ): string {
-  if (agent.entry.interrupted === true) {
+  if (dotState === 'interrupted') {
     return 'Interrupted by user'
   }
   // Why: report the observation, not a verdict on the agent — the elapsed gap is what
   // lets the user apply context Orca has no way to know (a long build, a slow download).
-  return dotState === 'unverifiable'
-    ? agentNoUpdateLabel(agent.entry, now)
-    : agentStateLabel(dotState)
+  return dotState === 'unverifiable' ? rowNoUpdateLabel(agent, now) : agentStateLabel(dotState)
 }
 
 type Props = {
@@ -55,12 +64,10 @@ type Props = {
   hideExpand?: boolean
   /** Reuse the row's hover tint to show the focused terminal pane's agent. */
   isFocusedPane?: boolean
-  // Why: inline-card orchestration rows fold children under a leading chevron.
+  // Why: inline-card orchestration rows can fold their child agents.
   childAgentCount?: number
   childAgentsExpanded?: boolean
   onToggleChildAgents?: () => void
-  // Why: a top-level chevron hangs in the card gutter so the state dot keeps the column of chevron-less rows.
-  disclosureInGutter?: boolean
   // Why: chevron indentation replaces fixed-offset lineage connector art.
   hideLineageConnectors?: boolean
   // Why: send-popover target mode makes row clicks send/no-op instead of navigating.
@@ -82,7 +89,6 @@ const DashboardAgentRow = React.memo(function DashboardAgentRow({
   childAgentCount,
   childAgentsExpanded = false,
   onToggleChildAgents,
-  disclosureInGutter = false,
   hideLineageConnectors = false,
   sendTargetStatus,
   sendTargetDisabledReason,
@@ -130,7 +136,11 @@ const DashboardAgentRow = React.memo(function DashboardAgentRow({
   const conversationName = useAgentRowConversationName(agent)
   const prompt = conversationName ?? getAgentRowPrimaryText(agent.entry)
   // Why: prompt is '' when unknown, so fall back to the state label to keep the row labeled.
-  const displayLabel = prompt || agentStateLabel(asDotState(agent.state, agent.entry.workingMode))
+  const displayLabel =
+    prompt ||
+    agentStateLabel(
+      agent.childRow?.displayState ?? asDotState(agent.state, agent.entry.workingMode)
+    )
   const model = agent.entry.model?.trim() ?? ''
   const isMonitoring = agent.state === 'working' && agent.entry.workingMode === 'monitoring'
   const isWorking = agent.state === 'working' && !isMonitoring
@@ -140,8 +150,11 @@ const DashboardAgentRow = React.memo(function DashboardAgentRow({
   const showsTool = showsAgentToolPreview(agent.state) && !isMonitoring
   const toolName = showsTool ? (agent.entry.toolName?.trim() ?? '') : ''
   const toolInput = showsTool ? (agent.entry.toolInput?.trim() ?? '') : ''
-  const lastAssistantMessage = agent.entry.lastAssistantMessage?.trim() ?? ''
-  const isInterrupted = agent.entry.interrupted === true
+  // Why: a child row's message line is the model's, so a child that ended without an outcome says so.
+  const lastAssistantMessage = agent.childRow
+    ? agentChildRowMessageLine(agent.childRow)
+    : (agent.entry.lastAssistantMessage?.trim() ?? '')
+  const isInterrupted = agentVerdictDisplayMark(agent.entry) === 'interrupted'
   const lineage = agent.lineage
   const isLineageChild = lineage?.depth === 1
   const lineageChildCount = lineage?.childCount ?? 0
@@ -152,14 +165,13 @@ const DashboardAgentRow = React.memo(function DashboardAgentRow({
           lineageChildCount === 1 ? 'agent' : 'agents'
         }`
       : [formatAgentTypeLabel(agent.agentType), model].filter(Boolean).join(' · ')
-  // Why: interrupted is a terminal outcome, so surface it in the leading state dot.
-  const dotState: AgentDotState = isInterrupted
-    ? 'interrupted'
-    : asDotState(agent.state, agent.entry.workingMode)
+  // Why: a stop or a failure is a terminal outcome, so surface it in the leading state dot; a
+  // failure does so even while subagents still run.
+  const dotState: AgentDotState = agentRowDisplayDotState(agent)
   const dotTooltipLabel = stateDotTooltipLabel(agent, dotState, now)
   // Why: the elapsed gap is the whole content of an `unverifiable` row, so it rides the
   // row's own timestamp slot rather than hiding in a hover tooltip.
-  const noUpdateLabel = dotState === 'unverifiable' ? agentNoUpdateLabel(agent.entry, now) : null
+  const noUpdateLabel = dotState === 'unverifiable' ? rowNoUpdateLabel(agent, now) : null
 
   // Why: always show the chevron so the row's right edge doesn't flicker as content grows/shrinks.
 
@@ -183,8 +195,7 @@ const DashboardAgentRow = React.memo(function DashboardAgentRow({
       onClick={handleActivate}
       className={cn(
         // Why: named group scopes the X-reveal to this row, not every row in the card.
-        'group/agent-row relative flex flex-col py-1',
-        hasChildDisclosure && disclosureInGutter ? '-ml-7' : '-ml-2',
+        'agent-disclosure-row group/agent-row relative -ml-2 flex flex-col py-1',
         isLineageChild ? 'pl-5 pr-2' : 'px-2',
         // Why: hover wash stays softer than the enclosing card's highlight.
         'cursor-pointer rounded-sm worktree-agent-row-hover',
@@ -227,11 +238,6 @@ const DashboardAgentRow = React.memo(function DashboardAgentRow({
         </span>
       ) : null}
       <div className="flex items-center gap-1.5">
-        <DashboardAgentChildDisclosure
-          childAgentCount={childAgentCount}
-          childAgentsExpanded={childAgentsExpanded}
-          onToggleChildAgents={onToggleChildAgents}
-        />
         {/* Why: state dot sits in the leading gutter so the eye can scan one column for row state. */}
         <Tooltip>
           <TooltipTrigger asChild>
@@ -286,6 +292,9 @@ const DashboardAgentRow = React.memo(function DashboardAgentRow({
         <DashboardAgentRowTrailingControls
           paneKey={agent.paneKey}
           relativeTimestamp={relativeTimestamp}
+          childAgentCount={childAgentCount}
+          childAgentsExpanded={childAgentsExpanded}
+          onToggleChildAgents={onToggleChildAgents}
           expanded={expanded}
           hideExpand={hideExpand}
           hideDismiss={agent.rowSource === 'subagent'}
diff --git a/src/renderer/src/components/dashboard/DashboardAgentRowTrailingControls.tsx b/src/renderer/src/components/dashboard/DashboardAgentRowTrailingControls.tsx
index f194abbe508..62b6ff2589d 100644
--- a/src/renderer/src/components/dashboard/DashboardAgentRowTrailingControls.tsx
+++ b/src/renderer/src/components/dashboard/DashboardAgentRowTrailingControls.tsx
@@ -2,8 +2,12 @@ import React, { useCallback } from 'react'
 import { ChevronDown, Send, X } from 'lucide-react'
 import { translate } from '@/i18n/i18n'
 import { cn } from '@/lib/utils'
+import { DashboardAgentChildDisclosure } from './DashboardAgentChildDisclosure'
 
 type DashboardAgentRowTrailingControlsProps = {
+  childAgentCount?: number
+  childAgentsExpanded?: boolean
+  onToggleChildAgents?: () => void
   paneKey: string
   relativeTimestamp: string | null
   expanded: boolean
@@ -18,6 +22,9 @@ type DashboardAgentRowTrailingControlsProps = {
 }
 
 export function DashboardAgentRowTrailingControls({
+  childAgentCount,
+  childAgentsExpanded = false,
+  onToggleChildAgents,
   paneKey,
   relativeTimestamp,
   expanded,
@@ -64,8 +71,15 @@ export function DashboardAgentRowTrailingControls({
     [onSendTargetClick, paneKey, sendTargetStatus]
   )
 
+  const hasChildDisclosure = Boolean(childAgentCount && onToggleChildAgents)
+
   return (
-    <span className="relative ml-auto flex h-3.5 w-12 shrink-0 items-center justify-end">
+    <span
+      className={cn(
+        'relative ml-auto flex shrink-0 items-center justify-end',
+        hasChildDisclosure ? 'h-5 gap-1' : 'h-3.5 w-12'
+      )}
+    >
       {(sendTargetStatus === 'eligible' || sendTargetStatus === 'sending') && (
         <button
           type="button"
@@ -75,6 +89,7 @@ export function DashboardAgentRowTrailingControls({
           disabled={sendTargetStatus === 'sending'}
           className={cn(
             'worktree-agent-send-target-button absolute right-0 top-1/2 z-10 inline-flex h-5 -translate-y-1/2 items-center gap-1 rounded-md border px-1.5 text-[10px] font-medium leading-none transition-[background-color,border-color,color,opacity]',
+            hasChildDisclosure && 'static translate-y-0',
             sendTargetStatus === 'sending' && 'cursor-progress opacity-75'
           )}
           aria-label={translate(
@@ -90,7 +105,7 @@ export function DashboardAgentRowTrailingControls({
           <span>{translate('auto.components.dashboard.DashboardAgentRow.912e136cd9', 'Send')}</span>
         </button>
       )}
-      {!sendTargetStatus && hideDismiss && relativeTimestamp !== null && (
+      {!hasChildDisclosure && !sendTargetStatus && hideDismiss && relativeTimestamp !== null && (
         <span
           className="pointer-events-none shrink-0 text-[10px] leading-none text-muted-foreground/60"
           aria-hidden
@@ -100,7 +115,7 @@ export function DashboardAgentRowTrailingControls({
       )}
       {/* Why: timestamp and dismiss-X share one slot. On no-hover devices the X
           is visible by default, so the timestamp must yield there too. */}
-      {!sendTargetStatus && !hideDismiss && relativeTimestamp !== null && (
+      {!hasChildDisclosure && !sendTargetStatus && !hideDismiss && relativeTimestamp !== null && (
         <span className="relative grid grid-cols-1 grid-rows-1 shrink-0 items-center justify-items-end">
           <span
             className={cn(
@@ -132,7 +147,7 @@ export function DashboardAgentRowTrailingControls({
           </button>
         </span>
       )}
-      {!sendTargetStatus && !hideDismiss && relativeTimestamp === null && (
+      {!sendTargetStatus && !hideDismiss && (hasChildDisclosure || relativeTimestamp === null) && (
         <button
           type="button"
           onClick={handleDismiss}
@@ -152,6 +167,18 @@ export function DashboardAgentRowTrailingControls({
           <X className="size-3.5" />
         </button>
       )}
+      {hasChildDisclosure && (
+        <DashboardAgentChildDisclosure
+          childAgentCount={childAgentCount}
+          childAgentsExpanded={childAgentsExpanded}
+          onToggleChildAgents={onToggleChildAgents}
+          timestamp={
+            <span className="text-[10px] leading-none text-muted-foreground/60">
+              {relativeTimestamp}
+            </span>
+          }
+        />
+      )}
       {!hideExpand && (
         <button
           type="button"
diff --git a/src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts b/src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts
index 91b445dd78f..b5ee4ae239c 100644
--- a/src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts
+++ b/src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts
@@ -51,6 +51,47 @@ describe('lastEnteredDoneAt shares the Smart Sort completion clock', () => {
     expect(lastEnteredDoneAt(row(entry))).toBe(2_000)
     expect(agentEntryCompletionAt(entry)).toBeNull()
   })
+
+  it('dates a failed turn as a completion, and a stopped one only for display', () => {
+    const verdictDone = (outcome: 'failure' | 'cancellation') =>
+      doneEntry({
+        stateStartedAt: 2_000,
+        mainAgent: { state: 'done', outcome, stateStartedAt: 2_000 }
+      })
+    expect(agentEntryCompletionAt(verdictDone('failure'))).toBe(2_000)
+    expect(lastEnteredDoneAt(row(verdictDone('failure')))).toBe(2_000)
+    expect(agentEntryCompletionAt(verdictDone('cancellation'))).toBeNull()
+    expect(lastEnteredDoneAt(row(verdictDone('cancellation')))).toBe(2_000)
+  })
+
+  it('dates a main agent that failed while its subagents run by when it failed', () => {
+    const held = (outcome: 'failure' | 'cancellation') =>
+      doneEntry({
+        state: 'working',
+        stateStartedAt: 3_000,
+        mainAgent: { state: 'done', outcome, stateStartedAt: 2_500 }
+      })
+    expect(agentEntryCompletionAt(held('failure'))).toBeNull()
+    expect(lastEnteredDoneAt(row(held('failure')))).toBe(2_500)
+    expect(lastEnteredDoneAt(row(held('cancellation')))).toBeNull()
+  })
+
+  it('reads the verdict history carries when a boundary displaced the completion', () => {
+    const history = { state: 'done' as const, prompt: '', startedAt: 1_500 }
+    const boundary = (outcome?: 'failure' | 'cancellation') =>
+      doneEntry({
+        sessionBoundary: true,
+        stateHistory: [
+          {
+            ...history,
+            ...(outcome ? { mainAgent: { state: 'done', outcome, stateStartedAt: 1_500 } } : {})
+          }
+        ]
+      })
+    expect(agentEntryCompletionAt(boundary())).toBe(1_500)
+    expect(agentEntryCompletionAt(boundary('failure'))).toBe(1_500)
+    expect(agentEntryCompletionAt(boundary('cancellation'))).toBeNull()
+  })
 })
 
 describe('lastEnteredDoneAt subagent rows', () => {
diff --git a/src/renderer/src/components/dashboard/agent-finished-timestamp.ts b/src/renderer/src/components/dashboard/agent-finished-timestamp.ts
index fe101862957..d176ae0a879 100644
--- a/src/renderer/src/components/dashboard/agent-finished-timestamp.ts
+++ b/src/renderer/src/components/dashboard/agent-finished-timestamp.ts
@@ -1,4 +1,8 @@
 import { agentEntryCompletionAt } from '../../../../shared/agent-completion-time'
+import {
+  agentTurnStoppedByUser,
+  agentVerdictDisplayMark
+} from '../../../../shared/agent-main-agent-verdict'
 import type { DashboardAgentRow } from './useDashboardData'
 
 /**
@@ -8,11 +12,11 @@ import type { DashboardAgentRow } from './useDashboardData'
  * agent reads "N since it finished", an active one falls through to its start.
  */
 export function lastEnteredDoneAt(
-  agent: Pick<DashboardAgentRow, 'rowSource' | 'state' | 'entry'>
+  agent: Pick<DashboardAgentRow, 'rowSource' | 'state' | 'entry' | 'childRow'>
 ): number | null {
-  // Why: a subagent's synthetic entry may say done while its row is idle or unverifiable.
-  if (agent.rowSource === 'subagent' && agent.state !== 'done') {
-    return null
+  // Why: a subagent has no turns; it ended when its host settled it, if it has.
+  if (agent.rowSource === 'subagent') {
+    return agent.childRow?.settledAt ?? null
   }
   const entry = agent.entry
   // Why: same primitive Smart Sort ranks on, so the displayed age and Done eligibility share a clock.
@@ -22,10 +26,14 @@ export function lastEnteredDoneAt(
   if (completedAt !== null) {
     return completedAt
   }
-  // Why: display is looser than ranking — an interrupted turn still shows when it stopped.
-  if (entry.state === 'done' && entry.interrupted === true && entry.sessionBoundary !== true) {
+  // Why: display is looser than ranking — a stopped turn still shows when it ended.
+  if (entry.state === 'done' && agentTurnStoppedByUser(entry) && entry.sessionBoundary !== true) {
     return entry.stateStartedAt
   }
+  // Why: a failed main agent reads failed while its subagents run, so it shows when it failed.
+  if (entry.state !== 'done' && entry.mainAgent && agentVerdictDisplayMark(entry) === 'failed') {
+    return entry.mainAgent.stateStartedAt
+  }
   for (let i = (entry.stateHistory?.length ?? 0) - 1; i >= 0; i--) {
     if (entry.stateHistory[i].state === 'done') {
       return entry.stateHistory[i].startedAt
diff --git a/src/renderer/src/components/dashboard/agent-row-lineage-model.test.ts b/src/renderer/src/components/dashboard/agent-row-lineage-model.test.ts
index 016d1503e76..15a3c4a8d83 100644
--- a/src/renderer/src/components/dashboard/agent-row-lineage-model.test.ts
+++ b/src/renderer/src/components/dashboard/agent-row-lineage-model.test.ts
@@ -162,20 +162,20 @@ describe('buildAgentRowLineageTree', () => {
     )
     const iterate = Set.prototype[Symbol.iterator]
     let visitedSetEntries = 0
-    const spy = vi
-      .spyOn(Set.prototype, Symbol.iterator)
-      .mockImplementation(function (this: Set<unknown>) {
-        const iterator = iterate.call(this)
-        const next = iterator.next.bind(iterator)
-        iterator.next = () => {
-          const result = next()
-          if (!result.done) {
-            visitedSetEntries += 1
-          }
-          return result
+    const spy = vi.spyOn(Set.prototype, Symbol.iterator).mockImplementation(function (
+      this: Set<unknown>
+    ) {
+      const iterator = iterate.call(this)
+      const next = iterator.next.bind(iterator)
+      iterator.next = () => {
+        const result = next()
+        if (!result.done) {
+          visitedSetEntries += 1
         }
-        return iterator
-      })
+        return result
+      }
+      return iterator
+    })
     let tree: ReturnType<typeof buildAgentRowLineageTree>
     try {
       tree = buildAgentRowLineageTree(rows)
diff --git a/src/renderer/src/components/dashboard/useDashboardData.ts b/src/renderer/src/components/dashboard/useDashboardData.ts
index 02d4010edcd..7ca391ef234 100644
--- a/src/renderer/src/components/dashboard/useDashboardData.ts
+++ b/src/renderer/src/components/dashboard/useDashboardData.ts
@@ -1,6 +1,7 @@
 import type { AgentStatusEntry, AgentType } from '../../../../shared/agent-status-types'
 import type { AgentRowState } from '@/lib/agent-row-decay-state'
 import type { TerminalTab } from '../../../../shared/terminal-tab-types'
+import type { AgentChildRowModel } from '../../../../shared/agent-child-row-model'
 
 export type DashboardAgentRow = {
   /** Row identity. For 'subagent' rows this is a synthetic key (the child has
@@ -18,6 +19,8 @@ export type DashboardAgentRow = {
    *  stateHistory entry, falling back to updatedAt when no history exists yet.
    *  Used to sort agents by when they started. */
   startedAt: number
+  /** Subagent rows only: what the row shows, decided once for every surface. */
+  childRow?: AgentChildRowModel
   lineage?: {
     depth: 0 | 1
     parentPaneKey?: string
diff --git a/src/renderer/src/components/dashboard/useRetainedAgents.test.ts b/src/renderer/src/components/dashboard/useRetainedAgents.test.ts
index d1440f4e5ef..97640f2c2ae 100644
--- a/src/renderer/src/components/dashboard/useRetainedAgents.test.ts
+++ b/src/renderer/src/components/dashboard/useRetainedAgents.test.ts
@@ -68,7 +68,12 @@ function makeTab(overrides: Partial<TerminalTab> & { id: string }): TerminalTab
   }
 }
 
-function makeAgentRow(args: { paneKey: string; state: AgentStatusState; interrupted?: boolean }) {
+function makeAgentRow(args: {
+  paneKey: string
+  state: AgentStatusState
+  interrupted?: boolean
+  mainAgent?: AgentStatusEntry['mainAgent']
+}) {
   const entry: AgentStatusEntry = {
     state: args.state,
     prompt: 'Fix it',
@@ -78,7 +83,8 @@ function makeAgentRow(args: { paneKey: string; state: AgentStatusState; interrup
     terminalTitle: 'Claude',
     stateHistory: [],
     agentType: 'claude',
-    interrupted: args.interrupted
+    interrupted: args.interrupted,
+    mainAgent: args.mainAgent
   }
 
   return {
@@ -134,6 +140,34 @@ describe('collectRetainedAgentsOnDisappear', () => {
     expect(result.toRetain).toEqual([])
   })
 
+  it('retains a failed done row so the failure stays visible, but not a cancelled one', () => {
+    const retainedFor = (outcome: 'failure' | 'cancellation') =>
+      collectRetainedAgentsOnDisappear({
+        previousAgents: new Map([
+          [
+            'tab-1:1',
+            {
+              row: makeAgentRow({
+                paneKey: 'tab-1:1',
+                state: 'done',
+                mainAgent: { state: 'done', outcome, stateStartedAt: 100 }
+              }),
+              worktreeId: 'wt-1'
+            }
+          ]
+        ]),
+        currentAgents: new Map(),
+        retainedAgentsByPaneKey: {},
+        retentionSuppressedPaneKeys: {},
+        recentlyClosedAgentStatusTabIds: {},
+        recentlyRetiredAgentStatusPaneKeys: {}
+      }).toRetain
+
+    expect(retainedFor('failure')).toHaveLength(1)
+    expect(retainedFor('failure')[0]?.entry.mainAgent?.outcome).toBe('failure')
+    expect(retainedFor('cancellation')).toEqual([])
+  })
+
   it('refreshes the retained snapshot when a reused paneKey starts a newer run', () => {
     // Why: a reused paneKey (same tab+pane, fresh agent start after a prior
     // retained run) produces a newer startedAt. Without the freshness check
diff --git a/src/renderer/src/components/dashboard/useRetainedAgents.ts b/src/renderer/src/components/dashboard/useRetainedAgents.ts
index f0ab639e2ba..f26baaafc37 100644
--- a/src/renderer/src/components/dashboard/useRetainedAgents.ts
+++ b/src/renderer/src/components/dashboard/useRetainedAgents.ts
@@ -15,6 +15,7 @@ import {
   type AgentStatusEntry
 } from '../../../../shared/agent-status-types'
 import { parsePaneKey } from '../../../../shared/stable-pane-id'
+import { agentTurnStoppedByUser } from '../../../../shared/agent-main-agent-verdict'
 
 import {
   createWorktreeTabBucketProjection,
@@ -299,13 +300,12 @@ export function collectRetainedAgentsOnDisappear(args: {
     if (args.recentlyClosedAgentStatusTabIds[ownerTabId]) {
       continue
     }
-    // Why: only keep a sticky snapshot when the agent finished cleanly
-    // (state === 'done' and not interrupted). Explicit teardown paths mark
+    // Why: only keep a sticky snapshot when the agent finished and the user did not
+    // stop it; a failure is kept so it stays visible. Explicit teardown paths mark
     // pane keys as suppression candidates, so a close/quit/crash cannot
     // resurrect a stale `done` row on the next sync.
     const lastState = prev.row.state
-    const wasInterrupted = prev.row.entry.interrupted === true
-    if (lastState !== 'done' || wasInterrupted) {
+    if (lastState !== 'done' || agentTurnStoppedByUser(prev.row.entry)) {
       continue
     }
     toRetain.push({
diff --git a/src/renderer/src/components/diff-comments/DiffCommentDraftCard.test.tsx b/src/renderer/src/components/diff-comments/DiffCommentDraftCard.test.tsx
new file mode 100644
index 00000000000..68914826e6d
--- /dev/null
+++ b/src/renderer/src/components/diff-comments/DiffCommentDraftCard.test.tsx
@@ -0,0 +1,270 @@
+// @vitest-environment happy-dom
+import { act, cleanup, fireEvent, render } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { toast } from 'sonner'
+import { DiffCommentDraftCard } from './DiffCommentDraftCard'
+
+vi.mock('sonner', () => ({ toast: { error: vi.fn(), success: vi.fn(), info: vi.fn() } }))
+
+describe('DiffCommentDraftCard', () => {
+  let scrollHeight = 60
+
+  beforeEach(() => {
+    scrollHeight = 60
+    vi.spyOn(HTMLTextAreaElement.prototype, 'scrollHeight', 'get').mockImplementation(
+      () => scrollHeight
+    )
+  })
+
+  afterEach(() => {
+    cleanup()
+    vi.restoreAllMocks()
+  })
+
+  it('renders line header', () => {
+    const onCancel = vi.fn()
+    const onSubmit = vi.fn().mockResolvedValue(true)
+
+    const view = render(
+      <DiffCommentDraftCard lineNumber={42} onCancel={onCancel} onSubmit={onSubmit} />
+    )
+
+    expect(view.getByText('Line 42')).toBeDefined()
+    expect(view.queryByText('You')).toBeNull()
+    const textarea = view.getByPlaceholderText('Add note for the AI')
+    expect(textarea).toBeDefined()
+    expect(document.activeElement).toBe(textarea)
+    expect(view.getByRole('button', { name: 'Add note' })).toBeDefined()
+    expect(view.getByRole('button', { name: 'Cancel' })).toBeDefined()
+  })
+
+  it('renders range header when startLine is provided', () => {
+    const onCancel = vi.fn()
+    const onSubmit = vi.fn().mockResolvedValue(true)
+
+    const view = render(
+      <DiffCommentDraftCard
+        lineNumber={42}
+        startLine={38}
+        onCancel={onCancel}
+        onSubmit={onSubmit}
+      />
+    )
+
+    expect(view.getByText('Lines 38-42')).toBeDefined()
+  })
+
+  it('disables submit button when body is whitespace and enables when text is typed', () => {
+    const onCancel = vi.fn()
+    const onSubmit = vi.fn().mockResolvedValue(true)
+
+    const view = render(
+      <DiffCommentDraftCard lineNumber={10} onCancel={onCancel} onSubmit={onSubmit} />
+    )
+
+    const submitBtn = view.getByRole('button', { name: 'Add note' })
+    expect(submitBtn.hasAttribute('disabled')).toBe(true)
+
+    const textarea = view.getByRole('textbox')
+    fireEvent.change(textarea, { target: { value: '   ' } })
+    expect(submitBtn.hasAttribute('disabled')).toBe(true)
+
+    fireEvent.change(textarea, { target: { value: 'Refactor this loop' } })
+    expect(submitBtn.hasAttribute('disabled')).toBe(false)
+  })
+
+  it('parks focus on the textarea before the pressed submit button turns disabled', async () => {
+    let resolveSubmit: (result: boolean) => void = () => {}
+    const onSubmit = vi.fn(
+      () =>
+        new Promise<boolean>((resolve) => {
+          resolveSubmit = resolve
+        })
+    )
+    const view = render(
+      <DiffCommentDraftCard lineNumber={10} onCancel={vi.fn()} onSubmit={onSubmit} />
+    )
+    const textarea = view.getByRole('textbox')
+    fireEvent.change(textarea, { target: { value: 'Pending note' } })
+    const submitBtn = view.getByRole('button', { name: 'Add note' })
+    submitBtn.focus()
+    expect(document.activeElement).toBe(submitBtn)
+    fireEvent.click(submitBtn)
+
+    // Chromium moves focus to <body> when a focused button turns disabled, which would stop the
+    // draft zone from handing focus back to the editor once the save lands.
+    expect(onSubmit).toHaveBeenCalledTimes(1)
+    expect(submitBtn.hasAttribute('disabled')).toBe(true)
+    expect(document.activeElement).toBe(textarea)
+
+    await act(async () => resolveSubmit(true))
+  })
+
+  it('calls onSubmit when clicking submit button', async () => {
+    const onCancel = vi.fn()
+    const onSubmit = vi.fn().mockResolvedValue(true)
+
+    const view = render(
+      <DiffCommentDraftCard lineNumber={10} onCancel={onCancel} onSubmit={onSubmit} />
+    )
+
+    const textarea = view.getByRole('textbox')
+    fireEvent.change(textarea, { target: { value: 'Needs revision' } })
+
+    const submitBtn = view.getByRole('button', { name: 'Add note' })
+    await act(async () => {
+      fireEvent.click(submitBtn)
+    })
+
+    expect(onSubmit).toHaveBeenCalledWith('Needs revision')
+  })
+
+  it('calls onSubmit on Enter without Shift, but allows Shift+Enter for newlines', async () => {
+    const onCancel = vi.fn()
+    const onSubmit = vi.fn().mockResolvedValue(true)
+
+    const view = render(
+      <DiffCommentDraftCard lineNumber={10} onCancel={onCancel} onSubmit={onSubmit} />
+    )
+
+    const textarea = view.getByRole('textbox')
+    fireEvent.change(textarea, { target: { value: 'First line' } })
+
+    // Shift+Enter should NOT submit
+    fireEvent.keyDown(textarea, { key: 'Enter', shiftKey: true })
+    expect(onSubmit).not.toHaveBeenCalled()
+
+    // Plain Enter SHOULD submit
+    await act(async () => {
+      fireEvent.keyDown(textarea, { key: 'Enter', shiftKey: false })
+    })
+    expect(onSubmit).toHaveBeenCalledWith('First line')
+  })
+
+  it('submits Cmd+Shift+Enter and ignores duplicate submits while pending', async () => {
+    let resolveSubmit: (result: boolean) => void = () => {}
+    const onSubmit = vi.fn(
+      () =>
+        new Promise<boolean>((resolve) => {
+          resolveSubmit = resolve
+        })
+    )
+    const onCancel = vi.fn()
+    const view = render(
+      <DiffCommentDraftCard lineNumber={10} onCancel={onCancel} onSubmit={onSubmit} />
+    )
+    const textarea = view.getByRole('textbox')
+    fireEvent.change(textarea, { target: { value: 'Pending note' } })
+    const submitButton = view.getByRole('button', { name: 'Add note' })
+
+    fireEvent.keyDown(textarea, { key: 'Enter', metaKey: true, shiftKey: true })
+    fireEvent.click(submitButton)
+    fireEvent.keyDown(textarea, { key: 'Escape' })
+
+    expect(onSubmit).toHaveBeenCalledTimes(1)
+    expect(view.getByRole('button', { name: 'Cancel' }).hasAttribute('disabled')).toBe(true)
+    expect(onCancel).not.toHaveBeenCalled()
+
+    await act(async () => resolveSubmit(true))
+  })
+
+  it('reports a rejected save to the user and re-enables the card', async () => {
+    const error = new Error('network down')
+    const onSubmit = vi.fn().mockRejectedValue(error)
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {})
+    const view = render(
+      <DiffCommentDraftCard lineNumber={10} onCancel={vi.fn()} onSubmit={onSubmit} />
+    )
+    fireEvent.change(view.getByRole('textbox'), { target: { value: 'Rejected note' } })
+
+    await act(async () => {
+      fireEvent.click(view.getByRole('button', { name: 'Add note' }))
+    })
+
+    expect(toast.error).toHaveBeenCalledWith('Failed to save comment')
+    expect(consoleError).toHaveBeenCalled()
+    expect(view.getByRole('button', { name: 'Add note' }).hasAttribute('disabled')).toBe(false)
+  })
+
+  it('seeds and reports draft text so a re-anchored card can carry it', () => {
+    const onBodyChange = vi.fn()
+    const view = render(
+      <DiffCommentDraftCard
+        lineNumber={10}
+        initialBody="Carried note"
+        onBodyChange={onBodyChange}
+        onCancel={vi.fn()}
+        onSubmit={vi.fn().mockResolvedValue(true)}
+      />
+    )
+    const textarea = view.getByRole('textbox')
+    expect(textarea instanceof HTMLTextAreaElement).toBe(true)
+    if (textarea instanceof HTMLTextAreaElement) {
+      expect(textarea.value).toBe('Carried note')
+    }
+    fireEvent.change(textarea, { target: { value: 'Updated note' } })
+    expect(onBodyChange).toHaveBeenCalledWith('Updated note')
+  })
+
+  it('does not submit on Enter when IME composition is active', async () => {
+    const onCancel = vi.fn()
+    const onSubmit = vi.fn().mockResolvedValue(true)
+
+    const view = render(
+      <DiffCommentDraftCard lineNumber={10} onCancel={onCancel} onSubmit={onSubmit} />
+    )
+
+    const textarea = view.getByRole('textbox')
+    fireEvent.change(textarea, { target: { value: 'nihon' } })
+
+    // IME composition
+    fireEvent.keyDown(textarea, { key: 'Enter', isComposing: true })
+    expect(onSubmit).not.toHaveBeenCalled()
+  })
+
+  it('calls onCancel when clicking Cancel or pressing Escape', () => {
+    const onCancel = vi.fn()
+    const onSubmit = vi.fn().mockResolvedValue(true)
+
+    const view = render(
+      <DiffCommentDraftCard lineNumber={10} onCancel={onCancel} onSubmit={onSubmit} />
+    )
+
+    const cancelBtn = view.getByRole('button', { name: 'Cancel' })
+    fireEvent.click(cancelBtn)
+    expect(onCancel).toHaveBeenCalledTimes(1)
+
+    const textarea = view.getByRole('textbox')
+    fireEvent.keyDown(textarea, { key: 'Escape' })
+    expect(onCancel).toHaveBeenCalledTimes(2)
+  })
+
+  it('notifies onContentResize when textarea height changes', () => {
+    const onContentResize = vi.fn()
+    const onCancel = vi.fn()
+    const onSubmit = vi.fn().mockResolvedValue(true)
+
+    const view = render(
+      <DiffCommentDraftCard
+        lineNumber={10}
+        onCancel={onCancel}
+        onSubmit={onSubmit}
+        onContentResize={onContentResize}
+      />
+    )
+
+    const textarea = view.getByRole('textbox')
+    // Called once on initial layout to settle view zone height
+    expect(onContentResize).toHaveBeenCalledTimes(1)
+
+    // Same height (60)
+    fireEvent.change(textarea, { target: { value: 'line 1' } })
+    expect(onContentResize).toHaveBeenCalledTimes(1)
+
+    // Height increases
+    scrollHeight = 120
+    fireEvent.change(textarea, { target: { value: 'line 1\nline 2\nline 3' } })
+    expect(onContentResize).toHaveBeenCalledTimes(2)
+    expect(textarea.style.height).toBe('120px')
+  })
+})
diff --git a/src/renderer/src/components/diff-comments/DiffCommentDraftCard.tsx b/src/renderer/src/components/diff-comments/DiffCommentDraftCard.tsx
new file mode 100644
index 00000000000..f81444106af
--- /dev/null
+++ b/src/renderer/src/components/diff-comments/DiffCommentDraftCard.tsx
@@ -0,0 +1,268 @@
+import { useCallback, useEffect, useId, useLayoutEffect, useRef, useState } from 'react'
+import { CornerDownLeft } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import { useMountedRef } from '@/hooks/useMountedRef'
+import { translate } from '@/i18n/i18n'
+import {
+  getCommentBodySubmitState,
+  hasBoundedCommentBodyText
+} from '@/lib/comment-body-submit-state'
+import { toast } from 'sonner'
+import { installOpenDraftAddReviewNoteGuard } from '../editor/editor-shortcuts'
+
+export type DiffCommentDraftCardProps = {
+  lineNumber: number
+  startLine?: number
+  placeholder?: string
+  submitLabel?: string
+  submittingLabel?: string
+  initialBody?: string
+  onBodyChange?: (body: string) => void
+  onCancel: () => void
+  onSubmit: (body: string) => Promise<boolean>
+  onContentResize?: () => void
+}
+
+function resizeDraftTextarea(textarea: HTMLTextAreaElement): boolean {
+  const previousHeight = textarea.style.height
+  textarea.style.height = 'auto'
+  textarea.style.height = `${Math.min(Math.max(textarea.scrollHeight, 60), 240)}px`
+  return textarea.style.height !== previousHeight
+}
+
+export function DiffCommentDraftCard({
+  lineNumber,
+  startLine,
+  placeholder,
+  submitLabel,
+  submittingLabel,
+  onCancel,
+  onSubmit,
+  onContentResize,
+  initialBody = '',
+  onBodyChange
+}: DiffCommentDraftCardProps): React.JSX.Element {
+  const [body, setBody] = useState(initialBody)
+  const bodyRef = useRef(body)
+  const [submitting, setSubmitting] = useState(false)
+  const mountedRef = useMountedRef()
+  const textareaRef = useRef<HTMLTextAreaElement | null>(null)
+  const cardRef = useRef<HTMLDivElement | null>(null)
+  const onContentResizeRef = useRef(onContentResize)
+
+  useEffect(() => {
+    bodyRef.current = body
+  }, [body])
+
+  useEffect(() => {
+    onContentResizeRef.current = onContentResize
+  }, [onContentResize])
+
+  const labelId = useId()
+  const headerLabel =
+    startLine && startLine !== lineNumber
+      ? translate(
+          'auto.components.diff.comments.DiffCommentPopover.c845170b3b',
+          'Lines {{value0}}-{{value1}}',
+          { value0: startLine, value1: lineNumber }
+        )
+      : translate(
+          'auto.components.diff.comments.DiffCommentPopover.e05063cfc1',
+          'Line {{value0}}',
+          { value0: lineNumber }
+        )
+
+  const focusTextareaRef = useCallback((textarea: HTMLTextAreaElement | null): void => {
+    textareaRef.current = textarea
+    textarea?.focus()
+  }, [])
+
+  useEffect(() => {
+    const focusTextarea = (): void => textareaRef.current?.focus()
+    focusTextarea()
+    if (typeof requestAnimationFrame !== 'function') {
+      return
+    }
+    const frame = requestAnimationFrame(focusTextarea)
+    return () => cancelAnimationFrame(frame)
+  }, [])
+
+  useLayoutEffect(() => {
+    const card = cardRef.current
+    if (!card || !onContentResizeRef.current) {
+      return
+    }
+    const textarea = textareaRef.current
+    if (textarea) {
+      resizeDraftTextarea(textarea)
+    }
+    onContentResizeRef.current()
+    if (typeof ResizeObserver === 'undefined') {
+      return
+    }
+    const observer = new ResizeObserver(() => {
+      onContentResizeRef.current?.()
+    })
+    observer.observe(card)
+    return () => observer.disconnect()
+  }, [])
+
+  useEffect(() => {
+    const card = cardRef.current
+    if (!card) {
+      return
+    }
+    return installOpenDraftAddReviewNoteGuard(card)
+  }, [])
+
+  useEffect(() => {
+    const onDocumentMouseDown = (event: MouseEvent): void => {
+      const card = cardRef.current
+      const target = event.target
+      if (!card || (target instanceof Node && card.contains(target))) {
+        return
+      }
+      // Keep a non-empty draft alive when the user clicks another line's add button.
+      if (/\S/u.test(bodyRef.current)) {
+        return
+      }
+      onCancel()
+    }
+    document.addEventListener('mousedown', onDocumentMouseDown)
+    return () => document.removeEventListener('mousedown', onDocumentMouseDown)
+  }, [onCancel])
+
+  const handleSubmit = async (): Promise<void> => {
+    if (submitting) {
+      return
+    }
+    const bodyState = getCommentBodySubmitState(body)
+    if (bodyState.status === 'empty') {
+      return
+    }
+    if (bodyState.status === 'too-large-leading-whitespace') {
+      toast.error(
+        translate(
+          'auto.components.diff.comments.DiffCommentPopover.commentTooLarge',
+          'Comment is too large to submit safely.'
+        )
+      )
+      return
+    }
+    // Chromium drops focus to <body> when the pressed button turns disabled, and the zone only
+    // hands focus back to Monaco while the card still holds it. Park it on the textarea first.
+    textareaRef.current?.focus()
+    setSubmitting(true)
+    try {
+      const result = await onSubmit(bodyState.body)
+      if (result === false && mountedRef.current) {
+        setSubmitting(false)
+      }
+    } catch (err) {
+      console.error('Failed to submit diff comment draft:', err)
+      // A rejected save never reaches the caller's own failure toast, so report it here.
+      toast.error(
+        translate('auto.components.editor.diffCommentSaveFailed', 'Failed to save comment')
+      )
+      if (mountedRef.current) {
+        setSubmitting(false)
+      }
+    }
+  }
+
+  const handleKeyDown = (e: React.KeyboardEvent<HTMLTextAreaElement>): void => {
+    e.stopPropagation()
+
+    if (e.key === 'Escape') {
+      e.preventDefault()
+      if (submitting) {
+        return
+      }
+      onCancel()
+      return
+    }
+
+    const isEnter = e.key === 'Enter' && !e.nativeEvent.isComposing
+    const isCmdOrCtrl = e.metaKey || e.ctrlKey
+    // Plain Shift+Enter inserts a newline; Cmd/Ctrl+Enter submits even with Shift.
+    if (isEnter && (isCmdOrCtrl || !e.shiftKey)) {
+      e.preventDefault()
+      if (submitting) {
+        return
+      }
+      void handleSubmit()
+    }
+  }
+
+  const canSubmit = !submitting && hasBoundedCommentBodyText(body)
+
+  return (
+    <div
+      ref={cardRef}
+      className="orca-diff-comment-popover orca-diff-comment-draft-card"
+      role="region"
+      aria-labelledby={labelId}
+      onMouseDown={(ev) => ev.stopPropagation()}
+      onClick={(ev) => ev.stopPropagation()}
+    >
+      <div className="orca-diff-comment-content-col gap-2">
+        <div id={labelId} className="orca-diff-comment-popover-label">
+          {headerLabel}
+        </div>
+
+        {/* Textarea */}
+        <textarea
+          ref={focusTextareaRef}
+          className="orca-diff-comment-popover-textarea"
+          placeholder={
+            placeholder ??
+            translate(
+              'auto.components.diff.comments.DiffCommentPopover.f6c449191e',
+              'Add note for the AI'
+            )
+          }
+          value={body}
+          rows={3}
+          onChange={(e) => {
+            setBody(e.target.value)
+            onBodyChange?.(e.target.value)
+            if (resizeDraftTextarea(e.currentTarget)) {
+              onContentResizeRef.current?.()
+            }
+          }}
+          onKeyDown={handleKeyDown}
+        />
+
+        {/* Footer */}
+        <div className="orca-diff-comment-popover-footer">
+          <Button type="button" variant="ghost" size="sm" onClick={onCancel} disabled={submitting}>
+            {translate('auto.components.diff.comments.DiffCommentPopover.2b3ce6d394', 'Cancel')}
+          </Button>
+          <Button
+            type="button"
+            size="sm"
+            aria-label={
+              submitLabel ??
+              translate('auto.components.diff.comments.DiffCommentPopover.5fa4bfebaa', 'Add note')
+            }
+            onClick={() => void handleSubmit()}
+            disabled={!canSubmit}
+          >
+            {submitting
+              ? (submittingLabel ??
+                translate(
+                  'auto.components.diff.comments.DiffCommentPopover.5e9b3d0c2e',
+                  'Adding...'
+                ))
+              : (submitLabel ??
+                translate(
+                  'auto.components.diff.comments.DiffCommentPopover.5fa4bfebaa',
+                  'Add note'
+                ))}
+            {!submitting && <CornerDownLeft className="ml-1 size-3 opacity-70" />}
+          </Button>
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/diff-comments/diff-comment-add-note-shortcut.ts b/src/renderer/src/components/diff-comments/diff-comment-add-note-shortcut.ts
index 3dab9d053b8..a58ac12d725 100644
--- a/src/renderer/src/components/diff-comments/diff-comment-add-note-shortcut.ts
+++ b/src/renderer/src/components/diff-comments/diff-comment-add-note-shortcut.ts
@@ -55,8 +55,9 @@ export function installDiffCommentAddNoteShortcut({
   onOpenComposer: (args: { lineNumber: number; startLine?: number; top: number }) => void
 }): () => void {
   return installEditorAddReviewNoteShortcut(editor.getContainerDomNode(), () => {
-    // Why: an open draft consumes the chord itself (DiffCommentPopover's guard); claiming it here
-    // too would remount the composer and drop what the user already typed.
+    // Why: an open draft card owns the chord (isComposerOpen reports it, and the card's own guard
+    // eats presses from its textarea); claiming it here too would re-open the card at the editor's
+    // selection and move what the user already typed.
     if (isComposerOpen()) {
       return true
     }
diff --git a/src/renderer/src/components/diff-comments/diff-comment-draft-zone.test.tsx b/src/renderer/src/components/diff-comments/diff-comment-draft-zone.test.tsx
new file mode 100644
index 00000000000..76be7f554a7
--- /dev/null
+++ b/src/renderer/src/components/diff-comments/diff-comment-draft-zone.test.tsx
@@ -0,0 +1,313 @@
+// @vitest-environment happy-dom
+import { act, fireEvent, renderHook, within } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  useDiffCommentDraftZone,
+  type UseDiffCommentDraftZoneArgs
+} from './diff-comment-draft-zone'
+import {
+  createFakeDiffCommentEditor,
+  type FakeDiffCommentEditor
+} from './diff-comment-editor-test-fixture'
+
+const DRAFT_LINE = 5
+const OTHER_LINE = 9
+const BODY = 'Needs revision'
+
+type CreateComment = NonNullable<UseDiffCommentDraftZoneArgs['onCreateComment']>
+
+function renderDraftZone(fake: FakeDiffCommentEditor, onCreateComment: CreateComment) {
+  return renderHook(
+    ({ monacoModelIdentity }: { monacoModelIdentity: string }) =>
+      useDiffCommentDraftZone({ editor: fake.editor, monacoModelIdentity, onCreateComment }),
+    { initialProps: { monacoModelIdentity: 'model-v1' } }
+  )
+}
+
+function openDraftAt(hook: ReturnType<typeof renderDraftZone>, lineNumber: number): void {
+  act(() => {
+    hook.result.current.onAddCommentClickRef.current({ lineNumber, top: 0 })
+  })
+}
+
+// The single open draft card, attached to the editor node the way Monaco would mount its zone.
+function draftCard(fake: FakeDiffCommentEditor): {
+  dom: HTMLElement
+  textarea: HTMLTextAreaElement
+} {
+  const zones = [...fake.zones.values()]
+  expect(zones).toHaveLength(1)
+  const dom = zones[0].domNode
+  if (!dom.isConnected) {
+    fake.domNode.appendChild(dom)
+  }
+  const textarea = dom.querySelector('textarea')
+  if (!(textarea instanceof HTMLTextAreaElement)) {
+    throw new Error('draft card did not render a textarea')
+  }
+  return { dom, textarea }
+}
+
+function typeDraft(fake: FakeDiffCommentEditor, body: string): void {
+  fireEvent.change(draftCard(fake).textarea, { target: { value: body } })
+}
+
+function submitDraft(fake: FakeDiffCommentEditor, body: string): void {
+  typeDraft(fake, body)
+  fireEvent.click(within(draftCard(fake).dom).getByRole('button', { name: 'Add note' }))
+}
+
+function deferredCreateComment(): {
+  onCreateComment: CreateComment & ReturnType<typeof vi.fn>
+  settle: (result: boolean) => Promise<void>
+} {
+  let resolve: (result: boolean) => void = () => {}
+  const onCreateComment = vi.fn(
+    () =>
+      new Promise<boolean>((r) => {
+        resolve = r
+      })
+  )
+  return {
+    onCreateComment,
+    settle: (result) =>
+      act(async () => {
+        resolve(result)
+      })
+  }
+}
+
+const frames = new Map<number, FrameRequestCallback>()
+let nextFrameId = 0
+
+function pumpFrames(): void {
+  const pending = [...frames.values()]
+  frames.clear()
+  act(() => {
+    for (const callback of pending) {
+      callback(16)
+    }
+  })
+}
+
+beforeEach(() => {
+  frames.clear()
+  vi.stubGlobal('requestAnimationFrame', (callback: FrameRequestCallback): number => {
+    nextFrameId += 1
+    frames.set(nextFrameId, callback)
+    return nextFrameId
+  })
+  vi.stubGlobal('cancelAnimationFrame', (id: number) => {
+    frames.delete(id)
+  })
+})
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+  document.body.replaceChildren()
+  vi.clearAllMocks()
+})
+
+describe('useDiffCommentDraftZone re-anchoring', () => {
+  it('keeps the carried body when a second model swap lands before the re-anchor frame', () => {
+    const fake = createFakeDiffCommentEditor()
+    const hook = renderDraftZone(fake, vi.fn().mockResolvedValue(true))
+    openDraftAt(hook, DRAFT_LINE)
+    typeDraft(fake, BODY)
+
+    hook.rerender({ monacoModelIdentity: 'model-v2' })
+    hook.rerender({ monacoModelIdentity: 'model-v3' })
+    expect(fake.zones.size).toBe(0)
+    pumpFrames()
+
+    const { textarea } = draftCard(fake)
+    expect(textarea.value).toBe(BODY)
+    expect([...fake.zones.values()][0].afterLineNumber).toBe(DRAFT_LINE)
+    expect(hook.result.current.isDraftOpen()).toBe(true)
+  })
+
+  it('re-anchors the typed body onto a replacement editor', () => {
+    const first = createFakeDiffCommentEditor()
+    const replacement = createFakeDiffCommentEditor()
+    const onCreateComment = vi.fn().mockResolvedValue(true)
+    const hook = renderHook(
+      ({
+        fake,
+        monacoModelIdentity
+      }: {
+        fake: FakeDiffCommentEditor
+        monacoModelIdentity: string
+      }) => useDiffCommentDraftZone({ editor: fake.editor, monacoModelIdentity, onCreateComment }),
+      { initialProps: { fake: first, monacoModelIdentity: 'model-v1' } }
+    )
+    act(() => {
+      hook.result.current.onAddCommentClickRef.current({ lineNumber: DRAFT_LINE, top: 0 })
+    })
+    typeDraft(first, BODY)
+
+    hook.rerender({ fake: replacement, monacoModelIdentity: 'model-v2' })
+    expect(first.zones.size).toBe(0)
+    pumpFrames()
+
+    expect(draftCard(replacement).textarea.value).toBe(BODY)
+    expect([...replacement.zones.values()][0].afterLineNumber).toBe(DRAFT_LINE)
+  })
+
+  it('lets a click on another line win over a scheduled re-anchor', () => {
+    const fake = createFakeDiffCommentEditor()
+    const hook = renderDraftZone(fake, vi.fn().mockResolvedValue(true))
+    openDraftAt(hook, DRAFT_LINE)
+    typeDraft(fake, BODY)
+    hook.rerender({ monacoModelIdentity: 'model-v2' })
+
+    openDraftAt(hook, OTHER_LINE)
+    expect(draftCard(fake).textarea.value).toBe(BODY)
+    pumpFrames()
+
+    const zones = [...fake.zones.values()]
+    expect(zones).toHaveLength(1)
+    expect(zones[0].afterLineNumber).toBe(OTHER_LINE)
+    expect(draftCard(fake).textarea.value).toBe(BODY)
+  })
+})
+
+describe('useDiffCommentDraftZone in-flight submit', () => {
+  it('does not carry a submitting draft across a model swap and clears it once the save lands', async () => {
+    const fake = createFakeDiffCommentEditor()
+    const { onCreateComment, settle } = deferredCreateComment()
+    const hook = renderDraftZone(fake, onCreateComment)
+    openDraftAt(hook, DRAFT_LINE)
+    submitDraft(fake, BODY)
+    expect(onCreateComment).toHaveBeenCalledTimes(1)
+
+    hook.rerender({ monacoModelIdentity: 'model-v2' })
+    pumpFrames()
+    // The in-flight save owns the text: no replacement card that could submit it a second time.
+    expect(fake.zones.size).toBe(0)
+
+    await settle(true)
+    pumpFrames()
+    expect(fake.zones.size).toBe(0)
+    expect(hook.result.current.isDraftOpen()).toBe(false)
+    expect(onCreateComment).toHaveBeenCalledTimes(1)
+  })
+
+  it('brings the draft back for retry when its save fails after a model swap', async () => {
+    const fake = createFakeDiffCommentEditor()
+    const { onCreateComment, settle } = deferredCreateComment()
+    const hook = renderDraftZone(fake, onCreateComment)
+    openDraftAt(hook, DRAFT_LINE)
+    submitDraft(fake, BODY)
+    hook.rerender({ monacoModelIdentity: 'model-v2' })
+    expect(fake.zones.size).toBe(0)
+
+    await settle(false)
+
+    const { textarea } = draftCard(fake)
+    expect(textarea.value).toBe(BODY)
+    expect([...fake.zones.values()][0].afterLineNumber).toBe(DRAFT_LINE)
+    expect(hook.result.current.isDraftOpen()).toBe(true)
+  })
+
+  it('does not carry a submitting body into a draft opened on another line', async () => {
+    const fake = createFakeDiffCommentEditor()
+    const { onCreateComment, settle } = deferredCreateComment()
+    const hook = renderDraftZone(fake, onCreateComment)
+    openDraftAt(hook, DRAFT_LINE)
+    submitDraft(fake, BODY)
+
+    openDraftAt(hook, OTHER_LINE)
+    expect(draftCard(fake).textarea.value).toBe('')
+
+    await settle(true)
+    const zones = [...fake.zones.values()]
+    expect(zones).toHaveLength(1)
+    expect(zones[0].afterLineNumber).toBe(OTHER_LINE)
+    expect(onCreateComment).toHaveBeenCalledTimes(1)
+  })
+})
+
+describe('useDiffCommentDraftZone focus handoff', () => {
+  it('returns focus to the editor when a save succeeds while the card holds it', async () => {
+    const fake = createFakeDiffCommentEditor()
+    const { onCreateComment, settle } = deferredCreateComment()
+    const hook = renderDraftZone(fake, onCreateComment)
+    openDraftAt(hook, DRAFT_LINE)
+    draftCard(fake).textarea.focus()
+    submitDraft(fake, BODY)
+
+    await settle(true)
+
+    expect(fake.zones.size).toBe(0)
+    expect(fake.focusCount()).toBe(1)
+  })
+
+  it('returns focus to the editor when the save was started from the submit button', async () => {
+    const fake = createFakeDiffCommentEditor()
+    const { onCreateComment, settle } = deferredCreateComment()
+    const hook = renderDraftZone(fake, onCreateComment)
+    openDraftAt(hook, DRAFT_LINE)
+    typeDraft(fake, BODY)
+    const submit = within(draftCard(fake).dom).getByRole('button', { name: 'Add note' })
+    submit.focus()
+    fireEvent.click(submit)
+    // The card must still hold focus while the save is pending, on a control that stays enabled.
+    expect(document.activeElement).toBe(draftCard(fake).textarea)
+
+    await settle(true)
+
+    expect(fake.zones.size).toBe(0)
+    expect(fake.focusCount()).toBe(1)
+  })
+
+  it('leaves focus alone when the save settles after the user clicked away', async () => {
+    const fake = createFakeDiffCommentEditor()
+    const { onCreateComment, settle } = deferredCreateComment()
+    const hook = renderDraftZone(fake, onCreateComment)
+    openDraftAt(hook, DRAFT_LINE)
+    submitDraft(fake, BODY)
+
+    const elsewhere = document.createElement('input')
+    document.body.appendChild(elsewhere)
+    elsewhere.focus()
+    await settle(true)
+
+    expect(fake.zones.size).toBe(0)
+    expect(fake.focusCount()).toBe(0)
+  })
+})
+
+describe('useDiffCommentDraftZone open state', () => {
+  it('reports the draft closed again after cancel so the chord is not deadened', () => {
+    const fake = createFakeDiffCommentEditor()
+    const hook = renderDraftZone(fake, vi.fn().mockResolvedValue(true))
+    openDraftAt(hook, DRAFT_LINE)
+    expect(hook.result.current.isDraftOpen()).toBe(true)
+
+    fireEvent.click(within(draftCard(fake).dom).getByRole('button', { name: 'Cancel' }))
+
+    expect(hook.result.current.isDraftOpen()).toBe(false)
+    expect(fake.zones.size).toBe(0)
+
+    openDraftAt(hook, OTHER_LINE)
+    expect(hook.result.current.isDraftOpen()).toBe(true)
+    expect([...fake.zones.values()][0].afterLineNumber).toBe(OTHER_LINE)
+  })
+})
+
+describe('useDiffCommentDraftZone teardown', () => {
+  it('does not resurrect a card when a failed save settles after unmount', async () => {
+    const fake = createFakeDiffCommentEditor()
+    const { onCreateComment, settle } = deferredCreateComment()
+    const hook = renderDraftZone(fake, onCreateComment)
+    openDraftAt(hook, DRAFT_LINE)
+    submitDraft(fake, BODY)
+
+    hook.unmount()
+    expect(fake.zones.size).toBe(0)
+
+    await settle(false)
+    pumpFrames()
+    expect(fake.zones.size).toBe(0)
+  })
+})
diff --git a/src/renderer/src/components/diff-comments/diff-comment-draft-zone.ts b/src/renderer/src/components/diff-comments/diff-comment-draft-zone.ts
new file mode 100644
index 00000000000..ef734025041
--- /dev/null
+++ b/src/renderer/src/components/diff-comments/diff-comment-draft-zone.ts
@@ -0,0 +1,323 @@
+import { useCallback, useEffect, useRef } from 'react'
+import type { editor as monacoEditor } from 'monaco-editor'
+import { createRoot } from 'react-dom/client'
+import { installDiffCommentZoneMouseDownStopper } from './diff-comment-zone-mouse-events'
+import { renderDiffCommentDraftCard } from './diff-comment-zone-card'
+import {
+  resizeDiffCommentZone,
+  DRAFT_ZONE_DEFAULT_HEIGHT,
+  type DraftZoneEntry
+} from './diff-comment-view-zone-entry'
+
+export type DiffCommentDraft = {
+  lineNumber: number
+  startLine?: number
+}
+
+type CarriedDraft = { draft: DiffCommentDraft; body: string }
+
+export type UseDiffCommentDraftZoneArgs = {
+  editor: monacoEditor.ICodeEditor | null
+  monacoModelIdentity?: string
+  canOpenDraft?: boolean
+  onCreateComment?: (args: {
+    lineNumber: number
+    startLine?: number
+    body: string
+  }) => Promise<boolean>
+  draftPlaceholder?: string
+  draftSubmitLabel?: string
+  onAddCommentClick?: (args: { lineNumber: number; startLine?: number; top: number }) => void
+}
+
+export type DiffCommentDraftZoneHandle = {
+  disposeDraftZone: (focusEditor?: boolean) => void
+  isDraftOpen: () => boolean
+  onAddCommentClickRef: React.RefObject<
+    (args: { lineNumber: number; startLine?: number; top: number }) => void
+  >
+}
+
+export function useDiffCommentDraftZone({
+  editor,
+  monacoModelIdentity,
+  canOpenDraft = true,
+  onCreateComment,
+  draftPlaceholder,
+  draftSubmitLabel,
+  onAddCommentClick
+}: UseDiffCommentDraftZoneArgs): DiffCommentDraftZoneHandle {
+  const draftZoneRef = useRef<DraftZoneEntry | null>(null)
+  // The only copy of a draft between its card being torn down and the replacement mounting.
+  const pendingDraftRef = useRef<CarriedDraft | null>(null)
+  const previousModelIdentityRef = useRef(monacoModelIdentity)
+  const reanchorFrameRef = useRef<number | null>(null)
+  const onAddCommentClickRef = useRef<
+    (args: { lineNumber: number; startLine?: number; top: number }) => void
+  >(() => {})
+
+  // A save can settle after unmount; without this its retry would mount a card nobody disposes.
+  const unmountedRef = useRef(false)
+  const onCreateCommentRef = useRef(onCreateComment)
+  const onLegacyAddCommentClickRef = useRef(onAddCommentClick)
+
+  useEffect(() => {
+    unmountedRef.current = false
+    return () => {
+      unmountedRef.current = true
+    }
+  }, [])
+
+  useEffect(() => {
+    onCreateCommentRef.current = onCreateComment
+    onLegacyAddCommentClickRef.current = onAddCommentClick
+  }, [onAddCommentClick, onCreateComment])
+
+  const isDraftOpen = useCallback((): boolean => draftZoneRef.current !== null, [])
+
+  const cancelReanchorFrame = useCallback((): void => {
+    if (reanchorFrameRef.current === null) {
+      return
+    }
+    cancelAnimationFrame(reanchorFrameRef.current)
+    reanchorFrameRef.current = null
+  }, [])
+
+  const disposeDraftZone = useCallback((focusEditor = false): void => {
+    const entry = draftZoneRef.current
+    if (!entry) {
+      return
+    }
+    draftZoneRef.current = null
+    if (entry.editor.getModel()) {
+      entry.editor.changeViewZones((accessor) => accessor.removeZone(entry.zoneId))
+    }
+    entry.disposeMouseDownStopper()
+    queueMicrotask(() => entry.root.unmount())
+    if (focusEditor) {
+      entry.editor.focus()
+    }
+  }, [])
+
+  // Latest openDraft for callers that outlive a render: the re-anchor frame and a settling submit.
+  const openDraftRef = useRef<(draft: DiffCommentDraft, initialBody?: string) => boolean>(
+    () => false
+  )
+
+  // A save that failed after its card was torn down (model swap, editor refresh) brings the text
+  // back for a retry; an open card means the user already moved on, and the failure toast covers it.
+  const restoreFailedSubmit = useCallback((draft: DiffCommentDraft, body: string): void => {
+    if (unmountedRef.current || draftZoneRef.current || openDraftRef.current(draft, body)) {
+      return
+    }
+    pendingDraftRef.current = { draft, body }
+  }, [])
+
+  const openDraft = useCallback(
+    (draft: DiffCommentDraft, initialBody = ''): boolean => {
+      if (!editor || !editor.getModel() || !onCreateCommentRef.current || !canOpenDraft) {
+        return false
+      }
+
+      disposeDraftZone()
+      editor.changeViewZones((accessor) => {
+        const dom = document.createElement('div')
+        dom.className = 'orca-diff-comment-inline'
+        const marginDom = document.createElement('div')
+        marginDom.className = 'orca-diff-comment-draft-margin'
+        const disposeDomMouseDownStopper = installDiffCommentZoneMouseDownStopper(dom)
+        const disposeMarginMouseDownStopper = installDiffCommentZoneMouseDownStopper(marginDom)
+        const root = createRoot(dom)
+        let didFocus = false
+        const delegate: monacoEditor.IViewZone = {
+          afterLineNumber: draft.lineNumber,
+          heightInPx: DRAFT_ZONE_DEFAULT_HEIGHT,
+          domNode: dom,
+          marginDomNode: marginDom,
+          suppressMouseDown: false,
+          onDomNodeTop: () => {
+            if (didFocus) {
+              return
+            }
+            const textarea = dom.querySelector<HTMLTextAreaElement>('textarea')
+            if (!textarea) {
+              return
+            }
+            didFocus = true
+            textarea.focus()
+          }
+        }
+        const zoneId = accessor.addZone(delegate)
+        const entry: DraftZoneEntry = {
+          editor,
+          zoneId,
+          domNode: dom,
+          marginDomNode: marginDom,
+          delegate,
+          root,
+          draft,
+          body: initialBody,
+          submitting: false,
+          disposeMouseDownStopper: () => {
+            disposeDomMouseDownStopper()
+            disposeMarginMouseDownStopper()
+          }
+        }
+        draftZoneRef.current = entry
+
+        renderDiffCommentDraftCard(root, draft, {
+          placeholder: draftPlaceholder,
+          submitLabel: draftSubmitLabel,
+          initialBody,
+          onBodyChange: (body) => {
+            if (draftZoneRef.current === entry) {
+              entry.body = body
+            }
+          },
+          resizeZone: () => {
+            if (draftZoneRef.current === entry) {
+              resizeDiffCommentZone(editor, entry)
+            }
+          },
+          onCancel: () => disposeDraftZone(true),
+          onSubmit: async (body) => {
+            const createComment = onCreateCommentRef.current
+            if (!createComment) {
+              return false
+            }
+            entry.submitting = true
+            let succeeded = false
+            try {
+              const result = await createComment({
+                lineNumber: draft.lineNumber,
+                startLine: draft.startLine,
+                body
+              })
+              succeeded = result !== false
+              return result
+            } finally {
+              entry.submitting = false
+              if (succeeded) {
+                if (draftZoneRef.current === entry) {
+                  // Hand focus back to Monaco only if the card still holds it: a slow save can
+                  // settle after the user has clicked away, and stealing focus back is worse.
+                  disposeDraftZone(entry.domNode.contains(document.activeElement))
+                }
+              } else if (draftZoneRef.current !== entry) {
+                restoreFailedSubmit(draft, body)
+              }
+            }
+          }
+        })
+      })
+      // Report what actually mounted: the re-anchor frame drops its only copy of the draft on true.
+      return draftZoneRef.current !== null
+    },
+    [
+      canOpenDraft,
+      disposeDraftZone,
+      draftPlaceholder,
+      draftSubmitLabel,
+      editor,
+      restoreFailedSubmit
+    ]
+  )
+
+  useEffect(() => {
+    openDraftRef.current = openDraft
+  }, [openDraft])
+
+  // The stash is only cleared once a card actually mounts: the editor may still be mid-refresh
+  // when the frame fires, and a later editor/identity change re-schedules from the same stash.
+  const scheduleReanchor = useCallback((): void => {
+    if (reanchorFrameRef.current !== null) {
+      return
+    }
+    reanchorFrameRef.current = requestAnimationFrame(() => {
+      reanchorFrameRef.current = null
+      const pending = pendingDraftRef.current
+      if (pending && openDraftRef.current(pending.draft, pending.body)) {
+        pendingDraftRef.current = null
+      }
+    })
+  }, [])
+
+  const openDraftFromArgs = useCallback(
+    (args: { lineNumber: number; startLine?: number; top: number }): void => {
+      if (!canOpenDraft) {
+        return
+      }
+      if (!onCreateCommentRef.current) {
+        onLegacyAddCommentClickRef.current?.(args)
+        return
+      }
+      const current = draftZoneRef.current
+      const pending = pendingDraftRef.current
+      // A submitting card's text is already on its way to the store; carrying it would post it twice.
+      const carriedBody =
+        (current && !current.submitting ? current.body : '') || pending?.body || ''
+      // The user picked a new anchor, so a scheduled re-anchor must not move the card back afterwards.
+      cancelReanchorFrame()
+      pendingDraftRef.current = null
+      if (!openDraft({ lineNumber: args.lineNumber, startLine: args.startLine }, carriedBody)) {
+        pendingDraftRef.current = pending
+      }
+    },
+    [canOpenDraft, cancelReanchorFrame, openDraft]
+  )
+
+  useEffect(() => {
+    onAddCommentClickRef.current = openDraftFromArgs
+  }, [openDraftFromArgs])
+
+  useEffect(() => {
+    if (previousModelIdentityRef.current === monacoModelIdentity) {
+      return
+    }
+    previousModelIdentityRef.current = monacoModelIdentity
+    cancelReanchorFrame()
+    const current = draftZoneRef.current
+    if (current) {
+      // A save in flight owns its text: the settling submit disposes on success and re-opens on
+      // failure, so carrying it here would mount a second card that could submit the same note.
+      if (!current.submitting) {
+        pendingDraftRef.current = { draft: current.draft, body: current.body }
+      }
+      disposeDraftZone()
+    }
+    if (pendingDraftRef.current) {
+      scheduleReanchor()
+    }
+  }, [cancelReanchorFrame, disposeDraftZone, monacoModelIdentity, scheduleReanchor])
+
+  // A combined-diff model refresh can briefly clear the editor ref before the replacement mounts.
+  // Re-anchor any carried draft when that replacement becomes available.
+  useEffect(() => {
+    if (!editor || !canOpenDraft || !pendingDraftRef.current) {
+      return
+    }
+    scheduleReanchor()
+    return cancelReanchorFrame
+  }, [cancelReanchorFrame, canOpenDraft, editor, scheduleReanchor])
+
+  useEffect(() => {
+    if (!editor) {
+      return
+    }
+    return () => {
+      cancelReanchorFrame()
+      // Runs before the identity effect on a same-render swap, so stash here or the draft is lost.
+      const current = draftZoneRef.current
+      if (!unmountedRef.current && current && !current.submitting) {
+        pendingDraftRef.current = { draft: current.draft, body: current.body }
+      }
+      disposeDraftZone(false)
+    }
+  }, [cancelReanchorFrame, disposeDraftZone, editor])
+
+  return {
+    disposeDraftZone,
+    isDraftOpen,
+    onAddCommentClickRef
+  }
+}
diff --git a/src/renderer/src/components/diff-comments/diff-comment-editor-test-fixture.ts b/src/renderer/src/components/diff-comments/diff-comment-editor-test-fixture.ts
index 253bb785074..3e13e6784a5 100644
--- a/src/renderer/src/components/diff-comments/diff-comment-editor-test-fixture.ts
+++ b/src/renderer/src/components/diff-comments/diff-comment-editor-test-fixture.ts
@@ -22,6 +22,8 @@ export type FakeDiffCommentEditor = {
   decorations: () => readonly FakeDecoration[]
   decorationWrites: () => number
   scrollTop: () => number
+  /** How many times the editor was asked to take focus back. */
+  focusCount: () => number
   emitMouseMove: (lineNumber: number) => void
   emitDispose: () => void
   /** Viewport-relative Y for a line, as the fake hit-test reads it. */
@@ -69,6 +71,7 @@ export function createFakeDiffCommentEditor(
   let scrollTop = 0
   let decorations: FakeDecoration[] = []
   let decorationWrites = 0
+  let focusCount = 0
   const mouseMoveListeners: ((e: { target: { position: { lineNumber: number } } }) => void)[] = []
   const disposeListeners: (() => void)[] = []
   const noopDisposable: IDisposable = { dispose: () => {} }
@@ -100,6 +103,9 @@ export function createFakeDiffCommentEditor(
     getScrollHeight: () => lineCount * FAKE_LINE_HEIGHT_PX,
     getLayoutInfo: () => ({ height: FAKE_EDITOR_HEIGHT_PX, contentLeft: 60 }),
     getSelection: () => null,
+    focus: () => {
+      focusCount += 1
+    },
     deltaDecorations: () => [],
     createDecorationsCollection: () => ({
       set: (next: MonacoEditor.IModelDeltaDecoration[]) => {
@@ -161,6 +167,7 @@ export function createFakeDiffCommentEditor(
     decorations: () => decorations,
     decorationWrites: () => decorationWrites,
     scrollTop: () => scrollTop,
+    focusCount: () => focusCount,
     clientYForLine,
     setLineCount: (next) => {
       lineCount = next
diff --git a/src/renderer/src/components/diff-comments/diff-comment-view-zone-entry.ts b/src/renderer/src/components/diff-comments/diff-comment-view-zone-entry.ts
index 7e72732a608..56e785f51b3 100644
--- a/src/renderer/src/components/diff-comments/diff-comment-view-zone-entry.ts
+++ b/src/renderer/src/components/diff-comments/diff-comment-view-zone-entry.ts
@@ -13,13 +13,37 @@ export type ZoneEntry = {
   laidOut: boolean
 }
 
+export type DraftZoneEntry = {
+  editor: monacoEditor.ICodeEditor
+  zoneId: string
+  domNode: HTMLElement
+  marginDomNode: HTMLElement
+  delegate: monacoEditor.IViewZone
+  root: Root
+  draft: { lineNumber: number; startLine?: number }
+  body: string
+  // A save is in flight: the body must not be carried to another card, or the note could post twice.
+  submitting: boolean
+  disposeMouseDownStopper: () => void
+}
+
 // Card chrome + per-line body height; used by the initial estimate and the live resize, so keep in lockstep.
 export const ZONE_CHROME_PX = 68
 export const ZONE_LINE_PX = 20
 export const ZONE_MIN_PX = 88
+export const DRAFT_ZONE_DEFAULT_HEIGHT = 152
+
+export type ResizableZoneEntry = {
+  zoneId: string
+  domNode: HTMLElement
+  delegate: monacoEditor.IViewZone
+}
 
 // Re-measure/re-layout the zone: mutate delegate.heightInPx first (Monaco's _layoutZone re-reads it) so inline edit expands without clipping.
-export function resizeDiffCommentZone(editor: monacoEditor.ICodeEditor, entry: ZoneEntry): void {
+export function resizeDiffCommentZone(
+  editor: monacoEditor.ICodeEditor,
+  entry: ResizableZoneEntry
+): void {
   const child = entry.domNode.firstElementChild
   const wrapperStyle = window.getComputedStyle(entry.domNode)
   const verticalPadding =
diff --git a/src/renderer/src/components/diff-comments/diff-comment-zone-card.tsx b/src/renderer/src/components/diff-comments/diff-comment-zone-card.tsx
index 097b70d7972..d34de51a2bc 100644
--- a/src/renderer/src/components/diff-comments/diff-comment-zone-card.tsx
+++ b/src/renderer/src/components/diff-comments/diff-comment-zone-card.tsx
@@ -5,6 +5,7 @@ import { formatDiffComments } from '@/lib/diff-comments-format'
 import { TooltipProvider } from '@/components/ui/tooltip'
 import type { DiffCommentDeliverySnapshot } from '@/store/slices/diffComments'
 import { DiffCommentCard } from './DiffCommentCard'
+import { DiffCommentDraftCard } from './DiffCommentDraftCard'
 import type { DecoratedDiffComment } from './decorated-diff-comment'
 import { NotesSendMenu, type NotesSendMenuScope } from '../editor/NotesSendMenu'
 import { translate } from '@/i18n/i18n'
@@ -118,3 +119,46 @@ export function renderDiffCommentZoneCard(
     </TooltipProvider>
   )
 }
+
+export type DiffCommentDraftCardContext = {
+  placeholder?: string
+  submitLabel?: string
+  submittingLabel?: string
+  initialBody?: string
+  onBodyChange?: (body: string) => void
+  resizeZone: () => void
+  onCancel: () => void
+  onSubmit: (body: string) => Promise<boolean>
+}
+
+export function renderDiffCommentDraftCard(
+  root: Root,
+  draft: { lineNumber: number; startLine?: number },
+  {
+    placeholder,
+    submitLabel,
+    submittingLabel,
+    initialBody,
+    onBodyChange,
+    resizeZone,
+    onCancel,
+    onSubmit
+  }: DiffCommentDraftCardContext
+): void {
+  root.render(
+    <TooltipProvider delayDuration={400}>
+      <DiffCommentDraftCard
+        lineNumber={draft.lineNumber}
+        startLine={draft.startLine}
+        placeholder={placeholder}
+        submitLabel={submitLabel}
+        submittingLabel={submittingLabel}
+        initialBody={initialBody}
+        onBodyChange={onBodyChange}
+        onCancel={onCancel}
+        onSubmit={onSubmit}
+        onContentResize={resizeZone}
+      />
+    </TooltipProvider>
+  )
+}
diff --git a/src/renderer/src/components/diff-comments/useDiffCommentDecorator.range-selection.test.tsx b/src/renderer/src/components/diff-comments/useDiffCommentDecorator.range-selection.test.tsx
index e09747b5932..2708e63a137 100644
--- a/src/renderer/src/components/diff-comments/useDiffCommentDecorator.range-selection.test.tsx
+++ b/src/renderer/src/components/diff-comments/useDiffCommentDecorator.range-selection.test.tsx
@@ -1,5 +1,5 @@
 // @vitest-environment happy-dom
-import { renderHook } from '@testing-library/react'
+import { act, renderHook } from '@testing-library/react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { Selection } from 'monaco-editor'
 import type * as DiffCommentZoneCardModule from './diff-comment-zone-card'
@@ -37,6 +37,12 @@ type DecoratorProps = {
   commentableLineNumbers?: readonly number[]
   addNoteShortcutEnabled?: boolean
   onAddCommentClick?: (args: { lineNumber: number; startLine?: number; top: number }) => void
+  // Present on the inline-draft surfaces; absent for the legacy popover callers.
+  onCreateComment?: (args: {
+    lineNumber: number
+    startLine?: number
+    body: string
+  }) => Promise<boolean>
 }
 
 function renderDecorator(fake: FakeDiffCommentEditor, initialProps: DecoratorProps = {}) {
@@ -51,6 +57,7 @@ function renderDecorator(fake: FakeDiffCommentEditor, initialProps: DecoratorPro
         pendingCommentTarget: props.pendingCommentTarget ?? null,
         addNoteShortcutEnabled: props.addNoteShortcutEnabled ?? false,
         onAddCommentClick: props.onAddCommentClick ?? vi.fn(),
+        onCreateComment: props.onCreateComment,
         onDeleteComment: vi.fn()
       }),
     { initialProps }
@@ -102,19 +109,19 @@ function firePointerEvent(
 }
 
 // Mod+Shift+A on the platform this test's user agent reports.
-function pressAddReviewNoteChord(node: HTMLElement): void {
+function pressAddReviewNoteChord(node: HTMLElement): KeyboardEvent {
   const isMac = navigator.userAgent.includes('Mac')
-  node.dispatchEvent(
-    new KeyboardEvent('keydown', {
-      key: 'A',
-      code: 'KeyA',
-      shiftKey: true,
-      metaKey: isMac,
-      ctrlKey: !isMac,
-      bubbles: true,
-      cancelable: true
-    })
-  )
+  const event = new KeyboardEvent('keydown', {
+    key: 'A',
+    code: 'KeyA',
+    shiftKey: true,
+    metaKey: isMac,
+    ctrlKey: !isMac,
+    bubbles: true,
+    cancelable: true
+  })
+  node.dispatchEvent(event)
+  return event
 }
 
 const frameCallbacks: FrameRequestCallback[] = []
@@ -377,4 +384,29 @@ describe('useDiffCommentDecorator add-note chord', () => {
 
     expect(onAddCommentClick).toHaveBeenCalledTimes(1)
   })
+
+  it('leaves the chord to an open inline draft card instead of re-anchoring it', () => {
+    const fake = createFakeDiffCommentEditor()
+    vi.spyOn(fake.editor, 'getSelection').mockReturnValue(selectionOf(9, 1, 14, 8))
+    renderDecorator(fake, {
+      addNoteShortcutEnabled: true,
+      onCreateComment: vi.fn().mockResolvedValue(true)
+    })
+
+    act(() => {
+      pressAddReviewNoteChord(fake.domNode)
+    })
+    const [zone] = [...fake.zones.values()]
+    expect(zone?.afterLineNumber).toBe(14)
+
+    // The selection moved on, but the open card must keep its anchor and its text.
+    vi.spyOn(fake.editor, 'getSelection').mockReturnValue(selectionOf(30, 1, 32, 4))
+    const secondChord: { event?: KeyboardEvent } = {}
+    act(() => {
+      secondChord.event = pressAddReviewNoteChord(fake.domNode)
+    })
+
+    expect(secondChord.event?.defaultPrevented).toBe(true)
+    expect([...fake.zones.values()]).toEqual([zone])
+  })
 })
diff --git a/src/renderer/src/components/diff-comments/useDiffCommentDecorator.tsx b/src/renderer/src/components/diff-comments/useDiffCommentDecorator.tsx
index 6abbadc25cf..e94bb6fc59e 100644
--- a/src/renderer/src/components/diff-comments/useDiffCommentDecorator.tsx
+++ b/src/renderer/src/components/diff-comments/useDiffCommentDecorator.tsx
@@ -7,7 +7,6 @@ import {
   installDiffCommentAddButtonOverlay,
   type DiffCommentAddButtonOverlayHandle
 } from './diff-comment-add-button-overlay'
-import type { DiffCommentLineRange, DiffCommentLineTarget } from './diff-comment-line-range'
 import { installDiffCommentAddNoteShortcut } from './diff-comment-add-note-shortcut'
 import { installDiffCommentZoneMouseDownStopper } from './diff-comment-zone-mouse-events'
 import { getRenderSignature, renderDiffCommentZoneCard } from './diff-comment-zone-card'
@@ -19,6 +18,10 @@ import {
   ZONE_MIN_PX,
   type ZoneEntry
 } from './diff-comment-view-zone-entry'
+import type { DiffCommentLineRange, DiffCommentLineTarget } from './diff-comment-line-range'
+import { useDiffCommentDraftZone, type DiffCommentDraft } from './diff-comment-draft-zone'
+
+export type { DiffCommentDraft }
 
 type DecoratorArgs = {
   editor: monacoEditor.ICodeEditor | null
@@ -29,13 +32,19 @@ type DecoratorArgs = {
   comments: readonly DecoratedDiffComment[]
   commentableLineNumbers?: readonly number[]
   addButtonLabel?: string
-  // The open composer's anchor — pass the composer state itself. Its lines stay lit while the
-  // note is written, and because the composer owns the range the band cannot outlive it.
   pendingCommentTarget?: DiffCommentLineTarget | null
   // Bind the Add Review Note chord to this editor. Off for the markdown editor, which already
   // binds it through its own input bindings.
   addNoteShortcutEnabled?: boolean
-  onAddCommentClick: (args: { lineNumber: number; startLine?: number; top: number }) => void
+  onCreateComment?: (args: {
+    lineNumber: number
+    startLine?: number
+    body: string
+  }) => Promise<boolean>
+  draftPlaceholder?: string
+  draftSubmitLabel?: string
+  canOpenDraft?: boolean
+  onAddCommentClick?: (args: { lineNumber: number; startLine?: number; top: number }) => void
   onDeleteComment: (commentId: string) => void
   // Present only on surfaces that allow editing (local diffs); PR review notes are remote and can't be edited here.
   onUpdateComment?: (commentId: string, body: string) => Promise<boolean>
@@ -55,6 +64,10 @@ export function useDiffCommentDecorator({
   addButtonLabel = 'Add note for the AI',
   pendingCommentTarget = null,
   addNoteShortcutEnabled = false,
+  onCreateComment,
+  draftPlaceholder,
+  draftSubmitLabel,
+  canOpenDraft,
   onAddCommentClick,
   onDeleteComment,
   onUpdateComment,
@@ -68,8 +81,6 @@ export function useDiffCommentDecorator({
   )
   const hoverLineRef = useRef<number | null>(null)
   const overlayRef = useRef<DiffCommentAddButtonOverlayHandle | null>(null)
-  // Mirrored so the overlay's install effect can re-apply the live range without depending on it;
-  // the effect below owns the value, and runs in the same commit as the install.
   const pendingCommentRangeRef = useRef<DiffCommentLineRange | null>(null)
   const setPendingCommentRange = useCallback((range: DiffCommentLineRange | null): void => {
     pendingCommentRangeRef.current = range
@@ -82,16 +93,25 @@ export function useDiffCommentDecorator({
   // Stash the diff-zones effect's scrollToZone closure so the request-effect can invoke the latest version.
   const scrollToZoneRef = useRef<((commentId: string) => void) | null>(null)
   const scrollToZoneFrameRef = useRef<number | null>(null)
+
   // Stash callbacks in refs so the effect doesn't tear down + re-attach on every parent render (parent passes inline arrows) — avoids flicker.
-  const onAddCommentClickRef = useRef(onAddCommentClick)
   const onDeleteCommentRef = useRef(onDeleteComment)
   const onUpdateCommentRef = useRef(onUpdateComment)
   const onPendingScrollConsumedRef = useRef(onPendingScrollConsumed)
-  onAddCommentClickRef.current = onAddCommentClick
   onDeleteCommentRef.current = onDeleteComment
   onUpdateCommentRef.current = onUpdateComment
   onPendingScrollConsumedRef.current = onPendingScrollConsumed
 
+  const { onAddCommentClickRef, isDraftOpen } = useDiffCommentDraftZone({
+    editor,
+    monacoModelIdentity,
+    onCreateComment,
+    draftPlaceholder,
+    draftSubmitLabel,
+    canOpenDraft,
+    onAddCommentClick
+  })
+
   const cancelScrollToZoneFrame = useCallback((): void => {
     if (scrollToZoneFrameRef.current === null) {
       return
@@ -135,19 +155,13 @@ export function useDiffCommentDecorator({
       onAddCommentClickRef
     })
     overlayRef.current = overlay
-    // A rebuild (model swap, widened commentable set) must not drop the open composer's band.
     overlay.setPendingRange(pendingCommentRangeRef.current)
     return () => {
       overlayRef.current = null
       overlay.dispose()
     }
-    // Why: the pending range is read through a ref and applied by the effect below, so opening or
-    // closing a composer must not tear down and rebuild the overlay mid-gesture.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [addButtonLabel, commentableLineSet, editor, monacoModelIdentity])
+  }, [addButtonLabel, commentableLineSet, editor, monacoModelIdentity, onAddCommentClickRef])
 
-  // Keyed on the two line numbers, not the composer object: the composer's `top` is rewritten on
-  // every scroll frame, and none of that should reach a decoration write.
   const pendingLineNumber = pendingCommentTarget?.lineNumber ?? null
   const pendingStartLine = pendingCommentTarget?.startLine ?? null
   useEffect(() => {
@@ -158,6 +172,7 @@ export function useDiffCommentDecorator({
     setPendingCommentRange(range)
   }, [pendingLineNumber, pendingStartLine, setPendingCommentRange])
 
+  const hasDraftComposer = onCreateComment !== undefined
   useEffect(() => {
     if (!editor || !addNoteShortcutEnabled) {
       return
@@ -165,19 +180,24 @@ export function useDiffCommentDecorator({
     return installDiffCommentAddNoteShortcut({
       editor,
       commentableLineSet,
-      // The composer consumes the chord itself once open (DiffCommentPopover's guard); claiming
-      // it here as well would remount the composer over the user's draft. A live gutter drag owns
-      // the band the same way, and its range isn't committed yet — opening from the stale editor
-      // selection would remount the composer the moment the press lands.
+      // An open draft card owns the chord: claiming it here would re-open the card at the editor's
+      // selection and move the user's text. The card mounts synchronously, so a second chord in the
+      // same event turn already sees it. A live gutter drag owns the band the same way; opening
+      // from the stale editor selection during a drag would remount the card mid-gesture.
       isComposerOpen: () =>
-        pendingCommentRangeRef.current !== null || overlayRef.current?.isDragging() === true,
+        isDraftOpen() ||
+        pendingCommentRangeRef.current !== null ||
+        overlayRef.current?.isDragging() === true,
       onOpenComposer: (args) => {
-        // Claim synchronously so a second chord in the same event turn cannot open another draft
-        // before React commits the parent state update.
-        setPendingCommentRange({
-          startLine: args.startLine ?? args.lineNumber,
-          endLine: args.lineNumber
-        })
+        // Legacy popover callers commit composer state through React, so claim now or a same-turn
+        // repeat opens a second one; their pendingCommentTarget releases the claim on close. The
+        // inline draft card never passes one, so a claim here would never be released.
+        if (!hasDraftComposer) {
+          setPendingCommentRange({
+            startLine: args.startLine ?? args.lineNumber,
+            endLine: args.lineNumber
+          })
+        }
         onAddCommentClickRef.current(args)
       }
     })
@@ -185,7 +205,10 @@ export function useDiffCommentDecorator({
     addNoteShortcutEnabled,
     commentableLineSet,
     editor,
+    hasDraftComposer,
+    isDraftOpen,
     monacoModelIdentity,
+    onAddCommentClickRef,
     setPendingCommentRange
   ])
 
@@ -376,12 +399,12 @@ export function useDiffCommentDecorator({
     activeGroupId,
     cancelScrollToZoneFrame,
     clearDeliveredDiffComments,
+    comments,
     editor,
     filePath,
     formatCommentPrompt,
     monacoModelIdentity,
-    worktreeId,
-    comments
+    worktreeId
   ])
 
   // Scroll-to-note resolution splits across this effect (request after layout) and onDomNodeTop (before), via pendingScrollRef.
diff --git a/src/renderer/src/components/editor/CheckRunDetailsPanel.copy.test.tsx b/src/renderer/src/components/editor/CheckRunDetailsPanel.copy.test.tsx
index 23bc3d51c59..826b63ef4af 100644
--- a/src/renderer/src/components/editor/CheckRunDetailsPanel.copy.test.tsx
+++ b/src/renderer/src/components/editor/CheckRunDetailsPanel.copy.test.tsx
@@ -9,6 +9,7 @@ import { CheckRunDetailsPanel } from './CheckRunDetailsPanel'
 const writeClipboardText = vi.fn<(text: string) => Promise<void>>()
 
 vi.mock('@/i18n/i18n', () => ({
+  i18n: { language: 'en' },
   translate: (_key: string, fallback: string) => fallback
 }))
 
diff --git a/src/renderer/src/components/editor/DiffSectionBody.tsx b/src/renderer/src/components/editor/DiffSectionBody.tsx
index 3a21d282861..5ac46e17538 100644
--- a/src/renderer/src/components/editor/DiffSectionBody.tsx
+++ b/src/renderer/src/components/editor/DiffSectionBody.tsx
@@ -1,10 +1,8 @@
-import type { RefObject } from 'react'
 import { lazyWithRetry as lazy } from '@/lib/lazy-with-retry'
 import { AlertCircle, RefreshCw } from 'lucide-react'
 import { DiffEditor, type DiffOnMount } from '@monaco-editor/react'
 import { cn } from '@/lib/utils'
 import { Button } from '@/components/ui/button'
-import { DiffCommentPopover } from '../diff-comments/DiffCommentPopover'
 import { combinedDiffSectionScrollbarOptions } from './diff-editor-scrollbar-options'
 import { isCombinedDiffSizeUnknown } from './combined-diff-on-demand-load'
 import type { DiffSection } from './diff-section-types'
@@ -21,18 +19,8 @@ const ImageDiffViewer = lazy(() => import('./ImageDiffViewer'))
 type DiffSectionBodyProps = {
   section: DiffSection
   index: number
-  sectionBodyRef: RefObject<HTMLDivElement | null>
   sectionBodyHeight: number | undefined
   useIntrinsicImageHeight: boolean
-  popover: {
-    lineNumber: number
-    startLine?: number
-    top: number
-    left?: number
-    lineHeight: number
-  } | null
-  addLineCommentPlaceholder?: string
-  addLineCommentLabel?: string
   isBranchMode: boolean
   sideBySide: boolean
   isDark: boolean
@@ -43,8 +31,6 @@ type DiffSectionBodyProps = {
   diffWordWrap?: boolean
   diffShowWhitespace?: boolean
   editorFontFamily?: string
-  onCancelComment: () => void
-  onSubmitComment: (body: string) => Promise<void>
   onRetrySection: (index: number) => void
   onLoadDeferredSection: (index: number) => void
   onSaveLimitedDiff: () => void
@@ -54,12 +40,8 @@ type DiffSectionBodyProps = {
 export function DiffSectionBody({
   section,
   index,
-  sectionBodyRef,
   sectionBodyHeight,
   useIntrinsicImageHeight,
-  popover,
-  addLineCommentPlaceholder,
-  addLineCommentLabel,
   isBranchMode,
   sideBySide,
   isDark,
@@ -70,8 +52,6 @@ export function DiffSectionBody({
   diffWordWrap,
   diffShowWhitespace,
   editorFontFamily,
-  onCancelComment,
-  onSubmitComment,
   onRetrySection,
   onLoadDeferredSection,
   onSaveLimitedDiff,
@@ -86,27 +66,9 @@ export function DiffSectionBody({
 
   return (
     <div
-      ref={sectionBodyRef}
       className={cn('relative', useIntrinsicImageHeight && 'overflow-visible')}
       style={sectionBodyHeight === undefined ? undefined : { height: sectionBodyHeight }}
     >
-      {popover && !renderLimit?.limited ? (
-        // Why: key by lineNumber so the popover remounts when the anchor
-        // line changes instead of leaking draft state across lines.
-        <DiffCommentPopover
-          key={`${popover.startLine ?? popover.lineNumber}:${popover.lineNumber}`}
-          lineNumber={popover.lineNumber}
-          startLine={popover.startLine}
-          top={popover.top}
-          left={popover.left}
-          lineHeight={popover.lineHeight}
-          placeholder={addLineCommentPlaceholder}
-          submitLabel={addLineCommentLabel}
-          submittingLabel="Posting…"
-          onCancel={onCancelComment}
-          onSubmit={onSubmitComment}
-        />
-      ) : null}
       {section.loadOnDemand ? (
         <LargeDiffLoadPrompt
           sizeUnknown={isCombinedDiffSizeUnknown(section)}
@@ -204,6 +166,8 @@ export function DiffSectionBody({
           keepCurrentOriginalModel
           keepCurrentModifiedModel
           options={{
+            // Native EditContext focus scrolls its hidden input into the combined viewport.
+            editContext: false,
             readOnly: !isEditable,
             originalEditable: false,
             renderSideBySide: sideBySide,
diff --git a/src/renderer/src/components/editor/DiffSectionItem.tsx b/src/renderer/src/components/editor/DiffSectionItem.tsx
index d1be74ca199..45ddd300f22 100644
--- a/src/renderer/src/components/editor/DiffSectionItem.tsx
+++ b/src/renderer/src/components/editor/DiffSectionItem.tsx
@@ -1,16 +1,11 @@
-import { useEffect, useMemo, useRef, useState } from 'react'
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import type { DiffOnMount } from '@monaco-editor/react'
 import type { editor as monacoEditor } from 'monaco-editor'
-import { monaco } from '@/lib/monaco-setup'
 import { detectLanguage } from '@/lib/language-detect'
 import { useAppStore } from '@/store'
 import { computeDiffEditorFontSize, resolveEditorFontFamily } from '@/lib/editor-font-zoom'
 import { selectWorktreeDiffComments } from '@/store/worktree-diff-comments-selector'
 import { useDiffCommentDecorator } from '../diff-comments/useDiffCommentDecorator'
-import {
-  getDiffCommentPopoverLeft,
-  getDiffCommentPopoverTop
-} from '../diff-comments/diff-comment-popover-position'
 import { applyDiffEditorLineNumberOptions } from './diff-editor-line-number-options'
 import { DiffSectionHeader } from './DiffSectionHeader'
 import type { DiffComment } from '../../../../shared/diff-comment-types'
@@ -82,15 +77,7 @@ export function DiffSectionItem({
 
   const [modifiedEditor, setModifiedEditor] = useState<monacoEditor.ICodeEditor | null>(null)
   const diffEditorRef = useRef<monacoEditor.IStandaloneDiffEditor | null>(null)
-  const sectionBodyRef = useRef<HTMLDivElement | null>(null)
   const lineNumberOptionsSubRef = useRef<{ dispose: () => void } | null>(null)
-  const [popover, setPopover] = useState<{
-    lineNumber: number
-    startLine?: number
-    top: number
-    left?: number
-    lineHeight: number
-  } | null>(null)
   const hasLineCommentAction = Boolean(worktreeId || onAddLineComment)
 
   const { disposeDiffModels, setSectionRootNode } = useDiffSectionModelLifecycle({
@@ -98,6 +85,12 @@ export function DiffSectionItem({
     collapsed: section.collapsed
   })
 
+  const { lineStats, sectionBodyHeight, useIntrinsicImageHeight, isLargeDiffLimited } =
+    useDiffSectionLayoutMetrics({
+      section,
+      sectionHeight
+    })
+
   // Why: only forward the pending scroll id when it matches a comment in this
   // section so unrelated sections don't keep re-rendering their decorator
   // every time the sidebar requests a scroll elsewhere.
@@ -108,25 +101,41 @@ export function DiffSectionItem({
     return diffComments.some((c) => c.id === scrollToDiffCommentId) ? scrollToDiffCommentId : null
   }, [scrollToDiffCommentId, diffComments])
 
+  const handleCreateComment = useCallback(
+    async ({
+      lineNumber,
+      startLine,
+      body
+    }: {
+      lineNumber: number
+      startLine?: number
+      body: string
+    }): Promise<boolean> => {
+      return submitDiffSectionComment({
+        addDiffComment,
+        body,
+        onAddLineComment,
+        target: { lineNumber, startLine },
+        section,
+        worktreeId
+      })
+    },
+    [addDiffComment, onAddLineComment, section, worktreeId]
+  )
+
   useDiffCommentDecorator({
     editor: hasLineCommentAction ? modifiedEditor : null,
+    monacoModelIdentity: `${modelPathBase}:modified`,
     filePath: section.path,
     worktreeId: worktreeId ?? '',
     comments: inlineComments ?? (worktreeId ? diffComments : []),
     commentableLineNumbers: getCommentableLineNumbers?.(section),
     addButtonLabel: addLineCommentLabel,
-    pendingCommentTarget: popover,
     addNoteShortcutEnabled: hasLineCommentAction,
-    onAddCommentClick: ({ lineNumber, startLine, top }) =>
-      setPopover({
-        lineNumber,
-        startLine,
-        top,
-        left: modifiedEditor
-          ? (getDiffCommentPopoverLeft(modifiedEditor, sectionBodyRef.current) ?? undefined)
-          : undefined,
-        lineHeight: modifiedEditor?.getOption(monaco.editor.EditorOption.lineHeight) ?? 0
-      }),
+    onCreateComment: handleCreateComment,
+    draftPlaceholder: addLineCommentPlaceholder,
+    draftSubmitLabel: addLineCommentLabel,
+    canOpenDraft: !isLargeDiffLimited,
     onDeleteComment: (id) => {
       if (worktreeId) {
         void deleteDiffComment(worktreeId, id)
@@ -137,36 +146,6 @@ export function DiffSectionItem({
     onPendingScrollConsumed: () => setScrollToDiffCommentId(null)
   })
 
-  useEffect(() => {
-    if (!modifiedEditor || !popover) {
-      return
-    }
-    const update = (): void => {
-      const lineHeight = modifiedEditor.getOption(monaco.editor.EditorOption.lineHeight)
-      const top = getDiffCommentPopoverTop(modifiedEditor, popover.lineNumber, lineHeight)
-      if (top == null) {
-        setPopover(null)
-        return
-      }
-      const left = getDiffCommentPopoverLeft(modifiedEditor, sectionBodyRef.current)
-      setPopover((prev) =>
-        prev ? { ...prev, top, left: left == null ? prev.left : left, lineHeight } : prev
-      )
-    }
-    const scrollSub = modifiedEditor.onDidScrollChange(update)
-    const contentSub = modifiedEditor.onDidContentSizeChange(update)
-    const layoutSub = modifiedEditor.onDidLayoutChange(update)
-    return () => {
-      scrollSub.dispose()
-      contentSub.dispose()
-      layoutSub.dispose()
-    }
-    // Why: depend on popover.lineNumber (not the whole popover object) so the
-    // effect doesn't re-subscribe on every top update it dispatches. The guard
-    // on `popover` above handles the popover-closed case.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [modifiedEditor, popover?.lineNumber])
-
   useEffect(() => {
     const diffEditor = diffEditorRef.current
     if (!diffEditor) {
@@ -180,29 +159,6 @@ export function DiffSectionItem({
     }
   }, [sideBySide])
 
-  const handleSubmitComment = async (body: string): Promise<void> => {
-    if (!popover) {
-      return
-    }
-    const submitted = await submitDiffSectionComment({
-      addDiffComment,
-      body,
-      onAddLineComment,
-      popover,
-      section,
-      worktreeId
-    })
-    if (submitted) {
-      setPopover(null)
-    }
-  }
-
-  const { lineStats, sectionBodyHeight, useIntrinsicImageHeight, isLargeDiffLimited } =
-    useDiffSectionLayoutMetrics({
-      section,
-      sectionHeight
-    })
-
   useDiffSectionFallbackCleanup({
     disposeDiffModels,
     index,
@@ -256,7 +212,7 @@ export function DiffSectionItem({
     // Why: Monaco disposes inner editors when the DiffEditor container is
     // unmounted (e.g. section collapse, tab change). Clearing the state
     // prevents decorator effects and scroll subscriptions from invoking
-    // methods on a disposed editor instance, and avoids `popover` pointing
+    // methods on a disposed editor instance, and avoids stale draft state pointing
     // at a line in an editor that no longer exists.
     modified.onDidDispose(() => {
       contentSizeSub.dispose()
@@ -272,7 +228,6 @@ export function DiffSectionItem({
         modifiedEditorsRef.current.delete(index)
       }
       setModifiedEditor(null)
-      setPopover(null)
     })
 
     if (!isEditable) {
@@ -361,12 +316,8 @@ export function DiffSectionItem({
         <DiffSectionBody
           section={section}
           index={index}
-          sectionBodyRef={sectionBodyRef}
           sectionBodyHeight={sectionBodyHeight}
           useIntrinsicImageHeight={useIntrinsicImageHeight}
-          popover={popover}
-          addLineCommentPlaceholder={addLineCommentPlaceholder}
-          addLineCommentLabel={addLineCommentLabel}
           isBranchMode={isBranchMode}
           sideBySide={sideBySide}
           isDark={isDark}
@@ -377,8 +328,6 @@ export function DiffSectionItem({
           diffWordWrap={settings?.diffWordWrap}
           diffShowWhitespace={settings?.diffShowWhitespace}
           editorFontFamily={resolveEditorFontFamily(settings)}
-          onCancelComment={() => setPopover(null)}
-          onSubmitComment={handleSubmitComment}
           onRetrySection={retrySection}
           onLoadDeferredSection={loadDeferredSection ?? loadSection}
           onSaveLimitedDiff={() => void handleSectionSaveRef.current(index)}
diff --git a/src/renderer/src/components/editor/DiffViewer.tsx b/src/renderer/src/components/editor/DiffViewer.tsx
index 77610151f7e..a2697069df0 100644
--- a/src/renderer/src/components/editor/DiffViewer.tsx
+++ b/src/renderer/src/components/editor/DiffViewer.tsx
@@ -3,16 +3,12 @@ import { DiffEditor, type DiffOnMount } from '@monaco-editor/react'
 import type { editor } from 'monaco-editor'
 import { useAppStore } from '@/store'
 import { diffViewStateCache, setWithLRU } from '@/lib/scroll-cache'
-import { monaco } from '@/lib/monaco-setup'
 import { computeDiffEditorFontSize, resolveEditorFontFamily } from '@/lib/editor-font-zoom'
 import { useContextualCopySetup } from './useContextualCopySetup'
 import { selectWorktreeDiffComments } from '@/store/worktree-diff-comments-selector'
 import { useDiffCommentDecorator } from '../diff-comments/useDiffCommentDecorator'
-import { DiffCommentPopover } from '../diff-comments/DiffCommentPopover'
-import {
-  getDiffCommentPopoverLeft,
-  getDiffCommentPopoverTop
-} from '../diff-comments/diff-comment-popover-position'
+import { toast } from 'sonner'
+import { translate } from '@/i18n/i18n'
 import { applyDiffEditorLineNumberOptions } from './diff-editor-line-number-options'
 import type { DiffComment } from '../../../../shared/diff-comment-types'
 import { isDiffComment } from '@/lib/diff-comment-compat'
@@ -30,7 +26,7 @@ import { buildDiffEditorHideUnchangedOptions } from './diff-editor-hide-unchange
 import { useDiffEditorRegistration } from './diff-navigation-context'
 import { preserveDiffViewStateAcrossModelSwaps } from './diff-model-swap-view-state'
 import { monacoFindOptions } from './monaco-find-options'
-import { resolveDocumentTheme } from '@/lib/document-theme'
+import { useDocumentDarkTheme } from '@/hooks/use-document-dark-theme'
 
 export default function DiffViewer({
   modelKey,
@@ -54,6 +50,7 @@ export default function DiffViewer({
   largeDiffSaveContentAvailable
 }: DiffViewerProps): React.JSX.Element {
   const settings = useAppStore((s) => s.settings)
+  const isDark = useDocumentDarkTheme()
   const editorFontZoomLevel = useAppStore((s) => s.editorFontZoomLevel)
   const addDiffComment = useAppStore((s) => s.addDiffComment)
   const deleteDiffComment = useAppStore((s) => s.deleteDiffComment)
@@ -73,16 +70,8 @@ export default function DiffViewer({
 
   const diffEditorRef = useRef<editor.IStandaloneDiffEditor | null>(null)
   const { registerDiffEditor, unregisterDiffEditor } = useDiffEditorRegistration()
-  const diffBodyRef = useRef<HTMLDivElement | null>(null)
   const lineNumberOptionsSubRef = useRef<{ dispose: () => void } | null>(null)
   const [modifiedEditor, setModifiedEditor] = useState<editor.ICodeEditor | null>(null)
-  const [popover, setPopover] = useState<{
-    lineNumber: number
-    startLine?: number
-    top: number
-    left?: number
-    lineHeight: number
-  } | null>(null)
 
   const renderLimit = useMemo(
     () => largeDiffRenderLimit ?? getLargeDiffRenderLimit({ originalContent, modifiedContent }),
@@ -98,6 +87,45 @@ export default function DiffViewer({
     return diffComments.some((c) => c.id === scrollToDiffCommentId) ? scrollToDiffCommentId : null
   }, [scrollToDiffCommentId, diffComments, worktreeId])
 
+  const handleCreateComment = useCallback(
+    async ({
+      lineNumber,
+      startLine,
+      body
+    }: {
+      lineNumber: number
+      startLine?: number
+      body: string
+    }): Promise<boolean> => {
+      if (onAddLineComment) {
+        return onAddLineComment({
+          lineNumber,
+          startLine,
+          body
+        })
+      }
+      if (!worktreeId) {
+        return false
+      }
+      const result = await addDiffComment({
+        worktreeId,
+        filePath: relativePath,
+        source: 'diff',
+        startLine,
+        lineNumber,
+        body,
+        side: 'modified'
+      })
+      if (!result) {
+        toast.error(
+          translate('auto.components.editor.diffCommentSaveFailed', 'Failed to save comment')
+        )
+      }
+      return Boolean(result)
+    },
+    [addDiffComment, onAddLineComment, relativePath, worktreeId]
+  )
+
   // Why: gate the decorator on a comment target; updateDiffComment is only wired for local diffs (worktreeId present).
   useDiffCommentDecorator({
     editor: hasLineCommentAction ? modifiedEditor : null,
@@ -107,18 +135,11 @@ export default function DiffViewer({
     comments: worktreeId ? diffComments : [],
     commentableLineNumbers,
     addButtonLabel: addLineCommentLabel,
-    pendingCommentTarget: popover,
     addNoteShortcutEnabled: hasLineCommentAction,
-    onAddCommentClick: ({ lineNumber, startLine, top }) =>
-      setPopover({
-        lineNumber,
-        startLine,
-        top,
-        left: modifiedEditor
-          ? (getDiffCommentPopoverLeft(modifiedEditor, diffBodyRef.current) ?? undefined)
-          : undefined,
-        lineHeight: modifiedEditor?.getOption(monaco.editor.EditorOption.lineHeight) ?? 0
-      }),
+    onCreateComment: handleCreateComment,
+    draftPlaceholder: addLineCommentPlaceholder,
+    draftSubmitLabel: addLineCommentLabel,
+    canOpenDraft: !renderLimit.limited,
     onDeleteComment: (id) => {
       if (worktreeId) {
         void deleteDiffComment(worktreeId, id)
@@ -129,34 +150,6 @@ export default function DiffViewer({
     onPendingScrollConsumed: () => setScrollToDiffCommentId(null)
   })
 
-  useEffect(() => {
-    if (!modifiedEditor || !popover) {
-      return
-    }
-    const update = (): void => {
-      const lineHeight = modifiedEditor.getOption(monaco.editor.EditorOption.lineHeight)
-      const top = getDiffCommentPopoverTop(modifiedEditor, popover.lineNumber, lineHeight)
-      if (top == null) {
-        setPopover(null)
-        return
-      }
-      const left = getDiffCommentPopoverLeft(modifiedEditor, diffBodyRef.current)
-      setPopover((prev) =>
-        prev ? { ...prev, top, left: left == null ? prev.left : left, lineHeight } : prev
-      )
-    }
-    const scrollSub = modifiedEditor.onDidScrollChange(update)
-    const contentSub = modifiedEditor.onDidContentSizeChange(update)
-    const layoutSub = modifiedEditor.onDidLayoutChange(update)
-    return () => {
-      scrollSub.dispose()
-      contentSub.dispose()
-      layoutSub.dispose()
-    }
-    // Why: depend on popover.lineNumber (not the whole object) so the effect doesn't re-subscribe on every top update.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [modifiedEditor, popover?.lineNumber])
-
   useDiffViewerFirstChangeAutoScroll({
     diffEditorRef,
     modifiedEditor,
@@ -175,44 +168,8 @@ export default function DiffViewer({
       unregisterDiffEditor(fallenBackEditor)
     }
     setModifiedEditor(null)
-    setPopover(null)
   }, [unregisterDiffEditor])
 
-  const handleSubmitComment = async (body: string): Promise<void> => {
-    if (!popover) {
-      return
-    }
-    if (onAddLineComment) {
-      const ok = await onAddLineComment({
-        lineNumber: popover.lineNumber,
-        startLine: popover.startLine,
-        body
-      })
-      if (ok) {
-        setPopover(null)
-      }
-      return
-    }
-    if (!worktreeId) {
-      return
-    }
-    // Why: await persistence — a null result (failed save) keeps the popover open for retry instead of losing the draft.
-    const result = await addDiffComment({
-      worktreeId,
-      filePath: relativePath,
-      source: 'diff',
-      startLine: popover.startLine,
-      lineNumber: popover.lineNumber,
-      body,
-      side: 'modified'
-    })
-    if (result) {
-      setPopover(null)
-    } else {
-      console.error('Failed to add diff comment — draft preserved')
-    }
-  }
-
   // Keep refs to latest callbacks so the mounted editor always calls current versions
   const onSaveRef = useRef(onSave)
   onSaveRef.current = onSave
@@ -287,7 +244,6 @@ export default function DiffViewer({
         diffEditorRef.current = null
         unregisterDiffEditor(diffEditor)
         setModifiedEditor(null)
-        setPopover(null)
       })
     },
     [editable, setupCopy, modelKey, filePath, sideBySide, registerDiffEditor, unregisterDiffEditor]
@@ -321,22 +277,7 @@ export default function DiffViewer({
 
   return (
     <div className="flex flex-col flex-1 min-h-0">
-      <div ref={diffBodyRef} className="flex-1 min-h-0 relative">
-        {popover && hasLineCommentAction && !renderLimit.limited && (
-          <DiffCommentPopover
-            key={`${popover.startLine ?? popover.lineNumber}:${popover.lineNumber}`}
-            lineNumber={popover.lineNumber}
-            startLine={popover.startLine}
-            top={popover.top}
-            left={popover.left}
-            lineHeight={popover.lineHeight}
-            placeholder={addLineCommentPlaceholder}
-            submitLabel={addLineCommentLabel}
-            submittingLabel="Posting…"
-            onCancel={() => setPopover(null)}
-            onSubmit={handleSubmitComment}
-          />
-        )}
+      <div className="flex-1 min-h-0 relative">
         {renderLimit.limited ? (
           <LargeDiffFallback
             filePath={relativePath}
@@ -354,7 +295,7 @@ export default function DiffViewer({
             language={language}
             original={originalContent}
             modified={modifiedContent}
-            theme={resolveDocumentTheme(settings?.theme ?? 'light') ? 'vs-dark' : 'vs'}
+            theme={isDark ? 'vs-dark' : 'vs'}
             onMount={handleMount}
             // Why: key models by tab identity and preserve the modified undo stack across Changes-mode HEAD rotations.
             originalModelPath={currentDiffModelPaths.originalModelPath}
diff --git a/src/renderer/src/components/editor/IpynbCellEditor.tsx b/src/renderer/src/components/editor/IpynbCellEditor.tsx
index 6e6689395a6..228bf57f6e3 100644
--- a/src/renderer/src/components/editor/IpynbCellEditor.tsx
+++ b/src/renderer/src/components/editor/IpynbCellEditor.tsx
@@ -12,7 +12,7 @@ import {
 import type { IpynbCell } from './ipynb-parse'
 import { MarkdownPreviewBody } from './MarkdownPreviewBody'
 import { useMonacoColorizedLines } from './MonacoCodeExcerpt'
-import { useDocumentDarkTheme } from './use-document-dark-theme'
+import { useDocumentDarkTheme } from '@/hooks/use-document-dark-theme'
 
 const NO_MARKDOWN_COMPONENTS: Components = {}
 // Box metrics the preview and the live editor share, so activating a cell never shifts it.
diff --git a/src/renderer/src/components/editor/IpynbCellOutputs.tsx b/src/renderer/src/components/editor/IpynbCellOutputs.tsx
index 5397fede139..950e913b9c3 100644
--- a/src/renderer/src/components/editor/IpynbCellOutputs.tsx
+++ b/src/renderer/src/components/editor/IpynbCellOutputs.tsx
@@ -9,7 +9,7 @@ import { IpynbMarkdownCell } from './IpynbCellEditor'
 import { IpynbHtmlOutput } from './IpynbHtmlOutput'
 import { parseAnsiSegments, type AnsiColor } from './ipynb-ansi'
 import type { IpynbCell, IpynbOutput, IpynbOutputItem } from './ipynb-parse'
-import { useDocumentDarkTheme } from './use-document-dark-theme'
+import { useDocumentDarkTheme } from '@/hooks/use-document-dark-theme'
 
 const ANSI_PALETTE_KEYS = [
   'black',
diff --git a/src/renderer/src/components/editor/IpynbCellToolbar.tsx b/src/renderer/src/components/editor/IpynbCellToolbar.tsx
index 04adc084904..2ca3f42b0b6 100644
--- a/src/renderer/src/components/editor/IpynbCellToolbar.tsx
+++ b/src/renderer/src/components/editor/IpynbCellToolbar.tsx
@@ -41,33 +41,47 @@ function cellKindLabel(kind: IpynbCellKind): string {
 export function IpynbToolbarButton({
   label,
   disabled = false,
+  disabledReason,
   shortcut,
   onClick,
   children
 }: {
   label: string
   disabled?: boolean
+  /** Shown instead of the label while disabled, so the user learns why. */
+  disabledReason?: string
   shortcut?: ShortcutKeyComboDetails
   onClick: () => void
   children: ReactNode
 }): React.JSX.Element {
+  const reason = disabled ? disabledReason : undefined
+  const button = (
+    <Button
+      type="button"
+      variant="ghost"
+      size="icon-xs"
+      aria-label={label}
+      disabled={disabled}
+      onClick={onClick}
+    >
+      {children}
+    </Button>
+  )
   return (
     <Tooltip>
       <TooltipTrigger asChild>
-        <Button
-          type="button"
-          variant="ghost"
-          size="icon-xs"
-          aria-label={label}
-          disabled={disabled}
-          onClick={onClick}
-        >
-          {children}
-        </Button>
+        {/* Why the span: a disabled button gets no pointer or focus events, so its tooltip never opens. */}
+        {reason ? (
+          <span tabIndex={0} aria-label={reason} className="inline-flex">
+            {button}
+          </span>
+        ) : (
+          button
+        )}
       </TooltipTrigger>
       <TooltipContent side="top" sideOffset={4}>
         <span className="flex items-center gap-2">
-          <span>{label}</span>
+          <span>{reason ?? label}</span>
           {shortcut && shortcut.keys.length > 0 ? (
             <ShortcutKeyCombo keys={shortcut.keys} doubleTap={shortcut.doubleTap} />
           ) : null}
diff --git a/src/renderer/src/components/editor/IpynbHtmlOutput.tsx b/src/renderer/src/components/editor/IpynbHtmlOutput.tsx
index 5ef92315121..2344f3a8504 100644
--- a/src/renderer/src/components/editor/IpynbHtmlOutput.tsx
+++ b/src/renderer/src/components/editor/IpynbHtmlOutput.tsx
@@ -1,7 +1,7 @@
 import { useMemo } from 'react'
 import DOMPurify from 'dompurify'
 import { translate } from '@/i18n/i18n'
-import { useDocumentDarkTheme } from './use-document-dark-theme'
+import { useDocumentDarkTheme } from '@/hooks/use-document-dark-theme'
 
 // Why: an opaque-origin, script-free frame with a no-network CSP keeps output markup inert;
 // its links aim at popups the sandbox blocks.
diff --git a/src/renderer/src/components/editor/IpynbKernelToolbar.test.tsx b/src/renderer/src/components/editor/IpynbKernelToolbar.test.tsx
index 71348f4839a..cd68eec18bc 100644
--- a/src/renderer/src/components/editor/IpynbKernelToolbar.test.tsx
+++ b/src/renderer/src/components/editor/IpynbKernelToolbar.test.tsx
@@ -1,25 +1,100 @@
 // @vitest-environment happy-dom
-import { cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { act, cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { TooltipProvider } from '@/components/ui/tooltip'
 
-vi.hoisted(() => {
+const { listPythonEnvironments } = vi.hoisted(() => {
+  const listPythonEnvironments = vi.fn()
   // The kernel session subscribes to kernel frames when it loads.
   Object.defineProperty(window, 'api', {
     configurable: true,
-    value: { notebook: { onKernelFrame: () => () => {} } }
+    value: { notebook: { onKernelFrame: () => () => {}, listPythonEnvironments } }
   })
+  return { listPythonEnvironments }
 })
 vi.mock('@/i18n/i18n', () => ({ translate: (_key: string, fallback: string) => fallback }))
 vi.mock('@/store', () => ({ useAppStore: { subscribe: () => () => {} } }))
 
 import { IpynbKernelToolbar } from './IpynbKernelToolbar'
+import { trustNotebook } from './ipynb-kernel-session'
 import { getSession, setEnvironment, updateSession } from './ipynb-kernel-store'
 
 const FILE = '/repo/nb.ipynb'
+const CREATE_VENV = /^Create virtual environment…/
+const TRUST_FIRST = 'Run a cell to trust this notebook first'
 
 afterEach(cleanup)
 
+function renderToolbar(filePath: string) {
+  return render(
+    <TooltipProvider>
+      <IpynbKernelToolbar
+        filePath={filePath}
+        rootPath="/repo"
+        onRunAll={vi.fn()}
+        onClearAll={vi.fn()}
+      />
+    </TooltipProvider>
+  )
+}
+
+function togglePicker(label: string): void {
+  fireEvent.pointerDown(screen.getByRole('button', { name: label }), {
+    button: 0,
+    ctrlKey: false,
+    pointerType: 'mouse'
+  })
+}
+
+describe('kernel picker trust', () => {
+  it('lists workspace envs without running them until the notebook is trusted', async () => {
+    const file = '/repo/untrusted.ipynb'
+    const venv = { path: '/repo/.venv/bin/python', name: '.venv' }
+    listPythonEnvironments.mockResolvedValue({
+      workspace: [venv],
+      path: [{ path: '/usr/bin/python3', name: 'python3', version: '3.12.1' }]
+    })
+    renderToolbar(file)
+
+    togglePicker('Select Kernel')
+    await screen.findByText('/repo/.venv/bin/python')
+    expect(listPythonEnvironments).toHaveBeenLastCalledWith({
+      filePath: file,
+      rootPath: '/repo',
+      runWorkspaceInterpreters: false
+    })
+    // A version read from nowhere shows the bare env name.
+    expect(screen.getByText('.venv')).toBeTruthy()
+    // Creating a .venv would reuse, and so run, one the repo shipped; the item says why it is off.
+    expect(screen.getByRole('menuitem', { name: CREATE_VENV }).dataset.disabled).toBe('')
+    expect(screen.getByText(TRUST_FIRST)).toBeTruthy()
+
+    act(() => trustNotebook(file))
+    await waitFor(() =>
+      expect(listPythonEnvironments).toHaveBeenLastCalledWith({
+        filePath: file,
+        rootPath: '/repo',
+        runWorkspaceInterpreters: true
+      })
+    )
+    expect(screen.getByRole('menuitem', { name: CREATE_VENV }).dataset.disabled).toBeUndefined()
+    expect(screen.queryByText(TRUST_FIRST)).toBeNull()
+  })
+
+  it('keeps Restart kernel disabled, and says why, until the notebook is trusted', () => {
+    const file = '/repo/saved-env.ipynb'
+    setEnvironment(file, { path: '/repo/.venv/bin/python', name: '.venv', version: '3.12.1' })
+    renderToolbar(file)
+    expect(screen.getByRole('button', { name: 'Restart kernel' })).toHaveProperty('disabled', true)
+    // The focusable wrapper is what lets the disabled button's tooltip open.
+    expect(screen.getByLabelText(TRUST_FIRST).getAttribute('tabindex')).toBe('0')
+
+    act(() => trustNotebook(file))
+    expect(screen.getByRole('button', { name: 'Restart kernel' })).toHaveProperty('disabled', false)
+    expect(screen.queryByLabelText(TRUST_FIRST)).toBeNull()
+  })
+})
+
 describe('ipykernel setup dialog', () => {
   it('Cancel drops the waiting cells, as Esc does', () => {
     const venv = { path: '/repo/.venv/bin/python', name: '.venv', version: '3.12.1' }
diff --git a/src/renderer/src/components/editor/IpynbKernelToolbar.tsx b/src/renderer/src/components/editor/IpynbKernelToolbar.tsx
index c15b4f69c13..00092c3719c 100644
--- a/src/renderer/src/components/editor/IpynbKernelToolbar.tsx
+++ b/src/renderer/src/components/editor/IpynbKernelToolbar.tsx
@@ -40,7 +40,7 @@ import { useNotebookKernelState } from './ipynb-kernel-store'
 type KernelState = ReturnType<typeof useNotebookKernelState>
 
 function environmentLabel({ name, version }: PythonEnvironment): string {
-  return `${name} (Python ${version})`
+  return version ? `${name} (Python ${version})` : name
 }
 
 function kernelLabel({ environment, status, setup }: KernelState): string {
@@ -109,21 +109,27 @@ export function IpynbKernelToolbar({
     kernel.status === 'starting' || (kernel.setup !== null && kernel.setup.phase !== 'idle')
   // A PATH interpreter, not the selected one: that may be the very .venv being (re)created.
   const venvBase = environments?.path[0]
+  const untrustedHint = translate(
+    'auto.components.editor.IpynbViewer.trustFirst',
+    'Run a cell to trust this notebook first'
+  )
 
   useEffect(() => {
     if (!pickerOpen) {
       return
     }
     let current = true
-    void window.api.notebook.listPythonEnvironments({ filePath, rootPath }).then((found) => {
-      if (current) {
-        setEnvironments(found)
-      }
-    })
+    void window.api.notebook
+      .listPythonEnvironments({ filePath, rootPath, runWorkspaceInterpreters: kernel.trusted })
+      .then((found) => {
+        if (current) {
+          setEnvironments(found)
+        }
+      })
     return () => {
       current = false
     }
-  }, [filePath, pickerOpen, rootPath])
+  }, [filePath, kernel.trusted, pickerOpen, rootPath])
 
   const choose = (path: string): void => {
     const environment = [...(environments?.workspace ?? []), ...(environments?.path ?? [])].find(
@@ -146,7 +152,9 @@ export function IpynbKernelToolbar({
       ) : null}
       <IpynbToolbarButton
         label={translate('auto.components.editor.IpynbViewer.restart', 'Restart kernel')}
-        disabled={!kernel.environment || settling}
+        // No kernel can start before trust, so a restart there would silently do nothing.
+        disabled={!kernel.environment || !kernel.trusted || settling}
+        disabledReason={kernel.environment && !kernel.trusted ? untrustedHint : undefined}
         onClick={() => restartKernel(filePath)}
       >
         <RotateCcw />
@@ -220,8 +228,9 @@ export function IpynbKernelToolbar({
             <FolderOpen />
             {translate('auto.components.editor.IpynbViewer.browsePython', 'Browse for Python…')}
           </DropdownMenuItem>
+          {/* Why trusted: it reuses an existing .venv, running a Python the repo may have shipped. */}
           <DropdownMenuItem
-            disabled={!venvBase}
+            disabled={!venvBase || !kernel.trusted}
             onSelect={() => {
               if (venvBase) {
                 offerVirtualEnvironment(filePath, venvBase)
@@ -229,10 +238,17 @@ export function IpynbKernelToolbar({
             }}
           >
             <Plus />
-            {translate(
-              'auto.components.editor.IpynbViewer.createVenvItem',
-              'Create virtual environment…'
-            )}
+            <span className="flex min-w-0 flex-col">
+              <span>
+                {translate(
+                  'auto.components.editor.IpynbViewer.createVenvItem',
+                  'Create virtual environment…'
+                )}
+              </span>
+              {venvBase && !kernel.trusted ? (
+                <span className="text-xs text-muted-foreground">{untrustedHint}</span>
+              ) : null}
+            </span>
           </DropdownMenuItem>
         </DropdownMenuContent>
       </DropdownMenu>
diff --git a/src/renderer/src/components/editor/IpynbRendering.test.tsx b/src/renderer/src/components/editor/IpynbRendering.test.tsx
index 2086e6b1878..a3fd55808eb 100644
--- a/src/renderer/src/components/editor/IpynbRendering.test.tsx
+++ b/src/renderer/src/components/editor/IpynbRendering.test.tsx
@@ -7,8 +7,11 @@ import { IpynbRunPrompt } from './IpynbCellToolbar'
 import { TooltipProvider } from '@/components/ui/tooltip'
 import type { IpynbCell, IpynbOutput } from './ipynb-parse'
 
-vi.mock('@/i18n/i18n', () => ({ translate: (_key: string, fallback: string) => fallback }))
-vi.mock('./use-document-dark-theme', () => ({ useDocumentDarkTheme: () => true }))
+vi.mock('@/i18n/i18n', () => ({
+  i18n: { language: 'en' },
+  translate: (_key: string, fallback: string) => fallback
+}))
+vi.mock('@/hooks/use-document-dark-theme', () => ({ useDocumentDarkTheme: () => true }))
 vi.mock('@/lib/monaco-setup', () => ({ monaco: {} }))
 vi.mock('./MonacoCodeExcerpt', () => ({
   useMonacoColorizedLines: () => []
diff --git a/src/renderer/src/components/editor/MarkdownPreview.link-routing.interaction.test.tsx b/src/renderer/src/components/editor/MarkdownPreview.link-routing.interaction.test.tsx
index 9be38fdb1d2..e244a50865a 100644
--- a/src/renderer/src/components/editor/MarkdownPreview.link-routing.interaction.test.tsx
+++ b/src/renderer/src/components/editor/MarkdownPreview.link-routing.interaction.test.tsx
@@ -71,7 +71,10 @@ vi.mock('@/lib/connection-context', () => ({
 vi.mock('@/lib/connection-owner-resolution', () => ({
   createConnectionIdForFileSelector: () => () => connectionOwner.value
 }))
-vi.mock('@/i18n/i18n', () => ({ translate: (_key: string, fallback: string) => fallback }))
+vi.mock('@/i18n/i18n', () => ({
+  i18n: { language: 'en' },
+  translate: (_key: string, fallback: string) => fallback
+}))
 vi.mock('./useLocalImageSrc', () => ({ useLocalImageSrc: (src?: string) => src }))
 vi.mock('./MermaidBlock', () => ({ default: () => null }))
 vi.mock('./CodeBlockCopyButton', () => ({
diff --git a/src/renderer/src/components/editor/MarkdownPreview.toc-visibility-gate.test.tsx b/src/renderer/src/components/editor/MarkdownPreview.toc-visibility-gate.test.tsx
index 23f66fa9ee5..645d1f556d6 100644
--- a/src/renderer/src/components/editor/MarkdownPreview.toc-visibility-gate.test.tsx
+++ b/src/renderer/src/components/editor/MarkdownPreview.toc-visibility-gate.test.tsx
@@ -55,7 +55,10 @@ vi.mock('@/lib/connection-context', () => ({ getConnectionIdForFile: () => null
 vi.mock('@/lib/connection-owner-resolution', () => ({
   createConnectionIdForFileSelector: () => () => null
 }))
-vi.mock('@/i18n/i18n', () => ({ translate: (_key: string, fallback: string) => fallback }))
+vi.mock('@/i18n/i18n', () => ({
+  i18n: { language: 'en' },
+  translate: (_key: string, fallback: string) => fallback
+}))
 vi.mock('./useLocalImageSrc', () => ({ useLocalImageSrc: (src?: string) => src }))
 vi.mock('./MermaidBlock', () => ({ default: () => null }))
 vi.mock('./CodeBlockCopyButton', () => ({
diff --git a/src/renderer/src/components/editor/MermaidViewer.tsx b/src/renderer/src/components/editor/MermaidViewer.tsx
index 722a8046a4a..97561212dc8 100644
--- a/src/renderer/src/components/editor/MermaidViewer.tsx
+++ b/src/renderer/src/components/editor/MermaidViewer.tsx
@@ -1,7 +1,7 @@
 import React, { useLayoutEffect, useRef } from 'react'
-import { useAppStore } from '@/store'
 import { scrollTopCache, setWithLRU } from '@/lib/scroll-cache'
 import MermaidBlock from './MermaidBlock'
+import { useDocumentDarkTheme } from '@/hooks/use-document-dark-theme'
 
 type MermaidViewerProps = {
   content: string
@@ -17,10 +17,7 @@ export default function MermaidViewer({
   filePath
 }: MermaidViewerProps): React.JSX.Element {
   const rootRef = useRef<HTMLDivElement>(null)
-  const settings = useAppStore((s) => s.settings)
-  const isDark =
-    settings?.theme === 'dark' ||
-    (settings?.theme === 'system' && window.matchMedia('(prefers-color-scheme: dark)').matches)
+  const isDark = useDocumentDarkTheme()
 
   // Why: Each viewing mode (source vs diagram) produces different DOM heights.
   // Mode-scoped keys prevent restoring a source-mode scroll position in diagram
diff --git a/src/renderer/src/components/editor/MonacoCodeExcerpt.tsx b/src/renderer/src/components/editor/MonacoCodeExcerpt.tsx
index 9bd60e16948..1e2b31eb6ee 100644
--- a/src/renderer/src/components/editor/MonacoCodeExcerpt.tsx
+++ b/src/renderer/src/components/editor/MonacoCodeExcerpt.tsx
@@ -3,7 +3,7 @@ import { monaco } from '@/lib/monaco-setup'
 import { computeEditorFontSize, resolveEditorFontFamily } from '@/lib/editor-font-zoom'
 import { useAppStore } from '@/store'
 import { cn } from '@/lib/utils'
-import { useDocumentDarkTheme } from './use-document-dark-theme'
+import { useDocumentDarkTheme } from '@/hooks/use-document-dark-theme'
 
 let pythonLanguageRegistrationPromise: Promise<void> | null = null
 
diff --git a/src/renderer/src/components/editor/MonacoEditor.system-theme.test.tsx b/src/renderer/src/components/editor/MonacoEditor.system-theme.test.tsx
new file mode 100644
index 00000000000..9f1065591a4
--- /dev/null
+++ b/src/renderer/src/components/editor/MonacoEditor.system-theme.test.tsx
@@ -0,0 +1,145 @@
+// @vitest-environment happy-dom
+import { act, cleanup, render } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { resetSystemPrefersDarkSubscriptionForTests } from '@/components/terminal-pane/use-system-prefers-dark'
+
+const editorProps: { current: Record<string, unknown> | null } = vi.hoisted(() => ({
+  current: null
+}))
+const settingsState: { theme: 'system' | 'dark' | 'light' } = vi.hoisted(() => ({
+  theme: 'system'
+}))
+
+vi.mock('@monaco-editor/react', () => ({
+  default: (props: Record<string, unknown>) => {
+    editorProps.current = props
+    return null
+  },
+  loader: { config: vi.fn() }
+}))
+vi.mock('@/store', () => ({
+  useAppStore: (selector: (state: Record<string, unknown>) => unknown) =>
+    selector({
+      settings: {
+        get theme() {
+          return settingsState.theme
+        },
+        terminalFontSize: 13,
+        terminalFontFamily: 'monospace'
+      },
+      editorFontZoomLevel: 0,
+      setPendingEditorReveal: vi.fn(),
+      setEditorCursorLine: vi.fn(),
+      addDiffComment: vi.fn(),
+      deleteDiffComment: vi.fn(),
+      updateDiffComment: vi.fn(),
+      scrollToDiffCommentId: null,
+      setScrollToDiffCommentId: vi.fn(),
+      worktreeDiffComments: {}
+    })
+}))
+vi.mock('../diff-comments/useDiffCommentDecorator', () => ({
+  useDiffCommentDecorator: vi.fn()
+}))
+vi.mock('./useContextualCopySetup', () => ({
+  useContextualCopySetup: () => ({ setupCopy: vi.fn(), toastNode: null })
+}))
+
+import MonacoEditor from './MonacoEditor'
+
+function installMatchMedia(initialMatches: boolean): {
+  emit: (matches: boolean) => void
+} {
+  let matches = initialMatches
+  const listeners = new Set<EventListener>()
+  const mediaQuery = '(prefers-color-scheme: dark)'
+  const media: MediaQueryList = {
+    get matches() {
+      return matches
+    },
+    media: mediaQuery,
+    onchange: null,
+    addListener() {},
+    removeListener() {},
+    addEventListener(type, listener) {
+      if (type === 'change' && typeof listener === 'function') {
+        listeners.add(listener)
+      }
+    },
+    removeEventListener(type, listener) {
+      if (type === 'change' && typeof listener === 'function') {
+        listeners.delete(listener)
+      }
+    },
+    dispatchEvent() {
+      return false
+    }
+  }
+  window.matchMedia = () => media
+  return {
+    emit(nextMatches: boolean): void {
+      matches = nextMatches
+      const event = new MediaQueryListEvent('change', { matches: nextMatches, media: mediaQuery })
+      for (const listener of listeners) {
+        listener(event)
+      }
+    }
+  }
+}
+
+function renderEditor(): void {
+  render(
+    <MonacoEditor
+      fileId="file"
+      filePath="/repo/hello.ts"
+      viewStateKey="pane:hello"
+      relativePath="hello.ts"
+      content={'function hello() {}\n'}
+      language="typescript"
+      onContentChange={vi.fn()}
+      onSave={vi.fn()}
+    />
+  )
+}
+
+const originalMatchMedia = window.matchMedia
+
+afterEach(() => {
+  cleanup()
+  editorProps.current = null
+  settingsState.theme = 'system'
+  resetSystemPrefersDarkSubscriptionForTests()
+  window.matchMedia = originalMatchMedia
+})
+
+describe('MonacoEditor system theme', () => {
+  it('follows a system color-scheme change while the editor stays mounted', () => {
+    const media = installMatchMedia(false)
+    renderEditor()
+
+    expect(editorProps.current?.theme).toBe('vs')
+
+    act(() => {
+      media.emit(true)
+    })
+    expect(editorProps.current?.theme).toBe('vs-dark')
+
+    act(() => {
+      media.emit(false)
+    })
+    expect(editorProps.current?.theme).toBe('vs')
+  })
+
+  it('keeps an explicit theme when the system color scheme changes', () => {
+    settingsState.theme = 'light'
+    const media = installMatchMedia(true)
+    renderEditor()
+
+    expect(editorProps.current?.theme).toBe('vs')
+
+    act(() => {
+      media.emit(false)
+    })
+    expect(editorProps.current?.theme).toBe('vs')
+  })
+})
diff --git a/src/renderer/src/components/editor/MonacoEditor.tsx b/src/renderer/src/components/editor/MonacoEditor.tsx
index cb3e9693f47..17f659607a3 100644
--- a/src/renderer/src/components/editor/MonacoEditor.tsx
+++ b/src/renderer/src/components/editor/MonacoEditor.tsx
@@ -21,6 +21,7 @@ import { useMonacoContentSyncBridge } from './use-monaco-content-sync-bridge'
 import { useMonacoMarkdownAnnotations } from './use-monaco-markdown-annotations'
 import { useMonacoEditorDecorations } from './use-monaco-editor-decorations'
 import { useMonacoEditorMount } from './use-monaco-editor-mount'
+import { useDocumentDarkTheme } from '@/hooks/use-document-dark-theme'
 import { snapshotMonacoViewState } from './monaco-view-state-persistence'
 import { MonacoMarkdownAnnotationOverlay } from './MonacoMarkdownAnnotationOverlay'
 
@@ -117,9 +118,7 @@ export default function MonacoEditor({
   const [gutterMenuOpen, setGutterMenuOpen] = useState(false)
   const [gutterMenuPoint, setGutterMenuPoint] = useState({ x: 0, y: 0 })
   const [gutterMenuLine, setGutterMenuLine] = useState(1)
-  const isDark =
-    settings?.theme === 'dark' ||
-    (settings?.theme === 'system' && window.matchMedia('(prefers-color-scheme: dark)').matches)
+  const isDark = useDocumentDarkTheme()
 
   const { queueReveal, cancelScheduledReveal, clearTransientRevealHighlight } =
     useMonacoRevealScheduler()
diff --git a/src/renderer/src/components/editor/PdfFind.test.tsx b/src/renderer/src/components/editor/PdfFind.test.tsx
new file mode 100644
index 00000000000..a08f2640458
--- /dev/null
+++ b/src/renderer/src/components/editor/PdfFind.test.tsx
@@ -0,0 +1,153 @@
+// @vitest-environment happy-dom
+
+import { act, cleanup, fireEvent, render } from '@testing-library/react'
+// PDF.js's legacy entry supplies the runtime polyfills for Node-based tests.
+import 'pdfjs-dist/legacy/build/pdf.mjs'
+import { EventBus, FindState } from 'pdfjs-dist/web/pdf_viewer.mjs'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import PdfFind from './PdfFind'
+
+vi.mock('@/i18n/i18n', () => ({
+  translate: (_key: string, fallback: string, values?: { value0: number; value1: number }) =>
+    fallback
+      .replace('{{value0}}', String(values?.value0))
+      .replace('{{value1}}', String(values?.value1))
+}))
+
+afterEach(() => {
+  cleanup()
+  vi.restoreAllMocks()
+})
+
+function setup() {
+  const bus = new EventBus()
+  const eventBusRef = { current: bus }
+  const onClose = vi.fn()
+  const view = render(<PdfFind isOpen onClose={onClose} eventBusRef={eventBusRef} />)
+  const query = (value: string): void => {
+    fireEvent.change(view.getByPlaceholderText('Find in page...'), { target: { value } })
+  }
+  const count = (current: number, total: number): void => {
+    act(() =>
+      bus.dispatch('updatefindmatchescount', { source: bus, matchesCount: { current, total } })
+    )
+  }
+  const control = (current: number, total: number, state = FindState.FOUND): void => {
+    act(() =>
+      bus.dispatch('updatefindcontrolstate', {
+        source: bus,
+        state,
+        previous: false,
+        entireWord: false,
+        rawQuery: 'needle',
+        matchesCount: { current, total }
+      })
+    )
+  }
+  const open = (isOpen: boolean): void => {
+    view.rerender(<PdfFind isOpen={isOpen} onClose={onClose} eventBusRef={eventBusRef} />)
+  }
+  return { bus, view, query, count, control, open, onClose }
+}
+
+describe('PDF find event synchronization', () => {
+  it('follows progressive totals and control-state navigation, wrap, and no results', () => {
+    const { view, query, count, control } = setup()
+    query('needle')
+    count(1, 2)
+    expect(view.getByText('1 of 2')).toBeTruthy()
+    count(1, 6)
+    expect(view.getByText('1 of 6')).toBeTruthy()
+    control(2, 6)
+    expect(view.getByText('2 of 6')).toBeTruthy()
+    control(6, 6, FindState.WRAPPED)
+    expect(view.getByText('6 of 6')).toBeTruthy()
+    query('absent')
+    control(6, 6, FindState.PENDING)
+    control(0, 0, FindState.NOT_FOUND)
+    expect(view.getByText('No matches')).toBeTruthy()
+    query('beacon')
+    count(1, 2)
+    expect(view.getByText('1 of 2')).toBeTruthy()
+  })
+
+  it('subscribes before a synchronous cached result on reopening', () => {
+    const { bus, view, query, count, open } = setup()
+    query('needle')
+    count(2, 6)
+    open(false)
+    bus.on('find', () => {
+      bus.dispatch('updatefindcontrolstate', {
+        source: bus,
+        state: FindState.PENDING,
+        rawQuery: 'needle',
+        matchesCount: { current: 2, total: 6 }
+      })
+    })
+    open(true)
+    expect(view.getByText('2 of 6')).toBeTruthy()
+  })
+
+  it('removes both listeners on close and unmount without accumulating on reopen', () => {
+    const { view, open, query, control } = setup()
+    const on = vi.spyOn(EventBus.prototype, 'on')
+    const off = vi.spyOn(EventBus.prototype, 'off')
+    open(false)
+    expect(off.mock.calls.map(([name]) => name)).toEqual([
+      'updatefindmatchescount',
+      'updatefindcontrolstate'
+    ])
+    off.mockClear()
+    for (let cycle = 0; cycle < 3; cycle += 1) {
+      open(true)
+      query('needle')
+      control(3, 6)
+      expect(view.getByText('3 of 6')).toBeTruthy()
+      if (cycle < 2) {
+        open(false)
+      }
+    }
+    view.unmount()
+    expect(on.mock.calls).toHaveLength(6)
+    expect(off.mock.calls).toEqual(on.mock.calls)
+  })
+
+  it('keeps empty queries clear even if a pending scan reports late', () => {
+    const { view, query, count, control } = setup()
+    query('needle')
+    count(2, 6)
+    query('')
+    count(3, 6)
+    control(3, 6)
+    expect(view.queryByText('3 of 6')).toBeNull()
+    query('absent')
+    expect(view.getByText('No matches')).toBeTruthy()
+  })
+
+  it('dispatches next and previous from buttons and Enter without changing the query', () => {
+    const { view, query, onClose } = setup()
+    const dispatch = vi.spyOn(EventBus.prototype, 'dispatch')
+    query('needle')
+    const input = view.getByPlaceholderText('Find in page...')
+    fireEvent.click(view.getByTitle('Next match'))
+    fireEvent.click(view.getByTitle('Previous match'))
+    fireEvent.keyDown(input, { key: 'Enter' })
+    fireEvent.keyDown(input, { key: 'Enter', shiftKey: true })
+    expect(dispatch.mock.calls.filter(([name]) => name === 'find')).toEqual(
+      ['', 'again', 'again', 'again', 'again'].map((type, index) => [
+        'find',
+        {
+          source: null,
+          type,
+          query: 'needle',
+          highlightAll: true,
+          caseSensitive: false,
+          entireWord: false,
+          findPrevious: index === 2 || index === 4
+        }
+      ])
+    )
+    fireEvent.keyDown(input, { key: 'Escape' })
+    expect(onClose).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/renderer/src/components/editor/PdfFind.tsx b/src/renderer/src/components/editor/PdfFind.tsx
index 16b42e7effb..a186123bcfa 100644
--- a/src/renderer/src/components/editor/PdfFind.tsx
+++ b/src/renderer/src/components/editor/PdfFind.tsx
@@ -60,6 +60,27 @@ export default function PdfFind({
     input.select()
   }, [])
 
+  // Subscribe before dispatching: PDF.js can report cached counts synchronously.
+  useEffect(() => {
+    const eventBus = eventBusRef.current
+    if (!eventBus || !isOpen) {
+      return
+    }
+    const handleMatchesCount = (evt: {
+      matchesCount: { current: number; total: number }
+    }): void => {
+      setActiveMatch(evt.matchesCount.current)
+      setTotalMatches(evt.matchesCount.total)
+    }
+    eventBus.on('updatefindmatchescount', handleMatchesCount)
+    // Navigation and zero-result searches report counts on the control-state event.
+    eventBus.on('updatefindcontrolstate', handleMatchesCount)
+    return () => {
+      eventBus.off('updatefindmatchescount', handleMatchesCount)
+      eventBus.off('updatefindcontrolstate', handleMatchesCount)
+    }
+  }, [eventBusRef, isOpen])
+
   useEffect(() => {
     if (!isOpen) {
       return
@@ -74,23 +95,6 @@ export default function PdfFind({
     dispatchFind('')
   }, [requestQuery, isOpen, dispatchFind, eventBusRef])
 
-  useEffect(() => {
-    const eventBus = eventBusRef.current
-    if (!eventBus || !isOpen) {
-      return
-    }
-    const handleMatchesCount = (evt: {
-      matchesCount: { current: number; total: number }
-    }): void => {
-      setActiveMatch(evt.matchesCount.current)
-      setTotalMatches(evt.matchesCount.total)
-    }
-    eventBus.on('updatefindmatchescount', handleMatchesCount)
-    return () => {
-      eventBus.off('updatefindmatchescount', handleMatchesCount)
-    }
-  }, [eventBusRef, isOpen])
-
   const handleKeyDown = useCallback(
     (e: React.KeyboardEvent) => {
       e.stopPropagation()
diff --git a/src/renderer/src/components/editor/RichMarkdownCodeBlock.tsx b/src/renderer/src/components/editor/RichMarkdownCodeBlock.tsx
index 0e7c53068fa..dc358e1973a 100644
--- a/src/renderer/src/components/editor/RichMarkdownCodeBlock.tsx
+++ b/src/renderer/src/components/editor/RichMarkdownCodeBlock.tsx
@@ -4,8 +4,8 @@ import { useTranslation } from 'react-i18next'
 import { NodeViewContent, NodeViewWrapper } from '@tiptap/react'
 import type { NodeViewProps } from '@tiptap/react'
 import { Copy, Check } from 'lucide-react'
-import { useAppStore } from '@/store'
 import MermaidBlock from './MermaidBlock'
+import { useDocumentDarkTheme } from '@/hooks/use-document-dark-theme'
 import { translate } from '@/i18n/i18n'
 import {
   getCodeBlockLanguageLabel,
@@ -28,10 +28,7 @@ export function RichMarkdownCodeBlock({
   // Why: clipboard IPC can resolve after the node view unmounts; avoid
   // starting a reset timer that will outlive the component.
   const isMountedRef = useRef(false)
-  const settings = useAppStore((s) => s.settings)
-  const isDark =
-    settings?.theme === 'dark' ||
-    (settings?.theme === 'system' && window.matchMedia('(prefers-color-scheme: dark)').matches)
+  const isDark = useDocumentDarkTheme()
 
   const isMermaid = language === 'mermaid'
 
diff --git a/src/renderer/src/components/editor/RichMarkdownEditorSurface.tsx b/src/renderer/src/components/editor/RichMarkdownEditorSurface.tsx
index 8e2ca1e4abb..6c71a126ecd 100644
--- a/src/renderer/src/components/editor/RichMarkdownEditorSurface.tsx
+++ b/src/renderer/src/components/editor/RichMarkdownEditorSurface.tsx
@@ -35,6 +35,14 @@ function shouldFocusEmptyEditorFromSurfaceClick(
   return !target.closest('.rich-markdown-editor-shell button, .rich-markdown-editor-shell input')
 }
 
+function shouldReturnFocusToEditor(event: React.MouseEvent<HTMLDivElement>): boolean {
+  if (event.button !== 0) {
+    return false
+  }
+  const target = event.target
+  return target instanceof Element && Boolean(target.closest('.ProseMirror'))
+}
+
 type RichMarkdownEditorSurfaceProps = {
   editor: Editor | null
   editorFontZoomLevel: number
@@ -209,6 +217,11 @@ export function RichMarkdownEditorSurface({
             // Image layout must not anchor-scroll over the restored tab position.
             className="relative h-full overflow-auto scrollbar-editor [overflow-anchor:none]"
             onMouseDown={(event) => {
+              if (shouldReturnFocusToEditor(event)) {
+                // Keep the find bar open while handing keyboard focus back to the document.
+                searchState.searchInputRef.current?.blur()
+                editor?.commands.focus()
+              }
               if (!shouldFocusEmptyEditorFromSurfaceClick(event, editor)) {
                 return
               }
diff --git a/src/renderer/src/components/editor/check-run-details-fix-with-ai.ts b/src/renderer/src/components/editor/check-run-details-fix-with-ai.ts
index 48cae27613a..394bcac8123 100644
--- a/src/renderer/src/components/editor/check-run-details-fix-with-ai.ts
+++ b/src/renderer/src/components/editor/check-run-details-fix-with-ai.ts
@@ -11,7 +11,7 @@ import {
 import { openSourceControlAiSettingsTarget } from '@/components/right-sidebar/source-control-ai-settings-navigation'
 import { getConnectionId } from '@/lib/connection-context'
 import { startFixChecksAgent } from '@/lib/fix-checks-agent-launch'
-import { readSourceControlLaunchRecipeAgentId } from '@/lib/source-control-launch-agent-selection'
+import { readSourceControlLaunchRecipeAgentId } from '../../../../shared/source-control-launch-agent-selection'
 import { resolveSourceControlLaunchPlatform } from '@/lib/source-control-launch-platform'
 import { useAppStore } from '@/store'
 import { findWorktreeById } from '@/store/slices/worktree-helpers'
diff --git a/src/renderer/src/components/editor/closed-editor-model-lifetime.test.ts b/src/renderer/src/components/editor/closed-editor-model-lifetime.test.ts
index 0b69a239526..e3e904643a9 100644
--- a/src/renderer/src/components/editor/closed-editor-model-lifetime.test.ts
+++ b/src/renderer/src/components/editor/closed-editor-model-lifetime.test.ts
@@ -1,5 +1,5 @@
 // @vitest-environment happy-dom
-import * as monaco from 'monaco-editor'
+import * as monaco from 'monaco-editor/esm/vs/editor/editor.api.js'
 import { afterEach, expect, it, vi } from 'vitest'
 import {
   attachModelLifetimeView,
diff --git a/src/renderer/src/components/editor/closed-editor-model-reentrancy.test.ts b/src/renderer/src/components/editor/closed-editor-model-reentrancy.test.ts
index 1ebfbe29c9d..ad32f6fd0f0 100644
--- a/src/renderer/src/components/editor/closed-editor-model-reentrancy.test.ts
+++ b/src/renderer/src/components/editor/closed-editor-model-reentrancy.test.ts
@@ -13,7 +13,7 @@ import {
   diffViewStateCache,
   pdfViewPositionCache
 } from '@/lib/scroll-cache'
-import * as monaco from 'monaco-editor'
+import * as monaco from 'monaco-editor/esm/vs/editor/editor.api.js'
 
 vi.mock('sonner', () => ({ toast: { info: vi.fn(), error: vi.fn(), success: vi.fn() } }))
 afterEach(resetModelLifetimeFixtures)
diff --git a/src/renderer/src/components/editor/closed-editor-model-registry.test.ts b/src/renderer/src/components/editor/closed-editor-model-registry.test.ts
index 5caf134efe2..91818243edf 100644
--- a/src/renderer/src/components/editor/closed-editor-model-registry.test.ts
+++ b/src/renderer/src/components/editor/closed-editor-model-registry.test.ts
@@ -1,5 +1,5 @@
 // @vitest-environment happy-dom
-import * as monaco from 'monaco-editor'
+import * as monaco from 'monaco-editor/esm/vs/editor/editor.api.js'
 import { afterEach, expect, it, vi } from 'vitest'
 import {
   attachModelLifetimeView,
diff --git a/src/renderer/src/components/editor/closed-editor-model-shell.test.tsx b/src/renderer/src/components/editor/closed-editor-model-shell.test.tsx
index 67f423c2f49..5471ebce54b 100644
--- a/src/renderer/src/components/editor/closed-editor-model-shell.test.tsx
+++ b/src/renderer/src/components/editor/closed-editor-model-shell.test.tsx
@@ -1,7 +1,7 @@
 // @vitest-environment happy-dom
 import React from 'react'
 import { useStore, type StoreApi } from 'zustand'
-import * as monaco from 'monaco-editor'
+import * as monaco from 'monaco-editor/esm/vs/editor/editor.api.js'
 import { act, cleanup, render, waitFor } from '@testing-library/react'
 import { afterEach, expect, it, vi } from 'vitest'
 import type { AppState } from '@/store/types'
diff --git a/src/renderer/src/components/editor/closed-editor-view-state-retention.test.ts b/src/renderer/src/components/editor/closed-editor-view-state-retention.test.ts
index 89c49aaeafc..1b88f0ccbb6 100644
--- a/src/renderer/src/components/editor/closed-editor-view-state-retention.test.ts
+++ b/src/renderer/src/components/editor/closed-editor-view-state-retention.test.ts
@@ -1,5 +1,5 @@
 // @vitest-environment happy-dom
-import * as monaco from 'monaco-editor'
+import * as monaco from 'monaco-editor/esm/vs/editor/editor.api.js'
 import { createStore } from 'zustand/vanilla'
 import { afterEach, expect, it } from 'vitest'
 import type { OpenFile } from '@/store/slices/editor'
diff --git a/src/renderer/src/components/editor/combined-diff/CombinedDiffViewer.tsx b/src/renderer/src/components/editor/combined-diff/CombinedDiffViewer.tsx
index 449f89cb70f..a50dcce43df 100644
--- a/src/renderer/src/components/editor/combined-diff/CombinedDiffViewer.tsx
+++ b/src/renderer/src/components/editor/combined-diff/CombinedDiffViewer.tsx
@@ -38,6 +38,7 @@ import {
 import { useCombinedDiffNotesActions } from './review-controls/use-combined-diff-notes-actions'
 import { useCombinedDiffSectionActions } from './review-controls/use-combined-diff-section-actions'
 import { useCombinedDiffViewPreferences } from './review-controls/use-combined-diff-view-preferences'
+import { useDocumentDarkTheme } from '@/hooks/use-document-dark-theme'
 
 export default function CombinedDiffViewer({
   file,
@@ -64,9 +65,7 @@ export default function CombinedDiffViewer({
   )
   const activeGroupId = useAppStore((s) => s.activeGroupIdByWorktree[file.worktreeId])
   const canOpenWorkspaceFileBrowserForPath = useWorkspaceFileBrowserActionPredicate(file.worktreeId)
-  const isDark =
-    settings?.theme === 'dark' ||
-    (settings?.theme === 'system' && window.matchMedia('(prefers-color-scheme: dark)').matches)
+  const isDark = useDocumentDarkTheme()
 
   const [sections, setSections] = useState<DiffSection[]>([])
   const [sectionHeights, setSectionHeights] = useState<Record<number, number>>({})
diff --git a/src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-windowing.test.tsx b/src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-windowing.test.tsx
index ba5848e3f67..e913d6bde35 100644
--- a/src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-windowing.test.tsx
+++ b/src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-windowing.test.tsx
@@ -57,11 +57,11 @@ beforeEach(() => {
   document.body.appendChild(host)
   root = createRoot(host)
   vi.stubGlobal('ResizeObserver', NoopResizeObserver)
-  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(
-    function (this: HTMLElement) {
-      return this.classList.contains('overflow-auto') ? VIEWPORT_HEIGHT_PX : TREE_ROW_HEIGHT_PX
-    }
-  )
+  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(function (
+    this: HTMLElement
+  ) {
+    return this.classList.contains('overflow-auto') ? VIEWPORT_HEIGHT_PX : TREE_ROW_HEIGHT_PX
+  })
   vi.spyOn(Element.prototype, 'getBoundingClientRect').mockImplementation(function (this: Element) {
     const height = this.classList.contains('overflow-auto')
       ? VIEWPORT_HEIGHT_PX
diff --git a/src/renderer/src/components/editor/combined-diff/scroll-viewport/combined-diff-render-range.test.ts b/src/renderer/src/components/editor/combined-diff/scroll-viewport/combined-diff-render-range.test.ts
new file mode 100644
index 00000000000..7f58e7c2a37
--- /dev/null
+++ b/src/renderer/src/components/editor/combined-diff/scroll-viewport/combined-diff-render-range.test.ts
@@ -0,0 +1,55 @@
+import { describe, expect, it } from 'vitest'
+import { getCombinedDiffRenderRange } from './combined-diff-render-range'
+
+describe('combined diff render range', () => {
+  it('keeps visible large sections without mounting their large neighbors', () => {
+    expect(
+      getCombinedDiffRenderRange(
+        { startIndex: 2, endIndex: 3, count: 8, overscan: 5 },
+        () => 230_000,
+        800
+      )
+    ).toEqual([2, 3])
+  })
+
+  it('pre-renders at most one viewport of small sections on each side', () => {
+    expect(
+      getCombinedDiffRenderRange(
+        { startIndex: 4, endIndex: 5, count: 10, overscan: 5 },
+        () => 200,
+        400
+      )
+    ).toEqual([2, 3, 4, 5, 6, 7])
+  })
+
+  it('stops at a large neighboring section instead of skipping across it', () => {
+    const heights = [100, 230_000, 100, 100, 230_000, 100]
+    expect(
+      getCombinedDiffRenderRange(
+        { startIndex: 2, endIndex: 2, count: heights.length, overscan: 5 },
+        (index) => heights[index],
+        800
+      )
+    ).toEqual([2, 3])
+  })
+
+  it('retains the row-count cap and list boundaries for short sections', () => {
+    expect(
+      getCombinedDiffRenderRange(
+        { startIndex: 1, endIndex: 2, count: 100, overscan: 5 },
+        () => 28,
+        800
+      )
+    ).toEqual([0, 1, 2, 3, 4, 5, 6, 7])
+  })
+
+  it('renders only visible sections before the viewport is measured', () => {
+    expect(
+      getCombinedDiffRenderRange(
+        { startIndex: 1, endIndex: 2, count: 10, overscan: 5 },
+        () => 88,
+        0
+      )
+    ).toEqual([1, 2])
+  })
+})
diff --git a/src/renderer/src/components/editor/combined-diff/scroll-viewport/combined-diff-render-range.ts b/src/renderer/src/components/editor/combined-diff/scroll-viewport/combined-diff-render-range.ts
new file mode 100644
index 00000000000..0e57d785e86
--- /dev/null
+++ b/src/renderer/src/components/editor/combined-diff/scroll-viewport/combined-diff-render-range.ts
@@ -0,0 +1,28 @@
+import type { Range } from '@tanstack/react-virtual'
+
+export function getCombinedDiffRenderRange(
+  range: Range,
+  estimateHeight: (index: number) => number,
+  viewportHeight: number
+): number[] {
+  let start = range.startIndex
+  let end = range.endIndex
+  const budget = Math.max(0, viewportHeight)
+  let height = 0
+  while (start > 0 && range.startIndex - start < range.overscan) {
+    height += estimateHeight(start - 1)
+    if (height > budget) {
+      break
+    }
+    start -= 1
+  }
+  height = 0
+  while (end + 1 < range.count && end - range.endIndex < range.overscan) {
+    height += estimateHeight(end + 1)
+    if (height > budget) {
+      break
+    }
+    end += 1
+  }
+  return Array.from({ length: end - start + 1 }, (_, offset) => start + offset)
+}
diff --git a/src/renderer/src/components/editor/combined-diff/scroll-viewport/use-combined-diff-virtualizer.ts b/src/renderer/src/components/editor/combined-diff/scroll-viewport/use-combined-diff-virtualizer.ts
index d9874ea9265..4cca1137aff 100644
--- a/src/renderer/src/components/editor/combined-diff/scroll-viewport/use-combined-diff-virtualizer.ts
+++ b/src/renderer/src/components/editor/combined-diff/scroll-viewport/use-combined-diff-virtualizer.ts
@@ -4,6 +4,7 @@ import { elementScroll, useVirtualizer, type Virtualizer } from '@tanstack/react
 import type { ProgrammaticScrollMarks } from '@/hooks/programmatic-scroll-marks'
 import type { DiffSection } from '../../diff-section-types'
 import { getDiffSectionRowEstimatedHeight } from '../../diff-section-layout'
+import { getCombinedDiffRenderRange } from './combined-diff-render-range'
 
 const COMBINED_DIFF_OVERSCAN = 5
 
@@ -28,17 +29,21 @@ export function useCombinedDiffVirtualizer({
   sections: DiffSection[]
   sideBySide: boolean
 }): Virtualizer<HTMLDivElement, Element> {
+  const estimateSize = (index: number): number => {
+    const section = sections[index]
+    return section ? getDiffSectionRowEstimatedHeight(section, sectionHeights[index]) : 88
+  }
   const virtualizer = useVirtualizer({
     count: sections.length,
     getScrollElement: () => scrollContainerRef.current,
-    estimateSize: (index) => {
-      const section = sections[index]
-      if (!section) {
-        return 88
-      }
-
-      return getDiffSectionRowEstimatedHeight(section, sectionHeights[index])
-    },
+    estimateSize,
+    // Offscreen Monaco sections render their full height; bound that work by pixels, too.
+    rangeExtractor: (range) =>
+      getCombinedDiffRenderRange(
+        range,
+        estimateSize,
+        scrollContainerRef.current?.clientHeight ?? 0
+      ),
     overscan: COMBINED_DIFF_OVERSCAN,
     initialOffset: () => scrollOffsetRef.current,
     // Why: mark every virtualizer-issued scroll so events are attributed to the user only when this code didn't cause them.
diff --git a/src/renderer/src/components/editor/conflict-review-file-tree-windowing.test.tsx b/src/renderer/src/components/editor/conflict-review-file-tree-windowing.test.tsx
index e7612a30a39..596a148db9f 100644
--- a/src/renderer/src/components/editor/conflict-review-file-tree-windowing.test.tsx
+++ b/src/renderer/src/components/editor/conflict-review-file-tree-windowing.test.tsx
@@ -51,13 +51,13 @@ beforeEach(() => {
   document.body.appendChild(host)
   root = createRoot(host)
   vi.stubGlobal('ResizeObserver', NoopResizeObserver)
-  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(
-    function (this: HTMLElement) {
-      return this.classList.contains('overflow-auto')
-        ? VIEWPORT_HEIGHT_PX
-        : CONFLICT_REVIEW_ROW_HEIGHT_PX
-    }
-  )
+  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(function (
+    this: HTMLElement
+  ) {
+    return this.classList.contains('overflow-auto')
+      ? VIEWPORT_HEIGHT_PX
+      : CONFLICT_REVIEW_ROW_HEIGHT_PX
+  })
   vi.spyOn(Element.prototype, 'getBoundingClientRect').mockImplementation(function (this: Element) {
     const top = synthesizedTop(this)
     const height = this.classList.contains('overflow-auto')
diff --git a/src/renderer/src/components/editor/diff-section-comment-submit.test.ts b/src/renderer/src/components/editor/diff-section-comment-submit.test.ts
new file mode 100644
index 00000000000..0332839c134
--- /dev/null
+++ b/src/renderer/src/components/editor/diff-section-comment-submit.test.ts
@@ -0,0 +1,40 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { toast } from 'sonner'
+import { submitDiffSectionComment } from './diff-section-comment-submit'
+import type { DiffSection } from './diff-section-types'
+
+vi.mock('sonner', () => ({ toast: { error: vi.fn() } }))
+
+const section: DiffSection = {
+  key: 'section-1',
+  path: 'src/example.ts',
+  status: 'modified',
+  originalContent: 'before',
+  modifiedContent: 'after',
+  collapsed: false,
+  loading: false,
+  dirty: false,
+  diffResult: null,
+  largeDiffRenderLimit: null
+}
+
+describe('submitDiffSectionComment', () => {
+  beforeEach(() => {
+    vi.mocked(toast.error).mockClear()
+  })
+
+  it('surfaces persistence failures while keeping the draft open', async () => {
+    const addDiffComment = vi.fn().mockResolvedValue(null)
+
+    const result = await submitDiffSectionComment({
+      addDiffComment,
+      body: 'Needs revision',
+      target: { lineNumber: 4 },
+      section,
+      worktreeId: 'worktree-1'
+    })
+
+    expect(result).toBe(false)
+    expect(toast.error).toHaveBeenCalledWith('Failed to save comment')
+  })
+})
diff --git a/src/renderer/src/components/editor/diff-section-comment-submit.ts b/src/renderer/src/components/editor/diff-section-comment-submit.ts
index 99a2cde8ce5..0d011a9dd6f 100644
--- a/src/renderer/src/components/editor/diff-section-comment-submit.ts
+++ b/src/renderer/src/components/editor/diff-section-comment-submit.ts
@@ -1,6 +1,8 @@
 import type { DiffSection } from './diff-section-types'
+import { toast } from 'sonner'
+import { translate } from '@/i18n/i18n'
 
-type DiffSectionPopoverTarget = {
+type DiffSectionCommentTarget = {
   lineNumber: number
   startLine?: number
 }
@@ -19,7 +21,7 @@ export async function submitDiffSectionComment({
   addDiffComment,
   body,
   onAddLineComment,
-  popover,
+  target,
   section,
   worktreeId
 }: {
@@ -33,14 +35,14 @@ export async function submitDiffSectionComment({
       body: string
     }
   ) => Promise<boolean>
-  popover: DiffSectionPopoverTarget
+  target: DiffSectionCommentTarget
   section: DiffSection
   worktreeId?: string
 }): Promise<boolean> {
   if (onAddLineComment) {
     return onAddLineComment(section, {
-      lineNumber: popover.lineNumber,
-      startLine: popover.startLine,
+      lineNumber: target.lineNumber,
+      startLine: target.startLine,
       body
     })
   }
@@ -53,13 +55,13 @@ export async function submitDiffSectionComment({
     worktreeId,
     filePath: section.path,
     source: 'diff',
-    startLine: popover.startLine,
-    lineNumber: popover.lineNumber,
+    startLine: target.startLine,
+    lineNumber: target.lineNumber,
     body,
     side: 'modified'
   })
   if (!result) {
-    console.error('Failed to add diff comment — draft preserved')
+    toast.error(translate('auto.components.editor.diffCommentSaveFailed', 'Failed to save comment'))
   }
   return Boolean(result)
 }
diff --git a/src/renderer/src/components/editor/editor-model-lifetime-fixture.ts b/src/renderer/src/components/editor/editor-model-lifetime-fixture.ts
index a7ecac75d85..5ec2466f452 100644
--- a/src/renderer/src/components/editor/editor-model-lifetime-fixture.ts
+++ b/src/renderer/src/components/editor/editor-model-lifetime-fixture.ts
@@ -1,4 +1,4 @@
-import * as monaco from 'monaco-editor'
+import * as monaco from 'monaco-editor/esm/vs/editor/editor.api.js'
 import { vi } from 'vitest'
 import { createEditorModelRegistry } from '@/lib/editor-model-registry'
 import { createTestStore, makeWorktree, TEST_REPO } from '@/store/slices/store-test-helpers'
diff --git a/src/renderer/src/components/editor/ipynb-kernel-session.test.ts b/src/renderer/src/components/editor/ipynb-kernel-session.test.ts
index 1dffc0ab6a7..e609bae9e2c 100644
--- a/src/renderer/src/components/editor/ipynb-kernel-session.test.ts
+++ b/src/renderer/src/components/editor/ipynb-kernel-session.test.ts
@@ -55,9 +55,50 @@ beforeEach(() => {
     listener({ openFiles: openFiles.current }, { openFiles: [] })
   }
   openFiles.current = [{ filePath: FILE }]
+  // Cells only reach runCells after the user trusts the notebook.
+  for (const filePath of [
+    FILE,
+    '/repo/nb.ipynb',
+    '/other.ipynb',
+    '/third.ipynb',
+    '/fourth.ipynb'
+  ]) {
+    session.trustNotebook(filePath)
+  }
 })
 
 describe('notebook kernel session', () => {
+  it('runs no interpreter before trust: a pick or restart only records the choice', async () => {
+    const untrusted = '/untrusted/nb.ipynb'
+    const shipped = { path: '/untrusted/.venv/bin/python', name: '.venv' }
+    openFiles.current = [{ filePath: untrusted }]
+    session.selectEnvironment(untrusted, shipped)
+    session.restartKernel(untrusted)
+    await Promise.resolve()
+    expect(notebookApi.startKernel).not.toHaveBeenCalled()
+    expect(notebookApi.listPythonEnvironments).not.toHaveBeenCalled()
+    expect(getSession(untrusted)).toMatchObject({ status: 'off', trusted: false, queue: [] })
+
+    session.trustNotebook(untrusted)
+    await session.runCells(untrusted, [{ key: 'a', code: 'x' }], '/untrusted')
+    expect(notebookApi.startKernel).toHaveBeenCalledWith({
+      filePath: untrusted,
+      python: shipped.path
+    })
+    expect(notebookApi.execute).toHaveBeenCalledWith({ filePath: untrusted, code: 'x' })
+  })
+
+  it('discovers with workspace interpreters once trusted', async () => {
+    openFiles.current = [{ filePath: '/fifth.ipynb' }]
+    session.trustNotebook('/fifth.ipynb')
+    await session.runCells('/fifth.ipynb', [{ key: 'a', code: 'x' }], '/proj')
+    expect(notebookApi.listPythonEnvironments).toHaveBeenCalledWith({
+      filePath: '/fifth.ipynb',
+      rootPath: '/proj',
+      runWorkspaceInterpreters: true
+    })
+  })
+
   it('starts the recommended env, runs queued cells in order, and stops the queue on an error', async () => {
     await session.runCells(
       FILE,
diff --git a/src/renderer/src/components/editor/ipynb-kernel-session.ts b/src/renderer/src/components/editor/ipynb-kernel-session.ts
index de0c15bfe77..a75f406138a 100644
--- a/src/renderer/src/components/editor/ipynb-kernel-session.ts
+++ b/src/renderer/src/components/editor/ipynb-kernel-session.ts
@@ -64,7 +64,11 @@ async function discoverEnvironment(
   filePath: string,
   rootPath: string | null
 ): Promise<PythonEnvironment | undefined> {
-  const found = await window.api.notebook.listPythonEnvironments({ filePath, rootPath })
+  const found = await window.api.notebook.listPythonEnvironments({
+    filePath,
+    rootPath,
+    runWorkspaceInterpreters: true
+  })
   const recommended = found.workspace[0] ?? found.path[0]
   if (recommended && isOpen(filePath)) {
     setEnvironment(filePath, recommended)
@@ -72,7 +76,11 @@ async function discoverEnvironment(
   return recommended
 }
 
+/** Starts the notebook's kernel; the one place a notebook's Python runs, so it refuses until trusted. */
 async function start(filePath: string, rootPath: string | null = null): Promise<void> {
+  if (!getSession(filePath).trusted) {
+    return
+  }
   // Why 'starting' before discovery: a second run meanwhile must queue, not start another kernel.
   updateSession(filePath, () => ({ status: 'starting' }))
   let result: KernelStartResult | null
@@ -156,7 +164,7 @@ export function restartKernel(filePath: string): void {
   void start(filePath)
 }
 
-/** Switching interpreters restarts a running kernel; otherwise queued cells wait for the new one. */
+/** Switching interpreters restarts a running kernel; before trust it only records the choice. */
 export function selectEnvironment(filePath: string, environment: PythonEnvironment): void {
   setEnvironment(filePath, environment)
   // A pick replaces an open setup prompt; the new env reopens it if it lacks ipykernel too.
diff --git a/src/renderer/src/components/editor/ipynb-kernel-setup-commands.test.ts b/src/renderer/src/components/editor/ipynb-kernel-setup-commands.test.ts
index 873dc2bb0a4..599cfac726c 100644
--- a/src/renderer/src/components/editor/ipynb-kernel-setup-commands.test.ts
+++ b/src/renderer/src/components/editor/ipynb-kernel-setup-commands.test.ts
@@ -13,6 +13,7 @@ describe('copyable setup commands', () => {
     expect(windows('C:\\My Env\\python.exe')).toBe(`& 'C:\\My Env\\python.exe'${pip}`)
     expect(windows('C:\\Dev&Test\\python.exe')).toBe(`& 'C:\\Dev&Test\\python.exe'${pip}`)
     expect(windows("C:\\Bob's\\python.exe")).toBe(`& 'C:\\Bob''s\\python.exe'${pip}`)
+    expect(windows('C:\\Bob\u2019s\\python.exe')).toBe(`& 'C:\\Bob\u2019\u2019s\\python.exe'${pip}`)
   })
 
   it('creates the venv and installs into it only when creation succeeded', () => {
diff --git a/src/renderer/src/components/editor/ipynb-kernel-setup-commands.ts b/src/renderer/src/components/editor/ipynb-kernel-setup-commands.ts
index 0d9fa553de8..dd15a8586c5 100644
--- a/src/renderer/src/components/editor/ipynb-kernel-setup-commands.ts
+++ b/src/renderer/src/components/editor/ipynb-kernel-setup-commands.ts
@@ -1,9 +1,10 @@
 import { getRendererAppPlatform } from '@/lib/renderer-app-platform'
 import { venvInterpreterSegments } from '../../../../shared/notebook-venv-location'
+import { quotePowerShellLiteral } from '../../../../shared/powershell-native-argument'
 
 /** Quotes a path for a shell; single quotes are literal in POSIX shells and PowerShell. */
 function shellQuote(path: string, windows: boolean): string {
-  return windows ? `'${path.replaceAll("'", "''")}'` : `'${path.replaceAll("'", "'\\''")}'`
+  return windows ? quotePowerShellLiteral(path) : `'${path.replaceAll("'", "'\\''")}'`
 }
 
 /** PowerShell runs a quoted program path only through `&`. */
diff --git a/src/renderer/src/components/editor/ipynb-kernel-store.ts b/src/renderer/src/components/editor/ipynb-kernel-store.ts
index abdf8cab9b3..057e8f552f5 100644
--- a/src/renderer/src/components/editor/ipynb-kernel-store.ts
+++ b/src/renderer/src/components/editor/ipynb-kernel-store.ts
@@ -54,11 +54,15 @@ function loadEnvironments(): Record<string, PythonEnvironment> {
     return isRecord(stored)
       ? Object.fromEntries(
           Object.entries(stored).flatMap(([filePath, env]) =>
-            isRecord(env) &&
-            typeof env.path === 'string' &&
-            typeof env.name === 'string' &&
-            typeof env.version === 'string'
-              ? [[filePath, { path: env.path, name: env.name, version: env.version }]]
+            isRecord(env) && typeof env.path === 'string' && typeof env.name === 'string'
+              ? [
+                  [
+                    filePath,
+                    typeof env.version === 'string'
+                      ? { path: env.path, name: env.name, version: env.version }
+                      : { path: env.path, name: env.name }
+                  ]
+                ]
               : []
           )
         )
diff --git a/src/renderer/src/components/editor/local-host-test-fixture.ts b/src/renderer/src/components/editor/local-host-test-fixture.ts
new file mode 100644
index 00000000000..d6ef4f7128a
--- /dev/null
+++ b/src/renderer/src/components/editor/local-host-test-fixture.ts
@@ -0,0 +1,18 @@
+import type { WorktreeHostConnection } from '@/lib/worktree-host-connection-phase'
+
+/** Stands in for the host-connection module in suites that mock the store: every worktree is local. */
+const LOCAL_HOST_CONNECTION: WorktreeHostConnection = {
+  phase: 'local',
+  targetId: null,
+  environmentId: null,
+  publishedStatus: null,
+  connectedEpoch: null
+}
+
+export function selectWorktreeHostConnectionPhase(): WorktreeHostConnection {
+  return LOCAL_HOST_CONNECTION
+}
+
+export function useWorktreeHostConnection(): WorktreeHostConnection {
+  return LOCAL_HOST_CONNECTION
+}
diff --git a/src/renderer/src/components/editor/markdown-directive-tokenizer.ts b/src/renderer/src/components/editor/markdown-directive-tokenizer.ts
new file mode 100644
index 00000000000..7356d99eddf
--- /dev/null
+++ b/src/renderer/src/components/editor/markdown-directive-tokenizer.ts
@@ -0,0 +1,19 @@
+import type { NodeConfig } from '@tiptap/core'
+import { createMarkdownTokenizerStart } from './markdown-tokenizer-start'
+
+export function guardMarkdownDirectiveTokenizer(
+  tokenizer: NodeConfig['markdownTokenizer'],
+  name: string
+): NodeConfig['markdownTokenizer'] {
+  if (!tokenizer || typeof tokenizer === 'function') {
+    return tokenizer
+  }
+  const marker = `:::${name}`
+  return {
+    ...tokenizer,
+    start: createMarkdownTokenizerStart(marker, true),
+    tokenize(source, tokens, lexer) {
+      return source.startsWith(marker) ? tokenizer.tokenize(source, tokens, lexer) : undefined
+    }
+  }
+}
diff --git a/src/renderer/src/components/editor/markdown-tokenizer-start.test.ts b/src/renderer/src/components/editor/markdown-tokenizer-start.test.ts
new file mode 100644
index 00000000000..c190b3b7e5a
--- /dev/null
+++ b/src/renderer/src/components/editor/markdown-tokenizer-start.test.ts
@@ -0,0 +1,96 @@
+import { expect, it, vi } from 'vitest'
+import { createTiptapMarkedFacade } from './tiptap-marked-facade'
+import {
+  createMarkdownTokenizerStart,
+  registerMarkdownTokenizerStart
+} from './markdown-tokenizer-start'
+
+it.each([
+  'x\n:::detailsSummary',
+  'x\r:::detailsSummary',
+  'x\u2028:::detailsSummary',
+  'x\u2029:::detailsSummary',
+  'x:::detailsSummary\n:::detailsSummary',
+  'ordinary text'
+])('matches the upstream multiline directive start: %j', (source) => {
+  expect(createMarkdownTokenizerStart(':::detailsSummary', true)(source)).toBe(
+    source.match(/^:::detailsSummary/m)?.index ?? -1
+  )
+})
+
+it('does not search each remaining suffix for an absent marker', () => {
+  const marked = createTiptapMarkedFacade()
+  const start = createMarkdownTokenizerStart('MARKER')
+  marked.use({
+    extensions: [{ name: 'marker', level: 'block', start, tokenizer: () => undefined }]
+  })
+  const includes = vi.spyOn(String.prototype, 'includes')
+  const indexOf = vi.spyOn(String.prototype, 'indexOf')
+  try {
+    marked.lexer('Prose\n\n'.repeat(1000))
+    expect(includes.mock.calls.filter(([value]) => value === 'MARKER')).toHaveLength(1)
+    expect(indexOf.mock.calls.filter(([value]) => value === 'MARKER')).toHaveLength(0)
+  } finally {
+    includes.mockRestore()
+    indexOf.mockRestore()
+  }
+})
+
+it('restores searches for nested generated input and later parses', () => {
+  const marked = createTiptapMarkedFacade()
+  const start = createMarkdownTokenizerStart('MARKER')
+  marked.use({
+    extensions: [
+      {
+        name: 'marker',
+        level: 'block',
+        start,
+        tokenizer(source) {
+          return source.startsWith('MARKER')
+            ? { type: 'marker', raw: 'MARKER', text: 'found' }
+            : undefined
+        }
+      },
+      {
+        name: 'wrapper',
+        level: 'block',
+        tokenizer(source) {
+          if (!source.startsWith('WRAPPER')) {
+            return undefined
+          }
+          return {
+            type: 'wrapper',
+            raw: 'WRAPPER',
+            tokens: this.lexer.blockTokens('prose\nMARKER')
+          }
+        }
+      }
+    ]
+  })
+  const nested = marked.lexer('WRAPPER')
+  expect(nested[0]).toMatchObject({
+    type: 'wrapper',
+    tokens: [{ type: 'paragraph' }, { type: 'marker' }]
+  })
+  expect(marked.lexer('prose\nMARKER').map((token) => token.type)).toEqual(['paragraph', 'marker'])
+  expect(createTiptapMarkedFacade().lexer('MARKER')[0].type).toBe('paragraph')
+})
+
+it('skips custom searches when their required marker is absent', () => {
+  const marked = createTiptapMarkedFacade()
+  const search = vi.fn((source: string) => source.search(/<details\b/i))
+  marked.use({
+    extensions: [
+      {
+        name: 'details',
+        level: 'block',
+        start: registerMarkdownTokenizerStart('<', search),
+        tokenizer: () => undefined
+      }
+    ]
+  })
+  marked.lexer('Prose\n\n'.repeat(1000))
+  expect(search).not.toHaveBeenCalled()
+  marked.lexer('Prose\n<DETAILS>')
+  expect(search).toHaveReturnedWith(5)
+})
diff --git a/src/renderer/src/components/editor/markdown-tokenizer-start.ts b/src/renderer/src/components/editor/markdown-tokenizer-start.ts
new file mode 100644
index 00000000000..b32a4539fac
--- /dev/null
+++ b/src/renderer/src/components/editor/markdown-tokenizer-start.ts
@@ -0,0 +1,22 @@
+const startMarkers = new WeakMap<(source: string) => number | void, string>()
+
+export function registerMarkdownTokenizerStart(marker: string, start: (source: string) => number) {
+  startMarkers.set(start, marker)
+  return start
+}
+
+/** Let a lexer skip suffix searches for markers absent from its entire input. */
+export function createMarkdownTokenizerStart(marker: string, lineStart = false) {
+  const start = (source: string): number => {
+    let position = source.indexOf(marker)
+    while (lineStart && position > 0 && !'\n\r\u2028\u2029'.includes(source[position - 1])) {
+      position = source.indexOf(marker, position + marker.length)
+    }
+    return position
+  }
+  return registerMarkdownTokenizerStart(marker, start)
+}
+
+export function getMarkdownTokenizerStartMarker(start: (source: string) => number | void) {
+  return startMarkers.get(start)
+}
diff --git a/src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts b/src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts
index 7118634a3b1..380a44ec8d4 100644
--- a/src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts
+++ b/src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts
@@ -1,5 +1,5 @@
 // @vitest-environment happy-dom
-import * as monaco from 'monaco-editor'
+import * as monaco from 'monaco-editor/esm/vs/editor/editor.api.js'
 import { afterEach, describe, expect, it } from 'vitest'
 import { syncContentUpdate } from './monaco-content-sync'
 
diff --git a/src/renderer/src/components/editor/monaco-cursor-line-lifetime.test.ts b/src/renderer/src/components/editor/monaco-cursor-line-lifetime.test.ts
new file mode 100644
index 00000000000..3c7baa5bf2c
--- /dev/null
+++ b/src/renderer/src/components/editor/monaco-cursor-line-lifetime.test.ts
@@ -0,0 +1,75 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { editor } from 'monaco-editor'
+import type { OpenFile } from '@/store/slices/editor'
+import { createEditorStore } from '@/store/slices/editor-slice-test-harness'
+import { installMonacoViewStateTracking } from './monaco-view-state-persistence'
+
+function makeFile(id: string, filePath: string): OpenFile {
+  return {
+    id,
+    filePath,
+    relativePath: 'file.ts',
+    worktreeId: 'wt-1',
+    language: 'typescript',
+    mode: 'edit',
+    isDirty: false
+  }
+}
+
+function startTracking(
+  store: ReturnType<typeof createEditorStore>,
+  file: OpenFile,
+  line: number
+): ReturnType<typeof installMonacoViewStateTracking> {
+  const mockEditor = {
+    getPosition: () => ({ lineNumber: line, column: 1 }),
+    onDidChangeCursorPosition: () => ({ dispose: vi.fn() }),
+    onDidScrollChange: () => ({ dispose: vi.fn() })
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Cursor tracking calls only the three mocked editor methods above.
+  const editorInstance = mockEditor as unknown as editor.IStandaloneCodeEditor
+  const params = {
+    editorInstance,
+    fileIdRef: { current: file.id },
+    viewStateKey: file.id,
+    scrollThrottleTimerRef: { current: null },
+    setEditorCursorLine: store.getState().setEditorCursorLine
+  }
+  return installMonacoViewStateTracking(params)
+}
+
+describe('Monaco cursor-line ownership lifetime', () => {
+  it('releases positions after 250 distinct owned editor tabs close', () => {
+    const store = createEditorStore()
+    for (let index = 0; index < 250; index += 1) {
+      const file = makeFile(`editor:wt-1:local:file-${index}`, `/repo/file-${index}.ts`)
+      store.setState({ openFiles: [file] })
+      const tracking = startTracking(store, file, index + 1)
+      tracking.cursorPositionSub.dispose()
+      tracking.scrollStateSub.dispose()
+      store.getState().closeFile(file.id)
+    }
+
+    expect(store.getState().openFiles).toHaveLength(0)
+    expect(Object.keys(store.getState().editorCursorLine)).toHaveLength(0)
+  })
+
+  it('isolates same-path positions and closes only the selected file identity', () => {
+    const store = createEditorStore()
+    const local = makeFile('editor:wt-1:local:file.ts', '/repo/file.ts')
+    const remote = makeFile('editor:wt-1:remote-a:file.ts', '/repo/file.ts')
+    store.setState({ openFiles: [local, remote] })
+    const localTracking = startTracking(store, local, 12)
+    const remoteTracking = startTracking(store, remote, 35)
+
+    expect(store.getState().editorCursorLine).toEqual({ [local.id]: 12, [remote.id]: 35 })
+    localTracking.cursorPositionSub.dispose()
+    localTracking.scrollStateSub.dispose()
+    store.getState().closeFile(local.id)
+    expect(store.getState().editorCursorLine).toEqual({ [remote.id]: 35 })
+    remoteTracking.cursorPositionSub.dispose()
+    remoteTracking.scrollStateSub.dispose()
+    store.getState().closeFile(remote.id)
+    expect(store.getState().editorCursorLine).toEqual({})
+  })
+})
diff --git a/src/renderer/src/components/editor/monaco-view-state-persistence.test.ts b/src/renderer/src/components/editor/monaco-view-state-persistence.test.ts
index 60dfe48cdeb..a8001fdffb4 100644
--- a/src/renderer/src/components/editor/monaco-view-state-persistence.test.ts
+++ b/src/renderer/src/components/editor/monaco-view-state-persistence.test.ts
@@ -76,7 +76,7 @@ describe('Monaco view state persistence', () => {
 
     installMonacoViewStateTracking({
       editorInstance,
-      filePath: 'file.ts',
+      fileIdRef: { current: 'file.ts' },
       viewStateKey: 'file.ts::tab-1',
       scrollThrottleTimerRef: { current: null },
       setEditorCursorLine
diff --git a/src/renderer/src/components/editor/monaco-view-state-persistence.ts b/src/renderer/src/components/editor/monaco-view-state-persistence.ts
index 46272e9ee39..33c5a963923 100644
--- a/src/renderer/src/components/editor/monaco-view-state-persistence.ts
+++ b/src/renderer/src/components/editor/monaco-view-state-persistence.ts
@@ -4,7 +4,7 @@ import { editorSelectionCache, scrollTopCache, setWithLRU } from '@/lib/scroll-c
 
 type MonacoViewStateTrackingParams = {
   editorInstance: editor.IStandaloneCodeEditor
-  filePath: string
+  fileIdRef: MutableRefObject<string>
   viewStateKey: string
   scrollThrottleTimerRef: MutableRefObject<ReturnType<typeof setTimeout> | null>
   setEditorCursorLine: (fileId: string, line: number) => void
@@ -14,16 +14,16 @@ export function installMonacoViewStateTracking(params: MonacoViewStateTrackingPa
   cursorPositionSub: { dispose: () => void }
   scrollStateSub: { dispose: () => void }
 } {
-  const { editorInstance, filePath, viewStateKey, scrollThrottleTimerRef, setEditorCursorLine } =
+  const { editorInstance, fileIdRef, viewStateKey, scrollThrottleTimerRef, setEditorCursorLine } =
     params
 
   // Track cursor line for "copy path to line" feature
   const pos = editorInstance.getPosition()
   if (pos) {
-    setEditorCursorLine(filePath, pos.lineNumber)
+    setEditorCursorLine(fileIdRef.current, pos.lineNumber)
   }
   const cursorPositionSub = editorInstance.onDidChangeCursorPosition((e) => {
-    setEditorCursorLine(filePath, e.position.lineNumber)
+    setEditorCursorLine(fileIdRef.current, e.position.lineNumber)
   })
 
   // Why: only the resting scroll position matters, so trailing-throttle writes (~150ms) instead of writing every 60fps frame.
diff --git a/src/renderer/src/components/editor/raw-markdown-html.ts b/src/renderer/src/components/editor/raw-markdown-html.ts
index edcf8715808..226979b030c 100644
--- a/src/renderer/src/components/editor/raw-markdown-html.ts
+++ b/src/renderer/src/components/editor/raw-markdown-html.ts
@@ -1,3 +1,4 @@
+import { createMarkdownTokenizerStart } from './markdown-tokenizer-start'
 import { Node, mergeAttributes } from '@tiptap/core'
 import { isEditableDetailsHtmlBlock, matchDetailsHtmlBlock } from './details-markdown-html'
 import { formatMarkdownDocLinkBody, parseMarkdownDocLink } from './markdown-doc-links'
@@ -44,11 +45,7 @@ function isLineOnlyHtml(line: string): boolean {
 function matchBlockHtml(content: string, start: number): string | null {
   const lineEnd = findLineEnd(content, start)
   const line = content.slice(start, lineEnd)
-  if (!isLineOnlyHtml(line)) {
-    return null
-  }
-
-  return line
+  return isLineOnlyHtml(line) ? line : null
 }
 
 export function encodeRawMarkdownHtmlForRichEditor(
@@ -282,7 +279,9 @@ function createRawSourceNode({
     markdownTokenizer: {
       name,
       level: inline ? 'inline' : 'block',
-      start: inline ? skipInlineTransportStartScan : transport.startFor(kind),
+      start: inline
+        ? skipInlineTransportStartScan
+        : createMarkdownTokenizerStart(transport.startFor(kind)),
       tokenize(src) {
         const matched = transport.match(src, kind)
         if (!matched) {
diff --git a/src/renderer/src/components/editor/rich-markdown-block-source-work.test.ts b/src/renderer/src/components/editor/rich-markdown-block-source-work.test.ts
new file mode 100644
index 00000000000..ef8d64b0a2f
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-block-source-work.test.ts
@@ -0,0 +1,52 @@
+import { Editor } from '@tiptap/core'
+import { expect, it, vi } from 'vitest'
+import { createRichMarkdownEditorCodec } from './rich-markdown-source-transport'
+import { createRichMarkdownExtensions } from './rich-markdown-extensions'
+import { commitRichMarkdownSerialization } from './rich-markdown-serialization-commit'
+
+function create(source: string) {
+  return new Editor({
+    element: null,
+    extensions: createRichMarkdownExtensions({ codec: createRichMarkdownEditorCodec() }),
+    content: source,
+    contentType: 'markdown'
+  })
+}
+
+it('proves the assembled document without reparsing every unchanged source block', () => {
+  const source = `${Array.from(
+    { length: 1000 },
+    (_, index) => `Paragraph ${index} with _emphasis_.\n\n> [!NOTE]\n> - Callout ${index}\n\n`
+  ).join('')}End\n`
+  const editor = create(source)
+  const refs = {
+    originalSourceRef: { current: source },
+    baseCanonicalRef: { current: editor.getMarkdown() },
+    lastCommittedMarkdownRef: { current: source }
+  }
+  const parse = vi.spyOn(editor.markdown!, 'parse')
+  let expected = source
+  try {
+    for (let edit = 0; edit < 3; edit++) {
+      parse.mockClear()
+      editor.commands.insertContentAt(1, { type: 'text', text: 'x' })
+      expected = `x${expected}`
+      const result = commitRichMarkdownSerialization(editor, refs, (markdown) => {
+        const reopened = create(markdown)
+        try {
+          return reopened.getMarkdown()
+        } finally {
+          reopened.destroy()
+        }
+      })
+      expect(result.markdown).toBe(expected)
+      expect(parse.mock.calls.filter(([markdown]) => markdown.length > 50_000)).toHaveLength(
+        edit === 0 ? 2 : 1
+      )
+      expect(parse.mock.calls.length).toBeLessThanOrEqual(3)
+    }
+  } finally {
+    parse.mockRestore()
+    editor.destroy()
+  }
+})
diff --git a/src/renderer/src/components/editor/rich-markdown-block-source.ts b/src/renderer/src/components/editor/rich-markdown-block-source.ts
new file mode 100644
index 00000000000..514e40d486e
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-block-source.ts
@@ -0,0 +1,208 @@
+import type { Editor } from '@tiptap/core'
+import { getRichMarkdownSerializationDocument } from './rich-markdown-trailing-paragraph'
+import type { Node as ProseMirrorNode } from '@tiptap/pm/model'
+import { diffArrays } from 'diff'
+import { extractAbsorbedBlankLines } from '@tiptap/markdown'
+import { encodeRawMarkdownHtmlForRichEditor } from './raw-markdown-html'
+import type { RichMarkdownEditorCodec } from './rich-markdown-source-transport'
+import {
+  reconcileSerializedMarkdown,
+  restoreMarkdownSourceEol
+} from './rich-markdown-source-reconcile'
+
+type SourceBlock = { node: ProseMirrorNode; source: string; separator: string }
+type SourceDocument = { source: string; leading: string; blocks: SourceBlock[] }
+type SourceContext = {
+  codec: RichMarkdownEditorCodec
+  htmlSuperscriptLinks: boolean
+  baseline?: SourceDocument
+}
+
+const contexts = new WeakMap<Editor, SourceContext>()
+
+export function registerRichMarkdownBlockSource(
+  editor: Editor,
+  codec: RichMarkdownEditorCodec,
+  htmlSuperscriptLinks: boolean
+): void {
+  contexts.set(editor, { codec, htmlSuperscriptLinks })
+}
+
+function parse(editor: Editor, context: SourceContext, source: string): ProseMirrorNode {
+  return editor.schema.nodeFromJSON(
+    editor.markdown!.parse(encodeRawMarkdownHtmlForRichEditor(source, context.codec, context))
+  )
+}
+
+function readSourceDocument(
+  editor: Editor,
+  context: SourceContext,
+  source: string,
+  expected?: ProseMirrorNode
+): SourceDocument | null {
+  const normalized = source.replace(/\r\n/g, '\n')
+  const document = expected ?? parse(editor, context, normalized)
+  const tokens = extractAbsorbedBlankLines(context.codec.marked.lexer(normalized))
+  // Definitions and custom source owners may cross token boundaries; never guess their spans.
+  if (tokens.map((token) => token.raw).join('') !== normalized) {
+    return null
+  }
+  const blocks: SourceBlock[] = []
+  let leading = ''
+  const lastContentIndex = tokens.findLastIndex((token) => token.type !== 'space')
+  for (const [tokenIndex, token] of tokens.entries()) {
+    const raw = token.raw
+    if (raw === undefined) {
+      return null
+    }
+    if (token.type === 'space') {
+      const pieces: string[] = []
+      let offset = 0
+      for (const match of raw.matchAll(/\n\n/g)) {
+        pieces.push(raw.slice(offset, match.index + 2))
+        offset = match.index + 2
+      }
+      const remainder = raw.slice(offset)
+      const previous = blocks.at(-1)
+      if (pieces.length === 0) {
+        if (previous) {
+          previous.separator += remainder
+        } else {
+          leading += remainder
+        }
+        continue
+      }
+      const atEnd = tokenIndex > lastContentIndex
+      if (previous) {
+        previous.separator += pieces.shift()!
+      }
+      // Match the parser's implicit paragraphs, including leading/trailing blank runs.
+      for (const separator of pieces) {
+        blocks.push({ node: editor.schema.nodes.paragraph.create(), source: '', separator })
+      }
+      if (previous && atEnd) {
+        blocks.push({
+          node: editor.schema.nodes.paragraph.create(),
+          source: '',
+          separator: remainder
+        })
+      } else {
+        blocks.at(-1)!.separator += remainder
+      }
+      continue
+    }
+    const text = raw.replace(/\n+$/, '')
+    if (blocks.length >= document.childCount) {
+      return null
+    }
+    // These spans are provisional; the assembled document must pass the full parse proof below.
+    blocks.push({
+      node: document.child(blocks.length),
+      source: text,
+      separator: raw.slice(text.length)
+    })
+  }
+  if (
+    document.childCount !== blocks.length ||
+    blocks.some((block, index) => !block.node.eq(document.child(index)))
+  ) {
+    return null
+  }
+  return { source, leading, blocks }
+}
+
+/** Reuse exact source for equal blocks, even when character-level reconciliation cannot match. */
+export function reconcileRichMarkdownBlockSource(
+  editor: Editor,
+  originalSource: string,
+  edited: string,
+  roundTrip: (source: string) => string | null
+): string | null {
+  const context = contexts.get(editor)
+  if (!context) {
+    return null
+  }
+  try {
+    const baseline =
+      context.baseline?.source === originalSource
+        ? context.baseline
+        : readSourceDocument(editor, context, originalSource)
+    if (!baseline) {
+      return null
+    }
+    context.baseline = baseline
+    const document = getRichMarkdownSerializationDocument(editor)
+    const current = readSourceDocument(editor, context, edited, document)
+    if (!current) {
+      return null
+    }
+    // Bound replacement-heavy diffs; ordinary single-block edits remain linear in document size.
+    const changes = diffArrays(baseline.blocks, current.blocks, {
+      comparator: (before, after) => before.node.eq(after.node),
+      maxEditLength: 256
+    })
+    if (!changes) {
+      return null
+    }
+    const blocks: SourceBlock[] = []
+    let originalIndex = 0
+    let removed: SourceBlock[] = []
+    for (const change of changes) {
+      if (change.added) {
+        for (const [index, block] of change.value.entries()) {
+          const previous = removed.length === change.count ? removed[index] : undefined
+          const canonical = previous ? roundTrip(previous.source) : null
+          const source =
+            previous && canonical !== null
+              ? reconcileSerializedMarkdown({
+                  originalSource: previous.source,
+                  baseCanonical: canonical,
+                  edited: block.source,
+                  roundTrip
+                })
+              : block.source
+          blocks.push({ ...block, source, separator: previous?.separator ?? block.separator })
+        }
+        removed = []
+      } else if (change.removed) {
+        removed = baseline.blocks.slice(originalIndex, originalIndex + change.count)
+        originalIndex += change.count
+      } else {
+        removed = []
+        blocks.push(...baseline.blocks.slice(originalIndex, originalIndex + change.count))
+        originalIndex += change.count
+      }
+    }
+    // A moved EOF block needs a separator before the next block.
+    for (let index = 0; index < blocks.length - 1; index++) {
+      if (!blocks[index].separator) {
+        blocks[index] = { ...blocks[index], separator: '\n\n' }
+      }
+    }
+    const assemble = () =>
+      baseline.leading + blocks.map((block) => block.source + block.separator).join('')
+    let candidate = assemble()
+    // Validate the assembled document, including cross-block reference and delimiter interactions.
+    if (!parse(editor, context, candidate).eq(document)) {
+      const originalIndices = new Map(baseline.blocks.map((block, index) => [block, index]))
+      for (let index = 0; index < blocks.length - 1; index++) {
+        const originalIndex = originalIndices.get(blocks[index])
+        const unchangedBoundary =
+          originalIndex !== undefined &&
+          originalIndices.get(blocks[index + 1]) === originalIndex + 1
+        if (!unchangedBoundary && !blocks[index].separator.includes('\n\n')) {
+          blocks[index] = { ...blocks[index], separator: '\n\n' }
+        }
+      }
+      candidate = assemble()
+      if (!parse(editor, context, candidate).eq(document)) {
+        return null
+      }
+    }
+    const result = restoreMarkdownSourceEol(candidate, originalSource)
+    context.baseline = { source: result, leading: baseline.leading, blocks }
+    return result
+  } catch {
+    return null
+  }
+}
diff --git a/src/renderer/src/components/editor/rich-markdown-details-case.test.ts b/src/renderer/src/components/editor/rich-markdown-details-case.test.ts
new file mode 100644
index 00000000000..caf92d90a04
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-details-case.test.ts
@@ -0,0 +1,25 @@
+import { Editor } from '@tiptap/core'
+import { expect, it } from 'vitest'
+import { createRichMarkdownExtensions } from './rich-markdown-extensions'
+import { createRichMarkdownEditorCodec } from './rich-markdown-source-transport'
+
+it.each(['details', 'Details', 'DETAILS', 'dEtAiLs'])(
+  'opens %s after prose as an editable toggle',
+  (tag) => {
+    const editor = new Editor({
+      element: null,
+      extensions: createRichMarkdownExtensions({ codec: createRichMarkdownEditorCodec() }),
+      content: `Before\n<${tag}><summary>Title</summary>\n\nBody\n\n</${tag}>`,
+      contentType: 'markdown'
+    })
+    try {
+      expect(editor.state.doc.child(0).textContent).toBe('Before')
+      const toggle = editor.state.doc.child(1)
+      expect(toggle.type.name).toBe('details')
+      expect(toggle.child(0).textContent).toBe('Title')
+      expect(toggle.child(1).textContent).toBe('Body')
+    } finally {
+      editor.destroy()
+    }
+  }
+)
diff --git a/src/renderer/src/components/editor/rich-markdown-details-extension.ts b/src/renderer/src/components/editor/rich-markdown-details-extension.ts
index 1bfcfc09a15..f7e28fd16c2 100644
--- a/src/renderer/src/components/editor/rich-markdown-details-extension.ts
+++ b/src/renderer/src/components/editor/rich-markdown-details-extension.ts
@@ -1,3 +1,5 @@
+import { registerMarkdownTokenizerStart } from './markdown-tokenizer-start'
+import { guardMarkdownDirectiveTokenizer } from './markdown-directive-tokenizer'
 import { decodeHtmlEntities, type AnyExtension, type Editor } from '@tiptap/core'
 import { Details, DetailsContent, DetailsSummary } from '@tiptap/extension-details'
 import type { PlaceholderOptions } from '@tiptap/extension-placeholder'
@@ -228,7 +230,7 @@ const OrcaDetails = Details.extend({
   markdownTokenizer: {
     name: 'details',
     level: 'block',
-    start: '<details',
+    start: registerMarkdownTokenizerStart('<', (source) => source.search(/<details\b/i)),
     tokenize(src, _tokens, lexer) {
       const detailsBlock = matchDetailsHtmlBlock(src, 0)
       if (!detailsBlock || !isEditableDetailsHtmlBlock(detailsBlock)) {
@@ -287,6 +289,10 @@ const OrcaDetails = Details.extend({
 })
 
 const OrcaDetailsSummary = DetailsSummary.extend({
+  markdownTokenizer: guardMarkdownDirectiveTokenizer(
+    DetailsSummary.config.markdownTokenizer,
+    'detailsSummary'
+  ),
   // Why: the summary parser runs parseInline, which emits image/math nodes that
   // upstream's text*-only summary rejects, so the doc is schema-invalid until the
   // first edit reassembles the summary and ProseMirror throws.
@@ -294,6 +300,10 @@ const OrcaDetailsSummary = DetailsSummary.extend({
 })
 
 const OrcaDetailsContent = DetailsContent.extend({
+  markdownTokenizer: guardMarkdownDirectiveTokenizer(
+    DetailsContent.config.markdownTokenizer,
+    'detailsContent'
+  ),
   // Why: detailsContent's double-Enter escape must run before StarterKit's
   // generic paragraph split, otherwise users can get stuck inside a toggle.
   priority: 1000,
diff --git a/src/renderer/src/components/editor/rich-markdown-document-fidelity.test.ts b/src/renderer/src/components/editor/rich-markdown-document-fidelity.test.ts
new file mode 100644
index 00000000000..974a32f4d74
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-document-fidelity.test.ts
@@ -0,0 +1,147 @@
+import { reconcileRichMarkdownBlockSource } from './rich-markdown-block-source'
+import { Editor } from '@tiptap/core'
+import { describe, expect, it } from 'vitest'
+import { createRichMarkdownExtensions } from './rich-markdown-extensions'
+import { createRichMarkdownEditorCodec } from './rich-markdown-source-transport'
+import { encodeRawMarkdownHtmlForRichEditor } from './raw-markdown-html'
+import { normalizeEmptyListItems } from './rich-markdown-normalize'
+import { commitRichMarkdownSerialization } from './rich-markdown-serialization-commit'
+
+function createEditor(source: string) {
+  const codec = createRichMarkdownEditorCodec()
+  const editor = new Editor({
+    element: null,
+    extensions: createRichMarkdownExtensions({ codec }),
+    content: encodeRawMarkdownHtmlForRichEditor(source, codec),
+    contentType: 'markdown'
+  })
+  normalizeEmptyListItems(editor)
+  return editor
+}
+
+function serialize(source: string) {
+  const editor = createEditor(source)
+  try {
+    return editor.getMarkdown()
+  } finally {
+    editor.destroy()
+  }
+}
+
+const article = [
+  '# Der Turing-Test',
+  '',
+  'Der Turing-Test ist ein Gedankenexperiment aus dem Jahr 1950.',
+  '',
+  '> [!wissenswert] Das Original war ein Ratespiel um Mann und Frau',
+  '> In Turings Aufsatz heißt der Test "Imitation Game".',
+  '',
+  'Ein zweiter Absatz mit user_name_field, feature~2 und [^1].',
+  '',
+  '> [!zeitstrahl] 75 Jahre Imitation Game',
+  '> - 1950 · Alan Turing veröffentlicht seinen Aufsatz.',
+  '> - 1980 · John Searle widerspricht.',
+  '',
+  'Ein dritter Absatz mit *echter Betonung*.',
+  '',
+  '> [!achtung] Heißt „bestanden“, dass die Maschine denkt?',
+  '> Nein, und das ist der Einwand von John Searle.',
+  '',
+  '> [!selbsttest]',
+  '> - Was hat Turing mit dem Test erreichen wollen?',
+  '> - Was bedeutet Intelligenz?',
+  ''
+].join('\n')
+
+describe('rich Markdown document source fidelity', () => {
+  it.each([article, article.repeat(100), article.replaceAll('\n\n', '\n\n\n\n').repeat(60)])(
+    'only changes edited prose across successive commits (%#)',
+    (source) => {
+      const editor = createEditor(source)
+      const refs = {
+        originalSourceRef: { current: source },
+        baseCanonicalRef: { current: editor.getMarkdown() },
+        lastCommittedMarkdownRef: { current: source }
+      }
+      let expected = source
+      try {
+        for (const text of ['1950.', '[^1].', '*echter Betonung*.']) {
+          const needle = text.replace(/\*/g, '')
+          let position = -1
+          editor.state.doc.descendants((node, pos) => {
+            if (position === -1 && node.isText && node.text?.includes(needle)) {
+              position = pos + node.text.indexOf(needle) + needle.length
+            }
+          })
+          // The final period is a separate text node after the italic mark.
+          if (position === -1) {
+            editor.state.doc.descendants((node, pos) => {
+              if (
+                position === -1 &&
+                node.type.name === 'paragraph' &&
+                node.textContent.includes('Ein dritter')
+              ) {
+                position = pos + node.nodeSize - 1
+              }
+            })
+          }
+          expect(position).toBeGreaterThan(0)
+          editor.commands.insertContentAt(position, { type: 'text', text: ' rgffggf' })
+          expected = expected.replace(text, `${text} rgffggf`)
+          const result = commitRichMarkdownSerialization(editor, refs, serialize)
+          expect(result.markdown).toBe(expected)
+          const reopened = createEditor(result.markdown)
+          try {
+            expect(reopened.getJSON()).toEqual(editor.getJSON())
+          } finally {
+            reopened.destroy()
+          }
+        }
+      } finally {
+        editor.destroy()
+      }
+    }
+  )
+})
+
+describe('block source reconciliation when a whole-document patch cannot be applied', () => {
+  it.each([
+    ['\n\n_Keep_\n\n\n\nEnd\n\n', '\n\n_Keep_\n\n\n\nChanged\n\n', '\n\n_Keep_\n\n\n\nChanged\n\n'],
+    [
+      '_Keep_\n\n> [!NOTE]\n> - a\n',
+      '_Keep_\n\n> [!NOTE]\n> - a\n\nAdded paragraph\n',
+      '_Keep_\n\n> [!NOTE]\n> - a\n\nAdded paragraph'
+    ],
+    ['_Keep_\n', '_Keep_\n\nAdded paragraph', '_Keep_\n\nAdded paragraph'],
+    [
+      '_Keep_\n\nRemove this\n\n> [!NOTE]\n> - a\n',
+      '_Keep_\n\n> [!NOTE]\n> - a\n',
+      '_Keep_\n\n> [!NOTE]\n> - a\n'
+    ],
+    [
+      '_Keep_\n\nRepeat\n\nRepeat\n\nEnd\n',
+      '_Keep_\n\nRepeat\n\nChanged\n\nEnd\n',
+      '_Keep_\n\nRepeat\n\nChanged\n\nEnd\n'
+    ],
+    ['_Keep_\r\n\r\nEnd\r\n', '_Keep_\n\nChanged', '_Keep_\r\n\r\nChanged\r\n'],
+    [
+      '_Keep_\n\n```text\n[] \\_ ~ ` *\n```\n\nEnd\n',
+      '_Keep_\n\n```text\n[] \\_ ~ ` *\n```\n\nChanged\n',
+      '_Keep_\n\n```text\n[] \\_ ~ ` *\n```\n\nChanged\n'
+    ]
+  ])('preserves source through structural changes (%#)', (source, changed, expected) => {
+    const editor = createEditor(changed)
+    try {
+      const result = reconcileRichMarkdownBlockSource(
+        editor,
+        source,
+        editor.getMarkdown(),
+        serialize
+      )
+      expect(result).toBe(expected)
+      expect(serialize(result!)).toBe(editor.getMarkdown())
+    } finally {
+      editor.destroy()
+    }
+  })
+})
diff --git a/src/renderer/src/components/editor/rich-markdown-escape-fidelity.test.ts b/src/renderer/src/components/editor/rich-markdown-escape-fidelity.test.ts
new file mode 100644
index 00000000000..5f2584495e4
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-escape-fidelity.test.ts
@@ -0,0 +1,212 @@
+import { Editor, type JSONContent } from '@tiptap/core'
+import StarterKit from '@tiptap/starter-kit'
+import { describe, expect, it, vi } from 'vitest'
+import { encodeRawMarkdownHtmlForRichEditor } from './raw-markdown-html'
+import { createRichMarkdownExtensions } from './rich-markdown-extensions'
+import { createRichMarkdownEditorCodec } from './rich-markdown-source-transport'
+import { createIsolatedMarkdownExtensionForTests } from './isolated-markdown-extension-for-tests'
+
+function createEditor(content: JSONContent | string) {
+  return new Editor({
+    element: null,
+    extensions: [StarterKit, createIsolatedMarkdownExtensionForTests()],
+    content,
+    ...(typeof content === 'string' ? { contentType: 'markdown' as const } : {})
+  })
+}
+
+function paragraph(text: string): JSONContent {
+  return { type: 'paragraph', content: [{ type: 'text', text }] }
+}
+
+function expectReopens(editor: Editor, reopen = createEditor): void {
+  const reopened = reopen(editor.getMarkdown())
+  try {
+    expect(reopened.getJSON()).toEqual(editor.getJSON())
+  } finally {
+    reopened.destroy()
+  }
+}
+
+function createRichEditor(content: JSONContent | string) {
+  const codec = createRichMarkdownEditorCodec()
+  return new Editor({
+    element: null,
+    extensions: createRichMarkdownExtensions({ codec }),
+    content:
+      typeof content === 'string' ? encodeRawMarkdownHtmlForRichEditor(content, codec) : content,
+    ...(typeof content === 'string' ? { contentType: 'markdown' as const } : {})
+  })
+}
+
+describe('optional Markdown escapes', () => {
+  it.each(['user_name_field', 'a_2_b', 'a__b', 'пристаням_стремятся', '𐐀_𐐁', 'é_value'])(
+    'preserves intraword underscores in %s',
+    (text) => {
+      const editor = createEditor({ type: 'doc', content: [paragraph(text)] })
+      try {
+        expect(editor.getMarkdown()).toBe(text)
+        expectReopens(editor)
+      } finally {
+        editor.destroy()
+      }
+    }
+  )
+
+  it.each(['__init__', '___init___', '_word_', 'see a. __b__c', 'a\\_b', 'a\\\\_b'])(
+    'keeps literal delimiter runs and backslashes safe: %s',
+    (text) => {
+      const editor = createEditor({ type: 'doc', content: [paragraph(text)] })
+      try {
+        expectReopens(editor)
+      } finally {
+        editor.destroy()
+      }
+    }
+  )
+
+  it.each(['feature~2', 'an unmatched ` tick', 'a single * marker', 'a~b_c*d`e'])(
+    'omits optional escapes only when the parser proves the literal survives: %s',
+    (text) => {
+      const editor = createEditor({ type: 'doc', content: [paragraph(text)] })
+      try {
+        expect(editor.getMarkdown()).toBe(text)
+        expectReopens(editor)
+      } finally {
+        editor.destroy()
+      }
+    }
+  )
+
+  it.each([
+    '~5 dollars, see v2~beta',
+    '~~deleted~~',
+    '*italic*',
+    '**bold**',
+    '`code`',
+    '[label](url)',
+    '[literal] *bold* feature~2'
+  ])('retains escapes that prevent new Markdown syntax: %s', (text) => {
+    const editor = createEditor({ type: 'doc', content: [paragraph(text)] })
+    try {
+      expectReopens(editor)
+      if (text.includes('feature~2')) {
+        expect(editor.getMarkdown()).toContain('feature~2')
+      }
+    } finally {
+      editor.destroy()
+    }
+  })
+
+  it('preserves identifiers alongside emphasis-like literals', () => {
+    const editor = createEditor({ type: 'doc', content: [paragraph('__init__ user_name')] })
+    try {
+      expect(editor.getMarkdown()).toContain('user_name')
+      expectReopens(editor)
+    } finally {
+      editor.destroy()
+    }
+  })
+
+  it('preserves callouts and identifiers in nested containers', () => {
+    const source = '> [!NOTE] user_name\n>\n> - [literal] a__b\n\n- outer_name\n  - inner_name'
+    const editor = createEditor(source)
+    try {
+      expect(editor.getMarkdown()).toContain('> [!NOTE] user_name')
+      expect(editor.getMarkdown()).toContain('[literal] a__b')
+      expect(editor.getMarkdown()).toContain('inner_name')
+      expectReopens(editor)
+    } finally {
+      editor.destroy()
+    }
+  })
+
+  it('validates marks across adjacent text nodes', () => {
+    const editor = createEditor({
+      type: 'doc',
+      content: [
+        {
+          type: 'paragraph',
+          content: [
+            { type: 'text', text: 'a_' },
+            { type: 'text', text: '_b_', marks: [{ type: 'bold' }] },
+            { type: 'text', text: '_c user_name' }
+          ]
+        }
+      ]
+    })
+    try {
+      expect(editor.getMarkdown()).toContain('user_name')
+      expectReopens(editor)
+    } finally {
+      editor.destroy()
+    }
+  })
+
+  it('does not activate definitions nested in another block', () => {
+    const editor = createEditor({
+      type: 'doc',
+      content: [paragraph('[ref]'), { type: 'blockquote', content: [paragraph('[ref]: /target')] }]
+    })
+    try {
+      expectReopens(editor)
+    } finally {
+      editor.destroy()
+    }
+  })
+})
+
+describe('literal escape validation boundaries', () => {
+  it('validates a nested container once and caches unchanged blocks', () => {
+    const editor = createEditor('> [!NOTE] user_name\n>\n> - inner_value')
+    const parse = vi.spyOn(editor.markdown!, 'parse')
+    try {
+      expect(editor.getMarkdown()).toContain('[!NOTE] user_name')
+      expect(parse).toHaveBeenCalledTimes(1)
+      editor.getMarkdown()
+      expect(parse).toHaveBeenCalledTimes(1)
+      editor.commands.insertContentAt(3, { type: 'text', text: 'edit ' })
+      editor.getMarkdown()
+      expect(parse).toHaveBeenCalledTimes(2)
+      expectReopens(editor)
+    } finally {
+      parse.mockRestore()
+      editor.destroy()
+    }
+  })
+
+  it('skips optional validation for an oversized block', () => {
+    const editor = createEditor({ type: 'doc', content: [paragraph(`${'a_'.repeat(25_001)}b`)] })
+    const parse = vi.spyOn(editor.markdown!, 'parse')
+    try {
+      expect(editor.getMarkdown()).toContain('a\\_')
+      expect(parse).not.toHaveBeenCalled()
+    } finally {
+      parse.mockRestore()
+      editor.destroy()
+    }
+  })
+
+  it.each([
+    '> [!TIP] user_name\n>\n> - [x] inner_value',
+    '> user_name <span data-value="literal_[]">raw\\_value</span>',
+    '<div>literal\\_[]</div>\n\nuser_name',
+    '> user_name `literal\\_[]`',
+    '```text\nliteral\\_[]\n```\n\nuser_name',
+    '[ref]\n\n> [ref]: /target\n>\n> tail',
+    '> [ref]\n\n[ref]: /target'
+  ])('preserves source ownership and reopen semantics: %s', (source) => {
+    const editor = createRichEditor(source)
+    try {
+      expectReopens(editor, createRichEditor)
+      if (source.includes('<div>')) {
+        expect(editor.getMarkdown()).toContain('<div>literal\\_[]</div>')
+      }
+      if (source.includes('<span')) {
+        expect(editor.getMarkdown()).toContain('<span data-value="literal_[]">')
+      }
+    } finally {
+      editor.destroy()
+    }
+  })
+})
diff --git a/src/renderer/src/components/editor/rich-markdown-extension.ts b/src/renderer/src/components/editor/rich-markdown-extension.ts
index c36c692b4b9..06d93579abf 100644
--- a/src/renderer/src/components/editor/rich-markdown-extension.ts
+++ b/src/renderer/src/components/editor/rich-markdown-extension.ts
@@ -1,4 +1,5 @@
 import { Markdown } from '@tiptap/markdown'
+import { registerRichMarkdownBlockSource } from './rich-markdown-block-source'
 import { preserveLiteralMarkdownSource } from './rich-markdown-literal-serialization'
 import type { RichMarkdownEditorCodec } from './rich-markdown-source-transport'
 
@@ -23,6 +24,7 @@ export function createRichMarkdownExtension(
     onBeforeCreate(event) {
       this.parent?.(event)
       preserveLiteralMarkdownSource(this.editor, codec, htmlSuperscriptLinks)
+      registerRichMarkdownBlockSource(this.editor, codec, htmlSuperscriptLinks)
     }
   })
 }
diff --git a/src/renderer/src/components/editor/rich-markdown-extensions.ts b/src/renderer/src/components/editor/rich-markdown-extensions.ts
index 9a4f292f042..c7e69917c25 100644
--- a/src/renderer/src/components/editor/rich-markdown-extensions.ts
+++ b/src/renderer/src/components/editor/rich-markdown-extensions.ts
@@ -1,11 +1,13 @@
+import { createMarkdownTokenizerStart } from './markdown-tokenizer-start'
 import type { AnyExtension } from '@tiptap/core'
 import StarterKit from '@tiptap/starter-kit'
+import { RichMarkdownTrailingParagraph } from './rich-markdown-trailing-paragraph'
 import Link from '@tiptap/extension-link'
 import { Code } from '@tiptap/extension-code'
 import Image from '@tiptap/extension-image'
 import Placeholder from '@tiptap/extension-placeholder'
 import TaskItem from '@tiptap/extension-task-item'
-import { Table } from '@tiptap/extension-table'
+import { RichMarkdownTable } from './rich-markdown-table'
 import { TableCell } from '@tiptap/extension-table-cell'
 import { TableHeader } from '@tiptap/extension-table-header'
 import { TableRow } from '@tiptap/extension-table-row'
@@ -73,9 +75,11 @@ export function createRichMarkdownExtensions({
       code: false,
       codeBlock: false,
       orderedList: false,
-      paragraph: false
+      paragraph: false,
+      trailingNode: false
     }),
     RichMarkdownParagraph,
+    RichMarkdownTrailingParagraph,
     RichMarkdownCode,
     RichMarkdownCodeBlockLowlight.extend({
       addNodeView() {
@@ -218,7 +222,7 @@ export function createRichMarkdownExtensions({
       nested: true
     }),
     ...createOrcaDetailsExtensions(),
-    Table.configure({
+    RichMarkdownTable.configure({
       resizable: false
     }),
     TableRow,
@@ -229,7 +233,16 @@ export function createRichMarkdownExtensions({
         throwOnError: false
       }
     }),
-    BlockMath.configure({
+    BlockMath.extend({
+      markdownTokenizer:
+        BlockMath.config.markdownTokenizer &&
+        typeof BlockMath.config.markdownTokenizer !== 'function'
+          ? {
+              ...BlockMath.config.markdownTokenizer,
+              start: createMarkdownTokenizerStart('$$')
+            }
+          : BlockMath.config.markdownTokenizer
+    }).configure({
       katexOptions: {
         displayMode: true,
         throwOnError: false
diff --git a/src/renderer/src/components/editor/rich-markdown-literal-serialization.ts b/src/renderer/src/components/editor/rich-markdown-literal-serialization.ts
index d294bec3e06..3a998fe0495 100644
--- a/src/renderer/src/components/editor/rich-markdown-literal-serialization.ts
+++ b/src/renderer/src/components/editor/rich-markdown-literal-serialization.ts
@@ -1,11 +1,24 @@
 import type { Editor, JSONContent } from '@tiptap/core'
+import { getRichMarkdownSerializationDocument } from './rich-markdown-trailing-paragraph'
 import type { Node as ProseMirrorNode } from '@tiptap/pm/model'
 import { encodeRawMarkdownHtmlForRichEditor } from './raw-markdown-html'
 import type { RichMarkdownEditorCodec } from './rich-markdown-source-transport'
 
+const MAX_LITERAL_BLOCK_CODE_UNITS = 50_000
+const LITERAL_BLOCK_TYPES = new Set([
+  'paragraph',
+  'heading',
+  'blockquote',
+  'bulletList',
+  'orderedList',
+  'taskList'
+])
+
 function withoutOptionalEscapes(markdown: string): string {
-  return markdown.replace(/\\([\\_[\]])/g, (escaped, character) =>
-    character === '\\' ? escaped : character
+  // Consume escaped backslashes first; underscore runs must be wholly inside a word.
+  return markdown.replace(
+    /\\\\|(?<=[\p{L}\p{N}\p{M}])(?:\\_)+(?=[\p{L}\p{N}\p{M}])|\\[[\]]/gu,
+    (escaped) => (escaped === '\\\\' ? escaped : escaped.replace(/\\/g, ''))
   )
 }
 
@@ -16,51 +29,74 @@ export function preserveLiteralMarkdownSource(
 ): void {
   const manager = editor.markdown!
   const render = manager.renderNodeToMarkdown.bind(manager)
-  const serialize = editor.getMarkdown.bind(editor)
   const cache = new WeakMap<ProseMirrorNode, { markdown: string; result: string }>()
   let blocks: Map<JSONContent, ProseMirrorNode> | undefined
 
   manager.renderNodeToMarkdown = (node, ...args) => {
     const markdown = render(node, ...args)
     const block = blocks?.get(node)
-    if (!block || !/\\[[\]]/.test(markdown)) {
+    if (!block || !/\\[_[\]~`*]/.test(markdown)) {
+      return markdown
+    }
+    // Retain existing large paragraph/heading fidelity; cap only the expanded validation.
+    const preservesBrackets =
+      (node.type === 'paragraph' || node.type === 'heading') && /\\[[\]]/.test(markdown)
+    if (markdown.length > MAX_LITERAL_BLOCK_CODE_UNITS && !preservesBrackets) {
       return markdown
     }
     const cached = cache.get(block)
     if (cached?.markdown === markdown) {
       return cached.result
     }
-    const candidate = withoutOptionalEscapes(markdown)
     let result = markdown
-    try {
-      const parsed = manager.parse(
-        encodeRawMarkdownHtmlForRichEditor(candidate, codec, { htmlSuperscriptLinks })
+    const candidates = [
+      withoutOptionalEscapes,
+      ...['~', '`', '*'].map(
+        (character) => (source: string) =>
+          source.replace(/\\([\\_~`*])/g, (escaped, value) =>
+            value === character ? value : escaped
+          )
       )
-      // Every mark, attribute and text position must survive reopening this block.
-      if (parsed.content?.length === 1 && editor.schema.nodeFromJSON(parsed.content[0]).eq(block)) {
-        result = candidate
+    ]
+    for (const unescape of candidates) {
+      const candidate = unescape(result)
+      if (candidate === result) {
+        continue
+      }
+      try {
+        const parsed = manager.parse(
+          encodeRawMarkdownHtmlForRichEditor(candidate, codec, { htmlSuperscriptLinks })
+        )
+        // Every mark, attribute and text position must survive reopening this block.
+        if (
+          parsed.content?.length === 1 &&
+          editor.schema.nodeFromJSON(parsed.content[0]).eq(block)
+        ) {
+          result = candidate
+        }
+      } catch {
+        // Keep escapes when a custom parser cannot prove equivalence.
       }
-    } catch {
-      // Keep the upstream escaped output when a custom parser cannot prove equivalence.
     }
     cache.set(block, { markdown, result })
     return result
   }
 
   editor.getMarkdown = () => {
-    const markdown = serialize()
-    if (!/\\[[\]]/.test(markdown)) {
+    const document = getRichMarkdownSerializationDocument(editor)
+    const json = document.toJSON()
+    const markdown = manager.serialize(json)
+    if (!/\\[_[\]~`*]/.test(markdown)) {
       return markdown
     }
     // Reference definitions can change inline meaning across block boundaries.
-    if (/^ {0,3}\[[^\n]*\]:/m.test(withoutOptionalEscapes(markdown))) {
+    if (/\][ \t]*:/.test(withoutOptionalEscapes(markdown))) {
       return markdown
     }
-    const json = editor.getJSON()
     blocks = new Map()
     json.content?.forEach((node, index) => {
-      if (node.type === 'paragraph' || node.type === 'heading') {
-        blocks!.set(node, editor.state.doc.child(index))
+      if (node.type && LITERAL_BLOCK_TYPES.has(node.type)) {
+        blocks!.set(node, document.child(index))
       }
     })
     try {
diff --git a/src/renderer/src/components/editor/rich-markdown-save-benchmark.test.ts b/src/renderer/src/components/editor/rich-markdown-save-benchmark.test.ts
new file mode 100644
index 00000000000..4051a8e9b91
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-save-benchmark.test.ts
@@ -0,0 +1,54 @@
+import { Editor } from '@tiptap/core'
+import { it, expect } from 'vitest'
+import { createRichMarkdownEditorCodec } from './rich-markdown-source-transport'
+import { createRichMarkdownExtensions } from './rich-markdown-extensions'
+import { commitRichMarkdownSerialization } from './rich-markdown-serialization-commit'
+function create(source: string) {
+  return new Editor({
+    element: null,
+    extensions: createRichMarkdownExtensions({ codec: createRichMarkdownEditorCodec() }),
+    content: source,
+    contentType: 'markdown'
+  })
+}
+// Run with ORCA_MARKDOWN_SAVE_BENCHMARK=1; timings are evidence, not a machine-dependent CI gate.
+it.skipIf(process.env.ORCA_MARKDOWN_SAVE_BENCHMARK !== '1')(
+  'measures source preservation at supported document sizes',
+  () => {
+    for (const count of [100, 500, 1500, 6000]) {
+      const source = `${Array.from(
+        { length: count },
+        (_, i) => `Paragraph ${i} with _emphasis_ and user_name.\n\n> [!NOTE]\n> - Callout ${i}\n\n`
+      ).join('')}End\n`
+      const editor = create(source)
+      const refs = {
+        originalSourceRef: { current: source },
+        baseCanonicalRef: { current: editor.getMarkdown() },
+        lastCommittedMarkdownRef: { current: source }
+      }
+      const times: number[] = []
+      for (let j = 0; j < 3; j++) {
+        editor.commands.insertContentAt(2, { type: 'text', text: 'x' })
+        const start = performance.now()
+        const result = commitRichMarkdownSerialization(editor, refs, (text) => {
+          const round = create(text)
+          try {
+            return round.getMarkdown()
+          } finally {
+            round.destroy()
+          }
+        })
+        times.push(Math.round(performance.now() - start))
+        expect(result.markdown).toContain('> [!NOTE]\n> - Callout 0')
+      }
+      process.stdout.write(
+        `${JSON.stringify({
+          bytes: source.length,
+          blocks: editor.state.doc.childCount,
+          milliseconds: times
+        })}\n`
+      )
+      editor.destroy()
+    }
+  }
+)
diff --git a/src/renderer/src/components/editor/rich-markdown-serialization-commit.ts b/src/renderer/src/components/editor/rich-markdown-serialization-commit.ts
index dcebdf60dbd..e21089a0a2e 100644
--- a/src/renderer/src/components/editor/rich-markdown-serialization-commit.ts
+++ b/src/renderer/src/components/editor/rich-markdown-serialization-commit.ts
@@ -1,5 +1,6 @@
 import type { MutableRefObject } from 'react'
 import type { Editor } from '@tiptap/react'
+import { reconcileRichMarkdownBlockSource } from './rich-markdown-block-source'
 import {
   reconcileSerializedMarkdown,
   restoreMarkdownSourceEol
@@ -58,6 +59,22 @@ export function commitRichMarkdownSerialization(
     reconciled = restoreMarkdownSourceEol(edited, refs.originalSourceRef.current)
   }
 
+  if (
+    editor &&
+    edited !== refs.baseCanonicalRef.current &&
+    reconciled === restoreMarkdownSourceEol(edited, refs.originalSourceRef.current)
+  ) {
+    const preserved = reconcileRichMarkdownBlockSource(
+      editor,
+      refs.originalSourceRef.current,
+      edited,
+      roundTrip
+    )
+    if (preserved !== null) {
+      reconciled = preserved
+    }
+  }
+
   refs.originalSourceRef.current = reconciled
   // Why: reconciled ≡ edited semantically, so its canonical form is `edited`
   // (also correct in every fallback branch, which returns `edited` verbatim).
diff --git a/src/renderer/src/components/editor/rich-markdown-table.test.ts b/src/renderer/src/components/editor/rich-markdown-table.test.ts
new file mode 100644
index 00000000000..b3c79eee961
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-table.test.ts
@@ -0,0 +1,56 @@
+import { Table } from '@tiptap/extension-table'
+import { afterEach, expect, it, vi } from 'vitest'
+import { RichMarkdownTable } from './rich-markdown-table'
+
+afterEach(() => vi.restoreAllMocks())
+
+it.each([
+  '',
+  'prose',
+  '| A | B |\n| --- | :---: |\n| a | b |',
+  'A | B\n--- | ---\na | b',
+  '| A |\nnot a separator\n',
+  'one\n\n| A |\n| --- |',
+  '| A |\r\n| --- |\r\n',
+  '| A |\n| - |',
+  '| A |\n| : |',
+  `| A |\n| - |\n${'prose\n'.repeat(10_000)}`
+])('matches the upstream table detector: %j', (source) => {
+  const base = Table.config.markdownTokenizer
+  const guarded = RichMarkdownTable.config.markdownTokenizer
+  if (
+    !base ||
+    typeof base === 'function' ||
+    typeof base.start !== 'function' ||
+    !guarded ||
+    typeof guarded === 'function' ||
+    typeof guarded.start !== 'function'
+  ) {
+    throw new Error('Table tokenizer contract changed')
+  }
+  expect(guarded.start(source)).toBe(base.start(source))
+})
+
+it('only passes the first two lines to the upstream detector', () => {
+  const base = Table.config.markdownTokenizer
+  const guarded = RichMarkdownTable.config.markdownTokenizer
+  if (
+    !base ||
+    typeof base === 'function' ||
+    typeof base.start !== 'function' ||
+    !guarded ||
+    typeof guarded === 'function' ||
+    typeof guarded.start !== 'function'
+  ) {
+    throw new Error('Table tokenizer contract changed')
+  }
+  const original = base.start
+  const start = vi.fn(original)
+  base.start = start
+  try {
+    guarded.start(`first\nsecond\n${'rest\n'.repeat(10_000)}`)
+    expect(start).toHaveBeenCalledExactlyOnceWith('first\nsecond')
+  } finally {
+    base.start = original
+  }
+})
diff --git a/src/renderer/src/components/editor/rich-markdown-table.ts b/src/renderer/src/components/editor/rich-markdown-table.ts
new file mode 100644
index 00000000000..4e285531390
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-table.ts
@@ -0,0 +1,22 @@
+import { Table } from '@tiptap/extension-table'
+
+const tokenizer = Table.config.markdownTokenizer
+
+export const RichMarkdownTable = Table.extend({
+  markdownTokenizer:
+    tokenizer && typeof tokenizer !== 'function'
+      ? {
+          ...tokenizer,
+          start(source) {
+            const firstEnd = source.indexOf('\n')
+            if (firstEnd === -1) {
+              return -1
+            }
+            const secondEnd = source.indexOf('\n', firstEnd + 1)
+            // Upstream tests only two lines, but splits the entire remaining document.
+            const prefix = secondEnd === -1 ? source : source.slice(0, secondEnd)
+            return typeof tokenizer.start === 'function' ? tokenizer.start(prefix) : -1
+          }
+        }
+      : tokenizer
+})
diff --git a/src/renderer/src/components/editor/rich-markdown-trailing-paragraph.test.ts b/src/renderer/src/components/editor/rich-markdown-trailing-paragraph.test.ts
new file mode 100644
index 00000000000..042c1d25a72
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-trailing-paragraph.test.ts
@@ -0,0 +1,77 @@
+// @vitest-environment happy-dom
+import { Editor } from '@tiptap/core'
+import { afterEach, describe, expect, it } from 'vitest'
+import { createRichMarkdownExtensions } from './rich-markdown-extensions'
+import { createRichMarkdownEditorCodec } from './rich-markdown-source-transport'
+import { commitRichMarkdownSerialization } from './rich-markdown-serialization-commit'
+
+const editors: Editor[] = []
+function createEditor(content: string) {
+  const editor = new Editor({
+    element: document.createElement('div'),
+    extensions: createRichMarkdownExtensions({ codec: createRichMarkdownEditorCodec() }),
+    content,
+    contentType: 'markdown'
+  })
+  editors.push(editor)
+  return editor
+}
+function serialize(source: string) {
+  return createEditor(source).getMarkdown()
+}
+afterEach(() => editors.splice(0).forEach((editor) => editor.destroy()))
+
+describe('the synthetic trailing paragraph', () => {
+  it.each(['> [!NOTE]\n> - A list item', '# Heading', '- List item', '```text\ncode\n```'])(
+    'does not change serialization on selection or an unrelated edit: %s',
+    (ending) => {
+      const source = `\nProse to edit.\n\n${ending}\n`
+      const editor = createEditor(source)
+      const refs = {
+        originalSourceRef: { current: source },
+        baseCanonicalRef: { current: editor.getMarkdown() },
+        lastCommittedMarkdownRef: { current: source }
+      }
+      editor.commands.setTextSelection(2)
+      expect(editor.state.doc.lastChild?.type.name).toBe('paragraph')
+      expect(editor.getMarkdown()).toBe(refs.baseCanonicalRef.current)
+      editor.commands.insertContentAt(1, { type: 'text', text: 'Edited ' })
+      expect(commitRichMarkdownSerialization(editor, refs, serialize).markdown).toBe(
+        source.replace('Prose', 'Edited Prose')
+      )
+    }
+  )
+
+  it('saves text typed into the trailing paragraph and survives undo/redo', () => {
+    const editor = createEditor('> Quote')
+    editor.commands.setTextSelection(2)
+    editor.commands.insertContentAt(editor.state.doc.content.size - 1, {
+      type: 'text',
+      text: 'New paragraph'
+    })
+    expect(editor.getMarkdown()).toBe('> Quote\n\nNew paragraph')
+    editor.commands.undo()
+    expect(editor.getMarkdown()).toBe('> Quote\n\n')
+    editor.commands.redo()
+    expect(editor.getMarkdown()).toBe('> Quote\n\nNew paragraph')
+  })
+
+  it('keeps an intentionally added blank paragraph', () => {
+    const editor = createEditor('> Quote')
+    editor.commands.setTextSelection(2)
+    editor.commands.setTextSelection(editor.state.doc.content.size - 1)
+    editor.commands.splitBlock()
+    expect(createEditor(editor.getMarkdown()).getJSON()).toEqual(editor.getJSON())
+    expect(editor.state.doc.childCount).toBe(3)
+  })
+
+  it('keeps authored trailing blank paragraphs after loading and replacing content', () => {
+    const editor = createEditor('> Quote\n\n')
+    editor.commands.setTextSelection(2)
+    expect(editor.getMarkdown()).toBe('> Quote\n\n')
+    editor.commands.setContent('# Heading', { contentType: 'markdown' })
+    expect(editor.getMarkdown()).toBe('# Heading')
+    editor.commands.setContent('# Heading\n\n', { contentType: 'markdown' })
+    expect(editor.getMarkdown()).toBe('# Heading\n\n')
+  })
+})
diff --git a/src/renderer/src/components/editor/rich-markdown-trailing-paragraph.ts b/src/renderer/src/components/editor/rich-markdown-trailing-paragraph.ts
new file mode 100644
index 00000000000..614f3ddace7
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-trailing-paragraph.ts
@@ -0,0 +1,65 @@
+import type { Editor } from '@tiptap/core'
+import { TrailingNode } from '@tiptap/extensions'
+import type { Node as ProseMirrorNode } from '@tiptap/pm/model'
+import { Plugin, PluginKey } from '@tiptap/pm/state'
+
+const trailingParagraph = new PluginKey<ProseMirrorNode | null>('richMarkdownTrailingParagraph')
+
+// The click target below a final quote/list is UI scaffolding until the user edits it.
+export const RichMarkdownTrailingParagraph = TrailingNode.extend({
+  addProseMirrorPlugins() {
+    const plugins = (this.parent?.() ?? []).map((plugin) => {
+      const append = plugin.spec.appendTransaction
+      if (!append) {
+        return plugin
+      }
+      return new Plugin({
+        ...plugin.spec,
+        appendTransaction(transactions, oldState, state) {
+          const transaction = append.call(plugin, transactions, oldState, state)
+          if (transaction) {
+            transaction.setMeta(trailingParagraph, transaction.doc.lastChild)
+          }
+          return transaction
+        }
+      })
+    })
+    return [
+      ...plugins,
+      new Plugin<ProseMirrorNode | null>({
+        key: trailingParagraph,
+        state: {
+          init: () => null,
+          apply(transaction, previous, oldState) {
+            const inserted: unknown = transaction.getMeta(trailingParagraph)
+            if (inserted === transaction.doc.lastChild && transaction.doc.lastChild) {
+              return transaction.doc.lastChild
+            }
+            if (!previous || !transaction.docChanged) {
+              return previous
+            }
+            let start = oldState.doc.content.size - previous.nodeSize
+            let touched = false
+            for (const map of transaction.mapping.maps) {
+              map.forEach((from, to) => {
+                if (from <= start + previous.nodeSize && to > start) {
+                  touched = true
+                }
+              })
+              start = map.map(start, 1)
+            }
+            return !touched && transaction.doc.lastChild === previous ? previous : null
+          }
+        }
+      })
+    ]
+  }
+})
+
+export function getRichMarkdownSerializationDocument(editor: Editor): ProseMirrorNode {
+  const document = editor.state.doc
+  const synthetic = trailingParagraph.getState(editor.state)
+  return synthetic && document.lastChild === synthetic
+    ? document.copy(document.content.cut(0, document.content.size - synthetic.nodeSize))
+    : document
+}
diff --git a/src/renderer/src/components/editor/tiptap-marked-facade.ts b/src/renderer/src/components/editor/tiptap-marked-facade.ts
index 80cadb343f9..196bb8e16c8 100644
--- a/src/renderer/src/components/editor/tiptap-marked-facade.ts
+++ b/src/renderer/src/components/editor/tiptap-marked-facade.ts
@@ -1,3 +1,4 @@
+import { getMarkdownTokenizerStartMarker } from './markdown-tokenizer-start'
 import {
   Hooks,
   Lexer,
@@ -19,6 +20,27 @@ export function createTiptapMarkedFacade(): typeof marked {
   // Why: Tiptap 3.22.5 registers on the injected instance but parses with
   // `new instance.Lexer()`, so the constructor must retain the private registry.
   class RegistryLexer extends Lexer {
+    private readonly registeredExtensions = this.options.extensions
+    blockTokens(source: string, tokens?: TokensList, lastParagraphClipped?: boolean): TokensList
+    blockTokens(source: string, tokens?: Token[], lastParagraphClipped?: boolean): Token[]
+    blockTokens(source: string, tokens?: Token[], lastParagraphClipped?: boolean): Token[] {
+      const previousExtensions = this.options.extensions
+      const extensions = this.registeredExtensions
+      if (!extensions?.startBlock) {
+        return super.blockTokens(source, tokens, lastParagraphClipped)
+      }
+      const startBlock = extensions.startBlock.filter((start) => {
+        const marker = getMarkdownTokenizerStartMarker(start)
+        return !marker || source.includes(marker)
+      })
+      this.options.extensions = { ...extensions, startBlock }
+      try {
+        return super.blockTokens(source, tokens, lastParagraphClipped)
+      } finally {
+        this.options.extensions = previousExtensions
+      }
+    }
+
     constructor(options?: MarkedOptions) {
       super({
         ...registry.defaults,
diff --git a/src/renderer/src/components/editor/use-markdown-preview-source-foundation.ts b/src/renderer/src/components/editor/use-markdown-preview-source-foundation.ts
index ca6f4c023f2..380063c653f 100644
--- a/src/renderer/src/components/editor/use-markdown-preview-source-foundation.ts
+++ b/src/renderer/src/components/editor/use-markdown-preview-source-foundation.ts
@@ -13,6 +13,7 @@ import {
   getMarkdownPreviewSourceRelativePath,
   resolveMarkdownPreviewSourceWorktree
 } from './markdown-preview-source-routing'
+import { useDocumentDarkTheme } from '@/hooks/use-document-dark-theme'
 import { usePreserveSectionDuringExternalEdit } from './usePreserveSectionDuringExternalEdit'
 
 export function useMarkdownPreviewSourceFoundation({
@@ -143,9 +144,7 @@ export function useMarkdownPreviewSourceFoundation({
   )
   const editorFontZoomLevel = useAppStore((s) => s.editorFontZoomLevel)
   const editorFontSize = computeEditorFontSize(14, editorFontZoomLevel)
-  const isDark =
-    settings?.theme === 'dark' ||
-    (settings?.theme === 'system' && window.matchMedia('(prefers-color-scheme: dark)').matches)
+  const isDark = useDocumentDarkTheme()
 
   const renderedContent = usePreserveSectionDuringExternalEdit(content, bodyRef)
 
diff --git a/src/renderer/src/components/editor/use-monaco-editor-mount.cursor-owner.test.tsx b/src/renderer/src/components/editor/use-monaco-editor-mount.cursor-owner.test.tsx
new file mode 100644
index 00000000000..667e3be7530
--- /dev/null
+++ b/src/renderer/src/components/editor/use-monaco-editor-mount.cursor-owner.test.tsx
@@ -0,0 +1,177 @@
+// @vitest-environment happy-dom
+import { cleanup, renderHook } from '@testing-library/react'
+import { Suspense } from 'react'
+import { afterEach, expect, it, vi } from 'vitest'
+import type { editor } from 'monaco-editor'
+import type { OnMount } from '@monaco-editor/react'
+import { createEditorTabsStore } from '@/store/slices/editor-slice-test-harness'
+import { captureEditorFileOperationProvenance } from '@/lib/editor-file-operation-owner'
+import type { MonacoEditorMountParams } from './monaco-editor-mount-params'
+import { useMonacoEditorMount } from './use-monaco-editor-mount'
+
+vi.mock('@/store', () => ({
+  useAppStore: { getState: () => ({ pendingEditorReveal: null, pendingEditorFocusRequest: null }) }
+}))
+vi.mock('./monaco-markdown-doc-link-decorations', () => ({
+  createMarkdownDocLinkDecorationController: vi.fn()
+}))
+vi.mock('./monaco-markdown-doc-completions', () => ({
+  ensureMarkdownDocCompletionProvider: vi.fn()
+}))
+vi.mock('./monaco-e2e-probe', () => ({ installMonacoE2EProbe: () => vi.fn() }))
+vi.mock('./monaco-editor-input-bindings', () => ({
+  installMonacoEditorInputBindings: () => ({ disposeInputBindings: vi.fn() })
+}))
+
+afterEach(cleanup)
+
+it('keeps a retained cursor listener on the current file ID after same-path owner migration', () => {
+  const store = createEditorTabsStore()
+  const filePath = '/repo/file.ts'
+  const oldId = 'restored-file'
+  store.setState({
+    activeFileId: null,
+    openFiles: [
+      {
+        id: oldId,
+        filePath,
+        relativePath: 'file.ts',
+        worktreeId: 'old-workspace',
+        language: 'typescript',
+        mode: 'edit',
+        isDirty: false
+      }
+    ],
+    runtimeEnvironments: [],
+    detectedWorktreesByRepo: {}
+  })
+  const params: MonacoEditorMountParams = {
+    fileId: oldId,
+    filePath,
+    viewStateKey: 'stable-tab-view',
+    viewStateId: 'stable-tab',
+    worktreeId: 'old-workspace',
+    autoHeight: false,
+    autoHeightLineHeight: 20,
+    editorRef: { current: null },
+    editorContainerRef: { current: null },
+    languageRef: { current: 'typescript' },
+    propsRef: {
+      current: {
+        relativePath: 'file.ts',
+        language: 'typescript',
+        onSave: vi.fn(),
+        onContentChange: vi.fn()
+      }
+    },
+    readOnlyRef: { current: false },
+    scrollThrottleTimerRef: { current: null },
+    unregisterFileSearchSelectionRef: { current: null },
+    setMountedEditor: vi.fn(),
+    setAutoHeightContentHeight: vi.fn(),
+    setEditorCursorLine: store.getState().setEditorCursorLine,
+    setupCopy: vi.fn(),
+    queueReveal: vi.fn(),
+    contentSync: {
+      contentRef: { current: '' },
+      lastSyncedContentRef: { current: '' },
+      contentSyncModeRef: { current: 'undoable' },
+      isApplyingProgrammaticContentRef: { current: false },
+      isApplyingLargePasteRef: { current: false }
+    },
+    decorations: {
+      markdownDocLinkDecorationsRef: { current: null },
+      conflictDecorationsRef: { current: null },
+      updateMarkdownCompletionDocuments: vi.fn()
+    },
+    annotations: {
+      commentPopoverRef: { current: null },
+      shouldShowMarkdownAnnotationsRef: { current: false },
+      setCommentPopover: vi.fn(),
+      setSelectionAnnotationTarget: vi.fn()
+    },
+    gutterMenu: {
+      setGutterMenuOpen: vi.fn(),
+      setGutterMenuPoint: vi.fn(),
+      setGutterMenuLine: vi.fn()
+    }
+  }
+  let emitCursor:
+    | ((event: { position: { lineNumber: number; column: number } }) => void)
+    | undefined
+  let disposeEditor: (() => void) | undefined
+  const cursorDispose = vi.fn()
+  const mockEditor = {
+    getModel: () => null,
+    getPosition: () => ({ lineNumber: 1, column: 1 }),
+    focus: vi.fn(),
+    onDidChangeCursorPosition: (listener: NonNullable<typeof emitCursor>) => {
+      emitCursor = listener
+      return { dispose: cursorDispose }
+    },
+    onDidScrollChange: () => ({ dispose: vi.fn() }),
+    onMouseDown: () => ({ dispose: vi.fn() }),
+    onDidDispose: (listener: () => void) => {
+      disposeEditor = listener
+    }
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Mount and tracking use only the editor methods mocked above; decorations/input/probe integrations are mocked.
+  const editorInstance = mockEditor as unknown as editor.IStandaloneCodeEditor
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The mocked mount integrations do not access Monaco, and the mouse listener is not invoked.
+  const monaco = {} as Parameters<OnMount>[1]
+  const suspendedRender = vi.fn()
+  const neverCommits = new Promise<void>(() => {})
+  const view = renderHook(
+    ({ next, suspend }: { next: MonacoEditorMountParams; suspend: boolean }) => {
+      const onMount = useMonacoEditorMount(next)
+      if (suspend) {
+        suspendedRender()
+        throw neverCommits
+      }
+      return onMount
+    },
+    {
+      initialProps: { next: params, suspend: false },
+      wrapper: ({ children }) => <Suspense fallback={null}>{children}</Suspense>
+    }
+  )
+  view.result.current(editorInstance, monaco)
+  expect(store.getState().editorCursorLine).toEqual({ [oldId]: 1 })
+
+  view.rerender({ next: { ...params, fileId: 'uncommitted-owner' }, suspend: true })
+  expect(suspendedRender).toHaveBeenCalled()
+  emitCursor?.({ position: { lineNumber: 7, column: 1 } })
+  expect(store.getState().editorCursorLine).toEqual({ [oldId]: 7 })
+
+  const result = store.getState().reparentRestoredEditorFileOwner({
+    fileId: oldId,
+    targetWorktreeId: 'wt-1',
+    targetRelativePath: 'file.ts',
+    targetExecutionHostId: 'local',
+    targetRuntimeEnvironmentId: null,
+    targetOperationProvenance: captureEditorFileOperationProvenance(
+      store.getState(),
+      'wt-1',
+      null,
+      true
+    )
+  })
+  expect(result.ok).toBe(true)
+  if (!result.ok) {
+    throw new Error(`Owner migration failed: ${result.reason}`)
+  }
+  expect(store.getState().openFiles[0].filePath).toBe(filePath)
+  view.rerender({
+    next: { ...params, fileId: result.fileId, worktreeId: 'wt-1' },
+    suspend: false
+  })
+  emitCursor?.({ position: { lineNumber: 42, column: 1 } })
+
+  expect(store.getState().editorCursorLine).toEqual({ [result.fileId]: 42 })
+  disposeEditor?.()
+  expect(cursorDispose).toHaveBeenCalledOnce()
+  params.unregisterFileSearchSelectionRef.current?.()
+  view.unmount()
+  store.getState().closeFile(result.fileId)
+  expect(store.getState().editorCursorLine).toEqual({})
+})
diff --git a/src/renderer/src/components/editor/use-monaco-editor-mount.ts b/src/renderer/src/components/editor/use-monaco-editor-mount.ts
index 6860d2a7091..da97dc6ec32 100644
--- a/src/renderer/src/components/editor/use-monaco-editor-mount.ts
+++ b/src/renderer/src/components/editor/use-monaco-editor-mount.ts
@@ -1,4 +1,4 @@
-import { useCallback } from 'react'
+import { useCallback, useLayoutEffect, useRef } from 'react'
 import type { OnMount } from '@monaco-editor/react'
 import { useAppStore } from '@/store'
 import { registerFileSearchSelectedTextProvider } from '@/lib/file-search-selection'
@@ -61,6 +61,11 @@ export function useMonacoEditorMount(params: MonacoEditorMountParams): OnMount {
     },
     gutterMenu: { setGutterMenuOpen, setGutterMenuPoint, setGutterMenuLine }
   } = params
+  // Why: retained listeners must follow committed ownership, never an abandoned render.
+  const fileIdRef = useRef(fileId)
+  useLayoutEffect(() => {
+    fileIdRef.current = fileId
+  }, [fileId])
 
   return useCallback<OnMount>(
     (editorInstance, monaco) => {
@@ -145,7 +150,7 @@ export function useMonacoEditorMount(params: MonacoEditorMountParams): OnMount {
 
       const { cursorPositionSub, scrollStateSub } = installMonacoViewStateTracking({
         editorInstance,
-        filePath,
+        fileIdRef,
         viewStateKey,
         scrollThrottleTimerRef,
         setEditorCursorLine
diff --git a/src/renderer/src/components/editor/useEditorPanelContentState.test.tsx b/src/renderer/src/components/editor/useEditorPanelContentState.test.tsx
index 14b70465087..6df420f6abc 100644
--- a/src/renderer/src/components/editor/useEditorPanelContentState.test.tsx
+++ b/src/renderer/src/components/editor/useEditorPanelContentState.test.tsx
@@ -41,6 +41,8 @@ vi.mock('@/lib/connection-context', () => ({
   isWorktreeConnectionResolved: mocks.isWorktreeConnectionResolved
 }))
 
+vi.mock('@/lib/worktree-host-connection-phase', () => import('./local-host-test-fixture'))
+
 vi.mock('@/lib/runtime-workspace-file-route', () => ({
   findWorkspaceFileRoute: vi.fn(() => null)
 }))
diff --git a/src/renderer/src/components/editor/useEditorPanelFileContentLoader.ts b/src/renderer/src/components/editor/useEditorPanelFileContentLoader.ts
index 005887aca11..e7fdfc88754 100644
--- a/src/renderer/src/components/editor/useEditorPanelFileContentLoader.ts
+++ b/src/renderer/src/components/editor/useEditorPanelFileContentLoader.ts
@@ -6,6 +6,7 @@ import { getDiskBaselineSignature } from './diff-content-signature'
 import { getRuntimeFileReadScope, readRuntimeFileContent } from '@/runtime/runtime-file-client'
 import { RuntimeRpcCallError, settingsForRuntimeOwner } from '@/runtime/runtime-rpc-client'
 import { findWorkspaceFileRoute } from '@/lib/runtime-workspace-file-route'
+import { selectWorktreeHostConnectionPhase } from '@/lib/worktree-host-connection-phase'
 import {
   LOCAL_EXECUTION_HOST_ID,
   toRuntimeExecutionHostId,
@@ -81,6 +82,7 @@ export function useEditorPanelFileContentLoader({
       fileReadGenerationCounterRef.current = generation
       fileReadGenerationRef.current[id] = generation
       outstandingFileReadsRef.current[id] = generation
+      let readConnectionId: string | undefined
       try {
         const resolvedConnectionId = getConnectionIdForFile(worktreeId ?? null, filePath)
         const connectionId = resolvedConnectionId ?? undefined
@@ -94,7 +96,7 @@ export function useEditorPanelFileContentLoader({
         // worktree's SSH owner must never be inferred for them (a stamp still routes).
         const isLiveTailLogTab =
           restoredOpenFile?.readOnly === true && restoredOpenFile.liveTail === true
-        let readConnectionId = connectionId
+        readConnectionId = connectionId
         let readWorktreeId = worktreeId
         let readRelativePath = restoredOpenFile?.relativePath ?? relativePath
         if (
@@ -204,10 +206,25 @@ export function useEditorPanelFileContentLoader({
         if (fileReadGenerationRef.current[id] !== generation) {
           return
         }
-        const message = err instanceof Error ? err.message : String(err)
+        const hostConnection = selectWorktreeHostConnectionPhase(
+          useAppStore.getState(),
+          worktreeId ?? null
+        )
+        // Why: a read through an SSH host that is still connecting failed on the connection,
+        // not the file; the retry gate waits for it rather than showing "connection dropped".
+        const hostConnecting =
+          hostConnection.phase === 'connecting' &&
+          readConnectionId !== undefined &&
+          readConnectionId === hostConnection.targetId
+        const message = hostConnecting
+          ? WORKTREE_OWNER_NOT_READY_ERROR
+          : err instanceof Error
+            ? err.message
+            : String(err)
         // Why: a host may put prose on the message and the machine token on `.code`;
         // classifiers downstream must see the token, not only its rendering (#21041).
-        const loadErrorCode = err instanceof RuntimeRpcCallError ? err.code : undefined
+        const loadErrorCode =
+          !hostConnecting && err instanceof RuntimeRpcCallError ? err.code : undefined
         setFileContents((prev) => ({
           ...prev,
           [id]: {
diff --git a/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.host-connection.test.tsx b/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.host-connection.test.tsx
new file mode 100644
index 00000000000..ad6b4cb012a
--- /dev/null
+++ b/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.host-connection.test.tsx
@@ -0,0 +1,257 @@
+// @vitest-environment happy-dom
+
+import { act, type Dispatch, type SetStateAction } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { OpenFile } from '@/store/slices/editor'
+import type { WorktreeHostConnection } from '@/lib/worktree-host-connection-phase'
+import type { SshConnectionStatus } from '../../../../shared/ssh-types'
+import {
+  WORKTREE_OWNER_NOT_READY_ERROR,
+  WORKTREE_OWNER_UNREACHABLE_ERROR,
+  type FileContent
+} from './editor-panel-content-types'
+
+const mocks = vi.hoisted(() => {
+  const hostConnection: WorktreeHostConnection = {
+    phase: 'connecting',
+    targetId: 'ssh-a',
+    environmentId: null,
+    publishedStatus: 'connecting',
+    connectedEpoch: null
+  }
+  return { hostConnection, readRuntimeFileContent: vi.fn() }
+})
+
+vi.mock('@/lib/worktree-host-connection-phase', () => ({
+  selectWorktreeHostConnectionPhase: () => mocks.hostConnection,
+  useWorktreeHostConnection: () => mocks.hostConnection
+}))
+vi.mock('@/lib/connection-context', () => ({
+  getConnectionIdForFile: () => 'ssh-a',
+  isWorktreeConnectionResolved: () => true
+}))
+vi.mock('@/runtime/runtime-file-client', () => ({
+  getRuntimeFileReadScope: (_settings: unknown, connectionId: string | undefined) =>
+    connectionId ?? 'local',
+  readRuntimeFileContent: mocks.readRuntimeFileContent
+}))
+
+import {
+  OWNER_NOT_READY_RETRY_DELAY_MS,
+  useEditorPanelFileLoadRetry
+} from './useEditorPanelFileLoadRetry'
+import {
+  useEditorPanelFileContentLoader,
+  type EditorPanelFileContentLoader
+} from './useEditorPanelFileContentLoader'
+
+const SSH_PROVIDER_UNAVAILABLE =
+  'Remote connection dropped. Click Reconnect on the SSH target before retrying.'
+
+const STATUS_BY_PHASE: Record<WorktreeHostConnection['phase'], SshConnectionStatus | null> = {
+  local: null,
+  connecting: 'connecting',
+  connected: 'connected',
+  unavailable: 'disconnected',
+  unverifiable: null
+}
+
+function setHost(
+  phase: WorktreeHostConnection['phase'],
+  connectionGeneration: number | null = null
+): void {
+  mocks.hostConnection = {
+    phase,
+    targetId: 'ssh-a',
+    environmentId: null,
+    publishedStatus: STATUS_BY_PHASE[phase],
+    connectedEpoch: phase === 'connected' ? `ssh-a:${connectionGeneration}` : null
+  }
+}
+
+const file: OpenFile = {
+  id: 'tab-1',
+  filePath: '/home/user/project/src/index.ts',
+  relativePath: 'src/index.ts',
+  worktreeId: 'repo-ssh::/home/user/project',
+  language: 'typescript',
+  isDirty: false,
+  mode: 'edit'
+}
+const OPEN_FILES_REF = { current: [file] }
+
+function RetryHarness({
+  fileContents,
+  attemptsRef,
+  loadFileContent,
+  setFileContents
+}: {
+  fileContents: Record<string, FileContent>
+  attemptsRef: { current: Record<string, number> }
+  loadFileContent: () => Promise<void>
+  setFileContents: Dispatch<SetStateAction<Record<string, FileContent>>>
+}): null {
+  useEditorPanelFileLoadRetry({
+    activeFile: file,
+    fileContents,
+    fileLoadRetryAttemptsRef: attemptsRef,
+    loadFileContent,
+    openFilesRef: OPEN_FILES_REF,
+    setFileContents
+  })
+  return null
+}
+
+describe('editor file loads while the SSH host connects', () => {
+  let container: HTMLDivElement
+  let root: Root
+
+  beforeEach(() => {
+    vi.useFakeTimers()
+    mocks.readRuntimeFileContent.mockReset()
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+  })
+
+  afterEach(() => {
+    act(() => root.unmount())
+    container.remove()
+    vi.useRealTimers()
+  })
+
+  it('shows the connecting copy, not "connection dropped", for a read that failed mid-connect', async () => {
+    setHost('connecting')
+    mocks.readRuntimeFileContent.mockRejectedValue(new Error(SSH_PROVIDER_UNAVAILABLE))
+    let fileContents: Record<string, FileContent> = {}
+    let load: EditorPanelFileContentLoader | null = null
+    function LoaderHarness(): null {
+      load = useEditorPanelFileContentLoader({
+        fileLoadRetryAttemptsRef: { current: {} },
+        fileReadGenerationCounterRef: { current: 0 },
+        fileReadGenerationRef: { current: {} },
+        openFilesRef: OPEN_FILES_REF,
+        outstandingFileReadsRef: { current: {} },
+        setFileContents: (updater) => {
+          fileContents = typeof updater === 'function' ? updater(fileContents) : updater
+        }
+      })
+      return null
+    }
+    act(() => root.render(<LoaderHarness />))
+    await act(async () => load?.(file.filePath, file.id, file.worktreeId, file.relativePath))
+    expect(fileContents[file.id]?.loadError).toBe(WORKTREE_OWNER_NOT_READY_ERROR)
+
+    setHost('unavailable')
+    await act(async () => load?.(file.filePath, file.id, file.worktreeId, file.relativePath))
+    expect(fileContents[file.id]?.loadError).toBe(SSH_PROVIDER_UNAVAILABLE)
+  })
+
+  it('spends no retry budget while connecting, then reloads exactly once when the host connects', () => {
+    setHost('connecting')
+    const attemptsRef: { current: Record<string, number> } = { current: {} }
+    let fileContents: Record<string, FileContent> = {
+      [file.id]: { content: '', isBinary: false, loadError: WORKTREE_OWNER_NOT_READY_ERROR }
+    }
+    const setFileContents: Dispatch<SetStateAction<Record<string, FileContent>>> = (updater) => {
+      fileContents = typeof updater === 'function' ? updater(fileContents) : updater
+    }
+    const loadFileContent = vi.fn(async () => undefined)
+    const render = (): void =>
+      act(() =>
+        root.render(
+          <RetryHarness
+            fileContents={fileContents}
+            attemptsRef={attemptsRef}
+            loadFileContent={loadFileContent}
+            setFileContents={setFileContents}
+          />
+        )
+      )
+
+    render()
+    act(() => vi.advanceTimersByTime(OWNER_NOT_READY_RETRY_DELAY_MS * 10))
+    expect(loadFileContent).not.toHaveBeenCalled()
+    expect(attemptsRef.current[file.id]).toBeUndefined()
+
+    setHost('connected', 1)
+    render()
+    expect(loadFileContent).toHaveBeenCalledOnce()
+    expect(attemptsRef.current[file.id]).toBe(0)
+    expect(fileContents[file.id]).toBeUndefined()
+
+    render()
+    act(() => vi.advanceTimersByTime(OWNER_NOT_READY_RETRY_DELAY_MS * 10))
+    expect(loadFileContent).toHaveBeenCalledOnce()
+  })
+
+  it('re-arms an exhausted budget when the host reconnects under a new generation', () => {
+    setHost('connected', 1)
+    const attemptsRef: { current: Record<string, number> } = { current: { [file.id]: 3 } }
+    let fileContents: Record<string, FileContent> = {
+      [file.id]: { content: '', isBinary: false, loadError: WORKTREE_OWNER_UNREACHABLE_ERROR }
+    }
+    const setFileContents: Dispatch<SetStateAction<Record<string, FileContent>>> = (updater) => {
+      fileContents = typeof updater === 'function' ? updater(fileContents) : updater
+    }
+    const loadFileContent = vi.fn(async () => undefined)
+    const render = (): void =>
+      act(() =>
+        root.render(
+          <RetryHarness
+            fileContents={fileContents}
+            attemptsRef={attemptsRef}
+            loadFileContent={loadFileContent}
+            setFileContents={setFileContents}
+          />
+        )
+      )
+
+    render()
+    expect(loadFileContent).not.toHaveBeenCalled()
+
+    setHost('connected', 2)
+    render()
+    expect(loadFileContent).toHaveBeenCalledOnce()
+    expect(attemptsRef.current[file.id]).toBe(0)
+  })
+
+  it('keeps retrying for a host it cannot verify, then reloads once it connects', () => {
+    setHost('unverifiable')
+    const attemptsRef: { current: Record<string, number> } = { current: {} }
+    let fileContents: Record<string, FileContent> = {
+      [file.id]: { content: '', isBinary: false, loadError: WORKTREE_OWNER_NOT_READY_ERROR }
+    }
+    const setFileContents: Dispatch<SetStateAction<Record<string, FileContent>>> = (updater) => {
+      fileContents = typeof updater === 'function' ? updater(fileContents) : updater
+    }
+    const loadFileContent = vi.fn(async () => {
+      fileContents = {
+        [file.id]: { content: '', isBinary: false, loadError: WORKTREE_OWNER_NOT_READY_ERROR }
+      }
+    })
+    const render = (): void =>
+      act(() =>
+        root.render(
+          <RetryHarness
+            fileContents={fileContents}
+            attemptsRef={attemptsRef}
+            loadFileContent={loadFileContent}
+            setFileContents={setFileContents}
+          />
+        )
+      )
+
+    // Unverifiable is not "connecting": the ordinary owner-not-ready poll keeps running.
+    render()
+    act(() => vi.advanceTimersByTime(OWNER_NOT_READY_RETRY_DELAY_MS))
+    expect(loadFileContent).toHaveBeenCalledOnce()
+    expect(attemptsRef.current[file.id]).toBe(1)
+
+    setHost('connected', 1)
+    render()
+    expect(loadFileContent).toHaveBeenCalledTimes(2)
+    expect(attemptsRef.current[file.id]).toBe(0)
+  })
+})
diff --git a/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.ts b/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.ts
index 571ccf548c0..4f3057e7b1a 100644
--- a/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.ts
+++ b/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.ts
@@ -1,5 +1,6 @@
-import { useEffect, type Dispatch, type MutableRefObject, type SetStateAction } from 'react'
+import { useEffect, useRef, type Dispatch, type MutableRefObject, type SetStateAction } from 'react'
 import type { OpenFile } from '@/store/slices/editor'
+import { useWorktreeHostConnection } from '@/lib/worktree-host-connection-phase'
 import { hasRuntimeRpcErrorCode } from '../../../../shared/runtime-rpc-error-code'
 import {
   WORKTREE_HOST_SELECTOR_NOT_FOUND_CODE,
@@ -79,13 +80,61 @@ export function useEditorPanelFileLoadRetry({
   const activeFileLoadErrorCode = activeFileLoadRetryId
     ? fileContents[activeFileLoadRetryId]?.loadErrorCode
     : undefined
+  const hostConnection = useWorktreeHostConnection(activeFile?.worktreeId ?? null)
+  const hostTargetId = hostConnection.targetId
+  const hostConnecting = hostConnection.phase === 'connecting'
+  const connectedHostEpoch = hostConnection.connectedEpoch
+  const seenHostRef = useRef({ targetId: hostTargetId, connectedEpoch: connectedHostEpoch })
 
   useEffect(() => {
+    // Why the same target: switching to a file on another host is not that host connecting.
+    const hostJustConnected =
+      connectedHostEpoch !== null &&
+      seenHostRef.current.targetId === hostTargetId &&
+      seenHostRef.current.connectedEpoch !== connectedHostEpoch
+    seenHostRef.current = { targetId: hostTargetId, connectedEpoch: connectedHostEpoch }
+    if (!activeFileLoadRetryId || !activeFileLoadError) {
+      return
+    }
+    const reload = (nextRetryCount: number): void => {
+      const currentFile = openFilesRef.current.find((file) => file.id === activeFileLoadRetryId)
+      if (
+        !currentFile ||
+        (currentFile.mode !== 'edit' && currentFile.mode !== 'markdown-preview')
+      ) {
+        return
+      }
+      fileLoadRetryAttemptsRef.current[activeFileLoadRetryId] = nextRetryCount
+      setFileContents((prev) => {
+        if (prev[currentFile.id]?.loadError !== activeFileLoadError) {
+          return prev
+        }
+        const next = { ...prev }
+        delete next[currentFile.id]
+        return next
+      })
+      void loadFileContent(
+        currentFile.filePath,
+        currentFile.id,
+        currentFile.worktreeId,
+        currentFile.relativePath
+      )
+    }
+    // Why: the connected transition below re-arms the read, so waiting spends no budget.
+    if (hostConnecting) {
+      return
+    }
+    // Why: a host that just connected (or reconnected) can serve a read a lost connection
+    // failed — including one whose budget already ran out — so reload once on a fresh budget.
     if (
-      !activeFileLoadRetryId ||
-      !activeFileLoadError ||
-      !shouldRetryFileLoadError(activeFileLoadError, activeFileLoadErrorCode)
+      hostJustConnected &&
+      (activeFileLoadError === WORKTREE_OWNER_UNREACHABLE_ERROR ||
+        shouldRetryFileLoadError(activeFileLoadError, activeFileLoadErrorCode))
     ) {
+      reload(0)
+      return
+    }
+    if (!shouldRetryFileLoadError(activeFileLoadError, activeFileLoadErrorCode)) {
       return
     }
     const ownerNotReady = isOwnerNotReadyError(activeFileLoadError)
@@ -127,35 +176,15 @@ export function useEditorPanelFileLoadRetry({
     const delayMs = ownerNotReady
       ? OWNER_NOT_READY_RETRY_DELAY_MS
       : (FILE_LOAD_RETRY_DELAYS_MS[retryCount] ?? FILE_LOAD_RETRY_DELAYS_MS[0])
-    const timeoutId = window.setTimeout(() => {
-      const currentFile = openFilesRef.current.find((file) => file.id === activeFileLoadRetryId)
-      if (
-        !currentFile ||
-        (currentFile.mode !== 'edit' && currentFile.mode !== 'markdown-preview')
-      ) {
-        return
-      }
-      fileLoadRetryAttemptsRef.current[activeFileLoadRetryId] = retryCount + 1
-      setFileContents((prev) => {
-        if (prev[currentFile.id]?.loadError !== activeFileLoadError) {
-          return prev
-        }
-        const next = { ...prev }
-        delete next[currentFile.id]
-        return next
-      })
-      void loadFileContent(
-        currentFile.filePath,
-        currentFile.id,
-        currentFile.worktreeId,
-        currentFile.relativePath
-      )
-    }, delayMs)
+    const timeoutId = window.setTimeout(() => reload(retryCount + 1), delayMs)
     return () => window.clearTimeout(timeoutId)
   }, [
     activeFileLoadRetryId,
     activeFileLoadError,
     activeFileLoadErrorCode,
+    connectedHostEpoch,
+    hostConnecting,
+    hostTargetId,
     fileLoadRetryAttemptsRef,
     loadFileContent,
     openFilesRef,
diff --git a/src/renderer/src/components/editor/useEditorPanelHostUnresolvedContentState.test.tsx b/src/renderer/src/components/editor/useEditorPanelHostUnresolvedContentState.test.tsx
index ddd9938c42e..c6ff09f8c97 100644
--- a/src/renderer/src/components/editor/useEditorPanelHostUnresolvedContentState.test.tsx
+++ b/src/renderer/src/components/editor/useEditorPanelHostUnresolvedContentState.test.tsx
@@ -33,6 +33,8 @@ vi.mock('@/lib/connection-context', () => ({
   isWorktreeConnectionResolved: vi.fn(() => true)
 }))
 
+vi.mock('@/lib/worktree-host-connection-phase', () => import('./local-host-test-fixture'))
+
 vi.mock('@/lib/runtime-workspace-file-route', () => ({
   findWorkspaceFileRoute: vi.fn(() => null)
 }))
diff --git a/src/renderer/src/components/editor/useEditorPanelRemoteSiblingContentState.test.tsx b/src/renderer/src/components/editor/useEditorPanelRemoteSiblingContentState.test.tsx
index 6666302d0a9..08fcc4df79a 100644
--- a/src/renderer/src/components/editor/useEditorPanelRemoteSiblingContentState.test.tsx
+++ b/src/renderer/src/components/editor/useEditorPanelRemoteSiblingContentState.test.tsx
@@ -37,6 +37,8 @@ vi.mock('@/lib/connection-context', () => ({
   isWorktreeConnectionResolved: vi.fn(() => true)
 }))
 
+vi.mock('@/lib/worktree-host-connection-phase', () => import('./local-host-test-fixture'))
+
 vi.mock('@/lib/runtime-workspace-file-route', () => ({
   findWorkspaceFileRoute: mocks.findWorkspaceFileRoute
 }))
diff --git a/src/renderer/src/components/editor/useEditorPanelVisibilityContentState.test.tsx b/src/renderer/src/components/editor/useEditorPanelVisibilityContentState.test.tsx
index 317fa625779..818f50107be 100644
--- a/src/renderer/src/components/editor/useEditorPanelVisibilityContentState.test.tsx
+++ b/src/renderer/src/components/editor/useEditorPanelVisibilityContentState.test.tsx
@@ -32,6 +32,8 @@ vi.mock('@/lib/connection-context', () => ({
   isWorktreeConnectionResolved: vi.fn(() => true)
 }))
 
+vi.mock('@/lib/worktree-host-connection-phase', () => import('./local-host-test-fixture'))
+
 vi.mock('@/lib/runtime-workspace-file-route', () => ({
   findWorkspaceFileRoute: vi.fn(() => null)
 }))
diff --git a/src/renderer/src/components/emulator-pane/use-emulator-video-stream.ts b/src/renderer/src/components/emulator-pane/use-emulator-video-stream.ts
index 35857aa2b7d..1dc9f18593d 100644
--- a/src/renderer/src/components/emulator-pane/use-emulator-video-stream.ts
+++ b/src/renderer/src/components/emulator-pane/use-emulator-video-stream.ts
@@ -1,4 +1,5 @@
 import { useEffect, useRef, useState } from 'react'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 // Decodes the Android H.264 stream (scrcpy access units forwarded over the
 // emulator:videoStream* IPC) with WebCodecs and paints it to a <canvas>. The
@@ -32,7 +33,7 @@ const H264_CODEC = 'avc1.640028'
 type StreamSize = { width: number; height: number }
 
 function newVideoStreamId(): string {
-  return globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random()}`
+  return createBrowserUuid()
 }
 
 export function useEmulatorVideoStream(
diff --git a/src/renderer/src/components/feature-interaction-writer-boundaries.test.ts b/src/renderer/src/components/feature-interaction-writer-boundaries.test.ts
deleted file mode 100644
index 4a02840098e..00000000000
--- a/src/renderer/src/components/feature-interaction-writer-boundaries.test.ts
+++ /dev/null
@@ -1,323 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-const COMPONENT_ROOT = __dirname
-
-function componentSource(relativePath: string): string {
-  return readFileSync(join(COMPONENT_ROOT, relativePath), 'utf8')
-}
-
-function sourceBetween(source: string, startPattern: string, endPattern: string): string {
-  const start = source.indexOf(startPattern)
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = source.indexOf(endPattern, start + startPattern.length)
-  expect(end).toBeGreaterThan(start)
-  return source.slice(start, end)
-}
-
-describe('feature interaction writer boundaries', () => {
-  it('keeps Cmd+J feature writers in open/selection handlers, not query or navigation rendering', () => {
-    // Selection and create callbacks now live in focused hooks; the surface only renders them.
-    const selectionSource = componentSource('use-worktree-jump-palette-selection-actions.ts')
-    const lifecycleSource = componentSource('use-worktree-jump-palette-selection-lifecycle.ts')
-    const createSource = componentSource('use-worktree-jump-palette-create-action.ts')
-    const handlerSection = [selectionSource, lifecycleSource, createSource].join('\n')
-    const renderSection = componentSource('worktree-jump-palette-surface.tsx')
-
-    const cmdJWriterPattern = /recordFeatureInteraction\('cmd-j/g
-    const allCmdJWriterCount = handlerSection.match(cmdJWriterPattern)?.length ?? 0
-    expect(allCmdJWriterCount).toBeGreaterThanOrEqual(6)
-    expect(handlerSection.match(cmdJWriterPattern)?.length ?? 0).toBe(allCmdJWriterCount)
-    expect(renderSection).not.toContain("recordFeatureInteraction('cmd-j")
-    expect(
-      sourceBetween(lifecycleSource, 'const handleQueryChange', 'const cancelFallbackFocusFrames')
-    ).not.toContain("recordFeatureInteraction('cmd-j")
-  })
-
-  it('keeps task-provider writers off filters, tab switches, query edits, refresh, and pagination', () => {
-    const providerWriter = /recordFeatureInteraction\('(github|gitlab|linear)-tasks'\)/
-    const refreshSource = componentSource('use-task-page-github-cache-reconciliation.ts')
-    const paginationSource = componentSource('use-task-page-github-search-pagination.ts')
-    const searchSource = componentSource('use-task-page-search-actions.ts')
-
-    const passiveSections = [
-      sourceBetween(refreshSource, 'const handleRefreshGithubTasks', 'const nextModel'),
-      sourceBetween(paginationSource, 'const handleLoadNextPage', 'const commitTaskSearch'),
-      sourceBetween(searchSource, 'const applyPRFilterChange', 'const handleApplyTaskSearch'),
-      sourceBetween(searchSource, 'const handleApplyTaskSearch', 'const handleTaskSearchChange'),
-      sourceBetween(
-        searchSource,
-        'const handleTaskSearchChange',
-        'const handleSetDefaultTaskPreset'
-      ),
-      sourceBetween(
-        searchSource,
-        'const handleSelectGithubTaskKind',
-        'const handleResetGithubTaskSearch'
-      )
-    ]
-    for (const section of passiveSections) {
-      expect(section).not.toMatch(providerWriter)
-    }
-  })
-
-  it('records GitHub provider-depth for inline item mutation success paths', () => {
-    const githubWriter = "recordFeatureInteraction('github-tasks')"
-    // Why: table cells route success telemetry through the optimistic mutation
-    // hook so provider-depth recording stays on one confirm path.
-    const hookSource = readFileSync(
-      join(COMPONENT_ROOT, '../hooks/useTaskPageGitHubWorkItemMutation.ts'),
-      'utf8'
-    )
-    expect(
-      sourceBetween(hookSource, "if (confirmed === 'confirmed')", 'return confirmed')
-    ).toContain(githubWriter)
-    expect(
-      sourceBetween(
-        componentSource('use-task-page-workspace-actions.ts'),
-        'const handleOpenOrUseGitHubWorkItem',
-        'const openComposerForGitLabItem'
-      )
-    ).toContain(githubWriter)
-  })
-
-  it('threads GitHub task source context through inline task mutations', () => {
-    const sections = [
-      componentSource('task-page/github/StatusCell.tsx'),
-      componentSource('task-page/github/AssigneesCell.tsx'),
-      componentSource('task-page/github/ReviewCell.tsx'),
-      componentSource('task-page/github/MergeCell.tsx'),
-      sourceBetween(
-        componentSource('use-task-page-github-issue-creation.ts'),
-        'const handleCreateNewIssue',
-        'const nextModel'
-      )
-    ]
-
-    for (const section of sections) {
-      expect(section).toContain('sourceContext')
-    }
-    const rowSource = componentSource('task-page/github/Rows.tsx')
-    // Rows inline the repo lookup per cell rather than hoisting one const.
-    expect(
-      rowSource.match(/sourceContext=\{getTaskPageRepoSourceContext\(itemRepo, 'github'\)\}/g)
-    ).toHaveLength(4)
-  })
-
-  it('suppresses Tasks surface telemetry for in-page provider switches and detail opens', () => {
-    const suppression = 'recordTasksInteraction: false'
-    const githubDetailSection = sourceBetween(
-      componentSource('use-task-page-github-detail.ts'),
-      'const openGitHubDetailPage',
-      'const nextModel'
-    )
-
-    const inPageNavigationSections = [
-      sourceBetween(
-        componentSource('use-task-page-detail-routing.ts'),
-        'const openLinearDetailPage',
-        'const openRelatedLinearIssue'
-      ),
-      sourceBetween(
-        componentSource('task-page/SourceBar.tsx'),
-        'taskSourceManuallyChangedRef.current = true',
-        'void updateSettings'
-      )
-    ]
-
-    expect(githubDetailSection).toContain('openGitHubSourceContext')
-    expect(githubDetailSection).toContain('openTaskPage')
-    expect(githubDetailSection).toContain(suppression)
-
-    for (const section of inPageNavigationSections) {
-      expect(section).toContain(suppression)
-    }
-  })
-
-  it('records Cmd+J create-workspace as its own destination, not a generic quick action', () => {
-    const source = componentSource('use-worktree-jump-palette-selection-actions.ts')
-    const section = sourceBetween(
-      source,
-      'const handleSelectQuickAction',
-      'const handleSelectProjectTarget'
-    )
-
-    expect(section).toContain("recordFeatureInteraction('cmd-j-create-workspace')")
-    expect(section).toContain("recordFeatureInteraction('cmd-j-quick-action')")
-    expect(section.indexOf("recordFeatureInteraction('cmd-j-create-workspace')")).toBeLessThan(
-      section.indexOf("recordFeatureInteraction('cmd-j-quick-action')")
-    )
-    expect(
-      sourceBetween(
-        section,
-        "if (action.id === 'create-workspace')",
-        "recordFeatureInteraction('cmd-j-quick-action')"
-      )
-    ).toContain('return')
-  })
-
-  it('records GitLab provider-depth for detail opens, workspace use, and dialog mutations', () => {
-    const detailsSource = componentSource('gitlab-item-dialog/use-gitlab-details-editing.ts')
-    const primarySource = componentSource('gitlab-item-dialog/use-gitlab-primary-actions.ts')
-    const reviewSource = componentSource('gitlab-item-dialog/use-gitlab-review-actions.ts')
-    const gitlabWriter = "recordFeatureInteraction('gitlab-tasks')"
-
-    expect(
-      sourceBetween(
-        componentSource('task-page/gitlab/ItemList.tsx'),
-        '{displayedGitLabItems.map((item) => (',
-        'handleUseGitLabItem(item)'
-      ).match(/recordFeatureInteraction\('gitlab-tasks'\)/g)
-    ).toHaveLength(2)
-    expect(
-      sourceBetween(
-        componentSource('use-task-page-workspace-actions.ts'),
-        'const handleUseGitLabItem',
-        'const nextModel'
-      )
-    ).toContain(gitlabWriter)
-
-    const mutationSections = [
-      sourceBetween(detailsSource, 'const handleSaveDetails', 'return {'),
-      sourceBetween(reviewSource, 'const handleSetReviewers', 'const handleSubmitInlineComment'),
-      sourceBetween(
-        reviewSource,
-        'const handleSubmitInlineComment',
-        'const handleResolveDiscussion'
-      ),
-      sourceBetween(primarySource, 'const handleClose', 'const handleReopen'),
-      sourceBetween(primarySource, 'const handleReopen', 'const handleMerge'),
-      sourceBetween(primarySource, 'const handleMerge', 'const handleSubmitComment'),
-      sourceBetween(primarySource, 'const handleSubmitComment', 'return {'),
-      sourceBetween(reviewSource, 'const handleResolveDiscussion', 'return {')
-    ]
-    for (const section of mutationSections) {
-      expect(section).toContain(gitlabWriter)
-      expect(section).toContain('showGitLabMutationError')
-    }
-  })
-
-  it('keeps nested GitLab row actions from also opening task details by keyboard', () => {
-    const rowSection = sourceBetween(
-      componentSource('task-page/gitlab/ItemList.tsx'),
-      'onKeyDown={(e) => {',
-      'className="grid w-full cursor-pointer'
-    )
-    expect(rowSection).toContain('e.target !== e.currentTarget')
-    expect(rowSection.indexOf('e.target !== e.currentTarget')).toBeLessThan(
-      rowSection.indexOf("e.key === 'Enter'")
-    )
-  })
-
-  it('keys GitLab rows by repository and item identity across hosts', () => {
-    expect(componentSource('task-page/gitlab/ItemList.tsx')).toContain(
-      'key={`${item.repoId}:${item.id}`}'
-    )
-  })
-
-  it('records Linear provider-depth for inline edits, board drops, creation, and workspace use', () => {
-    const drawerSource = [
-      componentSource('linear-item-drawer-edit-controller.tsx'),
-      componentSource('linear-item-drawer-comment-footer.tsx')
-    ].join('\n')
-    const linearWriter = "recordFeatureInteraction('linear-tasks')"
-
-    const taskPageSections = [
-      sourceBetween(
-        componentSource('task-page-linear-issue-model.tsx'),
-        'export function LinearStateCell',
-        'return ('
-      ),
-      sourceBetween(
-        componentSource('use-task-page-linear-board.ts'),
-        'const handleLinearBoardDrop',
-        'const toggleLinearDisplayProperty'
-      ),
-      sourceBetween(
-        componentSource('use-task-page-linear-issue-creation.ts'),
-        'const handleCreateNewLinearIssue',
-        'const nextModel'
-      ),
-      sourceBetween(
-        componentSource('use-task-page-composer-actions.ts'),
-        'const handleUseLinearItem',
-        'const handleLinearWorkspaceChange'
-      )
-    ]
-    for (const section of taskPageSections) {
-      expect(section).toContain(linearWriter)
-    }
-
-    const drawerMutationSections = [
-      sourceBetween(drawerSource, 'const handleStateChange', 'const handlePriorityChange'),
-      sourceBetween(drawerSource, 'const handlePriorityChange', 'const handleEstimateChange'),
-      sourceBetween(drawerSource, 'const handleEstimateChange', 'const handleEstimateSubmit'),
-      sourceBetween(drawerSource, 'const handleAssigneeChange', 'const handleLabelToggle'),
-      sourceBetween(drawerSource, 'const handleLabelToggle', 'return {'),
-      sourceBetween(drawerSource, 'const handleSubmit = useCallback(async () => {', 'return (')
-    ]
-    for (const section of drawerMutationSections) {
-      expect(section).toContain(linearWriter)
-    }
-  })
-
-  it('records Jira provider-depth for workspace use', () => {
-    const jiraWriter = "recordFeatureInteraction('jira-tasks')"
-
-    // End boundary is the declaration after the handler: the Jira connect flow
-    // now lives in the shared JiraConnectDialog, so handleJiraConnect (the prior
-    // marker) no longer exists in TaskPage.
-    expect(
-      sourceBetween(
-        componentSource('use-task-page-composer-actions.ts'),
-        'const handleUseJiraItem',
-        'const nextModel'
-      )
-    ).toContain(jiraWriter)
-  })
-
-  it('records browser annotation agent handoff only from the prompt-delivered callback', () => {
-    const source = componentSource('browser-pane/annotate/use-browser-page-annotation-send.ts')
-    expect(
-      source.match(/recordFeatureInteraction\('browser-annotations-sent-to-agent'\)/g)
-    ).toHaveLength(1)
-    expect(
-      sourceBetween(
-        source,
-        'const handleBrowserAnnotationsSentToAgent',
-        'const handleClearBrowserAnnotations'
-      )
-    ).toContain("recordFeatureInteraction('browser-annotations-sent-to-agent')")
-    expect(
-      sourceBetween(
-        source,
-        'const handleCopyBrowserAnnotations',
-        'const handleBrowserAnnotationsSentToAgent'
-      )
-    ).not.toContain("recordFeatureInteraction('browser-annotations-sent-to-agent')")
-    expect(
-      sourceBetween(
-        source,
-        'const handleClearBrowserAnnotations',
-        'const handleDeleteBrowserAnnotation'
-      )
-    ).not.toContain("recordFeatureInteraction('browser-annotations-sent-to-agent')")
-  })
-
-  it('records floating workspace hide only from explicit disable or hide actions', () => {
-    const allowedSources = [
-      componentSource('settings/FloatingWorkspacePane.tsx'),
-      componentSource('floating-terminal/FloatingTerminalIconContextMenu.tsx')
-    ].join('\n')
-    const passiveSources = [
-      componentSource('../App.tsx'),
-      componentSource('floating-terminal/FloatingTerminalPanel.tsx')
-    ].join('\n')
-
-    expect(
-      allowedSources.match(/recordFeatureInteraction\('floating-workspace-hidden'\)/g) ?? []
-    ).toHaveLength(2)
-    expect(passiveSources).not.toContain("recordFeatureInteraction('floating-workspace-hidden')")
-  })
-})
diff --git a/src/renderer/src/components/feature-tips/feature-tip-startup-gate.test.ts b/src/renderer/src/components/feature-tips/feature-tip-startup-gate.test.ts
index 0c5da4935f3..3de131fca5b 100644
--- a/src/renderer/src/components/feature-tips/feature-tip-startup-gate.test.ts
+++ b/src/renderer/src/components/feature-tips/feature-tip-startup-gate.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest'
-import { getDefaultOnboardingState, getDefaultVoiceSettings } from '../../../../shared/constants'
+import { getDefaultVoiceSettings } from '../../../../shared/constants'
+import { getDefaultOnboardingState } from '../../../../shared/onboarding-defaults'
 import type { CliInstallStatus } from '../../../../shared/cli-install-types'
 import type { GlobalSettings } from '../../../../shared/global-settings-types'
 import type { OnboardingState } from '../../../../shared/onboarding-state-types'
diff --git a/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tab-lifecycle.test.tsx b/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tab-lifecycle.test.tsx
index a4c58f7ad04..1d8624ba435 100644
--- a/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tab-lifecycle.test.tsx
+++ b/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tab-lifecycle.test.tsx
@@ -209,7 +209,11 @@ describe('FloatingTerminalPanel close behavior', () => {
     const element = await renderPanel(true)
     const tabBar = findByTypeName(element, 'TabBar')
     ;(tabBar.props.onNewBrowserTab as () => void)()
-    ;(tabBar.props.onDuplicateBrowserTab as (browserTabId: string) => void)('browser-1')
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: TabBarProps types this callback; the test tree erases it.
+    ;(tabBar.props.onDuplicateBrowserTab as (browserTabId: string, unifiedTabId: string) => void)(
+      'browser-1',
+      'browser-unified-1'
+    )
 
     expect(mocks.createWebRuntimeSessionBrowserTab).not.toHaveBeenCalled()
     expect(mocks.createBrowserTab).toHaveBeenNthCalledWith(
@@ -231,7 +235,7 @@ describe('FloatingTerminalPanel close behavior', () => {
         title: 'Example',
         sessionProfileId: 'profile-1',
         sessionPartition: 'persist:orca-browser-session-profile-1',
-        targetGroupId: 'floating-group',
+        afterTabId: 'browser-unified-1',
         browserRuntimeEnvironmentId: null
       }
     )
diff --git a/src/renderer/src/components/floating-terminal/FloatingTerminalPanelSurface.tsx b/src/renderer/src/components/floating-terminal/FloatingTerminalPanelSurface.tsx
index e3a57fb0c41..bd2311e7ada 100644
--- a/src/renderer/src/components/floating-terminal/FloatingTerminalPanelSurface.tsx
+++ b/src/renderer/src/components/floating-terminal/FloatingTerminalPanelSurface.tsx
@@ -60,7 +60,6 @@ export function renderFloatingTerminalPanelSurface({
   activeTabType,
   browserTabs,
   createBrowserTab,
-  activeGroup,
   closeAllFiles,
   makePreviewFilePermanent,
   pinFile,
@@ -177,14 +176,14 @@ export function renderFloatingTerminalPanelSurface({
               onCloseFile={closeFloatingItemConfirmed}
               onActivateBrowserTab={activateFloatingItem}
               onCloseBrowserTab={closeFloatingItemConfirmed}
-              onDuplicateBrowserTab={(browserTabId) => {
+              onDuplicateBrowserTab={(browserTabId, sourceUnifiedTabId) => {
                 const source = browserTabs.find((tab) => tab.id === browserTabId)
                 if (!source) {
                   return
                 }
                 createBrowserTab(FLOATING_TERMINAL_WORKTREE_ID, source.url, {
                   ...buildDuplicatedBrowserTabOptions(source),
-                  targetGroupId: activeGroup?.id,
+                  afterTabId: sourceUnifiedTabId,
                   browserRuntimeEnvironmentId: null
                 })
               }}
diff --git a/src/renderer/src/components/github-item-dialog-source-boundary.test.ts b/src/renderer/src/components/github-item-dialog-source-boundary.test.ts
deleted file mode 100644
index 630ae68a7a0..00000000000
--- a/src/renderer/src/components/github-item-dialog-source-boundary.test.ts
+++ /dev/null
@@ -1,310 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-const COMPONENT_ROOT = __dirname
-
-function componentSource(relativePath: string): string {
-  // Why: CRLF checkouts would otherwise break every multi-line source assertion.
-  return readFileSync(join(COMPONENT_ROOT, relativePath), 'utf8').replace(/\r\n?/g, '\n')
-}
-
-function destSources(...relativePaths: string[]): string {
-  return relativePaths.map((relativePath) => componentSource(relativePath)).join('\n')
-}
-
-function sourceBetween(source: string, startPattern: string, endPattern: string): string {
-  const start = source.indexOf(startPattern)
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = source.indexOf(endPattern, start + startPattern.length)
-  expect(end).toBeGreaterThan(start)
-  return source.slice(start, end)
-}
-
-describe('GitHubItemDialog source host boundaries', () => {
-  it('does not keep the stale right-side sheet owner', () => {
-    const source = destSources(
-      'GitHubItemDialog.tsx',
-      'github-item-dialog/open-dialog/github-item-dialog.tsx'
-    )
-
-    expect(source).not.toContain('@/components/ui/sheet')
-    expect(source).not.toContain('<Sheet')
-    expect(source).not.toContain('<SheetContent')
-    expect(source).not.toContain("variant?: 'sheet'")
-  })
-
-  it('routes reviewer metadata and reviewer mutations through the task source context', () => {
-    const source = destSources(
-      'github-item-dialog/land-pull-request/pr-reviewers-panel.tsx',
-      'github-item-dialog/land-pull-request/pr-reviewers-request-actions.ts'
-    )
-    const section = source
-
-    expect(section).toContain('getTaskSourceRuntimeSettings(sourceContext)')
-    expect(section).toContain('useRepoAssigneesBySlug(')
-    expect(section).toContain('sourceSettings')
-    expect(section).toContain('useRepoAssignees(')
-    expect(section).toContain('sourceSettings')
-    expect(section).toContain('getActiveRuntimeTarget(sourceSettings)')
-    expect(section).toContain(
-      'const runtimeRepo = getGitHubRuntimeRepoId(sourceContext, item.repoId)'
-    )
-    expect(section).toContain("'github.requestPRReviewers'")
-    expect(section).toContain("'github.removePRReviewers'")
-    expect(section).toContain('resolvePullRequestRepo(item, projectOrigin)')
-    expect(section.match(/prRepo: reviewRepo/g)).toHaveLength(4)
-    expect(section).toContain('notifyWorkItemDetailsMutation(')
-    expect(section).toContain('{ local: false }')
-  })
-
-  it('routes edit metadata through the same task source as issue mutations', () => {
-    const source = destSources(
-      'github-item-dialog/edit-item-fields/gh-edit-section.tsx',
-      'github-item-dialog/edit-item-fields/gh-edit-section-mutations.ts'
-    )
-    const section = source
-    const helperSection = componentSource('github/github-work-item-edit-mutations.ts')
-
-    expect(section).toContain('getTaskSourceRuntimeSettings(sourceContext)')
-    expect(section).toContain('useRepoLabels(')
-    expect(section).toContain('useRepoLabelsBySlug(')
-    expect(section).toContain('projectOrigin?.host')
-    expect(section).toContain('useRepoAssignees(')
-    expect(section).toContain('useRepoAssigneesBySlug(')
-    expect(section).toContain('sourceSettings')
-    expect(helperSection).toContain("'github.updateIssue'")
-    expect(helperSection).toContain("'github.updatePRState'")
-    expect(helperSection).toContain("'github.project.updateIssueBySlug'")
-    expect(helperSection).toContain("'github.project.updatePullRequestBySlug'")
-    expect(helperSection).toContain("args.sourceContext?.provider === 'github'")
-    expect(helperSection).toContain('getTaskSourceRuntimeSettings(args.sourceContext)')
-    expect(helperSection).toContain(
-      'getGitHubMutationRoutingSettings(useAppStore.getState(), args.repoId, args.sourceContext)'
-    )
-    expect(helperSection).toContain('notifyWorkItemDetailsMutation(')
-    expect(helperSection).toContain(
-      "repo: getGitHubRuntimeRepoId(args.sourceContext, args.repoId ?? '')"
-    )
-    expect(helperSection).toContain('{ local: false }')
-  })
-
-  it('uses source-aware details routing and cache identity', () => {
-    const source = destSources(
-      'github-item-dialog/load-item-details/work-item-details-cache.ts',
-      'github-item-dialog/load-item-details/use-github-item-dialog-details.ts'
-    )
-    const cacheKeySection = sourceBetween(
-      source,
-      'function getWorkItemDetailsCacheKey',
-      'function touchWorkItemDetailsCache'
-    )
-    const matchInvalidationSection = sourceBetween(
-      source,
-      'function invalidateWorkItemDetailsCacheByMatch',
-      'function patchCachedPRFileViewedState'
-    )
-
-    expect(source).toContain('lookupGitHubWorkItemDetailsForSource({')
-    expect(source).toContain('sourceContext,')
-    expect(cacheKeySection).toContain('sourceCacheScope')
-    expect(source).toContain('getTaskSourceCacheScope(sourceContext)')
-    expect(matchInvalidationSection).toContain(
-      'if (removed) {\n    workItemDetailsCacheGeneration += 1'
-    )
-  })
-
-  it('treats null details as unavailable while preserving empty detail payloads', () => {
-    const source = destSources(
-      'github-item-dialog/load-item-details/use-github-item-dialog-details.ts',
-      'github-item-dialog/load-item-details/work-item-details-fetch-settle.ts'
-    )
-    const loadedSection = sourceBetween(
-      source,
-      'const loading = !!cachedEntry?.pending && !cachedEntry?.details',
-      '// Why: if a cross-window mutation invalidates'
-    )
-    const resultSection = sourceBetween(source, 'inflight', '.catch((err) => {')
-
-    expect(loadedSection).toContain('const detailsLoaded = Boolean(cachedEntry?.details)')
-    expect(loadedSection).not.toContain('fetchedAt > 0')
-    expect(resultSection).toContain('} else if (result === null) {')
-    expect(resultSection).toContain('error: WORK_ITEM_DETAILS_UNAVAILABLE_MESSAGE')
-    expect(resultSection).toContain('details: result')
-  })
-
-  it('routes PR file viewed mutations through the task source context', () => {
-    const changeSection = destSources(
-      'github-item-dialog/load-item-details/use-github-item-dialog-details.ts',
-      'github-item-dialog/load-item-details/pr-file-viewed-change.ts'
-    )
-    const helperSection = componentSource('github/github-work-item-comment-mutations.ts')
-
-    expect(helperSection).toContain('getGitHubSourceRuntimeHost(args.sourceContext)')
-    expect(helperSection).toContain("'github.setPRFileViewed'")
-    expect(helperSection).toContain('repo: getGitHubRuntimeRepoId(args.sourceContext, args.repoId)')
-    expect(helperSection).toContain('sourceContext: args.sourceContext')
-    expect(helperSection).toContain('{ local: false }')
-    expect(changeSection).toContain('canUseDetailsRepoContext')
-    expect(changeSection).toContain('repoPath: repoPath ??')
-    expect(changeSection).toContain('sourceContext,')
-  })
-
-  it('routes comment mutations through runtime source context when needed', () => {
-    const helperSource = componentSource('github/github-work-item-comment-mutations.ts')
-    const helperSection = sourceBetween(
-      helperSource,
-      'function addIssueCommentForRepo',
-      'function setPRFileViewedForRepo'
-    )
-
-    expect(helperSection).toContain('getGitHubSourceRuntimeHost(args.sourceContext)')
-    expect(helperSection).toContain("'github.addIssueComment'")
-    expect(helperSection).toContain("'github.addPRReviewComment'")
-    expect(helperSection).toContain("'github.addPRReviewCommentReply'")
-    expect(helperSection).toContain('repo: getGitHubRuntimeRepoId(args.sourceContext, args.repoId)')
-    expect(helperSection).toContain('sourceContext: args.sourceContext')
-    expect(helperSection).toContain('notifyWorkItemDetailsMutation(')
-    expect(helperSection).toContain('{ local: false }')
-  })
-
-  it('routes PR file contents and runtime viewed invalidations through the task source context', () => {
-    const source = destSources(
-      'github-item-dialog/load-item-details/work-item-details-cache.ts',
-      'github-item-dialog/load-item-details/pr-file-content-cache.ts'
-    )
-    const commentMutations = componentSource('github/github-work-item-comment-mutations.ts')
-    const fileContentsSection = sourceBetween(
-      source,
-      'function loadPRFileContents',
-      'touchPRFileContentCache(cacheKey, request)'
-    )
-    const fileContentsCacheKeySection = sourceBetween(
-      source,
-      'function getPRFileContentCacheKey',
-      'function loadPRFileContents'
-    )
-    const listenerSection = sourceBetween(source, 'let workItemMutatedUnsub', '// Why: bounded LRU')
-
-    expect(fileContentsCacheKeySection).toContain(
-      'source:${getTaskSourceCacheScope(args.sourceContext)}'
-    )
-    expect(fileContentsSection).toContain("'github.prFileContents'")
-    expect(fileContentsSection).toContain(
-      'repo: getGitHubRuntimeRepoId(args.sourceContext, args.repoId)'
-    )
-    expect(fileContentsSection).toContain('sourceContext: args.sourceContext')
-    expect(fileContentsSection).toContain('sourceContext,')
-    expect(listenerSection).toContain('onGitHubWorkItemDetailsCacheMutation')
-    expect(commentMutations).toContain('emitGitHubWorkItemDetailsCacheMutation(args)')
-    expect(commentMutations).toContain('options.local !== false')
-    expect(commentMutations).toContain('notifyWorkItemMutated({')
-  })
-
-  it('routes merge actions through the repo owner host (#6957)', () => {
-    const actionsSection = componentSource(
-      'github-item-dialog/land-pull-request/pr-actions-panel.tsx'
-    )
-
-    expect(actionsSection).toContain(
-      'getGitHubMutationRoutingSettings(s, item.repoId ?? repoId ?? null, sourceContext)'
-    )
-    expect(actionsSection).toContain('getActiveRuntimeTarget(sourceSettings)')
-    expect(actionsSection).toContain(
-      'const canMergeWithRepoContext = !!repoPath || mergeTarget.kind ==='
-    )
-    expect(actionsSection).toContain("'github.mergePR'")
-    expect(actionsSection).toContain("'github.setPRAutoMerge'")
-    expect(actionsSection).toContain('const prRepo = resolvePullRequestRepo(item, projectOrigin)')
-    expect(actionsSection).not.toContain('prRepo: item.prRepo ?? null')
-    expect(actionsSection).toContain(
-      'repo: getGitHubRuntimeRepoId(sourceContext, repoId ?? item.repoId)'
-    )
-    expect(actionsSection).toContain('sourceContext,')
-    expect(actionsSection).toContain('notifyWorkItemDetailsMutation(')
-    expect(actionsSection).toContain('{ local: false }')
-  })
-
-  it('routes check actions through the task source context', () => {
-    const checksSection = destSources(
-      'github-item-dialog/inspect-pull-request/checks-tab.tsx',
-      'github-item-dialog/inspect-pull-request/checks-tab-actions.ts',
-      'github-item-dialog/inspect-pull-request/checks-tab-request-details.ts'
-    )
-
-    expect(checksSection).toContain('sourceContext?: TaskSourceContext | null')
-    expect(checksSection).toContain('sourceContext,')
-    expect(checksSection).toContain("'github.prChecks'")
-    expect(checksSection).toContain("'github.rerunPRChecks'")
-    expect(checksSection).toContain("'github.prCheckDetails'")
-    expect(checksSection).toContain(
-      'repo: getGitHubRuntimeRepoId(ctx.sourceContext, ctx.repoId ?? ctx.itemRepoId)'
-    )
-    expect(checksSection).toContain('window.api.gh.prChecks({')
-    expect(checksSection).toContain('window.api.gh.rerunPRChecks({')
-    expect(checksSection).toContain('prCheckDetails({')
-    expect(checksSection).toMatch(
-      /withGitHubCheckDetailsTimeout\(\(signal\) =>\s*ctx\.runtimeHost\s*\?\s*callRuntimeRpc[\s\S]*:\s*window\.api\.gh\.prCheckDetails\(\{/
-    )
-    expect(checksSection).toContain('{ timeoutMs: 30_000, signal }')
-  })
-
-  it('makes failed check detail loads retryable and fences stale responses', () => {
-    const checksSection = destSources(
-      'github-item-dialog/inspect-pull-request/checks-tab.tsx',
-      'github-item-dialog/inspect-pull-request/checks-tab-actions.ts',
-      'github-item-dialog/inspect-pull-request/checks-tab-request-details.ts',
-      'github-item-dialog/inspect-pull-request/checks-tab-check-details.tsx'
-    )
-
-    expect(checksSection).toContain('createGitHubChecksTabState(checks, checkDetailsContextKey)')
-    expect(checksSection).toContain('checksState,\n    checks,\n    checkDetailsContextKey')
-    expect(checksSection).toContain('resetGitHubChecksTabForSource(current)')
-    expect(checksSection).toContain(
-      'committedChecksContextOwnerRef.current !== refreshContextOwner'
-    )
-    expect(checksSection).toContain('activeChecksRefreshRequestIdRef.current !== refreshRequestId')
-    expect(checksSection).toContain('current.contextOwner === refreshContextOwner')
-    expect(checksSection).toContain(
-      'const rerunContextOwner = ctx.committedChecksContextOwnerRef.current'
-    )
-    expect(checksSection).toContain(
-      'ctx.committedChecksContextOwnerRef.current !== rerunContextOwner'
-    )
-    expect(checksSection).toContain('await refreshGitHubChecksTab(ctx, rerunContextOwner)')
-    expect(checksSection).toContain('!ctx.mountedRef.current ||')
-    expect(checksSection).toContain('settleGitHubChecksTabDetails(current, key, requestId, next)')
-    expect(checksSection).toContain('onClick={() => onRetry(check, getCheckDetailsKey(check))}')
-    expect(checksSection).toContain('disabled={state.loading}')
-    expect(checksSection).toContain('aria-busy={state.loading}')
-    expect(checksSection).toContain("translate('githubChecks.retrying', 'Retrying…')")
-    expect(checksSection).toContain("'Retry'")
-  })
-
-  it('uses hydrated work item details for the page checks tab', () => {
-    const source = componentSource('github-item-dialog/open-dialog/github-item-dialog-pr-tabs.tsx')
-    const checksTab = sourceBetween(
-      source,
-      '<TabsContent value="checks"',
-      '<TabsContent value="files"'
-    )
-
-    expect(checksTab).toContain('item={displayWorkItem ?? workItem}')
-  })
-
-  it('records state authority for dialog state mutations so stale list refetches cannot revert them (STA-3343)', () => {
-    const editSection = destSources(
-      'github-item-dialog/edit-item-fields/gh-edit-section.tsx',
-      'github-item-dialog/edit-item-fields/gh-edit-section-mutations.ts'
-    )
-    expect(editSection).toContain('assertTaskPageGitHubDialogStateAuthority({')
-    expect(editSection).toContain('if (authority?.revert())')
-
-    const actionsSection = componentSource(
-      'github-item-dialog/land-pull-request/pr-actions-panel.tsx'
-    )
-    expect(actionsSection.match(/assertTaskPageGitHubDialogStateAuthority\(\{/g)).toHaveLength(2)
-    expect(actionsSection).toContain('if (authority.revert())')
-    expect(actionsSection).toContain("state: 'merged'")
-  })
-})
diff --git a/src/renderer/src/components/github-item-dialog/inspect-pull-request/pr-files-combined-diff-viewer.tsx b/src/renderer/src/components/github-item-dialog/inspect-pull-request/pr-files-combined-diff-viewer.tsx
index d6da1177779..b29f8d97fce 100644
--- a/src/renderer/src/components/github-item-dialog/inspect-pull-request/pr-files-combined-diff-viewer.tsx
+++ b/src/renderer/src/components/github-item-dialog/inspect-pull-request/pr-files-combined-diff-viewer.tsx
@@ -9,6 +9,7 @@ import type { DiffSection } from '@/components/editor/diff-section-types'
 import { getCombinedDiffBranchEntriesInTreeOrder } from '../../editor/combined-diff/browse-files/combined-diff-file-tree-filter'
 import type { CombinedDiffFileTreeEntry } from '../../editor/combined-diff/resolve-changes/combined-diff-section-identity'
 import { useAppStore } from '@/store'
+import { useDocumentDarkTheme } from '@/hooks/use-document-dark-theme'
 import type { GitBranchChangeEntry } from '../../../../../shared/git-diff-compare-types'
 import { isPRFileViewed } from '@/components/github/pr-file-content-size'
 import {
@@ -92,9 +93,7 @@ function PRFilesCombinedDiffSections({
   setFileTreeCollapsed
 }: PRFilesCombinedDiffSectionsProps): React.JSX.Element {
   const settings = useAppStore((s) => s.settings)
-  const isDark =
-    settings?.theme === 'dark' ||
-    (settings?.theme === 'system' && window.matchMedia('(prefers-color-scheme: dark)').matches)
+  const isDark = useDocumentDarkTheme()
   // Why: this subtree is keyed by the diff signature, so its file set is fixed for the
   // mount. Freezing it in state keeps a stable identity without caching through a ref.
   const [entries] = useState<GitBranchChangeEntry[]>(() =>
diff --git a/src/renderer/src/components/github-item-dialog/open-dialog/github-item-dialog.tsx b/src/renderer/src/components/github-item-dialog/open-dialog/github-item-dialog.tsx
index 71e580a21d5..f07fe236c70 100644
--- a/src/renderer/src/components/github-item-dialog/open-dialog/github-item-dialog.tsx
+++ b/src/renderer/src/components/github-item-dialog/open-dialog/github-item-dialog.tsx
@@ -58,7 +58,9 @@ export default function GitHubItemDialog({
         return
       }
 
-      const result = activateAndRevealWorktree(currentAttached.id)
+      const result = activateAndRevealWorktree(currentAttached.id, {
+        navigationIntent: 'user-open'
+      })
       if (result === false) {
         toast.error(
           translate(
diff --git a/src/renderer/src/components/github/repro-8784-ghe-avatar-fallback.test.ts b/src/renderer/src/components/github/repro-8784-ghe-avatar-fallback.test.ts
index 8b33b3dc40c..ddf7fb92cff 100644
--- a/src/renderer/src/components/github/repro-8784-ghe-avatar-fallback.test.ts
+++ b/src/renderer/src/components/github/repro-8784-ghe-avatar-fallback.test.ts
@@ -4,15 +4,12 @@
  * Regression guard (was a repro that documented the broken path). After the fix:
  * - resolveGitHubUserAvatarSrc prefers API URLs
  * - PullRequestPage author uses authorAvatarUrl via GitHubUserAvatar
- * - TaskPage ReviewChipAvatar no longer hardcodes github.com login.png
  *
  * Re-run:
  *   pnpm exec vitest run --config config/vitest.config.ts \
  *     src/renderer/src/components/github/repro-8784-ghe-avatar-fallback.test.ts
  */
 import { describe, expect, it } from 'vitest'
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
 import { githubAvatarUrl, resolveGitHubUserAvatarSrc } from './github-user-avatar'
 
 describe('issue #8784 GHE avatar fallback (regression)', () => {
@@ -38,86 +35,4 @@ describe('issue #8784 GHE avatar fallback (regression)', () => {
     // enrichment + image onError → initials when this 404s.
     expect(githubAvatarUrl('corp-user')).toBe('https://github.com/corp-user.png?size=64')
   })
-
-  it('source routes PR author/reviewer avatars through GitHubUserAvatar + authorAvatarUrl', () => {
-    const prPage = readFileSync(join(__dirname, '../pull-request-page/page/header.tsx'), 'utf8')
-    expect(prPage).toMatch(/GitHubUserAvatar/)
-    expect(prPage).toMatch(/authorAvatarUrl/)
-    // Why: author chip must not ignore API avatar_url and only pass login.
-    expect(prPage).not.toMatch(/githubAvatarUrl\(workItem\.author\)/)
-
-    const reviewChip = readFileSync(join(__dirname, '../task-page/github/Avatars.tsx'), 'utf8')
-    expect(reviewChip).toMatch(/GitHubUserAvatar/)
-    // Why: list chip must not hardcode github.com/{login}.png.
-    expect(reviewChip).not.toMatch(/github\.com\/\$\{reviewer\.login\}\.png/)
-  })
-
-  // GHES URLs can exist but fail unauthenticated; target slots need onError fallbacks.
-  // Scope checks because TaskPage also renders non-GitHub provider avatars.
-  const GITHUB_AVATAR_SLOTS = [
-    {
-      file: 'pull-request-page/reviewers/picker-row.tsx',
-      fn: 'ReviewerPickerRow',
-      login: 'reviewer.login',
-      displayName: 'reviewer.name'
-    },
-    {
-      file: 'pull-request-page/conversation/comment-card.tsx',
-      fn: 'ConversationCommentCard',
-      login: 'comment.author',
-      displayName: null
-    },
-    {
-      file: 'pull-request-page/mentions/textarea.tsx',
-      fn: 'MentionTextarea',
-      login: 'option.login',
-      displayName: 'option.name'
-    },
-    {
-      file: 'task-page/github/Avatars.tsx',
-      fn: 'GitHubAssigneeAvatar',
-      login: 'assignee.login',
-      displayName: 'assignee.name'
-    },
-    {
-      file: 'task-page/github/AssigneesCell.tsx',
-      fn: 'GHAssigneesCell',
-      login: 'user.login',
-      displayName: 'user.name'
-    },
-    {
-      file: 'task-page/github/ReviewerPicker.tsx',
-      fn: 'TaskPageGitHubReviewerPicker',
-      login: 'reviewer.login',
-      displayName: 'reviewer.name'
-    }
-  ] as const
-
-  function componentBody(file: string, fn: string): string {
-    const source = readFileSync(join(__dirname, '..', file), 'utf8')
-    const start = source.indexOf(`function ${fn}`)
-    expect(start, `${file}: function ${fn} not found`).toBeGreaterThanOrEqual(0)
-    const next = source.indexOf('\nfunction ', start + 1)
-    return source.slice(start, next === -1 ? undefined : next)
-  }
-
-  it.each(GITHUB_AVATAR_SLOTS)(
-    'renders the $fn avatar through GitHubUserAvatar (#13976)',
-    ({ file, fn, login }) => {
-      const body = componentBody(file, fn)
-
-      // Reject aliases and resolver expressions as well as direct avatarUrl fields.
-      expect(body, `${fn} still renders a bare img`).not.toMatch(/<img[\s>]/)
-      expect(body, `${fn} does not use GitHubUserAvatar`).toContain('<GitHubUserAvatar')
-      expect(body, `${fn} does not pass its login`).toContain(`login={${login}}`)
-    }
-  )
-
-  // Preserve two-letter initials when the fallback renders.
-  it.each(GITHUB_AVATAR_SLOTS.filter((slot) => slot.displayName !== null))(
-    'passes the $fn display name so initials are not reduced to one letter (#13976)',
-    ({ file, fn, displayName }) => {
-      expect(componentBody(file, fn)).toContain(`name={${displayName}}`)
-    }
-  )
 })
diff --git a/src/renderer/src/components/linear-issue-workspace-api-parity.test.ts b/src/renderer/src/components/linear-issue-workspace-api-parity.test.ts
deleted file mode 100644
index 91310627cf7..00000000000
--- a/src/renderer/src/components/linear-issue-workspace-api-parity.test.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-function componentSource(file: string): string {
-  return readFileSync(join(__dirname, file), 'utf8')
-}
-
-describe('Linear issue workspace provider API parity', () => {
-  it('keeps detail and comments on the selected source and workspace', () => {
-    const source = componentSource('linear-issue-workspace-detail-state.ts')
-    expect(source).toContain('initialRequest.providerSettings,')
-    expect(source).toContain('initialRequest.issue.id,')
-    expect(source).toContain('initialRequest.issue.workspaceId')
-    expect(source).toContain('targetProviderSettings,')
-    expect(source).toContain('targetIssue.id,')
-    expect(source).toContain('targetIssue.workspaceId')
-  })
-
-  it('keeps project search and assignment source-scoped', () => {
-    const source = componentSource('linear-issue-project-selector.tsx')
-    expect(source).toContain(
-      'linearListProjects(providerSettings, requestQuery, 20, issue.workspaceId)'
-    )
-    expect(source).toMatch(
-      /linearUpdateIssue\(\s*providerSettings,\s*issue\.id,\s*\{ projectId: project\.id \},\s*issue\.workspaceId/
-    )
-    expect(source).toContain('patchLinearIssue(issue.id, { project }, { sourceContext })')
-  })
-
-  it('keeps sub-issue create and open payloads source-scoped', () => {
-    const source = componentSource('linear-issue-sub-issues.tsx')
-    expect(source).toContain('parentIssueId: issue.id')
-    expect(source).toContain('teamId: issue.team.id')
-    expect(source).toContain('workspaceId: issue.workspaceId')
-    expect(source).toContain('projectId: issue.project?.id ?? null')
-    expect(source).toMatch(
-      /fetchLinearIssue\(subIssue\.id, issue\.workspaceId, \{\s*sourceContext\s*\}\)/
-    )
-  })
-
-  it('keeps git and folder workspace attachments in the same lookup', () => {
-    const source = componentSource('LinearIssueWorkspace.tsx')
-    expect(source).toContain('...allWorktrees')
-    expect(source).toContain('...folderWorkspaces.map(folderWorkspaceToWorktree)')
-    expect(source).toContain('findLinearIssueWorkspaceAttachment(attachmentWorkspaces')
-    expect(source).toContain('openLinearIssueWorkspaceOrStart(detail.displayed')
-  })
-})
diff --git a/src/renderer/src/components/linear-issue-workspace-header.test.ts b/src/renderer/src/components/linear-issue-workspace-header.test.ts
deleted file mode 100644
index 4fd36b23bf4..00000000000
--- a/src/renderer/src/components/linear-issue-workspace-header.test.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-const source = readFileSync(join(__dirname, 'linear-issue-workspace-header.tsx'), 'utf8')
-
-function headerSource(): string {
-  const start = source.indexOf('<header className="flex h-[61px]')
-  const end = source.indexOf('</header>', start)
-  expect(start).toBeGreaterThanOrEqual(0)
-  expect(end).toBeGreaterThan(start)
-  return source.slice(start, end)
-}
-
-describe('LinearIssueWorkspace header actions', () => {
-  it('exposes copy, open-on-Linear, and a labeled start-workspace control', () => {
-    const header = headerSource()
-
-    expect(header).toContain("copyLinearIssueText(issue.url, 'URL')")
-    expect(header).toContain('window.api.shell.openUrl(issue.url)')
-    expect(header).toContain("'Open on Linear'")
-    expect(header).toContain('<Copy className="size-4" />')
-    expect(header).toContain('<ExternalLink className="size-4" />')
-    expect(header).toContain("'Start workspace'")
-    expect(header).toContain("'Start workspace from issue'")
-    expect(header).not.toContain("'Copy issue identifier'")
-    expect(header).toMatch(/size="sm"[\s\S]*onClick=\{onOpenOrUseIssue\}/)
-    expect(header).not.toMatch(/size="icon-sm"\s+onClick=\{onOpenOrUseIssue\}/)
-  })
-})
diff --git a/src/renderer/src/components/linear-scope-selector.test.ts b/src/renderer/src/components/linear-scope-selector.test.ts
index 3e8d69f69c7..90b06f4e636 100644
--- a/src/renderer/src/components/linear-scope-selector.test.ts
+++ b/src/renderer/src/components/linear-scope-selector.test.ts
@@ -4,7 +4,6 @@ import {
   LINEAR_SCOPE_TEAM_FILTER_QUERY_MAX_BYTES,
   filterLinearScopeTeams,
   getLinearScopeTriggerLabel,
-  isLinearScopeTeamFilterQueryTooLarge,
   normalizeLinearScopeTeamSelection
 } from './linear-scope-selector'
 
@@ -125,7 +124,6 @@ describe('LinearScopeSelector helpers', () => {
       }
     ] as LinearTeam[]
 
-    expect(isLinearScopeTeamFilterQueryTooLarge(oversizedQuery)).toBe(true)
     expect(filterLinearScopeTeams(throwingTeams, oversizedQuery, new Map())).toEqual([])
   })
 
diff --git a/src/renderer/src/components/linear-scope-selector.tsx b/src/renderer/src/components/linear-scope-selector.tsx
index e6a1712fab1..331c667bc58 100644
--- a/src/renderer/src/components/linear-scope-selector.tsx
+++ b/src/renderer/src/components/linear-scope-selector.tsx
@@ -38,7 +38,7 @@ type LinearScopeTeamSelectionInput = {
 
 export const LINEAR_SCOPE_TEAM_FILTER_QUERY_MAX_BYTES = 2 * 1024
 
-export function isLinearScopeTeamFilterQueryTooLarge(
+function isLinearScopeTeamFilterQueryTooLarge(
   query: string,
   maxBytes = LINEAR_SCOPE_TEAM_FILTER_QUERY_MAX_BYTES
 ): boolean {
diff --git a/src/renderer/src/components/native-chat-resume-failed-chat-watch.test.ts b/src/renderer/src/components/native-chat-resume-failed-chat-watch.test.ts
index 308e7b878e8..7dfc8938373 100644
--- a/src/renderer/src/components/native-chat-resume-failed-chat-watch.test.ts
+++ b/src/renderer/src/components/native-chat-resume-failed-chat-watch.test.ts
@@ -25,8 +25,8 @@ vi.mock('@/runtime/structured-agent-session-client', () => ({
 }))
 vi.mock('sonner', () => ({ toast: vi.fn() }))
 
-// After a restart action leaves a chat failed, the user's reply in that chat must retire the status
-// bar entry without the user reopening anything, and nothing may run while nothing failed.
+// When the user sends in an offered or failed chat, its status bar entry must retire without the
+// user reopening anything, and nothing may run while nothing is offered or failed.
 
 const failure = {
   sessionId: 'a',
@@ -91,7 +91,26 @@ afterEach(() => {
   vi.useRealTimers()
 })
 
-it('opens no status stream while nothing failed', async () => {
+// The host withdraws a pending offer once the chat moves on; the status bar must not keep counting it.
+it('re-reads once when the user sends in an offered chat, and the count drops', async () => {
+  const { failedAt: _failedAt, outcome: _outcome, reason: _reason, ...candidate } = failure
+  mocks.rpc
+    .mockResolvedValueOnce({ sessions: [candidate], failed: [] })
+    .mockResolvedValue({ sessions: [], failed: [] })
+  await refreshNativeChatRestartOffer()
+  await vi.advanceTimersByTimeAsync(0)
+  expect(getNativeChatRestartOffer().candidates).toHaveLength(1)
+  expect(mocks.subscribeStatus).toHaveBeenCalledOnce()
+
+  hostEmit()({ type: 'status', session: summary('working', 'Something else', Date.now() + 10_000) })
+  await vi.advanceTimersByTimeAsync(500)
+
+  expect(offerReads()).toBe(2)
+  expect(getNativeChatRestartOffer().candidates).toEqual([])
+  expect(mocks.unsubscribe).toHaveBeenCalledOnce()
+})
+
+it('opens no status stream while nothing is offered or failed', async () => {
   mocks.rpc.mockResolvedValue({ sessions: [], failed: [] })
   await refreshNativeChatRestartOffer()
   await vi.advanceTimersByTimeAsync(0)
diff --git a/src/renderer/src/components/native-chat-resume-on-restart-store.ts b/src/renderer/src/components/native-chat-resume-on-restart-store.ts
index a3012495a3c..452aa78cc81 100644
--- a/src/renderer/src/components/native-chat-resume-on-restart-store.ts
+++ b/src/renderer/src/components/native-chat-resume-on-restart-store.ts
@@ -17,7 +17,10 @@ import {
   type ResumeCandidate,
   type ResumeFailure
 } from './native-chat-resume-on-restart-grouping'
-import { requestNativeChatResumeOnRestartDialog } from './native-chat-resume-on-restart-dialog'
+import {
+  consumeNativeChatResumeOnRestartDialogRequest,
+  requestNativeChatResumeOnRestartDialog
+} from './native-chat-resume-on-restart-dialog'
 
 /**
  * Which interrupted chats the host is still offering to resume, and every action that moves that.
@@ -50,50 +53,78 @@ let launch: Promise<void> | undefined
  *  a re-read that raced it must neither pre-empt nor undo. */
 let actionsBegun = 0
 let actionsSettled = 0
+/** The chats each in-flight continue call names, so the status bar can report the resume after
+ *  the dialog that started it has closed. Held only for the call's lifetime; never persisted. */
+const resumeBatches = new Set<readonly string[]>()
+const NOTHING_RESUMING: readonly string[] = []
+let resuming: readonly string[] = NOTHING_RESUMING
 const listeners = new Set<() => void>()
 const LAUNCH_READ_RETRY_DELAYS_MS = [100, 250, 500] as const
 
+function emit(): void {
+  for (const listener of listeners) {
+    listener()
+  }
+}
+
 /** The snapshot object is replaced HERE and nowhere else — never during a render — so every
  *  `useSyncExternalStore` reader sees the same reference until a host answer or a user action
  *  actually moves the offer. */
 function publish(next: NativeChatRestartOffer): void {
   offer = next
-  syncFailedChatWatch()
-  for (const listener of listeners) {
-    listener()
+  syncOfferedChatWatch()
+  emit()
+}
+
+/** A confirmed host answer. One with nothing left also retires any open request for the dialog,
+ *  which has nothing to show; a failed read only hides rows, so it keeps the request. */
+function publishAnswer(next: NativeChatRestartOffer): void {
+  publish(next)
+  if (next.candidates.length === 0 && next.failed.length === 0) {
+    consumeNativeChatResumeOnRestartDialogRequest()
   }
 }
 
+function syncResuming(): void {
+  resuming = resumeBatches.size === 0 ? NOTHING_RESUMING : [...new Set([...resumeBatches].flat())]
+  emit()
+}
+
 /**
- * Re-reads the host once a failed chat shows new activity, so a reply the user sent there retires
- * its entry here too. The host stays the judge; this only asks again.
+ * Re-reads the host once an offered or failed chat shows new activity, so a message the user sent
+ * there, or its agent starting, retires its entry here too. The host stays the judge; this only
+ * asks again.
  *
- * Held only while something failed. Keyed on status and prompt rather than every summary, so an
- * agent streaming in a failed chat costs one re-read, not one per tool call.
+ * Held only while something is offered or failed. Keyed on status and prompt rather than every
+ * summary, so an agent streaming in such a chat costs one re-read, not one per tool call.
  */
-const FAILED_CHAT_REFRESH_DELAY_MS = 500
-let failedChatWatch: {
+const OFFERED_CHAT_REFRESH_DELAY_MS = 500
+let offeredChatWatch: {
   feed: StructuredAgentSessionStatusFeedOwner
   seen: Map<string, string>
   release: () => void
 } | null = null
-let failedChatRefresh: ReturnType<typeof setTimeout> | null = null
+let offeredChatRefresh: ReturnType<typeof setTimeout> | null = null
 
-function failedChatActivityKey(summary: AgentSessionStatusSummary): string {
+function offeredChatIds(): Set<string> {
+  return new Set([...offer.candidates, ...offer.failed].map((entry) => entry.sessionId))
+}
+
+function offeredChatActivityKey(summary: AgentSessionStatusSummary): string {
   return `${summary.status ?? ''}\u0000${summary.latestPrompt}`
 }
 
-function syncFailedChatWatch(): void {
-  const failedIds = new Set(offer.failed.map((failure) => failure.sessionId))
-  if (failedIds.size === 0) {
-    releaseFailedChatWatch()
+function syncOfferedChatWatch(): void {
+  const offeredIds = offeredChatIds()
+  if (offeredIds.size === 0) {
+    releaseOfferedChatWatch()
     return
   }
-  if (!failedChatWatch) {
+  if (!offeredChatWatch) {
     const feed = getStructuredAgentSessionStatusFeed(LOCAL)
-    const unsubscribe = feed.subscribe(noticeFailedChatActivity)
+    const unsubscribe = feed.subscribe(noticeOfferedChatActivity)
     const deactivate = feed.activate()
-    failedChatWatch = {
+    offeredChatWatch = {
       feed,
       seen: new Map(),
       release: () => {
@@ -102,66 +133,70 @@ function syncFailedChatWatch(): void {
       }
     }
   }
-  const { feed, seen } = failedChatWatch
+  const { feed, seen } = offeredChatWatch
   for (const sessionId of seen.keys()) {
-    if (!failedIds.has(sessionId)) {
+    if (!offeredIds.has(sessionId)) {
       seen.delete(sessionId)
     }
   }
   // What the feed already holds is what this listing answered.
-  for (const sessionId of failedIds) {
+  for (const sessionId of offeredIds) {
     const summary = feed.getSnapshot().get(sessionId)
     if (summary && !seen.has(sessionId)) {
-      seen.set(sessionId, failedChatActivityKey(summary))
+      seen.set(sessionId, offeredChatActivityKey(summary))
     }
   }
 }
 
-function noticeFailedChatActivity(): void {
-  if (!failedChatWatch) {
+function noticeOfferedChatActivity(): void {
+  if (!offeredChatWatch) {
     return
   }
-  const { feed, seen } = failedChatWatch
+  const { feed, seen } = offeredChatWatch
   const snapshot = feed.getSnapshot()
   let changed = false
-  for (const failure of offer.failed) {
-    const summary = snapshot.get(failure.sessionId)
+  for (const sessionId of offeredChatIds()) {
+    const summary = snapshot.get(sessionId)
     if (!summary) {
       continue
     }
-    const key = failedChatActivityKey(summary)
-    const previous = seen.get(failure.sessionId)
+    const key = offeredChatActivityKey(summary)
+    const previous = seen.get(sessionId)
     if (previous !== key) {
-      seen.set(failure.sessionId, key)
+      seen.set(sessionId, key)
       // A first sighting is news only if newer than the list; a change to a known chat always is,
       // since the host may have answered the list just before the change was delivered here.
       changed ||= previous !== undefined || summary.updatedAt > offer.listedAt
     }
   }
-  if (changed && failedChatRefresh === null) {
-    failedChatRefresh = setTimeout(() => {
-      failedChatRefresh = null
+  if (changed && offeredChatRefresh === null) {
+    offeredChatRefresh = setTimeout(() => {
+      offeredChatRefresh = null
       if (actionsBegun === actionsSettled) {
         const issued = actionsBegun
         void readNativeChatRestartOffer(() => actionsBegun === issued)
       }
-    }, FAILED_CHAT_REFRESH_DELAY_MS)
+    }, OFFERED_CHAT_REFRESH_DELAY_MS)
   }
 }
 
-function releaseFailedChatWatch(): void {
-  if (failedChatRefresh !== null) {
-    clearTimeout(failedChatRefresh)
-    failedChatRefresh = null
+function releaseOfferedChatWatch(): void {
+  if (offeredChatRefresh !== null) {
+    clearTimeout(offeredChatRefresh)
+    offeredChatRefresh = null
   }
-  failedChatWatch?.release()
-  failedChatWatch = null
+  offeredChatWatch?.release()
+  offeredChatWatch = null
 }
 
 export function getNativeChatRestartOffer(): NativeChatRestartOffer {
   return offer
 }
 
+export function getNativeChatRestartResuming(): readonly string[] {
+  return resuming
+}
+
 function subscribe(listener: () => void): () => void {
   listeners.add(listener)
   return () => {
@@ -201,7 +236,7 @@ async function readNativeChatRestartOffer(current = () => true): Promise<HostOff
     }
     const failed = failedFrom(offered)
     if (current()) {
-      publish({ candidates: offered.sessions, failed, listedAt: Date.now() })
+      publishAnswer({ candidates: offered.sessions, failed, listedAt: Date.now() })
     }
     return { candidates: offered.sessions, failed, available: true }
   } catch {
@@ -248,6 +283,9 @@ export async function continueNativeChatRestartOffer(
   reported: readonly string[] = sessionIds ?? []
 ): Promise<void> {
   actionsBegun += 1
+  const batch = [...reported]
+  resumeBatches.add(batch)
+  syncResuming()
   try {
     const result = await callStructuredAgentSession<
       HostOfferPayload & {
@@ -264,7 +302,7 @@ export async function continueNativeChatRestartOffer(
       failureToastActions
     )
     if (Array.isArray(result.sessions)) {
-      publish({ candidates: result.sessions, failed, listedAt: Date.now() })
+      publishAnswer({ candidates: result.sessions, failed, listedAt: Date.now() })
     } else {
       await refreshNativeChatRestartOffer()
     }
@@ -273,6 +311,8 @@ export async function continueNativeChatRestartOffer(
     announceRestartUnconfirmed(reported.length)
   } finally {
     actionsSettled += 1
+    resumeBatches.delete(batch)
+    syncResuming()
   }
 }
 
@@ -293,7 +333,11 @@ export async function dismissNativeChatRestartOffer(sessionIds?: readonly string
       sessionIds ? { sessionIds: [...sessionIds] } : {}
     )
     if (Array.isArray(result.sessions)) {
-      publish({ candidates: result.sessions, failed: failedFrom(result), listedAt: Date.now() })
+      publishAnswer({
+        candidates: result.sessions,
+        failed: failedFrom(result),
+        listedAt: Date.now()
+      })
     } else {
       await refreshNativeChatRestartOffer()
     }
@@ -356,10 +400,17 @@ export function useNativeChatRestartOffer(enabled: boolean): NativeChatRestartOf
   return useSyncExternalStore(subscribe, getNativeChatRestartOffer, getNativeChatRestartOffer)
 }
 
+/** The chats a resume is carrying on right now, whichever surface started it. */
+export function useNativeChatRestartResuming(): readonly string[] {
+  return useSyncExternalStore(subscribe, getNativeChatRestartResuming, getNativeChatRestartResuming)
+}
+
 /** @internal - tests need a clean module between cases. */
 export function _resetNativeChatRestartOffer(): void {
-  releaseFailedChatWatch()
+  releaseOfferedChatWatch()
   offer = EMPTY
+  resumeBatches.clear()
+  resuming = NOTHING_RESUMING
   actionsBegun = 0
   actionsSettled = 0
   launch = undefined
diff --git a/src/renderer/src/components/native-chat/NativeChatAwaitingInputRow.tsx b/src/renderer/src/components/native-chat/NativeChatAwaitingInputRow.tsx
index 0f9dab5720b..9549fc933e7 100644
--- a/src/renderer/src/components/native-chat/NativeChatAwaitingInputRow.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatAwaitingInputRow.tsx
@@ -1,11 +1,17 @@
+import { useCallback, useRef, useState } from 'react'
+import { ChevronRight } from 'lucide-react'
 import { cn } from '@/lib/utils'
 import { translate } from '@/i18n/i18n'
 import {
   NATIVE_CHAT_ASK_ROW_COPY,
   type NativeChatAskRowSubject
 } from '../../../../shared/native-chat-ask-row'
+import { useNativeChatDisclosure } from './native-chat-disclosure-store'
 import { NativeChatToolRunIcon } from './NativeChatToolIcon'
 
+const ROW_CLASS_NAME =
+  'flex min-h-6 w-full items-center gap-1.5 py-0.5 text-left text-sm leading-relaxed text-muted-foreground'
+
 /**
  * The row a question tool call draws in place of its raw input. The agent is
  * blocked on the reader, so the row says that in plain words and names what was
@@ -13,19 +19,68 @@ import { NativeChatToolRunIcon } from './NativeChatToolIcon'
  *
  * Only the label breathes: the question is the part worth reading, and animating
  * it would make the one line the reader has to act on the hardest one to read.
+ *
+ * A question too long for the line becomes a disclosure, and so does a grouped
+ * prompt, whose line names only a count. Once answered, this row may be the only
+ * place the questions are still shown, so the full text opens below the toggle,
+ * outside it, where it can be selected and copied like any other prose.
  */
 export function NativeChatAwaitingInputRow({
   subject,
-  pending
+  pending,
+  disclosureKey,
+  listsQuestions = true
 }: {
   /** Null when the payload named no question; the label carries the row alone. */
   subject: NativeChatAskRowSubject | null
   /** Still waiting on an answer; a settled prompt reports what was asked. */
   pending: boolean
+  /** Identity the opened question is remembered under while the row is unmounted. */
+  disclosureKey?: string
+  /** False when the caller already shows each question of a grouped prompt in full. */
+  listsQuestions?: boolean
 }): React.JSX.Element {
-  const label = pending
-    ? translate('components.native-chat.ask.awaiting', NATIVE_CHAT_ASK_ROW_COPY.awaiting)
-    : translate('components.native-chat.ask.asked', NATIVE_CHAT_ASK_ROW_COPY.asked)
+  // The list and a lone question are separate disclosures: a pending Codex group is
+  // keyed by its first question, which becomes its own row once answered.
+  const { open, setOpen } = useNativeChatDisclosure(
+    disclosureKey !== undefined && subject?.kind === 'questions'
+      ? `${disclosureKey}:questions`
+      : disclosureKey,
+    false
+  )
+  // Seeded from `open`: a row remounted open was clipped when the reader opened
+  // it, and dropping the toggle as it folds would drop keyboard focus with it.
+  const [clipped, setClipped] = useState(open)
+  const observerRef = useRef<ResizeObserver | null>(null)
+  // Attached to the question only while it sits on the line; an open row keeps its verdict.
+  const measureLine = useCallback((line: HTMLSpanElement | null) => {
+    observerRef.current?.disconnect()
+    observerRef.current = null
+    if (!line) {
+      return
+    }
+    const measure = (): void => setClipped(line.scrollWidth > line.clientWidth)
+    measure()
+    if (typeof ResizeObserver === 'undefined') {
+      return
+    }
+    observerRef.current = new ResizeObserver(measure)
+    observerRef.current.observe(line)
+  }, [])
+
+  const question = subject?.kind === 'question' ? subject.text : null
+  const questions = subject?.kind === 'questions' && listsQuestions ? subject.questions : null
+  // A count always hides its questions, so the list needs no clipping measurement.
+  const toggles = questions !== null || (question !== null && (open || clipped))
+  // With nothing to name, the label must read as a whole phrase, not end on a colon.
+  const label = !pending
+    ? translate('components.native-chat.ask.asked', NATIVE_CHAT_ASK_ROW_COPY.asked)
+    : subject === null
+      ? translate(
+          'components.native-chat.ask.awaitingUnnamed',
+          NATIVE_CHAT_ASK_ROW_COPY.awaitingUnnamed
+        )
+      : translate('components.native-chat.ask.awaiting', NATIVE_CHAT_ASK_ROW_COPY.awaiting)
   const text =
     subject === null
       ? null
@@ -34,20 +89,72 @@ export function NativeChatAwaitingInputRow({
         : translate(
             'components.native-chat.ask.questionCount',
             NATIVE_CHAT_ASK_ROW_COPY.questionCount,
-            { value0: subject.count }
+            { value0: subject.questions.length }
           )
-
-  return (
-    <div
-      className="flex min-h-6 w-full items-center gap-1.5 py-0.5 text-sm leading-relaxed text-muted-foreground"
-      data-native-chat-ask-row={pending ? 'awaiting' : 'asked'}
-      aria-live={pending ? 'polite' : undefined}
-    >
+  const header = (
+    <>
       <NativeChatToolRunIcon iconName="message-square-more" className="text-muted-foreground" />
       <span className={cn('shrink-0', pending && 'animate-pulse motion-reduce:animate-none')}>
         {label}
       </span>
-      <span className="min-w-0 truncate text-foreground/85">{text}</span>
+      {question !== null && toggles && open ? null : (
+        <span
+          ref={question === null ? undefined : measureLine}
+          className="min-w-0 truncate text-foreground/85"
+        >
+          {text}
+        </span>
+      )}
+      {toggles ? (
+        <ChevronRight
+          aria-hidden
+          className={cn(
+            'size-3.5 shrink-0 text-muted-foreground transition-all',
+            open
+              ? 'rotate-90'
+              : 'can-hover:opacity-0 group-hover/ask-row:opacity-100 group-focus-visible/ask-row:opacity-100'
+          )}
+        />
+      ) : null}
+    </>
+  )
+
+  return (
+    <div
+      data-native-chat-ask-row={pending ? 'awaiting' : 'asked'}
+      aria-live={pending ? 'polite' : undefined}
+    >
+      {toggles ? (
+        <button
+          type="button"
+          onClick={() => setOpen(!open)}
+          className={cn(
+            ROW_CLASS_NAME,
+            'group/ask-row rounded-md focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring/70'
+          )}
+          aria-expanded={open}
+        >
+          {header}
+        </button>
+      ) : (
+        <div className={ROW_CLASS_NAME}>{header}</div>
+      )}
+      {toggles && open && question !== null ? (
+        // Indented to the label, past the icon slot and its gap.
+        <p className="whitespace-pre-wrap break-words pl-5.5 text-sm leading-relaxed text-foreground/85">
+          {question}
+        </p>
+      ) : null}
+      {open && questions !== null ? (
+        // Numbers hang in the icon slot so each question starts under the label.
+        <ol className="list-decimal space-y-1 pl-5.5 text-sm leading-relaxed text-foreground/85 marker:text-muted-foreground">
+          {questions.map((entry) => (
+            <li key={entry} className="whitespace-pre-wrap break-words">
+              {entry}
+            </li>
+          ))}
+        </ol>
+      ) : null}
     </div>
   )
 }
diff --git a/src/renderer/src/components/native-chat/NativeChatBackgroundTasksStatus.test.tsx b/src/renderer/src/components/native-chat/NativeChatBackgroundTasksStatus.test.tsx
index 365be31cc47..e37bfa0f9da 100644
--- a/src/renderer/src/components/native-chat/NativeChatBackgroundTasksStatus.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatBackgroundTasksStatus.test.tsx
@@ -335,3 +335,47 @@ it('stops elapsed renders in a hidden pane and catches up on reveal', () => {
   unmount()
   expect(vi.getTimerCount()).toBe(0)
 })
+
+it('lets the 1 Hz tick sleep while every row has settled, with each run frozen', () => {
+  vi.useFakeTimers()
+  vi.setSystemTime(1_000_000)
+  const committed = vi.fn()
+  const finished = (id: string, firstObservedAt: number, settledAt: number) => ({
+    id,
+    providerId: `task-${id}`,
+    kind: 'agent' as const,
+    description: `child ${id}`,
+    state: 'done' as const,
+    membership: 'settled' as const,
+    outcome: 'succeeded' as const,
+    firstObservedAt,
+    observedAt: settledAt,
+    settledAt,
+    stoppable: false,
+    invocation: { invocationId: `spawn-${id}`, generation: 1 }
+  })
+  render(
+    <Profiler id="strip" onRender={committed}>
+      <NativeChatBackgroundTasksStatus
+        expanded
+        onExpandedChange={() => {}}
+        isVisible
+        tasks={[]}
+        settledTasks={[]}
+        childViews={[finished('a', 400_000, 520_000), finished('b', 700_000, 760_000)]}
+        indicatorActive
+        supportsTaskStop
+        supportsStopAll
+        stoppingTaskIds={new Set()}
+        stoppingAll={false}
+        onStop={() => {}}
+      />
+    </Profiler>
+  )
+  const rows = screen.getAllByRole('listitem').map((row) => row.textContent)
+  expect(rows).toEqual(['child a · Agent2m 0s', 'child b · Agent1m 0s'])
+  committed.mockClear()
+  act(() => vi.advanceTimersByTime(5_000))
+  expect(committed).not.toHaveBeenCalled()
+  expect(vi.getTimerCount()).toBe(0)
+})
diff --git a/src/renderer/src/components/native-chat/NativeChatBackgroundTasksStatus.tsx b/src/renderer/src/components/native-chat/NativeChatBackgroundTasksStatus.tsx
index 2e8cf51f18f..a0ff61a78c8 100644
--- a/src/renderer/src/components/native-chat/NativeChatBackgroundTasksStatus.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatBackgroundTasksStatus.tsx
@@ -1,18 +1,25 @@
 import { useEffect, useId, useMemo, useRef, useState } from 'react'
 import { Activity, Bot, ChevronDown, CircleHelp, SquareTerminal, Workflow } from 'lucide-react'
 import type { AgentSessionBackgroundTask } from '../../../../shared/agent-session-wire'
-import { AgentStateDot } from '@/components/AgentStateDot'
+import type {
+  AgentChildRowContext,
+  AgentChildRowModel
+} from '../../../../shared/agent-child-row-model'
+import type { AgentChildWorkView } from '../../../../shared/agent-status-child-work-view'
+import { AgentChildRowContent } from '@/components/AgentChildRowContent'
+import { agentChildRowName } from '@/components/agent-child-row-text'
 import { Button } from '@/components/ui/button'
 import { useNow } from '@/hooks/use-now'
 import { translate } from '@/i18n/i18n'
 import { backgroundTasksHeaderContent } from './background-task-header-content'
 import {
-  backgroundTaskElapsedLabel,
   backgroundTaskGroupLabel,
-  backgroundTaskStateReason,
+  backgroundTaskRowElapsedLabel,
+  backgroundTaskRowTicks,
   buildBackgroundTaskGroups,
+  buildBackgroundTaskGroupsFromViews,
   formatBackgroundTaskTokens,
-  type BackgroundRosterTask
+  type BackgroundTaskGroup
 } from './background-task-roster'
 
 /** Below this strip width (border-box, live root font size) the header drops
@@ -64,78 +71,95 @@ function kindIconTone(kind: AgentSessionBackgroundTask['kind'], dimmed: boolean)
   return dimmed ? `${tone}/40` : tone
 }
 
-/** Absent means stoppable: a host predating the field published only rows its
- *  stop could act on, so reading absence as "not stoppable" would hide a
- *  working control. Only an explicit `false` withholds the button — Claude
- *  marks its in-turn foreground rows that way, and a Stop on one of those
- *  resolves to an empty target list and silently reports nothing cancelled. */
-function backgroundTaskStoppable(task: AgentSessionBackgroundTask): boolean {
-  return task.stoppable !== false
-}
-
 function BackgroundTaskRow(props: {
-  entry: BackgroundRosterTask
+  row: AgentChildRowModel
   now: number
   supportsTaskStop: boolean
-  stopping: boolean
+  stoppingTaskIds: ReadonlySet<string>
   onStop: (taskId: string) => void
 }): React.JSX.Element {
-  const { entry, now } = props
-  const Icon = KIND_ICONS[entry.task.kind]
-  // Every attention state states its reason on the row, the same ones the collapsed
-  // header names; `unverifiable` ("no contact") must never be silently dropped.
-  const reason = backgroundTaskStateReason(entry.state)
-  // Settled rows keep their final usage but no elapsed — a still-growing clock
-  // on finished work would lie.
+  const { row, now } = props
+  const Icon = KIND_ICONS[row.kind]
   const meta = [
-    entry.task.totalTokens !== undefined
-      ? formatBackgroundTaskTokens(entry.task.totalTokens)
-      : null,
-    entry.settled ? null : backgroundTaskElapsedLabel(entry.task, now)
+    row.totalTokens !== undefined ? formatBackgroundTaskTokens(row.totalTokens) : null,
+    backgroundTaskRowElapsedLabel(row, now)
   ]
     .filter((part): part is string => part !== null)
     .join(' · ')
+  // Only an explicit `false` withholds the button: a Stop on a row the host cannot target
+  // resolves to an empty list and silently reports nothing cancelled.
+  const stopId =
+    !row.settled && props.supportsTaskStop && row.canStop ? (row.providerId ?? null) : null
   return (
-    <li className="flex h-6 min-w-0 items-center gap-2 text-foreground/80">
-      <Icon
-        aria-hidden="true"
-        className={`size-3.5 shrink-0 ${kindIconTone(entry.task.kind, false)}`}
-      />
-      <AgentStateDot state={entry.state} size="sm" title={null} />
-      <span className="min-w-0 flex-1 truncate">
-        <span className="font-medium text-foreground">{entry.name}</span>
-        {reason ? <span className="text-muted-foreground"> · {reason}</span> : null}
-      </span>
-      {meta ? (
-        <span className="shrink-0 font-mono text-[10px] tabular-nums text-muted-foreground">
-          {meta}
-        </span>
+    <>
+      <li className="flex h-6 min-w-0 items-center gap-2 text-foreground/80">
+        <Icon aria-hidden="true" className={`size-3.5 shrink-0 ${kindIconTone(row.kind, false)}`} />
+        {/* Every attention state states its reason on the row; `unverifiable` is never dropped. */}
+        <AgentChildRowContent
+          row={row}
+          now={now}
+          leadClassName="font-medium text-foreground"
+          trailClassName="text-muted-foreground"
+          separator=" · "
+          dotTitle={null}
+        />
+        {meta ? (
+          <span className="shrink-0 font-mono text-[10px] tabular-nums text-muted-foreground">
+            {meta}
+          </span>
+        ) : null}
+        {stopId !== null ? (
+          <Button
+            type="button"
+            variant="ghost"
+            size="xs"
+            aria-label={translate(
+              'components.native-chat.backgroundTasks.stopTask',
+              'Stop {{value0}}',
+              {
+                value0: agentChildRowName(row)
+              }
+            )}
+            disabled={props.stoppingTaskIds.has(stopId)}
+            onClick={() => props.onStop(stopId)}
+          >
+            {translate('components.native-chat.backgroundTasks.stop', 'Stop')}
+          </Button>
+        ) : null}
+      </li>
+      {row.owned.length > 0 ? (
+        // Work a child owns (its shell, a nested agent) reads beneath it, not in its kind's group.
+        <li>
+          <ul role="list" className="ml-5 space-y-0.5">
+            {row.owned.map((owned) => (
+              <BackgroundTaskRow
+                key={owned.id}
+                row={owned}
+                now={now}
+                supportsTaskStop={props.supportsTaskStop}
+                stoppingTaskIds={props.stoppingTaskIds}
+                onStop={props.onStop}
+              />
+            ))}
+          </ul>
+        </li>
       ) : null}
-      {!entry.settled && props.supportsTaskStop && backgroundTaskStoppable(entry.task) ? (
-        <Button
-          type="button"
-          variant="ghost"
-          size="xs"
-          aria-label={translate(
-            'components.native-chat.backgroundTasks.stopTask',
-            'Stop {{value0}}',
-            {
-              value0: entry.name
-            }
-          )}
-          disabled={props.stopping}
-          onClick={() => props.onStop(entry.task.id)}
-        >
-          {translate('components.native-chat.backgroundTasks.stop', 'Stop')}
-        </Button>
-      ) : null}
-    </li>
+    </>
   )
 }
 
+function rowsTick(rows: readonly AgentChildRowModel[]): boolean {
+  return rows.some((row) => backgroundTaskRowTicks(row) || rowsTick(row.owned))
+}
+
 export function NativeChatBackgroundTasksStatus(props: {
   tasks: readonly AgentSessionBackgroundTask[]
   settledTasks: readonly AgentSessionBackgroundTask[]
+  /** The host's child views, when it publishes them; rows then read these instead of the tasks. */
+  childViews?: readonly AgentChildWorkView[]
+  /** The session's parent-row context for those views, the one its sidebar rows read; without
+   *  it every live claim stands as reported. */
+  childRowContext?: AgentChildRowContext
   supportsTaskStop: boolean
   /** False when the provider exposes no honest stop at all; the fallback
    *  control is hidden rather than offering a button that cannot act. */
@@ -160,16 +184,18 @@ export function NativeChatBackgroundTasksStatus(props: {
   const stripRef = useRef<HTMLDivElement>(null)
   const narrow = useNarrowStrip(stripRef)
   // The 1 Hz elapsed tick must not re-group, re-sort and re-translate the whole roster.
-  const groups = useMemo(
-    () => buildBackgroundTaskGroups(props.tasks, props.settledTasks),
-    [props.tasks, props.settledTasks]
+  const groups: BackgroundTaskGroup[] = useMemo(
+    () =>
+      props.childViews !== undefined
+        ? buildBackgroundTaskGroupsFromViews(props.childViews, props.childRowContext)
+        : buildBackgroundTaskGroups(props.tasks, props.settledTasks),
+    [props.childViews, props.childRowContext, props.tasks, props.settledTasks]
   )
   const singleLiveCommand =
     groups.length === 1 && groups[0].kind === 'command' && groups[0].tasks.length === 1
-  const hasElapsed = groups.some((group) =>
-    group.tasks.some((entry) => !entry.settled && (entry.task.startedAt ?? 0) > 0)
-  )
-  const now = useNow(1_000, props.isVisible && hasElapsed && (expanded || singleLiveCommand))
+  // Settled rows are frozen, so a strip of only finished work never wakes the 1 Hz tick.
+  const ticks = groups.some((group) => rowsTick(group.tasks.map((entry) => entry.row)))
+  const now = useNow(1_000, props.isVisible && ticks && (expanded || singleLiveCommand))
   const header = backgroundTasksHeaderContent(groups, { narrow, now })
   const headerText = `${header.segments.map((segment) => segment.text).join(' · ')}${header.detail ? `${header.segments.length > 0 ? ' — ' : ''}${header.detail}` : ''}`
   return (
@@ -178,10 +204,10 @@ export function NativeChatBackgroundTasksStatus(props: {
       className="group/tasks shrink-0 bg-background px-3 pt-2 sm:px-4"
     >
       {/* When the goal tab is the next sibling, take its width and share its top edge. */}
-      <div className="mx-auto w-full max-w-4xl group-has-[+[data-native-chat-thread-goal]]/tasks:px-2">
+      <div className="mx-auto w-full max-w-4xl [[data-native-chat-background-tasks]:has(+[data-native-chat-thread-goal])_&]:px-2">
         <div
           ref={stripRef}
-          className="overflow-hidden rounded-lg border border-border bg-muted/50 text-xs text-muted-foreground shadow-xs group-has-[+[data-native-chat-thread-goal]]/tasks:rounded-b-none group-has-[+[data-native-chat-thread-goal]]/tasks:shadow-none"
+          className="overflow-hidden rounded-lg border border-border bg-muted/50 text-xs text-muted-foreground shadow-xs [[data-native-chat-background-tasks]:has(+[data-native-chat-thread-goal])_&]:rounded-b-none [[data-native-chat-background-tasks]:has(+[data-native-chat-thread-goal])_&]:shadow-none"
         >
           <div className="flex h-8 items-center px-1.5">
             <button
@@ -250,11 +276,11 @@ export function NativeChatBackgroundTasksStatus(props: {
                     >
                       {group.tasks.map((entry) => (
                         <BackgroundTaskRow
-                          key={entry.task.id}
-                          entry={entry}
+                          key={entry.row.id}
+                          row={entry.row}
                           now={now}
                           supportsTaskStop={props.supportsTaskStop}
-                          stopping={props.stoppingTaskIds.has(entry.task.id)}
+                          stoppingTaskIds={props.stoppingTaskIds}
                           onStop={props.onStop}
                         />
                       ))}
diff --git a/src/renderer/src/components/native-chat/NativeChatCodeBlock.tsx b/src/renderer/src/components/native-chat/NativeChatCodeBlock.tsx
index 7965668d2dc..0e7d106c85d 100644
--- a/src/renderer/src/components/native-chat/NativeChatCodeBlock.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatCodeBlock.tsx
@@ -47,7 +47,7 @@ export function NativeChatCodeBlock({
         <NativeChatCopyButton
           text={code}
           label={translate('components.native-chat.copyCode', 'Copy code')}
-          className="absolute right-2 top-2 opacity-100 transition-opacity can-hover:pointer-events-none can-hover:opacity-0 group-hover/code:pointer-events-auto group-hover/code:opacity-100 group-has-[:focus-visible]/code:pointer-events-auto group-has-[:focus-visible]/code:opacity-100"
+          className="absolute right-2 top-2 opacity-100 transition-opacity can-hover:pointer-events-none can-hover:opacity-0 group-hover/code:pointer-events-auto group-hover/code:opacity-100 [[class~='group/code']:has(:focus-visible)_&]:pointer-events-auto [[class~='group/code']:has(:focus-visible)_&]:opacity-100"
         />
       ) : null}
     </div>
diff --git a/src/renderer/src/components/native-chat/NativeChatComposer.test.tsx b/src/renderer/src/components/native-chat/NativeChatComposer.test.tsx
index 8eb4c9b7469..bf0cdd4bc6c 100644
--- a/src/renderer/src/components/native-chat/NativeChatComposer.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatComposer.test.tsx
@@ -100,7 +100,7 @@ vi.mock('@/lib/native-chat-telemetry', () => ({
 vi.mock('./use-native-chat-draft', () => ({
   useNativeChatDraft: (scopeKey: string) => {
     mocks.draftScopeKeys.push(scopeKey)
-    return { draft: mocks.draft, setDraft: mocks.setDraft }
+    return { draft: mocks.draft, setDraft: mocks.setDraft, flushDraftAppends: () => {} }
   }
 }))
 vi.mock('./native-chat-draft-cache', () => ({
diff --git a/src/renderer/src/components/native-chat/NativeChatComposer.tsx b/src/renderer/src/components/native-chat/NativeChatComposer.tsx
index 60735d705e2..922ddfd20cd 100644
--- a/src/renderer/src/components/native-chat/NativeChatComposer.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatComposer.tsx
@@ -74,7 +74,11 @@ const NativeChatComposerPane = forwardRef<NativeChatComposerHandle, NativeChatCo
     // images survive both TUI/GUI toggles and PTY replacement on reconnect.
     // Why: local, SSH, and runtime reconnects can replace or temporarily clear
     // the PTY id. Pane identity is the stable ownership key for unsent input.
-    const { draft, setDraft } = useNativeChatDraft(paneKey)
+    const imeEnterGesture = useImeEnterGestureOwnership()
+    const { draft, setDraft, flushDraftAppends } = useNativeChatDraft(
+      paneKey,
+      imeEnterGesture.isComposing
+    )
     const [caret, setCaret] = useState(draft.length)
     useNativeChatLaunchDraftAdoption({
       terminalTabId,
@@ -90,7 +94,6 @@ const NativeChatComposerPane = forwardRef<NativeChatComposerHandle, NativeChatCo
     const [activeSuggestion, setActiveSuggestion] = useState(0)
     const [notice, setNotice] = useState<string | null>(null)
     const [dictationPressed, setDictationPressed] = useState(false)
-    const imeEnterGesture = useImeEnterGestureOwnership()
     const { textareaRef } = useNativeChatComposerAppMenuSelection(imeEnterGesture.isComposing)
     const { cancelPendingSends, trackPendingSend } = useNativeChatSendLifecycle(
       terminalTabId,
@@ -386,6 +389,7 @@ const NativeChatComposerPane = forwardRef<NativeChatComposerHandle, NativeChatCo
           if (element.value !== draft) {
             handleDraftChange(element.value, element)
           }
+          flushDraftAppends()
           attachments.flushPendingAttachments()
         }}
         onPaste={handlePaste}
diff --git a/src/renderer/src/components/native-chat/NativeChatDeliveryRetry.tsx b/src/renderer/src/components/native-chat/NativeChatDeliveryRetry.tsx
deleted file mode 100644
index 5958e2a8d54..00000000000
--- a/src/renderer/src/components/native-chat/NativeChatDeliveryRetry.tsx
+++ /dev/null
@@ -1,49 +0,0 @@
-import { RotateCcw } from 'lucide-react'
-import {
-  admitStructuredAgentSessionOutboxEntry,
-  type StructuredAgentSessionOutboxEntry
-} from '../../../../shared/structured-agent-session-outbox'
-import { Button } from '@/components/ui/button'
-import { translate } from '@/i18n/i18n'
-
-export function NativeChatDeliveryRetry({
-  outbox,
-  blockedClientMessageId,
-  retry
-}: {
-  outbox: readonly StructuredAgentSessionOutboxEntry[]
-  blockedClientMessageId: string | null
-  retry: (clientMessageId: string) => void
-}): React.JSX.Element | null {
-  // Why: read through the drain's own rule, so Retry can never name an entry other than the one
-  // the queue actually stopped on -- which is no longer always the head.
-  const admission = admitStructuredAgentSessionOutboxEntry(outbox, blockedClientMessageId)
-  const retryable = admission.state === 'blocked' ? admission.entry : null
-  if (!retryable) {
-    return null
-  }
-  return (
-    <div className="mx-auto flex w-full max-w-4xl items-center justify-between gap-3 px-4 py-1 text-xs text-muted-foreground">
-      <span>
-        {retryable.state === 'unconfirmed'
-          ? translate(
-              'auto.components.native.chat.NativeChatStructuredSession.1f772bb5d0',
-              'Message delivery is unconfirmed.'
-            )
-          : translate(
-              'auto.components.native.chat.NativeChatStructuredSession.93ef441197',
-              'Message was not sent.'
-            )}
-      </span>
-      <Button
-        type="button"
-        variant="ghost"
-        size="xs"
-        onClick={() => retry(retryable.clientMessageId)}
-      >
-        <RotateCcw className="size-3" />
-        {translate('auto.components.native.chat.NativeChatStructuredSession.a5e7f14068', 'Retry')}
-      </Button>
-    </div>
-  )
-}
diff --git a/src/renderer/src/components/native-chat/NativeChatEmptyState.test.tsx b/src/renderer/src/components/native-chat/NativeChatEmptyState.test.tsx
new file mode 100644
index 00000000000..dccfaba728c
--- /dev/null
+++ b/src/renderer/src/components/native-chat/NativeChatEmptyState.test.tsx
@@ -0,0 +1,56 @@
+// @vitest-environment happy-dom
+
+import '@testing-library/jest-dom/vitest'
+
+import { cleanup, render, screen } from '@testing-library/react'
+import { afterEach, expect, it } from 'vitest'
+import { NativeChatEmptyState } from './NativeChatEmptyState'
+
+afterEach(cleanup)
+
+it('keeps pointing the terminal-backed chat back to its terminal when a read fails', () => {
+  render(<NativeChatEmptyState kind="error" />)
+  expect(
+    screen.getByText(
+      'The transcript could not be read. Toggle back to the terminal to keep working.'
+    )
+  ).toBeInTheDocument()
+})
+
+it('tells the structured chat its read keeps retrying', () => {
+  render(<NativeChatEmptyState kind="error" retrying />)
+  expect(
+    screen.getByText('The transcript could not be read. Orca keeps trying to load it.')
+  ).toBeInTheDocument()
+})
+
+it('shows the host message in place of the terminal-backed default', () => {
+  render(<NativeChatEmptyState kind="error" message="disk full" />)
+  expect(screen.getByText('disk full')).toBeInTheDocument()
+  expect(screen.queryByText(/Toggle back to the terminal/)).toBeNull()
+})
+
+// The structured chat passes words only from the notice table, never the host's.
+it("says the structured chat's own words for the failure once, as the title, above its retrying line", () => {
+  render(
+    <NativeChatEmptyState
+      kind="error"
+      retrying
+      headline="Orca couldn't open this chat's history right now."
+    />
+  )
+  expect(screen.getByText("Orca couldn't open this chat's history right now.")).toHaveClass(
+    'font-medium'
+  )
+  expect(screen.queryByText('Could not load conversation')).toBeNull()
+  expect(
+    screen.getByText('The transcript could not be read. Orca keeps trying to load it.')
+  ).toBeInTheDocument()
+})
+
+it('says a failure no retry gets past in its one line, with nothing of trying again', () => {
+  render(<NativeChatEmptyState kind="error" headline="Unable to load this chat." />)
+  expect(screen.getByText('Unable to load this chat.')).toHaveClass('font-medium')
+  expect(screen.queryByText('Could not load conversation')).toBeNull()
+  expect(screen.queryByText(/keeps trying|Toggle back/)).toBeNull()
+})
diff --git a/src/renderer/src/components/native-chat/NativeChatEmptyState.tsx b/src/renderer/src/components/native-chat/NativeChatEmptyState.tsx
index f7c20ef51f4..ec84f554cd7 100644
--- a/src/renderer/src/components/native-chat/NativeChatEmptyState.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatEmptyState.tsx
@@ -7,13 +7,20 @@ import type { NativeChatSession } from '../../../../shared/native-chat-types'
 export function NativeChatEmptyState({
   kind,
   message,
-  agent
+  headline,
+  agent,
+  retrying = false
 }: {
   kind: 'loading' | 'empty' | 'error' | 'not-agent'
   message?: string
+  /** The chat's own sentence for the failure, said once: it takes the generic title's place. */
+  headline?: string
   agent?: NativeChatSession['agent']
+  /** The read retries on its own (structured chat), so the error says so instead of pointing
+   *  back to the terminal. */
+  retrying?: boolean
 }): React.JSX.Element {
-  const copy = emptyStateCopy(kind, message, agent)
+  const copy = emptyStateCopy(kind, { message, headline }, agent, retrying)
   return (
     <div className="flex h-full w-full flex-col items-center justify-center gap-3 p-6 text-center">
       <div
@@ -39,8 +46,9 @@ export function NativeChatEmptyState({
 
 function emptyStateCopy(
   kind: 'loading' | 'empty' | 'error' | 'not-agent',
-  message?: string,
-  agent?: NativeChatSession['agent']
+  words: { message?: string; headline?: string },
+  agent?: NativeChatSession['agent'],
+  retrying = false
 ): { title: string; subtitle: string | null } {
   switch (kind) {
     case 'loading':
@@ -54,19 +62,30 @@ function emptyStateCopy(
           NATIVE_CHAT_EMPTY_STATE_COPY.loading.subtitle
         )
       }
-    case 'error':
+    case 'error': {
+      const retryingLine = retrying
+        ? translate(
+            'components.native-chat.state.error.retryingSubtitle',
+            NATIVE_CHAT_EMPTY_STATE_COPY.retryingError.subtitle
+          )
+        : null
+      if (words.headline) {
+        return { title: words.headline, subtitle: retryingLine }
+      }
       return {
         title: translate(
           'components.native-chat.state.error.title',
           NATIVE_CHAT_EMPTY_STATE_COPY.error.title
         ),
         subtitle:
-          message ??
+          retryingLine ??
+          words.message ??
           translate(
             'components.native-chat.state.error.subtitle',
             NATIVE_CHAT_EMPTY_STATE_COPY.error.subtitle
           )
       }
+    }
     case 'not-agent':
       return {
         title: translate(
diff --git a/src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx b/src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx
index cd08f779e71..303ab2472c7 100644
--- a/src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx
@@ -33,6 +33,7 @@ vi.mock('../../store', () => ({
 }))
 
 import { NativeChatInteractiveCard } from './NativeChatInteractiveCard'
+import { useNativeChatInteractivePromptCard } from './use-native-chat-interactive-prompt-card'
 
 const mocks = {
   sendAnswer: vi.fn<NativeChatInteractiveSend['sendAnswer']>(),
@@ -45,6 +46,8 @@ function renderCard(canSend = true): ReturnType<typeof render> {
   return render(cardElement(canSend))
 }
 
+const NO_MESSAGES: readonly NativeChatMessage[] = []
+
 function cardElement(
   canSend = true,
   messages?: readonly NativeChatMessage[],
@@ -52,11 +55,36 @@ function cardElement(
   transcriptSettled = true
 ): React.JSX.Element {
   return (
-    <NativeChatInteractiveCard
-      paneKey="tab-1:leaf-1"
+    <CardHarness
       canSend={canSend}
       messages={messages}
+      onShowingQuestionChange={onShowingQuestionChange}
       transcriptSettled={transcriptSettled}
+    />
+  )
+}
+
+// The view derives the card and hands it over; this stands in for that view.
+function CardHarness({
+  canSend,
+  messages,
+  onShowingQuestionChange,
+  transcriptSettled
+}: {
+  canSend: boolean
+  messages?: readonly NativeChatMessage[]
+  onShowingQuestionChange?: (showing: boolean) => void
+  transcriptSettled: boolean
+}): React.JSX.Element | null {
+  const card = useNativeChatInteractivePromptCard({
+    paneKey: 'tab-1:leaf-1',
+    messages: messages ?? NO_MESSAGES,
+    transcriptSettled: transcriptSettled && messages !== undefined
+  })
+  return (
+    <NativeChatInteractiveCard
+      card={card}
+      canSend={canSend}
       onShowingQuestionChange={onShowingQuestionChange}
       send={{
         sendAnswer: mocks.sendAnswer,
diff --git a/src/renderer/src/components/native-chat/NativeChatInteractiveCard.tsx b/src/renderer/src/components/native-chat/NativeChatInteractiveCard.tsx
index 0b3e110c0d5..9d57a6ab5e1 100644
--- a/src/renderer/src/components/native-chat/NativeChatInteractiveCard.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatInteractiveCard.tsx
@@ -1,19 +1,16 @@
 import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react'
-import { useAppStore } from '../../store'
-import { resolveNativeChatAsk } from '../../../../shared/native-chat-ask'
-import type { NativeChatMessage } from '../../../../shared/native-chat-types'
-import { parseInteractivePrompt } from './native-chat-interactive-prompt'
+import type { InteractivePromptCard } from './native-chat-interactive-prompt'
 import { nativeChatCardDismissKey } from './native-chat-dismiss-key'
 import { NativeChatQuestionCard } from './NativeChatQuestionCard'
 import { NativeChatApprovalCard } from './NativeChatApprovalCard'
 import type { NativeChatInteractiveSend } from './use-native-chat-interactive-send'
 
 /**
- * Render the live interactive card for the pane while the agent's
- * `interactivePrompt` is present: a question wizard (precedence) or a tool
- * approval. Cleared by the host once the agent moves on, so it disappears
- * automatically. Sends through the composer's verified runtime path (R8/R6):
- * answers via agent-specific paste or selector keystrokes; cancel/deny as ESC.
+ * Render the pane's interactive card (see useNativeChatInteractivePromptCard): a
+ * question wizard or a tool approval. Cleared by the host once the agent moves
+ * on, so it disappears automatically. Sends through the composer's verified
+ * runtime path (R8/R6): answers via agent-specific paste or selector
+ * keystrokes; cancel/deny as ESC.
  * Guarded by `canSend` so a mobile presence-lock blocks desktop sends too.
  *
  * Dismiss-on-answer (mobile parity): the live status lingers after answering —
@@ -21,29 +18,17 @@ import type { NativeChatInteractiveSend } from './use-native-chat-interactive-se
  * answered prompt by content key and hide the card until a genuinely different
  * prompt arrives. The dismissal resets once the prompt clears, so a later
  * (even identical) prompt shows again instead of staying hidden.
- *
- * The transcript is the second source (mobile parity again): a question that the
- * live status never delivered — headless host, relay gap, replay, reconnect —
- * still has its unresolved tool call in the messages we already parsed. Without
- * it the composer stays mounted over a pane parked on a selector, and the next
- * send commits the highlighted option instead of the typed message (#11761).
  */
 export function NativeChatInteractiveCard({
-  paneKey,
+  card,
   send,
   canSend,
-  messages,
-  transcriptSettled,
   onShowingQuestionChange,
   answerInputRef
 }: {
-  paneKey: string
+  card: InteractivePromptCard
   send: NativeChatInteractiveSend
   canSend: boolean
-  /** Transcript to fall back on when live status carries no prompt. Pass the
-   *  command-boundary-trimmed messages so an ask abandoned via `/clear` stays gone. */
-  messages?: readonly NativeChatMessage[]
-  transcriptSettled: boolean
   /** Reports whether a question card is on screen so the view can replace the
    *  composer with it (the card's free-text row is the answer input). */
   onShowingQuestionChange?: (showing: boolean) => void
@@ -51,26 +36,7 @@ export function NativeChatInteractiveCard({
    *  a target while the composer is unmounted. */
   answerInputRef?: React.RefObject<HTMLInputElement | null>
 }): React.JSX.Element | null {
-  const interactivePrompt = useAppStore(
-    (s) => s.agentStatusByPaneKey[paneKey]?.interactivePrompt ?? null
-  )
-  // Thread the sibling `toolName` from the same status entry so the question
-  // parser can dispatch through the tool's registered parser (mobile parity).
-  const interactiveToolName = useAppStore((s) => s.agentStatusByPaneKey[paneKey]?.toolName ?? null)
   const { sendAnswer, sendRaw, cancelPending, cancel } = send
-
-  const card = useMemo(() => {
-    const statusCard = parseInteractivePrompt(interactivePrompt, interactiveToolName ?? undefined)
-    if (statusCard?.kind === 'approval') {
-      return statusCard
-    }
-    const prompt = resolveNativeChatAsk({
-      liveAsk: statusCard?.prompt ?? null,
-      messages: messages ?? [],
-      transcriptSettled: transcriptSettled && messages != null
-    })
-    return prompt ? { kind: 'question' as const, prompt } : null
-  }, [interactivePrompt, interactiveToolName, messages, transcriptSettled])
   const cardKey = useMemo(() => nativeChatCardDismissKey(card), [card])
   const [dismissedKey, setDismissedKey] = useState<string | null>(null)
   // A question answer is a paced multi-step write (body→Enter per question); keep
diff --git a/src/renderer/src/components/native-chat/NativeChatLaunchRetry.tsx b/src/renderer/src/components/native-chat/NativeChatLaunchRetry.tsx
index 1a4204a326f..b186bbc4e34 100644
--- a/src/renderer/src/components/native-chat/NativeChatLaunchRetry.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatLaunchRetry.tsx
@@ -2,14 +2,21 @@ import { RotateCcw } from 'lucide-react'
 import { Button } from '@/components/ui/button'
 import { translate } from '@/i18n/i18n'
 import type { StructuredAgentSessionLaunchLifecycle } from '@/lib/structured-agent-session-launch'
+import { agentSessionRefusalCauseParts } from '../../../../shared/agent-session-refusal-notice'
+import type { AgentSessionWriteRefusal } from '../../../../shared/agent-session-write-failure'
+import { agentSessionWriteNoticeText } from './agent-session-write-notice-text'
 
 export function NativeChatLaunchRetry({
   lifecycle,
-  failureReason = null,
+  failure = null,
+  agentLabel,
   onRetry
 }: {
   lifecycle: StructuredAgentSessionLaunchLifecycle | null
-  failureReason?: string | null
+  /** Names the agent in a start failure's words. */
+  agentLabel?: string
+  /** The host's refusal behind the failed start; its message is never shown. */
+  failure?: AgentSessionWriteRefusal | null
   onRetry: () => void
 }): React.JSX.Element | null {
   if (lifecycle !== 'failed' && lifecycle !== 'visibility-unknown') {
@@ -25,11 +32,17 @@ export function NativeChatLaunchRetry({
           'auto.components.native.chat.NativeChatLaunchRetry.unknown',
           'Chat connection could not be confirmed.'
         )
+  const cause =
+    lifecycle === 'failed' && failure
+      ? agentSessionWriteNoticeText(
+          agentSessionRefusalCauseParts(failure, agentLabel ? { agentName: agentLabel } : {})
+        )
+      : ''
   return (
     <div className="mx-auto flex w-full max-w-4xl items-center justify-between gap-3 px-4 py-1 text-xs text-destructive">
       <span className="min-w-0 break-words">
         {message}
-        {lifecycle === 'failed' && failureReason ? ` ${failureReason}` : null}
+        {cause ? ` ${cause}` : null}
       </span>
       <Button type="button" variant="ghost" size="xs" onClick={onRetry}>
         <RotateCcw className="size-3" />
diff --git a/src/renderer/src/components/native-chat/NativeChatMessageList.queued-turn-order.test.tsx b/src/renderer/src/components/native-chat/NativeChatMessageList.queued-turn-order.test.tsx
new file mode 100644
index 00000000000..d1da02b713c
--- /dev/null
+++ b/src/renderer/src/components/native-chat/NativeChatMessageList.queued-turn-order.test.tsx
@@ -0,0 +1,180 @@
+// @vitest-environment happy-dom
+
+import '@testing-library/jest-dom/vitest'
+
+import { cleanup, render, screen } from '@testing-library/react'
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalRenderItem,
+  AgentJournalTurnScope
+} from '../../../../shared/agent-session-journal-types'
+import type { NativeChatMessage } from '../../../../shared/native-chat-types'
+import type { NativeChatLiveSession } from './use-native-chat-live-session'
+import { NativeChatMessageList } from './NativeChatMessageList'
+import { installNativeChatMessageListTestViewport } from './native-chat-message-list-test-viewport'
+
+let restoreViewport = (): void => {}
+beforeAll(() => {
+  restoreViewport = installNativeChatMessageListTestViewport()
+})
+afterAll(() => restoreViewport())
+afterEach(cleanup)
+
+const text = (
+  id: string,
+  role: NativeChatMessage['role'],
+  body: string,
+  timestamp: number
+): NativeChatMessage => ({
+  id,
+  role,
+  blocks: [{ type: 'text', text: body }],
+  timestamp,
+  source: 'transcript'
+})
+const toolRun = (id: string, timestamp: number): NativeChatMessage => ({
+  id,
+  role: 'assistant',
+  blocks: [{ type: 'tool-call', name: 'Bash', input: { command: 'sleep 5' }, state: 'completed' }],
+  timestamp,
+  source: 'transcript'
+})
+
+// Claude runs A; B is sent mid-turn and Claude answers it after A. The journal writes B when it is
+// sent, so A's remaining tool run and its answer follow B there, and B's turn opens after them.
+const messages = [
+  text('user-a', 'user', 'Run the first job', 1),
+  toolRun('a-tool-1', 2),
+  text('user-b', 'user', 'Then run the second job', 3),
+  toolRun('a-tool-2', 4),
+  text('a-answer', 'assistant', 'FIRST DONE', 5),
+  text('b-answer', 'assistant', 'SECOND DONE', 6)
+]
+
+/** With `statesScope` false the rows carry no turn scope, as a host older than turn scopes writes. */
+function journal(bState: 'running' | 'completed', statesScope: boolean): AgentJournalRenderItem[] {
+  const thread: AgentJournalTurnScope = { kind: 'thread' }
+  const inTurn = (turnItemId: string): AgentJournalTurnScope => ({ kind: 'turn', turnItemId })
+  const row = (
+    itemId: string,
+    body: AgentJournalItemBody,
+    turnScope: AgentJournalTurnScope,
+    sequence: number
+  ): AgentJournalRenderItem => ({
+    itemId,
+    revision: 0,
+    sequence,
+    observedAt: sequence,
+    body,
+    ...(statesScope ? { turnScope } : {})
+  })
+  const said = (role: 'user' | 'assistant'): AgentJournalItemBody => ({
+    kind: 'message',
+    role,
+    blocks: []
+  })
+  return [
+    row('user-a', said('user'), thread, 1),
+    row(
+      'turn-a',
+      { kind: 'turn', turnId: 'turn-a', state: 'completed', userItemId: 'user-a' },
+      thread,
+      2
+    ),
+    row('a-tool-1', said('assistant'), inTurn('turn-a'), 3),
+    // Handed over while A runs, so the host scopes it to A's turn until its own opens.
+    row('user-b', said('user'), inTurn('turn-a'), 4),
+    row('a-tool-2', said('assistant'), inTurn('turn-a'), 5),
+    row('a-answer', said('assistant'), inTurn('turn-a'), 6),
+    row(
+      'turn-b',
+      { kind: 'turn', turnId: 'turn-b', state: bState, userItemId: 'user-b' },
+      thread,
+      7
+    ),
+    row('b-answer', said('assistant'), inTurn('turn-b'), 8)
+  ]
+}
+
+const session = (status: NativeChatLiveSession['status']): NativeChatLiveSession => ({
+  messages,
+  status,
+  sessionId: 'session-1',
+  agent: 'claude',
+  hasMore: false,
+  loadingEarlier: false,
+  olderHistoryGeneration: 0,
+  loadEarlier: vi.fn(),
+  readPhase: 'ready'
+})
+
+function expectInOrder(...nodes: Element[]): void {
+  for (const [index, node] of nodes.slice(1).entries()) {
+    expect(nodes[index]!.compareDocumentPosition(node)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
+  }
+}
+
+const bar = (label: string | RegExp): Element =>
+  screen.getByText(label).closest('[data-native-chat-turn-status]')!
+
+describe.each([
+  ['states each row’s turn', true],
+  ['states no scope', false]
+])(
+  'a message the provider answered after the running turn, on a host that %s',
+  (_host, statesScope) => {
+    it("draws A's remaining rows and answer under A's bar, then B's bubble and turn", () => {
+      render(
+        <NativeChatMessageList
+          session={session('working')}
+          journalItems={journal('running', statesScope)}
+          journalSubmissions={[]}
+          isWorking
+          workingStartedAt={Date.now() - 1000}
+          settledTurns={new Map([['user-a', { startedAt: 1, workedSeconds: 17 }]])}
+          expandSignal={false}
+          fontScale={1}
+        />
+      )
+
+      expectInOrder(
+        screen.getByText('Run the first job'),
+        bar('Worked for 17s'),
+        screen.getByText('FIRST DONE'),
+        screen.getByText('Then run the second job'),
+        bar(/Working for/),
+        screen.getByText('SECOND DONE')
+      )
+    })
+
+    it('keeps that order once both turns settle', () => {
+      render(
+        <NativeChatMessageList
+          session={session('ready')}
+          journalItems={journal('completed', statesScope)}
+          journalSubmissions={[]}
+          isWorking={false}
+          workingStartedAt={null}
+          settledTurns={
+            new Map([
+              ['user-a', { startedAt: 1, workedSeconds: 17 }],
+              ['user-b', { startedAt: 2, workedSeconds: 51 }]
+            ])
+          }
+          expandSignal={false}
+          fontScale={1}
+        />
+      )
+
+      expectInOrder(
+        screen.getByText('Run the first job'),
+        bar('Worked for 17s'),
+        screen.getByText('FIRST DONE'),
+        screen.getByText('Then run the second job'),
+        bar('Worked for 51s'),
+        screen.getByText('SECOND DONE')
+      )
+    })
+  }
+)
diff --git a/src/renderer/src/components/native-chat/NativeChatMessageList.task-list-frames.test.tsx b/src/renderer/src/components/native-chat/NativeChatMessageList.task-list-frames.test.tsx
index 1408342336a..82b2c43d468 100644
--- a/src/renderer/src/components/native-chat/NativeChatMessageList.task-list-frames.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatMessageList.task-list-frames.test.tsx
@@ -70,7 +70,6 @@ function transcript(messages: NativeChatMessage[], sessionId = 'live-codex') {
       isWorking={false}
       expandSignal
       fontScale={1}
-      showTurnStatus={false}
     />
   )
 }
@@ -113,6 +112,8 @@ describe('live Codex checklist frames', () => {
       role: 'assistant',
       timestamp: 1,
       source: 'transcript',
+      // Journalled like the frames it sits between.
+      journalPosition: { sequence: 1, index: 0 },
       blocks: [
         {
           type: 'tool-call',
diff --git a/src/renderer/src/components/native-chat/NativeChatMessageList.tool-stream-cost.test.tsx b/src/renderer/src/components/native-chat/NativeChatMessageList.tool-stream-cost.test.tsx
index 2a2401bea52..a77d2907b6a 100644
--- a/src/renderer/src/components/native-chat/NativeChatMessageList.tool-stream-cost.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatMessageList.tool-stream-cost.test.tsx
@@ -44,15 +44,7 @@ function Transcript({ items }: { items: AgentJournalRenderItem[] }) {
     loadEarlier,
     readPhase: 'ready'
   }
-  return (
-    <NativeChatMessageList
-      session={session}
-      isWorking
-      expandSignal
-      fontScale={1}
-      showTurnStatus={false}
-    />
-  )
+  return <NativeChatMessageList session={session} isWorking expandSignal fontScale={1} />
 }
 
 function row(index: number, body: AgentJournalRenderItem['body']): AgentJournalRenderItem {
diff --git a/src/renderer/src/components/native-chat/NativeChatMessageList.tsx b/src/renderer/src/components/native-chat/NativeChatMessageList.tsx
index 626315f73e0..6138d662974 100644
--- a/src/renderer/src/components/native-chat/NativeChatMessageList.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatMessageList.tsx
@@ -10,9 +10,8 @@ import { nativeChatTaskListPredecessors } from './native-chat-task-list-history'
 import { NativeChatTaskList } from './NativeChatTaskList'
 import { projectNativeChatTaskListFrames } from './native-chat-task-list-frames'
 import { omitNativeChatThreadGoalRows } from './native-chat-thread-goal-rows'
-import { shouldShowNativeChatTypingIndicator } from './native-chat-typing-indicator'
 import { useNativeChatTurnStatus } from './use-native-chat-turn-status'
-import { NativeChatTypingIndicatorRow } from './NativeChatTypingIndicatorRow'
+import { NativeChatAwaitingInputRow } from './NativeChatAwaitingInputRow'
 import type { RuntimeFileOperationArgs } from '@/runtime/runtime-file-client'
 import type { NativeChatTurnActivity } from '../../../../shared/native-chat-turn-activity'
 import { NativeChatTurnActivityLine } from './NativeChatTurnActivityLine'
@@ -20,13 +19,19 @@ import {
   NativeChatDisclosureContext,
   useNativeChatDisclosures
 } from './native-chat-disclosure-store'
-import { NativeChatTranscriptItems } from './NativeChatTranscriptItems'
+import {
+  NativeChatTranscriptItems,
+  NativeChatWaitingTranscriptItems
+} from './NativeChatTranscriptItems'
 import type { NativeChatTranscriptRowContext } from './NativeChatTranscriptRow'
+import type { NativeChatDeliveryNotice } from './NativeChatMessageRow'
 import {
   buildNativeChatTranscriptSlots,
+  splitNativeChatSlotsWaitingBehindLiveTurn,
   nativeChatSlotIndexOf
 } from './native-chat-transcript-slots'
 import { useNativeChatTranscriptWindow } from './use-native-chat-transcript-window'
+import { useNativeChatTurnMembership } from './use-native-chat-turn-membership'
 import { useNativeChatTranscriptScroll } from './use-native-chat-transcript-scroll'
 import { useNativeChatOlderHistoryAutoload } from './use-native-chat-older-history-autoload'
 import { NativeChatOlderHistoryRow } from './NativeChatOlderHistoryRow'
@@ -39,8 +44,12 @@ import type {
 import { useNativeChatRailHistoryJump } from './use-native-chat-rail-history-jump'
 import { nativeChatReaderScrollInputHandlers } from './native-chat-reader-scroll-input'
 
-import type { AgentJournalRenderItem } from '../../../../shared/agent-session-journal-types'
+import type {
+  AgentJournalRenderItem,
+  AgentJournalSubmission
+} from '../../../../shared/agent-session-journal-types'
 import { isStructuredAgentSessionThinking } from '../../../../shared/structured-agent-session-live-turn'
+import { nativeChatSubagentLabels } from '../../../../shared/native-chat-subagent-attribution'
 import type { NativeChatSettledTurns } from '../../../../shared/native-chat-turn-status'
 import {
   nativeChatTurnDiffs,
@@ -53,6 +62,10 @@ export { ProviderFrameRow } from './NativeChatTranscriptChrome'
 
 const MAX_EXPANDED_TURNS = 128
 
+/** The turn is blocked on the reader. `shown`: the pane draws the prompt itself, as a card;
+ *  `unshown`: it cannot (the prompt is only in the agent's terminal). */
+export type NativeChatAwaitingInput = 'shown' | 'unshown'
+
 type NativeChatNavigationRequest =
   | { kind: 'diff'; target: NativeChatDiffReveal }
   | { kind: 'rail'; messageId: string; requestId: number }
@@ -60,6 +73,7 @@ type NativeChatNavigationRequest =
 export function NativeChatMessageList({
   session,
   journalItems,
+  journalSubmissions,
   railOutline = null,
   isVisible = true,
   isWorking,
@@ -69,14 +83,15 @@ export function NativeChatMessageList({
   allowFileUriLinks = false,
   workingStartedAt,
   settledTurns,
-  failedDeliveryMessageIds,
-  showTurnStatus = true,
-  showLiveTurnActivity = true,
+  deliveryNotices,
+  awaitingInput = null,
   turnActivity,
   runtimeContext
 }: {
   session: NativeChatLiveSession
   journalItems?: readonly AgentJournalRenderItem[]
+  /** With the items, what places each row in its turn (structured lane). */
+  journalSubmissions?: readonly AgentJournalSubmission[]
   /** User messages older than the loaded window, from the host's outline. */
   railOutline?: readonly NativeChatRailOutlineEntry[] | null
   isVisible?: boolean
@@ -86,15 +101,14 @@ export function NativeChatMessageList({
   /** Chat-only text multiplier (1 = default), driven by the zoom shortcuts. */
   fontScale: number
   workingStartedAt?: number | null
-  /** Host-recorded turn durations keyed by user message id (structured lane). */
+  /** Recorded turn durations keyed by user message id (the host's, or the transcript's).
+   *  A turn missing here shows the duration this list observed, if it saw the turn run. */
   settledTurns?: NativeChatSettledTurns
   onLinkClick?: CommentMarkdownLinkClickHandler
   allowFileUriLinks?: boolean
-  failedDeliveryMessageIds?: ReadonlySet<string>
-  /** Turn timing and disclosure are available on structured agent sessions. */
-  showTurnStatus?: boolean
-  /** Whether the active turn's foreground activity row should be visible. */
-  showLiveTurnActivity?: boolean
+  deliveryNotices?: ReadonlyMap<string, NativeChatDeliveryNotice>
+  /** Set while the turn waits on the reader; the live activity line yields to it. */
+  awaitingInput?: NativeChatAwaitingInput | null
   turnActivity?: NativeChatTurnActivity | null
   runtimeContext?: RuntimeFileOperationArgs | null
 }): React.JSX.Element {
@@ -146,31 +160,19 @@ export function NativeChatMessageList({
     // Structured sessions show goal state in the banner above the composer.
     return journalItems ? omitNativeChatThreadGoalRows(projected) : projected
   }, [journalItems, projectMessages, session.messages])
+  const subagentLabels = useMemo(() => nativeChatSubagentLabels(messages), [messages])
   const taskListPredecessors = useMemo(() => nativeChatTaskListPredecessors(messages), [messages])
   const taskListState = useMemo(() => nativeChatTaskListState(messages), [messages])
-  const showTypingIndicator = showTurnStatus
-    ? isWorking
-    : shouldShowNativeChatTypingIndicator({ messages, isWorking })
-  const latestUserIndex = messages.findLastIndex((message) => message.role === 'user')
-  const currentTurnKey =
-    latestUserIndex === -1 ? undefined : (messages[latestUserIndex]?.id ?? undefined)
-  // Resolve each row's turn boundary once. Prefix slice/findLast in the render
-  // loop becomes quadratic for long transcripts.
-  const turnKeys = useMemo(() => {
-    let currentTurnKey: string | undefined
-    return messages.map((message) => {
-      if (message.role === 'user') {
-        currentTurnKey = message.id
-      }
-      return currentTurnKey
-    })
-  }, [messages])
+  // Each row's turn, which turn is live, and the order the rows draw in, resolved once.
+  const {
+    messages: rows,
+    turnKeys,
+    liveTurnKey
+  } = useNativeChatTurnMembership(messages, journalItems, journalSubmissions)
   const turnDiffs = useMemo(
     () =>
-      journalItems
-        ? nativeChatTurnDiffs(messages, turnKeys)
-        : new Map<string, NativeChatTurnDiff>(),
-    [journalItems, messages, turnKeys]
+      journalItems ? nativeChatTurnDiffs(rows, turnKeys) : new Map<string, NativeChatTurnDiff>(),
+    [journalItems, rows, turnKeys]
   )
   // "Thinking" is real reasoning content at the tail of the turn, not the absence
   // of output — the latter reports thinking while the request is merely in flight.
@@ -179,43 +181,54 @@ export function NativeChatMessageList({
     [journalItems]
   )
   const turnStatuses = useNativeChatTurnStatus({
-    messages,
-    latestUserIndex,
-    isWorking: showTurnStatus && isWorking,
-    workingStartedAt: showTurnStatus ? workingStartedAt : null,
-    settledTurns: showTurnStatus ? settledTurns : null,
+    turnKeys,
+    liveTurnKey,
+    isWorking,
+    workingStartedAt,
+    settledTurns,
     thinking
   })
+  // The transcript tail: what the running turn is doing, or that it waits on a
+  // prompt nothing else on screen shows. A prompt card says so itself.
+  const tailRow =
+    awaitingInput === 'unshown'
+      ? 'awaiting-input'
+      : isWorking && awaitingInput === null
+        ? 'activity'
+        : null
   const lifecycleWorking = session.transcriptLifecycle?.state === 'working'
-  const slots = useMemo(
+  const allSlots = useMemo(
     () =>
       buildNativeChatTranscriptSlots({
-        messages,
+        messages: rows,
         turnKeys,
-        latestUserIndex,
-        currentTurnKey,
+        liveTurnKey,
         receipts,
         turnStatuses,
         turnDiffs,
-        showTurnStatus,
         expandedTurnKeys: expandedTurnIds,
         isWorking,
-        lifecycleWorking
+        lifecycleWorking,
+        subagentLabels
       }),
     [
-      currentTurnKey,
+      liveTurnKey,
       expandedTurnIds,
       isWorking,
-      latestUserIndex,
       lifecycleWorking,
-      messages,
       receipts,
-      showTurnStatus,
+      rows,
+      subagentLabels,
       turnDiffs,
       turnKeys,
       turnStatuses
     ]
   )
+  // A message waiting behind the live turn draws after that turn's live activity, not inside it.
+  const { slots, waitingSlots } = useMemo(
+    () => splitNativeChatSlotsWaitingBehindLiveTurn(allSlots, journalItems),
+    [allSlots, journalItems]
+  )
   const transcriptWindow = useNativeChatTranscriptWindow({
     scrollRef,
     slots,
@@ -229,7 +242,7 @@ export function NativeChatMessageList({
     contentRef,
     itemCount: slots.length,
     isWorking,
-    showTypingIndicator,
+    showsTailRow: tailRow !== null,
     isVisible,
     alignToViewportTop: transcriptWindow.alignToViewportTop,
     scrollToEnd: transcriptWindow.scrollToEnd,
@@ -324,11 +337,10 @@ export function NativeChatMessageList({
   const rowContext = useMemo<NativeChatTranscriptRowContext>(
     () => ({
       expandSignal,
-      showTurnStatus,
       revealedDiff,
       taskListPredecessors,
       expandedTurnIds,
-      failedDeliveryMessageIds,
+      deliveryNotices,
       allowFileUriLinks,
       runtimeContext,
       onLinkClick,
@@ -340,13 +352,12 @@ export function NativeChatMessageList({
       allowFileUriLinks,
       expandSignal,
       expandedTurnIds,
-      failedDeliveryMessageIds,
+      deliveryNotices,
       onLinkClick,
       revealDiff,
       revealedDiff,
       runtimeContext,
       scrollMessageToTop,
-      showTurnStatus,
       taskListPredecessors,
       toggleExpandedTurn
     ]
@@ -391,13 +402,15 @@ export function NativeChatMessageList({
                   context={rowContext}
                   window={transcriptWindow}
                 />
-                {showTurnStatus && showLiveTurnActivity && isWorking ? (
+                {tailRow === 'activity' ? (
                   <NativeChatTurnActivityLine
                     activity={turnActivity}
-                    status={turnStatuses.active}
+                    thinking={turnStatuses.active?.thinking === true}
                   />
+                ) : tailRow === 'awaiting-input' ? (
+                  <NativeChatAwaitingInputRow subject={null} pending />
                 ) : null}
-                {!showTurnStatus && showTypingIndicator ? <NativeChatTypingIndicatorRow /> : null}
+                <NativeChatWaitingTranscriptItems slots={waitingSlots} context={rowContext} />
               </div>
             </div>
           </div>
diff --git a/src/renderer/src/components/native-chat/NativeChatMessageList.turn-fold.test.tsx b/src/renderer/src/components/native-chat/NativeChatMessageList.turn-fold.test.tsx
index b80d963bb25..7c62a9efe3e 100644
--- a/src/renderer/src/components/native-chat/NativeChatMessageList.turn-fold.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatMessageList.turn-fold.test.tsx
@@ -4,6 +4,11 @@ import '@testing-library/jest-dom/vitest'
 
 import { cleanup, fireEvent, render, screen } from '@testing-library/react'
 import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
+import type {
+  AgentJournalRenderItem,
+  AgentJournalTurnScope
+} from '../../../../shared/agent-session-journal-types'
+import type { NativeChatMessage } from '../../../../shared/native-chat-types'
 import type { NativeChatLiveSession } from './use-native-chat-live-session'
 import { NativeChatMessageList } from './NativeChatMessageList'
 import { installNativeChatMessageListTestViewport } from './native-chat-message-list-test-viewport'
@@ -72,6 +77,40 @@ function session(startedAt: number): NativeChatLiveSession {
   }
 }
 
+/** The journal behind `messages`: one turn `user-1` opened, holding every later row. With
+ *  `statesScope` false, the rows carry no turn scope, as an older host writes them. */
+function journalOf(
+  messages: readonly NativeChatMessage[],
+  statesScope: boolean
+): AgentJournalRenderItem[] {
+  const scope = (turnScope: AgentJournalTurnScope) => (statesScope ? { turnScope } : {})
+  const [opener, ...rest] = messages
+  const entry = (message: NativeChatMessage, sequence: number): AgentJournalRenderItem => ({
+    itemId: message.id,
+    revision: 0,
+    sequence,
+    observedAt: sequence,
+    body: {
+      kind: 'message',
+      role: message.role === 'user' ? 'user' : 'assistant',
+      blocks: [{ type: 'text', text: message.id }]
+    },
+    ...scope({ kind: 'turn', turnItemId: 'turn-1' })
+  })
+  return [
+    { ...entry(opener!, 1), ...scope({ kind: 'thread' }) },
+    {
+      itemId: 'turn-1',
+      revision: 0,
+      sequence: 2,
+      observedAt: 2,
+      body: { kind: 'turn', turnId: 'turn-1', state: 'completed', userItemId: opener!.id },
+      ...scope({ kind: 'thread' })
+    },
+    ...rest.map((message, index) => entry(message, index + 3))
+  ]
+}
+
 // A finished turn is the transcript's resting state, and it should read as the
 // answer to the prompt — not as the transcript of the work that produced it.
 describe('NativeChatMessageList settled turn fold', () => {
@@ -140,6 +179,50 @@ describe('NativeChatMessageList settled turn fold', () => {
     expect(screen.queryByRole('button', { name: 'Toggle turn details' })).toBeNull()
   })
 
+  // The #23621 shape: the host folded a mid-turn send into the running turn, so
+  // the rows after it are still the opener's. One bar under the opener folds
+  // them all; the steered bubble stays visible and never grows a bar or group.
+  it.each([
+    ['states each row’s turn', true],
+    ['states no scope', false]
+  ])(
+    "folds the rows after a mid-turn send behind the opener's bar on a host that %s",
+    (_host, statesScope) => {
+      const startedAt = Date.now() - 3000
+      const base = session(startedAt)
+      const steer: (typeof base.messages)[number] = {
+        id: 'mid-b',
+        role: 'user',
+        blocks: [{ type: 'text', text: 'Also check the tests.' }],
+        timestamp: startedAt + 2,
+        source: 'transcript'
+      }
+      const messages = [...base.messages.slice(0, 3), steer, ...base.messages.slice(3)]
+      render(
+        <NativeChatMessageList
+          session={{ ...base, messages }}
+          journalItems={journalOf(messages, statesScope)}
+          journalSubmissions={[]}
+          isWorking={false}
+          workingStartedAt={null}
+          settledTurns={new Map([['user-1', { startedAt, workedSeconds: 70 }]])}
+          expandSignal={false}
+          fontScale={1}
+        />
+      )
+
+      expect(screen.getByText('Also check the tests.')).toBeInTheDocument()
+      expect(screen.queryByText(NARRATION)).toBeNull()
+      expect(screen.queryByText(MORE_NARRATION)).toBeNull()
+      const toggles = screen.getAllByRole('button', { name: 'Toggle turn details' })
+      expect(toggles).toHaveLength(1)
+
+      fireEvent.click(toggles[0]!)
+      expect(screen.getByText(NARRATION)).toBeInTheDocument()
+      expect(screen.getByText(MORE_NARRATION)).toBeInTheDocument()
+    }
+  )
+
   // The answer is the LAST prose the agent produced. A turn whose final output
   // is a tool run still answers with the prose before it.
   it('keeps the last prose row when the turn ends on tool activity', () => {
diff --git a/src/renderer/src/components/native-chat/NativeChatMessageList.turn-indicator.test.tsx b/src/renderer/src/components/native-chat/NativeChatMessageList.turn-indicator.test.tsx
index 4c72c96a194..300a4f01fb9 100644
--- a/src/renderer/src/components/native-chat/NativeChatMessageList.turn-indicator.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatMessageList.turn-indicator.test.tsx
@@ -9,7 +9,8 @@ import { NativeChatMessageList } from './NativeChatMessageList'
 import { installNativeChatMessageListTestViewport } from './native-chat-message-list-test-viewport'
 import type {
   AgentJournalItemBody,
-  AgentJournalRenderItem
+  AgentJournalRenderItem,
+  AgentJournalTurnScope
 } from '../../../../shared/agent-session-journal-types'
 
 // The turn record this host writes, and the legacy status row an older host sends.
@@ -56,7 +57,8 @@ const session: NativeChatLiveSession = {
   readPhase: 'ready'
 }
 
-// The live turn renders exactly one indicator row; a settled turn keeps its own.
+// The live turn has two rows: the clock bar under the prompt, and a tail line that
+// says what the turn is doing. A settled turn keeps only the bar.
 describe('NativeChatMessageList turn indicator', () => {
   it('keeps a reduced-motion-safe spinner on the live row of a no-tool Codex turn', () => {
     render(
@@ -87,7 +89,7 @@ describe('NativeChatMessageList turn indicator', () => {
       />
     )
 
-    const activity = screen.getByText('Working for 0s')
+    const activity = screen.getByText('Working…')
     const row = activity.closest('[data-native-chat-turn-activity]')
     const spinner = row?.querySelector('svg')
     expect(activity).not.toHaveClass('animate-pulse', 'animate-spin')
@@ -131,7 +133,7 @@ describe('NativeChatMessageList turn indicator', () => {
     expect(toolLabel).toHaveClass('animate-pulse')
     expect(screen.getAllByText('Running 1 command')).toHaveLength(1)
     expect(screen.getByText('pnpm test')).toBeInTheDocument()
-    const activity = screen.getByText('Working for 0s')
+    const activity = screen.getByText('Working…')
     expect(activity.textContent).not.toBe(toolLabel.textContent)
     expect(activity).not.toHaveTextContent('shell')
     expect(activity).not.toHaveTextContent('pnpm test')
@@ -165,7 +167,7 @@ describe('NativeChatMessageList turn indicator', () => {
         }}
         journalItems={[journalItem(1, turnItem), journalItem(2, reasoningRow)]}
         isWorking
-        showLiveTurnActivity={false}
+        awaitingInput="shown"
         expandSignal={false}
         fontScale={1}
       />
@@ -177,6 +179,38 @@ describe('NativeChatMessageList turn indicator', () => {
     expect(screen.getByText('Running 1 command')).toHaveClass('animate-pulse')
   })
 
+  // A terminal-backed pane can learn its agent is waiting without being handed
+  // the prompt; the tail then says so, in the row a question uses.
+  it('says the turn waits on the reader when no card shows the prompt', () => {
+    const { container } = render(
+      <NativeChatMessageList
+        session={{
+          ...session,
+          messages: [
+            {
+              id: 'user-wait',
+              role: 'user',
+              blocks: [{ type: 'text', text: 'Deploy it' }],
+              timestamp: 1,
+              source: 'transcript'
+            }
+          ]
+        }}
+        isWorking
+        workingStartedAt={Date.now() - 5000}
+        awaitingInput="unshown"
+        expandSignal={false}
+        fontScale={1}
+      />
+    )
+
+    expect(container.querySelector('[data-native-chat-ask-row="awaiting"]')).toHaveTextContent(
+      /^Awaiting user input$/
+    )
+    expect(container.querySelector('[data-native-chat-turn-activity]')).toBeNull()
+    expect(screen.getByText('Working for 5s')).toBeInTheDocument()
+  })
+
   it('keeps the live row up after a tool settles', () => {
     render(
       <NativeChatMessageList
@@ -209,7 +243,7 @@ describe('NativeChatMessageList turn indicator', () => {
 
     // The settled run heads with the command it ran; the live row is separate.
     const settledTool = screen.getByText('pnpm test')
-    const activity = screen.getByText('Working for 0s')
+    const activity = screen.getByText('Working…')
     expect(activity.textContent).not.toBe(settledTool.textContent)
     expect(activity).not.toHaveTextContent('shell')
     expect(activity).not.toHaveTextContent('pnpm test')
@@ -285,42 +319,6 @@ describe('NativeChatMessageList turn indicator', () => {
     expect(liveRun?.querySelector('.lucide-check')).toBeInTheDocument()
   })
 
-  it('keeps bridge chats on the legacy activity chrome', () => {
-    render(
-      <NativeChatMessageList
-        session={{
-          ...session,
-          status: 'working',
-          messages: [
-            {
-              id: 'bridge-tool',
-              role: 'assistant',
-              blocks: [
-                {
-                  type: 'tool-call',
-                  name: 'shell',
-                  input: { command: 'sleep 5' },
-                  state: 'running'
-                }
-              ],
-              timestamp: 1,
-              source: 'transcript'
-            }
-          ]
-        }}
-        isWorking
-        expandSignal={false}
-        fontScale={1}
-        showTurnStatus={false}
-      />
-    )
-
-    expect(screen.queryByText('Thinking')).toBeNull()
-    expect(screen.queryByRole('button', { name: 'Toggle turn details' })).toBeNull()
-    expect(screen.queryByText('Running sleep 5')).toBeNull()
-    expect(document.querySelectorAll('.animate-bounce')).toHaveLength(3)
-  })
-
   it('replaces a bridge ask row and settles it from the FIFO tool result', () => {
     const user = {
       id: 'bridge-user',
@@ -354,7 +352,6 @@ describe('NativeChatMessageList turn indicator', () => {
         isWorking={false}
         expandSignal={false}
         fontScale={1}
-        showTurnStatus={false}
       />
     )
 
@@ -381,7 +378,6 @@ describe('NativeChatMessageList turn indicator', () => {
         isWorking={false}
         expandSignal={false}
         fontScale={1}
-        showTurnStatus={false}
       />
     )
 
@@ -390,7 +386,7 @@ describe('NativeChatMessageList turn indicator', () => {
     expect(screen.queryByText(/AskUserQuestion/)).toBeNull()
   })
 
-  it('reads "Thinking" on the one live row while the turn is reasoning', () => {
+  it('reads "Thinking" on the tail line while the bar keeps the clock', () => {
     const { container } = render(
       <NativeChatMessageList
         session={{
@@ -414,10 +410,12 @@ describe('NativeChatMessageList turn indicator', () => {
     )
 
     const user = screen.getByText('Start the task')
+    const bar = screen.getByText('Working for 0s')
     const thinking = screen.getByText('Thinking')
-    expect(user.compareDocumentPosition(thinking)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
-    // One indicator, not a "Thinking" row stacked above a spinning "Working…" row.
-    expect(container.querySelectorAll('[data-native-chat-turn-status]')).toHaveLength(1)
+    expect(user.compareDocumentPosition(bar)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
+    expect(bar.compareDocumentPosition(thinking)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
+    expect(screen.getAllByText('Thinking')).toHaveLength(1)
+    expect(screen.queryByText('Working…')).toBeNull()
     expect(thinking.closest('[data-native-chat-turn-activity]')?.querySelector('svg')).toHaveClass(
       'animate-spin'
     )
@@ -451,10 +449,10 @@ describe('NativeChatMessageList turn indicator', () => {
     )
 
     expect(screen.queryByText('Thinking')).toBeNull()
-    expect(screen.getByText('Working for 0s')).toBeInTheDocument()
+    expect(screen.getByText('Working…')).toBeInTheDocument()
   })
 
-  it('lets provider activity text beat the reasoning label on the same single row', () => {
+  it('lets provider activity text beat the reasoning label on the tail line', () => {
     const { container } = render(
       <NativeChatMessageList
         session={{
@@ -480,10 +478,11 @@ describe('NativeChatMessageList turn indicator', () => {
 
     expect(screen.getByText('Exploring the repo layout')).toBeInTheDocument()
     expect(screen.queryByText('Thinking')).toBeNull()
+    expect(container.querySelectorAll('[data-native-chat-turn-activity]')).toHaveLength(1)
     expect(container.querySelectorAll('[data-native-chat-turn-status]')).toHaveLength(1)
   })
 
-  it('places the one live row after the newest content in the turn', () => {
+  it('puts the clock bar under the prompt and the tail line after the newest content', () => {
     render(
       <NativeChatMessageList
         session={{
@@ -512,20 +511,35 @@ describe('NativeChatMessageList turn indicator', () => {
       />
     )
 
-    const status = screen.getByText('Working for 0s')
+    const user = screen.getByText('Run the checks')
+    const bar = screen.getByText('Working for 0s')
     const assistant = screen.getByText('I am checking now.')
-    // The live row trails the newest content instead of sitting under the prompt.
-    expect(assistant.compareDocumentPosition(status)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
-    expect(document.querySelectorAll('[data-native-chat-turn-status]')).toHaveLength(1)
+    const tail = screen.getByText('Working…')
+    expect(user.compareDocumentPosition(bar)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
+    expect(bar.compareDocumentPosition(assistant)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
+    expect(assistant.compareDocumentPosition(tail)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
+    expect(bar.closest('[data-native-chat-turn-status]')).toHaveAttribute(
+      'data-native-chat-turn-status',
+      'active'
+    )
+    // The clock is said once, on the bar.
+    expect(screen.getAllByText(/Working for/)).toHaveLength(1)
   })
 
-  it('shows elapsed working time once tool activity starts', () => {
+  it('shows elapsed working time on the bar while a tool runs', () => {
     render(
       <NativeChatMessageList
         session={{
           ...session,
           status: 'working',
           messages: [
+            {
+              id: 'user-tool',
+              role: 'user',
+              blocks: [{ type: 'text', text: 'Wait a bit' }],
+              timestamp: 1,
+              source: 'transcript'
+            },
             {
               id: 'tool-1',
               role: 'assistant',
@@ -583,6 +597,11 @@ describe('NativeChatMessageList turn indicator', () => {
         fontScale={1}
       />
     )
+    // The live bar sits where the settled one will, so settling never moves it.
+    const liveBar = screen.getByText('Working for 3s')
+    expect(screen.getByText('Complete this task').compareDocumentPosition(liveBar)).toBe(
+      Node.DOCUMENT_POSITION_FOLLOWING
+    )
 
     rerender(
       <NativeChatMessageList
@@ -596,6 +615,10 @@ describe('NativeChatMessageList turn indicator', () => {
 
     const user = screen.getByText('Complete this task')
     const status = screen.getByText('Worked for 3s')
+    // Settled in place: the same bar, not a remount.
+    expect(status.closest('[data-native-chat-turn-status]')).toBe(
+      liveBar.closest('[data-native-chat-turn-status]')
+    )
     const assistant = screen.getByText('Task complete.')
     expect(user.compareDocumentPosition(status)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
     expect(status.compareDocumentPosition(assistant)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
@@ -627,6 +650,145 @@ describe('NativeChatMessageList turn indicator', () => {
     expect(screen.getByText('Working for 0s')).toBeInTheDocument()
   })
 
+  it.each([
+    ["a host that states each row's turn", true],
+    ['a host that states none', false]
+  ])(
+    'keeps the live bar under the prompt that opened the running turn, not a message sent mid-turn, on %s',
+    (_, scoped) => {
+      const prompt = (id: string, text: string): NativeChatLiveSession['messages'][number] => ({
+        id,
+        role: 'user',
+        blocks: [{ type: 'text', text }],
+        timestamp: 1,
+        source: 'transcript'
+      })
+      const messages = [
+        prompt('user-a', 'Run four sleeps'),
+        {
+          id: 'tool-a',
+          role: 'assistant' as const,
+          blocks: [
+            {
+              type: 'tool-call' as const,
+              name: 'Bash',
+              input: { command: 'sleep 15' },
+              state: 'running' as const
+            }
+          ],
+          timestamp: 2,
+          source: 'transcript' as const
+        },
+        prompt('user-b', 'Also say banana')
+      ]
+      // B was handed over while A's turn runs, so a host that states scopes puts it in that turn.
+      const t1: AgentJournalTurnScope = { kind: 'turn', turnItemId: 't1' }
+      const thread: AgentJournalTurnScope = { kind: 'thread' }
+      const row = (
+        itemId: string,
+        sequence: number,
+        body: AgentJournalItemBody,
+        turnScope: AgentJournalTurnScope
+      ): AgentJournalRenderItem => ({
+        itemId,
+        revision: 1,
+        sequence,
+        observedAt: sequence,
+        body,
+        ...(scoped ? { turnScope } : {})
+      })
+      const journal = (t1State: 'running' | 'completed', t2State?: 'running' | 'completed') => [
+        row('user-a', 1, { kind: 'message', role: 'user', blocks: [] }, thread),
+        row('t1', 2, { kind: 'turn', turnId: 't1', state: t1State, userItemId: 'user-a' }, thread),
+        row('tool-a', 3, { kind: 'message', role: 'assistant', blocks: [] }, t1),
+        row('user-b', 4, { kind: 'message', role: 'user', blocks: [] }, t1),
+        ...(t2State
+          ? [
+              row(
+                't2',
+                5,
+                { kind: 'turn', turnId: 't2', state: t2State, userItemId: 'user-b' },
+                thread
+              )
+            ]
+          : [])
+      ]
+      const list = (props: Partial<React.ComponentProps<typeof NativeChatMessageList>>) => (
+        <NativeChatMessageList
+          session={{ ...session, status: 'working', messages }}
+          isWorking
+          expandSignal={false}
+          fontScale={1}
+          {...props}
+        />
+      )
+      // B was sent while A's turn runs: the host's record still names A as the running turn's opener.
+      const { rerender } = render(
+        list({
+          workingStartedAt: Date.now() - 5000,
+          settledTurns: new Map(),
+          journalItems: journal('running')
+        })
+      )
+      const barA = screen.getByText('Working for 5s').closest('[data-native-chat-turn-status]')
+      expect(screen.getAllByText(/Working for/)).toHaveLength(1)
+      expect(screen.getByText('Run four sleeps').compareDocumentPosition(barA!)).toBe(
+        Node.DOCUMENT_POSITION_FOLLOWING
+      )
+      expect(barA!.compareDocumentPosition(screen.getByText('Also say banana'))).toBe(
+        Node.DOCUMENT_POSITION_FOLLOWING
+      )
+
+      // A settles in place: under its prompt, above B. A's tool work is A's on either host (read
+      // from its scope, or from journal order), so the settled bar becomes that work's fold toggle.
+      const expectSettledUnderA = () => {
+        const settledA = screen
+          .getByText('Worked for 17s')
+          .closest('[data-native-chat-turn-status]')
+        expect(screen.getByText('Run four sleeps').compareDocumentPosition(settledA!)).toBe(
+          Node.DOCUMENT_POSITION_FOLLOWING
+        )
+        expect(settledA!.compareDocumentPosition(screen.getByText('Also say banana'))).toBe(
+          Node.DOCUMENT_POSITION_FOLLOWING
+        )
+      }
+
+      // B's own turn opens: A settles in place and B counts from A's end.
+      rerender(
+        list({
+          workingStartedAt: Date.now() - 1000,
+          settledTurns: new Map([['user-a', { startedAt: 1, workedSeconds: 17 }]]),
+          journalItems: journal('completed', 'running')
+        })
+      )
+      expectSettledUnderA()
+      const barB = screen.getByText('Working for 1s').closest('[data-native-chat-turn-status]')
+      expect(screen.getByText('Also say banana').compareDocumentPosition(barB!)).toBe(
+        Node.DOCUMENT_POSITION_FOLLOWING
+      )
+
+      rerender(
+        list({
+          isWorking: false,
+          session: { ...session, status: 'ready', messages },
+          workingStartedAt: null,
+          settledTurns: new Map([
+            ['user-a', { startedAt: 1, workedSeconds: 17 }],
+            ['user-b', { startedAt: 2, workedSeconds: 51 }]
+          ]),
+          journalItems: journal('completed', 'completed')
+        })
+      )
+      expectSettledUnderA()
+      expect(
+        screen
+          .getByText('Also say banana')
+          .compareDocumentPosition(screen.getByText('Worked for 51s'))
+      ).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
+      expect(screen.queryByText(/Working for/)).toBeNull()
+    }
+  )
+
   it("uses the completed caret to expand that turn's tool details", () => {
     const startedAt = Date.now() - 3000
     render(
diff --git a/src/renderer/src/components/native-chat/NativeChatMessageList.turn-membership.test.tsx b/src/renderer/src/components/native-chat/NativeChatMessageList.turn-membership.test.tsx
new file mode 100644
index 00000000000..ec6ca5b3734
--- /dev/null
+++ b/src/renderer/src/components/native-chat/NativeChatMessageList.turn-membership.test.tsx
@@ -0,0 +1,432 @@
+// @vitest-environment happy-dom
+
+import '@testing-library/jest-dom/vitest'
+
+import { cleanup, render, screen } from '@testing-library/react'
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
+import {
+  agentJournalItemKey,
+  agentJournalSubmissionKey
+} from '../../../../shared/agent-session-journal-item-key'
+import type {
+  AgentJournalItemBody,
+  AgentJournalRenderItem,
+  AgentJournalSubmission,
+  AgentJournalTurnScope
+} from '../../../../shared/agent-session-journal-types'
+import { projectStructuredAgentSessionMessages } from '../../../../shared/structured-agent-session-message-projection'
+import { selectStructuredAgentSettledTurns } from '../../../../shared/structured-agent-session-turn-timing'
+import { NativeChatMessageList } from './NativeChatMessageList'
+import { installNativeChatMessageListTestViewport } from './native-chat-message-list-test-viewport'
+
+let restoreViewport = (): void => {}
+beforeAll(() => {
+  restoreViewport = installNativeChatMessageListTestViewport()
+})
+afterAll(() => restoreViewport())
+afterEach(cleanup)
+
+const THREAD: AgentJournalTurnScope = { kind: 'thread' }
+const inTurn = (turnItemId: string): AgentJournalTurnScope => ({ kind: 'turn', turnItemId })
+let sequence = 0
+
+function item(
+  itemId: string,
+  body: AgentJournalItemBody,
+  turnScope: AgentJournalTurnScope = THREAD
+): AgentJournalRenderItem {
+  sequence += 1
+  return { itemId, revision: 0, sequence, observedAt: sequence, body, turnScope }
+}
+const say = (
+  itemId: string,
+  role: 'user' | 'assistant',
+  text: string,
+  scope: AgentJournalTurnScope = THREAD
+) => item(itemId, { kind: 'message', role, blocks: [{ type: 'text', text }] }, scope)
+const work = (itemId: string, scope: AgentJournalTurnScope) =>
+  item(
+    itemId,
+    {
+      kind: 'message',
+      role: 'assistant',
+      blocks: [{ type: 'tool-call', name: 'shell', input: { command: 'ls' }, state: 'completed' }]
+    },
+    scope
+  )
+const settledTurn = (itemId: string, userItemId: string, seconds: number, start: number) =>
+  item(itemId, {
+    kind: 'turn',
+    turnId: itemId,
+    state: 'completed',
+    outcome: 'success',
+    userItemId,
+    startedAt: start,
+    completedAt: start + seconds * 1000
+  })
+
+/** "List three fruits", answered and settled in 4s. */
+function fruitTurn(): AgentJournalRenderItem[] {
+  return [
+    say('u1', 'user', 'List three fruits'),
+    settledTurn('t1', 'u1', 4, 1_000),
+    say('t1-narration', 'assistant', 'Thinking about fruit.', inTurn('t1')),
+    work('t1-work', inTurn('t1')),
+    say('t1-answer', 'assistant', 'Apple, banana, cherry.', inTurn('t1'))
+  ]
+}
+
+function journalList(
+  items: AgentJournalRenderItem[],
+  submissions: AgentJournalSubmission[] = [],
+  {
+    isWorking = false,
+    workingStartedAt = null,
+    hostTiming = true
+  }: { isWorking?: boolean; workingStartedAt?: number | null; hostTiming?: boolean } = {}
+): React.JSX.Element {
+  return (
+    <NativeChatMessageList
+      session={{
+        messages: projectStructuredAgentSessionMessages(items, [], submissions),
+        status: 'ready',
+        sessionId: 'session-1',
+        agent: 'codex',
+        hasMore: false,
+        loadingEarlier: false,
+        olderHistoryGeneration: 0,
+        loadEarlier: vi.fn(),
+        readPhase: 'ready'
+      }}
+      journalItems={items}
+      journalSubmissions={submissions}
+      settledTurns={hostTiming ? selectStructuredAgentSettledTurns(items, submissions) : undefined}
+      isWorking={isWorking}
+      workingStartedAt={workingStartedAt}
+      expandSignal={false}
+      fontScale={1}
+    />
+  )
+}
+
+function renderJournal(
+  items: AgentJournalRenderItem[],
+  submissions: AgentJournalSubmission[] = [],
+  isWorking = false
+): void {
+  render(journalList(items, submissions, { isWorking }))
+}
+
+function follows(later: HTMLElement, earlier: HTMLElement): boolean {
+  return Boolean(earlier.compareDocumentPosition(later) & Node.DOCUMENT_POSITION_FOLLOWING)
+}
+
+describe('NativeChatMessageList turns from the turn record', () => {
+  it('gives /compact its own turn and result, and leaves the turn before it untouched', () => {
+    const compactEntry = agentJournalSubmissionKey('cmd-1')
+    const commandTurn = agentJournalItemKey({
+      provider: 'orca',
+      clientMessageId: 'command-turn:cmd-1'
+    })
+    const items = [
+      ...fruitTurn(),
+      item(compactEntry, {
+        kind: 'message',
+        role: 'user',
+        blocks: [{ type: 'text', text: '/compact' }],
+        command: { name: 'compact' }
+      }),
+      settledTurn(commandTurn, compactEntry, 2, 10_000),
+      item(
+        'command-result',
+        { kind: 'status', text: 'Conversation compacted.', presentation: 'compaction' },
+        inTurn(commandTurn)
+      )
+    ]
+    renderJournal(items, [
+      {
+        clientMessageId: 'cmd-1',
+        fence: 1,
+        payloadFingerprint: 'f',
+        dispatchState: 'accepted',
+        providerItemId: null,
+        reason: null,
+        submittedAt: 9_000,
+        resolvedAt: 12_000
+      }
+    ])
+
+    expect(screen.getByText('Apple, banana, cherry.')).toBeInTheDocument()
+    expect(screen.queryByText('Thinking about fruit.')).toBeNull()
+    const compact = screen.getByText('/compact')
+    const previousStatus = screen.getByText('Worked for 4s')
+    const ownStatus = screen.getByText('Worked for 2s')
+    expect(follows(compact, previousStatus)).toBe(true)
+    expect(follows(ownStatus, compact)).toBe(true)
+    expect(screen.getByRole('separator', { name: 'Context compacted' })).toBeInTheDocument()
+  })
+
+  it('draws a message waiting behind /compact after the compaction, never above it', () => {
+    const compactEntry = agentJournalSubmissionKey('cmd-1')
+    const commandTurn = agentJournalItemKey({
+      provider: 'orca',
+      clientMessageId: 'command-turn:cmd-1'
+    })
+    const held = agentJournalSubmissionKey('held')
+    const items = [
+      ...fruitTurn(),
+      item(compactEntry, {
+        kind: 'message',
+        role: 'user',
+        blocks: [{ type: 'text', text: '/compact' }],
+        command: { name: 'compact' }
+      }),
+      settledTurn(commandTurn, compactEntry, 2, 10_000),
+      // Accepted while the command ran, so written before the command's result.
+      say(held, 'user', 'Say DONE'),
+      item(
+        'command-result',
+        { kind: 'status', text: 'Conversation compacted.', presentation: 'compaction' },
+        inTurn(commandTurn)
+      )
+    ]
+    const submission = (
+      clientMessageId: string,
+      handedOverAt?: number
+    ): AgentJournalSubmission => ({
+      clientMessageId,
+      fence: 1,
+      payloadFingerprint: clientMessageId,
+      dispatchState:
+        handedOverAt === undefined && clientMessageId === 'held' ? 'pending' : 'accepted',
+      providerItemId: null,
+      reason: null,
+      submittedAt: 9_000,
+      resolvedAt: null,
+      handoverRecorded: true,
+      ...(handedOverAt !== undefined ? { handedOverAt } : {})
+    })
+    // The command settled; the loop has not yet handed the held message over.
+    renderJournal(items, [submission('cmd-1', 9_500), submission('held')])
+
+    expect(
+      follows(
+        screen.getByText('Say DONE'),
+        screen.getByRole('separator', { name: 'Context compacted' })
+      )
+    ).toBe(true)
+  })
+
+  it('keeps the row that says why a turn stopped visible in its folded turn', () => {
+    const items = [
+      ...fruitTurn(),
+      item(
+        'exit',
+        { kind: 'status', text: 'The agent exited unexpectedly.', tone: 'error' },
+        inTurn('t1')
+      )
+    ]
+    renderJournal(items)
+
+    expect(screen.queryByText('Thinking about fruit.')).toBeNull()
+    expect(screen.getByText('The agent exited unexpectedly.')).toBeInTheDocument()
+  })
+
+  it('folds a turn the provider resumed on its own under its own status', () => {
+    const wake = agentJournalItemKey({
+      provider: 'legacy',
+      agent: 'claude',
+      sessionId: 'session-1',
+      recordId: 'turn-lifecycle:wake'
+    })
+    const items = [
+      ...fruitTurn(),
+      // Claude keys a resumed turn's record on itself: no message opened it.
+      settledTurn(wake, wake, 9, 20_000),
+      say('wake-narration', 'assistant', 'The background build finished.', inTurn(wake)),
+      work('wake-work', inTurn(wake)),
+      say('wake-answer', 'assistant', 'All tests pass now.', inTurn(wake))
+    ]
+    renderJournal(items)
+
+    const previousStatus = screen.getByText('Worked for 4s')
+    const ownStatus = screen.getByText('Worked for 9s')
+    expect(follows(ownStatus, screen.getByText('Apple, banana, cherry.'))).toBe(true)
+    expect(follows(ownStatus, previousStatus)).toBe(true)
+    expect(screen.queryByText('The background build finished.')).toBeNull()
+    expect(screen.getByText('All tests pass now.')).toBeInTheDocument()
+    expect(screen.getAllByRole('button', { name: 'Toggle turn details' })).toHaveLength(2)
+  })
+
+  it("keeps the settled turn's duration while a turn the provider opened runs after it", () => {
+    const wake = agentJournalItemKey({
+      provider: 'legacy',
+      agent: 'claude',
+      sessionId: 'session-1',
+      recordId: 'turn-lifecycle:wake'
+    })
+    const items = [
+      ...fruitTurn(),
+      item(wake, {
+        kind: 'turn',
+        turnId: wake,
+        state: 'running',
+        userItemId: wake,
+        startedAt: 20_000
+      }),
+      say('wake-answer', 'assistant', 'Checking the background build.', inTurn(wake))
+    ]
+    renderJournal(items, [], true)
+
+    expect(screen.getByText('Worked for 4s')).toBeInTheDocument()
+    expect(screen.getByText('Checking the background build.')).toBeInTheDocument()
+  })
+
+  it('clocks a turn the provider opened under its own key, not the user turn before it', () => {
+    const wake = 'wake'
+    const ask = say('u1', 'user', 'List three fruits')
+    const answer = (state: 'running' | 'completed') => [
+      ask,
+      item('t1', { kind: 'turn', turnId: 't1', state, userItemId: 'u1' }),
+      say('t1-answer', 'assistant', 'Apple, banana, cherry.', inTurn('t1'))
+    ]
+    // No host durations: this client's own clock is all the rows have.
+    const local = { hostTiming: false }
+    const { rerender } = render(
+      journalList(answer('running'), [], {
+        ...local,
+        isWorking: true,
+        workingStartedAt: Date.now() - 7_000
+      })
+    )
+    rerender(journalList(answer('completed'), [], local))
+    expect(screen.getByText('Worked for 7s')).toBeInTheDocument()
+
+    const woken = [
+      ...answer('completed'),
+      item(wake, { kind: 'turn', turnId: wake, state: 'running', userItemId: 'claude:wake' }),
+      say('wake-answer', 'assistant', 'Checking the background build.', inTurn(wake))
+    ]
+    rerender(journalList(woken, [], { ...local, isWorking: true, workingStartedAt: Date.now() }))
+    expect(screen.getByText('Worked for 7s')).toBeInTheDocument()
+  })
+
+  it('draws a message waiting behind a running /compact after its live activity', () => {
+    const compactEntry = agentJournalSubmissionKey('cmd-1')
+    const commandTurn = agentJournalItemKey({
+      provider: 'orca',
+      clientMessageId: 'command-turn:cmd-1'
+    })
+    const held = agentJournalSubmissionKey('held')
+    const items = [
+      ...fruitTurn(),
+      item(compactEntry, {
+        kind: 'message',
+        role: 'user',
+        blocks: [{ type: 'text', text: '/compact' }],
+        command: { name: 'compact' }
+      }),
+      item(commandTurn, {
+        kind: 'turn',
+        turnId: 'compact:cmd-1',
+        state: 'running',
+        userItemId: compactEntry,
+        startedAt: 10_000
+      }),
+      say(held, 'user', 'Say DONE')
+    ]
+    const submission = (
+      clientMessageId: string,
+      handedOverAt?: number
+    ): AgentJournalSubmission => ({
+      clientMessageId,
+      fence: 1,
+      payloadFingerprint: clientMessageId,
+      dispatchState: handedOverAt === undefined ? 'pending' : 'accepted',
+      providerItemId: null,
+      reason: null,
+      submittedAt: 9_000,
+      resolvedAt: null,
+      handoverRecorded: true,
+      ...(handedOverAt !== undefined ? { handedOverAt } : {})
+    })
+    const { container } = render(
+      journalList(items, [submission('cmd-1', 9_500), submission('held')], {
+        isWorking: true,
+        workingStartedAt: 10_000
+      })
+    )
+
+    const activity = container.querySelector<HTMLElement>('[data-native-chat-turn-activity]')
+    expect(activity).not.toBeNull()
+    expect(follows(activity!, screen.getByText('/compact'))).toBe(true)
+    expect(follows(screen.getByText('Say DONE'), activity!)).toBe(true)
+  })
+
+  it("keeps a steer on its way into an ordinary running turn above that turn's activity", () => {
+    const steer = agentJournalSubmissionKey('steer')
+    const items = [
+      say('u1', 'user', 'List three fruits'),
+      item('t1', {
+        kind: 'turn',
+        turnId: 't1',
+        state: 'running',
+        userItemId: 'u1',
+        startedAt: 10_000
+      }),
+      say('t1-narration', 'assistant', 'Thinking about fruit.', inTurn('t1')),
+      say(steer, 'user', 'Make it four')
+    ]
+    const { container } = render(
+      journalList(
+        items,
+        [
+          {
+            clientMessageId: 'steer',
+            fence: 1,
+            payloadFingerprint: 'steer',
+            dispatchState: 'pending',
+            providerItemId: null,
+            reason: null,
+            submittedAt: 10_500,
+            resolvedAt: null,
+            handoverRecorded: true
+          }
+        ],
+        { isWorking: true, workingStartedAt: 10_000 }
+      )
+    )
+
+    // Handed over within moments, where it already is: it must not cross the activity line to wait.
+    const activity = container.querySelector<HTMLElement>('[data-native-chat-turn-activity]')
+    expect(activity).not.toBeNull()
+    expect(follows(activity!, screen.getByText('Make it four'))).toBe(true)
+  })
+
+  it('keeps a message whose own start is pending above the activity that start reports', () => {
+    const waiting = agentJournalSubmissionKey('first')
+    const { container } = render(
+      journalList(
+        [say(waiting, 'user', 'Hello there')],
+        [
+          {
+            clientMessageId: 'first',
+            fence: 1,
+            payloadFingerprint: 'first',
+            dispatchState: 'pending',
+            providerItemId: null,
+            reason: null,
+            submittedAt: 9_000,
+            resolvedAt: null,
+            handoverRecorded: true
+          }
+        ],
+        { isWorking: true, workingStartedAt: 9_000 }
+      )
+    )
+
+    const activity = container.querySelector<HTMLElement>('[data-native-chat-turn-activity]')
+    expect(activity).not.toBeNull()
+    expect(follows(activity!, screen.getByText('Hello there'))).toBe(true)
+  })
+})
diff --git a/src/renderer/src/components/native-chat/NativeChatMessageRow.test.tsx b/src/renderer/src/components/native-chat/NativeChatMessageRow.test.tsx
index 4b29ebf57c5..7097cb87aa4 100644
--- a/src/renderer/src/components/native-chat/NativeChatMessageRow.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatMessageRow.test.tsx
@@ -60,9 +60,9 @@ describe('MessageRow control visibility', () => {
       'can-hover:opacity-0',
       'can-hover:pointer-events-none',
       'group-hover:opacity-100',
-      'group-has-[:focus-visible]:opacity-100',
+      '[.group:has(:focus-visible)_&]:opacity-100',
       'group-hover:pointer-events-auto',
-      'group-has-[:focus-visible]:pointer-events-auto'
+      '[.group:has(:focus-visible)_&]:pointer-events-auto'
     )
     expect(copy.parentElement).not.toHaveClass('opacity-0', 'pointer-events-none')
     expect(time).not.toHaveAttribute('tabindex')
@@ -79,9 +79,9 @@ describe('MessageRow control visibility', () => {
       'can-hover:opacity-0',
       'can-hover:pointer-events-none',
       'group-hover:opacity-100',
-      'group-has-[:focus-visible]:opacity-100',
+      '[.group:has(:focus-visible)_&]:opacity-100',
       'group-hover:pointer-events-auto',
-      'group-has-[:focus-visible]:pointer-events-auto'
+      '[.group:has(:focus-visible)_&]:pointer-events-auto'
     )
     expect(copy.parentElement).not.toHaveClass('opacity-0', 'pointer-events-none')
     expect(copy.parentElement!.parentElement).toHaveClass('group')
@@ -162,3 +162,83 @@ describe('MessageRow send mode', () => {
     expect(screen.queryByText('Sent as goal')).not.toBeInTheDocument()
   })
 })
+
+describe('a user message that did not go through', () => {
+  function renderUser(deliveryNotice?: { text: string; onRetry?: () => void }) {
+    return render(
+      <MessageRow
+        message={{
+          id: 'message',
+          role: 'user',
+          timestamp: 0,
+          source: 'transcript',
+          blocks: [{ type: 'text', text: 'Message text' }]
+        }}
+        expandSignal={false}
+        onScrollMessageToTop={vi.fn()}
+        deliveryNotice={deliveryNotice}
+      />
+    )
+  }
+
+  it('says why under the message, with a Retry that sends this one', () => {
+    const onRetry = vi.fn()
+    renderUser({ text: "The agent couldn't restart. Your message was not sent.", onRetry })
+
+    expect(
+      screen.getByText("The agent couldn't restart. Your message was not sent.")
+    ).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'Retry' }))
+    expect(onRetry).toHaveBeenCalledOnce()
+  })
+
+  it('offers no Retry where the surface cannot send it again', () => {
+    renderUser({ text: 'Not delivered — check the terminal' })
+
+    expect(screen.getByText('Not delivered — check the terminal')).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Retry' })).toBeNull()
+  })
+
+  it('says nothing when it went through', () => {
+    renderUser()
+    expect(screen.queryByRole('button', { name: 'Retry' })).toBeNull()
+  })
+})
+
+describe("MessageRow — a subagent's row speaks as that subagent", () => {
+  function renderAgentRow(agentId: string | undefined, subagentLabel?: string) {
+    return render(
+      <MessageRow
+        message={{
+          id: 'message',
+          role: 'assistant',
+          timestamp: 0,
+          source: 'transcript',
+          blocks: [{ type: 'text', text: 'The PR is CLEAN.' }],
+          ...(agentId === undefined ? {} : { agentId })
+        }}
+        expandSignal={false}
+        onScrollMessageToTop={vi.fn()}
+        subagentLabel={subagentLabel}
+      />
+    )
+  }
+
+  it('names the subagent that wrote the row', () => {
+    renderAgentRow('task-1', 'explore the lane')
+    expect(
+      screen.getByRole('note', { name: 'Written by subagent explore the lane' })
+    ).toBeInTheDocument()
+    expect(screen.getByText('The PR is CLEAN.')).toBeInTheDocument()
+  })
+
+  it('still marks the row as a subagent when no loaded roster names it', () => {
+    renderAgentRow('task-9')
+    expect(screen.getByRole('note', { name: 'Subagent' })).toBeInTheDocument()
+  })
+
+  it("adds nothing to the session's own row", () => {
+    renderAgentRow(undefined, 'explore the lane')
+    expect(screen.queryByRole('note')).toBeNull()
+  })
+})
diff --git a/src/renderer/src/components/native-chat/NativeChatMessageRow.tsx b/src/renderer/src/components/native-chat/NativeChatMessageRow.tsx
index 52dc6f62a3b..e43a758051b 100644
--- a/src/renderer/src/components/native-chat/NativeChatMessageRow.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatMessageRow.tsx
@@ -1,5 +1,6 @@
 import { memo, useCallback, useRef } from 'react'
-import { Goal } from 'lucide-react'
+import { Bot, Goal, RotateCcw } from 'lucide-react'
+import { Button } from '@/components/ui/button'
 import CommentMarkdown, {
   type CommentMarkdownLinkClickHandler
 } from '@/components/sidebar/CommentMarkdown'
@@ -10,6 +11,8 @@ import type {
   NativeChatToolCallBlock
 } from '../../../../shared/native-chat-types'
 import { deriveNativeChatRowContent } from '../../../../shared/native-chat-row-content'
+import { agentJournalItemSubagentId } from '../../../../shared/agent-session-journal-producer'
+import { NATIVE_CHAT_SUBAGENT_ATTRIBUTION_COPY } from '../../../../shared/native-chat-subagent-attribution'
 import { NativeChatToolRun } from './NativeChatToolRun'
 import { NativeChatCodeBlock } from './NativeChatCodeBlock'
 import { NativeChatNoticeRow } from './NativeChatNoticeRow'
@@ -23,6 +26,10 @@ import {
 import type { NativeChatDiffReveal } from './native-chat-turn-diffs'
 import type { RuntimeFileOperationArgs } from '@/runtime/runtime-file-client'
 
+/** What a user message says under it when it did not go through, with its own Retry when the
+ *  surface can send it again. */
+export type NativeChatDeliveryNotice = { text: string; onRetry?: () => void }
+
 /** One message: its prose first, then a collapsible run folding all of the
  *  turn's tool activity. Monochrome per STYLEGUIDE: user prompts read as a
  *  lifted card, assistant prose as body copy, reasoning de-emphasized.
@@ -39,9 +46,9 @@ export const MessageRow = memo(function MessageRow({
   onScrollMessageToTop,
   onLinkClick,
   allowFileUriLinks = false,
-  deliveryFailed = false,
-  structuredActivityUi = true,
+  deliveryNotice,
   folded = false,
+  subagentLabel,
   runtimeContext
 }: {
   message: NativeChatMessage
@@ -56,10 +63,11 @@ export const MessageRow = memo(function MessageRow({
   onScrollMessageToTop: (el: HTMLElement) => void
   onLinkClick?: CommentMarkdownLinkClickHandler
   allowFileUriLinks?: boolean
-  deliveryFailed?: boolean
-  structuredActivityUi?: boolean
+  deliveryNotice?: NativeChatDeliveryNotice
   /** Behind a folded turn: the row keeps only what outlives the turn. */
   folded?: boolean
+  /** The roster's name for the subagent that wrote this row, when one names it. */
+  subagentLabel?: string
   runtimeContext?: RuntimeFileOperationArgs | null
 }): React.JSX.Element | null {
   const rowRef = useRef<HTMLDivElement | null>(null)
@@ -162,17 +170,23 @@ export const MessageRow = memo(function MessageRow({
         {/* Copy + timestamp reveal together, mirroring the agent controls row.
             Image-only prompts have no text to copy, so the button is omitted. */}
         {markdown || message.timestamp !== null ? (
-          <div className="flex select-none items-center gap-1 transition-opacity can-hover:pointer-events-none can-hover:opacity-0 group-hover:pointer-events-auto group-hover:opacity-100 group-has-[:focus-visible]:pointer-events-auto group-has-[:focus-visible]:opacity-100">
+          <div className="flex select-none items-center gap-1 transition-opacity can-hover:pointer-events-none can-hover:opacity-0 group-hover:pointer-events-auto group-hover:opacity-100 [.group:has(:focus-visible)_&]:pointer-events-auto [.group:has(:focus-visible)_&]:opacity-100">
             {markdown ? <NativeChatCopyButton text={markdown} /> : null}
             <NativeChatMessageTimestamp timestamp={message.timestamp} focusable />
           </div>
         ) : null}
-        {deliveryFailed ? (
-          <div className="max-w-[85%] text-[11px] text-destructive/80">
-            {translate(
-              'components.native-chat.launchPromptNotDelivered',
-              'Not delivered — check the terminal'
-            )}
+        {deliveryNotice ? (
+          <div className="flex max-w-[85%] items-center gap-2 text-[11px] text-destructive/80">
+            <span className="min-w-0 break-words">{deliveryNotice.text}</span>
+            {deliveryNotice.onRetry ? (
+              <Button type="button" variant="ghost" size="xs" onClick={deliveryNotice.onRetry}>
+                <RotateCcw className="size-3" />
+                {translate(
+                  'auto.components.native.chat.NativeChatStructuredSession.a5e7f14068',
+                  'Retry'
+                )}
+              </Button>
+            ) : null}
           </div>
         ) : null}
       </div>
@@ -182,6 +196,24 @@ export const MessageRow = memo(function MessageRow({
   // Plain assistant prose is the copyable unit; reasoning/system asides stay
   // chrome-free. Controls reveal on hover/keyboard focus and stay visible on touch.
   const showControls = !isReasoning && !isSystem && markdown.length > 0
+  // A subagent's row sits where it happened but speaks as that subagent, never as
+  // the agent the reader is talking to.
+  const subagentName =
+    agentJournalItemSubagentId(message) === null
+      ? null
+      : (subagentLabel ??
+        translate(
+          'components.native-chat.subagents.unnamed',
+          NATIVE_CHAT_SUBAGENT_ATTRIBUTION_COPY.unnamed
+        ))
+  const subagentCaption =
+    subagentLabel === undefined
+      ? subagentName
+      : translate(
+          'components.native-chat.subagents.writtenBy',
+          NATIVE_CHAT_SUBAGENT_ATTRIBUTION_COPY.writtenBy,
+          { value0: subagentLabel }
+        )
 
   return (
     <div
@@ -190,9 +222,22 @@ export const MessageRow = memo(function MessageRow({
         'group relative max-w-full select-text text-sm leading-relaxed text-foreground',
         // Reasoning is the agent thinking aloud — quieter, italic, like an aside.
         isReasoning && 'border-l-2 border-border/60 pl-3 italic text-muted-foreground',
+        subagentName !== null && !isReasoning && 'border-l-2 border-border/60 pl-3',
         isSystem && 'text-xs text-muted-foreground'
       )}
     >
+      {subagentName !== null ? (
+        <div
+          role="note"
+          aria-label={subagentCaption ?? undefined}
+          className="mb-1 flex min-h-5 items-center gap-1.5 not-italic text-muted-foreground"
+        >
+          <Bot aria-hidden className="size-3.5 shrink-0" />
+          <code aria-hidden className="min-w-0 truncate font-mono text-[11px]">
+            {subagentName}
+          </code>
+        </div>
+      ) : null}
       <NativeChatImageAttachments
         blocks={prose}
         runtimeContext={runtimeContext}
@@ -222,7 +267,6 @@ export const MessageRow = memo(function MessageRow({
           expandSignal={expandSignal}
           activeTurnIsWorking={activeTurnIsWorking}
           trailing={trailingRun}
-          structuredActivityUi={structuredActivityUi}
           disclosureId={message.id}
         />
       ) : null}
@@ -231,7 +275,7 @@ export const MessageRow = memo(function MessageRow({
           markdown={markdown}
           timestamp={message.timestamp}
           onScrollToTop={scrollToTop}
-          className="mt-1 -mb-5 w-fit select-none transition-opacity can-hover:pointer-events-none can-hover:opacity-0 group-hover:pointer-events-auto group-hover:opacity-100 group-has-[:focus-visible]:pointer-events-auto group-has-[:focus-visible]:opacity-100"
+          className="mt-1 -mb-5 w-fit select-none transition-opacity can-hover:pointer-events-none can-hover:opacity-0 group-hover:pointer-events-auto group-hover:opacity-100 [.group:has(:focus-visible)_&]:pointer-events-auto [.group:has(:focus-visible)_&]:opacity-100"
         />
       ) : null}
     </div>
diff --git a/src/renderer/src/components/native-chat/NativeChatQuestionCard.test.tsx b/src/renderer/src/components/native-chat/NativeChatQuestionCard.test.tsx
index 9b1a2967682..189815f2478 100644
--- a/src/renderer/src/components/native-chat/NativeChatQuestionCard.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatQuestionCard.test.tsx
@@ -69,6 +69,21 @@ function clickAction(text: string): void {
   click(button, text)
 }
 
+function typeAnswer(value: string): void {
+  const input = container.querySelector('input')!
+  act(() => {
+    const setter = Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value')!.set!
+    setter.call(input, value)
+    input.dispatchEvent(new Event('input', { bubbles: true }))
+  })
+}
+
+function optionPressed(label: string): string | null | undefined {
+  return [...container.querySelectorAll('button[aria-pressed]')]
+    .find((b) => b.textContent?.includes(label))
+    ?.getAttribute('aria-pressed')
+}
+
 const tabsOrSpaces: AskPrompt = {
   questions: [
     {
@@ -222,4 +237,123 @@ describe('NativeChatQuestionCard', () => {
       { indices: [], other: 'SSH host' }
     ])
   })
+
+  it('replaces a picked option with a typed answer on a single-select question', () => {
+    const onAnswer = vi.fn()
+    render(tabsOrSpaces, onAnswer)
+
+    clickOption('Spaces')
+    typeAnswer('two spaces')
+    expect(optionPressed('Spaces')).toBe('false')
+    clickAction('Submit')
+
+    expect(onAnswer).toHaveBeenCalledWith([{ indices: [], other: 'two spaces' }])
+  })
+
+  it('keeps typed text in the field but sends a later-picked option', () => {
+    const onAnswer = vi.fn()
+    render(tabsOrSpaces, onAnswer)
+
+    typeAnswer('two spaces')
+    clickOption('Tabs')
+    expect(container.querySelector('input')!.value).toBe('two spaces')
+    clickAction('Submit')
+
+    expect(onAnswer).toHaveBeenCalledWith([{ indices: [0], other: '' }])
+  })
+
+  it('chooses the kept typed text again when its field is clicked', () => {
+    const onAnswer = vi.fn()
+    render(tabsOrSpaces, onAnswer)
+
+    typeAnswer('two spaces')
+    clickOption('Tabs')
+    act(() => {
+      container.querySelector('input')!.dispatchEvent(new MouseEvent('click', { bubbles: true }))
+    })
+    expect(optionPressed('Tabs')).toBe('false')
+    clickAction('Submit')
+
+    expect(onAnswer).toHaveBeenCalledWith([{ indices: [], other: 'two spaces' }])
+  })
+
+  it('ignores a click on the answer field while the answer is sending', () => {
+    const renderCard = (isSubmitting: boolean): void => {
+      act(() => {
+        root.render(
+          <NativeChatQuestionCard
+            prompt={tabsOrSpaces}
+            onAnswer={vi.fn()}
+            onCancel={() => {}}
+            isSubmitting={isSubmitting}
+          />
+        )
+      })
+    }
+    renderCard(false)
+    typeAnswer('two spaces')
+    clickOption('Tabs')
+    renderCard(true)
+    // Chromium still delivers pointer events to a disabled input.
+    const input = container.querySelector('input')!
+    act(() => {
+      input.dispatchEvent(new MouseEvent('pointerdown', { bubbles: true }))
+      input.dispatchEvent(new MouseEvent('click', { bubbles: true }))
+    })
+
+    expect(optionPressed('Tabs')).toBe('true')
+  })
+
+  it('keeps the picked option when keyboard focus passes through the field', () => {
+    const onAnswer = vi.fn()
+    render(tabsOrSpaces, onAnswer)
+
+    typeAnswer('two spaces')
+    clickOption('Tabs')
+    act(() => {
+      container.querySelector('input')!.dispatchEvent(new FocusEvent('focusin', { bubbles: true }))
+    })
+    clickAction('Submit')
+
+    expect(onAnswer).toHaveBeenCalledWith([{ indices: [0], other: '' }])
+  })
+
+  it('leaves nothing chosen when a picked option is unpicked over kept text', () => {
+    const onAnswer = vi.fn()
+    render(tabsOrSpaces, onAnswer)
+
+    typeAnswer('two spaces')
+    clickOption('Tabs')
+    clickOption('Tabs')
+
+    expect(optionPressed('Tabs')).toBe('false')
+    expect(
+      [...container.querySelectorAll('button')].some((b) => b.textContent?.trim() === 'Skip')
+    ).toBe(true)
+    expect(onAnswer).not.toHaveBeenCalled()
+  })
+
+  it('sends picked options and typed text together on a multi-select question', () => {
+    const onAnswer = vi.fn()
+    render(
+      {
+        questions: [
+          {
+            question: 'Which targets?',
+            multiSelect: true,
+            options: [{ label: 'Web' }, { label: 'Mobile' }]
+          }
+        ]
+      },
+      onAnswer
+    )
+
+    clickOption('Mobile')
+    typeAnswer('Desktop')
+    typeAnswer('')
+    typeAnswer('Desktop app')
+    clickAction('Submit')
+
+    expect(onAnswer).toHaveBeenCalledWith([{ indices: [1], other: 'Desktop app' }])
+  })
 })
diff --git a/src/renderer/src/components/native-chat/NativeChatQuestionCard.tsx b/src/renderer/src/components/native-chat/NativeChatQuestionCard.tsx
index 0167fbb61f3..e26131d96f0 100644
--- a/src/renderer/src/components/native-chat/NativeChatQuestionCard.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatQuestionCard.tsx
@@ -18,11 +18,16 @@ export type NativeChatQuestionCardProps = {
   answerInputRef?: RefObject<HTMLInputElement | null>
 }
 
+// Selection entry for the typed answer (never a real option index), so a single-select
+// question holds exactly one choice: an option or the typed answer.
+const TYPED_ANSWER = -1
+
 /**
  * Native renderer for an agent's AskUserQuestion prompt: a numbered pick-list
  * (mobile/Claude-Code parity) with a header + close, a hover-highlighted row per
  * option, and an optional free-text row for a custom answer. Single-select
- * commits on click; multi-select toggles and confirms via the trailing action.
+ * holds one answer (an option or the typed text, whichever was chosen last);
+ * multi-select toggles options, adds any typed text, and confirms via the trailing action.
  * Multi-question prompts step through tabs across the top. Neutral shadcn tokens.
  */
 export function NativeChatQuestionCard({
@@ -44,29 +49,55 @@ export function NativeChatQuestionCard({
   const q = prompt.questions[index]!
   const questionAllowsOther = Array.isArray(allowOther) ? (allowOther[index] ?? false) : allowOther
 
+  // Picking an option replaces a chosen typed answer on single-select; the text stays in
+  // the field, unsent, until the user types or clicks there again.
+  const typedAnswerChosen = (qi: number, sel = selections, oth = otherText): boolean =>
+    (sel[qi] ?? []).includes(TYPED_ANSWER) && (oth[qi] ?? '').trim().length > 0
+
+  const chooseTypedAnswer = (qi: number): void => {
+    setSelections((prev) => {
+      const cur = prev[qi] ?? []
+      if (cur.includes(TYPED_ANSWER)) {
+        return prev
+      }
+      const chosen = prompt.questions[qi]?.multiSelect ? [...cur, TYPED_ANSWER] : [TYPED_ANSWER]
+      return prev.map((s, i) => (i === qi ? chosen : s))
+    })
+  }
+
+  const pickedOptions = (qi: number, sel = selections): number[] =>
+    (sel[qi] ?? []).filter((choice) => choice !== TYPED_ANSWER)
+
   const setOther = (qi: number, value: string): void => {
     setOtherText((prev) => {
       const next = [...prev]
       next[qi] = value
       return next
     })
+    if (value.trim().length > 0) {
+      chooseTypedAnswer(qi)
+    }
   }
 
-  // The resolved answer for a question: picked labels plus any typed free-text.
+  // The resolved answer for a question: picked labels plus the typed answer when chosen.
   const answerFor = (qi: number, sel = selections, oth = otherText): string => {
     const question = prompt.questions[qi]
-    const picked = (sel[qi] ?? [])
+    const picked = pickedOptions(qi, sel)
       .map((optionIndex) => question?.options[optionIndex]?.label ?? '')
       .filter((label) => label.length > 0)
-    const other = (oth[qi] ?? '').trim()
+    const other = typedAnswerChosen(qi, sel, oth) ? (oth[qi] ?? '').trim() : ''
     return [...picked, ...(other ? [other] : [])].join(', ')
   }
 
   const currentAnswered = answerFor(index).length > 0
+  const currentTypedAnswerChosen = typedAnswerChosen(index)
 
   const submitAll = (sel: number[][], oth: string[]): void => {
     const resolved: AskAnswerSelection[] = prompt.questions.map((_, i) => {
-      return { indices: [...(sel[i] ?? [])], other: (oth[i] ?? '').trim() }
+      return {
+        indices: pickedOptions(i, sel),
+        other: typedAnswerChosen(i, sel, oth) ? (oth[i] ?? '').trim() : ''
+      }
     })
     const anyAnswered = resolved.some((s) => s.indices.length > 0 || (s.other ?? '').length > 0)
     if (anyAnswered) {
@@ -192,8 +223,19 @@ export function NativeChatQuestionCard({
             <div className="flex items-center gap-3 px-3.5 py-2.5">
               {questionAllowsOther ? (
                 <>
-                  <span className="flex size-6 shrink-0 items-center justify-center rounded-md bg-muted text-muted-foreground">
-                    <Pencil className="size-3.5" />
+                  <span
+                    className={cn(
+                      'flex size-6 shrink-0 items-center justify-center rounded-md',
+                      currentTypedAnswerChosen
+                        ? 'bg-primary text-primary-foreground'
+                        : 'bg-muted text-muted-foreground'
+                    )}
+                  >
+                    {currentTypedAnswerChosen ? (
+                      <Check className="size-3.5" strokeWidth={3} />
+                    ) : (
+                      <Pencil className="size-3.5" />
+                    )}
                   </span>
                   {/* No `/` or `@` picker here — that autocomplete belongs to the composer,
                       which this card replaces. What you type is delivered verbatim as the
@@ -205,6 +247,13 @@ export function NativeChatQuestionCard({
                     disabled={isSubmitting}
                     value={otherText[index]}
                     onChange={(e) => setOther(index, e.target.value)}
+                    // Click, not focus: tabbing through the field toward Submit must not
+                    // replace the option the user just picked.
+                    onClick={() => {
+                      if ((otherText[index] ?? '').trim().length > 0) {
+                        chooseTypedAnswer(index)
+                      }
+                    }}
                     onKeyDown={(e) => {
                       if (e.key === 'Enter') {
                         e.preventDefault()
@@ -215,7 +264,12 @@ export function NativeChatQuestionCard({
                       'components.native-chat.question.otherPlaceholder',
                       'Type your answer'
                     )}
-                    className="min-w-0 flex-1 bg-transparent text-sm text-foreground outline-none placeholder:text-muted-foreground/60 disabled:cursor-default disabled:opacity-50"
+                    className={cn(
+                      'min-w-0 flex-1 bg-transparent text-sm outline-none placeholder:text-muted-foreground/60 disabled:cursor-default disabled:opacity-50',
+                      currentTypedAnswerChosen || !otherText[index]
+                        ? 'text-foreground'
+                        : 'text-muted-foreground'
+                    )}
                   />
                 </>
               ) : (
diff --git a/src/renderer/src/components/native-chat/NativeChatResolutionReceipt.test.tsx b/src/renderer/src/components/native-chat/NativeChatResolutionReceipt.test.tsx
index 8dc70aab15e..72f1f62c21d 100644
--- a/src/renderer/src/components/native-chat/NativeChatResolutionReceipt.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatResolutionReceipt.test.tsx
@@ -1,11 +1,19 @@
 // @vitest-environment happy-dom
 import '@testing-library/jest-dom/vitest'
-import { act, cleanup, render, screen } from '@testing-library/react'
+import { act, cleanup, fireEvent, render, screen } from '@testing-library/react'
 import { afterEach, describe, expect, it } from 'vitest'
 import { i18n } from '@/i18n/i18n'
-import type { AgentJournalQuestionItem } from '../../../../shared/agent-session-journal-types'
+import type {
+  AgentJournalQuestionItem,
+  AgentJournalRenderItem
+} from '../../../../shared/agent-session-journal-types'
 import { encodeAgentSessionQuestionAnswers } from '../../../../shared/agent-session-question-answer'
 import { NativeChatResolutionReceipt } from './NativeChatResolutionReceipt'
+import { structuredQuestionTranscript } from './structured-agent-question-projection'
+import {
+  NativeChatDisclosureContext,
+  useNativeChatDisclosures
+} from './native-chat-disclosure-store'
 import {
   nativeChatReceiptAnswers,
   type NativeChatResolvedPrompt
@@ -210,6 +218,203 @@ describe('resolution receipts', () => {
     expect(screen.queryByText('1 grouped question from Claude')).toBeNull()
   })
 
+  it('keeps an opened question open once it is answered', () => {
+    const scrollWidth = Object.getOwnPropertyDescriptor(HTMLElement.prototype, 'scrollWidth')
+    Object.defineProperty(HTMLElement.prototype, 'scrollWidth', {
+      configurable: true,
+      get: () => 400
+    })
+    const pendingBody: AgentJournalQuestionItem = {
+      kind: 'question',
+      question: 'Which of the three migration strategies should I use?',
+      options: [{ id: 'a', label: 'Strategy A' }],
+      resolution: { ...approval.resolution, state: 'pending', selectedOptionId: null }
+    }
+    function Harness({ body }: { body: AgentJournalQuestionItem }): React.JSX.Element {
+      const disclosures = useNativeChatDisclosures()
+      return (
+        <NativeChatDisclosureContext.Provider value={disclosures}>
+          <NativeChatResolutionReceipt body={body} disclosureId="message-1" />
+        </NativeChatDisclosureContext.Provider>
+      )
+    }
+    try {
+      const { rerender } = render(<Harness body={pendingBody} />)
+      fireEvent.click(screen.getByRole('button', { name: /Awaiting user input:/ }))
+
+      rerender(
+        <Harness
+          body={{ ...pendingBody, resolution: { ...approval.resolution, selectedOptionId: 'a' } }}
+        />
+      )
+      expect(screen.getByRole('button', { name: /Asked:/ })).toHaveAttribute(
+        'aria-expanded',
+        'true'
+      )
+    } finally {
+      if (scrollWidth) {
+        Object.defineProperty(HTMLElement.prototype, 'scrollWidth', scrollWidth)
+      } else {
+        Reflect.deleteProperty(HTMLElement.prototype, 'scrollWidth')
+      }
+    }
+  })
+
+  describe('a grouped question', () => {
+    const FIRST = 'Which of the three migration strategies should I use for the orders table?'
+    const SECOND = 'Should the old columns be dropped in the same release?'
+    const grouped: AgentJournalQuestionItem = {
+      kind: 'question',
+      question: '2 grouped questions from Claude',
+      options: [],
+      questions: [
+        { id: 'q1', question: FIRST, multiSelect: false, options: [{ id: 'a', label: 'A' }] },
+        { id: 'q2', question: SECOND, multiSelect: false, options: [{ id: 'y', label: 'Yes' }] }
+      ],
+      resolution: { state: 'cancelled', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
+    }
+
+    function Harness({
+      body,
+      mounted = true
+    }: {
+      body: AgentJournalQuestionItem
+      mounted?: boolean
+    }): React.JSX.Element {
+      const disclosures = useNativeChatDisclosures()
+      return (
+        <NativeChatDisclosureContext.Provider value={disclosures}>
+          {mounted ? <NativeChatResolutionReceipt body={body} disclosureId="message-1" /> : null}
+        </NativeChatDisclosureContext.Provider>
+      )
+    }
+
+    it('lists every question of a cancelled prompt below its toggle', () => {
+      const { rerender } = render(<Harness body={grouped} />)
+      const toggle = screen.getByRole('button', { name: /Asked:\s*2 questions/ })
+      expect(toggle).toHaveAttribute('aria-expanded', 'false')
+      expect(screen.queryByText(FIRST)).toBeNull()
+
+      fireEvent.click(toggle)
+      expect(toggle).toHaveAttribute('aria-expanded', 'true')
+      // The count stays on the line; the list opens outside the button, as prose.
+      expect(toggle).toHaveTextContent('2 questions')
+      const items = screen.getAllByRole('listitem')
+      expect(items.map((item) => item.textContent)).toEqual([FIRST, SECOND])
+      expect(items[0]?.closest('button')).toBeNull()
+      fireEvent.click(items[0]!)
+      expect(toggle).toHaveAttribute('aria-expanded', 'true')
+
+      rerender(<Harness body={grouped} mounted={false} />)
+      rerender(<Harness body={grouped} />)
+      const remounted = screen.getByRole('button', { name: /Asked:/ })
+      expect(remounted).toHaveAttribute('aria-expanded', 'true')
+      expect(screen.getByText(SECOND)).toBeInTheDocument()
+
+      // Folding keeps the same control, so keyboard focus is not dropped.
+      remounted.focus()
+      fireEvent.click(remounted)
+      expect(document.activeElement).toBe(remounted)
+      expect(remounted).toHaveAttribute('aria-expanded', 'false')
+      expect(screen.queryByRole('list')).toBeNull()
+    })
+
+    it('lists the questions of a pending group the card may not be showing', () => {
+      render(
+        <Harness body={{ ...grouped, resolution: { ...grouped.resolution, state: 'pending' } }} />
+      )
+      fireEvent.click(screen.getByRole('button', { name: /Awaiting user input:\s*2 questions/ }))
+      expect(screen.getAllByRole('listitem').map((item) => item.textContent)).toEqual([
+        FIRST,
+        SECOND
+      ])
+    })
+
+    it('does not carry an opened Codex group onto its first question once answered', () => {
+      const codexQuestion = (
+        itemId: string,
+        question: string,
+        resolution: AgentJournalQuestionItem['resolution'] = {
+          state: 'pending',
+          selectedOptionId: null,
+          resolvedBy: null,
+          resolvedAt: null
+        }
+      ): AgentJournalRenderItem => ({
+        itemId,
+        sequence: 1,
+        revision: 1,
+        observedAt: 1,
+        body: {
+          kind: 'question',
+          question,
+          options: [{ id: `${itemId}-a`, label: 'A' }],
+          resolution
+        }
+      })
+      const receiptFor = (items: AgentJournalRenderItem[]): AgentJournalQuestionItem => {
+        const body = structuredQuestionTranscript(items).receipts.get('message-1')
+        if (body?.kind !== 'question') {
+          throw new Error('expected a question receipt')
+        }
+        return body
+      }
+      const second = codexQuestion('message-2', SECOND)
+      const { rerender } = render(
+        <Harness body={receiptFor([codexQuestion('message-1', 'Branch?'), second])} />
+      )
+      fireEvent.click(screen.getByRole('button', { name: /Awaiting user input:\s*2 questions/ }))
+      expect(screen.getByText('Branch?')).toBeInTheDocument()
+
+      // Answering the first question gives it its own row under the group's id.
+      const answered = codexQuestion('message-1', 'Branch?', {
+        state: 'resolved',
+        selectedOptionId: 'message-1-a',
+        resolvedBy: null,
+        resolvedAt: 1000
+      })
+      rerender(<Harness body={receiptFor([answered, second])} />)
+      expect(screen.getByText('Branch?')).toHaveClass('truncate')
+      expect(screen.queryByRole('button')).toBeNull()
+    })
+
+    it('stays plain once answered, since each question is listed with its answer', () => {
+      render(
+        <Harness
+          body={{
+            ...grouped,
+            resolution: {
+              state: 'resolved',
+              selectedOptionId: null,
+              answers: [
+                { questionId: 'q1', optionIds: ['a'] },
+                { questionId: 'q2', optionIds: ['y'] }
+              ],
+              resolvedBy: null,
+              resolvedAt: 1000
+            }
+          }}
+        />
+      )
+      expect(screen.getByText('2 questions')).toBeInTheDocument()
+      expect(screen.queryByRole('button')).toBeNull()
+      expect(screen.getAllByText(FIRST)).toHaveLength(1)
+      expect(screen.getAllByText(SECOND)).toHaveLength(1)
+      expect(screen.getByText('Yes')).toBeInTheDocument()
+    })
+
+    it('leaves a cancelled single question that fits its line as plain text', () => {
+      render(
+        <Harness
+          body={{ ...grouped, question: FIRST, questions: grouped.questions?.slice(0, 1) }}
+        />
+      )
+      expect(screen.getByText(FIRST)).toHaveClass('truncate')
+      expect(screen.queryByRole('button')).toBeNull()
+      expect(screen.queryByRole('list')).toBeNull()
+    })
+  })
+
   it('decodes single free-text answers only for the declared question', () => {
     const body: AgentJournalQuestionItem = {
       kind: 'question',
@@ -225,4 +430,22 @@ describe('resolution receipts', () => {
       ).toEqual([{ question: null, answer: null }])
     }
   })
+
+  it('reads the recorded structured answers before the packed form', () => {
+    const typed = 'Wait for the capture to finish. '.repeat(50).trim()
+    const body: AgentJournalQuestionItem = {
+      kind: 'question',
+      question: 'Name?',
+      options: [{ id: 'q1:choice-1', label: 'Default' }],
+      freeTextQuestionId: 'q1',
+      resolution: {
+        ...approval.resolution,
+        // The packed copy only older clients read; it must not win over the recorded answer.
+        selectedOptionId: 'q1:choice-1',
+        answers: [{ questionId: 'q1', optionIds: [], other: typed }]
+      }
+    }
+
+    expect(nativeChatReceiptAnswers(body)).toEqual([{ question: null, answer: typed }])
+  })
 })
diff --git a/src/renderer/src/components/native-chat/NativeChatResolutionReceipt.tsx b/src/renderer/src/components/native-chat/NativeChatResolutionReceipt.tsx
index d6587fe9f00..a1906a27197 100644
--- a/src/renderer/src/components/native-chat/NativeChatResolutionReceipt.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatResolutionReceipt.tsx
@@ -8,15 +8,19 @@ import {
 } from './native-chat-resolution-receipt'
 
 export function NativeChatResolutionReceipt({
-  body
+  body,
+  disclosureId
 }: {
   body: NativeChatResolvedPrompt
+  /** Message this receipt stands in for; keys the question row's disclosure. */
+  disclosureId?: string
 }): React.JSX.Element | null {
+  const askDisclosureKey = disclosureId === undefined ? undefined : `ask:${disclosureId}`
   const subject: NativeChatAskRowSubject | null =
     body.kind !== 'question'
       ? null
       : body.questions && body.questions.length > 1
-        ? { kind: 'count', count: body.questions.length }
+        ? { kind: 'questions', questions: body.questions.map((entry) => entry.question) }
         : {
             kind: 'question',
             // Claude keeps a generic grouped label for a single multi-select
@@ -31,11 +35,12 @@ export function NativeChatResolutionReceipt({
           }
   if (body.resolution.state === 'pending') {
     return body.kind === 'question' ? (
-      <NativeChatAwaitingInputRow subject={subject} pending />
+      <NativeChatAwaitingInputRow subject={subject} pending disclosureKey={askDisclosureKey} />
     ) : null
   }
   const { resolution } = body
   const title = body.kind === 'approval' ? (body.displayName ?? body.title) : body.question
+  // Non-empty only once resolved, and then each question is listed with its answer.
   const answers = nativeChatReceiptAnswers(body)
   return (
     <div
@@ -43,7 +48,12 @@ export function NativeChatResolutionReceipt({
       data-native-chat-receipt={body.kind}
     >
       {body.kind === 'question' ? (
-        <NativeChatAwaitingInputRow pending={false} subject={subject} />
+        <NativeChatAwaitingInputRow
+          pending={false}
+          subject={subject}
+          disclosureKey={askDisclosureKey}
+          listsQuestions={answers.length === 0}
+        />
       ) : (
         <div className="font-medium">{title}</div>
       )}
diff --git a/src/renderer/src/components/native-chat/NativeChatResolvedView.tsx b/src/renderer/src/components/native-chat/NativeChatResolvedView.tsx
index e711d62245a..786ade25ebc 100644
--- a/src/renderer/src/components/native-chat/NativeChatResolvedView.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatResolvedView.tsx
@@ -6,16 +6,17 @@ import { useNativeChatRetainedSession } from './use-native-chat-retained-session
 import { isNativeChatTranscriptUnsettled } from './native-chat-live-session-contract'
 import { selectNativeChatViewState } from './native-chat-view-state'
 import { NativeChatMessageList } from './NativeChatMessageList'
+import { useNativeChatLaunchPromptDeliveryNotice } from './use-native-chat-launch-prompt-delivery-notice'
 import { NativeChatComposer, type NativeChatComposerHandle } from './NativeChatComposer'
 import { useNativeChatFontScale } from './use-native-chat-font-scale'
 import { useNativeChatCanSend } from './use-native-chat-can-send'
 import { NativeChatInteractiveCard } from './NativeChatInteractiveCard'
+import { useNativeChatInteractivePromptCard } from './use-native-chat-interactive-prompt-card'
 import { NativeChatEmptyState } from './NativeChatEmptyState'
 import { useNativeChatInteractiveSend } from './use-native-chat-interactive-send'
-import {
-  shouldClearNativeChatWorkingSuppression,
-  shouldShowNativeChatWorking
-} from './native-chat-working-suppression'
+import { shouldClearNativeChatWorkingSuppression } from './native-chat-working-suppression'
+import { resolveNativeChatTerminalTurn } from './native-chat-terminal-turn'
+import { useNativeChatTerminalTurnTiming } from './use-native-chat-terminal-turn-timing'
 import {
   appendPendingSendCache,
   launchPromptAsMessage,
@@ -246,13 +247,15 @@ export function NativeChatResolvedView({
       ? sessionWithLaunchPrompt
       : { ...sessionWithLaunchPrompt, messages }
   }, [sessionWithLaunchPrompt, commandMarkers])
-  const failedLaunchPromptMessageIds = useMemo(() => {
-    const id = paneLaunchPrompt?.failed ? launchPromptMessage?.id : null
-    if (!id || !sessionAfterCommandBoundaries.messages.some((message) => message.id === id)) {
-      return undefined
-    }
-    return new Set([id])
-  }, [paneLaunchPrompt?.failed, launchPromptMessage?.id, sessionAfterCommandBoundaries.messages])
+  const launchPromptDeliveryNotices = useNativeChatLaunchPromptDeliveryNotice(
+    paneLaunchPrompt?.failed ? launchPromptMessage?.id : null,
+    sessionAfterCommandBoundaries.messages
+  )
+  const promptCard = useNativeChatInteractivePromptCard({
+    paneKey,
+    messages: sessionAfterCommandBoundaries.messages,
+    transcriptSettled: session.readPhase === 'ready'
+  })
 
   // The streaming preview bubble (if any) sits after the transcript but before
   // the optimistic user echoes — same order mobile uses.
@@ -315,11 +318,14 @@ export function NativeChatResolvedView({
       previousWorkingEpochRef.current = null
     }
   }, [liveWorking, workingInterrupted, hookWorkingEpoch])
-  const isWorking = shouldShowNativeChatWorking({
+  const { isWorking, turnActive, awaitingInput } = resolveNativeChatTerminalTurn({
     isConversation,
     working: liveWorking,
-    interrupted: workingInterrupted
+    hookAwaitingInput: session.hookAwaitingInput === true,
+    interrupted: workingInterrupted,
+    hasPromptCard: promptCard !== null
   })
+  const turnTiming = useNativeChatTerminalTurnTiming(paneKey, session.messages, turnActive)
 
   const stopAgent = useCallback(() => {
     setWorkingInterrupted(true)
@@ -401,14 +407,14 @@ export function NativeChatResolvedView({
           <NativeChatMessageList
             session={sessionWithPending}
             isVisible={isVisible}
-            isWorking={isWorking}
+            isWorking={turnActive}
             expandSignal={false}
             fontScale={fontScale.scale}
-            workingStartedAt={hookWorkingEpoch}
-            showTurnStatus={false}
+            {...turnTiming}
+            awaitingInput={awaitingInput}
             onLinkClick={onLinkClick}
             allowFileUriLinks={fileLinkContext !== null}
-            failedDeliveryMessageIds={failedLaunchPromptMessageIds}
+            deliveryNotices={launchPromptDeliveryNotices}
           />
         )}
       </div>
@@ -416,11 +422,9 @@ export function NativeChatResolvedView({
           (mobile parity). A question card supplies its own answer input, so it
           fully replaces the composer while active — no stray "Send a message". */}
       <NativeChatInteractiveCard
-        paneKey={paneKey}
+        card={promptCard}
         send={interactiveSend}
         canSend={canSend}
-        messages={sessionAfterCommandBoundaries.messages}
-        transcriptSettled={session.readPhase === 'ready'}
         onShowingQuestionChange={setQuestionActive}
         answerInputRef={questionAnswerInputRef}
       />
diff --git a/src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx b/src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx
new file mode 100644
index 00000000000..ba2a7c00de2
--- /dev/null
+++ b/src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx
@@ -0,0 +1,401 @@
+// @vitest-environment happy-dom
+
+import '@testing-library/jest-dom/vitest'
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { act, cleanup, render, screen } from '@testing-library/react'
+import type { AgentStatusEntry, AgentStatusPayload } from '../../../../shared/agent-status-types'
+import type { NativeChatMessage } from '../../../../shared/native-chat-types'
+import type { NativeChatLiveSession } from './use-native-chat-live-session'
+
+// The transcript source and the composer are stubbed; the wire under test is
+// store status -> resolved view -> the shared message list and prompt card.
+const retained = vi.hoisted((): { session: NativeChatLiveSession | null } => ({ session: null }))
+vi.mock('./use-native-chat-retained-session', () => ({
+  useNativeChatRetainedSession: () => retained.session
+}))
+vi.mock('./NativeChatComposer', () => ({ NativeChatComposer: () => null }))
+
+const { NativeChatResolvedView } = await import('./NativeChatResolvedView')
+const { useAppStore } = await import('../../store')
+const { installNativeChatMessageListTestViewport } =
+  await import('./native-chat-message-list-test-viewport')
+
+const paneKey = 'tab-state:leaf-state'
+let restoreViewport = (): void => {}
+
+const userTurn: NativeChatMessage = {
+  id: 'user-1',
+  role: 'user',
+  blocks: [{ type: 'text', text: 'Rename the module' }],
+  timestamp: 1,
+  source: 'transcript'
+}
+
+const askCall: NativeChatMessage = {
+  id: 'ask-1',
+  role: 'assistant',
+  blocks: [
+    {
+      type: 'tool-call',
+      name: 'AskUserQuestion',
+      input: {
+        questions: [
+          {
+            question: 'Which name?',
+            multiSelect: false,
+            options: [{ label: 'core' }, { label: 'base' }]
+          }
+        ]
+      }
+    }
+  ],
+  timestamp: 2,
+  source: 'transcript'
+}
+
+const stepCall: NativeChatMessage = {
+  id: 'step-1',
+  role: 'assistant',
+  blocks: [{ type: 'tool-call', name: 'Bash', input: { command: 'pnpm build' } }],
+  timestamp: 3,
+  source: 'transcript'
+}
+
+// `status` and `hookAwaitingInput` are what the live session reconciles from the
+// same hook row; the test states both so the view is fed a consistent session.
+function transcript(
+  status: NativeChatLiveSession['status'],
+  hookAwaitingInput: boolean,
+  messages: NativeChatMessage[] = [userTurn]
+): NativeChatLiveSession {
+  return {
+    messages,
+    status,
+    sessionId: 'session-state',
+    agent: 'claude',
+    hookAwaitingInput,
+    hasMore: false,
+    loadingEarlier: false,
+    olderHistoryGeneration: 0,
+    loadEarlier: vi.fn(),
+    readPhase: 'ready'
+  }
+}
+
+function setStatus(payload: Omit<AgentStatusPayload, 'prompt' | 'agentType'>, age = 0): void {
+  useAppStore
+    .getState()
+    .setAgentStatus(paneKey, { prompt: 'Rename the module', agentType: 'claude', ...payload })
+  const live = useAppStore.getState().agentStatusByPaneKey[paneKey]
+  if (!live) {
+    throw new Error('the store dropped the status row this test depends on')
+  }
+  useAppStore.setState((store) => ({
+    agentStatusByPaneKey: {
+      ...store.agentStatusByPaneKey,
+      [paneKey]: { ...live, stateStartedAt: Date.now() - age }
+    }
+  }))
+}
+
+function patchStatus(fields: Partial<AgentStatusEntry>): void {
+  useAppStore.setState((store) => ({
+    agentStatusByPaneKey: {
+      ...store.agentStatusByPaneKey,
+      [paneKey]: { ...store.agentStatusByPaneKey[paneKey]!, ...fields }
+    }
+  }))
+}
+
+function renderPane(): void {
+  render(
+    <NativeChatResolvedView
+      paneKey={paneKey}
+      agent="claude"
+      sessionId="session-state"
+      transcriptPath={null}
+      isVisible
+      isFocusedGroup={false}
+      targetPtyId="pty-state"
+      terminalTabId="tab-state"
+      ownsTabWideLaunchDraft={false}
+    />
+  )
+}
+
+function liveActivityLine(): Element | null {
+  return document.querySelector('[data-native-chat-turn-activity]')
+}
+
+beforeEach(() => {
+  restoreViewport = installNativeChatMessageListTestViewport()
+  useAppStore.setState({ agentStatusByPaneKey: {}, nativeChatLaunchPromptByTabId: {} })
+})
+
+afterEach(() => {
+  cleanup()
+  restoreViewport()
+  useAppStore.setState({ agentStatusByPaneKey: {}, nativeChatLaunchPromptByTabId: {} })
+})
+
+// A terminal-backed pane renders through the structured chat's own turn-status
+// UI: the clock bar under the prompt, the live line at the tail, and the row a
+// question uses when the agent waits on the reader.
+describe('NativeChatResolvedView turn status', () => {
+  it('counts the working turn from the host-stamped epoch, with the live line at the tail', () => {
+    retained.session = transcript('working', false)
+    setStatus({ state: 'working' }, 75_000)
+
+    renderPane()
+
+    expect(screen.getByText('Working for 1m 15s')).toBeInTheDocument()
+    expect(liveActivityLine()).toHaveTextContent('Working…')
+    expect(document.querySelectorAll('.animate-bounce')).toHaveLength(0)
+  })
+
+  it.each(['waiting', 'blocked'] as const)(
+    'says a %s agent waits on the reader when only its terminal shows the prompt',
+    (state) => {
+      retained.session = transcript('ready', true)
+      setStatus({ state }, 20_000)
+
+      renderPane()
+
+      // A whole phrase: there is no question to name after a colon.
+      expect(screen.getByText('Awaiting user input')).toBeInTheDocument()
+      expect(liveActivityLine()).toBeNull()
+      // The turn runs on behind the wait, as a structured turn does behind its card.
+      expect(screen.getByText('Working for 20s')).toBeInTheDocument()
+    }
+  )
+
+  it('lets the approval card speak for the wait', () => {
+    retained.session = transcript('ready', true)
+    setStatus({
+      state: 'waiting',
+      interactivePrompt: JSON.stringify({ approval: { tool: 'Bash', summary: 'rm -rf dist' } })
+    })
+
+    renderPane()
+
+    expect(screen.getByText('Allow Bash?')).toBeInTheDocument()
+    expect(screen.queryByText(/Awaiting user input/)).toBeNull()
+    expect(liveActivityLine()).toBeNull()
+    expect(screen.getByText('Working for 0s')).toBeInTheDocument()
+  })
+
+  it("keeps a pending question's transcript row awaiting while the agent waits", () => {
+    retained.session = transcript('ready', true, [userTurn, askCall])
+    setStatus({ state: 'waiting' })
+
+    renderPane()
+
+    // One row says it: the question's own, not a second one at the tail.
+    expect(document.querySelectorAll('[data-native-chat-ask-row="awaiting"]')).toHaveLength(1)
+    expect(screen.getByText('Awaiting user input:')).toBeInTheDocument()
+    expect(screen.getAllByText('Which name?').length).toBeGreaterThan(0)
+    expect(screen.queryByText('Asked:')).toBeNull()
+  })
+
+  // Answering a terminal-only prompt means leaving the chat, which remounts it on return; a reload
+  // also starts the store with no state history. The host's stamp covers both.
+  it("counts a turn it first sees after a wait from the host's turn start, not the last state", () => {
+    retained.session = transcript('working', false)
+    setStatus({ state: 'working' }, 5_000)
+    patchStatus({ turnStartedAt: Date.now() - 90_000, stateHistory: [] })
+
+    renderPane()
+
+    expect(screen.getByText('Working for 1m 30s')).toBeInTheDocument()
+  })
+
+  // A background task holds the row 'working' past the last turn's end, so the row's own epoch is
+  // that turn's; the host stamps the new turn from the main agent's own prompt.
+  it('counts a new turn from its stamp, not a row held open by background work', () => {
+    retained.session = transcript('working', false)
+    setStatus({ state: 'working' })
+    const now = Date.now()
+    patchStatus({
+      stateStartedAt: now - 45 * 60_000,
+      turnStartedAt: now - 5_000,
+      mainAgent: { state: 'working', stateStartedAt: now - 5_000 },
+      stateHistory: []
+    })
+
+    renderPane()
+
+    expect(screen.getByText('Working for 5s')).toBeInTheDocument()
+  })
+
+  it("falls back to the main agent's own clock on a host that stamps no turn", () => {
+    retained.session = transcript('working', false)
+    setStatus({ state: 'working' })
+    const now = Date.now()
+    patchStatus({
+      stateStartedAt: now - 45 * 60_000,
+      mainAgent: { state: 'working', stateStartedAt: now - 5_000 },
+      stateHistory: []
+    })
+
+    renderPane()
+
+    expect(screen.getByText('Working for 5s')).toBeInTheDocument()
+  })
+
+  // An Esc at a permission prompt fires no hook, then the same text is sent again: a new turn.
+  it('counts the same prompt sent again as a new turn', () => {
+    retained.session = transcript('working', false)
+    setStatus({ state: 'working' }, 5_000)
+    const now = Date.now()
+    patchStatus({
+      turnStartedAt: now - 5_000,
+      stateHistory: [
+        { state: 'working', prompt: 'Rename the module', startedAt: now - 600_000 },
+        { state: 'waiting', prompt: 'Rename the module', startedAt: now - 500_000 }
+      ]
+    })
+
+    renderPane()
+
+    expect(screen.getByText('Working for 5s')).toBeInTheDocument()
+  })
+
+  // The reader no longer rebuilds a turn from the history, so an old host reads the state's start.
+  it('falls back to the current state start on a host that stamps no turn', () => {
+    retained.session = transcript('working', false)
+    setStatus({ state: 'working' }, 20_000)
+    const now = Date.now()
+    patchStatus({
+      stateHistory: [
+        { state: 'working', prompt: 'Rename the module', startedAt: now - 90_000 },
+        { state: 'waiting', prompt: 'Rename the module', startedAt: now - 40_000 }
+      ]
+    })
+
+    renderPane()
+
+    expect(screen.getByText('Working for 20s')).toBeInTheDocument()
+  })
+
+  // The host recorded the turn's end, so a pane mounted after it (a switch to the terminal and
+  // back) folds it behind its duration instead of drawing it unfinished.
+  it('shows the host-ended latest turn with its host duration after a remount', () => {
+    retained.session = transcript('ready', false, [userTurn, stepCall])
+    setStatus({ state: 'done' })
+    // One clock read: the duration is the difference of these two stamps.
+    const now = Date.now()
+    patchStatus({ stateStartedAt: now - 10_000, turnStartedAt: now - 100_000 })
+
+    renderPane()
+
+    expect(screen.getByText('Worked for 1m 30s')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Toggle turn details' })).toBeInTheDocument()
+  })
+
+  // The store's staleness drops a silent row after 30 minutes. A wait left unanswered that long
+  // must not read as a finished turn: nothing says it ended.
+  it('does not settle a turn the host went quiet on', () => {
+    retained.session = transcript('ready', true, [userTurn, stepCall])
+    setStatus({ state: 'waiting' }, 60_000)
+    patchStatus({ turnStartedAt: Date.now() - 60_000 })
+
+    renderPane()
+    expect(screen.getByText('Working for 1m 0s')).toBeInTheDocument()
+
+    // The live session reads no hook state once the row is stale, so the wait no longer holds the turn.
+    retained.session = transcript('ready', false, [userTurn, stepCall])
+    act(() => {
+      patchStatus({ updatedAt: Date.now() - 31 * 60_000 })
+    })
+
+    expect(screen.queryByText(/Work(ing|ed) for/)).toBeNull()
+    expect(screen.queryByRole('button', { name: 'Toggle turn details' })).toBeNull()
+    expect(screen.getByText('pnpm build')).toBeInTheDocument()
+  })
+
+  it('folds finished turns from history behind their transcript duration', () => {
+    const at = Date.parse('2026-09-28T10:00:00.000Z')
+    retained.session = transcript('ready', false, [
+      { ...userTurn, timestamp: at },
+      {
+        id: 'answer-1',
+        role: 'assistant',
+        blocks: [{ type: 'text', text: 'Renamed.' }],
+        timestamp: at + 45_000,
+        source: 'transcript'
+      },
+      {
+        id: 'user-2',
+        role: 'user',
+        blocks: [{ type: 'text', text: 'Now add tests' }],
+        timestamp: at + 100_000,
+        source: 'transcript'
+      }
+    ])
+    setStatus({ state: 'done' }, 60_000)
+
+    renderPane()
+
+    expect(screen.getByText('Worked for 45s')).toBeInTheDocument()
+    // The latest turn has no recorded end, and this pane never watched it.
+    expect(screen.getAllByText(/Work(ing|ed) for/)).toHaveLength(1)
+  })
+
+  // The transcript draws no row for harness notices, so they cannot end a turn either.
+  it('keeps a running turn open across a harness notice injected mid-turn', () => {
+    const at = Date.parse('2026-09-28T10:00:00.000Z')
+    retained.session = transcript('working', false, [
+      { ...userTurn, timestamp: at },
+      {
+        id: 'progress-1',
+        role: 'assistant',
+        blocks: [{ type: 'text', text: 'Starting the build.' }],
+        timestamp: at + 10_000,
+        source: 'transcript'
+      },
+      {
+        id: 'notice-1',
+        role: 'user',
+        blocks: [{ type: 'text', text: '<task-notification>\n<task-id>b1</task-id>' }],
+        timestamp: at + 20_000,
+        source: 'transcript'
+      },
+      {
+        id: 'progress-2',
+        role: 'assistant',
+        blocks: [{ type: 'text', text: 'Build finished, checking output.' }],
+        timestamp: at + 25_000,
+        source: 'transcript'
+      }
+    ])
+    setStatus({ state: 'working' }, 30_000)
+
+    renderPane()
+
+    expect(screen.getByText('Working for 30s')).toBeInTheDocument()
+    expect(screen.getByText('Starting the build.')).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Toggle turn details' })).toBeNull()
+  })
+
+  it('stays quiet on a settled turn it never watched', () => {
+    retained.session = transcript('ready', false)
+    setStatus({ state: 'done' }, 60_000)
+
+    renderPane()
+
+    expect(screen.queryByText(/Awaiting user input/)).toBeNull()
+    expect(screen.queryByText(/Work(ing|ed) for/)).toBeNull()
+    expect(liveActivityLine()).toBeNull()
+  })
+
+  it('stays quiet when the pane has no status at all', () => {
+    retained.session = transcript('ready', false)
+
+    renderPane()
+
+    expect(screen.queryByText(/Awaiting user input/)).toBeNull()
+    expect(screen.queryByText(/Work(ing|ed) for/)).toBeNull()
+    expect(liveActivityLine()).toBeNull()
+  })
+})
diff --git a/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.test.tsx b/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.test.tsx
index cb777f910f2..f86fc972c22 100644
--- a/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.test.tsx
@@ -4,6 +4,10 @@ import { cleanup, render, screen, waitFor } from '@testing-library/react'
 import type * as ReactModule from 'react'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { SessionOptionDescriptor } from '../../../../shared/native-chat-session-options'
+import { RuntimeRpcCallError } from '@/runtime/runtime-rpc-result'
+
+const toastError = vi.hoisted(() => vi.fn())
+vi.mock('sonner', () => ({ toast: { error: toastError } }))
 
 vi.mock('@/i18n/i18n', () => ({
   translate: (_key: string, fallback: string, values?: Record<string, string | number>) => {
@@ -441,6 +445,55 @@ describe('NativeChatSessionOptionPickers', () => {
     await waitFor(() => expect(invokeAction).toHaveBeenCalledWith('model'))
   })
 
+  it.each([
+    [
+      "the table's words for a host's refusal, not its message",
+      new RuntimeRpcCallError({
+        id: 'request-1',
+        ok: false,
+        error: {
+          code: 'runtime_error',
+          message: 'agent_session_journal_unreadable',
+          data: {
+            refusal: {
+              code: 'agent_session_journal_unreadable',
+              details: { reason: 'journalCorrupt' }
+            }
+          }
+        },
+        _meta: { runtimeId: 'runtime-1' }
+      }),
+      "Unable to load this chat. The setting wasn't changed."
+    ],
+    [
+      "a local surface's own sentence",
+      new Error('The terminal did not accept the command.'),
+      'The terminal did not accept the command.'
+    ]
+  ])('describes a failed option change with %s', async (_label, error, description) => {
+    toastError.mockClear()
+    const invokeAction = vi.fn().mockRejectedValue(error)
+    render(
+      <NativeChatSessionOptionPickers
+        surface={{ ...surface, invokeAction }}
+        snapshot={[
+          model({
+            kind: { type: 'select', choices: [{ value: 'gpt-5.5', label: 'GPT-5.5' }] },
+            valueSource: 'unknown',
+            action: { type: 'agent-picker' }
+          })
+        ]}
+        isWorking={false}
+      />
+    )
+    screen.getByRole('button', { name: 'Choose in agent picker…' }).click()
+    await waitFor(() =>
+      expect(toastError).toHaveBeenCalledExactlyOnceWith('Could not update option', {
+        description
+      })
+    )
+  })
+
   it('uses a Toggle action for unknown flip-only options via invokeAction', async () => {
     const invokeAction = vi.fn().mockResolvedValue({ snapshot: [] })
     const setOption = vi.fn().mockResolvedValue({ snapshot: [] })
diff --git a/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.tsx b/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.tsx
index 507103d485f..0dacff0289e 100644
--- a/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.tsx
@@ -32,6 +32,9 @@ import {
   nativeChatSessionOptionLabel
 } from './native-chat-session-option-labels'
 import type { NativeChatOptionPickerRequest } from './native-chat-composer-types'
+import { agentSessionThrownFailure } from '../../../../shared/agent-session-write-failure'
+import { RuntimeRpcCallError } from '@/runtime/runtime-rpc-result'
+import { agentSessionWriteFailureText } from './agent-session-write-notice-text'
 
 export type NativeChatSessionOptionPickersProps = {
   surface: SessionOptionsSurface | null
@@ -204,6 +207,15 @@ function DescriptorMenuRows(props: {
   )
 }
 
+/** A host's error is words for its log, so it gets the table's; a local surface's error is
+ *  already written for the person. */
+function optionUpdateFailureDescription(error: unknown): string {
+  if (error instanceof RuntimeRpcCallError) {
+    return agentSessionWriteFailureText(agentSessionThrownFailure(error, error.code), 'option')
+  }
+  return error instanceof Error ? error.message : String(error)
+}
+
 function runSurfaceCall(
   pendingKey: string,
   setPendingId: (id: string | null) => void,
@@ -214,7 +226,7 @@ function runSurfaceCall(
     .catch((error) => {
       toast.error(
         translate('components.native-chat.composer.optionUpdateFailed', 'Could not update option'),
-        { description: error instanceof Error ? error.message : String(error) }
+        { description: optionUpdateFailureDescription(error) }
       )
     })
     .finally(() => setPendingId(null))
diff --git a/src/renderer/src/components/native-chat/NativeChatStructuredSession.goal-dock.test.tsx b/src/renderer/src/components/native-chat/NativeChatStructuredSession.goal-dock.test.tsx
index 471f1b636d2..c3c08f6647e 100644
--- a/src/renderer/src/components/native-chat/NativeChatStructuredSession.goal-dock.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatStructuredSession.goal-dock.test.tsx
@@ -35,7 +35,7 @@ const STRIP = '[data-native-chat-background-tasks]'
 const GOAL = '[data-native-chat-thread-goal]'
 // The seam is CSS on DOM adjacency: the strip styles itself when a goal tab follows
 // it, and the goal tab styles itself when the strip precedes it.
-const STRIP_DOCK_RULE = /^group-has-\[\+\[([a-z-]+)\]\]\/tasks:(.+)$/
+const STRIP_DOCK_RULE = /^\[\[data-native-chat-background-tasks\]:has\(\+\[([a-z-]+)\]\)_&\]:(.+)$/
 const GOAL_DOCK_RULE = /^group-\[\[([a-z-]+)\]\+&\]\/goal:(.+)$/
 
 function dockRules(root: Element, rule: RegExp): { attribute: string; utility: string }[] {
diff --git a/src/renderer/src/components/native-chat/NativeChatStructuredSession.launch-lifecycle.test.tsx b/src/renderer/src/components/native-chat/NativeChatStructuredSession.launch-lifecycle.test.tsx
index 9513d0cfeb6..644c1c65750 100644
--- a/src/renderer/src/components/native-chat/NativeChatStructuredSession.launch-lifecycle.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatStructuredSession.launch-lifecycle.test.tsx
@@ -26,6 +26,14 @@ vi.mock('./NativeChatQuestionCard', () => moduleFactories.nativeChatQuestionCard
 import { NativeChatStructuredSession } from './NativeChatStructuredSession'
 import { readOutbox } from './structured-agent-session-outbox-storage'
 
+const NOT_SIGNED_IN = {
+  kind: 'refused',
+  code: 'agent_session_operation_invalid',
+  details: { reason: 'notSignedIn' }
+} as const
+// Retry beside it is the resend, so the words keep only the step before it.
+const NOT_SIGNED_IN_TEXT = 'Codex is not signed in for the selected account. Sign in first.'
+
 function sessionView(): React.JSX.Element {
   return (
     <NativeChatStructuredSession
@@ -99,17 +107,54 @@ describe('NativeChatStructuredSession launch lifecycle', () => {
     expect(mocks.retryLaunch).toHaveBeenCalledWith('wt-1', 'session-1')
   })
 
-  it('shows why a failed launch failed beside Retry', () => {
+  it('words why a failed launch failed beside Retry from the refusal, never its code', () => {
     mocks.launchLifecycle = 'failed'
-    mocks.launchFailureReason = 'claude is not signed in'
+    mocks.launchFailure = NOT_SIGNED_IN
     render(sessionView())
 
-    expect(screen.getByText('Chat could not be started. claude is not signed in')).toBeTruthy()
+    expect(screen.getByText(`Chat could not be started. ${NOT_SIGNED_IN_TEXT}`)).toBeTruthy()
+    expect(screen.queryByText(/agent_session_/)).toBeNull()
+  })
+
+  it("keeps a step the Retry doesn't take, and drops one it does", () => {
+    mocks.launchLifecycle = 'failed'
+    mocks.launchFailure = {
+      kind: 'refused',
+      code: 'agent_session_conflict',
+      details: { reason: 'claimConflicted' }
+    }
+    const { rerender } = render(sessionView())
+    expect(
+      screen.getByText(
+        'Chat could not be started. This chat is still open in a terminal agent. Quit that agent to continue the chat here.'
+      )
+    ).toBeTruthy()
+
+    mocks.launchFailure = {
+      kind: 'refused',
+      code: 'agent_session_journal_unreadable',
+      details: { reason: 'journalUnavailable' }
+    }
+    rerender(sessionView())
+    expect(
+      screen.getByText(
+        "Chat could not be started. Orca couldn't open this chat's history right now."
+      )
+    ).toBeTruthy()
+  })
+
+  it('says only that the chat could not start when the refusal names no reason', () => {
+    mocks.launchLifecycle = 'failed'
+    mocks.launchFailure = { kind: 'refused', code: 'agent_session_operation_invalid' }
+    render(sessionView())
+
+    expect(screen.getByText('Chat could not be started.')).toBeTruthy()
+    expect(screen.queryByText(/agent_session_/)).toBeNull()
   })
 
   it('keeps a stale reason off a launch that is no longer failed', () => {
     mocks.launchLifecycle = 'visibility-unknown'
-    mocks.launchFailureReason = 'claude is not signed in'
+    mocks.launchFailure = NOT_SIGNED_IN
     render(sessionView())
 
     expect(screen.getByText('Chat connection could not be confirmed.')).toBeTruthy()
@@ -177,10 +222,10 @@ describe('NativeChatStructuredSession launch lifecycle', () => {
     const { rerender } = render(sessionView())
 
     expect(composerSend()('still there?', [])).toBe(true)
-    mocks.launchFailureReason = 'claude is not signed in'
+    mocks.launchFailure = NOT_SIGNED_IN
     rerender(sessionView())
 
-    expect(screen.getByText('Chat could not be started. claude is not signed in')).toBeTruthy()
+    expect(screen.getByText(`Chat could not be started. ${NOT_SIGNED_IN_TEXT}`)).toBeTruthy()
     expect(mocks.call).not.toHaveBeenCalled()
     expect(readOutbox('session-1')).toEqual([
       expect.objectContaining({
diff --git a/src/renderer/src/components/native-chat/NativeChatStructuredSession.read-error.test.tsx b/src/renderer/src/components/native-chat/NativeChatStructuredSession.read-error.test.tsx
new file mode 100644
index 00000000000..89ef518feb3
--- /dev/null
+++ b/src/renderer/src/components/native-chat/NativeChatStructuredSession.read-error.test.tsx
@@ -0,0 +1,108 @@
+// @vitest-environment happy-dom
+
+import { cleanup, render, screen } from '@testing-library/react'
+import { afterEach, expect, it, vi } from 'vitest'
+
+const { mocks, moduleFactories, resetStructuredSessionMocks } = await vi.hoisted(async () =>
+  (await import('./NativeChatStructuredSession.test-harness')).createStructuredSessionMocks()
+)
+
+vi.mock('@/runtime/structured-agent-session-client', () =>
+  moduleFactories.structuredAgentSessionClient()
+)
+vi.mock('./use-structured-agent-session', () => moduleFactories.useStructuredAgentSession())
+vi.mock('./use-native-chat-font-scale', () => moduleFactories.useNativeChatFontScale())
+vi.mock('./use-native-chat-file-link-context', () => moduleFactories.useNativeChatFileLinkContext())
+vi.mock('./use-native-chat-file-link-click', () => moduleFactories.useNativeChatFileLinkClick())
+vi.mock('./NativeChatMessageList', () => moduleFactories.nativeChatMessageList())
+vi.mock('./NativeChatComposer', () => moduleFactories.nativeChatComposer())
+vi.mock('./NativeChatApprovalCard', () => moduleFactories.nativeChatApprovalCard())
+vi.mock('./NativeChatQuestionCard', () => moduleFactories.nativeChatQuestionCard())
+
+import { NativeChatStructuredSession } from './NativeChatStructuredSession'
+
+afterEach(() => {
+  cleanup()
+  resetStructuredSessionMocks()
+})
+
+function renderPane(): void {
+  render(
+    <NativeChatStructuredSession
+      isVisible
+      isFocusedGroup
+      tabId="structured-read-error-tab"
+      sessionId="read-error-session"
+      target={{ kind: 'local' }}
+      agent="codex"
+    />
+  )
+}
+
+function journalRefusal(reason: 'journalCorrupt' | 'journalUnavailable') {
+  return { code: 'agent_session_journal_unreadable', details: { reason } } as const
+}
+
+// The host's message and code never reach the pane; it words the refusal, and says it once.
+it('says a failed read with no refusal keeps retrying, and adds nothing of the host', () => {
+  mocks.status = 'error'
+  mocks.messages = []
+
+  renderPane()
+
+  expect(screen.getByText('Could not load conversation')).toBeTruthy()
+  expect(
+    screen.getByText('The transcript could not be read. Orca keeps trying to load it.')
+  ).toBeTruthy()
+  expect(screen.queryByText(/history couldn't be loaded/)).toBeNull()
+  expect(screen.queryByText(/Toggle back to the terminal/)).toBeNull()
+})
+
+it('says a damaged history cannot load in one line, without claiming Orca keeps trying', () => {
+  mocks.status = 'error'
+  mocks.readRefusal = journalRefusal('journalCorrupt')
+  mocks.messages = []
+
+  renderPane()
+
+  expect(screen.getAllByText('Unable to load this chat.')).toHaveLength(1)
+  expect(screen.queryByText('Could not load conversation')).toBeNull()
+  expect(screen.queryByText(/keeps trying/)).toBeNull()
+  expect(screen.queryByText(/agent_session_/)).toBeNull()
+})
+
+it("names a history that couldn't open right now once, and that the pane keeps trying", () => {
+  mocks.status = 'error'
+  mocks.readRefusal = journalRefusal('journalUnavailable')
+  mocks.messages = []
+
+  renderPane()
+
+  expect(screen.getAllByText("Orca couldn't open this chat's history right now.")).toHaveLength(1)
+  expect(screen.queryByText('Could not load conversation')).toBeNull()
+  expect(
+    screen.getByText('The transcript could not be read. Orca keeps trying to load it.')
+  ).toBeTruthy()
+  expect(screen.queryByText(/Try again/)).toBeNull()
+})
+
+it('says only that it is reconnecting, not as an error, when a failure names nothing', () => {
+  mocks.status = 'error'
+
+  renderPane()
+
+  expect(screen.getByTestId('message-list')).toBeTruthy()
+  const reconnecting = screen.getByText('Reconnecting to this chat…')
+  expect(reconnecting.className).not.toContain('text-destructive')
+  expect(screen.queryByText(/history couldn't be loaded/)).toBeNull()
+})
+
+it('words a failed reconnect beside a transcript it keeps', () => {
+  mocks.status = 'error'
+  mocks.readRefusal = journalRefusal('journalUnavailable')
+
+  renderPane()
+
+  expect(screen.getByTestId('message-list')).toBeTruthy()
+  expect(screen.getByText("Orca couldn't open this chat's history right now.")).toBeTruthy()
+})
diff --git a/src/renderer/src/components/native-chat/NativeChatStructuredSession.start-failure-notice.test.tsx b/src/renderer/src/components/native-chat/NativeChatStructuredSession.start-failure-notice.test.tsx
new file mode 100644
index 00000000000..6f529c1d3c9
--- /dev/null
+++ b/src/renderer/src/components/native-chat/NativeChatStructuredSession.start-failure-notice.test.tsx
@@ -0,0 +1,163 @@
+// @vitest-environment happy-dom
+
+import { cleanup, render, screen, waitFor, within } from '@testing-library/react'
+import { afterEach, expect, it, vi } from 'vitest'
+import type { AgentSessionFailureFact } from '../../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../../shared/agent-session-failure-words'
+import {
+  agentJournalItemKey,
+  agentJournalSubmissionKey
+} from '../../../../shared/agent-session-journal-item-key'
+import type { AgentJournalRenderItem } from '../../../../shared/agent-session-journal-types'
+import { structuredAgentSessionStartFailureRowIdentity } from '../../../../shared/structured-agent-session-start-failure-row-key'
+
+const { mocks, moduleFactories, resetStructuredSessionMocks } = await vi.hoisted(async () =>
+  (await import('./NativeChatStructuredSession.test-harness')).createStructuredSessionMocks()
+)
+
+vi.mock('@/runtime/structured-agent-session-client', () =>
+  moduleFactories.structuredAgentSessionClient()
+)
+vi.mock('./use-structured-agent-session', () => moduleFactories.useStructuredAgentSession())
+vi.mock('./use-native-chat-font-scale', () => moduleFactories.useNativeChatFontScale())
+vi.mock('./use-native-chat-file-link-context', () => moduleFactories.useNativeChatFileLinkContext())
+vi.mock('./use-native-chat-file-link-click', () => moduleFactories.useNativeChatFileLinkClick())
+vi.mock('./NativeChatMessageList', () => moduleFactories.nativeChatMessageList())
+vi.mock('./NativeChatComposer', () => moduleFactories.nativeChatComposer())
+vi.mock('./NativeChatEmptyState', () => moduleFactories.nativeChatEmptyState())
+vi.mock('./NativeChatApprovalCard', () => moduleFactories.nativeChatApprovalCard())
+vi.mock('./NativeChatQuestionCard', () => moduleFactories.nativeChatQuestionCard())
+
+import { NativeChatStructuredSession } from './NativeChatStructuredSession'
+
+afterEach(() => {
+  cleanup()
+  localStorage.clear()
+  resetStructuredSessionMocks()
+})
+
+const SESSION_ID = 'start-failure-session'
+const START_FAILED: AgentSessionFailureFact = { kind: 'providerStartFailed' }
+const START_FAILED_REASON =
+  'Claude stopped before it finished starting. Send your message to try again.'
+
+function startFailureRow(fact: AgentSessionFailureFact): AgentJournalRenderItem {
+  return {
+    itemId: agentJournalItemKey(structuredAgentSessionStartFailureRowIdentity('generation-1')),
+    revision: 1,
+    sequence: 1,
+    observedAt: 1,
+    body: {
+      kind: 'status',
+      tone: 'error',
+      ...agentSessionFailureWords(fact, { agentName: 'Claude', surface: 'row' })
+    }
+  }
+}
+
+function rejected(clientMessageId: string, reason: string, rejection: AgentSessionFailureFact) {
+  return {
+    outbox: {
+      clientMessageId,
+      sessionId: SESSION_ID,
+      body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: clientMessageId }] },
+      previewUris: [],
+      state: 'rejected',
+      queuedAt: 1,
+      lastAttemptAt: null,
+      retryAfterUnknownSubmittedAt: null,
+      lastFailure: { kind: 'rejected', reason, rejection: { kind: rejection.kind } }
+    },
+    submission: {
+      clientMessageId,
+      fence: 1,
+      payloadFingerprint: clientMessageId,
+      dispatchState: 'rejected',
+      providerItemId: null,
+      reason,
+      rejection,
+      submittedAt: 1,
+      resolvedAt: 1
+    }
+  }
+}
+
+function renderPane(messages: ReturnType<typeof rejected>[]): void {
+  mocks.mode = 'outbox'
+  mocks.submissions = messages.map((message) => message.submission)
+  localStorage.setItem(
+    `orca:desktopStructuredAgentSessionOutbox:v1:${encodeURIComponent(SESSION_ID)}`,
+    JSON.stringify(messages.map((message) => message.outbox))
+  )
+  render(
+    <NativeChatStructuredSession
+      isVisible
+      isFocusedGroup
+      tabId="start-failure-tab"
+      sessionId={SESSION_ID}
+      target={{ kind: 'local' }}
+      agent="claude"
+    />
+  )
+}
+
+async function notice(clientMessageId: string): Promise<HTMLElement> {
+  return waitFor(() => {
+    const row = document.querySelector<HTMLElement>(
+      `[data-message-id="${agentJournalSubmissionKey(clientMessageId)}"]`
+    )
+    if (!row) {
+      throw new Error(`no notice on ${clientMessageId}`)
+    }
+    return row
+  })
+}
+
+// The start's own row says why, so its rejected messages say only that they were not sent.
+it("says only 'not sent', with its Retry, on each message the failed start's row explains", async () => {
+  mocks.journalItems = [startFailureRow(START_FAILED)]
+
+  renderPane([
+    rejected('first', START_FAILED_REASON, START_FAILED),
+    rejected('second', START_FAILED_REASON, START_FAILED)
+  ])
+
+  for (const id of ['first', 'second']) {
+    const row = await notice(id)
+    expect(within(row).getByText('Your message was not sent.')).toBeTruthy()
+    expect(within(row).getByRole('button', { name: 'Retry' })).toBeTruthy()
+  }
+  expect(screen.queryByText(/stopped before it finished starting/)).toBeNull()
+})
+
+it('keeps the full notice on a message rejected for a reason no start-failure row states', async () => {
+  mocks.journalItems = [startFailureRow(START_FAILED)]
+  const providerRejected: AgentSessionFailureFact = {
+    kind: 'providerRejected',
+    detail: { text: 'Image type .bmp', audience: 'person' }
+  }
+
+  renderPane([
+    rejected('stated', START_FAILED_REASON, START_FAILED),
+    rejected(
+      'other',
+      'The provider did not accept this message: Image type .bmp.',
+      providerRejected
+    )
+  ])
+
+  expect(within(await notice('stated')).getByText('Your message was not sent.')).toBeTruthy()
+  expect(
+    within(await notice('other')).getByText(
+      'The provider did not accept this message: Image type .bmp.'
+    )
+  ).toBeTruthy()
+})
+
+it("keeps the start failure's own words when its row is not loaded", async () => {
+  renderPane([rejected('first', START_FAILED_REASON, START_FAILED)])
+
+  expect(
+    within(await notice('first')).getByText('Claude stopped before it finished starting.')
+  ).toBeTruthy()
+})
diff --git a/src/renderer/src/components/native-chat/NativeChatStructuredSession.test-harness.tsx b/src/renderer/src/components/native-chat/NativeChatStructuredSession.test-harness.tsx
index 86963cb542b..71fd557983a 100644
--- a/src/renderer/src/components/native-chat/NativeChatStructuredSession.test-harness.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatStructuredSession.test-harness.tsx
@@ -2,7 +2,10 @@ import { forwardRef, useImperativeHandle, useRef } from 'react'
 import { vi } from 'vitest'
 import type { AgentJournalRenderItem } from '../../../../shared/agent-session-journal-types'
 import type { AgentSessionBackgroundTask } from '../../../../shared/agent-session-wire'
+import type { AgentSessionWriteRefusal } from '../../../../shared/agent-session-write-failure'
+import type { AgentSessionRefusalReference } from '../../../../shared/agent-session-wire-refusals'
 import type { NativeChatApprovalCardProps } from './NativeChatApprovalCard'
+import type { NativeChatDeliveryNotice } from './NativeChatMessageRow'
 import type { NativeChatQuestionCardProps } from './NativeChatQuestionCard'
 import type { NativeChatLaunchSeed } from './native-chat-composer-types'
 import type { NativeChatOlderPageResult } from './native-chat-pagination'
@@ -19,15 +22,41 @@ function nullable<T>(): T | null {
   return null
 }
 
+function absent<T>(): T | undefined {
+  return undefined
+}
+
+/** Stands in for the transcript: renders only each message's delivery notice and its Retry. */
+export function DeliveryNoticesMock({
+  notices
+}: {
+  notices?: ReadonlyMap<string, NativeChatDeliveryNotice>
+}): React.JSX.Element {
+  return (
+    <div data-testid="message-list">
+      {[...(notices ?? [])].map(([id, notice]) => (
+        <div key={id} data-message-id={id}>
+          <span>{notice.text}</span>
+          {notice.onRetry ? (
+            <button type="button" onClick={notice.onRetry}>
+              Retry
+            </button>
+          ) : null}
+        </div>
+      ))}
+    </div>
+  )
+}
+
 type StructuredSessionMessageListProps = {
   allowFileUriLinks?: boolean
   isVisible?: boolean
   onLinkClick?: (...args: unknown[]) => void
-  showTurnStatus?: boolean
-  showLiveTurnActivity?: boolean
+  awaitingInput?: 'shown' | 'unshown' | null
   isWorking?: boolean
   runtimeContext?: unknown
   session?: { hasMore: boolean; loadingEarlier: boolean; loadEarlier: () => Promise<void> }
+  deliveryNotices?: ReadonlyMap<string, NativeChatDeliveryNotice>
 }
 
 const initialMessageListProps: StructuredSessionMessageListProps | null = null
@@ -43,24 +72,28 @@ export function createStructuredSessionMocks() {
     call: vi.fn<(...args: never[]) => unknown>(),
     fileLinkClick: vi.fn<(...args: never[]) => unknown>(),
     launchLifecycle: nullable<StructuredAgentSessionLaunchLifecycle>(),
-    launchFailureReason: nullable<string>(),
+    launchFailure: nullable<AgentSessionWriteRefusal>(),
     launchResumes: false,
     retryLaunch: vi.fn<(...args: never[]) => unknown>(),
     controllerProps: nullable<{ transportEnabled?: boolean }>(),
     mode: 'static' as 'static' | 'outbox',
     status: 'ready' as 'idle' | 'loading' | 'ready' | 'error',
+    readRefusal: absent<AgentSessionRefusalReference>(),
     messages: null as null | unknown[],
     messageListProps: initialMessageListProps,
-    composerProps: null as null | {
+    composerProps: nullable<{
       launchSeed?: NativeChatLaunchSeed
       structuredTransport?: Record<string, unknown>
       isWorking?: boolean
-    },
+      onStop?: () => void
+    }>(),
     approvalCardProps: initialApprovalCardProps,
     questionCardProps: null as NativeChatQuestionCardProps | null,
     promptItems: [] as AgentJournalRenderItem[],
+    journalItems: new Array<AgentJournalRenderItem>(),
     respond: vi.fn<(...args: never[]) => unknown>(),
     cancel: vi.fn<(...args: never[]) => unknown>(),
+    stop: vi.fn<() => unknown>(),
     handlePasteEvent: vi.fn<(...args: never[]) => unknown>(),
     pasteFromClipboard: vi.fn<(...args: never[]) => unknown>(),
     submissions: [] as unknown[],
@@ -68,6 +101,8 @@ export function createStructuredSessionMocks() {
     showBackgroundTasks: false,
     isWorking: false,
     turnId: null as string | null,
+    // Unset: Stop follows the turn, as against an older host.
+    canStop: nullable<boolean>(),
     supportsBackgroundTaskStop: false,
     supportsBackgroundTaskStopAll: true,
     backgroundTasks: [] as AgentSessionBackgroundTask[],
@@ -89,6 +124,8 @@ export function createStructuredSessionMocks() {
     useStructuredAgentSession: async () => {
       const { useStructuredAgentSessionOutbox } =
         await import('./use-structured-agent-session-outbox')
+      const { projectStructuredAgentSessionMessages } =
+        await import('../../../../shared/structured-agent-session-message-projection')
       return {
         useStructuredAgentSession: (props: {
           sessionId: string
@@ -103,11 +140,11 @@ export function createStructuredSessionMocks() {
             submissions: mocks.submissions as never
           })
           return {
-            journalItems: [],
+            journalItems: mocks.journalItems,
             messages:
               mocks.messages ??
               (mocks.mode === 'outbox'
-                ? []
+                ? projectStructuredAgentSessionMessages([], outbox.outbox, [])
                 : [
                     {
                       id: 'message-1',
@@ -124,12 +161,14 @@ export function createStructuredSessionMocks() {
                   ]),
             status: mocks.status,
             error: outbox.error,
+            readRefusal: mocks.readRefusal,
             hasOlder: mocks.hasOlder,
             loadingOlder: mocks.loadingOlder,
             olderHistoryGeneration: mocks.olderHistoryGeneration,
             loadOlder: mocks.loadOlder,
             prompts: mocks.promptItems,
             outbox: outbox.outbox,
+            submissions: mocks.submissions,
             blockedClientMessageId: outbox.blockedClientMessageId,
             send: outbox.send,
             retry: outbox.retry,
@@ -143,6 +182,8 @@ export function createStructuredSessionMocks() {
               supportsStopAll: mocks.supportsBackgroundTaskStopAll
             },
             turnId: mocks.turnId,
+            canStop: mocks.canStop ?? mocks.turnId !== null,
+            stop: mocks.stop,
             threadGoal: mocks.threadGoal,
             cancel: mocks.cancel,
             stopBackgroundTask: (taskId?: string) =>
@@ -181,7 +222,7 @@ export function createStructuredSessionMocks() {
       getStructuredAgentSessionLaunchResumes: () => mocks.launchResumes,
       useStructuredAgentSessionLaunchSelection: () => null,
       useStructuredAgentSessionLaunchLifecycle: () => mocks.launchLifecycle,
-      useStructuredAgentSessionLaunchFailureReason: () => mocks.launchFailureReason
+      useStructuredAgentSessionLaunchFailure: () => mocks.launchFailure
     }),
     useNativeChatFontScale: () => ({
       useNativeChatFontScale: () => ({ scale: 1 })
@@ -199,7 +240,7 @@ export function createStructuredSessionMocks() {
     nativeChatMessageList: () => ({
       NativeChatMessageList: (props: typeof mocks.messageListProps) => {
         mocks.messageListProps = props
-        return <div data-testid="message-list" />
+        return <DeliveryNoticesMock notices={props?.deliveryNotices} />
       }
     }),
     nativeChatComposer: () => ({
@@ -237,20 +278,23 @@ export function createStructuredSessionMocks() {
   const resetStructuredSessionMocks = (): void => {
     mocks.call.mockReset()
     mocks.launchLifecycle = null
-    mocks.launchFailureReason = null
+    mocks.launchFailure = null
     mocks.launchResumes = false
     mocks.retryLaunch.mockReset()
     mocks.controllerProps = null
     mocks.mode = 'static'
     mocks.status = 'ready'
+    mocks.readRefusal = undefined
     mocks.messages = null
     mocks.messageListProps = null
     mocks.composerProps = null
     mocks.approvalCardProps = null
     mocks.questionCardProps = null
     mocks.promptItems = []
+    mocks.journalItems = []
     mocks.respond.mockReset()
     mocks.cancel.mockReset()
+    mocks.stop.mockReset()
     mocks.handlePasteEvent.mockReset()
     mocks.pasteFromClipboard.mockReset()
     mocks.submissions = []
@@ -258,6 +302,7 @@ export function createStructuredSessionMocks() {
     mocks.showBackgroundTasks = false
     mocks.isWorking = false
     mocks.turnId = null
+    mocks.canStop = null
     mocks.supportsBackgroundTaskStop = false
     mocks.supportsBackgroundTaskStopAll = true
     mocks.stopBackgroundTask.mockReset()
diff --git a/src/renderer/src/components/native-chat/NativeChatStructuredSession.test.tsx b/src/renderer/src/components/native-chat/NativeChatStructuredSession.test.tsx
index 286ae50a3c8..9279ca63f20 100644
--- a/src/renderer/src/components/native-chat/NativeChatStructuredSession.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatStructuredSession.test.tsx
@@ -2,7 +2,6 @@
 
 import { act, cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { decodeAgentSessionQuestionAnswers } from '../../../../shared/agent-session-question-answer'
 import type { AgentJournalRenderItem } from '../../../../shared/agent-session-journal-types'
 import { useAppStore } from '@/store'
 import {
@@ -28,6 +27,7 @@ vi.mock('./NativeChatApprovalCard', () => moduleFactories.nativeChatApprovalCard
 vi.mock('./NativeChatQuestionCard', () => moduleFactories.nativeChatQuestionCard())
 
 import { NativeChatStructuredSession } from './NativeChatStructuredSession'
+import { structuredAgentSessionPaneKey } from '../../../../shared/structured-agent-session-projection'
 
 describe('NativeChatStructuredSession', () => {
   afterEach(() => {
@@ -35,6 +35,22 @@ describe('NativeChatStructuredSession', () => {
     resetStructuredSessionMocks()
   })
 
+  it('gives what a Stop withdrew back to the composer this pane shows', () => {
+    render(
+      <NativeChatStructuredSession
+        isVisible
+        isFocusedGroup
+        tabId="structured-tab-1"
+        sessionId="session-1"
+        target={{ kind: 'local' }}
+        agent="codex"
+      />
+    )
+    const paneKey = structuredAgentSessionPaneKey('structured-tab-1', 'session-1')
+    expect(mocks.composerProps).toMatchObject({ paneKey })
+    expect(mocks.controllerProps).toMatchObject({ composerScopeKey: paneKey })
+  })
+
   it('routes the launch draft and app-menu paste to the structured composer', () => {
     const draft = {
       tabId: 'structured-draft-tab',
@@ -178,8 +194,8 @@ describe('NativeChatStructuredSession', () => {
     expect(mocks.loadOlder).toHaveBeenCalledOnce()
   })
 
-  // Turn status and transcript image previews shipped Codex-first. Every
-  // structured session renders through the same list, so neither is agent-gated.
+  // Transcript image previews shipped Codex-first. Every structured session
+  // renders through the same list, so they are not agent-gated.
   it.each(['codex', 'claude'] as const)(
     'renders the same structured transcript chrome for %s',
     (agent) => {
@@ -194,7 +210,6 @@ describe('NativeChatStructuredSession', () => {
         />
       )
 
-      expect(mocks.messageListProps?.showTurnStatus).toBe(true)
       expect(mocks.messageListProps?.runtimeContext).not.toBeUndefined()
     }
   )
@@ -217,7 +232,7 @@ describe('NativeChatStructuredSession', () => {
 
     expect(mocks.messageListProps).toMatchObject({
       isWorking: true,
-      showLiveTurnActivity: false
+      awaitingInput: 'shown'
     })
     expect(
       document
@@ -232,13 +247,13 @@ describe('NativeChatStructuredSession', () => {
       itemId: 'legacy-question-item',
       expectedRevision: 1
     })
-    expect(mocks.messageListProps?.showLiveTurnActivity).toBe(false)
+    expect(mocks.messageListProps?.awaitingInput).toBe('shown')
 
     mocks.promptItems = []
     rerender(view())
     expect(mocks.messageListProps).toMatchObject({
       isWorking: true,
-      showLiveTurnActivity: true
+      awaitingInput: null
     })
     expect(screen.getByTestId('structured-composer')).toBeTruthy()
     expect(mocks.composerProps?.isWorking).toBe(true)
@@ -286,15 +301,18 @@ describe('NativeChatStructuredSession', () => {
 
     expect(mocks.messageListProps).toMatchObject({
       isWorking: true,
-      showLiveTurnActivity: false
+      awaitingInput: 'shown'
     })
     expect(mocks.approvalCardProps?.approval.title).toBe('Allow command?')
     expect(screen.queryByTestId('structured-composer')).toBeNull()
     expect(document.querySelector('[data-native-chat-background-tasks="true"]')).not.toBeNull()
 
     act(() => mocks.approvalCardProps?.onChoose('allow'))
-    expect(mocks.respond).toHaveBeenCalledWith(approvalItems[0], 'allow')
-    expect(mocks.messageListProps?.showLiveTurnActivity).toBe(false)
+    expect(mocks.respond).toHaveBeenCalledWith(approvalItems[0], {
+      kind: 'option',
+      optionId: 'allow'
+    })
+    expect(mocks.messageListProps?.awaitingInput).toBe('shown')
 
     act(() => mocks.approvalCardProps?.onCancel?.())
     expect(mocks.cancel).toHaveBeenCalledWith('turn-approval', {
@@ -366,6 +384,16 @@ describe('NativeChatStructuredSession', () => {
     expect(screen.getByRole('list', { name: 'Agents' })).toBeTruthy()
   })
 
+  it('offers Stop before any turn opens when the controller can stop, and stops through it', () => {
+    mocks.canStop = true
+    render(claudeSessionView('structured-tab-pre-turn', 'session-pre-turn'))
+
+    expect(mocks.composerProps?.isWorking).toBe(true)
+    act(() => mocks.composerProps?.onStop?.())
+    expect(mocks.stop).toHaveBeenCalledOnce()
+    expect(mocks.cancel).not.toHaveBeenCalled()
+  })
+
   it('keeps the strip mounted through a running turn, with the turn owning the voice', () => {
     // The strip stands for work that OUTLIVES a turn, so `show` is true while
     // `isMonitoring` is false: mounted, but not speaking as the live indicator.
@@ -535,14 +563,16 @@ describe('NativeChatStructuredSession', () => {
       { indices: [0, 1], other: '' },
       { indices: [], other: 'SSH host' }
     ])
-    const encoded = mocks.respond.mock.calls[0]?.[1]
-    expect(decodeAgentSessionQuestionAnswers(encoded)).toEqual([
-      { questionId: 'q1', optionIds: ['target-web', 'target-mobile'] },
-      { questionId: 'q2', optionIds: [], other: 'SSH host' }
-    ])
+    expect(mocks.respond).toHaveBeenCalledWith(mocks.promptItems[0], {
+      kind: 'answers',
+      answers: [
+        { questionId: 'q1', optionIds: ['target-web', 'target-mobile'] },
+        { questionId: 'q2', optionIds: [], other: 'SSH host' }
+      ]
+    })
   })
 
-  it('keeps legacy single-question option ids and free text behavior', () => {
+  it('answers a single-question item as its one question', () => {
     mocks.promptItems = legacySingleQuestionPromptItems
 
     render(
@@ -568,6 +598,14 @@ describe('NativeChatStructuredSession', () => {
       }
     ])
     card.onAnswer([{ indices: [1], other: '' }])
-    expect(mocks.respond).toHaveBeenCalledWith(mocks.promptItems[0], 'q1:choice-2')
+    expect(mocks.respond).toHaveBeenLastCalledWith(mocks.promptItems[0], {
+      kind: 'answers',
+      answers: [{ questionId: 'q1', optionIds: ['q1:choice-2'] }]
+    })
+    card.onAnswer([{ indices: [], other: ' Svelte ' }])
+    expect(mocks.respond).toHaveBeenLastCalledWith(mocks.promptItems[0], {
+      kind: 'answers',
+      answers: [{ questionId: 'q1', optionIds: [], other: 'Svelte' }]
+    })
   })
 })
diff --git a/src/renderer/src/components/native-chat/NativeChatStructuredSession.transport-probe.test.tsx b/src/renderer/src/components/native-chat/NativeChatStructuredSession.transport-probe.test.tsx
deleted file mode 100644
index ffa8787e753..00000000000
--- a/src/renderer/src/components/native-chat/NativeChatStructuredSession.transport-probe.test.tsx
+++ /dev/null
@@ -1,377 +0,0 @@
-// @vitest-environment happy-dom
-
-import { act, cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
-import React from 'react'
-import { afterEach, describe, expect, it, vi } from 'vitest'
-
-const { mocks, moduleFactories, resetStructuredSessionMocks } = await vi.hoisted(async () =>
-  (await import('./NativeChatStructuredSession.test-harness')).createStructuredSessionMocks()
-)
-
-vi.mock('@/runtime/structured-agent-session-client', () =>
-  moduleFactories.structuredAgentSessionClient()
-)
-vi.mock('./use-structured-agent-session', () => moduleFactories.useStructuredAgentSession())
-vi.mock('./use-native-chat-font-scale', () => moduleFactories.useNativeChatFontScale())
-vi.mock('./use-native-chat-file-link-context', () => moduleFactories.useNativeChatFileLinkContext())
-vi.mock('./use-native-chat-file-link-click', () => moduleFactories.useNativeChatFileLinkClick())
-vi.mock('./NativeChatMessageList', () => moduleFactories.nativeChatMessageList())
-vi.mock('./NativeChatComposer', () => moduleFactories.nativeChatComposer())
-vi.mock('./NativeChatEmptyState', () => moduleFactories.nativeChatEmptyState())
-vi.mock('./NativeChatApprovalCard', () => moduleFactories.nativeChatApprovalCard())
-vi.mock('./NativeChatQuestionCard', () => moduleFactories.nativeChatQuestionCard())
-
-import { NativeChatStructuredSession } from './NativeChatStructuredSession'
-
-describe('NativeChatStructuredSession transport-unconfirmed sends', () => {
-  afterEach(() => {
-    cleanup()
-    resetStructuredSessionMocks()
-  })
-
-  it('retries an unconfirmed transport send and clears the delivery notice', async () => {
-    mocks.mode = 'outbox'
-    mocks.call.mockRejectedValueOnce(new Error('socket closed')).mockResolvedValueOnce({
-      ok: true,
-      value: {
-        submission: {
-          clientMessageId: 'client-1',
-          dispatchState: 'accepted'
-        }
-      }
-    })
-
-    render(
-      <NativeChatStructuredSession
-        isVisible
-        isFocusedGroup
-        tabId="structured-tab-1"
-        sessionId="session-1"
-        target={{ kind: 'local' }}
-        agent="codex"
-      />
-    )
-
-    const send = mocks.composerProps?.structuredTransport?.send as
-      | ((text: string, attachments: readonly { id: string; path: string }[]) => boolean)
-      | undefined
-    expect(send?.('hello', [])).toBe(true)
-    await waitFor(() => expect(mocks.call).toHaveBeenCalledOnce())
-    await waitFor(() => expect(screen.getByText('Message delivery is unconfirmed.')).toBeTruthy())
-
-    fireEvent.click(screen.getByRole('button', { name: /Retry/ }))
-
-    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(2))
-    await waitFor(() => expect(screen.queryByText('Message delivery is unconfirmed.')).toBeNull())
-  })
-
-  it('resends a transport-unconfirmed head so later messages are not wedged', async () => {
-    mocks.mode = 'outbox'
-    mocks.submissions = []
-    mocks.call.mockRejectedValueOnce(new Error('socket closed')).mockResolvedValue({
-      ok: true,
-      value: { submission: { clientMessageId: 'client-1', dispatchState: 'accepted' } }
-    })
-
-    render(
-      <NativeChatStructuredSession
-        isVisible
-        isFocusedGroup
-        tabId="structured-tab-wedge"
-        sessionId="session-wedge"
-        target={{ kind: 'local' }}
-        agent="codex"
-      />
-    )
-
-    const send = mocks.composerProps?.structuredTransport?.send as
-      | ((text: string, attachments: readonly { id: string; path: string }[]) => boolean)
-      | undefined
-    expect(send?.('first', [])).toBe(true)
-    await waitFor(() => expect(mocks.call).toHaveBeenCalledOnce())
-    await waitFor(() => expect(screen.getByText('Message delivery is unconfirmed.')).toBeTruthy())
-
-    expect(send?.('second', [])).toBe(true)
-    // The head is probed automatically, clears, and the queue drains.
-    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(3), { timeout: 10000 })
-    await waitFor(() => expect(screen.queryByText('Message delivery is unconfirmed.')).toBeNull())
-  }, 20000)
-
-  it('probes the same operation without marking an explicit user retry', async () => {
-    mocks.mode = 'outbox'
-    mocks.submissions = []
-    mocks.call.mockRejectedValueOnce(new Error('socket closed')).mockResolvedValue({
-      ok: true,
-      value: { submission: { clientMessageId: 'client-1', dispatchState: 'accepted' } }
-    })
-
-    render(
-      <NativeChatStructuredSession
-        isVisible
-        isFocusedGroup
-        tabId="structured-tab-probe-flag"
-        sessionId="session-probe-flag"
-        target={{ kind: 'local' }}
-        agent="codex"
-      />
-    )
-
-    const send = mocks.composerProps?.structuredTransport?.send as
-      | ((text: string, attachments: readonly { id: string; path: string }[]) => boolean)
-      | undefined
-    expect(send?.('first', [])).toBe(true)
-    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(2), { timeout: 10000 })
-
-    const first = mocks.call.mock.calls[0]?.[2] as Record<string, unknown>
-    const probe = mocks.call.mock.calls[1]?.[2] as Record<string, unknown>
-    expect(probe.retryUnknown).toBeUndefined()
-    // Same operation id: both dedupe layers key off it.
-    expect((probe.envelope as { clientOperationId: string }).clientOperationId).toBe(
-      (first.envelope as { clientOperationId: string }).clientOperationId
-    )
-  }, 20000)
-
-  it('parks a host-confirmed unknown instead of probing it', async () => {
-    mocks.mode = 'outbox'
-    mocks.call.mockRejectedValueOnce(new Error('socket closed')).mockResolvedValue({
-      ok: true,
-      value: { submission: { clientMessageId: 'client-1', dispatchState: 'accepted' } }
-    })
-
-    render(
-      <NativeChatStructuredSession
-        isVisible
-        isFocusedGroup
-        tabId="structured-tab-parked"
-        sessionId="session-parked"
-        target={{ kind: 'local' }}
-        agent="codex"
-      />
-    )
-
-    const send = mocks.composerProps?.structuredTransport?.send as
-      | ((text: string, attachments: readonly { id: string; path: string }[]) => boolean)
-      | undefined
-    expect(send?.('first', [])).toBe(true)
-    await waitFor(() => expect(mocks.call).toHaveBeenCalledOnce())
-
-    const sent = mocks.call.mock.calls[0]?.[2] as { envelope: { clientOperationId: string } }
-    // The host now reports an unresolved unknown: another replay is the user's call.
-    mocks.submissions = [
-      {
-        clientMessageId: sent.envelope.clientOperationId,
-        fence: 1,
-        payloadFingerprint: 'fp',
-        dispatchState: 'unknown',
-        providerItemId: null,
-        reason: null,
-        submittedAt: 1,
-        resolvedAt: null
-      }
-    ]
-    // Queue a second message purely to re-render so the effect observes the
-    // new submissions; it must stay wedged behind the parked head.
-    await act(async () => {
-      send?.('second', [])
-    })
-    await act(async () => {
-      await new Promise((resolve) => setTimeout(resolve, 3000))
-    })
-    expect(mocks.call).toHaveBeenCalledOnce()
-  }, 20000)
-
-  it('still probes while streaming batches rebuild the submissions array', async () => {
-    mocks.mode = 'outbox'
-    mocks.submissions = []
-    mocks.call.mockRejectedValueOnce(new Error('socket closed')).mockResolvedValue({
-      ok: true,
-      value: { submission: { clientMessageId: 'client-1', dispatchState: 'accepted' } }
-    })
-
-    const makeView = (): React.ReactElement => (
-      <NativeChatStructuredSession
-        isVisible
-        isFocusedGroup
-        tabId="structured-tab-churn"
-        sessionId="session-churn"
-        target={{ kind: 'local' }}
-        agent="codex"
-      />
-    )
-    const { rerender } = render(makeView())
-
-    const send = mocks.composerProps?.structuredTransport?.send as
-      | ((text: string, attachments: readonly { id: string; path: string }[]) => boolean)
-      | undefined
-    expect(send?.('first', [])).toBe(true)
-    await waitFor(() => expect(mocks.call).toHaveBeenCalledOnce())
-
-    // Each batch mints a fresh submissions array for an unrelated message. An
-    // array-identity dependency restarts the backoff on every one of these, so a
-    // stream that outlasts the delay would never let the probe fire.
-    for (let index = 0; index < 12; index += 1) {
-      mocks.submissions = [
-        {
-          clientMessageId: `other-${index}`,
-          fence: 1,
-          payloadFingerprint: 'fp',
-          dispatchState: 'accepted',
-          providerItemId: null,
-          reason: null,
-          submittedAt: index,
-          resolvedAt: index
-        }
-      ]
-      await act(async () => {
-        rerender(makeView())
-        await new Promise((resolve) => setTimeout(resolve, 250))
-      })
-    }
-
-    // Asserted with no trailing grace period: the probe must have fired *during*
-    // the stream, not after it went quiet.
-    expect(mocks.call).toHaveBeenCalledTimes(2)
-  }, 20000)
-
-  it('restarts probe delay when the runtime target changes', async () => {
-    mocks.mode = 'outbox'
-    mocks.call.mockRejectedValueOnce(new Error('socket closed')).mockResolvedValue({
-      ok: true,
-      value: { submission: { clientMessageId: 'client-1', dispatchState: 'accepted' } }
-    })
-
-    const makeView = (
-      target: { kind: 'local' } | { kind: 'environment'; environmentId: string }
-    ) => (
-      <NativeChatStructuredSession
-        isVisible
-        isFocusedGroup
-        tabId="structured-tab-target-switch"
-        sessionId="session-target-switch"
-        target={target}
-        agent="codex"
-      />
-    )
-    const { rerender } = render(makeView({ kind: 'local' }))
-    const send = mocks.composerProps?.structuredTransport?.send as
-      | ((text: string, attachments: readonly { id: string; path: string }[]) => boolean)
-      | undefined
-    expect(send?.('first', [])).toBe(true)
-    await waitFor(() => expect(mocks.call).toHaveBeenCalledOnce())
-    await waitFor(() => expect(screen.getByText('Message delivery is unconfirmed.')).toBeTruthy())
-
-    await act(async () => {
-      await new Promise((resolve) => setTimeout(resolve, 300))
-    })
-    rerender(makeView({ kind: 'environment', environmentId: 'env-1' }))
-    await act(async () => {
-      await new Promise((resolve) => setTimeout(resolve, 600))
-    })
-    expect(mocks.call).toHaveBeenCalledOnce()
-    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(2), { timeout: 1500 })
-  }, 10000)
-
-  it('never auto-probes an entry the user already force-retried', async () => {
-    mocks.mode = 'outbox'
-    mocks.submissions = []
-    // Both the original send and the user's explicit Retry fail at the transport.
-    mocks.call.mockRejectedValue(new Error('socket closed'))
-
-    render(
-      <NativeChatStructuredSession
-        isVisible
-        isFocusedGroup
-        tabId="structured-tab-forced"
-        sessionId="session-forced"
-        target={{ kind: 'local' }}
-        agent="codex"
-      />
-    )
-
-    const send = mocks.composerProps?.structuredTransport?.send as
-      | ((text: string, attachments: readonly { id: string; path: string }[]) => boolean)
-      | undefined
-    expect(send?.('first', [])).toBe(true)
-    await waitFor(() => expect(mocks.call).toHaveBeenCalledOnce())
-    await waitFor(() => expect(screen.getByText('Message delivery is unconfirmed.')).toBeTruthy())
-
-    // User retries with the same envelope and no legacy redelivery signal.
-    fireEvent.click(screen.getByRole('button', { name: /Retry/ }))
-    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(2))
-    const forcedRequest = mocks.call.mock.calls[1]?.[2] as Record<string, unknown> | undefined
-    expect(forcedRequest?.retryUnknown).toBeUndefined()
-
-    // That retry also failed at the transport. The probe must not repeat an
-    // explicit retry automatically.
-    await act(async () => {
-      await new Promise((resolve) => setTimeout(resolve, 3000))
-    })
-    expect(mocks.call).toHaveBeenCalledTimes(2)
-  }, 20000)
-
-  it('does not hot-loop when the host answers pending', async () => {
-    mocks.mode = 'outbox'
-    mocks.call.mockResolvedValue({
-      ok: true,
-      value: { submission: { clientMessageId: 'client-1', dispatchState: 'pending' } }
-    })
-
-    render(
-      <NativeChatStructuredSession
-        isVisible
-        isFocusedGroup
-        tabId="structured-tab-pending"
-        sessionId="session-pending"
-        target={{ kind: 'local' }}
-        agent="codex"
-      />
-    )
-
-    const send = mocks.composerProps?.structuredTransport?.send as
-      | ((text: string, attachments: readonly { id: string; path: string }[]) => boolean)
-      | undefined
-    expect(send?.('first', [])).toBe(true)
-    await waitFor(() => expect(mocks.call).toHaveBeenCalledOnce())
-
-    // A pending row parks the entry under the backoff instead of re-dispatching
-    // immediately. Without that, this window is an unbounded back-to-back RPC flood.
-    await act(async () => {
-      await new Promise((resolve) => setTimeout(resolve, 2500))
-    })
-    expect(mocks.call.mock.calls.length).toBeLessThanOrEqual(3)
-  }, 20000)
-
-  it('keeps probing past the old five-attempt budget', async () => {
-    mocks.mode = 'outbox'
-    mocks.call.mockRejectedValue(new Error('socket closed'))
-    vi.useFakeTimers({ shouldAdvanceTime: true })
-    try {
-      render(
-        <NativeChatStructuredSession
-          isVisible
-          isFocusedGroup
-          tabId="structured-tab-budget"
-          sessionId="session-budget"
-          target={{ kind: 'local' }}
-          agent="codex"
-        />
-      )
-
-      const send = mocks.composerProps?.structuredTransport?.send as
-        | ((text: string, attachments: readonly { id: string; path: string }[]) => boolean)
-        | undefined
-      expect(send?.('first', [])).toBe(true)
-
-      // Backoff is 1+2+4+8+16 = 31s for five probes, which was the old hard budget.
-      // Step past it; a seventh call proves the probe re-arms instead of giving up.
-      for (let step = 0; step < 12; step += 1) {
-        await act(async () => {
-          await vi.advanceTimersByTimeAsync(8_000)
-        })
-      }
-      expect(mocks.call.mock.calls.length).toBeGreaterThanOrEqual(7)
-    } finally {
-      vi.useRealTimers()
-    }
-  }, 30000)
-})
diff --git a/src/renderer/src/components/native-chat/NativeChatStructuredSession.tsx b/src/renderer/src/components/native-chat/NativeChatStructuredSession.tsx
index 4e18f0bf9c8..935d247309a 100644
--- a/src/renderer/src/components/native-chat/NativeChatStructuredSession.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatStructuredSession.tsx
@@ -1,5 +1,5 @@
-import { useMemo, useRef, useState } from 'react'
-import { encodeAgentSessionQuestionAnswers } from '../../../../shared/agent-session-question-answer'
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
+import { agentSessionPromptQuestions } from '../../../../shared/agent-session-question-answer'
 import { dispatchStructuredAgentSessionComposerCommand } from '../../../../shared/structured-agent-session-composer'
 import { structuredAgentSessionPaneKey } from '../../../../shared/structured-agent-session-projection'
 import type { NativeChatLiveSession } from './use-native-chat-live-session'
@@ -22,14 +22,15 @@ import { NativeChatStructuredSessionStatus } from './NativeChatStructuredSession
 import { useNativeChatLaunchDraftSignal } from './use-native-chat-launch-draft-adoption'
 import { NativeChatLaunchRetry } from './NativeChatLaunchRetry'
 import { useNativeChatProvisionalLaunch } from './use-native-chat-provisional-launch'
-import { NativeChatDeliveryRetry } from './NativeChatDeliveryRetry'
-import { useStructuredAgentSessionHostExecutionPhase } from './StructuredAgentSessionStatusBridge'
+import { useStructuredAgentSessionHostExecution } from './StructuredAgentSessionStatusBridge'
 import { structuredAgentLabel } from '@/lib/structured-agent-session-launch-label'
 import { NativeChatThreadGoalBanner } from './NativeChatThreadGoalBanner'
+import { structuredAgentSessionReadFailureNotice } from './structured-agent-session-read-failure-notice'
+import { useStructuredAgentSessionStartFailureFacts } from './use-structured-agent-session-start-failure-facts'
+import { structuredAgentSessionDeliveryNotices } from './structured-agent-session-delivery-notices'
+import type { AgentJournalSubmission } from '../../../../shared/agent-session-journal-types'
 
-function encodeQuestionAnswer(questionId: string, answer: string): string {
-  return `${encodeURIComponent(questionId)}:${encodeURIComponent(answer)}`
-}
+const NO_SUBMISSIONS: readonly AgentJournalSubmission[] = []
 
 export function NativeChatStructuredSession(
   props: Omit<NativeChatStructuredViewProps, 'mode'>
@@ -41,10 +42,15 @@ export function NativeChatStructuredSession(
   )
   const { sendThroughRelaunch } = provisionalLaunch
   // The host's own word on whether the provider child has answered startup yet.
-  const startupPhase = useStructuredAgentSessionHostExecutionPhase(props.sessionId, props.target)
+  const hostExecution = useStructuredAgentSessionHostExecution(props.sessionId, props.target)
+  const paneKey = useMemo(
+    () => structuredAgentSessionPaneKey(props.tabId, props.sessionId),
+    [props.sessionId, props.tabId]
+  )
   const controller = useStructuredAgentSession({
     ...props,
-    providerStarting: startupPhase === 'starting',
+    composerScopeKey: paneKey,
+    providerStarting: hostExecution.phase === 'starting',
     transportEnabled: provisionalLaunch.transportEnabled,
     ...(provisionalLaunch.launch ? { launch: provisionalLaunch.launch } : {})
   })
@@ -61,10 +67,6 @@ export function NativeChatStructuredSession(
     id: string
     sequence: number
   } | null>(null)
-  const paneKey = useMemo(
-    () => structuredAgentSessionPaneKey(props.tabId, props.sessionId),
-    [props.sessionId, props.tabId]
-  )
   const rootRef = useRef<HTMLDivElement>(null)
   const composerRef = useRef<NativeChatComposerHandle>(null)
   const paneCommands = useStructuredNativeChatPaneCommands({
@@ -104,7 +106,46 @@ export function NativeChatStructuredSession(
     }),
     [controller, props.agent, props.sessionId]
   )
-  const viewState = selectNativeChatViewState(session)
+  // Read at click time, so the notices stay put while the outbox's Retry is rebuilt each render.
+  const retryRef = useRef(controller.retry)
+  useEffect(() => {
+    retryRef.current = controller.retry
+  })
+  const retryDelivery = useCallback((clientMessageId: string) => {
+    retryRef.current(clientMessageId)
+  }, [])
+  const agentLabel = structuredAgentLabel(props.agent === 'codex' ? 'codex' : 'claude')
+  // Only a rejected message reads the journal's rows, so a new batch of them re-renders no row else.
+  const hasRejected = controller.outbox.some((entry) => entry.state === 'rejected')
+  const rejectionRows = hasRejected ? controller.submissions : NO_SUBMISSIONS
+  const startFailures = useStructuredAgentSessionStartFailureFacts(
+    controller.journalItems,
+    hasRejected
+  )
+  const deliveryNotices = useMemo(
+    () =>
+      structuredAgentSessionDeliveryNotices(
+        controller.outbox,
+        controller.blockedClientMessageId,
+        agentLabel,
+        retryDelivery,
+        rejectionRows,
+        startFailures
+      ),
+    [
+      controller.outbox,
+      controller.blockedClientMessageId,
+      agentLabel,
+      retryDelivery,
+      rejectionRows,
+      startFailures
+    ]
+  )
+  const viewState = selectNativeChatViewState(session, { readRetries: true })
+  const readFailure =
+    controller.status === 'error'
+      ? structuredAgentSessionReadFailureNotice(controller.readRefusal)
+      : null
   const fontScale = useNativeChatFontScale(viewState.kind === 'ready')
   const imageRuntimeContext = useNativeChatImageRuntimeContext(props.tabId)
   const { onLinkClick, linkActionRequest, closeLinkActions } = useNativeChatLinkActions(
@@ -146,21 +187,7 @@ export function NativeChatStructuredSession(
     composerReady: prompt === null
   })
   const questionBody = prompt?.body.kind === 'question' ? prompt.body : null
-  const questions =
-    questionBody?.questions ??
-    (questionBody
-      ? [
-          {
-            id: questionBody.freeTextQuestionId ?? 'q1',
-            question: questionBody.question,
-            options: questionBody.options,
-            multiSelect: false,
-            ...(questionBody.freeTextQuestionId
-              ? { freeTextQuestionId: questionBody.freeTextQuestionId }
-              : {})
-          }
-        ]
-      : [])
+  const questions = questionBody ? agentSessionPromptQuestions(questionBody) : []
   const structuredTransport = useMemo(() => {
     const threadGoal = controller.threadGoal
     const setThreadGoalObjective = threadGoal
@@ -235,13 +262,18 @@ export function NativeChatStructuredSession(
         {viewState.kind === 'loading' ? (
           <NativeChatEmptyState kind="loading" />
         ) : viewState.kind === 'error' ? (
-          <NativeChatEmptyState kind="error" message={viewState.message} />
+          <NativeChatEmptyState
+            kind="error"
+            retrying={!readFailure?.final}
+            {...(readFailure?.named ? { headline: readFailure.text } : {})}
+          />
         ) : viewState.kind === 'empty' ? (
           <NativeChatEmptyState kind="empty" agent={props.agent} />
         ) : (
           <NativeChatMessageList
             session={session}
             journalItems={controller.journalItems}
+            journalSubmissions={controller.submissions}
             railOutline={controller.railOutline}
             isVisible={props.isVisible}
             isWorking={controller.isWorking}
@@ -249,30 +281,32 @@ export function NativeChatStructuredSession(
             fontScale={fontScale.scale}
             workingStartedAt={controller.workingStartedAt}
             settledTurns={controller.settledTurns}
-            showTurnStatus
-            showLiveTurnActivity={prompt === null}
+            awaitingInput={prompt === null ? null : 'shown'}
             turnActivity={controller.turnActivity}
             onLinkClick={onLinkClick}
             allowFileUriLinks={onLinkClick !== undefined}
             runtimeContext={imageRuntimeContext}
+            deliveryNotices={deliveryNotices}
           />
         )}
       </div>
-      <NativeChatDeliveryRetry
-        outbox={controller.outbox}
-        blockedClientMessageId={controller.blockedClientMessageId}
-        retry={controller.retry}
-      />
       <NativeChatLaunchRetry
         lifecycle={provisionalLaunch.lifecycle}
-        failureReason={provisionalLaunch.failureReason}
+        failure={provisionalLaunch.failure}
+        agentLabel={agentLabel}
         onRetry={provisionalLaunch.retry}
       />
       <NativeChatStructuredSessionStatus
         sessionId={props.sessionId}
-        agentLabel={structuredAgentLabel(props.agent === 'codex' ? 'codex' : 'claude')}
-        startupPhase={startupPhase}
-        error={controller.error}
+        agentLabel={agentLabel}
+        startupPhase={hostExecution.phase}
+        startupChildKey={hostExecution.childKey}
+        // Said once: on the pane when the failure took it, else here beside the transcript. A
+        // failure that names nothing is only the pane reconnecting.
+        error={
+          viewState.kind === 'error' || !readFailure?.named ? controller.error : readFailure.text
+        }
+        reconnecting={viewState.kind !== 'error' && readFailure !== null && !readFailure.named}
         composerError={composerError}
         isVisible={props.isVisible}
         backgroundTasks={controller.backgroundTasks}
@@ -295,7 +329,7 @@ export function NativeChatStructuredSession(
         <NativeChatApprovalCard
           key={`${prompt.itemId}:${prompt.revision}`}
           approval={approval}
-          onChoose={(optionId) => void controller.respond(prompt, optionId)}
+          onChoose={(optionId) => void controller.respond(prompt, { kind: 'option', optionId })}
           onCancel={cancelPrompt}
           shouldFocus={props.isVisible && props.isFocusedGroup}
           onLinkClick={onLinkClick}
@@ -318,35 +352,17 @@ export function NativeChatStructuredSession(
           }}
           allowOther={questions.map((question) => Boolean(question.freeTextQuestionId))}
           onAnswer={(answers) => {
-            if (questionBody.questions) {
-              const grouped = questions.map((question, questionIndex) => {
-                const answer = answers[questionIndex]
-                const other = answer?.other?.trim()
-                const optionIds = (answer?.indices ?? []).flatMap((optionIndex) => {
-                  const optionId = question.options[optionIndex]?.id
-                  return optionId ? [optionId] : []
-                })
-                return {
-                  questionId: question.id,
-                  optionIds: question.multiSelect || !other ? optionIds : [],
-                  ...(other ? { other } : {})
-                }
+            const chosen = questions.map((question, questionIndex) => {
+              const answer = answers[questionIndex]
+              const other = answer?.other?.trim()
+              const optionIds = (answer?.indices ?? []).flatMap((optionIndex) => {
+                const optionId = question.options[optionIndex]?.id
+                return optionId ? [optionId] : []
               })
-              if (grouped.every((answer) => answer.optionIds.length > 0 || answer.other)) {
-                void controller.respond(prompt, encodeAgentSessionQuestionAnswers(grouped))
-              }
-              return
-            }
-            const index = answers[0]?.indices[0]
-            const other = answers[0]?.other?.trim()
-            const optionId =
-              typeof index === 'number'
-                ? questionBody.options[index]?.id
-                : questionBody.freeTextQuestionId && other
-                  ? encodeQuestionAnswer(questionBody.freeTextQuestionId, other)
-                  : undefined
-            if (optionId) {
-              void controller.respond(prompt, optionId)
+              return { questionId: question.id, optionIds, ...(other ? { other } : {}) }
+            })
+            if (chosen.every((answer) => answer.optionIds.length > 0 || answer.other)) {
+              void controller.respond(prompt, { kind: 'answers', answers: chosen })
             }
           }}
           onCancel={cancelPrompt}
@@ -360,14 +376,8 @@ export function NativeChatStructuredSession(
           targetPtyId={null}
           agent={props.agent}
           canSend={!prompt}
-          // Stop, not status: only a provider-minted turn can be interrupted, so the button
-          // must not flip while a dispatch is still unanswered.
-          isWorking={controller.turnId !== null}
-          onStop={() => {
-            if (controller.turnId) {
-              void controller.cancel(controller.turnId)
-            }
-          }}
+          isWorking={controller.canStop}
+          onStop={() => void controller.stop()}
           structuredTransport={structuredTransport}
           launchSeed={{ ...launchDraftSignal, ownsTabWideLaunchDraft: true }}
         />
diff --git a/src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.test.tsx b/src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.test.tsx
index abb248f719c..81a8f53300f 100644
--- a/src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.test.tsx
@@ -9,6 +9,7 @@ import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { AgentJournalRenderItem } from '../../../../shared/agent-session-journal-types'
 import type { AgentSessionBackgroundTask } from '../../../../shared/agent-session-wire'
 import type { NativeChatQuestionCardProps } from './NativeChatQuestionCard'
+import type { NativeChatDeliveryNotice } from './NativeChatMessageRow'
 
 const mocks = vi.hoisted(() => ({
   call: vi.fn(),
@@ -17,7 +18,6 @@ const mocks = vi.hoisted(() => ({
   messageListProps: null as null | {
     allowFileUriLinks?: boolean
     onLinkClick?: (...args: unknown[]) => void
-    showTurnStatus?: boolean
     runtimeContext?: unknown
   },
   composerProps: null as null | {
@@ -45,6 +45,8 @@ vi.mock('@/runtime/structured-agent-session-client', () => ({
 
 vi.mock('./use-structured-agent-session', async () => {
   const { useStructuredAgentSessionOutbox } = await import('./use-structured-agent-session-outbox')
+  const { projectStructuredAgentSessionMessages } =
+    await import('../../../../shared/structured-agent-session-message-projection')
   return {
     useStructuredAgentSession: (props: {
       sessionId: string
@@ -60,7 +62,7 @@ vi.mock('./use-structured-agent-session', async () => {
         journalItems: [],
         messages:
           mocks.mode === 'outbox'
-            ? []
+            ? projectStructuredAgentSessionMessages([], outbox.outbox, [])
             : [
                 {
                   id: 'message-1',
@@ -77,6 +79,7 @@ vi.mock('./use-structured-agent-session', async () => {
         loadOlder: vi.fn(),
         prompts: mocks.promptItems,
         outbox: outbox.outbox,
+        submissions: mocks.submissions,
         blockedClientMessageId: outbox.blockedClientMessageId,
         send: outbox.send,
         retry: outbox.retry,
@@ -131,12 +134,19 @@ vi.mock('./use-native-chat-file-link-click', () => ({
   useNativeChatFileLinkClick: (context: unknown) => (context ? mocks.fileLinkClick : undefined)
 }))
 
-vi.mock('./NativeChatMessageList', () => ({
-  NativeChatMessageList: (props: typeof mocks.messageListProps) => {
-    mocks.messageListProps = props
-    return <div data-testid="message-list" />
+vi.mock('./NativeChatMessageList', async () => {
+  const { DeliveryNoticesMock } = await import('./NativeChatStructuredSession.test-harness')
+  return {
+    NativeChatMessageList: (
+      props: NonNullable<typeof mocks.messageListProps> & {
+        deliveryNotices?: ReadonlyMap<string, NativeChatDeliveryNotice>
+      }
+    ) => {
+      mocks.messageListProps = props
+      return <DeliveryNoticesMock notices={props.deliveryNotices} />
+    }
   }
-}))
+})
 
 vi.mock('./NativeChatComposer', () => ({
   NativeChatComposer: forwardRef((props: typeof mocks.composerProps, ref) => {
@@ -280,6 +290,128 @@ describe('NativeChatStructuredSession delivery', () => {
     expect(request.envelope.clientOperationId).toBe('op-head')
   })
 
+  it('offers a rejected message no Retry while the queue is stopped, and gives it back once it moves', async () => {
+    mocks.mode = 'outbox'
+    mocks.submissions = []
+    mocks.call.mockResolvedValue({
+      ok: true,
+      value: { submission: { clientMessageId: 'op-head', dispatchState: 'accepted' } }
+    })
+    seedOutbox('session-held-rejected', [
+      seededEntry('session-held-rejected', 'op-head', 'first', 'unconfirmed'),
+      {
+        ...seededEntry('session-held-rejected', 'op-rejected', 'second', 'queued'),
+        state: 'rejected',
+        lastFailure: { kind: 'rejected', reason: 'Claude messages support at most 20 images' }
+      }
+    ])
+
+    render(
+      <NativeChatStructuredSession
+        isVisible
+        isFocusedGroup
+        tabId="structured-tab-held-rejected"
+        sessionId="session-held-rejected"
+        target={{ kind: 'local' }}
+        agent="codex"
+      />
+    )
+
+    await waitFor(() => expect(screen.getByText('Message delivery is unconfirmed.')).toBeTruthy())
+    expect(screen.getByText('Claude messages support at most 20 images')).toBeTruthy()
+    // One Retry, the stopped message's: it sends only that one.
+    fireEvent.click(screen.getByRole('button', { name: /Retry/ }))
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledOnce())
+    expect(mocks.call.mock.calls[0]?.[2]).toMatchObject({
+      envelope: { clientOperationId: 'op-head' }
+    })
+
+    // The queue moved, so the rejected message offers its own Retry again.
+    await waitFor(() => expect(screen.queryByText('Message delivery is unconfirmed.')).toBeNull())
+    expect(screen.getByText('Claude messages support at most 20 images')).toBeTruthy()
+    expect(screen.getAllByRole('button', { name: /Retry/ })).toHaveLength(1)
+    expect(mocks.call).toHaveBeenCalledOnce()
+  })
+
+  it("words a failed start on each message by the chat's agent, leaving the resend to its Retry", async () => {
+    mocks.mode = 'outbox'
+    mocks.submissions = []
+    const startFailed = (clientMessageId: string, text: string) => ({
+      ...seededEntry('session-start-failed', clientMessageId, text, 'queued'),
+      state: 'rejected' as const,
+      lastFailure: {
+        kind: 'rejected' as const,
+        reason: 'Codex stopped before it finished starting. Send your message to try again.',
+        rejection: { kind: 'providerStartFailed' as const }
+      }
+    })
+    seedOutbox('session-start-failed', [
+      startFailed('op-first', 'first'),
+      startFailed('op-second', 'second')
+    ])
+
+    render(
+      <NativeChatStructuredSession
+        isVisible
+        isFocusedGroup
+        tabId="structured-tab-start-failed"
+        sessionId="session-start-failed"
+        target={{ kind: 'local' }}
+        agent="codex"
+      />
+    )
+
+    await waitFor(() =>
+      expect(screen.getAllByText('Codex stopped before it finished starting.')).toHaveLength(2)
+    )
+    expect(screen.getAllByRole('button', { name: /Retry/ })).toHaveLength(2)
+    expect(screen.queryByText(/Send your message to try again/)).toBeNull()
+  })
+
+  it("words a rejected message from its loaded journal row, not the message's own copy", async () => {
+    mocks.mode = 'outbox'
+    const reason = "Claude couldn't start. Send your message to try again."
+    mocks.submissions = [
+      {
+        clientMessageId: 'op-recorded',
+        fence: 1,
+        payloadFingerprint: 'fingerprint',
+        dispatchState: 'rejected',
+        providerItemId: null,
+        reason,
+        rejection: {
+          kind: 'startFailed',
+          refusal: { code: 'agent_session_identity_required', details: { reason: 'recordMissing' } }
+        },
+        submittedAt: 1,
+        resolvedAt: 1
+      }
+    ]
+    seedOutbox('session-recorded', [
+      {
+        ...seededEntry('session-recorded', 'op-recorded', 'first', 'queued'),
+        state: 'rejected',
+        lastFailure: { kind: 'rejected', reason, rejection: { kind: 'startFailed' } }
+      }
+    ])
+
+    render(
+      <NativeChatStructuredSession
+        isVisible
+        isFocusedGroup
+        tabId="structured-tab-recorded"
+        sessionId="session-recorded"
+        target={{ kind: 'local' }}
+        agent="codex"
+      />
+    )
+
+    await waitFor(() =>
+      expect(screen.getByText("Codex couldn't start. Start a new chat to continue.")).toBeTruthy()
+    )
+    expect(screen.queryByText(reason)).toBeNull()
+  })
+
   it('names the stuck message behind an admitted head, and its Retry sends that one', async () => {
     mocks.mode = 'outbox'
     mocks.submissions = []
diff --git a/src/renderer/src/components/native-chat/NativeChatStructuredSessionStatus.test.tsx b/src/renderer/src/components/native-chat/NativeChatStructuredSessionStatus.test.tsx
index 77e365886c8..da53ca1914c 100644
--- a/src/renderer/src/components/native-chat/NativeChatStructuredSessionStatus.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatStructuredSessionStatus.test.tsx
@@ -2,11 +2,18 @@
 
 import '@testing-library/jest-dom/vitest'
 
-import { cleanup, render, screen } from '@testing-library/react'
+import { act, cleanup, render, screen } from '@testing-library/react'
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { NativeChatStructuredSessionStatus } from './NativeChatStructuredSessionStatus'
+import {
+  NativeChatStructuredSessionStatus,
+  SLOW_STARTUP_NOTICE_DELAY_MS
+} from './NativeChatStructuredSessionStatus'
+import { STATUS_MIN_VISIBLE_MS } from '@/lib/delayed-status'
 
-afterEach(cleanup)
+afterEach(() => {
+  cleanup()
+  vi.useRealTimers()
+})
 
 const NO_TASKS = {
   show: false,
@@ -17,12 +24,17 @@ const NO_TASKS = {
   supportsStopAll: false
 }
 
-function renderStatus(startupPhase: 'starting' | 'ready' | null) {
-  return render(
+function statusElement(
+  startupPhase: 'starting' | 'ready' | null,
+  sessionId = 'session-1',
+  startupChildKey: string | null = null
+) {
+  return (
     <NativeChatStructuredSessionStatus
-      sessionId="session-1"
+      sessionId={sessionId}
       agentLabel="Claude"
       startupPhase={startupPhase}
+      startupChildKey={startupChildKey}
       error={null}
       composerError={null}
       isVisible
@@ -32,13 +44,85 @@ function renderStatus(startupPhase: 'starting' | 'ready' | null) {
   )
 }
 
+function renderStatus(startupPhase: 'starting' | 'ready' | null) {
+  return render(statusElement(startupPhase))
+}
+
 describe('NativeChatStructuredSessionStatus', () => {
-  it('says the agent is still starting while the host reports a starting child', () => {
+  it('stays quiet through a normal startup', () => {
+    vi.useFakeTimers()
+    const view = renderStatus('starting')
+    act(() => vi.advanceTimersByTime(SLOW_STARTUP_NOTICE_DELAY_MS - 1))
+    expect(screen.queryByText(/still starting/)).not.toBeInTheDocument()
+    view.rerender(statusElement('ready'))
+    act(() => vi.advanceTimersByTime(SLOW_STARTUP_NOTICE_DELAY_MS))
+    expect(screen.queryByText(/still starting/)).not.toBeInTheDocument()
+  })
+
+  it('says the agent is still starting once startup runs long', () => {
+    vi.useFakeTimers()
     renderStatus('starting')
+    act(() => vi.advanceTimersByTime(SLOW_STARTUP_NOTICE_DELAY_MS))
     expect(screen.getByText(/Claude is still starting/)).toBeInTheDocument()
     expect(screen.getByText(/close this chat/)).toBeInTheDocument()
   })
 
+  it('restarts the grace period for a relaunch or another session', () => {
+    vi.useFakeTimers()
+    const view = renderStatus('starting')
+    act(() => vi.advanceTimersByTime(SLOW_STARTUP_NOTICE_DELAY_MS))
+    view.rerender(statusElement('ready'))
+    act(() => vi.advanceTimersByTime(STATUS_MIN_VISIBLE_MS))
+    expect(screen.queryByText(/still starting/)).not.toBeInTheDocument()
+    view.rerender(statusElement('starting'))
+    expect(screen.queryByText(/still starting/)).not.toBeInTheDocument()
+    act(() => vi.advanceTimersByTime(SLOW_STARTUP_NOTICE_DELAY_MS))
+    expect(screen.getByText(/still starting/)).toBeInTheDocument()
+    view.rerender(statusElement('starting', 'session-2'))
+    expect(screen.queryByText(/still starting/)).not.toBeInTheDocument()
+  })
+
+  it('hides an old notice and gives a replacement child its full grace period', () => {
+    vi.useFakeTimers()
+    const view = render(statusElement('starting', 'session-1', 'child-1'))
+    act(() => vi.advanceTimersByTime(SLOW_STARTUP_NOTICE_DELAY_MS))
+    expect(screen.getByText(/still starting/)).toBeInTheDocument()
+    view.rerender(statusElement('ready', 'session-1', 'child-1'))
+    act(() => vi.advanceTimersByTime(100))
+    view.rerender(statusElement('starting', 'session-1', 'child-2'))
+    expect(screen.queryByText(/still starting/)).not.toBeInTheDocument()
+    act(() => vi.advanceTimersByTime(STATUS_MIN_VISIBLE_MS))
+    expect(screen.queryByText(/still starting/)).not.toBeInTheDocument()
+    act(() => vi.advanceTimersByTime(SLOW_STARTUP_NOTICE_DELAY_MS - STATUS_MIN_VISIBLE_MS))
+    expect(screen.getByText(/still starting/)).toBeInTheDocument()
+  })
+
+  it('resets for a replacement child even when no intermediate phase reaches the view', () => {
+    vi.useFakeTimers()
+    const view = render(statusElement('starting', 'session-1', 'child-1'))
+    act(() => vi.advanceTimersByTime(SLOW_STARTUP_NOTICE_DELAY_MS))
+    view.rerender(statusElement('starting', 'session-1', 'child-2'))
+    expect(screen.queryByText(/still starting/)).not.toBeInTheDocument()
+    act(() => vi.advanceTimersByTime(SLOW_STARTUP_NOTICE_DELAY_MS - 1))
+    expect(screen.queryByText(/still starting/)).not.toBeInTheDocument()
+    act(() => vi.advanceTimersByTime(1))
+    expect(screen.getByText(/still starting/)).toBeInTheDocument()
+  })
+
+  it('resets on an observed restart when an older host has no child identity', () => {
+    vi.useFakeTimers()
+    const view = renderStatus('starting')
+    act(() => vi.advanceTimersByTime(SLOW_STARTUP_NOTICE_DELAY_MS))
+    view.rerender(statusElement('ready'))
+    act(() => vi.advanceTimersByTime(100))
+    view.rerender(statusElement('starting'))
+    expect(screen.queryByText(/still starting/)).not.toBeInTheDocument()
+    act(() => vi.advanceTimersByTime(SLOW_STARTUP_NOTICE_DELAY_MS - 1))
+    expect(screen.queryByText(/still starting/)).not.toBeInTheDocument()
+    act(() => vi.advanceTimersByTime(1))
+    expect(screen.getByText(/still starting/)).toBeInTheDocument()
+  })
+
   it('shows nothing about startup once the child is ready or the host has no word', () => {
     renderStatus('ready')
     expect(screen.queryByText(/still starting/)).not.toBeInTheDocument()
diff --git a/src/renderer/src/components/native-chat/NativeChatStructuredSessionStatus.tsx b/src/renderer/src/components/native-chat/NativeChatStructuredSessionStatus.tsx
index 86a2b858a42..31518886150 100644
--- a/src/renderer/src/components/native-chat/NativeChatStructuredSessionStatus.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatStructuredSessionStatus.tsx
@@ -1,5 +1,6 @@
 import { useState } from 'react'
 import { translate } from '@/i18n/i18n'
+import { useDelayedStatus } from '@/hooks/use-delayed-status'
 import { NativeChatBackgroundTasksStatus } from './NativeChatBackgroundTasksStatus'
 import type { StructuredSessionBackgroundTasksView } from './structured-session-background-tasks-view'
 
@@ -11,13 +12,19 @@ type StoppingBackgroundTasks = {
 
 const NO_STOPPING_TASKS: ReadonlySet<string> = new Set()
 
+// Why: every launch passes through `starting`; only a slow start deserves the notice.
+export const SLOW_STARTUP_NOTICE_DELAY_MS = 5_000
+
 export function NativeChatStructuredSessionStatus(props: {
   sessionId: string
   /** What to call the agent in copy about its process. */
   agentLabel: string
   /** The host's word on the provider child; `starting` is published but not yet answering. */
   startupPhase: 'starting' | 'ready' | null
+  startupChildKey: string | number | null
   error: string | null
+  /** A read the pane is reconnecting on its own: said plainly, not as an error. */
+  reconnecting?: boolean
   composerError: string | null
   isVisible: boolean
   backgroundTasks: StructuredSessionBackgroundTasksView
@@ -26,6 +33,11 @@ export function NativeChatStructuredSessionStatus(props: {
   const [stopping, setStopping] = useState<StoppingBackgroundTasks | null>(null)
   const [expanded, setExpanded] = useState<{ sessionId: string; expanded: boolean } | null>(null)
   const activeStopping = stopping?.sessionId === props.sessionId ? stopping : null
+  const shownStartupPhase = useDelayedStatus(
+    JSON.stringify([props.sessionId, typeof props.startupChildKey, props.startupChildKey]),
+    props.startupPhase === 'starting' ? 'starting' : null,
+    SLOW_STARTUP_NOTICE_DELAY_MS
+  )
 
   const onStop = (taskId?: string) => {
     const sessionId = props.sessionId
@@ -59,7 +71,7 @@ export function NativeChatStructuredSessionStatus(props: {
 
   return (
     <>
-      {props.startupPhase === 'starting' ? (
+      {shownStartupPhase === 'starting' ? (
         <p className="mx-auto w-full max-w-4xl px-4 py-1 text-xs text-muted-foreground">
           {translate(
             'auto.components.native.chat.NativeChatStructuredSessionStatus.starting',
@@ -68,6 +80,11 @@ export function NativeChatStructuredSessionStatus(props: {
           )}
         </p>
       ) : null}
+      {props.reconnecting && !props.error ? (
+        <p className="mx-auto w-full max-w-4xl px-4 py-1 text-xs text-muted-foreground">
+          {translate('components.native-chat.state.reconnecting', 'Reconnecting to this chat…')}
+        </p>
+      ) : null}
       {props.error || props.composerError ? (
         <p className="mx-auto w-full max-w-4xl px-4 py-1 text-xs text-destructive">
           {props.error ?? props.composerError}
diff --git a/src/renderer/src/components/native-chat/NativeChatToolRun.ask-row.test.tsx b/src/renderer/src/components/native-chat/NativeChatToolRun.ask-row.test.tsx
index 4de5a0d214b..b4257648efa 100644
--- a/src/renderer/src/components/native-chat/NativeChatToolRun.ask-row.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatToolRun.ask-row.test.tsx
@@ -2,10 +2,14 @@
 
 import '@testing-library/jest-dom/vitest'
 
-import { cleanup, render, screen } from '@testing-library/react'
+import { cleanup, fireEvent, render, screen } from '@testing-library/react'
 import { afterEach, describe, expect, it } from 'vitest'
 import type { NativeChatBlock } from '../../../../shared/native-chat-types'
 import { NativeChatToolRun } from './NativeChatToolRun'
+import {
+  NativeChatDisclosureContext,
+  useNativeChatDisclosures
+} from './native-chat-disclosure-store'
 
 afterEach(cleanup)
 
@@ -16,6 +20,46 @@ function askBlocks(state: 'running' | 'completed'): NativeChatBlock[] {
   return [{ type: 'tool-call', name: 'AskUserQuestion', input: ASK_INPUT, state }]
 }
 
+/** Lays every element out wider than its box, as a long question is on its line. */
+function clipEveryLine(): () => void {
+  const originals = ['scrollWidth', 'clientWidth'].map(
+    (name) => [name, Object.getOwnPropertyDescriptor(HTMLElement.prototype, name)] as const
+  )
+  Object.defineProperty(HTMLElement.prototype, 'scrollWidth', {
+    configurable: true,
+    get: () => 400
+  })
+  Object.defineProperty(HTMLElement.prototype, 'clientWidth', {
+    configurable: true,
+    get: () => 100
+  })
+  return () => {
+    for (const [name, original] of originals) {
+      if (original) {
+        Object.defineProperty(HTMLElement.prototype, name, original)
+      } else {
+        Reflect.deleteProperty(HTMLElement.prototype, name)
+      }
+    }
+  }
+}
+
+function DisclosureHarness({ mounted }: { mounted: boolean }): React.JSX.Element {
+  const disclosures = useNativeChatDisclosures()
+  return (
+    <NativeChatDisclosureContext.Provider value={disclosures}>
+      {mounted ? (
+        <NativeChatToolRun
+          blocks={askBlocks('completed')}
+          expandSignal
+          activeTurnIsWorking={false}
+          disclosureId="message-1"
+        />
+      ) : null}
+    </NativeChatDisclosureContext.Provider>
+  )
+}
+
 describe('NativeChatToolRun awaiting-input row', () => {
   it('does not revive stale tool state after a turn stops', () => {
     render(
@@ -80,9 +124,89 @@ describe('NativeChatToolRun awaiting-input row', () => {
     expect(screen.getByText('Asked:')).not.toHaveClass('animate-pulse')
     expect(screen.getByText(QUESTION)).toBeInTheDocument()
     // A run that is only the ask has no work left to head, so it draws no header.
+    expect(container.querySelector('[data-native-chat-tool-run-state]')).toBeNull()
+  })
+
+  it('leaves a question that fits on its line as plain text', () => {
+    const { container } = render(
+      <NativeChatToolRun blocks={askBlocks('completed')} expandSignal activeTurnIsWorking={false} />
+    )
+    expect(screen.getByText(QUESTION)).toHaveClass('truncate')
     expect(container.querySelector('button')).toBeNull()
   })
 
+  it('opens a clipped question below the toggle and folds it back', () => {
+    const restore = clipEveryLine()
+    try {
+      render(
+        <NativeChatToolRun
+          blocks={askBlocks('completed')}
+          expandSignal
+          activeTurnIsWorking={false}
+        />
+      )
+      const toggle = screen.getByRole('button', { name: /Asked:/ })
+      expect(toggle).toHaveAttribute('aria-expanded', 'false')
+
+      fireEvent.click(toggle)
+      expect(toggle).toHaveAttribute('aria-expanded', 'true')
+      const full = screen.getByText(QUESTION)
+      expect(full).not.toHaveClass('truncate')
+      // Outside the button, so it selects like prose and a click in it keeps it open.
+      expect(full.closest('button')).toBeNull()
+      fireEvent.click(full)
+      expect(toggle).toHaveAttribute('aria-expanded', 'true')
+
+      fireEvent.click(toggle)
+      expect(toggle).toHaveAttribute('aria-expanded', 'false')
+      expect(screen.getByText(QUESTION)).toHaveClass('truncate')
+    } finally {
+      restore()
+    }
+  })
+
+  it('keeps an opened question open when the windowed row remounts', () => {
+    const restore = clipEveryLine()
+    try {
+      const { rerender } = render(<DisclosureHarness mounted />)
+      fireEvent.click(screen.getByRole('button', { name: /Asked:/ }))
+
+      rerender(<DisclosureHarness mounted={false} />)
+      expect(screen.queryByText(QUESTION)).toBeNull()
+      rerender(<DisclosureHarness mounted />)
+
+      const toggle = screen.getByRole('button', { name: /Asked:/ })
+      expect(toggle).toHaveAttribute('aria-expanded', 'true')
+      expect(screen.getByText(QUESTION).closest('button')).toBeNull()
+
+      // Folding it keeps the same control, so keyboard focus is not dropped.
+      toggle.focus()
+      fireEvent.click(toggle)
+      expect(document.activeElement).toBe(toggle)
+      expect(toggle).toHaveAttribute('aria-expanded', 'false')
+    } finally {
+      restore()
+    }
+  })
+
+  it('offers no expansion when the row names only a question count', () => {
+    const restore = clipEveryLine()
+    try {
+      const input = { questions: [{ question: 'First?' }, { question: 'Second?' }] }
+      render(
+        <NativeChatToolRun
+          blocks={[{ type: 'tool-call', name: 'AskUserQuestion', input, state: 'completed' }]}
+          expandSignal
+          activeTurnIsWorking={false}
+        />
+      )
+      expect(screen.getByText('2 questions')).toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: /Asked:/ })).toBeNull()
+    } finally {
+      restore()
+    }
+  })
+
   it('counts only the work that ran in the header beside the ask', () => {
     const blocks: NativeChatBlock[] = [
       { type: 'tool-call', name: 'Read', input: { file_path: 'a.ts' }, state: 'completed' },
@@ -107,7 +231,7 @@ describe('NativeChatToolRun awaiting-input row', () => {
       />
     )
 
-    expect(screen.getByText('Awaiting user input:')).toBeInTheDocument()
+    expect(screen.getByText('Awaiting user input')).toBeInTheDocument()
     expect(screen.queryByText(/request_user_input/)).toBeNull()
   })
 })
diff --git a/src/renderer/src/components/native-chat/NativeChatToolRun.tsx b/src/renderer/src/components/native-chat/NativeChatToolRun.tsx
index bb8d9f96302..a6cb100ff58 100644
--- a/src/renderer/src/components/native-chat/NativeChatToolRun.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatToolRun.tsx
@@ -58,7 +58,6 @@ export function NativeChatToolRun({
   activeTurnIsWorking,
   trailing,
   expandOverride,
-  structuredActivityUi = true,
   disclosureId,
   onLinkClick
 }: {
@@ -81,7 +80,6 @@ export function NativeChatToolRun({
    *  the agent has already moved past reads as settled even mid-call. Left
    *  unset, a working turn's run is taken to be its last. */
   trailing?: boolean
-  structuredActivityUi?: boolean
   /** Message this run belongs to. Windowing unmounts rows, so a run the reader
    *  opened has to be remembered somewhere that outlives the row. */
   disclosureId?: string
@@ -130,10 +128,9 @@ export function NativeChatToolRun({
   // caller with no turn state, or a turn blocked on the reader's answer, falls
   // back to the calls themselves.
   const live =
-    structuredActivityUi &&
-    (activeTurnIsWorking === true && !askIsActive
+    activeTurnIsWorking === true && !askIsActive
       ? trailing !== false
-      : selectActiveToolCall(headerBlocks, { activeTurnIsWorking }) !== null)
+      : selectActiveToolCall(headerBlocks, { activeTurnIsWorking }) !== null
   // One sentence for the whole run, or the command itself when the run is one
   // call — the reader recognizes `git push` faster than "Ran 1 command".
   const runSentence = nativeChatToolRunSentence(headerBlocks, { live })
@@ -199,7 +196,6 @@ export function NativeChatToolRun({
   // the grouped row visible here made a failed child command look like the
   // whole response was still running (or had failed) even while collapsed.
   if (
-    structuredActivityUi &&
     expandOverride === false &&
     !(revealedDiff && open) &&
     !live &&
@@ -217,7 +213,13 @@ export function NativeChatToolRun({
     <div className="mt-3">
       {standaloneRows}
       {hasAskCall ? (
-        <NativeChatAwaitingInputRow subject={askSubject} pending={askIsActive} />
+        <NativeChatAwaitingInputRow
+          subject={askSubject}
+          pending={askIsActive}
+          disclosureKey={disclosureId === undefined ? undefined : `ask:${disclosureId}`}
+          // A grouped ask here still names only its count.
+          listsQuestions={false}
+        />
       ) : null}
       {!showsHeader ? null : (
         // One element for the run's whole life. Live and settled are states of
@@ -231,7 +233,7 @@ export function NativeChatToolRun({
           aria-live="polite"
           data-native-chat-tool-run-state={live ? 'live' : 'settled'}
         >
-          {structuredActivityUi && settledHeaderIcon ? (
+          {settledHeaderIcon ? (
             <NativeChatToolRunIcon iconName={settledHeaderIcon} className="text-muted-foreground" />
           ) : null}
           {/* The run in words, in the transcript's own type. Present tense while
@@ -272,7 +274,7 @@ export function NativeChatToolRun({
           {/* Only a stated success is marked done — see nativeChatToolRunOutcome —
               and never while live: between two calls nothing is running, and a
               mark that appeared then would flash on every call. */}
-          {structuredActivityUi && !live && runSucceeded ? (
+          {!live && runSucceeded ? (
             <Check aria-hidden className="size-3 shrink-0 text-muted-foreground" />
           ) : null}
           {latestCallLabel ? (
diff --git a/src/renderer/src/components/native-chat/NativeChatTranscriptItems.tsx b/src/renderer/src/components/native-chat/NativeChatTranscriptItems.tsx
index c8b51e0263e..ca3f3709b12 100644
--- a/src/renderer/src/components/native-chat/NativeChatTranscriptItems.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatTranscriptItems.tsx
@@ -48,3 +48,20 @@ export function NativeChatTranscriptItems({
     </div>
   )
 }
+
+/** Rows drawn after the live turn's activity, outside the window: few, and the newest there are. */
+export function NativeChatWaitingTranscriptItems({
+  slots,
+  context
+}: {
+  slots: readonly NativeChatTranscriptSlot[]
+  context: NativeChatTranscriptRowContext
+}): React.JSX.Element {
+  return (
+    <>
+      {slots.map((slot) => (
+        <NativeChatTranscriptRow key={slot.message.id} slot={slot} context={context} />
+      ))}
+    </>
+  )
+}
diff --git a/src/renderer/src/components/native-chat/NativeChatTranscriptRow.tsx b/src/renderer/src/components/native-chat/NativeChatTranscriptRow.tsx
index 266f528ebfd..91e71df2140 100644
--- a/src/renderer/src/components/native-chat/NativeChatTranscriptRow.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatTranscriptRow.tsx
@@ -1,7 +1,7 @@
 import { memo } from 'react'
 import type { CommentMarkdownLinkClickHandler } from '@/components/sidebar/CommentMarkdown'
 import type { RuntimeFileOperationArgs } from '@/runtime/runtime-file-client'
-import { MessageRow } from './NativeChatMessageRow'
+import { MessageRow, type NativeChatDeliveryNotice } from './NativeChatMessageRow'
 import { NativeChatResolutionReceipt } from './NativeChatResolutionReceipt'
 import { NativeChatWorkingStatus } from './NativeChatWorkingStatus'
 import { NativeChatTurnDiffRollup } from './NativeChatTurnDiffRollup'
@@ -13,11 +13,11 @@ import type { NativeChatDiffReveal, NativeChatDiffTarget } from './native-chat-t
  *  object so a row's props change only when that row's own slot does. */
 export type NativeChatTranscriptRowContext = {
   expandSignal: boolean
-  showTurnStatus: boolean
   revealedDiff: NativeChatDiffReveal | null
   taskListPredecessors: ReadonlyMap<string, NativeChatTaskListPredecessors>
   expandedTurnIds: ReadonlySet<string>
-  failedDeliveryMessageIds?: ReadonlySet<string>
+  /** Keyed by message id: the user messages that did not go through, each with its own words. */
+  deliveryNotices?: ReadonlyMap<string, NativeChatDeliveryNotice>
   allowFileUriLinks: boolean
   runtimeContext?: RuntimeFileOperationArgs | null
   onLinkClick?: CommentMarkdownLinkClickHandler
@@ -42,10 +42,22 @@ export const NativeChatTranscriptRow = memo(function NativeChatTranscriptRow({
   const { message, turnKey, status, receipt, turnDiff } = slot
   const predecessors = context.taskListPredecessors.get(message.id)
   const expanded = turnKey ? context.expandedTurnIds.has(turnKey) : undefined
+  const statusRow = status ? (
+    <NativeChatWorkingStatus
+      startedAt={status.startedAt}
+      workedSeconds={status.workedSeconds}
+      expanded={expanded === true}
+      onToggleExpanded={
+        slot.turnFolds && turnKey ? () => context.onToggleExpandedTurn(turnKey) : undefined
+      }
+    />
+  ) : null
   return (
     <div className="flex flex-col gap-5">
+      {/* A turn with no user bubble carries its bar above its first row. */}
+      {slot.statusAbove ? statusRow : null}
       {receipt ? (
-        <NativeChatResolutionReceipt body={receipt} />
+        <NativeChatResolutionReceipt body={receipt} disclosureId={message.id} />
       ) : (
         <MessageRow
           message={message}
@@ -60,23 +72,13 @@ export const NativeChatTranscriptRow = memo(function NativeChatTranscriptRow({
           onScrollMessageToTop={context.onScrollMessageToTop}
           onLinkClick={context.onLinkClick}
           allowFileUriLinks={context.allowFileUriLinks}
-          deliveryFailed={context.failedDeliveryMessageIds?.has(message.id) === true}
-          structuredActivityUi={context.showTurnStatus}
+          deliveryNotice={context.deliveryNotices?.get(message.id)}
           folded={slot.folded}
+          subagentLabel={slot.subagentLabel}
           runtimeContext={context.runtimeContext}
         />
       )}
-      {status ? (
-        <NativeChatWorkingStatus
-          startedAt={status.startedAt}
-          thinking={status.thinking}
-          workedSeconds={status.workedSeconds}
-          expanded={expanded === true}
-          onToggleExpanded={
-            slot.turnFolds && turnKey ? () => context.onToggleExpandedTurn(turnKey) : undefined
-          }
-        />
-      ) : null}
+      {slot.statusAbove ? null : statusRow}
       {turnDiff ? (
         <NativeChatTurnDiffRollup diff={turnDiff} onReveal={context.onRevealDiff} />
       ) : null}
diff --git a/src/renderer/src/components/native-chat/NativeChatTurnActivityLine.tsx b/src/renderer/src/components/native-chat/NativeChatTurnActivityLine.tsx
index 72e11ad25a8..3813ff8d203 100644
--- a/src/renderer/src/components/native-chat/NativeChatTurnActivityLine.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatTurnActivityLine.tsx
@@ -1,55 +1,30 @@
 import { Loader2 } from 'lucide-react'
 import { translate } from '@/i18n/i18n'
 import type { NativeChatTurnActivity } from '../../../../shared/native-chat-turn-activity'
-import {
-  describeNativeChatActiveTurnLabel,
-  NATIVE_CHAT_TURN_STATUS_COPY,
-  type NativeChatTurnStatus
-} from '../../../../shared/native-chat-turn-status'
-import { useNativeChatElapsedSeconds } from './use-native-chat-elapsed-seconds'
+import { describeNativeChatActiveTurnLabel } from '../../../../shared/native-chat-turn-status'
 
-/** The live turn's one indicator: a spinner plus whatever the turn can say about
- *  itself — the provider's activity text, else that it is reasoning, else how
- *  long it has been working. A settled turn keeps its own `NativeChatWorkingStatus`
- *  row; this one is only ever rendered while the turn is in flight. */
+/** The live turn's tail line: a spinner plus what the turn is doing right now —
+ *  the provider's activity text, else that it is reasoning, else plain "Working…".
+ *  The clock lives in the turn bar under the user's message, not here. */
 export function NativeChatTurnActivityLine({
   activity,
-  status
+  thinking
 }: {
   activity?: NativeChatTurnActivity | null
-  status?: NativeChatTurnStatus | null
+  thinking: boolean
 }): React.JSX.Element {
-  const thinking = status?.thinking === true
-  // The clock only ticks when its number is the label; activity text and
-  // "Thinking" carry no duration.
-  const counting = status != null && !thinking && !activity?.text
-  const elapsedSeconds = useNativeChatElapsedSeconds(status?.startedAt ?? null, counting)
-  const resolved = describeNativeChatActiveTurnLabel({
-    activityText: activity?.text,
-    thinking,
-    elapsedSeconds
-  })
+  const resolved = describeNativeChatActiveTurnLabel({ activityText: activity?.text, thinking })
   const label =
     resolved.source === 'activity'
       ? resolved.text
-      : status == null
-        ? translate('components.native-chat.status.working', 'Working…')
-        : resolved.key === 'thinking'
-          ? translate(
-              'components.native-chat.status.thinking',
-              NATIVE_CHAT_TURN_STATUS_COPY.thinking
-            )
-          : translate(
-              'components.native-chat.status.workingFor',
-              NATIVE_CHAT_TURN_STATUS_COPY.workingFor,
-              { value0: resolved.duration }
-            )
+      : resolved.key === 'thinking'
+        ? translate('components.native-chat.status.thinking', 'Thinking')
+        : translate('components.native-chat.status.working', 'Working…')
 
   return (
     <div
       className="flex min-h-6 items-center gap-1.5 text-sm leading-relaxed text-muted-foreground"
       data-native-chat-turn-activity="true"
-      data-native-chat-turn-status="active"
       aria-live="polite"
       aria-atomic="true"
     >
diff --git a/src/renderer/src/components/native-chat/NativeChatTypingIndicatorRow.tsx b/src/renderer/src/components/native-chat/NativeChatTypingIndicatorRow.tsx
deleted file mode 100644
index 59969c1dece..00000000000
--- a/src/renderer/src/components/native-chat/NativeChatTypingIndicatorRow.tsx
+++ /dev/null
@@ -1,21 +0,0 @@
-import { translate } from '@/i18n/i18n'
-
-export function NativeChatTypingIndicatorRow(): React.JSX.Element {
-  return (
-    <div
-      className="flex items-center justify-start"
-      aria-label={translate('components.native-chat.status.responding', 'Agent is responding')}
-      aria-live="polite"
-    >
-      <div className="flex h-8 items-center gap-1.5 text-muted-foreground">
-        {[0, 1, 2].map((i) => (
-          <span
-            key={i}
-            className="size-1.5 animate-bounce rounded-full bg-muted-foreground/70"
-            style={{ animationDelay: `${i * 160}ms` }}
-          />
-        ))}
-      </div>
-    </div>
-  )
-}
diff --git a/src/renderer/src/components/native-chat/NativeChatView.test.tsx b/src/renderer/src/components/native-chat/NativeChatView.test.tsx
index cc25dabc125..e7e09d2070a 100644
--- a/src/renderer/src/components/native-chat/NativeChatView.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatView.test.tsx
@@ -35,8 +35,10 @@ function renderResolution(
   )
 }
 
+const notComposing = (): boolean => false
+
 function DraftProbe({ paneKey, sessionId }: { paneKey: string; sessionId: string | null }) {
-  const { draft, setDraft } = useNativeChatDraft(paneKey)
+  const { draft, setDraft } = useNativeChatDraft(paneKey, notComposing)
   return (
     <label>
       Session {sessionId ?? 'none'}
diff --git a/src/renderer/src/components/native-chat/NativeChatWorkingStatus.tsx b/src/renderer/src/components/native-chat/NativeChatWorkingStatus.tsx
index c610abff7d6..53e31157075 100644
--- a/src/renderer/src/components/native-chat/NativeChatWorkingStatus.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatWorkingStatus.tsx
@@ -9,27 +9,22 @@ import { useNativeChatElapsedSeconds } from './use-native-chat-elapsed-seconds'
 
 export { formatNativeChatDuration }
 
+/** The turn bar under the user's message: a running clock while the turn works,
+ *  then the settled duration, which toggles the turn's folded detail. */
 export function NativeChatWorkingStatus({
   startedAt,
-  thinking,
   workedSeconds,
   expanded = false,
   onToggleExpanded
 }: {
   startedAt: number | null
-  thinking: boolean
   workedSeconds?: number | null
   expanded?: boolean
   onToggleExpanded?: () => void
 }): React.JSX.Element {
-  const counting = !thinking && workedSeconds == null
-  const elapsedSeconds = useNativeChatElapsedSeconds(startedAt, counting)
+  const elapsedSeconds = useNativeChatElapsedSeconds(startedAt, workedSeconds == null)
 
-  const { key, duration } = describeNativeChatTurnStatus({
-    thinking,
-    workedSeconds,
-    elapsedSeconds
-  })
+  const { key, duration } = describeNativeChatTurnStatus({ workedSeconds, elapsedSeconds })
   const label =
     key === 'workedFor'
       ? translate(
@@ -39,15 +34,14 @@ export function NativeChatWorkingStatus({
             value0: duration
           }
         )
-      : key === 'thinking'
-        ? translate('components.native-chat.status.thinking', NATIVE_CHAT_TURN_STATUS_COPY.thinking)
-        : translate(
-            'components.native-chat.status.workingFor',
-            NATIVE_CHAT_TURN_STATUS_COPY.workingFor,
-            { value0: duration }
-          )
+      : translate(
+          'components.native-chat.status.workingFor',
+          NATIVE_CHAT_TURN_STATUS_COPY.workingFor,
+          { value0: duration }
+        )
   // `tabular-nums`: the live clock reflows its own label every second otherwise.
-  const className = `flex min-h-8 items-center gap-1 text-sm text-muted-foreground tabular-nums${thinking ? '' : ' border-b border-border'}`
+  const className =
+    'flex min-h-8 items-center gap-1 border-b border-border text-sm text-muted-foreground tabular-nums'
   const caret =
     workedSeconds != null && onToggleExpanded ? (
       <ChevronRight
@@ -82,9 +76,8 @@ export function NativeChatWorkingStatus({
         'components.native-chat.status.responding',
         NATIVE_CHAT_TURN_STATUS_COPY.responding
       )}
-      aria-live="polite"
     >
-      <span className={thinking ? 'animate-pulse' : undefined}>{label}</span>
+      <span>{label}</span>
       {caret}
     </div>
   )
diff --git a/src/renderer/src/components/native-chat/StructuredAgentSessionAttentionBridge.test.tsx b/src/renderer/src/components/native-chat/StructuredAgentSessionAttentionBridge.test.tsx
index ba210d74994..4b31d0b0357 100644
--- a/src/renderer/src/components/native-chat/StructuredAgentSessionAttentionBridge.test.tsx
+++ b/src/renderer/src/components/native-chat/StructuredAgentSessionAttentionBridge.test.tsx
@@ -10,6 +10,7 @@ import { act, cleanup, render, waitFor } from '@testing-library/react'
 import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
 import type { AgentJournalTurnOutcome } from '../../../../shared/agent-session-journal-types'
 import type {
+  AgentSessionStatusEvent,
   AgentSessionTurnCompletion,
   AgentSessionTurnCompletionEvent
 } from '../../../../shared/agent-session-wire'
@@ -27,7 +28,9 @@ type TestStore = {
 type BridgeMocks = {
   store: TestStore | null
   emitters: ((event: AgentSessionTurnCompletionEvent) => void)[]
+  statusEmitters: ((event: AgentSessionStatusEvent) => void)[]
   subscribeCompletions: Mock
+  subscribeStatus: Mock
   supportsCapability: Mock
   unsubscribe: Mock
 }
@@ -35,7 +38,9 @@ type BridgeMocks = {
 const mocks = vi.hoisted<BridgeMocks>(() => ({
   store: null,
   emitters: [],
+  statusEmitters: [],
   subscribeCompletions: vi.fn(),
+  subscribeStatus: vi.fn(),
   supportsCapability: vi.fn(),
   unsubscribe: vi.fn()
 }))
@@ -58,11 +63,16 @@ vi.mock('@/runtime/runtime-rpc-client', async (importOriginal) => ({
 }))
 
 vi.mock('@/runtime/structured-agent-session-client', () => ({
-  subscribeStructuredAgentSessionTurnCompletions: mocks.subscribeCompletions
+  subscribeStructuredAgentSessionTurnCompletions: mocks.subscribeCompletions,
+  subscribeStructuredAgentSessionStatus: mocks.subscribeStatus
 }))
 
 import { StructuredAgentSessionAttentionBridge } from './StructuredAgentSessionAttentionBridge'
 import { resetStructuredAgentSessionTurnCompletionFeedsForTests } from '@/runtime/structured-agent-session-turn-completion-feed'
+import {
+  getStructuredAgentSessionStatusFeed,
+  resetStructuredAgentSessionStatusFeedsForTests
+} from '@/runtime/structured-agent-session-status-feed'
 import {
   makeTabGroup,
   makeUnifiedTab,
@@ -176,7 +186,15 @@ describe('StructuredAgentSessionAttentionBridge', () => {
       }
     })
     resetStructuredAgentSessionTurnCompletionFeedsForTests()
+    resetStructuredAgentSessionStatusFeedsForTests()
     mocks.emitters.length = 0
+    mocks.statusEmitters.length = 0
+    mocks.subscribeStatus.mockImplementation(
+      (_target: unknown, emit: (event: AgentSessionStatusEvent) => void) => {
+        mocks.statusEmitters.push(emit)
+        return Promise.resolve({ unsubscribe: vi.fn() })
+      }
+    )
     mocks.subscribeCompletions.mockImplementation(
       (_target: unknown, emit: (event: AgentSessionTurnCompletionEvent) => void) => {
         mocks.emitters.push(emit)
@@ -215,6 +233,7 @@ describe('StructuredAgentSessionAttentionBridge', () => {
     cleanup()
     vi.unstubAllGlobals()
     resetStructuredAgentSessionTurnCompletionFeedsForTests()
+    resetStructuredAgentSessionStatusFeedsForTests()
   })
 
   it('lights the unread indicators when the host reports a successful turn', async () => {
@@ -235,14 +254,14 @@ describe('StructuredAgentSessionAttentionBridge', () => {
       worktreeId: WORKSPACE,
       paneKey: CHAT_SUBJECT,
       agentState: 'done',
-      agentInterrupted: false
+      agentTurnOutcome: 'success'
     })
   })
 
   // A settled turn is news whichever way it settled, exactly as the CLI lane treats one. The
-  // difference is wording, and it rides the notification flag that already says "stopped".
+  // difference is wording, which main picks from the verdict.
   it.each(['failure', 'cancellation'] as const)(
-    'lights the indicators and says stopped for a %s the host reports',
+    'lights the indicators and hands main the %s the host reports',
     async (outcome) => {
       render(<StructuredAgentSessionAttentionBridge />)
       await waitFor(() => expect(mocks.subscribeCompletions).toHaveBeenCalledOnce())
@@ -254,7 +273,7 @@ describe('StructuredAgentSessionAttentionBridge', () => {
         paneDot: 'agent-completion',
         tabDot: 'agent-completion'
       })
-      expect(onlyDispatch()).toMatchObject({ agentState: 'done', agentInterrupted: true })
+      expect(onlyDispatch()).toMatchObject({ agentState: 'done', agentTurnOutcome: outcome })
     }
   )
 
@@ -299,6 +318,48 @@ describe('StructuredAgentSessionAttentionBridge', () => {
     }
   )
 
+  // Remote clients receive the status and completion streams over separate sockets, unordered, so
+  // the wording must come from the completion alone. The mirror is set to disagree in each case.
+  function mirrorStatus(status: 'idle' | 'attention'): void {
+    mocks.statusEmitters[0]?.({
+      type: 'status',
+      session: {
+        sessionId: SESSION,
+        workspaceId: 'host-side-workspace',
+        agent: 'claude',
+        status,
+        latestPrompt: 'Ship it',
+        updatedAt: 1
+      }
+    })
+  }
+
+  it.each([
+    { awaitingUser: true, mirror: 'idle', agentState: 'blocked' },
+    { awaitingUser: undefined, mirror: 'attention', agentState: 'done' }
+  ] as const)(
+    'words awaitingUser=$awaitingUser as $agentState whatever the status mirror says ($mirror)',
+    async ({ awaitingUser, mirror, agentState }) => {
+      const stopStatus = getStructuredAgentSessionStatusFeed({ kind: 'local' }).activate()
+      render(<StructuredAgentSessionAttentionBridge />)
+      await waitFor(() => expect(mocks.subscribeCompletions).toHaveBeenCalledOnce())
+      await waitFor(() => expect(mocks.subscribeStatus).toHaveBeenCalledOnce())
+      const completion = turnCompletion()
+
+      act(() => {
+        mirrorStatus(mirror)
+        hostStream()({
+          type: 'completion',
+          completion: awaitingUser ? { ...completion, awaitingUser } : completion
+        })
+      })
+
+      expect(indicators().paneDot).toBe('agent-completion')
+      expect(onlyDispatch()).toMatchObject({ agentState, agentTurnOutcome: 'success' })
+      stopStatus()
+    }
+  )
+
   it('lights nothing for a turn whose outcome the host never stated', async () => {
     render(<StructuredAgentSessionAttentionBridge />)
     await waitFor(() => expect(mocks.subscribeCompletions).toHaveBeenCalledOnce())
diff --git a/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.test.tsx b/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.test.tsx
index 6cdaa2646e4..42091c79de9 100644
--- a/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.test.tsx
+++ b/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.test.tsx
@@ -64,7 +64,7 @@ vi.mock('@/runtime/structured-agent-session-client', () => ({
 import {
   getStructuredAgentSessionTabs,
   StructuredAgentSessionStatusBridge,
-  useStructuredAgentSessionHostExecutionPhase
+  useStructuredAgentSessionHostExecution
 } from './StructuredAgentSessionStatusBridge'
 import { resetStructuredAgentSessionStatusFeedsForTests } from '@/runtime/structured-agent-session-status-feed'
 
@@ -698,28 +698,102 @@ describe('StructuredAgentSessionStatusBridge', () => {
     expect(mocks.setAgentStatus).not.toHaveBeenCalled()
   })
 
-  it('re-renders a startup-phase reader only when the phase changes', async () => {
-    const phases: (string | null)[] = []
+  it('re-renders a startup reader only when its phase or child changes', async () => {
+    const executions: ReturnType<typeof useStructuredAgentSessionHostExecution>[] = []
     function PhaseProbe(): null {
-      phases.push(useStructuredAgentSessionHostExecutionPhase('session-1', { kind: 'local' }))
+      executions.push(useStructuredAgentSessionHostExecution('session-1', { kind: 'local' }))
       return null
     }
     render(<PhaseProbe />)
     await waitFor(() => expect(mocks.subscribeStatus).toHaveBeenCalledOnce())
 
-    act(() => feed().emit({ type: 'status', session: summary({ hostExecutionPhase: 'starting' }) }))
-    const rendersWhileStarting = phases.length
     act(() =>
       feed().emit({
         type: 'status',
-        session: summary({ hostExecutionPhase: 'starting', latestPrompt: 'next', updatedAt: 2 })
+        session: summary({
+          hostExecutionPhase: 'starting',
+          hostExecutionChild: { generation: 'child-1', fence: 1 }
+        })
       })
     )
-    expect(phases).toHaveLength(rendersWhileStarting)
+    const rendersWhileStarting = executions.length
+    act(() =>
+      feed().emit({
+        type: 'status',
+        session: summary({
+          hostExecutionPhase: 'starting',
+          hostExecutionChild: { generation: 'child-1', fence: 1 },
+          latestPrompt: 'next',
+          updatedAt: 2
+        })
+      })
+    )
+    expect(executions).toHaveLength(rendersWhileStarting)
+    act(() =>
+      feed().emit({
+        type: 'status',
+        session: summary({
+          hostExecutionPhase: 'starting',
+          hostExecutionChild: { generation: 'child-1', fence: 2 }
+        })
+      })
+    )
+    expect(executions).toHaveLength(rendersWhileStarting)
 
-    act(() => feed().emit({ type: 'status', session: summary({ hostExecutionPhase: 'ready' }) }))
-    expect(phases.at(-1)).toBe('ready')
-    expect(phases).toContain('starting')
+    act(() =>
+      feed().emit({
+        type: 'status',
+        session: summary({
+          hostExecutionPhase: 'ready',
+          hostExecutionChild: { generation: 'child-1', fence: 1 }
+        })
+      })
+    )
+    expect(executions.at(-1)?.phase).toBe('ready')
+    act(() =>
+      feed().emit({
+        type: 'status',
+        session: summary({
+          hostExecutionPhase: 'starting',
+          hostExecutionChild: { generation: 'child-2', fence: 2 }
+        })
+      })
+    )
+    expect(executions.at(-1)).toEqual({
+      phase: 'starting',
+      childKey: 'child-2'
+    })
+    expect(executions.some(({ phase }) => phase === 'starting')).toBe(true)
+  })
+
+  it('uses the fence for a child whose acquisition has no generation', async () => {
+    const executions: ReturnType<typeof useStructuredAgentSessionHostExecution>[] = []
+    function PhaseProbe(): null {
+      executions.push(useStructuredAgentSessionHostExecution('session-1', { kind: 'local' }))
+      return null
+    }
+    render(<PhaseProbe />)
+    await waitFor(() => expect(mocks.subscribeStatus).toHaveBeenCalledOnce())
+    act(() =>
+      feed().emit({
+        type: 'status',
+        session: summary({
+          hostExecutionPhase: 'starting',
+          hostExecutionChild: { generation: null, fence: 1 }
+        })
+      })
+    )
+    expect(executions.at(-1)?.childKey).toBe(1)
+    act(() =>
+      feed().emit({
+        type: 'status',
+        session: summary({
+          hostExecutionPhase: 'starting',
+          hostExecutionChild: { generation: null, fence: 2 }
+        })
+      })
+    )
+    expect(executions.at(-1)?.childKey).toBe(2)
   })
 })
 
diff --git a/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.tsx b/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.tsx
index 92d3128d082..8205d96a5af 100644
--- a/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.tsx
+++ b/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.tsx
@@ -8,7 +8,8 @@ import {
 } from '../../../../shared/agent-status-child-work-projection'
 import {
   continueMainAgentStatus,
-  isAgentStatusHeldOpenByChildWork
+  isAgentStatusHeldOpenByChildWork,
+  mainAgentTurnInterrupted
 } from '../../../../shared/agent-lead-status-fold'
 import { mainAgentStatusEqual, agentSubagentsEqual } from '../../../../shared/agent-status-types'
 import { structuredAgentSessionPaneKey } from '../../../../shared/structured-agent-session-projection'
@@ -46,18 +47,30 @@ export function useStructuredAgentSessionStatusSummary(
   return { summary, observation }
 }
 
-/** Only the host's startup phase, so a chat re-renders when that changes, not on every status. */
-export function useStructuredAgentSessionHostExecutionPhase(
+/** The host's child state, projected to stable primitives so journal updates do not re-render chat. */
+export function useStructuredAgentSessionHostExecution(
   sessionId: string,
   target: RuntimeClientTarget
-): NonNullable<AgentSessionStatusSummary['hostExecutionPhase']> | null {
+): {
+  phase: NonNullable<AgentSessionStatusSummary['hostExecutionPhase']> | null
+  childKey: string | number | null
+} {
   const feed = useMemo(() => getStructuredAgentSessionStatusFeed(target), [target])
   useEffect(() => feed.activate(), [feed])
-  return useSyncExternalStore(
+  const phase = useSyncExternalStore(
     feed.subscribe,
     () => feed.getSnapshot().get(sessionId)?.hostExecutionPhase ?? null,
     () => null
   )
+  const childKey = useSyncExternalStore(
+    feed.subscribe,
+    () => {
+      const child = feed.getSnapshot().get(sessionId)?.hostExecutionChild
+      return child?.generation ?? child?.fence ?? null
+    },
+    () => null
+  )
+  return { phase, childKey }
 }
 
 function projectStatus(
@@ -98,6 +111,8 @@ function projectStatus(
     state: agentStatus.state,
     ...(agentStatus.workingMode ? { workingMode: agentStatus.workingMode } : {}),
     mainAgent,
+    // Derived from `mainAgent`, so the equality below needs no second check of it.
+    interrupted: mainAgentTurnInterrupted(mainAgent),
     prompt: summary.latestPrompt,
     agentType: tab.agentSessionAgent,
     // The host projects these from the journal so the row reads like a hook-reported one:
diff --git a/src/renderer/src/components/native-chat/agent-session-write-notice-text.test.ts b/src/renderer/src/components/native-chat/agent-session-write-notice-text.test.ts
new file mode 100644
index 00000000000..260c910d01e
--- /dev/null
+++ b/src/renderer/src/components/native-chat/agent-session-write-notice-text.test.ts
@@ -0,0 +1,41 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import { i18n } from '@/i18n/i18n'
+import en from '@/i18n/locales/en.json'
+import { agentSessionWriteNoticeEnglish } from '../../../../shared/agent-session-refusal-notice'
+import {
+  AGENT_SESSION_WRITE_NOTICE_COPY,
+  type AgentSessionWriteNoticeSentence
+} from '../../../../shared/agent-session-write-notice-copy'
+import { agentSessionWriteNoticeText } from './agent-session-write-notice-text'
+
+const SENTENCES = Object.keys(AGENT_SESSION_WRITE_NOTICE_COPY).filter(
+  (key): key is AgentSessionWriteNoticeSentence => key in AGENT_SESSION_WRITE_NOTICE_COPY
+)
+
+afterEach(async () => {
+  await i18n.changeLanguage('en')
+})
+
+describe('desktop words for a write that did not happen', () => {
+  it('says exactly what the phone says in English', () => {
+    for (const sentence of SENTENCES) {
+      expect(agentSessionWriteNoticeText([sentence])).toBe(
+        agentSessionWriteNoticeEnglish([sentence])
+      )
+    }
+  })
+
+  it('keeps the English catalog in step with the shared copy', () => {
+    expect(en.components['native-chat'].writeNotice).toEqual(AGENT_SESSION_WRITE_NOTICE_COPY)
+  })
+
+  it('translates each sentence whole and shows a provider reason as written', async () => {
+    await i18n.changeLanguage('fr')
+    expect(agentSessionWriteNoticeText(['restartFailed', 'notDoneSend'])).toBe(
+      "L'agent n'a pas pu redémarrer. Votre message n'a pas été envoyé."
+    )
+    expect(
+      agentSessionWriteNoticeText([{ text: 'Claude messages support at most 20 images' }])
+    ).toBe('Claude messages support at most 20 images')
+  })
+})
diff --git a/src/renderer/src/components/native-chat/agent-session-write-notice-text.ts b/src/renderer/src/components/native-chat/agent-session-write-notice-text.ts
new file mode 100644
index 00000000000..812197d6e33
--- /dev/null
+++ b/src/renderer/src/components/native-chat/agent-session-write-notice-text.ts
@@ -0,0 +1,124 @@
+// Desktop words for a chat write that did not happen: each sentence translated whole, with the
+// shared English as its fallback so desktop and mobile never say it differently.
+
+import { translate } from '@/i18n/i18n'
+import { agentSessionWriteNoticeParts } from '../../../../shared/agent-session-refusal-notice'
+import {
+  AGENT_SESSION_WRITE_NOTICE_COPY as COPY,
+  type AgentSessionWriteNoticePart,
+  type AgentSessionWriteNoticeSentence
+} from '../../../../shared/agent-session-write-notice-copy'
+import type {
+  AgentSessionWriteFailure,
+  AgentSessionWriteKind
+} from '../../../../shared/agent-session-write-failure'
+
+const SENTENCES: Record<AgentSessionWriteNoticeSentence, () => string> = {
+  notDoneReadHistory: () =>
+    translate('components.native-chat.writeNotice.notDoneReadHistory', COPY.notDoneReadHistory),
+  notDoneSend: () => translate('components.native-chat.writeNotice.notDoneSend', COPY.notDoneSend),
+  tryAgainComposerSend: () =>
+    translate('components.native-chat.writeNotice.tryAgainComposerSend', COPY.tryAgainComposerSend),
+  notDoneStop: () => translate('components.native-chat.writeNotice.notDoneStop', COPY.notDoneStop),
+  notDoneStopTask: () =>
+    translate('components.native-chat.writeNotice.notDoneStopTask', COPY.notDoneStopTask),
+  notDoneStopTasks: () =>
+    translate('components.native-chat.writeNotice.notDoneStopTasks', COPY.notDoneStopTasks),
+  notDoneAnswer: () =>
+    translate('components.native-chat.writeNotice.notDoneAnswer', COPY.notDoneAnswer),
+  notDoneOption: () =>
+    translate('components.native-chat.writeNotice.notDoneOption', COPY.notDoneOption),
+  notDoneCommand: () =>
+    translate('components.native-chat.writeNotice.notDoneCommand', COPY.notDoneCommand),
+  notDoneGoal: () => translate('components.native-chat.writeNotice.notDoneGoal', COPY.notDoneGoal),
+  restartFailed: () =>
+    translate('components.native-chat.writeNotice.restartFailed', COPY.restartFailed),
+  capacity: () => translate('components.native-chat.writeNotice.capacity', COPY.capacity),
+  outcomeUnknown: () =>
+    translate('components.native-chat.writeNotice.outcomeUnknown', COPY.outcomeUnknown),
+  questionChanged: () =>
+    translate('components.native-chat.writeNotice.questionChanged', COPY.questionChanged),
+  historyUnreadable: () =>
+    translate('components.native-chat.writeNotice.historyUnreadable', COPY.historyUnreadable),
+  historyUnusable: () =>
+    translate('components.native-chat.writeNotice.historyUnusable', COPY.historyUnusable),
+  historyUnavailable: () =>
+    translate('components.native-chat.writeNotice.historyUnavailable', COPY.historyUnavailable),
+  unsupported: () => translate('components.native-chat.writeNotice.unsupported', COPY.unsupported),
+  unreachable: () => translate('components.native-chat.writeNotice.unreachable', COPY.unreachable),
+  recordFailed: () =>
+    translate('components.native-chat.writeNotice.recordFailed', COPY.recordFailed),
+  conversationCleared: () =>
+    translate('components.native-chat.writeNotice.conversationCleared', COPY.conversationCleared),
+  openCurrentConversation: () =>
+    translate(
+      'components.native-chat.writeNotice.openCurrentConversation',
+      COPY.openCurrentConversation
+    ),
+  clearUnfinished: () =>
+    translate('components.native-chat.writeNotice.clearUnfinished', COPY.clearUnfinished),
+  commandRunning: () =>
+    translate('components.native-chat.writeNotice.commandRunning', COPY.commandRunning),
+  waitForCommand: () =>
+    translate('components.native-chat.writeNotice.waitForCommand', COPY.waitForCommand),
+  agentStarting: () =>
+    translate('components.native-chat.writeNotice.agentStarting', COPY.agentStarting),
+  waitForStart: () =>
+    translate('components.native-chat.writeNotice.waitForStart', COPY.waitForStart),
+  turnActive: () => translate('components.native-chat.writeNotice.turnActive', COPY.turnActive),
+  waitForTurn: () => translate('components.native-chat.writeNotice.waitForTurn', COPY.waitForTurn),
+  promptPending: () =>
+    translate('components.native-chat.writeNotice.promptPending', COPY.promptPending),
+  answerFirst: () => translate('components.native-chat.writeNotice.answerFirst', COPY.answerFirst),
+  backgroundTasksRunning: () =>
+    translate(
+      'components.native-chat.writeNotice.backgroundTasksRunning',
+      COPY.backgroundTasksRunning
+    ),
+  waitForBackgroundTasks: () =>
+    translate(
+      'components.native-chat.writeNotice.waitForBackgroundTasks',
+      COPY.waitForBackgroundTasks
+    ),
+  messagesUnsettled: () =>
+    translate('components.native-chat.writeNotice.messagesUnsettled', COPY.messagesUnsettled),
+  settleEarlierMessage: () =>
+    translate('components.native-chat.writeNotice.settleEarlierMessage', COPY.settleEarlierMessage),
+  optionRejected: () =>
+    translate('components.native-chat.writeNotice.optionRejected', COPY.optionRejected),
+  goalsUnsupported: () =>
+    translate('components.native-chat.writeNotice.goalsUnsupported', COPY.goalsUnsupported),
+  agentRefused: () =>
+    translate('components.native-chat.writeNotice.agentRefused', COPY.agentRefused),
+  ownerUnproven: () =>
+    translate('components.native-chat.writeNotice.ownerUnproven', COPY.ownerUnproven),
+  reopenChat: () => translate('components.native-chat.writeNotice.reopenChat', COPY.reopenChat),
+  terminalAgentHoldsChat: () =>
+    translate(
+      'components.native-chat.writeNotice.terminalAgentHoldsChat',
+      COPY.terminalAgentHoldsChat
+    ),
+  quitTerminalAgent: () =>
+    translate('components.native-chat.writeNotice.quitTerminalAgent', COPY.quitTerminalAgent),
+  hostReconciling: () =>
+    translate('components.native-chat.writeNotice.hostReconciling', COPY.hostReconciling),
+  waitMoment: () => translate('components.native-chat.writeNotice.waitMoment', COPY.waitMoment),
+  recordUnreadable: () =>
+    translate('components.native-chat.writeNotice.recordUnreadable', COPY.recordUnreadable),
+  chatNotFound: () =>
+    translate('components.native-chat.writeNotice.chatNotFound', COPY.chatNotFound),
+  startNewChat: () =>
+    translate('components.native-chat.writeNotice.startNewChat', COPY.startNewChat),
+  tryAgain: () => translate('components.native-chat.writeNotice.tryAgain', COPY.tryAgain)
+}
+
+export function agentSessionWriteNoticeText(parts: readonly AgentSessionWriteNoticePart[]): string {
+  return parts.map((part) => (typeof part === 'string' ? SENTENCES[part]() : part.text)).join(' ')
+}
+
+export function agentSessionWriteFailureText(
+  failure: AgentSessionWriteFailure,
+  write: AgentSessionWriteKind
+): string {
+  return agentSessionWriteNoticeText(agentSessionWriteNoticeParts(failure, write))
+}
diff --git a/src/renderer/src/components/native-chat/background-task-header-content.ts b/src/renderer/src/components/native-chat/background-task-header-content.ts
index 0ec1c765e1f..acbd97cb543 100644
--- a/src/renderer/src/components/native-chat/background-task-header-content.ts
+++ b/src/renderer/src/components/native-chat/background-task-header-content.ts
@@ -166,8 +166,8 @@ export function backgroundTasksHeaderContent(
         : kindCountLabel(group.kind, 1)
     // A still-growing clock on finished work would lie, exactly as on the row.
     const elapsed =
-      group.kind === 'command' && !entry.settled
-        ? backgroundTaskElapsedLabel(entry.task, options.now)
+      group.kind === 'command' && !entry.row.settled
+        ? backgroundTaskElapsedLabel(entry.row.firstObservedAt, options.now)
         : null
     return {
       segments: [{ text: subject, kind: group.kind }],
diff --git a/src/renderer/src/components/native-chat/background-task-roster.test.ts b/src/renderer/src/components/native-chat/background-task-roster.test.ts
index eb2232056a7..f4159632c69 100644
--- a/src/renderer/src/components/native-chat/background-task-roster.test.ts
+++ b/src/renderer/src/components/native-chat/background-task-roster.test.ts
@@ -172,8 +172,8 @@ describe('buildBackgroundTaskGroups', () => {
       [agent('settled', { state: 'done', startedAt: 0 })]
     )
     expect(built.map((group) => group.kind)).toEqual(['agent', 'monitor'])
-    expect(built[0].tasks.map((entry) => entry.task.id)).toEqual(['settled', 'early', 'late'])
-    expect(built[0].tasks[0].settled).toBe(true)
+    expect(built[0].tasks.map((entry) => entry.row.id)).toEqual(['settled', 'early', 'late'])
+    expect(built[0].tasks[0].row.settled).toBe(true)
   })
 
   it('defaults the state slot so a stateless row still reads as work', () => {
@@ -234,9 +234,19 @@ describe('resumed tasks from mixed-version hosts', () => {
       [live, ...shells],
       [settled, agent('sibling', { state: 'done' })]
     )
-    expect(
-      groups.flatMap((group) => group.tasks).filter((entry) => entry.task.id === live.id)
-    ).toEqual([{ task: live, settled: false, state: 'working', name: 'Background agent' }])
+    const owners = groups
+      .flatMap((group) => group.tasks)
+      .filter((entry) => entry.row.id === live.id)
+    expect(owners).toHaveLength(1)
+    expect(owners[0]).toMatchObject({
+      row: {
+        settled: false,
+        displayState: 'working',
+        name: 'Background agent',
+        totalTokens: 20000
+      },
+      state: 'working'
+    })
     expect(backgroundTasksHeaderContent(groups, { narrow: false, now: NOW }).segments).toEqual([
       { text: '2 agents', kind: 'agent' },
       { text: '4 shells', kind: 'command' }
diff --git a/src/renderer/src/components/native-chat/background-task-roster.ts b/src/renderer/src/components/native-chat/background-task-roster.ts
index 4b1c290e944..7b62bb1f57c 100644
--- a/src/renderer/src/components/native-chat/background-task-roster.ts
+++ b/src/renderer/src/components/native-chat/background-task-roster.ts
@@ -6,6 +6,15 @@ import type {
   AgentSessionBackgroundTask,
   AgentSessionBackgroundTaskRunState
 } from '../../../../shared/agent-session-wire'
+import {
+  buildAgentChildRowModels,
+  buildLegacyTaskRowModels,
+  usableAgentChildLabel,
+  type AgentChildRowContext,
+  type AgentChildRowModel
+} from '../../../../shared/agent-child-row-model'
+import { agentChildRunStateFor } from '../../../../shared/agent-status-child-work-display'
+import type { AgentChildWorkView } from '../../../../shared/agent-status-child-work-view'
 import { formatNativeChatDuration } from '../../../../shared/native-chat-turn-status'
 import { translate } from '@/i18n/i18n'
 
@@ -13,10 +22,10 @@ type TaskKind = AgentSessionBackgroundTask['kind']
 type RunState = AgentSessionBackgroundTaskRunState
 
 export type BackgroundRosterTask = {
-  task: AgentSessionBackgroundTask
-  settled: boolean
+  /** What the row shows, decided by the same model the sidebar's child rows use. */
+  row: AgentChildRowModel
+  /** The row's display state in the header's vocabulary. */
   state: RunState
-  name: string
 }
 
 export type BackgroundTaskGroup = { kind: TaskKind; tasks: BackgroundRosterTask[] }
@@ -24,17 +33,6 @@ export type BackgroundTaskGroup = { kind: TaskKind; tasks: BackgroundRosterTask[
 /** Fixed presentation order; groups render only when non-empty. */
 const KIND_ORDER: readonly TaskKind[] = ['agent', 'command', 'monitor', 'workflow', 'unknown']
 
-/** Provider strings that carry no identity; a row falls through to its kind label. */
-const PLACEHOLDER_NAMES = new Set(['unknown', 'untitled', 'task', 'subagent'])
-
-function usableTaskText(value: string | undefined): string | null {
-  const trimmed = value?.trim()
-  if (!trimmed || PLACEHOLDER_NAMES.has(trimmed.toLowerCase())) {
-    return null
-  }
-  return trimmed
-}
-
 export function backgroundTaskKindLabel(kind: TaskKind): string {
   switch (kind) {
     case 'agent':
@@ -50,56 +48,63 @@ export function backgroundTaskKindLabel(kind: TaskKind): string {
   }
 }
 
-/** Display name: description → name → kind label. Empty-after-trim and
- *  placeholder values fall through, so a row always renders something. */
+/** The transcript row's name: description → name → kind label. Empty-after-trim and
+ *  placeholder values fall through, so the row always renders something. */
 export function resolveBackgroundTaskName(task: AgentSessionBackgroundTask): string {
   return (
-    usableTaskText(task.description) ??
-    usableTaskText(task.name) ??
+    usableAgentChildLabel(task.description) ??
+    usableAgentChildLabel(task.name) ??
     backgroundTaskKindLabel(task.kind)
   )
 }
 
-function effectiveState(task: AgentSessionBackgroundTask, settled: boolean): RunState {
-  if (task.state) {
-    return task.state
-  }
-  if (settled) {
-    return 'done'
-  }
-  return task.kind === 'monitor' ? 'monitoring' : 'working'
+/** Stable-sort first-seen then id, so a live update never reshuffles surviving rows. */
+function groupRosterEntries(entries: BackgroundRosterTask[]): BackgroundTaskGroup[] {
+  entries.sort((left, right) => {
+    const startDelta = left.row.firstObservedAt - right.row.firstObservedAt
+    return startDelta !== 0 ? startDelta : left.row.id < right.row.id ? -1 : 1
+  })
+  return KIND_ORDER.map((kind) => ({
+    kind,
+    tasks: entries.filter((entry) => entry.row.kind === kind)
+  })).filter((group) => group.tasks.length > 0)
 }
 
-/** Merge live and settled tasks into kind groups, stable-sorted first-seen
- *  (startedAt) then id, so a live update never reshuffles surviving rows. */
+function rosterEntries(rows: readonly AgentChildRowModel[]): BackgroundTaskGroup[] {
+  return groupRosterEntries(
+    rows.map((row) => ({ row, state: agentChildRunStateFor(row.displayState) }))
+  )
+}
+
+/** Kind groups from a host that publishes only the task roster, live and settled merged. */
 export function buildBackgroundTaskGroups(
   tasks: readonly AgentSessionBackgroundTask[],
   settledTasks: readonly AgentSessionBackgroundTask[]
 ): BackgroundTaskGroup[] {
-  // Older hosts can retain a previous turn beside its resumed live task.
-  const owners = new Map<string, BackgroundRosterTask>()
-  for (const [roster, settled] of [
-    [settledTasks, true],
-    [tasks, false]
-  ] as const) {
-    for (const task of roster) {
-      owners.set(task.id, {
-        task,
-        settled,
-        state: effectiveState(task, settled),
-        name: resolveBackgroundTaskName(task)
-      })
-    }
-  }
-  const entries = [...owners.values()]
-  entries.sort((left, right) => {
-    const startDelta = (left.task.startedAt ?? 0) - (right.task.startedAt ?? 0)
-    return startDelta !== 0 ? startDelta : left.task.id < right.task.id ? -1 : 1
-  })
-  return KIND_ORDER.map((kind) => ({
-    kind,
-    tasks: entries.filter((entry) => entry.task.kind === kind)
-  })).filter((group) => group.tasks.length > 0)
+  // An old host's unlabeled row keeps the kind label it always showed; a view row reads its state.
+  return rosterEntries(
+    buildLegacyTaskRowModels(tasks, settledTasks).map((row) =>
+      row.name ? row : { ...row, name: backgroundTaskKindLabel(row.kind) }
+    )
+  )
+}
+
+// Until a caller passes the session's parent-row context, every live claim stands as reported.
+const REPORTED_ROW_CONTEXT: AgentChildRowContext = {
+  parentEvidenceFresh: true,
+  transportObservation: 'live',
+  parentObservedAt: 0,
+  hostClockOffsetMs: 0
+}
+
+/** Kind groups from the host's child views: the main agent's work at the top, each child's own
+ *  work nested beneath it rather than counted again in its kind's group. Pass the context the
+ *  sidebar builds for the same parent (`agentChildRowContextForParent`) so both read one verdict. */
+export function buildBackgroundTaskGroupsFromViews(
+  views: readonly AgentChildWorkView[],
+  context: AgentChildRowContext = REPORTED_ROW_CONTEXT
+): BackgroundTaskGroup[] {
+  return rosterEntries(buildAgentChildRowModels(views, context))
 }
 
 export function backgroundTaskStateWord(state: RunState): string {
@@ -155,14 +160,26 @@ export function formatBackgroundTaskTokens(totalTokens: number): string {
     : `${tokenScaleText(Math.round(totalTokens / 100_000) / 10)}m`
 }
 
-export function backgroundTaskElapsedLabel(
-  task: AgentSessionBackgroundTask,
-  now: number
-): string | null {
-  if (task.startedAt === undefined || task.startedAt <= 0) {
+export function backgroundTaskElapsedLabel(startedAt: number, now: number): string | null {
+  if (startedAt <= 0) {
     return null
   }
-  return formatNativeChatDuration((now - task.startedAt) / 1000)
+  return formatNativeChatDuration((now - startedAt) / 1000)
+}
+
+/** Whether a row's elapsed time moves: only live work's does. */
+export function backgroundTaskRowTicks(row: AgentChildRowModel): boolean {
+  return !row.settled && row.firstObservedAt > 0
+}
+
+/** A live row's clock runs; a settled row's stops where it settled, so finished work never ticks. */
+export function backgroundTaskRowElapsedLabel(row: AgentChildRowModel, now: number): string | null {
+  if (!row.settled) {
+    return backgroundTaskElapsedLabel(row.firstObservedAt, now)
+  }
+  return row.settledAt !== undefined
+    ? backgroundTaskElapsedLabel(row.firstObservedAt, row.settledAt)
+    : null
 }
 
 export function backgroundTaskGroupLabel(kind: TaskKind): string {
diff --git a/src/renderer/src/components/native-chat/claude-model-switch-confirmation.ts b/src/renderer/src/components/native-chat/claude-model-switch-confirmation.ts
index eedf8506e1c..334e4639add 100644
--- a/src/renderer/src/components/native-chat/claude-model-switch-confirmation.ts
+++ b/src/renderer/src/components/native-chat/claude-model-switch-confirmation.ts
@@ -147,7 +147,7 @@ export function createClaudeModelSwitchConfirmationObserver(args: {
         // exact Claude warning defaults to “Yes” and needs only one Enter.
         const accepted = args.submitConfirmation
           ? args.submitConfirmation() !== false
-          : sendRuntimePtyInput(args.settings, args.ptyId, NATIVE_CHAT_SUBMIT)
+          : sendRuntimePtyInput(args.settings, args.ptyId, NATIVE_CHAT_SUBMIT, 'driving')
         if (!accepted) {
           finish('unknown')
           return
diff --git a/src/renderer/src/components/native-chat/native-chat-composer-containment.test.ts b/src/renderer/src/components/native-chat/native-chat-composer-containment.test.ts
deleted file mode 100644
index 2c8a08ffa89..00000000000
--- a/src/renderer/src/components/native-chat/native-chat-composer-containment.test.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-import fs from 'node:fs'
-import { describe, expect, it } from 'vitest'
-
-const composerField = fs.readFileSync(
-  new URL('./NativeChatComposerField.tsx', import.meta.url),
-  'utf8'
-)
-const autocompleteMenus = fs.readFileSync(
-  new URL('./NativeChatAutocompleteMenus.tsx', import.meta.url),
-  'utf8'
-)
-
-describe('native chat composer paint containment (#10481)', () => {
-  it('bounds caret repaints to the composer input shell', () => {
-    expect(composerField).toContain('[contain:paint]')
-  })
-
-  it('keeps the outer composer uncontained so the pickers can overflow it', () => {
-    // The pickers are siblings that render above the shell via `bottom-full`;
-    // containing their parent would clip them.
-    const outerShell = composerField.slice(0, composerField.indexOf('[contain:paint]'))
-    expect(outerShell).toContain('<div className="shrink-0 bg-background">')
-    expect(outerShell).not.toContain('contain:paint')
-  })
-
-  it('lifts both pickers above the contained shell', () => {
-    // The shell is a stacking context now, so it paints at z-index 0 in tree
-    // order — an unlayered picker would lose its drop shadow to it.
-    for (const picker of ['bottom-full left-0 right-0 z-20', 'bottom-full left-3 right-3 z-20']) {
-      expect(autocompleteMenus).toContain(picker)
-    }
-  })
-})
diff --git a/src/renderer/src/components/native-chat/native-chat-draft-cache.ts b/src/renderer/src/components/native-chat/native-chat-draft-cache.ts
index 62ff5dc5cff..333ab7a2c50 100644
--- a/src/renderer/src/components/native-chat/native-chat-draft-cache.ts
+++ b/src/renderer/src/components/native-chat/native-chat-draft-cache.ts
@@ -28,6 +28,40 @@ export function writeNativeChatDraftCache(scopeKey: string, draft: string): void
   })
 }
 
+export function appendNativeChatDraftText(draft: string, text: string): string {
+  return draft === '' ? text : `${draft.trimEnd()}\n\n${text}`
+}
+
+// Only a write from outside the composer notifies; its own writes already hold the text.
+const appendListeners = new Map<string, Set<(text: string) => void>>()
+
+/** Puts text back after whatever is typed, and tells a mounted composer to show it. */
+export function appendNativeChatDraftCache(scopeKey: string, text: string): void {
+  if (text === '') {
+    return
+  }
+  writeNativeChatDraftCache(
+    scopeKey,
+    appendNativeChatDraftText(readNativeChatDraftCache(scopeKey), text)
+  )
+  appendListeners.get(scopeKey)?.forEach((listener) => listener(text))
+}
+
+export function subscribeToNativeChatDraftAppend(
+  scopeKey: string,
+  listener: (text: string) => void
+): () => void {
+  const listeners = appendListeners.get(scopeKey) ?? new Set()
+  appendListeners.set(scopeKey, listeners)
+  listeners.add(listener)
+  return () => {
+    listeners.delete(listener)
+    if (listeners.size === 0 && appendListeners.get(scopeKey) === listeners) {
+      appendListeners.delete(scopeKey)
+    }
+  }
+}
+
 export function clearNativeChatDraftCacheForTests(): void {
   draftCache.clear()
 }
diff --git a/src/renderer/src/components/native-chat/native-chat-leaf-routing.test.ts b/src/renderer/src/components/native-chat/native-chat-leaf-routing.test.ts
index b435d40f797..47a4d020a25 100644
--- a/src/renderer/src/components/native-chat/native-chat-leaf-routing.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-leaf-routing.test.ts
@@ -135,7 +135,7 @@ describe('resolveNativeChatLeafRoute', () => {
     ).toEqual({ chatLeafId: 'agent-leaf', exitChat: false })
   })
 
-  it('moves chat to an eligible active sibling after its leaf closes', () => {
+  it('exits chat when the user closes its pane', () => {
     expect(
       resolveNativeChatLeafRoute({
         isChatViewMode: true,
@@ -144,7 +144,7 @@ describe('resolveNativeChatLeafRoute', () => {
         chatLeafStillMounted: false,
         activeLeafIsEligible: true
       })
-    ).toEqual({ chatLeafId: 'agent-sibling', exitChat: false })
+    ).toEqual({ chatLeafId: null, exitChat: true })
   })
 
   it('does not move chat when its mounted leaf temporarily becomes ineligible', () => {
diff --git a/src/renderer/src/components/native-chat/native-chat-leaf-routing.ts b/src/renderer/src/components/native-chat/native-chat-leaf-routing.ts
index 45eaa451b95..176194952dc 100644
--- a/src/renderer/src/components/native-chat/native-chat-leaf-routing.ts
+++ b/src/renderer/src/components/native-chat/native-chat-leaf-routing.ts
@@ -107,6 +107,11 @@ export function resolveNativeChatLeafRoute(args: {
   if (!args.activeLeafId && !confirmedAgentExit) {
     return { chatLeafId: args.chatLeafId, exitChat: false }
   }
+  if (args.chatLeafId && !args.chatLeafStillMounted && !confirmedAgentExit) {
+    // A user-closed chat pane is an explicit close, not an agent handoff. Do not
+    // retarget the chat surface to whichever sibling became active.
+    return { chatLeafId: null, exitChat: true }
+  }
   if (args.activeLeafIsEligible && (!confirmedAgentExit || args.activeLeafId !== args.chatLeafId)) {
     return { chatLeafId: args.activeLeafId, exitChat: false }
   }
diff --git a/src/renderer/src/components/native-chat/native-chat-live-session-contract.ts b/src/renderer/src/components/native-chat/native-chat-live-session-contract.ts
index e3097ca085f..d61d11b9ac1 100644
--- a/src/renderer/src/components/native-chat/native-chat-live-session-contract.ts
+++ b/src/renderer/src/components/native-chat/native-chat-live-session-contract.ts
@@ -27,6 +27,9 @@ export function isNativeChatTranscriptUnsettled(phase: ReadState['phase']): bool
 export type NativeChatLiveSession = NativeChatSession & {
   /** Latest provider turn boundary, used to settle orphaned running tool rows. */
   transcriptLifecycle?: NativeChatTurnLifecycle
+  /** The pane's hook says the agent stopped mid-turn for the reader, and the transcript
+   *  has not since ended that turn. Absent on lanes with no hook status. */
+  hookAwaitingInput?: boolean
   /** True when an older page may still exist (the last read filled the window). */
   hasMore: boolean
   /** Whether an older-history page is currently loading. */
diff --git a/src/renderer/src/components/native-chat/native-chat-live-status.test.ts b/src/renderer/src/components/native-chat/native-chat-live-status.test.ts
index ce8a2875df0..9dcd683dcd9 100644
--- a/src/renderer/src/components/native-chat/native-chat-live-status.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-live-status.test.ts
@@ -3,7 +3,7 @@
 
 import { describe, expect, it } from 'vitest'
 import type { NativeChatMessage } from '../../../../shared/native-chat-types'
-import { mergeNativeChatLiveSession } from './native-chat-live-status'
+import { mergeNativeChatLiveSession, nativeChatHookAwaitsInput } from './native-chat-live-status'
 import { selectNativeChatViewState } from './native-chat-view-state'
 import { shouldShowNativeChatWorking } from './native-chat-working-suppression'
 
@@ -154,6 +154,36 @@ describe('mergeNativeChatLiveSession', () => {
     expect(session.status).toBe('ready')
   })
 
+  it("keeps omp working while its latest row is a tool call written after the turn's start", () => {
+    // Shaped as decodeOmpTranscriptLine emits them: every omp row carries its timestamp.
+    const turnStartedAt = Date.parse('2026-09-28T10:00:00.000Z')
+    const toolCall: NativeChatMessage = {
+      id: 'rec-2',
+      role: 'assistant',
+      blocks: [
+        { type: 'text', text: 'Running the suite.' },
+        { type: 'tool-call', name: 'bash', input: { command: 'pnpm test' } }
+      ],
+      timestamp: turnStartedAt + 4_000,
+      source: 'transcript'
+    }
+    const session = mergeNativeChatLiveSession({
+      messages: [{ ...user('rec-1', 'run the tests'), timestamp: turnStartedAt }, toolCall],
+      sessionId: 'sess',
+      agent: 'omp',
+      hookState: 'working',
+      stateStartedAt: turnStartedAt
+    })
+    expect(session.status).toBe('working')
+    expect(
+      shouldShowNativeChatWorking({
+        isConversation: true,
+        working: session.status === 'working',
+        interrupted: false
+      })
+    ).toBe(true)
+  })
+
   it('keeps working while the hook reports a live background child', () => {
     const session = mergeNativeChatLiveSession({
       messages: [assistant('a-1', 'lead done')],
@@ -201,7 +231,7 @@ describe('mergeNativeChatLiveSession', () => {
       }).status
     ).toBe('working')
     // Regression: a non-null sessionId used to force 'loading' over live work,
-    // so the pane rendered idle mid-turn — Send instead of Stop, no typing
+    // so the pane rendered idle mid-turn — Send instead of Stop, no working
     // indicator, no streaming preview. The empty-transcript loading SURFACE is
     // selectNativeChatViewState's job; the status must stay 'working'.
     expect(
@@ -249,7 +279,7 @@ describe('mergeNativeChatLiveSession', () => {
 
   // The whole chain the defect broke: a fresh Claude session reports its id
   // before the transcript flushes, so the pane rendered Send (not Stop) with no
-  // typing indicator while the agent was working.
+  // working indicator while the agent was working.
   it('keeps the Stop affordance for a working known session mid-flush', () => {
     const session = mergeNativeChatLiveSession({
       messages: [user('u-1', 'run it')],
@@ -271,3 +301,46 @@ describe('mergeNativeChatLiveSession', () => {
     ).toBe(true)
   })
 })
+
+describe('nativeChatHookAwaitsInput', () => {
+  it.each(['waiting', 'blocked'] as const)('reads a %s hook as a wait on the reader', (state) => {
+    expect(nativeChatHookAwaitsInput(state, 5, undefined)).toBe(true)
+    expect(
+      nativeChatHookAwaitsInput(state, 5, { state: 'working', turnId: 'turn-1', timestamp: 1 })
+    ).toBe(true)
+  })
+
+  it('reads no other hook state as a wait', () => {
+    expect(nativeChatHookAwaitsInput('working', 5, undefined)).toBe(false)
+    expect(nativeChatHookAwaitsInput('done', 5, undefined)).toBe(false)
+    expect(nativeChatHookAwaitsInput(null, 5, undefined)).toBe(false)
+  })
+
+  // An interrupt at the prompt fires no hook; the transcript's marker is the only end.
+  it('ends a wait the transcript closed after it began', () => {
+    expect(
+      nativeChatHookAwaitsInput('waiting', 5, {
+        state: 'interrupted',
+        turnId: 'turn-1',
+        timestamp: 6
+      })
+    ).toBe(false)
+    expect(
+      nativeChatHookAwaitsInput('waiting', 5, {
+        state: 'completed',
+        turnId: 'turn-1',
+        timestamp: 6
+      })
+    ).toBe(false)
+  })
+
+  it('keeps a wait that began after the last closed turn', () => {
+    expect(
+      nativeChatHookAwaitsInput('waiting', 5, {
+        state: 'interrupted',
+        turnId: 'turn-1',
+        timestamp: 2
+      })
+    ).toBe(true)
+  })
+})
diff --git a/src/renderer/src/components/native-chat/native-chat-live-status.ts b/src/renderer/src/components/native-chat/native-chat-live-status.ts
index eefd7fcbeca..f3d2bb58be9 100644
--- a/src/renderer/src/components/native-chat/native-chat-live-status.ts
+++ b/src/renderer/src/components/native-chat/native-chat-live-status.ts
@@ -63,14 +63,15 @@ export function mergeNativeChatLiveSession(input: NativeChatLiveMergeInput): Nat
   }
 
   const status = liveStatusOverride(
+    agent,
     hookState,
     statusTailMessage ?? messages.at(-1),
     stateStartedAt,
     transcriptLifecycle,
     hookHasWorkingSubagents ?? false
   )
-  // Why live work still wins: 'working' is what drives Stop-vs-Send, the typing
-  // indicator and the streaming preview, so forcing 'loading' over it renders an
+  // Why live work still wins: 'working' is what drives Stop-vs-Send, the turn
+  // status and the streaming preview, so forcing 'loading' over it renders an
   // idle pane while the agent works. A known session with nothing to show yet is
   // held on the loading surface by selectNativeChatViewState instead.
   if (loading && status !== 'working') {
@@ -84,10 +85,36 @@ export function mergeNativeChatLiveSession(input: NativeChatLiveMergeInput): Nat
   }
 }
 
+/**
+ * Whether the agent stopped mid-turn for the reader (`blocked` and `waiting` both mean a human
+ * must decide). Reconciled like 'working': an interrupt at the prompt fires no hook, so only the
+ * transcript's terminal marker can end a wait the hook never cleared.
+ */
+export function nativeChatHookAwaitsInput(
+  hookState: AgentStatusState | null,
+  stateStartedAt: number | null | undefined,
+  transcriptLifecycle: NativeChatTurnLifecycle | undefined
+): boolean {
+  return (
+    (hookState === 'blocked' || hookState === 'waiting') &&
+    !lifecycleTerminatesCurrentTurn(transcriptLifecycle, stateStartedAt)
+  )
+}
+
 /** Slack for comparing transcript timestamps to hook receipt times across hosts. */
 export const LIFECYCLE_CLOCK_SKEW_SLACK_MS = 2_000
 
+/**
+ * Agents whose own runtime reports the turn end: omp posts `agent_end` from inside the agent,
+ * retried until the host takes it and held back while the run continues. Their hook 'working'
+ * is never a dropped Stop, so a trailing assistant row (a tool call mid-run) cannot end it.
+ */
+function hookDeliversTurnEnd(agent: AgentType): boolean {
+  return agent === 'omp'
+}
+
 function liveStatusOverride(
+  agent: AgentType,
   hookState: AgentStatusState | null,
   statusTailMessage: NativeChatMessage | undefined,
   stateStartedAt: number | null | undefined,
@@ -121,6 +148,7 @@ function liveStatusOverride(
   // do not settle early on capable providers.
   if (
     transcriptLifecycle?.state !== 'working' &&
+    !hookDeliversTurnEnd(agent) &&
     trailingAssistantPostDates(statusTailMessage, stateStartedAt)
   ) {
     return undefined
diff --git a/src/renderer/src/components/native-chat/native-chat-message-rail-items.test.ts b/src/renderer/src/components/native-chat/native-chat-message-rail-items.test.ts
index 5e6fecefa2f..a541c601966 100644
--- a/src/renderer/src/components/native-chat/native-chat-message-rail-items.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-message-rail-items.test.ts
@@ -42,12 +42,10 @@ function slotsOf(messages: NativeChatMessage[]) {
   return buildNativeChatTranscriptSlots({
     messages,
     turnKeys,
-    latestUserIndex: messages.findLastIndex((message) => message.role === 'user'),
-    currentTurnKey: undefined,
+    liveTurnKey: undefined,
     receipts: new Map<string, NativeChatResolvedPrompt>(),
     turnStatuses: { active: null, completedByTurn: {} },
     turnDiffs: new Map<string, NativeChatTurnDiff>(),
-    showTurnStatus: false,
     expandedTurnKeys: new Set<string>(),
     isWorking: false,
     lifecycleWorking: false
diff --git a/src/renderer/src/components/native-chat/native-chat-noise.test.ts b/src/renderer/src/components/native-chat/native-chat-noise.test.ts
deleted file mode 100644
index a9942ed82d7..00000000000
--- a/src/renderer/src/components/native-chat/native-chat-noise.test.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import type { NativeChatMessage } from '../../../../shared/native-chat-types'
-import { isNoiseMessage, stripNoiseMessages } from './native-chat-noise'
-
-function msg(
-  role: NativeChatMessage['role'],
-  text: string,
-  blocks?: NativeChatMessage['blocks']
-): NativeChatMessage {
-  return {
-    id: text.slice(0, 8),
-    role,
-    blocks: blocks ?? [{ type: 'text', text }],
-    timestamp: 0,
-    source: 'transcript'
-  }
-}
-
-describe('isNoiseMessage', () => {
-  it('flags task-notification and system-reminder user turns', () => {
-    expect(isNoiseMessage(msg('user', '<task-notification>\n<task-id>x</task-id>'))).toBe(true)
-    expect(isNoiseMessage(msg('user', '<system-reminder>\nbe careful'))).toBe(true)
-    expect(
-      isNoiseMessage(
-        msg(
-          'user',
-          'Caveat: The messages below were generated by the user while running local commands'
-        )
-      )
-    ).toBe(true)
-    expect(isNoiseMessage(msg('user', '[Request interrupted by user]'))).toBe(true)
-  })
-
-  it('keeps real user messages', () => {
-    expect(isNoiseMessage(msg('user', 'make it work for codex'))).toBe(false)
-    expect(isNoiseMessage(msg('user', '<my-custom-element>pasted code'))).toBe(false)
-  })
-
-  it('keeps assistant and tool turns', () => {
-    expect(isNoiseMessage(msg('assistant', '<system-reminder> in prose'))).toBe(false)
-    expect(isNoiseMessage(msg('system', 'Conversation interrupted'))).toBe(false)
-  })
-
-  it('keeps a user turn that carries tool results', () => {
-    expect(isNoiseMessage(msg('user', '', [{ type: 'tool-result', output: 'ok' }]))).toBe(false)
-  })
-
-  it('stripNoiseMessages removes only the noise', () => {
-    const out = stripNoiseMessages([
-      msg('user', 'hello'),
-      msg('user', '<task-notification>done'),
-      msg('assistant', 'hi')
-    ])
-    expect(out.map((m) => m.role)).toEqual(['user', 'assistant'])
-  })
-})
diff --git a/src/renderer/src/components/native-chat/native-chat-rail-outline-parity.test.ts b/src/renderer/src/components/native-chat/native-chat-rail-outline-parity.test.ts
index 3057be1f908..f84a99ed2c0 100644
--- a/src/renderer/src/components/native-chat/native-chat-rail-outline-parity.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-rail-outline-parity.test.ts
@@ -60,7 +60,8 @@ const JOURNAL: AgentJournalRenderItem[] = [
   ]),
   row(10, { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'Done.' }] }),
   user(11, [{ type: 'text', text: 'Thanks' }]),
-  // Journalled after `Thanks` but observed before `Done.`: the transcript orders by observation.
+  // Recovered after a crash: journalled after `Thanks`, but carrying the provider's clock from
+  // before `Done.`. The transcript orders by journal position, never observation.
   { ...user(12, [{ type: 'text', text: 'Observed earlier' }]), observedAt: 1_009.5 }
 ]
 
@@ -80,12 +81,10 @@ function loadedRailItems(items: AgentJournalRenderItem[], submissions: AgentJour
   const slots = buildNativeChatTranscriptSlots({
     messages,
     turnKeys,
-    latestUserIndex: messages.findLastIndex((message) => message.role === 'user'),
-    currentTurnKey: turn,
+    liveTurnKey: turn,
     receipts: new Map<string, NativeChatResolvedPrompt>(),
     turnStatuses: { active: null, completedByTurn: {} },
     turnDiffs: new Map<string, NativeChatTurnDiff>(),
-    showTurnStatus: true,
     expandedTurnKeys: new Set<string>(),
     isWorking: false,
     lifecycleWorking: false
@@ -107,13 +106,13 @@ describe('conversation outline parity with the loaded rail', () => {
       }))
     ).toEqual(loaded.map(({ id, text, hasImages }) => ({ id, text, hasImages })))
     // Anti-vacuous: the folded tool result, the refused send, the harness turn and the empty
-    // prompt were all dropped, and the late-journalled row sits where it was observed.
+    // prompt were all dropped, and the recovered row sits where it was journalled.
     expect(outline.map((entry) => entry.itemId)).toEqual([
       'item-1',
       'item-5',
       'item-9',
-      'item-12',
-      'item-11'
+      'item-11',
+      'item-12'
     ])
   })
 
@@ -123,8 +122,8 @@ describe('conversation outline parity with the loaded rail', () => {
       { itemId: 'item-1', sequence: 1, preview: 'Fix the parser', imageCount: 0 },
       { itemId: 'item-5', sequence: 5, preview: '', imageCount: 1 },
       { itemId: 'item-9', sequence: 9, preview: 'Compare these', imageCount: 2 },
-      { itemId: 'item-12', sequence: 12, preview: 'Observed earlier', imageCount: 0 },
-      { itemId: 'item-11', sequence: 11, preview: 'Thanks', imageCount: 0 }
+      { itemId: 'item-11', sequence: 11, preview: 'Thanks', imageCount: 0 },
+      { itemId: 'item-12', sequence: 12, preview: 'Observed earlier', imageCount: 0 }
     ])
   })
 })
diff --git a/src/renderer/src/components/native-chat/native-chat-resolution-receipt.ts b/src/renderer/src/components/native-chat/native-chat-resolution-receipt.ts
index f9a0c64437d..475966a1b03 100644
--- a/src/renderer/src/components/native-chat/native-chat-resolution-receipt.ts
+++ b/src/renderer/src/components/native-chat/native-chat-resolution-receipt.ts
@@ -2,7 +2,10 @@ import type {
   AgentJournalApprovalItem,
   AgentJournalQuestionItem
 } from '../../../../shared/agent-session-journal-types'
-import { decodeAgentSessionQuestionAnswers } from '../../../../shared/agent-session-question-answer'
+import {
+  agentSessionPromptQuestions,
+  legacyAgentSessionQuestionAnswers
+} from '../../../../shared/agent-session-question-answer'
 
 export type NativeChatResolvedPrompt = AgentJournalApprovalItem | AgentJournalQuestionItem
 export type NativeChatReceiptAnswer = { question: string | null; answer: string | null }
@@ -14,16 +17,19 @@ export function nativeChatReceiptAnswers(
     return []
   }
   const selected = body.resolution.selectedOptionId
-  if (body.kind === 'question' && body.questions) {
-    const answers = selected ? decodeAgentSessionQuestionAnswers(selected) : null
-    return body.questions.map((question) => {
+  if (body.kind === 'question') {
+    // Rows written before hosts recorded structured answers carry only the packed form.
+    const answers =
+      body.resolution.answers ??
+      (selected ? legacyAgentSessionQuestionAnswers(body, selected) : null)
+    return agentSessionPromptQuestions(body).map((question) => {
       const answer = answers?.find((entry) => entry.questionId === question.id)
       const labels = answer?.optionIds.map(
         (id) => question.options.find((option) => option.id === id)?.label
       )
       const valid = labels?.every((label) => label !== undefined)
       return {
-        question: question.question,
+        question: body.questions ? question.question : null,
         answer: valid
           ? [...(labels ?? []), ...(answer?.other ? [answer.other] : [])].join(' · ') || null
           : null
@@ -31,20 +37,5 @@ export function nativeChatReceiptAnswers(
     })
   }
   const option = body.options.find((option) => option.id === selected)
-  if (option) {
-    return [{ question: null, answer: option.label }]
-  }
-  if (body.kind === 'question' && body.freeTextQuestionId && selected) {
-    const prefix = `${encodeURIComponent(body.freeTextQuestionId)}:`
-    if (selected.startsWith(prefix)) {
-      try {
-        return [
-          { question: null, answer: decodeURIComponent(selected.slice(prefix.length)) || null }
-        ]
-      } catch {
-        // Malformed persisted answers remain readable as an unavailable selection.
-      }
-    }
-  }
-  return [{ question: null, answer: null }]
+  return [{ question: null, answer: option?.label ?? null }]
 }
diff --git a/src/renderer/src/components/native-chat/native-chat-row-height-estimate.ts b/src/renderer/src/components/native-chat/native-chat-row-height-estimate.ts
index 60075385292..368eea2699b 100644
--- a/src/renderer/src/components/native-chat/native-chat-row-height-estimate.ts
+++ b/src/renderer/src/components/native-chat/native-chat-row-height-estimate.ts
@@ -29,6 +29,8 @@ export type NativeChatRowChromeMetrics = {
   /** Behind a folded turn: prose and tool activity draw nothing, so estimating
    *  them would reserve a screen of height for a row that paints a roster. */
   folded?: boolean
+  /** A subagent wrote the row, so it draws a caption naming that subagent. */
+  attributed?: boolean
 }
 
 const LINE_HEIGHT_PX = 22
@@ -38,6 +40,7 @@ const USER_BUBBLE_CHROME_PX = 32
 const IMAGE_STRIP_PX = 88
 const TOOL_RUN_PX = 40
 const SUBAGENT_ROW_PX = 32
+const SUBAGENT_CAPTION_PX = 24
 const STATUS_ROW_PX = 28
 const TURN_DIFF_PX = 28
 const RECEIPT_PX = 56
@@ -117,6 +120,9 @@ export function estimateNativeChatRowHeight(
       height += TOOL_RUN_PX
     }
     height += content.subagentGroupCount * SUBAGENT_ROW_PX
+    if (chrome.attributed === true && height > 0) {
+      height += SUBAGENT_CAPTION_PX
+    }
     partCount = height > 0 ? 1 : 0
   }
   if (chrome.hasStatus) {
diff --git a/src/renderer/src/components/native-chat/native-chat-runtime-image-send.ts b/src/renderer/src/components/native-chat/native-chat-runtime-image-send.ts
index f77ba77e274..aba65acf8db 100644
--- a/src/renderer/src/components/native-chat/native-chat-runtime-image-send.ts
+++ b/src/renderer/src/components/native-chat/native-chat-runtime-image-send.ts
@@ -56,20 +56,20 @@ export function sendNativeChatMessageWithImageAttachments(
           ),
           trimmedText.length > 0
         )) {
-          sendRuntimePtyInput(settings, ptyId, payload)
+          sendRuntimePtyInput(settings, ptyId, payload, 'driving')
         }
         if (trimmedText.length > 0) {
           delay(NATIVE_CHAT_IMAGE_ATTACHMENT_SETTLE_MS, () => {
-            sendRuntimePtyInput(settings, ptyId, buildNativeChatPasteBytes(text))
+            sendRuntimePtyInput(settings, ptyId, buildNativeChatPasteBytes(text), 'driving')
             delay(NATIVE_CHAT_SUBMIT_DELAY_MS, () => {
-              sendRuntimePtyInput(settings, ptyId, NATIVE_CHAT_SUBMIT)
+              sendRuntimePtyInput(settings, ptyId, NATIVE_CHAT_SUBMIT, 'driving')
               markSubmitted()
             })
           })
           return
         }
         delay(NATIVE_CHAT_SUBMIT_DELAY_MS, () => {
-          sendRuntimePtyInput(settings, ptyId, NATIVE_CHAT_SUBMIT)
+          sendRuntimePtyInput(settings, ptyId, NATIVE_CHAT_SUBMIT, 'driving')
           markSubmitted()
         })
       })
diff --git a/src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts b/src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts
index d8cf90167ec..0071b73b21d 100644
--- a/src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts
@@ -138,7 +138,12 @@ describe('sendNativeChatMessage', () => {
     ])
 
     await vi.advanceTimersByTimeAsync(NATIVE_CHAT_SUBMIT_DELAY_MS)
-    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(SETTINGS, PTY, NATIVE_CHAT_SUBMIT)
+    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(
+      SETTINGS,
+      PTY,
+      NATIVE_CHAT_SUBMIT,
+      'driving'
+    )
     expect(sendRuntimePtyInput).toHaveBeenCalledTimes(6)
   })
 
@@ -194,13 +199,19 @@ describe('sendNativeChatMessageVerified', () => {
     expect(sendRuntimePtyInputVerified).toHaveBeenCalledWith(
       SETTINGS,
       PTY,
-      buildNativeChatPasteBytes('/model sonnet')
+      buildNativeChatPasteBytes('/model sonnet'),
+      'driving'
     )
 
     await vi.advanceTimersByTimeAsync(NATIVE_CHAT_SUBMIT_DELAY_MS)
 
     expect(await result).toBe(true)
-    expect(sendRuntimePtyInputVerified).toHaveBeenLastCalledWith(SETTINGS, PTY, NATIVE_CHAT_SUBMIT)
+    expect(sendRuntimePtyInputVerified).toHaveBeenLastCalledWith(
+      SETTINGS,
+      PTY,
+      NATIVE_CHAT_SUBMIT,
+      'driving'
+    )
     expect(
       sendRuntimePtyInputVerified.mock.calls.some(
         (call) => call[2] === NATIVE_CHAT_CLEAR_UNSUBMITTED_INPUT
@@ -234,7 +245,12 @@ describe('sendNativeChatMessageVerified', () => {
     const submits = sendRuntimePtyInput.mock.calls.filter((call) => call[2] === NATIVE_CHAT_SUBMIT)
     // Only the verified path's Enter — chat's delayed Enter was cancelled.
     expect(submits).toHaveLength(0)
-    expect(sendRuntimePtyInputVerified).toHaveBeenCalledWith(SETTINGS, PTY, NATIVE_CHAT_SUBMIT)
+    expect(sendRuntimePtyInputVerified).toHaveBeenCalledWith(
+      SETTINGS,
+      PTY,
+      NATIVE_CHAT_SUBMIT,
+      'driving'
+    )
   })
 
   it('returns false when the delayed Enter wait is aborted', async () => {
@@ -347,9 +363,14 @@ describe('sendNativeChatMessageWithImageAttachments', () => {
       '\x1b[200~@"C:\\Images\\screen shot.png"\x1b[201~ '
     ])
     vi.advanceTimersByTime(NATIVE_CHAT_IMAGE_ATTACHMENT_SETTLE_MS)
-    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(SETTINGS, PTY, 'describe')
+    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(SETTINGS, PTY, 'describe', 'driving')
     vi.advanceTimersByTime(NATIVE_CHAT_SUBMIT_DELAY_MS)
-    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(SETTINGS, PTY, NATIVE_CHAT_SUBMIT)
+    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(
+      SETTINGS,
+      PTY,
+      NATIVE_CHAT_SUBMIT,
+      'driving'
+    )
   })
 
   it('clears the line, then bracket-pastes image paths before prompt text', () => {
@@ -372,10 +393,20 @@ describe('sendNativeChatMessageWithImageAttachments', () => {
     ])
 
     vi.advanceTimersByTime(NATIVE_CHAT_IMAGE_ATTACHMENT_SETTLE_MS)
-    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(SETTINGS, PTY, 'what do you see?')
+    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(
+      SETTINGS,
+      PTY,
+      'what do you see?',
+      'driving'
+    )
 
     vi.advanceTimersByTime(NATIVE_CHAT_SUBMIT_DELAY_MS)
-    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(SETTINGS, PTY, NATIVE_CHAT_SUBMIT)
+    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(
+      SETTINGS,
+      PTY,
+      NATIVE_CHAT_SUBMIT,
+      'driving'
+    )
     expect(sendRuntimePtyInput).toHaveBeenCalledTimes(4)
   })
 
@@ -396,7 +427,12 @@ describe('sendNativeChatMessageWithImageAttachments', () => {
 
     vi.advanceTimersByTime(1)
     expect(sendRuntimePtyInput).toHaveBeenCalledTimes(3)
-    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(SETTINGS, PTY, NATIVE_CHAT_SUBMIT)
+    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(
+      SETTINGS,
+      PTY,
+      NATIVE_CHAT_SUBMIT,
+      'driving'
+    )
   })
 
   it('treats whitespace-only prompt input as attachment-only', () => {
@@ -450,7 +486,7 @@ describe('empty prompt submit', () => {
   it('submits an empty prompt with a bare Enter', () => {
     submitNativeChatPrompt(SETTINGS, PTY)
     expect(sendRuntimePtyInput).toHaveBeenCalledOnce()
-    expect(sendRuntimePtyInput).toHaveBeenCalledWith(SETTINGS, PTY, NATIVE_CHAT_SUBMIT)
+    expect(sendRuntimePtyInput).toHaveBeenCalledWith(SETTINGS, PTY, NATIVE_CHAT_SUBMIT, 'driving')
   })
 })
 
@@ -483,16 +519,17 @@ describe('sendNativeChatAskAnswer', () => {
     )
 
     vi.advanceTimersByTime(0)
-    expect(sendRuntimePtyInput).toHaveBeenCalledWith(SETTINGS, PTY, '1')
+    expect(sendRuntimePtyInput).toHaveBeenCalledWith(SETTINGS, PTY, '1', 'driving')
 
     vi.advanceTimersByTime(NATIVE_CHAT_QUESTION_STEP_MS)
-    expect(sendRuntimePtyInput).toHaveBeenCalledWith(SETTINGS, PTY, '2')
+    expect(sendRuntimePtyInput).toHaveBeenCalledWith(SETTINGS, PTY, '2', 'driving')
 
     vi.advanceTimersByTime(NATIVE_CHAT_QUESTION_STEP_MS)
     expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(
       SETTINGS,
       PTY,
-      buildNativeChatPasteBytes('custom answer')
+      buildNativeChatPasteBytes('custom answer'),
+      'driving'
     )
   })
 
@@ -533,7 +570,7 @@ describe('sendNativeChatAskAnswer', () => {
     const handle = sendNativeChatAskAnswer(SETTINGS, PTY, [{ raw: '2' }], onSettled)
     await vi.advanceTimersByTimeAsync(handle.settleAfterMs)
 
-    expect(sendRuntimePtyInputVerified).toHaveBeenCalledWith(SETTINGS, PTY, '2')
+    expect(sendRuntimePtyInputVerified).toHaveBeenCalledWith(SETTINGS, PTY, '2', 'driving')
     expect(onSettled).not.toHaveBeenCalled()
 
     resolveAccepted(true)
diff --git a/src/renderer/src/components/native-chat/native-chat-runtime-send.ts b/src/renderer/src/components/native-chat/native-chat-runtime-send.ts
index a845fe10d16..1eb7a676103 100644
--- a/src/renderer/src/components/native-chat/native-chat-runtime-send.ts
+++ b/src/renderer/src/components/native-chat/native-chat-runtime-send.ts
@@ -72,7 +72,12 @@ export function clearUnsubmittedAgentInput(
   ptyId: string,
   options?: NativeChatSendOptions
 ): void {
-  sendRuntimePtyInput(settings, ptyId, options?.clearInput ?? NATIVE_CHAT_CLEAR_UNSUBMITTED_INPUT)
+  sendRuntimePtyInput(
+    settings,
+    ptyId,
+    options?.clearInput ?? NATIVE_CHAT_CLEAR_UNSUBMITTED_INPUT,
+    'driving'
+  )
 }
 
 /**
@@ -104,7 +109,7 @@ export function clearThenWrite(
       // An unreadable terminal is unconfirmed; the maximal clear remains safe.
     }
     if (!cleared) {
-      sendRuntimePtyInput(settings, ptyId, AGENT_TUI_CLEAR_INPUT_MAX)
+      sendRuntimePtyInput(settings, ptyId, AGENT_TUI_CLEAR_INPUT_MAX, 'driving')
     }
     writeBody()
   })
@@ -140,11 +145,11 @@ export function sendNativeChatMessage(
         if (isCancelled()) {
           return
         }
-        sendRuntimePtyInput(settings, ptyId, buildNativeChatPasteBytes(text))
+        sendRuntimePtyInput(settings, ptyId, buildNativeChatPasteBytes(text), 'driving')
         // Schedule from the actual body write: an overdue clear-confirm callback
         // must not collapse the required body-to-Enter gap after a renderer stall.
         delay(NATIVE_CHAT_SUBMIT_DELAY_MS, () => {
-          sendRuntimePtyInput(settings, ptyId, NATIVE_CHAT_SUBMIT)
+          sendRuntimePtyInput(settings, ptyId, NATIVE_CHAT_SUBMIT, 'driving')
           markSubmitted()
         })
       })
@@ -203,12 +208,13 @@ export async function sendNativeChatMessageVerified(
   const bodyAccepted = await sendRuntimePtyInputVerified(
     settings,
     ptyId,
-    buildNativeChatPasteBytes(text)
+    buildNativeChatPasteBytes(text),
+    'driving'
   )
   if (!bodyAccepted || signal?.aborted || !(await waitForNativeChatSubmit(signal))) {
     return false
   }
-  return sendRuntimePtyInputVerified(settings, ptyId, NATIVE_CHAT_SUBMIT)
+  return sendRuntimePtyInputVerified(settings, ptyId, NATIVE_CHAT_SUBMIT, 'driving')
 }
 
 /** Types a slash command as individual keys so Codex opens its command palette. */
@@ -224,7 +230,7 @@ export async function typeNativeChatCommand(
     command,
     signal,
     write: async (key) =>
-      (await sendRuntimePtyInputVerified(settings, ptyId, key)) ? 'accepted' : 'rejected'
+      (await sendRuntimePtyInputVerified(settings, ptyId, key, 'driving')) ? 'accepted' : 'rejected'
   })
   return outcome === 'accepted'
 }
@@ -253,7 +259,9 @@ export function sendNativeChatTypedCommand(
           if (isCancelled()) {
             return 'rejected'
           }
-          return (await sendRuntimePtyInputVerified(settings, ptyId, key)) ? 'accepted' : 'rejected'
+          return (await sendRuntimePtyInputVerified(settings, ptyId, key, 'driving'))
+            ? 'accepted'
+            : 'rejected'
         }
       }).then(finish, () => finish('rejected'))
     },
@@ -269,7 +277,7 @@ export function sendNativeChatTypedCommand(
 /** Submit a TUI prompt with no body (Enter only) — e.g. a plain submit when the
  *  composer is empty. */
 export function submitNativeChatPrompt(settings: RuntimeSettings, ptyId: string): void {
-  sendRuntimePtyInput(settings, ptyId, NATIVE_CHAT_SUBMIT)
+  sendRuntimePtyInput(settings, ptyId, NATIVE_CHAT_SUBMIT, 'driving')
 }
 
 /**
@@ -297,10 +305,10 @@ export function sendNativeChatAskAnswer(
           // Why: inference must use the remote host's acceptance result, not
           // the fire-and-forget renderer dispatch result.
           verifiedWrites.push(
-            sendRuntimePtyInputVerified(settings, ptyId, bytes).catch(() => false)
+            sendRuntimePtyInputVerified(settings, ptyId, bytes, 'driving').catch(() => false)
           )
         } else {
-          sendRuntimePtyInput(settings, ptyId, bytes)
+          sendRuntimePtyInput(settings, ptyId, bytes, 'driving')
         }
       }, index * NATIVE_CHAT_QUESTION_STEP_MS)
     )
diff --git a/src/renderer/src/components/native-chat/native-chat-session-assembler.ts b/src/renderer/src/components/native-chat/native-chat-session-assembler.ts
index eb61380967f..30f818d8d03 100644
--- a/src/renderer/src/components/native-chat/native-chat-session-assembler.ts
+++ b/src/renderer/src/components/native-chat/native-chat-session-assembler.ts
@@ -7,7 +7,7 @@ import {
   type NativeChatSessionStatus
 } from '../../../../shared/native-chat-types'
 import { NATIVE_CHAT_STREAMING_ID } from '../../../../shared/native-chat-streaming'
-import { compareNativeChatMessagesByTime } from '../../../../shared/native-chat-transcript-projection'
+import { compareNativeChatTranscriptMessages } from '../../../../shared/native-chat-transcript-projection'
 import {
   hasImagePromptMarker,
   isImageSourceUserTurn,
@@ -93,26 +93,26 @@ function supersedes(candidate: NativeChatMessage, existing: NativeChatMessage):
 
 // Why: the tail bubbles form fixed tiers that timestamps alone can't express.
 // The streaming preview (null timestamp) must follow real content but sit ahead
-// of the optimistic composer echoes, which carry finite `sentAt` timestamps that
-// would otherwise sort past it. Rank first, then timestamp within a tier.
+// of the optimistic composer echoes and queued sends, which carry finite timestamps
+// that would otherwise sort past it. Rank first, then timestamp within a tier.
 function messageSortRank(message: NativeChatMessage): number {
   if (message.id === NATIVE_CHAT_STREAMING_ID) {
     return 1
   }
-  if (isPendingMessageId(message.id) || isLaunchPromptMessageId(message.id)) {
+  if (message.queued || isPendingMessageId(message.id) || isLaunchPromptMessageId(message.id)) {
     return 2
   }
   return 0
 }
 
-// Rank first; within a tier the transcript's shared time order.
+// Rank first; within a tier the transcript's shared order.
 export function compareMessages(a: NativeChatMessage, b: NativeChatMessage): number {
   const ar = messageSortRank(a)
   const br = messageSortRank(b)
   if (ar !== br) {
     return ar - br
   }
-  return compareNativeChatMessagesByTime(a, b)
+  return compareNativeChatTranscriptMessages(a, b)
 }
 
 /**
diff --git a/src/renderer/src/components/native-chat/native-chat-stop-layering.test.ts b/src/renderer/src/components/native-chat/native-chat-stop-layering.test.ts
index 26b4009caaa..4a1f7a7863e 100644
--- a/src/renderer/src/components/native-chat/native-chat-stop-layering.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-stop-layering.test.ts
@@ -16,7 +16,14 @@ describe('native chat layering', () => {
       expect(source(path)).toContain('<RetainedPaneHost')
     }
     expect(css).not.toMatch(/\.native-chat-pane-shell:has\(\[data-native-chat-working/)
-    expect(css).toMatch(/\[data-sonner-toaster\][^{]*\{[^}]*z-index:\s*40\s*!important;/s)
+    expect(css).toMatch(
+      /\[data-sonner-toaster\][^{]*\{[^}]*z-index:\s*var\(--toaster-z-index,\s*40\)\s*!important;/s
+    )
+    // A :has() in the toaster's selector, or one scanning below body's children, froze large diffs.
+    expect(css).toMatch(
+      /body:has\(>\s*\[data-slot='dialog-overlay'\],\s*>\s*\[data-slot='sheet-overlay'\]\)\s*\{\s*--toaster-z-index:\s*60;/
+    )
+    expect(css).not.toMatch(/:has\([^{]*\)\s+\[data-sonner-toaster\]/)
   })
 
   it('publishes working state from both structured and bridge chat roots', () => {
diff --git a/src/renderer/src/components/native-chat/native-chat-structured-send-composition-clear.test.tsx b/src/renderer/src/components/native-chat/native-chat-structured-send-composition-clear.test.tsx
index 6b647453e8e..298da7fba6a 100644
--- a/src/renderer/src/components/native-chat/native-chat-structured-send-composition-clear.test.tsx
+++ b/src/renderer/src/components/native-chat/native-chat-structured-send-composition-clear.test.tsx
@@ -67,6 +67,7 @@ vi.mock('../dictation/dictation-control-events', () => ({
 }))
 
 import { NativeChatComposer } from './NativeChatComposer'
+import { appendNativeChatDraftCache, readNativeChatDraftCache } from './native-chat-draft-cache'
 
 type Dispatched = { handled: boolean; accepted: boolean; error: string | null }
 
@@ -124,20 +125,20 @@ function renderComposer(structuredTransport: NativeChatStructuredComposerTranspo
   )
 }
 
-describe('structured send racing the next IME composition', () => {
-  beforeEach(() => {
-    Object.defineProperty(window, 'api', {
-      configurable: true,
-      value: {
-        git: { discoverCommitMessageModels: vi.fn().mockResolvedValue({ success: false }) },
-        pty: { getMainBufferSnapshot: vi.fn().mockResolvedValue(null) },
-        ui: { onFileDrop: () => vi.fn() }
-      }
-    })
+beforeEach(() => {
+  Object.defineProperty(window, 'api', {
+    configurable: true,
+    value: {
+      git: { discoverCommitMessageModels: vi.fn().mockResolvedValue({ success: false }) },
+      pty: { getMainBufferSnapshot: vi.fn().mockResolvedValue(null) },
+      ui: { onFileDrop: () => vi.fn() }
+    }
   })
+})
 
-  afterEach(() => cleanup())
+afterEach(() => cleanup())
 
+describe('structured send racing the next IME composition', () => {
   // The regression: the RPC's clear lands while the NEXT composition is live, so the DOM sync
   // drops it and settlement used to adopt the sent text back into the composer (#17359).
   it('does not resurrect the sent message when the clear lands mid-composition', async () => {
@@ -240,3 +241,66 @@ describe('structured send racing the next IME composition', () => {
     expect(promptValue(input)).toBe('/model')
   })
 })
+
+describe('a withdrawn message put back during an IME composition', () => {
+  // The field ignores a programmatic draft while the IME owns it, and the next composed keystroke
+  // wrote the draft without the text, after its outbox entry had already been dropped.
+  it('shows the text once the composition settles, after what was composed', () => {
+    renderComposer(transport())
+    const pane = `tab-${paneCounter}:structured`
+    const input = textarea()
+    changePrompt(input, 'abc')
+
+    fireEvent.compositionStart(input)
+    changePrompt(input, 'abc안')
+    act(() => appendNativeChatDraftCache(pane, 'withdrawn'))
+    changePrompt(input, 'abc안녕')
+    fireEvent.compositionEnd(input, { data: '안녕' })
+
+    expect(promptValue(input)).toBe('abc안녕\n\nwithdrawn')
+    expect(readNativeChatDraftCache(pane)).toBe('abc안녕\n\nwithdrawn')
+  })
+
+  // Settling spends the held text; a later write or composition must not add it again.
+  it('shows the text once, however much is typed or composed after', () => {
+    renderComposer(transport())
+    const pane = `tab-${paneCounter}:structured`
+    const input = textarea()
+    changePrompt(input, 'abc')
+    fireEvent.compositionStart(input)
+    changePrompt(input, 'abc안')
+    act(() => appendNativeChatDraftCache(pane, 'withdrawn'))
+    fireEvent.compositionEnd(input, { data: '안' })
+
+    changePrompt(input, 'abc안\n\nwithdrawn!')
+    fireEvent.compositionStart(input)
+    changePrompt(input, 'abc안\n\nwithdrawn!가')
+    fireEvent.compositionEnd(input, { data: '가' })
+
+    expect(promptValue(input)).toBe('abc안\n\nwithdrawn!가')
+    expect(readNativeChatDraftCache(pane)).toBe('abc안\n\nwithdrawn!가')
+  })
+
+  // The settle first swaps in the composed value (dropping the sent text), then adds the held text.
+  it('keeps the text when a sent message is also cleared mid-composition', async () => {
+    const dispatch = deferred()
+    const structured = transport({ dispatchCommand: vi.fn(() => dispatch.promise) })
+    renderComposer(structured)
+    const pane = `tab-${paneCounter}:structured`
+    const input = textarea()
+    changePrompt(input, '안녕')
+    pressEnter(input)
+
+    fireEvent.compositionStart(input)
+    changePrompt(input, '안녕하')
+    act(() => appendNativeChatDraftCache(pane, 'withdrawn'))
+    await act(async () => {
+      dispatch.resolve(PASS_THROUGH)
+      await dispatch.promise
+    })
+    fireEvent.compositionEnd(input, { data: '하' })
+
+    expect(promptValue(input)).toBe('하\n\nwithdrawn')
+    expect(readNativeChatDraftCache(pane)).toBe('하\n\nwithdrawn')
+  })
+})
diff --git a/src/renderer/src/components/native-chat/native-chat-terminal-turn.test.ts b/src/renderer/src/components/native-chat/native-chat-terminal-turn.test.ts
new file mode 100644
index 00000000000..4e77c18ace6
--- /dev/null
+++ b/src/renderer/src/components/native-chat/native-chat-terminal-turn.test.ts
@@ -0,0 +1,243 @@
+import { describe, expect, it } from 'vitest'
+import {
+  NATIVE_CHAT_INTERRUPTED_STATUS_TEXT,
+  type NativeChatMessage
+} from '../../../../shared/native-chat-types'
+import {
+  nativeChatHookLatestTurnWorkedSeconds,
+  nativeChatHookTurnStartedAt,
+  nativeChatLatestTurnId,
+  nativeChatTranscriptSettledTurns,
+  resolveNativeChatTerminalTurn
+} from './native-chat-terminal-turn'
+
+const idle = {
+  isConversation: true,
+  working: false,
+  hookAwaitingInput: false,
+  interrupted: false,
+  hasPromptCard: false
+}
+
+describe('resolveNativeChatTerminalTurn', () => {
+  it('keeps the turn running while the agent waits, without calling it generating', () => {
+    expect(resolveNativeChatTerminalTurn({ ...idle, hookAwaitingInput: true })).toEqual({
+      isWorking: false,
+      turnActive: true,
+      awaitingInput: 'unshown'
+    })
+  })
+
+  it('lets a prompt card speak for the wait', () => {
+    expect(
+      resolveNativeChatTerminalTurn({ ...idle, hookAwaitingInput: true, hasPromptCard: true })
+    ).toEqual({ isWorking: false, turnActive: true, awaitingInput: 'shown' })
+  })
+
+  it('reports a generating turn with nothing awaited', () => {
+    expect(resolveNativeChatTerminalTurn({ ...idle, working: true })).toEqual({
+      isWorking: true,
+      turnActive: true,
+      awaitingInput: null
+    })
+  })
+
+  // Stop is the reader's word that the turn is over, whatever the hook still says.
+  it('ends the turn on local Stop, wait included', () => {
+    expect(
+      resolveNativeChatTerminalTurn({
+        ...idle,
+        working: true,
+        hookAwaitingInput: true,
+        interrupted: true
+      })
+    ).toEqual({ isWorking: false, turnActive: false, awaitingInput: null })
+  })
+
+  it('stays quiet with no turn at all', () => {
+    expect(resolveNativeChatTerminalTurn(idle)).toEqual({
+      isWorking: false,
+      turnActive: false,
+      awaitingInput: null
+    })
+  })
+})
+
+describe('nativeChatHookTurnStartedAt', () => {
+  const entry = { state: 'working' as const, stateStartedAt: 3_000 }
+
+  // Answered in the terminal: the current state began at 3s, the turn at 1s.
+  it("dates the turn by the host's stamp, not the state it came back from", () => {
+    expect(nativeChatHookTurnStartedAt({ ...entry, turnStartedAt: 1_000 })).toBe(1_000)
+  })
+
+  // A background task held the row 'working' since 500; the main agent's turn began at 8s.
+  it('keeps the stamp when child work holds the row open', () => {
+    expect(
+      nativeChatHookTurnStartedAt({
+        ...entry,
+        stateStartedAt: 500,
+        turnStartedAt: 8_000,
+        mainAgent: { state: 'working', stateStartedAt: 8_000 }
+      })
+    ).toBe(8_000)
+  })
+
+  it("falls back to the main agent's own state start on a host that stamps no turn", () => {
+    expect(
+      nativeChatHookTurnStartedAt({
+        ...entry,
+        stateStartedAt: 500,
+        mainAgent: { state: 'working', stateStartedAt: 8_000 }
+      })
+    ).toBe(8_000)
+  })
+
+  it('falls back to the row once the main agent is done, or where it has none', () => {
+    expect(
+      nativeChatHookTurnStartedAt({ ...entry, mainAgent: { state: 'done', stateStartedAt: 2_500 } })
+    ).toBe(3_000)
+    expect(nativeChatHookTurnStartedAt(entry)).toBe(3_000)
+  })
+
+  it('knows nothing without a status row', () => {
+    expect(nativeChatHookTurnStartedAt(undefined)).toBeNull()
+  })
+})
+
+describe('nativeChatHookLatestTurnWorkedSeconds', () => {
+  const done = { state: 'done' as const, stateStartedAt: 91_000, turnStartedAt: 1_000 }
+
+  it("times a turn the host ended from its turn start to the main agent's done", () => {
+    expect(nativeChatHookLatestTurnWorkedSeconds(done, false)).toBe(90)
+    // Child work still holds the row; the main agent's own end closes the turn.
+    expect(
+      nativeChatHookLatestTurnWorkedSeconds(
+        { ...done, state: 'working', mainAgent: { state: 'done', stateStartedAt: 31_000 } },
+        false
+      )
+    ).toBe(30)
+  })
+
+  // Staleness ages the row out of the pane, not the host's record that the turn finished.
+  it('keeps a host-ended duration once the row is stale', () => {
+    expect(nativeChatHookLatestTurnWorkedSeconds(done, true)).toBe(90)
+  })
+
+  it('hides a local end while the host went quiet mid-turn', () => {
+    expect(
+      nativeChatHookLatestTurnWorkedSeconds(
+        { ...done, state: 'waiting', stateStartedAt: 2_000 },
+        true
+      )
+    ).toBeNull()
+  })
+
+  // A pane-side end (Stop, the transcript's end marker) is the pane's own word; keep what it saw.
+  it('keeps the local reading while the host is fresh and the turn not host-ended', () => {
+    expect(
+      nativeChatHookLatestTurnWorkedSeconds(
+        { ...done, state: 'waiting', stateStartedAt: 2_000 },
+        false
+      )
+    ).toBeUndefined()
+  })
+
+  it('invents no duration without the host turn stamp, or across a session boundary', () => {
+    expect(
+      nativeChatHookLatestTurnWorkedSeconds({ state: 'done', stateStartedAt: 91_000 }, false)
+    ).toBeUndefined()
+    expect(
+      nativeChatHookLatestTurnWorkedSeconds({ ...done, sessionBoundary: true }, false)
+    ).toBeUndefined()
+    expect(nativeChatHookLatestTurnWorkedSeconds(undefined, true)).toBeUndefined()
+  })
+})
+
+function row(
+  id: string,
+  role: NativeChatMessage['role'],
+  timestamp: number | null
+): NativeChatMessage {
+  return { id, role, blocks: [{ type: 'text', text: id }], timestamp, source: 'transcript' }
+}
+
+describe('nativeChatTranscriptSettledTurns', () => {
+  it('times each finished turn from its prompt to its last row, leaving the latest out', () => {
+    const settled = nativeChatTranscriptSettledTurns([
+      row('u1', 'user', 10_000),
+      row('a1', 'assistant', 20_000),
+      row('a2', 'assistant', 55_900),
+      row('u2', 'user', 70_000),
+      row('a3', 'assistant', 80_000)
+    ])
+    expect([...settled]).toEqual([['u1', { startedAt: 10_000, workedSeconds: 45 }]])
+  })
+
+  it('ends an interrupted turn at its interruption', () => {
+    const settled = nativeChatTranscriptSettledTurns([
+      row('u1', 'user', 0),
+      row('a1', 'assistant', 5_000),
+      {
+        ...row('stop', 'system', 12_000),
+        blocks: [{ type: 'text', text: NATIVE_CHAT_INTERRUPTED_STATUS_TEXT }]
+      },
+      row('u2', 'user', 60_000)
+    ])
+    expect(settled.get('u1')).toEqual({ startedAt: 0, workedSeconds: 12 })
+  })
+
+  // An attachment row sits beside the next prompt; it does not stretch the turn before it.
+  it('does not end a turn at a system row the agent did not write', () => {
+    const settled = nativeChatTranscriptSettledTurns([
+      row('u1', 'user', 0),
+      row('a1', 'assistant', 5_000),
+      row('@src/index.ts', 'system', 3_600_000),
+      row('u2', 'user', 3_601_000)
+    ])
+    expect(settled.get('u1')).toEqual({ startedAt: 0, workedSeconds: 5 })
+  })
+
+  // A harness notice (task notification, reminder) is user-role in the transcript but not a prompt.
+  it('times a turn across a harness notice injected mid-turn', () => {
+    const settled = nativeChatTranscriptSettledTurns([
+      row('u1', 'user', 0),
+      row('a1', 'assistant', 5_000),
+      {
+        ...row('notice', 'user', 10_000),
+        blocks: [{ type: 'text', text: '<task-notification>\n<task-id>b1</task-id>' }]
+      },
+      row('a2', 'assistant', 30_000),
+      row('u2', 'user', 60_000)
+    ])
+    expect([...settled]).toEqual([['u1', { startedAt: 0, workedSeconds: 30 }]])
+  })
+
+  // Absent, not null: null would also hide the duration the pane measured itself.
+  it('leaves out a turn missing either end', () => {
+    const settled = nativeChatTranscriptSettledTurns([
+      row('u1', 'user', null),
+      row('a1', 'assistant', 5_000),
+      row('u2', 'user', 10_000),
+      row('a2', 'assistant', null),
+      row('u3', 'user', 20_000)
+    ])
+    expect(settled.size).toBe(0)
+  })
+})
+
+describe('nativeChatLatestTurnId', () => {
+  it('names the last prompt, not a harness notice after it', () => {
+    expect(
+      nativeChatLatestTurnId([
+        row('u1', 'user', 0),
+        row('a1', 'assistant', 5_000),
+        {
+          ...row('notice', 'user', 10_000),
+          blocks: [{ type: 'text', text: '<task-notification>\n<task-id>b1</task-id>' }]
+        }
+      ])
+    ).toBe('u1')
+    expect(nativeChatLatestTurnId([row('a1', 'assistant', 0)])).toBeNull()
+  })
+})
diff --git a/src/renderer/src/components/native-chat/native-chat-terminal-turn.ts b/src/renderer/src/components/native-chat/native-chat-terminal-turn.ts
new file mode 100644
index 00000000000..2926c5d75f2
--- /dev/null
+++ b/src/renderer/src/components/native-chat/native-chat-terminal-turn.ts
@@ -0,0 +1,132 @@
+import type { AgentStatusEntry } from '../../../../shared/agent-status-types'
+import {
+  isInterruptedStatusMessage,
+  type NativeChatMessage
+} from '../../../../shared/native-chat-types'
+import type {
+  NativeChatSettledTurn,
+  NativeChatSettledTurns
+} from '../../../../shared/native-chat-turn-status'
+import { isNoiseMessage } from '../../../../shared/native-chat-noise'
+import type { NativeChatAwaitingInput } from './NativeChatMessageList'
+import { shouldShowNativeChatWorking } from './native-chat-working-suppression'
+
+export type NativeChatTerminalTurn = {
+  /** The agent is generating: drives Stop-vs-Send and the streaming preview. */
+  isWorking: boolean
+  /** The turn is running, including while its agent waits on the reader, as a
+   *  structured turn runs on behind its prompt card: its clock keeps counting. */
+  turnActive: boolean
+  awaitingInput: NativeChatAwaitingInput | null
+}
+
+/** The turn facts a terminal-backed pane feeds the shared turn-status UI. */
+export function resolveNativeChatTerminalTurn(args: {
+  isConversation: boolean
+  /** Hook 'working', reconciled with the transcript's turn boundaries. */
+  working: boolean
+  /** Hook 'waiting'/'blocked', reconciled the same way. */
+  hookAwaitingInput: boolean
+  /** Local Stop suppression. */
+  interrupted: boolean
+  /** The pane draws the agent's prompt as a card. */
+  hasPromptCard: boolean
+}): NativeChatTerminalTurn {
+  const { isConversation, working, hookAwaitingInput, interrupted, hasPromptCard } = args
+  const turnActive = shouldShowNativeChatWorking({
+    isConversation,
+    working: working || hookAwaitingInput,
+    interrupted
+  })
+  return {
+    isWorking: shouldShowNativeChatWorking({ isConversation, working, interrupted }),
+    turnActive,
+    // A prompt only the terminal shows is the one wait the transcript has to report.
+    awaitingInput: hasPromptCard ? 'shown' : turnActive && hookAwaitingInput ? 'unshown' : null
+  }
+}
+
+type NativeChatHookTurnEntry = Pick<
+  AgentStatusEntry,
+  'state' | 'stateStartedAt' | 'turnStartedAt' | 'mainAgent' | 'sessionBoundary'
+>
+
+/**
+ * When the pane's current turn began: the host's stamp from the main agent's own turn-opening
+ * event, which survives a remount, a reload and child work holding the row open. A host too old to
+ * stamp it leaves the current state's start, the main agent's while it is mid-turn.
+ */
+export function nativeChatHookTurnStartedAt(
+  entry: NativeChatHookTurnEntry | undefined
+): number | null {
+  if (!entry) {
+    return null
+  }
+  if (entry.turnStartedAt !== undefined) {
+    return entry.turnStartedAt
+  }
+  return entry.mainAgent && entry.mainAgent.state !== 'done'
+    ? entry.mainAgent.stateStartedAt
+    : entry.stateStartedAt
+}
+
+/**
+ * The latest turn's duration by the host, for a turn the pane is not running: a number once the
+ * main agent is done (its done stamp minus the host's turn start), null when the host went quiet
+ * mid-turn (nothing says the turn ended, so a locally measured end would be a false claim), and
+ * undefined to keep what the pane observed (an old host, a session boundary, a pane-side end).
+ */
+export function nativeChatHookLatestTurnWorkedSeconds(
+  entry: NativeChatHookTurnEntry | undefined,
+  hookSilent: boolean
+): number | null | undefined {
+  if (!entry) {
+    return undefined
+  }
+  const mainAgent = entry.mainAgent ?? entry
+  if (mainAgent.state === 'done') {
+    return entry.sessionBoundary === true || entry.turnStartedAt === undefined
+      ? undefined
+      : Math.max(0, Math.floor((mainAgent.stateStartedAt - entry.turnStartedAt) / 1000))
+  }
+  return hookSilent ? null : undefined
+}
+
+/** The transcript's latest turn: its last prompt, harness notices aside. */
+export function nativeChatLatestTurnId(messages: readonly NativeChatMessage[]): string | null {
+  const latest = messages.findLast((message) => message.role === 'user' && !isNoiseMessage(message))
+  return latest?.id ?? null
+}
+
+/**
+ * Durations of the transcript's finished turns, from its own timestamps (one clock): a turn runs
+ * from its prompt to the agent's last timestamped row or its interruption. Other system rows (file
+ * mentions, extension notes) can land long after, next to the following prompt. The latest turn is
+ * left out, since nothing here says it has ended, and so is a turn missing either end, which keeps
+ * what the pane observed.
+ */
+export function nativeChatTranscriptSettledTurns(
+  messages: readonly NativeChatMessage[]
+): NativeChatSettledTurns {
+  const settled = new Map<string, NativeChatSettledTurn>()
+  let turn: { id: string; startedAt: number | null; endedAt: number | null } | null = null
+  for (const message of messages) {
+    // A harness notice is user-role but draws no row, so it neither starts nor extends a turn.
+    if (message.role !== 'user' || isNoiseMessage(message)) {
+      const agentRow =
+        message.role === 'system' ? isInterruptedStatusMessage(message) : message.role !== 'user'
+      if (turn && agentRow && message.timestamp != null) {
+        turn.endedAt = Math.max(turn.endedAt ?? message.timestamp, message.timestamp)
+      }
+      continue
+    }
+    if (turn?.startedAt != null && turn.endedAt != null) {
+      settled.set(turn.id, {
+        startedAt: turn.startedAt,
+        workedSeconds: Math.max(0, Math.floor((turn.endedAt - turn.startedAt) / 1000))
+      })
+    }
+    turn = { id: message.id, startedAt: message.timestamp, endedAt: null }
+  }
+  return settled
+}
diff --git a/src/renderer/src/components/native-chat/native-chat-tool-fold.test.ts b/src/renderer/src/components/native-chat/native-chat-tool-fold.test.ts
index 2e15d24eb2a..3c83b6a2796 100644
--- a/src/renderer/src/components/native-chat/native-chat-tool-fold.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-tool-fold.test.ts
@@ -252,3 +252,57 @@ describe('spawn-group roster rows', () => {
     expect(prose.map((block) => block.type)).toEqual(['text', 'subagent-group'])
   })
 })
+
+describe('foldToolMessages — each agent folds into its own run', () => {
+  const child = (
+    overrides: Partial<NativeChatMessage> & Pick<NativeChatMessage, 'id'>
+  ): NativeChatMessage => msg({ agentId: 'task-1', ...overrides })
+  const text = (value: string) => ({ type: 'text' as const, text: value })
+  const call = (name: string) => ({ type: 'tool-call' as const, name, input: {} })
+
+  it("does not fold a subagent's tool calls into its parent's message", () => {
+    const folded = foldToolMessages([
+      msg({ id: 'parent', blocks: [text('delegating')] }),
+      child({ id: 'child-grep', blocks: [call('Grep')] })
+    ])
+    expect(folded.map((message) => message.id)).toEqual(['parent', 'child-grep'])
+    expect(folded[0]?.blocks).toEqual([text('delegating')])
+  })
+
+  it("keeps interleaved agents in order, each call in its own agent's run", () => {
+    const folded = foldToolMessages([
+      msg({ id: 'parent', blocks: [text('delegating')] }),
+      child({ id: 'child', blocks: [text('looking')] }),
+      child({ id: 'child-grep', blocks: [call('Grep')] }),
+      msg({ id: 'parent-read', blocks: [call('Read')] })
+    ])
+    // The parent's later call stays where it happened, below the child's work,
+    // rather than jumping back up into the parent's earlier row.
+    expect(folded.map((message) => message.id)).toEqual(['parent', 'child', 'parent-read'])
+    expect(folded[0]?.blocks).toEqual([text('delegating')])
+    expect(folded[1]?.blocks).toEqual([text('looking'), call('Grep')])
+    expect(folded[1]?.agentId).toBe('task-1')
+    expect(folded[2]?.agentId).toBeUndefined()
+  })
+
+  it("ends every agent's run at a turn boundary", () => {
+    const folded = foldToolMessages([
+      child({ id: 'child', blocks: [text('looking')] }),
+      msg({ id: 'ask', role: 'user', blocks: [text('next')] }),
+      child({ id: 'child-grep', blocks: [call('Grep')] })
+    ])
+    // The child's later call stays in the turn it happened in.
+    expect(folded.map((message) => message.id)).toEqual(['child', 'ask', 'child-grep'])
+  })
+
+  it('folds a transcript that names no producer exactly as a single run', () => {
+    const folded = foldToolMessages([
+      msg({ id: 'a', blocks: [text('one')] }),
+      msg({ id: 'a-call', blocks: [call('Bash')] }),
+      msg({ id: 'notice', role: 'system', blocks: [text('Something happened')] }),
+      msg({ id: 'b-call', blocks: [call('Read')] })
+    ])
+    expect(folded.map((message) => message.id)).toEqual(['a', 'notice', 'b-call'])
+    expect(folded[0]?.blocks).toEqual([text('one'), call('Bash')])
+  })
+})
diff --git a/src/renderer/src/components/native-chat/native-chat-transcript-slots.test.ts b/src/renderer/src/components/native-chat/native-chat-transcript-slots.test.ts
index ecb6a183f4e..add069deb97 100644
--- a/src/renderer/src/components/native-chat/native-chat-transcript-slots.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-transcript-slots.test.ts
@@ -1,5 +1,11 @@
 import { describe, expect, it } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalRenderItem,
+  AgentJournalTurnScope
+} from '../../../../shared/agent-session-journal-types'
 import type { NativeChatMessage } from '../../../../shared/native-chat-types'
+import { nativeChatTurnMembership } from '../../../../shared/native-chat-turn-membership'
 import {
   selectNativeChatTurnStatuses,
   type NativeChatTurnStatus
@@ -38,12 +44,10 @@ function build(
   return buildNativeChatTranscriptSlots({
     messages,
     turnKeys,
-    latestUserIndex: messages.findLastIndex((message) => message.role === 'user'),
-    currentTurnKey: undefined,
+    liveTurnKey: undefined,
     receipts: new Map<string, NativeChatResolvedPrompt>(),
     turnStatuses: NO_STATUSES,
     turnDiffs: new Map<string, NativeChatTurnDiff>(),
-    showTurnStatus: true,
     expandedTurnKeys: new Set<string>(),
     isWorking: false,
     lifecycleWorking: false,
@@ -112,7 +116,7 @@ describe('transcript slots', () => {
   it('keeps a message whose only content is a turn status under it', () => {
     const status: NativeChatTurnStatus = { startedAt: 1, thinking: false, workedSeconds: 4 }
     const slots = build([text('u', '', 'user')], {
-      latestUserIndex: 0,
+      liveTurnKey: 'u',
       turnStatuses: { active: status, completedByTurn: {} }
     })
     expect(slots).toHaveLength(1)
@@ -139,14 +143,15 @@ describe('transcript slots', () => {
     expect(slots[0]?.receipt).toBe(receipt)
   })
 
-  it('leaves the running turn status to the single transcript-tail indicator', () => {
+  it('puts the running turn bar under the prompt it answers', () => {
     const status: NativeChatTurnStatus = { startedAt: 1, thinking: false, workedSeconds: null }
-    const slots = build([text('u', 'ask', 'user')], {
-      latestUserIndex: 0,
+    const slots = build([text('u', 'ask', 'user'), text('a', 'answer')], {
+      liveTurnKey: 'u',
       turnStatuses: { active: status, completedByTurn: {} },
       isWorking: true
     })
-    expect(slots[0]?.status).toBeUndefined()
+    expect(slots[0]?.status).toBe(status)
+    expect(slots[1]?.status).toBeUndefined()
   })
 
   it('reserves a height for every slot it keeps', () => {
@@ -205,3 +210,404 @@ describe('a send the host rejected', () => {
     ])
   })
 })
+
+describe('a turn no message opened', () => {
+  const settled = (workedSeconds: number): NativeChatTurnStatus => ({
+    startedAt: 1,
+    thinking: false,
+    workedSeconds
+  })
+
+  it('draws its status at its first row and folds its work behind it', () => {
+    const messages = [
+      text('u1', 'List three fruits', 'user'),
+      text('a1', 'Apple, banana, cherry.'),
+      toolRun('wake-tool'),
+      text('wake-answer', 'The background task finished.')
+    ]
+    const slots = build(messages, {
+      turnKeys: ['u1', 'u1', 'wake', 'wake'],
+      turnStatuses: {
+        active: settled(4),
+        completedByTurn: { u1: settled(4), wake: settled(9) }
+      }
+    })
+    const statusOf = (id: string) =>
+      slots.find((slot) => slot.message.id === id)?.status?.workedSeconds
+    expect(statusOf('u1')).toBe(4)
+    expect(statusOf('wake-tool')).toBe(9)
+    expect(statusOf('wake-answer')).toBeUndefined()
+    const toolSlot = slots.find((slot) => slot.message.id === 'wake-tool')
+    expect(toolSlot).toMatchObject({ folded: true, turnFolds: true, turnKey: 'wake' })
+  })
+
+  const failure = (id: string): NativeChatMessage => ({
+    ...text(id, 'The agent exited unexpectedly.', 'system'),
+    blocks: [{ type: 'text' as const, text: 'The agent exited unexpectedly.', tone: 'error' }]
+  })
+
+  it('ends a failed turn on its error, folding the prose before it', () => {
+    const messages = [
+      text('u1', 'go', 'user'),
+      text('a1', 'Looking.'),
+      toolRun('work'),
+      failure('exit')
+    ]
+    const slots = build(messages, {
+      turnStatuses: { active: settled(3), completedByTurn: { u1: settled(3) } }
+    })
+    // Folded rows take no slot; the error is the turn's visible end.
+    expect(slots.map((slot) => [slot.message.id, slot.folded])).toEqual([
+      ['u1', false],
+      ['exit', false]
+    ])
+  })
+
+  it('folds an error the agent recovered from behind the answer that followed it', () => {
+    const messages = [text('u1', 'go', 'user'), failure('retry'), text('a1', 'Done.')]
+    const slots = build(messages, {
+      turnStatuses: { active: settled(3), completedByTurn: { u1: settled(3) } }
+    })
+    expect(slots.map((slot) => [slot.message.id, slot.folded])).toEqual([
+      ['u1', false],
+      ['a1', false]
+    ])
+  })
+})
+
+describe('the live turn', () => {
+  const settled = (workedSeconds: number): NativeChatTurnStatus => ({
+    startedAt: 1,
+    thinking: false,
+    workedSeconds
+  })
+  const working: NativeChatTurnStatus = { startedAt: 1, thinking: false, workedSeconds: null }
+  const THREAD: AgentJournalTurnScope = { kind: 'thread' }
+  const inTurn = (turnItemId: string): AgentJournalTurnScope => ({ kind: 'turn', turnItemId })
+  let sequence = 0
+  const entry = (
+    itemId: string,
+    body: AgentJournalItemBody,
+    turnScope: AgentJournalTurnScope = THREAD
+  ): AgentJournalRenderItem => {
+    sequence += 1
+    return { itemId, revision: 0, sequence, observedAt: sequence, body, turnScope }
+  }
+  const record = (itemId: string, userItemId: string, state: 'running' | 'completed') =>
+    entry(itemId, { kind: 'turn', turnId: itemId, state, userItemId })
+  const row = (id: string, turnScope: AgentJournalTurnScope = THREAD) =>
+    entry(
+      id,
+      { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: id }] },
+      turnScope
+    )
+
+  /** "List three fruits", answered and settled; then a turn the provider opened on its own. */
+  const messages = [
+    text('u1', 'List three fruits', 'user'),
+    text('a1', 'Apple, banana, cherry.'),
+    toolRun('wake-tool'),
+    text('wake-note', 'Checking the background build.')
+  ]
+  function wakeJournal(state: 'running' | 'completed'): AgentJournalRenderItem[] {
+    return [
+      entry('u1', { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'go' }] }),
+      record('t1', 'u1', 'completed'),
+      row('a1', inTurn('t1')),
+      record('wake', 'claude:wake', state),
+      row('wake-tool', inTurn('wake')),
+      row('wake-note', inTurn('wake'))
+    ]
+  }
+  function buildLive(
+    rows: NativeChatMessage[],
+    journal: AgentJournalRenderItem[] | null,
+    overrides: Partial<Parameters<typeof buildNativeChatTranscriptSlots>[0]>
+  ) {
+    const { turnKeys, liveTurnKey } = nativeChatTurnMembership(
+      rows,
+      journal ? { items: journal, submissions: [] } : null
+    )
+    return build(rows, { turnKeys, liveTurnKey, ...overrides })
+  }
+  const slotOf = (slots: ReturnType<typeof build>, id: string) =>
+    slots.find((slot) => slot.message.id === id)
+
+  it('leaves the settled user turn its duration while a turn the provider opened runs', () => {
+    const slots = buildLive(messages, wakeJournal('running'), {
+      isWorking: true,
+      turnStatuses: { active: working, completedByTurn: { u1: settled(4) } }
+    })
+    expect(slotOf(slots, 'u1')?.status?.workedSeconds).toBe(4)
+    expect(
+      slots.filter((slot) => slot.status !== undefined).map((slot) => slot.message.id)
+    ).toEqual(['u1', 'wake-tool'])
+  })
+
+  it('draws a turn the provider opened at its first row, running and then settled', () => {
+    const running = buildLive(messages, wakeJournal('running'), {
+      isWorking: true,
+      turnStatuses: { active: working, completedByTurn: { u1: settled(4) } }
+    })
+    expect(running.map((slot) => [slot.message.id, slot.status])).toEqual([
+      ['u1', settled(4)],
+      ['a1', undefined],
+      ['wake-tool', working],
+      ['wake-note', undefined]
+    ])
+    const ended = buildLive(messages, wakeJournal('completed'), {
+      turnStatuses: { active: settled(4), completedByTurn: { u1: settled(4), wake: settled(9) } }
+    })
+    expect(slotOf(ended, 'u1')?.status?.workedSeconds).toBe(4)
+    expect(slotOf(ended, 'wake-tool')?.status?.workedSeconds).toBe(9)
+  })
+
+  it('keeps the running turn live, and the settled turn before it settled', () => {
+    const slots = buildLive(messages, wakeJournal('running'), { isWorking: true })
+    expect(slots.map((slot) => [slot.message.id, slot.turnKey, slot.activeTurnIsWorking])).toEqual([
+      ['u1', 'u1', false],
+      ['a1', 'u1', false],
+      ['wake-tool', 'wake', true],
+      ['wake-note', 'wake', true]
+    ])
+  })
+
+  it('leaves the settled user turn alone while the running turn has drawn nothing yet', () => {
+    const journal = wakeJournal('running').slice(0, 4)
+    const slots = buildLive(messages.slice(0, 2), journal, {
+      isWorking: true,
+      turnStatuses: { active: working, completedByTurn: { u1: settled(4) } }
+    })
+    expect(
+      slots.map((slot) => [slot.message.id, slot.status?.workedSeconds, slot.activeTurnIsWorking])
+    ).toEqual([
+      ['u1', 4, false],
+      ['a1', undefined, false]
+    ])
+  })
+
+  it('still draws a running turn a message opened on that message, with its rows live', () => {
+    const journal = [
+      entry('u1', { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'go' }] }),
+      record('t1', 'u1', 'running'),
+      row('a1', inTurn('t1'))
+    ]
+    const rows = messages.slice(0, 2)
+    const live = buildLive(rows, journal, { isWorking: true })
+    expect(live.map((slot) => [slot.turnKey, slot.activeTurnIsWorking])).toEqual([
+      ['u1', true],
+      ['u1', true]
+    ])
+    const stopped = buildLive(rows, journal, {
+      turnStatuses: { active: settled(3), completedByTurn: {} }
+    })
+    expect(slotOf(stopped, 'u1')?.status?.workedSeconds).toBe(3)
+  })
+
+  it('reads a turn the provider opened by journal order where the host states no scope', () => {
+    const unscoped = wakeJournal('running').map(({ turnScope: _scope, ...rest }) => rest)
+    const slots = buildLive(messages, unscoped, {
+      isWorking: true,
+      turnStatuses: { active: working, completedByTurn: { u1: settled(4) } }
+    })
+    expect(
+      slots.map((slot) => [slot.turnKey, slot.status?.workedSeconds, slot.activeTurnIsWorking])
+    ).toEqual([
+      ['u1', 4, false],
+      ['u1', undefined, false],
+      ['wake', null, true],
+      ['wake', undefined, true]
+    ])
+  })
+
+  it('keeps the newest user row live with no journal', () => {
+    const slots = buildLive(messages, null, {
+      isWorking: true,
+      turnStatuses: { active: settled(2), completedByTurn: {} }
+    })
+    expect(
+      slots.map((slot) => [slot.turnKey, slot.status?.workedSeconds, slot.activeTurnIsWorking])
+    ).toEqual([
+      ['u1', 2, true],
+      ['u1', undefined, true],
+      ['u1', undefined, true],
+      ['u1', undefined, true]
+    ])
+  })
+})
+
+// Rows belong to the turn the host says owns them, not to the nearest preceding
+// user bubble. The owned turn keys reshape the fold, the bar and liveness.
+describe('turn-owned grouping', () => {
+  const settled: NativeChatTurnStatus = { startedAt: 1, thinking: false, workedSeconds: 70 }
+  // The #23621 shape: B lands mid-turn, three tool calls follow, one turn.
+  const midTurn = [
+    text('A', 'go', 'user'),
+    toolRun('t1'),
+    text('B', 'and also this', 'user'),
+    toolRun('t2'),
+    toolRun('t3'),
+    toolRun('t4'),
+    text('answer', 'Done.')
+  ]
+  const ownedKeys = midTurn.map(() => 'A')
+
+  it("folds every row of a settled turn behind its opener's bar, across a mid-turn send", () => {
+    const slots = build(midTurn, {
+      turnKeys: ownedKeys,
+      turnStatuses: { active: null, completedByTurn: { A: settled } }
+    })
+    // All four tool rows fold; the steered bubble stays visible with no bar of its own.
+    expect(slots.map((slot) => [slot.message.id, slot.status ?? null])).toEqual([
+      ['A', settled],
+      ['B', null],
+      ['answer', null]
+    ])
+    expect(slots[0]?.turnFolds).toBe(true)
+  })
+
+  it('returns every row of the turn when the reader opens it', () => {
+    const slots = build(midTurn, {
+      turnKeys: ownedKeys,
+      turnStatuses: { active: null, completedByTurn: { A: settled } },
+      expandedTurnKeys: new Set(['A'])
+    })
+    expect(slots.map((slot) => slot.message.id)).toEqual([
+      'A',
+      't1',
+      'B',
+      't2',
+      't3',
+      't4',
+      'answer'
+    ])
+  })
+
+  it("anchors a provider-opened turn's bar above its first row", () => {
+    const messages = [text('u1', 'earlier', 'user'), toolRun('w1'), text('done', 'Woke up.')]
+    const slots = build(messages, {
+      turnKeys: ['u1', 'wake', 'wake'],
+      liveTurnKey: 'wake',
+      turnStatuses: { active: settled, completedByTurn: {} },
+      isWorking: true
+    })
+    expect(slots.map((slot) => [slot.message.id, slot.status ?? null, slot.statusAbove])).toEqual([
+      ['u1', null, false],
+      ['w1', settled, true],
+      ['done', null, false]
+    ])
+  })
+
+  it("rolls a turn's diff up once, under its last row, when another prompt lands among its rows", () => {
+    // B opens its own turn but was sent before A's last row was written.
+    const messages = [
+      text('A', 'go', 'user'),
+      toolRun('t1'),
+      text('B', 'next', 'user'),
+      text('a-answer', 'Done with A.'),
+      toolRun('b1')
+    ]
+    const diff = (added: number): NativeChatTurnDiff => ({
+      files: [],
+      added,
+      removed: 0,
+      truncated: false
+    })
+    const slots = build(messages, {
+      turnKeys: ['A', 'A', 'B', 'A', 'B'],
+      turnDiffs: new Map([
+        ['A', diff(1)],
+        ['B', diff(2)]
+      ])
+    })
+    expect(
+      slots.filter((slot) => slot.turnDiff).map((slot) => [slot.message.id, slot.turnDiff?.added])
+    ).toEqual([
+      ['a-answer', 1],
+      ['b1', 2]
+    ])
+  })
+
+  it("keeps a running turn's rows live while a newer message waits behind it", () => {
+    const messages = [text('A', 'go', 'user'), toolRun('t1'), text('C', 'next up', 'user')]
+    const slots = build(messages, {
+      turnKeys: ['A', 'A', 'C'],
+      liveTurnKey: 'A',
+      isWorking: true
+    })
+    expect(slots.map((slot) => [slot.message.id, slot.activeTurnIsWorking])).toEqual([
+      ['A', true],
+      ['t1', true],
+      ['C', false]
+    ])
+  })
+})
+
+describe("a subagent's rows speak as that subagent", () => {
+  const settled: NativeChatTurnStatus = { startedAt: 1, thinking: false, workedSeconds: 5 }
+  const roster: NativeChatMessage = {
+    id: 'roster',
+    role: 'system',
+    blocks: [
+      {
+        type: 'subagent-group',
+        groupId: 'group-1',
+        agents: [{ id: 'task-1', label: 'explore the lane', state: 'working' }]
+      }
+    ],
+    timestamp: 1,
+    source: 'transcript'
+  }
+  const child = (id: string, body: string, agentId = 'task-1'): NativeChatMessage => ({
+    ...text(id, body),
+    agentId
+  })
+  const messages = [
+    text('ask', 'summarise the repo', 'user'),
+    text('answer', 'Delegated; the summary follows.'),
+    roster,
+    child('child-said', 'The PR is CLEAN.')
+  ]
+
+  it("keeps the parent's answer on a settled turn and folds the subagent's later words", () => {
+    const slots = build(messages, {
+      turnStatuses: { active: null, completedByTurn: { ask: settled } },
+      subagentLabels: new Map([['task-1', 'explore the lane']])
+    })
+    const drawn = slots.filter((slot) => !slot.folded).map((slot) => slot.message.id)
+    expect(drawn).toContain('answer')
+    expect(drawn).not.toContain('child-said')
+  })
+
+  it("names the subagent on its row from the roster, and only on a subagent's row", () => {
+    const slots = build(messages, {
+      subagentLabels: new Map([['task-1', 'explore the lane']])
+    })
+    const labelOf = (id: string) => slots.find((slot) => slot.message.id === id)?.subagentLabel
+    expect(labelOf('child-said')).toBe('explore the lane')
+    expect(labelOf('answer')).toBeUndefined()
+  })
+
+  it("keeps the parent's run live while its subagent works below it", () => {
+    const trailing = (rows: NativeChatMessage[]) =>
+      build(rows)
+        .filter((slot) => slot.trailingRun)
+        .map((slot) => slot.message.id)
+    const childRun: NativeChatMessage = { ...toolRun('child-run'), agentId: 'task-1' }
+    // The parent is still inside its spawn call; the child's work does not move it past.
+    expect(trailing([text('ask', 'go', 'user'), toolRun('spawn'), childRun])).toEqual([
+      'spawn',
+      'child-run'
+    ])
+    // The parent answering does move it past its own run, whatever the child does.
+    expect(
+      trailing([text('ask', 'go', 'user'), toolRun('spawn'), text('said', 'Done.'), childRun])
+    ).toEqual(['said', 'child-run'])
+  })
+
+  it('reserves room for the caption on a subagent row', () => {
+    const [parentSlot] = build([text('mine', 'same words')])
+    const [childSlot] = build([child('theirs', 'same words')])
+    expect(childSlot!.estimatedHeight).toBeGreaterThan(parentSlot!.estimatedHeight)
+  })
+})
diff --git a/src/renderer/src/components/native-chat/native-chat-transcript-slots.ts b/src/renderer/src/components/native-chat/native-chat-transcript-slots.ts
index bf1b3f3e75c..96989aab0f0 100644
--- a/src/renderer/src/components/native-chat/native-chat-transcript-slots.ts
+++ b/src/renderer/src/components/native-chat/native-chat-transcript-slots.ts
@@ -7,13 +7,18 @@
 // single place that answers "does this message take a slot?", and it answers it
 // with the same derivation the row itself renders from.
 
+import type { AgentJournalRenderItem } from '../../../../shared/agent-session-journal-types'
 import {
   isBackgroundTaskBlock,
   isSubagentGroupBlock,
   isToolCallBlock,
   type NativeChatMessage
 } from '../../../../shared/native-chat-types'
+import { agentJournalItemSubagentId } from '../../../../shared/agent-session-journal-producer'
+import { nativeChatSubagentLabel } from '../../../../shared/native-chat-subagent-attribution'
 import type { NativeChatTurnStatus } from '../../../../shared/native-chat-turn-status'
+import { nativeChatMessagesWaitingBehindLiveTurn } from '../../../../shared/native-chat-turn-membership'
+import { nativeChatTurnBarRows } from '../../../../shared/native-chat-turn-grouping'
 import {
   nativeChatTurnFold,
   type NativeChatTurnFoldRow
@@ -42,12 +47,18 @@ export type NativeChatTranscriptSlot = {
   receipt: NativeChatResolvedPrompt | undefined
   /** Turn timing shown under this row, already filtered to "should render". */
   status: NativeChatTurnStatus | undefined
+  /** The bar renders above the row: this turn has no user bubble of its own
+   *  (provider-opened), so its bar sits at the turn's position instead. */
+  statusAbove?: boolean
   /** This row is behind its turn's folded status row: it draws no prose and no
    *  tool activity, only work that outlives the turn. */
   folded: boolean
   /** Whether this row's turn hides anything, so its status row offers a caret. */
   turnFolds: boolean
   turnDiff: NativeChatTurnDiff | undefined
+  /** The roster's name for the subagent that wrote this row, when one names it.
+   *  Whether a subagent wrote it at all is the message's own linkage. */
+  subagentLabel: string | undefined
   /** Height to reserve before the row has ever been measured. */
   estimatedHeight: number
 }
@@ -55,20 +66,22 @@ export type NativeChatTranscriptSlot = {
 export type NativeChatTranscriptSlotsInput = {
   messages: readonly NativeChatMessage[]
   turnKeys: readonly (string | undefined)[]
-  latestUserIndex: number
-  currentTurnKey: string | undefined
+  /** The live turn (`nativeChatTurnMembership`): its bar carries the running clock and its rows
+   *  stay live. Undefined when no row has opened one. */
+  liveTurnKey: string | undefined
   receipts: ReadonlyMap<string, NativeChatResolvedPrompt>
   turnStatuses: {
     active: NativeChatTurnStatus | null
     completedByTurn: Readonly<Record<string, NativeChatTurnStatus>>
   }
   turnDiffs: ReadonlyMap<string, NativeChatTurnDiff>
-  showTurnStatus: boolean
   /** Turns the reader opened. Everything else with a duration stays folded. */
   expandedTurnKeys: ReadonlySet<string>
   isWorking: boolean
   /** Session-level lifecycle, which outlives a transcript that never said "done". */
   lifecycleWorking: boolean
+  /** Each subagent's roster label, by the id its rows carry. */
+  subagentLabels?: ReadonlyMap<string, string>
 }
 
 export function buildNativeChatTranscriptSlots(
@@ -77,20 +90,20 @@ export function buildNativeChatTranscriptSlots(
   const {
     messages,
     turnKeys,
-    latestUserIndex,
-    currentTurnKey,
+    liveTurnKey,
     receipts,
     turnStatuses,
     turnDiffs,
-    showTurnStatus,
     expandedTurnKeys,
     isWorking,
-    lifecycleWorking
+    lifecycleWorking,
+    subagentLabels
   } = input
   // One pass to decide what each row draws, then the fold over those readings —
   // so "is this the answer" and "does this row render prose" cannot disagree.
   const foldRows: NativeChatTurnFoldRow[] = messages.map((message, index) => {
     const content = deriveNativeChatRowContent(message.blocks)
+    const agentId = agentJournalItemSubagentId(message)
     return {
       turnKey: turnKeys[index],
       role: message.role,
@@ -99,45 +112,73 @@ export function buildNativeChatTranscriptSlots(
       // and its plain-text twin is then the only record the spawn happened.
       outlivesTurn: message.blocks.some(
         (block) => isSubagentGroupBlock(block) || isBackgroundTaskBlock(block)
-      )
+      ),
+      reportsFailure: message.blocks.some(
+        (block) => block.type === 'text' && block.tone === 'error'
+      ),
+      reportsCompaction: message.blocks.some(
+        (block) => block.type === 'text' && block.presentation === 'compaction'
+      ),
+      ...(agentId === null ? {} : { agentId })
     }
   })
   // Liveness is the turn's, not any one call's: the run at the frontier stays
   // live between its calls, and a run the agent has moved past is settled even
   // while its last call is still reporting. An approval's receipt decides a call
   // of the run above it, which then runs, so it does not move past that run.
-  const trailingRunIndex = foldRows.findLastIndex(
-    (row, index) =>
+  // Each agent has its own frontier: a subagent working below its parent's run
+  // has not moved the parent past it.
+  const trailingRunIndexes = new Set<number>()
+  const agentsWithFrontier = new Set<string | null>()
+  for (let index = foldRows.length - 1; index >= 0; index -= 1) {
+    const row = foldRows[index]!
+    const agent = agentJournalItemSubagentId(messages[index])
+    if (
+      !agentsWithFrontier.has(agent) &&
       row.role !== 'user' &&
       row.role !== 'reasoning' &&
       receipts.get(messages[index].id)?.kind !== 'approval' &&
       (row.rendersProse || messages[index].blocks.some(isToolCallBlock))
-  )
+    ) {
+      trailingRunIndexes.add(index)
+      agentsWithFrontier.add(agent)
+    }
+  }
   const settledTurnKeys = new Set(
-    showTurnStatus
-      ? Object.entries(turnStatuses.completedByTurn)
-          .filter(([, status]) => status.workedSeconds != null)
-          .map(([turnKey]) => turnKey)
-      : []
+    Object.entries(turnStatuses.completedByTurn)
+      .filter(([, status]) => status.workedSeconds != null)
+      .map(([turnKey]) => turnKey)
   )
   const { foldedRows, foldableTurnKeys } = nativeChatTurnFold({
     rows: foldRows,
     settledTurnKeys,
     expandedTurnKeys
   })
+  const bars = nativeChatTurnBarRows(messages, turnKeys)
+  // A turn's rows need not be contiguous (another turn's prompt can land among
+  // them), so its rollup goes under its last row, not every run boundary.
+  const lastRowByTurn = new Map<string, number>()
+  turnKeys.forEach((turnKey, index) => {
+    if (turnKey !== undefined) {
+      lastRowByTurn.set(turnKey, index)
+    }
+  })
   const slots: NativeChatTranscriptSlot[] = []
   for (const [index, message] of messages.entries()) {
     const turnKey = turnKeys[index]
     const receipt = receipts.get(message.id)
+    const bar = turnKey === undefined ? undefined : bars.get(turnKey)
+    // A turn's bar draws at its first row, so a message folded into it (a steer) carries none.
     const candidateStatus =
-      index === latestUserIndex
-        ? turnStatuses.active
-        : message.role === 'user' && turnKey
-          ? turnStatuses.completedByTurn[turnKey]
-          : undefined
-    const status =
-      showTurnStatus && candidateStatus?.workedSeconds != null ? candidateStatus : undefined
-    const turnDiff = turnKey && turnKeys[index + 1] !== turnKey ? turnDiffs.get(turnKey) : undefined
+      turnKey === undefined || bar?.index !== index
+        ? undefined
+        : turnKey === liveTurnKey
+          ? turnStatuses.active
+          : turnStatuses.completedByTurn[turnKey]
+    // The live turn's bar carries its running clock; it settles in place.
+    const status = candidateStatus ?? undefined
+    const turnDiff =
+      turnKey && lastRowByTurn.get(turnKey) === index ? turnDiffs.get(turnKey) : undefined
     const folded = foldedRows.has(index)
     // Skipping a folded row entirely is what keeps windowing honest: a counted
     // index the row declines to draw reserves estimated height for nothing and
@@ -147,23 +188,30 @@ export function buildNativeChatTranscriptSlots(
     if (!drawsRow && status === undefined && turnDiff === undefined) {
       continue
     }
+    const subagentId = agentJournalItemSubagentId(message)
     slots.push({
       message,
       turnKey,
+      // Liveness is the owning turn's, not the newest prompt's: a running turn's
+      // rows stay live while a newer message waits behind it.
       activeTurnIsWorking:
-        (currentTurnKey ? turnKey === currentTurnKey : turnKey === undefined) &&
+        (liveTurnKey ? turnKey === liveTurnKey : turnKey === undefined) &&
         (isWorking || lifecycleWorking),
-      trailingRun: index === trailingRunIndex,
+      trailingRun: trailingRunIndexes.has(index),
       receipt,
       status: status ?? undefined,
+      statusAbove: bar?.above === true && status !== undefined,
       folded,
       turnFolds: turnKey !== undefined && foldableTurnKeys.has(turnKey),
       turnDiff,
+      subagentLabel: nativeChatSubagentLabel(subagentLabels, message),
       estimatedHeight: estimateNativeChatRowHeight(nativeChatRowContentMetrics(message), {
         hasReceipt: receipt !== undefined,
         hasStatus: status !== undefined,
         hasTurnDiff: turnDiff !== undefined,
-        folded
+        folded,
+        // Only an agent's own row draws the caption; a receipt stands in for it.
+        attributed: subagentId !== null && receipt === undefined && message.role !== 'user'
       })
     })
   }
@@ -181,3 +229,19 @@ export function nativeChatSlotIndexOf(
   }
   return slots.findIndex((slot) => slot.message.id === messageId)
 }
+
+/** Splits off the slots of messages waiting behind the live turn: they draw after its live
+ *  activity, not inside it. */
+export function splitNativeChatSlotsWaitingBehindLiveTurn(
+  slots: readonly NativeChatTranscriptSlot[],
+  journalItems: readonly AgentJournalRenderItem[] | undefined
+): { slots: NativeChatTranscriptSlot[]; waitingSlots: NativeChatTranscriptSlot[] } {
+  const waiting = nativeChatMessagesWaitingBehindLiveTurn(
+    slots.map((slot) => slot.message),
+    journalItems
+  )
+  return {
+    slots: slots.filter((slot) => !waiting.has(slot.message.id)),
+    waitingSlots: slots.filter((slot) => waiting.has(slot.message.id))
+  }
+}
diff --git a/src/renderer/src/components/native-chat/native-chat-typing-indicator.test.ts b/src/renderer/src/components/native-chat/native-chat-typing-indicator.test.ts
deleted file mode 100644
index b53b217eb15..00000000000
--- a/src/renderer/src/components/native-chat/native-chat-typing-indicator.test.ts
+++ /dev/null
@@ -1,154 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { NATIVE_CHAT_STREAMING_ID } from '../../../../shared/native-chat-streaming'
-import type { NativeChatMessage } from '../../../../shared/native-chat-types'
-import type { AgentJournalRenderItem } from '../../../../shared/agent-session-journal-types'
-import { projectStructuredItemsToNativeChat } from '../../../../shared/structured-agent-session-projection'
-import { shouldShowNativeChatTypingIndicator } from './native-chat-typing-indicator'
-
-function message(id: string, role: NativeChatMessage['role'], text = id): NativeChatMessage {
-  return { id, role, blocks: [{ type: 'text', text }], timestamp: null, source: 'transcript' }
-}
-
-describe('shouldShowNativeChatTypingIndicator', () => {
-  it('stays hidden when the session is idle', () => {
-    expect(
-      shouldShowNativeChatTypingIndicator({
-        messages: [message('u1', 'user')],
-        isWorking: false
-      })
-    ).toBe(false)
-  })
-
-  it('shows once a send lands and no assistant row exists yet', () => {
-    expect(
-      shouldShowNativeChatTypingIndicator({
-        messages: [message('a0', 'assistant'), message('u1', 'user')],
-        isWorking: true
-      })
-    ).toBe(true)
-  })
-
-  it('hides as soon as the structured reply row arrives, before working clears', () => {
-    expect(
-      shouldShowNativeChatTypingIndicator({
-        messages: [message('u1', 'user'), message('orca-item', 'assistant')],
-        isWorking: true
-      })
-    ).toBe(false)
-  })
-
-  it('hides behind the PTY streaming bubble', () => {
-    expect(
-      shouldShowNativeChatTypingIndicator({
-        messages: [message('u1', 'user'), message(NATIVE_CHAT_STREAMING_ID, 'assistant')],
-        isWorking: true
-      })
-    ).toBe(false)
-  })
-
-  it('does not flicker back on when a system row interleaves mid-turn', () => {
-    expect(
-      shouldShowNativeChatTypingIndicator({
-        messages: [
-          message('u1', 'user'),
-          message('a1', 'assistant'),
-          message('s1', 'system', 'Ran /status')
-        ],
-        isWorking: true
-      })
-    ).toBe(false)
-  })
-
-  it('shows again for the next send even though an earlier turn replied', () => {
-    expect(
-      shouldShowNativeChatTypingIndicator({
-        messages: [message('u1', 'user'), message('a1', 'assistant'), message('u2', 'user')],
-        isWorking: true
-      })
-    ).toBe(true)
-  })
-
-  it('does not let an unresolved tool from an earlier turn hide the next send indicator', () => {
-    const earlierRunningTool: NativeChatMessage = {
-      id: 'tool-old',
-      role: 'assistant',
-      blocks: [
-        { type: 'tool-call', name: 'shell', input: { command: 'sleep 1' }, state: 'running' }
-      ],
-      timestamp: null,
-      source: 'transcript'
-    }
-    expect(
-      shouldShowNativeChatTypingIndicator({
-        messages: [earlierRunningTool, message('a1', 'assistant'), message('u2', 'user')],
-        isWorking: true
-      })
-    ).toBe(true)
-  })
-
-  it('shows after a slash-command marker even though an earlier turn replied', () => {
-    expect(
-      shouldShowNativeChatTypingIndicator({
-        messages: [
-          message('a1', 'assistant'),
-          message('command:compact', 'system', 'Ran /compact')
-        ],
-        isWorking: true
-      })
-    ).toBe(true)
-  })
-
-  it('shows on a session whose transcript is still empty', () => {
-    expect(shouldShowNativeChatTypingIndicator({ messages: [], isWorking: true })).toBe(true)
-  })
-})
-
-// These build rows through the REAL structured projection instead of hand-made
-// `command:` marker ids. The hand-made ids only exist on the PTY transport, so
-// tests using them were blind to how the shipping transport actually looks.
-describe('with rows projected from the structured journal', () => {
-  function toolCallItem(sequence: number): AgentJournalRenderItem {
-    return {
-      itemId: `codex:thread-1:turn-1:${sequence}`,
-      revision: 1,
-      sequence,
-      observedAt: 1_800_000_000_000,
-      body: {
-        kind: 'tool-call',
-        name: 'shell',
-        state: 'running',
-        input: { command: 'sed -n 1,240p README.md' }
-      }
-    } as AgentJournalRenderItem
-  }
-
-  function assistantTextItem(sequence: number): AgentJournalRenderItem {
-    return {
-      itemId: `codex:thread-1:turn-1:${sequence}`,
-      revision: 1,
-      sequence,
-      observedAt: 1_800_000_000_000,
-      body: {
-        kind: 'message',
-        role: 'assistant',
-        blocks: [{ type: 'text', text: "I'm checking PR 14696's metadata." }]
-      }
-    } as AgentJournalRenderItem
-  }
-
-  it('stays visible beside the structured live tool row while a command runs', () => {
-    const messages = projectStructuredItemsToNativeChat([assistantTextItem(1), toolCallItem(2)])
-    expect(messages.at(-1)?.role).toBe('assistant')
-    expect(shouldShowNativeChatTypingIndicator({ messages, isWorking: true })).toBe(true)
-  })
-
-  it('hides once prose is the newest row', () => {
-    const messages = projectStructuredItemsToNativeChat([toolCallItem(1), assistantTextItem(2)])
-    expect(shouldShowNativeChatTypingIndicator({ messages, isWorking: true })).toBe(false)
-  })
-
-  it('stays hidden when the turn is not working, command row or not', () => {
-    const messages = projectStructuredItemsToNativeChat([toolCallItem(1)])
-    expect(shouldShowNativeChatTypingIndicator({ messages, isWorking: false })).toBe(false)
-  })
-})
diff --git a/src/renderer/src/components/native-chat/native-chat-typing-indicator.ts b/src/renderer/src/components/native-chat/native-chat-typing-indicator.ts
deleted file mode 100644
index 144560278a2..00000000000
--- a/src/renderer/src/components/native-chat/native-chat-typing-indicator.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-import type { NativeChatMessage } from '../../../../shared/native-chat-types'
-import { NATIVE_CHAT_STREAMING_ID } from '../../../../shared/native-chat-streaming'
-import { isCommandMarkerId } from './native-chat-command-marker'
-
-function isToolActivityOnlyRow(message: NativeChatMessage): boolean {
-  const blocks = message.blocks
-  if (!blocks || blocks.length === 0) {
-    return false
-  }
-  return blocks.every((block) => block.type === 'tool-call' || block.type === 'tool-result')
-}
-
-export function shouldShowNativeChatTypingIndicator(args: {
-  messages: readonly NativeChatMessage[]
-  isWorking: boolean
-}): boolean {
-  if (!args.isWorking) {
-    return false
-  }
-  const { messages } = args
-  for (let index = messages.length - 1; index >= 0; index -= 1) {
-    const message = messages[index]
-    if (!message || message.role === 'user' || isCommandMarkerId(message.id)) {
-      return true
-    }
-    if (isToolActivityOnlyRow(message)) {
-      return true
-    }
-    if (message.role === 'assistant' || message.id === NATIVE_CHAT_STREAMING_ID) {
-      return false
-    }
-  }
-  return true
-}
diff --git a/src/renderer/src/components/native-chat/native-chat-view-state.test.ts b/src/renderer/src/components/native-chat/native-chat-view-state.test.ts
index ea97ec99a19..39bf20322b5 100644
--- a/src/renderer/src/components/native-chat/native-chat-view-state.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-view-state.test.ts
@@ -34,7 +34,30 @@ describe('selectNativeChatViewState', () => {
     })
   })
 
-  it('maps error with its message', () => {
+  it('maps error with its message when nothing has loaded (P2-21)', () => {
+    const state = selectNativeChatViewState(
+      session({ messages: [], status: 'error', error: 'boom' })
+    )
+    expect(state).toEqual({ kind: 'error', message: 'boom' })
+  })
+
+  // The pane's own translated line fills in, which for the structured chat says the read retries.
+  it('maps an error with no text to no message', () => {
+    expect(selectNativeChatViewState(session({ messages: [], status: 'error' }))).toEqual({
+      kind: 'error'
+    })
+  })
+
+  it('keeps a loaded transcript on screen when a later read fails (P2-21)', () => {
+    const state = selectNativeChatViewState(session({ status: 'error', error: 'boom' }), {
+      readRetries: true
+    })
+    expect(state).toEqual({ kind: 'ready', isWorking: false })
+  })
+
+  // The terminal-backed read does not retry; its only messages on error are local echoes (a launch
+  // prompt, a pending send), which must not hide the error and its way back to the terminal.
+  it('shows a terminal-backed read error over local echoes', () => {
     const state = selectNativeChatViewState(session({ status: 'error', error: 'boom' }))
     expect(state).toEqual({ kind: 'error', message: 'boom' })
   })
diff --git a/src/renderer/src/components/native-chat/native-chat-view-state.ts b/src/renderer/src/components/native-chat/native-chat-view-state.ts
index 775635df122..13a7e8a5afe 100644
--- a/src/renderer/src/components/native-chat/native-chat-view-state.ts
+++ b/src/renderer/src/components/native-chat/native-chat-view-state.ts
@@ -10,23 +10,36 @@ import type { NativeChatSession } from '../../../../shared/native-chat-types'
  *  live in-flight indicator. The rest are full-pane states. */
 export type NativeChatViewState =
   | { kind: 'loading' }
-  | { kind: 'error'; message: string }
+  | { kind: 'error'; message?: string }
   | { kind: 'empty' }
   | { kind: 'ready'; isWorking: false }
   | { kind: 'ready'; isWorking: true }
 
 /**
- * Decide which surface to render. Error is terminal, but any renderable message
- * wins over loading/empty so optimistic first sends never get replaced by a
- * full-pane placeholder while transcript discovery catches up.
+ * Decide which surface to render. Any renderable message wins over loading/empty so optimistic
+ * first sends never get replaced while transcript discovery catches up. Where the read retries on
+ * its own (the structured chat), messages win over an error too: a read that fails after the
+ * transcript loaded keeps it, and the error reaches the composer's error line. The terminal-backed
+ * read does not retry, and its only messages on error are local echoes, so its error takes the pane.
  */
-export function selectNativeChatViewState(session: NativeChatSession): NativeChatViewState {
-  if (session.status === 'error') {
-    return { kind: 'error', message: session.error ?? 'Conversation could not be loaded.' }
+export function selectNativeChatViewState(
+  session: NativeChatSession,
+  { readRetries = false }: { readRetries?: boolean } = {}
+): NativeChatViewState {
+  // No text of its own: the empty state supplies the pane's translated line.
+  const error: NativeChatViewState | null =
+    session.status === 'error'
+      ? { kind: 'error', ...(session.error ? { message: session.error } : {}) }
+      : null
+  if (error && !readRetries) {
+    return error
   }
   if (session.messages.length > 0) {
     return { kind: 'ready', isWorking: session.status === 'working' }
   }
+  if (error) {
+    return error
+  }
   if (session.status === 'loading') {
     return { kind: 'loading' }
   }
diff --git a/src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx b/src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx
index e4bae292004..8600d40c3ca 100644
--- a/src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx
+++ b/src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx
@@ -20,7 +20,7 @@ function renderTurns(count: number, startedAt: number): void {
     root.render(
       <>
         {Array.from({ length: count }, (_, index) => (
-          <NativeChatWorkingStatus key={index} startedAt={startedAt} thinking={false} />
+          <NativeChatWorkingStatus key={index} startedAt={startedAt} />
         ))}
       </>
     )
@@ -61,9 +61,7 @@ describe('native chat working status elapsed clock', () => {
 
   it('renders the compact duration in the completed status label', () => {
     act(() => {
-      root.render(
-        <NativeChatWorkingStatus startedAt={1_000_000} thinking={false} workedSeconds={69} />
-      )
+      root.render(<NativeChatWorkingStatus startedAt={1_000_000} workedSeconds={69} />)
     })
 
     expect(elapsedLabels()).toEqual(['Worked for 1m 9s'])
@@ -96,14 +94,9 @@ describe('native chat working status elapsed clock', () => {
     expect(vi.getTimerCount()).toBe(1)
   })
 
-  it('holds no timer for a thinking turn or a completed turn', () => {
+  it('holds no timer for a completed turn', () => {
     act(() => {
-      root.render(
-        <>
-          <NativeChatWorkingStatus startedAt={1_000_000} thinking />
-          <NativeChatWorkingStatus startedAt={1_000_000} thinking={false} workedSeconds={12} />
-        </>
-      )
+      root.render(<NativeChatWorkingStatus startedAt={1_000_000} workedSeconds={12} />)
     })
     expect(vi.getTimerCount()).toBe(0)
   })
diff --git a/src/renderer/src/components/native-chat/structured-agent-question-projection.test.ts b/src/renderer/src/components/native-chat/structured-agent-question-projection.test.ts
index ab74c2efef2..09154a2512a 100644
--- a/src/renderer/src/components/native-chat/structured-agent-question-projection.test.ts
+++ b/src/renderer/src/components/native-chat/structured-agent-question-projection.test.ts
@@ -215,3 +215,19 @@ describe('structured agent session ask-row projection', () => {
     ).toHaveLength(1)
   })
 })
+
+describe("a subagent's pending question keeps its producer", () => {
+  it('carries the linkage onto the row that stands in for the question', () => {
+    const projected = projectQuestion({
+      ...item('child-q', {
+        kind: 'question',
+        question: 'Which branch?',
+        options: [{ id: 'q1:main', label: 'main' }],
+        resolution: { ...PENDING }
+      }),
+      agentId: 'task-1',
+      producerKind: 'agent'
+    })
+    expect(projected).toMatchObject({ role: 'system', agentId: 'task-1' })
+  })
+})
diff --git a/src/renderer/src/components/native-chat/structured-agent-question-projection.ts b/src/renderer/src/components/native-chat/structured-agent-question-projection.ts
index b56fa1c7ab0..da247876119 100644
--- a/src/renderer/src/components/native-chat/structured-agent-question-projection.ts
+++ b/src/renderer/src/components/native-chat/structured-agent-question-projection.ts
@@ -4,6 +4,8 @@ import type {
 } from '../../../../shared/agent-session-journal-types'
 import { isAskUserQuestionTool } from '../../../../shared/agent-question-answered-intent'
 import { parseAskFromToolInput } from '../../../../shared/native-chat-ask'
+import { agentJournalItemRowOrigin } from '../../../../shared/agent-session-journal-position'
+import { agentJournalLinkageFields } from '../../../../shared/agent-session-journal-producer'
 import type { NativeChatMessage } from '../../../../shared/native-chat-types'
 import { projectStructuredItemToNativeChat } from '../../../../shared/structured-agent-session-projection'
 import { readAgentJournalTurn } from '../../../../shared/agent-session-turn-record'
@@ -69,10 +71,9 @@ function projectItem(item: AgentJournalRenderItem): Projection {
     if (body.resolution.state === 'pending') {
       // A system row preserves question identity through tool folding; the receipt renders its body.
       message = {
-        id: item.itemId,
+        ...agentJournalItemRowOrigin(item),
+        ...agentJournalLinkageFields(item),
         role: 'system',
-        timestamp: item.observedAt,
-        source: 'transcript',
         blocks: [{ type: 'text', text: body.question }]
       }
     }
diff --git a/src/renderer/src/components/native-chat/structured-agent-session-delivery-notices.test.ts b/src/renderer/src/components/native-chat/structured-agent-session-delivery-notices.test.ts
new file mode 100644
index 00000000000..faadac1127e
--- /dev/null
+++ b/src/renderer/src/components/native-chat/structured-agent-session-delivery-notices.test.ts
@@ -0,0 +1,414 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { AgentSessionFailureFact } from '../../../../shared/agent-session-failure'
+import type {
+  AgentJournalRenderItem,
+  AgentJournalSubmission
+} from '../../../../shared/agent-session-journal-types'
+import {
+  createStructuredAgentSessionOutboxEntry,
+  type StructuredAgentSessionOutboxEntry
+} from '../../../../shared/structured-agent-session-outbox'
+import { agentSessionFailureWords } from '../../../../shared/agent-session-failure-words'
+import {
+  agentJournalItemKey,
+  agentJournalSubmissionKey
+} from '../../../../shared/agent-session-journal-item-key'
+import { structuredAgentSessionStartFailureRowIdentity } from '../../../../shared/structured-agent-session-start-failure-row-key'
+import {
+  structuredAgentSessionDeliveryNotices,
+  structuredAgentSessionStartFailureFacts
+} from './structured-agent-session-delivery-notices'
+
+function entry(
+  clientMessageId: string,
+  patch: Partial<StructuredAgentSessionOutboxEntry> = {}
+): StructuredAgentSessionOutboxEntry {
+  return {
+    ...createStructuredAgentSessionOutboxEntry({
+      clientMessageId,
+      sessionId: 'session-1',
+      text: clientMessageId,
+      attachments: [],
+      queuedAt: 1
+    }),
+    ...patch
+  }
+}
+
+function texts(
+  outbox: StructuredAgentSessionOutboxEntry[],
+  blocked: string | null = null,
+  submissions: readonly AgentJournalSubmission[] = [],
+  startFailures: readonly AgentSessionFailureFact[] = []
+): Record<string, string> {
+  const notices = structuredAgentSessionDeliveryNotices(
+    outbox,
+    blocked,
+    'Claude',
+    () => {},
+    submissions,
+    startFailures
+  )
+  return Object.fromEntries([...notices].map(([id, notice]) => [id, notice.text]))
+}
+
+describe('the notice on each message that did not go through', () => {
+  it('gives two failed messages each their own reason and their own Retry', () => {
+    const retry = vi.fn()
+    const notices = structuredAgentSessionDeliveryNotices(
+      [
+        entry('first', {
+          state: 'rejected',
+          lastFailure: { kind: 'rejected', reason: 'Claude messages support at most 20 images' }
+        }),
+        entry('second', {
+          state: 'rejected',
+          lastFailure: {
+            kind: 'rejected',
+            reason: 'Claude never finished starting, so Orca stopped it.',
+            rejection: { kind: 'hostStopped' }
+          }
+        })
+      ],
+      null,
+      'Claude',
+      retry,
+      [],
+      []
+    )
+
+    expect([...notices.keys()]).toEqual([
+      agentJournalSubmissionKey('first'),
+      agentJournalSubmissionKey('second')
+    ])
+    expect(notices.get(agentJournalSubmissionKey('first'))?.text).toBe(
+      'Claude messages support at most 20 images'
+    )
+    expect(notices.get(agentJournalSubmissionKey('second'))?.text).toBe(
+      'Claude never finished starting, so Orca stopped it.'
+    )
+    notices.get(agentJournalSubmissionKey('second'))?.onRetry?.()
+    expect(retry).toHaveBeenCalledExactlyOnceWith('second')
+  })
+
+  it('chooses the words from the saved refusal on the message the queue stopped on', () => {
+    expect(
+      texts(
+        [
+          entry('held', {
+            lastFailure: { kind: 'refused', code: 'agent_session_owner_restart_failed' }
+          })
+        ],
+        'held'
+      )
+    ).toEqual({
+      [agentJournalSubmissionKey('held')]: "The agent couldn't restart. Your message was not sent."
+    })
+  })
+
+  // The same rule as a rejected row's: its own Retry is the resend step, and any other step stays.
+  it('leaves a retry step to the Retry beside the message the queue stopped on', () => {
+    const held = (lastFailure: StructuredAgentSessionOutboxEntry['lastFailure']) =>
+      texts([entry('held', { lastFailure })], 'held')
+    expect(
+      held({
+        kind: 'refused',
+        code: 'agent_session_journal_unreadable',
+        details: { reason: 'journalUnavailable' }
+      })
+    ).toEqual({
+      [agentJournalSubmissionKey('held')]:
+        "Orca couldn't open this chat's history right now. Your message was not sent."
+    })
+    expect(
+      held({
+        kind: 'refused',
+        code: 'agent_session_operation_invalid',
+        details: { reason: 'notSignedIn' }
+      })
+    ).toEqual({
+      [agentJournalSubmissionKey('held')]:
+        'Your message was not sent. Claude is not signed in for the selected account. Sign in first.'
+    })
+  })
+
+  it('says a message is unconfirmed, and only that it was not sent when nothing more is known', () => {
+    expect(texts([entry('doubt', { state: 'unconfirmed' })])).toEqual({
+      [agentJournalSubmissionKey('doubt')]: 'Message delivery is unconfirmed.'
+    })
+    expect(texts([entry('bare')], 'bare')).toEqual({
+      [agentJournalSubmissionKey('bare')]: 'Message was not sent.'
+    })
+  })
+
+  // The drain's own rule: a message behind the one the queue stopped on is only waiting, so it says
+  // nothing. A rejected message holds nothing up and keeps its words.
+  it('says why on the message the queue stopped on and on every rejected one', () => {
+    expect(
+      texts([
+        entry('sent', { state: 'dispatching' }),
+        entry('rejected', { state: 'rejected' }),
+        entry('stuck', { state: 'unconfirmed' }),
+        entry('behind', { state: 'unconfirmed' }),
+        entry('queued')
+      ])
+    ).toEqual({
+      [agentJournalSubmissionKey('rejected')]: 'Message was not sent.',
+      [agentJournalSubmissionKey('stuck')]: 'Message delivery is unconfirmed.'
+    })
+  })
+
+  // Its Retry would put it back in the queue to wait unseen behind the stopped message.
+  it('keeps a rejected message its words but not its Retry while the queue is stopped', () => {
+    const retry = vi.fn()
+    for (const [outbox, blocked] of [
+      [[entry('stuck', { state: 'unconfirmed' }), entry('rejected', { state: 'rejected' })], null],
+      [[entry('rejected', { state: 'rejected' }), entry('held')], 'held']
+    ] as const) {
+      const notices = structuredAgentSessionDeliveryNotices(
+        [...outbox],
+        blocked,
+        'Claude',
+        retry,
+        [],
+        []
+      )
+      expect(notices.get(agentJournalSubmissionKey('rejected'))).toEqual({
+        text: 'Message was not sent.'
+      })
+    }
+  })
+
+  // Beside its own Retry the resend step is the button; without one the words keep it.
+  it('leaves out sending again only where the message has its own Retry', () => {
+    const startFailed = (clientMessageId: string): StructuredAgentSessionOutboxEntry =>
+      entry(clientMessageId, {
+        state: 'rejected',
+        lastFailure: {
+          kind: 'rejected',
+          reason: 'Claude stopped before it finished starting. Send your message to try again.',
+          rejection: { kind: 'providerStartFailed' }
+        }
+      })
+    expect(texts([startFailed('first'), startFailed('second')])).toEqual({
+      [agentJournalSubmissionKey('first')]: 'Claude stopped before it finished starting.',
+      [agentJournalSubmissionKey('second')]: 'Claude stopped before it finished starting.'
+    })
+    expect(texts([startFailed('rejected'), entry('held')], 'held')).toMatchObject({
+      [agentJournalSubmissionKey('rejected')]:
+        'Claude stopped before it finished starting. Send your message to try again.'
+    })
+  })
+
+  it.each([
+    [
+      'notDelivered',
+      'This message was not delivered. Send it again to continue.',
+      'This message was not delivered.'
+    ],
+    [
+      'hostFault',
+      "Orca ran into a problem, so this didn't go through. Try again.",
+      "Orca ran into a problem, so this didn't go through."
+    ]
+  ] as const)('leaves the step to the Retry beside a %s message', (kind, reason, shown) => {
+    expect(
+      texts([
+        entry('rejected', {
+          state: 'rejected',
+          lastFailure: { kind: 'rejected', reason, rejection: { kind } }
+        })
+      ])
+    ).toEqual({ [agentJournalSubmissionKey('rejected')]: shown })
+  })
+
+  // The journal holds the whole fact; the message's own copy keeps only its kind and attachment.
+  it("words a recorded rejection from the journal's fact, whatever reason the host wrote", () => {
+    const rejected = (id: string): StructuredAgentSessionOutboxEntry =>
+      entry(id, {
+        state: 'rejected',
+        // An older host's words, and not the pane's agent name: never compared, never shown.
+        lastFailure: {
+          kind: 'rejected',
+          reason: "The agent couldn't be started.",
+          rejection: { kind: 'startFailed' }
+        }
+      })
+    const recorded = (id: string, rejection: AgentSessionFailureFact): AgentJournalSubmission => ({
+      clientMessageId: id,
+      fence: 1,
+      payloadFingerprint: 'fingerprint',
+      dispatchState: 'rejected',
+      providerItemId: null,
+      reason: "The agent couldn't be started.",
+      rejection,
+      submittedAt: 1,
+      resolvedAt: 1
+    })
+    const facts: [string, AgentSessionFailureFact, string][] = [
+      [
+        'gone',
+        {
+          kind: 'startFailed',
+          refusal: {
+            code: 'agent_session_identity_required',
+            details: { reason: 'recordMissing' }
+          }
+        },
+        "Claude couldn't start. Start a new chat to continue."
+      ],
+      [
+        'claimed',
+        {
+          kind: 'startFailed',
+          refusal: { code: 'agent_session_conflict', details: { reason: 'claimConflicted' } }
+        },
+        "Claude couldn't start. This chat is still open in a terminal agent. Quit that agent to continue the chat here."
+      ],
+      [
+        'resumable',
+        { kind: 'startFailed', refusal: { code: 'agent_session_ownership_unknown' } },
+        "Claude couldn't start."
+      ],
+      [
+        'provider',
+        { kind: 'providerRejected', detail: { text: 'Image type .bmp', audience: 'person' } },
+        'The provider did not accept this message: Image type .bmp.'
+      ],
+      [
+        'logged',
+        { kind: 'providerRejected', detail: { text: 'HTTP 400 at /v1', audience: 'log' } },
+        'The provider did not accept this message.'
+      ]
+    ]
+    expect(
+      texts(
+        facts.map(([id]) => rejected(id)),
+        null,
+        facts.map(([id, fact]) => recorded(id, fact))
+      )
+    ).toEqual(
+      Object.fromEntries(facts.map(([id, , shown]) => [agentJournalSubmissionKey(id), shown]))
+    )
+    // Not loaded (older than the loaded page): the message's copy has no refusal or detail, so the
+    // host's sentence, which holds them, is shown for those kinds; the table words the rest.
+    expect(
+      texts([
+        rejected('gone'),
+        entry('provider', {
+          state: 'rejected',
+          lastFailure: {
+            kind: 'rejected',
+            reason: 'The provider did not accept this message: Image type .bmp.',
+            rejection: { kind: 'providerRejected' }
+          }
+        }),
+        entry('stopped', {
+          state: 'rejected',
+          lastFailure: {
+            kind: 'rejected',
+            reason: 'The agent stopped before this message was sent.',
+            rejection: { kind: 'providerExited' }
+          }
+        })
+      ])
+    ).toEqual({
+      [agentJournalSubmissionKey('gone')]: "The agent couldn't be started.",
+      [agentJournalSubmissionKey('provider')]:
+        'The provider did not accept this message: Image type .bmp.',
+      [agentJournalSubmissionKey('stopped')]: 'Claude stopped before this message was sent.'
+    })
+  })
+
+  it('says nothing on a message that is only waiting its turn or on its way', () => {
+    expect(texts([entry('queued'), entry('sending', { state: 'dispatching' })])).toEqual({})
+  })
+
+  // Matched on the typed fact of a row found by its identity, never on either sentence.
+  describe('a message rejected by a start whose row already says why', () => {
+    const startFailed: AgentSessionFailureFact = {
+      kind: 'startFailed',
+      refusal: { code: 'agent_session_identity_required', details: { reason: 'recordMissing' } }
+    }
+    const rejected = (id: string, fact: AgentSessionFailureFact) =>
+      entry(id, {
+        state: 'rejected',
+        lastFailure: {
+          kind: 'rejected',
+          reason: 'Written by the host.',
+          rejection: { kind: fact.kind }
+        }
+      })
+    const recorded = (id: string, fact: AgentSessionFailureFact): AgentJournalSubmission => ({
+      clientMessageId: id,
+      fence: 1,
+      payloadFingerprint: id,
+      dispatchState: 'rejected',
+      providerItemId: null,
+      reason: 'Written by the host.',
+      rejection: fact,
+      submittedAt: 1,
+      resolvedAt: 1
+    })
+    const statusRow = (itemId: string, fact: AgentSessionFailureFact): AgentJournalRenderItem => ({
+      itemId,
+      revision: 1,
+      sequence: 1,
+      observedAt: 1,
+      body: {
+        kind: 'status',
+        tone: 'error',
+        ...agentSessionFailureWords(fact, { agentName: 'Claude', surface: 'row' })
+      }
+    })
+    const startRowKey = agentJournalItemKey(structuredAgentSessionStartFailureRowIdentity('gen'))
+
+    it('reads only the start-failure rows', () => {
+      expect(
+        structuredAgentSessionStartFailureFacts([
+          statusRow(startRowKey, startFailed),
+          statusRow(agentJournalSubmissionKey('exit-row'), { kind: 'providerExited' })
+        ])
+      ).toEqual([startFailed])
+    })
+
+    it('says only that each was not sent, and words any other rejection in full', () => {
+      const otherRefusal: AgentSessionFailureFact = {
+        kind: 'startFailed',
+        refusal: { code: 'agent_session_conflict', details: { reason: 'claimConflicted' } }
+      }
+      const facts = structuredAgentSessionStartFailureFacts([statusRow(startRowKey, startFailed)])
+      expect(
+        texts(
+          [
+            rejected('first', startFailed),
+            rejected('second', startFailed),
+            rejected('other', otherRefusal)
+          ],
+          null,
+          [
+            recorded('first', startFailed),
+            recorded('second', startFailed),
+            recorded('other', otherRefusal)
+          ],
+          facts
+        )
+      ).toEqual({
+        [agentJournalSubmissionKey('first')]: 'Your message was not sent.',
+        [agentJournalSubmissionKey('second')]: 'Your message was not sent.',
+        [agentJournalSubmissionKey('other')]:
+          "Claude couldn't start. This chat is still open in a terminal agent. Quit that agent to continue the chat here."
+      })
+    })
+
+    it('keeps the full notice when the rejection is not loaded, or no start row states it', () => {
+      const shown = "Claude couldn't start. Start a new chat to continue."
+      expect(texts([rejected('first', startFailed)], null, [], [startFailed])).toEqual({
+        [agentJournalSubmissionKey('first')]: 'Written by the host.'
+      })
+      expect(
+        texts([rejected('first', startFailed)], null, [recorded('first', startFailed)], [])
+      ).toEqual({ [agentJournalSubmissionKey('first')]: shown })
+    })
+  })
+})
diff --git a/src/renderer/src/components/native-chat/structured-agent-session-delivery-notices.ts b/src/renderer/src/components/native-chat/structured-agent-session-delivery-notices.ts
new file mode 100644
index 00000000000..ec3eb60e687
--- /dev/null
+++ b/src/renderer/src/components/native-chat/structured-agent-session-delivery-notices.ts
@@ -0,0 +1,137 @@
+// Which of the structured chat's own messages say, on their row, that they did not go through.
+//
+// Derived from the outbox on every render and never stored: each failed or held message carries
+// its own typed failure, so each row words its own reason. Read through the drain's own rule: while
+// the queue is stopped, only the message it stopped on has a Retry; another's would wait unseen
+// behind it. One waiting behind says nothing; a rejected message holds nothing up, so it keeps its
+// words and gets its Retry once the queue moves.
+//
+// A message the host recorded and then rejected is worded from the journal's own fact, found by id;
+// the message keeps only a smaller copy, read when its submission is not loaded. A rejection that
+// is a failed start's, the fact its loaded row states, says only that it was not sent: the row
+// already says why.
+
+import {
+  readAgentSessionFailureFact,
+  type AgentSessionFailureFact
+} from '../../../../shared/agent-session-failure'
+import { agentJournalSubmissionKey } from '../../../../shared/agent-session-journal-item-key'
+import type {
+  AgentJournalRenderItem,
+  AgentJournalSubmission
+} from '../../../../shared/agent-session-journal-types'
+import { agentSessionWriteNotDoneParts } from '../../../../shared/agent-session-refusal-notice'
+import { isStructuredAgentSessionStartFailureRow } from '../../../../shared/structured-agent-session-start-failure-row-key'
+import {
+  admitStructuredAgentSessionOutboxEntry,
+  type StructuredAgentSessionOutboxEntry
+} from '../../../../shared/structured-agent-session-outbox'
+import type { AgentSessionFailureWordsContext } from '../../../../shared/agent-session-failure-words'
+import { structuredAgentSessionAttemptFailureParts } from '../../../../shared/structured-agent-session-send-disposition'
+import { translate } from '@/i18n/i18n'
+import { agentSessionWriteNoticeText } from './agent-session-write-notice-text'
+import type { NativeChatDeliveryNotice } from './NativeChatMessageRow'
+
+/** The facts the chat's loaded start-failure rows state. */
+export function structuredAgentSessionStartFailureFacts(
+  items: readonly AgentJournalRenderItem[]
+): AgentSessionFailureFact[] {
+  const facts: AgentSessionFailureFact[] = []
+  for (const item of items) {
+    if (item.body.kind === 'status' && isStructuredAgentSessionStartFailureRow(item.itemId)) {
+      const fact = readAgentSessionFailureFact(item.body.failure)
+      if (fact) {
+        facts.push(fact)
+      }
+    }
+  }
+  return facts
+}
+
+/** Whether two facts are one failure: a start's row and the messages it rejected share one. */
+export function sameAgentSessionFailureFact(
+  a: AgentSessionFailureFact,
+  b: AgentSessionFailureFact
+): boolean {
+  return (
+    a.kind === b.kind &&
+    a.detail?.text === b.detail?.text &&
+    a.detail?.audience === b.detail?.audience &&
+    a.refusal?.code === b.refusal?.code &&
+    a.refusal?.details?.reason === b.refusal?.details?.reason &&
+    a.attachment?.reason === b.attachment?.reason &&
+    a.attachment?.limit === b.attachment?.limit &&
+    a.retry?.error === b.retry?.error &&
+    a.retry?.status === b.retry?.status
+  )
+}
+
+function deliveryNoticeText(
+  entry: StructuredAgentSessionOutboxEntry,
+  context: AgentSessionFailureWordsContext,
+  recorded: AgentJournalSubmission | undefined,
+  startFailures: readonly AgentSessionFailureFact[]
+): string {
+  if (entry.state === 'unconfirmed') {
+    return translate(
+      'auto.components.native.chat.NativeChatStructuredSession.1f772bb5d0',
+      'Message delivery is unconfirmed.'
+    )
+  }
+  if (!entry.lastFailure) {
+    return translate(
+      'auto.components.native.chat.NativeChatStructuredSession.93ef441197',
+      'Message was not sent.'
+    )
+  }
+  const fact = readAgentSessionFailureFact(recorded?.rejection)
+  if (
+    entry.state === 'rejected' &&
+    fact &&
+    startFailures.some((stated) => sameAgentSessionFailureFact(stated, fact))
+  ) {
+    return agentSessionWriteNoticeText(agentSessionWriteNotDoneParts('send'))
+  }
+  return agentSessionWriteNoticeText(
+    structuredAgentSessionAttemptFailureParts(entry.lastFailure, context, fact)
+  )
+}
+
+/** Keyed by the message id the transcript renders each entry under. `blockedClientMessageId` is
+ *  the entry a refusal stopped the queue on; `agentName` is the chat's agent, for the words. */
+export function structuredAgentSessionDeliveryNotices(
+  outbox: readonly StructuredAgentSessionOutboxEntry[],
+  blockedClientMessageId: string | null,
+  agentName: string,
+  retry: (clientMessageId: string) => void,
+  /** The journal's rows, whose rejected ones carry more of a rejection than the message keeps. */
+  submissions: readonly AgentJournalSubmission[],
+  /** What the loaded start-failure rows state, from `structuredAgentSessionStartFailureFacts`. */
+  startFailures: readonly AgentSessionFailureFact[]
+): ReadonlyMap<string, NativeChatDeliveryNotice> {
+  const admission = admitStructuredAgentSessionOutboxEntry(outbox, blockedClientMessageId)
+  const held = admission.state === 'blocked' ? admission.entry.clientMessageId : null
+  const rejected = new Map(
+    submissions
+      .filter((submission) => submission.dispatchState === 'rejected')
+      .map((submission) => [submission.clientMessageId, submission])
+  )
+  const notices = new Map<string, NativeChatDeliveryNotice>()
+  for (const entry of outbox) {
+    if (entry.state === 'rejected' || entry.clientMessageId === held) {
+      // Its own Retry is the step, so the words leave out sending again.
+      const retryControl = held === null || entry.clientMessageId === held
+      const text = deliveryNoticeText(
+        entry,
+        { agentName, retryControl },
+        rejected.get(entry.clientMessageId),
+        startFailures
+      )
+      notices.set(
+        agentJournalSubmissionKey(entry.clientMessageId),
+        retryControl ? { text, onRetry: () => retry(entry.clientMessageId) } : { text }
+      )
+    }
+  }
+  return notices
+}
diff --git a/src/renderer/src/components/native-chat/structured-agent-session-outbox-dispatch.ts b/src/renderer/src/components/native-chat/structured-agent-session-outbox-dispatch.ts
index fc2d5adf150..c42121a2b5c 100644
--- a/src/renderer/src/components/native-chat/structured-agent-session-outbox-dispatch.ts
+++ b/src/renderer/src/components/native-chat/structured-agent-session-outbox-dispatch.ts
@@ -10,6 +10,7 @@ import {
 import type { RuntimeClientTarget } from '@/runtime/runtime-rpc-client'
 import { callStructuredAgentSession } from '@/runtime/structured-agent-session-client'
 import {
+  stageStructuredAgentSessionOutboxEntryForSend,
   structuredAgentSessionSendRequest,
   updateStructuredAgentSessionOutboxEntry,
   type StructuredAgentSessionOutboxEntry
@@ -56,6 +57,18 @@ export function readMountedStructuredAgentSessionOutbox(
   )
 }
 
+/** A send left dispatching when its owner changed goes out again, under the same id. */
+export function requeueInterruptedStructuredAgentSessionDispatches(
+  entries: StructuredAgentSessionOutboxEntry[],
+  fence: number | null
+): StructuredAgentSessionOutboxEntry[] {
+  return entries.map((entry) =>
+    entry.state === 'dispatching' && !hasInFlightLaunchDispatch(entry, fence)
+      ? { ...entry, state: 'queued' as const }
+      : entry
+  )
+}
+
 export function dispatchStructuredAgentSessionOutboxEntry(args: {
   next: StructuredAgentSessionOutboxEntry
   persisted: readonly StructuredAgentSessionOutboxEntry[]
@@ -77,7 +90,7 @@ export function dispatchStructuredAgentSessionOutboxEntry(args: {
     const staged = updateStructuredAgentSessionOutboxEntry(
       args.persisted,
       args.next.clientMessageId,
-      (entry) => ({ ...entry, state: 'dispatching' as const, lastAttemptAt: Date.now() })
+      (entry) => stageStructuredAgentSessionOutboxEntryForSend(entry, Date.now())
     )
     if (!writeOutbox(args.sessionId, staged)) {
       args.inFlightIdRef.current = null
@@ -105,10 +118,17 @@ export function dispatchStructuredAgentSessionOutboxEntry(args: {
           createOperationId: args.createOperationId
         })
       )
-      return result.ok
-        ? result.value.submission.dispatchState === 'accepted' ||
-            result.value.submission.dispatchState === 'pending'
-        : false
+      if (!result.ok) {
+        return false
+      }
+      // A queued answer retired the entry; the queue keeps moving.
+      if ('queued' in result.value) {
+        return true
+      }
+      return (
+        result.value.submission.dispatchState === 'accepted' ||
+        result.value.submission.dispatchState === 'pending'
+      )
     } catch (caught) {
       if (args.dispatchGenerationRef.current !== args.dispatchGeneration) {
         return false
diff --git a/src/renderer/src/components/native-chat/structured-agent-session-outbox-storage.test.ts b/src/renderer/src/components/native-chat/structured-agent-session-outbox-storage.test.ts
index f289feb7c34..9b8b3c537a6 100644
--- a/src/renderer/src/components/native-chat/structured-agent-session-outbox-storage.test.ts
+++ b/src/renderer/src/components/native-chat/structured-agent-session-outbox-storage.test.ts
@@ -1,9 +1,13 @@
 // @vitest-environment happy-dom
 
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { createStructuredAgentSessionOutboxEntry } from '../../../../shared/structured-agent-session-outbox'
+import {
+  createStructuredAgentSessionOutboxEntry,
+  type StructuredAgentSessionAttemptFailure
+} from '../../../../shared/structured-agent-session-outbox'
 import {
   hasUndeliveredStructuredAgentSessionOutbox,
+  readOutbox,
   resetUndeliveredStructuredAgentSessionOutboxForTests,
   subscribeToUndeliveredStructuredAgentSessionOutbox,
   writeOutbox
@@ -103,3 +107,102 @@ describe('undelivered structured agent session outbox projection', () => {
     releaseRemount()
   })
 })
+
+describe("a saved message's last failure", () => {
+  beforeEach(() => {
+    localStorage.clear()
+  })
+
+  it.each<StructuredAgentSessionAttemptFailure>([
+    { kind: 'refused', code: 'agent_session_checkpoint_stale' },
+    { kind: 'refused', code: 'agent_session_conflict', details: { reason: 'chatStarting' } },
+    {
+      kind: 'refused',
+      code: 'agent_session_ownership_unknown',
+      details: { reason: 'ownerUnproven', ownerVerdict: 'unverifiable' }
+    },
+    { kind: 'rejected', reason: 'Claude messages support at most 20 images' },
+    {
+      kind: 'rejected',
+      reason: 'Claude accepts at most 20 images in one message, so this message was not sent.',
+      rejection: { kind: 'attachmentInvalid', attachment: { reason: 'tooMany', limit: 20 } }
+    },
+    { kind: 'rejected', reason: null },
+    { kind: 'failed' }
+  ])('reads back $kind as it was saved', (lastFailure) => {
+    writeOutbox('session-a', [{ ...entry('session-a', 'client-1'), lastFailure }])
+
+    expect(readOutbox('session-a')[0]?.lastFailure).toEqual(lastFailure)
+  })
+
+  it('keeps the message and drops a failure it cannot read', () => {
+    localStorage.setItem(
+      'orca:desktopStructuredAgentSessionOutbox:v1:session-a',
+      JSON.stringify([
+        { ...entry('session-a', 'client-1'), lastFailure: 'The agent was restarting.' },
+        { ...entry('session-a', 'client-2'), lastFailure: { kind: 'rejected', reason: 7 } }
+      ])
+    )
+
+    const read = readOutbox('session-a')
+    expect(read.map((saved) => saved.clientMessageId)).toEqual(['client-1', 'client-2'])
+    expect(read.every((saved) => saved.lastFailure === undefined)).toBe(true)
+  })
+
+  // Written by a build that kept only the code or the reason; it reads as that build meant it.
+  it('reads an entry saved before failures carried details as it was', () => {
+    localStorage.setItem(
+      'orca:desktopStructuredAgentSessionOutbox:v1:session-a',
+      JSON.stringify([
+        {
+          ...entry('session-a', 'client-1'),
+          lastFailure: { kind: 'refused', code: 'agent_session_checkpoint_stale' }
+        },
+        { ...entry('session-a', 'client-2'), lastFailure: { kind: 'rejected', reason: 'Nope.' } }
+      ])
+    )
+
+    expect(readOutbox('session-a').map((saved) => saved.lastFailure)).toEqual([
+      { kind: 'refused', code: 'agent_session_checkpoint_stale' },
+      { kind: 'rejected', reason: 'Nope.' }
+    ])
+  })
+
+  it('keeps only what a newer build saved that this one can place', () => {
+    localStorage.setItem(
+      'orca:desktopStructuredAgentSessionOutbox:v1:session-a',
+      JSON.stringify([
+        {
+          ...entry('session-a', 'client-1'),
+          lastFailure: {
+            kind: 'refused',
+            code: 'agent_session_checkpoint_stale',
+            details: { reason: 'fromTheFuture', currentFence: 4 }
+          }
+        },
+        {
+          ...entry('session-a', 'client-2'),
+          lastFailure: {
+            kind: 'rejected',
+            reason: 'Claude stopped before it finished starting.',
+            rejection: { kind: 'providerStartFailed', detail: { text: 'exit 1', audience: 'log' } }
+          }
+        },
+        {
+          ...entry('session-a', 'client-3'),
+          lastFailure: { kind: 'rejected', reason: 'Nope.', rejection: { kind: 'fromTheFuture' } }
+        }
+      ])
+    )
+
+    expect(readOutbox('session-a').map((saved) => saved.lastFailure)).toEqual([
+      { kind: 'refused', code: 'agent_session_checkpoint_stale' },
+      {
+        kind: 'rejected',
+        reason: 'Claude stopped before it finished starting.',
+        rejection: { kind: 'providerStartFailed' }
+      },
+      { kind: 'rejected', reason: 'Nope.' }
+    ])
+  })
+})
diff --git a/src/renderer/src/components/native-chat/structured-agent-session-outbox-storage.ts b/src/renderer/src/components/native-chat/structured-agent-session-outbox-storage.ts
index b96fb55ea60..8e9bb342638 100644
--- a/src/renderer/src/components/native-chat/structured-agent-session-outbox-storage.ts
+++ b/src/renderer/src/components/native-chat/structured-agent-session-outbox-storage.ts
@@ -4,6 +4,7 @@ import {
   type StructuredAgentSessionOutboxEntry
 } from '../../../../shared/structured-agent-session-outbox'
 import { createStructuredAgentSessionOperationId } from '../../../../shared/structured-agent-session-mutation'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 const OUTBOX_PREFIX = 'orca:desktopStructuredAgentSessionOutbox:v1:'
 
@@ -103,7 +104,7 @@ export function enqueueStructuredAgentSessionLaunchPrompt(
 ): StructuredAgentSessionOutboxEntry | null {
   const entry = {
     ...createStructuredAgentSessionOutboxEntry({
-      clientMessageId: createStructuredAgentSessionOperationId(() => crypto.randomUUID()),
+      clientMessageId: createStructuredAgentSessionOperationId(createBrowserUuid),
       sessionId,
       text,
       attachments: [],
diff --git a/src/renderer/src/components/native-chat/structured-agent-session-read-failure-notice.ts b/src/renderer/src/components/native-chat/structured-agent-session-read-failure-notice.ts
new file mode 100644
index 00000000000..8dee55de82e
--- /dev/null
+++ b/src/renderer/src/components/native-chat/structured-agent-session-read-failure-notice.ts
@@ -0,0 +1,32 @@
+// What the structured chat says when reading its history failed: the notice table's words for the
+// refusal the read met, never the host's message or code.
+
+import {
+  agentSessionReadHistoryRefusalParts,
+  agentSessionWriteNotDoneParts
+} from '../../../../shared/agent-session-refusal-notice'
+import type { AgentSessionRefusalReference } from '../../../../shared/agent-session-wire-refusals'
+import { isFinalAgentSessionReadRefusal } from '../../../../shared/structured-agent-session-read-refusal'
+import { agentSessionWriteNoticeText } from './agent-session-write-notice-text'
+
+export type StructuredAgentSessionReadFailureNotice = {
+  text: string
+  /** The host named the situation, so the words say more than that the history did not load. */
+  named: boolean
+  /** Nothing the read retries gets past it, so the pane no longer says it keeps trying. */
+  final: boolean
+}
+
+export function structuredAgentSessionReadFailureNotice(
+  refusal: AgentSessionRefusalReference | undefined
+): StructuredAgentSessionReadFailureNotice {
+  // The pane reconnects on its own, so it is the Retry beside the words.
+  const parts = refusal
+    ? agentSessionReadHistoryRefusalParts(refusal.code, refusal.details, { retryControl: true })
+    : agentSessionWriteNotDoneParts('read-history')
+  return {
+    text: agentSessionWriteNoticeText(parts),
+    named: refusal?.details?.reason !== undefined,
+    final: isFinalAgentSessionReadRefusal(refusal)
+  }
+}
diff --git a/src/renderer/src/components/native-chat/structured-agent-session-read-owner.ts b/src/renderer/src/components/native-chat/structured-agent-session-read-owner.ts
index 6ec7b38f8b2..e3f87a8e95e 100644
--- a/src/renderer/src/components/native-chat/structured-agent-session-read-owner.ts
+++ b/src/renderer/src/components/native-chat/structured-agent-session-read-owner.ts
@@ -223,7 +223,7 @@ function createReadOwner(
     }
     const transport = startStructuredAgentSessionReadTransport({
       applyEvent: (event) => apply({ type: 'event', event }),
-      applyError: (message) => apply({ type: 'error', message }),
+      applyError: (message, refusal) => apply({ type: 'error', message, refusal }),
       getCursor: () => snapshot.state.cursor,
       onHistoryReadInvalidated: invalidateOlderPages,
       hydrate: snapshot.state.epoch === null ? hydrate : undefined,
diff --git a/src/renderer/src/components/native-chat/structured-agent-session-read-transport.test.ts b/src/renderer/src/components/native-chat/structured-agent-session-read-transport.test.ts
index 5e5be1b6b3b..683676c99d6 100644
--- a/src/renderer/src/components/native-chat/structured-agent-session-read-transport.test.ts
+++ b/src/renderer/src/components/native-chat/structured-agent-session-read-transport.test.ts
@@ -9,12 +9,16 @@ import type {
   AgentSessionSubscribeEvent
 } from '../../../../shared/agent-session-wire'
 
-const mocks = vi.hoisted(() => ({ subscribe: vi.fn() }))
+const mocks = vi.hoisted(() => ({ subscribe: vi.fn(), watchHostContact: vi.fn() }))
 
 vi.mock('@/runtime/structured-agent-session-client', () => ({
   subscribeStructuredAgentSession: mocks.subscribe
 }))
 
+vi.mock('@/runtime/runtime-host-contact-regained', () => ({
+  subscribeRuntimeHostContactRegained: mocks.watchHostContact
+}))
+
 import { startStructuredAgentSessionReadTransport } from './structured-agent-session-read-transport'
 
 type SubscribeAttempt = {
@@ -269,7 +273,7 @@ describe('structured agent-session read transport unattached refusals', () => {
       // ...and the failure is owed once it has passed.
       await vi.advanceTimersByTimeAsync(750)
       attempts.at(-1)?.onError(rpcRefusal(UNATTACHED))
-      expect(applyError).toHaveBeenCalledWith(`RuntimeRpcCallError: ${UNATTACHED}`)
+      expect(applyError).toHaveBeenCalledWith(UNATTACHED)
       transport.dispose()
     } finally {
       vi.useRealTimers()
@@ -284,7 +288,7 @@ describe('structured agent-session read transport unattached refusals', () => {
         throw new Error('journal read failed')
       }, applyError)
       await flushPromises()
-      expect(applyError).toHaveBeenCalledExactlyOnceWith('Error: journal read failed')
+      expect(applyError).toHaveBeenCalledExactlyOnceWith('journal read failed')
       transport.dispose()
     } finally {
       vi.useRealTimers()
@@ -303,7 +307,107 @@ describe('structured agent-session read transport unattached refusals', () => {
       expect(applyError).not.toHaveBeenCalled()
 
       attempts[0].onError({ code: 'runtime_error', message: 'transport died' })
-      expect(applyError).toHaveBeenCalledOnce()
+      // The host's own words, never `[object Object]` (P2-04).
+      expect(applyError).toHaveBeenCalledExactlyOnceWith('transport died')
+      transport.dispose()
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('hands the pane the refusal a read met, and stops reconnecting only past damage', async () => {
+    vi.useFakeTimers()
+    try {
+      const journalRefusal = (reason: string) => ({
+        code: 'runtime_error',
+        message: 'agent_session_journal_unreadable',
+        data: { refusal: { code: 'agent_session_journal_unreadable', details: { reason } } }
+      })
+      const applyError = vi.fn()
+      const transport = startWithHydration(async () => undefined, applyError)
+      await flushPromises()
+      expect(attempts).toHaveLength(1)
+
+      // An open that can clear keeps reconnecting.
+      attempts[0].onError(journalRefusal('journalUnavailable'))
+      attempts[0].closed.resolve({ unsubscribe: attempts[0].unsubscribe })
+      await flushPromises()
+      expect(applyError).toHaveBeenLastCalledWith('agent_session_journal_unreadable', {
+        code: 'agent_session_journal_unreadable',
+        details: { reason: 'journalUnavailable' }
+      })
+      await vi.advanceTimersByTimeAsync(750)
+      expect(attempts).toHaveLength(2)
+
+      // Damage no retry reads past: decided from the reason, not the message, which is the same.
+      attempts[1].onError(journalRefusal('journalCorrupt'))
+      attempts[1].closed.resolve({ unsubscribe: attempts[1].unsubscribe })
+      await flushPromises()
+      expect(applyError).toHaveBeenLastCalledWith('agent_session_journal_unreadable', {
+        code: 'agent_session_journal_unreadable',
+        details: { reason: 'journalCorrupt' }
+      })
+      await vi.advanceTimersByTimeAsync(60_000)
+      expect(attempts).toHaveLength(2)
+      transport.dispose()
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('reads a thrown hydrate refusal the same way, and a new run reads again', async () => {
+    vi.useFakeTimers()
+    try {
+      const corrupt = Object.assign(new Error('agent_session_journal_unreadable'), {
+        response: {
+          error: {
+            code: 'runtime_error',
+            message: 'agent_session_journal_unreadable',
+            data: {
+              refusal: {
+                code: 'agent_session_journal_unreadable',
+                details: { reason: 'journalCorrupt' }
+              }
+            }
+          }
+        }
+      })
+      const hydrate = vi.fn(async () => {
+        throw corrupt
+      })
+      const first = startWithHydration(hydrate, vi.fn())
+      await vi.advanceTimersByTimeAsync(60_000)
+      expect(attempts).toHaveLength(0)
+      first.dispose()
+
+      // Reopening the chat is a new run, which reads again.
+      const second = startWithHydration(hydrate, vi.fn())
+      await flushPromises()
+      expect(hydrate).toHaveBeenCalledTimes(2)
+      second.dispose()
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('re-opens after a failed open and leaves the error once the conversation reads (P2-04)', async () => {
+    vi.useFakeTimers()
+    try {
+      const applyError = vi.fn()
+      const applyEvent = vi.fn()
+      const transport = startWithHydration(async () => undefined, applyError, applyEvent)
+      await flushPromises()
+      attempts[0].onError({ code: 'agent_session_journal_unreadable', message: 'disk full' })
+      attempts[0].closed.resolve({ unsubscribe: attempts[0].unsubscribe })
+      await flushPromises()
+      expect(applyError).toHaveBeenCalledExactlyOnceWith('disk full')
+
+      // The retry re-asks, and the host's open runs again: a fault that cleared now reads.
+      await vi.advanceTimersByTimeAsync(750)
+      expect(attempts).toHaveLength(2)
+      attempts[1].onEvent(snapshot(1))
+      await flushPromises()
+      expect(applyEvent).toHaveBeenCalledWith(expect.objectContaining({ type: 'snapshot' }))
       transport.dispose()
     } finally {
       vi.useRealTimers()
@@ -331,4 +435,128 @@ describe('structured agent-session read transport unattached refusals', () => {
       vi.useRealTimers()
     }
   })
+
+  it('waits twice as long after each failed open, up to 30 s, and starts over once a read lands', async () => {
+    vi.useFakeTimers()
+    try {
+      const unavailable = {
+        code: 'runtime_error',
+        message: 'agent_session_journal_unreadable',
+        data: {
+          refusal: {
+            code: 'agent_session_journal_unreadable',
+            details: { reason: 'journalUnavailable' }
+          }
+        }
+      }
+      const transport = startWithHydration(async () => undefined, vi.fn())
+      await flushPromises()
+      // As a local subscribe does: the open resolves, then the host's refusal arrives.
+      const refuseLatest = async (): Promise<void> => {
+        const attempt = attempts.at(-1)!
+        attempt.closed.resolve({ unsubscribe: attempt.unsubscribe })
+        await flushPromises()
+        attempt.onError(unavailable)
+      }
+      const expectReopenAfter = async (delay: number): Promise<void> => {
+        const opened = attempts.length
+        await vi.advanceTimersByTimeAsync(delay - 1)
+        expect(attempts).toHaveLength(opened)
+        await vi.advanceTimersByTimeAsync(1)
+        expect(attempts).toHaveLength(opened + 1)
+      }
+
+      for (const delay of [750, 1_500, 3_000, 6_000, 12_000, 24_000, 30_000, 30_000]) {
+        await refuseLatest()
+        await expectReopenAfter(delay)
+      }
+
+      // A read that delivers is the success the next failure starts over from.
+      attempts.at(-1)!.closed.resolve({ unsubscribe: attempts.at(-1)!.unsubscribe })
+      await flushPromises()
+      attempts.at(-1)!.onEvent(snapshot(1))
+      attempts.at(-1)!.onError(unavailable)
+      await expectReopenAfter(750)
+      await refuseLatest()
+      await expectReopenAfter(1_500)
+
+      // Damage still ends reconnecting, however far the wait has grown.
+      const latest = attempts.at(-1)!
+      latest.closed.resolve({ unsubscribe: latest.unsubscribe })
+      await flushPromises()
+      latest.onError({
+        ...unavailable,
+        data: {
+          refusal: {
+            code: 'agent_session_journal_unreadable',
+            details: { reason: 'journalCorrupt' }
+          }
+        }
+      })
+      const opened = attempts.length
+      await vi.advanceTimersByTimeAsync(120_000)
+      expect(attempts).toHaveLength(opened)
+      transport.dispose()
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('reads again as soon as a remote host is reachable, not after the grown wait', async () => {
+    vi.useFakeTimers()
+    try {
+      let hostContactRegained = (): void => {}
+      const stopWatch = vi.fn()
+      mocks.watchHostContact.mockImplementation((_environmentId, listener: () => void) => {
+        hostContactRegained = listener
+        return stopWatch
+      })
+      const unavailable = { code: 'runtime_unavailable', message: 'Remote runtime is unavailable.' }
+      const transport = startStructuredAgentSessionReadTransport({
+        applyEvent: vi.fn(),
+        applyError: vi.fn(),
+        getCursor: () => null,
+        onHistoryReadInvalidated: () => undefined,
+        hydrate: async () => undefined,
+        sessionId: 'session-a',
+        target: { kind: 'environment', environmentId: 'env-a' }
+      })
+      expect(mocks.watchHostContact).toHaveBeenCalledWith('env-a', expect.any(Function))
+      await flushPromises()
+      const refuseLatest = async (): Promise<void> => {
+        const attempt = attempts.at(-1)!
+        attempt.closed.resolve({ unsubscribe: attempt.unsubscribe })
+        await flushPromises()
+        attempt.onError(unavailable)
+      }
+      // An outage long enough that the wait reaches its cap.
+      for (const delay of [750, 1_500, 3_000, 6_000, 12_000, 24_000]) {
+        await refuseLatest()
+        await vi.advanceTimersByTimeAsync(delay)
+      }
+      await refuseLatest()
+      const opened = attempts.length
+      await vi.advanceTimersByTimeAsync(29_000)
+      expect(attempts).toHaveLength(opened)
+
+      hostContactRegained()
+      await vi.advanceTimersByTimeAsync(0)
+      expect(attempts).toHaveLength(opened + 1)
+
+      // The wait starts over too, so a failure right after reconnect is retried soon.
+      await refuseLatest()
+      await vi.advanceTimersByTimeAsync(750)
+      expect(attempts).toHaveLength(opened + 2)
+
+      transport.dispose()
+      expect(stopWatch).toHaveBeenCalledTimes(1)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('does not watch host contact for a local read', () => {
+    startWithHydration(async () => undefined, vi.fn()).dispose()
+    expect(mocks.watchHostContact).not.toHaveBeenCalled()
+  })
 })
diff --git a/src/renderer/src/components/native-chat/structured-agent-session-read-transport.ts b/src/renderer/src/components/native-chat/structured-agent-session-read-transport.ts
index f4310cec890..a0a693e92a9 100644
--- a/src/renderer/src/components/native-chat/structured-agent-session-read-transport.ts
+++ b/src/renderer/src/components/native-chat/structured-agent-session-read-transport.ts
@@ -3,18 +3,48 @@ import type { AgentSessionSubscribeEvent } from '../../../../shared/agent-sessio
 import { createStructuredAgentSessionEventCoalescer } from '../../../../shared/structured-agent-session-coalescer'
 import {
   AGENT_SESSION_UNATTACHED_READ_GRACE_MS,
+  isFinalAgentSessionReadRefusal,
   isUnattachedAgentSessionReadRefusal
 } from '../../../../shared/structured-agent-session-read-refusal'
+import type { AgentSessionRefusalReference } from '../../../../shared/agent-session-wire-refusals'
+import { readAgentSessionErrorRefusal } from '../../../../shared/agent-session-write-failure'
+import { subscribeRuntimeHostContactRegained } from '@/runtime/runtime-host-contact-regained'
 import type { RuntimeClientTarget } from '@/runtime/runtime-rpc-client'
 import { subscribeStructuredAgentSession } from '@/runtime/structured-agent-session-client'
 
+// A stream hands its failure over as the raw `{ code, message }` payload; `String()` of that is `[object Object]`.
+function readFailureText(error: unknown): string {
+  if (error instanceof Error) {
+    return error.message || 'Something went wrong.'
+  }
+  if (typeof error === 'string') {
+    return error || 'Something went wrong.'
+  }
+  if (typeof error === 'object' && error !== null) {
+    if ('message' in error && typeof error.message === 'string' && error.message.length > 0) {
+      return error.message
+    }
+    if ('code' in error && typeof error.code === 'string' && error.code.length > 0) {
+      return error.code
+    }
+  }
+  return 'Something went wrong.'
+}
+
+const RECONNECT_FIRST_DELAY_MS = 750
+const RECONNECT_MAX_DELAY_MS = 30_000
+
+/** Each reconnect waits twice the last, up to the cap, until a read delivers. */
 function createReconnectScheduler(args: { shouldStop: () => boolean; reconnect: () => void }) {
   let timer: ReturnType<typeof setTimeout> | null = null
+  let nextDelay = RECONNECT_FIRST_DELAY_MS
   return {
-    schedule(delay = 750): void {
+    schedule(): void {
       if (args.shouldStop() || timer) {
         return
       }
+      const delay = nextDelay
+      nextDelay = Math.min(delay * 2, RECONNECT_MAX_DELAY_MS)
       timer = setTimeout(() => {
         timer = null
         if (!args.shouldStop()) {
@@ -22,6 +52,22 @@ function createReconnectScheduler(args: { shouldStop: () => boolean; reconnect:
         }
       }, delay)
     },
+    /** A read delivered, so the next failure is retried soon again. */
+    reset(): void {
+      nextDelay = RECONNECT_FIRST_DELAY_MS
+    },
+    /** The host is reachable again: a waiting retry runs now instead of after the grown wait. */
+    retryNow(): void {
+      nextDelay = RECONNECT_FIRST_DELAY_MS
+      if (!timer) {
+        return
+      }
+      clearTimeout(timer)
+      timer = null
+      if (!args.shouldStop()) {
+        args.reconnect()
+      }
+    },
     dispose(): void {
       if (timer) {
         clearTimeout(timer)
@@ -33,7 +79,8 @@ function createReconnectScheduler(args: { shouldStop: () => boolean; reconnect:
 
 export function startStructuredAgentSessionReadTransport(args: {
   applyEvent: (event: AgentSessionSubscribeEvent) => void
-  applyError: (message: string) => void
+  /** `message` is the failure's own text, for logs; `refusal` is what a surface words. */
+  applyError: (message: string, refusal?: AgentSessionRefusalReference) => void
   getCursor: () => AgentJournalCursor | null
   onHistoryReadInvalidated: () => void
   hydrate?: (shouldStop: () => boolean) => Promise<void>
@@ -45,6 +92,8 @@ export function startStructuredAgentSessionReadTransport(args: {
 } {
   let stopped = false
   let connected = false
+  // A refusal no retry reads past ends reconnecting for this run; reopening the chat starts another.
+  let failedFinally = false
   let unattachedSince: number | null = null
   let opening = false
   let openGeneration = 0
@@ -57,9 +106,16 @@ export function startStructuredAgentSessionReadTransport(args: {
     }
   })
   const reconnectScheduler = createReconnectScheduler({
-    shouldStop: () => stopped || connected,
+    shouldStop: () => stopped || connected || failedFinally,
     reconnect: () => void open()
   })
+  // Why: an outage grows the retry wait to its cap; a host that is back should not wait it out.
+  const stopHostContactWatch =
+    args.target.kind === 'environment'
+      ? subscribeRuntimeHostContactRegained(args.target.environmentId, () =>
+          reconnectScheduler.retryNow()
+        )
+      : () => {}
   const isCurrentOpenGeneration = (candidate: number): boolean =>
     !stopped && candidate === openGeneration
   const clearUnattachedReadGrace = (): void => {
@@ -69,23 +125,32 @@ export function startStructuredAgentSessionReadTransport(args: {
    * A read failure, reported to the pane only once it is one.
    *
    * A refusal saying this host holds no attached session is the retry loop's own subject, not a
-   * verdict: the reconnect below re-asks, and either the hold that attaches the session or the tab
-   * retirement that ends the pane resolves it. Painting the pane red inside that window turned an
+   * verdict: the reconnect below re-asks, and either the host opening the session or the tab
+   * retirement that ends the pane resolves it. Only an older host still refuses this way. Painting the pane red inside that window turned an
    * ordinary chat close into a `Could not load conversation` the user could do nothing about.
    *
    * A window, not a mute. An unattached read still refusing past the grace is no longer
    * transitional, so the pane is owed the failure rather than a spinner that never resolves.
    */
+  const applyReadFailure = (error: unknown): void => {
+    const refusal = readAgentSessionErrorRefusal(error)
+    failedFinally = isFinalAgentSessionReadRefusal(refusal)
+    if (refusal) {
+      args.applyError(readFailureText(error), refusal)
+    } else {
+      args.applyError(readFailureText(error))
+    }
+  }
   const reportReadFailure = (error: unknown): void => {
     if (!isUnattachedAgentSessionReadRefusal(error)) {
       clearUnattachedReadGrace()
-      args.applyError(String(error))
+      applyReadFailure(error)
       return
     }
     const now = Date.now()
     unattachedSince ??= now
     if (now - unattachedSince >= AGENT_SESSION_UNATTACHED_READ_GRACE_MS) {
-      args.applyError(String(error))
+      applyReadFailure(error)
     }
   }
   const captureHistoryReadGuard = (): (() => boolean) => {
@@ -99,6 +164,10 @@ export function startStructuredAgentSessionReadTransport(args: {
       return
     }
     clearUnattachedReadGrace()
+    // Not on connect: a local subscribe resolves before the host's open refuses.
+    if (event.type !== 'end') {
+      reconnectScheduler.reset()
+    }
     if (event.type === 'snapshot' || event.type === 'reset') {
       coalescer.flush()
       if (!isCurrentOpenGeneration(eventOpenGeneration)) {
@@ -210,6 +279,7 @@ export function startStructuredAgentSessionReadTransport(args: {
       stopped = true
       openGeneration += 1
       args.onHistoryReadInvalidated()
+      stopHostContactWatch()
       reconnectScheduler.dispose()
       coalescer.dispose()
       unsubscribe()
diff --git a/src/renderer/src/components/native-chat/structured-agent-session-transcript-order.test.ts b/src/renderer/src/components/native-chat/structured-agent-session-transcript-order.test.ts
new file mode 100644
index 00000000000..ea9b3a0cf3b
--- /dev/null
+++ b/src/renderer/src/components/native-chat/structured-agent-session-transcript-order.test.ts
@@ -0,0 +1,130 @@
+import { describe, expect, it } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalRenderItem,
+  AgentJournalSubmission
+} from '../../../../shared/agent-session-journal-types'
+import { projectAgentSessionConversationOutline } from '../../../../shared/agent-session-conversation-outline'
+import { agentJournalSubmissionKey } from '../../../../shared/agent-session-journal-item-key'
+import {
+  createStructuredAgentSessionOutboxEntry,
+  type StructuredAgentSessionOutboxEntry
+} from '../../../../shared/structured-agent-session-outbox'
+import { createNativeChatMessageListProjection } from './native-chat-message-list-projection'
+import { projectStructuredAgentSessionMessages } from './structured-agent-session-message-projection'
+
+function journalItem(
+  itemId: string,
+  sequence: number,
+  observedAt: number,
+  body: AgentJournalItemBody,
+  extra: Partial<AgentJournalRenderItem> = {}
+): AgentJournalRenderItem {
+  return { itemId, revision: 1, sequence, observedAt, body, ...extra }
+}
+
+function said(role: 'user' | 'assistant', text: string): AgentJournalItemBody {
+  return { kind: 'message', role, blocks: [{ type: 'text', text }] }
+}
+
+function answered(question: string): AgentJournalItemBody {
+  return {
+    kind: 'question',
+    question,
+    options: [{ id: 'yes', label: 'Yes' }],
+    resolution: { state: 'resolved', selectedOptionId: 'yes', resolvedBy: 'client', resolvedAt: 9 }
+  }
+}
+
+/** The ids the desktop transcript list draws, top to bottom. */
+function drawn(
+  items: AgentJournalRenderItem[],
+  outbox: StructuredAgentSessionOutboxEntry[] = [],
+  submissions: AgentJournalSubmission[] = []
+): string[] {
+  return createNativeChatMessageListProjection()(
+    projectStructuredAgentSessionMessages(items, outbox, submissions)
+  ).map(({ id }) => id)
+}
+
+function queued(clientMessageId: string, text: string, queuedAt: number) {
+  return createStructuredAgentSessionOutboxEntry({
+    clientMessageId,
+    sessionId: 'session',
+    text,
+    attachments: [],
+    queuedAt
+  })
+}
+
+describe('structured transcript order', () => {
+  it('draws a row recovered after a crash at its journal position, not its earlier clock', () => {
+    // The provider logged the last prompt before the crash; the host journalled it on recovery.
+    const items = [
+      journalItem('ask', 1, 100, said('user', 'Fix the parser')),
+      journalItem('reply', 2, 300, said('assistant', 'Working on it')),
+      journalItem('steer', 3, 310, said('user', 'Keep the old API')),
+      journalItem('recovered', 4, 200, said('user', 'Also add a test'), {
+        recovered: true,
+        recoveredAt: 400
+      })
+    ]
+    expect(drawn(items)).toEqual(['ask', 'reply', 'steer', 'recovered'])
+    // The host's outline, published to every client, uses the same order.
+    expect(projectAgentSessionConversationOutline(items, []).map(({ itemId }) => itemId)).toEqual([
+      'ask',
+      'steer',
+      'recovered'
+    ])
+  })
+
+  it("draws one write's questions by their place in it, whatever order they arrive in", () => {
+    // One Codex ask: a single journal write, one sequence and one timestamp. Neither
+    // the ids nor the arrival order below spell the order it was asked in.
+    const scope = journalItem('q:scope', 5, 500, answered('Which files?'))
+    const priority = journalItem('q:priority', 5, 500, answered('What matters?'), {
+      sequenceIndex: 1
+    })
+    const deadline = journalItem('q:deadline', 5, 500, answered('When?'), { sequenceIndex: 2 })
+    expect(drawn([priority, deadline, scope])).toEqual(['q:scope', 'q:priority', 'q:deadline'])
+  })
+
+  it('keeps a send the journal does not hold yet below every row it does', () => {
+    // The composer's clock can trail the host's; the unsent message still reads last.
+    const outbox = [queued('queued', 'One more thing', 150)]
+    const items = [
+      journalItem('ask', 1, 100, said('user', 'Fix the parser')),
+      journalItem('reply', 2, 200, said('assistant', 'Working on it'))
+    ]
+    expect(drawn(items, outbox)).toEqual(['ask', 'reply', agentJournalSubmissionKey('queued')])
+  })
+
+  it('keeps a send the journal recorded and the provider refused at its journal place', () => {
+    // The agent kept writing after the refused steer; its Retry stays with the composer.
+    const refused = agentJournalSubmissionKey('steer')
+    const items = [
+      journalItem('ask', 1, 100, said('user', 'Fix the parser')),
+      journalItem(refused, 2, 200, said('user', 'Keep the old API')),
+      journalItem('reply', 3, 300, said('assistant', 'Done.'))
+    ]
+    const submissions: AgentJournalSubmission[] = [
+      {
+        clientMessageId: 'steer',
+        fence: 1,
+        payloadFingerprint: 'fingerprint',
+        dispatchState: 'rejected',
+        providerItemId: null,
+        reason: 'provider_refused',
+        submittedAt: 200,
+        resolvedAt: 250
+      }
+    ]
+    expect(
+      drawn(
+        items,
+        [queued('steer', 'Keep the old API', 190), queued('next', 'And docs', 400)],
+        submissions
+      )
+    ).toEqual(['ask', refused, 'reply', agentJournalSubmissionKey('next')])
+  })
+})
diff --git a/src/renderer/src/components/native-chat/structured-agent-session-withdrawn-message-restore.test.tsx b/src/renderer/src/components/native-chat/structured-agent-session-withdrawn-message-restore.test.tsx
new file mode 100644
index 00000000000..150b520bcd3
--- /dev/null
+++ b/src/renderer/src/components/native-chat/structured-agent-session-withdrawn-message-restore.test.tsx
@@ -0,0 +1,475 @@
+// A message a Stop withdrew never ran, and nothing sends it again. Its sender gets the text and
+// images back in the composer, once, after whatever is typed there.
+
+// @vitest-environment happy-dom
+
+import { act, cleanup, renderHook, waitFor } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type {
+  AgentJournalRenderItem,
+  AgentJournalSubmission
+} from '../../../../shared/agent-session-journal-types'
+import {
+  DISPATCH_REJECTED_CANCELLED,
+  DISPATCH_REJECTED_WRITE_FAILED
+} from '../../../../shared/structured-agent-session-dispatch-rejection'
+
+type SendParams = { envelope?: { clientOperationId: string } }
+type ReadState = { submissions: AgentJournalSubmission[]; items: AgentJournalRenderItem[] }
+
+const mocks = vi.hoisted(() => {
+  const read: ReadState = { submissions: [], items: [] }
+  return {
+    call: vi.fn<(target: unknown, method: string, params: SendParams) => Promise<unknown>>(),
+    toastError: vi.fn(),
+    read
+  }
+})
+
+vi.mock('@/runtime/structured-agent-session-client', () => ({
+  callStructuredAgentSession: mocks.call,
+  supportsStructuredAgentSessionPromptCancel: vi.fn(async () => false)
+}))
+
+vi.mock('./use-structured-agent-session-read', () => ({
+  useStructuredAgentSessionRead: () => ({
+    state: {
+      fence: 1,
+      items: mocks.read.items,
+      submissions: mocks.read.submissions,
+      status: 'ready',
+      error: null,
+      hasOlder: false
+    },
+    loadingOlder: false,
+    loadOlder: vi.fn()
+  })
+}))
+
+vi.mock('sonner', () => ({ toast: { error: mocks.toastError } }))
+
+import {
+  AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
+  AGENT_SESSION_CONVERSATION_STOP_RUNTIME_CAPABILITY
+} from '../../../../shared/protocol-version'
+import { setLocalRuntimeCapabilitiesForTests } from '@/runtime/local-runtime-capabilities'
+import {
+  appendNativeChatDraftCache,
+  clearNativeChatDraftCacheForTests,
+  readNativeChatDraftCache,
+  subscribeToNativeChatDraftAppend,
+  writeNativeChatDraftCache
+} from './native-chat-draft-cache'
+import {
+  appendNativeChatAttachmentCache,
+  clearNativeChatAttachmentCacheForTests,
+  readNativeChatAttachmentCache,
+  useNativeChatComposerAttachments
+} from './use-native-chat-composer-attachments'
+import { useNativeChatDraft } from './use-native-chat-draft'
+import {
+  enqueueStructuredAgentSessionLaunchPrompt,
+  readOutbox,
+  writeOutbox
+} from './structured-agent-session-outbox-storage'
+import { useStructuredAgentSessionOutbox } from './use-structured-agent-session-outbox'
+import { useStructuredAgentSession } from './use-structured-agent-session'
+
+const SESSION = 'session-1'
+const PANE = 'tab-1::session-1'
+const OTHER_PANE = 'tab-2::session-1'
+const target = { kind: 'local' } as const
+const NONE: AgentJournalSubmission[] = []
+
+function submission(
+  clientMessageId: string,
+  overrides: Partial<AgentJournalSubmission> = {}
+): AgentJournalSubmission {
+  return {
+    clientMessageId,
+    fence: 1,
+    payloadFingerprint: 'fingerprint',
+    dispatchState: 'pending',
+    providerItemId: null,
+    reason: null,
+    submittedAt: 10,
+    resolvedAt: null,
+    handoverRecorded: true,
+    ...overrides
+  }
+}
+
+function withdrawn(
+  clientMessageId: string,
+  overrides: Partial<AgentJournalSubmission> = {}
+): AgentJournalSubmission {
+  return submission(clientMessageId, {
+    dispatchState: 'rejected',
+    reason: DISPATCH_REJECTED_CANCELLED,
+    resolvedAt: 11,
+    ...overrides
+  })
+}
+
+function answerSendsPending(): void {
+  mocks.call.mockImplementation(async (_target, method, params) => {
+    if (method !== 'agentSession.send') {
+      return null
+    }
+    const id = params.envelope?.clientOperationId ?? ''
+    return {
+      ok: true,
+      replayed: false,
+      fence: 1,
+      cursor: { epoch: 'epoch-1', sequence: 2 },
+      value: { clientMessageId: id, submission: submission(id) }
+    }
+  })
+}
+
+function renderOutbox(composerScopeKey: string | null = PANE) {
+  return renderHook(
+    (props: { submissions: AgentJournalSubmission[] }) =>
+      useStructuredAgentSessionOutbox({
+        sessionId: SESSION,
+        target,
+        fence: 1,
+        submissions: props.submissions,
+        ...(composerScopeKey ? { composerScopeKey } : {})
+      }),
+    { initialProps: { submissions: NONE } }
+  )
+}
+
+async function sendToHost(
+  result: { current: ReturnType<typeof useStructuredAgentSessionOutbox> },
+  text: string,
+  attachments: { path: string; previewUri: string }[] = []
+): Promise<string> {
+  act(() => expect(result.current.send(text, attachments)).toBe(true))
+  await waitFor(() => expect(result.current.outbox.at(-1)?.state).toBe('dispatching'))
+  return result.current.outbox.at(-1)!.clientMessageId
+}
+
+function occurrences(text: string, of: string): number {
+  return text.split(of).length - 1
+}
+
+afterEach(() => {
+  cleanup()
+  setLocalRuntimeCapabilitiesForTests(null)
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  localStorage.clear()
+  clearNativeChatDraftCacheForTests()
+  clearNativeChatAttachmentCacheForTests()
+  mocks.read.submissions = []
+  mocks.read.items = []
+  let uuid = 0
+  vi.spyOn(globalThis.crypto, 'randomUUID').mockImplementation(() => {
+    uuid += 1
+    return `11111111-1111-4111-8111-${uuid.toString(16).padStart(12, '0')}`
+  })
+})
+
+describe('a message the host withdrew at a Stop', () => {
+  it.each([
+    ['a Stop during the start withdrew it from the host queue', {}],
+    ['Claude cancelled it as a queued follow-up', { handedOverAt: 12 }]
+  ])(
+    'comes back to the composer with its images, after the draft, when %s',
+    async (_case, handover) => {
+      answerSendsPending()
+      writeNativeChatDraftCache(PANE, 'already typed')
+      appendNativeChatAttachmentCache(PANE, [{ id: 'typed', path: '/tmp/typed.png' }])
+      const { result, rerender } = renderOutbox()
+      const id = await sendToHost(result, 'hello', [
+        { path: '/tmp/shot.png', previewUri: '/tmp/shot.png' }
+      ])
+      rerender({ submissions: [submission(id, handover)] })
+
+      rerender({ submissions: [withdrawn(id, handover)] })
+
+      await waitFor(() => expect(result.current.outbox).toEqual([]))
+      expect(readNativeChatDraftCache(PANE)).toBe('already typed\n\nhello')
+      expect(readNativeChatAttachmentCache(PANE)).toEqual([
+        { id: 'typed', path: '/tmp/typed.png' },
+        { id: expect.any(String), path: '/tmp/shot.png' }
+      ])
+    }
+  )
+
+  it('comes back when the host wrote the withdrawal as a typed fact in a sentence', async () => {
+    answerSendsPending()
+    const { result, rerender } = renderOutbox()
+    const id = await sendToHost(result, 'hello')
+
+    rerender({
+      submissions: [
+        withdrawn(id, {
+          reason: 'This message was withdrawn before the agent started it.',
+          rejection: { kind: 'cancelled' }
+        })
+      ]
+    })
+
+    await waitFor(() => expect(result.current.outbox).toEqual([]))
+    expect(readNativeChatDraftCache(PANE)).toBe('hello')
+  })
+
+  it('comes back once, whatever replays the journal or shows the chat again', async () => {
+    answerSendsPending()
+    const first = renderOutbox()
+    const id = await sendToHost(first.result, 'hello')
+    // A second view of the same chat in this window reads the same outbox.
+    const second = renderOutbox(OTHER_PANE)
+
+    first.rerender({ submissions: [withdrawn(id)] })
+    second.rerender({ submissions: [withdrawn(id)] })
+    // A replayed snapshot, then a reconnect remounting the view.
+    first.rerender({ submissions: [{ ...withdrawn(id) }] })
+    first.unmount()
+    renderOutbox().rerender({ submissions: [withdrawn(id)] })
+
+    await waitFor(() => expect(readOutbox(SESSION)).toEqual([]))
+    const restored = readNativeChatDraftCache(PANE) + readNativeChatDraftCache(OTHER_PANE)
+    expect(occurrences(restored, 'hello')).toBe(1)
+  })
+
+  it('is back in the composer before it leaves storage, so a crash between repeats it', async () => {
+    answerSendsPending()
+    const { result, rerender } = renderOutbox()
+    const id = await sendToHost(result, 'hello')
+    let storedAtRestore: string[] = []
+    const unsubscribe = subscribeToNativeChatDraftAppend(PANE, () => {
+      storedAtRestore = readOutbox(SESSION).map((entry) => entry.clientMessageId)
+    })
+    const beforeDrop = readOutbox(SESSION, { recoverDispatching: false })
+
+    rerender({ submissions: [withdrawn(id)] })
+    unsubscribe()
+
+    expect(storedAtRestore).toEqual([id])
+    // The drop never reached storage: the next mount gives the text back again rather than losing it.
+    cleanup()
+    writeOutbox(SESSION, beforeDrop)
+    renderOutbox().rerender({ submissions: [withdrawn(id)] })
+    expect(readNativeChatDraftCache(PANE)).toBe('hello\n\nhello')
+  })
+
+  it('keeps a message refused for any other reason on its Retry, and gives nothing back', async () => {
+    answerSendsPending()
+    const { result, rerender } = renderOutbox()
+    const id = await sendToHost(result, 'hello')
+
+    rerender({
+      submissions: [
+        submission(id, { dispatchState: 'rejected', reason: DISPATCH_REJECTED_WRITE_FAILED })
+      ]
+    })
+
+    await waitFor(() => expect(result.current.outbox[0]?.state).toBe('rejected'))
+    expect(readNativeChatDraftCache(PANE)).toBe('')
+  })
+
+  it('drops a withdrawn launch prompt where no composer shows the chat', () => {
+    const launch = enqueueStructuredAgentSessionLaunchPrompt(SESSION, 'launch text')!
+    const { result, rerender } = renderOutbox(null)
+
+    expect(() => rerender({ submissions: [withdrawn(launch.clientMessageId)] })).not.toThrow()
+
+    expect(result.current.outbox).toEqual([])
+    expect(readOutbox(SESSION)).toEqual([])
+    expect(readNativeChatDraftCache(PANE)).toBe('')
+  })
+})
+
+describe('a message a Stop took out of the outbox before the host held it', () => {
+  it('comes back to the composer when the Stop follows the send at once', async () => {
+    mocks.call.mockImplementation(() => new Promise<never>(() => {}))
+    const { result } = renderOutbox()
+    act(() => expect(result.current.send('first')).toBe(true))
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(1))
+    act(() => expect(result.current.send('second')).toBe(true))
+
+    act(() => result.current.withdrawUnsent())
+
+    expect(result.current.outbox.map((entry) => entry.body.blocks)).toEqual([
+      [{ type: 'text', text: 'first' }]
+    ])
+    expect(readNativeChatDraftCache(PANE)).toBe('second')
+  })
+
+  it('gives back a send already on its way only when the host withdraws it', async () => {
+    answerSendsPending()
+    const reply = Promise.withResolvers<void>()
+    const answer = mocks.call.getMockImplementation()!
+    mocks.call.mockImplementationOnce(async (...args) => {
+      await reply.promise
+      return answer(...args)
+    })
+    const { result, rerender } = renderOutbox()
+    act(() => expect(result.current.send('hello')).toBe(true))
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(1))
+    const id = result.current.outbox[0]!.clientMessageId
+
+    act(() => result.current.withdrawUnsent())
+    // It lands ahead of the Stop and reads as sent, not as back in the composer.
+    await act(async () => reply.resolve())
+    rerender({ submissions: [submission(id)] })
+    expect(readNativeChatDraftCache(PANE)).toBe('')
+    expect(result.current.outbox.map((entry) => entry.clientMessageId)).toEqual([id])
+
+    rerender({ submissions: [withdrawn(id)] })
+
+    await waitFor(() => expect(result.current.outbox).toEqual([]))
+    expect(readNativeChatDraftCache(PANE)).toBe('hello')
+  })
+
+  it('leaves a message waiting on Retry where it is, and gives back only what it withdrew', async () => {
+    writeOutbox(SESSION, [
+      {
+        clientMessageId: 'refused-1',
+        sessionId: SESSION,
+        body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'refused' }] },
+        previewUris: [],
+        state: 'rejected',
+        queuedAt: 1,
+        lastAttemptAt: null,
+        retryAfterUnknownSubmittedAt: null
+      }
+    ])
+    mocks.call.mockImplementation(() => new Promise<never>(() => {}))
+    const { result } = renderOutbox()
+    act(() => expect(result.current.send('second')).toBe(true))
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(1))
+    act(() => expect(result.current.send('third')).toBe(true))
+    const onItsWay = result.current.outbox[1]!.clientMessageId
+
+    act(() => result.current.withdrawUnsent())
+
+    expect(result.current.outbox.map((entry) => entry.clientMessageId)).toEqual([
+      'refused-1',
+      onItsWay
+    ])
+    expect(readNativeChatDraftCache(PANE)).toBe('third')
+  })
+})
+
+describe('Stop through the chat', () => {
+  beforeEach(() => {
+    setLocalRuntimeCapabilitiesForTests([
+      AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
+      AGENT_SESSION_CONVERSATION_STOP_RUNTIME_CAPABILITY
+    ])
+    writeOutbox(SESSION, [
+      {
+        clientMessageId: 'queued-1',
+        sessionId: SESSION,
+        body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
+        previewUris: [],
+        state: 'dispatching',
+        queuedAt: 1,
+        lastAttemptAt: 1,
+        retryAfterUnknownSubmittedAt: null
+      }
+    ])
+    mocks.read.submissions = [submission('queued-1')]
+  })
+
+  function renderChat() {
+    return renderHook(() =>
+      useStructuredAgentSession({
+        sessionId: SESSION,
+        agent: 'claude',
+        target,
+        isVisible: true,
+        composerScopeKey: PANE
+      })
+    )
+  }
+
+  it('gives back what the host withdrew into the pane that pressed it', async () => {
+    mocks.call.mockImplementation(async (_target, method) =>
+      method === 'agentSession.cancel' ? { ok: true, value: { cancelled: true } } : null
+    )
+    const { result, rerender } = renderChat()
+
+    await act(async () => {
+      await result.current.stop()
+    })
+    mocks.read.submissions = [withdrawn('queued-1')]
+    rerender()
+
+    await waitFor(() => expect(result.current.outbox).toEqual([]))
+    expect(readNativeChatDraftCache(PANE)).toBe('hello')
+  })
+
+  it('says a failed Stop in a toast and gives nothing back', async () => {
+    mocks.call.mockImplementation(async (_target, method) =>
+      method === 'agentSession.cancel'
+        ? { ok: false, refusal: { code: 'agent_session_not_found', message: 'Gone.' } }
+        : null
+    )
+    const { result, rerender } = renderChat()
+
+    await act(async () => {
+      await result.current.stop()
+    })
+    rerender()
+
+    expect(mocks.toastError).toHaveBeenCalledOnce()
+    expect(readNativeChatDraftCache(PANE)).toBe('')
+    expect(result.current.outbox.map((entry) => entry.clientMessageId)).toEqual(['queued-1'])
+  })
+})
+
+const notComposing = (): boolean => false
+
+describe('an open composer', () => {
+  it('shows text put back while it is open, after what is typed', () => {
+    const { result } = renderHook(() => useNativeChatDraft(PANE, notComposing))
+    act(() => result.current.setDraft('typed'))
+
+    act(() => appendNativeChatDraftCache(PANE, 'hello'))
+
+    expect(result.current.draft).toBe('typed\n\nhello')
+  })
+
+  it('keeps text put back mid-composition through the composed writes, even if it unmounts', () => {
+    const { result, unmount } = renderHook(() => useNativeChatDraft(PANE, () => true))
+    act(() => appendNativeChatDraftCache(PANE, 'hello'))
+    act(() => result.current.setDraft('typed'))
+
+    expect(result.current.draft).toBe('typed')
+    unmount()
+    expect(readNativeChatDraftCache(PANE)).toBe('typed\n\nhello')
+  })
+
+  it('shows images put back while it is open, beside the ones attached', () => {
+    const { result } = renderHook(() =>
+      useNativeChatComposerAttachments({
+        attachmentScopeKey: PANE,
+        allowWithoutTarget: true,
+        caret: 0,
+        disabled: false,
+        isComposing: () => false,
+        resolveTarget: () => null,
+        textareaRef: { current: null },
+        setCaret: () => {},
+        setDraft: () => {},
+        setNotice: () => {}
+      })
+    )
+    act(() => result.current.attachResolvedPaths(['/tmp/typed.png']))
+
+    act(() => appendNativeChatAttachmentCache(PANE, [{ id: 'restored', path: '/tmp/shot.png' }]))
+
+    expect(result.current.imageAttachments.map((attachment) => attachment.path)).toEqual([
+      '/tmp/typed.png',
+      '/tmp/shot.png'
+    ])
+  })
+})
diff --git a/src/renderer/src/components/native-chat/structured-agent-session-withdrawn-message-restore.ts b/src/renderer/src/components/native-chat/structured-agent-session-withdrawn-message-restore.ts
new file mode 100644
index 00000000000..fb8a0c202e5
--- /dev/null
+++ b/src/renderer/src/components/native-chat/structured-agent-session-withdrawn-message-restore.ts
@@ -0,0 +1,76 @@
+import { useMemo } from 'react'
+import type { AgentJournalSubmission } from '../../../../shared/agent-session-journal-types'
+import { dispatchWasWithdrawn } from '../../../../shared/structured-agent-session-dispatch-rejection'
+import type { StructuredAgentSessionOutboxEntry } from '../../../../shared/structured-agent-session-outbox'
+import { appendNativeChatDraftCache } from './native-chat-draft-cache'
+import { readOutbox } from './structured-agent-session-outbox-storage'
+import { appendNativeChatAttachmentCache } from './use-native-chat-composer-attachments'
+
+/**
+ * Gives the sender back what a Stop withdrew: its text and images go into this pane's composer,
+ * after whatever is there. Called before the entries leave storage, so a failure between the two
+ * repeats the text rather than losing it. Only this client's outbox holds them, so no other viewer
+ * gets them.
+ */
+function restoreWithdrawnMessages(
+  sessionId: string,
+  composerScopeKey: string | undefined,
+  withdrawn: readonly StructuredAgentSessionOutboxEntry[]
+): void {
+  if (!composerScopeKey || withdrawn.length === 0) {
+    return
+  }
+  // What storage no longer holds was already given back by whichever view dropped it first.
+  const held = new Set(
+    readOutbox(sessionId, { recoverDispatching: false }).map((entry) => entry.clientMessageId)
+  )
+  for (const entry of withdrawn) {
+    if (!held.has(entry.clientMessageId)) {
+      continue
+    }
+    const blocks = entry.body.blocks
+    appendNativeChatDraftCache(
+      composerScopeKey,
+      blocks.flatMap((block) => (block.type === 'text' ? [block.text] : [])).join('\n')
+    )
+    appendNativeChatAttachmentCache(
+      composerScopeKey,
+      blocks.flatMap((block, index) =>
+        block.type === 'image-ref' && block.path
+          ? [{ id: `withdrawn-${entry.clientMessageId}-${index}`, path: block.path }]
+          : []
+      )
+    )
+  }
+}
+
+export function useStructuredAgentSessionWithdrawnRestore(
+  sessionId: string,
+  /** Absent where no composer shows this session; the entries are then only dropped. */
+  composerScopeKey: string | undefined
+): {
+  /** The entries the host settled as withdrawn by a Stop. */
+  byHost: (
+    entries: readonly StructuredAgentSessionOutboxEntry[],
+    submissions: readonly AgentJournalSubmission[]
+  ) => void
+  /** Entries a Stop took out of the outbox here, before the host held them. */
+  byStop: (entries: readonly StructuredAgentSessionOutboxEntry[]) => void
+} {
+  return useMemo(
+    () => ({
+      byHost: (entries, submissions) => {
+        const withdrawn = new Set(
+          submissions.filter(dispatchWasWithdrawn).map((submission) => submission.clientMessageId)
+        )
+        restoreWithdrawnMessages(
+          sessionId,
+          composerScopeKey,
+          entries.filter((entry) => withdrawn.has(entry.clientMessageId))
+        )
+      },
+      byStop: (entries) => restoreWithdrawnMessages(sessionId, composerScopeKey, entries)
+    }),
+    [composerScopeKey, sessionId]
+  )
+}
diff --git a/src/renderer/src/components/native-chat/structured-attention-dispatch.test.ts b/src/renderer/src/components/native-chat/structured-attention-dispatch.test.ts
index 573eca9d455..76a49ff8e3b 100644
--- a/src/renderer/src/components/native-chat/structured-attention-dispatch.test.ts
+++ b/src/renderer/src/components/native-chat/structured-attention-dispatch.test.ts
@@ -10,6 +10,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { FolderWorkspace } from '../../../../shared/folder-workspace-types'
 import type { GlobalSettings } from '../../../../shared/global-settings-types'
 import type { AgentSessionTurnCompletion } from '../../../../shared/agent-session-wire'
+import { agentJournalSubmissionKey } from '../../../../shared/agent-session-journal-item-key'
 import { structuredAgentSessionPaneKey } from '../../../../shared/structured-agent-session-projection'
 import {
   createTestStore,
@@ -230,7 +231,7 @@ describe('dispatchStructuredTurnCompletionAttention', () => {
     expect(indicators().paneDot).toBe('agent-completion')
   })
 
-  it('words a successful turn as finished and a stopped one through the shipped interrupted flag', () => {
+  it('hands main the host verdict, which picks finished, failed or stopped', () => {
     dispatchStructuredTurnCompletionAttention(structuredTab(), completion())
     // 'done' is the host's report that the turn settled, not a reading of the status row: main
     // words a 'working' state as "working", which would announce a finished turn as unfinished.
@@ -238,16 +239,39 @@ describe('dispatchStructuredTurnCompletionAttention', () => {
       source: 'agent-task-complete',
       surface: 'agent-session',
       agentState: 'done',
-      agentInterrupted: false
+      agentTurnOutcome: 'success'
     })
 
+    for (const [outcome, turnId] of [
+      ['cancellation', 'turn-2'],
+      ['failure', 'turn-3']
+    ] as const) {
+      dispatched.length = 0
+      seed()
+      dispatchStructuredTurnCompletionAttention(structuredTab(), completion({ outcome, turnId }))
+      expect(onlyDispatch()).toMatchObject({ agentState: 'done', agentTurnOutcome: outcome })
+    }
+  })
+
+  it('calls back a send refused before any turn, named by its journal item key, as failed', () => {
+    dispatchStructuredTurnCompletionAttention(
+      structuredTab(),
+      completion({ outcome: 'failure', turnId: agentJournalSubmissionKey('m1') })
+    )
+    expect(indicators().paneDot).toBe('agent-completion')
+    expect(onlyDispatch()).toMatchObject({ agentState: 'done', agentTurnOutcome: 'failure' })
+  })
+
+  it('asks for input when the host settled a request while a prompt waits on the user', () => {
+    // e.g. a subagent's approval is unanswered.
+    dispatchStructuredTurnCompletionAttention(structuredTab(), completion({ awaitingUser: true }))
+    expect(indicators().paneDot).toBe('agent-completion')
+    expect(onlyDispatch()).toMatchObject({ agentState: 'blocked', agentTurnOutcome: 'success' })
+
     dispatched.length = 0
     seed()
-    dispatchStructuredTurnCompletionAttention(
-      structuredTab(),
-      completion({ outcome: 'cancellation', turnId: 'turn-2' })
-    )
-    expect(onlyDispatch()).toMatchObject({ agentState: 'done', agentInterrupted: true })
+    dispatchStructuredTurnCompletionAttention(structuredTab(), completion())
+    expect(onlyDispatch()).toMatchObject({ agentState: 'done' })
   })
 
   it('says done even while the status row still reads working, because the host settled the turn', () => {
@@ -270,7 +294,7 @@ describe('dispatchStructuredTurnCompletionAttention', () => {
       }
     })
     dispatchStructuredTurnCompletionAttention(structuredTab(), completion())
-    expect(onlyDispatch()).toMatchObject({ agentState: 'done', agentInterrupted: false })
+    expect(onlyDispatch()).toMatchObject({ agentState: 'done', agentTurnOutcome: 'success' })
   })
 
   it('delivers an id the acknowledgement round trip dismisses when the user reads the chat', () => {
diff --git a/src/renderer/src/components/native-chat/structured-attention-dispatch.ts b/src/renderer/src/components/native-chat/structured-attention-dispatch.ts
index f0afca80e13..4553d79b0a5 100644
--- a/src/renderer/src/components/native-chat/structured-attention-dispatch.ts
+++ b/src/renderer/src/components/native-chat/structured-attention-dispatch.ts
@@ -13,10 +13,11 @@
  * adapter, and the same delivery tail — so suppression, acknowledgement, addressing, the success
  * sound and the blocked-permission fallback all have exactly one implementation.
  *
- * EVERY SETTLED TURN NOTIFIES, matching the CLI lane: success says "finished", and failure and
- * cancellation say "stopped" through the shipped `agentInterrupted` flag rather than a second
- * vocabulary. A turn with no outcome is UNKNOWN — the host sends no event for one, and nothing
- * here may turn that absence into success.
+ * EVERY SETTLED TURN NOTIFIES, matching the CLI lane: the outcome picks the wording — "finished",
+ * "failed" or "stopped" — exactly as the hook lane's verdict does. A turn with no outcome is UNKNOWN — the host sends no event for one, and nothing
+ * here may turn that absence into success. A request that settles while a prompt (a subagent's
+ * approval, say) waits on the user is worded "needs input" instead, as the hook lane words a
+ * blocked row.
  *
  * Unread and delivery come out of ONE `resolveAgentAttention` decision. "Do not alert me about
  * something I am watching" is already answered by focus, in the surface adapter's viewed gates and
@@ -107,10 +108,10 @@ export function dispatchStructuredTurnCompletionAttention(
           ...(row?.agentType ? { agentType: row.agentType } : {}),
           // 'done' is what the host told us, not an inference from the row — the row's own state
           // can still read 'working' when the completion outruns the status re-projection, and
-          // main words a 'working' notification as "working". The outcome picks the wording from
-          // there: interrupted covers failure and cancellation alike.
-          agentState: 'done',
-          agentInterrupted: completion.outcome !== 'success',
+          // main words a 'working' notification as "working". The outcome picks the wording from there.
+          // `awaitingUser` is the row's 'blocked': the user has a prompt to answer.
+          agentState: completion.awaitingUser ? 'blocked' : 'done',
+          agentTurnOutcome: completion.outcome,
           ...(row?.prompt ? { agentPrompt: row.prompt } : {}),
           ...(row?.lastAssistantMessage
             ? { agentLastAssistantMessage: row.lastAssistantMessage }
diff --git a/src/renderer/src/components/native-chat/structured-conversation-command-send.ts b/src/renderer/src/components/native-chat/structured-conversation-command-send.ts
index 77be7d336e7..51575e4ae03 100644
--- a/src/renderer/src/components/native-chat/structured-conversation-command-send.ts
+++ b/src/renderer/src/components/native-chat/structured-conversation-command-send.ts
@@ -3,6 +3,7 @@ import type {
   AgentSessionConversationCommandResult
 } from '../../../../shared/agent-session-conversation-command'
 import { translate } from '@/i18n/i18n'
+import type { StructuredAgentSessionWriteOutcome } from './use-structured-agent-session-mutate'
 
 export async function sendStructuredConversationCommand(input: {
   command: AgentSessionConversationCommand
@@ -10,7 +11,7 @@ export async function sendStructuredConversationCommand(input: {
   blocked: boolean
   send: (
     command: AgentSessionConversationCommand
-  ) => Promise<AgentSessionConversationCommandResult | null>
+  ) => Promise<StructuredAgentSessionWriteOutcome<AgentSessionConversationCommandResult>>
 }): Promise<{ accepted: boolean; error: string | null }> {
   if (input.pending.current || input.blocked) {
     return {
@@ -23,7 +24,11 @@ export async function sendStructuredConversationCommand(input: {
   }
   input.pending.current = true
   try {
-    const result = await input.send(input.command)
+    const outcome = await input.send(input.command)
+    if (outcome.kind === 'not-done') {
+      return { accepted: false, error: outcome.notice }
+    }
+    const result = outcome.kind === 'done' ? outcome.value : null
     return {
       accepted: result?.state === 'completed' && !result.error,
       error:
diff --git a/src/renderer/src/components/native-chat/use-native-chat-composer-attachments.ts b/src/renderer/src/components/native-chat/use-native-chat-composer-attachments.ts
index e3e98dc5fa8..341e242901f 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-composer-attachments.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-composer-attachments.ts
@@ -1,5 +1,5 @@
 import type { NativeChatComposerInput } from './native-chat-composer-input'
-import { useCallback, useRef, useState, type RefObject } from 'react'
+import { useCallback, useEffect, useRef, useState, type RefObject } from 'react'
 import { translate } from '@/i18n/i18n'
 import {
   nativeChatComposerTargetIsRemote,
@@ -53,6 +53,14 @@ export function useNativeChatComposerAttachments({
   )
   const imageAttachmentCounter = useRef(0)
 
+  useEffect(
+    () =>
+      subscribeToNativeChatAttachmentAppend(attachmentScopeKey, (appended) =>
+        setImageAttachments((prev) => [...prev, ...appended])
+      ),
+    [attachmentScopeKey]
+  )
+
   const updateImageAttachments = useCallback(
     (
       updater: (
@@ -237,6 +245,42 @@ function writeNativeChatAttachmentCache(
   setBoundedScopeCacheEntry(attachmentCache, scopeKey, [...attachments])
 }
 
+// Only a write from outside the composer notifies; its own writes already hold the chips.
+const appendListeners = new Map<
+  string,
+  Set<(appended: readonly NativeChatComposerImageAttachment[]) => void>
+>()
+
+/** Puts settled images back after whatever is attached, and shows them in a mounted composer. */
+export function appendNativeChatAttachmentCache(
+  scopeKey: string,
+  appended: readonly NativeChatComposerImageAttachment[]
+): void {
+  if (appended.length === 0) {
+    return
+  }
+  writeNativeChatAttachmentCache(scopeKey, [
+    ...readNativeChatAttachmentCache(scopeKey),
+    ...appended
+  ])
+  appendListeners.get(scopeKey)?.forEach((listener) => listener(appended))
+}
+
+function subscribeToNativeChatAttachmentAppend(
+  scopeKey: string,
+  listener: (appended: readonly NativeChatComposerImageAttachment[]) => void
+): () => void {
+  const listeners = appendListeners.get(scopeKey) ?? new Set()
+  appendListeners.set(scopeKey, listeners)
+  listeners.add(listener)
+  return () => {
+    listeners.delete(listener)
+    if (listeners.size === 0 && appendListeners.get(scopeKey) === listeners) {
+      appendListeners.delete(scopeKey)
+    }
+  }
+}
+
 export function clearNativeChatAttachmentCacheForTests(): void {
   attachmentCache.clear()
 }
diff --git a/src/renderer/src/components/native-chat/use-native-chat-composer-interrupt.ts b/src/renderer/src/components/native-chat/use-native-chat-composer-interrupt.ts
index 71a654c0927..f59d86303f1 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-composer-interrupt.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-composer-interrupt.ts
@@ -25,7 +25,7 @@ export function useNativeChatComposerInterrupt(args: {
     }
     const target = resolveTarget()
     if (target) {
-      sendRuntimePtyInput(target.settings, target.ptyId, ESC)
+      sendRuntimePtyInput(target.settings, target.ptyId, ESC, 'driving')
     }
   }, [cancelPendingSends, isWorking, onStop, resolveTarget])
 }
diff --git a/src/renderer/src/components/native-chat/use-native-chat-draft.ts b/src/renderer/src/components/native-chat/use-native-chat-draft.ts
index 6de88b8fda3..5653c0a77a8 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-draft.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-draft.ts
@@ -1,5 +1,10 @@
-import { useCallback, useRef, useState } from 'react'
-import { readNativeChatDraftCache, writeNativeChatDraftCache } from './native-chat-draft-cache'
+import { useCallback, useEffect, useRef, useState } from 'react'
+import {
+  appendNativeChatDraftText,
+  readNativeChatDraftCache,
+  subscribeToNativeChatDraftAppend,
+  writeNativeChatDraftCache
+} from './native-chat-draft-cache'
 
 /**
  * Composer draft state backed by the scope cache so a typed-but-unsent message
@@ -7,11 +12,18 @@ import { readNativeChatDraftCache, writeNativeChatDraftCache } from './native-ch
  * pane key also used for image attachments; when it changes (the composer is
  * reused for a different pane) the cached draft is reloaded.
  */
-export function useNativeChatDraft(scopeKey: string): {
+export function useNativeChatDraft(
+  scopeKey: string,
+  isComposing: () => boolean
+): {
   draft: string
   setDraft: (next: string | ((previous: string) => string)) => void
+  /** Shows text appended during an IME composition, which owns the field until it settles. */
+  flushDraftAppends: () => void
 } {
   const [draft, setDraftState] = useState(() => readNativeChatDraftCache(scopeKey))
+  // Appended while composing: the editor's own writes would erase it, so the cache keeps it after them.
+  const pendingAppendRef = useRef<{ scopeKey: string; text: string } | null>(null)
 
   // Reload the cached draft when reused for a different pane (scope change),
   // adjusting state during render rather than in an effect so the restored draft
@@ -22,18 +34,49 @@ export function useNativeChatDraft(scopeKey: string): {
     setDraftState(readNativeChatDraftCache(scopeKey))
   }
 
+  useEffect(
+    () =>
+      subscribeToNativeChatDraftAppend(scopeKey, (text) => {
+        if (!isComposing()) {
+          setDraftState(readNativeChatDraftCache(scopeKey))
+          return
+        }
+        const pending = pendingAppendRef.current
+        pendingAppendRef.current = {
+          scopeKey,
+          text:
+            pending?.scopeKey === scopeKey ? appendNativeChatDraftText(pending.text, text) : text
+        }
+      }),
+    [isComposing, scopeKey]
+  )
+
   // Persist every mutation through the cache. Accepts the same value/updater
   // forms as a useState setter so call sites are drop-in.
   const setDraft = useCallback(
     (next: string | ((previous: string) => string)) => {
       setDraftState((previous) => {
         const resolved = typeof next === 'function' ? next(previous) : next
-        writeNativeChatDraftCache(scopeKey, resolved)
+        const pending = pendingAppendRef.current
+        writeNativeChatDraftCache(
+          scopeKey,
+          pending?.scopeKey === scopeKey
+            ? appendNativeChatDraftText(resolved, pending.text)
+            : resolved
+        )
         return resolved
       })
     },
     [scopeKey]
   )
 
-  return { draft, setDraft }
+  const flushDraftAppends = useCallback(() => {
+    const pending = pendingAppendRef.current
+    pendingAppendRef.current = null
+    if (pending?.scopeKey === scopeKey) {
+      setDraft((previous) => appendNativeChatDraftText(previous, pending.text))
+    }
+  }, [scopeKey, setDraft])
+
+  return { draft, setDraft, flushDraftAppends }
 }
diff --git a/src/renderer/src/components/native-chat/use-native-chat-interactive-prompt-card.test.ts b/src/renderer/src/components/native-chat/use-native-chat-interactive-prompt-card.test.ts
new file mode 100644
index 00000000000..a13df87c3e8
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-native-chat-interactive-prompt-card.test.ts
@@ -0,0 +1,68 @@
+// @vitest-environment happy-dom
+
+import { afterEach, describe, expect, it } from 'vitest'
+import { act, cleanup, renderHook } from '@testing-library/react'
+import type { AgentStatusPayload } from '../../../../shared/agent-status-types'
+import type { NativeChatMessage } from '../../../../shared/native-chat-types'
+
+const { useAppStore } = await import('../../store')
+const { useNativeChatInteractivePromptCard } =
+  await import('./use-native-chat-interactive-prompt-card')
+
+const paneKey = 'tab-card:leaf-card'
+const NO_MESSAGES: readonly NativeChatMessage[] = []
+
+function setStatus(payload: Omit<AgentStatusPayload, 'prompt' | 'agentType'>): void {
+  useAppStore
+    .getState()
+    .setAgentStatus(paneKey, { prompt: 'Rename', agentType: 'claude', ...payload })
+}
+
+afterEach(() => {
+  cleanup()
+  useAppStore.setState({ agentStatusByPaneKey: {} })
+})
+
+describe('useNativeChatInteractivePromptCard', () => {
+  // The hook runs in the pane's view, so each render here re-renders the whole transcript.
+  it('does not re-render for a tool call that carries no prompt', () => {
+    setStatus({ state: 'working', toolName: 'Read' })
+    let renders = 0
+    renderHook(() => {
+      renders += 1
+      return useNativeChatInteractivePromptCard({
+        paneKey,
+        messages: NO_MESSAGES,
+        transcriptSettled: true
+      })
+    })
+    const settled = renders
+
+    act(() => setStatus({ state: 'working', toolName: 'Bash' }))
+    act(() => setStatus({ state: 'working', toolName: 'Edit' }))
+
+    expect(renders).toBe(settled)
+  })
+
+  it('still reads the prompt that arrives with a tool call', () => {
+    setStatus({ state: 'working', toolName: 'Read' })
+    const { result } = renderHook(() =>
+      useNativeChatInteractivePromptCard({
+        paneKey,
+        messages: NO_MESSAGES,
+        transcriptSettled: true
+      })
+    )
+    expect(result.current).toBeNull()
+
+    act(() =>
+      setStatus({
+        state: 'waiting',
+        toolName: 'Bash',
+        interactivePrompt: JSON.stringify({ approval: { tool: 'Bash', summary: 'rm -rf dist' } })
+      })
+    )
+
+    expect(result.current).toMatchObject({ kind: 'approval' })
+  })
+})
diff --git a/src/renderer/src/components/native-chat/use-native-chat-interactive-prompt-card.ts b/src/renderer/src/components/native-chat/use-native-chat-interactive-prompt-card.ts
new file mode 100644
index 00000000000..243fea0ac57
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-native-chat-interactive-prompt-card.ts
@@ -0,0 +1,48 @@
+import { useMemo } from 'react'
+import { useAppStore } from '../../store'
+import { resolveNativeChatAsk } from '../../../../shared/native-chat-ask'
+import type { NativeChatMessage } from '../../../../shared/native-chat-types'
+import {
+  parseInteractivePrompt,
+  type InteractivePromptCard
+} from './native-chat-interactive-prompt'
+
+/**
+ * The prompt a terminal-backed pane can draw as a card: a tool approval from the
+ * live status, else a question from the live status or, failing that, from the
+ * transcript's unresolved ask (headless host, relay gap, replay, reconnect — a
+ * pane parked on a selector must not take the next message as its answer, #11761).
+ */
+export function useNativeChatInteractivePromptCard({
+  paneKey,
+  messages,
+  transcriptSettled
+}: {
+  paneKey: string
+  /** Pass the command-boundary-trimmed messages so an ask abandoned via `/clear` stays gone. */
+  messages: readonly NativeChatMessage[]
+  transcriptSettled: boolean
+}): InteractivePromptCard {
+  const interactivePrompt = useAppStore(
+    (s) => s.agentStatusByPaneKey[paneKey]?.interactivePrompt ?? null
+  )
+  // The sibling `toolName` lets the question parser dispatch through the tool's
+  // registered parser (mobile parity). Read only beside a prompt: it changes on
+  // every tool call, and this hook re-renders the whole pane.
+  const interactiveToolName = useAppStore((s) => {
+    const entry = s.agentStatusByPaneKey[paneKey]
+    return entry?.interactivePrompt ? (entry.toolName ?? null) : null
+  })
+  return useMemo(() => {
+    const statusCard = parseInteractivePrompt(interactivePrompt, interactiveToolName ?? undefined)
+    if (statusCard?.kind === 'approval') {
+      return statusCard
+    }
+    const prompt = resolveNativeChatAsk({
+      liveAsk: statusCard?.prompt ?? null,
+      messages,
+      transcriptSettled
+    })
+    return prompt ? { kind: 'question' as const, prompt } : null
+  }, [interactivePrompt, interactiveToolName, messages, transcriptSettled])
+}
diff --git a/src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx b/src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx
index 864c62f6f91..f2cbd8df93c 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx
+++ b/src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx
@@ -195,7 +195,8 @@ describe('useNativeChatInteractiveSend', () => {
     expect(mocks.sendRuntimePtyInput).toHaveBeenCalledWith(
       { terminalTabId: 'tab-1' },
       'pty-1',
-      '\x1b'
+      '\x1b',
+      'driving'
     )
   })
 
diff --git a/src/renderer/src/components/native-chat/use-native-chat-interactive-send.ts b/src/renderer/src/components/native-chat/use-native-chat-interactive-send.ts
index 43adabae8f3..3d270cde49b 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-interactive-send.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-interactive-send.ts
@@ -76,7 +76,12 @@ export function useNativeChatInteractiveSend(
       if (!targetPtyId) {
         return
       }
-      sendRuntimePtyInput(getSettingsForAgentTabRuntimeOwner(terminalTabId), targetPtyId, raw)
+      sendRuntimePtyInput(
+        getSettingsForAgentTabRuntimeOwner(terminalTabId),
+        targetPtyId,
+        raw,
+        'driving'
+      )
     },
     [terminalTabId, targetPtyId]
   )
diff --git a/src/renderer/src/components/native-chat/use-native-chat-launch-prompt-delivery-notice.ts b/src/renderer/src/components/native-chat/use-native-chat-launch-prompt-delivery-notice.ts
new file mode 100644
index 00000000000..c3d7974c160
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-native-chat-launch-prompt-delivery-notice.ts
@@ -0,0 +1,22 @@
+import { useMemo } from 'react'
+import { translate } from '@/i18n/i18n'
+import type { NativeChatMessage } from '../../../../shared/native-chat-types'
+import type { NativeChatDeliveryNotice } from './NativeChatMessageRow'
+
+/** The terminal-backed chat's one delivery notice: its launch prompt, when the terminal refused it
+ *  and the prompt's row is on screen. The terminal is where to act, so it offers no Retry. */
+export function useNativeChatLaunchPromptDeliveryNotice(
+  failedMessageId: string | null | undefined,
+  messages: readonly NativeChatMessage[]
+): ReadonlyMap<string, NativeChatDeliveryNotice> | undefined {
+  return useMemo(() => {
+    if (!failedMessageId || !messages.some((message) => message.id === failedMessageId)) {
+      return undefined
+    }
+    const text = translate(
+      'components.native-chat.launchPromptNotDelivered',
+      'Not delivered — check the terminal'
+    )
+    return new Map([[failedMessageId, { text }]])
+  }, [failedMessageId, messages])
+}
diff --git a/src/renderer/src/components/native-chat/use-native-chat-live-session.test.ts b/src/renderer/src/components/native-chat/use-native-chat-live-session.test.ts
index cd4b701e270..4c7f784eb31 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-live-session.test.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-live-session.test.ts
@@ -547,6 +547,42 @@ describe('useNativeChatLiveSession — transport routing', () => {
     expect(latest?.status).toBe('ready')
   })
 
+  // Declining a prompt with an interrupt fires no hook, so the row keeps saying
+  // `waiting`; the transcript's marker is what ends the wait.
+  it('ends a hook wait once the transcript records the turn interrupted', async () => {
+    const waitStartedAt = Date.now() - 1_000
+    useAppStore.getState().setAgentStatus(PANE, { state: 'waiting', prompt: '', agentType: AGENT })
+    const row = useAppStore.getState().agentStatusByPaneKey[PANE]
+    if (!row) {
+      throw new Error('the store dropped the status row this test depends on')
+    }
+    useAppStore.setState({
+      agentStatusByPaneKey: { [PANE]: { ...row, stateStartedAt: waitStartedAt } }
+    })
+    const transport = getMockTransport('env-1')
+    await render({ paneKey: PANE, agent: AGENT, sessionId: SESSION, runtimeEnvironmentId: 'env-1' })
+    await act(async () =>
+      transport.emit({
+        type: 'snapshot',
+        messages: [user('u-1', 'go')],
+        hasMore: false,
+        lifecycle: { state: 'working', turnId: 'turn-1', timestamp: waitStartedAt - 500 }
+      })
+    )
+    expect(latest?.hookAwaitingInput).toBe(true)
+    expect(latest?.status).toBe('ready')
+
+    await act(async () =>
+      transport.emit({
+        type: 'appended',
+        messages: [],
+        lifecycle: { state: 'interrupted', turnId: 'turn-1', timestamp: Date.now() }
+      })
+    )
+
+    expect(latest?.hookAwaitingInput).toBe(false)
+  })
+
   it('does not let an older pagination read rewind a live completion', async () => {
     useAppStore.setState({
       agentStatusByPaneKey: {
diff --git a/src/renderer/src/components/native-chat/use-native-chat-live-session.ts b/src/renderer/src/components/native-chat/use-native-chat-live-session.ts
index a62237f1b35..0f4a4058155 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-live-session.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-live-session.ts
@@ -9,7 +9,7 @@ import {
   createNativeChatMerger,
   replaceList
 } from '../../../../shared/native-chat-merge'
-import { mergeNativeChatLiveSession } from './native-chat-live-status'
+import { mergeNativeChatLiveSession, nativeChatHookAwaitsInput } from './native-chat-live-status'
 import {
   hasMoreNativeChatHistory,
   NATIVE_CHAT_INITIAL_LIMIT,
@@ -342,6 +342,11 @@ export function useNativeChatLiveSession(
     })
     return {
       ...session,
+      hookAwaitingInput: nativeChatHookAwaitsInput(
+        hookState,
+        hookStateStartedAt,
+        transcriptLifecycle
+      ),
       hasMore,
       loadingEarlier,
       olderHistoryGeneration,
diff --git a/src/renderer/src/components/native-chat/use-native-chat-message-rail.test.ts b/src/renderer/src/components/native-chat/use-native-chat-message-rail.test.ts
index cec8d63a9c7..518e33a9586 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-message-rail.test.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-message-rail.test.ts
@@ -31,12 +31,10 @@ function slotsOf(messages: NativeChatMessage[]) {
   return buildNativeChatTranscriptSlots({
     messages,
     turnKeys,
-    latestUserIndex: messages.findLastIndex((entry) => entry.role === 'user'),
-    currentTurnKey: undefined,
+    liveTurnKey: undefined,
     receipts: new Map<string, NativeChatResolvedPrompt>(),
     turnStatuses: { active: null, completedByTurn: {} },
     turnDiffs: new Map<string, NativeChatTurnDiff>(),
-    showTurnStatus: false,
     expandedTurnKeys: new Set<string>(),
     isWorking: false,
     lifecycleWorking: false
diff --git a/src/renderer/src/components/native-chat/use-native-chat-provisional-launch.test.tsx b/src/renderer/src/components/native-chat/use-native-chat-provisional-launch.test.tsx
index 304168a328a..d19e114e6b9 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-provisional-launch.test.tsx
+++ b/src/renderer/src/components/native-chat/use-native-chat-provisional-launch.test.tsx
@@ -7,13 +7,14 @@ import type * as LaunchIntentModule from '@/lib/launch-structured-agent-session'
 
 const mocks = vi.hoisted(() => ({
   call: vi.fn<(target: unknown, method: string, params?: unknown) => Promise<unknown>>(),
-  launch: vi.fn<(intent: { sessionId: string }) => Promise<{ sessionId: string; fence: number }>>()
+  launch: vi.fn<(intent: { sessionId: string }) => Promise<{ sessionId: string; fence: number }>>(),
+  toastError: vi.fn()
 }))
 
 let readState: StructuredAgentSessionState
 let publishedTabs: unknown[] = []
 
-vi.mock('sonner', () => ({ toast: { error: vi.fn(), message: vi.fn() } }))
+vi.mock('sonner', () => ({ toast: { error: mocks.toastError, message: vi.fn() } }))
 
 vi.mock('@/runtime/structured-agent-session-client', () => ({
   callStructuredAgentSession: mocks.call
@@ -169,7 +170,9 @@ describe('a chat pane over its own launch', () => {
       await launch.launchResult
     })
     rerender()
-    await waitFor(() => expect(result.current.error).toBe('GPT-5.6 Luna is not available'))
+    await waitFor(() =>
+      expect(mocks.toastError).toHaveBeenCalledWith("The setting wasn't changed.")
+    )
     // Reverted to what the chat runs; the refusal never kept the launch from publishing.
     expect(currentModel(result.current.optionSnapshot)).toBe('gpt-5.5')
   })
diff --git a/src/renderer/src/components/native-chat/use-native-chat-provisional-launch.ts b/src/renderer/src/components/native-chat/use-native-chat-provisional-launch.ts
index 0661eb0df88..12528859d71 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-provisional-launch.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-provisional-launch.ts
@@ -3,7 +3,7 @@ import {
   getStructuredAgentSessionLaunchLifecycle,
   getStructuredAgentSessionLaunchResumes,
   retryStructuredAgentSessionLaunch,
-  useStructuredAgentSessionLaunchFailureReason,
+  useStructuredAgentSessionLaunchFailure,
   useStructuredAgentSessionLaunchLifecycle,
   useStructuredAgentSessionLaunchSelection
 } from '@/lib/structured-agent-session-launch'
@@ -66,7 +66,7 @@ export function useNativeChatProvisionalLaunch(
   sessionId: string
 ) {
   const lifecycle = useStructuredAgentSessionLaunchLifecycle(worktreeId ?? '', sessionId)
-  const failureReason = useStructuredAgentSessionLaunchFailureReason(worktreeId ?? '', sessionId)
+  const failure = useStructuredAgentSessionLaunchFailure(worktreeId ?? '', sessionId)
   const launch = useLatchedLaunchView(sessionId, worktreeId, lifecycle !== null)
   const retry = useCallback(() => {
     if (worktreeId) {
@@ -91,7 +91,7 @@ export function useNativeChatProvisionalLaunch(
   return {
     lifecycle,
     launch,
-    failureReason,
+    failure,
     retry,
     sendThroughRelaunch,
     transportEnabled: lifecycle === null || lifecycle === 'published'
diff --git a/src/renderer/src/components/native-chat/use-native-chat-terminal-turn-timing.ts b/src/renderer/src/components/native-chat/use-native-chat-terminal-turn-timing.ts
new file mode 100644
index 00000000000..13aa5a93977
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-native-chat-terminal-turn-timing.ts
@@ -0,0 +1,45 @@
+import { useMemo } from 'react'
+import { useAppStore } from '../../store'
+import type { NativeChatMessage } from '../../../../shared/native-chat-types'
+import type { NativeChatSettledTurns } from '../../../../shared/native-chat-turn-status'
+import {
+  nativeChatHookLatestTurnWorkedSeconds,
+  nativeChatHookTurnStartedAt,
+  nativeChatLatestTurnId,
+  nativeChatTranscriptSettledTurns
+} from './native-chat-terminal-turn'
+import { resolveNativeChatHookState } from './use-native-chat-hook-status'
+
+/** The terminal-backed pane's turn timing for the message list: when its running turn began, by
+ *  the host, and each finished turn's duration (the host's for the latest, the transcript's for
+ *  history). All of it survives a remount of the pane. */
+export function useNativeChatTerminalTurnTiming(
+  paneKey: string,
+  messages: readonly NativeChatMessage[],
+  turnActive: boolean
+): { workingStartedAt: number | null; settledTurns: NativeChatSettledTurns } {
+  // Freshness is time-based: re-read when the scheduler says a silent row aged out.
+  const agentStatusEpoch = useAppStore((s) => s.agentStatusEpoch)
+  void agentStatusEpoch
+  const turnStartedAt = useAppStore((s) =>
+    nativeChatHookTurnStartedAt(s.agentStatusByPaneKey[paneKey])
+  )
+  const latestWorkedSeconds = useAppStore((s) => {
+    const entry = s.agentStatusByPaneKey[paneKey]
+    return nativeChatHookLatestTurnWorkedSeconds(entry, resolveNativeChatHookState(entry) === null)
+  })
+  const transcriptSettled = useMemo(() => nativeChatTranscriptSettledTurns(messages), [messages])
+  const latestTurnId = useMemo(() => nativeChatLatestTurnId(messages), [messages])
+  const settledTurns = useMemo(() => {
+    if (turnActive || latestWorkedSeconds === undefined || latestTurnId === null) {
+      return transcriptSettled
+    }
+    return new Map(transcriptSettled).set(
+      latestTurnId,
+      latestWorkedSeconds === null || turnStartedAt === null
+        ? null
+        : { startedAt: turnStartedAt, workedSeconds: latestWorkedSeconds }
+    )
+  }, [latestTurnId, latestWorkedSeconds, transcriptSettled, turnActive, turnStartedAt])
+  return { workingStartedAt: turnActive ? turnStartedAt : null, settledTurns }
+}
diff --git a/src/renderer/src/components/native-chat/use-native-chat-transcript-scroll.test.tsx b/src/renderer/src/components/native-chat/use-native-chat-transcript-scroll.test.tsx
index 1f08a51299a..948b83c5dbb 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-transcript-scroll.test.tsx
+++ b/src/renderer/src/components/native-chat/use-native-chat-transcript-scroll.test.tsx
@@ -23,7 +23,7 @@ function TranscriptHarness({
     contentRef,
     itemCount,
     isWorking: false,
-    showTypingIndicator: false,
+    showsTailRow: false,
     isVisible,
     alignToViewportTop: vi.fn(),
     scrollToEnd,
diff --git a/src/renderer/src/components/native-chat/use-native-chat-transcript-scroll.ts b/src/renderer/src/components/native-chat/use-native-chat-transcript-scroll.ts
index 23bebf0f1e8..6df6d3eb562 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-transcript-scroll.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-transcript-scroll.ts
@@ -52,7 +52,7 @@ export function useNativeChatTranscriptScroll({
   contentRef,
   itemCount,
   isWorking,
-  showTypingIndicator,
+  showsTailRow,
   isVisible,
   alignToViewportTop,
   scrollToEnd,
@@ -64,7 +64,8 @@ export function useNativeChatTranscriptScroll({
   contentRef: React.RefObject<HTMLDivElement | null>
   itemCount: number
   isWorking: boolean
-  showTypingIndicator: boolean
+  /** Whether the list draws a row after the transcript (live activity or a wait). */
+  showsTailRow: boolean
   isVisible: boolean
   alignToViewportTop: (element: HTMLElement) => void
   scrollToEnd: () => void
@@ -156,7 +157,7 @@ export function useNativeChatTranscriptScroll({
     itemCount,
     isWorking,
     restoreScrollOffset,
-    showTypingIndicator,
+    showsTailRow,
     scrollToEndWhenMeasurable
   ])
 
diff --git a/src/renderer/src/components/native-chat/use-native-chat-transcript-window.options.test.tsx b/src/renderer/src/components/native-chat/use-native-chat-transcript-window.options.test.tsx
index 823f78af6ed..7d245cc76fd 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-transcript-window.options.test.tsx
+++ b/src/renderer/src/components/native-chat/use-native-chat-transcript-window.options.test.tsx
@@ -58,6 +58,7 @@ function slot(id: string): NativeChatTranscriptSlot {
     folded: false,
     turnFolds: false,
     turnDiff: undefined,
+    subagentLabel: undefined,
     estimatedHeight: 48
   }
 }
diff --git a/src/renderer/src/components/native-chat/use-native-chat-turn-membership.ts b/src/renderer/src/components/native-chat/use-native-chat-turn-membership.ts
new file mode 100644
index 00000000000..1793dcc1d68
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-native-chat-turn-membership.ts
@@ -0,0 +1,36 @@
+import { useMemo } from 'react'
+import type {
+  AgentJournalRenderItem,
+  AgentJournalSubmission
+} from '../../../../shared/agent-session-journal-types'
+import type { NativeChatMessage } from '../../../../shared/native-chat-types'
+import { nativeChatTurnMembership } from '../../../../shared/native-chat-turn-membership'
+import { nativeChatRowsInDrawOrder } from '../../../../shared/native-chat-turn-grouping'
+
+export type NativeChatTurnRows = {
+  /** The rows in the order the transcript draws them. */
+  messages: readonly NativeChatMessage[]
+  /** Each drawn row's turn, by index into `messages`. */
+  turnKeys: readonly (string | undefined)[]
+  liveTurnKey: string | undefined
+}
+
+/** Each row's turn, which turn is live, and the order the rows draw in, resolved once: from the
+ *  turn record when the host states scopes, else by journal order. */
+export function useNativeChatTurnMembership(
+  messages: readonly NativeChatMessage[],
+  journalItems: readonly AgentJournalRenderItem[] | undefined,
+  journalSubmissions: readonly AgentJournalSubmission[] | undefined
+): NativeChatTurnRows {
+  return useMemo(() => {
+    const { turnKeys, liveTurnKey, drawOrder } = nativeChatTurnMembership(
+      messages,
+      journalItems ? { items: journalItems, submissions: journalSubmissions ?? [] } : null
+    )
+    return {
+      messages: nativeChatRowsInDrawOrder(messages, drawOrder),
+      turnKeys: nativeChatRowsInDrawOrder(turnKeys, drawOrder),
+      liveTurnKey
+    }
+  }, [journalItems, journalSubmissions, messages])
+}
diff --git a/src/renderer/src/components/native-chat/use-native-chat-turn-status.ts b/src/renderer/src/components/native-chat/use-native-chat-turn-status.ts
index 82d98c77ec0..6bf7f2fdc81 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-turn-status.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-turn-status.ts
@@ -1,6 +1,6 @@
-import { useLayoutEffect, useState } from 'react'
-import type { NativeChatMessage } from '../../../../shared/native-chat-types'
+import { useLayoutEffect, useMemo, useState } from 'react'
 import {
+  NATIVE_CHAT_UNANCHORED_TURN_KEY,
   reduceNativeChatTurnTiming,
   selectNativeChatTurnStatuses,
   type NativeChatSettledTurns,
@@ -11,18 +11,20 @@ import {
 export type { NativeChatTurnStatus }
 
 export function useNativeChatTurnStatus({
-  messages,
-  latestUserIndex,
+  turnKeys,
+  liveTurnKey,
   isWorking,
   workingStartedAt,
   settledTurns,
   thinking = false
 }: {
-  messages: readonly NativeChatMessage[]
-  latestUserIndex: number
+  /** Each row's turn, as `nativeChatTurnMembership` places it. */
+  turnKeys: readonly (string | undefined)[]
+  /** The live turn, whose bar carries the running clock (`nativeChatTurnMembership`). */
+  liveTurnKey: string | undefined
   isWorking: boolean
   workingStartedAt?: number | null
-  /** Host-recorded durations; they outrank whatever this client observed. */
+  /** Recorded durations (the host's journal or the transcript); they outrank what this client observed. */
   settledTurns?: NativeChatSettledTurns | null
   /** Whether the turn is reasoning right now, derived from its journal content. */
   thinking?: boolean
@@ -30,14 +32,14 @@ export function useNativeChatTurnStatus({
   active: NativeChatTurnStatus | null
   completedByTurn: Readonly<Record<string, NativeChatTurnStatus>>
 } {
-  const latestUserId = latestUserIndex !== -1 ? (messages[latestUserIndex]?.id ?? null) : null
-  const activeTurnKey = latestUserId ?? '__unanchored__'
+  const activeTurnKey = liveTurnKey ?? NATIVE_CHAT_UNANCHORED_TURN_KEY
   const [timingByTurn, setTimingByTurn] = useState<NativeChatTurnTimingByTurn>({})
+  const validTurnKeys = useMemo(
+    () => new Set(turnKeys.filter((turnKey) => turnKey !== undefined)),
+    [turnKeys]
+  )
 
   useLayoutEffect(() => {
-    const validTurnKeys = new Set(
-      messages.filter((message) => message.role === 'user').map((message) => message.id)
-    )
     setTimingByTurn((current) =>
       reduceNativeChatTurnTiming(current, {
         activeTurnKey,
@@ -47,7 +49,7 @@ export function useNativeChatTurnStatus({
         now: Date.now()
       })
     )
-  }, [activeTurnKey, isWorking, messages, workingStartedAt])
+  }, [activeTurnKey, isWorking, validTurnKeys, workingStartedAt])
 
   return selectNativeChatTurnStatuses(timingByTurn, {
     activeTurnKey,
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-command-send-gate.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session-command-send-gate.test.tsx
new file mode 100644
index 00000000000..6fc339e90c8
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-command-send-gate.test.tsx
@@ -0,0 +1,93 @@
+// @vitest-environment happy-dom
+
+import { act, renderHook } from '@testing-library/react'
+import { beforeEach, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  call: vi.fn(),
+  outboxSend: vi.fn()
+}))
+let items: AgentJournalRenderItem[] = []
+
+vi.mock('@/runtime/structured-agent-session-client', () => ({
+  callStructuredAgentSession: mocks.call
+}))
+
+vi.mock('./use-structured-agent-session-read', () => ({
+  useStructuredAgentSessionRead: () => ({
+    state: {
+      fence: 3,
+      items,
+      submissions: [],
+      status: 'ready',
+      error: null,
+      hasOlder: false,
+      handoff: null
+    },
+    loadingOlder: false,
+    loadOlder: vi.fn()
+  })
+}))
+
+vi.mock('./use-structured-agent-session-outbox', () => ({
+  structuredSessionOperationId: () => 'operation-1',
+  useStructuredAgentSessionOutbox: () => ({
+    outbox: [],
+    blockedClientMessageId: null,
+    error: null,
+    send: mocks.outboxSend,
+    retry: vi.fn()
+  })
+}))
+
+import type { AgentJournalRenderItem } from '../../../../shared/agent-session-journal-types'
+import { useStructuredAgentSession } from './use-structured-agent-session'
+
+function answer(text: string, scoped: boolean): AgentJournalRenderItem {
+  return {
+    itemId: text,
+    revision: 0,
+    sequence: 1,
+    observedAt: 1,
+    body: { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text }] },
+    ...(scoped ? { turnScope: { kind: 'thread' as const } } : {})
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.outboxSend.mockReturnValue(true)
+})
+
+/** Starts `/compact` and leaves its reply outstanding, then sends a message. */
+function sendDuringCommand(): boolean {
+  mocks.call.mockImplementation((_target: unknown, method: string) =>
+    method === 'agentSession.conversationCommand' ? new Promise(() => {}) : Promise.resolve(null)
+  )
+  const { result } = renderHook(() =>
+    useStructuredAgentSession({
+      sessionId: 'session-1',
+      agent: 'codex',
+      target: { kind: 'local' },
+      isVisible: true
+    })
+  )
+  act(() => {
+    void result.current.runConversationCommand('compact')
+  })
+  return result.current.send('typed during the command')
+}
+
+it('still refuses a message locally while an older host runs a command', () => {
+  items = [answer('from an older host', false)]
+
+  expect(sendDuringCommand()).toBe(false)
+  expect(mocks.outboxSend).not.toHaveBeenCalled()
+})
+
+it('queues a message typed during a command on a host that runs it as a turn', () => {
+  items = [answer('from this host', true)]
+
+  expect(sendDuringCommand()).toBe(true)
+  expect(mocks.outboxSend).toHaveBeenCalledOnce()
+})
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-hold.ts b/src/renderer/src/components/native-chat/use-structured-agent-session-hold.ts
index 628a369281b..f484f500a56 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-hold.ts
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-hold.ts
@@ -8,6 +8,9 @@
 //
 // The release CHAINS off the hold rather than racing it: an unmount during the hold's round trip
 // would otherwise release a hold that has not landed yet, and the late hold would never be undone.
+//
+// A current host ignores both: it starts an agent only for a send. They stay for older hosts, until
+// MIN_COMPATIBLE_RUNTIME_SERVER_VERSION passes the first host that ignores them.
 
 import { useEffect, useRef } from 'react'
 import { structuredAgentSessionHolderId } from '../../../../shared/structured-agent-session-holder'
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-mutate.ts b/src/renderer/src/components/native-chat/use-structured-agent-session-mutate.ts
index d7706913d21..57b7acdaf09 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-mutate.ts
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-mutate.ts
@@ -1,25 +1,50 @@
 // One structured-session mutation, fenced and idempotent.
 //
 // The client operation id is keyed on (session, method, payload) so a retry of
-// the same request reuses it and the host upserts one row instead of two, and
+// the same request reuses it and the host upserts one row instead of two (a
+// payload naming no target gets a new one on every call), and
 // every result is discarded unless the runtime fence it was issued against is
-// still the current one.
+// still the current one. A write that did not happen is reported once, in the
+// person's words, by the caller that knows where to say it; nothing latches.
 
-import { useCallback, useEffect, useRef, useState } from 'react'
+import { useCallback, useEffect, useRef } from 'react'
+import { toast } from 'sonner'
 import * as conversationCommands from './structured-conversation-command-send'
 import type { AgentSessionMutationResult } from '../../../../shared/agent-session-wire'
+import {
+  agentSessionRefusalFailure,
+  agentSessionThrownFailure,
+  agentSessionWriteKindForMethod as writeKind
+} from '../../../../shared/agent-session-write-failure'
 import { agentSessionRefusalOperationState } from '../../../../shared/agent-session-refusal-retry'
 import { structuredAgentSessionPayloadFingerprint } from '../../../../shared/structured-agent-session-mutation'
+import { structuredAgentSessionWriteNamesItsTarget } from '../../../../shared/structured-agent-session-operation-identity'
 import type { RuntimeClientTarget } from '@/runtime/runtime-rpc-client'
+import { RuntimeRpcCallError } from '@/runtime/runtime-rpc-result'
 import { callStructuredAgentSession } from '@/runtime/structured-agent-session-client'
 import { structuredSessionOperationId } from './use-structured-agent-session-outbox'
+import { agentSessionWriteFailureText } from './agent-session-write-notice-text'
 
-export type StructuredAgentSessionMutate = <T>(
+export type StructuredAgentSessionWriteOutcome<T> =
+  | { kind: 'done'; value: T }
+  /** Refused or failed, with what to tell the person. */
+  | { kind: 'not-done'; notice: string }
+  /** Settled for an owner or session this pane no longer shows; there is nothing to say. */
+  | { kind: 'dropped' }
+
+type WriteArgs = [
   method: string,
   fingerprintMethod: string,
   fields: Record<string, unknown>,
   operationIdOverride?: string | null
-) => Promise<T | null>
+]
+
+export type StructuredAgentSessionWrite = <T>(
+  ...args: WriteArgs
+) => Promise<StructuredAgentSessionWriteOutcome<T>>
+
+/** A write whose failure is shown as a toast; the control that sent it is the way to try again. */
+export type StructuredAgentSessionMutate = <T>(...args: WriteArgs) => Promise<T | null>
 
 export function useStructuredAgentSessionMutate(args: {
   sessionId: string
@@ -29,13 +54,10 @@ export function useStructuredAgentSessionMutate(args: {
    *  is in flight, and a result from the previous fence is not this session's. */
   stateRef: { current: { fence: number | null } }
 }): {
+  write: StructuredAgentSessionWrite
   mutate: StructuredAgentSessionMutate
-  writeError: string | null
-  /** A write this hook did not send, refused all the same (a pick applied by the launch). */
-  reportWriteError: (message: string) => void
 } {
   const { enabled = true, sessionId, stateRef, target } = args
-  const [writeError, setWriteError] = useState<string | null>(null)
   const operationIds = useRef(new Map<string, string>())
   const enabledRef = useRef(enabled)
   useEffect(() => {
@@ -43,21 +65,28 @@ export function useStructuredAgentSessionMutate(args: {
     enabledRef.current = enabled
   }, [enabled])
 
-  const mutate = useCallback(
+  const write = useCallback(
     async <T>(
       method: string,
       fingerprintMethod: string,
       fields: Record<string, unknown>,
       operationIdOverride?: string | null
-    ): Promise<T | null> => {
+    ): Promise<StructuredAgentSessionWriteOutcome<T>> => {
       if (!enabled || !enabledRef.current || stateRef.current.fence === null) {
-        return null
+        return { kind: 'dropped' }
       }
       const targetFence = stateRef.current.fence
       const key = `${sessionId}:${fingerprintMethod}:${JSON.stringify(fields)}`
+      // A write naming no target acts on whatever is in flight when the host reaches it, so every
+      // press is its own write; one naming its target keeps its id for a retry to replay.
+      const namesTarget = structuredAgentSessionWriteNamesItsTarget(fingerprintMethod, fields)
       const clientOperationId =
-        operationIdOverride ?? operationIds.current.get(key) ?? structuredSessionOperationId()
-      operationIds.current.set(key, clientOperationId)
+        operationIdOverride ??
+        (namesTarget ? operationIds.current.get(key) : undefined) ??
+        structuredSessionOperationId()
+      if (namesTarget) {
+        operationIds.current.set(key, clientOperationId)
+      }
       let result: AgentSessionMutationResult<T>
       try {
         result = await callStructuredAgentSession<AgentSessionMutationResult<T>>(target, method, {
@@ -74,31 +103,60 @@ export function useStructuredAgentSessionMutate(args: {
           ...fields
         })
       } catch (error) {
-        if (enabledRef.current && stateRef.current.fence === targetFence) {
-          setWriteError(error instanceof Error ? error.message : 'Request was not sent')
-        }
-        return null
+        return enabledRef.current && stateRef.current.fence === targetFence
+          ? {
+              kind: 'not-done',
+              notice: agentSessionWriteFailureText(
+                agentSessionThrownFailure(
+                  error,
+                  error instanceof RuntimeRpcCallError ? error.code : undefined
+                ),
+                writeKind(fingerprintMethod, fields)
+              )
+            }
+          : { kind: 'dropped' }
       }
       if (!result.ok) {
-        if (agentSessionRefusalOperationState(result.refusal.code) === 'settled-rejected') {
+        const operationState = agentSessionRefusalOperationState(result.refusal.code)
+        // Cancel's plan recovers no unknown ledger row, so a kept id would earn the same refusal
+        // until it expires, and Stop for that turn would do nothing.
+        if (
+          operationState === 'settled-rejected' ||
+          (operationState === 'unknown' && fingerprintMethod === 'agentSession.cancel')
+        ) {
           operationIds.current.delete(key)
         }
-        if (enabledRef.current && stateRef.current.fence === targetFence) {
-          setWriteError(result.refusal.message)
-        }
-        return null
+        return enabledRef.current && stateRef.current.fence === targetFence
+          ? {
+              kind: 'not-done',
+              notice: agentSessionWriteFailureText(
+                agentSessionRefusalFailure(result.refusal),
+                writeKind(fingerprintMethod, fields)
+              )
+            }
+          : { kind: 'dropped' }
       }
       if (!enabledRef.current || stateRef.current.fence !== targetFence) {
-        return null
+        return { kind: 'dropped' }
       }
       if (!conversationCommands.isUnconfirmedConversationCommand(fingerprintMethod, result.value)) {
         operationIds.current.delete(key)
       }
-      setWriteError(null)
-      return result.value
+      return { kind: 'done', value: result.value }
     },
     [enabled, sessionId, stateRef, target]
   )
 
-  return { mutate, writeError, reportWriteError: setWriteError }
+  const mutate = useCallback(
+    async <T>(...writeArgs: WriteArgs): Promise<T | null> => {
+      const outcome = await write<T>(...writeArgs)
+      if (outcome.kind === 'not-done') {
+        toast.error(outcome.notice)
+      }
+      return outcome.kind === 'done' ? outcome.value : null
+    },
+    [write]
+  )
+
+  return { write, mutate }
 }
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-options.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session-options.test.tsx
index 65b39be9a94..53e582af5de 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-options.test.tsx
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-options.test.tsx
@@ -7,9 +7,11 @@ const mocks = vi.hoisted(() => ({
   call: vi.fn(),
   enqueue: vi.fn(),
   hold: vi.fn<(sessionId: string, id: string, encoded: string) => Promise<unknown> | null>(),
-  reportWriteError: vi.fn<(message: string) => void>()
+  toastError: vi.fn<(message: string) => void>()
 }))
 
+vi.mock('sonner', () => ({ toast: { error: mocks.toastError } }))
+
 vi.mock('@/runtime/structured-agent-session-client', () => ({
   callStructuredAgentSession: mocks.call
 }))
@@ -99,7 +101,6 @@ function renderOptions(initial: RenderProps, mutate: StructuredAgentSessionMutat
         turnId: props.turnId ?? null,
         unloadedTurnRevisions: undefined,
         mutate,
-        reportWriteError: mocks.reportWriteError,
         ...(props.launch
           ? {
               launch: {
@@ -164,7 +165,7 @@ describe('useStructuredAgentSessionOptions', () => {
     mocks.call.mockReset()
     mocks.enqueue.mockReset()
     mocks.hold.mockReset()
-    mocks.reportWriteError.mockReset()
+    mocks.toastError.mockReset()
   })
 
   it('upgrades the seed with the host catalog while the live read is still pending', async () => {
@@ -408,7 +409,7 @@ describe('useStructuredAgentSessionOptions', () => {
           picks: [{ modelId: 'gpt-5.6-luna', optionId: 'model', value: 'gpt-5.6-luna' }]
         })
       )
-      expect(mocks.reportWriteError).not.toHaveBeenCalled()
+      expect(mocks.toastError).not.toHaveBeenCalled()
       unmount()
     })
 
@@ -416,7 +417,7 @@ describe('useStructuredAgentSessionOptions', () => {
       answer({})
       mocks.hold.mockResolvedValue({
         kind: 'refused',
-        message: 'Model gpt-5.6-luna is unavailable'
+        failure: { kind: 'refused', code: 'agent_session_operation_capacity' }
       })
       const { result, unmount } = renderOptions(
         { ...PROVISIONAL, launchSeedOptions: SEED },
@@ -426,7 +427,9 @@ describe('useStructuredAgentSessionOptions', () => {
         await result.current.setStructuredOption('model', 'gpt-5.6-luna')
       })
       await waitFor(() =>
-        expect(mocks.reportWriteError).toHaveBeenCalledWith('Model gpt-5.6-luna is unavailable')
+        expect(mocks.toastError).toHaveBeenCalledWith(
+          "Orca has received too many requests in the last day. The setting wasn't changed."
+        )
       )
       expect(mocks.enqueue).not.toHaveBeenCalled()
       unmount()
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-options.ts b/src/renderer/src/components/native-chat/use-structured-agent-session-options.ts
index 3cd1f94add8..e3ee7cd1de0 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-options.ts
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-options.ts
@@ -1,3 +1,4 @@
+import { toast } from 'sonner'
 import { useCallback, useMemo } from 'react'
 import type {
   AgentSessionOptionResult,
@@ -23,6 +24,7 @@ import { encodeStructuredAgentSessionOptionValue } from '../../../../shared/stru
 import type { StructuredAgentSessionMutate } from './use-structured-agent-session-mutate'
 import { useHostModelCatalogUpgrade } from './use-host-model-catalog-upgrade'
 import { useStructuredAgentSessionOptionState } from './use-structured-agent-session-option-state'
+import { agentSessionWriteFailureText } from './agent-session-write-notice-text'
 import type { StructuredAgentSessionLaunchView } from './use-native-chat-provisional-launch'
 import {
   getStructuredAgentSessionLaunchSelection,
@@ -44,7 +46,6 @@ export function useStructuredAgentSessionOptions(args: {
   turnId: string | null
   unloadedTurnRevisions: number | undefined
   mutate: StructuredAgentSessionMutate
-  reportWriteError: (message: string) => void
   launch?: StructuredAgentSessionLaunchView
 }) {
   const {
@@ -53,7 +54,6 @@ export function useStructuredAgentSessionOptions(args: {
     launch,
     mutate,
     providerVisible,
-    reportWriteError,
     sessionId,
     target,
     transportEnabled,
@@ -187,7 +187,7 @@ export function useStructuredAgentSessionOptions(args: {
   const settleLaunchOptionPick = useCallback(
     (outcome: StructuredLaunchOptionOutcome) => {
       if (outcome.kind === 'refused') {
-        reportWriteError(outcome.message)
+        toast.error(agentSessionWriteFailureText(outcome.failure, 'option'))
       } else if (outcome.kind === 'accepted') {
         rememberOptionPicks(
           structuredAgentSessionOptionView(
@@ -199,7 +199,7 @@ export function useStructuredAgentSessionOptions(args: {
         )
       }
     },
-    [launchSeedOptions, optionStateRef, rememberOptionPicks, reportWriteError]
+    [launchSeedOptions, optionStateRef, rememberOptionPicks]
   )
   const optionSnapshot = useMemo(() => {
     const snapshot = structuredAgentSessionOptionSnapshot(
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-admission.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-admission.test.tsx
index 0fff127cd2c..feb9f898ce2 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-admission.test.tsx
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-admission.test.tsx
@@ -21,6 +21,8 @@ vi.mock('@/runtime/structured-agent-session-client', () => ({
 import { useStructuredAgentSessionOutbox } from './use-structured-agent-session-outbox'
 import { enqueueStructuredAgentSessionLaunchPrompt } from './structured-agent-session-outbox-storage'
 import { settleStructuredAgentLaunchPrompt } from '@/lib/structured-agent-session-launch-prompt'
+import { structuredAgentSessionDeliveryNotices } from './structured-agent-session-delivery-notices'
+import { agentJournalSubmissionKey } from '../../../../shared/agent-session-journal-item-key'
 
 const LOCAL_TARGET = { kind: 'local' } as const
 
@@ -32,12 +34,19 @@ function deferred<T>() {
   return { promise, resolve }
 }
 
-type SendRequest = { body?: { blocks?: { text?: string }[] } }
+type SendRequest = {
+  body?: { blocks?: { text?: string }[] }
+  envelope?: { clientOperationId?: string }
+}
 
 function requestText(params: SendRequest | undefined): string | undefined {
   return params?.body?.blocks?.[0]?.text
 }
 
+function requestId(params: SendRequest | undefined): string {
+  return String(params?.envelope?.clientOperationId)
+}
+
 function sentTexts(): (string | undefined)[] {
   return mocks.call.mock.calls.map((call) => requestText(call[2]))
 }
@@ -219,4 +228,94 @@ describe('structured agent session outbox admission', () => {
     await act(async () => admission.resolve(submissionResult(String(id), 'pending', 10)))
     expect(sentTexts()).toEqual(['first', 'second'])
   })
+
+  // A message the queue is held on goes out only by its own Retry, never another message's.
+  it("keeps a refused message held when a rejected message's Retry shows while a head waits", async () => {
+    const inFlight = deferred<ReturnType<typeof submissionResult>>()
+    mocks.call.mockImplementation((_target, _method, params) => {
+      const text = requestText(params)
+      const attempt = sentTexts().filter((sent) => sent === text).length
+      const id = requestId(params)
+      if (text === 'held') {
+        return Promise.resolve(refusedResult('agent_session_ownership_unknown'))
+      }
+      if (attempt === 1) {
+        return Promise.resolve(refusedResult('agent_session_owner_restart_failed'))
+      }
+      return text === 'x' ? inFlight.promise : Promise.resolve(submissionResult(id, 'accepted', 20))
+    })
+    const { result } = renderOutbox()
+    for (const text of ['x', 'a', 'c']) {
+      act(() => expect(result.current.send(text)).toBe(true))
+      await waitFor(() => expect(result.current.outbox.at(-1)?.state).toBe('rejected'))
+    }
+    act(() => expect(result.current.send('held')).toBe(true))
+    await waitFor(() => expect(result.current.blockedClientMessageId).not.toBeNull())
+    const heldId = result.current.blockedClientMessageId
+    const [x, a, c] = result.current.outbox
+
+    // x goes out and stays in flight, so a, retried after it, waits queued ahead of the held one.
+    act(() => result.current.retry(x!.clientMessageId))
+    await waitFor(() => expect(sentTexts()).toEqual(['x', 'a', 'c', 'held', 'x']))
+    act(() => result.current.retry(a!.clientMessageId))
+    await settleTimers(20)
+    // The drain would send a next, so the queue reads as moving and c offers its own Retry.
+    const notices = structuredAgentSessionDeliveryNotices(
+      result.current.outbox,
+      result.current.blockedClientMessageId,
+      'Claude',
+      () => {},
+      [],
+      []
+    )
+    expect(notices.get(agentJournalSubmissionKey(c!.clientMessageId))?.onRetry).toBeDefined()
+
+    act(() => result.current.retry(c!.clientMessageId))
+    expect(result.current.blockedClientMessageId).toBe(heldId)
+    await act(async () => inFlight.resolve(submissionResult(x!.clientMessageId, 'accepted', 20)))
+    await waitFor(() => expect(result.current.outbox).toHaveLength(1))
+    await settleTimers(50)
+    expect(sentTexts().filter((text) => text === 'held')).toHaveLength(1)
+    expect(result.current.blockedClientMessageId).toBe(heldId)
+  })
+
+  it('keeps a refused message held when an unconfirmed message ahead of it is retried', async () => {
+    const none: readonly AgentJournalSubmission[] = []
+    mocks.call.mockImplementation((_target, _method, params) => {
+      const id = requestId(params)
+      if (requestText(params) === 'held') {
+        return Promise.resolve(refusedResult('agent_session_ownership_unknown'))
+      }
+      const sent = sentTexts().filter((text) => text === 'first').length
+      return Promise.resolve(submissionResult(id, sent === 1 ? 'pending' : 'accepted', 10))
+    })
+    const { result, rerender } = renderHook(
+      ({ submissions }: { submissions: readonly AgentJournalSubmission[] }) =>
+        useStructuredAgentSessionOutbox({
+          sessionId: 'session-1',
+          target: LOCAL_TARGET,
+          fence: 1,
+          submissions
+        }),
+      { initialProps: { submissions: none } }
+    )
+    act(() => expect(result.current.send('first')).toBe(true))
+    await waitFor(() => expect(result.current.outbox[0]?.state).toBe('dispatching'))
+    act(() => expect(result.current.send('held')).toBe(true))
+    await waitFor(() => expect(result.current.blockedClientMessageId).not.toBeNull())
+    const heldId = result.current.blockedClientMessageId
+    const firstId = String(result.current.outbox[0]?.clientMessageId)
+    const unknown: AgentJournalSubmission = {
+      ...submissionResult(firstId, 'pending', 10).value.submission,
+      dispatchState: 'unknown'
+    }
+    rerender({ submissions: [unknown] })
+    await waitFor(() => expect(result.current.outbox[0]?.state).toBe('unconfirmed'))
+
+    act(() => result.current.retry(firstId))
+    await waitFor(() => expect(result.current.outbox).toHaveLength(1))
+    await settleTimers(50)
+    expect(sentTexts()).toEqual(['first', 'held', 'first'])
+    expect(result.current.blockedClientMessageId).toBe(heldId)
+  })
 })
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-fence.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-fence.test.tsx
new file mode 100644
index 00000000000..61b5ea95e72
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-fence.test.tsx
@@ -0,0 +1,139 @@
+// @vitest-environment happy-dom
+
+// A moved fence is not a reason to send anything again on a host that records every send before it
+// starts an agent. There, only a Retry or a new send goes out. An older host, which restarts the
+// agent inside the send and refuses it unrecorded when that fails, keeps the resend on a new fence.
+
+import { act, renderHook, waitFor } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY } from '../../../../shared/protocol-version'
+
+const mocks = vi.hoisted(() => ({ call: vi.fn() }))
+
+vi.mock('@/runtime/structured-agent-session-client', () => ({
+  callStructuredAgentSession: mocks.call
+}))
+
+import { setLocalRuntimeCapabilitiesForTests } from '@/runtime/local-runtime-capabilities'
+import { useStructuredAgentSessionOutbox } from './use-structured-agent-session-outbox'
+
+const LOCAL_TARGET = { kind: 'local' } as const
+
+function deferred<T>() {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((next) => {
+    resolve = next
+  })
+  return { promise, resolve }
+}
+
+function pendingResult(clientMessageId: string) {
+  return {
+    ok: true,
+    replayed: false,
+    fence: 1,
+    cursor: { epoch: 'epoch-1', sequence: 1 },
+    value: {
+      clientMessageId,
+      submission: {
+        clientMessageId,
+        fence: 1,
+        payloadFingerprint: 'fingerprint',
+        dispatchState: 'pending' as const,
+        handoverRecorded: true,
+        providerItemId: null,
+        reason: null,
+        submittedAt: 1,
+        resolvedAt: null
+      }
+    }
+  }
+}
+
+function sentId(call: number): string {
+  const id: unknown = mocks.call.mock.calls[call]?.[2].envelope.clientOperationId
+  return String(id)
+}
+
+function render() {
+  return renderHook(
+    ({ fence }) =>
+      useStructuredAgentSessionOutbox({
+        sessionId: 'session-1',
+        target: LOCAL_TARGET,
+        fence,
+        submissions: []
+      }),
+    { initialProps: { fence: 1 } }
+  )
+}
+
+/** Long enough for any effect a fence change schedules to have sent. */
+async function settle(): Promise<void> {
+  await act(() => new Promise<void>((resolve) => setTimeout(resolve, 50)))
+}
+
+describe('an outbox on a host that accepts a send before any agent has it', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    localStorage.clear()
+    setLocalRuntimeCapabilitiesForTests([AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY])
+  })
+
+  it('neither resends nor drops the answer of a send in flight when the fence moves', async () => {
+    const answer = deferred<ReturnType<typeof pendingResult>>()
+    mocks.call.mockReturnValueOnce(answer.promise)
+    const { result, rerender } = render()
+
+    act(() => expect(result.current.send('hello')).toBe(true))
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(1))
+    // A start or restart on the host moves the fence while the send is out.
+    rerender({ fence: 2 })
+    rerender({ fence: 3 })
+    await settle()
+    expect(mocks.call).toHaveBeenCalledTimes(1)
+
+    await act(async () => answer.resolve(pendingResult(sentId(0))))
+    // The answer lands: the entry is the host's now, not re-queued behind a moved fence.
+    expect(result.current.outbox).toMatchObject([{ state: 'dispatching' }])
+    await settle()
+    expect(mocks.call).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps a blocked head blocked across a fence change; only Retry sends it', async () => {
+    mocks.call.mockRejectedValueOnce(new Error('send failed')).mockResolvedValue({ ok: true })
+    const { result, rerender } = render()
+
+    act(() => expect(result.current.send('hello')).toBe(true))
+    await waitFor(() => expect(result.current.blockedClientMessageId).not.toBeNull())
+    rerender({ fence: 2 })
+    await settle()
+    expect(mocks.call).toHaveBeenCalledTimes(1)
+    // The failure stays on the message; the fence change neither clears nor resends it.
+    expect(result.current.outbox[0]?.lastFailure).toEqual({ kind: 'failed' })
+
+    act(() => result.current.retry(result.current.outbox[0]!.clientMessageId))
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(2))
+  })
+})
+
+describe('an outbox on an older host', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    localStorage.clear()
+    setLocalRuntimeCapabilitiesForTests([])
+  })
+
+  it('still resends a send in flight when the fence moves, as the new owner may take it', async () => {
+    mocks.call.mockReturnValueOnce(new Promise(() => {})).mockReturnValue(new Promise(() => {}))
+    const { result, rerender } = render()
+
+    act(() => expect(result.current.send('hello')).toBe(true))
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(1))
+    rerender({ fence: 2 })
+
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(2))
+    expect(sentId(1)).toBe(sentId(0))
+  })
+})
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-rejection-cause.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-rejection-cause.test.tsx
index d66f579ed0d..3ce99e6fd4b 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-rejection-cause.test.tsx
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-rejection-cause.test.tsx
@@ -1,7 +1,9 @@
 // @vitest-environment happy-dom
 
 import { act, renderHook, waitFor } from '@testing-library/react'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentJournalSubmission } from '../../../../shared/agent-session-journal-types'
+import { DISPATCH_REJECTED_CANCELLED } from '../../../../shared/structured-agent-session-dispatch-rejection'
 
 const mocks = vi.hoisted(() => ({
   call: vi.fn()
@@ -11,12 +13,49 @@ vi.mock('@/runtime/structured-agent-session-client', () => ({
   callStructuredAgentSession: mocks.call
 }))
 
+import { setLocalRuntimeCapabilitiesForTests } from '@/runtime/local-runtime-capabilities'
 import { useStructuredAgentSessionOutbox } from './use-structured-agent-session-outbox'
+import { agentSessionWriteNoticeEnglish } from '../../../../shared/agent-session-refusal-notice'
+import { structuredAgentSessionAttemptFailureParts } from '../../../../shared/structured-agent-session-send-disposition'
+import {
+  createStructuredAgentSessionOutboxEntry,
+  type StructuredAgentSessionOutboxEntry
+} from '../../../../shared/structured-agent-session-outbox'
+import { writeOutbox } from './structured-agent-session-outbox-storage'
+
+function shownFailure(entry: StructuredAgentSessionOutboxEntry | undefined): string | undefined {
+  return (
+    entry?.lastFailure &&
+    agentSessionWriteNoticeEnglish(structuredAgentSessionAttemptFailureParts(entry.lastFailure))
+  )
+}
 
 // What the host answers when the child it restarted for this send died before starting.
 const REASON =
   'The provider stopped before it finished starting: claude stream-json exited (code 1): claude: not signed in.'
 
+function acceptedResultFor(clientMessageId: string) {
+  return {
+    ok: true,
+    replayed: false,
+    fence: 1,
+    cursor: { epoch: 'epoch-1', sequence: 2 },
+    value: {
+      clientMessageId,
+      submission: {
+        clientMessageId,
+        fence: 1,
+        payloadFingerprint: 'fingerprint',
+        dispatchState: 'accepted',
+        providerItemId: `provider-${clientMessageId}`,
+        reason: null,
+        submittedAt: 1,
+        resolvedAt: 1
+      }
+    }
+  }
+}
+
 function rejectedResultFor(clientMessageId: string) {
   return {
     ok: true,
@@ -45,7 +84,7 @@ describe('a send the host rejected because the agent never started', () => {
     localStorage.clear()
   })
 
-  it('names the cause under the composer and keeps the message for Retry', async () => {
+  it('names the cause on the message and keeps it for Retry', async () => {
     mocks.call.mockImplementationOnce(
       async (
         _target: unknown,
@@ -64,8 +103,350 @@ describe('a send the host rejected because the agent never started', () => {
 
     act(() => expect(result.current.send('hello')).toBe(true))
 
-    await waitFor(() => expect(result.current.error).toBe(REASON))
-    expect(result.current.outbox[0]?.state).toBe('queued')
-    expect(result.current.blockedClientMessageId).toBe(result.current.outbox[0]?.clientMessageId)
+    await waitFor(() => expect(shownFailure(result.current.outbox[0])).toBe(REASON))
+    // Settled as not delivered: it waits for Retry and holds no later message up.
+    expect(result.current.error).toBeNull()
+    expect(result.current.outbox[0]?.state).toBe('rejected')
+    expect(result.current.blockedClientMessageId).toBeNull()
+  })
+
+  it('sends a new message past one the host could not start the agent for, without resending it', async () => {
+    const message = "Claude couldn't restart: Not logged in. Please run /login."
+    mocks.call.mockImplementation(async (_target, _method, params) => {
+      const request = params as {
+        envelope: { clientOperationId: string }
+        body: { blocks: { text?: string }[] }
+      }
+      return request.body.blocks[0]?.text === 'first'
+        ? { ok: false, refusal: { code: 'agent_session_owner_restart_failed', message } }
+        : acceptedResultFor(request.envelope.clientOperationId)
+    })
+    const { result } = renderHook(() =>
+      useStructuredAgentSessionOutbox({
+        sessionId: 'session-1',
+        target: { kind: 'local' },
+        fence: 1,
+        submissions: []
+      })
+    )
+
+    act(() => expect(result.current.send('first')).toBe(true))
+    await waitFor(() => expect(result.current.outbox[0]?.state).toBe('rejected'))
+    const rejectedId = result.current.outbox[0]!.clientMessageId
+
+    // The user's next message is the retry of the start: it goes out on its own.
+    act(() => expect(result.current.send('second')).toBe(true))
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(2))
+    await act(() => new Promise((resolve) => setTimeout(resolve, 50)))
+
+    const sent = mocks.call.mock.calls.map(
+      (call) => (call[2] as { body?: { blocks?: { text?: string }[] } })?.body?.blocks?.[0]?.text
+    )
+    expect(sent).toEqual(['first', 'second'])
+    expect(result.current.outbox.map((entry) => [entry.clientMessageId, entry.state])).toEqual([
+      [rejectedId, 'rejected']
+    ])
+  })
+
+  it('keeps a message the host accepted and then could not deliver, with its reason and Retry', async () => {
+    const reason = "Codex couldn't restart: spawn codex ENOENT."
+    mocks.call.mockImplementation(
+      async (
+        _target: unknown,
+        _method: unknown,
+        params: { envelope: { clientOperationId: string } }
+      ) => pendingResultFor(params.envelope.clientOperationId)
+    )
+    const target = { kind: 'local' } as const
+    const { result, rerender } = renderHook(
+      (props: { submissions: AgentJournalSubmission[] }) =>
+        useStructuredAgentSessionOutbox({
+          sessionId: 'session-1',
+          target,
+          fence: 1,
+          submissions: props.submissions
+        }),
+      { initialProps: { submissions: NO_SUBMISSIONS } }
+    )
+
+    act(() => expect(result.current.send('hello')).toBe(true))
+    await waitFor(() => expect(result.current.outbox[0]?.state).toBe('dispatching'))
+    const id = result.current.outbox[0]!.clientMessageId
+
+    rerender({
+      submissions: [{ ...pendingResultFor(id).value.submission, dispatchState: 'rejected', reason }]
+    })
+
+    await waitFor(() => expect(result.current.outbox[0]?.state).toBe('rejected'))
+    expect(shownFailure(result.current.outbox[0])).toBe(reason)
+    expect(result.current.error).toBeNull()
+    expect(result.current.blockedClientMessageId).toBeNull()
+
+    // Retry is a new message with the same text: a fresh id, sent once.
+    act(() => result.current.retry(id))
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(2))
+    const retried: {
+      envelope: { clientOperationId: string }
+      body: { blocks: { text?: string }[] }
+    } = mocks.call.mock.calls[1]![2]
+    expect(retried.envelope.clientOperationId).not.toBe(id)
+    expect(retried.body.blocks[0]?.text).toBe('hello')
+  })
+
+  it('says nothing when a Stop withdrew the message', async () => {
+    mocks.call.mockImplementation(
+      async (
+        _target: unknown,
+        _method: unknown,
+        params: { envelope: { clientOperationId: string } }
+      ) => pendingResultFor(params.envelope.clientOperationId)
+    )
+    const target = { kind: 'local' } as const
+    const { result, rerender } = renderHook(
+      (props: { submissions: AgentJournalSubmission[] }) =>
+        useStructuredAgentSessionOutbox({
+          sessionId: 'session-1',
+          target,
+          fence: 1,
+          submissions: props.submissions
+        }),
+      { initialProps: { submissions: NO_SUBMISSIONS } }
+    )
+
+    act(() => expect(result.current.send('hello')).toBe(true))
+    await waitFor(() => expect(result.current.outbox[0]?.state).toBe('dispatching'))
+    const id = result.current.outbox[0]!.clientMessageId
+
+    rerender({
+      submissions: [
+        {
+          ...pendingResultFor(id).value.submission,
+          dispatchState: 'rejected',
+          reason: DISPATCH_REJECTED_CANCELLED
+        }
+      ]
+    })
+
+    await waitFor(() => expect(result.current.outbox).toEqual([]))
+    expect(result.current.error).toBeNull()
+  })
+
+  it('reads a message rejected while the chat was closed as not sent, and sends past it', async () => {
+    const reason = "Codex couldn't restart: spawn codex ENOENT."
+    mocks.call.mockImplementation(
+      async (
+        _target: unknown,
+        _method: unknown,
+        params: { envelope: { clientOperationId: string } }
+      ) => pendingResultFor(params.envelope.clientOperationId)
+    )
+    const target = { kind: 'local' } as const
+    const first = renderHook(() =>
+      useStructuredAgentSessionOutbox({
+        sessionId: 'session-1',
+        target,
+        fence: 1,
+        submissions: NO_SUBMISSIONS
+      })
+    )
+    act(() => expect(first.result.current.send('hello')).toBe(true))
+    await waitFor(() => expect(first.result.current.outbox[0]?.state).toBe('dispatching'))
+    const id = first.result.current.outbox[0]!.clientMessageId
+    first.unmount()
+
+    // Reopened after the start failed, or after a quit settled the message as not sent.
+    const rejected = [
+      { ...pendingResultFor(id).value.submission, dispatchState: 'rejected' as const, reason }
+    ]
+    const { result } = renderHook(() =>
+      useStructuredAgentSessionOutbox({
+        sessionId: 'session-1',
+        target,
+        fence: 1,
+        submissions: rejected
+      })
+    )
+
+    await waitFor(() => expect(result.current.outbox[0]?.state).toBe('rejected'))
+    expect(shownFailure(result.current.outbox[0])).toBe(reason)
+    act(() => expect(result.current.send('second')).toBe(true))
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(2))
+  })
+
+  // After a restart nothing in memory remembers the rejection, and its journal row may be older
+  // than the loaded page: the message's own state is what says a resend needs a new id.
+  it('retries a message rejected before a restart under a new id', async () => {
+    const rejected = createStructuredAgentSessionOutboxEntry({
+      clientMessageId: 'rejected-before-restart',
+      sessionId: 'session-1',
+      text: 'first',
+      attachments: [],
+      queuedAt: 1
+    })
+    writeOutbox('session-1', [
+      {
+        ...rejected,
+        state: 'rejected',
+        lastFailure: {
+          kind: 'rejected',
+          reason: 'The provider did not accept this message.',
+          rejection: { kind: 'providerRejected' }
+        }
+      }
+    ])
+    mocks.call.mockImplementation(async (_target, _method, params) =>
+      acceptedResultFor(String(params.envelope.clientOperationId))
+    )
+    const { result } = renderHook(() =>
+      useStructuredAgentSessionOutbox({
+        sessionId: 'session-1',
+        target: { kind: 'local' },
+        fence: 1,
+        submissions: []
+      })
+    )
+    expect(result.current.outbox[0]?.state).toBe('rejected')
+
+    act(() => result.current.retry('rejected-before-restart'))
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledOnce())
+    const sentId: unknown = mocks.call.mock.calls[0]![2].envelope.clientOperationId
+    expect(sentId).not.toBe('rejected-before-restart')
+    await waitFor(() => expect(result.current.outbox).toHaveLength(0))
+  })
+
+  it('keeps the rejection when the journal settles the message before the send answers', async () => {
+    const reason = "Codex couldn't restart: spawn codex ENOENT."
+    let answer: (value: unknown) => void = () => undefined
+    mocks.call.mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          answer = resolve
+        })
+    )
+    const target = { kind: 'local' } as const
+    const { result, rerender } = renderHook(
+      (props: { submissions: AgentJournalSubmission[] }) =>
+        useStructuredAgentSessionOutbox({
+          sessionId: 'session-1',
+          target,
+          fence: 1,
+          submissions: props.submissions
+        }),
+      { initialProps: { submissions: NO_SUBMISSIONS } }
+    )
+
+    act(() => expect(result.current.send('hello')).toBe(true))
+    await waitFor(() => expect(result.current.outbox[0]?.state).toBe('dispatching'))
+    const id = result.current.outbox[0]!.clientMessageId
+
+    // A start refused at once: the rejection frame lands before the send's own `pending` answer.
+    rerender({
+      submissions: [{ ...pendingResultFor(id).value.submission, dispatchState: 'rejected', reason }]
+    })
+    await waitFor(() => expect(result.current.outbox[0]?.state).toBe('rejected'))
+    await act(async () => answer(pendingResultFor(id)))
+
+    expect(result.current.outbox[0]?.state).toBe('rejected')
+    expect(shownFailure(result.current.outbox[0])).toBe(reason)
+    expect(result.current.error).toBeNull()
+  })
+})
+
+const NO_SUBMISSIONS: AgentJournalSubmission[] = []
+
+function pendingResultFor(clientMessageId: string) {
+  const submission: AgentJournalSubmission = {
+    clientMessageId,
+    fence: 1,
+    payloadFingerprint: 'fingerprint',
+    dispatchState: 'pending',
+    providerItemId: null,
+    reason: null,
+    submittedAt: 1,
+    resolvedAt: null,
+    handoverRecorded: true
+  }
+  return {
+    ok: true,
+    replayed: false,
+    fence: 1,
+    cursor: { epoch: 'epoch-1', sequence: 2 },
+    value: {
+      clientMessageId,
+      submission
+    }
+  }
+}
+
+// Stable across renders, as a mounted pane's target is.
+const LOCAL_TARGET = { kind: 'local' } as const
+
+function submission(
+  clientMessageId: string,
+  dispatchState: 'pending' | 'accepted'
+): AgentJournalSubmission {
+  return {
+    clientMessageId,
+    fence: 3,
+    payloadFingerprint: 'fingerprint',
+    dispatchState,
+    providerItemId: null,
+    reason: null,
+    submittedAt: 10,
+    resolvedAt: dispatchState === 'accepted' ? 11 : null
+  }
+}
+
+// An older host: it restarts the agent inside the send, so a new fence is its word to send again.
+describe('a send refused while its agent restarted', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    localStorage.clear()
+    setLocalRuntimeCapabilitiesForTests([])
+  })
+
+  afterEach(() => {
+    setLocalRuntimeCapabilitiesForTests(null)
+  })
+
+  // The live order: the restart takes seconds, so the journal settles the resend before its reply.
+  it('leaves no error behind once a send refused before an agent restart is delivered', async () => {
+    mocks.call
+      .mockResolvedValueOnce({
+        ok: false,
+        refusal: {
+          code: 'agent_session_checkpoint_stale',
+          message: 'Expected runtime fence 1; the session is at 3.'
+        }
+      })
+      .mockReturnValueOnce(new Promise(() => {}))
+    const { result, rerender } = renderHook(
+      ({ fence, submissions }: { fence: number; submissions: AgentJournalSubmission[] }) =>
+        useStructuredAgentSessionOutbox({
+          sessionId: 'session-1',
+          target: LOCAL_TARGET,
+          fence,
+          submissions
+        }),
+      { initialProps: { fence: 1, submissions: NO_SUBMISSIONS } }
+    )
+
+    act(() => expect(result.current.send('hello')).toBe(true))
+    await waitFor(() =>
+      expect(shownFailure(result.current.outbox[0])).toBe('Your message was not sent.')
+    )
+
+    // The pane learns the new owner and sends the same message again.
+    rerender({ fence: 3, submissions: [] })
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(2))
+    expect(result.current.outbox[0]).toMatchObject({ state: 'dispatching' })
+    expect(shownFailure(result.current.outbox[0])).toBeUndefined()
+
+    const id = result.current.outbox[0]!.clientMessageId
+    rerender({ fence: 3, submissions: [submission(id, 'pending')] })
+    rerender({ fence: 3, submissions: [submission(id, 'accepted')] })
+    await waitFor(() => expect(result.current.outbox).toHaveLength(0))
+    expect(result.current.error).toBeNull()
+    expect(result.current.blockedClientMessageId).toBeNull()
   })
 })
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-unconfirmed-probe.ts b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-unconfirmed-probe.ts
new file mode 100644
index 00000000000..e4e49c11975
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-unconfirmed-probe.ts
@@ -0,0 +1,77 @@
+import { useEffect, useLayoutEffect, useRef, type Dispatch, type SetStateAction } from 'react'
+import type { AgentJournalSubmission } from '../../../../shared/agent-session-journal-types'
+import type { StructuredAgentSessionOutboxEntry } from '../../../../shared/structured-agent-session-outbox'
+import { writeOutbox } from './structured-agent-session-outbox-storage'
+
+const UNCONFIRMED_PROBE_BASE_DELAY_MS = 1_000
+/** No attempt ceiling: a transport outage outlives any fixed budget, and giving up
+ *  restores the wedge this fixes. Growth caps the rate at one status query per 16s.
+ *  A refusal that blocks the head still ends probing until a manual Retry (or, on an older
+ *  host, a fence change), because the entry leaves `unconfirmed`. */
+const UNCONFIRMED_PROBE_MAX_DELAY_MS = 16_000
+
+/** Re-queues the entry holding the outbox in `unconfirmed`, with backoff, until the journal answers it. */
+export function useStructuredAgentSessionOutboxUnconfirmedProbe(args: {
+  sessionId: string
+  outbox: readonly StructuredAgentSessionOutboxEntry[]
+  submissions: readonly AgentJournalSubmission[]
+  owner: { attached: boolean; ownerChange: number | null; targetKey: string }
+  outboxRef: { current: StructuredAgentSessionOutboxEntry[] }
+  setOutbox: Dispatch<SetStateAction<StructuredAgentSessionOutboxEntry[]>>
+}): void {
+  const { outbox, outboxRef, owner, sessionId, setOutbox, submissions } = args
+  const probeAttemptsRef = useRef({ id: null as string | null, attempts: 0 })
+  useLayoutEffect(() => {
+    probeAttemptsRef.current = { id: null, attempts: 0 }
+  }, [owner.ownerChange, owner.targetKey, sessionId])
+
+  // A transport-side unknown may never have reached the host, and nothing else
+  // moves it out of `unconfirmed`, so one wedges the whole FIFO queue. Re-issuing
+  // the same envelope without `retryUnknown` is idempotent: the operation ledger
+  // replays a recorded outcome, or the host performs a genuine first delivery.
+  // A host-confirmed unknown stays parked until the user explicitly asks Retry
+  // to replay the same operation.
+  // The first `unconfirmed` entry is the one holding the queue, at whatever index it sits: an
+  // unconfirmed tail behind an admitted head would otherwise wedge until the head cleared,
+  // which is the wedge this probe exists to prevent.
+  const blocker = outbox.find((entry) => entry.state === 'unconfirmed')
+  // Depend on primitives: `submissions` is rebuilt on every streaming batch, so an
+  // array-identity dep would reset the backoff forever while the agent is working.
+  // A non-null `retryAfterUnknownSubmittedAt` means the user already retried, so
+  // another request would repeat that explicit action. Only entries that have
+  // never been retried are safe to probe automatically.
+  const probeId =
+    blocker && blocker.sessionId === sessionId && blocker.retryAfterUnknownSubmittedAt === null
+      ? blocker.clientMessageId
+      : null
+  const probeSettled =
+    probeId !== null && submissions.some((submission) => submission.clientMessageId === probeId)
+  useEffect(() => {
+    if (probeId === null || probeSettled || !owner.attached) {
+      return
+    }
+    const attempts = probeAttemptsRef.current.id === probeId ? probeAttemptsRef.current.attempts : 0
+    const timer = setTimeout(
+      () => {
+        probeAttemptsRef.current = { id: probeId, attempts: attempts + 1 }
+        const next = outboxRef.current.map((entry) =>
+          entry.clientMessageId === probeId ? { ...entry, state: 'queued' as const } : entry
+        )
+        outboxRef.current = next
+        setOutbox(next)
+        writeOutbox(sessionId, next)
+      },
+      Math.min(UNCONFIRMED_PROBE_BASE_DELAY_MS * 2 ** attempts, UNCONFIRMED_PROBE_MAX_DELAY_MS)
+    )
+    return () => clearTimeout(timer)
+  }, [
+    outboxRef,
+    owner.attached,
+    owner.ownerChange,
+    owner.targetKey,
+    probeId,
+    probeSettled,
+    sessionId,
+    setOutbox
+  ])
+}
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-withdrawal.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-withdrawal.test.tsx
new file mode 100644
index 00000000000..f188c01919f
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-withdrawal.test.tsx
@@ -0,0 +1,168 @@
+// What a Stop does to the messages this client sent that the host does not hold yet: nothing may go
+// out after the Stop, and nothing the host already holds or already refused changes here.
+
+// @vitest-environment happy-dom
+
+import { act, cleanup, renderHook, waitFor } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentJournalSubmission } from '../../../../shared/agent-session-journal-types'
+import type { StructuredAgentSessionOutboxEntry } from '../../../../shared/structured-agent-session-outbox'
+import {
+  hasUnsentStructuredAgentSessionOutboxEntry,
+  withdrawUnsentStructuredAgentSessionOutboxEntries
+} from '../../../../shared/structured-agent-session-outbox-stop-withdrawal'
+
+type SendRequest = { body?: { blocks?: { text?: string }[] } }
+
+const mocks = vi.hoisted(() => ({
+  call: vi.fn<(target: unknown, method: string, params: SendRequest) => Promise<unknown>>()
+}))
+
+vi.mock('@/runtime/structured-agent-session-client', () => ({
+  callStructuredAgentSession: mocks.call
+}))
+
+import { useStructuredAgentSessionOutbox } from './use-structured-agent-session-outbox'
+import { readOutbox } from './structured-agent-session-outbox-storage'
+
+// One object: a target rebuilt each render reads as a new owner, which re-sends what is on its way.
+const TARGET = { kind: 'local' } as const
+
+function sentTexts(): (string | undefined)[] {
+  return mocks.call.mock.calls.map((call) => call[2].body?.blocks?.[0]?.text)
+}
+
+function pending(clientMessageId: string): AgentJournalSubmission {
+  return {
+    clientMessageId,
+    fence: 1,
+    payloadFingerprint: 'fingerprint',
+    dispatchState: 'pending',
+    providerItemId: null,
+    reason: null,
+    submittedAt: 10,
+    resolvedAt: null,
+    handoverRecorded: true
+  }
+}
+
+function entry(
+  clientMessageId: string,
+  state: StructuredAgentSessionOutboxEntry['state']
+): StructuredAgentSessionOutboxEntry {
+  return {
+    clientMessageId,
+    sessionId: 'session-1',
+    body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: clientMessageId }] },
+    previewUris: [],
+    state,
+    queuedAt: 1,
+    lastAttemptAt: null,
+    retryAfterUnknownSubmittedAt: null
+  }
+}
+
+afterEach(cleanup)
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  localStorage.clear()
+  let uuid = 0
+  vi.spyOn(globalThis.crypto, 'randomUUID').mockImplementation(() => {
+    uuid += 1
+    return `11111111-1111-4111-8111-${uuid.toString(16).padStart(12, '0')}`
+  })
+})
+
+describe('a Stop withdrawing what the host does not hold', () => {
+  it('leaves the send on its way to the host and keeps every message behind it from going out', async () => {
+    const reply = Promise.withResolvers<unknown>()
+    mocks.call.mockImplementation((_target, _method, params) =>
+      params.body?.blocks?.[0]?.text === 'first' ? reply.promise : new Promise<never>(() => {})
+    )
+    const { result } = renderHook(() =>
+      useStructuredAgentSessionOutbox({
+        sessionId: 'session-1',
+        target: TARGET,
+        fence: 1,
+        submissions: []
+      })
+    )
+    act(() => expect(result.current.send('first')).toBe(true))
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(1))
+    act(() => expect(result.current.send('second')).toBe(true))
+    const firstId = result.current.outbox[0]!.clientMessageId
+
+    act(() => result.current.withdrawUnsent())
+    await act(async () =>
+      reply.resolve({
+        ok: true,
+        replayed: false,
+        fence: 1,
+        cursor: { epoch: 'epoch-1', sequence: 10 },
+        value: { clientMessageId: firstId, submission: pending(firstId) }
+      })
+    )
+    await act(async () => new Promise((resolve) => setTimeout(resolve, 50)))
+
+    // The host's answer to it, not this Stop, decides whether it comes back.
+    expect(result.current.outbox.map((candidate) => candidate.clientMessageId)).toEqual([firstId])
+    expect(readOutbox('session-1').map((candidate) => candidate.clientMessageId)).toEqual([firstId])
+    expect(sentTexts()).toEqual(['first'])
+  })
+
+  it('leaves what the journal holds to the host, and a refused message to its Retry', () => {
+    const entries = [
+      entry('held', 'dispatching'),
+      entry('refused', 'rejected'),
+      entry('in-doubt', 'unconfirmed'),
+      entry('local', 'queued')
+    ]
+
+    expect(
+      withdrawUnsentStructuredAgentSessionOutboxEntries(entries, [pending('held')], null, null).map(
+        (candidate) => candidate.clientMessageId
+      )
+    ).toEqual(['held', 'refused'])
+  })
+
+  it('leaves every message that waits on its Retry, not only a refused one', () => {
+    const entries = [
+      entry('blocked', 'queued'),
+      { ...entry('retried-in-doubt', 'unconfirmed'), retryAfterUnknownSubmittedAt: 10 },
+      entry('probed-in-doubt', 'unconfirmed'),
+      entry('local', 'queued')
+    ]
+
+    expect(
+      withdrawUnsentStructuredAgentSessionOutboxEntries(entries, [], 'blocked', null).map(
+        (candidate) => candidate.clientMessageId
+      )
+    ).toEqual(['blocked', 'retried-in-doubt'])
+    expect(hasUnsentStructuredAgentSessionOutboxEntry(entries.slice(0, 2), [], 'blocked')).toBe(
+      false
+    )
+    expect(hasUnsentStructuredAgentSessionOutboxEntry(entries, [], 'blocked')).toBe(true)
+  })
+
+  it('keeps a message whose send failed for its Retry', async () => {
+    mocks.call.mockRejectedValue(new Error('the host refused the frame'))
+    const { result } = renderHook(() =>
+      useStructuredAgentSessionOutbox({
+        sessionId: 'session-1',
+        target: TARGET,
+        fence: 1,
+        submissions: []
+      })
+    )
+    act(() => expect(result.current.send('first')).toBe(true))
+    await waitFor(() => expect(result.current.blockedClientMessageId).not.toBeNull())
+
+    act(() => result.current.withdrawUnsent())
+
+    expect(result.current.outbox.map((candidate) => candidate.body.blocks)).toEqual([
+      [{ type: 'text', text: 'first' }]
+    ])
+    expect(readOutbox('session-1')).toHaveLength(1)
+  })
+})
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx
index 613a599c2a6..04b25f93e8a 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx
@@ -233,6 +233,7 @@ describe('useStructuredAgentSessionOutbox', () => {
   it.each(['agent_session_operation_conflict', 'agent_session_operation_expired'] as const)(
     'rotates a send operation after %s',
     async (code) => {
+      // oxlint-disable-next-line no-restricted-properties -- stubbing the global the generator reads, to pin ids in this test
       vi.mocked(globalThis.crypto.randomUUID)
         .mockReturnValueOnce('11111111-1111-4111-8111-111111111111')
         .mockReturnValueOnce('22222222-2222-4222-8222-222222222222')
@@ -247,7 +248,7 @@ describe('useStructuredAgentSessionOutbox', () => {
       )
 
       act(() => expect(result.current.send('hello')).toBe(true))
-      await waitFor(() => expect(result.current.outbox[0]?.state).toBe('queued'))
+      await waitFor(() => expect(result.current.outbox[0]?.state).toBe('rejected'))
       const firstId = (mocks.call.mock.calls[0]![2] as { envelope: { clientOperationId: string } })
         .envelope.clientOperationId
       const retryId = result.current.outbox[0]!.clientMessageId
@@ -322,7 +323,8 @@ describe('useStructuredAgentSessionOutbox', () => {
     await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(1))
     const id = result.current.outbox[0]!.clientMessageId
     await waitFor(() => expect(result.current.outbox[0]?.state).toBe('unconfirmed'))
-    expect(result.current.error).toBe('Message delivery is unconfirmed')
+    // The Retry row already says delivery is unconfirmed; nothing repeats it.
+    expect([result.current.error, result.current.outbox[0]?.lastFailure]).toEqual([null, undefined])
 
     rerender({
       submissions: [
@@ -529,7 +531,7 @@ describe('useStructuredAgentSessionOutbox', () => {
     ).toBe(firstId)
   })
 
-  it('stops on a host that could not restart the agent and shows its message', async () => {
+  it('stops on a host that could not restart the agent and keeps its refusal on the message', async () => {
     const message = "Claude couldn't restart: Not logged in. Please run /login."
     mocks.call.mockResolvedValue({
       ok: false,
@@ -545,12 +547,20 @@ describe('useStructuredAgentSessionOutbox', () => {
     )
 
     act(() => expect(result.current.send('hello')).toBe(true))
-    await waitFor(() => expect(result.current.error).toBe(message))
+    await waitFor(() =>
+      expect(result.current.outbox[0]?.lastFailure).toEqual({
+        kind: 'refused',
+        code: 'agent_session_owner_restart_failed'
+      })
+    )
+    expect(result.current.error).toBeNull()
     await act(() => new Promise((resolve) => setTimeout(resolve, 50)))
 
     expect(mocks.call).toHaveBeenCalledOnce()
     expect(result.current.outbox).toHaveLength(1)
-    expect(result.current.blockedClientMessageId).toBe(result.current.outbox[0]?.clientMessageId)
+    // Never sent, and never re-sent on its own: it waits for Retry and holds nothing up.
+    expect(result.current.outbox[0]?.state).toBe('rejected')
+    expect(result.current.blockedClientMessageId).toBeNull()
     // Settled, not pending: the refused id never ran, so a Retry is a new operation.
     const sentId: unknown = mocks.call.mock.calls[0]![2].envelope.clientOperationId
     const retryId = result.current.outbox[0]!.clientMessageId
@@ -591,6 +601,7 @@ describe('useStructuredAgentSessionOutbox', () => {
   })
 
   it('retries an unknown head and advances a queued tail', async () => {
+    // oxlint-disable-next-line no-restricted-properties -- stubbing the global the generator reads, to pin ids in this test
     vi.mocked(globalThis.crypto.randomUUID)
       .mockReturnValueOnce('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa')
       .mockReturnValueOnce('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb')
@@ -653,6 +664,7 @@ describe('useStructuredAgentSessionOutbox', () => {
   })
 
   it('rotates a history-rejected unknown head so the queued tail can advance', async () => {
+    // oxlint-disable-next-line no-restricted-properties -- stubbing the global the generator reads, to pin ids in this test
     vi.mocked(globalThis.crypto.randomUUID)
       .mockReturnValueOnce('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa')
       .mockReturnValueOnce('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb')
@@ -713,6 +725,7 @@ describe('useStructuredAgentSessionOutbox', () => {
   })
 
   it('rotates the id after a refused write and delivers the message exactly once', async () => {
+    // oxlint-disable-next-line no-restricted-properties -- stubbing the global the generator reads, to pin ids in this test
     vi.mocked(globalThis.crypto.randomUUID)
       .mockReturnValueOnce('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa')
       .mockReturnValueOnce('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb')
@@ -761,16 +774,11 @@ describe('useStructuredAgentSessionOutbox', () => {
     await waitFor(() => expect(mocks.call).toHaveBeenCalledOnce())
     const firstId = mocks.call.mock.calls[0]![2].envelope.clientOperationId as string
 
-    // A refused write is answered, not doubted: the entry parks with human copy
-    // rather than under the "delivery is unconfirmed" banner. The durable reason
-    // stays `provider_write_failed: …`; it must not reach the screen.
-    await waitFor(() =>
-      expect(result.current.error).toBe(
-        "Couldn't reach the agent. Your message was not sent — Retry to send it again."
-      )
-    )
-    expect(result.current.outbox[0]?.state).toBe('queued')
-    expect(result.current.blockedClientMessageId).toBe(firstId)
+    // A refused write is answered, not doubted: the entry parks with its rejection rather than
+    // under the "delivery is unconfirmed" banner. The disposition tests pin its words.
+    await waitFor(() => expect(result.current.outbox[0]?.lastFailure?.kind).toBe('rejected'))
+    expect(result.current.outbox[0]?.state).toBe('rejected')
+    expect(result.current.blockedClientMessageId).toBeNull()
 
     // Retry immediately, before the journal subscription can publish the rejected row.
     act(() => result.current.retry(firstId))
@@ -838,7 +846,9 @@ describe('useStructuredAgentSessionOutbox', () => {
     )
 
     act(() => expect(result.current.send('hello')).toBe(true))
-    await waitFor(() => expect(result.current.error).toBe('agent_session_checkpoint_stale'))
+    const refused = { kind: 'refused', code: 'agent_session_checkpoint_stale' }
+    await waitFor(() => expect(result.current.outbox[0]?.lastFailure).toEqual(refused))
+    expect(result.current.error).toBeNull()
 
     rerender({ sessionId: 'session-2' })
     expect(result.current.error).toBeNull()
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-outbox.ts b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox.ts
index e38709b9fed..117f22dd9a6 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-outbox.ts
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox.ts
@@ -7,35 +7,40 @@ import {
   reconcileStructuredAgentSessionOutbox,
   type StructuredAgentSessionOutboxEntry
 } from '../../../../shared/structured-agent-session-outbox'
-import type { StructuredAgentSessionSendDisposition } from '../../../../shared/structured-agent-session-send-disposition'
+import { withdrawUnsentStructuredAgentSessionOutboxEntries } from '../../../../shared/structured-agent-session-outbox-stop-withdrawal'
+import {
+  journalAnswersInFlightSend,
+  type StructuredAgentSessionSendDisposition
+} from '../../../../shared/structured-agent-session-send-disposition'
 import type { RuntimeClientTarget } from '@/runtime/runtime-rpc-client'
 import { readOutbox, writeOutbox } from './structured-agent-session-outbox-storage'
 import {
   dispatchStructuredAgentSessionOutboxEntry,
-  hasInFlightLaunchDispatch,
-  readMountedStructuredAgentSessionOutbox
+  readMountedStructuredAgentSessionOutbox,
+  requeueInterruptedStructuredAgentSessionDispatches
 } from './structured-agent-session-outbox-dispatch'
 import { getStructuredAgentLaunchPromptDispatch } from '@/lib/structured-agent-session-launch-prompt'
+import { useStructuredAgentSessionOutboxOwnerChange } from '@/runtime/structured-agent-session-accepted-send-capability'
+import { useStructuredAgentSessionOutboxUnconfirmedProbe } from './use-structured-agent-session-outbox-unconfirmed-probe'
+import { createBrowserUuid } from '@/lib/browser-uuid'
+import { useStructuredAgentSessionWithdrawnRestore } from './structured-agent-session-withdrawn-message-restore'
 
 export function structuredSessionOperationId(): string {
-  return createStructuredAgentSessionOperationId(() => crypto.randomUUID())
+  return createStructuredAgentSessionOperationId(createBrowserUuid)
 }
 
-const UNCONFIRMED_PROBE_BASE_DELAY_MS = 1_000
-/** No attempt ceiling: a transport outage outlives any fixed budget, and giving up
- *  restores the wedge this fixes. Growth caps the rate at one status query per 16s.
- *  A refusal that blocks the head still ends probing until a fence change or a manual
- *  Retry, because the entry leaves `unconfirmed` -- pre-existing, not closed here. */
-const UNCONFIRMED_PROBE_MAX_DELAY_MS = 16_000
-
 export function useStructuredAgentSessionOutbox(args: {
   sessionId: string
   target: RuntimeClientTarget
   fence: number | null
   submissions: readonly AgentJournalSubmission[]
+  /** The composer that gets back what a Stop withdrew from this client's outbox. */
+  composerScopeKey?: string
 }) {
-  const { fence, sessionId, submissions, target } = args
-  const targetKey = target.kind === 'local' ? 'local' : `environment:${target.environmentId}`
+  const { composerScopeKey, fence, sessionId, submissions, target } = args
+  // What resends, unblocks and drops a send in flight besides a Retry or a new send; see the hook.
+  const owner = useStructuredAgentSessionOutboxOwnerChange(target, fence)
+  const restoreWithdrawn = useStructuredAgentSessionWithdrawnRestore(sessionId, composerScopeKey)
   const [outbox, setOutbox] = useState<StructuredAgentSessionOutboxEntry[]>(() =>
     readMountedStructuredAgentSessionOutbox(sessionId, fence, readOutbox)
   )
@@ -46,8 +51,6 @@ export function useStructuredAgentSessionOutbox(args: {
   const inFlightIdRef = useRef<string | null>(null)
   const dispatchGenerationRef = useRef(0)
   const blockedIdRef = useRef<string | null>(null)
-  const retryWithFreshClientMessageIdRef = useRef<string | null>(null)
-  const probeAttemptsRef = useRef({ id: null as string | null, attempts: 0 })
   const [error, setError] = useState<string | null>(null)
   const [errorSession, setErrorSession] = useState(sessionId)
   // Render-time reset (react.dev: adjusting state when a prop changes), so the
@@ -65,21 +68,15 @@ export function useStructuredAgentSessionOutbox(args: {
     dispatchGenerationRef.current += 1
     inFlightIdRef.current = null
     blockedIdRef.current = null
-    retryWithFreshClientMessageIdRef.current = null
-    probeAttemptsRef.current = { id: null, attempts: 0 }
-  }, [fence, sessionId, targetKey])
+  }, [owner.ownerChange, owner.targetKey, sessionId])
 
   useEffect(() => {
     const sessionChanged = outboxSessionRef.current !== sessionId
     outboxSessionRef.current = sessionId
     const current = sessionChanged
-      ? readMountedStructuredAgentSessionOutbox(sessionId, fence, readOutbox)
+      ? readMountedStructuredAgentSessionOutbox(sessionId, owner.fenceRef.current, readOutbox)
       : outboxRef.current
-    const next = current.map((entry) =>
-      entry.state === 'dispatching' && !hasInFlightLaunchDispatch(entry, fence)
-        ? { ...entry, state: 'queued' as const }
-        : entry
-    )
+    const next = requeueInterruptedStructuredAgentSessionDispatches(current, owner.fenceRef.current)
     if (
       sessionChanged ||
       next.some((entry, index) => entry !== current[index]) ||
@@ -89,7 +86,7 @@ export function useStructuredAgentSessionOutbox(args: {
       setOutbox(next)
       writeOutbox(sessionId, next)
     }
-  }, [fence, sessionId, target])
+  }, [owner.fenceRef, owner.ownerChange, sessionId, target])
 
   useEffect(() => {
     const current = outboxRef.current
@@ -102,12 +99,13 @@ export function useStructuredAgentSessionOutbox(args: {
         .map((submission) => submission.clientMessageId)
     )
     const next = reconcileStructuredAgentSessionOutbox(current, submissions)
-    const admittedInFlight = inFlightIdRef.current !== null && hostOwns.has(inFlightIdRef.current)
+    const admittedInFlight = journalAnswersInFlightSend(submissions, inFlightIdRef.current)
     if (
       admittedInFlight ||
       next.some((entry, index) => entry !== current[index]) ||
       next.length !== current.length
     ) {
+      restoreWithdrawn.byHost(current, submissions)
       outboxRef.current = next
       setOutbox(next)
       writeOutbox(sessionId, next)
@@ -128,7 +126,7 @@ export function useStructuredAgentSessionOutbox(args: {
     ) {
       setError(null)
     }
-  }, [sessionId, submissions])
+  }, [restoreWithdrawn, sessionId, submissions])
 
   // The one place that owns the refs, the React state and the storage write.
   const applyDisposition = useCallback(
@@ -137,7 +135,6 @@ export function useStructuredAgentSessionOutbox(args: {
       // drain, so a later microtask would leave the queue with no trigger to move on.
       inFlightIdRef.current = null
       blockedIdRef.current = disposition.blockedClientMessageId
-      retryWithFreshClientMessageIdRef.current = disposition.retryWithFreshClientMessageId
       setError(disposition.error)
       outboxRef.current = disposition.entries
       setOutbox(disposition.entries)
@@ -217,46 +214,14 @@ export function useStructuredAgentSessionOutbox(args: {
     }
   }, [applyDisposition, fence, outbox, sessionId, target])
 
-  // A transport-side unknown may never have reached the host, and nothing else
-  // moves it out of `unconfirmed`, so one wedges the whole FIFO queue. Re-issuing
-  // the same envelope without `retryUnknown` is idempotent: the operation ledger
-  // replays a recorded outcome, or the host performs a genuine first delivery.
-  // A host-confirmed unknown stays parked until the user explicitly asks Retry
-  // to replay the same operation.
-  // The first `unconfirmed` entry is the one holding the queue, at whatever index it sits: an
-  // unconfirmed tail behind an admitted head would otherwise wedge until the head cleared,
-  // which is the wedge this probe exists to prevent.
-  const blocker = outbox.find((entry) => entry.state === 'unconfirmed')
-  // Depend on primitives: `submissions` is rebuilt on every streaming batch, so an
-  // array-identity dep would reset the backoff forever while the agent is working.
-  // A non-null `retryAfterUnknownSubmittedAt` means the user already retried, so
-  // another request would repeat that explicit action. Only entries that have
-  // never been retried are safe to probe automatically.
-  const probeId =
-    blocker && blocker.sessionId === sessionId && blocker.retryAfterUnknownSubmittedAt === null
-      ? blocker.clientMessageId
-      : null
-  const probeSettled =
-    probeId !== null && submissions.some((submission) => submission.clientMessageId === probeId)
-  useEffect(() => {
-    if (probeId === null || probeSettled || fence === null) {
-      return
-    }
-    const attempts = probeAttemptsRef.current.id === probeId ? probeAttemptsRef.current.attempts : 0
-    const timer = setTimeout(
-      () => {
-        probeAttemptsRef.current = { id: probeId, attempts: attempts + 1 }
-        const next = outboxRef.current.map((entry) =>
-          entry.clientMessageId === probeId ? { ...entry, state: 'queued' as const } : entry
-        )
-        outboxRef.current = next
-        setOutbox(next)
-        writeOutbox(sessionId, next)
-      },
-      Math.min(UNCONFIRMED_PROBE_BASE_DELAY_MS * 2 ** attempts, UNCONFIRMED_PROBE_MAX_DELAY_MS)
-    )
-    return () => clearTimeout(timer)
-  }, [fence, probeId, probeSettled, sessionId, targetKey])
+  useStructuredAgentSessionOutboxUnconfirmedProbe({
+    sessionId,
+    outbox,
+    submissions,
+    owner,
+    outboxRef,
+    setOutbox
+  })
 
   const send = useCallback(
     (text: string, attachments: readonly { path: string; previewUri: string }[] = []): boolean => {
@@ -283,22 +248,39 @@ export function useStructuredAgentSessionOutbox(args: {
     [sessionId]
   )
 
+  // Before the Stop goes out, so the drain has nothing left to send after it.
+  const withdrawUnsent = useCallback((): void => {
+    const next = withdrawUnsentStructuredAgentSessionOutboxEntries(
+      outboxRef.current,
+      submissions,
+      blockedIdRef.current,
+      inFlightIdRef.current
+    )
+    if (next.length !== outboxRef.current.length) {
+      restoreWithdrawn.byStop(outboxRef.current.filter((entry) => !next.includes(entry)))
+      outboxRef.current = next
+      setOutbox(next)
+      writeOutbox(sessionId, next)
+    }
+  }, [restoreWithdrawn, sessionId, submissions])
+
   const retry = (clientMessageId: string): void => {
-    blockedIdRef.current = null
+    // Another message's Retry must not send the one the queue is held on.
+    if (blockedIdRef.current === clientMessageId) {
+      blockedIdRef.current = null
+    }
     setError(null)
     const submission = submissions.find(
       (candidate) => candidate.clientMessageId === clientMessageId
     )
     const current = outboxRef.current.find((entry) => entry.clientMessageId === clientMessageId)
-    // A provider-history reconciliation can settle an earlier unknown as
-    // rejected before the user presses Retry. Reusing that operation id only
-    // replays the settled rejection forever, so rotate the id for a safe resend.
-    if (
-      current &&
-      (submission?.dispatchState === 'rejected' ||
-        retryWithFreshClientMessageIdRef.current === clientMessageId)
-    ) {
-      retryWithFreshClientMessageIdRef.current = null
+    // The host settled this id as rejected, and reusing it only replays that forever, so rotate the
+    // id for a safe resend. Read from the message itself, which outlives a restart, or from a
+    // reconciliation that settled an earlier unknown before the outbox caught up. A refusal that
+    // settled the message already rotated it.
+    const recordedRejection =
+      current?.state === 'rejected' && current.lastFailure?.kind === 'rejected'
+    if (current && (recordedRejection || submission?.dispatchState === 'rejected')) {
       const rotated = outboxRef.current.map((entry) =>
         entry.clientMessageId === clientMessageId
           ? {
@@ -340,5 +322,12 @@ export function useStructuredAgentSessionOutbox(args: {
     outboxRef.current = next
     setOutbox(next)
   }
-  return { outbox, error, blockedClientMessageId: blockedIdRef.current, send, retry }
+  return {
+    outbox,
+    error,
+    blockedClientMessageId: blockedIdRef.current,
+    send,
+    retry,
+    withdrawUnsent
+  }
 }
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-question-answers.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session-question-answers.test.tsx
new file mode 100644
index 00000000000..337b22b4f5e
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-question-answers.test.tsx
@@ -0,0 +1,164 @@
+// @vitest-environment happy-dom
+
+import { act, renderHook } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  call: vi.fn(),
+  promptCancelSupported: vi.fn(),
+  questionAnswersSupported: vi.fn(),
+  operationId: vi.fn(() => 'operation-1')
+}))
+
+vi.mock('@/runtime/structured-agent-session-client', () => ({
+  callStructuredAgentSession: mocks.call,
+  supportsStructuredAgentSessionPromptCancel: mocks.promptCancelSupported,
+  supportsStructuredAgentSessionQuestionAnswers: mocks.questionAnswersSupported
+}))
+vi.mock('./use-structured-agent-session-read', () => ({
+  useStructuredAgentSessionRead: () => ({
+    state: {
+      fence: 3,
+      items,
+      submissions: [],
+      status: 'ready',
+      error: null,
+      hasOlder: false,
+      handoff: null
+    },
+    loadingOlder: false,
+    loadOlder: vi.fn()
+  })
+}))
+vi.mock('./use-structured-agent-session-outbox', () => ({
+  structuredSessionOperationId: mocks.operationId,
+  useStructuredAgentSessionOutbox: () => ({
+    outbox: [],
+    blockedClientMessageId: null,
+    error: null,
+    send: vi.fn(),
+    retry: vi.fn()
+  })
+}))
+
+import type { AgentJournalRenderItem } from '../../../../shared/agent-session-journal-types'
+import { encodeAgentSessionQuestionAnswers } from '../../../../shared/agent-session-question-answer'
+import {
+  useStructuredAgentSession,
+  type StructuredPromptItem
+} from './use-structured-agent-session'
+
+let items: AgentJournalRenderItem[] = []
+const target = { kind: 'local' } as const
+
+const question: StructuredPromptItem = {
+  itemId: 'question-1',
+  revision: 2,
+  sequence: 2,
+  observedAt: 2,
+  body: {
+    kind: 'question',
+    question: '1 grouped question from Claude',
+    options: [],
+    questions: [
+      {
+        id: 'q1',
+        question: 'Which option?',
+        multiSelect: false,
+        options: [{ id: 'q1:choice-1', label: 'Alpha' }],
+        freeTextQuestionId: 'q1'
+      }
+    ],
+    resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
+  }
+}
+
+const approval: StructuredPromptItem = {
+  itemId: 'approval-1',
+  revision: 3,
+  sequence: 3,
+  observedAt: 3,
+  body: {
+    kind: 'approval',
+    title: 'Allow Bash?',
+    detail: null,
+    options: [{ id: 'allow', label: 'Allow' }],
+    resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
+  }
+}
+
+const answers = [{ questionId: 'q1', optionIds: [], other: 'Wait for the capture. '.repeat(80) }]
+
+function respondCall(): Record<string, unknown> | undefined {
+  return mocks.call.mock.calls.find(([, method]) =>
+    String(method).startsWith('agentSession.respondTo')
+  )?.[2]
+}
+
+describe('desktop structured prompt answers', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    items = [question, approval]
+    mocks.call.mockResolvedValue({ ok: true, value: { itemId: 'question-1', revision: 3 } })
+  })
+
+  it('sends structured answers to a host that takes them', async () => {
+    mocks.questionAnswersSupported.mockResolvedValue(true)
+    const { result } = renderHook(() =>
+      useStructuredAgentSession({
+        sessionId: 'session-1',
+        target,
+        agent: 'claude',
+        isVisible: true
+      })
+    )
+
+    await act(async () => {
+      await result.current.respond(question, { kind: 'answers', answers })
+    })
+
+    expect(mocks.questionAnswersSupported).toHaveBeenCalledWith(target)
+    expect(respondCall()).toMatchObject({ itemId: 'question-1', expectedRevision: 2, answers })
+    expect(respondCall()).not.toHaveProperty('optionId')
+  })
+
+  it('packs the answer into an option id for a host that predates structured answers', async () => {
+    mocks.questionAnswersSupported.mockResolvedValue(false)
+    const { result } = renderHook(() =>
+      useStructuredAgentSession({
+        sessionId: 'session-1',
+        target,
+        agent: 'claude',
+        isVisible: true
+      })
+    )
+
+    await act(async () => {
+      await result.current.respond(question, { kind: 'answers', answers })
+    })
+
+    expect(respondCall()).toMatchObject({
+      itemId: 'question-1',
+      optionId: encodeAgentSessionQuestionAnswers(answers)
+    })
+    expect(respondCall()).not.toHaveProperty('answers')
+  })
+
+  it('sends an approval decision without probing the host', async () => {
+    const { result } = renderHook(() =>
+      useStructuredAgentSession({
+        sessionId: 'session-1',
+        target,
+        agent: 'claude',
+        isVisible: true
+      })
+    )
+
+    await act(async () => {
+      await result.current.respond(approval, { kind: 'option', optionId: 'allow' })
+    })
+
+    expect(mocks.questionAnswersSupported).not.toHaveBeenCalled()
+    expect(respondCall()).toMatchObject({ itemId: 'approval-1', optionId: 'allow' })
+  })
+})
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-start-failure-facts.test.ts b/src/renderer/src/components/native-chat/use-structured-agent-session-start-failure-facts.test.ts
new file mode 100644
index 00000000000..97ef023dffb
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-start-failure-facts.test.ts
@@ -0,0 +1,42 @@
+// @vitest-environment happy-dom
+
+import { renderHook } from '@testing-library/react'
+import { expect, it } from 'vitest'
+import type { AgentSessionFailureFact } from '../../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../../shared/agent-session-failure-words'
+import { agentJournalItemKey } from '../../../../shared/agent-session-journal-item-key'
+import type { AgentJournalRenderItem } from '../../../../shared/agent-session-journal-types'
+import { structuredAgentSessionStartFailureRowIdentity } from '../../../../shared/structured-agent-session-start-failure-row-key'
+import { useStructuredAgentSessionStartFailureFacts } from './use-structured-agent-session-start-failure-facts'
+
+function startFailureRow(startKey: string, fact: AgentSessionFailureFact): AgentJournalRenderItem {
+  return {
+    itemId: agentJournalItemKey(structuredAgentSessionStartFailureRowIdentity(startKey)),
+    revision: 1,
+    sequence: 1,
+    observedAt: 1,
+    body: {
+      kind: 'status',
+      tone: 'error',
+      ...agentSessionFailureWords(fact, { agentName: 'Claude', surface: 'row' })
+    }
+  }
+}
+
+// A streaming turn hands over a new item list on every delta; the facts must not follow it.
+it('holds the same facts while the start rows state nothing new', () => {
+  const row = startFailureRow('gen-1', { kind: 'providerStartFailed' })
+  const { result, rerender } = renderHook(
+    ({ items }) => useStructuredAgentSessionStartFailureFacts(items, true),
+    { initialProps: { items: [row] } }
+  )
+  const first = result.current
+  expect(first).toEqual([{ kind: 'providerStartFailed' }])
+
+  rerender({ items: [row, startFailureRow('other-start', { kind: 'providerStartFailed' })] })
+  expect(result.current).not.toBe(first)
+  const second = result.current
+
+  rerender({ items: [row, startFailureRow('other-start', { kind: 'providerStartFailed' })] })
+  expect(result.current).toBe(second)
+})
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-start-failure-facts.ts b/src/renderer/src/components/native-chat/use-structured-agent-session-start-failure-facts.ts
new file mode 100644
index 00000000000..83f20103de1
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-start-failure-facts.ts
@@ -0,0 +1,33 @@
+import { useEffect, useMemo, useRef } from 'react'
+import type { AgentSessionFailureFact } from '../../../../shared/agent-session-failure'
+import type { AgentJournalRenderItem } from '../../../../shared/agent-session-journal-types'
+import {
+  sameAgentSessionFailureFact,
+  structuredAgentSessionStartFailureFacts
+} from './structured-agent-session-delivery-notices'
+
+const NO_FACTS: readonly AgentSessionFailureFact[] = []
+
+/** What the loaded start-failure rows state, read only while `enabled`. Held while unchanged, so a
+ *  streaming turn does not rebuild every row's delivery notice. */
+export function useStructuredAgentSessionStartFailureFacts(
+  items: readonly AgentJournalRenderItem[],
+  enabled: boolean
+): readonly AgentSessionFailureFact[] {
+  const facts = useMemo(
+    () => (enabled ? structuredAgentSessionStartFailureFacts(items) : NO_FACTS),
+    [enabled, items]
+  )
+  const previousRef = useRef<readonly AgentSessionFailureFact[]>(NO_FACTS)
+  const previous = previousRef.current
+  const stable =
+    previous.length === facts.length &&
+    previous.every((fact, index) => sameAgentSessionFailureFact(fact, facts[index]))
+      ? previous
+      : facts
+  // Written after commit, so render stays pure.
+  useEffect(() => {
+    previousRef.current = stable
+  }, [stable])
+  return stable
+}
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-stop.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session-stop.test.tsx
new file mode 100644
index 00000000000..5d517bf57bb
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-stop.test.tsx
@@ -0,0 +1,541 @@
+// @vitest-environment happy-dom
+
+// Stop is there from the moment a message is sent until the work settles — against a host that takes
+// a Stop naming no turn. Against any other host, one that accepts sends first included, it stays
+// exactly what it was: a running turn only, named.
+
+import { act, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type {
+  AgentJournalRenderItem,
+  AgentJournalSubmission
+} from '../../../../shared/agent-session-journal-types'
+import type { StructuredAgentSessionOutboxEntry } from '../../../../shared/structured-agent-session-outbox'
+
+const mocks = vi.hoisted(() => ({
+  call: vi.fn(),
+  withdrawUnsent: vi.fn(),
+  operations: 0
+}))
+let items: AgentJournalRenderItem[] = []
+let submissions: AgentJournalSubmission[] = []
+let outbox: StructuredAgentSessionOutboxEntry[] = []
+let blockedClientMessageId: string | null = null
+let fence = 3
+
+vi.mock('@/runtime/structured-agent-session-client', () => ({
+  callStructuredAgentSession: mocks.call,
+  supportsStructuredAgentSessionPromptCancel: vi.fn(async () => false)
+}))
+
+vi.mock('./use-structured-agent-session-read', () => ({
+  useStructuredAgentSessionRead: () => ({
+    state: { fence, items, submissions, status: 'ready', error: null, hasOlder: false },
+    loadingOlder: false,
+    loadOlder: vi.fn()
+  })
+}))
+
+vi.mock('./use-structured-agent-session-outbox', () => ({
+  structuredSessionOperationId: () => `operation-${++mocks.operations}`,
+  useStructuredAgentSessionOutbox: () => ({
+    outbox,
+    blockedClientMessageId,
+    error: null,
+    send: vi.fn(),
+    retry: vi.fn(),
+    withdrawUnsent: mocks.withdrawUnsent
+  })
+}))
+
+import {
+  AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
+  AGENT_SESSION_CONVERSATION_STOP_RUNTIME_CAPABILITY
+} from '../../../../shared/protocol-version'
+import { setLocalRuntimeCapabilitiesForTests } from '@/runtime/local-runtime-capabilities'
+import { projectStructuredAgentSessionStatusSummary } from '../../../../shared/structured-agent-session-projection'
+import { structuredAgentSessionAgentStatus } from '../../../../shared/structured-agent-session-agent-status'
+import { useStructuredAgentSession } from './use-structured-agent-session'
+
+function entry(
+  state: StructuredAgentSessionOutboxEntry['state']
+): StructuredAgentSessionOutboxEntry {
+  return {
+    clientMessageId: 'client-1',
+    sessionId: 'session-1',
+    body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hi' }] },
+    previewUris: [],
+    state,
+    queuedAt: 1,
+    lastAttemptAt: null,
+    retryAfterUnknownSubmittedAt: null
+  }
+}
+
+function submission(overrides: Partial<AgentJournalSubmission>): AgentJournalSubmission {
+  return {
+    clientMessageId: 'client-1',
+    fence: 3,
+    payloadFingerprint: 'fingerprint-1',
+    dispatchState: 'pending',
+    providerItemId: null,
+    reason: null,
+    submittedAt: 1,
+    resolvedAt: null,
+    ...overrides
+  }
+}
+
+const RUNNING_TURN: AgentJournalRenderItem = {
+  itemId: 'turn-1',
+  revision: 1,
+  sequence: 1,
+  observedAt: 1,
+  body: { kind: 'turn', turnId: 'provider-turn', state: 'running' }
+}
+
+// Every way work can be in flight after a send, in the order a message passes through them.
+const IN_FLIGHT = {
+  'the send is on its way to the host': () => {
+    outbox = [entry('dispatching')]
+  },
+  'the host has queued it': () => {
+    submissions = [submission({ handoverRecorded: true })]
+  },
+  'it was handed over and is unanswered': () => {
+    submissions = [submission({ handoverRecorded: true, handedOverAt: 2 })]
+  },
+  'a turn is running': () => {
+    items = [RUNNING_TURN]
+  }
+}
+
+function render() {
+  return renderHook(() =>
+    useStructuredAgentSession({
+      sessionId: 'session-1',
+      agent: 'claude',
+      target: { kind: 'local' },
+      isVisible: true
+    })
+  )
+}
+
+function cancels(): unknown[] {
+  return mocks.call.mock.calls
+    .filter(([, method]) => method === 'agentSession.cancel')
+    .map(([, , params]) => params)
+}
+
+afterEach(() => {
+  setLocalRuntimeCapabilitiesForTests(null)
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.call.mockImplementation(async (_target, method) =>
+    method === 'agentSession.cancel' ? { ok: true, value: { cancelled: true } } : null
+  )
+  items = []
+  submissions = []
+  outbox = []
+  blockedClientMessageId = null
+  fence = 3
+})
+
+describe('Stop against a host that stops the conversation', () => {
+  beforeEach(() => {
+    setLocalRuntimeCapabilitiesForTests([
+      AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
+      AGENT_SESSION_CONVERSATION_STOP_RUNTIME_CAPABILITY
+    ])
+  })
+
+  it.each(Object.entries(IN_FLIGHT))(
+    'shows while %s, and stops the conversation',
+    async (_state, arrange) => {
+      arrange()
+      const { result } = render()
+
+      expect(result.current.canStop).toBe(true)
+      await act(async () => {
+        await result.current.stop()
+      })
+
+      expect(mocks.withdrawUnsent).toHaveBeenCalledOnce()
+      // Withdrawn first, so the drain has nothing left to send after the Stop.
+      const cancelCall = mocks.call.mock.calls.findIndex(
+        ([, method]) => method === 'agentSession.cancel'
+      )
+      expect(mocks.withdrawUnsent.mock.invocationCallOrder[0]).toBeLessThan(
+        mocks.call.mock.invocationCallOrder[cancelCall] ?? 0
+      )
+      expect(cancels()).toEqual([expect.not.objectContaining({ turnId: expect.anything() })])
+    }
+  )
+
+  function cancelOperationIds(): string[] {
+    return mocks.call.mock.calls
+      .filter(([, method]) => method === 'agentSession.cancel')
+      .map(([, , params]) => params.envelope.clientOperationId)
+  }
+
+  it('does not let a Stop whose answer never came back replay into every later one', async () => {
+    submissions = [submission({ handoverRecorded: true, handedOverAt: 2 })]
+    const answers: (() => unknown)[] = [
+      () => {
+        throw new Error('the connection dropped before the host answered')
+      },
+      () => ({
+        ok: false,
+        refusal: { code: 'agent_session_operation_unknown', message: 'Outcome unknown.' }
+      })
+    ]
+    mocks.call.mockImplementation(async (_target, method) =>
+      method === 'agentSession.cancel'
+        ? (answers.shift()?.() ?? { ok: true, value: { cancelled: true } })
+        : null
+    )
+    const { result } = render()
+
+    for (let press = 0; press < 3; press += 1) {
+      await act(async () => {
+        await result.current.stop()
+      })
+    }
+
+    // One key serves every Stop in this chat, so a kept id would replay into a later Stop, which the
+    // host answers as already handled and stops nothing for up to a day.
+    const ids = cancelOperationIds()
+    expect(new Set(ids).size).toBe(3)
+  })
+
+  it('sends a Stop of its own for a second press while the first is still on its way', async () => {
+    submissions = [submission({ handoverRecorded: true, handedOverAt: 2 })]
+    const pending: ((value: unknown) => void)[] = []
+    mocks.call.mockImplementation((_target, method) =>
+      method === 'agentSession.cancel'
+        ? new Promise((resolve) => pending.push(resolve))
+        : Promise.resolve(null)
+    )
+    const { result } = render()
+
+    await act(async () => {
+      const presses = [result.current.stop(), result.current.stop()]
+      for (const resolve of pending) {
+        resolve({ ok: true, value: { cancelled: true } })
+      }
+      await Promise.all(presses)
+    })
+
+    // The host runs them in order; the second acts on whatever is still running, if anything.
+    const ids = cancelOperationIds()
+    expect(ids).toHaveLength(2)
+    expect(ids[1]).not.toBe(ids[0])
+  })
+
+  it('sends a new Stop after one the host answered once the chat had moved on', async () => {
+    items = [RUNNING_TURN]
+    const pending: ((value: unknown) => void)[] = []
+    mocks.call.mockImplementation((_target, method) =>
+      method !== 'agentSession.cancel'
+        ? Promise.resolve(null)
+        : pending.length === 0
+          ? new Promise((resolve) => pending.push(resolve))
+          : Promise.resolve({ ok: true, value: { cancelled: true } })
+    )
+    const { result, rerender } = render()
+
+    let first: Promise<unknown> = Promise.resolve()
+    act(() => {
+      first = result.current.stop()
+    })
+    fence = 4
+    rerender()
+    await act(async () => {
+      pending[0]?.({ ok: true, value: { cancelled: true } })
+      await first
+    })
+    await act(async () => {
+      await result.current.stop()
+    })
+
+    // Reusing the first id would replay it: the host answers not-cancelled and stops nothing.
+    const fences: number[] = mocks.call.mock.calls
+      .filter(([, method]) => method === 'agentSession.cancel')
+      .map(([, , params]) => params.envelope.expectedRuntimeFence)
+    expect(fences).toEqual([3, 4])
+    const ids = cancelOperationIds()
+    expect(ids[1]).not.toBe(ids[0])
+  })
+
+  it('stops a message sent after a Stop whose answer is still on its way', async () => {
+    items = [RUNNING_TURN]
+    const ran = new Set<string>()
+    const pending: (() => void)[] = []
+    mocks.call.mockImplementation((_target, method, params) => {
+      if (method !== 'agentSession.cancel') {
+        return Promise.resolve(null)
+      }
+      // As the host's ledger does: an id it already ran replays as handled and stops nothing.
+      const operationId: string = params.envelope.clientOperationId
+      const value = { cancelled: !ran.has(operationId) }
+      ran.add(operationId)
+      return new Promise((resolve) => pending.push(() => resolve({ ok: true, value })))
+    })
+    const { result, rerender } = render()
+
+    let first: Promise<unknown> = Promise.resolve()
+    let second: Promise<unknown> = Promise.resolve()
+    act(() => {
+      first = result.current.stop()
+    })
+    // The next message goes out, and reaches the host ahead of the second Stop.
+    outbox = [entry('dispatching')]
+    rerender()
+    act(() => {
+      second = result.current.stop()
+    })
+    await act(async () => {
+      for (const answer of pending) {
+        answer()
+      }
+      await Promise.all([first, second])
+    })
+
+    expect(await second).toEqual({ cancelled: true })
+  })
+
+  it('does not let a lost stop of every background task swallow the next one', async () => {
+    const answers: (() => unknown)[] = [
+      () => {
+        throw new Error('the connection dropped before the host answered')
+      }
+    ]
+    mocks.call.mockImplementation(async (_target, method) =>
+      method === 'agentSession.cancel'
+        ? (answers.shift()?.() ?? { ok: true, value: { cancelled: true } })
+        : null
+    )
+    const { result } = render()
+
+    for (let press = 0; press < 2; press += 1) {
+      await act(async () => {
+        await result.current.stopBackgroundTask()
+      })
+    }
+
+    const ids = cancelOperationIds()
+    expect(ids).toHaveLength(2)
+    expect(ids[1]).not.toBe(ids[0])
+  })
+
+  it('replays a lost stop of one background task, which names what it stops', async () => {
+    const answers: (() => unknown)[] = [
+      () => {
+        throw new Error('the connection dropped before the host answered')
+      }
+    ]
+    mocks.call.mockImplementation(async (_target, method) =>
+      method === 'agentSession.cancel'
+        ? (answers.shift()?.() ?? { ok: true, value: { cancelled: true } })
+        : null
+    )
+    const { result } = render()
+
+    for (let press = 0; press < 2; press += 1) {
+      await act(async () => {
+        await result.current.stopBackgroundTask('task-1')
+      })
+    }
+
+    const ids = cancelOperationIds()
+    expect(ids).toHaveLength(2)
+    expect(ids[1]).toBe(ids[0])
+  })
+
+  it('sends a new cancel of a named turn after the host could not settle the last one', async () => {
+    const answers: (() => unknown)[] = [
+      () => ({
+        ok: false,
+        refusal: { code: 'agent_session_operation_unknown', message: 'Outcome unknown.' }
+      })
+    ]
+    mocks.call.mockImplementation(async (_target, method) =>
+      method === 'agentSession.cancel'
+        ? (answers.shift()?.() ?? { ok: true, value: { cancelled: true } })
+        : null
+    )
+    const { result } = render()
+
+    for (let press = 0; press < 2; press += 1) {
+      await act(async () => {
+        await result.current.cancel('provider-turn')
+      })
+    }
+
+    // Cancel recovers nothing from an unknown row, so the same id would earn the same refusal.
+    const ids = cancelOperationIds()
+    expect(ids).toHaveLength(2)
+    expect(ids[1]).not.toBe(ids[0])
+  })
+
+  it('is hidden at rest, and with only a message that will not run', () => {
+    expect(render().result.current.canStop).toBe(false)
+    outbox = [entry('rejected')]
+    submissions = [submission({ dispatchState: 'accepted', resolvedAt: 2 })]
+    expect(render().result.current.canStop).toBe(false)
+  })
+
+  it('is hidden with only a message that waits on its Retry', () => {
+    // A send that failed holds the queue until the user retries it.
+    outbox = [entry('queued')]
+    blockedClientMessageId = 'client-1'
+    expect(render().result.current.canStop).toBe(false)
+
+    // A send the host restarted under is parked for the user, and the chat reads idle.
+    outbox = [{ ...entry('unconfirmed'), retryAfterUnknownSubmittedAt: -1 }]
+    blockedClientMessageId = null
+    submissions = [
+      submission({
+        dispatchState: 'unknown',
+        recovered: true,
+        reason: 'host_restarted_before_acknowledgement'
+      })
+    ]
+    const { result } = render()
+    expect(result.current.isWorking).toBe(false)
+    expect(result.current.canStop).toBe(false)
+  })
+})
+
+const EARLIER_TURN: AgentJournalRenderItem[] = [
+  {
+    itemId: 'user-0',
+    revision: 1,
+    sequence: 1,
+    observedAt: 1,
+    body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'earlier' }] }
+  },
+  {
+    itemId: 'turn-0',
+    revision: 2,
+    sequence: 2,
+    observedAt: 2,
+    body: { kind: 'turn', turnId: 'turn-0', state: 'completed', outcome: 'success' }
+  }
+]
+
+/** The main agent's state as the sidebar row reads it: the host's projection of this journal,
+ *  through the same fold the row applies, or null when the session lists no agent at all. */
+function sidebarMainAgentState(): string | null {
+  const summary = projectStructuredAgentSessionStatusSummary(items, submissions, 3)
+  return summary.status
+    ? structuredAgentSessionAgentStatus({ ...summary, status: summary.status }).mainAgent.state
+    : null
+}
+
+// Claude retrying a rate-limited request (HTTP 429) writes only `api_retry` frames: it echoes the
+// message and opens a turn only once a request gets through or is interrupted, so the journal holds
+// a handed-over send, a row per retry, and no turn for as long as the retries last.
+const RATE_LIMIT_RETRY: AgentJournalRenderItem = {
+  itemId: 'provider-frame:claude:acquisition:1',
+  revision: 3,
+  sequence: 3,
+  observedAt: 3,
+  body: { kind: 'status', text: 'rate_limit', tone: 'error' }
+}
+
+const SIDEBAR_STATES = {
+  'a first message Claude is retrying after HTTP 429': () => {
+    items = [RATE_LIMIT_RETRY]
+    submissions = [submission({ handoverRecorded: true, handedOverAt: 2 })]
+  },
+  'a follow-up Claude is retrying after HTTP 429': () => {
+    items = [...EARLIER_TURN, RATE_LIMIT_RETRY]
+    submissions = [
+      submission({ clientMessageId: 'client-0', dispatchState: 'accepted', resolvedAt: 2 }),
+      submission({ handoverRecorded: true, handedOverAt: 3 })
+    ]
+  },
+  'a send whose write was ambiguous, still on the live child': () => {
+    items = EARLIER_TURN
+    submissions = [submission({ dispatchState: 'unknown', reason: 'write_outcome_unknown' })]
+  },
+  'a send an earlier child never answered': () => {
+    items = EARLIER_TURN
+    submissions = [submission({ fence: 2, handoverRecorded: true, handedOverAt: 2 })]
+  },
+  'a settled turn': () => {
+    items = EARLIER_TURN
+    submissions = [submission({ dispatchState: 'accepted', resolvedAt: 2 })]
+  }
+}
+
+describe('Stop against a host that stops the conversation, beside the sidebar', () => {
+  beforeEach(() => {
+    setLocalRuntimeCapabilitiesForTests([
+      AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
+      AGENT_SESSION_CONVERSATION_STOP_RUNTIME_CAPABILITY
+    ])
+  })
+
+  it.each(Object.entries(SIDEBAR_STATES))(
+    'shows exactly when the sidebar reads working, for %s',
+    (_state, arrange) => {
+      arrange()
+      const { result } = render()
+
+      expect(result.current.canStop).toBe(sidebarMainAgentState() === 'working')
+      expect(result.current.isWorking).toBe(result.current.canStop)
+    }
+  )
+
+  it('is there for a rate-limited request the sidebar reads as working', () => {
+    SIDEBAR_STATES['a follow-up Claude is retrying after HTTP 429']()
+    const { result } = render()
+
+    expect(sidebarMainAgentState()).toBe('working')
+    expect(result.current.turnId).toBeNull()
+    expect(result.current.canStop).toBe(true)
+  })
+})
+
+// A host that accepts sends first but predates the no-turn cancel refuses that cancel as invalid,
+// so it is treated exactly as an older host; so is one whose capabilities are not known yet.
+describe.each([
+  ['one that only accepts sends first', [AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY]],
+  ['an older one', []],
+  ['one not heard from yet', null]
+])('Stop against a host that is %s', (_host, capabilities) => {
+  beforeEach(() => {
+    setLocalRuntimeCapabilitiesForTests(capabilities)
+  })
+
+  it.each(Object.entries(IN_FLIGHT).filter(([state]) => state !== 'a turn is running'))(
+    'stays hidden while %s, and sends no cancel naming no turn',
+    async (_state, arrange) => {
+      arrange()
+      const { result } = render()
+
+      expect(result.current.canStop).toBe(false)
+      await act(async () => {
+        await result.current.stop()
+      })
+      expect(cancels()).toEqual([])
+      expect(mocks.withdrawUnsent).not.toHaveBeenCalled()
+    }
+  )
+
+  it('stops a running turn by name, as it always did', async () => {
+    items = [RUNNING_TURN]
+    const { result } = render()
+
+    expect(result.current.canStop).toBe(true)
+    await act(async () => {
+      await result.current.stop()
+    })
+    expect(cancels()).toEqual([expect.objectContaining({ turnId: 'provider-turn' })])
+    expect(mocks.withdrawUnsent).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-transport-state.ts b/src/renderer/src/components/native-chat/use-structured-agent-session-transport-state.ts
index c2c93788a04..b08801b199b 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-transport-state.ts
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-transport-state.ts
@@ -1,8 +1,6 @@
 import { useMemo } from 'react'
-import {
-  activeStructuredAgentSessionTurnId,
-  hasUnansweredStructuredAgentSessionDispatch
-} from '../../../../shared/structured-agent-session-projection'
+import { activeStructuredAgentSessionTurnId } from '../../../../shared/structured-agent-session-projection'
+import { isStructuredAgentSessionMainAgentWorking } from '../../../../shared/structured-agent-session-main-agent-working'
 import type { StructuredAgentSessionState } from '../../../../shared/structured-agent-session-reducer'
 import { selectStructuredAgentTurnActivity } from '../../../../shared/native-chat-turn-activity'
 import { structuredSessionBackgroundTasksView } from './structured-session-background-tasks-view'
@@ -19,8 +17,8 @@ export function useStructuredAgentSessionTransportState(
   const submissions = enabled ? state.submissions : NO_SUBMISSIONS
   const fence = enabled ? state.fence : null
   const turnId = activeStructuredAgentSessionTurnId(journalItems)
-  const isWorking =
-    turnId !== null || hasUnansweredStructuredAgentSessionDispatch(submissions, fence)
+  // The rule the host projects every session list's Working from, so this chat cannot disagree.
+  const isWorking = isStructuredAgentSessionMainAgentWorking(turnId, submissions, fence)
   const turnActivity = useMemo(
     () => selectStructuredAgentTurnActivity(journalItems, turnId, enabled ? state.activity : null),
     [enabled, journalItems, state.activity, turnId]
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-transport.ts b/src/renderer/src/components/native-chat/use-structured-agent-session-transport.ts
index 7bf979f8ff0..f0c3eaa59a8 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-transport.ts
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-transport.ts
@@ -20,10 +20,8 @@ export function useStructuredAgentSessionTransport(args: {
     enabled: providerVisible
   })
   // A worktree switch hides the pane, but a message the user already sent is still owed a
-  // delivery. The read is what carries the journal rows that retire it, and its subscription
-  // takes a retaining hold — without which the host evicts the session once its idle window runs
-  // out and then refuses the send outright. Gated on `enabled`: a session not yet published has
-  // nothing to read. Attention is not the signal; owed work is.
+  // delivery, and the read is what carries the journal rows that retire it. Gated on `enabled`:
+  // a session not yet published has nothing to read. Attention is not the signal; owed work is.
   const hasUndelivered = useUndeliveredStructuredAgentSessionOutbox(sessionId)
   const read = useStructuredAgentSessionRead({
     sessionId,
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-write-refusal.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session-write-refusal.test.tsx
new file mode 100644
index 00000000000..8cc467a3d28
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-write-refusal.test.tsx
@@ -0,0 +1,233 @@
+// @vitest-environment happy-dom
+
+import { act, renderHook } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  call: vi.fn(),
+  toastError: vi.fn()
+}))
+
+vi.mock('sonner', () => ({ toast: { error: mocks.toastError, message: vi.fn() } }))
+
+vi.mock('@/runtime/structured-agent-session-client', () => ({
+  callStructuredAgentSession: mocks.call
+}))
+
+vi.mock('./use-structured-agent-session-read', () => ({
+  useStructuredAgentSessionRead: () => ({
+    state: {
+      fence: 3,
+      items: [],
+      submissions: [],
+      status: 'ready',
+      error: null,
+      hasOlder: false,
+      handoff: null
+    },
+    loadingOlder: false,
+    loadOlder: vi.fn()
+  })
+}))
+
+vi.mock('./use-structured-agent-session-outbox', () => ({
+  structuredSessionOperationId: () => 'operation-1',
+  useStructuredAgentSessionOutbox: () => ({
+    outbox: [],
+    blockedClientMessageId: null,
+    error: null,
+    send: vi.fn(),
+    retry: vi.fn()
+  })
+}))
+
+import { useStructuredAgentSession } from './use-structured-agent-session'
+import { RuntimeRpcCallError } from '@/runtime/runtime-rpc-result'
+
+const LOCAL_TARGET = { kind: 'local' } as const
+const OPTIONS = { models: [], current: {} }
+
+describe('a chat write the host refused', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('says a refused Stop once, in plain words, and leaves nothing latched', async () => {
+    mocks.call.mockImplementation((_target, method) =>
+      method === 'agentSession.options'
+        ? Promise.resolve(OPTIONS)
+        : Promise.resolve({
+            ok: false,
+            refusal: {
+              code: 'agent_session_checkpoint_stale',
+              message: 'Expected runtime fence 1; the session is at 3.'
+            }
+          })
+    )
+    const { result } = renderHook(() =>
+      useStructuredAgentSession({
+        sessionId: 'session-1',
+        target: LOCAL_TARGET,
+        agent: 'claude',
+        isVisible: true
+      })
+    )
+
+    await act(async () => {
+      await expect(result.current.cancel('turn-1')).resolves.toBeNull()
+    })
+
+    expect(mocks.toastError).toHaveBeenCalledWith("The agent wasn't stopped.")
+    expect(result.current.error).toBeNull()
+  })
+
+  it('does not say a Stop failed when its request timed out after it may have run', async () => {
+    mocks.call.mockImplementation((_target, method) =>
+      method === 'agentSession.options'
+        ? Promise.resolve(OPTIONS)
+        : Promise.reject(
+            new RuntimeRpcCallError({
+              id: 'request-1',
+              ok: false,
+              error: {
+                code: 'runtime_timeout',
+                message: 'Timed out waiting for the remote Orca runtime to respond.'
+              },
+              _meta: { runtimeId: 'runtime-1' }
+            })
+          )
+    )
+    const { result } = renderHook(() =>
+      useStructuredAgentSession({
+        sessionId: 'session-1',
+        target: LOCAL_TARGET,
+        agent: 'claude',
+        isVisible: true
+      })
+    )
+
+    await act(async () => {
+      await expect(result.current.cancel('turn-1')).resolves.toBeNull()
+    })
+
+    expect(mocks.toastError).toHaveBeenCalledWith(
+      "Orca couldn't confirm what happened. Check the chat."
+    )
+  })
+
+  it('words a refusal the host threw from its data, never the bare code it carries as its message', async () => {
+    mocks.call.mockImplementation((_target, method) =>
+      method === 'agentSession.options'
+        ? Promise.resolve(OPTIONS)
+        : Promise.reject(
+            new RuntimeRpcCallError({
+              id: 'request-1',
+              ok: false,
+              error: {
+                code: 'runtime_error',
+                message: 'agent_session_journal_unreadable',
+                data: {
+                  refusal: {
+                    code: 'agent_session_journal_unreadable',
+                    details: { reason: 'journalUnavailable' }
+                  }
+                }
+              },
+              _meta: { runtimeId: 'runtime-1' }
+            })
+          )
+    )
+    const { result } = renderHook(() =>
+      useStructuredAgentSession({
+        sessionId: 'session-1',
+        target: LOCAL_TARGET,
+        agent: 'claude',
+        isVisible: true
+      })
+    )
+
+    await act(async () => {
+      await expect(result.current.cancel('turn-1')).resolves.toBeNull()
+    })
+
+    expect(mocks.toastError).toHaveBeenCalledExactlyOnceWith(
+      "Orca couldn't open this chat's history right now. The agent wasn't stopped. Try again."
+    )
+  })
+
+  it('answers a refused conversation command inline, where the command was typed', async () => {
+    mocks.call.mockImplementation((_target, method) =>
+      method === 'agentSession.options'
+        ? Promise.resolve(OPTIONS)
+        : Promise.resolve({
+            ok: false,
+            refusal: {
+              code: 'agent_session_operation_invalid',
+              message: 'agent_session_rewind:outcome-unknown'
+            }
+          })
+    )
+    const { result } = renderHook(() =>
+      useStructuredAgentSession({
+        sessionId: 'session-1',
+        target: LOCAL_TARGET,
+        agent: 'claude',
+        isVisible: true
+      })
+    )
+
+    await act(async () => {
+      await expect(result.current.runConversationCommand('compact')).resolves.toEqual({
+        accepted: false,
+        // The code does not say why, so no next step is offered that could be false.
+        error: "The command didn't run."
+      })
+    })
+
+    expect(mocks.toastError).not.toHaveBeenCalled()
+    expect(result.current.error).toBeNull()
+  })
+
+  it('says the reason the host named, for a Stop and for a command', async () => {
+    mocks.call.mockImplementation((_target, method) =>
+      method === 'agentSession.options'
+        ? Promise.resolve(OPTIONS)
+        : Promise.resolve({
+            ok: false,
+            refusal:
+              method === 'agentSession.cancel'
+                ? {
+                    code: 'agent_session_conflict',
+                    message: 'The chat is still starting.',
+                    details: { reason: 'chatStarting' }
+                  }
+                : {
+                    code: 'agent_session_operation_invalid',
+                    message: 'Wait for the current turn to finish before using this command.',
+                    details: { reason: 'turnActive' }
+                  }
+          })
+    )
+    const { result } = renderHook(() =>
+      useStructuredAgentSession({
+        sessionId: 'session-1',
+        target: LOCAL_TARGET,
+        agent: 'claude',
+        isVisible: true
+      })
+    )
+
+    await act(async () => {
+      await expect(result.current.cancel('turn-1')).resolves.toBeNull()
+      await expect(result.current.runConversationCommand('compact')).resolves.toEqual({
+        accepted: false,
+        error:
+          "The agent is still responding. The command didn't run. Wait for the agent to finish responding, or stop it."
+      })
+    })
+
+    expect(mocks.toastError).toHaveBeenCalledWith(
+      "The agent is still starting. The agent wasn't stopped. Wait for the agent to finish starting."
+    )
+  })
+})
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx
index be20364c1dc..719fa29be61 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx
@@ -6,8 +6,11 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 const mocks = vi.hoisted(() => ({
   call: vi.fn(),
   operationId: vi.fn(),
-  enqueueSettingsWrite: vi.fn()
+  enqueueSettingsWrite: vi.fn(),
+  toastError: vi.fn()
 }))
+
+vi.mock('sonner', () => ({ toast: { error: mocks.toastError, message: vi.fn() } }))
 let fence = 3
 let sessionCommands: { name: string; kind: 'command' | 'skill' }[] | undefined
 let items: AgentJournalRenderItem[] = []
@@ -255,7 +258,12 @@ describe('useStructuredAgentSession options', () => {
       expect(await result.current.setStructuredOption('model', 'gpt-fast')).toBe(false)
     })
 
-    expect(result.current.error).toBe('provider rejected option')
+    // Said once, without the transport's text, and without claiming an outcome the failure
+    // cannot prove; nothing stays behind under the composer.
+    expect(mocks.toastError).toHaveBeenCalledWith(
+      "Orca couldn't confirm what happened. Check the chat."
+    )
+    expect(result.current.error).toBeNull()
     expect(result.current.optionSnapshot.find((entry) => entry.id === 'model')).toMatchObject({
       settable: true
     })
@@ -411,6 +419,7 @@ describe('useStructuredAgentSession options', () => {
     })
 
     expect(result.current.error).toBeNull()
+    expect(mocks.toastError).not.toHaveBeenCalled()
   })
 
   it('includes one background task id in the cancel fingerprint and payload', async () => {
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session.ts b/src/renderer/src/components/native-chat/use-structured-agent-session.ts
index 640b3b2a7c4..ce66d47cbce 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session.ts
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session.ts
@@ -8,7 +8,16 @@ import type {
 } from '../../../../shared/agent-session-conversation-command'
 import type { AgentType } from '../../../../shared/agent-status-types'
 import type { RuntimeClientTarget } from '@/runtime/runtime-rpc-client'
-import { supportsStructuredAgentSessionPromptCancel } from '@/runtime/structured-agent-session-client'
+import {
+  supportsStructuredAgentSessionPromptCancel,
+  supportsStructuredAgentSessionQuestionAnswers
+} from '@/runtime/structured-agent-session-client'
+import { useStructuredAgentSessionHostStopsConversation } from '@/runtime/structured-agent-session-host-capability'
+import { hasUnsentStructuredAgentSessionOutboxEntry } from '../../../../shared/structured-agent-session-outbox-stop-withdrawal'
+import {
+  legacyAgentSessionSelectedOptionId,
+  type AgentSessionPromptResponse
+} from '../../../../shared/agent-session-question-answer'
 import {
   pendingStructuredSessionPrompts,
   type StructuredPromptItem
@@ -21,6 +30,7 @@ import type { StructuredAgentSessionLaunchView } from './use-native-chat-provisi
 import { useStructuredAgentSessionThreadGoal } from './use-structured-agent-session-thread-goal'
 import { useStructuredAgentSessionContextUsage } from './use-structured-agent-session-context-usage'
 import { useStructuredAgentSessionRailOutline } from './use-structured-agent-session-rail-outline'
+import { hostStatesTurnScopes } from '../../../../shared/native-chat-turn-membership'
 
 export type { StructuredPromptItem } from './structured-agent-session-message-projection'
 
@@ -36,9 +46,12 @@ export function useStructuredAgentSession(args: {
   providerStarting?: boolean
   /** This view started the session; only then does the stored selection name what it runs. */
   launch?: StructuredAgentSessionLaunchView
+  /** The composer that gets back what a Stop withdrew. */
+  composerScopeKey?: string
 }) {
   const {
     agent,
+    composerScopeKey,
     isVisible,
     launch,
     providerStarting = false,
@@ -46,21 +59,13 @@ export function useStructuredAgentSession(args: {
     target,
     transportEnabled = true
   } = args
-  const {
-    state,
-    loadingOlder,
-    olderHistoryGeneration,
-    loadOlder,
-    mutate,
-    writeError,
-    reportWriteError,
-    providerVisible
-  } = useStructuredAgentSessionTransport({
-    sessionId,
-    target,
-    isVisible,
-    enabled: transportEnabled
-  })
+  const { state, loadingOlder, olderHistoryGeneration, loadOlder, mutate, write, providerVisible } =
+    useStructuredAgentSessionTransport({
+      sessionId,
+      target,
+      isVisible,
+      enabled: transportEnabled
+    })
   const commandPending = useRef(false)
   const transportState = useStructuredAgentSessionTransportState(state, transportEnabled)
   const {
@@ -82,14 +87,14 @@ export function useStructuredAgentSession(args: {
     turnId: transportState.turnId,
     unloadedTurnRevisions: state.unloadedTurnRevisions,
     mutate,
-    reportWriteError,
     ...(launch ? { launch } : {})
   })
   const outboxController = useStructuredAgentSessionOutbox({
     sessionId,
     target,
     fence: transportState.fence,
-    submissions: transportState.submissions
+    submissions: transportState.submissions,
+    composerScopeKey
   })
 
   const threadGoal = useStructuredAgentSessionThreadGoal({
@@ -111,6 +116,19 @@ export function useStructuredAgentSession(args: {
 
   const prompts = pendingStructuredSessionPrompts(transportState.journalItems)
   const { outbox } = outboxController
+  // A host that takes a Stop naming no turn gets Stop from the send until the work settles; every
+  // Stop before a turn opens needs that form. An older host can stop only a turn it has opened.
+  const stopsConversation =
+    useStructuredAgentSessionHostStopsConversation(target) && transportState.fence !== null
+  const canStop =
+    transportState.turnId !== null ||
+    (stopsConversation &&
+      (transportState.isWorking ||
+        hasUnsentStructuredAgentSessionOutboxEntry(
+          outbox,
+          transportState.submissions,
+          outboxController.blockedClientMessageId
+        )))
   const messages = useStructuredAgentSessionMessages(
     transportState.journalItems,
     outbox,
@@ -129,7 +147,7 @@ export function useStructuredAgentSession(args: {
           outbox.length
         ),
         send: (command) =>
-          mutate<AgentSessionConversationCommandResult>(
+          write<AgentSessionConversationCommandResult>(
             'agentSession.conversationCommand',
             'agentSession.conversationCommand',
             { command }
@@ -138,9 +156,10 @@ export function useStructuredAgentSession(args: {
     journalItems: transportState.journalItems,
     messages,
     status: transportEnabled ? state.status : 'ready',
-    error: transportEnabled
-      ? (state.error ?? writeError ?? outboxController.error)
-      : outboxController.error,
+    /** The outbox's own line; a failed read is worded from `readRefusal`, never its text. */
+    error: outboxController.error,
+    /** The refusal the failed read met, while `status` is `error`. */
+    readRefusal: transportEnabled ? state.readRefusal : undefined,
     hasOlder: transportEnabled && state.hasOlder,
     railOutline: transportEnabled ? railOutline : null,
     loadingOlder: transportEnabled && loadingOlder,
@@ -148,9 +167,14 @@ export function useStructuredAgentSession(args: {
     loadOlder,
     prompts,
     outbox,
+    /** The journal's rows for sent messages, which carry a rejected message's whole fact. */
+    submissions: transportState.submissions,
     blockedClientMessageId: outboxController.blockedClientMessageId,
+    // A message typed during a command queues behind it on the host.
     send: (...input: Parameters<typeof outboxController.send>) =>
-      !commandPending.current && outboxController.send(...input),
+      // Legacy: an older host refuses sends while a command runs; removable once those hosts age out.
+      (!commandPending.current || hostStatesTurnScopes(transportState.journalItems)) &&
+      outboxController.send(...input),
     retry: outboxController.retry,
     isWorking: transportState.isWorking,
     workingStartedAt: transportState.turnTiming.workingStartedAt,
@@ -158,6 +182,16 @@ export function useStructuredAgentSession(args: {
     turnActivity: transportState.turnActivity,
     backgroundTasks: transportState.backgroundTasks,
     turnId: transportState.turnId,
+    canStop,
+    stop: () => {
+      if (stopsConversation) {
+        outboxController.withdrawUnsent()
+        return mutate('agentSession.cancel', 'agentSession.cancel', {})
+      }
+      return transportState.turnId
+        ? mutate('agentSession.cancel', 'agentSession.cancel', { turnId: transportState.turnId })
+        : Promise.resolve(null)
+    },
     cancel: async (turnId: string, prompt?: StructuredPromptCancelTarget) => {
       // Capability negotiation must complete before mutate constructs the payload
       // fingerprint and operation id: older hosts reject the strict prompt field.
@@ -174,14 +208,32 @@ export function useStructuredAgentSession(args: {
         scope: 'background-tasks',
         ...(taskId ? { taskId } : {})
       }),
-    respond: (item: StructuredPromptItem, optionId: string) =>
-      mutate<AgentSessionPromptResult>(
+    respond: async (item: StructuredPromptItem, response: AgentSessionPromptResponse) => {
+      const promptTarget = { itemId: item.itemId, expectedRevision: item.revision }
+      let fields: Record<string, unknown>
+      if (response.kind === 'option') {
+        fields = { ...promptTarget, optionId: response.optionId }
+      } else if (await supportsStructuredAgentSessionQuestionAnswers(target)) {
+        // Negotiated before mutate fingerprints the call: older hosts reject the strict field.
+        fields = { ...promptTarget, answers: response.answers }
+      } else {
+        const optionId =
+          item.body.kind === 'question'
+            ? legacyAgentSessionSelectedOptionId(item.body, response.answers)
+            : null
+        if (optionId === null) {
+          return null
+        }
+        fields = { ...promptTarget, optionId }
+      }
+      return mutate<AgentSessionPromptResult>(
         item.body.kind === 'approval'
           ? 'agentSession.respondToApproval'
           : 'agentSession.respondToQuestion',
         `agentSession.respondTo:${item.body.kind}`,
-        { itemId: item.itemId, expectedRevision: item.revision, optionId }
-      ),
+        fields
+      )
+    },
     optionSnapshot,
     optionSurface,
     sessionCommands: transportEnabled ? (state.commands ?? undefined) : undefined,
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-turn-timing.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-turn-timing.test.tsx
index d065f34f81c..c946c830866 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-turn-timing.test.tsx
+++ b/src/renderer/src/components/native-chat/use-structured-agent-turn-timing.test.tsx
@@ -76,7 +76,8 @@ describe('useStructuredAgentTurnTiming', () => {
     vi.useFakeTimers()
     vi.setSystemTime(CLIENT_NOW)
     const running = [
-      user('u1', 1),
+      // The acknowledged send: its entry's key is the submission's, not the provider's.
+      user('orca:first', 1),
       lifecycle(
         't1',
         2,
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-turn-timing.ts b/src/renderer/src/components/native-chat/use-structured-agent-turn-timing.ts
index 5603c82b42f..e12975bf5ce 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-turn-timing.ts
+++ b/src/renderer/src/components/native-chat/use-structured-agent-turn-timing.ts
@@ -5,10 +5,7 @@ import type {
 } from '../../../../shared/agent-session-journal-types'
 import type { NativeChatSettledTurns } from '../../../../shared/native-chat-turn-status'
 import type { StructuredAgentHostClock } from '../../../../shared/structured-agent-session-reducer'
-import {
-  selectStructuredAgentRunningTurnTiming,
-  selectStructuredAgentSettledTurns
-} from '../../../../shared/structured-agent-session-turn-timing'
+import { selectStructuredAgentTurnBars } from '../../../../shared/structured-agent-session-turn-timing'
 import {
   stepStructuredAgentTurnClock,
   type StructuredAgentTurnClockLatch
@@ -29,15 +26,11 @@ export function useStructuredAgentTurnTiming(
   },
   turnId: string | null
 ): { settledTurns: NativeChatSettledTurns; workingStartedAt: number | null } {
-  const settledTurns = useMemo(
-    () => selectStructuredAgentSettledTurns(items, submissions),
-    [items, submissions]
+  const { settledTurns, runningTiming } = useMemo(
+    () => selectStructuredAgentTurnBars(items, submissions, turnId),
+    [items, submissions, turnId]
   )
   const [latch, setLatch] = useState<StructuredAgentTurnClockLatch | null>(null)
-  const runningTiming = useMemo(
-    () => (turnId === null ? null : selectStructuredAgentRunningTurnTiming(items, turnId)),
-    [items, turnId]
-  )
   // Stamp during render (React's derive-from-props pattern) so the first paint of
   // a new turn already counts from the right instant.
   const step = stepStructuredAgentTurnClock({
diff --git a/src/renderer/src/components/new-workspace/NewWorkspaceComposerAdvancedSection.tsx b/src/renderer/src/components/new-workspace/NewWorkspaceComposerAdvancedSection.tsx
index f7b18f6ebaa..9849ab14258 100644
--- a/src/renderer/src/components/new-workspace/NewWorkspaceComposerAdvancedSection.tsx
+++ b/src/renderer/src/components/new-workspace/NewWorkspaceComposerAdvancedSection.tsx
@@ -61,6 +61,8 @@ type NewWorkspaceComposerAdvancedSectionProps = Pick<
   | 'onSparseSelectPreset'
   | 'canUseSparseCheckout'
 > & {
+  sparseEditing?: boolean
+  onSparseEditingChange: (editing: boolean) => void
   branchNameInputId: string
   setupConfigLabel: string
   setupRunLabel: string
@@ -72,6 +74,8 @@ type NewWorkspaceComposerAdvancedSectionProps = Pick<
 
 export function NewWorkspaceComposerAdvancedSection({
   advancedOpen,
+  sparseEditing,
+  onSparseEditingChange,
   smartNameSelection,
   name,
   onNameValueChange,
@@ -144,7 +148,8 @@ export function NewWorkspaceComposerAdvancedSection({
   return (
     <div
       className={cn(
-        'grid overflow-hidden transition-[grid-template-rows] duration-200 ease-out',
+        'grid transition-[grid-template-rows] duration-200 ease-out',
+        advancedOpen && sparseEditing ? 'overflow-visible' : 'overflow-hidden',
         !advancedOpen && '!mt-2',
         advancedOpen ? 'grid-rows-[1fr]' : 'grid-rows-[0fr]'
       )}
@@ -272,7 +277,7 @@ export function NewWorkspaceComposerAdvancedSection({
                     <div className="flex items-start justify-between gap-3 p-3">
                       <span
                         className={cn(
-                          'min-w-0 space-y-1',
+                          'min-w-0',
                           resolvedSetupDecision === 'run' ? '' : 'opacity-50'
                         )}
                       >
@@ -282,12 +287,6 @@ export function NewWorkspaceComposerAdvancedSection({
                             'Wait for setup to complete before starting agent'
                           )}
                         </span>
-                        <span className="block text-[11px] text-muted-foreground">
-                          {translate(
-                            'auto.components.NewWorkspaceComposerCard.waitForSetupBeforeAgentHelp',
-                            'Turn this on when setup installs dependencies, MCP servers, or config files the agent needs during startup.'
-                          )}
-                        </span>
                       </span>
                       <SettingsSwitch
                         checked={setupAgentStartupPolicy === 'wait-for-setup'}
@@ -359,7 +358,9 @@ export function NewWorkspaceComposerAdvancedSection({
                 )}
               </label>
               <SparseCheckoutPresetSelect
+                key={repoId}
                 repoId={repoId}
+                onEditingChange={onSparseEditingChange}
                 presets={sparsePresets}
                 selectedPresetId={sparseSelectedPresetId}
                 onSelectPreset={onSparseSelectPreset}
diff --git a/src/renderer/src/components/new-workspace/NewWorkspaceComposerAgentSection.tsx b/src/renderer/src/components/new-workspace/NewWorkspaceComposerAgentSection.tsx
index 620bcbeb22a..4d597d3d436 100644
--- a/src/renderer/src/components/new-workspace/NewWorkspaceComposerAgentSection.tsx
+++ b/src/renderer/src/components/new-workspace/NewWorkspaceComposerAgentSection.tsx
@@ -17,6 +17,7 @@ type NewWorkspaceComposerAgentSectionProps = Pick<
   | 'advancedOpen'
   | 'onToggleAdvanced'
 > & {
+  advancedLocked?: boolean
   visibleQuickAgents: React.ComponentProps<typeof AgentCombobox>['agents']
   defaultTuiAgent: React.ComponentProps<typeof AgentCombobox>['defaultAgent']
   handleSetDefaultAgent: (
@@ -31,6 +32,7 @@ export function NewWorkspaceComposerAgentSection({
   createDisabled,
   onCreate,
   advancedOpen,
+  advancedLocked = false,
   onToggleAdvanced,
   visibleQuickAgents,
   defaultTuiAgent,
@@ -84,6 +86,8 @@ export function NewWorkspaceComposerAgentSection({
           variant="ghost"
           size="sm"
           onClick={onToggleAdvanced}
+          disabled={advancedLocked}
+          aria-expanded={advancedOpen}
           className="-ml-2 text-xs focus-visible:ring-inset"
         >
           {translate('auto.components.NewWorkspaceComposerCard.f0470c7383', 'Advanced')}
diff --git a/src/renderer/src/components/new-workspace/NewWorkspaceComposerProjectSection.tsx b/src/renderer/src/components/new-workspace/NewWorkspaceComposerProjectSection.tsx
index 1928b205ff6..24178d12822 100644
--- a/src/renderer/src/components/new-workspace/NewWorkspaceComposerProjectSection.tsx
+++ b/src/renderer/src/components/new-workspace/NewWorkspaceComposerProjectSection.tsx
@@ -31,6 +31,7 @@ type NewWorkspaceComposerProjectSectionProps = Pick<
   | 'selectedEphemeralVmRecipeId'
   | 'ephemeralVmRecipeError'
 > & {
+  disabled?: boolean
   projectDescriptionId: string
   onAddProject: () => void
   focusNameInput: () => void
@@ -48,6 +49,7 @@ type NewWorkspaceComposerProjectSectionProps = Pick<
 }
 
 export function NewWorkspaceComposerProjectSection({
+  disabled = false,
   projectOptions = EMPTY_PROJECT_OPTIONS,
   selectedProjectId = null,
   onProjectChange,
@@ -80,7 +82,7 @@ export function NewWorkspaceComposerProjectSection({
   selectedProjectName
 }: NewWorkspaceComposerProjectSectionProps): React.JSX.Element {
   return (
-    <div className="space-y-1">
+    <fieldset disabled={disabled} className="space-y-1">
       <div className="space-y-1">
         <div className="flex items-center justify-between gap-2">
           <label className="text-xs font-medium text-muted-foreground">
@@ -198,6 +200,6 @@ export function NewWorkspaceComposerProjectSection({
           </Button>
         </div>
       ) : null}
-    </div>
+    </fieldset>
   )
 }
diff --git a/src/renderer/src/components/onboarding/OnboardingFlow.test.tsx b/src/renderer/src/components/onboarding/OnboardingFlow.test.tsx
index 5b4f95e1bd3..573dc0b3f94 100644
--- a/src/renderer/src/components/onboarding/OnboardingFlow.test.tsx
+++ b/src/renderer/src/components/onboarding/OnboardingFlow.test.tsx
@@ -2,7 +2,8 @@ import type { ComponentProps } from 'react'
 import { renderToStaticMarkup } from 'react-dom/server'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { TooltipProvider } from '@/components/ui/tooltip'
-import { getDefaultOnboardingState, getDefaultSettings } from '../../../../shared/constants'
+import { getDefaultSettings } from '../../../../shared/constants'
+import { getDefaultOnboardingState } from '../../../../shared/onboarding-defaults'
 import { useAppStore } from '@/store'
 import OnboardingFlow from './OnboardingFlow'
 import { ONBOARDING_SKIP_CONFIRMATION_COPY } from './OnboardingSkipConfirmationDialog'
diff --git a/src/renderer/src/components/onboarding/onboarding-flow-state.ts b/src/renderer/src/components/onboarding/onboarding-flow-state.ts
index 853ed9096db..c2765894ee0 100644
--- a/src/renderer/src/components/onboarding/onboarding-flow-state.ts
+++ b/src/renderer/src/components/onboarding/onboarding-flow-state.ts
@@ -1,7 +1,10 @@
 import { toast } from 'sonner'
 import type { AppState } from '@/store/types'
 import { translate } from '@/i18n/i18n'
-import { ONBOARDING_FINAL_STEP, ONBOARDING_FLOW_VERSION } from '../../../../shared/constants'
+import {
+  ONBOARDING_FINAL_STEP,
+  ONBOARDING_FLOW_VERSION
+} from '../../../../shared/onboarding-defaults'
 import type { EventProps } from '../../../../shared/telemetry-events'
 import type { GlobalSettings } from '../../../../shared/global-settings-types'
 import type { OnboardingState } from '../../../../shared/onboarding-state-types'
diff --git a/src/renderer/src/components/onboarding/onboarding-folder-agent-startup.test.ts b/src/renderer/src/components/onboarding/onboarding-folder-agent-startup.test.ts
index fa8a791ace1..d57028e882c 100644
--- a/src/renderer/src/components/onboarding/onboarding-folder-agent-startup.test.ts
+++ b/src/renderer/src/components/onboarding/onboarding-folder-agent-startup.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest'
-import { getDefaultOnboardingState, getDefaultSettings } from '../../../../shared/constants'
+import { getDefaultSettings } from '../../../../shared/constants'
+import { getDefaultOnboardingState } from '../../../../shared/onboarding-defaults'
 import {
   buildDismissedOnboardingFolderAgentStartup,
   buildOnboardingFolderAgentStartup,
diff --git a/src/renderer/src/components/onboarding/use-onboarding-flow-actions.ts b/src/renderer/src/components/onboarding/use-onboarding-flow-actions.ts
index 9fac360b162..8a632927815 100644
--- a/src/renderer/src/components/onboarding/use-onboarding-flow-actions.ts
+++ b/src/renderer/src/components/onboarding/use-onboarding-flow-actions.ts
@@ -3,7 +3,7 @@ import { toast } from 'sonner'
 import { applyDocumentTheme } from '@/lib/document-theme'
 import { track } from '@/lib/telemetry'
 import { translate } from '@/i18n/i18n'
-import { ONBOARDING_FINAL_STEP } from '../../../../shared/constants'
+import { ONBOARDING_FINAL_STEP } from '../../../../shared/onboarding-defaults'
 import type { GlobalSettings } from '../../../../shared/global-settings-types'
 import type { OnboardingState } from '../../../../shared/onboarding-state-types'
 import type { TuiAgent } from '../../../../shared/tui-agent'
diff --git a/src/renderer/src/components/onboarding/use-onboarding-flow-persistence.test.ts b/src/renderer/src/components/onboarding/use-onboarding-flow-persistence.test.ts
index e3ab2b88857..93392392a2b 100644
--- a/src/renderer/src/components/onboarding/use-onboarding-flow-persistence.test.ts
+++ b/src/renderer/src/components/onboarding/use-onboarding-flow-persistence.test.ts
@@ -3,7 +3,7 @@
 import { createElement, useEffect, act } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { getDefaultOnboardingState } from '../../../../shared/constants'
+import { getDefaultOnboardingState } from '../../../../shared/onboarding-defaults'
 import type { OnboardingState } from '../../../../shared/onboarding-state-types'
 
 const trackMock = vi.hoisted(() => vi.fn())
diff --git a/src/renderer/src/components/onboarding/use-onboarding-flow-persistence.ts b/src/renderer/src/components/onboarding/use-onboarding-flow-persistence.ts
index 93b4b62c153..965fda126be 100644
--- a/src/renderer/src/components/onboarding/use-onboarding-flow-persistence.ts
+++ b/src/renderer/src/components/onboarding/use-onboarding-flow-persistence.ts
@@ -1,7 +1,10 @@
 import { useCallback, useRef } from 'react'
 import { track } from '@/lib/telemetry'
 import { useAppStore } from '@/store'
-import { ONBOARDING_FINAL_STEP, ONBOARDING_FLOW_VERSION } from '../../../../shared/constants'
+import {
+  ONBOARDING_FINAL_STEP,
+  ONBOARDING_FLOW_VERSION
+} from '../../../../shared/onboarding-defaults'
 import type { EventProps } from '../../../../shared/telemetry-events'
 import type { GlobalSettings } from '../../../../shared/global-settings-types'
 import type { OnboardingState } from '../../../../shared/onboarding-state-types'
diff --git a/src/renderer/src/components/onboarding/use-onboarding-flow-telemetry.ts b/src/renderer/src/components/onboarding/use-onboarding-flow-telemetry.ts
index c0f2dee0696..6e387c8cc3c 100644
--- a/src/renderer/src/components/onboarding/use-onboarding-flow-telemetry.ts
+++ b/src/renderer/src/components/onboarding/use-onboarding-flow-telemetry.ts
@@ -1,7 +1,7 @@
 import { useCallback, useEffect, useRef, useState } from 'react'
 import { applyDocumentTheme } from '@/lib/document-theme'
 import { track } from '@/lib/telemetry'
-import { ONBOARDING_FINAL_STEP } from '../../../../shared/constants'
+import { ONBOARDING_FINAL_STEP } from '../../../../shared/onboarding-defaults'
 import type { GlobalSettings } from '../../../../shared/global-settings-types'
 import type { EventProps } from '../../../../shared/telemetry-events'
 import type { AppState } from '@/store/types'
diff --git a/src/renderer/src/components/onboarding/use-onboarding-flow.test.ts b/src/renderer/src/components/onboarding/use-onboarding-flow.test.ts
index ffc39e3a6cb..4930c1c59b9 100644
--- a/src/renderer/src/components/onboarding/use-onboarding-flow.test.ts
+++ b/src/renderer/src/components/onboarding/use-onboarding-flow.test.ts
@@ -4,7 +4,7 @@ import {
   prepareSkippedOnboardingPreferences,
   remapOpenOnboardingLastCompletedStep
 } from './onboarding-flow-state'
-import { getDefaultOnboardingState } from '../../../../shared/constants'
+import { getDefaultOnboardingState } from '../../../../shared/onboarding-defaults'
 
 vi.mock('sonner', () => ({
   toast: { error: vi.fn(), info: vi.fn(), success: vi.fn() }
diff --git a/src/renderer/src/components/pull-request-page/checks/fix-dialog.tsx b/src/renderer/src/components/pull-request-page/checks/fix-dialog.tsx
index b779c22574a..f43c6f6be53 100644
--- a/src/renderer/src/components/pull-request-page/checks/fix-dialog.tsx
+++ b/src/renderer/src/components/pull-request-page/checks/fix-dialog.tsx
@@ -2,7 +2,7 @@ import React from 'react'
 import { toast } from 'sonner'
 import type { useAppStore } from '@/store'
 import { SourceControlAgentActionDialog } from '@/components/right-sidebar/SourceControlAgentActionDialog'
-import { readSourceControlLaunchRecipeAgentId } from '@/lib/source-control-launch-agent-selection'
+import { readSourceControlLaunchRecipeAgentId } from '../../../../../shared/source-control-launch-agent-selection'
 import type { SourceControlActionRecipe } from '../../../../../shared/source-control-ai-actions'
 import { translate } from '@/i18n/i18n'
 import type { GitHubWorkItem } from '../../../../../shared/github/work-item-types'
diff --git a/src/renderer/src/components/pull-request-page/files/combined-diff-viewer.tsx b/src/renderer/src/components/pull-request-page/files/combined-diff-viewer.tsx
index 68592865d47..5fcc8fe406a 100644
--- a/src/renderer/src/components/pull-request-page/files/combined-diff-viewer.tsx
+++ b/src/renderer/src/components/pull-request-page/files/combined-diff-viewer.tsx
@@ -2,6 +2,7 @@ import React, { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useSta
 import { useVirtualizer } from '@tanstack/react-virtual'
 import type { editor as monacoEditor } from 'monaco-editor'
 import { useAppStore } from '@/store'
+import { useDocumentDarkTheme } from '@/hooks/use-document-dark-theme'
 import { DiffSectionItem } from '@/components/editor/DiffSectionItem'
 import { CombinedDiffFileTree } from '../../editor/combined-diff/browse-files/combined-diff-file-tree'
 import { useCombinedDiffSectionIndexMap } from '../../editor/combined-diff/resolve-changes/use-combined-diff-section-index-map'
@@ -45,9 +46,7 @@ export function PRFilesCombinedDiffViewer({
   onViewedChange
 }: PRFilesCombinedDiffViewerProps): React.JSX.Element {
   const settings = useAppStore((s) => s.settings)
-  const isDark =
-    settings?.theme === 'dark' ||
-    (settings?.theme === 'system' && window.matchMedia('(prefers-color-scheme: dark)').matches)
+  const isDark = useDocumentDarkTheme()
   const diffEntrySignature = useMemo(
     () =>
       JSON.stringify(
diff --git a/src/renderer/src/components/pull-request-page/page/surface.tsx b/src/renderer/src/components/pull-request-page/page/surface.tsx
index a299a0caa87..ffa5f401e2b 100644
--- a/src/renderer/src/components/pull-request-page/page/surface.tsx
+++ b/src/renderer/src/components/pull-request-page/page/surface.tsx
@@ -132,7 +132,9 @@ export default function PullRequestPage({
       return
     }
 
-    const result = activateAndRevealWorktree(currentAttached.id)
+    const result = activateAndRevealWorktree(currentAttached.id, {
+      navigationIntent: 'user-open'
+    })
     if (result === false) {
       toast.error(
         translate(
diff --git a/src/renderer/src/components/refactor-hook-contract.test-support.ts b/src/renderer/src/components/refactor-hook-contract.test-support.ts
deleted file mode 100644
index cb191c7c86f..00000000000
--- a/src/renderer/src/components/refactor-hook-contract.test-support.ts
+++ /dev/null
@@ -1,163 +0,0 @@
-import { createHash } from 'node:crypto'
-// TypeScript 7 is a native CLI; AST tests still need the legacy JavaScript API.
-import ts from 'typescript-api'
-
-export type HookContractFact = {
-  dependencies: string[] | null
-  name: string
-}
-
-type HookDefinition = {
-  body: ts.Node
-  sourceFile: ts.SourceFile
-}
-
-export type HookSource = {
-  relativePath: string
-  source: string
-}
-
-export type HookDefinitions = ReadonlyMap<string, HookDefinition>
-
-function readFunctionName(node: ts.Node): string | null {
-  if ((ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node)) && node.name) {
-    return node.name.text
-  }
-  if (
-    ts.isArrowFunction(node) &&
-    ts.isVariableDeclaration(node.parent) &&
-    ts.isIdentifier(node.parent.name)
-  ) {
-    return node.parent.name.text
-  }
-  return null
-}
-
-function readHookName(node: ts.CallExpression): string | null {
-  if (ts.isIdentifier(node.expression) && /^use[A-Z]/.test(node.expression.text)) {
-    return node.expression.text
-  }
-  if (
-    ts.isPropertyAccessExpression(node.expression) &&
-    /^use[A-Z]/.test(node.expression.name.text)
-  ) {
-    return node.expression.name.text
-  }
-  return null
-}
-
-function normalize(node: ts.Node, sourceFile: ts.SourceFile): string {
-  return node
-    .getText(sourceFile)
-    .replace(/\/\*[\s\S]*?\*\//g, '')
-    .replace(/\/\/.*$/gm, '')
-    .replace(/\s+/g, '')
-}
-
-export function readHookDefinitions(
-  sources: readonly HookSource[],
-  includesDefinition: (name: string) => boolean
-): HookDefinitions {
-  const definitions = new Map<string, HookDefinition>()
-  for (const { relativePath, source } of sources) {
-    const sourceFile = ts.createSourceFile(
-      relativePath,
-      source,
-      ts.ScriptTarget.Latest,
-      true,
-      relativePath.endsWith('.tsx') ? ts.ScriptKind.TSX : ts.ScriptKind.TS
-    )
-    const visit = (node: ts.Node): void => {
-      if (
-        (ts.isFunctionDeclaration(node) ||
-          ts.isFunctionExpression(node) ||
-          ts.isArrowFunction(node)) &&
-        node.body
-      ) {
-        const name = readFunctionName(node)
-        if (name && includesDefinition(name)) {
-          definitions.set(name, { body: node.body, sourceFile })
-        }
-      }
-      ts.forEachChild(node, visit)
-    }
-    visit(sourceFile)
-  }
-  return definitions
-}
-
-export function readFlattenedHookFacts(
-  definitions: HookDefinitions,
-  rootName: string
-): HookContractFact[] {
-  const flatten = (name: string, active: ReadonlySet<string>): HookContractFact[] => {
-    const definition = definitions.get(name)
-    if (!definition || active.has(name)) {
-      throw new Error(`Invalid hook stage: ${name}`)
-    }
-    const facts: HookContractFact[] = []
-    const nextActive = new Set([...active, name])
-    const visit = (node: ts.Node): void => {
-      if (ts.isCallExpression(node)) {
-        const hookName = readHookName(node)
-        if (hookName) {
-          if (definitions.has(hookName)) {
-            facts.push(...flatten(hookName, nextActive))
-          } else {
-            const dependencyArray = [...node.arguments]
-              .toReversed()
-              .find((argument) => ts.isArrayLiteralExpression(argument))
-            facts.push({
-              dependencies: dependencyArray
-                ? [...dependencyArray.elements].map((element) =>
-                    normalize(element, definition.sourceFile)
-                  )
-                : null,
-              name: hookName
-            })
-          }
-        }
-      }
-      ts.forEachChild(node, visit)
-    }
-    visit(definition.body)
-    return facts
-  }
-
-  return flatten(rootName, new Set())
-}
-
-export function hashContract(values: readonly string[]): string {
-  return createHash('sha256').update(values.join('\n')).digest('hex')
-}
-
-export function readDependencyContract(facts: readonly HookContractFact[]): string[] {
-  return facts.flatMap(({ dependencies, name }) =>
-    dependencies === null ? [] : [`${name}|[${dependencies.join(',')}]`]
-  )
-}
-
-export function projectDependencyContract(
-  facts: readonly HookContractFact[],
-  allowedAdditions: Readonly<Record<number, readonly string[]>>
-): string[] {
-  const dependencyFacts = facts.filter(
-    (fact): fact is HookContractFact & { dependencies: string[] } => fact.dependencies !== null
-  )
-  for (const ordinal of Object.keys(allowedAdditions).map(Number)) {
-    if (!Number.isInteger(ordinal) || ordinal < 0 || ordinal >= dependencyFacts.length) {
-      throw new Error(`Invalid dependency-array ordinal: ${ordinal}`)
-    }
-  }
-  return dependencyFacts.map(({ dependencies, name }, ordinal) => {
-    const projected = [...dependencies]
-    for (const addition of allowedAdditions[ordinal] ?? []) {
-      const index = projected.indexOf(addition)
-      if (index === -1) {
-        throw new Error(`Missing allowed dependency addition at ${ordinal}: ${addition}`)
-      }
-      projected.splice(index, 1)
-    }
-    return `${name}|[${projected.join(',')}]`
-  })
-}
diff --git a/src/renderer/src/components/right-sidebar/FileExplorer.tsx b/src/renderer/src/components/right-sidebar/FileExplorer.tsx
index f1c031f3467..c8800f4655f 100644
--- a/src/renderer/src/components/right-sidebar/FileExplorer.tsx
+++ b/src/renderer/src/components/right-sidebar/FileExplorer.tsx
@@ -1,6 +1,16 @@
 import React, { useCallback, useMemo } from 'react'
 import { useAppStore } from '@/store'
 import { useActiveWorktree, useRepoById } from '@/store/selectors'
+import {
+  getExplorerDisplayRootOptions,
+  resolveExplorerDisplayRootChoice,
+  getExplorerDisplayRootPath,
+  getExplorerDisplayDepth,
+  getExplorerEffectiveExpanded
+} from './file-explorer-display-root'
+import { FileExplorerScopeNotice } from './FileExplorerScopeNotice'
+import { useFileExplorerRootNavigation } from './use-file-explorer-root-navigation'
+import { useFileExplorerScopeTransition } from './use-file-explorer-scope-transition'
 import { basename } from '@/lib/path'
 import { cn } from '@/lib/utils'
 import { isGitRepoKind } from '../../../../shared/repo-kind'
@@ -28,6 +38,7 @@ import { useFileExplorerTreePaneState } from './use-file-explorer-tree-pane-stat
 import { translate } from '@/i18n/i18n'
 import type { RightSidebarExplorerView } from '../../../../shared/ui-chrome-types'
 
+/** Coordinates scoped navigation while retaining the actual worktree root for file operations and runtime routing. */
 function FileExplorerFiles(): React.JSX.Element {
   const explorerView = useAppStore((s) => s.rightSidebarExplorerView)
   const showRightSidebarFiles = useAppStore((s) => s.showRightSidebarFiles)
@@ -46,7 +57,15 @@ function FileExplorerFiles(): React.JSX.Element {
   )
   const toggleShowDotfilesForWorktree = useAppStore((s) => s.toggleShowDotfilesForWorktree)
 
+  const savedRoot = useAppStore((s) =>
+    activeWorktreeId ? s.explorerDisplayRootByWorktree[activeWorktreeId] : undefined
+  )
+  const rootOptions = useMemo(() => getExplorerDisplayRootOptions(activeWorktree), [activeWorktree])
+  const rootChoice = resolveExplorerDisplayRootChoice(rootOptions, savedRoot)
+  const rootNavigation = useFileExplorerRootNavigation(activeWorktreeId, rootChoice, rootOptions)
   const worktreePath = activeWorktree?.path ?? null
+  const displayRootPath = getExplorerDisplayRootPath(worktreePath, rootChoice)
+  const displayDepth = getExplorerDisplayDepth(worktreePath, displayRootPath)
   const isFilesViewActive = explorerView === 'files'
   const visibleFilesWorktreePath = getVisibleFileExplorerWorktreePath({
     explorerView,
@@ -62,7 +81,15 @@ function FileExplorerFiles(): React.JSX.Element {
     [activeWorktreeId, expandedDirs]
   )
 
-  const tree = useFileExplorerTree(worktreePath, expanded, activeWorktreeId)
+  const effectiveExpanded = useMemo(
+    () =>
+      getExplorerEffectiveExpanded(
+        expanded,
+        visibleFilesWorktreePath && displayRootPath !== worktreePath ? displayRootPath : null
+      ),
+    [expanded, visibleFilesWorktreePath, displayRootPath, worktreePath]
+  )
+  const tree = useFileExplorerTree(worktreePath, effectiveExpanded, activeWorktreeId)
   const {
     nameFilterQuery,
     setNameFilterQuery,
@@ -99,7 +126,8 @@ function FileExplorerFiles(): React.JSX.Element {
     activeRepoSupportsGit && isFilesViewActive,
     showDotfiles,
     nameFilterSource,
-    hasNameFilter ? nameFilterCollapsedPaths : null
+    hasNameFilter ? nameFilterCollapsedPaths : null,
+    visibleFilesWorktreePath ? displayRootPath : null
   )
   const rowExpandedPaths = useMemo(
     () =>
@@ -149,10 +177,13 @@ function FileExplorerFiles(): React.JSX.Element {
   // return, so a transient null worktree cannot unmount the tree's reset guard
   // and SSH generation refs and trigger a full cache-dropping reload on return.
   const paneState = useFileExplorerTreePaneState({
+    onRevealOutsideRoot: rootNavigation.revealOutsideRoot,
     activeWorktreeId,
     activeRepo,
     worktreePath,
     visibleFilesWorktreePath,
+    displayRootPath,
+    effectiveExpanded,
     expanded,
     activeFileId,
     openFiles,
@@ -174,11 +205,20 @@ function FileExplorerFiles(): React.JSX.Element {
     handleExplorerBackgroundContextMenuCapture,
     handleExplorerBackgroundDoubleClick
   } = useFileExplorerBackgroundMenu({
-    worktreePath,
+    worktreePath: displayRootPath,
+    displayDepth,
     inlineInput: inlineInputState.inlineInput,
     startNew: inlineInputState.startNew
   })
 
+  useFileExplorerScopeTransition({
+    displayRootPath,
+    activeWorktreeId,
+    paneState,
+    selection,
+    setBgMenuOpen
+  })
+
   if (!worktreePath) {
     return (
       <div className="flex h-full items-center justify-center text-[11px] text-muted-foreground px-4 text-center">
@@ -219,6 +259,29 @@ function FileExplorerFiles(): React.JSX.Element {
           showDotfiles={showDotfiles}
           onToggleDotfiles={handleToggleDotfiles}
         />
+        {activeWorktree?.isSparse && (
+          <FileExplorerScopeNotice
+            rootSelect={
+              isFilesViewActive && rootOptions
+                ? {
+                    options: rootOptions,
+                    value: rootChoice,
+                    onValueChange: rootNavigation.selectRoot,
+                    disabled:
+                      Boolean(paneState.dragDrop.dragSourcePath) ||
+                      paneState.dragDrop.isNativeDragOver
+                  }
+                : null
+            }
+            returnRoot={rootNavigation.returnRoot}
+            onSelectRoot={rootNavigation.selectRoot}
+            disabled={
+              Boolean(paneState.dragDrop.dragSourcePath) || paneState.dragDrop.isNativeDragOver
+            }
+            searching={!isFilesViewActive}
+            sparse={!!activeWorktree?.isSparse}
+          />
+        )}
         <FileExplorerQueryStrip view={explorerView} onSelectView={handleSelectExplorerView}>
           {/* Why: keep both query rows mounted and cross-fade so the Names/Contents
              switch does not remount or shift when changing modes. */}
@@ -230,6 +293,7 @@ function FileExplorerFiles(): React.JSX.Element {
             >
               <FileExplorerNameFilter
                 query={nameFilterQuery}
+                scopeLabel={rootOptions?.find((option) => option.value === rootChoice)?.label}
                 loading={nameFilterFiles.loading}
                 onQueryChange={setNameFilterQuery}
                 onClear={handleClearNameFilter}
@@ -258,6 +322,7 @@ function FileExplorerFiles(): React.JSX.Element {
            avoids remounting heavy virtualized panes while preserving full height. */}
         <div className="relative min-h-0 flex-1 overflow-hidden">
           <FileExplorerFilesTreePane
+            displayRootPath={displayRootPath}
             activeRepo={activeRepo}
             worktreePath={worktreePath}
             visibleFilesWorktreePath={visibleFilesWorktreePath}
@@ -302,7 +367,8 @@ function FileExplorerFiles(): React.JSX.Element {
         open={bgMenuOpen}
         onOpenChange={setBgMenuOpen}
         point={bgMenuPoint}
-        worktreePath={worktreePath}
+        worktreePath={displayRootPath ?? worktreePath}
+        displayDepth={displayDepth}
         onStartNew={inlineInputState.startNew}
       />
     </>
diff --git a/src/renderer/src/components/right-sidebar/FileExplorerBackgroundMenu.tsx b/src/renderer/src/components/right-sidebar/FileExplorerBackgroundMenu.tsx
index 8e7e3218ef1..1b3faef1f3b 100644
--- a/src/renderer/src/components/right-sidebar/FileExplorerBackgroundMenu.tsx
+++ b/src/renderer/src/components/right-sidebar/FileExplorerBackgroundMenu.tsx
@@ -19,16 +19,19 @@ function stopRightButtonMenuSelection(event: React.PointerEvent): void {
   event.stopPropagation()
 }
 
+/** Targets creation and paste at the displayed directory while keeping workspace operations rooted at the worktree. */
 export function FileExplorerBackgroundMenu({
   open,
   onOpenChange,
   point,
   worktreePath,
+  displayDepth = 0,
   onStartNew
 }: {
   open: boolean
   onOpenChange: (open: boolean) => void
   point: { x: number; y: number }
+  displayDepth?: number
   worktreePath: string
   onStartNew: (type: 'file' | 'folder', dir: string, depth: number) => void
 }): React.JSX.Element {
@@ -55,14 +58,14 @@ export function FileExplorerBackgroundMenu({
         onPointerUpCapture={stopRightButtonMenuSelection}
         onCloseAutoFocus={(e) => e.preventDefault()}
       >
-        <DropdownMenuItem onSelect={() => onStartNew('file', worktreePath, 0)}>
+        <DropdownMenuItem onSelect={() => onStartNew('file', worktreePath, displayDepth)}>
           <FilePlus />
           {translate(
             'auto.components.right.sidebar.FileExplorerBackgroundMenu.21fe46ed36',
             'New File'
           )}
         </DropdownMenuItem>
-        <DropdownMenuItem onSelect={() => onStartNew('folder', worktreePath, 0)}>
+        <DropdownMenuItem onSelect={() => onStartNew('folder', worktreePath, displayDepth)}>
           <FolderPlus />
           {translate(
             'auto.components.right.sidebar.FileExplorerBackgroundMenu.3b5e2dcb8d',
diff --git a/src/renderer/src/components/right-sidebar/FileExplorerFilesTreePane.errors.test.tsx b/src/renderer/src/components/right-sidebar/FileExplorerFilesTreePane.errors.test.tsx
new file mode 100644
index 00000000000..f647ff63706
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/FileExplorerFilesTreePane.errors.test.tsx
@@ -0,0 +1,69 @@
+// @vitest-environment happy-dom
+import type { ComponentProps } from 'react'
+import { renderToStaticMarkup } from 'react-dom/server'
+import { expect, it } from 'vitest'
+import { FileExplorerFilesTreePane } from './FileExplorerFilesTreePane'
+import { FileExplorerTreeStatus } from './FileExplorerTreeStatus'
+import { visit, type ReactElementLike } from './file-explorer-element-tree-test-harness'
+
+type Props = ComponentProps<typeof FileExplorerFilesTreePane>
+function emptyPane(error?: string) {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This element-tree fixture supplies every field read by the empty pane; child components and event handlers are not executed.
+  return FileExplorerFilesTreePane({
+    worktreePath: '/repo',
+    displayRootPath: '/repo/src',
+    explorerView: 'files',
+    visibleRowCount: 0,
+    hasNameFilter: false,
+    tree: {
+      loadingDirPaths: new Set(),
+      rootError: 'Full root unavailable',
+      dirCache: { '/repo/src': { children: [], error } }
+    },
+    selection: {},
+    paneState: {
+      inlineInputState: {},
+      rowScrolling: {},
+      handlers: {},
+      nodeCommands: {},
+      dragDrop: { rootDragHandlers: {} }
+    }
+  } as unknown as Props)
+}
+
+it.each([undefined, 'Permission denied', ''])(
+  'uses the selected root error (%j), not a stale full-root error',
+  (error) => {
+    const elements: ReactElementLike[] = []
+    visit(emptyPane(error), (element) => elements.push(element))
+    const status = elements.find((element) => element.type === FileExplorerTreeStatus)
+    expect(status?.props).toMatchObject({
+      isLoading: false,
+      error: error ?? null,
+      isEmpty: error === undefined
+    })
+    expect(elements.some((element) => element.props?.role === 'status')).toBe(error !== undefined)
+  }
+)
+
+it('renders an empty error message as a failed read rather than an empty directory', () => {
+  const markup = renderToStaticMarkup(<FileExplorerTreeStatus isLoading={false} error="" isEmpty />)
+  expect(markup).toContain('Could not load files for this workspace:')
+  expect(markup).not.toContain('No files in this workspace')
+})
+
+it('describes the selected folder rather than claiming the whole workspace is empty', () => {
+  const markup = renderToStaticMarkup(
+    <FileExplorerTreeStatus isLoading={false} error={null} isEmpty scopedToFolder />
+  )
+  expect(markup).toContain('No files in this folder')
+  expect(markup).not.toContain('No files in this workspace')
+})
+
+it('identifies a failed folder load without mislabeling workspace availability', () => {
+  const markup = renderToStaticMarkup(
+    <FileExplorerTreeStatus isLoading={false} error="Permission denied" isEmpty scopedToFolder />
+  )
+  expect(markup).toContain('Could not load this folder:')
+  expect(markup).toContain('Permission denied')
+})
diff --git a/src/renderer/src/components/right-sidebar/FileExplorerFilesTreePane.tsx b/src/renderer/src/components/right-sidebar/FileExplorerFilesTreePane.tsx
index 819561f3e45..a83b4e0a370 100644
--- a/src/renderer/src/components/right-sidebar/FileExplorerFilesTreePane.tsx
+++ b/src/renderer/src/components/right-sidebar/FileExplorerFilesTreePane.tsx
@@ -1,4 +1,6 @@
 import type React from 'react'
+import { getExplorerDisplayDepth } from './file-explorer-display-root'
+import { Button } from '@/components/ui/button'
 import { dirname } from '@/lib/path'
 import { ScrollArea } from '@/components/ui/scroll-area'
 import { cn } from '@/lib/utils'
@@ -18,6 +20,7 @@ import type { useFileExplorerTreePaneState } from './use-file-explorer-tree-pane
 type FileExplorerFilesTreePaneProps = {
   activeRepo: Repo | null
   worktreePath: string | null
+  displayRootPath: string | null
   visibleFilesWorktreePath: string | null
   explorerView: RightSidebarExplorerView
   isFilesViewActive: boolean
@@ -41,6 +44,7 @@ type FileExplorerFilesTreePaneProps = {
 export function FileExplorerFilesTreePane({
   activeRepo,
   worktreePath,
+  displayRootPath,
   visibleFilesWorktreePath,
   explorerView,
   isFilesViewActive,
@@ -59,7 +63,8 @@ export function FileExplorerFilesTreePane({
   handleExplorerBackgroundContextMenuCapture,
   handleExplorerBackgroundDoubleClick
 }: FileExplorerFilesTreePaneProps): React.JSX.Element {
-  const { loadingDirPaths, rootCache, rootError } = tree
+  const { loadingDirPaths, rootError } = tree
+  const rootCache = displayRootPath ? tree.dirCache[displayRootPath] : undefined
   const { selectedPaths, preserveSelectionForContextMenu, copyPathsForNode } = selection
   const {
     scrollRef,
@@ -111,10 +116,14 @@ export function FileExplorerFilesTreePane({
   // when the tree is empty, still loading, or showing a read error.
   const isEmptyState = visibleRowCount === 0 && !inlineInput
   const isNameFilterLoading = nameFilterSource?.relativePaths === null
-  const isRootLoading = !rootCache || (!!worktreePath && loadingDirPaths.has(worktreePath))
+  const isRootLoading = !rootCache || (!!displayRootPath && loadingDirPaths.has(displayRootPath))
   const isLoading = isEmptyState && (hasNameFilter ? isNameFilterLoading : isRootLoading)
-  const treeError = hasNameFilter ? nameFilterFiles.loadError : rootError
-  const hasError = isEmptyState && !isLoading && !!treeError
+  const treeError = hasNameFilter
+    ? nameFilterFiles.loadError
+    : displayRootPath
+      ? (rootCache?.error ?? null)
+      : rootError
+  const hasError = isEmptyState && !isLoading && treeError !== null
   const showTree = !isEmptyState
   const emptyMessage =
     hasNameFilter && !nameFilterFiles.loadError
@@ -133,7 +142,7 @@ export function FileExplorerFilesTreePane({
         explorerView !== 'files' && 'pointer-events-none invisible',
         isRootDragOver &&
           explorerView === 'files' &&
-          !(dragSourcePath && dirname(dragSourcePath) === worktreePath) &&
+          !(dragSourcePath && dirname(dragSourcePath) === displayRootPath) &&
           'bg-border',
         isNativeDragOver && explorerView === 'files' && !nativeDropTargetDir && 'bg-border'
       )}
@@ -141,7 +150,9 @@ export function FileExplorerFilesTreePane({
       viewportTabIndex={-1}
       viewportClassName="h-full min-h-0 py-2"
       data-native-file-drop-target={isFilesViewActive ? 'file-explorer' : undefined}
-      data-native-file-drop-dir={visibleFilesWorktreePath ?? undefined}
+      data-native-file-drop-dir={
+        visibleFilesWorktreePath ? (displayRootPath ?? undefined) : undefined
+      }
       onWheelCapture={handleWheelCapture}
       onDragOver={rootDragHandlers.onDragOver}
       onDragEnter={rootDragHandlers.onDragEnter}
@@ -156,16 +167,26 @@ export function FileExplorerFilesTreePane({
         onDoubleClick: handleExplorerBackgroundDoubleClick
       }}
     >
+      {treeError !== null && !isLoading && !hasNameFilter && displayRootPath && (
+        <div className="px-2 py-1 text-xs text-muted-foreground" role="status">
+          {showTree && <p>{treeError}</p>}
+          <Button variant="ghost" size="xs" onClick={() => void tree.refreshDir(displayRootPath)}>
+            {translate('fileExplorer.root.retry', 'Retry')}
+          </Button>
+        </div>
+      )}
       {!showTree && (
         <FileExplorerTreeStatus
           isLoading={isLoading}
           error={hasError ? treeError : null}
           isEmpty={isEmptyState && !isLoading && !hasError}
           emptyMessage={emptyMessage}
+          scopedToFolder={!!displayRootPath && displayRootPath !== worktreePath}
         />
       )}
       {showTree && (
         <FileExplorerVirtualRows
+          displayDepthOffset={getExplorerDisplayDepth(worktreePath, displayRootPath)}
           virtualizer={virtualizer}
           inlineInputIndex={inlineInputIndex}
           rowProjection={rowProjection}
diff --git a/src/renderer/src/components/right-sidebar/FileExplorerNameFilter.test.tsx b/src/renderer/src/components/right-sidebar/FileExplorerNameFilter.test.tsx
index 4defbc9bfd6..cc13cef3b9e 100644
--- a/src/renderer/src/components/right-sidebar/FileExplorerNameFilter.test.tsx
+++ b/src/renderer/src/components/right-sidebar/FileExplorerNameFilter.test.tsx
@@ -64,3 +64,13 @@ describe('FileExplorerNameFilter', () => {
     expect(onClear).toHaveBeenCalledTimes(1)
   })
 })
+
+it('names the visible folder in the filter prompt', () => {
+  const element = FileExplorerNameFilter({
+    query: '',
+    scopeLabel: 'apps/web',
+    onQueryChange: vi.fn(),
+    onClear: vi.fn()
+  })
+  expect(findInputByAriaLabel(element, 'Find files').props.placeholder).toBe('Find in apps/web')
+})
diff --git a/src/renderer/src/components/right-sidebar/FileExplorerNameFilter.tsx b/src/renderer/src/components/right-sidebar/FileExplorerNameFilter.tsx
index d28b49350eb..b4e86996c65 100644
--- a/src/renderer/src/components/right-sidebar/FileExplorerNameFilter.tsx
+++ b/src/renderer/src/components/right-sidebar/FileExplorerNameFilter.tsx
@@ -5,6 +5,7 @@ import { translate } from '@/i18n/i18n'
 
 type FileExplorerNameFilterProps = {
   query: string
+  scopeLabel?: string
   loading?: boolean
   onQueryChange: (value: string) => void
   onClear: () => void
@@ -12,6 +13,7 @@ type FileExplorerNameFilterProps = {
 
 export function FileExplorerNameFilter({
   query,
+  scopeLabel,
   loading = false,
   onQueryChange,
   onClear
@@ -29,10 +31,14 @@ export function FileExplorerNameFilter({
           'auto.components.right.sidebar.FileExplorerNameFilter.26fb73c6e3',
           'Find files'
         )}
-        placeholder={translate(
-          'auto.components.right.sidebar.FileExplorerNameFilter.26fb73c6e3',
-          'Find files'
-        )}
+        placeholder={
+          scopeLabel
+            ? translate('fileExplorer.root.findInFolder', 'Find in {{path}}', { path: scopeLabel })
+            : translate(
+                'auto.components.right.sidebar.FileExplorerNameFilter.26fb73c6e3',
+                'Find files'
+              )
+        }
         value={query}
         onChange={(event) => onQueryChange(event.currentTarget.value)}
         spellCheck={false}
diff --git a/src/renderer/src/components/right-sidebar/FileExplorerRootSelect.tsx b/src/renderer/src/components/right-sidebar/FileExplorerRootSelect.tsx
new file mode 100644
index 00000000000..d721f8d741a
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/FileExplorerRootSelect.tsx
@@ -0,0 +1,97 @@
+import { ChevronDown, ChevronRight, FolderTree } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuRadioGroup,
+  DropdownMenuRadioItem,
+  DropdownMenuTrigger
+} from '@/components/ui/dropdown-menu'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { translate } from '@/i18n/i18n'
+import { FILE_EXPLORER_FULL_ROOT, type ExplorerRootOption } from './file-explorer-display-root'
+
+export type FileExplorerRootSelectProps = {
+  options: ExplorerRootOption[]
+  value: string
+  onValueChange: (value: string) => void
+  disabled: boolean
+}
+
+export function FileExplorerRootSelect({
+  options,
+  value,
+  onValueChange,
+  disabled
+}: FileExplorerRootSelectProps): React.JSX.Element {
+  const fullRootLabel = translate('fileExplorer.root.full', 'Repository root')
+  const atRoot = value === FILE_EXPLORER_FULL_ROOT
+  const selectedLabel = atRoot
+    ? fullRootLabel
+    : (options.find((option) => option.value === value)?.label ?? value)
+  return (
+    <nav
+      aria-label={translate('fileExplorer.root.label', 'Explorer root')}
+      className="flex min-w-0 flex-1 items-center"
+    >
+      {!atRoot && (
+        <>
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <Button
+                type="button"
+                variant="ghost"
+                size="icon-xs"
+                disabled={disabled}
+                aria-label={fullRootLabel}
+                onClick={() => onValueChange(FILE_EXPLORER_FULL_ROOT)}
+              >
+                <FolderTree />
+              </Button>
+            </TooltipTrigger>
+            <TooltipContent>{fullRootLabel}</TooltipContent>
+          </Tooltip>
+          <ChevronRight className="size-3 shrink-0 text-muted-foreground" />
+        </>
+      )}
+      <DropdownMenu>
+        <Tooltip>
+          <TooltipTrigger asChild>
+            <DropdownMenuTrigger asChild>
+              <Button
+                type="button"
+                variant="ghost"
+                size="xs"
+                className="min-w-0"
+                disabled={disabled}
+                aria-label={translate('fileExplorer.root.label', 'Explorer root')}
+              >
+                {atRoot && <FolderTree />}
+                <span className="truncate">{selectedLabel}</span>
+                <ChevronDown />
+              </Button>
+            </DropdownMenuTrigger>
+          </TooltipTrigger>
+          <TooltipContent className="max-w-sm [overflow-wrap:anywhere]">
+            {selectedLabel}
+          </TooltipContent>
+        </Tooltip>
+        <DropdownMenuContent
+          align="start"
+          collisionPadding={8}
+          className="w-72 max-w-[calc(100vw-1rem)]"
+        >
+          <DropdownMenuRadioGroup value={value} onValueChange={onValueChange}>
+            {options.map((option) => (
+              <DropdownMenuRadioItem key={option.value} value={option.value}>
+                <span className="min-w-0 whitespace-normal [overflow-wrap:anywhere]">
+                  {option.value === FILE_EXPLORER_FULL_ROOT ? fullRootLabel : option.label}
+                </span>
+              </DropdownMenuRadioItem>
+            ))}
+          </DropdownMenuRadioGroup>
+        </DropdownMenuContent>
+      </DropdownMenu>
+    </nav>
+  )
+}
diff --git a/src/renderer/src/components/right-sidebar/FileExplorerRow.tsx b/src/renderer/src/components/right-sidebar/FileExplorerRow.tsx
index 8355ea38a01..d8ca5fba7ae 100644
--- a/src/renderer/src/components/right-sidebar/FileExplorerRow.tsx
+++ b/src/renderer/src/components/right-sidebar/FileExplorerRow.tsx
@@ -25,6 +25,7 @@ import { FileExplorerRowContextMenu } from './file-explorer-row-context-menu'
 
 export type FileExplorerRowProps = {
   node: TreeNode
+  displayDepthOffset?: number
   isExpanded: boolean
   isLoading: boolean
   isSelected: boolean
@@ -67,8 +68,10 @@ export type FileExplorerRowProps = {
   onNativeDragExpandDir: (dirPath: string) => void
 }
 
+/** Offsets visual indentation for a scoped tree without changing the node paths passed to file actions. */
 export function FileExplorerRow({
   node,
+  displayDepthOffset = 0,
   isExpanded,
   isLoading,
   isSelected,
@@ -144,7 +147,7 @@ export function FileExplorerRow({
             isSelected && 'text-accent-foreground',
             isFlashing && 'bg-amber-400/20 ring-1 ring-inset ring-amber-400/70'
           )}
-          style={{ paddingLeft: `${node.depth * 16 + 8}px` }}
+          style={{ paddingLeft: `${(node.depth - displayDepthOffset) * 16 + 8}px` }}
           ref={setRowDragNode}
           data-native-file-drop-dir={rowDropDir}
           // Why: marks this draggable row so the wheel-capture handler can rescue
diff --git a/src/renderer/src/components/right-sidebar/FileExplorerScopeNotice.test.tsx b/src/renderer/src/components/right-sidebar/FileExplorerScopeNotice.test.tsx
new file mode 100644
index 00000000000..34bfac75390
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/FileExplorerScopeNotice.test.tsx
@@ -0,0 +1,73 @@
+// @vitest-environment happy-dom
+import { cleanup, fireEvent, render as renderComponent, screen } from '@testing-library/react'
+import type { ReactNode } from 'react'
+import { afterEach, expect, it, vi } from 'vitest'
+import { TooltipProvider } from '@/components/ui/tooltip'
+import { FileExplorerScopeNotice } from './FileExplorerScopeNotice'
+
+const render = (ui: ReactNode) => renderComponent(ui, { wrapper: TooltipProvider })
+afterEach(cleanup)
+const props = {
+  returnRoot: null,
+  onSelectRoot: vi.fn(),
+  disabled: false,
+  searching: false,
+  sparse: true
+}
+
+it('keeps checkout guidance behind a keyboard-accessible disclosure', () => {
+  render(<FileExplorerScopeNotice {...props} />)
+  expect(screen.getByText('Sparse checkout')).toBeTruthy()
+  expect(screen.queryByText(/The folder picker changes/)).toBeNull()
+  fireEvent.click(screen.getByRole('button', { name: 'About sparse checkout scope' }))
+  expect(screen.getByText(/The folder picker changes/)).toBeTruthy()
+  expect(screen.getByText(/Contents searches across the workspace/)).toBeTruthy()
+})
+
+it('labels content search scope without implying all repository files are present', () => {
+  render(<FileExplorerScopeNotice {...props} searching />)
+  expect(screen.getByText('Search scope: workspace files')).toBeTruthy()
+  expect(screen.getAllByRole('button')).toHaveLength(1)
+})
+
+it('keeps return navigation alongside scope details and honors drag disabling', () => {
+  const onSelectRoot = vi.fn()
+  const returnRoot = { value: 'apps/web', label: 'apps/web' }
+  const { rerender } = render(
+    <FileExplorerScopeNotice {...props} returnRoot={returnRoot} onSelectRoot={onSelectRoot} />
+  )
+  fireEvent.click(screen.getByRole('button', { name: 'Back to apps/web' }))
+  expect(onSelectRoot).toHaveBeenCalledWith('apps/web')
+  expect(screen.getByRole('button', { name: 'About sparse checkout scope' })).toBeTruthy()
+  rerender(<FileExplorerScopeNotice {...props} returnRoot={returnRoot} disabled />)
+  expect(screen.getByRole('button', { name: 'Back to apps/web' }).hasAttribute('disabled')).toBe(
+    true
+  )
+})
+
+it('adds no sparse chrome to ordinary or folder workspaces', () => {
+  const { container } = render(<FileExplorerScopeNotice {...props} sparse={false} />)
+  expect(container.textContent).toBe('')
+})
+
+it('places the active folder choice in the scope row and retains the return action', () => {
+  render(
+    <FileExplorerScopeNotice
+      {...props}
+      rootSelect={{
+        options: [
+          { value: '/', label: 'Repository root' },
+          { value: 'packages/ui', label: 'packages/ui' }
+        ],
+        value: '/',
+        disabled: false,
+        onValueChange: vi.fn()
+      }}
+      returnRoot={{ value: 'packages/ui', label: 'packages/ui' }}
+    />
+  )
+  expect(screen.getByRole('button', { name: 'Explorer root' }).textContent).toContain(
+    'Repository root'
+  )
+  expect(screen.getByRole('button', { name: 'Back to packages/ui' })).toBeTruthy()
+})
diff --git a/src/renderer/src/components/right-sidebar/FileExplorerScopeNotice.tsx b/src/renderer/src/components/right-sidebar/FileExplorerScopeNotice.tsx
new file mode 100644
index 00000000000..af4ca7ff40d
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/FileExplorerScopeNotice.tsx
@@ -0,0 +1,109 @@
+import { ArrowLeft, Info } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { translate } from '@/i18n/i18n'
+import { FileExplorerRootSelect, type FileExplorerRootSelectProps } from './FileExplorerRootSelect'
+import type { ExplorerRootOption } from './file-explorer-display-root'
+
+export function FileExplorerScopeNotice({
+  rootSelect,
+  returnRoot,
+  onSelectRoot,
+  disabled,
+  searching,
+  sparse
+}: {
+  rootSelect?: FileExplorerRootSelectProps | null
+  returnRoot: ExplorerRootOption | null
+  onSelectRoot: (value: string) => void
+  disabled: boolean
+  searching: boolean
+  sparse: boolean
+}): React.JSX.Element | null {
+  if (!sparse) {
+    return null
+  }
+  return (
+    <div className="border-b border-border">
+      <div className="flex min-h-8 min-w-0 items-center gap-1 px-2">
+        {returnRoot && !searching && (
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <Button
+                type="button"
+                variant="ghost"
+                size="icon-xs"
+                disabled={disabled}
+                aria-label={translate('fileExplorer.root.back', 'Back to {{path}}', {
+                  path: returnRoot.label
+                })}
+                onClick={() => onSelectRoot(returnRoot.value)}
+              >
+                <ArrowLeft />
+              </Button>
+            </TooltipTrigger>
+            <TooltipContent>
+              {translate('fileExplorer.root.back', 'Back to {{path}}', { path: returnRoot.label })}
+            </TooltipContent>
+          </Tooltip>
+        )}
+        {rootSelect && !searching ? (
+          <FileExplorerRootSelect {...rootSelect} />
+        ) : (
+          <span className="min-w-0 flex-1 truncate text-xs text-muted-foreground">
+            {searching
+              ? translate('fileExplorer.root.searchScope', 'Search scope: workspace files')
+              : translate('fileExplorer.root.sparseStatus', 'Sparse checkout')}
+          </span>
+        )}
+        <div className="ml-auto shrink-0">
+          <Popover>
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <PopoverTrigger asChild>
+                  <Button
+                    variant="ghost"
+                    size="icon-xs"
+                    aria-label={translate(
+                      'fileExplorer.root.scopeDetails',
+                      'About sparse checkout scope'
+                    )}
+                  >
+                    <Info />
+                  </Button>
+                </PopoverTrigger>
+              </TooltipTrigger>
+              <TooltipContent>
+                {translate('fileExplorer.root.scopeDetails', 'About sparse checkout scope')}
+              </TooltipContent>
+            </Tooltip>
+            <PopoverContent
+              align="end"
+              collisionPadding={8}
+              className="w-72 max-w-[var(--radix-popover-content-available-width)]"
+            >
+              <div className="space-y-2 p-3 text-xs">
+                <p className="font-medium">
+                  {translate('fileExplorer.root.sparseStatus', 'Sparse checkout')}
+                </p>
+                <p>
+                  {translate(
+                    'fileExplorer.root.scopeExplanation',
+                    'The folder picker changes what you see, not which files are checked out. Repository root includes the checked-out root and ancestor files.'
+                  )}
+                </p>
+                <p className="text-muted-foreground">
+                  {translate(
+                    'fileExplorer.root.searchExplanation',
+                    'Names filters the folder you are viewing. Contents searches across the workspace. Files omitted by sparse checkout are not searched.'
+                  )}
+                </p>
+              </div>
+            </PopoverContent>
+          </Popover>
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/right-sidebar/FileExplorerToolbar.tsx b/src/renderer/src/components/right-sidebar/FileExplorerToolbar.tsx
index 85ef2277dbb..d3d4bd0d70e 100644
--- a/src/renderer/src/components/right-sidebar/FileExplorerToolbar.tsx
+++ b/src/renderer/src/components/right-sidebar/FileExplorerToolbar.tsx
@@ -32,6 +32,7 @@ type FileExplorerToolbarProps = {
   onToggleDotfiles: () => void
 }
 
+/** Shares repository actions across explorer views. */
 export function FileExplorerToolbar({
   repoName,
   worktreePath,
diff --git a/src/renderer/src/components/right-sidebar/FileExplorerTreeStatus.tsx b/src/renderer/src/components/right-sidebar/FileExplorerTreeStatus.tsx
index 58fa294e5da..dc68d17f63c 100644
--- a/src/renderer/src/components/right-sidebar/FileExplorerTreeStatus.tsx
+++ b/src/renderer/src/components/right-sidebar/FileExplorerTreeStatus.tsx
@@ -6,14 +6,17 @@ type FileExplorerTreeStatusProps = {
   isLoading: boolean
   error: string | null
   isEmpty: boolean
+  scopedToFolder?: boolean
   emptyMessage?: string
 }
 
+/** Treats even an empty error message as a failed read, keeping unreadable directories distinct from empty ones. */
 export function FileExplorerTreeStatus({
   isLoading,
   error,
   isEmpty,
-  emptyMessage
+  emptyMessage,
+  scopedToFolder = false
 }: FileExplorerTreeStatusProps): React.JSX.Element | null {
   if (isLoading) {
     return (
@@ -23,13 +26,15 @@ export function FileExplorerTreeStatus({
     )
   }
 
-  if (error) {
+  if (error !== null) {
     return (
       <div className="flex h-full items-center justify-center px-4 text-center text-[11px] text-muted-foreground">
-        {translate(
-          'auto.components.right.sidebar.FileExplorerTreeStatus.c76693e456',
-          'Could not load files for this workspace:'
-        )}{' '}
+        {scopedToFolder
+          ? translate('fileExplorer.root.folderLoadError', 'Could not load this folder:')
+          : translate(
+              'auto.components.right.sidebar.FileExplorerTreeStatus.c76693e456',
+              'Could not load files for this workspace:'
+            )}{' '}
         {error}
       </div>
     )
@@ -39,10 +44,12 @@ export function FileExplorerTreeStatus({
     return (
       <div className="flex h-full items-center justify-center px-4 text-center text-[11px] text-muted-foreground">
         {emptyMessage ??
-          translate(
-            'auto.components.right.sidebar.FileExplorerTreeStatus.ce03835e1f',
-            'No files in this workspace'
-          )}
+          (scopedToFolder
+            ? translate('fileExplorer.root.emptyFolder', 'No files in this folder')
+            : translate(
+                'auto.components.right.sidebar.FileExplorerTreeStatus.ce03835e1f',
+                'No files in this workspace'
+              ))}
       </div>
     )
   }
diff --git a/src/renderer/src/components/right-sidebar/FileExplorerVirtualRows.tsx b/src/renderer/src/components/right-sidebar/FileExplorerVirtualRows.tsx
index a4fefd0b715..eb4e7425516 100644
--- a/src/renderer/src/components/right-sidebar/FileExplorerVirtualRows.tsx
+++ b/src/renderer/src/components/right-sidebar/FileExplorerVirtualRows.tsx
@@ -16,6 +16,7 @@ type FileExplorerVirtualRowsProps = {
   virtualizer: Virtualizer<HTMLDivElement, Element>
   inlineInputIndex: number
   rowProjection: FileExplorerRowProjection
+  displayDepthOffset?: number
   inlineInput: InlineInput | null
   handleInlineSubmit: (value: string) => void
   dismissInlineInput: () => void
@@ -100,11 +101,13 @@ function resolveDragSourceExecutionHostId(
   return sourceExecutionHostId
 }
 
+/** Renders virtual and inline-input rows using display-relative indentation but worktree-relative operation paths. */
 export function FileExplorerVirtualRows(props: FileExplorerVirtualRowsProps): React.JSX.Element {
   const {
     virtualizer,
     inlineInputIndex,
     rowProjection,
+    displayDepthOffset = 0,
     inlineInput,
     handleInlineSubmit,
     dismissInlineInput,
@@ -183,7 +186,7 @@ export function FileExplorerVirtualRows(props: FileExplorerVirtualRowsProps): Re
               style={{ transform: `translateY(${vItem.start}px)` }}
             >
               <InlineInputRow
-                depth={inlineDepth}
+                depth={inlineDepth - displayDepthOffset}
                 inlineInput={inlineInput!}
                 onSubmit={handleInlineSubmit}
                 onCancel={dismissInlineInput}
@@ -220,6 +223,7 @@ export function FileExplorerVirtualRows(props: FileExplorerVirtualRowsProps): Re
             style={{ transform: `translateY(${vItem.start}px)` }}
           >
             <FileExplorerRow
+              displayDepthOffset={displayDepthOffset}
               node={n}
               isExpanded={expanded.has(n.path)}
               isLoading={n.isDirectory && loadingDirPaths.has(n.path)}
diff --git a/src/renderer/src/components/right-sidebar/SourceControl.host-context-boundary.test.ts b/src/renderer/src/components/right-sidebar/SourceControl.host-context-boundary.test.ts
deleted file mode 100644
index 12539a08acc..00000000000
--- a/src/renderer/src/components/right-sidebar/SourceControl.host-context-boundary.test.ts
+++ /dev/null
@@ -1,111 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-const WORKTREE_CONTEXT_SOURCE = readFileSync(
-  join(__dirname, 'source-control/listing/use-worktree-context.ts'),
-  'utf8'
-)
-const PR_GENERATION_SOURCE = readFileSync(
-  join(__dirname, 'source-control/review/use-pull-request-generation.ts'),
-  'utf8'
-)
-const CREATE_REVIEW_COMPOSER_SOURCE = readFileSync(
-  join(__dirname, 'source-control/review/use-create-review-composer.ts'),
-  'utf8'
-)
-const STATUS_REFRESH_SOURCE = readFileSync(
-  join(__dirname, 'source-control/sync/use-status-refresh.ts'),
-  'utf8'
-)
-const BASE_REF_DEFAULT_SOURCE = readFileSync(
-  join(__dirname, 'source-control/sync/use-base-ref-default.ts'),
-  'utf8'
-)
-
-function sourceBetween(source: string, startPattern: string, endPattern: string): string {
-  const start = source.indexOf(startPattern)
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = source.indexOf(endPattern, start + startPattern.length)
-  expect(end).toBeGreaterThan(start)
-  return source.slice(start, end)
-}
-
-describe('SourceControl host-context boundaries', () => {
-  it('snapshots PR generation host ownership and reuses it after async branch preparation', () => {
-    const generateSection = sourceBetween(
-      PR_GENERATION_SOURCE,
-      'const handleGeneratePullRequestFieldsForActive = useCallback(',
-      'const handleCancelGeneratePullRequestFieldsForActive = useCallback('
-    )
-    expect(generateSection).toContain('runtimeTargetSettings: activeRepoSettings')
-    expect(generateSection).toContain('settings: context.runtimeTargetSettings')
-
-    const cancelSection = sourceBetween(
-      PR_GENERATION_SOURCE,
-      'const handleCancelGeneratePullRequestFieldsForActive = useCallback(',
-      'const handlePullRequestGenerationSeedRestored = useCallback('
-    )
-    expect(cancelSection).toContain('settings: record.context.runtimeTargetSettings')
-
-    const refreshSection = sourceBetween(
-      STATUS_REFRESH_SOURCE,
-      'const refreshGitStatusAfterPullRequestGeneration = useCallback(',
-      '  return {'
-    )
-    expect(refreshSection).toContain('settings: context.runtimeTargetSettings')
-    expect(refreshSection).not.toContain('settings: activeRepoSettings')
-  })
-
-  it('routes create-review field generation through caller-provided owner settings', () => {
-    const composerCall = sourceBetween(
-      CREATE_REVIEW_COMPOSER_SOURCE,
-      '} = useCreatePullRequestDialogFields({',
-      'const handleGeneratePullRequestFieldsClick = useCallback'
-    )
-    expect(composerCall).toContain('settings: activeRepoSettings')
-
-    const hookSource = readFileSync(
-      join(__dirname, 'use-create-pull-request-field-generation.ts'),
-      'utf8'
-    )
-    const requestContext = sourceBetween(hookSource, 'const requestContext = {', 'const seed = {')
-    expect(requestContext).toContain('settings,')
-    expect(requestContext).not.toContain('useAppStore.getState().settings')
-  })
-
-  it('keeps eligibility base refreshes scoped to repo execution ownership', () => {
-    const ownerSettingsSection = sourceBetween(
-      WORKTREE_CONTEXT_SOURCE,
-      'const activeRepoSettings = useMemo(',
-      'const activeRepoRuntimeEnvironmentId'
-    )
-    expect(ownerSettingsSection).not.toContain('activeRepo ?? null')
-    expect(ownerSettingsSection).toContain(
-      '[activeRepoConnectionId, activeRepoExecutionHostId, activeRepoId, settings]'
-    )
-
-    const baseRefSection = sourceBetween(
-      BASE_REF_DEFAULT_SOURCE,
-      '// Why: reset to null so that effectiveBaseRef becomes falsy until the IPC',
-      '  return defaultBaseRef'
-    )
-    expect(baseRefSection).toContain(
-      'getRuntimeRepoBaseRefDefault(\n      { activeRuntimeEnvironmentId: activeRepoRuntimeEnvironmentId },\n      activeRepoId'
-    )
-    const dependencyBlock = sourceBetween(baseRefSection, '  }, [', '  ])')
-    const dependencyEntries = dependencyBlock
-      .split('\n')
-      .slice(1)
-      .map((line) => line.trim().replace(/,$/, ''))
-      .filter((line) => line.length > 0 && !line.startsWith('//'))
-    expect(dependencyEntries).toEqual([
-      'activeRepoConnectionId',
-      'activeRepoExecutionHostId',
-      'activeRepoId',
-      'activeRepoRuntimeEnvironmentId',
-      'isBranchVisible',
-      'isFolder'
-    ])
-  })
-})
diff --git a/src/renderer/src/components/right-sidebar/SourceControl.virtual-file-list.test.tsx b/src/renderer/src/components/right-sidebar/SourceControl.virtual-file-list.test.tsx
index 2970693dfe4..4d3c172c1ba 100644
--- a/src/renderer/src/components/right-sidebar/SourceControl.virtual-file-list.test.tsx
+++ b/src/renderer/src/components/right-sidebar/SourceControl.virtual-file-list.test.tsx
@@ -203,13 +203,13 @@ beforeEach(() => {
   // and 24px rows (both rect + row measurement read offsetHeight), and keep
   // the observer path inert so measurements stay deterministic.
   vi.stubGlobal('ResizeObserver', NoopResizeObserver)
-  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(
-    function (this: HTMLElement) {
-      return this.classList.contains('overflow-auto')
-        ? VIEWPORT_HEIGHT_PX
-        : VIRTUALIZED_LIST_ROW_HEIGHT_PX
-    }
-  )
+  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(function (
+    this: HTMLElement
+  ) {
+    return this.classList.contains('overflow-auto')
+      ? VIEWPORT_HEIGHT_PX
+      : VIRTUALIZED_LIST_ROW_HEIGHT_PX
+  })
   vi.spyOn(Element.prototype, 'getBoundingClientRect').mockImplementation(function (this: Element) {
     // The panel scroller acts as the fixed viewport; everything inside it
     // shifts up by scrollTop, which is what the list's scroll-margin math
diff --git a/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.test.ts b/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.test.ts
index 19f0d47ce82..db39129526e 100644
--- a/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.test.ts
+++ b/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.test.ts
@@ -13,6 +13,7 @@ import {
   useAiVaultSessionRefresh
 } from './ai-vault-session-refresh'
 import { DEFAULT_AI_VAULT_SESSION_LIMIT, type AiVaultSessionLimit } from './ai-vault-session-limit'
+import { withNonSecureContextCrypto } from '@/lib/non-secure-context-crypto-stub'
 
 const EMPTY_RESULT: AiVaultListResult = {
   sessions: [],
@@ -801,3 +802,21 @@ describe('useAiVaultSessionRefresh in-app agent session behavior', () => {
     expect(listSessionsMock.mock.calls.length).toBe(callsWhileHealthy)
   })
 })
+
+// Regression for #18096: over plain HTTP the browser hides crypto.randomUUID, so minting
+// the request token with a raw call threw during render and the panel showed "The right
+// sidebar hit an error". The fallback must still be a well-formed v4 UUID.
+describe('useAiVaultSessionRefresh in a non-secure context', () => {
+  it('mints a request token when crypto.randomUUID is unavailable', async () => {
+    await withNonSecureContextCrypto(async () => {
+      await renderHook()
+      await flushMicrotasks()
+
+      expect(lastCallArgs()).toMatchObject({
+        requestToken: expect.stringMatching(
+          /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
+        )
+      })
+    })
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.ts b/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.ts
index b8787af49f9..9ace8fbd399 100644
--- a/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.ts
+++ b/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.ts
@@ -21,6 +21,7 @@ import {
   readCachedAiVaultSessionResult,
   resetAiVaultSessionResultCacheForTest
 } from './ai-vault-session-result-cache'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 // In-app session creation bypasses the cache so the new session appears promptly.
 // Keep the budget at module scope so tab remounts cannot amplify full scans.
@@ -94,7 +95,7 @@ export function useAiVaultSessionRefresh(
   const [loading, setLoading] = useState(false)
   const [error, setError] = useState<string | null>(null)
   const requestTokenRef = useRef<string>(undefined!)
-  requestTokenRef.current ??= crypto.randomUUID()
+  requestTokenRef.current ??= createBrowserUuid()
   const refreshIdRef = useRef(0)
   const refreshInFlightRef = useRef(false)
   const pendingRefreshRef = useRef(false)
diff --git a/src/renderer/src/components/right-sidebar/checks-panel/active-content.tsx b/src/renderer/src/components/right-sidebar/checks-panel/active-content.tsx
index caf3c074ea3..9f1cc498e31 100644
--- a/src/renderer/src/components/right-sidebar/checks-panel/active-content.tsx
+++ b/src/renderer/src/components/right-sidebar/checks-panel/active-content.tsx
@@ -8,7 +8,7 @@ import { SourceControlAgentActionDialog } from '../SourceControlAgentActionDialo
 import { ChecksPanelUpdatedAtMetadata } from '../checks-panel-updated-at-metadata'
 import { getChecksPanelRefreshErrorBannerLine } from '../github-refresh-error-copy'
 import { resolveChecksPanelHostedReviewModifierDestination } from '../checks-panel-hosted-review-click-routing'
-import { readSourceControlLaunchRecipeAgentId } from '@/lib/source-control-launch-agent-selection'
+import { readSourceControlLaunchRecipeAgentId } from '../../../../../shared/source-control-launch-agent-selection'
 import { resolveSourceControlActionRecipe } from '../../../../../shared/source-control-ai'
 import { clearPendingPRCommentAiAck } from '../pr-comments-ai-launch-ack'
 import { getBrokenChecks } from '../../pr-checks-fix-prompt'
diff --git a/src/renderer/src/components/right-sidebar/file-explorer-display-root.test.ts b/src/renderer/src/components/right-sidebar/file-explorer-display-root.test.ts
new file mode 100644
index 00000000000..607cb702abc
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/file-explorer-display-root.test.ts
@@ -0,0 +1,111 @@
+import { describe, expect, it } from 'vitest'
+import {
+  getExplorerDisplayDepth,
+  getExplorerDisplayRootOptions,
+  getExplorerDisplayRootPath,
+  resolveExplorerDisplayRootChoice,
+  getExplorerEffectiveExpanded
+} from './file-explorer-display-root'
+import { createVisibleFileExplorerRowProjection } from './useFileExplorerVisibleRowProjection'
+import { fileExplorerEntriesToTreeNodes } from './file-explorer-directory-listing'
+
+const flags = { ignoredSet: new Set<string>(), showDotfiles: true, showGitIgnoredFiles: true }
+
+describe('sparse explorer projection', () => {
+  it('resolves defaults and preserves explicit full root', () => {
+    const options = getExplorerDisplayRootOptions({
+      isSparse: true,
+      sparseDirectories: ['packages/app', 'packages/api']
+    })
+    expect(resolveExplorerDisplayRootChoice(options)).toBe('/')
+    expect(resolveExplorerDisplayRootChoice(options, '/')).toBe('/')
+    expect(resolveExplorerDisplayRootChoice(options, 'packages/api')).toBe('packages/api')
+    expect(
+      resolveExplorerDisplayRootChoice(
+        getExplorerDisplayRootOptions({ isSparse: true, sparseDirectories: ['packages/app'] })
+      )
+    ).toBe('packages/app')
+    expect(resolveExplorerDisplayRootChoice(options, 'removed')).toBe('/')
+    expect(getExplorerDisplayRootOptions({ sparseDirectories: ['src'] })).toBeNull()
+    expect(resolveExplorerDisplayRootChoice(null, 'src')).toBe('/')
+  })
+  it('rejects unsafe directories and deduplicates normalized options', () => {
+    expect(
+      getExplorerDisplayRootOptions({
+        isSparse: true,
+        sparseDirectories: [
+          '/etc',
+          '../src',
+          'app/../etc',
+          'C:\\src',
+          'packages\\app',
+          'packages/app'
+        ]
+      })?.map((option) => option.value)
+    ).toEqual(['/', 'packages/app'])
+  })
+  it.each(['/repo', 'C:\\repo'])(
+    'keeps identity and depths relative to true root on %s',
+    (root) => {
+      const scope = getExplorerDisplayRootPath(root, 'packages/app')!
+      const depth = getExplorerDisplayDepth(root, scope)
+      const children = fileExplorerEntriesToTreeNodes(
+        [{ name: 'index.ts', isDirectory: false, isSymlink: false }],
+        scope,
+        depth - 1,
+        root,
+        { kind: 'local' }
+      )
+      const projection = createVisibleFileExplorerRowProjection(
+        {
+          worktreePath: root,
+          displayRootPath: scope,
+          expanded: new Set(),
+          dirCache: { [scope]: { children } }
+        },
+        flags
+      )
+      expect(projection.getRowAtIndex(0)).toMatchObject({
+        relativePath: 'packages/app/index.ts',
+        depth: 2
+      })
+      expect(projection.getRowAtIndex(0)?.path).toBe(
+        getExplorerDisplayRootPath(root, 'packages/app/index.ts')
+      )
+    }
+  )
+  it('scopes name results without duplicating their directory prefix or matching adjacent names', () => {
+    const projection = createVisibleFileExplorerRowProjection(
+      {
+        worktreePath: '/repo',
+        displayRootPath: '/repo/packages/app',
+        expanded: new Set(),
+        dirCache: {}
+      },
+      {
+        ...flags,
+        nameFilter: {
+          query: 'index',
+          relativePaths: [
+            'packages/app/src/index.ts',
+            'packages/apple/index.ts',
+            'packages/api/index.ts'
+          ]
+        }
+      }
+    )
+    expect(projection.getOrderedPaths()).toEqual([
+      '/repo/packages/app/src',
+      '/repo/packages/app/src/index.ts'
+    ])
+    expect(projection.getRowAtIndex(1)?.relativePath).toBe('packages/app/src/index.ts')
+  })
+  it('keeps the displayed root refreshable after Collapse All without persisting expansion', () => {
+    const userExpanded = new Set<string>()
+    expect([...getExplorerEffectiveExpanded(userExpanded, '/repo/packages/app')]).toEqual([
+      '/repo/packages/app'
+    ])
+    expect(userExpanded.size).toBe(0)
+    expect(getExplorerEffectiveExpanded(userExpanded, null)).toBe(userExpanded)
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/file-explorer-display-root.ts b/src/renderer/src/components/right-sidebar/file-explorer-display-root.ts
new file mode 100644
index 00000000000..f8a877ec899
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/file-explorer-display-root.ts
@@ -0,0 +1,81 @@
+import { translate } from '@/i18n/i18n'
+import { getRelativePathInsideRoot, joinPath } from '@/lib/path'
+import { FILE_EXPLORER_FULL_ROOT } from '../../../../shared/file-explorer-display-root'
+import { splitPathSegments } from './path-tree'
+
+export { FILE_EXPLORER_FULL_ROOT }
+export type ExplorerRootOption = { value: string; label: string }
+
+/** Returns deduplicated safe sparse-directory choices plus full root, or null when scoping is unavailable. */
+export function getExplorerDisplayRootOptions(
+  worktree: {
+    isSparse?: boolean
+    sparseDirectories?: string[]
+  } | null
+): ExplorerRootOption[] | null {
+  if (!worktree?.isSparse) {
+    return null
+  }
+  const dirs = [
+    ...new Set(
+      (worktree.sparseDirectories ?? [])
+        .filter(
+          (dir) =>
+            Boolean(dir) &&
+            !/^[\\/]|^[A-Za-z]:/.test(dir) &&
+            !splitPathSegments(dir).some((part) => part === '..' || part === '.')
+        )
+        .map((dir) => splitPathSegments(dir).join('/'))
+    )
+  ].filter(Boolean)
+  return dirs.length
+    ? [
+        {
+          value: FILE_EXPLORER_FULL_ROOT,
+          label: translate('fileExplorer.root.full', 'Repository root')
+        },
+        ...dirs.map((dir) => ({ value: dir, label: dir }))
+      ]
+    : null
+}
+
+/** Focuses a sole sparse directory; multiple directories retain repository context unless explicitly scoped. */
+export function resolveExplorerDisplayRootChoice(
+  options: ExplorerRootOption[] | null,
+  saved?: string
+): string {
+  return options?.some((option) => option.value === saved)
+    ? saved!
+    : options?.length === 2
+      ? options[1].value
+      : FILE_EXPLORER_FULL_ROOT
+}
+
+/** Resolves a display choice against the actual workspace root; the full-root sentinel leaves that root intact. */
+export function getExplorerDisplayRootPath(
+  worktreePath: string | null,
+  choice: string
+): string | null {
+  return worktreePath && choice !== FILE_EXPLORER_FULL_ROOT
+    ? joinPath(worktreePath, choice)
+    : worktreePath
+}
+
+/** Returns the ancestor depth to subtract from cached row indentation, without rebasing file identities. */
+export function getExplorerDisplayDepth(
+  worktreePath: string | null,
+  displayRootPath: string | null
+): number {
+  const relative = displayRootPath ? getRelativePathInsideRoot(displayRootPath, worktreePath) : null
+  return relative ? splitPathSegments(relative).length : 0
+}
+
+/** Includes the displayed root for loading and refresh without persisting it as a user-expanded folder. */
+export function getExplorerEffectiveExpanded(
+  expanded: Set<string>,
+  displayRootPath: string | null
+): Set<string> {
+  return displayRootPath && !expanded.has(displayRootPath)
+    ? new Set([...expanded, displayRootPath])
+    : expanded
+}
diff --git a/src/renderer/src/components/right-sidebar/file-explorer-expanded-dirs-refresh.ts b/src/renderer/src/components/right-sidebar/file-explorer-expanded-dirs-refresh.ts
index 6f172ee5d11..06088739ae3 100644
--- a/src/renderer/src/components/right-sidebar/file-explorer-expanded-dirs-refresh.ts
+++ b/src/renderer/src/components/right-sidebar/file-explorer-expanded-dirs-refresh.ts
@@ -30,6 +30,7 @@ export type RefreshFileExplorerExpandedDirsParams = {
   onDirCommitted?: (dirPath: string) => void
 }
 
+/** Refreshes directories with bounded concurrency and load-token ownership, preserving cached children on read failure. */
 export async function refreshFileExplorerExpandedDirs({
   dirs,
   worktreePath,
@@ -80,6 +81,7 @@ export async function refreshFileExplorerExpandedDirs({
     }
   }
 
+  /** Commits only still-owned reads so superseded refreshes cannot replace newer directory data. */
   const commitPendingResults = (): void => {
     if (stopped) {
       return
@@ -95,7 +97,14 @@ export async function refreshFileExplorerExpandedDirs({
     setDirCache((prev) => {
       const next = { ...prev }
       for (const result of currentResults) {
-        next[result.dirPath] = result.cache
+        next[result.dirPath] =
+          result.cache.error !== undefined
+            ? {
+                ...prev[result.dirPath],
+                children: prev[result.dirPath]?.children ?? [],
+                error: result.cache.error
+              }
+            : result.cache
       }
       return next
     })
@@ -157,9 +166,9 @@ export async function refreshFileExplorerExpandedDirs({
             operationOwner: listing.operationOwner
           }
         }
-      } catch {
+      } catch (error) {
         if (dirLoadTracker.isCurrent(loadToken)) {
-          cache = { children: [] }
+          cache = { children: [], error: error instanceof Error ? error.message : String(error) }
         }
       }
       settleRead(cache ? { dirPath, cache } : undefined)
diff --git a/src/renderer/src/components/right-sidebar/file-explorer-name-filter-projection.ts b/src/renderer/src/components/right-sidebar/file-explorer-name-filter-projection.ts
index 3a118ba18c5..b8d9256219e 100644
--- a/src/renderer/src/components/right-sidebar/file-explorer-name-filter-projection.ts
+++ b/src/renderer/src/components/right-sidebar/file-explorer-name-filter-projection.ts
@@ -1,4 +1,4 @@
-import { joinPath, normalizeRelativePath } from '@/lib/path'
+import { getRelativePathInsideRoot, joinPath, normalizeRelativePath } from '@/lib/path'
 import { compareFileNames } from '../../../../shared/file-name-sort'
 import {
   FILE_NAME_FILTER_QUERY_MAX_BYTES,
@@ -107,13 +107,15 @@ function createSyntheticNode(
   }
 }
 
+/** Builds a filtered subtree for the display root while retaining worktree-relative paths on synthetic nodes. */
 export function createNameFilteredFileExplorerProjection({
   collapsedPaths,
   ignoredSet,
   nameFilter,
   showDotfiles,
   showGitIgnoredFiles,
-  worktreePath
+  worktreePath,
+  displayRootPath = worktreePath
 }: {
   collapsedPaths?: ReadonlySet<string>
   ignoredSet: Set<string>
@@ -121,6 +123,7 @@ export function createNameFilteredFileExplorerProjection({
   showDotfiles: boolean
   showGitIgnoredFiles: boolean
   worktreePath: string
+  displayRootPath?: string
 }): FileExplorerRowProjection {
   const visibleFlatRows: TreeNode[] = []
   const rowsByPath = new Map<string, TreeNode>()
@@ -137,7 +140,10 @@ export function createNameFilteredFileExplorerProjection({
   const rootChildren = new Map<string, SyntheticTreeEntry>()
   for (const rawRelativePath of nameFilter.relativePaths) {
     const relativePath = normalizeRelativePath(rawRelativePath)
-    if (!relativePath) {
+    if (
+      !relativePath ||
+      getRelativePathInsideRoot(joinPath(worktreePath, relativePath), displayRootPath) === null
+    ) {
       continue
     }
     if (!showDotfiles && isDotfileRelativePath(relativePath)) {
@@ -178,7 +184,16 @@ export function createNameFilteredFileExplorerProjection({
     }
   }
 
-  appendNameFilteredEntries(rootChildren.values(), visibleFlatRows, rowsByPath, collapsedPaths)
+  let displayChildren = rootChildren
+  const scope = getRelativePathInsideRoot(displayRootPath, worktreePath)
+  for (const segment of scope ? splitPathSegments(scope) : []) {
+    const entry = displayChildren.get(segment)
+    if (!entry) {
+      return createFileExplorerRowProjectionFromParts(visibleFlatRows, rowsByPath)
+    }
+    displayChildren = entry.children
+  }
+  appendNameFilteredEntries(displayChildren.values(), visibleFlatRows, rowsByPath, collapsedPaths)
   return createFileExplorerRowProjectionFromParts(visibleFlatRows, rowsByPath)
 }
 
diff --git a/src/renderer/src/components/right-sidebar/file-explorer-types.ts b/src/renderer/src/components/right-sidebar/file-explorer-types.ts
index 02bd1fd39e4..62525e2d834 100644
--- a/src/renderer/src/components/right-sidebar/file-explorer-types.ts
+++ b/src/renderer/src/components/right-sidebar/file-explorer-types.ts
@@ -19,6 +19,7 @@ export type TreeNode = {
 
 /** Why no `loading` here: see file-explorer-loading-dirs.ts — identity changes re-walk the tree. */
 export type DirCache = {
+  error?: string
   children: TreeNode[]
   operationOwner?: FileExplorerOperationOwner
 }
diff --git a/src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.test.ts b/src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.test.ts
index 7d7e1b1e4ad..6706b5ea0ad 100644
--- a/src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.test.ts
+++ b/src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.test.ts
@@ -56,6 +56,39 @@ function review(number: number): HostedReviewInfo {
 }
 
 describe('parent PR checks projection selector', () => {
+  it.each([false, true])(
+    'releases unrelated store data while keeping the projection cached (replacement=%s)',
+    async (replacement) => {
+      if (typeof globalThis.gc !== 'function') {
+        throw new Error('Run with the repository Vitest --expose-gc config')
+      }
+      const select = createParentPrChecksProjectionSelector({
+        worktrees: [worktree(0)],
+        repos: [repo()],
+        settings: null,
+        refreshOutcomes: new Map()
+      })
+      if (replacement) {
+        select({ hostedReviewCache: {}, prCache: {}, checksCache: {} })
+      }
+      const caches = { hostedReviewCache: {}, prCache: {}, checksCache: {} }
+      function selectRetiredState(): WeakRef<object> {
+        const unrelatedData = { content: new Uint8Array(1024 * 1024) }
+        const state = { ...caches, unrelatedData }
+        select(state)
+        return new WeakRef(unrelatedData)
+      }
+      const retired = selectRetiredState()
+      const projection = select(caches)
+      for (let round = 0; round < 3; round++) {
+        await new Promise<void>((resolve) => setImmediate(resolve))
+        globalThis.gc()
+      }
+      expect(retired.deref()).toBeUndefined()
+      expect(select(caches)).toBe(projection)
+    }
+  )
+
   it('does not inspect tracked keys when cache map references are unchanged', () => {
     const cacheRead = vi.fn()
     const observedCache = new Proxy(
diff --git a/src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.ts b/src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.ts
index 42ad55de0a8..4c4f04cb7ac 100644
--- a/src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.ts
+++ b/src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.ts
@@ -18,6 +18,15 @@ type CacheDependency = {
   value: unknown
 }
 
+function selectCacheReferences(state: ReviewCacheState): ReviewCacheState {
+  // Pick narrows the type, not the object received from the store.
+  return {
+    hostedReviewCache: state.hostedReviewCache,
+    prCache: state.prCache,
+    checksCache: state.checksCache
+  }
+}
+
 function trackCacheReads<K extends ReviewCacheName>(
   state: ReviewCacheState,
   cacheName: K,
@@ -74,7 +83,7 @@ export function createParentPrChecksProjectionSelector(
       }
       if (dependenciesAreCurrent(state, cached.cacheReferences, cached.dependencies)) {
         // Why: adopting unrelated replacement maps keeps later store notifications O(1).
-        cached.cacheReferences = state
+        cached.cacheReferences = selectCacheReferences(state)
         return cached.projection
       }
     }
@@ -88,7 +97,7 @@ export function createParentPrChecksProjectionSelector(
       prCache: trackCacheReads(state, 'prCache', dependencies),
       checksCache: trackCacheReads(state, 'checksCache', dependencies)
     })
-    cached = { cacheReferences: state, dependencies, projection }
+    cached = { cacheReferences: selectCacheReferences(state), dependencies, projection }
     return projection
   }
 }
diff --git a/src/renderer/src/components/right-sidebar/source-control/ai/recovery-launch.ts b/src/renderer/src/components/right-sidebar/source-control/ai/recovery-launch.ts
index ec1a7169825..4a055a613ee 100644
--- a/src/renderer/src/components/right-sidebar/source-control/ai/recovery-launch.ts
+++ b/src/renderer/src/components/right-sidebar/source-control/ai/recovery-launch.ts
@@ -7,7 +7,7 @@ import { planAgentCliArgsSuffix } from '@/lib/tui-agent-startup'
 import {
   pickSourceControlLaunchAgent,
   readSourceControlLaunchRecipeAgentId
-} from '@/lib/source-control-launch-agent-selection'
+} from '../../../../../../shared/source-control-launch-agent-selection'
 import { isTuiAgentEnabled } from '../../../../../../shared/tui-agent-selection'
 import type {
   SourceControlActionRecipe,
diff --git a/src/renderer/src/components/right-sidebar/source-control/commit/component-gates.ts b/src/renderer/src/components/right-sidebar/source-control/commit/component-gates.ts
index e5b59366ce9..aca9e0ca192 100644
--- a/src/renderer/src/components/right-sidebar/source-control/commit/component-gates.ts
+++ b/src/renderer/src/components/right-sidebar/source-control/commit/component-gates.ts
@@ -1,4 +1,4 @@
-import { pickSourceControlLaunchAgent } from '@/lib/source-control-launch-agent-selection'
+import { pickSourceControlLaunchAgent } from '../../../../../../shared/source-control-launch-agent-selection'
 import type { GitConflictOperation } from '../../../../../../shared/git-status-types'
 import type { TuiAgent } from '../../../../../../shared/tui-agent'
 
diff --git a/src/renderer/src/components/right-sidebar/source-control/commit/recovery-notice.tsx b/src/renderer/src/components/right-sidebar/source-control/commit/recovery-notice.tsx
index 0afb3c49bef..a86ac2697c1 100644
--- a/src/renderer/src/components/right-sidebar/source-control/commit/recovery-notice.tsx
+++ b/src/renderer/src/components/right-sidebar/source-control/commit/recovery-notice.tsx
@@ -11,7 +11,7 @@ import {
   DialogTitle
 } from '@/components/ui/dialog'
 import { translate } from '@/i18n/i18n'
-import { readSourceControlLaunchRecipeAgentId } from '@/lib/source-control-launch-agent-selection'
+import { readSourceControlLaunchRecipeAgentId } from '../../../../../../shared/source-control-launch-agent-selection'
 import type {
   SourceControlActionRecipe,
   SourceControlLaunchActionId
diff --git a/src/renderer/src/components/right-sidebar/source-control/panel/panel-dialogs.tsx b/src/renderer/src/components/right-sidebar/source-control/panel/panel-dialogs.tsx
index b5a414431ed..2dc2ee71f9a 100644
--- a/src/renderer/src/components/right-sidebar/source-control/panel/panel-dialogs.tsx
+++ b/src/renderer/src/components/right-sidebar/source-control/panel/panel-dialogs.tsx
@@ -1,4 +1,4 @@
-import { readSourceControlLaunchRecipeAgentId } from '@/lib/source-control-launch-agent-selection'
+import { readSourceControlLaunchRecipeAgentId } from '../../../../../../shared/source-control-launch-agent-selection'
 import { SourceControlDialogLayer } from './dialog-layer'
 import type { SourceControlPanelReadyProps } from './panel-props'
 
diff --git a/src/renderer/src/components/right-sidebar/use-file-explorer-background-menu.ts b/src/renderer/src/components/right-sidebar/use-file-explorer-background-menu.ts
index 5810cbed500..b05103959f8 100644
--- a/src/renderer/src/components/right-sidebar/use-file-explorer-background-menu.ts
+++ b/src/renderer/src/components/right-sidebar/use-file-explorer-background-menu.ts
@@ -15,9 +15,11 @@ type UseFileExplorerBackgroundMenuResult = {
 /** Empty-space interactions of the explorer surface: background menu and new-file double click. */
 export function useFileExplorerBackgroundMenu({
   worktreePath,
+  displayDepth = 0,
   inlineInput,
   startNew
 }: {
+  displayDepth?: number
   worktreePath: string | null
   inlineInput: InlineInput | null
   startNew: (type: 'file' | 'folder', parentPath: string, depth: number) => void
@@ -48,9 +50,9 @@ export function useFileExplorerBackgroundMenu({
       if (target.closest('[data-slot="context-menu-trigger"]')) {
         return
       }
-      startNew('file', worktreePath, 0)
+      startNew('file', worktreePath, displayDepth)
     },
-    [inlineInput, startNew, worktreePath]
+    [inlineInput, startNew, worktreePath, displayDepth]
   )
 
   return {
diff --git a/src/renderer/src/components/right-sidebar/use-file-explorer-root-navigation.test.tsx b/src/renderer/src/components/right-sidebar/use-file-explorer-root-navigation.test.tsx
new file mode 100644
index 00000000000..fc40dc77c3c
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/use-file-explorer-root-navigation.test.tsx
@@ -0,0 +1,51 @@
+// @vitest-environment happy-dom
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { useFileExplorerRootNavigation } from './use-file-explorer-root-navigation'
+
+const actions = vi.hoisted(() => ({
+  clearPendingExplorerReveal: vi.fn(),
+  setExplorerDisplayRootForWorktree: vi.fn()
+}))
+vi.mock('@/store', () => ({ useAppStore: { getState: () => actions } }))
+afterEach(cleanup)
+beforeEach(() => vi.clearAllMocks())
+const options = [
+  { value: '/', label: 'Repository root' },
+  { value: 'app', label: 'app' }
+]
+
+it('offers a return after an outside reveal and clears it on explicit navigation', () => {
+  const { result, rerender } = renderHook(
+    ({ choice }) => useFileExplorerRootNavigation('wt', choice, options),
+    { initialProps: { choice: 'app' } }
+  )
+  act(() => result.current.revealOutsideRoot())
+  expect(actions.setExplorerDisplayRootForWorktree).toHaveBeenCalledWith('wt', '/')
+  expect(actions.clearPendingExplorerReveal).not.toHaveBeenCalled()
+  rerender({ choice: '/' })
+  expect(result.current.returnRoot?.value).toBe('app')
+  act(() => result.current.selectRoot('app'))
+  expect(actions.clearPendingExplorerReveal).toHaveBeenCalledOnce()
+  expect(actions.setExplorerDisplayRootForWorktree).toHaveBeenLastCalledWith('wt', 'app')
+  expect(result.current.returnRoot).toBeNull()
+})
+
+it('never returns into another workspace or a removed sparse directory', () => {
+  const { result, rerender } = renderHook(
+    ({ id, choice, roots }) => useFileExplorerRootNavigation(id, choice, roots),
+    { initialProps: { id: 'first', choice: 'app', roots: options } }
+  )
+  act(() => result.current.revealOutsideRoot())
+  rerender({ id: 'second', choice: '/', roots: options })
+  expect(result.current.returnRoot).toBeNull()
+  rerender({ id: 'first', choice: '/', roots: [options[0]] })
+  expect(result.current.returnRoot).toBeNull()
+})
+
+it('does not manufacture a return target when already at the repository root', () => {
+  const { result } = renderHook(() => useFileExplorerRootNavigation('wt', '/', options))
+  act(() => result.current.revealOutsideRoot())
+  expect(result.current.returnRoot).toBeNull()
+  expect(actions.setExplorerDisplayRootForWorktree).not.toHaveBeenCalled()
+})
diff --git a/src/renderer/src/components/right-sidebar/use-file-explorer-root-navigation.ts b/src/renderer/src/components/right-sidebar/use-file-explorer-root-navigation.ts
new file mode 100644
index 00000000000..d9646f1d1ec
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/use-file-explorer-root-navigation.ts
@@ -0,0 +1,37 @@
+import { useCallback, useState } from 'react'
+import { useAppStore } from '@/store'
+import { FILE_EXPLORER_FULL_ROOT, type ExplorerRootOption } from './file-explorer-display-root'
+
+export function useFileExplorerRootNavigation(
+  worktreeId: string | null,
+  choice: string,
+  options: ExplorerRootOption[] | null
+) {
+  const [returnTarget, setReturnTarget] = useState<{ worktreeId: string; choice: string } | null>(
+    null
+  )
+  const selectRoot = useCallback(
+    (value: string) => {
+      if (!worktreeId) {
+        return
+      }
+      setReturnTarget(null)
+      const state = useAppStore.getState()
+      state.clearPendingExplorerReveal()
+      state.setExplorerDisplayRootForWorktree(worktreeId, value)
+    },
+    [worktreeId]
+  )
+  const revealOutsideRoot = useCallback(() => {
+    if (!worktreeId || choice === FILE_EXPLORER_FULL_ROOT) {
+      return
+    }
+    setReturnTarget({ worktreeId, choice })
+    useAppStore.getState().setExplorerDisplayRootForWorktree(worktreeId, FILE_EXPLORER_FULL_ROOT)
+  }, [worktreeId, choice])
+  const returnRoot =
+    choice === FILE_EXPLORER_FULL_ROOT && returnTarget?.worktreeId === worktreeId
+      ? (options?.find((option) => option.value === returnTarget.choice) ?? null)
+      : null
+  return { selectRoot, revealOutsideRoot, returnRoot }
+}
diff --git a/src/renderer/src/components/right-sidebar/use-file-explorer-row-scrolling.ts b/src/renderer/src/components/right-sidebar/use-file-explorer-row-scrolling.ts
index 7fd0f96ed3a..24888841c1c 100644
--- a/src/renderer/src/components/right-sidebar/use-file-explorer-row-scrolling.ts
+++ b/src/renderer/src/components/right-sidebar/use-file-explorer-row-scrolling.ts
@@ -13,8 +13,10 @@ type UseFileExplorerRowScrollingParams = {
   inlineInputIndex: number
   rowProjection: FileExplorerRowProjection
   scrollRef: RefObject<HTMLDivElement | null>
+  onRevealOutsideRoot?: () => void
   activeWorktreeId: string | null
   worktreePath: string | null
+  displayRootPath?: string | null
   expanded: Set<string>
   dirCache: Record<string, DirCache>
   loadingDirPaths: ReadonlySet<string>
@@ -29,18 +31,21 @@ type UseFileExplorerRowScrollingResult = {
   virtualizer: Virtualizer<HTMLDivElement, Element>
   scrollToIndex: (index: number) => void
   flashingPath: string | null
+  cancelRevealTimers: () => void
   explorerShellRef: RefObject<HTMLDivElement | null>
   setExplorerShellRef: (node: HTMLDivElement | null) => void
 }
 
 /** Decides which explorer row is measured and scrolled into view. */
 export function useFileExplorerRowScrolling({
+  onRevealOutsideRoot,
   visibleRowCount,
   inlineInputIndex,
   rowProjection,
   scrollRef,
   activeWorktreeId,
   worktreePath,
+  displayRootPath = worktreePath,
   expanded,
   dirCache,
   loadingDirPaths,
@@ -77,14 +82,16 @@ export function useFileExplorerRowScrolling({
   })
 
   const cancelRevealTimers = useFileExplorerReveal({
+    onRevealOutsideRoot,
     activeWorktreeId,
     worktreePath,
+    displayRootPath,
     pendingExplorerReveal,
     clearPendingExplorerReveal,
     expanded,
     dirCache,
     loadingDirPaths,
-    rootCache,
+    rootCache: displayRootPath ? dirCache[displayRootPath] : rootCache,
     rowProjection,
     loadDir,
     setSelectedPath,
@@ -109,6 +116,7 @@ export function useFileExplorerRowScrolling({
     activeFileId,
     activeWorktreeId,
     worktreePath,
+    displayRootPath,
     pendingExplorerReveal,
     openFiles,
     rowProjection,
@@ -129,5 +137,12 @@ export function useFileExplorerRowScrolling({
     [virtualizer]
   )
 
-  return { virtualizer, scrollToIndex, flashingPath, explorerShellRef, setExplorerShellRef }
+  return {
+    virtualizer,
+    scrollToIndex,
+    flashingPath,
+    explorerShellRef,
+    setExplorerShellRef,
+    cancelRevealTimers
+  }
 }
diff --git a/src/renderer/src/components/right-sidebar/use-file-explorer-scope-transition.ts b/src/renderer/src/components/right-sidebar/use-file-explorer-scope-transition.ts
new file mode 100644
index 00000000000..55e24c6a35b
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/use-file-explorer-scope-transition.ts
@@ -0,0 +1,38 @@
+import { useLayoutEffect, useRef } from 'react'
+import type { useFileExplorerTreePaneState } from './use-file-explorer-tree-pane-state'
+import type { useFileExplorerSelection } from './useFileExplorerSelection'
+
+/** Clears transient interactions when scope changes within a worktree, preserving directory caches and undo state. */
+export function useFileExplorerScopeTransition({
+  displayRootPath,
+  activeWorktreeId,
+  paneState,
+  selection,
+  setBgMenuOpen
+}: {
+  displayRootPath: string | null
+  activeWorktreeId: string | null
+  paneState: ReturnType<typeof useFileExplorerTreePaneState>
+  selection: ReturnType<typeof useFileExplorerSelection>
+  setBgMenuOpen: (open: boolean) => void
+}): void {
+  const previous = useRef({ displayRootPath, activeWorktreeId })
+  useLayoutEffect(() => {
+    const changed =
+      previous.current.displayRootPath !== displayRootPath &&
+      previous.current.activeWorktreeId === activeWorktreeId
+    previous.current = { displayRootPath, activeWorktreeId }
+    if (!changed) {
+      return
+    }
+    selection.resetSelection()
+    if (paneState.inlineInputState.inlineInput) {
+      paneState.inlineInputState.dismissInlineInput()
+    }
+    paneState.rowScrolling.cancelRevealTimers()
+    setBgMenuOpen(false)
+    if (paneState.scrollRef.current) {
+      paneState.scrollRef.current.scrollTop = 0
+    }
+  }, [displayRootPath, activeWorktreeId, paneState, selection, setBgMenuOpen])
+}
diff --git a/src/renderer/src/components/right-sidebar/use-file-explorer-tree-load-effects.ts b/src/renderer/src/components/right-sidebar/use-file-explorer-tree-load-effects.ts
index a583484f68d..e2f5d3e80f2 100644
--- a/src/renderer/src/components/right-sidebar/use-file-explorer-tree-load-effects.ts
+++ b/src/renderer/src/components/right-sidebar/use-file-explorer-tree-load-effects.ts
@@ -9,6 +9,7 @@ import { splitPathSegments } from './path-tree'
 
 type UseFileExplorerTreeLoadEffectsParams = {
   visibleFilesWorktreePath: string | null
+  displayRootPath?: string | null
   expanded: Set<string>
   dirCache: Record<string, DirCache>
   loadingDirPaths: ReadonlySet<string>
@@ -23,6 +24,7 @@ type UseFileExplorerTreeLoadEffectsParams = {
 /** Reset/retry/stale-dir loads for the currently visible worktree tree. */
 export function useFileExplorerTreeLoadEffects({
   visibleFilesWorktreePath,
+  displayRootPath = visibleFilesWorktreePath,
   expanded,
   dirCache,
   loadingDirPaths,
@@ -72,6 +74,21 @@ export function useFileExplorerTreeLoadEffects({
     }
   }, [sshConnectedGeneration, visibleFilesWorktreePath]) // eslint-disable-line react-hooks/exhaustive-deps
 
+  useEffect(() => {
+    if (
+      !visibleFilesWorktreePath ||
+      !displayRootPath ||
+      displayRootPath === visibleFilesWorktreePath ||
+      dirCache[displayRootPath] ||
+      loadingDirPaths.has(displayRootPath)
+    ) {
+      return
+    }
+    const depth =
+      splitPathSegments(displayRootPath.slice(visibleFilesWorktreePath.length + 1)).length - 1
+    void loadDir(displayRootPath, depth)
+  }, [visibleFilesWorktreePath, displayRootPath, dirCache, loadingDirPaths, loadDir])
+
   useEffect(() => {
     if (!visibleFilesWorktreePath) {
       return
@@ -84,6 +101,9 @@ export function useFileExplorerTreeLoadEffects({
       }
       // Why: a full refresh (watcher overflow) re-reads only root and the dirs expanded at the time,
       // so a listing cached while collapsed is unverified — re-read it here instead of trusting it.
+      if (dirCache[dirPath]?.error) {
+        continue
+      }
       const decision = decideExpandedDirLoad(dirCache[dirPath], isDirStale(dirPath))
       if (decision === 'skip') {
         continue
diff --git a/src/renderer/src/components/right-sidebar/use-file-explorer-tree-pane-state.ts b/src/renderer/src/components/right-sidebar/use-file-explorer-tree-pane-state.ts
index a68ad54b2f9..2eca309a9e3 100644
--- a/src/renderer/src/components/right-sidebar/use-file-explorer-tree-pane-state.ts
+++ b/src/renderer/src/components/right-sidebar/use-file-explorer-tree-pane-state.ts
@@ -1,5 +1,5 @@
 import type { Dispatch, RefObject, SetStateAction } from 'react'
-import { useMemo, useRef } from 'react'
+import { useEffect, useMemo, useRef } from 'react'
 import { useAppStore } from '@/store'
 import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
 import { useWorkspaceFileBrowserActionPredicate } from '@/lib/file-preview'
@@ -22,10 +22,13 @@ import type { useFileExplorerSelection } from './useFileExplorerSelection'
 import type { useFileExplorerTree } from './useFileExplorerTree'
 
 type UseFileExplorerTreePaneStateParams = {
+  onRevealOutsideRoot?: () => void
   activeWorktreeId: string | null
   activeRepo: Repo | null
   worktreePath: string | null
   visibleFilesWorktreePath: string | null
+  displayRootPath: string | null
+  effectiveExpanded: Set<string>
   expanded: Set<string>
   activeFileId: string | null
   openFiles: OpenFile[]
@@ -64,10 +67,13 @@ type UseFileExplorerTreePaneStateResult = {
  * whole directory cache — when the same workspace comes back.
  */
 export function useFileExplorerTreePaneState({
+  onRevealOutsideRoot,
   activeWorktreeId,
   activeRepo,
   worktreePath,
   visibleFilesWorktreePath,
+  displayRootPath,
+  effectiveExpanded,
   expanded,
   activeFileId,
   openFiles,
@@ -104,6 +110,13 @@ export function useFileExplorerTreePaneState({
     selectedPaths
   } = selection
 
+  const pendingReveal = useAppStore((s) => s.pendingExplorerReveal)
+  useEffect(() => {
+    if (pendingReveal?.worktreeId === activeWorktreeId && hasNameFilter) {
+      setNameFilterQuery('')
+    }
+  }, [pendingReveal, activeWorktreeId, hasNameFilter, setNameFilterQuery])
+
   const scrollRef = useRef<HTMLDivElement>(null)
   const canOpenWorkspaceFileBrowserForPath =
     useWorkspaceFileBrowserActionPredicate(activeWorktreeId)
@@ -154,6 +167,7 @@ export function useFileExplorerTreePaneState({
 
   const dragDrop = useFileExplorerDragDrop({
     worktreePath,
+    displayRootPath,
     activeWorktreeId,
     expanded,
     toggleDir,
@@ -164,10 +178,12 @@ export function useFileExplorerTreePaneState({
 
   useFileExplorerTreeLoadEffects({
     visibleFilesWorktreePath,
-    expanded,
+    displayRootPath,
+    expanded: effectiveExpanded,
     dirCache,
     loadingDirPaths,
-    rootError,
+    rootError:
+      rootError ?? (displayRootPath ? tree.dirCache[displayRootPath]?.error : null) ?? null,
     isDirStale,
     loadDir,
     resetAndLoad,
@@ -177,6 +193,7 @@ export function useFileExplorerTreePaneState({
 
   const inlineInputState = useFileExplorerInlineInput({
     activeWorktreeId,
+    displayRootPath,
     worktreePath: visibleFilesWorktreePath,
     expanded,
     rowProjection,
@@ -189,7 +206,7 @@ export function useFileExplorerTreePaneState({
     activeWorktreeId,
     dirCache,
     setDirCache,
-    expanded,
+    expanded: effectiveExpanded,
     setSelectedPath: setSingleSelectedPath,
     refreshDir,
     refreshTree,
@@ -200,6 +217,7 @@ export function useFileExplorerTreePaneState({
   })
 
   useFileExplorerImport({
+    displayRootPath,
     worktreePath: visibleFilesWorktreePath,
     activeWorktreeId,
     refreshDir,
@@ -209,6 +227,8 @@ export function useFileExplorerTreePaneState({
   })
 
   const rowScrolling = useFileExplorerRowScrolling({
+    onRevealOutsideRoot,
+    displayRootPath,
     visibleRowCount,
     inlineInputIndex: inlineInputState.inlineInputIndex,
     rowProjection,
diff --git a/src/renderer/src/components/right-sidebar/useFileExplorerAutoReveal.ts b/src/renderer/src/components/right-sidebar/useFileExplorerAutoReveal.ts
index 8ff69943969..1428800353a 100644
--- a/src/renderer/src/components/right-sidebar/useFileExplorerAutoReveal.ts
+++ b/src/renderer/src/components/right-sidebar/useFileExplorerAutoReveal.ts
@@ -1,5 +1,6 @@
 import { useCallback, useEffect, useRef } from 'react'
 import type { Virtualizer } from '@tanstack/react-virtual'
+import { getRelativePathInsideRoot } from '@/lib/path'
 import { useAppStore } from '@/store'
 import type { OpenFile } from '@/store/slices/editor'
 import type { FileExplorerRowProjection } from './file-explorer-row-projection'
@@ -8,6 +9,7 @@ type UseFileExplorerAutoRevealParams = {
   activeFileId: string | null
   activeWorktreeId: string | null
   worktreePath: string | null
+  displayRootPath?: string | null
   pendingExplorerReveal: { worktreeId: string; filePath: string; requestId: number } | null
   openFiles: OpenFile[]
   rowProjection: FileExplorerRowProjection
@@ -27,6 +29,7 @@ export function useFileExplorerAutoReveal({
   activeFileId,
   activeWorktreeId,
   worktreePath,
+  displayRootPath = worktreePath,
   pendingExplorerReveal,
   openFiles,
   rowProjection,
@@ -74,6 +77,9 @@ export function useFileExplorerAutoReveal({
     }
 
     const filePath = activeFile.filePath
+    if (getRelativePathInsideRoot(filePath, displayRootPath) === null) {
+      return
+    }
 
     if (rowProjection.hasPath(filePath)) {
       // File is already visible in the tree — just scroll to it and select
@@ -103,6 +109,7 @@ export function useFileExplorerAutoReveal({
     activeWorktreeId,
     cancelScrollFrame,
     worktreePath,
+    displayRootPath,
     pendingExplorerReveal,
     openFiles,
     rowProjection,
diff --git a/src/renderer/src/components/right-sidebar/useFileExplorerDragDrop.ts b/src/renderer/src/components/right-sidebar/useFileExplorerDragDrop.ts
index 91e0e4dd8e0..16d9b8ca0ad 100644
--- a/src/renderer/src/components/right-sidebar/useFileExplorerDragDrop.ts
+++ b/src/renderer/src/components/right-sidebar/useFileExplorerDragDrop.ts
@@ -13,6 +13,7 @@ import { useFileExplorerDragExpand } from './useFileExplorerDragExpand'
 
 type UseFileExplorerDragDropParams = {
   worktreePath: string | null
+  displayRootPath?: string | null
   activeWorktreeId: string | null
   expanded: Set<string>
   toggleDir: (worktreeId: string, dirPath: string) => void
@@ -48,8 +49,10 @@ type UseFileExplorerDragDropResult = {
   clearNativeDragState: () => void
 }
 
+/** Routes background drops to the displayed directory while preserving the worktree context for move operations. */
 export function useFileExplorerDragDrop({
   worktreePath,
+  displayRootPath = worktreePath,
   activeWorktreeId,
   expanded,
   toggleDir,
@@ -184,18 +187,18 @@ export function useFileExplorerDragDrop({
         // not the React drop handler. We only clear native drag visual state
         // here; the actual import is triggered from onFileDrop.
         clearNativeDragState()
-        if (worktreePath) {
+        if (displayRootPath) {
           const dragPaths = readWorkspaceFileDragPaths(e.dataTransfer)
           if (dragPaths.status === 'rejected') {
             toast.error(getWorkspaceFileDragRejectionMessage(dragPaths.reason))
             return
           }
           for (const sourcePath of dragPaths.paths) {
-            handleMoveDrop(sourcePath, worktreePath)
+            handleMoveDrop(sourcePath, displayRootPath)
           }
         }
       },
-      [worktreePath, handleMoveDrop, stopDragEdgeScroll, clearNativeDragState]
+      [displayRootPath, handleMoveDrop, stopDragEdgeScroll, clearNativeDragState]
     )
   }
 
diff --git a/src/renderer/src/components/right-sidebar/useFileExplorerImport.committed-scope.test.tsx b/src/renderer/src/components/right-sidebar/useFileExplorerImport.committed-scope.test.tsx
new file mode 100644
index 00000000000..efdd716f5b9
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/useFileExplorerImport.committed-scope.test.tsx
@@ -0,0 +1,82 @@
+// @vitest-environment happy-dom
+import { Suspense, startTransition } from 'react'
+import { act, cleanup, render, waitFor } from '@testing-library/react'
+import { afterEach, expect, it, vi } from 'vitest'
+import { useFileExplorerImport } from './useFileExplorerImport'
+
+const mocks = vi.hoisted(() => ({ importPaths: vi.fn(), subscribe: vi.fn() }))
+vi.mock('@/runtime/runtime-file-client', () => ({
+  importExternalPathsToRuntime: mocks.importPaths
+}))
+vi.mock('./file-explorer-operation-owner', () => ({
+  captureFileExplorerOperationGuard: () => ({ route: {}, assertCurrent: vi.fn() })
+}))
+vi.mock('sonner', () => ({ toast: { error: vi.fn() } }))
+afterEach(() => {
+  cleanup()
+  vi.unstubAllGlobals()
+  vi.clearAllMocks()
+})
+
+it('keeps native drops on committed scope when a new scope render suspends', async () => {
+  vi.stubGlobal('api', { ui: { onFileDrop: mocks.subscribe } })
+  const selected = vi.fn()
+  const clearDrag = vi.fn()
+  const refresh = vi.fn().mockResolvedValue(undefined)
+  const suspended = new Promise<void>(() => {})
+  mocks.subscribe.mockReturnValue(vi.fn())
+  mocks.importPaths.mockResolvedValue({
+    results: [{ status: 'imported', destPath: '/repo/app/file.ts' }]
+  })
+
+  function Probe({ scope, suspend = false }: { scope: string; suspend?: boolean }) {
+    useFileExplorerImport({
+      activeWorktreeId: 'wt',
+      worktreePath: '/repo',
+      displayRootPath: scope,
+      refreshDir: refresh,
+      clearNativeDragState: clearDrag,
+      setSelectedPath: selected
+    })
+    if (suspend) {
+      throw suspended
+    }
+    return <span>{scope}</span>
+  }
+  const view = render(
+    <Suspense fallback="Loading">
+      <Probe scope="/repo/app" />
+    </Suspense>
+  )
+  await act(async () => {
+    startTransition(() =>
+      view.rerender(
+        <Suspense fallback="Loading">
+          <Probe scope="/repo/api" suspend />
+        </Suspense>
+      )
+    )
+  })
+  expect(view.getByText('/repo/app')).toBeTruthy()
+  const drop = mocks.subscribe.mock.calls[0][0]
+  await act(async () => {
+    drop({ target: 'file-explorer', paths: ['/source/file.ts'], destinationDir: '/repo/app' })
+  })
+  await waitFor(() => expect(selected).toHaveBeenCalledWith('/repo/app/file.ts'))
+  expect(refresh).toHaveBeenCalledWith('/repo/app')
+
+  selected.mockClear()
+  view.rerender(
+    <Suspense fallback="Loading">
+      <Probe scope="/repo/api" />
+    </Suspense>
+  )
+  await act(async () => {
+    drop({ target: 'file-explorer', paths: ['/source/file.ts'], destinationDir: '/repo/app' })
+  })
+  await waitFor(() => expect(clearDrag).toHaveBeenCalledTimes(2))
+  expect(selected).not.toHaveBeenCalled()
+  expect(mocks.importPaths).toHaveBeenCalledTimes(1)
+  expect(refresh).toHaveBeenCalledTimes(1)
+  expect(mocks.subscribe).toHaveBeenCalledTimes(1)
+})
diff --git a/src/renderer/src/components/right-sidebar/useFileExplorerImport.ts b/src/renderer/src/components/right-sidebar/useFileExplorerImport.ts
index 24775de473b..8d7fffd6408 100644
--- a/src/renderer/src/components/right-sidebar/useFileExplorerImport.ts
+++ b/src/renderer/src/components/right-sidebar/useFileExplorerImport.ts
@@ -1,4 +1,5 @@
-import { useEffect, useRef } from 'react'
+import { getRelativePathInsideRoot } from '@/lib/path'
+import { useEffect, useLayoutEffect, useRef } from 'react'
 import { toast } from 'sonner'
 import { extractIpcErrorMessage } from '@/lib/ipc-error'
 import { importExternalPathsToRuntime } from '@/runtime/runtime-file-client'
@@ -8,6 +9,7 @@ import { captureFileExplorerOperationGuard } from './file-explorer-operation-own
 
 type UseFileExplorerImportParams = {
   worktreePath: string | null
+  displayRootPath?: string | null
   activeWorktreeId: string | null
   refreshDir: (dirPath: string) => Promise<void>
   clearNativeDragState: () => void
@@ -26,6 +28,7 @@ type UseFileExplorerImportParams = {
  */
 export function useFileExplorerImport({
   worktreePath,
+  displayRootPath = worktreePath,
   activeWorktreeId,
   refreshDir,
   clearNativeDragState,
@@ -33,18 +36,32 @@ export function useFileExplorerImport({
   operationOwner
 }: UseFileExplorerImportParams): void {
   // Refs to avoid re-subscribing IPC listener on every render
+  const displayRootRef = useRef(displayRootPath)
   const worktreePathRef = useRef(worktreePath)
-  worktreePathRef.current = worktreePath
   const activeWorktreeIdRef = useRef(activeWorktreeId)
-  activeWorktreeIdRef.current = activeWorktreeId
   const refreshDirRef = useRef(refreshDir)
-  refreshDirRef.current = refreshDir
   const clearNativeDragStateRef = useRef(clearNativeDragState)
-  clearNativeDragStateRef.current = clearNativeDragState
   const setSelectedPathRef = useRef(setSelectedPath)
-  setSelectedPathRef.current = setSelectedPath
   const operationOwnerRef = useRef(operationOwner)
-  operationOwnerRef.current = operationOwner
+
+  // Native drops must observe only committed workspace state.
+  useLayoutEffect(() => {
+    displayRootRef.current = displayRootPath
+    worktreePathRef.current = worktreePath
+    activeWorktreeIdRef.current = activeWorktreeId
+    refreshDirRef.current = refreshDir
+    clearNativeDragStateRef.current = clearNativeDragState
+    setSelectedPathRef.current = setSelectedPath
+    operationOwnerRef.current = operationOwner
+  }, [
+    displayRootPath,
+    worktreePath,
+    activeWorktreeId,
+    refreshDir,
+    clearNativeDragState,
+    setSelectedPath,
+    operationOwner
+  ])
 
   useEffect(() => {
     return window.api.ui.onFileDrop((data) => {
@@ -66,6 +83,9 @@ export function useFileExplorerImport({
 
       void (async () => {
         try {
+          if (getRelativePathInsideRoot(destinationDir, displayRootRef.current) === null) {
+            return
+          }
           const operationGuard = captureFileExplorerOperationGuard(wtId, operationOwnerRef.current)
           operationGuard.assertCurrent()
           const { results } = await importExternalPathsToRuntime(
@@ -93,7 +113,11 @@ export function useFileExplorerImport({
           const skipped = results.filter((r) => r.status === 'skipped')
           const failed = results.filter((r) => r.status === 'failed')
 
-          if (imported.length > 0) {
+          if (
+            imported.length > 0 &&
+            activeWorktreeIdRef.current === wtId &&
+            getRelativePathInsideRoot(imported[0].destPath, displayRootRef.current) !== null
+          ) {
             setSelectedPathRef.current(imported[0].destPath)
           }
 
diff --git a/src/renderer/src/components/right-sidebar/useFileExplorerInlineInput.ts b/src/renderer/src/components/right-sidebar/useFileExplorerInlineInput.ts
index 467e21bd42d..ed197871579 100644
--- a/src/renderer/src/components/right-sidebar/useFileExplorerInlineInput.ts
+++ b/src/renderer/src/components/right-sidebar/useFileExplorerInlineInput.ts
@@ -18,6 +18,7 @@ import {
 type UseFileExplorerInlineInputParams = {
   activeWorktreeId: string | null
   worktreePath: string | null
+  displayRootPath?: string | null
   expanded: Set<string>
   rowProjection: FileExplorerRowProjection
   scrollRef: React.RefObject<HTMLDivElement | null>
@@ -33,9 +34,11 @@ type UseFileExplorerInlineInputResult = {
   handleInlineSubmit: (value: string) => void
 }
 
+/** Positions creation input under the displayed root while retaining true workspace paths for edits and undo. */
 export function useFileExplorerInlineInput({
   activeWorktreeId,
   worktreePath,
+  displayRootPath = worktreePath,
   expanded,
   rowProjection,
   scrollRef,
@@ -68,12 +71,12 @@ export function useFileExplorerInlineInput({
     if (!inlineInput || inlineInput.type === 'rename') {
       return -1
     }
-    return rowProjection.getInsertIndexAfterSubtree(inlineInput.parentPath, worktreePath)
-  }, [inlineInput, rowProjection, worktreePath])
+    return rowProjection.getInsertIndexAfterSubtree(inlineInput.parentPath, displayRootPath)
+  }, [inlineInput, rowProjection, displayRootPath])
 
   const startNew = useCallback(
     (type: 'file' | 'folder', parentPath: string, depth: number) => {
-      if (activeWorktreeId && parentPath !== worktreePath && !expanded.has(parentPath)) {
+      if (activeWorktreeId && parentPath !== displayRootPath && !expanded.has(parentPath)) {
         toggleDir(activeWorktreeId, parentPath)
       }
       setInlineInput({
@@ -83,7 +86,7 @@ export function useFileExplorerInlineInput({
         operationOwner: getFileExplorerOperationOwner(activeWorktreeId)
       })
     },
-    [activeWorktreeId, worktreePath, expanded, toggleDir]
+    [activeWorktreeId, displayRootPath, expanded, toggleDir]
   )
 
   const startRename = useCallback(
diff --git a/src/renderer/src/components/right-sidebar/useFileExplorerReveal.scoped-root.test.tsx b/src/renderer/src/components/right-sidebar/useFileExplorerReveal.scoped-root.test.tsx
new file mode 100644
index 00000000000..f53503e14df
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/useFileExplorerReveal.scoped-root.test.tsx
@@ -0,0 +1,93 @@
+// @vitest-environment happy-dom
+import { cleanup, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { Virtualizer } from '@tanstack/react-virtual'
+import { useFileExplorerReveal } from './useFileExplorerReveal'
+import { useFileExplorerAutoReveal } from './useFileExplorerAutoReveal'
+import { createFileExplorerRowProjectionFromParts } from './file-explorer-row-projection'
+import type { TreeNode } from './file-explorer-types'
+
+const store = vi.hoisted(() => ({
+  setState: vi.fn(),
+  getState: () => ({ setExplorerDisplayRootForWorktree: setRoot })
+}))
+const setRoot = vi.hoisted(() => vi.fn())
+vi.mock('@/store', () => ({ useAppStore: store }))
+afterEach(cleanup)
+beforeEach(() => vi.clearAllMocks())
+
+function fixture(filePath = '/repo/packages/app/index.ts') {
+  const node: TreeNode = {
+    name: 'index.ts',
+    path: '/repo/packages/app/index.ts',
+    relativePath: 'packages/app/index.ts',
+    depth: 2,
+    isDirectory: false
+  }
+  const projection = createFileExplorerRowProjectionFromParts([node], new Map([[node.path, node]]))
+  return {
+    activeWorktreeId: 'wt',
+    worktreePath: '/repo',
+    displayRootPath: '/repo/packages/app',
+    pendingExplorerReveal: { worktreeId: 'wt', filePath, requestId: 1, flash: false },
+    clearPendingExplorerReveal: vi.fn(),
+    expanded: new Set<string>(),
+    dirCache: { '/repo/packages/app': { children: [node] } },
+    loadingDirPaths: new Set<string>(),
+    rootCache: { children: [node] },
+    rowProjection: projection,
+    loadDir: vi.fn().mockResolvedValue(true),
+    setSelectedPath: vi.fn(),
+    setFlashingPath: vi.fn(),
+    flashTimeoutRef: { current: null },
+    virtualizer: new Virtualizer<HTMLDivElement, Element>({
+      count: 1,
+      getScrollElement: () => null,
+      estimateSize: () => 24,
+      scrollToFn: vi.fn(),
+      observeElementRect: vi.fn(),
+      observeElementOffset: vi.fn()
+    })
+  }
+}
+
+it('reveals a scoped child without waiting for hidden ancestor rows', () => {
+  const args = fixture()
+  renderHook(() => useFileExplorerReveal(args))
+  expect(args.loadDir).toHaveBeenCalledWith('/repo/packages/app', 1)
+  expect(args.setSelectedPath).toHaveBeenCalledWith('/repo/packages/app/index.ts')
+  expect(args.clearPendingExplorerReveal).toHaveBeenCalled()
+  expect(setRoot).not.toHaveBeenCalled()
+})
+
+it('switches to full root without consuming an out-of-scope explicit request', () => {
+  const args = fixture('/repo/README.md')
+  renderHook(() => useFileExplorerReveal(args))
+  expect(setRoot).toHaveBeenCalledWith('wt', '/')
+  expect(args.clearPendingExplorerReveal).not.toHaveBeenCalled()
+  expect(args.loadDir).not.toHaveBeenCalled()
+})
+
+it('does not enqueue auto-reveal for an editor file outside scope', () => {
+  const args = fixture()
+  renderHook(() =>
+    useFileExplorerAutoReveal({
+      ...args,
+      pendingExplorerReveal: null,
+      activeFileId: 'readme',
+      openFiles: [
+        {
+          id: 'readme',
+          filePath: '/repo/README.md',
+          relativePath: 'README.md',
+          worktreeId: 'wt',
+          mode: 'edit',
+          language: 'markdown',
+          isDirty: false
+        }
+      ]
+    })
+  )
+  expect(store.setState).not.toHaveBeenCalled()
+  expect(args.setSelectedPath).not.toHaveBeenCalled()
+})
diff --git a/src/renderer/src/components/right-sidebar/useFileExplorerReveal.ts b/src/renderer/src/components/right-sidebar/useFileExplorerReveal.ts
index caac486ccdc..7677b599a87 100644
--- a/src/renderer/src/components/right-sidebar/useFileExplorerReveal.ts
+++ b/src/renderer/src/components/right-sidebar/useFileExplorerReveal.ts
@@ -1,14 +1,18 @@
 import { useCallback, useEffect, useMemo, useRef } from 'react'
 import type { Dispatch, RefObject, SetStateAction } from 'react'
 import type { Virtualizer } from '@tanstack/react-virtual'
+import { getRelativePathInsideRoot } from '@/lib/path'
+import { getExplorerDisplayDepth, FILE_EXPLORER_FULL_ROOT } from './file-explorer-display-root'
 import { useAppStore } from '@/store'
 import { getRevealAncestorDirs } from './file-explorer-paths'
 import type { DirCache } from './file-explorer-types'
 import type { FileExplorerRowProjection } from './file-explorer-row-projection'
 
 type UseFileExplorerRevealParams = {
+  onRevealOutsideRoot?: () => void
   activeWorktreeId: string | null
   worktreePath: string | null
+  displayRootPath?: string | null
   pendingExplorerReveal: {
     worktreeId: string
     filePath: string
@@ -28,9 +32,12 @@ type UseFileExplorerRevealParams = {
   virtualizer: Virtualizer<HTMLDivElement, Element>
 }
 
+/** Expands and selects reveal targets; explicit outside-scope requests restore full-root navigation. */
 export function useFileExplorerReveal({
+  onRevealOutsideRoot,
   activeWorktreeId,
   worktreePath,
+  displayRootPath = worktreePath,
   pendingExplorerReveal,
   clearPendingExplorerReveal,
   expanded,
@@ -76,14 +83,33 @@ export function useFileExplorerReveal({
       return null
     }
 
-    return getRevealAncestorDirs(worktreePath, pendingExplorerReveal.filePath)
-  }, [activeWorktreeId, pendingExplorerReveal, worktreePath])
+    if (getRelativePathInsideRoot(pendingExplorerReveal.filePath, worktreePath) === null) {
+      return null
+    }
+    return getRevealAncestorDirs(displayRootPath ?? worktreePath, pendingExplorerReveal.filePath)
+  }, [activeWorktreeId, pendingExplorerReveal, worktreePath, displayRootPath])
 
   useEffect(() => {
     if (!pendingExplorerReveal || !activeWorktreeId || !worktreePath) {
       return
     }
 
+    if (pendingExplorerReveal.worktreeId !== activeWorktreeId) {
+      return
+    }
+    if (
+      getRelativePathInsideRoot(pendingExplorerReveal.filePath, worktreePath) !== null &&
+      getRelativePathInsideRoot(pendingExplorerReveal.filePath, displayRootPath) === null
+    ) {
+      if (onRevealOutsideRoot) {
+        onRevealOutsideRoot()
+      } else {
+        useAppStore
+          .getState()
+          .setExplorerDisplayRootForWorktree(activeWorktreeId, FILE_EXPLORER_FULL_ROOT)
+      }
+      return
+    }
     if (!pendingRevealAncestorDirs) {
       clearPendingExplorerReveal()
       return
@@ -114,13 +140,19 @@ export function useFileExplorerReveal({
     })
 
     void (async () => {
-      const rootLoaded = await loadDir(worktreePath, -1)
+      const rootLoaded = await loadDir(
+        displayRootPath ?? worktreePath,
+        getExplorerDisplayDepth(worktreePath, displayRootPath) - 1
+      )
       if (!rootLoaded) {
         return
       }
 
       for (let depth = 0; depth < pendingRevealAncestorDirs.length; depth += 1) {
-        const ancestorLoaded = await loadDir(pendingRevealAncestorDirs[depth], depth)
+        const ancestorLoaded = await loadDir(
+          pendingRevealAncestorDirs[depth],
+          getExplorerDisplayDepth(worktreePath, pendingRevealAncestorDirs[depth]) - 1
+        )
         if (!ancestorLoaded) {
           return
         }
@@ -132,7 +164,9 @@ export function useFileExplorerReveal({
     loadDir,
     pendingExplorerReveal,
     pendingRevealAncestorDirs,
-    worktreePath
+    onRevealOutsideRoot,
+    worktreePath,
+    displayRootPath
   ])
 
   useEffect(() => {
@@ -148,7 +182,9 @@ export function useFileExplorerReveal({
 
     const targetPath = pendingExplorerReveal.filePath
     const parentDirPath =
-      pendingRevealAncestorDirs.length > 0 ? pendingRevealAncestorDirs.at(-1)! : worktreePath
+      pendingRevealAncestorDirs.length > 0
+        ? pendingRevealAncestorDirs.at(-1)!
+        : (displayRootPath ?? worktreePath)
     const parentDirCache = dirCache[parentDirPath]
     const missingExpandedAncestor = pendingRevealAncestorDirs.find(
       (dirPath) => !expanded.has(dirPath)
@@ -156,13 +192,23 @@ export function useFileExplorerReveal({
     const missingAncestor = pendingRevealAncestorDirs.find(
       (dirPath) => !rowProjection.hasPath(dirPath)
     )
-    const rootStillLoading = !rootCache || loadingDirPaths.has(worktreePath)
+    const rootStillLoading = !rootCache || loadingDirPaths.has(displayRootPath ?? worktreePath)
     const parentDirStillLoading =
-      parentDirPath === worktreePath
+      parentDirPath === (displayRootPath ?? worktreePath)
         ? rootStillLoading
         : !parentDirCache || loadingDirPaths.has(parentDirPath)
-    const parentDirKnown = parentDirPath === worktreePath ? !!rootCache : !!parentDirCache
+    const parentDirKnown =
+      parentDirPath === (displayRootPath ?? worktreePath) ? !!rootCache : !!parentDirCache
 
+    if (
+      !rootStillLoading &&
+      (rootCache?.error ||
+        parentDirCache?.error ||
+        pendingRevealAncestorDirs.some((path) => dirCache[path]?.error))
+    ) {
+      clearPendingExplorerReveal()
+      return
+    }
     if (
       rootStillLoading ||
       missingExpandedAncestor ||
@@ -222,7 +268,8 @@ export function useFileExplorerReveal({
     setSelectedPath,
     flashTimeoutRef,
     virtualizer,
-    worktreePath
+    worktreePath,
+    displayRootPath
   ])
 
   return cancelRevealTimers
diff --git a/src/renderer/src/components/right-sidebar/useFileExplorerTree.scoped-root.test.tsx b/src/renderer/src/components/right-sidebar/useFileExplorerTree.scoped-root.test.tsx
new file mode 100644
index 00000000000..ba47aaba16e
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/useFileExplorerTree.scoped-root.test.tsx
@@ -0,0 +1,70 @@
+// @vitest-environment happy-dom
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { useFileExplorerTree } from './useFileExplorerTree'
+import { getExplorerEffectiveExpanded } from './file-explorer-display-root'
+
+const read = vi.hoisted(() => vi.fn())
+vi.mock('./file-explorer-directory-listing', async (original) => ({
+  ...(await original<Record<string, unknown>>()),
+  readFileExplorerDirectory: read
+}))
+vi.mock('./file-explorer-operation-owner', async (original) => ({
+  ...(await original<Record<string, unknown>>()),
+  getFileExplorerOperationOwner: () => ({ kind: 'local' })
+}))
+const listing = (name?: string) => ({
+  entries: name ? [{ name, isDirectory: false }] : [],
+  operationOwner: { kind: 'local' }
+})
+beforeEach(() => read.mockReset().mockResolvedValue(listing()))
+afterEach(cleanup)
+
+it.each(['Host unavailable', ''])(
+  'preserves cached children on refresh failure (%j) and recovers',
+  async (message) => {
+    const expanded = getExplorerEffectiveExpanded(new Set(), '/repo/packages/app')
+    const { result } = renderHook(() => useFileExplorerTree('/repo', expanded, 'wt'))
+    read.mockResolvedValueOnce(listing('before.ts'))
+    await act(async () => {
+      await result.current.loadDir('/repo/packages/app', 1)
+    })
+    read.mockImplementation(async (_id, _root, path) => {
+      if (path === '/repo/packages/app') {
+        throw new Error(message)
+      }
+      return listing()
+    })
+    await act(async () => {
+      await result.current.refreshTree()
+    })
+    expect(result.current.dirCache['/repo/packages/app']).toMatchObject({
+      error: message,
+      children: [{ relativePath: 'packages/app/before.ts', depth: 2 }]
+    })
+    read.mockResolvedValue(listing('after.ts'))
+    await act(async () => {
+      await result.current.refreshTree()
+    })
+    expect(result.current.dirCache['/repo/packages/app'].error).toBeUndefined()
+    expect(result.current.dirCache['/repo/packages/app'].children[0]).toMatchObject({
+      relativePath: 'packages/app/after.ts',
+      depth: 2
+    })
+  }
+)
+
+it('distinguishes an unreadable scoped directory from an empty one and allows forced retry', async () => {
+  const { result } = renderHook(() => useFileExplorerTree('/repo', new Set(), 'wt'))
+  read.mockRejectedValueOnce(new Error('Permission denied'))
+  await act(async () => {
+    await result.current.loadDir('/repo/app', 0)
+  })
+  expect(result.current.rootError).toBeNull()
+  expect(result.current.dirCache['/repo/app'].error).toBe('Permission denied')
+  await act(async () => {
+    await result.current.refreshDir('/repo/app')
+  })
+  expect(result.current.dirCache['/repo/app']).toMatchObject({ children: [] })
+  expect(result.current.dirCache['/repo/app'].error).toBeUndefined()
+})
diff --git a/src/renderer/src/components/right-sidebar/useFileExplorerTree.ts b/src/renderer/src/components/right-sidebar/useFileExplorerTree.ts
index b7e1225e153..ee186eac965 100644
--- a/src/renderer/src/components/right-sidebar/useFileExplorerTree.ts
+++ b/src/renderer/src/components/right-sidebar/useFileExplorerTree.ts
@@ -46,6 +46,7 @@ type UseFileExplorerTreeResult = {
   resetAndLoad: () => void
 }
 
+/** Owns worktree-addressed directory caches and load tokens; display scoping changes traversal rather than cache identity. */
 export function useFileExplorerTree(
   worktreePath: string | null,
   expanded: Set<string>,
@@ -139,7 +140,14 @@ export function useFileExplorerTree(
           setSourceWorkspaceId(null)
           rootReadFailedRef.current = true
         }
-        setDirCache((prev) => ({ ...prev, [dirPath]: { children: [] } }))
+        setDirCache((prev) => ({
+          ...prev,
+          [dirPath]: {
+            ...prev[dirPath],
+            children: prev[dirPath]?.children ?? [],
+            error: error instanceof Error ? error.message : String(error)
+          }
+        }))
         updateLoadingDirPaths((prev) => clearFileExplorerDirsLoading(prev, [dirPath]))
         return !options?.failOnError
       }
diff --git a/src/renderer/src/components/right-sidebar/useFileExplorerVisibleRowProjection.ts b/src/renderer/src/components/right-sidebar/useFileExplorerVisibleRowProjection.ts
index 5939911181a..afefa839b41 100644
--- a/src/renderer/src/components/right-sidebar/useFileExplorerVisibleRowProjection.ts
+++ b/src/renderer/src/components/right-sidebar/useFileExplorerVisibleRowProjection.ts
@@ -29,13 +29,15 @@ type VisibleFileExplorerRowProjectionInput = {
   dirCache: Record<string, DirCache>
   expanded: Set<string>
   worktreePath: string | null
+  displayRootPath?: string | null
 }
 
+/** Collects worktree-relative paths beneath the displayed root, respecting expanded folders and dotfile visibility. */
 export function getFileExplorerIgnoredQueryRelativePaths(
   input: VisibleFileExplorerRowProjectionInput,
   showDotfiles: boolean
 ): string[] {
-  const { dirCache, expanded, worktreePath } = input
+  const { dirCache, expanded, worktreePath, displayRootPath = worktreePath } = input
   if (!worktreePath) {
     return []
   }
@@ -56,15 +58,18 @@ export function getFileExplorerIgnoredQueryRelativePaths(
       }
     }
   }
-  visitChildren(worktreePath)
+  if (displayRootPath) {
+    visitChildren(displayRootPath)
+  }
   return relativePaths
 }
 
+/** Projects the displayed subtree without rebasing row paths, including when filename filtering synthesizes nodes. */
 export function createVisibleFileExplorerRowProjection(
   input: VisibleFileExplorerRowProjectionInput,
   options: VisibleFileExplorerRowProjectionOptions
 ): FileExplorerRowProjection {
-  const { dirCache, expanded, worktreePath } = input
+  const { dirCache, expanded, worktreePath, displayRootPath = worktreePath } = input
   const visibleFlatRows: TreeNode[] = []
   const rowsByPath = new Map<string, TreeNode>()
   if (!worktreePath) {
@@ -77,7 +82,8 @@ export function createVisibleFileExplorerRowProjection(
       nameFilter: options.nameFilter,
       showDotfiles: options.showDotfiles,
       showGitIgnoredFiles: options.showGitIgnoredFiles,
-      worktreePath
+      worktreePath,
+      displayRootPath: displayRootPath ?? worktreePath
     })
   }
 
@@ -104,7 +110,9 @@ export function createVisibleFileExplorerRowProjection(
       }
     }
   }
-  visitChildren(worktreePath)
+  if (displayRootPath) {
+    visitChildren(displayRootPath)
+  }
 
   return createFileExplorerRowProjectionFromParts(visibleFlatRows, rowsByPath)
 }
@@ -146,6 +154,7 @@ function useContentStableRelativePaths(relativePaths: string[], enabled: boolean
   return stable
 }
 
+/** Combines scoped rows with host-aware ignore checks while retaining worktree-relative Git query paths. */
 export function useFileExplorerVisibleRowProjection(
   activeWorktreeId: string | null,
   worktreePath: string | null,
@@ -154,7 +163,8 @@ export function useFileExplorerVisibleRowProjection(
   activeRepoSupportsGit: boolean,
   showDotfiles: boolean,
   nameFilter: FileExplorerNameFilterProjectionSource | null,
-  nameFilterCollapsedPaths: ReadonlySet<string> | null = null
+  nameFilterCollapsedPaths: ReadonlySet<string> | null = null,
+  displayRootPath: string | null = worktreePath
 ): {
   rowProjection: FileExplorerRowProjection
   ignoredByRelativePath: Set<string>
@@ -171,11 +181,19 @@ export function useFileExplorerVisibleRowProjection(
         ? nameFilter
           ? getFileExplorerNameFilterIgnoredQueryRelativePaths(nameFilter, showDotfiles)
           : getFileExplorerIgnoredQueryRelativePaths(
-              { dirCache, expanded, worktreePath },
+              { dirCache, expanded, worktreePath, displayRootPath },
               showDotfiles
             )
         : EMPTY_RELATIVE_PATHS,
-    [activeRepoSupportsGit, dirCache, expanded, nameFilter, showDotfiles, worktreePath]
+    [
+      activeRepoSupportsGit,
+      dirCache,
+      expanded,
+      nameFilter,
+      showDotfiles,
+      worktreePath,
+      displayRootPath
+    ]
   )
   // Why: the name-filter list is debounced per keystroke, so it must keep a fresh
   // identity; only the dirCache-derived list needs stability across wave commits.
@@ -197,7 +215,7 @@ export function useFileExplorerVisibleRowProjection(
   const rowProjection = useMemo(
     () =>
       createVisibleFileExplorerRowProjection(
-        { dirCache, expanded, worktreePath },
+        { dirCache, expanded, worktreePath, displayRootPath },
         {
           ignoredSet,
           nameFilter,
@@ -214,7 +232,8 @@ export function useFileExplorerVisibleRowProjection(
       nameFilterCollapsedPaths,
       showDotfiles,
       showGitIgnoredFiles,
-      worktreePath
+      worktreePath,
+      displayRootPath
     ]
   )
   const nameFilterExpandedPaths = useMemo(
diff --git a/src/renderer/src/components/right-sidebar/useSourceControlAgentActionDialog.ts b/src/renderer/src/components/right-sidebar/useSourceControlAgentActionDialog.ts
index cfe413b0392..60e7a45bb1b 100644
--- a/src/renderer/src/components/right-sidebar/useSourceControlAgentActionDialog.ts
+++ b/src/renderer/src/components/right-sidebar/useSourceControlAgentActionDialog.ts
@@ -3,7 +3,7 @@ import { getAgentCatalog } from '@/lib/agent-catalog'
 import {
   pickSourceControlLaunchAgent,
   resolveSourceControlLaunchAgentScope
-} from '@/lib/source-control-launch-agent-selection'
+} from '../../../../shared/source-control-launch-agent-selection'
 import { useAppStore } from '@/store'
 import { useRepoById } from '@/store/selectors'
 import { renderSourceControlActionCommandTemplate } from '../../../../shared/source-control-ai-actions'
diff --git a/src/renderer/src/components/settings/AccountsPane.section-lifetime.test.tsx b/src/renderer/src/components/settings/AccountsPane.section-lifetime.test.tsx
new file mode 100644
index 00000000000..ff46d963732
--- /dev/null
+++ b/src/renderer/src/components/settings/AccountsPane.section-lifetime.test.tsx
@@ -0,0 +1,257 @@
+// @vitest-environment happy-dom
+import { act, cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { getDefaultSettings } from '../../../../shared/constants'
+import { AccountsPane } from './AccountsPane'
+
+const fake = vi.hoisted(() => ({
+  query: '',
+  cursorStatus: vi.fn(async () => ({
+    signedIn: false,
+    email: null,
+    displayName: null,
+    credentialSource: null,
+    planType: null,
+    tokenFresh: false,
+    error: null
+  })),
+  cursorRefresh: vi.fn(async () => {}),
+  cursorUsage: { updatedAt: 0 },
+  status: vi.fn(async () => ({
+    signedIn: false,
+    email: null,
+    teamId: null,
+    tokenFresh: false,
+    error: null
+  })),
+  pending: vi.fn(async () => null),
+  subscribe: vi.fn(() => vi.fn()),
+  refresh: vi.fn(async () => {}),
+  write: vi.fn(),
+  watcher: vi.fn(() => ({ close: vi.fn() })),
+  grokUsage: { updatedAt: 0 }
+}))
+vi.mock('@/i18n/i18n', () => ({
+  i18n: { language: 'en' },
+  translate: (_key: string, fallback: string, values?: Record<string, string | number>) =>
+    Object.entries(values ?? {}).reduce(
+      (text, [key, value]) => text.replaceAll(`{{${key}}}`, String(value)),
+      fallback
+    )
+}))
+vi.mock('@/store', () => ({
+  useAppStore: (selector: (state: Record<string, unknown>) => unknown) =>
+    selector({
+      settingsSearchQuery: fake.query,
+      rateLimits: {
+        codex: null,
+        codexTarget: { runtime: 'host', wslDistro: null },
+        minimax: null,
+        cursor: fake.cursorUsage,
+        grok: fake.grokUsage
+      },
+      runtimeEnvironments: [],
+      refreshRateLimits: fake.cursorRefresh,
+      refreshGrokRateLimits: fake.refresh,
+      recordFeatureInteraction: fake.write,
+      fetchSettings: fake.write
+    })
+}))
+vi.mock('@/runtime/runtime-provider-accounts-client', () => ({
+  emptyClaudeAccountsState: () => ({
+    accounts: [],
+    activeAccountId: null,
+    activeAccountIdsByRuntime: { host: null, wsl: {} }
+  }),
+  emptyCodexAccountsState: () => ({
+    accounts: [],
+    activeAccountId: null,
+    activeAccountIdsByRuntime: { host: null, wsl: {} }
+  }),
+  hasRemoteProviderAccountOwner: (settings: { activeRuntimeEnvironmentId?: string }) =>
+    Boolean(settings.activeRuntimeEnvironmentId),
+  watchProviderAccounts: fake.watcher,
+  selectClaudeProviderAccount: fake.write,
+  selectCodexProviderAccount: fake.write,
+  removeClaudeProviderAccount: fake.write,
+  removeCodexProviderAccount: fake.write
+}))
+beforeEach(() => {
+  vi.clearAllMocks()
+  fake.query = ''
+  fake.grokUsage = { updatedAt: 0 }
+  fake.cursorUsage = { updatedAt: 0 }
+  Object.assign(window, {
+    api: {
+      minimaxCredentials: {
+        getStatus: vi.fn(async () => ({ cookieConfigured: false, apiKeyConfigured: false }))
+      },
+      codexConfigSync: {
+        status: vi.fn(async () => ({
+          state: 'synced',
+          reason: null,
+          systemConfigPath: '/synthetic/config.toml'
+        }))
+      },
+      codexAccounts: { getPendingLoginUrl: fake.pending, onPendingLoginUrlChanged: fake.subscribe },
+      cursorAccounts: { getStatus: fake.cursorStatus },
+      grokAccounts: { getStatus: fake.status }
+    }
+  })
+})
+afterEach(() => {
+  cleanup()
+  Reflect.deleteProperty(window, 'api')
+})
+
+it.each([false, true])(
+  'retains Grok status reads with Windows account support %s',
+  async (wslSupportedPlatform) => {
+    const props = {
+      settings: getDefaultSettings('/synthetic'),
+      updateSettings: fake.write,
+      wslSupportedPlatform
+    }
+    const view = render(<AccountsPane {...props} />)
+    await act(async () => {})
+    // The invariant is identity, not a magic number: the matched section keeps the same DOM
+    // node across every query edit, so editing the query cannot cost an extra read or watcher.
+    const mountedHeading = screen.getByText('Grok (xAI)', { exact: true })
+    const watchersAfterMount = fake.watcher.mock.calls.length
+    const statusReadsAfterMount = fake.status.mock.calls.length
+    for (const query of ['g', 'gr', 'gro', 'grok', '', 'g', 'gr', 'gro', 'grok']) {
+      fake.query = query
+      await act(async () => view.rerender(<AccountsPane {...props} />))
+      expect(screen.getByText('Grok (xAI)', { exact: true })).toBe(mountedHeading)
+    }
+    expect(fake.watcher.mock.calls.length).toBe(watchersAfterMount)
+    expect(fake.status.mock.calls.length).toBe(statusReadsAfterMount)
+  }
+)
+it.each([false, true])(
+  'retains Codex login reads with Windows account support %s',
+  async (wslSupportedPlatform) => {
+    const props = {
+      settings: getDefaultSettings('/synthetic'),
+      updateSettings: fake.write,
+      wslSupportedPlatform
+    }
+    const view = render(<AccountsPane {...props} />)
+    await act(async () => {})
+    const mountedHeading = screen.getByText('Codex', { exact: true })
+    const pendingReadsAfterMount = fake.pending.mock.calls.length
+    const subscriptionsAfterMount = fake.subscribe.mock.calls.length
+    for (const query of [
+      'c',
+      'co',
+      'cod',
+      'code',
+      'codex',
+      '',
+      'c',
+      'co',
+      'cod',
+      'code',
+      'codex'
+    ]) {
+      fake.query = query
+      await act(async () => view.rerender(<AccountsPane {...props} />))
+      expect(screen.getByText('Codex', { exact: true })).toBe(mountedHeading)
+    }
+    expect(fake.pending.mock.calls.length).toBe(pendingReadsAfterMount)
+    expect(fake.subscribe.mock.calls.length).toBe(subscriptionsAfterMount)
+  }
+)
+it('preserves explicit Grok refresh and real hide/reopen status reads', async () => {
+  fake.query = 'grok'
+  const props = { settings: getDefaultSettings('/synthetic'), updateSettings: fake.write }
+  const view = render(<AccountsPane {...props} />)
+  await act(async () => {})
+  fireEvent.click(screen.getByRole('button', { name: 'Refresh usage' }))
+  await act(async () => {})
+  expect(fake.refresh).toHaveBeenCalledTimes(1)
+  expect(fake.status).toHaveBeenCalledTimes(2)
+  fake.query = 'codex'
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(screen.queryByText('Grok (xAI)', { exact: true })).toBeNull()
+  fake.query = 'grok'
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(fake.status).toHaveBeenCalledTimes(3)
+  expect(fake.write).not.toHaveBeenCalled()
+})
+
+it('keeps usage-driven Grok status refreshes while the section stays mounted', async () => {
+  fake.query = 'grok'
+  const props = { settings: getDefaultSettings('/synthetic'), updateSettings: fake.write }
+  const view = render(<AccountsPane {...props} />)
+  await act(async () => {})
+  fake.grokUsage = { updatedAt: 10 }
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(fake.status).toHaveBeenCalledTimes(2)
+  fake.query = 'gro'
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(fake.status).toHaveBeenCalledTimes(2)
+  fake.grokUsage = { updatedAt: 11 }
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(fake.status).toHaveBeenCalledTimes(3)
+})
+
+it('keeps the login subscription until Codex genuinely hides', async () => {
+  const props = { settings: getDefaultSettings('/synthetic'), updateSettings: fake.write }
+  const view = render(<AccountsPane {...props} />)
+  await act(async () => {})
+  const unsubscribe = fake.subscribe.mock.results[0].value
+  fake.query = 'codex'
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(unsubscribe).not.toHaveBeenCalled()
+  fake.query = 'grok'
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(unsubscribe).toHaveBeenCalledTimes(1)
+  fake.query = 'codex'
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(fake.subscribe).toHaveBeenCalledTimes(2)
+  view.unmount()
+  expect(fake.subscribe.mock.results[1].value).toHaveBeenCalledTimes(1)
+})
+
+it.each([false, true])(
+  'retains Cursor status reads with Windows account support %s',
+  async (wslSupportedPlatform) => {
+    const props = {
+      settings: getDefaultSettings('/synthetic'),
+      updateSettings: fake.write,
+      wslSupportedPlatform
+    }
+    const view = render(<AccountsPane {...props} />)
+    await act(async () => {})
+    const mountedHeading = screen.getByText('Cursor', { exact: true })
+    const statusReadsAfterMount = fake.cursorStatus.mock.calls.length
+    for (const query of ['c', 'cu', 'cur', 'curs', 'curso', 'cursor', '', 'c', 'cu', 'cursor']) {
+      fake.query = query
+      await act(async () => view.rerender(<AccountsPane {...props} />))
+      expect(screen.getByText('Cursor', { exact: true })).toBe(mountedHeading)
+    }
+    expect(fake.cursorStatus.mock.calls.length).toBe(statusReadsAfterMount)
+    expect(fake.write).not.toHaveBeenCalled()
+  }
+)
+
+it('keeps Cursor refresh driven by usage updates and genuine reopen', async () => {
+  fake.query = 'cursor'
+  const props = { settings: getDefaultSettings('/synthetic'), updateSettings: fake.write }
+  const view = render(<AccountsPane {...props} />)
+  await act(async () => {})
+  fireEvent.click(screen.getByRole('button', { name: 'Refresh usage' }))
+  await act(async () => {})
+  expect(fake.cursorRefresh).toHaveBeenCalledTimes(1)
+  expect(fake.cursorStatus).toHaveBeenCalledTimes(1)
+  fake.cursorUsage = { updatedAt: 1 }
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(fake.cursorStatus).toHaveBeenCalledTimes(2)
+  fake.query = 'codex'
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(screen.queryByText('Cursor', { exact: true })).toBeNull()
+  fake.query = 'cursor'
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(fake.cursorStatus).toHaveBeenCalledTimes(3)
+})
diff --git a/src/renderer/src/components/settings/AccountsPane.tsx b/src/renderer/src/components/settings/AccountsPane.tsx
index 3af24a986fd..a418aa9916b 100644
--- a/src/renderer/src/components/settings/AccountsPane.tsx
+++ b/src/renderer/src/components/settings/AccountsPane.tsx
@@ -18,6 +18,7 @@ import {
   getAccountsClaudeSearchEntries,
   getAccountsCodexSearchEntries,
   getAccountsGeminiSearchEntries,
+  getAccountsCursorSearchEntries,
   getAccountsGrokSearchEntries,
   getAccountsLocationSearchEntries,
   getAccountsMiniMaxSearchEntries,
@@ -26,6 +27,7 @@ import {
 } from './accounts-search'
 import { getRemoteAccountsPaneScope } from './provider-account-scope'
 import { ProviderHostScopeControl } from './ProviderHostScopeControl'
+import { SettingsSectionStack } from './SettingsSectionStack'
 import { matchesSettingsSearch } from './settings-search'
 import { getCodexAccountAuthWarning } from './codex-account-auth-warning'
 import { getCodexConfigSyncWarning } from './codex-config-sync-warning'
@@ -34,8 +36,8 @@ import {
   providerAccountIsActiveInView,
   providerAccountMatchesView
 } from './provider-account-visibility'
-import { Separator } from '../ui/separator'
 import { GrokAccountsSection } from './GrokAccountsSection'
+import { CursorAccountsSection } from './CursorAccountsSection'
 import type {
   AccountsPaneProps,
   AccountsPaneSectionModel,
@@ -379,18 +381,16 @@ export function AccountsPane({
       : null,
     matchesSettingsSearch(searchQuery, getAccountsGrokSearchEntries()) ? (
       <GrokAccountsSection key="grok" />
+    ) : null,
+    matchesSettingsSearch(searchQuery, getAccountsCursorSearchEntries()) ? (
+      <CursorAccountsSection key="cursor" />
     ) : null
-  ].filter(Boolean)
+  ]
 
   return (
     <div className="space-y-8">
       {renderAccountsRemovalDialogs(model, removeCodexTarget, removeClaudeTarget)}
-      {visibleSections.map((section, index) => (
-        <div key={index} className="space-y-8">
-          {index > 0 ? <Separator /> : null}
-          {section}
-        </div>
-      ))}
+      <SettingsSectionStack sections={visibleSections} spacing="group" />
     </div>
   )
 }
diff --git a/src/renderer/src/components/settings/AgentsPane.test.tsx b/src/renderer/src/components/settings/AgentsPane.test.tsx
index ada6d8f1938..45ce068790c 100644
--- a/src/renderer/src/components/settings/AgentsPane.test.tsx
+++ b/src/renderer/src/components/settings/AgentsPane.test.tsx
@@ -8,6 +8,10 @@ import { AGENT_CATALOG } from '@/lib/agent-catalog'
 import { useAppStore } from '../../store'
 import { getAgentGeneratedTabTitlesTitle } from './agent-generated-tab-title-copy'
 import { getAgentStatusHooksTitle } from './agent-status-hooks-copy'
+import {
+  getAgentWorkspaceTrustDescription,
+  getAgentWorkspaceTrustTitle
+} from './agent-workspace-trust-copy'
 import { getAgentAwakeDescription, getAgentAwakeTitle } from './agent-awake-copy'
 import { AgentAwakeSetting } from './AgentAwakeSetting'
 import { AgentRuntimeSetting } from './AgentRuntimeSetting'
@@ -17,6 +21,7 @@ import {
   AgentPermissionsSetting,
   AgentGeneratedTabTitlesSetting,
   AgentStatusHooksSetting,
+  AgentWorkspaceTrustSetting,
   AgentsPane,
   getAgentsPaneSearchEntries,
   buildAgentAvailabilitySettingsUpdate,
@@ -263,6 +268,21 @@ describe('AgentsPane', () => {
     }
   })
 
+  it('keeps the host-only folder trust row out of paired web clients and their search', () => {
+    Reflect.set(globalThis, '__ORCA_WEB_CLIENT__', true)
+    try {
+      expect(renderPane(getDefaultSettings('/tmp'))).not.toContain(getAgentWorkspaceTrustTitle())
+      expect(
+        matchesSettingsSearch(
+          'trust',
+          getAgentsPaneSearchEntries({ includeAgentWorkspaceTrust: false })
+        )
+      ).toBe(false)
+    } finally {
+      Reflect.deleteProperty(globalThis, '__ORCA_WEB_CLIENT__')
+    }
+  })
+
   it('renders the agent runtime control on Windows-class hosts', () => {
     const markup = renderPane(
       {
@@ -365,6 +385,28 @@ describe('AgentsPane', () => {
     })
   })
 
+  it('defaults agent folder trust on and toggles it off', () => {
+    const updateSettings = vi.fn()
+    const element = AgentWorkspaceTrustSetting({
+      settings: getDefaultSettings('/tmp'),
+      updateSettings
+    })
+
+    const trustSwitch = findSwitchRow(element, getAgentWorkspaceTrustTitle())
+    expect(trustSwitch.props.checked).toBe(true)
+    expect(getAgentWorkspaceTrustDescription()).toContain('hooks')
+    expect(getAgentWorkspaceTrustDescription()).toContain('already trusted stay trusted')
+    expect(getAgentWorkspaceTrustDescription()).toContain('without you watching')
+
+    const onChange: unknown = trustSwitch.props.onChange
+    expect(typeof onChange).toBe('function')
+    if (typeof onChange === 'function') {
+      onChange()
+    }
+
+    expect(updateSettings).toHaveBeenCalledWith({ agentWorkspaceTrustEnabled: false })
+  })
+
   it('toggles generated tab titles with the next value', () => {
     const updateSettings = vi.fn()
     const element = AgentGeneratedTabTitlesSetting({
diff --git a/src/renderer/src/components/settings/AgentsPane.tsx b/src/renderer/src/components/settings/AgentsPane.tsx
index 59e139973ad..c348ecea339 100644
--- a/src/renderer/src/components/settings/AgentsPane.tsx
+++ b/src/renderer/src/components/settings/AgentsPane.tsx
@@ -14,6 +14,10 @@ import {
   getAgentGeneratedTabTitlesTitle
 } from './agent-generated-tab-title-copy'
 import { getAgentStatusHooksDescription, getAgentStatusHooksTitle } from './agent-status-hooks-copy'
+import {
+  getAgentWorkspaceTrustDescription,
+  getAgentWorkspaceTrustTitle
+} from './agent-workspace-trust-copy'
 import {
   SettingsSegmentedControl,
   SettingsSubsectionHeader,
@@ -255,6 +259,9 @@ export function AgentsPane({
         wslCapabilitiesLoading={wslCapabilitiesLoading}
       />
       <AgentStatusHooksSetting settings={settings} updateSettings={updateSettings} />
+      {!isPairedWebClientWindow() ? (
+        <AgentWorkspaceTrustSetting settings={settings} updateSettings={updateSettings} />
+      ) : null}
       <AgentGeneratedTabTitlesSetting settings={settings} updateSettings={updateSettings} />
       {!isPairedWebClientWindow() ? (
         <AgentAwakeSetting settings={settings} updateSettings={updateSettings} />
@@ -296,6 +303,21 @@ export function AgentStatusHooksSetting({ settings, updateSettings }: AgentsPane
   )
 }
 
+export function AgentWorkspaceTrustSetting({ settings, updateSettings }: AgentsPaneProps) {
+  const enabled = settings.agentWorkspaceTrustEnabled !== false
+  return (
+    <section className="space-y-3">
+      <SettingsSwitchRow
+        label={getAgentWorkspaceTrustTitle()}
+        description={getAgentWorkspaceTrustDescription()}
+        checked={enabled}
+        onChange={() => updateSettings({ agentWorkspaceTrustEnabled: !enabled })}
+        ariaLabel={getAgentWorkspaceTrustTitle()}
+      />
+    </section>
+  )
+}
+
 export function AgentGeneratedTabTitlesSetting({ settings, updateSettings }: AgentsPaneProps) {
   const enabled = settings.tabAutoGenerateTitle === true
   return (
diff --git a/src/renderer/src/components/settings/AppearanceWindowSidebarSection.tsx b/src/renderer/src/components/settings/AppearanceWindowSidebarSection.tsx
index 1d82af8ed7d..03c7912a772 100644
--- a/src/renderer/src/components/settings/AppearanceWindowSidebarSection.tsx
+++ b/src/renderer/src/components/settings/AppearanceWindowSidebarSection.tsx
@@ -53,7 +53,8 @@ function recordStatusBarToggleInteraction(
     id === 'kimi' ||
     id === 'antigravity' ||
     id === 'minimax' ||
-    id === 'grok'
+    id === 'grok' ||
+    id === 'cursor'
   ) {
     recordFeatureInteraction('usage-tracking')
   }
diff --git a/src/renderer/src/components/settings/BrowserPane.search-catalog.test.tsx b/src/renderer/src/components/settings/BrowserPane.search-catalog.test.tsx
new file mode 100644
index 00000000000..20517cf7276
--- /dev/null
+++ b/src/renderer/src/components/settings/BrowserPane.search-catalog.test.tsx
@@ -0,0 +1,129 @@
+// @vitest-environment happy-dom
+import { cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { getDefaultSettings } from '../../../../shared/constants'
+import { BrowserPane } from './BrowserPane'
+import { getBrowserPaneSearchEntries } from './browser-search'
+import type * as BrowserSearch from './browser-search'
+
+const fake = vi.hoisted(() => ({
+  query: '',
+  locale: { language: 'en' },
+  translate: vi.fn((_key: string, fallback: string) => fallback),
+  setHost: vi.fn(),
+  profiles: [],
+  repos: [],
+  map: new Map(),
+  environments: [],
+  hostOptions: [{ id: 'local', kind: 'local', label: 'Local' }]
+}))
+vi.mock('@/i18n/i18n', () => ({ i18n: fake.locale, translate: fake.translate }))
+vi.mock('./browser-search', async (importOriginal) => {
+  const original = await importOriginal<typeof BrowserSearch>()
+  return { ...original, getBrowserPaneSearchEntries: vi.fn(original.getBrowserPaneSearchEntries) }
+})
+vi.mock('@/store', () => ({
+  useAppStore: (selector: (state: Record<string, unknown>) => unknown) =>
+    selector({
+      settingsSearchQuery: fake.query,
+      browserDefaultUrl: '',
+      browserSessionProfiles: fake.profiles,
+      repos: fake.repos,
+      sshTargetLabels: fake.map,
+      sshConnectionStates: fake.map,
+      runtimeEnvironments: fake.environments,
+      runtimeStatusByEnvironmentId: fake.map,
+      browserSessionHostIdOverride: null,
+      setBrowserSessionHostId: fake.setHost
+    })
+}))
+vi.mock('@/components/terminal-pane/pane-helpers', () => ({ isMacUserAgent: () => false }))
+vi.mock('../sidebar/sidebar-host-options', () => ({
+  buildSidebarHostOptions: () => fake.hostOptions
+}))
+vi.mock('./BrowserHomePageSetting', () => ({
+  BrowserHomePageSetting: ({
+    value,
+    onChange
+  }: {
+    value: string
+    onChange: (value: string) => void
+  }) => (
+    <input
+      aria-label="Home page draft"
+      value={value}
+      onChange={(event) => onChange(event.target.value)}
+    />
+  )
+}))
+vi.mock('./BrowserUsePane', () => ({ BrowserUseSetup: () => <span>Browser use row</span> }))
+vi.mock('./BrowserDefaultZoomSetting', () => ({
+  BrowserDefaultZoomSetting: () => <span>Zoom row</span>
+}))
+vi.mock('./BrowserSearchEngineSetting', () => ({
+  BrowserSearchEngineSetting: () => <span>Search row</span>
+}))
+vi.mock('./BrowserLinkRoutingSetting', () => ({
+  BrowserLinkRoutingSetting: () => <span>Routing row</span>
+}))
+vi.mock('./BrowserLinkRoutingModifierSetting', () => ({
+  BrowserLinkRoutingModifierSetting: () => <span>Modifier row</span>
+}))
+vi.mock('./BrowserTerminalLinkActionsSetting', () => ({
+  BrowserTerminalLinkActionsSetting: () => <span>Terminal links row</span>
+}))
+vi.mock('./BrowserLocalhostWorktreeLabelsSetting', () => ({
+  BrowserLocalhostWorktreeLabelsSetting: () => <span>Localhost row</span>
+}))
+vi.mock('./BrowserClientHostedRemoteSetting', () => ({
+  BrowserClientHostedRemoteSetting: () => <span>Remote row</span>
+}))
+vi.mock('./BrowserSshWorkspaceRoutingSetting', () => ({
+  BrowserSshWorkspaceRoutingSetting: () => <span>SSH row</span>
+}))
+vi.mock('./BrowserUserAgentSetting', () => ({
+  BrowserUserAgentSetting: () => <span>Identity row</span>
+}))
+vi.mock('./SettingsFormControls', () => ({ SettingsSubsectionHeader: () => null }))
+vi.mock('./BrowserSessionCookiesSection', () => ({
+  BrowserSessionCookiesSection: () => <span>Cookies row</span>
+}))
+vi.mock('./BrowserNewProfileDialog', () => ({ BrowserNewProfileDialog: () => null }))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  fake.query = ''
+  fake.locale.language = 'en'
+  fake.translate.mockImplementation((_key, fallback) => fallback)
+})
+afterEach(cleanup)
+it('builds one catalog per render while typing a home page draft', () => {
+  render(<BrowserPane settings={getDefaultSettings('/synthetic')} updateSettings={vi.fn()} />)
+  vi.clearAllMocks()
+  for (let index = 1; index <= 20; index++) {
+    fireEvent.change(screen.getByRole('textbox'), { target: { value: 'x'.repeat(index) } })
+  }
+  expect(getBrowserPaneSearchEntries).toHaveBeenCalledTimes(20)
+})
+it('keeps targeted search visibility', () => {
+  fake.query = 'Default Home Page'
+  render(<BrowserPane settings={getDefaultSettings('/synthetic')} updateSettings={vi.fn()} />)
+  expect(screen.getByRole('textbox')).toBeTruthy()
+  expect(screen.queryByText('Cookies row')).toBeNull()
+})
+
+it('rebuilds metadata in the next render after the language changes', () => {
+  fake.query = 'Default Home Page'
+  const settings = getDefaultSettings('/synthetic')
+  const view = render(<BrowserPane settings={settings} updateSettings={vi.fn()} />)
+  expect(screen.getByRole('textbox')).toBeTruthy()
+  fake.locale.language = 'synthetic-locale'
+  fake.query = 'Translated home'
+  fake.translate.mockImplementation((_key, fallback) =>
+    fallback === 'Default Home Page' ? 'Translated home' : fallback
+  )
+  vi.mocked(getBrowserPaneSearchEntries).mockClear()
+  view.rerender(<BrowserPane settings={settings} updateSettings={vi.fn()} />)
+  expect(screen.getByRole('textbox')).toBeTruthy()
+  expect(screen.queryByText('Cookies row')).toBeNull()
+})
diff --git a/src/renderer/src/components/settings/BrowserPane.tsx b/src/renderer/src/components/settings/BrowserPane.tsx
index be271b61785..41b330b2c33 100644
--- a/src/renderer/src/components/settings/BrowserPane.tsx
+++ b/src/renderer/src/components/settings/BrowserPane.tsx
@@ -102,25 +102,18 @@ export function BrowserPane({
 
   const selectedSearchEngine = browserDefaultSearchEngine ?? 'google'
 
-  const showHomePage = matchesSettingsSearch(searchQuery, [getBrowserPaneSearchEntries()[0]])
-  const showSearchEngine = matchesSettingsSearch(searchQuery, [getBrowserPaneSearchEntries()[1]])
-  const showDefaultZoom = matchesSettingsSearch(searchQuery, [getBrowserPaneSearchEntries()[2]])
-  const showLinkRouting = matchesSettingsSearch(searchQuery, [getBrowserPaneSearchEntries()[3]])
-  const showLinkRoutingModifier = matchesSettingsSearch(searchQuery, [
-    getBrowserPaneSearchEntries()[4]
-  ])
-  const showTerminalLinkActions = matchesSettingsSearch(searchQuery, [
-    getBrowserPaneSearchEntries()[5]
-  ])
-  const showLocalhostLabels = matchesSettingsSearch(searchQuery, [getBrowserPaneSearchEntries()[6]])
-  const showCookies = matchesSettingsSearch(searchQuery, [getBrowserPaneSearchEntries()[7]])
-  const showClientHostedRemote = matchesSettingsSearch(searchQuery, [
-    getBrowserPaneSearchEntries()[8]
-  ])
-  const showSshWorkspaceRouting = matchesSettingsSearch(searchQuery, [
-    getBrowserPaneSearchEntries()[9]
-  ])
-  const showUserAgent = matchesSettingsSearch(searchQuery, [getBrowserPaneSearchEntries()[10]])
+  const browserSearchEntries = getBrowserPaneSearchEntries()
+  const showHomePage = matchesSettingsSearch(searchQuery, [browserSearchEntries[0]])
+  const showSearchEngine = matchesSettingsSearch(searchQuery, [browserSearchEntries[1]])
+  const showDefaultZoom = matchesSettingsSearch(searchQuery, [browserSearchEntries[2]])
+  const showLinkRouting = matchesSettingsSearch(searchQuery, [browserSearchEntries[3]])
+  const showLinkRoutingModifier = matchesSettingsSearch(searchQuery, [browserSearchEntries[4]])
+  const showTerminalLinkActions = matchesSettingsSearch(searchQuery, [browserSearchEntries[5]])
+  const showLocalhostLabels = matchesSettingsSearch(searchQuery, [browserSearchEntries[6]])
+  const showCookies = matchesSettingsSearch(searchQuery, [browserSearchEntries[7]])
+  const showClientHostedRemote = matchesSettingsSearch(searchQuery, [browserSearchEntries[8]])
+  const showSshWorkspaceRouting = matchesSettingsSearch(searchQuery, [browserSearchEntries[9]])
+  const showUserAgent = matchesSettingsSearch(searchQuery, [browserSearchEntries[10]])
   const showBrowserUse = matchesSettingsSearch(searchQuery, getBrowserUsePaneSearchEntries())
   const isMac = isMacUserAgent()
   const linkRoutingDescription = getBrowserLinkRoutingDescription(
diff --git a/src/renderer/src/components/settings/CursorAccountsSection.tsx b/src/renderer/src/components/settings/CursorAccountsSection.tsx
new file mode 100644
index 00000000000..705e7a6e33b
--- /dev/null
+++ b/src/renderer/src/components/settings/CursorAccountsSection.tsx
@@ -0,0 +1,281 @@
+import { useCallback, useEffect, useRef, useState } from 'react'
+import { ExternalLink, Loader2, RefreshCw, ShieldCheck } from 'lucide-react'
+import { AgentIcon } from '@/lib/agent-catalog'
+import { translate } from '@/i18n/i18n'
+import { cn } from '@/lib/utils'
+import { useAppStore } from '../../store'
+import { Badge } from '../ui/badge'
+import { Button } from '../ui/button'
+import type { CursorAccountStatus } from '../../../../shared/rate-limit-types'
+import { SearchableSetting } from './SearchableSetting'
+
+const CURSOR_USAGE_DASHBOARD_URL = 'https://cursor.com/dashboard/spending'
+const SEARCH_KEYWORDS = ['cursor', 'usage', 'plan', 'spend', 'billing', 'rate limit']
+
+function credentialSourceLabel(source: CursorAccountStatus['credentialSource']): string | null {
+  if (source === 'keychain') {
+    return translate(
+      'auto.components.settings.CursorAccountsSection.source.keychain',
+      'macOS Keychain (cursor-agent)'
+    )
+  }
+  if (source === 'cli') {
+    return translate(
+      'auto.components.settings.CursorAccountsSection.source.cli',
+      'Cursor CLI auth file'
+    )
+  }
+  if (source === 'desktop') {
+    return translate('auto.components.settings.CursorAccountsSection.source.desktop', 'Cursor IDE')
+  }
+  return null
+}
+
+export function CursorAccountsSection(): React.JSX.Element {
+  const refreshRateLimits = useAppStore((s) => s.refreshRateLimits)
+  const cursorUsage = useAppStore((s) => s.rateLimits.cursor)
+  const [status, setStatus] = useState<CursorAccountStatus | null>(null)
+  const [loading, setLoading] = useState(true)
+  const [refreshing, setRefreshing] = useState(false)
+
+  // Why a generation counter: two usage updates can overlap, and the slower read
+  // would otherwise land last and repaint the pane with the older account.
+  const latestLoad = useRef(0)
+
+  const loadStatus = useCallback(async (): Promise<void> => {
+    const generation = latestLoad.current + 1
+    latestLoad.current = generation
+    const apply = (next: CursorAccountStatus): void => {
+      if (latestLoad.current !== generation) {
+        return
+      }
+      setStatus(next)
+      setLoading(false)
+    }
+    try {
+      apply(await window.api.cursorAccounts.getStatus())
+    } catch (error) {
+      console.error('Failed to load Cursor account status:', error)
+      apply({
+        signedIn: false,
+        email: null,
+        displayName: null,
+        credentialSource: null,
+        planType: null,
+        tokenFresh: false,
+        error: error instanceof Error ? error.message : 'Unable to read Cursor sign-in'
+      })
+    }
+  }, [])
+
+  // Why: after a background usage fetch, sign-in state may change — reload status then.
+  useEffect(() => {
+    void loadStatus()
+  }, [loadStatus, cursorUsage?.updatedAt])
+
+  // Why: the effect below already reloads status when the refresh lands a new
+  // snapshot, and each load is a keychain read for an item Orca does not own.
+  const handleRefreshUsage = async (): Promise<void> => {
+    setRefreshing(true)
+    try {
+      await refreshRateLimits()
+    } finally {
+      setRefreshing(false)
+    }
+  }
+
+  const signedIn = status?.signedIn === true
+  const tokenFresh = status?.tokenFresh === true
+  const sourceLabel = credentialSourceLabel(status?.credentialSource ?? null)
+  const pools = cursorUsage?.buckets ?? []
+  const monthly = cursorUsage?.monthly ?? null
+  // Why: hiding the row entirely leaves signed-in users with no explanation when
+  // Cursor reports no allowance or the refresh failed — never let unknown usage
+  // read as healthy, and never let a failed fetch render as an empty section.
+  const unavailableReason =
+    signedIn && pools.length === 0 && !monthly
+      ? cursorUsage?.status === 'unavailable' || cursorUsage?.status === 'error'
+        ? (cursorUsage.error ?? null)
+        : null
+      : null
+  // Why separate from the row above: a stale snapshot still renders its numbers,
+  // so the failure has to be said beside them rather than instead of them.
+  const staleUsageError =
+    signedIn && cursorUsage?.status === 'error' && (pools.length > 0 || monthly)
+      ? (cursorUsage.error ?? null)
+      : null
+
+  return (
+    <section id="accounts-cursor" className="space-y-4 scroll-mt-6">
+      <div className="flex items-start justify-between gap-3">
+        <div className="space-y-1">
+          <h3 className="flex items-center gap-2 text-sm font-semibold">
+            <AgentIcon agent="cursor" size={16} />
+            {translate('auto.components.settings.CursorAccountsSection.title', 'Cursor')}
+          </h3>
+          <p className="text-xs text-muted-foreground">
+            {translate(
+              'auto.components.settings.CursorAccountsSection.subtitle',
+              'Shows your monthly Cursor plan usage from the sign-in already on this computer. Orca only reads it — it never changes your Cursor login.'
+            )}
+          </p>
+        </div>
+        <a
+          href={CURSOR_USAGE_DASHBOARD_URL}
+          target="_blank"
+          rel="noopener noreferrer"
+          className="inline-flex items-center gap-1 text-xs text-muted-foreground hover:text-foreground"
+        >
+          {translate(
+            'auto.components.settings.CursorAccountsSection.dashboardLink',
+            'Cursor dashboard'
+          )}
+          <ExternalLink className="size-3" />
+        </a>
+      </div>
+
+      <div
+        className={cn(
+          'flex items-start gap-3 rounded-lg border bg-muted/20 p-3',
+          signedIn && tokenFresh ? 'border-border/60' : 'border-border/40'
+        )}
+      >
+        <ShieldCheck
+          className={cn(
+            'mt-0.5 size-4 shrink-0',
+            signedIn && tokenFresh ? 'text-foreground' : 'text-muted-foreground'
+          )}
+        />
+        <div className="min-w-0 flex-1 space-y-1">
+          {loading ? (
+            <p className="text-xs text-muted-foreground">
+              {translate('auto.components.settings.CursorAccountsSection.loading', 'Loading…')}
+            </p>
+          ) : signedIn ? (
+            <>
+              <p className="truncate text-xs font-medium">
+                {status?.email ??
+                  status?.displayName ??
+                  translate('auto.components.settings.CursorAccountsSection.signedIn', 'Signed in')}
+              </p>
+              <p className="text-xs text-muted-foreground">
+                {tokenFresh
+                  ? sourceLabel
+                    ? translate(
+                        'auto.components.settings.CursorAccountsSection.signedInFrom',
+                        'Signed in. Orca reads the session stored in {{source}}.',
+                        { source: sourceLabel }
+                      )
+                    : translate(
+                        'auto.components.settings.CursorAccountsSection.signedInGeneric',
+                        'Signed in. Orca reads the Cursor session stored on this computer.'
+                      )
+                  : translate(
+                      'auto.components.settings.CursorAccountsSection.expired',
+                      'Sign-in expired — run cursor-agent login on the computer running Orca, then click Refresh usage.'
+                    )}
+              </p>
+            </>
+          ) : (
+            <>
+              <p className="text-xs font-medium">
+                {translate(
+                  'auto.components.settings.CursorAccountsSection.signedOut',
+                  'No Cursor sign-in found on this computer'
+                )}
+              </p>
+              <p className="text-xs text-muted-foreground">
+                {translate(
+                  'auto.components.settings.CursorAccountsSection.signedOutHelp',
+                  'Sign in with Cursor IDE, or run cursor-agent login in a terminal, then click Refresh usage here.'
+                )}
+              </p>
+            </>
+          )}
+          {status?.error ? <p className="text-xs text-destructive">{status.error}</p> : null}
+        </div>
+        <Button
+          variant="outline"
+          size="xs"
+          disabled={refreshing}
+          onClick={() => void handleRefreshUsage()}
+          className="shrink-0"
+        >
+          {refreshing ? (
+            <Loader2 className="size-3 animate-spin" />
+          ) : (
+            <RefreshCw className="size-3" />
+          )}
+          {translate(
+            'auto.components.settings.CursorAccountsSection.refreshUsage',
+            'Refresh usage'
+          )}
+        </Button>
+      </div>
+
+      {pools.length > 0 || monthly ? (
+        <SearchableSetting
+          title={translate(
+            'auto.components.settings.CursorAccountsSection.usageTitle',
+            'Monthly plan usage'
+          )}
+          description={translate(
+            'auto.components.settings.CursorAccountsSection.usageDescription',
+            'Cursor bills two pools that reset with your billing cycle, plus on-demand spend once they run out.'
+          )}
+          keywords={SEARCH_KEYWORDS}
+        >
+          <div className="space-y-1">
+            {pools.map((pool) => (
+              <div key={pool.name} className="flex items-center gap-2 text-xs">
+                <Badge variant="secondary">
+                  <span className="tabular-nums">{Math.round(pool.usedPercent)}%</span>
+                </Badge>
+                <span className="text-muted-foreground">{pool.name}</span>
+              </div>
+            ))}
+            {monthly ? (
+              <div className="flex items-center gap-2 text-xs">
+                <Badge variant="secondary">
+                  <span className="tabular-nums">{Math.round(monthly.usedPercent)}%</span>
+                </Badge>
+                <span className="text-muted-foreground">
+                  {translate('auto.components.settings.CursorAccountsSection.planTotal', 'Plan')}
+                </span>
+              </div>
+            ) : null}
+            {(monthly ?? pools[0])?.resetDescription ? (
+              <p className="text-xs text-muted-foreground">
+                {translate(
+                  'auto.components.settings.CursorAccountsSection.resets',
+                  'Resets {{when}}',
+                  { when: (monthly ?? pools[0])?.resetDescription ?? '' }
+                )}
+              </p>
+            ) : null}
+            {staleUsageError ? (
+              <p className="text-xs text-destructive">
+                {translate(
+                  'auto.components.settings.CursorAccountsSection.staleUsage',
+                  'Last known usage — the latest refresh failed: {{reason}}',
+                  { reason: staleUsageError }
+                )}
+              </p>
+            ) : null}
+          </div>
+        </SearchableSetting>
+      ) : unavailableReason ? (
+        <SearchableSetting
+          title={translate('auto.components.settings.CursorAccountsSection.usageLabel', 'Usage')}
+          description={translate(
+            'auto.components.settings.CursorAccountsSection.noAllowance',
+            'Cursor reported no usage allowance for this account.'
+          )}
+          keywords={SEARCH_KEYWORDS}
+        >
+          <p className="text-xs text-muted-foreground">{unavailableReason}</p>
+        </SearchableSetting>
+      ) : null}
+    </section>
+  )
+}
diff --git a/src/renderer/src/components/settings/GeneralPane.section-lifetime.test.tsx b/src/renderer/src/components/settings/GeneralPane.section-lifetime.test.tsx
new file mode 100644
index 00000000000..65311898711
--- /dev/null
+++ b/src/renderer/src/components/settings/GeneralPane.section-lifetime.test.tsx
@@ -0,0 +1,206 @@
+// @vitest-environment happy-dom
+import { act, cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { getDefaultSettings } from '../../../../shared/constants'
+import { GeneralPane } from './GeneralPane'
+const fake = vi.hoisted(() => ({
+  query: '',
+  getVersion: vi.fn(async () => '1.4.100'),
+  refresh: vi.fn(async () => {}),
+  action: vi.fn(),
+  updates: new Map([
+    ['synthetic-host', { environmentId: 'synthetic-host', phase: 'current', name: 'Synthetic' }]
+  ])
+}))
+vi.mock('@/i18n/i18n', () => ({
+  i18n: { language: 'en' },
+  translate: (_key: string, fallback: string, values?: Record<string, string | number>) =>
+    Object.entries(values ?? {}).reduce(
+      (text, [key, value]) => text.replaceAll(`{{${key}}}`, String(value)),
+      fallback
+    )
+}))
+vi.mock('@/store', () => ({
+  useAppStore: (selector: (state: Record<string, unknown>) => unknown) =>
+    selector({
+      settingsSearchQuery: fake.query,
+      updateStatus: { state: 'idle' },
+      remoteServerUpdates: fake.updates,
+      remoteServerUpdatesChecking: false,
+      remoteServerUpdatesRunning: false,
+      refreshRemoteServerUpdates: fake.refresh,
+      setRemoteServerUpdateDialogOpen: fake.action
+    })
+}))
+vi.mock('@/components/settings/GeneralWorkspaceSettingsSection', () => ({
+  GeneralWorkspaceSettingsSection: () => null
+}))
+vi.mock('@/components/settings/CliSection', () => ({ CliSection: () => null }))
+vi.mock('@/components/settings/GeneralSupportSection', () => ({
+  GeneralSupportSection: () => null
+}))
+vi.mock('@/components/settings/ReleaseChannelSection', () => ({
+  ReleaseChannelSection: () => <div>Release picker open</div>
+}))
+vi.mock('@/components/settings/DefaultWindowsProjectRuntimeSetting', () => ({
+  DefaultWindowsProjectRuntimeSetting: () => null
+}))
+beforeEach(() => {
+  vi.clearAllMocks()
+  fake.query = ''
+  fake.updates = new Map([
+    ['synthetic-host', { environmentId: 'synthetic-host', phase: 'current', name: 'Synthetic' }]
+  ])
+  Object.assign(window, { api: { updater: { getVersion: fake.getVersion } } })
+})
+afterEach(() => {
+  cleanup()
+  Reflect.deleteProperty(window, 'api')
+})
+it.each([false, true])(
+  'retains update sections with Windows runtime support %s',
+  async (wslSupportedPlatform) => {
+    const props = {
+      settings: getDefaultSettings('/synthetic'),
+      updateSettings: vi.fn(),
+      fontSuggestions: [],
+      wslSupportedPlatform
+    }
+    const view = render(<GeneralPane {...props} />)
+    await act(async () => {})
+    // The invariant is identity, not a magic number: the matched section keeps the same DOM
+    // node across every query edit, so editing the query cannot cost an extra read.
+    const mountedHeading = screen.getByText('Updates', { exact: true })
+    const versionReadsAfterMount = fake.getVersion.mock.calls.length
+    const remoteRefreshesAfterMount = fake.refresh.mock.calls.length
+    for (const query of [
+      'u',
+      'up',
+      'upd',
+      'upda',
+      'updat',
+      'update',
+      '',
+      'v',
+      've',
+      'ver',
+      'vers',
+      'versi',
+      'versio',
+      'version'
+    ]) {
+      fake.query = query
+      await act(async () => view.rerender(<GeneralPane {...props} />))
+      expect(screen.getByText('Updates', { exact: true })).toBe(mountedHeading)
+    }
+    expect(fake.getVersion.mock.calls.length).toBe(versionReadsAfterMount)
+    expect(fake.refresh.mock.calls.length).toBe(remoteRefreshesAfterMount)
+  }
+)
+
+it('keeps showing store-published remote update state without a remount', async () => {
+  const props = {
+    settings: getDefaultSettings('/synthetic'),
+    updateSettings: vi.fn(),
+    fontSuggestions: []
+  }
+  fake.query = 'update'
+  const view = render(<GeneralPane {...props} />)
+  await act(async () => {})
+  const mountedHeading = screen.getByText('Updates', { exact: true })
+  expect(screen.getByText('1 paired server · 1 up to date')).toBeTruthy()
+  // Remote update entries live in the store, so a retained section stays fresh through the
+  // subscription rather than through the remount a query edit used to force.
+  fake.updates = new Map([
+    ['synthetic-host', { environmentId: 'synthetic-host', phase: 'available', name: 'Synthetic' }]
+  ])
+  fake.query = 'updat'
+  await act(async () => view.rerender(<GeneralPane {...props} />))
+  expect(screen.getByText('Updates', { exact: true })).toBe(mountedHeading)
+  expect(screen.getByText('1 paired server · 1 ready to update')).toBeTruthy()
+  expect(fake.refresh.mock.calls.length).toBe(1)
+})
+it('keeps explicit remote refresh and true hide/reopen reads', async () => {
+  const props = {
+    settings: getDefaultSettings('/synthetic'),
+    updateSettings: vi.fn(),
+    fontSuggestions: []
+  }
+  const view = render(<GeneralPane {...props} />)
+  await act(async () => {})
+  fireEvent.click(screen.getByRole('button', { name: 'Check for Server Updates' }))
+  expect(fake.refresh).toHaveBeenCalledTimes(2)
+  fake.query = 'Tab Order'
+  await act(async () => view.rerender(<GeneralPane {...props} />))
+  expect(screen.queryByText('Updates', { exact: true })).toBeNull()
+  fake.query = 'update'
+  await act(async () => view.rerender(<GeneralPane {...props} />))
+  expect(fake.getVersion).toHaveBeenCalledTimes(2)
+  expect(fake.refresh).toHaveBeenCalledTimes(3)
+})
+
+it('preserves an autosave draft until external settings change or the section hides', async () => {
+  const settings = { ...getDefaultSettings('/synthetic'), editorAutoSaveDelayMs: 1000 }
+  const props = { settings, updateSettings: vi.fn(), fontSuggestions: [] }
+  const view = render(<GeneralPane {...props} />)
+  await act(async () => {})
+  fireEvent.change(screen.getByRole('spinbutton'), { target: { value: '2500' } })
+  fake.query = 'Auto Save'
+  await act(async () => view.rerender(<GeneralPane {...props} />))
+  expect(screen.getByRole('spinbutton').getAttribute('value')).toBe('2500')
+  expect(props.updateSettings).not.toHaveBeenCalled()
+  const changedProps = { ...props, settings: { ...settings, editorAutoSaveDelayMs: 3000 } }
+  await act(async () => view.rerender(<GeneralPane {...changedProps} />))
+  expect(screen.getByRole('spinbutton').getAttribute('value')).toBe('3000')
+  fireEvent.change(screen.getByRole('spinbutton'), { target: { value: '3500' } })
+  fake.query = 'Tab Order'
+  await act(async () => view.rerender(<GeneralPane {...changedProps} />))
+  expect(screen.queryByRole('spinbutton')).toBeNull()
+  fake.query = 'Auto Save'
+  await act(async () => view.rerender(<GeneralPane {...changedProps} />))
+  expect(screen.getByRole('spinbutton').getAttribute('value')).toBe('3000')
+  expect(props.updateSettings).not.toHaveBeenCalled()
+})
+it('retains the revealed release picker only while Updates remains visible', async () => {
+  const props = {
+    settings: getDefaultSettings('/synthetic'),
+    updateSettings: vi.fn(),
+    fontSuggestions: []
+  }
+  const view = render(<GeneralPane {...props} />)
+  await act(async () => {})
+  fireEvent.click(screen.getByText('Updates', { exact: true }), { altKey: true })
+  expect(screen.getByText('Release picker open')).toBeTruthy()
+  fake.query = 'update'
+  await act(async () => view.rerender(<GeneralPane {...props} />))
+  expect(screen.getByText('Release picker open')).toBeTruthy()
+  fake.query = 'Tab Order'
+  await act(async () => view.rerender(<GeneralPane {...props} />))
+  fake.query = 'update'
+  await act(async () => view.rerender(<GeneralPane {...props} />))
+  expect(screen.queryByText('Release picker open')).toBeNull()
+})
+it('does not publish a version result from a genuinely unmounted section', async () => {
+  let resolveOld: ((value: string) => void) | undefined
+  fake.getVersion.mockImplementationOnce(
+    () =>
+      new Promise<string>((resolve) => {
+        resolveOld = resolve
+      })
+  )
+  const props = {
+    settings: getDefaultSettings('/synthetic'),
+    updateSettings: vi.fn(),
+    fontSuggestions: []
+  }
+  const view = render(<GeneralPane {...props} />)
+  await act(async () => {})
+  fake.query = 'Tab Order'
+  await act(async () => view.rerender(<GeneralPane {...props} />))
+  fake.query = 'update'
+  await act(async () => view.rerender(<GeneralPane {...props} />))
+  expect(screen.getByText('Current version: 1.4.100')).toBeTruthy()
+  await act(async () => resolveOld?.('1.0.0'))
+  expect(screen.getByText('Current version: 1.4.100')).toBeTruthy()
+  expect(screen.queryByText('Current version: 1.0.0')).toBeNull()
+})
diff --git a/src/renderer/src/components/settings/GeneralPane.test.ts b/src/renderer/src/components/settings/GeneralPane.test.ts
index 482fc1df787..e8fd5ea998b 100644
--- a/src/renderer/src/components/settings/GeneralPane.test.ts
+++ b/src/renderer/src/components/settings/GeneralPane.test.ts
@@ -4,7 +4,6 @@ import {
   getDesktopPlatformFromUserAgent,
   getGeneralPaneSearchEntries,
   getTabOrderControlSearchKeywords,
-  shouldCommitOpenInApplicationsDraft,
   shouldShowProjectRuntimeSection,
   updateAutoSaveDelayDraftState
 } from './GeneralPane'
@@ -30,36 +29,6 @@ describe('GeneralPane auto-save delay drafts', () => {
   })
 })
 
-describe('GeneralPane open-in application drafts', () => {
-  it('does not commit rows until both label and command are present', () => {
-    expect(
-      shouldCommitOpenInApplicationsDraft([{ id: 'draft', label: 'Cursor', command: '' }])
-    ).toBe(false)
-    expect(
-      shouldCommitOpenInApplicationsDraft([{ id: 'draft', label: '', command: 'cursor' }])
-    ).toBe(false)
-    expect(
-      shouldCommitOpenInApplicationsDraft([{ id: 'draft', label: '   ', command: 'cursor' }])
-    ).toBe(false)
-    expect(
-      shouldCommitOpenInApplicationsDraft([{ id: 'draft', label: 'Cursor', command: '   ' }])
-    ).toBe(false)
-  })
-
-  it('allows commit when every draft row has a label and command', () => {
-    expect(shouldCommitOpenInApplicationsDraft([])).toBe(true)
-    expect(
-      shouldCommitOpenInApplicationsDraft([{ id: 'cursor', label: 'Cursor', command: 'cursor' }])
-    ).toBe(true)
-    expect(
-      shouldCommitOpenInApplicationsDraft([
-        { id: 'cursor', label: 'Cursor', command: 'cursor' },
-        { id: 'zed', label: 'Zed', command: 'zed' }
-      ])
-    ).toBe(true)
-  })
-})
-
 describe('GeneralPane desktop platform detection', () => {
   it('keeps Windows available for Windows-only CLI settings', () => {
     expect(
diff --git a/src/renderer/src/components/settings/GeneralPane.tsx b/src/renderer/src/components/settings/GeneralPane.tsx
index 981e5d530e9..e9b9fc4bc30 100644
--- a/src/renderer/src/components/settings/GeneralPane.tsx
+++ b/src/renderer/src/components/settings/GeneralPane.tsx
@@ -1,7 +1,6 @@
 import type React from 'react'
 import type { GlobalSettings } from '../../../../shared/global-settings-types'
 import { useAppStore } from '../../store'
-import { Separator } from '../ui/separator'
 import { CliSection } from './CliSection'
 import { GeneralEditorSettingsSection } from './GeneralEditorSettingsSection'
 import { GeneralSupportSection } from './GeneralSupportSection'
@@ -18,6 +17,7 @@ import {
 } from './general-search'
 import { getGeneralProjectRuntimeSearchEntries } from './general-project-runtime-search'
 import { RecentTabOrderControl } from './RecentTabOrderControl'
+import { SettingsSectionStack } from './SettingsSectionStack'
 import { matchesSettingsSearch, type SettingsSearchEntry } from './settings-search'
 import { SearchableSetting } from './SearchableSetting'
 import { SettingsSubsectionHeader, SettingsSwitchRow } from './SettingsFormControls'
@@ -279,18 +279,15 @@ export function GeneralPane({
     // its own loading placeholder and its own collapsing Separator. Without
     // that separation, a dangling divider would remain above the collapsed
     // section.
-  ].filter(Boolean)
+  ]
 
   return (
     <div className="space-y-6">
-      {visibleSections.map((section, index) => (
-        <div key={index} className="space-y-6">
-          {index > 0 ? <Separator /> : null}
-          {section}
-        </div>
-      ))}
+      <SettingsSectionStack sections={visibleSections} spacing="section" />
       {matchesSettingsSearch(searchQuery, getGeneralSupportSearchEntries()) ? (
-        <GeneralSupportSection hasPrecedingSections={visibleSections.length > 0} />
+        <GeneralSupportSection
+          hasPrecedingSections={visibleSections.some((section) => section !== null)}
+        />
       ) : null}
     </div>
   )
diff --git a/src/renderer/src/components/settings/GlobalWorktreeVisibilitySourcesSetting.tsx b/src/renderer/src/components/settings/GlobalWorktreeVisibilitySourcesSetting.tsx
index 1cf9a026cd9..b660b25a3f3 100644
--- a/src/renderer/src/components/settings/GlobalWorktreeVisibilitySourcesSetting.tsx
+++ b/src/renderer/src/components/settings/GlobalWorktreeVisibilitySourcesSetting.tsx
@@ -17,6 +17,7 @@ import WorktreeVisibilitySourceList, {
   type WorktreeVisibilitySourceRow
 } from '../sidebar/WorktreeVisibilitySourceList'
 import { translate } from '@/i18n/i18n'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 type Props = {
   settings: GlobalSettings
@@ -105,7 +106,7 @@ export function GlobalWorktreeVisibilitySourcesSetting({
       if (customSources.length >= MAX_CUSTOM_WORKTREE_VISIBILITY_SOURCES) {
         return 'limit'
       }
-      const id = crypto.randomUUID().replaceAll('-', '')
+      const id = createBrowserUuid().replaceAll('-', '')
       const candidate = normalizeCustomWorktreeVisibilitySources([{ id, rootPath }])?.[0]
       if (!candidate) {
         return 'invalid-path'
diff --git a/src/renderer/src/components/settings/OpenInMenuSetting.tsx b/src/renderer/src/components/settings/OpenInMenuSetting.tsx
index aa18ec951f1..33db6a1b4bc 100644
--- a/src/renderer/src/components/settings/OpenInMenuSetting.tsx
+++ b/src/renderer/src/components/settings/OpenInMenuSetting.tsx
@@ -23,6 +23,7 @@ import {
   type OpenInAppPreset
 } from '@/lib/open-in-app-catalog'
 import { translate } from '@/i18n/i18n'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 type OpenInMenuSettingProps = {
   applications: OpenInApplication[] | undefined
@@ -36,9 +37,7 @@ type OpenInApplicationsDraftState = {
 
 function createOpenInApplication(): OpenInApplication {
   return {
-    id:
-      globalThis.crypto?.randomUUID?.() ??
-      `open-in-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`,
+    id: createBrowserUuid(),
     label: '',
     command: ''
   }
diff --git a/src/renderer/src/components/settings/RepositoryHookPolicySettings.tsx b/src/renderer/src/components/settings/RepositoryHookPolicySettings.tsx
index a6bedb5949c..6a41bdb974e 100644
--- a/src/renderer/src/components/settings/RepositoryHookPolicySettings.tsx
+++ b/src/renderer/src/components/settings/RepositoryHookPolicySettings.tsx
@@ -141,19 +141,13 @@ export function RepositorySetupPolicySetting({
         />
       </div>
       <div className="flex items-start justify-between gap-4 border-t border-border/60 pt-4">
-        <div className="min-w-0 space-y-1">
+        <div className="min-w-0">
           <h5 className="text-sm font-semibold">
             {translate(
               'auto.components.settings.RepositoryHooksSection.waitForSetupBeforeAgent',
               'Wait for setup to complete before starting agent'
             )}
           </h5>
-          <p className="text-xs text-muted-foreground">
-            {translate(
-              'auto.components.settings.RepositoryHooksSection.waitForSetupBeforeAgentHelp',
-              'Turn this on when setup installs dependencies, MCP servers, or config files the agent needs during startup.'
-            )}
-          </p>
         </div>
         <SettingsSwitch
           checked={setupAgentStartupPolicy === 'wait-for-setup'}
diff --git a/src/renderer/src/components/settings/RepositoryPane.tsx b/src/renderer/src/components/settings/RepositoryPane.tsx
index 71a4c2e9c24..d5de052b6b5 100644
--- a/src/renderer/src/components/settings/RepositoryPane.tsx
+++ b/src/renderer/src/components/settings/RepositoryPane.tsx
@@ -407,7 +407,7 @@ export function RepositoryPane({
     ) : null,
     !isFolder &&
     (forceFullPaneForRepoMatch || matchesSettingsSearch(searchQuery, sparsePresetEntries)) ? (
-      <SparsePresetSettingsSection key="sparse-presets" repoId={repo.id} />
+      <SparsePresetSettingsSection key={`sparse-presets:${repo.id}`} repoId={repo.id} />
     ) : null,
     !isFolder && (forceFullPaneForRepoMatch || matchesSettingsSearch(searchQuery, mcpEntries)) ? (
       <McpConfigSection key="mcp-configs" repo={repo} />
diff --git a/src/renderer/src/components/settings/SettingsSectionStack.tsx b/src/renderer/src/components/settings/SettingsSectionStack.tsx
new file mode 100644
index 00000000000..c243980eafa
--- /dev/null
+++ b/src/renderer/src/components/settings/SettingsSectionStack.tsx
@@ -0,0 +1,27 @@
+import type { ReactElement } from 'react'
+import { Separator } from '../ui/separator'
+
+// Why: settings panes rebuild their section list from the search query, so a pane-local
+// `key={index}` re-binds every key when an earlier section drops out. React then tears down
+// and remounts each surviving section, discarding its unsaved drafts and re-issuing its
+// loads once per keystroke. Keying by the section's own element key keeps a section that
+// stays matched mounted for the whole search.
+export function SettingsSectionStack({
+  sections,
+  spacing
+}: {
+  sections: readonly (ReactElement | null)[]
+  spacing: 'section' | 'group'
+}): ReactElement {
+  const visibleSections = sections.filter((section): section is ReactElement => section !== null)
+  return (
+    <>
+      {visibleSections.map((section, index) => (
+        <div key={section.key} className={spacing === 'group' ? 'space-y-8' : 'space-y-6'}>
+          {index > 0 ? <Separator /> : null}
+          {section}
+        </div>
+      ))}
+    </>
+  )
+}
diff --git a/src/renderer/src/components/settings/SourceControlActionRepoOverrideNote.test.tsx b/src/renderer/src/components/settings/SourceControlActionRepoOverrideNote.test.tsx
index 095cfc4b550..c0cc2549819 100644
--- a/src/renderer/src/components/settings/SourceControlActionRepoOverrideNote.test.tsx
+++ b/src/renderer/src/components/settings/SourceControlActionRepoOverrideNote.test.tsx
@@ -5,7 +5,7 @@ import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { TooltipProvider } from '../ui/tooltip'
 import { SourceControlActionRepoOverrideNote } from './SourceControlActionRepoOverrideNote'
-import type { SourceControlActionRecipeOverrideSummary } from '@/lib/source-control-launch-agent-selection'
+import type { SourceControlActionRecipeOverrideSummary } from '../../../../shared/source-control-launch-agent-selection'
 
 let container: HTMLDivElement
 let root: Root
diff --git a/src/renderer/src/components/settings/SourceControlActionRepoOverrideNote.tsx b/src/renderer/src/components/settings/SourceControlActionRepoOverrideNote.tsx
index 28fd8cbcdcf..6ec74d0ee35 100644
--- a/src/renderer/src/components/settings/SourceControlActionRepoOverrideNote.tsx
+++ b/src/renderer/src/components/settings/SourceControlActionRepoOverrideNote.tsx
@@ -5,7 +5,7 @@ import { Tooltip, TooltipContent, TooltipTrigger } from '../ui/tooltip'
 import type {
   SourceControlActionRecipeOverrideField,
   SourceControlActionRecipeOverrideSummary
-} from '@/lib/source-control-launch-agent-selection'
+} from '../../../../shared/source-control-launch-agent-selection'
 import { translate } from '@/i18n/i18n'
 
 type SourceControlActionRepoOverrideNoteProps = {
diff --git a/src/renderer/src/components/settings/SourceControlAiActionRecipeDefaults.tsx b/src/renderer/src/components/settings/SourceControlAiActionRecipeDefaults.tsx
index 9d00e6505cd..57f6787522a 100644
--- a/src/renderer/src/components/settings/SourceControlAiActionRecipeDefaults.tsx
+++ b/src/renderer/src/components/settings/SourceControlAiActionRecipeDefaults.tsx
@@ -21,7 +21,7 @@ import { useRepos } from '@/store/selectors'
 import {
   summarizeReposOverridingActionRecipe,
   type SourceControlActionRecipeOverrideSummary
-} from '@/lib/source-control-launch-agent-selection'
+} from '../../../../shared/source-control-launch-agent-selection'
 import { SearchableSetting } from './SearchableSetting'
 import { getRepositorySourceControlAiActionRecipeSectionId } from './repository-settings-targets'
 import { matchesSettingsSearch } from './settings-search'
diff --git a/src/renderer/src/components/settings/SparsePresetSettingsSection.test.tsx b/src/renderer/src/components/settings/SparsePresetSettingsSection.test.tsx
index 271f66d6570..8c4ba2e7c20 100644
--- a/src/renderer/src/components/settings/SparsePresetSettingsSection.test.tsx
+++ b/src/renderer/src/components/settings/SparsePresetSettingsSection.test.tsx
@@ -1,10 +1,14 @@
+// @vitest-environment happy-dom
+import { cleanup, fireEvent, render, screen } from '@testing-library/react'
 import { renderToStaticMarkup } from 'react-dom/server'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Repo } from '../../../../shared/repo-types'
 import type { SparsePreset } from '../../../../shared/worktree/create-types'
 import { SparsePresetSettingsSection } from './SparsePresetSettingsSection'
 
 const storeMock = vi.hoisted(() => ({
   state: {
+    repos: new Array<Repo>(),
     sparsePresetsByRepo: {} as Record<string, SparsePreset[]>,
     sparsePresetsLoadStatusByRepo: {} as Record<string, 'idle' | 'loading' | 'loaded' | 'error'>,
     sparsePresetsErrorByRepo: {} as Record<string, string | undefined>,
@@ -18,8 +22,11 @@ vi.mock('../../store', () => ({
   useAppStore: (selector: (state: typeof storeMock.state) => unknown) => selector(storeMock.state)
 }))
 
+afterEach(cleanup)
+
 describe('SparsePresetSettingsSection', () => {
   beforeEach(() => {
+    storeMock.state.repos = []
     storeMock.state.sparsePresetsByRepo = {}
     storeMock.state.sparsePresetsLoadStatusByRepo = {}
     storeMock.state.sparsePresetsErrorByRepo = {}
@@ -38,4 +45,36 @@ describe('SparsePresetSettingsSection', () => {
     expect(markup).toContain('disk failed')
     expect(markup).toContain('Sparse presets could not be loaded.')
   })
+
+  it('offers a load retry and prevents creating against an unknown preset list', () => {
+    storeMock.state.sparsePresetsLoadStatusByRepo = { 'repo-1': 'error' }
+    storeMock.state.sparsePresetsErrorByRepo = { 'repo-1': 'disk failed' }
+    storeMock.state.fetchSparsePresets.mockResolvedValue(undefined)
+    render(<SparsePresetSettingsSection repoId="repo-1" />)
+    expect(screen.getByRole('button', { name: 'New Preset' }).hasAttribute('disabled')).toBe(true)
+    fireEvent.click(screen.getByRole('button', { name: 'Retry loading presets' }))
+    expect(storeMock.state.fetchSparsePresets).toHaveBeenCalledWith('repo-1')
+  })
+
+  it('edits a preset in place and prevents replacing an unsaved draft', () => {
+    storeMock.state.sparsePresetsByRepo = {
+      'repo-1': ['Web', 'API'].map((name) => ({
+        id: name,
+        repoId: 'repo-1',
+        name,
+        directories: [`apps/${name}`],
+        createdAt: 0,
+        updatedAt: 0
+      }))
+    }
+    Element.prototype.scrollIntoView = vi.fn()
+    render(<SparsePresetSettingsSection repoId="repo-1" />)
+    fireEvent.click(screen.getByRole('button', { name: 'Edit Web' }))
+    expect(screen.queryByRole('button', { name: 'Edit Web' })).toBeNull()
+    expect(screen.getByRole('button', { name: 'Edit API' }).hasAttribute('disabled')).toBe(true)
+    expect(screen.getByRole('button', { name: 'Delete API' }).hasAttribute('disabled')).toBe(true)
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'My unsaved preset' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Edit API' }))
+    expect(screen.getByDisplayValue('My unsaved preset')).toBeTruthy()
+  })
 })
diff --git a/src/renderer/src/components/settings/SparsePresetSettingsSection.tsx b/src/renderer/src/components/settings/SparsePresetSettingsSection.tsx
index 4c641bb8125..137435411a7 100644
--- a/src/renderer/src/components/settings/SparsePresetSettingsSection.tsx
+++ b/src/renderer/src/components/settings/SparsePresetSettingsSection.tsx
@@ -1,8 +1,8 @@
-import { useEffect, useState } from 'react'
-import { Plus } from 'lucide-react'
+import { useEffect, useRef, useState } from 'react'
+import { Plus, RefreshCcw } from 'lucide-react'
 import type { SparsePreset } from '../../../../shared/worktree/create-types'
 import { useAppStore } from '../../store'
-import { parseSparsePresetDirectories } from '@/lib/sparse-preset-draft'
+import { parseSparsePresetDirectories, validateSparsePresetName } from '@/lib/sparse-preset-draft'
 import { useMountedRef } from '@/hooks/useMountedRef'
 import { Button } from '../ui/button'
 import { getSparsePresetOperationErrorMessage } from './sparse-preset-operation-error'
@@ -17,6 +17,7 @@ type SparsePresetSettingsSectionProps = {
 export function SparsePresetSettingsSection({
   repoId
 }: SparsePresetSettingsSectionProps): React.JSX.Element {
+  const repo = useAppStore((s) => s.repos.find((entry) => entry.id === repoId))
   const presets = useAppStore((s) => s.sparsePresetsByRepo[repoId])
   const loadStatus = useAppStore((s) => s.sparsePresetsLoadStatusByRepo[repoId] ?? 'idle')
   const loadError = useAppStore((s) => s.sparsePresetsErrorByRepo[repoId])
@@ -30,6 +31,31 @@ export function SparsePresetSettingsSection({
   const [deletingPresetId, setDeletingPresetId] = useState<string | null>(null)
   const [operationError, setOperationError] = useState<string | null>(null)
   const mountedRef = useMountedRef()
+  const sectionRef = useRef<HTMLElement | null>(null)
+  const returnPresetIdRef = useRef<string | null>(null)
+  const returnFocusRef = useRef<HTMLElement | null>(null)
+  const closeDraft = (): void => {
+    setDraft(null)
+    setOperationError(null)
+    requestAnimationFrame(() => {
+      if (!mountedRef.current) {
+        return
+      }
+      if (returnPresetIdRef.current) {
+        sectionRef.current
+          ?.querySelector<HTMLButtonElement>(
+            `[data-edit-preset="${CSS.escape(returnPresetIdRef.current)}"]`
+          )
+          ?.focus()
+      } else if (returnFocusRef.current?.isConnected) {
+        returnFocusRef.current.focus()
+      }
+    })
+  }
+  const rememberEditorTrigger = (): void => {
+    returnFocusRef.current =
+      document.activeElement instanceof HTMLElement ? document.activeElement : null
+  }
 
   useEffect(() => {
     if (presets === undefined && loadStatus === 'idle') {
@@ -46,29 +72,26 @@ export function SparsePresetSettingsSection({
   const sortedPresets = presets ?? []
   const parsedDirectories = draft ? parseSparsePresetDirectories(draft.directoriesText) : null
   const trimmedName = draft?.name.trim() ?? ''
-  const lowerName = trimmedName.toLowerCase()
-  const collidingPreset =
-    draft && trimmedName
-      ? (sortedPresets.find(
-          (preset) => preset.id !== draft.presetId && preset.name.toLowerCase() === lowerName
-        ) ?? null)
-      : null
-
-  const nameError =
-    draft && trimmedName.length === 0
-      ? 'Name is required.'
-      : trimmedName.length > 80
-        ? 'Name must be 80 characters or fewer.'
-        : collidingPreset
-          ? `"${collidingPreset.name}" already exists.`
-          : null
+  const nameError = draft
+    ? validateSparsePresetName(draft.name, sortedPresets, draft.presetId)
+    : null
   const canSaveDraft =
-    !!draft && !submitting && !nameError && parsedDirectories !== null && !parsedDirectories.error
-  const visibleError = operationError ?? loadError ?? null
+    !!draft &&
+    presets !== undefined &&
+    !submitting &&
+    !nameError &&
+    parsedDirectories !== null &&
+    !parsedDirectories.error
+  const visibleError = (draft ? null : operationError) ?? loadError ?? null
 
   const startNewPreset = (): void => {
+    if (draft || presets === undefined || deletingPresetId) {
+      return
+    }
+    rememberEditorTrigger()
     setConfirmingDeleteId(null)
     setOperationError(null)
+    returnPresetIdRef.current = null
     setDraft({
       mode: 'new',
       name: '',
@@ -77,8 +100,13 @@ export function SparsePresetSettingsSection({
   }
 
   const startEditPreset = (preset: SparsePreset): void => {
+    if (draft || presets === undefined || deletingPresetId) {
+      return
+    }
+    rememberEditorTrigger()
     setConfirmingDeleteId(null)
     setOperationError(null)
+    returnPresetIdRef.current = preset.id
     setDraft({
       mode: 'edit',
       presetId: preset.id,
@@ -101,7 +129,7 @@ export function SparsePresetSettingsSection({
         directories: parsedDirectories.directories
       })
       if (saved && mountedRef.current) {
-        setDraft(null)
+        closeDraft()
       } else if (mountedRef.current) {
         setOperationError(
           draft.mode === 'new' ? 'Failed to save preset.' : 'Failed to update preset.'
@@ -124,6 +152,9 @@ export function SparsePresetSettingsSection({
   }
 
   const handleDeletePreset = async (preset: SparsePreset): Promise<void> => {
+    if (draft || deletingPresetId) {
+      return
+    }
     if (confirmingDeleteId !== preset.id) {
       setConfirmingDeleteId(preset.id)
       return
@@ -135,9 +166,6 @@ export function SparsePresetSettingsSection({
       // state intact until persistence actually reports success.
       await removeSparsePreset({ repoId, presetId: preset.id })
       if (mountedRef.current) {
-        if (draft?.presetId === preset.id) {
-          setDraft(null)
-        }
         setConfirmingDeleteId(null)
       }
     } catch (error) {
@@ -152,8 +180,29 @@ export function SparsePresetSettingsSection({
     }
   }
 
+  const draftEditor = draft ? (
+    <SparsePresetDraftEditor
+      draft={draft}
+      operationError={operationError}
+      setDraft={(nextDraft) => {
+        if (nextDraft) {
+          setDraft(nextDraft)
+        } else {
+          closeDraft()
+        }
+      }}
+      nameError={nameError}
+      parsedDirectories={parsedDirectories}
+      canSaveDraft={canSaveDraft}
+      submitting={submitting}
+      onSave={() => void handleSaveDraft()}
+      repoRootPath={repo?.path}
+      repoConnectionId={repo?.connectionId ?? undefined}
+    />
+  ) : null
+
   return (
-    <section className="space-y-4">
+    <section ref={sectionRef} className="space-y-4">
       <div className="flex items-start justify-between gap-4">
         <div className="space-y-1">
           <h3 className="text-sm font-semibold">
@@ -174,7 +223,7 @@ export function SparsePresetSettingsSection({
           variant="outline"
           size="sm"
           onClick={startNewPreset}
-          disabled={!!draft}
+          disabled={!!draft || presets === undefined || deletingPresetId !== null}
         >
           <Plus className="size-3.5" />
           {translate(
@@ -193,17 +242,7 @@ export function SparsePresetSettingsSection({
         </div>
       ) : null}
 
-      {draft ? (
-        <SparsePresetDraftEditor
-          draft={draft}
-          setDraft={setDraft}
-          nameError={nameError}
-          parsedDirectories={parsedDirectories}
-          canSaveDraft={canSaveDraft}
-          submitting={submitting}
-          onSave={() => void handleSaveDraft()}
-        />
-      ) : null}
+      {draft?.mode === 'new' ? draftEditor : null}
 
       {presets === undefined ? (
         <div className="rounded-xl border border-dashed border-border/60 bg-background/60 px-4 py-6 text-sm text-muted-foreground">
@@ -216,6 +255,32 @@ export function SparsePresetSettingsSection({
                 'auto.components.settings.SparsePresetSettingsSection.8deb7024ab',
                 'Loading sparse presets...'
               )}
+          {loadError ? (
+            <div className="mt-3">
+              <Button
+                type="button"
+                variant="outline"
+                size="sm"
+                disabled={loadStatus === 'loading'}
+                onClick={() => {
+                  setOperationError(null)
+                  void fetchSparsePresets(repoId).catch((error: unknown) => {
+                    if (mountedRef.current) {
+                      setOperationError(
+                        getSparsePresetOperationErrorMessage(
+                          error,
+                          'Failed to load sparse presets.'
+                        )
+                      )
+                    }
+                  })
+                }}
+              >
+                <RefreshCcw />
+                {translate('sparsePreset.retryLoad', 'Retry loading presets')}
+              </Button>
+            </div>
+          ) : null}
         </div>
       ) : sortedPresets.length === 0 && !draft ? (
         <div className="rounded-xl border border-dashed border-border/60 bg-background/60 px-4 py-6 text-sm text-muted-foreground">
@@ -226,18 +291,22 @@ export function SparsePresetSettingsSection({
         </div>
       ) : (
         <div className="space-y-2">
-          {sortedPresets.map((preset) => (
-            <SparsePresetSettingsRow
-              key={preset.id}
-              preset={preset}
-              confirmingDeleteId={confirmingDeleteId}
-              deletingPresetId={deletingPresetId}
-              submitting={submitting}
-              onEdit={startEditPreset}
-              onDelete={handleDeletePreset}
-              onClearDeleteConfirm={() => setConfirmingDeleteId(null)}
-            />
-          ))}
+          {sortedPresets.map((preset) =>
+            draft?.presetId === preset.id ? (
+              <div key={preset.id}>{draftEditor}</div>
+            ) : (
+              <SparsePresetSettingsRow
+                key={preset.id}
+                preset={preset}
+                confirmingDeleteId={confirmingDeleteId}
+                deletingPresetId={deletingPresetId}
+                submitting={submitting || !!draft}
+                onEdit={startEditPreset}
+                onDelete={handleDeletePreset}
+                onClearDeleteConfirm={() => setConfirmingDeleteId(null)}
+              />
+            )
+          )}
         </div>
       )}
     </section>
diff --git a/src/renderer/src/components/settings/SshPassphraseDialog.tsx b/src/renderer/src/components/settings/SshPassphraseDialog.tsx
index 7f9e2ff61c3..922e795fe28 100644
--- a/src/renderer/src/components/settings/SshPassphraseDialog.tsx
+++ b/src/renderer/src/components/settings/SshPassphraseDialog.tsx
@@ -61,7 +61,10 @@ export function SshPassphraseDialog(): React.JSX.Element | null {
   )
 
   const handleSubmit = useCallback(async () => {
-    if (!request || !value) {
+    // Why: keyboard-interactive servers may accept an empty response (e.g.
+    // plain Enter to trigger a default MFA push); passwords and passphrases
+    // are never empty.
+    if (!request || (!value && request.kind !== 'keyboard-interactive')) {
       return
     }
     setSubmitting(true)
@@ -186,7 +189,7 @@ export function SshPassphraseDialog(): React.JSX.Element | null {
           <Input
             id="ssh-credential-input"
             ref={setInputRef}
-            type="password"
+            type={isKeyboardInteractive && request.echo ? 'text' : 'password'}
             value={value}
             onChange={(e) => setValue(e.target.value)}
             onKeyDown={(e) => {
@@ -224,7 +227,11 @@ export function SshPassphraseDialog(): React.JSX.Element | null {
           >
             {translate('auto.components.settings.SshPassphraseDialog.d5a234456f', 'Cancel')}
           </Button>
-          <Button size="sm" onClick={() => void handleSubmit()} disabled={!value || submitting}>
+          <Button
+            size="sm"
+            onClick={() => void handleSubmit()}
+            disabled={(!value && !isKeyboardInteractive) || submitting}
+          >
             {isKeyboardInteractive
               ? translate('auto.components.settings.SshPassphraseDialog.c624f64b86', 'Continue')
               : isPassword
diff --git a/src/renderer/src/components/settings/accounts-search.ts b/src/renderer/src/components/settings/accounts-search.ts
index 856e22213ca..60fa795caa9 100644
--- a/src/renderer/src/components/settings/accounts-search.ts
+++ b/src/renderer/src/components/settings/accounts-search.ts
@@ -217,6 +217,38 @@ export const getAccountsGrokSearchEntries = createLocalizedCatalog(() => [
   }
 ])
 
+export const getAccountsCursorSearchEntries = createLocalizedCatalog(() => [
+  {
+    title: translate('auto.components.settings.accounts.search.cursor.title', 'Cursor Usage'),
+    description: translate(
+      'auto.components.settings.accounts.search.cursor.description',
+      'Monthly plan usage read from the Cursor sign-in already on this computer (cursor-agent login).'
+    ),
+    keywords: [
+      ...translateSearchKeyword(
+        'auto.components.settings.accounts.search.cursor.kw.cursor',
+        'cursor'
+      ),
+      ...translateSearchKeyword(
+        'auto.components.settings.accounts.search.cursor.kw.usage',
+        'usage'
+      ),
+      ...translateSearchKeyword(
+        'auto.components.settings.accounts.search.cursor.kw.spend',
+        'spend'
+      ),
+      ...translateSearchKeyword(
+        'auto.components.settings.accounts.search.cursor.kw.rateLimit',
+        'rate limit'
+      ),
+      ...translateSearchKeyword(
+        'auto.components.settings.accounts.search.cursor.kw.statusBar',
+        'status bar'
+      )
+    ]
+  }
+])
+
 export const getAccountsPaneSearchEntries = createLocalizedCatalog((): SettingsSearchEntry[] => [
   ...getAccountsLocationSearchEntries(),
   ...getAccountsClaudeSearchEntries(),
@@ -224,5 +256,6 @@ export const getAccountsPaneSearchEntries = createLocalizedCatalog((): SettingsS
   ...getAccountsGeminiSearchEntries(),
   ...getAccountsOpencodeSearchEntries(),
   ...getAccountsMiniMaxSearchEntries(),
-  ...getAccountsGrokSearchEntries()
+  ...getAccountsGrokSearchEntries(),
+  ...getAccountsCursorSearchEntries()
 ])
diff --git a/src/renderer/src/components/settings/agent-workspace-trust-copy.ts b/src/renderer/src/components/settings/agent-workspace-trust-copy.ts
new file mode 100644
index 00000000000..b01b669cf25
--- /dev/null
+++ b/src/renderer/src/components/settings/agent-workspace-trust-copy.ts
@@ -0,0 +1,37 @@
+import { translate } from '@/i18n/i18n'
+import { searchKeywords } from './settings-search-keywords'
+
+export function getAgentWorkspaceTrustTitle(): string {
+  return translate(
+    'auto.components.settings.agent-workspace-trust-copy.title',
+    'Trust the folder when Orca starts an agent'
+  )
+}
+
+export function getAgentWorkspaceTrustDescription(): string {
+  return translate(
+    'auto.components.settings.agent-workspace-trust-copy.description',
+    'Agents Orca starts skip their "Do you trust this folder?" prompt, so the project\'s agent hooks and settings run right away. Without this, each agent asks the first time it runs in a folder. Agents running without you watching, such as orchestration workers, automations and agents started from your phone, will wait at that question until you answer it in their terminal. Folders already trusted stay trusted.'
+  )
+}
+
+export function getAgentWorkspaceTrustSearchKeywords(): string[] {
+  return searchKeywords([
+    { key: 'auto.components.settings.agents.search.agent-trust-trust', fallback: 'trust' },
+    { key: 'auto.components.settings.agents.search.agent-trust-folder', fallback: 'folder' },
+    { key: 'auto.components.settings.agents.search.agent-trust-worktree', fallback: 'worktree' },
+    { key: 'auto.components.settings.agents.search.c64059f50d', fallback: 'prompt' },
+    { key: 'auto.components.settings.agents.search.0d752916f8', fallback: 'hooks' },
+    { key: 'auto.components.settings.agents.search.96ba2373b6', fallback: 'agent' },
+    {
+      key: 'auto.components.settings.agents.search.f412abbba5',
+      fallback: 'claude',
+      englishOnly: true
+    },
+    {
+      key: 'auto.components.settings.agents.search.5ded38b843',
+      fallback: 'codex',
+      englishOnly: true
+    }
+  ])
+}
diff --git a/src/renderer/src/components/settings/agents-search.ts b/src/renderer/src/components/settings/agents-search.ts
index ed353d5acbf..9be62273d1e 100644
--- a/src/renderer/src/components/settings/agents-search.ts
+++ b/src/renderer/src/components/settings/agents-search.ts
@@ -14,6 +14,11 @@ import {
   getAgentStatusHooksSearchKeywords,
   getAgentStatusHooksTitle
 } from './agent-status-hooks-copy'
+import {
+  getAgentWorkspaceTrustDescription,
+  getAgentWorkspaceTrustSearchKeywords,
+  getAgentWorkspaceTrustTitle
+} from './agent-workspace-trust-copy'
 import { getAgentCacheTimerSearchEntries } from './agent-cache-timer-search'
 import { translate } from '@/i18n/i18n'
 import { searchKeywords, translateSearchKeyword, uniqueKeywords } from './settings-search-keywords'
@@ -62,9 +67,11 @@ function expandAgentSearchText(value: string): string[] {
 type AgentsPaneSearchOptions = {
   includeAgentAwake?: boolean
   includeAgentRuntime?: boolean
+  includeAgentWorkspaceTrust?: boolean
 }
 
 const AGENT_AWAKE_SEARCH_ENTRY_ID = 'agent-awake'
+const AGENT_WORKSPACE_TRUST_SEARCH_ENTRY_ID = 'agent-workspace-trust'
 const AGENT_RUNTIME_SEARCH_ENTRY_ID = 'agent-runtime'
 
 const getAllAgentsPaneSearchEntries = createLocalizedCatalog(() => [
@@ -108,6 +115,12 @@ const getAllAgentsPaneSearchEntries = createLocalizedCatalog(() => [
     description: getAgentStatusHooksDescription(),
     keywords: getAgentStatusHooksSearchKeywords()
   },
+  {
+    title: getAgentWorkspaceTrustTitle(),
+    id: AGENT_WORKSPACE_TRUST_SEARCH_ENTRY_ID,
+    description: getAgentWorkspaceTrustDescription(),
+    keywords: getAgentWorkspaceTrustSearchKeywords()
+  },
   {
     title: getAgentGeneratedTabTitlesTitle(),
     description: getAgentGeneratedTabTitlesDescription(),
@@ -145,12 +158,16 @@ const getAllAgentsPaneSearchEntries = createLocalizedCatalog(() => [
 
 export function getAgentsPaneSearchEntries({
   includeAgentAwake = true,
-  includeAgentRuntime = true
+  includeAgentRuntime = true,
+  includeAgentWorkspaceTrust = true
 }: AgentsPaneSearchOptions = {}) {
   const entries = getAllAgentsPaneSearchEntries()
   return entries.filter(
     (entry) =>
       (!('id' in entry) || entry.id !== AGENT_RUNTIME_SEARCH_ENTRY_ID || includeAgentRuntime) &&
-      (!('id' in entry) || entry.id !== AGENT_AWAKE_SEARCH_ENTRY_ID || includeAgentAwake)
+      (!('id' in entry) || entry.id !== AGENT_AWAKE_SEARCH_ENTRY_ID || includeAgentAwake) &&
+      (!('id' in entry) ||
+        entry.id !== AGENT_WORKSPACE_TRUST_SEARCH_ENTRY_ID ||
+        includeAgentWorkspaceTrust)
   )
 }
diff --git a/src/renderer/src/components/settings/appearance-status-bar-cursor-toggle-search.ts b/src/renderer/src/components/settings/appearance-status-bar-cursor-toggle-search.ts
new file mode 100644
index 00000000000..efff55c67f6
--- /dev/null
+++ b/src/renderer/src/components/settings/appearance-status-bar-cursor-toggle-search.ts
@@ -0,0 +1,39 @@
+import type { StatusBarItem } from '../../../../shared/ui-chrome-types'
+import { translate } from '@/i18n/i18n'
+import { translateSearchKeyword } from './settings-search-keywords'
+
+export function getCursorStatusBarToggleSearchEntry(): {
+  id: StatusBarItem
+  title: string
+  description: string
+  keywords: string[]
+  toggleDescription: string
+} {
+  return {
+    id: 'cursor',
+    title: translate('auto.components.settings.appearance.search.cursor.title', 'Cursor Usage'),
+    description: translate(
+      'auto.components.settings.appearance.search.cursor.description',
+      'Show monthly Cursor plan usage from the Cursor sign-in on this computer.'
+    ),
+    keywords: [
+      ...translateSearchKeyword(
+        'auto.components.settings.appearance.search.896eb53fd4',
+        'status bar'
+      ),
+      ...translateSearchKeyword(
+        'auto.components.settings.appearance.search.cursor.kw.cursor',
+        'cursor'
+      ),
+      ...translateSearchKeyword('auto.components.settings.appearance.search.00a028f25f', 'usage'),
+      ...translateSearchKeyword(
+        'auto.components.settings.appearance.search.de586def95',
+        'subscription'
+      )
+    ],
+    toggleDescription: translate(
+      'settings.appearance.statusBar.cursorToggleDescription',
+      'Show Cursor plan usage when signed in through cursor-agent or Cursor IDE.'
+    )
+  }
+}
diff --git a/src/renderer/src/components/settings/appearance-status-bar-minimax-toggle-search.ts b/src/renderer/src/components/settings/appearance-status-bar-minimax-toggle-search.ts
new file mode 100644
index 00000000000..4b514acd2eb
--- /dev/null
+++ b/src/renderer/src/components/settings/appearance-status-bar-minimax-toggle-search.ts
@@ -0,0 +1,41 @@
+import type { StatusBarItem } from '../../../../shared/ui-chrome-types'
+import { translate } from '@/i18n/i18n'
+import { translateSearchKeyword } from './settings-search-keywords'
+
+export function getMiniMaxStatusBarToggleSearchEntry(): {
+  id: StatusBarItem
+  title: string
+  description: string
+  keywords: string[]
+  toggleDescription: string
+} {
+  return {
+    id: 'minimax',
+    title: translate('auto.components.settings.appearance.search.0f08f6b483', 'MiniMax Usage'),
+    description: translate(
+      'auto.components.settings.appearance.search.e46178eb1b',
+      'Show MiniMax subscription usage in the status bar.'
+    ),
+    keywords: [
+      ...translateSearchKeyword(
+        'auto.components.settings.appearance.search.896eb53fd4',
+        'status bar'
+      ),
+      ...translateSearchKeyword('auto.components.settings.appearance.search.d16378a88f', 'minimax'),
+      ...translateSearchKeyword('auto.components.settings.appearance.search.00a028f25f', 'usage'),
+      ...translateSearchKeyword(
+        'auto.components.settings.appearance.search.de586def95',
+        'subscription'
+      ),
+      ...translateSearchKeyword('auto.components.settings.appearance.search.d9e7cef86f', 'cookie'),
+      ...translateSearchKeyword(
+        'auto.components.settings.appearance.search.25e51b62ee',
+        'rate limit'
+      )
+    ],
+    toggleDescription: translate(
+      'settings.appearance.statusBar.minimaxToggleDescription',
+      'Show MiniMax subscription usage for the active workspace.'
+    )
+  }
+}
diff --git a/src/renderer/src/components/settings/appearance-status-bar-search.test.ts b/src/renderer/src/components/settings/appearance-status-bar-search.test.ts
index 3518bcba8aa..bc8596d564d 100644
--- a/src/renderer/src/components/settings/appearance-status-bar-search.test.ts
+++ b/src/renderer/src/components/settings/appearance-status-bar-search.test.ts
@@ -31,6 +31,16 @@ describe('getStatusBarToggles', () => {
     )
   })
 
+  it('includes ZCode quota in Appearance search', () => {
+    const toggle = getStatusBarToggles().find((entry) => entry.id === 'zcode')
+
+    expect(toggle).toMatchObject({
+      title: 'ZCode Usage',
+      toggleDescription: 'Show ZCode Coding Plan quota usage.'
+    })
+    expect(toggle?.keywords).toEqual(expect.arrayContaining(['zcode', 'zai', 'glm']))
+  })
+
   it('includes MiniMax usage so Appearance can toggle the default-on status item', () => {
     const miniMaxToggle = getStatusBarToggles().find((entry) => entry.id === 'minimax')
 
diff --git a/src/renderer/src/components/settings/appearance-status-bar-search.ts b/src/renderer/src/components/settings/appearance-status-bar-search.ts
index 9be73da6a91..16749f4ab31 100644
--- a/src/renderer/src/components/settings/appearance-status-bar-search.ts
+++ b/src/renderer/src/components/settings/appearance-status-bar-search.ts
@@ -3,7 +3,10 @@ import { createLocalizedCatalog } from '@/i18n/localized-catalog'
 import { translate } from '@/i18n/i18n'
 import { translateSearchKeyword } from './settings-search-keywords'
 import { getAntigravityStatusBarToggleSearchEntry } from './appearance-status-bar-antigravity-toggle-search'
+import { getMiniMaxStatusBarToggleSearchEntry } from './appearance-status-bar-minimax-toggle-search'
 import { getGrokStatusBarToggleSearchEntry } from './appearance-status-bar-grok-toggle-search'
+import { getCursorStatusBarToggleSearchEntry } from './appearance-status-bar-cursor-toggle-search'
+import { getZcodeStatusBarToggleSearchEntry } from './appearance-status-bar-zcode-toggle-search'
 
 export const getStatusBarToggles = createLocalizedCatalog(
   (): readonly {
@@ -164,42 +167,10 @@ export const getStatusBarToggles = createLocalizedCatalog(
         'Show Kimi subscription usage for the active workspace.'
       )
     },
-    {
-      id: 'minimax',
-      title: translate('auto.components.settings.appearance.search.0f08f6b483', 'MiniMax Usage'),
-      description: translate(
-        'auto.components.settings.appearance.search.e46178eb1b',
-        'Show MiniMax subscription usage in the status bar.'
-      ),
-      keywords: [
-        ...translateSearchKeyword(
-          'auto.components.settings.appearance.search.896eb53fd4',
-          'status bar'
-        ),
-        ...translateSearchKeyword(
-          'auto.components.settings.appearance.search.d16378a88f',
-          'minimax'
-        ),
-        ...translateSearchKeyword('auto.components.settings.appearance.search.00a028f25f', 'usage'),
-        ...translateSearchKeyword(
-          'auto.components.settings.appearance.search.de586def95',
-          'subscription'
-        ),
-        ...translateSearchKeyword(
-          'auto.components.settings.appearance.search.d9e7cef86f',
-          'cookie'
-        ),
-        ...translateSearchKeyword(
-          'auto.components.settings.appearance.search.25e51b62ee',
-          'rate limit'
-        )
-      ],
-      toggleDescription: translate(
-        'settings.appearance.statusBar.minimaxToggleDescription',
-        'Show MiniMax subscription usage for the active workspace.'
-      )
-    },
+    getMiniMaxStatusBarToggleSearchEntry(),
     getGrokStatusBarToggleSearchEntry(),
+    getCursorStatusBarToggleSearchEntry(),
+    getZcodeStatusBarToggleSearchEntry(),
     {
       id: 'ssh',
       title: translate('auto.components.settings.appearance.search.57fb424c56', 'Remote Hosts'),
diff --git a/src/renderer/src/components/settings/appearance-status-bar-zcode-toggle-search.ts b/src/renderer/src/components/settings/appearance-status-bar-zcode-toggle-search.ts
new file mode 100644
index 00000000000..1d618a65dc3
--- /dev/null
+++ b/src/renderer/src/components/settings/appearance-status-bar-zcode-toggle-search.ts
@@ -0,0 +1,34 @@
+import type { StatusBarItem } from '../../../../shared/ui-chrome-types'
+import { translate } from '@/i18n/i18n'
+import { translateSearchKeyword } from './settings-search-keywords'
+
+export function getZcodeStatusBarToggleSearchEntry(): {
+  id: StatusBarItem
+  title: string
+  description: string
+  keywords: string[]
+  toggleDescription: string
+} {
+  return {
+    id: 'zcode',
+    title: translate('auto.components.settings.appearance.search.zcodeUsageTitle', 'ZCode Usage'),
+    description: translate(
+      'auto.components.settings.appearance.search.zcodeUsageDescription',
+      'Show ZCode Coding Plan quota usage in the status bar.'
+    ),
+    keywords: [
+      ...translateSearchKeyword(
+        'auto.components.settings.appearance.search.896eb53fd4',
+        'status bar'
+      ),
+      ...translateSearchKeyword('auto.components.settings.appearance.search.zcode', 'zcode'),
+      ...translateSearchKeyword('auto.components.settings.appearance.search.00a028f25f', 'usage'),
+      ...translateSearchKeyword('auto.components.settings.appearance.search.zai', 'zai'),
+      ...translateSearchKeyword('auto.components.settings.appearance.search.glm', 'glm')
+    ],
+    toggleDescription: translate(
+      'settings.appearance.statusBar.zcodeToggleDescription',
+      'Show ZCode Coding Plan quota usage.'
+    )
+  }
+}
diff --git a/src/renderer/src/components/settings/sparse-preset-draft-editor.tsx b/src/renderer/src/components/settings/sparse-preset-draft-editor.tsx
index 6813fc0c3d0..66e0c0b3a5b 100644
--- a/src/renderer/src/components/settings/sparse-preset-draft-editor.tsx
+++ b/src/renderer/src/components/settings/sparse-preset-draft-editor.tsx
@@ -1,16 +1,7 @@
-import { LoaderCircle, Save, X } from 'lucide-react'
 import type { SparsePresetDirectoryParseResult } from '@/lib/sparse-preset-draft'
-import { Button } from '../ui/button'
-import { Input } from '../ui/input'
-import { Label } from '../ui/label'
-import { translate } from '@/i18n/i18n'
-
-export type SparsePresetDraft = {
-  mode: 'new' | 'edit'
-  presetId?: string
-  name: string
-  directoriesText: string
-}
+import { SparsePresetInlineEditor } from '../sparse/SparsePresetInlineEditor'
+import type { SparsePresetDraft } from '../sparse/SparseCheckoutPresetDraftForm'
+export type { SparsePresetDraft } from '../sparse/SparseCheckoutPresetDraftForm'
 
 type SparsePresetDraftEditorProps = {
   draft: SparsePresetDraft
@@ -20,139 +11,22 @@ type SparsePresetDraftEditorProps = {
   canSaveDraft: boolean
   submitting: boolean
   onSave: () => void
+  operationError?: string | null
+  repoRootPath?: string
+  repoConnectionId?: string
 }
 
 export function SparsePresetDraftEditor({
-  draft,
   setDraft,
-  nameError,
-  parsedDirectories,
   canSaveDraft,
-  submitting,
-  onSave
+  ...props
 }: SparsePresetDraftEditorProps): React.JSX.Element {
   return (
-    <div className="rounded-xl border border-border/60 bg-background/80 p-4 shadow-sm">
-      <div className="mb-3 flex items-center justify-between gap-3">
-        <div className="space-y-0.5">
-          <h5 className="text-sm font-semibold">
-            {draft.mode === 'new'
-              ? translate(
-                  'auto.components.settings.SparsePresetSettingsSection.d7565029a9',
-                  'New Preset'
-                )
-              : translate(
-                  'auto.components.settings.SparsePresetSettingsSection.623b4cf910',
-                  'Edit Preset'
-                )}
-          </h5>
-          <p className="text-xs text-muted-foreground">
-            {translate(
-              'auto.components.settings.SparsePresetSettingsSection.694cc55ecb',
-              'Saved directories are used when creating sparse worktrees for this repository.'
-            )}
-          </p>
-        </div>
-        <Button
-          type="button"
-          variant="ghost"
-          size="icon-xs"
-          aria-label={translate(
-            'auto.components.settings.SparsePresetSettingsSection.b9922ec194',
-            'Cancel preset edit'
-          )}
-          onClick={() => setDraft(null)}
-          disabled={submitting}
-        >
-          <X className="size-3.5" />
-        </Button>
-      </div>
-
-      <div className="grid gap-4 md:grid-cols-[minmax(0,0.8fr)_minmax(0,1.2fr)]">
-        <div className="space-y-2">
-          <Label htmlFor="sparse-preset-settings-name">
-            {translate('auto.components.settings.SparsePresetSettingsSection.a6fcdd9e3c', 'Name')}
-          </Label>
-          <Input
-            id="sparse-preset-settings-name"
-            value={draft.name}
-            onChange={(event) => setDraft({ ...draft, name: event.target.value })}
-            placeholder={translate(
-              'auto.components.settings.SparsePresetSettingsSection.3b6f1abd3e',
-              'e.g. web-only'
-            )}
-            maxLength={80}
-            autoComplete="off"
-            spellCheck={false}
-            className="h-9 text-sm"
-          />
-          {nameError ? <p className="text-xs text-destructive">{nameError}</p> : null}
-        </div>
-
-        <div className="space-y-2">
-          <Label htmlFor="sparse-preset-settings-directories">
-            {translate(
-              'auto.components.settings.SparsePresetSettingsSection.caf33029cc',
-              'Directories'
-            )}
-          </Label>
-          <textarea
-            id="sparse-preset-settings-directories"
-            value={draft.directoriesText}
-            onChange={(event) => setDraft({ ...draft, directoriesText: event.target.value })}
-            placeholder={translate(
-              'auto.components.settings.SparsePresetSettingsSection.fde7ff2cc3',
-              'packages/web shared/ui'
-            )}
-            rows={5}
-            spellCheck={false}
-            className="w-full min-w-0 resize-y rounded-md border border-input bg-transparent px-3 py-2 font-mono text-xs shadow-xs outline-none transition-[color,box-shadow] placeholder:text-muted-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50"
-          />
-          {parsedDirectories?.error ? (
-            <p className="text-xs text-destructive">{parsedDirectories.error}</p>
-          ) : (
-            <p className="text-xs text-muted-foreground">
-              {parsedDirectories?.directories.length === 1
-                ? translate(
-                    'auto.components.settings.SparsePresetSettingsSection.b532b9c17d',
-                    '1 directory will be saved.'
-                  )
-                : translate(
-                    'auto.components.settings.SparsePresetSettingsSection.3dfa765ca7',
-                    '{{value0}} directories will be saved.',
-                    { value0: parsedDirectories?.directories.length ?? 0 }
-                  )}{' '}
-              {translate(
-                'auto.components.settings.SparsePresetSettingsSection.c240a16f25',
-                'Use repo-relative paths like packages/web or apps/api.'
-              )}
-            </p>
-          )}
-        </div>
-      </div>
-
-      <div className="mt-4 flex justify-end gap-2">
-        <Button
-          type="button"
-          variant="ghost"
-          size="sm"
-          onClick={() => setDraft(null)}
-          disabled={submitting}
-        >
-          {translate('auto.components.settings.SparsePresetSettingsSection.2d7d45e991', 'Cancel')}
-        </Button>
-        <Button type="button" size="sm" onClick={onSave} disabled={!canSaveDraft}>
-          {submitting ? (
-            <LoaderCircle className="size-3.5 animate-spin" />
-          ) : (
-            <Save className="size-3.5" />
-          )}
-          {translate(
-            'auto.components.settings.SparsePresetSettingsSection.a05bc9183f',
-            'Save Preset'
-          )}
-        </Button>
-      </div>
-    </div>
+    <SparsePresetInlineEditor
+      {...props}
+      onDraftChange={setDraft}
+      canSave={canSaveDraft}
+      onCancel={() => setDraft(null)}
+    />
   )
 }
diff --git a/src/renderer/src/components/settings/sparse-preset-settings-row.tsx b/src/renderer/src/components/settings/sparse-preset-settings-row.tsx
index 3c0fa0c4a0c..4b796590768 100644
--- a/src/renderer/src/components/settings/sparse-preset-settings-row.tsx
+++ b/src/renderer/src/components/settings/sparse-preset-settings-row.tsx
@@ -76,6 +76,7 @@ export function SparsePresetSettingsRow({
               'Edit {{value0}}',
               { value0: preset.name }
             )}
+            data-edit-preset={preset.id}
             onClick={() => onEdit(preset)}
             disabled={submitting || deletingPresetId !== null}
           >
diff --git a/src/renderer/src/components/settings/worktree-symlink-path-filter.scan-budget.test.ts b/src/renderer/src/components/settings/worktree-symlink-path-filter.scan-budget.test.ts
new file mode 100644
index 00000000000..cde893fca59
--- /dev/null
+++ b/src/renderer/src/components/settings/worktree-symlink-path-filter.scan-budget.test.ts
@@ -0,0 +1,115 @@
+import { expect, it } from 'vitest'
+import {
+  getWorktreeSymlinkPathFilterState,
+  WORKTREE_SYMLINK_PATH_MAX_SUGGESTIONS
+} from './worktree-symlink-path-filter'
+
+it.each([100, 1_000, 50_000])('bounds matching name reads across %i entries', (size) => {
+  let nameReads = 0
+  const suggestions = Array.from({ length: size }, (_, index) => ({
+    get name() {
+      nameReads++
+      return `package-${index}`
+    },
+    isDirectory: true
+  }))
+  const result = getWorktreeSymlinkPathFilterState({
+    query: 'package',
+    suggestions,
+    existingPaths: []
+  })
+  expect(result.filtered).toHaveLength(WORKTREE_SYMLINK_PATH_MAX_SUGGESTIONS)
+  expect(nameReads).toBe(WORKTREE_SYMLINK_PATH_MAX_SUGGESTIONS * 2)
+  expect(result.filtered[0]).toBe(suggestions[0])
+  expect(result.filtered.at(-1)).toBe(suggestions[49])
+  expect(result.showLiteralItem).toBe(true)
+})
+
+it('keeps the stock filter and slice results, identities and literal choice', () => {
+  const suggestions = Array.from({ length: 120 }, (_, index) => ({
+    name: index % 3 === 0 ? `PACKAGE-${index}` : `other-${index}`,
+    isDirectory: index % 2 === 0
+  }))
+  const limits = [0, 1, 5, 50, 500, -1, -5, 2.8, Number.NaN, Infinity, -Infinity]
+  for (const query of ['', '  /package ', 'OTHER', 'PACKAGE-3', 'missing']) {
+    const queryTrimmed = query.trim().replace(/^\/+/, '')
+    const normalizedQuery = queryTrimmed.toLowerCase()
+    for (const maxSuggestions of limits) {
+      const filtered = (
+        normalizedQuery
+          ? suggestions.filter((entry) => entry.name.toLowerCase().includes(normalizedQuery))
+          : suggestions
+      ).slice(0, maxSuggestions)
+      const result = getWorktreeSymlinkPathFilterState({
+        query,
+        suggestions,
+        existingPaths: ['missing'],
+        maxSuggestions
+      })
+      expect(result).toEqual({
+        queryTrimmed,
+        filtered,
+        showLiteralItem:
+          queryTrimmed.length > 0 &&
+          !filtered.some((entry) => entry.name === queryTrimmed) &&
+          queryTrimmed !== 'missing',
+        isQueryTooLarge: false
+      })
+      expect(result.filtered.every((entry, index) => entry === filtered[index])).toBe(true)
+    }
+  }
+})
+
+it('searches past nonmatches and preserves sparse-array filtering', () => {
+  const suggestions = Array.from({ length: 1_000 }, (_, index) => ({
+    name: index % 30 === 0 ? `target-${index}` : `other-${index}`,
+    isDirectory: true
+  }))
+  delete suggestions[0]
+  const result = getWorktreeSymlinkPathFilterState({
+    query: 'target',
+    suggestions,
+    existingPaths: [],
+    maxSuggestions: 5
+  })
+  expect(result.filtered).toEqual(
+    suggestions.filter((entry) => entry.name.includes('target')).slice(0, 5)
+  )
+  expect(result.filtered.map((entry) => entry.name)).toEqual([
+    'target-30',
+    'target-60',
+    'target-90',
+    'target-120',
+    'target-150'
+  ])
+})
+
+it('does not inspect names when no suggestions can be returned', () => {
+  const result = getWorktreeSymlinkPathFilterState({
+    query: 'target',
+    suggestions: [
+      {
+        get name(): string {
+          throw new Error('a zero result budget must not inspect names')
+        },
+        isDirectory: true
+      }
+    ],
+    existingPaths: [],
+    maxSuggestions: 0
+  })
+  expect(result.filtered).toEqual([])
+  expect(result.showLiteralItem).toBe(true)
+})
+
+it('retains the literal choice when an exact match falls after the visible limit', () => {
+  const suggestions = Array.from({ length: 50 }, (_, index) => ({
+    name: `target-${index}`,
+    isDirectory: true
+  }))
+  suggestions.push({ name: 'target', isDirectory: true })
+  expect(
+    getWorktreeSymlinkPathFilterState({ query: 'target', suggestions, existingPaths: [] })
+      .showLiteralItem
+  ).toBe(true)
+})
diff --git a/src/renderer/src/components/settings/worktree-symlink-path-filter.ts b/src/renderer/src/components/settings/worktree-symlink-path-filter.ts
index 1dc8d393d8d..f50a2f99cd1 100644
--- a/src/renderer/src/components/settings/worktree-symlink-path-filter.ts
+++ b/src/renderer/src/components/settings/worktree-symlink-path-filter.ts
@@ -44,11 +44,26 @@ export function getWorktreeSymlinkPathFilterState<T extends WorktreeSymlinkPathS
   }
 
   const normalizedQuery = queryTrimmed.toLowerCase()
-  const filtered = (
-    normalizedQuery
-      ? suggestions.filter((entry) => entry.name.toLowerCase().includes(normalizedQuery))
-      : suggestions
-  ).slice(0, maxSuggestions)
+  let filtered: T[]
+  if (normalizedQuery && Number.isInteger(maxSuggestions) && maxSuggestions >= 0) {
+    filtered = []
+    for (let index = 0; index < suggestions.length && filtered.length < maxSuggestions; index++) {
+      if (!(index in suggestions)) {
+        continue
+      }
+      const entry = suggestions[index]
+      if (entry.name.toLowerCase().includes(normalizedQuery)) {
+        filtered.push(entry)
+      }
+    }
+  } else {
+    // Preserve slice semantics for empty queries and unusual caller-supplied limits.
+    filtered = (
+      normalizedQuery
+        ? suggestions.filter((entry) => entry.name.toLowerCase().includes(normalizedQuery))
+        : suggestions
+    ).slice(0, maxSuggestions)
+  }
   const hasExactMatch = filtered.some((entry) => entry.name === queryTrimmed)
 
   return {
diff --git a/src/renderer/src/components/sidebar/CommentMermaidBlock.system-theme.test.tsx b/src/renderer/src/components/sidebar/CommentMermaidBlock.system-theme.test.tsx
new file mode 100644
index 00000000000..d84e932a018
--- /dev/null
+++ b/src/renderer/src/components/sidebar/CommentMermaidBlock.system-theme.test.tsx
@@ -0,0 +1,55 @@
+// @vitest-environment happy-dom
+import { act, cleanup, render } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { resetSystemPrefersDarkSubscriptionForTests } from '@/components/terminal-pane/use-system-prefers-dark'
+
+const mermaidProps: { current: { isDark: boolean } | null } = vi.hoisted(() => ({ current: null }))
+
+vi.mock('@/components/editor/MermaidBlock', () => ({
+  default: (props: { isDark: boolean }) => {
+    mermaidProps.current = props
+    return null
+  }
+}))
+vi.mock('@/store', () => ({
+  useAppStore: (selector: (state: Record<string, unknown>) => unknown) =>
+    selector({ settings: { theme: 'system' } })
+}))
+
+import CommentMermaidBlock from './CommentMermaidBlock'
+
+const originalMatchMedia = window.matchMedia
+
+afterEach(() => {
+  cleanup()
+  mermaidProps.current = null
+  resetSystemPrefersDarkSubscriptionForTests()
+  window.matchMedia = originalMatchMedia
+})
+
+describe('CommentMermaidBlock system theme', () => {
+  it('follows a system color-scheme change while mounted', () => {
+    let matches = false
+    const listeners = new Set<EventListener>()
+    const media = {
+      get matches() {
+        return matches
+      },
+      addEventListener: (_type: string, listener: EventListener) => listeners.add(listener),
+      removeEventListener: (_type: string, listener: EventListener) => listeners.delete(listener)
+    }
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the hook only reads `matches` and (un)subscribes to `change`.
+    window.matchMedia = (() => media) as unknown as typeof window.matchMedia
+
+    render(<CommentMermaidBlock content="graph TD; A-->B" />)
+    expect(mermaidProps.current?.isDark).toBe(false)
+
+    act(() => {
+      matches = true
+      for (const listener of listeners) {
+        listener(new MediaQueryListEvent('change', { matches: true }))
+      }
+    })
+    expect(mermaidProps.current?.isDark).toBe(true)
+  })
+})
diff --git a/src/renderer/src/components/sidebar/CommentMermaidBlock.tsx b/src/renderer/src/components/sidebar/CommentMermaidBlock.tsx
index 128444a8d2f..5d8cd5d0ceb 100644
--- a/src/renderer/src/components/sidebar/CommentMermaidBlock.tsx
+++ b/src/renderer/src/components/sidebar/CommentMermaidBlock.tsx
@@ -1,7 +1,7 @@
 import React from 'react'
 import MermaidBlock from '@/components/editor/MermaidBlock'
 import { cn } from '@/lib/utils'
-import { useAppStore } from '@/store'
+import { useDocumentDarkTheme } from '@/hooks/use-document-dark-theme'
 
 // Why: comment markdown components are module-level constants without access to
 // the live theme, so this wrapper resolves dark mode from the app store (same
@@ -15,10 +15,7 @@ export default function CommentMermaidBlock({
   content: string
   className?: string
 }): React.JSX.Element {
-  const settings = useAppStore((s) => s.settings)
-  const isDark =
-    settings?.theme === 'dark' ||
-    (settings?.theme === 'system' && window.matchMedia('(prefers-color-scheme: dark)').matches)
+  const isDark = useDocumentDarkTheme()
 
   return (
     <div className={cn(className)}>
diff --git a/src/renderer/src/components/sidebar/DeleteWorktreeDialog.host-context-boundary.test.ts b/src/renderer/src/components/sidebar/DeleteWorktreeDialog.host-context-boundary.test.ts
deleted file mode 100644
index 15f7cc04a98..00000000000
--- a/src/renderer/src/components/sidebar/DeleteWorktreeDialog.host-context-boundary.test.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-const SOURCE = readFileSync(join(__dirname, 'use-delete-worktree-status-hydration.ts'), 'utf8')
-
-function sourceBetween(source: string, startPattern: string, endPattern: string): string {
-  const start = source.indexOf(startPattern)
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = source.indexOf(endPattern, start + startPattern.length)
-  expect(end).toBeGreaterThan(start)
-  return source.slice(start, end)
-}
-
-describe('DeleteWorktreeDialog host-context boundaries', () => {
-  it('preloads git status from the selected worktree owner instead of the focused host', () => {
-    const effect = sourceBetween(SOURCE, 'deleteTargets.filter(', 'return () => {')
-
-    expect(effect).toContain('getSettingsForWorktreeRuntimeOwner')
-    expect(effect).toContain('worktreesByRepo: useAppStore.getState().worktreesByRepo')
-    expect(effect).toContain('target.id')
-    expect(effect).not.toContain('settings,\n        worktreeId: target.id')
-  })
-
-  it('does not restart pending status requests when one target hydrates', () => {
-    const effect = sourceBetween(SOURCE, 'useEffect(() => {', '}, [')
-
-    expect(SOURCE).not.toContain('useAppStore((state) => state.gitStatusByWorktree)')
-    expect(effect).toContain('useAppStore.getState().gitStatusByWorktree')
-    expect(effect).toContain('const controller = new AbortController()')
-    expect(effect).toContain('signal: controller.signal')
-    expect(effect).toContain('controller.abort()')
-  })
-})
diff --git a/src/renderer/src/components/sidebar/StatusIndicator.test.ts b/src/renderer/src/components/sidebar/StatusIndicator.test.ts
index 1c238615628..668596ef6dd 100644
--- a/src/renderer/src/components/sidebar/StatusIndicator.test.ts
+++ b/src/renderer/src/components/sidebar/StatusIndicator.test.ts
@@ -36,15 +36,9 @@ describe('StatusIndicator', () => {
   it('renders working as a yellow spinner ring', () => {
     const markup = renderMarkup('working')
 
-    expect(markup).toContain('border-yellow-500')
-    expect(markup).toContain('border-t-transparent')
-    // Why: rotation must come from the compositor-driven CSS animation, not a
-    // JS clock writing per-element styles on the input thread (STA-3328).
-    expect(markup).toContain('agent-working-spinner')
+    // The spinner's own classes and animation contract belong to AgentWorkingSpinner.test.tsx;
+    // this pins only that 'working' reaches for it.
     expect(markup).toContain('data-agent-spinner')
-    // Why: under reduced motion the top border is filled so the static ring
-    // reads as a complete marker, not a broken partial spinner (#9515).
-    expect(markup).toContain('motion-reduce:border-t-yellow-500')
   })
 
   it('renders monitoring as a static heartbeat glyph', () => {
diff --git a/src/renderer/src/components/sidebar/StatusIndicator.tsx b/src/renderer/src/components/sidebar/StatusIndicator.tsx
index fdce0b62f83..10f65234c6f 100644
--- a/src/renderer/src/components/sidebar/StatusIndicator.tsx
+++ b/src/renderer/src/components/sidebar/StatusIndicator.tsx
@@ -25,6 +25,7 @@ const AGENT_STATUS_TOOLTIP_STATUSES = new Set<Status>([
   'working',
   'monitoring',
   'permission',
+  'failed',
   'interrupted',
   'done'
 ])
@@ -58,7 +59,7 @@ const StatusIndicator = React.memo(function StatusIndicator({
         <Activity className="size-3 text-yellow-500" aria-hidden="true" />
       </span>
     )
-  } else if (status === 'interrupted') {
+  } else if (status === 'failed' || status === 'interrupted') {
     indicator = (
       <span
         className={cn('inline-flex h-3 w-3 shrink-0 items-center justify-center', className)}
diff --git a/src/renderer/src/components/sidebar/WorktreeCardAgents.acknowledgement-emphasis.test.tsx b/src/renderer/src/components/sidebar/WorktreeCardAgents.acknowledgement-emphasis.test.tsx
new file mode 100644
index 00000000000..1459e7f1bb3
--- /dev/null
+++ b/src/renderer/src/components/sidebar/WorktreeCardAgents.acknowledgement-emphasis.test.tsx
@@ -0,0 +1,179 @@
+// @vitest-environment happy-dom
+
+import { renderToStaticMarkup } from 'react-dom/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { DashboardAgentRow } from '@/components/dashboard/useDashboardData'
+import { TooltipProvider } from '@/components/ui/tooltip'
+import { makePaneKey } from '../../../../shared/stable-pane-id'
+import {
+  clearWorktreeAgentExpansionStateForTests,
+  seedWorktreeAgentExpansionStateForTests
+} from './worktree-card-agents-expansion-state'
+import WorktreeCardAgents from './WorktreeCardAgents'
+
+const WORKSPACE = 'acknowledgement-workspace'
+const PANE_A = makePaneKey('tab-a', '11111111-1111-4111-8111-111111111111')
+const PANE_B = makePaneKey('tab-b', '22222222-2222-4222-8222-222222222222')
+let acknowledgements: Record<string, number> = {}
+let focusedPaneKey: string | null = null
+
+vi.mock('@/store', () => ({
+  useAppStore: (selector: (state: unknown) => unknown) =>
+    selector({
+      agentActivityDisplayMode: 'compact',
+      acknowledgedAgentsByPaneKey: acknowledgements,
+      agentSendPopoverTargetMode: null,
+      dropAgentStatus: vi.fn(),
+      dismissRetainedAgent: vi.fn(),
+      sendPromptToSidebarAgentTarget: vi.fn()
+    })
+}))
+vi.mock('./useWorktreeAgentRows', () => ({ useWorktreeAgentRows: () => [] }))
+vi.mock('@/lib/worktree-activation', () => ({ activateAndRevealWorktree: vi.fn() }))
+vi.mock('@/lib/activate-tab-and-focus-pane', () => ({ activateTabAndFocusPane: vi.fn() }))
+vi.mock('@/hooks/use-now', () => ({ useNow: () => 5000 }))
+vi.mock('./focused-agent-row-highlight', () => ({
+  useFocusedAgentPaneKey: () => focusedPaneKey
+}))
+vi.mock('@/components/dashboard/use-agent-row-conversation-name', () => ({
+  useAgentRowConversationName: () => null
+}))
+vi.mock('./CacheTimer', () => ({
+  default: () => null,
+  usePromptCacheCountdownForPane: () => null
+}))
+
+function agentRow(
+  paneKey: string,
+  state: DashboardAgentRow['state'] = 'done',
+  entry: Partial<DashboardAgentRow['entry']> = {}
+): DashboardAgentRow {
+  const tabId = paneKey === PANE_A ? 'tab-a' : 'tab-b'
+  return {
+    paneKey,
+    agentType: 'codex',
+    rowSource: 'live',
+    state,
+    startedAt: 1000,
+    tab: {
+      id: tabId,
+      ptyId: null,
+      worktreeId: WORKSPACE,
+      title: tabId,
+      customTitle: null,
+      color: null,
+      sortOrder: 0,
+      createdAt: 1000
+    },
+    entry: {
+      paneKey,
+      worktreeId: WORKSPACE,
+      state: state === 'idle' || state === 'unverifiable' ? 'done' : state,
+      prompt: paneKey === PANE_A ? 'Review agent A' : 'Review agent B',
+      lastAssistantMessage: 'Result details',
+      stateStartedAt: 2000,
+      updatedAt: 2000,
+      stateHistory: [],
+      ...entry
+    }
+  }
+}
+
+function renderLabels(agents: DashboardAgentRow[]): HTMLElement[] {
+  const container = document.createElement('div')
+  container.innerHTML = renderToStaticMarkup(
+    <TooltipProvider>
+      <WorktreeCardAgents worktreeId={WORKSPACE} agents={agents} />
+    </TooltipProvider>
+  )
+  return [
+    ...container.querySelectorAll<HTMLElement>('.compact-agent-row .flex-1 > span:first-child')
+  ]
+}
+
+function expectEmphasis(label: HTMLElement | undefined, unvisited: boolean): void {
+  expect(label).toBeDefined()
+  expect(label?.classList.contains('font-semibold')).toBe(unvisited)
+  expect(label?.classList.contains('font-normal')).toBe(!unvisited)
+  expect(label?.classList.contains('text-foreground')).toBe(unvisited)
+}
+
+beforeEach(() => {
+  acknowledgements = { [PANE_B]: 2000 }
+  focusedPaneKey = null
+  clearWorktreeAgentExpansionStateForTests()
+  seedWorktreeAgentExpansionStateForTests(WORKSPACE, {
+    compactRootListExpanded: true,
+    collapsedLineageParents: new Set()
+  })
+})
+
+describe('compact acknowledgement emphasis through WorktreeCardAgents', () => {
+  it('changes only A when its acknowledgement covers its current turn', () => {
+    const agents = [agentRow(PANE_A), agentRow(PANE_B)]
+    const [aBefore, bBefore] = renderLabels(agents)
+    expectEmphasis(aBefore, true)
+    expectEmphasis(bBefore, false)
+    acknowledgements = { ...acknowledgements, [PANE_A]: 2000 }
+    const [aAfter, bAfter] = renderLabels(agents)
+    expectEmphasis(aAfter, false)
+    expect(bAfter?.outerHTML).toBe(bBefore?.outerHTML)
+  })
+
+  it.each([
+    { ack: undefined, timestamp: 2000, emphasized: true },
+    { ack: 1999, timestamp: 2000, emphasized: true },
+    { ack: 2000, timestamp: 2000, emphasized: false },
+    { ack: 2001, timestamp: 2000, emphasized: false },
+    { ack: undefined, timestamp: 0, emphasized: false }
+  ])('uses ack $ack against timestamp $timestamp', ({ ack, timestamp, emphasized }) => {
+    acknowledgements = ack === undefined ? {} : { [PANE_A]: ack }
+    const [label] = renderLabels([agentRow(PANE_A, 'done', { stateStartedAt: timestamp })])
+    expectEmphasis(label, emphasized)
+  })
+
+  it.each(['working', 'blocked', 'waiting', 'done', 'idle', 'unverifiable'] as const)(
+    'uses the same age rule for %s rows',
+    (state) => {
+      const row = agentRow(PANE_A, state)
+      expectEmphasis(renderLabels([row])[0], true)
+      acknowledgements = { [PANE_A]: 2000 }
+      expectEmphasis(renderLabels([row])[0], false)
+    }
+  )
+
+  it.each([false, true])('preserves focused contrast when unvisited is %s', (unvisited) => {
+    focusedPaneKey = PANE_A
+    acknowledgements = unvisited ? {} : { [PANE_A]: 2000 }
+    const [label] = renderLabels([agentRow(PANE_A)])
+    expect(label?.classList.contains('text-foreground')).toBe(true)
+    expect(label?.classList.contains('font-semibold')).toBe(unvisited)
+    expect(label?.classList.contains('font-normal')).toBe(!unvisited)
+    expect(label?.nextElementSibling?.className).toBe('text-foreground/70')
+  })
+
+  it('emphasizes the monitoring label while preserving prompt ordering', () => {
+    const [label] = renderLabels([agentRow(PANE_A, 'working', { workingMode: 'monitoring' })])
+    expectEmphasis(label, true)
+    expect(label?.textContent).toBe('Monitoring background tasks')
+    expect(label?.nextElementSibling?.textContent).toContain('Review agent A')
+  })
+
+  it('keeps interruption text secondary to the acknowledgement signal', () => {
+    const [label] = renderLabels([agentRow(PANE_A, 'done', { interrupted: true })])
+    expectEmphasis(label, true)
+    expect(label?.nextElementSibling?.textContent).toContain('Interrupted by user')
+  })
+
+  it('does not treat same-state output as a new turn, but admits a newer timestamp', () => {
+    acknowledgements = { [PANE_A]: 2000 }
+    expectEmphasis(renderLabels([agentRow(PANE_A)])[0], false)
+    expectEmphasis(
+      renderLabels([
+        agentRow(PANE_A, 'done', { updatedAt: 3000, lastAssistantMessage: 'More output' })
+      ])[0],
+      false
+    )
+    expectEmphasis(renderLabels([agentRow(PANE_A, 'done', { stateStartedAt: 3000 })])[0], true)
+  })
+})
diff --git a/src/renderer/src/components/sidebar/WorktreeCardAgents.test.tsx b/src/renderer/src/components/sidebar/WorktreeCardAgents.test.tsx
index ffe49ff22e6..73b9a430bd7 100644
--- a/src/renderer/src/components/sidebar/WorktreeCardAgents.test.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeCardAgents.test.tsx
@@ -132,7 +132,6 @@ vi.mock('@/components/dashboard/DashboardAgentRow', () => ({
     childAgentCount,
     childAgentsExpanded,
     onToggleChildAgents,
-    disclosureInGutter,
     onActivate
   }: {
     agent: { paneKey: string }
@@ -143,7 +142,6 @@ vi.mock('@/components/dashboard/DashboardAgentRow', () => ({
     childAgentCount?: number
     childAgentsExpanded?: boolean
     onToggleChildAgents?: () => void
-    disclosureInGutter?: boolean
     onActivate: (tabId: string, paneKey: string) => void
   }) => {
     capturedRowActivations.push({ paneKey: agent.paneKey, onActivate })
@@ -155,7 +153,6 @@ vi.mock('@/components/dashboard/DashboardAgentRow', () => ({
         data-disabled-reason={sendTargetDisabledReason}
         data-has-send-handler={typeof onSendTargetClick === 'function' ? 'true' : 'false'}
         data-pane-key={agent.paneKey}
-        data-disclosure-in-gutter={disclosureInGutter ? 'true' : 'false'}
       >
         {agent.paneKey}
         {typeof childAgentCount === 'number' && childAgentCount > 0 ? (
@@ -222,7 +219,7 @@ describe('WorktreeCardAgents', () => {
     expect(markup).not.toContain('data-testid="agent-row"')
   })
 
-  it('dims non-focused compact agent row text', async () => {
+  it('emphasizes unvisited non-focused compact agent row text', async () => {
     mockAgentActivityDisplayMode = 'compact'
     mockAgents = [
       mockAgent({
@@ -236,7 +233,7 @@ describe('WorktreeCardAgents', () => {
 
     const markup = renderToStaticMarkup(<WorktreeCardAgents worktreeId="wt-1" />)
 
-    expect(markup).toContain('<span class="text-muted-foreground/90">Run tests</span>')
+    expect(markup).toContain('<span class="font-semibold text-foreground">Run tests</span>')
     expect(markup).toContain('<span class="text-muted-foreground/65"> - Inspecting changes</span>')
     expect(markup).not.toContain('data-focused-agent-pane="true"')
     expect(markup).not.toContain('<span class="text-foreground">Run tests</span>')
@@ -258,7 +255,7 @@ describe('WorktreeCardAgents', () => {
     const markup = renderToStaticMarkup(<WorktreeCardAgents worktreeId="wt-1" />)
 
     expect(markup).toContain('data-focused-agent-pane="true"')
-    expect(markup).toContain('<span class="text-foreground">Focused prompt</span>')
+    expect(markup).toContain('<span class="font-semibold text-foreground">Focused prompt</span>')
     expect(markup).toContain('<span class="text-foreground/70"> - Reading output</span>')
     expect(markup).not.toContain('<span class="text-muted-foreground/90">Focused prompt</span>')
   })
@@ -438,8 +435,6 @@ describe('WorktreeCardAgents', () => {
     expect(markup).toContain('role="tree"')
     expect(markup).toContain('data-pane-key="tab-parent:1"')
     expect(markup).toContain('data-pane-key="tab-child:1"')
-    expect(markup).toContain('data-pane-key="tab-parent:1" data-disclosure-in-gutter="true"')
-    expect(markup).toContain('data-pane-key="tab-child:1" data-disclosure-in-gutter="false"')
     expect(markup).toContain('aria-label="Hide 1 child agent"')
     expect(markup).toContain('aria-expanded="true"')
   })
diff --git a/src/renderer/src/components/sidebar/WorktreeCardAgents.tsx b/src/renderer/src/components/sidebar/WorktreeCardAgents.tsx
index f1ba5cf4d52..77918e22b91 100644
--- a/src/renderer/src/components/sidebar/WorktreeCardAgents.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeCardAgents.tsx
@@ -245,7 +245,6 @@ const WorktreeCardAgentsBody = React.memo(function WorktreeCardAgentsBody({
     }
     const childAgents = childrenByParentPaneKey.get(agent.paneKey) ?? []
     const hasChildAgents = childAgents.length > 0
-    const isRootAgent = ancestorPaneKeys.size === 0
     // Why: spawned child agents are actionable work, so show them as soon as the parent appears (disclosure still folds noise).
     const expanded = !collapsedLineageParents.has(agent.paneKey)
     const sendTarget = isAgentSendTargetModeActive
@@ -271,14 +270,12 @@ const WorktreeCardAgentsBody = React.memo(function WorktreeCardAgentsBody({
           stateDotSize="sm"
           // Why: clicking the row jumps straight to the agent, so the expand chevron is redundant (keep the identity glyph).
           hideExpand
-          // Why: fold children under the parent row's leading chevron so a parent reads as a tree node (Variant B in the mockups).
+          // Why: child expansion belongs to the parent agent row.
           childAgentCount={hasChildAgents ? childAgents.length : undefined}
           childAgentsExpanded={expanded}
           onToggleChildAgents={
             hasChildAgents ? () => toggleLineageParent(agent.paneKey) : undefined
           }
-          // Why: nested levels keep the chevron inline; their gutter is the parent's guide line.
-          disclosureInGutter={isRootAgent}
           isFocusedPane={agent.paneKey === focusedAgentPaneKey}
           sendTargetStatus={sendTarget?.status}
           sendTargetDisabledReason={sendTarget?.disabledReason}
@@ -307,7 +304,6 @@ const WorktreeCardAgentsBody = React.memo(function WorktreeCardAgentsBody({
     }
     const childAgents = childrenByParentPaneKey.get(agent.paneKey) ?? []
     const hasChildAgents = childAgents.length > 0
-    const isRootAgent = ancestorPaneKeys.size === 0
     const expanded = !collapsedLineageParents.has(agent.paneKey)
     const sendTarget = isAgentSendTargetModeActive
       ? (sendTargetsByPaneKey.get(agent.paneKey) ?? {
@@ -322,6 +318,7 @@ const WorktreeCardAgentsBody = React.memo(function WorktreeCardAgentsBody({
         <CompactAgentRow
           agent={agent}
           now={now}
+          isUnvisited={unvisitedByPaneKey[agent.paneKey] ?? false}
           onActivate={
             agent.rowSource === 'retained' ? handleActivateRetainedAgent : handleActivateAgentTab
           }
@@ -333,7 +330,6 @@ const WorktreeCardAgentsBody = React.memo(function WorktreeCardAgentsBody({
           onToggleChildAgents={
             hasChildAgents ? () => toggleLineageParent(agent.paneKey) : undefined
           }
-          disclosureInGutter={isRootAgent}
           isFocusedPane={agent.paneKey === focusedAgentPaneKey}
           cacheTimerActive={cacheTimerActive}
         />
diff --git a/src/renderer/src/components/sidebar/WorktreeContextMenu.delete-shortcut.test.tsx b/src/renderer/src/components/sidebar/WorktreeContextMenu.delete-shortcut.test.tsx
index c6664b14e2c..8bdac0ca143 100644
--- a/src/renderer/src/components/sidebar/WorktreeContextMenu.delete-shortcut.test.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeContextMenu.delete-shortcut.test.tsx
@@ -79,6 +79,7 @@ vi.mock('lucide-react', async () =>
 )
 
 vi.mock('@/i18n/i18n', () => ({
+  i18n: { language: 'en' },
   translate: (_key: string, fallback: string) => fallback
 }))
 
diff --git a/src/renderer/src/components/sidebar/WorktreeList.lineage-agent-expansion-coupling.test.tsx b/src/renderer/src/components/sidebar/WorktreeList.lineage-agent-expansion-coupling.test.tsx
index a68908e5618..f3cbe8ff0e7 100644
--- a/src/renderer/src/components/sidebar/WorktreeList.lineage-agent-expansion-coupling.test.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeList.lineage-agent-expansion-coupling.test.tsx
@@ -463,6 +463,8 @@ describe('WorktreeCard agent-list <-> child-worktrees expansion coupling', () =>
       for (const root of mountedRoots.splice(0)) {
         root.unmount()
       }
+      // Lazy markdown imports must finish before Vitest tears down the module environment.
+      await vi.dynamicImportSettled()
     })
     document.body.innerHTML = ''
     clearWorktreeAgentExpansionStateForTests()
diff --git a/src/renderer/src/components/sidebar/WorktreeVisibilityDialog.tsx b/src/renderer/src/components/sidebar/WorktreeVisibilityDialog.tsx
index 3ce9a85d275..3eadb6ca0d4 100644
--- a/src/renderer/src/components/sidebar/WorktreeVisibilityDialog.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeVisibilityDialog.tsx
@@ -56,6 +56,7 @@ import {
   shouldUseGlobalWorktreeVisibility
 } from './worktree-visibility-use-global'
 import { createWorktreeVisibilitySourceMutation } from './worktree-visibility-source-mutation'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export default function WorktreeVisibilityDialog(): React.JSX.Element | null {
   const activeModal = useAppStore((s) => s.activeModal)
@@ -277,7 +278,7 @@ export default function WorktreeVisibilityDialog(): React.JSX.Element | null {
       if ((existing?.length ?? 0) >= MAX_CUSTOM_WORKTREE_VISIBILITY_SOURCES) {
         return 'limit'
       }
-      const id = crypto.randomUUID().replaceAll('-', '')
+      const id = createBrowserUuid().replaceAll('-', '')
       const candidate = normalizeCustomWorktreeVisibilitySources([{ id, rootPath }])?.[0]
       if (!candidate) {
         return 'invalid-path'
diff --git a/src/renderer/src/components/sidebar/__snapshots__/subagent-child-row-fallback-pixels.test.tsx.snap b/src/renderer/src/components/sidebar/__snapshots__/subagent-child-row-fallback-pixels.test.tsx.snap
new file mode 100644
index 00000000000..d1c70a5fee2
--- /dev/null
+++ b/src/renderer/src/components/sidebar/__snapshots__/subagent-child-row-fallback-pixels.test.tsx.snap
@@ -0,0 +1,46 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`chat strip rows from a legacy background-task roster > render exactly as before 1`] = `"<div data-native-chat-background-tasks="true" class="group/tasks shrink-0 bg-background px-3 pt-2 sm:px-4"><div class="mx-auto w-full max-w-4xl [[data-native-chat-background-tasks]:has(+[data-native-chat-thread-goal])_&amp;]:px-2"><div class="overflow-hidden rounded-lg border border-border bg-muted/50 text-xs text-muted-foreground shadow-xs [[data-native-chat-background-tasks]:has(+[data-native-chat-thread-goal])_&amp;]:rounded-b-none [[data-native-chat-background-tasks]:has(+[data-native-chat-thread-goal])_&amp;]:shadow-none"><div class="flex h-8 items-center px-1.5"><button type="button" class="flex h-6 min-w-0 flex-1 cursor-pointer items-center gap-2 rounded-md px-1.5 text-left outline-none hover:bg-accent hover:text-accent-foreground focus-visible:ring-[3px] focus-visible:ring-ring/50" aria-expanded="true" aria-controls="_R_0_" aria-label="8 agents · 1 shell · 1 monitor"><span class="min-w-0 truncate"><span><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bot mr-1 inline size-3 align-[-0.125em] text-muted-foreground" aria-hidden="true"><path d="M12 8V4H8"></path><rect width="16" height="12" x="4" y="8" rx="2"></rect><path d="M2 14h2"></path><path d="M20 14h2"></path><path d="M15 13v2"></path><path d="M9 13v2"></path></svg><span class="font-medium text-foreground">8 agents</span></span><span><span class="text-muted-foreground"> · </span><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-square-terminal mr-1 inline size-3 align-[-0.125em] text-muted-foreground" aria-hidden="true"><path d="m7 11 2-2-2-2"></path><path d="M11 13h4"></path><rect width="18" height="18" x="3" y="3" rx="2" ry="2"></rect></svg><span class="font-medium text-foreground">1 shell</span></span><span><span class="text-muted-foreground"> · </span><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-activity mr-1 inline size-3 align-[-0.125em] text-yellow-500" aria-hidden="true"><path d="M22 12h-2.48a2 2 0 0 0-1.93 1.46l-2.35 8.36a.25.25 0 0 1-.48 0L9.24 2.18a.25.25 0 0 0-.48 0l-2.35 8.36A2 2 0 0 1 4.49 12H2"></path></svg><span class="font-medium text-foreground">1 monitor</span></span></span><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down size-3 transition-transform rotate-180" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button></div><div id="_R_0_" class="scrollbar-sleek max-h-40 overflow-y-auto border-t border-border px-3 py-2"><div class=""><p class="px-0.5 pb-1 font-mono text-[10px] uppercase tracking-wider text-muted-foreground">Agents</p><ul role="list" aria-label="Agents" class="space-y-0.5"><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bot size-3.5 shrink-0 text-muted-foreground" aria-hidden="true"><path d="M12 8V4H8"></path><rect width="16" height="12" x="4" y="8" rx="2"></rect><path d="M2 14h2"></path><path d="M20 14h2"></path><path d="M15 13v2"></path><path d="M9 13v2"></path></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Blocked"><span class="block rounded-full size-1.5 bg-red-500"></span></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">Failed child</span><span class="text-muted-foreground"> · failed</span></span></li><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bot size-3.5 shrink-0 text-muted-foreground" aria-hidden="true"><path d="M12 8V4H8"></path><rect width="16" height="12" x="4" y="8" rx="2"></rect><path d="M2 14h2"></path><path d="M20 14h2"></path><path d="M15 13v2"></path><path d="M9 13v2"></path></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="No recent update"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-dashed text-amber-500 size-2.5" aria-hidden="true"><path d="M10.1 2.182a10 10 0 0 1 3.8 0"></path><path d="M13.9 21.818a10 10 0 0 1-3.8 0"></path><path d="M17.609 3.721a10 10 0 0 1 2.69 2.7"></path><path d="M2.182 13.9a10 10 0 0 1 0-3.8"></path><path d="M20.279 17.609a10 10 0 0 1-2.7 2.69"></path><path d="M21.818 10.1a10 10 0 0 1 0 3.8"></path><path d="M3.721 6.391a10 10 0 0 1 2.7-2.69"></path><path d="M6.391 20.279a10 10 0 0 1-2.69-2.7"></path></svg></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">Background agent</span><span class="text-muted-foreground"> · no contact</span></span><button data-slot="button" data-variant="ghost" data-size="xs" class="inline-flex shrink-0 items-center justify-center cursor-pointer font-medium whitespace-nowrap transition-all outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:pointer-events-none disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 [&amp;_svg]:pointer-events-none [&amp;_svg]:shrink-0 hover:bg-accent hover:text-accent-foreground dark:hover:bg-accent/50 h-6 gap-1 rounded-md px-2 text-xs has-[&gt;svg]:px-1.5 [&amp;_svg:not([class*=&#x27;size-&#x27;])]:size-3" type="button" aria-label="Stop Background agent">Stop</button></li><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bot size-3.5 shrink-0 text-muted-foreground" aria-hidden="true"><path d="M12 8V4H8"></path><rect width="16" height="12" x="4" y="8" rx="2"></rect><path d="M2 14h2"></path><path d="M20 14h2"></path><path d="M15 13v2"></path><path d="M9 13v2"></path></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Idle"><span class="block rounded-full size-1.5 bg-neutral-500/40"></span></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">Cancelled child</span></span></li><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bot size-3.5 shrink-0 text-muted-foreground" aria-hidden="true"><path d="M12 8V4H8"></path><rect width="16" height="12" x="4" y="8" rx="2"></rect><path d="M2 14h2"></path><path d="M20 14h2"></path><path d="M15 13v2"></path><path d="M9 13v2"></path></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Waiting for input"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-message-circle-question-mark text-agent-question size-2.5" aria-hidden="true"><path d="M2.992 16.342a2 2 0 0 1 .094 1.167l-1.065 3.29a1 1 0 0 0 1.236 1.168l3.413-.998a2 2 0 0 1 1.099.092 10 10 0 1 0-4.777-4.719"></path><path d="M9.09 9a3 3 0 0 1 5.83 1c0 2-3 3-3 3"></path><path d="M12 17h.01"></path></svg></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">Approve edits</span><span class="text-muted-foreground"> · needs approval</span></span><button data-slot="button" data-variant="ghost" data-size="xs" class="inline-flex shrink-0 items-center justify-center cursor-pointer font-medium whitespace-nowrap transition-all outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:pointer-events-none disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 [&amp;_svg]:pointer-events-none [&amp;_svg]:shrink-0 hover:bg-accent hover:text-accent-foreground dark:hover:bg-accent/50 h-6 gap-1 rounded-md px-2 text-xs has-[&gt;svg]:px-1.5 [&amp;_svg:not([class*=&#x27;size-&#x27;])]:size-3" type="button" aria-label="Stop Approve edits">Stop</button></li><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bot size-3.5 shrink-0 text-muted-foreground" aria-hidden="true"><path d="M12 8V4H8"></path><rect width="16" height="12" x="4" y="8" rx="2"></rect><path d="M2 14h2"></path><path d="M20 14h2"></path><path d="M15 13v2"></path><path d="M9 13v2"></path></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Done"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-check text-emerald-500 size-2.5" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><path d="m9 12 2 2 4-4"></path></svg></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">Summarize logs</span></span><span class="shrink-0 font-mono text-[10px] tabular-nums text-muted-foreground">900</span></li><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bot size-3.5 shrink-0 text-muted-foreground" aria-hidden="true"><path d="M12 8V4H8"></path><rect width="16" height="12" x="4" y="8" rx="2"></rect><path d="M2 14h2"></path><path d="M20 14h2"></path><path d="M15 13v2"></path><path d="M9 13v2"></path></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Working"><span data-agent-spinner="" class="agent-working-spinner block rounded-full border-2 border-yellow-500 border-t-transparent motion-reduce:border-t-yellow-500 size-1.5"></span></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">Review the parser</span></span><span class="shrink-0 font-mono text-[10px] tabular-nums text-muted-foreground">18.2k · 10m 0s</span><button data-slot="button" data-variant="ghost" data-size="xs" class="inline-flex shrink-0 items-center justify-center cursor-pointer font-medium whitespace-nowrap transition-all outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:pointer-events-none disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 [&amp;_svg]:pointer-events-none [&amp;_svg]:shrink-0 hover:bg-accent hover:text-accent-foreground dark:hover:bg-accent/50 h-6 gap-1 rounded-md px-2 text-xs has-[&gt;svg]:px-1.5 [&amp;_svg:not([class*=&#x27;size-&#x27;])]:size-3" type="button" aria-label="Stop Review the parser" disabled="">Stop</button></li><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bot size-3.5 shrink-0 text-muted-foreground" aria-hidden="true"><path d="M12 8V4H8"></path><rect width="16" height="12" x="4" y="8" rx="2"></rect><path d="M2 14h2"></path><path d="M20 14h2"></path><path d="M15 13v2"></path><path d="M9 13v2"></path></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Blocked"><span class="block rounded-full size-1.5 bg-red-500"></span></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">Explore</span><span class="text-muted-foreground"> · failed</span></span><span class="shrink-0 font-mono text-[10px] tabular-nums text-muted-foreground">8m 20s</span><button data-slot="button" data-variant="ghost" data-size="xs" class="inline-flex shrink-0 items-center justify-center cursor-pointer font-medium whitespace-nowrap transition-all outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:pointer-events-none disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 [&amp;_svg]:pointer-events-none [&amp;_svg]:shrink-0 hover:bg-accent hover:text-accent-foreground dark:hover:bg-accent/50 h-6 gap-1 rounded-md px-2 text-xs has-[&gt;svg]:px-1.5 [&amp;_svg:not([class*=&#x27;size-&#x27;])]:size-3" type="button" aria-label="Stop Explore">Stop</button></li><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bot size-3.5 shrink-0 text-muted-foreground" aria-hidden="true"><path d="M12 8V4H8"></path><rect width="16" height="12" x="4" y="8" rx="2"></rect><path d="M2 14h2"></path><path d="M20 14h2"></path><path d="M15 13v2"></path><path d="M9 13v2"></path></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Working"><span data-agent-spinner="" class="agent-working-spinner block rounded-full border-2 border-yellow-500 border-t-transparent motion-reduce:border-t-yellow-500 size-1.5"></span></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">Old host child</span></span><span class="shrink-0 font-mono text-[10px] tabular-nums text-muted-foreground">6m 40s</span><button data-slot="button" data-variant="ghost" data-size="xs" class="inline-flex shrink-0 items-center justify-center cursor-pointer font-medium whitespace-nowrap transition-all outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:pointer-events-none disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 [&amp;_svg]:pointer-events-none [&amp;_svg]:shrink-0 hover:bg-accent hover:text-accent-foreground dark:hover:bg-accent/50 h-6 gap-1 rounded-md px-2 text-xs has-[&gt;svg]:px-1.5 [&amp;_svg:not([class*=&#x27;size-&#x27;])]:size-3" type="button" aria-label="Stop Old host child">Stop</button></li></ul></div><div class="mt-1.5 border-t border-border/60 pt-1.5"><p class="px-0.5 pb-1 font-mono text-[10px] uppercase tracking-wider text-muted-foreground">Shell</p><ul role="list" aria-label="Shell" class="space-y-0.5"><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-square-terminal size-3.5 shrink-0 text-muted-foreground" aria-hidden="true"><path d="m7 11 2-2-2-2"></path><path d="M11 13h4"></path><rect width="18" height="18" x="3" y="3" rx="2" ry="2"></rect></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Working"><span data-agent-spinner="" class="agent-working-spinner block rounded-full border-2 border-yellow-500 border-t-transparent motion-reduce:border-t-yellow-500 size-1.5"></span></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">npm run dev</span></span><span class="shrink-0 font-mono text-[10px] tabular-nums text-muted-foreground">11m 40s</span></li></ul></div><div class="mt-1.5 border-t border-border/60 pt-1.5"><p class="px-0.5 pb-1 font-mono text-[10px] uppercase tracking-wider text-muted-foreground">Monitors</p><ul role="list" aria-label="Monitors" class="space-y-0.5"><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-activity size-3.5 shrink-0 text-yellow-500" aria-hidden="true"><path d="M22 12h-2.48a2 2 0 0 0-1.93 1.46l-2.35 8.36a.25.25 0 0 1-.48 0L9.24 2.18a.25.25 0 0 0-.48 0l-2.35 8.36A2 2 0 0 1 4.49 12H2"></path></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Monitoring background tasks"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-activity text-yellow-500 size-2.5" aria-hidden="true"><path d="M22 12h-2.48a2 2 0 0 0-1.93 1.46l-2.35 8.36a.25.25 0 0 1-.48 0L9.24 2.18a.25.25 0 0 0-.48 0l-2.35 8.36A2 2 0 0 1 4.49 12H2"></path></svg></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">tail -f server.log</span></span><button data-slot="button" data-variant="ghost" data-size="xs" class="inline-flex shrink-0 items-center justify-center cursor-pointer font-medium whitespace-nowrap transition-all outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:pointer-events-none disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 [&amp;_svg]:pointer-events-none [&amp;_svg]:shrink-0 hover:bg-accent hover:text-accent-foreground dark:hover:bg-accent/50 h-6 gap-1 rounded-md px-2 text-xs has-[&gt;svg]:px-1.5 [&amp;_svg:not([class*=&#x27;size-&#x27;])]:size-3" type="button" aria-label="Stop tail -f server.log">Stop</button></li></ul></div></div></div></div></div>"`;
+
+exports[`chat strip rows from a legacy background-task roster > render exactly as before 2`] = `"<div data-native-chat-background-tasks="true" class="group/tasks shrink-0 bg-background px-3 pt-2 sm:px-4"><div class="mx-auto w-full max-w-4xl [[data-native-chat-background-tasks]:has(+[data-native-chat-thread-goal])_&amp;]:px-2"><div class="overflow-hidden rounded-lg border border-border bg-muted/50 text-xs text-muted-foreground shadow-xs [[data-native-chat-background-tasks]:has(+[data-native-chat-thread-goal])_&amp;]:rounded-b-none [[data-native-chat-background-tasks]:has(+[data-native-chat-thread-goal])_&amp;]:shadow-none"><div class="flex h-8 items-center px-1.5"><button type="button" class="flex h-6 min-w-0 flex-1 cursor-pointer items-center gap-2 rounded-md px-1.5 text-left outline-none hover:bg-accent hover:text-accent-foreground focus-visible:ring-[3px] focus-visible:ring-ring/50" aria-expanded="true" aria-controls="_R_0_" aria-label="8 agents · 1 shell · 1 monitor"><span class="min-w-0 truncate"><span><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bot mr-1 inline size-3 align-[-0.125em] text-muted-foreground" aria-hidden="true"><path d="M12 8V4H8"></path><rect width="16" height="12" x="4" y="8" rx="2"></rect><path d="M2 14h2"></path><path d="M20 14h2"></path><path d="M15 13v2"></path><path d="M9 13v2"></path></svg><span class="font-medium text-foreground">8 agents</span></span><span><span class="text-muted-foreground"> · </span><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-square-terminal mr-1 inline size-3 align-[-0.125em] text-muted-foreground" aria-hidden="true"><path d="m7 11 2-2-2-2"></path><path d="M11 13h4"></path><rect width="18" height="18" x="3" y="3" rx="2" ry="2"></rect></svg><span class="font-medium text-foreground">1 shell</span></span><span><span class="text-muted-foreground"> · </span><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-activity mr-1 inline size-3 align-[-0.125em] text-yellow-500" aria-hidden="true"><path d="M22 12h-2.48a2 2 0 0 0-1.93 1.46l-2.35 8.36a.25.25 0 0 1-.48 0L9.24 2.18a.25.25 0 0 0-.48 0l-2.35 8.36A2 2 0 0 1 4.49 12H2"></path></svg><span class="font-medium text-foreground">1 monitor</span></span></span><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down size-3 transition-transform rotate-180" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button></div><div id="_R_0_" class="scrollbar-sleek max-h-40 overflow-y-auto border-t border-border px-3 py-2"><div class=""><p class="px-0.5 pb-1 font-mono text-[10px] uppercase tracking-wider text-muted-foreground">Agents</p><ul role="list" aria-label="Agents" class="space-y-0.5"><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bot size-3.5 shrink-0 text-muted-foreground" aria-hidden="true"><path d="M12 8V4H8"></path><rect width="16" height="12" x="4" y="8" rx="2"></rect><path d="M2 14h2"></path><path d="M20 14h2"></path><path d="M15 13v2"></path><path d="M9 13v2"></path></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Blocked"><span class="block rounded-full size-1.5 bg-red-500"></span></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">Failed child</span><span class="text-muted-foreground"> · failed</span></span></li><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bot size-3.5 shrink-0 text-muted-foreground" aria-hidden="true"><path d="M12 8V4H8"></path><rect width="16" height="12" x="4" y="8" rx="2"></rect><path d="M2 14h2"></path><path d="M20 14h2"></path><path d="M15 13v2"></path><path d="M9 13v2"></path></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="No recent update"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-dashed text-amber-500 size-2.5" aria-hidden="true"><path d="M10.1 2.182a10 10 0 0 1 3.8 0"></path><path d="M13.9 21.818a10 10 0 0 1-3.8 0"></path><path d="M17.609 3.721a10 10 0 0 1 2.69 2.7"></path><path d="M2.182 13.9a10 10 0 0 1 0-3.8"></path><path d="M20.279 17.609a10 10 0 0 1-2.7 2.69"></path><path d="M21.818 10.1a10 10 0 0 1 0 3.8"></path><path d="M3.721 6.391a10 10 0 0 1 2.7-2.69"></path><path d="M6.391 20.279a10 10 0 0 1-2.69-2.7"></path></svg></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">Background agent</span><span class="text-muted-foreground"> · no contact</span></span></li><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bot size-3.5 shrink-0 text-muted-foreground" aria-hidden="true"><path d="M12 8V4H8"></path><rect width="16" height="12" x="4" y="8" rx="2"></rect><path d="M2 14h2"></path><path d="M20 14h2"></path><path d="M15 13v2"></path><path d="M9 13v2"></path></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Idle"><span class="block rounded-full size-1.5 bg-neutral-500/40"></span></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">Cancelled child</span></span></li><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bot size-3.5 shrink-0 text-muted-foreground" aria-hidden="true"><path d="M12 8V4H8"></path><rect width="16" height="12" x="4" y="8" rx="2"></rect><path d="M2 14h2"></path><path d="M20 14h2"></path><path d="M15 13v2"></path><path d="M9 13v2"></path></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Waiting for input"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-message-circle-question-mark text-agent-question size-2.5" aria-hidden="true"><path d="M2.992 16.342a2 2 0 0 1 .094 1.167l-1.065 3.29a1 1 0 0 0 1.236 1.168l3.413-.998a2 2 0 0 1 1.099.092 10 10 0 1 0-4.777-4.719"></path><path d="M9.09 9a3 3 0 0 1 5.83 1c0 2-3 3-3 3"></path><path d="M12 17h.01"></path></svg></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">Approve edits</span><span class="text-muted-foreground"> · needs approval</span></span></li><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bot size-3.5 shrink-0 text-muted-foreground" aria-hidden="true"><path d="M12 8V4H8"></path><rect width="16" height="12" x="4" y="8" rx="2"></rect><path d="M2 14h2"></path><path d="M20 14h2"></path><path d="M15 13v2"></path><path d="M9 13v2"></path></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Done"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-check text-emerald-500 size-2.5" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><path d="m9 12 2 2 4-4"></path></svg></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">Summarize logs</span></span><span class="shrink-0 font-mono text-[10px] tabular-nums text-muted-foreground">900</span></li><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bot size-3.5 shrink-0 text-muted-foreground" aria-hidden="true"><path d="M12 8V4H8"></path><rect width="16" height="12" x="4" y="8" rx="2"></rect><path d="M2 14h2"></path><path d="M20 14h2"></path><path d="M15 13v2"></path><path d="M9 13v2"></path></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Working"><span data-agent-spinner="" class="agent-working-spinner block rounded-full border-2 border-yellow-500 border-t-transparent motion-reduce:border-t-yellow-500 size-1.5"></span></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">Review the parser</span></span><span class="shrink-0 font-mono text-[10px] tabular-nums text-muted-foreground">18.2k · 10m 0s</span></li><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bot size-3.5 shrink-0 text-muted-foreground" aria-hidden="true"><path d="M12 8V4H8"></path><rect width="16" height="12" x="4" y="8" rx="2"></rect><path d="M2 14h2"></path><path d="M20 14h2"></path><path d="M15 13v2"></path><path d="M9 13v2"></path></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Blocked"><span class="block rounded-full size-1.5 bg-red-500"></span></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">Explore</span><span class="text-muted-foreground"> · failed</span></span><span class="shrink-0 font-mono text-[10px] tabular-nums text-muted-foreground">8m 20s</span></li><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bot size-3.5 shrink-0 text-muted-foreground" aria-hidden="true"><path d="M12 8V4H8"></path><rect width="16" height="12" x="4" y="8" rx="2"></rect><path d="M2 14h2"></path><path d="M20 14h2"></path><path d="M15 13v2"></path><path d="M9 13v2"></path></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Working"><span data-agent-spinner="" class="agent-working-spinner block rounded-full border-2 border-yellow-500 border-t-transparent motion-reduce:border-t-yellow-500 size-1.5"></span></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">Old host child</span></span><span class="shrink-0 font-mono text-[10px] tabular-nums text-muted-foreground">6m 40s</span></li></ul></div><div class="mt-1.5 border-t border-border/60 pt-1.5"><p class="px-0.5 pb-1 font-mono text-[10px] uppercase tracking-wider text-muted-foreground">Shell</p><ul role="list" aria-label="Shell" class="space-y-0.5"><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-square-terminal size-3.5 shrink-0 text-muted-foreground" aria-hidden="true"><path d="m7 11 2-2-2-2"></path><path d="M11 13h4"></path><rect width="18" height="18" x="3" y="3" rx="2" ry="2"></rect></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Working"><span data-agent-spinner="" class="agent-working-spinner block rounded-full border-2 border-yellow-500 border-t-transparent motion-reduce:border-t-yellow-500 size-1.5"></span></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">npm run dev</span></span><span class="shrink-0 font-mono text-[10px] tabular-nums text-muted-foreground">11m 40s</span></li></ul></div><div class="mt-1.5 border-t border-border/60 pt-1.5"><p class="px-0.5 pb-1 font-mono text-[10px] uppercase tracking-wider text-muted-foreground">Monitors</p><ul role="list" aria-label="Monitors" class="space-y-0.5"><li class="flex h-6 min-w-0 items-center gap-2 text-foreground/80"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-activity size-3.5 shrink-0 text-yellow-500" aria-hidden="true"><path d="M22 12h-2.48a2 2 0 0 0-1.93 1.46l-2.35 8.36a.25.25 0 0 1-.48 0L9.24 2.18a.25.25 0 0 0-.48 0l-2.35 8.36A2 2 0 0 1 4.49 12H2"></path></svg><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Monitoring background tasks"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-activity text-yellow-500 size-2.5" aria-hidden="true"><path d="M22 12h-2.48a2 2 0 0 0-1.93 1.46l-2.35 8.36a.25.25 0 0 1-.48 0L9.24 2.18a.25.25 0 0 0-.48 0l-2.35 8.36A2 2 0 0 1 4.49 12H2"></path></svg></span><span class="min-w-0 flex-1 truncate"><span class="font-medium text-foreground">tail -f server.log</span></span></li></ul></div><div class="mt-2 border-t border-border pt-2"><button data-slot="button" data-variant="ghost" data-size="xs" class="inline-flex shrink-0 items-center justify-center cursor-pointer font-medium whitespace-nowrap transition-all outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:pointer-events-none disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 [&amp;_svg]:pointer-events-none [&amp;_svg]:shrink-0 hover:bg-accent hover:text-accent-foreground dark:hover:bg-accent/50 h-6 gap-1 rounded-md px-2 text-xs has-[&gt;svg]:px-1.5 [&amp;_svg:not([class*=&#x27;size-&#x27;])]:size-3" type="button" aria-label="Stop background tasks">Stop</button></div></div></div></div></div>"`;
+
+exports[`sidebar child rows from a legacy subagents snapshot > render a stale parent and a lost transport exactly as before 1`] = `
+[
+  "<div draggable="false" class="compact-agent-row agent-disclosure-row group/compact-agent-row min-w-0 cursor-pointer rounded-sm px-1 text-[11px] leading-none text-muted-foreground worktree-agent-row-hover flex h-6 items-center gap-1"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="No recent update" data-state="closed" data-slot="tooltip-trigger"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-dashed text-amber-500 size-2.5" aria-hidden="true"><path d="M10.1 2.182a10 10 0 0 1 3.8 0"></path><path d="M13.9 21.818a10 10 0 0 1-3.8 0"></path><path d="M17.609 3.721a10 10 0 0 1 2.69 2.7"></path><path d="M2.182 13.9a10 10 0 0 1 0-3.8"></path><path d="M20.279 17.609a10 10 0 0 1-2.7 2.69"></path><path d="M21.818 10.1a10 10 0 0 1 0 3.8"></path><path d="M3.721 6.391a10 10 0 0 1 2.7-2.69"></path><path d="M6.391 20.279a10 10 0 0 1-2.69-2.7"></path></svg></span><span class="min-w-0 flex-1 truncate" title="Review the parser - No update in 5m"><span class="font-normal text-muted-foreground/90">Review the parser</span><span class="text-muted-foreground/65"> - No update in 5m</span></span><span class="min-w-0 max-w-24 truncate font-mono text-[10px] text-muted-foreground/70" title="claude-sonnet">claude-sonnet</span><span class="shrink-0 text-[10px] tabular-nums text-muted-foreground/60">10m</span></div>",
+  "<div draggable="false" class="compact-agent-row agent-disclosure-row group/compact-agent-row min-w-0 cursor-pointer rounded-sm px-1 text-[11px] leading-none text-muted-foreground worktree-agent-row-hover flex h-6 items-center gap-1"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="No recent update" data-state="closed" data-slot="tooltip-trigger"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-dashed text-amber-500 size-2.5" aria-hidden="true"><path d="M10.1 2.182a10 10 0 0 1 3.8 0"></path><path d="M13.9 21.818a10 10 0 0 1-3.8 0"></path><path d="M17.609 3.721a10 10 0 0 1 2.69 2.7"></path><path d="M2.182 13.9a10 10 0 0 1 0-3.8"></path><path d="M20.279 17.609a10 10 0 0 1-2.7 2.69"></path><path d="M21.818 10.1a10 10 0 0 1 0 3.8"></path><path d="M3.721 6.391a10 10 0 0 1 2.7-2.69"></path><path d="M6.391 20.279a10 10 0 0 1-2.69-2.7"></path></svg></span><span class="min-w-0 flex-1 truncate" title="Explore - No update in 5m"><span class="font-normal text-muted-foreground/90">Explore</span><span class="text-muted-foreground/65"> - No update in 5m</span></span><span class="shrink-0 text-[10px] tabular-nums text-muted-foreground/60">8m</span></div>",
+  "<div draggable="false" class="compact-agent-row agent-disclosure-row group/compact-agent-row min-w-0 cursor-pointer rounded-sm px-1 text-[11px] leading-none text-muted-foreground worktree-agent-row-hover flex h-6 items-center gap-1"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="No recent update" data-state="closed" data-slot="tooltip-trigger"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-dashed text-amber-500 size-2.5" aria-hidden="true"><path d="M10.1 2.182a10 10 0 0 1 3.8 0"></path><path d="M13.9 21.818a10 10 0 0 1-3.8 0"></path><path d="M17.609 3.721a10 10 0 0 1 2.69 2.7"></path><path d="M2.182 13.9a10 10 0 0 1 0-3.8"></path><path d="M20.279 17.609a10 10 0 0 1-2.7 2.69"></path><path d="M21.818 10.1a10 10 0 0 1 0 3.8"></path><path d="M3.721 6.391a10 10 0 0 1 2.7-2.69"></path><path d="M6.391 20.279a10 10 0 0 1-2.69-2.7"></path></svg></span><span class="min-w-0 flex-1 truncate" title="No recent update - No update in 5m"><span class="font-normal text-muted-foreground/90">No recent update</span><span class="text-muted-foreground/65"> - No update in 5m</span></span><span class="shrink-0 text-[10px] tabular-nums text-muted-foreground/60">16m</span></div>",
+  "<div draggable="false" class="compact-agent-row agent-disclosure-row group/compact-agent-row min-w-0 cursor-pointer rounded-sm px-1 text-[11px] leading-none text-muted-foreground worktree-agent-row-hover flex h-6 items-center gap-1"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="No recent update" data-state="closed" data-slot="tooltip-trigger"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-dashed text-amber-500 size-2.5" aria-hidden="true"><path d="M10.1 2.182a10 10 0 0 1 3.8 0"></path><path d="M13.9 21.818a10 10 0 0 1-3.8 0"></path><path d="M17.609 3.721a10 10 0 0 1 2.69 2.7"></path><path d="M2.182 13.9a10 10 0 0 1 0-3.8"></path><path d="M20.279 17.609a10 10 0 0 1-2.7 2.69"></path><path d="M21.818 10.1a10 10 0 0 1 0 3.8"></path><path d="M3.721 6.391a10 10 0 0 1 2.7-2.69"></path><path d="M6.391 20.279a10 10 0 0 1-2.69-2.7"></path></svg></span><span class="min-w-0 flex-1 truncate" title="Approve edits - No update in 5m"><span class="font-normal text-muted-foreground/90">Approve edits</span><span class="text-muted-foreground/65"> - No update in 5m</span></span><span class="shrink-0 text-[10px] tabular-nums text-muted-foreground/60">6m</span></div>",
+  "<div draggable="false" class="compact-agent-row agent-disclosure-row group/compact-agent-row min-w-0 cursor-pointer rounded-sm px-1 text-[11px] leading-none text-muted-foreground worktree-agent-row-hover flex h-6 items-center gap-1"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="No recent update" data-state="closed" data-slot="tooltip-trigger"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-dashed text-amber-500 size-2.5" aria-hidden="true"><path d="M10.1 2.182a10 10 0 0 1 3.8 0"></path><path d="M13.9 21.818a10 10 0 0 1-3.8 0"></path><path d="M17.609 3.721a10 10 0 0 1 2.69 2.7"></path><path d="M2.182 13.9a10 10 0 0 1 0-3.8"></path><path d="M20.279 17.609a10 10 0 0 1-2.7 2.69"></path><path d="M21.818 10.1a10 10 0 0 1 0 3.8"></path><path d="M3.721 6.391a10 10 0 0 1 2.7-2.69"></path><path d="M6.391 20.279a10 10 0 0 1-2.69-2.7"></path></svg></span><span class="min-w-0 flex-1 truncate" title="Review the parser - No update in 5m"><span class="font-normal text-muted-foreground/90">Review the parser</span><span class="text-muted-foreground/65"> - No update in 5m</span></span><span class="min-w-0 max-w-24 truncate font-mono text-[10px] text-muted-foreground/70" title="claude-sonnet">claude-sonnet</span><span class="shrink-0 text-[10px] tabular-nums text-muted-foreground/60">10m</span></div>",
+]
+`;
+
+exports[`sidebar child rows from a legacy subagents snapshot > render the compact rows exactly as before 1`] = `
+[
+  "<div draggable="false" class="compact-agent-row agent-disclosure-row group/compact-agent-row min-w-0 cursor-pointer rounded-sm px-1 text-[11px] leading-none text-muted-foreground worktree-agent-row-hover flex h-6 items-center gap-1"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Working" data-state="closed" data-slot="tooltip-trigger"><span data-agent-spinner="" class="agent-working-spinner block rounded-full border-2 border-yellow-500 border-t-transparent motion-reduce:border-t-yellow-500 size-1.5"></span></span><span class="min-w-0 flex-1 truncate" title="Review the parser - general-purpose"><span class="font-normal text-muted-foreground/90">Review the parser</span><span class="text-muted-foreground/65"> - general-purpose</span></span><span class="min-w-0 max-w-24 truncate font-mono text-[10px] text-muted-foreground/70" title="claude-sonnet">claude-sonnet</span><span class="shrink-0 text-[10px] tabular-nums text-muted-foreground/60">10m</span></div>",
+  "<div draggable="false" class="compact-agent-row agent-disclosure-row group/compact-agent-row min-w-0 cursor-pointer rounded-sm px-1 text-[11px] leading-none text-muted-foreground worktree-agent-row-hover flex h-6 items-center gap-1"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Working" data-state="closed" data-slot="tooltip-trigger"><span data-agent-spinner="" class="agent-working-spinner block rounded-full border-2 border-yellow-500 border-t-transparent motion-reduce:border-t-yellow-500 size-1.5"></span></span><span class="min-w-0 flex-1 truncate" title="Explore"><span class="font-normal text-muted-foreground/90">Explore</span></span><span class="shrink-0 text-[10px] tabular-nums text-muted-foreground/60">8m</span></div>",
+  "<div draggable="false" class="compact-agent-row agent-disclosure-row group/compact-agent-row min-w-0 cursor-pointer rounded-sm px-1 text-[11px] leading-none text-muted-foreground worktree-agent-row-hover flex h-6 items-center gap-1"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Working" data-state="closed" data-slot="tooltip-trigger"><span data-agent-spinner="" class="agent-working-spinner block rounded-full border-2 border-yellow-500 border-t-transparent motion-reduce:border-t-yellow-500 size-1.5"></span></span><span class="min-w-0 flex-1 truncate" title="Working - Agent"><span class="font-normal text-muted-foreground/90">Working</span><span class="text-muted-foreground/65"> - Agent</span></span><span class="shrink-0 text-[10px] tabular-nums text-muted-foreground/60">16m</span></div>",
+  "<div draggable="false" class="compact-agent-row agent-disclosure-row group/compact-agent-row min-w-0 cursor-pointer rounded-sm px-1 text-[11px] leading-none text-muted-foreground worktree-agent-row-hover flex h-6 items-center gap-1"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Waiting for input" data-state="closed" data-slot="tooltip-trigger"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-message-circle-question-mark text-agent-question size-2.5" aria-hidden="true"><path d="M2.992 16.342a2 2 0 0 1 .094 1.167l-1.065 3.29a1 1 0 0 0 1.236 1.168l3.413-.998a2 2 0 0 1 1.099.092 10 10 0 1 0-4.777-4.719"></path><path d="M9.09 9a3 3 0 0 1 5.83 1c0 2-3 3-3 3"></path><path d="M12 17h.01"></path></svg></span><span class="min-w-0 flex-1 truncate" title="Approve edits - Agent"><span class="font-normal text-muted-foreground/90">Approve edits</span><span class="text-muted-foreground/65"> - Agent</span></span><span class="shrink-0 text-[10px] tabular-nums text-muted-foreground/60">6m</span></div>",
+  "<div draggable="false" class="compact-agent-row agent-disclosure-row group/compact-agent-row min-w-0 cursor-pointer rounded-sm px-1 text-[11px] leading-none text-muted-foreground worktree-agent-row-hover flex h-6 items-center gap-1"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Blocked" data-state="closed" data-slot="tooltip-trigger"><span class="block rounded-full size-1.5 bg-red-500"></span></span><span class="min-w-0 flex-1 truncate" title="Rate limited - Agent"><span class="font-normal text-muted-foreground/90">Rate limited</span><span class="text-muted-foreground/65"> - Agent</span></span><span class="shrink-0 text-[10px] tabular-nums text-muted-foreground/60">6m</span></div>",
+  "<div draggable="false" class="compact-agent-row agent-disclosure-row group/compact-agent-row min-w-0 cursor-pointer rounded-sm px-1 text-[11px] leading-none text-muted-foreground worktree-agent-row-hover flex h-6 items-center gap-1"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Idle" data-state="closed" data-slot="tooltip-trigger"><span class="block rounded-full size-1.5 bg-neutral-500/40"></span></span><span class="min-w-0 flex-1 truncate" title="Teammate - writer"><span class="font-normal text-muted-foreground/90">Teammate</span><span class="text-muted-foreground/65"> - writer</span></span><span class="shrink-0 text-[10px] tabular-nums text-muted-foreground/60">6m</span></div>",
+  "<div draggable="false" class="compact-agent-row agent-disclosure-row group/compact-agent-row min-w-0 cursor-pointer rounded-sm px-1 text-[11px] leading-none text-muted-foreground worktree-agent-row-hover flex h-6 items-center gap-1"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="No recent update" data-state="closed" data-slot="tooltip-trigger"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-dashed text-amber-500 size-2.5" aria-hidden="true"><path d="M10.1 2.182a10 10 0 0 1 3.8 0"></path><path d="M13.9 21.818a10 10 0 0 1-3.8 0"></path><path d="M17.609 3.721a10 10 0 0 1 2.69 2.7"></path><path d="M2.182 13.9a10 10 0 0 1 0-3.8"></path><path d="M20.279 17.609a10 10 0 0 1-2.7 2.69"></path><path d="M21.818 10.1a10 10 0 0 1 0 3.8"></path><path d="M3.721 6.391a10 10 0 0 1 2.7-2.69"></path><path d="M6.391 20.279a10 10 0 0 1-2.69-2.7"></path></svg></span><span class="min-w-0 flex-1 truncate" title="Lost child - No update in 5m"><span class="font-normal text-muted-foreground/90">Lost child</span><span class="text-muted-foreground/65"> - No update in 5m</span></span><span class="shrink-0 text-[10px] tabular-nums text-muted-foreground/60">6m</span></div>",
+]
+`;
+
+exports[`sidebar child rows from a legacy subagents snapshot > render the full rows exactly as before 1`] = `
+[
+  "<div class="agent-disclosure-row group/agent-row relative -ml-2 flex flex-col py-1 px-2 cursor-pointer rounded-sm worktree-agent-row-hover" title="started 10m ago"><div class="flex items-center gap-1.5"><span class="inline-flex shrink-0 items-center justify-center" aria-label="Working" data-state="closed" data-slot="tooltip-trigger"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Working"><span data-agent-spinner="" class="agent-working-spinner block rounded-full border-2 border-yellow-500 border-t-transparent motion-reduce:border-t-yellow-500 size-1.5"></span></span></span><span class="block min-w-0 flex-1 overflow-hidden text-[11px] leading-snug transition-[height] duration-200 ease-out [interpolate-size:allow-keywords] h-[1lh] truncate font-normal text-muted-foreground" title="Review the parser">Review the parser</span><span class="max-w-24 shrink-0 truncate font-mono text-[10px] text-muted-foreground/70" title="claude-sonnet">claude-sonnet</span><span class="relative ml-auto flex shrink-0 items-center justify-end h-3.5 w-12"><span class="pointer-events-none shrink-0 text-[10px] leading-none text-muted-foreground/60" aria-hidden="true">10m ago</span></span></div><div data-agent-row-tool-slot="" class="mt-0.5 min-w-0 pl-5 text-[10px] leading-snug text-muted-foreground/70"><span data-agent-row-tool-placeholder="true" aria-hidden="true" class="block h-[1lh]"></span></div><div class="mt-0.5 pl-5 text-[10px] leading-snug text-muted-foreground/70"> </div></div>",
+  "<div class="agent-disclosure-row group/agent-row relative -ml-2 flex flex-col py-1 px-2 cursor-pointer rounded-sm worktree-agent-row-hover" title="started 8m ago"><div class="flex items-center gap-1.5"><span class="inline-flex shrink-0 items-center justify-center" aria-label="Working" data-state="closed" data-slot="tooltip-trigger"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Working"><span data-agent-spinner="" class="agent-working-spinner block rounded-full border-2 border-yellow-500 border-t-transparent motion-reduce:border-t-yellow-500 size-1.5"></span></span></span><span class="block min-w-0 flex-1 overflow-hidden text-[11px] leading-snug transition-[height] duration-200 ease-out [interpolate-size:allow-keywords] h-[1lh] truncate font-normal text-muted-foreground" title="Explore">Explore</span><span class="relative ml-auto flex shrink-0 items-center justify-end h-3.5 w-12"><span class="pointer-events-none shrink-0 text-[10px] leading-none text-muted-foreground/60" aria-hidden="true">8m ago</span></span></div><div data-agent-row-tool-slot="" class="mt-0.5 min-w-0 pl-5 text-[10px] leading-snug text-muted-foreground/70"><span data-agent-row-tool-placeholder="true" aria-hidden="true" class="block h-[1lh]"></span></div><div class="mt-0.5 pl-5 text-[10px] leading-snug text-muted-foreground/70"> </div></div>",
+  "<div class="agent-disclosure-row group/agent-row relative -ml-2 flex flex-col py-1 px-2 cursor-pointer rounded-sm worktree-agent-row-hover" title="started 16m ago"><div class="flex items-center gap-1.5"><span class="inline-flex shrink-0 items-center justify-center" aria-label="Working" data-state="closed" data-slot="tooltip-trigger"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Working"><span data-agent-spinner="" class="agent-working-spinner block rounded-full border-2 border-yellow-500 border-t-transparent motion-reduce:border-t-yellow-500 size-1.5"></span></span></span><span class="block min-w-0 flex-1 overflow-hidden text-[11px] leading-snug transition-[height] duration-200 ease-out [interpolate-size:allow-keywords] h-[1lh] truncate font-normal text-muted-foreground" title="Working">Working</span><span class="relative ml-auto flex shrink-0 items-center justify-end h-3.5 w-12"><span class="pointer-events-none shrink-0 text-[10px] leading-none text-muted-foreground/60" aria-hidden="true">16m ago</span></span></div><div data-agent-row-tool-slot="" class="mt-0.5 min-w-0 pl-5 text-[10px] leading-snug text-muted-foreground/70"><span data-agent-row-tool-placeholder="true" aria-hidden="true" class="block h-[1lh]"></span></div><div class="mt-0.5 pl-5 text-[10px] leading-snug text-muted-foreground/70"> </div></div>",
+  "<div class="agent-disclosure-row group/agent-row relative -ml-2 flex flex-col py-1 px-2 cursor-pointer rounded-sm worktree-agent-row-hover" title="started 6m ago"><div class="flex items-center gap-1.5"><span class="inline-flex shrink-0 items-center justify-center" aria-label="Waiting for input" data-state="closed" data-slot="tooltip-trigger"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Waiting for input"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-message-circle-question-mark text-agent-question size-2.5" aria-hidden="true"><path d="M2.992 16.342a2 2 0 0 1 .094 1.167l-1.065 3.29a1 1 0 0 0 1.236 1.168l3.413-.998a2 2 0 0 1 1.099.092 10 10 0 1 0-4.777-4.719"></path><path d="M9.09 9a3 3 0 0 1 5.83 1c0 2-3 3-3 3"></path><path d="M12 17h.01"></path></svg></span></span><span class="block min-w-0 flex-1 overflow-hidden text-[11px] leading-snug transition-[height] duration-200 ease-out [interpolate-size:allow-keywords] h-[1lh] truncate font-normal text-muted-foreground" title="Approve edits">Approve edits</span><span class="relative ml-auto flex shrink-0 items-center justify-end h-3.5 w-12"><span class="pointer-events-none shrink-0 text-[10px] leading-none text-muted-foreground/60" aria-hidden="true">6m ago</span></span></div><div class="mt-0.5 pl-5 text-[10px] leading-snug text-muted-foreground/70"> </div></div>",
+  "<div class="agent-disclosure-row group/agent-row relative -ml-2 flex flex-col py-1 px-2 cursor-pointer rounded-sm worktree-agent-row-hover" title="started 6m ago"><div class="flex items-center gap-1.5"><span class="inline-flex shrink-0 items-center justify-center" aria-label="Blocked" data-state="closed" data-slot="tooltip-trigger"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Blocked"><span class="block rounded-full size-1.5 bg-red-500"></span></span></span><span class="block min-w-0 flex-1 overflow-hidden text-[11px] leading-snug transition-[height] duration-200 ease-out [interpolate-size:allow-keywords] h-[1lh] truncate font-normal text-muted-foreground" title="Rate limited">Rate limited</span><span class="relative ml-auto flex shrink-0 items-center justify-end h-3.5 w-12"><span class="pointer-events-none shrink-0 text-[10px] leading-none text-muted-foreground/60" aria-hidden="true">6m ago</span></span></div><div class="mt-0.5 pl-5 text-[10px] leading-snug text-muted-foreground/70"> </div></div>",
+  "<div class="agent-disclosure-row group/agent-row relative -ml-2 flex flex-col py-1 px-2 cursor-pointer rounded-sm worktree-agent-row-hover" title="started 6m ago"><div class="flex items-center gap-1.5"><span class="inline-flex shrink-0 items-center justify-center" aria-label="Idle" data-state="closed" data-slot="tooltip-trigger"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="Idle"><span class="block rounded-full size-1.5 bg-neutral-500/40"></span></span></span><span class="block min-w-0 flex-1 overflow-hidden text-[11px] leading-snug transition-[height] duration-200 ease-out [interpolate-size:allow-keywords] h-[1lh] truncate font-normal text-muted-foreground" title="Teammate">Teammate</span><span class="relative ml-auto flex shrink-0 items-center justify-end h-3.5 w-12"><span class="pointer-events-none shrink-0 text-[10px] leading-none text-muted-foreground/60" aria-hidden="true">6m ago</span></span></div><div class="mt-0.5 pl-5 text-[10px] leading-snug text-muted-foreground/70"> </div></div>",
+  "<div class="agent-disclosure-row group/agent-row relative -ml-2 flex flex-col py-1 px-2 cursor-pointer rounded-sm worktree-agent-row-hover" title="No update in 5m • started 6m ago"><div class="flex items-center gap-1.5"><span class="inline-flex shrink-0 items-center justify-center" aria-label="No update in 5m" data-state="closed" data-slot="tooltip-trigger"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="No recent update"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-dashed text-amber-500 size-2.5" aria-hidden="true"><path d="M10.1 2.182a10 10 0 0 1 3.8 0"></path><path d="M13.9 21.818a10 10 0 0 1-3.8 0"></path><path d="M17.609 3.721a10 10 0 0 1 2.69 2.7"></path><path d="M2.182 13.9a10 10 0 0 1 0-3.8"></path><path d="M20.279 17.609a10 10 0 0 1-2.7 2.69"></path><path d="M21.818 10.1a10 10 0 0 1 0 3.8"></path><path d="M3.721 6.391a10 10 0 0 1 2.7-2.69"></path><path d="M6.391 20.279a10 10 0 0 1-2.69-2.7"></path></svg></span></span><span class="block min-w-0 flex-1 overflow-hidden text-[11px] leading-snug transition-[height] duration-200 ease-out [interpolate-size:allow-keywords] h-[1lh] truncate font-normal text-muted-foreground" title="Lost child">Lost child</span><span class="relative ml-auto flex shrink-0 items-center justify-end h-3.5 w-12"><span class="pointer-events-none shrink-0 text-[10px] leading-none text-muted-foreground/60" aria-hidden="true">No update in 5m</span></span></div><div class="mt-0.5 pl-5 text-[10px] leading-snug text-muted-foreground/70"> </div></div>",
+]
+`;
+
+exports[`sidebar child rows from a legacy subagents snapshot > render the full rows exactly as before 2`] = `
+[
+  "<div class="agent-disclosure-row group/agent-row relative -ml-2 flex flex-col py-1 px-2 cursor-pointer rounded-sm worktree-agent-row-hover" title="No update in 5m • started 10m ago"><div class="flex items-center gap-1.5"><span class="inline-flex shrink-0 items-center justify-center" aria-label="No update in 5m" data-state="closed" data-slot="tooltip-trigger"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="No recent update"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-dashed text-amber-500 size-2.5" aria-hidden="true"><path d="M10.1 2.182a10 10 0 0 1 3.8 0"></path><path d="M13.9 21.818a10 10 0 0 1-3.8 0"></path><path d="M17.609 3.721a10 10 0 0 1 2.69 2.7"></path><path d="M2.182 13.9a10 10 0 0 1 0-3.8"></path><path d="M20.279 17.609a10 10 0 0 1-2.7 2.69"></path><path d="M21.818 10.1a10 10 0 0 1 0 3.8"></path><path d="M3.721 6.391a10 10 0 0 1 2.7-2.69"></path><path d="M6.391 20.279a10 10 0 0 1-2.69-2.7"></path></svg></span></span><span class="block min-w-0 flex-1 overflow-hidden text-[11px] leading-snug transition-[height] duration-200 ease-out [interpolate-size:allow-keywords] h-[1lh] truncate font-normal text-muted-foreground" title="Review the parser">Review the parser</span><span class="max-w-24 shrink-0 truncate font-mono text-[10px] text-muted-foreground/70" title="claude-sonnet">claude-sonnet</span><span class="relative ml-auto flex shrink-0 items-center justify-end h-3.5 w-12"><span class="pointer-events-none shrink-0 text-[10px] leading-none text-muted-foreground/60" aria-hidden="true">No update in 5m</span></span></div><div class="mt-0.5 pl-5 text-[10px] leading-snug text-muted-foreground/70"> </div></div>",
+  "<div class="agent-disclosure-row group/agent-row relative -ml-2 flex flex-col py-1 px-2 cursor-pointer rounded-sm worktree-agent-row-hover" title="No update in 5m • started 8m ago"><div class="flex items-center gap-1.5"><span class="inline-flex shrink-0 items-center justify-center" aria-label="No update in 5m" data-state="closed" data-slot="tooltip-trigger"><span class="inline-flex shrink-0 items-center justify-center h-2.5 w-2.5" aria-label="No recent update"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-dashed text-amber-500 size-2.5" aria-hidden="true"><path d="M10.1 2.182a10 10 0 0 1 3.8 0"></path><path d="M13.9 21.818a10 10 0 0 1-3.8 0"></path><path d="M17.609 3.721a10 10 0 0 1 2.69 2.7"></path><path d="M2.182 13.9a10 10 0 0 1 0-3.8"></path><path d="M20.279 17.609a10 10 0 0 1-2.7 2.69"></path><path d="M21.818 10.1a10 10 0 0 1 0 3.8"></path><path d="M3.721 6.391a10 10 0 0 1 2.7-2.69"></path><path d="M6.391 20.279a10 10 0 0 1-2.69-2.7"></path></svg></span></span><span class="block min-w-0 flex-1 overflow-hidden text-[11px] leading-snug transition-[height] duration-200 ease-out [interpolate-size:allow-keywords] h-[1lh] truncate font-normal text-muted-foreground" title="Explore">Explore</span><span class="relative ml-auto flex shrink-0 items-center justify-end h-3.5 w-12"><span class="pointer-events-none shrink-0 text-[10px] leading-none text-muted-foreground/60" aria-hidden="true">No update in 5m</span></span></div><div class="mt-0.5 pl-5 text-[10px] leading-snug text-muted-foreground/70"> </div></div>",
+]
+`;
diff --git a/src/renderer/src/components/sidebar/add-repo-skip-finalization.test.ts b/src/renderer/src/components/sidebar/add-repo-skip-finalization.test.ts
index fac6aaa7a24..cafcf2225da 100644
--- a/src/renderer/src/components/sidebar/add-repo-skip-finalization.test.ts
+++ b/src/renderer/src/components/sidebar/add-repo-skip-finalization.test.ts
@@ -36,6 +36,7 @@ function makeState(overrides: Partial<AddRepoSkipFinalizationState>): AddRepoSki
     hideDefaultBranchWorkspace: false,
     showSleepingWorkspaces: true,
     alwaysShowDefaultBranchWorkspace: true,
+    repos: [],
     worktreesByRepo: {},
     setActiveRepo: vi.fn(),
     setFilterRepoIds: vi.fn(),
@@ -94,6 +95,69 @@ describe('finalizeImportedRepoAfterSkip', () => {
     expect(state.setHideDefaultBranchWorkspace).toHaveBeenCalledWith(false)
   })
 
+  it('clears default-branch hiding for a folder project whose only row is its root', () => {
+    const state = makeState({
+      hideDefaultBranchWorkspace: true,
+      repos: [{ id: 'folder-new', kind: 'folder' }],
+      worktreesByRepo: {
+        'folder-new': [
+          makeWorktree({
+            id: 'folder-new::/notes',
+            repoId: 'folder-new',
+            isMainWorktree: true,
+            head: '',
+            branch: ''
+          })
+        ]
+      }
+    })
+
+    finalizeImportedRepoAfterSkip(state, 'folder-new')
+
+    expect(state.setHideDefaultBranchWorkspace).toHaveBeenCalledWith(false)
+  })
+
+  it.each([false, true])(
+    'ignores archived siblings when revealing a folder root after Skip (root archived: %s)',
+    (rootArchived) => {
+      const state = makeState({
+        hideDefaultBranchWorkspace: true,
+        showSleepingWorkspaces: false,
+        alwaysShowDefaultBranchWorkspace: false,
+        repos: [{ id: 'folder-new', kind: 'folder' }],
+        worktreesByRepo: {
+          'folder-new': [
+            makeWorktree({
+              id: 'folder-new::/notes',
+              repoId: 'folder-new',
+              isMainWorktree: true,
+              head: '',
+              branch: '',
+              isArchived: rootArchived
+            }),
+            makeWorktree({
+              id: 'folder-new::/notes::workspace:archived',
+              repoId: 'folder-new',
+              head: '',
+              branch: '',
+              isArchived: true
+            })
+          ]
+        }
+      })
+
+      finalizeImportedRepoAfterSkip(state, 'folder-new')
+
+      if (rootArchived) {
+        expect(state.setHideDefaultBranchWorkspace).not.toHaveBeenCalled()
+        expect(state.setAlwaysShowDefaultBranchWorkspace).not.toHaveBeenCalled()
+      } else {
+        expect(state.setHideDefaultBranchWorkspace).toHaveBeenCalledWith(false)
+        expect(state.setAlwaysShowDefaultBranchWorkspace).toHaveBeenCalledWith(true)
+      }
+    }
+  )
+
   it('re-enables the default-branch exemption when the import would land asleep and hidden', () => {
     const state = makeState({
       showSleepingWorkspaces: false,
diff --git a/src/renderer/src/components/sidebar/add-repo-skip-finalization.ts b/src/renderer/src/components/sidebar/add-repo-skip-finalization.ts
index a37d14fd8f2..42a7c00b99a 100644
--- a/src/renderer/src/components/sidebar/add-repo-skip-finalization.ts
+++ b/src/renderer/src/components/sidebar/add-repo-skip-finalization.ts
@@ -1,3 +1,4 @@
+import type { Repo } from '../../../../shared/repo-types'
 import type { Worktree } from '../../../../shared/worktree/types'
 import { isDefaultBranchWorkspace } from './default-branch-workspace'
 import { revealRepoInProjectFilter, type ProjectFilterRevealState } from './project-filter-reveal'
@@ -8,6 +9,7 @@ export type AddRepoSkipFinalizationState = ProjectFilterRevealState & {
   hideDefaultBranchWorkspace: boolean
   showSleepingWorkspaces: boolean
   alwaysShowDefaultBranchWorkspace: boolean
+  repos: readonly Pick<Repo, 'id' | 'kind'>[]
   worktreesByRepo: Record<string, Worktree[]>
   setActiveRepo: (repoId: string | null) => void
   setShowActiveOnly: (value: boolean) => void
@@ -19,7 +21,10 @@ export function finalizeImportedRepoAfterSkip(
   state: AddRepoSkipFinalizationState,
   importedRepoId: string
 ): void {
-  const importedWorktrees = state.worktreesByRepo[importedRepoId] ?? []
+  const importedWorktrees = (state.worktreesByRepo[importedRepoId] ?? []).filter(
+    (worktree) => !worktree.isArchived
+  )
+  const importedRepo = state.repos.find((repo) => repo.id === importedRepoId)
 
   // Why: Skip means "do not open or create a worktree", not "hide the
   // imported project behind sidebar filters so it looks like nothing landed."
@@ -33,7 +38,7 @@ export function finalizeImportedRepoAfterSkip(
   if (
     importedWorktrees.length > 0 &&
     state.hideDefaultBranchWorkspace &&
-    importedWorktrees.every((worktree) => isDefaultBranchWorkspace(worktree))
+    importedWorktrees.every((worktree) => isDefaultBranchWorkspace(worktree, importedRepo))
   ) {
     state.setHideDefaultBranchWorkspace(false)
   }
diff --git a/src/renderer/src/components/sidebar/default-branch-folder-project-root.test.ts b/src/renderer/src/components/sidebar/default-branch-folder-project-root.test.ts
new file mode 100644
index 00000000000..36ea57f2e9c
--- /dev/null
+++ b/src/renderer/src/components/sidebar/default-branch-folder-project-root.test.ts
@@ -0,0 +1,139 @@
+import { describe, expect, it } from 'vitest'
+import { LOCAL_EXECUTION_HOST_ID } from '../../../../shared/execution-host'
+import type { Repo } from '../../../../shared/repo-types'
+import type { WorktreeLineage } from '../../../../shared/worktree/lineage-types'
+import type { Worktree } from '../../../../shared/worktree/types'
+import { isDefaultBranchWorkspace } from './default-branch-workspace'
+import { computeVisibleWorktreeIds } from './visible-worktrees'
+
+function makeRepo(id: string, path: string, kind: Repo['kind']): Repo {
+  return { id, path, displayName: id, badgeColor: '#000', addedAt: 0, kind }
+}
+
+function makeRow(repo: Repo, overrides: Partial<Worktree> & { id: string }): Worktree {
+  return {
+    repoId: repo.id,
+    path: repo.path,
+    head: 'abc123',
+    branch: 'refs/heads/main',
+    isBare: false,
+    isMainWorktree: true,
+    displayName: repo.id,
+    comment: '',
+    linkedIssue: null,
+    linkedPR: null,
+    linkedLinearIssue: null,
+    isArchived: false,
+    isUnread: false,
+    isPinned: false,
+    sortOrder: 0,
+    lastActivityAt: 0,
+    ...overrides
+  }
+}
+
+// Mirrors mergeFolderWorkspace: every row of a folder project has no head or branch,
+// and only the root (id `${repoId}::${path}`) is the main worktree.
+function folderProjectRows(repo: Repo): { root: Worktree; instance: Worktree } {
+  const rootId = `${repo.id}::${repo.path}`
+  return {
+    root: makeRow(repo, { id: rootId, head: '', branch: '' }),
+    instance: makeRow(repo, {
+      id: `${rootId}::workspace:task-1`,
+      head: '',
+      branch: '',
+      isMainWorktree: false
+    })
+  }
+}
+
+function visibleWithHideDefault(
+  repos: Repo[],
+  worktrees: Worktree[],
+  worktreeLineageById: Record<string, WorktreeLineage> = {},
+  injectLineageAncestors = true
+): string[] {
+  const worktreesByRepo: Record<string, Worktree[]> = {}
+  for (const worktree of worktrees) {
+    ;(worktreesByRepo[worktree.repoId] ??= []).push(worktree)
+  }
+  return computeVisibleWorktreeIds(
+    worktreesByRepo,
+    worktrees.map((worktree) => worktree.id),
+    {
+      filterRepoIds: [],
+      showSleepingWorkspaces: true,
+      tabsByWorktree: {},
+      ptyIdsByTabId: {},
+      browserTabsByWorktree: {},
+      worktreeIdsWithLiveAgent: new Set(),
+      hideDefaultBranchWorkspace: true,
+      hideAutomationGeneratedWorkspaces: false,
+      hideCliCreatedWorkspaces: false,
+      hideDetachedHeadWorkspaces: false,
+      hideWorkspacesFromOtherDevices: false,
+      pairedDeviceIdsByEnvironment: new Map(),
+      repoMap: new Map(repos.map((repo) => [repo.id, repo])),
+      workspaceHostScope: 'all',
+      defaultHostId: LOCAL_EXECUTION_HOST_ID,
+      worktreeLineageById,
+      injectLineageAncestors
+    }
+  )
+}
+
+describe('"Hide default branch" on folder projects', () => {
+  it('hides the root of a non-git folder project and keeps its other workspaces', () => {
+    const repo = makeRepo('notes', '/Users/me/notes', 'folder')
+    const { root, instance } = folderProjectRows(repo)
+
+    expect(isDefaultBranchWorkspace(root, repo)).toBe(true)
+    expect(isDefaultBranchWorkspace(instance, repo)).toBe(false)
+    expect(visibleWithHideDefault([repo], [root, instance])).toEqual([instance.id])
+  })
+
+  it('hides the root of a folder project added from a git subdirectory', () => {
+    const repo = makeRepo('app', '/Users/me/monorepo/packages/app', 'folder')
+    const { root, instance } = folderProjectRows(repo)
+
+    expect(visibleWithHideDefault([repo], [root, instance])).toEqual([instance.id])
+  })
+
+  it('preserves the sidebar hierarchy exception for a folder root with a visible child', () => {
+    const repo = makeRepo('notes', '/notes', 'folder')
+    const rows = folderProjectRows(repo)
+    const root = { ...rows.root, instanceId: 'root-instance' }
+    const child = { ...rows.instance, instanceId: 'child-instance' }
+    const lineage: WorktreeLineage = {
+      worktreeId: child.id,
+      worktreeInstanceId: child.instanceId,
+      parentWorktreeId: root.id,
+      parentWorktreeInstanceId: root.instanceId,
+      origin: 'cli',
+      capture: { source: 'terminal-context', confidence: 'inferred' },
+      createdAt: 1
+    }
+
+    expect(visibleWithHideDefault([repo], [root, child], { [child.id]: lineage })).toEqual([
+      root.id,
+      child.id
+    ])
+    expect(visibleWithHideDefault([repo], [root, child], { [child.id]: lineage }, false)).toEqual([
+      child.id
+    ])
+  })
+
+  it('keeps an empty-branch git main visible: detached HEAD, or an SSH row synthesized offline', () => {
+    const repo = makeRepo('repo', '/code/repo', 'git')
+    const remoteRepo = makeRepo('remote', '/srv/remote', 'git')
+    const detached = makeRow(repo, { id: 'repo::/code/repo', branch: '' })
+    const sshOffline = makeRow(remoteRepo, { id: 'remote::/srv/remote', branch: '', head: '' })
+
+    expect(isDefaultBranchWorkspace(detached, repo)).toBe(false)
+    expect(isDefaultBranchWorkspace(sshOffline, remoteRepo)).toBe(false)
+    expect(visibleWithHideDefault([repo, remoteRepo], [detached, sshOffline])).toEqual([
+      detached.id,
+      sshOffline.id
+    ])
+  })
+})
diff --git a/src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts b/src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts
index a0452e2f508..c2fb8091390 100644
--- a/src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts
+++ b/src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts
@@ -68,7 +68,7 @@ function visibleOptions(overrides: Partial<VisibleOptions> = {}): VisibleOptions
 
 describe('#8873 default-branch workspace under "Hide sleeping"', () => {
   it('is genuinely the default-branch row the "Hide default branch" toggle targets', () => {
-    expect(isDefaultBranchWorkspace(makeDefaultBranchWorktree())).toBe(true)
+    expect(isDefaultBranchWorkspace(makeDefaultBranchWorktree(), repoMap.get('repo1'))).toBe(true)
   })
 
   it('stays in the sidebar when it is sleeping and "Hide sleeping" is on', () => {
@@ -154,16 +154,14 @@ describe('the "Hide sleeping" exemption for project entry-point rows', () => {
   })
 
   it('keeps a sleeping folder workspace, which has no sibling row to fall back to', () => {
-    // Folder-mode projects are main worktrees with an empty branch/head, so the
-    // default-branch predicate rejects them; sweeping them drops the whole project.
+    // Folder-mode projects are main worktrees with an empty branch/head; sweeping
+    // them drops the whole project.
     const folder: Worktree = {
       ...makeDefaultBranchWorktree(),
       id: 'wt-folder',
       branch: '',
       head: ''
     }
-    expect(isDefaultBranchWorkspace(folder)).toBe(false)
-
     expect(visible([folder], { alwaysShowDefaultBranchWorkspace: true })).toEqual([folder.id])
   })
 
diff --git a/src/renderer/src/components/sidebar/default-branch-workspace.ts b/src/renderer/src/components/sidebar/default-branch-workspace.ts
index 43404232066..c57d2c68c5d 100644
--- a/src/renderer/src/components/sidebar/default-branch-workspace.ts
+++ b/src/renderer/src/components/sidebar/default-branch-workspace.ts
@@ -1,10 +1,16 @@
+import { isFolderRepo } from '../../../../shared/repo-kind'
+import type { Repo } from '../../../../shared/repo-types'
 import type { Worktree } from '../../../../shared/worktree/types'
 
 /** Keeps provisioned roots visible because they are the recipe-created workspace, not a source-repo row. */
-export function isDefaultBranchWorkspace(worktree: Worktree): boolean {
-  return (
-    worktree.isMainWorktree &&
-    worktree.branch.trim() !== '' &&
-    worktree.ephemeralVmCheckoutMode !== 'provisioned-root'
-  )
+export function isDefaultBranchWorkspace(
+  worktree: Worktree,
+  repo: Pick<Repo, 'kind'> | undefined
+): boolean {
+  if (!worktree.isMainWorktree || worktree.ephemeralVmCheckoutMode === 'provisioned-root') {
+    return false
+  }
+  // Why: a folder project's root is its default workspace but has no branch; on a git repo an
+  // empty branch means detached HEAD or an offline SSH row, which stay visible.
+  return worktree.branch.trim() !== '' || (repo !== undefined && isFolderRepo(repo))
 }
diff --git a/src/renderer/src/components/sidebar/folder-workspace-composer-expiry.test.tsx b/src/renderer/src/components/sidebar/folder-workspace-composer-expiry.test.tsx
new file mode 100644
index 00000000000..1361252d5ff
--- /dev/null
+++ b/src/renderer/src/components/sidebar/folder-workspace-composer-expiry.test.tsx
@@ -0,0 +1,309 @@
+// @vitest-environment happy-dom
+
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ProjectGroup } from '../../../../shared/project-group-types'
+import { FOLDER_WORKSPACE_PATH_STATUS_TTL_MS } from '../../../../shared/folder-workspace-path-status'
+import type { FolderWorkspacePathStatusCacheEntry } from '@/store/repos/repo-state'
+import { useAppStore } from '@/store'
+import { getFolderWorkspaceStatusRequestSnapshot } from '@/store/folder-workspaces/folder-path-status'
+import { useFolderWorkspaceComposerPathStatus } from './folder-workspace-composer-path-status'
+
+const initialState = useAppStore.getInitialState()
+const group: ProjectGroup = {
+  id: 'selected',
+  name: 'Folder',
+  parentPath: '/folder',
+  parentGroupId: null,
+  createdFrom: 'manual',
+  tabOrder: 0,
+  isCollapsed: false,
+  color: null,
+  createdAt: 0,
+  updatedAt: 0
+}
+const request = { scope: 'project-group', projectGroupId: group.id } as const
+const getPathStatus = vi.fn<Window['api']['folderWorkspaces']['getPathStatus']>()
+let originalApi: PropertyDescriptor | undefined
+
+function unrelatedEntries(): Record<string, FolderWorkspacePathStatusCacheEntry> {
+  const entries: Record<string, FolderWorkspacePathStatusCacheEntry> = {}
+  for (let index = 1; index <= 100; index += 1) {
+    entries[`local:project-group:unrelated-${index}`] = {
+      status: { path: `/unrelated-${index}`, exists: true },
+      checkedAt: Date.now() - FOLDER_WORKSPACE_PATH_STATUS_TTL_MS + index * 10,
+      requestSnapshot: 'unrelated'
+    }
+  }
+  return entries
+}
+
+async function expireUnrelatedEntries(): Promise<void> {
+  for (let index = 0; index < 1010; index += 1) {
+    await act(async () => vi.advanceTimersByTimeAsync(1))
+  }
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.setSystemTime(100_000)
+  getPathStatus.mockReset().mockResolvedValue({ path: '/folder', exists: true })
+  originalApi = Object.getOwnPropertyDescriptor(window, 'api')
+  Object.defineProperty(window, 'api', {
+    configurable: true,
+    value: { folderWorkspaces: { getPathStatus } }
+  })
+  useAppStore.setState(
+    {
+      ...initialState,
+      projectGroups: [group],
+      folderWorkspaces: [],
+      repos: [],
+      folderWorkspacePathStatuses: unrelatedEntries(),
+      settings: null
+    },
+    true
+  )
+})
+
+afterEach(() => {
+  cleanup()
+  expect(vi.getTimerCount()).toBe(0)
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+  useAppStore.setState(initialState, true)
+  if (originalApi) {
+    Object.defineProperty(window, 'api', originalApi)
+  } else {
+    Reflect.deleteProperty(window, 'api')
+  }
+})
+
+describe('folder composer cache expiry requests', () => {
+  it('retains unrelated-expiry and reopen retries after an uncached failure', async () => {
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    getPathStatus.mockRejectedValueOnce(new Error('Unavailable'))
+    const hook = renderHook(({ open }) => useFolderWorkspaceComposerPathStatus(group, open, null), {
+      initialProps: { open: true }
+    })
+    await act(async () => {})
+    await expireUnrelatedEntries()
+    expect(getPathStatus).toHaveBeenCalledTimes(2)
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+    hook.rerender({ open: false })
+    hook.rerender({ open: true })
+    await act(async () => {})
+    expect(getPathStatus).toHaveBeenCalledTimes(3)
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+  })
+
+  it('does not refetch a fresh selected folder when other entries expire', async () => {
+    const hook = renderHook(() => useFolderWorkspaceComposerPathStatus(group, true, null))
+    await act(async () => {})
+    await expireUnrelatedEntries()
+
+    expect(getPathStatus).toHaveBeenCalledExactlyOnceWith(request)
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+  })
+
+  it('retains expiry-triggered checks while the first result is unknown', async () => {
+    const gate = Promise.withResolvers<{ path: string; exists: boolean }>()
+    getPathStatus.mockReturnValue(gate.promise)
+    const hook = renderHook(() => useFolderWorkspaceComposerPathStatus(group, true, null))
+    await expireUnrelatedEntries()
+
+    expect(getPathStatus).toHaveBeenCalledTimes(101)
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(true)
+    await act(async () => gate.resolve({ path: '/folder', exists: true }))
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+  })
+
+  it('refreshes at the selected entry expiry and blocks while that refresh is pending', async () => {
+    useAppStore.setState({ folderWorkspacePathStatuses: {} })
+    const gate = Promise.withResolvers<{ path: string; exists: boolean }>()
+    getPathStatus
+      .mockResolvedValueOnce({ path: '/folder', exists: true })
+      .mockReturnValueOnce(gate.promise)
+    const hook = renderHook(() => useFolderWorkspaceComposerPathStatus(group, true, null))
+    await act(async () => {})
+    await act(async () => vi.advanceTimersByTimeAsync(FOLDER_WORKSPACE_PATH_STATUS_TTL_MS))
+    expect(getPathStatus).toHaveBeenCalledOnce()
+    await act(async () => vi.advanceTimersByTimeAsync(1))
+
+    expect(getPathStatus).toHaveBeenCalledTimes(2)
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(true)
+    await act(async () => gate.resolve({ path: '/folder', exists: true }))
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+  })
+
+  it('does not check a folder without a selected group', async () => {
+    renderHook(() => useFolderWorkspaceComposerPathStatus(null, true, null))
+    await expireUnrelatedEntries()
+    expect(getPathStatus).not.toHaveBeenCalled()
+  })
+
+  it.each(['missing', 'not-directory', 'ambiguous-connection'] as const)(
+    'retains unrelated-expiry recovery after a cached %s refresh fails',
+    async (reason) => {
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      getPathStatus
+        .mockResolvedValueOnce({ path: '/folder', exists: false, reason })
+        .mockRejectedValueOnce(new Error('Unavailable'))
+      const hook = renderHook(() => useFolderWorkspaceComposerPathStatus(group, true, null))
+      await act(async () => {})
+      await expireUnrelatedEntries()
+      expect(getPathStatus).toHaveBeenCalledOnce()
+      expect(hook.result.current.pathStatusBlocksCreate).toBe(true)
+      await act(async () => vi.advanceTimersByTimeAsync(8991))
+      expect(getPathStatus).toHaveBeenCalledTimes(2)
+      expect(hook.result.current.pathStatusBlocksCreate).toBe(true)
+      await act(async () => {
+        useAppStore.setState((state) => ({
+          folderWorkspacePathStatuses: {
+            ...state.folderWorkspacePathStatuses,
+            unrelated: {
+              checkedAt: Date.now() - FOLDER_WORKSPACE_PATH_STATUS_TTL_MS + 10,
+              requestSnapshot: '',
+              status: { path: '/other', exists: true }
+            }
+          }
+        }))
+      })
+      await act(async () => vi.advanceTimersByTimeAsync(11))
+      expect(getPathStatus).toHaveBeenCalledTimes(3)
+      expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+    }
+  )
+
+  it('forces the initial check even when a matching fresh result is already cached', async () => {
+    const snapshot = getFolderWorkspaceStatusRequestSnapshot(useAppStore.getState(), request)
+    expect(snapshot).not.toBeNull()
+    useAppStore.setState({
+      folderWorkspacePathStatuses: {
+        'local:project-group:selected': {
+          checkedAt: Date.now(),
+          requestSnapshot: snapshot ?? '',
+          status: { path: '/folder', exists: false, reason: 'missing' }
+        }
+      }
+    })
+    const hook = renderHook(() => useFolderWorkspaceComposerPathStatus(group, true, null))
+    await act(async () => {})
+    expect(getPathStatus).toHaveBeenCalledExactlyOnceWith(request)
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+  })
+
+  it('retries a fresh timestamp whose request snapshot is no longer current', async () => {
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    getPathStatus.mockRejectedValueOnce(new Error('Unavailable'))
+    useAppStore.setState((state) => ({
+      folderWorkspacePathStatuses: {
+        ...state.folderWorkspacePathStatuses,
+        'local:project-group:selected': {
+          checkedAt: Date.now(),
+          requestSnapshot: 'old-folder-snapshot',
+          status: { path: '/old-folder', exists: false, reason: 'missing' }
+        }
+      }
+    }))
+    const hook = renderHook(() => useFolderWorkspaceComposerPathStatus(group, true, null))
+    await act(async () => {})
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(true)
+    await act(async () => vi.advanceTimersByTimeAsync(11))
+    expect(getPathStatus).toHaveBeenCalledTimes(2)
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+  })
+
+  it('does not report a nonexistent pending check when cache is cleared after a skipped expiry', async () => {
+    const hook = renderHook(() => useFolderWorkspaceComposerPathStatus(group, true, null))
+    await act(async () => {})
+    await act(async () => vi.advanceTimersByTimeAsync(11))
+    expect(getPathStatus).toHaveBeenCalledOnce()
+    await act(async () => useAppStore.setState({ folderWorkspacePathStatuses: {} }))
+    expect(getPathStatus).toHaveBeenCalledOnce()
+    expect(vi.getTimerCount()).toBe(0)
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+  })
+
+  it('keeps a real pending check pending when fresh cache is removed after unrelated expiry', async () => {
+    const snapshot = getFolderWorkspaceStatusRequestSnapshot(useAppStore.getState(), request)
+    expect(snapshot).not.toBeNull()
+    useAppStore.setState((state) => ({
+      folderWorkspacePathStatuses: {
+        ...state.folderWorkspacePathStatuses,
+        'local:project-group:selected': {
+          checkedAt: Date.now(),
+          requestSnapshot: snapshot ?? '',
+          status: { path: '/folder', exists: true }
+        }
+      }
+    }))
+    const gate = Promise.withResolvers<{ path: string; exists: boolean }>()
+    getPathStatus.mockReturnValue(gate.promise)
+    const hook = renderHook(() => useFolderWorkspaceComposerPathStatus(group, true, null))
+    await act(async () => vi.advanceTimersByTimeAsync(11))
+    expect(getPathStatus).toHaveBeenCalledTimes(2)
+    await act(async () => useAppStore.setState({ folderWorkspacePathStatuses: {} }))
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(true)
+    await act(async () => gate.resolve({ path: '/folder', exists: true }))
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+  })
+
+  it('uses the selected runtime cache entry instead of a same-group local entry', async () => {
+    const fetchStatus = vi.fn().mockResolvedValue(null)
+    const snapshot = getFolderWorkspaceStatusRequestSnapshot(useAppStore.getState(), request)
+    expect(snapshot).not.toBeNull()
+    const makeEntry = (checkedAt: number): FolderWorkspacePathStatusCacheEntry => ({
+      checkedAt,
+      status: { path: '/folder', exists: true },
+      requestSnapshot: snapshot ?? ''
+    })
+    useAppStore.setState({
+      fetchFolderWorkspacePathStatus: fetchStatus,
+      folderWorkspacePathStatuses: {
+        'local:project-group:selected': makeEntry(90_010),
+        'environment:env-1:project-group:selected': makeEntry(100_000)
+      }
+    })
+    const hook = renderHook(() => useFolderWorkspaceComposerPathStatus(group, true, 'env-1'))
+    await act(async () => {})
+    await act(async () => vi.advanceTimersByTimeAsync(11))
+    expect(fetchStatus).toHaveBeenCalledExactlyOnceWith(request, {
+      force: true,
+      runtimeEnvironmentId: 'env-1'
+    })
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+    await act(async () => vi.advanceTimersByTimeAsync(9990))
+    expect(fetchStatus).toHaveBeenCalledTimes(2)
+  })
+
+  it('replaces the timer when the selected group changes', async () => {
+    const secondGroup: ProjectGroup = { ...group, id: 'second', parentPath: '/second' }
+    useAppStore.setState({ projectGroups: [group, secondGroup], folderWorkspacePathStatuses: {} })
+    getPathStatus.mockImplementation(async (input) => ({
+      path:
+        input.scope === 'project-group' && input.projectGroupId === 'second'
+          ? '/second'
+          : '/folder',
+      exists: true
+    }))
+    const hook = renderHook(
+      ({ selected }) => useFolderWorkspaceComposerPathStatus(selected, true, null),
+      {
+        initialProps: { selected: group }
+      }
+    )
+    await act(async () => {})
+    await act(async () => vi.advanceTimersByTimeAsync(5000))
+    hook.rerender({ selected: secondGroup })
+    await act(async () => {})
+    getPathStatus.mockClear()
+    await act(async () => vi.advanceTimersByTimeAsync(5001))
+    expect(getPathStatus).not.toHaveBeenCalled()
+    await act(async () => vi.advanceTimersByTimeAsync(5000))
+    expect(getPathStatus).toHaveBeenCalledExactlyOnceWith({
+      scope: 'project-group',
+      projectGroupId: 'second'
+    })
+  })
+})
diff --git a/src/renderer/src/components/sidebar/folder-workspace-composer-path-status.ts b/src/renderer/src/components/sidebar/folder-workspace-composer-path-status.ts
index 911c373191d..f014c915f3e 100644
--- a/src/renderer/src/components/sidebar/folder-workspace-composer-path-status.ts
+++ b/src/renderer/src/components/sidebar/folder-workspace-composer-path-status.ts
@@ -37,6 +37,14 @@ export function useFolderWorkspaceComposerPathStatus(
   )
   const cacheExpiryTick = useFolderWorkspacePathStatusCacheExpiryTick(folderWorkspacePathStatuses)
   const activePathStatusRefreshIdRef = useRef(0)
+  const previousPathStatusRefreshRef = useRef<{
+    request: typeof pathStatusRequest
+    cacheKey: string
+    refreshKey: string
+    runtimeEnvironmentId: typeof runtimeEnvironmentId
+    fetchStatus: typeof fetchFolderWorkspacePathStatus
+    pending: boolean
+  } | null>(null)
   const [completedPathStatusRefreshKeys, setCompletedPathStatusRefreshKeys] = useState<
     ReadonlySet<string>
   >(() => new Set())
@@ -72,7 +80,40 @@ export function useFolderWorkspaceComposerPathStatus(
   ])
 
   useEffect(() => {
-    if (!open || !pathStatusRequest || pathStatusRefreshKey === null) {
+    if (!open || !pathStatusRequest || pathStatusRefreshKey === null || !pathStatusCacheKey) {
+      previousPathStatusRefreshRef.current = null
+      return
+    }
+    const previousRefresh = previousPathStatusRefreshRef.current
+    const refresh = {
+      request: pathStatusRequest,
+      cacheKey: pathStatusCacheKey,
+      refreshKey: pathStatusRefreshKey,
+      runtimeEnvironmentId,
+      fetchStatus: fetchFolderWorkspacePathStatus,
+      pending: true
+    }
+    previousPathStatusRefreshRef.current = refresh
+    const completeRefresh = (): void => {
+      refresh.pending = false
+      setCompletedPathStatusRefreshKeys((current) => {
+        if (current.has(pathStatusRefreshKey)) {
+          return current
+        }
+        return new Set(current).add(pathStatusRefreshKey)
+      })
+    }
+    // Another folder's expiry does not invalidate this folder's fresh result.
+    if (
+      previousRefresh?.request === pathStatusRequest &&
+      previousRefresh.cacheKey === pathStatusCacheKey &&
+      previousRefresh.refreshKey !== pathStatusRefreshKey &&
+      previousRefresh.runtimeEnvironmentId === runtimeEnvironmentId &&
+      previousRefresh.fetchStatus === fetchFolderWorkspacePathStatus &&
+      !previousRefresh.pending &&
+      getFreshFolderWorkspacePathStatus(pathStatusRequest, pathStatusRouteOptions) !== null
+    ) {
+      completeRefresh()
       return
     }
     const refreshId = activePathStatusRefreshIdRef.current + 1
@@ -91,18 +132,16 @@ export function useFolderWorkspaceComposerPathStatus(
       if (activePathStatusRefreshIdRef.current !== refreshId) {
         return
       }
-      setCompletedPathStatusRefreshKeys((current) => {
-        if (current.has(pathStatusRefreshKey)) {
-          return current
-        }
-        return new Set(current).add(pathStatusRefreshKey)
-      })
+      completeRefresh()
     })
   }, [
     fetchFolderWorkspacePathStatus,
+    getFreshFolderWorkspacePathStatus,
     open,
+    pathStatusCacheKey,
     pathStatusRefreshKey,
     pathStatusRequest,
+    pathStatusRouteOptions,
     runtimeEnvironmentId
   ])
 
diff --git a/src/renderer/src/components/sidebar/folder-workspace-composer-submit.test.ts b/src/renderer/src/components/sidebar/folder-workspace-composer-submit.test.ts
index ef27dfcc03b..6976647ed8b 100644
--- a/src/renderer/src/components/sidebar/folder-workspace-composer-submit.test.ts
+++ b/src/renderer/src/components/sidebar/folder-workspace-composer-submit.test.ts
@@ -71,19 +71,11 @@ function makeFolderWorkspace(overrides: Partial<FolderWorkspace> = {}): FolderWo
 describe('submitFolderWorkspaceCreate', () => {
   beforeEach(() => {
     mocks.activateAndRevealFolderWorkspace.mockReturnValue({ primaryTabId: 'tab-1' })
-    Object.assign(window, {
-      api: {
-        agentTrust: {
-          markTrusted: vi.fn().mockResolvedValue(undefined)
-        }
-      }
-    })
   })
 
   afterEach(() => {
     mocks.activateAndRevealFolderWorkspace.mockReset()
     mocks.ensureAgentStartupInTerminal.mockReset()
-    Reflect.deleteProperty(window, 'api')
     vi.restoreAllMocks()
   })
 
@@ -313,10 +305,6 @@ describe('submitFolderWorkspaceCreate', () => {
     expect(startup?.command).toBe('codex')
     expect(startup?.command).not.toContain(linkedWorkItem.url)
     expect(startup?.command).not.toContain('Review this before starting')
-    expect(window.api.agentTrust?.markTrusted).toHaveBeenCalledWith({
-      preset: 'codex',
-      workspacePath: '/repo/platform/hi'
-    })
     expect(mocks.ensureAgentStartupInTerminal).toHaveBeenCalledWith({
       worktreeId: folderWorkspaceKey('folder-workspace-1'),
       primaryTabId: 'tab-1',
@@ -329,7 +317,7 @@ describe('submitFolderWorkspaceCreate', () => {
     })
   })
 
-  it('pre-marks remote linked Codex folder workspaces trusted before draft paste', async () => {
+  it('pastes the linked draft for remote Codex folder workspaces', async () => {
     const createFolderWorkspace = vi.fn(async () =>
       makeFolderWorkspace({
         connectionId: 'ssh-1',
@@ -364,11 +352,6 @@ describe('submitFolderWorkspaceCreate', () => {
       onOpenChange: vi.fn()
     })
 
-    expect(window.api.agentTrust?.markTrusted).toHaveBeenCalledWith({
-      preset: 'codex',
-      workspacePath: '/home/alice/platform/Trust remote folder draft',
-      connectionId: 'ssh-1'
-    })
     expect(mocks.ensureAgentStartupInTerminal).toHaveBeenCalledWith(
       expect.objectContaining({
         worktreeId: folderWorkspaceKey('folder-workspace-1'),
@@ -708,16 +691,12 @@ describe('submitFolderWorkspaceCreate native-chat launch draft', () => {
   beforeEach(() => {
     mocks.activateAndRevealFolderWorkspace.mockReturnValue({ primaryTabId: 'tab-1' })
     useAppStore.setState({ nativeChatLaunchDraftByTabId: {} })
-    Object.assign(window, {
-      api: { agentTrust: { markTrusted: vi.fn().mockResolvedValue(undefined) } }
-    })
   })
 
   afterEach(() => {
     mocks.activateAndRevealFolderWorkspace.mockReset()
     mocks.ensureAgentStartupInTerminal.mockReset()
     useAppStore.setState({ nativeChatLaunchDraftByTabId: {} })
-    Reflect.deleteProperty(window, 'api')
     vi.restoreAllMocks()
   })
 
@@ -816,16 +795,12 @@ describe('folder-workspace draft: seeded set == chat-opening set', () => {
   beforeEach(() => {
     mocks.activateAndRevealFolderWorkspace.mockReturnValue({ primaryTabId: 'tab-1' })
     useAppStore.setState({ nativeChatLaunchDraftByTabId: {} })
-    Object.assign(window, {
-      api: { agentTrust: { markTrusted: vi.fn().mockResolvedValue(undefined) } }
-    })
   })
 
   afterEach(() => {
     mocks.activateAndRevealFolderWorkspace.mockReset()
     mocks.ensureAgentStartupInTerminal.mockReset()
     useAppStore.setState({ nativeChatLaunchDraftByTabId: {} })
-    Reflect.deleteProperty(window, 'api')
     vi.restoreAllMocks()
   })
 
diff --git a/src/renderer/src/components/sidebar/folder-workspace-composer-submit.ts b/src/renderer/src/components/sidebar/folder-workspace-composer-submit.ts
index 62b29c8edb8..c4857877e11 100644
--- a/src/renderer/src/components/sidebar/folder-workspace-composer-submit.ts
+++ b/src/renderer/src/components/sidebar/folder-workspace-composer-submit.ts
@@ -1,6 +1,5 @@
 import { ensureAgentStartupInTerminal, type LinkedWorkItemSummary } from '@/lib/new-workspace'
 import { seedNativeChatLaunchDraftForAgentTab } from '@/lib/agent-launch-prompt-delivery'
-import { preflightAgentTrust } from '@/lib/agent-trust-preflight'
 import { createBrowserUuid } from '@/lib/browser-uuid'
 import { buildAgentStartupPlan } from '@/lib/tui-agent-startup'
 import { tuiAgentToAgentKind } from '@/lib/telemetry'
@@ -168,13 +167,6 @@ export async function submitFolderWorkspaceCreate({
   if (!workspace) {
     return false
   }
-  if (!structuredLaunch) {
-    await preflightAgentTrust({
-      agent: quickAgent,
-      workspacePath: workspace.folderPath,
-      connectionId: workspace.connectionId ?? projectGroup.connectionId
-    })
-  }
   if (startupPlan && !startupPlan.launchToken) {
     // Why: delayed delivery must target the exact pane spawned from this queued
     // startup, so both halves share one renderer-session token.
diff --git a/src/renderer/src/components/sidebar/project-added-default-checkout.test.ts b/src/renderer/src/components/sidebar/project-added-default-checkout.test.ts
index 71abdc34135..9871c255ca4 100644
--- a/src/renderer/src/components/sidebar/project-added-default-checkout.test.ts
+++ b/src/renderer/src/components/sidebar/project-added-default-checkout.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { getDefaultOnboardingState } from '../../../../shared/constants'
+import { getDefaultOnboardingState } from '../../../../shared/onboarding-defaults'
 import type { Repo } from '../../../../shared/repo-types'
 import type {
   DetectedWorktree,
diff --git a/src/renderer/src/components/sidebar/project-group-header-dom.test.ts b/src/renderer/src/components/sidebar/project-group-header-dom.test.ts
deleted file mode 100644
index 2e7523e5ecb..00000000000
--- a/src/renderer/src/components/sidebar/project-group-header-dom.test.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { fileURLToPath } from 'node:url'
-import { describe, expect, it } from 'vitest'
-
-function readWorktreeListSource(): string {
-  return readFileSync(
-    fileURLToPath(new URL('./worktree-list/rows/SectionHeader.tsx', import.meta.url)),
-    'utf8'
-  )
-}
-
-function readHeaderDragSource(): string {
-  return readFileSync(
-    fileURLToPath(new URL('./worktree-list/drag/use-header-drag.ts', import.meta.url)),
-    'utf8'
-  )
-}
-
-describe('Project Group header drag DOM source', () => {
-  it('renders concrete Project Group header drag attributes separately from repo headers', () => {
-    const source = readWorktreeListSource()
-
-    expect(source).toContain('data-project-group-header-id={projectGroupIdForHeader}')
-    expect(source).toContain('data-project-group-header-index={projectGroupHeaderIndex}')
-    expect(source).toContain('data-project-group-header-bucket={projectGroupHeaderBucketKey}')
-    expect(source).toContain('data-project-group-header-drag-handle=')
-  })
-
-  it('commits Project Group manual sorting through updateProjectGroup tabOrder', () => {
-    const source = readHeaderDragSource()
-
-    expect(source).toContain('const updateProjectGroup = useAppStore((s) => s.updateProjectGroup)')
-    // Why: the commit must carry the group's owner host so a non-focused host still persists the order.
-    expect(source).toContain(
-      'void updateProjectGroup(groupId, { tabOrder }, { hostId: ownerHostId ?? undefined })'
-    )
-  })
-
-  it('keeps grab cursor on the title surface and dual handle attrs on row + surface', () => {
-    // Why: lock the cursor/hit-test split so a cleanup does not put grab back on the whole row
-    // or drop row-level handle attrs that arm drag from indent/padding.
-    const source = readWorktreeListSource()
-    const headerBlockStart = source.indexOf('data-repo-header-id={projectIdForHeader}')
-    const headerBlockEnd = source.indexOf('<ProjectHeaderActions>', headerBlockStart)
-    expect(headerBlockStart).toBeGreaterThan(-1)
-    expect(headerBlockEnd).toBeGreaterThan(headerBlockStart)
-    const headerBlock = source.slice(headerBlockStart, headerBlockEnd)
-
-    // Dual handle placement: row (indent/padding) + title surface.
-    expect(headerBlock.match(/data-repo-header-drag-handle=/g)?.length).toBe(2)
-    expect(headerBlock.match(/data-project-group-header-drag-handle=/g)?.length).toBe(2)
-    // Surface owns grab; outer row only gets cursor-pointer when not draggable.
-    expect(headerBlock).toContain(
-      "!(isDraggableRepoHeader || isDraggableProjectGroupHeader) && 'cursor-pointer'"
-    )
-    expect(headerBlock).toContain("'flex min-w-0 flex-1 items-center gap-1.5 self-stretch'")
-    expect(headerBlock).toContain("'cursor-grab active:cursor-grabbing'")
-    // Row-level ternary grab must stay gone.
-    expect(headerBlock).not.toMatch(
-      /isDraggableRepoHeader \|\| isDraggableProjectGroupHeader\s*\?\s*'cursor-grab/
-    )
-  })
-})
diff --git a/src/renderer/src/components/sidebar/sidebar-filter-state.test.ts b/src/renderer/src/components/sidebar/sidebar-filter-state.test.ts
index c6945a7f041..5722f8e0b0e 100644
--- a/src/renderer/src/components/sidebar/sidebar-filter-state.test.ts
+++ b/src/renderer/src/components/sidebar/sidebar-filter-state.test.ts
@@ -7,6 +7,8 @@ import {
 import { isDefaultBranchWorkspace } from './default-branch-workspace'
 import type { Worktree } from '../../../../shared/worktree/types'
 
+const gitRepo = { kind: 'git' } as const
+
 function makeWorktree(id: string, repoId = 'repo1'): Worktree {
   return {
     id,
@@ -50,26 +52,34 @@ describe('isDefaultBranchWorkspace', () => {
   it('returns true for a branch-backed main worktree', () => {
     const main = makeWorktree('main')
     main.isMainWorktree = true
-    expect(isDefaultBranchWorkspace(main)).toBe(true)
+    expect(isDefaultBranchWorkspace(main, gitRepo)).toBe(true)
   })
 
-  it('returns false for folder-mode main worktrees (empty branch)', () => {
+  it('returns false for an empty-branch git main (detached HEAD or offline SSH row)', () => {
+    const detached = makeWorktree('detached')
+    detached.isMainWorktree = true
+    detached.branch = ''
+    expect(isDefaultBranchWorkspace(detached, gitRepo)).toBe(false)
+  })
+
+  it('returns true for a folder project root, which has no branch', () => {
     const folder = makeWorktree('folder')
     folder.isMainWorktree = true
     folder.branch = ''
-    expect(isDefaultBranchWorkspace(folder)).toBe(false)
+    folder.head = ''
+    expect(isDefaultBranchWorkspace(folder, { kind: 'folder' })).toBe(true)
   })
 
   it('returns false for non-main worktrees even on the default branch', () => {
     const feature = makeWorktree('feature')
-    expect(isDefaultBranchWorkspace(feature)).toBe(false)
+    expect(isDefaultBranchWorkspace(feature, gitRepo)).toBe(false)
   })
 
   it('keeps a provisioned root visible as the recipe-created workspace', () => {
     const provisionedRoot = makeWorktree('provisioned-root')
     provisionedRoot.isMainWorktree = true
     provisionedRoot.ephemeralVmCheckoutMode = 'provisioned-root'
-    expect(isDefaultBranchWorkspace(provisionedRoot)).toBe(false)
+    expect(isDefaultBranchWorkspace(provisionedRoot, gitRepo)).toBe(false)
   })
 })
 
diff --git a/src/renderer/src/components/sidebar/sleep-worktree-activation-race.test.ts b/src/renderer/src/components/sidebar/sleep-worktree-activation-race.test.ts
index bf7eb3c758e..5f3b588f93c 100644
--- a/src/renderer/src/components/sidebar/sleep-worktree-activation-race.test.ts
+++ b/src/renderer/src/components/sidebar/sleep-worktree-activation-race.test.ts
@@ -88,6 +88,7 @@ describe('sleep flow vs slept-workspace activation', () => {
     expect(mocks.resumeWorkspace).toHaveBeenCalledWith({ workspaceId: 'wt-parent' })
     expect(mocks.activateAndRevealWorktree).toHaveBeenCalledTimes(1)
     expect(mocks.activateAndRevealWorktree).toHaveBeenCalledWith('wt-parent', {
+      navigationIntent: 'user-open',
       revealInSidebar: false
     })
 
@@ -102,6 +103,7 @@ describe('sleep flow vs slept-workspace activation', () => {
     await activateWorktreeFromSidebar('wt-parent')
 
     expect(mocks.activateAndRevealWorktree).toHaveBeenCalledWith('wt-parent', {
+      navigationIntent: 'user-open',
       revealInSidebar: false
     })
     expect(mocks.toastError).toHaveBeenCalledWith(
diff --git a/src/renderer/src/components/sidebar/smart-attention.test.ts b/src/renderer/src/components/sidebar/smart-attention.test.ts
index e8bcfad610a..c1868cb9496 100644
--- a/src/renderer/src/components/sidebar/smart-attention.test.ts
+++ b/src/renderer/src/components/sidebar/smart-attention.test.ts
@@ -102,6 +102,27 @@ describe('mostRecentAttentionInHistory', () => {
     ).toBe(NOW - 4_000)
   })
 
+  it('counts a failed history done as attention and skips a cancelled one', () => {
+    expect(
+      mostRecentAttentionInHistory([
+        makeHistory('done', NOW - 4_000),
+        {
+          ...makeHistory('done', NOW - 1_000),
+          mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: NOW - 1_000 }
+        }
+      ])
+    ).toBe(NOW - 1_000)
+    expect(
+      mostRecentAttentionInHistory([
+        makeHistory('done', NOW - 4_000),
+        {
+          ...makeHistory('done', NOW - 1_000),
+          mainAgent: { state: 'done', outcome: 'cancellation', stateStartedAt: NOW - 1_000 }
+        }
+      ])
+    ).toBe(NOW - 4_000)
+  })
+
   it('returns null when only interrupted dones exist', () => {
     expect(mostRecentAttentionInHistory([makeHistory('done', NOW - 1_000, true)])).toBeNull()
   })
@@ -181,6 +202,31 @@ describe('resolveAttention', () => {
     expect(resolveAttention([hookPane(entry)], NOW)).toEqual(IDLE)
   })
 
+  it('ranks a failed done in Class 2 at its end time, like a completion', () => {
+    const entry = makeEntry({
+      paneKey: 't:1',
+      state: 'done',
+      mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: NOW - 90_000 },
+      stateStartedAt: NOW - 90_000,
+      updatedAt: NOW - 30_000
+    })
+    expect(resolveAttention([hookPane(entry)], NOW)).toEqual({
+      cls: 2,
+      attentionTimestamp: NOW - 90_000
+    })
+  })
+
+  it('still demotes a done the user stopped, recorded as a cancellation verdict', () => {
+    const entry = makeEntry({
+      paneKey: 't:1',
+      state: 'done',
+      mainAgent: { state: 'done', outcome: 'cancellation', stateStartedAt: NOW - 90_000 },
+      stateStartedAt: NOW - 90_000,
+      updatedAt: NOW - 30_000
+    })
+    expect(resolveAttention([hookPane(entry)], NOW)).toEqual(IDLE)
+  })
+
   it('treats a session boundary as idle unless it displaced a real completion', () => {
     const boundary = makeEntry({
       paneKey: 't:1',
diff --git a/src/renderer/src/components/sidebar/smart-attention.ts b/src/renderer/src/components/sidebar/smart-attention.ts
index 481dd0c2010..5130efe9379 100644
--- a/src/renderer/src/components/sidebar/smart-attention.ts
+++ b/src/renderer/src/components/sidebar/smart-attention.ts
@@ -1,5 +1,6 @@
 import { classifyTitleActivity, isExplicitAgentStatusFresh } from '@/lib/pane-agent-evidence'
 import { agentEntryCompletionAt } from '../../../../shared/agent-completion-time'
+import { agentTurnStoppedByUser } from '../../../../shared/agent-main-agent-verdict'
 import { migrationUnsupportedToAgentStatusEntry } from '@/lib/migration-unsupported-agent-entry'
 import { resolveDecayedAgentRowState } from '@/lib/agent-row-decay-state'
 import { tabHasLivePty } from '@/lib/tab-has-live-pty'
@@ -85,18 +86,15 @@ export function hasFreshAttributedAgentStatus(
 
 /**
  * Return the timestamp of the most recent `done`/`blocked`/`waiting` history row, ignoring
- * interrupted `done` rows (Ctrl+C). Returns `null` when no qualifying row exists.
+ * `done` rows the user stopped (Ctrl+C). Returns `null` when no qualifying row exists.
  */
 export function mostRecentAttentionInHistory(history: AgentStateHistoryEntry[]): number | null {
   let max = 0
   for (const h of history) {
-    // Why: setAgentStatus preserves `interrupted` on history rows, so filter them like the current entry.
-    if (h.state === 'done' && h.interrupted) {
-      continue
-    }
+    // Why: history rows keep the verdict, so filter a stopped turn like the current entry.
     if (h.state === 'done' || h.state === 'blocked' || h.state === 'waiting') {
       // Why: Infinity from a corrupted row would pin the worktree atop Class 3 forever; treat non-finite as missing.
-      if (!Number.isFinite(h.startedAt)) {
+      if (agentTurnStoppedByUser(h) || !Number.isFinite(h.startedAt)) {
         continue
       }
       if (h.startedAt > max) {
@@ -163,8 +161,8 @@ export function resolveAttention(panes: PaneInput[], now: number): WorktreeAtten
         ts = entry.stateStartedAt
         cause = entry.state
       } else if (entry.state === 'done') {
-        // Why: null covers interrupted `done` (Ctrl+C — user is finished with it) and idle session
-        // boundaries; neither is attention.
+        // Why: null covers a stopped `done` (not a completion) and idle session boundaries;
+        // neither is attention. A failed `done` ranks here: it is news the user has not seen.
         const completedAt = agentEntryCompletionAt(entry)
         if (completedAt === null) {
           continue
diff --git a/src/renderer/src/components/sidebar/smart-sort.test.ts b/src/renderer/src/components/sidebar/smart-sort.test.ts
index 3c0193fbc2e..6be13b7ceaf 100644
--- a/src/renderer/src/components/sidebar/smart-sort.test.ts
+++ b/src/renderer/src/components/sidebar/smart-sort.test.ts
@@ -85,7 +85,8 @@ function makeEntry(overrides: Partial<AgentStatusEntry> & { paneKey: string }):
     tabId: overrides.tabId,
     terminalTitle: overrides.terminalTitle,
     stateHistory: overrides.stateHistory ?? [],
-    interrupted: overrides.interrupted
+    interrupted: overrides.interrupted,
+    mainAgent: overrides.mainAgent
   }
 }
 
@@ -334,6 +335,31 @@ describe('smart sort — interrupted and stale handling', () => {
     expect(sorted.map((w) => w.id)).toEqual(['real-done', 'interrupted'])
   })
 
+  it('ranks a failed turn above an idle worktree and a cancelled one below it', () => {
+    const idle = makeWorktree({ id: 'idle', displayName: 'Idle', lastActivityAt: NOW - 10_000 })
+    const failed = makeWorktree({ id: 'failed', displayName: 'Failed', lastActivityAt: 0 })
+    const stopped = makeWorktree({ id: 'stopped', displayName: 'Stopped', lastActivityAt: 0 })
+    const tabs = {
+      [idle.id]: [makeTab({ id: 'tab-idle', worktreeId: idle.id })],
+      [failed.id]: [makeTab({ id: 'tab-failed', worktreeId: failed.id })],
+      [stopped.id]: [makeTab({ id: 'tab-stopped', worktreeId: stopped.id })]
+    }
+    const doneWith = (tabId: string, outcome: 'failure' | 'cancellation') =>
+      makeEntry({
+        paneKey: paneKey(tabId, '1'),
+        state: 'done',
+        mainAgent: { state: 'done', outcome, stateStartedAt: NOW - 60_000 },
+        stateStartedAt: NOW - 60_000,
+        updatedAt: NOW - 1_000
+      })
+    const entries = {
+      [paneKey('tab-failed', '1')]: doneWith('tab-failed', 'failure'),
+      [paneKey('tab-stopped', '1')]: doneWith('tab-stopped', 'cancellation')
+    }
+    const sorted = sortSmart([stopped, idle, failed], tabs, entries)
+    expect(sorted.map((w) => w.id)).toEqual(['failed', 'idle', 'stopped'])
+  })
+
   it('stale entries fall to Class 4', () => {
     const stale = makeWorktree({
       id: 'stale',
diff --git a/src/renderer/src/components/sidebar/subagent-child-row-fallback-pixels.test.tsx b/src/renderer/src/components/sidebar/subagent-child-row-fallback-pixels.test.tsx
new file mode 100644
index 00000000000..0be9f5ae546
--- /dev/null
+++ b/src/renderer/src/components/sidebar/subagent-child-row-fallback-pixels.test.tsx
@@ -0,0 +1,237 @@
+/** @vitest-environment happy-dom */
+import { renderToStaticMarkup } from 'react-dom/server'
+import { describe, expect, it, vi } from 'vitest'
+import type { AgentSessionBackgroundTask } from '../../../../shared/agent-session-wire'
+import type { AgentStatusEntry, AgentSubagentSnapshot } from '../../../../shared/agent-status-types'
+import type { TerminalTab } from '../../../../shared/terminal-tab-types'
+import DashboardAgentRow from '@/components/dashboard/DashboardAgentRow'
+import { NativeChatBackgroundTasksStatus } from '@/components/native-chat/NativeChatBackgroundTasksStatus'
+import { TooltipProvider } from '@/components/ui/tooltip'
+import { CompactAgentRow } from './worktree-card-compact-agent-row'
+import { buildSubagentChildRows } from './worktree-subagent-child-rows'
+
+vi.mock('@/components/dashboard/use-agent-row-conversation-name', () => ({
+  useAgentRowConversationName: () => null
+}))
+
+vi.mock('./CacheTimer', () => ({
+  default: () => null,
+  usePromptCacheCountdownForPane: () => null
+}))
+
+// Captured on the unmodified renderer: a host that sends only today's legacy shapes (an old host,
+// or any CLI pane) must keep rendering exactly these rows.
+
+const NOW = 1_000_000
+
+const tab: TerminalTab = {
+  id: 'parent-tab',
+  ptyId: null,
+  worktreeId: 'wt-1',
+  title: 'Parent',
+  customTitle: null,
+  color: null,
+  sortOrder: 0,
+  createdAt: 1
+}
+
+function parentWith(
+  subagents: AgentSubagentSnapshot[],
+  overrides: Partial<AgentStatusEntry> = {}
+): AgentStatusEntry {
+  return {
+    paneKey: 'parent-tab:leaf-1',
+    tabId: tab.id,
+    worktreeId: tab.worktreeId,
+    state: 'working',
+    prompt: 'parent prompt',
+    updatedAt: 700_000,
+    stateStartedAt: 10,
+    stateHistory: [],
+    subagents,
+    ...overrides
+  }
+}
+
+const SUBAGENTS: AgentSubagentSnapshot[] = [
+  {
+    id: 'described',
+    state: 'working',
+    startedAt: 400_000,
+    agentType: 'general-purpose',
+    model: 'claude-sonnet',
+    description: 'Review the parser'
+  },
+  { id: 'typed-only', state: 'working', startedAt: 500_000, agentType: 'Explore' },
+  { id: 'anonymous', state: 'working', startedAt: 0 },
+  { id: 'asking', state: 'waiting', startedAt: 600_000, description: 'Approve edits' },
+  { id: 'stuck', state: 'blocked', startedAt: 610_000, description: 'Rate limited' },
+  { id: 'parked', state: 'idle', startedAt: 620_000, description: 'Teammate', agentType: 'writer' },
+  { id: 'quiet', state: 'unverifiable', startedAt: 630_000, description: 'Lost child' }
+]
+
+function normalize(markup: string): string {
+  return markup.replaceAll('<!-- -->', '')
+}
+
+function compactMarkup(parent: AgentStatusEntry, parentIsFresh: boolean): string[] {
+  return buildSubagentChildRows({ parentEntry: parent, tab, parentIsFresh }).map((agent) =>
+    normalize(
+      renderToStaticMarkup(
+        <TooltipProvider>
+          <CompactAgentRow agent={agent} now={NOW} onActivate={() => {}} />
+        </TooltipProvider>
+      )
+    )
+  )
+}
+
+function fullMarkup(parent: AgentStatusEntry, parentIsFresh: boolean): string[] {
+  return buildSubagentChildRows({ parentEntry: parent, tab, parentIsFresh }).map((agent) =>
+    normalize(
+      renderToStaticMarkup(
+        <TooltipProvider>
+          <DashboardAgentRow
+            agent={agent}
+            now={NOW}
+            onActivate={() => {}}
+            onDismiss={() => {}}
+            stateDotSize="sm"
+            hideExpand
+            hideLineageConnectors
+          />
+        </TooltipProvider>
+      )
+    )
+  )
+}
+
+function textOf(markup: string): string {
+  const container = document.createElement('div')
+  container.innerHTML = markup
+  return container.textContent ?? ''
+}
+
+describe('sidebar child rows from a legacy subagents snapshot', () => {
+  it('render the compact rows exactly as before', () => {
+    const rows = compactMarkup(parentWith(SUBAGENTS), true)
+    expect(rows.map(textOf)).toEqual([
+      'Review the parser - general-purposeclaude-sonnet10m',
+      'Explore8m',
+      'Working - Agent16m',
+      'Approve edits - Agent6m',
+      'Rate limited - Agent6m',
+      'Teammate - writer6m',
+      'Lost child - No update in 5m6m'
+    ])
+    expect(rows).toMatchSnapshot()
+  })
+
+  it('render a stale parent and a lost transport exactly as before', () => {
+    const stale = compactMarkup(parentWith(SUBAGENTS.slice(0, 4)), false)
+    const lost = compactMarkup(
+      parentWith(SUBAGENTS.slice(0, 1), { subagentObservation: 'unverifiable' }),
+      true
+    )
+    expect([...stale, ...lost].map(textOf)).toEqual([
+      'Review the parser - No update in 5mclaude-sonnet10m',
+      'Explore - No update in 5m8m',
+      'No recent update - No update in 5m16m',
+      'Approve edits - No update in 5m6m',
+      'Review the parser - No update in 5mclaude-sonnet10m'
+    ])
+    expect([...stale, ...lost]).toMatchSnapshot()
+  })
+
+  it('render the full rows exactly as before', () => {
+    expect(fullMarkup(parentWith(SUBAGENTS), true)).toMatchSnapshot()
+    expect(fullMarkup(parentWith(SUBAGENTS.slice(0, 2)), false)).toMatchSnapshot()
+  })
+})
+
+const TASKS: AgentSessionBackgroundTask[] = [
+  {
+    id: 'agent-working',
+    kind: 'agent',
+    description: 'Review the parser',
+    name: 'general-purpose',
+    state: 'working',
+    startedAt: 400_000,
+    totalTokens: 18_200
+  },
+  { id: 'agent-waiting', kind: 'agent', description: 'Approve edits', state: 'waiting' },
+  { id: 'agent-blocked', kind: 'agent', name: 'Explore', state: 'blocked', startedAt: 500_000 },
+  { id: 'agent-quiet', kind: 'agent', description: 'subagent', state: 'unverifiable' },
+  { id: 'agent-stateless', kind: 'agent', description: 'Old host child', startedAt: 600_000 },
+  {
+    id: 'command-1',
+    kind: 'command',
+    description: 'npm run dev',
+    startedAt: 300_000,
+    stoppable: false
+  },
+  { id: 'monitor-1', kind: 'monitor', description: 'tail -f server.log' }
+]
+
+const SETTLED_TASKS: AgentSessionBackgroundTask[] = [
+  {
+    id: 'agent-done',
+    kind: 'agent',
+    description: 'Summarize logs',
+    state: 'done',
+    startedAt: 100_000,
+    totalTokens: 900
+  },
+  { id: 'agent-stopped', kind: 'agent', description: 'Cancelled child', state: 'idle' },
+  { id: 'agent-failed', kind: 'agent', description: 'Failed child', state: 'blocked' }
+]
+
+function stripMarkup(supportsTaskStop: boolean): string {
+  vi.useFakeTimers()
+  vi.setSystemTime(NOW)
+  try {
+    return normalize(
+      renderToStaticMarkup(
+        <TooltipProvider>
+          <NativeChatBackgroundTasksStatus
+            tasks={TASKS}
+            settledTasks={SETTLED_TASKS}
+            supportsTaskStop={supportsTaskStop}
+            supportsStopAll
+            stoppingTaskIds={new Set(['agent-working'])}
+            stoppingAll={false}
+            indicatorActive
+            isVisible
+            expanded
+            onExpandedChange={() => {}}
+            onStop={() => {}}
+          />
+        </TooltipProvider>
+      )
+    )
+  } finally {
+    vi.useRealTimers()
+  }
+}
+
+describe('chat strip rows from a legacy background-task roster', () => {
+  it('render exactly as before', () => {
+    const markup = stripMarkup(true)
+    const container = document.createElement('div')
+    container.innerHTML = markup
+    expect([...container.querySelectorAll('li')].map((row) => row.textContent)).toEqual([
+      'Failed child · failed',
+      'Background agent · no contactStop',
+      'Cancelled child',
+      'Approve edits · needs approvalStop',
+      'Summarize logs900',
+      'Review the parser18.2k · 10m 0sStop',
+      'Explore · failed8m 20sStop',
+      'Old host child6m 40sStop',
+      'npm run dev11m 40s',
+      'tail -f server.logStop'
+    ])
+    expect(markup).toMatchSnapshot()
+    expect(stripMarkup(false)).toMatchSnapshot()
+  })
+})
diff --git a/src/renderer/src/components/sidebar/use-worktree-activity-status.ts b/src/renderer/src/components/sidebar/use-worktree-activity-status.ts
index d6325f675a6..e3f346c6259 100644
--- a/src/renderer/src/components/sidebar/use-worktree-activity-status.ts
+++ b/src/renderer/src/components/sidebar/use-worktree-activity-status.ts
@@ -26,9 +26,11 @@ export function useWorktreeActivityStatus(worktreeId: string): WorktreeStatus {
     hasPermission,
     hasLiveWorking,
     hasLiveMonitoring,
+    hasFailed,
     hasInterrupted,
     hasLiveDone,
     hasRetainedDone,
+    hasRetainedFailed,
     agentStatusPaneIdsByTabId,
     stalePaneIdsByTabId
   } = useAppStore(useShallow((s) => selectWorktreeAgentActivitySummary(s, worktreeId)))
@@ -49,9 +51,11 @@ export function useWorktreeActivityStatus(worktreeId: string): WorktreeStatus {
         hasPermission,
         hasLiveWorking,
         hasLiveMonitoring,
+        hasFailed,
         hasInterrupted,
         hasLiveDone,
-        hasRetainedDone
+        hasRetainedDone,
+        hasRetainedFailed
       }),
     [
       tabs,
@@ -64,9 +68,11 @@ export function useWorktreeActivityStatus(worktreeId: string): WorktreeStatus {
       hasPermission,
       hasLiveWorking,
       hasLiveMonitoring,
+      hasFailed,
       hasInterrupted,
       hasLiveDone,
-      hasRetainedDone
+      hasRetainedDone,
+      hasRetainedFailed
     ]
   )
 }
diff --git a/src/renderer/src/components/sidebar/use-worktree-activity-statuses.ts b/src/renderer/src/components/sidebar/use-worktree-activity-statuses.ts
index d62573307a1..6d1c0054517 100644
--- a/src/renderer/src/components/sidebar/use-worktree-activity-statuses.ts
+++ b/src/renderer/src/components/sidebar/use-worktree-activity-statuses.ts
@@ -34,9 +34,11 @@ export function selectWorktreeActivityStatuses(
       hasPermission,
       hasLiveWorking,
       hasLiveMonitoring,
+      hasFailed,
       hasInterrupted,
       hasLiveDone,
       hasRetainedDone,
+      hasRetainedFailed,
       agentStatusPaneIdsByTabId,
       stalePaneIdsByTabId
     } = selectWorktreeAgentActivitySummary(statusInputs, worktreeId)
@@ -53,9 +55,11 @@ export function selectWorktreeActivityStatuses(
         hasPermission,
         hasLiveWorking,
         hasLiveMonitoring,
+        hasFailed,
         hasInterrupted,
         hasLiveDone,
-        hasRetainedDone
+        hasRetainedDone,
+        hasRetainedFailed
       })
     )
   }
diff --git a/src/renderer/src/components/sidebar/use-worktree-context-menu-commands.ts b/src/renderer/src/components/sidebar/use-worktree-context-menu-commands.ts
index ebef4544b23..30920343680 100644
--- a/src/renderer/src/components/sidebar/use-worktree-context-menu-commands.ts
+++ b/src/renderer/src/components/sidebar/use-worktree-context-menu-commands.ts
@@ -164,7 +164,7 @@ export function useWorktreeContextMenuCommands(args: {
   }, [args])
   const handleOpenParent = useCallback(() => {
     if (args.validParentWorktreeId) {
-      activateAndRevealWorktree(args.validParentWorktreeId)
+      activateAndRevealWorktree(args.validParentWorktreeId, { navigationIntent: 'user-open' })
     }
   }, [args.validParentWorktreeId])
   return {
diff --git a/src/renderer/src/components/sidebar/visible-worktrees.test.ts b/src/renderer/src/components/sidebar/visible-worktrees.test.ts
index 597d4b91e61..81b2ff9d1f4 100644
--- a/src/renderer/src/components/sidebar/visible-worktrees.test.ts
+++ b/src/renderer/src/components/sidebar/visible-worktrees.test.ts
@@ -389,18 +389,18 @@ describe('computeVisibleWorktreeIds', () => {
     expect(result).toEqual([feature.id])
   })
 
-  it('keeps folder-mode main worktrees visible when default branch workspaces are hidden', () => {
-    const folder = makeWorktree('folder')
-    folder.isMainWorktree = true
-    folder.branch = ''
+  it('keeps an empty-branch git main visible when default branch workspaces are hidden', () => {
+    const detached = makeWorktree('detached')
+    detached.isMainWorktree = true
+    detached.branch = ''
 
     const result = computeVisibleWorktreeIds(
-      { repo1: [folder] },
-      [folder.id],
+      { repo1: [detached] },
+      [detached.id],
       visibleOptions({ hideDefaultBranchWorkspace: true })
     )
 
-    expect(result).toEqual([folder.id])
+    expect(result).toEqual([detached.id])
   })
 
   it('filters worktrees to a selected SSH host scope', () => {
diff --git a/src/renderer/src/components/sidebar/visible-worktrees.ts b/src/renderer/src/components/sidebar/visible-worktrees.ts
index 194c363568e..82b72109fb1 100644
--- a/src/renderer/src/components/sidebar/visible-worktrees.ts
+++ b/src/renderer/src/components/sidebar/visible-worktrees.ts
@@ -56,10 +56,10 @@ import { getWorktreeHostIdentity } from '../../../../shared/worktree/host-qualif
  * Whether the "Hide sleeping" sweep must keep this row (#8873).
  *
  * Why isMainWorktree and not isDefaultBranchWorkspace: the project's primary
- * checkout is the repo's only guaranteed entry point. Folder workspaces and
- * detached-HEAD mains fail the default-branch predicate yet often have no
- * sibling row at all, so sweeping them drops the entire project out of the
- * sidebar, Cmd+J and the board with no way back except changing a filter.
+ * checkout is the repo's only guaranteed entry point. Detached-HEAD and offline
+ * SSH mains fail the default-branch predicate yet often have no sibling row at
+ * all, so sweeping them drops the entire project out of the sidebar, Cmd+J and
+ * the board with no way back except changing a filter.
  *
  * Why shared: the sidebar pipeline and the jump palette both apply this, and a
  * second copy is how the two surfaces drift.
@@ -109,7 +109,7 @@ export function computeVisibleWorktrees(
   }
 
   if (opts.hideDefaultBranchWorkspace) {
-    all = all.filter((w) => !isDefaultBranchWorkspace(w))
+    all = all.filter((w) => !isDefaultBranchWorkspace(w, opts.repoMap.get(w.repoId)))
   }
 
   if (opts.hideAutomationGeneratedWorkspaces) {
diff --git a/src/renderer/src/components/sidebar/worktree-agent-activity-summary.test.ts b/src/renderer/src/components/sidebar/worktree-agent-activity-summary.test.ts
index 7b3bdd42849..a4ac0369bf7 100644
--- a/src/renderer/src/components/sidebar/worktree-agent-activity-summary.test.ts
+++ b/src/renderer/src/components/sidebar/worktree-agent-activity-summary.test.ts
@@ -22,6 +22,7 @@ function makeAgentStatusEntry(args: {
   restoredUnconfirmed?: true
   workingMode?: AgentStatusEntry['workingMode']
   interrupted?: true
+  mainAgent?: AgentStatusEntry['mainAgent']
 }): AgentStatusEntry {
   return {
     paneKey: args.paneKey,
@@ -34,6 +35,7 @@ function makeAgentStatusEntry(args: {
     restoredUnconfirmed: args.restoredUnconfirmed,
     workingMode: args.workingMode,
     interrupted: args.interrupted,
+    mainAgent: args.mainAgent,
     orchestration: args.parentPaneKey
       ? {
           taskId: 'task-1',
@@ -223,6 +225,134 @@ describe('selectWorktreeAgentActivitySummary', () => {
     expect(summary).toMatchObject({ hasInterrupted: true, hasLiveDone: false })
   })
 
+  it('separates a failed outcome from clean completion and from a cancellation', () => {
+    vi.spyOn(Date, 'now').mockReturnValue(2_000)
+    const paneKey = makePaneKey('tab-1', LEAF_ID)
+    const summary = selectWorktreeAgentActivitySummary(
+      {
+        tabsByWorktree: { 'repo::/wt-1': [makeTab('tab-1', 'repo::/wt-1')] },
+        agentStatusEpoch: 3,
+        agentStatusByPaneKey: {
+          [paneKey]: makeAgentStatusEntry({
+            paneKey,
+            state: 'done',
+            mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 1_000 }
+          })
+        },
+        migrationUnsupportedByPtyId: {},
+        runtimeAgentOrchestrationByPaneKey: {},
+        retainedAgentsByPaneKey: {}
+      },
+      'repo::/wt-1'
+    )
+
+    expect(summary).toMatchObject({ hasFailed: true, hasInterrupted: false, hasLiveDone: false })
+  })
+
+  it('reports a main agent that failed while its subagents run, beside their pending question', () => {
+    vi.spyOn(Date, 'now').mockReturnValue(2_000)
+    const paneKey = makePaneKey('tab-1', LEAF_ID)
+    const summaryFor = (state: 'working' | 'waiting', outcome: 'failure' | 'success') =>
+      selectWorktreeAgentActivitySummary(
+        {
+          tabsByWorktree: { 'repo::/wt-1': [makeTab('tab-1', 'repo::/wt-1')] },
+          agentStatusEpoch: state === 'working' ? (outcome === 'failure' ? 5 : 6) : 7,
+          agentStatusByPaneKey: {
+            [paneKey]: makeAgentStatusEntry({
+              paneKey,
+              state,
+              mainAgent: { state: 'done', outcome, stateStartedAt: 1_000 }
+            })
+          },
+          migrationUnsupportedByPtyId: {},
+          runtimeAgentOrchestrationByPaneKey: {},
+          retainedAgentsByPaneKey: {}
+        },
+        'repo::/wt-1'
+      )
+
+    expect(summaryFor('working', 'failure')).toMatchObject({
+      hasFailed: true,
+      hasLiveWorking: false
+    })
+    expect(summaryFor('working', 'success')).toMatchObject({
+      hasFailed: false,
+      hasLiveWorking: true
+    })
+    expect(summaryFor('waiting', 'failure')).toMatchObject({ hasFailed: true, hasPermission: true })
+  })
+
+  describe('a failed agent on the worktree card', () => {
+    const worktreeId = 'repo::/wt-2'
+    const liveTab = makeTab('tab-1', worktreeId)
+    const retainedTab = makeTab('tab-2', worktreeId)
+    const failure = { state: 'done', outcome: 'failure', stateStartedAt: 1_000 } as const
+    const workingKey = makePaneKey('tab-1', LEAF_ID)
+    const failedKey = makePaneKey('tab-1', '22222222-2222-4222-8222-222222222222')
+    const working = makeAgentStatusEntry({ paneKey: workingKey, state: 'working' })
+    const retainedFailure = {
+      'tab-2:0': {
+        entry: makeAgentStatusEntry({ paneKey: 'tab-2:0', state: 'done', mainAgent: failure }),
+        worktreeId,
+        tab: retainedTab,
+        agentType: 'claude' as const,
+        startedAt: 1_000
+      }
+    }
+    let epoch = 100
+    const cardFor = (
+      agentStatusByPaneKey: AgentActivityInput['agentStatusByPaneKey'],
+      retainedAgentsByPaneKey: AgentActivityInput['retainedAgentsByPaneKey']
+    ) => {
+      vi.spyOn(Date, 'now').mockReturnValue(2_000)
+      const summary = selectWorktreeAgentActivitySummary(
+        {
+          tabsByWorktree: { [worktreeId]: [liveTab, retainedTab] },
+          agentStatusEpoch: epoch++,
+          agentStatusByPaneKey,
+          migrationUnsupportedByPtyId: {},
+          runtimeAgentOrchestrationByPaneKey: {},
+          retainedAgentsByPaneKey
+        },
+        worktreeId
+      )
+      return {
+        summary,
+        status: resolveWorktreeStatus({ tabs: [], browserTabs: [], ptyIdsByTabId: {}, ...summary })
+      }
+    }
+
+    it('reads a retained failure as failed once nothing else is live, not done', () => {
+      const { summary, status } = cardFor({}, retainedFailure)
+
+      expect(summary).toMatchObject({ hasRetainedFailed: true, hasRetainedDone: false })
+      expect(status).toBe('failed')
+    })
+
+    it('lets live work outrank a departed agent that failed', () => {
+      const { summary, status } = cardFor({ [workingKey]: working }, retainedFailure)
+
+      expect(summary).toMatchObject({ hasFailed: false, hasRetainedFailed: true })
+      expect(status).toBe('working')
+    })
+
+    it('keeps a live failure above live work', () => {
+      const { status } = cardFor(
+        {
+          [workingKey]: working,
+          [failedKey]: makeAgentStatusEntry({
+            paneKey: failedKey,
+            state: 'done',
+            mainAgent: failure
+          })
+        },
+        {}
+      )
+
+      expect(status).toBe('failed')
+    })
+  })
+
   it('lets an unconfirmed restored row suppress only its pane title', () => {
     vi.spyOn(Date, 'now').mockReturnValue(2_000)
     const paneKey = makePaneKey('tab-1', LEAF_ID)
diff --git a/src/renderer/src/components/sidebar/worktree-agent-activity-summary.ts b/src/renderer/src/components/sidebar/worktree-agent-activity-summary.ts
index 589b7c46854..52d1fb23268 100644
--- a/src/renderer/src/components/sidebar/worktree-agent-activity-summary.ts
+++ b/src/renderer/src/components/sidebar/worktree-agent-activity-summary.ts
@@ -8,18 +8,23 @@ import {
 } from '@/lib/agent-status-worktree-attribution'
 import {
   AGENT_STATUS_STALE_AFTER_MS,
-  type AgentStatusEntry,
   type AgentStatusOrchestrationContext
 } from '../../../../shared/agent-status-types'
+import { agentVerdictDisplayMark } from '../../../../shared/agent-main-agent-verdict'
+import { applyAgentPaneActivityFlags } from '@/lib/agent-pane-activity-flags'
 
 export type WorktreeAgentActivitySummary = {
   hasPermission: boolean
   hasLiveWorking: boolean
   hasLiveMonitoring: boolean
+  /** A fresh failed main agent, also while its subagents run; kept apart from clean done. */
+  hasFailed: boolean
   /** Fresh interrupted completion, kept separate from clean done outcomes. */
   hasInterrupted: boolean
   hasLiveDone: boolean
   hasRetainedDone: boolean
+  /** A departed agent's failure; unlike `hasFailed` it yields to live work. */
+  hasRetainedFailed: boolean
   agentStatusPaneIdsByTabId: Record<string, ReadonlySet<string>>
   /** Stale rows suppress generated permission labels while preserving native title fallback. */
   stalePaneIdsByTabId: Record<string, ReadonlySet<string>>
@@ -31,9 +36,11 @@ const EMPTY_SUMMARY: WorktreeAgentActivitySummary = {
   hasPermission: false,
   hasLiveWorking: false,
   hasLiveMonitoring: false,
+  hasFailed: false,
   hasInterrupted: false,
   hasLiveDone: false,
   hasRetainedDone: false,
+  hasRetainedFailed: false,
   agentStatusPaneIdsByTabId: EMPTY_AGENT_STATUS_PANE_IDS_BY_TAB_ID,
   stalePaneIdsByTabId: EMPTY_AGENT_STATUS_PANE_IDS_BY_TAB_ID
 }
@@ -134,7 +141,7 @@ function getWorktreeAgentActivitySummaries(
     if (entry.state === 'done') {
       addParentPaneId(summary, orchestration, worktreeId, tabIdToWorktreeId)
     }
-    applyLiveAgentState(summary, entry)
+    applyAgentPaneActivityFlags(summary, entry)
   }
 
   for (const unsupported of Object.values(state.migrationUnsupportedByPtyId ?? {})) {
@@ -147,7 +154,12 @@ function getWorktreeAgentActivitySummaries(
 
   for (const retained of Object.values(state.retainedAgentsByPaneKey ?? {})) {
     const summary = summaryForWorktree(retained.worktreeId)
-    summary.hasRetainedDone = true
+    // Why: a failed agent is retained so its failure stays visible, not so it reads done.
+    if (agentVerdictDisplayMark(retained.entry) === 'failed') {
+      summary.hasRetainedFailed = true
+    } else {
+      summary.hasRetainedDone = true
+    }
     const paneIdentity = parseAgentStatusPaneIdentity(retained.entry?.paneKey)
     if (paneIdentity) {
       addAgentStatusPaneId(summary, paneIdentity.tabId, paneIdentity.paneId)
@@ -190,9 +202,11 @@ function summariesEqual(
     previous.hasPermission === next.hasPermission &&
     previous.hasLiveWorking === next.hasLiveWorking &&
     previous.hasLiveMonitoring === next.hasLiveMonitoring &&
+    previous.hasFailed === next.hasFailed &&
     previous.hasInterrupted === next.hasInterrupted &&
     previous.hasLiveDone === next.hasLiveDone &&
     previous.hasRetainedDone === next.hasRetainedDone &&
+    previous.hasRetainedFailed === next.hasRetainedFailed &&
     agentStatusPaneIdsByTabIdEqual(
       previous.agentStatusPaneIdsByTabId,
       next.agentStatusPaneIdsByTabId
@@ -227,26 +241,6 @@ function agentStatusPaneIdsByTabIdEqual(
   return true
 }
 
-function applyLiveAgentState(
-  summary: WorktreeAgentActivitySummary,
-  entry: Pick<AgentStatusEntry, 'state' | 'workingMode' | 'interrupted'>
-): void {
-  if (entry.state === 'blocked' || entry.state === 'waiting') {
-    summary.hasPermission = true
-  } else if (entry.interrupted === true) {
-    // Interrupted is encoded as done, so it must be checked first.
-    summary.hasInterrupted = true
-  } else if (entry.state === 'working') {
-    if (entry.workingMode === 'monitoring') {
-      summary.hasLiveMonitoring = true
-    } else {
-      summary.hasLiveWorking = true
-    }
-  } else if (entry.state === 'done') {
-    summary.hasLiveDone = true
-  }
-}
-
 function addAgentStatusPaneId(
   summary: WorktreeAgentActivitySummary,
   tabId: string,
diff --git a/src/renderer/src/components/sidebar/worktree-card-agent-summary.test.ts b/src/renderer/src/components/sidebar/worktree-card-agent-summary.test.ts
index e303ed2c402..62a7d54c6d5 100644
--- a/src/renderer/src/components/sidebar/worktree-card-agent-summary.test.ts
+++ b/src/renderer/src/components/sidebar/worktree-card-agent-summary.test.ts
@@ -4,7 +4,12 @@ import { describe, expect, it, vi } from 'vitest'
 import { TooltipProvider } from '@/components/ui/tooltip'
 import type { DashboardAgentRow as DashboardAgentRowData } from '@/components/dashboard/useDashboardData'
 import { CompactAgentRow, getCompactAgentSecondary } from './worktree-card-compact-agent-row'
-import { getAgentDotState, summarizeAgents } from './worktree-card-agent-summary'
+import {
+  buildSummaryAgentGroups,
+  getAgentDotState,
+  summarizeAgents
+} from './worktree-card-agent-summary'
+import { buildSubagentChildRows } from './worktree-subagent-child-rows'
 
 function monitoringAgent(): DashboardAgentRowData {
   return {
@@ -45,6 +50,30 @@ function renderCompactAgentRow(props: React.ComponentProps<typeof CompactAgentRo
 }
 
 describe('worktree card agent summary', () => {
+  it('keeps a failed child in the groups and the counts', () => {
+    const failed: DashboardAgentRowData = {
+      ...monitoringAgent(),
+      paneKey: 'tab-1:leaf-1\u0000subagent:child',
+      rowSource: 'subagent',
+      state: 'blocked',
+      childRow: {
+        id: 'child',
+        kind: 'agent',
+        displayState: 'failed',
+        name: 'Fuzz the tokenizer',
+        detail: null,
+        firstObservedAt: 1,
+        recencyAt: 1,
+        canStop: false,
+        settled: true,
+        owned: []
+      }
+    }
+    expect(getAgentDotState(failed)).toBe('failed')
+    expect(buildSummaryAgentGroups([failed]).map((group) => group.state)).toEqual(['failed'])
+    expect(summarizeAgents([failed], 'Agent')).toBe('Agent failed')
+  })
+
   it('presents passive working as monitoring', () => {
     const agent = monitoringAgent()
 
@@ -102,4 +131,72 @@ describe('worktree card agent summary', () => {
 
     expect(summarizeAgents([done, interrupted], 'Agents')).toBe('Agents: 1 interrupted, 1 done')
   })
+
+  it('lists a failed turn as failed, not done, ahead of an interrupted one', () => {
+    const done = monitoringAgent()
+    done.state = 'done'
+    done.entry.state = 'done'
+    done.entry.workingMode = undefined
+    const failed = {
+      ...done,
+      paneKey: 'tab-1:leaf-3',
+      entry: {
+        ...done.entry,
+        paneKey: 'tab-1:leaf-3',
+        mainAgent: { state: 'done' as const, outcome: 'failure' as const, stateStartedAt: 1 }
+      }
+    }
+    const interrupted = {
+      ...done,
+      paneKey: 'tab-1:leaf-2',
+      entry: { ...done.entry, paneKey: 'tab-1:leaf-2', interrupted: true }
+    }
+
+    expect(getAgentDotState(failed)).toBe('failed')
+    expect(getCompactAgentSecondary(failed, 0)).toBe('Failed')
+    expect(getCompactAgentSecondary(interrupted, 0)).toBe('Interrupted by user')
+    expect(summarizeAgents([done, interrupted, failed], 'Agents')).toBe(
+      'Agents: 1 failed, 1 interrupted, 1 done'
+    )
+  })
+
+  it('reads a main agent that failed while its subagent works as failed, ranked above working', () => {
+    const held = (outcome: 'failure' | 'success' | 'cancellation'): DashboardAgentRowData => {
+      const agent = monitoringAgent()
+      agent.entry.workingMode = undefined
+      agent.entry.mainAgent = { state: 'done', outcome, stateStartedAt: 1 }
+      return agent
+    }
+    const working = monitoringAgent()
+    working.paneKey = 'tab-1:leaf-2'
+    working.entry = { ...working.entry, paneKey: 'tab-1:leaf-2', workingMode: undefined }
+
+    expect(getAgentDotState(held('failure'))).toBe('failed')
+    expect(getCompactAgentSecondary(held('failure'), 0)).toBe('Failed')
+    expect(summarizeAgents([working, held('failure')], 'Agents')).toBe(
+      'Agents: 1 failed, 1 working'
+    )
+    // Only a failure outranks live work; a success or a stop with a live subagent reads working.
+    expect(getAgentDotState(held('success'))).toBe('working')
+    expect(getAgentDotState(held('cancellation'))).toBe('working')
+    expect(getCompactAgentSecondary(held('cancellation'), 0)).not.toBe('Interrupted by user')
+  })
+
+  it('keeps a subagent row on its own state while its failed main agent reads failed', () => {
+    const parent = monitoringAgent()
+    parent.entry = {
+      ...parent.entry,
+      workingMode: undefined,
+      mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 1 },
+      subagents: [{ id: 'child-1', state: 'working', startedAt: 1 }]
+    }
+    const [child] = buildSubagentChildRows({
+      parentEntry: parent.entry,
+      tab: parent.tab,
+      parentIsFresh: true
+    })
+
+    expect(getAgentDotState(parent)).toBe('failed')
+    expect(getAgentDotState(child)).toBe('working')
+  })
 })
diff --git a/src/renderer/src/components/sidebar/worktree-card-agent-summary.ts b/src/renderer/src/components/sidebar/worktree-card-agent-summary.ts
index 314aa430d16..76fe81307e9 100644
--- a/src/renderer/src/components/sidebar/worktree-card-agent-summary.ts
+++ b/src/renderer/src/components/sidebar/worktree-card-agent-summary.ts
@@ -1,7 +1,7 @@
 import type { AgentDotState } from '@/components/AgentStateDot'
 import type { DashboardAgentRow as DashboardAgentRowData } from '@/components/dashboard/useDashboardData'
 import { formatAgentTypeLabel } from '@/lib/agent-status'
-import { agentRowDotState } from '@/lib/agent-row-dot-state'
+import { agentRowDisplayDotState } from '@/lib/agent-row-dot-state'
 
 export type SummaryAgentGroup = {
   state: AgentDotState
@@ -11,6 +11,8 @@ export type SummaryAgentGroup = {
 const SUMMARY_STATE_ORDER: AgentDotState[] = [
   'waiting',
   'blocked',
+  // Why: a failed main agent outranks live work; a pending question still comes first.
+  'failed',
   'working',
   'monitoring',
   'interrupted',
@@ -21,10 +23,7 @@ const SUMMARY_STATE_ORDER: AgentDotState[] = [
 ]
 
 export function getAgentDotState(agent: DashboardAgentRowData): AgentDotState {
-  if (agent.entry.interrupted === true) {
-    return 'interrupted'
-  }
-  return agentRowDotState(agent.state, agent.entry.workingMode)
+  return agentRowDisplayDotState(agent)
 }
 
 export function formatSummaryStateLabel(state: AgentDotState): string {
diff --git a/src/renderer/src/components/sidebar/worktree-card-compact-agent-row.tsx b/src/renderer/src/components/sidebar/worktree-card-compact-agent-row.tsx
index f0d63d5d11f..7ee48834185 100644
--- a/src/renderer/src/components/sidebar/worktree-card-compact-agent-row.tsx
+++ b/src/renderer/src/components/sidebar/worktree-card-compact-agent-row.tsx
@@ -1,12 +1,12 @@
 import React, { useCallback, useEffect, useRef } from 'react'
-import { ChevronRight } from 'lucide-react'
+import { DashboardAgentChildDisclosure } from '@/components/dashboard/DashboardAgentChildDisclosure'
 import { AgentStateDot, agentStateLabel } from '@/components/AgentStateDot'
+import { AgentChildRowContent } from '@/components/AgentChildRowContent'
 import type { DashboardAgentRow as DashboardAgentRowData } from '@/components/dashboard/useDashboardData'
 import { AgentIcon } from '@/lib/agent-catalog'
 import { agentTypeToIconAgent, formatAgentTypeLabel } from '@/lib/agent-status'
 import { cn } from '@/lib/utils'
 import { getAgentDotState } from './worktree-card-agent-summary'
-import { translate } from '@/i18n/i18n'
 import { getAgentRowPrimaryText } from '@/lib/agent-row-primary-text'
 import { formatAgentToolPreview } from '@/lib/agent-row-tool-preview'
 import { agentNoUpdateLabel } from '@/lib/agent-row-decay-state'
@@ -14,6 +14,7 @@ import { useAgentRowConversationName } from '@/components/dashboard/use-agent-ro
 import { lastEnteredDoneAt } from '@/components/dashboard/agent-finished-timestamp'
 import CacheTimer, { usePromptCacheCountdownForPane } from './CacheTimer'
 import { formatShortTimeAgo } from '@/lib/short-time-ago'
+import { agentVerdictDisplayMark } from '../../../../shared/agent-main-agent-verdict'
 
 function getCompactAgentPrimary(
   agent: DashboardAgentRowData,
@@ -28,9 +29,13 @@ export function getCompactAgentSecondary(
   now: number,
   lastAssistantMessageOverride?: string
 ): string {
-  if (agent.entry.interrupted === true) {
+  const verdictMark = agentVerdictDisplayMark(agent.entry)
+  if (verdictMark === 'interrupted') {
     return 'Interrupted by user'
   }
+  if (verdictMark === 'failed') {
+    return 'Failed'
+  }
   // Why: the only honest thing to say about a pane Orca still holds but no longer hears
   // from is how long the silence has run; the user supplies the meaning.
   if (agent.state === 'unverifiable') {
@@ -65,14 +70,6 @@ function getCompactAgentTime(agent: DashboardAgentRowData, now: number): string
   return startedAt > 0 ? formatShortTimeAgo(startedAt, now) : null
 }
 
-function stopActivationKeyPropagation(e: React.KeyboardEvent): void {
-  // Why: the surrounding worktree list handles Enter/Space as row activation.
-  // Focused nested buttons need those keys to stay local.
-  if (e.key === 'Enter' || e.key === ' ') {
-    e.stopPropagation()
-  }
-}
-
 type CompactAgentRowProps = {
   agent: DashboardAgentRowData
   now: number
@@ -85,10 +82,10 @@ type CompactAgentRowProps = {
   childAgentCount?: number
   childAgentsExpanded?: boolean
   onToggleChildAgents?: () => void
-  disclosureInGutter?: boolean
   isFocusedPane?: boolean
   hideIdentityIcon?: boolean
   cacheTimerActive?: boolean
+  isUnvisited?: boolean
 }
 
 export const CompactAgentRow = React.memo(function CompactAgentRow({
@@ -101,10 +98,10 @@ export const CompactAgentRow = React.memo(function CompactAgentRow({
   childAgentCount,
   childAgentsExpanded = false,
   onToggleChildAgents,
-  disclosureInGutter = false,
   isFocusedPane = false,
   hideIdentityIcon = false,
-  cacheTimerActive = true
+  cacheTimerActive = true,
+  isUnvisited = false
 }: CompactAgentRowProps) {
   const hasChildDisclosure =
     typeof childAgentCount === 'number' &&
@@ -176,71 +173,66 @@ export const CompactAgentRow = React.memo(function CompactAgentRow({
     },
     [agent.paneKey, onSendTargetClick, sendTargetStatus]
   )
-  const handleToggleChildren = useCallback(
-    (e: React.MouseEvent<HTMLButtonElement>) => {
-      e.preventDefault()
-      e.stopPropagation()
-      onToggleChildAgents?.()
-    },
-    [onToggleChildAgents]
+  const timestamp = shortTime ? (
+    <span
+      className={cn(
+        'shrink-0 text-[10px] tabular-nums',
+        isFocusedPane ? 'text-foreground/70' : 'text-muted-foreground/60'
+      )}
+    >
+      {shortTime}
+    </span>
+  ) : null
+
+  // Why: the selected-row fill is strong enough to wash out the dimmed prompt/secondary text, so
+  // lift the lead toward full foreground when focused; an unvisited row stays bold either way.
+  const leadClassName = cn(
+    isUnvisited ? 'font-semibold text-foreground' : 'font-normal text-muted-foreground/90',
+    isFocusedPane && !isUnvisited && 'text-foreground'
   )
 
   const rowBody = (
     <>
-      {hasChildDisclosure ? (
-        <button
-          type="button"
-          className="compact-agent-child-disclosure-button flex size-4 shrink-0 items-center justify-center rounded-sm text-muted-foreground hover:bg-worktree-sidebar-accent hover:text-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-worktree-sidebar-ring"
-          aria-label={translate(
-            'auto.components.sidebar.worktree.card.compact.agents.a128d7006b',
-            '{{value0}} {{value1}} child {{value2}}',
-            {
-              value0: childAgentsExpanded ? 'Hide' : 'Show',
-              value1: childAgentCount,
-              value2: childAgentCount === 1 ? 'agent' : 'agents'
-            }
-          )}
-          aria-expanded={childAgentsExpanded}
-          onClick={handleToggleChildren}
-          onKeyDown={stopActivationKeyPropagation}
-        >
-          <ChevronRight
-            className={cn(
-              'size-3 transition-transform duration-150',
-              childAgentsExpanded && 'rotate-90'
-            )}
-            aria-hidden
+      {agent.childRow ? (
+        // Why: a child row reads through the piece the chat strip renders, so both say the same.
+        <AgentChildRowContent
+          row={agent.childRow}
+          now={now}
+          leadClassName={leadClassName}
+          trailClassName={isFocusedPane ? 'text-foreground/70' : 'text-muted-foreground/65'}
+          separator=" - "
+          dotTitle={sendTargetDisabledReason ? null : undefined}
+          tooltipSide="right"
+          lineTitle={!sendTargetDisabledReason}
+        />
+      ) : (
+        <>
+          {/* Why: the row's actionable disabled reason must win on every hit area. */}
+          <AgentStateDot
+            state={dotState}
+            size="sm"
+            title={sendTargetDisabledReason ? null : undefined}
+            tooltipSide="right"
           />
-        </button>
-      ) : null}
-      {/* Why: the row's actionable disabled reason must win on every hit area. */}
-      <AgentStateDot
-        state={dotState}
-        size="sm"
-        title={sendTargetDisabledReason ? null : undefined}
-        tooltipSide="right"
-      />
-      {!hideIcon && (
-        <span className="inline-flex shrink-0" title={formatAgentTypeLabel(agent.agentType)}>
-          <AgentIcon agent={agentTypeToIconAgent(agent.agentType)} size={13} />
-        </span>
-      )}
-      <span
-        className="min-w-0 flex-1 truncate"
-        title={sendTargetDisabledReason ? undefined : rowTitle}
-      >
-        {/* Why: the selected-row fill is strong enough to wash out the dimmed
-            prompt/secondary text, so lift both toward full foreground when focused. */}
-        <span className={isFocusedPane ? 'text-foreground' : 'text-muted-foreground/90'}>
-          {leadingText}
-        </span>
-        {trailingText && (
-          <span className={isFocusedPane ? 'text-foreground/70' : 'text-muted-foreground/65'}>
-            {' '}
-            - {trailingText}
+          {!hideIcon && (
+            <span className="inline-flex shrink-0" title={formatAgentTypeLabel(agent.agentType)}>
+              <AgentIcon agent={agentTypeToIconAgent(agent.agentType)} size={13} />
+            </span>
+          )}
+          <span
+            className="min-w-0 flex-1 truncate"
+            title={sendTargetDisabledReason ? undefined : rowTitle}
+          >
+            <span className={leadClassName}>{leadingText}</span>
+            {trailingText && (
+              <span className={isFocusedPane ? 'text-foreground/70' : 'text-muted-foreground/65'}>
+                {' '}
+                - {trailingText}
+              </span>
+            )}
           </span>
-        )}
-      </span>
+        </>
+      )}
       {model && (
         <span
           className={cn(
@@ -263,16 +255,15 @@ export const CompactAgentRow = React.memo(function CompactAgentRow({
         </span>
       )}
       {cacheTimer && <CacheTimer startedAt={cacheTimer.startedAt} ttlMs={cacheTimer.ttlMs} />}
-      {shortTime && (
-        <span
-          className={cn(
-            'shrink-0 text-[10px] tabular-nums',
-            // Why: the muted timestamp drops out against the selected-row fill.
-            isFocusedPane ? 'text-foreground/70' : 'text-muted-foreground/60'
-          )}
-        >
-          {shortTime}
-        </span>
+      {hasChildDisclosure ? (
+        <DashboardAgentChildDisclosure
+          childAgentCount={childAgentCount}
+          childAgentsExpanded={childAgentsExpanded}
+          onToggleChildAgents={onToggleChildAgents}
+          timestamp={timestamp}
+        />
+      ) : (
+        timestamp
       )}
     </>
   )
@@ -281,11 +272,9 @@ export const CompactAgentRow = React.memo(function CompactAgentRow({
     <div
       draggable={false}
       className={cn(
-        'compact-agent-row group/compact-agent-row min-w-0 overflow-hidden cursor-pointer rounded-sm px-1 text-[11px] leading-none',
+        'compact-agent-row agent-disclosure-row group/compact-agent-row min-w-0 cursor-pointer rounded-sm px-1 text-[11px] leading-none',
         'text-muted-foreground worktree-agent-row-hover',
         hasChildDisclosure && 'worktree-agent-lineage-parent-row',
-        // Why: hang the chevron in the card gutter so the state dot keeps the column of chevron-less rows.
-        hasChildDisclosure && disclosureInGutter && '-ml-5',
         isLineageChild && 'worktree-agent-lineage-child-row',
         'flex h-6 items-center gap-1',
         isFocusedPane && 'bg-worktree-sidebar-accent',
diff --git a/src/renderer/src/components/sidebar/worktree-card-surface.tsx b/src/renderer/src/components/sidebar/worktree-card-surface.tsx
index 8d3e03ebeaa..df0cd67b412 100644
--- a/src/renderer/src/components/sidebar/worktree-card-surface.tsx
+++ b/src/renderer/src/components/sidebar/worktree-card-surface.tsx
@@ -51,7 +51,7 @@ export function WorktreeCardSurface({ card }: { card: WorktreeCardController }):
         'relative flex cursor-pointer flex-col pr-1.5 transition-[background-color,border-color,opacity,box-shadow] duration-200 outline-none select-none',
         titleOnlyCard ? 'py-2' : 'pt-1.25 pb-1.5',
         flushSurface ? 'ml-1 w-[calc(100%-0.25rem)]' : 'ml-1',
-        'rounded-lg',
+        'overflow-hidden rounded-lg',
         // Why: the live data attribute updates before React state during navigation,
         // so it must own the complete active style without stale utility classes.
         isLineageDropTarget
diff --git a/src/renderer/src/components/sidebar/worktree-keyboard-cycle.test.ts b/src/renderer/src/components/sidebar/worktree-keyboard-cycle.test.ts
index 430736c92be..9f5562d91cd 100644
--- a/src/renderer/src/components/sidebar/worktree-keyboard-cycle.test.ts
+++ b/src/renderer/src/components/sidebar/worktree-keyboard-cycle.test.ts
@@ -1,5 +1,3 @@
-import { readFileSync } from 'node:fs'
-import { fileURLToPath } from 'node:url'
 import { describe, expect, it } from 'vitest'
 import type { HostSectionRow } from './host-section-rows'
 import {
@@ -151,27 +149,3 @@ describe('getCyclableWorktreeIds', () => {
     expect(getCyclableWorktreeIds(rows, 'single-location')).toEqual(['visible-after-host'])
   })
 })
-
-describe('WorktreeList keyboard cycling', () => {
-  it('cycles over the rendered rows instead of rebuilding a parallel layout', () => {
-    const source = readFileSync(
-      fileURLToPath(new URL('./worktree-list/navigation/use-keyboard.ts', import.meta.url)),
-      'utf8'
-    )
-    const navigateWorktree = source.slice(
-      source.indexOf('const navigateWorktree = useCallback('),
-      source.indexOf('const handleContainerKeyDown = useCallback(')
-    )
-
-    // Why: a second buildRows call drifts from the rendered layout (host sections,
-    // pinned placement); cycling must read the same rows the viewport renders.
-    expect(navigateWorktree).toContain('getCyclableWorktreeRows(rows, pinnedDisplayPolicy)')
-    expect(navigateWorktree).toContain('getCyclableRowIdentity')
-    // Why: the active host is stored resolved while a local row is unqualified; comparing raw identities wraps to the top.
-    expect(navigateWorktree).toContain('resolveActiveCycleIdentity')
-    expect(navigateWorktree).not.toContain('composeWorktreeHostIdentity')
-    expect(navigateWorktree).toContain('executionHostId: nextWorktree.hostId')
-    expect(navigateWorktree).toContain('resolveCycledWorktreeId')
-    expect(navigateWorktree).not.toContain('buildRows(')
-  })
-})
diff --git a/src/renderer/src/components/sidebar/worktree-list/grouping/build-rows.test.ts b/src/renderer/src/components/sidebar/worktree-list/grouping/build-rows.test.ts
index d95c204026c..fb53b8d016a 100644
--- a/src/renderer/src/components/sidebar/worktree-list/grouping/build-rows.test.ts
+++ b/src/renderer/src/components/sidebar/worktree-list/grouping/build-rows.test.ts
@@ -1,25 +1,11 @@
-import { readFileSync } from 'node:fs'
-import { fileURLToPath } from 'node:url'
 import { describe, expect, it } from 'vitest'
 import { buildRows } from './build-rows'
 import { ALL_GROUP_META, getPRGroupKey, PINNED_GROUP_KEY } from './group-keys'
 import { getGroupKeyForWorktree } from './worktree-group-keys'
-import {
-  REPO_HEADER_ACTION_BUTTON_CLASS,
-  REPO_HEADER_ACTION_REVEAL_CLASS
-} from '../../repo-header-action-button-class'
 import { repo, worktree, repoMap } from '../../worktree-list-groups-test-fixtures'
 import type { Repo } from '../../../../../../shared/repo-types'
 import type { Worktree } from '../../../../../../shared/worktree/types'
 
-function readWorktreeListSource(): string {
-  return readFileSync(fileURLToPath(new URL('../../WorktreeList.tsx', import.meta.url)), 'utf8')
-}
-
-function readSectionHeaderRowSource(): string {
-  return readFileSync(fileURLToPath(new URL('../rows/SectionHeader.tsx', import.meta.url)), 'utf8')
-}
-
 describe('getPRGroupKey', () => {
   it('puts merged PRs in the done group', () => {
     const prCache = {
@@ -382,40 +368,3 @@ describe('buildRows with pinned worktrees', () => {
     ])
   })
 })
-
-describe('WorktreeList header styles', () => {
-  it('does not title-case workspace group labels', () => {
-    const source = readSectionHeaderRowSource()
-
-    expect(source).not.toContain('leading-none capitalize')
-  })
-
-  it('collapses repo header actions without reserving title width', () => {
-    expect(REPO_HEADER_ACTION_REVEAL_CLASS).toContain('min-w-0 max-w-0 -ml-1.5')
-    expect(REPO_HEADER_ACTION_REVEAL_CLASS).toContain('focus:ml-0 focus:max-w-5 focus:opacity-100')
-    expect(REPO_HEADER_ACTION_REVEAL_CLASS).toContain(
-      'group-hover:ml-0 group-hover:max-w-5 group-hover:opacity-100'
-    )
-    expect(REPO_HEADER_ACTION_BUTTON_CLASS).toContain(
-      'transition-[margin,max-width,opacity,background-color,color]'
-    )
-    expect(REPO_HEADER_ACTION_BUTTON_CLASS).toContain(
-      'data-[state=open]:ml-0 data-[state=open]:max-w-5 data-[state=open]:opacity-100'
-    )
-  })
-
-  it('resolves repo header color from project group headers only', () => {
-    const source = readSectionHeaderRowSource()
-
-    expect(source).toContain('resolveProjectGroupHeaderColor({')
-    expect(source).toContain('headerKey: row.key')
-    expect(source).toContain('color={repoHeaderColor}')
-  })
-
-  it('adapts projected setup rows for sidebar project grouping', () => {
-    const source = readWorktreeListSource()
-
-    expect(source).toContain('const projectHostSetupProjection = useProjectHostSetupProjection()')
-    expect(source).toContain('projectHostSetups: projectHostSetupProjection.setups')
-  })
-})
diff --git a/src/renderer/src/components/sidebar/worktree-list/listing/use-filters.ts b/src/renderer/src/components/sidebar/worktree-list/listing/use-filters.ts
index 38b15bab63e..bb8629d7276 100644
--- a/src/renderer/src/components/sidebar/worktree-list/listing/use-filters.ts
+++ b/src/renderer/src/components/sidebar/worktree-list/listing/use-filters.ts
@@ -96,7 +96,7 @@ export function useSidebarWorktreeFilters() {
     if (scopedHostIds && !scopedHostIds.includes(targetHostId)) {
       state.setVisibleWorkspaceHostIds([...scopedHostIds, targetHostId])
     }
-    if (state.hideDefaultBranchWorkspace && isDefaultBranchWorkspace(worktree)) {
+    if (state.hideDefaultBranchWorkspace && isDefaultBranchWorkspace(worktree, repo)) {
       state.setHideDefaultBranchWorkspace(false)
     }
     if (state.hideAutomationGeneratedWorkspaces && isAutomationGeneratedWorkspace(worktree)) {
diff --git a/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.focus.test.tsx b/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.focus.test.tsx
new file mode 100644
index 00000000000..c09637354f2
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.focus.test.tsx
@@ -0,0 +1,290 @@
+// @vitest-environment happy-dom
+import { act, useRef, useState } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { useVirtualizer } from '@tanstack/react-virtual'
+import { Terminal } from '@xterm/xterm'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { HostSectionRow } from '../../host-section-rows'
+import { repo, worktree } from '../../worktree-list-groups-test-fixtures'
+import { focusPanePreservingOverlays } from '@/lib/pane-manager/pane-overlay-focus'
+import { getShortcutPlatform } from '@/lib/shortcut-platform'
+
+const state = {
+  keybindings: undefined,
+  activeView: 'terminal',
+  activeTabType: 'terminal',
+  activeWorktreeId: 'a',
+  activeTabId: 'tab-a',
+  tabsByWorktree: {
+    a: [{ id: 'tab-a' }],
+    b: [{ id: 'tab-b' }],
+    c: [{ id: 'tab-c' }],
+    'folder:one': [{ id: 'folder-tab' }]
+  }
+}
+const activate = vi.fn()
+const focusRuntime = vi.fn()
+vi.mock('@/store', () => ({
+  useAppStore: Object.assign((selector: (s: typeof state) => unknown) => selector(state), {
+    getState: () => state
+  })
+}))
+vi.mock('@/lib/worktree-activation', () => ({
+  activateAndRevealWorktree: (...args: unknown[]) => activate(...args)
+}))
+vi.mock('@/runtime/sync-runtime-graph', () => ({
+  focusRuntimeTerminalSurface: (...args: unknown[]) => focusRuntime(...args)
+}))
+const { useWorktreeListKeyboardNavigation } = await import('./use-keyboard')
+Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
+
+const rows: HostSectionRow[] = ['a', 'b', 'c'].map((id) => ({
+  type: 'item',
+  rowKey: id,
+  sectionKey: repo.id,
+  worktree: { ...worktree, id, hostId: 'ssh:fixture' },
+  repo,
+  depth: 0,
+  groupDepth: 0,
+  lineageTrail: [],
+  isLastLineageChild: false,
+  lineageChildCount: 0
+}))
+let root: Root
+let container: HTMLDivElement
+let list: HTMLDivElement
+let terminal: Terminal
+let textarea: HTMLTextAreaElement
+let autoFocus: () => void
+let modal = 'none'
+
+function Probe() {
+  const scrollRef = useRef<HTMLDivElement>(null)
+  const [activeId, setActiveId] = useState(state.activeWorktreeId)
+  const virtualizer = useVirtualizer<HTMLDivElement, HTMLDivElement>({
+    count: rows.length,
+    getScrollElement: () => scrollRef.current,
+    estimateSize: () => 30
+  })
+  activate.mockImplementation((id: string) => {
+    state.activeWorktreeId = id
+    state.activeTabId = `tab-${id}`
+    setActiveId(id)
+    autoFocus()
+  })
+  const { handleContainerKeyDown } = useWorktreeListKeyboardNavigation({
+    rows,
+    renderRows: rows,
+    activeWorktreeId: activeId,
+    activeWorkspaceExecutionHostId: 'ssh:fixture',
+    pinnedDisplayPolicy: 'single-location',
+    virtualizer,
+    scrollRef,
+    activeModal: modal,
+    markDirectScrollInput: () => {}
+  })
+  return (
+    <div
+      ref={scrollRef}
+      data-worktree-sidebar
+      role="listbox"
+      tabIndex={0}
+      onKeyDown={handleContainerKeyDown}
+    >
+      <button>Row action</button>
+    </div>
+  )
+}
+
+function press(key: string, init: KeyboardEventInit = {}, target: HTMLElement = list) {
+  act(() => {
+    target.dispatchEvent(
+      new KeyboardEvent('keydown', { key, code: key, bubbles: true, cancelable: true, ...init })
+    )
+  })
+}
+
+beforeEach(() => {
+  Object.assign(state, {
+    activeView: 'terminal',
+    activeTabType: 'terminal',
+    activeWorktreeId: 'a',
+    activeTabId: 'tab-a'
+  })
+  activate.mockReset()
+  focusRuntime.mockReset()
+  modal = 'none'
+  container = document.createElement('div')
+  textarea = document.createElement('textarea')
+  textarea.className = 'xterm-helper-textarea'
+  document.body.append(container, textarea)
+  terminal = new Terminal()
+  vi.spyOn(terminal, 'focus').mockImplementation(() => textarea.focus())
+  autoFocus = () => focusPanePreservingOverlays({ container, terminal })
+  root = createRoot(container)
+  act(() => root.render(<Probe />))
+  const element = container.querySelector('[data-worktree-sidebar]')
+  if (!(element instanceof HTMLDivElement)) {
+    throw new Error('List missing')
+  }
+  list = element
+  list.focus()
+})
+
+afterEach(() => {
+  act(() => root.unmount())
+  terminal.dispose()
+  vi.restoreAllMocks()
+  document.body.innerHTML = ''
+})
+
+describe('workspace list focus ownership', () => {
+  it('keeps repeated arrows in the list across activation and rerenders', () => {
+    press('ArrowDown')
+    expect(document.activeElement).toBe(list)
+    press('ArrowDown')
+    expect(document.activeElement).toBe(list)
+    press('ArrowUp')
+    expect(activate.mock.calls.map(([id]) => id)).toEqual(['b', 'c', 'b'])
+    expect(activate).toHaveBeenLastCalledWith('b', {
+      navigationIntent: 'user-open',
+      executionHostId: 'ssh:fixture'
+    })
+    expect(terminal.focus).not.toHaveBeenCalled()
+  })
+
+  it('keeps delayed terminal readiness from taking focus', () => {
+    autoFocus = () => {}
+    press('ArrowDown')
+    focusPanePreservingOverlays({ container, terminal })
+    expect(document.activeElement).toBe(list)
+  })
+
+  it.each(['inside', 'outside'])(
+    'releases ownership before an explicit %s pointer action',
+    (where) => {
+      press('ArrowDown')
+      const target = where === 'inside' ? list : textarea
+      target.dispatchEvent(new Event('pointerdown', { bubbles: true }))
+      focusPanePreservingOverlays({ container, terminal })
+      expect(document.activeElement).toBe(textarea)
+    }
+  )
+
+  it('does not revive old ownership when leaving and reentering the list', () => {
+    press('ArrowDown')
+    textarea.focus()
+    list.focus()
+    focusPanePreservingOverlays({ container, terminal })
+    expect(document.activeElement).toBe(textarea)
+  })
+
+  it('drops ownership when the list unmounts and remounts', () => {
+    press('ArrowDown')
+    act(() => root.render(null))
+    focusPanePreservingOverlays({ container, terminal })
+    expect(document.activeElement).toBe(textarea)
+    act(() => root.render(<Probe />))
+    container.querySelector<HTMLElement>('[data-worktree-sidebar]')?.focus()
+    focusPanePreservingOverlays({ container, terminal })
+    expect(document.activeElement).toBe(textarea)
+  })
+
+  it.each(['Mac', 'Windows', 'Linux'])(
+    'keeps CmdOrCtrl cycling as terminal navigation on %s',
+    (platform) => {
+      vi.spyOn(navigator, 'userAgent', 'get').mockReturnValue(platform)
+      press('ArrowDown')
+      const mod = getShortcutPlatform() === 'darwin' ? { metaKey: true } : { ctrlKey: true }
+      press('ArrowDown', { ...mod, shiftKey: true })
+      expect(activate.mock.calls.map(([id]) => id)).toEqual(['b', 'c'])
+      expect(document.activeElement).toBe(textarea)
+    }
+  )
+
+  it('does not navigate while an application modal is active', () => {
+    modal = 'settings'
+    act(() => root.render(<Probe />))
+    press('ArrowDown')
+    press('Enter')
+    expect(activate).not.toHaveBeenCalled()
+    expect(focusRuntime).not.toHaveBeenCalled()
+  })
+
+  it.each(['dialog', 'menu'])('does not navigate behind a visible %s', (role) => {
+    const overlay = document.createElement('div')
+    overlay.setAttribute('role', role)
+    document.body.append(overlay)
+    press('ArrowDown')
+    press('Enter')
+    expect(activate).not.toHaveBeenCalled()
+    expect(focusRuntime).not.toHaveBeenCalled()
+    expect(document.activeElement).toBe(list)
+  })
+
+  it('does not consume Enter from a row action', () => {
+    const button = list.querySelector('button')
+    if (!button) {
+      throw new Error('Button missing')
+    }
+    button.focus()
+    press('Enter', {}, button)
+    expect(document.activeElement).toBe(button)
+    expect(focusRuntime).not.toHaveBeenCalled()
+  })
+
+  it('asks the workspace-scoped pane API to focus the selected active pane', () => {
+    press('ArrowDown')
+    focusRuntime.mockImplementation(() => {
+      textarea.focus()
+      return true
+    })
+    press('Enter')
+    expect(focusRuntime).toHaveBeenCalledWith('tab-b', null, 'b')
+    expect(document.activeElement).toBe(textarea)
+    expect(list.hasAttribute('data-keyboard-navigation')).toBe(false)
+  })
+
+  it('uses folder workspace identity when handing focus to its terminal', () => {
+    Object.assign(state, { activeWorktreeId: 'folder:one', activeTabId: 'folder-tab' })
+    press('Enter')
+    expect(focusRuntime).toHaveBeenCalledWith('folder-tab', null, 'folder:one')
+  })
+
+  it.each([false, true])(
+    'keeps ownership when Enter returns %s without moving focus',
+    (handled) => {
+      press('ArrowDown')
+      focusRuntime.mockReturnValue(handled)
+      press('Enter')
+      expect(document.activeElement).toBe(list)
+      focusPanePreservingOverlays({ container, terminal })
+      expect(document.activeElement).toBe(list)
+      expect(terminal.focus).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['editor', 'browser', 'agent', 'empty', 'unowned', 'unmounted', 'other-view'])(
+    'leaves focus in the list for %s targets instead of another terminal',
+    (target) => {
+      if (['editor', 'browser', 'agent'].includes(target)) {
+        state.activeTabType = target
+      }
+      if (target === 'empty') {
+        state.activeWorktreeId = ''
+      }
+      if (target === 'unowned') {
+        state.activeTabId = 'tab-b'
+      }
+      if (target === 'other-view') {
+        state.activeView = 'settings'
+      }
+      focusRuntime.mockReturnValue(false)
+      press('Enter')
+      expect(document.activeElement).toBe(list)
+      if (target !== 'unmounted') {
+        expect(focusRuntime).not.toHaveBeenCalled()
+      }
+    }
+  )
+})
diff --git a/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.host-identity.test.tsx b/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.host-identity.test.tsx
index efac59a9c07..4944d69340a 100644
--- a/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.host-identity.test.tsx
+++ b/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.host-identity.test.tsx
@@ -101,7 +101,7 @@ describe('worktree keyboard cycling with a resolved active host', () => {
 
     press('down')
 
-    expect(activateAndRevealWorktree).toHaveBeenCalledWith('c', {})
+    expect(activateAndRevealWorktree).toHaveBeenCalledWith('c', { navigationIntent: 'user-open' })
   })
 
   it('steps to the previous row when the active host resolved to local', () => {
@@ -109,7 +109,7 @@ describe('worktree keyboard cycling with a resolved active host', () => {
 
     press('up')
 
-    expect(activateAndRevealWorktree).toHaveBeenCalledWith('a', {})
+    expect(activateAndRevealWorktree).toHaveBeenCalledWith('a', { navigationIntent: 'user-open' })
   })
 
   it('still steps normally when the active host is unqualified', () => {
@@ -117,6 +117,6 @@ describe('worktree keyboard cycling with a resolved active host', () => {
 
     press('down')
 
-    expect(activateAndRevealWorktree).toHaveBeenCalledWith('c', {})
+    expect(activateAndRevealWorktree).toHaveBeenCalledWith('c', { navigationIntent: 'user-open' })
   })
 })
diff --git a/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.ts b/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.ts
index c8d3ec5d80d..612bd82b505 100644
--- a/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.ts
+++ b/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.ts
@@ -3,6 +3,8 @@ import type React from 'react'
 import type { Virtualizer } from '@tanstack/react-virtual'
 import { useAppStore } from '@/store'
 import { activateAndRevealWorktree } from '@/lib/worktree-activation'
+import { focusRuntimeTerminalSurface } from '@/runtime/sync-runtime-graph'
+import { hasVisibleOverlay } from '@/lib/visible-overlay'
 import type { ExecutionHostId } from '../../../../../../shared/execution-host'
 import { getShortcutPlatform } from '@/lib/shortcut-platform'
 import { keybindingMatchesAction } from '../../../../../../shared/keybindings'
@@ -87,10 +89,10 @@ export function useWorktreeListKeyboardNavigation(args: {
       }
 
       // Why: keyboard cycling is real navigation; route through the activation helper that records history.
-      activateAndRevealWorktree(
-        nextWorktree.id,
-        nextWorktree.hostId ? { executionHostId: nextWorktree.hostId } : {}
-      )
+      activateAndRevealWorktree(nextWorktree.id, {
+        navigationIntent: 'user-open',
+        ...(nextWorktree.hostId ? { executionHostId: nextWorktree.hostId } : {})
+      })
 
       const rowIndex = findPreferredRenderRowIndexForWorktreeIdentity(
         renderRows,
@@ -112,13 +114,19 @@ export function useWorktreeListKeyboardNavigation(args: {
   )
 
   useEffect(() => {
+    const endListNavigation = () => {
+      scrollRef.current?.removeAttribute('data-keyboard-navigation')
+    }
     const handleKeyDown = (e: KeyboardEvent) => {
       if (activeModal !== 'none' || isEditableTarget(e.target)) {
         return
       }
 
       const platform = getShortcutPlatform()
-      if (keybindingMatchesAction('sidebar.focusWorktreeList', e, platform, keybindings)) {
+      if (
+        keybindingMatchesAction('sidebar.focusWorktreeList', e, platform, keybindings) &&
+        !hasVisibleOverlay()
+      ) {
         scrollRef.current?.focus()
         e.preventDefault()
         return
@@ -129,7 +137,8 @@ export function useWorktreeListKeyboardNavigation(args: {
         : keybindingMatchesAction('worktree.navigateDown', e, platform, keybindings)
           ? 'down'
           : null
-      if (direction) {
+      if (direction && !hasVisibleOverlay()) {
+        endListNavigation()
         markDirectScrollInput()
         navigateWorktree(direction)
         e.preventDefault()
@@ -137,31 +146,50 @@ export function useWorktreeListKeyboardNavigation(args: {
     }
 
     window.addEventListener('keydown', handleKeyDown, { capture: true })
-    return () => window.removeEventListener('keydown', handleKeyDown, { capture: true })
+    window.addEventListener('pointerdown', endListNavigation, { capture: true })
+    window.addEventListener('focusout', endListNavigation, { capture: true })
+    return () => {
+      window.removeEventListener('keydown', handleKeyDown, { capture: true })
+      window.removeEventListener('pointerdown', endListNavigation, { capture: true })
+      window.removeEventListener('focusout', endListNavigation, { capture: true })
+    }
   }, [activeModal, keybindings, markDirectScrollInput, navigateWorktree, scrollRef])
 
   const handleContainerKeyDown = useCallback(
     (e: React.KeyboardEvent) => {
+      if (
+        e.defaultPrevented ||
+        e.target !== e.currentTarget ||
+        activeModal !== 'none' ||
+        hasVisibleOverlay()
+      ) {
+        return
+      }
       if (e.key === 'ArrowUp' || e.key === 'ArrowDown') {
-        if (e.target !== e.currentTarget) {
-          return
-        }
+        // The focused DOM node owns navigation, including while a new terminal mounts.
+        e.currentTarget.setAttribute('data-keyboard-navigation', '')
         markDirectScrollInput()
         navigateWorktree(e.key === 'ArrowUp' ? 'up' : 'down')
         e.preventDefault()
       } else if (e.key === 'Enter') {
-        const helper = document.querySelector(
-          '.xterm-helper-textarea'
-        ) as HTMLTextAreaElement | null
-        if (helper) {
-          helper.focus()
+        const { activeView, activeWorktreeId, activeTabType, activeTabId, tabsByWorktree } =
+          useAppStore.getState()
+        if (
+          activeView === 'terminal' &&
+          activeTabType === 'terminal' &&
+          activeWorktreeId &&
+          activeTabId &&
+          tabsByWorktree[activeWorktreeId]?.some((tab) => tab.id === activeTabId)
+        ) {
+          // The registered manager owns the active split; unavailable surfaces keep list focus.
+          focusRuntimeTerminalSurface(activeTabId, null, activeWorktreeId)
         }
         e.preventDefault()
       } else if (['PageUp', 'PageDown', 'Home', 'End', ' '].includes(e.key)) {
         markDirectScrollInput()
       }
     },
-    [markDirectScrollInput, navigateWorktree]
+    [activeModal, markDirectScrollInput, navigateWorktree]
   )
 
   return { handleContainerKeyDown }
diff --git a/src/renderer/src/components/sidebar/worktree-snapshot-prune-batch.ts b/src/renderer/src/components/sidebar/worktree-snapshot-prune-batch.ts
index 91e970291fd..f8cbd049cf8 100644
--- a/src/renderer/src/components/sidebar/worktree-snapshot-prune-batch.ts
+++ b/src/renderer/src/components/sidebar/worktree-snapshot-prune-batch.ts
@@ -1,3 +1,5 @@
+import { createBrowserUuid } from '@/lib/browser-uuid'
+
 export type WorktreeSnapshotPruneBatch = {
   batchId: string
   finish: () => Promise<void>
@@ -14,7 +16,7 @@ export function beginWorktreeSnapshotPruneBatch(): Promise<WorktreeSnapshotPrune
   if (typeof begin !== 'function' || typeof record !== 'function' || typeof finish !== 'function') {
     return null
   }
-  const batchId = crypto.randomUUID()
+  const batchId = createBrowserUuid()
   return begin({ batchId })
     .then(() => ({ batchId, finish: () => finish({ batchId }) }))
     .catch((error: unknown) => {
diff --git a/src/renderer/src/components/sidebar/worktree-subagent-child-rows.ts b/src/renderer/src/components/sidebar/worktree-subagent-child-rows.ts
index e629a8e352b..729038d46ef 100644
--- a/src/renderer/src/components/sidebar/worktree-subagent-child-rows.ts
+++ b/src/renderer/src/components/sidebar/worktree-subagent-child-rows.ts
@@ -1,6 +1,17 @@
 import type { DashboardAgentRow } from '@/components/dashboard/useDashboardData'
+import type { AgentRowState } from '@/lib/agent-row-decay-state'
 import type { AgentStatusEntry } from '../../../../shared/agent-status-types'
-import { resolveAgentChildWorkFreshness } from '../../../../shared/agent-status-child-work-freshness'
+import {
+  agentChildRowContextForParent,
+  buildAgentChildRowModels,
+  buildLegacyAgentChildRowModels,
+  flattenAgentChildRowModels,
+  type AgentChildRowModel
+} from '../../../../shared/agent-child-row-model'
+import {
+  agentChildRunStateFor,
+  type AgentChildDisplayState
+} from '../../../../shared/agent-status-child-work-display'
 import type { TerminalTab } from '../../../../shared/terminal-tab-types'
 
 /** Row-identity key for an in-process subagent child row. The NUL separator
@@ -11,12 +22,71 @@ function subagentRowKey(parentPaneKey: string, subagentId: string): string {
   return `${parentPaneKey}\u0000subagent:${subagentId}`
 }
 
+/** The lifecycle word every reader of a CLI row already understands; the row's own dot says more. */
+function agentRowStateFor(displayState: AgentChildDisplayState): AgentRowState {
+  const runState = agentChildRunStateFor(displayState)
+  // A CLI row carries monitoring as `working` plus its `workingMode`.
+  return runState === 'monitoring' ? 'working' : runState
+}
+
+function childDashboardRow(
+  row: AgentChildRowModel,
+  parentEntry: AgentStatusEntry,
+  tab: TerminalTab
+): DashboardAgentRow {
+  const state = agentRowStateFor(row.displayState)
+  const startedAt = row.firstObservedAt > 0 ? row.firstObservedAt : parentEntry.stateStartedAt
+  const paneKey = subagentRowKey(parentEntry.paneKey, row.id)
+  const detail = row.detail
+  // The same fields a CLI agent row carries, so every reader of a CLI row reads a child the same way.
+  const entry: AgentStatusEntry = {
+    state: state === 'idle' || state === 'unverifiable' ? 'done' : state,
+    ...(row.displayState === 'monitoring' ? { workingMode: 'monitoring' as const } : {}),
+    prompt: row.name,
+    // The parent's delivery clock; the child's own evidence clock rides `evidenceObservedAt`.
+    updatedAt: parentEntry.updatedAt,
+    ...(row.observedAt !== undefined ? { evidenceObservedAt: row.observedAt } : {}),
+    stateStartedAt: startedAt,
+    agentType: row.agentType,
+    model: row.model,
+    ...(detail?.kind === 'operation'
+      ? {
+          toolName: detail.toolName,
+          ...(detail.input !== undefined ? { toolInput: detail.input } : {})
+        }
+      : {}),
+    ...(detail?.kind === 'message' ? { lastAssistantMessage: detail.text } : {}),
+    paneKey,
+    worktreeId: parentEntry.worktreeId,
+    tabId: parentEntry.tabId,
+    stateHistory: [],
+    orchestration: {
+      taskId: `subagent:${row.id}`,
+      dispatchId: `subagent:${row.id}`,
+      displayName: row.name || undefined,
+      parentPaneKey: parentEntry.paneKey
+    }
+  }
+  return {
+    paneKey,
+    entry,
+    tab,
+    agentType: row.agentType ?? 'unknown',
+    rowSource: 'subagent',
+    state,
+    activationPaneKey: parentEntry.paneKey,
+    startedAt,
+    childRow: row
+  }
+}
+
 /**
- * Derive indented child rows for the live in-process subagents/teammates a
- * pane's agent has spawned (entry.subagents, reported via agent hooks). These
- * children have no PTY or tab of their own: the rows reuse the parent's tab,
- * activate the parent's pane, and link into the existing lineage tree through
- * `orchestration.parentPaneKey`.
+ * Derive indented child rows for the subagents/teammates a pane's agent has
+ * spawned. These children have no PTY or tab of their own: the rows reuse the
+ * parent's tab, activate the parent's pane, and link into the existing lineage
+ * tree through `orchestration.parentPaneKey`. The host's child views win; a host
+ * that sends only the legacy `subagents` snapshot (an old host, any CLI pane)
+ * is read as before.
  */
 export function buildSubagentChildRows(args: {
   parentEntry: AgentStatusEntry
@@ -25,48 +95,14 @@ export function buildSubagentChildRows(args: {
    *  states are equally unverifiable. */
   parentIsFresh: boolean
 }): DashboardAgentRow[] {
-  const subagents = args.parentEntry.subagents
-  if (!subagents || subagents.length === 0) {
-    return []
-  }
-  return subagents.map((subagent) => {
-    const freshness = resolveAgentChildWorkFreshness({
-      state: subagent.state,
-      membership: 'live',
-      parentEvidenceFresh: args.parentIsFresh,
-      transportObservation: args.parentEntry.subagentObservation ?? 'live'
-    })
-    const state = freshness === 'done' ? 'idle' : freshness === 'monitoring' ? 'working' : freshness
-    const activeState = state !== 'idle' && state !== 'unverifiable' ? state : undefined
-    const startedAt = subagent.startedAt > 0 ? subagent.startedAt : args.parentEntry.stateStartedAt
-    const paneKey = subagentRowKey(args.parentEntry.paneKey, subagent.id)
-    const entry: AgentStatusEntry = {
-      state: activeState ?? 'done',
-      prompt: subagent.description ?? subagent.agentType ?? '',
-      updatedAt: args.parentEntry.updatedAt,
-      stateStartedAt: startedAt,
-      agentType: subagent.agentType,
-      model: subagent.model,
-      paneKey,
-      worktreeId: args.parentEntry.worktreeId,
-      tabId: args.parentEntry.tabId,
-      stateHistory: [],
-      orchestration: {
-        taskId: `subagent:${subagent.id}`,
-        dispatchId: `subagent:${subagent.id}`,
-        displayName: subagent.description,
-        parentPaneKey: args.parentEntry.paneKey
-      }
-    }
-    return {
-      paneKey,
-      entry,
-      tab: args.tab,
-      agentType: subagent.agentType ?? 'unknown',
-      rowSource: 'subagent' as const,
-      state,
-      activationPaneKey: args.parentEntry.paneKey,
-      startedAt
-    }
-  })
+  const { parentEntry } = args
+  const context = agentChildRowContextForParent(parentEntry, args.parentIsFresh)
+  const rows =
+    parentEntry.children !== undefined
+      ? buildAgentChildRowModels(parentEntry.children, context)
+      : buildLegacyAgentChildRowModels(parentEntry.subagents ?? [], context)
+  // Shells and monitors show through their owner's dot; the sidebar lists agents.
+  return flattenAgentChildRowModels(rows)
+    .filter((row) => row.kind === 'agent')
+    .map((row) => childDashboardRow(row, parentEntry, args.tab))
 }
diff --git a/src/renderer/src/components/skills/SkillBundleInstallFlow.tsx b/src/renderer/src/components/skills/SkillBundleInstallFlow.tsx
index 3663ac4e81a..e4115f5ba13 100644
--- a/src/renderer/src/components/skills/SkillBundleInstallFlow.tsx
+++ b/src/renderer/src/components/skills/SkillBundleInstallFlow.tsx
@@ -24,6 +24,7 @@ import { translate } from '@/i18n/i18n'
 import { checklistItemsFromVersion } from './skill-package-checklist-items'
 import { summarizeSkillInstallRisk } from './skill-package-install-risk'
 import { retryableSkillIds } from './skill-bundle-retry-selection'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 type BundleVersion = SkillCloudVersion & {
   manifest: Extract<SkillCloudVersion['manifest'], { skills: unknown }>
@@ -169,7 +170,7 @@ export function SkillBundleInstallFlow(props: {
           return
         }
       }
-      const operationId = crypto.randomUUID()
+      const operationId = createBrowserUuid()
       installProgress.begin(operationId)
       const operation = await window.api.skills.installBundleShare({
         shareId: props.shareId,
diff --git a/src/renderer/src/components/skills/SkillInstallDialog.tsx b/src/renderer/src/components/skills/SkillInstallDialog.tsx
index 6ad6edcbedf..8f150708ee9 100644
--- a/src/renderer/src/components/skills/SkillInstallDialog.tsx
+++ b/src/renderer/src/components/skills/SkillInstallDialog.tsx
@@ -26,6 +26,7 @@ import { translate } from '@/i18n/i18n'
 import { resolveSkillShareForInstall } from './skill-warning-preview-gate'
 import { useSkillInstallRisk } from './use-skill-install-risk'
 import { SkillInstallDialogFooter } from './SkillInstallDialogFooter'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export function SkillInstallDialog({
   open,
@@ -193,7 +194,7 @@ export function SkillInstallDialog({
           return
         }
       }
-      const operationId = crypto.randomUUID()
+      const operationId = createBrowserUuid()
       installProgress.begin(operationId)
       const operation = await window.api.skills.installShare({
         shareId: preview.shareId,
diff --git a/src/renderer/src/components/skills/SkillInstallManagementDialog.tsx b/src/renderer/src/components/skills/SkillInstallManagementDialog.tsx
index d1a6016655f..7dabac57dfe 100644
--- a/src/renderer/src/components/skills/SkillInstallManagementDialog.tsx
+++ b/src/renderer/src/components/skills/SkillInstallManagementDialog.tsx
@@ -17,6 +17,7 @@ import {
 } from './skill-managed-install-groups'
 import { translate } from '@/i18n/i18n'
 import { SkillInstallManagementDialogContent } from './SkillInstallManagementDialogContent'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export function SkillInstallManagementDialog({
   open,
@@ -158,7 +159,7 @@ export function SkillInstallManagementDialog({
     setBusy(true)
     setError(null)
     setNotice(null)
-    const operationId = crypto.randomUUID()
+    const operationId = createBrowserUuid()
     installProgress.begin(operationId)
     try {
       const version = details?.versions.find((candidate) => candidate.versionId === versionId)
diff --git a/src/renderer/src/components/skills/use-skill-delete-flow.ts b/src/renderer/src/components/skills/use-skill-delete-flow.ts
index 654cefedc6d..1ca6f6035de 100644
--- a/src/renderer/src/components/skills/use-skill-delete-flow.ts
+++ b/src/renderer/src/components/skills/use-skill-delete-flow.ts
@@ -22,6 +22,7 @@ import {
   skillDeletePlacementSummary,
   skillDeleteRetainedSourceLines
 } from './skill-delete-copy'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export type SkillDeleteFlow = {
   /** False while the target is unresolved or the host predates the capability. */
@@ -38,7 +39,7 @@ export type SkillDeleteFlow = {
 
 function toRequest(skills: readonly DiscoveredSkill[]): SkillDeleteRequest {
   return {
-    operationId: crypto.randomUUID(),
+    operationId: createBrowserUuid(),
     skills: skills.map((skill) => ({
       id: skill.id,
       directoryPath: skill.directoryPath,
diff --git a/src/renderer/src/components/sparse/SparseCheckoutPresetDraftForm.test.tsx b/src/renderer/src/components/sparse/SparseCheckoutPresetDraftForm.test.tsx
new file mode 100644
index 00000000000..2545d8d4eec
--- /dev/null
+++ b/src/renderer/src/components/sparse/SparseCheckoutPresetDraftForm.test.tsx
@@ -0,0 +1,110 @@
+// @vitest-environment happy-dom
+import { cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { afterEach, expect, it, vi } from 'vitest'
+import { SparseCheckoutPresetDraftForm } from './SparseCheckoutPresetDraftForm'
+
+afterEach(cleanup)
+const callbacks = { onDraftChange: vi.fn(), onSave: vi.fn(), onCancel: vi.fn() }
+
+it('keeps an untouched new preset neutral and reveals the name error on blur', () => {
+  render(
+    <SparseCheckoutPresetDraftForm
+      {...callbacks}
+      draft={{ mode: 'new', name: '', directoriesText: '' }}
+      parsedDirectories={{ directories: [], error: 'Add at least one directory.' }}
+      nameError="Name is required."
+      submitting={false}
+      canSave={false}
+    />
+  )
+  expect(screen.queryByText('Name is required.')).toBeNull()
+  // Why: an empty draft has nothing to be wrong with yet — the list states it plainly.
+  expect(screen.queryByText('Add at least one directory.')).toBeNull()
+  expect(screen.getByText('No folders added yet.')).toBeTruthy()
+  fireEvent.blur(screen.getByLabelText('Name'))
+  expect(screen.getByText('Name is required.')).toBeTruthy()
+})
+
+it('keeps a save failure alongside the retained draft', () => {
+  render(
+    <SparseCheckoutPresetDraftForm
+      {...callbacks}
+      draft={{ mode: 'edit', name: 'Web', directoriesText: 'apps/web' }}
+      parsedDirectories={{ directories: ['apps/web'], error: null }}
+      nameError={null}
+      submitting={false}
+      canSave={true}
+      operationError="Could not save the preset. Try again."
+    />
+  )
+  expect(screen.getByRole('alert').textContent).toContain('Try again')
+  expect(screen.getByText('apps/web')).toBeTruthy()
+  expect(screen.getByRole('button', { name: 'Save preset' }).hasAttribute('disabled')).toBe(false)
+})
+
+it('removes a selected directory from the draft', () => {
+  const onDraftChange = vi.fn()
+  render(
+    <SparseCheckoutPresetDraftForm
+      {...callbacks}
+      onDraftChange={onDraftChange}
+      draft={{ mode: 'edit', name: 'Web', directoriesText: 'apps/web\npackages/ui' }}
+      parsedDirectories={{ directories: ['apps/web', 'packages/ui'], error: null }}
+      nameError={null}
+      submitting={false}
+      canSave={true}
+    />
+  )
+  fireEvent.click(screen.getByRole('button', { name: 'Remove apps/web' }))
+  expect(onDraftChange).toHaveBeenCalledWith(
+    expect.objectContaining({ directoriesText: 'packages/ui' })
+  )
+})
+
+it('disables the folder picker until a repository root is known', () => {
+  const { rerender } = render(
+    <SparseCheckoutPresetDraftForm
+      {...callbacks}
+      draft={{ mode: 'new', name: '', directoriesText: '' }}
+      parsedDirectories={{ directories: [], error: null }}
+      nameError={null}
+      submitting={false}
+      canSave={false}
+    />
+  )
+  expect(screen.getByRole('combobox').hasAttribute('disabled')).toBe(true)
+  rerender(
+    <SparseCheckoutPresetDraftForm
+      {...callbacks}
+      draft={{ mode: 'new', name: '', directoriesText: '' }}
+      parsedDirectories={{ directories: [], error: null }}
+      nameError={null}
+      submitting={false}
+      canSave={false}
+      repoRootPath="/repo"
+    />
+  )
+  expect(screen.getByRole('combobox').hasAttribute('disabled')).toBe(false)
+})
+
+it('opens a preset saved before the chip editor with every directory intact', () => {
+  const onDraftChange = vi.fn()
+  const saved = ['apps/web', 'packages/ui', 'packages/design-tokens']
+  render(
+    <SparseCheckoutPresetDraftForm
+      {...callbacks}
+      onDraftChange={onDraftChange}
+      draft={{ mode: 'edit', name: 'Legacy', directoriesText: saved.join('\n') }}
+      parsedDirectories={{ directories: saved, error: null }}
+      nameError={null}
+      submitting={false}
+      canSave={true}
+    />
+  )
+  // Why: presets predate the chip editor, so the stored string[] must survive untouched.
+  for (const directory of saved) {
+    expect(screen.getByRole('button', { name: `Remove ${directory}` })).toBeTruthy()
+  }
+  expect(screen.getByRole('button', { name: 'Save preset' }).hasAttribute('disabled')).toBe(false)
+  expect(onDraftChange).not.toHaveBeenCalled()
+})
diff --git a/src/renderer/src/components/sparse/SparseCheckoutPresetDraftForm.tsx b/src/renderer/src/components/sparse/SparseCheckoutPresetDraftForm.tsx
index b257f7cf923..52b99620dd8 100644
--- a/src/renderer/src/components/sparse/SparseCheckoutPresetDraftForm.tsx
+++ b/src/renderer/src/components/sparse/SparseCheckoutPresetDraftForm.tsx
@@ -1,7 +1,13 @@
-import { LoaderCircle } from 'lucide-react'
+import { useId, useState } from 'react'
+import { Loader2 } from 'lucide-react'
 import { Button } from '@/components/ui/button'
 import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { SparseDirectoryPicker } from './SparseDirectoryPicker'
+import { SparseSelectedDirectoryList } from './SparseSelectedDirectoryList'
+import { addSparseDirectoryEntries } from './sparse-directory-entry-input'
 import { translate } from '@/i18n/i18n'
+import { normalizeSparseDirectoryLines } from '@/lib/sparse-paths'
 import type { SparsePresetDirectoryParseResult } from '@/lib/sparse-preset-draft'
 
 export type SparsePresetDraft = {
@@ -17,10 +23,13 @@ type SparseCheckoutPresetDraftFormProps = {
   nameError: string | null
   submitting: boolean
   canSave: boolean
-  setNameInputNode: (node: HTMLInputElement | null) => void
+  setNameInputNode?: (node: HTMLInputElement | null) => void
   onDraftChange: (draft: SparsePresetDraft) => void
   onCancel: () => void
   onSave: () => void
+  operationError?: string | null
+  repoRootPath?: string
+  repoConnectionId?: string
 }
 
 export function SparseCheckoutPresetDraftForm({
@@ -32,105 +41,124 @@ export function SparseCheckoutPresetDraftForm({
   setNameInputNode,
   onDraftChange,
   onCancel,
-  onSave
+  onSave,
+  operationError,
+  repoRootPath,
+  repoConnectionId
 }: SparseCheckoutPresetDraftFormProps): React.JSX.Element {
+  const id = useId()
+  const [nameTouched, setNameTouched] = useState(false)
+  const visibleNameError = nameTouched || draft.name.length > 0 ? nameError : null
+  const directoryError = draft.directoriesText.length > 0 ? parsedDirectories?.error : null
+  // Why: chips must survive a preset whose saved paths no longer parse.
+  const selectedDirectories = normalizeSparseDirectoryLines(draft.directoriesText)
+  const setDirectories = (next: string[]): void => {
+    onDraftChange({ ...draft, directoriesText: next.join('\n') })
+  }
+  const addDirectories = (directories: string[]): void => {
+    setDirectories(addSparseDirectoryEntries(selectedDirectories, directories))
+  }
+  const removeDirectory = (directory: string): void => {
+    setDirectories(selectedDirectories.filter((entry) => entry !== directory))
+  }
   return (
-    // Why: bg-popover matches the opaque surface the cmdk list (Command root) paints, so the draft
-    // form doesn't show the translucent PopoverContent through it while the list looks solid.
     <form
-      className="rounded-md bg-popover text-popover-foreground"
+      className="space-y-3"
       onSubmit={(event) => {
         event.preventDefault()
+        event.stopPropagation()
         onSave()
       }}
     >
-      <div className="border-b border-border px-3 py-2 text-xs font-medium text-foreground">
-        {draft.mode === 'new'
-          ? translate('auto.components.sparse.SparseCheckoutPresetSelect.c4ac80151d', 'New preset')
-          : translate(
-              'auto.components.sparse.SparseCheckoutPresetSelect.69c020eddc',
-              'Edit preset'
-            )}
-      </div>
-      <div className="space-y-3 px-3 py-3">
-        <div className="space-y-1">
-          <label
-            htmlFor="sparse-preset-name"
-            className="block text-[11px] font-medium text-muted-foreground"
-          >
-            {translate('auto.components.sparse.SparseCheckoutPresetSelect.b3a500c623', 'Name')}
-          </label>
+      <div className="space-y-3">
+        <div className="space-y-2">
+          <Label htmlFor={`${id}-name`}>{translate('sparsePreset.name', 'Name')}</Label>
           <Input
-            id="sparse-preset-name"
+            id={`${id}-name`}
             ref={setNameInputNode}
             value={draft.name}
             onChange={(event) => onDraftChange({ ...draft, name: event.target.value })}
-            placeholder={translate(
-              'auto.components.sparse.SparseCheckoutPresetSelect.064c1e2d12',
-              'Renderer UI'
-            )}
-            maxLength={80}
+            placeholder={translate('sparsePreset.namePlaceholder', 'Web app and shared UI')}
+            disabled={submitting}
             autoComplete="off"
             spellCheck={false}
-            className="h-8 text-xs"
+            onBlur={() => setNameTouched(true)}
+            aria-invalid={!!visibleNameError}
+            aria-describedby={visibleNameError ? `${id}-name-error` : undefined}
           />
+          {visibleNameError ? (
+            <p id={`${id}-name-error`} className="text-xs text-destructive">
+              {visibleNameError}
+            </p>
+          ) : null}
         </div>
-        <div className="space-y-1">
-          <label
-            htmlFor="sparse-preset-directories"
-            className="block text-[11px] font-medium text-muted-foreground"
-          >
+        <div className="space-y-2">
+          <Label id={`${id}-directories`}>
+            {translate('sparsePreset.directories', 'Directories')}
+          </Label>
+          <p id={`${id}-help`} className="text-xs text-muted-foreground">
             {translate(
-              'auto.components.sparse.SparseCheckoutPresetSelect.0e9ad9c798',
-              'Directories'
+              'sparsePreset.pathInstructions',
+              'Pick folders from the repository, or type any repo-relative path.'
             )}
-          </label>
-          {/* Why: match the app's canonical textarea (composer Note field) — border-input +
-              standard focus ring — instead of a one-off wrapper. font-mono since these are paths. */}
-          <textarea
-            id="sparse-preset-directories"
-            value={draft.directoriesText}
-            onChange={(event) => onDraftChange({ ...draft, directoriesText: event.target.value })}
-            placeholder={translate(
-              'auto.components.sparse.SparseCheckoutPresetSelect.ddbcaef7be',
-              'src/renderer packages/ui'
-            )}
-            rows={3}
-            spellCheck={false}
-            className="max-h-28 w-full min-w-0 resize-none rounded-md border border-input bg-transparent px-3 py-1.5 font-mono text-xs leading-5 shadow-xs transition-[color,box-shadow] outline-none selection:bg-primary selection:text-primary-foreground placeholder:text-muted-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50"
-          />
-        </div>
-      </div>
-      <div className="flex min-h-11 items-center justify-between gap-3 border-t border-border px-3 py-2">
-        <div className="min-w-0 text-[10px] text-muted-foreground">
-          {nameError ? (
-            <span className="text-destructive">{nameError}</span>
-          ) : parsedDirectories?.error ? (
-            <span className="text-destructive">{parsedDirectories.error}</span>
-          ) : parsedDirectories?.directories.length === 1 ? (
-            translate('auto.components.sparse.SparseCheckoutPresetSelect.e9283eb171', '1 directory')
-          ) : (
-            translate(
-              'auto.components.sparse.SparseCheckoutPresetSelect.14952d451e',
-              '{{value0}} directories',
-              { value0: parsedDirectories?.directories.length ?? 0 }
-            )
-          )}
-        </div>
-        <div className="flex shrink-0 justify-end gap-1">
-          <Button
-            type="button"
-            variant="ghost"
-            size="sm"
-            className="h-7 px-2 text-xs text-muted-foreground"
-            onClick={onCancel}
+          </p>
+          <SparseDirectoryPicker
+            rootPath={repoRootPath ?? ''}
+            connectionId={repoConnectionId}
+            selected={selectedDirectories}
             disabled={submitting}
-          >
-            {translate('auto.components.sparse.SparseCheckoutPresetSelect.de8fce5854', 'Cancel')}
+            describedById={`${id}-help ${id}-directory-status`}
+            onAdd={addDirectories}
+          />
+          <SparseSelectedDirectoryList
+            directories={selectedDirectories}
+            disabled={submitting}
+            onRemove={removeDirectory}
+          />
+          <p id={`${id}-directory-status`} aria-live="polite">
+            {directoryError ? (
+              <span className="text-xs text-destructive">{directoryError}</span>
+            ) : null}
+          </p>
+        </div>
+        <details className="space-y-2 text-xs text-muted-foreground">
+          <summary className="cursor-pointer">
+            {translate('sparsePreset.details', 'What gets checked out?')}
+          </summary>
+          <p>
+            {translate(
+              'sparsePreset.coneHelp',
+              'Git also keeps files at the repository root and along the parent folders of these directories.'
+            )}
+          </p>
+        </details>
+      </div>
+      <div className="space-y-3 border-t border-border pt-3">
+        {operationError ? (
+          <p role="alert" className="text-sm text-destructive">
+            {operationError}
+          </p>
+        ) : null}
+        <div className="flex justify-end gap-2">
+          <Button type="button" variant="ghost" onClick={onCancel} disabled={submitting}>
+            {translate('sparsePreset.cancel', 'Cancel')}
           </Button>
-          <Button type="submit" size="sm" className="h-7 px-2 text-xs" disabled={!canSave}>
-            {submitting ? <LoaderCircle className="size-3 animate-spin" /> : null}
-            {translate('auto.components.sparse.SparseCheckoutPresetSelect.8b12c0850a', 'Save')}
+          <Button
+            type="submit"
+            disabled={!canSave}
+            aria-busy={submitting}
+            aria-label={translate('sparsePreset.save', 'Save preset')}
+          >
+            <span className="relative">
+              <span className="data-[saving=true]:invisible" data-saving={submitting}>
+                {translate('sparsePreset.save', 'Save preset')}
+              </span>
+              {submitting ? (
+                <span className="absolute inset-0 flex items-center justify-center">
+                  <Loader2 className="size-4 animate-spin" />
+                </span>
+              ) : null}
+            </span>
           </Button>
         </div>
       </div>
diff --git a/src/renderer/src/components/sparse/SparseCheckoutPresetSelect.tsx b/src/renderer/src/components/sparse/SparseCheckoutPresetSelect.tsx
index a25f4337c9c..9916415e147 100644
--- a/src/renderer/src/components/sparse/SparseCheckoutPresetSelect.tsx
+++ b/src/renderer/src/components/sparse/SparseCheckoutPresetSelect.tsx
@@ -1,18 +1,15 @@
-import React, { useCallback, useMemo, useRef, useState } from 'react'
-import { Check, ChevronsUpDown, LoaderCircle, Pencil, Plus, RefreshCcw } from 'lucide-react'
+import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react'
+import { ChevronsUpDown, LoaderCircle, RefreshCcw } from 'lucide-react'
 import { Button } from '@/components/ui/button'
-import { Command, CommandItem, CommandList, CommandSeparator } from '@/components/ui/command'
+import { SparsePresetChooser } from './SparsePresetChooser'
 import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover'
 import { useAppStore } from '@/store'
-import { cn } from '@/lib/utils'
-import { parseSparsePresetDirectories } from '@/lib/sparse-preset-draft'
+import { parseSparsePresetDirectories, validateSparsePresetName } from '@/lib/sparse-preset-draft'
 import { useMountedRef } from '@/hooks/useMountedRef'
 import type { SparsePreset } from '../../../../shared/worktree/create-types'
 import { translate } from '@/i18n/i18n'
-import {
-  SparseCheckoutPresetDraftForm,
-  type SparsePresetDraft
-} from './SparseCheckoutPresetDraftForm'
+import type { SparsePresetDraft } from './SparseCheckoutPresetDraftForm'
+import { SparsePresetInlineEditor } from './SparsePresetInlineEditor'
 
 type SparseCheckoutPresetSelectProps = {
   repoId: string
@@ -20,6 +17,7 @@ type SparseCheckoutPresetSelectProps = {
   selectedPresetId: string | null
   onSelectPreset: (preset: SparsePreset | null) => void
   disabled?: boolean
+  onEditingChange?: (editing: boolean) => void
 }
 
 export default function SparseCheckoutPresetSelect({
@@ -27,8 +25,10 @@ export default function SparseCheckoutPresetSelect({
   presets,
   selectedPresetId,
   onSelectPreset,
-  disabled = false
+  disabled = false,
+  onEditingChange
 }: SparseCheckoutPresetSelectProps): React.JSX.Element {
+  const repo = useAppStore((s) => s.repos.find((entry) => entry.id === repoId))
   const fetchSparsePresets = useAppStore((s) => s.fetchSparsePresets)
   const saveSparsePreset = useAppStore((s) => s.saveSparsePreset)
   const presetsForRepo = useAppStore((s) => s.sparsePresetsByRepo[repoId])
@@ -39,10 +39,20 @@ export default function SparseCheckoutPresetSelect({
   const [open, setOpen] = useState(false)
   const [draft, setDraft] = useState<SparsePresetDraft | null>(null)
   const [submitting, setSubmitting] = useState(false)
+  const [operationError, setOperationError] = useState<string | null>(null)
+  const triggerRef = useRef<HTMLButtonElement>(null)
   const nameInputRef = useRef<HTMLInputElement>(null)
   const nameInputFocusFrameRef = useRef<number | null>(null)
   const mountedRef = useMountedRef()
 
+  useEffect(() => () => onEditingChange?.(false), [onEditingChange])
+
+  const finishDraft = useCallback(() => {
+    setDraft(null)
+    onEditingChange?.(false)
+    triggerRef.current?.focus()
+  }, [onEditingChange])
+
   const visiblePresets = presetsForRepo ?? presets
   const presetsLoaded = presetsForRepo !== undefined
   const isLoadingPresets = !disabled && presetsLoading
@@ -53,21 +63,9 @@ export default function SparseCheckoutPresetSelect({
   )
   const parsedDirectories = draft ? parseSparsePresetDirectories(draft.directoriesText) : null
   const trimmedName = draft?.name.trim() ?? ''
-  const nameCollision =
-    draft && trimmedName
-      ? (visiblePresets.find(
-          (preset) =>
-            preset.id !== draft.presetId && preset.name.toLowerCase() === trimmedName.toLowerCase()
-        ) ?? null)
-      : null
-  const nameError =
-    draft && trimmedName.length === 0
-      ? 'Name is required.'
-      : trimmedName.length > 80
-        ? 'Name must be 80 characters or fewer.'
-        : nameCollision
-          ? `"${nameCollision.name}" already exists.`
-          : null
+  const nameError = draft
+    ? validateSparsePresetName(draft.name, visiblePresets, draft.presetId)
+    : null
   const canSave =
     draft !== null &&
     !submitting &&
@@ -101,15 +99,21 @@ export default function SparseCheckoutPresetSelect({
       if (disabled || !presetsLoaded) {
         return
       }
+      setOpen(false)
+      setOperationError(null)
       setDraft(nextDraft)
+      onEditingChange?.(true)
       cancelNameInputFocusFrame()
       nameInputFocusFrameRef.current = requestAnimationFrame(() => {
         nameInputFocusFrameRef.current = null
         nameInputRef.current?.focus()
         nameInputRef.current?.select()
+        nameInputRef.current
+          ?.closest('[data-sparse-preset-editor]')
+          ?.scrollIntoView({ block: 'start' })
       })
     },
-    [cancelNameInputFocusFrame, disabled, presetsLoaded]
+    [cancelNameInputFocusFrame, disabled, onEditingChange, presetsLoaded]
   )
 
   const startNewPreset = useCallback((): void => {
@@ -141,6 +145,7 @@ export default function SparseCheckoutPresetSelect({
       return
     }
     setSubmitting(true)
+    setOperationError(null)
     try {
       const saved = await saveSparsePreset({
         repoId,
@@ -152,8 +157,18 @@ export default function SparseCheckoutPresetSelect({
         if (draft.mode === 'new' || selectedPresetId === saved.id) {
           onSelectPreset(saved)
         }
-        setDraft(null)
+        finishDraft()
         setOpen(false)
+      } else if (mountedRef.current) {
+        setOperationError(
+          translate('sparsePreset.saveFailed', 'Could not save the preset. Try again.')
+        )
+      }
+    } catch {
+      if (mountedRef.current) {
+        setOperationError(
+          translate('sparsePreset.saveFailed', 'Could not save the preset. Try again.')
+        )
       }
     } finally {
       if (mountedRef.current) {
@@ -163,6 +178,7 @@ export default function SparseCheckoutPresetSelect({
   }, [
     canSave,
     draft,
+    finishDraft,
     mountedRef,
     onSelectPreset,
     parsedDirectories,
@@ -194,171 +210,122 @@ export default function SparseCheckoutPresetSelect({
   )
 
   const triggerLabel = isLoadingPresets
-    ? 'Loading presets...'
+    ? translate('sparsePreset.loading', 'Loading presets...')
     : hasPresetLoadError
-      ? 'Retry loading presets'
+      ? translate(
+          'auto.components.sparse.SparseCheckoutPresetSelect.a683a4bc8e',
+          'Retry loading presets'
+        )
       : !presetsLoaded
-        ? 'Load presets'
+        ? translate('auto.components.sparse.SparseCheckoutPresetSelect.16223dde6a', 'Load presets')
         : selectedPreset
           ? selectedPreset.name
-          : 'Off'
+          : translate('sparsePreset.fullCheckout', 'Full checkout')
 
   return (
-    <Popover
-      open={open}
-      onOpenChange={(nextOpen) => {
-        if (nextOpen && presetsLoading) {
-          setOpen(false)
-          setDraft(null)
-          return
-        }
-        setOpen(nextOpen)
-        if (!nextOpen) {
-          setDraft(null)
-        }
-      }}
-    >
-      <PopoverTrigger asChild>
-        <Button
-          type="button"
-          variant="outline"
-          role="combobox"
-          aria-expanded={open}
-          aria-busy={isLoadingPresets}
-          disabled={disabled || isLoadingPresets}
-          className="h-9 w-full justify-between border-input px-3 text-sm font-normal text-foreground focus:border-ring focus:ring-[3px] focus:ring-ring/50"
-        >
-          <span className="truncate">{triggerLabel}</span>
-          {isLoadingPresets ? (
-            <LoaderCircle className="size-3.5 animate-spin opacity-60" />
-          ) : hasPresetLoadError || !presetsLoaded ? (
-            <RefreshCcw className="size-3.5 opacity-60" />
-          ) : (
-            <ChevronsUpDown className="size-3.5 opacity-50" />
-          )}
-        </Button>
-      </PopoverTrigger>
-      <PopoverContent
-        align="start"
-        className="popover-scroll-content max-h-[min(var(--radix-popover-content-available-height),24rem)] w-[var(--radix-popover-trigger-width)] max-w-[calc(100vw-2rem)] overflow-y-auto p-0 scrollbar-sleek"
-        onOpenAutoFocus={(event) => event.preventDefault()}
+    <>
+      <Popover
+        open={open}
+        onOpenChange={(nextOpen) => {
+          if (nextOpen && draft) {
+            return
+          }
+          if (nextOpen && presetsLoading) {
+            setOpen(false)
+            setDraft(null)
+            return
+          }
+          setOpen(nextOpen)
+        }}
       >
-        {draft ? (
-          <SparseCheckoutPresetDraftForm
-            draft={draft}
-            parsedDirectories={parsedDirectories}
-            nameError={nameError}
-            submitting={submitting}
-            canSave={canSave}
-            setNameInputNode={setNameInputNode}
-            onDraftChange={setDraft}
-            onCancel={() => setDraft(null)}
-            onSave={() => void handleSaveDraft()}
-          />
-        ) : !presetsLoaded ? (
-          <div className="p-1">
-            {hasPresetLoadError ? (
-              <div className="px-2 py-1.5 text-[11px] text-destructive">
-                <span className="break-words">{presetsLoadError}</span>
-              </div>
-            ) : null}
-            <button
-              type="button"
-              className="flex h-9 w-full items-center gap-2 rounded-md px-2 text-left text-xs hover:bg-accent hover:text-accent-foreground"
-              onClick={handleRetryLoadPresets}
-            >
-              <RefreshCcw className="size-3.5 text-muted-foreground" />
-              <span className="truncate">
-                {hasPresetLoadError
-                  ? translate(
-                      'auto.components.sparse.SparseCheckoutPresetSelect.a683a4bc8e',
-                      'Retry loading presets'
-                    )
-                  : translate(
-                      'auto.components.sparse.SparseCheckoutPresetSelect.16223dde6a',
-                      'Load presets'
-                    )}
-              </span>
-            </button>
-          </div>
-        ) : (
-          // Why: cmdk Command/CommandItem so this dropdown matches the other composer pickers
-          // (run-target, project, agent) — same padding, keyboard-highlight, and check placement.
-          <Command value={selectedPreset ? `preset:${selectedPreset.id}` : 'off'}>
-            <CommandList>
-              <CommandItem
-                value="off"
-                onSelect={handleSelectOff}
-                className="items-center gap-2 px-3 py-2"
-              >
-                <Check className={cn('size-4', selectedPreset ? 'opacity-0' : 'opacity-100')} />
-                <span className="truncate">
-                  {translate('auto.components.sparse.SparseCheckoutPresetSelect.c7f9b3f0c1', 'Off')}
-                </span>
-              </CommandItem>
-              {visiblePresets.length > 0 ? (
-                <>
-                  <CommandSeparator />
-                  {visiblePresets.map((preset) => (
-                    <CommandItem
-                      key={preset.id}
-                      value={`preset:${preset.id}`}
-                      onSelect={() => handleSelectPreset(preset)}
-                      className="items-center gap-2 px-3 py-2"
-                    >
-                      <Check
-                        className={cn(
-                          'size-4 shrink-0',
-                          selectedPreset?.id === preset.id ? 'opacity-100' : 'opacity-0'
-                        )}
-                      />
-                      <span className="min-w-0 flex-1 truncate">{preset.name}</span>
-                      <Button
-                        type="button"
-                        variant="ghost"
-                        size="icon-xs"
-                        aria-label={translate(
-                          'auto.components.sparse.SparseCheckoutPresetSelect.7c3275d307',
-                          'Edit {{value0}}',
-                          { value0: preset.name }
-                        )}
-                        className="ml-1 size-6 shrink-0 rounded-md text-muted-foreground hover:bg-background/35 hover:text-foreground"
-                        // Why: the pencil opens the edit draft; stop the event so cmdk doesn't
-                        // also select the preset row underneath it.
-                        onPointerDown={(event) => {
-                          event.preventDefault()
-                          event.stopPropagation()
-                        }}
-                        onClick={(event) => {
-                          event.preventDefault()
-                          event.stopPropagation()
-                          startEditPreset(preset)
-                        }}
-                      >
-                        <Pencil className="size-3.5" />
-                      </Button>
-                    </CommandItem>
-                  ))}
-                </>
+        <PopoverTrigger asChild>
+          <Button
+            ref={triggerRef}
+            type="button"
+            variant="outline"
+            role="combobox"
+            aria-label={translate('sparsePreset.checkoutPreset', 'Checkout preset')}
+            aria-expanded={open}
+            aria-busy={isLoadingPresets}
+            aria-disabled={Boolean(draft) || undefined}
+            disabled={disabled || isLoadingPresets}
+            className="w-full justify-between"
+          >
+            <span className="truncate">{triggerLabel}</span>
+            {isLoadingPresets ? (
+              <LoaderCircle className="size-3.5 animate-spin opacity-60" />
+            ) : hasPresetLoadError || !presetsLoaded ? (
+              <RefreshCcw className="size-3.5 opacity-60" />
+            ) : (
+              <ChevronsUpDown className="size-3.5 opacity-50" />
+            )}
+          </Button>
+        </PopoverTrigger>
+        <PopoverContent
+          align="start"
+          sideOffset={0}
+          wheelScroll
+          className="w-[var(--radix-popover-trigger-width)] max-w-[calc(100vw-2rem)]"
+          onCloseAutoFocus={(event) => {
+            if (draft) {
+              event.preventDefault()
+            }
+          }}
+        >
+          {!presetsLoaded ? (
+            <div className="p-1">
+              {hasPresetLoadError ? (
+                <div className="px-2 py-1.5 text-[11px] text-destructive">
+                  <span className="break-words">{presetsLoadError}</span>
+                </div>
               ) : null}
-              <CommandSeparator />
-              <CommandItem
-                value="new-preset"
-                onSelect={startNewPreset}
-                className="items-center gap-2 px-3 py-2 text-muted-foreground"
+              <button
+                type="button"
+                className="flex h-9 w-full items-center gap-2 rounded-md px-2 text-left text-xs hover:bg-accent hover:text-accent-foreground"
+                onClick={handleRetryLoadPresets}
               >
-                <Plus className="size-4 shrink-0" />
+                <RefreshCcw className="size-3.5 text-muted-foreground" />
                 <span className="truncate">
-                  {translate(
-                    'auto.components.sparse.SparseCheckoutPresetSelect.c4ac80151d',
-                    'New preset'
-                  )}
+                  {hasPresetLoadError
+                    ? translate(
+                        'auto.components.sparse.SparseCheckoutPresetSelect.a683a4bc8e',
+                        'Retry loading presets'
+                      )
+                    : translate(
+                        'auto.components.sparse.SparseCheckoutPresetSelect.16223dde6a',
+                        'Load presets'
+                      )}
                 </span>
-              </CommandItem>
-            </CommandList>
-          </Command>
-        )}
-      </PopoverContent>
-    </Popover>
+              </button>
+            </div>
+          ) : (
+            <SparsePresetChooser
+              presets={visiblePresets}
+              selectedPresetId={selectedPresetId}
+              onSelect={handleSelectPreset}
+              onSelectFull={handleSelectOff}
+              onEdit={startEditPreset}
+              onNew={startNewPreset}
+            />
+          )}
+        </PopoverContent>
+      </Popover>
+      {draft ? (
+        <SparsePresetInlineEditor
+          draft={draft}
+          parsedDirectories={parsedDirectories}
+          nameError={nameError}
+          submitting={submitting}
+          canSave={canSave}
+          setNameInputNode={setNameInputNode}
+          onDraftChange={setDraft}
+          onCancel={finishDraft}
+          onSave={() => void handleSaveDraft()}
+          operationError={operationError}
+          repoRootPath={repo?.path}
+          repoConnectionId={repo?.connectionId ?? undefined}
+        />
+      ) : null}
+    </>
   )
 }
diff --git a/src/renderer/src/components/sparse/SparseDirectoryPicker.tsx b/src/renderer/src/components/sparse/SparseDirectoryPicker.tsx
new file mode 100644
index 00000000000..3b6a68e389a
--- /dev/null
+++ b/src/renderer/src/components/sparse/SparseDirectoryPicker.tsx
@@ -0,0 +1,247 @@
+import { useCallback, useEffect, useMemo, useState } from 'react'
+import { ChevronRight, ChevronsUpDown, Folder, LoaderCircle, Plus } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import {
+  Command,
+  CommandEmpty,
+  CommandInput,
+  CommandItem,
+  CommandList
+} from '@/components/ui/command'
+import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover'
+import { getWorktreeSymlinkPathFilterState } from '@/components/settings/worktree-symlink-path-filter'
+import { joinPath } from '@/lib/path'
+import { translate } from '@/i18n/i18n'
+import {
+  getSparseBrowseTrail,
+  joinSparseBrowsePath,
+  listBrowsableDirectories
+} from './sparse-directory-browse'
+import { parseSparseDirectoryEntryInput } from './sparse-directory-entry-input'
+
+type SparseDirectoryPickerProps = {
+  rootPath: string
+  connectionId?: string
+  selected: string[]
+  disabled: boolean
+  describedById?: string
+  onAdd: (directories: string[]) => void
+}
+
+type BrowseState =
+  | { status: 'loading' }
+  | { status: 'ready'; directories: string[] }
+  | { status: 'error' }
+
+export function SparseDirectoryPicker({
+  rootPath,
+  connectionId,
+  selected,
+  disabled,
+  describedById,
+  onAdd
+}: SparseDirectoryPickerProps): React.JSX.Element {
+  const [open, setOpen] = useState(false)
+  const [relativePath, setRelativePath] = useState('')
+  const [query, setQuery] = useState('')
+  const [state, setState] = useState<BrowseState>({ status: 'loading' })
+
+  useEffect(() => {
+    if (!open || !rootPath) {
+      return
+    }
+    let cancelled = false
+    setState({ status: 'loading' })
+    void window.api.fs
+      .readDir({ dirPath: joinPath(rootPath, relativePath), connectionId })
+      .then((entries) => {
+        if (!cancelled) {
+          setState({ status: 'ready', directories: listBrowsableDirectories(entries) })
+        }
+      })
+      .catch(() => {
+        if (!cancelled) {
+          setState({ status: 'error' })
+        }
+      })
+    return () => {
+      cancelled = true
+    }
+  }, [open, rootPath, relativePath, connectionId])
+
+  const handleOpenChange = useCallback((nextOpen: boolean): void => {
+    setOpen(nextOpen)
+    if (!nextOpen) {
+      setRelativePath('')
+      setQuery('')
+    }
+  }, [])
+
+  const commit = useCallback(
+    (raw: string): void => {
+      const { entries } = parseSparseDirectoryEntryInput(raw)
+      if (entries.length > 0) {
+        onAdd(entries)
+      }
+      setQuery('')
+      handleOpenChange(false)
+    },
+    [handleOpenChange, onAdd]
+  )
+
+  const { queryTrimmed, filtered, showLiteralItem } = useMemo(
+    () =>
+      getWorktreeSymlinkPathFilterState({
+        query,
+        suggestions:
+          state.status === 'ready'
+            ? state.directories.map((name) => ({ name, isDirectory: true }))
+            : [],
+        existingPaths: selected
+      }),
+    [query, state, selected]
+  )
+  // Why: free-form typing is repo-relative, so it must not inherit the browsed folder.
+  const literalError = showLiteralItem ? parseSparseDirectoryEntryInput(queryTrimmed).error : null
+  const trail = getSparseBrowseTrail(relativePath)
+
+  return (
+    <Popover open={open} onOpenChange={handleOpenChange}>
+      <PopoverTrigger asChild>
+        <Button
+          type="button"
+          variant="outline"
+          role="combobox"
+          // Why: combobox takes no name from content, so the visible label is not enough.
+          aria-label={translate('sparsePreset.addPath', 'Add a folder')}
+          aria-expanded={open}
+          aria-describedby={describedById}
+          disabled={disabled || !rootPath}
+          className="w-full justify-between"
+        >
+          <span className="truncate">{translate('sparsePreset.addPath', 'Add a folder')}</span>
+          <ChevronsUpDown className="size-3.5 opacity-50" />
+        </Button>
+      </PopoverTrigger>
+      <PopoverContent
+        align="start"
+        sideOffset={4}
+        className="w-[var(--radix-popover-trigger-width)]"
+        onEscapeKeyDown={(event) => event.stopPropagation()}
+      >
+        <div className="flex max-h-[min(var(--radix-popover-content-available-height),22rem)] flex-col">
+          <div className="flex shrink-0 flex-wrap items-center gap-0.5 border-b border-border px-2 py-1.5 text-xs text-muted-foreground">
+            <button
+              type="button"
+              className="rounded px-1 py-0.5 hover:bg-accent hover:text-accent-foreground"
+              onClick={() => setRelativePath('')}
+            >
+              {translate('sparsePreset.repositoryRoot', 'Repository root')}
+            </button>
+            {trail.map((segment) => (
+              <span key={segment.path} className="flex items-center gap-0.5">
+                <ChevronRight className="size-3 opacity-50" />
+                <button
+                  type="button"
+                  className="max-w-32 truncate rounded px-1 py-0.5 font-mono hover:bg-accent hover:text-accent-foreground"
+                  onClick={() => setRelativePath(segment.path)}
+                >
+                  {segment.name}
+                </button>
+              </span>
+            ))}
+          </div>
+          <Command shouldFilter={false} className="min-h-0 flex-1">
+            <CommandInput
+              placeholder={translate(
+                'sparsePreset.findOrTypePath',
+                'Find a folder, or type any path…'
+              )}
+              aria-label={translate(
+                'sparsePreset.findOrTypePath',
+                'Find a folder, or type any path…'
+              )}
+              value={query}
+              onValueChange={setQuery}
+            />
+            <CommandList className="min-h-0 flex-1">
+              <CommandEmpty>
+                {state.status === 'loading'
+                  ? translate('sparsePreset.loadingPaths', 'Reading folders…')
+                  : state.status === 'error'
+                    ? translate(
+                        'sparsePreset.pathsUnavailable',
+                        'Could not read this folder. Type the path instead.'
+                      )
+                    : translate('sparsePreset.noPathMatches', 'No folders found.')}
+              </CommandEmpty>
+              {showLiteralItem ? (
+                literalError ? (
+                  <p className="px-3 py-2 text-xs text-destructive">{literalError}</p>
+                ) : (
+                  <CommandItem
+                    value={`__literal__:${queryTrimmed}`}
+                    onSelect={() => commit(queryTrimmed)}
+                  >
+                    <Plus className="size-4 shrink-0 text-muted-foreground" />
+                    <span className="truncate text-xs">
+                      {translate('sparsePreset.addTypedPath', 'Add')}{' '}
+                      <code className="rounded bg-muted px-1 py-0.5 font-mono text-[11px]">
+                        {queryTrimmed}
+                      </code>
+                    </span>
+                  </CommandItem>
+                )
+              ) : null}
+              {state.status === 'loading' ? (
+                <div className="flex items-center justify-center py-4">
+                  <LoaderCircle className="size-4 animate-spin opacity-60" />
+                </div>
+              ) : null}
+              {filtered.map((entry) => {
+                const path = joinSparseBrowsePath(relativePath, entry.name)
+                const alreadySelected = selected.includes(path)
+                return (
+                  <CommandItem
+                    key={path}
+                    value={path}
+                    disabled={alreadySelected}
+                    onSelect={() => commit(path)}
+                  >
+                    <Folder className="size-4 shrink-0 text-muted-foreground" />
+                    <span className="flex-1 truncate font-mono text-xs">{entry.name}</span>
+                    {alreadySelected ? (
+                      <span className="text-[11px] text-muted-foreground">
+                        {translate('sparsePreset.pathAdded', 'Added')}
+                      </span>
+                    ) : null}
+                    <Button
+                      type="button"
+                      variant="ghost"
+                      size="icon-xs"
+                      aria-label={translate('sparsePreset.openFolder', 'Open {{name}}', {
+                        name: entry.name
+                      })}
+                      onClick={(event) => {
+                        event.stopPropagation()
+                        setRelativePath(path)
+                        setQuery('')
+                      }}
+                      onKeyDown={(event) => {
+                        if (event.key === 'Enter' || event.key === ' ') {
+                          event.stopPropagation()
+                        }
+                      }}
+                    >
+                      <ChevronRight />
+                    </Button>
+                  </CommandItem>
+                )
+              })}
+            </CommandList>
+          </Command>
+        </div>
+      </PopoverContent>
+    </Popover>
+  )
+}
diff --git a/src/renderer/src/components/sparse/SparsePresetChooser.test.tsx b/src/renderer/src/components/sparse/SparsePresetChooser.test.tsx
new file mode 100644
index 00000000000..0ec37e85cc5
--- /dev/null
+++ b/src/renderer/src/components/sparse/SparsePresetChooser.test.tsx
@@ -0,0 +1,72 @@
+// @vitest-environment happy-dom
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { TooltipProvider } from '@/components/ui/tooltip'
+import { SparsePresetChooser } from './SparsePresetChooser'
+
+const presets = [
+  {
+    id: 'web',
+    repoId: 'repo',
+    name: 'Web app',
+    directories: ['apps/web'],
+    createdAt: 0,
+    updatedAt: 0
+  },
+  {
+    id: 'api',
+    repoId: 'repo',
+    name: 'API',
+    directories: ['services/backend'],
+    createdAt: 0,
+    updatedAt: 0
+  }
+]
+beforeEach(() => {
+  HTMLElement.prototype.scrollIntoView = vi.fn()
+})
+afterEach(cleanup)
+
+function setup() {
+  const onSelect = vi.fn()
+  const onEdit = vi.fn()
+  const onNew = vi.fn()
+  render(
+    <TooltipProvider>
+      <SparsePresetChooser
+        presets={presets}
+        selectedPresetId="web"
+        onSelect={onSelect}
+        onEdit={onEdit}
+        onNew={onNew}
+        onSelectFull={vi.fn()}
+      />
+    </TooltipProvider>
+  )
+  return { onSelect, onEdit, onNew }
+}
+
+it('filters by directories while keeping preset creation reachable', async () => {
+  const { onSelect, onNew } = setup()
+  fireEvent.change(screen.getByRole('combobox'), { target: { value: 'backend' } })
+  await waitFor(() => expect(screen.queryByRole('option', { name: /Web app/ })).toBeNull())
+  fireEvent.keyDown(screen.getByRole('combobox'), { key: 'Enter' })
+  expect(onSelect).toHaveBeenCalledWith(presets[1])
+  fireEvent.change(screen.getByRole('combobox'), { target: { value: 'no-such-preset' } })
+  await waitFor(() => expect(screen.getByText('No matching presets.')).toBeTruthy())
+  fireEvent.click(screen.getByRole('button', { name: 'New preset' }))
+  expect(onNew).toHaveBeenCalledOnce()
+})
+
+it('editing a preset does not also select it', () => {
+  const { onSelect, onEdit } = setup()
+  fireEvent.click(screen.getByRole('button', { name: 'Edit API' }))
+  expect(onEdit).toHaveBeenCalledWith(presets[1])
+  expect(onSelect).not.toHaveBeenCalled()
+})
+
+it('does not select the highlighted preset when Enter activates New preset', () => {
+  const { onSelect } = setup()
+  fireEvent.keyDown(screen.getByRole('button', { name: 'New preset' }), { key: 'Enter' })
+  expect(onSelect).not.toHaveBeenCalled()
+})
diff --git a/src/renderer/src/components/sparse/SparsePresetChooser.tsx b/src/renderer/src/components/sparse/SparsePresetChooser.tsx
new file mode 100644
index 00000000000..4b31baa00cd
--- /dev/null
+++ b/src/renderer/src/components/sparse/SparsePresetChooser.tsx
@@ -0,0 +1,121 @@
+import { Check, Pencil, Plus } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import {
+  Command,
+  CommandEmpty,
+  CommandInput,
+  CommandItem,
+  CommandList
+} from '@/components/ui/command'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { translate } from '@/i18n/i18n'
+import { cn } from '@/lib/utils'
+import type { SparsePreset } from '../../../../shared/worktree/create-types'
+
+type SparsePresetChooserProps = {
+  presets: SparsePreset[]
+  selectedPresetId: string | null
+  onSelect: (preset: SparsePreset) => void
+  onSelectFull: () => void
+  onEdit: (preset: SparsePreset) => void
+  onNew: () => void
+}
+
+export function SparsePresetChooser({
+  presets,
+  selectedPresetId,
+  onSelect,
+  onSelectFull,
+  onEdit,
+  onNew
+}: SparsePresetChooserProps): React.JSX.Element {
+  return (
+    <Command
+      defaultValue={selectedPresetId ? `preset:${selectedPresetId}` : 'full'}
+      className="max-h-[min(var(--radix-popover-content-available-height),24rem)]"
+    >
+      <CommandInput
+        placeholder={translate('sparsePreset.search', 'Find a preset…')}
+        aria-label={translate('sparsePreset.search', 'Find a preset…')}
+      />
+      <CommandList className="min-h-0 flex-1">
+        <CommandEmpty>{translate('sparsePreset.noMatches', 'No matching presets.')}</CommandEmpty>
+        <CommandItem
+          value="full"
+          keywords={[translate('sparsePreset.fullCheckout', 'Full checkout')]}
+          onSelect={onSelectFull}
+          selection="palette"
+        >
+          <Check className={cn('size-4 shrink-0', selectedPresetId && 'opacity-0')} />
+          <div className="min-w-0">
+            <div>{translate('sparsePreset.fullCheckout', 'Full checkout')}</div>
+            <div className="text-xs text-muted-foreground">
+              {translate('sparsePreset.allFiles', 'All repository files')}
+            </div>
+          </div>
+        </CommandItem>
+        {presets.map((preset) => (
+          <CommandItem
+            key={preset.id}
+            value={`preset:${preset.id}`}
+            keywords={[preset.name, ...preset.directories]}
+            onSelect={() => onSelect(preset)}
+            selection="palette"
+          >
+            <Check
+              className={cn('size-4 shrink-0', selectedPresetId !== preset.id && 'opacity-0')}
+            />
+            <div className="min-w-0 flex-1">
+              <div className="truncate">{preset.name}</div>
+              <div className="truncate font-mono text-xs text-muted-foreground">
+                {preset.directories.join(', ')}
+              </div>
+            </div>
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <Button
+                  type="button"
+                  variant="ghost"
+                  size="icon-xs"
+                  aria-label={translate('sparsePreset.editNamed', 'Edit {{name}}', {
+                    name: preset.name
+                  })}
+                  onClick={(event) => {
+                    event.stopPropagation()
+                    onEdit(preset)
+                  }}
+                  onKeyDown={(event) => {
+                    if (event.key === 'Enter' || event.key === ' ') {
+                      event.stopPropagation()
+                    }
+                  }}
+                >
+                  <Pencil />
+                </Button>
+              </TooltipTrigger>
+              <TooltipContent>
+                {translate('sparsePreset.editNamed', 'Edit {{name}}', { name: preset.name })}
+              </TooltipContent>
+            </Tooltip>
+          </CommandItem>
+        ))}
+      </CommandList>
+      <div className="shrink-0 border-t border-border p-1">
+        <Button
+          type="button"
+          variant="ghost"
+          className="w-full justify-start"
+          onClick={onNew}
+          onKeyDown={(event) => {
+            if (event.key === 'Enter' || event.key === ' ') {
+              event.stopPropagation()
+            }
+          }}
+        >
+          <Plus />
+          {translate('auto.components.sparse.SparseCheckoutPresetSelect.c4ac80151d', 'New preset')}
+        </Button>
+      </div>
+    </Command>
+  )
+}
diff --git a/src/renderer/src/components/sparse/SparsePresetInlineEditor.tsx b/src/renderer/src/components/sparse/SparsePresetInlineEditor.tsx
new file mode 100644
index 00000000000..aabc95d4ce6
--- /dev/null
+++ b/src/renderer/src/components/sparse/SparsePresetInlineEditor.tsx
@@ -0,0 +1,49 @@
+import { useCallback, useEffect, useId, useRef } from 'react'
+import type { ComponentProps } from 'react'
+import { translate } from '@/i18n/i18n'
+import { SparseCheckoutPresetDraftForm } from './SparseCheckoutPresetDraftForm'
+
+export function SparsePresetInlineEditor(
+  props: ComponentProps<typeof SparseCheckoutPresetDraftForm>
+): React.JSX.Element {
+  const titleId = useId()
+  const editorRef = useRef<HTMLElement | null>(null)
+  useEffect(() => {
+    const frame = requestAnimationFrame(() => {
+      editorRef.current?.scrollIntoView({ block: 'center', behavior: 'auto' })
+    })
+    return () => cancelAnimationFrame(frame)
+  }, [])
+  const focusName = useCallback((node: HTMLInputElement | null) => {
+    node?.focus()
+    node?.closest('[data-sparse-preset-editor]')?.scrollIntoView({ block: 'start' })
+  }, [])
+  return (
+    <section
+      role="region"
+      ref={editorRef}
+      data-sparse-preset-editor="true"
+      aria-labelledby={titleId}
+      className="space-y-3 border-t border-border pt-3"
+      onKeyDown={(event) => {
+        if (event.key === 'Escape') {
+          event.preventDefault()
+          event.stopPropagation()
+          if (!props.submitting) {
+            props.onCancel()
+          }
+        }
+      }}
+    >
+      <h4 id={titleId} className="text-sm font-medium">
+        {props.draft.mode === 'new'
+          ? translate('sparsePreset.new', 'New sparse preset')
+          : translate('sparsePreset.edit', 'Edit sparse preset')}
+      </h4>
+      <SparseCheckoutPresetDraftForm
+        {...props}
+        setNameInputNode={props.setNameInputNode ?? focusName}
+      />
+    </section>
+  )
+}
diff --git a/src/renderer/src/components/sparse/SparseSelectedDirectoryList.tsx b/src/renderer/src/components/sparse/SparseSelectedDirectoryList.tsx
new file mode 100644
index 00000000000..b2fbe657fdf
--- /dev/null
+++ b/src/renderer/src/components/sparse/SparseSelectedDirectoryList.tsx
@@ -0,0 +1,49 @@
+import { X } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import { translate } from '@/i18n/i18n'
+
+type SparseSelectedDirectoryListProps = {
+  directories: string[]
+  disabled: boolean
+  onRemove: (directory: string) => void
+}
+
+export function SparseSelectedDirectoryList({
+  directories,
+  disabled,
+  onRemove
+}: SparseSelectedDirectoryListProps): React.JSX.Element {
+  if (directories.length === 0) {
+    return (
+      <div className="rounded-md border border-dashed border-border px-3 py-4 text-center text-xs text-muted-foreground">
+        {translate('sparsePreset.noDirectories', 'No folders added yet.')}
+      </div>
+    )
+  }
+  return (
+    <div className="flex flex-wrap gap-1.5 rounded-md border border-border px-2 py-2">
+      {directories.map((directory) => (
+        <span
+          key={directory}
+          title={directory}
+          className="inline-flex min-w-0 max-w-full items-center gap-1 rounded-md border border-border bg-muted py-1 pr-1 pl-2 font-mono text-[11px]"
+        >
+          <span className="truncate">{directory}</span>
+          <Button
+            type="button"
+            size="icon-xs"
+            variant="ghost"
+            disabled={disabled}
+            onClick={() => onRemove(directory)}
+            aria-label={translate('sparsePreset.removePath', 'Remove {{name}}', {
+              name: directory
+            })}
+            className="shrink-0"
+          >
+            <X />
+          </Button>
+        </span>
+      ))}
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/sparse/sparse-directory-browse.test.ts b/src/renderer/src/components/sparse/sparse-directory-browse.test.ts
new file mode 100644
index 00000000000..84f21f8b9aa
--- /dev/null
+++ b/src/renderer/src/components/sparse/sparse-directory-browse.test.ts
@@ -0,0 +1,45 @@
+import { describe, expect, it } from 'vitest'
+import type { DirEntry } from '../../../../shared/filesystem-entry-types'
+import {
+  getSparseBrowseTrail,
+  joinSparseBrowsePath,
+  listBrowsableDirectories
+} from './sparse-directory-browse'
+
+const entry = (name: string, isDirectory: boolean): DirEntry => ({
+  name,
+  isDirectory,
+  isSymlink: false
+})
+
+describe('listBrowsableDirectories', () => {
+  it('keeps only sorted, non-hidden directories', () => {
+    expect(
+      listBrowsableDirectories([
+        entry('packages', true),
+        entry('README.md', false),
+        entry('.git', true),
+        entry('.vscode', true),
+        entry('node_modules', true),
+        entry('apps', true)
+      ])
+    ).toEqual(['apps', 'packages'])
+  })
+})
+
+describe('joinSparseBrowsePath', () => {
+  it('omits the separator at the repository root', () => {
+    expect(joinSparseBrowsePath('', 'apps')).toBe('apps')
+    expect(joinSparseBrowsePath('apps', 'web')).toBe('apps/web')
+  })
+})
+
+describe('getSparseBrowseTrail', () => {
+  it('builds cumulative segments', () => {
+    expect(getSparseBrowseTrail('')).toEqual([])
+    expect(getSparseBrowseTrail('apps/web')).toEqual([
+      { name: 'apps', path: 'apps' },
+      { name: 'web', path: 'apps/web' }
+    ])
+  })
+})
diff --git a/src/renderer/src/components/sparse/sparse-directory-browse.ts b/src/renderer/src/components/sparse/sparse-directory-browse.ts
new file mode 100644
index 00000000000..41926e63279
--- /dev/null
+++ b/src/renderer/src/components/sparse/sparse-directory-browse.ts
@@ -0,0 +1,35 @@
+import type { DirEntry } from '../../../../shared/filesystem-entry-types'
+
+const HIDDEN_BROWSE_DIRECTORIES = new Set(['.git', 'node_modules'])
+
+/** Directories a sparse preset can name, in display order. Hidden folders and
+ *  heavy tool caches are dropped because no cone-mode preset targets them. */
+export function listBrowsableDirectories(entries: DirEntry[]): string[] {
+  return entries
+    .filter(
+      (entry) =>
+        entry.isDirectory &&
+        !entry.name.startsWith('.') &&
+        !HIDDEN_BROWSE_DIRECTORIES.has(entry.name)
+    )
+    .map((entry) => entry.name)
+    .sort((left, right) => left.localeCompare(right))
+}
+
+export function joinSparseBrowsePath(parent: string, name: string): string {
+  return parent ? `${parent}/${name}` : name
+}
+
+/** Cumulative breadcrumb segments for `apps/web` → apps, apps/web. */
+export function getSparseBrowseTrail(relativePath: string): { name: string; path: string }[] {
+  if (!relativePath) {
+    return []
+  }
+  const trail: { name: string; path: string }[] = []
+  let prefix = ''
+  for (const name of relativePath.split('/')) {
+    prefix = joinSparseBrowsePath(prefix, name)
+    trail.push({ name, path: prefix })
+  }
+  return trail
+}
diff --git a/src/renderer/src/components/sparse/sparse-directory-entry-input.test.ts b/src/renderer/src/components/sparse/sparse-directory-entry-input.test.ts
new file mode 100644
index 00000000000..db261c184e2
--- /dev/null
+++ b/src/renderer/src/components/sparse/sparse-directory-entry-input.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'vitest'
+import {
+  addSparseDirectoryEntries,
+  parseSparseDirectoryEntryInput
+} from './sparse-directory-entry-input'
+
+describe('parseSparseDirectoryEntryInput', () => {
+  it('normalizes a single typed path', () => {
+    expect(parseSparseDirectoryEntryInput('  apps\\web/ ')).toEqual({
+      entries: ['apps/web'],
+      error: null
+    })
+  })
+
+  it('splits a multi-line paste and drops duplicates', () => {
+    expect(parseSparseDirectoryEntryInput('apps/web\npackages/ui\napps/web').entries).toEqual([
+      'apps/web',
+      'packages/ui'
+    ])
+  })
+
+  it('rejects absolute paths and parent segments', () => {
+    expect(parseSparseDirectoryEntryInput('/Users/me/repo').error).toBeTruthy()
+    expect(parseSparseDirectoryEntryInput('C:\\repo').error).toBeTruthy()
+    expect(parseSparseDirectoryEntryInput('apps/../secrets').error).toBeTruthy()
+    expect(parseSparseDirectoryEntryInput('.').error).toBeTruthy()
+  })
+})
+
+describe('addSparseDirectoryEntries', () => {
+  it('appends only new entries and preserves order', () => {
+    expect(addSparseDirectoryEntries(['apps/web'], ['apps/web', 'packages/ui'])).toEqual([
+      'apps/web',
+      'packages/ui'
+    ])
+  })
+})
diff --git a/src/renderer/src/components/sparse/sparse-directory-entry-input.ts b/src/renderer/src/components/sparse/sparse-directory-entry-input.ts
new file mode 100644
index 00000000000..e357527330b
--- /dev/null
+++ b/src/renderer/src/components/sparse/sparse-directory-entry-input.ts
@@ -0,0 +1,42 @@
+import {
+  hasSparseDirectoryParentSegment,
+  isAbsoluteSparseDirectoryPath,
+  normalizeSparseDirectoryLines
+} from '@/lib/sparse-paths'
+import { translate } from '@/i18n/i18n'
+
+export type SparseDirectoryEntryInputResult = {
+  entries: string[]
+  error: string | null
+}
+
+/** Turn free-form typing or a multi-line paste into repo-relative entries,
+ *  rejecting the same shapes the saved-preset parser rejects. */
+export function parseSparseDirectoryEntryInput(raw: string): SparseDirectoryEntryInputResult {
+  const invalid = {
+    entries: [],
+    error: translate(
+      'auto.lib.sparse.preset.draft.5915a0a1f6',
+      'Use repo-relative directories, not root, absolute paths, or parent segments.'
+    )
+  }
+  if (raw.split('\n').some((line) => isAbsoluteSparseDirectoryPath(line))) {
+    return invalid
+  }
+  const entries = normalizeSparseDirectoryLines(raw)
+  if (entries.some((entry) => entry === '.' || hasSparseDirectoryParentSegment(entry))) {
+    return invalid
+  }
+  return { entries, error: null }
+}
+
+/** Append entries that are not already selected, preserving existing order. */
+export function addSparseDirectoryEntries(selected: string[], entries: string[]): string[] {
+  const next = [...selected]
+  for (const entry of entries) {
+    if (!next.includes(entry)) {
+      next.push(entry)
+    }
+  }
+  return next
+}
diff --git a/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.test.tsx b/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.test.tsx
index 3a689eac09a..846b3fa9034 100644
--- a/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.test.tsx
+++ b/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.test.tsx
@@ -177,6 +177,36 @@ describe('StarNagAgentValueMomentObserver', () => {
     expect(showAgentValueMoment).not.toHaveBeenCalled()
   })
 
+  it('ignores a prompted done whose turn failed', async () => {
+    ;({ root, container } = renderObserver())
+
+    setAgentEntries({ pane: entry({ state: 'working' }) })
+    setAgentEntries({
+      pane: entry({
+        state: 'done',
+        mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 1 }
+      })
+    })
+    await act(async () => {
+      vi.advanceTimersByTime(2400)
+    })
+
+    expect(agentValueMoment).not.toHaveBeenCalled()
+  })
+
+  it('ignores a return to a done dated before the work it ended', async () => {
+    ;({ root, container } = renderObserver())
+
+    setAgentEntries({ pane: entry({ state: 'done', stateStartedAt: 1 }) })
+    setAgentEntries({ pane: entry({ state: 'working', stateStartedAt: 5 }) })
+    setAgentEntries({ pane: entry({ state: 'done', stateStartedAt: 1 }) })
+    await act(async () => {
+      vi.advanceTimersByTime(2400)
+    })
+
+    expect(agentValueMoment).not.toHaveBeenCalled()
+  })
+
   it('waits for other live agents and recent typing to quiet', async () => {
     ;({ root, container } = renderObserver())
 
diff --git a/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.tsx b/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.tsx
index 42f6145b1f3..ace4491a13c 100644
--- a/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.tsx
+++ b/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.tsx
@@ -1,5 +1,6 @@
 import { useCallback, useEffect, useRef } from 'react'
 import type { AgentStatusEntry } from '../../../../shared/agent-status-types'
+import { agentTurnEndedUncleanly } from '../../../../shared/agent-main-agent-verdict'
 import { useAppStore } from '@/store'
 
 // Why: leave a short quiet window after agents finish so the prompt does not
@@ -36,7 +37,9 @@ function hasSuccessfulDoneTransition(
       // Why: a session-boundary done is an idle connect (STA-3386), not a value moment —
       // a stale working row + resume would otherwise nag on launch.
       entry.sessionBoundary !== true &&
-      !entry.interrupted &&
+      !agentTurnEndedUncleanly(entry) &&
+      // A new done, not a return to one dated before the work it ended (a command at rest).
+      entry.stateStartedAt >= previousEntry.stateStartedAt &&
       hasMeaningfulPrompt(entry)
     ) {
       return true
diff --git a/src/renderer/src/components/status-bar/NativeChatResumeStatusSegment.tsx b/src/renderer/src/components/status-bar/NativeChatResumeStatusSegment.tsx
index 0bd87f1d128..751a804b2dd 100644
--- a/src/renderer/src/components/status-bar/NativeChatResumeStatusSegment.tsx
+++ b/src/renderer/src/components/status-bar/NativeChatResumeStatusSegment.tsx
@@ -1,21 +1,29 @@
-import { AlertCircle, RotateCcw } from 'lucide-react'
+import { AlertCircle, Loader2, RotateCcw } from 'lucide-react'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
 import { translate } from '@/i18n/i18n'
 import { useAppStore } from '@/store'
 import { requestNativeChatResumeOnRestartDialog } from '../native-chat-resume-on-restart-dialog'
 import {
+  getNativeChatRestartResuming,
   refreshNativeChatRestartOffer,
-  useNativeChatRestartOffer
+  useNativeChatRestartOffer,
+  useNativeChatRestartResuming
 } from '../native-chat-resume-on-restart-store'
 
 // Why: closing the resume dialog is a snooze, not a decline — the host keeps the offer. This is
 // then the only surface left carrying it, so it is always rendered rather than gated by
-// `statusBarItems`. A chat the resume could not carry on is kept the same way: the toast that
-// reported it is gone in seconds, and this entry is what still names it.
+// `statusBarItems`. Pressing Resume closes the dialog too, so this entry carries the run while it
+// is in flight. A chat the resume could not carry on is kept the same way: the toast that reported
+// it is gone in seconds, and this entry is what still names it.
 
 /** Re-reads the host before opening so the dialog always reflects the current durable records.
  *  Opening the chat itself is read-only and does not retire the offer. */
 async function reopenOffer(): Promise<void> {
+  // Mid-resume the host's answer is already on its way; a re-read racing it could undo it.
+  if (getNativeChatRestartResuming().length > 0) {
+    requestNativeChatResumeOnRestartDialog()
+    return
+  }
   const { candidates, failed } = await refreshNativeChatRestartOffer()
   if (candidates.length > 0 || failed.length > 0) {
     requestNativeChatResumeOnRestartDialog()
@@ -59,6 +67,37 @@ function Segment({
 
 type SegmentText = { label: string; ariaLabel: string; tooltip: string }
 
+function resumingText(count: number): SegmentText {
+  return {
+    label:
+      count === 1
+        ? translate(
+            'auto.components.status.bar.NativeChatResumeStatusSegment.resumingLabelOne',
+            'Resuming 1 chat'
+          )
+        : translate(
+            'auto.components.status.bar.NativeChatResumeStatusSegment.resumingLabel',
+            'Resuming {{value0}} chats',
+            { value0: count }
+          ),
+    ariaLabel:
+      count === 1
+        ? translate(
+            'auto.components.status.bar.NativeChatResumeStatusSegment.resumingAriaOne',
+            'Resuming 1 chat. Click to open details.'
+          )
+        : translate(
+            'auto.components.status.bar.NativeChatResumeStatusSegment.resumingAria',
+            'Resuming {{value0}} chats. Click to open details.',
+            { value0: count }
+          ),
+    tooltip: translate(
+      'auto.components.status.bar.NativeChatResumeStatusSegment.resumingTooltip',
+      'Restoring interrupted chats and asking them to carry on…'
+    )
+  }
+}
+
 function failedText(count: number): SegmentText {
   return {
     label:
@@ -131,16 +170,29 @@ export function NativeChatResumeStatusSegment({
     (store) => store.settings?.experimentalStructuredNativeChat === true
   )
   const { candidates, failed } = useNativeChatRestartOffer(structuredEnabled)
-  if (!structuredEnabled || (candidates.length === 0 && failed.length === 0)) {
+  const resumingIds = useNativeChatRestartResuming()
+  if (!structuredEnabled) {
     return null
   }
 
-  const pending = candidates.length
-  const failures = failed.length
+  // A chat being resumed is counted once, as in flight, until the host answers for it.
+  const inFlight = new Set(resumingIds)
+  const waiting = failed.filter((failure) => !inFlight.has(failure.sessionId))
+  const resuming = inFlight.size
+  const pending = candidates.filter((candidate) => !inFlight.has(candidate.sessionId)).length
+  const failures = waiting.length
   // An unconfirmed chat may be working, so "failed" would invite a duplicate "continue".
-  const unconfirmed = failed.some((failure) => failure.outcome === 'unconfirmed')
+  const unconfirmed = waiting.some((failure) => failure.outcome === 'unconfirmed')
   return (
     <>
+      {resuming > 0 && (
+        <Segment
+          iconOnly={iconOnly}
+          count={resuming}
+          icon={<Loader2 className="size-3 animate-spin text-muted-foreground" />}
+          {...resumingText(resuming)}
+        />
+      )}
       {pending > 0 && (
         <Segment
           iconOnly={iconOnly}
diff --git a/src/renderer/src/components/status-bar/PetStatusSegment.layout.test.ts b/src/renderer/src/components/status-bar/PetStatusSegment.layout.test.ts
deleted file mode 100644
index e213100816e..00000000000
--- a/src/renderer/src/components/status-bar/PetStatusSegment.layout.test.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-describe('PetStatusSegment layout', () => {
-  it('does not reserve fixed right padding on the pet menu trigger', () => {
-    const source = readFileSync(join(__dirname, 'PetStatusSegment.tsx'), 'utf8')
-
-    // Why: the old pr-[6.5rem] reserved ~104px of empty space after the label and
-    // shoved neighboring status-bar segments left; unit-guard so CI catches a
-    // reintroduction without needing Electron Playwright.
-    expect(source).not.toMatch(/pr-\[\d+(?:\.\d+)?rem\]/)
-    expect(source).toMatch(/className="group inline-flex items-center cursor-pointer pl-1 py-0\.5"/)
-  })
-})
diff --git a/src/renderer/src/components/status-bar/PortsStatusSegment.render-stability.test.tsx b/src/renderer/src/components/status-bar/PortsStatusSegment.render-stability.test.tsx
index d6d4ad95184..3f518db6751 100644
--- a/src/renderer/src/components/status-bar/PortsStatusSegment.render-stability.test.tsx
+++ b/src/renderer/src/components/status-bar/PortsStatusSegment.render-stability.test.tsx
@@ -30,6 +30,7 @@ vi.mock('@/lib/react-error-boundary-reporting', () => ({
 }))
 
 vi.mock('@/i18n/i18n', () => ({
+  i18n: { language: 'en' },
   translate: (_key: string, fallback: string, options?: Record<string, unknown>) =>
     options
       ? fallback.replace(/{{(\w+)}}/g, (_match, name: string) => String(options[name] ?? ''))
diff --git a/src/renderer/src/components/status-bar/ResourceUsageStatusSegment.rows.test.tsx b/src/renderer/src/components/status-bar/ResourceUsageStatusSegment.rows.test.tsx
index 783202de0cb..580c7f02f13 100644
--- a/src/renderer/src/components/status-bar/ResourceUsageStatusSegment.rows.test.tsx
+++ b/src/renderer/src/components/status-bar/ResourceUsageStatusSegment.rows.test.tsx
@@ -23,6 +23,7 @@ vi.mock('@/components/ui/tooltip', () => ({
 }))
 
 vi.mock('@/i18n/i18n', () => ({
+  i18n: { language: 'en' },
   translate: (_key: string, fallback: string, values?: Record<string, string>) =>
     values
       ? Object.entries(values).reduce(
diff --git a/src/renderer/src/components/status-bar/StatusBarProviderSegment.tsx b/src/renderer/src/components/status-bar/StatusBarProviderSegment.tsx
index 24de1094534..f3aaa6cbede 100644
--- a/src/renderer/src/components/status-bar/StatusBarProviderSegment.tsx
+++ b/src/renderer/src/components/status-bar/StatusBarProviderSegment.tsx
@@ -6,11 +6,19 @@ import {
   type UsagePercentageDisplay
 } from '../../../../shared/usage-percentage-display'
 import type { StatusBarUsageMode } from '../../../../shared/status-bar-usage-mode'
-import { ProviderIcon, clampUsedPercent, getProviderUsageStatusLabel } from './tooltip'
+import {
+  ProviderIcon,
+  USAGE_URGENT_PERCENT,
+  USAGE_WARNING_PERCENT,
+  clampUsedPercent,
+  getProviderDisplayName,
+  getProviderUsageStatusLabel
+} from './tooltip'
 import { getTightestUsageSection } from './UsageRosterPanel'
 import { formatRateLimitWindowChipLabel } from '@/lib/window-label-formatter'
 import { formatUsagePercentageLabel } from './usage-percentage-label'
 import { translate } from '@/i18n/i18n'
+import { isCursorUsageBucket } from '../../../../shared/cursor-usage-buckets'
 
 function MiniBar({
   usedPct,
@@ -66,6 +74,65 @@ export function ProviderLetterBadge({ p }: { p: ProviderRateLimits }): React.JSX
   )
 }
 
+export type UsageTone = 'urgent' | 'warning' | 'normal'
+
+/** Urgency by consumption, matching the usage bar colors, whatever % display the user chose. */
+export function getUsageTone(p: ProviderRateLimits): UsageTone {
+  const tightest = getTightestUsageSection(p)
+  const used = tightest ? clampUsedPercent(tightest.window.usedPercent) : 0
+  return used >= USAGE_URGENT_PERCENT
+    ? 'urgent'
+    : used >= USAGE_WARNING_PERCENT
+      ? 'warning'
+      : 'normal'
+}
+
+/**
+ * Stands in for usage chips a narrow bar can't fit. Always rendered at the collapsing
+ * density so its width is known before anything collapses; out of the row while empty.
+ */
+export function UsageOverflowChip({
+  hidden,
+  display
+}: {
+  hidden: readonly ProviderRateLimits[]
+  display: UsagePercentageDisplay
+}): React.JSX.Element {
+  const tones = hidden.map(getUsageTone)
+  const tone = tones.includes('urgent')
+    ? 'urgent'
+    : tones.includes('warning')
+      ? 'warning'
+      : 'normal'
+  const names = hidden
+    .map((p) => {
+      const tightest = getTightestUsageSection(p)
+      const name = getProviderDisplayName(p.provider)
+      return tightest
+        ? `${name} ${formatUsagePercentageLabel(tightest.window.usedPercent, display)}`
+        : name
+    })
+    .join(', ')
+  return (
+    <span
+      data-usage-more
+      data-usage-collapsed={hidden.length === 0}
+      data-tone={tone}
+      aria-hidden={hidden.length === 0}
+      title={translate(
+        'auto.components.status.bar.StatusBar.hiddenUsageProviders',
+        'Also: {{value0}}',
+        {
+          value0: names
+        }
+      )}
+      className="inline-flex h-4 items-center rounded-full border border-border px-1.5 text-[11px] font-medium tabular-nums text-foreground data-[tone=urgent]:border-destructive/40 data-[tone=urgent]:text-destructive data-[tone=warning]:border-status-warning-border data-[tone=warning]:text-status-warning data-[usage-collapsed=true]:invisible data-[usage-collapsed=true]:absolute"
+    >
+      +{Math.max(1, hidden.length)}
+    </span>
+  )
+}
+
 function getProviderLetter(provider: ProviderRateLimits['provider']): string {
   switch (provider) {
     case 'claude':
@@ -82,6 +149,10 @@ function getProviderLetter(provider: ProviderRateLimits['provider']): string {
       return 'M'
     case 'grok':
       return 'R'
+    case 'cursor':
+      return 'U'
+    case 'zcode':
+      return 'Z'
     case 'codex':
       return 'X'
   }
@@ -94,6 +165,12 @@ function getProviderLetter(provider: ProviderRateLimits['provider']): string {
 // Why: Gemini exposes extra experimental buckets that made the pre-existing verbose footer noisy.
 const STATUS_BAR_BUCKET_NAMES = new Set(['Flash', 'Pro', '1.5 Pro'])
 
+// Why: the allowlist above is Gemini's. Cursor's pools are its whole meter — filtering
+// them out leaves a signed-in account with an icon and no number at all.
+function isVisibleStatusBarBucket(name: string): boolean {
+  return STATUS_BAR_BUCKET_NAMES.has(name) || isCursorUsageBucket(name)
+}
+
 function VerboseProviderUsage({
   p,
   display
@@ -102,7 +179,10 @@ function VerboseProviderUsage({
   display: UsagePercentageDisplay
 }): React.JSX.Element {
   if (p.buckets && p.buckets.length > 0) {
-    const visibleBuckets = p.buckets.filter((bucket) => STATUS_BAR_BUCKET_NAMES.has(bucket.name))
+    const visibleBuckets = p.buckets.filter((bucket) => isVisibleStatusBarBucket(bucket.name))
+    // Why: a provider whose buckets are all filtered out still has a headline
+    // window worth showing rather than rendering an empty segment.
+    const fallbackWindow = p.session ?? p.monthly ?? null
     return (
       <>
         {visibleBuckets.map((bucket, index) => (
@@ -113,10 +193,10 @@ function VerboseProviderUsage({
             </span>
           </React.Fragment>
         ))}
-        {visibleBuckets.length === 0 && p.session ? (
+        {visibleBuckets.length === 0 && fallbackWindow ? (
           <WindowLabel
-            w={p.session}
-            label={formatRateLimitWindowChipLabel(p.session)}
+            w={fallbackWindow}
+            label={formatRateLimitWindowChipLabel(fallbackWindow)}
             display={display}
           />
         ) : null}
diff --git a/src/renderer/src/components/status-bar/StatusBarSurface.tsx b/src/renderer/src/components/status-bar/StatusBarSurface.tsx
index dfdcbb926db..844eeabe504 100644
--- a/src/renderer/src/components/status-bar/StatusBarSurface.tsx
+++ b/src/renderer/src/components/status-bar/StatusBarSurface.tsx
@@ -8,7 +8,6 @@ import {
   DropdownMenuTrigger
 } from '@/components/ui/dropdown-menu'
 import { translate } from '@/i18n/i18n'
-import { getProviderDisplayName } from './tooltip'
 import { UsageRosterPanel } from './UsageRosterPanel'
 import { getUsageProviderAccountsSectionId } from './usage-provider-settings-target'
 import {
@@ -27,7 +26,7 @@ import { FloatingTerminalIconContextMenu } from '@/components/floating-terminal/
 import { ClaudeSwitcherMenu } from './ClaudeSwitcherMenu'
 import { CodexSwitcherMenu } from './CodexSwitcherMenu'
 import { ProviderDetailsMenu, CLOSE_ALL_CONTEXT_MENUS_EVENT } from './ProviderDetailsMenu'
-import { ProviderLetterBadge, ProviderSegment } from './StatusBarProviderSegment'
+import { ProviderSegment, UsageOverflowChip, getUsageTone } from './StatusBarProviderSegment'
 import { useStatusBarController } from './use-status-bar-controller'
 import { StatusBarVisibilityMenu } from './StatusBarVisibilityMenu'
 import { isPairedWebClientWindow } from '@/lib/desktop-window-chrome'
@@ -61,8 +60,10 @@ export function StatusBarSurface({
   const {
     anyFetching,
     anyVisible,
+    barRef,
+    collapseUsage,
+    collapsedUsageProviders,
     compact,
-    containerRefCallback,
     floatingTerminalActionLabel,
     floatingTerminalShortcut,
     handleManageAccounts,
@@ -71,11 +72,13 @@ export function StatusBarSurface({
     handleUsageDetails,
     handleUsageMenuOpenChange,
     hasVisibleUsageMeters,
-    iconOnly,
     isEmptyUsageState,
     isRefreshing,
+    overflowing,
     petEnabled,
     rosterProviders,
+    segmentsIconOnly,
+    segmentsRef,
     setMenuOpen,
     setMenuPoint,
     setStatusBarUsageMode,
@@ -88,13 +91,16 @@ export function StatusBarSurface({
     statusBarUsageMode,
     usageMenuFocusHandoff,
     usageMenuOpen,
-    usagePercentageDisplay
+    usagePercentageDisplay,
+    usageRef,
+    usageTightestOnly
   } = controller
 
   return (
     <div
-      ref={containerRefCallback}
-      className="flex items-center h-6 min-h-[24px] px-3 gap-4 border-t border-border bg-[var(--bg-titlebar,var(--card))] text-xs select-none shrink-0 relative"
+      ref={barRef}
+      // Why: one line at any width — density steps down first. overflow-clip (not hidden) so focus can't scroll the bar; the clip margin spares focus rings and badge dots.
+      className="flex items-center h-6 min-h-[24px] px-3 gap-4 overflow-clip [overflow-clip-margin:3px] whitespace-nowrap border-t border-border bg-[var(--bg-titlebar,var(--card))] text-xs select-none shrink-0 relative"
       onContextMenuCapture={(event) => {
         if (!shouldOpenStatusBarContextMenu(event.target)) {
           return
@@ -107,193 +113,217 @@ export function StatusBarSurface({
         setMenuOpen(true)
       }}
     >
-      <div className="flex items-center gap-3">
-        {isEmptyUsageState ? (
-          showEmptyUsageCta ? (
-            <StatusBarUsageEmptyCta />
-          ) : null
-        ) : hasVisibleUsageMeters ? (
-          // Consolidated roster pill → opens the all-agents Usage popover (mock parity).
-          <UsagePercentageDisplayChangeNotice hasVisibleUsageMeters={hasVisibleUsageMeters}>
-            <DropdownMenu
-              open={usageMenuOpen}
-              onOpenChange={handleUsageMenuOpenChange}
-              modal={false}
-            >
-              <DropdownMenuTrigger asChild>
-                <button
-                  type="button"
-                  className="inline-flex items-center gap-3 rounded px-1 py-0.5 hover:bg-accent/70"
-                  aria-label={translate(
-                    'auto.components.status.bar.UsageRosterPanel.title',
-                    'Usage'
-                  )}
-                >
-                  {rosterProviders.map((p) =>
-                    iconOnly ? (
-                      // Narrow status bar: fall back to main's compact letter badge.
-                      <span key={p.provider} title={getProviderDisplayName(p.provider)}>
-                        <ProviderLetterBadge p={p} />
-                      </span>
-                    ) : (
-                      <ProviderSegment
+      {/* Why: usage gives way first — what it drops stays one click away in its popover. */}
+      <div
+        className="status-bar-usage-cluster flex min-w-0 flex-1 items-center overflow-clip [overflow-clip-margin:3px]"
+        data-overflowing={overflowing}
+      >
+        <div ref={usageRef} className="flex shrink-0 items-center gap-3">
+          {isEmptyUsageState ? (
+            showEmptyUsageCta ? (
+              <StatusBarUsageEmptyCta />
+            ) : null
+          ) : hasVisibleUsageMeters ? (
+            // Consolidated roster pill → opens the all-agents Usage popover (mock parity).
+            <UsagePercentageDisplayChangeNotice hasVisibleUsageMeters={hasVisibleUsageMeters}>
+              <DropdownMenu
+                open={usageMenuOpen}
+                onOpenChange={handleUsageMenuOpenChange}
+                modal={false}
+              >
+                <DropdownMenuTrigger asChild>
+                  <button
+                    type="button"
+                    className="inline-flex items-center gap-3 rounded px-1 py-0.5 hover:bg-accent/70"
+                    aria-label={translate(
+                      'auto.components.status.bar.UsageRosterPanel.title',
+                      'Usage'
+                    )}
+                  >
+                    {rosterProviders.map((p) => (
+                      // Why: collapsed chips leave the row but stay measurable, so the density hook can bring them back.
+                      <span
                         key={p.provider}
-                        p={p}
-                        compact={compact}
-                        display={usagePercentageDisplay}
-                        mode={statusBarUsageMode}
-                      />
-                    )
-                  )}
-                </button>
-              </DropdownMenuTrigger>
-              <DropdownMenuContent
-                {...STATUS_BAR_CONTEXT_MENU_EXEMPT_PROPS}
-                side="top"
-                align="start"
-                sideOffset={8}
-                // Keep the popover (and its drill-in submenus) above the status
-                // bar instead of overlapping it — bottom padding ≈ footer height.
-                collisionPadding={{ top: 8, bottom: 32, left: 8, right: 8 }}
-                className="w-[360px] p-0"
-                onPointerDownOutside={usageMenuFocusHandoff.onPointerDownOutside}
-                onCloseAutoFocus={usageMenuFocusHandoff.onCloseAutoFocus}
-              >
-                <UsageRosterPanel
-                  providers={rosterProviders}
-                  display={usagePercentageDisplay}
-                  statusBarUsageMode={statusBarUsageMode}
-                  onStatusBarUsageModeChange={setStatusBarUsageMode}
-                  isRefreshing={isRefreshing || anyFetching}
-                  onRefresh={handleRefresh}
-                  onOpenProvider={handleOpenProviderAccounts}
-                  onSignIn={handleOpenProviderAccounts}
-                  canSignIn={(provider) => getUsageProviderAccountsSectionId(provider) !== null}
-                  onManageAccounts={handleManageAccounts}
-                  onUsageDetails={handleUsageDetails}
-                  renderRow={(p, rowNode) => {
-                    // Every provider drills into its detail panel (parity with the
-                    // per-provider dropdowns on main); Claude/Codex additionally get
-                    // the account switcher + runtime toggle + Codex reset credits.
-                    if (p.provider === 'claude') {
-                      return (
-                        <ClaudeSwitcherMenu
-                          claude={p}
+                        data-usage-chip={p.provider}
+                        data-usage-urgent={getUsageTone(p) === 'urgent'}
+                        data-usage-collapsed={collapsedUsageProviders.includes(p.provider)}
+                        aria-hidden={collapsedUsageProviders.includes(p.provider)}
+                        className="inline-flex data-[usage-collapsed=true]:invisible data-[usage-collapsed=true]:absolute"
+                      >
+                        <ProviderSegment
+                          p={p}
                           compact={compact}
-                          iconOnly={false}
-                          asSubmenu
-                          triggerContent={rowNode}
+                          display={usagePercentageDisplay}
+                          mode={usageTightestOnly ? 'compact' : statusBarUsageMode}
                         />
-                      )
-                    }
-                    if (p.provider === 'codex') {
-                      return (
-                        <CodexSwitcherMenu
-                          codex={p}
-                          compact={compact}
-                          iconOnly={false}
-                          asSubmenu
-                          triggerContent={rowNode}
-                        />
-                      )
-                    }
-                    return (
-                      <ProviderDetailsMenu
-                        provider={p}
-                        compact={compact}
-                        iconOnly={false}
-                        asSubmenu
-                        triggerContent={rowNode}
-                        ariaLabel={translate(
-                          'auto.components.status.bar.UsageRosterPanel.openDetails',
-                          'Open usage details'
+                      </span>
+                    ))}
+                    {collapseUsage ? (
+                      <UsageOverflowChip
+                        hidden={rosterProviders.filter((p) =>
+                          collapsedUsageProviders.includes(p.provider)
                         )}
+                        display={usagePercentageDisplay}
                       />
-                    )
-                  }}
-                />
-              </DropdownMenuContent>
-            </DropdownMenu>
-          </UsagePercentageDisplayChangeNotice>
-        ) : null}
-        {anyVisible && !isEmptyUsageState && (
-          <Tooltip>
-            <TooltipTrigger asChild>
-              <button
-                onClick={handleRefresh}
-                disabled={isRefreshing}
-                className="p-0.5 rounded hover:bg-accent text-muted-foreground hover:text-foreground transition-colors disabled:opacity-40"
-                aria-label={translate(
-                  'auto.components.status.bar.StatusBar.3325d996cb',
-                  'Refresh rate limits'
-                )}
-              >
-                <RefreshCw
-                  size={11}
-                  className={isRefreshing || anyFetching ? 'animate-spin' : ''}
-                />
-              </button>
-            </TooltipTrigger>
-            <TooltipContent side="top" sideOffset={6}>
-              {translate('auto.components.status.bar.StatusBar.c8857b40f7', 'Refresh usage data')}
-            </TooltipContent>
-          </Tooltip>
-        )}
-      </div>
-
-      <div className="flex-1" />
-
-      <div className="flex items-center gap-3">
-        {!isPairedWebClientWindow() ? <CaffeinateStatusSegment iconOnly={iconOnly} /> : null}
-        <RemoteServerUpdateStatusSegment iconOnly={iconOnly} />
-        <SkillUpdateStatusSegment iconOnly={iconOnly} />
-        <NativeChatResumeStatusSegment iconOnly={iconOnly} />
-        <UpdateStatusSegment compact={compact} iconOnly={iconOnly} />
-        <React.Suspense fallback={null}>
-          {petEnabled ? <PetStatusSegment /> : null}
-          {showResourceUsage ? (
-            <ResourceUsageStatusSegment compact={compact} iconOnly={iconOnly} />
+                    ) : null}
+                  </button>
+                </DropdownMenuTrigger>
+                <DropdownMenuContent
+                  {...STATUS_BAR_CONTEXT_MENU_EXEMPT_PROPS}
+                  side="top"
+                  align="start"
+                  sideOffset={8}
+                  // Keep the popover (and its drill-in submenus) above the status
+                  // bar instead of overlapping it — bottom padding ≈ footer height.
+                  collisionPadding={{ top: 8, bottom: 32, left: 8, right: 8 }}
+                  className="w-[360px] p-0"
+                  onPointerDownOutside={usageMenuFocusHandoff.onPointerDownOutside}
+                  onCloseAutoFocus={usageMenuFocusHandoff.onCloseAutoFocus}
+                >
+                  <UsageRosterPanel
+                    providers={rosterProviders}
+                    display={usagePercentageDisplay}
+                    statusBarUsageMode={statusBarUsageMode}
+                    onStatusBarUsageModeChange={setStatusBarUsageMode}
+                    isRefreshing={isRefreshing || anyFetching}
+                    onRefresh={handleRefresh}
+                    onOpenProvider={handleOpenProviderAccounts}
+                    onSignIn={handleOpenProviderAccounts}
+                    canSignIn={(provider) => getUsageProviderAccountsSectionId(provider) !== null}
+                    onManageAccounts={handleManageAccounts}
+                    onUsageDetails={handleUsageDetails}
+                    renderRow={(p, rowNode) => {
+                      // Every provider drills into its detail panel (parity with the
+                      // per-provider dropdowns on main); Claude/Codex additionally get
+                      // the account switcher + runtime toggle + Codex reset credits.
+                      if (p.provider === 'claude') {
+                        return (
+                          <ClaudeSwitcherMenu
+                            claude={p}
+                            compact={compact}
+                            iconOnly={false}
+                            asSubmenu
+                            triggerContent={rowNode}
+                          />
+                        )
+                      }
+                      if (p.provider === 'codex') {
+                        return (
+                          <CodexSwitcherMenu
+                            codex={p}
+                            compact={compact}
+                            iconOnly={false}
+                            asSubmenu
+                            triggerContent={rowNode}
+                          />
+                        )
+                      }
+                      return (
+                        <ProviderDetailsMenu
+                          provider={p}
+                          compact={compact}
+                          iconOnly={false}
+                          asSubmenu
+                          triggerContent={rowNode}
+                          ariaLabel={translate(
+                            'auto.components.status.bar.UsageRosterPanel.openDetails',
+                            'Open usage details'
+                          )}
+                        />
+                      )
+                    }}
+                  />
+                </DropdownMenuContent>
+              </DropdownMenu>
+            </UsagePercentageDisplayChangeNotice>
           ) : null}
-          {showPorts ? <PortsStatusSegment compact={compact} iconOnly={iconOnly} /> : null}
-          {showSsh ? <SshStatusSegment compact={compact} iconOnly={iconOnly} /> : null}
-        </React.Suspense>
-        {showFloatingTerminalToggle && (
-          <FloatingTerminalIconContextMenu currentLocation="status-bar" className="relative">
+          {anyVisible && !isEmptyUsageState && (
             <Tooltip>
               <TooltipTrigger asChild>
                 <button
-                  type="button"
-                  className="relative inline-flex size-5 cursor-pointer items-center justify-center rounded border border-border bg-secondary text-secondary-foreground shadow-xs transition-colors hover:bg-accent hover:text-accent-foreground"
-                  aria-label={
-                    showFloatingWorkspaceAttentionDot
-                      ? translate(
-                          'auto.components.status.bar.StatusBar.floatingTerminalNewActivity',
-                          '{{label}}, new activity',
-                          { label: floatingTerminalActionLabel }
-                        )
-                      : floatingTerminalActionLabel
-                  }
-                  onClick={() => {
-                    window.dispatchEvent(new CustomEvent(TOGGLE_FLOATING_TERMINAL_EVENT))
-                  }}
+                  onClick={handleRefresh}
+                  disabled={isRefreshing}
+                  className="p-0.5 rounded hover:bg-accent text-muted-foreground hover:text-foreground transition-colors disabled:opacity-40"
+                  aria-label={translate(
+                    'auto.components.status.bar.StatusBar.3325d996cb',
+                    'Refresh rate limits'
+                  )}
                 >
-                  <PanelsTopLeft className="size-3.5" />
-                  {showFloatingWorkspaceAttentionDot ? (
-                    // Why: amber = Orca's "needs attention" convention; ring matches the fill so the dot reads on the icon.
-                    <span
-                      aria-hidden
-                      data-floating-terminal-attention
-                      className="pointer-events-none absolute right-0.5 top-0.5 size-1.5 rounded-full bg-amber-500 ring-1 ring-secondary"
-                    />
-                  ) : null}
+                  <RefreshCw
+                    size={11}
+                    className={isRefreshing || anyFetching ? 'animate-spin' : ''}
+                  />
                 </button>
               </TooltipTrigger>
               <TooltipContent side="top" sideOffset={6}>
-                {floatingTerminalActionLabel} ({floatingTerminalShortcut})
+                {translate('auto.components.status.bar.StatusBar.c8857b40f7', 'Refresh usage data')}
               </TooltipContent>
             </Tooltip>
-          </FloatingTerminalIconContextMenu>
-        )}
+          )}
+        </div>
+      </div>
+
+      {/* Why: attention segments never clip; below the tightest density they scroll rather than vanish. */}
+      <div
+        className="min-w-0 data-[overflowing=true]:overflow-x-auto data-[overflowing=true]:scrollbar-none"
+        data-overflowing={overflowing}
+      >
+        <div ref={segmentsRef} className="flex w-max items-center gap-3">
+          {!isPairedWebClientWindow() ? (
+            <CaffeinateStatusSegment iconOnly={segmentsIconOnly} />
+          ) : null}
+          <RemoteServerUpdateStatusSegment iconOnly={segmentsIconOnly} />
+          <SkillUpdateStatusSegment iconOnly={segmentsIconOnly} />
+          <NativeChatResumeStatusSegment iconOnly={segmentsIconOnly} />
+          <UpdateStatusSegment compact={compact} iconOnly={segmentsIconOnly} />
+          <React.Suspense fallback={null}>
+            {petEnabled ? <PetStatusSegment /> : null}
+            {showResourceUsage ? (
+              <ResourceUsageStatusSegment compact={compact} iconOnly={segmentsIconOnly} />
+            ) : null}
+            {showPorts ? (
+              <PortsStatusSegment compact={compact} iconOnly={segmentsIconOnly} />
+            ) : null}
+            {showSsh ? <SshStatusSegment compact={compact} iconOnly={segmentsIconOnly} /> : null}
+          </React.Suspense>
+          {showFloatingTerminalToggle && (
+            <FloatingTerminalIconContextMenu currentLocation="status-bar" className="relative">
+              <Tooltip>
+                <TooltipTrigger asChild>
+                  <button
+                    type="button"
+                    className="relative inline-flex size-5 cursor-pointer items-center justify-center rounded border border-border bg-secondary text-secondary-foreground shadow-xs transition-colors hover:bg-accent hover:text-accent-foreground"
+                    aria-label={
+                      showFloatingWorkspaceAttentionDot
+                        ? translate(
+                            'auto.components.status.bar.StatusBar.floatingTerminalNewActivity',
+                            '{{label}}, new activity',
+                            { label: floatingTerminalActionLabel }
+                          )
+                        : floatingTerminalActionLabel
+                    }
+                    onClick={() => {
+                      window.dispatchEvent(new CustomEvent(TOGGLE_FLOATING_TERMINAL_EVENT))
+                    }}
+                  >
+                    <PanelsTopLeft className="size-3.5" />
+                    {showFloatingWorkspaceAttentionDot ? (
+                      // Why: amber = Orca's "needs attention" convention; ring matches the fill so the dot reads on the icon.
+                      <span
+                        aria-hidden
+                        data-floating-terminal-attention
+                        className="pointer-events-none absolute right-0.5 top-0.5 size-1.5 rounded-full bg-amber-500 ring-1 ring-secondary"
+                      />
+                    ) : null}
+                  </button>
+                </TooltipTrigger>
+                <TooltipContent side="top" sideOffset={6}>
+                  {floatingTerminalActionLabel} ({floatingTerminalShortcut})
+                </TooltipContent>
+              </Tooltip>
+            </FloatingTerminalIconContextMenu>
+          )}
+        </div>
       </div>
 
       <StatusBarVisibilityMenu controller={controller} />
diff --git a/src/renderer/src/components/status-bar/StatusBarVisibilityMenu.tsx b/src/renderer/src/components/status-bar/StatusBarVisibilityMenu.tsx
index 7b47b6bb6d2..c98f91c673e 100644
--- a/src/renderer/src/components/status-bar/StatusBarVisibilityMenu.tsx
+++ b/src/renderer/src/components/status-bar/StatusBarVisibilityMenu.tsx
@@ -133,6 +133,28 @@ export function StatusBarVisibilityMenu({
             {translate('auto.components.status.bar.StatusBar.grokUsageMenu', 'Grok Usage')}
           </DropdownMenuCheckboxItem>
         )}
+        {isStatusBarItemAvailable('zcode', detectedAgentIds) && (
+          <DropdownMenuCheckboxItem
+            checked={statusBarItems.includes('zcode')}
+            onCheckedChange={() => {
+              recordFeatureInteraction('usage-tracking')
+              toggleStatusBarItem('zcode')
+            }}
+          >
+            <AgentIcon agent="zcode" size={14} />
+            {translate('auto.components.status.bar.StatusBar.zcodeUsageMenu', 'ZCode Usage')}
+          </DropdownMenuCheckboxItem>
+        )}
+        <DropdownMenuCheckboxItem
+          checked={statusBarItems.includes('cursor')}
+          onCheckedChange={() => {
+            recordFeatureInteraction('usage-tracking')
+            toggleStatusBarItem('cursor')
+          }}
+        >
+          <AgentIcon agent="cursor" size={14} />
+          {translate('auto.components.status.bar.StatusBar.cursorUsageMenu', 'Cursor Usage')}
+        </DropdownMenuCheckboxItem>
         <DropdownMenuCheckboxItem
           checked={statusBarItems.includes('ssh')}
           onCheckedChange={() => {
diff --git a/src/renderer/src/components/status-bar/UsageRosterPanel.test.tsx b/src/renderer/src/components/status-bar/UsageRosterPanel.test.tsx
index de4f5a0e06f..4f538ea852f 100644
--- a/src/renderer/src/components/status-bar/UsageRosterPanel.test.tsx
+++ b/src/renderer/src/components/status-bar/UsageRosterPanel.test.tsx
@@ -247,6 +247,35 @@ describe('UsageRow', () => {
     expect(markup).toContain('25%')
     expect(markup).toContain('60%')
   })
+
+  it('labels ZCode MCP separately from Coding Plan windows in both roster modes', () => {
+    const zcode: ProviderRateLimits = {
+      provider: 'zcode',
+      session: { usedPercent: 1, windowMinutes: 300, resetsAt: null, resetDescription: null },
+      weekly: { usedPercent: 94, windowMinutes: 10_080, resetsAt: null, resetDescription: null },
+      monthly: { usedPercent: 97, windowMinutes: 43_200, resetsAt: null, resetDescription: null },
+      updatedAt: mocks.now,
+      status: 'ok',
+      error: null
+    }
+    const renderRow = (mode: 'verbose' | 'compact') =>
+      renderToStaticMarkup(
+        <UsageRow
+          p={zcode}
+          display="used"
+          mode={mode}
+          state={{ kind: 'usage', statusLabel: null }}
+          showSignInAction={false}
+          now={mocks.now}
+        />
+      )
+
+    expect(renderRow('verbose')).toContain('data-usage-window="MCP"')
+    expect(renderRow('verbose')).toContain('MCP')
+    expect(renderRow('verbose')).not.toContain('30d')
+    expect(renderRow('compact')).toContain('MCP')
+    expect(renderRow('compact')).not.toContain('30d')
+  })
 })
 
 describe('UsageRosterPanel density picker', () => {
diff --git a/src/renderer/src/components/status-bar/UsageRosterPanel.tsx b/src/renderer/src/components/status-bar/UsageRosterPanel.tsx
index feb066fadca..6163f1ba548 100644
--- a/src/renderer/src/components/status-bar/UsageRosterPanel.tsx
+++ b/src/renderer/src/components/status-bar/UsageRosterPanel.tsx
@@ -49,6 +49,9 @@ function shortLabel(
   if (section.window === p.fableWeekly) {
     return 'Fable'
   }
+  if (p.provider === 'zcode' && section.window === p.monthly) {
+    return section.label
+  }
   return useRemainingDuration
     ? formatRateLimitWindowChipLabel(section.window)
     : formatWindowLabel(section.window.windowMinutes)
diff --git a/src/renderer/src/components/status-bar/resource-session-classification-parity.test.ts b/src/renderer/src/components/status-bar/resource-session-classification-parity.test.ts
deleted file mode 100644
index ec7c7a62848..00000000000
--- a/src/renderer/src/components/status-bar/resource-session-classification-parity.test.ts
+++ /dev/null
@@ -1,52 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { resolve } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-const CONTROLLER_PATH = resolve(__dirname, 'use-resource-usage-status-controller.ts')
-const DERIVED_MODEL_PATH = resolve(__dirname, 'use-resource-usage-derived-model.ts')
-
-/**
- * Both destructive paths — bulk "kill orphans" and a single row's kill — must classify from the
- * same binding inputs. When the merge call site re-listed the fields instead of reusing the
- * object, it silently omitted deferred SSH sessions: bulk cleanup spared them while the row's
- * kill destroyed them with no confirmation. Same bug, one click over (#8459).
- */
-describe('resource session classification parity', () => {
-  it('feeds the row merge the same binding inputs as the bulk selector', () => {
-    const source = readFileSync(DERIVED_MODEL_PATH, 'utf8')
-    const mergeCall = source.slice(
-      source.indexOf('mergeSnapshotAndSessions(resourceSnapshot'),
-      source.indexOf('ambiguousWorktreeIds\n          })')
-    )
-
-    expect(mergeCall).toContain('...resourceSessionBindings')
-    // Any of these appearing inline means the call site is re-deriving bindings and can drift.
-    for (const field of [
-      'ptyIdsByTabId,',
-      'tabsByWorktree,',
-      'terminalLayoutsByTabId,',
-      'deferredSshSessionIdsByTabId,',
-      'workspaceSessionReady,'
-    ]) {
-      expect(mergeCall).not.toContain(field)
-    }
-  })
-
-  it('keeps every binding source in the one object both paths read', () => {
-    const source = readFileSync(CONTROLLER_PATH, 'utf8')
-    const bindings = source.slice(
-      source.indexOf('const resourceSessionBindings = useMemo'),
-      source.indexOf('const popoverBodyRef')
-    )
-
-    for (const field of [
-      'ptyIdsByTabId',
-      'tabsByWorktree',
-      'terminalLayoutsByTabId',
-      'deferredSshSessionIdsByTabId',
-      'workspaceSessionReady'
-    ]) {
-      expect(bindings).toContain(field)
-    }
-  })
-})
diff --git a/src/renderer/src/components/status-bar/status-bar-agent-gating.test.ts b/src/renderer/src/components/status-bar/status-bar-agent-gating.test.ts
index cd98315df50..4c7ada35a47 100644
--- a/src/renderer/src/components/status-bar/status-bar-agent-gating.test.ts
+++ b/src/renderer/src/components/status-bar/status-bar-agent-gating.test.ts
@@ -20,6 +20,7 @@ describe('isStatusBarItemAvailable', () => {
     expect(isStatusBarItemAvailable('gemini', null)).toBe(true)
     expect(isStatusBarItemAvailable('antigravity', null)).toBe(true)
     expect(isStatusBarItemAvailable('grok', null)).toBe(true)
+    expect(isStatusBarItemAvailable('zcode', null)).toBe(true)
   })
 
   it('hides CLI items not detected on PATH', () => {
@@ -28,6 +29,7 @@ describe('isStatusBarItemAvailable', () => {
     expect(isStatusBarItemAvailable('gemini', ['claude', 'codex'])).toBe(false)
     expect(isStatusBarItemAvailable('antigravity', ['claude', 'codex'])).toBe(false)
     expect(isStatusBarItemAvailable('grok', ['claude', 'kimi'])).toBe(false)
+    expect(isStatusBarItemAvailable('zcode', ['claude', 'kimi'])).toBe(false)
   })
 
   it('shows CLI items detected on PATH', () => {
@@ -36,5 +38,6 @@ describe('isStatusBarItemAvailable', () => {
     expect(isStatusBarItemAvailable('gemini', ['gemini'])).toBe(true)
     expect(isStatusBarItemAvailable('antigravity', ['antigravity'])).toBe(true)
     expect(isStatusBarItemAvailable('grok', ['grok'])).toBe(true)
+    expect(isStatusBarItemAvailable('zcode', ['zcode'])).toBe(true)
   })
 })
diff --git a/src/renderer/src/components/status-bar/status-bar-agent-gating.ts b/src/renderer/src/components/status-bar/status-bar-agent-gating.ts
index 145abef3a90..85f641b96d2 100644
--- a/src/renderer/src/components/status-bar/status-bar-agent-gating.ts
+++ b/src/renderer/src/components/status-bar/status-bar-agent-gating.ts
@@ -13,7 +13,8 @@ const CLI_GATED_ITEMS: ReadonlySet<StatusBarItem> = new Set([
   'gemini',
   'kimi',
   'antigravity',
-  'grok'
+  'grok',
+  'zcode'
 ])
 
 export function isStatusBarItemAvailable(
diff --git a/src/renderer/src/components/status-bar/status-bar-container-observer.ts b/src/renderer/src/components/status-bar/status-bar-container-observer.ts
deleted file mode 100644
index 627b982efcd..00000000000
--- a/src/renderer/src/components/status-bar/status-bar-container-observer.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-export function observeStatusBarContainer(
-  node: HTMLDivElement,
-  onWidthChange: (width: number) => void
-): ResizeObserver {
-  const observer = new ResizeObserver((entries) => {
-    for (const entry of entries) {
-      onWidthChange(entry.contentRect.width)
-    }
-  })
-  observer.observe(node)
-  return observer
-}
diff --git a/src/renderer/src/components/status-bar/status-bar-cursor-segment.test.tsx b/src/renderer/src/components/status-bar/status-bar-cursor-segment.test.tsx
new file mode 100644
index 00000000000..eb3781af391
--- /dev/null
+++ b/src/renderer/src/components/status-bar/status-bar-cursor-segment.test.tsx
@@ -0,0 +1,96 @@
+import { renderToStaticMarkup } from 'react-dom/server'
+import { describe, expect, it, vi } from 'vitest'
+import {
+  CURSOR_MODELS_BUCKET_NAME,
+  CURSOR_OTHER_MODELS_BUCKET_NAME
+} from '../../../../shared/cursor-usage-buckets'
+import type { ProviderRateLimits, RateLimitWindow } from '../../../../shared/rate-limit-types'
+
+vi.mock('@/i18n/i18n', () => ({
+  i18n: { language: 'en' },
+  translate: (_key: string, fallback: string, values?: Record<string, string>) => {
+    let result = fallback
+    for (const [key, value] of Object.entries(values ?? {})) {
+      result = result.replace(`{{${key}}}`, value)
+    }
+    return result
+  }
+}))
+
+vi.mock('@/lib/agent-catalog', () => ({
+  AgentIcon: () => null
+}))
+
+vi.mock('../../store', () => ({
+  useAppStore: (selector: (state: { usagePercentageDisplay: 'used' | 'remaining' }) => unknown) =>
+    selector({ usagePercentageDisplay: 'used' })
+}))
+
+function windowOf(usedPercent: number): RateLimitWindow {
+  return { usedPercent, windowMinutes: 43_200, resetsAt: null, resetDescription: null }
+}
+
+function cursorLimits(overrides: Partial<ProviderRateLimits> = {}): ProviderRateLimits {
+  return {
+    provider: 'cursor',
+    session: null,
+    weekly: null,
+    monthly: windowOf(92),
+    buckets: [
+      { name: CURSOR_MODELS_BUCKET_NAME, ...windowOf(45) },
+      { name: CURSOR_OTHER_MODELS_BUCKET_NAME, ...windowOf(50) }
+    ],
+    updatedAt: Date.now(),
+    error: null,
+    status: 'ok',
+    ...overrides
+  }
+}
+
+describe('Cursor status-bar segment', () => {
+  it('renders both plan pools instead of filtering them out as unknown buckets', async () => {
+    // Why: the verbose bucket allowlist was written for Gemini's experimental
+    // models. Cursor's pools are its whole meter, so a signed-in account
+    // rendered an icon with no percentage at all.
+    const { ProviderSegment } = await import('./StatusBar')
+    const markup = renderToStaticMarkup(
+      <ProviderSegment p={cursorLimits()} compact={false} display="used" mode="verbose" />
+    )
+    expect(markup).toContain(CURSOR_MODELS_BUCKET_NAME)
+    expect(markup).toContain(CURSOR_OTHER_MODELS_BUCKET_NAME)
+    expect(markup).toContain('45%')
+    expect(markup).toContain('50%')
+  })
+
+  it('falls back to the plan total when no bucket is renderable', async () => {
+    const { ProviderSegment } = await import('./StatusBar')
+    const markup = renderToStaticMarkup(
+      <ProviderSegment
+        p={cursorLimits({ buckets: [{ name: 'Unknown pool', ...windowOf(70) }] })}
+        compact={false}
+        display="used"
+        mode="verbose"
+      />
+    )
+    expect(markup).not.toContain('Unknown pool')
+    expect(markup).toContain('92%')
+  })
+})
+
+describe('getWindowSections for Cursor', () => {
+  it('keeps the plan total beside the pools', async () => {
+    // Why: Cursor puts the headline number in `monthly` and the sub-pools in
+    // buckets. Dropping `monthly` hid the figure closest to the user's cap — a
+    // plan at 92% read as 50% in the roster and the tooltip.
+    const { getWindowSections } = await import('./tooltip')
+    const sections = getWindowSections(cursorLimits())
+    expect(sections.find((section) => section.label === 'Plan')?.window?.usedPercent).toBe(92)
+    expect(sections.map((section) => section.label)).toContain(CURSOR_MODELS_BUCKET_NAME)
+  })
+
+  it('leaves other providers unchanged when they report no monthly window', async () => {
+    const { getWindowSections } = await import('./tooltip')
+    const sections = getWindowSections(cursorLimits({ monthly: null, provider: 'gemini' }))
+    expect(sections.some((section) => section.label === 'Plan')).toBe(false)
+  })
+})
diff --git a/src/renderer/src/components/status-bar/status-bar-density.test.ts b/src/renderer/src/components/status-bar/status-bar-density.test.ts
new file mode 100644
index 00000000000..1ddcbaf35f0
--- /dev/null
+++ b/src/renderer/src/components/status-bar/status-bar-density.test.ts
@@ -0,0 +1,91 @@
+import { describe, expect, it } from 'vitest'
+import {
+  STATUS_BAR_DENSITY_LEVELS,
+  pickStatusBarDensityLevel,
+  recordStatusBarDensityWidth
+} from './status-bar-density'
+
+const TIGHTEST = STATUS_BAR_DENSITY_LEVELS.length - 1
+const w = (natural: number, fit = natural) => ({ natural, fit })
+
+describe('STATUS_BAR_DENSITY_LEVELS', () => {
+  it('collapses usage into "+N" before right-side segments lose their labels', () => {
+    const firstCollapse = STATUS_BAR_DENSITY_LEVELS.findIndex((level) => level.collapseUsage)
+    const firstIconOnly = STATUS_BAR_DENSITY_LEVELS.findIndex((level) => level.segmentsIconOnly)
+    expect(firstCollapse).toBeGreaterThan(-1)
+    expect(firstCollapse).toBeLessThan(firstIconOnly)
+  })
+})
+
+describe('pickStatusBarDensityLevel', () => {
+  it('keeps the roomiest level that fits', () => {
+    expect(pickStatusBarDensityLevel([w(700), w(600), w(500), w(400), w(300)], 800)).toBe(0)
+    expect(pickStatusBarDensityLevel([w(700), w(600), w(500), w(400), w(300)], 550)).toBe(2)
+  })
+
+  it('fits a collapsing level by its collapsed width, not its natural width', () => {
+    // Level 3 would need 500 with every chip, but 380 with calm chips folded into "+N".
+    expect(pickStatusBarDensityLevel([w(700), w(600), w(500), w(500, 380), w(300)], 400)).toBe(3)
+  })
+
+  it('probes an unmeasured level before settling on a tighter one', () => {
+    expect(pickStatusBarDensityLevel([w(700), undefined, w(500)], 650)).toBe(1)
+    expect(pickStatusBarDensityLevel([], 650)).toBe(0)
+  })
+
+  it('falls back to the tightest level when nothing fits', () => {
+    expect(pickStatusBarDensityLevel([w(700), w(600), w(500), w(400), w(300)], 200)).toBe(TIGHTEST)
+  })
+
+  it('tolerates sub-pixel rounding at the boundary', () => {
+    expect(pickStatusBarDensityLevel([w(600.6)], 600)).toBe(0)
+  })
+})
+
+describe('recordStatusBarDensityWidth', () => {
+  it('fills in a level without disturbing the others', () => {
+    expect(recordStatusBarDensityWidth([w(700), undefined, w(500)], 1, w(600))).toEqual([
+      w(700),
+      w(600),
+      w(500)
+    ])
+  })
+
+  it('forgets other levels when a level re-measures differently', () => {
+    // A segment appeared or vanished, so the other levels' widths no longer describe the bar.
+    expect(recordStatusBarDensityWidth([w(700), w(600), w(500)], 1, w(640))).toEqual([
+      undefined,
+      w(640)
+    ])
+  })
+
+  it('drops only the other collapsing levels when only the collapsed width moves', () => {
+    // Urgency changes which chips collapse, moving fit widths but never the natural one.
+    expect(
+      recordStatusBarDensityWidth(
+        [w(700), w(600), w(500), w(600, 450), w(500, 400)],
+        3,
+        w(600, 430)
+      )
+    ).toEqual([w(700), w(600), w(500), w(600, 430), undefined])
+  })
+
+  it('re-probes a roomier collapsing level once the tightest level sees its fit move', () => {
+    // Level 3's stale fit (450) kept the bar at level 4; fewer urgent chips now let it fit.
+    const settled = [w(700), w(600), w(500), w(600, 450), w(500, 400)]
+    expect(pickStatusBarDensityLevel(settled, 420)).toBe(TIGHTEST)
+    const remeasured = recordStatusBarDensityWidth(settled, TIGHTEST, w(500, 380))
+    expect(remeasured).toEqual([w(700), w(600), w(500), undefined, w(500, 380)])
+    expect(pickStatusBarDensityLevel(remeasured, 420)).toBe(3)
+    const probed = recordStatusBarDensityWidth(remeasured, 3, w(600, 410))
+    expect(pickStatusBarDensityLevel(probed, 420)).toBe(3)
+  })
+
+  it('keeps other levels on a sub-pixel re-measure', () => {
+    expect(recordStatusBarDensityWidth([w(700), w(600), w(500)], 1, w(600.5))).toEqual([
+      w(700),
+      w(600.5),
+      w(500)
+    ])
+  })
+})
diff --git a/src/renderer/src/components/status-bar/status-bar-density.ts b/src/renderer/src/components/status-bar/status-bar-density.ts
new file mode 100644
index 00000000000..6801d910358
--- /dev/null
+++ b/src/renderer/src/components/status-bar/status-bar-density.ts
@@ -0,0 +1,183 @@
+import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react'
+import type { MutableRefObject } from 'react'
+import { measureUsageRow, pickCollapsedUsageChips } from './status-bar-usage-collapse'
+
+export type StatusBarDensity = {
+  /** Drop usage mini bars and secondary segment labels. */
+  compact: boolean
+  /** One percentage per provider, whatever the chosen usage mode. */
+  usageTightestOnly: boolean
+  /** Right-side segments show icon + count; tooltips carry the label. */
+  segmentsIconOnly: boolean
+  /** Calm providers give way to a "+N" chip when even one percentage each doesn't fit. */
+  collapseUsage: boolean
+}
+
+// Why: ordered roomiest → tightest so each step gives up the least useful detail first.
+// Usage gives way before right-side labels (collapsing into "+N" before those go
+// icon-only) because the Usage popover holds everything the bar drops.
+export const STATUS_BAR_DENSITY_LEVELS: readonly StatusBarDensity[] = [
+  { compact: false, usageTightestOnly: false, segmentsIconOnly: false, collapseUsage: false },
+  { compact: true, usageTightestOnly: false, segmentsIconOnly: false, collapseUsage: false },
+  { compact: true, usageTightestOnly: true, segmentsIconOnly: false, collapseUsage: false },
+  { compact: true, usageTightestOnly: true, segmentsIconOnly: false, collapseUsage: true },
+  { compact: true, usageTightestOnly: true, segmentsIconOnly: true, collapseUsage: true }
+]
+
+export type StatusBarLevelWidth = {
+  /** Width with every usage chip shown; a change here means the content changed. */
+  natural: number
+  /** Narrowest the level can get: natural, or with calm chips collapsed where the level allows it. */
+  fit: number
+}
+const NO_COLLAPSED_USAGE: readonly string[] = []
+
+const WIDTH_TOLERANCE_PX = 1
+
+/** Roomiest level known to fit; an unmeasured level is returned so it gets probed. */
+export function pickStatusBarDensityLevel(
+  levelWidths: readonly (StatusBarLevelWidth | undefined)[],
+  availableWidth: number
+): number {
+  const tightest = STATUS_BAR_DENSITY_LEVELS.length - 1
+  for (let level = 0; level < tightest; level++) {
+    const width = levelWidths[level]
+    if (width === undefined || width.fit <= availableWidth + WIDTH_TOLERANCE_PX) {
+      return level
+    }
+  }
+  return tightest
+}
+
+/** A level measuring differently than before means the content changed, so every other level's width is stale. */
+export function recordStatusBarDensityWidth(
+  levelWidths: readonly (StatusBarLevelWidth | undefined)[],
+  level: number,
+  width: StatusBarLevelWidth
+): (StatusBarLevelWidth | undefined)[] {
+  const previous = levelWidths[level]
+  const naturalChanged =
+    previous !== undefined && Math.abs(previous.natural - width.natural) > WIDTH_TOLERANCE_PX
+  // Why: urgency can change which chips pin without moving the natural width.
+  const fitChanged =
+    previous !== undefined && Math.abs(previous.fit - width.fit) > WIDTH_TOLERANCE_PX
+  const next = naturalChanged
+    ? []
+    : fitChanged
+      ? levelWidths.map((entry, index) =>
+          STATUS_BAR_DENSITY_LEVELS[index]?.collapseUsage ? undefined : entry
+        )
+      : [...levelWidths]
+  next[level] = width
+  return next
+}
+
+type ElementRef = MutableRefObject<HTMLElement | null>
+
+function measureWidth(ref: ElementRef): number {
+  return ref.current?.getBoundingClientRect().width ?? 0
+}
+
+/**
+ * Picks the roomiest density at which the usage cluster and the right-side segments fit
+ * on one line. Widths are measured from the rendered content, so a transient segment
+ * (update ready, chats to resume) condenses the bar only while it is present. At the
+ * collapsing levels it also names the usage chips that give way to a "+N" chip.
+ */
+export function useStatusBarDensity(): {
+  density: StatusBarDensity
+  overflowing: boolean
+  collapsedUsageProviders: readonly string[]
+  barRef: (node: HTMLElement | null) => void
+  usageRef: (node: HTMLElement | null) => void
+  segmentsRef: (node: HTMLElement | null) => void
+} {
+  const [level, setLevel] = useState(0)
+  const [overflowing, setOverflowing] = useState(false)
+  const [collapsedUsageProviders, setCollapsedUsageProviders] = useState(NO_COLLAPSED_USAGE)
+  const committedLevelRef = useRef(0)
+  const overflowingRef = useRef(false)
+  const collapsedUsageRef = useRef(NO_COLLAPSED_USAGE)
+  const levelWidthsRef = useRef<(StatusBarLevelWidth | undefined)[]>([])
+  const barElementRef = useRef<HTMLElement | null>(null)
+  const usageElementRef = useRef<HTMLElement | null>(null)
+  const segmentsElementRef = useRef<HTMLElement | null>(null)
+  const observerRef = useRef<ResizeObserver | null>(null)
+
+  const evaluate = useCallback((): void => {
+    const bar = barElementRef.current
+    if (!bar) {
+      return
+    }
+    const style = getComputedStyle(bar)
+    const available =
+      bar.clientWidth - Number.parseFloat(style.paddingLeft) - Number.parseFloat(style.paddingRight)
+    const usage = measureUsageRow(usageElementRef.current)
+    const fixedWidth = (Number.parseFloat(style.columnGap) || 0) + measureWidth(segmentsElementRef)
+    const required = usage.naturalWidth + fixedWidth
+    const collapses = STATUS_BAR_DENSITY_LEVELS[committedLevelRef.current].collapseUsage
+    levelWidthsRef.current = recordStatusBarDensityWidth(
+      levelWidthsRef.current,
+      committedLevelRef.current,
+      { natural: required, fit: collapses ? usage.pinnedWidth + fixedWidth : required }
+    )
+    const nextLevel = pickStatusBarDensityLevel(levelWidthsRef.current, available)
+    if (nextLevel !== committedLevelRef.current) {
+      setLevel(nextLevel)
+    }
+    const collapsible =
+      nextLevel === committedLevelRef.current && STATUS_BAR_DENSITY_LEVELS[nextLevel].collapseUsage
+    const nextCollapsed = collapsible
+      ? pickCollapsedUsageChips(
+          usage.chips,
+          required - available - WIDTH_TOLERANCE_PX,
+          usage.moreChipWidth,
+          usage.chipGap
+        )
+      : NO_COLLAPSED_USAGE
+    if (nextCollapsed.join() !== collapsedUsageRef.current.join()) {
+      collapsedUsageRef.current = nextCollapsed
+      setCollapsedUsageProviders(nextCollapsed)
+    }
+    const nextOverflowing = usage.renderedWidth + fixedWidth > available + WIDTH_TOLERANCE_PX
+    if (nextOverflowing !== overflowingRef.current) {
+      overflowingRef.current = nextOverflowing
+      setOverflowing(nextOverflowing)
+    }
+  }, [])
+
+  // Why: runs before paint, so probing a roomier level that turns out not to fit never flashes.
+  useLayoutEffect(() => {
+    committedLevelRef.current = level
+    evaluate()
+  })
+
+  useEffect(() => () => observerRef.current?.disconnect(), [])
+
+  const refs = useMemo(() => {
+    const bind =
+      (target: ElementRef) =>
+      (node: HTMLElement | null): void => {
+        observerRef.current ??= new ResizeObserver(() => evaluate())
+        if (target.current) {
+          observerRef.current.unobserve(target.current)
+        }
+        target.current = node
+        if (node) {
+          observerRef.current.observe(node)
+        }
+      }
+    return {
+      barRef: bind(barElementRef),
+      usageRef: bind(usageElementRef),
+      segmentsRef: bind(segmentsElementRef)
+    }
+  }, [evaluate])
+
+  return {
+    density: STATUS_BAR_DENSITY_LEVELS[level],
+    overflowing,
+    collapsedUsageProviders,
+    ...refs
+  }
+}
diff --git a/src/renderer/src/components/status-bar/status-bar-provider-visibility.test.ts b/src/renderer/src/components/status-bar/status-bar-provider-visibility.test.ts
index 239c3314eb3..987bb91c040 100644
--- a/src/renderer/src/components/status-bar/status-bar-provider-visibility.test.ts
+++ b/src/renderer/src/components/status-bar/status-bar-provider-visibility.test.ts
@@ -77,6 +77,7 @@ function usageSettings(overrides: Partial<UsageProviderSettings> = {}): UsagePro
     minimaxApiKeyConfigured: false,
     opencodeGoApiKeyConfigured: false,
     grokAuthConfigured: false,
+    cursorAuthConfigured: false,
     ...overrides
   }
 }
@@ -394,6 +395,35 @@ describe('getVisibleUsageProvider', () => {
 })
 
 describe('isUsageEmptyState', () => {
+  it('keeps the Cursor bar visible on a local session before the first snapshot', () => {
+    // Why: the credential lives on disk, not in settings, so main's flag is the
+    // only durable signal that the bar has an account behind it.
+    const pending = getVisibleUsageProvider(
+      'cursor',
+      null,
+      usageSettings({ cursorAuthConfigured: true })
+    )
+    expect(pending).toMatchObject({ provider: 'cursor', status: 'fetching' })
+    expect(getVisibleUsageProvider('cursor', null, usageSettings())).toBeNull()
+  })
+
+  it('hides the Cursor bar when no local session exists, even on an unavailable snapshot', () => {
+    // Why: 'unavailable' is how a signed-out host reports Cursor; without the
+    // durable flag there is no account to show a bar for.
+    const unavailable = provider('unavailable', { provider: 'cursor' })
+    expect(getVisibleUsageProvider('cursor', unavailable, usageSettings())).toBeNull()
+    // With a session on disk the row stays, so "no allowance" is explained
+    // rather than silently vanishing.
+    expect(
+      getVisibleUsageProvider('cursor', unavailable, usageSettings({ cursorAuthConfigured: true }))
+    ).toBe(unavailable)
+  })
+
+  it('keeps a failing Cursor refresh visible so the error is not silently hidden', () => {
+    const failing = provider('error', { provider: 'cursor' })
+    expect(getVisibleUsageProvider('cursor', failing, usageSettings())).toBe(failing)
+  })
+
   it('waits for provider snapshots before showing the setup CTA', () => {
     expect(isUsageEmptyState(createEmptyRateLimitState(), usageSettings())).toBe(false)
   })
@@ -409,7 +439,8 @@ describe('isUsageEmptyState', () => {
           kimi: provider('unavailable', { provider: 'kimi' }),
           antigravity: undefined,
           minimax: undefined,
-          grok: undefined
+          grok: undefined,
+          cursor: undefined
         },
         usageSettings()
       )
@@ -427,7 +458,9 @@ describe('isUsageEmptyState', () => {
           kimi: provider('unavailable', { provider: 'kimi' }),
           antigravity: provider('unavailable', { provider: 'antigravity' }),
           minimax: provider('unavailable', { provider: 'minimax' }),
-          grok: provider('unavailable', { provider: 'grok' })
+          grok: provider('unavailable', { provider: 'grok' }),
+          cursor: provider('unavailable', { provider: 'cursor' }),
+          zcode: provider('unavailable', { provider: 'zcode' })
         },
         usageSettings()
       )
@@ -445,7 +478,9 @@ describe('isUsageEmptyState', () => {
           kimi: provider('unavailable', { provider: 'kimi' }),
           antigravity: provider('unavailable', { provider: 'antigravity' }),
           minimax: provider('unavailable', { provider: 'minimax' }),
-          grok: provider('unavailable', { provider: 'grok' })
+          grok: provider('unavailable', { provider: 'grok' }),
+          cursor: provider('unavailable', { provider: 'cursor' }),
+          zcode: provider('unavailable', { provider: 'zcode' })
         },
         usageSettings({
           codexManagedAccounts: [
@@ -468,21 +503,21 @@ describe('isUsageEmptyState', () => {
   })
 
   it('shows the setup CTA for a loaded profile with no configured usage provider', () => {
-    expect(
-      isUsageEmptyState(
-        {
-          claude: provider('unavailable', { provider: 'claude' }),
-          codex: provider('unavailable', { provider: 'codex' }),
-          gemini: provider('unavailable'),
-          opencodeGo: provider('unavailable', { provider: 'opencode-go' }),
-          kimi: provider('unavailable', { provider: 'kimi' }),
-          antigravity: null,
-          minimax: provider('unavailable', { provider: 'minimax' }),
-          grok: provider('unavailable', { provider: 'grok' })
-        },
-        usageSettings()
-      )
-    ).toBe(true)
+    const settledProviders = {
+      claude: provider('unavailable', { provider: 'claude' }),
+      codex: provider('unavailable', { provider: 'codex' }),
+      gemini: provider('unavailable'),
+      opencodeGo: provider('unavailable', { provider: 'opencode-go' }),
+      kimi: provider('unavailable', { provider: 'kimi' }),
+      antigravity: null,
+      minimax: provider('unavailable', { provider: 'minimax' }),
+      grok: provider('unavailable', { provider: 'grok' }),
+      cursor: provider('unavailable', { provider: 'cursor' }),
+      zcode: provider('unavailable', { provider: 'zcode' })
+    }
+    expect(isUsageEmptyState(settledProviders, usageSettings())).toBe(true)
+    expect(isUsageEmptyState({ ...settledProviders, zcode: undefined }, usageSettings())).toBe(true)
+    expect(isUsageEmptyState({ ...settledProviders, zcode: null }, usageSettings())).toBe(false)
   })
 
   it('does not show the setup CTA while checked Antigravity usage is awaiting a snapshot', () => {
@@ -496,7 +531,9 @@ describe('isUsageEmptyState', () => {
           kimi: provider('unavailable', { provider: 'kimi' }),
           antigravity: null,
           grok: provider('unavailable', { provider: 'grok' }),
-          minimax: provider('unavailable', { provider: 'minimax' })
+          minimax: provider('unavailable', { provider: 'minimax' }),
+          cursor: provider('unavailable', { provider: 'cursor' }),
+          zcode: provider('unavailable', { provider: 'zcode' })
         },
         usageSettings({ antigravityUsageConfigured: true, geminiCliOAuthEnabled: true })
       )
@@ -516,7 +553,9 @@ describe('isUsageEmptyState', () => {
           kimi: provider('unavailable', { provider: 'kimi' }),
           antigravity: null,
           grok: provider('unavailable', { provider: 'grok' }),
-          minimax: provider('unavailable', { provider: 'minimax' })
+          minimax: provider('unavailable', { provider: 'minimax' }),
+          cursor: provider('unavailable', { provider: 'cursor' }),
+          zcode: provider('unavailable', { provider: 'zcode' })
         },
         usageSettings({ antigravityUsageConfigured: true })
       )
diff --git a/src/renderer/src/components/status-bar/status-bar-provider-visibility.ts b/src/renderer/src/components/status-bar/status-bar-provider-visibility.ts
index c14f0a23a39..24392aa48ab 100644
--- a/src/renderer/src/components/status-bar/status-bar-provider-visibility.ts
+++ b/src/renderer/src/components/status-bar/status-bar-provider-visibility.ts
@@ -21,6 +21,7 @@ export type UsageProviderSettings = Pick<
   // store, neither of which the renderer can see; main reports presence.
   opencodeGoApiKeyConfigured: boolean
   grokAuthConfigured: boolean
+  cursorAuthConfigured: boolean
 }
 
 type UsageProviderSnapshots = {
@@ -32,6 +33,8 @@ type UsageProviderSnapshots = {
   antigravity: ProviderRateLimits | null | undefined
   minimax: ProviderRateLimits | null | undefined
   grok: ProviderRateLimits | null | undefined
+  cursor: ProviderRateLimits | null | undefined
+  zcode?: ProviderRateLimits | null
 }
 
 type UsageProviderId = ProviderRateLimits['provider']
@@ -83,7 +86,8 @@ export function hasUsageProviderSettings(
     // already covered by the gemini term above.
     settings?.minimaxCookieConfigured === true ||
     settings?.minimaxApiKeyConfigured === true ||
-    settings?.grokAuthConfigured === true
+    settings?.grokAuthConfigured === true ||
+    settings?.cursorAuthConfigured === true
   )
 }
 
@@ -121,6 +125,9 @@ export function hasUsageProviderSettingsForProvider(
   if (providerId === 'grok') {
     return settings.grokAuthConfigured === true
   }
+  if (providerId === 'cursor') {
+    return settings.cursorAuthConfigured === true
+  }
   return false
 }
 
@@ -130,7 +137,7 @@ function createPendingProviderSnapshot(providerId: UsageProviderId): ProviderRat
     session: null,
     weekly: null,
     ...(providerId === 'opencode-go' ? { monthly: null } : {}),
-    ...(providerId === 'gemini' ? { buckets: [] } : {}),
+    ...(providerId === 'gemini' || providerId === 'cursor' ? { buckets: [] } : {}),
     updatedAt: 0,
     error: null,
     status: 'fetching'
@@ -174,7 +181,9 @@ export function isUsageEmptyState(
     isProviderSnapshotPending(providers.kimi) ||
     antigravitySnapshotPending ||
     isProviderSnapshotPending(providers.minimax) ||
-    isProviderSnapshotPending(providers.grok)
+    isProviderSnapshotPending(providers.grok) ||
+    isProviderSnapshotPending(providers.cursor) ||
+    (providers.zcode !== undefined && isProviderSnapshotPending(providers.zcode))
   ) {
     return false
   }
@@ -187,6 +196,8 @@ export function isUsageEmptyState(
     !isProviderConfigured(providers.kimi) &&
     !isProviderConfigured(providers.antigravity) &&
     !isProviderConfigured(providers.minimax) &&
-    !isProviderConfigured(providers.grok)
+    !isProviderConfigured(providers.grok) &&
+    !isProviderConfigured(providers.cursor) &&
+    !isProviderConfigured(providers.zcode)
   )
 }
diff --git a/src/renderer/src/components/status-bar/status-bar-usage-collapse.test.ts b/src/renderer/src/components/status-bar/status-bar-usage-collapse.test.ts
new file mode 100644
index 00000000000..9abddbb902e
--- /dev/null
+++ b/src/renderer/src/components/status-bar/status-bar-usage-collapse.test.ts
@@ -0,0 +1,46 @@
+import { describe, expect, it } from 'vitest'
+import { pickCollapsedUsageChips } from './status-bar-usage-collapse'
+
+const GAP = 12
+const MORE = 20
+// Roster order, as the status bar renders it.
+const chips = [
+  { provider: 'claude', width: 60, urgent: false },
+  { provider: 'codex', width: 60, urgent: false },
+  { provider: 'gemini', width: 60, urgent: false },
+  { provider: 'grok', width: 60, urgent: false },
+  { provider: 'cursor', width: 60, urgent: true }
+]
+
+describe('pickCollapsedUsageChips', () => {
+  it('collapses nothing when the row fits', () => {
+    expect(pickCollapsedUsageChips(chips, 0, MORE, GAP)).toEqual([])
+    expect(pickCollapsedUsageChips(chips, -40, MORE, GAP)).toEqual([])
+  })
+
+  it('drops calm agents from the end of the roster and keeps the urgent one', () => {
+    // 10px over: one chip frees 72px, which also pays for the "+N" chip (20 + 12).
+    expect(pickCollapsedUsageChips(chips, 10, MORE, GAP)).toEqual(['grok'])
+    expect(pickCollapsedUsageChips(chips, 60, MORE, GAP)).toEqual(['grok', 'gemini'])
+  })
+
+  it('reserves room for the "+N" chip it introduces', () => {
+    // 41px over + 32px for "+N" = 73px, one more than a single chip frees.
+    expect(pickCollapsedUsageChips(chips, 41, MORE, GAP)).toEqual(['grok', 'gemini'])
+  })
+
+  it('drops urgent agents only after every calm one', () => {
+    expect(pickCollapsedUsageChips(chips, 300, MORE, GAP)).toEqual([
+      'grok',
+      'gemini',
+      'codex',
+      'claude',
+      'cursor'
+    ])
+  })
+
+  it('drops urgent agents from the end of the roster too', () => {
+    const allUrgent = chips.map((chip) => ({ ...chip, urgent: true }))
+    expect(pickCollapsedUsageChips(allUrgent, 10, MORE, GAP)).toEqual(['cursor'])
+  })
+})
diff --git a/src/renderer/src/components/status-bar/status-bar-usage-collapse.ts b/src/renderer/src/components/status-bar/status-bar-usage-collapse.ts
new file mode 100644
index 00000000000..4a08acd8f12
--- /dev/null
+++ b/src/renderer/src/components/status-bar/status-bar-usage-collapse.ts
@@ -0,0 +1,93 @@
+export type UsageChipMeasure = {
+  provider: string
+  width: number
+  urgent: boolean
+  collapsed: boolean
+}
+
+export type UsageRowMeasure = {
+  /** Width of the usage row as if every chip were shown, so collapsing never reads as a content change. */
+  naturalWidth: number
+  /** Width with every calm chip collapsed into "+N", keeping urgent ones. */
+  pinnedWidth: number
+  /** Width the row actually occupies right now. */
+  renderedWidth: number
+  chips: UsageChipMeasure[]
+  moreChipWidth: number
+  chipGap: number
+}
+
+/**
+ * Chooses which usage chips give way so the row sheds `overflowPx`. Calm agents go first,
+ * from the end of the roster; urgent ones only when calm ones can't free enough room.
+ */
+export function pickCollapsedUsageChips(
+  chips: readonly Pick<UsageChipMeasure, 'provider' | 'width' | 'urgent'>[],
+  overflowPx: number,
+  moreChipWidth: number,
+  chipGap: number
+): string[] {
+  if (overflowPx <= 0) {
+    return []
+  }
+  // The first collapsed chip brings the "+N" chip (and its gap) into the row.
+  const needed = overflowPx + moreChipWidth + chipGap
+  const dropOrder = [
+    ...chips.filter((chip) => !chip.urgent).toReversed(),
+    ...chips.filter((chip) => chip.urgent).toReversed()
+  ]
+  const collapsed: string[] = []
+  let freed = 0
+  for (const chip of dropOrder) {
+    if (freed >= needed) {
+      break
+    }
+    collapsed.push(chip.provider)
+    freed += chip.width + chipGap
+  }
+  return collapsed
+}
+
+/** Reads the `data-usage-*` markers the status bar renders on its usage chips and "+N" chip. */
+export function measureUsageRow(usage: HTMLElement | null): UsageRowMeasure {
+  if (!usage) {
+    return {
+      naturalWidth: 0,
+      pinnedWidth: 0,
+      renderedWidth: 0,
+      chips: [],
+      moreChipWidth: 0,
+      chipGap: 0
+    }
+  }
+  const renderedWidth = usage.getBoundingClientRect().width
+  const chipElements = [...usage.querySelectorAll<HTMLElement>('[data-usage-chip]')]
+  const chipRow = chipElements[0]?.parentElement
+  const chipGap = chipRow ? Number.parseFloat(getComputedStyle(chipRow).columnGap) || 0 : 0
+  const chips = chipElements.map((element) => ({
+    provider: element.dataset.usageChip ?? '',
+    width: element.getBoundingClientRect().width,
+    urgent: element.dataset.usageUrgent === 'true',
+    collapsed: element.dataset.usageCollapsed === 'true'
+  }))
+  const more = usage.querySelector<HTMLElement>('[data-usage-more]')
+  const moreChipWidth = more?.getBoundingClientRect().width ?? 0
+  const moreInRow = more !== null && more.dataset.usageCollapsed !== 'true'
+  const collapsedWidth = chips
+    .filter((chip) => chip.collapsed)
+    .reduce((sum, chip) => sum + chip.width + chipGap, 0)
+  const naturalWidth = renderedWidth + collapsedWidth - (moreInRow ? moreChipWidth + chipGap : 0)
+  const calmChips = chips.filter((chip) => !chip.urgent)
+  const pinnedWidth =
+    naturalWidth -
+    calmChips.reduce((sum, chip) => sum + chip.width + chipGap, 0) +
+    (calmChips.length > 0 ? moreChipWidth + chipGap : 0)
+  return {
+    naturalWidth,
+    pinnedWidth,
+    renderedWidth,
+    chips,
+    moreChipWidth,
+    chipGap
+  }
+}
diff --git a/src/renderer/src/components/status-bar/tooltip.test.ts b/src/renderer/src/components/status-bar/tooltip.test.ts
index fd7561e250c..f08f1e4a1eb 100644
--- a/src/renderer/src/components/status-bar/tooltip.test.ts
+++ b/src/renderer/src/components/status-bar/tooltip.test.ts
@@ -54,7 +54,8 @@ const PROVIDER_IDS: ProviderRateLimits['provider'][] = [
   'opencode-go',
   'kimi',
   'minimax',
-  'grok'
+  'grok',
+  'zcode'
 ]
 
 afterEach(() => {
@@ -294,6 +295,18 @@ describe('provider usage error copy', () => {
 })
 
 describe('getWindowSections', () => {
+  it('keeps ZCode Coding Plan windows separate from MCP quota', () => {
+    const session = { usedPercent: 25, windowMinutes: 300, resetsAt: null, resetDescription: null }
+    const weekly = { usedPercent: 40, windowMinutes: 10080, resetsAt: null, resetDescription: null }
+    const mcp = { usedPercent: 10, windowMinutes: 43200, resetsAt: null, resetDescription: null }
+    const sections = getWindowSections(
+      provider({ provider: 'zcode', session, weekly, monthly: mcp })
+    )
+
+    expect(sections.map((section) => section.label)).toEqual(['Session', 'Weekly', 'MCP'])
+    expect(sections[2].window).toBe(mcp)
+  })
+
   it('returns buckets as sections when present', () => {
     const p: ProviderRateLimits = {
       provider: 'gemini',
diff --git a/src/renderer/src/components/status-bar/tooltip.tsx b/src/renderer/src/components/status-bar/tooltip.tsx
index 2a82f7318dd..735452c9e26 100644
--- a/src/renderer/src/components/status-bar/tooltip.tsx
+++ b/src/renderer/src/components/status-bar/tooltip.tsx
@@ -97,6 +97,12 @@ export function ProviderIcon({ provider }: { provider: string }): React.JSX.Elem
   if (provider === 'grok') {
     return <AgentIcon agent="grok" size={13} />
   }
+  if (provider === 'zcode') {
+    return <AgentIcon agent="zcode" size={13} />
+  }
+  if (provider === 'cursor') {
+    return <AgentIcon agent="cursor" size={13} />
+  }
   return <ClaudeIcon size={13} />
 }
 
@@ -146,6 +152,19 @@ export function getWindowSections(
     const bucketSections = p.buckets.map((b) => ({ label: b.name, window: b as RateLimitWindow }))
     return [
       ...bucketSections,
+      // Why: Cursor reports the plan total in `monthly` and its pools as buckets,
+      // so dropping it here would hide the number closest to the user's cap.
+      ...(p.monthly
+        ? [
+            {
+              label:
+                p.provider === 'cursor'
+                  ? translate('auto.components.status.bar.tooltip.cursor.plan', 'Plan')
+                  : translate('auto.components.status.bar.tooltip.7f7f208060', 'Monthly'),
+              window: p.monthly
+            }
+          ]
+        : []),
       {
         label: translate('auto.components.status.bar.tooltip.252c096536', 'Weekly'),
         window: p.weekly
@@ -170,7 +189,10 @@ export function getWindowSections(
   }
   if (p.monthly !== undefined && p.monthly !== null) {
     sections.push({
-      label: translate('auto.components.status.bar.tooltip.7f7f208060', 'Monthly'),
+      label:
+        p.provider === 'zcode'
+          ? translate('auto.components.status.bar.tooltip.zcode.mcp', 'MCP')
+          : translate('auto.components.status.bar.tooltip.7f7f208060', 'Monthly'),
       window: p.monthly
     })
   }
@@ -188,11 +210,14 @@ export function getWindowSections(
 
 // Why: urgency color tracks % used even when fill represents % remaining;
 // low usage stays neutral so persistent chrome stays quiet.
+export const USAGE_WARNING_PERCENT = 60
+export const USAGE_URGENT_PERCENT = 80
+
 export function barColor(usedPct: number): string {
-  if (usedPct < 60) {
+  if (usedPct < USAGE_WARNING_PERCENT) {
     return 'bg-muted-foreground/40'
   }
-  if (usedPct < 80) {
+  if (usedPct < USAGE_URGENT_PERCENT) {
     return 'bg-yellow-500'
   }
   return 'bg-red-500'
diff --git a/src/renderer/src/components/status-bar/usage-error-copy.ts b/src/renderer/src/components/status-bar/usage-error-copy.ts
index 8dd8ec7f2aa..95942ddb5b7 100644
--- a/src/renderer/src/components/status-bar/usage-error-copy.ts
+++ b/src/renderer/src/components/status-bar/usage-error-copy.ts
@@ -26,6 +26,12 @@ export function getProviderDisplayName(provider: ProviderRateLimits['provider'])
   if (provider === 'grok') {
     return 'Grok'
   }
+  if (provider === 'zcode') {
+    return 'ZCode'
+  }
+  if (provider === 'cursor') {
+    return 'Cursor'
+  }
   return provider
 }
 
@@ -117,6 +123,11 @@ export function getProviderUsageStatusLabel(p: ProviderRateLimits): string {
   if (p.provider === 'minimax' && p.usageMetadata?.failureKind === 'stale-token') {
     return translate('auto.components.status.bar.tooltip.minimax.expired.label', 'Sign-in expired')
   }
+  // Why: cursor-agent owns its own token rotation, so a lapsed Cursor session is
+  // fixed by signing in to the CLI, not by Orca retrying the fetch.
+  if (p.provider === 'cursor' && p.usageMetadata?.failureKind === 'stale-token') {
+    return translate('auto.components.status.bar.tooltip.cursor.expired.label', 'Sign-in expired')
+  }
   // Why: an unsubscribed account is a settled answer about the account, not a
   // failed refresh; "Refresh failed" sends the user hunting a bug that is not there.
   if (p.usageMetadata?.failureKind === 'no-subscription') {
@@ -152,6 +163,12 @@ export function getProviderUsageErrorMessage(p: ProviderRateLimits): string {
       'Run kimi in a terminal on the computer running Orca and wait for it to start, then retry usage.'
     )
   }
+  if (p.provider === 'cursor' && p.usageMetadata?.failureKind === 'stale-token') {
+    return translate(
+      'auto.components.status.bar.tooltip.cursor.expired.message',
+      'Run cursor-agent login in a terminal on the computer running Orca, then retry usage.'
+    )
+  }
   if (p.provider === 'claude') {
     switch (p.usageMetadata?.failureKind) {
       case 'deferred-by-live-session':
diff --git a/src/renderer/src/components/status-bar/usage-provider-settings-target.ts b/src/renderer/src/components/status-bar/usage-provider-settings-target.ts
index 59ea7104249..b531bffd161 100644
--- a/src/renderer/src/components/status-bar/usage-provider-settings-target.ts
+++ b/src/renderer/src/components/status-bar/usage-provider-settings-target.ts
@@ -18,8 +18,12 @@ export function getUsageProviderAccountsSectionId(
       return 'accounts-minimax'
     case 'grok':
       return 'accounts-grok'
+    case 'cursor':
+      return 'accounts-cursor'
     case 'kimi':
+    case 'zcode':
       // Why: Orca must not mutate Kimi's CLI-owned credential lifecycle.
+      // ZCode likewise owns its Coding Plan credential in ~/.zcode/cli/config.json.
       return null
   }
 }
diff --git a/src/renderer/src/components/status-bar/use-status-bar-controller.ts b/src/renderer/src/components/status-bar/use-status-bar-controller.ts
index d2f9a21ea18..8ec0bcfce43 100644
--- a/src/renderer/src/components/status-bar/use-status-bar-controller.ts
+++ b/src/renderer/src/components/status-bar/use-status-bar-controller.ts
@@ -9,7 +9,7 @@ import { isStatusBarItemAvailable } from './status-bar-agent-gating'
 import { getVisibleUsageProvider, isUsageEmptyState } from './status-bar-provider-visibility'
 import { getUsageProviderAccountsSectionId } from './usage-provider-settings-target'
 import { CLOSE_ALL_CONTEXT_MENUS_EVENT, useStatusBarMenuFocusHandoff } from './ProviderDetailsMenu'
-import { observeStatusBarContainer } from './status-bar-container-observer'
+import { useStatusBarDensity } from './status-bar-density'
 
 export function useStatusBarController(floatingTerminalOpen: boolean) {
   const floatingTerminalShortcut = useShortcutLabel('floatingTerminal.toggle')
@@ -40,14 +40,18 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
   const petEnabled = useAppStore((s) => s.settings?.experimentalPet === true)
   const toggleStatusBarItem = useAppStore((s) => s.toggleStatusBarItem)
   const usageEmptyStateDismissed = useAppStore((s) => s.usageEmptyStateDismissed)
-  const containerRef = useRef<HTMLDivElement>(null)
   const mountedRef = useRef(true)
   const [isRefreshing, setIsRefreshing] = useState(false)
   const [menuOpen, setMenuOpen] = useState(false)
   const [menuPoint, setMenuPoint] = useState({ x: 0, y: 0 })
-
-  const [containerWidth, setContainerWidth] = useState(900)
-  const resizeObserverRef = useRef<ResizeObserver | null>(null)
+  const {
+    density: { compact, usageTightestOnly, segmentsIconOnly, collapseUsage },
+    overflowing,
+    collapsedUsageProviders,
+    barRef,
+    usageRef,
+    segmentsRef
+  } = useStatusBarDensity()
 
   useEffect(() => {
     mountedRef.current = true
@@ -67,18 +71,6 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
     void ensureDetectedAgents()
   }, [ensureDetectedAgents])
 
-  const containerRefCallback = useCallback((node: HTMLDivElement | null) => {
-    if (resizeObserverRef.current) {
-      resizeObserverRef.current.disconnect()
-      resizeObserverRef.current = null
-    }
-    if (node) {
-      containerRef.current = node
-      resizeObserverRef.current = observeStatusBarContainer(node, setContainerWidth)
-      setContainerWidth(node.getBoundingClientRect().width)
-    }
-  }, [])
-
   const refreshDetectedAgents = useAppStore((s) => s.refreshDetectedAgents)
   const handleRefresh = useCallback(async () => {
     if (isRefreshing) {
@@ -99,7 +91,8 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
     return null
   }
 
-  const { claude, codex, gemini, opencodeGo, kimi, antigravity, minimax, grok } = rateLimits
+  const { claude, codex, gemini, opencodeGo, kimi, antigravity, minimax, grok, cursor, zcode } =
+    rateLimits
 
   // Why: a bar is earned by a live snapshot or durable Settings setup; detection-gating hides per-CLI bars when the agent isn't on PATH.
   // Why: Antigravity has no persisted credential, so a checked status item + detected CLI is the durable "show its slot" signal.
@@ -114,7 +107,8 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
     minimaxCookieConfigured: rateLimits.minimaxCookieConfigured,
     minimaxApiKeyConfigured: rateLimits.minimaxApiKeyConfigured,
     opencodeGoApiKeyConfigured: rateLimits.opencodeGoApiKeyConfigured,
-    grokAuthConfigured: rateLimits.grokAuthConfigured
+    grokAuthConfigured: rateLimits.grokAuthConfigured,
+    cursorAuthConfigured: rateLimits.cursorAuthConfigured
   }
   const visibleClaude = getVisibleUsageProvider('claude', claude, usageSettings)
   const visibleCodex = getVisibleUsageProvider('codex', codex, usageSettings)
@@ -123,6 +117,8 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
   const visibleAntigravity = getVisibleUsageProvider('antigravity', antigravity, usageSettings)
   const visibleMiniMax = getVisibleUsageProvider('minimax', minimax, usageSettings)
   const visibleGrok = getVisibleUsageProvider('grok', grok, usageSettings)
+  const visibleCursor = getVisibleUsageProvider('cursor', cursor, usageSettings)
+  const visibleZcode = getVisibleUsageProvider('zcode', zcode, usageSettings)
   const showClaude =
     visibleClaude !== null &&
     statusBarItems.includes('claude') &&
@@ -149,6 +145,13 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
     visibleGrok !== null &&
     statusBarItems.includes('grok') &&
     isStatusBarItemAvailable('grok', detectedAgentIds)
+  // Why: a Cursor session can come from the IDE alone, so PATH detection of
+  // cursor-agent would hide a real meter from IDE-only users.
+  const showCursor = visibleCursor !== null && statusBarItems.includes('cursor')
+  const showZcode =
+    visibleZcode !== null &&
+    statusBarItems.includes('zcode') &&
+    isStatusBarItemAvailable('zcode', detectedAgentIds)
   // Why: OpenCode Go is web/cookie-auth, not a CLI on PATH, so detection-gating doesn't apply.
   const visibleOpencodeGo = getVisibleUsageProvider('opencode-go', opencodeGo, usageSettings)
   const showOpencodeGo = visibleOpencodeGo !== null && statusBarItems.includes('opencode-go')
@@ -166,11 +169,13 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
     showKimi ||
     showAntigravity ||
     showMiniMax ||
-    showGrok
+    showGrok ||
+    showCursor ||
+    showZcode
   const anyVisible = hasVisibleUsageMeters || showResourceUsage
   // Why: include Settings so durable managed accounts count — a configured user isn't shown the empty state while snapshots hydrate.
   const isEmptyUsageState = isUsageEmptyState(
-    { claude, codex, gemini, opencodeGo, kimi, antigravity, minimax, grok },
+    { claude, codex, gemini, opencodeGo, kimi, antigravity, minimax, grok, cursor, zcode },
     usageSettings
   )
   // Why: one-time nudge — once dismissed, stays hidden even if providers reconnect later.
@@ -183,10 +188,10 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
     kimi?.status === 'fetching' ||
     antigravity?.status === 'fetching' ||
     minimax?.status === 'fetching' ||
-    grok?.status === 'fetching'
+    grok?.status === 'fetching' ||
+    cursor?.status === 'fetching' ||
+    zcode?.status === 'fetching'
 
-  const compact = containerWidth < 900
-  const iconOnly = containerWidth < 500
   const floatingTerminalActionLabel = floatingTerminalOpen
     ? 'Minimize Floating Workspace'
     : 'Show Floating Workspace'
@@ -202,7 +207,9 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
     showOpencodeGo ? visibleOpencodeGo : null,
     showKimi ? visibleKimi : null,
     showMiniMax ? visibleMiniMax : null,
-    showGrok ? visibleGrok : null
+    showGrok ? visibleGrok : null,
+    showCursor ? visibleCursor : null,
+    showZcode ? visibleZcode : null
   ].filter((p): p is ProviderRateLimits => p !== null)
 
   const handleManageAccounts = (): void => {
@@ -235,8 +242,10 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
   return {
     anyFetching,
     anyVisible,
+    barRef,
+    collapseUsage,
+    collapsedUsageProviders,
     compact,
-    containerRefCallback,
     detectedAgentIds,
     floatingTerminalActionLabel,
     floatingTerminalShortcut,
@@ -246,14 +255,16 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
     handleUsageDetails,
     handleUsageMenuOpenChange,
     hasVisibleUsageMeters,
-    iconOnly,
     isEmptyUsageState,
     isRefreshing,
     menuOpen,
     menuPoint,
+    overflowing,
     petEnabled,
     recordFeatureInteraction,
     rosterProviders,
+    segmentsIconOnly,
+    segmentsRef,
     setMenuOpen,
     setMenuPoint,
     setStatusBarUsageMode,
@@ -268,7 +279,9 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
     toggleStatusBarItem,
     usageMenuFocusHandoff,
     usageMenuOpen,
-    usagePercentageDisplay
+    usagePercentageDisplay,
+    usageRef,
+    usageTightestOnly
   }
 }
 
diff --git a/src/renderer/src/components/status-bar/workspace-space-manager-source-boundary.test.ts b/src/renderer/src/components/status-bar/workspace-space-manager-source-boundary.test.ts
deleted file mode 100644
index 5c8c1975783..00000000000
--- a/src/renderer/src/components/status-bar/workspace-space-manager-source-boundary.test.ts
+++ /dev/null
@@ -1,79 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-const COMPONENT_ROOT = __dirname
-const PRODUCTION_MODULES = [
-  'WorkspaceSpaceManagerPanel.tsx',
-  'use-workspace-space-decision-projection.ts',
-  'use-workspace-space-git-refresh-action.ts',
-  'use-workspace-space-manager-bindings.ts',
-  'use-workspace-space-manager-panel.ts',
-  'use-workspace-space-manager-projection.ts',
-  'workspace-space-breakdown-list.tsx',
-  'workspace-space-decision-details.ts',
-  'workspace-space-decision-hover-card.tsx',
-  'workspace-space-manager-overview.tsx',
-  'workspace-space-manager-state-types.ts',
-  'workspace-space-manager-table.tsx',
-  'workspace-space-manager-toolbar.tsx',
-  'workspace-space-manager-view.tsx',
-  'workspace-space-metrics.tsx',
-  'workspace-space-selection-controls.tsx',
-  'workspace-space-status-badge.tsx',
-  'workspace-space-treemap.tsx',
-  'workspace-space-worktree-row.tsx'
-] as const
-
-function source(relativePath: string): string {
-  return readFileSync(join(COMPONENT_ROOT, relativePath), 'utf8').replace(/\r\n?/g, '\n')
-}
-
-describe('workspace space manager source boundaries', () => {
-  it('keeps the public export path as a controller/view facade', () => {
-    const facade = source('WorkspaceSpaceManagerPanel.tsx')
-
-    expect(facade).toContain('useWorkspaceSpaceManagerPanel()')
-    expect(facade).toContain('<WorkspaceSpaceManagerView model={model} />')
-    expect(facade).toContain('export { getWorkspaceDecisionDetails }')
-    expect(facade).not.toContain('max-lines')
-  })
-
-  it('keeps every production module below its physical line limit', () => {
-    for (const moduleName of PRODUCTION_MODULES) {
-      const moduleSource = source(moduleName)
-      const limit = moduleName.endsWith('.tsx') ? 400 : 300
-
-      expect(moduleSource.split('\n').length - 1, moduleName).toBeLessThan(limit)
-      expect(moduleSource, moduleName).not.toContain('disable max-lines')
-    }
-  })
-
-  it('preserves bounded git refreshes and source-owned runtime routing', () => {
-    const action = source('use-workspace-space-git-refresh-action.ts')
-    const projection = source('use-workspace-space-manager-projection.ts')
-
-    expect(action).toContain('const currentState = useAppStore.getState()')
-    expect(action).toContain('connectionId:')
-    expect(action).toContain('getRuntimeGitStatus({')
-    expect(action).toContain('getWorkspaceSpaceWorktreeIdentity(worktree)')
-    expect(action).toContain('inFlightGitStatusRefreshes.current.delete(requestKey)')
-    expect(projection).toContain('const GIT_STATUS_REFRESH_CONCURRENCY = 6')
-    expect(projection).toContain('await refreshWorkspaceGitStatus(worktree)')
-    expect(projection).toContain('void Promise.all(')
-    expect(projection).toContain('cancelled = true')
-  })
-
-  it('preserves normal, force, and open-workspace action routing', () => {
-    const controller = source('use-workspace-space-manager-panel.ts')
-    const table = source('workspace-space-manager-table.tsx')
-
-    expect(controller).toContain('runWorktreeBatchDelete(identities, {')
-    expect(controller).toContain('forceConfirm: true')
-    expect(controller).toContain('prepareActiveWorktreeFocusAfterDelete(worktree.worktreeId)')
-    expect(controller).toContain(
-      'removeWorktree(\n        { id: worktree.worktreeId, executionHostId: worktree.executionHostId ?? null },\n        true,\n        { allowUnverifiedPtyStop: true }\n      )'
-    )
-    expect(table).toContain('activateAndRevealWorktree(worktree.worktreeId)')
-  })
-})
diff --git a/src/renderer/src/components/status-bar/workspace-space-manager-table.tsx b/src/renderer/src/components/status-bar/workspace-space-manager-table.tsx
index d4a14655539..8b0ec305124 100644
--- a/src/renderer/src/components/status-bar/workspace-space-manager-table.tsx
+++ b/src/renderer/src/components/status-bar/workspace-space-manager-table.tsx
@@ -140,7 +140,11 @@ export function WorkspaceSpaceManagerTable({
                       deleteState={getDeleteStateForWorktree(worktree)}
                       onToggleSelected={() => toggleSelection(worktree)}
                       onInspect={() => setInspectedWorktreeId(identity)}
-                      onOpenWorkspace={() => activateAndRevealWorktree(worktree.worktreeId)}
+                      onOpenWorkspace={() =>
+                        activateAndRevealWorktree(worktree.worktreeId, {
+                          navigationIntent: 'user-open'
+                        })
+                      }
                       onDelete={() => deleteWorktrees([worktree])}
                       onForceDelete={() => forceDeleteWorktree(worktree)}
                     />
diff --git a/src/renderer/src/components/tab-bar/TabBarCreateEntry.search.test.tsx b/src/renderer/src/components/tab-bar/TabBarCreateEntry.search.test.tsx
index b40166cbc1d..8a168bcb684 100644
--- a/src/renderer/src/components/tab-bar/TabBarCreateEntry.search.test.tsx
+++ b/src/renderer/src/components/tab-bar/TabBarCreateEntry.search.test.tsx
@@ -99,6 +99,66 @@ afterEach(() => {
 })
 
 describe('TabBarCreateEntry search behavior', () => {
+  it.each([false, true])('searches weak file matches on Enter (delayed listing: %s)', (delayed) => {
+    const readyListing = {
+      files: [
+        'tests/e2e/terminal-split-activation-latency-main-probe.ts',
+        'src/main/linear/issue-context-inline-media.test.ts',
+        'src/renderer/src/components/editor/combined-diff/resolve-changes/combined-diff-section-cache-match.ts'
+      ],
+      loading: false,
+      loadError: null
+    }
+    fileListMock.current = delayed ? { files: [], loading: true, loadError: null } : readyListing
+    const onOpenEntry = vi.fn().mockResolvedValue(undefined)
+    renderEntry({ onOpenEntry })
+    setQuery('asciinema')
+
+    if (delayed) {
+      expect(container.querySelector('[aria-selected="true"]')).toBeNull()
+      submit()
+      expect(onOpenEntry).not.toHaveBeenCalled()
+      fileListMock.current = readyListing
+      renderEntry({ onOpenEntry })
+    }
+
+    expect(container.querySelector('[role="option"]')?.textContent).toContain('Search Google')
+    expect(container.querySelector('[aria-selected="true"]')?.textContent).toContain(
+      'Search Google'
+    )
+    submit()
+    expect(onOpenEntry).toHaveBeenCalledWith(
+      expect.objectContaining({
+        classification: { kind: 'search', engine: 'google', query: 'asciinema' }
+      })
+    )
+  })
+
+  it.each(['a', 'ab', 'asciinema'])('waits for an exact filename before arming %s', (query) => {
+    fileListMock.current = { files: [], loading: true, loadError: null }
+    const onOpenEntry = vi.fn().mockResolvedValue(undefined)
+    renderEntry({ onOpenEntry })
+    setQuery(query)
+
+    expect(container.querySelector('[aria-selected="true"]')).toBeNull()
+    submit()
+    expect(onOpenEntry).not.toHaveBeenCalled()
+
+    fileListMock.current = { files: [`docs/${query}`], loading: false, loadError: null }
+    renderEntry({ onOpenEntry })
+    expect(container.querySelector('[aria-selected="true"]')?.textContent).toContain('Open file')
+    submit()
+    expect(onOpenEntry).toHaveBeenCalledWith(
+      expect.objectContaining({
+        classification: {
+          kind: 'existing-file',
+          matchKind: 'exact-basename',
+          relativePath: `docs/${query}`
+        }
+      })
+    )
+  })
+
   it('tracks the configured provider and submits its exact classification', () => {
     const onOpenEntry = vi.fn().mockResolvedValue(undefined)
     renderEntry({ onOpenEntry })
diff --git a/src/renderer/src/components/tab-bar/client-hosted-browser-row-strip-placement.test.ts b/src/renderer/src/components/tab-bar/client-hosted-browser-row-strip-placement.test.ts
index 2b3dfadf473..a2b30515f1d 100644
--- a/src/renderer/src/components/tab-bar/client-hosted-browser-row-strip-placement.test.ts
+++ b/src/renderer/src/components/tab-bar/client-hosted-browser-row-strip-placement.test.ts
@@ -1,28 +1,11 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
 import { describe, expect, it } from 'vitest'
 import { resolveClientHostedBrowserRowStripGroupId } from './client-hosted-browser-row-strip-placement'
 
-function itemSurfaceSource(): string {
-  return readFileSync(join(__dirname, 'tab-bar-item-surface.tsx'), 'utf8')
-}
-
 describe('resolveClientHostedBrowserRowStripGroupId', () => {
-  it('names exactly one owning strip when the worktree is split', () => {
-    const groups = [{ id: 'group-left' }, { id: 'group-right' }, { id: 'group-bottom' }]
-
-    const owner = resolveClientHostedBrowserRowStripGroupId(groups)
-
-    expect(groups.filter((group) => group.id === owner)).toHaveLength(1)
-  })
-
   // Why: picking the focused group instead would make a row hop strips as the user clicks around.
   it('keeps the same owner as focus moves', () => {
     const groups = [{ id: 'group-left' }, { id: 'group-right' }]
 
-    expect(resolveClientHostedBrowserRowStripGroupId(groups)).toBe(
-      resolveClientHostedBrowserRowStripGroupId([...groups])
-    )
     expect(resolveClientHostedBrowserRowStripGroupId(groups)).toBe('group-left')
   })
 
@@ -30,28 +13,3 @@ describe('resolveClientHostedBrowserRowStripGroupId', () => {
     expect(resolveClientHostedBrowserRowStripGroupId([])).toBeNull()
   })
 })
-
-/**
- * A client-hosted placeholder is retired by activating anything else in its strip. That only holds
- * while every row kind's activation goes through the one wrapper — a new kind wired straight to
- * its `onActivate*` prop would leave the placeholder covering the pane it just switched to.
- */
-describe('tab-bar activation census', () => {
-  it('routes every row kind activation through the placeholder-clearing wrapper', () => {
-    const source = itemSurfaceSource()
-    const activations = source.match(/onActivate=\{[^}]*\}/g) ?? []
-
-    expect(activations.length).toBeGreaterThan(0)
-    for (const activation of activations) {
-      expect(activation, 'a row kind activates without retiring the placeholder').toContain(
-        'activateRealTab('
-      )
-    }
-  })
-
-  it('clears the placeholder before handing off to the real activation', () => {
-    expect(itemSurfaceSource()).toMatch(
-      /clearClientHostedBrowserRowSelection\(\)\s*\n\s*activate\?\.\(arg\)/
-    )
-  })
-})
diff --git a/src/renderer/src/components/tab-bar/tab-bar-item-surface.client-hosted-active-state.test.tsx b/src/renderer/src/components/tab-bar/tab-bar-item-surface.client-hosted-active-state.test.tsx
index 2cdff8b1931..a3f85044626 100644
--- a/src/renderer/src/components/tab-bar/tab-bar-item-surface.client-hosted-active-state.test.tsx
+++ b/src/renderer/src/components/tab-bar/tab-bar-item-surface.client-hosted-active-state.test.tsx
@@ -1,7 +1,5 @@
 // @vitest-environment happy-dom
 
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
 import type React from 'react'
 import { afterEach, describe, expect, it } from 'vitest'
 import type { WorkspaceVisibleTabType } from '../../../../shared/tab-types'
@@ -166,21 +164,3 @@ describe('client-hosted row while a real tab is activated', () => {
     }
   )
 })
-
-/**
- * The fixtures above cannot cover a row kind that does not exist yet, and a new one wired straight
- * to its own active-tab selector is exactly how this regressed the first time.
- */
-describe('tab-bar active-state census', () => {
-  it('suppresses every row kind while a client-hosted row owns the strip', () => {
-    const source = readFileSync(join(__dirname, 'tab-bar-item-surface.tsx'), 'utf8')
-    const decisions = source.match(/isActive=\{[^}]*\}/g) ?? []
-
-    expect(decisions.length).toBeGreaterThan(0)
-    for (const decision of decisions) {
-      expect(decision, 'a row kind underlines itself past a client-hosted row').toContain(
-        '!clientHostedRowOwnsActiveState'
-      )
-    }
-  })
-})
diff --git a/src/renderer/src/components/tab-bar/tab-bar-item-surface.tsx b/src/renderer/src/components/tab-bar/tab-bar-item-surface.tsx
index 08f3df3bc98..449b9628ca8 100644
--- a/src/renderer/src/components/tab-bar/tab-bar-item-surface.tsx
+++ b/src/renderer/src/components/tab-bar/tab-bar-item-surface.tsx
@@ -175,7 +175,7 @@ export function renderTabBarItems({
           onCloseToLeft={() => onCloseToLeft(item.id)}
           onDuplicate={
             runtime.managedBrowserCreationEnabled
-              ? () => onDuplicateBrowserTab?.(item.id)
+              ? () => onDuplicateBrowserTab?.(item.id, item.unifiedTabId)
               : undefined
           }
           onTogglePin={() => togglePinned(item)}
diff --git a/src/renderer/src/components/tab-bar/tab-bar-props.ts b/src/renderer/src/components/tab-bar/tab-bar-props.ts
index c7ee410530a..a6dae82bba5 100644
--- a/src/renderer/src/components/tab-bar/tab-bar-props.ts
+++ b/src/renderer/src/components/tab-bar/tab-bar-props.ts
@@ -47,7 +47,7 @@ export type TabBarProps = {
   onActivateBrowserTab?: (tabId: string) => void
   onActivateAgentSession?: (tabId: string) => void
   onCloseBrowserTab?: (tabId: string) => void
-  onDuplicateBrowserTab?: (tabId: string) => void
+  onDuplicateBrowserTab?: (tabId: string, unifiedTabId: string) => void
   onCloseAllFiles?: () => void
   onMakePreviewFilePermanent?: (fileId: string, tabId?: string) => void
   onPinFile?: (fileId: string, tabId?: string) => void
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts b/src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts
index 54bb018c96e..0a272dad7e0 100644
--- a/src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts
@@ -194,9 +194,9 @@ describe('tab create entry classification', () => {
       relativePath: 'src/components/Button.tsx'
     })
     expect(classifyTabEntryQuery('btn', files)).toEqual({
-      kind: 'existing-file',
-      matchKind: 'fuzzy',
-      relativePath: 'src/components/Button.tsx'
+      kind: 'search',
+      engine: 'google',
+      query: 'btn'
     })
   })
 
@@ -212,6 +212,18 @@ describe('tab create entry classification', () => {
     ])
   })
 
+  it('keeps literal filename matches after an exact basename match', () => {
+    expect(
+      getTabEntryOptions('Makefile', readyFiles(['build/Makefile', 'build/Makefile.am'])).map(
+        (option) => option.classification
+      )
+    ).toEqual([
+      { kind: 'existing-file', matchKind: 'exact-basename', relativePath: 'build/Makefile' },
+      { kind: 'search', engine: 'google', query: 'Makefile' },
+      { kind: 'existing-file', matchKind: 'literal-basename', relativePath: 'build/Makefile.am' }
+    ])
+  })
+
   it('prefers creating typed file paths over fuzzy matches', () => {
     expect(
       getTabEntryOptions('read.md', readyFiles(['README.md'])).map(
@@ -224,7 +236,7 @@ describe('tab create entry classification', () => {
     ])
   })
 
-  it('keeps single-token quick-open matches ahead of search, but not phrases', () => {
+  it('keeps literal filename matches ahead of search, but not phrases', () => {
     expect(
       getTabEntryOptions('typescript', readyFiles(['docs/typescript-guide.md'])).map(
         (option) => option.classification
@@ -232,7 +244,7 @@ describe('tab create entry classification', () => {
     ).toEqual([
       {
         kind: 'existing-file',
-        matchKind: 'fuzzy',
+        matchKind: 'literal-basename',
         relativePath: 'docs/typescript-guide.md'
       },
       { kind: 'search', engine: 'google', query: 'typescript' },
@@ -260,7 +272,7 @@ describe('tab create entry classification', () => {
   })
 
   // Fuzzy matching is a subsequence scan, so a short token matches broadly.
-  it('keeps a search slot when fuzzy matches would fill the whole list', () => {
+  it('puts search ahead of fuzzy filename and path matches', () => {
     const files = [
       'src/components/Button.tsx',
       'src/lib/bootstrap-nav.ts',
@@ -269,15 +281,14 @@ describe('tab create entry classification', () => {
       'src/bin/tune.ts'
     ]
     expect(getTabEntryOptions('btn', readyFiles(files)).map((o) => o.classification.kind)).toEqual([
+      'search',
       'existing-file',
       'existing-file',
-      'existing-file',
-      'search'
+      'existing-file'
     ])
-    // A one-slot list still answers with the file, so Enter keeps quick-open.
     expect(
       getTabEntryOptions('btn', readyFiles(files), 1).map((o) => o.classification.kind)
-    ).toEqual(['existing-file'])
+    ).toEqual(['search'])
   })
 
   it('ranks search before ordinary create-file actions', () => {
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-classifier.ts b/src/renderer/src/components/tab-bar/tab-create-entry-classifier.ts
index 78de06106a8..5c1b715d5f1 100644
--- a/src/renderer/src/components/tab-bar/tab-create-entry-classifier.ts
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-classifier.ts
@@ -3,7 +3,11 @@ import type { RuntimeFileListState } from '../quick-open-file-list'
 import { translate } from '@/i18n/i18n'
 import { getTabEntryOmniboxPlaceholder } from './tab-create-entry-copy'
 import { DEFAULT_SEARCH_ENGINE, type SearchEngine } from '../../../../shared/browser-url'
-import { findExistingFileMatches, isLikelyNewFileIntent } from './tab-create-entry-file-matches'
+import {
+  findExistingFileMatches,
+  isLikelyNewFileIntent,
+  type ExistingFileMatch
+} from './tab-create-entry-file-matches'
 import { parseForcedSearchQuery } from './tab-create-entry-forced-search'
 import {
   isTabEntryAbsolutePathLike,
@@ -31,11 +35,7 @@ export const TAB_ENTRY_ABSOLUTE_PATH_REMOTE_BLOCKED_MESSAGE =
 export type TabEntryClassification =
   | { kind: 'empty'; message: string }
   | { kind: 'explicit-url'; url: string }
-  | {
-      kind: 'existing-file'
-      matchKind: 'exact-path' | 'exact-basename' | 'fuzzy'
-      relativePath: string
-    }
+  | ExistingFileMatch
   | { kind: 'host-url'; url: string }
   | { kind: 'search'; engine: SearchEngine; query: string }
   | { kind: 'new-file'; relativePath: string }
@@ -223,8 +223,9 @@ export function getTabEntryOptions(
     getPreparedQuickOpenFiles(fileList.files),
     Math.max(actionLimit, 1)
   )
-  const exactExistingFiles = existingFiles.filter((file) => file.matchKind !== 'fuzzy')
-  const fuzzyExistingFiles = existingFiles.filter((file) => file.matchKind === 'fuzzy')
+  const exactExistingFiles = existingFiles.filter(
+    (file) => file.matchKind === 'exact-path' || file.matchKind === 'exact-basename'
+  )
 
   if (exactExistingFiles.length > 0) {
     const options: TabEntryActionClassification[] = [...exactExistingFiles]
@@ -233,37 +234,41 @@ export function getTabEntryOptions(
     } else if (!hostUrl && newFile) {
       options.push(search)
     }
+    options.push(...existingFiles.filter((file) => file.matchKind === 'literal-basename'))
     return toOptions(options, actionLimit)
   }
   if (hostUrl?.kind === 'blocked') {
     return [blockedOption('invalid-url', hostUrl.message)]
   }
   if (hostUrl?.kind === 'host-url') {
-    return toOptions([hostUrl, ...fuzzyExistingFiles], actionLimit)
+    return toOptions([hostUrl, ...existingFiles], actionLimit)
   }
   if (pathError || !newFile) {
     // Why: an unusable path is still a live quick-open prefix — "src/" cannot be
     // created, but it matches real files, and dropping them turns every typed
     // separator into an error row mid-keystroke.
-    return fuzzyExistingFiles.length > 0
-      ? toOptions(fuzzyExistingFiles, actionLimit)
+    return existingFiles.length > 0
+      ? toOptions(existingFiles, actionLimit)
       : [invalidPathOption(pathError)]
   }
   if (isLikelyNewFileIntent(trimmed)) {
-    return toOptions([newFile, search, ...fuzzyExistingFiles], actionLimit)
+    return toOptions([newFile, search, ...existingFiles], actionLimit)
   }
   // Why no create row: a spaced, extension-less phrase is a web query, and a
   // stray arrow/click on "Create file" leaves an empty `release notes` on disk
   // that then outranks search as an exact match forever after.
   if (/\s/.test(trimmed)) {
-    return toOptions([search, ...fuzzyExistingFiles], actionLimit)
+    return toOptions([search, ...existingFiles], actionLimit)
   }
-  // Why: a single token is still a quick-open attempt ("btn" → Button.tsx), so
-  // only phrases promote web search over fuzzy matches. Fuzzy matching is a
-  // subsequence scan that fills every slot in a real repo, so hold one back —
-  // otherwise search silently disappears from the list it should always offer.
+  // Short Latin tokens match too many filenames to imply file intent; CJK words can be short.
+  if (/^[\p{Script=Latin}\p{Nd}]{1,2}$/u.test(trimmed.normalize('NFC'))) {
+    return toOptions([search, ...existingFiles, newFile], actionLimit)
+  }
+  const literalFiles = existingFiles.filter((file) => file.matchKind === 'literal-basename')
+  const fuzzyFiles = existingFiles.filter((file) => file.matchKind === 'fuzzy')
+  // Reserve a search slot even when literal filename matches fill the list.
   return toOptions(
-    [...fuzzyExistingFiles.slice(0, Math.max(actionLimit - 1, 1)), search, newFile],
+    [...literalFiles.slice(0, Math.max(actionLimit - 1, 1)), search, ...fuzzyFiles, newFile],
     actionLimit
   )
 }
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.test.ts b/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.test.ts
index 8ac46512051..b271d168e78 100644
--- a/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.test.ts
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.test.ts
@@ -2,6 +2,7 @@ import { expect, it, vi } from 'vitest'
 import { prepareQuickOpenFiles, rankQuickOpenFiles } from '../quick-open-search'
 import { findExistingFileMatches } from './tab-create-entry-file-matches'
 import type * as QuickOpenSearch from '../quick-open-search'
+import { compareFileNames } from '../../../../shared/file-name-sort'
 
 const ranking = vi.hoisted(() => ({ calls: 0 }))
 vi.mock('../quick-open-search', async (importOriginal) => {
@@ -28,6 +29,20 @@ it('skips fuzzy ranking when exact matches fill the requested window', () => {
   expect(ranking.calls).toBe(0)
 })
 
+it('selects literal filenames from a large inventory without running fuzzy ranking', () => {
+  const files = prepareQuickOpenFiles([
+    ...Array.from({ length: 100_000 }, (_, index) => `a/s/c/i/i/n/e/m/a/file-${index}.ts`),
+    'docs/asciinema-10.md',
+    'docs/asciinema-2.md'
+  ])
+  ranking.calls = 0
+  expect(findExistingFileMatches('asciinema', files, 2).map((file) => file.relativePath)).toEqual([
+    'docs/asciinema-2.md',
+    'docs/asciinema-10.md'
+  ])
+  expect(ranking.calls).toBe(0)
+})
+
 it('deduplicates exact paths and still fills remaining slots with fuzzy matches', () => {
   const files = prepareQuickOpenFiles(['a.md', 'a.md', 'other/a.md', 'abc.md'])
   expect(findExistingFileMatches('a.md', files, 4)).toEqual([
@@ -37,14 +52,12 @@ it('deduplicates exact paths and still fills remaining slots with fuzzy matches'
   ])
 })
 
-// Why: skipping the ranker is only sound because a fuzzy hit can never outrank an
-// exact one — exact results are concatenated first and dedupe is first-wins, so the
-// exact prefix is exactly what a full ranked-then-sliced list would have returned.
-// This re-runs the pre-skip pipeline and holds the shipped one to it.
+// Sort every literal candidate to check the bounded selection against a full reference.
 function rankThenSlice(
   query: string,
   files: readonly QuickOpenSearch.QuickOpenIndexedFile[],
-  limit: number
+  limit: number,
+  preferLiteralFilenames = false
 ): { kind: string; matchKind: string; relativePath: string }[] {
   const normalized = query.trim().replace(/\\/g, '/')
   if (!normalized || limit <= 0) {
@@ -56,6 +69,12 @@ function rankThenSlice(
     ...files
       .filter((f) => f.lowerFilename === lower)
       .map((f) => ['exact-basename', f.path] as const),
+    ...(preferLiteralFilenames
+      ? files
+          .filter((file) => file.lowerFilename.includes(lower))
+          .sort((a, b) => compareFileNames(a.path, b.path))
+          .map((file) => ['literal-basename', file.path] as const)
+      : []),
     ...rankQuickOpenFiles(normalized, files, limit).map((f) => ['fuzzy', f.path] as const)
   ]
   const seen = new Set<string>()
@@ -65,7 +84,7 @@ function rankThenSlice(
     .slice(0, limit)
 }
 
-it('returns what rank-then-slice would have returned, including at limit 1', () => {
+it('preserves quick-open ordering for explicit file and path queries, including at limit 1', () => {
   const corpus = [
     ['a.md', 'ab.md', 'abc.md', 'deep/nested/a.md'],
     ['ab.md', 'abc.md', 'deep/nested/a.md'],
@@ -74,7 +93,7 @@ it('returns what rank-then-slice would have returned, including at limit 1', ()
     ['README.md', 'docs/readme.md', 'readme.mdx'],
     ['only-fuzzy.md']
   ]
-  const queries = ['a.md', 'index.ts', 'readme.md', 'src/index.ts', 'a', 'nope.md']
+  const queries = ['a.md', 'index.ts', 'readme.md', 'src/index.ts', 'nope.md']
   for (const paths of corpus) {
     const files = prepareQuickOpenFiles(paths)
     for (const query of queries) {
@@ -90,6 +109,46 @@ it('returns what rank-then-slice would have returned, including at limit 1', ()
   }
 })
 
+it('matches the full literal-first reference for bare tokens across limits and input orders', () => {
+  const queries = ['a', 'ab', 'abc', 'BTN', 'button', 'asciinema', '工具', 'é']
+  for (const query of queries) {
+    const paths = [
+      ...Array.from({ length: 12 }, (_, index) => `${[...query].join('/')}/file-${index}.ts`),
+      `docs/${query}-10.md`,
+      `docs/${query}-2.md`,
+      `docs/${query}-2.md`,
+      `docs\\${query.toLowerCase()}-guide.md`,
+      `docs/a${'x'.repeat(120)}-${query.toUpperCase()}.md`,
+      'unrelated.txt'
+    ]
+    for (const corpus of [paths, [...paths, query, `docs/${query}`, query]]) {
+      for (const orderedPaths of [corpus, corpus.toReversed()]) {
+        const files = prepareQuickOpenFiles(orderedPaths)
+        for (const limit of [0, 1, 2, 3, 5, 20]) {
+          expect({
+            query,
+            limit,
+            matches: findExistingFileMatches(` ${query} `, files, limit)
+          }).toEqual({ query, limit, matches: rankThenSlice(query, files, limit, true) })
+        }
+      }
+    }
+  }
+})
+
+it('does not let duplicate literal candidates consume the result limit', () => {
+  const files = prepareQuickOpenFiles([
+    ...Array.from({ length: 10 }, () => 'docs/button-1.md'),
+    'docs/button-2.md'
+  ])
+  ranking.calls = 0
+  expect(findExistingFileMatches('button', files, 2)).toEqual([
+    { kind: 'existing-file', matchKind: 'literal-basename', relativePath: 'docs/button-1.md' },
+    { kind: 'existing-file', matchKind: 'literal-basename', relativePath: 'docs/button-2.md' }
+  ])
+  expect(ranking.calls).toBe(0)
+})
+
 it('takes the exact match at limit 1 without consulting the ranker at all', () => {
   const files = prepareQuickOpenFiles(['a.md', 'ab.md', 'abc.md', 'deep/nested/a.md'])
   ranking.calls = 0
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.ts b/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.ts
index eb2f19576d8..72233be3075 100644
--- a/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.ts
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.ts
@@ -1,8 +1,12 @@
-import { rankQuickOpenFiles, type QuickOpenIndexedFile } from '../quick-open-search'
+import {
+  QuickOpenPathRanker,
+  rankQuickOpenFiles,
+  type QuickOpenIndexedFile
+} from '../quick-open-search'
 
 export type ExistingFileMatch = {
   kind: 'existing-file'
-  matchKind: 'exact-path' | 'exact-basename' | 'fuzzy'
+  matchKind: 'exact-path' | 'exact-basename' | 'literal-basename' | 'fuzzy'
   relativePath: string
 }
 
@@ -36,6 +40,27 @@ export function isLikelyNewFileIntent(query: string): boolean {
   return hasFilenameExtension(trimmed) || /^\.[^.].*$/.test(trimmed)
 }
 
+function findLiteralFilenameMatches(
+  query: string,
+  files: readonly QuickOpenIndexedFile[],
+  limit: number
+): ExistingFileMatch[] {
+  // Natural ordering avoids arbitrary fuzzy scores among literal filename matches.
+  const ranker = new QuickOpenPathRanker('', limit)
+  const seen = new Set<string>()
+  for (const file of files) {
+    if (file.lowerFilename.includes(query) && !seen.has(file.path)) {
+      seen.add(file.path)
+      ranker.consider(file.path)
+    }
+  }
+  return ranker.result().paths.map((relativePath) => ({
+    kind: 'existing-file',
+    matchKind: 'literal-basename',
+    relativePath
+  }))
+}
+
 function dedupeMatches(matches: ExistingFileMatch[]): ExistingFileMatch[] {
   const seen = new Set<string>()
   return matches.filter((match) => {
@@ -75,11 +100,21 @@ export function findExistingFileMatches(
   if (exactMatches.length >= limit) {
     return exactMatches.slice(0, limit)
   }
+  const preferFilenames = !isLikelyNewFileIntent(normalizedQuery) && !/\s/.test(normalizedQuery)
+  const preferredMatches = preferFilenames
+    ? dedupeMatches([
+        ...exactMatches,
+        ...findLiteralFilenameMatches(lowerQuery, indexedFiles, limit)
+      ])
+    : exactMatches
+  if (preferredMatches.length >= limit) {
+    return preferredMatches.slice(0, limit)
+  }
   const fuzzyMatches = rankQuickOpenFiles(normalizedQuery, indexedFiles, limit).map((file) => ({
     kind: 'existing-file' as const,
     matchKind: 'fuzzy' as const,
     relativePath: file.path
   }))
 
-  return dedupeMatches([...exactMatches, ...fuzzyMatches]).slice(0, limit)
+  return dedupeMatches([...preferredMatches, ...fuzzyMatches]).slice(0, limit)
 }
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-history-placement.test.ts b/src/renderer/src/components/tab-bar/tab-create-entry-history-placement.test.ts
index 7907a075b25..d0557dfd13a 100644
--- a/src/renderer/src/components/tab-bar/tab-create-entry-history-placement.test.ts
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-history-placement.test.ts
@@ -2,10 +2,11 @@ import { describe, expect, it } from 'vitest'
 import { insertHistoryRowsBelowFileMatches } from './tab-create-entry-history-placement'
 import type { BrowserHistoryOmniboxRow } from './tab-create-entry-active-option'
 import type { TabEntryOption } from './tab-create-entry-action'
+import type { ExistingFileMatch } from './tab-create-entry-file-matches'
 
 function fileOption(
   relativePath: string,
-  matchKind: 'exact-path' | 'exact-basename' | 'fuzzy'
+  matchKind: ExistingFileMatch['matchKind']
 ): TabEntryOption {
   return {
     id: `existing-file:${relativePath}`,
@@ -40,7 +41,7 @@ describe('tab create entry history placement', () => {
     const placed = insertHistoryRowsBelowFileMatches(
       [
         fileOption('README.md', 'exact-basename'),
-        fileOption('docs/readme-notes.md', 'fuzzy'),
+        fileOption('docs/readme-notes.md', 'literal-basename'),
         newFileOption,
         searchOption
       ],
@@ -53,9 +54,9 @@ describe('tab create entry history placement', () => {
     expect(placed[3]).toMatchObject({ option: { id: 'new-file:readme' } })
   })
 
-  it('stays below a fuzzy match that is the only file row', () => {
+  it.each(['literal-basename', 'fuzzy'] as const)('stays below a lone %s file row', (matchKind) => {
     const placed = insertHistoryRowsBelowFileMatches(
-      [fileOption('docs/readme-notes.md', 'fuzzy'), searchOption],
+      [fileOption('docs/readme-notes.md', matchKind), searchOption],
       rows
     )
 
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-search-ranking.test.ts b/src/renderer/src/components/tab-bar/tab-create-entry-search-ranking.test.ts
new file mode 100644
index 00000000000..82a9a2bfb14
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-search-ranking.test.ts
@@ -0,0 +1,139 @@
+import { describe, expect, it } from 'vitest'
+import { classifyTabEntryQuery, getTabEntryOptions } from './tab-create-entry-classifier'
+import { prepareQuickOpenFiles } from '../quick-open-search'
+import { findExistingFileMatches } from './tab-create-entry-file-matches'
+
+const unrelatedFiles = [
+  'tests/e2e/terminal-split-activation-latency-main-probe.ts',
+  'src/main/linear/issue-context-inline-media.test.ts',
+  'src/renderer/src/components/editor/combined-diff/resolve-changes/combined-diff-section-cache-match.ts'
+]
+const readyFiles = (files: string[]) => ({ files, loading: false, loadError: null })
+
+describe('new-tab file matches versus web search', () => {
+  it('puts search ahead of scattered path matches for asciinema', () => {
+    const options = getTabEntryOptions('asciinema', readyFiles(unrelatedFiles))
+    expect(options.map((option) => option.classification.kind)).toEqual([
+      'search',
+      'existing-file',
+      'existing-file',
+      'existing-file'
+    ])
+    expect(classifyTabEntryQuery('asciinema', readyFiles(unrelatedFiles))).toEqual({
+      kind: 'search',
+      engine: 'google',
+      query: 'asciinema'
+    })
+  })
+
+  it('keeps an actual filename match ahead of search and weak matches below it', () => {
+    const options = getTabEntryOptions(
+      'asciinema',
+      readyFiles([...unrelatedFiles, 'docs/asciinema-guide.md'])
+    )
+    expect(options[0].classification).toMatchObject({
+      kind: 'existing-file',
+      relativePath: 'docs/asciinema-guide.md'
+    })
+    expect(options[1].classification.kind).toBe('search')
+    expect(options.slice(2).every((option) => option.classification.kind === 'existing-file')).toBe(
+      true
+    )
+  })
+
+  it.each([1, 2, 4, 8])('finds a literal filename before limiting to %i actions', (limit) => {
+    const files = readyFiles([
+      ...Array.from({ length: 10 }, (_, index) => `b/u/t/t/o/n/file-${index}.ts`),
+      'src/components/Button.tsx'
+    ])
+    expect(getTabEntryOptions('button', files, limit)[0].classification).toMatchObject({
+      kind: 'existing-file',
+      relativePath: 'src/components/Button.tsx'
+    })
+  })
+
+  it('offers fuzzy filename abbreviations below search', () => {
+    expect(
+      getTabEntryOptions('btn', readyFiles(['src/components/Button.tsx'])).map(
+        (option) => option.classification
+      )
+    ).toEqual([
+      { kind: 'search', engine: 'google', query: 'btn' },
+      { kind: 'existing-file', matchKind: 'fuzzy', relativePath: 'src/components/Button.tsx' },
+      { kind: 'new-file', relativePath: 'btn' }
+    ])
+  })
+
+  it('finds literal filenames even when their old fuzzy score falls outside the result limit', () => {
+    const target = `docs/a${'x'.repeat(120)}-asciinema.md`
+    const files = readyFiles([
+      ...Array.from({ length: 10 }, (_, index) => `a/s/c/i/i/n/e/m/a/file-${index}.ts`),
+      target
+    ])
+    expect(getTabEntryOptions('asciinema', files)[0].classification).toMatchObject({
+      kind: 'existing-file',
+      relativePath: target
+    })
+  })
+
+  it.each([
+    ['btn', 'src/components/Button.tsx', false],
+    ['button', 'src/components/Button.tsx', true],
+    ['asciinema', 'docs/ASCIINEMA-guide.md', true],
+    ['asciinema', 'docs\\ASCIINEMA-guide.md', true],
+    ['asciinema', `docs/a${'x'.repeat(120)}-asciinema.md`, true],
+    ['asciinema', unrelatedFiles[0], false],
+    ['asciinema', unrelatedFiles[1], false],
+    ['asciinema', unrelatedFiles[2], false],
+    ['abc', 'alphabet-biology-chemistry.md', false],
+    ['abc', 'a----b----c.md', false],
+    ['btn', 'src/base/tone.ts', false]
+  ])('reports literal filename matching for %s in %s', (query, path, matches) => {
+    const results = findExistingFileMatches(query, prepareQuickOpenFiles([path]), 1)
+    expect(results.some((result) => result.matchKind === 'literal-basename')).toBe(matches)
+  })
+
+  it.each(['a', 'AB', 'é', 'e\u0301', '12'])('puts search first for short token %s', (query) => {
+    const files = readyFiles(
+      Array.from({ length: 10 }, (_, index) => `docs/${query}-guide-${index}.md`)
+    )
+    for (const limit of [1, 2, 4, 8]) {
+      const options = getTabEntryOptions(query, files, limit)
+      expect(options[0].classification).toEqual({ kind: 'search', engine: 'google', query })
+      expect(options.slice(1).map((option) => option.classification)).toEqual(
+        Array.from({ length: limit - 1 }, (_, index) => ({
+          kind: 'existing-file',
+          matchKind: 'literal-basename',
+          relativePath: `docs/${query}-guide-${index}.md`
+        }))
+      )
+    }
+  })
+
+  it.each(['a', 'ab'])('keeps exact short filename %s ahead of search', (query) => {
+    for (const relativePath of [query, `docs/${query}`]) {
+      const files = readyFiles([`${query}-guide.md`, relativePath])
+      expect(classifyTabEntryQuery(query, files)).toEqual({
+        kind: 'existing-file',
+        matchKind: relativePath === query ? 'exact-path' : 'exact-basename',
+        relativePath
+      })
+    }
+  })
+
+  it.each(['文', '工具'])('keeps short CJK filename matches ahead of search for %s', (query) => {
+    expect(classifyTabEntryQuery(query, readyFiles([`docs/${query}指南.md`]))).toEqual({
+      kind: 'existing-file',
+      matchKind: 'literal-basename',
+      relativePath: `docs/${query}指南.md`
+    })
+  })
+
+  it('reserves search when literal filenames fill the list', () => {
+    const files = readyFiles(['button.tsx', 'button.css', 'button.test.ts', 'button.md'])
+    expect(getTabEntryOptions('button', files).map((option) => option.classification.kind)).toEqual(
+      ['existing-file', 'existing-file', 'existing-file', 'search']
+    )
+    expect(classifyTabEntryQuery('button', files).kind).toBe('existing-file')
+  })
+})
diff --git a/src/renderer/src/components/tab-bar/tab-strip-growth-scroll.test.tsx b/src/renderer/src/components/tab-bar/tab-strip-growth-scroll.test.tsx
new file mode 100644
index 00000000000..f18f8333ee3
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/tab-strip-growth-scroll.test.tsx
@@ -0,0 +1,141 @@
+// @vitest-environment happy-dom
+import { act, cleanup, render } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { useTabStripOverflowNavigation } from './tab-strip-overflow-navigation'
+
+const TAB_WIDTH = 100
+const VIEWPORT_WIDTH = 300
+
+const scrollLeftByElement = new WeakMap<Element, number>()
+const originals = {
+  rect: HTMLElement.prototype.getBoundingClientRect,
+  scrollIntoView: HTMLElement.prototype.scrollIntoView,
+  scrollLeft: Object.getOwnPropertyDescriptor(HTMLElement.prototype, 'scrollLeft'),
+  scrollWidth: Object.getOwnPropertyDescriptor(HTMLElement.prototype, 'scrollWidth'),
+  clientWidth: Object.getOwnPropertyDescriptor(HTMLElement.prototype, 'clientWidth')
+}
+
+function isStrip(el: Element): boolean {
+  return el.hasAttribute('data-strip')
+}
+
+function rect(left: number, width: number): DOMRect {
+  return DOMRect.fromRect({ x: left, y: 0, width, height: 20 })
+}
+
+/** 100px tabs in a 300px strip; a tab's x is its index minus the strip's scroll. */
+function installStripLayout(): void {
+  Object.defineProperty(HTMLElement.prototype, 'scrollWidth', {
+    configurable: true,
+    get(this: Element) {
+      return isStrip(this) ? this.children.length * TAB_WIDTH : 0
+    }
+  })
+  Object.defineProperty(HTMLElement.prototype, 'clientWidth', {
+    configurable: true,
+    get(this: Element) {
+      return isStrip(this) ? VIEWPORT_WIDTH : 0
+    }
+  })
+  Object.defineProperty(HTMLElement.prototype, 'scrollLeft', {
+    configurable: true,
+    get(this: Element) {
+      return scrollLeftByElement.get(this) ?? 0
+    },
+    set(this: Element, value: number) {
+      const max = Math.max(0, this.scrollWidth - this.clientWidth)
+      scrollLeftByElement.set(this, Math.min(max, Math.max(0, value)))
+    }
+  })
+  HTMLElement.prototype.getBoundingClientRect = function (this: HTMLElement): DOMRect {
+    if (isStrip(this)) {
+      return rect(0, VIEWPORT_WIDTH)
+    }
+    const strip = this.parentElement
+    if (strip && isStrip(strip)) {
+      const index = Array.from(strip.children).indexOf(this)
+      return rect(index * TAB_WIDTH - strip.scrollLeft, TAB_WIDTH)
+    }
+    return rect(0, 0)
+  }
+  HTMLElement.prototype.scrollIntoView = function (): void {}
+}
+
+function restoreStripLayout(): void {
+  HTMLElement.prototype.getBoundingClientRect = originals.rect
+  HTMLElement.prototype.scrollIntoView = originals.scrollIntoView
+  for (const key of ['scrollLeft', 'scrollWidth', 'clientWidth'] as const) {
+    const descriptor = originals[key]
+    if (descriptor) {
+      Object.defineProperty(HTMLElement.prototype, key, descriptor)
+    } else {
+      Reflect.deleteProperty(HTMLElement.prototype, key)
+    }
+  }
+}
+
+function Strip({ tabs, active }: { tabs: string[]; active: string }): React.JSX.Element {
+  const navigation = useTabStripOverflowNavigation({
+    activeVisibleTabId: active,
+    layoutKey: tabs.join(','),
+    tabCount: tabs.length,
+    worktreeId: 'wt-1'
+  })
+  return (
+    <div data-strip="" ref={navigation.tabStripRef}>
+      {tabs.map((id) => (
+        <div key={id} data-tab-id={id} />
+      ))}
+    </div>
+  )
+}
+
+const TABS = ['A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J']
+
+function mountScrolled(active: string, scrollLeft: number) {
+  const view = render(<Strip tabs={TABS} active={active} />)
+  const strip = view.container.querySelector<HTMLElement>('[data-strip]')!
+  act(() => {
+    strip.scrollLeft = scrollLeft
+    strip.dispatchEvent(new Event('scroll'))
+  })
+  return { ...view, strip }
+}
+
+function tabX(strip: HTMLElement, id: string): number {
+  return strip.querySelector<HTMLElement>(`[data-tab-id="${id}"]`)!.getBoundingClientRect().left
+}
+
+describe('tab strip scroll when tabs are added', () => {
+  beforeEach(installStripLayout)
+  afterEach(() => {
+    cleanup()
+    restoreStripLayout()
+  })
+
+  it('keeps the viewed tab still when a background tab lands to its left', () => {
+    const { strip, rerender } = mountScrolled('F', 400)
+    expect(tabX(strip, 'F')).toBe(100)
+    rerender(<Strip tabs={['A', 'B', 'N', ...TABS.slice(2)]} active="F" />)
+    expect(tabX(strip, 'F')).toBe(100)
+  })
+
+  it('keeps the viewed tab still when a background tab lands after it', () => {
+    const { strip, rerender } = mountScrolled('F', 400)
+    rerender(<Strip tabs={[...TABS.slice(0, 6), 'N', ...TABS.slice(6)]} active="F" />)
+    expect(strip.scrollLeft).toBe(400)
+    expect(tabX(strip, 'F')).toBe(100)
+  })
+
+  it('does not jump to the end for a background tab while pinned to the end', () => {
+    const { strip, rerender } = mountScrolled('J', 700)
+    rerender(<Strip tabs={[...TABS, 'N']} active="J" />)
+    expect(tabX(strip, 'J')).toBe(200)
+  })
+
+  it('scrolls to the end for a foreground tab appended at the end', () => {
+    const { strip, rerender } = mountScrolled('C', 0)
+    rerender(<Strip tabs={[...TABS, 'N']} active="N" />)
+    expect(strip.scrollLeft).toBe(800)
+  })
+})
diff --git a/src/renderer/src/components/tab-bar/tab-strip-overflow-navigation.ts b/src/renderer/src/components/tab-bar/tab-strip-overflow-navigation.ts
index 77af550b748..462a97e9405 100644
--- a/src/renderer/src/components/tab-bar/tab-strip-overflow-navigation.ts
+++ b/src/renderer/src/components/tab-bar/tab-strip-overflow-navigation.ts
@@ -6,6 +6,12 @@ import {
   type TabStripScrollMetrics
 } from './tab-strip-scroll-metrics'
 import { isTabStripPointerGestureActive } from './tab-strip-pointer-gesture'
+import {
+  captureTabStripScrollAnchor,
+  isLastTabStripTab,
+  restoreTabStripScrollAnchor,
+  type TabStripScrollAnchor
+} from './tab-strip-scroll-anchor'
 
 const TAB_STRIP_SCROLL_FRACTION = 0.75
 const TAB_STRIP_MIN_SCROLL_STEP_PX = 120
@@ -25,6 +31,11 @@ export function scrollTabStripByStep(
   })
 }
 
+function isTabStripScrolledToEnd(el: HTMLElement): boolean {
+  const max = Math.max(0, el.scrollWidth - el.clientWidth)
+  return el.scrollLeft >= max - 2
+}
+
 const EMPTY_TAB_STRIP_OVERFLOW_STATE: TabStripScrollMetrics = {
   hasOverflow: false,
   canScrollStart: false,
@@ -51,6 +62,11 @@ export function useTabStripOverflowNavigation({
   const tabStripRef = useRef<HTMLDivElement>(null)
   const prevStripLenRef = useRef<{ worktreeId: string; len: number } | null>(null)
   const stickToEndRef = useRef(false)
+  const activeTabIdRef = useRef<string | null>(null)
+  const scrollAnchorRef = useRef<{
+    activeTabId: string | null
+    anchor: TabStripScrollAnchor | null
+  } | null>(null)
   const [tabStripOverflowState, setTabStripOverflowState] = useState<TabStripScrollMetrics>(
     EMPTY_TAB_STRIP_OVERFLOW_STATE
   )
@@ -74,6 +90,14 @@ export function useTabStripOverflowNavigation({
     },
     []
   )
+  const recordScrollAnchor = useCallback((): void => {
+    const el = tabStripRef.current
+    if (!el) {
+      return
+    }
+    const activeTabId = activeTabIdRef.current
+    scrollAnchorRef.current = { activeTabId, anchor: captureTabStripScrollAnchor(el, activeTabId) }
+  }, [])
 
   useEffect(() => {
     const el = tabStripRef.current
@@ -96,14 +120,11 @@ export function useTabStripOverflowNavigation({
     if (!el) {
       return
     }
-    const isAtEnd = (): boolean => {
-      const max = Math.max(0, el.scrollWidth - el.clientWidth)
-      return el.scrollLeft >= max - 2
-    }
     const onScroll = (): void => {
       // Only keep sticking while the user hasn't intentionally scrolled away.
-      stickToEndRef.current = isAtEnd()
+      stickToEndRef.current = isTabStripScrolledToEnd(el)
       updateTabStripOverflowState()
+      recordScrollAnchor()
     }
     el.addEventListener('scroll', onScroll, { passive: true })
     onScroll()
@@ -112,13 +133,10 @@ export function useTabStripOverflowNavigation({
       updateTabStripOverflowState()
       // If the user is pinned to the right edge, keep it pinned even as tab
       // labels (e.g. "Terminal 5" -> branch name) expand and change scrollWidth.
-      if (!stickToEndRef.current) {
-        return
+      if (stickToEndRef.current && !isTabStripPointerGestureActive()) {
+        el.scrollLeft = Math.max(0, el.scrollWidth - el.clientWidth)
       }
-      if (isTabStripPointerGestureActive()) {
-        return
-      }
-      el.scrollLeft = Math.max(0, el.scrollWidth - el.clientWidth)
+      recordScrollAnchor()
     }
 
     const disconnectResizeObservers = bindTabStripContentResizeObservers(el, handleStripResize)
@@ -127,7 +145,12 @@ export function useTabStripOverflowNavigation({
       el.removeEventListener('scroll', onScroll)
       disconnectResizeObservers()
     }
-  }, [updateTabStripOverflowState])
+  }, [recordScrollAnchor, updateTabStripOverflowState])
+
+  // Why a ref set first: the growth effect below must see this commit's active tab without re-running on every tab switch.
+  useLayoutEffect(() => {
+    activeTabIdRef.current = activeVisibleTabId
+  }, [activeVisibleTabId])
 
   useLayoutEffect(() => {
     const strip = tabStripRef.current
@@ -142,56 +165,65 @@ export function useTabStripOverflowNavigation({
       return
     }
     const pointerGestureActive = isTabStripPointerGestureActive()
-    if (stickToEndRef.current && !pointerGestureActive) {
-      const scrollToEnd = (): void => {
-        const el = tabStripRef.current
-        if (!el) {
-          return
-        }
-        el.scrollLeft = Math.max(0, el.scrollWidth - el.clientWidth)
-        updateTabStripOverflowState()
+    const scrollToEnd = (stick: boolean): void => {
+      const el = tabStripRef.current
+      if (!el) {
+        return
       }
-      scrollToEnd()
-      requestAnimationFrame(scrollToEnd)
-    }
-    if (tabCount > prev.len && !pointerGestureActive) {
-      const scrollToEnd = (): void => {
-        const el = tabStripRef.current
-        if (!el) {
-          return
-        }
-        el.scrollLeft = Math.max(0, el.scrollWidth - el.clientWidth)
+      el.scrollLeft = Math.max(0, el.scrollWidth - el.clientWidth)
+      if (stick) {
         stickToEndRef.current = true
-        updateTabStripOverflowState()
       }
-      scrollToEnd()
-      requestAnimationFrame(scrollToEnd)
+      updateTabStripOverflowState()
+    }
+    const recorded = scrollAnchorRef.current
+    if (tabCount > prev.len && !pointerGestureActive) {
+      if (recorded?.activeTabId === activeTabIdRef.current) {
+        // Why: a background open must not move the tab the user is looking at; insertions
+        // around it keep its on-screen x, the way VS Code and Chrome leave the viewed tab still.
+        if (recorded.anchor) {
+          restoreTabStripScrollAnchor(strip, recorded.anchor)
+        }
+        stickToEndRef.current = isTabStripScrolledToEnd(strip)
+      } else if (isLastTabStripTab(strip, activeTabIdRef.current)) {
+        scrollToEnd(true)
+        requestAnimationFrame(() => scrollToEnd(true))
+      }
+      // A foreground tab opened mid-strip is revealed by the active-tab effect below.
+    } else if (stickToEndRef.current && !pointerGestureActive) {
+      scrollToEnd(false)
+      requestAnimationFrame(() => scrollToEnd(false))
     }
     prevStripLenRef.current = { worktreeId, len: tabCount }
     updateTabStripOverflowState()
     requestAnimationFrame(updateTabStripOverflowState)
-  }, [layoutKey, tabCount, updateTabStripOverflowState, worktreeId])
+    recordScrollAnchor()
+  }, [layoutKey, recordScrollAnchor, tabCount, updateTabStripOverflowState, worktreeId])
 
   useLayoutEffect(() => {
     const strip = tabStripRef.current
     if (!strip || !activeVisibleTabId) {
+      recordScrollAnchor()
       return
     }
     const activeTab = strip.querySelector<HTMLElement>(
       `[data-tab-id="${CSS.escape(activeVisibleTabId)}"]`
     )
     if (!activeTab) {
+      recordScrollAnchor()
       return
     }
     if (isTabStripPointerGestureActive()) {
       // Why: active-tab preview changes during a tab press must not move the
       // strip under a stationary pointer before the release decides click/drag.
       requestAnimationFrame(updateTabStripOverflowState)
+      recordScrollAnchor()
       return
     }
     activeTab.scrollIntoView({ block: 'nearest', inline: 'nearest' })
     requestAnimationFrame(updateTabStripOverflowState)
-  }, [activeVisibleTabId, updateTabStripOverflowState])
+    recordScrollAnchor()
+  }, [activeVisibleTabId, recordScrollAnchor, updateTabStripOverflowState])
 
   return { tabStripRef, tabStripOverflowState, scrollTabStrip }
 }
diff --git a/src/renderer/src/components/tab-bar/tab-strip-scroll-anchor.ts b/src/renderer/src/components/tab-bar/tab-strip-scroll-anchor.ts
new file mode 100644
index 00000000000..b7f38ba281a
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/tab-strip-scroll-anchor.ts
@@ -0,0 +1,54 @@
+/** A tab's on-screen x inside the strip viewport, recorded before tabs are inserted around it. */
+export type TabStripScrollAnchor = {
+  tabId: string
+  offset: number
+}
+
+function tabElements(strip: HTMLElement): HTMLElement[] {
+  return Array.from(strip.querySelectorAll<HTMLElement>('[data-tab-id]'))
+}
+
+function findTab(strip: HTMLElement, tabId: string): HTMLElement | undefined {
+  return tabElements(strip).find((tab) => tab.dataset.tabId === tabId)
+}
+
+/** The active tab when it is on screen, else the first visible tab; null when nothing is visible. */
+export function captureTabStripScrollAnchor(
+  strip: HTMLElement,
+  activeTabId: string | null
+): TabStripScrollAnchor | null {
+  const stripRect = strip.getBoundingClientRect()
+  const isVisible = (tab: HTMLElement): boolean => {
+    const rect = tab.getBoundingClientRect()
+    return rect.width > 0 && rect.right > stripRect.left && rect.left < stripRect.right
+  }
+  const active = activeTabId ? findTab(strip, activeTabId) : undefined
+  const anchor =
+    active && isVisible(active) ? active : tabElements(strip).find((tab) => isVisible(tab))
+  const tabId = anchor?.dataset.tabId
+  if (!anchor || !tabId) {
+    return null
+  }
+  return { tabId, offset: anchor.getBoundingClientRect().left - stripRect.left }
+}
+
+/** Scroll so the anchor tab is back at its recorded x; false when that tab is gone. */
+export function restoreTabStripScrollAnchor(
+  strip: HTMLElement,
+  anchor: TabStripScrollAnchor
+): boolean {
+  const tab = findTab(strip, anchor.tabId)
+  if (!tab) {
+    return false
+  }
+  const drift =
+    tab.getBoundingClientRect().left - strip.getBoundingClientRect().left - anchor.offset
+  if (drift !== 0) {
+    strip.scrollLeft += drift
+  }
+  return true
+}
+
+export function isLastTabStripTab(strip: HTMLElement, tabId: string | null): boolean {
+  return tabId !== null && tabElements(strip).at(-1)?.dataset.tabId === tabId
+}
diff --git a/src/renderer/src/components/tab-bar/terminal-tab-activity-status.test.ts b/src/renderer/src/components/tab-bar/terminal-tab-activity-status.test.ts
index fc626b99132..129d290d571 100644
--- a/src/renderer/src/components/tab-bar/terminal-tab-activity-status.test.ts
+++ b/src/renderer/src/components/tab-bar/terminal-tab-activity-status.test.ts
@@ -163,6 +163,39 @@ describe('resolveTerminalTabActivityStatus', () => {
     ).toBe('interrupted')
   })
 
+  it('reports a failed done as failed, and not as a clean finish', () => {
+    const failed = entry(FIRST_LEAF_ID, 'done', {
+      mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: NOW }
+    })
+    const finished = entry(SECOND_LEAF_ID, 'done')
+    expect(
+      resolveTerminalTabActivityStatus({
+        tab: TAB,
+        agentStatusByPaneKey: { [failed.paneKey]: failed, [finished.paneKey]: finished },
+        ptyIdsByTabId: LIVE_PTY
+      })
+    ).toBe('failed')
+  })
+
+  it('reads a main agent that failed while its subagent works as failed; success or stop as working', () => {
+    const status = (outcome: 'failure' | 'success' | 'cancellation') => {
+      const held = entry(FIRST_LEAF_ID, 'working', {
+        mainAgent: { state: 'done', outcome, stateStartedAt: NOW }
+      })
+      return resolveTerminalTabActivityStatus({
+        tab: TAB,
+        agentStatusByPaneKey: { [held.paneKey]: held },
+        ptyIdsByTabId: LIVE_PTY
+      })
+    }
+    expect(status('failure')).toBe('failed')
+    expect(resolveTerminalTabAttentionBadge({ status: status('failure'), hasUnread: false })).toBe(
+      'failed'
+    )
+    expect(status('success')).toBe('working')
+    expect(status('cancellation')).toBe('working')
+  })
+
   it('does not let a finished sibling mask an interrupted outcome', () => {
     const interrupted = entry(FIRST_LEAF_ID, 'done', { interrupted: true })
     const finished = entry(SECOND_LEAF_ID, 'done')
diff --git a/src/renderer/src/components/tab-bar/terminal-tab-activity-status.ts b/src/renderer/src/components/tab-bar/terminal-tab-activity-status.ts
index 7a31cdb8ace..63cae98e2d9 100644
--- a/src/renderer/src/components/tab-bar/terminal-tab-activity-status.ts
+++ b/src/renderer/src/components/tab-bar/terminal-tab-activity-status.ts
@@ -9,6 +9,10 @@ import {
   type AgentStatusEntry
 } from '../../../../shared/agent-status-types'
 import { parseLegacyNumericPaneKey, parsePaneKey } from '../../../../shared/stable-pane-id'
+import {
+  applyAgentPaneActivityFlags,
+  type AgentPaneActivityFlags
+} from '@/lib/agent-pane-activity-flags'
 import type { TerminalLayoutSnapshot, TerminalTab } from '../../../../shared/terminal-tab-types'
 
 // Why: a terminal tab is a container of panes, exactly like a worktree card is
@@ -17,15 +21,8 @@ import type { TerminalLayoutSnapshot, TerminalTab } from '../../../../shared/ter
 // skip the card's retained-done promotion — see resolveTerminalTabActivityStatus).
 export type TerminalTabActivityStatus = WorktreeStatus
 
-// Per-tab live-hook flags, mirroring applyLiveAgentState in
-// worktree-agent-activity-summary.ts. blocked/waiting collapse to permission,
-// matching every other status surface in the app.
-type TerminalTabActivityFlags = {
-  hasPermission: boolean
-  hasLiveWorking: boolean
-  hasLiveMonitoring: boolean
-  hasInterrupted: boolean
-  hasLiveDone: boolean
+// Per-tab live-hook flags, folded by the same applyAgentPaneActivityFlags as the worktree card.
+type TerminalTabActivityFlags = AgentPaneActivityFlags & {
   paneIds: Set<string>
   /** Panes whose row went stale; suppress generated permission labels only. */
   stalePaneIds: Set<string>
@@ -84,20 +81,7 @@ function getTerminalTabActivityFlags(
 
     const flags = getOrCreateTerminalTabActivityFlags(flagsByTabId, identity.tabId)
     flags.paneIds.add(identity.paneId)
-    if (entry.state === 'blocked' || entry.state === 'waiting') {
-      flags.hasPermission = true
-    } else if (entry.state === 'working') {
-      if (entry.workingMode === 'monitoring') {
-        flags.hasLiveMonitoring = true
-      } else {
-        flags.hasLiveWorking = true
-      }
-    } else if (entry.interrupted === true) {
-      // Interrupted is encoded as done, so it must be checked first.
-      flags.hasInterrupted = true
-    } else if (entry.state === 'done') {
-      flags.hasLiveDone = true
-    }
+    applyAgentPaneActivityFlags(flags, entry)
   }
 
   flagsCache = { agentStatusByPaneKey, agentStatusEpoch, flagsByTabId }
@@ -114,6 +98,7 @@ function getOrCreateTerminalTabActivityFlags(
       hasPermission: false,
       hasLiveWorking: false,
       hasLiveMonitoring: false,
+      hasFailed: false,
       hasInterrupted: false,
       hasLiveDone: false,
       paneIds: new Set(),
@@ -178,6 +163,7 @@ export function resolveTerminalTabActivityStatus({
     hasPermission: flags?.hasPermission ?? false,
     hasLiveWorking: flags?.hasLiveWorking ?? false,
     hasLiveMonitoring: flags?.hasLiveMonitoring ?? false,
+    hasFailed: flags?.hasFailed ?? false,
     hasInterrupted: flags?.hasInterrupted ?? false,
     hasLiveDone: flags?.hasLiveDone ?? false,
     // Why: retained/orchestration promotions are worktree-aggregate concerns;
@@ -199,6 +185,7 @@ export type TerminalTabAttentionBadge =
   | 'working'
   | 'monitoring'
   | 'permission'
+  | 'failed'
   | 'interrupted'
   | 'unread'
   | 'done'
@@ -229,8 +216,8 @@ export function resolveTerminalTabAttentionBadge({
   if (status === 'done') {
     return 'done'
   }
-  if (status === 'interrupted') {
-    return 'interrupted'
+  if (status === 'failed' || status === 'interrupted') {
+    return status
   }
   return null
 }
@@ -238,11 +225,12 @@ export function resolveTerminalTabAttentionBadge({
 /** Map a container activity status onto AgentStateDot's vocabulary (no unread — that's a bell). */
 export function terminalTabActivityToAgentDotState(
   status: TerminalTabActivityStatus
-): 'working' | 'monitoring' | 'permission' | 'interrupted' | 'done' | null {
+): 'working' | 'monitoring' | 'permission' | 'failed' | 'interrupted' | 'done' | null {
   switch (status) {
     case 'working':
     case 'monitoring':
     case 'permission':
+    case 'failed':
     case 'interrupted':
     case 'done':
       return status
diff --git a/src/renderer/src/components/tab-group/RetainedPaneHost.test.tsx b/src/renderer/src/components/tab-group/RetainedPaneHost.test.tsx
index 964214e0d9f..ea71e0e8fd5 100644
--- a/src/renderer/src/components/tab-group/RetainedPaneHost.test.tsx
+++ b/src/renderer/src/components/tab-group/RetainedPaneHost.test.tsx
@@ -2,10 +2,13 @@
 import { act, cleanup, fireEvent, render } from '@testing-library/react'
 import { afterEach, beforeEach, expect, it, vi } from 'vitest'
 import { RetainedPaneHost } from './RetainedPaneHost'
+import { registerTabGroupBody } from './tab-group-body-geometry'
 
 const disconnect = vi.fn()
+const observerCreated = vi.fn()
 let notifyResize: () => void
 let anchors: HTMLDivElement[]
+let unregisterAnchors: (() => void)[]
 
 beforeEach(() => {
   vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
@@ -14,12 +17,15 @@ beforeEach(() => {
     class {
       constructor(callback: () => void) {
         notifyResize = callback
+        observerCreated()
       }
       observe(): void {}
+      unobserve(): void {}
       disconnect = disconnect
     }
   )
   disconnect.mockClear()
+  observerCreated.mockClear()
   anchors = ['left', 'right'].map((id, index) => {
     const anchor = document.createElement('div')
     anchor.dataset.tabGroupBodyId = id
@@ -27,11 +33,14 @@ beforeEach(() => {
     document.body.append(anchor)
     return anchor
   })
+  unregisterAnchors = ['left', 'right'].map((id, index) => registerTabGroupBody(id, anchors[index]))
 })
 
 afterEach(() => {
   cleanup()
+  unregisterAnchors.forEach((unregister) => unregister())
   anchors.forEach((anchor) => anchor.remove())
+  vi.restoreAllMocks()
   vi.unstubAllGlobals()
 })
 
@@ -105,3 +114,84 @@ it('allows hidden terminal startup measurement without exposing input or startin
   expect(timeout).not.toHaveBeenCalled()
   timeout.mockRestore()
 })
+
+function countResizeListeners(spy: ReturnType<typeof vi.spyOn>): number {
+  return spy.mock.calls.filter(([type]) => type === 'resize').length
+}
+
+it('measures a group once for all of its visible panes', () => {
+  const addListener = vi.spyOn(window, 'addEventListener')
+  const view = render(
+    <>
+      <RetainedPaneHost groupId="left" isVisible>
+        <span />
+      </RetainedPaneHost>
+      <RetainedPaneHost groupId="left" isVisible>
+        <span />
+      </RetainedPaneHost>
+      <RetainedPaneHost groupId="left" isVisible>
+        <span />
+      </RetainedPaneHost>
+    </>
+  )
+  expect(observerCreated).toHaveBeenCalledTimes(1)
+  expect(countResizeListeners(addListener)).toBe(1)
+
+  const measureBody = vi.fn(() => new DOMRect(0, 40, 300, 500))
+  anchors[0].getBoundingClientRect = measureBody
+  act(() => notifyResize())
+  expect(measureBody).toHaveBeenCalledTimes(1)
+  const hosts = Array.from(
+    view.container.querySelectorAll<HTMLElement>('[data-retained-pane-host]')
+  )
+  expect(hosts.map((host) => host.style.width)).toEqual(['300px', '300px', '300px'])
+
+  const removeListener = vi.spyOn(window, 'removeEventListener')
+  view.unmount()
+  expect(disconnect).toHaveBeenCalledTimes(1)
+  expect(countResizeListeners(removeListener)).toBe(1)
+})
+
+it('does not measure a hidden pane until it becomes visible', () => {
+  const addListener = vi.spyOn(window, 'addEventListener')
+  const view = render(
+    <RetainedPaneHost groupId="left" isVisible={false}>
+      <span />
+    </RetainedPaneHost>
+  )
+  const host = view.container.firstElementChild as HTMLDivElement
+  expect(observerCreated).not.toHaveBeenCalled()
+  expect(countResizeListeners(addListener)).toBe(0)
+  expect(host.style.display).toBe('none')
+
+  anchors[0].getBoundingClientRect = () => new DOMRect(0, 48, 320, 400)
+  view.rerender(
+    <RetainedPaneHost groupId="left" isVisible>
+      <span />
+    </RetainedPaneHost>
+  )
+  expect(observerCreated).toHaveBeenCalledTimes(1)
+  expect(host.style.top).toBe('48px')
+  expect(host.style.width).toBe('320px')
+
+  view.rerender(
+    <RetainedPaneHost groupId="left" isVisible={false}>
+      <span />
+    </RetainedPaneHost>
+  )
+  expect(disconnect).toHaveBeenCalledTimes(1)
+})
+
+it('keeps measuring a hidden pane that asks to measure while hidden', () => {
+  const view = render(
+    <RetainedPaneHost groupId="left" isVisible={false} measureWhileHidden>
+      <span />
+    </RetainedPaneHost>
+  )
+  const host = view.container.firstElementChild as HTMLDivElement
+  expect(observerCreated).toHaveBeenCalledTimes(1)
+  expect(host.style.width).toBe('400px')
+  anchors[0].getBoundingClientRect = () => new DOMRect(0, 32, 360, 568)
+  act(() => notifyResize())
+  expect(host.style.width).toBe('360px')
+})
diff --git a/src/renderer/src/components/tab-group/RetainedPaneHost.tsx b/src/renderer/src/components/tab-group/RetainedPaneHost.tsx
index 6007f2b1c20..c9ec5d3a826 100644
--- a/src/renderer/src/components/tab-group/RetainedPaneHost.tsx
+++ b/src/renderer/src/components/tab-group/RetainedPaneHost.tsx
@@ -1,6 +1,7 @@
 import { useCallback, useLayoutEffect, useMemo, useRef, useState } from 'react'
 import { SYNC_FIT_PANES_EVENT } from '@/constants/terminal'
 import { tabGroupBodyAnchorName } from './tab-group-body-anchor'
+import { subscribeTabGroupBodyRect, type TabGroupBodyRect } from './tab-group-body-geometry'
 
 const HAS_CSS_ANCHOR_POSITIONING =
   typeof CSS !== 'undefined' &&
@@ -9,7 +10,6 @@ const HAS_CSS_ANCHOR_POSITIONING =
   CSS.supports('width', 'anchor-size(--orca-terminal-overlay-probe width)')
 const MIN_OVERLAY_FIT_WIDTH_PX = 48
 const MIN_OVERLAY_FIT_HEIGHT_PX = 24
-const FALLBACK_RECT_MIN_CHANGE_PX = 1
 
 function shouldUseCssAnchorPositioning(): boolean {
   return (
@@ -18,13 +18,6 @@ function shouldUseCssAnchorPositioning(): boolean {
   )
 }
 
-type MeasuredFallbackRect = {
-  top: number
-  left: number
-  width: number
-  height: number
-}
-
 type RetainedPaneHostProps = {
   groupId: string | undefined
   isVisible: boolean
@@ -47,67 +40,17 @@ export function RetainedPaneHost({
 }: RetainedPaneHostProps): React.JSX.Element {
   const anchorName = groupId !== undefined ? tabGroupBodyAnchorName(groupId) : undefined
   const overlayRef = useRef<HTMLDivElement | null>(null)
-  const [measuredFallbackRect, setMeasuredFallbackRect] = useState<MeasuredFallbackRect | null>(
-    null
-  )
+  const [measuredFallbackRect, setMeasuredFallbackRect] = useState<TabGroupBodyRect | null>(null)
+  // Why: a hidden host renders display:none, so it has no use for group geometry until shown.
+  const measuresFallbackRect =
+    groupId !== undefined && !shouldUseCssAnchorPositioning() && (isVisible || measureWhileHidden)
   useLayoutEffect(() => {
-    if (!anchorName || shouldUseCssAnchorPositioning() || !groupId) {
+    const container = overlayRef.current?.parentElement
+    if (!measuresFallbackRect || groupId === undefined || !container) {
       return
     }
-
-    const findBody = (): HTMLElement | null => {
-      for (const candidate of document.querySelectorAll<HTMLElement>('[data-tab-group-body-id]')) {
-        if (candidate.dataset.tabGroupBodyId === groupId) {
-          return candidate
-        }
-      }
-      return null
-    }
-
-    const updateRect = (): void => {
-      const overlay = overlayRef.current
-      const parent = overlay?.parentElement
-      const body = findBody()
-      if (!parent || !body) {
-        setMeasuredFallbackRect(null)
-        return
-      }
-      const parentRect = parent.getBoundingClientRect()
-      const bodyRect = body.getBoundingClientRect()
-      const next: MeasuredFallbackRect = {
-        top: bodyRect.top - parentRect.top,
-        left: bodyRect.left - parentRect.left,
-        width: bodyRect.width,
-        height: bodyRect.height
-      }
-      // Why: ResizeObserver and xterm fit can otherwise amplify sub-pixel jitter forever.
-      setMeasuredFallbackRect((prev) =>
-        prev &&
-        Math.abs(prev.top - next.top) < FALLBACK_RECT_MIN_CHANGE_PX &&
-        Math.abs(prev.left - next.left) < FALLBACK_RECT_MIN_CHANGE_PX &&
-        Math.abs(prev.width - next.width) < FALLBACK_RECT_MIN_CHANGE_PX &&
-        Math.abs(prev.height - next.height) < FALLBACK_RECT_MIN_CHANGE_PX
-          ? prev
-          : next
-      )
-    }
-
-    updateRect()
-    const body = findBody()
-    const parent = overlayRef.current?.parentElement
-    const resizeObserver = new ResizeObserver(updateRect)
-    if (body) {
-      resizeObserver.observe(body)
-    }
-    if (parent) {
-      resizeObserver.observe(parent)
-    }
-    window.addEventListener('resize', updateRect)
-    return () => {
-      resizeObserver.disconnect()
-      window.removeEventListener('resize', updateRect)
-    }
-  }, [anchorName, groupId, isVisible])
+    return subscribeTabGroupBodyRect(groupId, container, setMeasuredFallbackRect)
+  }, [groupId, measuresFallbackRect])
 
   useLayoutEffect(() => {
     if (!fitTerminal || !isVisible || !anchorName) {
diff --git a/src/renderer/src/components/tab-group/TabGroupPanel.tsx b/src/renderer/src/components/tab-group/TabGroupPanel.tsx
index 6e48ddd0ec0..f6ad4b04d89 100644
--- a/src/renderer/src/components/tab-group/TabGroupPanel.tsx
+++ b/src/renderer/src/components/tab-group/TabGroupPanel.tsx
@@ -1,4 +1,4 @@
-import { Suspense, useMemo } from 'react'
+import { Suspense, useCallback, useMemo } from 'react'
 import { lazyWithRetry as lazy } from '@/lib/lazy-with-retry'
 import { useDroppable } from '@dnd-kit/core'
 import { Ellipsis, X } from 'lucide-react'
@@ -18,6 +18,7 @@ import { closeTerminalTab } from '../terminal/terminal-tab-actions'
 import { resolveGroupTabFromVisibleId } from './tab-group-visible-id'
 import { getTabPaneBodyDroppableId, type HoveredTabInsertion } from './useTabDragSplit'
 import { tabGroupBodyAnchorName } from './tab-group-body-anchor'
+import { registerTabGroupBody } from './tab-group-body-geometry'
 import { translate } from '@/i18n/i18n'
 import type { TabGroup } from '../../../../shared/tab-types'
 import type { ClientHostedBrowserRow } from '../../../../shared/client-hosted-browser-rows'
@@ -93,6 +94,20 @@ export default function TabGroupPanel({
     },
     disabled: !isTabDragActive
   })
+  const setBodyRef = useCallback(
+    (node: HTMLDivElement | null) => {
+      setBodyDropRef(node)
+      if (!node) {
+        return undefined
+      }
+      const unregisterBody = registerTabGroupBody(groupId, node)
+      return () => {
+        unregisterBody()
+        setBodyDropRef(null)
+      }
+    },
+    [groupId, setBodyDropRef]
+  )
   // Why: per-group anchor-name lets the worktree-level overlay position panes via CSS anchor positioning, so moving a tab between groups re-targets the anchor instead of remounting xterm (loses alt-screen TUI state) or reloading `<webview>`.
   const bodyAnchorName = tabGroupBodyAnchorName(groupId)
   // Why: memoize so a fresh style object each render doesn't break downstream memoization keyed on referential equality.
@@ -334,7 +349,7 @@ export default function TabGroupPanel({
       </div>
 
       <div
-        ref={setBodyDropRef}
+        ref={setBodyRef}
         data-tab-group-body-id={groupId}
         data-worktree-id={worktreeId}
         className="relative flex-1 min-h-0 overflow-hidden"
diff --git a/src/renderer/src/components/tab-group/tab-group-body-geometry.test.ts b/src/renderer/src/components/tab-group/tab-group-body-geometry.test.ts
new file mode 100644
index 00000000000..07458d30bee
--- /dev/null
+++ b/src/renderer/src/components/tab-group/tab-group-body-geometry.test.ts
@@ -0,0 +1,141 @@
+// @vitest-environment happy-dom
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { registerTabGroupBody, subscribeTabGroupBodyRect } from './tab-group-body-geometry'
+
+type FakeObserver = {
+  callback: () => void
+  observed: Set<Element>
+  disconnected: boolean
+}
+
+let observers: FakeObserver[]
+let cleanups: (() => void)[]
+
+function element(rect: DOMRect): HTMLDivElement {
+  const node = document.createElement('div')
+  node.getBoundingClientRect = () => rect
+  return node
+}
+
+function track(cleanup: () => void): () => void {
+  cleanups.push(cleanup)
+  return cleanup
+}
+
+function resizeListenerDelta(
+  add: ReturnType<typeof vi.spyOn>,
+  remove: ReturnType<typeof vi.spyOn>
+) {
+  const count = (spy: ReturnType<typeof vi.spyOn>): number =>
+    spy.mock.calls.filter(([type]) => type === 'resize').length
+  return count(add) - count(remove)
+}
+
+beforeEach(() => {
+  observers = []
+  cleanups = []
+  vi.stubGlobal(
+    'ResizeObserver',
+    class {
+      private readonly record: FakeObserver
+      constructor(callback: () => void) {
+        this.record = { callback, observed: new Set(), disconnected: false }
+        observers.push(this.record)
+      }
+      observe(target: Element): void {
+        this.record.observed.add(target)
+      }
+      unobserve(target: Element): void {
+        this.record.observed.delete(target)
+      }
+      disconnect(): void {
+        this.record.disconnected = true
+        this.record.observed.clear()
+      }
+    }
+  )
+})
+
+afterEach(() => {
+  cleanups.forEach((cleanup) => cleanup())
+  vi.restoreAllMocks()
+  vi.unstubAllGlobals()
+})
+
+describe('subscribeTabGroupBodyRect', () => {
+  it('shares one observer per group and one window listener across groups', () => {
+    const add = vi.spyOn(window, 'addEventListener')
+    const remove = vi.spyOn(window, 'removeEventListener')
+    const container = element(new DOMRect(0, 10, 800, 600))
+    track(registerTabGroupBody('a', element(new DOMRect(0, 42, 400, 568))))
+    track(registerTabGroupBody('b', element(new DOMRect(400, 42, 400, 568))))
+
+    const first = vi.fn()
+    const second = vi.fn()
+    const other = vi.fn()
+    const unsubscribeFirst = subscribeTabGroupBodyRect('a', container, first)
+    const unsubscribeSecond = subscribeTabGroupBodyRect('a', container, second)
+    const unsubscribeOther = subscribeTabGroupBodyRect('b', container, other)
+
+    expect(observers).toHaveLength(2)
+    expect(resizeListenerDelta(add, remove)).toBe(1)
+    expect(first).toHaveBeenLastCalledWith({ top: 32, left: 0, width: 400, height: 568 })
+    expect(second.mock.lastCall?.[0]).toBe(first.mock.lastCall?.[0])
+    expect(other).toHaveBeenLastCalledWith({ top: 32, left: 400, width: 400, height: 568 })
+
+    unsubscribeFirst()
+    expect(observers[0].disconnected).toBe(false)
+    unsubscribeSecond()
+    expect(observers[0].disconnected).toBe(true)
+    expect(resizeListenerDelta(add, remove)).toBe(1)
+    unsubscribeOther()
+    expect(observers[1].disconnected).toBe(true)
+    expect(resizeListenerDelta(add, remove)).toBe(0)
+  })
+
+  it('notifies only on changes larger than a pixel', () => {
+    const container = element(new DOMRect(0, 0, 800, 600))
+    let bodyRect = new DOMRect(0, 32, 400, 568)
+    const body = element(bodyRect)
+    body.getBoundingClientRect = () => bodyRect
+    track(registerTabGroupBody('a', body))
+    const listener = vi.fn()
+    track(subscribeTabGroupBodyRect('a', container, listener))
+    listener.mockClear()
+
+    bodyRect = new DOMRect(0, 32.5, 400.5, 568)
+    window.dispatchEvent(new Event('resize'))
+    expect(listener).not.toHaveBeenCalled()
+
+    bodyRect = new DOMRect(0, 32, 380, 568)
+    observers[0].callback()
+    expect(listener).toHaveBeenCalledTimes(1)
+    expect(listener).toHaveBeenLastCalledWith({ top: 32, left: 0, width: 380, height: 568 })
+  })
+
+  it('follows the group body as it mounts, is replaced, and unmounts', () => {
+    const container = element(new DOMRect(0, 0, 800, 600))
+    const listener = vi.fn()
+    track(subscribeTabGroupBodyRect('a', container, listener))
+    expect(listener).toHaveBeenLastCalledWith(null)
+
+    const firstBody = element(new DOMRect(0, 32, 400, 568))
+    const unregisterFirst = registerTabGroupBody('a', firstBody)
+    expect(observers[0].observed.has(firstBody)).toBe(true)
+    expect(listener).toHaveBeenLastCalledWith({ top: 32, left: 0, width: 400, height: 568 })
+
+    const secondBody = element(new DOMRect(0, 32, 600, 568))
+    const unregisterSecond = track(registerTabGroupBody('a', secondBody))
+    expect(observers[0].observed.has(firstBody)).toBe(false)
+    expect(observers[0].observed.has(secondBody)).toBe(true)
+    expect(listener).toHaveBeenLastCalledWith({ top: 32, left: 0, width: 600, height: 568 })
+
+    // A late unregister from the replaced panel must not drop the live body.
+    unregisterFirst()
+    expect(observers[0].observed.has(secondBody)).toBe(true)
+
+    unregisterSecond()
+    expect(observers[0].observed.has(secondBody)).toBe(false)
+    expect(listener).toHaveBeenLastCalledWith(null)
+  })
+})
diff --git a/src/renderer/src/components/tab-group/tab-group-body-geometry.ts b/src/renderer/src/components/tab-group/tab-group-body-geometry.ts
new file mode 100644
index 00000000000..28712fb0716
--- /dev/null
+++ b/src/renderer/src/components/tab-group/tab-group-body-geometry.ts
@@ -0,0 +1,171 @@
+// Why: every retained pane in a group sits over the same tab-group body, so the
+// non-anchor fallback (web client) measures that body once per group instead of
+// once per pane, and only while some pane in the group can display.
+
+export type TabGroupBodyRect = {
+  top: number
+  left: number
+  width: number
+  height: number
+}
+
+type TabGroupBodyRectListener = (rect: TabGroupBodyRect | null) => void
+
+type GroupBodyGeometrySource = {
+  groupId: string
+  // The positioned element the pane hosts are laid out in; rects are relative to it.
+  container: HTMLElement
+  listeners: Set<TabGroupBodyRectListener>
+  observer: ResizeObserver
+  observedBody: HTMLElement | null
+  rect: TabGroupBodyRect | null
+}
+
+const RECT_MIN_CHANGE_PX = 1
+
+const bodiesByGroupId = new Map<string, HTMLElement>()
+const sourcesByGroupId = new Map<string, Set<GroupBodyGeometrySource>>()
+
+function isSameRect(prev: TabGroupBodyRect | null, next: TabGroupBodyRect | null): boolean {
+  if (!prev || !next) {
+    return prev === next
+  }
+  // Why: ResizeObserver and xterm fit can otherwise amplify sub-pixel jitter forever.
+  return (
+    Math.abs(prev.top - next.top) < RECT_MIN_CHANGE_PX &&
+    Math.abs(prev.left - next.left) < RECT_MIN_CHANGE_PX &&
+    Math.abs(prev.width - next.width) < RECT_MIN_CHANGE_PX &&
+    Math.abs(prev.height - next.height) < RECT_MIN_CHANGE_PX
+  )
+}
+
+function measureSource(source: GroupBodyGeometrySource): void {
+  const body = source.observedBody
+  let next: TabGroupBodyRect | null = null
+  if (body) {
+    const containerRect = source.container.getBoundingClientRect()
+    const bodyRect = body.getBoundingClientRect()
+    next = {
+      top: bodyRect.top - containerRect.top,
+      left: bodyRect.left - containerRect.left,
+      width: bodyRect.width,
+      height: bodyRect.height
+    }
+  }
+  if (isSameRect(source.rect, next)) {
+    return
+  }
+  source.rect = next
+  for (const listener of source.listeners) {
+    listener(next)
+  }
+}
+
+function measureAllSources(): void {
+  for (const sources of sourcesByGroupId.values()) {
+    for (const source of sources) {
+      measureSource(source)
+    }
+  }
+}
+
+function syncObservedBody(source: GroupBodyGeometrySource): void {
+  const body = bodiesByGroupId.get(source.groupId) ?? null
+  if (body === source.observedBody) {
+    return
+  }
+  if (source.observedBody) {
+    source.observer.unobserve(source.observedBody)
+  }
+  if (body) {
+    source.observer.observe(body)
+  }
+  source.observedBody = body
+}
+
+function onGroupBodyChanged(groupId: string): void {
+  for (const source of sourcesByGroupId.get(groupId) ?? []) {
+    syncObservedBody(source)
+    measureSource(source)
+  }
+}
+
+/** Registers the element that is the body of `groupId`; returns the unregister function. */
+export function registerTabGroupBody(groupId: string, body: HTMLElement): () => void {
+  bodiesByGroupId.set(groupId, body)
+  onGroupBodyChanged(groupId)
+  return () => {
+    // A remounted panel may already have registered its replacement body.
+    if (bodiesByGroupId.get(groupId) !== body) {
+      return
+    }
+    bodiesByGroupId.delete(groupId)
+    onGroupBodyChanged(groupId)
+  }
+}
+
+function acquireSource(groupId: string, container: HTMLElement): GroupBodyGeometrySource {
+  let sources = sourcesByGroupId.get(groupId)
+  for (const existing of sources ?? []) {
+    if (existing.container === container) {
+      return existing
+    }
+  }
+  const source: GroupBodyGeometrySource = {
+    groupId,
+    container,
+    listeners: new Set(),
+    observer: new ResizeObserver(() => measureSource(source)),
+    observedBody: null,
+    rect: null
+  }
+  source.observer.observe(container)
+  syncObservedBody(source)
+  if (sourcesByGroupId.size === 0) {
+    window.addEventListener('resize', measureAllSources)
+  }
+  if (!sources) {
+    sources = new Set()
+    sourcesByGroupId.set(groupId, sources)
+  }
+  sources.add(source)
+  return source
+}
+
+function releaseSource(source: GroupBodyGeometrySource): void {
+  source.observer.disconnect()
+  const sources = sourcesByGroupId.get(source.groupId)
+  sources?.delete(source)
+  if (sources?.size === 0) {
+    sourcesByGroupId.delete(source.groupId)
+  }
+  if (sourcesByGroupId.size === 0) {
+    window.removeEventListener('resize', measureAllSources)
+  }
+}
+
+/**
+ * Subscribes to the rect of `groupId`'s body relative to `container`. The
+ * listener is called synchronously with the current rect, then on each change.
+ */
+export function subscribeTabGroupBodyRect(
+  groupId: string,
+  container: HTMLElement,
+  listener: TabGroupBodyRectListener
+): () => void {
+  const source = acquireSource(groupId, container)
+  // Why: observers miss moves without a resize, so a pane that becomes visible re-reads once.
+  measureSource(source)
+  listener(source.rect)
+  // A per-subscription entry keeps unsubscribe idempotent even if one listener subscribes twice.
+  const entry: TabGroupBodyRectListener = (rect) => listener(rect)
+  source.listeners.add(entry)
+  return () => {
+    if (!source.listeners.delete(entry)) {
+      return
+    }
+    if (source.listeners.size === 0) {
+      releaseSource(source)
+    }
+  }
+}
diff --git a/src/renderer/src/components/tab-group/useTabGroupCreationCommands.ts b/src/renderer/src/components/tab-group/useTabGroupCreationCommands.ts
index d0fae789882..609a0e6579c 100644
--- a/src/renderer/src/components/tab-group/useTabGroupCreationCommands.ts
+++ b/src/renderer/src/components/tab-group/useTabGroupCreationCommands.ts
@@ -99,7 +99,7 @@ export function useTabGroupCreationCommands({
     openEntry: async (args: TabCreateEntryArgs) => {
       await openTabBarEntry(args)
     },
-    duplicateBrowserTab: (browserTabId: string) => {
+    duplicateBrowserTab: (browserTabId: string, sourceUnifiedTabId: string) => {
       void (async () => {
         const state = useAppStore.getState()
         const tabs = state.browserTabsByWorktree[worktreeId] ?? []
@@ -123,17 +123,19 @@ export function useTabGroupCreationCommands({
             environmentId: runtimeEnvironmentId,
             url: source.url,
             profileId: source.sessionProfileId,
-            targetGroupId: groupId
+            targetGroupId: groupId,
+            clientAfterTabId: sourceUnifiedTabId
           })
           if (created) {
             return
           }
           throw new Error('The paired runtime could not duplicate the managed browser tab.')
         }
+        // Why no targetGroupId: a source-following duplicate joins the source's live group.
         createBrowserTab(worktreeId, source.url, {
           ...buildDuplicatedBrowserTabOptions(source),
           ...(runtimeEnvironmentId ? { browserRuntimeEnvironmentId: null } : {}),
-          targetGroupId: groupId
+          afterTabId: sourceUnifiedTabId
         })
       })().catch((error) => {
         toast.error(error instanceof Error ? error.message : String(error))
diff --git a/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.focus.test.ts b/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.focus.test.ts
index 290fb5c5984..b438f5ecee8 100644
--- a/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.focus.test.ts
+++ b/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.focus.test.ts
@@ -659,13 +659,13 @@ describe('useTabGroupWorkspaceModel terminal activation focus', () => {
     const { useTabGroupWorkspaceModel } = await import('./useTabGroupWorkspaceModel')
     const model = useTabGroupWorkspaceModel({ groupId: 'group-1', worktreeId: 'wt-1' })
 
-    model.commands.duplicateBrowserTab('browser-workspace-1')
+    model.commands.duplicateBrowserTab('browser-workspace-1', 'browser-unified-1')
 
     expect(mocks.createBrowserTab).toHaveBeenCalledWith('wt-1', 'https://example.com', {
       title: 'Example',
       sessionProfileId: 'profile-1',
       sessionPartition: 'persist:orca-browser-session-profile-1',
-      targetGroupId: 'group-1'
+      afterTabId: 'browser-unified-1'
     })
   })
 
diff --git a/src/renderer/src/components/task-drawer-source-boundary.test.ts b/src/renderer/src/components/task-drawer-source-boundary.test.ts
deleted file mode 100644
index 1a2f64504e7..00000000000
--- a/src/renderer/src/components/task-drawer-source-boundary.test.ts
+++ /dev/null
@@ -1,108 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-const COMPONENT_ROOT = __dirname
-
-function componentSource(relativePath: string): string {
-  return readFileSync(join(COMPONENT_ROOT, relativePath), 'utf8').replace(/\r\n?/g, '\n')
-}
-
-function sourceBetween(source: string, startPattern: string, endPattern: string): string {
-  const start = source.indexOf(startPattern)
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = source.indexOf(endPattern, start + startPattern.length)
-  expect(end).toBeGreaterThan(start)
-  return source.slice(start, end)
-}
-
-describe('task drawer source boundaries', () => {
-  it('threads GitHub task source context through detail mutations', () => {
-    const source = [
-      componentSource('github-item-dialog/edit-item-fields/gh-edit-section.tsx'),
-      componentSource('github-item-dialog/edit-item-fields/gh-edit-section-mutations.ts')
-    ].join('\n')
-    const issueUpdate = sourceBetween(
-      componentSource('github/github-work-item-edit-mutations.ts'),
-      'async function runIssueUpdate',
-      'async function runWorkItemBodyUpdate'
-    )
-    const commentUpdate = sourceBetween(
-      componentSource('github/github-work-item-comment-mutations.ts'),
-      'function addIssueCommentForRepo',
-      'function addPRReviewCommentForRepo'
-    )
-    const editSection = source
-
-    expect(issueUpdate).toContain('sourceContext: args.sourceContext')
-    expect(commentUpdate).toContain('sourceContext: args.sourceContext')
-    expect(editSection).toContain('sourceContext,')
-    expect(editSection).toContain(
-      'patchWorkItem(itemId, { state: newState }, itemRepoId, { sourceContext })'
-    )
-    expect(editSection).toContain(
-      'patchWorkItem(itemId, { labels: newLabels }, itemRepoId, { sourceContext })'
-    )
-  })
-
-  it('threads GitLab task source context through the shared drawer selector', () => {
-    const controllerSource = componentSource('GitLabItemDialog.tsx')
-    const source = [
-      controllerSource,
-      componentSource('gitlab-item-dialog/use-gitlab-item-dialog-effects.ts'),
-      componentSource('gitlab-item-dialog/use-gitlab-details-editing.ts'),
-      componentSource('gitlab-item-dialog/use-gitlab-primary-actions.ts'),
-      componentSource('gitlab-item-dialog/use-gitlab-review-actions.ts')
-    ].join('\n')
-    const selector = sourceBetween(
-      controllerSource,
-      'const repoSelector = useMemo',
-      'const updateCommentDraft'
-    )
-
-    expect(selector).toContain('...(repoId ? { repoId } : {})')
-    expect(selector).toContain('...(sourceContext ? { sourceContext } : {})')
-    expect(selector).toContain('}, [repoId, repoPath, sourceContext])')
-    expect(source).toContain('workItemDetails({ ...repoSelector')
-    expect(source).toContain('updateMR({ ...repoSelector')
-    expect(source).toContain('addMRComment({')
-    expect(source).toContain('addIssueComment({')
-    expect(source).toContain('...repoSelector')
-  })
-
-  it('uses Linear task source context for drawer reads, mutations, and optimistic patches', () => {
-    const drawerSource = componentSource('LinearItemDrawer.tsx')
-    const editSection = componentSource('linear-item-drawer-edit-controller.tsx')
-    const drawer = sourceBetween(
-      drawerSource,
-      'export default function LinearItemDrawer',
-      'return renderLinearItemDrawerSheet'
-    )
-
-    expect(editSection).toContain('const providerSettings = sourceContext ?? settings')
-    expect(editSection).toContain('linearUpdateIssue(providerSettings')
-    expect(editSection).toContain(
-      'patchLinearIssue(issue.id, { state: stateValue }, { sourceContext })'
-    )
-    expect(editSection).toContain(
-      'patchLinearIssue(issue.id, { assignee: newAssignee }, { sourceContext })'
-    )
-    expect(drawer).toContain('const providerSettings = sourceContext ?? settings')
-    expect(drawer).toContain('linearGetIssue(providerSettings')
-    expect(drawer).toContain('linearIssueComments(providerSettings')
-  })
-
-  it('uses Jira task source context for drawer reads, mutations, and optimistic patches', () => {
-    const source = componentSource('JiraIssueWorkspace.tsx')
-    const drawer = sourceBetween(source, 'export default function JiraIssueWorkspace', 'return (')
-
-    expect(drawer).toContain('const providerSettings = sourceContext ?? settings')
-    expect(drawer).toContain('jiraIssueComments(providerSettings')
-    expect(drawer).toContain('jiraGetIssue(providerSettings')
-    expect(drawer).toContain('jiraListTransitions(providerSettings')
-    expect(drawer).toContain('jiraUpdateIssue(providerSettings')
-    expect(drawer).toContain('jiraAddIssueComment(')
-    expect(drawer).toContain('patchJiraIssue(displayed.key, optimistic, { sourceContext })')
-    expect(drawer).toContain('patchJiraIssue(previous.key, previous, { sourceContext })')
-  })
-})
diff --git a/src/renderer/src/components/task-page-default-repo-selection.test.ts b/src/renderer/src/components/task-page-default-repo-selection.test.ts
index d87ceeec5ba..e62121d0ff4 100644
--- a/src/renderer/src/components/task-page-default-repo-selection.test.ts
+++ b/src/renderer/src/components/task-page-default-repo-selection.test.ts
@@ -4,7 +4,6 @@ import {
   getDefaultTaskRepoSelection,
   getTaskEligibleRepos,
   getTaskProjectPickerGroups,
-  getTaskProjectPickerRepos,
   normalizeTaskRepoSelection
 } from './task-page-default-repo-selection'
 
@@ -205,75 +204,6 @@ describe('getDefaultTaskRepoSelection', () => {
   })
 })
 
-describe('getTaskProjectPickerRepos', () => {
-  it('shows one picker row per logical GitHub project', () => {
-    const pickerRepos = getTaskProjectPickerRepos([
-      repo({
-        id: 'local-orca',
-        upstream: { owner: 'StablyAI', repo: 'Orca' }
-      }),
-      repo({
-        id: 'ssh-orca',
-        connectionId: 'builder',
-        upstream: { owner: 'stablyai', repo: 'orca' }
-      }),
-      repo({
-        id: 'other',
-        upstream: { owner: 'stablyai', repo: 'other' }
-      })
-    ])
-
-    expect(pickerRepos.map((candidate) => candidate.id)).toEqual(['local-orca', 'other'])
-  })
-
-  it('uses an explicitly selected remote source as the visible project row', () => {
-    const pickerRepos = getTaskProjectPickerRepos(
-      [
-        repo({
-          id: 'local-orca',
-          upstream: { owner: 'stablyai', repo: 'orca' }
-        }),
-        repo({
-          id: 'ssh-orca',
-          connectionId: 'builder',
-          upstream: { owner: 'stablyai', repo: 'orca' }
-        })
-      ],
-      new Set(['ssh-orca'])
-    )
-
-    expect(pickerRepos.map((candidate) => candidate.id)).toEqual(['ssh-orca'])
-  })
-
-  it('collapses legacy local and SSH rows that share a GitHub repo icon identity', () => {
-    const pickerRepos = getTaskProjectPickerRepos([
-      repo({
-        id: 'local-claude-swap',
-        displayName: 'claude-swap',
-        repoIcon: {
-          type: 'image',
-          src: 'https://github.com/stablyai.png?size=64',
-          source: 'github',
-          label: 'stablyai/claude-swap'
-        }
-      }),
-      repo({
-        id: 'ssh-claude-swap',
-        displayName: 'claude-swap',
-        connectionId: 'builder',
-        repoIcon: {
-          type: 'image',
-          src: 'https://github.com/stablyai.png?size=64',
-          source: 'github',
-          label: 'StablyAI/claude-swap'
-        }
-      })
-    ])
-
-    expect(pickerRepos.map((candidate) => candidate.id)).toEqual(['local-claude-swap'])
-  })
-})
-
 describe('getTaskProjectPickerGroups', () => {
   it('keeps all host sources under one logical project row', () => {
     const groups = getTaskProjectPickerGroups([
diff --git a/src/renderer/src/components/task-page-default-repo-selection.ts b/src/renderer/src/components/task-page-default-repo-selection.ts
index e5c41c08b18..96af4192883 100644
--- a/src/renderer/src/components/task-page-default-repo-selection.ts
+++ b/src/renderer/src/components/task-page-default-repo-selection.ts
@@ -36,13 +36,6 @@ export function getDefaultTaskRepoSelection(repos: readonly Repo[]): Set<string>
   return new Set([...selectedByProject.values()].map((repo) => repo.id))
 }
 
-export function getTaskProjectPickerRepos(
-  repos: readonly Repo[],
-  preferredSelection: ReadonlySet<string> = new Set()
-): Repo[] {
-  return getTaskProjectPickerGroups(repos, preferredSelection).map((group) => group.repo)
-}
-
 export function getTaskProjectPickerGroups(
   repos: readonly Repo[],
   preferredSelection: ReadonlySet<string> = new Set()
diff --git a/src/renderer/src/components/task-page-github-issue-creation.test.ts b/src/renderer/src/components/task-page-github-issue-creation.test.ts
deleted file mode 100644
index bacc3988bb8..00000000000
--- a/src/renderer/src/components/task-page-github-issue-creation.test.ts
+++ /dev/null
@@ -1,53 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { readTaskPageSource } from './task-page-source-family.test-support'
-import { readFileSync } from 'node:fs'
-
-const taskPageSource = readTaskPageSource('use-task-page-github-issue-creation.ts')
-const newIssueDraftSource = readFileSync(
-  new URL('./use-task-page-github-issue-draft.ts', import.meta.url),
-  'utf8'
-)
-const newIssueRepoResetSource = readFileSync(
-  new URL('./task-page-new-issue-draft.ts', import.meta.url),
-  'utf8'
-)
-
-function issueCreationSection(): string {
-  const start = taskPageSource.indexOf('const handleCreateNewIssue')
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = taskPageSource.indexOf('const nextModel', start)
-  expect(end).toBeGreaterThan(start)
-  return taskPageSource.slice(start, end)
-}
-
-describe('TaskPage GitHub issue creation', () => {
-  it('keeps issue creation targeted to the first selected repo on a fresh mount', () => {
-    expect(newIssueDraftSource).toContain(
-      'selectedRepos.find((r) => r.id === newIssueRepoId) ?? selectedRepos[0] ?? null'
-    )
-    // Why: a repo leaving the selection mid-draft must reset to the first selected repo.
-    expect(newIssueRepoResetSource).toContain('newIssueRepoId === null')
-    expect(newIssueRepoResetSource).toContain('return { repoId: selectedRepoIds[0] ?? null }')
-  })
-
-  it('covers the complete remote oversized-body recovery timeout envelope', () => {
-    const section = issueCreationSection()
-
-    expect(section).toContain("'github.createIssue'")
-    expect(section).toMatch(/\{\s*timeoutMs: 65_000\s*\}/)
-  })
-
-  it('treats a body-save warning as created while preserving the recovery draft', () => {
-    const section = issueCreationSection()
-    const warningBranch = section.slice(
-      section.indexOf('if (result.bodySaveWarning)'),
-      section.indexOf('// Why: bump the nonce')
-    )
-
-    expect(warningBranch).toContain('toast.warning')
-    expect(warningBranch).toContain('description: result.bodySaveWarning')
-    expect(warningBranch).toMatch(/setNewIssueDraft\(\{\s*title: ''\s*\}\)/)
-    expect(warningBranch).toContain('} else {')
-    expect(warningBranch).toContain('clearNewIssueDraft()')
-  })
-})
diff --git a/src/renderer/src/components/task-page-linear-team-selection.test.ts b/src/renderer/src/components/task-page-linear-team-selection.test.ts
index 6eb1878fbbd..b75b6404080 100644
--- a/src/renderer/src/components/task-page-linear-team-selection.test.ts
+++ b/src/renderer/src/components/task-page-linear-team-selection.test.ts
@@ -1,6 +1,9 @@
 import { describe, expect, it } from 'vitest'
 import type { LinearTeam } from '../../../shared/linear/workspace-types'
-import { reconcileLinearTeamSelection } from './task-page-linear-team-selection'
+import {
+  reconcileLinearTeamSelection,
+  storedLinearTeamSelection
+} from './task-page-linear-team-selection'
 
 function team(id: string): LinearTeam {
   return {
@@ -34,4 +37,39 @@ describe('reconcileLinearTeamSelection', () => {
       'd'
     ])
   })
+
+  // Why: 0a2b6e7f (1.4.207) crashed page.tasks with "(t ?? []).filter is not a
+  // function": the persisted setting reached the renderer as a string, which
+  // `new Set(value)` in the hook initializer accepts and this call did not.
+  it('treats a saved selection of the wrong shape as sticky-all', () => {
+    expect(Array.from(reconcileLinearTeamSelection([team('a'), team('b')], 'a'))).toEqual([
+      'a',
+      'b'
+    ])
+    expect(Array.from(reconcileLinearTeamSelection([team('a'), team('b')], { 0: 'a' }))).toEqual([
+      'a',
+      'b'
+    ])
+  })
+})
+
+describe('storedLinearTeamSelection', () => {
+  it('keeps a string array', () => {
+    expect(storedLinearTeamSelection(['a', 'b'])).toEqual(['a', 'b'])
+  })
+
+  it('reads null and undefined as sticky-all', () => {
+    expect(storedLinearTeamSelection(null)).toBeNull()
+    expect(storedLinearTeamSelection(undefined)).toBeNull()
+  })
+
+  it('reads a string, an object or a number as sticky-all instead of throwing', () => {
+    expect(storedLinearTeamSelection('a')).toBeNull()
+    expect(storedLinearTeamSelection({ 0: 'a' })).toBeNull()
+    expect(storedLinearTeamSelection(7)).toBeNull()
+  })
+
+  it('drops non-string entries from a mixed array', () => {
+    expect(storedLinearTeamSelection(['a', 1, null, 'b'])).toEqual(['a', 'b'])
+  })
 })
diff --git a/src/renderer/src/components/task-page-linear-team-selection.ts b/src/renderer/src/components/task-page-linear-team-selection.ts
index 3ec82284a59..9cebac902b7 100644
--- a/src/renderer/src/components/task-page-linear-team-selection.ts
+++ b/src/renderer/src/components/task-page-linear-team-selection.ts
@@ -1,8 +1,18 @@
 import type { LinearTeam } from '../../../shared/linear/workspace-types'
 
+// Why: the persisted value is not validated on the way in and a string reached
+// 1.4.207 (0a2b6e7f); anything but a string array reads as sticky-all.
+export function storedLinearTeamSelection(value: unknown): string[] | null {
+  if (!Array.isArray(value)) {
+    return null
+  }
+  return value.filter((id): id is string => typeof id === 'string')
+}
+
+// Why `unknown`: this is the crash site, so it must hold for the raw setting too.
 export function reconcileLinearTeamSelection(
   availableTeams: LinearTeam[],
-  storedSelection: readonly string[] | null | undefined
+  storedSelection: unknown
 ): ReadonlySet<string> {
   const availableIds = availableTeams.map((team) => team.id)
   if (availableIds.length === 0) {
@@ -10,7 +20,9 @@ export function reconcileLinearTeamSelection(
   }
 
   const availableIdSet = new Set(availableIds)
-  const validStoredSelection = (storedSelection ?? []).filter((id) => availableIdSet.has(id))
+  const validStoredSelection = (storedLinearTeamSelection(storedSelection) ?? []).filter((id) =>
+    availableIdSet.has(id)
+  )
   if (validStoredSelection.length > 0) {
     return new Set(validStoredSelection)
   }
diff --git a/src/renderer/src/components/task-page-source-family.test-support.ts b/src/renderer/src/components/task-page-source-family.test-support.ts
deleted file mode 100644
index 2253f11295e..00000000000
--- a/src/renderer/src/components/task-page-source-family.test-support.ts
+++ /dev/null
@@ -1,82 +0,0 @@
-import { readFileSync, readdirSync } from 'node:fs'
-import { join } from 'node:path'
-
-import {
-  type HookContractFact,
-  readFlattenedHookFacts,
-  readHookDefinitions
-} from './refactor-hook-contract.test-support'
-
-const TASK_PAGE_FLAT_SOURCE_PATTERN = /^(?:use-task-page-.*\.ts|task-page-.*\.tsx?)$/
-const TASK_PAGE_DIRECTORY = 'task-page'
-const TASK_PAGE_EXTRACTED_LOWERCASE_FILES = new Set([
-  'task-page-draft-storage.tsx',
-  'task-page-github-landing-refresh-run.tsx',
-  'task-page-github-quiet-refresh-run.tsx',
-  'task-page-github-review-model.tsx',
-  'task-page-github-reviewer-actions.ts',
-  'task-page-linear-issue-model.tsx',
-  'task-page-linear-jira-list-model.tsx',
-  'task-page-source-context.tsx'
-])
-
-function isSourceFile(name: string): boolean {
-  return !name.includes('.test.') && !name.includes('.test-support.')
-}
-
-// Why: the components/task-page tree nests by provider, so a flat readdir would silently
-// return an empty family and turn every ratchet built on it into a no-op.
-function readTaskPageDirectory(relativeDirectory: string): string[] {
-  return readdirSync(join(__dirname, relativeDirectory), { withFileTypes: true }).flatMap(
-    (entry) => {
-      const relativePath = `${relativeDirectory}/${entry.name}`
-      if (entry.isDirectory()) {
-        return readTaskPageDirectory(relativePath)
-      }
-      return /\.tsx?$/.test(entry.name) && isSourceFile(entry.name) ? [relativePath] : []
-    }
-  )
-}
-
-export const TASK_PAGE_SOURCE_FILES = [
-  ...readdirSync(__dirname).filter(
-    (name) => TASK_PAGE_FLAT_SOURCE_PATTERN.test(name) && isSourceFile(name)
-  ),
-  ...readTaskPageDirectory(TASK_PAGE_DIRECTORY)
-].sort()
-
-export const TASK_PAGE_REFACTOR_SOURCE_FILES = TASK_PAGE_SOURCE_FILES.filter(
-  (name) =>
-    (name.startsWith(`${TASK_PAGE_DIRECTORY}/`) && name.endsWith('.tsx')) ||
-    /^use-task-page-.*\.ts$/.test(name) ||
-    TASK_PAGE_EXTRACTED_LOWERCASE_FILES.has(name)
-)
-
-export function readTaskPageSource(relativePath: string): string {
-  return readFileSync(join(__dirname, relativePath), 'utf8')
-}
-
-export function readTaskPageSourceFamily(): string {
-  return TASK_PAGE_SOURCE_FILES.map(
-    (relativePath) => `// TaskPage source: ${relativePath}\n${readTaskPageSource(relativePath)}`
-  ).join('\n')
-}
-
-export function readTaskPageRefactorSourceFamily(): string {
-  return TASK_PAGE_REFACTOR_SOURCE_FILES.map(readTaskPageSource).join('\n')
-}
-
-export function readFlattenedTaskPageHookFacts(): HookContractFact[] {
-  const definitions = readHookDefinitions(
-    TASK_PAGE_REFACTOR_SOURCE_FILES.map((relativePath) => ({
-      relativePath,
-      source: readTaskPageSource(relativePath)
-    })),
-    (name) => name === 'TaskPage' || name.startsWith('useTaskPage')
-  )
-  return readFlattenedHookFacts(definitions, 'TaskPage')
-}
-
-export function readFlattenedTaskPageHookOrder(): string[] {
-  return readFlattenedTaskPageHookFacts().map(({ name }) => name)
-}
diff --git a/src/renderer/src/components/task-page-source-switch-boundary.test.ts b/src/renderer/src/components/task-page-source-switch-boundary.test.ts
deleted file mode 100644
index ae3bc60df21..00000000000
--- a/src/renderer/src/components/task-page-source-switch-boundary.test.ts
+++ /dev/null
@@ -1,99 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { readTaskPageSource } from './task-page-source-family.test-support'
-
-const CONTENT_SOURCE = readTaskPageSource('task-page/Content.tsx')
-const SOURCE_BAR_SOURCE = readTaskPageSource('task-page/SourceBar.tsx')
-const SOURCE_CONTEXT_SOURCE = readTaskPageSource('task-page-source-context.tsx')
-const RUNTIME_HOSTS_SOURCE = readTaskPageSource('use-task-page-runtime-hosts.ts')
-const GITHUB_DETAIL_SOURCE = readTaskPageSource('use-task-page-github-detail.ts')
-const WORKSPACE_ACTIONS_SOURCE = readTaskPageSource('use-task-page-workspace-actions.ts')
-
-function sourceBetween(source: string, startPattern: string, endPattern: string): string {
-  const start = source.indexOf(startPattern)
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = source.indexOf(endPattern, start + startPattern.length)
-  expect(end).toBeGreaterThan(start)
-  return source.slice(start, end)
-}
-
-describe('TaskPage source switching host boundary', () => {
-  it('renders GitHub item details from the task-detail page owner only', () => {
-    const detailSection = sourceBetween(
-      CONTENT_SOURCE,
-      '<PullRequestPage',
-      ") : taskSource === 'github' && githubMode === 'project' ?"
-    )
-
-    expect(CONTENT_SOURCE).toContain('<ProjectViewWrapper selectedRepoIds={repoSelection} />')
-    expect(detailSection).toContain('workItem={dialogWorkItem}')
-    expect(detailSection).toContain('<PullRequestPage')
-    expect(detailSection).toContain('sourceContext={dialogSourceContext}')
-    expect(detailSection).toContain('<GitHubItemDialog')
-    expect(detailSection).toContain('sourceContext={dialogSourceContext}')
-    expect(CONTENT_SOURCE.match(/<GitHubItemDialog/g)).toHaveLength(1)
-  })
-
-  it('switches task source without mutating the focused run host', () => {
-    const section = sourceBetween(
-      SOURCE_BAR_SOURCE,
-      '{visibleSourceOptions.map((source) => {',
-      "{taskSource === 'linear' && linearConnected ?"
-    )
-
-    expect(section).toContain('openTaskPage(')
-    expect(section).toContain('taskSource: source.id')
-    expect(section).toContain('defaultTaskSource: source.id')
-    expect(section).not.toContain('activeRuntimeEnvironmentId')
-    expect(section).not.toContain('projectHostSetupId')
-    expect(section).not.toContain('workspaceRunContext')
-  })
-
-  it('treats missing remote task-source capability as source unavailable', () => {
-    const section = sourceBetween(
-      SOURCE_CONTEXT_SOURCE,
-      'function getTaskSourceHostAvailabilityForHost',
-      'function getTaskPageRepoCacheInput'
-    )
-
-    expect(section).toContain('TASK_SOURCE_CONTEXT_RUNTIME_CAPABILITY')
-    expect(section).toContain("reason: 'checking-task-source-capability'")
-    expect(section).toContain("reason: 'missing-task-source-capability'")
-  })
-
-  it('checks runtime-owned provider auth on the owning runtime', () => {
-    const section = sourceBetween(
-      RUNTIME_HOSTS_SOURCE,
-      'const runtimeTaskSourceHostIds = useMemo(() => {',
-      'const nextModel'
-    )
-
-    expect(section).toContain('TASK_SOURCE_CONTEXT_RUNTIME_CAPABILITY')
-    expect(section).toContain("'preflight.check'")
-    expect(section).toMatch(/\{\s*kind: 'environment',\s*environmentId: parsed\.environmentId\s*\}/)
-    expect(RUNTIME_HOSTS_SOURCE).toContain('runtimePreflightStatusByHostId')
-  })
-
-  it('preserves exact GitLab project identity when opening or starting from an item', () => {
-    const sourceContextBuilder = sourceBetween(
-      SOURCE_CONTEXT_SOURCE,
-      'function getTaskPageRepoSourceContext',
-      'function getTaskSourceHostAvailabilityForHost'
-    )
-    expect(sourceContextBuilder).toContain('gitlabProjectRef?: GitLabProjectRef | null')
-    expect(sourceContextBuilder).toContain('buildGitLabProviderIdentity(gitlabProjectRef)')
-
-    const openGitLabDetail = sourceBetween(
-      GITHUB_DETAIL_SOURCE,
-      'const openGitLabDetailPage = useCallback(',
-      'const nextModel'
-    )
-    expect(openGitLabDetail).toContain('item.projectRef')
-
-    const startGitLabWorkspace = sourceBetween(
-      WORKSPACE_ACTIONS_SOURCE,
-      'const openComposerForGitLabItem = useCallback(',
-      'const handleUseGitLabItem = useCallback('
-    )
-    expect(startGitLabWorkspace).toContain('item.projectRef')
-  })
-})
diff --git a/src/renderer/src/components/task-page-task-creation-drafts.test.ts b/src/renderer/src/components/task-page-task-creation-drafts.test.ts
deleted file mode 100644
index 969c1b0c373..00000000000
--- a/src/renderer/src/components/task-page-task-creation-drafts.test.ts
+++ /dev/null
@@ -1,103 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { describe, expect, it } from 'vitest'
-import {
-  readTaskPageSource,
-  readTaskPageSourceFamily
-} from './task-page-source-family.test-support'
-
-const taskPageSource = readTaskPageSourceFamily()
-const linearCreateDialogsSource = readFileSync(
-  new URL('./use-task-page-linear-creation-state.ts', import.meta.url),
-  'utf8'
-)
-const jiraCreateDialogSource = readFileSync(
-  new URL('./use-task-page-jira-creation-state.ts', import.meta.url),
-  'utf8'
-)
-const jiraCreateSubmitSource = readFileSync(
-  new URL('./use-task-page-jira-issue-creation.ts', import.meta.url),
-  'utf8'
-)
-const draftWriterSource = readFileSync(
-  new URL('./task-page-draft-storage.tsx', import.meta.url),
-  'utf8'
-)
-const draftRetentionSource = [linearCreateDialogsSource, jiraCreateDialogSource].join('\n')
-
-function sectionBetween(source: string, startAnchor: string, endAnchor: string): string {
-  const start = source.indexOf(startAnchor)
-  expect(start, `missing anchor: ${startAnchor}`).toBeGreaterThanOrEqual(0)
-  const end = source.indexOf(endAnchor, start)
-  expect(end, `missing anchor: ${endAnchor}`).toBeGreaterThan(start)
-  return source.slice(start, end)
-}
-
-describe('TaskPage Linear/Jira creation drafts', () => {
-  it('uses the contentful gate for each session draft writer', () => {
-    expect(draftWriterSource.split('isTaskCreationDraftContentful(draft)')).toHaveLength(4)
-  })
-
-  it('retains all three drafts on dismissal without subscribing TaskPage to draft actions', () => {
-    expect(draftRetentionSource.split('useTaskCreationDraftRetention({')).toHaveLength(4)
-    expect(taskPageSource).not.toMatch(
-      /useAppStore\(\(s\) => s\.(?:set|clear)New(?:LinearProject|LinearIssue|JiraIssue)Draft\)/
-    )
-    expect(draftRetentionSource).not.toMatch(
-      /useAppStore\(\(s\) => s\.(?:set|clear)New(?:LinearProject|LinearIssue|JiraIssue)Draft\)/
-    )
-  })
-
-  it('restores dismissed typed text when each dialog reopens', () => {
-    const linearFilters = readFileSync(
-      new URL('./task-page/linear/Filters.tsx', import.meta.url),
-      'utf8'
-    )
-    const jiraFilters = readFileSync(
-      new URL('./task-page/jira/Filters.tsx', import.meta.url),
-      'utf8'
-    )
-    expect(linearFilters).toContain("setNewLinearProjectName(draft?.name ?? '')")
-    expect(linearFilters).toContain("setNewLinearProjectDescription(draft?.description ?? '')")
-    expect(linearFilters).toContain("setNewLinearProjectContent(draft?.content ?? '')")
-    expect(linearFilters).toContain("setNewLinearIssueTitle(issueDraft?.title ?? '')")
-    expect(linearFilters).toContain("setNewLinearIssueBody(issueDraft?.body ?? '')")
-    expect(jiraFilters).toContain("setNewJiraIssueTitle(draft?.title ?? '')")
-    expect(jiraFilters).toContain("setNewJiraIssueBody(draft?.body ?? '')")
-  })
-
-  it('discards each recovery draft only on a successful create', () => {
-    const linearProjectSection = sectionBetween(
-      readTaskPageSource('use-task-page-linear-project-creation.ts'),
-      'const handleCreateNewLinearProject',
-      'const nextModel'
-    )
-    expect(linearProjectSection).toContain('discardNewLinearProjectDraft()')
-
-    const linearIssueSection = sectionBetween(
-      readTaskPageSource('use-task-page-linear-issue-creation.ts'),
-      'const handleCreateNewLinearIssue',
-      'const nextModel'
-    )
-    expect(linearIssueSection).toContain('discardNewLinearIssueDraft()')
-
-    const jiraIssueSection = sectionBetween(
-      readTaskPageSource('use-task-page-jira-issue-creation.ts'),
-      'const handleCreateNewJiraIssue',
-      'const nextModel'
-    )
-    expect(jiraIssueSection).toContain('discardNewJiraIssueDraft()')
-  })
-
-  it('surfaces Jira create transport failures without leaking stale-context toasts', () => {
-    const jiraIssueSection = sectionBetween(
-      jiraCreateSubmitSource,
-      'const handleCreateNewJiraIssue',
-      'const nextModel'
-    )
-    expect(jiraIssueSection).toContain('} catch (error) {')
-    expect(jiraIssueSection).toContain(
-      'submitProviderRuntimeContextKey === providerRuntimeContextKeyRef.current'
-    )
-    expect(jiraIssueSection).toContain('toast.error(')
-  })
-})
diff --git a/src/renderer/src/components/task-page-workspace-composer-boundary.test.ts b/src/renderer/src/components/task-page-workspace-composer-boundary.test.ts
deleted file mode 100644
index a16128eee76..00000000000
--- a/src/renderer/src/components/task-page-workspace-composer-boundary.test.ts
+++ /dev/null
@@ -1,136 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-import {
-  readTaskPageSource,
-  readTaskPageSourceFamily
-} from './task-page-source-family.test-support'
-
-const TASK_PAGE_SOURCE = readTaskPageSourceFamily()
-const WORKSPACE_ACTIONS_SOURCE = readTaskPageSource('use-task-page-workspace-actions.ts')
-const COMPOSER_ACTIONS_SOURCE = readTaskPageSource('use-task-page-composer-actions.ts')
-const PROJECT_VIEW_SOURCE = readFileSync(
-  join(__dirname, 'github-project', 'ProjectViewWrapper.tsx'),
-  'utf8'
-)
-const COMPOSER_MODAL_SOURCE = readFileSync(join(__dirname, 'NewWorkspaceComposerModal.tsx'), 'utf8')
-const QUICK_SUBMIT_PREPARATION_SOURCE =
-  readFileSync(join(__dirname, '../hooks/composer-state/quick-submit-preparation.ts'), 'utf8') +
-  readFileSync(join(__dirname, '../hooks/composer-state/quick-creation-execution.ts'), 'utf8') +
-  readFileSync(join(__dirname, '../hooks/composer-state/quick-creation-request.ts'), 'utf8')
-
-function sourceBetween(source: string, startPattern: string, endPattern: string): string {
-  const start = source.indexOf(startPattern)
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = source.indexOf(endPattern, start + startPattern.length)
-  expect(end).toBeGreaterThan(start)
-  return source.slice(start, end)
-}
-
-describe('TaskPage workspace creation source boundaries', () => {
-  it('prefills the workspace composer for GitHub issues and pull requests', () => {
-    const section = sourceBetween(
-      WORKSPACE_ACTIONS_SOURCE,
-      'const openComposerForItem = useCallback(',
-      'const handleUseWorkItem = useCallback('
-    )
-
-    expect(section).toContain("provider: 'github'")
-    expect(section).toContain('type: item.type')
-    expect(section).toContain('number: item.number')
-    expect(section).toContain('title: item.title')
-    expect(section).toContain('url: item.url')
-    expect(section).toContain("openModal('new-workspace-composer', {")
-    expect(section).toContain("getTaskPageRepoSourceContext(repoMap.get(item.repoId), 'github')")
-    expect(section).toContain('prefilledName: getGitHubWorkItemWorkspaceSeed(item)')
-    expect(section).toContain('initialRepoId: item.repoId')
-    expect(section).toContain('initialGitHubWorkItem: item')
-    expect(section).toContain("enableIssueAutomation: item.type === 'issue'")
-    expect(section).toContain("telemetrySource: 'sidebar'")
-  })
-
-  it('forwards PR start-point data and issue automation through quick submit', () => {
-    expect(COMPOSER_MODAL_SOURCE).toContain(
-      'initialGitHubWorkItem: modalData.initialGitHubWorkItem ?? null'
-    )
-    expect(COMPOSER_MODAL_SOURCE).toContain(
-      'enableIssueAutomation: modalData.enableIssueAutomation === true'
-    )
-    const quickSubmit = QUICK_SUBMIT_PREPARATION_SOURCE
-    expect(quickSubmit).toContain('readAndConfirmRuntimeIssueCommand(')
-    expect(quickSubmit).toContain('selectedRepoExecutionHostId')
-    expect(quickSubmit).toContain('isSubmissionCancelled')
-    expect(quickSubmit).toContain(
-      '...(input.issueCommand ? { issueCommand: input.issueCommand } : {})'
-    )
-  })
-
-  it('routes TaskPage GitHub starts directly to the composer', () => {
-    const section = sourceBetween(
-      WORKSPACE_ACTIONS_SOURCE,
-      'const handleUseWorkItem = useCallback(',
-      'const handleOpenOrUseGitHubWorkItem = useCallback('
-    )
-
-    expect(section).toContain("recordFeatureInteraction('github-tasks')")
-    expect(section).toContain('openComposerForItem(item)')
-    expect(section).not.toContain('createGitHubWorkItemWorkspaceInBackground')
-    expect(WORKSPACE_ACTIONS_SOURCE).not.toContain('@/lib/github-work-item-background-create')
-    expect(TASK_PAGE_SOURCE).not.toContain('@/lib/github-work-item-background-create')
-  })
-
-  it('routes TaskPage Linear starts directly to the composer', () => {
-    const composerSection = sourceBetween(
-      COMPOSER_ACTIONS_SOURCE,
-      'const openComposerForLinearItem = useCallback(',
-      'const handleUseLinearItem = useCallback('
-    )
-    const handlerSection = sourceBetween(
-      COMPOSER_ACTIONS_SOURCE,
-      'const handleUseLinearItem = useCallback(',
-      'const handleOpenOrUseLinearItem = useCallback('
-    )
-
-    expect(composerSection).toContain('buildLinearIssueLinkedWorkItem(issue)')
-    expect(composerSection).toContain("openModal('new-workspace-composer', {")
-    expect(composerSection).toContain('taskSourceContext: linearTaskSourceContext')
-    expect(composerSection).toContain('prefilledName: getLinearIssueWorkspaceName(issue)')
-    expect(composerSection).toContain("telemetrySource: 'sidebar'")
-    expect(handlerSection).toContain("recordFeatureInteraction('linear-tasks')")
-    expect(handlerSection).toContain('openComposerForLinearItem(issue)')
-  })
-
-  it('resumes an attachment from the primary action and composes when none exists', () => {
-    const section = sourceBetween(
-      WORKSPACE_ACTIONS_SOURCE,
-      'const handleOpenOrUseGitHubWorkItem = useCallback(',
-      'const openComposerForGitLabItem = useCallback('
-    )
-
-    expect(section).toContain('findGithubWorkItemWorkspaceAttachment(')
-    expect(section).toContain('if (!currentAttached)')
-    expect(section).toContain('handleUseWorkItem(item)')
-    expect(section).toContain('activateAndRevealWorktree(currentAttached.id)')
-  })
-
-  it('uses the shared composer handler from GitHub detail and start-new actions', () => {
-    const detail = readFileSync(join(__dirname, 'task-page/Content.tsx'), 'utf8')
-    const actions = readFileSync(join(__dirname, 'task-page/github/Rows.tsx'), 'utf8')
-    expect(detail.match(/onUse=\{\(item\) => \{/g)).toHaveLength(2)
-    expect(actions.match(/onSelect=\{\(\) => handleUseWorkItem\(item\)\}/g)).toHaveLength(2)
-  })
-
-  it('keeps project-view GitHub actions on the direct start-work path for issue #4756', () => {
-    const startAnchor = PROJECT_VIEW_SOURCE.includes('const handleStartWork')
-      ? 'const handleStartWork = useCallback('
-      : '// Why: issue #4756 keeps project-view actions on the direct'
-    const endAnchor = PROJECT_VIEW_SOURCE.includes('const handleStartWork')
-      ? 'const closeDialogRepoItem'
-      : 'openModalFallback: () => {'
-    const section = sourceBetween(PROJECT_VIEW_SOURCE, startAnchor, endAnchor)
-
-    expect(section).toContain('void launchWorkItemDirect({')
-    expect(section).toContain("launchSource: 'task_page'")
-    expect(section).not.toContain('createGitHubWorkItemWorkspaceInBackground')
-  })
-})
diff --git a/src/renderer/src/components/terminal-cold-activation.ts b/src/renderer/src/components/terminal-cold-activation.ts
index 8b6e96467ee..2d8cf075b57 100644
--- a/src/renderer/src/components/terminal-cold-activation.ts
+++ b/src/renderer/src/components/terminal-cold-activation.ts
@@ -1,11 +1,15 @@
 import { useAppStore } from '../store'
 import {
+  canAdmitTerminalTabsForStartup,
   canDeferColdActivationTabsForHost,
-  canMountTerminalWorkspaceForStartup,
   planColdActivationTabDeferral,
   pruneClosedBackgroundMountTabs,
   revealActivationDeferredTabs
 } from './terminal/background-terminal-worktree-mount'
+import {
+  holdTerminalTabsForStartup,
+  releaseStartupTerminalTabHold
+} from './terminal/startup-terminal-tab-hold'
 import { hasRegisteredRuntimeTerminalTab } from '../runtime/sync-runtime-graph'
 import { anyMountedWorktreeHasLayout as computeAnyMountedWorktreeHasLayout } from './terminal/split-group-mount'
 import { isParkRestorableTerminalPty } from './terminal-pane/terminal-hidden-view-parking'
@@ -32,6 +36,7 @@ export function applyTerminalColdActivation(controller: TerminalParkingFoundatio
     pairedRuntimeParkingEnvironmentIds,
     pendingStartupByTabId,
     renderedActiveWorktreeId,
+    startupTerminalTabHoldRef,
     startupWorktreeRefreshCompleted,
     tabsByWorktree,
     terminalParkingEnabled,
@@ -40,14 +45,26 @@ export function applyTerminalColdActivation(controller: TerminalParkingFoundatio
     workspaceSurfaceIds,
     workspaceSurfaceIdSet
   } = controller
-  if (
+  // Why the surface mounts on the tab model alone: the hydrated tabs, groups, and layout are
+  // everything the tab strip and the chat, browser, and editor panes need. Only terminal
+  // panes wait, held below, for startup restoration to publish PTY ownership — gating the
+  // whole surface on that chain left a restored session blank until its last step.
+  const startupHeldWorktreeId =
     renderedActiveWorktreeId &&
-    canMountTerminalWorkspaceForStartup({
+    !canAdmitTerminalTabsForStartup({
       workspaceSessionReady,
       hydrationSucceeded,
       startupWorktreeRefreshCompleted
     })
-  ) {
+      ? renderedActiveWorktreeId
+      : null
+  releaseStartupTerminalTabHold(
+    startupTerminalTabHoldRef,
+    backgroundMountTabIdsByWorktreeRef.current,
+    mountedWorktreeIdsRef.current,
+    startupHeldWorktreeId
+  )
+  if (renderedActiveWorktreeId && !startupHeldWorktreeId) {
     const worktreeTabs = tabsByWorktree[renderedActiveWorktreeId] ?? []
     const coldActivationDeferralEnabled =
       terminalParkingEnabled && terminalTitleSnapshotAuthorityEnabled
@@ -157,6 +174,15 @@ export function applyTerminalColdActivation(controller: TerminalParkingFoundatio
     tabsByWorktree,
     activationDeferredMountTabIdsByWorktreeRef.current
   )
+  if (startupHeldWorktreeId) {
+    holdTerminalTabsForStartup(
+      startupTerminalTabHoldRef,
+      backgroundMountTabIdsByWorktreeRef.current,
+      mountedWorktreeIdsRef.current,
+      startupHeldWorktreeId,
+      (tabsByWorktree[startupHeldWorktreeId] ?? []).map((tab) => tab.id)
+    )
+  }
   for (const id of mountedWorktreeIdsRef.current) {
     if (!workspaceSurfaceIdSet.has(id)) {
       mountedWorktreeIdsRef.current.delete(id)
@@ -173,7 +199,8 @@ export function applyTerminalColdActivation(controller: TerminalParkingFoundatio
   )
   return {
     anyMountedWorktreeHasLayout,
-    activationDeferralPlanRevision: activationDeferralPlanRevisionRef.current
+    activationDeferralPlanRevision: activationDeferralPlanRevisionRef.current,
+    startupTerminalTabHold: startupTerminalTabHoldRef.current
   }
 }
 
diff --git a/src/renderer/src/components/terminal-pane/TerminalContextMenu.test.tsx b/src/renderer/src/components/terminal-pane/TerminalContextMenu.test.tsx
index bd25abcce74..16f87ae24a9 100644
--- a/src/renderer/src/components/terminal-pane/TerminalContextMenu.test.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalContextMenu.test.tsx
@@ -78,6 +78,7 @@ function renderMenu(overrides: Record<string, unknown> = {}): string {
     onEqualizePaneSizes: vi.fn(),
     onClosePane: vi.fn(),
     onClearScreen: vi.fn(),
+    onResetTerminal: vi.fn(),
     canContinueAgentSessionInNewSession: false,
     onContinueAgentSessionInNewSession: vi.fn(),
     onForkAgentSession: vi.fn(),
diff --git a/src/renderer/src/components/terminal-pane/TerminalContextMenu.tsx b/src/renderer/src/components/terminal-pane/TerminalContextMenu.tsx
index 5236d61d1a6..e09969753e9 100644
--- a/src/renderer/src/components/terminal-pane/TerminalContextMenu.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalContextMenu.tsx
@@ -12,6 +12,7 @@ import {
   PanelsTopLeft,
   PanelRightClose,
   Pencil,
+  RotateCcw,
   SquareTerminal,
   TextSelect,
   X
@@ -53,6 +54,7 @@ type TerminalContextMenuProps = {
   onEqualizePaneSizes: () => void
   onClosePane: () => void
   onClearScreen: () => void
+  onResetTerminal: () => void
   canContinueAgentSessionInNewSession: boolean
   onContinueAgentSessionInNewSession: () => void
   onForkAgentSession: () => void
@@ -144,6 +146,7 @@ function TerminalContextMenuItems({
   onEqualizePaneSizes,
   onClosePane,
   onClearScreen,
+  onResetTerminal,
   canContinueAgentSessionInNewSession,
   onContinueAgentSessionInNewSession,
   onForkAgentSession,
@@ -350,6 +353,13 @@ function TerminalContextMenuItems({
         <Eraser />
         {translate('auto.components.terminal.pane.TerminalContextMenu.b4cdd9314e', 'Clear Screen')}
       </DropdownMenuItem>
+      <DropdownMenuItem onSelect={onResetTerminal}>
+        <RotateCcw />
+        {translate(
+          'auto.components.terminal.pane.TerminalContextMenu.resetTerminal',
+          'Reset Terminal'
+        )}
+      </DropdownMenuItem>
     </>
   )
 }
diff --git a/src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts b/src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts
index 31febbd6c21..18069a846b5 100644
--- a/src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts
+++ b/src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts
@@ -361,6 +361,19 @@ describe('TerminalErrorToast environment footer', () => {
     await waitFor(() => expect(environmentMocks.resolveFooter).not.toHaveBeenCalled())
   })
 
+  it('shows the issue request once for a host error that already asks for one', () => {
+    const view = render(
+      React.createElement(TerminalErrorToast, {
+        error:
+          'Failed to spawn shell "/bin/zsh": boom (shell: /bin/zsh). If this persists, please file an issue.',
+        onDismiss: vi.fn()
+      })
+    )
+
+    expect(view.container.textContent?.match(/If this persists/g)).toHaveLength(1)
+    expect(view.container.textContent).toContain('(shell: /bin/zsh).')
+  })
+
   it('renders owner-unverified as a warning without an issue link', () => {
     const onRetry = vi.fn().mockResolvedValue(true)
     const view = render(
diff --git a/src/renderer/src/components/terminal-pane/TerminalErrorToast.tsx b/src/renderer/src/components/terminal-pane/TerminalErrorToast.tsx
index 8b627a9651f..a31b0c37856 100644
--- a/src/renderer/src/components/terminal-pane/TerminalErrorToast.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalErrorToast.tsx
@@ -3,6 +3,10 @@ import { translate } from '@/i18n/i18n'
 import { resolveClientEnvironmentFooter } from '@/lib/client-environment-info'
 import { Button } from '@/components/ui/button'
 import { hasClientEnvironmentFooter } from '../../../../shared/client-environment-info'
+import {
+  localizeTerminalSpawnHints,
+  withoutTerminalSpawnIssueRequest
+} from './terminal-spawn-error-display'
 
 const SSH_PREFIX = 'SSH connection is not active'
 // Produced by pty-connection.ts reportError() when a PTY reattach can't reach its SSH host.
@@ -112,7 +116,7 @@ function humanizeUnreattachableSession(error: string): string {
 
 /** Swaps raw daemon-boundary codes for copy a user can act on. */
 export function humanizeTerminalError(error: string): string {
-  let humanized = error
+  let humanized = localizeTerminalSpawnHints(error)
   if (humanized.includes(PANE_OWNER_UNVERIFIED_MARKER)) {
     const explanation = isPaneOwnerUnverifiedError(humanized)
       ? translate(
@@ -178,7 +182,11 @@ export function TerminalErrorToast({
   // Restart cannot recover a session after its owning daemon exits.
   const showIssueLink =
     !ssh && !paneOwnerUnverified && !showDaemonRestart && !isExplainedTerminalError(error)
-  const displayError = humanizeTerminalError(error)
+  const humanizedError = humanizeTerminalError(error)
+  // Why: the toast appends its own linked request, so the host's plain-text one would repeat it.
+  const displayError = showIssueLink
+    ? withoutTerminalSpawnIssueRequest(humanizedError)
+    : humanizedError
   const tint = paneOwnerUnverified
     ? null
     : ssh
diff --git a/src/renderer/src/components/terminal-pane/TerminalPaneNativeChatPortal.test.tsx b/src/renderer/src/components/terminal-pane/TerminalPaneNativeChatPortal.test.tsx
index 08155fb7c25..292aa0449e7 100644
--- a/src/renderer/src/components/terminal-pane/TerminalPaneNativeChatPortal.test.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalPaneNativeChatPortal.test.tsx
@@ -4,9 +4,14 @@ import { cleanup, render } from '@testing-library/react'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { TerminalPaneController } from './use-terminal-pane-controller'
 
-const mocks = vi.hoisted(() => ({
-  nativeChatViewProps: null as null | { isFocusedGroup: boolean }
-}))
+const mocks = vi.hoisted(
+  (): {
+    nativeChatViewProps: null | {
+      isFocusedGroup: boolean
+      contextMenuActions: { onClosePane: () => void }
+    }
+  } => ({ nativeChatViewProps: null })
+)
 
 vi.mock('@/store', () => ({
   useAppStore: (
@@ -24,7 +29,10 @@ vi.mock('@/store', () => ({
 }))
 
 vi.mock('../native-chat/NativeChatView', () => ({
-  default: (props: { isFocusedGroup: boolean }) => {
+  default: (props: {
+    isFocusedGroup: boolean
+    contextMenuActions: { onClosePane: () => void }
+  }) => {
     mocks.nativeChatViewProps = props
     return <span data-focused-group={String(props.isFocusedGroup)} />
   }
@@ -38,6 +46,22 @@ afterEach(() => {
 })
 
 describe('TerminalPaneNativeChatPortal', () => {
+  it('targets the restored chat pane when its sibling is active', () => {
+    const portalContainer = document.createElement('div')
+    const controller = makeController(portalContainer, { activePaneIsChatLeaf: false })
+    if (!controller.chatPane) {
+      throw new Error('fixture must have a chat pane')
+    }
+    controller.chatPane.id = 42
+    controller.contextMenu.onClosePane = vi.fn()
+    render(<TerminalPaneNativeChatPortal controller={controller} />)
+    mocks.nativeChatViewProps?.contextMenuActions.onClosePane()
+    expect(controller.contextMenu.runForPane).toHaveBeenCalledWith(
+      42,
+      controller.contextMenu.onClosePane
+    )
+  })
+
   it('only gives the composer focus ownership to the active split leaf', () => {
     const portalContainer = document.createElement('div')
     document.body.appendChild(portalContainer)
diff --git a/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.react185.test.tsx b/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.react185.test.tsx
index dbdca355779..cf9cabd9c57 100644
--- a/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.react185.test.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.react185.test.tsx
@@ -23,6 +23,7 @@ vi.mock('../../store', () => ({
 }))
 
 import { TerminalOverlaySlot } from './TerminalOverlaySlot'
+import { registerTabGroupBody } from '../tab-group/tab-group-body-geometry'
 
 const GROUP_ID = 'group-react185'
 const TAB_ID = 'tab-react185'
@@ -52,6 +53,7 @@ let capturedResizeCallback: (() => void) | null = null
 let container: HTMLDivElement
 let bodyEl: HTMLDivElement
 let bodyRect: DOMRect
+let unregisterBody: () => void
 let root: Root
 
 class CapturingResizeObserver {
@@ -103,12 +105,14 @@ beforeEach(() => {
   bodyRect = createRect({ top: 32, height: 568 })
   bodyEl.getBoundingClientRect = () => bodyRect
   document.body.appendChild(bodyEl)
+  unregisterBody = registerTabGroupBody(GROUP_ID, bodyEl)
 })
 
 afterEach(() => {
   act(() => {
     root?.unmount()
   })
+  unregisterBody()
   container?.remove()
   bodyEl?.remove()
   vi.unstubAllGlobals()
diff --git a/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.tsx b/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.tsx
index 2cb20783f53..63e75e9cdd5 100644
--- a/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.tsx
@@ -9,7 +9,9 @@ import {
 } from '../activity/activity-terminal-portal'
 import { shouldMountBackgroundWorktreeTab } from '../terminal/background-terminal-worktree-mount'
 import { useNativeChatToggleShortcut } from '../native-chat/use-native-chat-toggle-shortcut'
+import { RetainedPaneHost } from '../tab-group/RetainedPaneHost'
 import { TerminalOverlaySlot } from './TerminalOverlaySlot'
+import { TerminalRestoringPlaceholder } from './TerminalRestoringPlaceholder'
 import { useTerminalTabColdParking } from './use-terminal-tab-cold-parking'
 
 type TerminalOverlayAssignment = {
@@ -132,40 +134,50 @@ const TerminalPaneOverlayLayer = memo(function TerminalPaneOverlayLayer({
 
   return (
     <>
-      {terminalTabs
-        .filter((terminalTab) =>
-          shouldMountBackgroundWorktreeTab(backgroundMountTabIds, terminalTab.id)
-        )
-        .map((terminalTab) => {
-          const assignment = assignments.get(terminalTab.id)
-          const isVisible = Boolean(isWorktreeActive && assignment?.isActiveInGroup)
-          const isActive = Boolean(isVisible && assignment?.groupId === activeGroupId)
-          const activityTerminalPortal = findActivityTerminalPortal(activityTerminalPortals, {
-            worktreeId,
-            tabId: terminalTab.id
-          })
-          if (parkedTerminalTabIds.has(terminalTab.id)) {
-            return null
-          }
-          return (
-            <TerminalOverlaySlot
+      {terminalTabs.map((terminalTab) => {
+        const assignment = assignments.get(terminalTab.id)
+        const isVisible = Boolean(isWorktreeActive && assignment?.isActiveInGroup)
+        if (!shouldMountBackgroundWorktreeTab(backgroundMountTabIds, terminalTab.id)) {
+          // Why only the startup hold lands here visible: reveal admits every other visible
+          // deferred tab in the same render pass.
+          return isVisible ? (
+            <RetainedPaneHost
               key={terminalTab.id}
-              terminalTabId={terminalTab.id}
-              terminalGeneration={terminalTab.generation}
-              worktreeId={worktreeId}
-              worktreePath={worktreePath}
-              startupCwd={terminalTab.startupCwd}
               groupId={assignment?.groupId}
-              isWorktreeActive={isWorktreeActive}
-              isVisible={isVisible}
-              isActive={isActive}
-              activityTerminalPortal={activityTerminalPortal}
+              isVisible
               onFocusOwningGroup={focusOwningGroup}
-              consumeSuppressedPtyExit={consumeSuppressedPtyExit}
-              leaveWorktreeIfEmpty={leaveWorktreeIfEmpty}
-            />
-          )
-        })}
+            >
+              <TerminalRestoringPlaceholder />
+            </RetainedPaneHost>
+          ) : null
+        }
+        const isActive = Boolean(isVisible && assignment?.groupId === activeGroupId)
+        const activityTerminalPortal = findActivityTerminalPortal(activityTerminalPortals, {
+          worktreeId,
+          tabId: terminalTab.id
+        })
+        if (parkedTerminalTabIds.has(terminalTab.id)) {
+          return null
+        }
+        return (
+          <TerminalOverlaySlot
+            key={terminalTab.id}
+            terminalTabId={terminalTab.id}
+            terminalGeneration={terminalTab.generation}
+            worktreeId={worktreeId}
+            worktreePath={worktreePath}
+            startupCwd={terminalTab.startupCwd}
+            groupId={assignment?.groupId}
+            isWorktreeActive={isWorktreeActive}
+            isVisible={isVisible}
+            isActive={isActive}
+            activityTerminalPortal={activityTerminalPortal}
+            onFocusOwningGroup={focusOwningGroup}
+            consumeSuppressedPtyExit={consumeSuppressedPtyExit}
+            leaveWorktreeIfEmpty={leaveWorktreeIfEmpty}
+          />
+        )
+      })}
     </>
   )
 })
diff --git a/src/renderer/src/components/terminal-pane/TerminalPaneSurface.tsx b/src/renderer/src/components/terminal-pane/TerminalPaneSurface.tsx
index 08613fb6c3a..7eda851e7e9 100644
--- a/src/renderer/src/components/terminal-pane/TerminalPaneSurface.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalPaneSurface.tsx
@@ -92,14 +92,14 @@ export function TerminalPaneSurface({
     searchStateRef,
     searchInputRef,
     sessionRestoredBannerPaneIds,
-    sessionStateSaveFailureOpen,
+    sessionStateSaveFailureMessage,
     setAgentSessionContinuation,
     setAgentSessionFork,
     setContainerRef,
     setQuickCommandEditorOpen,
     setRenameValue,
     setSearchOpen,
-    setSessionStateSaveFailureOpen,
+    setSessionStateSaveFailureMessage,
     showSplitButton,
     showSshReconnectOverlay,
     splitTerminalPaneFromHeader,
@@ -201,8 +201,9 @@ export function TerminalPaneSurface({
       <DaemonActionDialog api={daemonActions} />
       {isActive && (
         <TerminalSessionStateSaveFailureDialog
-          open={sessionStateSaveFailureOpen}
-          onDismiss={() => setSessionStateSaveFailureOpen(false)}
+          open={sessionStateSaveFailureMessage !== null}
+          failureMessage={sessionStateSaveFailureMessage ?? ''}
+          onDismiss={() => setSessionStateSaveFailureMessage(null)}
           onOpenSpaceAnalyzer={openDiskSpaceAnalyzer}
         />
       )}
@@ -242,6 +243,7 @@ export function TerminalPaneSurface({
         onEqualizePaneSizes={contextMenu.onEqualizePaneSizes}
         onClosePane={contextMenu.onClosePane}
         onClearScreen={contextMenu.onClearScreen}
+        onResetTerminal={contextMenu.onResetTerminal}
         canContinueAgentSessionInNewSession={contextMenuCanContinueInNewSession}
         onContinueAgentSessionInNewSession={contextMenu.onContinueAgentSessionInNewSession}
         onForkAgentSession={() => void contextMenu.onForkAgentSession()}
diff --git a/src/renderer/src/components/terminal-pane/TerminalRestoringPlaceholder.tsx b/src/renderer/src/components/terminal-pane/TerminalRestoringPlaceholder.tsx
new file mode 100644
index 00000000000..4a2bb775e0d
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/TerminalRestoringPlaceholder.tsx
@@ -0,0 +1,20 @@
+import { Loader2 } from 'lucide-react'
+import { translate } from '@/i18n/i18n'
+
+/** Fills a terminal tab's slot while startup restoration holds its pane unmounted. */
+export function TerminalRestoringPlaceholder(): React.JSX.Element {
+  return (
+    <div
+      className="absolute inset-0 flex items-center justify-center gap-2 text-sm text-muted-foreground"
+      role="status"
+      aria-live="polite"
+      data-terminal-restoring-placeholder=""
+    >
+      <Loader2 className="size-4 animate-spin" />
+      {translate(
+        'auto.components.terminal.pane.TerminalRestoringPlaceholder.restoring',
+        'Restoring terminal…'
+      )}
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/terminal-pane/TerminalSessionStateSaveFailureDialog.tsx b/src/renderer/src/components/terminal-pane/TerminalSessionStateSaveFailureDialog.tsx
index 6ab425685a3..889fa69d7ef 100644
--- a/src/renderer/src/components/terminal-pane/TerminalSessionStateSaveFailureDialog.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalSessionStateSaveFailureDialog.tsx
@@ -1,4 +1,4 @@
-import { HardDrive } from 'lucide-react'
+import { AlertCircle } from 'lucide-react'
 import { Button } from '@/components/ui/button'
 import {
   Dialog,
@@ -9,16 +9,20 @@ import {
   DialogTitle
 } from '@/components/ui/dialog'
 import { translate } from '@/i18n/i18n'
+import { isTerminalSessionStorageCapacityFailure } from '../../../../shared/terminal-session-state-save-failure'
 
 export function TerminalSessionStateSaveFailureDialog({
   open,
+  failureMessage,
   onDismiss,
   onOpenSpaceAnalyzer
 }: {
   open: boolean
+  failureMessage: string
   onDismiss: () => void
   onOpenSpaceAnalyzer: () => void
 }): React.JSX.Element {
+  const capacityFailure = isTerminalSessionStorageCapacityFailure(failureMessage)
   return (
     <Dialog
       open={open}
@@ -32,29 +36,33 @@ export function TerminalSessionStateSaveFailureDialog({
         <DialogHeader className="gap-3">
           <div className="flex items-center gap-3">
             <div className="flex size-8 shrink-0 items-center justify-center rounded-md border border-border bg-muted/40">
-              <HardDrive className="size-4 text-muted-foreground" />
+              <AlertCircle className="size-4 text-muted-foreground" />
             </div>
             <DialogTitle className="text-base">
-              {translate(
-                'auto.components.terminal.pane.TerminalSessionStateSaveFailureDialog.678c780a2c',
-                'Disk space is unavailable'
-              )}
+              {translate('terminal.sessionSaveFailure.title', 'Could not save terminal session')}
             </DialogTitle>
           </div>
           <DialogDescription className="text-xs leading-5">
-            {translate(
-              'auto.components.terminal.pane.TerminalSessionStateSaveFailureDialog.e2fcf07c0d',
-              'Orca could not save this terminal session because local storage is full or not writable. Open the disk space analyzer to find workspace storage you can clean up.'
-            )}
+            {capacityFailure
+              ? translate(
+                  'terminal.sessionSaveFailure.capacity',
+                  'The device saving this terminal reported full storage or an exceeded storage quota. Free space on that device, then try again.'
+                )
+              : translate(
+                  'terminal.sessionSaveFailure.unknown',
+                  'Orca could not save the terminal state. Try again. If this continues, share the Orca logs with support so we can identify the cause.'
+                )}
           </DialogDescription>
         </DialogHeader>
 
-        <div className="rounded-md border border-border bg-muted/35 px-3 py-2.5 text-xs leading-5 text-muted-foreground">
-          {translate(
-            'auto.components.terminal.pane.TerminalSessionStateSaveFailureDialog.38c282a2c4',
-            'The analyzer opens directly from here. You can also open it later from the lower-left toolbox menu by choosing Space Analyzer.'
-          )}
-        </div>
+        {capacityFailure && (
+          <div className="rounded-md border border-border bg-muted/35 px-3 py-2.5 text-xs leading-5 text-muted-foreground">
+            {translate(
+              'auto.components.terminal.pane.TerminalSessionStateSaveFailureDialog.38c282a2c4',
+              'The analyzer opens directly from here. You can also open it later from the lower-left toolbox menu by choosing Space Analyzer.'
+            )}
+          </div>
+        )}
 
         <DialogFooter className="gap-2">
           <Button type="button" variant="outline" size="sm" onClick={onDismiss}>
@@ -63,12 +71,14 @@ export function TerminalSessionStateSaveFailureDialog({
               'Dismiss'
             )}
           </Button>
-          <Button type="button" size="sm" autoFocus onClick={onOpenSpaceAnalyzer}>
-            {translate(
-              'auto.components.terminal.pane.TerminalSessionStateSaveFailureDialog.6bee0c8f17',
-              'Open Disk Space Analyzer'
-            )}
-          </Button>
+          {capacityFailure && (
+            <Button type="button" size="sm" onClick={onOpenSpaceAnalyzer}>
+              {translate(
+                'auto.components.terminal.pane.TerminalSessionStateSaveFailureDialog.6bee0c8f17',
+                'Open Disk Space Analyzer'
+              )}
+            </Button>
+          )}
         </DialogFooter>
       </DialogContent>
     </Dialog>
diff --git a/src/renderer/src/components/terminal-pane/closed-terminal-leaf-notice.test.ts b/src/renderer/src/components/terminal-pane/closed-terminal-leaf-notice.test.ts
new file mode 100644
index 00000000000..cfb0ab96725
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/closed-terminal-leaf-notice.test.ts
@@ -0,0 +1,103 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { TerminalLayoutSnapshot } from '../../../../shared/terminal-tab-types'
+import { CLOSE_TERMINAL_PANE_EVENT } from '@/constants/terminal'
+
+const TAB_ID = 'tab-1'
+const LEAF_ID = '11111111-1111-4111-8111-111111111111'
+const SIBLING_LEAF_ID = '22222222-2222-4222-8222-222222222222'
+
+const splitLayout: TerminalLayoutSnapshot = {
+  root: {
+    type: 'split',
+    direction: 'vertical',
+    first: { type: 'leaf', leafId: LEAF_ID },
+    second: { type: 'leaf', leafId: SIBLING_LEAF_ID }
+  },
+  activeLeafId: LEAF_ID,
+  expandedLeafId: null,
+  ptyIdsByLeafId: { [LEAF_ID]: 'pty-closed', [SIBLING_LEAF_ID]: 'pty-sibling' }
+}
+
+const layouts: Record<string, TerminalLayoutSnapshot> = {}
+const state = {
+  tabsByWorktree: {},
+  terminalLayoutsByTabId: layouts,
+  runtimePaneTitlesByTabId: {},
+  clearTabLaunchAgent: vi.fn(),
+  updateTabTitle: vi.fn(),
+  setTabLayout: vi.fn((tabId: string, layout: TerminalLayoutSnapshot) => {
+    state.terminalLayoutsByTabId[tabId] = layout
+  })
+}
+
+vi.mock('@/store', () => ({ useAppStore: { getState: () => state } }))
+
+import { applyClosedTerminalLeafNotice } from './closed-terminal-leaf-notice'
+import { applyTerminalPaneCloseRequest } from './terminal-pane-lifecycle-close'
+import { parkedWatchersByTabId } from './terminal-parked-watcher-registry'
+
+function leafIds(layout: TerminalLayoutSnapshot | undefined): string[] {
+  return Object.keys(layout?.ptyIdsByLeafId ?? {})
+}
+
+beforeEach(() => {
+  state.terminalLayoutsByTabId = { [TAB_ID]: splitLayout }
+  state.setTabLayout.mockClear()
+  vi.stubGlobal('window', new EventTarget())
+})
+
+afterEach(() => {
+  parkedWatchersByTabId.clear()
+  vi.unstubAllGlobals()
+})
+
+describe('a split pane main already closed', () => {
+  it('reaches a mounted pane as a leaf-addressed close', () => {
+    const details: unknown[] = []
+    window.addEventListener(CLOSE_TERMINAL_PANE_EVENT, (event) =>
+      details.push(event instanceof CustomEvent ? event.detail : null)
+    )
+
+    applyClosedTerminalLeafNotice(TAB_ID, LEAF_ID)
+
+    expect(details).toEqual([{ tabId: TAB_ID, leafId: LEAF_ID }])
+  })
+
+  it('is ignored by a mounted pane whose exit already removed that leaf', () => {
+    const manager = {
+      closePane: vi.fn(),
+      detachPaneForExternalMove: vi.fn(),
+      retirePanePreservingPty: vi.fn(),
+      getNumericIdForLeaf: () => null,
+      getPanes: () => [{ id: 2 }]
+    }
+    const closeTab = vi.fn()
+
+    const result = applyTerminalPaneCloseRequest({
+      detail: { tabId: TAB_ID, leafId: LEAF_ID },
+      manager,
+      closeTab,
+      closeTabPreservingPty: vi.fn()
+    })
+
+    // Why: a numeric pane id would have reached the last-pane branch and closed the whole tab.
+    expect(result).toBe('ignored')
+    expect(closeTab).not.toHaveBeenCalled()
+    expect(manager.closePane).not.toHaveBeenCalled()
+  })
+
+  it('collapses a parked tab stored layout once, whichever of notice or exit lands first', () => {
+    parkedWatchersByTabId.set(TAB_ID, {
+      worktreeId: 'repo::/worktree',
+      tabPtyId: 'pty-closed',
+      disposersByPtyId: new Map([['pty-closed', vi.fn()]]),
+      paneIdByPtyId: new Map()
+    })
+
+    applyClosedTerminalLeafNotice(TAB_ID, LEAF_ID)
+    applyClosedTerminalLeafNotice(TAB_ID, LEAF_ID)
+
+    expect(leafIds(state.terminalLayoutsByTabId[TAB_ID])).toEqual([SIBLING_LEAF_ID])
+    expect(state.setTabLayout).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/closed-terminal-leaf-notice.ts b/src/renderer/src/components/terminal-pane/closed-terminal-leaf-notice.ts
new file mode 100644
index 00000000000..2b465db2878
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/closed-terminal-leaf-notice.ts
@@ -0,0 +1,16 @@
+import { CLOSE_TERMINAL_PANE_EVENT, type CloseTerminalPaneDetail } from '@/constants/terminal'
+import { collapseParkedTerminalLeaf } from './terminal-parked-pty-watcher'
+import { isTerminalTabParked } from './terminal-parked-watcher-registry'
+
+/**
+ * Drops a split pane main already closed. Addressed by leaf, so it is a no-op once the pane's own
+ * exit handling removed it, and the exit is a no-op after it: whichever lands first wins.
+ */
+export function applyClosedTerminalLeafNotice(tabId: string, leafId: string): void {
+  if (isTerminalTabParked(tabId)) {
+    collapseParkedTerminalLeaf(tabId, leafId)
+    return
+  }
+  const detail: CloseTerminalPaneDetail = { tabId, leafId }
+  window.dispatchEvent(new CustomEvent(CLOSE_TERMINAL_PANE_EVENT, { detail }))
+}
diff --git a/src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.test.ts b/src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.test.ts
index cba19b43c2f..c77339bfe2e 100644
--- a/src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.test.ts
+++ b/src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.test.ts
@@ -30,39 +30,52 @@ describe('deferred split pane handoff', () => {
     const cwdPromise = Promise.resolve('/source/cwd')
     const initial = beginDeferredSplitPaneHandoff(key, cwdPromise)
 
-    appendDeferredSplitPaneInput(initial, { data: 'typed', kind: 'ordinary' })
-    appendDeferredSplitPaneInput(initial, { data: '\x1b[0n', kind: 'immediate' })
-    appendDeferredSplitPaneInput(initial, { data: '\x03', kind: 'accepted' })
+    appendDeferredSplitPaneInput(initial, { data: 'typed', kind: 'ordinary', inputKind: 'driving' })
+    appendDeferredSplitPaneInput(initial, {
+      data: '\x1b[0n',
+      kind: 'immediate',
+      inputKind: 'query-reply'
+    })
+    appendDeferredSplitPaneInput(initial, { data: '\x03', kind: 'accepted', inputKind: 'driving' })
 
     const remounted = claimDeferredSplitPaneHandoff(key)
 
     expect(remounted?.cwdPromise).toBe(cwdPromise)
     expect(remounted?.preconnectInput).toEqual([
-      { data: 'typed', kind: 'ordinary' },
-      { data: '\x1b[0n', kind: 'immediate' },
-      { data: '\x03', kind: 'accepted' }
+      { data: 'typed', kind: 'ordinary', inputKind: 'driving' },
+      { data: '\x1b[0n', kind: 'immediate', inputKind: 'query-reply' },
+      { data: '\x03', kind: 'accepted', inputKind: 'driving' }
     ])
   })
 
   it('keeps input across repeated remounts and fences stale owners', () => {
     const key = makePaneKey('tab-1', LEAF_1)
     const initial = beginDeferredSplitPaneHandoff(key, Promise.resolve('/source/cwd'))
-    appendDeferredSplitPaneInput(initial, { data: 'before-first-remount', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(initial, {
+      data: 'before-first-remount',
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
     const firstRemount = claimDeferredSplitPaneHandoff(key)
     expect(firstRemount).not.toBeNull()
 
-    appendDeferredSplitPaneInput(initial, { data: 'stale-input', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(initial, {
+      data: 'stale-input',
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
     clearDeferredSplitPaneHandoff(initial)
     clearDeferredSplitPaneHandoff(initial)
     appendDeferredSplitPaneInput(firstRemount!.handle, {
       data: 'before-second-remount',
-      kind: 'ordinary'
+      kind: 'ordinary',
+      inputKind: 'driving'
     })
 
     const secondRemount = claimDeferredSplitPaneHandoff(key)
     expect(secondRemount?.preconnectInput).toEqual([
-      { data: 'before-first-remount', kind: 'ordinary' },
-      { data: 'before-second-remount', kind: 'ordinary' }
+      { data: 'before-first-remount', kind: 'ordinary', inputKind: 'driving' },
+      { data: 'before-second-remount', kind: 'ordinary', inputKind: 'driving' }
     ])
 
     clearDeferredSplitPaneHandoff(firstRemount!.handle)
@@ -74,21 +87,33 @@ describe('deferred split pane handoff', () => {
   it('releases an unmounted owner without dropping its pending handoff', () => {
     const key = makePaneKey('tab-1', LEAF_1)
     const initial = beginDeferredSplitPaneHandoff(key, Promise.resolve('/source/cwd'))
-    appendDeferredSplitPaneInput(initial, { data: 'before-unmount', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(initial, {
+      data: 'before-unmount',
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
 
     releaseDeferredSplitPaneHandoff(initial)
-    appendDeferredSplitPaneInput(initial, { data: 'late-stale', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(initial, {
+      data: 'late-stale',
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
     clearDeferredSplitPaneHandoff(initial)
 
     expect(claimDeferredSplitPaneHandoff(key)?.preconnectInput).toEqual([
-      { data: 'before-unmount', kind: 'ordinary' }
+      { data: 'before-unmount', kind: 'ordinary', inputKind: 'driving' }
     ])
   })
 
   it('lets a late close discard a released handoff by its stable pane key', () => {
     const key = makePaneKey('tab-1', LEAF_1)
     const owner = beginDeferredSplitPaneHandoff(key, Promise.resolve('/source/cwd'))
-    appendDeferredSplitPaneInput(owner, { data: 'must-not-replay', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(owner, {
+      data: 'must-not-replay',
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
 
     // Whole-tab cleanup releases the mount-local handle before a stale close callback can run.
     releaseDeferredSplitPaneHandoff(owner)
@@ -112,7 +137,11 @@ describe('deferred split pane handoff', () => {
   it('drops a stale record when an authoritative restored PTY wins the key', () => {
     const key = makePaneKey('tab-authoritative', LEAF_1)
     const stale = beginDeferredSplitPaneHandoff(key, Promise.resolve('/stale'))
-    appendDeferredSplitPaneInput(stale, { data: 'must-not-replay', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(stale, {
+      data: 'must-not-replay',
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
 
     discardDeferredSplitPaneHandoffForKey(key)
 
@@ -123,26 +152,44 @@ describe('deferred split pane handoff', () => {
   it('replaces an older handoff for the same stable pane key', () => {
     const key = makePaneKey('tab-1', LEAF_1)
     const stale = beginDeferredSplitPaneHandoff(key, Promise.resolve('/stale'))
-    appendDeferredSplitPaneInput(stale, { data: 'stale', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(stale, { data: 'stale', kind: 'ordinary', inputKind: 'driving' })
     const currentPromise = Promise.resolve('/current')
     const current = beginDeferredSplitPaneHandoff(key, currentPromise)
 
-    appendDeferredSplitPaneInput(stale, { data: 'late-stale', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(stale, {
+      data: 'late-stale',
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
     clearDeferredSplitPaneHandoff(stale)
-    appendDeferredSplitPaneInput(current, { data: 'current', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(current, {
+      data: 'current',
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
 
     const claimed = claimDeferredSplitPaneHandoff(key)
     expect(claimed?.cwdPromise).toBe(currentPromise)
-    expect(claimed?.preconnectInput).toEqual([{ data: 'current', kind: 'ordinary' }])
+    expect(claimed?.preconnectInput).toEqual([
+      { data: 'current', kind: 'ordinary', inputKind: 'driving' }
+    ])
   })
 
   it('retains input within the shared preconnect entry and code-unit caps', () => {
     const entryKey = makePaneKey('tab-entries', LEAF_1)
     const entryHandle = beginDeferredSplitPaneHandoff(entryKey, Promise.resolve('/entries'))
     for (let index = 0; index < PTY_PRECONNECT_INPUT_MAX_ENTRIES; index += 1) {
-      appendDeferredSplitPaneInput(entryHandle, { data: '', kind: 'ordinary' })
+      appendDeferredSplitPaneInput(entryHandle, {
+        data: '',
+        kind: 'ordinary',
+        inputKind: 'driving'
+      })
     }
-    appendDeferredSplitPaneInput(entryHandle, { data: 'overflow', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(entryHandle, {
+      data: 'overflow',
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
     expect(claimDeferredSplitPaneHandoff(entryKey)?.preconnectInput).toHaveLength(
       PTY_PRECONNECT_INPUT_MAX_ENTRIES
     )
@@ -154,11 +201,20 @@ describe('deferred split pane handoff', () => {
     )
     appendDeferredSplitPaneInput(codeUnitHandle, {
       data: 'x'.repeat(PTY_PRECONNECT_INPUT_MAX_CODE_UNITS),
-      kind: 'ordinary'
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
+    appendDeferredSplitPaneInput(codeUnitHandle, {
+      data: 'overflow',
+      kind: 'ordinary',
+      inputKind: 'driving'
     })
-    appendDeferredSplitPaneInput(codeUnitHandle, { data: 'overflow', kind: 'ordinary' })
     expect(claimDeferredSplitPaneHandoff(codeUnitKey)?.preconnectInput).toEqual([
-      { data: 'x'.repeat(PTY_PRECONNECT_INPUT_MAX_CODE_UNITS), kind: 'ordinary' }
+      {
+        data: 'x'.repeat(PTY_PRECONNECT_INPUT_MAX_CODE_UNITS),
+        kind: 'ordinary',
+        inputKind: 'driving'
+      }
     ])
   })
 
@@ -209,12 +265,12 @@ describe('deferred split pane handoff', () => {
   it('does not expose the registry input array by reference', () => {
     const key = makePaneKey('tab-1', LEAF_1)
     const handle = beginDeferredSplitPaneHandoff(key, Promise.resolve('/source/cwd'))
-    appendDeferredSplitPaneInput(handle, { data: 'kept', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(handle, { data: 'kept', kind: 'ordinary', inputKind: 'driving' })
     const firstClaim = claimDeferredSplitPaneHandoff(key)
     firstClaim?.preconnectInput.splice(0)
 
     expect(claimDeferredSplitPaneHandoff(key)?.preconnectInput).toEqual([
-      { data: 'kept', kind: 'ordinary' }
+      { data: 'kept', kind: 'ordinary', inputKind: 'driving' }
     ])
   })
 })
diff --git a/src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.ts b/src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.ts
index 6dfa1f30866..046b43daa9c 100644
--- a/src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.ts
+++ b/src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.ts
@@ -135,7 +135,7 @@ export function appendDeferredSplitPaneInput(
   ) {
     return
   }
-  owned.record.preconnectInput.push({ data: input.data, kind: input.kind })
+  owned.record.preconnectInput.push({ ...input })
   owned.record.inputCodeUnits += input.data.length
 }
 
diff --git a/src/renderer/src/components/terminal-pane/ipc-pty-connect.ts b/src/renderer/src/components/terminal-pane/ipc-pty-connect.ts
index 52b983c51fd..ea5a4dda3aa 100644
--- a/src/renderer/src/components/terminal-pane/ipc-pty-connect.ts
+++ b/src/renderer/src/components/terminal-pane/ipc-pty-connect.ts
@@ -1,5 +1,5 @@
 import { isRuntimeOwnedSshTargetId } from '../../../../shared/execution-host'
-import { extractIpcErrorMessage } from '@/lib/ipc-error'
+import { readIpcErrorDetail } from '@/lib/ipc-error'
 import { ensurePtyDispatcher } from './pty-dispatcher'
 import {
   clearConsumedPreHandlerPtyExit,
@@ -39,7 +39,7 @@ export async function connectIpcPty(
   context: IpcPtyConnectContext
 ): Promise<void | string | PtyConnectResult> {
   const { transportOptions, handlers } = context
-  const { onPtySpawn } = transportOptions
+  const { onPtySpawn, retainDisposedSpawn } = transportOptions
   context.setCallbacks(options.callbacks)
   ensurePtyDispatcher()
 
@@ -89,36 +89,37 @@ export async function connectIpcPty(
     // recorded before we asked for a PTY, so it belongs to that earlier owner, not to us.
     const priorIncarnationFence = currentPreHandlerPtySequence()
     const spawnResult = await spawnIpcPty(transportOptions, options, admittedSessionId)
-    const retireFreshSpawn = async (): Promise<void> => {
+    const retireFreshSpawn = async (path: 'disposed' | 'refused'): Promise<void> => {
       if (context.handleExplicitlyClosedConnect?.(spawnResult.id)) {
         return
       }
       // A newer generation may already own a recycled id; an id-only kill would retire its PTY.
-      if (
-        !spawnResult.isReattach &&
-        !spawnResult.coldRestore &&
-        !context.ownsPtyId(spawnResult.id)
-      ) {
+      if (spawnResult.isReattach || spawnResult.coldRestore || context.ownsPtyId(spawnResult.id)) {
+        return
+      }
+      // Only disposed transports can have a successor; live refusal must still retire the PTY (#11003).
+      const retained = path === 'disposed' && retainDisposedSpawn?.() === true
+      if (!retained) {
         await window.api.pty.kill(spawnResult.id)
       }
     }
 
     if (context.isDestroyed()) {
-      await retireFreshSpawn()
+      await retireFreshSpawn('disposed')
       return
     }
     if (options.admitPtyId && !options.admitPtyId(spawnResult.id)) {
-      await retireFreshSpawn()
+      await retireFreshSpawn('refused')
       return context.isDestroyed() ? undefined : spawnResult
     }
     if (context.isDestroyed()) {
-      await retireFreshSpawn()
+      await retireFreshSpawn('disposed')
       return
     }
     if (spawnResult.isReattach && !admittedSessionId) {
       context.getCallbacks().onReattachDetermined?.()
       if (context.isDestroyed()) {
-        await retireFreshSpawn()
+        await retireFreshSpawn('disposed')
         return
       }
     }
@@ -180,10 +181,8 @@ function handleConnectError(
   context: IpcPtyConnectContext
 ): PtyConnectResult | undefined {
   const { connectionId } = context.transportOptions
-  const message = extractIpcErrorMessage(
-    error,
-    error instanceof Error ? error.message : String(error)
-  )
+  const message =
+    readIpcErrorDetail(error) ?? (error instanceof Error ? error.message : String(error))
   if (connectionId && options.sessionId && isSshSessionGoneError(message)) {
     return { id: options.sessionId, sessionExpired: true }
   }
diff --git a/src/renderer/src/components/terminal-pane/keyboard-handlers-ime-enter-keyup.test.tsx b/src/renderer/src/components/terminal-pane/keyboard-handlers-ime-enter-keyup.test.tsx
index 7e6f9a02549..8a84eddbcef 100644
--- a/src/renderer/src/components/terminal-pane/keyboard-handlers-ime-enter-keyup.test.tsx
+++ b/src/renderer/src/components/terminal-pane/keyboard-handlers-ime-enter-keyup.test.tsx
@@ -328,7 +328,7 @@ describe('Windows IME Enter-keyup press-time evidence', () => {
     vi.runAllTimers()
 
     expect(harness.sendInput).toHaveBeenCalledTimes(1)
-    expect(harness.sendInput).toHaveBeenCalledWith('\x1b\r')
+    expect(harness.sendInput).toHaveBeenCalledWith('\x1b\r', 'driving')
     hook.unmount()
     harness.dispose()
   })
@@ -351,7 +351,7 @@ describe('Windows IME Enter-keyup press-time evidence', () => {
     vi.runAllTimers()
 
     expect(harness.sendInput).toHaveBeenCalledTimes(1)
-    expect(harness.sendInput).toHaveBeenCalledWith('\x1b\r')
+    expect(harness.sendInput).toHaveBeenCalledWith('\x1b\r', 'driving')
     hook.unmount()
     harness.dispose()
   })
@@ -374,7 +374,7 @@ describe('Windows IME Enter-keyup press-time evidence', () => {
 
     expect(harness.setActivePane).toHaveBeenCalledWith(2, { focus: false })
     expect(harness.sendInput).toHaveBeenCalledOnce()
-    expect(harness.sendInput).toHaveBeenCalledWith('\x1b\r')
+    expect(harness.sendInput).toHaveBeenCalledWith('\x1b\r', 'driving')
     hook.unmount()
     harness.dispose()
   })
diff --git a/src/renderer/src/components/terminal-pane/layout-serialization.test.ts b/src/renderer/src/components/terminal-pane/layout-serialization.test.ts
index 8980c86ee8d..5835246ebaf 100644
--- a/src/renderer/src/components/terminal-pane/layout-serialization.test.ts
+++ b/src/renderer/src/components/terminal-pane/layout-serialization.test.ts
@@ -38,7 +38,6 @@ import {
   POST_REPLAY_MODE_RESET,
   replayPayloadEndsWithCursorHidden,
   RESET_GRAPHIC_RENDITION,
-  RESET_KITTY_KEYBOARD_PROTOCOL,
   RESET_TERMINAL_CURSOR_STYLE
 } from '../../../../shared/terminal-mode-reset-profiles'
 import {
@@ -462,7 +461,7 @@ describe('replayPayloadEndsWithCursorHidden', () => {
 describe('buildPostReplayLiveAgentReattachReset', () => {
   it('preserves an intentionally hidden cursor', () => {
     expect(buildPostReplayLiveAgentReattachReset('agent frame\x1b[?25l')).toBe(
-      `${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}`
+      RESET_TERMINAL_CURSOR_STYLE
     )
   })
 
diff --git a/src/renderer/src/components/terminal-pane/pane-helpers.test.ts b/src/renderer/src/components/terminal-pane/pane-helpers.test.ts
index ee962bd49ae..909be3c41a5 100644
--- a/src/renderer/src/components/terminal-pane/pane-helpers.test.ts
+++ b/src/renderer/src/components/terminal-pane/pane-helpers.test.ts
@@ -69,6 +69,8 @@ describe('fitAndFocusPanes', () => {
       )
     }
 
+    matches = vi.fn(() => false)
+
     closest: (selector: string) => Element | null
   }
 
diff --git a/src/renderer/src/components/terminal-pane/pending-split-close.test.ts b/src/renderer/src/components/terminal-pane/pending-split-close.test.ts
index 5a022ef9c99..3ab94611f94 100644
--- a/src/renderer/src/components/terminal-pane/pending-split-close.test.ts
+++ b/src/renderer/src/components/terminal-pane/pending-split-close.test.ts
@@ -191,3 +191,18 @@ it('retires a local folder-workspace split without a git worktree row', async ()
   await p.connecting
   expect(window.api.pty.kill).toHaveBeenCalledTimes(2)
 })
+
+it('commits the explicit split close in main by its leaf without waiting for its write', async () => {
+  const p = await preparePendingSplitClose()
+  // Main's durable write never settles here: the pane must still leave and be killed at once.
+  const closeTerminalSurface = vi.fn(() => new Promise<void>(() => {}))
+  Object.assign(window.api, { session: { ...window.api.session, closeTerminalSurface } })
+  p.actions.executeClosePane(1)
+  expect(closeTerminalSurface).toHaveBeenCalledExactlyOnceWith({
+    worktreeId: 'workspace',
+    target: { kind: 'pane', tabId: p.tabId, leafId: p.leafId }
+  })
+  expect(p.transports.has(1)).toBe(false)
+  expect(p.state.terminalLayoutsByTabId[p.tabId].ptyIdsByLeafId?.[p.leafId]).toBeUndefined()
+  expect(window.api.pty.kill).toHaveBeenCalledExactlyOnceWith('pty-restored')
+})
diff --git a/src/renderer/src/components/terminal-pane/pty-buffer-serializer.test.ts b/src/renderer/src/components/terminal-pane/pty-buffer-serializer.test.ts
index 4adda77cc20..f72596187fb 100644
--- a/src/renderer/src/components/terminal-pane/pty-buffer-serializer.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-buffer-serializer.test.ts
@@ -6,6 +6,7 @@ describe('pty buffer serializer registry', () => {
 
   beforeEach(() => {
     vi.resetModules()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the registry reads only these pty members.
     ;(globalThis as { window: typeof window }).window = {
       ...originalWindow,
       api: {
@@ -13,6 +14,7 @@ describe('pty buffer serializer registry', () => {
         pty: {
           ...originalWindow?.api?.pty,
           onClearBufferRequest: vi.fn(() => () => {}),
+          onResetInputModesRequest: vi.fn(() => () => {}),
           onSerializeBufferRequest: vi.fn(() => () => {}),
           sendSerializedBuffer: vi.fn()
         }
@@ -120,4 +122,16 @@ describe('pty buffer serializer registry', () => {
       expect.objectContaining({ pendingEscapeTailAnsi: '\x1b[38;5;' })
     )
   })
+
+  it("routes a host's Reset Terminal request to the pane that owns the PTY", async () => {
+    const { registerPtySerializer } = await import('./pty-buffer-serializer')
+    const resetInputModes = vi.fn()
+    registerPtySerializer('pty-1', () => null, { resetInputModes })
+    const [[onRequest]] = vi.mocked(window.api.pty.onResetInputModesRequest).mock.calls
+
+    onRequest({ ptyId: 'pty-2' })
+    expect(resetInputModes).not.toHaveBeenCalled()
+    onRequest({ ptyId: 'pty-1' })
+    expect(resetInputModes).toHaveBeenCalledOnce()
+  })
 })
diff --git a/src/renderer/src/components/terminal-pane/pty-buffer-serializer.ts b/src/renderer/src/components/terminal-pane/pty-buffer-serializer.ts
index 35d6a833050..ada99d6cbe8 100644
--- a/src/renderer/src/components/terminal-pane/pty-buffer-serializer.ts
+++ b/src/renderer/src/components/terminal-pane/pty-buffer-serializer.ts
@@ -34,6 +34,7 @@ export type SerializeFn = (
 type SerializerEntry = {
   fn: SerializeFn
   clear?: () => void
+  resetInputModes?: () => void
   owner: symbol
 }
 
@@ -50,10 +51,10 @@ let listenerAttached = false
 export function registerPtySerializer(
   ptyId: string,
   serialize: SerializeFn,
-  clear?: () => void
+  actions: Pick<SerializerEntry, 'clear' | 'resetInputModes'> = {}
 ): () => void {
   const owner = Symbol(ptyId)
-  serializersByPtyId.set(ptyId, { fn: serialize, clear, owner })
+  serializersByPtyId.set(ptyId, { fn: serialize, ...actions, owner })
   ensureSerializerListener()
   return () => {
     const current = serializersByPtyId.get(ptyId)
@@ -116,6 +117,11 @@ export function registerPtyTitleSource(
   }
 }
 
+/** Grounds the pane's own records only; the host grounds its models on its own request. */
+export function resetPtyRendererInputModes(ptyId: string): void {
+  serializersByPtyId.get(ptyId)?.resetInputModes?.()
+}
+
 export function hasPtySerializer(ptyId: string): boolean {
   return serializersByPtyId.has(ptyId)
 }
@@ -133,6 +139,8 @@ function ensureSerializerListener(): void {
     serializersByPtyId.get(request.ptyId)?.clear?.()
   })
 
+  window.api.pty.onResetInputModesRequest((request) => resetPtyRendererInputModes(request.ptyId))
+
   window.api.pty.onSerializeBufferRequest((request) => {
     const entry = serializersByPtyId.get(request.ptyId)
     void Promise.resolve(entry?.fn(request.opts) ?? null)
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-cold-restore-resume-command.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-cold-restore-resume-command.test.ts
index 89bcc7254d1..757f3260fbc 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-cold-restore-resume-command.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-cold-restore-resume-command.test.ts
@@ -457,7 +457,7 @@ describe('connectPanePty', () => {
     ).resolves.toBe("codex '--dangerously-bypass-approvals-and-sandbox' 'resume' 'codex-session-1'")
   })
 
-  it('keeps a contentless reattach when the sleeping record represents a live session', async () => {
+  async function expectLiveNoteKeepsContentlessReattach(state: 'working' | 'done'): Promise<void> {
     const { connectPanePty } = await import('./pty-connection')
     const paneKey = makePaneKey('tab-1', LEAF_2)
     const transport = createMockTransport('restored-session')
@@ -488,6 +488,7 @@ describe('connectPanePty', () => {
         }
       }
     } as StoreState
+    Object.assign(mockStoreState.sleepingAgentSessionsByPaneKey[paneKey] ?? {}, { state })
     const pane = createPane(2)
     const manager = createManager(2)
     const deps = createDeps({
@@ -502,7 +503,13 @@ describe('connectPanePty', () => {
     expect(transport.disconnect).not.toHaveBeenCalled()
     expect(deps.syncPanePtyLayoutBinding).toHaveBeenCalledWith(2, 'restored-session')
     expect(mockStoreState.clearSleepingAgentSession).not.toHaveBeenCalled()
-  })
+  }
+
+  // Why: a live note is the idle anchor of a running pane, done or not, never hibernation evidence.
+  it.each(['working', 'done'] as const)(
+    'keeps a contentless reattach when a live-origin %s note represents a running session',
+    expectLiveNoteKeepsContentlessReattach
+  )
 
   it('keeps a contentless reattach when a live status supersedes passive sleep evidence', async () => {
     const { connectPanePty } = await import('./pty-connection')
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-command-finished-cleanup.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-command-finished-cleanup.test.ts
index 279f99d3ede..45a603f9e7f 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-command-finished-cleanup.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-command-finished-cleanup.test.ts
@@ -1,6 +1,7 @@
 import type * as React from 'react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { POST_REPLAY_REATTACH_RESET } from '../../../../shared/terminal-mode-reset-profiles'
+import { TerminalKittyKeyboardModeTracker } from '../../../../shared/terminal-kitty-keyboard-mode-tracker'
 import { makePaneKey } from '../../../../shared/stable-pane-id'
 import { flushAsyncTicks, createDeferred } from './pty-connection-test-async'
 import {
@@ -532,11 +533,13 @@ describe('connectPanePty', () => {
     const paneKey = makePaneKey('tab-1', LEAF_1)
     const pane = createPane(1)
     const { writes } = captureCallbackTerminalWrites(pane)
+    const deps = createDeps({ isVisibleRef: { current: false } })
 
     connectPanePty(
       pane as never,
       createManager(1) as never,
-      createDeps({ isVisibleRef: { current: false } }) as never
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: fixture types intentionally model the production connection boundary.
+      deps as never
     )
     await vi.advanceTimersByTimeAsync(20)
     await flushAsyncTicks()
@@ -545,11 +548,15 @@ describe('connectPanePty', () => {
       identity: { agentType: 'droid' }
     }
 
+    // The agent negotiates Kitty keys across a chunk split, then dies armed.
+    dataCallbackRef.current?.('\x1b[>')
+    dataCallbackRef.current?.('5u')
     // A SIGKILLed agent emits no mode teardown; only the shell's next prompt
     // mark arrives. The bare 133;D must not disarm yet — the foreground read
     // has not confirmed the agent is gone.
     dataCallbackRef.current?.('\x1b]133;D;0\x07')
     expect(writes.some((w) => w.includes(POST_REPLAY_REATTACH_RESET))).toBe(false)
+    expect(deps.paneKittyKeyboardModesRef.current.get(pane.id)?.flags).toBe(5)
 
     await vi.advanceTimersByTimeAsync(350)
     await flushAsyncTicks()
@@ -559,6 +566,58 @@ describe('connectPanePty', () => {
     // The live shell re-arms bracketed paste at its prompt before the disarm
     // fires; the reset must not strip it.
     expect(disarm).not.toContain('\x1b[?2004l')
+    // Shortcut policy reads the mirror, so it must drop the dead app's flags with xterm.
+    expect(deps.paneKittyKeyboardModesRef.current.get(pane.id)?.flags).toBe(0)
+  })
+
+  it('grounds xterm and the input mirror in stream order when output is still queued', async () => {
+    vi.useFakeTimers()
+    const { connectPanePty } = await import('./pty-connection')
+    const confirmRead = createDeferred<string>()
+    vi.mocked(window.api.pty.confirmForegroundProcess).mockReturnValue(confirmRead.promise)
+    const dataCallbackRef: { current: ((data: string) => void) | null } = { current: null }
+    const ptyId = 'pty-stale-mode-queued-output'
+    const transport = createMockTransport(ptyId)
+    transport.connect.mockImplementation(async ({ callbacks }: { callbacks: ConnectCallbacks }) => {
+      dataCallbackRef.current = callbacks.onData ?? null
+      return { id: ptyId }
+    })
+    transportFactoryQueue.push(transport)
+    const paneKey = makePaneKey('tab-1', LEAF_1)
+    const pane = createPane(1)
+    const { writes } = captureCallbackTerminalWrites(pane)
+    const deps = createDeps({ isVisibleRef: { current: false } })
+
+    connectPanePty(
+      pane as never,
+      createManager(1) as never,
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: fixture types intentionally model the production connection boundary.
+      deps as never
+    )
+    await vi.advanceTimersByTimeAsync(20)
+    await flushAsyncTicks()
+    mockStoreState.agentLaunchConfigByPaneKey[paneKey] = {
+      launchConfig: { agentArgs: '', agentEnv: {} },
+      identity: { agentType: 'droid' }
+    }
+    dataCallbackRef.current?.('\x1b]133;D;0\x07')
+    await vi.advanceTimersByTimeAsync(350)
+    await flushAsyncTicks()
+    expect(window.api.pty.confirmForegroundProcess).toHaveBeenCalled()
+
+    // Hidden-pane output sits in the background queue when the shell proof lands.
+    dataCallbackRef.current?.('\x1b[>5u')
+    expect(writes.some((w) => w.includes('\x1b[>5u'))).toBe(false)
+    confirmRead.resolve('bash')
+    await flushAsyncTicks()
+    await vi.advanceTimersByTimeAsync(100)
+
+    // Parsing what xterm received, in order, must match the mirror.
+    const xtermView = new TerminalKittyKeyboardModeTracker()
+    writes.forEach((write) => xtermView.scan(write))
+    expect(writes.some((w) => w.includes(POST_REPLAY_REATTACH_RESET))).toBe(true)
+    expect(deps.paneKittyKeyboardModesRef.current.get(pane.id)?.flags).toBe(0)
+    expect(xtermView.flags).toBe(0)
   })
 
   it('keeps armed modes while the agent still owns the foreground after a leaked 133;D', async () => {
@@ -576,11 +635,13 @@ describe('connectPanePty', () => {
     const paneKey = makePaneKey('tab-1', LEAF_1)
     const pane = createPane(1)
     const { writes } = captureCallbackTerminalWrites(pane)
+    const deps = createDeps({ isVisibleRef: { current: false } })
 
     connectPanePty(
       pane as never,
       createManager(1) as never,
-      createDeps({ isVisibleRef: { current: false } }) as never
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: fixture types intentionally model the production connection boundary.
+      deps as never
     )
     await vi.advanceTimersByTimeAsync(20)
     await flushAsyncTicks()
@@ -589,6 +650,7 @@ describe('connectPanePty', () => {
       identity: { agentType: 'droid' }
     }
 
+    dataCallbackRef.current?.('\x1b[>5u')
     // A full-screen agent's nested command shell leaks a 133;D onto the main
     // PTY; the confirming read republishes the live agent, so its armed
     // mouse/kitty modes must survive untouched.
@@ -597,6 +659,7 @@ describe('connectPanePty', () => {
     await flushAsyncTicks()
 
     expect(writes.some((w) => w.includes(POST_REPLAY_REATTACH_RESET))).toBe(false)
+    expect(deps.paneKittyKeyboardModesRef.current.get(pane.id)?.flags).toBe(5)
   })
 
   it('retires stale routing after unavailable command-finish reads without asserting shell', async () => {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-daemon-snapshot-replay.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-daemon-snapshot-replay.test.ts
index 2a20be95575..088c2c54905 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-daemon-snapshot-replay.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-daemon-snapshot-replay.test.ts
@@ -6,6 +6,7 @@ import {
   POST_REPLAY_REATTACH_RESET,
   RESET_GRAPHIC_RENDITION
 } from '../../../../shared/terminal-mode-reset-profiles'
+import { replayEpilogue } from './pty-connection-test-replay-epilogue'
 import { Terminal } from '@xterm/headless'
 import { flushAsyncTicks, createDeferred, writeHeadlessTerminal } from './pty-connection-test-async'
 import { createRect } from './pty-connection-test-dom'
@@ -192,11 +193,11 @@ describe('connectPanePty', () => {
       expect.any(Function)
     )
     expect(pane.terminal.write).toHaveBeenCalledWith(
-      POST_REPLAY_REATTACH_RESET,
+      replayEpilogue(POST_REPLAY_REATTACH_RESET),
       expect.any(Function)
     )
     expect(pane.terminal.write).not.toHaveBeenCalledWith(
-      POST_REPLAY_MODE_RESET,
+      replayEpilogue(POST_REPLAY_MODE_RESET, 0),
       expect.any(Function)
     )
 
@@ -252,7 +253,7 @@ describe('connectPanePty', () => {
     await flushAsyncTicks(20)
 
     expect(pane.terminal.write).toHaveBeenCalledWith(
-      POST_REPLAY_DEAD_TUI_RESET,
+      replayEpilogue(POST_REPLAY_DEAD_TUI_RESET),
       expect.any(Function)
     )
   })
@@ -461,7 +462,7 @@ describe('connectPanePty', () => {
     expect(writes.join('')).toContain('RESTORE-LIVE-STATE')
     expect(writes.join('')).not.toContain('ALT-FRAME-BODY')
     expect(writes).toContain(`${RESET_GRAPHIC_RENDITION}PREFIX-SCROLLBACKRESTORE-LIVE-STATE`)
-    expect(writes).toContain(POST_REPLAY_MODE_RESET)
+    expect(writes).toContain(replayEpilogue(POST_REPLAY_MODE_RESET, 0))
   })
 
   it('resizes the pane to the snapshot grid before replaying daemon snapshot bytes (bug #7279)', async () => {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-foreground-write-path.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-foreground-write-path.test.ts
index 743f06f6f42..f2dfe0bd637 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-foreground-write-path.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-foreground-write-path.test.ts
@@ -240,7 +240,7 @@ describe('connectPanePty', () => {
 
     const forward = deferPtyInput.mock.calls[0]?.[2] as (data: string) => void
     forward('a')
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
   })
 
   it('forwards terminal input directly when the host supplies no deferPtyInput', async () => {
@@ -253,7 +253,7 @@ describe('connectPanePty', () => {
     await flushAsyncTicks()
     sendTerminalInputThroughPane(pane, 'a')
 
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
   })
 
   it('keeps large ANSI redraws after captured shortcut input on the immediate path', async () => {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-fresh-spawn-guards.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-fresh-spawn-guards.test.ts
index d6d7246f017..408ce503b7e 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-fresh-spawn-guards.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-fresh-spawn-guards.test.ts
@@ -177,28 +177,6 @@ describe('connectPanePty', () => {
     )
   })
 
-  // Why: a late exit from a replaced PTY skips onExit's kitty reset, so a fresh spawn must reset the reused per-pane tracker itself or restart-in-place leaks old kitty flags.
-  it('resets a stale kitty keyboard mirror when spawning a fresh PTY', async () => {
-    const { connectPanePty } = await import('./pty-connection')
-    const { TerminalKittyKeyboardModeTracker } =
-      await import('../../../../shared/terminal-kitty-keyboard-mode-tracker')
-    const transport = createMockTransport()
-    transportFactoryQueue.push(transport)
-    const staleTracker = new TerminalKittyKeyboardModeTracker()
-    staleTracker.scan('\x1b[>1u')
-    expect(staleTracker.flags).toBe(1)
-    // Why: a unique tab id keeps this pane's key clear of other tests' pendingSpawnByPaneKey entries so the connect deterministically fresh-spawns.
-    const deps = createDeps({
-      tabId: 'tab-kitty-fresh-spawn',
-      paneKittyKeyboardModesRef: { current: new Map([[91, staleTracker]]) }
-    })
-
-    connectPanePty(createPane(91) as never, createManager(91) as never, deps as never)
-    await flushAsyncTicks()
-
-    expect(staleTracker.flags).toBe(0)
-  })
-
   // Why: deleting a worktree kills its PTYs for the filesystem teardown; the
   // renderer must not race a doomed respawn into a directory main is deleting
   // (main fences it with TerminalRemovalInProgressError and the pane is about to
@@ -221,6 +199,44 @@ describe('connectPanePty', () => {
     expect(deps.onPtyErrorRef.current).not.toHaveBeenCalled()
   })
 
+  // The disposed-spawn kill in ipc-pty-connect asks this callback before retiring a PTY; it must
+  // answer from the live store, or a remounted pane's shell dies under it.
+  it('lets a disposed spawn survive while the pane surface still exists in the store', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport()
+    transportFactoryQueue.push(transport)
+    const deps = createDeps({ tabId: 'tab-retain-disposed-spawn' })
+    mockStoreState = {
+      ...mockStoreState,
+      tabsByWorktree: { 'wt-1': [{ id: 'tab-retain-disposed-spawn', ptyId: null }] }
+    }
+
+    connectPanePty(createPane(1) as never, createManager(1) as never, deps as never)
+    await flushAsyncTicks()
+
+    const retain = createdTransportOptions[0]?.retainDisposedSpawn
+    if (typeof retain !== 'function') {
+      throw new Error('pane transport was built without retainDisposedSpawn')
+    }
+    expect(retain()).toBe(true)
+    mockStoreState = {
+      ...mockStoreState,
+      deleteStateByWorktreeId: { 'wt-1': { isDeleting: true, phase: 'deleting' } }
+    }
+    expect(retain()).toBe(false)
+    mockStoreState = {
+      ...mockStoreState,
+      deleteStateByWorktreeId: { 'local|wt-1': { isDeleting: true, phase: 'deleting' } }
+    }
+    expect(retain()).toBe(false)
+    mockStoreState = {
+      ...mockStoreState,
+      deleteStateByWorktreeId: {},
+      tabsByWorktree: { 'wt-1': [] }
+    }
+    expect(retain()).toBe(false)
+  })
+
   it('fresh-spawns normally when the pane worktree is not being deleted', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport()
@@ -452,7 +468,7 @@ describe('connectPanePty', () => {
     // Released (via the guard's fallback or parse completion): input flows again.
     deps.replayingPanesRef.current.delete(pane.id)
     sendTerminalInputThroughPane(pane, 'echo hi\r')
-    expect(transport.sendInput).toHaveBeenCalledWith('echo hi\r')
+    expect(transport.sendInput).toHaveBeenCalledWith('echo hi\r', 'query-reply')
   })
 
   it('preserves classified user input during replay while suppressing synthetic replies', async () => {
@@ -495,7 +511,7 @@ describe('connectPanePty', () => {
     for (const forward of deferred.splice(0)) {
       forward()
     }
-    expect(transport.sendInput).toHaveBeenCalledExactlyOnceWith('input_under_flood\r')
+    expect(transport.sendInput).toHaveBeenCalledExactlyOnceWith('input_under_flood\r', 'driving')
 
     // A wheel over a replayed alt-screen frame becomes cursor keys; the fresh shell must not recall history from them.
     pane.terminal.buffer.active.type = 'alternate'
@@ -506,7 +522,7 @@ describe('connectPanePty', () => {
     for (const forward of deferred.splice(0)) {
       forward()
     }
-    expect(transport.sendInput).toHaveBeenCalledExactlyOnceWith('input_under_flood\r')
+    expect(transport.sendInput).toHaveBeenCalledExactlyOnceWith('input_under_flood\r', 'driving')
 
     // The same bytes on the normal buffer can only be a keyboard arrow, which survives replay.
     pane.terminal.buffer.active.type = 'normal'
@@ -518,7 +534,7 @@ describe('connectPanePty', () => {
       forward()
     }
     expect(transport.sendInput).toHaveBeenCalledTimes(2)
-    expect(transport.sendInput).toHaveBeenLastCalledWith('\x1b[B')
+    expect(transport.sendInput).toHaveBeenLastCalledWith('\x1b[B', 'driving')
 
     // Once the guard releases, the same mouse report is ordinary input again.
     deps.replayingPanesRef.current.delete(pane.id)
@@ -529,7 +545,7 @@ describe('connectPanePty', () => {
     for (const forward of deferred.splice(0)) {
       forward()
     }
-    expect(transport.sendInput).toHaveBeenLastCalledWith('\x1b[<0;12;4M')
+    expect(transport.sendInput).toHaveBeenLastCalledWith('\x1b[<0;12;4M', 'driving')
   })
 
   it('settles a queued startup only after the pane binds its spawned PTY', async () => {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-hibernation-wake.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-hibernation-wake.test.ts
index 7aa4de64a1d..7855e756226 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-hibernation-wake.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-hibernation-wake.test.ts
@@ -209,6 +209,52 @@ describe('connectPanePty', () => {
     expect(transport.connect.mock.calls.length).toBe(connectCallsAfterWake)
   })
 
+  // Why: pins #16308's incidental effect. Hibernation writes a worktree-sleep note, yet any
+  // suppressed exit over a finished turn's live idle anchor now arms a resume on reveal.
+  it('arms an in-place resume from a finished turn idle anchor on a suppressed exit', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport('pty-pane-2')
+    transportFactoryQueue.push(transport)
+    const deps = createDeps({
+      consumeSuppressedPtyExit: vi.fn(() => true),
+      isVisibleRef: { current: false }
+    })
+    const pane = createPane(2)
+    const paneKey = `tab-1:${leafIdForPane(2)}`
+    mockStoreState.sleepingAgentSessionsByPaneKey[paneKey] = {
+      paneKey,
+      tabId: 'tab-1',
+      worktreeId: 'wt-1',
+      agent: 'claude',
+      providerSession: { key: 'session_id', id: 'sess-idle-anchor' },
+      prompt: '',
+      state: 'done',
+      capturedAt: 1,
+      updatedAt: 1,
+      origin: 'live'
+    }
+    mockStoreState.suppressedPtyExitIds['tab-pty'] = true
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the fixtures implement the pane, manager and deps members connectPanePty reads.
+    const args = [pane, createManager(1), deps] as unknown as Parameters<typeof connectPanePty>
+    const binding = connectPanePty(...args)
+    await flushAsyncTicks()
+    const onPtyExit = createdTransportOptions[0]?.onPtyExit
+    expect(onPtyExit).toBeTypeOf('function')
+    const connectCallsBeforeExit = transport.connect.mock.calls.length
+    if (typeof onPtyExit === 'function') {
+      onPtyExit('tab-pty')
+    }
+    await flushAsyncTicks()
+
+    binding.noteVisibilityResume()
+    await flushAsyncTicks()
+
+    const resumeConnectOptions: { command?: string } | undefined =
+      transport.connect.mock.calls.at(-1)?.[0]
+    expect(transport.connect.mock.calls.length).toBeGreaterThan(connectCallsBeforeExit)
+    expect(resumeConnectOptions?.command).toContain('sess-idle-anchor')
+  })
+
   it('resumes a hibernated agent from a navigation-free wake without a visibility reveal', async () => {
     // Mobile wake fanout drives wakeHibernatedAgentIfArmed on a still-hidden pane (no isVisible flip): the armed --resume must fire exactly once even if delivered twice (INV-1).
     const { connectPanePty } = await import('./pty-connection')
@@ -692,7 +738,7 @@ describe('connectPanePty', () => {
     sendTerminalInputThroughPane(pane, '\x1b[O')
     expect(mockStoreState.recordTerminalInput).not.toHaveBeenCalled()
     // The reply still reaches the shell; only the activity recording is gated.
-    expect(transport.sendInput).toHaveBeenCalledWith('\x1b[O')
+    expect(transport.sendInput).toHaveBeenCalledWith('\x1b[O', 'query-reply')
 
     // Real user input fires the core signal and records activity.
     for (const listener of userInputListeners) {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-hidden-codex-queries.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-hidden-codex-queries.test.ts
index fe18699c20d..e9443188b95 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-hidden-codex-queries.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-hidden-codex-queries.test.ts
@@ -6,6 +6,7 @@ import {
   POST_REPLAY_LIVE_SNAPSHOT_RESET,
   POST_REPLAY_REATTACH_RESET
 } from '../../../../shared/terminal-mode-reset-profiles'
+import { replayEpilogue } from './pty-connection-test-replay-epilogue'
 import { makePaneKey } from '../../../../shared/stable-pane-id'
 import { flushAsyncTicks } from './pty-connection-test-async'
 import {
@@ -520,15 +521,15 @@ describe('connectPanePty', () => {
 
       // A live agent owns ?1004h (focus reporting); the plain reset's ?1004l would silence focus events until restart, since agents only enable it at startup.
       expect(pane.terminal.write).toHaveBeenCalledWith(
-        POST_REPLAY_LIVE_AGENT_SNAPSHOT_RESET,
+        replayEpilogue(POST_REPLAY_LIVE_AGENT_SNAPSHOT_RESET),
         expect.any(Function)
       )
       expect(pane.terminal.write).not.toHaveBeenCalledWith(
-        POST_REPLAY_LIVE_SNAPSHOT_RESET,
+        replayEpilogue(POST_REPLAY_LIVE_SNAPSHOT_RESET),
         expect.any(Function)
       )
       expect(pane.terminal.write).not.toHaveBeenCalledWith(
-        POST_REPLAY_DEAD_TUI_RESET,
+        replayEpilogue(POST_REPLAY_DEAD_TUI_RESET),
         expect.any(Function)
       )
     } finally {
@@ -583,11 +584,11 @@ describe('connectPanePty', () => {
       await flushAsyncTicks(20)
 
       expect(pane.terminal.write).toHaveBeenCalledWith(
-        POST_REPLAY_DEAD_TUI_RESET,
+        replayEpilogue(POST_REPLAY_DEAD_TUI_RESET),
         expect.any(Function)
       )
       expect(pane.terminal.write).not.toHaveBeenCalledWith(
-        POST_REPLAY_LIVE_AGENT_SNAPSHOT_RESET,
+        replayEpilogue(POST_REPLAY_LIVE_AGENT_SNAPSHOT_RESET),
         expect.any(Function)
       )
     } finally {
@@ -634,15 +635,15 @@ describe('connectPanePty', () => {
       await flushAsyncTicks(20)
 
       expect(pane.terminal.write).toHaveBeenCalledWith(
-        POST_REPLAY_LIVE_SNAPSHOT_RESET,
+        replayEpilogue(POST_REPLAY_LIVE_SNAPSHOT_RESET),
         expect.any(Function)
       )
       expect(pane.terminal.write).not.toHaveBeenCalledWith(
-        POST_REPLAY_REATTACH_RESET,
+        replayEpilogue(POST_REPLAY_REATTACH_RESET),
         expect.any(Function)
       )
       expect(pane.terminal.write).not.toHaveBeenCalledWith(
-        POST_REPLAY_DEAD_TUI_RESET,
+        replayEpilogue(POST_REPLAY_DEAD_TUI_RESET),
         expect.any(Function)
       )
     } finally {
@@ -689,11 +690,11 @@ describe('connectPanePty', () => {
       await flushAsyncTicks(20)
 
       expect(pane.terminal.write).toHaveBeenCalledWith(
-        POST_REPLAY_LIVE_SNAPSHOT_RESET,
+        replayEpilogue(POST_REPLAY_LIVE_SNAPSHOT_RESET),
         expect.any(Function)
       )
       expect(pane.terminal.write).not.toHaveBeenCalledWith(
-        POST_REPLAY_REATTACH_RESET,
+        replayEpilogue(POST_REPLAY_REATTACH_RESET),
         expect.any(Function)
       )
     } finally {
@@ -739,11 +740,11 @@ describe('connectPanePty', () => {
       await flushAsyncTicks(20)
 
       expect(pane.terminal.write).toHaveBeenCalledWith(
-        POST_REPLAY_DEAD_TUI_RESET,
+        replayEpilogue(POST_REPLAY_DEAD_TUI_RESET),
         expect.any(Function)
       )
       expect(pane.terminal.write).not.toHaveBeenCalledWith(
-        POST_REPLAY_LIVE_SNAPSHOT_RESET,
+        replayEpilogue(POST_REPLAY_LIVE_SNAPSHOT_RESET),
         expect.any(Function)
       )
       expect(window.api.pty.inspectProcess).not.toHaveBeenCalled()
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-hook-completion-bell-arbitration.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-hook-completion-bell-arbitration.test.ts
index e315563f0c6..ef49288f3eb 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-hook-completion-bell-arbitration.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-hook-completion-bell-arbitration.test.ts
@@ -528,7 +528,7 @@ describe('connectPanePty', () => {
       'terminal-bell'
     )
     expect(deps.clearTerminalPaneUnread).not.toHaveBeenCalled()
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
   })
 
   // Why: xterm auto-replies during replay must not count as user interaction, or a BELed pane would self-dismiss unseen.
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-hook-completion-side-effects.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-hook-completion-side-effects.test.ts
index e61460ee490..2845be5a64d 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-hook-completion-side-effects.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-hook-completion-side-effects.test.ts
@@ -1,9 +1,6 @@
 import type * as React from 'react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import {
-  RESET_KITTY_KEYBOARD_PROTOCOL,
-  RESET_TERMINAL_CURSOR_STYLE
-} from '../../../../shared/terminal-mode-reset-profiles'
+import { RESET_TERMINAL_CURSOR_STYLE } from '../../../../shared/terminal-mode-reset-profiles'
 import { makePaneKey } from '../../../../shared/stable-pane-id'
 import { flushAsyncTicks } from './pty-connection-test-async'
 import { AGENT_TASK_COMPLETE_NOTIFICATION_MAX_WAIT_MS } from './pty-connection-test-constants'
@@ -456,15 +453,15 @@ describe('connectPanePty', () => {
         expect(deps.dispatchNotification).toHaveBeenCalledWith(expectedNotification)
       }
       expect(pane.terminal.write).toHaveBeenCalledWith(
-        `${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}`,
+        RESET_TERMINAL_CURSOR_STYLE,
         expect.any(Function)
       )
       transport.sendInput.mockClear()
       sendTerminalInputThroughPane(pane, '\x1b[I')
       sendTerminalInputThroughPane(pane, '\x7f')
       expect(transport.sendInput).toHaveBeenCalledTimes(2)
-      expect(transport.sendInput).toHaveBeenNthCalledWith(1, '\x1b[I')
-      expect(transport.sendInput).toHaveBeenLastCalledWith('\x7f')
+      expect(transport.sendInput).toHaveBeenNthCalledWith(1, '\x1b[I', 'query-reply')
+      expect(transport.sendInput).toHaveBeenLastCalledWith('\x7f', 'query-reply')
     } finally {
       restoreUserAgent()
     }
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-hook-idle-arbitration.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-hook-idle-arbitration.test.ts
index 1b6cfd4f049..e7af721d19a 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-hook-idle-arbitration.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-hook-idle-arbitration.test.ts
@@ -225,7 +225,7 @@ describe('connectPanePty', () => {
         agentToolName: 'Edit',
         agentToolInput: 'src/main/ipc/notifications.ts',
         agentLastAssistantMessage: 'Implemented the formatter.',
-        agentInterrupted: false
+        agentTurnOutcome: undefined
       })
     )
   })
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-interrupt-inference.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-interrupt-inference.test.ts
index 4b1f376b773..7e9034c1d61 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-interrupt-inference.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-interrupt-inference.test.ts
@@ -364,7 +364,7 @@ describe('connectPanePty', () => {
     vi.advanceTimersByTime(500)
     await flushAsyncTicks()
 
-    expect(transport.sendInput).toHaveBeenCalledWith('\x03')
+    expect(transport.sendInput).toHaveBeenCalledWith('\x03', 'query-reply')
     expect(window.api.agentStatus.inferInterrupt).not.toHaveBeenCalled()
     expect(deps.setRuntimePaneTitle).not.toHaveBeenCalled()
     expect(deps.updateTabTitle).not.toHaveBeenCalled()
@@ -478,7 +478,7 @@ describe('connectPanePty', () => {
     vi.advanceTimersByTime(500)
     await flushAsyncTicks()
 
-    expect(transport.sendInputAccepted).toHaveBeenCalledWith('\x1b[99;5u')
+    expect(transport.sendInputAccepted).toHaveBeenCalledWith('\x1b[99;5u', 'query-reply')
     expect(window.api.agentStatus.inferInterrupt).toHaveBeenCalledWith({
       paneKey,
       baselineUpdatedAt: 1_000,
@@ -652,7 +652,7 @@ describe('connectPanePty', () => {
     vi.advanceTimersByTime(500)
     await flushAsyncTicks()
 
-    expect(transport.sendInput).toHaveBeenCalledWith('\x03')
+    expect(transport.sendInput).toHaveBeenCalledWith('\x03', 'query-reply')
     expect(window.api.agentStatus.inferInterrupt).not.toHaveBeenCalled()
   })
 
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-kitty-keyboard-restore.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-kitty-keyboard-restore.test.ts
new file mode 100644
index 00000000000..9faaaf10eb3
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-connection-kitty-keyboard-restore.test.ts
@@ -0,0 +1,233 @@
+import type * as React from 'react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  POST_REPLAY_REATTACH_RESET,
+  PROCESS_BOUNDARY_GROUND
+} from '../../../../shared/terminal-mode-reset-profiles'
+import { TerminalKittyKeyboardModeTracker } from '../../../../shared/terminal-kitty-keyboard-mode-tracker'
+import { replayEpilogue } from './pty-connection-test-replay-epilogue'
+import { flushAsyncTicks } from './pty-connection-test-async'
+import {
+  LEAF_1,
+  createMockTransport,
+  createPane,
+  createManager,
+  type MockTransport
+} from './pty-connection-test-pane-fixtures'
+import { buildPaneConnectionDeps } from './pty-connection-test-deps'
+import { createInitialStoreState } from './pty-connection-test-store-fixtures'
+import type { StoreState } from './pty-connection-test-store-state'
+import {
+  installTerminalTestGlobals,
+  restoreTerminalTestGlobals
+} from './pty-connection-test-environment'
+
+const {
+  resetAndRefreshAllTerminalWebglAtlases,
+  scheduleTerminalWebglAtlasRecovery,
+  scheduleRuntimeGraphSync,
+  shouldSeedCacheTimerOnInitialTitle,
+  toastInfo,
+  notifyCodexPaneBoundForStaleSweep
+} = vi.hoisted(() => ({
+  resetAndRefreshAllTerminalWebglAtlases: vi.fn(),
+  scheduleTerminalWebglAtlasRecovery: vi.fn(),
+  scheduleRuntimeGraphSync: vi.fn(),
+  shouldSeedCacheTimerOnInitialTitle: vi.fn(() => false),
+  toastInfo: vi.fn(),
+  notifyCodexPaneBoundForStaleSweep: vi.fn()
+}))
+
+let mockStoreState: StoreState
+let transportFactoryQueue: MockTransport[] = []
+let createdTransportOptions: Record<string, unknown>[] = []
+let storeSubscribers: ((state: StoreState) => void)[] = []
+
+vi.mock('@/runtime/sync-runtime-graph', () => ({
+  scheduleRuntimeGraphSync
+}))
+
+vi.mock('@/lib/pane-manager/pane-manager-registry', async (importOriginal) => ({
+  ...(await importOriginal<Record<string, unknown>>()),
+  resetAndRefreshAllTerminalWebglAtlases
+}))
+
+vi.mock('./terminal-webgl-atlas-recovery', () => ({
+  scheduleTerminalWebglAtlasRecovery
+}))
+
+vi.mock('@/store', () => ({
+  useAppStore: {
+    getState: () => mockStoreState,
+    subscribe: (listener: (state: StoreState) => void) => {
+      storeSubscribers.push(listener)
+      return () => {
+        storeSubscribers = storeSubscribers.filter((candidate) => candidate !== listener)
+      }
+    }
+  }
+}))
+
+vi.mock('@/lib/agent-status', async (importOriginal) => {
+  const { buildAgentStatusModuleMock } = await import('./pty-connection-test-environment')
+  return buildAgentStatusModuleMock(await importOriginal<Record<string, unknown>>())
+})
+
+vi.mock('./cache-timer-seeding', () => ({
+  shouldSeedCacheTimerOnInitialTitle
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    info: toastInfo
+  }
+}))
+
+vi.mock('@/lib/codex-stale-pane-sweep', () => ({
+  notifyCodexPaneBoundForStaleSweep
+}))
+
+// Why: the working→idle test invokes the real useNotificationDispatch hook outside React, so useCallback must pass through (safe suite-wide: no test here renders React).
+vi.mock('react', async (importOriginal) => {
+  const actual = await importOriginal<typeof React>()
+  return {
+    ...actual,
+    useCallback: <T extends (...args: unknown[]) => unknown>(fn: T): T => fn
+  }
+})
+
+vi.mock('./pty-transport', () => ({
+  createIpcPtyTransport: vi.fn((options: Record<string, unknown>) => {
+    createdTransportOptions.push(options)
+    const nextTransport = transportFactoryQueue.shift()
+    if (!nextTransport) {
+      throw new Error('No mock transport queued')
+    }
+    return nextTransport
+  })
+}))
+
+vi.mock('./remote-runtime-pty-transport', () => ({
+  createRemoteRuntimePtyTransport: vi.fn(
+    (_environmentId: string, options: Record<string, unknown>) => {
+      createdTransportOptions.push(options)
+      const nextTransport = transportFactoryQueue.shift()
+      if (!nextTransport) {
+        throw new Error('No mock transport queued')
+      }
+      return nextTransport
+    }
+  )
+}))
+
+// Why: stub only getEagerPtyBufferHandle so tests can simulate a live eager buffer (adopt path) without standing up the real IPC dispatcher.
+vi.mock('./pty-dispatcher', async (importOriginal) => {
+  const actual = await importOriginal<Record<string, unknown>>()
+  return {
+    ...actual,
+    getEagerPtyBufferHandle: vi.fn(() => undefined)
+  }
+})
+
+function createDeps(overrides: Record<string, unknown> = {}) {
+  return buildPaneConnectionDeps(() => mockStoreState, overrides)
+}
+
+// Why: xterm and the pane mirror must end every restore on the same kitty flags.
+describe('connectPanePty kitty keyboard restore', () => {
+  beforeEach(() => {
+    vi.resetModules()
+    vi.clearAllMocks()
+    transportFactoryQueue = []
+    createdTransportOptions = []
+    storeSubscribers = []
+    mockStoreState = createInitialStoreState(() => mockStoreState)
+    installTerminalTestGlobals()
+  })
+
+  afterEach(async () => {
+    await restoreTerminalTestGlobals()
+  })
+
+  async function reattachWithSnapshotFlags(kittyKeyboard: boolean) {
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport('tab-pty')
+    transport.connect.mockImplementation(async ({ sessionId }: { sessionId?: string }) =>
+      sessionId
+        ? {
+            id: sessionId,
+            snapshot: 'live app frame',
+            snapshotKittyKeyboardFlags: 31,
+            snapshotSeq: 7
+          }
+        : null
+    )
+    transportFactoryQueue.push(transport)
+    const pane = createPane(1)
+    pane.terminal.options.vtExtensions.kittyKeyboard = kittyKeyboard
+    const deps = createDeps({
+      restoredLeafId: LEAF_1,
+      restoredPtyIdByLeafId: { [LEAF_1]: 'tab-pty' }
+    })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: pane-connection mocks cover the members connectPanePty reads.
+    connectPanePty(pane as never, createManager(1) as never, deps as never)
+    await flushAsyncTicks(20)
+    return { pane, mirror: deps.paneKittyKeyboardModesRef.current.get(pane.id) }
+  }
+
+  it("restores a live app's host-proven flags into xterm and the mirror on reattach", async () => {
+    const { pane, mirror } = await reattachWithSnapshotFlags(true)
+
+    expect(pane.terminal.write).toHaveBeenCalledWith(
+      `${POST_REPLAY_REATTACH_RESET}\x1b[<99u\x1b[=31u`,
+      expect.any(Function)
+    )
+    expect(mirror?.flags).toBe(31)
+  })
+
+  // Why: xterm ignores CSI u while the protocol is withheld (ConPTY), so its mirror must too.
+  it('keeps a withheld-protocol pane at 0 in both records despite host flags', async () => {
+    const { pane, mirror } = await reattachWithSnapshotFlags(false)
+
+    expect(pane.terminal.write).toHaveBeenCalledWith(
+      replayEpilogue(POST_REPLAY_REATTACH_RESET),
+      expect.any(Function)
+    )
+    expect(mirror?.flags).toBe(0)
+  })
+
+  it('grounds xterm and the mirror with one scanned write before a restart-in-place spawns', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    transportFactoryQueue.push(createMockTransport())
+    const pane = createPane(91)
+    // Why: a unique tab id keeps this pane's key clear of other tests' pendingSpawnByPaneKey entries so the connect deterministically fresh-spawns.
+    const deps = createDeps({ tabId: 'tab-kitty-fresh-spawn' })
+    // The pane's previous occupant left the alternate screen and kitty flags on.
+    const mirror = new TerminalKittyKeyboardModeTracker()
+    mirror.scan('\x1b[?1049h\x1b[>5u')
+    deps.paneKittyKeyboardModesRef.current.set(pane.id, mirror)
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: pane-connection mocks cover the members connectPanePty reads.
+    connectPanePty(pane as never, createManager(91) as never, deps as never)
+    await flushAsyncTicks(20)
+
+    expect(pane.terminal.write).toHaveBeenCalledWith(PROCESS_BOUNDARY_GROUND, expect.any(Function))
+    expect(mirror.snapshotFlags).toBe(0)
+    expect(mirror.isAlternateScreen).toBe(false)
+  })
+
+  it('grounds xterm and the mirror together on Reset Terminal and asks the host to ground', async () => {
+    const { pane, mirror } = await reattachWithSnapshotFlags(true)
+    expect(mirror?.flags).toBe(31)
+    const { resetTerminalInputModes } = await import('./terminal-input-mode-reset')
+
+    resetTerminalInputModes('tab-pty')
+
+    expect(pane.terminal.write).toHaveBeenLastCalledWith(
+      PROCESS_BOUNDARY_GROUND,
+      expect.any(Function)
+    )
+    expect(mirror?.flags).toBe(0)
+    expect(window.api.pty.resetInputModes).toHaveBeenCalledWith('tab-pty')
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-parked-ssh-snapshot.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-parked-ssh-snapshot.test.ts
index 39191d5d36a..84043771908 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-parked-ssh-snapshot.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-parked-ssh-snapshot.test.ts
@@ -4,6 +4,7 @@ import {
   POST_REPLAY_REATTACH_RESET,
   RESET_GRAPHIC_RENDITION
 } from '../../../../shared/terminal-mode-reset-profiles'
+import { replayEpilogue } from './pty-connection-test-replay-epilogue'
 import { toAppSshPtyId } from '../../../../shared/ssh-pty-id'
 import type { SshConnectionState } from '../../../../shared/ssh-types'
 import { flushAsyncTicks, createDeferred } from './pty-connection-test-async'
@@ -209,7 +210,7 @@ describe('connectPanePty', () => {
     // Why: the relay's replay buffer holds full history, so clear xterm before writing to avoid duplicating prior-session content.
     expect(writes).toContain(`${RESET_GRAPHIC_RENDITION}\x1b[2J\x1b[3J\x1b[H`)
     expect(writes).toContain('restored-ssh-output')
-    expect(writes).toContain(POST_REPLAY_REATTACH_RESET)
+    expect(writes).toContain(replayEpilogue(POST_REPLAY_REATTACH_RESET))
     expect(api.pty.signal).toHaveBeenCalledWith('leaf-session', 'SIGWINCH')
   })
 
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-pi-synchronized-input.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-pi-synchronized-input.test.ts
index a7917a1ccdf..173c721d25c 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-pi-synchronized-input.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-pi-synchronized-input.test.ts
@@ -164,8 +164,8 @@ describe('connectPanePty', () => {
       const pane = createPane(1)
       const synchronizedOutput = { synchronizedOutput: false }
       const renderRows = vi.fn()
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: test fixture exposes xterm's private render state to observe the DEC 2026 present.
       ;(
-        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: test fixture exposes xterm's private render state to observe the DEC 2026 present.
         pane.terminal as unknown as {
           _core: {
             coreService: { decPrivateModes: typeof synchronizedOutput }
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-reattach-mode-reset.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-reattach-mode-reset.test.ts
index 99c54dad2eb..6c22586b59f 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-reattach-mode-reset.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-reattach-mode-reset.test.ts
@@ -7,9 +7,9 @@ import {
   POST_REPLAY_REATTACH_RESET,
   POST_REPLAY_REATTACH_RESET_KEEP_MOUSE,
   RESET_GRAPHIC_RENDITION,
-  RESET_KITTY_KEYBOARD_PROTOCOL,
   RESET_TERMINAL_CURSOR_STYLE
 } from '../../../../shared/terminal-mode-reset-profiles'
+import { replayEpilogue } from './pty-connection-test-replay-epilogue'
 import { flushAsyncTicks } from './pty-connection-test-async'
 import {
   withMockedDocumentActiveElement,
@@ -275,8 +275,8 @@ describe('connectPanePty', () => {
     transport.sendInputImmediate.mockClear()
     sendTerminalInputThroughPane(pane, 'yes')
     sendTerminalInputThroughPane(pane, '\x1b[A') // arrow-key auto-repeat stays batched
-    expect(transport.sendInput).toHaveBeenCalledWith('yes')
-    expect(transport.sendInput).toHaveBeenCalledWith('\x1b[A')
+    expect(transport.sendInput).toHaveBeenCalledWith('yes', 'query-reply')
+    expect(transport.sendInput).toHaveBeenCalledWith('\x1b[A', 'query-reply')
     expect(transport.sendInputImmediate).not.toHaveBeenCalled()
 
     // terminal-query-reply.test proves real xterm emits this as one framed onData reply; this pins it to the immediate path.
@@ -291,7 +291,7 @@ describe('connectPanePty', () => {
     const printableInputs = [']10;hello', '>|xterm.js(6.1.0-beta.287)', ']|literal-text']
     for (const data of printableInputs) {
       sendTerminalInputThroughPane(pane, data)
-      expect(transport.sendInput).toHaveBeenCalledWith(data)
+      expect(transport.sendInput).toHaveBeenCalledWith(data, 'query-reply')
     }
     expect(transport.sendInputImmediate).not.toHaveBeenCalled()
   })
@@ -368,10 +368,10 @@ describe('connectPanePty', () => {
       connectPanePty(pane as never, manager as never, deps as never)
       await flushAsyncTicks(20)
 
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I')
+      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I', 'query-reply')
       // Snapshot ends with ?25l (Cursor Agent parks/hides the cursor); the reset must preserve it, not force ?25h, or a stray block paints.
       expect(pane.terminal.write).toHaveBeenCalledWith(
-        `${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}`,
+        replayEpilogue(RESET_TERMINAL_CURSOR_STYLE),
         expect.any(Function)
       )
       const writes = (pane.terminal.write as ReturnType<typeof vi.fn>).mock.calls.map(
@@ -411,11 +411,11 @@ describe('connectPanePty', () => {
     await flushAsyncTicks(20)
 
     expect(pane.terminal.write).toHaveBeenCalledWith(
-      POST_REPLAY_DEAD_TUI_RESET,
+      replayEpilogue(POST_REPLAY_DEAD_TUI_RESET),
       expect.any(Function)
     )
     expect(pane.terminal.write).not.toHaveBeenCalledWith(
-      POST_REPLAY_LIVE_AGENT_REATTACH_RESET,
+      replayEpilogue(POST_REPLAY_LIVE_AGENT_REATTACH_RESET),
       expect.any(Function)
     )
   })
@@ -459,8 +459,8 @@ describe('connectPanePty', () => {
       expect(writes).toContain(
         `${RESET_GRAPHIC_RENDITION}\x1b[?1003h\x1b[?1006h\x1b[?2004huser@host ~ $ `
       )
-      expect(writes).toContain(POST_REPLAY_MODE_RESET)
-      expect(writes).not.toContain(POST_REPLAY_LIVE_AGENT_REATTACH_RESET)
+      expect(writes).toContain(replayEpilogue(POST_REPLAY_MODE_RESET, 0))
+      expect(writes).not.toContain(replayEpilogue(POST_REPLAY_LIVE_AGENT_REATTACH_RESET))
     })
   })
 
@@ -512,11 +512,11 @@ describe('connectPanePty', () => {
       )
       const output = writes.join('')
       const snapshotIndex = output.indexOf('\x1b[?1003h\x1b[?1006h\x1b[?2004huser@host ~ $ ')
-      const resetIndex = output.indexOf(POST_REPLAY_MODE_RESET)
+      const resetIndex = output.indexOf(replayEpilogue(POST_REPLAY_MODE_RESET, 0))
       expect(snapshotIndex).toBeGreaterThanOrEqual(0)
       expect(resetIndex).toBeGreaterThan(snapshotIndex)
-      expect(writes).toContain(POST_REPLAY_MODE_RESET)
-      expect(writes).not.toContain(POST_REPLAY_LIVE_AGENT_REATTACH_RESET)
+      expect(writes).toContain(replayEpilogue(POST_REPLAY_MODE_RESET, 0))
+      expect(writes).not.toContain(replayEpilogue(POST_REPLAY_LIVE_AGENT_REATTACH_RESET))
     })
   })
 
@@ -547,7 +547,7 @@ describe('connectPanePty', () => {
       await flushAsyncTicks(20)
 
       expect(pane.terminal.write).toHaveBeenCalledWith(
-        POST_REPLAY_LIVE_AGENT_REATTACH_RESET,
+        replayEpilogue(POST_REPLAY_LIVE_AGENT_REATTACH_RESET),
         expect.any(Function)
       )
     })
@@ -581,7 +581,7 @@ describe('connectPanePty', () => {
 
       expect(transport.sendInput).not.toHaveBeenCalledWith('\x1b[I')
       expect(pane.terminal.write).toHaveBeenCalledWith(
-        `${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}`,
+        replayEpilogue(RESET_TERMINAL_CURSOR_STYLE),
         expect.any(Function)
       )
     })
@@ -614,11 +614,11 @@ describe('connectPanePty', () => {
 
       expect(transport.sendInput).not.toHaveBeenCalledWith('\x1b[I')
       expect(pane.terminal.write).toHaveBeenCalledWith(
-        POST_REPLAY_REATTACH_RESET,
+        replayEpilogue(POST_REPLAY_REATTACH_RESET),
         expect.any(Function)
       )
       expect(pane.terminal.write).not.toHaveBeenCalledWith(
-        POST_REPLAY_LIVE_AGENT_REATTACH_RESET,
+        replayEpilogue(POST_REPLAY_LIVE_AGENT_REATTACH_RESET),
         expect.any(Function)
       )
     })
@@ -650,7 +650,8 @@ describe('connectPanePty', () => {
         .map((call) => String(call[0]))
         .find(
           (data) =>
-            data === POST_REPLAY_REATTACH_RESET || data === POST_REPLAY_REATTACH_RESET_KEEP_MOUSE
+            data === replayEpilogue(POST_REPLAY_REATTACH_RESET) ||
+            data === replayEpilogue(POST_REPLAY_REATTACH_RESET_KEEP_MOUSE)
         )
     })
   }
@@ -658,12 +659,12 @@ describe('connectPanePty', () => {
   it('keeps mouse reporting when a reattach snapshot restores a live alternate-screen TUI', async () => {
     await expect(
       reattachSnapshotResetFor('\x1b[?1049h\x1b[?1002h\x1b[?1006hthird-party tui session')
-    ).resolves.toBe(POST_REPLAY_REATTACH_RESET_KEEP_MOUSE)
+    ).resolves.toBe(replayEpilogue(POST_REPLAY_REATTACH_RESET_KEEP_MOUSE))
   })
 
   it('still disarms mouse reporting when a reattach snapshot ends on the normal buffer', async () => {
     await expect(reattachSnapshotResetFor('\x1b[?1003h\x1b[?1006hdead tui residue')).resolves.toBe(
-      POST_REPLAY_REATTACH_RESET
+      replayEpilogue(POST_REPLAY_REATTACH_RESET)
     )
   })
 
@@ -703,11 +704,11 @@ describe('connectPanePty', () => {
 
       expect(transport.sendInput).not.toHaveBeenCalledWith('\x1b[I')
       expect(pane.terminal.write).toHaveBeenCalledWith(
-        POST_REPLAY_REATTACH_RESET,
+        replayEpilogue(POST_REPLAY_REATTACH_RESET),
         expect.any(Function)
       )
       expect(pane.terminal.write).not.toHaveBeenCalledWith(
-        POST_REPLAY_LIVE_AGENT_REATTACH_RESET,
+        replayEpilogue(POST_REPLAY_LIVE_AGENT_REATTACH_RESET),
         expect.any(Function)
       )
     })
@@ -741,11 +742,11 @@ describe('connectPanePty', () => {
 
       expect(transport.sendInput).not.toHaveBeenCalledWith('\x1b[I')
       expect(pane.terminal.write).toHaveBeenCalledWith(
-        POST_REPLAY_REATTACH_RESET,
+        replayEpilogue(POST_REPLAY_REATTACH_RESET),
         expect.any(Function)
       )
       expect(pane.terminal.write).not.toHaveBeenCalledWith(
-        POST_REPLAY_LIVE_AGENT_REATTACH_RESET,
+        replayEpilogue(POST_REPLAY_LIVE_AGENT_REATTACH_RESET),
         expect.any(Function)
       )
     })
@@ -782,11 +783,11 @@ describe('connectPanePty', () => {
 
       expect(transport.sendInput).not.toHaveBeenCalledWith('\x1b[I')
       expect(pane.terminal.write).toHaveBeenCalledWith(
-        POST_REPLAY_REATTACH_RESET,
+        replayEpilogue(POST_REPLAY_REATTACH_RESET),
         expect.any(Function)
       )
       expect(pane.terminal.write).not.toHaveBeenCalledWith(
-        POST_REPLAY_LIVE_AGENT_REATTACH_RESET,
+        replayEpilogue(POST_REPLAY_LIVE_AGENT_REATTACH_RESET),
         expect.any(Function)
       )
     })
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts
index 559060108ee..dbcc67fa47e 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts
@@ -3,9 +3,9 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   POST_REPLAY_LIVE_AGENT_REATTACH_RESET,
   POST_REPLAY_REATTACH_RESET,
-  RESET_KITTY_KEYBOARD_PROTOCOL,
   RESET_TERMINAL_CURSOR_STYLE
 } from '../../../../shared/terminal-mode-reset-profiles'
+import { replayEpilogue } from './pty-connection-test-replay-epilogue'
 import { flushAsyncTicks } from './pty-connection-test-async'
 import {
   NORMAL_BUFFER_PROLOGUE,
@@ -397,10 +397,10 @@ describe('connectPanePty', () => {
       await flushAsyncTicks(12)
 
       expect(pane.terminal.write).toHaveBeenCalledWith(
-        POST_REPLAY_LIVE_AGENT_REATTACH_RESET,
+        replayEpilogue(POST_REPLAY_LIVE_AGENT_REATTACH_RESET),
         expect.any(Function)
       )
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I')
+      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I', 'query-reply')
       return connection
     })
     disposable.dispose()
@@ -437,7 +437,7 @@ describe('connectPanePty', () => {
       await flushAsyncTicks(12)
 
       expect(pane.terminal.write).toHaveBeenCalledWith(
-        POST_REPLAY_LIVE_AGENT_REATTACH_RESET,
+        replayEpilogue(POST_REPLAY_LIVE_AGENT_REATTACH_RESET),
         expect.any(Function)
       )
       return connection
@@ -514,7 +514,7 @@ describe('connectPanePty', () => {
       await flushAsyncTicks(12)
 
       expect(pane.terminal.write).toHaveBeenCalledWith(
-        `${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}`,
+        replayEpilogue(RESET_TERMINAL_CURSOR_STYLE),
         expect.any(Function)
       )
       expect(pane.terminal.write).toHaveBeenCalledWith('\x1b[?25h\x1b[?1004l', expect.any(Function))
@@ -673,7 +673,7 @@ describe('connectPanePty', () => {
     await flushAsyncTicks(8)
 
     const replayIndex = writes.indexOf('authoritative replay')
-    const resetIndex = writes.indexOf(POST_REPLAY_REATTACH_RESET)
+    const resetIndex = writes.indexOf(replayEpilogue(POST_REPLAY_REATTACH_RESET))
     const liveIndex = writes.indexOf('NEWER-LIVE\r\n')
     expect(replayIndex).toBeGreaterThan(0)
     expect(resetIndex).toBeGreaterThan(replayIndex)
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-setup-split-spawn.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-setup-split-spawn.test.ts
index c61fb188caf..92438968984 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-setup-split-spawn.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-setup-split-spawn.test.ts
@@ -600,7 +600,7 @@ describe('connectPanePty', () => {
       writes.join('').indexOf('NEWER-LIVE-SSH-OUTPUT')
     )
     expect(transport.sendInput).not.toHaveBeenCalledWith('codex resume provider-session\r')
-    expect(transport.sendInput).toHaveBeenCalledWith('AFTER_ADOPTION_REPLAY\r')
+    expect(transport.sendInput).toHaveBeenCalledWith('AFTER_ADOPTION_REPLAY\r', 'query-reply')
     expect(deps.syncPanePtyLayoutBinding).toHaveBeenCalledWith(1, stablePtyId)
   })
 
@@ -642,7 +642,7 @@ describe('connectPanePty', () => {
     setFitOverride('pty-live', 'remote-desktop-fit', 80, 24)
     transport.claimViewport.mockClear()
     ;(onDataHandler as (data: string) => void)('a')
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
     expect(transport.claimViewport).toHaveBeenCalledTimes(1)
     ;(onDataHandler as (data: string) => void)('b')
     // The renderer stays parked until runtime convergence is acknowledged, so a second keystroke can retry a transient failed resize.
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-ssh-startup-draft-delivery.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-ssh-startup-draft-delivery.test.ts
index 2538c9e0cec..59fdc6decd7 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-ssh-startup-draft-delivery.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-ssh-startup-draft-delivery.test.ts
@@ -222,7 +222,10 @@ describe('connectPanePty', () => {
 
     expect(createdTransportOptions[0]?.commandDelivery).toBe('provider')
     expect(transport.sendInput).not.toHaveBeenCalledWith('droid\r')
-    expect(transport.sendInputAccepted).toHaveBeenCalledWith(`\x1b[200~${prompt}\x1b[201~`)
+    expect(transport.sendInputAccepted).toHaveBeenCalledWith(
+      `\x1b[200~${prompt}\x1b[201~`,
+      'launch'
+    )
   })
 
   it('waits past 8s for a cold Codex composer and preserves input ordering', async () => {
@@ -279,7 +282,8 @@ describe('connectPanePty', () => {
     await flushAsyncTicks()
 
     expect(transport.sendInputAccepted).toHaveBeenCalledWith(
-      '\x1b[200~https://github.com/stablyai/orca/issues/42\x1b[201~'
+      '\x1b[200~https://github.com/stablyai/orca/issues/42\x1b[201~',
+      'launch'
     )
     expect(transport.sendInput.mock.calls.map(([data]) => data)).toEqual([
       '\x1b[I',
@@ -354,7 +358,8 @@ describe('connectPanePty', () => {
 
     expect(transport.sendInputAccepted).toHaveBeenCalledTimes(1)
     expect(transport.sendInputAccepted).toHaveBeenCalledWith(
-      '\x1b[200~Linked Linear issue: STA-905\x1b[201~'
+      '\x1b[200~Linked Linear issue: STA-905\x1b[201~',
+      'launch'
     )
   })
 
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-stalled-hidden-restore.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-stalled-hidden-restore.test.ts
index d4c2ffd6745..a0f06268e97 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-stalled-hidden-restore.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-stalled-hidden-restore.test.ts
@@ -1,6 +1,9 @@
 import type * as React from 'react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { RESET_AFTER_BYTE_GAP } from '../../../../shared/terminal-mode-reset-profiles'
+import {
+  buildKittyKeyboardRestore,
+  RESET_AFTER_BYTE_GAP
+} from '../../../../shared/terminal-mode-reset-profiles'
 import { flushAsyncTicks, createDeferred } from './pty-connection-test-async'
 import { NORMAL_BUFFER_PROLOGUE } from './pty-connection-test-constants'
 import {
@@ -18,6 +21,9 @@ import {
   restoreTerminalTestGlobals
 } from './pty-connection-test-environment'
 
+// An abandon re-asserts the (known-zero) mirror's kitty flags after grounding the gap.
+const ABANDONED_RESTORE_GAP = `${RESET_AFTER_BYTE_GAP}${buildKittyKeyboardRestore(0)}`
+
 const {
   resetAndRefreshAllTerminalWebglAtlases,
   scheduleTerminalWebglAtlasRecovery,
@@ -206,10 +212,10 @@ describe('connectPanePty', () => {
     const warningIndex = written.findIndex((data) => data.includes('main recovery was unavailable'))
     const combinedLiveIndex = written.indexOf(firstLive + secondLive)
     expect(warningIndex).toBeGreaterThanOrEqual(0)
-    expect(written[warningIndex - 1]).toBe(RESET_AFTER_BYTE_GAP)
+    expect(written[warningIndex - 1]).toBe(ABANDONED_RESTORE_GAP)
     // Exactly one: writeRestoreUnavailableWarning already grounds the gap, so a
     // second unconditional write here was pure duplication.
-    expect(written.filter((data) => data === RESET_AFTER_BYTE_GAP)).toHaveLength(1)
+    expect(written.filter((data) => data === ABANDONED_RESTORE_GAP)).toHaveLength(1)
     expect(combinedLiveIndex).toBeGreaterThan(warningIndex)
 
     snapshot.resolve({
@@ -276,7 +282,7 @@ describe('connectPanePty', () => {
     await flushAsyncTicks(10)
 
     const written = pane.terminal.write.mock.calls.map(([data]) => data as string)
-    const resetIndex = written.indexOf(RESET_AFTER_BYTE_GAP)
+    const resetIndex = written.indexOf(ABANDONED_RESTORE_GAP)
     const liveIndex = written.findIndex((data) => data.includes('live-after-reveal'))
     expect(resetIndex).toBeGreaterThanOrEqual(0)
     expect(liveIndex).toBeGreaterThanOrEqual(0)
@@ -319,13 +325,13 @@ describe('connectPanePty', () => {
     await flushAsyncTicks(10)
 
     const written = pane.terminal.write.mock.calls.map(([data]) => data as string)
-    const resetIndex = written.indexOf(RESET_AFTER_BYTE_GAP)
+    const resetIndex = written.indexOf(ABANDONED_RESTORE_GAP)
     const liveIndex = written.indexOf(live)
     expect(resetIndex).toBeGreaterThanOrEqual(0)
     expect(liveIndex).toBeGreaterThan(resetIndex)
     // The re-arm arm grounds in rearmRemoteHiddenOutputRestoreInsteadOfWarning,
     // so the abandon body must not ground a second time.
-    expect(written.filter((data) => data === RESET_AFTER_BYTE_GAP)).toHaveLength(1)
+    expect(written.filter((data) => data === ABANDONED_RESTORE_GAP)).toHaveLength(1)
     expect(written.join('')).not.toContain('main recovery was unavailable')
 
     disposable.dispose()
@@ -383,8 +389,8 @@ describe('connectPanePty', () => {
     expect(liveIndex).toBeGreaterThan(warningIndex)
     // This arm gives up on recovery too, so the gap is grounded exactly once
     // before the blocked foreground is drained under it.
-    expect(written.filter((data) => data === RESET_AFTER_BYTE_GAP)).toHaveLength(1)
-    expect(written.indexOf(RESET_AFTER_BYTE_GAP)).toBeLessThan(liveIndex)
+    expect(written.filter((data) => data === ABANDONED_RESTORE_GAP)).toHaveLength(1)
+    expect(written.indexOf(ABANDONED_RESTORE_GAP)).toBeLessThan(liveIndex)
     disposable.dispose()
   })
 
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-startup-command-delivery.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-startup-command-delivery.test.ts
index 969bf836594..f85917e28c6 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-startup-command-delivery.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-startup-command-delivery.test.ts
@@ -525,7 +525,7 @@ describe('connectPanePty', () => {
       await flushAsyncTicks()
 
       expect(pane.terminal.paste).toHaveBeenCalledWith(command)
-      expect(transport.sendInput).toHaveBeenCalledWith('\r')
+      expect(transport.sendInput).toHaveBeenCalledWith('\r', 'launch')
       expect(transport.sendInput).not.toHaveBeenCalledWith(`${command}\r`)
     } finally {
       globalThis.setTimeout = originalSetTimeout
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-task-complete-dispatch.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-task-complete-dispatch.test.ts
index 4767de83382..25b40d86183 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-task-complete-dispatch.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-task-complete-dispatch.test.ts
@@ -699,7 +699,7 @@ describe('connectPanePty', () => {
     expect('agentToolName' in dispatchArgs).toBe(false)
     expect('agentToolInput' in dispatchArgs).toBe(false)
     expect('agentLastAssistantMessage' in dispatchArgs).toBe(false)
-    expect('agentInterrupted' in dispatchArgs).toBe(false)
+    expect('agentTurnOutcome' in dispatchArgs).toBe(false)
   })
 
   // Why: agent-row removal belongs to process/PTY lifecycle, not title reversion, so interrupts can't disappear the activity row.
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-terminal-input-gating.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-terminal-input-gating.test.ts
index 4659fccb5c5..4a2d2ee1206 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-terminal-input-gating.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-terminal-input-gating.test.ts
@@ -191,7 +191,7 @@ describe('connectPanePty', () => {
     }
     ;(onDataHandler as (data: string) => void)('a')
 
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
   })
 
   it('uses the current worktree tab for Codex stale fallback without enumerating all worktrees', async () => {
@@ -234,7 +234,7 @@ describe('connectPanePty', () => {
     }
     ;(onDataHandler as (data: string) => void)('a')
 
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
   })
 
   it('blocks stale Codex fallback input from the current worktree tab without enumerating all worktrees', async () => {
@@ -313,7 +313,7 @@ describe('connectPanePty', () => {
     }
     ;(onDataHandler as (data: string) => void)('a')
 
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
   })
 
   it('restores input through the tab fallback when the dismissed pane has no live PTY binding', async () => {
@@ -347,7 +347,7 @@ describe('connectPanePty', () => {
     }
     ;(onDataHandler as (data: string) => void)('a')
 
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
   })
 
   it('keeps a dismissed split pane typing while a sibling still holds the prompt', async () => {
@@ -389,7 +389,7 @@ describe('connectPanePty', () => {
     ;(onDataHandler as (data: string) => void)('a')
 
     expect((transport.getPtyId as unknown as () => string | null)()).toBe('pty-dismissed')
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
   })
 
   it('keeps blocking a pane with its own unanswered notice next to a dismissed sibling', async () => {
@@ -466,7 +466,7 @@ describe('connectPanePty', () => {
     ;(onDataHandler as (data: string) => void)('a')
 
     expect((transport.getPtyId as unknown as () => string | null)()).toBe('pty-plain-shell')
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
   })
 
   it('keeps blocking input on a pane whose restart is requested but not yet run', async () => {
@@ -782,7 +782,7 @@ describe('connectPanePty', () => {
     await flushAsyncTicks()
     vi.advanceTimersByTime(500)
 
-    expect(transport.sendInputAccepted).toHaveBeenCalledWith('\x03')
+    expect(transport.sendInputAccepted).toHaveBeenCalledWith('\x03', 'query-reply')
     expect(transport.sendInput).not.toHaveBeenCalled()
     expect(window.api.agentStatus.inferInterrupt).not.toHaveBeenCalled()
   })
@@ -843,7 +843,7 @@ describe('connectPanePty', () => {
     expect(transport.sendInput).not.toHaveBeenCalledWith('\r')
     // The terminator disarmed it, so the next real command reaches the shell.
     sendTerminalInputThroughPane(pane, 'ls\r')
-    expect(transport.sendInput).toHaveBeenCalledWith('ls\r')
+    expect(transport.sendInput).toHaveBeenCalledWith('ls\r', 'query-reply')
     _resetTerminalPaneRecoveryForTests()
   })
 
@@ -867,7 +867,7 @@ describe('connectPanePty', () => {
     vi.advanceTimersByTime(WRITE_PIPELINE_STALL_CHECK_MS * 2)
     await flushAsyncTicks()
 
-    expect(transport.sendInput).toHaveBeenCalledWith('x')
+    expect(transport.sendInput).toHaveBeenCalledWith('x', 'query-reply')
     expect(pane.terminal.write).toHaveBeenCalledWith('', expect.any(Function))
     expect(remountTerminalTabForRecovery).toHaveBeenCalledWith('tab-1', AUTOMATIC_REQUEST)
     binding.dispose()
@@ -892,7 +892,7 @@ describe('connectPanePty', () => {
     vi.advanceTimersByTime(WRITE_PIPELINE_STALL_CHECK_MS * 2)
     await flushAsyncTicks()
 
-    expect(transport.sendInputAccepted).toHaveBeenCalledWith('\x03')
+    expect(transport.sendInputAccepted).toHaveBeenCalledWith('\x03', 'query-reply')
     expect(pane.terminal.write).not.toHaveBeenCalledWith('', expect.any(Function))
     binding.dispose()
   })
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-test-deps.ts b/src/renderer/src/components/terminal-pane/pty-connection-test-deps.ts
index cc7536afcb7..e37ab960e3b 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-test-deps.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-test-deps.ts
@@ -2,6 +2,7 @@ import { vi } from 'vitest'
 import type { Mock } from 'vitest'
 import { leafIdForPane } from './pty-connection-test-pane-fixtures'
 import type { StoreState } from './pty-connection-test-store-state'
+import type { TerminalKittyKeyboardModeTracker } from '../../../../shared/terminal-kitty-keyboard-mode-tracker'
 
 type MockRef = { current: Mock }
 
@@ -16,7 +17,7 @@ export type PaneConnectionDeps = {
   mountFollowsTerminalPark: boolean
   paneTransportsRef: { current: Map<number, unknown> }
   paneMode2031Ref: { current: Map<number, unknown> }
-  paneKittyKeyboardModesRef: { current: Map<number, unknown> }
+  paneKittyKeyboardModesRef: { current: Map<number, TerminalKittyKeyboardModeTracker> }
   paneLastThemeModeRef: { current: Map<number, unknown> }
   replayingPanesRef: { current: Map<number, unknown> }
   isActiveRef: { current: boolean }
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-test-environment.ts b/src/renderer/src/components/terminal-pane/pty-connection-test-environment.ts
index eb3a40b6803..d8a9333c359 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-test-environment.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-test-environment.ts
@@ -54,6 +54,8 @@ export function installTerminalTestGlobals(): void {
         setPtyDeliveryInterest: vi.fn(),
         ackColdRestore: vi.fn(),
         onClearBufferRequest: vi.fn(() => vi.fn()),
+        onResetInputModesRequest: vi.fn(() => vi.fn()),
+        resetInputModes: vi.fn(),
         onSerializeBufferRequest: vi.fn(() => vi.fn()),
         sendSerializedBuffer: vi.fn(),
         declarePendingPaneSerializer: vi.fn().mockResolvedValue(1),
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-test-pane-fixtures.ts b/src/renderer/src/components/terminal-pane/pty-connection-test-pane-fixtures.ts
index c91c51f789e..302efe743bb 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-test-pane-fixtures.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-test-pane-fixtures.ts
@@ -103,6 +103,7 @@ export type MockPaneTerminal = {
     scrollback: number
     ignoreBracketedPasteMode: boolean
     theme: { foreground: string; background: string }
+    vtExtensions: { kittyKeyboard: boolean }
   }
   write: Mock<(data: string, callback?: () => void) => void>
   resize: Mock<(cols: number, rows: number) => void>
@@ -162,7 +163,8 @@ export function createPane(paneId: number): MockPane {
       theme: {
         foreground: '#eeeeee',
         background: '#111111'
-      }
+      },
+      vtExtensions: { kittyKeyboard: true }
     },
     write: vi.fn<(data: string, callback?: () => void) => void>(function write(...args): void {
       const [data, callback] = args
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-test-replay-epilogue.ts b/src/renderer/src/components/terminal-pane/pty-connection-test-replay-epilogue.ts
new file mode 100644
index 00000000000..56b4c515249
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-connection-test-replay-epilogue.ts
@@ -0,0 +1,6 @@
+import { buildKittyKeyboardRestore } from '../../../../shared/terminal-mode-reset-profiles'
+
+/** A post-replay reset: the profile, then the mirror's kitty restore (a bare pop while unproven). */
+export function replayEpilogue(profile: string, provenFlags?: number): string {
+  return `${profile}${buildKittyKeyboardRestore(provenFlags)}`
+}
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-typed-agent-identity.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-typed-agent-identity.test.ts
index 119e61e121e..73105c0248a 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-typed-agent-identity.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-typed-agent-identity.test.ts
@@ -182,7 +182,7 @@ describe('connectPanePty', () => {
       agentType: 'pi'
     })
 
-    expect(transport.sendInput).toHaveBeenCalledWith('omp\r')
+    expect(transport.sendInput).toHaveBeenCalledWith('omp\r', 'query-reply')
     expect(deps.setRuntimePaneTitle).toHaveBeenCalledWith('tab-1', 1, 'OMP ready')
     expect(deps.updateTabTitle).toHaveBeenCalledWith('tab-1', 'OMP ready')
     expect(mockStoreState.agentStatusByPaneKey[paneKey]).toMatchObject({
@@ -436,7 +436,7 @@ describe('connectPanePty', () => {
       agentType: 'pi'
     })
 
-    expect(transport.sendInput).toHaveBeenCalledWith('pi \x17omp\r')
+    expect(transport.sendInput).toHaveBeenCalledWith('pi \x17omp\r', 'query-reply')
     expect(deps.setRuntimePaneTitle).toHaveBeenCalledWith('tab-1', 1, 'OMP ready')
     expect(mockStoreState.agentStatusByPaneKey[paneKey]).toMatchObject({
       state: 'done',
@@ -474,7 +474,7 @@ describe('connectPanePty', () => {
       agentType: 'pi'
     })
 
-    expect(transport.sendInput).toHaveBeenCalledWith('pi\r')
+    expect(transport.sendInput).toHaveBeenCalledWith('pi\r', 'query-reply')
     expect(deps.setRuntimePaneTitle).toHaveBeenCalledWith('tab-1', 1, 'Pi ready')
     expect(deps.updateTabTitle).toHaveBeenCalledWith('tab-1', 'Pi ready')
     expect(mockStoreState.agentStatusByPaneKey[paneKey]).toMatchObject({
@@ -525,7 +525,7 @@ describe('connectPanePty', () => {
       agentType: 'pi'
     })
 
-    expect(transport.sendInput).toHaveBeenCalledWith('omp\r')
+    expect(transport.sendInput).toHaveBeenCalledWith('omp\r', 'query-reply')
     expect(deps.setRuntimePaneTitle).toHaveBeenCalledWith('tab-1', 1, 'Pi ready')
     expect(mockStoreState.agentStatusByPaneKey[paneKey]).toMatchObject({
       state: 'done',
@@ -564,7 +564,7 @@ describe('connectPanePty', () => {
       agentType: 'pi'
     })
 
-    expect(transport.sendInput).toHaveBeenCalledWith('omp\r')
+    expect(transport.sendInput).toHaveBeenCalledWith('omp\r', 'query-reply')
     expect(deps.setRuntimePaneTitle).toHaveBeenCalledWith('tab-1', 1, 'Pi ready')
     expect(mockStoreState.agentStatusByPaneKey[paneKey]).toMatchObject({
       state: 'done',
@@ -650,7 +650,7 @@ describe('connectPanePty', () => {
       agentType: 'pi'
     })
 
-    expect(transport.sendInput).toHaveBeenCalledWith('op\x1b[Dm\r')
+    expect(transport.sendInput).toHaveBeenCalledWith('op\x1b[Dm\r', 'query-reply')
     expect(mockStoreState.agentStatusByPaneKey[paneKey]).toMatchObject({
       state: 'done',
       agentType: 'omp',
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-windows-keyboard-reset.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-windows-keyboard-reset.test.ts
index 471e237a200..22ef4f6618a 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-windows-keyboard-reset.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-windows-keyboard-reset.test.ts
@@ -182,7 +182,7 @@ describe('connectPanePty', () => {
     )
   })
 
-  it('resets stale keyboard state when a native Windows agent becomes idle', async () => {
+  it('keeps kitty keyboard state when a native Windows agent becomes idle', async () => {
     const restoreUserAgent = temporarilySetNavigatorUserAgent(
       'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
     )
@@ -206,7 +206,12 @@ describe('connectPanePty', () => {
 
       idleHandler('* Codex done')
 
+      // Why: a finished turn is not a dead app; its kitty flags stay until the host sees it exit.
       expect(pane.terminal.write).toHaveBeenCalledWith(
+        RESET_TERMINAL_CURSOR_STYLE,
+        expect.any(Function)
+      )
+      expect(pane.terminal.write).not.toHaveBeenCalledWith(
         `${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}`,
         expect.any(Function)
       )
@@ -254,7 +259,7 @@ describe('connectPanePty', () => {
       )
       transport.sendInput.mockClear()
       sendTerminalInputThroughPane(pane, '\x1b[I')
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I')
+      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I', 'query-reply')
     } finally {
       restoreUserAgent()
     }
@@ -311,14 +316,14 @@ describe('connectPanePty', () => {
         )
         transport.sendInput.mockClear()
         sendTerminalInputThroughPane(pane, '\x1b[I')
-        expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I')
+        expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I', 'query-reply')
       } finally {
         restoreUserAgent()
       }
     }
   )
 
-  it('resets stale keyboard state when native Windows hook status reaches done', async () => {
+  it('resets cursor style when native Windows hook status reaches done', async () => {
     const restoreUserAgent = temporarilySetNavigatorUserAgent(
       'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
     )
@@ -359,7 +364,7 @@ describe('connectPanePty', () => {
       notifyStoreSubscribers()
 
       expect(pane.terminal.write).toHaveBeenCalledWith(
-        `${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}`,
+        RESET_TERMINAL_CURSOR_STYLE,
         expect.any(Function)
       )
     } finally {
@@ -367,7 +372,7 @@ describe('connectPanePty', () => {
     }
   })
 
-  it('resets stale keyboard state when a batched done→working→done burst lands as one publication', async () => {
+  it('resets cursor style when a batched done→working→done burst lands as one publication', async () => {
     const restoreUserAgent = temporarilySetNavigatorUserAgent(
       'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
     )
@@ -413,7 +418,7 @@ describe('connectPanePty', () => {
       notifyStoreSubscribers()
 
       expect(pane.terminal.write).toHaveBeenCalledWith(
-        `${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}`,
+        RESET_TERMINAL_CURSOR_STYLE,
         expect.any(Function)
       )
     } finally {
@@ -421,7 +426,7 @@ describe('connectPanePty', () => {
     }
   })
 
-  it('resets stale keyboard state when a batched burst ends on working after a completed turn', async () => {
+  it('resets cursor style when a batched burst ends on working after a completed turn', async () => {
     const restoreUserAgent = temporarilySetNavigatorUserAgent(
       'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
     )
@@ -464,7 +469,7 @@ describe('connectPanePty', () => {
       notifyStoreSubscribers()
 
       expect(pane.terminal.write).toHaveBeenCalledWith(
-        `${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}`,
+        RESET_TERMINAL_CURSOR_STYLE,
         expect.any(Function)
       )
     } finally {
@@ -472,7 +477,7 @@ describe('connectPanePty', () => {
     }
   })
 
-  it('keeps native Windows same-turn done repaints from re-resetting keyboard state', async () => {
+  it('keeps native Windows same-turn done repaints from re-resetting cursor style', async () => {
     const restoreUserAgent = temporarilySetNavigatorUserAgent(
       'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
     )
@@ -568,7 +573,7 @@ describe('connectPanePty', () => {
       notifyStoreSubscribers()
 
       sendTerminalInputThroughPane(pane, '\x1b[I')
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I')
+      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I', 'query-reply')
     } finally {
       restoreUserAgent()
     }
@@ -621,8 +626,8 @@ describe('connectPanePty', () => {
         sendTerminalInputThroughPane(pane, '\x1b[O')
         sendTerminalInputThroughPane(pane, '\x1b[I')
 
-        expect(transport.sendInput).toHaveBeenNthCalledWith(1, '\x1b[O')
-        expect(transport.sendInput).toHaveBeenNthCalledWith(2, '\x1b[I')
+        expect(transport.sendInput).toHaveBeenNthCalledWith(1, '\x1b[O', 'query-reply')
+        expect(transport.sendInput).toHaveBeenNthCalledWith(2, '\x1b[I', 'query-reply')
       } finally {
         restoreUserAgent()
       }
@@ -667,8 +672,8 @@ describe('connectPanePty', () => {
 
       sendTerminalInputThroughPane(pane, '\x7f')
       sendTerminalInputThroughPane(pane, 'x')
-      expect(transport.sendInput).toHaveBeenNthCalledWith(1, '\x7f')
-      expect(transport.sendInput).toHaveBeenNthCalledWith(2, 'x')
+      expect(transport.sendInput).toHaveBeenNthCalledWith(1, '\x7f', 'query-reply')
+      expect(transport.sendInput).toHaveBeenNthCalledWith(2, 'x', 'query-reply')
       expect(pane.terminal.modes.sendFocusMode).toBe(true)
 
       mockStoreState.agentStatusByPaneKey[paneKey] = {
@@ -679,7 +684,7 @@ describe('connectPanePty', () => {
       transport.sendInput.mockClear()
 
       sendTerminalInputThroughPane(pane, '\x1b[I')
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I')
+      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I', 'query-reply')
       expect(pane.terminal.modes.sendFocusMode).toBe(true)
 
       mockStoreState.agentStatusByPaneKey[paneKey] = {
@@ -689,7 +694,7 @@ describe('connectPanePty', () => {
       notifyStoreSubscribers()
       transport.sendInput.mockClear()
       sendTerminalInputThroughPane(pane, '\x1b[O')
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[O')
+      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[O', 'query-reply')
     } finally {
       restoreUserAgent()
     }
@@ -725,8 +730,8 @@ describe('connectPanePty', () => {
       sendTerminalInputThroughPane(pane, '\x1b[O')
       sendTerminalInputThroughPane(pane, '\x1b[I')
 
-      expect(transport.sendInput).toHaveBeenNthCalledWith(1, '\x1b[O')
-      expect(transport.sendInput).toHaveBeenNthCalledWith(2, '\x1b[I')
+      expect(transport.sendInput).toHaveBeenNthCalledWith(1, '\x1b[O', 'query-reply')
+      expect(transport.sendInput).toHaveBeenNthCalledWith(2, '\x1b[I', 'query-reply')
       expect(pane.terminal.modes.sendFocusMode).toBe(true)
     } finally {
       restoreUserAgent()
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/apply-reattach-payload.ts b/src/renderer/src/components/terminal-pane/pty-connection/apply-reattach-payload.ts
index 1eabdf99032..e8f8e7c1a08 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/apply-reattach-payload.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/apply-reattach-payload.ts
@@ -91,8 +91,8 @@ export function createReattachPayloadHandlers(
             : daemonSnapshotReplay
         }`
       )
-      session.writeReplayData(
-        session.reattachReplayResetSequence(
+      session.writeReplayEpilogue(
+        session.chooseReattachReplayReset(
           daemonSnapshotReplay,
           Boolean(ctx.connectResult.coldRestore),
           ctx.connectResult.isAlternateScreen,
@@ -198,8 +198,8 @@ export function createReattachPayloadHandlers(
         })) {
           session.writeReplayData(replayChunk)
         }
-        session.writeReplayData(
-          session.reattachReplayResetSequence(
+        session.writeReplayEpilogue(
+          session.chooseReattachReplayReset(
             modelData,
             Boolean(ctx.connectResult?.coldRestore),
             modelSnapshot.alternateScreen ?? ctx.connectResult?.isAlternateScreen,
@@ -237,8 +237,8 @@ export function createReattachPayloadHandlers(
         session.writeReplayData(
           `${ctx.connectResult.coldRestore ? RESET_GRAPHIC_RENDITION : ''}${ctx.connectResult.replay}`
         )
-        session.writeReplayData(
-          session.reattachReplayResetSequence(
+        session.writeReplayEpilogue(
+          session.chooseReattachReplayReset(
             ctx.connectResult.replay,
             Boolean(ctx.connectResult.coldRestore),
             ctx.connectResult.isAlternateScreen
@@ -305,9 +305,7 @@ export function createReattachPayloadHandlers(
         session.clearSleepingRecordAfterColdRestoreSpawn(preparedStartup)
       }
       // Why: cold-restore spawned a fresh shell; reset mode bytes a crashed TUI (e.g. Claude's \e[?1004h) left in scrollback that no live TUI now consumes.
-      session.writeReplayData(POST_REPLAY_MODE_RESET)
-      // Why: the dead run's kitty flags died with it and its scrollback was never scanned — the fresh shell starts at zero.
-      session.kittyKeyboardModes.reset()
+      session.writeInputModeGround(POST_REPLAY_MODE_RESET)
       session.consumeRestoredViewportBlankingMarker()
       // Why: a taller destination fit must not pull recovered rows back into the fresh shell's viewport after source-grid replay.
       session.writeFreshShellViewportBlanking(Math.max(destinationRows, session.pane.terminal.rows))
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/connect-pane-pty-session.ts b/src/renderer/src/components/terminal-pane/pty-connection/connect-pane-pty-session.ts
index c6a25e0d461..417ccd812da 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/connect-pane-pty-session.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/connect-pane-pty-session.ts
@@ -1,5 +1,6 @@
 import type { ManagedPane, PaneManager } from '@/lib/pane-manager/pane-manager'
 import type { PtyConnectionDeps } from '../pty-connection-types'
+import type { PtyTransport } from '../pty-transport-types'
 
 // Why: connectPanePty is a single closure factory. The bag lets extracted
 // installers share the same mutable bindings without changing call order.
@@ -7,6 +8,8 @@ export type ConnectPanePtySession = {
   pane: ManagedPane
   manager: PaneManager
   deps: PtyConnectionDeps
+  // Why typed: every PTY write must name its input kind, and the bag's `any` would hide a missing one.
+  transport: PtyTransport
   // oxlint-disable-next-line typescript/no-explicit-any -- session bag for mechanical extract
   [key: string]: any
 }
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/connect-pane-pty.ts b/src/renderer/src/components/terminal-pane/pty-connection/connect-pane-pty.ts
index 663bb3b345b..8c560ce30bd 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/connect-pane-pty.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/connect-pane-pty.ts
@@ -114,10 +114,6 @@ export function connectPanePty(
   session.remoteOutputGatedPtyId = null
   session.remoteOutputFactConsumerPtyId = null
   session.suppressViewportClaimTerminalResize = false
-  // Why: idle callbacks are registered before the deferred PTY output plumbing
-  // exists. Start with the shared scheduler, then switch to the PTY writer
-  // below so hidden-tab resets keep backlog-recovery callbacks and byte order.
-  session.idleAgentTerminalModeReset = RESET_TERMINAL_CURSOR_STYLE
   session.suppressNativeWindowsIdleCodexFocusReports = false
   session.setFocusReportSuppressionForAgentCompletion = (
     title: string | undefined,
@@ -127,11 +123,14 @@ export function connectPanePty(
     session.suppressNativeWindowsIdleCodexFocusReports =
       agentType && agentType !== 'unknown' ? agentType === 'codex' : titleAgentType === 'codex'
   }
+  // Why: idle callbacks are registered before the deferred PTY output plumbing
+  // exists. Start with the shared scheduler, then switch to the PTY writer
+  // so hidden-tab resets keep backlog-recovery callbacks and byte order.
   session.queueAgentIdleTerminalModeReset = (): void => {
     if (session.disposed) {
       return
     }
-    writeTerminalOutput(session.pane.terminal, session.idleAgentTerminalModeReset, {
+    writeTerminalOutput(session.pane.terminal, RESET_TERMINAL_CURSOR_STYLE, {
       foreground: shouldWritePtyOutputForeground(session.deps.isVisibleRef.current)
     })
   }
@@ -162,16 +161,16 @@ export function connectPanePty(
   // Why: paneKey crosses PTY env, hook IPC, retained rows, and reload/replay.
   // Use the stable layout leaf UUID, not the renderer-local numeric pane id.
   session.cacheKey = makePaneKey(session.deps.tabId, session.pane.leafId)
-  // Why: mirrors the kitty keyboard flags the pane's application negotiates.
-  // Fed only from application output (live PTY bytes + daemon replay
-  // payloads), never from renderer-generated resets, so it reflects what the
-  // application expects even after defensive renderer-side kitty wipes.
+  // Why: xterm exposes no kitty read, so this mirror tracks the flags xterm's
+  // encoder applies; see TerminalKittyKeyboardModeTracker for its feeds.
   session.kittyKeyboardModes = (() => {
     const existing = session.deps.paneKittyKeyboardModesRef.current.get(session.pane.id)
     if (existing) {
       return existing
     }
-    const created = new TerminalKittyKeyboardModeTracker()
+    const created = new TerminalKittyKeyboardModeTracker({
+      kittyKeyboard: session.pane.terminal.options.vtExtensions?.kittyKeyboard === true
+    })
     session.deps.paneKittyKeyboardModesRef.current.set(session.pane.id, created)
     return created
   })()
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/deferred-cold-restore-and-snapshot.ts b/src/renderer/src/components/terminal-pane/pty-connection/deferred-cold-restore-and-snapshot.ts
index 6c3a0628f79..f2a91feb98c 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/deferred-cold-restore-and-snapshot.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/deferred-cold-restore-and-snapshot.ts
@@ -91,7 +91,7 @@ export function bindDeferredColdRestoreAndSnapshot(session: ConnectPanePtySessio
     if (result.status !== 'pasted' || !isStartupPasteTargetCurrent(ptyId)) {
       return false
     }
-    return session.transport.sendInput('\r')
+    return session.transport.sendInput('\r', 'launch')
   }
   session.schedulePendingStartupCommandDelivery = (): void => {
     const startup = session.pendingStartupCommand
@@ -116,7 +116,7 @@ export function bindDeferredColdRestoreAndSnapshot(session: ConnectPanePtySessio
         const command = startup.command
         const submitted = session.shouldDeliverStartupViaTerminalPaste
           ? await runTerminalPasteStartupCommand(command)
-          : session.transport.sendInput(`${command}\r`)
+          : session.transport.sendInput(`${command}\r`, 'launch')
         if (submitted) {
           session.armStartupDraftReadinessObservation()
         } else {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/deferred-session-reattach-choice.ts b/src/renderer/src/components/terminal-pane/pty-connection/deferred-session-reattach-choice.ts
index f56f3c54f6c..6d045232a36 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/deferred-session-reattach-choice.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/deferred-session-reattach-choice.ts
@@ -27,7 +27,10 @@ export function runDeferredSessionReattachChoice(session: ConnectPanePtySession)
   const existingPtyId = storeSnapshot.tabsByWorktree[session.deps.worktreeId]?.find(
     (t) => t.id === session.deps.tabId
   )?.ptyId
-  const hasSleepingAgentSession = Boolean(session.getSleepingRecordForPane(storeSnapshot))
+  // Why: the host owns a mirrored tab's agent liveness and answers it at connect; a client note must not divert its start.
+  const resumesFromSleepingNote =
+    !isWebTerminalSurfaceTabId(session.deps.tabId) &&
+    Boolean(session.getSleepingRecordForPane(storeSnapshot))
 
   // Why: the tab-level fallback must not steal a PTY a setup sibling already published while the main pane waited for split geometry.
   const tabFallbackPtyId =
@@ -41,7 +44,7 @@ export function runDeferredSessionReattachChoice(session: ConnectPanePtySession)
 
   const restoredSessionId = restoredPtyId ?? null
   const sleptRemoteRuntimeSessionId =
-    restoredSessionId && isRemoteRuntimePtyId(restoredSessionId) && hasSleepingAgentSession
+    restoredSessionId && isRemoteRuntimePtyId(restoredSessionId) && resumesFromSleepingNote
       ? restoredSessionId
       : null
   const detachedLivePtyId =
@@ -53,7 +56,7 @@ export function runDeferredSessionReattachChoice(session: ConnectPanePtySession)
         : tabFallbackPtyId
       : null
   const detachedRemoteLeafPtyId =
-    restoredSessionId && isRemoteRuntimePtyId(restoredSessionId) && !hasSleepingAgentSession
+    restoredSessionId && isRemoteRuntimePtyId(restoredSessionId) && !resumesFromSleepingNote
       ? restoredSessionId
       : null
   const candidateReattachSessionId =
@@ -171,7 +174,7 @@ export function runDeferredSessionReattachChoice(session: ConnectPanePtySession)
                 `Pending PTY spawn for tab ${session.deps.tabId} resolved without a PTY id, retrying fresh spawn`
               )
             }
-            if (sleptRemoteColdRestoreStartup || hasSleepingAgentSession) {
+            if (sleptRemoteColdRestoreStartup || resumesFromSleepingNote) {
               session.startFreshColdRestoreAgentResume(sleptRemoteColdRestoreStartup ?? undefined)
             } else {
               session.startFreshSpawn()
@@ -202,7 +205,7 @@ export function runDeferredSessionReattachChoice(session: ConnectPanePtySession)
         })
     } else {
       recordPtyConnectDiagnostic(`pane=${session.pane.id} -> FRESH SPAWN`)
-      if (sleptRemoteColdRestoreStartup || hasSleepingAgentSession) {
+      if (sleptRemoteColdRestoreStartup || resumesFromSleepingNote) {
         session.startFreshColdRestoreAgentResume(sleptRemoteColdRestoreStartup ?? undefined)
       } else {
         session.startFreshSpawn()
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/deferred-session-reattach-live-bookmark.test.ts b/src/renderer/src/components/terminal-pane/pty-connection/deferred-session-reattach-live-bookmark.test.ts
new file mode 100644
index 00000000000..6f2b55aec24
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-connection/deferred-session-reattach-live-bookmark.test.ts
@@ -0,0 +1,205 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ConnectPanePtySession } from './connect-pane-pty-session'
+import { runDeferredSessionReattachChoice } from './deferred-session-reattach-choice'
+import type * as PairedParkedTerminalRestore from './paired-parked-terminal-restore'
+
+// Reproduction: a mirrored remote web-terminal pane whose host PTY is alive, with a periodic
+// origin:'live' crash-recovery bookmark, must attach to that PTY, not cold-restore a fresh agent.
+
+const TAB_ID = 'web-terminal-tab-1'
+const LEAF_ID = 'leaf-1'
+const ENV_ID = 'env-1'
+const REMOTE_PTY_ID = `remote:${ENV_ID}@@term_1`
+const WORKTREE_ID = 'repo-1::/workspaces/wt-1'
+
+const mocks = vi.hoisted(() => {
+  const state: Record<string, unknown> = {}
+  return { state, startDeferredSessionReattach: vi.fn(), canRestorePairedParked: false }
+})
+
+vi.mock('@/store', () => ({
+  useAppStore: { getState: () => mocks.state }
+}))
+vi.mock('@/runtime/sync-runtime-graph', () => ({ scheduleRuntimeGraphSync: vi.fn() }))
+vi.mock('../pty-dispatcher', () => ({ getEagerPtyBufferHandle: () => null }))
+vi.mock('./paired-parked-terminal-restore', async (importOriginal) => ({
+  ...(await importOriginal<typeof PairedParkedTerminalRestore>()),
+  canRestorePairedParkedTerminal: () => mocks.canRestorePairedParked
+}))
+vi.mock('./deferred-session-reattach-connect', () => ({
+  startDeferredSessionReattach: mocks.startDeferredSessionReattach
+}))
+
+const now = Date.UTC(2026, 8, 25)
+
+const codexLiveBookmark = {
+  worktreeId: WORKTREE_ID,
+  tabId: TAB_ID,
+  leafId: LEAF_ID,
+  agent: 'codex',
+  providerSession: { key: 'session_id', id: 'codex-conv-1' },
+  connectionId: null,
+  state: 'done',
+  origin: 'live',
+  capturedAt: now,
+  updatedAt: now,
+  launchConfig: { agentCommand: "codex '--dangerously-bypass-approvals-and-sandbox'" }
+}
+
+const claudeLiveBookmark = {
+  worktreeId: WORKTREE_ID,
+  tabId: TAB_ID,
+  leafId: LEAF_ID,
+  agent: 'claude',
+  providerSession: { key: 'session_id', id: 'claude-conv-1' },
+  connectionId: ENV_ID,
+  state: 'working',
+  origin: 'live',
+  capturedAt: now,
+  updatedAt: now
+}
+
+function setStore(sleepingRecord: Record<string, unknown> | null, tabId = TAB_ID): void {
+  const paneKey = `${tabId}:${LEAF_ID}`
+  mocks.state = {
+    tabsByWorktree: { [WORKTREE_ID]: [{ id: tabId, ptyId: REMOTE_PTY_ID }] },
+    ptyIdsByTabId: { [tabId]: [REMOTE_PTY_ID] },
+    sleepingAgentSessionsByPaneKey: sleepingRecord ? { [paneKey]: sleepingRecord } : {},
+    runtimeStatusByEnvironmentId: new Map()
+  }
+}
+
+function buildSession(
+  tabId = TAB_ID,
+  overrides: Record<string, unknown> = {}
+): ConnectPanePtySession {
+  const paneKey = `${tabId}:${LEAF_ID}`
+  let attachedPtyId: string | null = null
+  const transport = {
+    attach: vi.fn((opts: { existingPtyId: string }) => {
+      attachedPtyId = opts.existingPtyId
+    }),
+    getPtyId: () => attachedPtyId
+  }
+  const session = {
+    pane: { id: 1, leafId: LEAF_ID },
+    cacheKey: paneKey,
+    pendingSpawnKey: paneKey,
+    tabGeneration: 0,
+    transport,
+    cols: 80,
+    rows: 24,
+    disposed: false,
+    hadExistingPaneTransportAtConnect: false,
+    mountFollowsTerminalPark: false,
+    runtimeEnvironmentId: ENV_ID,
+    connectionId: null,
+    allowInitialIdleCacheSeed: true,
+    deps: {
+      tabId,
+      worktreeId: WORKTREE_ID,
+      restoredLeafId: LEAF_ID,
+      restoredPtyIdByLeafId: { [LEAF_ID]: REMOTE_PTY_ID },
+      paneTransportsRef: { current: new Map([[1, transport]]) },
+      clearTabPtyId: vi.fn()
+    },
+    // Mirrors installSleepingRecordAccess's stable-key lookup, which does not filter on origin.
+    getSleepingRecordForPane: (state: {
+      sleepingAgentSessionsByPaneKey: Record<string, unknown>
+    }) => {
+      const record = state.sleepingAgentSessionsByPaneKey[paneKey]
+      return record ? { paneKey, record } : null
+    },
+    buildColdRestoreAgentResumeStartup: vi.fn(() => ({ command: 'resume' })),
+    syncPanePtyLayoutBinding: vi.fn(),
+    clearPaneMode2031State: vi.fn(),
+    clearHiddenOutputRestoreState: vi.fn(),
+    captureTransportOutputCallbacks: vi.fn(() => ({ callbacks: {}, generation: 0 })),
+    bindActivePanePty: vi.fn(),
+    registerPaneSerializerFor: vi.fn(),
+    reportError: vi.fn(),
+    startFreshSpawn: vi.fn(),
+    startFreshColdRestoreAgentResume: vi.fn(),
+    armDirectSshPaneRetryTimeout: vi.fn(),
+    canAdoptCapturedDirectSshRetryPty: vi.fn(() => true),
+    ...overrides
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: test bag covers every member runDeferredSessionReattachChoice reads.
+  return session as unknown as ConnectPanePtySession
+}
+
+function expectAttachedToLiveRemotePty(session: ConnectPanePtySession): void {
+  expect(session.transport.attach).toHaveBeenCalledWith(
+    expect.objectContaining({ existingPtyId: REMOTE_PTY_ID })
+  )
+  expect(session.startFreshColdRestoreAgentResume).not.toHaveBeenCalled()
+  expect(session.startFreshSpawn).not.toHaveBeenCalled()
+  expect(session.deps.clearTabPtyId).not.toHaveBeenCalled()
+  expect(session.syncPanePtyLayoutBinding).not.toHaveBeenCalledWith(null)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.canRestorePairedParked = false
+})
+
+describe('deferred reattach choice: mirrored remote pane with a live crash-recovery bookmark', () => {
+  it('attaches to the restored remote PTY when there is no sleeping note', () => {
+    setStore(null)
+    const session = buildSession()
+    runDeferredSessionReattachChoice(session)
+    expectAttachedToLiveRemotePty(session)
+    expect(mocks.startDeferredSessionReattach).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    ['a done codex', codexLiveBookmark],
+    ['a working claude', claudeLiveBookmark]
+  ])('still attaches to the live remote PTY under %s live bookmark', (_label, record) => {
+    setStore(record)
+    const session = buildSession()
+    runDeferredSessionReattachChoice(session)
+    expectAttachedToLiveRemotePty(session)
+  })
+
+  // Why: the host owns a mirrored tab's liveness, so no client note may divert its start.
+  it.each(['worktree-sleep', 'quit'])(
+    'still attaches to the host PTY under a genuine %s sleep note',
+    (origin) => {
+      setStore({ ...codexLiveBookmark, origin })
+      const session = buildSession()
+      runDeferredSessionReattachChoice(session)
+      expectAttachedToLiveRemotePty(session)
+      expect(session.buildColdRestoreAgentResumeStartup).not.toHaveBeenCalled()
+    }
+  )
+
+  it('reattaches a parked-tab mount under a live note without clearing the binding', () => {
+    mocks.canRestorePairedParked = true
+    setStore(codexLiveBookmark)
+    const session = buildSession(TAB_ID, { mountFollowsTerminalPark: true })
+    runDeferredSessionReattachChoice(session)
+    expect(mocks.startDeferredSessionReattach).toHaveBeenCalledWith(session, REMOTE_PTY_ID)
+    expect(session.syncPanePtyLayoutBinding).not.toHaveBeenCalledWith(null)
+    expect(session.deps.clearTabPtyId).not.toHaveBeenCalled()
+    expect(session.startFreshColdRestoreAgentResume).not.toHaveBeenCalled()
+    expect(session.buildColdRestoreAgentResumeStartup).not.toHaveBeenCalled()
+  })
+})
+
+describe('deferred reattach choice: client-created runtime tab keeps its sleep note', () => {
+  it.each(['worktree-sleep', 'quit'])(
+    'takes the slept branch under a real %s sleep note',
+    (origin) => {
+      const tabId = 'client-tab-1'
+      setStore({ ...codexLiveBookmark, tabId, origin }, tabId)
+      const session = buildSession(tabId)
+      runDeferredSessionReattachChoice(session)
+      expect(session.transport.attach).not.toHaveBeenCalled()
+      expect(session.syncPanePtyLayoutBinding).toHaveBeenCalledWith(null)
+      expect(session.deps.clearTabPtyId).toHaveBeenCalledWith(tabId, REMOTE_PTY_ID)
+      expect(session.startFreshColdRestoreAgentResume).toHaveBeenCalledWith({ command: 'resume' })
+      expect(session.startFreshSpawn).not.toHaveBeenCalled()
+    }
+  )
+})
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/direct-ssh-retry-status.ts b/src/renderer/src/components/terminal-pane/pty-connection/direct-ssh-retry-status.ts
index 67fd09bcc59..a494d08fc80 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/direct-ssh-retry-status.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/direct-ssh-retry-status.ts
@@ -6,10 +6,6 @@ import {
   hasCachedWindowsTerminalCapabilities
 } from '@/lib/windows-terminal-capabilities'
 import { requestTerminalWritePipelineProbe } from '@/lib/pane-manager/terminal-write-pipeline-health'
-import {
-  RESET_KITTY_KEYBOARD_PROTOCOL,
-  RESET_TERMINAL_CURSOR_STYLE
-} from '../../../../../shared/terminal-mode-reset-profiles'
 import { subscribeToTerminalUserInput } from '../terminal-user-input-signal'
 import {
   isLocalNativeWindowsConpty,
@@ -86,11 +82,6 @@ export function installDirectSshRetryStatus(session: ConnectPanePtySession): voi
     ),
     executionHostId: session.executionHostId
   })
-  if (session.isNativeWindowsConpty) {
-    // Why: Windows ConPTY agent turns can leave renderer keyboard modes armed
-    // after completion, corrupting plain input with encoded bytes.
-    session.idleAgentTerminalModeReset = `${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}`
-  }
   session.shouldApplyNativeWindowsRewriteRefresh = session.isNativeWindowsConpty
   session.shouldApplyWindowsRendererUnicodeRefresh = CLIENT_PLATFORM === 'win32'
   session.shouldProtectNativeWindowsSynchronizedOutput = session.isNativeWindowsConpty
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/disposed-spawn-retention.test.ts b/src/renderer/src/components/terminal-pane/pty-connection/disposed-spawn-retention.test.ts
new file mode 100644
index 00000000000..0aa1422e552
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-connection/disposed-spawn-retention.test.ts
@@ -0,0 +1,120 @@
+import { describe, expect, it } from 'vitest'
+import { composeWorktreeHostIdentity } from '../../../../../shared/worktree/host-qualified-identity'
+import type { TerminalLayoutSnapshot, TerminalTab } from '../../../../../shared/terminal-tab-types'
+import type { WorktreeDeleteState } from '@/store/slices/worktree-delete-state-types'
+import { shouldRetainDisposedPaneSpawn } from './disposed-spawn-retention'
+
+const WT = 'wt'
+const TAB = 'tab-a'
+const LEAF = '11111111-1111-4111-8111-111111111111'
+const OTHER_LEAF = '22222222-2222-4222-8222-222222222222'
+
+function tab(id: string): TerminalTab {
+  return {
+    id,
+    ptyId: null,
+    worktreeId: WT,
+    title: 'Terminal 1',
+    customTitle: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 0
+  }
+}
+
+function layout(leafId: string): TerminalLayoutSnapshot {
+  return { root: { type: 'leaf', leafId }, activeLeafId: leafId, expandedLeafId: null }
+}
+
+function state(overrides: {
+  tabs?: Record<string, TerminalTab[]>
+  layouts?: Record<string, TerminalLayoutSnapshot>
+  deleting?: Record<string, WorktreeDeleteState>
+}) {
+  return {
+    tabsByWorktree: overrides.tabs ?? { [WT]: [tab(TAB)] },
+    terminalLayoutsByTabId: overrides.layouts ?? {},
+    deleteStateByWorktreeId: overrides.deleting ?? {}
+  }
+}
+
+const deleting: WorktreeDeleteState = {
+  isDeleting: true,
+  error: null,
+  canForceDelete: false,
+  forceDeleteReason: null
+}
+
+describe('shouldRetainDisposedPaneSpawn', () => {
+  it('keeps the PTY for a tab that still exists and has no layout root yet', () => {
+    expect(shouldRetainDisposedPaneSpawn(state({}), WT, TAB, LEAF)).toBe(true)
+  })
+
+  it('keeps the PTY when the layout still names the leaf', () => {
+    expect(
+      shouldRetainDisposedPaneSpawn(state({ layouts: { [TAB]: layout(LEAF) } }), WT, TAB, LEAF)
+    ).toBe(true)
+  })
+
+  it('kills the PTY when the tab is gone from every worktree', () => {
+    expect(
+      shouldRetainDisposedPaneSpawn(state({ tabs: { [WT]: [tab('other-tab')] } }), WT, TAB, LEAF)
+    ).toBe(false)
+  })
+
+  it('kills the PTY when the leaf was removed from the layout', () => {
+    expect(
+      shouldRetainDisposedPaneSpawn(
+        state({ layouts: { [TAB]: layout(OTHER_LEAF) } }),
+        WT,
+        TAB,
+        LEAF
+      )
+    ).toBe(false)
+  })
+
+  it('kills the PTY when its worktree is being deleted even though the tab is still listed', () => {
+    expect(
+      shouldRetainDisposedPaneSpawn(state({ deleting: { [WT]: deleting } }), WT, TAB, LEAF)
+    ).toBe(false)
+    expect(
+      shouldRetainDisposedPaneSpawn(state({ deleting: { other: deleting } }), WT, TAB, LEAF)
+    ).toBe(true)
+  })
+
+  it.each(['local', 'ssh:target', 'runtime:paired'] as const)(
+    'retires a disposed spawn when its %s workspace is being deleted',
+    (executionHostId) => {
+      const deletingState = state({
+        deleting: { [composeWorktreeHostIdentity(executionHostId, WT)]: deleting }
+      })
+
+      expect(shouldRetainDisposedPaneSpawn(deletingState, WT, TAB, LEAF, executionHostId)).toBe(
+        false
+      )
+      expect(shouldRetainDisposedPaneSpawn(deletingState, WT, TAB, LEAF, 'ssh:other-target')).toBe(
+        true
+      )
+    }
+  )
+
+  it('keeps legacy deletion entries scoped to their recorded execution host', () => {
+    const deletingState = state({
+      deleting: { [WT]: { ...deleting, executionHostId: 'ssh:target' } }
+    })
+
+    expect(shouldRetainDisposedPaneSpawn(deletingState, WT, TAB, LEAF, 'ssh:target')).toBe(false)
+    expect(shouldRetainDisposedPaneSpawn(deletingState, WT, TAB, LEAF, 'ssh:other-target')).toBe(
+      true
+    )
+    expect(
+      shouldRetainDisposedPaneSpawn(state({ deleting: { [WT]: deleting } }), WT, TAB, LEAF, 'local')
+    ).toBe(false)
+  })
+
+  it('finds the tab under a worktree other than the one it was opened in', () => {
+    expect(
+      shouldRetainDisposedPaneSpawn(state({ tabs: { [WT]: [], other: [tab(TAB)] } }), WT, TAB, LEAF)
+    ).toBe(true)
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/disposed-spawn-retention.ts b/src/renderer/src/components/terminal-pane/pty-connection/disposed-spawn-retention.ts
new file mode 100644
index 00000000000..98eeec0d0db
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-connection/disposed-spawn-retention.ts
@@ -0,0 +1,33 @@
+import type { AppState } from '@/store/types'
+import type { ExecutionHostId } from '../../../../../shared/execution-host'
+import { composeWorktreeHostIdentity } from '../../../../../shared/worktree/host-qualified-identity'
+import { collectLeafIdsInOrder } from '../terminal-layout-leaf-ids'
+
+// Main can give a remounted pane the same PTY, so disposal alone does not make it ownerless.
+export function shouldRetainDisposedPaneSpawn(
+  state: Pick<AppState, 'tabsByWorktree' | 'terminalLayoutsByTabId' | 'deleteStateByWorktreeId'>,
+  worktreeId: string,
+  tabId: string,
+  leafId: string,
+  executionHostId?: ExecutionHostId
+): boolean {
+  const deleteState =
+    (executionHostId
+      ? state.deleteStateByWorktreeId?.[composeWorktreeHostIdentity(executionHostId, worktreeId)]
+      : undefined) ?? state.deleteStateByWorktreeId?.[worktreeId]
+  if (
+    deleteState?.isDeleting &&
+    (!deleteState.executionHostId || deleteState.executionHostId === executionHostId)
+  ) {
+    return false
+  }
+  const tabPresent = Object.values(state.tabsByWorktree).some((tabs) =>
+    tabs.some((tab) => tab.id === tabId)
+  )
+  if (!tabPresent) {
+    return false
+  }
+  // A new single-pane tab has no layout root until its first pane binds.
+  const root = state.terminalLayoutsByTabId[tabId]?.root
+  return !root || collectLeafIdsInOrder(root).includes(leafId)
+}
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/empty-reattach-retire-evidence.test.ts b/src/renderer/src/components/terminal-pane/pty-connection/empty-reattach-retire-evidence.test.ts
new file mode 100644
index 00000000000..086cfb82081
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-connection/empty-reattach-retire-evidence.test.ts
@@ -0,0 +1,84 @@
+import { describe, expect, it } from 'vitest'
+import {
+  hasEmptyReattachRetireEvidence,
+  isHibernationDoneRecord
+} from './empty-reattach-retire-evidence'
+import type { SleepingAgentSessionRecord } from '../../../../../shared/agent-session-resume'
+import type { ColdRestoreAgentResumeStartup } from './fresh-spawn-types'
+
+function note(overrides: Partial<SleepingAgentSessionRecord> = {}): SleepingAgentSessionRecord {
+  return {
+    paneKey: 'tab-1:leaf-1',
+    worktreeId: 'wt-1',
+    agent: 'codex',
+    providerSession: { key: 'session_id', id: 'conv-1' },
+    prompt: '',
+    state: 'done',
+    capturedAt: 1,
+    updatedAt: 1,
+    ...overrides
+  }
+}
+
+function resumeStartup(
+  record: SleepingAgentSessionRecord | null,
+  useLiveEntry = false
+): ColdRestoreAgentResumeStartup {
+  return {
+    command: 'codex resume conv-1',
+    agent: 'codex',
+    resumeProviderSession: { key: 'session_id', id: 'conv-1' },
+    launchConfig: { agentArgs: '', agentEnv: {} },
+    launchToken: 'token-1',
+    useLiveEntry,
+    hasSleepingRecord: record !== null,
+    sleepingRecordEntry: record ? { paneKey: record.paneKey, record } : null
+  }
+}
+
+const WORKTREE_SLEEP_DONE = note({ origin: 'worktree-sleep' })
+
+describe('isHibernationDoneRecord', () => {
+  it.each([
+    ['a legacy originless done note', true, note()],
+    ['a worktree-sleep done note', true, WORKTREE_SLEEP_DONE],
+    ['a live done note (the idle anchor of a running pane)', false, note({ origin: 'live' })],
+    [
+      'a live done note marked not interrupted',
+      false,
+      note({ origin: 'live', interrupted: false })
+    ],
+    ['a quit done note', false, note({ origin: 'quit' })],
+    [
+      'a worktree-sleep note still working',
+      false,
+      note({ origin: 'worktree-sleep', state: 'working' })
+    ]
+  ])('%s -> %s', (_label, expected, record) => {
+    expect(isHibernationDoneRecord(record)).toBe(expected)
+  })
+})
+
+describe('hasEmptyReattachRetireEvidence', () => {
+  it.each([
+    ['a local pty', 'local-pty-1'],
+    ['a local daemon session id', 'wt-1@@daemon-session-1']
+  ])('retires %s under a hibernation done note', (_label, ptyId) => {
+    expect(hasEmptyReattachRetireEvidence(ptyId, resumeStartup(WORKTREE_SLEEP_DONE))).toBe(true)
+  })
+
+  it('never retires a remote runtime pty, whose disconnect leaves the host PTY alive', () => {
+    expect(
+      hasEmptyReattachRetireEvidence('remote:env-1@@term_1', resumeStartup(WORKTREE_SLEEP_DONE))
+    ).toBe(false)
+  })
+
+  it.each([
+    ['no resume startup', undefined],
+    ['a startup resuming the live entry', resumeStartup(WORKTREE_SLEEP_DONE, true)],
+    ['a startup without a sleeping note', resumeStartup(null)],
+    ['a live done note', resumeStartup(note({ origin: 'live' }))]
+  ])('keeps a local pty with %s', (_label, startup) => {
+    expect(hasEmptyReattachRetireEvidence('local-pty-1', startup)).toBe(false)
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/empty-reattach-retire-evidence.ts b/src/renderer/src/components/terminal-pane/pty-connection/empty-reattach-retire-evidence.ts
new file mode 100644
index 00000000000..eaa7638df6f
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-connection/empty-reattach-retire-evidence.ts
@@ -0,0 +1,22 @@
+import type { SleepingAgentSessionRecord } from '../../../../../shared/agent-session-resume'
+import type { ColdRestoreAgentResumeStartup } from './fresh-spawn-types'
+import { isRemoteRuntimePtyId } from './paired-parked-terminal-restore'
+
+// Why not activationTreatsNoteAsFinished: a live+done note is a finished turn's idle anchor for a running pane, not sleep.
+export function isHibernationDoneRecord(record: SleepingAgentSessionRecord): boolean {
+  return (
+    (record.origin === undefined || record.origin === 'worktree-sleep') && record.state === 'done'
+  )
+}
+
+// Why: never remote, where disconnect() only closes this viewer's stream, so the retry re-lands on the same live PTY and loops.
+export function hasEmptyReattachRetireEvidence(
+  ptyId: string,
+  coldRestoreStartup: ColdRestoreAgentResumeStartup | null | undefined
+): boolean {
+  const record =
+    coldRestoreStartup && !coldRestoreStartup.useLiveEntry
+      ? coldRestoreStartup.sleepingRecordEntry?.record
+      : undefined
+  return !isRemoteRuntimePtyId(ptyId) && record !== undefined && isHibernationDoneRecord(record)
+}
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-refresh.ts b/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-refresh.ts
index dff163f81d8..9c1b45051be 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-refresh.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-refresh.ts
@@ -151,6 +151,7 @@ export function bindForegroundOutputRefresh(session: ConnectPanePtySession): voi
       session.hiddenDeliverySyncedPtyId = null
     }
     if (
+      !ptyId ||
       !session.isHiddenDeliveryGateManagedPty(ptyId) ||
       !session.canUseHiddenOutputSnapshot(ptyId)
     ) {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-scan.test.ts b/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-scan.test.ts
new file mode 100644
index 00000000000..7d2a280eafc
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-scan.test.ts
@@ -0,0 +1,80 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  scanSynchronizedForegroundOutput,
+  SYNCHRONIZED_OUTPUT_START_SEQUENCE as start,
+  SYNCHRONIZED_OUTPUT_END_SEQUENCE as end
+} from './foreground-output-scan'
+
+afterEach(() => vi.restoreAllMocks())
+
+describe('foreground synchronized output scan', () => {
+  it.each([start, end])('bounds searched characters for a flood of %j markers', (marker) => {
+    const data = marker.repeat(8192)
+    const originalIndexOf = String.prototype.indexOf
+    let searchedCharacters = 0
+    const spy = vi.spyOn(String.prototype, 'indexOf').mockImplementation(function (
+      this: string,
+      search: string,
+      position = 0
+    ): number {
+      const result = originalIndexOf.call(this, search, position)
+      if (this === data && (search === start || search === end)) {
+        searchedCharacters += (result < 0 ? data.length : result + search.length) - position
+      }
+      return result
+    })
+    const result = scanSynchronizedForegroundOutput(data, '', false)
+    spy.mockRestore()
+    console.info(JSON.stringify({ markers: 8192, chars: data.length, searchedCharacters }))
+    expect(result).toEqual({
+      started: marker === start,
+      ended: marker === end,
+      active: marker === start,
+      markerTail: data.slice(-7)
+    })
+    expect(searchedCharacters).toBeLessThanOrEqual(data.length * 2)
+  })
+
+  it('preserves the last marker and records both transitions in the current chunk', () => {
+    expect(scanSynchronizedForegroundOutput(`${end}paint${start}`, '', true)).toEqual({
+      started: true,
+      ended: true,
+      active: true,
+      markerTail: start.slice(1)
+    })
+    expect(scanSynchronizedForegroundOutput(`${start}paint${end}`, '', false)).toEqual({
+      started: true,
+      ended: true,
+      active: false,
+      markerTail: end.slice(1)
+    })
+  })
+
+  it.each([start, end])('recognizes %j at every socket split', (marker) => {
+    for (let split = 1; split < marker.length; split++) {
+      const first = scanSynchronizedForegroundOutput(marker.slice(0, split), '', marker === end)
+      const second = scanSynchronizedForegroundOutput(
+        marker.slice(split),
+        first.markerTail,
+        first.active
+      )
+      expect(second).toEqual({
+        started: marker === start,
+        ended: marker === end,
+        active: marker === start,
+        markerTail: marker.slice(1)
+      })
+    }
+  })
+
+  it('leaves the latch unchanged for empty output and malformed lookalikes', () => {
+    for (const data of ['', 'ordinary output', '\x1b[?2026x'.repeat(2048)]) {
+      expect(scanSynchronizedForegroundOutput(data, '', true)).toEqual({
+        started: false,
+        ended: false,
+        active: true,
+        markerTail: data.slice(-7)
+      })
+    }
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-scan.ts b/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-scan.ts
index 8d8d53eebb6..b74f44a6d09 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-scan.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-scan.ts
@@ -58,27 +58,30 @@ export function scanSynchronizedForegroundOutput(
   let active = wasActive
   let started = false
   let ended = false
-  let offset = 0
+  let startIndex = scanData.indexOf(SYNCHRONIZED_OUTPUT_START_SEQUENCE)
+  let endIndex = scanData.indexOf(SYNCHRONIZED_OUTPUT_END_SEQUENCE)
 
-  while (offset < scanData.length) {
-    const startIndex = scanData.indexOf(SYNCHRONIZED_OUTPUT_START_SEQUENCE, offset)
-    const endIndex = scanData.indexOf(SYNCHRONIZED_OUTPUT_END_SEQUENCE, offset)
-    if (startIndex === -1 && endIndex === -1) {
-      break
-    }
+  // Each marker search advances independently, so a missing counterpart is scanned only once.
+  while (startIndex !== -1 || endIndex !== -1) {
     if (endIndex !== -1 && (startIndex === -1 || endIndex < startIndex)) {
       active = false
       if (endIndex + SYNCHRONIZED_OUTPUT_END_SEQUENCE.length > currentChunkStartIndex) {
         ended = true
       }
-      offset = endIndex + SYNCHRONIZED_OUTPUT_END_SEQUENCE.length
+      endIndex = scanData.indexOf(
+        SYNCHRONIZED_OUTPUT_END_SEQUENCE,
+        endIndex + SYNCHRONIZED_OUTPUT_END_SEQUENCE.length
+      )
       continue
     }
     active = true
     if (startIndex + SYNCHRONIZED_OUTPUT_START_SEQUENCE.length > currentChunkStartIndex) {
       started = true
     }
-    offset = startIndex + SYNCHRONIZED_OUTPUT_START_SEQUENCE.length
+    startIndex = scanData.indexOf(
+      SYNCHRONIZED_OUTPUT_START_SEQUENCE,
+      startIndex + SYNCHRONIZED_OUTPUT_START_SEQUENCE.length
+    )
   }
 
   return {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/fresh-spawn-follow-reset.ts b/src/renderer/src/components/terminal-pane/pty-connection/fresh-spawn-follow-reset.ts
index 83ab2e3f478..cb553ebc7de 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/fresh-spawn-follow-reset.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/fresh-spawn-follow-reset.ts
@@ -5,7 +5,8 @@ import {
   POST_REPLAY_DEAD_TUI_RESET,
   POST_REPLAY_MODE_RESET,
   POST_REPLAY_REATTACH_RESET,
-  POST_REPLAY_REATTACH_RESET_KEEP_MOUSE
+  POST_REPLAY_REATTACH_RESET_KEEP_MOUSE,
+  buildKittyKeyboardRestore
 } from '../../../../../shared/terminal-mode-reset-profiles'
 import { buildFreshShellViewportBlankingSequence } from '../terminal-restored-viewport'
 import { flushTerminalOutput } from '@/lib/pane-manager/pane-terminal-output-scheduler'
@@ -129,7 +130,29 @@ export function bindFreshSpawnFollowReset(session: ConnectPanePtySession): void
     })
   }
 
-  session.reattachReplayResetSequence = (
+  // Why one writer: the kitty mirror and xterm must parse every renderer-originated mode byte alike.
+  session.writeInputModeGround = (data: string): void => {
+    session.kittyKeyboardModes.scan(data)
+    session.writeReplayData(data)
+  }
+
+  /**
+   * Writes a post-replay reset ending in the mirror's Kitty flags, through the
+   * mirror first. The restore is built after scanning the profile because its
+   * `?1049l` moves both records to the other screen's slot.
+   */
+  session.writeReplayEpilogue = <T>(
+    profile: string,
+    write: (data: string) => T = session.writeReplayData
+  ): T => {
+    session.kittyKeyboardModes.scan(profile)
+    const kitty = buildKittyKeyboardRestore(session.kittyKeyboardModes.snapshotFlags)
+    session.kittyKeyboardModes.scan(kitty)
+    return write(`${profile}${kitty}`)
+  }
+
+  /** Picks the post-replay reset profile for a reattach; the caller writes it via writeReplayEpilogue. */
+  session.chooseReattachReplayReset = (
     payload: string,
     ownerProcessEnded = false,
     isAlternateScreen?: boolean,
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/fresh-spawn-start.ts b/src/renderer/src/components/terminal-pane/pty-connection/fresh-spawn-start.ts
index 29bc438a01c..b260adcccb8 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/fresh-spawn-start.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/fresh-spawn-start.ts
@@ -1,4 +1,5 @@
 import { useAppStore } from '@/store'
+import { PROCESS_BOUNDARY_GROUND } from '../../../../../shared/terminal-mode-reset-profiles'
 import { hasPtySerializer } from '../pty-buffer-serializer'
 import { writeTerminalOutput } from '@/lib/pane-manager/pane-terminal-output-scheduler'
 
@@ -52,11 +53,9 @@ export function bindStartFreshSpawn(session: ConnectPanePtySession): void {
     // Why: a canceled old replay clear can preserve xterm's native
     // isUserScrolling flag. A replacement shell must start in follow mode.
     session.resetFreshSpawnFollowOutput()
-    // Why: a fresh spawn is a new process with kitty keyboard flags at
-    // zero. The exit-handler reset alone is not enough: a late exit from a
-    // replaced PTY takes the stale-transport early return and skips it, so
-    // a restart-in-place would leak the old TUI's flags into a fresh shell.
-    session.kittyKeyboardModes.reset()
+    // Why: a fresh spawn is a new process, so a restart-in-place must not
+    // inherit the old TUI's screen, mouse or kitty modes in xterm or the mirror.
+    session.writeInputModeGround(PROCESS_BOUNDARY_GROUND)
     session.prepareFreshShellViewportForSpawn(options)
     const coldRestoreOverride =
       startupOverride && 'launchConfig' in startupOverride
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/hidden-output-restore-abandon.ts b/src/renderer/src/components/terminal-pane/pty-connection/hidden-output-restore-abandon.ts
index 3d08e5d495b..3e30289c2f6 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/hidden-output-restore-abandon.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/hidden-output-restore-abandon.ts
@@ -1,4 +1,3 @@
-import { RESET_AFTER_BYTE_GAP } from '../../../../../shared/terminal-mode-reset-profiles'
 import { cancelScheduledHiddenOutputRestore } from '../hidden-output-restore-scheduler'
 
 import type { ConnectPanePtySession } from './connect-pane-pty-session'
@@ -62,7 +61,7 @@ export function bindAbandonHiddenOutputRestore(session: ConnectPanePtySession):
     // session.rearmRemoteHiddenOutputRestoreInsteadOfWarning. Only the quiet
     // flood-abandon reaches neither, and it still drains chunks below.
     else if (!rearmedRemoteRestore) {
-      session.writePtyOutputToXterm(RESET_AFTER_BYTE_GAP, true)
+      session.writeAbandonedRestoreGap()
     }
     if (hadPendingOverflow) {
       return
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/hidden-output-restore-drain.ts b/src/renderer/src/components/terminal-pane/pty-connection/hidden-output-restore-drain.ts
index 1705fbe2cdf..ea4c48f43f2 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/hidden-output-restore-drain.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/hidden-output-restore-drain.ts
@@ -1,6 +1,5 @@
 import { recordTerminalFreezeBreadcrumb } from '../terminal-freeze-breadcrumbs'
 import { redactPtyIdForDiagnostics } from '../../../../../shared/pty-delivery-diagnostics'
-import { RESET_AFTER_BYTE_GAP } from '../../../../../shared/terminal-mode-reset-profiles'
 import { cancelScheduledHiddenOutputRestore } from '../hidden-output-restore-scheduler'
 import { isRemoteExecutionHostPtyId } from '../remote-execution-host-pty'
 
@@ -173,7 +172,7 @@ export function bindHiddenOutputRestoreDrain(session: ConnectPanePtySession): vo
       cycle: session.hiddenOutputRestoreRemoteAbandonCycles
     })
     session.noteHiddenOutputRestoreFloodBackpressure()
-    session.writePtyOutputToXterm(RESET_AFTER_BYTE_GAP, true)
+    session.writeAbandonedRestoreGap()
     return true
   }
 }
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/hidden-output-restore-snapshot.ts b/src/renderer/src/components/terminal-pane/pty-connection/hidden-output-restore-snapshot.ts
index 450fdd799db..e895128b280 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/hidden-output-restore-snapshot.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/hidden-output-restore-snapshot.ts
@@ -6,7 +6,8 @@ import {
   POST_REPLAY_LIVE_SNAPSHOT_RESET,
   POST_REPLAY_DEAD_TUI_RESET,
   POST_REPLAY_REATTACH_RESET,
-  RESET_AFTER_BYTE_GAP
+  RESET_AFTER_BYTE_GAP,
+  buildKittyKeyboardRestore
 } from '../../../../../shared/terminal-mode-reset-profiles'
 import {
   discardTerminalOutput,
@@ -30,9 +31,18 @@ import { recordTerminalFreezeBreadcrumb } from '../terminal-freeze-breadcrumbs'
 import type { ConnectPanePtySession } from './connect-pane-pty-session'
 
 export function bindHiddenOutputRestoreSnapshot(session: ConnectPanePtySession): void {
+  // Why the kitty restore: an abandoned restore discards queued chunks the
+  // mirror already scanned, so xterm re-adopts the mirror's flags.
+  session.writeAbandonedRestoreGap = function (): void {
+    session.writePtyOutputToXterm(
+      `${RESET_AFTER_BYTE_GAP}${buildKittyKeyboardRestore(session.kittyKeyboardModes.snapshotFlags)}`,
+      true
+    )
+  }
+
   session.writeRestoreUnavailableWarning = function (): void {
     // The reset must parse before both the warning and any foreground drain.
-    session.writePtyOutputToXterm(RESET_AFTER_BYTE_GAP, true)
+    session.writeAbandonedRestoreGap()
     if (!shouldWritePtyOutputForeground(session.deps.isVisibleRef.current)) {
       return
     }
@@ -156,7 +166,7 @@ export function bindHiddenOutputRestoreSnapshot(session: ConnectPanePtySession):
               : hasLiveAgent
                 ? POST_REPLAY_LIVE_AGENT_SNAPSHOT_RESET
                 : POST_REPLAY_LIVE_SNAPSHOT_RESET
-          session.writeReplayData(postReplayReset)
+          session.writeReplayEpilogue(postReplayReset)
           if (snapshot.pendingEscapeTailAnsi) {
             // Why last: snapshot taken mid-escape; re-arm as the FINAL replay write (any later ESC aborts it) so the live tail completes it, not render literally (Bug E / #7329).
             session.writeReplayData(snapshot.pendingEscapeTailAnsi)
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/pane-agent-identity.ts b/src/renderer/src/components/terminal-pane/pty-connection/pane-agent-identity.ts
index 19cd7cc374b..2c86932c499 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/pane-agent-identity.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/pane-agent-identity.ts
@@ -1,8 +1,7 @@
 import { agentTypeToIconAgent } from '@/lib/agent-status'
 import { useAppStore } from '@/store'
 import { getConnectionId } from '@/lib/connection-context'
-import { replayIntoTerminal } from '../replay-guard'
-import { POST_REPLAY_REATTACH_RESET } from '../../../../../shared/terminal-mode-reset-profiles'
+import { CONFIRMED_SHELL_MODE_RESET } from '../../../../../shared/terminal-mode-reset-profiles'
 import {
   isLocalNativeWindowsConpty,
   resolveWindowsShellOverride
@@ -181,14 +180,7 @@ export function installPaneAgentIdentity(session: ConnectPanePtySession): void {
       // Why: a hard-killed agent leaves mouse/focus/kitty modes armed, and the
       // surviving shell then receives pointer moves as typed SGR reports; the
       // replay guard keeps xterm's auto-replies from leaking to the shell.
-      replayIntoTerminal(session.pane, session.deps.replayingPanesRef, POST_REPLAY_REATTACH_RESET, {
-        breadcrumbIdentity: {
-          tabId: session.deps.tabId,
-          worktreeId: session.deps.worktreeId,
-          ptyId: session.transport.getPtyId()
-        },
-        shouldRefreshViewportSynchronously: session.shouldRefreshForegroundSynchronously
-      })
+      session.writeInputModeGround(CONFIRMED_SHELL_MODE_RESET)
       if (reason === 'visible-pty') {
         state.clearAgentLaunchConfig(session.cacheKey)
         return
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/pane-serializer-register.ts b/src/renderer/src/components/terminal-pane/pty-connection/pane-serializer-register.ts
index b4a953ef5b5..2b75548ec39 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/pane-serializer-register.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/pane-serializer-register.ts
@@ -1,3 +1,4 @@
+import { buildProcessBoundaryGround } from '../../../../../shared/terminal-mode-reset-profiles'
 import { serializeWithAbsoluteCursor } from '../../../../../shared/terminal-serialize-absolute-cursor'
 import { isTerminalWritePipelineCertifiedDead } from '@/lib/pane-manager/terminal-write-pipeline-health'
 import { registerPtySerializer, registerPtyTitleSource } from '../pty-buffer-serializer'
@@ -72,10 +73,16 @@ export function bindRegisterPaneSerializer(session: ConnectPanePtySession): void
           return null
         }
       },
-      () => {
-        session.clearHiddenOutputRestoreState()
-        discardTerminalOutput(session.pane.terminal)
-        clearTerminalScrollbackAndFollowOutput(session.pane.terminal)
+      {
+        clear: () => {
+          session.clearHiddenOutputRestoreState()
+          discardTerminalOutput(session.pane.terminal)
+          clearTerminalScrollbackAndFollowOutput(session.pane.terminal)
+        },
+        resetInputModes: () =>
+          session.writeInputModeGround(
+            buildProcessBoundaryGround({ keepFocusReporting: session.isNativeWindowsConpty })
+          )
       }
     )
     const unregisterTitleSource = registerPtyTitleSource(ptyId, (handler) =>
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/pane-serializer-settle.ts b/src/renderer/src/components/terminal-pane/pty-connection/pane-serializer-settle.ts
index 9ca1202e9b1..8015e49dd11 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/pane-serializer-settle.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/pane-serializer-settle.ts
@@ -122,16 +122,22 @@ export function bindSettlePaneSerializer(session: ConnectPanePtySession): void {
     )
     // Why: xterm focus reports share this transport queue. Bypassing it can
     // race CSI I against the draft on ConPTY and expose a literal `[I` prefix.
-    void sendAgentDraftPasteContent(settings, ptyId, session.startupDraftPrompt, async (data) => {
-      const accepted = await writeTerminalPastePtyInput(session.transport, data)
-      if (accepted && !startupDraftInputRecorded) {
-        // Why: this transport write bypasses xterm's user-input signal; keep
-        // the composed draft from being discarded by later hibernation.
-        startupDraftInputRecorded = true
-        session.recordTerminalInputForHibernation()
+    void sendAgentDraftPasteContent(
+      settings,
+      ptyId,
+      session.startupDraftPrompt,
+      'launch',
+      async (data) => {
+        const accepted = await writeTerminalPastePtyInput(session.transport, data, 'launch')
+        if (accepted && !startupDraftInputRecorded) {
+          // Why: this transport write bypasses xterm's user-input signal; keep
+          // the composed draft from being discarded by later hibernation.
+          startupDraftInputRecorded = true
+          session.recordTerminalInputForHibernation()
+        }
+        return accepted
       }
-      return accepted
-    })
+    )
       .catch(() => false)
       .finally(() => {
         startupDraftPasteInFlight = false
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/pty-exit-hibernate.test.ts b/src/renderer/src/components/terminal-pane/pty-connection/pty-exit-hibernate.test.ts
new file mode 100644
index 00000000000..5bd07b59141
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-connection/pty-exit-hibernate.test.ts
@@ -0,0 +1,40 @@
+import { describe, expect, it } from 'vitest'
+import type { SleepingAgentSessionRecord } from '../../../../../shared/agent-session-resume'
+import { noteArmsHibernatedPaneWake } from './pty-exit-hibernate'
+
+function note(overrides: Partial<SleepingAgentSessionRecord> = {}): SleepingAgentSessionRecord {
+  return {
+    paneKey: 'tab-1:leaf-1',
+    worktreeId: 'wt-1',
+    agent: 'codex',
+    providerSession: { key: 'session_id', id: 'conv-1' },
+    prompt: '',
+    state: 'done',
+    capturedAt: 1,
+    updatedAt: 1,
+    ...overrides
+  }
+}
+
+describe('noteArmsHibernatedPaneWake', () => {
+  it.each([
+    ['a hibernation note (worktree-sleep done)', true, note({ origin: 'worktree-sleep' })],
+    ['a legacy originless done note', true, note()],
+    // Why: #16308's incidental widening, kept; pty-connection-hibernation-wake.test.ts pins its effect.
+    ['a finished turn idle anchor (live done)', true, note({ origin: 'live' })],
+    ['an interrupted live turn', false, note({ origin: 'live', interrupted: true })],
+    [
+      'a failed live turn',
+      false,
+      note({ origin: 'live', mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 1 } })
+    ],
+    ['a quit capture', false, note({ origin: 'quit' })],
+    [
+      'a manual-sleep note still working',
+      false,
+      note({ origin: 'worktree-sleep', state: 'working' })
+    ]
+  ])('%s -> %s', (_label, expected, record) => {
+    expect(noteArmsHibernatedPaneWake(record)).toBe(expected)
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/pty-exit-hibernate.ts b/src/renderer/src/components/terminal-pane/pty-connection/pty-exit-hibernate.ts
index cdf4b869b12..98315f2ca6f 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/pty-exit-hibernate.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/pty-exit-hibernate.ts
@@ -6,13 +6,11 @@ import {
   deferPtyShutdownExit,
   isHostPtySleepPending
 } from '../pty-shutdown-exit-deferral'
-import { replayIntoTerminal } from '../replay-guard'
 import { POST_REPLAY_MODE_RESET } from '../../../../../shared/terminal-mode-reset-profiles'
 import { isProvenProcessExit } from '../../../../../shared/terminal-exit-cause'
-import {
-  getProviderSessionClaimKey,
-  isPassiveCompletedHibernationEvidence
-} from '@/lib/sleeping-agent-pane-ownership'
+import { getProviderSessionClaimKey } from '@/lib/sleeping-agent-pane-ownership'
+import type { SleepingAgentSessionRecord } from '../../../../../shared/agent-session-resume'
+import { agentTurnEndedUncleanly } from '../../../../../shared/agent-main-agent-verdict'
 import {
   createGitBashConsoleCapacityDetector,
   type GitBashConsoleCapacityDetector
@@ -22,6 +20,15 @@ import type { PtyPaneStartup } from '../pty-connection-types'
 import type { ConnectPanePtySession } from './connect-pane-pty-session'
 import { isPtyExitReplacedByRestart } from '../pty-exit-delivery'
 
+// Why live+done arms too: kept from #16308's wake-sweep widening; hibernation itself only writes worktree-sleep notes.
+export function noteArmsHibernatedPaneWake(record: SleepingAgentSessionRecord): boolean {
+  return (
+    record.state === 'done' &&
+    record.origin !== 'quit' &&
+    !(record.origin === 'live' && agentTurnEndedUncleanly(record))
+  )
+}
+
 /** PTY exit handling, hibernated-pane wake targets, and post-exit focus transfer. */
 export function installPtyExitHibernate(session: ConnectPanePtySession): void {
   type ProcessExitState = {
@@ -217,9 +224,6 @@ export function installPtyExitHibernate(session: ConnectPanePtySession): void {
     if (!isUnverifiedExit) {
       session.clearPanePtyFitBinding()
     }
-    // Why: the negotiating application died with its PTY; any replacement
-    // session starts with kitty keyboard flags at zero.
-    session.kittyKeyboardModes.reset()
     const isSuppressedExit =
       session.deps.consumeSuppressedPtyExit(ptyId) ||
       preserveRendererBinding ||
@@ -259,22 +263,12 @@ export function installPtyExitHibernate(session: ConnectPanePtySession): void {
       // is a wake hint or should be discarded; runtime cleanup above is enough.
       session.manager.setPaneGpuRendering(session.pane.id, true)
       const sleepingRecordEntry = session.getSleepingRecordForPane(useAppStore.getState())
-      if (
-        sleepingRecordEntry &&
-        isPassiveCompletedHibernationEvidence(sleepingRecordEntry.record)
-      ) {
+      if (sleepingRecordEntry && noteArmsHibernatedPaneWake(sleepingRecordEntry.record)) {
         // Why: hibernation killed this pane's PTY while hidden. The frozen TUI
         // frame still has mouse-tracking/bracketed-paste armed, which silently
         // eats every click and keystroke against a dead transport — disarm the
         // modes now and arm the reveal-time wake.
-        replayIntoTerminal(session.pane, session.deps.replayingPanesRef, POST_REPLAY_MODE_RESET, {
-          breadcrumbIdentity: {
-            tabId: session.deps.tabId,
-            worktreeId: session.deps.worktreeId,
-            ptyId
-          },
-          shouldRefreshViewportSynchronously: session.shouldRefreshForegroundSynchronously
-        })
+        session.writeInputModeGround(POST_REPLAY_MODE_RESET)
         session.hibernatedWakeTarget = { ptyId, record: sleepingRecordEntry.record }
         const pendingWakeMatches =
           session.pendingHibernatedWakeTarget?.ptyId === ptyId &&
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/pty-input-forward.ts b/src/renderer/src/components/terminal-pane/pty-connection/pty-input-forward.ts
index 6ff7c244443..aad2384bb27 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/pty-input-forward.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/pty-input-forward.ts
@@ -100,6 +100,8 @@ export function installPtyInputForward(session: ConnectPanePtySession): void {
       session.clearPendingTerminalInputIntent()
       return
     }
+    // Why xterm's provenance: its own focus reports reach onData too, and no person typed them.
+    const inputKind = wasUserInput ? 'driving' : 'query-reply'
     const intent = session.pendingTerminalInputIntent
     // Why: real xterm can deliver the terminal byte even when our DOM keydown
     // listener missed the press. Exact Ctrl+C/Escape bytes are still safe to
@@ -123,7 +125,7 @@ export function installPtyInputForward(session: ConnectPanePtySession): void {
       }
       session.clearPendingTerminalInputIntent()
       const writePromise = session.transport
-        .sendInputAccepted(data)
+        .sendInputAccepted(data, inputKind)
         .then((accepted): boolean | Promise<boolean> | null => {
           if (accepted) {
             // Why: rejected writes use transport recovery and must not arm a parser probe.
@@ -152,7 +154,7 @@ export function installPtyInputForward(session: ConnectPanePtySession): void {
     }
     if (intent) {
       session.claimViewportForUserActivity()
-      if (session.transport.sendInput(data)) {
+      if (session.transport.sendInput(data, inputKind)) {
         session.markAcceptedTerminalInputSent()
         session.observeAcceptedShellCommandInput(data)
         session.observeAcceptedTerminalInput(data, intent)
@@ -163,7 +165,7 @@ export function installPtyInputForward(session: ConnectPanePtySession): void {
       return
     }
     session.claimViewportForUserActivity()
-    if (session.transport.sendInput(data)) {
+    if (session.transport.sendInput(data, inputKind)) {
       session.markAcceptedTerminalInputSent()
       session.observeAcceptedShellCommandInput(data)
       session.observeAcceptedTerminalInput(data)
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/pty-input-recovery.ts b/src/renderer/src/components/terminal-pane/pty-connection/pty-input-recovery.ts
index cec1da62369..4533a02cd21 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/pty-input-recovery.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/pty-input-recovery.ts
@@ -21,6 +21,7 @@ import {
 
 import { isRemoteRuntimePtyId } from './paired-parked-terminal-restore'
 import { TRANSPORT_CONNECT_SETTLE_GRACE_MS } from './pty-connect-limits'
+import { shouldRetainDisposedPaneSpawn } from './disposed-spawn-retention'
 
 import type { ConnectPanePtySession } from './connect-pane-pty-session'
 import { resolveTerminalInlineImagesEnabled } from '../../../../../shared/terminal-inline-images-settings'
@@ -112,6 +113,14 @@ export function installPtyInputRecovery(session: ConnectPanePtySession): void {
     onPtyExit: session.onExit,
     onPtySpawn: session.onPtySpawn,
     onPtyRebind: session.onPtyRebind,
+    retainDisposedSpawn: () =>
+      shouldRetainDisposedPaneSpawn(
+        useAppStore.getState(),
+        session.deps.worktreeId,
+        session.deps.tabId,
+        session.pane.leafId,
+        session.executionHostId
+      ),
     ...(session.mainSideEffectAuthority
       ? {}
       : {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-context.test.ts b/src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-context.test.ts
index de3ee9011a8..46d2d41982d 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-context.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-context.test.ts
@@ -10,11 +10,14 @@ import type { ReattachPayloadContext } from './reattach-payload-context'
 import type { ReattachPayloadSession } from './reattach-payload-session'
 
 function createSession(overrides: Record<string, unknown> = {}): ReattachPayloadSession {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the handlers under test read only these session members.
   return {
     pane: createPane(1),
     rememberReattachPayloadAgentSignal: vi.fn(),
     writeReplayData: vi.fn(),
-    reattachReplayResetSequence: vi.fn(() => '<reset>'),
+    writeInputModeGround: vi.fn(),
+    chooseReattachReplayReset: vi.fn(() => '<reset>'),
+    writeReplayEpilogue: vi.fn(),
     sendFocusedReattachFocusInAfterReplay: vi.fn(),
     kittyKeyboardModes: {
       hasProvenBaseline: true,
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-session.ts b/src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-session.ts
index c9d53a56b54..b4c963d29f4 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-session.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-session.ts
@@ -5,6 +5,7 @@ export type ReattachPayloadSession = Pick<
   | 'applyColdRestoreAgentResumeStartup'
   | 'applySnapshotKittyKeyboardModes'
   | 'buildColdRestoreAgentResumeStartup'
+  | 'chooseReattachReplayReset'
   | 'clearSleepingRecordAfterColdRestoreSpawn'
   | 'consumeRestoredViewportBlankingMarker'
   | 'createReattachGridPush'
@@ -13,7 +14,6 @@ export type ReattachPayloadSession = Pick<
   | 'markHiddenOutputRestoreNeeded'
   | 'pane'
   | 'pendingReattachFit'
-  | 'reattachReplayResetSequence'
   | 'recordRendererOrderedSeq'
   | 'rememberReattachPayloadAgentSignal'
   | 'schedulePendingStartupCommandDelivery'
@@ -24,5 +24,7 @@ export type ReattachPayloadSession = Pick<
   | 'suppressStructuralReplayPtyResize'
   | 'transport'
   | 'writeFreshShellViewportBlanking'
+  | 'writeInputModeGround'
+  | 'writeReplayEpilogue'
   | 'writeReplayData'
 >
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-ssh-reconnect-model-paint.test.ts b/src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-ssh-reconnect-model-paint.test.ts
index 68782e666f6..bf14e261b2b 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-ssh-reconnect-model-paint.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-ssh-reconnect-model-paint.test.ts
@@ -36,11 +36,13 @@ function createSession(
   fireLog: FireLog,
   overrides: Record<string, unknown> = {}
 ): ReattachPayloadSession {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the handlers under test read only these session members.
   return {
     pane: createPane(1),
     rememberReattachPayloadAgentSignal: vi.fn(),
     writeReplayData: vi.fn((data: string) => fireLog.push(`write:${data}`)),
-    reattachReplayResetSequence: vi.fn(() => '<reset>'),
+    chooseReattachReplayReset: vi.fn(() => '<reset>'),
+    writeReplayEpilogue: vi.fn((profile: string) => fireLog.push(`write:${profile}`)),
     sendFocusedReattachFocusInAfterReplay: vi.fn(),
     applySnapshotKittyKeyboardModes: vi.fn(() => fireLog.push('kitty:snapshot-baseline')),
     setRestoredSnapshotBaseline: vi.fn(),
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/reattach-result-handler-park-reveal-verdict.test.ts b/src/renderer/src/components/terminal-pane/pty-connection/reattach-result-handler-park-reveal-verdict.test.ts
index 86237ac8f21..addf17ba8e8 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/reattach-result-handler-park-reveal-verdict.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/reattach-result-handler-park-reveal-verdict.test.ts
@@ -4,6 +4,7 @@ import { bindSerializeHiddenOutputSnapshot } from './hidden-output-snapshot-seri
 import type { ConnectPanePtySession } from './connect-pane-pty-session'
 import type { HiddenOutputSnapshotResult } from './hidden-output-snapshot-serialize'
 import type { ReattachPayloadContext } from './reattach-payload-context'
+import type { ColdRestoreAgentResumeStartup } from './fresh-spawn-types'
 
 /**
  * A park-reveal of a remote-runtime pty arrives with `replay: ''`, so the host
@@ -333,3 +334,64 @@ describe('handleReattachResult park-reveal snapshot verdict', () => {
     expect(bag.retryUnverifiableParkRevealSnapshot).toHaveBeenCalledOnce()
   })
 })
+
+// Retiring an empty reattach converges only locally: a remote disconnect() closes this viewer's
+// stream, so the resume would re-land on the same live host PTY and loop.
+describe('handleReattachResult empty reattach under a hibernation note', () => {
+  const record = {
+    paneKey: 'tab-1:leaf-1',
+    worktreeId: 'wt-1',
+    agent: 'codex',
+    providerSession: { key: 'session_id', id: 'conv-1' },
+    prompt: '',
+    state: 'done',
+    origin: 'worktree-sleep',
+    capturedAt: 1,
+    updatedAt: 1
+  } as const
+  const startup: ColdRestoreAgentResumeStartup = {
+    command: 'codex resume conv-1',
+    agent: 'codex',
+    resumeProviderSession: record.providerSession,
+    launchConfig: { agentArgs: '', agentEnv: {} },
+    launchToken: 'token-1',
+    useLiveEntry: false,
+    hasSleepingRecord: true,
+    sleepingRecordEntry: { paneKey: record.paneKey, record }
+  }
+
+  // The wake-hint row passes a non-remote stale id: only the result's remote id may decide.
+  it.each([
+    ['a fresh-spawn adoption', false, null],
+    ['a paired-parked reveal', true, REMOTE_PTY_ID],
+    ['a host wake-hint reattach', false, 'term_1']
+  ])('keeps the live remote PTY on %s', async (_label, mountFollowsTerminalPark, staleId) => {
+    const bag = buildParkRevealSession({
+      mountFollowsTerminalPark,
+      serializeHiddenOutputSnapshot: probeAnswers({ kind: 'snapshot', snapshot: HOST_IMAGE })
+    })
+
+    await expect(
+      bag.session.handleReattachResult(PARK_REVEAL_RESULT, staleId, startup)
+    ).resolves.toBe(true)
+
+    expect(bag.transport.disconnect).not.toHaveBeenCalled()
+    expect(bag.session.startFreshColdRestoreAgentResume).not.toHaveBeenCalled()
+    expect(bag.session.setPanePtyFitBinding).toHaveBeenCalledWith(REMOTE_PTY_ID)
+  })
+
+  it('retires an empty local fresh-spawn adoption and resumes the provider session', async () => {
+    const bag = buildParkRevealSession({ mountFollowsTerminalPark: false })
+
+    await expect(
+      bag.session.handleReattachResult({ id: 'local-pty-1', isReattach: true }, null, startup)
+    ).resolves.toBe(false)
+
+    expect(bag.transport.disconnect).toHaveBeenCalledOnce()
+    expect(bag.session.syncPanePtyLayoutBinding).toHaveBeenCalledWith(null)
+    expect(bag.session.startFreshColdRestoreAgentResume).toHaveBeenCalledExactlyOnceWith(startup, {
+      forceBlankRestoredViewport: true
+    })
+    expect(bag.session.setPanePtyFitBinding).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/reattach-result-handler.ts b/src/renderer/src/components/terminal-pane/pty-connection/reattach-result-handler.ts
index 25e5445a417..f141b671952 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/reattach-result-handler.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/reattach-result-handler.ts
@@ -5,12 +5,12 @@ import { warnTerminalLifecycleAnomaly } from '../terminal-lifecycle-diagnostics'
 // actually attached — nothing is inspectable while the session hydrates.
 import { notifyCodexPaneBoundForStaleSweep } from '@/lib/codex-stale-pane-sweep'
 import { useAppStore } from '@/store'
-import { isPassiveCompletedHibernationEvidence } from '@/lib/sleeping-agent-pane-ownership'
 import { parseAppSshPtyId } from '../../../../../shared/ssh-pty-id'
 import { resolveHiddenRestoreScrollbackRows } from '../terminal-hidden-restore-scrollback'
 import { shouldIgnoreStalePanePtyLayoutBinding } from './pane-pty-layout-binding'
 
 import { isRemoteRuntimePtyId } from './paired-parked-terminal-restore'
+import { hasEmptyReattachRetireEvidence } from './empty-reattach-retire-evidence'
 import type { ColdRestoreAgentResumeStartup } from './fresh-spawn-types'
 
 import type { ConnectPanePtySession } from './connect-pane-pty-session'
@@ -187,14 +187,12 @@ export function bindHandleReattachResult(sessionBag: ConnectPanePtySession): voi
     const hasStructuralReplay = Boolean(
       connectResult?.snapshot || connectResult?.replay || connectResult?.coldRestore
     )
-    const resumeComesFromPassiveHibernation = Boolean(
-      coldRestoreStartup &&
-      !coldRestoreStartup.useLiveEntry &&
-      coldRestoreStartup.sleepingRecordEntry &&
-      isPassiveCompletedHibernationEvidence(coldRestoreStartup.sleepingRecordEntry.record)
-    )
-    // Why: reattach drops startup commands; only passive hibernation is authority to retire an empty adopted shell and resume its provider session.
-    if (!hasStructuralReplay && connectResult?.isReattach && resumeComesFromPassiveHibernation) {
+    // Why: reattach drops startup commands; only real hibernation is authority to retire an empty adopted shell and resume its provider session.
+    if (
+      !hasStructuralReplay &&
+      connectResult?.isReattach &&
+      hasEmptyReattachRetireEvidence(ptyId, coldRestoreStartup)
+    ) {
       session.transport.disconnect()
       if (staleSessionId) {
         session.clearExitedPanePtyLayoutBinding(staleSessionId)
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/replay-data-drain.ts b/src/renderer/src/components/terminal-pane/pty-connection/replay-data-drain.ts
index 81ac85ed752..087326d0f40 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/replay-data-drain.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/replay-data-drain.ts
@@ -63,7 +63,7 @@ export function bindReplayDataDrain(session: ConnectPanePtySession): void {
       if (!session.shouldSendFocusedAgentReattachFocusIn() || !sendFocusMode) {
         return
       }
-      session.transport.sendInput(TERMINAL_FOCUS_IN_SEQUENCE)
+      session.transport.sendInput(TERMINAL_FOCUS_IN_SEQUENCE, 'query-reply')
     })
   }
 
@@ -158,8 +158,9 @@ export function bindReplayDataDrain(session: ConnectPanePtySession): void {
         continue
       }
       if (clearBeforeReplay || data.length > 0) {
-        await session.writeReplayDataAsync(
-          session.reattachReplayResetSequence(data, false, alternateScreen, terminalOwner)
+        await session.writeReplayEpilogue(
+          session.chooseReattachReplayReset(data, false, alternateScreen, terminalOwner),
+          session.writeReplayDataAsync
         )
         if (!isCurrentPayload()) {
           continue
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/session-reconcile-dispose.ts b/src/renderer/src/components/terminal-pane/pty-connection/session-reconcile-dispose.ts
index af21b11f25e..a48a56d9c7a 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/session-reconcile-dispose.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/session-reconcile-dispose.ts
@@ -7,10 +7,7 @@ import {
 import { cancelPendingSafeFitContinuations } from '@/lib/pane-manager/pane-tree-ops'
 import { PANE_PTY_RESIZE_HOLD_FLUSH_EVENT } from '@/lib/pane-manager/pane-pty-resize-hold'
 import { discardTerminalOutput } from '@/lib/pane-manager/pane-terminal-output-scheduler'
-import {
-  getProviderSessionClaimKey,
-  isPassiveCompletedHibernationEvidence
-} from '@/lib/sleeping-agent-pane-ownership'
+import { getProviderSessionClaimKey } from '@/lib/sleeping-agent-pane-ownership'
 import { releaseRendererPtyVisibilityClaim } from '../pty-renderer-delivery-claims'
 
 import { REMOTE_PTY_ID_PREFIX } from './pty-connect-limits'
@@ -18,6 +15,7 @@ import { SHIFT_ENTER_RECONFIRM_IDLE_MS } from './foreground-output-scan'
 import type { PanePtyBinding } from './pane-pty-binding'
 
 import type { ConnectPanePtySession } from './connect-pane-pty-session'
+import { noteArmsHibernatedPaneWake } from './pty-exit-hibernate'
 
 export function installSessionReconcileDispose(session: ConnectPanePtySession): PanePtyBinding {
   session.reconcileIfSessionDead = (
@@ -134,7 +132,7 @@ export function installSessionReconcileDispose(session: ConnectPanePtySession):
       const currentPtyId = session.transport.getPtyId()
       if (
         recordEntry &&
-        isPassiveCompletedHibernationEvidence(recordEntry.record) &&
+        noteArmsHibernatedPaneWake(recordEntry.record) &&
         currentPtyId !== null &&
         state.suppressedPtyExitIds[currentPtyId] === true &&
         !session.disposed &&
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/ssh-snapshot-prepaint.ts b/src/renderer/src/components/terminal-pane/pty-connection/ssh-snapshot-prepaint.ts
index 8dfe10e8a6e..fd2a4a097a2 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/ssh-snapshot-prepaint.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/ssh-snapshot-prepaint.ts
@@ -60,7 +60,7 @@ export function bindPrepaintParkedSshSnapshot(session: ConnectPanePtySession): v
             })) {
               session.writeReplayData(replayChunk)
             }
-            session.writeReplayData(session.reattachReplayResetSequence(modelData))
+            session.writeReplayEpilogue(session.chooseReattachReplayReset(modelData))
             if (snapshot.pendingEscapeTailAnsi) {
               session.writeReplayData(snapshot.pendingEscapeTailAnsi)
             }
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/write-pty-output-to-xterm.ts b/src/renderer/src/components/terminal-pane/pty-connection/write-pty-output-to-xterm.ts
index 3335776a118..34fdd14bf70 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/write-pty-output-to-xterm.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/write-pty-output-to-xterm.ts
@@ -1,6 +1,7 @@
 import { takeCurrentTerminalDeliveryCredit } from '@/lib/pane-manager/terminal-delivery-credit'
 import { nativeWindowsRewriteNeedsFollowupRenderRefresh } from '@/lib/pane-manager/terminal-complex-script'
 import { writeTerminalOutput } from '@/lib/pane-manager/pane-terminal-output-scheduler'
+import { RESET_TERMINAL_CURSOR_STYLE } from '../../../../../shared/terminal-mode-reset-profiles'
 import { forceFullViewportPresent } from '@/lib/pane-manager/terminal-render-pause-release'
 
 import { FOREGROUND_SYNCHRONIZED_FRAME_INTERACTIVE_WINDOW_MS } from './foreground-output-budgets'
@@ -126,7 +127,7 @@ export function bindWritePtyOutputToXterm(session: ConnectPanePtySession): void
       return
     }
     session.writePtyOutputToXterm(
-      session.idleAgentTerminalModeReset,
+      RESET_TERMINAL_CURSOR_STYLE,
       shouldWritePtyOutputForeground(session.deps.isVisibleRef.current)
     )
   }
diff --git a/src/renderer/src/components/terminal-pane/pty-input-write-queue-contract.ts b/src/renderer/src/components/terminal-pane/pty-input-write-queue-contract.ts
index 6ac6068f068..b3a2236fe1c 100644
--- a/src/renderer/src/components/terminal-pane/pty-input-write-queue-contract.ts
+++ b/src/renderer/src/components/terminal-pane/pty-input-write-queue-contract.ts
@@ -1,3 +1,5 @@
+import type { TerminalInputKind } from '../../../../shared/terminal-input-kind'
+
 export const TERMINAL_INPUT_COALESCE_MAX_CODE_UNITS = 4096
 export const PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLIES = 64
 export const PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLY_CODE_UNITS =
@@ -8,6 +10,7 @@ export type PendingPtyInputWrite = {
   id: string
   text: string
   replyOnly: boolean
+  inputKind: TerminalInputKind
   resolveAccepted: ((accepted: boolean) => void) | undefined
   tooLarge: boolean | Promise<boolean>
   chunks?: Iterator<string>
@@ -15,17 +18,17 @@ export type PendingPtyInputWrite = {
 }
 
 export type PtyInputWriteQueue = {
-  enqueue: (id: string, data: string) => boolean
+  enqueue: (id: string, data: string, inputKind: TerminalInputKind) => boolean
   enqueueQueryReply: (id: string, data: string) => boolean
-  enqueueAccepted: (id: string, data: string) => Promise<boolean>
+  enqueueAccepted: (id: string, data: string, inputKind: TerminalInputKind) => Promise<boolean>
   waitForDrain: () => Promise<void>
   clear: () => void
 }
 
 export type PtyInputWriteQueueDeps = {
   isWritable: (id: string) => boolean
-  write: (id: string, data: string) => void
-  writeAccepted?: (id: string, data: string) => Promise<boolean>
+  write: (id: string, data: string, inputKind: TerminalInputKind) => void
+  writeAccepted?: (id: string, data: string, inputKind: TerminalInputKind) => Promise<boolean>
   yieldBetweenWrites?: () => Promise<void>
   onDrainFailure?: (id: string) => void
 }
diff --git a/src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts b/src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts
index 556ba19f8a6..9b3099d0326 100644
--- a/src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts
@@ -81,7 +81,7 @@ describe('pty input write queue', () => {
     // Simulates a 2s aggressive trackpad gesture at 120Hz: 240 SGR reports
     // enqueued while the drain cannot run between events.
     for (let i = 0; i < 240; i += 1) {
-      expect(queue.enqueue('pty-1', WHEEL_UP_REPORT)).toBe(true)
+      expect(queue.enqueue('pty-1', WHEEL_UP_REPORT, 'driving')).toBe(true)
     }
     await queue.waitForDrain()
 
@@ -98,7 +98,7 @@ describe('pty input write queue', () => {
 
     const inputs = ['a', '\x1b[<65;1;1M', 'bc', '\x1b[A', 'd']
     for (const input of inputs) {
-      queue.enqueue('pty-1', input)
+      queue.enqueue('pty-1', input, 'driving')
     }
     await queue.waitForDrain()
 
@@ -112,10 +112,10 @@ describe('pty input write queue', () => {
       write: (id, data) => writes.push({ id, data })
     })
 
-    queue.enqueue('pty-1', 'a')
-    queue.enqueue('pty-1', 'b')
-    queue.enqueue('pty-2', 'c')
-    queue.enqueue('pty-1', 'd')
+    queue.enqueue('pty-1', 'a', 'driving')
+    queue.enqueue('pty-1', 'b', 'driving')
+    queue.enqueue('pty-2', 'c', 'driving')
+    queue.enqueue('pty-1', 'd', 'driving')
     await queue.waitForDrain()
 
     expect(writes).toEqual([
@@ -131,7 +131,7 @@ describe('pty input write queue', () => {
 
     const piece = 'x'.repeat(1000)
     for (let i = 0; i < 12; i += 1) {
-      queue.enqueue('pty-1', piece)
+      queue.enqueue('pty-1', piece, 'driving')
     }
     await queue.waitForDrain()
 
@@ -146,9 +146,9 @@ describe('pty input write queue', () => {
     const { writes, queue } = createRecordingQueue()
 
     const large = 'y'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES * 2 + 100)
-    queue.enqueue('pty-1', 'before')
-    queue.enqueue('pty-1', large)
-    queue.enqueue('pty-1', 'after')
+    queue.enqueue('pty-1', 'before', 'driving')
+    queue.enqueue('pty-1', large, 'driving')
+    queue.enqueue('pty-1', 'after', 'driving')
     await queue.waitForDrain()
 
     expect(writes.map((write) => write.data).join('')).toBe(`before${large}after`)
@@ -161,7 +161,7 @@ describe('pty input write queue', () => {
   it('rejects input over the terminal input byte limit without writing', async () => {
     const { writes, queue } = createRecordingQueue()
 
-    expect(queue.enqueue('pty-1', 'z'.repeat(TERMINAL_INPUT_MAX_BYTES + 1))).toBe(false)
+    expect(queue.enqueue('pty-1', 'z'.repeat(TERMINAL_INPUT_MAX_BYTES + 1), 'driving')).toBe(false)
     await queue.waitForDrain()
 
     expect(writes).toEqual([])
@@ -171,9 +171,9 @@ describe('pty input write queue', () => {
     let writable = true
     const { writes, queue } = createRecordingQueue({ writable: () => writable })
 
-    queue.enqueue('pty-1', 'a')
+    queue.enqueue('pty-1', 'a', 'driving')
     writable = false
-    queue.enqueue('pty-1', 'b')
+    queue.enqueue('pty-1', 'b', 'driving')
     await queue.waitForDrain()
 
     expect(writes).toEqual([{ id: 'pty-1', data: 'a' }])
@@ -210,7 +210,7 @@ describe('pty input write queue', () => {
     const reply = mode2031SequenceFor('dark')
 
     queue.enqueueQueryReply('pty-1', reply)
-    queue.enqueue('pty-1', 'y')
+    queue.enqueue('pty-1', 'y', 'driving')
     await queue.waitForDrain()
 
     expect(writes).toEqual([
@@ -231,7 +231,7 @@ describe('pty input write queue', () => {
       allAccepted = queue.enqueueQueryReply('pty-1', reply) && allAccepted
     }
     expect(allAccepted).toBe(true)
-    expect(queue.enqueue('pty-1', 'k')).toBe(true)
+    expect(queue.enqueue('pty-1', 'k', 'driving')).toBe(true)
 
     await Promise.resolve()
     expect(pendingYields).toHaveLength(1)
@@ -256,7 +256,7 @@ describe('pty input write queue', () => {
     for (const reply of replies) {
       expect(queue.enqueueQueryReply('pty-1', reply)).toBe(true)
     }
-    expect(queue.enqueue('pty-1', 'k')).toBe(true)
+    expect(queue.enqueue('pty-1', 'k', 'driving')).toBe(true)
 
     await Promise.resolve()
     for (let turn = 0; turn < PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLIES; turn += 1) {
@@ -286,10 +286,10 @@ describe('pty input write queue', () => {
     expect(second.length * 3).toBeGreaterThan(PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLY_CODE_UNITS)
     queue.enqueueQueryReply('pty-1', first)
     queue.enqueueQueryReply('pty-1', dropped)
-    queue.enqueue('pty-1', 'x')
+    queue.enqueue('pty-1', 'x', 'driving')
     queue.enqueueQueryReply('pty-1', second)
     queue.enqueueQueryReply('pty-1', third)
-    queue.enqueue('pty-1', 'k')
+    queue.enqueue('pty-1', 'k', 'driving')
 
     await Promise.resolve()
     expect(pendingYields).toHaveLength(1)
@@ -365,7 +365,7 @@ describe('pty input write queue', () => {
     const replies = Array.from({ length: 10_000 }, (_, index) => `\x1b[?${index};1n`)
 
     for (const input of ordinary) {
-      expect(queue.enqueue('pty-1', input)).toBe(true)
+      expect(queue.enqueue('pty-1', input, 'driving')).toBe(true)
     }
     for (const reply of replies) {
       expect(queue.enqueueQueryReply('pty-1', reply)).toBe(true)
@@ -386,7 +386,7 @@ describe('pty input write queue', () => {
     const replies = Array.from({ length: 10_000 }, (_, index) => `\x1b[?${index};1n`)
 
     expect(queue.enqueueQueryReply('pty-1', '\x1b[?10000;1n')).toBe(true)
-    expect(queue.enqueue('pty-1', ordinary)).toBe(true)
+    expect(queue.enqueue('pty-1', ordinary, 'driving')).toBe(true)
     for (const reply of replies) {
       expect(queue.enqueueQueryReply('pty-1', reply)).toBe(true)
     }
@@ -413,14 +413,14 @@ describe('pty input write queue', () => {
     })
 
     try {
-      expect(queue.enqueue('pty-1', 'stale')).toBe(true)
-      expect(queue.enqueue('pty-1', 'also-stale')).toBe(false)
+      expect(queue.enqueue('pty-1', 'stale', 'driving')).toBe(true)
+      expect(queue.enqueue('pty-1', 'also-stale', 'driving')).toBe(false)
       await expect(queue.waitForDrain()).resolves.toBeUndefined()
 
       shouldThrow = false
-      expect(queue.enqueue('pty-1', 'still-stale')).toBe(false)
+      expect(queue.enqueue('pty-1', 'still-stale', 'driving')).toBe(false)
       queue.clear()
-      expect(queue.enqueue('pty-1', 'fresh')).toBe(true)
+      expect(queue.enqueue('pty-1', 'fresh', 'driving')).toBe(true)
       await queue.waitForDrain()
 
       expect(writes).toEqual([{ id: 'pty-1', data: 'fresh' }])
@@ -443,9 +443,9 @@ describe('pty input write queue', () => {
       }
     })
 
-    expect(queue.enqueue('pty-1', 'first')).toBe(true)
-    const accepted = queue.enqueueAccepted('pty-1', 'second')
-    expect(queue.enqueue('pty-1', 'third')).toBe(true)
+    expect(queue.enqueue('pty-1', 'first', 'driving')).toBe(true)
+    const accepted = queue.enqueueAccepted('pty-1', 'second', 'driving')
+    expect(queue.enqueue('pty-1', 'third', 'driving')).toBe(true)
     expect(queue.enqueueQueryReply('pty-1', 'fourth')).toBe(true)
     await flushAsyncTicks()
 
@@ -475,13 +475,13 @@ describe('pty input write queue', () => {
         delivered.push(`accepted:${data}`)
         if (!reentered) {
           reentered = true
-          queue.enqueue('pty-1', 'later')
+          queue.enqueue('pty-1', 'later', 'driving')
         }
         return acceptedWrite.promise
       }
     })
 
-    const accepted = queue.enqueueAccepted('pty-1', 'first')
+    const accepted = queue.enqueueAccepted('pty-1', 'first', 'driving')
     await flushAsyncTicks()
 
     expect(delivered).toEqual(['accepted:first'])
@@ -503,12 +503,12 @@ describe('pty input write queue', () => {
       writeAccepted: (_id, data) => {
         delivered.push(`accepted:${data}`)
         queue.clear()
-        queue.enqueue('pty-1', 'fresh')
+        queue.enqueue('pty-1', 'fresh', 'driving')
         return acceptedWrite.promise
       }
     })
 
-    const accepted = queue.enqueueAccepted('pty-1', 'stale')
+    const accepted = queue.enqueueAccepted('pty-1', 'stale', 'driving')
 
     await expect(accepted).resolves.toBe(false)
     await queue.waitForDrain()
@@ -533,12 +533,12 @@ describe('pty input write queue', () => {
         return acceptedWrite.promise
       }
     })
-    const active = queue.enqueueAccepted('pty-1', 'stale-active')
-    const pending = queue.enqueueAccepted('pty-1', 'stale-pending')
+    const active = queue.enqueueAccepted('pty-1', 'stale-active', 'driving')
+    const pending = queue.enqueueAccepted('pty-1', 'stale-pending', 'driving')
     await acceptedStarted.promise
 
     queue.clear()
-    expect(queue.enqueue('pty-1', 'fresh')).toBe(true)
+    expect(queue.enqueue('pty-1', 'fresh', 'driving')).toBe(true)
 
     await expect(active).resolves.toBe(false)
     await expect(pending).resolves.toBe(false)
@@ -567,7 +567,9 @@ describe('pty input write queue', () => {
     })
 
     try {
-      expect(queue.enqueue('pty-1', 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES * 2))).toBe(true)
+      expect(
+        queue.enqueue('pty-1', 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES * 2), 'driving')
+      ).toBe(true)
       expect(rejectYield).toBeDefined()
       rejectYield?.(failure)
       await queue.waitForDrain()
@@ -607,11 +609,13 @@ describe('pty input write queue', () => {
     })
 
     try {
-      expect(queue.enqueue('pty-1', 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES * 2))).toBe(true)
+      expect(
+        queue.enqueue('pty-1', 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES * 2), 'driving')
+      ).toBe(true)
       expect(rejectYield).toBeDefined()
       queue.clear()
       rejectNextYield = false
-      expect(queue.enqueue('pty-2', 'fresh')).toBe(true)
+      expect(queue.enqueue('pty-2', 'fresh', 'driving')).toBe(true)
       rejectYield?.(failure)
       await queue.waitForDrain()
 
@@ -697,8 +701,8 @@ describe('pty input write queue', () => {
     })
 
     const large = 'y'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES * 3)
-    queue.enqueue('pty-1', large)
-    queue.enqueue('pty-1', 'tail')
+    queue.enqueue('pty-1', large, 'driving')
+    queue.enqueue('pty-1', 'tail', 'driving')
     // First chunk is written synchronously, then the drain parks on the yield.
     expect(writes.length).toBe(1)
 
@@ -716,9 +720,9 @@ describe('pty input write queue', () => {
     const stale = 'é'.repeat(CLIPBOARD_TEXT_MEASURE_YIELD_CODE_UNITS + 1)
 
     try {
-      expect(queue.enqueue('pty-1', stale)).toBe(true)
+      expect(queue.enqueue('pty-1', stale, 'driving')).toBe(true)
       queue.clear()
-      expect(queue.enqueue('pty-1', 'fresh')).toBe(true)
+      expect(queue.enqueue('pty-1', 'fresh', 'driving')).toBe(true)
 
       await vi.runAllTimersAsync()
       await queue.waitForDrain()
@@ -755,7 +759,7 @@ describe('pty input write queue', () => {
     globalThis.gc?.()
     const heapBefore = process.memoryUsage().heapUsed
     for (let index = 0; index < 20_000; index += 1) {
-      await queue.enqueueAccepted('pty-1', 'x')
+      await queue.enqueueAccepted('pty-1', 'x', 'driving')
     }
     await queue.waitForDrain()
     globalThis.gc?.()
diff --git a/src/renderer/src/components/terminal-pane/pty-input-write-queue.ts b/src/renderer/src/components/terminal-pane/pty-input-write-queue.ts
index 31b37ed6af5..7f646354b27 100644
--- a/src/renderer/src/components/terminal-pane/pty-input-write-queue.ts
+++ b/src/renderer/src/components/terminal-pane/pty-input-write-queue.ts
@@ -12,6 +12,7 @@ import {
   type PtyInputWriteQueue,
   type PtyInputWriteQueueDeps
 } from './pty-input-write-queue-contract'
+import type { TerminalInputKind } from '../../../../shared/terminal-input-kind'
 import {
   createHeadQueue,
   peekHeadQueue,
@@ -111,7 +112,7 @@ export function createPtyInputWriteQueue(deps: PtyInputWriteQueueDeps): PtyInput
   // Why: one cancel per in-flight write rather than `.then()` on a queue-lifetime
   // promise — those reactions are retained until that promise settles, so a
   // long-lived pane accumulated one record per acknowledged write (Esc, Ctrl+C).
-  async function writeAcceptedChunk(id: string, data: string): Promise<boolean> {
+  async function writeAcceptedChunk(item: PendingPtyInputWrite, data: string): Promise<boolean> {
     let cancel = (): void => undefined
     const cancelled = new Promise<boolean>((resolve) => {
       cancel = () => resolve(false)
@@ -122,7 +123,9 @@ export function createPtyInputWriteQueue(deps: PtyInputWriteQueueDeps): PtyInput
     try {
       return await Promise.race([
         cancelled,
-        Promise.resolve(deps.writeAccepted?.(id, data) ?? false).catch(() => false)
+        Promise.resolve(deps.writeAccepted?.(item.id, data, item.inputKind) ?? false).catch(
+          () => false
+        )
       ])
     } finally {
       pendingAcceptedCancels.delete(cancel)
@@ -173,6 +176,7 @@ export function createPtyInputWriteQueue(deps: PtyInputWriteQueueDeps): PtyInput
               peek.tooLarge !== false ||
               peek.chunks !== undefined ||
               !isCoalesciblePtyInput(peek) ||
+              peek.inputKind !== next.inputKind ||
               payload.length + peek.text.length > TERMINAL_INPUT_COALESCE_MAX_CODE_UNITS
             ) {
               break
@@ -180,7 +184,7 @@ export function createPtyInputWriteQueue(deps: PtyInputWriteQueueDeps): PtyInput
             payload += peek.text
             removePending(peek)
           }
-          deps.write(next.id, payload)
+          deps.write(next.id, payload, next.inputKind)
           if (firstPending()) {
             await yieldBetweenWrites()
           }
@@ -196,8 +200,8 @@ export function createPtyInputWriteQueue(deps: PtyInputWriteQueueDeps): PtyInput
         }
         const writeGeneration = generation
         const accepted = next.resolveAccepted
-          ? await writeAcceptedChunk(next.id, chunk.value)
-          : (deps.write(next.id, chunk.value), true)
+          ? await writeAcceptedChunk(next, chunk.value)
+          : (deps.write(next.id, chunk.value, next.inputKind), true)
         if (generation !== writeGeneration || firstPending() !== next) {
           continue
         }
@@ -249,8 +253,9 @@ export function createPtyInputWriteQueue(deps: PtyInputWriteQueueDeps): PtyInput
 
   function enqueueInput(
     id: string,
-    data: string,
+    text: string,
     queryReply: boolean,
+    inputKind: TerminalInputKind,
     resolveAccepted?: PendingPtyInputWrite['resolveAccepted']
   ): boolean {
     try {
@@ -260,20 +265,28 @@ export function createPtyInputWriteQueue(deps: PtyInputWriteQueueDeps): PtyInput
       }
       // Every query reply stays atomic so host-side ordering can classify it (#13892).
       const replyOnly = queryReply
-      if (replyOnly && !admitReply(data)) {
+      if (replyOnly && !admitReply(text)) {
         return false
       }
-      const tooLarge = replyOnly ? false : isTerminalInputTooLargeWithDeferredMeasurement(data)
+      const tooLarge = replyOnly ? false : isTerminalInputTooLargeWithDeferredMeasurement(text)
       if (tooLarge === true) {
         resolveAccepted?.(false)
         return false
       }
-      const item = { sequence: nextSequence, id, text: data, replyOnly, tooLarge, resolveAccepted }
+      const item = {
+        sequence: nextSequence,
+        id,
+        text,
+        replyOnly,
+        inputKind,
+        tooLarge,
+        resolveAccepted
+      }
       nextSequence += 1
       if (replyOnly) {
         pendingReplies.items.push(item)
         pendingReplyCount += 1
-        pendingReplyCodeUnits += data.length
+        pendingReplyCodeUnits += text.length
       } else {
         pendingOrdinary.items.push(item)
       }
@@ -286,17 +299,17 @@ export function createPtyInputWriteQueue(deps: PtyInputWriteQueueDeps): PtyInput
   }
 
   return {
-    enqueue(id: string, data: string): boolean {
-      return enqueueInput(id, data, false)
+    enqueue(id: string, data: string, inputKind: TerminalInputKind): boolean {
+      return enqueueInput(id, data, false, inputKind)
     },
 
     enqueueQueryReply(id: string, data: string): boolean {
-      return enqueueInput(id, data, true)
+      return enqueueInput(id, data, true, 'query-reply')
     },
 
-    enqueueAccepted: (id, data) =>
+    enqueueAccepted: (id, data, inputKind) =>
       new Promise((resolve) => {
-        enqueueInput(id, data, false, resolve)
+        enqueueInput(id, data, false, inputKind, resolve)
       }),
 
     async waitForDrain(): Promise<void> {
diff --git a/src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.test.ts b/src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.test.ts
index d36c3a274ed..2595863cb3d 100644
--- a/src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.test.ts
@@ -11,9 +11,9 @@ describe('createPtyPreconnectInputBuffer', () => {
     const acceptedWrite = createDeferred<boolean>()
     const buffer = createPtyPreconnectInputBuffer()
     const delivered: string[] = []
-    const accepted = buffer.enqueueAccepted('first')
-    expect(buffer.enqueue('second', 'ordinary')).toBe(true)
-    expect(buffer.enqueue('third', 'immediate')).toBe(true)
+    const accepted = buffer.enqueueAccepted('first', 'driving')
+    expect(buffer.enqueue('second', 'ordinary', 'driving')).toBe(true)
+    expect(buffer.enqueue('third', 'immediate', 'driving')).toBe(true)
     const writer = {
       isCurrent: () => true,
       sendInput: (data: string) => {
@@ -52,9 +52,9 @@ describe('createPtyPreconnectInputBuffer', () => {
       const writeStarted = createDeferred<void>()
       const buffer = createPtyPreconnectInputBuffer()
       const sendInput = vi.fn(() => true)
-      const accepted = buffer.enqueueAccepted('first')
-      const laterAccepted = buffer.enqueueAccepted('third')
-      expect(buffer.enqueue('second', 'ordinary')).toBe(true)
+      const accepted = buffer.enqueueAccepted('first', 'driving')
+      const laterAccepted = buffer.enqueueAccepted('third', 'driving')
+      expect(buffer.enqueue('second', 'ordinary', 'driving')).toBe(true)
       const flushing = buffer.flush({
         isCurrent: () => true,
         sendInput,
@@ -72,7 +72,7 @@ describe('createPtyPreconnectInputBuffer', () => {
       await expect(laterAccepted).resolves.toBe(false)
       await expect(flushing).resolves.toBeUndefined()
       expect(sendInput).not.toHaveBeenCalled()
-      expect(buffer.enqueue('after-clear', 'ordinary')).toBe(false)
+      expect(buffer.enqueue('after-clear', 'ordinary', 'driving')).toBe(false)
 
       if (lateOutcome === 'resolve') {
         acceptedWrite.resolve(true)
@@ -91,7 +91,8 @@ describe('createPtyPreconnectInputBuffer', () => {
     const codeUnitWriteStarted = createDeferred<void>()
     const codeUnitBuffer = createPtyPreconnectInputBuffer()
     const codeUnitAccepted = codeUnitBuffer.enqueueAccepted(
-      'x'.repeat(PTY_PRECONNECT_INPUT_MAX_CODE_UNITS)
+      'x'.repeat(PTY_PRECONNECT_INPUT_MAX_CODE_UNITS),
+      'driving'
     )
     const codeUnitFlush = codeUnitBuffer.flush({
       isCurrent: () => true,
@@ -104,7 +105,7 @@ describe('createPtyPreconnectInputBuffer', () => {
     })
     await codeUnitWriteStarted.promise
 
-    expect(codeUnitBuffer.enqueue('overflow', 'ordinary')).toBe(false)
+    expect(codeUnitBuffer.enqueue('overflow', 'ordinary', 'driving')).toBe(false)
 
     codeUnitBuffer.clear()
     codeUnitWrite.resolve(true)
@@ -114,9 +115,9 @@ describe('createPtyPreconnectInputBuffer', () => {
     const entryWrite = createDeferred<boolean>()
     const entryWriteStarted = createDeferred<void>()
     const entryBuffer = createPtyPreconnectInputBuffer()
-    const entryAccepted = entryBuffer.enqueueAccepted('first')
+    const entryAccepted = entryBuffer.enqueueAccepted('first', 'driving')
     for (let index = 1; index < PTY_PRECONNECT_INPUT_MAX_ENTRIES; index += 1) {
-      expect(entryBuffer.enqueue('', 'ordinary')).toBe(true)
+      expect(entryBuffer.enqueue('', 'ordinary', 'driving')).toBe(true)
     }
     const entryFlush = entryBuffer.flush({
       isCurrent: () => true,
@@ -129,7 +130,7 @@ describe('createPtyPreconnectInputBuffer', () => {
     })
     await entryWriteStarted.promise
 
-    expect(entryBuffer.enqueue('', 'ordinary')).toBe(false)
+    expect(entryBuffer.enqueue('', 'ordinary', 'driving')).toBe(false)
 
     entryBuffer.clear()
     entryWrite.resolve(true)
@@ -141,12 +142,13 @@ describe('createPtyPreconnectInputBuffer', () => {
     const entryBuffer = createPtyPreconnectInputBuffer(
       Array.from({ length: PTY_PRECONNECT_INPUT_MAX_ENTRIES + 1 }, () => ({
         data: '',
-        kind: 'ordinary' as const
+        kind: 'ordinary' as const,
+        inputKind: 'driving' as const
       }))
     )
     let entryWrites = 0
 
-    expect(entryBuffer.enqueue('', 'ordinary')).toBe(false)
+    expect(entryBuffer.enqueue('', 'ordinary', 'driving')).toBe(false)
     await entryBuffer.flush({
       isCurrent: () => true,
       sendInput: () => {
@@ -158,12 +160,16 @@ describe('createPtyPreconnectInputBuffer', () => {
     expect(entryWrites).toBe(PTY_PRECONNECT_INPUT_MAX_ENTRIES)
 
     const codeUnitBuffer = createPtyPreconnectInputBuffer([
-      { data: 'x'.repeat(PTY_PRECONNECT_INPUT_MAX_CODE_UNITS), kind: 'ordinary' },
-      { data: 'overflow', kind: 'ordinary' }
+      {
+        data: 'x'.repeat(PTY_PRECONNECT_INPUT_MAX_CODE_UNITS),
+        kind: 'ordinary',
+        inputKind: 'driving'
+      },
+      { data: 'overflow', kind: 'ordinary', inputKind: 'driving' }
     ])
     const codeUnitWrites: number[] = []
 
-    expect(codeUnitBuffer.enqueue('new', 'ordinary')).toBe(false)
+    expect(codeUnitBuffer.enqueue('new', 'ordinary', 'driving')).toBe(false)
     await codeUnitBuffer.flush({
       isCurrent: () => true,
       sendInput: (data) => {
@@ -179,7 +185,7 @@ describe('createPtyPreconnectInputBuffer', () => {
     // Regression: an abandoned deferred spawn never reaches connect(), so nothing
     // drained the buffer and a paste awaiting sendInputAccepted hung forever.
     const buffer = createPtyPreconnectInputBuffer()
-    const pastePending = buffer.enqueueAccepted('pasted text')
+    const pastePending = buffer.enqueueAccepted('pasted text', 'driving')
     let settled = false
     void pastePending.then(() => {
       settled = true
diff --git a/src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.ts b/src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.ts
index 3dce1962bb9..cb8dec2d6d0 100644
--- a/src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.ts
+++ b/src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.ts
@@ -1,4 +1,5 @@
 import { CLIPBOARD_TEXT_MEASURE_YIELD_CODE_UNITS } from '../../../../shared/clipboard-text'
+import type { TerminalInputKind } from '../../../../shared/terminal-input-kind'
 
 export const PTY_PRECONNECT_INPUT_MAX_ENTRIES = 1024
 // Why: a retention budget, not the 16MB single-write ceiling. The deferral lasts
@@ -12,6 +13,7 @@ export type PtyPreconnectInputKind = 'ordinary' | 'immediate' | 'accepted'
 export type PtyPreconnectInputEntry = {
   data: string
   kind: PtyPreconnectInputKind
+  inputKind: TerminalInputKind
 }
 
 type BufferedInput = PtyPreconnectInputEntry & {
@@ -20,9 +22,9 @@ type BufferedInput = PtyPreconnectInputEntry & {
 
 type PreconnectInputWriter = {
   isCurrent: () => boolean
-  sendInput: (data: string) => boolean
+  sendInput: (data: string, inputKind: TerminalInputKind) => boolean
   sendInputImmediate: (data: string) => boolean
-  sendInputAccepted?: (data: string) => Promise<boolean>
+  sendInputAccepted?: (data: string, inputKind: TerminalInputKind) => Promise<boolean>
 }
 
 export type PtyPreconnectInputBuffer = {
@@ -30,10 +32,12 @@ export type PtyPreconnectInputBuffer = {
   enqueue: (
     data: string,
     kind: 'ordinary' | 'immediate',
+    inputKind: TerminalInputKind,
     onRetained?: (entry: PtyPreconnectInputEntry) => void
   ) => boolean
   enqueueAccepted: (
     data: string,
+    inputKind: TerminalInputKind,
     onRetained?: (entry: PtyPreconnectInputEntry) => void
   ) => Promise<boolean>
   flush: (writer: PreconnectInputWriter) => Promise<void>
@@ -70,14 +74,15 @@ export function createPtyPreconnectInputBuffer(
   const createInput = (
     data: string,
     kind: PtyPreconnectInputKind,
+    inputKind: TerminalInputKind,
     resolve?: BufferedInput['resolve']
-  ): BufferedInput => ({ data, kind, ...(resolve ? { resolve } : {}) })
+  ): BufferedInput => ({ data, kind, inputKind, ...(resolve ? { resolve } : {}) })
   const notifyRetained = (
     onRetained: ((entry: PtyPreconnectInputEntry) => void) | undefined,
     input: BufferedInput
   ): void => {
     try {
-      onRetained?.({ data: input.data, kind: input.kind })
+      onRetained?.({ data: input.data, kind: input.kind, inputKind: input.inputKind })
     } catch {
       // Handoff capture is advisory; a callback failure must not reject input admission.
     }
@@ -86,7 +91,7 @@ export function createPtyPreconnectInputBuffer(
   // Seeded entries came from a predecessor transport and must not be reported
   // back to that predecessor's handoff owner as newly typed input.
   for (const entry of initialEntries) {
-    retain(createInput(entry.data, entry.kind))
+    retain(createInput(entry.data, entry.kind, entry.inputKind))
   }
   const clear = (): void => {
     const dropped = pending
@@ -124,8 +129,8 @@ export function createPtyPreconnectInputBuffer(
             accepted = await Promise.race([
               Promise.resolve(
                 writer.sendInputAccepted
-                  ? writer.sendInputAccepted(input.data)
-                  : writer.sendInput(input.data)
+                  ? writer.sendInputAccepted(input.data, input.inputKind)
+                  : writer.sendInput(input.data, input.inputKind)
               ),
               flushStopped.then(() => null)
             ])
@@ -152,7 +157,7 @@ export function createPtyPreconnectInputBuffer(
         const accepted =
           input.kind === 'immediate'
             ? writer.sendInputImmediate(input.data)
-            : writer.sendInput(input.data)
+            : writer.sendInput(input.data, input.inputKind)
         if (!accepted) {
           clear()
           return
@@ -186,17 +191,17 @@ export function createPtyPreconnectInputBuffer(
 
   return {
     isBuffering: () => buffering,
-    enqueue(data, kind, onRetained) {
-      const input = createInput(data, kind)
+    enqueue(data, kind, inputKind, onRetained) {
+      const input = createInput(data, kind, inputKind)
       const retained = retain(input)
       if (retained) {
         notifyRetained(onRetained, input)
       }
       return retained
     },
-    enqueueAccepted(data, onRetained) {
+    enqueueAccepted(data, inputKind, onRetained) {
       return new Promise<boolean>((resolve) => {
-        const input = createInput(data, 'accepted', resolve)
+        const input = createInput(data, 'accepted', inputKind, resolve)
         if (!retain(input)) {
           resolve(false)
           return
diff --git a/src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts b/src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts
index 129c920f976..ed9c029d14c 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts
@@ -68,6 +68,22 @@ describe('createIpcPtyTransport', () => {
     expect(spawn).not.toHaveBeenCalled()
   })
 
+  it('keeps the recovery hint and raw diagnostic from a wrapped spawn error', async () => {
+    const { createIpcPtyTransport } = await import('./pty-transport')
+    vi.mocked(window.api.pty.spawn).mockRejectedValueOnce(
+      new Error(
+        "Error invoking remote method 'pty:spawn': Error: Close unused terminals, then try again.\nnode-pty: open_slave failed: EMFILE (errno 24)"
+      )
+    )
+    const onError = vi.fn()
+
+    await createIpcPtyTransport({}).connect({ url: '', callbacks: { onError } })
+
+    expect(onError).toHaveBeenCalledWith(
+      'Close unused terminals, then try again.\nnode-pty: open_slave failed: EMFILE (errno 24)'
+    )
+  })
+
   it('threads provider command ownership through the spawn IPC', async () => {
     const { createIpcPtyTransport } = await import('./pty-transport')
     const transport = createIpcPtyTransport({
diff --git a/src/renderer/src/components/terminal-pane/pty-transport-detach-attach-handoff.test.ts b/src/renderer/src/components/terminal-pane/pty-transport-detach-attach-handoff.test.ts
index 7cac9384052..3d1cec9ea77 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport-detach-attach-handoff.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport-detach-attach-handoff.test.ts
@@ -169,6 +169,46 @@ describe('createIpcPtyTransport', () => {
     expect(transport.getPtyId()).toBeNull()
   })
 
+  // A pane remounted mid-spawn is handed the same PTY by main's pane-spawn reservation, so a kill
+  // from the disposed transport lands on the successor's shell. The surface owner decides.
+  it('keeps a fresh spawn that resolves after destroy when the pane surface still owns it', async () => {
+    const { createIpcPtyTransport } = await import('./pty-transport')
+    const kill = vi.mocked(window.api.pty.kill)
+    let resolveSpawn: (result: { id: string }) => void = () => {}
+    vi.mocked(window.api.pty.spawn).mockImplementation(
+      () =>
+        new Promise((resolve) => {
+          resolveSpawn = resolve
+        })
+    )
+    const transport = createIpcPtyTransport({ retainDisposedSpawn: () => true })
+    const pending = transport.connect({ url: '', callbacks: {} })
+    await transport.destroy?.()
+    resolveSpawn({ id: 'pty-shared-with-successor' })
+
+    await expect(pending).resolves.toBeUndefined()
+    expect(kill).not.toHaveBeenCalled()
+  })
+
+  it('still kills a fresh spawn that resolves after destroy when nothing owns the surface', async () => {
+    const { createIpcPtyTransport } = await import('./pty-transport')
+    const kill = vi.mocked(window.api.pty.kill)
+    let resolveSpawn: (result: { id: string }) => void = () => {}
+    vi.mocked(window.api.pty.spawn).mockImplementation(
+      () =>
+        new Promise((resolve) => {
+          resolveSpawn = resolve
+        })
+    )
+    const transport = createIpcPtyTransport({ retainDisposedSpawn: () => false })
+    const pending = transport.connect({ url: '', callbacks: {} })
+    await transport.destroy?.()
+    resolveSpawn({ id: 'pty-orphaned' })
+
+    await expect(pending).resolves.toBeUndefined()
+    expect(kill).toHaveBeenCalledWith('pty-orphaned')
+  })
+
   it('drops the exit observer when abandoning an obsolete reattach without killing it', async () => {
     const { createIpcPtyTransport } = await import('./pty-transport')
     const onPtyExit = vi.fn()
diff --git a/src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts b/src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts
index 1060d617dd2..df2c11e08d4 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts
@@ -65,8 +65,8 @@ describe('createIpcPtyTransport', () => {
       const transport = createIpcPtyTransport({})
       await transport.connect({ url: '', callbacks: { onWriteUnavailable: recovery } })
 
-      expect(transport.sendInput('input')).toBe(true)
-      expect(transport.sendInput('later-input')).toBe(false)
+      expect(transport.sendInput('input', 'driving')).toBe(true)
+      expect(transport.sendInput('later-input', 'driving')).toBe(false)
 
       expect(recovery).toHaveBeenCalledOnce()
       expect(warn).toHaveBeenCalledWith('[pty-input-write-queue] drain failed:', failure)
@@ -80,8 +80,8 @@ describe('createIpcPtyTransport', () => {
     const localTransport = createIpcPtyTransport({})
 
     await localTransport.connect({ url: '', callbacks: {} })
-    await expect(localTransport.sendInputAccepted?.('\x03')).resolves.toBe(true)
-    expect(window.api.pty.writeAccepted).toHaveBeenCalledWith('pty-1', '\x03')
+    await expect(localTransport.sendInputAccepted?.('\x03', 'driving')).resolves.toBe(true)
+    expect(window.api.pty.writeAccepted).toHaveBeenCalledWith('pty-1', '\x03', 'driving')
 
     const sshTransport = createIpcPtyTransport({ connectionId: 'ssh-1' })
     await sshTransport.connect({ url: '', callbacks: {} })
@@ -103,8 +103,8 @@ describe('createIpcPtyTransport', () => {
     const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
 
     const connecting = transport.connect({ url: '', callbacks: {} })
-    expect(transport.sendInput('first-')).toBe(true)
-    const accepted = transport.sendInputAccepted?.('second-')
+    expect(transport.sendInput('first-', 'driving')).toBe(true)
+    const accepted = transport.sendInputAccepted?.('second-', 'driving')
     expect(transport.sendInputImmediate('third')).toBe(true)
     expect(window.api.pty.write).not.toHaveBeenCalled()
     expect(window.api.pty.writeAccepted).not.toHaveBeenCalled()
@@ -133,21 +133,21 @@ describe('createIpcPtyTransport', () => {
     const transport = createIpcPtyTransport({
       bufferInputUntilConnect: true,
       preconnectInput: [
-        { data: 'before-remount-', kind: 'ordinary' },
-        { data: '\x1b[0n', kind: 'immediate' },
-        { data: '\x03', kind: 'accepted' }
+        { data: 'before-remount-', kind: 'ordinary', inputKind: 'driving' },
+        { data: '\x1b[0n', kind: 'immediate', inputKind: 'query-reply' },
+        { data: '\x03', kind: 'accepted', inputKind: 'driving' }
       ],
       onPreconnectInput
     })
 
     const connecting = transport.connect({ url: '', callbacks: {} })
-    expect(transport.sendInput('new-ordinary-')).toBe(true)
+    expect(transport.sendInput('new-ordinary-', 'driving')).toBe(true)
     expect(transport.sendInputImmediate('new-immediate-')).toBe(true)
-    const accepted = transport.sendInputAccepted?.('new-accepted')
+    const accepted = transport.sendInputAccepted?.('new-accepted', 'driving')
     expect(onPreconnectInput.mock.calls).toEqual([
-      [{ data: 'new-ordinary-', kind: 'ordinary' }],
-      [{ data: 'new-immediate-', kind: 'immediate' }],
-      [{ data: 'new-accepted', kind: 'accepted' }]
+      [{ data: 'new-ordinary-', kind: 'ordinary', inputKind: 'driving' }],
+      [{ data: 'new-immediate-', kind: 'immediate', inputKind: 'query-reply' }],
+      [{ data: 'new-accepted', kind: 'accepted', inputKind: 'driving' }]
     ])
 
     spawn.resolve({ id: 'pty-1' })
@@ -180,8 +180,8 @@ describe('createIpcPtyTransport', () => {
       onPreconnectInput: (input) => captured.push(input)
     })
 
-    const predecessorAccepted = predecessor.sendInputAccepted?.('\x03')
-    expect(captured).toEqual([{ data: '\x03', kind: 'accepted' }])
+    const predecessorAccepted = predecessor.sendInputAccepted?.('\x03', 'driving')
+    expect(captured).toEqual([{ data: '\x03', kind: 'accepted', inputKind: 'driving' }])
 
     const successor = createIpcPtyTransport({ preconnectInput: captured })
     const connecting = successor.connect({ url: '', callbacks: {} })
@@ -205,17 +205,17 @@ describe('createIpcPtyTransport', () => {
       onPreconnectInput
     })
 
-    expect(transport.sendInput('ordinary')).toBe(true)
+    expect(transport.sendInput('ordinary', 'driving')).toBe(true)
     expect(transport.sendInputImmediate('immediate')).toBe(true)
-    const accepted = transport.sendInputAccepted?.('accepted')
+    const accepted = transport.sendInputAccepted?.('accepted', 'driving')
     expect(onPreconnectInput).toHaveBeenCalledTimes(3)
 
     await transport.connect({ url: '', callbacks: {} })
 
     await expect(accepted).resolves.toBe(true)
-    expect(window.api.pty.write).toHaveBeenCalledWith('pty-1', 'ordinary')
-    expect(window.api.pty.write).toHaveBeenCalledWith('pty-1', 'immediate')
-    expect(window.api.pty.writeAccepted).toHaveBeenCalledWith('pty-1', 'accepted')
+    expect(window.api.pty.write).toHaveBeenCalledWith('pty-1', 'ordinary', 'driving')
+    expect(window.api.pty.write).toHaveBeenCalledWith('pty-1', 'immediate', 'query-reply')
+    expect(window.api.pty.writeAccepted).toHaveBeenCalledWith('pty-1', 'accepted', 'driving')
   })
 
   it('keeps live acknowledged input ahead of later ordinary and immediate writes', async () => {
@@ -235,9 +235,9 @@ describe('createIpcPtyTransport', () => {
       const transport = createIpcPtyTransport({})
       await transport.connect({ url: '', callbacks: {} })
 
-      expect(transport.sendInput('first')).toBe(true)
-      const accepted = transport.sendInputAccepted?.('second')
-      expect(transport.sendInput('third')).toBe(true)
+      expect(transport.sendInput('first', 'driving')).toBe(true)
+      const accepted = transport.sendInputAccepted?.('second', 'driving')
+      expect(transport.sendInput('third', 'driving')).toBe(true)
       expect(transport.sendInputImmediate('fourth')).toBe(true)
       await flushAsyncTicks()
 
@@ -275,11 +275,11 @@ describe('createIpcPtyTransport', () => {
       const slowInput = 'é'.repeat(CLIPBOARD_TEXT_MEASURE_YIELD_CODE_UNITS + 1)
 
       const connecting = transport.connect({ url: '', callbacks: {} })
-      expect(transport.sendInput(slowInput)).toBe(true)
+      expect(transport.sendInput(slowInput, 'driving')).toBe(true)
       await connecting
 
-      const accepted = transport.sendInputAccepted?.('accepted')
-      expect(transport.sendInput('later')).toBe(true)
+      const accepted = transport.sendInputAccepted?.('accepted', 'driving')
+      expect(transport.sendInput('later', 'driving')).toBe(true)
       expect(transport.sendInputImmediate('reply')).toBe(true)
       expect(delivered).toEqual([])
 
@@ -318,14 +318,14 @@ describe('createIpcPtyTransport', () => {
     const { createIpcPtyTransport } = await import('./pty-transport')
     const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
 
-    expect(transport.sendInput('ordinary')).toBe(true)
-    const accepted = transport.sendInputAccepted?.('accepted')
+    expect(transport.sendInput('ordinary', 'driving')).toBe(true)
+    const accepted = transport.sendInputAccepted?.('accepted', 'driving')
     await transport.destroy?.()
 
     await expect(accepted).resolves.toBe(false)
-    expect(transport.sendInput('after-destroy')).toBe(false)
+    expect(transport.sendInput('after-destroy', 'driving')).toBe(false)
     expect(transport.sendInputImmediate('after-destroy')).toBe(false)
-    await expect(transport.sendInputAccepted?.('after-destroy')).resolves.toBe(false)
+    await expect(transport.sendInputAccepted?.('after-destroy', 'driving')).resolves.toBe(false)
     expect(window.api.pty.write).not.toHaveBeenCalled()
     expect(window.api.pty.writeAccepted).not.toHaveBeenCalled()
   })
@@ -341,11 +341,11 @@ describe('createIpcPtyTransport', () => {
       const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
 
       const connecting = transport.connect({ url: '', callbacks: {} })
-      const accepted = transport.sendInputAccepted?.('first')
-      expect(transport.sendInput('later')).toBe(true)
+      const accepted = transport.sendInputAccepted?.('first', 'driving')
+      expect(transport.sendInput('later', 'driving')).toBe(true)
       spawn.resolve({ id: 'pty-1' })
       await flushAsyncTicks()
-      expect(window.api.pty.writeAccepted).toHaveBeenCalledWith('pty-1', 'first')
+      expect(window.api.pty.writeAccepted).toHaveBeenCalledWith('pty-1', 'first', 'driving')
 
       if (teardown === 'disconnect') {
         transport.disconnect()
@@ -358,7 +358,7 @@ describe('createIpcPtyTransport', () => {
       await expect(accepted).resolves.toBe(false)
       await expect(connecting).resolves.toBe('pty-1')
       expect(window.api.pty.write).not.toHaveBeenCalled()
-      expect(transport.sendInput('after-teardown')).toBe(false)
+      expect(transport.sendInput('after-teardown', 'driving')).toBe(false)
 
       acceptedWrite.resolve(true)
       await flushAsyncTicks()
@@ -377,10 +377,10 @@ describe('createIpcPtyTransport', () => {
       const transport = createIpcPtyTransport({})
       await transport.connect({ url: '', callbacks: {} })
 
-      const accepted = transport.sendInputAccepted?.('first')
-      expect(transport.sendInput('later')).toBe(true)
+      const accepted = transport.sendInputAccepted?.('first', 'driving')
+      expect(transport.sendInput('later', 'driving')).toBe(true)
       await flushAsyncTicks()
-      expect(window.api.pty.writeAccepted).toHaveBeenCalledWith('pty-1', 'first')
+      expect(window.api.pty.writeAccepted).toHaveBeenCalledWith('pty-1', 'first', 'driving')
 
       if (teardown === 'disconnect') {
         transport.disconnect()
@@ -392,7 +392,7 @@ describe('createIpcPtyTransport', () => {
 
       await expect(accepted).resolves.toBe(false)
       expect(window.api.pty.write).not.toHaveBeenCalled()
-      expect(transport.sendInput('after-teardown')).toBe(false)
+      expect(transport.sendInput('after-teardown', 'driving')).toBe(false)
 
       acceptedWrite.resolve(true)
       await flushAsyncTicks()
@@ -412,7 +412,7 @@ describe('createIpcPtyTransport', () => {
       const onConnect = vi.fn()
 
       const connecting = transport.connect({ url: '', callbacks: { onConnect } })
-      const accepted = transport.sendInputAccepted?.('pending')
+      const accepted = transport.sendInputAccepted?.('pending', 'driving')
       if (teardown === 'disconnect') {
         transport.disconnect()
       } else {
@@ -551,18 +551,18 @@ describe('createIpcPtyTransport', () => {
       const chunk = 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES)
       await transport.connect({ url: '', callbacks: {} })
 
-      expect(transport.sendInput(`${chunk}${chunk}`)).toBe(true)
-      expect(window.api.pty.write).toHaveBeenCalledExactlyOnceWith('pty-1', chunk)
+      expect(transport.sendInput(`${chunk}${chunk}`, 'driving')).toBe(true)
+      expect(window.api.pty.write).toHaveBeenCalledExactlyOnceWith('pty-1', chunk, 'driving')
 
       onExit?.({ id: 'pty-1', code: 0 })
       transport.attach({ existingPtyId: 'pty-1', callbacks: {} })
-      expect(transport.sendInput('fresh')).toBe(true)
+      expect(transport.sendInput('fresh', 'driving')).toBe(true)
 
       await vi.runAllTimersAsync()
 
       expect(vi.mocked(window.api.pty.write).mock.calls).toEqual([
-        ['pty-1', chunk],
-        ['pty-1', 'fresh']
+        ['pty-1', chunk, 'driving'],
+        ['pty-1', 'fresh', 'driving']
       ])
     } finally {
       vi.useRealTimers()
@@ -577,22 +577,22 @@ describe('createIpcPtyTransport', () => {
     const chunk = 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES)
     await transport.connect({ url: '', callbacks: {} })
 
-    const accepted = transport.sendInputAccepted?.(`${chunk}stale-tail`)
+    const accepted = transport.sendInputAccepted?.(`${chunk}stale-tail`, 'driving')
     await flushAsyncTicks()
-    expect(window.api.pty.writeAccepted).toHaveBeenCalledExactlyOnceWith('pty-1', chunk)
+    expect(window.api.pty.writeAccepted).toHaveBeenCalledExactlyOnceWith('pty-1', chunk, 'driving')
 
     onExit?.({ id: 'pty-1', code: 0 })
     transport.attach({ existingPtyId: 'pty-1', callbacks: {} })
-    expect(transport.sendInput('fresh')).toBe(true)
+    expect(transport.sendInput('fresh', 'driving')).toBe(true)
 
     await expect(accepted).resolves.toBe(false)
     await flushAsyncTicks()
-    expect(window.api.pty.write).toHaveBeenCalledExactlyOnceWith('pty-1', 'fresh')
+    expect(window.api.pty.write).toHaveBeenCalledExactlyOnceWith('pty-1', 'fresh', 'driving')
 
     acceptedWrite.resolve(true)
     await flushAsyncTicks()
 
-    expect(window.api.pty.writeAccepted).toHaveBeenCalledExactlyOnceWith('pty-1', chunk)
+    expect(window.api.pty.writeAccepted).toHaveBeenCalledExactlyOnceWith('pty-1', chunk, 'driving')
     await expect(accepted).resolves.toBe(false)
   })
 
@@ -601,13 +601,13 @@ describe('createIpcPtyTransport', () => {
     const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
 
     expect(transport.sendInputImmediate('immediate')).toBe(true)
-    const accepted = transport.sendInputAccepted?.('accepted')
+    const accepted = transport.sendInputAccepted?.('accepted', 'driving')
     transport.disconnect()
 
     await expect(accepted).resolves.toBe(false)
-    expect(transport.sendInput('after-disconnect')).toBe(false)
+    expect(transport.sendInput('after-disconnect', 'driving')).toBe(false)
     expect(transport.sendInputImmediate('after-disconnect')).toBe(false)
-    await expect(transport.sendInputAccepted?.('after-disconnect')).resolves.toBe(false)
+    await expect(transport.sendInputAccepted?.('after-disconnect', 'driving')).resolves.toBe(false)
     expect(window.api.pty.write).not.toHaveBeenCalled()
     expect(window.api.pty.writeAccepted).not.toHaveBeenCalled()
   })
@@ -619,13 +619,13 @@ describe('createIpcPtyTransport', () => {
     bufferPreHandlerPtyExit(ptyId, 0)
     const { createIpcPtyTransport } = await import('./pty-transport')
     const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
-    const accepted = transport.sendInputAccepted?.('input')
+    const accepted = transport.sendInputAccepted?.('input', 'driving')
 
     transport.attach({ existingPtyId: ptyId, callbacks: {} })
 
     await expect(accepted).resolves.toBe(false)
     expect(transport.isConnected()).toBe(false)
-    expect(transport.sendInput('after-exit')).toBe(false)
+    expect(transport.sendInput('after-exit', 'driving')).toBe(false)
     clearPreHandlerPtyState(ptyId)
   })
 
@@ -635,7 +635,7 @@ describe('createIpcPtyTransport', () => {
     })
     const { createIpcPtyTransport } = await import('./pty-transport')
     const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
-    const accepted = transport.sendInputAccepted?.('input')
+    const accepted = transport.sendInputAccepted?.('input', 'driving')
 
     expect(() => transport.attach({ existingPtyId: 'pty-attach-failure', callbacks: {} })).toThrow(
       'dispatcher attach failed'
@@ -643,7 +643,7 @@ describe('createIpcPtyTransport', () => {
 
     await expect(accepted).resolves.toBe(false)
     expect(transport.isConnected()).toBe(false)
-    expect(transport.sendInput('after-failure')).toBe(false)
+    expect(transport.sendInput('after-failure', 'driving')).toBe(false)
   })
 
   it('settles and drops preconnect input when the split spawn fails', async () => {
@@ -652,14 +652,14 @@ describe('createIpcPtyTransport', () => {
     const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
     const onError = vi.fn()
 
-    expect(transport.sendInput('ordinary')).toBe(true)
-    const accepted = transport.sendInputAccepted?.('accepted')
+    expect(transport.sendInput('ordinary', 'driving')).toBe(true)
+    const accepted = transport.sendInputAccepted?.('accepted', 'driving')
     await transport.connect({ url: '', callbacks: { onError } })
 
     await expect(accepted).resolves.toBe(false)
-    expect(transport.sendInput('after-failure')).toBe(false)
+    expect(transport.sendInput('after-failure', 'driving')).toBe(false)
     expect(transport.sendInputImmediate('after-failure')).toBe(false)
-    await expect(transport.sendInputAccepted?.('after-failure')).resolves.toBe(false)
+    await expect(transport.sendInputAccepted?.('after-failure', 'driving')).resolves.toBe(false)
     expect(onError).toHaveBeenCalledWith('spawn failed')
     expect(window.api.pty.write).not.toHaveBeenCalled()
     expect(window.api.pty.writeAccepted).not.toHaveBeenCalled()
@@ -673,16 +673,16 @@ describe('createIpcPtyTransport', () => {
     const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
 
     const connecting = transport.connect({ url: '', callbacks: {} })
-    expect(transport.sendInput('first')).toBe(true)
-    const accepted = transport.sendInputAccepted?.('second')
-    expect(transport.sendInput('third')).toBe(true)
+    expect(transport.sendInput('first', 'driving')).toBe(true)
+    const accepted = transport.sendInputAccepted?.('second', 'driving')
+    expect(transport.sendInput('third', 'driving')).toBe(true)
 
     spawn.resolve({ id: 'pty-1' })
     await connecting
 
     await expect(accepted).resolves.toBe(false)
     expect(window.api.pty.write).toHaveBeenCalledOnce()
-    expect(window.api.pty.write).toHaveBeenCalledWith('pty-1', 'first')
+    expect(window.api.pty.write).toHaveBeenCalledWith('pty-1', 'first', 'driving')
   })
 
   it('drops acknowledged preconnect input when an earlier ordinary write fails', async () => {
@@ -695,8 +695,8 @@ describe('createIpcPtyTransport', () => {
     const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
 
     try {
-      expect(transport.sendInput('first')).toBe(true)
-      const accepted = transport.sendInputAccepted?.('second')
+      expect(transport.sendInput('first', 'driving')).toBe(true)
+      const accepted = transport.sendInputAccepted?.('second', 'driving')
       await transport.connect({ url: '', callbacks: {} })
 
       await expect(accepted).resolves.toBe(false)
@@ -712,12 +712,14 @@ describe('createIpcPtyTransport', () => {
     const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
 
     for (let index = 0; index < PTY_PRECONNECT_INPUT_MAX_ENTRIES; index += 1) {
-      expect(transport.sendInput('x')).toBe(true)
+      expect(transport.sendInput('x', 'driving')).toBe(true)
     }
-    expect(transport.sendInput('overflow')).toBe(false)
+    expect(transport.sendInput('overflow', 'driving')).toBe(false)
 
     const oversized = createIpcPtyTransport({ bufferInputUntilConnect: true })
-    expect(oversized.sendInput('x'.repeat(PTY_PRECONNECT_INPUT_MAX_CODE_UNITS + 1))).toBe(false)
+    expect(
+      oversized.sendInput('x'.repeat(PTY_PRECONNECT_INPUT_MAX_CODE_UNITS + 1), 'driving')
+    ).toBe(false)
     await transport.destroy?.()
     await oversized.destroy?.()
   })
@@ -731,14 +733,14 @@ describe('createIpcPtyTransport', () => {
 
       await transport.connect({ url: '', callbacks: {} })
 
-      expect(transport.sendInput(`${chunk}tail`)).toBe(true)
+      expect(transport.sendInput(`${chunk}tail`, 'driving')).toBe(true)
       expect(window.api.pty.write).toHaveBeenCalledTimes(1)
-      expect(window.api.pty.write).toHaveBeenNthCalledWith(1, 'pty-1', chunk)
+      expect(window.api.pty.write).toHaveBeenNthCalledWith(1, 'pty-1', chunk, 'driving')
 
       await vi.runOnlyPendingTimersAsync()
 
       expect(window.api.pty.write).toHaveBeenCalledTimes(2)
-      expect(window.api.pty.write).toHaveBeenNthCalledWith(2, 'pty-1', 'tail')
+      expect(window.api.pty.write).toHaveBeenNthCalledWith(2, 'pty-1', 'tail', 'driving')
     } finally {
       vi.useRealTimers()
     }
@@ -755,7 +757,7 @@ describe('createIpcPtyTransport', () => {
 
       await transport.connect({ url: '', callbacks: {} })
       expect(transport.sendInputImmediate(first)).toBe(true)
-      expect(transport.sendInput(ordinary)).toBe(true)
+      expect(transport.sendInput(ordinary, 'driving')).toBe(true)
       for (const reply of replies) {
         expect(transport.sendInputImmediate(reply)).toBe(true)
       }
@@ -763,11 +765,11 @@ describe('createIpcPtyTransport', () => {
       await vi.runAllTimersAsync()
 
       expect(vi.mocked(window.api.pty.write).mock.calls).toEqual([
-        ['pty-1', first],
-        ['pty-1', ordinary],
+        ['pty-1', first, 'query-reply'],
+        ['pty-1', ordinary, 'driving'],
         ...replies
           .slice(-PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLIES)
-          .map((reply) => ['pty-1', reply])
+          .map((reply) => ['pty-1', reply, 'query-reply'])
       ])
     } finally {
       vi.useRealTimers()
@@ -783,7 +785,7 @@ describe('createIpcPtyTransport', () => {
 
       await transport.connect({ url: '', callbacks: {} })
 
-      expect(transport.sendInput(text)).toBe(true)
+      expect(transport.sendInput(text, 'driving')).toBe(true)
       expect(window.api.pty.write).not.toHaveBeenCalled()
 
       await vi.runAllTimersAsync()
@@ -805,7 +807,7 @@ describe('createIpcPtyTransport', () => {
 
     await transport.connect({ url: '', callbacks: {} })
 
-    expect(transport.sendInput('x'.repeat(TERMINAL_INPUT_MAX_BYTES + 1))).toBe(false)
+    expect(transport.sendInput('x'.repeat(TERMINAL_INPUT_MAX_BYTES + 1), 'driving')).toBe(false)
     expect(window.api.pty.write).not.toHaveBeenCalled()
   })
 
@@ -818,16 +820,16 @@ describe('createIpcPtyTransport', () => {
 
       await transport.connect({ url: '', callbacks: {} })
 
-      const accepted = transport.sendInputAccepted?.(`${chunk}tail`)
+      const accepted = transport.sendInputAccepted?.(`${chunk}tail`, 'driving')
       await Promise.resolve()
       expect(window.api.pty.writeAccepted).toHaveBeenCalledTimes(1)
-      expect(window.api.pty.writeAccepted).toHaveBeenNthCalledWith(1, 'pty-1', chunk)
+      expect(window.api.pty.writeAccepted).toHaveBeenNthCalledWith(1, 'pty-1', chunk, 'driving')
 
       await vi.runOnlyPendingTimersAsync()
 
       await expect(accepted).resolves.toBe(true)
       expect(window.api.pty.writeAccepted).toHaveBeenCalledTimes(2)
-      expect(window.api.pty.writeAccepted).toHaveBeenNthCalledWith(2, 'pty-1', 'tail')
+      expect(window.api.pty.writeAccepted).toHaveBeenNthCalledWith(2, 'pty-1', 'tail', 'driving')
     } finally {
       vi.useRealTimers()
     }
@@ -842,7 +844,7 @@ describe('createIpcPtyTransport', () => {
 
       await transport.connect({ url: '', callbacks: {} })
 
-      const accepted = transport.sendInputAccepted?.(text)
+      const accepted = transport.sendInputAccepted?.(text, 'driving')
       await Promise.resolve()
       expect(window.api.pty.writeAccepted).not.toHaveBeenCalled()
 
@@ -867,7 +869,7 @@ describe('createIpcPtyTransport', () => {
     await transport.connect({ url: '', callbacks: {} })
 
     await expect(
-      transport.sendInputAccepted?.('x'.repeat(TERMINAL_INPUT_MAX_BYTES + 1))
+      transport.sendInputAccepted?.('x'.repeat(TERMINAL_INPUT_MAX_BYTES + 1), 'driving')
     ).resolves.toBe(false)
     expect(window.api.pty.writeAccepted).not.toHaveBeenCalled()
   })
diff --git a/src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts b/src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts
index 879db477f40..b10fd3fe1ba 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts
@@ -92,7 +92,7 @@ describe('createIpcPtyTransport', () => {
     await transport.connect({ url: '', callbacks: { onError } })
     expect(onError).toHaveBeenCalled()
     expect(transport.isConnected()).toBe(false)
-    expect(transport.sendInput('echo hello\r')).toBe(false)
+    expect(transport.sendInput('echo hello\r', 'driving')).toBe(false)
     await flushPtySideEffects()
     expect(write).not.toHaveBeenCalled()
 
@@ -102,7 +102,7 @@ describe('createIpcPtyTransport', () => {
     await transport.connect({ url: '', callbacks: { onError: onErrorKilled } })
     expect(onErrorKilled).not.toHaveBeenCalled()
     expect(transport.isConnected()).toBe(false)
-    expect(transport.sendInput('echo hello\r')).toBe(false)
+    expect(transport.sendInput('echo hello\r', 'driving')).toBe(false)
     await flushPtySideEffects()
     expect(write).not.toHaveBeenCalled()
   })
@@ -153,7 +153,10 @@ describe('createIpcPtyTransport', () => {
     const onDataCallback = vi.fn()
     const onExitCallback = vi.fn()
     spawn.mockResolvedValueOnce({ id: 'pty-fresh-fallback', sessionExpired: true })
-    const transport = createIpcPtyTransport({ onPtySpawn })
+    // Built the way installPtyInputRecovery builds it: every real pane supplies
+    // retainDisposedSpawn, and for a live pane refusing its own id it answers "retain". The refusal
+    // must kill anyway — this transport is the pane's only one, so nothing else owns the PTY.
+    const transport = createIpcPtyTransport({ onPtySpawn, retainDisposedSpawn: () => true })
 
     const result = await transport.connect({
       url: '',
@@ -184,7 +187,7 @@ describe('createIpcPtyTransport', () => {
     const retirementError = new Error('provider shutdown refused')
     spawn.mockResolvedValueOnce({ id: 'pty-fresh-fallback', sessionExpired: true })
     kill.mockRejectedValueOnce(retirementError)
-    const transport = createIpcPtyTransport({ onPtySpawn })
+    const transport = createIpcPtyTransport({ onPtySpawn, retainDisposedSpawn: () => true })
 
     await expect(
       transport.connect({
diff --git a/src/renderer/src/components/terminal-pane/pty-transport-recycled-pty-incarnation.test.ts b/src/renderer/src/components/terminal-pane/pty-transport-recycled-pty-incarnation.test.ts
index 7936300fb06..2c521261b73 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport-recycled-pty-incarnation.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport-recycled-pty-incarnation.test.ts
@@ -10,7 +10,8 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   installIpcPtyWindow,
   restorePtySpecWindow,
-  type PtyExitPayload
+  type PtyExitPayload,
+  type PtyStreamPayload
 } from './pty-transport-test-harness'
 
 const RECYCLED_PTY_ID = 'ssh:target@@pty-1'
@@ -20,11 +21,16 @@ const FRESH_INCARNATION_ID = 'incarnation-of-the-shell-now-attaching'
 describe('createIpcPtyTransport against a relay-recycled PTY id', () => {
   const originalWindow = (globalThis as { window?: typeof window }).window
   let onExit: ((payload: PtyExitPayload) => void) | null = null
+  let onData: ((payload: PtyStreamPayload) => void) | null = null
 
   beforeEach(() => {
     vi.resetModules()
     onExit = null
+    onData = null
     installIpcPtyWindow(originalWindow, {
+      data: (callback) => {
+        onData = callback
+      },
       exit: (callback) => {
         onExit = callback
       }
@@ -82,6 +88,42 @@ describe('createIpcPtyTransport against a relay-recycled PTY id', () => {
     expect(paneExit).toHaveBeenCalledWith(3)
   })
 
+  it('delivers an authentication failure and exit after the main-side binding cleanup', async () => {
+    const { createIpcPtyTransport } = await import('./pty-transport')
+    const spawn = vi.mocked(window.api.pty.spawn)
+    let release!: () => void
+    const cleanup = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    spawn.mockImplementationOnce(async () => {
+      onData?.({ id: RECYCLED_PTY_ID, data: 'Authentication failed: sign in again.\r\n' })
+      onExit?.({ id: RECYCLED_PTY_ID, code: 1, incarnationId: FRESH_INCARNATION_ID })
+      await cleanup
+      return { id: RECYCLED_PTY_ID, incarnationId: FRESH_INCARNATION_ID }
+    })
+    const output = vi.fn()
+    const exit = vi.fn()
+    const error = vi.fn()
+    const connected = vi.fn()
+    const transport = createIpcPtyTransport()
+    const pending = transport.connect({
+      url: '',
+      callbacks: {
+        onData: output,
+        onExit: exit,
+        onError: error,
+        onConnect: connected
+      }
+    })
+    release()
+    expect(await pending).toEqual({ id: RECYCLED_PTY_ID, exitedBeforeAttach: true })
+    expect(output).toHaveBeenCalledWith('Authentication failed: sign in again.\r\n')
+    expect(exit).toHaveBeenCalledWith(1)
+    expect(output.mock.invocationCallOrder[0]).toBeLessThan(exit.mock.invocationCallOrder[0])
+    expect(error).not.toHaveBeenCalled()
+    expect(connected).not.toHaveBeenCalled()
+  })
+
   // Absence is unknown, never a mismatch — so an SSH host predating the field, and the relay's own
   // unnamed `{ id, code: -1 }` drop, keep exactly the behaviour #16970 shipped. (`remote:` runtime
   // PTYs are not covered by this: their exits never traverse `pty:exit` at all.)
diff --git a/src/renderer/src/components/terminal-pane/pty-transport-types.ts b/src/renderer/src/components/terminal-pane/pty-transport-types.ts
index c7753abbd3e..dce25fd547c 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport-types.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport-types.ts
@@ -10,6 +10,7 @@ import type {
 import type { StartupCommandDelivery } from '../../../../shared/codex-startup-delivery'
 import type { ProjectExecutionRuntimeResolution } from '../../../../shared/project-execution-runtime'
 import type { EventProps } from '../../../../shared/telemetry-events'
+import type { TerminalInputKind } from '../../../../shared/terminal-input-kind'
 import type { TerminalOscColorQueryReplyColors } from '../../../../shared/terminal-osc-color-reply'
 import type { TuiAgent } from '../../../../shared/tui-agent'
 import type { ExecutionHostId } from '../../../../shared/execution-host'
@@ -182,7 +183,7 @@ export type PtyTransport = {
     callbacks: PtyCallbacks
   }) => void
   disconnect: () => void
-  sendInput: (data: string) => boolean
+  sendInput: (data: string, inputKind: TerminalInputKind) => boolean
   // Why: latency-critical terminal query replies (CPR/DSR/DA/OSC color/pixel
   // size) must skip input coalescing — a querying program reads them in raw
   // mode with a short timeout, so a debounced reply lands on the shell prompt
@@ -190,7 +191,7 @@ export type PtyTransport = {
   // this is `sendInput` for them; the remote transport flushes pending input
   // (preserving order) and sends the reply immediately.
   sendInputImmediate: (data: string) => boolean
-  sendInputAccepted?: (data: string) => Promise<boolean>
+  sendInputAccepted?: (data: string, inputKind: TerminalInputKind) => Promise<boolean>
   /** Settles retained pre-connect input when a deferred spawn is abandoned before connect. */
   abandonPreconnectInput?: () => void
   claimViewport?: (cols: number, rows: number) => boolean
@@ -211,6 +212,8 @@ export type PtyTransport = {
   getRecoveryState?: () => PtyTransportRecoveryState
   /** Starts a fresh connection epoch while preserving the authoritative remote PTY identity. */
   retryRecovery?: () => boolean
+  /** Lets a wrapper retain input when recovery re-enters connect internally. */
+  setConnectForRecovery?: (connect: PtyTransport['connect']) => void
   /** The user dismissed the error surface; the next occurrence of the same message must surface again. */
   notifyErrorSurfaceDismissed?: () => void
   getPtyId: () => string | null
@@ -278,6 +281,9 @@ export type IpcPtyTransportOptions = {
   onPtyExit?: (ptyId: string, exitCode?: number) => void
   onTitleChange?: (title: string, rawTitle: string) => void
   onPtySpawn?: (ptyId: string) => void
+  /** Asked when a fresh spawn resolves after this transport was destroyed: true keeps the PTY for
+   *  the pane's successor (disposed-spawn-retention.ts); absent or false kills it. */
+  retainDisposedSpawn?: () => boolean
   /** Rebind an existing pane after its provider replaces the PTY identity. */
   onPtyRebind?: (ptyId: string, replacedPtyId: string, incarnationId?: string | null) => void
   onBell?: () => void
diff --git a/src/renderer/src/components/terminal-pane/pty-transport-user-input.test.ts b/src/renderer/src/components/terminal-pane/pty-transport-user-input.test.ts
new file mode 100644
index 00000000000..34a71b81b8c
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-transport-user-input.test.ts
@@ -0,0 +1,89 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createDeferred, flushAsyncTicks } from './pty-connection-test-async'
+import type { PtyPreconnectInputEntry } from './pty-preconnect-input-buffer'
+import { installIpcPtyWindow, restorePtySpecWindow } from './pty-transport-test-harness'
+
+describe('createIpcPtyTransport: input kind', () => {
+  const originalWindow: typeof window | undefined = globalThis.window
+
+  beforeEach(() => {
+    vi.resetModules()
+    installIpcPtyWindow(originalWindow, {})
+  })
+
+  afterEach(() => {
+    restorePtySpecWindow(originalWindow)
+  })
+
+  it('sends every write with the kind its writer gave it', async () => {
+    const { createIpcPtyTransport } = await import('./pty-transport')
+    const transport = createIpcPtyTransport({})
+    await transport.connect({ url: '', callbacks: {} })
+
+    transport.sendInput('typed', 'driving')
+    await flushAsyncTicks()
+    transport.sendInput('\x1b[I', 'query-reply')
+    await flushAsyncTicks()
+    transport.sendInputImmediate('\x1b[1;1R')
+    await flushAsyncTicks()
+    await transport.sendInputAccepted?.('echo startup\r', 'launch')
+
+    expect(vi.mocked(window.api.pty.write).mock.calls).toEqual([
+      ['pty-1', 'typed', 'driving'],
+      ['pty-1', '\x1b[I', 'query-reply'],
+      ['pty-1', '\x1b[1;1R', 'query-reply']
+    ])
+    expect(window.api.pty.writeAccepted).toHaveBeenCalledWith('pty-1', 'echo startup\r', 'launch')
+    transport.disconnect()
+  })
+
+  it('never merges bytes of different kinds', async () => {
+    const { createIpcPtyTransport } = await import('./pty-transport')
+    const transport = createIpcPtyTransport({})
+    await transport.connect({ url: '', callbacks: {} })
+
+    // The first write drains at once; what queues behind it would otherwise coalesce.
+    transport.sendInput('\x1b[O', 'query-reply')
+    transport.sendInput('\x1b[I', 'query-reply')
+    transport.sendInput('a', 'driving')
+    transport.sendInput('b', 'driving')
+
+    await vi.waitFor(() =>
+      expect(vi.mocked(window.api.pty.write).mock.calls).toEqual([
+        ['pty-1', '\x1b[O', 'query-reply'],
+        ['pty-1', '\x1b[I', 'query-reply'],
+        ['pty-1', 'ab', 'driving']
+      ])
+    )
+    transport.disconnect()
+  })
+
+  it('keeps the kind of input written before the spawn connects and across a remount', async () => {
+    const spawn = createDeferred<Awaited<ReturnType<typeof window.api.pty.spawn>>>()
+    vi.mocked(window.api.pty.spawn).mockReturnValue(spawn.promise)
+    const { createIpcPtyTransport } = await import('./pty-transport')
+    const captured: PtyPreconnectInputEntry[] = []
+    const predecessor = createIpcPtyTransport({
+      bufferInputUntilConnect: true,
+      onPreconnectInput: (entry) => captured.push(entry)
+    })
+    void predecessor.connect({ url: '', callbacks: {} })
+    predecessor.sendInput('typed-early', 'driving')
+    predecessor.sendInput('startup', 'launch')
+    predecessor.destroy?.()
+
+    const successor = createIpcPtyTransport({ preconnectInput: captured })
+    spawn.resolve({ id: 'pty-1' })
+    await successor.connect({ url: '', callbacks: {} })
+    await flushAsyncTicks()
+
+    expect(captured).toEqual([
+      { data: 'typed-early', kind: 'ordinary', inputKind: 'driving' },
+      { data: 'startup', kind: 'ordinary', inputKind: 'launch' }
+    ])
+    expect(vi.mocked(window.api.pty.write).mock.calls).toEqual([
+      ['pty-1', 'typed-early', 'driving'],
+      ['pty-1', 'startup', 'launch']
+    ])
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/pty-transport.ts b/src/renderer/src/components/terminal-pane/pty-transport.ts
index a8adfccb7ac..fd26a7324b5 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport.ts
@@ -5,6 +5,7 @@ import { createPtyInputWriteQueue } from './pty-input-write-queue'
 import { createPtyOutputProcessor } from './pty-output-processor'
 import { createPtyPreconnectInputBuffer } from './pty-preconnect-input-buffer'
 import type { IpcPtyTransportOptions, PtyTransport } from './pty-transport-types'
+import type { TerminalInputKind } from '../../../../shared/terminal-input-kind'
 
 export {
   ensurePtyDispatcher,
@@ -57,8 +58,8 @@ export function createIpcPtyTransport(opts: IpcPtyTransportOptions = {}): PtyTra
 
   const inputWriteQueue = createPtyInputWriteQueue({
     isWritable: (id) => !destroyed && connected && ptyId === id,
-    write: (id, data) => window.api.pty.write(id, data),
-    writeAccepted: (id, data) => window.api.pty.writeAccepted(id, data),
+    write: (id, data, inputKind) => window.api.pty.write(id, data, inputKind),
+    writeAccepted: (id, data, inputKind) => window.api.pty.writeAccepted(id, data, inputKind),
     onDrainFailure: (id) => {
       if (ptyId === id) {
         storedCallbacks.onWriteUnavailable?.()
@@ -115,12 +116,13 @@ export function createIpcPtyTransport(opts: IpcPtyTransportOptions = {}): PtyTra
     }
     await preconnectInputBuffer.flush({
       isCurrent: () => !destroyed && connected && ptyId === id,
-      sendInput: (data) => inputWriteQueue.enqueue(id, data),
+      sendInput: (data, inputKind) => inputWriteQueue.enqueue(id, data, inputKind),
       sendInputImmediate: (data) => inputWriteQueue.enqueueQueryReply(id, data),
       ...(connectionId
         ? {}
         : {
-            sendInputAccepted: (data: string) => inputWriteQueue.enqueueAccepted(id, data)
+            sendInputAccepted: (data: string, inputKind: TerminalInputKind) =>
+              inputWriteQueue.enqueueAccepted(id, data, inputKind)
           })
     })
   }
@@ -213,16 +215,23 @@ export function createIpcPtyTransport(opts: IpcPtyTransportOptions = {}): PtyTra
       storedCallbacks = {}
     },
 
-    sendInput(data) {
+    sendInput(data, inputKind) {
       if (!destroyed && preconnectInputBuffer?.isBuffering()) {
-        return preconnectInputBuffer.enqueue(data, 'ordinary', opts.onPreconnectInput)
+        return preconnectInputBuffer.enqueue(data, 'ordinary', inputKind, opts.onPreconnectInput)
       }
-      return !destroyed && connected && ptyId ? inputWriteQueue.enqueue(ptyId, data) : false
+      return !destroyed && connected && ptyId
+        ? inputWriteQueue.enqueue(ptyId, data, inputKind)
+        : false
     },
 
     sendInputImmediate(data) {
       if (!destroyed && preconnectInputBuffer?.isBuffering()) {
-        return preconnectInputBuffer.enqueue(data, 'immediate', opts.onPreconnectInput)
+        return preconnectInputBuffer.enqueue(
+          data,
+          'immediate',
+          'query-reply',
+          opts.onPreconnectInput
+        )
       }
       return !destroyed && connected && ptyId
         ? inputWriteQueue.enqueueQueryReply(ptyId, data)
@@ -232,14 +241,14 @@ export function createIpcPtyTransport(opts: IpcPtyTransportOptions = {}): PtyTra
     ...(connectionId
       ? {}
       : {
-          async sendInputAccepted(data: string): Promise<boolean> {
+          async sendInputAccepted(data: string, inputKind: TerminalInputKind): Promise<boolean> {
             if (!destroyed && preconnectInputBuffer?.isBuffering()) {
-              return preconnectInputBuffer.enqueueAccepted(data, opts.onPreconnectInput)
+              return preconnectInputBuffer.enqueueAccepted(data, inputKind, opts.onPreconnectInput)
             }
             if (destroyed || !connected || !ptyId) {
               return false
             }
-            return inputWriteQueue.enqueueAccepted(ptyId, data)
+            return inputWriteQueue.enqueueAccepted(ptyId, data, inputKind)
           }
         }),
 
diff --git a/src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts b/src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts
index 737339f4705..4ede67a8990 100644
--- a/src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts
@@ -65,6 +65,7 @@ describe('createRemotePaneLayoutPusher', () => {
       tabId: 'tab-1',
       root: layout.root,
       expandedLeafId: layout.expandedLeafId,
+      chatLeafId: null,
       titlesByLeafId: layout.titlesByLeafId
     })
   })
@@ -79,6 +80,18 @@ describe('createRemotePaneLayoutPusher', () => {
     expect(updateWebRuntimePaneLayout.mock.calls[0][0]).not.toHaveProperty('titlesByLeafId')
   })
 
+  it('publishes owner changes and an explicit clear without a geometry change', () => {
+    const pusher = createRemotePaneLayoutPusher()
+    for (const chatLeafId of ['leaf-a', 'leaf-b', undefined]) {
+      pusher.push({ worktreeId: 'wt-1', tabId: 'tab-1', layout: makeLayout({ chatLeafId }) })
+    }
+    expect(updateWebRuntimePaneLayout.mock.calls.map(([args]) => args.chatLeafId)).toEqual([
+      'leaf-a',
+      'leaf-b',
+      null
+    ])
+  })
+
   it('pushes again for every host-visible change', () => {
     const pusher = createRemotePaneLayoutPusher()
     pusher.push({ worktreeId: 'wt-1', tabId: 'tab-1', layout: makeLayout() })
diff --git a/src/renderer/src/components/terminal-pane/remote-pane-layout-push.ts b/src/renderer/src/components/terminal-pane/remote-pane-layout-push.ts
index 963d4b78355..35ef17b949b 100644
--- a/src/renderer/src/components/terminal-pane/remote-pane-layout-push.ts
+++ b/src/renderer/src/components/terminal-pane/remote-pane-layout-push.ts
@@ -35,6 +35,7 @@ export function createRemotePaneLayoutPusher(): RemotePaneLayoutPusher {
         tabId,
         root: layout.root,
         expandedLeafId: layout.expandedLeafId,
+        chatLeafId: layout.chatLeafId ?? null,
         ...(layout.titlesByLeafId ? { titlesByLeafId: layout.titlesByLeafId } : {})
       }).then((updated) => {
         // Why: a disconnected or timed-out push carried no information, so the next persist must retry it.
diff --git a/src/renderer/src/components/terminal-pane/remote-reattach-input-buffer.test.ts b/src/renderer/src/components/terminal-pane/remote-reattach-input-buffer.test.ts
new file mode 100644
index 00000000000..9b6a731b158
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/remote-reattach-input-buffer.test.ts
@@ -0,0 +1,150 @@
+import { describe, expect, it, vi } from 'vitest'
+import { createDeferred, flushAsyncTicks } from './pty-connection-test-async'
+import type { PtyConnectResult, PtyTransport } from './pty-transport-types'
+import { withRemoteReattachInputBuffer } from './remote-reattach-input-buffer'
+
+const ORIGINAL_ID = 'remote:environment@@term_original'
+
+function createHarness() {
+  const connected = createDeferred<PtyConnectResult | undefined>()
+  let ptyId: string | null = null
+  const writes: string[] = []
+  const delegate: PtyTransport = {
+    connect: vi.fn(() => connected.promise),
+    attach: vi.fn(),
+    disconnect: vi.fn(),
+    detach: vi.fn(),
+    destroy: vi.fn(),
+    isConnected: () => ptyId !== null,
+    getPtyId: () => ptyId,
+    resize: () => true,
+    sendInput: vi.fn((data) => {
+      if (!ptyId) {
+        return false
+      }
+      writes.push(data)
+      return true
+    }),
+    sendInputImmediate: vi.fn(() => false),
+    sendInputAccepted: vi.fn(async (data) => {
+      if (!ptyId) {
+        return false
+      }
+      writes.push(data)
+      return true
+    })
+  }
+  return {
+    delegate,
+    connected,
+    writes,
+    transport: withRemoteReattachInputBuffer(delegate),
+    finish(id: string | null = ORIGINAL_ID) {
+      ptyId = id
+      connected.resolve(id ? { id, isReattach: true } : undefined)
+    }
+  }
+}
+
+describe('remote reattach type-ahead', () => {
+  it('preserves typing from the restored screen before connect starts', async () => {
+    const harness = createHarness()
+    expect(harness.transport.sendInput('before', 'driving')).toBe(true)
+    const accepted = harness.transport.sendInputAccepted?.('\x03', 'driving')
+    const connecting = harness.transport.connect({ url: '', sessionId: ORIGINAL_ID, callbacks: {} })
+    expect(harness.transport.sendInput('after\r', 'driving')).toBe(true)
+    harness.finish()
+    await connecting
+    await expect(accepted).resolves.toBe(true)
+    expect(harness.writes).toEqual(['before', '\x03', 'after\r'])
+  })
+
+  it('discards pre-entry typing when the first connection creates a fresh terminal', async () => {
+    const harness = createHarness()
+    const accepted = harness.transport.sendInputAccepted?.('old tail\r', 'driving')
+    const connecting = harness.transport.connect({ url: '', callbacks: {} })
+    await expect(accepted).resolves.toBe(false)
+    harness.finish('remote:environment@@fresh')
+    await connecting
+    expect(harness.writes).toEqual([])
+  })
+
+  it('delivers typing and an acknowledged interrupt once the original endpoint reattaches', async () => {
+    const harness = createHarness()
+    const connecting = harness.transport.connect({ url: '', sessionId: ORIGINAL_ID, callbacks: {} })
+    expect(harness.transport.sendInput('partial', 'driving')).toBe(true)
+    const accepted = harness.transport.sendInputAccepted?.('\x03', 'driving')
+    expect(harness.transport.sendInput('next\r', 'driving')).toBe(true)
+    expect(harness.writes).toEqual([])
+    harness.finish()
+    await connecting
+    await expect(accepted).resolves.toBe(true)
+    expect(harness.writes).toEqual(['partial', '\x03', 'next\r'])
+    expect(harness.transport.sendInput('later', 'driving')).toBe(true)
+    expect(harness.writes.at(-1)).toBe('later')
+  })
+
+  it.each(['remote:environment@@term_replacement', null])(
+    'never forwards retained input when the original endpoint is unavailable: %s',
+    async (replacementId) => {
+      const harness = createHarness()
+      const connecting = harness.transport.connect({
+        url: '',
+        sessionId: ORIGINAL_ID,
+        callbacks: {}
+      })
+      const accepted = harness.transport.sendInputAccepted?.('dangerous tail\r', 'driving')
+      harness.finish(replacementId)
+      await connecting
+      await expect(accepted).resolves.toBe(false)
+      expect(harness.writes).toEqual([])
+    }
+  )
+
+  it.each(['disconnect', 'detach', 'destroy'] as const)(
+    'drops input and settles accepted writes on %s before a late reattach',
+    async (action) => {
+      const harness = createHarness()
+      const connecting = harness.transport.connect({
+        url: '',
+        sessionId: ORIGINAL_ID,
+        callbacks: {}
+      })
+      const accepted = harness.transport.sendInputAccepted?.('stale\r', 'driving')
+      harness.transport[action]?.()
+      await expect(accepted).resolves.toBe(false)
+      harness.finish()
+      await connecting
+      expect(harness.writes).toEqual([])
+    }
+  )
+
+  it('keeps newly typed bytes behind a pending acknowledged write', async () => {
+    const harness = createHarness()
+    const acknowledgement = createDeferred<boolean>()
+    harness.delegate.sendInputAccepted = () => acknowledgement.promise
+    const transport = withRemoteReattachInputBuffer(harness.delegate)
+    const connecting = transport.connect({ url: '', sessionId: ORIGINAL_ID, callbacks: {} })
+    const accepted = transport.sendInputAccepted?.('\x03', 'driving')
+    harness.finish()
+    await flushAsyncTicks()
+    expect(transport.sendInput('after interrupt\r', 'driving')).toBe(true)
+    expect(harness.writes).toEqual([])
+    acknowledgement.resolve(true)
+    await connecting
+    await expect(accepted).resolves.toBe(true)
+    expect(harness.writes).toEqual(['after interrupt\r'])
+  })
+
+  it('rejects pending writes when connection fails and leaves query replies unbuffered', async () => {
+    const harness = createHarness()
+    const connecting = harness.transport.connect({ url: '', sessionId: ORIGINAL_ID, callbacks: {} })
+    const accepted = harness.transport.sendInputAccepted?.('typed', 'driving')
+    expect(harness.transport.sendInput('\x1b[I', 'query-reply')).toBe(false)
+    expect(harness.transport.sendInputImmediate('\x1b[1;1R')).toBe(false)
+    harness.connected.reject(new Error('offline'))
+    await expect(connecting).rejects.toThrow('offline')
+    await expect(accepted).resolves.toBe(false)
+    expect(harness.writes).toEqual([])
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/remote-reattach-input-buffer.ts b/src/renderer/src/components/terminal-pane/remote-reattach-input-buffer.ts
new file mode 100644
index 00000000000..6e5969a74c8
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/remote-reattach-input-buffer.ts
@@ -0,0 +1,90 @@
+import { parseRemoteRuntimePtyId } from '../../../../shared/remote-runtime-pty-id'
+import { createPtyPreconnectInputBuffer } from './pty-preconnect-input-buffer'
+import type { PtyTransport } from './pty-transport-types'
+
+/** Keeps type-ahead on a restored screen bound to its original remote terminal. */
+export function withRemoteReattachInputBuffer(transport: PtyTransport): PtyTransport {
+  const sendAccepted = transport.sendInputAccepted?.bind(transport)
+  let pending: ReturnType<typeof createPtyPreconnectInputBuffer> | null =
+    createPtyPreconnectInputBuffer()
+  let entered = false
+  const clear = (): void => {
+    pending?.clear()
+    pending = null
+  }
+  const wrapped: PtyTransport = {
+    ...transport,
+    async connect(options) {
+      const expectedId = options.sessionId
+      const initialBuffer = entered ? null : pending
+      entered = true
+      const buffer =
+        expectedId && parseRemoteRuntimePtyId(expectedId)
+          ? (initialBuffer ?? createPtyPreconnectInputBuffer())
+          : null
+      // Restored pixels can accept typing before the first connect call begins.
+      if (pending !== buffer) {
+        clear()
+      }
+      pending = buffer
+      try {
+        const result = await transport.connect(options)
+        if (buffer) {
+          await buffer.flush({
+            // A replacement endpoint must never receive the old terminal's unfinished command.
+            isCurrent: () => pending === buffer && transport.getPtyId() === expectedId,
+            sendInput: (data, kind) => transport.sendInput(data, kind),
+            sendInputImmediate: (data) => transport.sendInputImmediate(data),
+            ...(sendAccepted ? { sendInputAccepted: sendAccepted } : {})
+          })
+        }
+        return result
+      } finally {
+        buffer?.clear()
+        if (pending === buffer) {
+          pending = null
+        }
+      }
+    },
+    sendInput(data, kind) {
+      return kind !== 'query-reply' && pending?.isBuffering()
+        ? pending.enqueue(data, 'ordinary', kind)
+        : transport.sendInput(data, kind)
+    },
+    // Emulator replies stay on the immediate path; replay must not retain them as user input.
+    ...(sendAccepted
+      ? {
+          sendInputAccepted: (data, kind) =>
+            kind !== 'query-reply' && pending?.isBuffering()
+              ? pending.enqueueAccepted(data, kind)
+              : sendAccepted(data, kind)
+        }
+      : {}),
+    attach(options) {
+      entered = true
+      clear()
+      transport.attach(options)
+    },
+    disconnect() {
+      entered = true
+      clear()
+      transport.disconnect()
+    },
+    ...(transport.detach
+      ? {
+          detach: (options) => {
+            entered = true
+            clear()
+            transport.detach?.(options)
+          }
+        }
+      : {}),
+    destroy(options) {
+      entered = true
+      clear()
+      return transport.destroy?.(options)
+    }
+  }
+  transport.setConnectForRecovery?.((options) => wrapped.connect(options))
+  return wrapped
+}
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-error-surface-dismissal.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-error-surface-dismissal.test.ts
index 1df9a355a05..b07afbb20d3 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-error-surface-dismissal.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-error-surface-dismissal.test.ts
@@ -48,18 +48,18 @@ describe('remote runtime error surface dismissal', () => {
     const onError = vi.fn()
     const transport = await attachTransportWithFatalSends(onError)
 
-    expect(await transport.sendInputAccepted?.('a')).toBe(false)
-    expect(await transport.sendInputAccepted?.('b')).toBe(false)
+    expect(await transport.sendInputAccepted?.('a', 'driving')).toBe(false)
+    expect(await transport.sendInputAccepted?.('b', 'driving')).toBe(false)
     // Contract preserved: one continuous outage still surfaces the repeated error once.
     expect(onError.mock.calls).toEqual([[FATAL_ERROR]])
 
     transport.notifyErrorSurfaceDismissed?.()
 
-    expect(await transport.sendInputAccepted?.('c')).toBe(false)
+    expect(await transport.sendInputAccepted?.('c', 'driving')).toBe(false)
     expect(onError.mock.calls).toEqual([[FATAL_ERROR], [FATAL_ERROR]])
 
     // The memory re-arms: repeats after the re-surfaced error are suppressed again until the next dismissal.
-    expect(await transport.sendInputAccepted?.('d')).toBe(false)
+    expect(await transport.sendInputAccepted?.('d', 'driving')).toBe(false)
     expect(onError).toHaveBeenCalledTimes(2)
     transport.destroy?.()
   })
@@ -68,9 +68,9 @@ describe('remote runtime error surface dismissal', () => {
     const onError = vi.fn()
     const transport = await attachTransportWithFatalSends(onError)
 
-    expect(await transport.sendInputAccepted?.('a')).toBe(false)
-    expect(await transport.sendInputAccepted?.('b')).toBe(false)
-    expect(await transport.sendInputAccepted?.('c')).toBe(false)
+    expect(await transport.sendInputAccepted?.('a', 'driving')).toBe(false)
+    expect(await transport.sendInputAccepted?.('b', 'driving')).toBe(false)
+    expect(await transport.sendInputAccepted?.('c', 'driving')).toBe(false)
 
     expect(onError).toHaveBeenCalledTimes(1)
     transport.destroy?.()
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-query-reply-immediate.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-query-reply-immediate.test.ts
index ec46891e9d5..6d8616a1baa 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-query-reply-immediate.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-query-reply-immediate.test.ts
@@ -71,7 +71,7 @@ describe('remote transport sendInputImmediate (#7329)', () => {
       await vi.waitFor(() => expect(runtimeSubscribe).toHaveBeenCalled())
 
       // Typed input: debounced — nothing sent before the 8ms flush.
-      expect(transport.sendInput('yes')).toBe(true)
+      expect(transport.sendInput('yes', 'driving')).toBe(true)
       expect(terminalSendCalls()).toEqual([])
 
       // Query reply (OSC 11 background color): sent immediately, no timer.
@@ -139,10 +139,10 @@ describe('remote transport sendInputImmediate (#7329)', () => {
     // A paste above CLIPBOARD_TEXT_MEASURE_YIELD_CODE_UNITS forces the async
     // validation path, so its bytes are captured in validationTail, not pending.
     const paste = 'p'.repeat(CLIPBOARD_TEXT_MEASURE_YIELD_CODE_UNITS + 1)
-    expect(transport.sendInput(paste)).toBe(true)
+    expect(transport.sendInput(paste, 'driving')).toBe(true)
     // Immediately (validation still pending) a TUI emits a CPR reply.
     expect(transport.sendInputImmediate('\x1b[3;1R')).toBe(true)
-    expect(transport.sendInput('z')).toBe(true)
+    expect(transport.sendInput('z', 'driving')).toBe(true)
 
     // Wait until the reply is actually flushed instead of sleeping a fixed
     // interval: the reply legitimately trails the paste's async validation plus
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts
index 6185198d59e..f5861cbc810 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts
@@ -523,7 +523,7 @@ describe('createRemoteRuntimePtyTransport', () => {
       }
       send.mockClear()
 
-      expect(transport.sendInput('ls\r')).toBe(true)
+      expect(transport.sendInput('ls\r', 'driving')).toBe(true)
       await vi.runOnlyPendingTimersAsync()
       expect(runtimeCall).not.toHaveBeenCalled()
       const inputFrame = decodeTerminalStreamFrame(send.mock.calls[0][0])
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts
index 398efce980a..58034193be8 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts
@@ -249,7 +249,9 @@ describe('createRemoteRuntimePtyTransport', () => {
       expect(handleEvents.getWebSessionTerminalHandleSubscriberCountForTests()).toBe(1)
 
       const listCallsAfterBound = hostListCalls
-      await expect(transport.sendInputAccepted?.('retry while reconnecting')).resolves.toBe(false)
+      await expect(
+        transport.sendInputAccepted?.('retry while reconnecting', 'driving')
+      ).resolves.toBe(false)
       await vi.advanceTimersByTimeAsync(16_000)
 
       // The accepted-snapshot listener already owns recovery. User input must
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-coalescing.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-coalescing.test.ts
index 999716aa43d..b77f0b26e82 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-coalescing.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-coalescing.test.ts
@@ -143,9 +143,9 @@ describe('createRemoteRuntimePtyTransport', () => {
       })
       await vi.waitFor(() => expect(runtimeSubscribe).toHaveBeenCalled())
       expect(transport.claimViewport?.(101, 33)).toBe(true)
-      expect(transport.sendInput('x')).toBe(true)
+      expect(transport.sendInput('x', 'driving')).toBe(true)
       expect(transport.sendInputImmediate('\x1b[?1;2c')).toBe(true)
-      expect(transport.sendInput('z')).toBe(true)
+      expect(transport.sendInput('z', 'driving')).toBe(true)
       await vi.advanceTimersByTimeAsync(8)
       expect(runtimeCall).not.toHaveBeenCalledWith(
         expect.objectContaining({ method: 'terminal.send' })
@@ -193,8 +193,8 @@ describe('createRemoteRuntimePtyTransport', () => {
       runtimeCall.mockClear()
       subscriptionSendBinary.mockClear()
 
-      expect(transport.sendInput('a')).toBe(true)
-      expect(transport.sendInput('b')).toBe(true)
+      expect(transport.sendInput('a', 'driving')).toBe(true)
+      expect(transport.sendInput('b', 'driving')).toBe(true)
       expect(runtimeCall).not.toHaveBeenCalled()
 
       await vi.runOnlyPendingTimersAsync()
@@ -225,8 +225,8 @@ describe('createRemoteRuntimePtyTransport', () => {
       runtimeCall.mockClear()
       subscriptionSendBinary.mockClear()
 
-      expect(transport.sendInput('a')).toBe(true)
-      expect(transport.sendInput('b')).toBe(true)
+      expect(transport.sendInput('a', 'driving')).toBe(true)
+      expect(transport.sendInput('b', 'driving')).toBe(true)
       await vi.runOnlyPendingTimersAsync()
 
       expect(runtimeCall).not.toHaveBeenCalled()
@@ -256,14 +256,14 @@ describe('createRemoteRuntimePtyTransport', () => {
       subscriptionSendBinary.mockClear()
 
       const chunk = 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES)
-      expect(transport.sendInput(chunk)).toBe(true)
+      expect(transport.sendInput(chunk, 'driving')).toBe(true)
       expect(subscriptionSendBinary).toHaveBeenCalledTimes(1)
       let frame = decodeTerminalStreamFrame(subscriptionSendBinary.mock.calls[0][0])
       expect(frame?.opcode).toBe(TerminalStreamOpcode.Input)
       expect(frame?.streamId).toBe(streamId)
       expect(frame ? decodeTerminalStreamText(frame.payload) : '').toBe(chunk)
 
-      expect(transport.sendInput('tail')).toBe(true)
+      expect(transport.sendInput('tail', 'driving')).toBe(true)
       await vi.runOnlyPendingTimersAsync()
 
       expect(runtimeCall).not.toHaveBeenCalled()
@@ -299,7 +299,7 @@ describe('createRemoteRuntimePtyTransport', () => {
 
     await transport.connect({ url: '', callbacks: {} })
 
-    await expect(transport.sendInputAccepted?.('\x03')).resolves.toBe(true)
+    await expect(transport.sendInputAccepted?.('\x03', 'driving')).resolves.toBe(true)
     expect(runtimeCall).toHaveBeenCalledWith({
       selector: 'env-1',
       method: 'terminal.send',
@@ -339,8 +339,8 @@ describe('createRemoteRuntimePtyTransport', () => {
       await transport.connect({ url: '', callbacks: {} })
       subscriptionSendBinary.mockClear()
 
-      expect(transport.sendInput('a')).toBe(true)
-      await expect(transport.sendInputAccepted?.('\x03')).resolves.toBe(true)
+      expect(transport.sendInput('a', 'driving')).toBe(true)
+      await expect(transport.sendInputAccepted?.('\x03', 'driving')).resolves.toBe(true)
       await vi.runOnlyPendingTimersAsync()
 
       expect(runtimeCall).toHaveBeenCalledWith({
@@ -383,7 +383,7 @@ describe('createRemoteRuntimePtyTransport', () => {
 
     await transport.connect({ url: '', callbacks: {} })
 
-    await expect(transport.sendInputAccepted?.('\x03')).resolves.toBe(false)
+    await expect(transport.sendInputAccepted?.('\x03', 'driving')).resolves.toBe(false)
   })
 
   it('splits large acknowledged remote input before terminal.send RPCs', async () => {
@@ -415,7 +415,7 @@ describe('createRemoteRuntimePtyTransport', () => {
     await transport.connect({ url: '', callbacks: {} })
 
     const chunk = '😀'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES / 4)
-    await expect(transport.sendInputAccepted?.(`${chunk}tail`)).resolves.toBe(true)
+    await expect(transport.sendInputAccepted?.(`${chunk}tail`, 'driving')).resolves.toBe(true)
 
     const sendCalls = runtimeCall.mock.calls.filter((call) => call[0].method === 'terminal.send')
     expect(sendCalls).toHaveLength(2)
@@ -455,7 +455,7 @@ describe('createRemoteRuntimePtyTransport', () => {
       await transport.connect({ url: '', callbacks: {} })
       runtimeCall.mockClear()
 
-      const accepted = transport.sendInputAccepted?.(text)
+      const accepted = transport.sendInputAccepted?.(text, 'driving')
       await Promise.resolve()
 
       expect(runtimeCall).not.toHaveBeenCalled()
@@ -502,9 +502,9 @@ describe('createRemoteRuntimePtyTransport', () => {
 
     await transport.connect({ url: '', callbacks: {} })
 
-    await expect(transport.sendInputAccepted?.(`${firstChunk}${rejectedChunk}after`)).resolves.toBe(
-      false
-    )
+    await expect(
+      transport.sendInputAccepted?.(`${firstChunk}${rejectedChunk}after`, 'driving')
+    ).resolves.toBe(false)
 
     const sendTexts = runtimeCall.mock.calls
       .filter((call) => call[0].method === 'terminal.send')
@@ -530,7 +530,10 @@ describe('createRemoteRuntimePtyTransport', () => {
     runtimeCall.mockClear()
 
     await expect(
-      transport.sendInputAccepted?.('😀'.repeat(Math.floor(TERMINAL_INPUT_MAX_BYTES / 4) + 1))
+      transport.sendInputAccepted?.(
+        '😀'.repeat(Math.floor(TERMINAL_INPUT_MAX_BYTES / 4) + 1),
+        'driving'
+      )
     ).resolves.toBe(false)
     expect(runtimeCall).not.toHaveBeenCalled()
   })
@@ -550,7 +553,7 @@ describe('createRemoteRuntimePtyTransport', () => {
       runtimeCall.mockClear()
       subscriptionSendBinary.mockClear()
 
-      expect(transport.sendInput('echo one\necho two\r\n')).toBe(true)
+      expect(transport.sendInput('echo one\necho two\r\n', 'driving')).toBe(true)
       await vi.runOnlyPendingTimersAsync()
 
       expect(runtimeCall).not.toHaveBeenCalled()
@@ -614,7 +617,7 @@ describe('createRemoteRuntimePtyTransport', () => {
       subscriptionSendBinary.mockClear()
 
       expect(transport.claimViewport?.(101, 33)).toBe(true)
-      expect(transport.sendInput('x')).toBe(true)
+      expect(transport.sendInput('x', 'driving')).toBe(true)
       await vi.runOnlyPendingTimersAsync()
 
       const frames = subscriptionSendBinary.mock.calls.map((call) =>
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts
index 6230bd00d8f..30c03745abe 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts
@@ -60,7 +60,7 @@ describe('createRemoteRuntimePtyTransport', () => {
         callbacks: { onWriteUnavailable }
       })
       await vi.waitFor(() => expect(transport.getPtyId()).toBe('remote:env-1@@terminal-1'))
-      expect(transport.sendInput('x')).toBe(true)
+      expect(transport.sendInput('x', 'driving')).toBe(true)
       await vi.advanceTimersByTimeAsync(8)
 
       await vi.waitFor(() => expect(onWriteUnavailable).toHaveBeenCalledOnce())
@@ -103,7 +103,7 @@ describe('createRemoteRuntimePtyTransport', () => {
         callbacks: { onWriteUnavailable, onError }
       })
       await vi.waitFor(() => expect(transport.getPtyId()).toBe('remote:env-1@@terminal-1'))
-      expect(transport.sendInput('x')).toBe(true)
+      expect(transport.sendInput('x', 'driving')).toBe(true)
       await vi.advanceTimersByTimeAsync(8)
 
       await vi.waitFor(() => expect(onWriteUnavailable).toHaveBeenCalledOnce())
@@ -148,7 +148,7 @@ describe('createRemoteRuntimePtyTransport', () => {
         callbacks: { onWriteUnavailable: oldWriteUnavailable }
       })
       await vi.waitFor(() => expect(transport.getPtyId()).toBe('remote:env-1@@terminal-1'))
-      expect(transport.sendInput('old')).toBe(true)
+      expect(transport.sendInput('old', 'driving')).toBe(true)
       await vi.advanceTimersByTimeAsync(8)
       await vi.waitFor(() =>
         expect(runtimeCall).toHaveBeenCalledWith(
@@ -205,7 +205,7 @@ describe('createRemoteRuntimePtyTransport', () => {
         callbacks: {}
       })
       await vi.waitFor(() => expect(transport.getPtyId()).toBe('remote:env-1@@terminal-old'))
-      expect(transport.sendInput('queued-for-old')).toBe(true)
+      expect(transport.sendInput('queued-for-old', 'driving')).toBe(true)
 
       resolvedPaneHandle = 'terminal-new'
       transport.attach({
@@ -322,7 +322,7 @@ describe('createRemoteRuntimePtyTransport', () => {
       subscriptionSendBinary.mockClear()
 
       // Why: replacement input stays disabled until terminal.resolvePane proves the new handle belongs to this pane.
-      expect(transport.sendInput('x')).toBe(false)
+      expect(transport.sendInput('x', 'driving')).toBe(false)
       vi.advanceTimersByTime(8)
 
       const inputFrames = subscriptionSendBinary.mock.calls
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-reattach-type-ahead.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-reattach-type-ahead.test.ts
new file mode 100644
index 00000000000..94fd6f82853
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-reattach-type-ahead.test.ts
@@ -0,0 +1,68 @@
+import { beforeEach, expect, it, vi } from 'vitest'
+import {
+  TerminalStreamOpcode,
+  decodeTerminalStreamText
+} from '../../../../shared/terminal-stream-protocol'
+import { createDeferred } from './pty-connection-test-async'
+import {
+  createRemoteRuntimeTransportMocks,
+  type MultiplexSubscriptionCallbacks
+} from './remote-runtime-pty-transport-test-harness'
+
+let callbacks: MultiplexSubscriptionCallbacks = null
+let resolvedHandle = 'terminal-1'
+const { runtimeCall, latestFrameForOpcode, resetRemoteRuntimeTransport } =
+  createRemoteRuntimeTransportMocks({
+    getCallbacks: () => callbacks,
+    setCallbacks: (value) => {
+      callbacks = value
+    },
+    getResolvedPaneHandle: () => resolvedHandle,
+    setResolvedPaneHandle: (value) => {
+      resolvedHandle = value
+    }
+  })
+
+beforeEach(resetRemoteRuntimeTransport)
+
+it('sends typing from a restored screen after the host finishes resolving its original pane', async () => {
+  const resolution = createDeferred<void>()
+  const call = runtimeCall.getMockImplementation()
+  runtimeCall.mockImplementation(async (request: { method: string }) => {
+    if (request.method === 'terminal.resolvePane') {
+      await resolution.promise
+    }
+    return call?.(request)
+  })
+  const { createRemoteRuntimePtyTransport } = await import('./remote-runtime-pty-transport')
+  const transport = createRemoteRuntimePtyTransport('env-1', {
+    worktreeId: 'wt-1',
+    tabId: 'web-terminal-host-tab-1',
+    leafId: 'pane:1'
+  })
+  try {
+    expect(transport.sendInput('probe-', 'driving')).toBe(true)
+    const connecting = transport.connect({
+      url: '',
+      sessionId: 'remote:env-1@@terminal-1',
+      callbacks: {}
+    })
+    await vi.waitFor(() => {
+      expect(runtimeCall).toHaveBeenCalledWith(
+        expect.objectContaining({ method: 'terminal.resolvePane' })
+      )
+    })
+    expect(transport.getPtyId()).toBeNull()
+    expect(transport.sendInput('cold-parked\r', 'driving')).toBe(true)
+    expect(latestFrameForOpcode(TerminalStreamOpcode.Input)).toBeUndefined()
+    resolution.resolve()
+    await connecting
+    await vi.waitFor(() => {
+      const frame = latestFrameForOpcode(TerminalStreamOpcode.Input)
+      expect(frame && decodeTerminalStreamText(frame.payload)).toBe('probe-cold-parked\r')
+    })
+  } finally {
+    resolution.resolve()
+    transport.destroy?.()
+  }
+})
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stale-handle-recovery.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stale-handle-recovery.test.ts
index 53c1921fe74..cec52958852 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stale-handle-recovery.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stale-handle-recovery.test.ts
@@ -226,7 +226,7 @@ describe('createRemoteRuntimePtyTransport', () => {
     if (!sendInputAccepted) {
       throw new Error('Expected acknowledged remote terminal input')
     }
-    const pendingSend = sendInputAccepted('sent-before-rebind')
+    const pendingSend = sendInputAccepted('sent-before-rebind', 'driving')
     await vi.waitFor(() =>
       expect(runtimeCall).toHaveBeenCalledWith(expect.objectContaining({ method: 'terminal.send' }))
     )
@@ -293,7 +293,7 @@ describe('createRemoteRuntimePtyTransport', () => {
     if (!sendInputAccepted) {
       throw new Error('Expected acknowledged remote terminal input')
     }
-    const pendingSend = sendInputAccepted('sent-before-close')
+    const pendingSend = sendInputAccepted('sent-before-close', 'driving')
     await vi.waitFor(() =>
       expect(runtimeCall).toHaveBeenCalledWith(expect.objectContaining({ method: 'terminal.send' }))
     )
@@ -390,7 +390,7 @@ describe('createRemoteRuntimePtyTransport', () => {
       if (!sendInputAccepted) {
         throw new Error('Expected acknowledged remote terminal input')
       }
-      const pendingSend = sendInputAccepted('sent-before-stream-end')
+      const pendingSend = sendInputAccepted('sent-before-stream-end', 'driving')
       await vi.waitFor(() =>
         expect(runtimeCall).toHaveBeenCalledWith(
           expect.objectContaining({ method: 'terminal.send' })
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-sticky-replacement-policy.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-sticky-replacement-policy.test.ts
index 5a61a5587e6..ce689695bc0 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-sticky-replacement-policy.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-sticky-replacement-policy.test.ts
@@ -76,7 +76,7 @@ describe('createRemoteRuntimePtyTransport', () => {
       if (!sendInputAccepted) {
         throw new Error('Expected acknowledged remote terminal input')
       }
-      const pendingSend = sendInputAccepted('sent-before-stream-end')
+      const pendingSend = sendInputAccepted('sent-before-stream-end', 'driving')
       await vi.waitFor(() =>
         expect(runtimeCall).toHaveBeenCalledWith(
           expect.objectContaining({ method: 'terminal.send' })
@@ -361,7 +361,10 @@ describe('createRemoteRuntimePtyTransport', () => {
     if (!sendInputAccepted) {
       throw new Error('Expected acknowledged remote terminal input')
     }
-    const sends = Promise.all([sendInputAccepted('first'), sendInputAccepted('second')])
+    const sends = Promise.all([
+      sendInputAccepted('first', 'driving'),
+      sendInputAccepted('second', 'driving')
+    ])
     await vi.waitFor(() => expect(hostListCalls).toBe(1))
     await expect(sends).resolves.toEqual([false, false])
 
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts
index e0b85414e3f..c3d61a8b3d3 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts
@@ -466,7 +466,7 @@ describe('createRemoteRuntimePtyTransport', () => {
       })
 
       expect(transport.isConnected()).toBe(false)
-      expect(transport.sendInput(`detached-${cycle}`)).toBe(false)
+      expect(transport.sendInput(`detached-${cycle}`, 'driving')).toBe(false)
       expect(unsubscribeByEpoch[cycle]).toHaveBeenCalledTimes(1)
       await vi.waitFor(() => expect(runtimeSubscribe).toHaveBeenCalledTimes(cycle + 2))
       await vi.waitFor(() => expect(latestSubscribePayload().terminal).toBe('terminal-1'))
@@ -542,7 +542,7 @@ describe('createRemoteRuntimePtyTransport', () => {
       expect(disconnectedState?.phase).toBe('disconnected')
       expect(transport.getPtyId()).toBe('remote:env-1@@terminal-1')
       expect(transport.isConnected()).toBe(false)
-      expect(transport.sendInput('must not reach a stale socket')).toBe(false)
+      expect(transport.sendInput('must not reach a stale socket', 'driving')).toBe(false)
       expect(onError).not.toHaveBeenCalled()
       await vi.advanceTimersByTimeAsync(5 * 60_000)
       expect(runtimeSubscribe).toHaveBeenCalledTimes(callsAtCutoff)
@@ -591,7 +591,7 @@ describe('createRemoteRuntimePtyTransport', () => {
     subscriptionCallbacks?.onClose?.()
     await vi.waitFor(() => expect(runtimeSubscribe).toHaveBeenCalledTimes(2))
     expect(transport.claimViewport?.(101, 33)).toBe(true)
-    const accepted = transport.sendInputAccepted?.('\x03')
+    const accepted = transport.sendInputAccepted?.('\x03', 'driving')
     await Promise.resolve()
     rejectReconnect(new Error('reconnect failed'))
 
@@ -610,7 +610,7 @@ describe('createRemoteRuntimePtyTransport', () => {
     const { streamId } = latestSubscribePayload()
 
     expect(transport.claimViewport?.(101, 33)).toBe(true)
-    const accepted = transport.sendInputAccepted?.('x')
+    const accepted = transport.sendInputAccepted?.('x', 'driving')
     subscriptionCallbacks?.onResponse({
       ok: true,
       result: { type: 'end', streamId }
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts
index 17d78934e53..cb78db75e9e 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts
@@ -1,4 +1,5 @@
 import { createAgentSessionKeyboardOptions } from '@/runtime/agent-session-keyboard-capability'
+import { withRemoteReattachInputBuffer } from './remote-reattach-input-buffer'
 /* eslint-disable max-lines -- Why: remote PTY transport keeps lifecycle, JSON fallback, and binary stream wiring together so reconnect/destroy ordering stays testable as one behavior surface. */
 import type { RuntimeRpcResponse } from '../../../../shared/runtime-rpc-envelope'
 import {
@@ -885,7 +886,7 @@ export function createRemoteRuntimePtyTransport(
       return true
     }
     if (lastConnectOptions) {
-      void transport.connect(lastConnectOptions)
+      void connectForRecovery(lastConnectOptions)
       return true
     }
     return false
@@ -2173,6 +2174,7 @@ export function createRemoteRuntimePtyTransport(
     flushPendingClaimInput(nextStream)
   }
 
+  let connectForRecovery: PtyTransport['connect'] = (options) => transport.connect(options)
   const transport: PtyTransport = {
     async connect(options) {
       cancelTerminalCreateRetryWait()
@@ -2583,6 +2585,8 @@ export function createRemoteRuntimePtyTransport(
       storedCallbacks = {}
     },
 
+    // Why no kind: terminal.send has no launch kind, and its query-reply kind is for mobile
+    // clients, so the host classifies a desktop's bytes itself.
     sendInput(data: string): boolean {
       if (!connected || !handle || recoveryBlocksIo()) {
         return false
@@ -2713,7 +2717,7 @@ export function createRemoteRuntimePtyTransport(
         recovery.currentPhase === 'disconnected'
       ) {
         recovery.begin()
-        void transport.connect(lastConnectOptions)
+        void connectForRecovery(lastConnectOptions)
         return true
       }
       // Why: online/resume fires a parked retry; the button must not be weaker than an event (#12684).
@@ -2783,6 +2787,9 @@ export function createRemoteRuntimePtyTransport(
       return stream.serializeBufferOutcome(opts)
     },
 
+    setConnectForRecovery(connect) {
+      connectForRecovery = connect
+    },
     destroy() {
       destroyed = true
       setAttachmentUnavailable()
@@ -2798,5 +2805,5 @@ export function createRemoteRuntimePtyTransport(
       viewportBatcher.clear()
     }
   }
-  return transport
+  return withRemoteReattachInputBuffer(transport)
 }
diff --git a/src/renderer/src/components/terminal-pane/scan22-ssh-new-tab-disposed-spawn-kill.repro.test.ts b/src/renderer/src/components/terminal-pane/scan22-ssh-new-tab-disposed-spawn-kill.repro.test.ts
new file mode 100644
index 00000000000..ed142fea393
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/scan22-ssh-new-tab-disposed-spawn-kill.repro.test.ts
@@ -0,0 +1,50 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { installIpcPtyWindow, restorePtySpecWindow } from './pty-transport-test-harness'
+
+// Scan-22 repro: a new SSH tab whose pane remounts while its first pty:spawn is in flight.
+// Main's pane-spawn reservation hands the successor the SAME PTY id; the disposed
+// predecessor then killed it on resolve (tab closes on pty-exit, or goes input-dead).
+describe('scan22: disposed mid-spawn SSH transport vs successor on the same PTY', () => {
+  const originalWindow = (globalThis as { window?: typeof window }).window
+  beforeEach(() => {
+    vi.resetModules()
+    installIpcPtyWindow(originalWindow, {})
+  })
+  afterEach(() => restorePtySpecWindow(originalWindow))
+
+  it('does not kill the PTY the remounted successor is bound to', async () => {
+    const { createIpcPtyTransport } = await import('./pty-transport')
+    let resolveFirst: (value: { id: string }) => void = () => {}
+    const spawn = vi.mocked(window.api.pty.spawn)
+    spawn.mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          resolveFirst = resolve
+        })
+    )
+    // Successor is handed the same id by main's (worktree, connection, paneKey) reservation.
+    spawn.mockResolvedValueOnce({ id: 'ssh-conn@@pty-7' })
+    // As installPtyInputRecovery wires it: the tab and its leaf still exist in the store.
+    const paneOptions = {
+      connectionId: 'ssh-conn',
+      worktreeId: 'wt',
+      tabId: 'tab-2',
+      leafId: 'leaf-a',
+      retainDisposedSpawn: () => true
+    }
+
+    const first = createIpcPtyTransport(paneOptions)
+    const firstConnect = first.connect({ url: '', callbacks: {} })
+    // Pane remount (generation bump / recovery / park flip) while spawn is in flight.
+    first.destroy?.()
+
+    const successor = createIpcPtyTransport(paneOptions)
+    await successor.connect({ url: '', callbacks: {} })
+    expect(successor.getPtyId()).toBe('ssh-conn@@pty-7')
+
+    resolveFirst({ id: 'ssh-conn@@pty-7' })
+    await firstConnect
+
+    expect(window.api.pty.kill).not.toHaveBeenCalledWith('ssh-conn@@pty-7')
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.test.ts b/src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.test.ts
index 37fe50db1a1..79e2ec738f3 100644
--- a/src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.test.ts
+++ b/src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.test.ts
@@ -75,4 +75,22 @@ describe('selectSleepingRecordParkExemptTabIds', () => {
 
     expect([...selectSleepingRecordParkExemptTabIds(stateWith({}), 'wt-1')]).toEqual([])
   })
+
+  // Why: pins #16308's incidental effect — a finished turn's idle anchor no longer pins its hidden tab mounted.
+  it('lets a finished turn park but keeps running and interrupted turns mounted', () => {
+    const note = (tabId: string, overrides: Partial<SleepingAgentSessionRecord>) =>
+      sleepingRecord({ paneKey: `${tabId}:${LEAF_ID}`, origin: 'live', ...overrides })
+    const records = {
+      a: note('tab-idle-anchor', { state: 'done' }),
+      b: note('tab-running', { state: 'working' }),
+      c: note('tab-interrupted', { state: 'done', interrupted: true }),
+      d: note('tab-quit', { state: 'done', origin: 'quit' })
+    }
+
+    expect([...selectSleepingRecordParkExemptTabIds(stateWith(records), 'wt-1')]).toEqual([
+      'tab-running',
+      'tab-interrupted',
+      'tab-quit'
+    ])
+  })
 })
diff --git a/src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.ts b/src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.ts
index 4859edade2b..7e572ab6904 100644
--- a/src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.ts
+++ b/src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.ts
@@ -1,6 +1,6 @@
 import type { SleepingAgentSessionRecord } from '../../../../shared/agent-session-resume'
 import { parseLegacyNumericPaneKey, parsePaneKey } from '../../../../shared/stable-pane-id'
-import { isPassiveCompletedHibernationEvidence } from '../../lib/sleeping-agent-pane-ownership'
+import { activationTreatsNoteAsFinished } from '../../lib/sleeping-agent-pane-ownership'
 import { createWorktreeRecordSelector } from '@/store/worktree-record-selector-cache'
 
 const EMPTY_TAB_IDS: ReadonlySet<string> = new Set()
@@ -11,8 +11,8 @@ type SleepingRecordParkExemptionState = {
 
 /** Tab ids whose panes own a sleeping record a mount can actually consume.
  *  Why: a parked pane can never cold-restore, so per-tab parks must exempt
- *  these — but only these: passive-completed records never resume,
- *  and exempting them would pin a hidden pane mounted indefinitely.
+ *  these — but not notes activation treats as finished: exempting those
+ *  would pin every hidden finished-agent pane mounted indefinitely.
  *
  *  Why memoized on the record map's identity (STA-7552): zustand re-runs every
  *  mounted subscriber's selector on every store write, so an unrelated pane
@@ -36,7 +36,7 @@ export const selectSleepingRecordParkExemptTabIds = createWorktreeRecordSelector
       if (!record || record.worktreeId !== worktreeId) {
         continue
       }
-      if (isPassiveCompletedHibernationEvidence(record)) {
+      if (activationTreatsNoteAsFinished(record)) {
         continue
       }
       // Why: malformed pane keys must yield no owner instead of a truncated tab id.
diff --git a/src/renderer/src/components/terminal-pane/terminal-agent-session-fork.test.ts b/src/renderer/src/components/terminal-pane/terminal-agent-session-fork.test.ts
index 7d1a85a8bd6..3fe546eb51f 100644
--- a/src/renderer/src/components/terminal-pane/terminal-agent-session-fork.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-agent-session-fork.test.ts
@@ -11,7 +11,6 @@ const mockToast = {
   success: vi.fn()
 }
 const mockWriteClipboardText = vi.fn(async () => undefined)
-const mockMarkTrusted = vi.fn(async () => undefined)
 const LEAF_ID = '11111111-1111-4111-8111-111111111111'
 
 const store = {
@@ -104,15 +103,11 @@ describe('forkAgentSessionFromPane', () => {
       }
     })
     mockWriteClipboardText.mockResolvedValue(undefined)
-    mockMarkTrusted.mockResolvedValue(undefined)
     vi.stubGlobal('window', {
       api: {
         ui: {
           writeTerminalClipboardText: mockWriteClipboardText
         },
-        agentTrust: {
-          markTrusted: mockMarkTrusted
-        },
         platform: {
           get: () => ({ platform: 'win32' })
         }
@@ -253,36 +248,7 @@ describe('forkAgentSessionFromPane', () => {
     }
   )
 
-  it('pre-marks trust for the created fork workspace before launching a trusted agent', async () => {
-    store.agentStatusByPaneKey = {
-      [`tab-1:${LEAF_ID}`]: { agentType: 'codex' }
-    }
-    mockCreateWorktree.mockResolvedValueOnce({
-      worktree: {
-        id: 'wt-fork',
-        path: '/repo/worktrees/auth-feature-fork'
-      }
-    })
-    const { forkAgentSessionFromPane } = await import('./terminal-agent-session-fork')
-
-    await forkAgentSessionFromPane({
-      pane: makePane('User: compare OAuth options'),
-      tabId: 'tab-1',
-      worktreeId: 'wt-1',
-      groupId: null
-    })
-
-    expect(mockMarkTrusted).toHaveBeenCalledWith({
-      preset: 'codex',
-      workspacePath: '/repo/worktrees/auth-feature-fork'
-    })
-    expect(mockMarkTrusted.mock.invocationCallOrder[0]).toBeLessThan(
-      mockLaunchAgentInNewTab.mock.invocationCallOrder[0]
-    )
-    expect(mockLaunchAgentInNewTab).toHaveBeenCalled()
-  })
-
-  it('uses remote trust and Linux startup quoting for SSH workspaces', async () => {
+  it('uses Linux startup quoting for SSH workspaces', async () => {
     store.repos = [{ id: 'repo-1', kind: 'git', connectionId: 'ssh-1' }]
     store.agentStatusByPaneKey = {
       [`tab-1:${LEAF_ID}`]: { agentType: 'codex' }
@@ -302,11 +268,6 @@ describe('forkAgentSessionFromPane', () => {
       groupId: null
     })
 
-    expect(mockMarkTrusted).toHaveBeenCalledWith({
-      preset: 'codex',
-      workspacePath: '/home/u/repo/auth-feature-fork',
-      connectionId: 'ssh-1'
-    })
     expect(mockLaunchAgentInNewTab).toHaveBeenCalledWith(
       expect.objectContaining({
         agent: 'codex',
@@ -379,40 +340,6 @@ describe('forkAgentSessionFromPane', () => {
     )
   })
 
-  it('still launches the forked agent when trust preflight fails', async () => {
-    store.agentStatusByPaneKey = {
-      [`tab-1:${LEAF_ID}`]: { agentType: 'codex' }
-    }
-    mockCreateWorktree.mockResolvedValueOnce({
-      worktree: {
-        id: 'wt-fork',
-        path: '/repo/worktrees/auth-feature-fork'
-      }
-    })
-    mockMarkTrusted.mockRejectedValueOnce(new Error('trust write failed'))
-    const { forkAgentSessionFromPane } = await import('./terminal-agent-session-fork')
-
-    await forkAgentSessionFromPane({
-      pane: makePane('User: continue after trust failure'),
-      tabId: 'tab-1',
-      worktreeId: 'wt-1',
-      groupId: null
-    })
-
-    expect(mockMarkTrusted).toHaveBeenCalledWith({
-      preset: 'codex',
-      workspacePath: '/repo/worktrees/auth-feature-fork'
-    })
-    expect(mockLaunchAgentInNewTab).toHaveBeenCalledWith(
-      expect.objectContaining({
-        agent: 'codex',
-        worktreeId: 'wt-fork',
-        prompt: expect.stringContaining('User: continue after trust failure')
-      })
-    )
-    expect(mockToast.error).not.toHaveBeenCalledWith('trust write failed')
-  })
-
   it('creates a top-level workspace fork and copies context when the source agent cannot be resolved', async () => {
     const pane = makePane('Assistant: here is the current plan')
     const { forkAgentSessionFromPane } = await import('./terminal-agent-session-fork')
diff --git a/src/renderer/src/components/terminal-pane/terminal-agent-session-fork.ts b/src/renderer/src/components/terminal-pane/terminal-agent-session-fork.ts
index b685d539fb6..f02c0bb803d 100644
--- a/src/renderer/src/components/terminal-pane/terminal-agent-session-fork.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-agent-session-fork.ts
@@ -10,7 +10,6 @@ import { useAppStore } from '@/store'
 import { makePaneKey } from '../../../../shared/stable-pane-id'
 import { TUI_AGENT_CONFIG } from '../../../../shared/tui-agent-config'
 import { getForkAgentLaunchPlatform } from './terminal-agent-session-fork-launch-platform'
-import { preflightAgentTrust } from '@/lib/agent-trust-preflight'
 import { slugifyForWorkspaceName } from '../../../../shared/workspace-name'
 import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
 import type { TuiAgent } from '../../../../shared/tui-agent'
@@ -236,13 +235,6 @@ export async function startAgentSessionFork(fork: PreparedAgentSessionFork): Pro
     prompt: fork.prompt,
     promptDelivery: 'draft'
   })
-  if (agentSessionLaunchPlan.route !== 'structured-native-chat') {
-    await preflightAgentTrust({
-      agent: fork.agent,
-      workspacePath: created.worktree.path,
-      connectionId: sourceRepo?.connectionId
-    })
-  }
   const launchPlatform = getForkAgentLaunchPlatform({
     repo: sourceRepo,
     worktreePath: created.worktree.path,
diff --git a/src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.test.ts b/src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.test.ts
index df997a87afc..05513b53c66 100644
--- a/src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.test.ts
@@ -27,7 +27,7 @@ describe('sendCapturedTerminalInput', () => {
           data: '\r'
         })
       ).toBe(true)
-      expect(transport.sendInput).toHaveBeenCalledWith('\r')
+      expect(transport.sendInput).toHaveBeenCalledWith('\r', 'driving')
     }
   )
 
diff --git a/src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.ts b/src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.ts
index 7a2780a5d32..5409d5420de 100644
--- a/src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.ts
@@ -32,7 +32,7 @@ export function sendCapturedTerminalInput({
   ) {
     return false
   }
-  const sent = capturedTransport.sendInput(data)
+  const sent = capturedTransport.sendInput(data, 'driving')
   if (sent) {
     onAccepted?.()
   }
diff --git a/src/renderer/src/components/terminal-pane/terminal-chat-ownership-lifecycle.test.tsx b/src/renderer/src/components/terminal-pane/terminal-chat-ownership-lifecycle.test.tsx
new file mode 100644
index 00000000000..350c27667fa
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-chat-ownership-lifecycle.test.tsx
@@ -0,0 +1,269 @@
+// @vitest-environment happy-dom
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { useEffect, useState } from 'react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { TerminalLayoutSnapshot } from '../../../../shared/terminal-tab-types'
+import { useTerminalPaneChatState } from './use-terminal-pane-chat-state'
+import { useTerminalPaneLayoutPersistence } from './use-terminal-pane-layout-persistence'
+import { resolveNativeChatLeafRoute } from '../native-chat/native-chat-leaf-routing'
+import { detachTerminalLayoutLeaf } from './terminal-layout-leaf-detach'
+import { parseWorkspaceSession } from '../../../../shared/workspace-session-schema'
+import type { RemotePaneLayoutPusher } from './remote-pane-layout-push'
+
+const LEFT = '11111111-1111-4111-8111-111111111111'
+const RIGHT = '22222222-2222-4222-8222-222222222222'
+const mocks = vi.hoisted(() => {
+  const layouts: Record<string, TerminalLayoutSnapshot> = {}
+  const tab = { id: 'tab', entityId: 'tab', contentType: 'terminal', viewMode: 'chat' }
+  const state = {
+    terminalLayoutsByTabId: layouts,
+    unifiedTabsByWorktree: { wt: [tab] },
+    tabsByWorktree: {},
+    settings: { experimentalNativeChat: true },
+    pendingCodexPaneRestartIds: [],
+    runtimePaneTitlesByTabId: { tab: { 1: 'codex', 2: 'codex' } },
+    agentStatusByPaneKey: {},
+    paneForegroundAgentByPaneKey: {},
+    setTabLayout: (_id: string, layout: TerminalLayoutSnapshot) => {
+      layouts.tab = layout
+    },
+    setTabViewMode: (_id: string, mode: string) => {
+      state.unifiedTabsByWorktree = { wt: [{ ...tab, viewMode: mode }] }
+    },
+    toggleTabViewMode: (id: string): void => {
+      state.setTabViewMode(
+        id,
+        state.unifiedTabsByWorktree.wt[0].viewMode === 'chat' ? 'terminal' : 'chat'
+      )
+    }
+  }
+  return { state }
+})
+vi.mock('../../store', async () => {
+  const { create } = await import('zustand')
+  const { terminalLayoutEqual } = await import('@/lib/terminal-layout-equality')
+  mocks.state.setTabLayout = (id, layout) => {
+    if (terminalLayoutEqual(mocks.state.terminalLayoutsByTabId[id], layout)) {
+      return
+    }
+    mocks.state.terminalLayoutsByTabId = { ...mocks.state.terminalLayoutsByTabId, [id]: layout }
+    useAppStore.setState({ terminalLayoutsByTabId: mocks.state.terminalLayoutsByTabId })
+  }
+  mocks.state.setTabViewMode = (_id, mode) => {
+    mocks.state.unifiedTabsByWorktree = {
+      wt: [{ ...mocks.state.unifiedTabsByWorktree.wt[0], viewMode: mode }]
+    }
+    useAppStore.setState({ unifiedTabsByWorktree: mocks.state.unifiedTabsByWorktree })
+  }
+  const useAppStore = create(() => mocks.state)
+  return { useAppStore }
+})
+vi.mock('@/runtime/web-runtime-session', () => ({ clearWebRuntimeTerminalBuffer: vi.fn() }))
+
+function makeFixture(paneIds = [1, 2], remotePusher?: RemotePaneLayoutPusher) {
+  const container = document.createElement('div')
+  const split = document.createElement('div')
+  split.className = 'pane-split'
+  container.append(split)
+  const panes = [LEFT, RIGHT].map((leafId, index) => {
+    const element = document.createElement('div')
+    element.className = 'pane'
+    element.dataset.paneId = String(paneIds[index])
+    element.dataset.leafId = leafId
+    split.append(element)
+    return { id: paneIds[index], leafId, container: element }
+  })
+  const manager = {
+    getPanes: () => panes,
+    getActivePane: () => panes[0],
+    getLeafIdMap: () => new Map(panes.map((pane) => [pane.id, pane.leafId]))
+  }
+  return {
+    managerRef: { current: manager },
+    containerRef: { current: container },
+    nativeChatTranscriptIsLocalReadable: true,
+    onAgentExitedRef: { current: vi.fn() },
+    paneCount: 2,
+    tabId: 'tab',
+    worktreeId: 'wt',
+    tabWideAgentHintLeafId: null,
+    setTabWideAgentHintLeafId: vi.fn(),
+    clearedScrollbackLeafIdsRef: { current: new Set<string>() },
+    expandedPaneIdRef: { current: null },
+    paneTitles: {},
+    paneTitlesRef: { current: {} },
+    paneTransportsRef: { current: new Map() },
+    remotePaneLayoutPusherRef: { current: remotePusher ?? null },
+    removedTitleLeafIdsRef: { current: new Set<string>() },
+    setPaneTitles: vi.fn()
+  }
+}
+function useFixture(fixture: ReturnType<typeof makeFixture>, initialOwner: string | null) {
+  const [chatLeafId, setChatLeafId] = useState(initialOwner)
+  const input = { ...fixture, chatLeafId, setChatLeafId }
+  const chat = useTerminalPaneChatState(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture supplies every field read by the chat hook.
+    input as unknown as Parameters<typeof useTerminalPaneChatState>[0]
+  )
+  const layoutInput = { ...input, ...chat, setTabLayout: mocks.state.setTabLayout }
+  const layout = useTerminalPaneLayoutPersistence(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture supplies every field read by the persistence hook.
+    layoutInput as unknown as Parameters<typeof useTerminalPaneLayoutPersistence>[0]
+  )
+  const activeLeafId = fixture.managerRef.current.getActivePane()?.leafId ?? null
+  const mounted = fixture.managerRef.current.getPanes().some((pane) => pane.leafId === chatLeafId)
+  const { applyNativeChatLeafRoute, isChatViewMode, isChatEligibleForLeaf } = chat
+  useEffect(() => {
+    applyNativeChatLeafRoute(
+      resolveNativeChatLeafRoute({
+        isChatViewMode,
+        chatLeafId,
+        activeLeafId,
+        chatLeafStillMounted: mounted,
+        activeLeafIsEligible: isChatEligibleForLeaf(activeLeafId)
+      })
+    )
+  }, [
+    applyNativeChatLeafRoute,
+    isChatEligibleForLeaf,
+    isChatViewMode,
+    chatLeafId,
+    activeLeafId,
+    mounted
+  ])
+  return { ...chat, ...layout, chatLeafId, setChatLeafId }
+}
+
+beforeEach(() => {
+  mocks.state.settings.experimentalNativeChat = true
+  mocks.state.setTabViewMode('tab', 'chat')
+  mocks.state.setTabLayout('tab', {
+    root: {
+      type: 'split',
+      direction: 'vertical',
+      first: { type: 'leaf', leafId: LEFT },
+      second: { type: 'leaf', leafId: RIGHT }
+    },
+    activeLeafId: LEFT,
+    expandedLeafId: null,
+    chatLeafId: RIGHT
+  })
+})
+afterEach(cleanup)
+
+describe('terminal chat ownership lifecycle', () => {
+  it('batches a pane toggle into chat and back without selecting the active sibling', () => {
+    mocks.state.setTabViewMode('tab', 'terminal')
+    const fixture = makeFixture()
+    const hook = renderHook(() => useFixture(fixture, null))
+    act(() => hook.result.current.toggleNativeChatForLeaf(RIGHT))
+    expect(hook.result.current.chatLeafId).toBe(RIGHT)
+    expect(mocks.state.unifiedTabsByWorktree.wt[0].viewMode).toBe('chat')
+    expect(mocks.state.terminalLayoutsByTabId.tab.chatLeafId).toBe(RIGHT)
+    act(() => hook.result.current.toggleNativeChatForLeaf(RIGHT))
+    expect(hook.result.current.chatLeafId).toBeNull()
+    expect(mocks.state.unifiedTabsByWorktree.wt[0].viewMode).toBe('terminal')
+    expect(mocks.state.terminalLayoutsByTabId.tab.chatLeafId).toBeUndefined()
+  })
+
+  it('preserves the saved owner when this client disables native chat', () => {
+    const push = vi.fn()
+    const fixture = makeFixture(undefined, { push })
+    mocks.state.terminalLayoutsByTabId.tab.ptyIdsByLeafId = {
+      [LEFT]: 'remote:host:terminal',
+      [RIGHT]: 'remote:host:chat'
+    }
+    const hook = renderHook(() => useFixture(fixture, RIGHT))
+    mocks.state.settings.experimentalNativeChat = false
+    hook.rerender()
+    hook.result.current.persistLayoutSnapshot()
+    expect(hook.result.current.effectiveChatViewMode).toBe(false)
+    expect(mocks.state.unifiedTabsByWorktree.wt[0].viewMode).toBe('chat')
+    expect(mocks.state.terminalLayoutsByTabId.tab.chatLeafId).toBe(RIGHT)
+    expect(push).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        layout: expect.objectContaining({ chatLeafId: RIGHT })
+      })
+    )
+  })
+
+  it('clears ownership when the tab-bar turns chat off, then targets the active sibling', () => {
+    const fixture = makeFixture()
+    const hook = renderHook(() => useFixture(fixture, RIGHT))
+    act(() => mocks.state.setTabViewMode('tab', 'terminal'))
+    hook.rerender()
+    expect(hook.result.current.chatLeafId).toBeNull()
+    expect(mocks.state.terminalLayoutsByTabId.tab.chatLeafId).toBeUndefined()
+    act(() => mocks.state.setTabViewMode('tab', 'chat'))
+    hook.rerender()
+    expect(hook.result.current.chatLeafId).toBe(LEFT)
+  })
+
+  it('keeps the current owner when a mount-time callback captures a pane for detaching', () => {
+    const fixture = makeFixture()
+    const hook = renderHook(() => useFixture(fixture, RIGHT))
+    const mountedPersist = hook.result.current.persistLayoutSnapshot
+    act(() => hook.result.current.toggleNativeChatForLeaf(LEFT))
+    expect(hook.result.current.chatLeafId).toBe(LEFT)
+    mountedPersist()
+    const detached = detachTerminalLayoutLeaf(mocks.state.terminalLayoutsByTabId.tab, LEFT)
+    expect(detached?.detachedLayout.chatLeafId).toBe(LEFT)
+    expect(detached?.sourceLayout.chatLeafId).toBeUndefined()
+  })
+
+  it('does not resurrect an owner after chat is turned off and the split is resized', () => {
+    const fixture = makeFixture()
+    const hook = renderHook(() => useFixture(fixture, RIGHT))
+    const mountedPersist = hook.result.current.persistLayoutSnapshot
+    act(() => hook.result.current.switchNativeChatToTerminal())
+    mountedPersist()
+    expect(mocks.state.terminalLayoutsByTabId.tab.chatLeafId).toBeUndefined()
+  })
+
+  it('closing the chat leaf leaves an eligible terminal sibling in terminal mode', () => {
+    const fixture = makeFixture()
+    const hook = renderHook(() => useFixture(fixture, RIGHT))
+    fixture.managerRef.current.getPanes().pop()?.container.remove()
+    hook.rerender()
+    expect(hook.result.current.chatLeafId).toBeNull()
+    expect(mocks.state.unifiedTabsByWorktree.wt[0].viewMode).toBe('terminal')
+  })
+
+  it('restores chat on the right with the left active and different numeric pane IDs', () => {
+    const initialFixture = makeFixture()
+    const original = renderHook(() => useFixture(initialFixture, RIGHT))
+    original.result.current.persistLayoutSnapshot()
+    const session = parseWorkspaceSession(
+      JSON.parse(
+        JSON.stringify({
+          activeRepoId: null,
+          activeWorktreeId: 'wt',
+          activeTabId: 'tab',
+          tabsByWorktree: {},
+          terminalLayoutsByTabId: mocks.state.terminalLayoutsByTabId
+        })
+      )
+    )
+    expect(session.ok).toBe(true)
+    if (!session.ok) {
+      throw new Error('session did not parse')
+    }
+    original.unmount()
+    const saved = session.value.terminalLayoutsByTabId.tab!
+    mocks.state.setTabLayout('tab', saved)
+    expect(saved.activeLeafId).toBe(LEFT)
+    expect(saved.root).toMatchObject({ first: { leafId: LEFT }, second: { leafId: RIGHT } })
+    const restored = makeFixture([20, 10])
+    const hook = renderHook(() => useFixture(restored, saved.chatLeafId ?? null))
+    const chatPane = restored.managerRef.current
+      .getPanes()
+      .find((pane) => pane.leafId === hook.result.current.chatLeafId)
+    expect(chatPane?.id).toBe(10)
+    // Closing the restored chat leaf must leave the left terminal untouched.
+    restored.managerRef.current.getPanes().pop()?.container.remove()
+    hook.rerender()
+    expect(restored.managerRef.current.getPanes().map((pane) => pane.leafId)).toEqual([LEFT])
+    expect(hook.result.current.chatLeafId).toBeNull()
+    expect(mocks.state.unifiedTabsByWorktree.wt[0].viewMode).toBe('terminal')
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/terminal-cold-park-withheld-tabs.test.ts b/src/renderer/src/components/terminal-pane/terminal-cold-park-withheld-tabs.test.ts
index 75ca204c5cd..7fe3ca858de 100644
--- a/src/renderer/src/components/terminal-pane/terminal-cold-park-withheld-tabs.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-cold-park-withheld-tabs.test.ts
@@ -22,6 +22,7 @@ function pinnedRecord(pinnedUntilMs: number | null): ParkVerdictFlipRecord {
     windowStartMs: 0,
     flips: 0,
     notified: false,
+    lastFlipMs: 0,
     burstStartMs: 0,
     burstFlips: 0,
     pinnedUntilMs
diff --git a/src/renderer/src/components/terminal-pane/terminal-command-lifecycle.ts b/src/renderer/src/components/terminal-pane/terminal-command-lifecycle.ts
index 61ad0891fa6..5d60514842e 100644
--- a/src/renderer/src/components/terminal-pane/terminal-command-lifecycle.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-command-lifecycle.ts
@@ -15,9 +15,9 @@ export function createTerminalCommandLifecycle(options: TerminalCommandLifecycle
   // Why: the byte parsing lives in shared so main's side-effect tracker emits
   // identical command-finished facts for local/SSH PTYs; this renderer wrapper
   // remains the byte path for remote-runtime PTYs and the kill-switch-off mode.
-  const scanner = createOsc133CommandFinishedScanner(
-    options.onCommandFinished,
-    options.onCommandStarted
+  // Why the wrapper: the scanner passes a chunk offset, which a callback with its own optional parameter must not receive.
+  const scanner = createOsc133CommandFinishedScanner(options.onCommandFinished, () =>
+    options.onCommandStarted?.()
   )
   const disposables: IDisposable[] = []
 
diff --git a/src/renderer/src/components/terminal-pane/terminal-copy-shortcut.test.ts b/src/renderer/src/components/terminal-pane/terminal-copy-shortcut.test.ts
new file mode 100644
index 00000000000..05b363d973a
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-copy-shortcut.test.ts
@@ -0,0 +1,90 @@
+// @vitest-environment happy-dom
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { PaneManager } from '@/lib/pane-manager/pane-manager'
+import { dispatchTerminalShortcutAction } from './terminal-keyboard-action-dispatch'
+import { resolveTerminalShortcutAction } from './terminal-shortcut-policy'
+import { createTerminalNativeOnlyShortcutTracker } from './terminal-native-only-shortcut'
+
+type DispatchContext = Parameters<typeof dispatchTerminalShortcutAction>[3]
+
+function dispatchCopy(selection: string, repeat: boolean) {
+  const writeTerminalClipboardText = vi.fn().mockResolvedValue(undefined)
+  vi.stubGlobal('api', { ui: { writeTerminalClipboardText } })
+  const tracker = createTerminalNativeOnlyShortcutTracker()
+  const event = new KeyboardEvent('keydown', {
+    key: 'c',
+    code: 'KeyC',
+    metaKey: true,
+    repeat,
+    cancelable: true
+  })
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Copy only reads the active pane's selection.
+  const manager = {
+    getActivePane: () => ({ terminal: { getSelection: () => selection } })
+  } as PaneManager
+  const context: DispatchContext = {
+    tabId: 'tab',
+    worktreeId: 'workspace',
+    fallbackCwd: '',
+    expandedPaneIdRef: { current: null },
+    setExpandedPane: vi.fn(),
+    restoreExpandedLayout: vi.fn(),
+    refreshPaneSizes: vi.fn(),
+    persistLayoutSnapshot: vi.fn(),
+    toggleExpandPane: vi.fn(),
+    setSearchOpen: vi.fn(),
+    focusSearchInput: vi.fn(),
+    searchOpenRef: { current: false },
+    onRequestClosePane: vi.fn(),
+    onClearPaneScrollback: vi.fn(),
+    onSetTitle: vi.fn(),
+    onClearPaneTitle: vi.fn(),
+    paneTransportsRef: { current: new Map() },
+    paneCwdRef: { current: new Map() },
+    managerRef: { current: manager },
+    getKeyboardSplitTelemetrySource: () => 'keyboard',
+    armNativeOnlyShortcut: tracker.armKeyDown
+  }
+  dispatchTerminalShortcutAction({ type: 'copySelection' }, event, manager, context)
+  return {
+    claimed: event.defaultPrevented,
+    copies: writeTerminalClipboardText.mock.calls.length,
+    releaseClaimed: tracker.consumeCompanion({ type: 'keyup', key: 'c', code: 'KeyC' })
+  }
+}
+
+afterEach(() => vi.unstubAllGlobals())
+
+describe('terminal copy shortcut', () => {
+  it('leaves an unselected press to the terminal', () => {
+    expect(dispatchCopy('', false)).toEqual({ claimed: false, copies: 0, releaseClaimed: false })
+  })
+
+  it('copies a selection once and claims the press through its release', () => {
+    expect(dispatchCopy('text', false)).toEqual({ claimed: true, copies: 1, releaseClaimed: true })
+    expect(dispatchCopy('text', true)).toEqual({ claimed: true, copies: 0, releaseClaimed: false })
+  })
+
+  it('matches held and remapped copy bindings', () => {
+    const keybindings = { 'terminal.copySelection': ['Mod+Shift+C'] }
+    const chord = {
+      key: 'c',
+      code: 'KeyC',
+      metaKey: true,
+      ctrlKey: false,
+      altKey: false,
+      shiftKey: false
+    }
+    expect(resolveTerminalShortcutAction(chord, true, 'false', 0, false, keybindings)).toBeNull()
+    expect(
+      resolveTerminalShortcutAction(
+        { ...chord, shiftKey: true, repeat: true },
+        true,
+        'false',
+        0,
+        false,
+        keybindings
+      )
+    ).toEqual({ type: 'copySelection' })
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/terminal-drop-handler.test.ts b/src/renderer/src/components/terminal-pane/terminal-drop-handler.test.ts
index ee6a492f642..26e8f21d3fe 100644
--- a/src/renderer/src/components/terminal-pane/terminal-drop-handler.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-drop-handler.test.ts
@@ -156,7 +156,8 @@ describe('handleTerminalFileDrop', () => {
       { assertCurrent: expect.any(Function) }
     )
     expect(sendInput).toHaveBeenCalledWith(
-      wrapTerminalBracketedPasteText('/remote/repo/.orca/drops/logo.png')
+      wrapTerminalBracketedPasteText('/remote/repo/.orca/drops/logo.png'),
+      'driving'
     )
     expect(focus).toHaveBeenCalled()
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
@@ -252,7 +253,8 @@ describe('handleTerminalFileDrop', () => {
       { assertCurrent: expect.any(Function) }
     )
     expect(sendInput).toHaveBeenCalledWith(
-      wrapTerminalBracketedPasteText('\\\\server\\share\\repo\\.orca\\drops\\logo.png')
+      wrapTerminalBracketedPasteText('\\\\server\\share\\repo\\.orca\\drops\\logo.png'),
+      'driving'
     )
   })
 
@@ -308,7 +310,7 @@ describe('handleTerminalFileDrop', () => {
       '/remote/repo/.orca/drops',
       { assertCurrent: expect.any(Function) }
     )
-    expect(sendInput).toHaveBeenCalledWith('/remote/repo/.orca/drops/spec.pdf ')
+    expect(sendInput).toHaveBeenCalledWith('/remote/repo/.orca/drops/spec.pdf ', 'driving')
   })
 
   it('keeps explicit local worktree drops local while a runtime is focused', async () => {
@@ -335,7 +337,7 @@ describe('handleTerminalFileDrop', () => {
     })
 
     expect(mocks.importExternalPathsToRuntime).not.toHaveBeenCalled()
-    expect(sendInput).toHaveBeenCalledWith('/Users/me/spec.pdf ')
+    expect(sendInput).toHaveBeenCalledWith('/Users/me/spec.pdf ', 'driving')
     expect(focus).toHaveBeenCalled()
   })
 
@@ -382,8 +384,12 @@ describe('handleTerminalFileDrop', () => {
     })
 
     expect(mocks.importExternalPathsToRuntime).not.toHaveBeenCalled()
-    expect(sendInput).toHaveBeenNthCalledWith(1, "'/mnt/c/Users/alice/Desktop/notes one.txt' ")
-    expect(sendInput).toHaveBeenNthCalledWith(2, '/home/alice/repo/README.md ')
+    expect(sendInput).toHaveBeenNthCalledWith(
+      1,
+      "'/mnt/c/Users/alice/Desktop/notes one.txt' ",
+      'driving'
+    )
+    expect(sendInput).toHaveBeenNthCalledWith(2, '/home/alice/repo/README.md ', 'driving')
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
   })
 
@@ -413,7 +419,7 @@ describe('handleTerminalFileDrop', () => {
       data: { paths: ['/Users/me/spec.pdf'], target: 'terminal' }
     })
 
-    expect(sendInputAccepted).toHaveBeenCalledWith('/Users/me/spec.pdf ')
+    expect(sendInputAccepted).toHaveBeenCalledWith('/Users/me/spec.pdf ', 'driving')
     expect(sendInput).not.toHaveBeenCalled()
     expect(focus).toHaveBeenCalled()
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
@@ -452,7 +458,7 @@ describe('handleTerminalFileDrop', () => {
 
     expect(activeSendInput).not.toHaveBeenCalled()
     expect(activeFocus).not.toHaveBeenCalled()
-    expect(targetSendInput).toHaveBeenCalledWith('/Users/me/spec.pdf ')
+    expect(targetSendInput).toHaveBeenCalledWith('/Users/me/spec.pdf ', 'driving')
     expect(targetFocus).toHaveBeenCalled()
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-target')
   })
@@ -508,8 +514,8 @@ describe('handleTerminalFileDrop', () => {
       worktreePath: '\\\\wsl.localhost\\Ubuntu-24.04\\home\\user\\repo'
     })
     expect(sendInput.mock.calls).toEqual([
-      ["'/mnt/c/Users/Name/My Project/file.txt' "],
-      ['/home/user/repo/README.md ']
+      ["'/mnt/c/Users/Name/My Project/file.txt' ", 'driving'],
+      ['/home/user/repo/README.md ', 'driving']
     ])
     expect(focus).toHaveBeenCalled()
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
@@ -608,7 +614,7 @@ describe('handleTerminalFileDrop', () => {
       expectedSshTargetId: 'ssh-win',
       expectedSshConnectionGeneration: 4
     })
-    expect(sendInput).toHaveBeenCalledWith('"C:\\Remote Repo\\A&B.txt" ')
+    expect(sendInput).toHaveBeenCalledWith('"C:\\Remote Repo\\A&B.txt" ', 'driving')
     expect(focus).toHaveBeenCalled()
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
   })
@@ -684,6 +690,6 @@ describe('handleTerminalFileDrop', () => {
       data: { paths: ["/Users/me/it's here.txt"], target: 'terminal' }
     })
 
-    expect(sendInput).toHaveBeenCalledWith("'/remote/repo/it'\\''s here.txt' ")
+    expect(sendInput).toHaveBeenCalledWith("'/remote/repo/it'\\''s here.txt' ", 'driving')
   })
 })
diff --git a/src/renderer/src/components/terminal-pane/terminal-drop-internal-handler.test.ts b/src/renderer/src/components/terminal-pane/terminal-drop-internal-handler.test.ts
index 2c1c2652e87..cd42929c248 100644
--- a/src/renderer/src/components/terminal-pane/terminal-drop-internal-handler.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-drop-internal-handler.test.ts
@@ -116,7 +116,10 @@ describe('handleInternalTerminalFileDrop', () => {
     })
 
     expect(result).toEqual({ status: 'pasted', pathCount: 2 })
-    expect(sendInput.mock.calls).toEqual([['/repo/a.ts '], ["'/repo/my file.ts' "]])
+    expect(sendInput.mock.calls).toEqual([
+      ['/repo/a.ts ', 'driving'],
+      ["'/repo/my file.ts' ", 'driving']
+    ])
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
     expect(focus).toHaveBeenCalled()
   })
@@ -155,7 +158,7 @@ describe('handleInternalTerminalFileDrop', () => {
 
     expect(result).toEqual({ status: 'cancelled', reason: 'target-stale', pathCount: 1 })
     expect(sendInputAccepted).toHaveBeenCalledTimes(1)
-    expect(sendInputAccepted).toHaveBeenCalledWith('/repo/a.ts ')
+    expect(sendInputAccepted).toHaveBeenCalledWith('/repo/a.ts ', 'driving')
     expect(sendInput).not.toHaveBeenCalled()
     expect(replacementSendInput).not.toHaveBeenCalled()
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
@@ -187,7 +190,7 @@ describe('handleInternalTerminalFileDrop', () => {
     })
 
     expect(result).toEqual({ status: 'pasted', pathCount: 1 })
-    expect(sendInputAccepted).toHaveBeenCalledWith('/repo/a.ts ')
+    expect(sendInputAccepted).toHaveBeenCalledWith('/repo/a.ts ', 'driving')
     expect(sendInput).not.toHaveBeenCalled()
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
     expect(focus).toHaveBeenCalled()
@@ -254,7 +257,7 @@ describe('handleInternalTerminalFileDrop', () => {
     })
 
     expect(result).toEqual({ status: 'pasted', pathCount: 1 })
-    expect(sendInput).toHaveBeenCalledWith('"C:\\repo\\a&b.txt" ')
+    expect(sendInput).toHaveBeenCalledWith('"C:\\repo\\a&b.txt" ', 'driving')
   })
 
   it('uses SSH remote platform metadata for Windows internal file drops', async () => {
@@ -293,7 +296,7 @@ describe('handleInternalTerminalFileDrop', () => {
     })
 
     expect(result).toEqual({ status: 'pasted', pathCount: 1 })
-    expect(sendInput).toHaveBeenCalledWith('"C:\\Remote Repo\\A&B.txt" ')
+    expect(sendInput).toHaveBeenCalledWith('"C:\\Remote Repo\\A&B.txt" ', 'driving')
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
     expect(focus).toHaveBeenCalled()
   })
@@ -334,7 +337,7 @@ describe('handleInternalTerminalFileDrop', () => {
     })
 
     expect(result).toEqual({ status: 'pasted', pathCount: 1 })
-    expect(sendInput).toHaveBeenCalledWith("'/remote/repo/it'\\''s here.txt' ")
+    expect(sendInput).toHaveBeenCalledWith("'/remote/repo/it'\\''s here.txt' ", 'driving')
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
     expect(focus).toHaveBeenCalled()
   })
@@ -387,7 +390,7 @@ describe('handleInternalTerminalFileDrop', () => {
     expect(result).toEqual({ status: 'pasted', pathCount: 1 })
     expect(activeSendInput).not.toHaveBeenCalled()
     expect(activeFocus).not.toHaveBeenCalled()
-    expect(targetSendInput).toHaveBeenCalledWith('/repo/drop-target.ts ')
+    expect(targetSendInput).toHaveBeenCalledWith('/repo/drop-target.ts ', 'driving')
     expect(targetFocus).toHaveBeenCalled()
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-target')
   })
diff --git a/src/renderer/src/components/terminal-pane/terminal-drop-path-writer.test.ts b/src/renderer/src/components/terminal-pane/terminal-drop-path-writer.test.ts
index 7fcb898d7eb..20fe46c1fda 100644
--- a/src/renderer/src/components/terminal-pane/terminal-drop-path-writer.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-drop-path-writer.test.ts
@@ -48,7 +48,7 @@ describe('terminal drop path writer', () => {
       failureReason: 'write-rejected'
     })
     expect(sendInputAccepted).toHaveBeenCalledTimes(1)
-    expect(sendInputAccepted).toHaveBeenCalledWith('/repo/a.ts ')
+    expect(sendInputAccepted).toHaveBeenCalledWith('/repo/a.ts ', 'driving')
     expect(sendInput).not.toHaveBeenCalled()
   })
 
@@ -70,7 +70,8 @@ describe('terminal drop path writer', () => {
     // Why: image attachment detection in terminal TUIs keys off bracketed paste
     // of the literal path — no shell-escaping, no trailing space.
     expect(sendInputAccepted).toHaveBeenCalledWith(
-      wrapTerminalBracketedPasteText('/repo/My Screenshot.png')
+      wrapTerminalBracketedPasteText('/repo/My Screenshot.png'),
+      'driving'
     )
   })
 
@@ -88,10 +89,11 @@ describe('terminal drop path writer', () => {
       targetShell: 'posix'
     })
 
-    expect(sendInputAccepted).toHaveBeenNthCalledWith(1, '/repo/a.ts ')
+    expect(sendInputAccepted).toHaveBeenNthCalledWith(1, '/repo/a.ts ', 'driving')
     expect(sendInputAccepted).toHaveBeenNthCalledWith(
       2,
-      wrapTerminalBracketedPasteText('/repo/shot.png')
+      wrapTerminalBracketedPasteText('/repo/shot.png'),
+      'driving'
     )
   })
 
@@ -113,9 +115,10 @@ describe('terminal drop path writer', () => {
     // non-image path would collide with it without an explicit separator.
     expect(sendInputAccepted).toHaveBeenNthCalledWith(
       1,
-      `${wrapTerminalBracketedPasteText('/repo/shot.png')} `
+      `${wrapTerminalBracketedPasteText('/repo/shot.png')} `,
+      'driving'
     )
-    expect(sendInputAccepted).toHaveBeenNthCalledWith(2, '/repo/a.ts ')
+    expect(sendInputAccepted).toHaveBeenNthCalledWith(2, '/repo/a.ts ', 'driving')
   })
 
   it('does not insert a separator between back-to-back image pastes', async () => {
@@ -136,11 +139,13 @@ describe('terminal drop path writer', () => {
     // TUI input between the two attachments.
     expect(sendInputAccepted).toHaveBeenNthCalledWith(
       1,
-      wrapTerminalBracketedPasteText('/repo/one.png')
+      wrapTerminalBracketedPasteText('/repo/one.png'),
+      'driving'
     )
     expect(sendInputAccepted).toHaveBeenNthCalledWith(
       2,
-      wrapTerminalBracketedPasteText('/repo/two.png')
+      wrapTerminalBracketedPasteText('/repo/two.png'),
+      'driving'
     )
   })
 
@@ -158,7 +163,10 @@ describe('terminal drop path writer', () => {
       targetShell: 'posix'
     })
 
-    expect(sendInputAccepted).toHaveBeenCalledWith("'/repo/a.png; touch /tmp/pwned #.png' ")
+    expect(sendInputAccepted).toHaveBeenCalledWith(
+      "'/repo/a.png; touch /tmp/pwned #.png' ",
+      'driving'
+    )
   })
 
   it('falls back to shell escaping for image paths with Windows shell metacharacters', async () => {
@@ -175,7 +183,7 @@ describe('terminal drop path writer', () => {
       targetShell: 'windows'
     })
 
-    expect(sendInputAccepted).toHaveBeenCalledWith('"C:\\Users\\me\\Pictures\\a&b.png" ')
+    expect(sendInputAccepted).toHaveBeenCalledWith('"C:\\Users\\me\\Pictures\\a&b.png" ', 'driving')
   })
 
   it('separates an image paste from a following image path that must be shell escaped', async () => {
@@ -194,9 +202,14 @@ describe('terminal drop path writer', () => {
 
     expect(sendInputAccepted).toHaveBeenNthCalledWith(
       1,
-      `${wrapTerminalBracketedPasteText('/repo/shot.png')} `
+      `${wrapTerminalBracketedPasteText('/repo/shot.png')} `,
+      'driving'
+    )
+    expect(sendInputAccepted).toHaveBeenNthCalledWith(
+      2,
+      "'/repo/a.png; touch /tmp/pwned #.png' ",
+      'driving'
     )
-    expect(sendInputAccepted).toHaveBeenNthCalledWith(2, "'/repo/a.png; touch /tmp/pwned #.png' ")
   })
 
   it('times out dropped path writes that never receive PTY acknowledgement', async () => {
diff --git a/src/renderer/src/components/terminal-pane/terminal-drop-path-writer.ts b/src/renderer/src/components/terminal-pane/terminal-drop-path-writer.ts
index f8ed3766251..824a812ddb7 100644
--- a/src/renderer/src/components/terminal-pane/terminal-drop-path-writer.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-drop-path-writer.ts
@@ -72,7 +72,7 @@ export async function writeTerminalDropPathsToCapturedTarget({
         )
       : `${shellEscapePath(path, targetShell)} `
     const writeResult = await runTerminalPasteOperationWithTimeout(
-      () => writeTerminalPastePtyInput(liveTransport, payload),
+      () => writeTerminalPastePtyInput(liveTransport, payload, 'driving'),
       operationTimeoutMs
     )
     if (writeResult.timedOut) {
diff --git a/src/renderer/src/components/terminal-pane/terminal-ime-composition-route.ts b/src/renderer/src/components/terminal-pane/terminal-ime-composition-route.ts
index 7b7ed78989f..45fe1ee23ab 100644
--- a/src/renderer/src/components/terminal-pane/terminal-ime-composition-route.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-ime-composition-route.ts
@@ -99,8 +99,8 @@ export function readTerminalImeCompositionSessionDetail(
 export function installTerminalImeCompositionRoute(args: {
   terminalElement: HTMLElement | null | undefined
   terminal: Pick<Terminal, 'input'>
-  capturedTransport: PtyTransport
-  getCurrentTransport: () => PtyTransport | undefined
+  capturedTransport: Pick<PtyTransport, 'getPtyId'>
+  getCurrentTransport: () => Pick<PtyTransport, 'getPtyId'> | undefined
 }): IDisposable {
   const terminalElement = args.terminalElement
   const sessions = new Map<number, CapturedCompositionSession>()
diff --git a/src/renderer/src/components/terminal-pane/terminal-ime-user-input-provenance.test.ts b/src/renderer/src/components/terminal-pane/terminal-ime-user-input-provenance.test.ts
new file mode 100644
index 00000000000..5b0accad22c
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-ime-user-input-provenance.test.ts
@@ -0,0 +1,174 @@
+// @vitest-environment happy-dom
+// IME and Hangul commits bypass xterm's key path and enter through `terminal.input`. Main records
+// a run's first user input from xterm's user-input signal, so every commit route must carry it.
+import { Terminal } from '@xterm/xterm'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import type { IDisposable } from '@xterm/xterm'
+import type { PtyTransport } from './pty-transport'
+import {
+  installTerminalImeCompositionRoute,
+  XTERM_COMPOSITION_SESSION_END_EVENT,
+  XTERM_COMPOSITION_SESSION_START_EVENT
+} from './terminal-ime-composition-route'
+import { IPAD_DESKTOP_MODE_UA, pretendIosWeb } from './terminal-ios-hangul-preedit-fixture'
+import { installTerminalPaneInputHandling } from './terminal-pane-pane-input'
+import { subscribeToTerminalInputData } from './terminal-user-input-signal'
+
+const MAC_UA =
+  'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36'
+
+type ForwardedInput = { data: string; wasUserInput: boolean }
+
+const disposables: IDisposable[] = []
+
+function openPane(): {
+  terminal: Terminal
+  textarea: HTMLTextAreaElement
+  forwarded: ForwardedInput[]
+} {
+  const container = document.createElement('div')
+  document.body.appendChild(container)
+  const terminal = new Terminal({ cols: 40, rows: 8 })
+  disposables.push(terminal)
+  terminal.open(container)
+  installTerminalPaneInputHandling({
+    pane: { id: 1, terminal },
+    managerRef: { current: null },
+    paneKittyKeyboardModesRef: { current: new Map() },
+    settingsRef: { current: {} },
+    imeCompositionDisposablesRef: { current: new Map() },
+    imeNativeTextForwarderDisposablesRef: { current: new Map() }
+  })
+  const forwarded: ForwardedInput[] = []
+  disposables.push(
+    subscribeToTerminalInputData(terminal, (data, wasUserInput) =>
+      forwarded.push({ data, wasUserInput })
+    )
+  )
+  return { terminal, textarea: terminal.textarea!, forwarded }
+}
+
+function key(
+  textarea: HTMLTextAreaElement,
+  type: 'keydown' | 'keypress' | 'keyup',
+  init: { key: string; code: string; keyCode: number }
+): KeyboardEvent {
+  const event = new KeyboardEvent(type, { ...init, bubbles: true, cancelable: true })
+  // happy-dom drops the legacy numeric fields from KeyboardEventInit; xterm's key paths read them.
+  Object.defineProperty(event, 'keyCode', { value: init.keyCode })
+  Object.defineProperty(event, 'charCode', { value: type === 'keypress' ? init.keyCode : 0 })
+  textarea.dispatchEvent(event)
+  return event
+}
+
+function insertText(textarea: HTMLTextAreaElement, inputType: string, data: string | null): void {
+  const event = new InputEvent('input', { bubbles: true })
+  Object.defineProperty(event, 'inputType', { value: inputType })
+  Object.defineProperty(event, 'data', { value: data })
+  Object.defineProperty(event, 'composed', { value: true })
+  textarea.dispatchEvent(event)
+}
+
+describe('IME and Hangul commits reach the PTY as user input', () => {
+  let originalUserAgent: PropertyDescriptor | undefined
+  let originalMaxTouchPoints: PropertyDescriptor | undefined
+  let originalGetContext: PropertyDescriptor | undefined
+
+  beforeEach(() => {
+    originalUserAgent = Object.getOwnPropertyDescriptor(navigator, 'userAgent')
+    originalMaxTouchPoints = Object.getOwnPropertyDescriptor(navigator, 'maxTouchPoints')
+    // happy-dom has no 2d context, which the DOM renderer's WidthCache requires.
+    originalGetContext = Object.getOwnPropertyDescriptor(HTMLCanvasElement.prototype, 'getContext')
+    Object.defineProperty(HTMLCanvasElement.prototype, 'getContext', {
+      configurable: true,
+      value: () => ({ measureText: () => ({ width: 10 }) })
+    })
+  })
+
+  afterEach(() => {
+    for (const disposable of disposables.splice(0)) {
+      disposable.dispose()
+    }
+    for (const [property, descriptor] of [
+      ['userAgent', originalUserAgent],
+      ['maxTouchPoints', originalMaxTouchPoints]
+    ] as const) {
+      // Why delete: with no own descriptor the real value lives on the prototype, which the stub shadows.
+      if (descriptor) {
+        Object.defineProperty(navigator, property, descriptor)
+      } else {
+        Reflect.deleteProperty(navigator, property)
+      }
+    }
+    if (originalGetContext) {
+      Object.defineProperty(HTMLCanvasElement.prototype, 'getContext', originalGetContext)
+    } else {
+      Reflect.deleteProperty(HTMLCanvasElement.prototype, 'getContext')
+    }
+    document.body.replaceChildren()
+  })
+
+  it('marks a macOS input-source substitution as user input', () => {
+    pretendIosWeb(0, MAC_UA)
+    const { textarea, forwarded } = openPane()
+
+    const keydown = key(textarea, 'keydown', { key: ',', code: 'Comma', keyCode: 188 })
+    expect(keydown.defaultPrevented).toBe(false)
+    textarea.value = '，'
+    insertText(textarea, 'insertText', '，')
+    key(textarea, 'keyup', { key: ',', code: 'Comma', keyCode: 188 })
+
+    expect(forwarded).toEqual([{ data: '，', wasUserInput: true }])
+  })
+
+  it('marks an iPadOS Hangul syllable commit as user input', async () => {
+    pretendIosWeb(5, IPAD_DESKTOP_MODE_UA)
+    const { textarea, forwarded } = openPane()
+    const typeJamo = async (jamo: string, written: string, replaces: boolean) => {
+      if (
+        !key(textarea, 'keydown', { key: jamo, code: 'KeyQ', keyCode: jamo.charCodeAt(0) })
+          .defaultPrevented
+      ) {
+        key(textarea, 'keypress', { key: jamo, code: 'KeyQ', keyCode: jamo.charCodeAt(0) })
+      }
+      if (replaces) {
+        textarea.value = textarea.value.slice(0, -1)
+        insertText(textarea, 'deleteContentBackward', null)
+      }
+      textarea.value += written
+      insertText(textarea, 'insertText', written)
+      await new Promise((resolve) => window.setTimeout(resolve, 0))
+    }
+
+    await typeJamo('ㅎ', 'ㅎ', false)
+    await typeJamo('ㅏ', '하', true)
+    await typeJamo('ㄴ', '한', true)
+    await typeJamo('ㄱ', 'ㄱ', false)
+
+    expect(forwarded).toEqual([{ data: '한', wasUserInput: true }])
+  })
+
+  it('marks a composition the route delivers after a pane switch as user input', () => {
+    const { terminal, forwarded } = openPane()
+    const transport: Pick<PtyTransport, 'getPtyId'> = { getPtyId: () => 'pty-1' }
+    disposables.push(
+      installTerminalImeCompositionRoute({
+        terminalElement: terminal.element!,
+        terminal,
+        capturedTransport: transport,
+        getCurrentTransport: () => transport
+      })
+    )
+    const session = (type: string, data?: string): CustomEvent =>
+      new CustomEvent(type, {
+        bubbles: true,
+        cancelable: true,
+        detail: { id: 1, data, dataPendingReconciliation: false }
+      })
+
+    terminal.element!.dispatchEvent(session(XTERM_COMPOSITION_SESSION_START_EVENT))
+    terminal.element!.dispatchEvent(session(XTERM_COMPOSITION_SESSION_END_EVENT, '한'))
+
+    expect(forwarded).toEqual([{ data: '한', wasUserInput: true }])
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/terminal-ime-xterm-midline-preedit-tail.test.ts b/src/renderer/src/components/terminal-pane/terminal-ime-xterm-midline-preedit-tail.test.ts
index 46861938efe..ff8ec1d3408 100644
--- a/src/renderer/src/components/terminal-pane/terminal-ime-xterm-midline-preedit-tail.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-ime-xterm-midline-preedit-tail.test.ts
@@ -52,17 +52,17 @@ type RigOptions = {
  * overflow. This gives the preedit span a width and the screen its cols*rows box.
  */
 function stubCompositionLayout(preeditWidth: () => number): void {
-  vi.spyOn(HTMLElement.prototype, 'getBoundingClientRect').mockImplementation(
-    function (this: HTMLElement) {
-      if (this.classList.contains('xterm-composition-preedit')) {
-        return DOMRect.fromRect({ height: CELL_HEIGHT_PX, width: preeditWidth() })
-      }
-      if (this.classList.contains('xterm-screen')) {
-        return DOMRect.fromRect({ height: 24 * CELL_HEIGHT_PX, width: 80 * CELL_WIDTH_PX })
-      }
-      return DOMRect.fromRect({ height: 0, width: 0 })
+  vi.spyOn(HTMLElement.prototype, 'getBoundingClientRect').mockImplementation(function (
+    this: HTMLElement
+  ) {
+    if (this.classList.contains('xterm-composition-preedit')) {
+      return DOMRect.fromRect({ height: CELL_HEIGHT_PX, width: preeditWidth() })
     }
-  )
+    if (this.classList.contains('xterm-screen')) {
+      return DOMRect.fromRect({ height: 24 * CELL_HEIGHT_PX, width: 80 * CELL_WIDTH_PX })
+    }
+    return DOMRect.fromRect({ height: 0, width: 0 })
+  })
 }
 
 function openTerminal(options: RigOptions = {}): Rig {
diff --git a/src/renderer/src/components/terminal-pane/terminal-ime-xterm-preedit-cell-grid.test.ts b/src/renderer/src/components/terminal-pane/terminal-ime-xterm-preedit-cell-grid.test.ts
index 083b1c43ebd..38f10c0db50 100644
--- a/src/renderer/src/components/terminal-pane/terminal-ime-xterm-preedit-cell-grid.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-ime-xterm-preedit-cell-grid.test.ts
@@ -99,12 +99,13 @@ describe('IME preedit advances on the terminal cell grid (#19315)', () => {
       'letterSpacing'
     )!.set!
     // happy-dom drops calc(var(...)); Electron coverage checks the resulting layout.
-    vi.spyOn(CSSStyleDeclaration.prototype, 'letterSpacing', 'set').mockImplementation(
-      function (this: CSSStyleDeclaration, value) {
-        assignedSpacing.set(this, value)
-        setter.call(this, value)
-      }
-    )
+    vi.spyOn(CSSStyleDeclaration.prototype, 'letterSpacing', 'set').mockImplementation(function (
+      this: CSSStyleDeclaration,
+      value
+    ) {
+      assignedSpacing.set(this, value)
+      setter.call(this, value)
+    })
     vi.spyOn(HTMLCanvasElement.prototype, 'getContext').mockImplementation(() => {
       const context: CanvasRenderingContext2D = Object.create(null)
       context.font = '13px monospace'
diff --git a/src/renderer/src/components/terminal-pane/terminal-input-mode-reset.ts b/src/renderer/src/components/terminal-pane/terminal-input-mode-reset.ts
new file mode 100644
index 00000000000..479da70f65d
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-input-mode-reset.ts
@@ -0,0 +1,18 @@
+import { resetWebRuntimeTerminalInputModes } from '@/runtime/web-runtime-session'
+import { resetPtyRendererInputModes } from './pty-buffer-serializer'
+
+/**
+ * Reset Terminal: grounds the input modes an app left armed (Kitty keyboard,
+ * mouse, bracketed paste, focus, alt screen, cursor keys) in the pane and in the
+ * host's models, so a reattach does not re-arm them. Each side grounds its own
+ * records; an older host rejects the request and only the pane is grounded.
+ */
+export function resetTerminalInputModes(ptyId: string | null): void {
+  if (!ptyId) {
+    return
+  }
+  resetPtyRendererInputModes(ptyId)
+  if (!resetWebRuntimeTerminalInputModes(ptyId)) {
+    window.api.pty.resetInputModes(ptyId)
+  }
+}
diff --git a/src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit-coexistence.test.ts b/src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit-coexistence.test.ts
index 5f65a429922..42f032b17f4 100644
--- a/src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit-coexistence.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit-coexistence.test.ts
@@ -210,7 +210,7 @@ describe('the iPadOS Hangul path alongside everything else', () => {
     pretendIosWeb()
     const rig = openIosTerminal()
     const sent: string[] = []
-    writeTerminalPastePtyInput({ sendInput: (data) => (sent.push(data), true) }, 'echo ')
+    writeTerminalPastePtyInput({ sendInput: (data) => (sent.push(data), true) }, 'echo ', 'driving')
     expect(sent).toEqual(['echo '])
 
     await typeHangeul(rig)
diff --git a/src/renderer/src/components/terminal-pane/terminal-keyboard-action-dispatch.ts b/src/renderer/src/components/terminal-pane/terminal-keyboard-action-dispatch.ts
index feb3eb4b7de..ce0c10694f3 100644
--- a/src/renderer/src/components/terminal-pane/terminal-keyboard-action-dispatch.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-keyboard-action-dispatch.ts
@@ -79,10 +79,6 @@ export function dispatchTerminalShortcutAction(
     event.stopImmediatePropagation()
     return
   }
-  if (event.repeat) {
-    return
-  }
-
   if (action.type === 'copySelection') {
     const pane = manager.getActivePane() ?? manager.getPanes()[0]
     if (!pane || !pane.terminal.getSelection()) {
@@ -90,10 +86,16 @@ export function dispatchTerminalShortcutAction(
     }
     event.preventDefault()
     event.stopImmediatePropagation()
-    void copyTerminalSelection({
-      terminal: pane.terminal,
-      writeClipboardText: window.api.ui.writeTerminalClipboardText
-    }).catch(() => {})
+    if (!event.repeat) {
+      armNativeOnlyShortcut(event)
+      void copyTerminalSelection({
+        terminal: pane.terminal,
+        writeClipboardText: window.api.ui.writeTerminalClipboardText
+      }).catch(() => {})
+    }
+    return
+  }
+  if (event.repeat) {
     return
   }
   if (action.type === 'toggleSearch') {
diff --git a/src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.ts b/src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.ts
index 4287e4eeee2..ffa88d60783 100644
--- a/src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.ts
@@ -94,6 +94,7 @@ export function detachTerminalLayoutLeaf(
       ptyIdsByLeafId
     }),
     expandedLeafId: layout.expandedLeafId === leafId ? null : layout.expandedLeafId,
+    ...(layout.chatLeafId && layout.chatLeafId !== leafId ? { chatLeafId: layout.chatLeafId } : {}),
     ...(ptyIdsByLeafId ? { ptyIdsByLeafId } : {}),
     ...(buffersByLeafId ? { buffersByLeafId } : {}),
     ...(scrollbackRefsByLeafId ? { scrollbackRefsByLeafId } : {}),
@@ -110,6 +111,7 @@ export function detachTerminalLayoutLeaf(
       root: { type: 'leaf', leafId },
       activeLeafId: leafId,
       expandedLeafId: null,
+      ...(layout.chatLeafId === leafId ? { chatLeafId: leafId } : {}),
       ...(detachedPtyIdsByLeafId ? { ptyIdsByLeafId: detachedPtyIdsByLeafId } : {}),
       ...(detachedBuffersByLeafId ? { buffersByLeafId: detachedBuffersByLeafId } : {}),
       ...(detachedScrollbackRefsByLeafId
diff --git a/src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.ts b/src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.ts
index 37870c03d70..7ea60830f9c 100644
--- a/src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.ts
@@ -182,6 +182,7 @@ function normalizeTerminalLayoutLeafIds(snapshot: TerminalLayoutSnapshot | null
   // selection ids must not strand focus on a missing pane.
   const remappedActiveLeafId = getRemappedLeafId(activeLeafId, rewrite) ?? firstLeafId(root)
   const remappedExpandedLeafId = getRemappedLeafId(expandedLeafId, rewrite)
+  const remappedChatLeafId = getRemappedLeafId(snapshot.chatLeafId, rewrite)
   const ptyIdsByLeafId = remapLeafRecord(snapshot.ptyIdsByLeafId, rewrite)
   const buffersByLeafId = remapLeafRecord(snapshot.buffersByLeafId, rewrite)
   const scrollbackRefsByLeafId = remapLeafRecord(snapshot.scrollbackRefsByLeafId, rewrite)
@@ -191,6 +192,7 @@ function normalizeTerminalLayoutLeafIds(snapshot: TerminalLayoutSnapshot | null
     buffersByLeafId: _oldBuffersByLeafId,
     scrollbackRefsByLeafId: _oldScrollbackRefsByLeafId,
     titlesByLeafId: _oldTitlesByLeafId,
+    chatLeafId: _oldChatLeafId,
     ...snapshotWithoutLeafRecords
   } = snapshot
   return {
@@ -203,6 +205,7 @@ function normalizeTerminalLayoutLeafIds(snapshot: TerminalLayoutSnapshot | null
         ptyIdsByLeafId
       }),
       expandedLeafId: remappedExpandedLeafId,
+      ...(remappedChatLeafId ? { chatLeafId: remappedChatLeafId } : {}),
       ...(ptyIdsByLeafId ? { ptyIdsByLeafId } : {}),
       ...(buffersByLeafId ? { buffersByLeafId } : {}),
       ...(scrollbackRefsByLeafId ? { scrollbackRefsByLeafId } : {}),
diff --git a/src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.ts b/src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.ts
index 3687621f151..001be213fab 100644
--- a/src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.ts
@@ -205,6 +205,9 @@ export function normalizeTerminalLayoutPtyOwnership(
   const ptyIdsByLeafId = coalesceLeafRecord(snapshot.ptyIdsByLeafId, retainedLeafIdByRemovedLeafId)
   const rootLeafIds = collectLeafIds(root)
   const activeLeafId = resolveOwnedActiveLeafId(rootLeafIds, mappedActiveLeafId, ptyIdsByLeafId)
+  const remappedChatLeafId = snapshot.chatLeafId
+    ? resolveRetainedLeafId(snapshot.chatLeafId, retainedLeafIdByRemovedLeafId)
+    : null
   const { buffersByLeafId, scrollbackRefsByLeafId } = coalesceScrollbackRecords(
     snapshot.buffersByLeafId,
     snapshot.scrollbackRefsByLeafId,
@@ -217,6 +220,7 @@ export function normalizeTerminalLayoutPtyOwnership(
     buffersByLeafId: _oldBuffersByLeafId,
     scrollbackRefsByLeafId: _oldScrollbackRefsByLeafId,
     titlesByLeafId: _oldTitlesByLeafId,
+    chatLeafId: _oldChatLeafId,
     ...snapshotWithoutLeafRecords
   } = snapshot
 
@@ -231,6 +235,9 @@ export function normalizeTerminalLayoutPtyOwnership(
         rootLeafIds.includes(snapshot.expandedLeafId)
           ? snapshot.expandedLeafId
           : null,
+      ...(remappedChatLeafId && rootLeafIds.includes(remappedChatLeafId)
+        ? { chatLeafId: remappedChatLeafId }
+        : {}),
       ...(ptyIdsByLeafId ? { ptyIdsByLeafId } : {}),
       ...(buffersByLeafId ? { buffersByLeafId } : {}),
       ...(scrollbackRefsByLeafId ? { scrollbackRefsByLeafId } : {}),
diff --git a/src/renderer/src/components/terminal-pane/terminal-link-action-request.ts b/src/renderer/src/components/terminal-pane/terminal-link-action-request.ts
index 1ddedfe9e5a..21f917302ca 100644
--- a/src/renderer/src/components/terminal-pane/terminal-link-action-request.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-link-action-request.ts
@@ -50,7 +50,7 @@ export function requestTerminalLinkAction(
     !event ||
     !context ||
     !(
-      isTerminalLinkActionActivation(event) ||
+      (isTerminalLinkActionActivation(event) && context.plainClickBehavior !== 'none') ||
       (isTerminalMiddleClickActivation(event) && context.middleClickBehavior !== 'none')
     ) ||
     !context.pointerGesture.canRequestAction(event)
diff --git a/src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts b/src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts
index ca1168eb7b6..be546428c90 100644
--- a/src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts
@@ -122,6 +122,26 @@ describe('terminal link action routing', () => {
     expect(run).toHaveBeenCalledOnce()
   })
 
+  it('leaves disabled plain clicks with the terminal while middle click remains enabled', () => {
+    const context = actionContext()
+    context.plainClickBehavior = 'none'
+    context.middleClickBehavior = 'open'
+    const event = plainEvent()
+    const run = vi.fn()
+
+    expect(
+      requestTerminalLinkAction(event, context, {
+        destination: 'https://example.com',
+        kind: 'url',
+        primary: { label: 'Open', run }
+      })
+    ).toBe(false)
+    expect(context.claimPtyMouse).not.toHaveBeenCalled()
+    expect(event.preventDefault).not.toHaveBeenCalled()
+    expect(context.request).not.toHaveBeenCalled()
+    expect(run).not.toHaveBeenCalled()
+  })
+
   it('keeps middle click available when plain clicks stay with the terminal', () => {
     const run = vi.fn()
     const context = actionContext()
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-hook-order-parity.test.ts b/src/renderer/src/components/terminal-pane/terminal-pane-hook-order-parity.test.ts
deleted file mode 100644
index 8645d8cecb0..00000000000
--- a/src/renderer/src/components/terminal-pane/terminal-pane-hook-order-parity.test.ts
+++ /dev/null
@@ -1,123 +0,0 @@
-import { createHash } from 'node:crypto'
-import { readFileSync, readdirSync } from 'node:fs'
-import { join } from 'node:path'
-// TypeScript 7 is a native CLI; AST tests still need the legacy JavaScript API.
-import ts from 'typescript-api'
-import { describe, expect, it } from 'vitest'
-
-const TERMINAL_PANE_HOOK_SOURCE_PATTERN =
-  /^(?:TerminalPane\.tsx|use-terminal-pane-(?:chat-state|close-actions|context-actions|controller|foundation|global-listeners|layout-bindings|layout-persistence|lifecycle-stage|mobile-actions|paste-listeners|process-exit-actions|projection|reconciliation|startup-actions|store-actions|store-bindings|title-effects|title-state)\.ts)$/
-// Rebased onto main after the workbench surface-per-workspace and deferred
-// split-cwd changes; the pane session-ID projection added one render hook (230 hooks).
-// Then 27 stable-action `useAppStore` subscriptions folded into four
-// `useTerminalPaneStoreActions()` calls, each one `useMemo` (204 hooks, 8 useMemo).
-// Restoring the terminal/chat switcher added four `useCallback`s -- three in
-// chat-state (can-toggle, toggle-for-leaf, toggle-active) and the context-menu
-// toggle in projection (208 hooks, still 8 useMemo).
-// Then chat-state's orchestration dispatch-status subscription went with the
-// paused notice that read it (207 hooks, still 8 useMemo).
-// Then host-authoritative layout removal added two `useRef`s in reconciliation
-// (last host layout leaf set, retired leaf set) (209 hooks, still 8 useMemo).
-// Then search match count + Cmd+F focus parity (#9035) added a `useRef` and a `useCallback` in
-// foundation (search input ref, focus-search-input) (211 hooks, still 8 useMemo).
-// Then the pending split-close admission added one `useRef` in close-actions
-// (the confirmed-close continuation) (212 hooks, still 8 useMemo).
-// Then the dead adopted-structured-session portal went with its local target `useMemo`
-// in projection (211 hooks, 7 useMemo).
-const PRE_REFACTOR_HOOK_ORDER_SHA256 =
-  '8293793dd40900d869b110ddbe8b4412080f8f505da0baeb4337102147886053'
-
-const sourceFiles = readdirSync(__dirname)
-  .filter((name) => TERMINAL_PANE_HOOK_SOURCE_PATTERN.test(name))
-  .sort()
-
-function readFunctionDefinitions(): Map<string, ts.FunctionDeclaration> {
-  const definitions = new Map<string, ts.FunctionDeclaration>()
-  for (const relativePath of sourceFiles) {
-    const filePath = join(__dirname, relativePath)
-    const sourceFile = ts.createSourceFile(
-      filePath,
-      readFileSync(filePath, 'utf8'),
-      ts.ScriptTarget.Latest,
-      true,
-      relativePath.endsWith('.tsx') ? ts.ScriptKind.TSX : ts.ScriptKind.TS
-    )
-    const visit = (node: ts.Node): void => {
-      if (
-        ts.isFunctionDeclaration(node) &&
-        node.name &&
-        (node.name.text === 'TerminalPane' || node.name.text.startsWith('useTerminalPane'))
-      ) {
-        definitions.set(node.name.text, node)
-      }
-      ts.forEachChild(node, visit)
-    }
-    visit(sourceFile)
-  }
-  return definitions
-}
-
-function readFlattenedHookOrder(): string[] {
-  const definitions = readFunctionDefinitions()
-  const flatten = (name: string, active: ReadonlySet<string>): string[] => {
-    const definition = definitions.get(name)
-    if (!definition?.body) {
-      throw new Error(`Missing terminal pane hook stage: ${name}`)
-    }
-    if (active.has(name)) {
-      throw new Error(`Recursive terminal pane hook stage: ${name}`)
-    }
-    const nextActive = new Set([...active, name])
-    const hooks: string[] = []
-    const visit = (node: ts.Node): void => {
-      if (
-        ts.isCallExpression(node) &&
-        ts.isIdentifier(node.expression) &&
-        /^use[A-Z]/.test(node.expression.text)
-      ) {
-        const hookName = node.expression.text
-        hooks.push(...(definitions.has(hookName) ? flatten(hookName, nextActive) : [hookName]))
-      }
-      ts.forEachChild(node, visit)
-    }
-    visit(definition.body)
-    return hooks
-  }
-
-  return flatten('TerminalPane', new Set())
-}
-
-describe('TerminalPane refactor hook parity', () => {
-  it('preserves the recursively flattened render hook order', () => {
-    const hooks = readFlattenedHookOrder()
-    expect(hooks).toHaveLength(211)
-    expect(hooks.filter((hook) => hook === 'useMemo')).toHaveLength(7)
-    expect(createHash('sha256').update(hooks.join('\n')).digest('hex')).toBe(
-      PRE_REFACTOR_HOOK_ORDER_SHA256
-    )
-  })
-
-  it('aggregates every extracted hook stage', () => {
-    expect(sourceFiles).toHaveLength(20)
-    expect(sourceFiles).toContain('TerminalPane.tsx')
-    expect(sourceFiles).toContain('use-terminal-pane-controller.ts')
-  })
-
-  it('defers quick-command host work until the context menu opens', () => {
-    const startupSource = readFileSync(
-      join(__dirname, 'use-terminal-pane-startup-actions.ts'),
-      'utf8'
-    )
-    const contextSource = readFileSync(
-      join(__dirname, 'use-terminal-pane-context-actions.ts'),
-      'utf8'
-    )
-
-    expect(startupSource).toContain('const quickCommandRepoId =')
-    expect(startupSource).not.toContain('useTerminalQuickCommandHosts')
-    expect(contextSource).toContain('useTerminalQuickCommandHosts(worktreeId, contextMenu.open)')
-    expect(contextSource).toContain('terminalQuickCommandMatchesWorkspaceProject')
-    expect(contextSource).toContain('projectHostSetupProjection.setups')
-    expect(contextSource).toContain('quickCommandExecutionHostId')
-  })
-})
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-host-state-memo.test.ts b/src/renderer/src/components/terminal-pane/terminal-pane-host-state-memo.test.ts
index ba9c169295d..ba4bb48f1c3 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pane-host-state-memo.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-host-state-memo.test.ts
@@ -54,6 +54,23 @@ beforeEach(() => {
 })
 
 describe('selectTerminalPaneHostState memo', () => {
+  it('releases the last store snapshot when no terminal selects again', async () => {
+    if (typeof globalThis.gc !== 'function') {
+      throw new Error('Run with the repository Vitest --expose-gc config')
+    }
+    function selectRetiredState(): WeakRef<AppState> {
+      const state = makeState()
+      selectTerminalPaneHostState(state, LOCAL_WORKTREE)
+      return new WeakRef(state)
+    }
+    const retired = selectRetiredState()
+    for (let round = 0; round < 3; round++) {
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      globalThis.gc()
+    }
+    expect(retired.deref()).toBeUndefined()
+  })
+
   it('returns the same object across an unrelated store write', () => {
     const first = makeState()
     const before = selectTerminalPaneHostState(first, LOCAL_WORKTREE)
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-host-state.test.ts b/src/renderer/src/components/terminal-pane/terminal-pane-host-state.test.ts
index c9614690e4b..fef6ce12224 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pane-host-state.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-host-state.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import type { AppState } from '@/store/types'
+import { selectWorktreeHostConnectionPhase } from '@/lib/worktree-host-connection-phase'
 import { selectTerminalPaneHostState } from './terminal-pane-host-state'
 
 function makeState(overrides: Record<string, unknown>): AppState {
@@ -161,4 +162,71 @@ describe('selectTerminalPaneHostState', () => {
       sshReconnectTargetRemoved: false
     })
   })
+
+  // The terminal reads the shared host signal but names the published status: an undialed
+  // target during startup restoration stays "disconnected" here (the overlay and error
+  // ownership are unchanged) even though the other panes read that window as connecting.
+  it('reports the published status through the shared signal, across startup and connect', () => {
+    const repos = [{ id: 'repo-ssh', connectionId: 'ssh-a' }]
+    const worktreesByRepo = { 'repo-ssh': [{ id: 'wt-ssh', repoId: 'repo-ssh' }] }
+    const withStatus = (status: string | null): AppState =>
+      makeState({
+        repos,
+        worktreesByRepo,
+        terminalStartupRestorationReady: false,
+        sshConnectionStates: new Map(
+          status ? [['ssh-a', { targetId: 'ssh-a', status, error: null, reconnectAttempt: 0 }]] : []
+        )
+      })
+
+    expect(selectWorktreeHostConnectionPhase(withStatus(null), 'wt-ssh').phase).toBe('connecting')
+    expect(selectTerminalPaneHostState(withStatus(null), 'wt-ssh').sshReconnectStatus).toBe(
+      'disconnected'
+    )
+    expect(selectTerminalPaneHostState(withStatus('connecting'), 'wt-ssh').sshReconnectStatus).toBe(
+      'connecting'
+    )
+    expect(selectTerminalPaneHostState(withStatus('connected'), 'wt-ssh').sshReconnectStatus).toBe(
+      'connected'
+    )
+  })
+
+  // An owning runtime that has not published its SSH state is unverifiable, not down: the
+  // terminal keeps reporting no status, so it shows no reconnect overlay for it.
+  it('reports no status for a nested target whose runtime has not published its SSH state', () => {
+    const state = makeState({
+      repos: [{ id: 'repo-runtime', connectionId: 'ssh-nested', executionHostId: 'runtime:env-a' }],
+      runtimeStatusByEnvironmentId: new Map([
+        ['env-a', { status: { runtimeId: 'runtime-a' }, checkedAt: 1 }]
+      ]),
+      sshStateByEnvironment: new Map([
+        [
+          'env-a',
+          {
+            connectionStates: new Map(),
+            targetLabels: new Map(),
+            removedTargetLabels: new Map(),
+            targetsHydrated: false
+          }
+        ]
+      ]),
+      worktreesByRepo: {
+        'repo-runtime': [
+          {
+            id: 'wt-runtime',
+            repoId: 'repo-runtime',
+            hostId: 'runtime:env-a',
+            runtimeOwnerEnvironmentId: 'env-a'
+          }
+        ]
+      }
+    })
+
+    expect(selectWorktreeHostConnectionPhase(state, 'wt-runtime').phase).toBe('unverifiable')
+    expect(selectTerminalPaneHostState(state, 'wt-runtime')).toMatchObject({
+      sshReconnectEnvironmentId: 'env-a',
+      sshReconnectStatus: null,
+      sshReconnectTargetId: 'ssh-nested'
+    })
+  })
 })
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-host-state.ts b/src/renderer/src/components/terminal-pane/terminal-pane-host-state.ts
index 6b40bdf379c..19471a706e7 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pane-host-state.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-host-state.ts
@@ -1,21 +1,22 @@
 import type { AppState } from '@/store/types'
 import { getConnectionIdFromState } from '@/lib/connection-context'
-import { getExplicitRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
+import {
+  resolveWorktreeHostConnection,
+  type WorktreeHostConnection
+} from '@/lib/worktree-host-connection-phase'
 import { isNativeChatTranscriptLocalReadable } from '@/lib/native-chat-transcript-readability'
 import {
   selectRuntimeAwareSshError,
-  selectRuntimeAwareSshStatus,
   selectRuntimeAwareSshTargetLabel,
   selectRuntimeAwareSshTargetRemoved
 } from '@/store/slices/runtime-environment-ssh'
-import { isRuntimeOwnedSshTargetId } from '../../../../shared/execution-host'
 
 export type TerminalPaneHostState = {
   nativeChatTranscriptIsLocalReadable: boolean
   sshReconnectEnvironmentId: string | null
   /** The failure detail behind the status; the overlay shows only a canned sentence without it. */
   sshReconnectError: string | null
-  sshReconnectStatus: ReturnType<typeof selectRuntimeAwareSshStatus>
+  sshReconnectStatus: WorktreeHostConnection['publishedStatus']
   sshReconnectTargetId: string | null
   sshReconnectTargetLabel: string
   sshReconnectTargetRemoved: boolean
@@ -25,9 +26,8 @@ function computeTerminalPaneHostState(state: AppState, worktreeId: string): Term
   const connectionId = getConnectionIdFromState(state, worktreeId)
   const nativeChatTranscriptIsLocalReadableResult =
     isNativeChatTranscriptLocalReadable(connectionId)
-  const sshReconnectTargetId =
-    connectionId && !isRuntimeOwnedSshTargetId(connectionId) ? connectionId : null
-  if (!sshReconnectTargetId) {
+  const host = resolveWorktreeHostConnection(state, worktreeId, connectionId)
+  if (!host.targetId) {
     return {
       nativeChatTranscriptIsLocalReadable: nativeChatTranscriptIsLocalReadableResult,
       sshReconnectEnvironmentId: null,
@@ -38,7 +38,7 @@ function computeTerminalPaneHostState(state: AppState, worktreeId: string): Term
       sshReconnectTargetRemoved: false
     }
   }
-  const sshReconnectEnvironmentId = getExplicitRuntimeEnvironmentIdForWorktree(state, worktreeId)
+  const { targetId: sshReconnectTargetId, environmentId: sshReconnectEnvironmentId } = host
   return {
     nativeChatTranscriptIsLocalReadable: nativeChatTranscriptIsLocalReadableResult,
     sshReconnectEnvironmentId,
@@ -47,11 +47,7 @@ function computeTerminalPaneHostState(state: AppState, worktreeId: string): Term
       sshReconnectEnvironmentId,
       sshReconnectTargetId
     ),
-    sshReconnectStatus: selectRuntimeAwareSshStatus(
-      state,
-      sshReconnectEnvironmentId,
-      sshReconnectTargetId
-    ),
+    sshReconnectStatus: host.publishedStatus,
     sshReconnectTargetId,
     sshReconnectTargetLabel: selectRuntimeAwareSshTargetLabel(
       state,
@@ -78,7 +74,8 @@ function isSameHostState(a: TerminalPaneHostState, b: TerminalPaneHostState): bo
   )
 }
 
-let cachedState: AppState | null = null
+// Identity checks must not keep a retired store alive after the last pane unmounts.
+let cachedState: WeakRef<AppState> | null = null
 let cachedByWorktreeId = new Map<string, TerminalPaneHostState>()
 let previousByWorktreeId = new Map<string, TerminalPaneHostState>()
 
@@ -100,10 +97,10 @@ export function selectTerminalPaneHostState(
   state: AppState,
   worktreeId: string
 ): TerminalPaneHostState {
-  if (state !== cachedState) {
+  if (state !== cachedState?.deref()) {
     previousByWorktreeId = cachedByWorktreeId
     cachedByWorktreeId = new Map()
-    cachedState = state
+    cachedState = new WeakRef(state)
   }
   const cached = cachedByWorktreeId.get(worktreeId)
   if (cached) {
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-lifecycle-primitives.ts b/src/renderer/src/components/terminal-pane/terminal-pane-lifecycle-primitives.ts
index d569e265098..385c07cf7c0 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pane-lifecycle-primitives.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-lifecycle-primitives.ts
@@ -3,22 +3,12 @@ import type { TerminalLayoutSnapshot, TerminalTab } from '../../../../shared/ter
 import type { PtyPaneStartup } from './pty-connection-types'
 import type { PtyTransport } from './pty-transport'
 import type { PaneCwdMap } from './resolve-split-cwd'
-import { writeTerminalOutput } from '@/lib/pane-manager/pane-terminal-output-scheduler'
-import { RESET_KITTY_KEYBOARD_PROTOCOL } from '../../../../shared/terminal-mode-reset-profiles'
 import type { TerminalPaneSplitSource } from '../../../../shared/feature-education-telemetry'
 import type { HttpLinkSourceOwner } from '@/lib/http-link-routing'
 import { resolveLocalhostHttpLinkDisplayUrl } from '@/lib/http-link-routing'
 import { recordCreatedTerminalPaneSplit } from './terminal-pane-split-completion'
 import { PRIMARY_SELECTION_MAX_LENGTH } from '@/lib/primary-selection'
 
-/** Writes a transport-agnostic interrupt reset without running xterm work inline. */
-export function resetTerminalKeyboardProtocolAfterInterrupt(terminal: Terminal): void {
-  writeTerminalOutput(terminal, RESET_KITTY_KEYBOARD_PROTOCOL, {
-    foreground: true,
-    latencySensitive: false
-  })
-}
-
 export function recordRuntimeCreatedTerminalPaneSplit(
   createdPane: unknown,
   args: {
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-listener-order-parity.test.ts b/src/renderer/src/components/terminal-pane/terminal-pane-listener-order-parity.test.ts
deleted file mode 100644
index 70a214abfd5..00000000000
--- a/src/renderer/src/components/terminal-pane/terminal-pane-listener-order-parity.test.ts
+++ /dev/null
@@ -1,94 +0,0 @@
-import { createHash } from 'node:crypto'
-import { readFileSync, readdirSync } from 'node:fs'
-import { join } from 'node:path'
-// TypeScript 7 is a native CLI; AST tests still need the legacy JavaScript API.
-import ts from 'typescript-api'
-import { describe, expect, it } from 'vitest'
-
-const LISTENER_SOURCE_PATTERN =
-  /^(?:TerminalPane\.tsx|terminal-pane-paste-listeners\.ts|use-terminal-pane-(?:chat-state|close-actions|context-actions|controller|foundation|global-listeners|layout-bindings|layout-persistence|lifecycle-stage|mobile-actions|paste-listeners|projection|reconciliation|startup-actions|store-bindings|title-effects|title-state)\.ts)$/
-const PRE_REFACTOR_LISTENER_ORDER_SHA256 =
-  '2a2c5caaa368636d761ec819a7858f6b8010e578ccdd5c1be5960f87968c7e8a'
-
-type FunctionDefinition = { declaration: ts.FunctionDeclaration; sourceFile: ts.SourceFile }
-
-function readDefinitions(): Map<string, FunctionDefinition> {
-  const definitions = new Map<string, FunctionDefinition>()
-  for (const relativePath of readdirSync(__dirname).filter((name) =>
-    LISTENER_SOURCE_PATTERN.test(name)
-  )) {
-    const filePath = join(__dirname, relativePath)
-    const sourceFile = ts.createSourceFile(
-      filePath,
-      readFileSync(filePath, 'utf8'),
-      ts.ScriptTarget.Latest,
-      true,
-      relativePath.endsWith('.tsx') ? ts.ScriptKind.TSX : ts.ScriptKind.TS
-    )
-    const visit = (node: ts.Node): void => {
-      if (
-        ts.isFunctionDeclaration(node) &&
-        node.name &&
-        (node.name.text === 'TerminalPane' ||
-          node.name.text === 'registerTerminalPanePasteListeners' ||
-          node.name.text.startsWith('useTerminalPane'))
-      ) {
-        definitions.set(node.name.text, { declaration: node, sourceFile })
-      }
-      ts.forEachChild(node, visit)
-    }
-    visit(sourceFile)
-  }
-  return definitions
-}
-
-function readFlattenedListeners(): string[] {
-  const definitions = readDefinitions()
-  const listeners: string[] = []
-  const visitDefinition = (name: string, active: ReadonlySet<string>): void => {
-    const definition = definitions.get(name)
-    if (!definition?.declaration.body) {
-      throw new Error(`Missing terminal pane stage: ${name}`)
-    }
-    if (active.has(name)) {
-      throw new Error(`Recursive terminal pane stage: ${name}`)
-    }
-    const nextActive = new Set([...active, name])
-    const visit = (node: ts.Node): void => {
-      if (ts.isCallExpression(node)) {
-        if (
-          ts.isPropertyAccessExpression(node.expression) &&
-          ['addEventListener', 'removeEventListener'].includes(node.expression.name.text)
-        ) {
-          listeners.push(
-            [
-              node.expression.expression.getText(definition.sourceFile),
-              node.expression.name.text,
-              ...node.arguments.map((argument) =>
-                argument.getText(definition.sourceFile).replace(/\s+/g, '')
-              )
-            ].join('|')
-          )
-        }
-        if (ts.isIdentifier(node.expression) && definitions.has(node.expression.text)) {
-          visitDefinition(node.expression.text, nextActive)
-        }
-      }
-      ts.forEachChild(node, visit)
-    }
-    visit(definition.declaration.body)
-  }
-
-  visitDefinition('TerminalPane', new Set())
-  return listeners
-}
-
-describe('TerminalPane refactor listener parity', () => {
-  it('preserves ordered listener registration and cleanup', () => {
-    const listeners = readFlattenedListeners()
-    expect(listeners).toHaveLength(24)
-    expect(createHash('sha256').update(listeners.join('\n')).digest('hex')).toBe(
-      PRE_REFACTOR_LISTENER_ORDER_SHA256
-    )
-  })
-})
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-menu-paste.ts b/src/renderer/src/components/terminal-pane/terminal-pane-menu-paste.ts
index 295b7e35c53..b27900d2097 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pane-menu-paste.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-menu-paste.ts
@@ -89,7 +89,7 @@ export const executeTerminalPaneMenuPasteText = async (
   const execution = await executeTerminalPastePlan(plan, {
     pasteText: (pasteText, pasteOptions) =>
       pasteTerminalText(pane.terminal, pasteText, pasteOptions),
-    writePty: (data) => writeTerminalPastePtyInput(transport, data),
+    writePty: (data) => writeTerminalPastePtyInput(transport, data, 'driving'),
     isTargetCurrent: () => isPanePasteTargetMounted(context, pane, transport, ptyId),
     canContinue: () => isPanePasteTargetMounted(context, pane, transport, ptyId)
   })
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-pane-input.ts b/src/renderer/src/components/terminal-pane/terminal-pane-pane-input.ts
index b639d3b6ef8..32ee2639029 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pane-pane-input.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-pane-input.ts
@@ -30,10 +30,9 @@ import {
 } from './xterm-bypass-policy'
 import { markTerminalPinnedViewport } from '@/lib/pane-manager/terminal-scroll-intent'
 import { syncTerminalScrollIntentSoon } from '@/lib/pane-manager/terminal-scroll-intent-settle'
-import { resetTerminalKeyboardProtocolAfterInterrupt } from './terminal-pane-lifecycle-primitives'
 
 type PaneInputContext = {
-  pane: ManagedPane
+  pane: Pick<ManagedPane, 'id' | 'terminal'>
   managerRef: React.RefObject<PaneManager | null>
   paneKittyKeyboardModesRef: UseTerminalPaneLifecycleDeps['paneKittyKeyboardModesRef']
   settingsRef: React.RefObject<Record<string, unknown> | null | undefined>
@@ -141,7 +140,6 @@ export function installTerminalPaneInputHandling(context: PaneInputContext): voi
       if (event.type === 'keydown') {
         pendingTerminalInterruptKeyup = true
         pane.terminal.input(TERMINAL_INTERRUPT_INPUT)
-        resetTerminalKeyboardProtocolAfterInterrupt(pane.terminal)
       } else {
         pendingTerminalInterruptKeyup = false
       }
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-paste-execution.ts b/src/renderer/src/components/terminal-pane/terminal-pane-paste-execution.ts
index e436bd2cc6a..309c42dc18d 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pane-paste-execution.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-paste-execution.ts
@@ -93,7 +93,7 @@ export function createTerminalPanePasteExecution(
     const execution = await executeTerminalPastePlan(plan, {
       pasteText: (pasteText, pasteOptions) =>
         pasteTerminalText(pane.terminal, pasteText, pasteOptions),
-      writePty: (data) => writeTerminalPastePtyInput(transport, data),
+      writePty: (data) => writeTerminalPastePtyInput(transport, data, 'driving'),
       isTargetCurrent: () => {
         if (!isPanePasteTargetMounted(pane, transport, ptyId)) {
           return false
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-quick-command-initialization.test.ts b/src/renderer/src/components/terminal-pane/terminal-pane-quick-command-initialization.test.ts
new file mode 100644
index 00000000000..b64f7583160
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-quick-command-initialization.test.ts
@@ -0,0 +1,23 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+describe('TerminalPane quick-command initialization', () => {
+  it('defers quick-command host work until the context menu opens', () => {
+    const startupSource = readFileSync(
+      join(__dirname, 'use-terminal-pane-startup-actions.ts'),
+      'utf8'
+    )
+    const contextSource = readFileSync(
+      join(__dirname, 'use-terminal-pane-context-actions.ts'),
+      'utf8'
+    )
+
+    expect(startupSource).toContain('const quickCommandRepoId =')
+    expect(startupSource).not.toContain('useTerminalQuickCommandHosts')
+    expect(contextSource).toContain('useTerminalQuickCommandHosts(worktreeId, contextMenu.open)')
+    expect(contextSource).toContain('terminalQuickCommandMatchesWorkspaceProject')
+    expect(contextSource).toContain('projectHostSetupProjection.setups')
+    expect(contextSource).toContain('quickCommandExecutionHostId')
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts b/src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts
index 209ac9dd5e9..8586db21e41 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts
@@ -271,6 +271,31 @@ describe('resolveTerminalTabStripDropTarget', () => {
 })
 
 describe('detachTerminalPaneToTab', () => {
+  it.each([LEAF_1, LEAF_2])('moves chat mode only with its owning leaf %s', (chatLeafId) => {
+    const store = createStore({ ...splitLayout(), chatLeafId })
+    detachTerminalPaneToTab({
+      getStore: () => store,
+      manager: {
+        getPanes: () => [{ id: 1 }, { id: 2 }],
+        getLeafId: () => LEAF_2,
+        detachPaneForExternalMove: () => true
+      },
+      persistLayoutSnapshot: vi.fn(),
+      sourcePaneId: 2,
+      sourceTabId: SOURCE_TAB_ID,
+      targetGroupId: TARGET_GROUP_ID,
+      worktreeId: WORKTREE_ID
+    })
+    const options = vi.mocked(store.createTab).mock.calls[0]?.[3]
+    expect(options?.viewMode ?? 'terminal').toBe(chatLeafId === LEAF_2 ? 'chat' : 'terminal')
+    expect(store.terminalLayoutsByTabId['tab-detached']?.chatLeafId).toBe(
+      chatLeafId === LEAF_2 ? LEAF_2 : undefined
+    )
+    expect(store.terminalLayoutsByTabId[SOURCE_TAB_ID]?.chatLeafId).toBe(
+      chatLeafId === LEAF_1 ? LEAF_1 : undefined
+    )
+  })
+
   it('creates a new terminal tab with the detached leaf layout and PTY id', () => {
     const store = createStore()
     const manager = {
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.ts b/src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.ts
index ed63e48c2a8..27c97538d2d 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.ts
@@ -140,6 +140,7 @@ export function detachTerminalPaneToTab(args: {
   )?.shellOverride
   const tab = latestStore.createTab(args.worktreeId, args.targetGroupId, sourceShellOverride, {
     activate: true,
+    ...(detachedLayout.chatLeafId ? { viewMode: 'chat' as const } : {}),
     initialPtyId: ptyId ?? undefined,
     ...(!ptyId
       ? {
diff --git a/src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.test.ts b/src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.test.ts
index 6f99c97eeaf..709d820db26 100644
--- a/src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.test.ts
@@ -1,9 +1,11 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { CrashReportBreadcrumbData } from '../../../../shared/crash-reporting'
 import {
   TERMINAL_TAB_PARK_FLIP_BURST_LIMIT,
   TERMINAL_TAB_PARK_FLIP_BURST_WINDOW_MS,
   TERMINAL_TAB_PARK_FLIP_COMMIT_COST,
   TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT,
+  TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS,
   TERMINAL_TAB_PARK_FLIP_WINDOW_MS,
   getParkVerdictUnparkPinUntilMs,
   recordParkVerdictFlips,
@@ -11,11 +13,19 @@ import {
   type ParkVerdictFlipRecord
 } from './terminal-park-verdict-flip-telemetry'
 
-const recordBreadcrumb = vi.fn()
+const recordBreadcrumb = vi.fn<(name: string, data?: CrashReportBreadcrumbData) => void>()
 vi.mock('@/lib/crash-breadcrumb-recorder', () => ({
-  recordRendererCrashBreadcrumb: (name: string, data?: unknown) => recordBreadcrumb(name, data)
+  recordRendererCrashBreadcrumb: (name: string, data?: CrashReportBreadcrumbData) =>
+    recordBreadcrumb(name, data)
 }))
 
+function pinDuration(data?: CrashReportBreadcrumbData): number {
+  if (typeof data?.pinnedForMs !== 'number') {
+    throw new Error('Missing numeric pin duration')
+  }
+  return data.pinnedForMs
+}
+
 const TAB = 'tab-1'
 /** Slower than the burst window, so only the notice limit can fire. */
 const SLOW_CHURN_STEP_MS = TERMINAL_TAB_PARK_FLIP_BURST_WINDOW_MS * 4
@@ -112,15 +122,373 @@ describe('recordParkVerdictFlips', () => {
     )
   })
 
-  // Why: slow churn must not be damped — parking it out for a minute would cost
-  // a mounted pane's memory for a verdict that was never near React's bail.
-  it('does not pin churn spread past the burst window', () => {
+  // Why this replaced "does not pin churn spread past the burst window": that
+  // rule read the pin as purely a React #185 guard, so slow churn was left to
+  // run rather than spend a mounted pane's memory on it. The field disagreed —
+  // slow churn remounts the pane every ~3.8s for as long as it lasts, and a
+  // remount re-establishes a remote terminal. Memory is the cheaper side.
+  it('pins churn that is too slow to burst but reaches the notice limit', () => {
     const records = new Map<string, ParkVerdictFlipRecord>()
     for (let i = 0; i < TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT + 1; i += 1) {
       observe({ records, parked: i % 2 === 0, nowMs: 1_000 + i * SLOW_CHURN_STEP_MS })
     }
 
-    expect(records.get(TAB)?.pinnedUntilMs ?? null).toBeNull()
+    const noticeMs = 1_000 + TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT * SLOW_CHURN_STEP_MS
+    expect(records.get(TAB)?.pinnedUntilMs).toBe(noticeMs + TERMINAL_TAB_PARK_FLIP_WINDOW_MS)
+    expect(recordBreadcrumb).toHaveBeenCalledWith(
+      'terminal_park_verdict_churn',
+      expect.objectContaining({
+        trigger: 'window',
+        pinnedForMs: TERMINAL_TAB_PARK_FLIP_WINDOW_MS,
+        sustainedPinCount: 1
+      })
+    )
+  })
+
+  // Why these cadences and not round numbers: they are the field's. Bundle
+  // Nz4kzIG_NwLd8KObgjJDKA (v1.4.201, win32) carries 52 churn crumbs, and they
+  // are TWO unrelated episodes in two launches, not one run:
+  //   L3 (09-14 00:53) 35 crumbs, 1 tab, 46.9 min, 34 window + 1 burst
+  //   L4 (09-14 17:07) 17 crumbs, 4 tabs,  8.9 min, 17 window + 0 burst
+  // The user filed from L4, 12.3 min after its churn had already stopped.
+  //
+  // Per-flip cadence is elapsedMs / (NOTICE_LIMIT - 1), NOT / NOTICE_LIMIT: the
+  // window opens ON a flip (resetFlipWindows then `flips += 1`), so the 12th
+  // flip sits 11 intervals later. L3 runs 3197/4627/5442 ms per flip
+  // (min/median/max); L4 runs 3193/3203/5014.
+  //
+  // The slow end is where this matters. The limit needs 12 flips inside 60s, so
+  // it is unreachable past 60s/11 = 5454.5 ms per flip — and the field's slowest
+  // observed episode sits 12.7 ms inside that, not comfortably clear of it. The
+  // cadences below therefore span the real range INCLUDING that edge, and the
+  // edge case asserts the weaker damping that actually happens there.
+  describe('sustained field-cadence churn', () => {
+    const FIELD_FLIP_INTERVAL_MS = 4_627
+    const FIELD_SLOWEST_FLIP_INTERVAL_MS = 5_442
+    const FIELD_CHURN_DURATION_MS = 47 * 60_000
+
+    // Fixed duration rather than a fixed flip count, so every cadence covers
+    // the same 47 minutes the field bundle spans and the crumb budget compares.
+    function runFieldChurn(stepMs = FIELD_FLIP_INTERVAL_MS): {
+      flips: number
+      pinnedPasses: number
+      crumbs: number
+    } {
+      const records = new Map<string, ParkVerdictFlipRecord>()
+      const flips = Math.ceil(FIELD_CHURN_DURATION_MS / stepMs)
+      let pinnedPasses = 0
+      for (let i = 0; i < flips; i += 1) {
+        const nowMs = 1_000 + i * stepMs
+        observe({ records, parked: i % 2 === 0, nowMs })
+        const { pinnedTabIds } = selectParkVerdictPinnedTabIds({
+          records,
+          tabIds: [TAB],
+          nowMs
+        })
+        if (pinnedTabIds.size > 0) {
+          pinnedPasses += 1
+        }
+      }
+      return {
+        flips,
+        pinnedPasses,
+        crumbs: recordBreadcrumb.mock.calls.filter(
+          (call) => call[0] === 'terminal_park_verdict_churn'
+        ).length
+      }
+    }
+
+    // Two harnesses, and the difference between them matters.
+    //
+    // This one is OPEN-LOOP: it drives the parked flag unconditionally. The real
+    // hook subtracts pinned tabs from the rendered verdict, so a pinned tab
+    // records no flip at all — and engaging the pin is itself a transition, so a
+    // flip lands INSIDE the live pin. Three successive defects in this file were
+    // invisible here and visible the moment the pin was fed back. Keep it as a
+    // cheap regression guard; read 'keeps the back-off when the pin engagement
+    // is itself a flip' for behaviour.
+    //
+    // The user-visible quantity is verdict transitions — two per mount/unmount
+    // cycle — measured over 47 simulated minutes with the pin applied in the
+    // same commit cascade as the flip that caused it:
+    //
+    //   per flip   transitions before -> after   ceiling reached
+    //   3193 ms    884 -> 96   (9.2x fewer)      8x
+    //   4627 ms    610 -> 96   (6.4x fewer)      8x
+    //   4800 ms    588 -> 96   (6.1x fewer)      8x
+    //   5000 ms    564 -> 126  (4.5x fewer)      8x
+    //   5442 ms    519 -> 156  (3.3x fewer)      8x
+    //
+    // The slow end is weaker but no longer collapses: reaching 12 flips takes 11
+    // intervals, so past ~4.7s per flip each window only barely makes the limit
+    // and damping engages later. It still reaches the ceiling everywhere.
+    it.each([
+      ['fastest observed', 3_193, 0.5],
+      ['median', FIELD_FLIP_INTERVAL_MS, 0.5],
+      ['slowest observed', FIELD_SLOWEST_FLIP_INTERVAL_MS, 0.4]
+    ])('damps %s field churn instead of letting it run all session', (_label, stepMs, floor) => {
+      const { flips, pinnedPasses, crumbs } = runFieldChurn(stepMs)
+
+      expect(pinnedPasses).toBeGreaterThan(flips * floor)
+      expect(crumbs).toBeLessThan(20)
+    })
+
+    // Why this asserts the gap rather than closing it: reaching the notice
+    // limit takes NOTICE_LIMIT - 1 intervals, so churn averaging slower than
+    // 60s/11 = 5454.5ms per flip never reaches it and stays undamped — before
+    // this change and after, which is why the crumb count is 0 rather than 43.
+    // The edge is sharp: this harness pins 60% of passes at 5450ms and 0% at
+    // 5460ms. Closing the gap means widening the window, which would also
+    // re-arm the pin on honest parking — that round-trips on the order of
+    // minutes.
+    //
+    // The field is NOT comfortably clear of this: its slowest observed episode
+    // runs 5441.8ms per flip, 12.7ms inside the edge. Churn a hair slower than
+    // anything yet observed would evade the damper entirely. Recorded so a
+    // later change to either constant cannot move the edge unnoticed.
+    it('leaves churn slower than the window undamped', () => {
+      const tooSlowMs =
+        Math.ceil(TERMINAL_TAB_PARK_FLIP_WINDOW_MS / (TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT - 1)) + 1
+      const { pinnedPasses, crumbs } = runFieldChurn(tooSlowMs)
+
+      expect(pinnedPasses).toBe(0)
+      expect(crumbs).toBe(0)
+    })
+
+    it('backs the pin off to the ceiling while the churn persists', () => {
+      const records = new Map<string, ParkVerdictFlipRecord>()
+      const flips = Math.ceil(FIELD_CHURN_DURATION_MS / FIELD_FLIP_INTERVAL_MS)
+      for (let i = 0; i < flips; i += 1) {
+        observe({ records, parked: i % 2 === 0, nowMs: 1_000 + i * FIELD_FLIP_INTERVAL_MS })
+      }
+
+      const pinnedForMs = recordBreadcrumb.mock.calls
+        .filter((call) => call[0] === 'terminal_park_verdict_churn')
+        .map((call) => pinDuration(call[1]))
+      expect(pinnedForMs[0]).toBe(TERMINAL_TAB_PARK_FLIP_WINDOW_MS)
+      expect(pinnedForMs.at(-1)).toBe(TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS)
+    })
+
+    // Why this drives the loop the way useTerminalParkVerdictPin does — record
+    // first, then subtract the pinned set from the NEXT pass's verdict — and
+    // why every other test here must not: with the pin fed back, a pinned tab
+    // records no flip at all, and that is the state the back-off has to survive.
+    // The open-loop harness above cannot see it, and shipped a fix whose
+    // exponential back-off never left 1x in production: the quiet-branch reset
+    // measured staleness from windowStartMs, which a pin always makes older
+    // than a full window, so every lapse wiped the count.
+    function runClosedLoopChurn(stepMs: number, durationMs = 20 * 60_000) {
+      const records = new Map<string, ParkVerdictFlipRecord>()
+      const passes = Math.ceil(durationMs / stepMs)
+      let pinned = new Set<string>()
+      let remounts = 0
+      let previouslyParked = false
+      for (let i = 0; i < passes; i += 1) {
+        const nowMs = 1_000 + i * stepMs
+        const candidateParked = i % 2 === 0
+        const renderedParked = candidateParked && !pinned.has(TAB)
+        recordParkVerdictFlips({
+          records,
+          liveTabIds: new Set([TAB]),
+          nextParkedTabIds: new Set(renderedParked ? [TAB] : []),
+          nowMs
+        })
+        pinned = selectParkVerdictPinnedTabIds({ records, tabIds: [TAB], nowMs }).pinnedTabIds
+        if (renderedParked !== previouslyParked) {
+          remounts += 1
+          previouslyParked = renderedParked
+        }
+      }
+      const crumbs = recordBreadcrumb.mock.calls.filter(
+        (call) => call[0] === 'terminal_park_verdict_churn'
+      )
+      return {
+        remounts,
+        crumbs: crumbs.length,
+        pinnedForMs: crumbs.map((call) => pinDuration(call[1]))
+      }
+    }
+
+    it('reaches the ceiling under the real pin feedback loop', () => {
+      const { pinnedForMs } = runClosedLoopChurn(FIELD_FLIP_INTERVAL_MS)
+
+      // The whole sequence, not just its ends: a base-8 back-off, or a reset
+      // that fires one window early, both pass an ends-only assertion.
+      expect(pinnedForMs.length).toBeGreaterThan(3)
+      expect(pinnedForMs.slice(0, 4)).toEqual([
+        TERMINAL_TAB_PARK_FLIP_WINDOW_MS,
+        TERMINAL_TAB_PARK_FLIP_WINDOW_MS * 2,
+        TERMINAL_TAB_PARK_FLIP_WINDOW_MS * 4,
+        TERMINAL_TAB_PARK_FLIP_WINDOW_MS * 8
+      ])
+      expect(pinnedForMs.at(-1)).toBe(TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS)
+    })
+
+    // The user-visible quantity. Every flip that survives the pin is one pane
+    // remount; the percentages elsewhere are a pin duty cycle, not this.
+    it('cuts remounts against the undamped baseline', () => {
+      const { remounts, crumbs } = runClosedLoopChurn(FIELD_FLIP_INTERVAL_MS)
+
+      // Undamped, 20 min at 4627ms/flip is 260 remounts and 20 crumbs.
+      expect(remounts).toBeLessThan(80)
+      expect(crumbs).toBeLessThan(10)
+    })
+
+    // Why this drives the pin into the SAME pass that records the flip: engaging
+    // the pin is itself a rendered verdict transition — the hook drops the tab
+    // from the parked set and the effect re-runs on the changed dep — so a flip
+    // lands while the pin is live. That flip used to overwrite the pin deadline
+    // with the current time, and the back-off then cleared one window later
+    // rather than one window after the pin ended.
+    //
+    // It also kills `easedFlipCount -> noticeLimit`, which is behaviourally the
+    // revision this one replaced and which the open-loop tests cannot see.
+    it('keeps the back-off when the pin engagement is itself a flip', () => {
+      const records = new Map<string, ParkVerdictFlipRecord>()
+      const stepMs = 5_000
+      let pinned = new Set<string>()
+      for (let i = 0; i < 400; i += 1) {
+        const nowMs = 1_000 + i * stepMs
+        const candidateParked = i % 2 === 0
+        recordParkVerdictFlips({
+          records,
+          liveTabIds: new Set([TAB]),
+          nextParkedTabIds: new Set(candidateParked && !pinned.has(TAB) ? [TAB] : []),
+          nowMs
+        })
+        pinned = selectParkVerdictPinnedTabIds({ records, tabIds: [TAB], nowMs }).pinnedTabIds
+        // The re-render the pin itself causes, in the same commit cascade.
+        recordParkVerdictFlips({
+          records,
+          liveTabIds: new Set([TAB]),
+          nextParkedTabIds: new Set(candidateParked && !pinned.has(TAB) ? [TAB] : []),
+          nowMs
+        })
+      }
+
+      const pinnedForMs = recordBreadcrumb.mock.calls
+        .filter((call) => call[0] === 'terminal_park_verdict_churn')
+        .map((call) => pinDuration(call[1]))
+      expect(Math.max(...pinnedForMs)).toBe(TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS)
+    })
+
+    // Why: the back-off must not accumulate across episodes that are not
+    // consecutive. Four isolated 12-flip episodes six hours apart previously
+    // reached the 8-minute ceiling, because the flip path's reset was gated on
+    // `flips < noticeLimit` and the notice path leaves `flips` at exactly
+    // noticeLimit — so a window reopening after hours of silence did not reset.
+    // Each episode resumes ON a flip, so nothing lands in the quiet branch.
+    it('does not accumulate across episodes hours apart', () => {
+      const records = new Map<string, ParkVerdictFlipRecord>()
+      let nowMs = 1_000
+      let parked = false
+      for (let episode = 0; episode < 4; episode += 1) {
+        for (let i = 0; i <= TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT; i += 1) {
+          parked = !parked
+          observe({ records, parked, nowMs })
+          nowMs += SLOW_CHURN_STEP_MS
+        }
+        nowMs += 6 * 60 * 60 * 1_000
+      }
+
+      const pinnedForMs = recordBreadcrumb.mock.calls
+        .filter((call) => call[0] === 'terminal_park_verdict_churn')
+        .map((call) => pinDuration(call[1]))
+      expect(pinnedForMs).toHaveLength(4)
+      expect(pinnedForMs.every((ms) => ms === TERMINAL_TAB_PARK_FLIP_WINDOW_MS)).toBe(true)
+    })
+
+    // Why this range and not one cadence: past roughly 4.7s per flip a lapsing
+    // pin pushes the next window out of alignment so it closes at 11 of 12.
+    // Gating the reset on `flips < noticeLimit` read that as the churn easing
+    // and reset the back-off every cycle, leaving it stuck at 1x across the
+    // slower half of the field's own observed range — the half where damping is
+    // weakest to begin with. The back-off must still climb there.
+    it.each([4_800, 5_000, FIELD_SLOWEST_FLIP_INTERVAL_MS])(
+      'still backs off above the alignment cliff at %ims per flip',
+      (stepMs) => {
+        runFieldChurn(stepMs)
+
+        const pinnedForMs = recordBreadcrumb.mock.calls
+          .filter((call) => call[0] === 'terminal_park_verdict_churn')
+          .map((call) => pinDuration(call[1]))
+        expect(Math.max(...pinnedForMs)).toBeGreaterThan(TERMINAL_TAB_PARK_FLIP_WINDOW_MS)
+      }
+    )
+
+    // Why: without this the back-off is a ratchet — a tab that churned once at
+    // launch would still be carrying an 8-minute pin hours later.
+    it('starts over at one window after a quiet window', () => {
+      const records = new Map<string, ParkVerdictFlipRecord>()
+      for (let i = 0; i < TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT + 1; i += 1) {
+        observe({ records, parked: i % 2 === 0, nowMs: 1_000 + i * SLOW_CHURN_STEP_MS })
+      }
+      expect(records.get(TAB)?.sustainedPinCount).toBe(1)
+
+      const quietMs = 1_000 + TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS * 4
+      observe({ records, parked: true, nowMs: quietMs })
+      expect(records.get(TAB)?.sustainedPinCount).toBe(0)
+
+      recordBreadcrumb.mockClear()
+      for (let i = 1; i <= TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT; i += 1) {
+        observe({ records, parked: i % 2 === 0, nowMs: quietMs + i * SLOW_CHURN_STEP_MS })
+      }
+      expect(recordBreadcrumb).toHaveBeenCalledWith(
+        'terminal_park_verdict_churn',
+        expect.objectContaining({
+          pinnedForMs: TERMINAL_TAB_PARK_FLIP_WINDOW_MS,
+          sustainedPinCount: 1
+        })
+      )
+    })
+  })
+
+  // Why this is NOT the test that covers the below-limit reset: its gap is also
+  // a full quiet window, so the quiet disjunct alone satisfies it and deleting
+  // the below-limit clause stays invisible here. The sparse-churn test below is
+  // the one that distinguishes them; this one only pins that a reset exists.
+  it('clears the back-off when a window closes below the notice limit', () => {
+    const records = new Map<string, ParkVerdictFlipRecord>()
+    for (let i = 0; i < TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT + 1; i += 1) {
+      observe({ records, parked: i % 2 === 0, nowMs: 1_000 + i * SLOW_CHURN_STEP_MS })
+    }
+    expect(records.get(TAB)?.sustainedPinCount).toBe(1)
+
+    // One flip, a full window later: the window closes holding far fewer than
+    // the notice limit, which is the only proof the churn actually stopped.
+    const nextWindowMs = 1_000 + TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS * 2
+    observe({ records, parked: false, nowMs: nextWindowMs })
+    observe({ records, parked: true, nowMs: nextWindowMs + TERMINAL_TAB_PARK_FLIP_WINDOW_MS + 1 })
+
+    expect(records.get(TAB)?.sustainedPinCount).toBe(0)
+  })
+
+  // Why this shape and not a quiet gap: it is the only one that separates the
+  // two reset conditions. One flip every 20s is three per window — below the
+  // eased threshold, so the below-limit clause fires — while the last flip is
+  // never a full window old, so the quiet clause never does. Without the
+  // below-limit clause the back-off stays armed indefinitely under churn that
+  // has demonstrably eased, and the next notice pins for the ceiling rather
+  // than one window. Four mutations of that clause survived every other test.
+  it('clears the back-off under churn that eased but never stopped', () => {
+    const records = new Map<string, ParkVerdictFlipRecord>()
+    let nowMs = 1_000
+    let parked = false
+    for (let i = 0; i <= TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT; i += 1) {
+      parked = !parked
+      observe({ records, parked, nowMs })
+      nowMs += SLOW_CHURN_STEP_MS
+    }
+    expect(records.get(TAB)?.sustainedPinCount).toBe(1)
+
+    nowMs = (records.get(TAB)?.pinnedUntilMs ?? nowMs) + 1_000
+    for (let i = 0; i < 12; i += 1) {
+      parked = !parked
+      observe({ records, parked, nowMs })
+      nowMs += 20_000
+    }
+
+    expect(records.get(TAB)?.sustainedPinCount).toBe(0)
   })
 
   it('re-arms after the window elapses', () => {
diff --git a/src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.ts b/src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.ts
index aee6c2d744a..a7482ab94c8 100644
--- a/src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.ts
@@ -1,7 +1,20 @@
 /**
  * Cold-park verdict telemetry and a safe-side circuit breaker.
  * Field breadcrumbs prove render-cadence flips, but not which eligibility input
- * oscillates; burst damping keeps the pane mounted before React reaches #185.
+ * oscillates; damping keeps the pane mounted rather than let it cycle.
+ *
+ * Two horizons, because churn harms in two ways: a burst reaches React's commit
+ * bail (#185), while churn merely sustained remounts the pane over and over.
+ * A remount does not reconnect a terminal — parking deliberately keeps the PTY
+ * alive (see terminal-parked-tab-watchers), SSH restores from main's snapshot,
+ * and a remote runtime re-subscribes a stream on a per-environment multiplexer
+ * that outlives the pane. What it costs is a remount each time, indefinitely.
+ * Retention force-parks bypass sustained pins; burst protection still applies.
+ *
+ * What this is NOT: a fix for whatever keeps re-proposing the park. That input
+ * is still unidentified, so this caps the remount rate of an oscillation rather
+ * than ending it — the pin masks the rendered verdict, and the driver resumes
+ * the moment each pin lapses.
  *
  * Scope: flips are counted on the rendered verdict and the pin subtracts from
  * that same verdict (selectParkVerdictPinnedTabIds), so churn driven by any
@@ -14,8 +27,18 @@ import { recordRendererCrashBreadcrumb } from '@/lib/crash-breadcrumb-recorder'
 import { REACT_NESTED_UPDATE_LIMIT } from '../../../../shared/react-update-depth-attribution'
 
 export const TERMINAL_TAB_PARK_FLIP_WINDOW_MS = 60_000
-/** Flips per window that no sane park policy should reach. Breadcrumb only. */
+/** Flips per window that no sane park policy should reach. */
 export const TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT = 12
+/**
+ * Ceiling for the sustained-churn pin. Each consecutive notice-limit window
+ * doubles the pin, so a verdict that cannot settle is re-proposed on the order
+ * of minutes instead of every ~45s. A tab restarts at 1x once it has been quiet
+ * for a full window past its pin deadline — so roughly nine minutes of real
+ * silence at the ceiling, not one window. See lastFlipMs.
+ *
+ * Only sustained churn backs off; burst protection keeps its one-window pin.
+ */
+export const TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS = 8 * TERMINAL_TAB_PARK_FLIP_WINDOW_MS
 
 /** Measured upper bound after the passive-effect pin engages. */
 const PARK_PIN_SETTLE_COMMITS = 6
@@ -38,8 +61,26 @@ export type ParkVerdictFlipRecord = {
   notified: boolean
   burstStartMs: number
   burstFlips: number
-  /** Set when a flip burst engaged damping; the verdict stays unparked until then. */
+  /** Set when flip churn engaged damping; the verdict stays unparked until then. */
   pinnedUntilMs?: number | null
+  pinTrigger?: 'burst' | 'window'
+  /** Consecutive notice-limit windows; backs the pin off for churn that persists. */
+  sustainedPinCount?: number
+  /**
+   * When this tab was last active: a flip, or the deadline of a pin that was
+   * suppressing flips, whichever is later. The back-off clears a full window
+   * after that.
+   *
+   * Why a pin counts as activity: while pinned the hook subtracts the tab from
+   * the rendered verdict, so no flip can be recorded. Without this, the first
+   * idle pass after a long pin lapsed saw a flip timestamp up to eight minutes
+   * old and cleared the back-off that the pin had just earned.
+   *
+   * Consequence worth stating: "quiet for one window" is therefore measured from
+   * the PIN DEADLINE, so a tab at the 8-minute ceiling needs about nine minutes
+   * of real silence before the back-off clears, not one.
+   */
+  lastFlipMs: number
 }
 
 // Why it leaves pinnedUntilMs alone: the notice window is 60s from the first
@@ -52,6 +93,37 @@ function resetFlipWindows(record: ParkVerdictFlipRecord, nowMs: number): void {
   record.burstFlips = 0
 }
 
+/**
+ * Whether the tab has genuinely gone quiet: a full window with no flip recorded,
+ * counting from the last one or from the pin deadline, whichever is later.
+ *
+ * Why not `nowMs - windowStartMs`: on the flip path that is a tautology, because
+ * the branch that would consult it only runs once the window is already a window
+ * old. And while a tab is pinned the hook subtracts it from the rendered verdict,
+ * so no flip is recorded and `windowStartMs` does not advance either — measuring
+ * from it reads continuous churn as quiet in both directions.
+ */
+function hasBeenQuietForAWindow(
+  record: ParkVerdictFlipRecord,
+  nowMs: number,
+  flipWindowMs: number
+): boolean {
+  return nowMs - record.lastFlipMs >= flipWindowMs
+}
+
+/**
+ * Flips in a closing window below which the churn has genuinely eased.
+ *
+ * Why half and not the notice limit itself: past ~4.7s per flip a lapsing pin
+ * pushes the next window out of alignment, so it closes at 11 of 12 while the
+ * churn has not slowed at all. Treating that as "eased" reset the back-off on
+ * every cycle and left it stuck at 1x across the slower half of the field's own
+ * cadence range — the half where it is needed most.
+ */
+function easedFlipCount(noticeLimit: number): number {
+  return Math.ceil(noticeLimit / 2)
+}
+
 // Why liveness and not presence: a tab pinned while cold-park-eligible can stop
 // being a candidate before its deadline, and nothing would consult it again. An
 // expired pin must stop damping and stop gating breadcrumbs on its own.
@@ -72,6 +144,7 @@ export function getParkVerdictUnparkPinUntilMs(args: {
   if (!isParkVerdictPinLive(record, args.nowMs) || args.nowMs < record.windowStartMs) {
     resetFlipWindows(record, args.nowMs)
     record.pinnedUntilMs = null
+    record.pinTrigger = undefined
     return null
   }
   return record.pinnedUntilMs
@@ -87,6 +160,8 @@ export function recordParkVerdictFlips(args: {
   noticeLimit?: number
   burstWindowMs?: number
   burstLimit?: number
+  sustainedPinMaxMs?: number
+  allowSustainedPin?: boolean
 }): void {
   const {
     records,
@@ -96,7 +171,9 @@ export function recordParkVerdictFlips(args: {
     flipWindowMs = TERMINAL_TAB_PARK_FLIP_WINDOW_MS,
     noticeLimit = TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT,
     burstWindowMs = TERMINAL_TAB_PARK_FLIP_BURST_WINDOW_MS,
-    burstLimit = TERMINAL_TAB_PARK_FLIP_BURST_LIMIT
+    burstLimit = TERMINAL_TAB_PARK_FLIP_BURST_LIMIT,
+    sustainedPinMaxMs = TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS,
+    allowSustainedPin = true
   } = args
 
   for (const tabId of Array.from(records.keys())) {
@@ -117,11 +194,30 @@ export function recordParkVerdictFlips(args: {
         notified: false,
         burstStartMs: nowMs,
         burstFlips: 0,
-        pinnedUntilMs: null
+        pinnedUntilMs: null,
+        lastFlipMs: nowMs
       })
       continue
     }
+    // Retention eviction must also release pins earned before the force-park.
+    if (!allowSustainedPin && record.pinTrigger === 'window') {
+      resetFlipWindows(record, nowMs)
+      record.pinnedUntilMs = null
+      record.pinTrigger = undefined
+      record.sustainedPinCount = 0
+      record.lastFlipMs = nowMs
+    }
     if (parked === record.parked) {
+      // Why the back-off clears here and not only on a flip: churn stopping
+      // looks like no flips at all, so a flip-gated reset would ratchet — a tab
+      // that churned once at launch would still carry a ceiling pin hours on.
+      //
+      // Why no isParkVerdictPinLive check: a live pin puts lastFlipMs in the
+      // future, so the window test already fails. Asserting it too reads as the
+      // guard protecting this invariant when it is not.
+      if (record.sustainedPinCount && hasBeenQuietForAWindow(record, nowMs, flipWindowMs)) {
+        record.sustainedPinCount = 0
+      }
       continue
     }
 
@@ -129,6 +225,20 @@ export function recordParkVerdictFlips(args: {
     // elapsed value as a fresh window rather than trusting the delta.
     const elapsedMs = nowMs - record.windowStartMs
     if (elapsedMs >= flipWindowMs || elapsedMs < 0) {
+      // Why quiet and not `flips < noticeLimit`: a window closing below the limit
+      // is not proof the churn stopped. Past ~4.7s per flip the pin lapse pushes
+      // the next window out of alignment so it closes at 11, and that false
+      // signal reset the count on every cycle — leaving the back-off stuck at 1x
+      // for the slower half of the field's own cadence range, which is where it
+      // is needed most. It also failed in the other direction: `flips` is left at
+      // exactly noticeLimit by the notice path, so a window reopening after hours
+      // of silence did NOT reset, and isolated episodes ratcheted to the ceiling.
+      if (
+        record.flips < easedFlipCount(noticeLimit) ||
+        hasBeenQuietForAWindow(record, nowMs, flipWindowMs)
+      ) {
+        record.sustainedPinCount = 0
+      }
       resetFlipWindows(record, nowMs)
     }
     const burstElapsedMs = nowMs - record.burstStartMs
@@ -140,9 +250,19 @@ export function recordParkVerdictFlips(args: {
     record.parked = parked
     record.flips += 1
     record.burstFlips += 1
+    // Why the max and not a bare assignment: engaging the pin IS a rendered
+    // verdict transition — the hook drops the tab from the parked set, the
+    // effect re-runs on the changed dep, and that flip lands while the pin is
+    // live. A bare assignment overwrote the future deadline with the current
+    // time, so the quiet branch cleared the back-off one window later instead of
+    // one window after the pin ended, defeating this mechanism at exactly the
+    // slow cadences it exists for.
+    record.lastFlipMs = Math.max(nowMs, record.pinnedUntilMs ?? 0)
 
     if (!isParkVerdictPinLive(record, nowMs) && record.burstFlips >= burstLimit) {
       record.pinnedUntilMs = nowMs + flipWindowMs
+      record.pinTrigger = 'burst'
+      record.lastFlipMs = record.pinnedUntilMs
       recordRendererCrashBreadcrumb('terminal_park_verdict_churn', {
         tabId,
         trigger: 'burst',
@@ -158,6 +278,20 @@ export function recordParkVerdictFlips(args: {
     // exists to keep down.
     if (!isParkVerdictPinLive(record, nowMs) && !record.notified && record.flips >= noticeLimit) {
       record.notified = true
+      // Why this pins too: the burst window only catches churn fast enough to
+      // reach React's commit bail. Churn one flip every ~3-5s never bursts, so
+      // it used to run unbounded — 47min in one field launch, 9min in another.
+      // Each remount is user-visible, so the notice limit damps on its own.
+      let pinData: { pinnedForMs: number; sustainedPinCount: number } | undefined
+      if (allowSustainedPin) {
+        const sustainedPinCount = (record.sustainedPinCount ?? 0) + 1
+        const pinnedForMs = Math.min(flipWindowMs * 2 ** (sustainedPinCount - 1), sustainedPinMaxMs)
+        record.sustainedPinCount = sustainedPinCount
+        record.pinnedUntilMs = nowMs + pinnedForMs
+        record.pinTrigger = 'window'
+        record.lastFlipMs = record.pinnedUntilMs
+        pinData = { pinnedForMs, sustainedPinCount }
+      }
       // Why: flips is always exactly noticeLimit here, so elapsedMs is the only
       // field that separates slow churn from a burst the damping already caught.
       recordRendererCrashBreadcrumb('terminal_park_verdict_churn', {
@@ -165,7 +299,8 @@ export function recordParkVerdictFlips(args: {
         trigger: 'window',
         flips: record.flips,
         elapsedMs: nowMs - record.windowStartMs,
-        windowMs: flipWindowMs
+        windowMs: flipWindowMs,
+        ...pinData
       })
     }
   }
diff --git a/src/renderer/src/components/terminal-pane/terminal-parked-pty-watcher.ts b/src/renderer/src/components/terminal-pane/terminal-parked-pty-watcher.ts
index 158d03e8bb0..f70599f148c 100644
--- a/src/renderer/src/components/terminal-pane/terminal-parked-pty-watcher.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-parked-pty-watcher.ts
@@ -181,9 +181,15 @@ export function collapseParkedExitedLeaf(tabId: string, ptyId: string): void {
   const leafId =
     capturedPanesByTabId.get(tabId)?.panes.find((pane) => pane.ptyId === ptyId)?.leafId ??
     Object.entries(layout?.ptyIdsByLeafId ?? {}).find(([, boundPtyId]) => boundPtyId === ptyId)?.[0]
-  if (!leafId) {
-    return
+  if (leafId) {
+    collapseParkedTerminalLeaf(tabId, leafId, ptyId)
   }
+}
+
+/** Removes one leaf from a parked tab's stored layout; a no-op once the leaf is gone. */
+export function collapseParkedTerminalLeaf(tabId: string, leafId: string, ptyId?: string): void {
+  const state = useAppStore.getState()
+  const layout = state.terminalLayoutsByTabId[tabId]
   const detached = detachTerminalLayoutLeaf(layout, leafId)
   if (!detached) {
     return
@@ -191,7 +197,7 @@ export function collapseParkedExitedLeaf(tabId: string, ptyId: string): void {
   const terminalTab = Object.values(state.tabsByWorktree)
     .flat()
     .find((candidate) => candidate.id === tabId)
-  if (shouldClearLaunchAgentForClosedPane(terminalTab, ptyId)) {
+  if (shouldClearLaunchAgentForClosedPane(terminalTab, ptyId ?? layout?.ptyIdsByLeafId?.[leafId])) {
     state.clearTabLaunchAgent(tabId)
   }
   state.setTabLayout(tabId, detached.sourceLayout)
diff --git a/src/renderer/src/components/terminal-pane/terminal-paste-operation-order.test.ts b/src/renderer/src/components/terminal-pane/terminal-paste-operation-order.test.ts
index b36f0d06f65..f08926b2c81 100644
--- a/src/renderer/src/components/terminal-pane/terminal-paste-operation-order.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-paste-operation-order.test.ts
@@ -54,7 +54,13 @@ describe('terminal paste operation ordering', () => {
       pasteText: () => {},
       writePty,
       yieldToEventLoop: async () => {
-        startupDraft ??= sendAgentDraftPasteContent(null, 'pty-1', 'GENERATED_CONTEXT', writePty)
+        startupDraft ??= sendAgentDraftPasteContent(
+          null,
+          'pty-1',
+          'GENERATED_CONTEXT',
+          'launch',
+          writePty
+        )
       }
     })
     await startupDraft
@@ -80,6 +86,7 @@ describe('terminal paste operation ordering', () => {
       null,
       'pty-1',
       'G'.repeat(64 * 1024 + 1),
+      'launch',
       async (data) => {
         writes.push({ owner: 'startup', data })
         if (data === BRACKETED_PASTE_START) {
diff --git a/src/renderer/src/components/terminal-pane/terminal-programmatic-text-paste.ts b/src/renderer/src/components/terminal-pane/terminal-programmatic-text-paste.ts
index f92427e4729..4f3549a15ee 100644
--- a/src/renderer/src/components/terminal-pane/terminal-programmatic-text-paste.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-programmatic-text-paste.ts
@@ -66,7 +66,7 @@ export function handleTerminalProgrammaticTextPaste({
     .then((plan) =>
       executeTerminalPastePlan(plan, {
         pasteText: (text, options) => pasteTerminalText(pane.terminal, text, options),
-        writePty: (data) => writeTerminalPastePtyInput(transport, data),
+        writePty: (data) => writeTerminalPastePtyInput(transport, data, 'driving'),
         isTargetCurrent: () =>
           isTerminalPanePasteTargetCurrent({
             manager: getManager(),
diff --git a/src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.test.ts b/src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.test.ts
index e501c50402d..5a587c6acc9 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.test.ts
@@ -8,21 +8,21 @@ describe('terminal PTY paste writer', () => {
     const sendInputAccepted = vi.fn().mockResolvedValue(true)
 
     await expect(
-      writeTerminalPastePtyInput({ sendInput, sendInputAccepted }, 'payload')
+      writeTerminalPastePtyInput({ sendInput, sendInputAccepted }, 'payload', 'driving')
     ).resolves.toBe(true)
 
-    expect(sendInputAccepted).toHaveBeenCalledWith('payload')
+    expect(sendInputAccepted).toHaveBeenCalledWith('payload', 'driving')
     expect(sendInput).not.toHaveBeenCalled()
   })
 
   it('falls back to queued PTY writes when acknowledged writes are unavailable', () => {
     const sendInput = vi.fn().mockReturnValue(true)
 
-    expect(writeTerminalPastePtyInput({ sendInput }, 'payload')).toBe(true)
-    expect(sendInput).toHaveBeenCalledWith('payload')
+    expect(writeTerminalPastePtyInput({ sendInput }, 'payload', 'driving')).toBe(true)
+    expect(sendInput).toHaveBeenCalledWith('payload', 'driving')
   })
 
   it('rejects writes without a transport', () => {
-    expect(writeTerminalPastePtyInput(undefined, 'payload')).toBe(false)
+    expect(writeTerminalPastePtyInput(undefined, 'payload', 'driving')).toBe(false)
   })
 })
diff --git a/src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.ts b/src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.ts
index dd7e257615a..d1fffbc76fb 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.ts
@@ -1,15 +1,17 @@
 import type { PtyTransport } from './pty-transport'
+import type { TerminalInputKind } from '../../../../shared/terminal-input-kind'
 
 type TerminalPastePtyWriter = Pick<PtyTransport, 'sendInput' | 'sendInputAccepted'>
 
 export function writeTerminalPastePtyInput(
   transport: TerminalPastePtyWriter | undefined,
-  data: string
+  data: string,
+  inputKind: TerminalInputKind
 ): boolean | Promise<boolean> {
   if (!transport) {
     return false
   }
   // Why: paste chunking must respect PTY backpressure. sendInput only queues
   // local writes, while sendInputAccepted resolves after the PTY accepts them.
-  return transport.sendInputAccepted?.(data) ?? transport.sendInput(data)
+  return transport.sendInputAccepted?.(data, inputKind) ?? transport.sendInput(data, inputKind)
 }
diff --git a/src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.test.ts b/src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.test.ts
index 7759e8802bf..11c0449bd96 100644
--- a/src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.test.ts
@@ -40,7 +40,7 @@ describe('sendTerminalQuickCommandToPane', () => {
     })
 
     expect(sent).toBe(true)
-    expect(sendInput).toHaveBeenCalledWith('git status\r')
+    expect(sendInput).toHaveBeenCalledWith('git status\r', 'driving')
     expect(pane.terminal.focus).toHaveBeenCalledOnce()
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
   })
@@ -62,7 +62,7 @@ describe('sendTerminalQuickCommandToPane', () => {
     })
 
     expect(sent).toBe(false)
-    expect(sendInput).toHaveBeenCalledWith('npm test')
+    expect(sendInput).toHaveBeenCalledWith('npm test', 'driving')
     expect(pane.terminal.focus).not.toHaveBeenCalled()
     expect(mocks.recordTerminalUserInputForLeaf).not.toHaveBeenCalled()
   })
@@ -85,7 +85,7 @@ describe('sendTerminalQuickCommandToPane', () => {
     })
 
     expect(sent).toBe(true)
-    expect(sendInput).toHaveBeenCalledWith('cd packages; bun run build; cd ..\r')
+    expect(sendInput).toHaveBeenCalledWith('cd packages; bun run build; cd ..\r', 'driving')
     expect(pane.terminal.focus).toHaveBeenCalledOnce()
   })
 
@@ -107,7 +107,7 @@ describe('sendTerminalQuickCommandToPane', () => {
     })
 
     expect(sent).toBe(true)
-    expect(sendInput).toHaveBeenCalledWith('echo one; echo two')
+    expect(sendInput).toHaveBeenCalledWith('echo one; echo two', 'driving')
     expect(pane.terminal.focus).toHaveBeenCalledOnce()
   })
 
diff --git a/src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.ts b/src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.ts
index 39d49d02c86..5c8d3622b00 100644
--- a/src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.ts
@@ -5,6 +5,7 @@ import {
   isTerminalAgentQuickCommand
 } from '../../../../shared/terminal-quick-commands'
 import { recordTerminalUserInputForLeaf } from './terminal-input-activity'
+import type { PtyTransport } from './pty-transport-types'
 
 type QuickCommandPane = {
   leafId: string
@@ -13,9 +14,7 @@ type QuickCommandPane = {
   }
 }
 
-type QuickCommandTransport = {
-  sendInput: (data: string) => boolean
-}
+type QuickCommandTransport = Pick<PtyTransport, 'sendInput'>
 
 export function sendTerminalQuickCommandToPane({
   command,
@@ -36,7 +35,8 @@ export function sendTerminalQuickCommandToPane({
   }
 
   const sent = transport.sendInput(
-    buildTerminalQuickCommandInput(flattenTerminalQuickCommand(command))
+    buildTerminalQuickCommandInput(flattenTerminalQuickCommand(command)),
+    'driving'
   )
   if (sent) {
     recordTerminalUserInputForLeaf(tabId, pane.leafId)
diff --git a/src/renderer/src/components/terminal-pane/terminal-render-desync-evidence-persistence.test.ts b/src/renderer/src/components/terminal-pane/terminal-render-desync-evidence-persistence.test.ts
new file mode 100644
index 00000000000..2bfe39c2971
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-render-desync-evidence-persistence.test.ts
@@ -0,0 +1,27 @@
+import { describe, expect, it } from 'vitest'
+import { TERMINAL_RENDER_DESYNC_CAPTURE_ID_PATTERN } from '../../../../shared/terminal-render-desync-evidence'
+import { makePaneKey } from '../../../../shared/stable-pane-id'
+import { createBrowserUuid } from '@/lib/browser-uuid'
+import { createCaptureId } from './terminal-render-desync-evidence-persistence'
+
+describe('createCaptureId', () => {
+  // A real paneKey is two UUIDs joined by ':'. Unbounded, the id ran 124 chars and main
+  // rejected every capture with 'Invalid render-desync capture id'.
+  it('stays inside the id main will accept for a realistic paneKey', () => {
+    const paneKey = makePaneKey(createBrowserUuid(), createBrowserUuid())
+
+    expect(createCaptureId(paneKey)).toMatch(TERMINAL_RENDER_DESYNC_CAPTURE_ID_PATTERN)
+  })
+
+  it('keeps the leaf id so a capture is still traceable to its pane', () => {
+    const leafId = createBrowserUuid()
+
+    expect(createCaptureId(makePaneKey(createBrowserUuid(), leafId))).toContain(leafId)
+  })
+
+  it('does not collide for repeated captures of the same pane', () => {
+    const paneKey = makePaneKey(createBrowserUuid(), createBrowserUuid())
+
+    expect(createCaptureId(paneKey)).not.toBe(createCaptureId(paneKey))
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/terminal-render-desync-evidence-persistence.ts b/src/renderer/src/components/terminal-pane/terminal-render-desync-evidence-persistence.ts
index 036f677a02b..ee3be4f4eb6 100644
--- a/src/renderer/src/components/terminal-pane/terminal-render-desync-evidence-persistence.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-render-desync-evidence-persistence.ts
@@ -1,4 +1,5 @@
 import type { SentinelEvidence } from './terminal-render-desync-sentinel'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 /**
  * Durable persistence for render-desync captures, split from the sentinel so
@@ -59,8 +60,13 @@ export async function persistHealedReference(
   }
 }
 
+/** Why: a real paneKey is `${tabId}:${leafId}` — two UUIDs, 73 chars — which pushes the full
+ *  id past main's 120-char cap, so every capture was rejected. The trailing leaf id is the
+ *  identifying half, and the UUID nonce already guarantees uniqueness. */
+const MAX_CAPTURE_ID_PANE_PART_LENGTH = 40
+
 export function createCaptureId(paneKey: string): string {
-  const panePart = paneKey.replace(/[^a-zA-Z0-9_-]/g, '-')
-  const nonce = globalThis.crypto?.randomUUID?.() ?? Math.random().toString(36).slice(2)
+  const panePart = paneKey.replace(/[^a-zA-Z0-9_-]/g, '-').slice(-MAX_CAPTURE_ID_PANE_PART_LENGTH)
+  const nonce = createBrowserUuid()
   return `${Date.now()}-${panePart}-${nonce}`
 }
diff --git a/src/renderer/src/components/terminal-pane/terminal-replay-cursor-state.test.ts b/src/renderer/src/components/terminal-pane/terminal-replay-cursor-state.test.ts
index ce6a3db257c..70a3c4d2668 100644
--- a/src/renderer/src/components/terminal-pane/terminal-replay-cursor-state.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-replay-cursor-state.test.ts
@@ -1,12 +1,12 @@
 import { describe, expect, it } from 'vitest'
 import { Terminal } from '@xterm/headless'
 import {
+  CONFIRMED_SHELL_MODE_RESET,
   POST_REPLAY_LIVE_AGENT_REATTACH_RESET,
   POST_REPLAY_LIVE_SNAPSHOT_RESET,
   POST_REPLAY_MODE_RESET,
   POST_REPLAY_REATTACH_RESET,
-  RESET_KITTY_KEYBOARD_PROTOCOL,
-  RESET_TERMINAL_CURSOR_STYLE
+  RESET_KITTY_KEYBOARD_PROTOCOL
 } from '../../../../shared/terminal-mode-reset-profiles'
 
 const OLD_REATTACH_RESET_WITHOUT_CURSOR_STYLE = '\x1b[?25h\x1b[?1004l'
@@ -74,10 +74,11 @@ function writeTerminal(term: Terminal, data: string): Promise<void> {
 }
 
 describe('terminal replay state reset', () => {
-  it('includes Kitty keyboard protocol reset in replay reset bundles', () => {
+  it('resets Kitty keyboard state only in the process-ended bundles', () => {
     expect(RESET_KITTY_KEYBOARD_PROTOCOL).toBe('\x1b[<99u\x1b[=0u')
     expect(POST_REPLAY_MODE_RESET).toContain(RESET_KITTY_KEYBOARD_PROTOCOL)
-    expect(POST_REPLAY_REATTACH_RESET).toContain(RESET_KITTY_KEYBOARD_PROTOCOL)
+    expect(CONFIRMED_SHELL_MODE_RESET).toContain(RESET_KITTY_KEYBOARD_PROTOCOL)
+    expect(POST_REPLAY_REATTACH_RESET).not.toContain(RESET_KITTY_KEYBOARD_PROTOCOL)
     expect(POST_REPLAY_LIVE_SNAPSHOT_RESET).not.toContain(RESET_KITTY_KEYBOARD_PROTOCOL)
   })
 
@@ -137,7 +138,7 @@ describe('terminal replay state reset', () => {
     }
   })
 
-  it('clears active-buffer Kitty keyboard state after live reattach replay', async () => {
+  it("keeps a live app's Kitty keyboard state through the live reattach reset", async () => {
     const term = new Terminal({
       cols: 80,
       rows: 24,
@@ -147,25 +148,14 @@ describe('terminal replay state reset', () => {
 
     try {
       await writeTerminal(term, '\x1b[=31u\x1b[>15u')
-      expect(readKittyKeyboardState(term)).toMatchObject({
-        flags: 15,
-        mainStack: [31]
-      })
-
       await writeTerminal(term, POST_REPLAY_REATTACH_RESET)
-      // Why: after renderer reattach, the next Ctrl+C must not inherit a stale
-      // Kitty CSI-u encoder state from the replayed TUI snapshot.
-      expect(readKittyKeyboardState(term)).toMatchObject({
-        flags: 0,
-        mainFlags: 0,
-        mainStack: []
-      })
+      expect(readKittyKeyboardState(term)).toMatchObject({ flags: 15, mainStack: [31] })
     } finally {
       term.dispose()
     }
   })
 
-  it('clears active-buffer Kitty keyboard state with the idle-agent reset sequence', async () => {
+  it('clears active-buffer Kitty keyboard state with the confirmed-shell reset', async () => {
     const term = new Terminal({
       cols: 80,
       rows: 24,
@@ -175,14 +165,7 @@ describe('terminal replay state reset', () => {
 
     try {
       await writeTerminal(term, '\x1b[=31u\x1b[>15u')
-      expect(readKittyKeyboardState(term)).toMatchObject({
-        flags: 15,
-        mainStack: [31]
-      })
-
-      await writeTerminal(term, `${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}`)
-      // Why: this is the exact reset emitted when a native Windows agent turn
-      // completes, so the next Backspace/Enter must not inherit CSI-u encoding.
+      await writeTerminal(term, CONFIRMED_SHELL_MODE_RESET)
       expect(readKittyKeyboardState(term)).toMatchObject({
         flags: 0,
         mainFlags: 0,
diff --git a/src/renderer/src/components/terminal-pane/terminal-retention-churn-pins.test.tsx b/src/renderer/src/components/terminal-pane/terminal-retention-churn-pins.test.tsx
new file mode 100644
index 00000000000..a84ee6f2eb1
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-retention-churn-pins.test.tsx
@@ -0,0 +1,220 @@
+// @vitest-environment happy-dom
+import { act, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { CrashReportBreadcrumbData } from '../../../../shared/crash-reporting'
+import type { TerminalTab } from '../../../../shared/terminal-tab-types'
+
+const harness = vi.hoisted(() => ({
+  state: {
+    pendingStartupByTabId: {},
+    ptyIdsByTabId: {},
+    runtimeStatusByEnvironmentId: new Map(),
+    runtimePaneTitlesByTabId: {},
+    settings: {},
+    terminalLayoutsByTabId: {},
+    sleepingAgentSessionsByPaneKey: {},
+    repos: []
+  },
+  breadcrumb: vi.fn<(name: string, data?: CrashReportBreadcrumbData) => void>(),
+  syncWatchers: vi.fn()
+}))
+
+vi.mock('../../store', () => ({
+  useAppStore: Object.assign(
+    (selector: (state: typeof harness.state) => unknown) => selector(harness.state),
+    { getState: () => harness.state }
+  )
+}))
+
+vi.mock('./terminal-parked-tab-watchers', () => ({
+  canWatcherCoverParkedTerminalTab: () => true,
+  resolveParkedTerminalPaneCandidates: () => [],
+  disposeParkedTerminalWatchersForWorktree: vi.fn(),
+  syncParkedTerminalTabWatchers: harness.syncWatchers
+}))
+
+// Isolate the worktree verdict from the separate per-tab aging policy.
+vi.mock('./terminal-parking-e2e-overrides', () => ({
+  getTerminalParkingPolicyOverrides: () => ({ coldParkDelayMs: 24 * 60 * 60_000 })
+}))
+
+vi.mock('@/lib/crash-breadcrumb-recorder', () => ({
+  recordRendererCrashBreadcrumb: harness.breadcrumb
+}))
+
+import { useTerminalTabColdParking } from './use-terminal-tab-cold-parking'
+import {
+  TERMINAL_TAB_PARK_FLIP_BURST_LIMIT,
+  TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS,
+  TERMINAL_TAB_PARK_FLIP_WINDOW_MS
+} from './terminal-park-verdict-flip-telemetry'
+
+const WORKTREE_ID = 'retention-churn'
+const TAB_ID = 'restorable-ssh-tab'
+const EXEMPT_TAB_ID = 'local-live-shell'
+const STEP_MS = 4_000
+
+function terminalTab(id: string, ptyId: string): TerminalTab {
+  return {
+    id,
+    ptyId,
+    worktreeId: WORKTREE_ID,
+    title: id,
+    customTitle: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 0
+  }
+}
+
+type ParkingArgs = Parameters<typeof useTerminalTabColdParking>[0]
+
+function parkingArgs(isForceParked = false): ParkingArgs {
+  return {
+    worktreeId: WORKTREE_ID,
+    terminalTabs: [
+      terminalTab(TAB_ID, 'ssh:host@@session-1'),
+      terminalTab(EXEMPT_TAB_ID, 'local-fail-open-pty')
+    ],
+    assignments: new Map(),
+    isWorktreeActive: false,
+    activeTerminalTabId: null,
+    coldParkTerminalPanes: false,
+    isForceParked,
+    shouldMeasureHiddenWorktree: false,
+    activityTerminalPortals: []
+  }
+}
+
+function churn(
+  rerender: (args: ParkingArgs) => void,
+  args: ParkingArgs,
+  flips = 13,
+  stepMs = STEP_MS
+): void {
+  for (let flip = 1; flip <= flips; flip += 1) {
+    act(() => {
+      vi.advanceTimersByTime(stepMs)
+      rerender({ ...args, coldParkTerminalPanes: flip % 2 === 1 })
+    })
+  }
+}
+
+describe('retention force-parking and churn pins', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(1_000_000)
+    harness.breadcrumb.mockClear()
+    harness.syncWatchers.mockClear()
+  })
+
+  afterEach(() => vi.useRealTimers())
+
+  it('releases an earned sustained pin when forced, preserving the live-shell exemption', () => {
+    const args = parkingArgs()
+    const { result, rerender } = renderHook(useTerminalTabColdParking, { initialProps: args })
+    churn(rerender, args)
+    expect(result.current.size).toBe(0)
+    expect(harness.breadcrumb).toHaveBeenCalledWith(
+      'terminal_park_verdict_churn',
+      expect.objectContaining({ trigger: 'window', pinnedForMs: TERMINAL_TAB_PARK_FLIP_WINDOW_MS })
+    )
+
+    act(() => rerender({ ...args, coldParkTerminalPanes: true, isForceParked: true }))
+
+    expect(result.current).toEqual(new Set([TAB_ID]))
+    expect(harness.syncWatchers).toHaveBeenLastCalledWith(
+      expect.objectContaining({ parkedTabIds: new Set([TAB_ID]) })
+    )
+  })
+
+  it('does not rearm sustained pins while forced and resumes damping after force-parking ends', () => {
+    const args = parkingArgs(true)
+    const { result, rerender } = renderHook(useTerminalTabColdParking, { initialProps: args })
+    for (let flip = 1; flip <= 30; flip += 1) {
+      act(() => {
+        vi.advanceTimersByTime(STEP_MS)
+        rerender({ ...args, coldParkTerminalPanes: flip % 2 === 1 })
+      })
+      expect(result.current).toEqual(flip % 2 === 1 ? new Set([TAB_ID]) : new Set())
+    }
+    expect(harness.breadcrumb).toHaveBeenCalledWith(
+      'terminal_park_verdict_churn',
+      expect.objectContaining({ trigger: 'window' })
+    )
+    expect(harness.breadcrumb.mock.calls.some(([, data]) => data?.pinnedForMs !== undefined)).toBe(
+      false
+    )
+
+    act(() => vi.advanceTimersByTime(TERMINAL_TAB_PARK_FLIP_WINDOW_MS))
+    churn(rerender, { ...args, isForceParked: false })
+    expect(result.current.size).toBe(0)
+    expect(harness.breadcrumb).toHaveBeenCalledWith(
+      'terminal_park_verdict_churn',
+      expect.objectContaining({ trigger: 'window', pinnedForMs: TERMINAL_TAB_PARK_FLIP_WINDOW_MS })
+    )
+  })
+
+  it.each([false, true])('preserves the burst deadline with initial force-parking %s', (forced) => {
+    const args = parkingArgs(forced)
+    const { result, rerender } = renderHook(useTerminalTabColdParking, { initialProps: args })
+    churn(rerender, args, TERMINAL_TAB_PARK_FLIP_BURST_LIMIT, 10)
+    expect(result.current.size).toBe(0)
+    expect(harness.breadcrumb).toHaveBeenCalledWith(
+      'terminal_park_verdict_churn',
+      expect.objectContaining({ trigger: 'burst', pinnedForMs: TERMINAL_TAB_PARK_FLIP_WINDOW_MS })
+    )
+
+    act(() => {
+      vi.advanceTimersByTime(10_000)
+      rerender({ ...args, coldParkTerminalPanes: true, isForceParked: true })
+    })
+    expect(result.current.size).toBe(0)
+    act(() => vi.advanceTimersByTime(TERMINAL_TAB_PARK_FLIP_WINDOW_MS - 10_000))
+    expect(result.current).toEqual(new Set([TAB_ID]))
+  })
+
+  it('releases an ordinary pane at the eight-minute ceiling without further input changes', () => {
+    const args = parkingArgs()
+    args.terminalTabs = [terminalTab(TAB_ID, 'ssh:host@@session-1')]
+    const { result, rerender, unmount } = renderHook(useTerminalTabColdParking, {
+      initialProps: args
+    })
+    const reachedCeiling = () =>
+      harness.breadcrumb.mock.calls.some(
+        ([, data]) => data?.pinnedForMs === TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS
+      )
+    for (let flip = 1; flip <= 600 && !reachedCeiling(); flip += 1) {
+      act(() => {
+        vi.advanceTimersByTime(STEP_MS)
+        rerender({ ...args, coldParkTerminalPanes: flip % 2 === 1 })
+      })
+    }
+    expect(reachedCeiling()).toBe(true)
+    act(() => rerender({ ...args, coldParkTerminalPanes: true }))
+    expect(result.current.size).toBe(0)
+
+    act(() => vi.advanceTimersByTime(TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS - 1))
+    expect(result.current.size).toBe(0)
+    act(() => vi.advanceTimersByTime(1))
+    expect(result.current).toEqual(new Set([TAB_ID]))
+    expect(harness.syncWatchers).toHaveBeenLastCalledWith(
+      expect.objectContaining({ parkedTabIds: new Set([TAB_ID]) })
+    )
+    unmount()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('clears a live sustained-pin timer when its worktree unmounts', () => {
+    const args = parkingArgs()
+    const { rerender, unmount } = renderHook(useTerminalTabColdParking, { initialProps: args })
+    churn(rerender, args)
+    expect(harness.breadcrumb).toHaveBeenCalledWith(
+      'terminal_park_verdict_churn',
+      expect.objectContaining({ trigger: 'window', pinnedForMs: TERMINAL_TAB_PARK_FLIP_WINDOW_MS })
+    )
+    expect(vi.getTimerCount()).toBeGreaterThan(0)
+    unmount()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/terminal-shortcut-policy.ts b/src/renderer/src/components/terminal-pane/terminal-shortcut-policy.ts
index 3ec1fea161d..98f47941bb7 100644
--- a/src/renderer/src/components/terminal-pane/terminal-shortcut-policy.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-shortcut-policy.ts
@@ -100,17 +100,17 @@ export function resolveTerminalShortcutAction(
     return { type: 'switchInputSource' }
   }
 
-  // Why: held select-all keydowns must remain claimed until keyup so Kitty
-  // event reporting cannot encode their repeat or release into the PTY.
+  // Why: held select-all and copy keydowns must remain claimed until keyup so
+  // Kitty event reporting cannot encode their repeat or release into the PTY.
   if (keybindingMatchesAction('terminal.selectAll', event, platform, keybindings)) {
     return { type: 'selectAll' }
   }
 
-  if (!event.repeat) {
-    if (keybindingMatchesAction('terminal.copySelection', event, platform, keybindings)) {
-      return { type: 'copySelection' }
-    }
+  if (keybindingMatchesAction('terminal.copySelection', event, platform, keybindings)) {
+    return { type: 'copySelection' }
+  }
 
+  if (!event.repeat) {
     if (keybindingMatchesAction('terminal.search', event, platform, keybindings)) {
       return { type: 'toggleSearch' }
     }
diff --git a/src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.test.ts b/src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.test.ts
index 066aadfdb46..7e75da603ee 100644
--- a/src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.test.ts
@@ -190,7 +190,8 @@ describe('captureTerminalShutdownLayout', () => {
       expandedPaneId: null,
       paneTransports: new Map([[1, { getPtyId: vi.fn(() => 'pty-1') }]]),
       paneTitlesByPaneId: { 1: 'build logs' },
-      existingLayout: undefined
+      existingLayout: undefined,
+      chatLeafId: LEAF_ID
     })
 
     expect(order).toEqual(['flush', 'serialize'])
@@ -200,7 +201,8 @@ describe('captureTerminalShutdownLayout', () => {
       expandedLeafId: null,
       buffersByLeafId: { [LEAF_ID]: `snapshot:queued-before-quit${CURSOR_HOME}` },
       ptyIdsByLeafId: { [LEAF_ID]: 'pty-1' },
-      titlesByLeafId: { [LEAF_ID]: 'build logs' }
+      titlesByLeafId: { [LEAF_ID]: 'build logs' },
+      chatLeafId: LEAF_ID
     })
   })
 
diff --git a/src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.ts b/src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.ts
index 523db618d33..f53c96347d8 100644
--- a/src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.ts
@@ -25,6 +25,7 @@ type CaptureTerminalShutdownLayoutArgs = {
   paneTransports: ReadonlyMap<number, Pick<PtyTransport, 'getPtyId'>>
   paneTitlesByPaneId: Record<number, string>
   existingLayout: TerminalLayoutSnapshot | undefined
+  chatLeafId?: string | null
   /** Merge prior for buffers, resolved across both scrollback homes; defaults to the shared layout's. */
   priorBuffersByLeafId?: Record<string, string>
   captureBuffers?: boolean
@@ -98,6 +99,7 @@ export function captureTerminalShutdownLayout({
   paneTransports,
   paneTitlesByPaneId,
   existingLayout,
+  chatLeafId,
   priorBuffersByLeafId = existingLayout?.buffersByLeafId,
   captureBuffers = true,
   clearedScrollbackLeafIds
@@ -141,6 +143,9 @@ export function captureTerminalShutdownLayout({
     new Map(panes.map((pane) => [pane.id, pane.leafId]))
   )
   const currentLeafIds = new Set(panes.map((p) => p.leafId))
+  if (chatLeafId && panes.some((pane) => pane.leafId === chatLeafId)) {
+    layout.chatLeafId = chatLeafId
+  }
   const livePtyIdsByLeafId: Record<string, string> = {}
   const preservedPtyIdsByLeafId: Record<string, string> = {}
   for (const pane of panes) {
diff --git a/src/renderer/src/components/terminal-pane/terminal-spawn-error-display.test.ts b/src/renderer/src/components/terminal-pane/terminal-spawn-error-display.test.ts
new file mode 100644
index 00000000000..fad9f9d7c20
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-spawn-error-display.test.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  LEGACY_PTY_ALLOCATION_HINT,
+  LEGACY_TERMINAL_PROCESS_LIMIT_HINT,
+  PTY_ALLOCATION_HINT,
+  TERMINAL_PROCESS_LIMIT_HINT
+} from '../../../../shared/terminal-spawn-error-copy'
+
+// Why a locale stand-in: English fallbacks equal the host copy, so only a translation shows the swap.
+vi.mock('@/i18n/i18n', () => ({
+  translate: (key: string, fallback: string) =>
+    ({
+      'auto.components.terminal.pane.TerminalErrorToast.ptyAllocationLimit':
+        '系统无法再分配 pty 设备。',
+      'auto.components.terminal.pane.TerminalErrorToast.terminalProcessLimit':
+        '系统无法再启动终端进程。'
+    })[key] ?? fallback
+}))
+
+import {
+  localizeTerminalSpawnHints,
+  withoutTerminalSpawnIssueRequest
+} from './terminal-spawn-error-display'
+
+const RAW =
+  'Failed to spawn shell "/bin/zsh": node-pty: open_slave failed: EMFILE (errno 24, Too many open files) (shell: /bin/zsh). If this persists, please file an issue.'
+
+describe('localizeTerminalSpawnHints', () => {
+  it('translates the pty allocation hint and keeps the raw diagnostic', () => {
+    expect(localizeTerminalSpawnHints(`${PTY_ALLOCATION_HINT}\n${RAW}`)).toBe(
+      `系统无法再分配 pty 设备。\n${RAW}`
+    )
+  })
+
+  it('translates the terminal process limit hint', () => {
+    expect(localizeTerminalSpawnHints(TERMINAL_PROCESS_LIMIT_HINT)).toBe('系统无法再启动终端进程。')
+  })
+
+  it('translates the multi-line hints an older host publishes', () => {
+    expect(localizeTerminalSpawnHints(`${LEGACY_PTY_ALLOCATION_HINT} ${RAW}`)).toBe(
+      `系统无法再分配 pty 设备。 ${RAW}`
+    )
+    expect(localizeTerminalSpawnHints(LEGACY_TERMINAL_PROCESS_LIMIT_HINT)).toBe(
+      '系统无法再启动终端进程。'
+    )
+  })
+
+  it('leaves unrelated errors untouched', () => {
+    expect(localizeTerminalSpawnHints('Paste failed.')).toBe('Paste failed.')
+  })
+})
+
+describe('withoutTerminalSpawnIssueRequest', () => {
+  it('drops the host issue request and keeps the diagnostic', () => {
+    expect(withoutTerminalSpawnIssueRequest(RAW)).toBe(
+      'Failed to spawn shell "/bin/zsh": node-pty: open_slave failed: EMFILE (errno 24, Too many open files) (shell: /bin/zsh).'
+    )
+  })
+
+  it('drops the request from an error before another pane error', () => {
+    expect(withoutTerminalSpawnIssueRequest(`${RAW}\nPaste failed.`)).toBe(
+      'Failed to spawn shell "/bin/zsh": node-pty: open_slave failed: EMFILE (errno 24, Too many open files) (shell: /bin/zsh).\nPaste failed.'
+    )
+  })
+
+  it('keeps the same words when they are part of the diagnostic', () => {
+    const error = `Command printed: If this persists, please file an issue.\nMore detail follows.`
+    expect(withoutTerminalSpawnIssueRequest(error)).toBe(error)
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/terminal-spawn-error-display.ts b/src/renderer/src/components/terminal-pane/terminal-spawn-error-display.ts
new file mode 100644
index 00000000000..faa79292388
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-spawn-error-display.ts
@@ -0,0 +1,39 @@
+import { translate } from '@/i18n/i18n'
+import {
+  LEGACY_PTY_ALLOCATION_HINT,
+  LEGACY_TERMINAL_PROCESS_LIMIT_HINT,
+  PTY_ALLOCATION_HINT,
+  TERMINAL_PROCESS_LIMIT_HINT,
+  TERMINAL_SPAWN_ISSUE_REQUEST
+} from '../../../../shared/terminal-spawn-error-copy'
+
+/** Swaps the host's English resource-limit hints for the viewer's locale. */
+export function localizeTerminalSpawnHints(error: string): string {
+  const ptyAllocation = translate(
+    'auto.components.terminal.pane.TerminalErrorToast.ptyAllocationLimit',
+    PTY_ALLOCATION_HINT
+  )
+  const processLimit = translate(
+    'auto.components.terminal.pane.TerminalErrorToast.terminalProcessLimit',
+    TERMINAL_PROCESS_LIMIT_HINT
+  )
+  // Why a replacer: a translation containing `$&` would otherwise be read as a substitution.
+  return error
+    .replaceAll(LEGACY_PTY_ALLOCATION_HINT, () => ptyAllocation)
+    .replaceAll(PTY_ALLOCATION_HINT, () => ptyAllocation)
+    .replaceAll(LEGACY_TERMINAL_PROCESS_LIMIT_HINT, () => processLimit)
+    .replaceAll(TERMINAL_PROCESS_LIMIT_HINT, () => processLimit)
+}
+
+/** Drops the host's plain-text issue request where the toast renders its own linked one. */
+export function withoutTerminalSpawnIssueRequest(error: string): string {
+  const suffix = ` ${TERMINAL_SPAWN_ISSUE_REQUEST}`
+  return error
+    .split('\n')
+    .map((line) =>
+      line.includes('Failed to spawn shell "') && line.endsWith(suffix)
+        ? line.slice(0, -suffix.length)
+        : line
+    )
+    .join('\n')
+}
diff --git a/src/renderer/src/components/terminal-pane/terminal-startup-command-paste.ts b/src/renderer/src/components/terminal-pane/terminal-startup-command-paste.ts
index 3a2307cd87d..913c8b6cfdc 100644
--- a/src/renderer/src/components/terminal-pane/terminal-startup-command-paste.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-startup-command-paste.ts
@@ -47,7 +47,7 @@ export async function executeTerminalStartupCommandPaste({
 
   return executeTerminalPastePlan(plan, {
     pasteText: (text, options) => pasteTerminalText(pane.terminal, text, options),
-    writePty: (data) => writeTerminalPastePtyInput(transport, data),
+    writePty: (data) => writeTerminalPastePtyInput(transport, data, 'launch'),
     isTargetCurrent: isCurrent,
     canContinue: isCurrent
   })
diff --git a/src/renderer/src/components/terminal-pane/title-agent-identity.ts b/src/renderer/src/components/terminal-pane/title-agent-identity.ts
index 8a496052335..157d082a919 100644
--- a/src/renderer/src/components/terminal-pane/title-agent-identity.ts
+++ b/src/renderer/src/components/terminal-pane/title-agent-identity.ts
@@ -1,3 +1,4 @@
+import { isQoderTerminalTitle } from '../../../../shared/qoder-terminal-title'
 import {
   detectAgentStatusFromTitle,
   isGeminiTerminalTitle,
@@ -21,6 +22,7 @@ export function titleHasExplicitAgentIdentity(title: string): boolean {
     title.startsWith('. ') ||
     title.startsWith('* ') ||
     title.startsWith('\u2733') ||
+    isQoderTerminalTitle(title) ||
     isGeminiTerminalTitle(title) ||
     isPiTerminalTitle(title)
   ) {
diff --git a/src/renderer/src/components/terminal-pane/use-notification-dispatch-verdict.test.ts b/src/renderer/src/components/terminal-pane/use-notification-dispatch-verdict.test.ts
new file mode 100644
index 00000000000..2178d357c7a
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/use-notification-dispatch-verdict.test.ts
@@ -0,0 +1,53 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { dispatchTerminalNotification } from './use-notification-dispatch'
+import {
+  PANE_KEY,
+  getLastNotificationDispatchArg,
+  makeAgentStatus,
+  resetNotificationDispatchMockState,
+  type NotificationDispatchMockState
+} from './notification-dispatch-test-harness'
+
+vi.mock('@/store', async () => {
+  const harness = await import('./notification-dispatch-test-harness')
+  return harness.createNotificationDispatchStoreModuleMock()
+})
+
+vi.mock('@/lib/desktop-notification-sound', async () => {
+  const harness = await import('./notification-dispatch-test-harness')
+  return harness.createDesktopNotificationSoundModuleMock()
+})
+
+let mockState: NotificationDispatchMockState
+
+// The hook lane hands main the row's verdict, read through the one accessor, so a terminal
+// agent's StopFailure is worded "failed" rather than "finished".
+describe('dispatchTerminalNotification verdict', () => {
+  beforeEach(() => {
+    mockState = resetNotificationDispatchMockState()
+  })
+
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  it.each([
+    [{ mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 1 } }, 'failure'],
+    [{ mainAgent: { state: 'done', outcome: 'cancellation', stateStartedAt: 1 } }, 'cancellation'],
+    [{ interrupted: true }, 'cancellation'],
+    [{}, undefined]
+  ] as const)('passes %j as the turn outcome %s', (overrides, outcome) => {
+    mockState.agentStatusByPaneKey[PANE_KEY] = makeAgentStatus(PANE_KEY, overrides)
+
+    dispatchTerminalNotification('wt-primary', {
+      source: 'agent-task-complete',
+      terminalTitle: 'codex',
+      paneKey: PANE_KEY
+    })
+
+    expect(getLastNotificationDispatchArg()).toMatchObject({
+      agentState: 'done',
+      agentTurnOutcome: outcome
+    })
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/use-notification-dispatch.ts b/src/renderer/src/components/terminal-pane/use-notification-dispatch.ts
index 304e844d99d..3e4e4b4cb98 100644
--- a/src/renderer/src/components/terminal-pane/use-notification-dispatch.ts
+++ b/src/renderer/src/components/terminal-pane/use-notification-dispatch.ts
@@ -2,6 +2,7 @@ import { useCallback } from 'react'
 import { useAppStore } from '@/store'
 import { resolveCommittedTitleAgentType } from '@/lib/pane-agent-evidence'
 import { buildAgentNotificationId } from '../../../../shared/agent-notification-id'
+import { agentMainAgentVerdict } from '../../../../shared/agent-main-agent-verdict'
 import { shareCompatibleTitleIdentityGroup } from '../../../../shared/agent-title-owner'
 import {
   isFreshNonDoneAgentStatus,
@@ -146,7 +147,7 @@ export function dispatchTerminalNotification(
         agentToolName: agentStatus.toolName,
         agentToolInput: agentStatus.toolInput,
         agentLastAssistantMessage: agentStatus.lastAssistantMessage,
-        agentInterrupted: agentStatus.interrupted
+        agentTurnOutcome: agentMainAgentVerdict(agentStatus) ?? undefined
       }
     : {}
   const notificationId =
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-chat-state.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-chat-state.ts
index 5f6985936b3..06c3b979f63 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-chat-state.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-chat-state.ts
@@ -33,6 +33,7 @@ export function useTerminalPaneChatState(controller: TerminalPaneTitleController
     clearCodexRestartNotice,
     consumePendingCodexPaneRestart,
     setTabCanExpandPane,
+    setTabLayout,
     setTabPaneExpanded,
     setTabViewMode,
     suppressPtyExit,
@@ -148,15 +149,35 @@ export function useTerminalPaneChatState(controller: TerminalPaneTitleController
   )
   const applyNativeChatLeafRoute = useCallback(
     (route: NativeChatLeafRoute): void => {
+      const state = useAppStore.getState()
+      const currentMode = selectUnifiedTerminalTabFields(
+        state.unifiedTabsByWorktree,
+        worktreeId,
+        tabId
+      ).isChatViewMode
+      if (!isChatViewMode && currentMode && chatLeafId && route.chatLeafId === null) {
+        // Keep the owner through the batched toggle that turns chat mode on.
+        return
+      }
       if (route.chatLeafId !== chatLeafId) {
         setChatLeafId(route.chatLeafId)
       }
+      const existingLayout = useAppStore.getState().terminalLayoutsByTabId[tabId]
+      if (existingLayout && existingLayout.chatLeafId !== (route.chatLeafId ?? undefined)) {
+        if (route.chatLeafId) {
+          setTabLayout(tabId, { ...existingLayout, chatLeafId: route.chatLeafId })
+        } else if (existingLayout?.chatLeafId) {
+          const nextLayout = { ...existingLayout }
+          delete nextLayout.chatLeafId
+          setTabLayout(tabId, nextLayout)
+        }
+      }
       if (route.exitChat && unifiedTabId) {
         setTabViewMode(unifiedTabId, 'terminal')
       }
     },
     // oxlint-disable-next-line react-hooks/exhaustive-deps -- Preserve the pre-split dependency contract.
-    [chatLeafId, setTabViewMode, unifiedTabId]
+    [chatLeafId, isChatViewMode, setTabLayout, setTabViewMode, tabId, unifiedTabId, worktreeId]
   )
   const handleConfirmedAgentExit = useCallback(
     (leafId: string): void => {
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-close-actions.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-close-actions.ts
index 3e8dd463a30..bcdbd9b41b3 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-close-actions.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-close-actions.ts
@@ -16,6 +16,7 @@ import { clearPaneTerminalError } from './terminal-error-accumulation'
 import type { TerminalPaneBindingController } from './use-terminal-pane-layout-bindings'
 import { retireUnboundIpcTerminalPane } from './retire-unbound-ipc-terminal-pane'
 import { capturePendingTerminalPaneClose } from './terminal-pane-close-admission'
+import { commitTerminalSurfaceClose } from '@/store/terminals/terminal-surface-close-intent'
 
 export function useTerminalPaneCloseActions(controller: TerminalPaneBindingController) {
   const confirmedCloseRef = useRef<(() => void) | null>(null)
@@ -50,6 +51,7 @@ export function useTerminalPaneCloseActions(controller: TerminalPaneBindingContr
         clearSessionRestoredBannerForPane(paneId)
         const leafId = manager.getLeafId(paneId)
         if (leafId) {
+          commitTerminalSurfaceClose(worktreeId, { kind: 'pane', tabId, leafId })
           retireUnboundIpcTerminalPane({
             getState: useAppStore.getState,
             tabId,
@@ -82,7 +84,8 @@ export function useTerminalPaneCloseActions(controller: TerminalPaneBindingContr
       onCloseTab,
       syncPanePtyLayoutBinding,
       syncPanePtyLayoutBindingForLeaf,
-      tabId
+      tabId,
+      worktreeId
     ]
   )
   const getCloseDialogCopyKind = useCallback(
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-context-menu.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-context-menu.ts
index 155482f2163..463a3a7f415 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-context-menu.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-context-menu.ts
@@ -26,6 +26,7 @@ import { useTerminalContextMenuTrigger } from './use-terminal-context-menu-trigg
 import { useAppStore } from '@/store'
 import { makePaneKey } from '../../../../shared/stable-pane-id'
 import { resolvePaneAgentSessionId } from './pane-agent-session-id'
+import { resetTerminalInputModes } from './terminal-input-mode-reset'
 
 type UseTerminalPaneContextMenuDeps = {
   managerRef: React.RefObject<PaneManager | null>
@@ -68,6 +69,7 @@ type TerminalMenuState = {
   onEqualizePaneSizes: () => void
   onClosePane: () => void
   onClearScreen: () => void
+  onResetTerminal: () => void
   onForkAgentSession: () => Promise<void>
   onContinueAgentSessionInNewSession: () => void
   onCopyAgentSessionContext: () => Promise<void>
@@ -209,6 +211,13 @@ export function useTerminalPaneContextMenu({
     }
   }
 
+  const onResetTerminal = (): void => {
+    const pane = resolveMenuPane()
+    if (pane) {
+      resetTerminalInputModes(paneTransportsRef.current.get(pane.id)?.getPtyId() ?? null)
+    }
+  }
+
   const onForkAgentSession = async (): Promise<void> =>
     forkAgentSessionFromMenuPane(agentSessionContext, resolveMenuPane())
 
@@ -295,6 +304,7 @@ export function useTerminalPaneContextMenu({
     onEqualizePaneSizes,
     onClosePane,
     onClearScreen,
+    onResetTerminal,
     onForkAgentSession,
     onContinueAgentSessionInNewSession,
     onCopyAgentSessionContext,
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-foundation.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-foundation.ts
index 7114b07e1bb..008925a0688 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-foundation.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-foundation.ts
@@ -123,7 +123,9 @@ export function useTerminalPaneFoundation(
   const [quickCommandEditorOpen, setQuickCommandEditorOpen] = useState(false)
   const [quickCommandEditorHostId, setQuickCommandEditorHostId] =
     useState<ExecutionHostId>(LOCAL_EXECUTION_HOST_ID)
-  const [chatLeafId, setChatLeafId] = useState<string | null>(null)
+  const [chatLeafId, setChatLeafId] = useState<string | null>(
+    () => useAppStore.getState().terminalLayoutsByTabId[tabId]?.chatLeafId ?? null
+  )
   const onAgentExitedRef = useRef<(leafId: string) => void>(() => {})
   const [tabWideAgentHintLeafId, setTabWideAgentHintLeafId] = useState<string | null | undefined>(
     undefined
@@ -146,7 +148,9 @@ export function useTerminalPaneFoundation(
   const [ptyRecoveryStatesByPaneId, setPtyRecoveryStatesByPaneId] = useState<
     Record<number, VisiblePtyRecoveryState>
   >({})
-  const [sessionStateSaveFailureOpen, setSessionStateSaveFailureOpen] = useState(false)
+  const [sessionStateSaveFailureMessage, setSessionStateSaveFailureMessage] = useState<
+    string | null
+  >(null)
   const daemonActions = useDaemonActions()
   const { refreshMobileOverlays } = useMobileOverlayTicks({
     managerRef,
@@ -233,8 +237,8 @@ export function useTerminalPaneFoundation(
     setTerminalError,
     ptyRecoveryStatesByPaneId,
     setPtyRecoveryStatesByPaneId,
-    sessionStateSaveFailureOpen,
-    setSessionStateSaveFailureOpen,
+    sessionStateSaveFailureMessage,
+    setSessionStateSaveFailureMessage,
     daemonActions,
     refreshMobileOverlays
   }
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-layout-persistence.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-layout-persistence.ts
index b211a4ae4ba..d981232874d 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-layout-persistence.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-layout-persistence.ts
@@ -1,4 +1,4 @@
-import { useCallback, useEffect } from 'react'
+import { useCallback, useEffect, useLayoutEffect, useRef } from 'react'
 import { useAppStore } from '../../store'
 import type { ManagedPane } from '@/lib/pane-manager/pane-manager'
 import { serializeTerminalLayout } from './layout-serialization'
@@ -16,7 +16,9 @@ import type { TerminalPaneStartupController } from './use-terminal-pane-startup-
 export function useTerminalPaneLayoutPersistence(controller: TerminalPaneStartupController) {
   const {
     clearedScrollbackLeafIdsRef,
+    chatLeafId,
     containerRef,
+    isChatViewMode,
     expandedPaneIdRef,
     managerRef,
     paneCount,
@@ -32,6 +34,10 @@ export function useTerminalPaneLayoutPersistence(controller: TerminalPaneStartup
     terminalTab,
     worktreeId
   } = controller
+  const chatOwnerRef = useRef({ chatLeafId, isChatViewMode })
+  useLayoutEffect(() => {
+    chatOwnerRef.current = { chatLeafId, isChatViewMode }
+  }, [chatLeafId, isChatViewMode])
   const persistLayoutSnapshot = useCallback((): void => {
     const manager = managerRef.current
     const container = containerRef.current
@@ -49,6 +55,11 @@ export function useTerminalPaneLayoutPersistence(controller: TerminalPaneStartup
     const existing = useAppStore.getState().terminalLayoutsByTabId[tabId]
     const currentPanes = manager.getPanes()
     const currentLeafIds = new Set(currentPanes.map((pane) => pane.leafId))
+    // PaneManager retains this callback for its entire mount.
+    const { chatLeafId, isChatViewMode } = chatOwnerRef.current
+    if (isChatViewMode && chatLeafId && currentPanes.some((pane) => pane.leafId === chatLeafId)) {
+      layout.chatLeafId = chatLeafId
+    }
     const clearedScrollbackLeafIds = clearedScrollbackLeafIdsRef.current
     const scrollbackPreserveLeafIds = new Set(
       [...currentLeafIds].filter((leafId) => !clearedScrollbackLeafIds.has(leafId))
@@ -122,6 +133,10 @@ export function useTerminalPaneLayoutPersistence(controller: TerminalPaneStartup
     // oxlint-disable-next-line react-hooks/exhaustive-deps -- Preserve the pre-split dependency contract.
   }, [tabId, setTabLayout, worktreeId])
 
+  useEffect(() => {
+    persistLayoutSnapshot()
+  }, [chatLeafId, isChatViewMode, persistLayoutSnapshot])
+
   const clearPaneScrollback = useCallback(
     (pane: ManagedPane): void => {
       clearedScrollbackLeafIdsRef.current.add(pane.leafId)
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts
index a86341860fa..7e9e1e42b93 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts
@@ -12,7 +12,6 @@ import {
   resolvePaneSeedCwd,
   resolveQueuedInitialCwd,
   replayLayoutWithOneShotParkIntent,
-  resetTerminalKeyboardProtocolAfterInterrupt,
   retireMountedTerminalPaneSurface,
   shouldDetachPaneTransportOnUnmount,
   splitPaneWithOneShotStartup,
@@ -168,23 +167,6 @@ describe('applyTerminalPaneCloseRequest', () => {
   })
 })
 
-describe('resetTerminalKeyboardProtocolAfterInterrupt', () => {
-  it('does not write to an xterm whose pipeline is certified dead', async () => {
-    const { _resetWritePipelineHealthForTests, notifyUndeliverableWrite } =
-      await import('@/lib/pane-manager/terminal-write-pipeline-health')
-    const terminal = { write: vi.fn() }
-    try {
-      notifyUndeliverableWrite(terminal, 'replay-wedged')
-
-      resetTerminalKeyboardProtocolAfterInterrupt(terminal as never)
-
-      expect(terminal.write).not.toHaveBeenCalled()
-    } finally {
-      _resetWritePipelineHealthForTests(terminal)
-    }
-  })
-})
-
 // Why: onPaneCreated uses paneOwnsQueuedStartup to decide whether a pane may spend the tab's queued
 // startup command. Setup/issue splits borrow the same deps.startup field for their own one-shot
 // payload, so a looser test would let a split pane spend a command it never runs — re-breaking
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.ts
index d5f39d6fa8a..944a2e6bbe0 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.ts
@@ -25,7 +25,6 @@ export {
   mapRestoredPaneTitlesByPaneId,
   paneOwnsQueuedStartup,
   replayLayoutWithOneShotParkIntent,
-  resetTerminalKeyboardProtocolAfterInterrupt,
   resolvePaneLinkCwd,
   resolvePaneSeedCwd,
   resolveQueuedInitialCwd,
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-mobile-actions.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-mobile-actions.ts
index 5ce2bfc438e..009ab6b800a 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-mobile-actions.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-mobile-actions.ts
@@ -196,7 +196,7 @@ export function useTerminalPaneMobileActions(controller: TerminalPaneContextCont
         const execution = await executeTerminalPastePlan(plan, {
           pasteText: (pasteText, pasteOptions) =>
             pasteTerminalText(clickedPane.terminal, pasteText, pasteOptions),
-          writePty: (data) => writeTerminalPastePtyInput(transport, data),
+          writePty: (data) => writeTerminalPastePtyInput(transport, data, 'driving'),
           isTargetCurrent: targetStillMounted,
           canContinue: targetStillMounted
         })
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-startup-actions.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-startup-actions.ts
index 5f59aa73e25..deff696c93f 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-startup-actions.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-startup-actions.ts
@@ -46,7 +46,7 @@ export function useTerminalPaneStartupActions(controller: TerminalPaneStoreContr
     setQuickCommandEditorHostId,
     setQuickCommandEditorOpen,
     setSessionRestoredBannerPaneIds,
-    setSessionStateSaveFailureOpen,
+    setSessionStateSaveFailureMessage,
     setShouldMeasureHiddenStartup,
     setTerminalError,
     setTerminalErrorsByPaneId,
@@ -114,7 +114,7 @@ export function useTerminalPaneStartupActions(controller: TerminalPaneStoreContr
   )
 
   const openDiskSpaceAnalyzer = useCallback(() => {
-    setSessionStateSaveFailureOpen(false)
+    setSessionStateSaveFailureMessage(null)
     openSpacePage()
     void refreshWorkspaceSpace().catch((error: unknown) => {
       console.warn('Failed to refresh Space Analyzer after terminal session save failure:', error)
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-title-effects.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-title-effects.ts
index 6ca710a55d5..9ac662e89cc 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-title-effects.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-title-effects.ts
@@ -29,10 +29,12 @@ export function useTerminalPaneTitleEffects(controller: TerminalPaneCloseControl
     clearTerminalPaneUnread,
     clearTerminalTabUnread,
     clearWorktreeUnread,
+    chatLeafId,
     clearedScrollbackLeafIdsRef,
     containerRef,
     expandedPaneId,
     expandedPaneIdRef,
+    isChatViewMode,
     isolatedPaneKey,
     isVisible,
     managerRef,
@@ -215,6 +217,7 @@ export function useTerminalPaneTitleEffects(controller: TerminalPaneCloseControl
         paneTransports: paneTransportsRef.current,
         paneTitlesByPaneId: paneTitlesRef.current,
         existingLayout: existing,
+        chatLeafId: isChatViewMode ? chatLeafId : null,
         // Why resolved: a pane that serializes empty mid-replay must fall back to whichever home
         // holds its last good copy, not only the shared one.
         priorBuffersByLeafId: resolveLeafScrollbackBuffers({
@@ -247,7 +250,7 @@ export function useTerminalPaneTitleEffects(controller: TerminalPaneCloseControl
       }
     }
     // oxlint-disable-next-line react-hooks/exhaustive-deps -- Preserve the pre-split dependency contract.
-  }, [tabId, worktreeId, setTabLayout, setTabLocalOnlyScrollback])
+  }, [chatLeafId, isChatViewMode, tabId, worktreeId, setTabLayout, setTabLocalOnlyScrollback])
 
   useEffect(() => {
     if (renamingPaneId === null) {
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-title-state.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-title-state.ts
index 07db5bef38c..5c0522c97f1 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-title-state.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-title-state.ts
@@ -17,7 +17,7 @@ export function useTerminalPaneTitleState(controller: TerminalPaneFoundation) {
     managerRef,
     paneTransportsRef,
     setPtyRecoveryStatesByPaneId,
-    setSessionStateSaveFailureOpen,
+    setSessionStateSaveFailureMessage,
     setTerminalError,
     setTerminalErrorsByPaneId,
     sshReconnectOwnsTerminalErrorsRef
@@ -89,7 +89,7 @@ export function useTerminalPaneTitleState(controller: TerminalPaneFoundation) {
     if (isTerminalSessionStateSaveFailure(message)) {
       setTerminalError(null)
       setTerminalErrorsByPaneId({})
-      setSessionStateSaveFailureOpen(true)
+      setSessionStateSaveFailureMessage(message)
       return
     }
     const visibleMessage = sshReconnectOwnsTerminalErrorsRef.current
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-park-verdict-pin.ts b/src/renderer/src/components/terminal-pane/use-terminal-park-verdict-pin.ts
index 1941d459219..a8db91077c4 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-park-verdict-pin.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-park-verdict-pin.ts
@@ -47,8 +47,9 @@ export function useTerminalParkVerdictPin(args: {
   terminalTabs: readonly TerminalTab[]
   /** Park verdict before damping — every input already merged. */
   candidateParkedTabIds: ReadonlySet<string>
+  allowSustainedPin: boolean
 }): ReadonlySet<string> {
-  const { records, terminalTabs, candidateParkedTabIds } = args
+  const { records, terminalTabs, candidateParkedTabIds, allowSustainedPin } = args
   const [pinnedTabIds, setPinnedTabIds] = useState<ReadonlySet<string>>(EMPTY_TAB_IDS)
   const pinnedTabIdsRef = useRef(pinnedTabIds)
   // Why a revision and not a raw timer callback: the pin lapse must re-run the
@@ -81,7 +82,8 @@ export function useTerminalParkVerdictPin(args: {
       records: flipRecords,
       liveTabIds,
       nextParkedTabIds: parkedTabIds,
-      nowMs
+      nowMs,
+      allowSustainedPin
     })
     const { pinnedTabIds: nextPinnedTabIds, earliestPinExpiryMs } = selectParkVerdictPinnedTabIds({
       records: flipRecords,
@@ -113,7 +115,7 @@ export function useTerminalParkVerdictPin(args: {
         Math.max(1, earliestPinExpiryMs - nowMs)
       )
     }
-  }, [parkedTabIds, pinExpiryRevision, records, terminalTabs])
+  }, [allowSustainedPin, parkedTabIds, pinExpiryRevision, records, terminalTabs])
 
   // Why separate from the observation effect: that effect intentionally keeps a
   // live timer across its own re-runs, so its cleanup cannot own disposal.
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.ts b/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.ts
index 685546854bc..28794cf6dbf 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.ts
@@ -365,7 +365,8 @@ export function useTerminalTabColdParking(args: {
   const parkedTerminalTabIds = useTerminalParkVerdictPin({
     records: parkVerdictRecordsRef,
     terminalTabs,
-    candidateParkedTabIds: candidateParkedTerminalTabIds
+    candidateParkedTabIds: candidateParkedTerminalTabIds,
+    allowSustainedPin: !isForceParked
   })
 
   // Why: runs in the same effect flush as the commit that parked/revealed the
diff --git a/src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts b/src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts
index 265a80bf47e..c08ff8316c1 100644
--- a/src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts
+++ b/src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import {
+  isAppOwnedCopyChord,
   shouldBypassXtermKeyboardEvent,
   shouldPreventDefaultTerminalImeCandidateKey,
   shouldSuppressTerminalImeKeyboardEvent
@@ -19,12 +20,32 @@ describe('shouldBypassXtermKeyboardEvent — macOS', () => {
     ).toBe(true)
   })
 
-  it('bubbles Cmd+C even with no selection (no-op copy is harmless on macOS)', () => {
+  it('bubbles Cmd+C in a plain shell with no selection', () => {
     expect(
       shouldBypassXtermKeyboardEvent(event({ key: 'c', code: 'KeyC', metaKey: true }), noSel)
     ).toBe(true)
   })
 
+  it.each([1, 2, 3, 8, 31])('lets unselected Cmd+C reach Kitty flags %i', (flags) => {
+    for (const type of ['keydown', 'keyup']) {
+      for (const repeat of [false, true]) {
+        const chord = event({ type, key: 'c', code: 'KeyC', metaKey: true, repeat })
+        expect(shouldBypassXtermKeyboardEvent(chord, { ...noSel, kittyKeyboardFlags: flags })).toBe(
+          false
+        )
+        expect(shouldBypassXtermKeyboardEvent(chord, { ...opts, kittyKeyboardFlags: flags })).toBe(
+          true
+        )
+        expect(
+          shouldBypassXtermKeyboardEvent(
+            { ...chord, defaultPrevented: true },
+            { ...noSel, kittyKeyboardFlags: flags }
+          )
+        ).toBe(true)
+      }
+    }
+  })
+
   it('bubbles Cmd+V so web clients receive the native paste event', () => {
     expect(
       shouldBypassXtermKeyboardEvent(event({ key: 'v', code: 'KeyV', metaKey: true }), noSel)
@@ -173,6 +194,24 @@ describe('shouldBypassXtermKeyboardEvent — macOS', () => {
   })
 })
 
+describe('isAppOwnedCopyChord', () => {
+  const cmdC = event({ key: 'c', code: 'KeyC', metaKey: true })
+  const kittyApp = { isMac: true, hasSelection: false, kittyKeyboardFlags: 1 }
+
+  it('gives unselected macOS Cmd+C to an app that negotiated Kitty reporting', () => {
+    expect(isAppOwnedCopyChord(cmdC, kittyApp)).toBe(true)
+  })
+
+  it('keeps Orca copy for a selection, a plain shell, other chords, and other platforms', () => {
+    expect(isAppOwnedCopyChord(cmdC, { ...kittyApp, hasSelection: true })).toBe(false)
+    expect(isAppOwnedCopyChord(cmdC, { ...kittyApp, kittyKeyboardFlags: 0 })).toBe(false)
+    expect(isAppOwnedCopyChord(cmdC, { ...kittyApp, kittyKeyboardFlags: undefined })).toBe(false)
+    expect(isAppOwnedCopyChord({ ...cmdC, shiftKey: true }, kittyApp)).toBe(false)
+    const ctrlShiftC = event({ key: 'C', code: 'KeyC', ctrlKey: true, shiftKey: true })
+    expect(isAppOwnedCopyChord(ctrlShiftC, { ...kittyApp, isMac: false })).toBe(false)
+  })
+})
+
 describe('shouldSuppressTerminalImeKeyboardEvent — macOS', () => {
   const idle = {
     isMac: true,
diff --git a/src/renderer/src/components/terminal-pane/xterm-bypass-policy.ts b/src/renderer/src/components/terminal-pane/xterm-bypass-policy.ts
index 2ab8f27f4f1..977a1731e1e 100644
--- a/src/renderer/src/components/terminal-pane/xterm-bypass-policy.ts
+++ b/src/renderer/src/components/terminal-pane/xterm-bypass-policy.ts
@@ -282,6 +282,23 @@ function matchesClipboardBinding(
   return keybindingMatchesInput(binding, event, platform)
 }
 
+/**
+ * On macOS an unselected Cmd+C belongs to an app that negotiated Kitty keyboard
+ * reporting: apps like Codex capture the mouse, so their highlight is never an
+ * xterm selection. Without negotiation, unselected Cmd+C still sends nothing.
+ */
+export function isAppOwnedCopyChord(
+  event: XtermBypassEvent,
+  options: Pick<XtermBypassOptions, 'isMac' | 'hasSelection' | 'kittyKeyboardFlags'>
+): boolean {
+  return (
+    options.isMac &&
+    !options.hasSelection &&
+    (options.kittyKeyboardFlags ?? 0) !== 0 &&
+    matchesClipboardBinding('Mod+C', event, 'darwin')
+  )
+}
+
 /**
  * Decide whether plain Ctrl+C should bypass xterm's kitty CSI-u encoder and
  * be sent as ETX through Terminal.input() instead.
@@ -356,6 +373,10 @@ export function shouldBypassXtermKeyboardEvent(
     return true
   }
 
+  if (isAppOwnedCopyChord(event, options)) {
+    return false
+  }
+
   if (isMac) {
     // Why: window-level handlers already consume other Cmd chords before xterm
     // sees them in Electron. Web clients still need paste to bubble to
diff --git a/src/renderer/src/components/terminal-parked-watcher-sync-entries.test.tsx b/src/renderer/src/components/terminal-parked-watcher-sync-entries.test.tsx
index efcc2fb8d44..37b40a20053 100644
--- a/src/renderer/src/components/terminal-parked-watcher-sync-entries.test.tsx
+++ b/src/renderer/src/components/terminal-parked-watcher-sync-entries.test.tsx
@@ -80,6 +80,7 @@ function renderWatcherEffects(overrides: Partial<WatcherController> = {}): Promi
     pendingStartupByTabId: {},
     // Another workspace is on screen, so the mounted one is hidden and parks.
     renderedActiveWorktreeId: 'repo-1::/worktree-9',
+    startupTerminalTabHold: null,
     tabsByWorktree: {
       [PARKED_WORKTREE_ID]: [
         terminalTab('tab-parked', PARKED_WORKTREE_ID),
@@ -127,6 +128,20 @@ describe('parked terminal watcher sync entries', () => {
     expect([...(parkedEntry?.parkedTabIds ?? [])]).toEqual(['tab-parked'])
   })
 
+  it('watches the tabs a startup hold keeps unmounted on the visible workspace', async () => {
+    const heldWorktreeId = surfaceIds[9]
+    const tab = terminalTab('held-agent', heldWorktreeId, 'live-pty')
+    await renderWatcherEffects({
+      mountedWorktreeIdsRef: { current: new Set([heldWorktreeId]) },
+      startupTerminalTabHold: { worktreeId: heldWorktreeId, heldTabIds: new Set([tab.id]) },
+      tabsByWorktree: { [heldWorktreeId]: [tab] }
+    })
+
+    const entry = lastSyncEntries().get(heldWorktreeId)
+    expect([...entry!.parkedTabIds]).toEqual([tab.id])
+    expect([...entry!.restoreTitleOnStartTabIds!]).toEqual([tab.id])
+  })
+
   it('does not allocate a parked-tab-id set per unmounted surface', async () => {
     await renderWatcherEffects()
 
diff --git a/src/renderer/src/components/terminal-split-workspace-surfaces-startup-hold.test.tsx b/src/renderer/src/components/terminal-split-workspace-surfaces-startup-hold.test.tsx
new file mode 100644
index 00000000000..b8e1040995e
--- /dev/null
+++ b/src/renderer/src/components/terminal-split-workspace-surfaces-startup-hold.test.tsx
@@ -0,0 +1,86 @@
+// @vitest-environment happy-dom
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { TerminalSplitWorkspaceSurfaces } from './TerminalSplitWorkspaceSurfaces'
+import type { StartupTerminalTabHold } from './terminal/startup-terminal-tab-hold'
+import type { TerminalController } from './use-terminal-controller'
+
+const mocks = vi.hoisted(() => ({
+  surfaceProps: new Map<string, ReadonlySet<string> | null>()
+}))
+vi.mock('./TerminalWorktreeSplitSurface', () => ({
+  WorktreeSplitSurface: (props: {
+    worktreeId: string
+    activationDeferredMountTabIds: ReadonlySet<string> | null
+  }) => {
+    mocks.surfaceProps.set(props.worktreeId, props.activationDeferredMountTabIds)
+    return null
+  }
+}))
+vi.mock('./browser-pane/host-guest/browser-guest-paint-retention', () => ({
+  useAnyBrowserGuestNeedsPaint: () => false
+}))
+Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
+
+const HELD_WORKTREE_ID = 'repo::/held'
+const DEFERRED_WORKTREE_ID = 'repo::/deferred'
+const OTHER_WORKTREE_ID = 'repo::/other'
+const WORKTREE_IDS = [HELD_WORKTREE_ID, DEFERRED_WORKTREE_ID, OTHER_WORKTREE_ID]
+
+let root: Root | undefined
+afterEach(async () => {
+  await act(async () => root?.unmount())
+  root = undefined
+  mocks.surfaceProps.clear()
+})
+
+async function renderSurfaces(
+  hold: StartupTerminalTabHold | null,
+  deferred: Map<string, ReadonlySet<string>>
+): Promise<void> {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: TerminalSplitWorkspaceSurfaces reads only the fields listed here; the rest of the controller is machinery this render never touches.
+  const controller = {
+    activationDeferredMountTabIdsByWorktreeRef: { current: deferred },
+    activeGroupIdByWorktree: {},
+    activeView: 'terminal',
+    activityTerminalPortals: [],
+    anyMountedWorktreeHasLayout: true,
+    backgroundMountTabIdsByWorktreeRef: { current: new Map() },
+    effectiveActiveLayout: { type: 'leaf', groupId: 'group-1' },
+    effectiveParkedTerminalWorktreeIds: new Set(),
+    forceParkedTerminalWorktreeIds: new Set(),
+    getEffectiveLayoutForWorktree: () => ({ type: 'leaf', groupId: 'group-1' }),
+    measurableBackgroundWorktreeIdsRef: { current: new Set() },
+    mountedWorktreeIdsRef: { current: new Set(WORKTREE_IDS) },
+    renderedActiveWorktreeId: HELD_WORKTREE_ID,
+    startupTerminalTabHold: hold,
+    workspaceSurfaces: WORKTREE_IDS.map((id) => ({ id, path: `/${id}` }))
+  } as unknown as TerminalController
+  const container = document.createElement('div')
+  root = createRoot(container)
+  await act(async () => root?.render(<TerminalSplitWorkspaceSurfaces controller={controller} />))
+}
+
+describe('split workspace surfaces under a startup terminal hold', () => {
+  it('hands each surface its parked-equivalent tabs: deferral set, else held tabs, else none', async () => {
+    const hold: StartupTerminalTabHold = {
+      worktreeId: HELD_WORKTREE_ID,
+      heldTabIds: new Set(['held-tab'])
+    }
+    const deferredTabIds = new Set(['deferred-tab'])
+
+    await renderSurfaces(hold, new Map([[DEFERRED_WORKTREE_ID, deferredTabIds]]))
+
+    // Held tabs render no pane, so the surface must hand them to parked watchers.
+    expect(mocks.surfaceProps.get(HELD_WORKTREE_ID)).toBe(hold.heldTabIds)
+    expect(mocks.surfaceProps.get(DEFERRED_WORKTREE_ID)).toBe(deferredTabIds)
+    expect(mocks.surfaceProps.get(OTHER_WORKTREE_ID)).toBeNull()
+  })
+
+  it('passes no held tabs once the hold is released', async () => {
+    await renderSurfaces(null, new Map())
+
+    expect(mocks.surfaceProps.get(HELD_WORKTREE_ID)).toBeNull()
+  })
+})
diff --git a/src/renderer/src/components/terminal-startup-hold-placeholder.test.tsx b/src/renderer/src/components/terminal-startup-hold-placeholder.test.tsx
new file mode 100644
index 00000000000..be648b543b4
--- /dev/null
+++ b/src/renderer/src/components/terminal-startup-hold-placeholder.test.tsx
@@ -0,0 +1,222 @@
+// @vitest-environment happy-dom
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Tab, TabGroup } from '../../../shared/tab-types'
+import type { TerminalTab } from '../../../shared/terminal-tab-types'
+import type { TerminalController } from './use-terminal-controller'
+
+vi.mock('../store', async () => {
+  const { create } = await import('zustand')
+  const activeGroupIdByWorktree: Record<string, string | undefined> = {}
+  const groupsByWorktree: Record<string, TabGroup[]> = {}
+  const tabsByWorktree: Record<string, TerminalTab[]> = {}
+  const unifiedTabsByWorktree: Record<string, Tab[]> = {}
+  const useAppStore = create(() => ({
+    activeGroupIdByWorktree,
+    groupsByWorktree,
+    tabsByWorktree,
+    unifiedTabsByWorktree,
+    consumeSuppressedPtyExit: () => false,
+    focusGroup: () => {},
+    reconcileWorktreeTabModel: () => ({ renderableTabCount: 1 }),
+    setActiveWorktree: () => {}
+  }))
+  return { useAppStore }
+})
+vi.mock('./native-chat/use-native-chat-toggle-shortcut', () => ({
+  useNativeChatToggleShortcut: () => {}
+}))
+vi.mock('./terminal-pane/use-terminal-tab-cold-parking', () => ({
+  useTerminalTabColdParking: () => new Set()
+}))
+vi.mock('./terminal-pane/TerminalOverlaySlot', () => ({
+  TerminalOverlaySlot: (props: { terminalTabId: string }) => (
+    <div data-terminal-pane-tab-id={props.terminalTabId} />
+  )
+}))
+vi.mock('./terminal-pane/TerminalPane', () => ({
+  default: (props: { tabId: string }) => <div data-terminal-pane-tab-id={props.tabId} />
+}))
+vi.mock('./tab-group/RetainedPaneHost', () => ({
+  RetainedPaneHost: (props: { groupId?: string; children: React.ReactNode }) => (
+    <div data-retained-pane-group-id={props.groupId}>{props.children}</div>
+  )
+}))
+
+import { useAppStore } from '../store'
+import TerminalPaneOverlayLayer from './terminal-pane/TerminalPaneOverlayLayer'
+import { TerminalLegacyTerminalPanes } from './TerminalLegacyTerminalPanes'
+
+Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
+
+const WORKTREE_ID = 'repo::/held'
+const GROUP_ID = 'group-a'
+const NO_ADMITTED_TABS: ReadonlySet<string> = new Set()
+
+function terminalTab(id: string): TerminalTab {
+  return {
+    id,
+    worktreeId: WORKTREE_ID,
+    ptyId: null,
+    title: id,
+    customTitle: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 0,
+    generation: 0
+  }
+}
+
+function unifiedTerminalTab(id: string): Tab {
+  return {
+    id: `unified-${id}`,
+    entityId: id,
+    worktreeId: WORKTREE_ID,
+    groupId: GROUP_ID,
+    contentType: 'terminal',
+    label: id,
+    customLabel: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 0
+  }
+}
+
+function setTabs(tabIds: string[], activeTabId: string): void {
+  const group: TabGroup = {
+    id: GROUP_ID,
+    worktreeId: WORKTREE_ID,
+    activeTabId: `unified-${activeTabId}`,
+    tabOrder: tabIds.map((tabId) => `unified-${tabId}`)
+  }
+  useAppStore.setState({
+    activeGroupIdByWorktree: { [WORKTREE_ID]: GROUP_ID },
+    groupsByWorktree: { [WORKTREE_ID]: [group] },
+    tabsByWorktree: { [WORKTREE_ID]: tabIds.map(terminalTab) },
+    unifiedTabsByWorktree: { [WORKTREE_ID]: tabIds.map(unifiedTerminalTab) }
+  })
+}
+
+let container: HTMLDivElement
+let root: Root
+
+beforeEach(() => {
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+})
+afterEach(() => {
+  act(() => root.unmount())
+  container.remove()
+})
+
+function placeholders(): Element[] {
+  return [...container.querySelectorAll('[data-terminal-restoring-placeholder]')]
+}
+
+function mountedPaneTabIds(): string[] {
+  return [...container.querySelectorAll('[data-terminal-pane-tab-id]')].map(
+    (element) => element.getAttribute('data-terminal-pane-tab-id') ?? ''
+  )
+}
+
+describe('overlay layer under the startup terminal hold', () => {
+  function renderOverlay(backgroundMountTabIds: ReadonlySet<string> | null): void {
+    act(() =>
+      root.render(
+        <TerminalPaneOverlayLayer
+          worktreeId={WORKTREE_ID}
+          worktreePath="/held"
+          isWorktreeActive
+          backgroundMountTabIds={backgroundMountTabIds}
+        />
+      )
+    )
+  }
+
+  it('fills the visible held tab slot, including a tab created under the hold, until the gate opens', () => {
+    setTabs(['tab-a', 'tab-b'], 'tab-a')
+    renderOverlay(NO_ADMITTED_TABS)
+    // Only the visible tab gets a placeholder; the hidden held tab renders nothing.
+    expect(placeholders()).toHaveLength(1)
+    expect(placeholders()[0].parentElement?.getAttribute('data-retained-pane-group-id')).toBe(
+      GROUP_ID
+    )
+    expect(mountedPaneTabIds()).toEqual([])
+
+    setTabs(['tab-a', 'tab-b', 'tab-new'], 'tab-new')
+    renderOverlay(NO_ADMITTED_TABS)
+    expect(placeholders()).toHaveLength(1)
+    expect(mountedPaneTabIds()).toEqual([])
+
+    renderOverlay(null)
+    expect(placeholders()).toHaveLength(0)
+    expect(mountedPaneTabIds()).toEqual(['tab-a', 'tab-b', 'tab-new'])
+  })
+
+  it('renders no placeholder while the held worktree is not the active one', () => {
+    setTabs(['tab-a'], 'tab-a')
+    act(() =>
+      root.render(
+        <TerminalPaneOverlayLayer
+          worktreeId={WORKTREE_ID}
+          worktreePath="/held"
+          isWorktreeActive={false}
+          backgroundMountTabIds={NO_ADMITTED_TABS}
+        />
+      )
+    )
+    expect(placeholders()).toHaveLength(0)
+  })
+})
+
+describe('legacy terminal panes under the startup terminal hold', () => {
+  function renderLegacy(
+    tabIds: string[],
+    activeTabId: string,
+    restriction: ReadonlySet<string> | null
+  ): void {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: TerminalLegacyTerminalPanes reads only the fields listed here.
+    const controller = {
+      activeTabId,
+      activeTabType: 'terminal',
+      activeView: 'terminal',
+      activityTerminalPortals: [],
+      backgroundMountTabIdsByWorktreeRef: {
+        current: new Map(restriction ? [[WORKTREE_ID, restriction]] : [])
+      },
+      effectiveParkedTerminalWorktreeIds: new Set(),
+      evictionExemptTerminalTabIds: new Set(),
+      handleCloseTab: () => {},
+      handlePtyExit: () => {},
+      measurableBackgroundWorktreeIdsRef: { current: new Set() },
+      mountedWorktreeIdsRef: { current: new Set([WORKTREE_ID]) },
+      renderedActiveWorktreeId: WORKTREE_ID,
+      tabsByWorktree: { [WORKTREE_ID]: tabIds.map(terminalTab) },
+      worktreeBrowserTabs: [],
+      worktreeFiles: [],
+      workspaceSurfaces: [{ id: WORKTREE_ID, path: '/held' }]
+    } as unknown as TerminalController
+    act(() => root.render(<TerminalLegacyTerminalPanes controller={controller} />))
+  }
+
+  it('fills the active held tab, including a tab created under the hold, until the gate opens', () => {
+    renderLegacy(['tab-a', 'tab-b'], 'tab-a', NO_ADMITTED_TABS)
+    expect(placeholders()).toHaveLength(1)
+    expect(mountedPaneTabIds()).toEqual([])
+
+    renderLegacy(['tab-a', 'tab-b', 'tab-new'], 'tab-new', NO_ADMITTED_TABS)
+    expect(placeholders()).toHaveLength(1)
+
+    renderLegacy(['tab-a', 'tab-b', 'tab-new'], 'tab-new', null)
+    expect(placeholders()).toHaveLength(0)
+    expect(mountedPaneTabIds()).toEqual(['tab-a', 'tab-b', 'tab-new'])
+  })
+
+  it('renders no placeholder when the active tab is not a held one', () => {
+    renderLegacy(['tab-a', 'tab-b'], 'tab-a', new Set(['tab-a']))
+    expect(placeholders()).toHaveLength(0)
+    expect(mountedPaneTabIds()).toEqual(['tab-a'])
+  })
+})
diff --git a/src/renderer/src/components/terminal-workspace-surface-ids.test.tsx b/src/renderer/src/components/terminal-workspace-surface-ids.test.tsx
index f93b06a3b05..d21b878c218 100644
--- a/src/renderer/src/components/terminal-workspace-surface-ids.test.tsx
+++ b/src/renderer/src/components/terminal-workspace-surface-ids.test.tsx
@@ -77,6 +77,7 @@ describe('workspace surface ids', () => {
   it('does not rebuild a surface-id array or set on a cold-activation render', () => {
     const ids = Array.from({ length: 423 }, (_, index) => `repo::/worktree-${index}`)
     const { surfaces, mapCalls } = countingSurfaces(ids)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: applyTerminalColdActivation reads only the fields listed here; the rest of the foundation is render machinery this test never exercises.
     const controller = {
       activationDeferralPlanRevisionRef: { current: 0 },
       activationDeferredMountTabIdsByWorktreeRef: { current: new Map() },
@@ -89,6 +90,7 @@ describe('workspace surface ids', () => {
       groupsByWorktree: {},
       hydrationSucceeded: false,
       lastActivationWorktreeIdRef: { current: null },
+      startupTerminalTabHoldRef: { current: null },
       layoutByWorktree: {},
       mountedWorktreeIdsRef: { current: new Set(['repo::/worktree-0', 'repo::/gone']) },
       pairedRuntimeParkingEnvironmentIds: new Set(),
diff --git a/src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts b/src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts
index 0978393bba7..117f049978e 100644
--- a/src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts
+++ b/src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts
@@ -11,7 +11,7 @@ import {
   addBackgroundMountedTerminalWorktree,
   applyBackgroundMountTabRestriction,
   canDeferColdActivationTabsForHost,
-  canMountTerminalWorkspaceForStartup,
+  canAdmitTerminalTabsForStartup,
   collectDeferredMountTabIds,
   hasRequestedBackgroundTerminalWorktreeMount,
   planColdActivationTabDeferral,
@@ -23,24 +23,24 @@ import {
   shouldMountBackgroundWorktreeTab
 } from './background-terminal-worktree-mount'
 
-describe('terminal workspace startup mount gate', () => {
+describe('startup terminal tab admission gate', () => {
   it('waits for hydration unless startup entered degraded mode', () => {
     expect(
-      canMountTerminalWorkspaceForStartup({
+      canAdmitTerminalTabsForStartup({
         workspaceSessionReady: true,
         hydrationSucceeded: false,
         startupWorktreeRefreshCompleted: false
       })
     ).toBe(false)
     expect(
-      canMountTerminalWorkspaceForStartup({
+      canAdmitTerminalTabsForStartup({
         workspaceSessionReady: true,
         hydrationSucceeded: true,
         startupWorktreeRefreshCompleted: false
       })
     ).toBe(true)
     expect(
-      canMountTerminalWorkspaceForStartup({
+      canAdmitTerminalTabsForStartup({
         workspaceSessionReady: true,
         hydrationSucceeded: false,
         startupWorktreeRefreshCompleted: true
diff --git a/src/renderer/src/components/terminal/background-terminal-worktree-mount.ts b/src/renderer/src/components/terminal/background-terminal-worktree-mount.ts
index 8f8bf4461b0..4f4214e07fc 100644
--- a/src/renderer/src/components/terminal/background-terminal-worktree-mount.ts
+++ b/src/renderer/src/components/terminal/background-terminal-worktree-mount.ts
@@ -150,7 +150,14 @@ export function shouldMountBackgroundWorktreeTab(
 // working set (and later tab switches) ends up exactly where it was before.
 export const COLD_ACTIVATION_TAB_DEFER_THRESHOLD = 0
 
-export function canMountTerminalWorkspaceForStartup(args: {
+/**
+ * Whether restored terminal tabs may mount their panes. Why this fences panes and not the
+ * workspace surface: a pane binds a PTY on mount, and until startup restoration has fenced
+ * the daemon provider, reconnected SSH targets, and published PTY ownership, that bind would
+ * attach to a not-yet-restored session or spawn a duplicate shell. The tab strip and the
+ * chat, browser, and editor panes bind nothing, so they mount from the hydrated tab model.
+ */
+export function canAdmitTerminalTabsForStartup(args: {
   workspaceSessionReady: boolean
   hydrationSucceeded: boolean
   startupWorktreeRefreshCompleted: boolean
diff --git a/src/renderer/src/components/terminal/cold-activation-deferral-stranding.test.ts b/src/renderer/src/components/terminal/cold-activation-deferral-stranding.test.ts
index 89737f42991..40ab1847a4e 100644
--- a/src/renderer/src/components/terminal/cold-activation-deferral-stranding.test.ts
+++ b/src/renderer/src/components/terminal/cold-activation-deferral-stranding.test.ts
@@ -31,6 +31,7 @@ import {
 import { capturedPanesByTabId } from '../terminal-pane/terminal-parked-watcher-registry'
 import type { TerminalTab } from '../../../../shared/terminal-tab-types'
 import type { TerminalParkingFoundation } from '../use-terminal-parking-foundation'
+import type { StartupTerminalTabHold } from './startup-terminal-tab-hold'
 
 const WORKTREE_ID = 'repo::/worktree'
 const OTHER_WORKTREE_ID = 'repo::/other-worktree'
@@ -82,9 +83,11 @@ function useStrandingHarness(props: HarnessProps) {
   const backgroundMountTabIdsByWorktreeRef = useRef(new Map<string, ReadonlySet<string>>())
   const activationDeferredMountTabIdsByWorktreeRef = useRef(new Map<string, ReadonlySet<string>>())
   const lastActivationWorktreeIdRef = useRef<string | null>(null)
+  const startupTerminalTabHoldRef = useRef<StartupTerminalTabHold | null>(null)
   const mountedWorktreeIdsRef = useRef(new Set<string>())
   const activationDeferralPlanRevisionRef = useRef(0)
   const [backgroundMountRevision, setBackgroundMountRevision] = useState(0)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: applyTerminalColdActivation and the admission hook read only the fields listed here; the rest of the foundation is render machinery this harness never exercises.
   const foundation = {
     activationDeferralPlanRevisionRef,
     activationDeferredMountTabIdsByWorktreeRef,
@@ -98,6 +101,7 @@ function useStrandingHarness(props: HarnessProps) {
     groupsByWorktree: {},
     hydrationSucceeded: props.gateOpen,
     lastActivationWorktreeIdRef,
+    startupTerminalTabHoldRef,
     layoutByWorktree: {},
     mountedWorktreeIdsRef,
     pairedRuntimeParkingEnvironmentIds: new Set<string>(),
diff --git a/src/renderer/src/components/terminal/initial-terminal-structured-launch.test.tsx b/src/renderer/src/components/terminal/initial-terminal-structured-launch.test.tsx
index ec897d479da..ef45ae6cb3e 100644
--- a/src/renderer/src/components/terminal/initial-terminal-structured-launch.test.tsx
+++ b/src/renderer/src/components/terminal/initial-terminal-structured-launch.test.tsx
@@ -1,19 +1,33 @@
 // @vitest-environment happy-dom
-import { act } from 'react'
+import { act, StrictMode } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { useTerminalWatcherEffects } from '../use-terminal-watcher-effects'
+import {
+  claimEmptyWorkspaceDefaultSurface,
+  releaseEmptyWorkspaceDefaultSurface
+} from '@/lib/empty-workspace-default-surface-claims'
 
-const mocks = vi.hoisted(() => ({
-  gate: vi.fn(),
-  resume: vi.fn(),
-  authority: 'none',
-  launchStatus: vi.fn((_worktreeId: string, _provider: string): string => 'idle'),
-  createTab: vi.fn()
-}))
+const mocks = vi.hoisted(() => {
+  const storeTabsByWorktree: Record<string, unknown[]> = {}
+  const storeClosedRecords: Record<string, { worktreeId: string; closedAt: number }> = {}
+  return {
+    gate: vi.fn(),
+    resume: vi.fn(),
+    authority: 'none',
+    launchStatus: vi.fn((_worktreeId: string, _provider: string): string => 'idle'),
+    createTab: vi.fn(),
+    storeTabsByWorktree,
+    storeClosedRecords
+  }
+})
 vi.mock('@/store', () => ({
   useAppStore: Object.assign(() => mocks.authority, {
-    getState: () => ({ activeWorktreeId: 'wt-1' })
+    getState: () => ({
+      activeWorktreeId: 'wt-1',
+      tabsByWorktree: mocks.storeTabsByWorktree,
+      closedTerminalTabTombstonesByTabId: mocks.storeClosedRecords
+    })
   })
 }))
 vi.mock('@/lib/worktree-agent-activation-gate', () => ({
@@ -35,12 +49,16 @@ vi.mock('../terminal-pane/terminal-parked-tab-watchers', () => ({
   disposeAllParkedTerminalWatchers: vi.fn()
 }))
 
+const PENDING_INTENT = { callerProvidesSurface: false, seedUserDefaultSurface: true }
+
 Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
 let root: Root | undefined
 afterEach(async () => {
   await act(async () => root?.unmount())
   vi.clearAllMocks()
   mocks.authority = 'none'
+  mocks.storeTabsByWorktree = {}
+  mocks.storeClosedRecords = {}
 })
 
 function Watcher({ restored = true, hydrated = false, worktreeId = 'wt-1' } = {}): null {
@@ -72,6 +90,7 @@ function Watcher({ restored = true, hydrated = false, worktreeId = 'wt-1' } = {}
     pairedRuntimeParkingEnvironmentIds: new Set(),
     pendingStartupByTabId: {},
     renderedActiveWorktreeId: worktreeId,
+    startupTerminalTabHold: null,
     terminalParkingEnabled: false,
     terminalProviderSnapshotCapabilityRevision: 0,
     terminalSshParkingEnabled: false,
@@ -108,6 +127,134 @@ describe('passive terminal seeding during native chat creation', () => {
   })
 })
 
+function deferredGate(): (outcome: 'empty' | 'blocked') => Promise<void> {
+  let finishGate!: (outcome: 'empty' | 'blocked') => void
+  // One shared promise, as the gate's in-flight dedupe hands every rerun.
+  mocks.gate.mockReturnValue(
+    new Promise((resolve) => {
+      finishGate = resolve
+    })
+  )
+  return async (outcome) => act(async () => finishGate(outcome))
+}
+
+describe('passive terminal seeding retries until a decision applies', () => {
+  it('seeds once after a StrictMode double run', async () => {
+    const finishGate = deferredGate()
+    const renderStrict = () =>
+      root?.render(
+        <StrictMode>
+          <Watcher />
+        </StrictMode>
+      )
+    root = createRoot(document.createElement('div'))
+    await act(async () => renderStrict())
+    await finishGate('empty')
+    expect(mocks.createTab).toHaveBeenCalledTimes(1)
+
+    // The applied decision is final: a later run neither re-checks nor seeds again.
+    await act(async () => renderStrict())
+    expect(mocks.createTab).toHaveBeenCalledTimes(1)
+    expect(mocks.gate).toHaveBeenCalledTimes(2)
+  })
+
+  it('seeds once when an input changes mid-check', async () => {
+    const finishGate = deferredGate()
+    root = createRoot(document.createElement('div'))
+    await act(async () => root?.render(<Watcher />))
+    // Each render passes a fresh reconcile callback, so this rerun cancels the first check.
+    await act(async () => root?.render(<Watcher />))
+    await finishGate('empty')
+    expect(mocks.createTab).toHaveBeenCalledTimes(1)
+    expect(mocks.gate).toHaveBeenCalledTimes(2)
+  })
+
+  it('seeds once across two empty checks separated by leaving the workspace', async () => {
+    const resolvers: ((outcome: 'empty') => void)[] = []
+    mocks.gate.mockImplementation(
+      () =>
+        new Promise((resolve) => {
+          resolvers.push(resolve)
+        })
+    )
+    root = createRoot(document.createElement('div'))
+    await act(async () => root?.render(<Watcher />))
+    await act(async () => root?.render(<Watcher worktreeId="wt-2" />))
+    await act(async () => root?.render(<Watcher />))
+    await act(async () => resolvers.forEach((resolve) => resolve('empty')))
+    await act(async () => root?.render(<Watcher />))
+
+    expect(mocks.createTab).toHaveBeenCalledTimes(1)
+    expect(mocks.gate).toHaveBeenCalledTimes(3)
+  })
+
+  it('does not seed a workspace whose last terminal closed during the check', async () => {
+    const finishGate = deferredGate()
+    root = createRoot(document.createElement('div'))
+    await act(async () => root?.render(<Watcher />))
+    // closeTab empties the row and records the close in the same store write.
+    mocks.storeTabsByWorktree = { 'wt-1': [] }
+    mocks.storeClosedRecords = { 'closed-tab': { worktreeId: 'wt-1', closedAt: Date.now() } }
+    await finishGate('empty')
+    expect(mocks.createTab).not.toHaveBeenCalled()
+  })
+
+  it('seeds an empty row that has no close record, which legacy data leaves', async () => {
+    const finishGate = deferredGate()
+    root = createRoot(document.createElement('div'))
+    await act(async () => root?.render(<Watcher />))
+    mocks.storeTabsByWorktree = { 'wt-1': [] }
+    await finishGate('empty')
+    expect(mocks.createTab).toHaveBeenCalledTimes(1)
+  })
+
+  it('leaves the seed to an activation reseed awaiting agent detection', async () => {
+    const finishGate = deferredGate()
+    root = createRoot(document.createElement('div'))
+    await act(async () => root?.render(<Watcher />))
+    claimEmptyWorkspaceDefaultSurface('wt-1', PENDING_INTENT)
+    try {
+      await finishGate('empty')
+      expect(mocks.createTab).not.toHaveBeenCalled()
+    } finally {
+      releaseEmptyWorkspaceDefaultSurface('wt-1')
+    }
+  })
+
+  // Why: that reseed bails once the user leaves, so a workspace left mid-wait must seed on return.
+  it('seeds on return to a workspace left while a reseed awaited agent detection', async () => {
+    mocks.gate.mockResolvedValue('empty')
+    claimEmptyWorkspaceDefaultSurface('wt-1', PENDING_INTENT)
+    root = createRoot(document.createElement('div'))
+    try {
+      await act(async () => root?.render(<Watcher />))
+      expect(mocks.createTab).not.toHaveBeenCalled()
+    } finally {
+      releaseEmptyWorkspaceDefaultSurface('wt-1')
+    }
+
+    await act(async () => root?.render(<Watcher worktreeId="wt-2" />))
+    await act(async () => root?.render(<Watcher />))
+    expect(mocks.createTab).toHaveBeenCalledTimes(1)
+  })
+
+  it('seeds after leaving and returning to a blocked workspace', async () => {
+    mocks.gate.mockResolvedValue('blocked')
+    root = createRoot(document.createElement('div'))
+    await act(async () => root?.render(<Watcher />))
+    expect(mocks.createTab).not.toHaveBeenCalled()
+
+    await act(async () => root?.render(<Watcher worktreeId="wt-2" />))
+    mocks.gate.mockResolvedValue('empty')
+    await act(async () => root?.render(<Watcher />))
+    expect(mocks.createTab).toHaveBeenCalledTimes(1)
+    expect(mocks.createTab).toHaveBeenCalledWith('wt-1', undefined, undefined, {
+      pendingActivationSpawn: true
+    })
+    expect(mocks.gate.mock.calls.map(([id]) => id)).toEqual(['wt-1', 'wt-2', 'wt-1'])
+  })
+})
+
 describe('startup agent recovery host inventory', () => {
   it('keeps recovery available until the execution host answers', async () => {
     mocks.authority = 'unverifiable'
diff --git a/src/renderer/src/components/terminal/initial-terminal-wiring.test.ts b/src/renderer/src/components/terminal/initial-terminal-wiring.test.ts
index ed56289625e..d56384227cc 100644
--- a/src/renderer/src/components/terminal/initial-terminal-wiring.test.ts
+++ b/src/renderer/src/components/terminal/initial-terminal-wiring.test.ts
@@ -15,8 +15,11 @@ function readSource(relativePath: string): string {
 describe('Terminal auto-create wiring', () => {
   const source = readSource(TERMINAL_PATH)
 
-  it('derives the tombstone from the active worktree row', () => {
-    expect(source).toContain('Object.hasOwn(tabsByWorktree, activeWorktreeId)')
+  it('derives the tombstone from the active worktree row and its close records at decision time', () => {
+    // Why the live store: a render-captured row goes stale while the activation check runs.
+    expect(source).toMatch(
+      /isTerminalWorkspaceEmptiedOnPurpose\(\s*useAppStore\.getState\(\),\s*activeWorktreeId\s*\)/
+    )
   })
 
   it('passes that derivation into shouldAutoCreateInitialTerminal', () => {
@@ -31,10 +34,4 @@ describe('Terminal auto-create wiring', () => {
       'shouldAutoCreateInitialTerminal(renderableTabCount, activeWorktreeHasTerminalState)'
     )
   })
-
-  it('keeps that derivation in the effect dependencies', () => {
-    // Why: without the dep the effect never re-runs when the row appears or disappears.
-    // Anchored to the neighbouring dep so a stray trailing comma elsewhere can't satisfy it.
-    expect(source).toContain('activeWorktreeId,\n    activeWorktreeHasTerminalState,')
-  })
 })
diff --git a/src/renderer/src/components/terminal/initial-terminal.ts b/src/renderer/src/components/terminal/initial-terminal.ts
index b895bf0cbd5..515effce58c 100644
--- a/src/renderer/src/components/terminal/initial-terminal.ts
+++ b/src/renderer/src/components/terminal/initial-terminal.ts
@@ -2,6 +2,7 @@ export function shouldAutoCreateInitialTerminal(
   renderableTabCount: number,
   hasPersistedTerminalState = false
 ): boolean {
-  // Why: a missing row means never initialized; an explicit empty row records that the user closed the last terminal.
+  // Why: desktop callers pass isTerminalWorkspaceEmptiedOnPurpose, so an empty row with no close
+  // record (legacy data, or a writer that is not a close) still reads as never initialized.
   return renderableTabCount === 0 && !hasPersistedTerminalState
 }
diff --git a/src/renderer/src/components/terminal/startup-terminal-tab-hold.test.ts b/src/renderer/src/components/terminal/startup-terminal-tab-hold.test.ts
new file mode 100644
index 00000000000..d49d4a511cd
--- /dev/null
+++ b/src/renderer/src/components/terminal/startup-terminal-tab-hold.test.ts
@@ -0,0 +1,349 @@
+// @vitest-environment happy-dom
+
+/**
+ * Defect under test: the restored workspace surface used to wait for the whole
+ * startup chain (SSH reconnect, PTY reconnect, legacy worker recovery) before it
+ * mounted, so a session whose tab model had been in the store for seconds painted
+ * nothing at all. Only terminal panes need that chain — they bind a PTY on mount.
+ * The surface now mounts on the tab model, and terminal tabs are held unadmitted
+ * until the gate opens and the activation plan replaces the hold.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { useRef, useState } from 'react'
+import { useAppStore } from '@/store'
+import { applyTerminalColdActivation } from '../terminal-cold-activation'
+import { useActivationDeferredTabAdmission } from './use-activation-deferred-tab-admission'
+import {
+  pruneClosedBackgroundMountTabs,
+  revealActivationDeferredTabs,
+  shouldMountBackgroundWorktreeTab
+} from './background-terminal-worktree-mount'
+import {
+  holdTerminalTabsForStartup,
+  releaseStartupTerminalTabHold,
+  selectParkedEquivalentMountTabIds,
+  type StartupTerminalTabHold
+} from './startup-terminal-tab-hold'
+import type { TabGroup, TabGroupLayoutNode } from '../../../../shared/tab-types'
+import type { TerminalTab } from '../../../../shared/terminal-tab-types'
+import type { TerminalParkingFoundation } from '../use-terminal-parking-foundation'
+
+const WORKTREE_ID = 'repo::/worktree'
+const OTHER_WORKTREE_ID = 'repo::/other-worktree'
+const TAB_1 = 'tab-1'
+const TAB_2 = 'tab-2'
+const GROUP_ID = 'group-1'
+const SURFACE_IDS = [WORKTREE_ID, OTHER_WORKTREE_ID]
+
+const initialState = useAppStore.getInitialState()
+const originalRequestIdle = globalThis.requestIdleCallback
+const originalCancelIdle = globalThis.cancelIdleCallback
+
+function terminalTab(id: string, worktreeId: string): TerminalTab {
+  return {
+    id,
+    ptyId: `${worktreeId}@@${id}`,
+    worktreeId,
+    title: id,
+    customTitle: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 1
+  }
+}
+
+function leafLayout(worktreeId: string): {
+  groups: TabGroup[]
+  layout: TabGroupLayoutNode
+} {
+  return {
+    groups: [
+      { id: GROUP_ID, worktreeId, activeTabId: TAB_1, tabOrder: [TAB_1, TAB_2], recentTabIds: [] }
+    ],
+    layout: { type: 'leaf', groupId: GROUP_ID }
+  }
+}
+
+type HarnessProps = { worktreeId: string | null; gateOpen: boolean }
+
+/** Mirrors use-terminal-controller.ts: cold activation during render, then admission. */
+function useStartupHoldHarness(props: HarnessProps) {
+  const backgroundMountTabIdsByWorktreeRef = useRef(new Map<string, ReadonlySet<string>>())
+  const activationDeferredMountTabIdsByWorktreeRef = useRef(new Map<string, ReadonlySet<string>>())
+  const lastActivationWorktreeIdRef = useRef<string | null>(null)
+  const startupTerminalTabHoldRef = useRef<StartupTerminalTabHold | null>(null)
+  const mountedWorktreeIdsRef = useRef(new Set<string>())
+  const activationDeferralPlanRevisionRef = useRef(0)
+  const [backgroundMountRevision, setBackgroundMountRevision] = useState(0)
+  const restored = leafLayout(props.worktreeId ?? WORKTREE_ID)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: applyTerminalColdActivation and the admission hook read only the fields listed here; the rest of the foundation is render machinery this harness never exercises.
+  const foundation = {
+    activationDeferralPlanRevisionRef,
+    activationDeferredMountTabIdsByWorktreeRef,
+    activeGroupIdByWorktree: props.worktreeId ? { [props.worktreeId]: GROUP_ID } : {},
+    activeTabId: TAB_1,
+    activeTabIdByWorktree: props.worktreeId ? { [props.worktreeId]: TAB_1 } : {},
+    activeWorktreeDeferralHostId: 'local',
+    activityTerminalPortals: [],
+    backgroundMountRevision,
+    backgroundMountTabIdsByWorktreeRef,
+    groupsByWorktree: props.worktreeId ? { [props.worktreeId]: restored.groups } : {},
+    hydrationSucceeded: props.gateOpen,
+    lastActivationWorktreeIdRef,
+    layoutByWorktree: props.worktreeId ? { [props.worktreeId]: restored.layout } : {},
+    mountedWorktreeIdsRef,
+    pairedRuntimeParkingEnvironmentIds: new Set<string>(),
+    pendingStartupByTabId: {},
+    renderedActiveWorktreeId: props.worktreeId,
+    setBackgroundMountRevision,
+    startupTerminalTabHoldRef,
+    startupWorktreeRefreshCompleted: props.gateOpen,
+    tabsByWorktree: useAppStore.getState().tabsByWorktree,
+    terminalParkingEnabled: true,
+    terminalTitleSnapshotAuthorityEnabled: true,
+    workspaceSessionReady: props.gateOpen,
+    workspaceSurfaceIds: SURFACE_IDS,
+    workspaceSurfaceIdSet: new Set(SURFACE_IDS)
+  } as unknown as TerminalParkingFoundation
+  const coldActivation = Object.assign(foundation, applyTerminalColdActivation(foundation))
+  useActivationDeferredTabAdmission(coldActivation)
+  return {
+    activationDeferredMountTabIdsByWorktreeRef,
+    anyMountedWorktreeHasLayout: coldActivation.anyMountedWorktreeHasLayout,
+    backgroundMountTabIdsByWorktreeRef,
+    mountedWorktreeIdsRef,
+    startupTerminalTabHold: coldActivation.startupTerminalTabHold
+  }
+}
+
+function admits(
+  restrictions: Map<string, ReadonlySet<string>>,
+  worktreeId: string,
+  tabId: string
+): boolean {
+  return shouldMountBackgroundWorktreeTab(restrictions.get(worktreeId) ?? null, tabId)
+}
+
+describe('startup terminal tab hold', () => {
+  beforeEach(() => {
+    useAppStore.setState(initialState, true)
+    useAppStore.setState({
+      tabsByWorktree: {
+        [WORKTREE_ID]: [terminalTab(TAB_1, WORKTREE_ID), terminalTab(TAB_2, WORKTREE_ID)],
+        [OTHER_WORKTREE_ID]: [terminalTab(TAB_1, OTHER_WORKTREE_ID)]
+      }
+    })
+    // Deterministic drain: force scheduleActivationDeferredAdmission onto timers.
+    // @ts-expect-error -- exercising the no-requestIdleCallback environment
+    globalThis.requestIdleCallback = undefined
+    // @ts-expect-error -- exercising the no-requestIdleCallback environment
+    globalThis.cancelIdleCallback = undefined
+    vi.useFakeTimers()
+  })
+
+  afterEach(() => {
+    cleanup()
+    vi.useRealTimers()
+    globalThis.requestIdleCallback = originalRequestIdle
+    globalThis.cancelIdleCallback = originalCancelIdle
+    useAppStore.setState(initialState, true)
+  })
+
+  it('mounts the restored surface before the gate opens and holds every terminal tab', () => {
+    const { result, rerender } = renderHook(useStartupHoldHarness, {
+      initialProps: { worktreeId: WORKTREE_ID, gateOpen: false }
+    })
+    const restrictions = result.current.backgroundMountTabIdsByWorktreeRef.current
+
+    // The surface mounts from the tab model alone...
+    expect(result.current.mountedWorktreeIdsRef.current.has(WORKTREE_ID)).toBe(true)
+    expect(result.current.anyMountedWorktreeHasLayout).toBe(true)
+    // ...while no terminal pane may bind a PTY yet, and none is idle-admission work.
+    expect(admits(restrictions, WORKTREE_ID, TAB_1)).toBe(false)
+    expect(admits(restrictions, WORKTREE_ID, TAB_2)).toBe(false)
+    expect(result.current.activationDeferredMountTabIdsByWorktreeRef.current.has(WORKTREE_ID)).toBe(
+      false
+    )
+    // Held tabs stay parked-equivalent, so watchers own their bells, titles, and completions.
+    expect(result.current.startupTerminalTabHold).toEqual({
+      worktreeId: WORKTREE_ID,
+      heldTabIds: new Set([TAB_1, TAB_2])
+    })
+    act(() => {
+      vi.advanceTimersByTime(1_000)
+    })
+    expect(admits(restrictions, WORKTREE_ID, TAB_1)).toBe(false)
+
+    // The gate opening runs the activation plan, which replaces the hold.
+    rerender({ worktreeId: WORKTREE_ID, gateOpen: true })
+    expect(result.current.mountedWorktreeIdsRef.current.has(WORKTREE_ID)).toBe(true)
+    expect(admits(restrictions, WORKTREE_ID, TAB_1)).toBe(true)
+    expect(admits(restrictions, WORKTREE_ID, TAB_2)).toBe(true)
+    expect(result.current.startupTerminalTabHold).toBeNull()
+  })
+
+  it('returns a workspace switched away from mid-startup to the unmounted world', () => {
+    const { result, rerender } = renderHook(useStartupHoldHarness, {
+      initialProps: { worktreeId: WORKTREE_ID, gateOpen: false }
+    })
+    expect(result.current.mountedWorktreeIdsRef.current.has(WORKTREE_ID)).toBe(true)
+
+    rerender({ worktreeId: OTHER_WORKTREE_ID, gateOpen: false })
+    const restrictions = result.current.backgroundMountTabIdsByWorktreeRef.current
+    expect(result.current.mountedWorktreeIdsRef.current.has(WORKTREE_ID)).toBe(false)
+    expect(restrictions.has(WORKTREE_ID)).toBe(false)
+    expect(result.current.mountedWorktreeIdsRef.current.has(OTHER_WORKTREE_ID)).toBe(true)
+    expect(admits(restrictions, OTHER_WORKTREE_ID, TAB_1)).toBe(false)
+
+    rerender({ worktreeId: OTHER_WORKTREE_ID, gateOpen: true })
+    expect(admits(restrictions, OTHER_WORKTREE_ID, TAB_1)).toBe(true)
+  })
+
+  it('returns a workspace left for no workspace mid-startup to the unmounted world', () => {
+    const initialProps: HarnessProps = { worktreeId: WORKTREE_ID, gateOpen: false }
+    const { result, rerender } = renderHook(useStartupHoldHarness, { initialProps })
+    expect(result.current.mountedWorktreeIdsRef.current.has(WORKTREE_ID)).toBe(true)
+
+    rerender({ worktreeId: null, gateOpen: false })
+    expect(result.current.mountedWorktreeIdsRef.current.has(WORKTREE_ID)).toBe(false)
+    expect(result.current.backgroundMountTabIdsByWorktreeRef.current.has(WORKTREE_ID)).toBe(false)
+    expect(result.current.startupTerminalTabHold).toBeNull()
+
+    rerender({ worktreeId: null, gateOpen: true })
+    expect(result.current.mountedWorktreeIdsRef.current.size).toBe(0)
+  })
+
+  it('keeps holding a widened hold whose targeted tab closed', () => {
+    const { result, rerender } = renderHook(useStartupHoldHarness, {
+      initialProps: { worktreeId: WORKTREE_ID, gateOpen: false }
+    })
+    const restrictions = result.current.backgroundMountTabIdsByWorktreeRef.current
+    // A targeted background mount widens the hold to its tab.
+    restrictions.set(WORKTREE_ID, new Set([TAB_1]))
+    act(() => {
+      useAppStore.setState({
+        tabsByWorktree: {
+          ...useAppStore.getState().tabsByWorktree,
+          [WORKTREE_ID]: [terminalTab(TAB_2, WORKTREE_ID)]
+        }
+      })
+    })
+    rerender({ worktreeId: WORKTREE_ID, gateOpen: false })
+
+    expect(result.current.mountedWorktreeIdsRef.current.has(WORKTREE_ID)).toBe(true)
+    expect(admits(restrictions, WORKTREE_ID, TAB_2)).toBe(false)
+    expect(result.current.startupTerminalTabHold?.heldTabIds).toEqual(new Set([TAB_2]))
+  })
+
+  it('does not mount a surface with no active workspace', () => {
+    const { result } = renderHook(useStartupHoldHarness, {
+      initialProps: { worktreeId: null, gateOpen: false }
+    })
+    expect(result.current.mountedWorktreeIdsRef.current.size).toBe(0)
+    expect(result.current.backgroundMountTabIdsByWorktreeRef.current.size).toBe(0)
+  })
+})
+
+describe('holdTerminalTabsForStartup', () => {
+  it('admits no terminal tab of a worktree that has not mounted yet', () => {
+    const hold: { current: StartupTerminalTabHold | null } = { current: null }
+    const restrictions = new Map<string, ReadonlySet<string>>()
+    const mounted = new Set<string>()
+
+    holdTerminalTabsForStartup(hold, restrictions, mounted, 'wt-active', ['tab-1'])
+
+    expect(restrictions.get('wt-active')).toEqual(new Set())
+    expect(mounted.has('wt-active')).toBe(true)
+    expect(shouldMountBackgroundWorktreeTab(restrictions.get('wt-active') ?? null, 'tab-1')).toBe(
+      false
+    )
+    expect(hold.current).toEqual({ worktreeId: 'wt-active', heldTabIds: new Set(['tab-1']) })
+  })
+
+  it('keeps a targeted background mount that landed first and never narrows a full mount', () => {
+    const hold: { current: StartupTerminalTabHold | null } = { current: null }
+    const restrictions = new Map<string, ReadonlySet<string>>([['wt-active', new Set(['tab-1'])]])
+    const mounted = new Set<string>(['wt-full'])
+
+    holdTerminalTabsForStartup(hold, restrictions, mounted, 'wt-active', ['tab-1', 'tab-2'])
+    expect(restrictions.get('wt-active')).toEqual(new Set(['tab-1']))
+    expect(hold.current?.heldTabIds).toEqual(new Set(['tab-2']))
+
+    releaseStartupTerminalTabHold(hold, restrictions, mounted, 'wt-full')
+    holdTerminalTabsForStartup(hold, restrictions, mounted, 'wt-full', ['tab-1'])
+    expect(restrictions.has('wt-full')).toBe(false)
+    expect(hold.current?.heldTabIds).toEqual(new Set())
+  })
+
+  it('keeps the held set identity while the hold is unchanged', () => {
+    const hold: { current: StartupTerminalTabHold | null } = { current: null }
+    const restrictions = new Map<string, ReadonlySet<string>>()
+    const mounted = new Set<string>()
+    holdTerminalTabsForStartup(hold, restrictions, mounted, 'wt-active', ['tab-1'])
+    const first = hold.current
+
+    holdTerminalTabsForStartup(hold, restrictions, mounted, 'wt-active', ['tab-1'])
+
+    expect(hold.current).toBe(first)
+  })
+
+  it('survives prune and reveal passes untouched', () => {
+    const hold: { current: StartupTerminalTabHold | null } = { current: null }
+    const restrictions = new Map<string, ReadonlySet<string>>()
+    const deferred = new Map<string, ReadonlySet<string>>()
+    const mounted = new Set<string>()
+    holdTerminalTabsForStartup(hold, restrictions, mounted, 'wt-active', ['tab-1'])
+
+    expect(
+      pruneClosedBackgroundMountTabs(
+        restrictions,
+        mounted,
+        { 'wt-active': [{ id: 'tab-1' }] },
+        deferred
+      )
+    ).toBe(false)
+    revealActivationDeferredTabs({
+      restrictions,
+      deferredMountTabIdsByWorktree: deferred,
+      worktreeId: 'wt-active',
+      allTabIds: ['tab-1'],
+      immediateTabIds: new Set(['tab-1'])
+    })
+    expect(restrictions.get('wt-active')).toEqual(new Set())
+    expect(mounted.has('wt-active')).toBe(true)
+  })
+
+  it('releases an unwidened hold and leaves a widened one as a targeted restriction', () => {
+    const hold: { current: StartupTerminalTabHold | null } = { current: null }
+    const restrictions = new Map<string, ReadonlySet<string>>()
+    const mounted = new Set<string>()
+    holdTerminalTabsForStartup(hold, restrictions, mounted, 'wt-previous', ['tab-1'])
+
+    releaseStartupTerminalTabHold(hold, restrictions, mounted, 'wt-previous')
+    expect(hold.current?.worktreeId).toBe('wt-previous')
+
+    releaseStartupTerminalTabHold(hold, restrictions, mounted, null)
+    expect(restrictions.has('wt-previous')).toBe(false)
+    expect(mounted.has('wt-previous')).toBe(false)
+    expect(hold.current).toBeNull()
+
+    holdTerminalTabsForStartup(hold, restrictions, mounted, 'wt-targeted', ['tab-wake', 'tab-2'])
+    restrictions.set('wt-targeted', new Set(['tab-wake']))
+    releaseStartupTerminalTabHold(hold, restrictions, mounted, 'wt-active')
+    expect(restrictions.get('wt-targeted')).toEqual(new Set(['tab-wake']))
+    expect(mounted.has('wt-targeted')).toBe(true)
+  })
+})
+
+describe('selectParkedEquivalentMountTabIds', () => {
+  const hold: StartupTerminalTabHold = { worktreeId: 'wt-held', heldTabIds: new Set(['tab-1']) }
+
+  it('prefers the activation deferral, then the hold, for the held worktree only', () => {
+    const deferred = new Set(['tab-deferred'])
+    expect(selectParkedEquivalentMountTabIds(deferred, hold, 'wt-held')).toBe(deferred)
+    expect(selectParkedEquivalentMountTabIds(undefined, hold, 'wt-held')).toBe(hold.heldTabIds)
+    expect(selectParkedEquivalentMountTabIds(undefined, hold, 'wt-other')).toBeNull()
+    expect(selectParkedEquivalentMountTabIds(undefined, null, 'wt-held')).toBeNull()
+  })
+})
diff --git a/src/renderer/src/components/terminal/startup-terminal-tab-hold.ts b/src/renderer/src/components/terminal/startup-terminal-tab-hold.ts
new file mode 100644
index 00000000000..6398911e5c3
--- /dev/null
+++ b/src/renderer/src/components/terminal/startup-terminal-tab-hold.ts
@@ -0,0 +1,77 @@
+import {
+  applyBackgroundMountTabRestriction,
+  collectDeferredMountTabIds
+} from './background-terminal-worktree-mount'
+
+export type StartupTerminalTabHold = {
+  worktreeId: string
+  /** Tabs the hold keeps unmounted — parked-equivalent, so watchers own their side effects. */
+  heldTabIds: ReadonlySet<string>
+}
+
+/**
+ * Ends the hold unless `nextHeldWorktreeId` is still the held worktree. Must run before the
+ * activation plan, which would otherwise read the hold as a plan it had installed.
+ *
+ * Why an unwidened hold unmounts: nothing but the surface was mounted under it, so a worktree
+ * switched away from — or left for no workspace — mid-startup returns to the unmounted world
+ * where parked watchers cover it. A hold a targeted background mount widened keeps that mount's
+ * tabs, like any targeted restriction.
+ */
+export function releaseStartupTerminalTabHold(
+  hold: { current: StartupTerminalTabHold | null },
+  restrictions: Map<string, ReadonlySet<string>>,
+  mountedWorktreeIds: Set<string>,
+  nextHeldWorktreeId: string | null
+): void {
+  const held = hold.current
+  if (!held || held.worktreeId === nextHeldWorktreeId) {
+    return
+  }
+  hold.current = null
+  if (restrictions.get(held.worktreeId)?.size === 0) {
+    restrictions.delete(held.worktreeId)
+    mountedWorktreeIds.delete(held.worktreeId)
+  }
+}
+
+/**
+ * Keeps the worktree's terminal tabs unmounted while startup restoration is still publishing
+ * PTY ownership, so the workspace surface can mount from the hydrated tab model without a pane
+ * binding a PTY early. Runs after prune, so no prune pass can drop the hold before render.
+ *
+ * Why an empty admitted set and no deferral entry: reveal and idle admission act only on
+ * worktrees with a deferral entry, so nothing admits a held tab until the startup gate opens
+ * and the activation plan replaces the hold. A targeted background mount widens it to its
+ * tabs, as it widens any restriction; a worktree already fully mounted is never narrowed.
+ */
+export function holdTerminalTabsForStartup(
+  hold: { current: StartupTerminalTabHold | null },
+  restrictions: Map<string, ReadonlySet<string>>,
+  mountedWorktreeIds: Set<string>,
+  worktreeId: string,
+  tabIds: readonly string[]
+): void {
+  applyBackgroundMountTabRestriction(restrictions, mountedWorktreeIds, worktreeId, [])
+  mountedWorktreeIds.add(worktreeId)
+  const heldTabIds = collectDeferredMountTabIds(restrictions.get(worktreeId) ?? null, tabIds)
+  const previous = hold.current
+  // Why reuse: the set feeds a memoized surface prop, so an unchanged hold keeps its identity.
+  if (
+    previous?.worktreeId === worktreeId &&
+    previous.heldTabIds.size === heldTabIds.size &&
+    Array.from(heldTabIds).every((tabId) => previous.heldTabIds.has(tabId))
+  ) {
+    return
+  }
+  hold.current = { worktreeId, heldTabIds }
+}
+
+/** The watcher-coverage set for a mounted worktree: activation-deferred tabs, else held tabs. */
+export function selectParkedEquivalentMountTabIds(
+  activationDeferredMountTabIds: ReadonlySet<string> | undefined,
+  hold: StartupTerminalTabHold | null,
+  worktreeId: string
+): ReadonlySet<string> | null {
+  return activationDeferredMountTabIds ?? (hold?.worktreeId === worktreeId ? hold.heldTabIds : null)
+}
diff --git a/src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts b/src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts
index b2cdcb5b2ad..82f686f851f 100644
--- a/src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts
+++ b/src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts
@@ -8,8 +8,6 @@
  * Keyboard path: Cmd+W -> TerminalPane.handleRequestClosePane -> probePtyRunningWork
  *   (split panes) or closeTerminalTab's guard (last pane) -> CloseTerminalDialog.
  */
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
@@ -92,21 +90,6 @@ describe('#10142 close confirmation policy is the same for keyboard and mouse',
     })
   })
 
-  // Control: the keyboard entry point does probe for running children.
-  it('keyboard Cmd+W path probes for running child processes before closing', () => {
-    const source = readFileSync(
-      join(__dirname, '../terminal-pane/use-terminal-pane-close-actions.ts'),
-      'utf8'
-    )
-    const handler = source.slice(source.indexOf('const handleRequestClosePane'))
-    // The shared probe, not a direct inspect: the pane path asks the same question as the tab
-    // guard, and routing both through one measurement is what stops them drifting on what an
-    // unanswered host means.
-    expect(handler.slice(0, handler.indexOf('useImperativeHandle'))).toContain(
-      'probePtyRunningWork'
-    )
-  })
-
   // Control: the harness does observe a guard when one exists — pinning blocks the same mouse close.
   it('mouse close routes a pinned tab through its confirmation guard', () => {
     const state = stateWithBusyTerminalTab(closeTab)
@@ -121,13 +104,6 @@ describe('#10142 close confirmation policy is the same for keyboard and mouse',
     expect(closeTab).not.toHaveBeenCalled()
   })
 
-  it('mouse close (X button / middle-click) consults the running-process probe', async () => {
-    closeTerminalTab('tab-busy')
-    await Promise.resolve()
-
-    expect(inspectRuntimeTerminalProcessMock).toHaveBeenCalled()
-  })
-
   it('mouse close (X button / middle-click) does not drop a busy tab without confirmation', async () => {
     closeTerminalTab('tab-busy')
     await Promise.resolve()
diff --git a/src/renderer/src/components/terminal/use-terminal-provider-snapshot-capability.test.tsx b/src/renderer/src/components/terminal/use-terminal-provider-snapshot-capability.test.tsx
index b1f6e087617..c1763411586 100644
--- a/src/renderer/src/components/terminal/use-terminal-provider-snapshot-capability.test.tsx
+++ b/src/renderer/src/components/terminal/use-terminal-provider-snapshot-capability.test.tsx
@@ -1,6 +1,4 @@
 // @vitest-environment happy-dom
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { renderHook, waitFor } from '@testing-library/react'
 import {
@@ -195,21 +193,6 @@ describe('useTerminalProviderSnapshotCapability', () => {
     hook.unmount()
   })
 
-  // Why source-pinned: the hook test cannot prove the quiet parking effect consumes the external revision.
-  it('invalidates the Terminal parking pass when a capability verdict changes', () => {
-    const projectionSource = readFileSync(
-      join(__dirname, '../use-terminal-workspace-projection.ts'),
-      'utf8'
-    )
-    const parkingSource = readFileSync(join(__dirname, '../use-terminal-parking-pass.ts'), 'utf8')
-
-    expect(projectionSource).toContain(
-      'const terminalProviderSnapshotCapabilityRevision = useTerminalProviderSnapshotCapability('
-    )
-    expect(projectionSource).toContain('terminalProviderSnapshotCapabilityRevision')
-    expect(parkingSource.match(/terminalProviderSnapshotCapabilityRevision/g)).toHaveLength(2)
-  })
-
   it('cancels an unknown-capability retry when the hook unmounts', async () => {
     vi.useFakeTimers()
     resolveCapabilities.mockResolvedValue([{ id: 'ssh:target@@pty-1', authoritative: null }])
diff --git a/src/renderer/src/components/ui/command.tsx b/src/renderer/src/components/ui/command.tsx
index 26ee5e79a4f..77b9946bed6 100644
--- a/src/renderer/src/components/ui/command.tsx
+++ b/src/renderer/src/components/ui/command.tsx
@@ -1,6 +1,7 @@
 'use client'
 
 import * as React from 'react'
+import { cva, type VariantProps } from 'class-variance-authority'
 import { Command as CommandPrimitive } from 'cmdk'
 import { SearchIcon } from 'lucide-react'
 import { Dialog as DialogPrimitive } from 'radix-ui'
@@ -207,17 +208,24 @@ function CommandGroup({
   )
 }
 
+const commandItemVariants = cva('', {
+  variants: { selection: { default: '', palette: 'jump-palette-item' } },
+  defaultVariants: { selection: 'default' }
+})
+
 function CommandItem({
   className,
+  selection,
   ref,
   ...props
-}: React.ComponentProps<typeof CommandPrimitive.Item>) {
+}: React.ComponentProps<typeof CommandPrimitive.Item> & VariantProps<typeof commandItemVariants>) {
   return (
     <CommandPrimitive.Item
       ref={ref}
       data-slot="command-item"
       className={cn(
         'relative flex cursor-default gap-2 select-none items-center rounded-sm px-2 py-1.5 text-sm outline-none data-[selected=true]:bg-accent data-[selected=true]:text-accent-foreground data-[disabled=true]:pointer-events-none data-[disabled=true]:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*="size-"])]:size-4',
+        commandItemVariants({ selection }),
         className
       )}
       {...props}
diff --git a/src/renderer/src/components/ui/popover.tsx b/src/renderer/src/components/ui/popover.tsx
index ffd2c221e85..0362e7c63ab 100644
--- a/src/renderer/src/components/ui/popover.tsx
+++ b/src/renderer/src/components/ui/popover.tsx
@@ -114,6 +114,7 @@ function PopoverContent({
   className,
   align = 'center',
   sideOffset = 4,
+  wheelScroll = false,
   portalContainer,
   style,
   onWheel,
@@ -122,6 +123,7 @@ function PopoverContent({
   ...props
 }: React.ComponentProps<typeof PopoverPrimitive.Content> & {
   portalContainer?: HTMLElement | null
+  wheelScroll?: boolean
 }) {
   const handleConsumerWheel = React.useCallback(
     (event: React.WheelEvent<HTMLDivElement>): void => {
@@ -169,6 +171,7 @@ function PopoverContent({
         // is too faint to read, so the popover blended into the background.
         className={cn(
           'z-[60] overflow-hidden rounded-md border border-black/14 bg-[rgba(255,255,255,0.82)] text-popover-foreground shadow-[0_16px_36px_rgba(0,0,0,0.24),inset_0_1px_0_rgba(255,255,255,0.14)] backdrop-blur-2xl outline-none dark:border-white/14 dark:bg-[rgba(0,0,0,0.72)] dark:shadow-[0_20px_44px_rgba(0,0,0,0.42),inset_0_1px_0_rgba(255,255,255,0.04)] data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[state=open]:animate-in data-[state=open]:fade-in-0 data-[state=open]:zoom-in-95',
+          wheelScroll && 'popover-wheel-scroll',
           className
         )}
         ref={setContentRef}
diff --git a/src/renderer/src/components/ui/textarea.tsx b/src/renderer/src/components/ui/textarea.tsx
index 5e78f5555ef..10344a85248 100644
--- a/src/renderer/src/components/ui/textarea.tsx
+++ b/src/renderer/src/components/ui/textarea.tsx
@@ -1,27 +1,35 @@
 import * as React from 'react'
+import { cva, type VariantProps } from 'class-variance-authority'
 
 import { cn } from '@/lib/utils'
 
-const Textarea = React.forwardRef<HTMLTextAreaElement, React.ComponentProps<'textarea'>>(
-  ({ className, ...props }, ref) => {
-    return (
-      <textarea
-        ref={ref}
-        data-slot="textarea"
-        // Why scrollbar-sleek here: a textarea scrolls without an overflow class,
-        // so it escapes the scrollbar lint rule and paints Chromium's default
-        // light scrollbar on dark surfaces.
-        className={cn(
-          'scrollbar-sleek min-h-16 w-full min-w-0 rounded-md border border-input bg-transparent px-3 py-2 text-base shadow-xs transition-[color,box-shadow] outline-none placeholder:text-muted-foreground/60 disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50 md:text-sm dark:bg-input/30',
-          'focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50',
-          'aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40',
-          className
-        )}
-        {...props}
-      />
-    )
-  }
-)
+const textareaVariants = cva('', {
+  variants: { variant: { default: '', code: 'font-mono' } },
+  defaultVariants: { variant: 'default' }
+})
+
+const Textarea = React.forwardRef<
+  HTMLTextAreaElement,
+  React.ComponentProps<'textarea'> & VariantProps<typeof textareaVariants>
+>(({ className, variant, ...props }, ref) => {
+  return (
+    <textarea
+      ref={ref}
+      data-slot="textarea"
+      // Why scrollbar-sleek here: a textarea scrolls without an overflow class,
+      // so it escapes the scrollbar lint rule and paints Chromium's default
+      // light scrollbar on dark surfaces.
+      className={cn(
+        'scrollbar-sleek min-h-16 w-full min-w-0 rounded-md border border-input bg-transparent px-3 py-2 text-base shadow-xs transition-[color,box-shadow] outline-none placeholder:text-muted-foreground/60 disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50 md:text-sm dark:bg-input/30',
+        'focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50',
+        'aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40',
+        textareaVariants({ variant }),
+        className
+      )}
+      {...props}
+    />
+  )
+})
 
 Textarea.displayName = 'Textarea'
 
diff --git a/src/renderer/src/components/use-task-page-jira-list-effects.test.ts b/src/renderer/src/components/use-task-page-jira-list-effects.test.ts
new file mode 100644
index 00000000000..9a1f6e4973e
--- /dev/null
+++ b/src/renderer/src/components/use-task-page-jira-list-effects.test.ts
@@ -0,0 +1,83 @@
+// @vitest-environment happy-dom
+import { act, renderHook, waitFor } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { TaskPageLinearCollectionEffectsModel } from './use-task-page-linear-collection-effects'
+import { useTaskPageJiraListEffects } from './use-task-page-jira-list-effects'
+
+const listJiraIssues = vi.fn().mockResolvedValue([])
+const searchJiraIssues = vi.fn().mockResolvedValue([])
+
+function createModel(): TaskPageLinearCollectionEffectsModel {
+  const model = {
+    settings: null,
+    setTaskResumeState: vi.fn(),
+    searchJiraIssues,
+    listJiraIssues,
+    jiraConnected: true,
+    selectedJiraSiteId: 'site-1',
+    taskSource: 'jira',
+    jiraTaskSourceContext: null,
+    jiraTaskSourceScopeKey: 'fixture',
+    jiraSearchPersistReadyRef: { current: true },
+    taskResumeApplied: true,
+    selectedJiraIssueKey: null,
+    setSelectedJiraIssueKey: vi.fn(),
+    selectedJiraIssueFallback: null,
+    setSelectedJiraIssueFallback: vi.fn(),
+    setJiraIssues: vi.fn(),
+    setJiraLoading: vi.fn(),
+    setJiraError: vi.fn(),
+    setJiraErrorDetailsOpen: vi.fn(),
+    jiraSearchInput: '',
+    appliedJiraSearch: '',
+    setAppliedJiraSearch: vi.fn(),
+    activeJiraPreset: 'assigned',
+    jiraRefreshNonce: 0,
+    setJiraProjectStatusOrder: vi.fn(),
+    displayedJiraIssues: []
+  }
+  // SAFETY: the hook only reads the Jira fields above; the preceding pipeline model is intentionally not constructed in this isolated wiring test.
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the partial fixture intentionally models only fields read by this hook.
+  return model as unknown as TaskPageLinearCollectionEffectsModel
+}
+
+describe('useTaskPageJiraListEffects refresh wiring', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    listJiraIssues.mockResolvedValue([])
+    searchJiraIssues.mockResolvedValue([])
+  })
+
+  it('passes force only for a refresh nonce change', async () => {
+    const model = createModel()
+    const { rerender } = renderHook(() => useTaskPageJiraListEffects(model))
+
+    await waitFor(() => expect(listJiraIssues).toHaveBeenCalledTimes(1))
+    expect(listJiraIssues).toHaveBeenNthCalledWith(1, 'assigned', 50, {
+      sourceContext: null,
+      force: false
+    })
+
+    await act(async () => {
+      model.jiraRefreshNonce = 1
+      rerender()
+      await Promise.resolve()
+    })
+    await waitFor(() => expect(listJiraIssues).toHaveBeenCalledTimes(2))
+    expect(listJiraIssues).toHaveBeenNthCalledWith(2, 'assigned', 50, {
+      sourceContext: null,
+      force: true
+    })
+
+    await act(async () => {
+      model.activeJiraPreset = 'reported'
+      rerender()
+      await Promise.resolve()
+    })
+    await waitFor(() => expect(listJiraIssues).toHaveBeenCalledTimes(3))
+    expect(listJiraIssues).toHaveBeenNthCalledWith(3, 'reported', 50, {
+      sourceContext: null,
+      force: false
+    })
+  })
+})
diff --git a/src/renderer/src/components/use-task-page-jira-list-effects.ts b/src/renderer/src/components/use-task-page-jira-list-effects.ts
index b39a145bd89..cd0f9a067bf 100644
--- a/src/renderer/src/components/use-task-page-jira-list-effects.ts
+++ b/src/renderer/src/components/use-task-page-jira-list-effects.ts
@@ -1,5 +1,5 @@
 import type { TaskPageLinearCollectionEffectsModel } from './use-task-page-linear-collection-effects'
-import { useEffect } from 'react'
+import { useEffect, useRef } from 'react'
 import {
   getSingleJiraProjectScope,
   getTaskPageJiraStatusOrderScopeKey,
@@ -57,6 +57,7 @@ export function useTaskPageJiraListEffects(model: TaskPageLinearCollectionEffect
       jiraQuery: appliedJiraSearch.trim()
     })
   }, [appliedJiraSearch, setTaskResumeState, taskResumeApplied, jiraSearchPersistReadyRef])
+  const previousJiraRefreshNonceRef = useRef(jiraRefreshNonce)
   useEffect(() => {
     if (!taskResumeApplied) {
       return
@@ -67,6 +68,8 @@ export function useTaskPageJiraListEffects(model: TaskPageLinearCollectionEffect
     if (!jiraConnected) {
       return
     }
+    const force = previousJiraRefreshNonceRef.current !== jiraRefreshNonce
+    previousJiraRefreshNonceRef.current = jiraRefreshNonce
     let cancelled = false
     setJiraLoading(true)
     setJiraError(null)
@@ -75,10 +78,12 @@ export function useTaskPageJiraListEffects(model: TaskPageLinearCollectionEffect
     const request =
       trimmed.length > 0
         ? searchJiraIssues(trimmed, JIRA_ITEM_LIMIT, {
-            sourceContext: jiraTaskSourceContext
+            sourceContext: jiraTaskSourceContext,
+            force
           })
         : listJiraIssues(activeJiraPreset, JIRA_ITEM_LIMIT, {
-            sourceContext: jiraTaskSourceContext
+            sourceContext: jiraTaskSourceContext,
+            force
           })
     void request
       .then((issues) => {
diff --git a/src/renderer/src/components/use-task-page-linear-list-selection.ts b/src/renderer/src/components/use-task-page-linear-list-selection.ts
index 8c8de172f9a..ae2e03f0603 100644
--- a/src/renderer/src/components/use-task-page-linear-list-selection.ts
+++ b/src/renderer/src/components/use-task-page-linear-list-selection.ts
@@ -7,7 +7,10 @@ import {
   buildLinearTeamUrl,
   getLinearOrganizationUrlKeyFromIssueUrl
 } from '../../../shared/linear/links'
-import { reconcileLinearTeamSelection } from '@/components/task-page-linear-team-selection'
+import {
+  reconcileLinearTeamSelection,
+  storedLinearTeamSelection
+} from '@/components/task-page-linear-team-selection'
 import { useTaskPageLinearFilterSelection } from './use-task-page-linear-filter-selection'
 export type TaskPageLinearListSelectionPreludeModel = ReturnType<
   typeof useTaskPageLinearListSelectionPrelude
@@ -42,7 +45,13 @@ export function useTaskPageLinearListSelectionPrelude(model: TaskPageGitLabLoadi
     linearCustomViewContentsError,
     availableTeams
   } = model
-  const defaultLinearTeamSelection = settings?.defaultLinearTeamSelection
+  // Why memoized: the normalized array feeds an effect that sets state, and a
+  // fresh array per render would re-run it every render.
+  const rawLinearTeamSelection = settings?.defaultLinearTeamSelection
+  const defaultLinearTeamSelection = useMemo(
+    () => storedLinearTeamSelection(rawLinearTeamSelection),
+    [rawLinearTeamSelection]
+  )
   const [linearTeamSelection, setLinearTeamSelection] = useState<ReadonlySet<string>>(() => {
     if (!defaultLinearTeamSelection) {
       return new Set<string>()
diff --git a/src/renderer/src/components/use-task-page-workspace-actions.ts b/src/renderer/src/components/use-task-page-workspace-actions.ts
index 2a88981b675..5e2cb6f2aab 100644
--- a/src/renderer/src/components/use-task-page-workspace-actions.ts
+++ b/src/renderer/src/components/use-task-page-workspace-actions.ts
@@ -60,7 +60,9 @@ export function useTaskPageWorkspaceActions(model: TaskPageSearchActionsModel) {
         handleUseWorkItem(item)
         return
       }
-      const result = activateAndRevealWorktree(currentAttached.id)
+      const result = activateAndRevealWorktree(currentAttached.id, {
+        navigationIntent: 'user-open'
+      })
       if (result === false) {
         toast.error(
           item.type === 'pr'
diff --git a/src/renderer/src/components/use-terminal-create-actions.test.tsx b/src/renderer/src/components/use-terminal-create-actions.test.tsx
index b12fd7730c6..0c05e2a172c 100644
--- a/src/renderer/src/components/use-terminal-create-actions.test.tsx
+++ b/src/renderer/src/components/use-terminal-create-actions.test.tsx
@@ -93,7 +93,7 @@ describe('useTerminalCreateActions creation gates', () => {
 
   it('toasts instead of duplicating a browser tab when the provider forbids it', () => {
     mocks.browserAvailability = { state: 'hidden', reason: 'no browser here' }
-    renderActions().handleDuplicateBrowserTab('browser-1')
+    renderActions().handleDuplicateBrowserTab('browser-1', 'unified-browser-1')
     expect(mocks.toastError).toHaveBeenCalledWith('no browser here')
     expect(mocks.createBrowserTab).not.toHaveBeenCalled()
   })
diff --git a/src/renderer/src/components/use-terminal-create-actions.ts b/src/renderer/src/components/use-terminal-create-actions.ts
index 0d958ce70e0..c67f7a664f3 100644
--- a/src/renderer/src/components/use-terminal-create-actions.ts
+++ b/src/renderer/src/components/use-terminal-create-actions.ts
@@ -168,7 +168,7 @@ export function useTerminalCreateActions(controller: TerminalColdActivationContr
   }, [])
 
   const handleDuplicateBrowserTab = useCallback(
-    (browserTabId: string) => {
+    (browserTabId: string, sourceUnifiedTabId: string) => {
       if (!activeWorktreeId) {
         return
       }
@@ -195,14 +195,16 @@ export function useTerminalCreateActions(controller: TerminalColdActivationContr
           worktreeId: activeWorktreeId,
           environmentId: runtimeEnvironmentId,
           url: source.url,
-          profileId: source.sessionProfileId
+          profileId: source.sessionProfileId,
+          clientAfterTabId: sourceUnifiedTabId
         }).catch(showClientCreationActionError)
         return
       }
       try {
         createBrowserTab(activeWorktreeId, source.url, {
           ...buildDuplicatedBrowserTabOptions(source),
-          ...(runtimeEnvironmentId ? { browserRuntimeEnvironmentId: null } : {})
+          ...(runtimeEnvironmentId ? { browserRuntimeEnvironmentId: null } : {}),
+          afterTabId: sourceUnifiedTabId
         })
       } catch (error) {
         showClientCreationActionError(error)
diff --git a/src/renderer/src/components/use-terminal-parking-foundation.ts b/src/renderer/src/components/use-terminal-parking-foundation.ts
index c368b299471..3123a881d20 100644
--- a/src/renderer/src/components/use-terminal-parking-foundation.ts
+++ b/src/renderer/src/components/use-terminal-parking-foundation.ts
@@ -12,6 +12,7 @@ import {
   takeAllPendingBackgroundTerminalWorktreeMounts,
   takePendingBackgroundTerminalWorktreeMount
 } from './terminal/background-terminal-worktree-mount'
+import type { StartupTerminalTabHold } from './terminal/startup-terminal-tab-hold'
 import {
   combineTerminalWorktreeParkIds,
   useManualTerminalWorktreeParking
@@ -68,6 +69,7 @@ export function useTerminalParkingFoundation(controller: TerminalEditorCloseCont
   const backgroundMountTabIdsByWorktreeRef = useRef(new Map<string, ReadonlySet<string>>())
   const activationDeferredMountTabIdsByWorktreeRef = useRef(new Map<string, ReadonlySet<string>>())
   const lastActivationWorktreeIdRef = useRef<string | null>(null)
+  const startupTerminalTabHoldRef = useRef<StartupTerminalTabHold | null>(null)
   // Why a ref, not state: the cold-activation pass runs during render, where a
   // setState would be a render-phase update; the pass returns the count instead.
   const activationDeferralPlanRevisionRef = useRef(0)
@@ -167,6 +169,7 @@ export function useTerminalParkingFoundation(controller: TerminalEditorCloseCont
     backgroundMountTabIdsByWorktreeRef,
     activationDeferredMountTabIdsByWorktreeRef,
     lastActivationWorktreeIdRef,
+    startupTerminalTabHoldRef,
     activationDeferralPlanRevisionRef
   }
 }
diff --git a/src/renderer/src/components/use-terminal-watcher-effects.ts b/src/renderer/src/components/use-terminal-watcher-effects.ts
index e840c3f9ba0..39764c87345 100644
--- a/src/renderer/src/components/use-terminal-watcher-effects.ts
+++ b/src/renderer/src/components/use-terminal-watcher-effects.ts
@@ -10,11 +10,14 @@ import {
   type ParkedTerminalTabWatcherSyncEntry
 } from './terminal-pane/terminal-parked-tab-watchers'
 import { useAppStore } from '@/store'
+import { isTerminalWorkspaceEmptiedOnPurpose } from '../../../shared/closed-terminal-tab-tombstones'
 import { gateWorktreeAgentActivation } from '@/lib/worktree-agent-activation-gate'
 import { createWorkspaceTerminalHostAuthoritySelector } from '@/lib/workspace-terminal-host-authority'
 import { getStructuredAgentLaunchStatus } from '@/lib/structured-agent-session-launch'
+import { isEmptyWorkspaceDefaultSurfacePending } from '@/lib/empty-workspace-default-surface-claims'
 import { AGENT_SESSION_PROVIDER_HANDLE_PROVIDERS } from '../../../shared/agent-session-provider-handle'
 import type { TerminalColdActivationController } from './terminal-cold-activation'
+import { selectParkedEquivalentMountTabIds } from './terminal/startup-terminal-tab-hold'
 
 // Why shared: surfaces without watchable live tabs need no per-pass allocation.
 const NO_PARKED_TAB_IDS: ReadonlySet<string> = new Set()
@@ -41,6 +44,7 @@ type TerminalWatcherController = Pick<
   | 'pendingStartupByTabId'
   | 'reconcileWorktreeTabModel'
   | 'renderedActiveWorktreeId'
+  | 'startupTerminalTabHold'
   | 'tabsByWorktree'
   | 'terminalParkingEnabled'
   | 'terminalProviderSnapshotCapabilityRevision'
@@ -73,6 +77,7 @@ export function useTerminalWatcherEffects(controller: TerminalWatcherController)
     pendingStartupByTabId,
     reconcileWorktreeTabModel,
     renderedActiveWorktreeId,
+    startupTerminalTabHold,
     tabsByWorktree,
     terminalParkingEnabled,
     terminalProviderSnapshotCapabilityRevision,
@@ -118,7 +123,11 @@ export function useTerminalWatcherEffects(controller: TerminalWatcherController)
             }
           }
         }
-        deferredTabIds = activationDeferredMountTabIdsByWorktreeRef.current.get(workspaceId) ?? null
+        deferredTabIds = selectParkedEquivalentMountTabIds(
+          activationDeferredMountTabIdsByWorktreeRef.current.get(workspaceId),
+          startupTerminalTabHold,
+          workspaceId
+        )
         for (const tab of tabs) {
           if (
             deferredTabIds?.has(tab.id) &&
@@ -172,6 +181,7 @@ export function useTerminalWatcherEffects(controller: TerminalWatcherController)
     pairedRuntimeParkingEnvironmentIds,
     pendingStartupByTabId,
     renderedActiveWorktreeId,
+    startupTerminalTabHold,
     tabsByWorktree,
     terminalParkingEnabled,
     terminalProviderSnapshotCapabilityRevision,
@@ -183,11 +193,6 @@ export function useTerminalWatcherEffects(controller: TerminalWatcherController)
   useEffect(() => () => disposeAllParkedTerminalWatchers(), [])
 
   const startupActivationGateWorktreeIdsRef = useRef(new Set<string>())
-  // Why (main): a missing row means never initialized, an explicit empty row means the user
-  // closed the last terminal — so the gate must not re-seed one in the second case.
-  const activeWorktreeHasTerminalState = activeWorktreeId
-    ? Object.hasOwn(tabsByWorktree, activeWorktreeId)
-    : false
   // Why a store subscription rather than a read inside the effects: the verdict flips to `none` the
   // moment the execution host answers, and that transition is what re-runs the passes below.
   // Why the retained selector: resolution walks the owner catalogs, so recomputing it on every store
@@ -210,16 +215,26 @@ export function useTerminalWatcherEffects(controller: TerminalWatcherController)
     if (startupActivationGateWorktreeIdsRef.current.has(activeWorktreeId)) {
       return
     }
-    startupActivationGateWorktreeIdsRef.current.add(activeWorktreeId)
     let cancelled = false
     void gateWorktreeAgentActivation(activeWorktreeId).then((outcome) => {
       if (
         cancelled ||
-        outcome !== 'empty' ||
+        outcome === 'blocked' ||
         useAppStore.getState().activeWorktreeId !== activeWorktreeId
       ) {
         return
       }
+      // A reseed awaiting agent detection owns the surface. Left unmarked: that reseed bails if the
+      // user leaves during the wait, so a later return must seed here.
+      if (outcome === 'empty' && isEmptyWorkspaceDefaultSurfacePending(activeWorktreeId)) {
+        return
+      }
+      // Why mark only once a decision applies: a cancelled or blocked check must stay retryable,
+      // and a rerun shares the gate's in-flight promise instead of repeating its work.
+      startupActivationGateWorktreeIdsRef.current.add(activeWorktreeId)
+      if (outcome !== 'empty') {
+        return
+      }
       // A pending or unanswered chat create owns the surface even before its tab is published.
       if (
         AGENT_SESSION_PROVIDER_HANDLE_PROVIDERS.some(
@@ -230,6 +245,12 @@ export function useTerminalWatcherEffects(controller: TerminalWatcherController)
       }
       // Why: the activation gate reconciles durable/live agent state first; only an actually empty, never-visited workspace receives a default shell.
       const { renderableTabCount } = reconcileWorktreeTabModel(activeWorktreeId)
+      // Why (main): only a workspace emptied by a recorded close stays empty; an empty row with no
+      // record is unknown and seeds. Read at decision time: the row can change while the check runs.
+      const activeWorktreeHasTerminalState = isTerminalWorkspaceEmptiedOnPurpose(
+        useAppStore.getState(),
+        activeWorktreeId
+      )
       if (shouldAutoCreateInitialTerminal(renderableTabCount, activeWorktreeHasTerminalState)) {
         // Why: tag this never-visited-worktree tab so its PTY spawn doesn't count as activity and reshuffle the sidebar (explicit New Tab still bumps).
         createTab(activeWorktreeId, undefined, undefined, { pendingActivationSpawn: true })
@@ -240,7 +261,6 @@ export function useTerminalWatcherEffects(controller: TerminalWatcherController)
     }
   }, [
     activeWorktreeId,
-    activeWorktreeHasTerminalState,
     activeWorktreeHostAuthority,
     createTab,
     reconcileWorktreeTabModel,
diff --git a/src/renderer/src/components/use-worktree-jump-palette-selection-actions.ts b/src/renderer/src/components/use-worktree-jump-palette-selection-actions.ts
index e0da6c158fe..822a23f9e62 100644
--- a/src/renderer/src/components/use-worktree-jump-palette-selection-actions.ts
+++ b/src/renderer/src/components/use-worktree-jump-palette-selection-actions.ts
@@ -65,10 +65,10 @@ export function useWorktreeJumpPaletteSelectionActions({
         )
         return
       }
-      const activation = activateAndRevealWorktree(
-        worktree.id,
-        executionHostId ? { executionHostId } : {}
-      )
+      const activation = activateAndRevealWorktree(worktree.id, {
+        navigationIntent: 'user-open',
+        ...(executionHostId ? { executionHostId } : {})
+      })
       recordFeatureInteraction('cmd-j-workspace-open')
       skipRestoreFocusRef.current = true
       closeModal()
diff --git a/src/renderer/src/components/use-worktree-jump-palette-worktrees.ts b/src/renderer/src/components/use-worktree-jump-palette-worktrees.ts
index 37b1decc41f..348e6b82b10 100644
--- a/src/renderer/src/components/use-worktree-jump-palette-worktrees.ts
+++ b/src/renderer/src/components/use-worktree-jump-palette-worktrees.ts
@@ -97,7 +97,10 @@ export function useWorktreeJumpPaletteWorktrees({
         if (filterPredicate && !filterPredicate.matchesWorktree(worktree)) {
           return false
         }
-        if (hideDefaultBranchWorkspace && isDefaultBranchWorkspace(worktree)) {
+        if (
+          hideDefaultBranchWorkspace &&
+          isDefaultBranchWorkspace(worktree, repoMap.get(worktree.repoId))
+        ) {
           return false
         }
         if (hideAutomationGeneratedWorkspaces && isAutomationGeneratedWorkspace(worktree)) {
@@ -143,6 +146,7 @@ export function useWorktreeJumpPaletteWorktrees({
       hideWorkspacesFromOtherDevices,
       pairedDeviceIdsByEnvironment,
       ptyIdsByTabId,
+      repoMap,
       showSleepingWorkspaces,
       tabsByWorktree,
       worktreeIdsWithLiveAgent,
diff --git a/src/renderer/src/components/virtualized-list.test.tsx b/src/renderer/src/components/virtualized-list.test.tsx
index 7320c19ea62..7de8428cef4 100644
--- a/src/renderer/src/components/virtualized-list.test.tsx
+++ b/src/renderer/src/components/virtualized-list.test.tsx
@@ -89,13 +89,13 @@ beforeEach(() => {
   root = createRoot(host)
 
   vi.stubGlobal('ResizeObserver', MockResizeObserver)
-  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(
-    function (this: HTMLElement) {
-      return this.classList.contains('overflow-auto')
-        ? VIEWPORT_HEIGHT_PX
-        : VIRTUALIZED_LIST_ROW_HEIGHT_PX
-    }
-  )
+  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(function (
+    this: HTMLElement
+  ) {
+    return this.classList.contains('overflow-auto')
+      ? VIEWPORT_HEIGHT_PX
+      : VIRTUALIZED_LIST_ROW_HEIGHT_PX
+  })
   vi.spyOn(Element.prototype, 'getBoundingClientRect').mockImplementation(function (this: Element) {
     const top = topsByElement.get(this) ?? 0
     const height = this.classList.contains('overflow-auto')
diff --git a/src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-git-evidence.ts b/src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-git-evidence.ts
index ffd41665523..5e14cd962e2 100644
--- a/src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-git-evidence.ts
+++ b/src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-git-evidence.ts
@@ -6,6 +6,7 @@ import {
   selectWorkspaceCleanupGitEvidenceTargets,
   WORKSPACE_CLEANUP_GIT_EVIDENCE_MAX_TARGETS
 } from './workspace-cleanup-git-evidence'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export type WorkspaceCleanupGitEvidenceState = {
   /** Focused re-scan results, keyed by host-qualified identity. */
@@ -79,7 +80,7 @@ export function useWorkspaceCleanupGitEvidence({
     // would silently drop the overflow ids while marking them attempted.
     const worktreeIds = queueRef.current.slice(0, WORKSPACE_CLEANUP_GIT_EVIDENCE_MAX_TARGETS)
     queueRef.current = queueRef.current.slice(worktreeIds.length)
-    const scanId = crypto.randomUUID()
+    const scanId = createBrowserUuid()
     activeScanIdRef.current = scanId
     for (const worktreeId of worktreeIds) {
       queuedRef.current.delete(worktreeId)
diff --git a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-snapshot-prune-batch.ts b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-snapshot-prune-batch.ts
index b633f610d93..9081604e714 100644
--- a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-snapshot-prune-batch.ts
+++ b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-snapshot-prune-batch.ts
@@ -1,4 +1,5 @@
 import type { WorkspaceCleanupBackgroundRemovalArgs } from './workspace-cleanup-background-removal'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export function createWorkspaceCleanupSnapshotPruneBatch():
   | WorkspaceCleanupBackgroundRemovalArgs['snapshotPruneBatch']
@@ -9,7 +10,7 @@ export function createWorkspaceCleanupSnapshotPruneBatch():
   if (typeof begin !== 'function' || typeof record !== 'function' || typeof finish !== 'function') {
     return undefined
   }
-  const batchId = crypto.randomUUID()
+  const batchId = createBrowserUuid()
   return {
     batchId,
     begin: () => begin({ batchId }),
diff --git a/src/renderer/src/components/worktree-jump-palette-recent-inclusion.test.ts b/src/renderer/src/components/worktree-jump-palette-recent-inclusion.test.ts
new file mode 100644
index 00000000000..65432478232
--- /dev/null
+++ b/src/renderer/src/components/worktree-jump-palette-recent-inclusion.test.ts
@@ -0,0 +1,85 @@
+import { describe, expect, it } from 'vitest'
+import type { WorkspaceTabPaletteSearchResult } from '@/lib/workspace-tab-palette-search'
+import type { TabPaneInputSources } from '@/components/sidebar/smart-attention'
+import type { AgentJournalTurnOutcome } from '../../../shared/agent-turn-outcome'
+import type { AgentStatusEntry } from '../../../shared/agent-status-types'
+import { shouldIncludeOpenTabInRecentSection } from './worktree-jump-palette-recent-inclusion'
+import { makeAgentEntry, makeWorktree } from './worktree-jump-palette-test-fixtures'
+
+const NOW = 1_700_000_000_000
+const TAB_ID = 'terminal-1'
+
+function currentTabResult(): WorkspaceTabPaletteSearchResult {
+  return {
+    tabId: 'unified-terminal-1',
+    entityId: TAB_ID,
+    worktreeId: 'wt-1',
+    groupId: 'group-1',
+    contentType: 'terminal',
+    occupantAgent: null,
+    title: 'Terminal',
+    secondaryText: '',
+    secondaryMatches: [],
+    repoName: 'repo/orca',
+    worktreeName: 'Palette Worktree',
+    branchName: 'main',
+    titleRanges: [],
+    secondaryRanges: [],
+    repoRanges: [],
+    worktreeRanges: [],
+    branchRanges: [],
+    typeAliasMatches: [],
+    isCurrentTab: true,
+    isCurrentWorktree: true,
+    score: 0,
+    qualityClass: null,
+    rank: null,
+    paletteIdentity: `terminal\u0000wt-1\u0000group-1\u0000unified-terminal-1`,
+    lastActiveAt: null,
+    activity: { ageBucket: null, timestamp: 0 }
+  }
+}
+
+function includesCurrentTabWith(entry: AgentStatusEntry): boolean {
+  const paneSources: TabPaneInputSources = {
+    entriesByTabId: new Map([[TAB_ID, [entry]]]),
+    ptyIdsByTabId: {},
+    runtimePaneTitlesByTabId: {}
+  }
+  return shouldIncludeOpenTabInRecentSection({
+    item: { id: 'item-1', type: 'workspace-tab', result: currentTabResult() },
+    worktree: makeWorktree('wt-1', 'Palette Worktree'),
+    row: {
+      id: TAB_ID,
+      worktreeId: 'wt-1',
+      unifiedTabId: 'unified-terminal-1',
+      terminalTab: { id: TAB_ID, title: 'zsh' },
+      worktreeLastActivityAt: 0
+    },
+    paneSources,
+    unreadTerminalTabs: {},
+    unreadAgentCompletionPanes: {},
+    now: NOW
+  })
+}
+
+function doneWith(outcome?: AgentJournalTurnOutcome): AgentStatusEntry {
+  return makeAgentEntry(
+    TAB_ID,
+    'done',
+    NOW - 1_000,
+    outcome ? { mainAgent: { state: 'done', outcome, stateStartedAt: NOW - 1_000 } } : {}
+  )
+}
+
+describe('shouldIncludeOpenTabInRecentSection', () => {
+  it('keeps the current tab out of Recent once its turn settled, a failure like a completion', () => {
+    expect(includesCurrentTabWith(doneWith())).toBe(false)
+    expect(includesCurrentTabWith(doneWith('cancellation'))).toBe(false)
+    expect(includesCurrentTabWith(doneWith('failure'))).toBe(false)
+  })
+
+  it('keeps the current tab in Recent while its agent still works', () => {
+    expect(includesCurrentTabWith(makeAgentEntry(TAB_ID, 'working', NOW - 1_000))).toBe(true)
+  })
+})
diff --git a/src/renderer/src/components/worktree-jump-palette-recent-inclusion.ts b/src/renderer/src/components/worktree-jump-palette-recent-inclusion.ts
index 61cc3960d07..41712a4c771 100644
--- a/src/renderer/src/components/worktree-jump-palette-recent-inclusion.ts
+++ b/src/renderer/src/components/worktree-jump-palette-recent-inclusion.ts
@@ -46,5 +46,6 @@ export function shouldIncludeOpenTabInRecentSection({
       unreadAgentCompletionPanes
     })
   })
-  return badge != null && badge !== 'done' && badge !== 'interrupted'
+  // Why: a settled outcome on the tab you are on is not news; a failure ranks like a completion.
+  return badge != null && badge !== 'done' && badge !== 'failed' && badge !== 'interrupted'
 }
diff --git a/src/renderer/src/components/worktree-jump-palette-sleeping-filter.test.ts b/src/renderer/src/components/worktree-jump-palette-sleeping-filter.test.ts
index 73ce01b2951..56fe90c0eb2 100644
--- a/src/renderer/src/components/worktree-jump-palette-sleeping-filter.test.ts
+++ b/src/renderer/src/components/worktree-jump-palette-sleeping-filter.test.ts
@@ -1,10 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import { isSleepingSweepExemptWorkspace } from './sidebar/visible-worktrees'
 import type { Worktree } from '../../../shared/worktree/types'
-import { readWorktreeJumpPaletteSource } from './worktree-jump-palette-source.test-support'
-
-const worktreeSource = readWorktreeJumpPaletteSource('use-worktree-jump-palette-worktrees.ts')
-const storeSource = readWorktreeJumpPaletteSource('use-worktree-jump-palette-store-state.ts')
 
 function makeWorktree(overrides: Partial<Worktree> = {}): Worktree {
   return {
@@ -30,28 +26,6 @@ function makeWorktree(overrides: Partial<Worktree> = {}): Worktree {
 }
 
 describe('Cmd+J empty-query "Hide sleeping" pass (#8873)', () => {
-  // Why source-level: the palette re-implements the sidebar's filter pass
-  // inline, so the only structural guarantee that the two agree is that both
-  // call the shared predicate. A behavioral copy here would not catch a
-  // hand-rolled duplicate creeping back in.
-  it('routes the sleeping sweep through the shared exemption predicate', () => {
-    const start = worktreeSource.indexOf('const emptyQueryVisibleWorktrees = useMemo(')
-    expect(start).toBeGreaterThanOrEqual(0)
-    const end = worktreeSource.indexOf('const { visibleWorktreesForState', start)
-    const filterPass = worktreeSource.slice(start, end)
-
-    expect(filterPass).toContain(
-      '!isSleepingSweepExemptWorkspace(worktree, alwaysShowDefaultBranchWorkspace)'
-    )
-    expect(filterPass).toContain('alwaysShowDefaultBranchWorkspace,')
-  })
-
-  it('reads the flag from the same store field the sidebar uses', () => {
-    expect(storeSource).toMatch(
-      /const alwaysShowDefaultBranchWorkspace = useAppStore\(\s*\(state\) => state\.alwaysShowDefaultBranchWorkspace\s*\)/
-    )
-  })
-
   it('exempts a project entry point by default and honours an explicit opt-out', () => {
     const main = makeWorktree()
 
diff --git a/src/renderer/src/components/worktree-jump-palette-source-context-boundary.test.ts b/src/renderer/src/components/worktree-jump-palette-source-context-boundary.test.ts
deleted file mode 100644
index 0815cc7092f..00000000000
--- a/src/renderer/src/components/worktree-jump-palette-source-context-boundary.test.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { readWorktreeJumpPaletteSource } from './worktree-jump-palette-source.test-support'
-
-const source = [
-  readWorktreeJumpPaletteSource('use-worktree-jump-palette-create-action.ts'),
-  readWorktreeJumpPaletteSource('worktree-jump-palette-create-worktree.ts')
-].join('\n')
-
-function sourceBetween(startPattern: string, endPattern: string): string {
-  const start = source.indexOf(startPattern)
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = source.indexOf(endPattern, start + startPattern.length)
-  expect(end).toBeGreaterThan(start)
-  return source.slice(start, end)
-}
-
-describe('WorktreeJumpPalette source-context boundaries', () => {
-  it('defers pasted GitHub URL resolution to the composer so cross-project detection runs', () => {
-    // Why: pasting a cross-project URL must surface the same "Switch project?"
-    // prompt as Cmd+N. The palette hands the raw URL to the composer's name
-    // field instead of pre-resolving it against an arbitrary repo, which
-    // silently linked cross-project items to the wrong project.
-    const githubLinkSection = sourceBetween('if (ghLink) {', 'if (ghNumber !== null) {')
-    expect(githubLinkSection).toContain('prefilledName: trimmed')
-    expect(githubLinkSection).not.toContain('lookupGitHubWorkItemByOwnerRepoForSource')
-  })
-
-  it('resolves typed raw issue/PR numbers through the lookup repo source host', () => {
-    expect(source).toContain('buildTaskSourceContextFromRepo')
-
-    const rawNumberSection = sourceBetween(
-      'void lookupGitHubWorkItemForSource({',
-      '.then((item) => {'
-    )
-    expect(rawNumberSection).toContain('sourceContext')
-  })
-})
diff --git a/src/renderer/src/components/worktree-jump-palette-source.test-support.ts b/src/renderer/src/components/worktree-jump-palette-source.test-support.ts
deleted file mode 100644
index 6cb92e66de6..00000000000
--- a/src/renderer/src/components/worktree-jump-palette-source.test-support.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-
-export function readWorktreeJumpPaletteSource(relativePath: string): string {
-  return readFileSync(join(__dirname, relativePath), 'utf8')
-}
diff --git a/src/renderer/src/hooks/__tests__/remote-workspace-target-sync-test-harness.ts b/src/renderer/src/hooks/__tests__/remote-workspace-target-sync-test-harness.ts
index fcc8909af3c..3884704d2a1 100644
--- a/src/renderer/src/hooks/__tests__/remote-workspace-target-sync-test-harness.ts
+++ b/src/renderer/src/hooks/__tests__/remote-workspace-target-sync-test-harness.ts
@@ -82,6 +82,7 @@ export function worktree(id = 'repo-a::/remote/work') {
 }
 
 export function appState(overrides: Record<string, unknown> = {}): AppState {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: this fixture intentionally supplies only the slices used by target-sync tests.
   return {
     workspaceSessionReady: true,
     repos: [repo()],
@@ -100,6 +101,7 @@ export function appState(overrides: Record<string, unknown> = {}): AppState {
     directSshPaneRetryByTabId: {},
     directSshLivePtyBindingByTabId: {},
     terminalLayoutsByTabId: {},
+    pendingDirectSshLayoutEditsByTabId: {},
     activeTabIdByWorktree: {},
     openFiles: [],
     editorDrafts: {},
@@ -125,6 +127,7 @@ export function appState(overrides: Record<string, unknown> = {}): AppState {
     markRemoteWorkspaceHydrated: vi.fn(),
     clearRemoteWorkspaceHydrated: vi.fn(),
     setRemoteWorkspaceSyncStatus: vi.fn(),
+    acknowledgeDirectSshLayoutEdits: vi.fn(),
     reconnectPersistedTerminals: vi.fn(async () => {}),
     ...overrides
   } as unknown as AppState
diff --git a/src/renderer/src/hooks/composer-state/attachment-drop-lifetime.test.tsx b/src/renderer/src/hooks/composer-state/attachment-drop-lifetime.test.tsx
new file mode 100644
index 00000000000..d1d7b6859d8
--- /dev/null
+++ b/src/renderer/src/hooks/composer-state/attachment-drop-lifetime.test.tsx
@@ -0,0 +1,264 @@
+// @vitest-environment happy-dom
+
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { createRef, StrictMode } from 'react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { NativeFileDropPayload } from '../../../../shared/native-file-drop'
+import { useAttachmentDropState } from './attachment-drop-state'
+
+const mocks = vi.hoisted(() => ({ toastError: vi.fn() }))
+vi.mock('sonner', () => ({ toast: { error: mocks.toastError } }))
+vi.mock('@/store', () => ({ useAppStore: { getState: () => ({}) } }))
+vi.mock('@/runtime/runtime-file-client', () => ({ importExternalPathsToRuntime: vi.fn() }))
+
+const listeners = new Set<(data: NativeFileDropPayload) => void>()
+const authorize = vi.fn(async (_input: { targetPath: string }) => {})
+const stat = vi.fn(async (_input: { filePath: string }) => ({ isDirectory: false }))
+let originalApi: PropertyDescriptor | undefined
+
+function renderDrop(strict = false) {
+  const attach = vi.fn()
+  const prompt = vi.fn()
+  const hook = renderHook(
+    () =>
+      useAttachmentDropState({
+        agentPromptRef: { current: '' },
+        cancelPromptCaretFrame: () => {},
+        connectionId: null,
+        promptCaretFrameRef: { current: null },
+        promptTextareaRef: createRef<HTMLTextAreaElement>(),
+        selectedRepoPath: '/folder-workspace',
+        selectedRepoSettings: null,
+        setAgentPrompt: prompt,
+        setAttachmentPaths: attach
+      }),
+    { wrapper: strict ? StrictMode : undefined }
+  )
+  return { ...hook, attach, prompt }
+}
+
+function nativeDrop(paths: string[]): void {
+  for (const listener of listeners) {
+    listener({ target: 'composer', paths })
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  authorize.mockReset().mockResolvedValue(undefined)
+  stat.mockReset().mockResolvedValue({ isDirectory: false })
+  originalApi = Object.getOwnPropertyDescriptor(window, 'api')
+  Object.defineProperty(window, 'api', {
+    configurable: true,
+    value: {
+      fs: { authorizeExternalPath: authorize, stat },
+      ui: {
+        onFileDrop: (listener: (data: NativeFileDropPayload) => void) => {
+          listeners.add(listener)
+          return () => listeners.delete(listener)
+        }
+      }
+    }
+  })
+})
+
+afterEach(() => {
+  cleanup()
+  expect(listeners.size).toBe(0)
+  if (originalApi) {
+    Object.defineProperty(window, 'api', originalApi)
+  } else {
+    Reflect.deleteProperty(window, 'api')
+  }
+})
+
+describe('local composer drop lifetime', () => {
+  it.each(['authorize', 'stat'] as const)(
+    'stops a large batch after unmount during %s',
+    async (phase) => {
+      const gate = Promise.withResolvers<void>()
+      if (phase === 'authorize') {
+        authorize.mockImplementationOnce(() => gate.promise)
+      } else {
+        stat.mockImplementationOnce(async () => {
+          await gate.promise
+          return { isDirectory: false }
+        })
+      }
+      const hook = renderDrop()
+      const paths = Array.from({ length: 1000 }, (_, index) => `/drop/item-${index}`)
+      const pending = hook.result.current.applyLocalComposerDrop(paths)
+      await vi.waitFor(() =>
+        expect(phase === 'authorize' ? authorize : stat).toHaveBeenCalledOnce()
+      )
+      hook.unmount()
+      gate.resolve()
+      await pending
+
+      expect(authorize).toHaveBeenCalledOnce()
+      expect(stat).toHaveBeenCalledTimes(phase === 'authorize' ? 0 : 1)
+      expect(hook.attach).not.toHaveBeenCalled()
+      expect(hook.prompt).not.toHaveBeenCalled()
+      expect(mocks.toastError).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['authorize', 'stat'] as const)(
+    'stops silently when a held %s fails after unmount',
+    async (phase) => {
+      const gate = Promise.withResolvers<never>()
+      if (phase === 'authorize') {
+        authorize.mockImplementationOnce(() => gate.promise)
+      } else {
+        stat.mockImplementationOnce(() => gate.promise)
+      }
+      const hook = renderDrop()
+      const pending = hook.result.current.applyLocalComposerDrop(['/drop/one', '/drop/two'])
+      await vi.waitFor(() =>
+        expect(phase === 'authorize' ? authorize : stat).toHaveBeenCalledOnce()
+      )
+      hook.unmount()
+      gate.reject(new Error('EACCES: no access'))
+      await pending
+
+      expect(authorize).toHaveBeenCalledOnce()
+      expect(stat).toHaveBeenCalledTimes(phase === 'authorize' ? 0 : 1)
+      expect(hook.attach).not.toHaveBeenCalled()
+      expect(mocks.toastError).not.toHaveBeenCalled()
+    }
+  )
+
+  it('does no work through a callback saved before unmount', async () => {
+    const hook = renderDrop()
+    const applyDrop = hook.result.current.applyLocalComposerDrop
+    hook.unmount()
+    await applyDrop(['/drop/late'])
+
+    expect(authorize).not.toHaveBeenCalled()
+    expect(stat).not.toHaveBeenCalled()
+    expect(hook.attach).not.toHaveBeenCalled()
+  })
+
+  it('keeps the current request pending until it settles', async () => {
+    const gate = Promise.withResolvers<void>()
+    authorize.mockImplementationOnce(() => gate.promise)
+    const hook = renderDrop()
+    const settled = vi.fn()
+    const pending = hook.result.current.applyLocalComposerDrop(['/drop/one']).then(settled)
+    hook.unmount()
+    await Promise.resolve()
+    expect(settled).not.toHaveBeenCalled()
+    gate.resolve()
+    await pending
+    expect(settled).toHaveBeenCalledOnce()
+    expect(stat).not.toHaveBeenCalled()
+  })
+
+  it('preserves mixed results, order, duplicate filtering and one failure report', async () => {
+    const order: string[] = []
+    authorize.mockImplementation(async ({ targetPath }) => {
+      order.push(`authorize:${targetPath}`)
+    })
+    stat.mockImplementation(async ({ filePath }) => {
+      order.push(`stat:${filePath}`)
+      if (filePath === '/drop/missing') {
+        throw new Error('ENOENT: missing')
+      }
+      return { isDirectory: filePath === '/drop/folder' }
+    })
+    const hook = renderDrop()
+    const paths = ['/drop/one', '/drop/folder', '/drop/missing', '/drop/two', '/drop/one']
+    await hook.result.current.applyLocalComposerDrop(paths)
+
+    expect(order).toEqual(paths.flatMap((path) => [`authorize:${path}`, `stat:${path}`]))
+    expect(hook.attach).toHaveBeenCalledOnce()
+    expect(hook.attach.mock.calls[0]?.[0](['/existing'])).toEqual([
+      '/existing',
+      '/drop/one',
+      '/drop/two'
+    ])
+    expect(hook.prompt).toHaveBeenCalledWith('/drop/folder')
+    expect(mocks.toastError).toHaveBeenCalledExactlyOnceWith(
+      '1 of 5 items could not be attached.',
+      { id: 'composer-drop-failure', description: 'No longer at its original path.' }
+    )
+  })
+})
+
+describe('native composer ownership during a local drop', () => {
+  it.each([false, true])(
+    'stops after actual listener cleanup (Strict Mode: %s)',
+    async (strict) => {
+      const gate = Promise.withResolvers<void>()
+      authorize.mockImplementationOnce(() => gate.promise)
+      const hook = renderDrop(strict)
+      act(() => nativeDrop(['/drop/one', '/drop/two']))
+      await vi.waitFor(() => expect(authorize).toHaveBeenCalledOnce())
+      hook.unmount()
+      expect(listeners.size).toBe(0)
+      await act(async () => gate.resolve())
+
+      expect(authorize).toHaveBeenCalledOnce()
+      expect(stat).not.toHaveBeenCalled()
+      expect(hook.attach).not.toHaveBeenCalled()
+    }
+  )
+
+  it('continues while temporarily covered and applies if ownership returns', async () => {
+    const first = Promise.withResolvers<void>()
+    const second = Promise.withResolvers<void>()
+    authorize
+      .mockImplementationOnce(() => first.promise)
+      .mockImplementationOnce(() => second.promise)
+    const older = renderDrop()
+    act(() => nativeDrop(['/drop/one', '/drop/two']))
+    await vi.waitFor(() => expect(authorize).toHaveBeenCalledOnce())
+    const newer = renderDrop()
+    await act(async () => first.resolve())
+    expect(authorize).toHaveBeenCalledTimes(2)
+    expect(stat).toHaveBeenCalledOnce()
+    expect(older.attach).not.toHaveBeenCalled()
+    newer.unmount()
+    await act(async () => second.resolve())
+
+    expect(older.attach).toHaveBeenCalledOnce()
+    expect(newer.attach).not.toHaveBeenCalled()
+  })
+
+  it('withholds a completed drop while a newer owner remains mounted', async () => {
+    const gate = Promise.withResolvers<void>()
+    authorize.mockImplementationOnce(() => gate.promise)
+    const older = renderDrop()
+    act(() => nativeDrop(['/drop/one', '/drop/two']))
+    await vi.waitFor(() => expect(authorize).toHaveBeenCalledOnce())
+    const newer = renderDrop()
+    await act(async () => gate.resolve())
+
+    expect(authorize).toHaveBeenCalledTimes(2)
+    expect(stat).toHaveBeenCalledTimes(2)
+    expect(older.attach).not.toHaveBeenCalled()
+    expect(newer.attach).not.toHaveBeenCalled()
+  })
+
+  it('does not revive an old batch when another composer mounts', async () => {
+    const gate = Promise.withResolvers<void>()
+    authorize.mockImplementationOnce(() => gate.promise)
+    const older = renderDrop()
+    act(() => nativeDrop(['/drop/old-one', '/drop/old-two']))
+    await vi.waitFor(() => expect(authorize).toHaveBeenCalledOnce())
+    older.unmount()
+    const newer = renderDrop()
+    await act(async () => {
+      nativeDrop(['/drop/new'])
+      gate.resolve()
+    })
+
+    expect(authorize.mock.calls.map(([input]) => input.targetPath)).toEqual([
+      '/drop/old-one',
+      '/drop/new'
+    ])
+    expect(stat.mock.calls.map(([input]) => input.filePath)).toEqual(['/drop/new'])
+    expect(older.attach).not.toHaveBeenCalled()
+    expect(newer.attach).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/renderer/src/hooks/composer-state/attachment-drop-state.ts b/src/renderer/src/hooks/composer-state/attachment-drop-state.ts
index ace0e0ba4f7..03d1f15dc24 100644
--- a/src/renderer/src/hooks/composer-state/attachment-drop-state.ts
+++ b/src/renderer/src/hooks/composer-state/attachment-drop-state.ts
@@ -28,6 +28,7 @@ import {
   type ComposerDropItemResult
 } from '../composer-drop-result'
 import { applyComposerNativeFileDrop } from '../composer-native-file-drop'
+import { useMountedRef } from '../useMountedRef'
 import { useComposerDropListener } from './composer-drop-listener'
 
 // Local drops bypass the runtime importer's skip classification.
@@ -53,6 +54,7 @@ export function useAttachmentDropState(input: AttachmentDropStateInput) {
     setAgentPrompt,
     setAttachmentPaths
   } = input
+  const mountedRef = useMountedRef()
 
   const addComposerAttachments = useCallback(
     (paths: string[]): void => {
@@ -214,8 +216,14 @@ export function useAttachmentDropState(input: AttachmentDropStateInput) {
     async (paths: string[], canApply: () => boolean = () => true): Promise<void> => {
       const results: ComposerDropItemResult[] = []
       for (const filePath of paths) {
+        if (!mountedRef.current) {
+          return
+        }
         try {
           await window.api.fs.authorizeExternalPath({ targetPath: filePath })
+          if (!mountedRef.current) {
+            return
+          }
           const stat = await window.api.fs.stat({ filePath })
           results.push({
             status: 'imported',
@@ -227,7 +235,7 @@ export function useAttachmentDropState(input: AttachmentDropStateInput) {
         }
       }
 
-      if (!canApply()) {
+      if (!mountedRef.current || !canApply()) {
         return
       }
       const dropResult = collectComposerDropResult(results)
@@ -241,7 +249,7 @@ export function useAttachmentDropState(input: AttachmentDropStateInput) {
         })
       }
     },
-    [addComposerAttachments, insertComposerFolderPaths]
+    [addComposerAttachments, insertComposerFolderPaths, mountedRef]
   )
 
   const applyNativeDrop = useCallback(
diff --git a/src/renderer/src/hooks/direct-ssh-host-catalog-noop.test.ts b/src/renderer/src/hooks/direct-ssh-host-catalog-noop.test.ts
new file mode 100644
index 00000000000..0568f79bf9b
--- /dev/null
+++ b/src/renderer/src/hooks/direct-ssh-host-catalog-noop.test.ts
@@ -0,0 +1,162 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { Repo } from '../../../shared/repo-types'
+import type { DirectSshAuthority, SshProviderEpoch } from '../../../shared/ssh-types'
+import { createTestStore } from '../store/slices/store-test-helpers'
+import { createDirectSshHostHydration } from './direct-ssh-host-hydration'
+
+const authority: DirectSshAuthority = {
+  targetId: 'target-a',
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture uses one opaque epoch identity throughout.
+  providerEpoch: 'catalog-epoch' as SshProviderEpoch,
+  connectionGeneration: 1
+}
+
+const remoteRepo: Repo = {
+  id: 'shared',
+  path: '/srv/repo',
+  displayName: 'Remote repo',
+  badgeColor: '',
+  addedAt: 1,
+  connectionId: authority.targetId,
+  executionHostId: 'ssh:target-a',
+  hookSettings: { mode: 'auto', scripts: { setup: 'echo ready', archive: '' } },
+  symlinkPaths: ['.env'],
+  repoIcon: { type: 'lucide', name: 'Box' }
+}
+
+function fixture() {
+  const localRepo: Repo = {
+    ...remoteRepo,
+    path: '/local/repo',
+    connectionId: null,
+    executionHostId: 'local'
+  }
+  const folderRepo: Repo = { ...remoteRepo, id: 'folder', kind: 'folder', path: '/srv/folder' }
+  const initialRepos = [remoteRepo, localRepo, folderRepo]
+  const store = createTestStore()
+  store.setState({
+    repos: initialRepos,
+    manualRepoOrder: [
+      { hostId: 'ssh:target-a', repoId: 'shared' },
+      { hostId: 'local', repoId: 'shared' },
+      { hostId: 'ssh:target-a', repoId: 'folder' }
+    ]
+  })
+  let fetched: readonly Repo[] = [remoteRepo, folderRepo]
+  const hydration = createDirectSshHostHydration({
+    store,
+    listRepos: async () => ({
+      authoritative: true,
+      authority: { kind: 'direct-ssh', executionHostId: 'ssh:target-a', ...authority },
+      repos: structuredClone(fetched)
+    }),
+    listLineage: vi.fn(),
+    isCurrentAuthority: () => true
+  })
+  const listener = vi.fn()
+  store.subscribe(listener)
+  return {
+    store,
+    hydration,
+    listener,
+    initialRepos,
+    localRepo,
+    folderRepo,
+    setFetched: (repos: readonly Repo[]) => {
+      fetched = repos
+    }
+  }
+}
+
+describe('direct SSH host catalog publication', () => {
+  it('does not publish cloned equal repos across twenty refreshes', async () => {
+    const { store, hydration, listener, initialRepos } = fixture()
+    const initialState = store.getState()
+    for (let index = 0; index < 20; index++) {
+      await hydration.capturePreparationInput(authority, 'wake-refresh')
+    }
+    expect(store.getState().repos).toBe(initialRepos)
+    expect(store.getState()).toBe(initialState)
+    expect(listener).not.toHaveBeenCalled()
+    hydration.stop()
+  })
+
+  it('publishes a nested change once and retains equal sibling identities', async () => {
+    const { store, hydration, listener, localRepo, folderRepo, setFetched } = fixture()
+    const changed = { ...remoteRepo, symlinkPaths: ['.env', '.env.local'] }
+    setFetched([changed, folderRepo])
+    await hydration.capturePreparationInput(authority, 'wake-refresh')
+    expect(store.getState().repos).toEqual([changed, localRepo, folderRepo])
+    expect(store.getState().repos[0]).not.toBe(remoteRepo)
+    expect(store.getState().repos[1]).toBe(localRepo)
+    expect(store.getState().repos[2]).toBe(folderRepo)
+    expect(listener).toHaveBeenCalledOnce()
+    await hydration.capturePreparationInput(authority, 'wake-refresh')
+    expect(listener).toHaveBeenCalledOnce()
+    hydration.stop()
+  })
+
+  it('removes only target rows and retains manual order when adding a repo', async () => {
+    const { store, hydration, listener, localRepo, folderRepo, setFetched } = fixture()
+    const added = { ...remoteRepo, id: 'added', path: '/srv/added' }
+    setFetched([added, folderRepo])
+    await hydration.capturePreparationInput(authority, 'wake-refresh')
+    expect(store.getState().repos).toEqual([localRepo, folderRepo, added])
+    expect(store.getState().repos[0]).toBe(localRepo)
+    expect(store.getState().repos[1]).toBe(folderRepo)
+    expect(listener).toHaveBeenCalledOnce()
+    hydration.stop()
+  })
+
+  it('still advances catalog observation revisions when rows stay equal', async () => {
+    const { hydration, listener } = fixture()
+    const first = await hydration.capturePreparationInput(authority, 'reconnect')
+    const second = await hydration.capturePreparationInput(authority, 'wake-refresh')
+    expect(first).not.toBeNull()
+    expect(second?.catalogRevision).toBe(first!.catalogRevision + 1)
+    const repoFingerprint = JSON.stringify([
+      ['ssh:target-a', 'folder'],
+      ['ssh:target-a', 'shared']
+    ])
+    expect(
+      hydration.isPreparationTokenCurrent({
+        authority,
+        catalogRevision: first!.catalogRevision,
+        repoFingerprint
+      })
+    ).toBe(false)
+    expect(
+      hydration.isPreparationTokenCurrent({
+        authority,
+        catalogRevision: second!.catalogRevision,
+        repoFingerprint
+      })
+    ).toBe(true)
+    expect(listener).not.toHaveBeenCalled()
+    hydration.stop()
+  })
+
+  // Why these two shapes: the gate must fail closed on a field no previous row carried, so a
+  // `Repo` field added after this gate landed still publishes without anyone revisiting the
+  // comparison. `'auto'` is documented as semantically identical to an absent
+  // `issueSourcePreference`, which makes it the sharpest case for the strict own-key policy.
+  it.each([
+    {
+      label: 'an optional key no previous row carried',
+      changed: { ...remoteRepo, issueSourcePreference: 'auto' } satisfies Repo
+    },
+    {
+      label: 'a nested record no previous row carried',
+      changed: { ...remoteRepo, upstream: { owner: 'octo', repo: 'remote' } } satisfies Repo
+    }
+  ])('publishes when a fetched row gains $label', async ({ changed }) => {
+    const { store, hydration, listener, folderRepo, setFetched } = fixture()
+    setFetched([changed, folderRepo])
+    await hydration.capturePreparationInput(authority, 'wake-refresh')
+    expect(listener).toHaveBeenCalledOnce()
+    expect(store.getState().repos).toContainEqual(changed)
+    await hydration.capturePreparationInput(authority, 'wake-refresh')
+    expect(listener).toHaveBeenCalledOnce()
+    hydration.stop()
+  })
+})
diff --git a/src/renderer/src/hooks/direct-ssh-host-hydration.ts b/src/renderer/src/hooks/direct-ssh-host-hydration.ts
index 2c326501760..32b97b50a55 100644
--- a/src/renderer/src/hooks/direct-ssh-host-hydration.ts
+++ b/src/renderer/src/hooks/direct-ssh-host-hydration.ts
@@ -6,7 +6,7 @@ import { applyManualRepoOrder } from '../../../shared/manual-repo-order'
 import type { DirectSshAuthority } from '../../../shared/ssh-types'
 import { isWorkspaceKey } from '../../../shared/workspace-scope'
 import type { AppState } from '../store/types'
-import { reuseEqualRecordMap } from '../store/slices/repo-identity-reconcile'
+import { reconcileFetchedRepos, reuseEqualRecordMap } from '../store/slices/repo-identity-reconcile'
 import type {
   DirectSshLineageOutcome,
   DirectSshPreparationInput,
@@ -66,13 +66,14 @@ function mergeExactHostCatalog(state: AppState, snapshot: HostRepoCatalogSnapsho
   const hostId = snapshot.authority.executionHostId
   // Why re-apply the overlay: re-appending the host's rows puts them at the tail, which would
   // undo the user's manual cross-host order on every connect.
-  return {
-    ...state,
-    repos: applyManualRepoOrder(
+  const repos = reconcileFetchedRepos(
+    state.repos,
+    applyManualRepoOrder(
       [...state.repos.filter((repo) => getRepoExecutionHostId(repo) !== hostId), ...snapshot.repos],
       state.manualRepoOrder
     )
-  }
+  )
+  return repos === state.repos ? state : { ...state, repos }
 }
 
 // Why: the host owns every in-scope key, so drop the stale in-scope rows, overlay the snapshot's,
diff --git a/src/renderer/src/hooks/ipc-events-agent-status-store-test-fixtures.ts b/src/renderer/src/hooks/ipc-events-agent-status-store-test-fixtures.ts
index 7cabf081db9..8f676cada26 100644
--- a/src/renderer/src/hooks/ipc-events-agent-status-store-test-fixtures.ts
+++ b/src/renderer/src/hooks/ipc-events-agent-status-store-test-fixtures.ts
@@ -47,6 +47,7 @@ export type AgentStatusSetData = {
   connectionId?: string | null
   receivedAt: number
   stateStartedAt: number
+  turnStartedAt?: number
 }
 export type StoreLike = Record<string, unknown>
 export type StoreSubscribeListener = (state: StoreLike, previousState: StoreLike) => void
diff --git a/src/renderer/src/hooks/ipc-events-close-routing-test-harness.ts b/src/renderer/src/hooks/ipc-events-close-routing-test-harness.ts
index 3883f7ac8af..249e435b9a4 100644
--- a/src/renderer/src/hooks/ipc-events-close-routing-test-harness.ts
+++ b/src/renderer/src/hooks/ipc-events-close-routing-test-harness.ts
@@ -3,6 +3,7 @@
    calls back out would duplicate them into all 4 specs. */
 import type * as ReactModule from 'react'
 import { vi } from 'vitest'
+import type { TerminalSurfaceCloseTarget } from '../../../shared/terminal-surface-close-target'
 
 export type RequestTabCloseListener = (data: {
   requestId: string
@@ -12,7 +13,7 @@ export type RequestTabCloseListener = (data: {
 export type CloseActiveTabListener = (payload?: { sourceId: string }) => void
 export type CloseFloatingItemListener = (payload: { sourceId: string }) => void
 export type SelectFloatingIndexListener = (payload: { index: number }) => void
-export type CloseTerminalListener = (data: { tabId: string; paneRuntimeId?: number | null }) => void
+export type CloseTerminalListener = (target: TerminalSurfaceCloseTarget) => void
 export type CloseSessionTabListener = (data: { tabId: string; worktreeId: string }) => void
 export type SessionTabCloseRequestListener = (data: {
   requestId: string
diff --git a/src/renderer/src/hooks/ipc-events/agent-status-event-applicator.ts b/src/renderer/src/hooks/ipc-events/agent-status-event-applicator.ts
index 47aa5521a26..41957078f41 100644
--- a/src/renderer/src/hooks/ipc-events/agent-status-event-applicator.ts
+++ b/src/renderer/src/hooks/ipc-events/agent-status-event-applicator.ts
@@ -227,7 +227,8 @@ export function createAgentStatusEventApplicator(args: {
         ...(data.evidenceObservedAt !== undefined
           ? { evidenceObservedAt: data.evidenceObservedAt }
           : {}),
-        stateStartedAt: data.stateStartedAt
+        stateStartedAt: data.stateStartedAt,
+        ...(Number.isFinite(data.turnStartedAt) ? { turnStartedAt: data.turnStartedAt } : {})
       },
       routing: {
         tabId: ownerTabId,
diff --git a/src/renderer/src/hooks/ipc-events/browser-state-ipc-bridge.ts b/src/renderer/src/hooks/ipc-events/browser-state-ipc-bridge.ts
index 47da67cdc85..f5560403269 100644
--- a/src/renderer/src/hooks/ipc-events/browser-state-ipc-bridge.ts
+++ b/src/renderer/src/hooks/ipc-events/browser-state-ipc-bridge.ts
@@ -1,5 +1,6 @@
 import { rememberLiveBrowserUrl } from '@/components/browser-pane/describe-page/live-browser-url-registry'
 import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
+import { resolveBrowserSourceUnifiedTab } from '@/lib/browser-workspace-source-resolution'
 import { redactKagiSessionToken } from '../../../../shared/browser-url'
 import { useAppStore } from '../../store'
 import {
@@ -121,9 +122,18 @@ export function registerBrowserStateIpcBridge(
       const sourceTab = (store.browserTabsByWorktree[sourcePage.worktreeId] ?? []).find(
         (tab) => tab.id === sourcePage.workspaceId
       )
+      const sourceUnifiedTab = resolveBrowserSourceUnifiedTab(
+        store,
+        browserPageId,
+        sourcePage.worktreeId
+      )
       store.createBrowserTab(sourcePage.worktreeId, url, {
         title: url,
         activate: activate ?? true,
+        ...(sourceUnifiedTab ? { afterTabId: sourceUnifiedTab.id } : {}),
+        ...(sourceUnifiedTab?.executionHostId
+          ? { executionHostId: sourceUnifiedTab.executionHostId }
+          : {}),
         ...(sourceTab
           ? {
               sessionProfileId: sourceTab.sessionProfileId,
diff --git a/src/renderer/src/hooks/ipc-events/browser-state-open-link-profile.test.ts b/src/renderer/src/hooks/ipc-events/browser-state-open-link-profile.test.ts
index 446a0dc7435..9db3d4ee5f5 100644
--- a/src/renderer/src/hooks/ipc-events/browser-state-open-link-profile.test.ts
+++ b/src/renderer/src/hooks/ipc-events/browser-state-open-link-profile.test.ts
@@ -80,6 +80,12 @@ describe('link-opened Orca tabs', () => {
           }
         ]
       },
+      unifiedTabsByWorktree: {
+        'worktree-1': [
+          { id: 'unified-1', entityId: 'workspace-1', contentType: 'browser', groupId: 'group-1' }
+        ]
+      },
+      groupsByWorktree: { 'worktree-1': [{ id: 'group-1', tabOrder: ['unified-1'] }] },
       createBrowserTab: createBrowserTabMock
     }
 
@@ -89,6 +95,7 @@ describe('link-opened Orca tabs', () => {
       'worktree-1',
       'https://docs.example.com/guide',
       expect.objectContaining({
+        afterTabId: 'unified-1',
         sessionProfileId: 'profile-client-a',
         sessionPartition: 'persist:orca-browser-session-client-a'
       })
diff --git a/src/renderer/src/hooks/ipc-events/direct-ssh-connect-reply-routing.test.ts b/src/renderer/src/hooks/ipc-events/direct-ssh-connect-reply-routing.test.ts
new file mode 100644
index 00000000000..85023d75f4f
--- /dev/null
+++ b/src/renderer/src/hooks/ipc-events/direct-ssh-connect-reply-routing.test.ts
@@ -0,0 +1,291 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { useAppStore } from '@/store'
+import type {
+  DirectSshAuthority,
+  SshConnectionState,
+  SshProviderEpoch
+} from '../../../../shared/ssh-types'
+import { createDirectSshBridgeRuntime } from './direct-ssh-bridge-runtime'
+import { registerDirectSshStateIpcBridge } from './direct-ssh-state-ipc-bridge'
+
+function connectedState(
+  targetId = 'target-a',
+  generation = 1
+): SshConnectionState & DirectSshAuthority {
+  return {
+    targetId,
+    status: 'connected',
+    error: null,
+    reconnectAttempt: 0,
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Tests issue a fixed opaque provider token for each target.
+    providerEpoch: `epoch-${targetId}` as SshProviderEpoch,
+    connectionGeneration: generation
+  }
+}
+
+function authority(state: DirectSshAuthority): DirectSshAuthority {
+  return {
+    targetId: state.targetId,
+    providerEpoch: state.providerEpoch,
+    connectionGeneration: state.connectionGeneration
+  }
+}
+
+async function settle(): Promise<void> {
+  for (let index = 0; index < 60; index += 1) {
+    await Promise.resolve()
+  }
+}
+
+const originalStore = useAppStore.getState()
+const cleanups: (() => void)[] = []
+
+async function createHarness(
+  initialStates: readonly SshConnectionState[] = [],
+  reconciledStates: readonly SshConnectionState[] = []
+) {
+  const states = new Map(initialStates.map((state) => [state.targetId, state]))
+  const reconciled = new Map(reconciledStates.map((state) => [state.targetId, state]))
+  let stateListener: ((event: { targetId: string; state: unknown }) => void) | undefined
+  const getState = vi.fn(async ({ targetId }: { targetId: string }) => {
+    const state = states.get(targetId) ?? null
+    const next = reconciled.get(targetId)
+    if (next) {
+      states.set(targetId, next)
+    }
+    return state
+  })
+  const targets = ['target-a', 'target-b'].map((id) => ({ id, label: id }))
+  vi.stubGlobal('window', {
+    addEventListener: () => {},
+    removeEventListener: () => {},
+    api: {
+      ui: {},
+      repos: {},
+      worktrees: {},
+      ssh: {
+        listTargets: async () => targets,
+        listRemovedTargetLabels: async () => ({}),
+        getState,
+        listPortForwards: async () => [],
+        listDetectedPorts: async () => [],
+        onCredentialRequest: () => () => {},
+        onCredentialResolved: () => () => {},
+        onPortForwardsChanged: () => () => {},
+        onDetectedPortsChanged: () => () => {},
+        onStateChanged: (listener: typeof stateListener) => {
+          stateListener = listener
+          return () => {}
+        }
+      }
+    }
+  })
+  const store = useAppStore.getState()
+  const invalidate = vi.spyOn(store, 'invalidateStaleDirectSshTargetPtyBindings').mockReturnValue(1)
+  const retry = vi.spyOn(store, 'retryDirectSshTargetPanes').mockReturnValue(1)
+  const clearBindings = vi.spyOn(store, 'clearDirectSshTargetPtyBindings').mockReturnValue(1)
+  const runtime = createDirectSshBridgeRuntime()
+  const requestReconnect = vi.spyOn(runtime.reconnectCoordinator, 'requestReconnect')
+  const prepareAndSync = vi.spyOn(runtime, 'prepareAndSync')
+  const unsubs: (() => void)[] = []
+  cleanups.push(() => {
+    for (const unsubscribe of unsubs) {
+      unsubscribe()
+    }
+    runtime.stop()
+  })
+  registerDirectSshStateIpcBridge(unsubs, runtime)
+  await settle()
+  return {
+    runtime,
+    getState,
+    invalidate,
+    retry,
+    clearBindings,
+    requestReconnect,
+    prepareAndSync,
+    emit: (state: SshConnectionState) => {
+      if (!stateListener) {
+        throw new Error('SSH state listener was not registered')
+      }
+      stateListener({ targetId: state.targetId, state })
+    },
+    applyConnectReply: (state: SshConnectionState) => {
+      useAppStore.getState().setSshConnectionState(state.targetId, state)
+    }
+  }
+}
+
+beforeEach(() => {
+  useAppStore.setState(originalStore, true)
+})
+
+afterEach(async () => {
+  for (const cleanup of cleanups.splice(0)) {
+    cleanup()
+  }
+  await settle()
+  vi.restoreAllMocks()
+  useAppStore.setState(originalStore, true)
+  vi.unstubAllGlobals()
+})
+
+describe('direct SSH connect reply routing', () => {
+  it.each(['reply-first', 'push-first'] as const)(
+    'retries through the real coordinator once when connection ordering is %s',
+    async (ordering) => {
+      const harness = await createHarness()
+      const state = connectedState()
+      if (ordering === 'reply-first') {
+        harness.applyConnectReply(state)
+      }
+      harness.emit(state)
+      if (ordering === 'push-first') {
+        harness.applyConnectReply(state)
+      }
+
+      expect(harness.requestReconnect).toHaveBeenCalledExactlyOnceWith(authority(state))
+      expect(harness.invalidate).toHaveBeenCalledExactlyOnceWith(authority(state))
+      expect(harness.retry).toHaveBeenCalledExactlyOnceWith(authority(state))
+      expect(harness.runtime.reconnectAuthorityByTarget.get(state.targetId)).toEqual(
+        authority(state)
+      )
+      await settle()
+
+      harness.retry.mockClear()
+      harness.emit({ ...state })
+
+      expect(harness.requestReconnect).toHaveBeenCalledOnce()
+      expect(harness.invalidate).toHaveBeenCalledOnce()
+      expect(harness.retry).toHaveBeenCalledExactlyOnceWith(authority(state))
+      expect(harness.prepareAndSync).toHaveBeenLastCalledWith(authority(state), 'wake-refresh')
+    }
+  )
+
+  it('keeps hydration preparation-only and corrects its duplicate without requesting reconnect', async () => {
+    const state = connectedState()
+    const harness = await createHarness([state])
+
+    expect(harness.prepareAndSync).toHaveBeenCalledExactlyOnceWith(
+      authority(state),
+      'initial-hydration'
+    )
+    expect(harness.requestReconnect).not.toHaveBeenCalled()
+    expect(harness.invalidate).not.toHaveBeenCalled()
+    expect(harness.retry).not.toHaveBeenCalled()
+
+    harness.emit({ ...state })
+
+    expect(harness.requestReconnect).not.toHaveBeenCalled()
+    expect(harness.retry).toHaveBeenCalledExactlyOnceWith(authority(state))
+    expect(harness.runtime.reconnectAuthorityByTarget.size).toBe(0)
+
+    const next = connectedState(state.targetId, 2)
+    harness.applyConnectReply(next)
+    harness.retry.mockClear()
+    harness.emit(next)
+
+    expect(harness.requestReconnect).toHaveBeenCalledExactlyOnceWith(authority(next))
+    expect(harness.retry).toHaveBeenCalledExactlyOnceWith(authority(next))
+  })
+
+  it.each(['disconnected', 'error'] as const)(
+    'forgets a routed authority after %s even when the next connect reply reaches the store first',
+    async (status) => {
+      const state = connectedState()
+      const harness = await createHarness([state])
+      harness.emit({ ...state, status })
+
+      expect(harness.clearBindings).toHaveBeenCalledExactlyOnceWith(state.targetId)
+      harness.applyConnectReply(state)
+      harness.emit(state)
+
+      expect(harness.requestReconnect).toHaveBeenCalledExactlyOnceWith(authority(state))
+      expect(harness.retry).toHaveBeenCalledExactlyOnceWith(authority(state))
+      expect(harness.runtime.reconnectAuthorityByTarget.get(state.targetId)).toEqual(
+        authority(state)
+      )
+    }
+  )
+
+  it.each(['providerEpoch', 'connectionGeneration'] as const)(
+    'preserves initial hydration routing when %s must be reconciled',
+    async (missingField) => {
+      const state = connectedState()
+      const partial: SshConnectionState = { ...state }
+      delete partial[missingField]
+      const harness = await createHarness([partial], [state])
+
+      expect(useAppStore.getState().sshConnectionStates.get(state.targetId)).toEqual(state)
+      expect(harness.prepareAndSync).toHaveBeenCalledExactlyOnceWith(
+        authority(state),
+        'initial-hydration'
+      )
+      expect(harness.requestReconnect).not.toHaveBeenCalled()
+      expect(harness.retry).not.toHaveBeenCalled()
+
+      harness.emit(state)
+
+      expect(harness.requestReconnect).not.toHaveBeenCalled()
+      expect(harness.retry).toHaveBeenCalledExactlyOnceWith(authority(state))
+      expect(harness.runtime.reconnectAuthorityByTarget.size).toBe(0)
+    }
+  )
+
+  it.each(['providerEpoch', 'connectionGeneration'] as const)(
+    'waits for partial authority reconciliation when %s is missing',
+    async (missingField) => {
+      const harness = await createHarness()
+      const state = connectedState()
+      let resolveState!: (state: SshConnectionState) => void
+      harness.getState.mockImplementationOnce(
+        () =>
+          new Promise((resolve) => {
+            resolveState = resolve
+          })
+      )
+      harness.applyConnectReply(state)
+      const partial: SshConnectionState = { ...state }
+      delete partial[missingField]
+      harness.emit(partial)
+
+      expect(harness.requestReconnect).not.toHaveBeenCalled()
+      expect(harness.retry).not.toHaveBeenCalled()
+      resolveState(state)
+      await settle()
+
+      expect(harness.requestReconnect).toHaveBeenCalledExactlyOnceWith(authority(state))
+      expect(harness.invalidate).toHaveBeenCalledExactlyOnceWith(authority(state))
+      expect(harness.retry).toHaveBeenCalledWith(authority(state))
+      harness.emit(state)
+      expect(harness.requestReconnect).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('keeps routed authorities and disconnect cleanup separate for each target', async () => {
+    const harness = await createHarness()
+    const first = connectedState('target-a')
+    const second = connectedState('target-b')
+    for (const state of [first, second]) {
+      harness.applyConnectReply(state)
+      harness.emit(state)
+    }
+    await settle()
+    expect(harness.requestReconnect.mock.calls).toEqual([[authority(first)], [authority(second)]])
+
+    harness.emit({ ...first, status: 'disconnected' })
+    harness.retry.mockClear()
+    harness.emit(second)
+
+    expect(harness.requestReconnect).toHaveBeenCalledTimes(2)
+    expect(harness.retry).toHaveBeenCalledExactlyOnceWith(authority(second))
+    expect(harness.runtime.reconnectAuthorityByTarget.get(second.targetId)).toEqual(
+      authority(second)
+    )
+    expect(harness.runtime.reconnectAuthorityByTarget.has(first.targetId)).toBe(false)
+
+    harness.applyConnectReply(first)
+    harness.emit(first)
+    expect(harness.requestReconnect).toHaveBeenNthCalledWith(3, authority(first))
+  })
+})
diff --git a/src/renderer/src/hooks/ipc-events/direct-ssh-state-ipc-bridge.ts b/src/renderer/src/hooks/ipc-events/direct-ssh-state-ipc-bridge.ts
index 11ceff832fc..2efacc7765d 100644
--- a/src/renderer/src/hooks/ipc-events/direct-ssh-state-ipc-bridge.ts
+++ b/src/renderer/src/hooks/ipc-events/direct-ssh-state-ipc-bridge.ts
@@ -22,6 +22,8 @@ export function registerDirectSshStateIpcBridge(
     prepareAndSync
   } = runtime
   const sshStateWatermarkByTargetId = new Map<string, number>()
+  // Connect replies can update the store before this bridge routes the matching push.
+  const routedAuthorityByTarget = new Map<string, DirectSshAuthority>()
   const pendingPortHydrationByTargetId = new Map<
     string,
     { receivedForwardPush: boolean; receivedDetectedPush: boolean }
@@ -152,10 +154,10 @@ export function registerDirectSshStateIpcBridge(
     origin: DirectSshConnectedStateOrigin
   ): void => {
     const store = useAppStore.getState()
-    const previous = store.sshConnectionStates?.get(targetId)
     store.setSshConnectionState(targetId, state)
 
     if (canConnectSshStatus(state.status)) {
+      routedAuthorityByTarget.delete(targetId)
       reconnectAuthorityByTarget.delete(targetId)
       reconnectCoordinator.invalidate(targetId)
       store.clearRemoteDetectedAgents(targetId)
@@ -175,16 +177,8 @@ export function registerDirectSshStateIpcBridge(
       reconcileSshAuthority(targetId, state, origin, sshStateWatermarkByTargetId.get(targetId) ?? 0)
       return
     }
-    const previousAuthority =
-      previous?.status === 'connected' &&
-      previous.providerEpoch &&
-      previous.connectionGeneration !== undefined
-        ? {
-            targetId,
-            providerEpoch: previous.providerEpoch,
-            connectionGeneration: previous.connectionGeneration
-          }
-        : null
+    const previousAuthority = routedAuthorityByTarget.get(targetId) ?? null
+    routedAuthorityByTarget.set(targetId, authority)
     routeDirectSshConnectedState(
       {
         coordinator: reconnectCoordinator,
@@ -235,6 +229,7 @@ export function registerDirectSshStateIpcBridge(
           }
           const latestStore = useAppStore.getState()
           if (!targets.some((target) => target.id === data.targetId)) {
+            routedAuthorityByTarget.delete(data.targetId)
             latestStore.clearRemovedSshTargetState(data.targetId)
             return
           }
diff --git a/src/renderer/src/hooks/ipc-events/host-session-tab-target.ts b/src/renderer/src/hooks/ipc-events/host-session-tab-target.ts
new file mode 100644
index 00000000000..86397dd464d
--- /dev/null
+++ b/src/renderer/src/hooks/ipc-events/host-session-tab-target.ts
@@ -0,0 +1,13 @@
+import { LOCAL_STRUCTURED_SESSION_OWNER } from '@/runtime/local-structured-session-owner'
+import { resolveLocalTabIdForHostSessionTab } from '@/runtime/web-session-tabs-sync/tracking-mappings'
+
+/** Main addresses its own session-tab ids; a mirrored chat tab lives here under a different id. */
+export function resolveWindowTabIdForHostTab(worktreeId: string, tabId: string): string {
+  return (
+    resolveLocalTabIdForHostSessionTab({
+      environmentId: LOCAL_STRUCTURED_SESSION_OWNER,
+      worktreeId,
+      hostTabId: tabId
+    }) ?? tabId
+  )
+}
diff --git a/src/renderer/src/hooks/ipc-events/mobile-terminal-close-ipc-bridge.ts b/src/renderer/src/hooks/ipc-events/mobile-terminal-close-ipc-bridge.ts
index aaf1686e702..43a7e590558 100644
--- a/src/renderer/src/hooks/ipc-events/mobile-terminal-close-ipc-bridge.ts
+++ b/src/renderer/src/hooks/ipc-events/mobile-terminal-close-ipc-bridge.ts
@@ -1,5 +1,4 @@
-import { CLOSE_TERMINAL_PANE_EVENT } from '@/constants/terminal'
-import type { CloseTerminalPaneDetail } from '@/constants/terminal'
+import { applyClosedTerminalLeafNotice } from '@/components/terminal-pane/closed-terminal-leaf-notice'
 import { closeTerminalTab } from '@/components/terminal/terminal-tab-actions'
 import { detectLanguage } from '@/lib/language-detect'
 import { runSleepWorktree } from '@/components/sidebar/sleep-worktree-flow'
@@ -53,14 +52,12 @@ export function registerMobileAndTerminalCloseIpcBridge(
   )
 
   unsubs.push(
-    window.api.ui.onCloseTerminal(({ tabId, paneRuntimeId }) => {
-      if (paneRuntimeId != null) {
-        // Why: route pane closes via the lifecycle hook for sibling promotion (falls through to closeTab on the last pane).
-        const detail: CloseTerminalPaneDetail = { tabId, paneRuntimeId }
-        window.dispatchEvent(new CustomEvent(CLOSE_TERMINAL_PANE_EVENT, { detail }))
+    window.api.ui.onCloseTerminal((target) => {
+      if (target.kind === 'pane') {
+        applyClosedTerminalLeafNotice(target.tabId, target.leafId)
       } else {
         // Why: the CLI/RPC caller is answered immediately, so it cannot wait on a modal.
-        closeTerminalTab(tabId, { skipRunningProcessConfirm: true })
+        closeTerminalTab(target.tabId, { skipRunningProcessConfirm: true })
       }
     })
   )
diff --git a/src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge-ownership.test.ts b/src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge-ownership.test.ts
new file mode 100644
index 00000000000..cd1b231da18
--- /dev/null
+++ b/src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge-ownership.test.ts
@@ -0,0 +1,179 @@
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { useAppStore } from '@/store'
+import { subscribeRuntimeEnvironmentFromPreload } from '../../../../preload/runtime-environment-subscriptions'
+import { tagRuntimeSubscriptionReplayResponse } from '../../../../shared/runtime-subscription-replay'
+import { createCompatibleRuntimeStatusResponse } from '@/runtime/runtime-compatibility-test-fixture'
+import { registerRuntimeClientIpcBridge } from './runtime-client-ipc-bridge'
+
+const initialState = useAppStore.getState()
+
+beforeEach(() => vi.useFakeTimers())
+afterEach(() => {
+  useAppStore.setState(initialState, true)
+  vi.useRealTimers()
+  vi.unstubAllGlobals()
+})
+
+function createHarness() {
+  type Ipc = Parameters<typeof subscribeRuntimeEnvironmentFromPreload>[0]
+  type Args = Parameters<typeof subscribeRuntimeEnvironmentFromPreload>[1]
+  type Callbacks = Parameters<typeof subscribeRuntimeEnvironmentFromPreload>[2]
+  let listener: Parameters<Ipc['on']>[1] | undefined
+  const pending: ReturnType<typeof Promise.withResolvers<unknown>>[] = []
+  const issueRead = Promise.withResolvers<null>()
+  const ipc: Ipc = {
+    invoke: vi.fn((channel) => {
+      if (channel !== 'runtimeEnvironments:subscribe') {
+        return Promise.resolve()
+      }
+      const setup = Promise.withResolvers<unknown>()
+      pending.push(setup)
+      return setup.promise
+    }),
+    send: vi.fn(),
+    on: (_channel, callback) => {
+      listener = callback
+    },
+    removeListener: vi.fn()
+  }
+  const getIssue = vi.fn(() => issueRead.promise)
+  const refreshStatus = vi.fn(async () => true)
+  let nextId = 0
+  vi.stubGlobal('window', {
+    api: {
+      runtimeEnvironments: {
+        subscribe: (args: Args, callbacks: Callbacks) =>
+          subscribeRuntimeEnvironmentFromPreload(ipc, args, callbacks, () => `sub-${nextId++}`),
+        call: vi.fn(async () => ({ id: 'r', ok: true, result: [] }))
+      },
+      linear: { getIssue }
+    }
+  })
+  const status = createCompatibleRuntimeStatusResponse()
+  if (!status.ok) {
+    throw new Error('expected valid runtime status fixture')
+  }
+  useAppStore.setState({
+    settings: null,
+    runtimeEnvironments: [
+      {
+        id: 'host-a',
+        name: 'Host A',
+        createdAt: 1,
+        updatedAt: 1,
+        lastUsedAt: null,
+        runtimeId: null,
+        endpoints: [
+          { id: 'ws-a', kind: 'websocket', label: 'WS', endpoint: 'ws://example.invalid' }
+        ],
+        preferredEndpointId: 'ws-a'
+      }
+    ],
+    runtimeStatusByEnvironmentId: new Map([['host-a', { status: status.result, checkedAt: 1 }]]),
+    linearIssueCache: {},
+    linearSearchCache: {},
+    linearListCache: {},
+    linearProjectIssueCache: {},
+    linearCustomViewIssueCache: {},
+    checkLinearConnection: vi.fn(async () => {}),
+    refreshRuntimeEnvironmentStatus: refreshStatus
+  })
+  const starts: (() => void)[] = []
+  const start = (): (() => void) => {
+    const unsubs: (() => void)[] = []
+    const unsubscribeStore = registerRuntimeClientIpcBridge(unsubs, {
+      worktreeChangeRefreshQueue: { enqueue: vi.fn(), dispose: vi.fn() },
+      activateNotifiedWorktree: vi.fn(async () => {})
+    })
+    const stop = (): void => {
+      unsubscribeStore()
+      unsubs.forEach((unsubscribe) => unsubscribe())
+    }
+    starts.push(stop)
+    return stop
+  }
+  return {
+    start,
+    getIssue,
+    refreshStatus,
+    pending,
+    ipc,
+    emit: (index: number, replay = false) => {
+      const response = {
+        id: 'r',
+        ok: true as const,
+        _meta: { runtimeId: 'remote-runtime' },
+        result: {
+          type: 'linearLinkedIssueUpdated',
+          identifier: 'ISSUE-1',
+          workspaceId: 'workspace-a'
+        }
+      }
+      listener?.(null, {
+        subscriptionId: `sub-${index}`,
+        type: 'response',
+        response: replay ? tagRuntimeSubscriptionReplayResponse(response) : response
+      })
+    },
+    finish: async () => {
+      starts.forEach((stop) => stop())
+      pending.forEach((setup, index) =>
+        setup.resolve({ subscriptionId: `sub-${index}`, requestId: 'r' })
+      )
+      issueRead.resolve(null)
+      for (let index = 0; index < 30; index += 1) {
+        await Promise.resolve()
+      }
+    }
+  }
+}
+
+it('does no Linear read dispatch or cache publication after cleanup while setup is pending', async () => {
+  const h = createHarness()
+  let publications = 0
+  const stopCounting = useAppStore.subscribe((state, previous) => {
+    if (state.linearIssueCache !== previous.linearIssueCache) {
+      publications += 1
+    }
+  })
+  try {
+    h.start()()
+    for (let index = 0; index < 100; index += 1) {
+      h.emit(0)
+    }
+    expect(h.getIssue).not.toHaveBeenCalled()
+    expect(publications).toBe(0)
+  } finally {
+    stopCounting()
+    await h.finish()
+  }
+  expect(h.ipc.removeListener).toHaveBeenCalledOnce()
+})
+
+it('does no replay recovery or resubscription after cleanup', async () => {
+  const h = createHarness()
+  try {
+    h.start()()
+    h.emit(0, true)
+    expect(h.refreshStatus).not.toHaveBeenCalled()
+    expect(h.pending).toHaveLength(1)
+    expect(h.getIssue).not.toHaveBeenCalled()
+  } finally {
+    await h.finish()
+  }
+})
+
+it('accepts a fresh bridge early frame while rejecting the previous bridge frame', async () => {
+  const h = createHarness()
+  try {
+    h.start()()
+    h.start()
+    h.emit(0)
+    h.emit(1)
+    expect(h.getIssue).toHaveBeenCalledOnce()
+    expect(h.getIssue).toHaveBeenCalledWith({ id: 'ISSUE-1', workspaceId: 'workspace-a' })
+  } finally {
+    await h.finish()
+  }
+  expect(h.ipc.removeListener).toHaveBeenCalledOnce()
+})
diff --git a/src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge.ts b/src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge.ts
index a5db87bbce1..ae014d70230 100644
--- a/src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge.ts
+++ b/src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge.ts
@@ -137,7 +137,7 @@ export function registerRuntimeClientIpcBridge(
   const runtimeClientEventsSync = createRuntimeClientEventsSync({
     getDesiredEnvironmentIds: () => getRuntimeClientEventEnvironmentIds(useAppStore.getState()),
     getSubscriptionKey: (environmentId) => buildRuntimeClientEventEnvironmentKey([environmentId]),
-    subscribe: (environmentId, onEvent, onError) => {
+    subscribe: (environmentId, onEvent, onError, isCurrent) => {
       const sshGeneration = getEnvironmentSshStateGeneration(environmentId)
       const runtimeGeneration = getRuntimeEnvironmentConnectionGeneration(environmentId)
       const runtimeRevision = getRuntimeEnvironmentRevision(environmentId)
@@ -154,6 +154,9 @@ export function registerRuntimeClientIpcBridge(
         },
         onError,
         () => {
+          if (!isCurrent()) {
+            return
+          }
           invalidateRuntimeClientEventReplay({
             getSshStateReference: () => useAppStore.getState().sshStateByEnvironment,
             refreshRuntimeStatus: () => {
diff --git a/src/renderer/src/hooks/ipc-events/session-tab-ipc-bridge.ts b/src/renderer/src/hooks/ipc-events/session-tab-ipc-bridge.ts
index 47464072034..7cd2b65efb9 100644
--- a/src/renderer/src/hooks/ipc-events/session-tab-ipc-bridge.ts
+++ b/src/renderer/src/hooks/ipc-events/session-tab-ipc-bridge.ts
@@ -13,6 +13,7 @@ import {
 } from '../../store/pinned-tab-close-guard'
 import { useAppStore } from '../../store'
 import { resolveBrowserSessionTabTarget } from './browser-session-tab-target'
+import { resolveWindowTabIdForHostTab } from './host-session-tab-target'
 
 export function registerSessionTabIpcBridge(unsubs: (() => void)[]): void {
   unsubs.push(
@@ -20,8 +21,9 @@ export function registerSessionTabIpcBridge(unsubs: (() => void)[]): void {
       if (isLocalSessionTabCloseOwned(worktreeId, tabId)) {
         return
       }
+      const localTabId = resolveWindowTabIdForHostTab(worktreeId, tabId)
       const store = useAppStore.getState()
-      const browserTarget = resolveBrowserSessionTabTarget(store, worktreeId, tabId)
+      const browserTarget = resolveBrowserSessionTabTarget(store, worktreeId, localTabId)
       if (browserTarget) {
         guardPinnedTabClose({
           isPinned: isUnifiedTabPinned(store, worktreeId, browserTarget.workspaceId),
@@ -31,11 +33,11 @@ export function registerSessionTabIpcBridge(unsubs: (() => void)[]): void {
         return
       }
       guardPinnedTabClose({
-        isPinned: isUnifiedTabPinned(store, worktreeId, tabId),
-        tabLabel: resolvePinnedTabLabel(store, worktreeId, tabId),
+        isPinned: isUnifiedTabPinned(store, worktreeId, localTabId),
+        tabLabel: resolvePinnedTabLabel(store, worktreeId, localTabId),
         onClose: () => {
           const currentStore = useAppStore.getState()
-          closeMobileSessionTabInStore(currentStore, worktreeId, tabId)
+          closeMobileSessionTabInStore(currentStore, worktreeId, localTabId)
         }
       })
     })
@@ -43,8 +45,9 @@ export function registerSessionTabIpcBridge(unsubs: (() => void)[]): void {
 
   unsubs.push(
     window.api.ui.onSessionTabCloseRequest(({ requestId, tabId, worktreeId, expiresAt }) => {
+      const localTabId = resolveWindowTabIdForHostTab(worktreeId, tabId)
       const store = useAppStore.getState()
-      const browserTarget = resolveBrowserSessionTabTarget(store, worktreeId, tabId)
+      const browserTarget = resolveBrowserSessionTabTarget(store, worktreeId, localTabId)
       let cancelConfirmation: (() => void) | undefined
       let timeout: ReturnType<typeof setTimeout> | undefined
       let settled = false
@@ -78,7 +81,11 @@ export function registerSessionTabIpcBridge(unsubs: (() => void)[]): void {
             respond()
             return
           }
-          const closed = closeMobileSessionTabInStore(useAppStore.getState(), worktreeId, tabId)
+          const closed = closeMobileSessionTabInStore(
+            useAppStore.getState(),
+            worktreeId,
+            localTabId
+          )
           respond(closed ? undefined : SESSION_TAB_NOT_FOUND_ERROR)
         } catch (error) {
           respond(error instanceof Error ? error.message : SESSION_TAB_CLOSE_FAILED_ERROR)
@@ -92,7 +99,7 @@ export function registerSessionTabIpcBridge(unsubs: (() => void)[]): void {
         )
         return
       }
-      const visibleId = browserTarget?.workspaceId ?? tabId
+      const visibleId = browserTarget?.workspaceId ?? localTabId
       cancelConfirmation = guardPinnedTabClose({
         isPinned: isUnifiedTabPinned(store, worktreeId, visibleId),
         tabLabel: resolvePinnedTabLabel(store, worktreeId, visibleId),
diff --git a/src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge.ts b/src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge.ts
index 85460c88841..29ddc098726 100644
--- a/src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge.ts
+++ b/src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge.ts
@@ -9,6 +9,7 @@ import { activateTabAndFocusPane } from '@/lib/activate-tab-and-focus-pane'
 import { useAppStore } from '../../store'
 import type { AppState } from '../../store/types'
 import { resolveBrowserSessionTabTarget } from './browser-session-tab-target'
+import { resolveWindowTabIdForHostTab } from './host-session-tab-target'
 import {
   activateTerminalInitiatedWorktree,
   focusTerminalInitiatedTab
@@ -146,9 +147,12 @@ export function registerTerminalUiRoutingIpcBridge(unsubs: (() => void)[]): void
 
   unsubs.push(
     window.api.ui.onFocusEditorTab(({ tabId, worktreeId, userInitiated }) => {
+      const localTabId = resolveWindowTabIdForHostTab(worktreeId, tabId)
       const store = useAppStore.getState()
-      const tab = (store.unifiedTabsByWorktree[worktreeId] ?? []).find((item) => item.id === tabId)
-      const browserTarget = resolveBrowserSessionTabTarget(store, worktreeId, tabId)
+      const tab = (store.unifiedTabsByWorktree[worktreeId] ?? []).find(
+        (item) => item.id === localTabId
+      )
+      const browserTarget = resolveBrowserSessionTabTarget(store, worktreeId, localTabId)
       // Why: chat-completion focus is a courtesy reveal, not navigation — never yank the user
       // back into a workspace they deliberately left. A notification click is the opposite: the
       // user asked for this workspace, and the activateWorktree that precedes it is async, so
diff --git a/src/renderer/src/hooks/ipc-events/workspace-shortcut-ipc-bridge.ts b/src/renderer/src/hooks/ipc-events/workspace-shortcut-ipc-bridge.ts
index 9e78916fef3..496f885ebbb 100644
--- a/src/renderer/src/hooks/ipc-events/workspace-shortcut-ipc-bridge.ts
+++ b/src/renderer/src/hooks/ipc-events/workspace-shortcut-ipc-bridge.ts
@@ -93,11 +93,10 @@ export function registerWorkspaceShortcutIpcBridge(unsubs: (() => void)[]): void
       const visibleTargets = getVisibleWorktreeShortcutTargets()
       const target = visibleTargets[index]
       if (target) {
-        if (target.executionHostId) {
-          activateAndRevealWorkspace(target.id, { executionHostId: target.executionHostId })
-        } else {
-          activateAndRevealWorkspace(target.id)
-        }
+        activateAndRevealWorkspace(target.id, {
+          navigationIntent: 'user-open',
+          ...(target.executionHostId ? { executionHostId: target.executionHostId } : {})
+        })
       }
     })
   )
diff --git a/src/renderer/src/hooks/remote-workspace-session-merge-close-tombstones.test.ts b/src/renderer/src/hooks/remote-workspace-session-merge-close-tombstones.test.ts
index a1e82633f98..5fbdd00ffed 100644
--- a/src/renderer/src/hooks/remote-workspace-session-merge-close-tombstones.test.ts
+++ b/src/renderer/src/hooks/remote-workspace-session-merge-close-tombstones.test.ts
@@ -33,32 +33,28 @@ function sessionState(overrides: Partial<WorkspaceSessionState> = {}): Workspace
   } as WorkspaceSessionState
 }
 
+// Records ride on `current` here for brevity; the caller passes the renderer's read-only mirror.
 function merge(
   current: WorkspaceSessionState,
   remote: WorkspaceSessionState,
-  liveTabs: AppState['tabsByWorktree'] = {},
-  remoteRevision?: number
+  liveTabs: AppState['tabsByWorktree'] = {}
 ): WorkspaceSessionState {
   return mergeDirectSshRemoteWorkspaceSession(
-    current,
+    { ...current, closedTerminalTabTombstonesByTabId: undefined },
     remote,
     new Set([WORKTREE]),
     liveTabs,
     new Set(),
     undefined,
-    remoteRevision
+    current.closedTerminalTabTombstonesByTabId
   )
 }
 
-function tombstone(tabId: string, ackRevision?: number): WorkspaceSessionState {
+function tombstone(tabId: string): WorkspaceSessionState {
   return sessionState({
     tabsByWorktree: { [WORKTREE]: [] },
     closedTerminalTabTombstonesByTabId: {
-      [tabId]: {
-        closedAt: Date.now(),
-        worktreeId: WORKTREE,
-        ...(ackRevision ? { ackRevision } : {})
-      }
+      [tabId]: { closedAt: Date.now(), worktreeId: WORKTREE }
     }
   })
 }
@@ -77,7 +73,7 @@ describe('direct-SSH pull merge: closed-tab tombstones', () => {
       remoteSessionIdsByTabId: { toString: 'session-1' }
     })
 
-    const merged = merge(current, remote, {}, 2)
+    const merged = merge(current, remote, {})
 
     expect(merged.tabsByWorktree[WORKTREE]?.map((tab) => tab.id)).toEqual(['toString'])
     expect(Object.hasOwn(merged.terminalLayoutsByTabId, 'toString')).toBe(true)
@@ -96,7 +92,7 @@ describe('direct-SSH pull merge: closed-tab tombstones', () => {
     })
     const remote = sessionState({ tabsByWorktree: { [WORKTREE]: [terminalTab('tab-x')] } })
 
-    const merged = merge(current, remote, {}, 2)
+    const merged = merge(current, remote, {})
 
     expect(merged.tabsByWorktree[WORKTREE]?.map((tab) => tab.id)).toEqual(['tab-x'])
   })
@@ -109,12 +105,11 @@ describe('direct-SSH pull merge: closed-tab tombstones', () => {
       remoteSessionIdsByTabId: { ghost: 'pty-1' }
     })
 
-    const merged = merge(tombstone('ghost'), remote, { [WORKTREE]: [] }, 3)
+    const merged = merge(tombstone('ghost'), remote, { [WORKTREE]: [] })
 
     expect(merged.tabsByWorktree[WORKTREE]).toEqual([])
     expect(merged.terminalLayoutsByTabId.ghost).toBeUndefined()
     expect(merged.remoteSessionIdsByTabId?.ghost).toBeUndefined()
-    expect(merged.closedTerminalTabTombstonesByTabId?.ghost).toBeDefined()
   })
 
   it('does not re-add a tombstoned tab through the host-unknown branch', () => {
@@ -127,7 +122,7 @@ describe('direct-SSH pull merge: closed-tab tombstones', () => {
     })
     const remote = sessionState({ tabsByWorktree: { [WORKTREE]: [] } })
 
-    const merged = merge(current, remote, {}, 3)
+    const merged = merge(current, remote, {})
 
     expect(merged.tabsByWorktree[WORKTREE]).toEqual([])
   })
@@ -143,7 +138,7 @@ describe('direct-SSH pull merge: closed-tab tombstones', () => {
       activeTabIdByWorktree: { [WORKTREE]: 'ghost' }
     })
 
-    const merged = merge(tombstone('ghost'), remote, { [WORKTREE]: [] }, 3)
+    const merged = merge(tombstone('ghost'), remote, { [WORKTREE]: [] })
 
     expect(merged.tabsByWorktree[WORKTREE].map((tab) => tab.id)).toEqual(['survivor'])
   })
@@ -156,37 +151,20 @@ describe('direct-SSH pull merge: closed-tab tombstones', () => {
     })
     const remote = sessionState({ tabsByWorktree: { [WORKTREE]: [live] } })
 
-    const merged = merge(current, remote, { [WORKTREE]: [live] }, 3)
+    const merged = merge(current, remote, { [WORKTREE]: [live] })
 
     expect(merged.tabsByWorktree[WORKTREE].map((tab) => tab.id)).toEqual(['live'])
   })
 
-  it('leaves a tab alone when no tombstone names it', () => {
-    // The pre-existing absence-is-not-closed trade, restated: a host that still lists a tab closed
-    // on some other client keeps it here, because absence is all this merge would have to go on.
-    const agent = terminalTab('agent')
-    const closedElsewhere = terminalTab('closed-elsewhere')
-    const current = sessionState({ tabsByWorktree: { [WORKTREE]: [agent, closedElsewhere] } })
-    const remote = sessionState({ tabsByWorktree: { [WORKTREE]: [agent] } })
-
-    const merged = merge(current, remote, { [WORKTREE]: [agent, closedElsewhere] }, 3)
-
-    expect(merged.tabsByWorktree[WORKTREE].map((tab) => tab.id)).toContain('closed-elsewhere')
-  })
-
-  it('retires the tombstone once a newer snapshot stops listing the tab', () => {
-    const remote = sessionState({ tabsByWorktree: { [WORKTREE]: [] } })
-
-    const merged = merge(tombstone('ghost', 3), remote, { [WORKTREE]: [] }, 4)
+  it('neither retires nor writes back a record once the host stops listing the tab', () => {
+    // Main alone writes records; an acknowledgement used to delete them here, which made a workspace
+    // the user emptied read as never initialized as soon as the host caught up.
+    const current = tombstone('ghost')
+    const merged = merge(current, sessionState({ tabsByWorktree: { [WORKTREE]: [] } }), {
+      [WORKTREE]: []
+    })
 
     expect(merged.closedTerminalTabTombstonesByTabId).toBeUndefined()
-  })
-
-  it('keeps the tombstone when the snapshot omits the worktree entirely', () => {
-    // A snapshot that says nothing about the worktree — including one whose path never resolved —
-    // is not evidence the host saw the close.
-    const merged = merge(tombstone('ghost', 3), sessionState(), {}, 4)
-
-    expect(merged.closedTerminalTabTombstonesByTabId?.ghost).toBeDefined()
+    expect(current.closedTerminalTabTombstonesByTabId?.ghost).toBeDefined()
   })
 })
diff --git a/src/renderer/src/hooks/remote-workspace-session-merge-closed-terminal-tombstone.test.ts b/src/renderer/src/hooks/remote-workspace-session-merge-closed-terminal-tombstone.test.ts
index 3764181e71c..ff817913da4 100644
--- a/src/renderer/src/hooks/remote-workspace-session-merge-closed-terminal-tombstone.test.ts
+++ b/src/renderer/src/hooks/remote-workspace-session-merge-closed-terminal-tombstone.test.ts
@@ -15,9 +15,10 @@ import { useAppStore } from '@/store'
  * The closed-last-terminal tombstone across a direct-SSH reconnect, end to end.
  *
  * The unit-level rule lives in remote-workspace-session-merge-local-survival.test.ts; this asserts
- * what that rule is FOR. `Object.hasOwn(tabsByWorktree, worktreeId)` has to keep meaning one thing
- * — the merge dropping the key turned "the user closed the last terminal" into "never
- * initialized", and the seeding pass then handed the terminal back on every reconnect.
+ * what that rule is FOR. An empty row plus a close record has to keep meaning one thing — the
+ * merge dropping the key, or the re-hydration dropping the record, turns "the user closed the last
+ * terminal" into "never initialized", and the seeding pass then hands the terminal back on every
+ * reconnect.
  */
 const initialAppStoreState = useAppStore.getState()
 
@@ -26,9 +27,13 @@ afterEach(() => {
   useAppStore.setState(initialAppStoreState, true)
 })
 
-/** The state a workspace lands in once its last terminal is closed: an explicit empty row. */
+/** The state a workspace lands in once its last terminal is closed: an explicit empty row, and
+ *  the close record the renderer mirrors from main. */
 function seedClosedLastTerminal(worktreeId: string): void {
-  useAppStore.setState({ tabsByWorktree: { [worktreeId]: [] } })
+  useAppStore.setState({
+    tabsByWorktree: { [worktreeId]: [] },
+    closedTerminalTabTombstonesByTabId: { closed: { closedAt: Date.now(), worktreeId } }
+  })
   expect(useAppStore.getState().reconcileWorktreeTabModel(worktreeId).renderableTabCount).toBe(0)
 }
 
diff --git a/src/renderer/src/hooks/remote-workspace-session-merge.ts b/src/renderer/src/hooks/remote-workspace-session-merge.ts
index 1932ad30eca..f8bbb0d5ab1 100644
--- a/src/renderer/src/hooks/remote-workspace-session-merge.ts
+++ b/src/renderer/src/hooks/remote-workspace-session-merge.ts
@@ -1,6 +1,9 @@
 import type { TerminalTab } from '../../../shared/terminal-tab-types'
 import type { WorkspaceSessionState } from '../../../shared/workspace-session-state-types'
-import { reconcileClosedTerminalTabTombstones } from '../../../shared/closed-terminal-tab-tombstones'
+import {
+  hasClosedTerminalTabRecord,
+  type ClosedTerminalTabTombstonesByTabId
+} from '../../../shared/closed-terminal-tab-tombstones'
 import type { ExecutionHostId } from '../../../shared/execution-host'
 import { worktreeWorkspaceKey } from '../../../shared/workspace-scope'
 import { splitWorktreeId } from '../../../shared/worktree/id'
@@ -33,7 +36,8 @@ export function mergeDirectSshRemoteWorkspaceSession(
   liveTabsByWorktree: AppState['tabsByWorktree'],
   preserveLocalTerminalTabIds: ReadonlySet<string>,
   replaceExecutionHostId?: ExecutionHostId,
-  remoteRevision?: number
+  closedTabRecords?: ClosedTerminalTabTombstonesByTabId,
+  preserveLocalLayoutTabIds: ReadonlySet<string> = new Set()
 ): WorkspaceSessionState {
   // Live tabs across the worktrees this snapshot replaces. Close-suppression consults it so a tab
   // that is still live locally always beats its own tombstone.
@@ -44,7 +48,7 @@ export function mergeDirectSshRemoteWorkspaceSession(
   //      (terminal-tab-close.ts), so a tombstoned id is not live anywhere;
   //   2. isSuppressedByClose matches the tombstone's own worktreeId, so it cannot reach another
   //      workspace's tab even if an id somehow recurred;
-  //   3. only closeReason === 'user' ever writes a tombstone.
+  //   3. only a tab close writes a record; nothing infers one from a tab's absence.
   // A final sweep of suppression over the assembled tabsByWorktree — including worktrees
   // omitTargetWorktrees passes through verbatim — is still deliberately absent.
   const currentTabsById = new Map(
@@ -55,10 +59,10 @@ export function mergeDirectSshRemoteWorkspaceSession(
   const locallyPreservedTabIds = new Set<string>()
   const localTabsFor = (worktreeId: string): TerminalTab[] =>
     liveTabsByWorktree[worktreeId] ?? current.tabsByWorktree[worktreeId] ?? []
-  // Why presence and not length: an explicit empty row is the record that the user closed the last
-  // terminal (initial-terminal.ts), and localTabsFor cannot tell it from an absent one. Admitting
-  // only non-empty rows dropped the key, which reads downstream as "never initialized" and seeds a
-  // fresh terminal on every reconnect.
+  // Why presence and not length: an explicit empty row, with a close record for the worktree, is how
+  // a workspace the user emptied reads (initial-terminal.ts), and localTabsFor cannot tell it from an
+  // absent one. Admitting only non-empty rows dropped the key, which reads downstream as "never
+  // initialized" and seeds a fresh terminal on every reconnect.
   const hasLocalTabsRow = (worktreeId: string): boolean =>
     Object.hasOwn(liveTabsByWorktree, worktreeId) ||
     Object.hasOwn(current.tabsByWorktree, worktreeId)
@@ -115,36 +119,13 @@ export function mergeDirectSshRemoteWorkspaceSession(
       .filter(([tabId]) => remoteKnownTabIds.has(tabId))
       .map(([, sessionId]) => sessionId)
   )
-  // The other half of the trade below. Absence still cannot say "closed", so this says it instead:
-  // a tab THIS client watched the user close, whose close never reached the host. Only ids the user
-  // closed are ever in here, and only until the host's own snapshot stops listing them.
-  const closedTerminalTabTombstonesByTabId = reconcileClosedTerminalTabTombstones({
-    tombstones: current.closedTerminalTabTombstonesByTabId,
-    acknowledgedWorktreeIds: new Set(
-      [...replaceWorktreeIds].filter((worktreeId) =>
-        Object.hasOwn(remote.tabsByWorktree, worktreeId)
-      )
-    ),
-    hostKnownTabIds: remoteKnownTabIds,
-    hostRevision: remoteRevision,
-    now: Date.now()
-  })
-  // Why Object.hasOwn and not `in`: the map is a plain object from Object.fromEntries, so `in`
-  // answers true for every Object.prototype key on an EMPTY map — a host tab whose id is
-  // `toString` would be filtered, blocked from the host-unknown branch, and stripped of its layout
-  // and session id. Tab ids are validated only as non-empty and colon-free, and createTab honours
-  // caller-supplied id hints, so that id is reachable. This is the one place either direction could
-  // delete a tab the user never closed.
-  // Why the worktree comparison: the tombstone already carries the worktree it was closed in, so
-  // scoping on it makes "this suppression cannot reach another workspace's tab" structural rather
-  // than a property of where the call sites happen to sit.
-  // Why a live local tab still overrides its own tombstone: an id that is live here means the
-  // tombstone is stale (a close undone before it persisted), not a revival. Deleting a live pane is
-  // the one outcome this whole function exists to avoid.
+  // The other half of the trade below. Absence still cannot say "closed", so main's close record
+  // says it instead. Read only here: main alone writes records, and nothing acknowledges them away.
+  // Scoped to the record's own worktree, so suppression cannot reach another workspace's tab.
+  // Why a live local tab still overrides its record: an id that is live here means the record is
+  // stale, not a revival. Deleting a live pane is the one outcome this function exists to avoid.
   const isSuppressedByClose = (tabId: string, worktreeId: string): boolean =>
-    Object.hasOwn(closedTerminalTabTombstonesByTabId, tabId) &&
-    closedTerminalTabTombstonesByTabId[tabId]?.worktreeId === worktreeId &&
-    !currentTabsById.has(tabId)
+    hasClosedTerminalTabRecord(closedTabRecords, tabId, worktreeId) && !currentTabsById.has(tabId)
   // Ids this merge actually suppressed, recorded as it walks the worktrees. The layout and
   // session-id sweeps below have no worktree in scope, so they consult decisions already made
   // rather than re-deriving one without the scope that makes it safe.
@@ -243,15 +224,16 @@ export function mergeDirectSshRemoteWorkspaceSession(
         )
       })
     )
+  const preservedLayoutTabIds = new Set([...locallyPreservedTabIds, ...preserveLocalLayoutTabIds])
   const terminalLayoutsByTabId = {
     ...Object.fromEntries(
       Object.entries(current.terminalLayoutsByTabId).filter(
-        ([tabId]) => !replacedTabIds.has(tabId) || locallyPreservedTabIds.has(tabId)
+        ([tabId]) => !replacedTabIds.has(tabId) || preservedLayoutTabIds.has(tabId)
       )
     ),
     ...Object.fromEntries(
       Object.entries(remote.terminalLayoutsByTabId)
-        .filter(([tabId]) => !locallyPreservedTabIds.has(tabId) && !suppressedTabIds.has(tabId))
+        .filter(([tabId]) => !preservedLayoutTabIds.has(tabId) && !suppressedTabIds.has(tabId))
         // Why: this replace is wholesale, and a park capture does not bump tab.generation, so a
         // just-parked tab is not locally preserved and the only client-side copy of its remote
         // scrollback would go with its layout. Structure stays the host's.
@@ -269,10 +251,9 @@ export function mergeDirectSshRemoteWorkspaceSession(
   // the workspace or its path did not resolve to a local id, and taking that literally drops the
   // user onto the home screen while their terminals keep running. So it is only overridden when the
   // workspace they are standing in demonstrably still exists in the merged result.
-  // Why presence and not length, the same reading `hasLocalTabsRow` above already gives: an
-  // explicit empty row is the record that the user closed the last terminal, and a workspace they
-  // emptied still exists in the merged result. Counting rows sent them to the home screen for
-  // having closed their last tab.
+  // Why presence and not length, the same reading `hasLocalTabsRow` above already gives: a
+  // workspace the user emptied keeps an explicit empty row, so it still exists in the merged
+  // result. Counting rows sent them to the home screen for having closed their last tab.
   const localActiveWorkspaceSurvives =
     current.activeWorktreeId != null &&
     replaceWorktreeIds.has(current.activeWorktreeId) &&
@@ -346,11 +327,7 @@ export function mergeDirectSshRemoteWorkspaceSession(
       // tabs. Removal is the worktree-teardown path's job, not a reconnect's.
       ...current.defaultTerminalTabsAppliedByWorktreeId,
       ...remote.defaultTerminalTabsAppliedByWorktreeId
-    },
-    closedTerminalTabTombstonesByTabId:
-      Object.keys(closedTerminalTabTombstonesByTabId).length > 0
-        ? closedTerminalTabTombstonesByTabId
-        : undefined
+    }
   }
 }
 
diff --git a/src/renderer/src/hooks/remote-workspace-snapshot-apply-deferred-session-write.test.ts b/src/renderer/src/hooks/remote-workspace-snapshot-apply-deferred-session-write.test.ts
index 9b78320a9be..020d7d43c92 100644
--- a/src/renderer/src/hooks/remote-workspace-snapshot-apply-deferred-session-write.test.ts
+++ b/src/renderer/src/hooks/remote-workspace-snapshot-apply-deferred-session-write.test.ts
@@ -9,6 +9,8 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as AgentStatusModule from '@/lib/agent-status'
 import type { RemoteWorkspaceObservedSnapshot } from '../../../shared/remote-workspace-types'
+import { toAppSshPtyId } from '../../../shared/ssh-pty-id'
+import type { TerminalLayoutSnapshot } from '../../../shared/terminal-tab-types'
 import type { DirectSshAuthority, SshProviderEpoch } from '../../../shared/ssh-types'
 import { createTestStore, makeWorktree } from '../store/slices/store-test-helpers'
 import {
@@ -139,11 +141,15 @@ describe('session writes deferred by a direct-SSH apply', () => {
     vi.useRealTimers()
   })
 
-  async function applyTargetA(store: TestStore, onApplied: () => void): Promise<void> {
-    await applyDirectSshRemoteWorkspaceSnapshot({
+  async function applyTargetA(
+    store: TestStore,
+    onApplied: () => void,
+    remote = snapshot(1)
+  ): Promise<void> {
+    const result = await applyDirectSshRemoteWorkspaceSnapshot({
       store,
-      snapshot: snapshot(1),
-      token: token(1),
+      snapshot: remote,
+      token: token(remote.revision),
       arrival: 1,
       isArrivalCurrent: () => true,
       isPreparationTokenCurrent: () => true,
@@ -154,6 +160,7 @@ describe('session writes deferred by a direct-SSH apply', () => {
         return 0
       }
     })
+    expect(result).toBe('applied')
   }
 
   function seedBothTargets(store: TestStore): void {
@@ -206,7 +213,6 @@ describe('session writes deferred by a direct-SSH apply', () => {
 
       expect(persist, 'the close made during the apply never reached disk').toHaveBeenCalledTimes(1)
       const patch = persist.mock.calls[0][0].patch
-      expect(patch.closedTerminalTabTombstonesByTabId?.['tab-b']?.worktreeId).toBe(WORKTREE_B)
       expect(patch.tabsByWorktree?.[WORKTREE_B]).toEqual([])
       expect(patch.tabsByWorktree?.[WORKTREE_A]).toHaveLength(1)
     } finally {
@@ -214,6 +220,78 @@ describe('session writes deferred by a direct-SSH apply', () => {
     }
   })
 
+  it.each(['missing', 'outdated'] as const)(
+    'preserves a local split awaiting upload when reconnect has a %s layout',
+    async (remoteLayout) => {
+      const store = createTestStore()
+      seedCatalog(store)
+      const first = '11111111-1111-4111-8111-111111111111'
+      const second = '22222222-2222-4222-8222-222222222222'
+      const original: TerminalLayoutSnapshot = {
+        root: { type: 'leaf', leafId: first },
+        activeLeafId: first,
+        expandedLeafId: null,
+        ptyIdsByLeafId: { [first]: 'pty-tab-a' }
+      }
+      const initial = snapshot(1)
+      initial.session.terminalLayoutsByTabId = { 'tab-a': original }
+      const persist = vi.fn<(payload: WorkspaceSessionWrite) => void>()
+      const cleanup = createSessionWriteSubscriber({
+        store,
+        persist,
+        shouldSchedulePersist: () => !isDirectSshRemoteWorkspaceApplyInProgress(),
+        subscribeToPersistGateOpen: onDirectSshRemoteWorkspaceApplyWindowClosed
+      })
+      try {
+        store.setState({ workspaceSessionReady: true, hydrationSucceeded: true })
+        await applyTargetA(store, () => {}, initial)
+        store.getState().updateTabPtyId('tab-a', toAppSshPtyId(TARGET_A, 'pty-tab-a'))
+        vi.advanceTimersByTime(1_200)
+        persist.mockClear()
+        const generation = store.getState().tabsByWorktree[WORKTREE_A][0].generation
+        const split: TerminalLayoutSnapshot = {
+          ...original,
+          root: {
+            type: 'split',
+            direction: 'vertical',
+            first: { type: 'leaf', leafId: first },
+            second: { type: 'leaf', leafId: second }
+          },
+          activeLeafId: second,
+          ptyIdsByLeafId: {
+            [first]: toAppSshPtyId(TARGET_A, 'pty-tab-a'),
+            [second]: toAppSshPtyId(TARGET_A, 'pty-split')
+          }
+        }
+        store.getState().setTabLayout('tab-a', split)
+        expect(store.getState().tabsByWorktree[WORKTREE_A][0].generation).toBe(generation)
+        expect(persist).not.toHaveBeenCalled()
+
+        store.getState().clearDirectSshTargetPtyBindings(TARGET_A)
+        expect(store.getState().directSshPaneRetryByTabId).toEqual({})
+        expect(store.getState().directSshLivePtyBindingByTabId).toEqual({})
+        expect(store.getState().tabsByWorktree[WORKTREE_A][0].pendingActivationSpawn).toBeFalsy()
+        const stale = snapshot(1)
+        stale.session.tabsByWorktreePath[PATH_A][0].generation = generation
+        if (remoteLayout === 'outdated') {
+          stale.session.terminalLayoutsByTabId = { 'tab-a': original }
+        }
+        await applyTargetA(store, () => {}, stale)
+        vi.advanceTimersByTime(1_200)
+
+        const restored = store.getState().terminalLayoutsByTabId['tab-a']
+        expect(restored?.root).toEqual(split.root)
+        expect(restored?.ptyIdsByLeafId).toEqual(split.ptyIdsByLeafId)
+        expect(persist).toHaveBeenCalledTimes(1)
+        expect(persist.mock.calls[0][0].patch.terminalLayoutsByTabId?.['tab-a']?.root).toEqual(
+          split.root
+        )
+      } finally {
+        cleanup()
+      }
+    }
+  )
+
   it('still wakes the deferred write when the wall clock steps back during the tail', async () => {
     const store = createTestStore()
     seedBothTargets(store)
@@ -242,9 +320,7 @@ describe('session writes deferred by a direct-SSH apply', () => {
       vi.advanceTimersByTime(5_200)
 
       expect(persist, 'a clock step back stranded the deferred write').toHaveBeenCalledTimes(1)
-      expect(
-        persist.mock.calls[0][0].patch.closedTerminalTabTombstonesByTabId?.['tab-b']
-      ).toBeDefined()
+      expect(persist.mock.calls[0][0].patch.tabsByWorktree?.[WORKTREE_B]).toEqual([])
     } finally {
       cleanup()
     }
diff --git a/src/renderer/src/hooks/remote-workspace-snapshot-apply.ts b/src/renderer/src/hooks/remote-workspace-snapshot-apply.ts
index af2e845ab51..5ca493251ec 100644
--- a/src/renderer/src/hooks/remote-workspace-snapshot-apply.ts
+++ b/src/renderer/src/hooks/remote-workspace-snapshot-apply.ts
@@ -182,7 +182,17 @@ export async function applyDirectSshRemoteWorkspaceSnapshot({
     state.tabsByWorktree,
     currentRecoveryTabIds(state, authority, worktreeIds),
     toSshExecutionHostId(authority.targetId),
-    snapshot.revision
+    state.closedTerminalTabTombstonesByTabId,
+    new Set(
+      [...worktreeIds].flatMap((id) =>
+        (state.tabsByWorktree[id] ?? [])
+          .filter(
+            (tab) =>
+              state.pendingDirectSshLayoutEditsByTabId[tab.id]?.targetId === authority.targetId
+          )
+          .map((tab) => tab.id)
+      )
+    )
   )
   if (!isArrivalCurrent(authority.targetId, arrival) || !isPreparationTokenCurrent(token)) {
     return 'stale'
diff --git a/src/renderer/src/hooks/remote-workspace-target-sync.test.ts b/src/renderer/src/hooks/remote-workspace-target-sync.test.ts
index 7d9f662ffe0..65f7d2c0204 100644
--- a/src/renderer/src/hooks/remote-workspace-target-sync.test.ts
+++ b/src/renderer/src/hooks/remote-workspace-target-sync.test.ts
@@ -45,6 +45,34 @@ describe('createRemoteWorkspaceTargetSync', () => {
     )
   })
 
+  it('acknowledges the captured blank-host edit when a newer null-root edit arrives', async () => {
+    const firstEdit = { targetId: 'target-a', root: null }
+    const newerEdit = { targetId: 'target-a', root: null }
+    const acknowledgeDirectSshLayoutEdits = vi.fn()
+    const state = appState({
+      tabsByWorktree: {
+        'repo-a::/remote/work': [{ id: 'tab-a', worktreeId: 'repo-a::/remote/work', ptyId: null }]
+      },
+      pendingDirectSshLayoutEditsByTabId: { 'tab-a': firstEdit },
+      acknowledgeDirectSshLayoutEdits
+    })
+    const harness = createHarness(state, async () => snapshot(0))
+    const uploaded = snapshot(1)
+    uploaded.session.terminalLayoutsByTabId = {
+      'tab-a': { root: null, activeLeafId: null, expandedLeafId: null }
+    }
+    harness.setForConnectedTargets.mockImplementationOnce(async () => {
+      state.pendingDirectSshLayoutEditsByTabId = { 'tab-a': newerEdit }
+      return [{ targetId: owner.targetId, result: { ok: true, snapshot: uploaded } }]
+    })
+
+    await harness.sync.syncAfterConnect(token())
+
+    const acknowledged = acknowledgeDirectSshLayoutEdits.mock.calls[0]?.[0]?.['tab-a']
+    expect(acknowledged).toBe(firstEdit)
+    expect(state.pendingDirectSshLayoutEditsByTabId['tab-a']).toBe(newerEdit)
+  })
+
   it.each([
     ['stale-revision', 'Workspace changed on another device'],
     ['unavailable', 'Remote workspace sync unavailable']
diff --git a/src/renderer/src/hooks/remote-workspace-target-sync.ts b/src/renderer/src/hooks/remote-workspace-target-sync.ts
index c3d99224dbc..05d027ece2e 100644
--- a/src/renderer/src/hooks/remote-workspace-target-sync.ts
+++ b/src/renderer/src/hooks/remote-workspace-target-sync.ts
@@ -12,6 +12,7 @@ import { applyDirectSshRemoteWorkspaceSnapshot } from './remote-workspace-snapsh
 import { createRemoteWorkspaceSnapshotArrivalCoordinator } from './remote-workspace-snapshot-arrival-coordinator'
 import { createDeferredSnapshotPlacementRetries } from './remote-workspace-deferred-placement-retry'
 import { applyRemoteWorkspacePushStatus } from './remote-workspace-push-status'
+import { terminalLayoutNodeEqual } from '../lib/terminal-layout-equality'
 import { waitForRemoteWorkspaceSessionReady } from './remote-workspace-session-readiness'
 import type {
   RemoteWorkspaceTargetSync,
@@ -191,6 +192,7 @@ export function createRemoteWorkspaceTargetSync(
     if (!isArrivalCurrent(authority.targetId, arrival) || !deps.isPreparationTokenCurrent(token)) {
       return
     }
+    const pendingLayoutEdits = deps.store.getState().pendingDirectSshLayoutEditsByTabId
     const results = await deps.remoteWorkspace.setForConnectedTargets({
       session: buildWorkspaceSessionPayload(deps.store.getState()),
       hydratedTargetIds: [authority.targetId],
@@ -203,6 +205,21 @@ export function createRemoteWorkspaceTargetSync(
       return
     }
     const result = results.find((entry) => entry.targetId === authority.targetId)?.result
+    if (result?.ok) {
+      const currentState = deps.store.getState()
+      currentState.acknowledgeDirectSshLayoutEdits(
+        Object.fromEntries(
+          Object.entries(pendingLayoutEdits ?? {}).flatMap(([tabId, entry]) => {
+            const uploaded = result.snapshot.session.terminalLayoutsByTabId[tabId]
+            return entry.targetId === authority.targetId &&
+              uploaded &&
+              terminalLayoutNodeEqual(entry.root, uploaded.root)
+              ? [[tabId, entry]]
+              : []
+          })
+        )
+      )
+    }
     applyRemoteWorkspacePushStatus(deps.store.getState(), authority.targetId, result, snapshot)
   }
 
diff --git a/src/renderer/src/hooks/runtime-client-events-sync-ownership.test.ts b/src/renderer/src/hooks/runtime-client-events-sync-ownership.test.ts
new file mode 100644
index 00000000000..8383c863781
--- /dev/null
+++ b/src/renderer/src/hooks/runtime-client-events-sync-ownership.test.ts
@@ -0,0 +1,297 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { RuntimeClientEvent } from '../../../shared/runtime-client-events'
+import {
+  createRuntimeClientEventsSync,
+  type RuntimeClientEventSubscriptionHandle
+} from './runtime-client-events-sync'
+
+function makeHarness() {
+  let desired = ['A', 'B']
+  let key = 'A:1'
+  const records: {
+    environmentId: string
+    emit: () => void
+    resolve: () => void
+    reject: () => void
+    unsubscribe: ReturnType<typeof vi.fn>
+  }[] = []
+  const onEvent = vi.fn()
+  const manager = createRuntimeClientEventsSync({
+    getDesiredEnvironmentIds: () => desired,
+    getSubscriptionKey: (id) => (id === 'A' ? key : id),
+    subscribe: (environmentId, notify) => {
+      const pending = Promise.withResolvers<RuntimeClientEventSubscriptionHandle>()
+      const unsubscribe = vi.fn()
+      const event: RuntimeClientEvent = { type: 'reposChanged' }
+      records.push({
+        environmentId,
+        emit: () => notify(event),
+        resolve: () => pending.resolve({ unsubscribe }),
+        reject: () => pending.reject(new Error('setup failed')),
+        unsubscribe
+      })
+      notify(event)
+      return pending.promise
+    },
+    onEvent
+  })
+  return {
+    manager,
+    onEvent,
+    records,
+    setDesired: (next: string[]) => {
+      desired = next
+    },
+    rekey: () => {
+      key = 'A:2'
+    }
+  }
+}
+
+async function settle(): Promise<void> {
+  for (let index = 0; index < 4; index += 1) {
+    await Promise.resolve()
+  }
+}
+
+describe('runtime event subscription ownership', () => {
+  it.each([{ desired: ['A'] }, { desired: ['A', 'B'] }])(
+    'keeps the nested desired set after an initial frame replaces $desired',
+    async ({ desired }) => {
+      const h = makeHarness()
+      h.setDesired(desired)
+      h.onEvent.mockImplementation((id: string) => {
+        if (id === 'A') {
+          h.setDesired(['C'])
+          h.manager.sync()
+        }
+      })
+      h.manager.sync()
+      expect(h.records.map(({ environmentId }) => environmentId)).toEqual(['A', 'C'])
+      h.onEvent.mockClear()
+      h.records.forEach((record) => record.emit())
+      expect(h.onEvent.mock.calls.map(([id]) => id)).toEqual(['C'])
+      h.records.forEach((record) => record.resolve())
+      await settle()
+      expect(h.records[0].unsubscribe).toHaveBeenCalledOnce()
+      expect(h.records[1].unsubscribe).not.toHaveBeenCalled()
+      h.manager.sync()
+      expect(h.records).toHaveLength(2)
+      h.manager.stop()
+      expect(h.records[1].unsubscribe).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('keeps a retained owner when unsubscribe replaces an outer empty desired set', async () => {
+    const h = makeHarness()
+    h.manager.sync()
+    h.records.forEach((record) => record.resolve())
+    await settle()
+    h.records[0].unsubscribe.mockImplementation(() => {
+      h.setDesired(['B', 'C'])
+      h.manager.sync()
+    })
+    h.setDesired([])
+    h.manager.sync()
+    expect(h.records[0].unsubscribe).toHaveBeenCalledOnce()
+    expect(h.records[1].unsubscribe).not.toHaveBeenCalled()
+    h.onEvent.mockClear()
+    h.records.forEach((record) => record.emit())
+    expect(h.onEvent.mock.calls.map(([id]) => id)).toEqual(['B', 'C'])
+    h.records[2].resolve()
+    await settle()
+    expect(h.records[2].unsubscribe).not.toHaveBeenCalled()
+    h.manager.stop()
+    h.records.forEach((record) => expect(record.unsubscribe).toHaveBeenCalledOnce())
+  })
+
+  it('detaches stopped subscriptions before unsubscribe starts a new owner', async () => {
+    const h = makeHarness()
+    h.manager.sync()
+    h.records.forEach((record) => record.resolve())
+    await settle()
+    h.records[0].unsubscribe.mockImplementation(() => {
+      h.setDesired(['C'])
+      h.manager.sync()
+    })
+    h.manager.stop()
+    expect(h.records[0].unsubscribe).toHaveBeenCalledOnce()
+    expect(h.records[1].unsubscribe).toHaveBeenCalledOnce()
+    h.onEvent.mockClear()
+    h.records.forEach((record) => record.emit())
+    expect(h.onEvent.mock.calls.map(([id]) => id)).toEqual(['C'])
+    h.records[2].resolve()
+    await settle()
+    expect(h.records[2].unsubscribe).not.toHaveBeenCalled()
+    h.manager.stop()
+    expect(h.records[2].unsubscribe).toHaveBeenCalledOnce()
+  })
+
+  it('preserves a new owner started synchronously by the last initial frame', async () => {
+    let desired = ['A']
+    const records: {
+      emit: () => void
+      setup: ReturnType<typeof Promise.withResolvers<RuntimeClientEventSubscriptionHandle>>
+      unsubscribe: ReturnType<typeof vi.fn<() => void>>
+    }[] = []
+    const onEvent = vi.fn((id: string) => {
+      if (id === 'A') {
+        manager.stop()
+        desired = ['B']
+        manager.sync()
+      }
+    })
+    const manager = createRuntimeClientEventsSync({
+      getDesiredEnvironmentIds: () => desired,
+      subscribe: (_id, notify) => {
+        const setup = Promise.withResolvers<RuntimeClientEventSubscriptionHandle>()
+        const unsubscribe = vi.fn()
+        const emit = (): void => notify({ type: 'reposChanged' })
+        records.push({ emit, setup, unsubscribe })
+        emit()
+        return setup.promise
+      },
+      onEvent
+    })
+    manager.sync()
+    onEvent.mockClear()
+    records[0].emit()
+    records[1].emit()
+    expect(onEvent.mock.calls.map(([id]) => id)).toEqual(['B'])
+    records.forEach(({ setup, unsubscribe }) => setup.resolve({ unsubscribe }))
+    await settle()
+    expect(records[0].unsubscribe).toHaveBeenCalledOnce()
+    expect(records[1].unsubscribe).not.toHaveBeenCalled()
+    manager.stop()
+  })
+
+  it('stops starting further subscriptions when an initial frame synchronously stops the owner', async () => {
+    const pending = Promise.withResolvers<RuntimeClientEventSubscriptionHandle>()
+    const unsubscribe = vi.fn()
+    const subscribe = vi.fn((_id: string, notify: (event: RuntimeClientEvent) => void) => {
+      notify({ type: 'reposChanged' })
+      return pending.promise
+    })
+    const manager = createRuntimeClientEventsSync({
+      getDesiredEnvironmentIds: () => ['A', 'B'],
+      subscribe,
+      onEvent: () => manager.stop()
+    })
+    manager.sync()
+    expect(subscribe).toHaveBeenCalledOnce()
+    pending.resolve({ unsubscribe })
+    await settle()
+    expect(unsubscribe).toHaveBeenCalledOnce()
+  })
+
+  it('admits synchronous initial frames, pending frames and settled live frames', async () => {
+    const h = makeHarness()
+    h.manager.sync()
+    expect(h.onEvent).toHaveBeenCalledTimes(2)
+    h.records[0].emit()
+    h.records[0].resolve()
+    await settle()
+    h.records[0].emit()
+    expect(h.onEvent).toHaveBeenCalledTimes(4)
+    h.manager.stop()
+  })
+
+  it('drops pending and settled callbacks after stop and releases the late handle', async () => {
+    const h = makeHarness()
+    h.manager.sync()
+    h.records[1].resolve()
+    await settle()
+    h.manager.stop()
+    h.onEvent.mockClear()
+    h.records.forEach((record) => record.emit())
+    expect(h.onEvent).not.toHaveBeenCalled()
+    h.records[0].resolve()
+    await settle()
+    h.records.forEach((record) => expect(record.unsubscribe).toHaveBeenCalledOnce())
+  })
+
+  it.each([false, true])(
+    'drops a replaced owner while another host stays live (settled=%s)',
+    async (settled) => {
+      const h = makeHarness()
+      h.manager.sync()
+      h.records[1].resolve()
+      if (settled) {
+        h.records[0].resolve()
+      }
+      await settle()
+      h.setDesired(['B'])
+      h.manager.sync()
+      h.setDesired(['A', 'B'])
+      h.manager.sync()
+      h.onEvent.mockClear()
+      h.records[0].emit()
+      h.records[1].emit()
+      h.records[2].emit()
+      expect(h.onEvent.mock.calls.map(([id]) => id)).toEqual(['B', 'A'])
+      h.records[0].resolve()
+      h.records[2].resolve()
+      await settle()
+      expect(h.records[0].unsubscribe).toHaveBeenCalledOnce()
+      expect(h.records[2].unsubscribe).not.toHaveBeenCalled()
+      h.manager.stop()
+    }
+  )
+
+  it('rejects callbacks from the old key and admits its replacement before setup completes', async () => {
+    const h = makeHarness()
+    h.manager.sync()
+    h.rekey()
+    h.manager.sync()
+    h.onEvent.mockClear()
+    h.records[0].emit()
+    h.records[2].emit()
+    expect(h.onEvent).toHaveBeenCalledTimes(1)
+    h.records[0].resolve()
+    h.records[2].resolve()
+    await settle()
+    expect(h.records[0].unsubscribe).toHaveBeenCalledOnce()
+    h.manager.stop()
+  })
+
+  it('permits restarting after stop without reviving the old callback', () => {
+    const h = makeHarness()
+    h.manager.sync()
+    h.manager.stop()
+    h.manager.sync()
+    h.onEvent.mockClear()
+    h.records[0].emit()
+    h.records[2].emit()
+    expect(h.onEvent).toHaveBeenCalledTimes(1)
+    h.manager.stop()
+  })
+
+  it('drops callbacks from a rejected setup while retry is waiting', async () => {
+    const h = makeHarness()
+    const warning = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    try {
+      h.manager.sync()
+      h.records[0].reject()
+      await settle()
+      h.onEvent.mockClear()
+      h.records[0].emit()
+      expect(h.onEvent).not.toHaveBeenCalled()
+    } finally {
+      h.manager.stop()
+      warning.mockRestore()
+    }
+  })
+
+  it('revokes an owner before its unsubscribe callback can reenter delivery', async () => {
+    const h = makeHarness()
+    h.manager.sync()
+    h.records[0].resolve()
+    await settle()
+    h.records[0].unsubscribe.mockImplementation(h.records[0].emit)
+    h.onEvent.mockClear()
+    h.setDesired(['B'])
+    h.manager.sync()
+    expect(h.onEvent).not.toHaveBeenCalled()
+    h.manager.stop()
+  })
+})
diff --git a/src/renderer/src/hooks/runtime-client-events-sync.ts b/src/renderer/src/hooks/runtime-client-events-sync.ts
index 6388c35e3ac..ae44fe78907 100644
--- a/src/renderer/src/hooks/runtime-client-events-sync.ts
+++ b/src/renderer/src/hooks/runtime-client-events-sync.ts
@@ -13,7 +13,9 @@ export type RuntimeClientEventsSyncDeps = {
   subscribe: (
     environmentId: string,
     onEvent: (event: RuntimeClientEvent) => void,
-    onError: (error: unknown) => void
+    onError: (error: unknown) => void,
+    /** Use for subscription-side recovery that runs before event delivery. */
+    isCurrent: () => boolean
   ) => Promise<RuntimeClientEventSubscriptionHandle>
   onEvent: (environmentId: string, event: RuntimeClientEvent) => void
   /** Base retry delay; doubles per consecutive failure up to retryMaxDelayMs. */
@@ -49,8 +51,12 @@ export type RuntimeClientEventsSync = {
 export function createRuntimeClientEventsSync(
   deps: RuntimeClientEventsSyncDeps
 ): RuntimeClientEventsSync {
-  const subscriptions = new Map<string, { key: string; unsubscribe: () => void }>()
-  const pending = new Map<string, { key: string; generation: number }>()
+  type SubscriptionToken = { key: string; generation: number }
+  const subscriptions = new Map<
+    string,
+    { key: string; token: SubscriptionToken; unsubscribe: () => void }
+  >()
+  const pending = new Map<string, SubscriptionToken>()
   const retryTimers = new Map<string, ReturnType<typeof setTimeout>>()
   const consecutiveFailures = new Map<string, { key: string; count: number }>()
   const retryDelayMs = deps.retryDelayMs ?? 1_000
@@ -58,6 +64,7 @@ export function createRuntimeClientEventsSync(
   const random = deps.random ?? Math.random
   const getSubscriptionKey = deps.getSubscriptionKey ?? ((environmentId: string) => environmentId)
   let generation = 0
+  let syncInvocation = 0
 
   const clearRetryTimer = (environmentId: string): void => {
     const retryTimer = retryTimers.get(environmentId)
@@ -109,9 +116,7 @@ export function createRuntimeClientEventsSync(
 
   const stop = (): void => {
     generation += 1
-    for (const subscription of subscriptions.values()) {
-      subscription.unsubscribe()
-    }
+    const stoppedSubscriptions = [...subscriptions.values()]
     subscriptions.clear()
     pending.clear()
     for (const retryTimer of retryTimers.values()) {
@@ -119,9 +124,14 @@ export function createRuntimeClientEventsSync(
     }
     retryTimers.clear()
     consecutiveFailures.clear()
+    for (const subscription of stoppedSubscriptions) {
+      subscription.unsubscribe()
+    }
   }
 
   const sync = (): void => {
+    const syncGeneration = generation
+    const currentSyncInvocation = ++syncInvocation
     const desiredIds = new Set(deps.getDesiredEnvironmentIds())
     for (const environmentId of retryTimers.keys()) {
       if (desiredIds.has(environmentId)) {
@@ -136,14 +146,20 @@ export function createRuntimeClientEventsSync(
     }
 
     for (const [environmentId, subscription] of subscriptions) {
+      if (syncGeneration !== generation || currentSyncInvocation !== syncInvocation) {
+        return
+      }
       if (desiredIds.has(environmentId) && subscription.key === getSubscriptionKey(environmentId)) {
         continue
       }
-      subscription.unsubscribe()
       subscriptions.delete(environmentId)
+      subscription.unsubscribe()
     }
 
     for (const environmentId of desiredIds) {
+      if (syncGeneration !== generation || currentSyncInvocation !== syncInvocation) {
+        return
+      }
       const subscriptionKey = getSubscriptionKey(environmentId)
       const pendingSubscription = pending.get(environmentId)
       if (pendingSubscription && pendingSubscription.key !== subscriptionKey) {
@@ -159,13 +175,23 @@ export function createRuntimeClientEventsSync(
       const subscribeGeneration = generation
       const pendingSubscriptionToken = { key: subscriptionKey, generation: subscribeGeneration }
       pending.set(environmentId, pendingSubscriptionToken)
+      const isCurrent = (): boolean =>
+        subscribeGeneration === generation &&
+        (pending.get(environmentId) === pendingSubscriptionToken ||
+          subscriptions.get(environmentId)?.token === pendingSubscriptionToken)
       void deps
         .subscribe(
           environmentId,
-          (event) => deps.onEvent(environmentId, event),
+          (event) => {
+            // Initial frames arrive before setup settles; only the owning attempt may deliver.
+            if (isCurrent()) {
+              deps.onEvent(environmentId, event)
+            }
+          },
           (error) => {
             console.warn('[runtime-client-events] subscription error:', error)
-          }
+          },
+          isCurrent
         )
         .then((subscription) => {
           const isCurrentPending = pending.get(environmentId) === pendingSubscriptionToken
@@ -192,6 +218,7 @@ export function createRuntimeClientEventsSync(
           consecutiveFailures.delete(environmentId)
           subscriptions.set(environmentId, {
             key: subscriptionKey,
+            token: pendingSubscriptionToken,
             unsubscribe: subscription.unsubscribe
           })
         })
@@ -224,6 +251,9 @@ export function createRuntimeClientEventsSync(
         })
     }
 
+    if (syncGeneration !== generation || currentSyncInvocation !== syncInvocation) {
+      return
+    }
     for (const [environmentId, pendingSubscription] of pending) {
       if (
         desiredIds.has(environmentId) &&
diff --git a/src/renderer/src/hooks/settings-navigation-capability-sections.ts b/src/renderer/src/hooks/settings-navigation-capability-sections.ts
index b207682844f..61875e3bb60 100644
--- a/src/renderer/src/hooks/settings-navigation-capability-sections.ts
+++ b/src/renderer/src/hooks/settings-navigation-capability-sections.ts
@@ -42,7 +42,8 @@ export function buildCapabilitySettingsSections({
       icon: Bot,
       searchEntries: getAgentsPaneSearchEntries({
         includeAgentAwake: !isWebClient,
-        includeAgentRuntime: isLocalWindowsHost
+        includeAgentRuntime: isLocalWindowsHost,
+        includeAgentWorkspaceTrust: !isWebClient
       }),
       group: 'capabilities'
     },
diff --git a/src/renderer/src/hooks/use-delayed-status.ts b/src/renderer/src/hooks/use-delayed-status.ts
new file mode 100644
index 00000000000..c895107bb4a
--- /dev/null
+++ b/src/renderer/src/hooks/use-delayed-status.ts
@@ -0,0 +1,17 @@
+import { useEffect, useState } from 'react'
+import { createDelayedStatus, type ShownStatus } from '@/lib/delayed-status'
+
+/**
+ * Returns `value` only once it has lasted past `showDelayMs`, then holds it for a
+ * minimum time, so a short status never flashes. `key` is what the status belongs
+ * to (for example a session); a new key drops it at once.
+ */
+export function useDelayedStatus<A>(key: string, value: A | null, showDelayMs: number): A | null {
+  const [shown, setShown] = useState<ShownStatus<A> | null>(null)
+  const [status] = useState(() => createDelayedStatus<A>(setShown, { showDelayMs }))
+  useEffect(() => () => status.dispose(), [status])
+  useEffect(() => {
+    status.update(key, value)
+  }, [status, key, value])
+  return shown?.key === key ? shown.value : null
+}
diff --git a/src/renderer/src/hooks/use-document-dark-theme.test.tsx b/src/renderer/src/hooks/use-document-dark-theme.test.tsx
new file mode 100644
index 00000000000..4c4f63bbd36
--- /dev/null
+++ b/src/renderer/src/hooks/use-document-dark-theme.test.tsx
@@ -0,0 +1,87 @@
+// @vitest-environment happy-dom
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { resetSystemPrefersDarkSubscriptionForTests } from '@/components/terminal-pane/use-system-prefers-dark'
+
+const settingsState: { theme: 'system' | 'dark' | 'light' | undefined } = vi.hoisted(() => ({
+  theme: 'system'
+}))
+
+vi.mock('@/store', () => ({
+  useAppStore: (selector: (state: Record<string, unknown>) => unknown) =>
+    selector({
+      settings: settingsState.theme ? { theme: settingsState.theme } : undefined
+    })
+}))
+
+import { useDocumentDarkTheme } from './use-document-dark-theme'
+
+function installMatchMedia(initialMatches: boolean): {
+  emit: (matches: boolean) => void
+} {
+  let matches = initialMatches
+  const listeners = new Set<EventListener>()
+  const media = {
+    get matches() {
+      return matches
+    },
+    addEventListener: (_type: string, listener: EventListener) => listeners.add(listener),
+    removeEventListener: (_type: string, listener: EventListener) => listeners.delete(listener)
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the hook only reads `matches` and (un)subscribes to `change`.
+  window.matchMedia = (() => media) as unknown as typeof window.matchMedia
+  return {
+    emit(next) {
+      matches = next
+      const event = new MediaQueryListEvent('change', { matches: next })
+      for (const listener of listeners) {
+        listener(event)
+      }
+    }
+  }
+}
+
+const originalMatchMedia = window.matchMedia
+
+afterEach(() => {
+  cleanup()
+  settingsState.theme = 'system'
+  resetSystemPrefersDarkSubscriptionForTests()
+  window.matchMedia = originalMatchMedia
+})
+
+describe('useDocumentDarkTheme', () => {
+  it('follows a system color-scheme change while mounted', () => {
+    const media = installMatchMedia(false)
+    const { result } = renderHook(() => useDocumentDarkTheme())
+    expect(result.current).toBe(false)
+
+    act(() => media.emit(true))
+    expect(result.current).toBe(true)
+
+    act(() => media.emit(false))
+    expect(result.current).toBe(false)
+  })
+
+  it.each([
+    ['light', false],
+    ['dark', true]
+  ] as const)('keeps an explicit %s theme when the system flips', (theme, expected) => {
+    settingsState.theme = theme
+    const media = installMatchMedia(!expected)
+    const { result } = renderHook(() => useDocumentDarkTheme())
+    expect(result.current).toBe(expected)
+
+    act(() => media.emit(expected))
+    expect(result.current).toBe(expected)
+    act(() => media.emit(!expected))
+    expect(result.current).toBe(expected)
+  })
+
+  it('treats unloaded settings as system', () => {
+    settingsState.theme = undefined
+    installMatchMedia(true)
+    const { result } = renderHook(() => useDocumentDarkTheme())
+    expect(result.current).toBe(true)
+  })
+})
diff --git a/src/renderer/src/components/editor/use-document-dark-theme.ts b/src/renderer/src/hooks/use-document-dark-theme.ts
similarity index 100%
rename from src/renderer/src/components/editor/use-document-dark-theme.ts
rename to src/renderer/src/hooks/use-document-dark-theme.ts
diff --git a/src/renderer/src/hooks/useComposerState-host-context-boundaries.test.ts b/src/renderer/src/hooks/useComposerState-host-context-boundaries.test.ts
index 764a033275f..9d76c9f9a23 100644
--- a/src/renderer/src/hooks/useComposerState-host-context-boundaries.test.ts
+++ b/src/renderer/src/hooks/useComposerState-host-context-boundaries.test.ts
@@ -1,8 +1,5 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
 import { describe, expect, it } from 'vitest'
 import {
-  canResolveFolderSmartGitHubSubmit,
   getInitialAutoManagedWorkspaceName,
   getInitialGitHubPrStartPointSelection,
   getMatchingLinkedTaskSourceContext,
@@ -11,54 +8,6 @@ import {
   resolveInitialWorkspaceRunSeed
 } from './useComposerState'
 
-function readComposerModule(fileName: string): string {
-  return readFileSync(join(__dirname, 'composer-state', fileName), 'utf8')
-}
-
-const COMPOSER_SOURCE = {
-  cardProps: readComposerModule('composer-card-props.ts'),
-  derived: readComposerModule('derived-composer-state.ts'),
-  folderSubmit: readComposerModule('folder-submit-orchestration.ts'),
-  fullCreation: readComposerModule('full-creation-execution.ts'),
-  fullCreationStartup: readComposerModule('full-creation-startup.ts'),
-  fullSubmitOrchestration: readComposerModule('full-submit-orchestration.ts'),
-  fullSubmitPreparation: readComposerModule('full-submit-preparation.ts'),
-  fullSubmitSourcePreparation: readComposerModule('full-submit-source-preparation.ts'),
-  githubProvider: readComposerModule('github-provider-selection.ts'),
-  githubSourceApplication: readComposerModule('github-source-application.ts'),
-  githubSubmit: readComposerModule('github-submit-resolution.ts'),
-  gitlabProvider: readComposerModule('gitlab-provider-selection.ts'),
-  hostRuntime: readComposerModule('host-runtime-effects.ts'),
-  initialTarget: readComposerModule('initial-target-state.ts'),
-  issueSource: readComposerModule('issue-source-actions.ts'),
-  linkedItemLookup: readComposerModule('linked-item-lookup-effects.ts'),
-  navigation: readComposerModule('composer-navigation-actions.ts'),
-  projectTarget: readComposerModule('project-target-actions.ts'),
-  providerRuntime: readComposerModule('provider-runtime-sync.ts'),
-  quickCreation: readComposerModule('quick-creation-execution.ts'),
-  quickSubmitAction: readComposerModule('quick-submit-action.ts'),
-  quickSubmitPreparation: readComposerModule('quick-submit-preparation.ts'),
-  quickSubmitSourcePreparation: readComposerModule('quick-submit-source-preparation.ts'),
-  runtimeTarget: readComposerModule('runtime-target-selection.ts'),
-  sourceContext: readComposerModule('source-context-state.ts'),
-  sourceIdentity: readComposerModule('source-identity-actions.ts'),
-  targetChange: readComposerModule('target-change-actions.ts'),
-  quickStartup: readComposerModule('quick-startup-plan.ts'),
-  workspaceIdentity: readComposerModule('workspace-identity-state.ts')
-} as const
-const RECIPE_OPTIONS_SOURCE = readFileSync(
-  join(__dirname, 'useEphemeralVmRecipeOptions.ts'),
-  'utf8'
-)
-
-function sourceBetween(source: string, startPattern: string, endPattern: string): string {
-  const start = source.indexOf(startPattern)
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = source.indexOf(endPattern, start + startPattern.length)
-  expect(end).toBeGreaterThan(start)
-  return source.slice(start, end)
-}
-
 describe('useComposerState host-context boundaries', () => {
   it('seeds TaskPage pull requests as submit-time PR start points', () => {
     const item = {
@@ -156,14 +105,6 @@ describe('useComposerState host-context boundaries', () => {
     ).toEqual({ workspaceName: 'title-derived-name', displayName: 'Title derived name' })
   })
 
-  it('requires pasted PR recovery to match the selected GitHub host', () => {
-    const recoverySection = COMPOSER_SOURCE.derived
-
-    expect(recoverySection).toContain('githubRepoIdentityKey(fromName.slug)')
-    expect(recoverySection).toContain('githubRepoIdentityKey(selectedRepoSlug)')
-    expect(recoverySection).not.toContain('fromName.slug.owner.toLowerCase()')
-  })
-
   it('auto-owns linked-item generated prefilled names', () => {
     expect(
       getInitialAutoManagedWorkspaceName({
@@ -179,112 +120,6 @@ describe('useComposerState host-context boundaries', () => {
     ).toBe('fix-workspace-name')
   })
 
-  it('resolves GitHub PR bases against the selected run repo, not the source item repo', () => {
-    const section = COMPOSER_SOURCE.githubProvider
-
-    expect(section).toContain('const runRepo = selectedRepo ??')
-    expect(section).toContain('resolveGitHubPrStartPointForRepo')
-    expect(section).toContain('repoId: runRepo.id')
-    expect(section).toContain('settings: itemRepoSettings')
-    expect(section).toContain('smartGitHubPrStartPointSelectionRef.current = startPointSelection')
-    expect(section).toContain(
-      'if (smartGitHubPrStartPointSelectionRef.current !== startPointSelection)'
-    )
-    expect(section).not.toContain('repoId: repoForItem.id')
-    expect(section).not.toContain('repo: repoForItem.id')
-  })
-
-  it('resolves GitLab MR bases against the selected run repo, not the source item repo', () => {
-    const section = COMPOSER_SOURCE.gitlabProvider
-
-    expect(section).toContain('const runRepo = selectedRepo ??')
-    expect(section).toContain('repoId: runRepo.id')
-    expect(section).toContain('getSettingsForRepoRuntimeOwner')
-    expect(section).toContain('worktree.resolveMrBase')
-    expect(section).toContain('repo: runRepo.id')
-    expect(section).not.toContain('repoId: repoForItem.id')
-    // Why (#6263): an unresolved MR base must surface a toast and clear stale
-    // state instead of silently dropping the worktree onto origin/master.
-    expect(section).toContain('toast.error(result.error)')
-    expect(section).toContain("'Failed to resolve MR base.'")
-    expect(section).toMatch(/\.catch\(\(error: unknown\) =>/)
-  })
-
-  it('clears only repo-scoped linked work items when the repo or project changes', () => {
-    // Why: Linear and Jira issues are workspace-scoped context — a repo or
-    // project switch must keep them attached. Jira used to be dropped because
-    // this path special-cased Linear only.
-    const repoChangeSection = COMPOSER_SOURCE.targetChange
-    expect(repoChangeSection).toContain(
-      '!shouldPreserveWorkspaceSourceOnRepoChange(linkedWorkItem)'
-    )
-
-    const folderSourceSection = COMPOSER_SOURCE.targetChange
-    expect(folderSourceSection).toContain('!shouldPreserveWorkspaceSourceOnRepoChange(current)')
-
-    // No switch path may gate the linked-item clear on a Linear-only predicate
-    // again. (isLinearLinkedWorkItem itself may still appear — it drives the
-    // separate Linear branch-name feature — but never the preservation decision.)
-    expect(COMPOSER_SOURCE.targetChange).not.toContain('if (!preserveLinearLinkedWorkItem)')
-  })
-
-  it('does not use local SSH gates for runtime-owned folder targets', () => {
-    const targetSection = COMPOSER_SOURCE.runtimeTarget
-    expect(targetSection).toContain("parsedFolderTargetHost?.kind === 'runtime'")
-    expect(targetSection).toContain('connectionId: folderTargetConnectionId')
-    expect(COMPOSER_SOURCE.runtimeTarget).not.toContain('folderSourceConnectionId')
-  })
-
-  it('routes folder target runtime ownership through detection, path status, and create', () => {
-    const targetSection = COMPOSER_SOURCE.runtimeTarget
-    expect(targetSection).toContain('folderTargetRuntimeEnvironmentId')
-    expect(targetSection).toContain("{ kind: 'runtime' as const")
-    expect(targetSection).toContain('useFolderWorkspaceComposerPathStatus(')
-    expect(targetSection).toContain('folderTargetRuntimeEnvironmentId')
-    expect(targetSection).toContain('useDetectedAgents(folderTargetAgentDetectionTarget)')
-
-    const submitSection = COMPOSER_SOURCE.folderSubmit
-    expect(submitSection).toContain('isRemote: folderTargetIsRemote')
-    expect(submitSection).toContain(
-      "launchSource: telemetrySource === 'onboarding' ? 'onboarding' : 'new_workspace_composer'"
-    )
-    expect(submitSection).toContain('runtimeEnvironmentId: folderTargetRuntimeEnvironmentId')
-  })
-
-  it('detects composer agents against the repo host: SSH, then runtime, then local (#7082)', () => {
-    // Why: a repo owned by a paired runtime must show the runtime's agents, not
-    // the local machine's. SSH stays first priority; runtime falls through before
-    // local so an SSH repo never double-detects. Regression guard for #7082.
-    const selectorSection = COMPOSER_SOURCE.workspaceIdentity
-    expect(selectorSection).toContain('if (isRemote) {')
-    expect(selectorSection).toContain('s.remoteDetectedAgentIds[connectionId]')
-    expect(selectorSection).toContain('if (runtimeEnvironmentId) {')
-    expect(selectorSection).toContain('s.runtimeDetectedAgentIds[runtimeEnvironmentId]')
-    expect(selectorSection).toContain('return s.detectedAgentIds')
-    // SSH branch is checked before the runtime branch.
-    expect(selectorSection.indexOf('if (isRemote) {')).toBeLessThan(
-      selectorSection.indexOf('if (runtimeEnvironmentId) {')
-    )
-
-    expect(COMPOSER_SOURCE.workspaceIdentity).toContain(
-      'const runtimeEnvironmentId = selectedRepoSettings?.activeRuntimeEnvironmentId?.trim() || null'
-    )
-
-    // Detection effect fans out to the same three hosts in the same order and
-    // re-runs when the runtime environment changes.
-    const detectSection = sourceBetween(
-      COMPOSER_SOURCE.hostRuntime,
-      'const detect = isRemote',
-      '// Per-repo: load yaml hooks'
-    )
-    expect(detectSection).toContain('ensureRemoteDetectedAgents(connectionId!)')
-    expect(detectSection).toContain('ensureRuntimeDetectedAgents(runtimeEnvironmentId)')
-    expect(detectSection).toContain('ensureDetectedAgents()')
-    expect(detectSection).toMatch(
-      /\}, \[\s*connectionId,\s*runtimeEnvironmentId,\s*isRemote,\s*selectedRepoSshStatus,\s*disabledTuiAgents/
-    )
-  })
-
   it('seeds initial workspace run target from the task source context', () => {
     expect(
       resolveInitialWorkspaceRunSeed({
@@ -316,299 +151,6 @@ describe('useComposerState host-context boundaries', () => {
       hostId: 'local',
       projectHostSetupId: 'setup-local'
     })
-
-    const section = COMPOSER_SOURCE.initialTarget
-
-    expect(section).toContain('resolveInitialWorkspaceRunSeed')
-    expect(section).toContain('initialTaskSourceContext')
-    expect(section).toContain('projectId: initialRunSeed.projectId')
-    expect(section).toContain('hostId: initialRunSeed.hostId')
-    expect(section).toContain('projectHostSetupId: initialRunSeed.projectHostSetupId')
-  })
-
-  it('resolves typed GitHub issue/PR input through the selected repo source context', () => {
-    expect(COMPOSER_SOURCE.sourceContext).toContain(
-      'const selectedRepoGitHubSourceContext = useMemo'
-    )
-
-    const directLookup = COMPOSER_SOURCE.linkedItemLookup
-    expect(directLookup).toContain('sourceContext: selectedRepoGitHubSourceContext')
-    expect(directLookup).toContain('lookupGitHubWorkItemByOwnerRepoForSource')
-    expect(directLookup).toContain('type: normalizedLinkQuery.directLink.type')
-
-    const submitLookup = COMPOSER_SOURCE.githubSubmit
-    expect(submitLookup).toContain('sourceContext:')
-    expect(submitLookup).toContain('selectedRepoGitHubSourceContext')
-  })
-
-  it('uses submit-time GitHub PR start points for the create payload', () => {
-    const submitLookup = COMPOSER_SOURCE.githubSubmit
-    expect(submitLookup).toContain('resolveGitHubPrStartPointForRepo')
-    expect(submitLookup).toContain("kind: 'pr-start-point'")
-    expect(submitLookup).toContain("kind: 'metadata-only'")
-    expect(submitLookup).toContain('baseBranch: prStartPoint.baseBranch')
-    expect(submitLookup).toContain('branchNameOverride: prStartPoint.branchNameOverride')
-    const selectedPrSubmitLookup = sourceBetween(
-      submitLookup,
-      'if (linkedWorkItem) {',
-      'const intent = getSmartGitHubSubmitIntent(name)'
-    )
-    expect(selectedPrSubmitLookup).toContain('smartGitHubPrStartPointSelectionRef.current')
-    expect(selectedPrSubmitLookup).toContain("linkedWorkItemIdentity?.type === 'pr'")
-    expect(selectedPrSubmitLookup).toContain("startPointIdentity?.type === 'pr'")
-    expect(selectedPrSubmitLookup).toContain(
-      'startPointIdentity.number === linkedWorkItemIdentity.number'
-    )
-    expect(selectedPrSubmitLookup).toContain('resolveGitHubPrStartPointForRepo')
-    expect(selectedPrSubmitLookup.indexOf('resolveGitHubPrStartPointForRepo')).toBeLessThan(
-      selectedPrSubmitLookup.indexOf("return { kind: 'none' }")
-    )
-
-    const fullSubmit = COMPOSER_SOURCE.fullSubmitSourcePreparation + COMPOSER_SOURCE.fullCreation
-    expect(fullSubmit).toContain("smartGitHubResolution.kind === 'pr-start-point'")
-    expect(fullSubmit).toContain("smartGitHubResolution.kind === 'metadata-only'")
-    expect(fullSubmit).toContain('effectiveLinkedPR !== null || linkedGitLabMR !== null')
-    expect(fullSubmit).toContain('selectedRepoIsGit ? submitBaseBranch : undefined')
-    expect(fullSubmit).toContain('submitPushTarget')
-    expect(fullSubmit).toContain('submitCompareBaseRef')
-    expect(fullSubmit).not.toContain('smartGitHubResolution?.baseBranch ?? baseBranch')
-    expect(fullSubmit).not.toContain('smartGitHubResolution?.compareBaseRef ?? compareBaseRef')
-    expect(fullSubmit).not.toContain('smartGitHubResolution?.pushTarget ?? pushTarget')
-    expect(fullSubmit).not.toContain(
-      'smartGitHubResolution?.branchNameOverride ?? branchNameOverride'
-    )
-
-    const quickSubmit =
-      COMPOSER_SOURCE.quickSubmitSourcePreparation +
-      COMPOSER_SOURCE.quickSubmitPreparation +
-      COMPOSER_SOURCE.quickCreation
-    expect(quickSubmit).toContain("smartGitHubResolution.kind === 'pr-start-point'")
-    expect(quickSubmit).toContain("smartGitHubResolution.kind === 'metadata-only'")
-    expect(quickSubmit).toContain('effectiveLinkedPR !== null || linkedGitLabMR !== null')
-    expect(quickSubmit).toContain('explicitBaseBranch: smartSubmitBaseBranch')
-    expect(quickSubmit).toContain('pushTarget: submitPushTarget')
-    expect(quickSubmit).toContain('compareBaseRef: submitCompareBaseRef')
-    expect(quickSubmit).not.toContain('smartGitHubResolution?.baseBranch ?? baseBranch')
-    expect(quickSubmit).not.toContain('smartGitHubResolution?.compareBaseRef ?? compareBaseRef')
-    expect(quickSubmit).not.toContain('smartGitHubResolution?.pushTarget ?? pushTarget')
-    expect(quickSubmit).not.toContain(
-      'smartGitHubResolution?.branchNameOverride ?? branchNameOverride'
-    )
-  })
-
-  it('saves setup startup policy before creating a workspace', () => {
-    const persistSection = COMPOSER_SOURCE.providerRuntime
-    expect(persistSection).toContain('setupAgentStartupPolicySaveRef.current')
-    expect(persistSection).toContain('pendingSave?.repoId === currentRepo.id')
-    expect(persistSection).toContain('pendingSave.policy === policy')
-    expect(persistSection).toContain('await pendingSave.promise')
-    expect(persistSection).toContain('continue')
-    expect(COMPOSER_SOURCE.providerRuntime).toContain('setupAgentStartupPolicyDraftRef.current')
-
-    const fullSubmit = COMPOSER_SOURCE.fullCreation
-    const fullPolicySave = fullSubmit.indexOf('persistSetupAgentStartupPolicy()')
-    const fullCreate = fullSubmit.indexOf('const result = await createWorktree(')
-    expect(fullPolicySave).toBeGreaterThanOrEqual(0)
-    expect(fullCreate).toBeGreaterThan(fullPolicySave)
-
-    const quickSubmit = COMPOSER_SOURCE.quickCreation
-    const quickPolicySave = quickSubmit.indexOf('persistSetupAgentStartupPolicy()')
-    const quickCreate = quickSubmit.indexOf('const request = buildQuickCreationRequest(')
-    expect(quickPolicySave).toBeGreaterThanOrEqual(0)
-    expect(quickCreate).toBeGreaterThan(quickPolicySave)
-  })
-
-  it('resolves submit-time GitHub smart input when folder child repos exist', () => {
-    expect(
-      canResolveFolderSmartGitHubSubmit({
-        hasFolderSourceRepos: true
-      })
-    ).toBe(true)
-    expect(
-      canResolveFolderSmartGitHubSubmit({
-        hasFolderSourceRepos: false
-      })
-    ).toBe(false)
-
-    const lookupSection = COMPOSER_SOURCE.githubSubmit
-    expect(lookupSection).toContain('isProjectGroupTarget')
-    expect(lookupSection).toContain('folderSourceRepos.filter(isGitRepoKind)')
-    expect(lookupSection).toContain('Promise.all')
-    expect(lookupSection).toContain('buildTaskSourceContextFromRepo')
-
-    const section = COMPOSER_SOURCE.folderSubmit
-    expect(section).toContain('canResolveFolderSmartGitHubSubmit')
-    expect(section).toContain('hasFolderSourceRepos: folderSourceRepos.length > 0')
-    expect(section).toContain('? resolvePendingSmartGitHubSubmit()')
-    expect(section).toContain("Promise.resolve({ kind: 'none' } as const)")
-    expect(section).toContain("smartGitHubSettlement.status === 'cancelled'")
-    expect(section).not.toContain('folderSourceRequiresConnection')
-  })
-
-  it('clears branch reuse state when manually editing the branch name', () => {
-    const section = COMPOSER_SOURCE.sourceIdentity
-
-    expect(section).toContain('resolveComposerManualBranchNameChange')
-    expect(section).toContain('setReuseEligibleBranch(null)')
-    expect(section).toContain('setReuseSelectedBranch(false)')
-    expect(section).toContain("branchAutoNameRef.current = ''")
-  })
-
-  it('forces repo-scoped source reset when returning from folder target to a repo with the same id', () => {
-    const handleRepoChange = COMPOSER_SOURCE.targetChange
-    expect(handleRepoChange).toContain('forceResetStartFrom?: boolean')
-    expect(handleRepoChange).toContain('value === repoId && !options.forceResetStartFrom')
-
-    const handleProjectChange = COMPOSER_SOURCE.projectTarget
-    expect(handleProjectChange).toContain(
-      'handleRepoChange(nextRepoId, { forceResetStartFrom: isProjectGroupTarget })'
-    )
-  })
-
-  it('keeps a Linear branch override when its workspace-scoped issue survives a repo change', () => {
-    const section = COMPOSER_SOURCE.targetChange
-
-    expect(section).toContain('const preservedLinearBranchName = preserveLinearLinkedWorkItem')
-    expect(section).toContain('getLinearLinkedWorkItemBranchName(linkedWorkItem)')
-    expect(section).toContain('setBranchNameOverride(preservedLinearBranchName)')
-    expect(section).toContain(
-      'setBranchNameOverridePreservesNameEdits(Boolean(preservedLinearBranchName))'
-    )
-    expect(section).toContain("branchAutoNameRef.current = preservedLinearBranchName ?? ''")
-  })
-
-  it('clears a Linear branch override when its linked issue is removed', () => {
-    const section = COMPOSER_SOURCE.sourceIdentity
-
-    expect(section).toContain('const removedLinearItem = isLinearLinkedWorkItem(linkedWorkItem)')
-    expect(section).toContain('if (removedLinearItem)')
-    expect(section).toContain('setBranchNameOverride(undefined)')
-    expect(section).toContain('setBranchNameOverridePreservesNameEdits(false)')
-    expect(section).toContain("branchAutoNameRef.current = ''")
-  })
-
-  it('keeps Jira-mode URL edits synchronously blocked before lookup settles', () => {
-    // Why: derived on every render from the same name the submit path uses, so an in-flight
-    // URL cannot slip through between the keystroke and the create.
-    expect(COMPOSER_SOURCE.workspaceIdentity).toContain(
-      'isBlockingJiraUrlIntent(smartNameMode, name)'
-    )
-    const section = COMPOSER_SOURCE.sourceIdentity
-
-    expect(section).not.toContain("smartNameMode === 'smart'")
-    expect(section).not.toContain('setSourceIntentBlocksCreate')
-  })
-
-  it('selects a project by its own host instead of pinning the current host', () => {
-    // Regression: passing the current host as a hard `hostId` made picking a
-    // project set up only on a different host a silent no-op. The current host
-    // must be a preference (focusedHostScope), with a fallback to any ready host.
-    const handleProjectChange = COMPOSER_SOURCE.projectTarget
-    expect(handleProjectChange).toContain('focusedHostScope: preferredHostId ?? workspaceHostScope')
-    expect(handleProjectChange).not.toContain('hostId: preferredHostId')
-  })
-
-  it('clears GitLab-specific linked state when clearing smart-name selection', () => {
-    const section = COMPOSER_SOURCE.issueSource
-    expect(section).toContain("setLinkedIssue('')")
-    expect(section).toContain('setLinkedPR(null)')
-    expect(section).toContain('setLinkedGitLabIssue(null)')
-    expect(section).toContain('setLinkedGitLabMR(null)')
-    expect(section).toContain('setLinkedWorkItem(null)')
-  })
-
-  it('clears stale opposite-provider review fields when selecting linked work items', () => {
-    const githubApply = COMPOSER_SOURCE.githubSourceApplication
-    expect(githubApply).toContain('setLinkedGitLabIssue(null)')
-    expect(githubApply).toContain('setLinkedGitLabMR(null)')
-    expect(githubApply).toContain('setBranchNameOverridePreservesNameEdits(false)')
-    expect(githubApply).toContain("branchAutoNameRef.current = ''")
-
-    const gitlabApply = COMPOSER_SOURCE.gitlabProvider
-    expect(gitlabApply).toContain("setLinkedIssue('')")
-    expect(gitlabApply).toContain('setLinkedPR(null)')
-    expect(gitlabApply).toContain('setBranchNameOverridePreservesNameEdits(false)')
-    expect(gitlabApply).toContain("branchAutoNameRef.current = ''")
-
-    const githubProjectGroupHandler = COMPOSER_SOURCE.githubProvider
-    const gitlabProjectGroupHandler = COMPOSER_SOURCE.githubProvider
-    expect(githubProjectGroupHandler).toContain('setLinkedGitLabIssue(null)')
-    expect(githubProjectGroupHandler).toContain('setLinkedGitLabMR(null)')
-    expect(gitlabProjectGroupHandler).toContain(
-      "setLinkedIssue(identity.type === 'issue' ? String(identity.number) : '')"
-    )
-    expect(gitlabProjectGroupHandler).toContain(
-      "setLinkedPR(identity.type === 'pr' ? identity.number : null)"
-    )
-  })
-
-  it('disables repo-backed folder smart lookup when a folder target has no source repos', () => {
-    const cardProps = COMPOSER_SOURCE.cardProps
-    expect(cardProps).toContain(
-      'repoBackedSourcesDisabled: isProjectGroupTarget ? folderSourceRepos.length === 0 : false'
-    )
-    expect(cardProps).toContain(
-      'repoBackedSearchRepos: isProjectGroupTarget ? folderSourceRepos : undefined'
-    )
-  })
-
-  it('surfaces folder submit smart-resolution failures through create error UI', () => {
-    const section = COMPOSER_SOURCE.folderSubmit
-    expect(section).toContain('catch (error)')
-    expect(section).toContain('const formattedError = formatWorkspaceCreateError(error)')
-    expect(section).toContain('setCreateError(formattedError)')
-    expect(section).toContain('toast.error(getWorkspaceCreateErrorToastMessage(formattedError))')
-    expect(section).toContain('if (!folderWorkspaceCreated)')
-    expect(section).toContain('setCreateError({')
-  })
-
-  it('uses submit-time smart metadata for both folder launch mode and startup content', () => {
-    const section = COMPOSER_SOURCE.folderSubmit
-    expect(section).toContain(
-      'const submitLinkedWorkItem = smartGitHubMetadata?.linkedWorkItem ?? linkedWorkItem'
-    )
-    expect(section).toContain('resolveFolderWorkspaceLaunchDraft(submitLinkedWorkItem, note)')
-    expect(section).toContain('linkedWorkItem: submitLinkedWorkItem')
-  })
-
-  it('gates every submit path on the derived source intent', () => {
-    // Why: derived from name+mode, so the submitted name and the gate can never disagree.
-    expect(COMPOSER_SOURCE.workspaceIdentity).toContain(
-      'const sourceIntentBlocksCreate = !linkedWorkItem && isBlockingJiraUrlIntent(smartNameMode, name)'
-    )
-    const submitSections = [
-      COMPOSER_SOURCE.navigation,
-      COMPOSER_SOURCE.fullSubmitOrchestration,
-      COMPOSER_SOURCE.quickSubmitAction
-    ]
-
-    for (const section of submitSections) {
-      expect(section).toContain('sourceIntentBlocksCreate')
-    }
-  })
-
-  it('passes folder child repos to smart lookup instead of building task source options', () => {
-    const cardProps = COMPOSER_SOURCE.cardProps
-    expect(cardProps).toContain(
-      'repoBackedSearchRepos: isProjectGroupTarget ? folderSourceRepos : undefined'
-    )
-    expect(cardProps).not.toContain('folderSourceProjectOptions')
-    expect(cardProps).not.toContain('handleFolderTaskSourceProjectChange')
-    expect(cardProps).not.toContain('getRepoIdFromNewWorkspaceFolderSourceOptionId')
-  })
-
-  it('keeps folder run repo changes inside the selected folder source set', () => {
-    const section = COMPOSER_SOURCE.targetChange
-    expect(section).toContain('folderSourceRepos.some((repo) => repo.id === value)')
-    expect(section).toContain('return')
-
-    const cardProps = COMPOSER_SOURCE.cardProps
-    expect(cardProps).toContain('allowSmartNameAddProject: !isProjectGroupTarget')
-  })
-
-  it('preserves Jira linked items when switching from repo target to folder target', () => {
-    const section = COMPOSER_SOURCE.projectTarget
-    expect(section).toContain('!shouldPreserveWorkspaceSourceOnRepoChange(linkedWorkItem)')
   })
 
   it('restores Jira draft context only when its site and issue identity agree', () => {
@@ -644,139 +186,4 @@ describe('useComposerState host-context boundaries', () => {
       getMatchingLinkedTaskSourceContext({ ...item, jiraIdentifier: 'ORCA-999' }, context)
     ).toBeNull()
   })
-
-  it('resolves quick-create base refs through the worktree-create precedence helper', () => {
-    const section = COMPOSER_SOURCE.quickSubmitPreparation
-    expect(section).not.toContain('repoWorktreeBaseRef: selectedRepo.worktreeBaseRef')
-    expect(section).not.toContain('getRuntimeRepoBaseRefDefault')
-  })
-
-  it('plans new workspace agent startup from the selected repo runtime', () => {
-    expect(COMPOSER_SOURCE.runtimeTarget).toContain(
-      'const selectedRepoAgentLaunchPlatform = useMemo'
-    )
-    expect(COMPOSER_SOURCE.runtimeTarget).toContain('getLocalRepoProjectExecutionRuntimeContext')
-    expect(COMPOSER_SOURCE.runtimeTarget).toContain(
-      'getAgentLaunchPlatformForRepo(selectedRepo, projectRuntime)'
-    )
-
-    const fullStartupPlan = sourceBetween(
-      COMPOSER_SOURCE.fullSubmitPreparation,
-      'const startupPlan = buildAgentStartupPlan({',
-      'const shouldSeedInitialAgentStatus ='
-    )
-    expect(fullStartupPlan).toContain('platform: selectedRepoAgentLaunchPlatform')
-    expect(fullStartupPlan).not.toContain('platform: CLIENT_PLATFORM')
-    expect(COMPOSER_SOURCE.fullCreation).toContain('startupDraft: startupPlan.draftPrompt')
-
-    const quickStartupPlan = sourceBetween(
-      COMPOSER_SOURCE.quickCreation,
-      'buildQuickComposerStartup({',
-      'const startupPolicySettlement ='
-    )
-    expect(quickStartupPlan).toContain('platform: selectedRepoAgentLaunchPlatform')
-    expect(quickStartupPlan).not.toContain('platform: CLIENT_PLATFORM')
-  })
-
-  // Why: activation no longer rebuilds a startup from `createdWithAgent`, so this
-  // caller's own `startup` is the only thing that launches the agent it planned.
-  it('passes its own startup to activation when submit planned an agent', () => {
-    const activation = COMPOSER_SOURCE.fullCreation + COMPOSER_SOURCE.fullCreationStartup
-
-    expect(activation).toContain('...(!structuredLaunch && startup ? { startup } : {})')
-    expect(activation).toContain('backendStartupTerminalSpawned: true')
-    expect(activation).toContain('command: args.startupPlan.launchCommand')
-    expect(activation).toContain('launchAgent: args.agent')
-    // The removed activation-time fallback must not come back through this caller.
-    expect(COMPOSER_SOURCE.fullCreation).not.toContain('buildCreatedAgentReopenStartup')
-  })
-
-  it('prepares linked quick-create drafts for the selected default agent', () => {
-    const quickSubmit = COMPOSER_SOURCE.quickCreation + COMPOSER_SOURCE.quickStartup
-
-    expect(quickSubmit).toContain(
-      'const promptLinkedWorkItem = agent === null ? null : submitLinkedWorkItem'
-    )
-    expect(quickSubmit).toContain('resolveQuickCreateLinkedWorkItemPrompt(promptLinkedWorkItem')
-    expect(quickSubmit).not.toContain('explicitAgentChoice')
-    expect(quickSubmit).not.toContain('shouldPrepareQuickLinkedWorkItemAgentPrompt')
-    expect(COMPOSER_SOURCE.quickCreation).not.toContain('resolveQuickWorkspaceSubmitAgent')
-  })
-
-  it('keeps sentinel-based Jira and Linear starts out of issue-command templates', () => {
-    const submitSources =
-      COMPOSER_SOURCE.derived +
-      COMPOSER_SOURCE.fullSubmitSourcePreparation +
-      COMPOSER_SOURCE.fullSubmitPreparation +
-      COMPOSER_SOURCE.fullCreation +
-      COMPOSER_SOURCE.quickSubmitPreparation +
-      COMPOSER_SOURCE.quickCreation
-    expect(submitSources).not.toContain('isOrcaCliAvailableForLaunch')
-    expect(submitSources).not.toContain('hasGeneratedLinearSourceContext')
-    expect(submitSources).not.toContain('shouldDraftGeneratedLinearContext')
-    expect(COMPOSER_SOURCE.derived).toMatch(
-      /willApplyIssueCommandAsPrompt[\s\S]*canUseIssueCommandForLinkedItemProvider\(linkedWorkItemProvider\)/
-    )
-
-    const previewSection = COMPOSER_SOURCE.derived
-    expect(previewSection).toContain(
-      'canUseIssueCommandForLinkedItemProvider(linkedWorkItemProvider)'
-    )
-
-    const fullSubmit =
-      COMPOSER_SOURCE.fullSubmitSourcePreparation +
-      COMPOSER_SOURCE.fullSubmitPreparation +
-      COMPOSER_SOURCE.fullCreation +
-      COMPOSER_SOURCE.fullCreationStartup
-    expect(fullSubmit).toContain(
-      'canUseIssueCommandForLinkedItemProvider(submitLinkedWorkItemProvider)'
-    )
-    expect(fullSubmit).toMatch(
-      /submitShouldRunIssueAutomation[\s\S]*canUseIssueCommandForLinkedItemProvider\(submitLinkedWorkItemProvider\)/
-    )
-    expect(fullSubmit).toContain('prompt: submitStartupPrompt')
-    expect(fullSubmit).toContain('const shouldSeedInitialAgentStatus =')
-    expect(fullSubmit).toContain('...(args.shouldSeedInitialAgentStatus')
-
-    const quickSubmit =
-      COMPOSER_SOURCE.quickSubmitPreparation +
-      COMPOSER_SOURCE.quickCreation +
-      COMPOSER_SOURCE.quickStartup
-    expect(quickSubmit).toContain('startupPlan.draftPrompt = draftPrompt')
-  })
-
-  it('selects the failed Jira source host before opening integration settings', () => {
-    const section = COMPOSER_SOURCE.navigation
-
-    expect(section).toContain('getTaskSourceRuntimeSettings(')
-    expect(section).toContain('smartNameJiraSourceContext')
-    expect(section).toContain('setActiveRuntimeEnvironmentPreference(targetRuntimeEnvironmentId)')
-    expect(section.indexOf('setActiveRuntimeEnvironmentPreference')).toBeLessThan(
-      section.indexOf("openSettingsTarget({ pane: 'integrations'")
-    )
-    expect(section).toContain('if (!selected)')
-  })
-
-  it('gates per-workspace environment recipe discovery behind the experimental setting', () => {
-    const recipeLoadSection = COMPOSER_SOURCE.runtimeTarget
-    expect(recipeLoadSection).toContain('settings?.experimentalEphemeralVms === true')
-    expect(recipeLoadSection).toContain('useEphemeralVmRecipeOptions')
-    expect(recipeLoadSection).toContain('enabled: ephemeralVmsEnabled')
-    expect(RECIPE_OPTIONS_SOURCE).toContain('args.enabled &&')
-    expect(RECIPE_OPTIONS_SOURCE).toContain('window.api.ephemeralVm')
-    expect(RECIPE_OPTIONS_SOURCE).toContain('window.api.plugins.onChanged')
-    expect(RECIPE_OPTIONS_SOURCE).toContain('requestGeneration')
-
-    const submitSection = COMPOSER_SOURCE.quickCreation
-    expect(submitSection).toContain(
-      'const activeEphemeralVmRecipeId = ephemeralVmsEnabled ? selectedEphemeralVmRecipeId : null'
-    )
-    expect(submitSection).toContain('recipeId: activeEphemeralVmRecipeId')
-
-    const cardPropsSection = COMPOSER_SOURCE.cardProps
-    expect(cardPropsSection).toContain('ephemeralVmRecipes:')
-    expect(cardPropsSection).toContain('!ephemeralVmsEnabled')
-    expect(cardPropsSection).toContain('selectedEphemeralVmRecipeId:')
-    expect(cardPropsSection).toContain('ephemeralVmRecipeError:')
-  })
 })
diff --git a/src/renderer/src/hooks/useEditorExternalWatch-complexity.test.ts b/src/renderer/src/hooks/useEditorExternalWatch-complexity.test.ts
index f6e726f5a1f..c79a4fa1907 100644
--- a/src/renderer/src/hooks/useEditorExternalWatch-complexity.test.ts
+++ b/src/renderer/src/hooks/useEditorExternalWatch-complexity.test.ts
@@ -45,7 +45,7 @@ import {
   getOpenFilesForExternalFileChange,
   notifyEditorExternalFileChange
 } from '@/components/editor/editor-autosave'
-import { createExternalWatchEventHandler } from './useEditorExternalWatch'
+import { buildEditorExternalWatchEventHandler as createExternalWatchEventHandler } from './editor-external-watch-event-reconciliation'
 
 const EVENT_COUNT = 5_000
 const OPEN_FILE_COUNT = 100
diff --git a/src/renderer/src/hooks/useEditorExternalWatch-self-move.test.ts b/src/renderer/src/hooks/useEditorExternalWatch-self-move.test.ts
index 523e00420ca..aa50e88b7e4 100644
--- a/src/renderer/src/hooks/useEditorExternalWatch-self-move.test.ts
+++ b/src/renderer/src/hooks/useEditorExternalWatch-self-move.test.ts
@@ -14,10 +14,8 @@ vi.mock('@/components/editor/editor-autosave', async (importOriginal) => {
   }
 })
 
-import {
-  createExternalWatchEventHandler,
-  verifyLatchedMoveDestinations
-} from './useEditorExternalWatch'
+import { buildEditorExternalWatchEventHandler as createExternalWatchEventHandler } from './editor-external-watch-event-reconciliation'
+import { verifyLatchedMoveDestinations } from './useEditorExternalWatch'
 import { useAppStore } from '@/store'
 import { getOpenFilesForExternalFileChange } from '@/components/editor/editor-autosave'
 import { __clearSelfWriteRegistryForTests } from '@/components/editor/editor-self-write-registry'
diff --git a/src/renderer/src/hooks/useEditorExternalWatch-targets.test.ts b/src/renderer/src/hooks/useEditorExternalWatch-targets.test.ts
index dcb5d6f8254..c04e4931655 100644
--- a/src/renderer/src/hooks/useEditorExternalWatch-targets.test.ts
+++ b/src/renderer/src/hooks/useEditorExternalWatch-targets.test.ts
@@ -1,8 +1,8 @@
 import { describe, expect, it, vi } from 'vitest'
 import {
-  getEditorExternalWatchTargets,
+  selectEditorExternalWatchTargets as getEditorExternalWatchTargets,
   type EditorExternalWatchTargetState
-} from './useEditorExternalWatch'
+} from './editor-external-watch-targets'
 
 vi.mock('@/store', () => ({
   useAppStore: {
diff --git a/src/renderer/src/hooks/useEditorExternalWatch-wsl-repro.test.ts b/src/renderer/src/hooks/useEditorExternalWatch-wsl-repro.test.ts
index 930dc1167f6..b5372f5a92f 100644
--- a/src/renderer/src/hooks/useEditorExternalWatch-wsl-repro.test.ts
+++ b/src/renderer/src/hooks/useEditorExternalWatch-wsl-repro.test.ts
@@ -10,7 +10,7 @@ vi.mock('@/components/editor/editor-autosave', async (importOriginal) => {
 
 import { useAppStore } from '@/store'
 import { notifyEditorExternalFileChange } from '@/components/editor/editor-autosave'
-import { createExternalWatchEventHandler } from './useEditorExternalWatch'
+import { buildEditorExternalWatchEventHandler as createExternalWatchEventHandler } from './editor-external-watch-event-reconciliation'
 
 const worktreePath = '\\\\wsl.localhost\\Ubuntu\\workspace\\repo'
 const restoredPath = '//wsl.localhost/Ubuntu/workspace/repo/file.ts'
diff --git a/src/renderer/src/hooks/useEditorExternalWatch.test.ts b/src/renderer/src/hooks/useEditorExternalWatch.test.ts
index c006d2612d5..06f5b6672b5 100644
--- a/src/renderer/src/hooks/useEditorExternalWatch.test.ts
+++ b/src/renderer/src/hooks/useEditorExternalWatch.test.ts
@@ -20,10 +20,10 @@ vi.mock('@/components/editor/editor-autosave', async (importOriginal) => {
 })
 
 import {
-  createExternalWatchEventHandler,
-  getOverflowExternalReloadTargets,
-  getWatchedTargetKey
-} from './useEditorExternalWatch'
+  buildEditorExternalWatchEventHandler as createExternalWatchEventHandler,
+  collectOverflowEditorExternalReloadTargets as getOverflowExternalReloadTargets
+} from './editor-external-watch-event-reconciliation'
+import { getEditorExternalWatchTargetKey as getWatchedTargetKey } from './editor-external-watch-targets'
 import { useAppStore } from '@/store'
 import {
   getOpenFilesForExternalFileChange,
diff --git a/src/renderer/src/hooks/useEditorExternalWatch.ts b/src/renderer/src/hooks/useEditorExternalWatch.ts
index c9b7db652f8..9c7cce2826e 100644
--- a/src/renderer/src/hooks/useEditorExternalWatch.ts
+++ b/src/renderer/src/hooks/useEditorExternalWatch.ts
@@ -6,17 +6,11 @@ import type { FsChangedPayload } from '../../../shared/filesystem-entry-types'
 import {
   getEditorExternalWatchTargetKey,
   selectEditorExternalWatchTargets,
-  type EditorExternalWatchTarget,
-  type EditorExternalWatchTargetState
+  type EditorExternalWatchTarget
 } from './editor-external-watch-targets'
-import {
-  buildEditorExternalWatchEventHandler,
-  collectOverflowEditorExternalReloadTargets
-} from './editor-external-watch-event-reconciliation'
+import { buildEditorExternalWatchEventHandler } from './editor-external-watch-event-reconciliation'
 import { verifyLatchedEditorMoveDestinations } from './editor-external-watch-disk-verification'
 
-export type { EditorExternalWatchTargetState }
-
 function warnExternalWatchFailure(target: EditorExternalWatchTarget, err: unknown): void {
   console.warn('[filesystem-watch] failed to watch worktree', {
     worktreeId: target.worktreeId,
@@ -162,31 +156,8 @@ function subscribeRuntimeTarget(
     })
 }
 
-// Compatibility delegates keep existing direct imports stable without turning this module into an export barrel.
-export function getWatchedTargetKey(target: EditorExternalWatchTarget): string {
-  return getEditorExternalWatchTargetKey(target)
-}
-
-export function getEditorExternalWatchTargets(
-  state: EditorExternalWatchTargetState
-): ReturnType<typeof selectEditorExternalWatchTargets> {
-  return selectEditorExternalWatchTargets(state)
-}
-
-export function createExternalWatchEventHandler(
-  ...args: Parameters<typeof buildEditorExternalWatchEventHandler>
-): ReturnType<typeof buildEditorExternalWatchEventHandler> {
-  return buildEditorExternalWatchEventHandler(...args)
-}
-
 export function verifyLatchedMoveDestinations(
   ...args: Parameters<typeof verifyLatchedEditorMoveDestinations>
 ): void {
   verifyLatchedEditorMoveDestinations(...args)
 }
-
-export function getOverflowExternalReloadTargets(
-  ...args: Parameters<typeof collectOverflowEditorExternalReloadTargets>
-): ReturnType<typeof collectOverflowEditorExternalReloadTargets> {
-  return collectOverflowEditorExternalReloadTargets(...args)
-}
diff --git a/src/renderer/src/hooks/useIpcEvents-agent-status-snapshot-replay.test.ts b/src/renderer/src/hooks/useIpcEvents-agent-status-snapshot-replay.test.ts
index e26448f0b63..f8f77eced61 100644
--- a/src/renderer/src/hooks/useIpcEvents-agent-status-snapshot-replay.test.ts
+++ b/src/renderer/src/hooks/useIpcEvents-agent-status-snapshot-replay.test.ts
@@ -79,7 +79,9 @@ describe('useIpcEvents agent status snapshot integration', () => {
         toolInput: 'pnpm test',
         terminalHandle: 'term-future',
         receivedAt: 1_700_000_000_000,
-        stateStartedAt: 1_699_999_999_000
+        stateStartedAt: 1_699_999_999_000,
+        // A reload starts with no state history; the host's turn start must arrive with the row.
+        turnStartedAt: 1_699_999_990_000
       }
     ])
     await Promise.resolve()
@@ -113,7 +115,11 @@ describe('useIpcEvents agent status snapshot integration', () => {
         toolInput: 'pnpm test'
       }),
       'SSH Tab',
-      { updatedAt: 1_700_000_000_000, stateStartedAt: 1_699_999_999_000 },
+      {
+        updatedAt: 1_700_000_000_000,
+        stateStartedAt: 1_699_999_999_000,
+        turnStartedAt: 1_699_999_990_000
+      },
       expectWorktreeRouting('wt-1'),
       undefined
     )
diff --git a/src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts b/src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts
index 5240ea803f7..e22c6b41e0f 100644
--- a/src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts
+++ b/src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts
@@ -92,7 +92,7 @@ describe('useIpcEvents browser tab close routing', () => {
       getState: () => ({})
     })
 
-    closeTerminalListenerRef.current?.({ tabId: 'terminal-1' })
+    closeTerminalListenerRef.current?.({ kind: 'tab', tabId: 'terminal-1' })
 
     // The CLI/RPC caller is answered immediately, so this close must never raise a modal.
     expect(closeTerminalTabMock).toHaveBeenCalledWith('terminal-1', {
diff --git a/src/renderer/src/hooks/useIpcEvents-cmd-j-digit-chord.test.ts b/src/renderer/src/hooks/useIpcEvents-cmd-j-digit-chord.test.ts
index a0ff1ea24dc..ae61b9adcb9 100644
--- a/src/renderer/src/hooks/useIpcEvents-cmd-j-digit-chord.test.ts
+++ b/src/renderer/src/hooks/useIpcEvents-cmd-j-digit-chord.test.ts
@@ -52,7 +52,9 @@ describe('useIpcEvents digit-chord routing while Cmd+J is open', () => {
 
     expect(rowJumps).toEqual([])
     // Why assert the activation and not just the silent bus: a premature return would also emit nothing.
-    expect(harness.activateAndRevealWorkspace).toHaveBeenCalledWith('wt-c')
+    expect(harness.activateAndRevealWorkspace).toHaveBeenCalledWith('wt-c', {
+      navigationIntent: 'user-open'
+    })
   })
 
   it('routes duplicate ids at different positions to their rendered hosts', async () => {
@@ -67,6 +69,7 @@ describe('useIpcEvents digit-chord routing while Cmd+J is open', () => {
     harness.jumpToWorktreeIndex(1)
 
     expect(harness.activateAndRevealWorkspace).toHaveBeenCalledWith('repo::path', {
+      navigationIntent: 'user-open',
       executionHostId: 'ssh:box'
     })
   })
diff --git a/src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts b/src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts
index 12ca698f192..e0e4761aad0 100644
--- a/src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts
+++ b/src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts
@@ -1,5 +1,3 @@
-import { readdirSync, readFileSync } from 'node:fs'
-import { basename, resolve } from 'node:path'
 import { describe, expect, it } from 'vitest'
 import { buildSettingsNavigationMetadata } from './useSettingsNavigationMetadata'
 import type { Repo } from '../../../shared/repo-types'
@@ -405,42 +403,4 @@ describe('settings navigation metadata', () => {
     expect(ids({ isMac: false })).not.toContain('developer-permissions')
     expect(ids({ isMac: true })).toContain('developer-permissions')
   })
-
-  it('does not import Settings page or pane UI modules from the metadata hook', () => {
-    const testDir = import.meta.dirname
-    // Why: the section tables live in sibling settings-navigation-* modules, so reading only the
-    // hook would scan a file that no longer holds the imports this guard exists to police.
-    // Walk recursively so a later split that nests the modules cannot shrink this guard.
-    const sourceFiles = [
-      'useSettingsNavigationMetadata.ts',
-      ...readdirSync(testDir, { recursive: true, encoding: 'utf8' }).filter(
-        (name) => basename(name).startsWith('settings-navigation-') && name.endsWith('.ts')
-      )
-    ]
-    expect(sourceFiles.length).toBeGreaterThan(1)
-    const importLines = sourceFiles
-      .flatMap((name) => readFileSync(resolve(testDir, name), 'utf8').split('\n'))
-      .filter((line) => line.trim().startsWith('import '))
-      .join('\n')
-
-    expect(importLines).not.toMatch(/components\/settings\/Settings(?:'|")/)
-    expect(importLines).not.toMatch(/components\/settings\/[A-Z][A-Za-z]+Pane(?:'|")/)
-    expect(importLines).not.toMatch(/components\/stats\/StatsPane(?:'|")/)
-  })
-
-  it('does not import Settings page or pane UI modules from the quick action registry', () => {
-    const testDir = import.meta.dirname
-    const registrySource = readFileSync(
-      resolve(testDir, '../components/cmd-j/quick-actions.ts'),
-      'utf8'
-    )
-    const importLines = registrySource
-      .split('\n')
-      .filter((line) => line.trim().startsWith('import '))
-      .join('\n')
-
-    expect(importLines).not.toMatch(/components\/settings\/Settings(?:'|")/)
-    expect(importLines).not.toMatch(/components\/settings\/[A-Z][A-Za-z]+Pane(?:'|")/)
-    expect(importLines).not.toMatch(/components\/stats\/StatsPane(?:'|")/)
-  })
 })
diff --git a/src/renderer/src/i18n/en-runtime-required.json b/src/renderer/src/i18n/en-runtime-required.json
index b5e8431c573..fea3ef62d52 100644
--- a/src/renderer/src/i18n/en-runtime-required.json
+++ b/src/renderer/src/i18n/en-runtime-required.json
@@ -1481,7 +1481,19 @@
           "a9359c8aa9": "Unknown error"
         },
         "SparsePresetSettingsSection": {
-          "68bbcd864a": "new"
+          "2d7d45e991": "Cancel",
+          "3b6f1abd3e": "e.g. web-only",
+          "3dfa765ca7": "{{value0}} directories will be saved.",
+          "623b4cf910": "Edit Preset",
+          "68bbcd864a": "new",
+          "694cc55ecb": "Saved directories are used when creating sparse worktrees for this repository.",
+          "a05bc9183f": "Save Preset",
+          "a6fcdd9e3c": "Name",
+          "b532b9c17d": "1 directory will be saved.",
+          "b9922ec194": "Cancel preset edit",
+          "c240a16f25": "Use repo-relative paths like packages/web or apps/api.",
+          "caf33029cc": "Directories",
+          "fde7ff2cc3": "packages/web shared/ui"
         },
         "SshPane": {
           "94c5284560": "Targets",
@@ -1576,6 +1588,9 @@
             "042c551bc5": "config",
             "0d1c334987": "lid",
             "0d752916f8": "hooks",
+            "agent-trust-trust": "trust",
+            "agent-trust-folder": "folder",
+            "agent-trust-worktree": "worktree",
             "13b20636a6": "waiting",
             "167daeb5e9": "command",
             "2afd3b5858": "enable",
@@ -2005,6 +2020,15 @@
               }
             }
           }
+        },
+        "worktree": {
+          "card": {
+            "compact": {
+              "agents": {
+                "a128d7006b": "{{value0}} {{value1}} child {{value2}}"
+              }
+            }
+          }
         }
       },
       "skills": {
@@ -2180,7 +2204,18 @@
       },
       "sparse": {
         "SparseCheckoutPresetSelect": {
-          "bd6cec2056": "new"
+          "064c1e2d12": "Renderer UI",
+          "0e9ad9c798": "Directories",
+          "14952d451e": "{{value0}} directories",
+          "69c020eddc": "Edit preset",
+          "7c3275d307": "Edit {{value0}}",
+          "8b12c0850a": "Save",
+          "b3a500c623": "Name",
+          "bd6cec2056": "new",
+          "c7f9b3f0c1": "Off",
+          "ddbcaef7be": "src/renderer packages/ui",
+          "de8fce5854": "Cancel",
+          "e9283eb171": "1 directory"
         }
       },
       "stats": {
@@ -2464,9 +2499,17 @@
           "MobileDriverOverlay": {
             "3eed73394f": "Your keyboard is paused"
           },
+          "TerminalErrorToast": {
+            "ptyAllocationLimit": "Your system cannot allocate any more pty devices. Close some terminals you are not using, in Orca or another program, then try again.",
+            "terminalProcessLimit": "Your system cannot start another terminal process. Close unused terminals or quit unused processes, then try again."
+          },
           "TerminalRemoteRuntimeReconnectBanner": {
             "retryingBody": "Orca will retry for up to one minute. This terminal will resume if the connection returns."
           },
+          "TerminalSessionStateSaveFailureDialog": {
+            "678c780a2c": "Disk space is unavailable",
+            "e2fcf07c0d": "Orca could not save this terminal session because local storage is full or not writable. Open the disk space analyzer to find workspace storage you can clean up."
+          },
           "TerminalSshReconnectOverlay": {
             "connectButton": "Connect",
             "connectingButton": "Connecting..."
@@ -2657,6 +2700,7 @@
       "ask": {
         "asked": "Asked:",
         "awaiting": "Awaiting user input:",
+        "awaitingUnnamed": "Awaiting user input",
         "questionCount": "{{value0}} questions"
       },
       "composer": {
@@ -2672,6 +2716,7 @@
           "title": "Start a chat with {{value0}}"
         },
         "error": {
+          "retryingSubtitle": "The transcript could not be read. Orca keeps trying to load it.",
           "subtitle": "The transcript could not be read. Toggle back to the terminal to keep working.",
           "title": "Could not load conversation"
         },
@@ -2686,11 +2731,14 @@
       },
       "status": {
         "responding": "Agent is responding",
-        "thinking": "Thinking",
         "toggleDetails": "Toggle turn details",
         "workedFor": "Worked for {{value0}}",
         "workingFor": "Working for {{value0}}"
       },
+      "subagents": {
+        "unnamed": "Subagent",
+        "writtenBy": "Written by subagent {{value0}}"
+      },
       "tool": {
         "countN": "{{value0}} tool calls",
         "countOne": "1 tool call",
@@ -2708,6 +2756,56 @@
         "runningPreview": "Running {{preview}}",
         "usedManySummary": "Used {{toolCount}} tools",
         "usedOneSummary": "Used 1 tool"
+      },
+      "writeNotice": {
+        "agentRefused": "The agent turned this down.",
+        "agentStarting": "The agent is still starting.",
+        "answerFirst": "Answer the question or approval first.",
+        "backgroundTasksRunning": "Background tasks are still running.",
+        "capacity": "Orca has received too many requests in the last day.",
+        "chatNotFound": "The Orca running this chat has no record of it.",
+        "clearUnfinished": "The last /clear didn't finish.",
+        "commandRunning": "A /compact or /clear is still running.",
+        "conversationCleared": "This conversation has been cleared.",
+        "goalsUnsupported": "This agent doesn't support goals.",
+        "historyUnavailable": "Orca couldn't open this chat's history right now.",
+        "historyUnreadable": "Orca couldn't read this chat's saved history.",
+        "historyUnusable": "Unable to load this chat.",
+        "hostReconciling": "Orca is still checking on this chat after restarting.",
+        "messagesUnsettled": "A message you sent earlier hasn't been confirmed yet.",
+        "notDoneAnswer": "Your answer was not sent.",
+        "notDoneCommand": "The command didn't run.",
+        "notDoneGoal": "The goal wasn't changed.",
+        "notDoneOption": "The setting wasn't changed.",
+        "notDoneReadHistory": "This chat's history couldn't be loaded.",
+        "notDoneSend": "Your message was not sent.",
+        "notDoneStop": "The agent wasn't stopped.",
+        "notDoneStopTask": "The background task wasn't stopped.",
+        "notDoneStopTasks": "The background tasks weren't stopped.",
+        "openCurrentConversation": "Open the current conversation to continue.",
+        "optionRejected": "The agent didn't accept this setting.",
+        "outcomeUnknown": "Orca couldn't confirm what happened. Check the chat.",
+        "ownerUnproven": "Orca hasn't confirmed that this chat's previous agent stopped.",
+        "promptPending": "The agent is waiting for an answer to a question or approval.",
+        "questionChanged": "This question was already answered or has changed.",
+        "quitTerminalAgent": "Quit that agent to continue the chat here.",
+        "recordFailed": "Orca couldn't record it in this chat's history.",
+        "recordUnreadable": "Orca couldn't read this chat's saved state.",
+        "reopenChat": "Reopen the chat to check again.",
+        "restartFailed": "The agent couldn't restart.",
+        "settleEarlierMessage": "Wait for your earlier message to go through, or retry it.",
+        "startNewChat": "Start a new chat to continue.",
+        "terminalAgentHoldsChat": "This chat is still open in a terminal agent.",
+        "tryAgain": "Try again.",
+        "tryAgainComposerSend": "Send it again.",
+        "turnActive": "The agent is still responding.",
+        "unreachable": "Orca couldn't reach the agent.",
+        "unsupported": "The Orca running this chat doesn't support this. Update Orca, then try again.",
+        "waitForBackgroundTasks": "Wait for the background tasks to finish.",
+        "waitForCommand": "Wait for the /compact or /clear to finish.",
+        "waitForStart": "Wait for the agent to finish starting.",
+        "waitForTurn": "Wait for the agent to finish responding, or stop it.",
+        "waitMoment": "Wait a moment."
       }
     },
     "onboarding": {
@@ -2767,6 +2865,13 @@
       "title": "Agent dashboard"
     }
   },
+  "fileExplorer": {
+    "root": {
+      "omittedFiles": "Files omitted by sparse checkout are not searched.",
+      "viewOnly": "Sparse checkout · View changes do not change checked-out files.",
+      "viewing": "Viewing: {{path}}"
+    }
+  },
   "runtimeRpc": {
     "startupFailure": {
       "guidance": {
@@ -2793,6 +2898,12 @@
       }
     }
   },
+  "sparsePreset": {
+    "description": "Choose the folders a new workspace checks out.",
+    "findPath": "Find a folder…",
+    "finishEditing": "Save or cancel the preset to continue creating your workspace.",
+    "pathHelp": "One repository-relative directory per line. Spaces within a path are preserved."
+  },
   "worktreeJumpPalette": {
     "filter": {
       "chipOverflow": "+{{value0}}",
diff --git a/src/renderer/src/i18n/locales/en.json b/src/renderer/src/i18n/locales/en.json
index 2c9969e8b07..91f2275b0e2 100644
--- a/src/renderer/src/i18n/locales/en.json
+++ b/src/renderer/src/i18n/locales/en.json
@@ -150,7 +150,9 @@
         "resourceUsageToggleDescription": "Show the Resource Manager. Click it for CPU, memory, sessions, daemon controls, and workspace disk scans.",
         "portsToggleDescription": "Show live workspace ports. Click it for workspace-scoped ports and external listeners.",
         "antigravityToggleDescription": "Show Antigravity subscription usage for the active workspace.",
-        "grokToggleDescription": "Show Grok subscription credit usage when signed in via Grok CLI."
+        "grokToggleDescription": "Show Grok subscription credit usage when signed in via Grok CLI.",
+        "cursorToggleDescription": "Show Cursor plan usage when signed in through cursor-agent or Cursor IDE.",
+        "zcodeToggleDescription": "Show ZCode Coding Plan quota usage."
       },
       "menuBarIcon": {
         "title": "Show Menu Bar Icon",
@@ -584,6 +586,7 @@
           "9e2a9bb87b": "Continue",
           "6f8056a565": "Command Code",
           "4238b771b5": "Codebuff",
+          "freebuff_label": "Freebuff",
           "cbaf0c2e0b": "Cline",
           "1f8a19e9ad": "Autohand Code",
           "5e8eff11b3": "Auggie",
@@ -608,10 +611,13 @@
           "da41abbdd4": "Ante",
           "060d152fb5": "Trae",
           "muse_label": "Muse",
+          "dsh_label": "DeepSeek Harness",
+          "qoder_label": "Qoder CLI",
           "zcode_label": "ZCode",
           "d443a47995": "Prime Agent",
           "mimo_code_label": "MiMo Code",
-          "opencode2_label": "OpenCode 2"
+          "opencode2_label": "OpenCode 2",
+          "codebuddy_label": "CodeBuddy"
         },
         "skill": {
           "cli": {
@@ -1722,7 +1728,6 @@
         "notConnected": "Not connected",
         "notePasteTooLarge": "Paste is too large for the note field.",
         "waitForSetupBeforeAgent": "Wait for setup to complete before starting agent",
-        "waitForSetupBeforeAgentHelp": "Turn this on when setup installs dependencies, MCP servers, or config files the agent needs during startup.",
         "destroyDisabled": "destroy disabled",
         "destroyConfigured": "destroy configured",
         "noDestroyConfigured": "no destroy",
@@ -3188,6 +3193,7 @@
           },
           "TerminalContextMenu": {
             "b4cdd9314e": "Clear Screen",
+            "resetTerminal": "Reset Terminal",
             "8c17d6786d": "Close Pane",
             "copyTerminalId": "Copy Terminal ID",
             "2cf85a6a55": "Copy Pane ID",
@@ -3223,7 +3229,9 @@
             "e16012e31e": "The terminal daemon that owned this session exited, so the session and its scrollback could not be recovered. Open a new terminal to continue.",
             "sessionUnavailable": "Orca couldn't reattach to this pane's terminal session on the host. Open a new terminal to continue.",
             "sourceRestoring": "Reconnecting this terminal — its output is being re-established. The session is still running.",
-            "remoteTerminalClosed": "Remote terminal was closed."
+            "remoteTerminalClosed": "Remote terminal was closed.",
+            "ptyAllocationLimit": "Your system cannot allocate any more pty devices. Close some terminals you are not using, in Orca or another program, then try again.",
+            "terminalProcessLimit": "Your system cannot start another terminal process. Close unused terminals or quit unused processes, then try again."
           },
           "TerminalProcessExitOverlay": {
             "capacityTitle": "Git Bash console limit reached",
@@ -3269,7 +3277,7 @@
             "missing": {
               "tui": {
                 "title": "This ZCode build has no terminal UI",
-                "description": "Orca's hooks installed correctly \u2014 the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
+                "description": "Orca's hooks installed correctly — the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
               }
             }
           },
@@ -3396,6 +3404,9 @@
           "TerminalQuickCommandsSubmenu": {
             "3ccc7981bb": "Host unavailable",
             "54f29b7c0d": "Loading host…"
+          },
+          "TerminalRestoringPlaceholder": {
+            "restoring": "Restoring terminal…"
           }
         }
       },
@@ -3815,7 +3826,10 @@
             "grokUsageMenu": "Grok Usage",
             "floatingTerminalNewActivity": "{{label}}, new activity",
             "codexSignInSuccess": "Signed in to Codex",
-            "codexSignInError": "Codex sign-in failed. Please try again."
+            "codexSignInError": "Codex sign-in failed. Please try again.",
+            "cursorUsageMenu": "Cursor Usage",
+            "hiddenUsageProviders": "Also: {{value0}}",
+            "zcodeUsageMenu": "ZCode Usage"
           },
           "StatusBarUsageEmptyCta": {
             "828c764a79": "Connect an account",
@@ -3962,6 +3976,7 @@
             }
           },
           "tooltip": {
+            "zcode": { "mcp": "MCP" },
             "cedb7b99e3": "% used",
             "6d6df77f41": "No data available",
             "7f7f208060": "Monthly",
@@ -4006,6 +4021,13 @@
               "noSubscription": {
                 "label": "No subscription"
               }
+            },
+            "cursor": {
+              "expired": {
+                "label": "Sign-in expired",
+                "message": "Run cursor-agent login in a terminal on the computer running Orca, then retry usage."
+              },
+              "plan": "Plan"
             }
           },
           "SshTargetStatusRow": {
@@ -4106,7 +4128,12 @@
             "checkLabel": "{{value0}} chats to check",
             "checkAriaOne": "1 chat to check after resuming. Click for details.",
             "checkAria": "{{value0}} chats to check after resuming. Click for details.",
-            "checkTooltip": "Chats Orca couldn’t resume, or couldn’t confirm it resumed, after the restart. Click for details."
+            "checkTooltip": "Chats Orca couldn’t resume, or couldn’t confirm it resumed, after the restart. Click for details.",
+            "resumingLabelOne": "Resuming 1 chat",
+            "resumingLabel": "Resuming {{value0}} chats",
+            "resumingAriaOne": "Resuming 1 chat. Click to open details.",
+            "resumingAria": "Resuming {{value0}} chats. Click to open details.",
+            "resumingTooltip": "Restoring interrupted chats and asking them to carry on…"
           }
         }
       },
@@ -8032,8 +8059,7 @@
           "81057d5f71": "Saving...",
           "da37d6f10e": "Copy",
           "3149964b66": "Copied",
-          "waitForSetupBeforeAgent": "Wait for setup to complete before starting agent",
-          "waitForSetupBeforeAgentHelp": "Turn this on when setup installs dependencies, MCP servers, or config files the agent needs during startup."
+          "waitForSetupBeforeAgent": "Wait for setup to complete before starting agent"
         },
         "RepositoryIconPicker": {
           "2b7d27b93c": "Use {{value0}} repo color",
@@ -9085,7 +9111,18 @@
             "b2c4e7f1a8": "endpoint",
             "3a9b6d2c4e": "api key",
             "5d8f1a3b7c": "china",
-            "7e2a4b8c1d": "overseas"
+            "7e2a4b8c1d": "overseas",
+            "cursor": {
+              "title": "Cursor Usage",
+              "description": "Monthly plan usage read from the Cursor sign-in already on this computer (cursor-agent login).",
+              "kw": {
+                "cursor": "cursor",
+                "usage": "usage",
+                "spend": "spend",
+                "rateLimit": "rate limit",
+                "statusBar": "status bar"
+              }
+            }
           }
         },
         "advanced": {
@@ -9141,6 +9178,9 @@
             "0d1c334987": "lid",
             "ff8de8a2ad": "display",
             "0d752916f8": "hooks",
+            "agent-trust-trust": "trust",
+            "agent-trust-folder": "folder",
+            "agent-trust-worktree": "worktree",
             "6984d4291a": "status",
             "13b20636a6": "waiting",
             "8599603496": "done",
@@ -9334,6 +9374,11 @@
             "c5b9f8d1e3": "xai",
             "usagePercentageDisplayTitle": "Usage percentages",
             "usagePercentageDisplayDescription": "Choose whether provider limits show the percentage used or remaining.",
+            "zcodeUsageTitle": "ZCode Usage",
+            "zcodeUsageDescription": "Show ZCode Coding Plan quota usage in the status bar.",
+            "zcode": "zcode",
+            "zai": "zai",
+            "glm": "glm",
             "tray": {
               "tray": "tray",
               "system": "system tray",
@@ -9341,6 +9386,13 @@
               "close": "close",
               "notification": "notification area",
               "background": "background"
+            },
+            "cursor": {
+              "title": "Cursor Usage",
+              "description": "Show monthly Cursor plan usage from the Cursor sign-in on this computer.",
+              "kw": {
+                "cursor": "cursor"
+              }
             }
           }
         },
@@ -10881,6 +10933,10 @@
           "7707c15abb": "Agent status hooks",
           "a68a642835": "Shows working, waiting, and done states in Orca. Turn off to remove Orca-managed hooks and stop reinstalling them."
         },
+        "agent-workspace-trust-copy": {
+          "title": "Trust the folder when Orca starts an agent",
+          "description": "Agents Orca starts skip their \"Do you trust this folder?\" prompt, so the project's agent hooks and settings run right away. Without this, each agent asks the first time it runs in a folder. Agents running without you watching, such as orchestration workers, automations and agents started from your phone, will wait at that question until you answer it in their terminal. Folders already trusted stay trusted."
+        },
         "agent-generated-tab-title-copy": {
           "19ad21615a": "Auto-generate tab titles",
           "b036c7a409": "Derive short stable tab names from the first known agent prompt. Manual renames always win."
@@ -12152,6 +12208,31 @@
         "TerminalRenderingSection": {
           "6d4c55bacc": "Inline Images",
           "fffab5890b": "Display images directly in the terminal using SIXEL, iTerm2 (IIP), and Kitty graphics protocols."
+        },
+        "CursorAccountsSection": {
+          "source": {
+            "keychain": "macOS Keychain (cursor-agent)",
+            "cli": "Cursor CLI auth file",
+            "desktop": "Cursor IDE"
+          },
+          "title": "Cursor",
+          "subtitle": "Shows your monthly Cursor plan usage from the sign-in already on this computer. Orca only reads it — it never changes your Cursor login.",
+          "dashboardLink": "Cursor dashboard",
+          "loading": "Loading…",
+          "signedIn": "Signed in",
+          "signedInFrom": "Signed in. Orca reads the session stored in {{source}}.",
+          "signedInGeneric": "Signed in. Orca reads the Cursor session stored on this computer.",
+          "expired": "Sign-in expired — run cursor-agent login on the computer running Orca, then click Refresh usage.",
+          "signedOut": "No Cursor sign-in found on this computer",
+          "signedOutHelp": "Sign in with Cursor IDE, or run cursor-agent login in a terminal, then click Refresh usage here.",
+          "refreshUsage": "Refresh usage",
+          "usageTitle": "Monthly plan usage",
+          "usageDescription": "Cursor bills two pools that reset with your billing cycle, plus on-demand spend once they run out.",
+          "planTotal": "Plan",
+          "resets": "Resets {{when}}",
+          "usageLabel": "Usage",
+          "noAllowance": "Cursor reported no usage allowance for this account.",
+          "staleUsage": "Last known usage — the latest refresh failed: {{reason}}"
         }
       },
       "right": {
@@ -14956,6 +15037,7 @@
           "f1aa04b5cf": "This file",
           "8b87612461": "All unsent notes"
         },
+        "diffCommentSaveFailed": "Failed to save comment",
         "DiffSectionBody": {
           "35d6afb5be": "Binary file changed",
           "cef4cf0ff5": "Retry",
@@ -15103,6 +15185,7 @@
           "tryAgain": "Try again",
           "kernelCreatingVenv": "Creating .venv…",
           "createVenvItem": "Create virtual environment…",
+          "trustFirst": "Run a cell to trust this notebook first",
           "kernelStartFailed": "The kernel failed to start.",
           "noPython": "Python was not found on this computer. Install it from [python.org](https://www.python.org/downloads/), then run the cell again.",
           "kernelDied": "The kernel died.",
@@ -15598,7 +15681,10 @@
             "2b3ce6d394": "Cancel",
             "e05063cfc1": "Line {{value0}}",
             "c845170b3b": "Lines {{value0}}-{{value1}}",
-            "commentTooLarge": "Comment is too large to submit safely."
+            "commentTooLarge": "Comment is too large to submit safely.",
+            "f6c449191e": "Add note for the AI",
+            "5fa4bfebaa": "Add note",
+            "5e9b3d0c2e": "Adding..."
           },
           "useDiffCommentDecorator": {
             "995fa28b50": "This note"
@@ -17290,6 +17376,13 @@
         "dispatchRejected": "The agent refused the “continue” message. Open the chat and send one yourself.",
         "unsupported": "This chat can’t be resumed by Orca. Open it to see where it stopped.",
         "fallback": "Orca couldn’t resume this chat. Open it to continue manually."
+      },
+      "web": {
+        "preloadApi": {
+          "cursorAccounts": {
+            "hostOnly": "Cursor sign-in details are only readable on the computer running Orca."
+          }
+        }
       }
     },
     "i18n": {
@@ -17398,6 +17491,56 @@
       "empty": "No users found"
     },
     "native-chat": {
+      "writeNotice": {
+        "notDoneReadHistory": "This chat's history couldn't be loaded.",
+        "notDoneSend": "Your message was not sent.",
+        "tryAgainComposerSend": "Send it again.",
+        "notDoneStop": "The agent wasn't stopped.",
+        "notDoneStopTask": "The background task wasn't stopped.",
+        "notDoneStopTasks": "The background tasks weren't stopped.",
+        "notDoneAnswer": "Your answer was not sent.",
+        "notDoneOption": "The setting wasn't changed.",
+        "notDoneCommand": "The command didn't run.",
+        "notDoneGoal": "The goal wasn't changed.",
+        "restartFailed": "The agent couldn't restart.",
+        "capacity": "Orca has received too many requests in the last day.",
+        "outcomeUnknown": "Orca couldn't confirm what happened. Check the chat.",
+        "questionChanged": "This question was already answered or has changed.",
+        "historyUnreadable": "Orca couldn't read this chat's saved history.",
+        "historyUnusable": "Unable to load this chat.",
+        "historyUnavailable": "Orca couldn't open this chat's history right now.",
+        "unsupported": "The Orca running this chat doesn't support this. Update Orca, then try again.",
+        "unreachable": "Orca couldn't reach the agent.",
+        "recordFailed": "Orca couldn't record it in this chat's history.",
+        "conversationCleared": "This conversation has been cleared.",
+        "openCurrentConversation": "Open the current conversation to continue.",
+        "clearUnfinished": "The last /clear didn't finish.",
+        "commandRunning": "A /compact or /clear is still running.",
+        "waitForCommand": "Wait for the /compact or /clear to finish.",
+        "agentStarting": "The agent is still starting.",
+        "waitForStart": "Wait for the agent to finish starting.",
+        "turnActive": "The agent is still responding.",
+        "waitForTurn": "Wait for the agent to finish responding, or stop it.",
+        "promptPending": "The agent is waiting for an answer to a question or approval.",
+        "answerFirst": "Answer the question or approval first.",
+        "backgroundTasksRunning": "Background tasks are still running.",
+        "waitForBackgroundTasks": "Wait for the background tasks to finish.",
+        "messagesUnsettled": "A message you sent earlier hasn't been confirmed yet.",
+        "settleEarlierMessage": "Wait for your earlier message to go through, or retry it.",
+        "optionRejected": "The agent didn't accept this setting.",
+        "goalsUnsupported": "This agent doesn't support goals.",
+        "agentRefused": "The agent turned this down.",
+        "ownerUnproven": "Orca hasn't confirmed that this chat's previous agent stopped.",
+        "reopenChat": "Reopen the chat to check again.",
+        "terminalAgentHoldsChat": "This chat is still open in a terminal agent.",
+        "quitTerminalAgent": "Quit that agent to continue the chat here.",
+        "hostReconciling": "Orca is still checking on this chat after restarting.",
+        "waitMoment": "Wait a moment.",
+        "recordUnreadable": "Orca couldn't read this chat's saved state.",
+        "chatNotFound": "The Orca running this chat has no record of it.",
+        "startNewChat": "Start a new chat to continue.",
+        "tryAgain": "Try again."
+      },
       "taskList": {
         "title": "Tasks",
         "completed": "Completed",
@@ -17631,8 +17774,10 @@
         },
         "error": {
           "title": "Could not load conversation",
-          "subtitle": "The transcript could not be read. Toggle back to the terminal to keep working."
+          "subtitle": "The transcript could not be read. Toggle back to the terminal to keep working.",
+          "retryingSubtitle": "The transcript could not be read. Orca keeps trying to load it."
         },
+        "reconnecting": "Reconnecting to this chat…",
         "pairHost": "Pair a host to view agent chat history.",
         "notAgent": {
           "title": "No conversation here",
@@ -17667,6 +17812,7 @@
       },
       "ask": {
         "awaiting": "Awaiting user input:",
+        "awaitingUnnamed": "Awaiting user input",
         "asked": "Asked:",
         "questionCount": "{{value0}} questions"
       },
@@ -17703,7 +17849,9 @@
         "startedN": "Kicked off {{value0}} subagents",
         "ranOne": "Ran 1 subagent",
         "ranN": "Ran {{value0}} subagents",
-        "tokens": "{{value0}} tokens"
+        "tokens": "{{value0}} tokens",
+        "unnamed": "Subagent",
+        "writtenBy": "Written by subagent {{value0}}"
       },
       "conversationCommand": {
         "pendingWork": "Wait for pending work and messages to finish before using this command.",
@@ -18062,6 +18210,9 @@
           }
         }
       }
+    },
+    "agentChildRow": {
+      "ended": "Ended"
     }
   },
   "dashboardPopout": {
@@ -18276,6 +18427,7 @@
       "needsInput": "needs input",
       "working": "working",
       "stopped": "stopped",
+      "failed": "failed",
       "finished": "finished"
     }
   },
@@ -18363,5 +18515,70 @@
   },
   "common": {
     "retry": "Retry"
+  },
+  "terminal": {
+    "sessionSaveFailure": {
+      "title": "Could not save terminal session",
+      "capacity": "The device saving this terminal reported full storage or an exceeded storage quota. Free space on that device, then try again.",
+      "unknown": "Orca could not save the terminal state. Try again. If this continues, share the Orca logs with support so we can identify the cause."
+    }
+  },
+  "fileExplorer": {
+    "root": {
+      "label": "Explorer root",
+      "full": "Repository root",
+      "viewing": "Viewing: {{path}}",
+      "back": "Back to {{path}}",
+      "searchScope": "Search scope: workspace files",
+      "retry": "Retry",
+      "omittedFiles": "Files omitted by sparse checkout are not searched.",
+      "viewOnly": "Sparse checkout · View changes do not change checked-out files.",
+      "sparseStatus": "Sparse checkout",
+      "scopeDetails": "About sparse checkout scope",
+      "scopeExplanation": "The folder picker changes what you see, not which files are checked out. Repository root includes the checked-out root and ancestor files.",
+      "searchExplanation": "Names filters the folder you are viewing. Contents searches across the workspace. Files omitted by sparse checkout are not searched.",
+      "findInFolder": "Find in {{path}}",
+      "folderLoadError": "Could not load this folder:",
+      "emptyFolder": "No files in this folder"
+    }
+  },
+  "sparsePreset": {
+    "name": "Name",
+    "namePlaceholder": "Web app and shared UI",
+    "directories": "Directories",
+    "pathHelp": "One repository-relative directory per line. Spaces within a path are preserved.",
+    "coneHelp": "Git also keeps files at the repository root and along the parent folders of these directories.",
+    "cancel": "Cancel",
+    "save": "Save preset",
+    "new": "New sparse preset",
+    "edit": "Edit sparse preset",
+    "description": "Choose the folders a new workspace checks out.",
+    "saveFailed": "Could not save the preset. Try again.",
+    "nameRequired": "Name is required.",
+    "nameTooLong": "Name must be 80 characters or fewer.",
+    "nameExists": "A preset named “{{name}}” already exists.",
+    "loading": "Loading presets...",
+    "details": "What gets checked out?",
+    "finishEditing": "Save or cancel the preset to continue creating your workspace.",
+    "pathInstructions": "Pick folders from the repository, or type any repo-relative path.",
+    "retryLoad": "Retry loading presets",
+    "fullCheckout": "Full checkout",
+    "checkoutPreset": "Checkout preset",
+    "search": "Find a preset…",
+    "noMatches": "No matching presets.",
+    "allFiles": "All repository files",
+    "editNamed": "Edit {{name}}",
+    "addPath": "Add a folder",
+    "findPath": "Find a folder…",
+    "noPathMatches": "No folders found.",
+    "repositoryRoot": "Repository root",
+    "loadingPaths": "Reading folders…",
+    "pathsUnavailable": "Could not read this folder. Type the path instead.",
+    "pathAdded": "Added",
+    "openFolder": "Open {{name}}",
+    "findOrTypePath": "Find a folder, or type any path…",
+    "addTypedPath": "Add",
+    "noDirectories": "No folders added yet.",
+    "removePath": "Remove {{name}}"
   }
 }
diff --git a/src/renderer/src/i18n/locales/es.json b/src/renderer/src/i18n/locales/es.json
index 722d704acee..3aff95b8d5e 100644
--- a/src/renderer/src/i18n/locales/es.json
+++ b/src/renderer/src/i18n/locales/es.json
@@ -34,7 +34,8 @@
         "resourceUsageToggleDescription": "Muestra el Administrador de recursos. Haz clic para ver CPU, memoria, sesiones, controles del daemon y análisis de disco de los espacios de trabajo.",
         "portsToggleDescription": "Muestra los puertos activos de los espacios de trabajo. Haz clic para ver los puertos de cada espacio de trabajo y los puertos externos.",
         "antigravityToggleDescription": "Muestra el uso de suscripción de Antigravity para el espacio de trabajo activo.",
-        "grokToggleDescription": "Muestra el uso de créditos de suscripción de Grok cuando has iniciado sesión con Grok CLI."
+        "grokToggleDescription": "Muestra el uso de créditos de suscripción de Grok cuando has iniciado sesión con Grok CLI.",
+        "cursorToggleDescription": "Muestra el uso del plan de Cursor cuando inicias sesión con cursor-agent o el IDE de Cursor."
       },
       "menuBarIcon": {
         "title": "Mostrar icono en la barra de menús",
@@ -384,7 +385,8 @@
           "d443a47995": "Prime Agent",
           "mimo_code_label": "MiMo Code",
           "muse_label": "Muse",
-          "zcode_label": "ZCode"
+          "zcode_label": "ZCode",
+          "codebuddy_label": "CodeBuddy"
         },
         "skill": {
           "cli": {
@@ -727,7 +729,8 @@
             "tooMany": "You can attach up to {{maxCount}} images.",
             "dimensionsTooLarge": "{{fileName}} has dimensions that are too large to preview safely.",
             "invalidImage": "{{fileName}} is not a valid supported image.",
-            "additionalErrors": "{{count}} additional images could not be attached."
+            "additionalErrors": "{{count}} additional images could not be attached.",
+            "totalTooLarge": "{{fileName}} superaría el total de {{maxSize}} de archivos adjuntos."
           }
         }
       }
@@ -1376,7 +1379,6 @@
         "reuseExistingBranchHint": "Haz checkout de la rama existente en lugar de crear una nueva a partir de ella.",
         "createMultiple": "Crear más",
         "waitForSetupBeforeAgent": "Esperar a que termine el setup antes de iniciar el agente",
-        "waitForSetupBeforeAgentHelp": "Activa esto cuando el setup instale dependencias, servidores MCP o archivos de configuración que el agente necesita al iniciar.",
         "destroyDisabled": "destroy deshabilitado",
         "destroyConfigured": "destroy configurado",
         "noDestroyConfigured": "sin destroy",
@@ -2749,6 +2751,7 @@
           },
           "TerminalContextMenu": {
             "b4cdd9314e": "Borrar pantalla",
+            "resetTerminal": "Restablecer terminal",
             "8c17d6786d": "Cerrar panel",
             "copyTerminalId": "Copiar ID de terminal",
             "2cf85a6a55": "Copiar ID del panel",
@@ -2775,7 +2778,9 @@
             "a7e2fd2699": "abre un issue",
             "5c8ce20be6": "Si esto persiste, por favor",
             "cc6d997c65": "Reinicia el servicio del terminal desde aquí para borrar el estado obsoleto.",
-            "remoteTerminalClosed": "La terminal remota se cerró."
+            "remoteTerminalClosed": "La terminal remota se cerró.",
+            "ptyAllocationLimit": "Tu sistema no puede asignar más dispositivos pty. Cierra algunas terminales que no estés usando, en Orca o en otro programa, y vuelve a intentarlo.",
+            "terminalProcessLimit": "Tu sistema no puede iniciar otro proceso de terminal. Cierra las terminales que no uses o sal de los procesos que no necesites y vuelve a intentarlo."
           },
           "TerminalProcessExitOverlay": {
             "capacityTitle": "Se alcanzó el límite de consolas de Git Bash",
@@ -2802,7 +2807,7 @@
             "missing": {
               "tui": {
                 "title": "This ZCode build has no terminal UI",
-                "description": "Orca's hooks installed correctly \u2014 the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
+                "description": "Orca's hooks installed correctly — the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
               }
             }
           },
@@ -2925,6 +2930,9 @@
             "retryingBody": "Orca is retrying automatically. This terminal will resume if the connection returns.",
             "disconnectedBody": "Automatic retries stopped. Reconnect to resume this terminal session.",
             "reconnectButton": "Reconnect"
+          },
+          "TerminalRestoringPlaceholder": {
+            "restoring": "Restaurando terminal…"
           }
         }
       },
@@ -3339,7 +3347,9 @@
             "grokUsageMenu": "Uso de Grok",
             "floatingTerminalNewActivity": "{{label}}, nueva actividad",
             "codexSignInSuccess": "Sesión iniciada en Codex",
-            "codexSignInError": "No se pudo iniciar sesión en Codex. Inténtalo de nuevo."
+            "codexSignInError": "No se pudo iniciar sesión en Codex. Inténtalo de nuevo.",
+            "cursorUsageMenu": "Uso de Cursor",
+            "hiddenUsageProviders": "También: {{value0}}"
           },
           "StatusBarUsageEmptyCta": {
             "828c764a79": "Conectar una cuenta",
@@ -3507,6 +3517,13 @@
               "noSubscription": {
                 "label": "Sin suscripción"
               }
+            },
+            "cursor": {
+              "expired": {
+                "label": "Inicio de sesión caducado",
+                "message": "Ejecuta cursor-agent login en una terminal del equipo donde se ejecuta Orca y vuelve a intentar consultar el uso."
+              },
+              "plan": "Plan"
             }
           },
           "SshTargetStatusRow": {
@@ -3598,7 +3615,12 @@
             "checkLabel": "{{value0}} chats por revisar",
             "checkAriaOne": "1 chat por revisar tras la reanudación. Haz clic para ver los detalles.",
             "checkAria": "{{value0}} chats por revisar tras la reanudación. Haz clic para ver los detalles.",
-            "checkTooltip": "Chats que Orca no pudo reanudar, o no pudo confirmar que reanudó, tras el reinicio. Haz clic para ver los detalles."
+            "checkTooltip": "Chats que Orca no pudo reanudar, o no pudo confirmar que reanudó, tras el reinicio. Haz clic para ver los detalles.",
+            "resumingLabelOne": "Reanudando 1 chat",
+            "resumingLabel": "Reanudando {{value0}} chats",
+            "resumingAriaOne": "Reanudando 1 chat. Haz clic para ver los detalles.",
+            "resumingAria": "Reanudando {{value0}} chats. Haz clic para ver los detalles.",
+            "resumingTooltip": "Restaurando los chats interrumpidos y pidiéndoles que continúen…"
           }
         }
       },
@@ -4452,7 +4474,9 @@
           "69969ba364": "Envío…",
           "imageReadFailed": "Could not read the attached images. Try attaching them again.",
           "attachWhileSending": "Wait for the current feedback to finish sending before attaching more images.",
-          "imagesNotDelivered": "Feedback sent, but image delivery could not be confirmed."
+          "imagesNotDelivered": "Feedback sent, but image delivery could not be confirmed.",
+          "imagesNotIncluded": "Comentarios enviados. No se pudieron subir tus capturas de pantalla y no se incluyeron.",
+          "imagesRejected": "Comentarios enviados. Tus capturas de pantalla eran demasiado grandes para subirlas y no se incluyeron."
         },
         "SidebarFilter": {
           "e3b3898218": "Agregar proyecto",
@@ -5334,7 +5358,8 @@
         },
         "SidebarFeedbackImageAttachments": {
           "attachImages": "Attach",
-          "removeImage": "Remove {{fileName}}"
+          "removeImage": "Remove {{fileName}}",
+          "screenshotsHint": "Adjunta hasta {{count}} capturas de pantalla, {{maxSize}} en total"
         },
         "WorkspaceKanbanSearchField": {
           "bdb753c78d": "Ningún espacio de trabajo coincide",
@@ -6064,7 +6089,8 @@
             "shellEnvNamesAlwaysPassed": "PATH, la configuración regional y SSH_AUTH_SOCK se pasan siempre. Se aplica la próxima vez que un chat se inicie o se reanude.",
             "shellEnvTitle": "Usar el entorno de tu shell",
             "shellEnvCopy": "Los chats de Codex y Claude empiezan con todas las variables que exporta tu shell de inicio de sesión, igual que un terminal. Desactívalo para elegir cuáles reciben.",
-            "shellEnvToggleLabel": "Alternar el uso del entorno de tu shell"
+            "shellEnvToggleLabel": "Alternar el uso del entorno de tu shell",
+            "resumeCopy": "Cuando Orca se cierra o instala una actualización, los chats que estaban trabajando se reanudan automáticamente al volver a abrir Orca."
           },
           "agentDashboard": {
             "title": "Panel de agentes",
@@ -6782,8 +6808,7 @@
           "81057d5f71": "Guardando...",
           "da37d6f10e": "Copiar",
           "3149964b66": "Copiado",
-          "waitForSetupBeforeAgent": "Espera a que se complete la configuración antes de iniciar el agente",
-          "waitForSetupBeforeAgentHelp": "Activa esto cuando la configuración instale dependencias, servidores MCP o archivos de configuración que el agente necesite durante el inicio."
+          "waitForSetupBeforeAgent": "Espera a que se complete la configuración antes de iniciar el agente"
         },
         "RepositoryIconPicker": {
           "2b7d27b93c": "Usar {{value0}} como color del repositorio",
@@ -7813,7 +7838,18 @@
             "d2c6a0e8f1": "grok",
             "c1b5f9d7e0": "xai",
             "b0a4e8c6d9": "OAuth",
-            "a9f3d7b5c8": "inicio de sesión"
+            "a9f3d7b5c8": "inicio de sesión",
+            "cursor": {
+              "description": "Uso mensual del plan obtenido del inicio de sesión de Cursor que ya está en este equipo (cursor-agent login).",
+              "kw": {
+                "cursor": "cursor",
+                "rateLimit": "rate limit",
+                "spend": "gasto",
+                "statusBar": "barra de estado",
+                "usage": "uso"
+              },
+              "title": "Uso de Cursor"
+            }
           }
         },
         "advanced": {
@@ -7869,6 +7905,9 @@
             "0d1c334987": "tapa",
             "ff8de8a2ad": "pantalla",
             "0d752916f8": "hooks",
+            "agent-trust-trust": "confianza",
+            "agent-trust-folder": "carpeta",
+            "agent-trust-worktree": "worktree",
             "6984d4291a": "estado",
             "13b20636a6": "esperando",
             "8599603496": "hecho",
@@ -8040,7 +8079,14 @@
             "d6c0a9e2f4": "grok",
             "c5b9f8d1e3": "xai",
             "usagePercentageDisplayTitle": "Porcentajes de uso",
-            "usagePercentageDisplayDescription": "Elige si los límites del proveedor muestran el porcentaje usado o restante."
+            "usagePercentageDisplayDescription": "Elige si los límites del proveedor muestran el porcentaje usado o restante.",
+            "cursor": {
+              "description": "Muestra el uso mensual del plan de Cursor a partir del inicio de sesión de Cursor en este equipo.",
+              "kw": {
+                "cursor": "cursor"
+              },
+              "title": "Uso de Cursor"
+            }
           }
         },
         "auto": {
@@ -9445,6 +9491,10 @@
           "7707c15abb": "Hooks de estado del agente",
           "a68a642835": "Muestra los estados trabajando, esperando y completado en Orca. Desactívalo para quitar los hooks administrados por Orca y dejar de reinstalarlos."
         },
+        "agent-workspace-trust-copy": {
+          "title": "Confiar en la carpeta cuando Orca inicia un agente",
+          "description": "Los agentes que inicia Orca omiten su pregunta \"Do you trust this folder?\", así que los hooks y ajustes de agente del proyecto se ejecutan de inmediato. Sin esto, cada agente pregunta la primera vez que se ejecuta en una carpeta. Los agentes que se ejecutan sin que estés mirando, como los workers de orquestación, las automatizaciones y los agentes iniciados desde tu teléfono, esperarán en esa pregunta hasta que la respondas en su terminal. Las carpetas que ya son de confianza lo siguen siendo."
+        },
         "agent-generated-tab-title-copy": {
           "19ad21615a": "Generar títulos de pestañas automáticamente",
           "b036c7a409": "Deriva nombres de pestañas breves y estables a partir del primer prompt conocido del agente. Los cambios de nombre manuales siempre tienen prioridad."
@@ -10430,6 +10480,31 @@
           "saveFailed": "No se pudieron guardar los valores predeterminados de visibilidad.",
           "updateServer": "Actualiza este servidor para configurar los valores predeterminados de las fuentes.",
           "updateServerDefaults": "Actualiza este servidor para configurar los valores predeterminados de visibilidad."
+        },
+        "CursorAccountsSection": {
+          "dashboardLink": "Panel de Cursor",
+          "expired": "Inicio de sesión caducado — ejecuta cursor-agent login en el equipo donde se ejecuta Orca y haz clic en Actualizar uso.",
+          "loading": "Cargando…",
+          "noAllowance": "Cursor no reportó ninguna cuota de uso para esta cuenta.",
+          "planTotal": "Plan",
+          "refreshUsage": "Actualizar uso",
+          "resets": "Se restablece {{when}}",
+          "signedIn": "Sesión iniciada",
+          "signedInFrom": "Sesión iniciada. Orca lee la sesión almacenada en {{source}}.",
+          "signedInGeneric": "Sesión iniciada. Orca lee la sesión de Cursor almacenada en este equipo.",
+          "signedOut": "No se encontró ningún inicio de sesión de Cursor en este equipo",
+          "signedOutHelp": "Inicia sesión con el IDE de Cursor o ejecuta cursor-agent login en una terminal, y haz clic en Actualizar uso aquí.",
+          "source": {
+            "cli": "Archivo de autenticación de Cursor CLI",
+            "desktop": "IDE de Cursor",
+            "keychain": "Llavero de macOS (cursor-agent)"
+          },
+          "staleUsage": "Último uso conocido — falló la actualización más reciente: {{reason}}",
+          "subtitle": "Muestra tu uso mensual del plan de Cursor a partir del inicio de sesión que ya está en este equipo. Orca solo lo lee — nunca modifica tu inicio de sesión de Cursor.",
+          "title": "Cursor",
+          "usageDescription": "Cursor factura dos cuotas que se restablecen con tu ciclo de facturación, más gasto bajo demanda cuando se agotan.",
+          "usageLabel": "Uso",
+          "usageTitle": "Uso mensual del plan"
         }
       },
       "right": {
@@ -12972,6 +13047,7 @@
           "f1aa04b5cf": "Este archivo",
           "8b87612461": "Todas las notas no enviadas"
         },
+        "diffCommentSaveFailed": "No se pudo guardar el comentario",
         "DiffSectionBody": {
           "35d6afb5be": "Archivo binario cambiado",
           "cef4cf0ff5": "Reintentar",
@@ -13089,6 +13165,7 @@
           "notPython": "Ese archivo no es un intérprete de Python.",
           "interrupt": "Interrumpir",
           "restart": "Reiniciar kernel",
+          "trustFirst": "Ejecuta una celda para confiar primero en este notebook",
           "runAll": "Ejecutar todo",
           "clearAll": "Borrar todas las salidas",
           "notResponding": "Sin respuesta. Reinicia el kernel",
@@ -13104,7 +13181,22 @@
           "noPython": "No se encontró Python en este equipo. Instálalo desde [python.org](https://www.python.org/downloads/) y vuelve a ejecutar la celda.",
           "kernelDied": "El kernel murió.",
           "localOnly": "Las celdas del notebook solo pueden ejecutarse para archivos de este equipo.",
-          "pythonOnly": "Solo los notebooks de Python pueden ejecutarse en Orca."
+          "pythonOnly": "Solo los notebooks de Python pueden ejecutarse en Orca.",
+          "commandCopied": "Comando copiado",
+          "createVenv": "Crear .venv",
+          "createVenvItem": "Crear entorno virtual…",
+          "createVenvTitle": "¿Crear un entorno virtual?",
+          "creatingButton": "Creando…",
+          "creatingVenvDescription": "Creando .venv en {{folder}} e instalando ipykernel en él. Esto puede tardar un minuto.",
+          "creatingVenvTitle": "Creando entorno virtual…",
+          "installingButton": "Instalando…",
+          "installingDescription": "Instalando ipykernel en '{{env}}' con pip. Esto puede tardar un minuto.",
+          "installingTitle": "Instalando ipykernel…",
+          "kernelCreatingVenv": "Creando .venv…",
+          "setupFailed": "No funcionó. Salida de Python:",
+          "tryAgain": "Intentar de nuevo",
+          "useAnotherPython": "Usar otro Python…",
+          "venvDescription": "Orca creará un .venv en {{folder}} desde '{{env}}', instalará ipykernel en él y ejecutará este notebook allí."
         },
         "MarkdownPreview": {
           "e4683f70c4": "Cancelar",
@@ -13552,7 +13644,10 @@
             "2b3ce6d394": "Cancelar",
             "e05063cfc1": "Línea {{value0}}",
             "c845170b3b": "Líneas {{value0}}-{{value1}}",
-            "commentTooLarge": "El comentario es demasiado grande para enviarlo de forma segura."
+            "commentTooLarge": "El comentario es demasiado grande para enviarlo de forma segura.",
+            "f6c449191e": "Agregar nota para la IA",
+            "5fa4bfebaa": "Agregar nota",
+            "5e9b3d0c2e": "Agregando..."
           },
           "useDiffCommentDecorator": {
             "995fa28b50": "esta nota"
@@ -14745,7 +14840,17 @@
         "notConfirmedOtherOne": "No se pudo confirmar que 1 otro chat se reanudó",
         "notConfirmedOtherMany": "No se pudo confirmar que {{value0}} otros chats se reanudaron",
         "show": "Mostrar",
-        "dismiss": "Descartar"
+        "dismiss": "Descartar",
+        "activityApproval": "Esperando tu aprobación: {{value0}}",
+        "activityMidReply": "Estaba respondiendo",
+        "activityMonitorMany": "Supervisando {{value0}} tareas en segundo plano",
+        "activityMonitorOne": "Supervisando: {{value0}}",
+        "activityQuestion": "Esperando tu respuesta: {{value0}}",
+        "activitySubagentMany": "{{value0}} subagentes en ejecución",
+        "activitySubagentOne": "Subagente en ejecución: {{value0}}",
+        "activityUnnamed": "sin nombre",
+        "updateBody": "Estos chats estaban trabajando cuando Orca instaló una actualización. Al reanudarlos, cada uno se restaura donde se detuvo, con su contexto completo, y se pide al agente que revise lo que estaba haciendo antes de continuar. Tu propio prompt no se vuelve a enviar.",
+        "body": "Estos chats estaban trabajando cuando Orca se cerró. Al reanudarlos, cada uno se restaura donde se detuvo, con su contexto completo, y se pide al agente que revise lo que estaba haciendo antes de continuar. Tu propio prompt no se vuelve a enviar."
       },
       "NativeChatResumeOutcomeRow": {
         "openChat": "Abrir chat",
@@ -14766,6 +14871,13 @@
         "dispatchRejected": "El agente rechazó el mensaje “continue”. Abre el chat y envía uno tú mismo.",
         "unsupported": "Orca no puede reanudar este chat. Ábrelo para ver dónde se detuvo.",
         "fallback": "Orca no pudo reanudar este chat. Ábrelo para continuar manualmente."
+      },
+      "web": {
+        "preloadApi": {
+          "cursorAccounts": {
+            "hostOnly": "Los detalles del inicio de sesión de Cursor solo se pueden leer en el equipo donde se ejecuta Orca."
+          }
+        }
       }
     },
     "i18n": {
@@ -14828,6 +14940,56 @@
   },
   "components": {
     "native-chat": {
+      "writeNotice": {
+        "notDoneReadHistory": "No se pudo cargar el historial de este chat.",
+        "notDoneSend": "Su mensaje no se envió.",
+        "tryAgainComposerSend": "Vuelva a enviarlo.",
+        "notDoneStop": "El agente no se detuvo.",
+        "notDoneStopTask": "La tarea en segundo plano no se detuvo.",
+        "notDoneStopTasks": "Las tareas en segundo plano no se detuvieron.",
+        "notDoneAnswer": "Su respuesta no se envió.",
+        "notDoneOption": "La configuración no se cambió.",
+        "notDoneCommand": "El comando no se ejecutó.",
+        "notDoneGoal": "El objetivo no se cambió.",
+        "restartFailed": "El agente no pudo reiniciarse.",
+        "capacity": "Orca ha recibido demasiadas solicitudes en el último día.",
+        "outcomeUnknown": "Orca no pudo confirmar qué pasó. Revise el chat.",
+        "questionChanged": "Esta pregunta ya se respondió o ha cambiado.",
+        "historyUnreadable": "Orca no pudo leer el historial guardado de este chat.",
+        "historyUnusable": "No se puede cargar este chat.",
+        "historyUnavailable": "Orca no pudo abrir el historial de este chat en este momento.",
+        "unsupported": "La versión de Orca que ejecuta este chat no lo admite. Actualice Orca y vuelva a intentarlo.",
+        "unreachable": "Orca no pudo comunicarse con el agente.",
+        "recordFailed": "Orca no pudo registrarlo en el historial de este chat.",
+        "conversationCleared": "Esta conversación se borró.",
+        "openCurrentConversation": "Abra la conversación actual para continuar.",
+        "clearUnfinished": "El último /clear no terminó.",
+        "commandRunning": "Todavía se está ejecutando un /compact o /clear.",
+        "waitForCommand": "Espere a que termine el /compact o /clear.",
+        "agentStarting": "El agente todavía se está iniciando.",
+        "waitForStart": "Espere a que el agente termine de iniciarse.",
+        "turnActive": "El agente todavía está respondiendo.",
+        "waitForTurn": "Espere a que el agente termine de responder o deténgalo.",
+        "promptPending": "El agente está esperando una respuesta a una pregunta o aprobación.",
+        "answerFirst": "Responda primero a la pregunta o aprobación.",
+        "backgroundTasksRunning": "Todavía hay tareas en segundo plano en ejecución.",
+        "waitForBackgroundTasks": "Espere a que terminen las tareas en segundo plano.",
+        "messagesUnsettled": "Un mensaje que envió antes todavía no se ha confirmado.",
+        "settleEarlierMessage": "Espere a que se entregue su mensaje anterior o vuelva a intentarlo.",
+        "optionRejected": "El agente no aceptó este ajuste.",
+        "goalsUnsupported": "Este agente no admite objetivos.",
+        "agentRefused": "El agente lo rechazó.",
+        "ownerUnproven": "Orca no ha confirmado que el agente anterior de este chat se haya detenido.",
+        "reopenChat": "Vuelva a abrir el chat para comprobarlo de nuevo.",
+        "terminalAgentHoldsChat": "Este chat sigue abierto en un agente de terminal.",
+        "quitTerminalAgent": "Cierre ese agente para continuar el chat aquí.",
+        "hostReconciling": "Orca todavía está comprobando este chat después de reiniciarse.",
+        "waitMoment": "Espere un momento.",
+        "recordUnreadable": "Orca no pudo leer el estado guardado de este chat.",
+        "chatNotFound": "La versión de Orca que ejecuta este chat no tiene ningún registro de él.",
+        "startNewChat": "Inicie un chat nuevo para continuar.",
+        "tryAgain": "Vuelva a intentarlo."
+      },
       "composer": {
         "imageUnsupported": "Este agente no admite pegar imágenes.",
         "send": "Enviar",
@@ -14905,8 +15067,10 @@
         },
         "error": {
           "title": "No se pudo cargar la conversación",
-          "subtitle": "No se pudo leer la transcripción. Vuelva a la terminal para seguir trabajando."
+          "subtitle": "No se pudo leer la transcripción. Vuelva a la terminal para seguir trabajando.",
+          "retryingSubtitle": "No se pudo leer la transcripción. Orca sigue intentando cargarla."
         },
+        "reconnecting": "Reconectando con este chat…",
         "pairHost": "Empareje un host para ver el historial de chat del agente.",
         "notAgent": {
           "title": "No hay conversación aquí",
@@ -14951,6 +15115,10 @@
         "label": "Contexto: {{used}} de {{window}} tokens, {{percent}} % usados",
         "title": "Contexto",
         "estimated": "Estimado a partir de la última respuesta."
+      },
+      "subagents": {
+        "unnamed": "Subagente",
+        "writtenBy": "Escrito por el subagente {{value0}}"
       }
     },
     "tab": {
@@ -15015,6 +15183,9 @@
         "copySessionIdSuccess": "ID de sesión copiado",
         "copySessionIdError": "No se pudo copiar el ID de sesión"
       }
+    },
+    "agentChildRow": {
+      "ended": "Finalizado"
     }
   },
   "dashboardPopout": {
@@ -15158,7 +15329,114 @@
       "needsInput": "necesita información",
       "working": "trabajando",
       "stopped": "detenido",
+      "failed": "fallido",
       "finished": "finalizado"
     }
+  },
+  "featureTips": {
+    "sessionSearch": {
+      "ageHours": "2 h",
+      "ageMinutes": "12 min",
+      "ageYesterday": "1 d",
+      "agentsInstruction": "Tus agentes también pueden buscar en él. Pide a uno que “encuentre la sesión donde corregimos el tiempo de espera del inicio de sesión”.",
+      "consentInstruction": "Cámbialo o desactívalo cuando quieras en",
+      "continueInBackground": "Continuar en segundo plano",
+      "demoHit1Age": "3 d",
+      "demoHit1Snippet": "Aumentó el [[tiempo de espera de inicio de sesión]] a 30 s y agregó un reintento en la actualización del token.",
+      "demoHit1Title": "Corregir redirección de autenticación inestable",
+      "demoHit2Age": "1 sem",
+      "demoHit2Snippet": "¿Por qué se cuelga la página de [[inicio de sesión]] después de un [[tiempo de espera]] al reactivar?",
+      "demoHit2Title": "Actualización de sesión tras suspensión",
+      "demoHit3Age": "2 sem",
+      "demoHit3Snippet": "Agregó una prueba que cubre la ruta de [[tiempo de espera de inicio de sesión]] de principio a fin.",
+      "demoHit3Title": "Refuerzo e2e de autenticación",
+      "demoHit4Age": "5 d",
+      "demoHit4Snippet": "La [[reversión]] elimina primero el índice nuevo y luego restaura la columna anterior.",
+      "demoHit4Title": "Migración de la tabla de pedidos",
+      "demoHit5Age": "3 sem",
+      "demoHit5Snippet": "¿Puedes escribir un plan de [[reversión]] de la [[migración]] antes de reintentar?",
+      "demoHit5Title": "Falló la implementación en staging",
+      "demoHit6Age": "1 mes",
+      "demoHit6Snippet": "Cada [[migración]] aquí es reversible excepto el cambio de nombre del enum.",
+      "demoHit6Title": "Notas de revisión del esquema",
+      "demoQuery": "tiempo de espera de inicio de sesión",
+      "demoQuery2": "reversión de migración",
+      "demoRoleAssistant": "Asistente",
+      "demoRoleUser": "Usuario",
+      "enableFailed": "No se pudo activar la búsqueda de sesiones. Inténtalo de nuevo.",
+      "indexingDescription": "Orca está leyendo tus transcripciones anteriores de agentes para que puedas buscar en ellas. Esto puede tardar unos minutos.",
+      "indexingTitle": "Indexando tus sesiones de agentes",
+      "progressStarting": "Buscando tus sesiones…",
+      "readyDescription": "Todas las sesiones de agentes de este equipo ya se pueden encontrar por lo que se dijo en ellas.",
+      "readyTitle": "La búsqueda de sesiones está lista",
+      "readyToast": "La búsqueda de sesiones está lista",
+      "readyToastOpen": "Abrir",
+      "recent1Text": "Movió las entradas de búsqueda a Flujos de trabajo y actualizó las pruebas.",
+      "recent1Title": "Ordenar la barra lateral de ajustes",
+      "recent2Text": "Actualiza las dependencias y asegúrate de que la compilación siga pasando.",
+      "recent2Title": "Actualizar el archivo de bloqueo",
+      "recent3Text": "Esta es una primera versión de las notas, agrupadas por área.",
+      "recent3Title": "Borrador de notas de la versión",
+      "settingsLink": "Ajustes → Búsqueda de sesiones de agentes",
+      "startSearching": "Empezar a buscar"
+    }
+  },
+  "fileExplorer": {
+    "root": {
+      "label": "Raíz del explorador",
+      "full": "Raíz del repositorio",
+      "viewing": "Viendo: {{path}}",
+      "back": "Volver a {{path}}",
+      "searchScope": "Ámbito: archivos del espacio de trabajo",
+      "retry": "Reintentar",
+      "omittedFiles": "Los archivos excluidos por el checkout disperso no se buscan.",
+      "viewOnly": "Checkout disperso · Cambiar la vista no cambia los archivos extraídos.",
+      "sparseStatus": "Checkout disperso",
+      "scopeDetails": "Acerca del alcance del checkout disperso",
+      "scopeExplanation": "El selector de carpetas cambia lo que ves, no los archivos del checkout. La raíz del repositorio incluye los archivos presentes en la raíz y en las carpetas superiores.",
+      "searchExplanation": "Nombres filtra la carpeta que estás viendo. Contenido busca en todo el espacio de trabajo. No se buscan los archivos omitidos por el checkout disperso.",
+      "findInFolder": "Buscar en {{path}}",
+      "folderLoadError": "No se pudo cargar esta carpeta:",
+      "emptyFolder": "No hay archivos en esta carpeta"
+    }
+  },
+  "sparsePreset": {
+    "nameRequired": "El nombre es obligatorio.",
+    "nameTooLong": "El nombre debe tener 80 caracteres o menos.",
+    "nameExists": "Ya existe un preajuste llamado «{{name}}».",
+    "name": "Nombre",
+    "namePlaceholder": "Aplicación web e IU compartida",
+    "directories": "Directorios",
+    "pathHelp": "Un directorio relativo al repositorio por línea. Se conservan los espacios dentro de las rutas.",
+    "coneHelp": "Git también conserva los archivos de la raíz del repositorio y de las carpetas superiores de estos directorios.",
+    "cancel": "Cancelar",
+    "save": "Guardar preajuste",
+    "new": "Nuevo preajuste de checkout disperso",
+    "edit": "Editar preajuste de checkout disperso",
+    "description": "Elige las carpetas que se extraerán en un nuevo espacio de trabajo.",
+    "saveFailed": "No se pudo guardar el preajuste. Inténtalo de nuevo.",
+    "loading": "Cargando preajustes...",
+    "details": "¿Qué archivos se extraen?",
+    "finishEditing": "Guarda o cancela el preajuste para continuar creando tu espacio de trabajo.",
+    "pathInstructions": "Una carpeta por línea, con la ruta relativa a la raíz del repositorio.",
+    "retryLoad": "Reintentar cargar los ajustes predefinidos",
+    "fullCheckout": "Checkout completo",
+    "checkoutPreset": "Ajuste predefinido de checkout",
+    "search": "Buscar un ajuste predefinido…",
+    "noMatches": "No hay ajustes predefinidos que coincidan.",
+    "allFiles": "Todos los archivos del repositorio",
+    "editNamed": "Editar {{name}}",
+    "addPath": "Add a folder",
+    "findPath": "Find a folder…",
+    "noPathMatches": "No folders found.",
+    "repositoryRoot": "Repository root",
+    "loadingPaths": "Reading folders…",
+    "pathsUnavailable": "Could not read this folder. Type the path instead.",
+    "pathAdded": "Added",
+    "openFolder": "Open {{name}}",
+    "findOrTypePath": "Find a folder, or type any path…",
+    "addTypedPath": "Add",
+    "noDirectories": "No folders added yet.",
+    "removePath": "Remove {{name}}"
   }
 }
diff --git a/src/renderer/src/i18n/locales/fr.json b/src/renderer/src/i18n/locales/fr.json
index add1dd437d3..42058065579 100644
--- a/src/renderer/src/i18n/locales/fr.json
+++ b/src/renderer/src/i18n/locales/fr.json
@@ -133,7 +133,8 @@
         "resourceUsageToggleDescription": "Afficher le gestionnaire de ressources. Cliquez dessus pour le CPU, la mémoire, les sessions, les contrôles des daemons et les analyses disque des espaces de travail.",
         "portsToggleDescription": "Afficher les ports actifs de l'espace de travail. Cliquez dessus pour les ports par espace de travail et les écouteurs externes.",
         "antigravityToggleDescription": "Afficher l'utilisation de l'abonnement Antigravity pour l'espace de travail actif.",
-        "grokToggleDescription": "Afficher l'utilisation des crédits de l'abonnement Grok lorsque vous êtes connecté via Grok CLI."
+        "grokToggleDescription": "Afficher l'utilisation des crédits de l'abonnement Grok lorsque vous êtes connecté via Grok CLI.",
+        "cursorToggleDescription": "Afficher l'utilisation du forfait Cursor lorsque vous êtes connecté via cursor-agent ou Cursor IDE."
       },
       "menuBarIcon": {
         "title": "Afficher l'icône dans la barre de menus",
@@ -594,6 +595,7 @@
           "mimo_code_label": "MiMo Code",
           "muse_label": "Muse",
           "opencode2_label": "OpenCode 2",
+          "codebuddy_label": "CodeBuddy",
           "zcode_label": "ZCode"
         },
         "skill": {
@@ -968,7 +970,8 @@
             "tooMany": "Vous pouvez joindre jusqu'à {{maxCount}} images.",
             "dimensionsTooLarge": "{{fileName}} a des dimensions trop grandes pour un aperçu sans risque.",
             "invalidImage": "{{fileName}} n'est pas une image valide prise en charge.",
-            "additionalErrors": "{{count}} images supplémentaires n'ont pas pu être jointes."
+            "additionalErrors": "{{count}} images supplémentaires n'ont pas pu être jointes.",
+            "totalTooLarge": "{{fileName}} ferait dépasser {{maxSize}} au total pour les pièces jointes."
           }
         }
       },
@@ -1703,7 +1706,6 @@
         "notConnected": "Non connecté",
         "notePasteTooLarge": "Le contenu collé est trop volumineux pour le champ de note.",
         "waitForSetupBeforeAgent": "Attendre la fin du setup avant de démarrer l'agent",
-        "waitForSetupBeforeAgentHelp": "Activez cette option quand le setup installe des dépendances, des serveurs MCP ou des fichiers de configuration dont l'agent a besoin au démarrage.",
         "destroyDisabled": "destroy désactivé",
         "destroyConfigured": "destroy configuré",
         "noDestroyConfigured": "pas de destroy",
@@ -3134,6 +3136,7 @@
           },
           "TerminalContextMenu": {
             "b4cdd9314e": "Effacer l'écran",
+            "resetTerminal": "Réinitialiser le terminal",
             "8c17d6786d": "Fermer le volet",
             "copyTerminalId": "Copier l'ID du terminal",
             "2cf85a6a55": "Copier l'ID du volet",
@@ -3169,7 +3172,9 @@
             "ownerUnknown": "Orca n'a pas pu vérifier le propriétaire de ce terminal.",
             "42b283ecfc": "Orca n'a pas pu reconnecter ce terminal en toute sécurité car l'hôte n'a pas pu vérifier sa session enregistrée. Orca a laissé la session enregistrée inchangée. Cliquez sur Réessayer pour essayer de vous reconnecter maintenant. S'il ne parvient toujours pas à se reconnecter, ouvrez un nouveau terminal.",
             "sourceRestoring": "Reconnexion de ce terminal - sa sortie est en cours de rétablissement. La session est toujours en cours.",
-            "remoteTerminalClosed": "Le terminal distant était fermé."
+            "remoteTerminalClosed": "Le terminal distant était fermé.",
+            "ptyAllocationLimit": "Votre système ne peut plus allouer de périphériques pty. Fermez quelques terminaux inutilisés, dans Orca ou dans un autre programme, puis réessayez.",
+            "terminalProcessLimit": "Votre système ne peut pas démarrer un autre processus de terminal. Fermez les terminaux inutilisés ou quittez les processus inutiles, puis réessayez."
           },
           "TerminalProcessExitOverlay": {
             "capacityTitle": "Limite de consoles Git Bash atteinte",
@@ -3215,7 +3220,7 @@
             "missing": {
               "tui": {
                 "title": "This ZCode build has no terminal UI",
-                "description": "Orca's hooks installed correctly \u2014 the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
+                "description": "Orca's hooks installed correctly — the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
               }
             }
           },
@@ -3342,6 +3347,9 @@
           "TerminalQuickCommandsSubmenu": {
             "3ccc7981bb": "Hôte indisponible",
             "54f29b7c0d": "Chargement de l'hôte…"
+          },
+          "TerminalRestoringPlaceholder": {
+            "restoring": "Restauration du terminal…"
           }
         }
       },
@@ -3761,7 +3769,9 @@
             "grokUsageMenu": "Utilisation Grok",
             "floatingTerminalNewActivity": "{{label}}, nouvelle activité",
             "codexSignInSuccess": "Connecté à Codex",
-            "codexSignInError": "Échec de la connexion à Codex. Veuillez réessayer."
+            "codexSignInError": "Échec de la connexion à Codex. Veuillez réessayer.",
+            "cursorUsageMenu": "Utilisation Cursor",
+            "hiddenUsageProviders": "Aussi : {{value0}}"
           },
           "StatusBarUsageEmptyCta": {
             "828c764a79": "Connecter un compte",
@@ -3952,6 +3962,13 @@
               "noSubscription": {
                 "label": "Aucun abonnement"
               }
+            },
+            "cursor": {
+              "expired": {
+                "label": "Connexion expirée",
+                "message": "Exécutez cursor-agent login dans un terminal sur l'ordinateur qui exécute Orca, puis réessayez."
+              },
+              "plan": "Forfait"
             }
           },
           "SshTargetStatusRow": {
@@ -4052,7 +4069,12 @@
             "checkLabel": "{{value0}} chats à vérifier",
             "checkAriaOne": "1 chat à vérifier après la reprise. Cliquez pour plus de détails.",
             "checkAria": "{{value0}} chats à vérifier après la reprise. Cliquez pour plus de détails.",
-            "checkTooltip": "Chats qu'Orca n'a pas pu reprendre, ou dont il n'a pas pu confirmer la reprise, après le redémarrage. Cliquez pour plus de détails."
+            "checkTooltip": "Chats qu'Orca n'a pas pu reprendre, ou dont il n'a pas pu confirmer la reprise, après le redémarrage. Cliquez pour plus de détails.",
+            "resumingLabelOne": "Reprise d’1 conversation",
+            "resumingLabel": "Reprise de {{value0}} conversations",
+            "resumingAriaOne": "Reprise d’1 conversation. Cliquez pour voir les détails.",
+            "resumingAria": "Reprise de {{value0}} conversations. Cliquez pour voir les détails.",
+            "resumingTooltip": "Restauration des conversations interrompues et demande de poursuite…"
           }
         }
       },
@@ -5341,7 +5363,9 @@
           "69969ba364": "Envoi…",
           "imageReadFailed": "Impossible de lire les images jointes. Essayez de les joindre à nouveau.",
           "attachWhileSending": "Attendez la fin de l'envoi du commentaire en cours avant de joindre d'autres images.",
-          "imagesNotDelivered": "Commentaire envoyé, mais la livraison des images n'a pas pu être confirmée."
+          "imagesNotDelivered": "Commentaire envoyé, mais la livraison des images n'a pas pu être confirmée.",
+          "imagesNotIncluded": "Commentaire envoyé. Vos captures d'écran n'ont pas pu être téléversées et n'ont pas été incluses.",
+          "imagesRejected": "Commentaire envoyé. Vos captures d'écran étaient trop volumineuses pour être téléversées et n'ont pas été incluses."
         },
         "SidebarFilter": {
           "e3b3898218": "Ajouter un projet",
@@ -6241,7 +6265,8 @@
         },
         "SidebarFeedbackImageAttachments": {
           "attachImages": "Joindre",
-          "removeImage": "Supprimer {{fileName}}"
+          "removeImage": "Supprimer {{fileName}}",
+          "screenshotsHint": "Joignez jusqu'à {{count}} captures d'écran, {{maxSize}} au total"
         },
         "WorkspaceKanbanSearchField": {
           "bdb753c78d": "Aucun espace de travail correspondant",
@@ -7970,8 +7995,7 @@
           "81057d5f71": "Enregistrement...",
           "da37d6f10e": "Copier",
           "3149964b66": "Copied",
-          "waitForSetupBeforeAgent": "Attendre la fin du setup avant de démarrer l'agent",
-          "waitForSetupBeforeAgentHelp": "Activez cette option quand le setup installe des dépendances, des serveurs MCP ou des fichiers de configuration dont l'agent a besoin au démarrage."
+          "waitForSetupBeforeAgent": "Attendre la fin du setup avant de démarrer l'agent"
         },
         "RepositoryIconPicker": {
           "2b7d27b93c": "Utiliser la couleur de dépôt {{value0}}",
@@ -9023,7 +9047,18 @@
             "b2c4e7f1a8": "point final",
             "3a9b6d2c4e": "clé API",
             "5d8f1a3b7c": "Chine",
-            "7e2a4b8c1d": "outre-mer"
+            "7e2a4b8c1d": "outre-mer",
+            "cursor": {
+              "description": "Utilisation mensuelle du forfait lue depuis la connexion Cursor déjà présente sur cet ordinateur (cursor-agent login).",
+              "kw": {
+                "cursor": "cursor",
+                "rateLimit": "limite de débit",
+                "spend": "dépenses",
+                "statusBar": "barre d'état",
+                "usage": "utilisation"
+              },
+              "title": "Utilisation Cursor"
+            }
           }
         },
         "advanced": {
@@ -9079,6 +9114,9 @@
             "0d1c334987": "couvercle",
             "ff8de8a2ad": "écran",
             "0d752916f8": "hooks",
+            "agent-trust-trust": "confiance",
+            "agent-trust-folder": "dossier",
+            "agent-trust-worktree": "worktree",
             "6984d4291a": "statut",
             "13b20636a6": "en attente",
             "8599603496": "terminé",
@@ -9279,6 +9317,13 @@
               "close": "fermer",
               "notification": "zone de notification",
               "background": "arrière-plan"
+            },
+            "cursor": {
+              "description": "Afficher l'utilisation mensuelle du forfait Cursor à partir de la connexion Cursor sur cet ordinateur.",
+              "kw": {
+                "cursor": "cursor"
+              },
+              "title": "Utilisation Cursor"
             }
           }
         },
@@ -10819,6 +10864,10 @@
           "7707c15abb": "Hooks de statut des agents",
           "a68a642835": "Affiche les états en cours, en attente et terminé dans Orca. Désactivez pour supprimer les hooks gérés par Orca et arrêter de les réinstaller."
         },
+        "agent-workspace-trust-copy": {
+          "title": "Faire confiance au dossier quand Orca lance un agent",
+          "description": "Les agents lancés par Orca ignorent leur question « Do you trust this folder? » : les hooks et paramètres d'agent du projet s'exécutent donc tout de suite. Sans cette option, chaque agent pose la question la première fois qu'il s'exécute dans un dossier. Les agents qui tournent sans que vous les surveilliez, comme les workers d'orchestration, les automatisations et les agents lancés depuis votre téléphone, attendront à cette question jusqu'à ce que vous y répondiez dans leur terminal. Les dossiers déjà approuvés le restent."
+        },
         "agent-generated-tab-title-copy": {
           "19ad21615a": "Générer automatiquement les titres des onglets",
           "b036c7a409": "Déduit des noms d'onglets courts et stables à partir de la première requête connue de l'agent. Les renommages manuels ont toujours priorité."
@@ -12095,6 +12144,31 @@
         "TerminalRenderingSection": {
           "6d4c55bacc": "Images en ligne",
           "fffab5890b": "Affichez les images directement dans le terminal à l'aide des protocoles graphiques SIXEL, iTerm2 (IIP) et Kitty."
+        },
+        "CursorAccountsSection": {
+          "dashboardLink": "Tableau de bord Cursor",
+          "expired": "Connexion expirée — exécutez cursor-agent login sur l'ordinateur qui exécute Orca, puis cliquez sur Actualiser l'utilisation.",
+          "loading": "Chargement…",
+          "noAllowance": "Cursor n'a signalé aucun quota d'utilisation pour ce compte.",
+          "planTotal": "Forfait",
+          "refreshUsage": "Actualiser l'utilisation",
+          "resets": "Réinitialisation {{when}}",
+          "signedIn": "Connecté",
+          "signedInFrom": "Connecté. Orca lit la session stockée dans {{source}}.",
+          "signedInGeneric": "Connecté. Orca lit la session Cursor stockée sur cet ordinateur.",
+          "signedOut": "Aucune connexion Cursor trouvée sur cet ordinateur",
+          "signedOutHelp": "Connectez-vous avec Cursor IDE, ou exécutez cursor-agent login dans un terminal, puis cliquez ici sur Actualiser l'utilisation.",
+          "source": {
+            "cli": "Fichier d'authentification du CLI Cursor",
+            "desktop": "Cursor IDE",
+            "keychain": "Trousseau macOS (cursor-agent)"
+          },
+          "staleUsage": "Dernière utilisation connue — la dernière actualisation a échoué : {{reason}}",
+          "subtitle": "Affiche l'utilisation mensuelle de votre forfait Cursor à partir de la connexion déjà présente sur cet ordinateur. Orca se contente de la lire — il ne modifie jamais votre connexion Cursor.",
+          "title": "Cursor",
+          "usageDescription": "Cursor facture deux enveloppes qui se réinitialisent avec votre cycle de facturation, plus des dépenses à la demande une fois épuisées.",
+          "usageLabel": "Utilisation",
+          "usageTitle": "Utilisation mensuelle du forfait"
         }
       },
       "right": {
@@ -14899,6 +14973,7 @@
           "f1aa04b5cf": "Ce fichier",
           "8b87612461": "Toutes les notes non envoyées"
         },
+        "diffCommentSaveFailed": "Échec de l'enregistrement du commentaire",
         "DiffSectionBody": {
           "35d6afb5be": "Fichier binaire modifié",
           "cef4cf0ff5": "Réessayer",
@@ -15020,6 +15095,7 @@
           "notPython": "Ce fichier n'est pas un interpréteur Python.",
           "interrupt": "Interrompre",
           "restart": "Redémarrer le kernel",
+          "trustFirst": "Exécutez une cellule pour d'abord faire confiance à ce notebook",
           "runAll": "Tout exécuter",
           "clearAll": "Effacer toutes les sorties",
           "notResponding": "Ne répond pas. Redémarrez le kernel",
@@ -15035,7 +15111,22 @@
           "noPython": "Python est introuvable sur cet ordinateur. Installez-le depuis [python.org](https://www.python.org/downloads/), puis réexécutez la cellule.",
           "kernelDied": "Le kernel est mort.",
           "localOnly": "Les cellules du notebook ne peuvent s'exécuter que pour des fichiers sur cet ordinateur.",
-          "pythonOnly": "Seuls les notebooks Python peuvent s'exécuter dans Orca."
+          "pythonOnly": "Seuls les notebooks Python peuvent s'exécuter dans Orca.",
+          "commandCopied": "Commande copiée.",
+          "createVenv": "Créer .venv",
+          "createVenvItem": "Créer un environnement virtuel…",
+          "createVenvTitle": "Créer un environnement virtuel ?",
+          "creatingButton": "Création…",
+          "creatingVenvDescription": "Création de .venv dans {{folder}} et installation d'ipykernel. Cela peut prendre une minute.",
+          "creatingVenvTitle": "Création de l'environnement virtuel…",
+          "installingButton": "Installation…",
+          "installingDescription": "Installation d'ipykernel dans « {{env}} » avec pip. Cela peut prendre une minute.",
+          "installingTitle": "Installation d'ipykernel…",
+          "kernelCreatingVenv": "Création de .venv…",
+          "setupFailed": "Cela n'a pas fonctionné. Sortie de Python :",
+          "tryAgain": "Réessayer",
+          "useAnotherPython": "Utiliser un autre Python…",
+          "venvDescription": "Orca va créer un .venv dans {{folder}} à partir de « {{env}} », y installer ipykernel, puis y exécuter ce notebook."
         },
         "MarkdownPreview": {
           "e4683f70c4": "Annuler",
@@ -15526,7 +15617,10 @@
             "2b3ce6d394": "Annuler",
             "e05063cfc1": "Ligne {{value0}}",
             "c845170b3b": "Lignes {{value0}}-{{value1}}",
-            "commentTooLarge": "Le commentaire est trop volumineux pour être envoyé sans risque."
+            "commentTooLarge": "Le commentaire est trop volumineux pour être envoyé sans risque.",
+            "f6c449191e": "Ajouter une note pour l'IA",
+            "5fa4bfebaa": "Ajouter une note",
+            "5e9b3d0c2e": "Ajout..."
           },
           "useDiffCommentDecorator": {
             "995fa28b50": "Cette note"
@@ -17254,6 +17348,13 @@
         "dispatchRejected": "L'agent a refusé le message “continue”. Ouvrez le chat et envoyez-en un vous-même.",
         "unsupported": "Orca ne peut pas reprendre ce chat. Ouvrez-le pour voir où il s'est arrêté.",
         "fallback": "Orca n'a pas pu reprendre ce chat. Ouvrez-le pour continuer manuellement."
+      },
+      "web": {
+        "preloadApi": {
+          "cursorAccounts": {
+            "hostOnly": "Les détails de connexion Cursor ne sont lisibles que sur l'ordinateur qui exécute Orca."
+          }
+        }
       }
     },
     "i18n": {
@@ -17322,6 +17423,56 @@
   },
   "components": {
     "native-chat": {
+      "writeNotice": {
+        "notDoneReadHistory": "L'historique de ce chat n'a pas pu être chargé.",
+        "notDoneSend": "Votre message n'a pas été envoyé.",
+        "tryAgainComposerSend": "Renvoyez-le.",
+        "notDoneStop": "L'agent n'a pas été arrêté.",
+        "notDoneStopTask": "La tâche en arrière-plan n'a pas été arrêtée.",
+        "notDoneStopTasks": "Les tâches en arrière-plan n'ont pas été arrêtées.",
+        "notDoneAnswer": "Votre réponse n'a pas été envoyée.",
+        "notDoneOption": "Le paramètre n'a pas été modifié.",
+        "notDoneCommand": "La commande n'a pas été exécutée.",
+        "notDoneGoal": "L'objectif n'a pas été modifié.",
+        "restartFailed": "L'agent n'a pas pu redémarrer.",
+        "capacity": "Orca a reçu trop de requêtes au cours de la dernière journée.",
+        "outcomeUnknown": "Orca n'a pas pu confirmer ce qui s'est passé. Vérifiez le chat.",
+        "questionChanged": "Cette question a déjà reçu une réponse ou a changé.",
+        "historyUnreadable": "Orca n'a pas pu lire l'historique enregistré de ce chat.",
+        "historyUnusable": "Impossible de charger ce chat.",
+        "historyUnavailable": "Orca n'a pas pu ouvrir l'historique de ce chat pour le moment.",
+        "unsupported": "L'instance d'Orca qui exécute ce chat ne le prend pas en charge. Mettez Orca à jour, puis réessayez.",
+        "unreachable": "Orca n'a pas pu joindre l'agent.",
+        "recordFailed": "Orca n'a pas pu l'enregistrer dans l'historique de ce chat.",
+        "conversationCleared": "Cette conversation a été effacée.",
+        "openCurrentConversation": "Ouvrez la conversation actuelle pour continuer.",
+        "clearUnfinished": "Le dernier /clear ne s'est pas terminé.",
+        "commandRunning": "Un /compact ou /clear est encore en cours.",
+        "waitForCommand": "Attendez la fin du /compact ou /clear.",
+        "agentStarting": "L'agent est encore en cours de démarrage.",
+        "waitForStart": "Attendez que l'agent ait fini de démarrer.",
+        "turnActive": "L'agent est encore en train de répondre.",
+        "waitForTurn": "Attendez que l'agent ait fini de répondre, ou arrêtez-le.",
+        "promptPending": "L'agent attend une réponse à une question ou à une demande d'approbation.",
+        "answerFirst": "Répondez d'abord à la question ou à la demande d'approbation.",
+        "backgroundTasksRunning": "Des tâches en arrière-plan sont encore en cours.",
+        "waitForBackgroundTasks": "Attendez la fin des tâches en arrière-plan.",
+        "messagesUnsettled": "Un message que vous avez envoyé plus tôt n'a pas encore été confirmé.",
+        "settleEarlierMessage": "Attendez que votre message précédent soit transmis, ou renvoyez-le.",
+        "optionRejected": "L'agent n'a pas accepté ce réglage.",
+        "goalsUnsupported": "Cet agent ne prend pas en charge les objectifs.",
+        "agentRefused": "L'agent l'a refusé.",
+        "ownerUnproven": "Orca n'a pas confirmé l'arrêt de l'agent précédent de ce chat.",
+        "reopenChat": "Rouvrez le chat pour vérifier à nouveau.",
+        "terminalAgentHoldsChat": "Ce chat est encore ouvert dans un agent de terminal.",
+        "quitTerminalAgent": "Quittez cet agent pour continuer le chat ici.",
+        "hostReconciling": "Orca vérifie encore ce chat après son redémarrage.",
+        "waitMoment": "Patientez un instant.",
+        "recordUnreadable": "Orca n'a pas pu lire l'état enregistré de ce chat.",
+        "chatNotFound": "L'instance d'Orca qui exécute ce chat n'en a aucune trace.",
+        "startNewChat": "Démarrez un nouveau chat pour continuer.",
+        "tryAgain": "Réessayez."
+      },
       "composer": {
         "imageUnsupported": "Le collage d'image n'est pas pris en charge pour cet agent.",
         "send": "Envoyer",
@@ -17462,9 +17613,9 @@
         "responding": "L'agent répond",
         "working": "Fonctionnement…",
         "thinking": "Réflexion",
-        "workingFor": "Travailler pour {{value0}}",
-        "workedFor": "A travaillé pour {{value0}}",
-        "toggleDetails": "Basculer les détails du virage"
+        "workingFor": "En cours depuis {{value0}}",
+        "workedFor": "A travaillé pendant {{value0}}",
+        "toggleDetails": "Basculer les détails du tour"
       },
       "jumpToLatest": "Aller au dernier message",
       "toggle": {
@@ -17478,8 +17629,10 @@
         },
         "error": {
           "title": "Impossible de charger la conversation",
-          "subtitle": "La transcription n'a pas pu être lue. Rebasculez sur le terminal pour continuer à travailler."
+          "subtitle": "La transcription n'a pas pu être lue. Rebasculez sur le terminal pour continuer à travailler.",
+          "retryingSubtitle": "La transcription n'a pas pu être lue. Orca continue d'essayer de la charger."
         },
+        "reconnecting": "Reconnexion à ce chat…",
         "pairHost": "Associez un hôte pour consulter l'historique de chat des agents.",
         "notAgent": {
           "title": "Aucune conversation ici",
@@ -17604,6 +17757,7 @@
       "railEmptyMessage": "Message",
       "ask": {
         "awaiting": "En attente de la saisie de l'utilisateur :",
+        "awaitingUnnamed": "En attente de la saisie de l'utilisateur",
         "asked": "Demandé:",
         "questionCount": "{{value0}} questions"
       },
@@ -17627,7 +17781,9 @@
         "startedN": "Lancement des sous-agents {{value0}}",
         "ranOne": "A exécuté 1 sous-agent",
         "ranN": "Ran les sous-agents {{value0}}",
-        "tokens": "Jetons {{value0}}"
+        "tokens": "Jetons {{value0}}",
+        "unnamed": "Sous-agent",
+        "writtenBy": "Écrit par le sous-agent {{value0}}"
       },
       "conversationCommand": {
         "pendingWork": "Attendez la fin du travail et des messages en attente avant d'utiliser cette commande.",
@@ -18026,6 +18182,9 @@
           }
         }
       }
+    },
+    "agentChildRow": {
+      "ended": "Terminé"
     }
   },
   "dashboardPopout": {
@@ -18145,6 +18304,52 @@
       "unassignedInstruction": "Assignez un raccourci de dictée avant de lancer la dictée vocale dans un volet actif.",
       "settingsInstruction": "Modifiez le modèle, le mode de dictée ou le raccourci à tout moment dans",
       "settingsLink": "Paramètres → Voix"
+    },
+    "sessionSearch": {
+      "ageHours": "2 h",
+      "ageMinutes": "12 min",
+      "ageYesterday": "1 j",
+      "agentsInstruction": "Vos agents peuvent aussi la fouiller. Demandez à l'un d'eux de « retrouver la session où nous avons corrigé le délai de connexion ».",
+      "consentInstruction": "Modifiez ce réglage ou désactivez-le à tout moment dans",
+      "continueInBackground": "Continuer en arrière-plan",
+      "demoHit1Age": "3 j",
+      "demoHit1Snippet": "Le [[délai de connexion]] est passé à 30 s avec un nouvel essai sur l'actualisation du jeton.",
+      "demoHit1Title": "Corriger la redirection d'authentification instable",
+      "demoHit2Age": "1 sem.",
+      "demoHit2Snippet": "Pourquoi la page de [[connexion]] se fige-t-elle après un [[délai dépassé]] au réveil ?",
+      "demoHit2Title": "Actualisation de session après la mise en veille",
+      "demoHit3Age": "2 sem.",
+      "demoHit3Snippet": "Ajout d'un test couvrant le parcours [[délai de connexion]] de bout en bout.",
+      "demoHit3Title": "Renforcement des tests e2e d'authentification",
+      "demoHit4Age": "5 j",
+      "demoHit4Snippet": "Le [[retour en arrière]] supprime d'abord le nouvel index, puis restaure l'ancienne colonne.",
+      "demoHit4Title": "Migration de la table des commandes",
+      "demoHit5Age": "3 sem.",
+      "demoHit5Snippet": "Pouvez-vous rédiger un plan de [[retour en arrière]] de [[migration]] avant le nouvel essai ?",
+      "demoHit5Title": "Échec du déploiement en préproduction",
+      "demoHit6Age": "1 mois",
+      "demoHit6Snippet": "Chaque [[migration]] ici est réversible, sauf le renommage de l'enum.",
+      "demoHit6Title": "Notes de révision du schéma",
+      "demoQuery": "délai de connexion",
+      "demoQuery2": "retour en arrière de migration",
+      "demoRoleAssistant": "Assistant",
+      "demoRoleUser": "Utilisateur",
+      "enableFailed": "Impossible d'activer la recherche de session. Réessayez.",
+      "indexingDescription": "Orca lit vos transcriptions d'agent passées pour vous permettre de les rechercher. Cela peut prendre quelques minutes.",
+      "indexingTitle": "Indexation de vos sessions d'agent",
+      "progressStarting": "Recherche de vos sessions…",
+      "readyDescription": "Chaque session d'agent sur cet ordinateur peut désormais être retrouvée par son contenu.",
+      "readyTitle": "La recherche de session est prête",
+      "readyToast": "La recherche de session est prête",
+      "readyToastOpen": "Ouvrir",
+      "recent1Text": "Entrées de recherche déplacées sous Flux de travail et tests mis à jour.",
+      "recent1Title": "Ranger la barre latérale des paramètres",
+      "recent2Text": "Mettez à jour les dépendances et vérifiez que la compilation réussit toujours.",
+      "recent2Title": "Mettre à jour le fichier de verrouillage",
+      "recent3Text": "Voici une première version des notes, regroupées par domaine.",
+      "recent3Title": "Brouillon des notes de version",
+      "settingsLink": "Paramètres → Recherche de session d'agent",
+      "startSearching": "Commencer la recherche"
     }
   },
   "quickOpen": {
@@ -18155,6 +18360,7 @@
       "needsInput": "attend une réponse",
       "working": "en cours",
       "stopped": "arrêté",
+      "failed": "échoué",
       "finished": "terminé"
     }
   },
@@ -18298,5 +18504,63 @@
   },
   "common": {
     "retry": "Réessayer"
+  },
+  "fileExplorer": {
+    "root": {
+      "label": "Racine de l’explorateur",
+      "full": "Racine du dépôt",
+      "viewing": "Vue : {{path}}",
+      "back": "Revenir à {{path}}",
+      "searchScope": "Portée : fichiers de l’espace de travail",
+      "retry": "Réessayer",
+      "omittedFiles": "Les fichiers exclus par le checkout partiel ne sont pas recherchés.",
+      "viewOnly": "Checkout partiel · Changer de vue ne modifie pas les fichiers extraits.",
+      "sparseStatus": "Extraction partielle",
+      "scopeDetails": "À propos de la portée de l’extraction partielle",
+      "scopeExplanation": "Le sélecteur de dossiers change l’affichage, pas les fichiers extraits. La racine du dépôt inclut les fichiers extraits à la racine et dans les dossiers parents.",
+      "searchExplanation": "Noms filtre le dossier affiché. Contenu recherche dans tout l’espace de travail. Les fichiers exclus de l’extraction partielle ne sont pas recherchés.",
+      "findInFolder": "Rechercher dans {{path}}",
+      "folderLoadError": "Impossible de charger ce dossier :",
+      "emptyFolder": "Aucun fichier dans ce dossier"
+    }
+  },
+  "sparsePreset": {
+    "nameRequired": "Le nom est obligatoire.",
+    "nameTooLong": "Le nom doit contenir au maximum 80 caractères.",
+    "nameExists": "Un préréglage nommé « {{name}} » existe déjà.",
+    "name": "Nom",
+    "namePlaceholder": "Application web et interface partagée",
+    "directories": "Répertoires",
+    "pathHelp": "Un répertoire relatif au dépôt par ligne. Les espaces dans les chemins sont conservés.",
+    "coneHelp": "Git conserve également les fichiers à la racine du dépôt et dans les dossiers parents de ces répertoires.",
+    "cancel": "Annuler",
+    "save": "Enregistrer le préréglage",
+    "new": "Nouveau préréglage de checkout partiel",
+    "edit": "Modifier le préréglage de checkout partiel",
+    "description": "Choisissez les dossiers à extraire dans un nouvel espace de travail.",
+    "saveFailed": "Impossible d’enregistrer le préréglage. Réessayez.",
+    "loading": "Chargement des préréglages...",
+    "details": "Quels fichiers sont extraits ?",
+    "finishEditing": "Enregistrez ou annulez le préréglage pour poursuivre la création de votre espace de travail.",
+    "pathInstructions": "Un dossier par ligne, avec un chemin relatif à la racine du dépôt.",
+    "retryLoad": "Réessayer de charger les préréglages",
+    "fullCheckout": "Extraction complète",
+    "checkoutPreset": "Préréglage d’extraction",
+    "search": "Rechercher un préréglage…",
+    "noMatches": "Aucun préréglage correspondant.",
+    "allFiles": "Tous les fichiers du dépôt",
+    "editNamed": "Modifier {{name}}",
+    "addPath": "Add a folder",
+    "findPath": "Find a folder…",
+    "noPathMatches": "No folders found.",
+    "repositoryRoot": "Repository root",
+    "loadingPaths": "Reading folders…",
+    "pathsUnavailable": "Could not read this folder. Type the path instead.",
+    "pathAdded": "Added",
+    "openFolder": "Open {{name}}",
+    "findOrTypePath": "Find a folder, or type any path…",
+    "addTypedPath": "Add",
+    "noDirectories": "No folders added yet.",
+    "removePath": "Remove {{name}}"
   }
 }
diff --git a/src/renderer/src/i18n/locales/ja.json b/src/renderer/src/i18n/locales/ja.json
index 7ffa3e0e2eb..cc86474fe8b 100644
--- a/src/renderer/src/i18n/locales/ja.json
+++ b/src/renderer/src/i18n/locales/ja.json
@@ -34,7 +34,8 @@
         "resourceUsageToggleDescription": "リソースマネージャーを表示します。クリックすると、CPU、メモリ、セッション、デーモンコントロール、ワークスペースディスクスキャンの情報を確認できます。",
         "portsToggleDescription": "ライブワークスペースポートを表示します。ワークスペーススコープのポートと外部リスナーの場合はこれをクリックします。",
         "antigravityToggleDescription": "アクティブなワークスペースの Antigravity サブスクリプション使用量を表示します。",
-        "grokToggleDescription": "Grok CLI でサインインしている場合に Grok サブスクリプションのクレジット使用量を表示します。"
+        "grokToggleDescription": "Grok CLI でサインインしている場合に Grok サブスクリプションのクレジット使用量を表示します。",
+        "cursorToggleDescription": "cursor-agent または Cursor IDE でサインインしている場合に Cursor プランの使用状況を表示します。"
       },
       "menuBarIcon": {
         "title": "メニューバーアイコンを表示",
@@ -495,6 +496,7 @@
           "mimo_code_label": "MiMo Code",
           "muse_label": "Muse",
           "opencode2_label": "OpenCode 2",
+          "codebuddy_label": "CodeBuddy",
           "zcode_label": "ZCode"
         },
         "skill": {
@@ -869,7 +871,8 @@
             "tooMany": "画像は最大 {{maxCount}} 件まで添付できます。",
             "dimensionsTooLarge": "{{fileName}} は画像サイズが大きすぎるため、安全にプレビューできません。",
             "invalidImage": "{{fileName}} は有効な画像として読み取れません。",
-            "additionalErrors": "ほかに {{count}} 件の画像を添付できませんでした。"
+            "additionalErrors": "ほかに {{count}} 件の画像を添付できませんでした。",
+            "totalTooLarge": "{{fileName}} を追加すると添付ファイルの合計が {{maxSize}} を超えます。"
           }
         }
       },
@@ -1600,7 +1603,6 @@
         "reuseExistingBranchHint": "既存のブランチから新規ブランチを作成せず、そのブランチをチェックアウトします。",
         "createMultiple": "さらに作成",
         "waitForSetupBeforeAgent": "セットアップが完了するまで待ってから Agent を開始してください",
-        "waitForSetupBeforeAgentHelp": "セットアップによって、起動時に Agent に必要な依存関係、MCP サーバー、または構成ファイルがインストールされるときに、これをオンにします。",
         "destroyDisabled": "破壊は無効です",
         "destroyConfigured": "設定されたものを破棄する",
         "noDestroyConfigured": "破壊しない",
@@ -3031,6 +3033,7 @@
           },
           "TerminalContextMenu": {
             "b4cdd9314e": "クリアスクリーン",
+            "resetTerminal": "ターミナルをリセット",
             "8c17d6786d": "ペインを閉じる",
             "copyTerminalId": "ターミナル ID をコピー",
             "2cf85a6a55": "ペインIDのコピー",
@@ -3066,7 +3069,9 @@
             "42b283ecfc": "ホストが保存されたセッションを確認できなかったため、Orca はこのターミナルを安全に再接続できませんでした。 Orca は保存されたセッションを変更せずに残しました。今すぐ再接続を試みるには、「再試行」をクリックします。それでも再接続できない場合は、新規ターミナルを開きます。",
             "e16012e31e": "このセッションを所有していたターミナルデーモンが終了したため、セッションとそのスクロールバックを回復できませんでした。続行するには、新規ターミナルを開いてください。",
             "sessionUnavailable": "Orca はホスト上のこのペインのターミナルセッションに再接続できませんでした。続行するには、新規ターミナルを開いてください。",
-            "sourceRestoring": "このターミナルを再接続しています — その出力が再確立されています。セッションはまだ実行中です。"
+            "sourceRestoring": "このターミナルを再接続しています — その出力が再確立されています。セッションはまだ実行中です。",
+            "ptyAllocationLimit": "システムはこれ以上 pty デバイスを割り当てられません。Orca または他のプログラムで使っていないターミナルをいくつか閉じてから、もう一度お試しください。",
+            "terminalProcessLimit": "システムはこれ以上ターミナルプロセスを起動できません。使っていないターミナルを閉じるか、不要なプロセスを終了してから、もう一度お試しください。"
           },
           "TerminalProcessExitOverlay": {
             "capacityTitle": "Git Bash のコンソール上限に達しました",
@@ -3093,7 +3098,7 @@
             "missing": {
               "tui": {
                 "title": "This ZCode build has no terminal UI",
-                "description": "Orca's hooks installed correctly \u2014 the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
+                "description": "Orca's hooks installed correctly — the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
               }
             }
           },
@@ -3239,6 +3244,9 @@
           "TerminalQuickCommandsSubmenu": {
             "3ccc7981bb": "ホストが利用不可",
             "54f29b7c0d": "ホストを読み込み中…"
+          },
+          "TerminalRestoringPlaceholder": {
+            "restoring": "ターミナルを復元中…"
           }
         }
       },
@@ -3666,7 +3674,9 @@
             "grokUsageMenu": "Grok の使用状況",
             "floatingTerminalNewActivity": "{{label}}、新規アクティビティ",
             "codexSignInSuccess": "Codex にサインインしました",
-            "codexSignInError": "Codex のサインインに失敗しました。もう一度お試しください。"
+            "codexSignInError": "Codex のサインインに失敗しました。もう一度お試しください。",
+            "cursorUsageMenu": "Cursor の使用状況",
+            "hiddenUsageProviders": "ほかに: {{value0}}"
           },
           "StatusBarUsageEmptyCta": {
             "828c764a79": "アカウントを接続する",
@@ -3841,6 +3851,13 @@
               "noSubscription": {
                 "label": "サブスクリプションなし"
               }
+            },
+            "cursor": {
+              "expired": {
+                "label": "サインインの有効期限切れ",
+                "message": "Orca を実行しているコンピュータのターミナルで cursor-agent login を実行し、使用状況を再試行してください。"
+              },
+              "plan": "プラン"
             }
           },
           "SshTargetStatusRow": {
@@ -3949,7 +3966,12 @@
             "checkLabel": "確認が必要なチャット {{value0}} 件",
             "checkAriaOne": "再開後に確認が必要なチャット 1 件。詳細はクリックしてください。",
             "checkAria": "再開後に確認が必要なチャット {{value0}} 件。詳細はクリックしてください。",
-            "checkTooltip": "再起動後に Orca が再開できなかった、または再開を確認できなかったチャット。詳細はクリックしてください。"
+            "checkTooltip": "再起動後に Orca が再開できなかった、または再開を確認できなかったチャット。詳細はクリックしてください。",
+            "resumingLabelOne": "1 件のチャットを再開中",
+            "resumingLabel": "{{value0}} 件のチャットを再開中",
+            "resumingAriaOne": "1 件のチャットを再開中。詳細はクリックしてください。",
+            "resumingAria": "{{value0}} 件のチャットを再開中。詳細はクリックしてください。",
+            "resumingTooltip": "中断されたチャットを復元し、続行を依頼しています…"
           }
         }
       },
@@ -5204,7 +5226,9 @@
           "69969ba364": "送信中…",
           "imageReadFailed": "添付された画像を読み取れませんでした。もう一度添付してください。",
           "attachWhileSending": "現在のフィードバックの送信が完了してから、画像を追加してください。",
-          "imagesNotDelivered": "フィードバックを送信しましたが、画像が届いたかどうかは確認できませんでした。"
+          "imagesNotDelivered": "フィードバックを送信しましたが、画像が届いたかどうかは確認できませんでした。",
+          "imagesNotIncluded": "フィードバックを送信しました。スクリーンショットをアップロードできなかったため、含まれていません。",
+          "imagesRejected": "フィードバックを送信しました。スクリーンショットが大きすぎてアップロードできなかったため、含まれていません。"
         },
         "SidebarFilter": {
           "e3b3898218": "プロジェクトを追加",
@@ -6164,7 +6188,8 @@
         },
         "SidebarFeedbackImageAttachments": {
           "attachImages": "Attach",
-          "removeImage": "{{fileName}} を削除"
+          "removeImage": "{{fileName}} を削除",
+          "screenshotsHint": "スクリーンショットを最大 {{count}} 件、合計 {{maxSize}} まで添付できます"
         },
         "WorkspaceKanbanSearchField": {
           "bdb753c78d": "一致するワークスペースはありません",
@@ -7851,8 +7876,7 @@
           "81057d5f71": "保存中…",
           "da37d6f10e": "コピー",
           "3149964b66": "コピーしました",
-          "waitForSetupBeforeAgent": "セットアップが完了するまで待ってから Agent を開始してください",
-          "waitForSetupBeforeAgentHelp": "セットアップによって、起動時に Agent に必要な依存関係、MCP サーバー、または構成ファイルがインストールされるときに、これをオンにします。"
+          "waitForSetupBeforeAgent": "セットアップが完了するまで待ってから Agent を開始してください"
         },
         "RepositoryIconPicker": {
           "2b7d27b93c": "{{value0}} リポジトリカラーを使用する",
@@ -8900,7 +8924,18 @@
             "b2c4e7f1a8": "終点",
             "3a9b6d2c4e": "APIキー",
             "5d8f1a3b7c": "中国",
-            "7e2a4b8c1d": "海外"
+            "7e2a4b8c1d": "海外",
+            "cursor": {
+              "description": "このコンピュータに既にある Cursor のサインイン（cursor-agent login）から読み取った月間プラン使用状況。",
+              "kw": {
+                "cursor": "cursor",
+                "rateLimit": "レート制限",
+                "spend": "追加料金",
+                "statusBar": "ステータスバー",
+                "usage": "使用量"
+              },
+              "title": "Cursor の使用状況"
+            }
           }
         },
         "advanced": {
@@ -8956,6 +8991,9 @@
             "0d1c334987": "蓋",
             "ff8de8a2ad": "ディスプレイ",
             "0d752916f8": "フック",
+            "agent-trust-trust": "信頼",
+            "agent-trust-folder": "フォルダー",
+            "agent-trust-worktree": "ワークツリー",
             "6984d4291a": "状態",
             "13b20636a6": "待機",
             "8599603496": "完了",
@@ -9156,6 +9194,13 @@
               "close": "近い",
               "notification": "通知領域",
               "background": "背景"
+            },
+            "cursor": {
+              "description": "このコンピュータの Cursor サインインから月間 Cursor プラン使用状況を表示します。",
+              "kw": {
+                "cursor": "cursor"
+              },
+              "title": "Cursor の使用状況"
             }
           }
         },
@@ -10715,6 +10760,10 @@
           "7707c15abb": "Agent 状態フック",
           "a68a642835": "Orca で作業中、待機中、完了の状態を表示します。オフにすると Orca 管理のフックを削除し、再インストールを停止します。"
         },
+        "agent-workspace-trust-copy": {
+          "title": "Orca が Agent を起動するときにフォルダーを信頼する",
+          "description": "Orca が起動した Agent は「Do you trust this folder?」の確認を省略するため、プロジェクトの Agent のフックと設定がすぐに実行されます。この設定がオフの場合、各 Agent はフォルダーで初めて実行されるときに確認します。オーケストレーションのワーカー、オートメーション、スマートフォンから起動した Agent など、あなたが見ていない間に動く Agent は、そのターミナルで応答するまでこの確認で待機します。すでに信頼済みのフォルダーは信頼されたままです。"
+        },
         "agent-generated-tab-title-copy": {
           "19ad21615a": "タブタイトルを自動生成",
           "b036c7a409": "最初に判明した Agent のプロンプトから、短く安定したタブ名を生成します。手動での名前変更が常に優先されます。"
@@ -11992,6 +12041,31 @@
         "TerminalRenderingSection": {
           "6d4c55bacc": "インライン画像",
           "fffab5890b": "SIXEL、iTerm2 (IIP)、および Kitty グラフィックスプロトコルを使用して、ターミナルに画像を直接表示します。"
+        },
+        "CursorAccountsSection": {
+          "dashboardLink": "Cursor ダッシュボード",
+          "expired": "サインインの有効期限が切れています — Orca を実行しているコンピュータで cursor-agent login を実行し、「使用状況を更新」をクリックしてください。",
+          "loading": "読み込み中…",
+          "noAllowance": "Cursor によると、このアカウントには使用量の割り当てがありません。",
+          "planTotal": "プラン",
+          "refreshUsage": "使用状況を更新",
+          "resets": "{{when}} にリセット",
+          "signedIn": "サインイン済み",
+          "signedInFrom": "サインイン済み。Orca は {{source}} に保存されたセッションを読み取ります。",
+          "signedInGeneric": "サインイン済み。Orca はこのコンピュータに保存された Cursor セッションを読み取ります。",
+          "signedOut": "このコンピュータに Cursor のサインインが見つかりません",
+          "signedOutHelp": "Cursor IDE でサインインするか、ターミナルで cursor-agent login を実行してから、ここで「使用状況を更新」をクリックしてください。",
+          "source": {
+            "cli": "Cursor CLI 認証ファイル",
+            "desktop": "Cursor IDE",
+            "keychain": "macOS キーチェーン（cursor-agent）"
+          },
+          "staleUsage": "最後に確認できた使用状況 — 最新の更新に失敗しました: {{reason}}",
+          "subtitle": "このコンピュータに既にある Cursor のサインインから、月間の Cursor プラン使用状況を表示します。Orca は読み取るだけで、Cursor のログインを変更することはありません。",
+          "title": "Cursor",
+          "usageDescription": "Cursor は請求サイクルとともにリセットされる 2 つのプールの利用に課金し、使い切るとオンデマンドの追加料金が発生します。",
+          "usageLabel": "使用量",
+          "usageTitle": "月間プラン使用状況"
         }
       },
       "right": {
@@ -14796,6 +14870,7 @@
           "f1aa04b5cf": "このファイル",
           "8b87612461": "すべての未送信のメモ"
         },
+        "diffCommentSaveFailed": "コメントの保存に失敗しました",
         "DiffSectionBody": {
           "35d6afb5be": "バイナリファイルが変更されました",
           "cef4cf0ff5": "再試行",
@@ -14917,6 +14992,7 @@
           "notPython": "そのファイルは Python インタープリターではありません。",
           "interrupt": "中断",
           "restart": "カーネルを再起動",
+          "trustFirst": "先にセルを実行して、このノートブックを信頼してください",
           "runAll": "すべて実行",
           "clearAll": "すべての出力をクリア",
           "notResponding": "応答がありません。カーネルを再起動してください",
@@ -14932,11 +15008,26 @@
           "noPython": "このコンピュータに Python が見つかりません。[python.org](https://www.python.org/downloads/) からインストールして、セルを再実行してください。",
           "kernelDied": "カーネルが停止しました。",
           "localOnly": "ノートブックセルはこのコンピュータ上のファイルでのみ実行できます。",
-          "pythonOnly": "Orca では Python ノートブックのみ実行できます。"
+          "pythonOnly": "Orca では Python ノートブックのみ実行できます。",
+          "commandCopied": "コマンドをコピーしました",
+          "createVenv": ".venv を作成",
+          "createVenvItem": "仮想環境を作成…",
+          "createVenvTitle": "仮想環境を作成しますか？",
+          "creatingButton": "作成中…",
+          "creatingVenvDescription": "{{folder}} に .venv を作成し、ipykernel をインストールしています。数分かかることがあります。",
+          "creatingVenvTitle": "仮想環境を作成中…",
+          "installingButton": "インストール中…",
+          "installingDescription": "pip で '{{env}}' に ipykernel をインストールしています。数分かかることがあります。",
+          "installingTitle": "ipykernel をインストール中…",
+          "kernelCreatingVenv": ".venv を作成中…",
+          "setupFailed": "処理に失敗しました。Python の出力:",
+          "tryAgain": "再試行",
+          "useAnotherPython": "別の Python を使用…",
+          "venvDescription": "Orca は '{{env}}' から {{folder}} に .venv を作成し、ipykernel をインストールして、このノートブックをそこで実行します。"
         },
         "MarkdownPreview": {
           "e4683f70c4": "キャンセル",
-          "d737791433": "AI に関するメモを追加",
+          "d737791433": "AI 向けのメモを追加",
           "b1bfc04034": "選択したテキスト",
           "f37b98999e": "このメモ",
           "2b2b31382c": "フロントマター",
@@ -15423,7 +15514,10 @@
             "2b3ce6d394": "キャンセル",
             "e05063cfc1": "{{value0}} 行目",
             "c845170b3b": "行 {{value0}}-{{value1}}",
-            "commentTooLarge": "コメントが大きすぎるため安全に送信できません。"
+            "commentTooLarge": "コメントが大きすぎるため安全に送信できません。",
+            "f6c449191e": "AI 向けのメモを追加",
+            "5fa4bfebaa": "メモを追加",
+            "5e9b3d0c2e": "追加中…"
           },
           "useDiffCommentDecorator": {
             "995fa28b50": "このメモ"
@@ -17155,6 +17249,13 @@
         "dispatchRejected": "Agent が “continue” メッセージを拒否しました。チャットを開いて自分で送信してください。",
         "unsupported": "このチャットは Orca で再開できません。開いて停止位置を確認してください。",
         "fallback": "Orca はこのチャットを再開できませんでした。開いて手動で続けてください。"
+      },
+      "web": {
+        "preloadApi": {
+          "cursorAccounts": {
+            "hostOnly": "Cursor のサインイン詳細は、Orca を実行しているコンピュータでのみ読み取れます。"
+          }
+        }
       }
     },
     "i18n": {
@@ -17258,6 +17359,56 @@
       }
     },
     "native-chat": {
+      "writeNotice": {
+        "notDoneReadHistory": "このチャットの履歴を読み込めませんでした。",
+        "notDoneSend": "メッセージは送信されませんでした。",
+        "tryAgainComposerSend": "もう一度送信してください。",
+        "notDoneStop": "Agent は停止されませんでした。",
+        "notDoneStopTask": "バックグラウンドタスクは停止されませんでした。",
+        "notDoneStopTasks": "バックグラウンドタスクは停止されませんでした。",
+        "notDoneAnswer": "回答は送信されませんでした。",
+        "notDoneOption": "設定は変更されませんでした。",
+        "notDoneCommand": "コマンドは実行されませんでした。",
+        "notDoneGoal": "目標は変更されませんでした。",
+        "restartFailed": "Agent を再起動できませんでした。",
+        "capacity": "Orca が過去 1 日に受け取ったリクエストが多すぎます。",
+        "outcomeUnknown": "Orca は何が起きたかを確認できませんでした。チャットを確認してください。",
+        "questionChanged": "この質問はすでに回答済みか、変更されています。",
+        "historyUnreadable": "Orca はこのチャットの保存済み履歴を読み取れませんでした。",
+        "historyUnusable": "このチャットを読み込めません。",
+        "historyUnavailable": "Orca は現在このチャットの履歴を開けませんでした。",
+        "unsupported": "このチャットを実行している Orca はこの操作に対応していません。Orca を更新してから、もう一度お試しください。",
+        "unreachable": "Orca は Agent に接続できませんでした。",
+        "recordFailed": "Orca はこのチャットの履歴に記録できませんでした。",
+        "conversationCleared": "この会話はクリアされました。",
+        "openCurrentConversation": "続けるには、現在の会話を開いてください。",
+        "clearUnfinished": "前回の /clear は完了しませんでした。",
+        "commandRunning": "/compact または /clear がまだ実行中です。",
+        "waitForCommand": "/compact または /clear が終わるまでお待ちください。",
+        "agentStarting": "Agent はまだ起動中です。",
+        "waitForStart": "Agent の起動が終わるまでお待ちください。",
+        "turnActive": "Agent はまだ応答中です。",
+        "waitForTurn": "Agent の応答が終わるまで待つか、Agent を停止してください。",
+        "promptPending": "Agent は質問または承認への回答を待っています。",
+        "answerFirst": "先に質問または承認に回答してください。",
+        "backgroundTasksRunning": "バックグラウンドタスクがまだ実行中です。",
+        "waitForBackgroundTasks": "バックグラウンドタスクが終わるまでお待ちください。",
+        "messagesUnsettled": "以前に送信したメッセージがまだ確認されていません。",
+        "settleEarlierMessage": "以前のメッセージが届くまで待つか、再試行してください。",
+        "optionRejected": "Agent はこの設定を受け入れませんでした。",
+        "goalsUnsupported": "この Agent は目標に対応していません。",
+        "agentRefused": "Agent がこれを拒否しました。",
+        "ownerUnproven": "Orca は、このチャットの以前の Agent が停止したことをまだ確認できていません。",
+        "reopenChat": "もう一度確認するには、チャットを開き直してください。",
+        "terminalAgentHoldsChat": "このチャットはまだターミナルの Agent で開かれています。",
+        "quitTerminalAgent": "ここでチャットを続けるには、その Agent を終了してください。",
+        "hostReconciling": "Orca は再起動後、このチャットをまだ確認しています。",
+        "waitMoment": "しばらくお待ちください。",
+        "recordUnreadable": "Orca はこのチャットの保存済みの状態を読み取れませんでした。",
+        "chatNotFound": "このチャットを実行している Orca には、このチャットの記録がありません。",
+        "startNewChat": "続けるには、新しいチャットを開始してください。",
+        "tryAgain": "もう一度お試しください。"
+      },
       "composer": {
         "imageUnsupported": "この Agent では画像の貼り付けはサポートされていません。",
         "send": "送信",
@@ -17398,8 +17549,8 @@
         "responding": "Agent が応答中です",
         "working": "処理中…",
         "thinking": "考え",
-        "workingFor": "{{value0}} で働いています",
-        "workedFor": "{{value0}}で働いていました",
+        "workingFor": "{{value0}} 処理中",
+        "workedFor": "{{value0}} で完了",
         "toggleDetails": "ターンの詳細を切り替えます"
       },
       "jumpToLatest": "最新にジャンプ",
@@ -17414,8 +17565,10 @@
         },
         "error": {
           "title": "会話を読み込めませんでした",
-          "subtitle": "トランスクリプトを読み取ることができませんでした。作業を続けるには、ターミナルに切り替えてください。"
+          "subtitle": "トランスクリプトを読み取ることができませんでした。作業を続けるには、ターミナルに切り替えてください。",
+          "retryingSubtitle": "トランスクリプトを読み取ることができませんでした。Orca は読み込みを再試行し続けます。"
         },
+        "reconnecting": "このチャットに再接続しています…",
         "pairHost": "ホストをペアリングして、Agent のチャット履歴を表示します。",
         "notAgent": {
           "title": "ここでは会話はありません",
@@ -17540,6 +17693,7 @@
       "railEmptyMessage": "メッセージ",
       "ask": {
         "awaiting": "ユーザー入力を待っています:",
+        "awaitingUnnamed": "ユーザー入力を待っています",
         "asked": "質問:",
         "questionCount": "{{value0}} の質問"
       },
@@ -17563,7 +17717,9 @@
         "startedN": "{{value0}} サブ Agent をキックオフしました",
         "ranOne": "1 人のサブ Agent を実行しました",
         "ranN": "{{value0}} サブ Agent を実行しました",
-        "tokens": "{{value0}} トークン"
+        "tokens": "{{value0}} トークン",
+        "unnamed": "サブ Agent",
+        "writtenBy": "サブ Agent {{value0}} による出力"
       },
       "conversationCommand": {
         "pendingWork": "このコマンドを使用する前に、保留中の作業とメッセージが完了するまで待ってください。",
@@ -17782,7 +17938,7 @@
           "appliedFilters": "適用されたフィルター",
           "removeFilter": "フィルター {{value0}} を削除します",
           "chip": {
-            "idleDays": "アイドル {{value0}}d+",
+            "idleDays": "アイドル {{value0}}日以上",
             "neverVisited": "訪れたことがない",
             "minSize": "少なくとも {{value0}} MB",
             "maxSize": "最大 {{value0}} MB",
@@ -17905,9 +18061,9 @@
     "cmd-j": {
       "paletteSessionAge": {
         "minutes": "{{value0}}分",
-        "hours": "{{value0}}h",
-        "days": "{{value0}}d",
-        "underOneMinute": "<1m"
+        "hours": "{{value0}}時間",
+        "days": "{{value0}}日",
+        "underOneMinute": "<1分"
       }
     },
     "settings": {
@@ -17927,6 +18083,9 @@
           }
         }
       }
+    },
+    "agentChildRow": {
+      "ended": "終了"
     }
   },
   "dashboardPopout": {
@@ -18153,6 +18312,7 @@
       "needsInput": "入力待ち",
       "working": "処理中",
       "stopped": "停止",
+      "failed": "失敗",
       "finished": "完了"
     }
   },
@@ -18185,6 +18345,52 @@
       "unassignedInstruction": "フォーカスされたペインで音声ディクテーションを開始する前に、ディクテーションショートカットを割り当てます。",
       "settingsInstruction": "いつでもモデル、ディクテーションモード、ショートカットを変更できます。",
       "settingsLink": "設定→音声"
+    },
+    "sessionSearch": {
+      "ageHours": "2時間前",
+      "ageMinutes": "12分前",
+      "ageYesterday": "1日前",
+      "agentsInstruction": "Agent も検索できます。「ログインタイムアウトを修正したセッションを探して」と頼んでみてください。",
+      "consentInstruction": "いつでも以下で変更またはオフにできます:",
+      "continueInBackground": "バックグラウンドで続行",
+      "demoHit1Age": "3日前",
+      "demoHit1Snippet": "[[ログインタイムアウト]]を 30 秒に引き上げ、トークン更新時の再試行を追加しました。",
+      "demoHit1Title": "不安定な認証リダイレクトの修正",
+      "demoHit2Age": "1週間前",
+      "demoHit2Snippet": "スリープ復帰後に[[ログイン]]ページが[[タイムアウト]]で止まるのはなぜですか？",
+      "demoHit2Title": "スリープ後のセッション更新",
+      "demoHit3Age": "2週間前",
+      "demoHit3Snippet": "[[ログインタイムアウト]]の経路をエンドツーエンドでカバーするテストを追加しました。",
+      "demoHit3Title": "認証 E2E の強化",
+      "demoHit4Age": "5日前",
+      "demoHit4Snippet": "[[ロールバック]]では新規インデックスを先に削除し、古いカラムを復元します。",
+      "demoHit4Title": "注文テーブルの移行",
+      "demoHit5Age": "3週間前",
+      "demoHit5Snippet": "再試行の前に[[移行]][[ロールバック]]計画を書いてもらえますか？",
+      "demoHit5Title": "ステージングのデプロイに失敗",
+      "demoHit6Age": "1か月前",
+      "demoHit6Snippet": "ここの[[移行]]は enum の名前変更を除きすべて可逆です。",
+      "demoHit6Title": "スキーマレビューメモ",
+      "demoQuery": "ログインタイムアウト",
+      "demoQuery2": "移行 ロールバック",
+      "demoRoleAssistant": "アシスタント",
+      "demoRoleUser": "ユーザー",
+      "enableFailed": "セッション検索をオンにできませんでした。再試行してください。",
+      "indexingDescription": "過去の Agent の会話を読み取り、検索できるようにしています。数分かかることがあります。",
+      "indexingTitle": "Agent セッションをインデックス作成中",
+      "progressStarting": "セッションを探しています…",
+      "readyDescription": "このコンピュータ上のすべての Agent セッションを、会話内容から検索できるようになりました。",
+      "readyTitle": "セッション検索の準備ができました",
+      "readyToast": "セッション検索の準備ができました",
+      "readyToastOpen": "オープン",
+      "recent1Text": "検索エントリをワークフロー配下に移動し、テストを更新しました。",
+      "recent1Title": "設定サイドバーの整理",
+      "recent2Text": "依存関係を更新し、ビルドが通ることを確認します。",
+      "recent2Title": "ロックファイルの更新",
+      "recent3Text": "メモの初版です。分野別にまとめています。",
+      "recent3Title": "リリースノートの下書き",
+      "settingsLink": "設定 → Agent セッションの検索",
+      "startSearching": "検索を開始"
     }
   },
   "quickOpen": {
@@ -18298,5 +18504,63 @@
   },
   "common": {
     "retry": "再試行"
+  },
+  "fileExplorer": {
+    "root": {
+      "label": "エクスプローラーのルート",
+      "full": "リポジトリのルート",
+      "viewing": "表示中: {{path}}",
+      "back": "{{path}} に戻る",
+      "searchScope": "検索範囲: ワークスペースのファイル",
+      "retry": "再試行",
+      "omittedFiles": "スパースチェックアウトで除外されたファイルは検索されません。",
+      "viewOnly": "スパースチェックアウト · 表示を変えてもチェックアウト済みのファイルは変わりません。",
+      "sparseStatus": "スパースチェックアウト",
+      "scopeDetails": "スパースチェックアウトの範囲について",
+      "scopeExplanation": "フォルダーの選択で変わるのは表示範囲です。チェックアウトされるファイルは変わりません。リポジトリルートには、ルートと親フォルダーにチェックアウトされたファイルも表示されます。",
+      "searchExplanation": "「名前」は表示中のフォルダーを絞り込みます。「内容」はワークスペース全体を検索します。スパースチェックアウトで除外されたファイルは検索されません。",
+      "findInFolder": "{{path}} 内を検索",
+      "folderLoadError": "このフォルダーを読み込めませんでした：",
+      "emptyFolder": "このフォルダーにはファイルがありません"
+    }
+  },
+  "sparsePreset": {
+    "nameRequired": "名前を入力してください。",
+    "nameTooLong": "名前は80文字以内にしてください。",
+    "nameExists": "「{{name}}」というプリセットは既に存在します。",
+    "name": "名前",
+    "namePlaceholder": "Webアプリと共通UI",
+    "directories": "ディレクトリ",
+    "pathHelp": "リポジトリ相対のディレクトリを1行に1つ入力してください。パス内の空白は保持されます。",
+    "coneHelp": "Gitはリポジトリのルートと、選択したディレクトリの親フォルダにあるファイルも保持します。",
+    "cancel": "キャンセル",
+    "save": "プリセットを保存",
+    "new": "新しいスパースプリセット",
+    "edit": "スパースプリセットを編集",
+    "description": "新しいワークスペースでチェックアウトするフォルダを選択してください。",
+    "saveFailed": "プリセットを保存できませんでした。もう一度お試しください。",
+    "loading": "プリセットを読み込み中...",
+    "details": "チェックアウトされるファイルは？",
+    "finishEditing": "ワークスペースの作成を続けるには、プリセットを保存するかキャンセルしてください。",
+    "pathInstructions": "リポジトリルートからの相対パスで、1行に1フォルダーずつ入力します。",
+    "retryLoad": "プリセットの読み込みを再試行",
+    "fullCheckout": "フルチェックアウト",
+    "checkoutPreset": "チェックアウトのプリセット",
+    "search": "プリセットを検索…",
+    "noMatches": "一致するプリセットはありません。",
+    "allFiles": "リポジトリ内のすべてのファイル",
+    "editNamed": "{{name}} を編集",
+    "addPath": "Add a folder",
+    "findPath": "Find a folder…",
+    "noPathMatches": "No folders found.",
+    "repositoryRoot": "Repository root",
+    "loadingPaths": "Reading folders…",
+    "pathsUnavailable": "Could not read this folder. Type the path instead.",
+    "pathAdded": "Added",
+    "openFolder": "Open {{name}}",
+    "findOrTypePath": "Find a folder, or type any path…",
+    "addTypedPath": "Add",
+    "noDirectories": "No folders added yet.",
+    "removePath": "Remove {{name}}"
   }
 }
diff --git a/src/renderer/src/i18n/locales/ko.json b/src/renderer/src/i18n/locales/ko.json
index b44e62130a5..aa8bf3912d1 100644
--- a/src/renderer/src/i18n/locales/ko.json
+++ b/src/renderer/src/i18n/locales/ko.json
@@ -34,7 +34,8 @@
         "resourceUsageToggleDescription": "리소스 관리자를 표시합니다. 클릭하면 CPU, 메모리, 세션, 데몬 제어, 워크스페이스 디스크 스캔을 볼 수 있습니다.",
         "portsToggleDescription": "라이브 워크스페이스 포트를 표시합니다. 워크스페이스 범위 포트 및 외부 수신기를 보려면 클릭하세요.",
         "antigravityToggleDescription": "활성 워크스페이스에 대한 Antigravity 구독 사용량을 표시합니다.",
-        "grokToggleDescription": "Grok CLI로 로그인한 경우 Grok 구독 크레딧 사용량을 표시합니다."
+        "grokToggleDescription": "Grok CLI로 로그인한 경우 Grok 구독 크레딧 사용량을 표시합니다.",
+        "cursorToggleDescription": "cursor-agent 또는 Cursor IDE로 로그인한 경우 Cursor 플랜 사용량을 표시합니다."
       },
       "menuBarIcon": {
         "title": "메뉴 바 아이콘 표시",
@@ -495,6 +496,7 @@
           "mimo_code_label": "MiMo Code",
           "muse_label": "Muse",
           "opencode2_label": "OpenCode 2",
+          "codebuddy_label": "CodeBuddy",
           "zcode_label": "ZCode"
         },
         "skill": {
@@ -869,7 +871,8 @@
             "tooMany": "You can attach up to {{maxCount}} images.",
             "dimensionsTooLarge": "{{fileName}} has dimensions that are too large to preview safely.",
             "invalidImage": "{{fileName}} is not a valid supported image.",
-            "additionalErrors": "{{count}} additional images could not be attached."
+            "additionalErrors": "{{count}} additional images could not be attached.",
+            "totalTooLarge": "{{fileName}}을(를) 포함하면 첨부 파일 합계가 {{maxSize}}를 초과합니다."
           }
         }
       },
@@ -1600,7 +1603,6 @@
         "reuseExistingBranchHint": "기존 브랜치에서 새 브랜치를 만들지 않고 해당 브랜치를 체크아웃합니다.",
         "createMultiple": "더 만들기",
         "waitForSetupBeforeAgent": "agent를 시작하기 전에 설정이 완료될 때까지 기다리세요.",
-        "waitForSetupBeforeAgentHelp": "설치 프로그램이 시작 중에 agent에 필요한 종속성, MCP 서버 또는 구성 파일을 설치할 때 이 기능을 켜십시오.",
         "destroyDisabled": "비활성화된 파괴",
         "destroyConfigured": "구성된 파괴",
         "noDestroyConfigured": "파괴하지 마세요",
@@ -3031,6 +3033,7 @@
           },
           "TerminalContextMenu": {
             "b4cdd9314e": "화면 지우기",
+            "resetTerminal": "터미널 초기화",
             "8c17d6786d": "창 닫기",
             "copyTerminalId": "터미널 ID 복사",
             "2cf85a6a55": "창 ID 복사",
@@ -3066,7 +3069,9 @@
             "42b283ecfc": "호스트가 저장된 세션을 확인할 수 없기 때문에 Orca가 이 터미널을 안전하게 다시 연결할 수 없습니다. 오르카는 저장된 세션을 변경하지 않고 그대로 두었습니다. 지금 다시 연결을 시도하려면 재시도를 클릭하세요. 그래도 다시 연결할 수 없으면 새 터미널을 엽니다.",
             "e16012e31e": "이 세션을 소유한 터미널 데몬이 종료되었으므로 세션과 해당 스크롤백을 복구할 수 없습니다. 계속하려면 새 터미널을 여세요.",
             "sessionUnavailable": "Orca가 호스트에서 이 창의 터미널 세션에 다시 연결할 수 없습니다. 계속하려면 새 터미널을 여세요.",
-            "sourceRestoring": "이 터미널을 다시 연결하는 중 - 출력이 다시 설정되고 있습니다. 세션이 아직 실행 중입니다."
+            "sourceRestoring": "이 터미널을 다시 연결하는 중 - 출력이 다시 설정되고 있습니다. 세션이 아직 실행 중입니다.",
+            "ptyAllocationLimit": "시스템에서 더 이상 pty 장치를 할당할 수 없습니다. Orca 또는 다른 프로그램에서 사용하지 않는 터미널을 몇 개 닫은 후 다시 시도하세요.",
+            "terminalProcessLimit": "시스템에서 터미널 프로세스를 더 시작할 수 없습니다. 사용하지 않는 터미널을 닫거나 불필요한 프로세스를 종료한 후 다시 시도하세요."
           },
           "TerminalProcessExitOverlay": {
             "capacityTitle": "Git Bash 콘솔 한도에 도달했습니다",
@@ -3093,7 +3098,7 @@
             "missing": {
               "tui": {
                 "title": "This ZCode build has no terminal UI",
-                "description": "Orca's hooks installed correctly \u2014 the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
+                "description": "Orca's hooks installed correctly — the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
               }
             }
           },
@@ -3239,6 +3244,9 @@
           "TerminalQuickCommandsSubmenu": {
             "3ccc7981bb": "호스트를 사용할 수 없음",
             "54f29b7c0d": "호스트 로드 중…"
+          },
+          "TerminalRestoringPlaceholder": {
+            "restoring": "터미널 복원 중…"
           }
         }
       },
@@ -3666,7 +3674,9 @@
             "grokUsageMenu": "Grok 사용량",
             "floatingTerminalNewActivity": "{{label}}, 새 활동",
             "codexSignInSuccess": "Codex에 로그인했습니다",
-            "codexSignInError": "Codex 로그인에 실패했습니다. 다시 시도해 주세요."
+            "codexSignInError": "Codex 로그인에 실패했습니다. 다시 시도해 주세요.",
+            "cursorUsageMenu": "Cursor 사용량",
+            "hiddenUsageProviders": "그 외: {{value0}}"
           },
           "StatusBarUsageEmptyCta": {
             "828c764a79": "계정 연결",
@@ -3841,6 +3851,13 @@
               "noSubscription": {
                 "label": "구독 없음"
               }
+            },
+            "cursor": {
+              "expired": {
+                "label": "로그인 만료",
+                "message": "Orca가 실행 중인 컴퓨터의 터미널에서 cursor-agent login을 실행한 뒤 사용량을 다시 시도하세요."
+              },
+              "plan": "플랜"
             }
           },
           "SshTargetStatusRow": {
@@ -3949,7 +3966,12 @@
             "checkLabel": "확인할 채팅 {{value0}}개",
             "checkAriaOne": "재개한 후 확인할 채팅 1개. 자세히 보려면 클릭하세요.",
             "checkAria": "재개한 후 확인할 채팅 {{value0}}개. 자세히 보려면 클릭하세요.",
-            "checkTooltip": "다시 시작한 후 Orca가 재개하지 못했거나 재개했는지 확인하지 못한 채팅. 자세히 보려면 클릭하세요."
+            "checkTooltip": "다시 시작한 후 Orca가 재개하지 못했거나 재개했는지 확인하지 못한 채팅. 자세히 보려면 클릭하세요.",
+            "resumingLabelOne": "채팅 1개 재개 중",
+            "resumingLabel": "채팅 {{value0}}개 재개 중",
+            "resumingAriaOne": "채팅 1개 재개 중. 자세히 보려면 클릭하세요.",
+            "resumingAria": "채팅 {{value0}}개 재개 중. 자세히 보려면 클릭하세요.",
+            "resumingTooltip": "중단된 채팅을 복원하고 계속하도록 요청하는 중…"
           }
         }
       },
@@ -5204,7 +5226,9 @@
           "69969ba364": "전송 중…",
           "imageReadFailed": "Could not read the attached images. Try attaching them again.",
           "attachWhileSending": "Wait for the current feedback to finish sending before attaching more images.",
-          "imagesNotDelivered": "Feedback sent, but image delivery could not be confirmed."
+          "imagesNotDelivered": "Feedback sent, but image delivery could not be confirmed.",
+          "imagesNotIncluded": "피드백을 보냈습니다. 스크린샷을 업로드하지 못해 포함되지 않았습니다.",
+          "imagesRejected": "피드백을 보냈습니다. 스크린샷이 너무 커서 업로드하지 못해 포함되지 않았습니다."
         },
         "SidebarFilter": {
           "e3b3898218": "프로젝트 추가",
@@ -6164,7 +6188,8 @@
         },
         "SidebarFeedbackImageAttachments": {
           "attachImages": "Attach",
-          "removeImage": "Remove {{fileName}}"
+          "removeImage": "Remove {{fileName}}",
+          "screenshotsHint": "최대 {{count}}장, 총 {{maxSize}}까지 스크린샷을 첨부하세요."
         },
         "WorkspaceKanbanSearchField": {
           "bdb753c78d": "일치하는 워크스페이스가 없습니다",
@@ -7814,8 +7839,7 @@
           "81057d5f71": "저장 중...",
           "da37d6f10e": "복사",
           "3149964b66": "복사됨",
-          "waitForSetupBeforeAgent": "agent를 시작하기 전에 설정이 완료될 때까지 기다리세요.",
-          "waitForSetupBeforeAgentHelp": "설치 프로그램이 시작 중에 agent에 필요한 종속성, MCP 서버 또는 구성 파일을 설치할 때 이 기능을 켜십시오."
+          "waitForSetupBeforeAgent": "agent를 시작하기 전에 설정이 완료될 때까지 기다리세요."
         },
         "RepositoryIconPicker": {
           "2b7d27b93c": "{{value0}} repo 색상 사용",
@@ -8863,7 +8887,18 @@
             "b2c4e7f1a8": "끝점",
             "3a9b6d2c4e": "API 키",
             "5d8f1a3b7c": "중국",
-            "7e2a4b8c1d": "해외"
+            "7e2a4b8c1d": "해외",
+            "cursor": {
+              "description": "이 컴퓨터에 이미 있는 Cursor 로그인(cursor-agent login)에서 읽은 월간 플랜 사용량입니다.",
+              "kw": {
+                "cursor": "cursor",
+                "rateLimit": "속도 제한",
+                "spend": "지출",
+                "statusBar": "상태 표시줄",
+                "usage": "사용량"
+              },
+              "title": "Cursor 사용량"
+            }
           }
         },
         "advanced": {
@@ -8919,6 +8954,9 @@
             "0d1c334987": "뚜껑",
             "ff8de8a2ad": "표시",
             "0d752916f8": "훅",
+            "agent-trust-trust": "신뢰",
+            "agent-trust-folder": "폴더",
+            "agent-trust-worktree": "워크트리",
             "6984d4291a": "상태",
             "13b20636a6": "대기",
             "8599603496": "완료",
@@ -9119,6 +9157,13 @@
               "close": "닫다",
               "notification": "알림 영역",
               "background": "배경"
+            },
+            "cursor": {
+              "description": "이 컴퓨터의 Cursor 로그인에서 월간 Cursor 플랜 사용량을 표시합니다.",
+              "kw": {
+                "cursor": "cursor"
+              },
+              "title": "Cursor 사용량"
             }
           }
         },
@@ -10678,6 +10723,10 @@
           "7707c15abb": "Agent 상태 훅",
           "a68a642835": "Orca에서 작업 중, 대기 중, 완료 상태를 표시합니다. 끄면 Orca가 관리하는 훅을 제거하고 재설치를 중단합니다."
         },
+        "agent-workspace-trust-copy": {
+          "title": "Orca가 에이전트를 시작할 때 폴더 신뢰",
+          "description": "Orca가 시작한 에이전트는 \"Do you trust this folder?\" 확인을 건너뛰므로, 프로젝트의 에이전트 훅과 설정이 바로 실행됩니다. 이 설정이 없으면 각 에이전트가 폴더에서 처음 실행될 때 확인을 요청합니다. 오케스트레이션 워커, 자동화, 휴대폰에서 시작한 에이전트처럼 사용자가 지켜보지 않는 동안 실행되는 에이전트는 해당 터미널에서 응답할 때까지 그 확인에서 기다립니다. 이미 신뢰한 폴더는 계속 신뢰됩니다."
+        },
         "agent-generated-tab-title-copy": {
           "19ad21615a": "탭 제목 자동 생성",
           "b036c7a409": "첫 번째 agent 프롬프트에서 짧고 안정적인 탭 이름을 만듭니다. 수동으로 변경한 이름이 항상 우선합니다."
@@ -11992,6 +12041,31 @@
         "TerminalRenderingSection": {
           "6d4c55bacc": "인라인 이미지",
           "fffab5890b": "SIXEL, iTerm2(IIP) 및 Kitty 그래픽 프로토콜을 사용하여 터미널에 이미지를 직접 표시합니다."
+        },
+        "CursorAccountsSection": {
+          "dashboardLink": "Cursor 대시보드",
+          "expired": "로그인이 만료되었습니다 — Orca가 실행 중인 컴퓨터에서 cursor-agent login을 실행한 뒤 사용량 새로고침을 클릭하세요.",
+          "loading": "로드 중…",
+          "noAllowance": "Cursor에서 이 계정에 사용 한도가 없다고 보고했습니다.",
+          "planTotal": "플랜",
+          "refreshUsage": "사용량 새로고침",
+          "resets": "{{when}}에 초기화",
+          "signedIn": "로그인됨",
+          "signedInFrom": "로그인되었습니다. Orca는 {{source}}에 저장된 세션을 읽습니다.",
+          "signedInGeneric": "로그인되었습니다. Orca는 이 컴퓨터에 저장된 Cursor 세션을 읽습니다.",
+          "signedOut": "이 컴퓨터에서 Cursor 로그인을 찾을 수 없습니다",
+          "signedOutHelp": "Cursor IDE로 로그인하거나 터미널에서 cursor-agent login을 실행한 뒤 여기서 사용량 새로고침을 클릭하세요.",
+          "source": {
+            "cli": "Cursor CLI 인증 파일",
+            "desktop": "Cursor IDE",
+            "keychain": "macOS 키체인(cursor-agent)"
+          },
+          "staleUsage": "마지막으로 확인된 사용량 — 최신 새로고침이 실패했습니다: {{reason}}",
+          "subtitle": "이 컴퓨터에 이미 있는 로그인에서 Cursor 월간 플랜 사용량을 보여줍니다. Orca는 읽기만 하며 Cursor 로그인을 변경하지 않습니다.",
+          "title": "Cursor",
+          "usageDescription": "Cursor는 요금 주기에 따라 초기화되는 두 가지 풀과, 소진 후에 발생하는 주문형 지출로 과금합니다.",
+          "usageLabel": "사용량",
+          "usageTitle": "월간 플랜 사용량"
         }
       },
       "right": {
@@ -14796,6 +14870,7 @@
           "f1aa04b5cf": "이 파일",
           "8b87612461": "보내지 않은 모든 메모"
         },
+        "diffCommentSaveFailed": "댓글을 저장하지 못했습니다.",
         "DiffSectionBody": {
           "35d6afb5be": "바이너리 파일이 변경됨",
           "cef4cf0ff5": "다시 시도",
@@ -14917,6 +14992,7 @@
           "notPython": "해당 파일은 Python 인터프리터가 아닙니다.",
           "interrupt": "중단",
           "restart": "커널 다시 시작",
+          "trustFirst": "먼저 셀을 실행하여 이 노트북을 신뢰하세요",
           "runAll": "모두 실행",
           "clearAll": "모든 출력 지우기",
           "notResponding": "응답 없음. 커널을 다시 시작하세요",
@@ -14932,11 +15008,26 @@
           "noPython": "이 컴퓨터에서 Python을 찾을 수 없습니다. [python.org](https://www.python.org/downloads/)에서 설치한 뒤 셀을 다시 실행하세요.",
           "kernelDied": "커널이 종료되었습니다.",
           "localOnly": "노트북 셀은 이 컴퓨터의 파일에 대해서만 실행할 수 있습니다.",
-          "pythonOnly": "Orca에서는 Python 노트북만 실행할 수 있습니다."
+          "pythonOnly": "Orca에서는 Python 노트북만 실행할 수 있습니다.",
+          "commandCopied": "명령이 복사되었습니다.",
+          "createVenv": ".venv 만들기",
+          "createVenvItem": "가상 환경 만들기…",
+          "createVenvTitle": "가상 환경을 만들까요?",
+          "creatingButton": "만드는 중…",
+          "creatingVenvDescription": "{{folder}}에 .venv를 만들고 ipykernel을 설치하고 있습니다. 1분 정도 걸릴 수 있습니다.",
+          "creatingVenvTitle": "가상 환경 만드는 중…",
+          "installingButton": "설치 중…",
+          "installingDescription": "pip로 '{{env}}'에 ipykernel을 설치하고 있습니다. 1분 정도 걸릴 수 있습니다.",
+          "installingTitle": "ipykernel 설치 중…",
+          "kernelCreatingVenv": ".venv 만드는 중…",
+          "setupFailed": "실패했습니다. Python 출력:",
+          "tryAgain": "다시 시도",
+          "useAnotherPython": "다른 Python 사용…",
+          "venvDescription": "Orca가 '{{env}}'에서 {{folder}}에 .venv를 만들고, ipykernel을 설치한 뒤 이 노트북을 거기서 실행합니다."
         },
         "MarkdownPreview": {
           "e4683f70c4": "취소",
-          "d737791433": "AI에 대한 메모 추가",
+          "d737791433": "AI에게 전달할 메모 추가",
           "b1bfc04034": "선택한 텍스트",
           "f37b98999e": "이 메모",
           "2b2b31382c": "머리말",
@@ -15423,7 +15514,10 @@
             "2b3ce6d394": "취소",
             "e05063cfc1": "라인 {{value0}}",
             "c845170b3b": "라인 {{value0}}-{{value1}}",
-            "commentTooLarge": "댓글이 너무 길어 안전하게 제출할 수 없습니다."
+            "commentTooLarge": "댓글이 너무 길어 안전하게 제출할 수 없습니다.",
+            "f6c449191e": "AI에게 전달할 메모 추가",
+            "5fa4bfebaa": "메모 추가",
+            "5e9b3d0c2e": "추가 중..."
           },
           "useDiffCommentDecorator": {
             "995fa28b50": "이 메모"
@@ -17155,6 +17249,13 @@
         "dispatchRejected": "에이전트가 “continue” 메시지를 거부했습니다. 채팅을 열어 직접 보내세요.",
         "unsupported": "이 채팅은 Orca에서 재개할 수 없습니다. 열어서 중단된 위치를 확인하세요.",
         "fallback": "Orca가 이 채팅을 재개하지 못했습니다. 열어서 수동으로 계속하세요."
+      },
+      "web": {
+        "preloadApi": {
+          "cursorAccounts": {
+            "hostOnly": "Cursor 로그인 정보는 Orca가 실행 중인 컴퓨터에서만 읽을 수 있습니다."
+          }
+        }
       }
     },
     "i18n": {
@@ -17258,6 +17359,56 @@
       }
     },
     "native-chat": {
+      "writeNotice": {
+        "notDoneReadHistory": "이 채팅의 기록을 불러오지 못했습니다.",
+        "notDoneSend": "메시지가 전송되지 않았습니다.",
+        "tryAgainComposerSend": "다시 보내세요.",
+        "notDoneStop": "에이전트가 중지되지 않았습니다.",
+        "notDoneStopTask": "백그라운드 작업이 중지되지 않았습니다.",
+        "notDoneStopTasks": "백그라운드 작업이 중지되지 않았습니다.",
+        "notDoneAnswer": "답변이 전송되지 않았습니다.",
+        "notDoneOption": "설정이 변경되지 않았습니다.",
+        "notDoneCommand": "명령이 실행되지 않았습니다.",
+        "notDoneGoal": "목표가 변경되지 않았습니다.",
+        "restartFailed": "에이전트를 다시 시작하지 못했습니다.",
+        "capacity": "Orca가 지난 하루 동안 너무 많은 요청을 받았습니다.",
+        "outcomeUnknown": "Orca가 무슨 일이 있었는지 확인하지 못했습니다. 채팅을 확인하세요.",
+        "questionChanged": "이 질문은 이미 답변되었거나 변경되었습니다.",
+        "historyUnreadable": "Orca가 이 채팅의 저장된 기록을 읽지 못했습니다.",
+        "historyUnusable": "이 채팅을 불러올 수 없습니다.",
+        "historyUnavailable": "Orca가 지금 이 채팅의 기록을 열지 못했습니다.",
+        "unsupported": "이 채팅을 실행 중인 Orca가 이 기능을 지원하지 않습니다. Orca를 업데이트한 후 다시 시도하세요.",
+        "unreachable": "Orca가 에이전트에 연결하지 못했습니다.",
+        "recordFailed": "Orca가 이 채팅의 기록에 저장하지 못했습니다.",
+        "conversationCleared": "이 대화는 지워졌습니다.",
+        "openCurrentConversation": "계속하려면 현재 대화를 여세요.",
+        "clearUnfinished": "마지막 /clear가 완료되지 않았습니다.",
+        "commandRunning": "/compact 또는 /clear가 아직 실행 중입니다.",
+        "waitForCommand": "/compact 또는 /clear가 끝날 때까지 기다리세요.",
+        "agentStarting": "에이전트가 아직 시작 중입니다.",
+        "waitForStart": "에이전트가 시작을 마칠 때까지 기다리세요.",
+        "turnActive": "에이전트가 아직 응답 중입니다.",
+        "waitForTurn": "에이전트가 응답을 마칠 때까지 기다리거나 에이전트를 중지하세요.",
+        "promptPending": "에이전트가 질문 또는 승인에 대한 응답을 기다리고 있습니다.",
+        "answerFirst": "먼저 질문 또는 승인에 응답하세요.",
+        "backgroundTasksRunning": "백그라운드 작업이 아직 실행 중입니다.",
+        "waitForBackgroundTasks": "백그라운드 작업이 끝날 때까지 기다리세요.",
+        "messagesUnsettled": "앞서 보낸 메시지가 아직 확인되지 않았습니다.",
+        "settleEarlierMessage": "앞서 보낸 메시지가 전달될 때까지 기다리거나 다시 시도하세요.",
+        "optionRejected": "에이전트가 이 설정을 받아들이지 않았습니다.",
+        "goalsUnsupported": "이 에이전트는 목표를 지원하지 않습니다.",
+        "agentRefused": "에이전트가 이를 거부했습니다.",
+        "ownerUnproven": "Orca가 이 채팅의 이전 에이전트가 중지되었는지 아직 확인하지 못했습니다.",
+        "reopenChat": "다시 확인하려면 채팅을 다시 여세요.",
+        "terminalAgentHoldsChat": "이 채팅은 아직 터미널 에이전트에서 열려 있습니다.",
+        "quitTerminalAgent": "여기에서 채팅을 계속하려면 해당 에이전트를 종료하세요.",
+        "hostReconciling": "Orca가 다시 시작된 후 이 채팅을 아직 확인하고 있습니다.",
+        "waitMoment": "잠시 기다리세요.",
+        "recordUnreadable": "Orca가 이 채팅의 저장된 상태를 읽지 못했습니다.",
+        "chatNotFound": "이 채팅을 실행하는 Orca에 이 채팅의 기록이 없습니다.",
+        "startNewChat": "계속하려면 새 채팅을 시작하세요.",
+        "tryAgain": "다시 시도하세요."
+      },
       "composer": {
         "imageUnsupported": "이 에이전트는 이미지 붙여넣기를 지원하지 않습니다.",
         "send": "보내기",
@@ -17398,9 +17549,9 @@
         "responding": "Agent이 응답 중입니다.",
         "working": "일하고 있는…",
         "thinking": "생각",
-        "workingFor": "{{value0}}에서 근무",
-        "workedFor": "{{value0}}에서 근무함",
-        "toggleDetails": "회전 세부정보 전환"
+        "workingFor": "{{value0}} 작업 중",
+        "workedFor": "{{value0}} 작업 완료",
+        "toggleDetails": "턴 세부정보 전환"
       },
       "jumpToLatest": "최신으로 이동",
       "toggle": {
@@ -17414,8 +17565,10 @@
         },
         "error": {
           "title": "대화를 로드할 수 없습니다.",
-          "subtitle": "스크립트를 읽을 수 없습니다. 계속 작업하려면 terminal로 다시 전환하세요."
+          "subtitle": "스크립트를 읽을 수 없습니다. 계속 작업하려면 terminal로 다시 전환하세요.",
+          "retryingSubtitle": "스크립트를 읽을 수 없습니다. Orca가 계속 다시 불러오기를 시도합니다."
         },
+        "reconnecting": "이 채팅에 다시 연결하는 중…",
         "pairHost": "호스트를 페어링하여 에이전트 채팅 기록을 확인하세요.",
         "notAgent": {
           "title": "여기에는 대화가 없습니다.",
@@ -17540,6 +17693,7 @@
       "railEmptyMessage": "메시지",
       "ask": {
         "awaiting": "사용자 입력을 기다리는 중:",
+        "awaitingUnnamed": "사용자 입력을 기다리는 중",
         "asked": "질문:",
         "questionCount": "{{value0}} 질문"
       },
@@ -17563,7 +17717,9 @@
         "startedN": "{{value0}} 하위 에이전트가 시작되었습니다.",
         "ranOne": "하위 에이전트 1개 실행",
         "ranN": "{{value0}} 하위 에이전트를 실행했습니다.",
-        "tokens": "{{value0}} 토큰"
+        "tokens": "{{value0}} 토큰",
+        "unnamed": "하위 에이전트",
+        "writtenBy": "하위 에이전트 {{value0}}의 출력"
       },
       "conversationCommand": {
         "pendingWork": "이 명령을 사용하기 전에 보류 중인 작업과 메시지가 완료될 때까지 기다리십시오.",
@@ -17846,7 +18002,7 @@
           "justNow": "방금",
           "minutesAgo": "{{value0}}분 전",
           "hoursAgo": "{{value0}}시간 전",
-          "daysAgo": "{{value0}}d 전"
+          "daysAgo": "{{value0}}일 전"
         },
         "host": {
           "label": "호스트: {{value0}}",
@@ -17904,9 +18060,9 @@
     },
     "cmd-j": {
       "paletteSessionAge": {
-        "minutes": "{{value0}}m",
-        "hours": "{{value0}}h",
-        "days": "{{value0}}d",
+        "minutes": "{{value0}}분",
+        "hours": "{{value0}}시간",
+        "days": "{{value0}}일",
         "underOneMinute": "1분 미만"
       }
     },
@@ -17927,6 +18083,9 @@
           }
         }
       }
+    },
+    "agentChildRow": {
+      "ended": "종료됨"
     }
   },
   "dashboardPopout": {
@@ -18153,6 +18312,7 @@
       "needsInput": "입력 필요",
       "working": "작업 중",
       "stopped": "중지됨",
+      "failed": "실패함",
       "finished": "완료됨"
     }
   },
@@ -18185,6 +18345,52 @@
       "unassignedInstruction": "초점이 맞춰진 창에서 음성 받아쓰기를 시작하기 전에 받아쓰기 바로가기를 할당하세요.",
       "settingsInstruction": "언제든지 모델, 받아쓰기 모드 또는 바로가기를 변경할 수 있습니다.",
       "settingsLink": "설정 → 음성"
+    },
+    "sessionSearch": {
+      "ageHours": "2시간",
+      "ageMinutes": "12분",
+      "ageYesterday": "1일",
+      "agentsInstruction": "에이전트도 검색할 수 있습니다. 에이전트에게 “로그인 시간 초과를 수정한 세션을 찾아줘”라고 요청해 보세요.",
+      "consentInstruction": "언제든지 다음에서 변경하거나 끄기",
+      "continueInBackground": "백그라운드에서 계속하기",
+      "demoHit1Age": "3일",
+      "demoHit1Snippet": "[[로그인 시간 초과]]를 30초로 늘리고 토큰 새로고침에 재시도를 추가했습니다.",
+      "demoHit1Title": "불안정한 인증 리디렉션 수정",
+      "demoHit2Age": "1주",
+      "demoHit2Snippet": "절전 모드 해제 후 [[로그인]] 페이지가 [[시간 초과]] 후에 멈추는 이유는 무엇인가요?",
+      "demoHit2Title": "절전 후 세션 새로고침",
+      "demoHit3Age": "2주",
+      "demoHit3Snippet": "[[로그인 시간 초과]] 경로를 처음부터 끝까지 다루는 테스트를 추가했습니다.",
+      "demoHit3Title": "인증 e2e 강화",
+      "demoHit4Age": "5일",
+      "demoHit4Snippet": "[[롤백]]이 새 인덱스를 먼저 삭제한 뒤 이전 컬럼을 복원합니다.",
+      "demoHit4Title": "주문 테이블 마이그레이션",
+      "demoHit5Age": "3주",
+      "demoHit5Snippet": "다시 시도하기 전에 [[마이그레이션]] [[롤백]] 계획을 작성해 줄 수 있나요?",
+      "demoHit5Title": "스테이징 배포 실패",
+      "demoHit6Age": "1개월",
+      "demoHit6Snippet": "여기의 모든 [[마이그레이션]]은 enum 이름 변경을 제외하고 되돌릴 수 있습니다.",
+      "demoHit6Title": "스키마 검토 메모",
+      "demoQuery": "로그인 시간 초과",
+      "demoQuery2": "마이그레이션 롤백",
+      "demoRoleAssistant": "어시스턴트",
+      "demoRoleUser": "사용자",
+      "enableFailed": "세션 검색을 켜지 못했습니다. 다시 시도하세요.",
+      "indexingDescription": "Orca가 이전 에이전트 대화를 읽어 검색할 수 있도록 준비하고 있습니다. 몇 분 정도 걸릴 수 있습니다.",
+      "indexingTitle": "에이전트 세션을 색인화하는 중",
+      "progressStarting": "세션을 찾는 중…",
+      "readyDescription": "이제 이 컴퓨터의 모든 에이전트 세션을 대화 내용으로 찾을 수 있습니다.",
+      "readyTitle": "세션 검색이 준비되었습니다",
+      "readyToast": "세션 검색이 준비되었습니다",
+      "readyToastOpen": "열기",
+      "recent1Text": "검색 항목을 워크플로 아래로 옮기고 테스트를 업데이트했습니다.",
+      "recent1Title": "설정 사이드바 정리",
+      "recent2Text": "의존성을 업데이트하고 빌드가 여전히 통과하는지 확인하세요.",
+      "recent2Title": "잠금 파일 업데이트",
+      "recent3Text": "초안 메모입니다. 영역별로 정리했습니다.",
+      "recent3Title": "릴리스 노트 초안",
+      "settingsLink": "설정 → 에이전트 세션 검색",
+      "startSearching": "검색 시작하기"
     }
   },
   "quickOpen": {
@@ -18298,5 +18504,63 @@
   },
   "common": {
     "retry": "다시 시도"
+  },
+  "fileExplorer": {
+    "root": {
+      "label": "탐색기 루트",
+      "full": "저장소 루트",
+      "viewing": "보기: {{path}}",
+      "back": "{{path}}(으)로 돌아가기",
+      "searchScope": "검색 범위: 작업 공간 파일",
+      "retry": "다시 시도",
+      "omittedFiles": "희소 체크아웃에서 제외된 파일은 검색되지 않습니다.",
+      "viewOnly": "희소 체크아웃 · 보기를 바꿔도 체크아웃된 파일은 변경되지 않습니다.",
+      "sparseStatus": "스파스 체크아웃",
+      "scopeDetails": "스파스 체크아웃 범위 안내",
+      "scopeExplanation": "폴더 선택은 표시 범위만 바꾸며 체크아웃된 파일은 바꾸지 않습니다. 저장소 루트에는 루트와 상위 폴더에 체크아웃된 파일도 표시됩니다.",
+      "searchExplanation": "이름 검색은 현재 보고 있는 폴더를 필터링합니다. 내용 검색은 전체 워크스페이스를 검색합니다. 스파스 체크아웃에서 제외된 파일은 검색하지 않습니다.",
+      "findInFolder": "{{path}}에서 찾기",
+      "folderLoadError": "이 폴더를 불러오지 못했습니다:",
+      "emptyFolder": "이 폴더에 파일이 없습니다"
+    }
+  },
+  "sparsePreset": {
+    "nameRequired": "이름을 입력하세요.",
+    "nameTooLong": "이름은 80자 이하여야 합니다.",
+    "nameExists": "같은 이름의 프리셋이 이미 있습니다: {{name}}",
+    "name": "이름",
+    "namePlaceholder": "웹 앱 및 공용 UI",
+    "directories": "디렉터리",
+    "pathHelp": "한 줄에 저장소 기준 상대 경로를 하나씩 입력하세요. 경로 내 공백은 유지됩니다.",
+    "coneHelp": "Git은 저장소 루트와 선택한 디렉터리의 상위 폴더에 있는 파일도 유지합니다.",
+    "cancel": "취소",
+    "save": "프리셋 저장",
+    "new": "새 희소 체크아웃 프리셋",
+    "edit": "희소 체크아웃 프리셋 편집",
+    "description": "새 워크스페이스에서 체크아웃할 폴더를 선택하세요.",
+    "saveFailed": "프리셋을 저장하지 못했습니다. 다시 시도하세요.",
+    "loading": "프리셋을 불러오는 중...",
+    "details": "어떤 파일이 체크아웃되나요?",
+    "finishEditing": "워크스페이스 만들기를 계속하려면 프리셋을 저장하거나 취소하세요.",
+    "pathInstructions": "저장소 루트 기준 상대 경로로 한 줄에 폴더 하나씩 입력하세요.",
+    "retryLoad": "프리셋 불러오기 다시 시도",
+    "fullCheckout": "전체 체크아웃",
+    "checkoutPreset": "체크아웃 프리셋",
+    "search": "프리셋 찾기…",
+    "noMatches": "일치하는 프리셋이 없습니다.",
+    "allFiles": "저장소의 모든 파일",
+    "editNamed": "프리셋 편집: {{name}}",
+    "addPath": "Add a folder",
+    "findPath": "Find a folder…",
+    "noPathMatches": "No folders found.",
+    "repositoryRoot": "Repository root",
+    "loadingPaths": "Reading folders…",
+    "pathsUnavailable": "Could not read this folder. Type the path instead.",
+    "pathAdded": "Added",
+    "openFolder": "Open {{name}}",
+    "findOrTypePath": "Find a folder, or type any path…",
+    "addTypedPath": "Add",
+    "noDirectories": "No folders added yet.",
+    "removePath": "Remove {{name}}"
   }
 }
diff --git a/src/renderer/src/i18n/locales/zh.json b/src/renderer/src/i18n/locales/zh.json
index 5e7a0c9ec0f..e61395b4291 100644
--- a/src/renderer/src/i18n/locales/zh.json
+++ b/src/renderer/src/i18n/locales/zh.json
@@ -34,7 +34,8 @@
         "resourceUsageToggleDescription": "显示资源管理器。点击可查看 CPU、内存、会话、守护进程控制和工作区磁盘扫描。",
         "portsToggleDescription": "显示实时工作区端口。点击可查看工作区范围的端口和外部监听器。",
         "antigravityToggleDescription": "显示当前工作区的 Antigravity 订阅使用情况。",
-        "grokToggleDescription": "通过 Grok CLI 登录后显示 Grok 订阅额度使用情况。"
+        "grokToggleDescription": "通过 Grok CLI 登录后显示 Grok 订阅额度使用情况。",
+        "cursorToggleDescription": "通过 cursor-agent 或 Cursor IDE 登录后显示 Cursor 套餐用量。"
       },
       "menuBarIcon": {
         "title": "显示菜单栏图标",
@@ -495,6 +496,7 @@
           "mimo_code_label": "MiMo Code",
           "muse_label": "Muse",
           "opencode2_label": "OpenCode 2",
+          "codebuddy_label": "CodeBuddy",
           "zcode_label": "ZCode"
         },
         "skill": {
@@ -869,7 +871,8 @@
             "tooMany": "最多可附加 {{maxCount}} 张图片。",
             "dimensionsTooLarge": "{{fileName}} 的尺寸过大，无法安全预览。",
             "invalidImage": "{{fileName}} 不是有效的受支持图片。",
-            "additionalErrors": "还有 {{count}} 张图片无法附加。"
+            "additionalErrors": "还有 {{count}} 张图片无法附加。",
+            "totalTooLarge": "{{fileName}} 将使附件总大小超过 {{maxSize}}。"
           }
         }
       },
@@ -1600,7 +1603,6 @@
         "reuseExistingBranchHint": "检出已有分支，而不是从它创建新分支。",
         "createMultiple": "创建更多",
         "waitForSetupBeforeAgent": "等待设置完成后再启动智能体",
-        "waitForSetupBeforeAgentHelp": "如果设置会安装依赖、MCP 服务器或智能体启动时需要的配置文件，请开启此选项。",
         "destroyDisabled": "已禁用销毁",
         "destroyConfigured": "已配置销毁",
         "noDestroyConfigured": "未配置销毁",
@@ -3031,6 +3033,7 @@
           },
           "TerminalContextMenu": {
             "b4cdd9314e": "清屏",
+            "resetTerminal": "重置终端",
             "8c17d6786d": "关闭窗格",
             "copyTerminalId": "复制终端 ID",
             "2cf85a6a55": "复制窗格 ID",
@@ -3066,7 +3069,9 @@
             "42b283ecfc": "Orca 无法安全地重新连接此终端，因为主机无法验证其保存的会话。 Orca 保持保存的会话不变。单击“重试”立即尝试重新连接。如果仍然无法重新连接，请打开一个新终端。",
             "e16012e31e": "拥有该会话的终端守护程序已退出，因此该会话及其回滚无法恢复。打开新终端以继续。",
             "sessionUnavailable": "Orca 无法重新连接到主机上此窗格的终端会话。打开新终端以继续。",
-            "sourceRestoring": "重新连接该终端 — 正在重新建立其输出。会话仍在进行。"
+            "sourceRestoring": "重新连接该终端 — 正在重新建立其输出。会话仍在进行。",
+            "ptyAllocationLimit": "系统无法再分配 pty 设备。请在 Orca 或其他程序中关闭一些不用的终端，然后重试。",
+            "terminalProcessLimit": "系统无法再启动终端进程。请关闭不用的终端或退出不用的进程，然后重试。"
           },
           "TerminalProcessExitOverlay": {
             "capacityTitle": "已达到 Git Bash 控制台上限",
@@ -3093,7 +3098,7 @@
             "missing": {
               "tui": {
                 "title": "This ZCode build has no terminal UI",
-                "description": "Orca's hooks installed correctly \u2014 the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
+                "description": "Orca's hooks installed correctly — the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
               }
             }
           },
@@ -3239,6 +3244,9 @@
           "TerminalQuickCommandsSubmenu": {
             "3ccc7981bb": "主机不可用",
             "54f29b7c0d": "正在加载主机..."
+          },
+          "TerminalRestoringPlaceholder": {
+            "restoring": "正在恢复终端…"
           }
         }
       },
@@ -3666,7 +3674,9 @@
             "grokUsageMenu": "Grok 使用情况",
             "floatingTerminalNewActivity": "{{label}}，有新活动",
             "codexSignInSuccess": "已登录 Codex",
-            "codexSignInError": "Codex 登录失败，请重试。"
+            "codexSignInError": "Codex 登录失败，请重试。",
+            "cursorUsageMenu": "Cursor 用量",
+            "hiddenUsageProviders": "另有：{{value0}}"
           },
           "StatusBarUsageEmptyCta": {
             "828c764a79": "连接账户",
@@ -3841,6 +3851,13 @@
               "noSubscription": {
                 "label": "无订阅"
               }
+            },
+            "cursor": {
+              "expired": {
+                "label": "登录已过期",
+                "message": "请在运行 Orca 的电脑上的终端中运行 cursor-agent login，然后重新刷新用量。"
+              },
+              "plan": "套餐"
             }
           },
           "SshTargetStatusRow": {
@@ -3949,7 +3966,12 @@
             "checkLabel": "{{value0}} 个待检查的聊天",
             "checkAriaOne": "恢复后有 1 个待检查的聊天。点击查看详情。",
             "checkAria": "恢复后有 {{value0}} 个待检查的聊天。点击查看详情。",
-            "checkTooltip": "重启后 Orca 未能恢复或未能确认已恢复的聊天。点击查看详情。"
+            "checkTooltip": "重启后 Orca 未能恢复或未能确认已恢复的聊天。点击查看详情。",
+            "resumingLabelOne": "正在恢复 1 个聊天",
+            "resumingLabel": "正在恢复 {{value0}} 个聊天",
+            "resumingAriaOne": "正在恢复 1 个聊天。点击查看详情。",
+            "resumingAria": "正在恢复 {{value0}} 个聊天。点击查看详情。",
+            "resumingTooltip": "正在恢复中断的聊天并请它们继续…"
           }
         }
       },
@@ -5204,7 +5226,9 @@
           "69969ba364": "正在发送...",
           "imageReadFailed": "无法读取附加的图片。请重新附加。",
           "attachWhileSending": "请等待当前反馈发送完成，再附加更多图片。",
-          "imagesNotDelivered": "反馈已发送，但无法确认图片已送达。"
+          "imagesNotDelivered": "反馈已发送，但无法确认图片已送达。",
+          "imagesNotIncluded": "反馈已发送。您的截图无法上传，未包含在内。",
+          "imagesRejected": "反馈已发送。您的截图过大，无法上传，未包含在内。"
         },
         "SidebarFilter": {
           "e3b3898218": "添加项目",
@@ -6164,7 +6188,8 @@
         },
         "SidebarFeedbackImageAttachments": {
           "attachImages": "Attach",
-          "removeImage": "Remove {{fileName}}"
+          "removeImage": "Remove {{fileName}}",
+          "screenshotsHint": "最多附加 {{count}} 张截图，总计 {{maxSize}}"
         },
         "WorkspaceKanbanSearchField": {
           "bdb753c78d": "没有匹配的工作区",
@@ -7814,8 +7839,7 @@
           "81057d5f71": "保存中...",
           "da37d6f10e": "复制",
           "3149964b66": "已复制",
-          "waitForSetupBeforeAgent": "等待设置完成后再启动智能体",
-          "waitForSetupBeforeAgentHelp": "如果设置会安装依赖、MCP 服务器或智能体启动时需要的配置文件，请开启此选项。"
+          "waitForSetupBeforeAgent": "等待设置完成后再启动智能体"
         },
         "RepositoryIconPicker": {
           "2b7d27b93c": "使用 {{value0}} 仓库颜色",
@@ -8863,7 +8887,18 @@
             "7e2a4b8c1d": "海外",
             "37020a02c2": "安慰",
             "25591bf95b": "粘贴完整的 opencode.ai Cookie 标头，包括 __Host-console_session，以进行速率限制提取。",
-            "d16378a88f": "极小极大"
+            "d16378a88f": "极小极大",
+            "cursor": {
+              "description": "从此电脑上已有的 Cursor 登录（cursor-agent login）读取每月套餐用量。",
+              "kw": {
+                "cursor": "cursor",
+                "rateLimit": "速率限制",
+                "spend": "支出",
+                "statusBar": "状态栏",
+                "usage": "用量"
+              },
+              "title": "Cursor 用量"
+            }
           }
         },
         "advanced": {
@@ -8919,6 +8954,9 @@
             "0d1c334987": "合盖",
             "ff8de8a2ad": "显示器",
             "0d752916f8": "钩子",
+            "agent-trust-trust": "信任",
+            "agent-trust-folder": "文件夹",
+            "agent-trust-worktree": "工作树",
             "6984d4291a": "状态",
             "13b20636a6": "等待",
             "8599603496": "完成",
@@ -9119,6 +9157,13 @@
               "close": "关闭",
               "notification": "通知区",
               "background": "背景"
+            },
+            "cursor": {
+              "description": "显示来自此电脑上 Cursor 登录的每月 Cursor 套餐用量。",
+              "kw": {
+                "cursor": "cursor"
+              },
+              "title": "Cursor 用量"
             }
           }
         },
@@ -10678,6 +10723,10 @@
           "7707c15abb": "智能体状态钩子",
           "a68a642835": "在 Orca 中显示工作中、等待中和完成状态。关闭后将移除 Orca 管理的钩子并停止重新安装。"
         },
+        "agent-workspace-trust-copy": {
+          "title": "Orca 启动智能体时信任该文件夹",
+          "description": "Orca 启动的智能体会跳过“Do you trust this folder?”提示，因此项目的智能体钩子和设置会立即运行。若关闭此项，每个智能体在某个文件夹中首次运行时都会询问。在你没有看着时运行的智能体（例如编排工作进程、自动化以及从手机启动的智能体）会停在该提问处等待，直到你在它们的终端中作答。已信任的文件夹仍保持信任。"
+        },
         "agent-generated-tab-title-copy": {
           "19ad21615a": "自动生成标签页标题",
           "b036c7a409": "根据第一个已知智能体提示词生成简短稳定的标签页名称。手动重命名始终优先。"
@@ -11992,6 +12041,31 @@
         "TerminalRenderingSection": {
           "6d4c55bacc": "内嵌图像",
           "fffab5890b": "使用 SIXEL、iTerm2 (IIP) 和 Kitty 图形协议直接在终端中显示图像。"
+        },
+        "CursorAccountsSection": {
+          "dashboardLink": "Cursor 仪表盘",
+          "expired": "登录已过期 — 请在运行 Orca 的电脑上执行 cursor-agent login，然后点击“刷新用量”。",
+          "loading": "加载中…",
+          "noAllowance": "Cursor 报告此账号没有可用额度。",
+          "planTotal": "套餐",
+          "refreshUsage": "刷新用量",
+          "resets": "{{when}}重置",
+          "signedIn": "已登录",
+          "signedInFrom": "已登录。Orca 读取存储在{{source}}中的会话。",
+          "signedInGeneric": "已登录。Orca 读取存储在此电脑上的 Cursor 会话。",
+          "signedOut": "在此电脑上未找到 Cursor 登录",
+          "signedOutHelp": "请使用 Cursor IDE 登录，或在终端中运行 cursor-agent login，然后在此点击“刷新用量”。",
+          "source": {
+            "cli": "Cursor CLI 认证文件",
+            "desktop": "Cursor IDE",
+            "keychain": "macOS 钥匙串（cursor-agent）"
+          },
+          "staleUsage": "上次已知用量 — 最近一次刷新失败：{{reason}}",
+          "subtitle": "显示来自此电脑上已有登录的每月 Cursor 套餐用量。Orca 仅读取，不会更改您的 Cursor 登录。",
+          "title": "Cursor",
+          "usageDescription": "Cursor 按两个随账单周期重置的额度池计费，用完后按需计费。",
+          "usageLabel": "用量",
+          "usageTitle": "每月套餐用量"
         }
       },
       "right": {
@@ -14796,6 +14870,7 @@
           "f1aa04b5cf": "这个文件",
           "8b87612461": "所有未发送的笔记"
         },
+        "diffCommentSaveFailed": "保存评论失败",
         "DiffSectionBody": {
           "35d6afb5be": "二进制文件已更改",
           "cef4cf0ff5": "重试",
@@ -14917,6 +14992,7 @@
           "notPython": "该文件不是 Python 解释器。",
           "interrupt": "中断",
           "restart": "重启内核",
+          "trustFirst": "请先运行一个单元格以信任此笔记本",
           "runAll": "全部运行",
           "clearAll": "清除所有输出",
           "notResponding": "无响应。请重启内核",
@@ -14932,7 +15008,22 @@
           "noPython": "在此电脑上未找到 Python。请从 [python.org](https://www.python.org/downloads/) 安装，然后重新运行单元格。",
           "kernelDied": "内核已停止。",
           "localOnly": "笔记本单元格只能针对此电脑上的文件运行。",
-          "pythonOnly": "Orca 中只能运行 Python 笔记本。"
+          "pythonOnly": "Orca 中只能运行 Python 笔记本。",
+          "commandCopied": "命令已复制",
+          "createVenv": "创建 .venv",
+          "createVenvItem": "创建虚拟环境…",
+          "createVenvTitle": "创建虚拟环境？",
+          "creatingButton": "正在创建…",
+          "creatingVenvDescription": "正在 {{folder}} 中创建 .venv 并安装 ipykernel。这可能需要一分钟。",
+          "creatingVenvTitle": "正在创建虚拟环境…",
+          "installingButton": "正在安装…",
+          "installingDescription": "正在使用 pip 将 ipykernel 安装到“{{env}}”。这可能需要一分钟。",
+          "installingTitle": "正在安装 ipykernel…",
+          "kernelCreatingVenv": "正在创建 .venv…",
+          "setupFailed": "操作失败。Python 输出：",
+          "tryAgain": "重试",
+          "useAnotherPython": "使用其他 Python…",
+          "venvDescription": "Orca 将基于“{{env}}”在 {{folder}} 中创建 .venv，安装 ipykernel，并在其中运行此笔记本。"
         },
         "MarkdownPreview": {
           "e4683f70c4": "取消",
@@ -15423,7 +15514,10 @@
             "2b3ce6d394": "取消",
             "e05063cfc1": "行 {{value0}}",
             "c845170b3b": "行 {{value0}}-{{value1}}",
-            "commentTooLarge": "评论过长，无法安全提交。"
+            "commentTooLarge": "评论过长，无法安全提交。",
+            "f6c449191e": "为AI添加注释",
+            "5fa4bfebaa": "添加备注",
+            "5e9b3d0c2e": "添加..."
           },
           "useDiffCommentDecorator": {
             "995fa28b50": "此注"
@@ -17155,6 +17249,13 @@
         "dispatchRejected": "代理拒绝了“continue”消息。请打开聊天并自行发送一条。",
         "unsupported": "此聊天无法由 Orca 恢复。请将其打开以查看停止位置。",
         "fallback": "Orca 无法恢复此聊天。请将其打开以手动继续。"
+      },
+      "web": {
+        "preloadApi": {
+          "cursorAccounts": {
+            "hostOnly": "Cursor 登录详情仅可在运行 Orca 的电脑上读取。"
+          }
+        }
       }
     },
     "i18n": {
@@ -17223,6 +17324,56 @@
   },
   "components": {
     "native-chat": {
+      "writeNotice": {
+        "notDoneReadHistory": "无法加载此聊天的历史记录。",
+        "notDoneSend": "您的消息未发送。",
+        "tryAgainComposerSend": "请重新发送。",
+        "notDoneStop": "智能体未停止。",
+        "notDoneStopTask": "后台任务未停止。",
+        "notDoneStopTasks": "后台任务未停止。",
+        "notDoneAnswer": "您的回答未发送。",
+        "notDoneOption": "设置未更改。",
+        "notDoneCommand": "命令未运行。",
+        "notDoneGoal": "目标未更改。",
+        "restartFailed": "智能体无法重新启动。",
+        "capacity": "Orca 在过去一天内收到的请求过多。",
+        "outcomeUnknown": "Orca 无法确认发生了什么。请查看聊天。",
+        "questionChanged": "此问题已被回答或已更改。",
+        "historyUnreadable": "Orca 无法读取此聊天的已保存历史记录。",
+        "historyUnusable": "无法加载此聊天。",
+        "historyUnavailable": "Orca 目前无法打开此聊天的历史记录。",
+        "unsupported": "运行此聊天的 Orca 不支持此操作。请更新 Orca 后重试。",
+        "unreachable": "Orca 无法连接到智能体。",
+        "recordFailed": "Orca 无法将其记录到此聊天的历史记录中。",
+        "conversationCleared": "此对话已被清除。",
+        "openCurrentConversation": "请打开当前对话以继续。",
+        "clearUnfinished": "上一次 /clear 未完成。",
+        "commandRunning": "/compact 或 /clear 仍在运行。",
+        "waitForCommand": "请等待 /compact 或 /clear 完成。",
+        "agentStarting": "智能体仍在启动。",
+        "waitForStart": "请等待智能体完成启动。",
+        "turnActive": "智能体仍在回复。",
+        "waitForTurn": "请等待智能体完成回复，或将其停止。",
+        "promptPending": "智能体正在等待您回答问题或审批。",
+        "answerFirst": "请先回答问题或审批。",
+        "backgroundTasksRunning": "后台任务仍在运行。",
+        "waitForBackgroundTasks": "请等待后台任务完成。",
+        "messagesUnsettled": "您之前发送的一条消息尚未确认。",
+        "settleEarlierMessage": "请等待之前的消息送达，或重试该消息。",
+        "optionRejected": "智能体未接受此设置。",
+        "goalsUnsupported": "此智能体不支持目标。",
+        "agentRefused": "智能体拒绝了此请求。",
+        "ownerUnproven": "Orca 尚未确认此聊天之前的智能体已停止。",
+        "reopenChat": "请重新打开聊天以再次检查。",
+        "terminalAgentHoldsChat": "此聊天仍在终端智能体中打开。",
+        "quitTerminalAgent": "请退出该智能体，以便在此处继续聊天。",
+        "hostReconciling": "Orca 重启后仍在检查此聊天。",
+        "waitMoment": "请稍候。",
+        "recordUnreadable": "Orca 无法读取此聊天的已保存状态。",
+        "chatNotFound": "运行此聊天的 Orca 没有此聊天的记录。",
+        "startNewChat": "请开始新的聊天以继续。",
+        "tryAgain": "请重试。"
+      },
       "composer": {
         "imageUnsupported": "此智能体不支持粘贴图片。",
         "send": "发送",
@@ -17363,9 +17514,9 @@
         "responding": "智能体正在回复",
         "working": "处理中…",
         "thinking": "思维",
-        "workingFor": "为 {{value0}} 工作",
-        "workedFor": "为 {{value0}} 工作",
-        "toggleDetails": "切换转弯详情"
+        "workingFor": "已工作 {{value0}}",
+        "workedFor": "工作了 {{value0}}",
+        "toggleDetails": "切换回合详情"
       },
       "jumpToLatest": "跳到最新消息",
       "toggle": {
@@ -17379,8 +17530,10 @@
         },
         "error": {
           "title": "无法加载对话",
-          "subtitle": "无法读取记录。请切回终端继续工作。"
+          "subtitle": "无法读取记录。请切回终端继续工作。",
+          "retryingSubtitle": "无法读取记录。Orca 会继续尝试加载。"
         },
+        "reconnecting": "正在重新连接此聊天…",
         "pairHost": "配对主机以查看智能体聊天记录。",
         "notAgent": {
           "title": "这里没有对话",
@@ -17505,6 +17658,7 @@
       "railEmptyMessage": "信息",
       "ask": {
         "awaiting": "等待用户输入：",
+        "awaitingUnnamed": "等待用户输入",
         "asked": "问：",
         "questionCount": "{{value0}} 问题"
       },
@@ -17528,7 +17682,9 @@
         "startedN": "启动 {{value0}} 子代理",
         "ranOne": "Ran 1 子代理",
         "ranN": "Ran {{value0}} 子代理",
-        "tokens": "{{value0}} 代币"
+        "tokens": "{{value0}} 代币",
+        "unnamed": "子代理",
+        "writtenBy": "由子代理 {{value0}} 输出"
       },
       "conversationCommand": {
         "pendingWork": "在使用此命令之前，请等待挂起的工作和消息完成。",
@@ -17904,10 +18060,10 @@
     },
     "cmd-j": {
       "paletteSessionAge": {
-        "minutes": "{{value0}}米",
-        "hours": "{{value0}}h",
-        "days": "{{value0}}d",
-        "underOneMinute": "<1m"
+        "minutes": "{{value0}}分",
+        "hours": "{{value0}}小时",
+        "days": "{{value0}}天",
+        "underOneMinute": "<1分钟"
       }
     },
     "settings": {
@@ -17927,6 +18083,9 @@
           }
         }
       }
+    },
+    "agentChildRow": {
+      "ended": "已结束"
     }
   },
   "dashboardPopout": {
@@ -18153,6 +18312,7 @@
       "needsInput": "需要输入",
       "working": "处理中",
       "stopped": "已停止",
+      "failed": "已失败",
       "finished": "已完成"
     }
   },
@@ -18185,6 +18345,52 @@
       "unassignedInstruction": "在焦点窗格中开始语音听写之前指定听写快捷方式。",
       "settingsInstruction": "随时更改模型、听写模式或快捷方式",
       "settingsLink": "设置 → 语音"
+    },
+    "sessionSearch": {
+      "ageHours": "2小时",
+      "ageMinutes": "12分钟",
+      "ageYesterday": "1天",
+      "agentsInstruction": "您的代理也可以搜索。让它“找到我们修复登录超时的那次会话”。",
+      "consentInstruction": "随时可在以下位置更改或关闭",
+      "continueInBackground": "在后台继续",
+      "demoHit1Age": "3天",
+      "demoHit1Snippet": "将 [[登录超时]] 延长至 30 秒，并在令牌刷新时添加了重试。",
+      "demoHit1Title": "修复不稳定的身份验证重定向",
+      "demoHit2Age": "1周",
+      "demoHit2Snippet": "为什么唤醒后 [[登录]] 页面在 [[超时]] 后卡住？",
+      "demoHit2Title": "睡眠后会话刷新",
+      "demoHit3Age": "2周",
+      "demoHit3Snippet": "添加了覆盖 [[登录超时]] 路径的端到端测试。",
+      "demoHit3Title": "身份验证端到端加固",
+      "demoHit4Age": "5天",
+      "demoHit4Snippet": "[[回滚]] 会先删除新索引，再恢复旧列。",
+      "demoHit4Title": "订单表迁移",
+      "demoHit5Age": "3周",
+      "demoHit5Snippet": "在重试之前，你能写一份 [[迁移]] [[回滚]] 计划吗？",
+      "demoHit5Title": "预发布部署失败",
+      "demoHit6Age": "1个月",
+      "demoHit6Snippet": "这里的每个 [[迁移]] 都是可逆的，除了枚举重命名。",
+      "demoHit6Title": "表结构评审记录",
+      "demoQuery": "登录超时",
+      "demoQuery2": "迁移回滚",
+      "demoRoleAssistant": "助手",
+      "demoRoleUser": "用户",
+      "enableFailed": "无法开启会话搜索。请重试。",
+      "indexingDescription": "Orca 正在读取您过去的代理会话记录，以便您可以搜索它们。这可能需要几分钟。",
+      "indexingTitle": "正在索引您的代理会话",
+      "progressStarting": "正在查找您的会话…",
+      "readyDescription": "现在可以通过会话内容找到此电脑上的每个代理会话。",
+      "readyTitle": "会话搜索已就绪",
+      "readyToast": "会话搜索已就绪",
+      "readyToastOpen": "打开",
+      "recent1Text": "将搜索入口移至“工作流程”下，并更新了测试。",
+      "recent1Title": "整理设置侧边栏",
+      "recent2Text": "更新依赖项并确保构建仍然通过。",
+      "recent2Title": "更新 lockfile",
+      "recent3Text": "这是按领域分组的记录初稿。",
+      "recent3Title": "发布说明草稿",
+      "settingsLink": "设置 → 代理会话搜索",
+      "startSearching": "开始搜索"
     }
   },
   "quickOpen": {
@@ -18298,5 +18504,63 @@
   },
   "common": {
     "retry": "重试"
+  },
+  "fileExplorer": {
+    "root": {
+      "label": "文件浏览器根目录",
+      "full": "仓库根目录",
+      "viewing": "当前视图：{{path}}",
+      "back": "返回 {{path}}",
+      "searchScope": "搜索范围：工作区文件",
+      "retry": "重试",
+      "omittedFiles": "稀疏检出中排除的文件不会被搜索。",
+      "viewOnly": "稀疏检出 · 更改视图不会更改已检出的文件。",
+      "sparseStatus": "稀疏检出",
+      "scopeDetails": "关于稀疏检出范围",
+      "scopeExplanation": "文件夹选择器只改变显示范围，不会改变检出的文件。仓库根目录视图也会显示根目录和上级文件夹中已检出的文件。",
+      "searchExplanation": "“名称”筛选当前查看的文件夹。“内容”搜索整个工作区。稀疏检出排除的文件不会被搜索。",
+      "findInFolder": "在 {{path}} 中查找",
+      "folderLoadError": "无法加载此文件夹：",
+      "emptyFolder": "此文件夹中没有文件"
+    }
+  },
+  "sparsePreset": {
+    "nameRequired": "请输入名称。",
+    "nameTooLong": "名称不能超过80个字符。",
+    "nameExists": "名为“{{name}}”的预设已存在。",
+    "name": "名称",
+    "namePlaceholder": "Web应用与共享UI",
+    "directories": "目录",
+    "pathHelp": "每行输入一个相对于仓库的目录。路径中的空格会保留。",
+    "coneHelp": "Git还会保留仓库根目录以及这些目录的父文件夹中的文件。",
+    "cancel": "取消",
+    "save": "保存预设",
+    "new": "新建稀疏检出预设",
+    "edit": "编辑稀疏检出预设",
+    "description": "选择新工作区要检出的文件夹。",
+    "saveFailed": "无法保存预设。请重试。",
+    "loading": "正在加载预设...",
+    "details": "会检出哪些文件？",
+    "finishEditing": "保存或取消预设后，即可继续创建工作区。",
+    "pathInstructions": "每行输入一个文件夹，使用相对于仓库根目录的路径。",
+    "retryLoad": "重试加载预设",
+    "fullCheckout": "完整检出",
+    "checkoutPreset": "检出预设",
+    "search": "查找预设…",
+    "noMatches": "没有匹配的预设。",
+    "allFiles": "仓库中的所有文件",
+    "editNamed": "编辑 {{name}}",
+    "addPath": "Add a folder",
+    "findPath": "Find a folder…",
+    "noPathMatches": "No folders found.",
+    "repositoryRoot": "Repository root",
+    "loadingPaths": "Reading folders…",
+    "pathsUnavailable": "Could not read this folder. Type the path instead.",
+    "pathAdded": "Added",
+    "openFolder": "Open {{name}}",
+    "findOrTypePath": "Find a folder, or type any path…",
+    "addTypedPath": "Add",
+    "noDirectories": "No folders added yet.",
+    "removePath": "Remove {{name}}"
   }
 }
diff --git a/src/renderer/src/i18n/notification-agent-status-locales.test.ts b/src/renderer/src/i18n/notification-agent-status-locales.test.ts
new file mode 100644
index 00000000000..47828fa580a
--- /dev/null
+++ b/src/renderer/src/i18n/notification-agent-status-locales.test.ts
@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'vitest'
+import en from './locales/en.json'
+import es from './locales/es.json'
+import fr from './locales/fr.json'
+import ja from './locales/ja.json'
+import ko from './locales/ko.json'
+import zh from './locales/zh.json'
+
+// Main words a notification from these keys with an English fallback, so a locale missing one
+// silently notifies in English; no other gate catches it.
+describe('notification agent status locales', () => {
+  it.each(Object.entries({ en, es, fr, ja, ko, zh }))(
+    '%s words every verdict',
+    (_locale, catalog) => {
+      const words = catalog.notifications.agentStatus
+      for (const key of ['needsInput', 'working', 'stopped', 'failed', 'finished'] as const) {
+        expect(words[key]).toEqual(expect.any(String))
+        expect(words[key].length).toBeGreaterThan(0)
+      }
+    }
+  )
+})
diff --git a/src/renderer/src/i18n/relative-duration-copy-localization.test.ts b/src/renderer/src/i18n/relative-duration-copy-localization.test.ts
new file mode 100644
index 00000000000..65e5175e639
--- /dev/null
+++ b/src/renderer/src/i18n/relative-duration-copy-localization.test.ts
@@ -0,0 +1,70 @@
+/**
+ * Guards the localized relative-duration copy for the Cmd+J session-age badge and the
+ * native-chat turn row. The English source values ("{{value0}}m/h/d", "Working for N") are
+ * ambiguous, so bootstrap re-translation rendered them as a metre (米), a location particle
+ * (で / 에서), or a French infinitive. These are the reviewed values.
+ */
+import { describe, expect, it } from 'vitest'
+import fr from './locales/fr.json'
+import ja from './locales/ja.json'
+import ko from './locales/ko.json'
+import zh from './locales/zh.json'
+
+const catalogs = { fr, ja, ko, zh } as const
+
+function isStringRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function getByPath(node: unknown, path: string): string | undefined {
+  let current: unknown = node
+  for (const key of path.split('.')) {
+    if (!isStringRecord(current)) {
+      return undefined
+    }
+    current = current[key]
+  }
+  return typeof current === 'string' ? current : undefined
+}
+
+type Locale = keyof typeof catalogs
+
+const AGE_PATHS = 'components.cmd-j.paletteSessionAge'
+const STATUS_PATHS = 'components.native-chat.status'
+
+const cases: [Locale, string, string][] = [
+  // Cmd+J session-age badge: the unit must be a real duration word, not a bare Latin "m/h/d".
+  ['zh', `${AGE_PATHS}.minutes`, '{{value0}}分'],
+  ['zh', `${AGE_PATHS}.hours`, '{{value0}}小时'],
+  ['zh', `${AGE_PATHS}.days`, '{{value0}}天'],
+  ['zh', `${AGE_PATHS}.underOneMinute`, '<1分钟'],
+  ['ja', `${AGE_PATHS}.hours`, '{{value0}}時間'],
+  ['ja', `${AGE_PATHS}.days`, '{{value0}}日'],
+  ['ja', `${AGE_PATHS}.underOneMinute`, '<1分'],
+  ['ko', `${AGE_PATHS}.minutes`, '{{value0}}분'],
+  ['ko', `${AGE_PATHS}.hours`, '{{value0}}시간'],
+  ['ko', `${AGE_PATHS}.days`, '{{value0}}일'],
+  // Native-chat turn row: elapsed time, not a recipient — "working/worked for <duration>",
+  // never the location reading ("works at/for N").
+  ['zh', `${STATUS_PATHS}.workingFor`, '已工作 {{value0}}'],
+  ['zh', `${STATUS_PATHS}.workedFor`, '工作了 {{value0}}'],
+  ['ja', `${STATUS_PATHS}.workingFor`, '{{value0}} 処理中'],
+  ['ja', `${STATUS_PATHS}.workedFor`, '{{value0}} で完了'],
+  ['ko', `${STATUS_PATHS}.workingFor`, '{{value0}} 작업 중'],
+  ['ko', `${STATUS_PATHS}.workedFor`, '{{value0}} 작업 완료'],
+  ['fr', `${STATUS_PATHS}.workingFor`, 'En cours depuis {{value0}}'],
+  ['fr', `${STATUS_PATHS}.workedFor`, 'A travaillé pendant {{value0}}'],
+  // "turn" is a conversation turn (回合 / 턴 / tour), not a road turn (转弯 / 회전 / virage).
+  ['zh', `${STATUS_PATHS}.toggleDetails`, '切换回合详情'],
+  ['ko', `${STATUS_PATHS}.toggleDetails`, '턴 세부정보 전환'],
+  ['fr', `${STATUS_PATHS}.toggleDetails`, 'Basculer les détails du tour'],
+  // Workspace-cleanup durations keep the day unit localized too.
+  ['ja', 'components.workspace.cleanup.browse.chip.idleDays', 'アイドル {{value0}}日以上'],
+  ['ko', 'components.workspace.cleanup.relativeTime.daysAgo', '{{value0}}일 전']
+]
+
+describe('relative-duration copy localization', () => {
+  it.each(cases)('%s %s', (locale, path, expected) => {
+    expect(getByPath(catalogs[locale], path), path).toBe(expected)
+  })
+})
diff --git a/src/renderer/src/lib/activity-thread-display.test.ts b/src/renderer/src/lib/activity-thread-display.test.ts
index 03d5e788331..0f491dca0d5 100644
--- a/src/renderer/src/lib/activity-thread-display.test.ts
+++ b/src/renderer/src/lib/activity-thread-display.test.ts
@@ -203,6 +203,17 @@ describe('getActivityThreadStatusPreview', () => {
     ).toBe('Interrupted by user')
   })
 
+  it('surfaces a failed turn as failed, not as its last reply', () => {
+    expect(
+      getActivityThreadStatusPreview({
+        state: 'done',
+        lastAssistantMessage: 'Done!',
+        mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 1 },
+        prompt: 'Ship it'
+      })
+    ).toBe('Failed')
+  })
+
   it('names what a blocked approval is waiting on', () => {
     // Why: a permission request parks the row on 'waiting', and the tool fields are the
     // only thing that says what the user is being asked to approve (STA-3160).
diff --git a/src/renderer/src/lib/activity-thread-display.ts b/src/renderer/src/lib/activity-thread-display.ts
index c330edcb6f0..a4c81bc1a5d 100644
--- a/src/renderer/src/lib/activity-thread-display.ts
+++ b/src/renderer/src/lib/activity-thread-display.ts
@@ -11,6 +11,7 @@ import {
   orchestrationLabelsMatchLiveDispatch
 } from './agent-row-primary-text'
 import { formatAgentToolPreview } from './agent-row-tool-preview'
+import { agentVerdictDisplayMark } from '../../../shared/agent-main-agent-verdict'
 
 // Why: follow-up replies ("yes", "ok proceed") are valid hook prompts but are
 // terrible scan labels for a cross-worktree agent list — treat them as non-titles.
@@ -194,13 +195,18 @@ export function getActivityThreadStatusPreview(
     | 'lastAssistantMessage'
     | 'lastCompletedAssistantMessage'
     | 'interrupted'
+    | 'mainAgent'
     | 'prompt'
   >,
   agentState?: AgentStatusState | null
 ): string {
-  if (entry.interrupted === true) {
+  const verdictMark = agentVerdictDisplayMark(entry)
+  if (verdictMark === 'interrupted') {
     return 'Interrupted by user'
   }
+  if (verdictMark === 'failed') {
+    return 'Failed'
+  }
   const state = agentState ?? entry.state
   const toolPreview = formatAgentToolPreview(entry, state)
   if (toolPreview) {
@@ -228,6 +234,7 @@ export function resolveActivityThreadStatusPreview(
     | 'lastAssistantMessage'
     | 'lastCompletedAssistantMessage'
     | 'interrupted'
+    | 'mainAgent'
     | 'prompt'
   >,
   agentState: AgentStatusState | null | undefined,
diff --git a/src/renderer/src/lib/agent-background-session-test-state.ts b/src/renderer/src/lib/agent-background-session-test-state.ts
index 06f553ad72b..ee44a3ed7fd 100644
--- a/src/renderer/src/lib/agent-background-session-test-state.ts
+++ b/src/renderer/src/lib/agent-background-session-test-state.ts
@@ -188,7 +188,6 @@ export function stubAgentBackgroundSessionWindow(mocks: {
   spawn: TestMock
   write: TestMock
   kill: TestMock
-  markTrusted: TestMock
   runtimeEnvironmentCall: TestMock
   runtimeEnvironmentSubscribe: TestMock
 }): void {
@@ -196,7 +195,6 @@ export function stubAgentBackgroundSessionWindow(mocks: {
     dispatchEvent: mocks.dispatchEvent,
     api: {
       pty: { spawn: mocks.spawn, write: mocks.write, kill: mocks.kill },
-      agentTrust: { markTrusted: mocks.markTrusted },
       runtime: { call: vi.fn() },
       runtimeEnvironments: {
         call: mocks.runtimeEnvironmentCall,
@@ -215,7 +213,6 @@ export function resetAgentBackgroundSessionTestHarness(args: {
   spawn: TestMock
   write: TestMock
   kill: TestMock
-  markTrusted: TestMock
   dispatchEvent: TestMock
   getLaunchPlatform: TestMock
   runtimeCall: TestMock
@@ -267,7 +264,6 @@ export function resetAgentBackgroundSessionTestHarness(args: {
     spawn: args.spawn,
     write: args.write,
     kill: args.kill,
-    markTrusted: args.markTrusted,
     runtimeEnvironmentCall: args.runtimeTransportCall,
     runtimeEnvironmentSubscribe: args.runtimeSubscribe
   })
diff --git a/src/renderer/src/lib/agent-catalog-platform.ts b/src/renderer/src/lib/agent-catalog-platform.ts
new file mode 100644
index 00000000000..9a9eac351f0
--- /dev/null
+++ b/src/renderer/src/lib/agent-catalog-platform.ts
@@ -0,0 +1,13 @@
+export function getCatalogPlatform(): NodeJS.Platform {
+  const userAgent = typeof navigator === 'undefined' ? '' : navigator.userAgent
+  if (userAgent.includes('Windows')) {
+    return 'win32'
+  }
+  if (userAgent.includes('Mac')) {
+    return 'darwin'
+  }
+  if (userAgent) {
+    return 'linux'
+  }
+  return typeof process === 'undefined' ? 'linux' : process.platform
+}
diff --git a/src/renderer/src/lib/agent-catalog.tsx b/src/renderer/src/lib/agent-catalog.tsx
index 42c9baa7f6e..325d838552d 100644
--- a/src/renderer/src/lib/agent-catalog.tsx
+++ b/src/renderer/src/lib/agent-catalog.tsx
@@ -1,3 +1,4 @@
+import { getCatalogPlatform } from './agent-catalog-platform'
 import type React from 'react'
 import { ClaudeIcon, DroidIcon, OpenAIIcon } from '@/components/status-bar/icons'
 import openClaudeLogoUrl from '../../../../resources/openclaude-logo.png?url'
@@ -30,20 +31,6 @@ export type AgentCatalogEntry = {
   homepageUrl: string
 }
 
-function getCatalogPlatform(): NodeJS.Platform {
-  const userAgent = typeof navigator === 'undefined' ? '' : navigator.userAgent
-  if (userAgent.includes('Windows')) {
-    return 'win32'
-  }
-  if (userAgent.includes('Mac')) {
-    return 'darwin'
-  }
-  if (userAgent) {
-    return 'linux'
-  }
-  return typeof process === 'undefined' ? 'linux' : process.platform
-}
-
 export const getAgentCatalog = createLocalizedCatalog((): AgentCatalogEntry[] => [
   {
     id: 'claude',
@@ -127,6 +114,20 @@ export const getAgentCatalog = createLocalizedCatalog((): AgentCatalogEntry[] =>
     faviconDomain: 'dev.meta.ai',
     homepageUrl: 'https://dev.meta.ai/docs/muse-code'
   },
+  {
+    id: 'dsh',
+    label: translate('auto.lib.agent.catalog.dsh_label', 'DeepSeek Harness'),
+    cmd: 'dsh-tui',
+    searchAliases: ['deepseek', 'dsh', 'dst', 'deepseek harness'],
+    homepageUrl: 'https://deepseek-harness.github.io/deepseek-harness/'
+  },
+  {
+    id: 'qoder',
+    label: translate('auto.lib.agent.catalog.qoder_label', 'Qoder CLI'),
+    cmd: 'qodercli',
+    faviconDomain: 'qoder.com',
+    homepageUrl: 'https://docs.qoder.com/cli/overview'
+  },
   {
     id: 'zcode',
     label: translate('auto.lib.agent.catalog.zcode_label', 'ZCode'),
@@ -242,6 +243,13 @@ export const getAgentCatalog = createLocalizedCatalog((): AgentCatalogEntry[] =>
     faviconDomain: 'codebuff.com',
     homepageUrl: 'https://www.codebuff.com/docs/help/quick-start'
   },
+  {
+    id: 'freebuff',
+    label: translate('auto.lib.agent.catalog.freebuff_label', 'Freebuff'),
+    cmd: 'freebuff',
+    faviconDomain: 'freebuff.com',
+    homepageUrl: 'https://freebuff.com/cli'
+  },
   {
     id: 'command-code',
     label: translate('auto.lib.agent.catalog.6f8056a565', 'Command Code'),
@@ -328,6 +336,13 @@ export const getAgentCatalog = createLocalizedCatalog((): AgentCatalogEntry[] =>
     cmd: 'openclaw',
     faviconDomain: 'openclaw.ai',
     homepageUrl: 'https://github.com/openclaw/openclaw'
+  },
+  {
+    id: 'codebuddy',
+    label: translate('auto.lib.agent.catalog.codebuddy_label', 'CodeBuddy'),
+    cmd: 'codebuddy',
+    faviconDomain: 'codebuddy.ai',
+    homepageUrl: 'https://www.codebuddy.ai/cli'
   }
 ])
 
diff --git a/src/renderer/src/lib/agent-draft-paste-content.ts b/src/renderer/src/lib/agent-draft-paste-content.ts
index a76086b6790..19d5a30d275 100644
--- a/src/renderer/src/lib/agent-draft-paste-content.ts
+++ b/src/renderer/src/lib/agent-draft-paste-content.ts
@@ -12,6 +12,7 @@ import {
 } from '@/components/terminal-pane/terminal-bracketed-paste'
 import { runTerminalPtyInputTransaction } from '@/components/terminal-pane/terminal-pty-input-transaction'
 import { sendRuntimePtyInputVerified } from '@/runtime/runtime-terminal-inspection'
+import type { TerminalInputKind } from '../../../shared/terminal-input-kind'
 
 // Why: bracketed paste markers let supported TUIs treat generated prompt text
 // as one paste instead of echoing character-by-character or triggering edits.
@@ -29,10 +30,11 @@ export async function sendAgentDraftPasteContent(
   settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined,
   ptyId: string,
   content: string,
+  inputKind: TerminalInputKind,
   writePty?: AgentDraftPtyInputWriter
 ): Promise<boolean> {
   return await runTerminalPtyInputTransaction(ptyId, () =>
-    sendAgentDraftPasteContentNow(settings, ptyId, content, writePty)
+    sendAgentDraftPasteContentNow(settings, ptyId, content, inputKind, writePty)
   )
 }
 
@@ -42,6 +44,7 @@ export async function sendAgentDraftPasteContentNow(
   settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined,
   ptyId: string,
   content: string,
+  inputKind: TerminalInputKind,
   writePty?: AgentDraftPtyInputWriter
 ): Promise<boolean> {
   if (content.length > AGENT_DRAFT_PASTE_MAX_BYTES) {
@@ -57,6 +60,7 @@ export async function sendAgentDraftPasteContentNow(
       settings,
       ptyId,
       wrapTerminalBracketedPasteText(terminalContent),
+      inputKind,
       writePty
     )
   }
@@ -71,16 +75,16 @@ export async function sendAgentDraftPasteContentNow(
   for (const chunk of iterateAgentDraftPasteContentChunks(terminalContent)) {
     let accepted = false
     try {
-      accepted = await writeAgentDraftPtyInput(settings, ptyId, chunk, writePty)
+      accepted = await writeAgentDraftPtyInput(settings, ptyId, chunk, inputKind, writePty)
     } catch {
       if (bracketedPasteOpen && chunk !== BRACKETED_PASTE_END) {
-        await closeAgentDraftBracketedPaste(settings, ptyId, writePty)
+        await closeAgentDraftBracketedPaste(settings, ptyId, inputKind, writePty)
       }
       return false
     }
     if (!accepted) {
       if (bracketedPasteOpen && chunk !== BRACKETED_PASTE_END) {
-        await closeAgentDraftBracketedPaste(settings, ptyId, writePty)
+        await closeAgentDraftBracketedPaste(settings, ptyId, inputKind, writePty)
       }
       return false
     }
@@ -197,20 +201,24 @@ async function writeAgentDraftPtyInput(
   settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined,
   ptyId: string,
   data: string,
+  inputKind: TerminalInputKind,
   writePty?: AgentDraftPtyInputWriter
 ): Promise<boolean> {
-  return writePty ? await writePty(data) : await sendRuntimePtyInputVerified(settings, ptyId, data)
+  return writePty
+    ? await writePty(data)
+    : await sendRuntimePtyInputVerified(settings, ptyId, data, inputKind)
 }
 
 async function closeAgentDraftBracketedPaste(
   settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined,
   ptyId: string,
+  inputKind: TerminalInputKind,
   writePty?: AgentDraftPtyInputWriter
 ): Promise<void> {
   try {
     // Why: once the opener reached the PTY, a failed content chunk should not
     // leave the target TUI in bracketed-paste mode.
-    await writeAgentDraftPtyInput(settings, ptyId, BRACKETED_PASTE_END, writePty)
+    await writeAgentDraftPtyInput(settings, ptyId, BRACKETED_PASTE_END, inputKind, writePty)
   } catch {
     // The original write already failed; callers only need the paste to fail closed.
   }
diff --git a/src/renderer/src/lib/agent-favicon-assets.ts b/src/renderer/src/lib/agent-favicon-assets.ts
index 6c7221efe80..b041965736e 100644
--- a/src/renderer/src/lib/agent-favicon-assets.ts
+++ b/src/renderer/src/lib/agent-favicon-assets.ts
@@ -1,3 +1,4 @@
+import qoderUrl from '../../../shared/agent-icons/qoder.png?url'
 import type { TuiAgent } from '../../../shared/tui-agent'
 import grokUrl from '../../../shared/agent-icons/grok.png?url'
 import mimoCodeUrl from '../../../shared/agent-icons/mimo-code.png?url'
@@ -13,6 +14,7 @@ import crushUrl from '../../../shared/agent-icons/crush.png?url'
 import augUrl from '../../../shared/agent-icons/aug.png?url'
 import autohandUrl from '../../../shared/agent-icons/autohand.png?url'
 import clineUrl from '../../../shared/agent-icons/cline.png?url'
+import freebuffUrl from '../../../shared/agent-icons/freebuff.png?url'
 import codebuffUrl from '../../../shared/agent-icons/codebuff.png?url'
 import commandCodeUrl from '../../../shared/agent-icons/command-code.png?url'
 import continueUrl from '../../../shared/agent-icons/continue.png?url'
@@ -26,6 +28,7 @@ import devinUrl from '../../../shared/agent-icons/devin.png?url'
 import museUrl from '../../../shared/agent-icons/muse.png?url'
 import zcodeUrl from '../../../shared/agent-icons/zcode.png?url'
 import openclawUrl from '../../../shared/agent-icons/openclaw.png?url'
+import dshUrl from '../../../shared/agent-icons/dsh.png?url'
 
 // Why: these agents have no hand-authored SVG glyph, so previously their icons
 // loaded live from Google's favicon service. That service is unreachable in some
@@ -40,6 +43,7 @@ export const AGENT_FAVICON_ASSETS: Partial<Record<TuiAgent, string>> = {
   ante: anteUrl,
   trae: traeUrl,
   'prime-agent': primeAgentUrl,
+  qoder: qoderUrl,
   gemini: geminiUrl,
   antigravity: antigravityUrl,
   goose: gooseUrl,
@@ -50,6 +54,7 @@ export const AGENT_FAVICON_ASSETS: Partial<Record<TuiAgent, string>> = {
   autohand: autohandUrl,
   cline: clineUrl,
   codebuff: codebuffUrl,
+  freebuff: freebuffUrl,
   'command-code': commandCodeUrl,
   continue: continueUrl,
   cursor: cursorUrl,
@@ -60,6 +65,7 @@ export const AGENT_FAVICON_ASSETS: Partial<Record<TuiAgent, string>> = {
   hermes: hermesUrl,
   devin: devinUrl,
   muse: museUrl,
+  dsh: dshUrl,
   zcode: zcodeUrl,
   openclaw: openclawUrl
 }
diff --git a/src/renderer/src/lib/agent-followup-delivery.test.ts b/src/renderer/src/lib/agent-followup-delivery.test.ts
index 207c70ada36..48534cf8b06 100644
--- a/src/renderer/src/lib/agent-followup-delivery.test.ts
+++ b/src/renderer/src/lib/agent-followup-delivery.test.ts
@@ -49,7 +49,7 @@ describe('sendFollowupPromptWhenAgentReady — interpreter-wrapped agents', () =
       })
 
       expect(delivered).toBe(true)
-      expect(sendRuntimePtyInputVerified).toHaveBeenCalledWith(null, 'pty-1', 'ship it\r')
+      expect(sendRuntimePtyInputVerified).toHaveBeenCalledWith(null, 'pty-1', 'ship it\r', 'launch')
     })
 
     it(`still refuses to type into a bare ${agent} shell foreground`, async () => {
@@ -105,6 +105,6 @@ describe('sendFollowupPromptWhenAgentReady — interpreter-wrapped agents', () =
     })
 
     expect(delivered).toBe(true)
-    expect(sendRuntimePtyInputVerified).toHaveBeenCalledWith(null, 'pty-1', 'ship it\r')
+    expect(sendRuntimePtyInputVerified).toHaveBeenCalledWith(null, 'pty-1', 'ship it\r', 'launch')
   })
 })
diff --git a/src/renderer/src/lib/agent-followup-delivery.ts b/src/renderer/src/lib/agent-followup-delivery.ts
index bdcf0b4a92f..e520cb6df1f 100644
--- a/src/renderer/src/lib/agent-followup-delivery.ts
+++ b/src/renderer/src/lib/agent-followup-delivery.ts
@@ -22,7 +22,7 @@ export async function sendFollowupPromptWhenAgentReady(args: {
     return false
   }
   try {
-    return await sendRuntimePtyInputVerified(settings, ptyId, `${prompt}\r`)
+    return await sendRuntimePtyInputVerified(settings, ptyId, `${prompt}\r`, 'launch')
   } catch {
     return false
   }
diff --git a/src/renderer/src/lib/agent-hibernation-pane-eligibility.ts b/src/renderer/src/lib/agent-hibernation-pane-eligibility.ts
index bc55936fd24..0971402e872 100644
--- a/src/renderer/src/lib/agent-hibernation-pane-eligibility.ts
+++ b/src/renderer/src/lib/agent-hibernation-pane-eligibility.ts
@@ -5,6 +5,7 @@ import type { TerminalLayoutSnapshot, TerminalTab } from '../../../shared/termin
 import { parseRemoteRuntimePtyId } from '@/runtime/runtime-terminal-stream'
 import { lastInputBlocksHibernation } from './agent-hibernation-input-guard'
 import { isLiveResumeAnchorForCompletedAgent } from './live-resume-anchor-record'
+import { agentTurnEndedUncleanly } from '../../../shared/agent-main-agent-verdict'
 import type { AgentHibernationPlannerSnapshot } from './agent-hibernation-planner-snapshot'
 
 export type EligiblePane = {
@@ -89,7 +90,7 @@ export function getEligiblePane(args: {
   )
   if (
     entry.state !== 'done' ||
-    entry.interrupted === true ||
+    agentTurnEndedUncleanly(entry) ||
     Boolean(entry.subagents?.length) ||
     hasUnsettledOrUnknownDispatch(entry) ||
     (sleepingRecord && !hasOnlyLiveResumeAnchor)
diff --git a/src/renderer/src/lib/agent-hibernation-planner.test.ts b/src/renderer/src/lib/agent-hibernation-planner.test.ts
index 5be241004bb..79aa349d576 100644
--- a/src/renderer/src/lib/agent-hibernation-planner.test.ts
+++ b/src/renderer/src/lib/agent-hibernation-planner.test.ts
@@ -110,6 +110,21 @@ describe('agent sleep planner', () => {
     expect(
       plannedWorktrees(snapshot({ agentStatusByPaneKey: { [interrupted.paneKey]: interrupted } }))
     ).toEqual([])
+    // A failure ranks like a completion for attention, but a failed pane is never passive.
+    const failed = entry({ mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: OLD } })
+    expect(
+      plannedWorktrees(snapshot({ agentStatusByPaneKey: { [failed.paneKey]: failed } }))
+    ).toEqual([])
+    // A main agent that finished while its subagents still run is live work, whatever its verdict.
+    for (const outcome of ['success', 'failure'] as const) {
+      const held = entry({
+        state: 'working',
+        mainAgent: { state: 'done', outcome, stateStartedAt: OLD }
+      })
+      expect(
+        plannedWorktrees(snapshot({ agentStatusByPaneKey: { [held.paneKey]: held } }))
+      ).toEqual([])
+    }
     const noSession = entry({ providerSession: undefined })
     expect(
       plannedWorktrees(snapshot({ agentStatusByPaneKey: { [noSession.paneKey]: noSession } }))
diff --git a/src/renderer/src/lib/agent-launch-caller-profile-census.test.ts b/src/renderer/src/lib/agent-launch-caller-profile-census.test.ts
deleted file mode 100644
index 5a3dadedf83..00000000000
--- a/src/renderer/src/lib/agent-launch-caller-profile-census.test.ts
+++ /dev/null
@@ -1,90 +0,0 @@
-// Ties every caller profile back to the call site it characterizes. The behaviour files feed the
-// profiles through the real funnel; without this census a call site could change what it passes and
-// the behaviour files would keep happily pinning a shape nobody sends any more.
-
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-import { glob } from 'tinyglobby'
-import { AGENT_LAUNCH_CALLER_PROFILES } from './agent-launch-caller-profiles-test-harness'
-
-const REPO_ROOT = join(import.meta.dirname, '../../../..')
-const FUNNEL = 'src/renderer/src/lib/launch-agent-in-new-tab.ts'
-
-async function productionCallers(): Promise<string[]> {
-  const files = await glob(['src/**/*.ts', 'src/**/*.tsx'], {
-    cwd: REPO_ROOT,
-    ignore: ['**/*.test.ts', '**/*.test.tsx']
-  })
-  return files
-    .filter((file) => file !== FUNNEL)
-    .filter((file) => readFileSync(join(REPO_ROOT, file), 'utf8').includes('launchAgentInNewTab('))
-    .sort()
-}
-
-describe('agent launch caller profiles', () => {
-  it('covers every production call site of the funnel and no phantom one', async () => {
-    const profiled = AGENT_LAUNCH_CALLER_PROFILES.map((profile) => profile.caller).sort()
-
-    expect(profiled).toEqual(await productionCallers())
-  })
-
-  it('names each profile exactly once', () => {
-    const ids = AGENT_LAUNCH_CALLER_PROFILES.map((profile) => profile.id)
-
-    expect(new Set(ids).size).toBe(ids.length)
-    expect(ids.length).toBe(12)
-  })
-
-  it.each(AGENT_LAUNCH_CALLER_PROFILES.map((profile) => [profile.id, profile] as const))(
-    'keeps %s anchored to the arguments its call site still builds',
-    (_id, profile) => {
-      const source = readFileSync(join(REPO_ROOT, profile.caller), 'utf8')
-
-      // Why: a positive control on the instrument — an unreadable or renamed file would otherwise
-      // make every marker below vacuously "not found" and the assertion would just be noise.
-      expect(source).toContain('launchAgentInNewTab(')
-      expect(profile.sourceMarkers.length).toBeGreaterThan(0)
-      for (const marker of profile.sourceMarkers) {
-        expect(source).toContain(marker)
-      }
-    }
-  )
-
-  it.each(AGENT_LAUNCH_CALLER_PROFILES.map((profile) => [profile.id, profile] as const))(
-    'records whether %s installs launch callbacks, matching its source',
-    (_id, profile) => {
-      const source = readFileSync(join(REPO_ROOT, profile.caller), 'utf8')
-
-      expect(source.includes('beforeSurfaceOpen:')).toBe(profile.passesBeforeSurfaceOpen)
-      expect(source.includes('agentSessionLaunchPlan,')).toBe(profile.passesLaunchPlan)
-      expect(source.includes('onPromptDelivered')).toBe(profile.passesOnPromptDelivered)
-    }
-  )
-
-  it('pins which call sites read a tab id straight off the synchronous result', () => {
-    const readers = AGENT_LAUNCH_CALLER_PROFILES.filter((profile) =>
-      profile.readsBack.includes('surface-tab-id')
-    ).map((profile) => profile.id)
-
-    // Why: this is the coupling a move to an async launch RPC threatens most directly — these
-    // call sites cannot tolerate a tab id that only exists after the launch settles.
-    expect(readers.sort()).toEqual([
-      'fix-checks',
-      'floating-default-agent',
-      'quick-command',
-      'source-control-action',
-      'source-control-recovery',
-      'tab-bar-create-menu',
-      'tab-bar-quick-launch-button'
-    ])
-  })
-
-  it('pins which call sites await the prompt-delivery promise', () => {
-    const awaiters = AGENT_LAUNCH_CALLER_PROFILES.filter((profile) =>
-      profile.readsBack.includes('prompt-delivery-result')
-    ).map((profile) => profile.id)
-
-    expect(awaiters.sort()).toEqual(['session-continuation', 'source-control-action'])
-  })
-})
diff --git a/src/renderer/src/lib/agent-launch-caller-profiles-test-harness.ts b/src/renderer/src/lib/agent-launch-caller-profiles-test-harness.ts
index 39d7c77a13f..a988e1673f5 100644
--- a/src/renderer/src/lib/agent-launch-caller-profiles-test-harness.ts
+++ b/src/renderer/src/lib/agent-launch-caller-profiles-test-harness.ts
@@ -7,42 +7,23 @@ import type { LaunchAgentInNewTabArgs } from '@/lib/launch-agent-in-new-tab'
  * The suite feeds these argument shapes through the real funnel instead of driving twelve caller
  * module graphs: a migration rewrites the funnel's internals, not what a caller hands it, so the
  * observable outcome of each caller's argument shape is the thing that must survive.
- *
- * `sourceMarkers` re-anchors each profile to its call site. A caller that stops passing what the
- * profile encodes fails the census rather than silently drifting out of coverage.
  */
 export type CallerLaunchArgs = Omit<
   LaunchAgentInNewTabArgs,
   'beforeSurfaceOpen' | 'agentSessionLaunchPlan' | 'onPromptDelivered'
 >
 
-export type CallerResultRead =
-  | 'surface-tab-id'
-  | 'prompt-delivery-result'
-  | 'null-only'
-  | 'discarded'
-
 export type AgentLaunchCallerProfile = {
   /** Production module that owns this call site. */
   caller: string
   /** Stable id used in test titles so a dropped profile is visible in the report. */
   id: string
-  /** Literal fragments the call site must still contain for this profile to be current. */
-  sourceMarkers: readonly string[]
   /**
    * The argument object this call site builds. Values the call site derives at runtime (agent,
    * workspace, prompt text, group) use a representative stand-in; values it fixes as a literal are
    * reproduced exactly.
    */
   args: CallerLaunchArgs
-  /** The call site installs a `beforeSurfaceOpen` hook. */
-  passesBeforeSurfaceOpen: boolean
-  /** The call site hands in a route plan preflighted before the workspace existed. */
-  passesLaunchPlan: boolean
-  /** The call site installs an `onPromptDelivered` callback. */
-  passesOnPromptDelivered: boolean
-  /** What the call site reads off the synchronous result. */
-  readsBack: readonly CallerResultRead[]
 }
 
 const PROMPT = 'Explain the failing check and propose a fix.'
@@ -51,36 +32,30 @@ export const AGENT_LAUNCH_CALLER_PROFILES: readonly AgentLaunchCallerProfile[] =
   {
     id: 'dashboard-spawn',
     caller: 'src/renderer/src/components/dashboard/launch-dashboard-agent.ts',
-    sourceMarkers: ["launchSource: 'unknown'"],
-    args: { agent: 'codex', worktreeId: 'wt-1', launchSource: 'unknown' },
-    passesBeforeSurfaceOpen: false,
-    passesLaunchPlan: false,
-    passesOnPromptDelivered: false,
-    readsBack: ['null-only']
+    args: { agent: 'codex', worktreeId: 'wt-1', launchSource: 'unknown' }
+  },
+  {
+    id: 'empty-workspace-default-chat',
+    caller: 'src/renderer/src/lib/empty-workspace-default-agent-chat.ts',
+    args: {
+      agent: 'codex',
+      worktreeId: 'wt-1',
+      launchSource: 'unknown',
+      pendingActivationSpawn: true
+    }
   },
   {
     id: 'floating-default-agent',
     caller: 'src/renderer/src/components/floating-terminal/FloatingTerminalWindowControls.tsx',
-    sourceMarkers: ['worktreeId: FLOATING_TERMINAL_WORKTREE_ID', "launchSource: 'shortcut'"],
     args: {
       agent: 'codex',
       worktreeId: FLOATING_TERMINAL_WORKTREE_ID,
       launchSource: 'shortcut'
-    },
-    passesBeforeSurfaceOpen: false,
-    passesLaunchPlan: false,
-    passesOnPromptDelivered: false,
-    readsBack: ['surface-tab-id']
+    }
   },
   {
     id: 'source-control-action',
     caller: 'src/renderer/src/components/right-sidebar/runSourceControlAgentActionStart.ts',
-    sourceMarkers: [
-      'groupId: groupId ?? worktreeId',
-      'agentArgs: launchAgentArgs',
-      'promptDelivery,',
-      'launchPlatform,'
-    ],
     args: {
       agent: 'codex',
       worktreeId: 'wt-1',
@@ -91,21 +66,11 @@ export const AGENT_LAUNCH_CALLER_PROFILES: readonly AgentLaunchCallerProfile[] =
       launchPlatform: 'darwin',
       // Caller-supplied, not fixed at the call site: one representative value stands in.
       launchSource: 'sidebar'
-    },
-    passesBeforeSurfaceOpen: false,
-    passesLaunchPlan: false,
-    passesOnPromptDelivered: false,
-    readsBack: ['surface-tab-id', 'prompt-delivery-result']
+    }
   },
   {
     id: 'source-control-recovery',
     caller: 'src/renderer/src/components/right-sidebar/source-control/ai/recovery-launch.ts',
-    sourceMarkers: [
-      'groupId: activeGroupId ?? activeWorktreeId',
-      'agentArgs: savedRecipe.agentArgs',
-      "promptDelivery: 'submit-after-ready'",
-      "launchSource: 'source_control_recovery'"
-    ],
     args: {
       agent: 'codex',
       worktreeId: 'wt-1',
@@ -115,36 +80,22 @@ export const AGENT_LAUNCH_CALLER_PROFILES: readonly AgentLaunchCallerProfile[] =
       promptDelivery: 'submit-after-ready',
       launchPlatform: 'darwin',
       launchSource: 'source_control_recovery'
-    },
-    passesBeforeSurfaceOpen: false,
-    passesLaunchPlan: false,
-    passesOnPromptDelivered: false,
-    readsBack: ['surface-tab-id']
+    }
   },
   {
     id: 'git-history-explain-commit',
     caller:
       'src/renderer/src/components/right-sidebar/source-control/sync/use-git-history-commit-actions.ts',
-    sourceMarkers: ['prompt: explainPrompt', "promptDelivery: 'submit-after-ready'"],
     args: {
       agent: 'codex',
       worktreeId: 'wt-1',
       prompt: PROMPT,
       promptDelivery: 'submit-after-ready'
-    },
-    passesBeforeSurfaceOpen: false,
-    passesLaunchPlan: false,
-    passesOnPromptDelivered: false,
-    readsBack: ['discarded']
+    }
   },
   {
     id: 'tab-bar-quick-launch-button',
     caller: 'src/renderer/src/components/tab-bar/QuickLaunchButton.tsx',
-    sourceMarkers: [
-      '...(prompt !== undefined ? { prompt } : {})',
-      '...(promptDelivery !== undefined ? { promptDelivery } : {})',
-      '...(onPromptDelivered !== undefined ? { onPromptDelivered } : {})'
-    ],
     args: {
       agent: 'codex',
       worktreeId: 'wt-1',
@@ -152,36 +103,21 @@ export const AGENT_LAUNCH_CALLER_PROFILES: readonly AgentLaunchCallerProfile[] =
       prompt: PROMPT,
       promptDelivery: 'submit-after-ready',
       launchSource: 'tab_bar_quick_launch'
-    },
-    passesBeforeSurfaceOpen: false,
-    passesLaunchPlan: false,
-    passesOnPromptDelivered: true,
-    readsBack: ['surface-tab-id']
+    }
   },
   {
     id: 'tab-bar-create-menu',
     caller: 'src/renderer/src/components/tab-bar/use-tab-bar-create-menu-controller.ts',
-    sourceMarkers: ['groupId: resolvedGroupId', "launchSource: 'tab_bar_quick_launch'"],
     args: {
       agent: 'codex',
       worktreeId: 'wt-1',
       groupId: 'group-1',
       launchSource: 'tab_bar_quick_launch'
-    },
-    passesBeforeSurfaceOpen: false,
-    passesLaunchPlan: false,
-    passesOnPromptDelivered: false,
-    readsBack: ['surface-tab-id']
+    }
   },
   {
     id: 'terminal-session-fork',
     caller: 'src/renderer/src/components/terminal-pane/terminal-agent-session-fork.ts',
-    sourceMarkers: [
-      "promptDelivery: 'draft'",
-      "launchSource: 'terminal_context_menu'",
-      'agentSessionLaunchPlan,',
-      'beforeSurfaceOpen: (surface) =>'
-    ],
     args: {
       agent: 'codex',
       worktreeId: 'wt-1',
@@ -189,30 +125,16 @@ export const AGENT_LAUNCH_CALLER_PROFILES: readonly AgentLaunchCallerProfile[] =
       promptDelivery: 'draft',
       launchSource: 'terminal_context_menu',
       launchPlatform: 'darwin'
-    },
-    passesBeforeSurfaceOpen: true,
-    passesLaunchPlan: true,
-    passesOnPromptDelivered: false,
-    readsBack: ['null-only']
+    }
   },
   {
     id: 'terminal-create-shortcut',
     caller: 'src/renderer/src/components/use-terminal-create-actions.ts',
-    sourceMarkers: ['groupId: targetGroupId', "launchSource: 'shortcut'"],
-    args: { agent: 'codex', worktreeId: 'wt-1', groupId: 'group-1', launchSource: 'shortcut' },
-    passesBeforeSurfaceOpen: false,
-    passesLaunchPlan: false,
-    passesOnPromptDelivered: false,
-    readsBack: ['null-only']
+    args: { agent: 'codex', worktreeId: 'wt-1', groupId: 'group-1', launchSource: 'shortcut' }
   },
   {
     id: 'fix-checks',
     caller: 'src/renderer/src/lib/fix-checks-agent-launch.ts',
-    sourceMarkers: [
-      'agentArgs: recipe.agentArgs',
-      "promptDelivery: 'submit-after-ready'",
-      'beforeSurfaceOpen: () => {'
-    ],
     args: {
       agent: 'codex',
       worktreeId: 'wt-1',
@@ -223,19 +145,11 @@ export const AGENT_LAUNCH_CALLER_PROFILES: readonly AgentLaunchCallerProfile[] =
       launchPlatform: 'darwin',
       // Caller-supplied, not fixed at the call site: one representative value stands in.
       launchSource: 'task_page'
-    },
-    passesBeforeSurfaceOpen: true,
-    passesLaunchPlan: false,
-    passesOnPromptDelivered: false,
-    readsBack: ['surface-tab-id']
+    }
   },
   {
     id: 'session-continuation',
     caller: 'src/renderer/src/lib/launch-agent-session-continuation.ts',
-    sourceMarkers: [
-      "promptDelivery: agent === 'claude' ? 'draft' : 'submit-after-ready'",
-      'onPromptDelivered: () =>'
-    ],
     args: {
       agent: 'codex',
       worktreeId: 'wt-1',
@@ -245,20 +159,11 @@ export const AGENT_LAUNCH_CALLER_PROFILES: readonly AgentLaunchCallerProfile[] =
       initialCwd: '/repo/worktree/packages/app',
       // Caller-supplied, not fixed at the call site: one representative value stands in.
       launchSource: 'command_palette'
-    },
-    passesBeforeSurfaceOpen: false,
-    passesLaunchPlan: false,
-    passesOnPromptDelivered: true,
-    readsBack: ['prompt-delivery-result']
+    }
   },
   {
     id: 'quick-command',
     caller: 'src/renderer/src/lib/run-quick-command-in-new-tab.ts',
-    sourceMarkers: [
-      "launchSource: 'quick_command'",
-      'quickCommandLabel: command.label',
-      "{ promptDelivery: 'submit-after-ready' as const }"
-    ],
     args: {
       agent: 'codex',
       worktreeId: 'wt-1',
@@ -266,11 +171,7 @@ export const AGENT_LAUNCH_CALLER_PROFILES: readonly AgentLaunchCallerProfile[] =
       prompt: PROMPT,
       launchSource: 'quick_command',
       quickCommandLabel: 'Review'
-    },
-    passesBeforeSurfaceOpen: false,
-    passesLaunchPlan: false,
-    passesOnPromptDelivered: false,
-    readsBack: ['surface-tab-id']
+    }
   }
 ]
 
diff --git a/src/renderer/src/lib/agent-launch-routing-caller-census.test.ts b/src/renderer/src/lib/agent-launch-routing-caller-census.test.ts
deleted file mode 100644
index 3e91c5c8ec0..00000000000
--- a/src/renderer/src/lib/agent-launch-routing-caller-census.test.ts
+++ /dev/null
@@ -1,85 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-import { glob } from 'tinyglobby'
-
-const REPO_ROOT = join(import.meta.dirname, '../../../..')
-const CENSUS_FILE = 'src/renderer/src/lib/agent-launch-routing-caller-census.test.ts'
-
-const LAUNCH_AGENT_IN_NEW_TAB_CALLERS = [
-  'src/renderer/src/components/dashboard/launch-dashboard-agent.ts',
-  // Joined the funnel rather than appearing beside it: this button used to hand-roll the helper's
-  // terminal arm against `queueTabStartupCommand`. A line going up here is a converged bypass.
-  'src/renderer/src/components/floating-terminal/FloatingTerminalWindowControls.tsx',
-  'src/renderer/src/components/right-sidebar/runSourceControlAgentActionStart.ts',
-  'src/renderer/src/components/right-sidebar/source-control/ai/recovery-launch.ts',
-  'src/renderer/src/components/right-sidebar/source-control/sync/use-git-history-commit-actions.ts',
-  'src/renderer/src/components/tab-bar/QuickLaunchButton.tsx',
-  'src/renderer/src/components/tab-bar/use-tab-bar-create-menu-controller.ts',
-  'src/renderer/src/components/terminal-pane/terminal-agent-session-fork.ts',
-  'src/renderer/src/components/use-terminal-create-actions.ts',
-  'src/renderer/src/lib/fix-checks-agent-launch.ts',
-  'src/renderer/src/lib/launch-agent-session-continuation.ts',
-  'src/renderer/src/lib/run-quick-command-in-new-tab.ts'
-]
-
-// Why: the planner is the one production module that decides a route. A second resolver call
-// site is how the seven launch sites drifted apart before it existed.
-const ROUTE_RESOLVER_DEFINITION = 'src/renderer/src/lib/agent-launch-routing.ts'
-const ROUTE_PLANNER = 'src/renderer/src/lib/agent-session-launch-plan.ts'
-const DIRECT_ROUTE_RESOLVER_CALL = /\b(?:resolveAgentLaunchRoute|structuredAgentLaunchSupported)\(/
-// Why: adopting a verdict bypasses the resolver by design (a persisted quick-create request, a
-// resume whose gate already planned), so each adopter is pinned rather than trusted by convention.
-const VERDICT_ADOPTERS = [
-  'src/renderer/src/components/right-sidebar/ai-vault-session-resume-in-chat-launch.ts',
-  'src/renderer/src/lib/worktree-creation-structured-session.ts'
-]
-
-async function productionFiles(): Promise<string[]> {
-  return glob(['src/**/*.ts', 'src/**/*.tsx'], {
-    cwd: REPO_ROOT,
-    ignore: ['**/*.test.ts', '**/*.test.tsx', CENSUS_FILE]
-  })
-}
-
-describe('agent launch routing caller census', () => {
-  it('pins every production launchAgentInNewTab caller behind the shared funnel', async () => {
-    const callers = (await productionFiles())
-      .filter((file) => file !== 'src/renderer/src/lib/launch-agent-in-new-tab.ts')
-      .filter((file) =>
-        readFileSync(join(REPO_ROOT, file), 'utf8').includes('launchAgentInNewTab(')
-      )
-      .sort()
-    expect(callers).toEqual([...LAUNCH_AGENT_IN_NEW_TAB_CALLERS].sort())
-  })
-
-  it('lets only the planner decide a launch route', async () => {
-    const directCallers = (await productionFiles())
-      .filter((file) => file !== ROUTE_RESOLVER_DEFINITION)
-      .filter((file) =>
-        DIRECT_ROUTE_RESOLVER_CALL.test(readFileSync(join(REPO_ROOT, file), 'utf8'))
-      )
-      .sort()
-    expect(directCallers).toEqual([ROUTE_PLANNER])
-  })
-
-  it('pins every production adopter of a planned verdict', async () => {
-    const adopters = (await productionFiles())
-      .filter((file) => file !== ROUTE_PLANNER)
-      .filter((file) =>
-        readFileSync(join(REPO_ROOT, file), 'utf8').includes('adoptAgentSessionLaunchVerdict(')
-      )
-      .sort()
-    expect(adopters).toEqual([...VERDICT_ADOPTERS].sort())
-  })
-
-  it('keeps non-visible, resume, and floating launchers intentionally outside the route', () => {
-    for (const file of [
-      'src/renderer/src/lib/launch-agent-background-session.ts',
-      'src/renderer/src/lib/launch-ai-vault-session.ts',
-      'src/renderer/src/components/floating-terminal/FloatingTerminalWindowControls.tsx'
-    ]) {
-      expect(readFileSync(join(REPO_ROOT, file), 'utf8')).not.toContain('resolveAgentLaunchRoute')
-    }
-  })
-})
diff --git a/src/renderer/src/lib/agent-pane-activity-flags.ts b/src/renderer/src/lib/agent-pane-activity-flags.ts
new file mode 100644
index 00000000000..5298c840df9
--- /dev/null
+++ b/src/renderer/src/lib/agent-pane-activity-flags.ts
@@ -0,0 +1,38 @@
+import type { AgentStatusEntry } from '../../../shared/agent-status-types'
+import { agentVerdictDisplayMark } from '../../../shared/agent-main-agent-verdict'
+
+/** What fresh agent panes contribute to a container's status (worktree card, terminal tab). */
+export type AgentPaneActivityFlags = {
+  hasPermission: boolean
+  hasLiveWorking: boolean
+  hasLiveMonitoring: boolean
+  hasFailed: boolean
+  hasInterrupted: boolean
+  hasLiveDone: boolean
+}
+
+/** Fold one fresh pane's entry into its container's flags; `resolveWorktreeStatus` ranks them. */
+export function applyAgentPaneActivityFlags(
+  flags: AgentPaneActivityFlags,
+  entry: Pick<AgentStatusEntry, 'state' | 'workingMode' | 'interrupted' | 'mainAgent'>
+): void {
+  const mark = agentVerdictDisplayMark(entry)
+  if (entry.state === 'blocked' || entry.state === 'waiting') {
+    flags.hasPermission = true
+  }
+  // Why: a failed main agent outranks the live work its subagents hold, and it still counts
+  // beside a subagent's question so the failure shows once that is answered.
+  if (mark === 'failed') {
+    flags.hasFailed = true
+  } else if (mark === 'interrupted') {
+    flags.hasInterrupted = true
+  } else if (entry.state === 'working') {
+    if (entry.workingMode === 'monitoring') {
+      flags.hasLiveMonitoring = true
+    } else {
+      flags.hasLiveWorking = true
+    }
+  } else if (entry.state === 'done') {
+    flags.hasLiveDone = true
+  }
+}
diff --git a/src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts b/src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts
index 5b763aa5c6d..84ad14770d1 100644
--- a/src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts
+++ b/src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts
@@ -105,7 +105,12 @@ describe('post-paste submit retry Enter', () => {
 
     await expect(promise).resolves.toBe(true)
     expect(enterWrites()).toHaveLength(2)
-    expect(testState.sendRuntimePtyInputVerified).toHaveBeenLastCalledWith({}, 'pty-1', '\r')
+    expect(testState.sendRuntimePtyInputVerified).toHaveBeenLastCalledWith(
+      {},
+      'pty-1',
+      '\r',
+      'launch'
+    )
     expect(vi.getTimerCount()).toBe(0)
   })
 
@@ -143,7 +148,8 @@ describe('post-paste submit retry Enter', () => {
     const competing = sendAgentDraftPasteContent(
       {},
       'pty-1',
-      'y'.repeat(AGENT_DRAFT_PASTE_DIRECT_MAX_BYTES + 1)
+      'y'.repeat(AGENT_DRAFT_PASTE_DIRECT_MAX_BYTES + 1),
+      'driving'
     )
     await flushMicrotasks(10)
     expect(writes).toEqual([PASTED_ISSUE_URL, '\r'])
diff --git a/src/renderer/src/lib/agent-paste-draft.test.ts b/src/renderer/src/lib/agent-paste-draft.test.ts
index fdcb76cf2ed..bb07fb58504 100644
--- a/src/renderer/src/lib/agent-paste-draft.test.ts
+++ b/src/renderer/src/lib/agent-paste-draft.test.ts
@@ -57,7 +57,9 @@ vi.mock('@/components/terminal-pane/pty-pre-handler-buffer', () => ({
 
 vi.mock('@/runtime/runtime-terminal-inspection', () => ({
   isRemoteRuntimePtyId: testState.isRemoteRuntimePtyId,
-  sendRuntimePtyInputVerified: testState.sendRuntimePtyInputVerified,
+  // Why drop the kind: this suite pins write shapes; startup-draft-input-kind.test.ts pins kinds.
+  sendRuntimePtyInputVerified: (settings: unknown, ptyId: string, data: string) =>
+    testState.sendRuntimePtyInputVerified(settings, ptyId, data),
   inspectRuntimeTerminalProcess: testState.inspectRuntimeTerminalProcess
 }))
 
@@ -726,7 +728,8 @@ describe('pasteDraftWhenAgentReady', () => {
     const competing = sendAgentDraftPasteContent(
       {},
       'pty-1',
-      'y'.repeat(AGENT_DRAFT_PASTE_DIRECT_MAX_BYTES + 1)
+      'y'.repeat(AGENT_DRAFT_PASTE_DIRECT_MAX_BYTES + 1),
+      'driving'
     )
     await flushMicrotasks(10)
     expect(writes).toEqual([PASTED_ISSUE_URL])
@@ -902,7 +905,7 @@ describe('pasteDraftWhenAgentReady', () => {
 
   it('yields during large accepted-size preflight before writing agent draft chunks', async () => {
     const content = 'x'.repeat(AGENT_DRAFT_PASTE_DIRECT_MAX_BYTES + 300 * 1024)
-    const promise = sendAgentDraftPasteContent({}, 'pty-1', content)
+    const promise = sendAgentDraftPasteContent({}, 'pty-1', content, 'driving')
 
     await flushMicrotasks(5)
     expect(testState.sendRuntimePtyInputVerified).not.toHaveBeenCalled()
@@ -915,9 +918,9 @@ describe('pasteDraftWhenAgentReady', () => {
   })
 
   it('rejects oversized agent drafts before any PTY write', async () => {
-    await expect(
-      sendAgentDraftPasteContent({}, 'pty-1', 'x'.repeat(AGENT_DRAFT_PASTE_MAX_BYTES + 1))
-    ).resolves.toBe(false)
+    const oversized = 'x'.repeat(AGENT_DRAFT_PASTE_MAX_BYTES + 1)
+    const result = sendAgentDraftPasteContent({}, 'pty-1', oversized, 'driving')
+    await expect(result).resolves.toBe(false)
 
     expect(testState.sendRuntimePtyInputVerified).not.toHaveBeenCalled()
   })
diff --git a/src/renderer/src/lib/agent-paste-draft.ts b/src/renderer/src/lib/agent-paste-draft.ts
index a260d6bee18..feca855338a 100644
--- a/src/renderer/src/lib/agent-paste-draft.ts
+++ b/src/renderer/src/lib/agent-paste-draft.ts
@@ -1,5 +1,6 @@
 import type { GlobalSettings } from '../../../shared/global-settings-types'
 import type { TuiAgent } from '../../../shared/tui-agent'
+import type { TerminalInputKind } from '../../../shared/terminal-input-kind'
 import { TUI_AGENT_CONFIG } from '../../../shared/tui-agent-config'
 import { resolveDraftPasteReadyTimeoutMs } from '../../../shared/draft-paste-ready-timeout'
 import { useAppStore } from '@/store'
@@ -136,7 +137,9 @@ export async function pasteDraftWhenAgentReady(args: {
     ptyId,
     content,
     submit: submit === true,
-    agent
+    agent,
+    // Why launch: this delivers the prompt or draft an agent is started with.
+    inputKind: 'launch'
   })
 }
 
@@ -188,7 +191,9 @@ export async function pasteDraftToAgentPtyWhenReady(args: {
     ptyId,
     content,
     submit: submit === true,
-    agent
+    agent,
+    // Why launch: this delivers the prompt or draft an agent is started with.
+    inputKind: 'launch'
   })
 }
 
@@ -201,7 +206,8 @@ export async function submitPromptToAgentPty(args: {
     settings: getSettingsForAgentTabRuntimeOwner(args.tabId),
     ptyId: args.ptyId,
     content: args.content,
-    submit: true
+    submit: true,
+    inputKind: 'driving'
   })
 }
 
@@ -209,7 +215,7 @@ export async function sendBracketedPasteToRunningAgent(args: {
   ptyId: string
   content: string
 }): Promise<boolean> {
-  return await sendBracketedPasteToAgent({ ptyId: args.ptyId, content: args.content, submit: true })
+  return await sendBracketedPasteToAgent({ ...args, submit: true, inputKind: 'driving' })
 }
 
 async function sendBracketedPasteToAgent(args: {
@@ -218,14 +224,16 @@ async function sendBracketedPasteToAgent(args: {
   content: string
   submit: boolean
   agent?: TuiAgent
+  inputKind: TerminalInputKind
 }): Promise<boolean> {
   const { settings = useAppStore.getState().settings, ptyId, content, submit, agent } = args
+  const { inputKind } = args
   const submitRetryDelayMs = agent ? TUI_AGENT_CONFIG[agent]?.submitRetryDelayMs : undefined
   try {
     // Why: paste + Enter (+ retry Enter) must be one transaction, or a concurrent
     // paste on this PTY can slip between them and submit a half-written prompt.
     return await runTerminalPtyInputTransaction(ptyId, async () => {
-      const pasted = await sendAgentDraftPasteContentNow(settings, ptyId, content)
+      const pasted = await sendAgentDraftPasteContentNow(settings, ptyId, content, inputKind)
       if (!pasted || !submit) {
         return pasted
       }
@@ -234,14 +242,14 @@ async function sendBracketedPasteToAgent(args: {
       // Enter arrive in the same PTY write. Split the submit into the next turn so
       // the TUI processes bracketed-paste termination before handling Enter.
       await new Promise<void>((resolve) => window.setTimeout(resolve, POST_PASTE_SUBMIT_DELAY_MS))
-      const submitted = await sendRuntimePtyInputVerified(settings, ptyId, '\r')
+      const submitted = await sendRuntimePtyInputVerified(settings, ptyId, '\r', inputKind)
 
       if (submitRetryDelayMs !== undefined) {
         // Why: agents that render their composer before Enter is live silently eat
         // the first Enter; the retry is best-effort and never downgrades `submitted`.
         await new Promise<void>((resolve) => window.setTimeout(resolve, submitRetryDelayMs))
         try {
-          await sendRuntimePtyInputVerified(settings, ptyId, '\r')
+          await sendRuntimePtyInputVerified(settings, ptyId, '\r', inputKind)
         } catch {
           // Why: a rejected retry leaves the first Enter's verdict untouched.
         }
diff --git a/src/renderer/src/lib/agent-picker-search.test.ts b/src/renderer/src/lib/agent-picker-search.test.ts
index 12fe441103f..caff18e5c67 100644
--- a/src/renderer/src/lib/agent-picker-search.test.ts
+++ b/src/renderer/src/lib/agent-picker-search.test.ts
@@ -3,7 +3,6 @@ import {
   AGENT_PICKER_QUERY_MAX_BYTES,
   agentPickerBlankTerminalMatches,
   getAgentPickerCommandValue,
-  isAgentPickerQueryTooLarge,
   searchAgentPickerEntries
 } from './agent-picker-search'
 import { AGENT_CATALOG, type AgentCatalogEntry } from './agent-catalog'
@@ -94,7 +93,6 @@ describe('agent picker search', () => {
       }
     ] as AgentCatalogEntry[]
 
-    expect(isAgentPickerQueryTooLarge(oversizedQuery)).toBe(true)
     expect(searchAgentPickerEntries(throwingAgents, oversizedQuery)).toEqual([])
     expect(agentPickerBlankTerminalMatches(oversizedQuery)).toBe(false)
     expect(
diff --git a/src/renderer/src/lib/agent-picker-search.ts b/src/renderer/src/lib/agent-picker-search.ts
index 38c368f3d73..24ee2896742 100644
--- a/src/renderer/src/lib/agent-picker-search.ts
+++ b/src/renderer/src/lib/agent-picker-search.ts
@@ -10,7 +10,7 @@ type RankedAgent = {
 const NO_MATCH = Number.POSITIVE_INFINITY
 export const AGENT_PICKER_QUERY_MAX_BYTES = 2 * 1024
 
-export function isAgentPickerQueryTooLarge(
+function isAgentPickerQueryTooLarge(
   query: string,
   maxBytes = AGENT_PICKER_QUERY_MAX_BYTES
 ): boolean {
diff --git a/src/renderer/src/lib/agent-row-dot-state.ts b/src/renderer/src/lib/agent-row-dot-state.ts
index 79c0d7c198c..bf2b7b1e532 100644
--- a/src/renderer/src/lib/agent-row-dot-state.ts
+++ b/src/renderer/src/lib/agent-row-dot-state.ts
@@ -1,5 +1,7 @@
 import type { AgentDotState } from '@/components/AgentStateDot'
-import type { AgentWorkingMode } from '../../../shared/agent-status-types'
+import type { AgentChildRowModel } from '../../../shared/agent-child-row-model'
+import { agentVerdictDisplayMark } from '../../../shared/agent-main-agent-verdict'
+import type { AgentStatusEntry, AgentWorkingMode } from '../../../shared/agent-status-types'
 import type { AgentRowState } from './agent-row-decay-state'
 
 /**
@@ -22,3 +24,20 @@ export function agentRowDotState(
   }
   return 'idle'
 }
+
+/**
+ * The dot an agent row renders: a child row's own, else the main agent's verdict (a stop or a
+ * failure, which a failure shows even while subagents still run), else its state.
+ */
+export function agentRowDisplayDotState(agent: {
+  state: AgentRowState
+  entry: Pick<AgentStatusEntry, 'state' | 'interrupted' | 'mainAgent' | 'workingMode'>
+  childRow?: Pick<AgentChildRowModel, 'displayState'>
+}): AgentDotState {
+  if (agent.childRow) {
+    return agent.childRow.displayState
+  }
+  return (
+    agentVerdictDisplayMark(agent.entry) ?? agentRowDotState(agent.state, agent.entry.workingMode)
+  )
+}
diff --git a/src/renderer/src/lib/agent-status.ts b/src/renderer/src/lib/agent-status.ts
index acf7d7cbd53..04ecd728541 100644
--- a/src/renderer/src/lib/agent-status.ts
+++ b/src/renderer/src/lib/agent-status.ts
@@ -100,6 +100,7 @@ export { formatAgentTypeLabel } from '../../../shared/agent-type-label'
 const ICONABLE_AGENT_TYPES: Record<TuiAgent, true> = {
   claude: true,
   'claude-agent-teams': true,
+  codebuddy: true,
   openclaude: true,
   codex: true,
   autohand: true,
@@ -109,6 +110,7 @@ const ICONABLE_AGENT_TYPES: Record<TuiAgent, true> = {
   pi: true,
   omp: true,
   'prime-agent': true,
+  qoder: true,
   gemini: true,
   antigravity: true,
   aider: true,
@@ -120,6 +122,7 @@ const ICONABLE_AGENT_TYPES: Record<TuiAgent, true> = {
   aug: true,
   cline: true,
   codebuff: true,
+  freebuff: true,
   'command-code': true,
   continue: true,
   cursor: true,
@@ -136,7 +139,8 @@ const ICONABLE_AGENT_TYPES: Record<TuiAgent, true> = {
   ante: true,
   trae: true,
   muse: true,
-  zcode: true
+  zcode: true,
+  dsh: true
 }
 
 // Why: return null (not a 'claude' fallback) for unknown so Codex panes don't flash the Claude icon before the hook fires.
diff --git a/src/renderer/src/lib/agent-trust-preflight.test.ts b/src/renderer/src/lib/agent-trust-preflight.test.ts
deleted file mode 100644
index 151c51fbdac..00000000000
--- a/src/renderer/src/lib/agent-trust-preflight.test.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { preflightAgentTrust } from './agent-trust-preflight'
-
-const markTrusted = vi.fn()
-
-describe('preflightAgentTrust', () => {
-  beforeEach(() => {
-    markTrusted.mockReset().mockResolvedValue(undefined)
-    vi.stubGlobal('window', { api: { agentTrust: { markTrusted } } })
-  })
-
-  afterEach(() => vi.unstubAllGlobals())
-
-  it('marks a trust-gated agent with the host connection id', async () => {
-    await preflightAgentTrust({ agent: 'codex', workspacePath: '/repo/wt', connectionId: 'ssh-1' })
-
-    expect(markTrusted).toHaveBeenCalledWith({
-      preset: 'codex',
-      workspacePath: '/repo/wt',
-      connectionId: 'ssh-1'
-    })
-  })
-
-  it('omits a null connection id for local workspaces', async () => {
-    await preflightAgentTrust({ agent: 'codex', workspacePath: '/repo/wt', connectionId: null })
-
-    expect(markTrusted).toHaveBeenCalledWith({ preset: 'codex', workspacePath: '/repo/wt' })
-  })
-
-  it.each([
-    ['no agent', { agent: null, workspacePath: '/repo/wt' }],
-    ['no workspace path yet', { agent: 'codex' as const, workspacePath: null }],
-    ['an empty workspace path', { agent: 'codex' as const, workspacePath: '' }]
-  ])('skips the mark with %s', async (_label, args) => {
-    await preflightAgentTrust(args)
-
-    expect(markTrusted).not.toHaveBeenCalled()
-  })
-
-  it('skips agents without a trust preset', async () => {
-    await preflightAgentTrust({ agent: 'aider', workspacePath: '/repo/wt' })
-
-    expect(markTrusted).not.toHaveBeenCalled()
-  })
-
-  it('swallows a failed best-effort mark', async () => {
-    markTrusted.mockRejectedValue(new Error('offline'))
-
-    await expect(
-      preflightAgentTrust({ agent: 'codex', workspacePath: '/repo/wt' })
-    ).resolves.toBeUndefined()
-  })
-
-  it('is a no-op when the bridge is unavailable', async () => {
-    vi.stubGlobal('window', { api: {} })
-
-    await expect(
-      preflightAgentTrust({ agent: 'codex', workspacePath: '/repo/wt' })
-    ).resolves.toBeUndefined()
-  })
-})
diff --git a/src/renderer/src/lib/agent-trust-preflight.ts b/src/renderer/src/lib/agent-trust-preflight.ts
deleted file mode 100644
index d310d009cdc..00000000000
--- a/src/renderer/src/lib/agent-trust-preflight.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-import { TUI_AGENT_CONFIG } from '../../../shared/tui-agent-config'
-import type { TuiAgent } from '../../../shared/tui-agent'
-
-/** Silent best-effort mark; no prompt is shown. Trust-gated agents consume the
- *  first bracketed paste as menu input, so this runs before any prompt delivery. */
-export async function preflightAgentTrust(args: {
-  agent: TuiAgent | null | undefined
-  /** Folder and prospective workspaces can resolve to no path yet. */
-  workspacePath: string | null | undefined
-  connectionId?: string | null
-}): Promise<void> {
-  if (!args.agent || !args.workspacePath || !window.api.agentTrust?.markTrusted) {
-    return
-  }
-  const preset = TUI_AGENT_CONFIG[args.agent].preflightTrust
-  if (!preset) {
-    return
-  }
-  try {
-    await window.api.agentTrust.markTrusted({
-      preset,
-      workspacePath: args.workspacePath,
-      ...(args.connectionId ? { connectionId: args.connectionId } : {})
-    })
-  } catch {
-    // Best effort: the user can still dismiss the trust prompt manually.
-  }
-}
diff --git a/src/renderer/src/lib/ai-vault-resume-target.test.ts b/src/renderer/src/lib/ai-vault-resume-target.test.ts
index f7903f13000..b4ac2902ee9 100644
--- a/src/renderer/src/lib/ai-vault-resume-target.test.ts
+++ b/src/renderer/src/lib/ai-vault-resume-target.test.ts
@@ -4,10 +4,7 @@ import {
   canResumeAiVaultSessionOnTarget,
   getAiVaultResumeWorkspaceExecutionHostId,
   getAiVaultResumeRepoTargetStatus,
-  getAiVaultResumeWorktreeTargetStatus,
   getAiVaultResumeWorkspaceTargetStatus,
-  isSupportedAiVaultResumeRepo,
-  isUnsupportedAiVaultResumeRepo,
   isWslStoredAiVaultSessionFile
 } from './ai-vault-resume-target'
 import { folderWorkspaceKey } from '../../../shared/workspace-scope'
@@ -164,41 +161,6 @@ describe('ai vault resume target ownership', () => {
     expect(getAiVaultResumeRepoTargetStatus(null)).toBe('unknown')
   })
 
-  it('exposes boolean predicates for resume gates', () => {
-    expect(isSupportedAiVaultResumeRepo({ connectionId: null, executionHostId: 'local' })).toBe(
-      true
-    )
-    expect(isSupportedAiVaultResumeRepo({ connectionId: 'ssh-1', executionHostId: null })).toBe(
-      true
-    )
-    expect(
-      isSupportedAiVaultResumeRepo({ connectionId: null, executionHostId: 'runtime:env-1' })
-    ).toBe(true)
-    expect(
-      isUnsupportedAiVaultResumeRepo({ connectionId: null, executionHostId: 'runtime:env-1' })
-    ).toBe(false)
-  })
-
-  it('resolves runtime-owned worktree targets through their repo owner', () => {
-    expect(
-      getAiVaultResumeWorktreeTargetStatus({
-        worktreeId: 'repo-1::/repo/orca',
-        worktrees: [{ id: 'repo-1::/repo/orca', repoId: 'repo-1' }],
-        repos: [{ id: 'repo-1', connectionId: null, executionHostId: 'runtime:env-1' }]
-      })
-    ).toBe('runtime')
-  })
-
-  it('prefers explicit worktree host ownership over repo ownership', () => {
-    expect(
-      getAiVaultResumeWorktreeTargetStatus({
-        worktreeId: 'repo-1::/repo/orca',
-        worktrees: [{ id: 'repo-1::/repo/orca', repoId: 'repo-1', hostId: 'ssh:ssh-1' }],
-        repos: [{ id: 'repo-1', connectionId: null, executionHostId: 'runtime:env-1' }]
-      })
-    ).toBe('ssh')
-  })
-
   it('uses the composite worktree repo id when worktree discovery is incomplete', () => {
     expect(
       getAiVaultResumeWorkspaceTargetStatus(
diff --git a/src/renderer/src/lib/ai-vault-resume-target.ts b/src/renderer/src/lib/ai-vault-resume-target.ts
index fffc0c8c4bd..874bc7ae7b2 100644
--- a/src/renderer/src/lib/ai-vault-resume-target.ts
+++ b/src/renderer/src/lib/ai-vault-resume-target.ts
@@ -29,12 +29,6 @@ export function getAiVaultResumeRepoTargetStatus(
   return getAiVaultResumeExecutionHostTargetStatus(getRepoExecutionHostId(repo))
 }
 
-export function isSupportedAiVaultResumeRepo(
-  repo: AiVaultResumeRepoOwner | null | undefined
-): boolean {
-  return isSupportedAiVaultResumeTargetStatus(getAiVaultResumeRepoTargetStatus(repo))
-}
-
 export function isSupportedAiVaultResumeTargetStatus(status: AiVaultResumeTargetStatus): boolean {
   return status === 'local' || status === 'ssh' || status === 'runtime'
 }
@@ -91,34 +85,6 @@ export function canResumeAiVaultSessionOnTarget(args: {
   return true
 }
 
-export function isUnsupportedAiVaultResumeRepo(
-  repo: AiVaultResumeRepoOwner | null | undefined
-): boolean {
-  const status = getAiVaultResumeRepoTargetStatus(repo)
-  return status !== 'unknown' && !isSupportedAiVaultResumeTargetStatus(status)
-}
-
-export function getAiVaultResumeWorktreeTargetStatus(args: {
-  worktreeId: string | null
-  worktrees: readonly { id: string; repoId: string; hostId?: ExecutionHostId }[]
-  repos: readonly AiVaultResumeRepoOwnerWithId[]
-}): AiVaultResumeTargetStatus {
-  if (!args.worktreeId) {
-    return 'unknown'
-  }
-  const worktree = args.worktrees.find((candidate) => candidate.id === args.worktreeId)
-  if (!worktree) {
-    return 'unknown'
-  }
-  const worktreeHost = getAiVaultResumeExecutionHostTargetStatus(worktree.hostId)
-  if (worktreeHost !== 'unknown') {
-    return worktreeHost
-  }
-  return getAiVaultResumeRepoTargetStatus(
-    args.repos.find((candidate) => candidate.id === worktree.repoId)
-  )
-}
-
 export function getAiVaultResumeWorkspaceExecutionHostId(
   state: Pick<AppState, 'folderWorkspaces' | 'projectGroups' | 'repos' | 'worktreesByRepo'>,
   workspaceId: string | null
@@ -166,8 +132,6 @@ export function getAiVaultResumeWorkspaceTargetStatus(
   return getAiVaultResumeRepoTargetStatus(state.repos.find((repo) => repo.id === repoId))
 }
 
-type AiVaultResumeRepoOwnerWithId = AiVaultResumeRepoOwner & { id: string }
-
 function getAiVaultResumeFolderTargetStatus(
   state: Pick<AppState, 'folderWorkspaces' | 'projectGroups' | 'repos'>,
   folderWorkspaceId: string
diff --git a/src/renderer/src/lib/app-menu-paste.test.ts b/src/renderer/src/lib/app-menu-paste.test.ts
index 11a1282c874..3119213da74 100644
--- a/src/renderer/src/lib/app-menu-paste.test.ts
+++ b/src/renderer/src/lib/app-menu-paste.test.ts
@@ -4,11 +4,8 @@ import { afterEach, describe, expect, it, vi } from 'vitest'
 import {
   APP_MENU_PASTE_EVENT,
   dispatchAppMenuPasteEvent,
-  findFocusedAppMenuTextControlPasteTarget,
-  handleAppMenuPasteRequest,
-  shouldOwnAppMenuTextControlPaste
+  handleAppMenuPasteRequest
 } from './app-menu-paste'
-import { TEXT_CONTROL_PASTE_DIRECT_MAX_BYTES } from './text-control-paste'
 
 function appendTextarea(value = ''): HTMLTextAreaElement {
   const textarea = document.createElement('textarea')
@@ -208,40 +205,14 @@ describe('app menu paste', () => {
     expect(performNativePaste).not.toHaveBeenCalled()
   })
 
-  it('resolves only editable text controls for app-menu ownership', () => {
-    const textarea = appendTextarea()
-    const disabled = appendTextarea()
-    disabled.disabled = true
-    const colorInput = document.createElement('input')
-    colorInput.type = 'color'
-    document.body.appendChild(colorInput)
-
-    expect(findFocusedAppMenuTextControlPasteTarget(textarea)).toBe(textarea)
-    expect(findFocusedAppMenuTextControlPasteTarget(disabled)).toBeNull()
-    expect(findFocusedAppMenuTextControlPasteTarget(colorInput)).toBeNull()
-  })
-
-  it('exposes a cancellable ownership event and byte-threshold check', () => {
+  it('exposes a cancellable ownership event', () => {
     const onPaste = (event: Event): void => {
       event.preventDefault()
     }
     window.addEventListener(APP_MENU_PASTE_EVENT, onPaste)
 
     expect(dispatchAppMenuPasteEvent()).toBe(true)
-    expect(shouldOwnAppMenuTextControlPaste('small')).toBe(false)
-    expect(shouldOwnAppMenuTextControlPaste('x'.repeat(70 * 1024))).toBe(true)
 
     window.removeEventListener(APP_MENU_PASTE_EVENT, onPaste)
   })
-
-  it('bounds app-menu text-control ownership measuring at the direct-paste threshold', () => {
-    const codePointAt = vi.spyOn(String.prototype, 'codePointAt')
-    const text = 'x'.repeat(TEXT_CONTROL_PASTE_DIRECT_MAX_BYTES + 4_096)
-
-    expect(shouldOwnAppMenuTextControlPaste(text)).toBe(true)
-
-    expect(codePointAt.mock.calls.length).toBeLessThanOrEqual(
-      TEXT_CONTROL_PASTE_DIRECT_MAX_BYTES + 1
-    )
-  })
 })
diff --git a/src/renderer/src/lib/app-menu-paste.ts b/src/renderer/src/lib/app-menu-paste.ts
index 1ffd3205327..02e8fad7c22 100644
--- a/src/renderer/src/lib/app-menu-paste.ts
+++ b/src/renderer/src/lib/app-menu-paste.ts
@@ -4,10 +4,7 @@ import {
 } from '../../../shared/clipboard-text'
 import { TEXT_CONTROL_PASTE_MAX_BYTES, pasteTextIntoTextControl } from './text-control-paste'
 import { createTextControlRejectedResult } from './text-control-paste-diagnostics'
-import {
-  findOwnedTextControlPasteTarget,
-  shouldClaimTextControlPastePayload
-} from './text-control-paste-ownership'
+import { findOwnedTextControlPasteTarget } from './text-control-paste-ownership'
 
 export const APP_MENU_PASTE_EVENT = 'orca-app-menu-paste'
 
@@ -38,7 +35,7 @@ export function dispatchAppMenuPasteEvent(target: Window = window): boolean {
   return event.defaultPrevented
 }
 
-export function findFocusedAppMenuTextControlPasteTarget(
+function findFocusedAppMenuTextControlPasteTarget(
   activeElement: Element | null = typeof document === 'undefined' ? null : document.activeElement
 ): HTMLInputElement | HTMLTextAreaElement | null {
   return findOwnedTextControlPasteTarget(activeElement)
@@ -131,7 +128,3 @@ export async function handleAppMenuPasteRequest({
     redactedDiagnostic: result.redactedDiagnostic
   })
 }
-
-export function shouldOwnAppMenuTextControlPaste(text: string): boolean {
-  return shouldClaimTextControlPastePayload(text)
-}
diff --git a/src/renderer/src/lib/browser-uuid.ts b/src/renderer/src/lib/browser-uuid.ts
index 177d05f7ddb..017bfd13f74 100644
--- a/src/renderer/src/lib/browser-uuid.ts
+++ b/src/renderer/src/lib/browser-uuid.ts
@@ -1,28 +1,3 @@
-export function createBrowserUuid(): string {
-  const cryptoApi = globalThis.crypto
-  if (typeof cryptoApi?.randomUUID === 'function') {
-    return cryptoApi.randomUUID()
-  }
-
-  const bytes = new Uint8Array(16)
-  if (typeof cryptoApi?.getRandomValues === 'function') {
-    cryptoApi.getRandomValues(bytes)
-  } else {
-    // Why: LAN web clients can run in non-secure browser contexts where
-    // randomUUID is hidden. These are local UI IDs, not auth credentials.
-    for (let index = 0; index < bytes.length; index += 1) {
-      bytes[index] = Math.floor(Math.random() * 256)
-    }
-  }
-
-  bytes[6] = (bytes[6] & 0x0f) | 0x40
-  bytes[8] = (bytes[8] & 0x3f) | 0x80
-  return bytesToUuid(bytes)
-}
-
-function bytesToUuid(bytes: Uint8Array): string {
-  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0'))
-  return `${hex.slice(0, 4).join('')}-${hex.slice(4, 6).join('')}-${hex
-    .slice(6, 8)
-    .join('')}-${hex.slice(8, 10).join('')}-${hex.slice(10, 16).join('')}`
-}
+// Renderer-facing name for the shared generator. A re-export, so renderer code keeps one
+// obvious import and src/shared keeps the single implementation.
+export { createNonSecureContextUuid as createBrowserUuid } from '../../../shared/non-secure-context-uuid'
diff --git a/src/renderer/src/lib/browser-workspace-source-resolution.test.ts b/src/renderer/src/lib/browser-workspace-source-resolution.test.ts
new file mode 100644
index 00000000000..6dd57c668cf
--- /dev/null
+++ b/src/renderer/src/lib/browser-workspace-source-resolution.test.ts
@@ -0,0 +1,115 @@
+import { describe, expect, it } from 'vitest'
+import type { Tab, TabGroup } from '../../../shared/tab-types'
+import type { BrowserPage, BrowserWorkspace } from '../../../shared/browser-workspace-types'
+import { resolveBrowserSourceUnifiedTab } from './browser-workspace-source-resolution'
+
+const WT = 'wt-1'
+
+type ResolverState = Parameters<typeof resolveBrowserSourceUnifiedTab>[0]
+
+function wrapper(id: string, workspaceId: string, groupId = 'group-1'): Tab {
+  return {
+    id,
+    entityId: workspaceId,
+    groupId,
+    worktreeId: WT,
+    contentType: 'browser',
+    label: 'Example',
+    customLabel: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 1
+  }
+}
+
+function workspace(id: string): BrowserWorkspace {
+  return {
+    id,
+    worktreeId: WT,
+    activePageId: null,
+    pageIds: [],
+    url: 'about:blank',
+    title: '',
+    loading: false,
+    faviconUrl: null,
+    canGoBack: false,
+    canGoForward: false,
+    loadError: null,
+    createdAt: 1
+  }
+}
+
+function page(id: string, workspaceId: string): BrowserPage {
+  return {
+    id,
+    workspaceId,
+    worktreeId: WT,
+    url: 'about:blank',
+    title: '',
+    loading: false,
+    faviconUrl: null,
+    canGoBack: false,
+    canGoForward: false,
+    loadError: null,
+    createdAt: 1
+  }
+}
+
+function makeState(overrides: {
+  workspaces?: string[]
+  pages?: Record<string, string[]>
+  wrappers?: Tab[]
+  groups?: TabGroup[]
+}): ResolverState {
+  const workspaces = overrides.workspaces ?? ['ws-1']
+  const pages = overrides.pages ?? { 'ws-1': ['page-1'] }
+  const wrappers = overrides.wrappers ?? [wrapper('tab-1', 'ws-1')]
+  return {
+    browserTabsByWorktree: {
+      [WT]: workspaces.map(workspace)
+    },
+    browserPagesByWorkspace: Object.fromEntries(
+      Object.entries(pages).map(([workspaceId, ids]) => [
+        workspaceId,
+        ids.map((id) => page(id, workspaceId))
+      ])
+    ),
+    unifiedTabsByWorktree: { [WT]: wrappers },
+    groupsByWorktree: {
+      [WT]: overrides.groups ?? [
+        { id: 'group-1', worktreeId: WT, activeTabId: null, tabOrder: wrappers.map((t) => t.id) }
+      ]
+    }
+  }
+}
+
+describe('resolveBrowserSourceUnifiedTab', () => {
+  it('returns the unique live wrapper for a source page', () => {
+    expect(resolveBrowserSourceUnifiedTab(makeState({}), 'page-1', WT)?.id).toBe('tab-1')
+  })
+
+  it('stays inside the caller workspace', () => {
+    expect(resolveBrowserSourceUnifiedTab(makeState({}), 'page-1', 'wt-other')).toBeUndefined()
+  })
+
+  it('omits the anchor for ambiguous wrappers', () => {
+    const state = makeState({ wrappers: [wrapper('tab-1', 'ws-1'), wrapper('tab-2', 'ws-1')] })
+    expect(resolveBrowserSourceUnifiedTab(state, 'page-1', WT)).toBeUndefined()
+  })
+
+  it('omits the anchor when two workspaces claim the page', () => {
+    const state = makeState({
+      workspaces: ['ws-1', 'ws-2'],
+      pages: { 'ws-1': ['page-1'], 'ws-2': ['page-1'] }
+    })
+    expect(resolveBrowserSourceUnifiedTab(state, 'page-1', WT)).toBeUndefined()
+  })
+
+  it('omits the anchor for a closed page or a wrapper outside its group order', () => {
+    expect(resolveBrowserSourceUnifiedTab(makeState({}), 'closed-page', WT)).toBeUndefined()
+    const detached = makeState({
+      groups: [{ id: 'group-1', worktreeId: WT, activeTabId: null, tabOrder: [] }]
+    })
+    expect(resolveBrowserSourceUnifiedTab(detached, 'page-1', WT)).toBeUndefined()
+  })
+})
diff --git a/src/renderer/src/lib/browser-workspace-source-resolution.ts b/src/renderer/src/lib/browser-workspace-source-resolution.ts
index 9e10c6f7043..857f6f77270 100644
--- a/src/renderer/src/lib/browser-workspace-source-resolution.ts
+++ b/src/renderer/src/lib/browser-workspace-source-resolution.ts
@@ -1,3 +1,4 @@
+import type { Tab } from '../../../shared/tab-types'
 import type { AppState } from '../store/types'
 
 export type BrowserWorkspaceOwner = {
@@ -25,3 +26,39 @@ export function resolveBrowserWorkspaceOwner(
   }
   return null
 }
+
+/**
+ * The unified tab wrapping a source browser page. Anything but exactly one live wrapper in the
+ * caller's workspace is ambiguous, so the caller omits the source relationship.
+ */
+export function resolveBrowserSourceUnifiedTab(
+  state: Pick<
+    AppState,
+    | 'browserTabsByWorktree'
+    | 'browserPagesByWorkspace'
+    | 'unifiedTabsByWorktree'
+    | 'groupsByWorktree'
+  >,
+  sourcePageId: string,
+  worktreeId: string
+): Tab | undefined {
+  const owningWorkspaceIds = (state.browserTabsByWorktree[worktreeId] ?? [])
+    .filter((workspace) =>
+      (state.browserPagesByWorkspace[workspace.id] ?? []).some((page) => page.id === sourcePageId)
+    )
+    .map((workspace) => workspace.id)
+  if (owningWorkspaceIds.length !== 1) {
+    return undefined
+  }
+  const wrappers = (state.unifiedTabsByWorktree[worktreeId] ?? []).filter(
+    (tab) => tab.contentType === 'browser' && tab.entityId === owningWorkspaceIds[0]
+  )
+  if (wrappers.length !== 1) {
+    return undefined
+  }
+  const wrapper = wrappers[0]
+  const group = (state.groupsByWorktree[worktreeId] ?? []).find(
+    (candidate) => candidate.id === wrapper.groupId
+  )
+  return group?.tabOrder.includes(wrapper.id) ? wrapper : undefined
+}
diff --git a/src/renderer/src/lib/codex-session-restart.ts b/src/renderer/src/lib/codex-session-restart.ts
index c2f1119ca54..b2b4e07a22b 100644
--- a/src/renderer/src/lib/codex-session-restart.ts
+++ b/src/renderer/src/lib/codex-session-restart.ts
@@ -28,9 +28,9 @@ import type { TuiAgent } from '../../../shared/tui-agent'
 // Why: prompt integrations such as Starship can outlast the daemon's 300ms
 // Codex fast-path timeout; account restarts must wait until the shell accepts input.
 // Why launchAgent: pty:spawn runs the managed-auth readiness gate and Codex
-// launch prep (project trust pre-mark) only for launchAgent 'codex', so without
-// it a restart respawn could race the account handoff and record a launch
-// account the pane does not actually read.
+// launch prep only for launchAgent 'codex', so without it a restart respawn
+// could race the account handoff and record a launch account the pane does not
+// actually read.
 export const CODEX_ACCOUNT_RESTART_STARTUP = {
   command: 'codex',
   startupCommandDelivery: 'shell-ready',
diff --git a/src/renderer/src/lib/delayed-status.test.ts b/src/renderer/src/lib/delayed-status.test.ts
new file mode 100644
index 00000000000..11778a3d414
--- /dev/null
+++ b/src/renderer/src/lib/delayed-status.test.ts
@@ -0,0 +1,89 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createDelayedStatus, STATUS_MIN_VISIBLE_MS, type ShownStatus } from './delayed-status'
+
+const SHOW_DELAY_MS = 1_000
+
+function track() {
+  const changes: (ShownStatus<string> | null)[] = []
+  const status = createDelayedStatus<string>((shown) => changes.push(shown), {
+    showDelayMs: SHOW_DELAY_MS
+  })
+  return { status, changes }
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('createDelayedStatus', () => {
+  it('never shows a status that clears within the show delay', () => {
+    const { status, changes } = track()
+    status.update('a', 'starting')
+    vi.advanceTimersByTime(SHOW_DELAY_MS - 1)
+    status.update('a', null)
+    vi.advanceTimersByTime(SHOW_DELAY_MS * 2)
+    expect(changes).toEqual([])
+  })
+
+  it('shows a status that outlasts the show delay', () => {
+    const { status, changes } = track()
+    status.update('a', 'starting')
+    vi.advanceTimersByTime(SHOW_DELAY_MS)
+    expect(changes).toEqual([{ key: 'a', value: 'starting' }])
+  })
+
+  it('keeps a shown status up for the minimum visible time', () => {
+    const { status, changes } = track()
+    status.update('a', 'starting')
+    vi.advanceTimersByTime(SHOW_DELAY_MS)
+    status.update('a', null)
+    vi.advanceTimersByTime(STATUS_MIN_VISIBLE_MS - 1)
+    expect(changes).toEqual([{ key: 'a', value: 'starting' }])
+    vi.advanceTimersByTime(1)
+    expect(changes).toEqual([{ key: 'a', value: 'starting' }, null])
+  })
+
+  it('hides at once when the status clears after the minimum visible time', () => {
+    const { status, changes } = track()
+    status.update('a', 'starting')
+    vi.advanceTimersByTime(SHOW_DELAY_MS + STATUS_MIN_VISIBLE_MS)
+    status.update('a', null)
+    expect(changes).toEqual([{ key: 'a', value: 'starting' }, null])
+  })
+
+  it('restarts the show delay when an unkeyed status clears and returns during its hold', () => {
+    const { status, changes } = track()
+    status.update('a', 'starting')
+    vi.advanceTimersByTime(SHOW_DELAY_MS)
+    status.update('a', null)
+    vi.advanceTimersByTime(100)
+    status.update('a', 'starting')
+    expect(changes).toEqual([{ key: 'a', value: 'starting' }, null])
+    vi.advanceTimersByTime(SHOW_DELAY_MS - 1)
+    expect(changes).toHaveLength(2)
+    vi.advanceTimersByTime(1)
+    expect(changes.at(-1)).toEqual({ key: 'a', value: 'starting' })
+  })
+
+  it('drops the shown status at once for a new key, which waits its own delay', () => {
+    const { status, changes } = track()
+    status.update('a', 'starting')
+    vi.advanceTimersByTime(SHOW_DELAY_MS)
+    status.update('b', 'starting')
+    expect(changes).toEqual([{ key: 'a', value: 'starting' }, null])
+    vi.advanceTimersByTime(SHOW_DELAY_MS)
+    expect(changes.at(-1)).toEqual({ key: 'b', value: 'starting' })
+  })
+
+  it('does not show after dispose', () => {
+    const { status, changes } = track()
+    status.update('a', 'starting')
+    status.dispose()
+    vi.advanceTimersByTime(SHOW_DELAY_MS * 2)
+    expect(changes).toEqual([])
+  })
+})
diff --git a/src/renderer/src/lib/delayed-status.ts b/src/renderer/src/lib/delayed-status.ts
new file mode 100644
index 00000000000..8c388c966e4
--- /dev/null
+++ b/src/renderer/src/lib/delayed-status.ts
@@ -0,0 +1,92 @@
+/** How long a shown status stays up, so it cannot flash right at the show delay. */
+export const STATUS_MIN_VISIBLE_MS = 400
+
+/** The status a view should show, and the key it belongs to. */
+export type ShownStatus<A> = {
+  key: string
+  value: A
+}
+
+export type DelayedStatus<A> = {
+  /** Reports the real status for `key`. A new key drops the shown status at once. */
+  update: (key: string, value: A | null) => void
+  /** Cancels pending timers. A later `update` starts again from the real status. */
+  dispose: () => void
+}
+
+/**
+ * Turns a real status into the status a view shows. A status that clears within
+ * `showDelayMs` is never shown; a shown status stays for at least `minVisibleMs`.
+ * Values compare by identity, so use strings or other stable values.
+ */
+export function createDelayedStatus<A>(
+  onChange: (shown: ShownStatus<A> | null) => void,
+  options: { showDelayMs: number; minVisibleMs?: number }
+): DelayedStatus<A> {
+  const minVisibleMs = options.minVisibleMs ?? STATUS_MIN_VISIBLE_MS
+  let key = ''
+  let latest: A | null = null
+  let shown: A | null = null
+  // While hidden, this is the show delay. While shown, the minimum visible time.
+  let timer: ReturnType<typeof setTimeout> | undefined
+
+  const clearTimer = (): void => {
+    clearTimeout(timer)
+    timer = undefined
+  }
+  const hide = (): void => {
+    shown = null
+    onChange(null)
+  }
+  const show = (value: A): void => {
+    shown = value
+    onChange({ key, value })
+    clearTimer()
+    timer = setTimeout(() => {
+      timer = undefined
+      if (latest === null) {
+        hide()
+      }
+    }, minVisibleMs)
+  }
+
+  return {
+    update: (nextKey, value) => {
+      if (nextKey !== key) {
+        key = nextKey
+        clearTimer()
+        if (shown !== null) {
+          hide()
+        }
+      }
+      if (shown !== null && latest === null && value !== null) {
+        clearTimer()
+        hide()
+      }
+      latest = value
+
+      if (shown === null) {
+        if (value === null) {
+          clearTimer()
+        } else if (timer === undefined) {
+          timer = setTimeout(() => {
+            timer = undefined
+            if (latest !== null) {
+              show(latest)
+            }
+          }, options.showDelayMs)
+        }
+        return
+      }
+
+      if (value !== null) {
+        if (value !== shown) {
+          show(value)
+        }
+      } else if (timer === undefined) {
+        hide()
+      }
+    },
+    dispose: clearTimer
+  }
+}
diff --git a/src/renderer/src/lib/editor-model-registry.ts b/src/renderer/src/lib/editor-model-registry.ts
index 4a2b8da8890..b5d4c31578c 100644
--- a/src/renderer/src/lib/editor-model-registry.ts
+++ b/src/renderer/src/lib/editor-model-registry.ts
@@ -1,13 +1,15 @@
 import type * as Monaco from 'monaco-editor'
 
+type EditorModelRegistry = Pick<typeof Monaco, 'editor' | 'Uri'>
+
 export type EditorModelRegistryBridge = {
-  get(): typeof Monaco | null
+  get(): EditorModelRegistry | null
   subscribe(listener: () => void): () => void
-  register(registry: typeof Monaco): () => void
+  register(registry: EditorModelRegistry): () => void
 }
 
 export function createEditorModelRegistry(): EditorModelRegistryBridge {
-  let registration: { registry: typeof Monaco } | null = null
+  let registration: { registry: EditorModelRegistry } | null = null
   const listeners = new Set<() => void>()
   const notify = (): void => {
     for (const listener of listeners) {
@@ -15,12 +17,12 @@ export function createEditorModelRegistry(): EditorModelRegistryBridge {
     }
   }
   return {
-    get: (): typeof Monaco | null => registration?.registry ?? null,
+    get: (): EditorModelRegistry | null => registration?.registry ?? null,
     subscribe(listener: () => void): () => void {
       listeners.add(listener)
       return () => listeners.delete(listener)
     },
-    register(registry: typeof Monaco): () => void {
+    register(registry: EditorModelRegistry): () => void {
       const next = { registry }
       registration = next
       notify()
diff --git a/src/renderer/src/lib/empty-workspace-default-agent-chat.test.ts b/src/renderer/src/lib/empty-workspace-default-agent-chat.test.ts
new file mode 100644
index 00000000000..e3ad93eb3db
--- /dev/null
+++ b/src/renderer/src/lib/empty-workspace-default-agent-chat.test.ts
@@ -0,0 +1,154 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { GlobalSettings } from '../../../shared/global-settings-types'
+import { getDefaultSettings } from '../../../shared/constants'
+import { useAppStore } from '@/store'
+import {
+  emptyWorkspaceDefaultChatAwaitsDetection,
+  loadEmptyWorkspaceDefaultChatDetection,
+  openDefaultAgentChatInEmptyWorkspace
+} from './empty-workspace-default-agent-chat'
+
+const mocks = vi.hoisted(() => ({
+  launchAgentInNewTab: vi.fn(),
+  planAgentSessionLaunch: vi.fn(),
+  detectionTargetKey: vi.fn<() => string | undefined>()
+}))
+
+vi.mock('@/lib/launch-agent-in-new-tab', () => ({
+  launchAgentInNewTab: mocks.launchAgentInNewTab
+}))
+vi.mock('@/lib/agent-session-launch-plan', () => ({
+  planAgentSessionLaunch: mocks.planAgentSessionLaunch
+}))
+vi.mock('@/hooks/useAgentDetectionTarget', async (importOriginal) => ({
+  ...(await importOriginal<Record<string, unknown>>()),
+  getAgentDetectionTargetKeyForWorktree: mocks.detectionTargetKey
+}))
+
+const initialAppStoreState = useAppStore.getState()
+
+function seedSettings(settings: Partial<GlobalSettings>): void {
+  useAppStore.setState({
+    detectedAgentIds: ['claude', 'codex'],
+    settings: {
+      ...getDefaultSettings('/tmp'),
+      experimentalNativeChat: true,
+      openAgentTabsInChatByDefault: true,
+      defaultTuiAgent: 'codex',
+      disabledTuiAgents: [],
+      ...settings
+    }
+  })
+}
+
+beforeEach(() => {
+  mocks.detectionTargetKey.mockReturnValue('local')
+  mocks.planAgentSessionLaunch.mockReturnValue({ route: 'structured-native-chat' })
+  mocks.launchAgentInNewTab.mockReturnValue({
+    surface: { kind: 'local-agent-session', tabId: 'chat-tab', sessionId: 's-1' }
+  })
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+  vi.clearAllMocks()
+  useAppStore.setState(initialAppStoreState, true)
+})
+
+describe('openDefaultAgentChatInEmptyWorkspace', () => {
+  it('launches the default agent as a chat', () => {
+    seedSettings({})
+
+    expect(openDefaultAgentChatInEmptyWorkspace('wt-1')).toEqual({ primaryTabId: 'chat-tab' })
+    expect(mocks.launchAgentInNewTab).toHaveBeenCalledWith(
+      expect.objectContaining({ agent: 'codex', worktreeId: 'wt-1', pendingActivationSpawn: true })
+    )
+  })
+
+  it('does nothing unless new agent tabs open as chat', () => {
+    seedSettings({ openAgentTabsInChatByDefault: false })
+
+    expect(openDefaultAgentChatInEmptyWorkspace('wt-1')).toBeNull()
+    expect(mocks.launchAgentInNewTab).not.toHaveBeenCalled()
+  })
+
+  it('respects a Blank Terminal default agent', () => {
+    seedSettings({ defaultTuiAgent: 'blank' })
+
+    expect(openDefaultAgentChatInEmptyWorkspace('wt-1')).toBeNull()
+    expect(mocks.launchAgentInNewTab).not.toHaveBeenCalled()
+  })
+
+  it('does not start an agent that could only open as a terminal here', () => {
+    seedSettings({})
+    mocks.planAgentSessionLaunch.mockReturnValue({ route: 'terminal-tui' })
+
+    expect(openDefaultAgentChatInEmptyWorkspace('wt-1')).toBeNull()
+    expect(mocks.launchAgentInNewTab).not.toHaveBeenCalled()
+  })
+
+  it('reads the agents detected on the workspace SSH host', () => {
+    seedSettings({})
+    mocks.detectionTargetKey.mockReturnValue('ssh:conn-1')
+    useAppStore.setState({ remoteDetectedAgentIds: { 'conn-1': ['claude'] } })
+
+    openDefaultAgentChatInEmptyWorkspace('wt-1')
+
+    expect(mocks.launchAgentInNewTab).toHaveBeenCalledWith(
+      expect.objectContaining({ agent: 'claude' })
+    )
+  })
+
+  it('treats a workspace whose host is unresolved as unknown', () => {
+    seedSettings({})
+    mocks.detectionTargetKey.mockReturnValue(undefined)
+
+    expect(emptyWorkspaceDefaultChatAwaitsDetection('wt-1')).toBe(false)
+    expect(openDefaultAgentChatInEmptyWorkspace('wt-1')).toBeNull()
+    expect(mocks.launchAgentInNewTab).not.toHaveBeenCalled()
+  })
+})
+
+describe('agent detection for the default chat', () => {
+  it('waits only while chat is the default and the host list has not loaded', () => {
+    seedSettings({})
+    mocks.detectionTargetKey.mockReturnValue('ssh:conn-1')
+    useAppStore.setState({ remoteDetectedAgentIds: {} })
+    expect(emptyWorkspaceDefaultChatAwaitsDetection('wt-1')).toBe(true)
+
+    useAppStore.setState({ remoteDetectedAgentIds: { 'conn-1': [] } })
+    expect(emptyWorkspaceDefaultChatAwaitsDetection('wt-1')).toBe(false)
+
+    seedSettings({ openAgentTabsInChatByDefault: false })
+    useAppStore.setState({ remoteDetectedAgentIds: {} })
+    expect(emptyWorkspaceDefaultChatAwaitsDetection('wt-1')).toBe(false)
+  })
+
+  // Why: Blank Terminal opens a shell whatever the host has, so waiting only delays that shell.
+  it('does not wait when the default agent is Blank Terminal', () => {
+    seedSettings({ defaultTuiAgent: 'blank' })
+    mocks.detectionTargetKey.mockReturnValue('ssh:conn-1')
+    useAppStore.setState({ remoteDetectedAgentIds: {} })
+
+    expect(emptyWorkspaceDefaultChatAwaitsDetection('wt-1')).toBe(false)
+  })
+
+  it('probes the workspace host and gives up after a bounded wait', async () => {
+    vi.useFakeTimers()
+    seedSettings({})
+    mocks.detectionTargetKey.mockReturnValue('ssh:conn-1')
+    const ensureRemoteDetectedAgents = vi.fn(() => new Promise<never>(() => {}))
+    useAppStore.setState({ ensureRemoteDetectedAgents })
+    let settled = false
+
+    void loadEmptyWorkspaceDefaultChatDetection('wt-1').then(() => {
+      settled = true
+    })
+    await vi.advanceTimersByTimeAsync(4_999)
+    expect(settled).toBe(false)
+    await vi.advanceTimersByTimeAsync(1)
+
+    expect(ensureRemoteDetectedAgents).toHaveBeenCalledWith('conn-1')
+    expect(settled).toBe(true)
+  })
+})
diff --git a/src/renderer/src/lib/empty-workspace-default-agent-chat.ts b/src/renderer/src/lib/empty-workspace-default-agent-chat.ts
new file mode 100644
index 00000000000..84156f99927
--- /dev/null
+++ b/src/renderer/src/lib/empty-workspace-default-agent-chat.ts
@@ -0,0 +1,113 @@
+import { agentTabsDefaultToNativeChat } from '../../../shared/structured-native-chat-launch-route'
+import { pickTuiAgent } from '../../../shared/tui-agent-selection'
+import type { TuiAgent } from '../../../shared/tui-agent'
+import { withTimeout } from '../../../shared/promise-timeout-fallback'
+import { useAppStore } from '@/store'
+import type { AppState } from '@/store/types'
+import {
+  getAgentDetectionTargetKeyForWorktree,
+  parseAgentDetectionTargetKey
+} from '@/hooks/useAgentDetectionTarget'
+import type { AgentDetectionTarget } from '@/hooks/useDetectedAgents'
+import { workspaceKindForWorktreeId } from '@/lib/agent-launch-route-input'
+import { planAgentSessionLaunch } from '@/lib/agent-session-launch-plan'
+import { launchAgentInNewTab } from '@/lib/launch-agent-in-new-tab'
+
+// Why bounded: detection only decides chat vs shell, so a slow host must not hold the workspace empty.
+const DEFAULT_CHAT_DETECTION_TIMEOUT_MS = 5_000
+
+/**
+ * The host whose agent list picks the default chat; undefined when the workspace opens a shell
+ * whatever that list says. Shared by the wait and the open so they cannot drift.
+ */
+function defaultChatDetectionTarget(
+  state: AppState,
+  worktreeId: string
+): AgentDetectionTarget | undefined {
+  // Why: a 'blank' default means the user wants workspaces to open without an agent.
+  if (
+    !agentTabsDefaultToNativeChat(state.settings) ||
+    state.settings?.defaultTuiAgent === 'blank'
+  ) {
+    return undefined
+  }
+  // Why: an unresolved owner is an unknown host, not the local machine.
+  return parseAgentDetectionTargetKey(getAgentDetectionTargetKeyForWorktree(state, worktreeId))
+}
+
+/** Same host lists the tab bar reads; null means that host's detection has not loaded. */
+function readDetectedAgents(state: AppState, target: AgentDetectionTarget): TuiAgent[] | null {
+  if (target.kind === 'ssh') {
+    return state.remoteDetectedAgentIds[target.connectionId] ?? null
+  }
+  if (target.kind === 'runtime') {
+    return state.runtimeDetectedAgentIds[target.environmentId] ?? null
+  }
+  return target.contextKey
+    ? (state.localDetectedAgentIdsByContext[target.contextKey] ?? null)
+    : state.detectedAgentIds
+}
+
+/** True when the default chat could open here but the workspace host's agent list has not loaded. */
+export function emptyWorkspaceDefaultChatAwaitsDetection(worktreeId: string): boolean {
+  const state = useAppStore.getState()
+  const target = defaultChatDetectionTarget(state, worktreeId)
+  return target !== undefined && readDetectedAgents(state, target) === null
+}
+
+/** Loads the workspace host's agent list; resolves on success, failure, or timeout. */
+export async function loadEmptyWorkspaceDefaultChatDetection(worktreeId: string): Promise<void> {
+  const state = useAppStore.getState()
+  const target = defaultChatDetectionTarget(state, worktreeId)
+  if (!target) {
+    return
+  }
+  const detection =
+    target.kind === 'ssh'
+      ? state.ensureRemoteDetectedAgents(target.connectionId)
+      : target.kind === 'runtime'
+        ? state.ensureRuntimeDetectedAgents(target.environmentId)
+        : state.ensureDetectedAgents(target.worktreeId)
+  await withTimeout(detection, DEFAULT_CHAT_DETECTION_TIMEOUT_MS, [])
+}
+
+/**
+ * When the user's new agent tabs open as chat, an empty workspace opens their default agent as a
+ * chat instead of a bare shell. Null means nothing opened and the caller seeds the shell.
+ */
+export function openDefaultAgentChatInEmptyWorkspace(
+  worktreeId: string
+): { primaryTabId: string | null } | null {
+  const state = useAppStore.getState()
+  const target = defaultChatDetectionTarget(state, worktreeId)
+  if (!target) {
+    return null
+  }
+  const agent = pickTuiAgent(
+    state.settings?.defaultTuiAgent,
+    readDetectedAgents(state, target) ?? [],
+    state.settings?.disabledTuiAgents
+  )
+  if (!agent) {
+    return null
+  }
+  const agentSessionLaunchPlan = planAgentSessionLaunch(state, {
+    agent,
+    workspace: { kind: workspaceKindForWorktreeId(worktreeId), worktreeId }
+  })
+  // Why: an agent that can only open as a TUI here would replace the shell with a process nobody asked for.
+  if (agentSessionLaunchPlan.route === 'terminal-tui') {
+    return null
+  }
+  const result = launchAgentInNewTab({
+    agent,
+    worktreeId,
+    launchSource: 'unknown',
+    agentSessionLaunchPlan,
+    pendingActivationSpawn: true
+  })
+  if (!result) {
+    return null
+  }
+  return { primaryTabId: result.surface.kind === 'host-published' ? null : result.surface.tabId }
+}
diff --git a/src/renderer/src/lib/empty-workspace-default-surface-claims.ts b/src/renderer/src/lib/empty-workspace-default-surface-claims.ts
new file mode 100644
index 00000000000..61a989e6bfc
--- /dev/null
+++ b/src/renderer/src/lib/empty-workspace-default-surface-claims.ts
@@ -0,0 +1,29 @@
+import type { GatedEmptyWorkspaceReseedIntent } from './worktree-initial-terminal-seeding'
+
+// Why: while a gated reseed waits on agent detection, it owns the workspace's first surface;
+// any other seeder landing in that wait would put a shell beside the chat it is about to open.
+// Why the intent: the wait seeds for the latest activation, so a later one must not be dropped.
+const pendingIntentByWorkspace = new Map<string, GatedEmptyWorkspaceReseedIntent>()
+
+/** Records this activation's intent; false when a wait already pending now carries it instead. */
+export function claimEmptyWorkspaceDefaultSurface(
+  workspaceKey: string,
+  intent: GatedEmptyWorkspaceReseedIntent
+): boolean {
+  const alreadyPending = pendingIntentByWorkspace.has(workspaceKey)
+  pendingIntentByWorkspace.set(workspaceKey, intent)
+  return !alreadyPending
+}
+
+/** Ends the wait and returns the latest activation's intent. */
+export function releaseEmptyWorkspaceDefaultSurface(
+  workspaceKey: string
+): GatedEmptyWorkspaceReseedIntent | undefined {
+  const intent = pendingIntentByWorkspace.get(workspaceKey)
+  pendingIntentByWorkspace.delete(workspaceKey)
+  return intent
+}
+
+export function isEmptyWorkspaceDefaultSurfacePending(workspaceKey: string): boolean {
+  return pendingIntentByWorkspace.has(workspaceKey)
+}
diff --git a/src/renderer/src/lib/execute-open-editor-path-move.test.ts b/src/renderer/src/lib/execute-open-editor-path-move.test.ts
index 63e729dc65e..76c5bbc1c7e 100644
--- a/src/renderer/src/lib/execute-open-editor-path-move.test.ts
+++ b/src/renderer/src/lib/execute-open-editor-path-move.test.ts
@@ -16,7 +16,7 @@ import { useAppStore } from '@/store'
 import { executeOpenEditorPathMove } from './execute-open-editor-path-move'
 import { __activeEditorPathMoveCountForTests } from '@/components/editor/editor-path-move-inflight'
 import { getDiskBaselineSignature } from '@/components/editor/diff-content-signature'
-import { createExternalWatchEventHandler } from '@/hooks/useEditorExternalWatch'
+import { buildEditorExternalWatchEventHandler as createExternalWatchEventHandler } from '@/hooks/editor-external-watch-event-reconciliation'
 
 const CONTEXT = {
   settings: null,
diff --git a/src/renderer/src/lib/finished-agent-resume-resurrection.test.ts b/src/renderer/src/lib/finished-agent-resume-resurrection.test.ts
index d0132f53175..c2d5785b008 100644
--- a/src/renderer/src/lib/finished-agent-resume-resurrection.test.ts
+++ b/src/renderer/src/lib/finished-agent-resume-resurrection.test.ts
@@ -15,7 +15,7 @@
 import { afterEach, describe, expect, it } from 'vitest'
 import { makePaneKey } from '../../../shared/stable-pane-id'
 import { useAppStore } from '@/store'
-import { isPassiveCompletedHibernationEvidence } from './sleeping-agent-pane-ownership'
+import { activationTreatsNoteAsFinished } from './sleeping-agent-pane-ownership'
 import { resumeSleepingAgentSessionsForWorktree } from './resume-sleeping-agent-session'
 
 const initialAppStoreState = useAppStore.getState()
@@ -80,7 +80,7 @@ function reportTurnFinished(interrupted = false): void {
 describe('a finished local agent', () => {
   it('keeps completed quit records resumable', () => {
     expect(
-      isPassiveCompletedHibernationEvidence({
+      activationTreatsNoteAsFinished({
         paneKey: 'quit-tab:quit-leaf',
         tabId: 'quit-tab',
         worktreeId: WORKTREE_ID,
@@ -108,7 +108,7 @@ describe('a finished local agent', () => {
     expect(record?.agent).toBe('codex')
     expect(record?.providerSession).toEqual({ key: 'session_id', id: SESSION_ID })
     expect(
-      isPassiveCompletedHibernationEvidence(record!),
+      activationTreatsNoteAsFinished(record!),
       'a finished agent must read as history, or activation restarts it'
     ).toBe(true)
   })
@@ -120,7 +120,7 @@ describe('a finished local agent', () => {
     const record = useAppStore.getState().sleepingAgentSessionsByPaneKey[PANE_KEY]
     expect(record?.state).toBe('done')
     expect(record?.interrupted).toBe(true)
-    expect(isPassiveCompletedHibernationEvidence(record!)).toBe(false)
+    expect(activationTreatsNoteAsFinished(record!)).toBe(false)
 
     useAppStore.setState({
       tabsByWorktree: { [WORKTREE_ID]: [] },
diff --git a/src/renderer/src/lib/fix-checks-agent-launch.test.ts b/src/renderer/src/lib/fix-checks-agent-launch.test.ts
index c044ae4b068..32c636f13f7 100644
--- a/src/renderer/src/lib/fix-checks-agent-launch.test.ts
+++ b/src/renderer/src/lib/fix-checks-agent-launch.test.ts
@@ -97,7 +97,7 @@ vi.mock('@/lib/new-workspace', () => ({
   CLIENT_PLATFORM: 'win32'
 }))
 
-vi.mock('@/lib/source-control-launch-agent-selection', () => ({
+vi.mock('../../../shared/source-control-launch-agent-selection', () => ({
   pickSourceControlLaunchAgent: mocks.pickSourceControlLaunchAgent,
   readSourceControlLaunchRecipeAgentId: mocks.readSourceControlLaunchRecipeAgentId
 }))
diff --git a/src/renderer/src/lib/fix-checks-agent-launch.ts b/src/renderer/src/lib/fix-checks-agent-launch.ts
index 20a9db90537..1bfa1b78253 100644
--- a/src/renderer/src/lib/fix-checks-agent-launch.ts
+++ b/src/renderer/src/lib/fix-checks-agent-launch.ts
@@ -10,7 +10,7 @@ import { planAgentCliArgsSuffix } from '@/lib/tui-agent-startup'
 import {
   pickSourceControlLaunchAgent,
   readSourceControlLaunchRecipeAgentId
-} from '@/lib/source-control-launch-agent-selection'
+} from '../../../shared/source-control-launch-agent-selection'
 import { resolveSourceControlLaunchPlatform } from '@/lib/source-control-launch-platform'
 import { activateAndRevealWorktree } from '@/lib/worktree-activation'
 import { useAppStore } from '@/store'
diff --git a/src/renderer/src/lib/focus-terminal-tab-surface.split-focus.test.ts b/src/renderer/src/lib/focus-terminal-tab-surface.split-focus.test.ts
new file mode 100644
index 00000000000..d3fda81fa6b
--- /dev/null
+++ b/src/renderer/src/lib/focus-terminal-tab-surface.split-focus.test.ts
@@ -0,0 +1,47 @@
+// @vitest-environment happy-dom
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { focusTerminalTabSurface } from './focus-terminal-tab-surface'
+
+vi.mock('@/components/terminal-pane/terminal-ime-input-context-refresh', () => ({
+  refreshTerminalImeInputContext: vi.fn()
+}))
+
+describe('deferred split terminal focus', () => {
+  afterEach(() => {
+    document.body.replaceChildren()
+    vi.unstubAllGlobals()
+  })
+
+  it.each([null, 'left'])(
+    'preserves a pane reveal unless an explicit leaf (%s) was requested',
+    (requestedLeaf) => {
+      const frames: FrameRequestCallback[] = []
+      vi.stubGlobal('requestAnimationFrame', (callback: FrameRequestCallback) => {
+        frames.push(callback)
+        return frames.length
+      })
+      vi.stubGlobal('cancelAnimationFrame', vi.fn())
+      const tab = document.createElement('div')
+      tab.dataset.terminalTabId = 'floating-tab'
+      const inputs = ['left', 'right'].map((leafId) => {
+        const pane = document.createElement('div')
+        pane.dataset.leafId = leafId
+        const input = document.createElement('textarea')
+        input.className = 'xterm-helper-textarea'
+        pane.append(input)
+        tab.append(pane)
+        return input
+      })
+      document.body.append(tab)
+
+      focusTerminalTabSurface('floating-tab', requestedLeaf)
+      frames.shift()?.(0)
+      // The activity row focuses the right pane before the panel's deferred focus completes.
+      inputs[1].focus()
+      frames.shift()?.(0)
+
+      expect(document.activeElement).toBe(inputs[requestedLeaf ? 0 : 1])
+    }
+  )
+})
diff --git a/src/renderer/src/lib/focus-terminal-tab-surface.ts b/src/renderer/src/lib/focus-terminal-tab-surface.ts
index ef23ff051d7..bf7dc3ed991 100644
--- a/src/renderer/src/lib/focus-terminal-tab-surface.ts
+++ b/src/renderer/src/lib/focus-terminal-tab-surface.ts
@@ -80,7 +80,10 @@ export function focusTerminalTabSurface(
       const scopedSelector = leafId
         ? `[data-terminal-tab-id="${escapedTabId}"] [data-leaf-id="${cssAttributeString(leafId)}"]${UNCOVERED_TERMINAL_LEAF_SELECTOR} .xterm-helper-textarea`
         : `[data-terminal-tab-id="${escapedTabId}"] ${UNCOVERED_TERMINAL_LEAF_SELECTOR} .xterm-helper-textarea`
-      const scoped = document.querySelector(scopedSelector) as HTMLElement | null
+      // A pane-specific reveal may have focused a split while this tab-wide request was waiting.
+      const scoped =
+        (!leafId ? document.querySelector<HTMLElement>(`${scopedSelector}:focus`) : null) ??
+        document.querySelector<HTMLElement>(scopedSelector)
       if (scoped) {
         focusTerminalHelper(scoped, options)
         return
diff --git a/src/renderer/src/lib/http-link-modifier-routing.test.ts b/src/renderer/src/lib/http-link-modifier-routing.test.ts
index 8d0f94d580d..77066cc4189 100644
--- a/src/renderer/src/lib/http-link-modifier-routing.test.ts
+++ b/src/renderer/src/lib/http-link-modifier-routing.test.ts
@@ -44,15 +44,6 @@ describe('resolveModifierRouting', () => {
       wantsSystemBrowser: false
     })
   })
-
-  it('only diverges from the legacy behavior when links open externally', () => {
-    expect(resolveModifierRouting(true, true, true)).toEqual(
-      resolveModifierRouting(true, true, false)
-    )
-    expect(resolveModifierRouting(true, false, true)).not.toEqual(
-      resolveModifierRouting(true, false, false)
-    )
-  })
 })
 
 describe('modifier routing across link source owners', () => {
diff --git a/src/renderer/src/lib/language-detect.test.ts b/src/renderer/src/lib/language-detect.test.ts
index 7ed3f5c3b0a..9493bae9485 100644
--- a/src/renderer/src/lib/language-detect.test.ts
+++ b/src/renderer/src/lib/language-detect.test.ts
@@ -20,6 +20,22 @@ describe('detectLanguage', () => {
     expect(detectLanguage('packages/app.nimble')).toBe('nim')
   })
 
+  it.each([
+    'documents/report.typ',
+    'C:\\documents\\REPORT.TYP',
+    '\\\\server\\share\\report.typ',
+    '/home/user/folder workspace/Report.TyP'
+  ])('maps Typst source %s to the typst language id', (filePath) => {
+    expect(detectLanguage(filePath)).toBe('typst')
+  })
+
+  it.each(['report.typ.bak', 'report.typx', 'documents.typ/README', 'documents.typ\\README'])(
+    'keeps non-Typst file %s on plaintext',
+    (filePath) => {
+      expect(detectLanguage(filePath)).toBe('plaintext')
+    }
+  )
+
   it('maps exact filenames from Windows paths', () => {
     expect(detectLanguage('C:\\Users\\alice\\repo\\Dockerfile')).toBe('dockerfile')
     expect(detectLanguage('C:\\Users\\alice\\repo\\CMakeLists.txt')).toBe('cmake')
@@ -38,6 +54,25 @@ describe('detectLanguage', () => {
     expect(detectLanguage('C:\\rtl\\TOP.SV')).toBe('systemverilog')
   })
 
+  it.each([
+    'report.abap',
+    'src/zcor0260.prog.abap',
+    'src/zcl_demo.clas.abap',
+    'src/zif_demo.intf.abap',
+    'C:\\repo\\src\\ZCL_DEMO.CLAS.ABAP',
+    '\\\\server\\share\\src\\ZREPORT.PROG.ABAP',
+    '/home/user/folder workspace/src/Report.AbAp'
+  ])('maps ABAP source %s to the Monaco built-in abap language id', (filePath) => {
+    expect(detectLanguage(filePath)).toBe('abap')
+  })
+
+  it.each(['src.abap/README', 'src\\abap.abap\\README', 'report.abap.bak', 'report.abapx'])(
+    'keeps non-ABAP file %s on plaintext',
+    (filePath) => {
+      expect(detectLanguage(filePath)).toBe('plaintext')
+    }
+  )
+
   it('maps .proto files to the Monaco built-in proto language id, not the alias', () => {
     expect(detectLanguage('api/v1/service.proto')).toBe('proto')
   })
@@ -77,6 +112,11 @@ describe('detectLanguage', () => {
     expect(detectLanguage('C:\\theme\\snippets\\CART.LIQUID')).toBe('liquid')
   })
 
+  it('maps .sol files to the Monaco built-in sol language id, not the solidity alias', () => {
+    expect(detectLanguage('contracts/Vault.sol')).toBe('sol')
+    expect(detectLanguage('C:\\repo\\contracts\\TOKEN.SOL')).toBe('sol')
+  })
+
   it('maps Salesforce Apex sources to the apex language id (case-insensitive)', () => {
     expect(detectLanguage('force-app/main/default/classes/AccountService.cls')).toBe('apex')
     expect(detectLanguage('force-app/main/default/triggers/AccountTrigger.trigger')).toBe('apex')
@@ -84,9 +124,57 @@ describe('detectLanguage', () => {
     expect(detectLanguage('C:\\repo\\force-app\\classes\\ACCOUNTSERVICE.CLS')).toBe('apex')
   })
 
+  it.each([
+    'templates/base.twig',
+    'templates/node--article.html.twig',
+    'C:\\theme\\templates\\PAGE.HTML.TWIG',
+    '\\\\server\\share\\templates\\PAGE.TWIG',
+    '/home/user/folder workspace/templates/Base.TwIg'
+  ])('maps Twig template %s to the Monaco built-in twig language id', (filePath) => {
+    expect(detectLanguage(filePath)).toBe('twig')
+  })
+
+  it.each(['base.twig.bak', 'base.twigx', 'templates.twig/README', 'templates.twig\\README'])(
+    'keeps non-Twig file %s on plaintext',
+    (filePath) => {
+      expect(detectLanguage(filePath)).toBe('plaintext')
+    }
+  )
+
   it('keeps .json/.jsonc on the built-in json language and unknown on plaintext', () => {
     expect(detectLanguage('config/settings.json')).toBe('json')
     expect(detectLanguage('config/tsconfig.jsonc')).toBe('json')
     expect(detectLanguage('notes/scratch.unknownext')).toBe('plaintext')
   })
+  it.each([
+    ['.env', 'ini'],
+    ['.env.local', 'ini'],
+    ['.env.development', 'ini'],
+    ['.env.production', 'ini'],
+    ['.env.functions.local', 'ini'],
+    ['.env.staging', 'ini'],
+    ['.env.test.example', 'ini'],
+    ['config/.env.development.local', 'ini'],
+    ['.ENV', 'ini'],
+    ['.ENV.STAGING', 'ini'],
+    ['C:\\repo\\.EnV.FUNCTIONS.LOCAL', 'ini'],
+    ['\\\\server\\share\\.env.test.example', 'ini'],
+    ['.env.sh', 'shell'],
+    ['.ENV.SH', 'shell'],
+    ['.env.json', 'json'],
+    ['.env.local.ts', 'typescript'],
+    ['.env/CMakeLists.txt', 'cmake'],
+    ['C:\\repo\\.env.local\\Dockerfile', 'dockerfile'],
+    ['.envrc', 'plaintext'],
+    ['.environment', 'plaintext'],
+    ['env.staging', 'plaintext'],
+    ['dev.env', 'plaintext'],
+    ['other.env.local', 'plaintext'],
+    ['..env.local', 'plaintext'],
+    ['.env.staging/readme', 'plaintext'],
+    ['C:\\repo\\.env.local\\notes', 'plaintext'],
+    ['', 'plaintext']
+  ])('detects dotenv names without overriding specific mappings: %s', (filePath, expected) => {
+    expect(detectLanguage(filePath)).toBe(expected)
+  })
 })
diff --git a/src/renderer/src/lib/language-detect.ts b/src/renderer/src/lib/language-detect.ts
index e2738b1b404..c3d766d3710 100644
--- a/src/renderer/src/lib/language-detect.ts
+++ b/src/renderer/src/lib/language-detect.ts
@@ -1,3 +1,5 @@
+import { detectMonacoFilenameLanguage } from './monaco-filename-language'
+
 function extname(filePath: string): string {
   const lastDot = filePath.lastIndexOf('.')
   const lastSep = Math.max(filePath.lastIndexOf('/'), filePath.lastIndexOf('\\'))
@@ -42,6 +44,7 @@ const EXT_TO_LANGUAGE: Record<string, string> = {
   // Why: Monaco declares Liquid as both '.liquid' and '.html.liquid'; the final-extension
   // lookup below covers the compound form, so the single entry is enough.
   '.liquid': 'liquid',
+  '.twig': 'twig',
   '.xml': 'xml',
   '.svg': 'xml',
   '.py': 'python',
@@ -92,6 +95,8 @@ const EXT_TO_LANGUAGE: Record<string, string> = {
   '.hrl': 'erlang',
   '.hs': 'haskell',
   '.clj': 'clojure',
+  // Why: Monaco registers Solidity under the id 'sol'; 'solidity' is only an alias.
+  '.sol': 'sol',
   '.vue': 'vue',
   '.svelte': 'svelte',
   '.astro': 'astro',
@@ -102,8 +107,10 @@ const EXT_TO_LANGUAGE: Record<string, string> = {
   '.nim': 'nim',
   '.nims': 'nim',
   '.nimble': 'nim',
+  '.typ': 'typst',
   '.tf': 'hcl',
   '.hcl': 'hcl',
+  '.abap': 'abap',
   '.prisma': 'graphql',
   '.csv': 'csv',
   '.tsv': 'tsv'
@@ -126,11 +133,17 @@ export function detectLanguage(filePath: string): string {
   // Check exact filename first
   const parts = filePath.split(/[\\/]/)
   const filename = parts.at(-1)!
-  if (FILENAME_TO_LANGUAGE[filename]) {
+  if (Object.hasOwn(FILENAME_TO_LANGUAGE, filename)) {
     return FILENAME_TO_LANGUAGE[filename]
   }
 
   // Check extension
   const ext = extname(filename).toLowerCase()
-  return EXT_TO_LANGUAGE[ext] ?? 'plaintext'
+  const lowerName = filename.toLowerCase()
+  // Scoped dotenv names fall back to INI only when no specific extension matches.
+  return (
+    EXT_TO_LANGUAGE[ext] ??
+    detectMonacoFilenameLanguage(filename) ??
+    (lowerName === '.env' || lowerName.startsWith('.env.') ? 'ini' : 'plaintext')
+  )
 }
diff --git a/src/renderer/src/lib/launch-agent-background-session-remote.test.ts b/src/renderer/src/lib/launch-agent-background-session-remote.test.ts
index 11ade27d58a..77dfc46c349 100644
--- a/src/renderer/src/lib/launch-agent-background-session-remote.test.ts
+++ b/src/renderer/src/lib/launch-agent-background-session-remote.test.ts
@@ -24,7 +24,6 @@ const mockRegisterEagerPtyBuffer = vi.fn()
 const mockSubscribeToPtyData = vi.fn()
 const mockSubscribeToPtyExit = vi.fn()
 const mockPasteDraftWhenAgentReady = vi.fn()
-const mockMarkTrusted = vi.fn()
 const mockDispatchEvent = vi.fn()
 const mockGetAgentLaunchPlatformForRepo = vi.fn<() => NodeJS.Platform>()
 const state = createAgentBackgroundSessionTestState({
@@ -81,7 +80,6 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
       updateTabPtyId: mockUpdateTabPtyId,
       dispatchEvent: mockDispatchEvent,
       kill: mockKill,
-      markTrusted: mockMarkTrusted,
       spawn: mockSpawn,
       write: mockWrite
     })
@@ -178,7 +176,8 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
 
       expect(mockWrite).toHaveBeenCalledWith(
         'pty-1',
-        "claude '--dangerously-skip-permissions' 'run the automation'\r"
+        "claude '--dangerously-skip-permissions' 'run the automation'\r",
+        'launch'
       )
     } finally {
       vi.useRealTimers()
@@ -214,7 +213,8 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
 
       expect(mockWrite).toHaveBeenCalledWith(
         'pty-1',
-        "codex '--dangerously-bypass-approvals-and-sandbox' 'run the automation'\r"
+        "codex '--dangerously-bypass-approvals-and-sandbox' 'run the automation'\r",
+        'launch'
       )
     } finally {
       vi.useRealTimers()
@@ -241,7 +241,8 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
 
       expect(mockWrite).toHaveBeenCalledWith(
         'pty-1',
-        "codex '--dangerously-bypass-approvals-and-sandbox'\r"
+        "codex '--dangerously-bypass-approvals-and-sandbox'\r",
+        'launch'
       )
     } finally {
       vi.useRealTimers()
@@ -262,7 +263,8 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
 
       expect(mockWrite).toHaveBeenCalledWith(
         'pty-1',
-        "codex '--dangerously-bypass-approvals-and-sandbox'\r"
+        "codex '--dangerously-bypass-approvals-and-sandbox'\r",
+        'launch'
       )
     } finally {
       vi.useRealTimers()
@@ -288,7 +290,8 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
 
       expect(mockWrite).toHaveBeenCalledWith(
         'pty-1',
-        "codex '--dangerously-bypass-approvals-and-sandbox' 'run the automation'\r"
+        "codex '--dangerously-bypass-approvals-and-sandbox' 'run the automation'\r",
+        'launch'
       )
     } finally {
       vi.useRealTimers()
@@ -312,7 +315,8 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
 
       expect(mockWrite).toHaveBeenCalledWith(
         'pty-1',
-        "codex '--dangerously-bypass-approvals-and-sandbox' 'run the automation'\r"
+        "codex '--dangerously-bypass-approvals-and-sandbox' 'run the automation'\r",
+        'launch'
       )
     } finally {
       vi.useRealTimers()
@@ -353,7 +357,8 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
 
       expect(mockWrite).toHaveBeenCalledWith(
         'pty-1',
-        "codex --prefill 'draft from override' '--dangerously-bypass-approvals-and-sandbox'\r"
+        "codex --prefill 'draft from override' '--dangerously-bypass-approvals-and-sandbox'\r",
+        'launch'
       )
     } finally {
       vi.useRealTimers()
@@ -595,11 +600,6 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
       prompt: 'run the automation'
     })
 
-    expect(mockMarkTrusted).toHaveBeenCalledWith({
-      preset: 'codex',
-      workspacePath: '/srv/proj',
-      connectionId: 'ssh-1'
-    })
     expect(mockSpawn).toHaveBeenCalledWith(
       expect.objectContaining({ connectionId: 'ssh-1', cwd: '/srv/proj' })
     )
diff --git a/src/renderer/src/lib/launch-agent-background-session.test.ts b/src/renderer/src/lib/launch-agent-background-session.test.ts
index ea7b1a30762..23606a83776 100644
--- a/src/renderer/src/lib/launch-agent-background-session.test.ts
+++ b/src/renderer/src/lib/launch-agent-background-session.test.ts
@@ -25,7 +25,6 @@ const mockRegisterEagerPtyBuffer = vi.fn()
 const mockSubscribeToPtyData = vi.fn()
 const mockSubscribeToPtyExit = vi.fn()
 const mockPasteDraftWhenAgentReady = vi.fn()
-const mockMarkTrusted = vi.fn()
 const mockDispatchEvent = vi.fn()
 const mockGetAgentLaunchPlatformForRepo = vi.fn<() => NodeJS.Platform>()
 const state = createAgentBackgroundSessionTestState({
@@ -84,7 +83,6 @@ describe('launchAgentBackgroundSession', () => {
       updateTabPtyId: mockUpdateTabPtyId,
       dispatchEvent: mockDispatchEvent,
       kill: mockKill,
-      markTrusted: mockMarkTrusted,
       spawn: mockSpawn,
       write: mockWrite
     })
@@ -347,22 +345,6 @@ describe('launchAgentBackgroundSession', () => {
     )
   })
 
-  it('pre-marks trust for agents with first-launch trust prompts', async () => {
-    const { launchAgentBackgroundSession } = await import('./launch-agent-background-session')
-
-    await launchAgentBackgroundSession({
-      agent: 'codex',
-      worktreeId: 'wt-1',
-      prompt: 'run the automation'
-    })
-
-    expect(mockMarkTrusted).toHaveBeenCalledWith({
-      preset: 'codex',
-      workspacePath: '/repo/worktree'
-    })
-    expect(mockSpawn).toHaveBeenCalled()
-  })
-
   it('stamps hidden SSH status from renderer fallback when the kill switch is off', async () => {
     // Why: with main side-effect authority disabled, this sidecar is the only
     // OSC 9999 → store path for hidden SSH sessions.
diff --git a/src/renderer/src/lib/launch-agent-background-session.ts b/src/renderer/src/lib/launch-agent-background-session.ts
index 9ef4bcfae4a..35960f749d1 100644
--- a/src/renderer/src/lib/launch-agent-background-session.ts
+++ b/src/renderer/src/lib/launch-agent-background-session.ts
@@ -65,18 +65,6 @@ export async function launchAgentBackgroundSession(
     worktreePath: worktree.path,
     repo
   })
-  const preflight = requireTuiAgentConfig(agent).preflightTrust
-  if (preflight && worktree.path && window.api.agentTrust?.markTrusted) {
-    try {
-      await window.api.agentTrust.markTrusted({
-        preset: preflight,
-        workspacePath: worktree.path,
-        ...(launchHost.connectionId ? { connectionId: launchHost.connectionId } : {})
-      })
-    } catch {
-      // Best-effort: the user can still accept the trust prompt.
-    }
-  }
   const { platform: launchPlatform, isRemote } = launchHost
   const startupShell = resolveLocalWindowsAgentStartupShell({
     platform: launchPlatform,
@@ -118,7 +106,7 @@ export async function launchAgentBackgroundSession(
     command: sshConnectionId ? startupPlan.launchCommand : null,
     waitForShellReady:
       Boolean(sshConnectionId) && sshBackgroundLaunchWaitsForShellReady(startupPlan),
-    write: (ptyId, data) => window.api.pty.write(ptyId, data)
+    write: (ptyId, data) => window.api.pty.write(ptyId, data, 'launch')
   })
   // Route by the worktree's owner host, not the focused runtime.
   const runtimeTarget = getActiveRuntimeTarget(
diff --git a/src/renderer/src/lib/launch-agent-in-new-tab.ts b/src/renderer/src/lib/launch-agent-in-new-tab.ts
index f4923c79b5e..ce28d3c8ad1 100644
--- a/src/renderer/src/lib/launch-agent-in-new-tab.ts
+++ b/src/renderer/src/lib/launch-agent-in-new-tab.ts
@@ -60,6 +60,8 @@ export type LaunchAgentInNewTabArgs = {
   onPromptDeliveryUnconfirmed?: () => void
   /** Keeps a preflighted route authoritative across workspace creation. */
   agentSessionLaunchPlan?: AgentSessionLaunchPlan
+  /** The launch seeds a workspace being opened, so its PTY spawn must not reshuffle Recent. */
+  pendingActivationSpawn?: boolean
   /** Lets a workspace reveal itself before the selected surface opens. */
   beforeSurfaceOpen?: (
     surface:
@@ -114,6 +116,7 @@ function launchAgentInNewTabInternal(args: LaunchAgentInNewTabArgs): LaunchAgent
     onPromptDelivered,
     onPromptDeliveryUnconfirmed,
     agentSessionLaunchPlan,
+    pendingActivationSpawn,
     beforeSurfaceOpen
   } = args
   const store = useAppStore.getState()
@@ -245,6 +248,7 @@ function launchAgentInNewTabInternal(args: LaunchAgentInNewTabArgs): LaunchAgent
   const tab = store.createTab(worktreeId, groupId, undefined, {
     launchAgent: agent,
     quickCommandLabel,
+    ...(pendingActivationSpawn ? { pendingActivationSpawn: true } : {}),
     ...initialViewModeProps
   })
   seedNativeChatAppliedSessionOptions(tab.id, agent, startupPlan.sessionOptions)
diff --git a/src/renderer/src/lib/launch-agent-session-continuation.test.ts b/src/renderer/src/lib/launch-agent-session-continuation.test.ts
index 9edc71f10f6..0634680cf52 100644
--- a/src/renderer/src/lib/launch-agent-session-continuation.test.ts
+++ b/src/renderer/src/lib/launch-agent-session-continuation.test.ts
@@ -48,7 +48,6 @@ describe('launchAgentSessionContinuation', () => {
     writeClipboardText.mockClear()
     vi.stubGlobal('window', {
       api: {
-        agentTrust: { markTrusted: vi.fn(async () => undefined) },
         ui: { writeClipboardText }
       }
     })
@@ -65,7 +64,6 @@ describe('launchAgentSessionContinuation', () => {
         prompt: 'continue the unfinished task',
         worktreeId: 'wt-1',
         groupId: 'group-1',
-        workspacePath: '/repo/worktree',
         initialCwd: '/repo/worktree/packages/app',
         launchSource: 'terminal_context_menu'
       })
@@ -110,7 +108,6 @@ describe('launchAgentSessionContinuation', () => {
         agent: 'codex',
         prompt: 'continue',
         worktreeId: 'wt-1',
-        workspacePath: '/repo/worktree',
         launchSource: 'sidebar'
       })
     ).resolves.toBe(false)
@@ -130,7 +127,6 @@ describe('launchAgentSessionContinuation', () => {
       agent: 'codex',
       prompt: 'continue',
       worktreeId: 'wt-1',
-      workspacePath: '/repo/worktree',
       launchSource: 'sidebar'
     })
 
@@ -167,7 +163,6 @@ describe('launchAgentSessionContinuation', () => {
       agent: 'codex',
       prompt: 'continue the unfinished task',
       worktreeId: 'wt-1',
-      workspacePath: '/repo/worktree',
       launchSource: 'sidebar'
     })
 
@@ -194,7 +189,6 @@ describe('launchAgentSessionContinuation', () => {
       agent: 'codex',
       prompt: 'continue',
       worktreeId: 'wt-1',
-      workspacePath: '/repo/worktree',
       launchSource: 'sidebar'
     })
 
diff --git a/src/renderer/src/lib/launch-agent-session-continuation.ts b/src/renderer/src/lib/launch-agent-session-continuation.ts
index 5f2f3cba7c1..5656eddca04 100644
--- a/src/renderer/src/lib/launch-agent-session-continuation.ts
+++ b/src/renderer/src/lib/launch-agent-session-continuation.ts
@@ -1,6 +1,5 @@
 import { toast } from 'sonner'
 import { getAgentLabel } from '@/lib/agent-catalog'
-import { preflightAgentTrust } from '@/lib/agent-trust-preflight'
 import { getConnectionIdFromState } from '@/lib/connection-context'
 import { launchAgentInNewTab } from '@/lib/launch-agent-in-new-tab'
 import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
@@ -15,7 +14,6 @@ type LaunchAgentSessionContinuationArgs = {
   prompt: string
   worktreeId: string
   groupId?: string | null
-  workspacePath: string
   initialCwd?: string | null
   launchSource: LaunchSource
 }
@@ -73,7 +71,6 @@ export async function launchAgentSessionContinuation({
   prompt,
   worktreeId,
   groupId,
-  workspacePath,
   initialCwd,
   launchSource
 }: LaunchAgentSessionContinuationArgs): Promise<boolean> {
@@ -81,9 +78,6 @@ export async function launchAgentSessionContinuation({
     return false
   }
 
-  const connectionId = getConnectionIdFromState(useAppStore.getState(), worktreeId)
-  await preflightAgentTrust({ agent, workspacePath, connectionId })
-
   const label = getAgentLabel(agent)
   // Why: the paste helper writes blind when the agent's composer was never observed, so a
   // written prompt is not a delivered one. Claiming success there is how the whole handoff
diff --git a/src/renderer/src/lib/launch-structured-agent-session.test.ts b/src/renderer/src/lib/launch-structured-agent-session.test.ts
index 56f759da925..a4a462313ac 100644
--- a/src/renderer/src/lib/launch-structured-agent-session.test.ts
+++ b/src/renderer/src/lib/launch-structured-agent-session.test.ts
@@ -3,7 +3,6 @@ import { structuredAgentSessionPayloadFingerprint } from '../../../shared/struct
 import { callStructuredAgentSession } from '@/runtime/structured-agent-session-client'
 import {
   createStructuredAgentSessionLaunchIntent,
-  isDefinitiveStructuredAgentSessionCreateError,
   launchStructuredAgentSession,
   StructuredAgentSessionCreateRefusalError,
   StructuredAgentSessionCreateUnknownOutcomeError
@@ -266,7 +265,6 @@ describe('structured agent session launch', () => {
     expect(error).toBeInstanceOf(StructuredAgentSessionCreateUnknownOutcomeError)
     expect(error).not.toBeInstanceOf(StructuredAgentSessionCreateRefusalError)
     expect(error).toMatchObject({ code: 'agent_session_operation_unknown' })
-    expect(isDefinitiveStructuredAgentSessionCreateError(error)).toBe(false)
   })
 
   /** The class is the verdict, so a refusal message that happens to end in a definitive token
@@ -285,7 +283,6 @@ describe('structured agent session launch', () => {
     ).catch((caught: unknown) => caught)
 
     expect(error).toBeInstanceOf(StructuredAgentSessionCreateUnknownOutcomeError)
-    expect(isDefinitiveStructuredAgentSessionCreateError(error)).toBe(false)
   })
 
   it('preserves a definitive refusal code for the fallback path', async () => {
@@ -303,7 +300,6 @@ describe('structured agent session launch', () => {
 
     expect(error).toBeInstanceOf(StructuredAgentSessionCreateRefusalError)
     expect(error).toMatchObject({ code: 'structured_agent_session_unsupported' })
-    expect(isDefinitiveStructuredAgentSessionCreateError(error)).toBe(true)
   })
 
   it.each(['method_not_found', 'structured_agent_session_unsupported'])(
@@ -330,6 +326,5 @@ describe('structured agent session launch', () => {
     ).catch((caught: unknown) => caught)
 
     expect(transportError).not.toBeInstanceOf(StructuredAgentSessionCreateRefusalError)
-    expect(isDefinitiveStructuredAgentSessionCreateError(transportError)).toBe(false)
   })
 })
diff --git a/src/renderer/src/lib/launch-structured-agent-session.ts b/src/renderer/src/lib/launch-structured-agent-session.ts
index 73d274a7bdc..3f2ef6f1eeb 100644
--- a/src/renderer/src/lib/launch-structured-agent-session.ts
+++ b/src/renderer/src/lib/launch-structured-agent-session.ts
@@ -12,6 +12,11 @@ import {
 import { resolveStructuredLaunchSeedOptions } from '../../../shared/native-chat-session-option-defaults'
 import { hasRuntimeRpcErrorCode } from '../../../shared/runtime-rpc-error-code'
 import { isDefinitiveAgentSessionCreateRefusal } from '../../../shared/agent-session-definitive-refusal'
+import {
+  readAgentSessionRefusalReference,
+  type AgentSessionRefusalReference
+} from '../../../shared/agent-session-wire-refusals'
+import { readAgentSessionErrorRefusal } from '../../../shared/agent-session-write-failure'
 import { callStructuredAgentSession } from '@/runtime/structured-agent-session-client'
 import { toRuntimeWorktreeSelector } from '@/runtime/runtime-worktree-selector'
 import { useAppStore } from '@/store'
@@ -21,6 +26,7 @@ import {
   resolveWebSessionVisibleTabId
 } from '@/runtime/web-session-focus-intent'
 import { LOCAL_STRUCTURED_SESSION_OWNER } from '@/runtime/local-structured-session-owner'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export type StructuredAgentSessionLaunchIntent = {
   sessionId: string
@@ -46,7 +52,9 @@ class StructuredAgentSessionCreateError extends Error {
   constructor(
     message: string,
     /** The wire refusal code, or the RPC error code when the create never reached a handler. */
-    readonly code: string
+    readonly code: string,
+    /** The host's refusal as a reader may word it; absent from an older host or a local failure. */
+    readonly refusal?: AgentSessionRefusalReference
   ) {
     super(message)
   }
@@ -57,8 +65,12 @@ class StructuredAgentSessionCreateError extends Error {
  * `launchStructuredAgentSession` is the only place that decides it against the shared allowlist.
  */
 export class StructuredAgentSessionCreateRefusalError extends StructuredAgentSessionCreateError {
-  constructor(message: string, code: string = 'structured_agent_session_unsupported') {
-    super(message, code)
+  constructor(
+    message: string,
+    code: string = 'structured_agent_session_unsupported',
+    refusal?: AgentSessionRefusalReference
+  ) {
+    super(message, code, refusal)
     this.name = 'StructuredAgentSessionCreateRefusalError'
   }
 }
@@ -69,8 +81,8 @@ export class StructuredAgentSessionCreateRefusalError extends StructuredAgentSes
  * down the same path as a lost reply, which replays the intent and reconciles.
  */
 export class StructuredAgentSessionCreateUnknownOutcomeError extends StructuredAgentSessionCreateError {
-  constructor(message: string, code: string) {
-    super(message, code)
+  constructor(message: string, code: string, refusal?: AgentSessionRefusalReference) {
+    super(message, code, refusal)
     this.name = 'StructuredAgentSessionCreateUnknownOutcomeError'
   }
 }
@@ -96,16 +108,12 @@ function definitiveStructuredAgentSessionCreateErrorCode(error: unknown): string
   return null
 }
 
-export function isDefinitiveStructuredAgentSessionCreateError(error: unknown): boolean {
-  return definitiveStructuredAgentSessionCreateErrorCode(error) !== null
-}
-
 export function createStructuredAgentSessionLaunchIntent(
   worktreeId: string,
   agent: AgentSessionHandleProvider,
   resumeFrom?: StructuredAgentSessionResumeSource
 ): StructuredAgentSessionLaunchIntent {
-  const sessionId = createStructuredAgentSessionId(agent, () => crypto.randomUUID())
+  const sessionId = createStructuredAgentSessionId(agent, createBrowserUuid)
   return buildStructuredAgentSessionLaunchIntent(worktreeId, agent, sessionId, resumeFrom)
 }
 
@@ -132,7 +140,7 @@ function buildStructuredAgentSessionLaunchIntent(
       worktree: toRuntimeWorktreeSelector(worktreeId),
       agent,
       ...(resumeFrom ? { resumeFrom } : {}),
-      randomUuid: () => crypto.randomUUID()
+      randomUuid: createBrowserUuid
     }),
     ...launchSeedOptions(state, agent)
   }
@@ -251,7 +259,8 @@ async function hostSupportsCreate(intent: StructuredAgentSessionLaunchIntent): P
       }
       throw new StructuredAgentSessionCreateUnknownOutcomeError(
         error instanceof Error ? error.message : String(error),
-        code
+        code,
+        readAgentSessionErrorRefusal(error)
       )
     }
   }
@@ -290,20 +299,22 @@ export async function launchStructuredAgentSession(
       abandonStructuredAgentSessionLaunchIntent(intent)
       throw new StructuredAgentSessionCreateRefusalError(
         error instanceof Error ? error.message : String(error),
-        code
+        code,
+        readAgentSessionErrorRefusal(error)
       )
     }
     throw error
   }
   if (!result.ok) {
     const { code, message, ownerVerdict } = result.refusal
+    const refusal = readAgentSessionRefusalReference(result.refusal)
     // A failed operation whose provider is proven gone is a failure a new operation may retry.
     if (!isDefinitiveAgentSessionCreateRefusal(code) && ownerVerdict !== 'exited') {
       // Keep the focus intent: the session may exist, and recovery still has to adopt it.
-      throw new StructuredAgentSessionCreateUnknownOutcomeError(message, code)
+      throw new StructuredAgentSessionCreateUnknownOutcomeError(message, code, refusal)
     }
     abandonStructuredAgentSessionLaunchIntent(intent)
-    throw new StructuredAgentSessionCreateRefusalError(message, code)
+    throw new StructuredAgentSessionCreateRefusalError(message, code, refusal)
   }
   return { sessionId: result.value.sessionId, fence: result.value.fence }
 }
diff --git a/src/renderer/src/lib/launch-work-item-direct-agent-routing.test.ts b/src/renderer/src/lib/launch-work-item-direct-agent-routing.test.ts
index 0029507a33b..56e29c01b90 100644
--- a/src/renderer/src/lib/launch-work-item-direct-agent-routing.test.ts
+++ b/src/renderer/src/lib/launch-work-item-direct-agent-routing.test.ts
@@ -5,20 +5,15 @@ type BeginArgs = { beforeOpen: (sessionId: string) => boolean | void }
 
 const mocks = vi.hoisted(() => ({
   beginStructuredAgentSessionProvisionalLaunch:
-    vi.fn<(args: BeginArgs) => { sessionId: string; tab: { id: string } } | null>(),
-  preflightAgentTrust: vi.fn<(args: unknown) => Promise<void>>()
+    vi.fn<(args: BeginArgs) => { sessionId: string; tab: { id: string } } | null>()
 }))
 
 vi.mock('@/lib/structured-agent-session-provisional-tab', () => ({
   beginStructuredAgentSessionProvisionalLaunch: mocks.beginStructuredAgentSessionProvisionalLaunch
 }))
-vi.mock('@/lib/agent-trust-preflight', () => ({ preflightAgentTrust: mocks.preflightAgentTrust }))
 
 import { adoptAgentSessionLaunchVerdict } from './agent-session-launch-plan'
-import {
-  beginDirectWorkItemStructuredLaunch,
-  markDirectWorkItemAgentTrusted
-} from './launch-work-item-direct-agent-routing'
+import { beginDirectWorkItemStructuredLaunch } from './launch-work-item-direct-agent-routing'
 
 const structuredPlan: AgentSessionLaunchPlan = adoptAgentSessionLaunchVerdict({
   route: 'structured-native-chat',
@@ -31,7 +26,6 @@ const structuredPlan: AgentSessionLaunchPlan = adoptAgentSessionLaunchVerdict({
 describe('beginDirectWorkItemStructuredLaunch', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mocks.preflightAgentTrust.mockResolvedValue(undefined)
     mocks.beginStructuredAgentSessionProvisionalLaunch.mockImplementation((args) => {
       args.beforeOpen('session-1')
       return { sessionId: 'session-1', tab: { id: 'agent-session:session-1' } }
@@ -83,31 +77,3 @@ describe('beginDirectWorkItemStructuredLaunch', () => {
     expect(mocks.beginStructuredAgentSessionProvisionalLaunch).not.toHaveBeenCalled()
   })
 })
-
-describe('markDirectWorkItemAgentTrusted', () => {
-  beforeEach(() => vi.clearAllMocks())
-
-  it('preflights trust only for the legacy terminal route', async () => {
-    await markDirectWorkItemAgentTrusted({
-      structuredLaunch: false,
-      agent: 'codex',
-      workspacePath: '/repo/worktree',
-      connectionId: 'ssh-1'
-    })
-    expect(mocks.preflightAgentTrust).toHaveBeenCalledWith({
-      agent: 'codex',
-      workspacePath: '/repo/worktree',
-      connectionId: 'ssh-1'
-    })
-  })
-
-  it('leaves trust to the structured provider', async () => {
-    await markDirectWorkItemAgentTrusted({
-      structuredLaunch: true,
-      agent: 'codex',
-      workspacePath: '/repo/worktree',
-      connectionId: null
-    })
-    expect(mocks.preflightAgentTrust).not.toHaveBeenCalled()
-  })
-})
diff --git a/src/renderer/src/lib/launch-work-item-direct-agent-routing.ts b/src/renderer/src/lib/launch-work-item-direct-agent-routing.ts
index 08396c353e4..cbf080f1256 100644
--- a/src/renderer/src/lib/launch-work-item-direct-agent-routing.ts
+++ b/src/renderer/src/lib/launch-work-item-direct-agent-routing.ts
@@ -6,7 +6,6 @@ import { buildDirectWorkItemAgentStartupPlan } from '@/lib/launch-work-item-dire
 import type { AgentSessionLaunchPlan } from '@/lib/agent-session-launch-plan'
 import { isNativeChatTranscriptLocalReadable } from '@/lib/native-chat-transcript-readability'
 import { resolveSourceControlLaunchPlatform } from '@/lib/source-control-launch-platform'
-import { preflightAgentTrust } from '@/lib/agent-trust-preflight'
 import { beginStructuredAgentSessionProvisionalLaunch } from '@/lib/structured-agent-session-provisional-tab'
 
 export function buildDirectWorkItemStartup(args: {
@@ -79,23 +78,6 @@ export async function resolveDirectWorkItemAgent(args: {
   }
 }
 
-/** Why: runs only before the legacy route; structured chat has no TUI trust menu. */
-export async function markDirectWorkItemAgentTrusted(args: {
-  structuredLaunch: boolean
-  agent: TuiAgent | null
-  workspacePath: string
-  connectionId: string | null
-}): Promise<void> {
-  if (args.structuredLaunch) {
-    return
-  }
-  await preflightAgentTrust({
-    agent: args.agent,
-    workspacePath: args.workspacePath,
-    connectionId: args.connectionId
-  })
-}
-
 export function beginDirectWorkItemStructuredLaunch(args: {
   plan: AgentSessionLaunchPlan | null
   primaryTabId: string | null
diff --git a/src/renderer/src/lib/launch-work-item-direct-route-preparation.ts b/src/renderer/src/lib/launch-work-item-direct-route-preparation.ts
index e81dbf4b411..96ea10d91ec 100644
--- a/src/renderer/src/lib/launch-work-item-direct-route-preparation.ts
+++ b/src/renderer/src/lib/launch-work-item-direct-route-preparation.ts
@@ -9,7 +9,6 @@ import type {
 } from '@/lib/agent-session-launch-plan'
 import {
   buildDirectWorkItemStartup,
-  markDirectWorkItemAgentTrusted,
   resolveDirectWorkItemAgent
 } from '@/lib/launch-work-item-direct-agent-routing'
 
@@ -102,13 +101,6 @@ export async function prepareDirectWorkItemAgentLaunch(args: {
         })
   const structuredLaunch = plan?.route === 'structured-native-chat'
 
-  await markDirectWorkItemAgentTrusted({
-    structuredLaunch,
-    agent: effectiveAgent,
-    workspacePath: args.worktreePath,
-    connectionId: args.repoConnectionId
-  })
-
   return {
     launchConnectionId,
     unavailable: false,
diff --git a/src/renderer/src/lib/launch-work-item-direct.test.ts b/src/renderer/src/lib/launch-work-item-direct.test.ts
index 39d774efbb3..5b6686774bc 100644
--- a/src/renderer/src/lib/launch-work-item-direct.test.ts
+++ b/src/renderer/src/lib/launch-work-item-direct.test.ts
@@ -136,9 +136,6 @@ import { pickTuiAgent } from '../../../shared/tui-agent-selection'
 const mockApi = {
   worktrees: {
     resolvePrBase: mocks.resolvePrBase
-  },
-  agentTrust: {
-    markTrusted: vi.fn()
   }
 }
 
@@ -149,9 +146,6 @@ describe('launchWorkItemDirect', () => {
       api: {
         worktrees: {
           resolvePrBase: mocks.resolvePrBase
-        },
-        agentTrust: {
-          markTrusted: mockApi.agentTrust.markTrusted
         }
       }
     })
@@ -210,7 +204,6 @@ describe('launchWorkItemDirect', () => {
     } as typeof mocks.store
     // @ts-expect-error -- test shim
     globalThis.window = { api: mockApi }
-    mockApi.agentTrust.markTrusted.mockResolvedValue(undefined)
   })
 
   it('rejects invalid per-launch CLI arguments before creating a workspace', async () => {
@@ -593,7 +586,7 @@ describe('launchWorkItemDirect', () => {
     expect(mocks.seedNativeChatLaunchDraft).not.toHaveBeenCalled()
   })
 
-  it('uses remote cursor-agent detection, trust preflight, and paste launch for SSH repos', async () => {
+  it('uses remote cursor-agent detection and paste launch for SSH repos', async () => {
     mocks.store.repos = [
       {
         id: 'repo-ssh',
@@ -634,11 +627,6 @@ describe('launchWorkItemDirect', () => {
 
     expect(mocks.store.ensureDetectedAgents).not.toHaveBeenCalled()
     expect(mocks.store.ensureRemoteDetectedAgents).toHaveBeenCalledWith('ssh-1')
-    expect(mockApi.agentTrust.markTrusted).toHaveBeenCalledWith({
-      preset: 'cursor',
-      workspacePath: '/home/orca/repo-worktrees/issue-77',
-      connectionId: 'ssh-1'
-    })
     expect(buildAgentDraftLaunchPlan).toHaveBeenCalledWith({
       agent: 'cursor',
       draft: 'https://github.com/acme/repo/issues/77',
diff --git a/src/renderer/src/lib/linear-issue-workspace-open.test.ts b/src/renderer/src/lib/linear-issue-workspace-open.test.ts
index 86a72ab4df9..e455c52308a 100644
--- a/src/renderer/src/lib/linear-issue-workspace-open.test.ts
+++ b/src/renderer/src/lib/linear-issue-workspace-open.test.ts
@@ -87,6 +87,7 @@ describe('openLinearIssueWorkspaceOrStart', () => {
 
     expect(openLinearIssueWorkspaceOrStart({ identifier: 'ENG-1' }, vi.fn())).toBe('opened')
     expect(mocks.activateAndRevealWorktree).toHaveBeenCalledWith('worktree-1', {
+      navigationIntent: 'user-open',
       executionHostId: 'ssh:builder'
     })
   })
@@ -97,6 +98,7 @@ describe('openLinearIssueWorkspaceOrStart', () => {
 
     expect(openLinearIssueWorkspaceOrStart({ identifier: 'ENG-1' }, startWorkspace)).toBe('opened')
     expect(mocks.activateAndRevealFolderWorkspace).toHaveBeenCalledWith('folder-1', {
+      navigationIntent: 'user-open',
       executionHostId: 'local'
     })
     expect(startWorkspace).not.toHaveBeenCalled()
diff --git a/src/renderer/src/lib/linear-issue-workspace-open.ts b/src/renderer/src/lib/linear-issue-workspace-open.ts
index 4b838176f44..63d2944c180 100644
--- a/src/renderer/src/lib/linear-issue-workspace-open.ts
+++ b/src/renderer/src/lib/linear-issue-workspace-open.ts
@@ -35,14 +35,14 @@ export function openLinearIssueWorkspaceOrStart(
   const workspaceScope = parseWorkspaceKey(attached.id)
   const activation =
     workspaceScope?.type === 'folder'
-      ? activateAndRevealFolderWorkspace(
-          workspaceScope.folderWorkspaceId,
-          attached.hostId ? { executionHostId: attached.hostId } : undefined
-        )
-      : activateAndRevealWorktree(
-          attached.id,
-          attached.hostId ? { executionHostId: attached.hostId } : {}
-        )
+      ? activateAndRevealFolderWorkspace(workspaceScope.folderWorkspaceId, {
+          navigationIntent: 'user-open',
+          ...(attached.hostId ? { executionHostId: attached.hostId } : {})
+        })
+      : activateAndRevealWorktree(attached.id, {
+          navigationIntent: 'user-open',
+          ...(attached.hostId ? { executionHostId: attached.hostId } : {})
+        })
   if (activation === false) {
     toast.error(
       translate(
diff --git a/src/renderer/src/lib/markdown-review-notes.test.ts b/src/renderer/src/lib/markdown-review-notes.test.ts
index 8de37bd7051..f310a5497c6 100644
--- a/src/renderer/src/lib/markdown-review-notes.test.ts
+++ b/src/renderer/src/lib/markdown-review-notes.test.ts
@@ -132,15 +132,6 @@ describe('markdown review notes', () => {
     expect(checks).toBeLessThanOrEqual(2)
   })
 
-  it('prefers exact selected text for card highlights', () => {
-    const highlighted = getMarkdownReviewHighlightedText(
-      'one\ntwo broad line\nthree',
-      note({ selectedText: 'broad' })
-    )
-
-    expect(highlighted).toBe('broad')
-  })
-
   it('falls back to unquoted line context for card highlights', () => {
     const highlighted = getMarkdownReviewHighlightedText(
       'one\ntwo\nthree',
diff --git a/src/renderer/src/lib/monaco-filename-language.test.ts b/src/renderer/src/lib/monaco-filename-language.test.ts
new file mode 100644
index 00000000000..013e9cc7f17
--- /dev/null
+++ b/src/renderer/src/lib/monaco-filename-language.test.ts
@@ -0,0 +1,64 @@
+import { describe, expect, it } from 'vitest'
+import { detectLanguage } from './language-detect'
+import { detectMonacoFilenameLanguage } from './monaco-filename-language'
+import associations from './monaco-language-associations.json'
+
+describe('Monaco filename detection', () => {
+  it.each([
+    ['contracts/Vault.sol', 'sol'],
+    ['infra/main.bicep', 'bicep'],
+    ['queries/query.cypher', 'cypher'],
+    ['scripts/run.fsx', 'fsharp'],
+    ['shaders/main.wgsl', 'wgsl'],
+    ['docs/guide.rst', 'restructuredtext'],
+    ['C:\\workspace\\main.TcPOU', 'st'],
+    ['\\\\host\\share\\main.ML', 'fsharp'],
+    ['/remote/folder workspace/main.pas', 'pascal'],
+    ['templates/page.ftl', 'freemarker2'],
+    ['config/.babelrc', 'json'],
+    ['Gemfile', 'ruby'],
+    ['include/header.hxx', 'cpp'],
+    ['script.es6', 'javascript'],
+    ['script.pp', 'ruby']
+  ])('detects %s using built-in metadata', (path, language) => {
+    expect(detectLanguage(path)).toBe(language)
+  })
+
+  it('recognizes every unambiguous upstream extension and filename', () => {
+    for (const language of associations) {
+      for (const extension of language.extensions) {
+        const owners = associations.filter((entry) =>
+          entry.extensions.some((candidate) => candidate.toLowerCase() === extension.toLowerCase())
+        )
+        if (owners.length === 1) {
+          expect(detectMonacoFilenameLanguage(`sample${extension}`)).toBe(language.id)
+        }
+      }
+      for (const filename of language.filenames) {
+        expect(detectMonacoFilenameLanguage(filename)).toBe(language.id)
+      }
+    }
+  })
+
+  it.each([
+    ['file.mdx', 'markdown'],
+    ['file.tsx', 'typescript'],
+    ['file.jsonl', 'jsonl'],
+    ['file.ipynb', 'notebook'],
+    ['file.vue', 'vue'],
+    ['file.svelte', 'svelte'],
+    ['file.astro', 'astro'],
+    ['file.typ', 'typst'],
+    ['file.nim', 'nim'],
+    ['file.h', 'c'],
+    ['.env.staging', 'ini'],
+    ['file.unknown', 'plaintext'],
+    ['folder.sol/README', 'plaintext'],
+    ['folder.sol\\README', 'plaintext'],
+    ['constructor', 'plaintext'],
+    ['toString', 'plaintext'],
+    ['__proto__', 'plaintext']
+  ])('preserves Orca behavior for %s', (path, language) => {
+    expect(detectLanguage(path)).toBe(language)
+  })
+})
diff --git a/src/renderer/src/lib/monaco-filename-language.ts b/src/renderer/src/lib/monaco-filename-language.ts
new file mode 100644
index 00000000000..c8fc6d54d3d
--- /dev/null
+++ b/src/renderer/src/lib/monaco-filename-language.ts
@@ -0,0 +1,25 @@
+import associations from './monaco-language-associations.json'
+
+// Generated metadata avoids importing Monaco during session restoration.
+const filenames = new Map<string, string>()
+const extensions = new Map<string, string>()
+// Like Monaco, later registrations win ambiguous associations such as .pp.
+for (const language of associations) {
+  for (const filename of language.filenames) {
+    filenames.set(filename.toLowerCase(), language.id)
+  }
+  for (const extension of language.extensions) {
+    extensions.set(extension.toLowerCase(), language.id)
+  }
+}
+const suffixes = [...extensions.keys()].sort((a, b) => b.length - a.length)
+
+export function detectMonacoFilenameLanguage(filename: string): string | undefined {
+  const lowerName = filename.toLowerCase()
+  const exact = filenames.get(lowerName)
+  if (exact) {
+    return exact
+  }
+  const suffix = suffixes.find((extension) => lowerName.endsWith(extension))
+  return suffix ? extensions.get(suffix) : undefined
+}
diff --git a/src/renderer/src/lib/monaco-language-associations.json b/src/renderer/src/lib/monaco-language-associations.json
new file mode 100644
index 00000000000..6effc005140
--- /dev/null
+++ b/src/renderer/src/lib/monaco-language-associations.json
@@ -0,0 +1,470 @@
+[
+  {
+    "id": "json",
+    "extensions": [".json", ".bowerrc", ".jshintrc", ".jscsrc", ".eslintrc", ".babelrc", ".har"],
+    "filenames": []
+  },
+  {
+    "id": "abap",
+    "extensions": [".abap"],
+    "filenames": []
+  },
+  {
+    "id": "apex",
+    "extensions": [".cls"],
+    "filenames": []
+  },
+  {
+    "id": "azcli",
+    "extensions": [".azcli"],
+    "filenames": []
+  },
+  {
+    "id": "bat",
+    "extensions": [".bat", ".cmd"],
+    "filenames": []
+  },
+  {
+    "id": "bicep",
+    "extensions": [".bicep"],
+    "filenames": []
+  },
+  {
+    "id": "cameligo",
+    "extensions": [".mligo"],
+    "filenames": []
+  },
+  {
+    "id": "clojure",
+    "extensions": [".clj", ".cljs", ".cljc", ".edn"],
+    "filenames": []
+  },
+  {
+    "id": "coffeescript",
+    "extensions": [".coffee"],
+    "filenames": []
+  },
+  {
+    "id": "c",
+    "extensions": [".c", ".h"],
+    "filenames": []
+  },
+  {
+    "id": "cpp",
+    "extensions": [".cpp", ".cc", ".cxx", ".hpp", ".hh", ".hxx"],
+    "filenames": []
+  },
+  {
+    "id": "csharp",
+    "extensions": [".cs", ".csx", ".cake"],
+    "filenames": []
+  },
+  {
+    "id": "csp",
+    "extensions": [".csp"],
+    "filenames": []
+  },
+  {
+    "id": "css",
+    "extensions": [".css"],
+    "filenames": []
+  },
+  {
+    "id": "cypher",
+    "extensions": [".cypher", ".cyp"],
+    "filenames": []
+  },
+  {
+    "id": "dart",
+    "extensions": [".dart"],
+    "filenames": []
+  },
+  {
+    "id": "dockerfile",
+    "extensions": [".dockerfile"],
+    "filenames": ["Dockerfile"]
+  },
+  {
+    "id": "ecl",
+    "extensions": [".ecl"],
+    "filenames": []
+  },
+  {
+    "id": "elixir",
+    "extensions": [".ex", ".exs"],
+    "filenames": []
+  },
+  {
+    "id": "flow9",
+    "extensions": [".flow"],
+    "filenames": []
+  },
+  {
+    "id": "fsharp",
+    "extensions": [".fs", ".fsi", ".ml", ".mli", ".fsx", ".fsscript"],
+    "filenames": []
+  },
+  {
+    "id": "freemarker2",
+    "extensions": [".ftl", ".ftlh", ".ftlx"],
+    "filenames": []
+  },
+  {
+    "id": "freemarker2.tag-angle.interpolation-dollar",
+    "extensions": [],
+    "filenames": []
+  },
+  {
+    "id": "freemarker2.tag-bracket.interpolation-dollar",
+    "extensions": [],
+    "filenames": []
+  },
+  {
+    "id": "freemarker2.tag-angle.interpolation-bracket",
+    "extensions": [],
+    "filenames": []
+  },
+  {
+    "id": "freemarker2.tag-bracket.interpolation-bracket",
+    "extensions": [],
+    "filenames": []
+  },
+  {
+    "id": "freemarker2.tag-auto.interpolation-dollar",
+    "extensions": [],
+    "filenames": []
+  },
+  {
+    "id": "freemarker2.tag-auto.interpolation-bracket",
+    "extensions": [],
+    "filenames": []
+  },
+  {
+    "id": "go",
+    "extensions": [".go"],
+    "filenames": []
+  },
+  {
+    "id": "graphql",
+    "extensions": [".graphql", ".gql"],
+    "filenames": []
+  },
+  {
+    "id": "handlebars",
+    "extensions": [".handlebars", ".hbs"],
+    "filenames": []
+  },
+  {
+    "id": "hcl",
+    "extensions": [".tf", ".tfvars", ".hcl"],
+    "filenames": []
+  },
+  {
+    "id": "html",
+    "extensions": [".html", ".htm", ".shtml", ".xhtml", ".mdoc", ".jsp", ".asp", ".aspx", ".jshtm"],
+    "filenames": []
+  },
+  {
+    "id": "ini",
+    "extensions": [".ini", ".properties", ".gitconfig"],
+    "filenames": ["config", ".gitattributes", ".gitconfig", ".editorconfig"]
+  },
+  {
+    "id": "java",
+    "extensions": [".java", ".jav"],
+    "filenames": []
+  },
+  {
+    "id": "javascript",
+    "extensions": [".js", ".es6", ".jsx", ".mjs", ".cjs"],
+    "filenames": ["jakefile"]
+  },
+  {
+    "id": "julia",
+    "extensions": [".jl"],
+    "filenames": []
+  },
+  {
+    "id": "kotlin",
+    "extensions": [".kt", ".kts"],
+    "filenames": []
+  },
+  {
+    "id": "less",
+    "extensions": [".less"],
+    "filenames": []
+  },
+  {
+    "id": "lexon",
+    "extensions": [".lex"],
+    "filenames": []
+  },
+  {
+    "id": "lua",
+    "extensions": [".lua"],
+    "filenames": []
+  },
+  {
+    "id": "liquid",
+    "extensions": [".liquid", ".html.liquid"],
+    "filenames": []
+  },
+  {
+    "id": "m3",
+    "extensions": [".m3", ".i3", ".mg", ".ig"],
+    "filenames": []
+  },
+  {
+    "id": "markdown",
+    "extensions": [".md", ".markdown", ".mdown", ".mkdn", ".mkd", ".mdwn", ".mdtxt", ".mdtext"],
+    "filenames": []
+  },
+  {
+    "id": "mdx",
+    "extensions": [".mdx"],
+    "filenames": []
+  },
+  {
+    "id": "mips",
+    "extensions": [".s"],
+    "filenames": []
+  },
+  {
+    "id": "msdax",
+    "extensions": [".dax", ".msdax"],
+    "filenames": []
+  },
+  {
+    "id": "mysql",
+    "extensions": [],
+    "filenames": []
+  },
+  {
+    "id": "objective-c",
+    "extensions": [".m"],
+    "filenames": []
+  },
+  {
+    "id": "pascal",
+    "extensions": [".pas", ".p", ".pp"],
+    "filenames": []
+  },
+  {
+    "id": "pascaligo",
+    "extensions": [".ligo"],
+    "filenames": []
+  },
+  {
+    "id": "perl",
+    "extensions": [".pl", ".pm"],
+    "filenames": []
+  },
+  {
+    "id": "pgsql",
+    "extensions": [],
+    "filenames": []
+  },
+  {
+    "id": "php",
+    "extensions": [".php", ".php4", ".php5", ".phtml", ".ctp"],
+    "filenames": []
+  },
+  {
+    "id": "pla",
+    "extensions": [".pla"],
+    "filenames": []
+  },
+  {
+    "id": "postiats",
+    "extensions": [".dats", ".sats", ".hats"],
+    "filenames": []
+  },
+  {
+    "id": "powerquery",
+    "extensions": [".pq", ".pqm"],
+    "filenames": []
+  },
+  {
+    "id": "powershell",
+    "extensions": [".ps1", ".psm1", ".psd1"],
+    "filenames": []
+  },
+  {
+    "id": "proto",
+    "extensions": [".proto"],
+    "filenames": []
+  },
+  {
+    "id": "pug",
+    "extensions": [".jade", ".pug"],
+    "filenames": []
+  },
+  {
+    "id": "python",
+    "extensions": [".py", ".rpy", ".pyw", ".cpy", ".gyp", ".gypi"],
+    "filenames": []
+  },
+  {
+    "id": "qsharp",
+    "extensions": [".qs"],
+    "filenames": []
+  },
+  {
+    "id": "r",
+    "extensions": [".r", ".rhistory", ".rmd", ".rprofile", ".rt"],
+    "filenames": []
+  },
+  {
+    "id": "razor",
+    "extensions": [".cshtml"],
+    "filenames": []
+  },
+  {
+    "id": "redis",
+    "extensions": [".redis"],
+    "filenames": []
+  },
+  {
+    "id": "redshift",
+    "extensions": [],
+    "filenames": []
+  },
+  {
+    "id": "restructuredtext",
+    "extensions": [".rst"],
+    "filenames": []
+  },
+  {
+    "id": "ruby",
+    "extensions": [".rb", ".rbx", ".rjs", ".gemspec", ".pp"],
+    "filenames": ["rakefile", "Gemfile"]
+  },
+  {
+    "id": "rust",
+    "extensions": [".rs", ".rlib"],
+    "filenames": []
+  },
+  {
+    "id": "sb",
+    "extensions": [".sb"],
+    "filenames": []
+  },
+  {
+    "id": "scala",
+    "extensions": [".scala", ".sc", ".sbt"],
+    "filenames": []
+  },
+  {
+    "id": "scheme",
+    "extensions": [".scm", ".ss", ".sch", ".rkt"],
+    "filenames": []
+  },
+  {
+    "id": "scss",
+    "extensions": [".scss"],
+    "filenames": []
+  },
+  {
+    "id": "shell",
+    "extensions": [".sh", ".bash"],
+    "filenames": []
+  },
+  {
+    "id": "sol",
+    "extensions": [".sol"],
+    "filenames": []
+  },
+  {
+    "id": "aes",
+    "extensions": [".aes"],
+    "filenames": []
+  },
+  {
+    "id": "sparql",
+    "extensions": [".rq"],
+    "filenames": []
+  },
+  {
+    "id": "sql",
+    "extensions": [".sql"],
+    "filenames": []
+  },
+  {
+    "id": "st",
+    "extensions": [".st", ".iecst", ".iecplc", ".lc3lib", ".TcPOU", ".TcDUT", ".TcGVL", ".TcIO"],
+    "filenames": []
+  },
+  {
+    "id": "swift",
+    "extensions": [".swift"],
+    "filenames": []
+  },
+  {
+    "id": "systemverilog",
+    "extensions": [".sv", ".svh"],
+    "filenames": []
+  },
+  {
+    "id": "verilog",
+    "extensions": [".v", ".vh"],
+    "filenames": []
+  },
+  {
+    "id": "tcl",
+    "extensions": [".tcl"],
+    "filenames": []
+  },
+  {
+    "id": "twig",
+    "extensions": [".twig"],
+    "filenames": []
+  },
+  {
+    "id": "typescript",
+    "extensions": [".ts", ".tsx", ".cts", ".mts"],
+    "filenames": []
+  },
+  {
+    "id": "typespec",
+    "extensions": [".tsp"],
+    "filenames": []
+  },
+  {
+    "id": "vb",
+    "extensions": [".vb"],
+    "filenames": []
+  },
+  {
+    "id": "wgsl",
+    "extensions": [".wgsl"],
+    "filenames": []
+  },
+  {
+    "id": "xml",
+    "extensions": [
+      ".xml",
+      ".xsd",
+      ".dtd",
+      ".ascx",
+      ".csproj",
+      ".config",
+      ".props",
+      ".targets",
+      ".wxi",
+      ".wxl",
+      ".wxs",
+      ".xaml",
+      ".svg",
+      ".svgz",
+      ".opf",
+      ".xslt",
+      ".xsl"
+    ],
+    "filenames": []
+  },
+  {
+    "id": "yaml",
+    "extensions": [".yaml", ".yml"],
+    "filenames": []
+  }
+]
diff --git a/src/renderer/src/lib/monaco-languages/register-typst.test.ts b/src/renderer/src/lib/monaco-languages/register-typst.test.ts
new file mode 100644
index 00000000000..a3cdc96fe0a
--- /dev/null
+++ b/src/renderer/src/lib/monaco-languages/register-typst.test.ts
@@ -0,0 +1,76 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  TYPST_LANGUAGE_ID,
+  TYPST_TEXTMATE_SCOPE,
+  loadTypstTextMateGrammar,
+  registerTypstLanguage
+} from './register-typst'
+
+function createMonacoMock(languages: { id: string }[] = []) {
+  return {
+    languages: {
+      getLanguages: vi.fn(() => languages),
+      register: vi.fn((language: { id: string }) => languages.push(language)),
+      setLanguageConfiguration: vi.fn(),
+      registerTokensProviderFactory: vi.fn()
+    }
+  }
+}
+
+describe('registerTypstLanguage', () => {
+  it('registers Typst with its extension, TextMate scope, and editor configuration', () => {
+    const monaco = createMonacoMock()
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the mock exercises only the four languages.* calls this registration touches; the full Monaco module type cannot be satisfied structurally.
+    registerTypstLanguage(monaco as never)
+
+    expect(monaco.languages.register).toHaveBeenCalledWith({
+      id: TYPST_LANGUAGE_ID,
+      extensions: ['.typ'],
+      aliases: ['Typst', 'typst']
+    })
+    expect(monaco.languages.setLanguageConfiguration).toHaveBeenCalledWith(
+      TYPST_LANGUAGE_ID,
+      expect.objectContaining({
+        comments: { lineComment: '//', blockComment: ['/*', '*/'] },
+        brackets: [
+          ['{', '}'],
+          ['[', ']'],
+          ['(', ')']
+        ]
+      })
+    )
+    expect(monaco.languages.registerTokensProviderFactory).toHaveBeenCalledWith(
+      TYPST_LANGUAGE_ID,
+      expect.objectContaining({ create: expect.any(Function) })
+    )
+  })
+
+  it('does not register Typst twice', () => {
+    const monaco = createMonacoMock()
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only the mocked languages API is used.
+    registerTypstLanguage(monaco as never)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only the mocked languages API is used.
+    registerTypstLanguage(monaco as never)
+
+    expect(monaco.languages.register).toHaveBeenCalledTimes(1)
+    expect(monaco.languages.setLanguageConfiguration).toHaveBeenCalledTimes(1)
+    expect(monaco.languages.registerTokensProviderFactory).toHaveBeenCalledTimes(1)
+  })
+})
+
+describe('loadTypstTextMateGrammar', () => {
+  it('lazily loads the vendored Typst grammar for the Typst scope', async () => {
+    const grammar = await loadTypstTextMateGrammar(TYPST_TEXTMATE_SCOPE)
+
+    expect(grammar).toMatchObject({
+      name: 'typst',
+      scopeName: TYPST_TEXTMATE_SCOPE
+    })
+  })
+
+  it('ignores unrelated TextMate scopes', async () => {
+    await expect(loadTypstTextMateGrammar('source.python')).resolves.toBeNull()
+  })
+})
diff --git a/src/renderer/src/lib/monaco-languages/register-typst.ts b/src/renderer/src/lib/monaco-languages/register-typst.ts
new file mode 100644
index 00000000000..82f83e54a03
--- /dev/null
+++ b/src/renderer/src/lib/monaco-languages/register-typst.ts
@@ -0,0 +1,56 @@
+import type * as Monaco from 'monaco-editor'
+import type { IRawGrammar } from 'vscode-textmate'
+import { registerTextMateLanguage } from './textmate-language-registration'
+
+type MonacoModule = typeof Monaco
+
+export const TYPST_LANGUAGE_ID = 'typst'
+export const TYPST_TEXTMATE_SCOPE = 'source.typst'
+
+export const typstLanguageConfiguration: Monaco.languages.LanguageConfiguration = {
+  comments: {
+    lineComment: '//',
+    blockComment: ['/*', '*/']
+  },
+  brackets: [
+    ['{', '}'],
+    ['[', ']'],
+    ['(', ')']
+  ],
+  autoClosingPairs: [
+    { open: '{', close: '}' },
+    { open: '[', close: ']' },
+    { open: '(', close: ')' },
+    { open: '"', close: '"' }
+  ],
+  surroundingPairs: [
+    { open: '{', close: '}' },
+    { open: '[', close: ']' },
+    { open: '(', close: ')' },
+    { open: '"', close: '"' }
+  ]
+}
+
+export async function loadTypstTextMateGrammar(scopeName: string): Promise<IRawGrammar | null> {
+  if (scopeName !== TYPST_TEXTMATE_SCOPE) {
+    return null
+  }
+
+  // Lazy upstream grammar; provenance and Apache-2.0 license are in typst-LICENSE.txt.
+  const grammarModule = await import('./textmate-grammars/typst.tmLanguage.json')
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: TextMate injects the $self/$base repository entries required by IRawGrammar; real tokenization tests validate this vendored JSON.
+  return grammarModule.default as unknown as IRawGrammar
+}
+
+export function registerTypstLanguage(monaco: MonacoModule): void {
+  registerTextMateLanguage(monaco, {
+    language: {
+      id: TYPST_LANGUAGE_ID,
+      extensions: ['.typ'],
+      aliases: ['Typst', 'typst']
+    },
+    configuration: typstLanguageConfiguration,
+    scopeName: TYPST_TEXTMATE_SCOPE,
+    loadGrammar: loadTypstTextMateGrammar
+  })
+}
diff --git a/src/renderer/src/lib/monaco-languages/textmate-grammars/typst-LICENSE.txt b/src/renderer/src/lib/monaco-languages/textmate-grammars/typst-LICENSE.txt
new file mode 100644
index 00000000000..5c8e11a6e69
--- /dev/null
+++ b/src/renderer/src/lib/monaco-languages/textmate-grammars/typst-LICENSE.txt
@@ -0,0 +1,183 @@
+Typst
+
+Source: https://github.com/typst/typst/blob/9f2b6e8715237cb086899a42873660fe744622e8/tools/support/typst.tmLanguage.json
+Modifications by Orca: JSON formatting; line comments have opaque bodies;
+block comments nest only block comments; math reuses string and comment rules
+and consumes escapes before recognizing its closing dollar delimiter.
+
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
diff --git a/src/renderer/src/lib/monaco-languages/textmate-grammars/typst.tmLanguage.json b/src/renderer/src/lib/monaco-languages/textmate-grammars/typst.tmLanguage.json
new file mode 100644
index 00000000000..26c14b4c4f4
--- /dev/null
+++ b/src/renderer/src/lib/monaco-languages/textmate-grammars/typst.tmLanguage.json
@@ -0,0 +1,383 @@
+{
+  "comment": "Adapted by Orca: isolate comment nesting and protect strings, escapes, and comments inside math. See typst-LICENSE.txt for pinned upstream provenance.",
+  "name": "typst",
+  "patterns": [{ "include": "#markup" }],
+  "repository": {
+    "comments": {
+      "patterns": [
+        { "include": "#block-comment" },
+        {
+          "name": "comment.line.double-slash.typst",
+          "begin": "(?<!:)//",
+          "end": "\n",
+          "beginCaptures": { "0": { "name": "punctuation.definition.comment.typst" } }
+        }
+      ]
+    },
+    "common": {
+      "patterns": [{ "include": "#comments" }]
+    },
+    "markup": {
+      "patterns": [
+        { "include": "#common" },
+        {
+          "name": "constant.character.escape.content.typst",
+          "match": "\\\\([\\\\/\\[\\]{}#*_=~`$-.]|u\\{[0-9a-zA-Z]*\\}?)"
+        },
+        {
+          "name": "punctuation.definition.linebreak.typst",
+          "match": "\\\\"
+        },
+        {
+          "name": "punctuation.definition.nonbreaking-space.typst",
+          "match": "~"
+        },
+        {
+          "name": "punctuation.definition.shy.typst",
+          "match": "-\\?"
+        },
+        {
+          "name": "punctuation.definition.em-dash.typst",
+          "match": "---"
+        },
+        {
+          "name": "punctuation.definition.en-dash.typst",
+          "match": "--"
+        },
+        {
+          "name": "punctuation.definition.ellipsis.typst",
+          "match": "\\.\\.\\."
+        },
+        {
+          "name": "constant.symbol.typst",
+          "match": ":([a-zA-Z0-9]+:)+"
+        },
+        {
+          "name": "markup.bold.typst",
+          "begin": "(^\\*|\\*$|((?<=\\W|_)\\*)|(\\*(?=\\W|_)))",
+          "end": "(^\\*|\\*$|((?<=\\W|_)\\*)|(\\*(?=\\W|_)))|\n|(?=\\])",
+          "captures": { "0": { "name": "punctuation.definition.bold.typst" } },
+          "patterns": [{ "include": "#markup" }]
+        },
+        {
+          "name": "markup.italic.typst",
+          "begin": "(^_|_$|((?<=\\W|_)_)|(_(?=\\W|_)))",
+          "end": "(^_|_$|((?<=\\W|_)_)|(_(?=\\W|_)))|\n|(?=\\])",
+          "captures": { "0": { "name": "punctuation.definition.italic.typst" } },
+          "patterns": [{ "include": "#markup" }]
+        },
+        {
+          "name": "markup.underline.link.typst",
+          "match": "https?://[0-9a-zA-Z~/%#&=',;\\.\\+\\?]*"
+        },
+        {
+          "name": "markup.raw.block.typst",
+          "begin": "`{3,}",
+          "end": "\\0",
+          "captures": { "0": { "name": "punctuation.definition.raw.typst" } }
+        },
+        {
+          "name": "markup.raw.inline.typst",
+          "begin": "`",
+          "end": "`",
+          "captures": { "0": { "name": "punctuation.definition.raw.typst" } }
+        },
+        { "include": "#math" },
+        {
+          "name": "markup.heading.typst",
+          "contentName": "entity.name.section.typst",
+          "begin": "^\\s*=+\\s+",
+          "end": "\n|(?=<)",
+          "beginCaptures": { "0": { "name": "punctuation.definition.heading.typst" } },
+          "patterns": [{ "include": "#markup" }]
+        },
+        {
+          "name": "punctuation.definition.list.unnumbered.typst",
+          "match": "^\\s*-\\s+"
+        },
+        {
+          "name": "punctuation.definition.list.numbered.typst",
+          "match": "^\\s*([0-9]*\\.|\\+)\\s+"
+        },
+        {
+          "match": "^\\s*(/)\\s+([^:]*:)",
+          "captures": {
+            "1": { "name": "punctuation.definition.list.description.typst" },
+            "2": { "name": "markup.list.term.typst" }
+          }
+        },
+        {
+          "name": "entity.other.label.typst",
+          "match": "<[[:alpha:]_][[:alnum:]_-]*>",
+          "captures": { "1": { "name": "punctuation.definition.label.typst" } }
+        },
+        {
+          "name": "entity.other.reference.typst",
+          "match": "(@)[[:alpha:]_][[:alnum:]_-]*",
+          "captures": { "1": { "name": "punctuation.definition.reference.typst" } }
+        },
+        {
+          "begin": "(#)(let|set|show|context)\\b",
+          "end": "\n|(;)|(?=])",
+          "beginCaptures": {
+            "0": { "name": "keyword.other.typst" },
+            "1": { "name": "punctuation.definition.keyword.typst" }
+          },
+          "endCaptures": { "1": { "name": "punctuation.terminator.statement.typst" } },
+          "patterns": [{ "include": "#code" }]
+        },
+        {
+          "name": "keyword.other.typst",
+          "match": "(#)(as|in)\\b",
+          "captures": { "1": { "name": "punctuation.definition.keyword.typst" } }
+        },
+        {
+          "begin": "((#)if|(?<=(}|])\\s*)else)\\b",
+          "end": "\n|(?=])|(?<=}|])",
+          "beginCaptures": {
+            "0": { "name": "keyword.control.conditional.typst" },
+            "2": { "name": "punctuation.definition.keyword.typst" }
+          },
+          "patterns": [{ "include": "#code" }]
+        },
+        {
+          "begin": "(#)(for|while)\\b",
+          "end": "\n|(?=])|(?<=}|])",
+          "beginCaptures": {
+            "0": { "name": "keyword.control.loop.typst" },
+            "1": { "name": "punctuation.definition.keyword.typst" }
+          },
+          "patterns": [{ "include": "#code" }]
+        },
+        {
+          "name": "keyword.control.loop.typst",
+          "match": "(#)(break|continue)\\b",
+          "captures": { "1": { "name": "punctuation.definition.keyword.typst" } }
+        },
+        {
+          "begin": "(#)(import|include|export)\\b",
+          "end": "\n|(;)|(?=])",
+          "beginCaptures": {
+            "0": { "name": "keyword.control.import.typst" },
+            "1": { "name": "punctuation.definition.keyword.typst" }
+          },
+          "endCaptures": { "1": { "name": "punctuation.terminator.statement.typst" } },
+          "patterns": [{ "include": "#code" }]
+        },
+        {
+          "name": "keyword.control.flow.typst",
+          "match": "(#)(return)\\b",
+          "captures": { "1": { "name": "punctuation.definition.keyword.typst" } }
+        },
+        {
+          "comment": "Function name",
+          "name": "entity.name.function.typst",
+          "match": "((#)[[:alpha:]_][[:alnum:]_-]*!?)(?=\\[|\\()",
+          "captures": { "2": { "name": "punctuation.definition.function.typst" } }
+        },
+        {
+          "comment": "Function arguments",
+          "begin": "(?<=#[[:alpha:]_][[:alnum:]_-]*!?)\\(",
+          "end": "\\)",
+          "captures": { "0": { "name": "punctuation.definition.group.typst" } },
+          "patterns": [{ "include": "#arguments" }]
+        },
+        {
+          "name": "entity.other.interpolated.typst",
+          "match": "(#)[[:alpha:]_][.[:alnum:]_-]*",
+          "captures": { "1": { "name": "punctuation.definition.variable.typst" } }
+        },
+        {
+          "name": "meta.block.content.typst",
+          "begin": "#",
+          "end": "\\s",
+          "patterns": [{ "include": "#code" }]
+        }
+      ]
+    },
+    "code": {
+      "patterns": [
+        { "include": "#common" },
+        {
+          "name": "meta.block.code.typst",
+          "begin": "{",
+          "end": "}",
+          "captures": { "0": { "name": "punctuation.definition.block.code.typst" } },
+          "patterns": [{ "include": "#code" }]
+        },
+        {
+          "name": "meta.block.content.typst",
+          "begin": "\\[",
+          "end": "\\]",
+          "captures": { "0": { "name": "punctuation.definition.block.content.typst" } },
+          "patterns": [{ "include": "#markup" }]
+        },
+        {
+          "name": "comment.line.double-slash.typst",
+          "begin": "//",
+          "end": "\n",
+          "beginCaptures": { "0": { "name": "punctuation.definition.comment.typst" } }
+        },
+        {
+          "name": "punctuation.separator.colon.typst",
+          "match": ":"
+        },
+        {
+          "name": "punctuation.separator.comma.typst",
+          "match": ","
+        },
+        {
+          "name": "keyword.operator.typst",
+          "match": "=>|\\.\\."
+        },
+        {
+          "name": "keyword.operator.relational.typst",
+          "match": "==|!=|<=|<|>=|>"
+        },
+        {
+          "name": "keyword.operator.assignment.typst",
+          "match": "\\+=|-=|\\*=|/=|="
+        },
+        {
+          "name": "keyword.operator.arithmetic.typst",
+          "match": "\\+|\\*|/|(?<![[:alpha:]_][[:alnum:]_-]*)-(?![:alnum:]_-]*[[:alpha:]_])"
+        },
+        {
+          "name": "keyword.operator.word.typst",
+          "match": "\\b(and|or|not)\\b"
+        },
+        {
+          "name": "keyword.other.typst",
+          "match": "\\b(let|as|in|set|show|context)\\b"
+        },
+        {
+          "name": "keyword.control.conditional.typst",
+          "match": "\\b(if|else)\\b"
+        },
+        {
+          "name": "keyword.control.loop.typst",
+          "match": "\\b(for|while|break|continue)\\b"
+        },
+        {
+          "name": "keyword.control.import.typst",
+          "match": "\\b(import|include|export)\\b"
+        },
+        {
+          "name": "keyword.control.flow.typst",
+          "match": "\\b(return)\\b"
+        },
+        { "include": "#constants" },
+        {
+          "comment": "Function name",
+          "name": "entity.name.function.typst",
+          "match": "\\b[[:alpha:]_][[:alnum:]_-]*!?(?=\\[|\\()"
+        },
+        {
+          "comment": "Function name",
+          "name": "entity.name.function.typst",
+          "match": "(?<=\\bshow\\s*)\\b[[:alpha:]_][[:alnum:]_-]*(?=\\s*[:.])"
+        },
+        {
+          "comment": "Function arguments",
+          "begin": "(?<=\\b[[:alpha:]_][[:alnum:]_-]*!?)\\(",
+          "end": "\\)",
+          "captures": { "0": { "name": "punctuation.definition.group.typst" } },
+          "patterns": [{ "include": "#arguments" }]
+        },
+        {
+          "name": "variable.other.typst",
+          "match": "\\b[[:alpha:]_][[:alnum:]_-]*\\b"
+        },
+        {
+          "name": "meta.group.typst",
+          "begin": "\\(",
+          "end": "\\)|(?=;)",
+          "captures": { "0": { "name": "punctuation.definition.group.typst" } },
+          "patterns": [{ "include": "#code" }]
+        }
+      ]
+    },
+    "constants": {
+      "patterns": [
+        {
+          "name": "constant.language.none.typst",
+          "match": "\\bnone\\b"
+        },
+        {
+          "name": "constant.language.auto.typst",
+          "match": "\\bauto\\b"
+        },
+        {
+          "name": "constant.language.boolean.typst",
+          "match": "\\b(true|false)\\b"
+        },
+        {
+          "name": "constant.numeric.length.typst",
+          "match": "\\b(\\d*)?\\.?\\d+([eE][+-]?\\d+)?(mm|pt|cm|in|em)\\b"
+        },
+        {
+          "name": "constant.numeric.angle.typst",
+          "match": "\\b(\\d*)?\\.?\\d+([eE][+-]?\\d+)?(rad|deg)\\b"
+        },
+        {
+          "name": "constant.numeric.percentage.typst",
+          "match": "\\b(\\d*)?\\.?\\d+([eE][+-]?\\d+)?%"
+        },
+        {
+          "name": "constant.numeric.fr.typst",
+          "match": "\\b(\\d*)?\\.?\\d+([eE][+-]?\\d+)?fr"
+        },
+        {
+          "name": "constant.numeric.integer.typst",
+          "match": "\\b(0x[0-9a-zA-Z]+|(0b|0o)?\\d+)\\b"
+        },
+        {
+          "name": "constant.numeric.float.typst",
+          "match": "\\b(\\d*)?\\.?\\d+([eE][+-]?\\d+)?\\b"
+        },
+        { "include": "#string" },
+        { "include": "#math" }
+      ]
+    },
+    "arguments": {
+      "patterns": [
+        {
+          "name": "variable.parameter.typst",
+          "match": "\\b[[:alpha:]_][[:alnum:]_-]*(?=:)"
+        },
+        { "include": "#code" }
+      ]
+    },
+    "block-comment": {
+      "name": "comment.block.typst",
+      "begin": "/\\*",
+      "end": "\\*/",
+      "captures": { "0": { "name": "punctuation.definition.comment.typst" } },
+      "patterns": [{ "include": "#block-comment" }]
+    },
+    "string": {
+      "name": "string.quoted.double.typst",
+      "begin": "\"",
+      "end": "\"",
+      "captures": { "0": { "name": "punctuation.definition.string.typst" } },
+      "patterns": [
+        {
+          "name": "constant.character.escape.string.typst",
+          "match": "\\\\([\\\\\"nrt]|u\\{?[0-9a-zA-Z]*\\}?)"
+        }
+      ]
+    },
+    "math": {
+      "name": "string.other.math.typst",
+      "begin": "\\$",
+      "end": "\\$",
+      "captures": { "0": { "name": "punctuation.definition.string.math.typst" } },
+      "patterns": [
+        { "include": "#comments" },
+        { "include": "#string" },
+        { "name": "constant.character.escape.math.typst", "match": "\\\\." }
+      ]
+    }
+  },
+  "scopeName": "source.typst"
+}
diff --git a/src/renderer/src/lib/monaco-languages/textmate-language-registration.test.ts b/src/renderer/src/lib/monaco-languages/textmate-language-registration.test.ts
index dcd7b969ba9..a5638026eef 100644
--- a/src/renderer/src/lib/monaco-languages/textmate-language-registration.test.ts
+++ b/src/renderer/src/lib/monaco-languages/textmate-language-registration.test.ts
@@ -65,8 +65,12 @@ describe('registerTextMateLanguage', () => {
     expect(loadProviderModule).not.toHaveBeenCalled()
 
     const providerPromise = createTokensProvider()
+    expect(createTokensProvider()).toBe(providerPromise)
 
     await expect(providerPromise).resolves.toBe(provider)
+    expect(createTokensProvider()).toBe(providerPromise)
+    expect(loadProviderModule).toHaveBeenCalledTimes(1)
+    expect(createTextMateTokensProvider).toHaveBeenCalledTimes(1)
     expect(createTextMateTokensProvider).toHaveBeenCalledWith({
       scopeName: 'source.nim',
       loadGrammar
diff --git a/src/renderer/src/lib/monaco-languages/textmate-token-provider.test.ts b/src/renderer/src/lib/monaco-languages/textmate-token-provider.test.ts
index d2d40b04ba0..86b5d0c8604 100644
--- a/src/renderer/src/lib/monaco-languages/textmate-token-provider.test.ts
+++ b/src/renderer/src/lib/monaco-languages/textmate-token-provider.test.ts
@@ -4,6 +4,7 @@ import { describe, expect, it } from 'vitest'
 import { createOnigScanner, createOnigString, loadWASM } from 'vscode-oniguruma'
 import type { IOnigLib, IRawGrammar } from 'vscode-textmate'
 import nimGrammar from './textmate-grammars/nim.tmLanguage.json'
+import { loadTypstTextMateGrammar } from './register-typst'
 import { createTextMateTokensProvider } from './textmate-token-provider'
 
 const require = createRequire(import.meta.url)
@@ -46,6 +47,107 @@ describe('createTextMateTokensProvider', () => {
     )
   })
 
+  it('tokenizes Typst markup, code, and math through the lazy grammar loader', async () => {
+    const provider = await createTextMateTokensProvider({
+      scopeName: 'source.typst',
+      loadGrammar: loadTypstTextMateGrammar,
+      loadOniguruma: loadNodeOniguruma
+    })
+    const scopesOf = (line: string) =>
+      provider.tokenize(line, provider.getInitialState()).tokens.map((token) => token.scopes)
+
+    expect(scopesOf('#let width = 12pt')).toEqual(
+      expect.arrayContaining(['keyword.other.typst', 'constant.numeric.length.typst'])
+    )
+    expect(scopesOf('#set text(font: "Inter")')).toEqual(
+      expect.arrayContaining(['entity.name.function.typst', 'string.quoted.double.typst'])
+    )
+    expect(scopesOf('// note')).toContain('comment.line.double-slash.typst')
+    expect(scopesOf('$ sum_(k=0)^n k $')).toContain('string.other.math.typst')
+  })
+
+  it.each([
+    ['```rust', 'let x = 1', '```', '#let y = 2'],
+    ['````', '```', '````', '#let y = 2']
+  ])('carries a Typst raw block until its matching fence closes (%s)', async (...lines) => {
+    const provider = await createTextMateTokensProvider({
+      scopeName: 'source.typst',
+      loadGrammar: loadTypstTextMateGrammar,
+      loadOniguruma: loadNodeOniguruma
+    })
+
+    let state = provider.getInitialState()
+    const lineScopes = lines.map((line) => {
+      const result = provider.tokenize(line, state)
+      state = result.endState
+      return result.tokens.map((token) => token.scopes)
+    })
+
+    expect(lineScopes[1]).toEqual(['markup.raw.block.typst'])
+    expect(lineScopes[3]).toContain('keyword.other.typst')
+  })
+
+  it('carries Typst math across lines and returns to code after the closing dollar', async () => {
+    const provider = await createTextMateTokensProvider({
+      scopeName: 'source.typst',
+      loadGrammar: loadTypstTextMateGrammar,
+      loadOniguruma: loadNodeOniguruma
+    })
+    const opening = provider.tokenize('$', provider.getInitialState())
+    const clone = opening.endState.clone()
+    expect(clone.equals(opening.endState)).toBe(true)
+    const body = provider.tokenize('x^2 + y^2 = z^2', clone)
+    expect(body.tokens.map((token) => token.scopes)).toEqual(['string.other.math.typst'])
+    const closing = provider.tokenize('$', body.endState)
+    const after = provider.tokenize('#let y = 2', closing.endState)
+    expect(after.tokens.map((token) => token.scopes)).toContain('keyword.other.typst')
+    expect(after.tokens.map((token) => token.scopes)).not.toContain('string.other.math.typst')
+    expect(provider.tokenize('#let y = 2', provider.getInitialState()).tokens).toEqual(after.tokens)
+  })
+
+  it.each([
+    ['// Write /* to start a block comment.'],
+    ['/* documentation: // */'],
+    ['/* outer', '/* inner */ still outer', '*/'],
+    ['$ "cost $5" + x $'],
+    ['$ x + \\$ + y $'],
+    ['$ "escaped \\" $5" + x $'],
+    ['$ x + \\\\ $'],
+    ['$', '"cost $5" + \\$ + y', '$'],
+    ['$ x /* $ ignored */ + y $'],
+    ['$', '// $ ignored', 'x + y', '$'],
+    ['#let formula = $ "cost $5" + \\$ $']
+  ])('returns to Typst code after a comment or math region (%j)', async (...lines) => {
+    const provider = await createTextMateTokensProvider({
+      scopeName: 'source.typst',
+      loadGrammar: loadTypstTextMateGrammar,
+      loadOniguruma: loadNodeOniguruma
+    })
+    let state = provider.getInitialState()
+    for (const line of lines) {
+      state = provider.tokenize(line, state).endState
+    }
+    const after = '#let after = 12pt'
+    const tokens = provider.tokenize(after, state).tokens
+    expect(tokens).toEqual(provider.tokenize(after, provider.getInitialState()).tokens)
+    expect(tokens.map((token) => token.scopes)).toEqual(
+      expect.arrayContaining(['keyword.other.typst', 'constant.numeric.length.typst'])
+    )
+  })
+
+  it('keeps nested Typst block comments active until both closers', async () => {
+    const provider = await createTextMateTokensProvider({
+      scopeName: 'source.typst',
+      loadGrammar: loadTypstTextMateGrammar,
+      loadOniguruma: loadNodeOniguruma
+    })
+    let state = provider.tokenize('/* outer /* inner', provider.getInitialState()).endState
+    state = provider.tokenize('*/ still outer', state).endState
+    expect(provider.tokenize('#let hidden = 2', state).tokens.map((token) => token.scopes)).toEqual(
+      ['comment.block.typst']
+    )
+  })
+
   it('fails clearly when a scope has no grammar', async () => {
     await expect(
       createTextMateTokensProvider({
diff --git a/src/renderer/src/lib/monaco-setup.ts b/src/renderer/src/lib/monaco-setup.ts
index c94a147839d..5c2c69d24cb 100644
--- a/src/renderer/src/lib/monaco-setup.ts
+++ b/src/renderer/src/lib/monaco-setup.ts
@@ -13,6 +13,7 @@ import { registerJsonlLanguage } from './monaco-languages/register-jsonl'
 import { registerNimLanguage } from './monaco-languages/register-nim'
 import { registerShellMarkdownAliases } from './monaco-languages/register-shell-markdown-aliases'
 import { registerSvelteLanguage } from './monaco-languages/register-svelte'
+import { registerTypstLanguage } from './monaco-languages/register-typst'
 import { registerVueLanguage } from './monaco-languages/register-vue'
 import { installMonacoDelayerCancellationGuard } from './monaco-delayer-cancellation-guard'
 import { installMonacoDiffEditorDisposalGuard } from './monaco-diff-editor-disposal'
@@ -82,6 +83,7 @@ runMonacoSetupSteps([
   ['Svelte language registration', () => registerSvelteLanguage(monaco)],
   ['Astro language registration', () => registerAstroLanguage(monaco)],
   ['Nim language registration', () => registerNimLanguage(monaco)],
+  ['Typst language registration', () => registerTypstLanguage(monaco)],
   ['JSONL language registration', () => registerJsonlLanguage(monaco)],
   ['shell Markdown alias registration', () => registerShellMarkdownAliases(monaco)],
   ['delayer cancellation guard', installMonacoDelayerCancellationGuard],
diff --git a/src/renderer/src/lib/new-workspace-project-options.test.ts b/src/renderer/src/lib/new-workspace-project-options.test.ts
index b249570fb3d..682b3951816 100644
--- a/src/renderer/src/lib/new-workspace-project-options.test.ts
+++ b/src/renderer/src/lib/new-workspace-project-options.test.ts
@@ -1,13 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import {
-  NEW_WORKSPACE_PROJECT_OPTION_QUERY_MAX_BYTES,
-  buildNewWorkspaceFolderSourceOptions,
   buildNewWorkspaceProjectOptions,
-  findActionableFolderProjectGroup,
-  getRepoIdFromNewWorkspaceFolderSourceOptionId,
-  isNewWorkspaceProjectOptionQueryTooLarge,
-  searchNewWorkspaceProjectOptions,
-  type NewWorkspaceProjectOption
+  findActionableFolderProjectGroup
 } from './new-workspace-project-options'
 import type { ProjectGroup } from '../../../shared/project-group-types'
 import type { Project, ProjectHostSetup } from '../../../shared/project-types'
@@ -390,71 +384,6 @@ describe('buildNewWorkspaceProjectOptions', () => {
       'Builder (ssh:builder-b) · /workspace/merchant'
     ])
   })
-
-  it('filters project options by display name and detail', () => {
-    const options: NewWorkspaceProjectOption[] = [
-      {
-        kind: 'project',
-        id: 'orca',
-        projectId: 'orca',
-        displayName: 'Orca',
-        badgeColor: '#111111',
-        detail: 'stablyai/orca'
-      },
-      {
-        kind: 'project',
-        id: 'docs',
-        projectId: 'docs',
-        displayName: 'Docs',
-        badgeColor: '#222222',
-        detail: 'stablyai/docs'
-      }
-    ]
-
-    expect(searchNewWorkspaceProjectOptions(options, 'docs')).toEqual([options[1]])
-    expect(searchNewWorkspaceProjectOptions(options, 'stablyai/orca')).toEqual([options[0]])
-  })
-
-  it('rejects oversized pasted searches before reading project options', () => {
-    const oversizedQuery = 'secret-project-option'.repeat(
-      NEW_WORKSPACE_PROJECT_OPTION_QUERY_MAX_BYTES
-    )
-    const throwingOptions = [
-      {
-        id: 'secret',
-        badgeColor: '#111111',
-        get displayName(): string {
-          throw new Error('oversized project option queries must not scan names')
-        },
-        get detail(): string {
-          throw new Error('oversized project option queries must not scan details')
-        }
-      }
-    ] as NewWorkspaceProjectOption[]
-
-    expect(isNewWorkspaceProjectOptionQueryTooLarge(oversizedQuery)).toBe(true)
-    expect(searchNewWorkspaceProjectOptions(throwingOptions, oversizedQuery)).toEqual([])
-  })
-})
-
-describe('buildNewWorkspaceFolderSourceOptions', () => {
-  it('keeps concrete source repos separate even when they are the same logical project', () => {
-    const options = buildNewWorkspaceFolderSourceOptions([
-      repo('local-repo', { displayName: 'orca', path: '/tmp/orca' }),
-      repo('ssh-repo', {
-        displayName: 'orca',
-        path: '/srv/orca',
-        connectionId: 'ssh:builder'
-      })
-    ])
-
-    expect(options.map((option) => option.id).sort()).toEqual([
-      'folder-source:local-repo',
-      'folder-source:ssh-repo'
-    ])
-    expect(options.map((option) => option.detail).sort()).toEqual(['/srv/orca', '/tmp/orca'])
-    expect(getRepoIdFromNewWorkspaceFolderSourceOptionId('folder-source:ssh-repo')).toBe('ssh-repo')
-  })
 })
 
 describe('buildNewWorkspaceCreateTargetOptions', () => {
diff --git a/src/renderer/src/lib/new-workspace-project-options.ts b/src/renderer/src/lib/new-workspace-project-options.ts
index be8261126b8..72c69cd3286 100644
--- a/src/renderer/src/lib/new-workspace-project-options.ts
+++ b/src/renderer/src/lib/new-workspace-project-options.ts
@@ -16,7 +16,6 @@ import {
 } from './new-workspace-duplicate-project-details'
 
 export const NEW_WORKSPACE_PROJECT_GROUP_OPTION_PREFIX = 'project-group:'
-export const NEW_WORKSPACE_FOLDER_SOURCE_OPTION_PREFIX = 'folder-source:'
 
 export type NewWorkspaceProjectOption =
   | {
@@ -38,13 +37,6 @@ export type NewWorkspaceProjectOption =
       connectionId: string | null
     }
 
-type NewWorkspaceProjectOptionBase = {
-  id: string
-  displayName: string
-  badgeColor: string
-  detail: string
-}
-
 export const NEW_WORKSPACE_PROJECT_OPTION_QUERY_MAX_BYTES = 2 * 1024
 
 export function isNewWorkspaceProjectOptionQueryTooLarge(
@@ -151,16 +143,6 @@ function getProjectGroupOptionId(projectGroupId: string): string {
   return `${NEW_WORKSPACE_PROJECT_GROUP_OPTION_PREFIX}${projectGroupId}`
 }
 
-function getFolderSourceOptionId(repoId: string): string {
-  return `${NEW_WORKSPACE_FOLDER_SOURCE_OPTION_PREFIX}${repoId}`
-}
-
-export function getRepoIdFromNewWorkspaceFolderSourceOptionId(optionId: string): string | null {
-  return optionId.startsWith(NEW_WORKSPACE_FOLDER_SOURCE_OPTION_PREFIX)
-    ? optionId.slice(NEW_WORKSPACE_FOLDER_SOURCE_OPTION_PREFIX.length)
-    : null
-}
-
 export function getProjectGroupIdFromNewWorkspaceOptionId(optionId: string): string | null {
   return optionId.startsWith(NEW_WORKSPACE_PROJECT_GROUP_OPTION_PREFIX)
     ? optionId.slice(NEW_WORKSPACE_PROJECT_GROUP_OPTION_PREFIX.length)
@@ -206,21 +188,6 @@ export function findActionableFolderProjectGroup({
   )
 }
 
-export function buildNewWorkspaceFolderSourceOptions(
-  repos: readonly Repo[]
-): NewWorkspaceProjectOption[] {
-  return repos
-    .map((repo) => ({
-      kind: 'project' as const,
-      id: getFolderSourceOptionId(repo.id),
-      projectId: repo.id,
-      displayName: repo.displayName,
-      badgeColor: repo.badgeColor,
-      detail: repo.path
-    }))
-    .sort((a, b) => a.displayName.localeCompare(b.displayName) || a.detail.localeCompare(b.detail))
-}
-
 export function buildNewWorkspaceCreateTargetOptions({
   projectGroups,
   ...projectInput
@@ -251,19 +218,3 @@ export function buildNewWorkspaceCreateTargetOptions({
       a.id.localeCompare(b.id)
   )
 }
-
-export function searchNewWorkspaceProjectOptions(
-  options: readonly NewWorkspaceProjectOption[],
-  rawQuery: string
-): NewWorkspaceProjectOption[] {
-  if (isNewWorkspaceProjectOptionQueryTooLarge(rawQuery)) {
-    return []
-  }
-  const query = rawQuery.trim().toLowerCase()
-  if (!query) {
-    return [...options]
-  }
-  return options.filter((option: NewWorkspaceProjectOptionBase) =>
-    [option.displayName, option.detail].some((value) => value.toLowerCase().includes(query))
-  )
-}
diff --git a/src/renderer/src/lib/new-workspace.test.ts b/src/renderer/src/lib/new-workspace.test.ts
index 78d59f781f2..d3ca4fa01e6 100644
--- a/src/renderer/src/lib/new-workspace.test.ts
+++ b/src/renderer/src/lib/new-workspace.test.ts
@@ -293,7 +293,12 @@ describe('ensureAgentStartupInTerminal prompt delivery', () => {
       }
     })
 
-    expect(mockSendRuntimePtyInputVerified).toHaveBeenCalledWith({}, 'pty-1', 'fix the spinner\r')
+    expect(mockSendRuntimePtyInputVerified).toHaveBeenCalledWith(
+      {},
+      'pty-1',
+      'fix the spinner\r',
+      'launch'
+    )
     expect(mockTrack).not.toHaveBeenCalledWith('agent_prompt_sent', expect.anything())
   })
 
diff --git a/src/renderer/src/lib/non-secure-context-crypto-stub.ts b/src/renderer/src/lib/non-secure-context-crypto-stub.ts
new file mode 100644
index 00000000000..0413be294b8
--- /dev/null
+++ b/src/renderer/src/lib/non-secure-context-crypto-stub.ts
@@ -0,0 +1,29 @@
+/**
+ * Test-only shape of `globalThis.crypto` on a plain-HTTP origin: getRandomValues
+ * survives, the secure-context-only members do not.
+ *
+ * Swapping the whole `crypto` own property is the only reversible way to do this.
+ * `randomUUID` lives on `Crypto.prototype`, so stubbing it as an own property of
+ * `globalThis.crypto` leaves nothing to restore and leaks into the rest of the file.
+ */
+
+/** The crypto object a browser exposes on a non-secure origin. */
+export function createNonSecureContextCrypto(secureCrypto: Crypto = globalThis.crypto): {
+  getRandomValues: Crypto['getRandomValues']
+} {
+  return { getRandomValues: secureCrypto.getRandomValues.bind(secureCrypto) }
+}
+
+/** Runs `body` with the non-secure crypto shape installed, restoring the real one after. */
+export async function withNonSecureContextCrypto<T>(body: () => Promise<T> | T): Promise<T> {
+  const secureCrypto = globalThis.crypto
+  Object.defineProperty(globalThis, 'crypto', {
+    configurable: true,
+    value: createNonSecureContextCrypto(secureCrypto)
+  })
+  try {
+    return await body()
+  } finally {
+    Object.defineProperty(globalThis, 'crypto', { configurable: true, value: secureCrypto })
+  }
+}
diff --git a/src/renderer/src/lib/non-secure-context-crypto.repro.test.ts b/src/renderer/src/lib/non-secure-context-crypto.repro.test.ts
index f2f1a24c558..87da1737c79 100644
--- a/src/renderer/src/lib/non-secure-context-crypto.repro.test.ts
+++ b/src/renderer/src/lib/non-secure-context-crypto.repro.test.ts
@@ -3,18 +3,15 @@
  * hides crypto.randomUUID and crypto.subtle (secure-context-only). This test
  * recreates that exact global shape and drives the real call sites.
  */
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createNonSecureContextCrypto } from './non-secure-context-crypto-stub'
 
 const realCrypto = globalThis.crypto
 
 beforeEach(() => {
-  // Match a non-secure browser context: getRandomValues stays, the
-  // secure-context-only members are undefined.
   Object.defineProperty(globalThis, 'crypto', {
     configurable: true,
-    value: {
-      getRandomValues: realCrypto.getRandomValues.bind(realCrypto)
-    }
+    value: createNonSecureContextCrypto(realCrypto)
   })
 })
 
@@ -23,17 +20,6 @@ afterEach(() => {
 })
 
 describe('non-secure context (plain HTTP LAN web client)', () => {
-  it('crypto.randomUUID is undefined, like the browser reports', () => {
-    expect((globalThis.crypto as Crypto).randomUUID).toBeUndefined()
-    expect(() => (globalThis.crypto as Crypto).randomUUID()).toThrow()
-  })
-
-  it('hashOrcaHookScript does not throw when crypto.subtle is missing', async () => {
-    const { hashOrcaHookScript } = await import('./orca-hook-trust')
-    const hash = await hashOrcaHookScript('echo hi')
-    expect(hash).toMatch(/^[0-9a-f]+$/)
-  })
-
   // The fallback must match the secure-context hash, or the shared trust store
   // mismatches and the user is re-prompted to approve a hook they already
   // trusted on the desktop app.
@@ -45,11 +31,31 @@ describe('non-secure context (plain HTTP LAN web client)', () => {
     })()
     Object.defineProperty(globalThis, 'crypto', {
       configurable: true,
-      value: { getRandomValues: realCrypto.getRandomValues.bind(realCrypto) }
+      value: createNonSecureContextCrypto(realCrypto)
     })
     expect(await hashOrcaHookScript('echo hi')).toBe(secureHash)
   })
 
+  // Regression for #19667: the store builds this sequencer at module load, so a throw here
+  // white-screened the whole Remote Web client before anything painted.
+  it('loads the renderer agent-status authority and its store slice', async () => {
+    vi.resetModules()
+    const { rendererAgentStatusObservations } = await import('./renderer-agent-status-observations')
+    await import('../store/slices/agent-status-authority-actions')
+    expect(rendererAgentStatusObservations.getAuthorityId()).toMatch(
+      /^renderer:[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
+    )
+  })
+
+  // Naming two modules only pins today's crash. The reported stack was the whole store
+  // chunk, so evaluate the store root: any new import-time secure-context call anywhere in
+  // that graph fails here.
+  it('evaluates the whole store graph', async () => {
+    vi.resetModules()
+    const { useAppStore } = await import('@/store')
+    expect(typeof useAppStore.getState).toBe('function')
+  })
+
   it('createBrowserUuid does not throw when randomUUID is missing', async () => {
     const { createBrowserUuid } = await import('./browser-uuid')
     expect(createBrowserUuid()).toMatch(
diff --git a/src/renderer/src/lib/onboarding-project-checklist.test.ts b/src/renderer/src/lib/onboarding-project-checklist.test.ts
index 6a0f67aa62e..b1c4caba161 100644
--- a/src/renderer/src/lib/onboarding-project-checklist.test.ts
+++ b/src/renderer/src/lib/onboarding-project-checklist.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { getDefaultOnboardingState } from '../../../shared/constants'
+import { getDefaultOnboardingState } from '../../../shared/onboarding-defaults'
 import { markOnboardingProjectAdded } from './onboarding-project-checklist'
 
 const mocks = vi.hoisted(() => ({
diff --git a/src/renderer/src/lib/pane-manager/mint-stable-pane-id.ts b/src/renderer/src/lib/pane-manager/mint-stable-pane-id.ts
index 10f332f49ac..a6ca7cc2d64 100644
--- a/src/renderer/src/lib/pane-manager/mint-stable-pane-id.ts
+++ b/src/renderer/src/lib/pane-manager/mint-stable-pane-id.ts
@@ -1,25 +1,7 @@
 import type { TerminalLeafId } from '../../../../shared/stable-pane-id'
+import { createBrowserUuid } from '../browser-uuid'
 
-// Why: Electron/test runtimes can lack crypto.randomUUID. The fallback still
-// produces a UUID-shaped v4 id so pane-key validation remains deterministic.
 export function mintStablePaneId(): TerminalLeafId {
-  const cryptoApi = globalThis.crypto as Crypto | undefined
-  if (cryptoApi?.randomUUID) {
-    return cryptoApi.randomUUID() as TerminalLeafId
-  }
-  const bytes = new Uint8Array(16)
-  if (cryptoApi?.getRandomValues) {
-    cryptoApi.getRandomValues(bytes)
-  } else {
-    for (let i = 0; i < bytes.length; i += 1) {
-      bytes[i] = Math.floor(Math.random() * 256)
-    }
-  }
-  bytes[6] = (bytes[6] & 0x0f) | 0x40
-  bytes[8] = (bytes[8] & 0x3f) | 0x80
-  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('')
-  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(
-    16,
-    20
-  )}-${hex.slice(20)}` as TerminalLeafId
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: createBrowserUuid always returns a lowercase v4 UUID, the TerminalLeafId shape.
+  return createBrowserUuid() as TerminalLeafId
 }
diff --git a/src/renderer/src/lib/pane-manager/pane-overlay-focus.test.ts b/src/renderer/src/lib/pane-manager/pane-overlay-focus.test.ts
index 6b51c1ba449..1f8d603c89f 100644
--- a/src/renderer/src/lib/pane-manager/pane-overlay-focus.test.ts
+++ b/src/renderer/src/lib/pane-manager/pane-overlay-focus.test.ts
@@ -105,6 +105,26 @@ describe.each(['initial', 'active'] as const)('%s pane focus', (operation) => {
     expect(document.activeElement).toBe(f.textarea)
   })
 
+  it('preserves the focused list during arrow navigation', () => {
+    const f = fixture()
+    const sidebar = overlay('listbox')
+    sidebar.setAttribute('data-worktree-sidebar', '')
+    sidebar.setAttribute('data-keyboard-navigation', '')
+    focus(f)
+    expect(document.activeElement).toBe(sidebar)
+    expect(f.pane.terminal.focus).not.toHaveBeenCalled()
+  })
+
+  it('ignores a navigation marker on a list that no longer owns focus', () => {
+    const f = fixture()
+    const sidebar = overlay('listbox')
+    sidebar.setAttribute('data-worktree-sidebar', '')
+    sidebar.setAttribute('data-keyboard-navigation', '')
+    sidebar.blur()
+    focus(f)
+    expect(document.activeElement).toBe(f.textarea)
+  })
+
   it('allows focus after the overlay closes', () => {
     const f = fixture()
     overlay('menu').style.display = 'none'
diff --git a/src/renderer/src/lib/pane-manager/pane-overlay-focus.ts b/src/renderer/src/lib/pane-manager/pane-overlay-focus.ts
index 0dcf5c07ce9..bb53245df41 100644
--- a/src/renderer/src/lib/pane-manager/pane-overlay-focus.ts
+++ b/src/renderer/src/lib/pane-manager/pane-overlay-focus.ts
@@ -6,11 +6,12 @@ export function focusPanePreservingOverlays(
 ): void {
   if (
     typeof document !== 'undefined' &&
-    hasVisibleOverlay({
-      ignoreMatches: '[role="listbox"][data-worktree-sidebar]',
-      ignoreContaining: pane.container,
-      ignoreDismissed: true
-    })
+    (document.activeElement?.matches('[data-worktree-sidebar][data-keyboard-navigation]') ||
+      hasVisibleOverlay({
+        ignoreMatches: '[role="listbox"][data-worktree-sidebar]',
+        ignoreContaining: pane.container,
+        ignoreDismissed: true
+      }))
   ) {
     return
   }
diff --git a/src/renderer/src/lib/plugin-command-keybindings.test.ts b/src/renderer/src/lib/plugin-command-keybindings.test.ts
index b4ddcb00dae..9f9e24be48e 100644
--- a/src/renderer/src/lib/plugin-command-keybindings.test.ts
+++ b/src/renderer/src/lib/plugin-command-keybindings.test.ts
@@ -5,7 +5,6 @@ import {
 } from '../../../shared/keybindings'
 import type { ActivePluginCommand } from '@/store/plugin-panels'
 import {
-  buildPluginCommandKeybindingDefinitions,
   findPluginCommandForKeybinding,
   getEffectivePluginCommandKeybindings,
   pluginCommandKeybindingActionId,
@@ -41,16 +40,6 @@ describe('plugin command keybindings', () => {
     expect(getEffectivePluginCommandKeybindings(command, 'linux', { [actionId]: [] })).toEqual([])
   })
 
-  it('keeps removed-plugin overrides inert and restores them on reinstall', () => {
-    const actionId = pluginCommandKeybindingActionId(command)
-    const overrides = { [actionId]: ['Mod+Shift+T'] }
-
-    expect(buildPluginCommandKeybindingDefinitions([])).toEqual([])
-    expect(getEffectivePluginCommandKeybindings(command, 'linux', overrides)).toEqual([
-      'Mod+Shift+T'
-    ])
-  })
-
   it('matches effective overrides and honors explicit disablement', () => {
     const actionId = pluginCommandKeybindingActionId(command)
     const input = {
diff --git a/src/renderer/src/lib/react-commit-cascade-telemetry.test.ts b/src/renderer/src/lib/react-commit-cascade-telemetry.test.ts
index 89e0456c2ce..d09337c8d0c 100644
--- a/src/renderer/src/lib/react-commit-cascade-telemetry.test.ts
+++ b/src/renderer/src/lib/react-commit-cascade-telemetry.test.ts
@@ -2,7 +2,6 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { sanitizeCrashReportDetails } from '../../../shared/crash-report-redaction'
 import { REACT_NESTED_UPDATE_LIMIT } from '../../../shared/react-update-depth-attribution'
 import {
-  REACT_CASCADING_LANES,
   setReactCommitCascadeRendererSurface,
   REACT_COMMIT_CASCADE_ARM_COMMITS,
   REACT_COMMIT_CASCADE_BREADCRUMB,
@@ -67,7 +66,6 @@ describe('cascade thresholds', () => {
   it('derives arm and notice limits from React commit budget', () => {
     expect(REACT_COMMIT_CASCADE_NOTICE_LIMIT).toBeLessThan(REACT_NESTED_UPDATE_LIMIT)
     expect(REACT_COMMIT_CASCADE_ARM_COMMITS).toBeLessThan(REACT_COMMIT_CASCADE_NOTICE_LIMIT)
-    expect(REACT_CASCADING_LANES).toBe(42)
   })
 })
 
diff --git a/src/renderer/src/lib/recent-workspace-tab-rows.test.ts b/src/renderer/src/lib/recent-workspace-tab-rows.test.ts
index b0488309bf3..9babe59d9bf 100644
--- a/src/renderer/src/lib/recent-workspace-tab-rows.test.ts
+++ b/src/renderer/src/lib/recent-workspace-tab-rows.test.ts
@@ -166,6 +166,28 @@ describe('resolveRecentWorkspaceTabStatus', () => {
     )
   })
 
+  it('surfaces a failed outcome as failed', () => {
+    const failed = entry('failed', 'done', NOW - 1_000, {
+      mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: NOW - 1_000 }
+    })
+
+    expect(resolveRecentWorkspaceTabStatus(row('failed'), sources([failed]), NOW)).toBe('failed')
+  })
+
+  it('surfaces a main agent that failed while its subagent works as failed, above working', () => {
+    const held = (tabId: string, outcome: 'failure' | 'success') =>
+      entry(tabId, 'working', NOW - 1_000, {
+        mainAgent: { state: 'done', outcome, stateStartedAt: NOW - 2_000 }
+      })
+
+    expect(
+      resolveRecentWorkspaceTabStatus(row('held'), sources([held('held', 'failure')]), NOW)
+    ).toBe('failed')
+    expect(
+      resolveRecentWorkspaceTabStatus(row('held'), sources([held('held', 'success')]), NOW)
+    ).toBe('working')
+  })
+
   it('does not let a cleanly finished sibling mask an interruption', () => {
     const interrupted = entry('mixed', 'done', NOW - 1_000, {
       paneKey: `mixed:${LEAF_ID}`,
diff --git a/src/renderer/src/lib/recent-workspace-tab-rows.ts b/src/renderer/src/lib/recent-workspace-tab-rows.ts
index 2f4b172c475..45f90213953 100644
--- a/src/renderer/src/lib/recent-workspace-tab-rows.ts
+++ b/src/renderer/src/lib/recent-workspace-tab-rows.ts
@@ -7,6 +7,7 @@ import {
   type WorktreeAttention
 } from '@/components/sidebar/smart-attention'
 import { tabHasLivePty } from './tab-has-live-pty'
+import { agentVerdictDisplayMark } from '../../../shared/agent-main-agent-verdict'
 import { isExplicitAgentStatusFresh } from './pane-agent-evidence'
 import type { WorktreeStatus } from './worktree-status'
 import type { TerminalTab } from '../../../shared/terminal-tab-types'
@@ -74,6 +75,21 @@ export function resolveRecentWorkspaceTabStatus(
   const panes = collectTabPaneInputs(row.terminalTab, row.worktreeLastActivityAt, paneSources, now)
   const attention = resolveAttention(panes, now)
   const explicit = STATUS_BY_ATTENTION_CLASS[attention.cls]
+  if (explicit === 'permission') {
+    return explicit
+  }
+  const verdicts = new Set(
+    panes.flatMap((pane) =>
+      pane.kind === 'hook' &&
+      isExplicitAgentStatusFresh(pane.entry, now, AGENT_STATUS_STALE_AFTER_MS)
+        ? [agentVerdictDisplayMark(pane.entry)]
+        : []
+    )
+  )
+  // Why: a failed main agent outranks the subagent work still holding its row live.
+  if (verdicts.has('failed')) {
+    return 'failed'
+  }
   if (explicit === 'working') {
     const hasForegroundWork = panes.some(
       (pane) =>
@@ -82,16 +98,7 @@ export function resolveRecentWorkspaceTabStatus(
     )
     return hasForegroundWork ? 'working' : 'monitoring'
   }
-  if (explicit === 'permission') {
-    return explicit
-  }
-  const hasInterrupted = panes.some(
-    (pane) =>
-      pane.kind === 'hook' &&
-      pane.entry.interrupted === true &&
-      isExplicitAgentStatusFresh(pane.entry, now, AGENT_STATUS_STALE_AFTER_MS)
-  )
-  if (hasInterrupted) {
+  if (verdicts.has('interrupted')) {
     return 'interrupted'
   }
   if (explicit === 'done') {
diff --git a/src/renderer/src/lib/resume-sleeping-agent-session.ts b/src/renderer/src/lib/resume-sleeping-agent-session.ts
index 50fb378888f..ab2f06b40ef 100644
--- a/src/renderer/src/lib/resume-sleeping-agent-session.ts
+++ b/src/renderer/src/lib/resume-sleeping-agent-session.ts
@@ -7,7 +7,7 @@ import { AGENT_STATUS_STALE_AFTER_MS } from '../../../shared/agent-status-types'
 import { parsePaneKey } from '../../../shared/stable-pane-id'
 import {
   getProviderSessionClaimKey,
-  isPassiveCompletedHibernationEvidence,
+  activationTreatsNoteAsFinished,
   recordPaneIsOwnedByPreservedPane,
   stablePaneHasLivePty
 } from './sleeping-agent-pane-ownership'
@@ -34,7 +34,7 @@ function clearPassiveCompletedRecordsForClaimKey(
 ): void {
   const state = useAppStore.getState()
   for (const record of records) {
-    if (record.paneKey === keepPaneKey || !isPassiveCompletedHibernationEvidence(record)) {
+    if (record.paneKey === keepPaneKey || !activationTreatsNoteAsFinished(record)) {
       continue
     }
     if (getProviderSessionClaimKey(record) === claimKey) {
@@ -50,7 +50,7 @@ function getCurrentPaneOwnedClaimKeys(records: readonly SleepingAgentSessionReco
     if (
       state.sleepingAgentSessionsByPaneKey[record.paneKey] !== record ||
       isInvalidWorktreeActivationRecord(record) ||
-      isPassiveCompletedHibernationEvidence(record)
+      activationTreatsNoteAsFinished(record)
     ) {
       continue
     }
@@ -240,7 +240,7 @@ export function resumeSleepingAgentSessionsForWorktree(
     (record) => !isInvalidWorktreeActivationRecord(record)
   )
   const activeWorktreeRecords = validWorktreeRecords.filter(
-    (record) => !isPassiveCompletedHibernationEvidence(record)
+    (record) => !activationTreatsNoteAsFinished(record)
   )
   const activeClaimKeys = new Set(activeWorktreeRecords.map(getProviderSessionClaimKey))
   const newestActiveRecordByClaimKey = getNewestActiveRecordsByClaimKey(activeWorktreeRecords)
@@ -280,7 +280,7 @@ export function resumeSleepingAgentSessionsForWorktree(
       continue
     }
     const isPaneOwned = recordPaneIsOwnedByPreservedPane(record, currentState)
-    if (isPassiveCompletedHibernationEvidence(record)) {
+    if (activationTreatsNoteAsFinished(record)) {
       // Why: completed-agent hibernation is passive history; activation should
       // only keep displayable evidence, never start new work from it.
       if (!isPaneOwned || activeClaimKeys.has(claimKey)) {
diff --git a/src/renderer/src/lib/session-write-subscriber-deferred-persist.test.ts b/src/renderer/src/lib/session-write-subscriber-deferred-persist.test.ts
index df8bf5217d0..2a65442bd18 100644
--- a/src/renderer/src/lib/session-write-subscriber-deferred-persist.test.ts
+++ b/src/renderer/src/lib/session-write-subscriber-deferred-persist.test.ts
@@ -104,16 +104,12 @@ describe('session write subscriber defers writes across a closed persistence gat
 
     expect(persist).toHaveBeenCalledTimes(1)
     const patch = persist.mock.calls[0][0].patch
+    // Close records are main's; the renderer's mirror of them is never written back.
+    expect(patch.closedTerminalTabTombstonesByTabId).toBeUndefined()
     expect(
-      patch.closedTerminalTabTombstonesByTabId,
-      'the tombstone written during the apply window was discarded, not deferred'
-    ).toEqual({
-      'closed-during-apply': {
-        closedAt: expect.any(Number),
-        worktreeId: 'wt-remote'
-      }
-    })
-    expect(patch.activeTabId).toBe('still-open-tab')
+      patch.activeTabId,
+      'the mutation made during the apply window was discarded, not deferred'
+    ).toBe('still-open-tab')
     expect(patch.activeRepoId).toBe('repo-1')
     cleanup()
   })
@@ -198,7 +194,7 @@ describe('session write subscriber defers writes across a closed persistence gat
       'target B lost a tab close because target A was mid-apply'
     ).toEqual([])
     expect(patch.tabsByWorktree?.['wt-target-a']).toHaveLength(1)
-    expect(patch.closedTerminalTabTombstonesByTabId?.['tab-b']?.worktreeId).toBe('wt-target-b')
+    expect(patch.closedTerminalTabTombstonesByTabId).toBeUndefined()
     cleanup()
   })
 
diff --git a/src/renderer/src/lib/session-write-subscriber.test.ts b/src/renderer/src/lib/session-write-subscriber.test.ts
index 2f31550c6c0..dda5c01f44c 100644
--- a/src/renderer/src/lib/session-write-subscriber.test.ts
+++ b/src/renderer/src/lib/session-write-subscriber.test.ts
@@ -102,6 +102,27 @@ describe('createSessionWriteSubscriber', () => {
     cleanup()
   })
 
+  it('writes when the gate is already open at creation, with no store tick to wake it', () => {
+    // Why the store-write spy: every other case here opens the gate *after* creating the
+    // subscriber, so the opening setState is itself the tick that produces the first write. With
+    // the gate already open only the creation-time seed can, and equal catalogs no longer publish
+    // a tick to stand in for it.
+    useAppStore.setState({ workspaceSessionReady: true, hydrationSucceeded: true })
+
+    const persist = vi.fn<(payload: WorkspaceSessionWrite) => void>()
+    const storeTicks = vi.fn()
+    const unsubStoreTicks = useAppStore.subscribe(storeTicks)
+    const cleanup = createSessionWriteSubscriber({ store: useAppStore, persist })
+
+    vi.advanceTimersByTime(200)
+
+    expect(storeTicks).not.toHaveBeenCalled()
+    expect(persist).toHaveBeenCalledTimes(1)
+
+    unsubStoreTicks()
+    cleanup()
+  })
+
   it('re-checks the hydration gate when a pending debounce fires', () => {
     const persist = vi.fn<(payload: WorkspaceSessionWrite) => void>()
     const cleanup = createSessionWriteSubscriber({ store: useAppStore, persist })
diff --git a/src/renderer/src/lib/session-write-subscriber.ts b/src/renderer/src/lib/session-write-subscriber.ts
index 685a8e56e3f..7e7e9cf7360 100644
--- a/src/renderer/src/lib/session-write-subscriber.ts
+++ b/src/renderer/src/lib/session-write-subscriber.ts
@@ -201,7 +201,7 @@ export function createSessionWriteSubscriber({
     return false
   }
 
-  const unsub = store.subscribe((state) => {
+  const evaluateSessionState = (state: AppState): void => {
     if (!shouldPersistWorkspaceSession(state)) {
       return
     }
@@ -255,7 +255,14 @@ export function createSessionWriteSubscriber({
       return
     }
     armFlushTimer()
-  })
+  }
+
+  // Why evaluate once here: `prev === null` is what bootstraps the first full write, so a writer
+  // created when the session gate is *already* open owed that write to whatever unrelated store
+  // tick happened to arrive next. Catalog refreshes no longer publish when nothing changed, so
+  // that incidental wake-up is not guaranteed; seed from the current state instead.
+  evaluateSessionState(store.getState())
+  const unsub = store.subscribe(evaluateSessionState)
 
   const unsubGateOpen = subscribeToPersistGateOpen?.(() => {
     if (pendingChangedFields.size === 0 || timer !== null) {
diff --git a/src/renderer/src/lib/sidebar-worktree-activation.test.ts b/src/renderer/src/lib/sidebar-worktree-activation.test.ts
index a33f91565a2..a12ca8affa8 100644
--- a/src/renderer/src/lib/sidebar-worktree-activation.test.ts
+++ b/src/renderer/src/lib/sidebar-worktree-activation.test.ts
@@ -26,6 +26,7 @@ describe('sidebar worktree activation', () => {
     await activateWorktreeFromSidebar('wt-live')
 
     expect(mocks.activateAndRevealWorktree).toHaveBeenCalledWith('wt-live', {
+      navigationIntent: 'user-open',
       revealInSidebar: false
     })
     expect(mocks.activateAndRevealFolderWorkspace).not.toHaveBeenCalled()
@@ -38,6 +39,7 @@ describe('sidebar worktree activation', () => {
     // sidebar click itself must switch app state immediately.
     expect(mocks.activateAndRevealWorktree).toHaveBeenCalledTimes(1)
     expect(mocks.activateAndRevealWorktree).toHaveBeenCalledWith('wt-slept', {
+      navigationIntent: 'user-open',
       revealInSidebar: false
     })
   })
@@ -57,6 +59,7 @@ describe('sidebar worktree activation', () => {
     const activation = activateWorktreeFromSidebar('wt-vm')
 
     expect(mocks.activateAndRevealWorktree).toHaveBeenCalledWith('wt-vm', {
+      navigationIntent: 'user-open',
       revealInSidebar: false
     })
     expect(resumeWorkspace).toHaveBeenCalledWith({ workspaceId: 'wt-vm' })
@@ -68,7 +71,9 @@ describe('sidebar worktree activation', () => {
   it('routes folder workspace activation through the guarded folder path', async () => {
     await activateWorktreeFromSidebar('folder:folder-workspace-1')
 
-    expect(mocks.activateAndRevealFolderWorkspace).toHaveBeenCalledWith('folder-workspace-1')
+    expect(mocks.activateAndRevealFolderWorkspace).toHaveBeenCalledWith('folder-workspace-1', {
+      navigationIntent: 'user-open'
+    })
     expect(mocks.activateAndRevealWorktree).not.toHaveBeenCalled()
   })
 })
diff --git a/src/renderer/src/lib/sidebar-worktree-activation.ts b/src/renderer/src/lib/sidebar-worktree-activation.ts
index dd4eec3f0df..01bb94ad11b 100644
--- a/src/renderer/src/lib/sidebar-worktree-activation.ts
+++ b/src/renderer/src/lib/sidebar-worktree-activation.ts
@@ -13,17 +13,15 @@ export async function activateWorktreeFromSidebar(
 ): Promise<void> {
   const workspaceScope = parseWorkspaceKey(worktreeId)
   if (workspaceScope?.type === 'folder') {
-    if (executionHostId) {
-      activateAndRevealFolderWorkspace(workspaceScope.folderWorkspaceId, {
-        executionHostId
-      })
-    } else {
-      activateAndRevealFolderWorkspace(workspaceScope.folderWorkspaceId)
-    }
+    activateAndRevealFolderWorkspace(workspaceScope.folderWorkspaceId, {
+      navigationIntent: 'user-open',
+      ...(executionHostId ? { executionHostId } : {})
+    })
     return
   }
   // Keep navigation independent from an optional runtime wake IPC.
   activateAndRevealWorktree(worktreeId, {
+    navigationIntent: 'user-open',
     revealInSidebar: false,
     ...(executionHostId ? { executionHostId } : {})
   })
diff --git a/src/renderer/src/lib/sleeping-agent-pane-ownership.test.ts b/src/renderer/src/lib/sleeping-agent-pane-ownership.test.ts
new file mode 100644
index 00000000000..e1297857201
--- /dev/null
+++ b/src/renderer/src/lib/sleeping-agent-pane-ownership.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it } from 'vitest'
+import type { SleepingAgentSessionRecord } from '../../../shared/agent-session-resume'
+import { activationTreatsNoteAsFinished } from './sleeping-agent-pane-ownership'
+
+function note(overrides: Partial<SleepingAgentSessionRecord> = {}): SleepingAgentSessionRecord {
+  return {
+    paneKey: 'tab-1:leaf-1',
+    worktreeId: 'wt-1',
+    agent: 'codex',
+    providerSession: { key: 'session_id', id: 'conv-1' },
+    prompt: '',
+    state: 'done',
+    capturedAt: 1,
+    updatedAt: 1,
+    ...overrides
+  }
+}
+
+describe('activationTreatsNoteAsFinished', () => {
+  it.each([
+    ['a worktree-sleep done note', true, note({ origin: 'worktree-sleep' })],
+    ['a legacy originless done note', true, note()],
+    ['a finished turn idle anchor (live done)', true, note({ origin: 'live' })],
+    [
+      'an interrupted worktree-sleep note',
+      true,
+      note({ origin: 'worktree-sleep', interrupted: true })
+    ],
+    ['an interrupted live turn', false, note({ origin: 'live', interrupted: true })],
+    ['a quit capture', false, note({ origin: 'quit' })],
+    ['a running turn (live working)', false, note({ origin: 'live', state: 'working' })]
+  ])('%s -> %s', (_label, expected, record) => {
+    expect(activationTreatsNoteAsFinished(record)).toBe(expected)
+  })
+})
diff --git a/src/renderer/src/lib/sleeping-agent-pane-ownership.ts b/src/renderer/src/lib/sleeping-agent-pane-ownership.ts
index 8dac858af02..73294da7c6e 100644
--- a/src/renderer/src/lib/sleeping-agent-pane-ownership.ts
+++ b/src/renderer/src/lib/sleeping-agent-pane-ownership.ts
@@ -1,5 +1,6 @@
 import type { useAppStore } from '@/store'
 import type { SleepingAgentSessionRecord } from '../../../shared/agent-session-resume'
+import { agentTurnEndedUncleanly } from '../../../shared/agent-main-agent-verdict'
 import type {
   TerminalLayoutSnapshot,
   TerminalPaneLayoutNode,
@@ -17,13 +18,12 @@ export function getProviderSessionClaimKey(record: SleepingAgentSessionRecord):
     : base
 }
 
-// Why quit is excluded: it is an explicit request to keep resumable work. A
-// live interrupted checkpoint is also active work; interrupted worktree-sleep
-// records retain their existing passive/cleanup semantics.
-export function isPassiveCompletedHibernationEvidence(record: SleepingAgentSessionRecord): boolean {
+// Why live+done counts (#16308): workspace activation must not resume a finished turn's idle anchor.
+// Quit asks to keep work resumable and a live stopped or failed turn is unfinished.
+export function activationTreatsNoteAsFinished(record: SleepingAgentSessionRecord): boolean {
   return (
     record.origin !== 'quit' &&
-    !(record.origin === 'live' && record.interrupted === true) &&
+    !(record.origin === 'live' && agentTurnEndedUncleanly(record)) &&
     record.state === 'done'
   )
 }
@@ -125,7 +125,8 @@ function paneWillConnectOnActivation(
   // never cancels it), so any preserved restorable pane cold-restores in place.
   // Gating on the visible tab forked a second live surface onto the same
   // provider session for every non-group-active agent tab. Web-mirror tabs are
-  // the exception: they never mount a local pane, so they cannot own recovery.
+  // the exception: their pane attaches the host PTY instead of cold-restoring
+  // from a note, so they cannot own recovery.
   return !isWebTerminalSurfaceTabId(tabId)
 }
 
@@ -144,7 +145,7 @@ export function recordPaneIsOwnedByPreservedPane(
     if (!tab || !hasMatchingStablePaneLayout(tabId, stable.leafId, state.terminalLayoutsByTabId)) {
       return false
     }
-    if (isPassiveCompletedHibernationEvidence(record)) {
+    if (activationTreatsNoteAsFinished(record)) {
       return true
     }
     // Why: a pane with a live PTY owns its running session regardless of which
diff --git a/src/renderer/src/lib/solidity-language-id-registration.test.ts b/src/renderer/src/lib/solidity-language-id-registration.test.ts
new file mode 100644
index 00000000000..5cfe2598837
--- /dev/null
+++ b/src/renderer/src/lib/solidity-language-id-registration.test.ts
@@ -0,0 +1,20 @@
+import { readFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { describe, expect, it } from 'vitest'
+import { detectLanguage } from './language-detect'
+
+// Why: Monaco registers Solidity as id 'sol' with 'solidity' only an alias, and
+// mapping an alias silently renders plaintext. Pin against the installed package
+// so an upstream id change fails here instead of in the editor.
+describe('solidity language id', () => {
+  it('matches the id monaco-editor registers for .sol', () => {
+    const require = createRequire(import.meta.url)
+    const source = readFileSync(
+      require.resolve('monaco-editor/esm/vs/basic-languages/solidity/solidity.contribution.js'),
+      'utf8'
+    )
+    const registeredId = /id:\s*["']([^"']+)["']/.exec(source)?.[1]
+    expect(registeredId).toBeDefined()
+    expect(detectLanguage('contracts/Vault.sol')).toBe(registeredId)
+  })
+})
diff --git a/src/renderer/src/lib/sparse-preset-draft.test.ts b/src/renderer/src/lib/sparse-preset-draft.test.ts
index 6bb5e026629..8fa17cd9f59 100644
--- a/src/renderer/src/lib/sparse-preset-draft.test.ts
+++ b/src/renderer/src/lib/sparse-preset-draft.test.ts
@@ -1,5 +1,6 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { parseSparsePresetDirectories } from './sparse-preset-draft'
+import { setRendererUiLanguage } from '@/i18n/i18n'
+import { parseSparsePresetDirectories, validateSparsePresetName } from './sparse-preset-draft'
 
 afterEach(() => {
   vi.restoreAllMocks()
@@ -62,3 +63,30 @@ describe('parseSparsePresetDirectories', () => {
     expect(split).not.toHaveBeenCalled()
   })
 })
+
+describe('validateSparsePresetName', () => {
+  const presets = [{ id: 'web', name: 'Web UI' }]
+  it('validates required, length, duplicate, and unchanged names', () => {
+    expect(validateSparsePresetName(' ', presets)).toBe('Name is required.')
+    expect(validateSparsePresetName('a'.repeat(81), presets)).toBe(
+      'Name must be 80 characters or fewer.'
+    )
+    expect(validateSparsePresetName(' web ui ', presets)).toBe(
+      'A preset named “Web UI” already exists.'
+    )
+    expect(validateSparsePresetName('Web UI', presets, 'web')).toBeNull()
+    expect(validateSparsePresetName('a'.repeat(80), presets)).toBeNull()
+  })
+  it('uses Korean validation with a named interpolation', async () => {
+    await setRendererUiLanguage('ko')
+    try {
+      expect(validateSparsePresetName('', presets)).toBe('이름을 입력하세요.')
+      expect(validateSparsePresetName('a'.repeat(81), presets)).toBe('이름은 80자 이하여야 합니다.')
+      expect(validateSparsePresetName('web ui', presets)).toBe(
+        '같은 이름의 프리셋이 이미 있습니다: Web UI'
+      )
+    } finally {
+      await setRendererUiLanguage('en')
+    }
+  })
+})
diff --git a/src/renderer/src/lib/sparse-preset-draft.ts b/src/renderer/src/lib/sparse-preset-draft.ts
index d15f9d9de36..f0b907cc907 100644
--- a/src/renderer/src/lib/sparse-preset-draft.ts
+++ b/src/renderer/src/lib/sparse-preset-draft.ts
@@ -60,3 +60,25 @@ export function parseSparsePresetDirectories(value: string): SparsePresetDirecto
     error: null
   }
 }
+
+export function validateSparsePresetName(
+  name: string,
+  presets: readonly { id: string; name: string }[],
+  presetId?: string
+): string | null {
+  const trimmed = name.trim()
+  if (!trimmed) {
+    return translate('sparsePreset.nameRequired', 'Name is required.')
+  }
+  if (trimmed.length > 80) {
+    return translate('sparsePreset.nameTooLong', 'Name must be 80 characters or fewer.')
+  }
+  const collision = presets.find(
+    (preset) => preset.id !== presetId && preset.name.toLowerCase() === trimmed.toLowerCase()
+  )
+  return collision
+    ? translate('sparsePreset.nameExists', 'A preset named “{{name}}” already exists.', {
+        name: collision.name
+      })
+    : null
+}
diff --git a/src/renderer/src/lib/startup-draft-input-kind.test.ts b/src/renderer/src/lib/startup-draft-input-kind.test.ts
new file mode 100644
index 00000000000..34c96e3073f
--- /dev/null
+++ b/src/renderer/src/lib/startup-draft-input-kind.test.ts
@@ -0,0 +1,113 @@
+// @vitest-environment happy-dom
+// A created worktree's draft reaches its agent by one of two renderer routes: the pane's own
+// startup paste, or the draft helper that waits for the agent. Both must write it as launch input.
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { TerminalInputKind } from '../../../shared/terminal-input-kind'
+import { bindSettlePaneSerializer } from '@/components/terminal-pane/pty-connection/pane-serializer-settle'
+import type { ConnectPanePtySession } from '@/components/terminal-pane/pty-connection/connect-pane-pty-session'
+import { STARTUP_DRAFT_PASTE_QUIET_MS } from '@/components/terminal-pane/pty-connection/pty-connect-limits'
+import { pasteDraftToAgentPtyWhenReady, submitPromptToAgentPty } from './agent-paste-draft'
+
+vi.mock('@/store', () => ({
+  useAppStore: {
+    getState: () => ({ settings: {}, terminalLayoutsByTabId: {} }),
+    subscribe: () => () => {}
+  }
+}))
+
+vi.mock('./worktree-runtime-owner', () => ({
+  getSettingsForWorktreeRuntimeOwner: () => ({}),
+  getRuntimeEnvironmentIdForWorktree: () => null
+}))
+
+vi.mock('./agent-draft-readiness', () => ({
+  waitForAgentDraftInputReady: async () => true
+}))
+
+const DRAFT = 'plan the migration'
+const originalApi = window.api
+
+function stubPtyApi(): { kinds: TerminalInputKind[] } {
+  const kinds: TerminalInputKind[] = []
+  const writeAccepted = vi.fn(async (_id: string, _data: string, inputKind: TerminalInputKind) => {
+    kinds.push(inputKind)
+    return true
+  })
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: both routes reach only pty.writeAccepted.
+  window.api = { pty: { writeAccepted, write: vi.fn() } } as unknown as typeof window.api
+  return { kinds }
+}
+
+/** The pane route: the pane's transport pastes the draft once the agent's composer is ready. */
+async function paneRouteKinds(): Promise<TerminalInputKind[]> {
+  const { kinds } = stubPtyApi()
+  const transport = {
+    getPtyId: () => 'pty-1',
+    sendInput: () => true,
+    sendInputAccepted: (data: string, inputKind: TerminalInputKind) =>
+      window.api.pty.writeAccepted('pty-1', data, inputKind)
+  }
+  const pane = { id: 1 }
+  const bag: Record<string, unknown> = {
+    pane,
+    transport,
+    disposed: false,
+    connectionId: null,
+    ownsStartupDraftPaste: true,
+    shouldDeliverStartupViaTerminalPaste: false,
+    startupDraftPrompt: DRAFT,
+    recordTerminalInputForHibernation: () => {},
+    deps: { worktreeId: 'wt-1', paneTransportsRef: { current: new Map([[pane.id, transport]]) } }
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the session is an any-typed bag; the draft path reads only the fields above.
+  const session = bag as unknown as ConnectPanePtySession
+  bindSettlePaneSerializer(session)
+  session.observeStartupDraftPasteReadiness('\x1b[?2004h')
+  await vi.advanceTimersByTimeAsync(STARTUP_DRAFT_PASTE_QUIET_MS)
+  await vi.runAllTimersAsync()
+  return kinds
+}
+
+/** The helper route: the draft helper waits for the agent, then writes through the runtime. */
+async function helperRouteKinds(): Promise<TerminalInputKind[]> {
+  const { kinds } = stubPtyApi()
+  const pasted = pasteDraftToAgentPtyWhenReady({
+    tabId: 'tab-1',
+    ptyId: 'pty-1',
+    content: DRAFT,
+    agent: 'aider'
+  })
+  await vi.runAllTimersAsync()
+  await expect(pasted).resolves.toBe(true)
+  return kinds
+}
+
+describe('a created worktree’s startup draft', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+    window.api = originalApi
+  })
+
+  it('writes as launch input on both renderer routes', async () => {
+    const paneKinds = await paneRouteKinds()
+    const helperKinds = await helperRouteKinds()
+
+    expect(paneKinds.length).toBeGreaterThan(0)
+    expect(new Set(paneKinds)).toEqual(new Set(['launch']))
+    expect(new Set(helperKinds)).toEqual(new Set(paneKinds))
+  })
+
+  it('differs from a prompt submitted to an agent that is already running', async () => {
+    const { kinds } = stubPtyApi()
+
+    const submitted = submitPromptToAgentPty({ tabId: 'tab-1', ptyId: 'pty-1', content: DRAFT })
+    await vi.runAllTimersAsync()
+
+    await expect(submitted).resolves.toBe(true)
+    expect(new Set(kinds)).toEqual(new Set(['driving']))
+  })
+})
diff --git a/src/renderer/src/lib/structured-agent-session-launch-exited-owner.test.ts b/src/renderer/src/lib/structured-agent-session-launch-exited-owner.test.ts
index 1662e4c0430..10ebbc8fd89 100644
--- a/src/renderer/src/lib/structured-agent-session-launch-exited-owner.test.ts
+++ b/src/renderer/src/lib/structured-agent-session-launch-exited-owner.test.ts
@@ -1,6 +1,6 @@
 // @vitest-environment happy-dom
 // The launch client against the create wire contract: a failed create whose provider is proven
-// gone reads as failed (with its reason) and Retry starts it again; any other verdict stays unknown.
+// gone reads as failed (with its refusal) and Retry starts it again; any other verdict stays unknown.
 
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type {
@@ -49,13 +49,14 @@ import {
   startStructuredAgentLaunch
 } from './structured-agent-session-launch'
 import {
-  getStructuredAgentSessionLaunchFailureReason,
+  getStructuredAgentSessionLaunchFailure,
   resetStructuredAgentLaunchRegistryForTests
 } from './structured-agent-session-launch-registry'
 import { resetStructuredAgentLaunchPersistenceForTests } from './structured-agent-session-launch-persistence'
 
 const WORKTREE = 'wt-1'
 const EXIT_REASON = 'claude stream-json exited (code 1): stderr tail'
+const HOST_REFUSAL = { kind: 'refused', code: 'agent_session_operation_invalid' }
 
 /** The verdict the host puts on the failed operation's replay; undefined models an older host. */
 let replayVerdict: AgentSessionOwnerVerdict | undefined
@@ -125,12 +126,13 @@ beforeEach(() => {
 })
 
 describe('structured launch after a host-failed create', () => {
-  it('fails with the host reason when the provider is proven gone, and Retry starts it under a new operation', async () => {
+  it('fails with the host refusal when the provider is proven gone, and Retry starts it under a new operation', async () => {
     const sessionId = launch()
     await settle(sessionId)
 
     expect(getStructuredAgentSessionLaunchLifecycle(WORKTREE, sessionId)).toBe('failed')
-    expect(getStructuredAgentSessionLaunchFailureReason(WORKTREE, sessionId)).toBe(EXIT_REASON)
+    // The host's message is for its log; the Retry line words the refusal.
+    expect(getStructuredAgentSessionLaunchFailure(WORKTREE, sessionId)).toEqual(HOST_REFUSAL)
     expect(createdOperations.every((operation) => operation === failedOperation)).toBe(true)
 
     expect(retryStructuredAgentSessionLaunch(WORKTREE, sessionId)).toBe(true)
@@ -147,7 +149,8 @@ describe('structured launch after a host-failed create', () => {
     const sessionId = launch()
     await settle(sessionId)
     expect(getStructuredAgentSessionLaunchLifecycle(WORKTREE, sessionId)).toBe('failed')
-    expect(getStructuredAgentSessionLaunchFailureReason(WORKTREE, sessionId)).toBe(EXIT_REASON)
+    // The host's message is for its log; the Retry line words the refusal.
+    expect(getStructuredAgentSessionLaunchFailure(WORKTREE, sessionId)).toEqual(HOST_REFUSAL)
     expect(createdOperations).toEqual([failedOperation])
     expect(retryStructuredAgentSessionLaunch(WORKTREE, sessionId)).toBe(true)
     await settle(sessionId)
diff --git a/src/renderer/src/lib/structured-agent-session-launch-failure.ts b/src/renderer/src/lib/structured-agent-session-launch-failure.ts
new file mode 100644
index 00000000000..b9ad791a0c4
--- /dev/null
+++ b/src/renderer/src/lib/structured-agent-session-launch-failure.ts
@@ -0,0 +1,18 @@
+// What a failed chat start's Retry line may say: the host's refusal, never its message.
+
+import { readAgentSessionRefusalReference } from '../../../shared/agent-session-wire-refusals'
+import {
+  agentSessionRefusalFailure,
+  readAgentSessionErrorRefusal,
+  type AgentSessionWriteRefusal
+} from '../../../shared/agent-session-write-failure'
+
+/** The host's refusal behind a failed launch; undefined when the failure carried none (a lost
+ *  reply, a local fault, an older host). Reads a create error's own refusal or an RPC error's. */
+export function structuredLaunchFailure(error: unknown): AgentSessionWriteRefusal | undefined {
+  const refusal =
+    error instanceof Error && 'refusal' in error
+      ? readAgentSessionRefusalReference(error.refusal)
+      : readAgentSessionErrorRefusal(error)
+  return refusal ? agentSessionRefusalFailure(refusal) : undefined
+}
diff --git a/src/renderer/src/lib/structured-agent-session-launch-options.test.ts b/src/renderer/src/lib/structured-agent-session-launch-options.test.ts
index c48ccf403e7..3787ebe3608 100644
--- a/src/renderer/src/lib/structured-agent-session-launch-options.test.ts
+++ b/src/renderer/src/lib/structured-agent-session-launch-options.test.ts
@@ -3,6 +3,7 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { RuntimeMobileSessionTabsResult } from '../../../shared/runtime-session-contracts'
 import type { StructuredAgentSessionLaunchIntent } from '@/lib/launch-structured-agent-session'
+import { RuntimeRpcCallError } from '@/runtime/runtime-rpc-result'
 
 type CallParams = {
   envelope?: { expectedRuntimeFence?: number | null }
@@ -243,12 +244,16 @@ describe('picks made while a chat launches', () => {
     await settle()
     setOptionReplies[0]!.resolve({
       ok: false,
-      refusal: { code: 'agent_session_option_invalid', message: 'Model gpt-missing is unavailable' }
+      refusal: {
+        code: 'agent_session_operation_capacity',
+        message: 'Model gpt-missing is unavailable'
+      }
     })
 
+    // The picker gets the refusal as a fact; the host's diagnostic is not kept.
     await expect(pick).resolves.toEqual({
       kind: 'refused',
-      message: 'Model gpt-missing is unavailable'
+      failure: { kind: 'refused', code: 'agent_session_operation_capacity' }
     })
     await expect(launch.promptDeliveryResult).resolves.toEqual({
       delivered: true,
@@ -260,6 +265,41 @@ describe('picks made while a chat launches', () => {
     ])
   })
 
+  it('reports a refusal the host threw as its fact, never the bare code it carries as a message', async () => {
+    mocks.launch.mockResolvedValue({ sessionId: SESSION_ID, fence: 1 })
+    startStructuredAgentLaunch(WORKTREE_ID, 'codex')
+    const pick = holdStructuredAgentSessionLaunchOption(SESSION_ID, 'model', 'gpt-missing')
+    await settle()
+    setOptionReplies[0]!.resolve(
+      Promise.reject(
+        new RuntimeRpcCallError({
+          id: 'request-1',
+          ok: false,
+          error: {
+            code: 'runtime_error',
+            message: 'agent_session_journal_unreadable',
+            data: {
+              refusal: {
+                code: 'agent_session_journal_unreadable',
+                details: { reason: 'journalUnavailable' }
+              }
+            }
+          },
+          _meta: { runtimeId: 'runtime-1' }
+        })
+      )
+    )
+
+    await expect(pick).resolves.toEqual({
+      kind: 'refused',
+      failure: {
+        kind: 'refused',
+        code: 'agent_session_journal_unreadable',
+        details: { reason: 'journalUnavailable' }
+      }
+    })
+  })
+
   it('keeps picks held through a failed start and applies them to the retry', async () => {
     mocks.launch
       .mockRejectedValueOnce(new StructuredAgentSessionCreateRefusalError('unsupported'))
diff --git a/src/renderer/src/lib/structured-agent-session-launch-options.ts b/src/renderer/src/lib/structured-agent-session-launch-options.ts
index ea1f1cb18cb..b087264ce25 100644
--- a/src/renderer/src/lib/structured-agent-session-launch-options.ts
+++ b/src/renderer/src/lib/structured-agent-session-launch-options.ts
@@ -9,6 +9,8 @@ import {
   structuredAgentSessionPayloadFingerprint
 } from '../../../shared/structured-agent-session-mutation'
 import { callStructuredAgentSession } from '@/runtime/structured-agent-session-client'
+import { RuntimeRpcCallError } from '@/runtime/runtime-rpc-result'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 import {
   StructuredAgentSessionLaunchCancelledError,
   type StructuredAgentLaunchReceipt
@@ -19,6 +21,11 @@ import {
   subscribeStructuredAgentLaunchStatus,
   type StructuredLaunchState
 } from './structured-agent-session-launch-registry'
+import {
+  agentSessionRefusalFailure,
+  agentSessionThrownFailure,
+  type AgentSessionWriteFailure
+} from '../../../shared/agent-session-write-failure'
 
 /** The options a launch starts with, replaced whole so readers can compare by identity. */
 export type StructuredLaunchSelection = {
@@ -30,7 +37,7 @@ export type StructuredLaunchSelection = {
 
 export type StructuredLaunchOptionOutcome =
   | { kind: 'accepted'; options: Readonly<Record<string, string>> }
-  | { kind: 'refused'; message: string }
+  | { kind: 'refused'; failure: AgentSessionWriteFailure }
   | { kind: 'superseded' }
 
 type OptionReply = (outcome: StructuredLaunchOptionOutcome) => void
@@ -87,7 +94,7 @@ async function setLaunchOption(
     >({ kind: 'local' }, 'agentSession.setOption', {
       envelope: {
         sessionId,
-        clientOperationId: createStructuredAgentSessionOperationId(() => crypto.randomUUID()),
+        clientOperationId: createStructuredAgentSessionOperationId(createBrowserUuid),
         expectedRuntimeFence: fence,
         payloadFingerprint: structuredAgentSessionPayloadFingerprint({
           method: 'agentSession.setOption',
@@ -99,9 +106,15 @@ async function setLaunchOption(
     })
     return result.ok
       ? { kind: 'accepted', options: result.value.options ?? { [key]: value } }
-      : { kind: 'refused', message: result.refusal.message }
+      : { kind: 'refused', failure: agentSessionRefusalFailure(result.refusal) }
   } catch (error) {
-    return { kind: 'refused', message: error instanceof Error ? error.message : String(error) }
+    return {
+      kind: 'refused',
+      failure: agentSessionThrownFailure(
+        error,
+        error instanceof RuntimeRpcCallError ? error.code : undefined
+      )
+    }
   }
 }
 
diff --git a/src/renderer/src/lib/structured-agent-session-launch-prompt.test.ts b/src/renderer/src/lib/structured-agent-session-launch-prompt.test.ts
index b0e8d0674ff..6945c045645 100644
--- a/src/renderer/src/lib/structured-agent-session-launch-prompt.test.ts
+++ b/src/renderer/src/lib/structured-agent-session-launch-prompt.test.ts
@@ -1,7 +1,10 @@
 // @vitest-environment happy-dom
 
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { enqueueStructuredAgentSessionLaunchPrompt } from '@/components/native-chat/structured-agent-session-outbox-storage'
+import {
+  enqueueStructuredAgentSessionLaunchPrompt,
+  mutateStructuredAgentSessionLaunchPrompt
+} from '@/components/native-chat/structured-agent-session-outbox-storage'
 
 const mocks = vi.hoisted(() => ({ call: vi.fn() }))
 
@@ -57,4 +60,32 @@ describe('settleStructuredAgentLaunchPrompt', () => {
     }[]
     expect(persisted).toMatchObject([{ state: 'dispatching' }])
   })
+
+  it('drops the previous attempt failure when the launch path sends the message again', async () => {
+    const stagedEntry = enqueueStructuredAgentSessionLaunchPrompt('session-1', 'review this')
+    mutateStructuredAgentSessionLaunchPrompt(
+      'session-1',
+      stagedEntry!.clientMessageId,
+      (entry) => ({
+        ...entry,
+        lastFailure: { kind: 'refused', code: 'agent_session_operation_capacity' }
+      })
+    )
+    mocks.call.mockResolvedValue({
+      ok: false,
+      refusal: { code: 'agent_session_checkpoint_stale', message: 'stale' }
+    })
+
+    await settleStructuredAgentLaunchPrompt({
+      launchResult: Promise.resolve({ sessionId: 'session-1', fence: 1 }),
+      options: { prompt: 'review this' },
+      stagedEntry
+    })
+
+    const persisted: unknown = JSON.parse(localStorage.getItem(localStorage.key(0)!) ?? '[]')
+    expect(persisted).toHaveLength(1)
+    expect(persisted).not.toContainEqual(
+      expect.objectContaining({ lastFailure: expect.anything() })
+    )
+  })
 })
diff --git a/src/renderer/src/lib/structured-agent-session-launch-prompt.ts b/src/renderer/src/lib/structured-agent-session-launch-prompt.ts
index de7f4733644..ba9bef0b8d7 100644
--- a/src/renderer/src/lib/structured-agent-session-launch-prompt.ts
+++ b/src/renderer/src/lib/structured-agent-session-launch-prompt.ts
@@ -4,15 +4,18 @@ import type {
 } from '../../../shared/agent-session-wire'
 import {
   requeueStructuredAgentSessionSendRefusal,
+  stageStructuredAgentSessionOutboxEntryForSend,
   structuredAgentSessionSendRequest,
   type StructuredAgentSessionOutboxEntry
 } from '../../../shared/structured-agent-session-outbox'
+import { agentSessionRefusalFailure } from '../../../shared/agent-session-write-failure'
 import { createStructuredAgentSessionOperationId } from '../../../shared/structured-agent-session-mutation'
 import {
   mutateStructuredAgentSessionLaunchPrompt,
   type StructuredAgentSessionLaunchPromptMutation
 } from '@/components/native-chat/structured-agent-session-outbox-storage'
 import { callStructuredAgentSession } from '@/runtime/structured-agent-session-client'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export type StructuredPromptDeliveryResult = {
   delivered: boolean
@@ -91,11 +94,9 @@ async function dispatchStructuredLaunchPrompt(
   receipt: LaunchReceipt
 ): Promise<boolean> {
   if (
-    !mutateEntry(entry, (current) => ({
-      ...current,
-      state: 'dispatching',
-      lastAttemptAt: Date.now()
-    }))
+    !mutateEntry(entry, (current) =>
+      stageStructuredAgentSessionOutboxEntryForSend(current, Date.now())
+    )
   ) {
     return false
   }
@@ -111,13 +112,18 @@ async function dispatchStructuredLaunchPrompt(
       mutateEntry(entry, (current) =>
         requeueStructuredAgentSessionSendRefusal(
           current,
-          result.refusal.code,
-          () => createStructuredAgentSessionOperationId(() => crypto.randomUUID()),
+          agentSessionRefusalFailure(result.refusal),
+          () => createStructuredAgentSessionOperationId(createBrowserUuid),
           entry.lastAttemptAt !== null
         )
       )
       return false
     }
+    if ('queued' in result.value) {
+      // The host holds the draft; the outbox entry is spent.
+      mutateEntry(entry, () => null)
+      return true
+    }
     const dispatchState = result.value.submission.dispatchState
     mutateEntry(entry, (current) =>
       dispatchState === 'accepted'
diff --git a/src/renderer/src/lib/structured-agent-session-launch-registry.ts b/src/renderer/src/lib/structured-agent-session-launch-registry.ts
index dcafea65803..2f444446e03 100644
--- a/src/renderer/src/lib/structured-agent-session-launch-registry.ts
+++ b/src/renderer/src/lib/structured-agent-session-launch-registry.ts
@@ -1,5 +1,6 @@
 import { useSyncExternalStore } from 'react'
 import type { AgentSessionHandleProvider } from '../../../shared/agent-session-provider-handle'
+import type { AgentSessionWriteRefusal } from '../../../shared/agent-session-write-failure'
 import type { StructuredAgentSessionResumeSource } from '../../../shared/structured-agent-session-create'
 import type { StructuredLaunchRecoveryState } from './structured-agent-session-launch-recovery'
 import type { StructuredLaunchSelection } from './structured-agent-session-launch-options'
@@ -26,8 +27,9 @@ export type StructuredLaunchState = StructuredLaunchRecoveryState & {
   /** Fixed by the caller that opened this launch so coalesced prompts use one delivery mode. */
   promptDelivery: StructuredAgentLaunchOptions['promptDelivery']
   callers: StructuredLaunchCallerGroup
-  /** Why the last attempt failed, shown beside Retry; the toast stays generic. */
-  failureReason?: string
+  /** The host's refusal behind the last failed attempt, worded beside Retry; the toast stays
+   *  generic. Absent when the failure named none. */
+  failure?: AgentSessionWriteRefusal
   selection: StructuredLaunchSelection
 }
 
@@ -176,25 +178,25 @@ export function getStructuredAgentSessionLaunchResumes(sessionId: string): boole
   return resumeFrom !== undefined
 }
 
-export function getStructuredAgentSessionLaunchFailureReason(
+export function getStructuredAgentSessionLaunchFailure(
   worktreeId: string,
   sessionId: string
-): string | null {
+): AgentSessionWriteRefusal | null {
   const state = getStructuredLaunchStateBySessionId(sessionId)
   return state &&
     matchesLaunchWorktree(state, worktreeId) &&
     launchStateLifecycle(state) === 'failed'
-    ? (state.failureReason ?? null)
+    ? (state.failure ?? null)
     : null
 }
 
-export function useStructuredAgentSessionLaunchFailureReason(
+export function useStructuredAgentSessionLaunchFailure(
   worktreeId: string,
   sessionId: string
-): string | null {
+): AgentSessionWriteRefusal | null {
   return useSyncExternalStore(
     subscribeStructuredAgentLaunchStatus,
-    () => getStructuredAgentSessionLaunchFailureReason(worktreeId, sessionId),
+    () => getStructuredAgentSessionLaunchFailure(worktreeId, sessionId),
     () => null
   )
 }
diff --git a/src/renderer/src/lib/structured-agent-session-launch.ts b/src/renderer/src/lib/structured-agent-session-launch.ts
index 5ad75c36ed6..4c62128813b 100644
--- a/src/renderer/src/lib/structured-agent-session-launch.ts
+++ b/src/renderer/src/lib/structured-agent-session-launch.ts
@@ -27,6 +27,7 @@ import {
 } from '@/lib/structured-agent-session-launch-callers'
 import * as launchDraft from './structured-agent-session-launch-draft'
 import { trackStructuredLaunchFailureToast } from './structured-agent-session-launch-failure-toast'
+import { structuredLaunchFailure } from './structured-agent-session-launch-failure'
 import {
   deleteStructuredLaunchStateIfCurrent,
   getStructuredLaunchState,
@@ -51,7 +52,7 @@ export {
   retireStructuredAgentSessionLaunchCancellationTombstone,
   shouldRetainStructuredAgentSessionLaunchTab,
   subscribeStructuredAgentLaunchStatus,
-  useStructuredAgentSessionLaunchFailureReason,
+  useStructuredAgentSessionLaunchFailure,
   useStructuredAgentSessionLaunchLifecycle,
   type StructuredAgentLaunchStatus,
   type StructuredAgentSessionLaunchLifecycle
@@ -138,7 +139,13 @@ function trackLaunchSettlement(
         }
         return
       }
-      state.failureReason = error instanceof Error ? error.message : String(error)
+      // The host's message is for its log; the Retry line words the refusal itself.
+      const failure = structuredLaunchFailure(error)
+      if (failure) {
+        state.failure = failure
+      } else {
+        delete state.failure
+      }
       if (error instanceof StructuredAgentSessionCreateRefusalError) {
         settleStructuredLaunchRefusal(state)
       } else if (!state.visibilityUnknown) {
@@ -171,7 +178,7 @@ function restartStructuredLaunchState(state: StructuredLaunchState): void {
     state.intent = retryStructuredAgentSessionLaunchIntent(state.intent)
   }
   resetStructuredLaunchCallers(state)
-  delete state.failureReason
+  delete state.failure
   state.callers.outcome = 'pending'
   // A new create seeds from the settings of now; picks held through the failure still apply.
   state.selection = { ...state.selection, seed: state.intent.seedOptions }
diff --git a/src/renderer/src/lib/structured-agent-startup-label-census.test.ts b/src/renderer/src/lib/structured-agent-startup-label-census.test.ts
deleted file mode 100644
index 888e17c46c1..00000000000
--- a/src/renderer/src/lib/structured-agent-startup-label-census.test.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-import { glob } from 'tinyglobby'
-
-const REPO_ROOT = join(import.meta.dirname, '../../../..')
-
-describe('structured launch copy', () => {
-  it('never exposes the removed starting-chat phase or label', async () => {
-    const files = await glob(
-      ['src/renderer/src/**/*.ts', 'src/renderer/src/**/*.tsx', 'src/renderer/src/i18n/**/*.json'],
-      {
-        cwd: REPO_ROOT,
-        ignore: ['**/*.test.ts', '**/*.test.tsx']
-      }
-    )
-    const offenders = files.filter((file) => {
-      const source = readFileSync(join(REPO_ROOT, file), 'utf8')
-      return (
-        source.includes('starting-chat') ||
-        source.includes('Starting chat…') ||
-        /Starting (?:\{\{value0\}\}|Claude|Codex) chat…/.test(source)
-      )
-    })
-
-    expect(offenders).toEqual([])
-  })
-})
diff --git a/src/renderer/src/lib/terminal-input-activity-coalescing.test.ts b/src/renderer/src/lib/terminal-input-activity-coalescing.test.ts
index 125ab646382..e80abb66466 100644
--- a/src/renderer/src/lib/terminal-input-activity-coalescing.test.ts
+++ b/src/renderer/src/lib/terminal-input-activity-coalescing.test.ts
@@ -118,18 +118,6 @@ describe('terminal input activity coalescing', () => {
     expect(store.stored[OTHER_PANE]).toBe(1_100)
   })
 
-  it('clears the flush timer so a reset leaves no pending work', () => {
-    const store = createStore()
-
-    type(store, PANE, 1_000)
-    type(store, PANE, 1_100)
-    resetTerminalInputActivityCoalescingForTests()
-    vi.advanceTimersByTime(TERMINAL_INPUT_ACTIVITY_WRITE_INTERVAL_MS * 4)
-
-    expect(store.stored[PANE]).toBe(1_000)
-    expect(vi.getTimerCount()).toBe(0)
-  })
-
   it('writes immediately again once the coalescing window has passed', () => {
     const store = createStore()
 
diff --git a/src/renderer/src/lib/terminal-layout-equality.ts b/src/renderer/src/lib/terminal-layout-equality.ts
index 88eca78e0d3..b13dcc37bb9 100644
--- a/src/renderer/src/lib/terminal-layout-equality.ts
+++ b/src/renderer/src/lib/terminal-layout-equality.ts
@@ -49,6 +49,7 @@ export function terminalLayoutEqual(
     terminalLayoutNodeEqual(a?.root, b.root) &&
     (a?.activeLeafId ?? null) === b.activeLeafId &&
     (a?.expandedLeafId ?? null) === b.expandedLeafId &&
+    (a?.chatLeafId ?? null) === (b.chatLeafId ?? null) &&
     sameStringRecord(a?.ptyIdsByLeafId, b.ptyIdsByLeafId) &&
     sameStringRecord(a?.buffersByLeafId, b.buffersByLeafId) &&
     sameStringRecord(a?.scrollbackRefsByLeafId, b.scrollbackRefsByLeafId) &&
diff --git a/src/renderer/src/lib/terminal-links-cjk.test.ts b/src/renderer/src/lib/terminal-links-cjk.test.ts
new file mode 100644
index 00000000000..d1cddfb74f3
--- /dev/null
+++ b/src/renderer/src/lib/terminal-links-cjk.test.ts
@@ -0,0 +1,43 @@
+import { describe, expect, it } from 'vitest'
+import { extractTerminalFileLinks, resolveTerminalFileLinkText } from './terminal-links'
+
+describe('CJK terminal path names', () => {
+  for (const character of ['・', '･', '〜', '～']) {
+    it.each([
+      '/tmp/前CHAR後/a.txt',
+      'C:/tmp/前CHAR後/a.txt',
+      String.raw`C:\tmp\前CHAR後\a.txt`,
+      '//nas/base/前CHAR後/a.txt',
+      String.raw`\\nas\base\前CHAR後\a.txt`,
+      './前CHAR後/a.txt',
+      '/tmp/前CHAR後/space name/a.txt'
+    ])(`keeps ${character} in %s`, (template) => {
+      const filePath = template.replace('CHAR', character)
+      const links = extractTerminalFileLinks(filePath)
+      expect(links.map((link) => link.pathText)).toEqual([filePath])
+      expect(links[0]).toMatchObject({ startIndex: 0, endIndex: filePath.length })
+    })
+
+    it(`preserves location and normalized Windows target for ${character}`, () => {
+      expect(resolveTerminalFileLinkText(`C:\\tmp\\前${character}後\\a.txt:12:3`, '/cwd')).toEqual({
+        absolutePath: `C:/tmp/前${character}後/a.txt`,
+        line: 12,
+        column: 3
+      })
+    })
+
+    it.each([',', ';', '"', "'", '，', '。'])(`stops ${character} paths at %s`, (delimiter) => {
+      const filePath = `/tmp/前${character}後/a.txt`
+      expect(
+        extractTerminalFileLinks(`${filePath}${delimiter}次`).map((link) => link.pathText)
+      ).toEqual([filePath])
+    })
+
+    it(`keeps URI handling separate for ${character}`, () => {
+      expect(extractTerminalFileLinks(`https://example.com/前${character}後/a.txt`)).toEqual([])
+      expect(extractTerminalFileLinks(`file:///tmp/前${character}後/a.txt`)[0]?.pathText).toBe(
+        `/tmp/前${character}後/a.txt`
+      )
+    })
+  }
+})
diff --git a/src/renderer/src/lib/terminal-links.ts b/src/renderer/src/lib/terminal-links.ts
index 970c6d9208c..bffbc9c653a 100644
--- a/src/renderer/src/lib/terminal-links.ts
+++ b/src/renderer/src/lib/terminal-links.ts
@@ -33,8 +33,9 @@ export type ResolvedTerminalFileLink = Pick<ParsedTerminalFileLink, 'line' | 'co
 // `:line` and `:col` suffixes (e.g. `src/foo.ts:12:3`, `./bin`, `/abs/path`).
 // Why: framework route files commonly use punctuation segments like
 // `app/(shop)/products/[id]/page.tsx`; keep those links whole.
+// Keep Japanese middle dots and tildes without admitting prose delimiters.
 const LOCAL_PATH_REGEX =
-  /(?:~[\\/]|[\\/]|\.{1,2}[\\/]|[A-Za-z]:[\\/]|[\p{L}\p{N}\p{M}._-]+[\\/])[\p{L}\p{N}\p{M}._~\-/%+@\\()[\]]*(?::\d+)?(?::\d+)?/gu
+  /(?:~[\\/]|[\\/]|\.{1,2}[\\/]|[A-Za-z]:[\\/]|[\p{L}\p{N}\p{M}._-]+[\\/])[\p{L}\p{N}\p{M}._~\-/%+@\\()[\]\u30FB\uFF65\u301C\uFF5E]*(?::\d+)?(?::\d+)?/gu
 
 // Matches separator paths whose file or folder names include spaces. This runs
 // before LOCAL_PATH_REGEX so `/Users/A/Foo Bar/file.ts` is claimed as one link
diff --git a/src/renderer/src/lib/unified-tab-anchor-insertion.test.ts b/src/renderer/src/lib/unified-tab-anchor-insertion.test.ts
new file mode 100644
index 00000000000..49592599b7c
--- /dev/null
+++ b/src/renderer/src/lib/unified-tab-anchor-insertion.test.ts
@@ -0,0 +1,106 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Tab, TabGroup } from '../../../shared/tab-types'
+
+type AnchorStoreState = {
+  unifiedTabsByWorktree: Record<string, Tab[]>
+  groupsByWorktree: Record<string, TabGroup[]>
+  reorderUnifiedTabs: ReturnType<typeof vi.fn>
+}
+
+const mocks = vi.hoisted(() => {
+  const state: { current: AnchorStoreState | null } = { current: null }
+  return { state }
+})
+
+vi.mock('../store', () => ({
+  useAppStore: { getState: () => mocks.state.current }
+}))
+
+import { insertUnifiedTabAfterAnchor } from './unified-tab-anchor-insertion'
+
+const WT = 'wt-1'
+
+function tab(id: string, groupId: string, isPinned = false): Tab {
+  return {
+    id,
+    entityId: id,
+    groupId,
+    worktreeId: WT,
+    contentType: 'terminal',
+    label: id,
+    customLabel: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 1,
+    isPinned
+  }
+}
+
+function seed(tabs: Tab[], groups: TabGroup[]): void {
+  mocks.state.current = {
+    unifiedTabsByWorktree: { [WT]: tabs },
+    groupsByWorktree: { [WT]: groups },
+    reorderUnifiedTabs: vi.fn()
+  }
+}
+
+describe('insertUnifiedTabAfterAnchor', () => {
+  beforeEach(() => {
+    seed([], [])
+  })
+
+  it('moves a late terminal right after its anchor', () => {
+    seed(
+      [tab('A', 'g1'), tab('B', 'g1'), tab('C', 'g1'), tab('T', 'g1')],
+      [{ id: 'g1', worktreeId: WT, activeTabId: 'A', tabOrder: ['A', 'B', 'C', 'T'] }]
+    )
+    insertUnifiedTabAfterAnchor(WT, 'T', 'A')
+    expect(mocks.state.current?.reorderUnifiedTabs).toHaveBeenCalledWith(
+      'g1',
+      ['A', 'T', 'B', 'C'],
+      {
+        recordInteraction: false
+      }
+    )
+  })
+
+  it('keeps an unpinned terminal after the pinned prefix', () => {
+    seed(
+      [tab('P1', 'g1', true), tab('P2', 'g1', true), tab('C', 'g1'), tab('T', 'g1')],
+      [{ id: 'g1', worktreeId: WT, activeTabId: 'P1', tabOrder: ['P1', 'P2', 'C', 'T'] }]
+    )
+    insertUnifiedTabAfterAnchor(WT, 'T', 'P1')
+    expect(mocks.state.current?.reorderUnifiedTabs).toHaveBeenCalledWith(
+      'g1',
+      ['P1', 'P2', 'T', 'C'],
+      {
+        recordInteraction: false
+      }
+    )
+  })
+
+  it('is a no-op for a missing anchor or tabs in different groups', () => {
+    seed(
+      [tab('A', 'g1'), tab('T', 'g2')],
+      [
+        { id: 'g1', worktreeId: WT, activeTabId: 'A', tabOrder: ['A'] },
+        { id: 'g2', worktreeId: WT, activeTabId: 'T', tabOrder: ['T'] }
+      ]
+    )
+    insertUnifiedTabAfterAnchor(WT, 'T', 'A')
+    insertUnifiedTabAfterAnchor(WT, 'T', 'missing')
+    expect(mocks.state.current?.reorderUnifiedTabs).not.toHaveBeenCalled()
+  })
+
+  it('is a no-op when a stale group order lists a tab another group owns', () => {
+    seed(
+      [tab('A', 'g1'), tab('T', 'g2')],
+      [
+        { id: 'g1', worktreeId: WT, activeTabId: 'A', tabOrder: ['A', 'T'] },
+        { id: 'g2', worktreeId: WT, activeTabId: 'T', tabOrder: ['T'] }
+      ]
+    )
+    insertUnifiedTabAfterAnchor(WT, 'T', 'A')
+    expect(mocks.state.current?.reorderUnifiedTabs).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/lib/unified-tab-anchor-insertion.ts b/src/renderer/src/lib/unified-tab-anchor-insertion.ts
index 2b9055b919f..ab3bc2c68b7 100644
--- a/src/renderer/src/lib/unified-tab-anchor-insertion.ts
+++ b/src/renderer/src/lib/unified-tab-anchor-insertion.ts
@@ -1,6 +1,7 @@
 import { useAppStore } from '../store'
+import { insertTabIdIntoOrder } from '../store/slices/tabs/tabs-tab-order'
 
-/** Move `tabId` to sit immediately after `anchorTabId`; no-op unless both share a group. */
+/** Move `tabId` to sit immediately after `anchorTabId`; no-op unless both share a live group. */
 export function insertUnifiedTabAfterAnchor(
   worktreeId: string,
   tabId: string,
@@ -10,13 +11,30 @@ export function insertUnifiedTabAfterAnchor(
     return
   }
   const state = useAppStore.getState()
+  const tabs = state.unifiedTabsByWorktree[worktreeId] ?? []
+  const tab = tabs.find((candidate) => candidate.id === tabId)
+  const anchor = tabs.find((candidate) => candidate.id === anchorTabId)
+  if (!tab || !anchor || tab.groupId !== anchor.groupId) {
+    return
+  }
   const group = (state.groupsByWorktree[worktreeId] ?? []).find(
-    (candidate) => candidate.tabOrder.includes(tabId) && candidate.tabOrder.includes(anchorTabId)
+    (candidate) => candidate.id === tab.groupId
   )
-  if (!group) {
+  if (!group?.tabOrder.includes(tabId) || !group.tabOrder.includes(anchorTabId)) {
+    return
+  }
+  const order = insertTabIdIntoOrder(
+    group.tabOrder,
+    tabs,
+    tabId,
+    tab.isPinned === true,
+    anchorTabId
+  )
+  if (
+    order.length === group.tabOrder.length &&
+    order.every((id, index) => id === group.tabOrder[index])
+  ) {
     return
   }
-  const order = group.tabOrder.filter((id) => id !== tabId)
-  order.splice(order.indexOf(anchorTabId) + 1, 0, tabId)
   state.reorderUnifiedTabs(group.id, order, { recordInteraction: false })
 }
diff --git a/src/renderer/src/lib/wake-sleeping-agents-in-background.test.ts b/src/renderer/src/lib/wake-sleeping-agents-in-background.test.ts
index 40281b4a244..dc8dc8452b8 100644
--- a/src/renderer/src/lib/wake-sleeping-agents-in-background.test.ts
+++ b/src/renderer/src/lib/wake-sleeping-agents-in-background.test.ts
@@ -23,7 +23,7 @@ vi.mock('./resume-sleeping-agent-session', () => ({
 // the gating, not the predicate internals.
 const isPassiveSpy = vi.fn()
 vi.mock('./sleeping-agent-pane-ownership', () => ({
-  isPassiveCompletedHibernationEvidence: (record: unknown) => isPassiveSpy(record),
+  activationTreatsNoteAsFinished: (record: unknown) => isPassiveSpy(record),
   recordPaneIsOwnedByPreservedPane: () => false,
   getProviderSessionClaimKey: (record: {
     worktreeId: string
diff --git a/src/renderer/src/lib/wake-sleeping-agents-in-background.ts b/src/renderer/src/lib/wake-sleeping-agents-in-background.ts
index df22b07f209..4cfe88c51b8 100644
--- a/src/renderer/src/lib/wake-sleeping-agents-in-background.ts
+++ b/src/renderer/src/lib/wake-sleeping-agents-in-background.ts
@@ -9,7 +9,7 @@ import { parseLegacyNumericPaneKey, parsePaneKey } from '../../../shared/stable-
 import { resumeSleepingAgentSessionsForWorktree } from './resume-sleeping-agent-session'
 import {
   getProviderSessionClaimKey,
-  isPassiveCompletedHibernationEvidence,
+  activationTreatsNoteAsFinished,
   recordPaneIsOwnedByPreservedPane
 } from './sleeping-agent-pane-ownership'
 
@@ -89,12 +89,12 @@ function getCanonicalPassiveWakeRecords(
 ): SleepingAgentSessionRecord[] {
   const activeClaimKeys = new Set(
     records
-      .filter((record) => !isPassiveCompletedHibernationEvidence(record))
+      .filter((record) => !activationTreatsNoteAsFinished(record))
       .map(getProviderSessionClaimKey)
   )
   const recordsByClaim = new Map<string, SleepingAgentSessionRecord[]>()
   for (const record of records) {
-    if (!isPassiveCompletedHibernationEvidence(record)) {
+    if (!activationTreatsNoteAsFinished(record)) {
       continue
     }
     const claimKey = getProviderSessionClaimKey(record)
diff --git a/src/renderer/src/lib/workspace-activation-terminal-focus.test.ts b/src/renderer/src/lib/workspace-activation-terminal-focus.test.ts
index 26bbe4b1ebd..e87fc615042 100644
--- a/src/renderer/src/lib/workspace-activation-terminal-focus.test.ts
+++ b/src/renderer/src/lib/workspace-activation-terminal-focus.test.ts
@@ -1,209 +1,235 @@
-import type * as SyncRuntimeGraphModule from '@/runtime/sync-runtime-graph'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+// @vitest-environment happy-dom
+import type { AppState } from '@/store/types'
+import { act, createElement } from 'react'
+import { createRoot } from 'react-dom/client'
+import { Dialog, DialogContent, DialogTitle } from '@/components/ui/dialog'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const focusTerminalTabSurfaceMock = vi.hoisted(() => vi.fn())
-const focusRuntimeTerminalSurfaceMock = vi.hoisted(() => vi.fn())
-const getStateMock = vi.hoisted(() => vi.fn())
+globalThis.IS_REACT_ACT_ENVIRONMENT = true
 
-vi.mock('@/lib/focus-terminal-tab-surface', () => ({
-  focusTerminalTabSurface: focusTerminalTabSurfaceMock
+const mocks = vi.hoisted(() => ({
+  focus: vi.fn(),
+  getState: vi.fn(),
+  subscribe: vi.fn()
 }))
-
-vi.mock('@/runtime/sync-runtime-graph', () => ({
-  focusRuntimeTerminalSurface: focusRuntimeTerminalSurfaceMock
-}))
-
+vi.mock('@/runtime/sync-runtime-graph', () => ({ focusRuntimeTerminalSurface: mocks.focus }))
 vi.mock('@/store', () => ({
-  useAppStore: {
-    getState: getStateMock
-  }
+  useAppStore: { getState: mocks.getState, subscribe: mocks.subscribe }
 }))
 
 import { queueWorkspaceActivationTerminalFocus } from './workspace-activation-terminal-focus'
 
-const CHAT_VIEW_LEAF_ID = 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
-
-type FocusState = {
-  activeWorktreeId: string | null
-  activeView: string
-  activeTabType: string
-  activeTabId: string | null
-}
-
-let pendingFrame: (() => void) | null = null
-
-function setFocusState(state: FocusState): void {
-  getStateMock.mockImplementation(() => state)
-}
+let state: Pick<
+  AppState,
+  | 'activeWorktreeId'
+  | 'activeWorkspaceExecutionHostId'
+  | 'activeView'
+  | 'activeTabType'
+  | 'activeTabId'
+  | 'activeModal'
+>
+let frame: FrameRequestCallback | null
+let notifyStore: () => void
+let notifyMount: () => void
+const unsubscribe = vi.fn()
+const disconnect = vi.fn()
 
 function flushFrame(): void {
-  const frame = pendingFrame
-  pendingFrame = null
-  frame?.()
+  const callback = frame
+  frame = null
+  callback?.(0)
 }
 
-describe('queueWorkspaceActivationTerminalFocus', () => {
-  beforeEach(() => {
-    vi.clearAllMocks()
-    pendingFrame = null
-    vi.stubGlobal('requestAnimationFrame', (callback: FrameRequestCallback) => {
-      pendingFrame = () => callback(0)
-      return 1
-    })
-    focusRuntimeTerminalSurfaceMock.mockReturnValue(false)
+beforeEach(() => {
+  vi.clearAllMocks()
+  vi.useFakeTimers()
+  frame = null
+  state = {
+    activeWorktreeId: 'wt-1',
+    activeWorkspaceExecutionHostId: null,
+    activeView: 'terminal',
+    activeTabType: 'terminal',
+    activeTabId: 'tab-1',
+    activeModal: 'none'
+  }
+  mocks.getState.mockImplementation(() => state)
+  mocks.subscribe.mockImplementation((listener) => {
+    notifyStore = listener
+    return unsubscribe
   })
+  mocks.focus.mockReturnValue(false)
+  vi.stubGlobal('requestAnimationFrame', (callback: FrameRequestCallback) => {
+    frame = callback
+    return 1
+  })
+  vi.stubGlobal('cancelAnimationFrame', () => {
+    frame = null
+  })
+  vi.stubGlobal(
+    'MutationObserver',
+    class {
+      constructor(callback: () => void) {
+        notifyMount = callback
+      }
+      observe = vi.fn()
+      disconnect = disconnect
+    }
+  )
+})
+afterEach(() => {
+  document.dispatchEvent(new Event('pointerdown'))
+  document.body.replaceChildren()
+  vi.useRealTimers()
+  vi.unstubAllGlobals()
+})
 
-  it('focuses the primary tab from the activation result after the modal close frame', () => {
-    setFocusState({
-      activeWorktreeId: 'wt-1',
-      activeView: 'terminal',
-      activeTabType: 'terminal',
-      activeTabId: 'tab-1'
-    })
-
-    queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })
-
-    expect(focusRuntimeTerminalSurfaceMock).not.toHaveBeenCalled()
+describe('workspace activation focus', () => {
+  it('focuses an existing terminal after the palette closes and cleans up', () => {
+    mocks.focus.mockReturnValue(true)
+    expect(queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })).toBe(true)
+    expect(mocks.focus).not.toHaveBeenCalled()
     flushFrame()
-
-    expect(focusRuntimeTerminalSurfaceMock).toHaveBeenCalledWith('tab-1', null, 'wt-1')
-    expect(focusTerminalTabSurfaceMock).toHaveBeenCalledWith('tab-1')
+    expect(mocks.focus).toHaveBeenCalledWith('tab-1', null, 'wt-1')
+    expect(unsubscribe).toHaveBeenCalledOnce()
+    expect(disconnect).toHaveBeenCalledOnce()
+    expect(vi.getTimerCount()).toBe(0)
   })
 
-  it('uses the adopted active terminal tab when activation did not create one', () => {
-    setFocusState({
-      activeWorktreeId: 'wt-1',
-      activeView: 'terminal',
-      activeTabType: 'terminal',
-      activeTabId: 'tab-adopted'
-    })
-
+  it('waits for a sleeping terminal to mount instead of focusing another workspace', () => {
     queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: null })
     flushFrame()
-
-    expect(focusRuntimeTerminalSurfaceMock).toHaveBeenCalledWith('tab-adopted', null, 'wt-1')
-    expect(focusTerminalTabSurfaceMock).toHaveBeenCalledWith('tab-adopted')
-  })
-
-  it('does not fall back to DOM focus when the runtime surface handled focus', () => {
-    focusRuntimeTerminalSurfaceMock.mockReturnValue(true)
-    setFocusState({
-      activeWorktreeId: 'wt-1',
-      activeView: 'terminal',
-      activeTabType: 'terminal',
-      activeTabId: 'tab-1'
-    })
-
-    queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })
+    expect(mocks.focus).toHaveBeenCalledTimes(1)
+    expect(frame).toBeNull()
+    mocks.focus.mockReturnValue(true)
+    notifyMount()
     flushFrame()
-
-    expect(focusRuntimeTerminalSurfaceMock).toHaveBeenCalledWith('tab-1', null, 'wt-1')
-    expect(focusTerminalTabSurfaceMock).not.toHaveBeenCalled()
+    expect(mocks.focus).toHaveBeenLastCalledWith('tab-1', null, 'wt-1')
+    expect(unsubscribe).toHaveBeenCalledOnce()
   })
 
-  // Why: a legacy native chat is a terminal tab whose xterm stays mounted under the chat portal.
-  // Activation must leave the caret in the composer, so neither the runtime path's xterm focus
-  // nor the DOM fallback may fire. Runs the real runtime surface, not the module mock.
-  it('leaves a chat-view terminal tab unfocused on both the runtime and DOM paths', async () => {
-    const runtime = await vi.importActual<typeof SyncRuntimeGraphModule>(
-      '@/runtime/sync-runtime-graph'
-    )
-    focusRuntimeTerminalSurfaceMock.mockImplementation(runtime.focusRuntimeTerminalSurface)
-    const focus = vi.fn()
-    const pane = {
-      id: 1,
-      leafId: CHAT_VIEW_LEAF_ID,
-      container: {
-        querySelector: (selector: string) =>
-          selector === '.native-chat-pane-shell' ? ({} as Element) : null
-      },
-      terminal: { focus }
-    }
-    const manager = {
-      getPanes: () => [pane],
-      getActivePane: () => pane,
-      getLeafId: () => CHAT_VIEW_LEAF_ID,
-      getNumericIdForLeaf: () => pane.id,
-      setActivePane: vi.fn()
-    }
-    const unregister = runtime.registerRuntimeTerminalTab({
-      tabId: 'tab-1',
-      worktreeId: 'wt-1',
-      getManager: () => manager as never,
-      getContainer: () => null,
-      getPtyIdForPane: () => null,
-      getTabWideAgentHintLeafId: () => null
-    })
-    try {
-      setFocusState({
-        activeWorktreeId: 'wt-1',
-        activeView: 'terminal',
-        activeTabType: 'terminal',
-        activeTabId: 'tab-1'
-      })
-
-      queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })
-      flushFrame()
-
-      expect(focus).not.toHaveBeenCalled()
-      expect(focusTerminalTabSurfaceMock).not.toHaveBeenCalled()
-    } finally {
-      unregister()
-    }
-  })
-
-  // Why: #9939 — the return value is what stops the palette from running its whole-document
-  // fallback, which would grab the worktree the user just left, now mounted but hidden.
-  it('reports that it claimed focus for a terminal destination', () => {
-    setFocusState({
-      activeWorktreeId: 'wt-1',
-      activeView: 'terminal',
-      activeTabType: 'terminal',
-      activeTabId: 'tab-adopted'
-    })
-
+  it('claims a workspace whose terminal tab is created asynchronously', () => {
+    state.activeTabId = null
     expect(queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: null })).toBe(true)
-  })
-
-  it('declines a destination whose restored surface is not a terminal', () => {
-    setFocusState({
-      activeWorktreeId: 'wt-1',
-      activeView: 'terminal',
-      activeTabType: 'browser',
-      activeTabId: 'tab-adopted'
-    })
-
-    expect(queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: null })).toBe(false)
     flushFrame()
-    expect(focusRuntimeTerminalSurfaceMock).not.toHaveBeenCalled()
-    expect(focusTerminalTabSurfaceMock).not.toHaveBeenCalled()
+    expect(mocks.focus).not.toHaveBeenCalled()
+    state.activeTabId = 'restored-tab'
+    notifyStore()
+    flushFrame()
+    mocks.focus.mockReturnValue(true)
+    notifyMount()
+    flushFrame()
+    expect(mocks.focus).toHaveBeenLastCalledWith('restored-tab', null, 'wt-1')
   })
 
-  it('declines a destination that has no terminal tab yet', () => {
-    setFocusState({
-      activeWorktreeId: 'wt-1',
-      activeView: 'terminal',
-      activeTabType: 'terminal',
-      activeTabId: null
-    })
-
-    expect(queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: null })).toBe(false)
-  })
-
-  it('does not steal focus if the user leaves the created workspace first', () => {
-    const state: FocusState = {
-      activeWorktreeId: 'wt-1',
-      activeView: 'terminal',
-      activeTabType: 'terminal',
-      activeTabId: 'tab-1'
-    }
-    setFocusState(state)
-
+  it.each([
+    { activeWorktreeId: 'wt-2' },
+    { activeWorkspaceExecutionHostId: 'ssh:second-host' },
+    { activeView: 'settings' },
+    { activeTabType: 'browser' },
+    { activeTabId: 'tab-2' },
+    { activeModal: 'worktree-palette' }
+  ] as const)('cancels when selection changes to %j during restoration', (change) => {
     queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })
-    state.activeWorktreeId = 'wt-2'
     flushFrame()
+    mocks.focus.mockClear()
+    state = { ...state, ...change }
+    notifyStore()
+    flushFrame()
+    notifyMount()
+    flushFrame()
+    expect(mocks.focus).not.toHaveBeenCalled()
+    expect(unsubscribe).toHaveBeenCalledOnce()
+  })
 
-    expect(focusRuntimeTerminalSurfaceMock).not.toHaveBeenCalled()
-    expect(focusTerminalTabSurfaceMock).not.toHaveBeenCalled()
+  it('cancels on a user click while waiting', () => {
+    queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })
+    flushFrame()
+    document.dispatchEvent(new Event('pointerdown'))
+    mocks.focus.mockClear()
+    notifyMount()
+    flushFrame()
+    expect(mocks.focus).not.toHaveBeenCalled()
+  })
+
+  it('does not steal focus from an input claimed during restoration', () => {
+    queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })
+    const input = document.createElement('input')
+    document.body.append(input)
+    input.focus()
+    notifyMount()
+    flushFrame()
+    expect(mocks.focus).not.toHaveBeenCalled()
+    expect(document.activeElement).toBe(input)
+  })
+
+  it('retains focus through composer dialog close with a previously focused editable input', async () => {
+    const previousInput = document.createElement('input')
+    const container = document.createElement('div')
+    document.body.append(previousInput, container)
+    previousInput.focus()
+    const root = createRoot(container)
+    try {
+      // The composer uses a controlled modal without a DialogTrigger or close autofocus handler.
+      await act(async () => {
+        root.render(
+          createElement(
+            Dialog,
+            { open: true },
+            createElement(
+              DialogContent,
+              { 'aria-describedby': undefined },
+              createElement(DialogTitle, null, 'New workspace'),
+              createElement('input', { 'aria-label': 'Workspace name' })
+            )
+          )
+        )
+      })
+      expect(document.activeElement?.getAttribute('aria-label')).toBe('Workspace name')
+      queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })
+      await act(async () => root.render(null))
+      await act(async () => vi.advanceTimersByTime(0))
+      expect(previousInput.isConnected).toBe(true)
+      expect(document.activeElement).not.toBe(previousInput)
+      mocks.focus.mockReturnValue(true)
+      flushFrame()
+      expect(mocks.focus).toHaveBeenCalledWith('tab-1', null, 'wt-1')
+    } finally {
+      await act(async () => root.unmount())
+    }
+  })
+
+  it('keeps the post-palette request when terminal mounting briefly takes focus', () => {
+    queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })
+    const textarea = document.createElement('textarea')
+    textarea.className = 'xterm-helper-textarea'
+    document.body.append(textarea)
+    textarea.focus()
+    textarea.blur()
+    mocks.focus.mockReturnValue(true)
+    flushFrame()
+    expect(mocks.focus).toHaveBeenCalledWith('tab-1', null, 'wt-1')
+  })
+
+  it('expires a request if restoration fails', () => {
+    queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })
+    vi.advanceTimersByTime(30_000)
+    notifyMount()
+    flushFrame()
+    expect(mocks.focus).not.toHaveBeenCalled()
+    expect(unsubscribe).toHaveBeenCalledOnce()
+  })
+
+  it('cancels the previous request when a new activation is declined', () => {
+    queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })
+    state.activeTabType = 'browser'
+    expect(queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: null })).toBe(false)
+    notifyMount()
+    flushFrame()
+    expect(mocks.focus).not.toHaveBeenCalled()
+  })
+
+  it('declines a failed activation', () => {
+    expect(queueWorkspaceActivationTerminalFocus('wt-1', false)).toBe(false)
+    expect(mocks.subscribe).not.toHaveBeenCalled()
   })
 })
diff --git a/src/renderer/src/lib/workspace-activation-terminal-focus.ts b/src/renderer/src/lib/workspace-activation-terminal-focus.ts
index 8e7bcf03a33..7b36867461b 100644
--- a/src/renderer/src/lib/workspace-activation-terminal-focus.ts
+++ b/src/renderer/src/lib/workspace-activation-terminal-focus.ts
@@ -1,54 +1,94 @@
+import { shouldPreserveEditableFocus } from '@/components/terminal-pane/pane-helpers'
 import { useAppStore } from '@/store'
-import { focusTerminalTabSurface } from '@/lib/focus-terminal-tab-surface'
 import { focusRuntimeTerminalSurface } from '@/runtime/sync-runtime-graph'
 import type { ActivateAndRevealResult } from '@/lib/worktree-activation'
 
-function resolveActivatedWorkspaceTerminalTabId(
-  worktreeId: string,
-  activation: ActivateAndRevealResult | false
-): string | null {
-  const state = useAppStore.getState()
-  if (activation && activation.primaryTabId) {
-    return activation.primaryTabId
-  }
-  if (
-    state.activeWorktreeId !== worktreeId ||
-    state.activeView !== 'terminal' ||
-    state.activeTabType !== 'terminal'
-  ) {
-    return null
-  }
-  return state.activeTabId
-}
+let cancelPendingFocus: (() => void) | null = null
 
-// Why: returns false when the destination's restored surface is not a terminal, so callers can
-// fall back instead of focusing an unrelated worktree's mounted-but-hidden terminal (#9939).
+// A sleeping workspace can publish its tab and mount its terminal after the palette closes.
 export function queueWorkspaceActivationTerminalFocus(
   worktreeId: string,
   activation: ActivateAndRevealResult | false
 ): boolean {
-  const tabId = resolveActivatedWorkspaceTerminalTabId(worktreeId, activation)
-  if (!tabId) {
+  cancelPendingFocus?.()
+  const initial = useAppStore.getState()
+  if (
+    !activation ||
+    initial.activeWorktreeId !== worktreeId ||
+    initial.activeView !== 'terminal' ||
+    initial.activeTabType !== 'terminal'
+  ) {
     return false
   }
-
-  requestAnimationFrame(() => {
+  let tabId = activation.primaryTabId ?? initial.activeTabId
+  const executionHostId = initial.activeWorkspaceExecutionHostId
+  const initialFocus = document.activeElement
+  const closingDialog = document.querySelector('[role="dialog"]')
+  let frameId: number | null = null
+  let finished = false
+  const cancel = (): void => {
+    if (finished) {
+      return
+    }
+    finished = true
+    if (frameId !== null) {
+      cancelAnimationFrame(frameId)
+    }
+    observer.disconnect()
+    unsubscribe()
+    clearTimeout(timeout)
+    document.removeEventListener('pointerdown', cancel, true)
+    document.removeEventListener('focusin', onFocus, true)
+    if (cancelPendingFocus === cancel) {
+      cancelPendingFocus = null
+    }
+  }
+  const attempt = (): void => {
+    frameId = null
     const state = useAppStore.getState()
     if (
       state.activeWorktreeId !== worktreeId ||
+      state.activeWorkspaceExecutionHostId !== executionHostId ||
       state.activeView !== 'terminal' ||
       state.activeTabType !== 'terminal' ||
-      state.activeTabId !== tabId
+      (tabId !== null && state.activeTabId !== tabId) ||
+      state.activeModal !== 'none'
     ) {
+      cancel()
       return
     }
-
-    // Why: creation closes a Radix dialog immediately after activation. Queue
-    // focus past that close so focus restoration cannot leave the user on the
-    // removed composer field after Cmd/Ctrl+Enter.
-    if (!focusRuntimeTerminalSurface(tabId, null, worktreeId)) {
-      focusTerminalTabSurface(tabId)
+    tabId ??= state.activeTabId
+    if (tabId && focusRuntimeTerminalSurface(tabId, null, worktreeId)) {
+      cancel()
     }
+  }
+  const schedule = (): void => {
+    if (!finished && frameId === null) {
+      frameId = requestAnimationFrame(attempt)
+    }
+  }
+  const onFocus = (): void => {
+    const active = document.activeElement
+    if (
+      active !== initialFocus &&
+      !closingDialog?.contains(active) &&
+      shouldPreserveEditableFocus(active)
+    ) {
+      cancel()
+    }
+  }
+  const observer = new MutationObserver(schedule)
+  observer.observe(document.body, {
+    childList: true,
+    subtree: true,
+    attributes: true,
+    attributeFilter: ['class', 'style', 'data-state']
   })
+  const unsubscribe = useAppStore.subscribe(schedule)
+  const timeout = setTimeout(cancel, 30_000)
+  document.addEventListener('pointerdown', cancel, true)
+  document.addEventListener('focusin', onFocus, true)
+  cancelPendingFocus = cancel
+  schedule()
   return true
 }
diff --git a/src/renderer/src/lib/workspace-browser-tab-open.test.ts b/src/renderer/src/lib/workspace-browser-tab-open.test.ts
index 5ae73fa7c12..19ae4974038 100644
--- a/src/renderer/src/lib/workspace-browser-tab-open.test.ts
+++ b/src/renderer/src/lib/workspace-browser-tab-open.test.ts
@@ -96,6 +96,7 @@ describe('openWorkspaceBrowserTab', () => {
       {
         activate: true,
         browserRuntimeEnvironmentId: null,
+        executionHostId: 'ssh:ssh-target',
         focusAddressBar: false,
         sessionProfileId: 'ssh-profile',
         targetGroupId: 'group-1',
@@ -118,6 +119,7 @@ describe('openWorkspaceBrowserTab', () => {
     await openWorkspaceBrowserTab({
       workspaceId: WORKSPACE_ID,
       url: 'https://github.com/acme/orca/pull/456',
+      afterTabId: 'source-unified-tab',
       intent: { kind: 'url' },
       focusOnCreate: false,
       selectWorktree: false
@@ -126,7 +128,7 @@ describe('openWorkspaceBrowserTab', () => {
     expect(createBrowserTab).toHaveBeenCalledWith(
       WORKSPACE_ID,
       'https://github.com/acme/orca/pull/456',
-      expect.objectContaining({ activate: false })
+      expect.objectContaining({ activate: false, afterTabId: 'source-unified-tab' })
     )
   })
 
@@ -202,6 +204,7 @@ describe('openWorkspaceBrowserTab', () => {
     await openWorkspaceBrowserTab({
       workspaceId: WORKSPACE_ID,
       url: 'https://gitlab.com/acme/orca/-/merge_requests/77',
+      afterTabId: 'source-unified-tab',
       intent: { kind: 'url' },
       focusOnCreate: false,
       selectWorktree: false
@@ -209,6 +212,7 @@ describe('openWorkspaceBrowserTab', () => {
 
     expect(mocks.createRemote).toHaveBeenCalledWith(
       expect.objectContaining({
+        clientAfterTabId: 'source-unified-tab',
         focusOnCreate: false,
         selectWorktree: false,
         url: 'https://gitlab.com/acme/orca/-/merge_requests/77'
diff --git a/src/renderer/src/lib/workspace-browser-tab-open.ts b/src/renderer/src/lib/workspace-browser-tab-open.ts
index 18149a98bbc..5329511941e 100644
--- a/src/renderer/src/lib/workspace-browser-tab-open.ts
+++ b/src/renderer/src/lib/workspace-browser-tab-open.ts
@@ -24,6 +24,8 @@ export type WorkspaceBrowserTabIntent = { kind: 'url' } | { kind: 'search'; engi
 export type OpenWorkspaceBrowserTabRequest = {
   workspaceId: string
   targetGroupId?: string
+  /** Client-local unified tab id of the source; a source-following open omits targetGroupId. */
+  afterTabId?: string
   url: string
   intent: WorkspaceBrowserTabIntent
   /** Keep the caller's current terminal/task surface selected while creating the tab. */
@@ -190,10 +192,12 @@ function createClientBrowserTab(
       activate: request.focusOnCreate !== false,
       browserRuntimeEnvironmentId: null,
       focusAddressBar: false,
+      executionHostId: hostId,
       sessionProfileId:
         state.defaultBrowserSessionProfileIdByHostId[hostId] ??
         state.defaultBrowserSessionProfileId,
       targetGroupId: request.targetGroupId,
+      ...(request.afterTabId ? { afterTabId: request.afterTabId } : {}),
       title: presentation.title
     })
   } catch (error) {
@@ -289,6 +293,7 @@ export async function openWorkspaceBrowserTab(
       environmentId,
       url: request.url,
       targetGroupId: request.targetGroupId,
+      ...(request.afterTabId ? { clientAfterTabId: request.afterTabId } : {}),
       // Owner-pinned links need the host tab published before client reconciliation.
       ...(expectedEnvironmentId !== null ? { waitForRegistration: true } : {}),
       ...(request.placementPreference !== undefined
diff --git a/src/renderer/src/lib/workspace-emoji-shortcodes.lazy.test.ts b/src/renderer/src/lib/workspace-emoji-shortcodes.lazy.test.ts
index eafc3e3b2b8..2e4dfac4a4a 100644
--- a/src/renderer/src/lib/workspace-emoji-shortcodes.lazy.test.ts
+++ b/src/renderer/src/lib/workspace-emoji-shortcodes.lazy.test.ts
@@ -1,5 +1,3 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 describe('workspace emoji shortcode index laziness', () => {
@@ -20,11 +18,4 @@ describe('workspace emoji shortcode index laziness', () => {
     expect(shortcodeIndex.searchWorkspaceEmojiShortcodes('tada')[0]?.emoji).toBe('🎉')
     expect(catalog.isEmojiShortcodeCatalogBuiltForTest()).toBe(true)
   })
-
-  it('keeps the exact-shortcode index out of module scope', () => {
-    const indexSource = readFileSync(join(__dirname, 'workspace-emoji-shortcodes.ts'), 'utf8')
-
-    expect(indexSource).not.toMatch(/^const \w+ = new Map\(/m)
-    expect(indexSource).not.toContain('STANDARD_EMOJI_SHORTCODE_ENTRIES')
-  })
 })
diff --git a/src/renderer/src/lib/workspace-session-browser-history.test.ts b/src/renderer/src/lib/workspace-session-browser-history.test.ts
index 1a9bde2f605..8c6ef564e25 100644
--- a/src/renderer/src/lib/workspace-session-browser-history.test.ts
+++ b/src/renderer/src/lib/workspace-session-browser-history.test.ts
@@ -34,8 +34,7 @@ function createSnapshot(browserUrlHistory: BrowserHistoryEntry[]): WorkspaceSess
     worktreesByRepo: {},
     lastKnownRelayPtyIdByTabId: {},
     lastVisitedAtByWorktreeId: {},
-    defaultTerminalTabsAppliedByWorktreeId: {},
-    closedTerminalTabTombstonesByTabId: {}
+    defaultTerminalTabsAppliedByWorktreeId: {}
   }
 }
 
diff --git a/src/renderer/src/lib/workspace-session-closed-tab-tombstones.test.ts b/src/renderer/src/lib/workspace-session-closed-tab-tombstones.test.ts
deleted file mode 100644
index 522b079aff6..00000000000
--- a/src/renderer/src/lib/workspace-session-closed-tab-tombstones.test.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { buildWorkspaceSessionPatch } from './workspace-session-patch'
-import { SESSION_RELEVANT_FIELDS } from './workspace-session'
-import { CLOSED_TERMINAL_TAB_TOMBSTONE_TTL_MS } from '../../../shared/closed-terminal-tab-tombstones'
-
-// Why browserPagesByWorkspace is stubbed: buildWorkspaceSessionPatch pre-filters staged browser tabs
-// before field dispatch, so the minimal fixture has to carry the map it iterates.
-function patchFor(
-  map: Record<string, { closedAt: number; worktreeId: string }>
-): ReturnType<typeof buildWorkspaceSessionPatch> {
-  return buildWorkspaceSessionPatch(
-    { browserPagesByWorkspace: {}, closedTerminalTabTombstonesByTabId: map } as never,
-    ['closedTerminalTabTombstonesByTabId']
-  )
-}
-
-describe('closed-tab tombstones in the persisted session', () => {
-  it('is a session-relevant field, so a close on its own schedules a write', () => {
-    expect(SESSION_RELEVANT_FIELDS).toContain('closedTerminalTabTombstonesByTabId')
-  })
-
-  it('writes live tombstones and drops ones past the TTL', () => {
-    const now = Date.now()
-    expect(
-      patchFor({
-        fresh: { closedAt: now, worktreeId: 'repo-1::/srv/app' },
-        stale: {
-          closedAt: now - CLOSED_TERMINAL_TAB_TOMBSTONE_TTL_MS - 1,
-          worktreeId: 'repo-1::/srv/app'
-        }
-      }).closedTerminalTabTombstonesByTabId
-    ).toEqual({ fresh: { closedAt: now, worktreeId: 'repo-1::/srv/app' } })
-  })
-
-  it('omits the field entirely once the map empties', () => {
-    expect(patchFor({}).closedTerminalTabTombstonesByTabId).toBeUndefined()
-  })
-})
diff --git a/src/renderer/src/lib/workspace-session-closed-tab-tombstones.ts b/src/renderer/src/lib/workspace-session-closed-tab-tombstones.ts
deleted file mode 100644
index 48b1cb1a727..00000000000
--- a/src/renderer/src/lib/workspace-session-closed-tab-tombstones.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-import type { WorkspaceSessionState } from '../../../shared/workspace-session-state-types'
-import { pruneClosedTerminalTabTombstones } from '../../../shared/closed-terminal-tab-tombstones'
-
-/** Applies the TTL/cap bound on the way to disk, and omits an empty map like its siblings. */
-export function buildPersistedClosedTerminalTabTombstones(
-  map: WorkspaceSessionState['closedTerminalTabTombstonesByTabId']
-): WorkspaceSessionState['closedTerminalTabTombstonesByTabId'] {
-  const pruned = pruneClosedTerminalTabTombstones(map, Date.now())
-  return Object.keys(pruned).length > 0 ? pruned : undefined
-}
diff --git a/src/renderer/src/lib/workspace-session-editor-drafts.test.ts b/src/renderer/src/lib/workspace-session-editor-drafts.test.ts
index 690e5917fd1..ba639bb4668 100644
--- a/src/renderer/src/lib/workspace-session-editor-drafts.test.ts
+++ b/src/renderer/src/lib/workspace-session-editor-drafts.test.ts
@@ -36,7 +36,6 @@ function createSnapshot(
     lastKnownRelayPtyIdByTabId: {},
     lastVisitedAtByWorktreeId: {},
     defaultTerminalTabsAppliedByWorktreeId: {},
-    closedTerminalTabTombstonesByTabId: {},
     ...overrides
   }
 }
diff --git a/src/renderer/src/lib/workspace-session-liveness.test.ts b/src/renderer/src/lib/workspace-session-liveness.test.ts
index 5cabd5b52ff..821c059bfa0 100644
--- a/src/renderer/src/lib/workspace-session-liveness.test.ts
+++ b/src/renderer/src/lib/workspace-session-liveness.test.ts
@@ -35,7 +35,6 @@ function createSnapshot(
     lastKnownRelayPtyIdByTabId: {},
     lastVisitedAtByWorktreeId: {},
     defaultTerminalTabsAppliedByWorktreeId: {},
-    closedTerminalTabTombstonesByTabId: {},
     ...overrides
   }
 }
diff --git a/src/renderer/src/lib/workspace-session-patch.ts b/src/renderer/src/lib/workspace-session-patch.ts
index 4537e1c570b..dc2947918c2 100644
--- a/src/renderer/src/lib/workspace-session-patch.ts
+++ b/src/renderer/src/lib/workspace-session-patch.ts
@@ -20,7 +20,6 @@ import { withoutStagedBrowserTabs } from './workspace-session-staged-browser-tab
 import { buildPersistedUnifiedTabSessionData } from './workspace-session-unified-tabs'
 import { buildLastVisitedAtByWorktreeId } from './workspace-session-focus-recency'
 import { buildSleepingAgentSessionData } from './workspace-session-sleeping-agents'
-import { buildPersistedClosedTerminalTabTombstones } from './workspace-session-closed-tab-tombstones'
 
 type SessionRelevantField = keyof WorkspaceSessionSnapshot
 
@@ -193,11 +192,6 @@ export function buildWorkspaceSessionPatch(
         ? snapshot.defaultTerminalTabsAppliedByWorktreeId
         : undefined
   }
-  if (changed.has('closedTerminalTabTombstonesByTabId')) {
-    patch.closedTerminalTabTombstonesByTabId = buildPersistedClosedTerminalTabTombstones(
-      snapshot.closedTerminalTabTombstonesByTabId
-    )
-  }
   if (changed.has('sleepingAgentSessionsByPaneKey')) {
     patch.sleepingAgentSessionsByPaneKey =
       buildSleepingAgentSessionData(snapshot).sleepingAgentSessionsByPaneKey
diff --git a/src/renderer/src/lib/workspace-session-relevant-fields.test.ts b/src/renderer/src/lib/workspace-session-relevant-fields.test.ts
index ce26d33ec82..9aadf057964 100644
--- a/src/renderer/src/lib/workspace-session-relevant-fields.test.ts
+++ b/src/renderer/src/lib/workspace-session-relevant-fields.test.ts
@@ -36,7 +36,6 @@ describe('SESSION_RELEVANT_FIELDS', () => {
     lastKnownRelayPtyIdByTabId: true,
     lastVisitedAtByWorktreeId: true,
     defaultTerminalTabsAppliedByWorktreeId: true,
-    closedTerminalTabTombstonesByTabId: true,
     sleepingAgentSessionsByPaneKey: true,
     clientHostedBrowserCloseIntentsByEnvironment: true,
     pendingReconnectPtyIdByTabId: true,
diff --git a/src/renderer/src/lib/workspace-session-ssh-partition-round-trip.test.ts b/src/renderer/src/lib/workspace-session-ssh-partition-round-trip.test.ts
index 19050b9ff67..13cc1baf507 100644
--- a/src/renderer/src/lib/workspace-session-ssh-partition-round-trip.test.ts
+++ b/src/renderer/src/lib/workspace-session-ssh-partition-round-trip.test.ts
@@ -682,8 +682,7 @@ describe('ssh host partition remote-workspace round trip', () => {
       new Set([WORKTREE_ID]),
       read.session.tabsByWorktree,
       new Set(),
-      SSH_HOST_ID,
-      1
+      SSH_HOST_ID
     )
 
     expect(merged.tabsByWorktree[WORKTREE_ID]?.map((entry) => entry.id)).toEqual(['tab-runtime'])
@@ -718,8 +717,7 @@ describe('ssh host partition remote-workspace round trip', () => {
       new Set([WORKTREE_ID]),
       read.session.tabsByWorktree,
       new Set(),
-      SSH_HOST_ID,
-      2
+      SSH_HOST_ID
     )
 
     expect(merged.tabsByWorktree[WORKTREE_ID]?.map((entry) => entry.id)).toEqual(['tab-runtime'])
diff --git a/src/renderer/src/lib/workspace-session.ts b/src/renderer/src/lib/workspace-session.ts
index e35e2194f8e..4bf57f6d82f 100644
--- a/src/renderer/src/lib/workspace-session.ts
+++ b/src/renderer/src/lib/workspace-session.ts
@@ -11,7 +11,6 @@ import type { OpenFile } from '../store/slices/editor'
 import { buildPersistedUnifiedTabSessionData } from './workspace-session-unified-tabs'
 import { buildLastVisitedAtByWorktreeId } from './workspace-session-focus-recency'
 import { buildSleepingAgentSessionData } from './workspace-session-sleeping-agents'
-import { buildPersistedClosedTerminalTabTombstones } from './workspace-session-closed-tab-tombstones'
 import { buildActiveConnectionIdsAtShutdown } from './workspace-session-reconnect-targets'
 import { withoutStagedBrowserTabs } from './workspace-session-staged-browser-tabs'
 import { buildBrowserSessionData } from './workspace-session-browser-tabs'
@@ -57,7 +56,6 @@ export type WorkspaceSessionSnapshot = Pick<
   | 'lastKnownRelayPtyIdByTabId'
   | 'lastVisitedAtByWorktreeId'
   | 'defaultTerminalTabsAppliedByWorktreeId'
-  | 'closedTerminalTabTombstonesByTabId'
 > & {
   activeWorkspaceExecutionHostId?: AppState['activeWorkspaceExecutionHostId']
   sleepingAgentSessionsByPaneKey?: AppState['sleepingAgentSessionsByPaneKey']
@@ -100,7 +98,6 @@ export const SESSION_RELEVANT_FIELDS = [
   'lastKnownRelayPtyIdByTabId',
   'lastVisitedAtByWorktreeId',
   'defaultTerminalTabsAppliedByWorktreeId',
-  'closedTerminalTabTombstonesByTabId',
   'sleepingAgentSessionsByPaneKey',
   'clientHostedBrowserCloseIntentsByEnvironment',
   'pendingReconnectPtyIdByTabId',
@@ -330,9 +327,6 @@ export function buildWorkspaceSessionPayload(
       Object.keys(snapshot.defaultTerminalTabsAppliedByWorktreeId).length > 0
         ? snapshot.defaultTerminalTabsAppliedByWorktreeId
         : undefined,
-    closedTerminalTabTombstonesByTabId: buildPersistedClosedTerminalTabTombstones(
-      snapshot.closedTerminalTabTombstonesByTabId
-    ),
     ...buildSleepingAgentSessionData(snapshot),
     // Why unconditional rather than omit-when-empty: a full write replaces the persisted object,
     // so an emptied map has to be written as empty or the last replay never sticks.
diff --git a/src/renderer/src/lib/worktree-activation-default-agent-chat.test.ts b/src/renderer/src/lib/worktree-activation-default-agent-chat.test.ts
new file mode 100644
index 00000000000..ae956cabd21
--- /dev/null
+++ b/src/renderer/src/lib/worktree-activation-default-agent-chat.test.ts
@@ -0,0 +1,362 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { useAppStore } from '@/store'
+import { activateAndRevealFolderWorkspace, activateAndRevealWorktree } from './worktree-activation'
+import * as activationGate from './worktree-agent-activation-gate'
+import {
+  ensureWorktreeHasInitialTerminal,
+  reseedGatedEmptyWorkspace
+} from './worktree-initial-terminal-seeding'
+import {
+  isEmptyWorkspaceDefaultSurfacePending,
+  releaseEmptyWorkspaceDefaultSurface
+} from './empty-workspace-default-surface-claims'
+import { folderWorkspaceKey } from '../../../shared/workspace-scope'
+import {
+  makeCreatedAgentWorktree as makeWorktree,
+  seedEmptyActivatableWorktree
+} from '@/lib/worktree-activation-created-agent-test-state'
+import {
+  createMockStore,
+  registerWorktreeActivationReset
+} from './worktree-activation-test-harness'
+
+const defaultChat = vi.hoisted(() => ({
+  open: vi.fn(),
+  awaitsDetection: vi.fn(),
+  loadDetection: vi.fn()
+}))
+
+vi.mock('@/lib/empty-workspace-default-agent-chat', () => ({
+  openDefaultAgentChatInEmptyWorkspace: defaultChat.open,
+  emptyWorkspaceDefaultChatAwaitsDetection: defaultChat.awaitsDetection,
+  loadEmptyWorkspaceDefaultChatDetection: defaultChat.loadDetection
+}))
+
+const USER_OPEN = { navigationIntent: 'user-open' } as const
+const FOLDER_ID = 'folder-1'
+const FOLDER_KEY = folderWorkspaceKey(FOLDER_ID)
+const initialAppStoreState = useAppStore.getState()
+
+registerWorktreeActivationReset()
+
+beforeEach(() => {
+  defaultChat.open.mockReset()
+  defaultChat.awaitsDetection.mockReset().mockReturnValue(false)
+  defaultChat.loadDetection.mockReset().mockResolvedValue(undefined)
+})
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+  vi.restoreAllMocks()
+  releaseEmptyWorkspaceDefaultSurface(makeWorktree().id)
+  releaseEmptyWorkspaceDefaultSurface(FOLDER_KEY)
+  useAppStore.setState(initialAppStoreState, true)
+})
+
+/** Electron exposes the PTY inventory, so an empty workspace is seeded by the gated reseed. */
+function useElectronActivationGate(): ReturnType<typeof vi.spyOn> {
+  vi.stubGlobal('window', { api: { runtime: { call: vi.fn() }, pty: { listSessions: vi.fn() } } })
+  return vi.spyOn(activationGate, 'gateWorktreeAgentActivation').mockResolvedValue('empty')
+}
+
+function seedEmptyFolderWorkspace(): void {
+  useAppStore.setState({
+    folderWorkspaces: [
+      {
+        id: FOLDER_ID,
+        projectGroupId: 'group-1',
+        name: 'notes',
+        folderPath: '/local/notes',
+        executionHostId: 'local',
+        linkedTask: null,
+        comment: '',
+        isArchived: false,
+        isUnread: false,
+        isPinned: false,
+        sortOrder: 0
+      }
+    ],
+    activeView: 'terminal',
+    tabsByWorktree: {},
+    unifiedTabsByWorktree: {},
+    groupsByWorktree: {},
+    getFreshFolderWorkspacePathStatus: () => ({ exists: true }),
+    markWorktreeVisited: vi.fn(),
+    recordWorktreeVisit: vi.fn(),
+    revealWorktreeInSidebar: vi.fn()
+  } as unknown as Partial<ReturnType<typeof useAppStore.getState>>)
+}
+
+function tabCount(workspaceKey: string): number {
+  return (useAppStore.getState().tabsByWorktree[workspaceKey] ?? []).length
+}
+
+async function flushPromises(): Promise<void> {
+  await new Promise((resolve) => setTimeout(resolve, 0))
+}
+
+// Why: with chat as the default view, clicking an empty workspace used to open a bare shell the
+// user then had to turn into a chat by hand.
+describe('empty workspace seeding with a default agent chat', () => {
+  it('opens the default agent chat instead of a shell', () => {
+    defaultChat.open.mockReturnValue({ primaryTabId: 'chat-tab' })
+    const createTab = vi.fn(() => ({ id: 'shell-tab' }))
+    const store = createMockStore({ createTab })
+
+    const primaryTabId = ensureWorktreeHasInitialTerminal(
+      store,
+      'wt-1',
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      { seedUserDefaultSurface: true }
+    )
+
+    expect(defaultChat.open).toHaveBeenCalledWith('wt-1')
+    expect(primaryTabId).toBe('chat-tab')
+    expect(createTab).not.toHaveBeenCalled()
+  })
+
+  it('falls back to a shell when no chat can open', () => {
+    defaultChat.open.mockReturnValue(null)
+    const createTab = vi.fn(() => ({ id: 'shell-tab' }))
+    const store = createMockStore({ createTab })
+
+    const primaryTabId = ensureWorktreeHasInitialTerminal(
+      store,
+      'wt-1',
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      { seedUserDefaultSurface: true }
+    )
+
+    expect(primaryTabId).toBe('shell-tab')
+    expect(createTab).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps the shell for seeds that did not ask for the default surface', () => {
+    const store = createMockStore({ createTab: vi.fn(() => ({ id: 'shell-tab' })) })
+
+    ensureWorktreeHasInitialTerminal(store, 'wt-1')
+    ensureWorktreeHasInitialTerminal(store, 'wt-2', undefined, undefined, undefined, undefined, {
+      seedUserDefaultSurface: true,
+      activateCreatedTabs: false
+    })
+
+    expect(defaultChat.open).not.toHaveBeenCalled()
+  })
+
+  it('a user open of an empty workspace asks for the default surface', () => {
+    defaultChat.open.mockReturnValue({ primaryTabId: null })
+    const worktree = makeWorktree()
+    seedEmptyActivatableWorktree(worktree)
+
+    activateAndRevealWorktree(worktree.id, { ...USER_OPEN, notifyHostRuntime: false })
+
+    expect(defaultChat.open).toHaveBeenCalledWith(worktree.id)
+  })
+
+  it('back/forward navigation asks for the default surface', () => {
+    defaultChat.open.mockReturnValue({ primaryTabId: null })
+    const worktree = makeWorktree()
+    seedEmptyActivatableWorktree(worktree)
+    useAppStore.setState({
+      worktreeNavHistory: [worktree.id, 'repo-1::/elsewhere'],
+      worktreeNavHistoryIndex: 1
+    })
+
+    useAppStore.getState().goBackWorktree()
+
+    expect(defaultChat.open).toHaveBeenCalledWith(worktree.id)
+  })
+
+  // Why: CLI/phone creates, fallbacks after a failed agent launch, and the move after a delete
+  // activate with no intent; none of them may start an agent nobody picked.
+  it.each([
+    ['no navigation intent', {}],
+    ['a Blank Terminal pick', { ...USER_OPEN, agent: null }]
+  ])('keeps the shell for %s', (_label, selection) => {
+    const worktree = makeWorktree()
+    seedEmptyActivatableWorktree(worktree)
+
+    activateAndRevealWorktree(worktree.id, { ...selection, notifyHostRuntime: false })
+
+    expect(defaultChat.open).not.toHaveBeenCalled()
+    expect(tabCount(worktree.id)).toBe(1)
+  })
+})
+
+describe('the gated reseed that seeds an empty workspace in Electron', () => {
+  it('opens the default agent chat for a user open', async () => {
+    defaultChat.open.mockReturnValue({ primaryTabId: null })
+    const worktree = makeWorktree()
+    seedEmptyActivatableWorktree(worktree)
+    const gate = useElectronActivationGate()
+
+    const result = activateAndRevealWorktree(worktree.id, {
+      ...USER_OPEN,
+      notifyHostRuntime: false
+    })
+    expect(result === false ? 'failed' : result.primaryTabId).toBeNull()
+    await gate.mock.results[0]?.value
+
+    expect(defaultChat.open).toHaveBeenCalledWith(worktree.id)
+    expect(tabCount(worktree.id)).toBe(0)
+  })
+
+  it('seeds a shell for an activation without a user open', async () => {
+    const worktree = makeWorktree()
+    seedEmptyActivatableWorktree(worktree)
+    const gate = useElectronActivationGate()
+
+    activateAndRevealWorktree(worktree.id, { notifyHostRuntime: false })
+    await gate.mock.results[0]?.value
+
+    expect(defaultChat.open).not.toHaveBeenCalled()
+    expect(tabCount(worktree.id)).toBe(1)
+  })
+
+  it('opens the default agent chat for a user-opened folder workspace', async () => {
+    defaultChat.open.mockReturnValue({ primaryTabId: null })
+    seedEmptyFolderWorkspace()
+    const gate = useElectronActivationGate()
+
+    activateAndRevealFolderWorkspace(FOLDER_ID, { ...USER_OPEN, executionHostId: 'local' })
+    await gate.mock.results[0]?.value
+
+    expect(defaultChat.open).toHaveBeenCalledWith(FOLDER_KEY)
+    expect(tabCount(FOLDER_KEY)).toBe(0)
+  })
+
+  it('waits for the host agent list and lets no other reseed seed a shell meanwhile', async () => {
+    defaultChat.open.mockReturnValue({ primaryTabId: null })
+    defaultChat.awaitsDetection.mockReturnValue(true)
+    let finishDetection!: () => void
+    defaultChat.loadDetection.mockReturnValue(
+      new Promise<void>((resolve) => {
+        finishDetection = resolve
+      })
+    )
+    const worktree = makeWorktree()
+    seedEmptyActivatableWorktree(worktree)
+    const gate = useElectronActivationGate()
+
+    activateAndRevealWorktree(worktree.id, { ...USER_OPEN, notifyHostRuntime: false })
+    await gate.mock.results[0]?.value
+
+    expect(defaultChat.loadDetection).toHaveBeenCalledWith(worktree.id)
+    expect(isEmptyWorkspaceDefaultSurfacePending(worktree.id)).toBe(true)
+    reseedGatedEmptyWorkspace(worktree.id, {
+      callerProvidesSurface: false,
+      seedUserDefaultSurface: false
+    })
+    expect(tabCount(worktree.id)).toBe(0)
+    expect(defaultChat.open).not.toHaveBeenCalled()
+
+    finishDetection()
+    await flushPromises()
+
+    expect(isEmptyWorkspaceDefaultSurfacePending(worktree.id)).toBe(false)
+    expect(defaultChat.open).toHaveBeenCalledTimes(1)
+    expect(tabCount(worktree.id)).toBe(0)
+  })
+
+  // Why: the wait used to keep the first activation's intent, so returning to the workspace through
+  // history (no host id) failed the first intent's host check and left it with no surface at all.
+  it('seeds for the latest activation when the workspace is reopened during the wait', async () => {
+    defaultChat.open.mockReturnValue({ primaryTabId: null })
+    defaultChat.awaitsDetection.mockReturnValue(true)
+    let finishDetection!: () => void
+    defaultChat.loadDetection.mockReturnValue(
+      new Promise<void>((resolve) => {
+        finishDetection = resolve
+      })
+    )
+    const worktree = makeWorktree()
+    seedEmptyActivatableWorktree(worktree)
+    const gate = useElectronActivationGate()
+
+    activateAndRevealWorktree(worktree.id, {
+      ...USER_OPEN,
+      executionHostId: 'local',
+      notifyHostRuntime: false
+    })
+    await gate.mock.results[0]?.value
+    useAppStore.setState({ activeWorktreeId: 'repo-1::/elsewhere' })
+    activateAndRevealWorktree(worktree.id, { ...USER_OPEN, notifyHostRuntime: false })
+    await gate.mock.results[1]?.value
+    expect(useAppStore.getState().activeWorkspaceExecutionHostId).toBeNull()
+    finishDetection()
+    await flushPromises()
+
+    expect(defaultChat.loadDetection).toHaveBeenCalledTimes(1)
+    expect(isEmptyWorkspaceDefaultSurfacePending(worktree.id)).toBe(false)
+    expect(defaultChat.open).toHaveBeenCalledTimes(1)
+  })
+
+  it('seeds a shell when a plain activation follows the user open during the wait', async () => {
+    defaultChat.awaitsDetection.mockReturnValue(true)
+    let finishDetection!: () => void
+    defaultChat.loadDetection.mockReturnValue(
+      new Promise<void>((resolve) => {
+        finishDetection = resolve
+      })
+    )
+    const worktree = makeWorktree()
+    seedEmptyActivatableWorktree(worktree)
+    const gate = useElectronActivationGate()
+
+    activateAndRevealWorktree(worktree.id, { ...USER_OPEN, notifyHostRuntime: false })
+    await gate.mock.results[0]?.value
+    activateAndRevealWorktree(worktree.id, { notifyHostRuntime: false })
+    await gate.mock.results[1]?.value
+    expect(tabCount(worktree.id)).toBe(0)
+    finishDetection()
+    await flushPromises()
+
+    expect(defaultChat.open).not.toHaveBeenCalled()
+    expect(tabCount(worktree.id)).toBe(1)
+  })
+
+  it('re-checks the active workspace after the wait', async () => {
+    defaultChat.awaitsDetection.mockReturnValue(true)
+    let finishDetection!: () => void
+    defaultChat.loadDetection.mockReturnValue(
+      new Promise<void>((resolve) => {
+        finishDetection = resolve
+      })
+    )
+    const worktree = makeWorktree()
+    seedEmptyActivatableWorktree(worktree)
+    const gate = useElectronActivationGate()
+
+    activateAndRevealWorktree(worktree.id, { ...USER_OPEN, notifyHostRuntime: false })
+    await gate.mock.results[0]?.value
+    useAppStore.setState({ activeWorktreeId: 'repo-1::/elsewhere' })
+    finishDetection()
+    await flushPromises()
+
+    expect(isEmptyWorkspaceDefaultSurfacePending(worktree.id)).toBe(false)
+    expect(defaultChat.open).not.toHaveBeenCalled()
+    expect(tabCount(worktree.id)).toBe(0)
+  })
+
+  it('seeds the shell when detection fails', async () => {
+    defaultChat.open.mockReturnValue(null)
+    defaultChat.awaitsDetection.mockReturnValue(true)
+    defaultChat.loadDetection.mockRejectedValue(new Error('ssh probe failed'))
+    const worktree = makeWorktree()
+    seedEmptyActivatableWorktree(worktree)
+    const gate = useElectronActivationGate()
+
+    activateAndRevealWorktree(worktree.id, { ...USER_OPEN, notifyHostRuntime: false })
+    await gate.mock.results[0]?.value
+    await flushPromises()
+
+    expect(isEmptyWorkspaceDefaultSurfacePending(worktree.id)).toBe(false)
+    expect(tabCount(worktree.id)).toBe(1)
+  })
+})
diff --git a/src/renderer/src/lib/worktree-activation-default-tabs.test.ts b/src/renderer/src/lib/worktree-activation-default-tabs.test.ts
index 3b990948340..a6e5e5136a8 100644
--- a/src/renderer/src/lib/worktree-activation-default-tabs.test.ts
+++ b/src/renderer/src/lib/worktree-activation-default-tabs.test.ts
@@ -21,8 +21,11 @@ describe('ensureWorktreeHasInitialTerminal', () => {
     expect(store.queueTabSetupSplit).not.toHaveBeenCalled()
   })
 
-  it('does not recreate a terminal after an explicit empty state was persisted', () => {
-    const store = createMockStore({ tabsByWorktree: { 'wt-1': [] } })
+  it('does not recreate a terminal after the user closed the last one', () => {
+    const store = createMockStore({
+      tabsByWorktree: { 'wt-1': [] },
+      closedTerminalTabTombstonesByTabId: { closed: { closedAt: Date.now(), worktreeId: 'wt-1' } }
+    })
 
     ensureWorktreeHasInitialTerminal(store, 'wt-1')
 
diff --git a/src/renderer/src/lib/worktree-activation-emptied-workspace-reseed.test.ts b/src/renderer/src/lib/worktree-activation-emptied-workspace-reseed.test.ts
index 4d2b43e26bd..13cedba66df 100644
--- a/src/renderer/src/lib/worktree-activation-emptied-workspace-reseed.test.ts
+++ b/src/renderer/src/lib/worktree-activation-emptied-workspace-reseed.test.ts
@@ -24,9 +24,12 @@ afterEach(() => {
 })
 
 /** The state a workspace lands in once its last terminal is closed: the row survives as an
- *  explicit empty list rather than disappearing. */
+ *  explicit empty list rather than disappearing, beside the close's record. */
 function seedClosedLastTerminal(worktreeId: string): void {
-  useAppStore.setState({ tabsByWorktree: { [worktreeId]: [] } })
+  useAppStore.setState({
+    tabsByWorktree: { [worktreeId]: [] },
+    closedTerminalTabTombstonesByTabId: { closed: { closedAt: Date.now(), worktreeId } }
+  })
   const { renderableTabCount } = useAppStore.getState().reconcileWorktreeTabModel(worktreeId)
   expect(renderableTabCount).toBe(0)
 }
diff --git a/src/renderer/src/lib/worktree-activation-gated-empty-reseed.ts b/src/renderer/src/lib/worktree-activation-gated-empty-reseed.ts
index bb597d10e6e..2ab11bb1452 100644
--- a/src/renderer/src/lib/worktree-activation-gated-empty-reseed.ts
+++ b/src/renderer/src/lib/worktree-activation-gated-empty-reseed.ts
@@ -1,14 +1,20 @@
-import type { ExecutionHostId } from '../../../shared/execution-host'
 import {
   gateWorktreeAgentActivation,
   type WorktreeAgentActivationOutcome
 } from './worktree-agent-activation-gate'
-import { reseedGatedEmptyWorkspace } from './worktree-initial-terminal-seeding'
-
-type GatedEmptyWorkspaceReseedIntent = {
-  callerProvidesSurface: boolean
-  executionHostId?: ExecutionHostId
-}
+import {
+  reseedGatedEmptyWorkspace,
+  type GatedEmptyWorkspaceReseedIntent
+} from './worktree-initial-terminal-seeding'
+import {
+  emptyWorkspaceDefaultChatAwaitsDetection,
+  loadEmptyWorkspaceDefaultChatDetection
+} from './empty-workspace-default-agent-chat'
+import {
+  claimEmptyWorkspaceDefaultSurface,
+  isEmptyWorkspaceDefaultSurfacePending,
+  releaseEmptyWorkspaceDefaultSurface
+} from './empty-workspace-default-surface-claims'
 
 const latestReseedIntentByGate = new WeakMap<
   Promise<WorktreeAgentActivationOutcome>,
@@ -17,22 +23,36 @@ const latestReseedIntentByGate = new WeakMap<
 
 export function gateAndReseedEmptyWorkspace(
   workspaceKey: string,
-  callerProvidesSurface: boolean,
-  executionHostId?: ExecutionHostId
+  intent: GatedEmptyWorkspaceReseedIntent
 ): void {
   const gate = gateWorktreeAgentActivation(workspaceKey)
-  const intent: GatedEmptyWorkspaceReseedIntent = {
-    callerProvidesSurface,
-    ...(executionHostId ? { executionHostId } : {})
-  }
   latestReseedIntentByGate.set(gate, intent)
   void gate.then((outcome) => {
     if (latestReseedIntentByGate.get(gate) !== intent) {
       return
     }
     latestReseedIntentByGate.delete(gate)
-    if (outcome === 'empty') {
-      reseedGatedEmptyWorkspace(workspaceKey, intent.callerProvidesSurface, intent.executionHostId)
+    if (outcome !== 'empty') {
+      return
     }
+    const awaitsDetection =
+      intent.seedUserDefaultSurface && emptyWorkspaceDefaultChatAwaitsDetection(workspaceKey)
+    if (!awaitsDetection && !isEmptyWorkspaceDefaultSurfacePending(workspaceKey)) {
+      reseedGatedEmptyWorkspace(workspaceKey, intent)
+      return
+    }
+    // Why: the default agent depends on the host's list; seeding before it loads locks in a shell.
+    // A wait already pending takes this later intent instead, so the latest activation wins.
+    if (!claimEmptyWorkspaceDefaultSurface(workspaceKey, intent)) {
+      return
+    }
+    const settle = (): void => {
+      const latestIntent = releaseEmptyWorkspaceDefaultSurface(workspaceKey)
+      // Re-checks the active workspace, host, and emptiness the wait may have changed.
+      if (latestIntent) {
+        reseedGatedEmptyWorkspace(workspaceKey, latestIntent)
+      }
+    }
+    void loadEmptyWorkspaceDefaultChatDetection(workspaceKey).then(settle, settle)
   })
 }
diff --git a/src/renderer/src/lib/worktree-activation-nav-registration.ts b/src/renderer/src/lib/worktree-activation-nav-registration.ts
index 11a0af53329..46ab7f30c63 100644
--- a/src/renderer/src/lib/worktree-activation-nav-registration.ts
+++ b/src/renderer/src/lib/worktree-activation-nav-registration.ts
@@ -4,13 +4,14 @@ import {
 } from '@/store/slices/worktree-nav-history'
 import type { WorktreeNavHistoryViewEntry } from '@/store/slices/worktree-nav-history'
 
-type ActivateFn = (worktreeId: string) => unknown
+type ActivateFn = (worktreeId: string, opts: { navigationIntent: 'user-open' }) => unknown
 type ViewActivateFn = (entry: WorktreeNavHistoryViewEntry) => void
 
 export function registerWorktreeActivation(
   activate: ActivateFn,
   activateView: ViewActivateFn
 ): void {
-  setWorktreeNavActivator(activate)
+  // Why: back/forward is the user reopening a workspace they chose, like a sidebar click.
+  setWorktreeNavActivator((worktreeId) => activate(worktreeId, { navigationIntent: 'user-open' }))
   setWorktreeNavViewActivator(activateView)
 }
diff --git a/src/renderer/src/lib/worktree-activation-store-contract.ts b/src/renderer/src/lib/worktree-activation-store-contract.ts
index 63ce180ffed..66de89e85e3 100644
--- a/src/renderer/src/lib/worktree-activation-store-contract.ts
+++ b/src/renderer/src/lib/worktree-activation-store-contract.ts
@@ -8,9 +8,11 @@ import type {
 } from '../../../shared/agent-session-resume'
 import type { WorktreeRuntimeOwnerState } from '@/lib/worktree-runtime-owner'
 import type { AgentStartedTelemetry } from '@/lib/worktree-startup-payload'
+import type { ClosedTerminalTabTombstonesByTabId } from '../../../shared/closed-terminal-tab-tombstones'
 
 export type WorktreeActivationStore = Partial<WorktreeRuntimeOwnerState> & {
   tabsByWorktree: Record<string, { id: string }[]>
+  closedTerminalTabTombstonesByTabId?: ClosedTerminalTabTombstonesByTabId
   defaultTerminalTabsAppliedByWorktreeId: Record<string, true>
   createTab: (
     worktreeId: string,
@@ -75,4 +77,7 @@ export type InitialTerminalOptions = {
    *  Setup/issue work still runs, but work that needs no host terminal must not seed a shell
    *  beside the chat the caller is about to create. */
   callerProvidesSurface?: boolean
+  /** The user deliberately opened this workspace with no surface choice, so it may open their
+   *  default agent chat instead of a bare shell. */
+  seedUserDefaultSurface?: boolean
 }
diff --git a/src/renderer/src/lib/worktree-activation-surface-selection.ts b/src/renderer/src/lib/worktree-activation-surface-selection.ts
index 4385994ff94..9b78a23cd09 100644
--- a/src/renderer/src/lib/worktree-activation-surface-selection.ts
+++ b/src/renderer/src/lib/worktree-activation-surface-selection.ts
@@ -13,6 +13,8 @@ export type WorktreeActivationSurfaceSelection = {
   agent?: TuiAgent | null
   /** A navigation caller is about to open its own editor, diff, or other non-terminal surface. */
   providesInitialSurface?: boolean
+  /** Set only where the user deliberately opened this existing workspace; absent keeps the shell seed. */
+  navigationIntent?: 'user-open'
 }
 
 export type WorktreeActivationOptions = WorktreeActivationSurfaceSelection & {
@@ -38,3 +40,14 @@ export function activationProvidesInitialSurface(
 ): boolean {
   return selection?.providesInitialSurface === true || selection?.agent != null
 }
+
+/** A deliberate user open with no surface choice: an empty workspace gets the user's default surface. */
+export function activationSeedsUserDefaultSurface(
+  selection?: WorktreeActivationSurfaceSelection
+): boolean {
+  return (
+    selection?.navigationIntent === 'user-open' &&
+    selection.agent === undefined &&
+    selection.providesInitialSurface !== true
+  )
+}
diff --git a/src/renderer/src/lib/worktree-activation.ts b/src/renderer/src/lib/worktree-activation.ts
index f2e2ac8f85a..f63b1189097 100644
--- a/src/renderer/src/lib/worktree-activation.ts
+++ b/src/renderer/src/lib/worktree-activation.ts
@@ -28,6 +28,7 @@ import { ensureWebRuntimeWorktreeTerminalAfterWake } from '@/lib/web-runtime-wor
 import { applyWorktreeNavViewEntry } from '@/lib/worktree-nav-view-history-replay'
 import {
   activationProvidesInitialSurface,
+  activationSeedsUserDefaultSurface,
   type WorktreeActivationOptions,
   type WorktreeActivationSurfaceSelection
 } from './worktree-activation-surface-selection'
@@ -47,7 +48,8 @@ export type ActivateAndRevealResult = {
 function ensureFolderWorkspaceInitialTerminal(
   folderWorkspace: FolderWorkspace,
   startup?: WorktreeStartupPayload,
-  providesInitialSurface?: boolean
+  providesInitialSurface?: boolean,
+  seedUserDefaultSurface?: boolean
 ): string | null {
   if (providesInitialSurface === true && startup === undefined) {
     return null
@@ -61,7 +63,10 @@ function ensureFolderWorkspaceInitialTerminal(
     undefined,
     undefined,
     undefined,
-    { reseedEmptiedWorkspace: providesInitialSurface !== true }
+    {
+      reseedEmptiedWorkspace: providesInitialSurface !== true,
+      ...(seedUserDefaultSurface ? { seedUserDefaultSurface: true } : {})
+    }
   )
   return primaryTabId
 }
@@ -128,6 +133,7 @@ export function activateAndRevealFolderWorkspace(
 
   const workspaceKey = folderWorkspaceKey(folderWorkspaceId)
   const providesInitialSurface = activationProvidesInitialSurface(opts)
+  const seedUserDefaultSurface = activationSeedsUserDefaultSurface(opts)
   state.markWorktreeVisited(workspaceKey)
   if (!state.isNavigatingHistory) {
     state.recordWorktreeVisit(workspaceKey)
@@ -144,15 +150,20 @@ export function activateAndRevealFolderWorkspace(
     resumeSleepingAgentSessionsForWorktree(workspaceKey)
   }
   if (shouldGateAgentActivation) {
-    gateAndReseedEmptyWorkspace(
-      workspaceKey,
-      opts?.providesInitialSurface === true,
-      opts?.executionHostId
-    )
+    gateAndReseedEmptyWorkspace(workspaceKey, {
+      callerProvidesSurface: opts?.providesInitialSurface === true,
+      seedUserDefaultSurface,
+      ...(opts?.executionHostId ? { executionHostId: opts.executionHostId } : {})
+    })
   }
   const primaryTabId = shouldGateAgentActivation
     ? null
-    : ensureFolderWorkspaceInitialTerminal(folderWorkspace, opts?.startup, providesInitialSurface)
+    : ensureFolderWorkspaceInitialTerminal(
+        folderWorkspace,
+        opts?.startup,
+        providesInitialSurface,
+        seedUserDefaultSurface
+      )
 
   if (opts?.revealInSidebar !== false) {
     state.revealWorktreeInSidebar(
@@ -185,6 +196,7 @@ export function activateAndRevealWorktree(
     opts?.startup || opts?.setup || opts?.defaultTabs || opts?.issueCommand
   )
   const providesInitialSurface = activationProvidesInitialSurface(opts)
+  const seedUserDefaultSurface = activationSeedsUserDefaultSurface(opts)
   // Why: a plain reselect should still reveal the sidebar row but must not restamp focus recency or wake persistence.
   const isPlainAlreadyActiveTerminal =
     !hasActivationWork &&
@@ -243,11 +255,11 @@ export function activateAndRevealWorktree(
     resumeSleepingAgentSessionsForWorktree(worktreeId)
   }
   if (shouldGateAgentActivation) {
-    gateAndReseedEmptyWorkspace(
-      worktreeId,
-      opts?.providesInitialSurface === true,
-      opts?.executionHostId
-    )
+    gateAndReseedEmptyWorkspace(worktreeId, {
+      callerProvidesSurface: opts?.providesInitialSurface === true,
+      seedUserDefaultSurface,
+      ...(opts?.executionHostId ? { executionHostId: opts.executionHostId } : {})
+    })
   }
 
   // 4. Ensure a focusable surface exists for externally-created worktrees
@@ -266,6 +278,7 @@ export function activateAndRevealWorktree(
             ...(opts?.backendStartupTerminalSpawned ? { backendStartupTerminalSpawned: true } : {}),
             ...(opts?.createNewTerminalForStartup ? { createNewTerminalForStartup: true } : {}),
             ...(providesInitialSurface ? { callerProvidesSurface: true } : {}),
+            ...(seedUserDefaultSurface ? { seedUserDefaultSurface: true } : {}),
             reseedEmptiedWorkspace: !providesInitialSurface
           }
         )
diff --git a/src/renderer/src/lib/worktree-agent-activation-gate.test.ts b/src/renderer/src/lib/worktree-agent-activation-gate.test.ts
index 49d13f87f01..84b498f18f2 100644
--- a/src/renderer/src/lib/worktree-agent-activation-gate.test.ts
+++ b/src/renderer/src/lib/worktree-agent-activation-gate.test.ts
@@ -7,7 +7,10 @@ import type { TerminalLayoutSnapshot, TerminalTab } from '../../../shared/termin
 import { singlePaneLayoutSnapshot } from '@/store/slices/terminal-helpers'
 import type { TerminalSlice } from '@/store/slices/terminals'
 import { runWorktreeAgentActivationGate } from './worktree-agent-activation-gate'
-import type { LiveTerminalSurfaceOwnerIndex } from './worktree-live-terminal-surface-owners'
+import {
+  indexLiveTerminalSurfaceOwners,
+  type LiveTerminalSurfaceOwnerIndex
+} from './worktree-live-terminal-surface-owners'
 
 const WORKTREE_ID = 'repo::/worktree'
 const STALE_STRUCTURED_SESSION_ID = 'structured-session-stale'
@@ -212,7 +215,10 @@ function seedExistingSurface(
 describe('worktree agent activation gate', () => {
   it('uses immediately ready development restore inventory', async () => {
     const ptyId = `${WORKTREE_ID}@@live-pty`
-    const { deps, createTab, resume } = testDeps({ sessions: [listed(ptyId)] })
+    const { deps, createTab, resume } = testDeps({
+      sessions: [listed(ptyId)],
+      surfaceOwners: new Map([[ptyId, 'unowned']])
+    })
     const awaitReady = vi.fn(async () => true)
 
     await expect(
@@ -226,7 +232,10 @@ describe('worktree agent activation gate', () => {
 
   it('waits for packaged restore hydration before reading daemon inventory', async () => {
     const ptyId = `${WORKTREE_ID}@@live-pty`
-    const { deps, createTab, resume } = testDeps({ sessions: [listed(ptyId)] })
+    const { deps, createTab, resume } = testDeps({
+      sessions: [listed(ptyId)],
+      surfaceOwners: new Map([[ptyId, 'unowned']])
+    })
     let releaseReady!: (ready: boolean) => void
     const awaitReady = vi.fn(() => new Promise<boolean>((resolve) => (releaseReady = resolve)))
 
@@ -270,7 +279,10 @@ describe('worktree agent activation gate', () => {
 
   it('adopts a live daemon PTY before activation can resume another agent', async () => {
     const ptyId = `${WORKTREE_ID}@@live-pty`
-    const { deps, createTab, resume } = testDeps({ sessions: [listed(ptyId)] })
+    const { deps, createTab, resume } = testDeps({
+      sessions: [listed(ptyId)],
+      surfaceOwners: new Map([[ptyId, 'unowned']])
+    })
 
     await expect(runWorktreeAgentActivationGate(WORKTREE_ID, deps)).resolves.toBe('adopted')
 
@@ -285,7 +297,10 @@ describe('worktree agent activation gate', () => {
   it('adopts a daemon PTY minted for a folder workspace', async () => {
     const folderWorkspaceId = 'folder:plain-workspace'
     const ptyId = `${folderWorkspaceId}@@live-pty`
-    const { deps, createTab, resume } = testDeps({ sessions: [listed(ptyId)] })
+    const { deps, createTab, resume } = testDeps({
+      sessions: [listed(ptyId)],
+      surfaceOwners: new Map([[ptyId, 'unowned']])
+    })
 
     await expect(runWorktreeAgentActivationGate(folderWorkspaceId, deps)).resolves.toBe('adopted')
 
@@ -593,7 +608,10 @@ describe('worktree agent activation gate', () => {
     const unverifiablePtyId = `${WORKTREE_ID}@@ambiguous-agent`
     const { deps } = testDeps({
       sessions: [listed(adoptedPtyId), listed(unverifiablePtyId)],
-      surfaceOwners: new Map([[unverifiablePtyId, null]]),
+      surfaceOwners: new Map([
+        [adoptedPtyId, 'unowned'],
+        [unverifiablePtyId, null]
+      ]),
       resumeCount: 0
     })
 
@@ -653,14 +671,14 @@ describe('worktree agent activation gate', () => {
     const livePtyId = `${WORKTREE_ID}@@live-agent`
     const { deps, createTab } = testDeps({
       sessions: [listed(livePtyId)],
-      surfaceOwners: new Map()
+      surfaceOwners: new Map([[livePtyId, 'unowned']])
     })
     const store = deps.getState()
     seedExistingSurface(store, { tabId: 'tab-live', leafId: LIVE_LEAF_ID })
     // The pane mounts while the census is in flight, binding the PTY behind the sweep.
     deps.listSurfaceOwners.mockImplementation(async () => {
       store.ptyIdsByTabId['tab-live'] = [livePtyId]
-      return new Map()
+      return new Map([[livePtyId, 'unowned']])
     })
 
     await expect(runWorktreeAgentActivationGate(WORKTREE_ID, deps)).resolves.toBe('adopted')
@@ -668,6 +686,38 @@ describe('worktree agent activation gate', () => {
     expect(createTab).not.toHaveBeenCalled()
   })
 
+  it('does not adopt a predecessor after the relay restarts between activation inventories', async () => {
+    const predecessor = 'ssh:target@@pty2:old-relay:1'
+    const replacement = 'ssh:target@@pty2:new-relay:1'
+    const { deps, createTab } = testDeps({ resumeCount: 0 })
+    const store = deps.getState()
+    seedExistingSurface(store, {
+      tabId: 'tab-live',
+      leafId: LIVE_LEAF_ID,
+      boundPtyId: predecessor
+    })
+    let replyWithOldInventory!: (sessions: PtyListedSession[]) => void
+    deps.listSessions.mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          replyWithOldInventory = resolve
+        })
+    )
+    const activation = runWorktreeAgentActivationGate(WORKTREE_ID, deps)
+    await vi.waitFor(() => expect(deps.listSessions).toHaveBeenCalledOnce())
+
+    // Recovery rebinds the same pane before the old relay's inventory response arrives.
+    store.terminalLayoutsByTabId['tab-live']!.ptyIdsByLeafId[LIVE_LEAF_ID] = replacement
+    store.ptyIdsByTabId['tab-live'] = [replacement]
+    deps.listSurfaceOwners.mockResolvedValueOnce(indexLiveTerminalSurfaceOwners([], WORKTREE_ID))
+    replyWithOldInventory([{ ...listed(predecessor), worktreeId: WORKTREE_ID }])
+    await activation
+
+    expect(createTab).not.toHaveBeenCalled()
+    expect(store.tabsByWorktree[WORKTREE_ID]?.map((tab) => tab.id)).toEqual(['tab-live'])
+    expect(store.terminalLayoutsByTabId['tab-live']?.ptyIdsByLeafId[LIVE_LEAF_ID]).toBe(replacement)
+  })
+
   it('gives every host pane of an unmounted tab its own leaf', async () => {
     const firstPtyId = `${WORKTREE_ID}@@live-agent`
     const secondPtyId = `${WORKTREE_ID}@@live-sibling`
@@ -706,7 +756,7 @@ describe('worktree agent activation gate', () => {
     const livePtyId = `${WORKTREE_ID}@@orphan-agent`
     const { deps, createTab } = testDeps({
       sessions: [listed(livePtyId)],
-      surfaceOwners: new Map()
+      surfaceOwners: new Map([[livePtyId, 'unowned']])
     })
 
     await expect(runWorktreeAgentActivationGate(WORKTREE_ID, deps)).resolves.toBe('adopted')
diff --git a/src/renderer/src/lib/worktree-agent-live-surface-adoption.ts b/src/renderer/src/lib/worktree-agent-live-surface-adoption.ts
index 3675b7575da..81ac509ffb7 100644
--- a/src/renderer/src/lib/worktree-agent-live-surface-adoption.ts
+++ b/src/renderer/src/lib/worktree-agent-live-surface-adoption.ts
@@ -155,7 +155,7 @@ export async function adoptLiveWorkspacePtySurfaces(
       continue
     }
     const owner = surfaceOwners?.get(ptyId)
-    if (owner) {
+    if (owner && owner !== 'unowned') {
       if (adoptHostOwnedSurface(getState, worktreeId, owner, materializedTabIds)) {
         surfaced = true
       } else {
@@ -165,7 +165,7 @@ export async function adoptLiveWorkspacePtySurfaces(
     }
     // Why: only the execution host can prove a live PTY is unowned, and minting
     // on anything weaker forks a running agent onto a second empty surface.
-    if (!surfaceOwners || surfaceOwners.has(ptyId)) {
+    if (owner !== 'unowned') {
       declinedPtyIds.push(ptyId)
       continue
     }
diff --git a/src/renderer/src/lib/worktree-creation-flow-agent-trust-preflight.test.ts b/src/renderer/src/lib/worktree-creation-flow-agent-trust-preflight.test.ts
deleted file mode 100644
index 2a960761900..00000000000
--- a/src/renderer/src/lib/worktree-creation-flow-agent-trust-preflight.test.ts
+++ /dev/null
@@ -1,32 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-const FLOW_SOURCE = readFileSync(join(__dirname, 'worktree-creation-flow-execute.ts'), 'utf8')
-const PREFLIGHT_SOURCE = readFileSync(join(__dirname, 'agent-trust-preflight.ts'), 'utf8')
-
-function sourceBetween(source: string, startPattern: string, endPattern: string): string {
-  const start = source.indexOf(startPattern)
-  expect(start).toBeGreaterThanOrEqual(0)
-  const end = source.indexOf(endPattern, start + startPattern.length)
-  expect(end).toBeGreaterThan(start)
-  return source.slice(start, end)
-}
-
-describe('worktree creation flow agent trust preflight', () => {
-  it('forwards the repo SSH connection id when pre-marking terminal agent trust', () => {
-    const preflight = PREFLIGHT_SOURCE
-    const createFlow = sourceBetween(
-      FLOW_SOURCE,
-      'const backendSpawned = result.startupTerminal?.spawned === true',
-      '// `createWorktree` already inserted the real worktree row'
-    )
-
-    expect(preflight).toContain('connectionId?: string | null')
-    expect(preflight).toContain('...(args.connectionId ? { connectionId: args.connectionId } : {})')
-    expect(createFlow).toContain('repoConnectionId')
-    expect(createFlow).toContain('repo.id === worktree.repoId')
-    expect(createFlow).toContain('await preflightAgentTrust({')
-    expect(createFlow).toContain('connectionId: repoConnectionId')
-  })
-})
diff --git a/src/renderer/src/lib/worktree-creation-flow-execute.ts b/src/renderer/src/lib/worktree-creation-flow-execute.ts
index a47d7def194..d3b1b263757 100644
--- a/src/renderer/src/lib/worktree-creation-flow-execute.ts
+++ b/src/renderer/src/lib/worktree-creation-flow-execute.ts
@@ -1,6 +1,5 @@
 import { toast } from 'sonner'
 import { useAppStore } from '@/store'
-import { preflightAgentTrust } from '@/lib/agent-trust-preflight'
 import { activateAndRevealWorktree, type ActivateAndRevealResult } from '@/lib/worktree-activation'
 import { ensureWorktreeHasInitialTerminal } from '@/lib/worktree-initial-terminal-seeding'
 import {
@@ -146,20 +145,10 @@ export async function executeWorktreeCreation(
     ? undefined
     : buildWorktreeCreationStartupOpt(preparedRequest, backendSpawned)
 
-  if (worktree.path && !structuredLaunch) {
-    const repoConnectionId =
-      useAppStore.getState().repos.find((repo) => repo.id === worktree.repoId)?.connectionId ?? null
-    await preflightAgentTrust({
-      agent: preparedRequest.agent,
-      workspacePath: worktree.path,
-      connectionId: repoConnectionId
-    })
-  }
-
   // `createWorktree` already inserted the real worktree row. Leaving for an app
   // view keeps the create in the background, while selecting another workspace
   // means the user still expects this task-launch handoff when it becomes ready;
-  // the entry guard prevents a late trust preflight from reviving a cancelled create.
+  // the entry guard keeps a cancelled create from being revived.
   const completionState = useAppStore.getState()
   const shouldActivateOnCompletion =
     completionState.pendingWorktreeCreations[creationId] !== undefined &&
diff --git a/src/renderer/src/lib/worktree-creation-flow.test.ts b/src/renderer/src/lib/worktree-creation-flow.test.ts
index a599a265513..9f9725286c5 100644
--- a/src/renderer/src/lib/worktree-creation-flow.test.ts
+++ b/src/renderer/src/lib/worktree-creation-flow.test.ts
@@ -581,36 +581,6 @@ describe('staged background worktree creation', () => {
     })
   })
 
-  it('does not reveal a workspace cancelled during post-create trust preflight', async () => {
-    let resolveTrust!: () => void
-    const markTrusted = vi.fn(
-      () =>
-        new Promise<void>((resolve) => {
-          resolveTrust = resolve
-        })
-    )
-    globalThis.window = { api: { agentTrust: { markTrusted } } } as never
-    store.repos = [{ id: 'repo-1', connectionId: null }]
-    store.createWorktree.mockResolvedValueOnce({
-      worktree: { id: 'wt-1', repoId: 'repo-1', path: '/repo/wt-1' }
-    })
-
-    const started = continueBackgroundWorktreeCreation(
-      'creation-1',
-      makeRequest({ agent: 'codex' }),
-      { revealCreationSurface: false }
-    )
-
-    expect(started).toBe(true)
-    await vi.waitFor(() => expect(markTrusted).toHaveBeenCalledTimes(1))
-    delete store.pendingWorktreeCreations['creation-1']
-    store.activePendingCreationId = null
-    resolveTrust()
-    await vi.waitFor(() => expect(store.removePendingWorktreeCreation).toHaveBeenCalled())
-
-    expect(activateAndRevealWorktree).not.toHaveBeenCalled()
-  })
-
   // Why: one-click "Start workspace from issue" commonly backgrounds, so the
   // user-moved-on path is the common delivery for the repo's issue command; it
   // must thread through as the 5th positional arg, not be dropped to undefined.
diff --git a/src/renderer/src/lib/worktree-host-connection-phase.test.ts b/src/renderer/src/lib/worktree-host-connection-phase.test.ts
new file mode 100644
index 00000000000..ab7b3cdeeb7
--- /dev/null
+++ b/src/renderer/src/lib/worktree-host-connection-phase.test.ts
@@ -0,0 +1,227 @@
+import { describe, expect, it } from 'vitest'
+import type { AppState } from '@/store/types'
+import type { SshConnectionStatus } from '../../../shared/ssh-types'
+import { selectWorktreeHostConnectionPhase } from './worktree-host-connection-phase'
+
+function makeState(overrides: Record<string, unknown>): AppState {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the phase selector reads only the repo, worktree, runtime, and SSH fields set here.
+  return {
+    activeWorktreeId: null,
+    detectedWorktreesByRepo: {},
+    folderWorkspaces: [],
+    projectGroups: [],
+    removedSshTargetLabels: new Map(),
+    repos: [],
+    runtimeStatusByEnvironmentId: new Map(),
+    sshConnectionStates: new Map(),
+    sshStateByEnvironment: new Map(),
+    sshTargetLabels: new Map(),
+    sshTargetsHydrated: true,
+    terminalStartupRestorationReady: true,
+    worktreesByRepo: {},
+    ...overrides
+  } as unknown as AppState
+}
+
+function makeSshState(
+  status: SshConnectionStatus | null,
+  overrides: Record<string, unknown> = {}
+): AppState {
+  return makeState({
+    repos: [{ id: 'repo-ssh', connectionId: 'ssh-a' }],
+    sshConnectionStates: new Map(
+      status
+        ? [
+            [
+              'ssh-a',
+              {
+                targetId: 'ssh-a',
+                status,
+                error: null,
+                reconnectAttempt: 0,
+                connectionGeneration: 7
+              }
+            ]
+          ]
+        : []
+    ),
+    worktreesByRepo: { 'repo-ssh': [{ id: 'wt-ssh', repoId: 'repo-ssh' }] },
+    ...overrides
+  })
+}
+
+describe('selectWorktreeHostConnectionPhase', () => {
+  it('reports a local workspace, and no worktree, as local', () => {
+    const state = makeState({
+      repos: [{ id: 'repo-local' }],
+      worktreesByRepo: { 'repo-local': [{ id: 'wt-local', repoId: 'repo-local' }] }
+    })
+
+    const local = {
+      phase: 'local',
+      targetId: null,
+      environmentId: null,
+      publishedStatus: null,
+      connectedEpoch: null
+    }
+    expect(selectWorktreeHostConnectionPhase(state, 'wt-local')).toEqual(local)
+    expect(selectWorktreeHostConnectionPhase(state, null)).toEqual(local)
+  })
+
+  it('reports a runtime-owned target as local: this client never dials it', () => {
+    const state = makeState({
+      repos: [{ id: 'repo-ephemeral', connectionId: 'runtime-ssh-vm-a' }],
+      worktreesByRepo: { 'repo-ephemeral': [{ id: 'wt-ephemeral', repoId: 'repo-ephemeral' }] }
+    })
+
+    expect(selectWorktreeHostConnectionPhase(state, 'wt-ephemeral').phase).toBe('local')
+  })
+
+  it('reads an unpublished target as connecting only until startup restoration finishes', () => {
+    expect(
+      selectWorktreeHostConnectionPhase(
+        makeSshState(null, { terminalStartupRestorationReady: false }),
+        'wt-ssh'
+      )
+    ).toMatchObject({ phase: 'connecting', targetId: 'ssh-a', publishedStatus: 'disconnected' })
+    expect(selectWorktreeHostConnectionPhase(makeSshState(null), 'wt-ssh')).toMatchObject({
+      phase: 'unavailable',
+      targetId: 'ssh-a',
+      publishedStatus: 'disconnected'
+    })
+  })
+
+  it('maps published statuses; only a connected host names its connection', () => {
+    expect(selectWorktreeHostConnectionPhase(makeSshState('connecting'), 'wt-ssh')).toEqual({
+      phase: 'connecting',
+      targetId: 'ssh-a',
+      environmentId: null,
+      publishedStatus: 'connecting',
+      connectedEpoch: null
+    })
+    expect(selectWorktreeHostConnectionPhase(makeSshState('reconnecting'), 'wt-ssh').phase).toBe(
+      'connecting'
+    )
+    expect(selectWorktreeHostConnectionPhase(makeSshState('deploying-relay'), 'wt-ssh').phase).toBe(
+      'connecting'
+    )
+    expect(selectWorktreeHostConnectionPhase(makeSshState('connected'), 'wt-ssh')).toEqual({
+      phase: 'connected',
+      targetId: 'ssh-a',
+      environmentId: null,
+      publishedStatus: 'connected',
+      connectedEpoch: 'ssh-a:7'
+    })
+  })
+
+  it('reports failed and disconnected targets as unavailable once restoration is done', () => {
+    for (const status of ['reconnection-failed', 'disconnected', 'auth-failed', 'error'] as const) {
+      expect(selectWorktreeHostConnectionPhase(makeSshState(status), 'wt-ssh').phase).toBe(
+        'unavailable'
+      )
+    }
+  })
+
+  it('keeps a published failure unavailable even before restoration finishes', () => {
+    expect(
+      selectWorktreeHostConnectionPhase(
+        makeSshState('auth-failed', { terminalStartupRestorationReady: false }),
+        'wt-ssh'
+      ).phase
+    ).toBe('unavailable')
+  })
+
+  it("reads a runtime environment's nested target from that environment's SSH state", () => {
+    const state = makeState({
+      repos: [{ id: 'repo-runtime', connectionId: 'ssh-nested', executionHostId: 'runtime:env-a' }],
+      runtimeStatusByEnvironmentId: new Map([
+        ['env-a', { status: { runtimeId: 'runtime-a' }, checkedAt: 1 }]
+      ]),
+      sshStateByEnvironment: new Map([
+        [
+          'env-a',
+          {
+            connectionStates: new Map([
+              [
+                'ssh-nested',
+                {
+                  targetId: 'ssh-nested',
+                  status: 'connected',
+                  error: null,
+                  reconnectAttempt: 0,
+                  connectionGeneration: 3
+                }
+              ]
+            ]),
+            targetLabels: new Map([['ssh-nested', 'build box']]),
+            removedTargetLabels: new Map(),
+            targetsHydrated: true
+          }
+        ]
+      ]),
+      terminalStartupRestorationReady: false,
+      worktreesByRepo: {
+        'repo-runtime': [
+          {
+            id: 'wt-runtime',
+            repoId: 'repo-runtime',
+            hostId: 'runtime:env-a',
+            runtimeOwnerEnvironmentId: 'env-a'
+          }
+        ]
+      }
+    })
+
+    expect(selectWorktreeHostConnectionPhase(state, 'wt-runtime')).toEqual({
+      phase: 'connected',
+      targetId: 'ssh-nested',
+      environmentId: 'env-a',
+      publishedStatus: 'connected',
+      connectedEpoch: 'ssh-nested:3'
+    })
+  })
+
+  it('names a new connection on every reconnect', () => {
+    const connected = makeSshState('connected')
+    const reconnected = makeSshState('connected', {
+      sshConnectionStates: new Map([
+        [
+          'ssh-a',
+          {
+            targetId: 'ssh-a',
+            status: 'connected',
+            error: null,
+            reconnectAttempt: 0,
+            connectionGeneration: 8
+          }
+        ]
+      ])
+    })
+
+    expect(selectWorktreeHostConnectionPhase(reconnected, 'wt-ssh').connectedEpoch).not.toBe(
+      selectWorktreeHostConnectionPhase(connected, 'wt-ssh').connectedEpoch
+    )
+  })
+
+  it('reports a nested target whose runtime is unreachable as unverifiable, not down', () => {
+    const state = makeState({
+      repos: [{ id: 'repo-runtime', connectionId: 'ssh-nested', executionHostId: 'runtime:env-a' }],
+      worktreesByRepo: {
+        'repo-runtime': [
+          {
+            id: 'wt-runtime',
+            repoId: 'repo-runtime',
+            hostId: 'runtime:env-a',
+            runtimeOwnerEnvironmentId: 'env-a'
+          }
+        ]
+      }
+    })
+
+    expect(selectWorktreeHostConnectionPhase(state, 'wt-runtime')).toMatchObject({
+      phase: 'unverifiable',
+      targetId: 'ssh-nested',
+      publishedStatus: null
+    })
+  })
+})
diff --git a/src/renderer/src/lib/worktree-host-connection-phase.ts b/src/renderer/src/lib/worktree-host-connection-phase.ts
new file mode 100644
index 00000000000..8a0d39d4b1c
--- /dev/null
+++ b/src/renderer/src/lib/worktree-host-connection-phase.ts
@@ -0,0 +1,119 @@
+import { useShallow } from 'zustand/react/shallow'
+import { useAppStore } from '@/store'
+import type { AppState } from '@/store/types'
+import { getConnectionIdFromState } from '@/lib/connection-context'
+import { getExplicitRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
+import {
+  selectRuntimeAwareSshConnectionGeneration,
+  selectRuntimeAwareSshStatus
+} from '@/store/slices/runtime-environment-ssh'
+import { isConnectingSshStatus } from '@/ssh/ssh-connection-recoverability'
+import type { SshConnectionStatus } from '../../../shared/ssh-types'
+import { isRuntimeOwnedSshTargetId } from '../../../shared/execution-host'
+
+/**
+ * `local`: no SSH target this client dials for the worktree — a local workspace, a
+ * runtime-owned target, or an owner that has not resolved yet.
+ * `unverifiable`: the owning remote runtime is unreachable or has not published its SSH
+ * state, so this client cannot see the target — not evidence that it is down.
+ */
+export type WorktreeHostConnectionPhase =
+  | 'local'
+  | 'connecting'
+  | 'connected'
+  | 'unavailable'
+  | 'unverifiable'
+
+export type WorktreeHostConnection = {
+  phase: WorktreeHostConnectionPhase
+  targetId: string | null
+  /** The remote runtime whose mirrored SSH state owns the target; null for this client's own. */
+  environmentId: string | null
+  /**
+   * The status as published, before `phase` reads an undialed startup target as connecting.
+   * Surfaces that name the status itself (the terminal's reconnect overlay) read this; null
+   * when local or unverifiable.
+   */
+  publishedStatus: SshConnectionStatus | null
+  /** Names the live connection: null unless connected, and new on every reconnect. */
+  connectedEpoch: string | null
+}
+
+const LOCAL_HOST_CONNECTION: WorktreeHostConnection = {
+  phase: 'local',
+  targetId: null,
+  environmentId: null,
+  publishedStatus: null,
+  connectedEpoch: null
+}
+
+function derivePhase(
+  state: AppState,
+  targetId: string,
+  environmentId: string | null,
+  publishedStatus: SshConnectionStatus | null
+): WorktreeHostConnectionPhase {
+  if (publishedStatus === null) {
+    return 'unverifiable'
+  }
+  if (publishedStatus === 'connected') {
+    return 'connected'
+  }
+  if (isConnectingSshStatus(publishedStatus)) {
+    return 'connecting'
+  }
+  // Why: startup restoration dials the targets that were live at shutdown; until it publishes,
+  // a missing entry means "not dialed yet", not "disconnected". Restoration finishing (or
+  // degrading) ends this on its own.
+  if (
+    environmentId === null &&
+    !state.terminalStartupRestorationReady &&
+    !state.sshConnectionStates.has(targetId)
+  ) {
+    return 'connecting'
+  }
+  return 'unavailable'
+}
+
+/** The shared signal for a caller that already resolved the worktree's connection id. */
+export function resolveWorktreeHostConnection(
+  state: AppState,
+  worktreeId: string,
+  targetId: string | null | undefined
+): WorktreeHostConnection {
+  if (!targetId || isRuntimeOwnedSshTargetId(targetId)) {
+    return LOCAL_HOST_CONNECTION
+  }
+  const environmentId = getExplicitRuntimeEnvironmentIdForWorktree(state, worktreeId)
+  const publishedStatus = selectRuntimeAwareSshStatus(state, environmentId, targetId)
+  const generation = selectRuntimeAwareSshConnectionGeneration(state, environmentId, targetId)
+  return {
+    phase: derivePhase(state, targetId, environmentId, publishedStatus),
+    targetId,
+    environmentId,
+    publishedStatus,
+    connectedEpoch: publishedStatus === 'connected' ? `${targetId}:${generation ?? ''}` : null
+  }
+}
+
+/**
+ * The one reading of a worktree's SSH host that every pane shares, derived from the
+ * published SSH state. Panes must not re-derive status or reconnect identity themselves.
+ */
+export function selectWorktreeHostConnectionPhase(
+  state: AppState,
+  worktreeId: string | null
+): WorktreeHostConnection {
+  if (!worktreeId) {
+    return LOCAL_HOST_CONNECTION
+  }
+  return resolveWorktreeHostConnection(
+    state,
+    worktreeId,
+    getConnectionIdFromState(state, worktreeId)
+  )
+}
+
+export function useWorktreeHostConnection(worktreeId: string | null): WorktreeHostConnection {
+  return useAppStore(useShallow((state) => selectWorktreeHostConnectionPhase(state, worktreeId)))
+}
diff --git a/src/renderer/src/lib/worktree-initial-terminal-close-records.test.ts b/src/renderer/src/lib/worktree-initial-terminal-close-records.test.ts
new file mode 100644
index 00000000000..cd563d9cbe7
--- /dev/null
+++ b/src/renderer/src/lib/worktree-initial-terminal-close-records.test.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it } from 'vitest'
+import { ensureWorktreeHasInitialTerminal } from './worktree-initial-terminal-seeding'
+import {
+  createMockStore,
+  registerWorktreeActivationReset
+} from './worktree-activation-test-harness'
+import {
+  CLOSED_TERMINAL_TAB_TOMBSTONE_TTL_MS,
+  MAX_CLOSED_TERMINAL_TAB_TOMBSTONES,
+  recordClosedTerminalTabTombstone,
+  type ClosedTerminalTabTombstonesByTabId
+} from '../../../shared/closed-terminal-tab-tombstones'
+
+registerWorktreeActivationReset()
+
+const WT = 'wt-1'
+
+/** Startup hydration's seeding decision: no reseed opt-in, so only the row and records decide. */
+function seeds(
+  tabsByWorktree: Record<string, { id: string }[]>,
+  closedTerminalTabTombstonesByTabId?: ClosedTerminalTabTombstonesByTabId,
+  opts?: { reseedEmptiedWorkspace?: boolean }
+): boolean {
+  const store = createMockStore({ tabsByWorktree, closedTerminalTabTombstonesByTabId })
+  ensureWorktreeHasInitialTerminal(store, WT, undefined, undefined, undefined, undefined, opts)
+  return store.createTab.mock.calls.length > 0
+}
+
+function closedAt(closedAtMs: number): ClosedTerminalTabTombstonesByTabId {
+  return { 'closed-tab': { closedAt: closedAtMs, worktreeId: WT, reason: 'user' } }
+}
+
+describe('seeding an empty workspace reads close records', () => {
+  it('an empty row with a close record stays empty', () => {
+    expect(seeds({ [WT]: [] }, closedAt(Date.now()))).toBe(false)
+  })
+
+  it('a legacy empty row with no record seeds', () => {
+    expect(seeds({ [WT]: [] })).toBe(true)
+  })
+
+  it('an empty row whose only record is past its TTL seeds', () => {
+    expect(
+      seeds({ [WT]: [] }, closedAt(Date.now() - CLOSED_TERMINAL_TAB_TOMBSTONE_TTL_MS - 1))
+    ).toBe(true)
+  })
+
+  it('an empty row whose record the per-host cap evicted seeds', () => {
+    const now = Date.now()
+    let records = closedAt(now - 1_000)
+    for (let index = 0; index < MAX_CLOSED_TERMINAL_TAB_TOMBSTONES; index += 1) {
+      records = recordClosedTerminalTabTombstone(
+        records,
+        `other-${index}`,
+        { worktreeId: 'wt-other', reason: 'user' },
+        now
+      )
+    }
+    expect(records['closed-tab']).toBeUndefined()
+    expect(seeds({ [WT]: [] }, records)).toBe(true)
+  })
+
+  // Known weakness until every membership shrink is a close: an older close plus an empty row
+  // written by something that is not a close still reads as emptied on purpose.
+  it('a stale record from an earlier close suppresses the startup seed; activation reseeds', () => {
+    const earlierClose = closedAt(Date.now() - 60_000)
+    expect(seeds({ [WT]: [] }, earlierClose)).toBe(false)
+    expect(seeds({ [WT]: [] }, earlierClose, { reseedEmptiedWorkspace: true })).toBe(true)
+  })
+})
diff --git a/src/renderer/src/lib/worktree-initial-terminal-seeding.ts b/src/renderer/src/lib/worktree-initial-terminal-seeding.ts
index f9c2844d472..feb01ef0b9b 100644
--- a/src/renderer/src/lib/worktree-initial-terminal-seeding.ts
+++ b/src/renderer/src/lib/worktree-initial-terminal-seeding.ts
@@ -4,6 +4,7 @@ import type {
 } from '../../../shared/worktree/launch-types'
 import type { ExecutionHostId } from '../../../shared/execution-host'
 import { shouldAutoCreateInitialTerminal } from '@/components/terminal/initial-terminal'
+import { isTerminalWorkspaceEmptiedOnPurpose } from '../../../shared/closed-terminal-tab-tombstones'
 import { createSequencedSetupAgentCommands } from '../../../shared/setup-agent-sequencing'
 import { getSetupRunnerCommandPlatformForPath } from '../../../shared/setup-runner-command'
 import { agentKindToTuiAgent } from '../../../shared/agent-kind'
@@ -28,6 +29,8 @@ import {
   type IssueCommandLaunch
 } from '@/lib/worktree-setup-issue-command-queue'
 import { applyDefaultTerminalTabs } from '@/lib/worktree-default-terminal-tabs'
+import { openDefaultAgentChatInEmptyWorkspace } from '@/lib/empty-workspace-default-agent-chat'
+import { isEmptyWorkspaceDefaultSurfacePending } from '@/lib/empty-workspace-default-surface-claims'
 
 function getSetupRunnerCommandPlatformForLaunch(setup: WorktreeSetupLaunch): 'windows' | 'posix' {
   return getSetupRunnerCommandPlatformForPath(
@@ -36,15 +39,22 @@ function getSetupRunnerCommandPlatformForLaunch(setup: WorktreeSetupLaunch): 'wi
   )
 }
 
+export type GatedEmptyWorkspaceReseedIntent = {
+  callerProvidesSurface: boolean
+  seedUserDefaultSurface: boolean
+  executionHostId?: ExecutionHostId
+}
+
 /** Re-seed after an empty gate unless its activation owns the surface or no longer owns the host. */
 export function reseedGatedEmptyWorkspace(
   workspaceKey: string,
-  callerProvidesSurface: boolean,
-  executionHostId?: ExecutionHostId
+  intent: GatedEmptyWorkspaceReseedIntent
 ): void {
+  const { callerProvidesSurface, seedUserDefaultSurface, executionHostId } = intent
   const state = useAppStore.getState()
   if (
     callerProvidesSurface === true ||
+    isEmptyWorkspaceDefaultSurfacePending(workspaceKey) ||
     state.activeWorktreeId !== workspaceKey ||
     (executionHostId !== undefined && state.activeWorkspaceExecutionHostId !== executionHostId)
   ) {
@@ -58,7 +68,8 @@ export function reseedGatedEmptyWorkspace(
     undefined,
     undefined,
     {
-      reseedEmptiedWorkspace: true
+      reseedEmptiedWorkspace: true,
+      ...(seedUserDefaultSurface ? { seedUserDefaultSurface: true } : {})
     }
   )
 }
@@ -174,7 +185,7 @@ export function ensureWorktreeHasInitialTerminal(
   // terminal is added; and closeTabPreservingPty (use-terminal-pane-lifecycle.ts) skips both
   // deactivation hooks for pane moves and retirement, where re-seeding is the wanted outcome.
   const shouldHonourClosedTerminalTombstone =
-    Object.hasOwn(store.tabsByWorktree, worktreeId) && opts?.reseedEmptiedWorkspace !== true
+    isTerminalWorkspaceEmptiedOnPurpose(store, worktreeId) && opts?.reseedEmptiedWorkspace !== true
   // Why: an execution host that has not answered is not a host with no terminals; seeding into that
   // gap is what adds a tab per launch (STA-4658). Explicit launch work below is a request to create
   // a terminal now, so it stays ungated.
@@ -215,6 +226,16 @@ export function ensureWorktreeHasInitialTerminal(
   if (templatedTabId) {
     return templatedTabId
   }
+  if (
+    opts?.seedUserDefaultSurface === true &&
+    !hasExplicitLaunchWork &&
+    opts.activateCreatedTabs !== false
+  ) {
+    const defaultChat = openDefaultAgentChatInEmptyWorkspace(worktreeId)
+    if (defaultChat) {
+      return defaultChat.primaryTabId
+    }
+  }
 
   // Why: tag this activation-created tab so its PTY spawn doesn't count as activity and reshuffle the Recent sort.
   // Why: stamp the seeded agent before hooks arrive so native chat and provider chrome can resolve it immediately.
diff --git a/src/renderer/src/lib/worktree-jump-navigation.test.ts b/src/renderer/src/lib/worktree-jump-navigation.test.ts
index 4c76316556c..af8072ac9c4 100644
--- a/src/renderer/src/lib/worktree-jump-navigation.test.ts
+++ b/src/renderer/src/lib/worktree-jump-navigation.test.ts
@@ -57,7 +57,9 @@ describe('worktree jump navigation', () => {
 
     expect(mocks.worktreePassesSidebarFilters).not.toHaveBeenCalled()
     expect(mocks.warning).not.toHaveBeenCalled()
-    expect(mocks.activateAndRevealWorkspace).toHaveBeenCalledWith('repo::/deleted', {})
+    expect(mocks.activateAndRevealWorkspace).toHaveBeenCalledWith('repo::/deleted', {
+      navigationIntent: 'user-open'
+    })
   })
 
   it('switches the left sidebar to Spaces and warns when filters hide the target', () => {
@@ -67,6 +69,7 @@ describe('worktree jump navigation', () => {
 
     expect(state.setSidebarBody).toHaveBeenCalledWith('workspaces')
     expect(mocks.activateAndRevealWorkspace).toHaveBeenCalledWith('repo::/target', {
+      navigationIntent: 'user-open',
       revealInSidebar: false,
       clearSidebarFilters: false
     })
@@ -98,7 +101,9 @@ describe('worktree jump navigation', () => {
 
     expect(jumpToWorktreeFromSidebar('wt-collapsed')).toBe(true)
 
-    expect(mocks.activateAndRevealWorkspace).toHaveBeenCalledWith('wt-collapsed', {})
+    expect(mocks.activateAndRevealWorkspace).toHaveBeenCalledWith('wt-collapsed', {
+      navigationIntent: 'user-open'
+    })
     expect(mocks.warning).not.toHaveBeenCalled()
   })
 
@@ -121,6 +126,7 @@ describe('worktree jump navigation', () => {
     expect(jumpToWorktreeFromSidebar('repo::/target', { executionHostId: 'ssh:beta' })).toBe(true)
 
     expect(mocks.activateAndRevealWorkspace).toHaveBeenCalledWith('repo::/target', {
+      navigationIntent: 'user-open',
       revealInSidebar: false,
       clearSidebarFilters: false,
       executionHostId: 'ssh:beta'
@@ -134,6 +140,7 @@ describe('worktree jump navigation', () => {
     expect(jumpToWorktreeFromSidebar('folder:folder-1', { executionHostId: 'local' })).toBe(true)
 
     expect(mocks.activateAndRevealWorkspace).toHaveBeenCalledWith('folder:folder-1', {
+      navigationIntent: 'user-open',
       executionHostId: 'local'
     })
     // Folder workspaces never get the filter-hidden treatment.
diff --git a/src/renderer/src/lib/worktree-jump-navigation.ts b/src/renderer/src/lib/worktree-jump-navigation.ts
index bfc0d6dd936..38721b3337b 100644
--- a/src/renderer/src/lib/worktree-jump-navigation.ts
+++ b/src/renderer/src/lib/worktree-jump-navigation.ts
@@ -60,6 +60,7 @@ export function jumpToWorktreeFromSidebar(
 
   // Why the workspace dispatcher: it owns the folder-vs-worktree split and the folder path-status gate.
   const activated = activateAndRevealWorkspace(worktreeId, {
+    navigationIntent: 'user-open',
     ...(hiddenBeforeActivation ? { revealInSidebar: false, clearSidebarFilters: false } : {}),
     ...(options?.executionHostId ? { executionHostId: options.executionHostId } : {})
   })
diff --git a/src/renderer/src/lib/worktree-live-terminal-surface-owners.test.ts b/src/renderer/src/lib/worktree-live-terminal-surface-owners.test.ts
index 033ff1da034..66db1463496 100644
--- a/src/renderer/src/lib/worktree-live-terminal-surface-owners.test.ts
+++ b/src/renderer/src/lib/worktree-live-terminal-surface-owners.test.ts
@@ -27,10 +27,12 @@ function summary(overrides: Partial<RuntimeTerminalSummary>): RuntimeTerminalSum
   }
 }
 
-function stubTerminalList(result: unknown): void {
+function stubTerminalList(result: unknown) {
+  const call = vi.fn(async () => ({ ok: true, result }))
   vi.stubGlobal('window', {
-    api: { runtime: { call: vi.fn(async () => ({ ok: true, result })) } }
+    api: { runtime: { call } }
   })
+  return call
 }
 
 afterEach(() => {
@@ -48,7 +50,7 @@ describe('live terminal surface owners', () => {
     })
   })
 
-  it('leaves an orphaned PTY absent so it stays eligible for a recovery tab', () => {
+  it('records explicit live orphan evidence for a recovery tab', () => {
     const ptyId = `${WORKTREE_ID}@@orphan`
     const owners = indexLiveTerminalSurfaceOwners(
       [
@@ -62,9 +64,43 @@ describe('live terminal surface owners', () => {
       WORKTREE_ID
     )
 
-    expect(owners.has(ptyId)).toBe(false)
+    expect(owners.get(ptyId)).toBe('unowned')
   })
 
+  it('does not authorize adoption of a disconnected orphan', () => {
+    const ptyId = `${WORKTREE_ID}@@orphan`
+    const owners = indexLiveTerminalSurfaceOwners(
+      [summary({ ptyId, orphaned: true, connected: false })],
+      WORKTREE_ID
+    )
+
+    expect(owners.get(ptyId)).toBeNull()
+  })
+
+  it('does not infer orphan ownership from a legacy synthetic surface', () => {
+    const ptyId = `${WORKTREE_ID}@@orphan`
+    const owners = indexLiveTerminalSurfaceOwners(
+      [summary({ ptyId, tabId: `pty:${ptyId}`, leafId: `pty:${ptyId}` })],
+      WORKTREE_ID
+    )
+
+    expect(owners.get(ptyId)).toBeNull()
+  })
+
+  it.each([false, true])(
+    'rejects conflicting owned and orphan rows (orphan first: %s)',
+    (orphanFirst) => {
+      const orphan = summary({ orphaned: true })
+      const owned = summary({})
+      const owners = indexLiveTerminalSurfaceOwners(
+        orphanFirst ? [orphan, owned, orphan] : [owned, orphan, owned],
+        WORKTREE_ID
+      )
+
+      expect(owners.get(owned.ptyId!)).toBeNull()
+    }
+  )
+
   it('ignores rows belonging to another workspace', () => {
     const owners = indexLiveTerminalSurfaceOwners(
       [summary({ worktreeId: 'repo::/other' })],
@@ -74,14 +110,13 @@ describe('live terminal surface owners', () => {
     expect(owners.size).toBe(0)
   })
 
-  // Dropping the host's row over path spelling would read as `unowned` and mint a duplicate.
   it('indexes a row the host spelled with an equivalent workspace path', () => {
     const owners = indexLiveTerminalSurfaceOwners(
       [summary({ worktreeId: `${WORKTREE_ID}/` })],
       WORKTREE_ID
     )
 
-    expect(owners.get(`${WORKTREE_ID}@@live-agent`)?.tabId).toBe('tab-live')
+    expect(owners.get(`${WORKTREE_ID}@@live-agent`)).toMatchObject({ tabId: 'tab-live' })
   })
 
   it('reports a PTY claimed by two panes as unverifiable rather than unowned', () => {
@@ -122,7 +157,7 @@ describe('live terminal surface owners', () => {
 
     const owners = await readWorktreeLiveTerminalSurfaceOwners(WORKTREE_ID)
 
-    expect(owners?.get(`${WORKTREE_ID}@@live-agent`)?.tabId).toBe('tab-live')
+    expect(owners?.get(`${WORKTREE_ID}@@live-agent`)).toMatchObject({ tabId: 'tab-live' })
   })
 
   it('refuses a census from a host that cannot name the scope it answered for', async () => {
@@ -142,7 +177,7 @@ describe('live terminal surface owners', () => {
   })
 
   it('indexes a complete census', async () => {
-    stubTerminalList({
+    const call = stubTerminalList({
       terminals: [summary({})],
       truncated: false,
       hostScope: { hostIds: ['local'], omittedHostIds: [] }
@@ -150,7 +185,16 @@ describe('live terminal surface owners', () => {
 
     const owners = await readWorktreeLiveTerminalSurfaceOwners(WORKTREE_ID)
 
-    expect(owners?.get(`${WORKTREE_ID}@@live-agent`)?.tabId).toBe('tab-live')
+    expect(owners?.get(`${WORKTREE_ID}@@live-agent`)).toMatchObject({ tabId: 'tab-live' })
+    expect(call).toHaveBeenCalledWith({
+      method: 'terminal.list',
+      params: {
+        worktree: `id:${WORKTREE_ID}`,
+        limit: 200,
+        requireFreshPtyLiveness: true,
+        includeVisualLayouts: false
+      }
+    })
   })
 
   it('refuses a census the host could not answer', async () => {
diff --git a/src/renderer/src/lib/worktree-live-terminal-surface-owners.ts b/src/renderer/src/lib/worktree-live-terminal-surface-owners.ts
index d42c8e5ad4f..34aa91438f8 100644
--- a/src/renderer/src/lib/worktree-live-terminal-surface-owners.ts
+++ b/src/renderer/src/lib/worktree-live-terminal-surface-owners.ts
@@ -20,12 +20,11 @@ export type LiveTerminalSurfaceOwner = {
  * client-created tab can leave empty, so they cannot answer "is this PTY
  * unowned?" — only the host can.
  *
- * Three verdicts, never two: an entry is the owner, a `null` entry is
- * `unverifiable` (the host named a surface this renderer cannot address, or
- * named two), and a whole-index `null` is `unverifiable` for every PTY. Absence
- * from a readable index is the only proof of `unowned`.
+ * Only `unowned` proves the host observed a live PTY with no surface. Null and
+ * missing entries are unverifiable; an earlier inventory may name a retired PTY.
  */
-export type LiveTerminalSurfaceOwnerIndex = ReadonlyMap<string, LiveTerminalSurfaceOwner | null>
+type LiveTerminalSurfaceOwnership = LiveTerminalSurfaceOwner | 'unowned' | null
+export type LiveTerminalSurfaceOwnerIndex = ReadonlyMap<string, LiveTerminalSurfaceOwnership>
 
 const OWNER_LISTING_LIMIT = 200
 
@@ -65,25 +64,25 @@ function toSurfaceOwner(terminal: RuntimeTerminalSummary): LiveTerminalSurfaceOw
 export function indexLiveTerminalSurfaceOwners(
   terminals: readonly RuntimeTerminalSummary[],
   worktreeId: string
-): Map<string, LiveTerminalSurfaceOwner | null> {
-  const owners = new Map<string, LiveTerminalSurfaceOwner | null>()
+): Map<string, LiveTerminalSurfaceOwnership> {
+  const owners = new Map<string, LiveTerminalSurfaceOwnership>()
   for (const terminal of terminals) {
-    // `orphaned` is the host's own word for "live PTY, no surface owns it".
-    // Path spelling can differ between the host's row and the renderer's id; dropping a row
-    // over that would read as `unowned` and mint the duplicate this index exists to prevent.
-    if (
-      !worktreeIdsEqual(terminal.worktreeId, worktreeId) ||
-      !terminal.ptyId ||
-      terminal.orphaned === true
-    ) {
+    if (!worktreeIdsEqual(terminal.worktreeId, worktreeId) || !terminal.ptyId) {
       continue
     }
-    const owner = toSurfaceOwner(terminal)
+    const owner =
+      terminal.orphaned === true
+        ? terminal.connected === true
+          ? 'unowned'
+          : null
+        : toSurfaceOwner(terminal)
     const recorded = owners.get(terminal.ptyId)
-    // Two surfaces claiming one PTY is the duplicate this index must not endorse.
+    const recordedPane = recorded && recorded !== 'unowned' ? recorded.paneKey : recorded
+    const ownerPane = owner && owner !== 'unowned' ? owner.paneKey : owner
+    // Conflicting ownership claims cannot authorize adoption.
     owners.set(
       terminal.ptyId,
-      owners.has(terminal.ptyId) && recorded?.paneKey !== owner?.paneKey ? null : owner
+      owners.has(terminal.ptyId) && recordedPane !== ownerPane ? null : owner
     )
   }
   return owners
@@ -104,6 +103,7 @@ export async function readWorktreeLiveTerminalSurfaceOwners(
     params: {
       worktree: toRuntimeWorktreeSelector(worktreeId),
       limit: OWNER_LISTING_LIMIT,
+      requireFreshPtyLiveness: true,
       includeVisualLayouts: false
     }
   })
diff --git a/src/renderer/src/lib/worktree-palette-create-action.test.ts b/src/renderer/src/lib/worktree-palette-create-action.test.ts
index 8f4667a043e..51d6cf6cba9 100644
--- a/src/renderer/src/lib/worktree-palette-create-action.test.ts
+++ b/src/renderer/src/lib/worktree-palette-create-action.test.ts
@@ -1,7 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import {
   CREATE_WORKTREE_ITEM_ID,
-  WORKTREE_PALETTE_SELECTION_MOVE_KEYS,
   createWorktreePaletteRequestGuard,
   getNextWorktreePaletteSelection,
   getWorktreePaletteSelectionItemIds,
@@ -263,19 +262,6 @@ describe('worktree-palette-create-action', () => {
     ).toBe(false)
   })
 
-  it('counts only navigation keys as a user selection move', () => {
-    expect([...WORKTREE_PALETTE_SELECTION_MOVE_KEYS].sort()).toEqual([
-      'ArrowDown',
-      'ArrowUp',
-      'End',
-      'Home',
-      'PageDown',
-      'PageUp'
-    ])
-    // Enter is the activation itself, so it must never count as the gesture that arms it.
-    expect(WORKTREE_PALETTE_SELECTION_MOVE_KEYS.has('Enter')).toBe(false)
-  })
-
   it('invalidates stale async create lookups', () => {
     const guard = createWorktreePaletteRequestGuard()
     const first = guard.start()
diff --git a/src/renderer/src/lib/worktree-palette-create-action.ts b/src/renderer/src/lib/worktree-palette-create-action.ts
index 392bcddc33f..8a79e74272b 100644
--- a/src/renderer/src/lib/worktree-palette-create-action.ts
+++ b/src/renderer/src/lib/worktree-palette-create-action.ts
@@ -41,15 +41,6 @@ export function isWorktreePaletteCreateActivationAllowed(args: {
   return args.hasTaskUrlIntent || args.hasCreateName || args.selectionMovedByUser
 }
 
-export const WORKTREE_PALETTE_SELECTION_MOVE_KEYS: ReadonlySet<string> = new Set([
-  'ArrowDown',
-  'ArrowUp',
-  'Home',
-  'End',
-  'PageDown',
-  'PageUp'
-])
-
 type WorktreePaletteSelectionCandidateEntry = {
   id: string
   type: string
diff --git a/src/renderer/src/lib/worktree-status-spinner-launch-agent.test.ts b/src/renderer/src/lib/worktree-status-spinner-launch-agent.test.ts
index 78b71ef25da..e964a9f28f1 100644
--- a/src/renderer/src/lib/worktree-status-spinner-launch-agent.test.ts
+++ b/src/renderer/src/lib/worktree-status-spinner-launch-agent.test.ts
@@ -55,18 +55,6 @@ describe('#9040 worktree dot attributes spinner titles to the launched agent', (
     expect(status).toBe('working')
   })
 
-  // Why: pins the #9647 gate — spinner attribution needs a launch identity, so a
-  // spinner in a tab no agent was launched in cannot spin the dot.
-  it('stays active for a spinner title with no launch identity', () => {
-    const status = getWorktreeStatus(
-      [{ id: 'tab-1', title: '⠐ Review branch for regressions' }],
-      [],
-      livePtyMap('tab-1')
-    )
-
-    expect(status).toBe('active')
-  })
-
   it('does not manufacture activity from a non-spinner title with a launch identity', () => {
     const status = getWorktreeStatus(
       [{ id: 'tab-1', title: 'bash', launchAgent: 'claude' }],
diff --git a/src/renderer/src/lib/worktree-status.interrupted.test.ts b/src/renderer/src/lib/worktree-status.interrupted.test.ts
index 76536ff8c7a..d44530c91e2 100644
--- a/src/renderer/src/lib/worktree-status.interrupted.test.ts
+++ b/src/renderer/src/lib/worktree-status.interrupted.test.ts
@@ -44,6 +44,38 @@ describe('resolveWorktreeStatus — interrupted (STA-5357)', () => {
     )
   })
 
+  it('reports a failure above live work and every outcome, below only a pending question', () => {
+    expect(resolveWorktreeStatus({ ...base, hasFailed: true })).toBe('failed')
+    expect(resolveWorktreeStatus({ ...base, hasFailed: true, hasInterrupted: true })).toBe('failed')
+    expect(resolveWorktreeStatus({ ...base, hasFailed: true, hasLiveDone: true })).toBe('failed')
+    expect(resolveWorktreeStatus({ ...base, hasFailed: true, hasLiveWorking: true })).toBe('failed')
+    expect(resolveWorktreeStatus({ ...base, hasFailed: true, hasLiveMonitoring: true })).toBe(
+      'failed'
+    )
+    expect(resolveWorktreeStatus({ ...base, hasFailed: true, hasPermission: true })).toBe(
+      'permission'
+    )
+  })
+
+  it('reports a departed agent failure below live work and above every outcome', () => {
+    expect(resolveWorktreeStatus({ ...base, hasRetainedFailed: true })).toBe('failed')
+    expect(resolveWorktreeStatus({ ...base, hasRetainedFailed: true, hasInterrupted: true })).toBe(
+      'failed'
+    )
+    expect(resolveWorktreeStatus({ ...base, hasRetainedFailed: true, hasRetainedDone: true })).toBe(
+      'failed'
+    )
+    expect(resolveWorktreeStatus({ ...base, hasRetainedFailed: true, hasLiveWorking: true })).toBe(
+      'working'
+    )
+    expect(
+      resolveWorktreeStatus({ ...base, hasRetainedFailed: true, hasLiveMonitoring: true })
+    ).toBe('monitoring')
+    expect(resolveWorktreeStatus({ ...base, hasRetainedFailed: true, hasPermission: true })).toBe(
+      'permission'
+    )
+  })
+
   it('leaves every other combination alone', () => {
     expect(resolveWorktreeStatus({ ...base, hasLiveDone: true })).toBe('done')
     expect(resolveWorktreeStatus({ ...base, hasLiveWorking: true })).toBe('working')
diff --git a/src/renderer/src/lib/worktree-status.ts b/src/renderer/src/lib/worktree-status.ts
index cbd6c3c82f3..eecff15da07 100644
--- a/src/renderer/src/lib/worktree-status.ts
+++ b/src/renderer/src/lib/worktree-status.ts
@@ -17,6 +17,7 @@ export type WorktreeStatus =
   | 'working'
   | 'monitoring'
   | 'permission'
+  | 'failed'
   | 'interrupted'
   | 'done'
   | 'inactive'
@@ -35,6 +36,7 @@ const STATUS_LABELS: Record<WorktreeStatus, string> = {
   working: 'Working',
   monitoring: 'Monitoring background tasks',
   permission: 'Needs permission',
+  failed: 'Failed',
   interrupted: 'Interrupted',
   done: 'Done',
   inactive: 'Inactive'
@@ -167,7 +169,7 @@ export function getWorktreeStatusLabel(status: WorktreeStatus): string {
  *
  * Map args are narrowed to this worktree. `hasPermission`/`hasLiveWorking`/
  * `hasLiveDone` are fresh hook entries ({blocked,waiting} / {working} / {done});
- * `hasRetainedDone` is a retained-agent snapshot scoped to this worktreeId.
+ * `hasRetainedDone`/`hasRetainedFailed` are retained-agent snapshots scoped to this worktreeId.
  */
 export function resolveWorktreeStatus(args: {
   tabs: readonly Pick<TerminalTab, 'id' | 'title' | 'launchAgent'>[]
@@ -181,9 +183,11 @@ export function resolveWorktreeStatus(args: {
   hasPermission: boolean
   hasLiveWorking: boolean
   hasLiveMonitoring?: boolean
+  hasFailed?: boolean
   hasInterrupted?: boolean
   hasLiveDone: boolean
   hasRetainedDone: boolean
+  hasRetainedFailed?: boolean
 }): WorktreeStatus {
   const heuristic = getWorktreeStatus(
     args.tabs,
@@ -204,6 +208,11 @@ export function resolveWorktreeStatus(args: {
   if (heuristic === 'permission') {
     return 'permission'
   }
+  // Why: a failure is news, so it outranks live work (a failed main agent's subagents may still
+  // run); only a pending question comes first.
+  if (args.hasFailed) {
+    return 'failed'
+  }
   // Why: restored cards get the hook snapshot before panes mount; trust the explicit working row so they stay yellow on restart.
   if (args.hasLiveWorking || heuristic === 'working') {
     return 'working'
@@ -211,7 +220,11 @@ export function resolveWorktreeStatus(args: {
   if (args.hasLiveMonitoring || heuristic === 'monitoring') {
     return 'monitoring'
   }
-  // Terminal outcomes follow live states, but an interrupted outcome must not collapse into success.
+  // Why: a departed agent's failure has no expiry, so it must not pin the card over live work.
+  if (args.hasRetainedFailed) {
+    return 'failed'
+  }
+  // A stop follows live states, but must not collapse into success.
   if (args.hasInterrupted) {
     return 'interrupted'
   }
diff --git a/src/renderer/src/runtime/agent-resume-host-authority-capability.test.ts b/src/renderer/src/runtime/agent-resume-host-authority-capability.test.ts
index f25aa9868a9..e5b6d8327ae 100644
--- a/src/renderer/src/runtime/agent-resume-host-authority-capability.test.ts
+++ b/src/renderer/src/runtime/agent-resume-host-authority-capability.test.ts
@@ -1,6 +1,9 @@
 import { describe, expect, it } from 'vitest'
 import { RESUMABLE_TUI_AGENTS } from '../../../shared/agent-session-resume'
 import {
+  AGENT_SESSION_QODER_RESUME_RUNTIME_CAPABILITY,
+  AGENT_SESSION_CODEBUDDY_RESUME_RUNTIME_CAPABILITY,
+  AGENT_SESSION_DSH_RESUME_RUNTIME_CAPABILITY,
   AGENT_SESSION_KIMI_RESUME_RUNTIME_CAPABILITY,
   AGENT_SESSION_MUSE_RESUME_RUNTIME_CAPABILITY,
   AGENT_SESSION_OPENCODE2_RESUME_RUNTIME_CAPABILITY,
@@ -54,7 +57,9 @@ describe('agentResumeHostAuthorityCapability', () => {
       )
     ).toEqual({
       claude: undefined,
+      codebuddy: AGENT_SESSION_CODEBUDDY_RESUME_RUNTIME_CAPABILITY,
       codex: undefined,
+      qoder: AGENT_SESSION_QODER_RESUME_RUNTIME_CAPABILITY,
       gemini: undefined,
       antigravity: undefined,
       opencode: undefined,
@@ -69,7 +74,8 @@ describe('agentResumeHostAuthorityCapability', () => {
       copilot: undefined,
       muse: AGENT_SESSION_MUSE_RESUME_RUNTIME_CAPABILITY,
       omp: AGENT_SESSION_OMP_RESUME_PATH_RUNTIME_CAPABILITY,
-      kimi: AGENT_SESSION_KIMI_RESUME_RUNTIME_CAPABILITY
+      kimi: AGENT_SESSION_KIMI_RESUME_RUNTIME_CAPABILITY,
+      dsh: AGENT_SESSION_DSH_RESUME_RUNTIME_CAPABILITY
     })
   })
 })
diff --git a/src/renderer/src/runtime/agent-resume-host-authority-capability.ts b/src/renderer/src/runtime/agent-resume-host-authority-capability.ts
index ddc59b5ae98..a5cefe6a74c 100644
--- a/src/renderer/src/runtime/agent-resume-host-authority-capability.ts
+++ b/src/renderer/src/runtime/agent-resume-host-authority-capability.ts
@@ -2,6 +2,9 @@ import type { ResumableTuiAgent } from '../../../shared/agent-session-resume'
 import type { TuiAgent } from '../../../shared/tui-agent'
 import {
   AGENT_SESSION_KIMI_RESUME_RUNTIME_CAPABILITY,
+  AGENT_SESSION_QODER_RESUME_RUNTIME_CAPABILITY,
+  AGENT_SESSION_CODEBUDDY_RESUME_RUNTIME_CAPABILITY,
+  AGENT_SESSION_DSH_RESUME_RUNTIME_CAPABILITY,
   AGENT_SESSION_MUSE_RESUME_RUNTIME_CAPABILITY,
   AGENT_SESSION_ZCODE_RESUME_RUNTIME_CAPABILITY,
   AGENT_SESSION_OPENCODE2_RESUME_RUNTIME_CAPABILITY,
@@ -18,7 +21,9 @@ import {
 const RESUME_HOST_AUTHORITY_CAPABILITY_BY_AGENT = {
   // These shipped inside agent-session.host-authority.v1's enum, so the generic probe covers them.
   claude: undefined,
+  codebuddy: AGENT_SESSION_CODEBUDDY_RESUME_RUNTIME_CAPABILITY,
   codex: undefined,
+  qoder: AGENT_SESSION_QODER_RESUME_RUNTIME_CAPABILITY,
   gemini: undefined,
   antigravity: undefined,
   opencode: undefined,
@@ -36,7 +41,8 @@ const RESUME_HOST_AUTHORITY_CAPABILITY_BY_AGENT = {
   muse: AGENT_SESSION_MUSE_RESUME_RUNTIME_CAPABILITY,
   zcode: AGENT_SESSION_ZCODE_RESUME_RUNTIME_CAPABILITY,
   omp: AGENT_SESSION_OMP_RESUME_PATH_RUNTIME_CAPABILITY,
-  kimi: AGENT_SESSION_KIMI_RESUME_RUNTIME_CAPABILITY
+  kimi: AGENT_SESSION_KIMI_RESUME_RUNTIME_CAPABILITY,
+  dsh: AGENT_SESSION_DSH_RESUME_RUNTIME_CAPABILITY
 } satisfies Record<ResumableTuiAgent, RuntimeCapability | undefined>
 
 export function agentResumeHostAuthorityCapability(
diff --git a/src/renderer/src/runtime/browser-workspace-tab-close-census.test.ts b/src/renderer/src/runtime/browser-workspace-tab-close-census.test.ts
deleted file mode 100644
index 212e9d7afe7..00000000000
--- a/src/renderer/src/runtime/browser-workspace-tab-close-census.test.ts
+++ /dev/null
@@ -1,197 +0,0 @@
-import { readdirSync, readFileSync } from 'node:fs'
-import { join, relative, sep } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-// Why: who tears a browser workspace down is a policy, and every close site that decides it alone
-// gets it wrong in a different way — the ambiguous multi-owner close fell through silently, the
-// pageless host mirror was un-closable, and the menu's Close Tab fired at a host that had never
-// heard of a staged tab. Testing planBrowserWorkspaceTabClose in isolation cannot catch the next
-// site that skips it, so this census pins every renderer file that closes a browser workspace:
-// how often it reaches for the store action, and whether it asks the shared plan first. Adding a
-// close anywhere fails this test until it is classified here.
-const BROWSER_WORKSPACE_CLOSE_SITES: {
-  path: string
-  /**
-   * Every mention of the identifier, not just call expressions: a renamed destructure or a
-   * `store['closeBrowserTab']` lookup is still a close site, and matching `closeBrowserTab(`
-   * walks straight past both.
-   */
-  closeBrowserTabMentions: number
-  /** How many local teardowns forward the plan's cleanup reason; 0 for sites that skip the plan. */
-  planReasonForwardings: number
-  /** How many closeBrowserTab calls actually pass that reason on; 0 for sites that skip the plan. */
-  reasonCarryingCloseCalls: number
-  routesThroughPlan: boolean
-  why: string
-}[] = [
-  {
-    path: 'src/renderer/src/components/browser-pane/stream-remote/use-remote-browser-page-lifecycle.ts',
-    closeBrowserTabMentions: 4,
-    reasonCarryingCloseCalls: 0,
-    planReasonForwardings: 0,
-    routesThroughPlan: false,
-    why: 'Mirrors a page the host already retired; a plan-driven close would echo it back.'
-  },
-  {
-    path: 'src/renderer/src/components/floating-terminal/use-floating-terminal-close-actions.ts',
-    closeBrowserTabMentions: 6,
-    reasonCarryingCloseCalls: 0,
-    planReasonForwardings: 0,
-    routesThroughPlan: false,
-    why: 'Floating workspace tabs are local-only and have no remote owner to reconcile.'
-  },
-  {
-    path: 'src/renderer/src/components/floating-terminal/use-floating-terminal-panel-store-state.ts',
-    closeBrowserTabMentions: 3,
-    reasonCarryingCloseCalls: 0,
-    planReasonForwardings: 0,
-    routesThroughPlan: false,
-    why: 'Passes the local floating-panel close action through its controller.'
-  },
-  {
-    path: 'src/renderer/src/components/use-terminal-bulk-close-actions.ts',
-    closeBrowserTabMentions: 3,
-    reasonCarryingCloseCalls: 1,
-    planReasonForwardings: 1,
-    routesThroughPlan: true,
-    why: 'Bulk terminal-tab teardown plans browser ownership before local cleanup.'
-  },
-  {
-    path: 'src/renderer/src/components/use-terminal-workspace-store-bindings.ts',
-    closeBrowserTabMentions: 3,
-    reasonCarryingCloseCalls: 0,
-    planReasonForwardings: 0,
-    routesThroughPlan: false,
-    why: 'Store binding exposes the close action to terminal controllers.'
-  },
-  {
-    path: 'src/renderer/src/hooks/ipc-events/browser-request-ipc-bridge.ts',
-    closeBrowserTabMentions: 3,
-    reasonCarryingCloseCalls: 0,
-    planReasonForwardings: 0,
-    routesThroughPlan: false,
-    why: 'Host-requested closes are applied locally without echoing a close request.'
-  },
-  {
-    path: 'src/renderer/src/hooks/ipc-events/session-tab-ipc-bridge.ts',
-    closeBrowserTabMentions: 2,
-    reasonCarryingCloseCalls: 0,
-    planReasonForwardings: 0,
-    routesThroughPlan: false,
-    why: 'Host session-tab requests are applied locally without echo.'
-  },
-  {
-    path: 'src/renderer/src/lib/workspace-browser-tab-close.ts',
-    closeBrowserTabMentions: 2,
-    reasonCarryingCloseCalls: 1,
-    planReasonForwardings: 1,
-    routesThroughPlan: true,
-    why: 'All workspace browser teardown funnels through the ownership plan before local cleanup.'
-  },
-  {
-    path: 'src/renderer/src/runtime/browser-workspace-tab-close.ts',
-    closeBrowserTabMentions: 1,
-    reasonCarryingCloseCalls: 0,
-    planReasonForwardings: 0,
-    routesThroughPlan: true,
-    why: 'The funnel disavowal fallback completes teardown when every owning host denies the tab.'
-  },
-  {
-    path: 'src/renderer/src/runtime/web-runtime-browser-tab-staging.ts',
-    closeBrowserTabMentions: 1,
-    reasonCarryingCloseCalls: 0,
-    planReasonForwardings: 0,
-    routesThroughPlan: false,
-    why: 'Rolls back a client-staged row for a create that never reached a host page.'
-  },
-  {
-    path: 'src/renderer/src/store/slices/browser/browser-close-actions.ts',
-    closeBrowserTabMentions: 3,
-    reasonCarryingCloseCalls: 0,
-    planReasonForwardings: 0,
-    routesThroughPlan: false,
-    why: 'Slice-owned shutdown tears down every browser row directly.'
-  },
-  {
-    path: 'src/renderer/src/store/slices/browser/browser-slice-contract.ts',
-    closeBrowserTabMentions: 1,
-    reasonCarryingCloseCalls: 0,
-    planReasonForwardings: 0,
-    routesThroughPlan: false,
-    why: 'The extracted slice contract declares the close action consumed by browser controllers.'
-  }
-]
-
-function listSourceFiles(dir: string): string[] {
-  return readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
-    const fullPath = join(dir, entry.name)
-    if (entry.isDirectory()) {
-      return listSourceFiles(fullPath)
-    }
-    // Test harnesses and fixtures stub the store action rather than closing anything.
-    if (
-      !/\.(ts|tsx)$/.test(entry.name) ||
-      /\.test\.(ts|tsx)$/.test(entry.name) ||
-      /-test-(harness|fixtures)\.(ts|tsx)$/.test(entry.name)
-    ) {
-      return []
-    }
-    return [fullPath]
-  })
-}
-
-// Why: comments are stripped first, so commenting a close call out in place must fail the census
-// rather than quietly shrink the count.
-function stripComments(source: string): string {
-  return source.replace(/\/\*[\s\S]*?\*\//g, '').replace(/(^|[^:])\/\/.*$/gm, '$1')
-}
-
-function countCloseBrowserTabMentions(source: string): number {
-  return stripComments(source).match(/\bcloseBrowserTab\b/g)?.length ?? 0
-}
-
-describe('browser workspace close census', () => {
-  it.each(BROWSER_WORKSPACE_CLOSE_SITES)(
-    '$path mentions closeBrowserTab $closeBrowserTabMentions times, plan-routed: $routesThroughPlan',
-    ({ path, closeBrowserTabMentions, routesThroughPlan }) => {
-      const source = stripComments(readFileSync(join(process.cwd(), path), 'utf8'))
-      expect(countCloseBrowserTabMentions(source)).toBe(closeBrowserTabMentions)
-      expect(/\bcloseBrowserWorkspaceTabOnHosts\(/.test(source)).toBe(routesThroughPlan)
-    }
-  )
-
-  it('lists every renderer file that closes a browser workspace', () => {
-    const root = join(process.cwd(), 'src/renderer')
-    const closers = listSourceFiles(root)
-      .filter((filePath) => countCloseBrowserTabMentions(readFileSync(filePath, 'utf8')) > 0)
-      .map((filePath) => relative(process.cwd(), filePath).split(sep).join('/'))
-      .sort()
-    expect(closers).toEqual(BROWSER_WORKSPACE_CLOSE_SITES.map((site) => site.path).sort())
-  })
-
-  // Why: the plan is only an authority if its consumers actually run its local teardown. A site
-  // that reads the plan and then closes on its own terms is the same divergence with extra steps.
-  // Bound to the forwarding expression itself — merely mentioning localCloseReason is not wiring,
-  // and Terminal.tsx's two sites have no behavior test to catch it going missing.
-  it('every plan-routed site forwards the plan cleanup reason into its local teardown', () => {
-    const forwardsReason =
-      /plan\.localCloseReason\s*\?\s*\{\s*reason:\s*plan\.localCloseReason\s*\}\s*:\s*undefined/g
-    // Why: the expression existing somewhere in the file is not the wiring — a call that drops it on
-    // the floor reads identically. Both halves are pinned: the reason is computed, and the close
-    // calls carry it.
-    const carriesReason =
-      /closeBrowserTab\(\s*[^()]*?(?:[Cc]loseOptions|plan\.localCloseReason)[^()]*?\)/g
-    for (const site of BROWSER_WORKSPACE_CLOSE_SITES) {
-      const source = stripComments(readFileSync(join(process.cwd(), site.path), 'utf8'))
-      expect({
-        path: site.path,
-        forwards: source.match(forwardsReason)?.length ?? 0,
-        carrying: source.match(carriesReason)?.length ?? 0
-      }).toEqual({
-        path: site.path,
-        forwards: site.planReasonForwardings,
-        carrying: site.reasonCarryingCloseCalls
-      })
-    }
-  })
-})
diff --git a/src/renderer/src/runtime/focus-runtime-terminal-surface-chat-view.test.ts b/src/renderer/src/runtime/focus-runtime-terminal-surface-chat-view.test.ts
index 39683bf2791..a2eff98b6c6 100644
--- a/src/renderer/src/runtime/focus-runtime-terminal-surface-chat-view.test.ts
+++ b/src/renderer/src/runtime/focus-runtime-terminal-surface-chat-view.test.ts
@@ -66,13 +66,15 @@ function registerChatViewTab(covered: boolean): {
   focus: ReturnType<typeof vi.fn>
   setActivePane: ReturnType<typeof vi.fn>
 } {
-  const focus = vi.fn()
+  const textarea = document.createElement('textarea')
+  document.body.append(textarea)
+  const focus = vi.fn(() => textarea.focus())
   const setActivePane = vi.fn()
   const pane = {
     id: PANE_ID,
     leafId: LEAF_ID,
     container: makePaneContainer(covered),
-    terminal: { focus }
+    terminal: { focus, textarea }
   }
   const manager = {
     getPanes: () => [pane],
@@ -99,6 +101,7 @@ function registerChatViewTab(covered: boolean): {
 // under the chat portal, so focusing it drags the caret out of the composer (#9939 twin).
 describe('focusRuntimeTerminalSurface on a chat-view pane', () => {
   afterEach(() => {
+    document.body.replaceChildren()
     while (unregisterCallbacks.length > 0) {
       unregisterCallbacks.pop()?.()
     }
diff --git a/src/renderer/src/runtime/focus-runtime-terminal-surface-readiness.test.ts b/src/renderer/src/runtime/focus-runtime-terminal-surface-readiness.test.ts
new file mode 100644
index 00000000000..6430ea97c1e
--- /dev/null
+++ b/src/renderer/src/runtime/focus-runtime-terminal-surface-readiness.test.ts
@@ -0,0 +1,57 @@
+// @vitest-environment happy-dom
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { PaneManager } from '@/lib/pane-manager/pane-manager'
+import { focusRuntimeTerminalSurface, registerRuntimeTerminalTab } from './sync-runtime-graph'
+
+let unregister: (() => void) | undefined
+
+afterEach(() => {
+  unregister?.()
+  document.body.replaceChildren()
+})
+
+describe('terminal focus readiness', () => {
+  function register(hasPane: boolean, hasTextarea = true) {
+    const textarea = document.createElement('textarea')
+    const pane = {
+      id: 1,
+      container: document.createElement('div'),
+      terminal: {
+        textarea: hasTextarea ? textarea : undefined,
+        focus: vi.fn(() => textarea.focus())
+      }
+    }
+    const manager = {
+      getActivePane: () => (hasPane ? pane : undefined),
+      getPanes: () => (hasPane ? [pane] : [])
+    }
+    unregister = registerRuntimeTerminalTab({
+      tabId: 'restoring-tab',
+      worktreeId: 'restoring-workspace',
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Focus reads only getActivePane/getPanes and the pane's container/terminal.
+      getManager: () => manager as unknown as PaneManager,
+      getContainer: () => null,
+      getPtyIdForPane: () => null,
+      getTabWideAgentHintLeafId: () => null
+    })
+    return textarea
+  }
+
+  it('does not report success before the active pane exists', () => {
+    register(false)
+    expect(focusRuntimeTerminalSurface('restoring-tab', null, 'restoring-workspace')).toBe(false)
+  })
+
+  it('does not report success before the terminal textarea exists', () => {
+    register(true, false)
+    expect(focusRuntimeTerminalSurface('restoring-tab', null, 'restoring-workspace')).toBe(false)
+  })
+
+  it('does not consume focus until the terminal can receive it', () => {
+    const textarea = register(true)
+    expect(focusRuntimeTerminalSurface('restoring-tab', null, 'restoring-workspace')).toBe(false)
+    document.body.append(textarea)
+    expect(focusRuntimeTerminalSurface('restoring-tab', null, 'restoring-workspace')).toBe(true)
+    expect(document.activeElement).toBe(textarea)
+  })
+})
diff --git a/src/renderer/src/runtime/host-session-mirror-settle-census.test.ts b/src/renderer/src/runtime/host-session-mirror-settle-census.test.ts
deleted file mode 100644
index 7d6a0eadc3e..00000000000
--- a/src/renderer/src/runtime/host-session-mirror-settle-census.test.ts
+++ /dev/null
@@ -1,256 +0,0 @@
-/**
- * Registry test for the host-session-mirror settle seam. Four review rounds
- * each found a NEW call site settling the latch out of order with its store
- * patch, so the seam is enforced structurally: a settle exists only as the
- * receipt of a landed patch (or as the audited stale-frame exception), and a
- * new patch or settle site fails this census until it adopts that contract.
- */
-
-import { readdirSync, readFileSync, statSync } from 'node:fs'
-import { join, relative, sep } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-const RENDERER_SRC = join(import.meta.dirname, '..')
-
-const SETTLE_RULE = [
-  'The mirror latch settles EXACTLY when evidence reached the store.',
-  'applyWebSessionTabsStorePatch returns the settle receipt for its own patch:',
-  'capture it and invoke it after the frame finishes recovery. A frame whose',
-  'patch wrote nothing settles through hostSessionMirrorSettleForPatchlessFrame,',
-  'and ONLY on a decision carrying settlesHostMirror — a rejection backed by the',
-  'equal/newer view already accepted into the store. Never derive that from a',
-  'bare boolean: "the mirror never writes this workspace" is also a rejection,',
-  'and settling on it drains parked resume work against state nobody wrote.',
-  'A captured receipt that is never invoked wedges its pane instead, so every',
-  'receipt has to reach a call. Never call markHostSessionMirror*Hydrated from',
-  'feature code, and never add a boolean that remembers "the patch landed" —',
-  'that ordering bug shipped four times. If you added a legitimate new site,',
-  'update this census deliberately.'
-].join(' ')
-
-/** Receipt-minting calls. Every one owes its caller an invocation. */
-const RECEIPT_CALLS = [
-  'applyWebSessionTabsStorePatch(',
-  'hostSessionMirrorSettleForPatchlessFrame('
-] as const
-
-/**
- * The binding a receipt was captured into, read backwards from the call.
- * TypeScript cannot express a must-call obligation and the invocation is
- * deliberately deferred to after `finishRecovery`, so this stays textual:
- * an unrecognised capture shape fails rather than passing unaudited.
- */
-function receiptBindingName(before: string): string | null {
-  const lines = before.split('\n')
-  for (let line = lines.length - 1; line >= 0 && line > lines.length - 8; line -= 1) {
-    const match = /\b(?:const|let|var)?\s*([A-Za-z_$][\w$]*)\s*(?::[^=]*?)?=(?![=>])/.exec(
-      lines[line]!
-    )
-    if (match) {
-      return match[1]!
-    }
-  }
-  return null
-}
-
-function productionSources(): { path: string; source: string }[] {
-  const sources: { path: string; source: string }[] = []
-  const walk = (dir: string): void => {
-    for (const entry of readdirSync(dir)) {
-      const path = join(dir, entry)
-      if (statSync(path).isDirectory()) {
-        walk(path)
-        continue
-      }
-      if (!/\.(ts|tsx)$/.test(entry) || /\.test\.|\.d\.ts$/.test(entry)) {
-        continue
-      }
-      sources.push({
-        path: relative(RENDERER_SRC, path).split(sep).join('/'),
-        source: readFileSync(path, 'utf8')
-      })
-    }
-  }
-  walk(RENDERER_SRC)
-  return sources
-}
-
-function countOccurrences(source: string, needle: string): number {
-  let count = 0
-  for (
-    let index = source.indexOf(needle);
-    index !== -1;
-    index = source.indexOf(needle, index + 1)
-  ) {
-    count += 1
-  }
-  return count
-}
-
-describe('host-session-mirror settle census', () => {
-  const sources = productionSources()
-
-  it('mirror marks are reachable only through the settle receipts', () => {
-    const markCounts: Record<string, { hydrated: number; worktreeHydrated: number }> = {}
-    for (const { path, source } of sources) {
-      const hydrated = countOccurrences(source, 'markHostSessionMirrorHydrated(')
-      const worktreeHydrated = countOccurrences(source, 'markHostSessionMirrorWorktreeHydrated(')
-      if (hydrated + worktreeHydrated > 0) {
-        markCounts[path] = { hydrated, worktreeHydrated }
-      }
-    }
-    expect(markCounts, SETTLE_RULE).toEqual({
-      // The definitions themselves.
-      'runtime/host-session-mirror-hydration.ts': { hydrated: 1, worktreeHydrated: 1 },
-      // Exactly the receipt constructors: the patch receipt (environment-wide
-      // and per-worktree) and the stale-frame receipt. The environment-wide
-      // mark has three audited arms, all inside the receipt: an authoritative
-      // empty inventory, a non-empty inventory, and an empty inventory that
-      // settles only after `terminal.list` says the host has no live PTY —
-      // `0 === 0` is not host evidence (STA-5377).
-      'runtime/web-session-tabs-sync/mirror-settle.ts': { hydrated: 3, worktreeHydrated: 2 }
-    })
-  })
-
-  it('every store patch call site captures its settle receipt', () => {
-    const needle = 'applyWebSessionTabsStorePatch('
-    const callSites: Record<string, number> = {}
-    for (const { path, source } of sources) {
-      let calls = 0
-      for (
-        let index = source.indexOf(needle);
-        index !== -1;
-        index = source.indexOf(needle, index + 1)
-      ) {
-        const before = source.slice(0, index).trimEnd()
-        if (before.endsWith('function')) {
-          continue // The definition.
-        }
-        calls += 1
-        // A receipt is captured when the call is an expression consumed by an
-        // assignment, return, ternary, or argument — never a bare statement.
-        const capturedBy = before.slice(-1)
-        expect(
-          ['=', '(', ',', '?', ':', '{'].includes(capturedBy) || before.endsWith('return'),
-          `${path} discards the settle receipt of applyWebSessionTabsStorePatch. ${SETTLE_RULE}`
-        ).toBe(true)
-      }
-      if (calls > 0) {
-        callSites[path] = calls
-      }
-    }
-    expect(callSites, SETTLE_RULE).toEqual({
-      // Initial listAll, visibility-resume repair, full inventory, global
-      // singular frame, and scoped active frame are owned by these extracted
-      // recovery/event modules.
-      'runtime/web-session-tabs-sync/active-session-subscription.ts': 1,
-      'runtime/web-session-tabs-sync/global-session-events.ts': 1,
-      'runtime/web-session-tabs-sync/global-session-inventory-event.ts': 1,
-      'runtime/web-session-tabs-sync/load-initial.ts': 1,
-      'runtime/web-session-tabs-sync/visibility-resume-repair.ts': 1,
-      // The eager post-create session.tabs.list refresh.
-      'runtime/web-runtime-session-snapshot.ts': 1,
-      // The local structured-session mirror owns two: the inventory/subscription
-      // frame, and the toggle-off teardown that retracts the tabs it published.
-      'runtime/local-structured-session-tabs-sync/snapshot-apply.ts': 2
-    })
-  })
-
-  it('every captured settle receipt reaches an invocation', () => {
-    const receiptBindings: Record<string, Record<string, number>> = {}
-    for (const { path, source } of sources) {
-      for (const needle of RECEIPT_CALLS) {
-        for (
-          let index = source.indexOf(needle);
-          index !== -1;
-          index = source.indexOf(needle, index + 1)
-        ) {
-          const before = source.slice(0, index).trimEnd()
-          if (before.endsWith('function')) {
-            continue // The definition.
-          }
-          const name = receiptBindingName(before)
-          expect(
-            name,
-            `${path} captures a settle receipt in a shape this census cannot follow. ${SETTLE_RULE}`
-          ).not.toBeNull()
-          // The obligation is discharged by the next call of the same binding —
-          // a fresh declaration of that name in between means the call belongs
-          // to another receipt, so this one was dropped.
-          const rest = source.slice(index + needle.length)
-          const invocation = new RegExp(`\\b${name}\\s*(?:\\?\\.)?\\(`).exec(rest)
-          const redeclared =
-            invocation !== null &&
-            new RegExp(`\\b(?:let|const|var)\\s+${name}\\b`).test(rest.slice(0, invocation.index))
-          expect(
-            invocation !== null && !redeclared,
-            `${path} never invokes the settle receipt it captured into \`${name}\`. ${SETTLE_RULE}`
-          ).toBe(true)
-          const bindings = (receiptBindings[path] ??= {})
-          bindings[name!] = (bindings[name!] ?? 0) + 1
-        }
-      }
-    }
-    // Pinning the resolved names keeps the rule from going vacuous: a binding
-    // this census misreads settles on some other identifier's invocation.
-    expect(receiptBindings, SETTLE_RULE).toEqual({
-      // Hydration and mirror receipts remain pinned by their extracted owners:
-      // the global singular frame owns two hydration completions and the global
-      // inventory frame one, initial loading owns one, active subscription owns
-      // two mirror settles, and visibility resume repair owns one. The local
-      // structured-session apply module owns one settle per direction: the
-      // snapshot it mirrors in, and the teardown that retracts it.
-      'runtime/web-session-tabs-sync/active-session-subscription.ts': { settle: 2 },
-      'runtime/web-session-tabs-sync/global-session-events.ts': { settleHydration: 2 },
-      'runtime/web-session-tabs-sync/global-session-inventory-event.ts': { settleHydration: 1 },
-      'runtime/web-session-tabs-sync/load-initial.ts': { settleHydration: 1 },
-      'runtime/web-session-tabs-sync/visibility-resume-repair.ts': { settle: 1 },
-      'runtime/web-runtime-session-snapshot.ts': { settleMirror: 1 },
-      'runtime/local-structured-session-tabs-sync/snapshot-apply.ts': {
-        settleStructuredSessionClear: 1,
-        settleStructuredSessionMirror: 1
-      }
-    })
-  })
-
-  it('the patchless settle appears only at its audited sites', () => {
-    const patchlessCounts: Record<string, number> = {}
-    for (const { path, source } of sources) {
-      const count = countOccurrences(source, 'hostSessionMirrorSettleForPatchlessFrame(')
-      if (count > 0) {
-        patchlessCounts[path] = count
-      }
-    }
-    expect(patchlessCounts, SETTLE_RULE).toEqual({
-      // The definition, the global singular frame, and the scoped active frame.
-      'runtime/web-session-tabs-sync/active-session-subscription.ts': 1,
-      'runtime/web-session-tabs-sync/global-session-events.ts': 1,
-      'runtime/web-session-tabs-sync/mirror-settle.ts': 1
-    })
-  })
-
-  it('only the audited decisions grant a rejected frame a settle', () => {
-    const settlingCounts: Record<string, number> = {}
-    const silentCounts: Record<string, number> = {}
-    for (const { path, source } of sources) {
-      const settling = countOccurrences(source, 'settlesHostMirror: true')
-      const silent = countOccurrences(source, 'settlesHostMirror: false')
-      if (settling > 0) {
-        settlingCounts[path] = settling
-      }
-      if (silent > 0) {
-        silentCounts[path] = silent
-      }
-    }
-    // A new decision has to be minted here, and minting one forces its author
-    // to say whether the frame is host evidence — the whole point of the pair.
-    expect(settlingCounts, SETTLE_RULE).toEqual({
-      // The applied frame (its own patch) and the outranked one (the accepted view).
-      'runtime/web-session-tabs-sync/tracking-decisions.ts': 2
-    })
-    expect(silentCounts, SETTLE_RULE).toEqual({
-      // The unmirrored frame: no accepted view of it ever reached the store.
-      'runtime/web-session-tabs-sync/tracking-decisions.ts': 1
-    })
-  })
-})
diff --git a/src/renderer/src/runtime/mobile-markdown-bridge.test.ts b/src/renderer/src/runtime/mobile-markdown-bridge.test.ts
index 2e5abd834e4..e039cc515eb 100644
--- a/src/renderer/src/runtime/mobile-markdown-bridge.test.ts
+++ b/src/renderer/src/runtime/mobile-markdown-bridge.test.ts
@@ -1,7 +1,8 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   hashMarkdownContent,
-  MOBILE_MARKDOWN_EDIT_MAX_BYTES
+  MOBILE_MARKDOWN_EDIT_MAX_BYTES,
+  MOBILE_MARKDOWN_READ_MAX_BYTES
 } from '../../../shared/mobile-markdown-document'
 import { attachEditorAutosaveController } from '../components/editor/editor-autosave-controller'
 import { registerPendingEditorFlush } from '../components/editor/editor-pending-flush'
@@ -157,4 +158,69 @@ describe('mobile markdown bridge', () => {
       detach()
     }
   })
+
+  it('reads a markdown file between the edit and read budgets whole, as read-only', async () => {
+    openMarkdownFile()
+    const content = 'a'.repeat(632 * 1024)
+    setupWindow({ readFile: vi.fn().mockResolvedValue({ content, isBinary: false }) })
+    const detach = attachMobileMarkdownBridge()
+
+    try {
+      const response = await sendRequest({
+        id: 'read-632k',
+        operation: 'read',
+        worktreeId: 'wt-1',
+        tabId: 'tab-md'
+      })
+
+      expect(response).toMatchObject({
+        ok: true,
+        result: { content, editable: false, readOnlyReason: 'file_too_large' }
+      })
+      expect(response).not.toHaveProperty('result.truncated')
+    } finally {
+      detach()
+    }
+  })
+
+  it('truncates a markdown file over the read budget on a UTF-8 boundary', async () => {
+    openMarkdownFile()
+    // The 3-byte euro sign straddles the budget, so the cut must drop it whole.
+    const prefix = 'a'.repeat(MOBILE_MARKDOWN_READ_MAX_BYTES - 1)
+    const content = `${prefix}\u20actail`
+    setupWindow({ readFile: vi.fn().mockResolvedValue({ content, isBinary: false }) })
+    const detach = attachMobileMarkdownBridge()
+
+    try {
+      const response = await sendRequest({
+        id: 'read-over-budget',
+        operation: 'read',
+        worktreeId: 'wt-1',
+        tabId: 'tab-md'
+      })
+
+      expect(response).toMatchObject({
+        ok: true,
+        result: {
+          editable: false,
+          readOnlyReason: 'file_too_large',
+          truncated: true,
+          byteLength: MOBILE_MARKDOWN_READ_MAX_BYTES - 1 + 3 + 4,
+          version: hashMarkdownContent(prefix)
+        }
+      })
+      expect(response).toHaveProperty('result.content', prefix)
+      const save = await sendRequest({
+        id: 'save-truncated',
+        operation: 'save',
+        worktreeId: 'wt-1',
+        tabId: 'tab-md',
+        baseVersion: hashMarkdownContent(prefix),
+        content: prefix
+      })
+      expect(save).toMatchObject({ ok: false, error: 'file_too_large' })
+    } finally {
+      detach()
+    }
+  })
 })
diff --git a/src/renderer/src/runtime/mobile-markdown-bridge.ts b/src/renderer/src/runtime/mobile-markdown-bridge.ts
index b605c014801..c51a7656843 100644
--- a/src/renderer/src/runtime/mobile-markdown-bridge.ts
+++ b/src/renderer/src/runtime/mobile-markdown-bridge.ts
@@ -15,13 +15,13 @@ import {
   hashMarkdownContent,
   isMarkdownContentByteLengthOverLimit,
   MOBILE_MARKDOWN_EDIT_MAX_BYTES,
+  truncateMobileMarkdownRead,
   type RuntimeMarkdownReadTabResult,
   type RuntimeMarkdownSaveTabResult,
   type RuntimeMobileMarkdownRequest,
   type RuntimeMobileMarkdownResponse
 } from '../../../shared/mobile-markdown-document'
 
-const MOBILE_MARKDOWN_READ_MAX_BYTES = 512 * 1024
 const saveQueues = new Map<string, Promise<void>>()
 
 type FileContent = {
@@ -67,16 +67,18 @@ async function readMobileMarkdownTab(
   flushEditorState(target.sourceFile.id)
   const { content, source } = await readCurrentContent(target.sourceFile)
   const readOnlyReason = getReadOnlyReason(target.tab, target.sourceFile, content)
+  const preview = truncateMobileMarkdownRead(content)
   return {
     tabId,
     filePath: target.sourceFile.filePath,
     relativePath: target.sourceFile.relativePath,
-    content,
+    content: preview.content,
     isDirty: target.sourceFile.isDirty || source === 'draft',
-    version: hashMarkdownContent(content),
+    version: hashMarkdownContent(preview.content),
     source,
     editable: readOnlyReason === undefined,
-    ...(readOnlyReason ? { readOnlyReason } : {})
+    ...(readOnlyReason ? { readOnlyReason } : {}),
+    ...(preview.truncated ? { truncated: true, byteLength: preview.byteLength } : {})
   }
 }
 
@@ -252,9 +254,6 @@ async function readFileContent(file: OpenFile): Promise<string> {
   if (result.isBinary) {
     throw new Error('binary_file')
   }
-  if (isMarkdownContentByteLengthOverLimit(result.content, MOBILE_MARKDOWN_READ_MAX_BYTES)) {
-    throw new Error('file_too_large')
-  }
   return result.content
 }
 
diff --git a/src/renderer/src/runtime/remote-agent-session-launch.test.ts b/src/renderer/src/runtime/remote-agent-session-launch.test.ts
index d8cf0c542cb..dda22ff12fd 100644
--- a/src/renderer/src/runtime/remote-agent-session-launch.test.ts
+++ b/src/renderer/src/runtime/remote-agent-session-launch.test.ts
@@ -45,7 +45,7 @@ describe('remote agent-session launch routing', () => {
     expect(legacy).not.toHaveBeenCalled()
   })
 
-  it.each(['kimi', 'muse'] as const)(
+  it.each(['kimi', 'muse', 'codebuddy'] as const)(
     'falls back to legacy when an older host lacks the %s resume capability',
     async (agent) => {
       const hostAuthority = vi.fn().mockResolvedValue('structured')
@@ -70,23 +70,29 @@ describe('remote agent-session launch routing', () => {
     }
   )
 
-  it('uses host authority when the host supports Muse resume', async () => {
-    const hostAuthority = vi.fn().mockResolvedValue('host')
-    const legacy = vi.fn()
-    mocks.supportsCapability.mockResolvedValue(true)
+  it.each(['muse', 'codebuddy'] as const)(
+    'uses host authority when the host supports %s resume',
+    async (agent) => {
+      const hostAuthority = vi.fn().mockResolvedValue('host')
+      const legacy = vi.fn()
+      mocks.supportsCapability.mockResolvedValue(true)
 
-    await expect(
-      runRemoteAgentSessionLaunch({
-        environmentId: 'env-1',
-        hostAuthority,
-        hostAuthorityCapability: agentResumeHostAuthorityCapability('muse'),
-        legacy
-      })
-    ).resolves.toBe('host')
-    expect(mocks.supportsCapability).toHaveBeenCalledWith('env-1', 'agent-session.muse-resume.v1')
-    expect(hostAuthority).toHaveBeenCalledOnce()
-    expect(legacy).not.toHaveBeenCalled()
-  })
+      await expect(
+        runRemoteAgentSessionLaunch({
+          environmentId: 'env-1',
+          hostAuthority,
+          hostAuthorityCapability: agentResumeHostAuthorityCapability(agent),
+          legacy
+        })
+      ).resolves.toBe('host')
+      expect(mocks.supportsCapability).toHaveBeenCalledWith(
+        'env-1',
+        `agent-session.${agent}-resume.v1`
+      )
+      expect(hostAuthority).toHaveBeenCalledOnce()
+      expect(legacy).not.toHaveBeenCalled()
+    }
+  )
 
   it('preserves the exact legacy path when the capability is absent', async () => {
     const hostAuthority = vi.fn().mockResolvedValue('structured')
diff --git a/src/renderer/src/runtime/remote-server-parity.test.ts b/src/renderer/src/runtime/remote-server-parity.test.ts
index 7c1bcf9bb68..c9779332f66 100644
--- a/src/renderer/src/runtime/remote-server-parity.test.ts
+++ b/src/renderer/src/runtime/remote-server-parity.test.ts
@@ -210,29 +210,6 @@ describe('parity §3: remote terminal create appends rightmost (matches local)',
       toWebTerminalSurfaceTabId('host-tab-3')
     ])
   })
-
-  it('preserves existing relative order when adding (no reshuffle)', () => {
-    const prior = stateWithLocalTerminals([
-      localTerminal('host-tab-1', 0, false),
-      localTerminal('host-tab-2', 1, true)
-    ])
-    recordWebSessionFocusIntent({ environmentId: ENV }, WT, `host-tab-3::${LEAF_C}`)
-    const patch = applyWebSessionTabsSnapshot(
-      prior,
-      makeSnapshot([
-        { parentTab: 'host-tab-1', leaf: LEAF_A, active: false },
-        { parentTab: 'host-tab-2', leaf: LEAF_B, active: false },
-        { parentTab: 'host-tab-3', leaf: LEAF_C, active: true }
-      ]),
-      ENV,
-      NOW + 10
-    ) as Partial<WebSessionTabsSyncState>
-    expect(groupOrder(patch)).toEqual([
-      toWebTerminalSurfaceTabId('host-tab-1'),
-      toWebTerminalSurfaceTabId('host-tab-2'),
-      toWebTerminalSurfaceTabId('host-tab-3')
-    ])
-  })
 })
 
 // ──────────────────────────────────────────────────────────────────────────
@@ -422,24 +399,3 @@ describe('parity §11: remote browser create focuses the new browser tab', () =>
     expect(nextType).toBe('terminal')
   })
 })
-
-// ──────────────────────────────────────────────────────────────────────────
-// Plan §1 — Lifecycle: an emptied host snapshot does not bootstrap phantom tabs
-// when local terminals already exist (sleep/disconnect must not invent state).
-// ──────────────────────────────────────────────────────────────────────────
-describe('parity §1: empty host snapshot does not fabricate tabs', () => {
-  it('an empty snapshot with existing local terminals does not add a phantom tab', () => {
-    const prior = stateWithLocalTerminals([localTerminal('host-tab-1', 0, true)])
-    const patch = applyWebSessionTabsSnapshot(
-      prior,
-      makeSnapshot([], { activeTabId: null, activeTabType: null }),
-      ENV,
-      NOW + 10
-    ) as Partial<WebSessionTabsSyncState>
-    // No new fabricated terminal ids beyond what existed.
-    const order = groupOrder(patch)
-    for (const id of order) {
-      expect(id).toBe(toWebTerminalSurfaceTabId('host-tab-1'))
-    }
-  })
-})
diff --git a/src/renderer/src/runtime/runtime-host-contact-parity.test.ts b/src/renderer/src/runtime/runtime-host-contact-parity.test.ts
index a24e963a1d9..83e152cd899 100644
--- a/src/renderer/src/runtime/runtime-host-contact-parity.test.ts
+++ b/src/renderer/src/runtime/runtime-host-contact-parity.test.ts
@@ -10,16 +10,6 @@ import {
   runtimeHostContactFromSnapshot
 } from '../../../shared/runtime-host-contact'
 import type { RuntimeStatus } from '../../../shared/runtime-types'
-import {
-  runtimeHostConnectionState,
-  runtimeHostConnectionStateForEntry,
-  type RuntimeHostConnectionState
-} from './runtime-host-connection-state'
-
-// This file exists to prove the contact introduced here changes nothing. It carries a frozen copy
-// of the derivation as it stood before, and asserts the shipping one agrees with it on every
-// combination of the inputs it reads. A behaviour change would have to survive the whole
-// cross-product to go unnoticed, which is a much harder thing to do by accident than to argue.
 
 type Entry = {
   status: RuntimeStatus | null
@@ -27,33 +17,6 @@ type Entry = {
   snapshot?: RuntimeHostStatusSnapshot
 }
 
-/** The derivation exactly as it read before `RuntimeHostContact` existed. Do not refactor. */
-function legacyRuntimeHostConnectionStateForEntry(
-  entry: Entry | null | undefined
-): RuntimeHostConnectionState {
-  const snapshot = entry?.snapshot
-  if (snapshot) {
-    if (snapshot.retired || snapshot.verification === 'blocked') {
-      return 'disconnected'
-    }
-    if (snapshot.transport === 'disconnected') {
-      return 'reconnecting'
-    }
-    if (snapshot.verification === 'checking' && !entry?.status) {
-      return 'checking'
-    }
-    if (snapshot.transport === 'ready' && snapshot.verification !== 'verified') {
-      return 'runtime-unavailable'
-    }
-  }
-  return runtimeHostConnectionState({
-    hasStatusEntry: Boolean(entry),
-    status: entry?.status ?? null,
-    ...(snapshot?.transport === 'connecting' ? { transportStatus: 'checking' as const } : {}),
-    remoteControl: entry?.remoteControl ?? entry?.status?.remoteControl ?? null
-  })
-}
-
 const VERIFICATIONS = ['checking', 'verified', 'unavailable', 'blocked'] as const
 const TRANSPORTS = ['unknown', 'connecting', 'ready', 'disconnected'] as const
 const RETIRED = [false, true] as const
@@ -138,38 +101,7 @@ function* everySnapshotEntry(): Generator<{ label: string; entry: Entry }> {
   }
 }
 
-describe('the host contact changes no verdict', () => {
-  it('agrees with the frozen derivation on every snapshot combination', () => {
-    const cases = [...everySnapshotEntry()]
-    // Guard against the enumeration silently collapsing: 4 x 4 x 2 x 2 x 6.
-    expect(cases).toHaveLength(384)
-    const disagreements = cases
-      .map(({ label, entry }) => ({
-        label,
-        now: runtimeHostConnectionStateForEntry(entry),
-        before: legacyRuntimeHostConnectionStateForEntry(entry)
-      }))
-      .filter(({ now, before }) => now !== before)
-    expect(disagreements).toEqual([])
-  })
-
-  it('agrees for entries that carry no snapshot at all', () => {
-    const entries: (Entry | null | undefined)[] = [
-      null,
-      undefined,
-      { status: null },
-      { status: makeStatus() },
-      { status: null, remoteControl: makeRemoteControl('closed') },
-      { status: null, remoteControl: makeRemoteControl('ready') },
-      { status: makeStatus({ remoteControl: makeRemoteControl('reconnecting') }) }
-    ]
-    for (const entry of entries) {
-      expect(runtimeHostConnectionStateForEntry(entry)).toBe(
-        legacyRuntimeHostConnectionStateForEntry(entry)
-      )
-    }
-  })
-
+describe('the revoked predicate and the contact verdict stay in step', () => {
   it('keeps the revoked predicate and the contact verdict in step', () => {
     for (const { label, entry } of everySnapshotEntry()) {
       expect(
diff --git a/src/renderer/src/runtime/runtime-host-contact-regained.test.ts b/src/renderer/src/runtime/runtime-host-contact-regained.test.ts
new file mode 100644
index 00000000000..5daabf37790
--- /dev/null
+++ b/src/renderer/src/runtime/runtime-host-contact-regained.test.ts
@@ -0,0 +1,111 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { RuntimeStatus } from '../../../shared/runtime-types'
+
+vi.mock('sonner', () => ({
+  toast: { warning: vi.fn(), dismiss: vi.fn() }
+}))
+
+vi.mock('@/store', async () => {
+  const { create } = await import('zustand')
+  const { createRuntimeStatusSlice } = await import('@/store/slices/runtime-status')
+  type Slice = ReturnType<typeof createRuntimeStatusSlice>
+  return {
+    useAppStore: create<Slice>()((...a) =>
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the slice reads only its own fields.
+      createRuntimeStatusSlice(...(a as unknown as Parameters<typeof createRuntimeStatusSlice>))
+    )
+  }
+})
+
+import { useAppStore } from '@/store'
+import { clearRuntimeEnvironmentConnectionGenerationsForTests } from '@/store/slices/runtime-status'
+import { subscribeRuntimeHostContactRegained } from './runtime-host-contact-regained'
+
+function makeStatus(runtimeId: string): RuntimeStatus {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: fixture carries only the fields the slice reads.
+  return {
+    runtimeId,
+    rendererGraphEpoch: 0,
+    graphStatus: 'ready',
+    authoritativeWindowId: null,
+    liveTabCount: 0,
+    liveLeafCount: 0,
+    runtimeProtocolVersion: 3,
+    minCompatibleRuntimeClientVersion: 3
+  } as RuntimeStatus
+}
+
+let lastVerified: RuntimeStatus | null = null
+
+// As the host-status snapshot does: an outage keeps the last verified status, so a same-runtime
+// return moves only the contact epoch, not the connection generation.
+function publish(status: RuntimeStatus | null, checkedAt: number): void {
+  lastVerified = status ?? lastVerified
+  useAppStore.getState().setRuntimeEnvironmentStatus('env-a', {
+    status,
+    checkedAt,
+    snapshot: {
+      environmentId: 'env-a',
+      pairingRevision: 1,
+      sequence: checkedAt,
+      checkedAt,
+      status: lastVerified,
+      verification: status ? 'verified' : 'unavailable',
+      transport: status ? 'ready' : 'disconnected'
+    }
+  })
+}
+
+beforeEach(() => {
+  clearRuntimeEnvironmentConnectionGenerationsForTests()
+  vi.stubGlobal('window', { api: {}, dispatchEvent: vi.fn() })
+  useAppStore.setState({ runtimeStatusByEnvironmentId: new Map() })
+  lastVerified = null
+})
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+})
+
+describe('subscribeRuntimeHostContactRegained', () => {
+  it('fires when the runtime answers again after an outage, and not while it stays down', () => {
+    publish(makeStatus('runtime-a'), 1)
+    const listener = vi.fn()
+    const stop = subscribeRuntimeHostContactRegained('env-a', listener)
+
+    publish(null, 2)
+    publish(null, 3)
+    expect(listener).not.toHaveBeenCalled()
+
+    // Same runtime back: only the contact epoch moves.
+    const generation = useAppStore
+      .getState()
+      .runtimeStatusByEnvironmentId.get('env-a')?.connectionGeneration
+    publish(makeStatus('runtime-a'), 4)
+    expect(
+      useAppStore.getState().runtimeStatusByEnvironmentId.get('env-a')?.connectionGeneration
+    ).toBe(generation)
+    expect(listener).toHaveBeenCalledTimes(1)
+    publish(makeStatus('runtime-a'), 5)
+    expect(listener).toHaveBeenCalledTimes(1)
+
+    // A restarted runtime: the connection generation moves.
+    publish(makeStatus('runtime-b'), 6)
+    expect(listener).toHaveBeenCalledTimes(2)
+
+    stop()
+    publish(null, 7)
+    publish(makeStatus('runtime-b'), 8)
+    expect(listener).toHaveBeenCalledTimes(2)
+  })
+
+  it('ignores other environments', () => {
+    publish(makeStatus('runtime-a'), 1)
+    const listener = vi.fn()
+    const stop = subscribeRuntimeHostContactRegained('env-b', listener)
+    publish(null, 2)
+    publish(makeStatus('runtime-a'), 3)
+    expect(listener).not.toHaveBeenCalled()
+    stop()
+  })
+})
diff --git a/src/renderer/src/runtime/runtime-host-contact-regained.ts b/src/renderer/src/runtime/runtime-host-contact-regained.ts
new file mode 100644
index 00000000000..b829f51d99a
--- /dev/null
+++ b/src/renderer/src/runtime/runtime-host-contact-regained.ts
@@ -0,0 +1,31 @@
+import { useAppStore } from '@/store'
+import type { AppState } from '@/store/types'
+
+function contactMarks(state: AppState, environmentId: string): string | null {
+  const entry = state.runtimeStatusByEnvironmentId.get(environmentId)
+  return entry ? `${entry.hostContactEpoch ?? 0}:${entry.connectionGeneration ?? 0}` : null
+}
+
+/**
+ * Calls `listener` each time this client regains contact with an environment's runtime: the
+ * same-runtime return (`hostContactEpoch`) or a new runtime session (`connectionGeneration`),
+ * both published by runtime-status.ts.
+ */
+export function subscribeRuntimeHostContactRegained(
+  environmentId: string,
+  listener: () => void
+): () => void {
+  let lastMarks = contactMarks(useAppStore.getState(), environmentId)
+  return useAppStore.subscribe((state, previousState) => {
+    if (state.runtimeStatusByEnvironmentId === previousState.runtimeStatusByEnvironmentId) {
+      return
+    }
+    const marks = contactMarks(state, environmentId)
+    // Why keep the last marks across a missing entry: a cleared status that returns is a reconnect.
+    if (marks === null || marks === lastMarks) {
+      return
+    }
+    lastMarks = marks
+    listener()
+  })
+}
diff --git a/src/renderer/src/runtime/runtime-terminal-inspection.test.ts b/src/renderer/src/runtime/runtime-terminal-inspection.test.ts
index 7f54f5873bc..ded589e26b1 100644
--- a/src/renderer/src/runtime/runtime-terminal-inspection.test.ts
+++ b/src/renderer/src/runtime/runtime-terminal-inspection.test.ts
@@ -110,7 +110,12 @@ describe('runtime terminal owner routing', () => {
 
   it('sends input through the PTY owning environment instead of the active one', async () => {
     expect(
-      sendRuntimePtyInput({ activeRuntimeEnvironmentId: 'env-2' }, 'remote:env-1@@terminal-1', 'x')
+      sendRuntimePtyInput(
+        { activeRuntimeEnvironmentId: 'env-2' },
+        'remote:env-1@@terminal-1',
+        'x',
+        'driving'
+      )
     ).toBe(true)
 
     await vi.waitFor(() => {
@@ -341,7 +346,12 @@ describe('runtime terminal owner routing', () => {
     })
 
     expect(
-      sendRuntimePtyInput({ activeRuntimeEnvironmentId: 'env-2' }, 'remote:env-1@@terminal-1', 'x')
+      sendRuntimePtyInput(
+        { activeRuntimeEnvironmentId: 'env-2' },
+        'remote:env-1@@terminal-1',
+        'x',
+        'driving'
+      )
     ).toBe(true)
 
     await vi.waitFor(() => {
@@ -372,7 +382,12 @@ describe('runtime terminal owner routing', () => {
     useAppStore.setState({ lastTerminalInputAtByPaneKey: {} })
 
     expect(
-      sendRuntimePtyInput({ activeRuntimeEnvironmentId: 'env-2' }, 'remote:env-1@@terminal-1', 'x')
+      sendRuntimePtyInput(
+        { activeRuntimeEnvironmentId: 'env-2' },
+        'remote:env-1@@terminal-1',
+        'x',
+        'driving'
+      )
     ).toBe(true)
     const nextLeafId = '22222222-2222-4222-8222-222222222222'
     useAppStore.setState({
@@ -417,7 +432,12 @@ describe('runtime terminal owner routing', () => {
     })
 
     expect(
-      sendRuntimePtyInput({ activeRuntimeEnvironmentId: 'env-2' }, 'remote:env-1@@terminal-1', 'x')
+      sendRuntimePtyInput(
+        { activeRuntimeEnvironmentId: 'env-2' },
+        'remote:env-1@@terminal-1',
+        'x',
+        'driving'
+      )
     ).toBe(true)
 
     await vi.waitFor(() => {
@@ -436,7 +456,8 @@ describe('runtime terminal owner routing', () => {
       sendRuntimePtyInputVerified(
         { activeRuntimeEnvironmentId: 'env-2' },
         'remote:env-1@@terminal-stale',
-        'x'
+        'x',
+        'driving'
       )
     ).resolves.toBe(false)
   })
@@ -452,7 +473,8 @@ describe('runtime terminal owner routing', () => {
       sendRuntimePtyInputVerified(
         { activeRuntimeEnvironmentId: 'env-2' },
         'remote:env-1@@terminal-1',
-        'x'
+        'x',
+        'driving'
       )
     ).resolves.toBe(false)
 
@@ -472,17 +494,19 @@ describe('runtime terminal owner routing', () => {
     localWriteAccepted.mockResolvedValue(true)
 
     await expect(
-      sendRuntimePtyInputVerified({ activeRuntimeEnvironmentId: null }, 'local-pty', 'x')
+      sendRuntimePtyInputVerified({ activeRuntimeEnvironmentId: null }, 'local-pty', 'x', 'driving')
     ).resolves.toBe(true)
 
-    expect(localWriteAccepted).toHaveBeenCalledWith('local-pty', 'x')
+    expect(localWriteAccepted).toHaveBeenCalledWith('local-pty', 'x', 'driving')
     expect(localWrite).not.toHaveBeenCalled()
   })
 
   it('rejects oversized fire-and-forget local input before IPC writes', () => {
     const text = 'x'.repeat(TERMINAL_INPUT_MAX_BYTES + 1)
 
-    expect(sendRuntimePtyInput({ activeRuntimeEnvironmentId: null }, 'local-pty', text)).toBe(false)
+    expect(
+      sendRuntimePtyInput({ activeRuntimeEnvironmentId: null }, 'local-pty', text, 'driving')
+    ).toBe(false)
 
     expect(localWrite).not.toHaveBeenCalled()
     expect(localWriteAccepted).not.toHaveBeenCalled()
@@ -492,7 +516,12 @@ describe('runtime terminal owner routing', () => {
     const text = 'x'.repeat(TERMINAL_INPUT_MAX_BYTES + 1)
 
     expect(
-      sendRuntimePtyInput({ activeRuntimeEnvironmentId: 'env-2' }, 'remote:env-1@@terminal-1', text)
+      sendRuntimePtyInput(
+        { activeRuntimeEnvironmentId: 'env-2' },
+        'remote:env-1@@terminal-1',
+        text,
+        'driving'
+      )
     ).toBe(false)
 
     expect(runtimeTransportCall).not.toHaveBeenCalled()
@@ -504,14 +533,14 @@ describe('runtime terminal owner routing', () => {
     try {
       const text = 'x'.repeat(CLIPBOARD_TEXT_MEASURE_YIELD_CODE_UNITS + 1)
 
-      expect(sendRuntimePtyInput({ activeRuntimeEnvironmentId: null }, 'local-pty', text)).toBe(
-        true
-      )
+      expect(
+        sendRuntimePtyInput({ activeRuntimeEnvironmentId: null }, 'local-pty', text, 'driving')
+      ).toBe(true)
       expect(localWrite).not.toHaveBeenCalled()
 
       await vi.advanceTimersByTimeAsync(0)
 
-      expect(localWrite).toHaveBeenCalledWith('local-pty', text)
+      expect(localWrite).toHaveBeenCalledWith('local-pty', text, 'driving')
       expect(localWriteAccepted).not.toHaveBeenCalled()
     } finally {
       vi.useRealTimers()
@@ -523,9 +552,9 @@ describe('runtime terminal owner routing', () => {
     try {
       const text = makeByteOversizedTerminalInput()
 
-      expect(sendRuntimePtyInput({ activeRuntimeEnvironmentId: null }, 'local-pty', text)).toBe(
-        true
-      )
+      expect(
+        sendRuntimePtyInput({ activeRuntimeEnvironmentId: null }, 'local-pty', text, 'driving')
+      ).toBe(true)
 
       await vi.runAllTimersAsync()
 
@@ -540,7 +569,12 @@ describe('runtime terminal owner routing', () => {
     const text = 'x'.repeat(TERMINAL_INPUT_MAX_BYTES + 1)
 
     await expect(
-      sendRuntimePtyInputVerified({ activeRuntimeEnvironmentId: null }, 'local-pty', text)
+      sendRuntimePtyInputVerified(
+        { activeRuntimeEnvironmentId: null },
+        'local-pty',
+        text,
+        'driving'
+      )
     ).resolves.toBe(false)
 
     expect(localWriteAccepted).not.toHaveBeenCalled()
@@ -555,7 +589,8 @@ describe('runtime terminal owner routing', () => {
       const accepted = sendRuntimePtyInputVerified(
         { activeRuntimeEnvironmentId: null },
         'local-pty',
-        text
+        text,
+        'driving'
       )
 
       expect(localWriteAccepted).not.toHaveBeenCalled()
@@ -563,7 +598,7 @@ describe('runtime terminal owner routing', () => {
       await vi.advanceTimersByTimeAsync(0)
 
       await expect(accepted).resolves.toBe(true)
-      expect(localWriteAccepted).toHaveBeenCalledWith('local-pty', text)
+      expect(localWriteAccepted).toHaveBeenCalledWith('local-pty', text, 'driving')
       expect(localWrite).not.toHaveBeenCalled()
     } finally {
       vi.useRealTimers()
@@ -577,7 +612,8 @@ describe('runtime terminal owner routing', () => {
       const accepted = sendRuntimePtyInputVerified(
         { activeRuntimeEnvironmentId: null },
         'local-pty',
-        text
+        text,
+        'driving'
       )
 
       await vi.runAllTimersAsync()
@@ -612,7 +648,8 @@ describe('runtime terminal owner routing', () => {
       sendRuntimePtyInputVerified(
         { activeRuntimeEnvironmentId: 'env-2' },
         'remote:env-1@@terminal-1',
-        'x'
+        'x',
+        'driving'
       )
     ).resolves.toBe(true)
 
@@ -643,7 +680,8 @@ describe('runtime terminal owner routing', () => {
       sendRuntimePtyInputVerified(
         { activeRuntimeEnvironmentId: 'env-2' },
         'remote:env-1@@terminal-1',
-        'x'
+        'x',
+        'driving'
       )
     ).resolves.toBe(false)
 
@@ -829,10 +867,10 @@ describe('runtime terminal owner routing', () => {
     localWriteAccepted.mockResolvedValue(false)
 
     await expect(
-      sendRuntimePtyInputVerified({ activeRuntimeEnvironmentId: null }, 'local-pty', 'x')
+      sendRuntimePtyInputVerified({ activeRuntimeEnvironmentId: null }, 'local-pty', 'x', 'driving')
     ).resolves.toBe(true)
 
-    expect(localWriteAccepted).toHaveBeenCalledWith('local-pty', 'x')
-    expect(localWrite).toHaveBeenCalledWith('local-pty', 'x')
+    expect(localWriteAccepted).toHaveBeenCalledWith('local-pty', 'x', 'driving')
+    expect(localWrite).toHaveBeenCalledWith('local-pty', 'x', 'driving')
   })
 })
diff --git a/src/renderer/src/runtime/runtime-terminal-inspection.ts b/src/renderer/src/runtime/runtime-terminal-inspection.ts
index b34d75f4555..e235bb5adef 100644
--- a/src/renderer/src/runtime/runtime-terminal-inspection.ts
+++ b/src/renderer/src/runtime/runtime-terminal-inspection.ts
@@ -20,6 +20,7 @@ export type {
   ClientOnlyUnverifiableInspection,
   ClientOnlyUnverifiableReason
 } from '../../../shared/terminal-process-inspection'
+import type { TerminalInputKind } from '../../../shared/terminal-input-kind'
 
 export type RuntimeTerminalProcessInspection = TerminalProcessInspection
 
@@ -216,7 +217,8 @@ export async function confirmRuntimeTerminalForegroundProcess(
 export function sendRuntimePtyInput(
   settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined,
   ptyId: string,
-  data: string
+  data: string,
+  inputKind: TerminalInputKind
 ): boolean {
   const tooLarge = isRuntimePtyInputTooLarge(data)
   if (tooLarge === true) {
@@ -228,19 +230,22 @@ export function sendRuntimePtyInput(
     void tooLarge
       .then((resolvedTooLarge) => {
         if (!resolvedTooLarge) {
-          sendRuntimePtyInputWithinLimit(settings, ptyId, data)
+          sendRuntimePtyInputWithinLimit(settings, ptyId, data, inputKind)
         }
       })
       .catch(() => {})
     return true
   }
-  return sendRuntimePtyInputWithinLimit(settings, ptyId, data)
+  return sendRuntimePtyInputWithinLimit(settings, ptyId, data, inputKind)
 }
 
+// Why the kind reaches only the local write: terminal.send has no launch kind, and its query-reply
+// kind is for mobile clients, so the host classifies a desktop's environment write by its bytes.
 function sendRuntimePtyInputWithinLimit(
   settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined,
   ptyId: string,
-  data: string
+  data: string,
+  inputKind: TerminalInputKind
 ): boolean {
   const ownerEnvironmentId = getRemoteRuntimePtyEnvironmentId(ptyId)
   const target = ownerEnvironmentId
@@ -248,7 +253,7 @@ function sendRuntimePtyInputWithinLimit(
     : getActiveRuntimeTarget(settings)
   const terminal = getRemoteRuntimeTerminalHandle(ptyId)
   if (target.kind !== 'environment' || !terminal) {
-    window.api.pty.write(ptyId, data)
+    window.api.pty.write(ptyId, data, inputKind)
     recordRuntimeTerminalInputForPtyId(ptyId)
     return true
   }
@@ -274,7 +279,8 @@ function sendRuntimePtyInputWithinLimit(
 export async function sendRuntimePtyInputVerified(
   settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined,
   ptyId: string,
-  data: string
+  data: string,
+  inputKind: TerminalInputKind
 ): Promise<boolean> {
   const tooLarge = isRuntimePtyInputTooLarge(data)
   if (typeof tooLarge === 'boolean' ? tooLarge : await tooLarge) {
@@ -286,9 +292,9 @@ export async function sendRuntimePtyInputVerified(
     : getActiveRuntimeTarget(settings)
   const terminal = getRemoteRuntimeTerminalHandle(ptyId)
   if (target.kind !== 'environment' || !terminal) {
-    const accepted = await window.api.pty.writeAccepted(ptyId, data)
+    const accepted = await window.api.pty.writeAccepted(ptyId, data, inputKind)
     if (!accepted) {
-      window.api.pty.write(ptyId, data)
+      window.api.pty.write(ptyId, data, inputKind)
       // Why: SSH/local fallback writes are fire-and-forget. Callers use this
       // boolean to continue UX flow, while hook telemetry confirms real turns.
       recordRuntimeTerminalInputForPtyId(ptyId)
diff --git a/src/renderer/src/runtime/structured-agent-session-accepted-send-capability.test.tsx b/src/renderer/src/runtime/structured-agent-session-accepted-send-capability.test.tsx
new file mode 100644
index 00000000000..acdfdbb0323
--- /dev/null
+++ b/src/renderer/src/runtime/structured-agent-session-accepted-send-capability.test.tsx
@@ -0,0 +1,51 @@
+// @vitest-environment happy-dom
+
+import { renderHook, waitFor } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
+
+const mocks = vi.hoisted(() => ({ supports: vi.fn() }))
+
+vi.mock('./runtime-rpc-client', () => ({
+  runtimeEnvironmentSupportsCapability: mocks.supports
+}))
+
+import { setLocalRuntimeCapabilitiesForTests } from './local-runtime-capabilities'
+import { useStructuredAgentSessionHostAcceptsSend } from './structured-agent-session-accepted-send-capability'
+
+afterEach(() => {
+  setLocalRuntimeCapabilitiesForTests(null)
+  vi.clearAllMocks()
+})
+
+describe('whether a host accepts a send before any agent has it', () => {
+  it('reads the local host from its advertised capabilities', () => {
+    setLocalRuntimeCapabilitiesForTests([AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY])
+    const { result } = renderHook(() => useStructuredAgentSessionHostAcceptsSend({ kind: 'local' }))
+    expect(result.current).toBe(true)
+  })
+
+  it('treats a local host that does not advertise it as an older one', () => {
+    setLocalRuntimeCapabilitiesForTests([])
+    const { result } = renderHook(() => useStructuredAgentSessionHostAcceptsSend({ kind: 'local' }))
+    expect(result.current).toBe(false)
+  })
+
+  it('asks a remote host, and reads a failed probe as an older host', async () => {
+    mocks.supports.mockResolvedValueOnce(true).mockRejectedValueOnce(new Error('offline'))
+    const accepts = renderHook(() =>
+      useStructuredAgentSessionHostAcceptsSend({ kind: 'environment', environmentId: 'env-1' })
+    )
+    await waitFor(() => expect(accepts.result.current).toBe(true))
+    expect(mocks.supports).toHaveBeenCalledWith(
+      'env-1',
+      AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY
+    )
+
+    const offline = renderHook(() =>
+      useStructuredAgentSessionHostAcceptsSend({ kind: 'environment', environmentId: 'env-2' })
+    )
+    await waitFor(() => expect(mocks.supports).toHaveBeenCalledTimes(2))
+    expect(offline.result.current).toBe(false)
+  })
+})
diff --git a/src/renderer/src/runtime/structured-agent-session-accepted-send-capability.ts b/src/renderer/src/runtime/structured-agent-session-accepted-send-capability.ts
new file mode 100644
index 00000000000..0df8fdbea31
--- /dev/null
+++ b/src/renderer/src/runtime/structured-agent-session-accepted-send-capability.ts
@@ -0,0 +1,49 @@
+import { useLayoutEffect, useRef, type RefObject } from 'react'
+import { AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
+import type { RuntimeClientTarget } from './runtime-client-target'
+import {
+  structuredAgentSessionHostKey,
+  useStructuredAgentSessionHostCapability
+} from './structured-agent-session-host-capability'
+
+/**
+ * Whether the host answers a send at acceptance and never refuses one because its agent could not
+ * start. Such a host records every send before it starts anything, so nothing about a moved fence
+ * calls for a resend. False until the host has said so: an older host is handled as it always was.
+ */
+export function useStructuredAgentSessionHostAcceptsSend(target: RuntimeClientTarget): boolean {
+  return useStructuredAgentSessionHostCapability(
+    target,
+    AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY
+  )
+}
+
+/**
+ * When an outbox treats its owner as changed: resending a send in flight under the same id,
+ * dropping that send's answer, and unblocking a refused head. An older host restarts the agent
+ * inside the send and refuses it, unrecorded, when that fails, so a new fence is its only word that
+ * another try may land. A host that accepts first records every send before it starts anything,
+ * so a moved fence means nothing there, and only a Retry or a new send goes out.
+ */
+export function useStructuredAgentSessionOutboxOwnerChange(
+  target: RuntimeClientTarget,
+  fence: number | null
+): {
+  ownerChange: number | null
+  attached: boolean
+  fenceRef: RefObject<number | null>
+  targetKey: string
+} {
+  const acceptsSend = useStructuredAgentSessionHostAcceptsSend(target)
+  // Read by effects that run on an owner change, not on every fence move.
+  const fenceRef = useRef(fence)
+  useLayoutEffect(() => {
+    fenceRef.current = fence
+  }, [fence])
+  return {
+    ownerChange: acceptsSend ? null : fence,
+    attached: fence !== null,
+    fenceRef,
+    targetKey: structuredAgentSessionHostKey(target)
+  }
+}
diff --git a/src/renderer/src/runtime/structured-agent-session-client.ts b/src/renderer/src/runtime/structured-agent-session-client.ts
index 446f419d1f9..d50fed2b4c3 100644
--- a/src/renderer/src/runtime/structured-agent-session-client.ts
+++ b/src/renderer/src/runtime/structured-agent-session-client.ts
@@ -9,6 +9,7 @@ import type { AgentSessionConversationOutline } from '../../../shared/agent-sess
 import {
   AGENT_SESSION_CONVERSATION_OUTLINE_RUNTIME_CAPABILITY,
   AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY,
+  AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY,
   AGENT_SESSION_REWIND_RUNTIME_CAPABILITY,
   type RuntimeCapability
 } from '../../../shared/protocol-version'
@@ -46,6 +47,15 @@ export function supportsStructuredAgentSessionPromptCancel(
   return structuredAgentSessionHostSupports(target, AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY)
 }
 
+export function supportsStructuredAgentSessionQuestionAnswers(
+  target: RuntimeClientTarget
+): Promise<boolean> {
+  return structuredAgentSessionHostSupports(
+    target,
+    AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY
+  )
+}
+
 /** Null when the host predates the outline, without calling it. A failed read
  *  rejects, so the caller can retry it; the rail maps loaded messages meanwhile. */
 export async function readStructuredAgentSessionConversationOutline(
diff --git a/src/renderer/src/runtime/structured-agent-session-host-capability.test.tsx b/src/renderer/src/runtime/structured-agent-session-host-capability.test.tsx
new file mode 100644
index 00000000000..121b0719d3d
--- /dev/null
+++ b/src/renderer/src/runtime/structured-agent-session-host-capability.test.tsx
@@ -0,0 +1,53 @@
+// @vitest-environment happy-dom
+
+import { renderHook, waitFor } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
+  AGENT_SESSION_CONVERSATION_STOP_RUNTIME_CAPABILITY
+} from '../../../shared/protocol-version'
+
+const mocks = vi.hoisted(() => ({ supports: vi.fn() }))
+
+vi.mock('./runtime-rpc-client', () => ({
+  runtimeEnvironmentSupportsCapability: mocks.supports
+}))
+
+import { setLocalRuntimeCapabilitiesForTests } from './local-runtime-capabilities'
+import { useStructuredAgentSessionHostStopsConversation } from './structured-agent-session-host-capability'
+
+afterEach(() => {
+  setLocalRuntimeCapabilitiesForTests(null)
+  vi.clearAllMocks()
+})
+
+describe('whether a host takes a Stop naming no turn', () => {
+  it('reads it from the host capability of that name, not from accepting sends first', () => {
+    setLocalRuntimeCapabilitiesForTests([AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY])
+    expect(
+      renderHook(() => useStructuredAgentSessionHostStopsConversation({ kind: 'local' })).result
+        .current
+    ).toBe(false)
+
+    setLocalRuntimeCapabilitiesForTests([AGENT_SESSION_CONVERSATION_STOP_RUNTIME_CAPABILITY])
+    expect(
+      renderHook(() => useStructuredAgentSessionHostStopsConversation({ kind: 'local' })).result
+        .current
+    ).toBe(true)
+  })
+
+  it('asks a remote host for that capability', async () => {
+    mocks.supports.mockResolvedValueOnce(true)
+    const { result } = renderHook(() =>
+      useStructuredAgentSessionHostStopsConversation({
+        kind: 'environment',
+        environmentId: 'env-1'
+      })
+    )
+    await waitFor(() => expect(result.current).toBe(true))
+    expect(mocks.supports).toHaveBeenCalledWith(
+      'env-1',
+      AGENT_SESSION_CONVERSATION_STOP_RUNTIME_CAPABILITY
+    )
+  })
+})
diff --git a/src/renderer/src/runtime/structured-agent-session-host-capability.ts b/src/renderer/src/runtime/structured-agent-session-host-capability.ts
new file mode 100644
index 00000000000..22e59365bf1
--- /dev/null
+++ b/src/renderer/src/runtime/structured-agent-session-host-capability.ts
@@ -0,0 +1,63 @@
+import { useEffect, useState } from 'react'
+import {
+  AGENT_SESSION_CONVERSATION_STOP_RUNTIME_CAPABILITY,
+  type RuntimeCapability
+} from '../../../shared/protocol-version'
+import type { RuntimeClientTarget } from './runtime-client-target'
+import {
+  ensureLocalRuntimeCapabilities,
+  readLocalRuntimeCapabilitiesOrUnknown
+} from './local-runtime-capabilities'
+import { runtimeEnvironmentSupportsCapability } from './runtime-rpc-client'
+
+export function structuredAgentSessionHostKey(target: RuntimeClientTarget): string {
+  return target.kind === 'local' ? 'local' : `environment:${target.environmentId}`
+}
+
+/** Whether the session's host advertises `capability`. False until the host has said so, and for
+ *  a failed probe: an older host is handled as it always was. */
+export function useStructuredAgentSessionHostCapability(
+  target: RuntimeClientTarget,
+  capability: RuntimeCapability
+): boolean {
+  const key = structuredAgentSessionHostKey(target)
+  const [answer, setAnswer] = useState<{ key: string; supported: boolean }>(() => ({
+    key,
+    supported:
+      target.kind === 'local' &&
+      (readLocalRuntimeCapabilitiesOrUnknown()?.includes(capability) ?? false)
+  }))
+  const environmentId = target.kind === 'environment' ? target.environmentId : null
+  useEffect(() => {
+    let cancelled = false
+    const probe =
+      environmentId === null
+        ? ensureLocalRuntimeCapabilities().then(
+            (capabilities) => capabilities?.includes(capability) ?? false
+          )
+        : runtimeEnvironmentSupportsCapability(environmentId, capability)
+    void probe
+      .catch(() => false)
+      .then((supported) => {
+        if (!cancelled) {
+          setAnswer((current) =>
+            current.key === key && current.supported === supported ? current : { key, supported }
+          )
+        }
+      })
+    return () => {
+      cancelled = true
+    }
+  }, [capability, environmentId, key])
+  return answer.key === key && answer.supported
+}
+
+/** Whether the host takes a Stop naming no turn: the only Stop before the provider opens one. */
+export function useStructuredAgentSessionHostStopsConversation(
+  target: RuntimeClientTarget
+): boolean {
+  return useStructuredAgentSessionHostCapability(
+    target,
+    AGENT_SESSION_CONVERSATION_STOP_RUNTIME_CAPABILITY
+  )
+}
diff --git a/src/renderer/src/runtime/structured-agent-session-status-feed-lifecycle.test.ts b/src/renderer/src/runtime/structured-agent-session-status-feed-lifecycle.test.ts
index 4f98700d806..e192bddae52 100644
--- a/src/renderer/src/runtime/structured-agent-session-status-feed-lifecycle.test.ts
+++ b/src/renderer/src/runtime/structured-agent-session-status-feed-lifecycle.test.ts
@@ -27,7 +27,9 @@ const owned: AgentSessionStatusSummary = {
   status: 'working',
   latestPrompt: 'work',
   updatedAt: 1,
-  hostExecutionOwned: true
+  hostExecutionOwned: true,
+  hostExecutionPhase: 'starting',
+  hostExecutionChild: { generation: 'child-1', fence: 1 }
 }
 const done: AgentSessionStatusSummary = {
   ...owned,
@@ -69,7 +71,12 @@ describe('structured status feed execution authority lifecycle', () => {
     subscription().emit({ type: 'snapshot', sessions: [owned, done] })
     subscription().emit({ type: 'end' })
     expect(subscription().unsubscribe).toHaveBeenCalledOnce()
-    expect(feed.getSnapshot().get('running')).toEqual({ ...owned, hostExecutionOwned: undefined })
+    expect(feed.getSnapshot().get('running')).toEqual({
+      ...owned,
+      hostExecutionOwned: undefined,
+      hostExecutionPhase: undefined,
+      hostExecutionChild: undefined
+    })
     expect(feed.getSnapshot().get('completed')).toBe(done)
     subscription().emit({ type: 'status', session: owned })
     expect(feed.getSnapshot().get('running')?.hostExecutionOwned).toBeUndefined()
diff --git a/src/renderer/src/runtime/structured-agent-session-status-feed.ts b/src/renderer/src/runtime/structured-agent-session-status-feed.ts
index 84bbcacdecc..7e4d7f27eb8 100644
--- a/src/renderer/src/runtime/structured-agent-session-status-feed.ts
+++ b/src/renderer/src/runtime/structured-agent-session-status-feed.ts
@@ -95,7 +95,12 @@ function createOwner(target: RuntimeClientTarget): OwnedStatusFeed {
       if (!next) {
         next = new Map(snapshot)
       }
-      const { hostExecutionOwned: _owned, hostExecutionPhase: _phase, ...retained } = summary
+      const {
+        hostExecutionOwned: _owned,
+        hostExecutionPhase: _phase,
+        hostExecutionChild: _child,
+        ...retained
+      } = summary
       next.set(sessionId, retained)
     }
     if (next) {
diff --git a/src/renderer/src/runtime/structured-agent-session-tab-retirement.test.ts b/src/renderer/src/runtime/structured-agent-session-tab-retirement.test.ts
index 7963b1c150e..5c3017998c0 100644
--- a/src/renderer/src/runtime/structured-agent-session-tab-retirement.test.ts
+++ b/src/renderer/src/runtime/structured-agent-session-tab-retirement.test.ts
@@ -84,7 +84,6 @@ describe('structured agent session tab retirement', () => {
     beginStructuredAgentSessionTabClose({
       target,
       worktreeId: 'wt-1',
-      tabId: 'agent-tab-1',
       sessionId: 'session-1',
       provisional: true
     })
@@ -119,13 +118,11 @@ describe('structured agent session tab retirement', () => {
     retireStructuredAgentSessionTab({
       target,
       worktreeId: 'wt-1',
-      tabId: 'agent-tab-1',
       sessionId: 'session-1'
     })
     retireStructuredAgentSessionTab({
       target,
       worktreeId: 'wt-1',
-      tabId: 'agent-tab-1',
       sessionId: 'session-1'
     })
     expect(mocks.closeSession).toHaveBeenCalledTimes(1)
diff --git a/src/renderer/src/runtime/structured-agent-session-tab-retirement.ts b/src/renderer/src/runtime/structured-agent-session-tab-retirement.ts
index 8489aa0e6a6..567e7459603 100644
--- a/src/renderer/src/runtime/structured-agent-session-tab-retirement.ts
+++ b/src/renderer/src/runtime/structured-agent-session-tab-retirement.ts
@@ -19,7 +19,6 @@ function retirementKey(target: RuntimeClientTarget, worktreeId: string, sessionI
 export function retireStructuredAgentSessionTab(args: {
   target: RuntimeClientTarget
   worktreeId: string
-  tabId: string
   sessionId: string
   onError?: (error: unknown) => void
 }): void {
@@ -28,11 +27,13 @@ export function retireStructuredAgentSessionTab(args: {
   if (existing) {
     return
   }
+  const hostTabId = `agent-session:${args.sessionId}`
+  // Why: main echoes the host tab id it was asked to close, never this window's tab id.
   const closeHostTab = () =>
-    withLocalSessionTabCloseOwner(args.worktreeId, args.tabId, () =>
+    withLocalSessionTabCloseOwner(args.worktreeId, hostTabId, () =>
       callRuntimeRpc(args.target, 'session.tabs.close', {
         worktree: toRuntimeWorktreeSelector(args.worktreeId),
-        tabId: `agent-session:${args.sessionId}`,
+        tabId: hostTabId,
         reason: 'user'
       })
     )
@@ -58,7 +59,6 @@ export function retireStructuredAgentSessionTab(args: {
 export function beginStructuredAgentSessionTabClose(args: {
   target: RuntimeClientTarget
   worktreeId: string
-  tabId: string
   sessionId: string
   provisional: boolean
   onError?: (error: unknown) => void
@@ -92,7 +92,6 @@ export function suppressCancelledStructuredSessionTabs(
     retireStructuredAgentSessionTab({
       target,
       worktreeId: snapshot.worktree,
-      tabId: `agent-session:${sessionId}`,
       sessionId,
       onError
     })
diff --git a/src/renderer/src/runtime/structured-conversation-tab-replacement.test.ts b/src/renderer/src/runtime/structured-conversation-tab-replacement.test.ts
index 8f34606ef27..c6804fb4339 100644
--- a/src/renderer/src/runtime/structured-conversation-tab-replacement.test.ts
+++ b/src/renderer/src/runtime/structured-conversation-tab-replacement.test.ts
@@ -94,10 +94,10 @@ describe('clear pane identity', () => {
         groupId: 'local-group',
         isPinned: true
       })
-      expect(next.groupsByWorktree?.[WT]?.[0]).toMatchObject({
-        activeTabId: 'local-pane'
-      })
-      expect(next.groupsByWorktree?.[WT]?.[0]?.tabOrder[0]).toBe('local-pane')
+      // An omitted groups patch means the snapshot left every group as it was.
+      const nextGroup = (next.groupsByWorktree ?? state.groupsByWorktree)[WT]?.[0]
+      expect(nextGroup).toMatchObject({ activeTabId: 'local-pane' })
+      expect(nextGroup?.tabOrder[0]).toBe('local-pane')
       expect(next.activeTabIdByWorktree?.[WT] ?? state.activeTabIdByWorktree[WT]).toBe('local-pane')
       expect(next.tabsByWorktree?.[WT] ?? []).toEqual([])
       const repeated = applyWebSessionTabsSnapshot({ ...state, ...next }, snapshot, ENV, NOW + 1, {
diff --git a/src/renderer/src/runtime/sync-runtime-graph-agent-status-projection.test.ts b/src/renderer/src/runtime/sync-runtime-graph-agent-status-projection.test.ts
index 2ac4a8bbfd7..b78bb317585 100644
--- a/src/renderer/src/runtime/sync-runtime-graph-agent-status-projection.test.ts
+++ b/src/renderer/src/runtime/sync-runtime-graph-agent-status-projection.test.ts
@@ -13,6 +13,10 @@ import {
 // under test so a drifted constant cannot make this reference silently disagree for a reason
 // unrelated to the change.
 const BUCKET_MS = AGENT_STATUS_SYNC_UPDATED_AT_BUCKET_MS_FOR_TESTS
+type MainAgentStatus = AppState['agentStatusByPaneKey'][string]['mainAgent']
+function mainAgentKey(mainAgent: MainAgentStatus) {
+  return mainAgent ? [mainAgent.state, mainAgent.outcome ?? null, mainAgent.stateStartedAt] : null
+}
 function referenceProjection(map: AppState['agentStatusByPaneKey']): string {
   return JSON.stringify(
     Object.entries(map)
@@ -25,20 +29,24 @@ function referenceProjection(map: AppState['agentStatusByPaneKey']): string {
         prompt: entry.prompt,
         updatedAtBucket: Math.floor(entry.updatedAt / BUCKET_MS),
         stateStartedAt: entry.stateStartedAt,
+        // A new turn can keep the state (child work held it open); its stamp alone must republish.
+        turnStartedAt: entry.turnStartedAt ?? null,
         agentType: entry.agentType ?? null,
         terminalTitle: entry.terminalTitle ?? null,
         stateHistory: entry.stateHistory.map((history) => ({
           state: history.state,
           prompt: history.prompt,
           startedAt: history.startedAt,
-          interrupted: history.interrupted ?? null
+          interrupted: history.interrupted ?? null,
+          mainAgent: mainAgentKey(history.mainAgent)
         })),
         toolName: entry.toolName ?? null,
         toolInput: entry.toolInput ?? null,
         interactivePrompt: entry.interactivePrompt ?? null,
         lastAssistantMessage: entry.lastAssistantMessage ?? null,
         lastAssistantMessageIsToolOutput: entry.lastAssistantMessageIsToolOutput ?? null,
-        interrupted: entry.interrupted ?? null
+        interrupted: entry.interrupted ?? null,
+        mainAgent: mainAgentKey(entry.mainAgent)
       }))
   )
 }
@@ -71,6 +79,7 @@ describe('mobile agent-status projection equivalence', () => {
     statusMaps.push({})
     statusMaps.push({ 'tab-0:leaf-0': makeEntry(0) })
     statusMaps.push({ 'tab-0:leaf-0': makeEntry(0, { workingMode: 'monitoring' }) })
+    statusMaps.push({ 'tab-0:leaf-0': makeEntry(0, { turnStartedAt: 1740000000500 }) })
     const many: AppState['agentStatusByPaneKey'] = {}
     for (let index = 0; index < 12; index += 1) {
       many[`tab-${index}:leaf-0`] = makeEntry(index)
@@ -145,4 +154,39 @@ describe('mobile agent-status projection equivalence', () => {
     expect([...projected].sort()).toEqual([...localeCompareOrderedEntries].sort())
     expect(projected).toHaveLength(localeCompareOrderedEntries.length)
   })
+
+  it('republishes a verdict change that leaves the interrupted flag as it was', () => {
+    resetRuntimeMobileAgentStatusProjectionCacheForTests()
+    const project = (live: 'success' | 'failure', history: 'success' | 'failure'): string =>
+      buildRuntimeMobileAgentStatusProjectionForTests({
+        'tab-0:leaf-0': makeEntry(0, {
+          state: 'done',
+          mainAgent: { state: 'done', outcome: live, stateStartedAt: 1740000000000 },
+          stateHistory: [
+            {
+              state: 'done',
+              prompt: 'p',
+              startedAt: 1,
+              mainAgent: { state: 'done', outcome: history, stateStartedAt: 1 }
+            }
+          ]
+        })
+      })
+    expect(project('failure', 'success')).not.toBe(project('success', 'success'))
+    expect(project('success', 'failure')).not.toBe(project('success', 'success'))
+  })
+
+  it('republishes a main agent failing while its subagents keep the row working', () => {
+    resetRuntimeMobileAgentStatusProjectionCacheForTests()
+    const project = (outcome?: 'failure', stateStartedAt = 1740000000000): string =>
+      buildRuntimeMobileAgentStatusProjectionForTests({
+        'tab-0:leaf-0': makeEntry(0, {
+          state: 'working',
+          mainAgent: { state: 'done', ...(outcome ? { outcome } : {}), stateStartedAt }
+        })
+      })
+    expect(project('failure')).not.toBe(project())
+    // The main agent's own clock dates the failure on mobile, so moving it republishes too.
+    expect(project('failure', 1740000001000)).not.toBe(project('failure'))
+  })
 })
diff --git a/src/renderer/src/runtime/sync-runtime-graph-projection-hot-path.test.ts b/src/renderer/src/runtime/sync-runtime-graph-projection-hot-path.test.ts
index 1a163ada0a8..587e30a769e 100644
--- a/src/renderer/src/runtime/sync-runtime-graph-projection-hot-path.test.ts
+++ b/src/renderer/src/runtime/sync-runtime-graph-projection-hot-path.test.ts
@@ -35,6 +35,11 @@ const { AGENT_STATUS_SYNC_UPDATED_AT_BUCKET_MS } = await import('./sync-runtime-
 
 // ── Reference implementations: the pre-change bodies, kept verbatim ────────────────────
 
+type MainAgentStatus = AppState['agentStatusByPaneKey'][string]['mainAgent']
+function mainAgentKey(mainAgent: MainAgentStatus) {
+  return mainAgent ? [mainAgent.state, mainAgent.outcome ?? null, mainAgent.stateStartedAt] : null
+}
+
 function referenceEditorDraftsProjection(editorDrafts: AppState['editorDrafts']): string {
   return JSON.stringify(
     Object.fromEntries(
@@ -106,20 +111,23 @@ function referenceAgentStatusProjection(map: AppState['agentStatusByPaneKey']):
         prompt: entry.prompt,
         updatedAtBucket: Math.floor(entry.updatedAt / AGENT_STATUS_SYNC_UPDATED_AT_BUCKET_MS),
         stateStartedAt: entry.stateStartedAt,
+        turnStartedAt: entry.turnStartedAt ?? null,
         agentType: entry.agentType ?? null,
         terminalTitle: entry.terminalTitle ?? null,
         stateHistory: entry.stateHistory.map((history) => ({
           state: history.state,
           prompt: history.prompt,
           startedAt: history.startedAt,
-          interrupted: history.interrupted ?? null
+          interrupted: history.interrupted ?? null,
+          mainAgent: mainAgentKey(history.mainAgent)
         })),
         toolName: entry.toolName ?? null,
         toolInput: entry.toolInput ?? null,
         interactivePrompt: entry.interactivePrompt ?? null,
         lastAssistantMessage: entry.lastAssistantMessage ?? null,
         lastAssistantMessageIsToolOutput: entry.lastAssistantMessageIsToolOutput ?? null,
-        interrupted: entry.interrupted ?? null
+        interrupted: entry.interrupted ?? null,
+        mainAgent: mainAgentKey(entry.mainAgent)
       }))
   )
 }
diff --git a/src/renderer/src/runtime/sync-runtime-graph-terminal-registration-ownership.test.ts b/src/renderer/src/runtime/sync-runtime-graph-terminal-registration-ownership.test.ts
index 97d17f3fc47..410e8dea763 100644
--- a/src/renderer/src/runtime/sync-runtime-graph-terminal-registration-ownership.test.ts
+++ b/src/renderer/src/runtime/sync-runtime-graph-terminal-registration-ownership.test.ts
@@ -1,3 +1,4 @@
+// @vitest-environment happy-dom
 import { describe, expect, it, vi } from 'vitest'
 import {
   buildMobileSessionTabSnapshots,
@@ -77,11 +78,24 @@ describe('runtime terminal registration ownership', () => {
   })
 
   it('focuses the requested worktree when tab ids collide', () => {
-    const focusA = vi.fn()
-    const focusB = vi.fn()
+    const textareaA = document.createElement('textarea')
+    const textareaB = document.createElement('textarea')
+    document.body.append(textareaA, textareaB)
+    const focusA = vi.fn(() => textareaA.focus())
+    const focusB = vi.fn(() => textareaB.focus())
     const container = { querySelector: () => null }
-    const paneA = { id: 1, leafId: LEAF_A, container, terminal: { focus: focusA } }
-    const paneB = { id: 1, leafId: LEAF_B, container, terminal: { focus: focusB } }
+    const paneA = {
+      id: 1,
+      leafId: LEAF_A,
+      container,
+      terminal: { focus: focusA, textarea: textareaA }
+    }
+    const paneB = {
+      id: 1,
+      leafId: LEAF_B,
+      container,
+      terminal: { focus: focusB, textarea: textareaB }
+    }
     const managerA = {
       getPanes: () => [paneA],
       getActivePane: () => paneA,
@@ -113,9 +127,12 @@ describe('runtime terminal registration ownership', () => {
     try {
       expect(focusRuntimeTerminalSurface(TAB_ID, null, WORKTREE_B)).toBe(true)
       expect(focusB).toHaveBeenCalledOnce()
+      expect(document.activeElement).toBe(textareaB)
       expect(focusA).not.toHaveBeenCalled()
       expect(focusRuntimeTerminalSurface(TAB_ID)).toBe(false)
     } finally {
+      textareaA.remove()
+      textareaB.remove()
       unregisterB()
       unregisterA()
     }
diff --git a/src/renderer/src/runtime/sync-runtime-graph.ts b/src/renderer/src/runtime/sync-runtime-graph.ts
index 30504422fac..8267320e430 100644
--- a/src/renderer/src/runtime/sync-runtime-graph.ts
+++ b/src/renderer/src/runtime/sync-runtime-graph.ts
@@ -82,8 +82,12 @@ export function focusRuntimeTerminalSurface(
     if (activePaneIsCoveredByNativeChat(manager)) {
       return true
     }
-    manager.getActivePane()?.terminal.focus()
-    return true
+    const pane = manager.getActivePane()
+    if (!pane) {
+      return false
+    }
+    pane.terminal.focus()
+    return !!pane.terminal.textarea && document.activeElement === pane.terminal.textarea
   }
   const resolution = resolveLeafIdForManager(tabId, leafId, manager)
   if (resolution.status !== 'resolved') {
diff --git a/src/renderer/src/runtime/sync-runtime-graph/agent-status-projection.ts b/src/renderer/src/runtime/sync-runtime-graph/agent-status-projection.ts
index 16c188edef5..25b65573839 100644
--- a/src/renderer/src/runtime/sync-runtime-graph/agent-status-projection.ts
+++ b/src/renderer/src/runtime/sync-runtime-graph/agent-status-projection.ts
@@ -1,7 +1,12 @@
 import type { AppState } from '@/store/types'
+import type { AgentMainAgentStatus } from '../../../../shared/main-agent-status'
 import { AGENT_STATUS_SYNC_UPDATED_AT_BUCKET_MS, graphState } from './graph-state'
 import type { AgentStatusProjectionCacheEntry } from './types'
 
+function mainAgentKey(mainAgent: AgentMainAgentStatus | undefined) {
+  return mainAgent ? [mainAgent.state, mainAgent.outcome ?? null, mainAgent.stateStartedAt] : null
+}
+
 function serializeAgentStatusEntry(
   paneKey: string,
   entry: AppState['agentStatusByPaneKey'][string]
@@ -14,13 +19,15 @@ function serializeAgentStatusEntry(
     prompt: entry.prompt,
     updatedAtBucket: Math.floor(entry.updatedAt / AGENT_STATUS_SYNC_UPDATED_AT_BUCKET_MS),
     stateStartedAt: entry.stateStartedAt,
+    turnStartedAt: entry.turnStartedAt ?? null,
     agentType: entry.agentType ?? null,
     terminalTitle: entry.terminalTitle ?? null,
     stateHistory: entry.stateHistory.map((history) => ({
       state: history.state,
       prompt: history.prompt,
       startedAt: history.startedAt,
-      interrupted: history.interrupted ?? null
+      interrupted: history.interrupted ?? null,
+      mainAgent: mainAgentKey(history.mainAgent)
     })),
     toolName: entry.toolName ?? null,
     toolInput: entry.toolInput ?? null,
@@ -28,7 +35,9 @@ function serializeAgentStatusEntry(
     interactivePrompt: entry.interactivePrompt ?? null,
     lastAssistantMessage: entry.lastAssistantMessage ?? null,
     lastAssistantMessageIsToolOutput: entry.lastAssistantMessageIsToolOutput ?? null,
-    interrupted: entry.interrupted ?? null
+    interrupted: entry.interrupted ?? null,
+    // A failure changes the verdict and leaves `interrupted` as it was.
+    mainAgent: mainAgentKey(entry.mainAgent)
   })
 }
 
diff --git a/src/renderer/src/runtime/sync-runtime-graph/mobile-session-terminal-tabs.ts b/src/renderer/src/runtime/sync-runtime-graph/mobile-session-terminal-tabs.ts
index ac88ad17eb6..ce3df5a71f0 100644
--- a/src/renderer/src/runtime/sync-runtime-graph/mobile-session-terminal-tabs.ts
+++ b/src/renderer/src/runtime/sync-runtime-graph/mobile-session-terminal-tabs.ts
@@ -54,6 +54,7 @@ export function buildMobileTerminalSurfaceTabs(
     }),
     activeLeafId,
     expandedLeafId: sanitizedSavedLayout?.expandedLeafId ?? null,
+    ...(sanitizedSavedLayout?.chatLeafId ? { chatLeafId: sanitizedSavedLayout.chatLeafId } : {}),
     ...(Object.keys(savedPtyIdsByLeafId).length > 0 ? { ptyIdsByLeafId: savedPtyIdsByLeafId } : {}),
     ...(sanitizedSavedLayout?.titlesByLeafId
       ? { titlesByLeafId: sanitizedSavedLayout.titlesByLeafId }
diff --git a/src/renderer/src/runtime/web-runtime-browser-creation-context.ts b/src/renderer/src/runtime/web-runtime-browser-creation-context.ts
index d82f287b475..279c9169afc 100644
--- a/src/renderer/src/runtime/web-runtime-browser-creation-context.ts
+++ b/src/renderer/src/runtime/web-runtime-browser-creation-context.ts
@@ -37,6 +37,8 @@ export type CreateWebRuntimeSessionBrowserTabArgs = {
   profileId?: string | null
   targetGroupId?: string
   clientTargetGroupId?: string
+  /** Client-only unified tab id the staged row follows; never sent to the host. */
+  clientAfterTabId?: string
   clientTargetGroupCreated?: boolean
   focusOnCreate?: boolean
   /** Wait until a renderer-backed host can publish the new page in its session snapshot. */
@@ -109,6 +111,18 @@ export function createWebRuntimeBrowserCreationContext(
   }
 }
 
+/**
+ * The client group this create is steered to. With an anchor only an explicit client destination
+ * counts; a host-facing targetGroupId would otherwise freeze the row away from the source's group.
+ */
+export function resolveWebRuntimeBrowserClientTargetGroupId(
+  args: CreateWebRuntimeSessionBrowserTabArgs
+): string | undefined {
+  return args.clientAfterTabId
+    ? args.clientTargetGroupId
+    : (args.clientTargetGroupId ?? args.targetGroupId)
+}
+
 export function stageWebRuntimeBrowserCreation(context: WebRuntimeBrowserCreationContext): void {
   const { args, environmentId, intentOwner, provisionalPageId, shouldFocusOnCreate } = context
   throwIfE2eWebRuntimeBrowserCapabilityUnavailable()
@@ -125,6 +139,7 @@ export function stageWebRuntimeBrowserCreation(context: WebRuntimeBrowserCreatio
   if (context.shouldSelectWorktree) {
     selectWebRuntimeSessionBrowserWorktree(args.worktreeId, environmentId)
   }
+  const stagedTargetGroupId = resolveWebRuntimeBrowserClientTargetGroupId(args)
   // Why: everything below this point is a host round-trip; stage the tab first so the strip
   // reacts to the click instead of to the runtime.
   context.staged = stageWebRuntimeBrowserTab({
@@ -135,9 +150,8 @@ export function stageWebRuntimeBrowserCreation(context: WebRuntimeBrowserCreatio
     ...(args.url !== undefined ? { url: args.url } : {}),
     ...(args.stagedTitle !== undefined ? { title: args.stagedTitle } : {}),
     ...(args.profileId !== undefined ? { profileId: args.profileId } : {}),
-    ...((args.clientTargetGroupId ?? args.targetGroupId)
-      ? { targetGroupId: (args.clientTargetGroupId ?? args.targetGroupId) as string }
-      : {}),
+    ...(stagedTargetGroupId ? { targetGroupId: stagedTargetGroupId } : {}),
+    ...(args.clientAfterTabId ? { afterTabId: args.clientAfterTabId } : {}),
     ...(args.stagedFocusAddressBar !== undefined
       ? { focusAddressBar: args.stagedFocusAddressBar }
       : {}),
diff --git a/src/renderer/src/runtime/web-runtime-browser-creation-placement-test-rig.ts b/src/renderer/src/runtime/web-runtime-browser-creation-placement-test-rig.ts
new file mode 100644
index 00000000000..6eacef429e3
--- /dev/null
+++ b/src/renderer/src/runtime/web-runtime-browser-creation-placement-test-rig.ts
@@ -0,0 +1,244 @@
+import { vi } from 'vitest'
+import type { BrowserPage, BrowserWorkspace } from '../../../shared/browser-workspace-types'
+import type { RuntimeMobileSessionTabsResult } from '../../../shared/runtime-types'
+import type { Tab, TabGroup } from '../../../shared/tab-types'
+import type { ExecutionHostId } from '../../../shared/execution-host'
+import { useAppStore } from '../store'
+import type { AppState } from '../store/types'
+import { applyWebSessionTabsSnapshot } from './web-session-tabs-sync'
+import { ENV, NOW, WT, makeSnapshot } from './web-session-tabs-sync-test-harness'
+
+export const HOST: ExecutionHostId = `runtime:${ENV}`
+export const G1 = 'group-1'
+export const G2 = 'group-2'
+
+export type MirroredRow = { unifiedTabId: string; workspaceId: string; pageId: string }
+
+export function mirroredRow(name: string): MirroredRow {
+  return {
+    unifiedTabId: `${name}-tab`,
+    workspaceId: `${name}-workspace`,
+    pageId: `${name}-page`
+  }
+}
+
+export const SOURCE = mirroredRow('source')
+export const AFTER = mirroredRow('after')
+export const OTHER = mirroredRow('other')
+
+function workspace(row: MirroredRow): BrowserWorkspace {
+  return {
+    id: row.workspaceId,
+    worktreeId: WT,
+    activePageId: row.pageId,
+    pageIds: [row.pageId],
+    url: 'https://example.com/',
+    title: 'Example',
+    loading: false,
+    faviconUrl: null,
+    canGoBack: false,
+    canGoForward: false,
+    loadError: null,
+    createdAt: NOW
+  }
+}
+
+function page(row: MirroredRow): BrowserPage {
+  return {
+    id: row.pageId,
+    workspaceId: row.workspaceId,
+    worktreeId: WT,
+    url: 'https://example.com/',
+    title: 'Example',
+    loading: false,
+    faviconUrl: null,
+    canGoBack: false,
+    canGoForward: false,
+    loadError: null,
+    createdAt: NOW,
+    browserRuntimeEnvironmentId: ENV,
+    viewportPresetId: null
+  }
+}
+
+function unifiedTab(row: MirroredRow, groupId: string, sortOrder: number): Tab {
+  return {
+    id: row.unifiedTabId,
+    entityId: row.workspaceId,
+    groupId,
+    worktreeId: WT,
+    executionHostId: HOST,
+    contentType: 'browser',
+    label: 'Example',
+    customLabel: null,
+    color: null,
+    sortOrder,
+    createdAt: NOW,
+    lastFocusedAt: NOW - 10,
+    isPreview: false,
+    isPinned: false
+  }
+}
+
+export function runtimeStatusesFor(
+  capabilities: string[]
+): AppState['runtimeStatusByEnvironmentId'] {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: creation reads only status.capabilities from this entry.
+  return new Map([
+    [ENV, { status: { capabilities }, checkedAt: 1 }]
+  ]) as AppState['runtimeStatusByEnvironmentId']
+}
+
+/** G1 holds SOURCE then AFTER with SOURCE active; G2 holds OTHER and is the focused group. */
+export function seedPairedWorktree(): void {
+  const rows = [SOURCE, AFTER, OTHER]
+  const groups: TabGroup[] = [
+    {
+      id: G1,
+      worktreeId: WT,
+      activeTabId: SOURCE.unifiedTabId,
+      tabOrder: [SOURCE.unifiedTabId, AFTER.unifiedTabId],
+      recentTabIds: [SOURCE.unifiedTabId]
+    },
+    {
+      id: G2,
+      worktreeId: WT,
+      activeTabId: OTHER.unifiedTabId,
+      tabOrder: [OTHER.unifiedTabId],
+      recentTabIds: [OTHER.unifiedTabId]
+    }
+  ]
+  useAppStore.setState({
+    activeWorktreeId: WT,
+    activeWorkspaceExecutionHostId: HOST,
+    runtimeStatusByEnvironmentId: runtimeStatusesFor([
+      'browser.screencast.v1',
+      'browser.tab-create-known-id.v1'
+    ]),
+    browserTabsByWorktree: { [WT]: rows.map(workspace) },
+    browserPagesByWorkspace: Object.fromEntries(rows.map((row) => [row.workspaceId, [page(row)]])),
+    remoteBrowserPageHandlesByPageId: Object.fromEntries(
+      rows.map((row) => [row.pageId, { environmentId: ENV, remotePageId: row.pageId }])
+    ),
+    unifiedTabsByWorktree: {
+      [WT]: [unifiedTab(SOURCE, G1, 0), unifiedTab(AFTER, G1, 1), unifiedTab(OTHER, G2, 0)]
+    },
+    groupsByWorktree: { [WT]: groups },
+    activeGroupIdByWorktree: { [WT]: G2 },
+    layoutByWorktree: {
+      [WT]: {
+        type: 'split',
+        direction: 'horizontal',
+        first: { type: 'leaf', groupId: G1 },
+        second: { type: 'leaf', groupId: G2 }
+      }
+    },
+    activeTabType: 'browser',
+    activeTabTypeByWorktree: { [WT]: 'browser' },
+    activeBrowserTabId: OTHER.workspaceId,
+    activeBrowserTabIdByWorktree: { [WT]: OTHER.workspaceId },
+    tabBarOrderByWorktree: {}
+  })
+}
+
+function hostBrowserTab(
+  remotePageId: string,
+  hostWorkspaceId = `host-workspace-${remotePageId}`
+): RuntimeMobileSessionTabsResult['tabs'][number] {
+  return {
+    type: 'browser',
+    id: `host-tab-${remotePageId}`,
+    title: 'Example',
+    browserWorkspaceId: hostWorkspaceId,
+    browserPageId: remotePageId,
+    url: 'https://example.com/',
+    loading: false,
+    canGoBack: false,
+    canGoForward: false,
+    isActive: false
+  }
+}
+
+/** The host's page list; each publication mirrors every page it holds. */
+export const hostPages: string[] = []
+let snapshotVersion = 1
+
+export function publishHostSnapshot(): void {
+  snapshotVersion += 1
+  const snapshot = makeSnapshot(
+    [SOURCE.pageId, AFTER.pageId, OTHER.pageId, ...hostPages].map((id) => hostBrowserTab(id)),
+    { snapshotVersion, activeTabType: 'browser', activeTabId: null }
+  )
+  useAppStore.setState((state) =>
+    applyWebSessionTabsSnapshot(state, snapshot, ENV, NOW + snapshotVersion)
+  )
+}
+
+export function resetHostPages(): void {
+  hostPages.length = 0
+  snapshotVersion = 1
+}
+
+type Deferred = {
+  params: { page?: string; targetGroupId?: string } & Record<string, unknown>
+  resolve: (browserPageId?: string) => void
+  reject: (error: Error) => void
+}
+
+/** Every browser.tabCreate waits here until the test answers it. */
+export const pendingCreates: Deferred[] = []
+
+export function installRuntimeTransport(): ReturnType<typeof vi.fn> {
+  pendingCreates.length = 0
+  const call = vi.fn(
+    (request: { method: string; params: Deferred['params'] }) =>
+      new Promise((resolve, reject) => {
+        if (request.method === 'browser.tabCreate') {
+          pendingCreates.push({
+            params: request.params,
+            resolve: (browserPageId = request.params.page) => {
+              if (browserPageId) {
+                hostPages.push(browserPageId)
+              }
+              resolve({ id: 'create', ok: true, result: { browserPageId } })
+            },
+            reject
+          })
+          return
+        }
+        resolve({ id: request.method, ok: true, result: { closed: true } })
+      })
+  )
+  vi.stubGlobal('window', {
+    api: {
+      runtimeEnvironments: {
+        call,
+        prepareBrowserClientHostPlacement: vi.fn().mockResolvedValue({ kind: 'server' })
+      }
+    }
+  })
+  return call
+}
+
+export function groupOrder(groupId: string): string[] {
+  return useAppStore.getState().groupsByWorktree[WT]?.find((g) => g.id === groupId)?.tabOrder ?? []
+}
+
+export function wrapperForRemotePage(remotePageId: string): Tab | undefined {
+  const state = useAppStore.getState()
+  const workspace = (state.browserTabsByWorktree[WT] ?? []).find((candidate) =>
+    (state.browserPagesByWorkspace[candidate.id] ?? []).some(
+      (candidatePage) =>
+        state.remoteBrowserPageHandlesByPageId[candidatePage.id]?.remotePageId === remotePageId
+    )
+  )
+  return (state.unifiedTabsByWorktree[WT] ?? []).find(
+    (tab) => tab.contentType === 'browser' && tab.entityId === workspace?.id
+  )
+}
+
+export async function flushMicrotasks(): Promise<void> {
+  for (let index = 0; index < 20; index += 1) {
+    await Promise.resolve()
+  }
+}
diff --git a/src/renderer/src/runtime/web-runtime-browser-creation-placement.test.ts b/src/renderer/src/runtime/web-runtime-browser-creation-placement.test.ts
new file mode 100644
index 00000000000..45cd7433da8
--- /dev/null
+++ b/src/renderer/src/runtime/web-runtime-browser-creation-placement.test.ts
@@ -0,0 +1,343 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as SnapshotModule from './web-runtime-session-snapshot'
+import { useAppStore } from '../store'
+import { createWebRuntimeSessionBrowserTab } from './web-runtime-browser-creation'
+import { resetWebSessionBrowserPlacementsForTests } from './web-session-browser-placement'
+import { resetWebSessionTabsSyncTestState, ENV, WT } from './web-session-tabs-sync-test-harness'
+import {
+  AFTER,
+  G1,
+  G2,
+  HOST,
+  OTHER,
+  SOURCE,
+  flushMicrotasks,
+  groupOrder,
+  hostPages,
+  installRuntimeTransport,
+  pendingCreates,
+  publishHostSnapshot,
+  resetHostPages,
+  runtimeStatusesFor,
+  seedPairedWorktree,
+  wrapperForRemotePage
+} from './web-runtime-browser-creation-placement-test-rig'
+
+vi.mock('./web-runtime-session-snapshot', async (importOriginal) => ({
+  ...(await importOriginal<typeof SnapshotModule>()),
+  refreshWebRuntimeSessionTabsSnapshot: vi.fn(async () => publishHostSnapshot())
+}))
+
+function openLinkFromSource(
+  overrides: Partial<Parameters<typeof createWebRuntimeSessionBrowserTab>[0]> = {}
+): Promise<boolean> {
+  return createWebRuntimeSessionBrowserTab({
+    worktreeId: WT,
+    environmentId: ENV,
+    url: 'https://example.com/link',
+    clientAfterTabId: SOURCE.unifiedTabId,
+    focusOnCreate: false,
+    selectWorktree: false,
+    placementPreference: 'server',
+    ...overrides
+  })
+}
+
+function g1Group() {
+  return useAppStore.getState().groupsByWorktree[WT]?.find((group) => group.id === G1)
+}
+
+describe('paired browser creation placement', () => {
+  let runtimeCall: ReturnType<typeof installRuntimeTransport>
+
+  beforeEach(() => {
+    resetWebSessionTabsSyncTestState()
+    resetWebSessionBrowserPlacementsForTests()
+    resetHostPages()
+    seedPairedWorktree()
+    runtimeCall = installRuntimeTransport()
+  })
+
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  it('stages each background link after its source before any await and keeps source, 3, 2, 1', async () => {
+    const creates = [openLinkFromSource(), openLinkFromSource(), openLinkFromSource()]
+    const staged = pendingCreates.map((create) => create.params.page ?? '')
+    // Why no await above: the rows exist off the synchronous part of each call.
+    const stagedIds = staged.map((pageId) => wrapperForRemotePage(pageId)!.id)
+    expect(groupOrder(G1)).toEqual([
+      SOURCE.unifiedTabId,
+      stagedIds[2],
+      stagedIds[1],
+      stagedIds[0],
+      AFTER.unifiedTabId
+    ])
+
+    for (const index of [2, 0, 1]) {
+      pendingCreates[index].resolve()
+      await flushMicrotasks()
+    }
+    await expect(Promise.all(creates)).resolves.toEqual([true, true, true])
+
+    expect(groupOrder(G1)).toEqual([
+      SOURCE.unifiedTabId,
+      stagedIds[2],
+      stagedIds[1],
+      stagedIds[0],
+      AFTER.unifiedTabId
+    ])
+    for (const pageId of staged) {
+      expect(wrapperForRemotePage(pageId)?.lastFocusedAt).toBeUndefined()
+    }
+    const state = useAppStore.getState()
+    expect(g1Group()).toMatchObject({
+      activeTabId: SOURCE.unifiedTabId,
+      recentTabIds: [SOURCE.unifiedTabId]
+    })
+    expect(state.activeGroupIdByWorktree[WT]).toBe(G2)
+    expect(state.activeBrowserTabIdByWorktree[WT]).toBe(OTHER.workspaceId)
+    expect(
+      state.unifiedTabsByWorktree[WT]?.find((tab) => tab.id === SOURCE.unifiedTabId)?.lastFocusedAt
+    ).toBeDefined()
+    // Repeated snapshots neither replay the anchor nor manufacture visits.
+    publishHostSnapshot()
+    expect(groupOrder(G1)[1]).toBe(stagedIds[2])
+    expect(g1Group()?.recentTabIds).toEqual([SOURCE.unifiedTabId])
+  })
+
+  it('keeps the host-facing RPC free of the client anchor', async () => {
+    void openLinkFromSource({ targetGroupId: 'host-group' })
+    expect(pendingCreates[0].params).not.toHaveProperty('clientAfterTabId')
+    expect(pendingCreates[0].params).not.toHaveProperty('afterTabId')
+    expect(pendingCreates[0].params).toMatchObject({
+      targetGroupId: 'host-group',
+      activate: false,
+      navigation: 'caller'
+    })
+    // A host-facing group never freezes the anchored staged row out of the source's group.
+    expect(groupOrder(G1)[1]).toBe(wrapperForRemotePage(pendingCreates[0].params.page!)?.id)
+    expect(wrapperForRemotePage(pendingCreates[0].params.page!)?.executionHostId).toBe(HOST)
+    pendingCreates[0].resolve()
+    await flushMicrotasks()
+    expect(runtimeCall).toHaveBeenCalledTimes(1)
+  })
+
+  it('appends Group New Browser Tab staging to the invoking group without an anchor', async () => {
+    const create = createWebRuntimeSessionBrowserTab({
+      worktreeId: WT,
+      environmentId: ENV,
+      url: 'about:blank',
+      targetGroupId: G1,
+      clientTargetGroupId: G1,
+      placementPreference: 'server'
+    })
+    const pageId = pendingCreates[0].params.page!
+    const created = wrapperForRemotePage(pageId)!.id
+    expect(groupOrder(G1)).toEqual([SOURCE.unifiedTabId, AFTER.unifiedTabId, created])
+    expect(useAppStore.getState().activeGroupIdByWorktree[WT]).toBe(G1)
+    pendingCreates[0].resolve()
+    await expect(create).resolves.toBe(true)
+    expect(groupOrder(G1)).toEqual([SOURCE.unifiedTabId, AFTER.unifiedTabId, created])
+  })
+
+  it('stages the store Group New Browser Tab command before its first await', async () => {
+    useAppStore.setState({
+      browserDefaultUrl: 'about:blank',
+      repos: [
+        {
+          id: 'repo',
+          path: '/repo',
+          displayName: 'Repo',
+          badgeColor: '#000000',
+          addedAt: 1,
+          connectionId: null,
+          executionHostId: HOST
+        }
+      ],
+      worktreesByRepo: {
+        repo: [
+          {
+            id: WT,
+            repoId: 'repo',
+            path: '/worktree',
+            head: 'abc',
+            branch: 'main',
+            isBare: false,
+            isMainWorktree: false,
+            displayName: 'Worktree',
+            comment: '',
+            linkedIssue: null,
+            linkedPR: null,
+            linkedLinearIssue: null,
+            isArchived: false,
+            isUnread: false,
+            isPinned: false,
+            sortOrder: 0,
+            lastActivityAt: 1
+          }
+        ]
+      }
+    })
+    const open = useAppStore.getState().openNewBrowserTabInActiveWorkspace(G1)
+    const order = groupOrder(G1)
+    expect(order.slice(0, 2)).toEqual([SOURCE.unifiedTabId, AFTER.unifiedTabId])
+    expect(order).toHaveLength(3)
+    const created = order[2]
+    await flushMicrotasks()
+    expect(pendingCreates[0].params).toMatchObject({ targetGroupId: G1 })
+    expect(wrapperForRemotePage(pendingCreates[0].params.page!)?.id).toBe(created)
+    pendingCreates[0].resolve()
+    await open
+    expect(groupOrder(G1)).toEqual([SOURCE.unifiedTabId, AFTER.unifiedTabId, created])
+  })
+
+  it('fills an empty group structurally without adoption recording a visit', async () => {
+    const state = useAppStore.getState()
+    useAppStore.setState({
+      groupsByWorktree: {
+        [WT]: [
+          ...state.groupsByWorktree[WT]!,
+          { id: 'group-3', worktreeId: WT, activeTabId: null, tabOrder: [], recentTabIds: [] }
+        ]
+      },
+      layoutByWorktree: {
+        [WT]: {
+          type: 'split',
+          direction: 'horizontal',
+          first: state.layoutByWorktree[WT]!,
+          second: { type: 'leaf', groupId: 'group-3' }
+        }
+      }
+    })
+    const create = createWebRuntimeSessionBrowserTab({
+      worktreeId: WT,
+      environmentId: ENV,
+      url: 'https://example.com/',
+      clientTargetGroupId: 'group-3',
+      focusOnCreate: false,
+      selectWorktree: false,
+      placementPreference: 'server'
+    })
+    const created = wrapperForRemotePage(pendingCreates[0].params.page!)!.id
+    pendingCreates[0].resolve()
+    await expect(create).resolves.toBe(true)
+    publishHostSnapshot()
+    expect(
+      useAppStore.getState().groupsByWorktree[WT]?.find((group) => group.id === 'group-3')
+    ).toMatchObject({ activeTabId: created, tabOrder: [created], recentTabIds: [] })
+    expect(useAppStore.getState().activeGroupIdByWorktree[WT]).toBe(G2)
+  })
+
+  it('keeps a staged row the user dragged elsewhere through adoption', async () => {
+    const create = openLinkFromSource()
+    const pageId = pendingCreates[0].params.page!
+    const staged = wrapperForRemotePage(pageId)!.id
+    useAppStore.getState().moveUnifiedTabToGroup(staged, G2)
+    pendingCreates[0].resolve()
+    await expect(create).resolves.toBe(true)
+    expect(groupOrder(G2)).toContain(staged)
+    expect(groupOrder(G1)).toEqual([SOURCE.unifiedTabId, AFTER.unifiedTabId])
+  })
+
+  it('does not reclaim focus after the user selects another tab mid-create', async () => {
+    const create = openLinkFromSource({ focusOnCreate: true })
+    const staged = wrapperForRemotePage(pendingCreates[0].params.page!)!.id
+    expect(g1Group()?.activeTabId).toBe(staged)
+    useAppStore.getState().activateTab(OTHER.unifiedTabId)
+    useAppStore.getState().activateTab(SOURCE.unifiedTabId)
+    pendingCreates[0].resolve()
+    await expect(create).resolves.toBe(true)
+    publishHostSnapshot()
+    expect(g1Group()?.activeTabId).toBe(SOURCE.unifiedTabId)
+    expect(useAppStore.getState().activeWorktreeId).toBe(WT)
+  })
+
+  it('stages before a deferred hosting preparation resolves', async () => {
+    let answerPreparation!: (placement: { kind: 'server' }) => void
+    const prepare = vi.fn(
+      () =>
+        new Promise<{ kind: 'server' }>((resolve) => {
+          answerPreparation = resolve
+        })
+    )
+    vi.stubGlobal('window', {
+      api: {
+        runtimeEnvironments: { call: runtimeCall, prepareBrowserClientHostPlacement: prepare }
+      }
+    })
+    const create = openLinkFromSource({ placementPreference: 'auto' })
+    const stagedRows = groupOrder(G1)
+    expect(stagedRows).toHaveLength(3)
+    useAppStore.getState().focusGroup(WT, G2)
+    await flushMicrotasks()
+    answerPreparation({ kind: 'server' })
+    await flushMicrotasks()
+    pendingCreates[0].resolve()
+    await expect(create).resolves.toBe(true)
+    expect(groupOrder(G1)).toEqual(stagedRows)
+    expect(useAppStore.getState().activeGroupIdByWorktree[WT]).toBe(G2)
+  })
+
+  it('rehomes a staged row in place when an older host answers with its own id first', async () => {
+    useAppStore.setState({
+      runtimeStatusByEnvironmentId: runtimeStatusesFor(['browser.screencast.v1'])
+    })
+    const create = openLinkFromSource()
+    const staged = groupOrder(G1)[1]
+    expect(pendingCreates[0].params.page).toBeUndefined()
+    pendingCreates[0].resolve('host-minted-page')
+    await expect(create).resolves.toBe(true)
+    expect(groupOrder(G1)).toEqual([SOURCE.unifiedTabId, staged, AFTER.unifiedTabId])
+    expect(wrapperForRemotePage('host-minted-page')?.id).toBe(staged)
+  })
+
+  it('keeps the mirrored row and discards the stage when an older host mirrors first', async () => {
+    useAppStore.setState({
+      runtimeStatusByEnvironmentId: runtimeStatusesFor(['browser.screencast.v1'])
+    })
+    const create = openLinkFromSource()
+    const staged = groupOrder(G1)[1]
+    hostPages.push('host-minted-page')
+    publishHostSnapshot()
+    hostPages.pop()
+    pendingCreates[0].resolve('host-minted-page')
+    await expect(create).resolves.toBe(true)
+    const mirrored = wrapperForRemotePage('host-minted-page')!
+    const browserRows = useAppStore
+      .getState()
+      .unifiedTabsByWorktree[WT]!.filter((tab) => tab.contentType === 'browser')
+    expect(browserRows).toHaveLength(4)
+    expect(mirrored.id).not.toBe(staged)
+    expect(groupOrder(G1)).not.toContain(staged)
+    // Compatibility limit: exact adjacency is not replayed onto the mirrored row.
+    publishHostSnapshot()
+    expect(useAppStore.getState().unifiedTabsByWorktree[WT]).toHaveLength(4)
+  })
+
+  it('falls back to ordinary adoption without adjacency when staging fails', async () => {
+    const createBrowserTab = useAppStore.getState().createBrowserTab
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    useAppStore.setState({
+      createBrowserTab: () => {
+        throw new Error('staging refused')
+      }
+    })
+    try {
+      const create = openLinkFromSource()
+      expect(groupOrder(G1)).toEqual([SOURCE.unifiedTabId, AFTER.unifiedTabId])
+      useAppStore.setState({ createBrowserTab })
+      pendingCreates[0].resolve()
+      await expect(create).resolves.toBe(true)
+      const adopted = wrapperForRemotePage(pendingCreates[0].params.page!)
+      expect(adopted).toBeDefined()
+      expect(
+        useAppStore.getState().unifiedTabsByWorktree[WT]!.filter((tab) => tab.id === adopted!.id)
+      ).toHaveLength(1)
+      expect(groupOrder(G1).indexOf(adopted!.id)).not.toBe(1)
+    } finally {
+      warn.mockRestore()
+    }
+  })
+})
diff --git a/src/renderer/src/runtime/web-runtime-browser-creation.ts b/src/renderer/src/runtime/web-runtime-browser-creation.ts
index 99ad27d0adb..abb119fe915 100644
--- a/src/renderer/src/runtime/web-runtime-browser-creation.ts
+++ b/src/renderer/src/runtime/web-runtime-browser-creation.ts
@@ -16,6 +16,7 @@ import {
   completeWebRuntimeBrowserCreation,
   createWebRuntimeBrowserCreationContext,
   rehomeWebRuntimeBrowserCreation,
+  resolveWebRuntimeBrowserClientTargetGroupId,
   restageWebRuntimeBrowserCreation,
   stageWebRuntimeBrowserCreation,
   type CreateWebRuntimeSessionBrowserTabArgs
@@ -30,6 +31,7 @@ import {
 } from './web-runtime-browser-creation-e2e-fault'
 import { isWebRuntimeSessionActive } from './web-runtime-session-environment'
 import { refreshWebRuntimeSessionTabsSnapshot } from './web-runtime-session-snapshot'
+import { registerPairedBrowserTabCreator } from '../store/slices/browser/paired-browser-tab-creator'
 
 export async function createWebRuntimeSessionBrowserTab(
   args: CreateWebRuntimeSessionBrowserTabArgs
@@ -131,6 +133,11 @@ export async function createWebRuntimeSessionBrowserTab(
     if (created.browserPageId !== context.provisionalPageId) {
       rehomeWebRuntimeBrowserCreation(context, created.browserPageId)
     }
+    // Why: a staged row the user moved is judged where it renders now, not where it was requested.
+    const resolveExpectedGroupId = (): string | undefined =>
+      (context.staged
+        ? resolveStagedWebRuntimeBrowserTabGroupId(context.staged, args.worktreeId)
+        : undefined) ?? resolveWebRuntimeBrowserClientTargetGroupId(args)
     try {
       await refreshWebRuntimeSessionTabsSnapshot(environmentId, args.worktreeId, {
         expectedEnvironmentPairingRevision: context.intentOwner.pairingRevision,
@@ -145,18 +152,13 @@ export async function createWebRuntimeSessionBrowserTab(
           environmentId,
           args.worktreeId,
           created.browserPageId,
-          args.clientTargetGroupId ?? args.targetGroupId
+          resolveExpectedGroupId()
         )
       ) {
         throw error
       }
     }
-    const expectedGroupId =
-      (context.staged
-        ? resolveStagedWebRuntimeBrowserTabGroupId(context.staged, args.worktreeId)
-        : undefined) ??
-      args.clientTargetGroupId ??
-      args.targetGroupId
+    const expectedGroupId = resolveExpectedGroupId()
     let materialized = hasMaterializedWebRuntimeBrowserPage(
       useAppStore.getState(),
       environmentId,
@@ -253,3 +255,5 @@ export async function createWebRuntimeSessionBrowserTab(
     return finishWebRuntimeBrowserCreationFailure(context, failure, error)
   }
 }
+
+registerPairedBrowserTabCreator(createWebRuntimeSessionBrowserTab)
diff --git a/src/renderer/src/runtime/web-runtime-browser-tab-staging.ts b/src/renderer/src/runtime/web-runtime-browser-tab-staging.ts
index dee7bad2376..8a7259c4199 100644
--- a/src/renderer/src/runtime/web-runtime-browser-tab-staging.ts
+++ b/src/renderer/src/runtime/web-runtime-browser-tab-staging.ts
@@ -1,4 +1,5 @@
 import { useAppStore } from '../store'
+import { toRuntimeExecutionHostId } from '../../../shared/execution-host'
 
 /** Local rows minted for a browser tab whose host create RPC has not answered yet. */
 export type StagedWebRuntimeBrowserTab = {
@@ -21,6 +22,7 @@ export function stageWebRuntimeBrowserTab(args: {
   title?: string
   profileId?: string | null
   targetGroupId?: string
+  afterTabId?: string
   activate: boolean
   focusAddressBar?: boolean
   clientHosted?: boolean
@@ -31,6 +33,9 @@ export function stageWebRuntimeBrowserTab(args: {
       activate: args.activate,
       browserPageId: args.remotePageId,
       browserRuntimeEnvironmentId: args.environmentId,
+      // Why: the paired runtime owns this row; placement must not borrow the globally selected host.
+      executionHostId: toRuntimeExecutionHostId(args.environmentId),
+      ...(args.afterTabId ? { afterTabId: args.afterTabId } : {}),
       ...(args.title !== undefined ? { title: args.title } : {}),
       ...(args.profileId !== undefined && args.profileId !== null
         ? { sessionProfileId: args.profileId }
diff --git a/src/renderer/src/runtime/web-runtime-session.ts b/src/renderer/src/runtime/web-runtime-session.ts
index d62b48527b3..1ef7cfa5d6d 100644
--- a/src/renderer/src/runtime/web-runtime-session.ts
+++ b/src/renderer/src/runtime/web-runtime-session.ts
@@ -25,7 +25,10 @@ export {
   consumePendingWebRuntimeSplitMirrorTelemetry,
   closeWebRuntimeTerminal,
   updateWebRuntimePaneLayout,
-  setWebRuntimeTabProps,
-  clearWebRuntimeTerminalBuffer
+  setWebRuntimeTabProps
 } from './web-runtime-terminal-actions'
+export {
+  clearWebRuntimeTerminalBuffer,
+  resetWebRuntimeTerminalInputModes
+} from './web-runtime-terminal-buffer-actions'
 export type { WebRuntimeSplitSource } from './web-runtime-split-focus'
diff --git a/src/renderer/src/runtime/web-runtime-terminal-actions.ts b/src/renderer/src/runtime/web-runtime-terminal-actions.ts
index 5c4f7b60781..0ae704640f0 100644
--- a/src/renderer/src/runtime/web-runtime-terminal-actions.ts
+++ b/src/renderer/src/runtime/web-runtime-terminal-actions.ts
@@ -197,6 +197,7 @@ export async function updateWebRuntimePaneLayout(args: {
   tabId: string
   root: TerminalPaneLayoutNode | null
   expandedLeafId: string | null
+  chatLeafId?: string | null
   titlesByLeafId?: Record<string, string>
 }): Promise<boolean> {
   const environmentId =
@@ -216,6 +217,7 @@ export async function updateWebRuntimePaneLayout(args: {
         tabId: hostTabId,
         root: args.root,
         expandedLeafId: args.expandedLeafId,
+        ...(args.chatLeafId !== undefined ? { chatLeafId: args.chatLeafId } : {}),
         ...(args.titlesByLeafId ? { titlesByLeafId: args.titlesByLeafId } : {})
       },
       timeoutMs: 15_000
@@ -277,32 +279,3 @@ export function setWebRuntimeTabProps(args: {
     })
   return true
 }
-
-// Why: local pane.terminal.clear() is undone by the next host snapshot replay; clear the host buffer so it sticks.
-export function clearWebRuntimeTerminalBuffer(ptyId: string | null | undefined): boolean {
-  if (!ptyId) {
-    return false
-  }
-  const remote = parseRemoteRuntimePtyId(ptyId)
-  const environmentId = remote?.environmentId?.trim()
-  if (!remote || !environmentId || !isWebRuntimeSessionActive(environmentId)) {
-    return false
-  }
-  void window.api.runtimeEnvironments
-    .call({
-      selector: environmentId,
-      method: 'terminal.clearBuffer',
-      params: { terminal: remote.handle },
-      timeoutMs: 15_000
-    })
-    .then((response) => {
-      unwrapRuntimeRpcResult(response as RuntimeRpcResponse<{ clear: unknown }>)
-    })
-    .catch((error) => {
-      console.warn(
-        '[web-runtime-session] failed to clear terminal buffer:',
-        error instanceof Error ? error.message : String(error)
-      )
-    })
-  return true
-}
diff --git a/src/renderer/src/runtime/web-runtime-terminal-buffer-actions.ts b/src/renderer/src/runtime/web-runtime-terminal-buffer-actions.ts
new file mode 100644
index 00000000000..8759f2feaeb
--- /dev/null
+++ b/src/renderer/src/runtime/web-runtime-terminal-buffer-actions.ts
@@ -0,0 +1,49 @@
+import { unwrapRuntimeRpcResult } from './runtime-rpc-client'
+import { parseRemoteRuntimePtyId } from './runtime-terminal-stream'
+import { isWebRuntimeSessionActive } from './web-runtime-session-environment'
+
+// Why: local pane.terminal.clear() is undone by the next host snapshot replay; clear the host buffer so it sticks.
+export function clearWebRuntimeTerminalBuffer(ptyId: string | null | undefined): boolean {
+  return callWebRuntimeTerminalAction(ptyId, 'terminal.clearBuffer', 'clear terminal buffer')
+}
+
+// Why: same as clear; the host's snapshot would re-arm the modes on the next replay.
+export function resetWebRuntimeTerminalInputModes(ptyId: string | null | undefined): boolean {
+  return callWebRuntimeTerminalAction(
+    ptyId,
+    'terminal.resetInputModes',
+    'reset terminal input modes'
+  )
+}
+
+function callWebRuntimeTerminalAction(
+  ptyId: string | null | undefined,
+  method: 'terminal.clearBuffer' | 'terminal.resetInputModes',
+  action: string
+): boolean {
+  if (!ptyId) {
+    return false
+  }
+  const remote = parseRemoteRuntimePtyId(ptyId)
+  const environmentId = remote?.environmentId?.trim()
+  if (!remote || !environmentId || !isWebRuntimeSessionActive(environmentId)) {
+    return false
+  }
+  void window.api.runtimeEnvironments
+    .call({
+      selector: environmentId,
+      method,
+      params: { terminal: remote.handle },
+      timeoutMs: 15_000
+    })
+    .then((response) => {
+      unwrapRuntimeRpcResult(response)
+    })
+    .catch((error) => {
+      console.warn(
+        `[web-runtime-session] failed to ${action}:`,
+        error instanceof Error ? error.message : String(error)
+      )
+    })
+  return true
+}
diff --git a/src/renderer/src/runtime/web-session-client-owned-tab-placement.ts b/src/renderer/src/runtime/web-session-client-owned-tab-placement.ts
index 1df1f4df697..564348a105d 100644
--- a/src/renderer/src/runtime/web-session-client-owned-tab-placement.ts
+++ b/src/renderer/src/runtime/web-session-client-owned-tab-placement.ts
@@ -213,13 +213,18 @@ export function reconcileClientOwnedTabPlacement(
         : (group.activeTabId ?? tabOrder[0] ?? null))
     const validActiveTabId =
       activeTabId && tabOrder.includes(activeTabId) ? activeTabId : (tabOrder[0] ?? null)
+    const sanitizedRecent = sanitizeRecentTabIds(group.recentTabIds, tabOrder)
+    // Why: only explicit intent or a close/move successor is a visit; retaining the active tab or
+    // structurally filling an empty group must not reorder MRU.
+    const recordsVisit = validActiveTabId === intentActive || displacedActive !== null
     reconciled.push({
       ...group,
       tabOrder,
       activeTabId: validActiveTabId,
-      recentTabIds: validActiveTabId
-        ? pushRecentTabId(sanitizeRecentTabIds(group.recentTabIds, tabOrder), validActiveTabId)
-        : []
+      recentTabIds:
+        validActiveTabId && recordsVisit
+          ? pushRecentTabId(sanitizedRecent, validActiveTabId)
+          : sanitizedRecent
     })
   }
 
diff --git a/src/renderer/src/runtime/web-session-tabs-sync-browser-tabs.test.ts b/src/renderer/src/runtime/web-session-tabs-sync-browser-tabs.test.ts
index 7bdcc7f37bb..b90b06b6106 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync-browser-tabs.test.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync-browser-tabs.test.ts
@@ -493,44 +493,45 @@ describe('applyWebSessionTabsSnapshot', () => {
       groupId: previewGroupId
     })
 
+    const state = makeState({
+      groupsByWorktree: {
+        [WT]: [
+          {
+            id: editorGroupId,
+            worktreeId: WT,
+            activeTabId: 'local-editor',
+            tabOrder: ['local-editor']
+          },
+          {
+            id: previewGroupId,
+            worktreeId: WT,
+            activeTabId: null,
+            tabOrder: []
+          }
+        ]
+      },
+      layoutByWorktree: { [WT]: initialLayout },
+      unifiedTabsByWorktree: {
+        [WT]: [
+          {
+            id: 'local-editor',
+            worktreeId: WT,
+            groupId: editorGroupId,
+            contentType: 'editor',
+            entityId: 'local-file',
+            label: 'example.html',
+            sortOrder: 0,
+            createdAt: NOW,
+            isPreview: false,
+            isPinned: false,
+            customLabel: null,
+            color: null
+          }
+        ]
+      }
+    })
     const patch = applyWebSessionTabsSnapshot(
-      makeState({
-        groupsByWorktree: {
-          [WT]: [
-            {
-              id: editorGroupId,
-              worktreeId: WT,
-              activeTabId: 'local-editor',
-              tabOrder: ['local-editor']
-            },
-            {
-              id: previewGroupId,
-              worktreeId: WT,
-              activeTabId: null,
-              tabOrder: []
-            }
-          ]
-        },
-        layoutByWorktree: { [WT]: initialLayout },
-        unifiedTabsByWorktree: {
-          [WT]: [
-            {
-              id: 'local-editor',
-              worktreeId: WT,
-              groupId: editorGroupId,
-              contentType: 'editor',
-              entityId: 'local-file',
-              label: 'example.html',
-              sortOrder: 0,
-              createdAt: NOW,
-              isPreview: false,
-              isPinned: false,
-              customLabel: null,
-              color: null
-            }
-          ]
-        }
-      }),
+      state,
       makeSnapshot([], {
         activeTabType: null,
         tabGroups: [{ id: editorGroupId, activeTabId: null, tabOrder: [], recentTabIds: [] }],
@@ -538,9 +539,11 @@ describe('applyWebSessionTabsSnapshot', () => {
       }),
       ENV,
       NOW
-    ) as Partial<WebSessionTabsSyncState>
+    )
+    // An omitted groups patch means the snapshot left every group as it was.
+    const groups = patch.groupsByWorktree?.[WT] ?? state.groupsByWorktree[WT]
 
-    expect(patch.groupsByWorktree?.[WT]?.map((group) => group.id)).toContain(previewGroupId)
+    expect(groups?.map((group) => group.id)).toContain(previewGroupId)
     expect(layoutHasGroup(patch.layoutByWorktree?.[WT] ?? initialLayout, previewGroupId)).toBe(true)
   })
 
diff --git a/src/renderer/src/runtime/web-session-tabs-sync-client-owned-placement.test.ts b/src/renderer/src/runtime/web-session-tabs-sync-client-owned-placement.test.ts
index cfe0154a932..dd076a20fb0 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync-client-owned-placement.test.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync-client-owned-placement.test.ts
@@ -241,15 +241,13 @@ describe('client-owned tab placement for paired worktrees', () => {
       groupId: PREVIEW_GROUP
     })
 
-    const patch = applyWebSessionTabsSnapshot(
-      splitClientState(),
-      ambientSplitSnapshot(),
-      ENV,
-      NOW
-    ) as Partial<WebSessionTabsSyncState>
+    const state = splitClientState()
+    const patch = applyWebSessionTabsSnapshot(state, ambientSplitSnapshot(), ENV, NOW)
+    // An omitted groups patch means the snapshot left every group as it was.
+    const next = { ...state, ...patch }
 
-    expect(groupById(patch, HOST_GROUP)?.activeTabId).toBe(T2)
-    expect(groupById(patch, PREVIEW_GROUP)?.activeTabId).toBe(BROWSER_HOST_TAB)
+    expect(groupById(next, HOST_GROUP)?.activeTabId).toBe(T2)
+    expect(groupById(next, PREVIEW_GROUP)?.activeTabId).toBe(BROWSER_HOST_TAB)
   })
 
   it('keeps the client-focused group focused across repeated ambient snapshots', () => {
diff --git a/src/renderer/src/runtime/web-session-tabs-sync-remote-main-agent-verdict.test.ts b/src/renderer/src/runtime/web-session-tabs-sync-remote-main-agent-verdict.test.ts
new file mode 100644
index 00000000000..4a0f0c09070
--- /dev/null
+++ b/src/renderer/src/runtime/web-session-tabs-sync-remote-main-agent-verdict.test.ts
@@ -0,0 +1,112 @@
+/**
+ * A paired client mirrors a host's agent rows from `session.tabs`. A main agent that fails while
+ * its subagents keep the row working changes nothing but `mainAgent`: the row's state, start and
+ * (within one host frame) update time all stay put. The mirror must still take the new row and
+ * invalidate the worktree rollup, which caches on the agent-status epoch.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { RuntimeMobileSessionTabsResult } from '../../../shared/runtime-types'
+import type { AgentMainAgentStatus } from '../../../shared/main-agent-status'
+import { makePaneKey } from '../../../shared/stable-pane-id'
+import { toWebTerminalSurfaceTabId } from '../../../shared/terminal-surface-id'
+import { getDefaultSettings } from '../../../shared/constants'
+import { createTestStore, makeWorktree, seedStore } from '../store/slices/store-test-helpers'
+import { resetRendererOwnedAgentStatusPanesForTests } from '../components/terminal-pane/renderer-owned-agent-status-registry'
+import {
+  applyFreshWebSessionTabsSnapshot,
+  resetWebSessionTabsSnapshotFreshnessForTests
+} from './web-session-tabs-sync'
+import { selectWorktreeAgentActivitySummary } from '../components/sidebar/worktree-agent-activity-summary'
+
+// Why: web-session-tabs-sync imports the app-level store singleton; this
+// harness drives a createTestStore instance instead, like its sibling suites.
+vi.mock('../store', () => ({
+  useAppStore: {
+    setState: vi.fn(),
+    getState: vi.fn(() => ({})),
+    subscribe: vi.fn(() => () => {})
+  }
+}))
+
+const WT = 'repo1::/path/wt1'
+const ENV = 'remote-env-1'
+const T0 = 1_700_000_000_000
+const HOST_TAB_ID = 'host-tab-1'
+const LEAF_ID = '11111111-1111-4111-8111-111111111111'
+
+function hostSnapshot(snapshotVersion: number, mainAgent: AgentMainAgentStatus) {
+  const snapshot: RuntimeMobileSessionTabsResult = {
+    worktree: WT,
+    publicationEpoch: 'host-epoch-1',
+    snapshotVersion,
+    activeGroupId: 'host-group-1',
+    activeTabId: `${HOST_TAB_ID}::${LEAF_ID}`,
+    activeTabType: 'terminal',
+    tabs: [
+      {
+        type: 'terminal',
+        id: `${HOST_TAB_ID}::${LEAF_ID}`,
+        title: 'Claude Code',
+        parentTabId: HOST_TAB_ID,
+        leafId: LEAF_ID,
+        isActive: true,
+        launchAgent: 'claude',
+        status: 'ready',
+        terminal: 'terminal-1',
+        agentStatus: {
+          state: 'working',
+          prompt: 'ship it',
+          updatedAt: T0 - 1_000,
+          stateStartedAt: T0 - 5_000,
+          agentType: 'claude',
+          paneKey: makePaneKey(HOST_TAB_ID, LEAF_ID),
+          tabId: HOST_TAB_ID,
+          worktreeId: WT,
+          stateHistory: [],
+          mainAgent
+        }
+      }
+    ]
+  }
+  return snapshot
+}
+
+describe('a mirrored main agent that fails while its subagents keep the row working', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(T0)
+    resetWebSessionTabsSnapshotFreshnessForTests()
+    resetRendererOwnedAgentStatusPanesForTests()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+    resetRendererOwnedAgentStatusPanesForTests()
+  })
+
+  it('reaches the store and the worktree rollup', () => {
+    const store = createTestStore()
+    seedStore(store, {
+      settings: getDefaultSettings('/tmp'),
+      worktreesByRepo: { repo1: [makeWorktree({ id: WT, repoId: 'repo1', path: '/path/wt1' })] },
+      activeWorktreeId: WT
+    })
+    const apply = (snapshot: RuntimeMobileSessionTabsResult): void => {
+      store.setState(applyFreshWebSessionTabsSnapshot(store.getState(), snapshot, ENV, T0))
+    }
+
+    apply(hostSnapshot(1, { state: 'working', stateStartedAt: T0 - 5_000 }))
+    expect(selectWorktreeAgentActivitySummary(store.getState(), WT)).toMatchObject({
+      hasLiveWorking: true,
+      hasFailed: false
+    })
+
+    apply(hostSnapshot(2, { state: 'done', outcome: 'failure', stateStartedAt: T0 - 2_000 }))
+    const paneKey = makePaneKey(toWebTerminalSurfaceTabId(HOST_TAB_ID), LEAF_ID)
+    expect(store.getState().agentStatusByPaneKey[paneKey]?.mainAgent?.outcome).toBe('failure')
+    expect(selectWorktreeAgentActivitySummary(store.getState(), WT)).toMatchObject({
+      hasLiveWorking: false,
+      hasFailed: true
+    })
+  })
+})
diff --git a/src/renderer/src/runtime/web-session-tabs-sync/agent-status-patch.ts b/src/renderer/src/runtime/web-session-tabs-sync/agent-status-patch.ts
index e68958ec6bd..e6166f809f7 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync/agent-status-patch.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync/agent-status-patch.ts
@@ -3,6 +3,7 @@ import {
   type AgentStatusEntry
 } from '../../../../shared/agent-status-types'
 import { agentEntryCompletionAt } from '../../../../shared/agent-completion-time'
+import { agentMainAgentVerdict } from '../../../../shared/agent-main-agent-verdict'
 import { normalizeCompatibleAgentStatusEntryForOwner } from '../../../../shared/agent-title-owner'
 import { isWebTerminalSurfaceTabId, toWebTerminalSurfaceTabId } from '../web-runtime-session'
 import type { TerminalTab } from '../../../../shared/terminal-tab-types'
@@ -221,6 +222,9 @@ export function buildMirroredAgentStatusPatch(
       entry.state === 'done' &&
       agentEntryCompletionAt(existing) !== agentEntryCompletionAt(entry)
     const workingModeChanged = existing?.workingMode !== entry.workingMode
+    // A verdict moves no clock, including a main agent failing while its subagents keep the row working.
+    const verdictChanged =
+      !!existing && agentMainAgentVerdict(existing) !== agentMainAgentVerdict(entry)
     const entrySortRelevantChange =
       !existing ||
       existing.state !== entry.state ||
@@ -230,7 +234,7 @@ export function buildMirroredAgentStatusPatch(
       doneAttentionChanged ||
       isMirroredCommandCodeTurnBump(existing, entry)
     aggregateRelevantChange =
-      aggregateRelevantChange || entrySortRelevantChange || workingModeChanged
+      aggregateRelevantChange || entrySortRelevantChange || workingModeChanged || verdictChanged
     sortRelevantChange = sortRelevantChange || entrySortRelevantChange
   }
 
diff --git a/src/renderer/src/runtime/web-session-tabs-sync/mirrored-status-tab-retractions.test.ts b/src/renderer/src/runtime/web-session-tabs-sync/mirrored-status-tab-retractions.test.ts
index 975703fe6b5..31303c0ad86 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync/mirrored-status-tab-retractions.test.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync/mirrored-status-tab-retractions.test.ts
@@ -66,8 +66,25 @@ it('does not retract a colliding tab id owned by another host', () => {
   const tabId = toWebTerminalSurfaceTabId('same-tab')
   const paneKey = makePaneKey(tabId, LEAF_ID)
   state.agentStatusByPaneKey[paneKey] = {
-    paneKey, tabId, worktreeId: 'folder:1', connectionId: 'host-b', agentType: 'omp', state: 'done', prompt: '', updatedAt: NOW, stateStartedAt: NOW, stateHistory: []
+    paneKey,
+    tabId,
+    worktreeId: 'folder:1',
+    connectionId: 'host-b',
+    agentType: 'omp',
+    state: 'done',
+    prompt: '',
+    updatedAt: NOW,
+    stateStartedAt: NOW,
+    stateHistory: []
   }
   setHostSessionTabIdMapping({ environmentId: 'host-a', worktreeId: 'folder:1', tabId }, 'same-tab')
-  expect(collectUnhydratedMirroredTabRetractions({ state, environmentId: 'host-a', worktreeId: 'folder:1', nextHostTerminalTabIds: new Set(), currentTerminalIds: new Set() })).toEqual([])
+  expect(
+    collectUnhydratedMirroredTabRetractions({
+      state,
+      environmentId: 'host-a',
+      worktreeId: 'folder:1',
+      nextHostTerminalTabIds: new Set(),
+      currentTerminalIds: new Set()
+    })
+  ).toEqual([])
 })
diff --git a/src/renderer/src/runtime/web-session-tabs-sync/mirrored-status-tab-retractions.ts b/src/renderer/src/runtime/web-session-tabs-sync/mirrored-status-tab-retractions.ts
index 1f971225a4c..bc956b9fbfc 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync/mirrored-status-tab-retractions.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync/mirrored-status-tab-retractions.ts
@@ -36,7 +36,8 @@ export function collectUnhydratedMirroredTabRetractions(args: {
     if (
       entry?.worktreeId === args.worktreeId &&
       (entry.connectionId === args.environmentId ||
-        (args.environmentId === 'local' && (entry.connectionId === null || entry.connectionId === undefined))) &&
+        (args.environmentId === 'local' &&
+          (entry.connectionId === null || entry.connectionId === undefined))) &&
       tabId &&
       candidates.has(tabId)
     ) {
diff --git a/src/renderer/src/runtime/web-session-tabs-sync/state-equality-core.test.ts b/src/renderer/src/runtime/web-session-tabs-sync/state-equality-core.test.ts
new file mode 100644
index 00000000000..aa466c0f9b5
--- /dev/null
+++ b/src/renderer/src/runtime/web-session-tabs-sync/state-equality-core.test.ts
@@ -0,0 +1,47 @@
+import { describe, expect, it } from 'vitest'
+import type {
+  AgentStateHistoryEntry,
+  AgentStatusEntry
+} from '../../../../shared/agent-status-types'
+import { agentStatusEntryEqual, sameAgentStateHistory } from './state-equality-core'
+
+function doneEntry(mainAgent?: AgentStateHistoryEntry['mainAgent']): AgentStateHistoryEntry {
+  return { state: 'done', prompt: 'ship it', startedAt: 1_000, ...(mainAgent ? { mainAgent } : {}) }
+}
+
+describe('sameAgentStateHistory', () => {
+  it('sees a history verdict or main agent clock change under an unchanged flag', () => {
+    const failed = doneEntry({ state: 'done', outcome: 'failure', stateStartedAt: 900 })
+    expect(sameAgentStateHistory([failed], [{ ...failed }])).toBe(true)
+    expect(sameAgentStateHistory([doneEntry()], [failed])).toBe(false)
+    expect(
+      sameAgentStateHistory(
+        [failed],
+        [doneEntry({ state: 'done', outcome: 'success', stateStartedAt: 900 })]
+      )
+    ).toBe(false)
+    expect(
+      sameAgentStateHistory(
+        [failed],
+        [doneEntry({ state: 'done', outcome: 'failure', stateStartedAt: 950 })]
+      )
+    ).toBe(false)
+  })
+})
+
+describe('agentStatusEntryEqual', () => {
+  // A paired client must take a host row whose only change is a new turn under the same state.
+  it('sees a new host turn start under an unchanged state', () => {
+    const entry: AgentStatusEntry = {
+      state: 'working',
+      prompt: 'ship it',
+      updatedAt: 2_000,
+      stateStartedAt: 1_000,
+      turnStartedAt: 1_000,
+      paneKey: 'tab-1:leaf-1',
+      stateHistory: []
+    }
+    expect(agentStatusEntryEqual(entry, { ...entry })).toBe(true)
+    expect(agentStatusEntryEqual(entry, { ...entry, turnStartedAt: 1_500 })).toBe(false)
+  })
+})
diff --git a/src/renderer/src/runtime/web-session-tabs-sync/state-equality-core.ts b/src/renderer/src/runtime/web-session-tabs-sync/state-equality-core.ts
index 42345db35d0..407b7f6c2f3 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync/state-equality-core.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync/state-equality-core.ts
@@ -4,6 +4,7 @@ import {
   type AgentStatusEntry
 } from '../../../../shared/agent-status-types'
 import { agentProviderSessionsEqual } from '../../../../shared/agent-session-resume'
+import { mainAgentStatusEqual } from '../../../../shared/main-agent-status'
 import type {
   WebSessionTabsBatchContext,
   WebSessionTabsBatchRecordKey,
@@ -29,7 +30,8 @@ export function sameAgentStateHistory(
       entry.state === b[index]?.state &&
       entry.prompt === b[index]?.prompt &&
       entry.startedAt === b[index]?.startedAt &&
-      entry.interrupted === b[index]?.interrupted
+      entry.interrupted === b[index]?.interrupted &&
+      mainAgentStatusEqual(entry.mainAgent, b[index]?.mainAgent)
   )
 }
 
@@ -46,6 +48,7 @@ export function agentStatusEntryEqual(
     a.prompt === b.prompt &&
     a.updatedAt === b.updatedAt &&
     a.stateStartedAt === b.stateStartedAt &&
+    a.turnStartedAt === b.turnStartedAt &&
     a.agentType === b.agentType &&
     a.paneKey === b.paneKey &&
     a.worktreeId === b.worktreeId &&
@@ -57,6 +60,7 @@ export function agentStatusEntryEqual(
     a.lastAssistantMessage === b.lastAssistantMessage &&
     a.lastAssistantMessageIsToolOutput === b.lastAssistantMessageIsToolOutput &&
     a.interrupted === b.interrupted &&
+    mainAgentStatusEqual(a.mainAgent, b.mainAgent) &&
     a.promptInteractionKey === b.promptInteractionKey &&
     a.restoredUnconfirmed === b.restoredUnconfirmed &&
     agentProviderSessionsEqual(a.agentType, a.providerSession, b.providerSession) &&
diff --git a/src/renderer/src/runtime/web-session-tabs-sync/tab-builders.ts b/src/renderer/src/runtime/web-session-tabs-sync/tab-builders.ts
index bc1dc6d83b1..6c5f394d9a5 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync/tab-builders.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync/tab-builders.ts
@@ -56,8 +56,12 @@ export function buildBrowserUnifiedTab(
     label: tab.title,
     customLabel: null,
     color: hostTab.color !== undefined ? hostTab.color : (existingUnifiedTab?.color ?? null),
-    sortOrder: tab.createdAt,
+    // Why: adoption must not reset the staged row's placement or manufacture/drop a focus visit.
+    sortOrder: existingUnifiedTab?.sortOrder ?? tab.createdAt,
     createdAt: tab.createdAt,
+    ...(existingUnifiedTab?.lastFocusedAt !== undefined
+      ? { lastFocusedAt: existingUnifiedTab.lastFocusedAt }
+      : {}),
     isPreview: false,
     isPinned:
       hostTab.isPinned !== undefined
diff --git a/src/renderer/src/runtime/web-session-tabs-sync/terminal-surfaces.ts b/src/renderer/src/runtime/web-session-tabs-sync/terminal-surfaces.ts
index 7c76129ae9e..8810af4b933 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync/terminal-surfaces.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync/terminal-surfaces.ts
@@ -200,6 +200,12 @@ export function chooseRemoteTerminalLayout(
       : parentLayout?.expandedLeafId && knownLeafIds.has(parentLayout.expandedLeafId)
         ? parentLayout.expandedLeafId
         : null
+  const chatLeafId =
+    parentLayout?.chatLeafId && knownLeafIds.has(parentLayout.chatLeafId)
+      ? parentLayout.chatLeafId
+      : existingLayout?.chatLeafId && knownLeafIds.has(existingLayout.chatLeafId)
+        ? existingLayout.chatLeafId
+        : undefined
   // Why retained: this rebuilds the layout from the host's picture, and the host publishes no
   // scrollback of its own — a parked remote pane's bytes live only in the client's copy. Without
   // this, ANY inventory frame landing between park and reveal drops the only copy: the rebuild is
@@ -219,6 +225,7 @@ export function chooseRemoteTerminalLayout(
     }),
     activeLeafId,
     expandedLeafId,
+    ...(chatLeafId ? { chatLeafId } : {}),
     ptyIdsByLeafId,
     // Why: surface.title is the tab/PTY label, not a pane title; restoring it as one renders a fake title bar. Only host layout titles are real pane titles.
     ...(parentLayout?.titlesByLeafId ? { titlesByLeafId: parentLayout.titlesByLeafId } : {})
diff --git a/src/renderer/src/runtime/web-session-tabs-sync/tracking-mappings.ts b/src/renderer/src/runtime/web-session-tabs-sync/tracking-mappings.ts
index 83f8633f253..ed6ba998a1e 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync/tracking-mappings.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync/tracking-mappings.ts
@@ -73,3 +73,20 @@ export function hostSessionTabIdsByLocalTabForWorktree(
   }
   return entries
 }
+
+/** The local tab mirroring a host tab, or null when no mirrored tab claims it. */
+export function resolveLocalTabIdForHostSessionTab(args: {
+  environmentId: string
+  worktreeId: string
+  hostTabId: string
+}): string | null {
+  for (const [tabId, hostTabId] of hostSessionTabIdsByLocalTabForWorktree(
+    args.environmentId,
+    args.worktreeId
+  )) {
+    if (hostTabId === args.hostTabId) {
+      return tabId
+    }
+  }
+  return null
+}
diff --git a/src/renderer/src/startup/startup-degraded-recovery.test.ts b/src/renderer/src/startup/startup-degraded-recovery.test.ts
new file mode 100644
index 00000000000..a3f0fb44f26
--- /dev/null
+++ b/src/renderer/src/startup/startup-degraded-recovery.test.ts
@@ -0,0 +1,74 @@
+// @vitest-environment happy-dom
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('sonner', () => ({ toast: { error: vi.fn() } }))
+vi.mock('../components/terminal/terminal-provider-snapshot-capability', () => ({
+  collectTerminalProviderSnapshotPtyIds: () => [],
+  refreshTerminalProviderSnapshotCapabilities: async () => undefined
+}))
+vi.mock('../store', async () => {
+  const { create } = await import('zustand')
+  const useAppStore = create(() => ({
+    startupWorktreeRefreshCompleted: false,
+    terminalStartupRestorationReady: false,
+    workspaceSessionReady: false
+  }))
+  return { useAppStore }
+})
+
+import { useAppStore } from '../store'
+import { recoverFromDegradedStartup } from './startup-degraded-recovery'
+
+function recover(args: {
+  isCancelled: () => boolean
+  reconnectPersistedTerminals: () => Promise<void>
+}): Promise<void> {
+  return recoverFromDegradedStartup({
+    error: new Error('hydration failed'),
+    uiHydrated: true,
+    reconnectStarted: false,
+    hydratePersistedUI: vi.fn(),
+    abortSignal: new AbortController().signal,
+    ...args
+  })
+}
+
+describe('recoverFromDegradedStartup', () => {
+  beforeEach(() => {
+    vi.spyOn(console, 'error').mockImplementation(() => undefined)
+    useAppStore.setState({ terminalStartupRestorationReady: false, workspaceSessionReady: false })
+    Object.defineProperty(window, 'api', {
+      configurable: true,
+      value: {
+        app: {
+          awaitFirstWindowStartupServices: async () => undefined,
+          recoverLegacyWorkerTerminalsForRendererStartup: async () => undefined,
+          relaunch: vi.fn()
+        }
+      }
+    })
+  })
+
+  it('releases terminal startup restoration once the degraded reconnect succeeds', async () => {
+    await recover({
+      isCancelled: () => false,
+      reconnectPersistedTerminals: async () => {
+        useAppStore.setState({ workspaceSessionReady: true })
+      }
+    })
+
+    expect(useAppStore.getState().terminalStartupRestorationReady).toBe(true)
+  })
+
+  it('leaves the flag to the newer pass when this one was cancelled mid-reconnect', async () => {
+    let cancelled = false
+    await recover({
+      isCancelled: () => cancelled,
+      reconnectPersistedTerminals: async () => {
+        cancelled = true
+      }
+    })
+
+    expect(useAppStore.getState().terminalStartupRestorationReady).toBe(false)
+  })
+})
diff --git a/src/renderer/src/startup/startup-degraded-recovery.ts b/src/renderer/src/startup/startup-degraded-recovery.ts
index 987a74a8341..c5570af2717 100644
--- a/src/renderer/src/startup/startup-degraded-recovery.ts
+++ b/src/renderer/src/startup/startup-degraded-recovery.ts
@@ -93,6 +93,11 @@ export async function recoverFromDegradedStartup(args: DegradedStartupRecoveryAr
     )
     await reconnectPersistedTerminals(abortSignal)
     await window.api.app.recoverLegacyWorkerTerminalsForRendererStartup()
+    // Why: reconnect set workspaceSessionReady but not this flag, which the success chain sets
+    // last; without it a degraded boot keeps every restoration reader waiting for good.
+    if (!isCancelled()) {
+      useAppStore.setState({ terminalStartupRestorationReady: true })
+    }
   } catch (reconnectErr) {
     console.error('[startup] reconnectPersistedTerminals failed in error path:', reconnectErr)
     // Why (issue #1158): the await may have run during StrictMode teardown; re-check cancellation so a cancelled pass 1 doesn't stomp pass 2's hydration.
diff --git a/src/renderer/src/store/folder-workspaces/folder-workspace-catalog-actions.ts b/src/renderer/src/store/folder-workspaces/folder-workspace-catalog-actions.ts
index a5636882ea5..83678c50946 100644
--- a/src/renderer/src/store/folder-workspaces/folder-workspace-catalog-actions.ts
+++ b/src/renderer/src/store/folder-workspaces/folder-workspace-catalog-actions.ts
@@ -13,6 +13,7 @@ import {
   mergeFetchedFolderWorkspaceCatalog
 } from './folder-workspace-catalog'
 import { listRuntimeEnvironmentsForAllHostLoad } from '../runtime-catalog-hosts'
+import { reuseEqualRecordMap } from '../slices/repo-identity-reconcile'
 import { getFolderWorkspaceUpdateCoordinator } from './folder-workspace-mutations'
 
 export function createFolderWorkspaceCatalogActions(
@@ -47,11 +48,12 @@ export function createFolderWorkspaceCatalogActions(
             current.folderWorkspaces,
             current.projectGroups
           )
+          if (arrayElementsUnchanged(folderWorkspaces, current.folderWorkspaces)) {
+            return current
+          }
           return {
             folderWorkspaces,
-            ...(arrayElementsUnchanged(folderWorkspaces, current.folderWorkspaces)
-              ? {}
-              : { folderWorkspacePathStatuses: {} })
+            folderWorkspacePathStatuses: {}
           }
         })
       } catch (err) {
@@ -85,11 +87,12 @@ export function createFolderWorkspaceCatalogActions(
             current.folderWorkspaces,
             current.projectGroups
           )
+          if (arrayElementsUnchanged(folderWorkspaces, current.folderWorkspaces)) {
+            return current
+          }
           return {
             folderWorkspaces,
-            ...(arrayElementsUnchanged(folderWorkspaces, current.folderWorkspaces)
-              ? {}
-              : { folderWorkspacePathStatuses: {} })
+            folderWorkspacePathStatuses: {}
           }
         })
       }
@@ -130,12 +133,22 @@ export function createFolderWorkspaceCatalogActions(
         })
       )
       if (!failed) {
-        set((s) => ({
-          restoredRuntimeHostIdByWorkspaceSessionKey: clearRestoredFolderWorkspaceSessionOwners(
+        set((s) => {
+          // Why reuseEqualRecordMap: the cleanup rebuilds the record every refresh, and
+          // reference-equality readers (live dashboard selector, popout bridge) re-run on a
+          // fresh-but-equal identity, so the equal case must keep the previous one.
+          const restoredRuntimeHostIdByWorkspaceSessionKey = reuseEqualRecordMap(
             s.restoredRuntimeHostIdByWorkspaceSessionKey,
-            s
+            clearRestoredFolderWorkspaceSessionOwners(
+              s.restoredRuntimeHostIdByWorkspaceSessionKey,
+              s
+            )
           )
-        }))
+          return restoredRuntimeHostIdByWorkspaceSessionKey ===
+            s.restoredRuntimeHostIdByWorkspaceSessionKey
+            ? s
+            : { restoredRuntimeHostIdByWorkspaceSessionKey }
+        })
       }
     }
   }
diff --git a/src/renderer/src/store/github/cache-persistence.test.ts b/src/renderer/src/store/github/cache-persistence.test.ts
new file mode 100644
index 00000000000..70f21372dab
--- /dev/null
+++ b/src/renderer/src/store/github/cache-persistence.test.ts
@@ -0,0 +1,64 @@
+import { setImmediate } from 'node:timers/promises'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { createTestStore } from '../slices/store-test-helpers'
+import { debouncedSaveCache } from './cache-persistence'
+
+const setGitHub = vi.fn()
+
+beforeEach(() => {
+  vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+  setGitHub.mockReset()
+  vi.stubGlobal('window', { api: { cache: { setGitHub } } })
+})
+
+afterEach(() => {
+  vi.clearAllTimers()
+  vi.useRealTimers()
+  vi.unstubAllGlobals()
+})
+
+it('releases unrelated discarded renderer state while the cache save is pending', async () => {
+  const store = createTestStore()
+  const schedule = () => {
+    const drafts = { closedFile: Buffer.alloc(8 * 1024 * 1024, 65).toString('utf8') }
+    const state = { ...store.getState(), editorDrafts: drafts }
+    debouncedSaveCache(state)
+    return { state: new WeakRef(state), drafts: new WeakRef(drafts) }
+  }
+  const discarded = schedule()
+  if (!global.gc) {
+    throw new Error('config/vitest.config.ts must pass --expose-gc')
+  }
+  for (let turn = 0; turn < 3; turn += 1) {
+    await setImmediate()
+    global.gc()
+  }
+
+  expect(setGitHub).not.toHaveBeenCalled()
+  expect(discarded.state.deref() === undefined).toBe(true)
+  expect(discarded.drafts.deref() === undefined).toBe(true)
+  vi.advanceTimersByTime(1000)
+  expect(setGitHub).toHaveBeenCalledOnce()
+})
+
+it('persists the latest requested cache maps once after the trailing second', () => {
+  const state = createTestStore().getState()
+  const first = { ...state, prCache: {}, issueCache: {} }
+  const latest = { ...state, prCache: {}, issueCache: {} }
+  debouncedSaveCache(first)
+  vi.advanceTimersByTime(999)
+  expect(setGitHub).not.toHaveBeenCalled()
+
+  debouncedSaveCache(latest)
+  vi.advanceTimersByTime(999)
+  expect(setGitHub).not.toHaveBeenCalled()
+  vi.advanceTimersByTime(1)
+  expect(setGitHub).toHaveBeenCalledOnce()
+  expect(setGitHub.mock.calls[0][0]).toEqual({
+    cache: { pr: latest.prCache, issue: latest.issueCache }
+  })
+  expect(setGitHub.mock.calls[0][0].cache.pr).toBe(latest.prCache)
+  expect(setGitHub.mock.calls[0][0].cache.issue).toBe(latest.issueCache)
+  vi.advanceTimersByTime(1000)
+  expect(setGitHub).toHaveBeenCalledOnce()
+})
diff --git a/src/renderer/src/store/github/cache-persistence.ts b/src/renderer/src/store/github/cache-persistence.ts
index 06337e94a11..10c0c67ef13 100644
--- a/src/renderer/src/store/github/cache-persistence.ts
+++ b/src/renderer/src/store/github/cache-persistence.ts
@@ -5,12 +5,14 @@ let saveTimer: ReturnType<typeof setTimeout> | null = null
 /** Schedules the renderer's single trailing GitHub cache persistence write. */
 export function debouncedSaveCache(state: AppState): void {
   clearTimeout(saveTimer ?? undefined)
+  // Keep unrelated renderer state out of the pending timer's closure.
+  const { prCache, issueCache } = state
   saveTimer = setTimeout(() => {
     saveTimer = null
     window.api.cache.setGitHub({
       cache: {
-        pr: state.prCache,
-        issue: state.issueCache
+        pr: prCache,
+        issue: issueCache
       }
     })
   }, 1000)
diff --git a/src/renderer/src/store/github/check-actions.ts b/src/renderer/src/store/github/check-actions.ts
index d29a3720d38..51b9a891f1c 100644
--- a/src/renderer/src/store/github/check-actions.ts
+++ b/src/renderer/src/store/github/check-actions.ts
@@ -12,7 +12,11 @@ import {
 } from './cache-identity'
 import { isFresh, withBoundedCacheEntry } from './cache-policy'
 import { debouncedSaveCache } from './cache-persistence'
-import { inflightChecksRequests } from './request-coordination'
+import {
+  inflightChecksRequests,
+  nextProviderRequestId,
+  ownsInflightRequest
+} from './request-coordination'
 import { getGitHubRepoSourceSettings, getGitHubWorkItemRequestContext } from './work-item-routing'
 
 export const createCheckActions = (
@@ -87,18 +91,26 @@ export const createCheckActions = (
       return cachedChecks
     }
 
-    const inflightRequest = inflightChecksRequests.get(inflightKey)
-    if (inflightRequest) {
-      if (
-        (options?.force && !inflightRequest.force) ||
-        (options?.noCache && !inflightRequest.noCache)
-      ) {
-        await inflightRequest.promise.catch(() => {})
-      } else {
+    let waitedForUpgrade = false
+    for (;;) {
+      const inflightRequest = inflightChecksRequests.get(inflightKey)
+      if (!inflightRequest) {
+        break
+      }
+      const weakerThanRequested =
+        (options?.force && !inflightRequest.force) || (options?.noCache && !inflightRequest.noCache)
+      if (!weakerThanRequested) {
         return inflightRequest.promise
       }
+      // Why: wait out one weaker request so peers can share the upgrade, but never twice — a steady stream of weaker callers would otherwise starve this one forever.
+      if (waitedForUpgrade) {
+        break
+      }
+      waitedForUpgrade = true
+      await inflightRequest.promise.catch(() => {})
     }
 
+    const requestId = nextProviderRequestId()
     const request = (async () => {
       try {
         const requestContext = getGitHubWorkItemRequestContext(
@@ -131,6 +143,12 @@ export const createCheckActions = (
                 noCache: Boolean(options?.force || options?.noCache),
                 sourceContext: options?.sourceContext
               })) as PRCheckDetail[])
+        // Why: the bounded upgrade wait can leave us running beside a stronger request for this
+        // key. Both bypass gh's cache here, but the later-started one holds the newer run state —
+        // let only the key's current owner write checksCache and the PR status it derives.
+        if (!ownsInflightRequest(inflightChecksRequests, inflightKey, requestId)) {
+          return checks
+        }
         set((s) => {
           const nextState: Partial<AppState> = {
             checksCache: withBoundedCacheEntry(s.checksCache, cacheKey, {
@@ -168,13 +186,16 @@ export const createCheckActions = (
           return latestCached.data
         }
         return []
-      } finally {
+      }
+    })().finally(() => {
+      if (ownsInflightRequest(inflightChecksRequests, inflightKey, requestId)) {
         inflightChecksRequests.delete(inflightKey)
       }
-    })()
+    })
 
     inflightChecksRequests.set(inflightKey, {
       promise: request,
+      requestId,
       force: Boolean(options?.force),
       noCache: Boolean(options?.force || options?.noCache)
     })
diff --git a/src/renderer/src/store/github/project-actions.ts b/src/renderer/src/store/github/project-actions.ts
index f4c5fec3100..68fc2b0a37a 100644
--- a/src/renderer/src/store/github/project-actions.ts
+++ b/src/renderer/src/store/github/project-actions.ts
@@ -18,6 +18,8 @@ import { withBoundedCacheEntry, WORK_ITEMS_CACHE_TTL } from './cache-policy'
 import {
   acquireProviderRequestSlot as acquireWorkItemSlot,
   inflightProjectViewRequests,
+  nextProviderRequestId,
+  ownsInflightRequest,
   releaseProviderRequestSlot as releaseWorkItemSlot
 } from './request-coordination'
 import {
@@ -57,16 +59,25 @@ export const createProjectActions = (
       }
     }
 
-    const existing = inflightProjectViewRequests.get(requestKey)
-    if (existing) {
+    let waitedForUpgrade = false
+    for (;;) {
+      const existing = inflightProjectViewRequests.get(requestKey)
+      if (!existing) {
+        break
+      }
       // Why: a forcing caller must not dedupe to a non-forcing in-flight request; wait for it to settle, then issue a fresh forced call (mirrors fetchWorkItems).
-      if (options?.force && !existing.force) {
-        await existing.promise.catch(() => {})
-      } else {
+      if (!options?.force || existing.force) {
         return existing.promise
       }
+      // Why: wait out one weaker request so peers can share the upgrade, but never twice — a steady stream of weaker callers would otherwise starve this one forever.
+      if (waitedForUpgrade) {
+        break
+      }
+      waitedForUpgrade = true
+      await existing.promise.catch(() => {})
     }
 
+    const requestId = nextProviderRequestId()
     const request = (async (): Promise<GetProjectViewTableResult> => {
       await acquireWorkItemSlot()
       try {
@@ -79,6 +90,12 @@ export const createProjectActions = (
                 { timeoutMs: 60_000 }
               )
             : await window.api.gh.getProjectViewTable(args)
+        // Why: the bounded upgrade wait can leave us running beside a stronger request for this
+        // key, so neither write below may land once it owns the key — a late non-OK reply would
+        // otherwise stamp its error over the fresher table (or over a newer error) at the known key.
+        if (!ownsInflightRequest(inflightProjectViewRequests, requestKey, requestId)) {
+          return envelope
+        }
         if (envelope.ok) {
           const table = envelope.data
           const key = projectViewCacheKey(
@@ -119,12 +136,16 @@ export const createProjectActions = (
         }
       } finally {
         releaseWorkItemSlot()
+      }
+    })().finally(() => {
+      if (ownsInflightRequest(inflightProjectViewRequests, requestKey, requestId)) {
         inflightProjectViewRequests.delete(requestKey)
       }
-    })()
+    })
 
     inflightProjectViewRequests.set(requestKey, {
       promise: request,
+      requestId,
       force: Boolean(options?.force)
     })
     return request
diff --git a/src/renderer/src/store/github/provider-request-coalescing.test.ts b/src/renderer/src/store/github/provider-request-coalescing.test.ts
new file mode 100644
index 00000000000..f012999ce65
--- /dev/null
+++ b/src/renderer/src/store/github/provider-request-coalescing.test.ts
@@ -0,0 +1,343 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { GitHubWorkItem, ListWorkItemsResult } from '../../../../shared/github/work-item-types'
+import type { PRCheckDetail } from '../../../../shared/github/check-types'
+import type { GitHubProjectTable } from '../../../../shared/github/project-types'
+import type { GetProjectViewTableResult } from '../../../../shared/github/project-result-types'
+import type { FetchOptions } from './cache-model'
+import { projectViewCacheKey, projectViewRequestKey } from './cache-identity'
+import { inflightProjectViewRequests } from './request-coordination'
+import {
+  createTestStore,
+  mockApi,
+  resetRemoteRuntimeMocks
+} from '../slices/github-slice-test-harness'
+
+function workItems(title: string): ListWorkItemsResult<GitHubWorkItem> {
+  return {
+    items: [
+      {
+        id: 'issue-1',
+        type: 'issue',
+        number: 1,
+        title,
+        state: 'open',
+        url: 'https://example.test/1',
+        labels: [],
+        updatedAt: '2026-09-25T00:00:00Z',
+        author: null,
+        repoId: 'repo-1'
+      }
+    ],
+    sources: { issues: null, prs: null, originCandidate: null, upstreamCandidate: null }
+  }
+}
+
+const projectViewRequest = {
+  owner: 'acme',
+  ownerType: 'organization' as const,
+  projectNumber: 1,
+  viewId: 'view-1'
+}
+const projectViewCacheKey1 = projectViewCacheKey('organization', 'acme', 1, 'view-1')
+
+function projectTable(title: string): GitHubProjectTable {
+  return {
+    project: {
+      id: 'project-1',
+      owner: 'acme',
+      ownerType: 'organization',
+      number: 1,
+      title,
+      url: 'https://github.com/orgs/acme/projects/1'
+    },
+    selectedView: {
+      id: 'view-1',
+      number: 1,
+      name: 'Table',
+      layout: 'TABLE_LAYOUT',
+      filter: '',
+      fields: [],
+      groupByFields: [],
+      sortByFields: []
+    },
+    rows: [],
+    totalCount: 0,
+    parentFieldDropped: false
+  }
+}
+
+const strongerWorkItemOptions: FetchOptions[] = [
+  { force: true },
+  { force: true, noCache: true },
+  { force: true, requireComplete: true }
+]
+
+describe('GitHub provider request upgrade coalescing', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetRemoteRuntimeMocks()
+  })
+
+  it.each(strongerWorkItemOptions)('coalesces twenty work-item upgrades: %j', async (options) => {
+    const store = createTestStore()
+    const weak = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    const fresh = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    mockApi.gh.listWorkItems.mockReturnValueOnce(weak.promise).mockReturnValue(fresh.promise)
+    const first = store.getState().fetchWorkItems('repo-1', '/repo', 24, '')
+    const settled = vi.fn()
+    const followers = Array.from({ length: 20 }, () =>
+      store.getState().fetchWorkItems('repo-1', '/repo', 24, '', options).then(settled)
+    )
+    weak.resolve(workItems('weak'))
+    await first
+    await vi.waitFor(() =>
+      expect(mockApi.gh.listWorkItems.mock.calls.length).toBeGreaterThanOrEqual(2)
+    )
+    expect(settled).not.toHaveBeenCalled()
+    fresh.resolve(workItems('fresh'))
+    await Promise.all(followers)
+    expect(mockApi.gh.listWorkItems).toHaveBeenCalledTimes(2)
+    expect(settled).toHaveBeenCalledTimes(20)
+    expect(settled.mock.calls.every(([rows]) => rows[0].title === 'fresh')).toBe(true)
+    expect(mockApi.gh.listWorkItems).toHaveBeenLastCalledWith({
+      repoPath: '/repo',
+      repoId: 'repo-1',
+      limit: 24,
+      query: undefined,
+      ...(options.noCache ? { noCache: true } : {})
+    })
+  })
+
+  it('never joins a weaker replacement and never waits out more than one', async () => {
+    const store = createTestStore()
+    const weak = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    const forced = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    const strict = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    mockApi.gh.listWorkItems
+      .mockReturnValueOnce(weak.promise)
+      .mockReturnValueOnce(forced.promise)
+      .mockReturnValue(strict.promise)
+    const first = store.getState().fetchWorkItems('repo-1', '/repo', 24, '')
+    const forcedFetch = store.getState().fetchWorkItems('repo-1', '/repo', 24, '', { force: true })
+    const strictSettled = vi.fn()
+    const strictFollowers = Array.from({ length: 20 }, () =>
+      store
+        .getState()
+        .fetchWorkItems('repo-1', '/repo', 24, '', {
+          force: true,
+          noCache: true,
+          requireComplete: true
+        })
+        .then(strictSettled)
+    )
+    weak.resolve(workItems('weak'))
+    await first
+    // Why: the strict callers must reach the bridge without waiting out the weaker
+    // replacement too — the upgrade wait is bounded, so a repeating weaker refresh
+    // can never starve them. They still share exactly one strict request.
+    await vi.waitFor(() => expect(mockApi.gh.listWorkItems).toHaveBeenCalledTimes(3))
+    expect(mockApi.gh.listWorkItems).toHaveBeenLastCalledWith(
+      expect.objectContaining({ noCache: true })
+    )
+    expect(strictSettled).not.toHaveBeenCalled()
+    strict.resolve(workItems('strict'))
+    await Promise.all(strictFollowers)
+    forced.resolve(workItems('forced'))
+    await expect(forcedFetch).resolves.toEqual(workItems('forced').items)
+    expect(mockApi.gh.listWorkItems).toHaveBeenCalledTimes(3)
+    expect(strictSettled).toHaveBeenCalledTimes(20)
+    expect(strictSettled.mock.calls.every(([rows]) => rows[0].title === 'strict')).toBe(true)
+  })
+
+  it('keeps an invalidated request from removing its replacement dedupe entry', async () => {
+    const store = createTestStore()
+    const stale = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    const fresh = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    mockApi.gh.listWorkItems.mockReturnValueOnce(stale.promise).mockReturnValue(fresh.promise)
+    const first = store.getState().fetchWorkItems('repo-1', '/repo', 24, '')
+    store.getState().evictGitHubRepoCaches('repo-1', '/repo')
+    const replacement = store.getState().fetchWorkItems('repo-1', '/repo', 24, '', { force: true })
+    stale.resolve(workItems('stale'))
+    await first
+    const joined = store.getState().fetchWorkItems('repo-1', '/repo', 24, '', { force: true })
+    fresh.resolve(workItems('fresh'))
+    await expect(Promise.all([replacement, joined])).resolves.toEqual([
+      workItems('fresh').items,
+      workItems('fresh').items
+    ])
+    expect(mockApi.gh.listWorkItems).toHaveBeenCalledTimes(2)
+  })
+
+  it('rejects partial results for every complete-result waiter and allows a later retry', async () => {
+    const store = createTestStore()
+    const weak = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    const partial = {
+      ...workItems('partial'),
+      errors: { issues: { type: 'network_error' as const, message: 'offline' } }
+    }
+    mockApi.gh.listWorkItems.mockReturnValueOnce(weak.promise).mockResolvedValue(partial)
+    const first = store.getState().fetchWorkItems('repo-1', '/repo', 24, '')
+    const followers = Array.from({ length: 20 }, () =>
+      store.getState().fetchWorkItems('repo-1', '/repo', 24, '', {
+        force: true,
+        requireComplete: true
+      })
+    )
+    const settled = Promise.allSettled(followers)
+    weak.resolve(workItems('weak'))
+    await first
+    expect((await settled).every((result) => result.status === 'rejected')).toBe(true)
+    expect(mockApi.gh.listWorkItems).toHaveBeenCalledTimes(2)
+    mockApi.gh.listWorkItems.mockResolvedValue(workItems('recovered'))
+    await expect(
+      store.getState().fetchWorkItems('repo-1', '/repo', 24, '', {
+        force: true,
+        requireComplete: true
+      })
+    ).resolves.toEqual(workItems('recovered').items)
+    expect(mockApi.gh.listWorkItems).toHaveBeenCalledTimes(3)
+  })
+
+  it.each([{ force: true }, { noCache: true }])(
+    'coalesces twenty check upgrades: %j',
+    async (options) => {
+      const store = createTestStore()
+      const weak = Promise.withResolvers<PRCheckDetail[]>()
+      const fresh = Promise.withResolvers<PRCheckDetail[]>()
+      mockApi.gh.prChecks.mockReturnValueOnce(weak.promise).mockReturnValue(fresh.promise)
+      const first = store.getState().fetchPRChecks('/repo', 1, 'main', 'sha')
+      const settled = vi.fn()
+      const followers = Array.from({ length: 20 }, () =>
+        store.getState().fetchPRChecks('/repo', 1, 'main', 'sha', undefined, options).then(settled)
+      )
+      weak.resolve([])
+      await first
+      await vi.waitFor(() =>
+        expect(mockApi.gh.prChecks.mock.calls.length).toBeGreaterThanOrEqual(2)
+      )
+      expect(settled).not.toHaveBeenCalled()
+      const checks: PRCheckDetail[] = [
+        { name: 'fresh', status: 'completed', conclusion: 'success', url: null }
+      ]
+      fresh.resolve(checks)
+      await Promise.all(followers)
+      expect(mockApi.gh.prChecks).toHaveBeenCalledTimes(2)
+      expect(settled).toHaveBeenCalledTimes(20)
+      expect(settled.mock.calls.every(([rows]) => rows === checks)).toBe(true)
+    }
+  )
+
+  // Why: the bounded wait lets a force-only request (which still allows gh's own cache to answer)
+  // run beside a noCache one. Whichever settles last used to win the cache unconditionally.
+  it('keeps a late weaker work-item reply from burying the stronger result', async () => {
+    const store = createTestStore()
+    const weak = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    const forced = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    const strict = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    mockApi.gh.listWorkItems
+      .mockReturnValueOnce(weak.promise)
+      .mockReturnValueOnce(forced.promise)
+      .mockReturnValue(strict.promise)
+    const first = store.getState().fetchWorkItems('repo-1', '/repo', 24, '')
+    const forcedFetch = store.getState().fetchWorkItems('repo-1', '/repo', 24, '', { force: true })
+    const strictFetch = store
+      .getState()
+      .fetchWorkItems('repo-1', '/repo', 24, '', { force: true, noCache: true })
+    weak.resolve(workItems('weak'))
+    await first
+    await vi.waitFor(() => expect(mockApi.gh.listWorkItems).toHaveBeenCalledTimes(3))
+
+    strict.resolve(workItems('fresh'))
+    await expect(strictFetch).resolves.toEqual(workItems('fresh').items)
+    forced.resolve(workItems('gh-cached'))
+    await expect(forcedFetch).resolves.toEqual(workItems('gh-cached').items)
+
+    expect(store.getState().getCachedWorkItems('repo-1', 24, '', '/repo')).toEqual(
+      workItems('fresh').items
+    )
+    // Why: the stale payload must not be what isFresh hands back for the rest of the TTL either.
+    await expect(store.getState().fetchWorkItems('repo-1', '/repo', 24, '')).resolves.toEqual(
+      workItems('fresh').items
+    )
+    expect(mockApi.gh.listWorkItems).toHaveBeenCalledTimes(3)
+  })
+
+  it('keeps a superseded check reply from rewinding the cached run state', async () => {
+    const store = createTestStore()
+    const plain = Promise.withResolvers<PRCheckDetail[]>()
+    const noCacheOnly = Promise.withResolvers<PRCheckDetail[]>()
+    const forcedOnly = Promise.withResolvers<PRCheckDetail[]>()
+    mockApi.gh.prChecks
+      .mockReturnValueOnce(plain.promise)
+      .mockReturnValueOnce(noCacheOnly.promise)
+      .mockReturnValue(forcedOnly.promise)
+    const first = store.getState().fetchPRChecks('/repo', 1, 'main', 'sha')
+    // Why: force and noCache are incomparable, so each waits out the plain request and the second
+    // one then breaks out of the bounded wait while the first is still in flight.
+    const noCacheFetch = store
+      .getState()
+      .fetchPRChecks('/repo', 1, 'main', 'sha', undefined, { noCache: true })
+    const forcedFetch = store
+      .getState()
+      .fetchPRChecks('/repo', 1, 'main', 'sha', undefined, { force: true })
+    plain.resolve([])
+    await first
+    await vi.waitFor(() => expect(mockApi.gh.prChecks).toHaveBeenCalledTimes(3))
+
+    const newer: PRCheckDetail[] = [
+      { name: 'build', status: 'completed', conclusion: 'success', url: null }
+    ]
+    const older: PRCheckDetail[] = [
+      { name: 'build', status: 'in_progress', conclusion: null, url: null }
+    ]
+    forcedOnly.resolve(newer)
+    await expect(forcedFetch).resolves.toEqual(newer)
+    noCacheOnly.resolve(older)
+    await expect(noCacheFetch).resolves.toEqual(older)
+
+    expect(Object.values(store.getState().checksCache).map((entry) => entry.data)).toEqual([newer])
+  })
+
+  it('keeps a superseded project failure from stamping the known view key', async () => {
+    const store = createTestStore()
+    const weak = Promise.withResolvers<GetProjectViewTableResult>()
+    const replacementWeak = Promise.withResolvers<GetProjectViewTableResult>()
+    const forcedResult = Promise.withResolvers<GetProjectViewTableResult>()
+    mockApi.gh.getProjectViewTable
+      .mockReturnValueOnce(weak.promise)
+      .mockReturnValueOnce(replacementWeak.promise)
+      .mockReturnValue(forcedResult.promise)
+
+    const first = store.getState().fetchProjectViewTable(projectViewRequest)
+    const forcedFetch = store.getState().fetchProjectViewTable(projectViewRequest, { force: true })
+    // Why: only a non-forced entry can be superseded mid-flight, and it has to appear in the
+    // microtask after the first request clears the key — before the forced waiter re-checks it.
+    const pending = inflightProjectViewRequests.get(
+      projectViewRequestKey(projectViewRequest, 'local')
+    )
+    expect(pending).toBeDefined()
+    let replacementFetch: Promise<GetProjectViewTableResult> | undefined
+    void pending?.promise.then(() => {
+      replacementFetch = store.getState().fetchProjectViewTable(projectViewRequest)
+    })
+
+    const staleError = { type: 'network_error' as const, message: 'first attempt offline' }
+    weak.resolve({ ok: false, error: staleError })
+    await first
+    await vi.waitFor(() => expect(mockApi.gh.getProjectViewTable).toHaveBeenCalledTimes(3))
+    expect(store.getState().projectViewCache[projectViewCacheKey1]).toMatchObject({
+      error: staleError
+    })
+
+    forcedResult.resolve({ ok: true, data: projectTable('forced') })
+    await expect(forcedFetch).resolves.toEqual({ ok: true, data: projectTable('forced') })
+    const error = { type: 'network_error' as const, message: 'offline' }
+    replacementWeak.resolve({ ok: false, error })
+    await expect(replacementFetch).resolves.toEqual({ ok: false, error })
+
+    expect(store.getState().projectViewCache[projectViewCacheKey1]).toMatchObject({
+      data: projectTable('forced')
+    })
+    expect(store.getState().projectViewCache[projectViewCacheKey1].error).toBeUndefined()
+  })
+})
diff --git a/src/renderer/src/store/github/pull-request-actions.ts b/src/renderer/src/store/github/pull-request-actions.ts
index c9a43e075ac..17852c1d57f 100644
--- a/src/renderer/src/store/github/pull-request-actions.ts
+++ b/src/renderer/src/store/github/pull-request-actions.ts
@@ -9,6 +9,7 @@ import { prCacheKey } from './cache-identity'
 import { isFresh } from './cache-policy'
 import { buildGitHubPRRefreshStateClearToken } from './pr-refresh-state'
 import { githubHostedReviewFallbackPRNumber, prLookupHintKey } from './pr-result-routing'
+import { nextLookupGeneration } from '../lookup-generation-sequence'
 import { inflightPRRequests, prRequestGenerations } from './request-coordination'
 import { settingsForGitHubRepoOwner } from './work-item-routing'
 import {
@@ -113,7 +114,7 @@ export const createPullRequestActions = (
       return inflightRequest.promise
     }
 
-    const generation = (prRequestGenerations.get(cacheKey) ?? 0) + 1
+    const generation = nextLookupGeneration()
     const requestStartedAt = Date.now()
     const requestStartedHostedReviewEntry = get().hostedReviewCache[hostedReviewCacheKey]
     const requestStartedPRRefreshState = get().prRefreshStates[cacheKey]
diff --git a/src/renderer/src/store/github/request-coordination.ts b/src/renderer/src/store/github/request-coordination.ts
index fc6f3cb0b7c..7aecfcd2b44 100644
--- a/src/renderer/src/store/github/request-coordination.ts
+++ b/src/renderer/src/store/github/request-coordination.ts
@@ -13,31 +13,56 @@ export type InflightPR = {
 }
 export type InflightChecks = {
   promise: Promise<PRCheckDetail[]>
+  requestId: number
   force: boolean
   noCache: boolean
 }
 export type InflightWorkItems = {
   promise: Promise<readonly GitHubWorkItem[]>
+  requestId: number
   force: boolean
   noCache: boolean
   requireComplete: boolean
 }
+export type InflightProjectView = {
+  promise: Promise<GetProjectViewTableResult>
+  requestId: number
+  force: boolean
+}
 
 export const inflightPRRequests = new Map<string, InflightPR>()
 export const inflightIssueRequests = new Map<string, Promise<IssueInfo | null>>()
 export const inflightChecksRequests = new Map<string, InflightChecks>()
 export const inflightCommentsRequests = new Map<string, Promise<PRComment[]>>()
 export const inflightWorkItemsRequests = new Map<string, InflightWorkItems>()
-export const inflightProjectViewRequests = new Map<
-  string,
-  { promise: Promise<GetProjectViewTableResult>; force: boolean }
->()
+export const inflightProjectViewRequests = new Map<string, InflightProjectView>()
 export const prRequestGenerations = new Map<string, number>()
 export const prRefreshStartedHostedReviewEntries = new Map<
   string,
   AppState['hostedReviewCache'][string] | undefined
 >()
 
+let providerRequestSequence = 0
+
+/** Stamp identifying one provider request, captured before it awaits so it can recheck ownership after. */
+export function nextProviderRequestId(): number {
+  providerRequestSequence += 1
+  return providerRequestSequence
+}
+
+/**
+ * Why: the upgrade wait is bounded, so a stronger request can run beside a weaker one for the same
+ * key. Only the request the key currently resolves to may write that key's cache — otherwise a late
+ * weaker reply overwrites the stronger request's fresher result under a brand-new `fetchedAt`.
+ */
+export function ownsInflightRequest<T extends { requestId: number }>(
+  registry: ReadonlyMap<string, T>,
+  key: string,
+  requestId: number
+): boolean {
+  return registry.get(key)?.requestId === requestId
+}
+
 export function _getGitHubPRRequestGenerationCountForTest(): number {
   return prRequestGenerations.size
 }
diff --git a/src/renderer/src/store/github/work-item-fetch-actions.ts b/src/renderer/src/store/github/work-item-fetch-actions.ts
index 722556ee0ff..5d865741931 100644
--- a/src/renderer/src/store/github/work-item-fetch-actions.ts
+++ b/src/renderer/src/store/github/work-item-fetch-actions.ts
@@ -13,6 +13,8 @@ import { isFresh, withBoundedCacheEntry, WORK_ITEMS_CACHE_TTL } from './cache-po
 import {
   acquireProviderRequestSlot as acquireWorkItemSlot,
   inflightWorkItemsRequests,
+  nextProviderRequestId,
+  ownsInflightRequest,
   releaseProviderRequestSlot as releaseWorkItemSlot
 } from './request-coordination'
 import { findRepoForGitHubOwner } from './repository-routing'
@@ -109,20 +111,29 @@ export const createWorkItemFetchActions = (
       options?.sourceContext
     )
     const inflightKey = workItemsInflightRequestKey(key, requestContext.target)
-    const existing = inflightWorkItemsRequests.get(inflightKey)
-    if (existing) {
+    let waitedForUpgrade = false
+    for (;;) {
+      const existing = inflightWorkItemsRequests.get(inflightKey)
+      if (!existing) {
+        break
+      }
       // Why: a forcing/noCache caller must not dedupe to a weaker in-flight fetch (noCache is stricter — it must bypass gh api's cache too).
-      if (
+      const weakerThanRequested =
         (options?.force && !existing.force) ||
         (options?.noCache && !existing.noCache) ||
         (options?.requireComplete && !existing.requireComplete)
-      ) {
-        await existing.promise.catch(() => {})
-      } else {
+      if (!weakerThanRequested) {
         return existing.promise
       }
+      // Why: wait out one weaker request so peers can share the upgrade, but never twice — a steady stream of weaker callers would otherwise starve this one forever.
+      if (waitedForUpgrade) {
+        break
+      }
+      waitedForUpgrade = true
+      await existing.promise.catch(() => {})
     }
 
+    const requestId = nextProviderRequestId()
     const request = (async () => {
       await acquireWorkItemSlot()
       try {
@@ -163,6 +174,12 @@ export const createWorkItemFetchActions = (
         if (get().workItemsInvalidationNonce !== requestInvalidationNonce) {
           return items
         }
+        // Why: a stronger request may have replaced us on this key while we were awaiting (a
+        // force-only caller still lets gh's own cache answer), so writing here would bury its
+        // fresher rows under a new fetchedAt and keep isFresh serving them for the whole TTL.
+        if (!ownsInflightRequest(inflightWorkItemsRequests, inflightKey, requestId)) {
+          return items
+        }
         // Why: TaskPage useShallow-selects cache entry refs. A new { ...entry, fetchedAt }
         // still remaps every visible row. IPC structuredClone rebuilds nested records, so
         // data === previous.data never holds — reconcile structurally, then either mutate
@@ -220,12 +237,16 @@ export const createWorkItemFetchActions = (
         throw err
       } finally {
         releaseWorkItemSlot()
+      }
+    })().finally(() => {
+      if (ownsInflightRequest(inflightWorkItemsRequests, inflightKey, requestId)) {
         inflightWorkItemsRequests.delete(inflightKey)
       }
-    })()
+    })
 
     inflightWorkItemsRequests.set(inflightKey, {
       promise: request,
+      requestId,
       force: Boolean(options?.force),
       noCache: Boolean(options?.noCache),
       requireComplete: Boolean(options?.requireComplete)
diff --git a/src/renderer/src/store/lookup-generation-sequence.ts b/src/renderer/src/store/lookup-generation-sequence.ts
new file mode 100644
index 00000000000..c253b9d0184
--- /dev/null
+++ b/src/renderer/src/store/lookup-generation-sequence.ts
@@ -0,0 +1,22 @@
+/**
+ * Id source for the generation stamps that decide which in-flight lookup owns a
+ * cache key. One counter, allocated from for the life of the process, serves
+ * every cache and every coordinator that needs such a stamp.
+ *
+ * A coordinator that drops a key's generation entry once its newest lookup
+ * settles lets a per-key counter restart at 1 while an older lookup of the same
+ * key is still out: that straggler then reads as the current owner, publishes
+ * its stale answer, and tears down the live newer lookup's ownership so the
+ * fresh answer is dropped. Ids that are never reused remove the collision.
+ *
+ * Callers only ever compare stamps for equality, never order or magnitude, so a
+ * single shared sequence is safe no matter how many caches draw from it.
+ * Deliberately has no reset: rewinding it while a lookup is out recreates the
+ * very collision this exists to prevent.
+ */
+let lookupGenerationSequence = 0
+
+export function nextLookupGeneration(): number {
+  lookupGenerationSequence += 1
+  return lookupGenerationSequence
+}
diff --git a/src/renderer/src/store/plugin-language-packs-startup.test.ts b/src/renderer/src/store/plugin-language-packs-startup.test.ts
new file mode 100644
index 00000000000..6cb5a9c5711
--- /dev/null
+++ b/src/renderer/src/store/plugin-language-packs-startup.test.ts
@@ -0,0 +1,182 @@
+// @vitest-environment happy-dom
+
+import { StrictMode } from 'react'
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { PluginChangeEvent } from '../../../shared/plugins/plugin-change-event'
+import {
+  pluginLanguageResourceId,
+  type PluginLanguagePackRegistration
+} from '../../../shared/plugins/plugin-language-pack-artifact'
+import type * as LanguagePackModule from './plugin-language-packs'
+
+let languagePacks: typeof LanguagePackModule
+
+function pack(name: string): PluginLanguagePackRegistration {
+  const id = `plugin:${name}` as const
+  return {
+    id,
+    resourceLanguage: pluginLanguageResourceId(id),
+    pluginKey: name,
+    locale: 'en',
+    catalog: {}
+  }
+}
+
+function installBridge() {
+  const requests: ReturnType<typeof Promise.withResolvers<PluginLanguagePackRegistration[]>>[] = []
+  const listLanguagePacks = vi.fn(() => {
+    const request = Promise.withResolvers<PluginLanguagePackRegistration[]>()
+    requests.push(request)
+    return request.promise
+  })
+  const listeners: ((event: PluginChangeEvent) => void)[] = []
+  const onChanged = vi.fn((listener: (event: PluginChangeEvent) => void) => {
+    listeners.push(listener)
+    return () => {}
+  })
+  vi.stubGlobal('api', { plugins: { listLanguagePacks, onChanged } })
+  return { requests, listLanguagePacks, onChanged, listeners }
+}
+
+beforeEach(async () => {
+  vi.resetModules()
+  languagePacks = await import('./plugin-language-packs')
+})
+
+afterEach(() => {
+  cleanup()
+  vi.unstubAllGlobals()
+})
+
+describe('plugin language-pack startup ownership', () => {
+  it.each([false, true])(
+    'shares one load across mounted consumers (StrictMode: %s)',
+    async (strict) => {
+      const bridge = installBridge()
+      const wrapper = strict ? StrictMode : undefined
+      const first = renderHook(() => languagePacks.usePluginLanguagePacks(), { wrapper })
+      const second = renderHook(() => languagePacks.usePluginLanguagePacks(), { wrapper })
+      const dispatches = bridge.listLanguagePacks.mock.calls.length
+      const result = [pack('startup')]
+      await act(async () => {
+        for (const request of bridge.requests) {
+          request.resolve(result)
+        }
+        await Promise.all(bridge.requests.map((request) => request.promise))
+      })
+      expect(dispatches).toBe(1)
+      expect(bridge.onChanged).toHaveBeenCalledTimes(1)
+      expect(first.result.current).toEqual(result)
+      expect(second.result.current).toBe(first.result.current)
+    }
+  )
+
+  it.each(['resolve', 'reject'] as const)(
+    'keeps a newer refresh pending after an older request %ss',
+    async (settlement) => {
+      const bridge = installBridge()
+      const store = languagePacks.usePluginLanguagePackStore
+      const older = store.getState().fetchPacks()
+      const newer = store.getState().fetchPacks()
+      if (settlement === 'resolve') {
+        bridge.requests[0].resolve([pack('old')])
+      } else {
+        bridge.requests[0].reject(new Error('old failure'))
+      }
+      await older
+      expect(store.getState().loaded).toBe(false)
+      languagePacks.ensurePluginLanguagePacksLoaded()
+      const dispatches = bridge.listLanguagePacks.mock.calls.length
+      for (const request of bridge.requests.slice(1)) {
+        request.resolve([pack('current')])
+      }
+      await newer
+      expect(dispatches).toBe(2)
+      expect(store.getState().packs).toEqual([pack('current')])
+    }
+  )
+
+  it('allows a content-change refresh to supersede startup while ignoring unrelated changes', async () => {
+    const bridge = installBridge()
+    languagePacks.ensurePluginLanguagePacksLoaded()
+    bridge.listeners[0]({ contentPacksChanged: false })
+    expect(bridge.listLanguagePacks).toHaveBeenCalledTimes(1)
+    bridge.listeners[0]({ contentPacksChanged: true })
+    expect(bridge.listLanguagePacks).toHaveBeenCalledTimes(2)
+    bridge.requests[1].resolve([pack('changed')])
+    await bridge.requests[1].promise
+    bridge.requests[0].resolve([pack('old')])
+    await bridge.requests[0].promise
+    languagePacks.ensurePluginLanguagePacksLoaded()
+    expect(bridge.listLanguagePacks).toHaveBeenCalledTimes(2)
+    expect(languagePacks.usePluginLanguagePackStore.getState().packs).toEqual([pack('changed')])
+  })
+
+  it('keeps the shared startup request alive after the first consumer unmounts', async () => {
+    const bridge = installBridge()
+    const first = renderHook(() => languagePacks.usePluginLanguagePacks())
+    first.unmount()
+    const second = renderHook(() => languagePacks.usePluginLanguagePacks())
+    const dispatches = bridge.listLanguagePacks.mock.calls.length
+    await act(async () => {
+      for (const request of bridge.requests) {
+        request.resolve([pack('retained')])
+      }
+      await Promise.all(bridge.requests.map((request) => request.promise))
+    })
+    expect(dispatches).toBe(1)
+    expect(second.result.current).toEqual([pack('retained')])
+  })
+
+  it('retries a wedged startup request instead of joining it for the session', async () => {
+    vi.useFakeTimers()
+    try {
+      const bridge = installBridge()
+      languagePacks.ensurePluginLanguagePacksLoaded()
+      // A request that is merely slow is shared, not duplicated.
+      vi.advanceTimersByTime(9_000)
+      languagePacks.ensurePluginLanguagePacksLoaded()
+      expect(bridge.listLanguagePacks).toHaveBeenCalledTimes(1)
+      // Past the join window it is wedged, so a later consumer must be able to make progress.
+      vi.advanceTimersByTime(2_000)
+      languagePacks.ensurePluginLanguagePacksLoaded()
+      expect(bridge.listLanguagePacks).toHaveBeenCalledTimes(2)
+      bridge.requests[1].resolve([pack('recovered')])
+      await vi.waitFor(() =>
+        expect(languagePacks.usePluginLanguagePackStore.getState().loaded).toBe(true)
+      )
+      expect(languagePacks.usePluginLanguagePackStore.getState().packs).toEqual([pack('recovered')])
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('retains fail-closed loading and permits an explicit retry after rejection', async () => {
+    const bridge = installBridge()
+    const store = languagePacks.usePluginLanguagePackStore
+    const failed = store.getState().fetchPacks()
+    bridge.requests[0].reject(new Error('bridge unavailable'))
+    await failed
+    expect(store.getState().loaded).toBe(true)
+    expect(store.getState().packs).toEqual([])
+    languagePacks.ensurePluginLanguagePacksLoaded()
+    expect(bridge.listLanguagePacks).toHaveBeenCalledTimes(1)
+    const retry = store.getState().fetchPacks()
+    bridge.requests[1].resolve([pack('retry')])
+    await retry
+    expect(store.getState().packs).toEqual([pack('retry')])
+  })
+
+  it('finishes without an older bridge API and admits a later explicit refresh', async () => {
+    vi.stubGlobal('api', {})
+    languagePacks.ensurePluginLanguagePacksLoaded()
+    expect(languagePacks.usePluginLanguagePackStore.getState().loaded).toBe(true)
+    const bridge = installBridge()
+    const refresh = languagePacks.usePluginLanguagePackStore.getState().fetchPacks()
+    bridge.requests[0].resolve([pack('available')])
+    await refresh
+    expect(bridge.listLanguagePacks).toHaveBeenCalledTimes(1)
+    expect(languagePacks.usePluginLanguagePackStore.getState().packs).toEqual([pack('available')])
+  })
+})
diff --git a/src/renderer/src/store/plugin-language-packs.ts b/src/renderer/src/store/plugin-language-packs.ts
index 7c37c53c9c8..009ab459612 100644
--- a/src/renderer/src/store/plugin-language-packs.ts
+++ b/src/renderer/src/store/plugin-language-packs.ts
@@ -11,7 +11,17 @@ type PluginLanguagePackState = {
   fetchPacks: () => Promise<void>
 }
 
+/**
+ * Joining the startup request saves a duplicate IPC round trip, but its handler awaits plugin
+ * discovery — a wedged one must not turn `ensurePluginLanguagePacksLoaded` into a no-op for the
+ * session, which would pin every consumer on built-in translations. Past this bound the pending
+ * request is wedged rather than slow, so a later consumer starts its own (mirrors the reasoning in
+ * `src/main/git/coalesced-probe.ts`).
+ */
+const STARTUP_REQUEST_JOIN_WINDOW_MS = 10_000
+
 let requestGeneration = 0
+let latestRequestStartedAt: number | null = null
 let changeSubscriptionStarted = false
 
 export const usePluginLanguagePackStore = create<PluginLanguagePackState>()((set) => ({
@@ -19,9 +29,11 @@ export const usePluginLanguagePackStore = create<PluginLanguagePackState>()((set
   loaded: false,
   fetchPacks: async () => {
     const generation = ++requestGeneration
+    latestRequestStartedAt = Date.now()
     const api = window.api?.plugins
     if (!api?.listLanguagePacks) {
       if (generation === requestGeneration) {
+        latestRequestStartedAt = null
         set({ packs: [], loaded: true })
       }
       return
@@ -44,13 +56,20 @@ export const usePluginLanguagePackStore = create<PluginLanguagePackState>()((set
       if (generation === requestGeneration) {
         set({ packs: [], loaded: true })
       }
+    } finally {
+      if (generation === requestGeneration) {
+        latestRequestStartedAt = null
+      }
     }
   }
 }))
 
 export function ensurePluginLanguagePacksLoaded(): void {
   const state = usePluginLanguagePackStore.getState()
-  if (!state.loaded) {
+  const joinable =
+    latestRequestStartedAt !== null &&
+    Date.now() - latestRequestStartedAt < STARTUP_REQUEST_JOIN_WINDOW_MS
+  if (!state.loaded && !joinable) {
     void state.fetchPacks()
   }
   if (!changeSubscriptionStarted && window.api?.plugins?.onChanged) {
diff --git a/src/renderer/src/store/project-groups/project-group-catalog-actions.ts b/src/renderer/src/store/project-groups/project-group-catalog-actions.ts
index c7841c85e0c..d19ac185766 100644
--- a/src/renderer/src/store/project-groups/project-group-catalog-actions.ts
+++ b/src/renderer/src/store/project-groups/project-group-catalog-actions.ts
@@ -32,11 +32,12 @@ export function createProjectGroupCatalogActions(
             return current
           }
           const { projectGroups } = mergeFetchedProjectGroupCatalog(catalog, current.projectGroups)
+          if (arrayElementsUnchanged(projectGroups, current.projectGroups)) {
+            return current
+          }
           return {
             projectGroups,
-            ...(arrayElementsUnchanged(projectGroups, current.projectGroups)
-              ? {}
-              : { folderWorkspacePathStatuses: {} })
+            folderWorkspacePathStatuses: {}
           }
         })
       } catch (err) {
@@ -55,11 +56,12 @@ export function createProjectGroupCatalogActions(
             return s
           }
           const { projectGroups } = mergeFetchedProjectGroupCatalog(catalog, s.projectGroups)
+          if (arrayElementsUnchanged(projectGroups, s.projectGroups)) {
+            return s
+          }
           return {
             projectGroups,
-            ...(arrayElementsUnchanged(projectGroups, s.projectGroups)
-              ? {}
-              : { folderWorkspacePathStatuses: {} })
+            folderWorkspacePathStatuses: {}
           }
         })
       }
diff --git a/src/renderer/src/store/slices/agent-status-authority-actions.ts b/src/renderer/src/store/slices/agent-status-authority-actions.ts
index 7382cc020f2..2001f658752 100644
--- a/src/renderer/src/store/slices/agent-status-authority-actions.ts
+++ b/src/renderer/src/store/slices/agent-status-authority-actions.ts
@@ -16,6 +16,7 @@ import {
   getTabIdFromPaneKey,
   isRecentlyClosedAgentStatusTab
 } from './agent-status-pane-key-tab-binding'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export function createAgentStatusAuthorityActions(
   runtime: AgentStatusRuntime
@@ -31,7 +32,7 @@ export function createAgentStatusAuthorityActions(
     scheduleAgentStatusFreshness: () => freshness.schedule(),
 
     retireAgentPaneAuthority: (paneKey, options) => {
-      const retirementId = crypto.randomUUID()
+      const retirementId = createBrowserUuid()
       const ownerPaneKey = resolveAgentPaneAuthorityKey(paneKey)
       const previousRetirement = get().recentlyRetiredAgentStatusPaneKeys[ownerPaneKey]
       const retiredPaneKeys = [
diff --git a/src/renderer/src/store/slices/agent-status-contract.ts b/src/renderer/src/store/slices/agent-status-contract.ts
index afff64d3303..64ff3e10dcf 100644
--- a/src/renderer/src/store/slices/agent-status-contract.ts
+++ b/src/renderer/src/store/slices/agent-status-contract.ts
@@ -88,6 +88,8 @@ export type AgentStatusTiming = {
   /** Observation clock for staleness; see `AgentStatusEntry.evidenceObservedAt`. */
   evidenceObservedAt?: number
   stateStartedAt?: number
+  /** The host's turn start; see `AgentStatusEntry.turnStartedAt`. */
+  turnStartedAt?: number
 }
 
 export type AgentStatusRouting = {
diff --git a/src/renderer/src/store/slices/agent-status-drop-actions.ts b/src/renderer/src/store/slices/agent-status-drop-actions.ts
index cff59fdc329..12d6c9b6274 100644
--- a/src/renderer/src/store/slices/agent-status-drop-actions.ts
+++ b/src/renderer/src/store/slices/agent-status-drop-actions.ts
@@ -13,6 +13,7 @@ import {
   shouldReplaceRetainedWithLive
 } from './agent-status-pane-key-tab-binding'
 import { retireAgentPaneAuthorityAliasesByOwnerTab } from './agent-pane-authority'
+import { agentTurnStoppedByUser } from '../../../../shared/agent-main-agent-verdict'
 
 function removeAcknowledgement(
   acknowledgements: Record<string, number>,
@@ -162,7 +163,7 @@ export function createAgentStatusDropActions(
         if (
           liveEntry?.state === 'done' &&
           liveEntry.agentType !== undefined &&
-          liveEntry.interrupted !== true
+          !agentTurnStoppedByUser(liveEntry)
         ) {
           retainedEvidence.set(
             paneKey,
diff --git a/src/renderer/src/store/slices/agent-status-live-entry-builder.ts b/src/renderer/src/store/slices/agent-status-live-entry-builder.ts
index 28bf952460c..ec80692f95e 100644
--- a/src/renderer/src/store/slices/agent-status-live-entry-builder.ts
+++ b/src/renderer/src/store/slices/agent-status-live-entry-builder.ts
@@ -113,6 +113,11 @@ export function buildAgentStatusLiveEntry(
       : existing && existing.state === payload.state
         ? existing.stateStartedAt
         : updatedAt)
+  // Why: a writer with no turn clock (an OSC repaint) keeps the host's stamp only within one state;
+  // a state change it cannot date must not inherit another turn's start.
+  const turnStartedAt =
+    timing?.turnStartedAt ??
+    (existing && existing.state === payload.state ? existing.turnStartedAt : undefined)
   if (
     existing &&
     shouldSuppressInheritedTerminalStatus({
@@ -205,6 +210,7 @@ export function buildAgentStatusLiveEntry(
     ...(metadata?.structuredHostOwned === true ? { structuredHostOwned: true as const } : {}),
     stateStartedAt,
     stateObservedAt,
+    ...(turnStartedAt !== undefined ? { turnStartedAt } : {}),
     agentType: identity.agentType,
     model:
       payload.model ?? (existing?.agentType === identity.agentType ? existing.model : undefined),
diff --git a/src/renderer/src/store/slices/agent-status-live-entry-state-history.ts b/src/renderer/src/store/slices/agent-status-live-entry-state-history.ts
index 6976b0b990b..d1836ca137b 100644
--- a/src/renderer/src/store/slices/agent-status-live-entry-state-history.ts
+++ b/src/renderer/src/store/slices/agent-status-live-entry-state-history.ts
@@ -3,6 +3,7 @@ import {
   type AgentStateHistoryEntry,
   type AgentStatusEntry
 } from '../../../../shared/agent-status-types'
+import { agentVerdictFields } from '../../../../shared/agent-main-agent-verdict'
 import type { AgentStatusPayload } from './agent-status-contract'
 
 /** The history a live entry carries after this write, and when its state was first observed. A
@@ -36,7 +37,7 @@ export function resolveAgentStatusLiveEntryStateHistory(
         prompt: existing.prompt,
         startedAt: existing.stateStartedAt,
         observedAt: existing.stateObservedAt,
-        interrupted: existing.interrupted
+        ...agentVerdictFields(existing)
       }
     ]
     if (history.length > AGENT_STATE_HISTORY_MAX) {
diff --git a/src/renderer/src/store/slices/agent-status-live-facts.ts b/src/renderer/src/store/slices/agent-status-live-facts.ts
index 851ab789012..9d8c19742f7 100644
--- a/src/renderer/src/store/slices/agent-status-live-facts.ts
+++ b/src/renderer/src/store/slices/agent-status-live-facts.ts
@@ -16,6 +16,7 @@ import {
 } from './agent-status-pane-key-tab-binding'
 import { pruneMigrationUnsupportedEntries } from './agent-status-migration-unsupported-entries'
 import { sleepingRecordFromEntry } from './agent-status-sleeping-records'
+import { agentMainAgentVerdict } from '../../../../shared/agent-main-agent-verdict'
 
 export type AgentStatusLiveFacts = {
   existingSleepingRecord: SleepingAgentSessionRecord | undefined
@@ -95,12 +96,16 @@ export function deriveAgentStatusLiveFacts(args: AgentStatusLiveFactsArgs): Agen
       entry.lastAssistantMessageIsToolOutput !== existing.lastAssistantMessageIsToolOutput ||
       entry.orchestration !== existing.orchestration ||
       entry.subagents !== existing.subagents ||
-      entry.providerSession !== existing.providerSession ||
-      entry.interrupted !== existing.interrupted)
+      entry.providerSession !== existing.providerSession)
+  // A verdict moves no clock: a failure keeps a done's completion time, and a main agent that fails
+  // while its subagents keep the row working leaves the row's state and start as they were.
+  const verdictChanged =
+    !!existing && agentMainAgentVerdict(entry) !== agentMainAgentVerdict(existing)
   const retentionRelevantChange =
     sortRelevantChange ||
     attributionChanged ||
     existing?.workingMode !== entry.workingMode ||
+    verdictChanged ||
     doneRetentionFieldsChanged
   const existingSleepingRecord = state.sleepingAgentSessionsByPaneKey[paneKey]
   const liveRecoveryWorktreeId =
diff --git a/src/renderer/src/store/slices/agent-status-main-agent-fact.test.ts b/src/renderer/src/store/slices/agent-status-main-agent-fact.test.ts
index bd00eaa5015..8ceb45488e8 100644
--- a/src/renderer/src/store/slices/agent-status-main-agent-fact.test.ts
+++ b/src/renderer/src/store/slices/agent-status-main-agent-fact.test.ts
@@ -51,14 +51,12 @@ describe('the main agent fact on a renderer status entry', () => {
     })
     expect(store.getState().agentStatusByPaneKey[PANE].mainAgent).toEqual(mainAgent)
 
-    store
-      .getState()
-      .setAgentStatus(PANE, {
-        state: 'done',
-        prompt: 'go',
-        agentType: 'claude',
-        observation: osc(2)
-      })
+    store.getState().setAgentStatus(PANE, {
+      state: 'done',
+      prompt: 'go',
+      agentType: 'claude',
+      observation: osc(2)
+    })
     expect(store.getState().agentStatusByPaneKey[PANE].mainAgent).toBeUndefined()
   })
 
diff --git a/src/renderer/src/store/slices/agent-status-provider-session-actions.ts b/src/renderer/src/store/slices/agent-status-provider-session-actions.ts
index 1ffe1d7cb0e..8deddac21be 100644
--- a/src/renderer/src/store/slices/agent-status-provider-session-actions.ts
+++ b/src/renderer/src/store/slices/agent-status-provider-session-actions.ts
@@ -21,6 +21,7 @@ import {
 import { removePaneKeys } from './agent-status-pane-keyed-records'
 import { registryEntryMatchesStatus } from './agent-status-launch-config'
 import { copyLaunchConfig } from './agent-status-sleeping-records'
+import { agentVerdictFields } from '../../../../shared/agent-main-agent-verdict'
 
 export function createAgentStatusProviderSessionActions(
   runtime: AgentStatusRuntime
@@ -113,9 +114,7 @@ export function createAgentStatusProviderSessionActions(
               ? { connectionId: existingRecord.connectionId }
               : {}),
           ...(launchConfig ? { launchConfig: copyLaunchConfig(launchConfig) } : {}),
-          ...(preservesCompletedRecoveryRecord && existingRecord.interrupted !== undefined
-            ? { interrupted: existingRecord.interrupted }
-            : {}),
+          ...(preservesCompletedRecoveryRecord ? agentVerdictFields(existingRecord) : {}),
           origin: preservesQuitOrigin ? 'quit' : 'live'
         }
         removedLiveStatus = existingStatus !== undefined
diff --git a/src/renderer/src/store/slices/agent-status-provider-session.test.ts b/src/renderer/src/store/slices/agent-status-provider-session.test.ts
index 786b45378ec..30793ffce29 100644
--- a/src/renderer/src/store/slices/agent-status-provider-session.test.ts
+++ b/src/renderer/src/store/slices/agent-status-provider-session.test.ts
@@ -455,6 +455,61 @@ describe('recordAgentProviderSession', () => {
     })
   })
 
+  it('keeps a completed recovery record failed on a same-session update', () => {
+    const store = createTestStore()
+    store.setState({
+      tabsByWorktree: {
+        'wt-1': [makeTab({ id: 'tab-1', worktreeId: 'wt-1' })]
+      }
+    } as Partial<AppState>)
+    const providerSession = makePiCompatibleProviderSession('pi')
+
+    store
+      .getState()
+      .setAgentStatus(
+        'tab-1:leaf-1',
+        { state: 'working', prompt: 'finish the task', agentType: 'pi' },
+        'Pi',
+        { updatedAt: 20, stateStartedAt: 20 },
+        { tabId: 'tab-1', worktreeId: 'wt-1' },
+        { providerSession }
+      )
+    store.getState().setAgentStatus(
+      'tab-1:leaf-1',
+      {
+        state: 'done',
+        prompt: 'finish the task',
+        agentType: 'pi',
+        mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 30 }
+      },
+      'Pi',
+      { updatedAt: 30, stateStartedAt: 30 },
+      { tabId: 'tab-1', worktreeId: 'wt-1' },
+      { providerSession }
+    )
+    expect(store.getState().sleepingAgentSessionsByPaneKey['tab-1:leaf-1']).toMatchObject({
+      state: 'done',
+      mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 30 }
+    })
+
+    store
+      .getState()
+      .recordAgentProviderSession(
+        'tab-1:leaf-1',
+        'pi',
+        providerSession,
+        { updatedAt: 40 },
+        { tabId: 'tab-1', worktreeId: 'wt-1' }
+      )
+
+    expect(store.getState().sleepingAgentSessionsByPaneKey['tab-1:leaf-1']).toMatchObject({
+      providerSession,
+      state: 'done',
+      mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 30 },
+      origin: 'live'
+    })
+  })
+
   it('does not downgrade a quit recovery record on a same-session update', () => {
     const store = createTestStore()
     store.setState({
diff --git a/src/renderer/src/store/slices/agent-status-recovery-collection.ts b/src/renderer/src/store/slices/agent-status-recovery-collection.ts
index 689dbf861a7..491805b5b98 100644
--- a/src/renderer/src/store/slices/agent-status-recovery-collection.ts
+++ b/src/renderer/src/store/slices/agent-status-recovery-collection.ts
@@ -18,6 +18,7 @@ import {
   type CollectSleepingAgentSessionRecordsOptions
 } from './agent-status-sleeping-records'
 import { getLaunchConfigForEntry } from './agent-status-launch-config'
+import { agentTurnStoppedByUser } from '../../../../shared/agent-main-agent-verdict'
 import { isCompletedPiCompatibleAgentWithLiveRecoveryRecord } from '@/lib/live-resume-anchor-record'
 
 export function collectSleepingAgentSessionRecordsForWorktree(
@@ -153,7 +154,7 @@ export function collectHibernatedCompletionEvidenceForWorktree(
       !allowedPaneKeys.has(paneKey) ||
       entry.state !== 'done' ||
       agentType === undefined ||
-      entry.interrupted === true
+      agentTurnStoppedByUser(entry)
     ) {
       continue
     }
diff --git a/src/renderer/src/store/slices/agent-status-recovery-equivalence.ts b/src/renderer/src/store/slices/agent-status-recovery-equivalence.ts
index 660d104abf6..1659e757df5 100644
--- a/src/renderer/src/store/slices/agent-status-recovery-equivalence.ts
+++ b/src/renderer/src/store/slices/agent-status-recovery-equivalence.ts
@@ -3,6 +3,7 @@ import type {
   SleepingAgentLaunchConfig
 } from '../../../../shared/agent-session-resume'
 import { agentProviderSessionsEqual } from '../../../../shared/agent-session-resume'
+import { agentMainAgentVerdict } from '../../../../shared/agent-main-agent-verdict'
 
 export function launchConfigsEqual(
   a: SleepingAgentLaunchConfig | undefined,
@@ -41,7 +42,7 @@ export function sleepingRecordsEquivalentIgnoringCaptureTime(
     existing.updatedAt === next.updatedAt &&
     existing.terminalTitle === next.terminalTitle &&
     existing.lastAssistantMessage === next.lastAssistantMessage &&
-    existing.interrupted === next.interrupted &&
+    agentMainAgentVerdict(existing) === agentMainAgentVerdict(next) &&
     existing.origin === next.origin &&
     launchConfigsEqual(existing.launchConfig, next.launchConfig)
   )
@@ -61,7 +62,7 @@ export function recoveryRecordMatches(
     existing.worktreeId === next.worktreeId &&
     existing.tabId === next.tabId &&
     existing.state === next.state &&
-    existing.interrupted === next.interrupted &&
+    agentMainAgentVerdict(existing) === agentMainAgentVerdict(next) &&
     agentProviderSessionsEqual(existing.agent, existing.providerSession, next.providerSession) &&
     launchConfigsEqual(existing.launchConfig, next.launchConfig)
   )
diff --git a/src/renderer/src/store/slices/agent-status-sleeping-records.ts b/src/renderer/src/store/slices/agent-status-sleeping-records.ts
index 6363fb9e216..8e1abd3c202 100644
--- a/src/renderer/src/store/slices/agent-status-sleeping-records.ts
+++ b/src/renderer/src/store/slices/agent-status-sleeping-records.ts
@@ -1,5 +1,9 @@
 import type { AppState } from '../types'
 import type { AgentStatusEntry } from '../../../../shared/agent-status-types'
+import {
+  agentTurnEndedUncleanly,
+  agentVerdictFields
+} from '../../../../shared/agent-main-agent-verdict'
 import {
   getAgentResumeArgv,
   isResumableTuiAgent,
@@ -57,7 +61,7 @@ export function sleepingRecordFromEntry(args: {
       ? { lastAssistantMessage: args.entry.lastAssistantMessage }
       : {}),
     ...(args.launchConfig ? { launchConfig: copyLaunchConfig(args.launchConfig) } : {}),
-    ...(args.entry.interrupted ? { interrupted: true } : {}),
+    ...agentVerdictFields(args.entry),
     ...(args.origin ? { origin: args.origin } : {})
   }
 }
@@ -79,7 +83,7 @@ export function normalizeSleepingAgentSessionCollectOptions(
 }
 
 export function isValidCompletedAgentHibernationEntry(entry: AgentStatusEntry): boolean {
-  return entry.state === 'done' && entry.interrupted !== true
+  return entry.state === 'done' && !agentTurnEndedUncleanly(entry)
 }
 
 // Why: a finished pane is passive wake evidence, and a mobile wake background-mounts every passive
@@ -98,14 +102,18 @@ export function isDurableSleepingCapture(record: SleepingAgentSessionRecord): bo
 }
 
 // Why: manual sleep kills the pty either way, so the record carries resume identity, not the dead
-// turn's interrupt flag — and an explicitly slept workspace is never stale at wake, so a row the
+// turn's verdict — and an explicitly slept workspace is never stale at wake, so a row the
 // user is deliberately sleeping must not trip the wake-side staleness discard. `state` is preserved
 // so a done pane wakes lazily in place instead of spawning a new tab.
 export function manualSleepCaptureEntry(
   entry: AgentStatusEntry,
   capturedAt: number
 ): AgentStatusEntry {
-  return { ...entry, updatedAt: capturedAt, interrupted: false }
+  if (!entry.mainAgent) {
+    return { ...entry, updatedAt: capturedAt, interrupted: false }
+  }
+  const { outcome: _outcome, ...mainAgent } = entry.mainAgent
+  return { ...entry, updatedAt: capturedAt, interrupted: false, mainAgent }
 }
 
 export function removeSleepingRecordsReplacedByManualWorktreeSleep(
diff --git a/src/renderer/src/store/slices/agent-status-turn-started-at.test.ts b/src/renderer/src/store/slices/agent-status-turn-started-at.test.ts
new file mode 100644
index 00000000000..324b70e075f
--- /dev/null
+++ b/src/renderer/src/store/slices/agent-status-turn-started-at.test.ts
@@ -0,0 +1,50 @@
+import { describe, expect, it } from 'vitest'
+import { createTestStore } from './store-test-helpers'
+
+const PANE = 'tab-1:11111111-1111-4111-8111-111111111111'
+
+describe("the host's turn start on a renderer status entry", () => {
+  it('lands on the entry from the host timing and follows each host write', () => {
+    const store = createTestStore()
+    store
+      .getState()
+      .setAgentStatus(PANE, { state: 'working', prompt: 'go', agentType: 'claude' }, undefined, {
+        updatedAt: 1_000,
+        stateStartedAt: 1_000,
+        turnStartedAt: 900
+      })
+    expect(store.getState().agentStatusByPaneKey[PANE]?.turnStartedAt).toBe(900)
+
+    // The same prompt sent again: the state never left working, the host stamped a new turn.
+    store
+      .getState()
+      .setAgentStatus(PANE, { state: 'working', prompt: 'go', agentType: 'claude' }, undefined, {
+        updatedAt: 2_000,
+        stateStartedAt: 1_000,
+        turnStartedAt: 1_900
+      })
+    expect(store.getState().agentStatusByPaneKey[PANE]?.turnStartedAt).toBe(1_900)
+  })
+
+  it('keeps the stamp behind an unchanged state when a writer carries none, and drops it on a state edge', () => {
+    const store = createTestStore()
+    store
+      .getState()
+      .setAgentStatus(PANE, { state: 'working', prompt: 'go', agentType: 'claude' }, undefined, {
+        updatedAt: 1_000,
+        stateStartedAt: 1_000,
+        turnStartedAt: 900
+      })
+    // A renderer-side OSC repaint has no turn clock of its own.
+    store.getState().setAgentStatus(PANE, {
+      state: 'working',
+      prompt: 'go',
+      agentType: 'claude',
+      toolName: 'Bash'
+    })
+    expect(store.getState().agentStatusByPaneKey[PANE]?.turnStartedAt).toBe(900)
+
+    store.getState().setAgentStatus(PANE, { state: 'done', prompt: 'go', agentType: 'claude' })
+    expect(store.getState().agentStatusByPaneKey[PANE]?.turnStartedAt).toBeUndefined()
+  })
+})
diff --git a/src/renderer/src/store/slices/agent-status-verdict-copies.test.ts b/src/renderer/src/store/slices/agent-status-verdict-copies.test.ts
new file mode 100644
index 00000000000..26bec4113b1
--- /dev/null
+++ b/src/renderer/src/store/slices/agent-status-verdict-copies.test.ts
@@ -0,0 +1,191 @@
+import { describe, expect, it } from 'vitest'
+import type { SleepingAgentSessionRecord } from '../../../../shared/agent-session-resume'
+import type { AgentStatusEntry } from '../../../../shared/agent-status-types'
+import { parseWorkspaceSession } from '../../../../shared/workspace-session-schema'
+import { buildPaneActivityEvents } from '@/components/activity/activity-pane-events'
+import { makeTab, makeWorktree } from '@/components/activity/ActivityPrototypePage-test-fixtures'
+import type { AppState } from '../types'
+import { agentMeta, agentTitle } from '@/components/activity/activity-thread-presentation'
+import { activationTreatsNoteAsFinished } from '@/lib/sleeping-agent-pane-ownership'
+import { resolveAgentStatusLiveEntryStateHistory } from './agent-status-live-entry-state-history'
+import { deriveAgentStatusLiveFacts } from './agent-status-live-facts'
+import {
+  recoveryRecordMatches,
+  sleepingRecordsEquivalentIgnoringCaptureTime
+} from './agent-status-recovery-equivalence'
+import {
+  isValidCompletedAgentHibernationEntry,
+  manualSleepCaptureEntry,
+  sleepingRecordFromEntry
+} from './agent-status-sleeping-records'
+
+// Every copy of a row's verdict carries it: history, sleep records and their equality checks.
+// A copy that kept only `interrupted` would read a failure as a clean finish.
+const PANE_KEY = 'tab-1:11111111-1111-4111-8111-111111111111'
+const FAILED_MAIN_AGENT = { state: 'done', outcome: 'failure', stateStartedAt: 2_000 } as const
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: these readers touch only the three maps given; every tab lookup is answered by the tab the caller passes.
+const STATE = {
+  sleepingAgentSessionsByPaneKey: {},
+  migrationUnsupportedByPtyId: {},
+  tabsByWorktree: {}
+} as unknown as AppState
+
+function failedDone(overrides: Partial<AgentStatusEntry> = {}): AgentStatusEntry {
+  return {
+    paneKey: PANE_KEY,
+    state: 'done',
+    prompt: 'ship it',
+    updatedAt: 2_000,
+    stateStartedAt: 2_000,
+    stateHistory: [],
+    agentType: 'claude',
+    providerSession: { key: 'session_id', id: 'session-1' },
+    mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 2_000 },
+    ...overrides
+  }
+}
+
+function record(overrides: Partial<SleepingAgentSessionRecord> = {}): SleepingAgentSessionRecord {
+  return {
+    paneKey: PANE_KEY,
+    worktreeId: 'wt-1',
+    agent: 'claude',
+    providerSession: { key: 'session_id', id: 'session-1' },
+    prompt: 'ship it',
+    state: 'done',
+    capturedAt: 3_000,
+    updatedAt: 2_000,
+    origin: 'live',
+    ...overrides
+  }
+}
+
+describe('a failed done keeps its verdict in every copy', () => {
+  it('copies the verdict into history with the state it leaves', () => {
+    const { history } = resolveAgentStatusLiveEntryStateHistory(
+      failedDone(),
+      { state: 'working' },
+      3_000
+    )
+    expect(history.at(-1)).toMatchObject({
+      state: 'done',
+      mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 2_000 }
+    })
+  })
+
+  it('draws a history done as failed from its own main agent status, not the live row', () => {
+    // The main agent failed before the row settled, so its clock differs from the row's.
+    const mainAgent = { ...FAILED_MAIN_AGENT, stateStartedAt: 1_500 }
+    const entry: AgentStatusEntry = {
+      ...failedDone({ state: 'working', stateStartedAt: 3_000, mainAgent: undefined }),
+      stateHistory: resolveAgentStatusLiveEntryStateHistory(
+        failedDone({ mainAgent }),
+        { state: 'working' },
+        3_000
+      ).history
+    }
+    const events = buildPaneActivityEvents({
+      entry,
+      worktree: makeWorktree(),
+      repo: null,
+      tab: makeTab(),
+      agentType: 'claude',
+      agentAlive: true,
+      acknowledgedAt: 0,
+      clearedAt: 0,
+      liveState: null
+    })
+    const done = events.find((event) => event.state === 'done')
+    expect(done?.entry.mainAgent).toEqual(mainAgent)
+    expect(done && agentTitle(done)).toBe('Agent failed')
+    expect(done && agentMeta(done)).toBe('Claude failed')
+  })
+
+  it('records the verdict on a sleep record and never hibernates a failed pane', () => {
+    const sleeping = sleepingRecordFromEntry({
+      state: STATE,
+      entry: failedDone(),
+      worktreeId: 'wt-1',
+      tab: makeTab(),
+      capturedAt: 3_000,
+      origin: 'live'
+    })
+    expect(sleeping?.mainAgent).toEqual({
+      state: 'done',
+      outcome: 'failure',
+      stateStartedAt: 2_000
+    })
+    expect(isValidCompletedAgentHibernationEntry(failedDone())).toBe(false)
+    // A live checkpoint of a turn that failed is still work the user owns.
+    expect(activationTreatsNoteAsFinished(record({ mainAgent: FAILED_MAIN_AGENT }))).toBe(false)
+    expect(activationTreatsNoteAsFinished(record())).toBe(true)
+  })
+
+  it('keeps the main agent status through persistence, and drops only a malformed one', () => {
+    const hydrate = (sleeping: unknown) => {
+      const result = parseWorkspaceSession({
+        activeRepoId: null,
+        activeWorktreeId: null,
+        activeTabId: null,
+        tabsByWorktree: {},
+        terminalLayoutsByTabId: {},
+        sleepingAgentSessionsByPaneKey: { [PANE_KEY]: sleeping }
+      })
+      return result.ok ? result.value.sleepingAgentSessionsByPaneKey?.[PANE_KEY] : undefined
+    }
+    const sleeping = sleepingRecordFromEntry({
+      state: STATE,
+      entry: failedDone(),
+      worktreeId: 'wt-1',
+      tab: makeTab(),
+      capturedAt: 3_000,
+      origin: 'live'
+    })
+    expect(hydrate(sleeping)?.mainAgent).toEqual(FAILED_MAIN_AGENT)
+    const malformed = hydrate({ ...sleeping, mainAgent: { state: 'done', outcome: 'failure' } })
+    expect(malformed).toMatchObject({ paneKey: PANE_KEY, state: 'done', origin: 'live' })
+    expect(malformed?.mainAgent).toBeUndefined()
+  })
+
+  it('leaves the verdict behind when the user sleeps the workspace', () => {
+    expect(manualSleepCaptureEntry(failedDone(), 4_000).mainAgent).not.toHaveProperty('outcome')
+  })
+
+  // A failure keeps its completion clock, so only a verdict compare sees success -> failure.
+  it('re-retains a done whose verdict changed under an unchanged flag and clock', () => {
+    const failed = failedDone()
+    const withVerdict = (outcome: 'success' | 'failure'): AgentStatusEntry => ({
+      ...failed,
+      mainAgent: { state: 'done', outcome, stateStartedAt: 2_000 }
+    })
+    const facts = (existing: AgentStatusEntry, entry: AgentStatusEntry) =>
+      deriveAgentStatusLiveFacts({
+        state: STATE,
+        paneKey: PANE_KEY,
+        entry,
+        existing,
+        launchConfigSource: undefined,
+        retainsResumableRecoveryIdentity: false,
+        commandCodeNewTurn: false,
+        updatedAt: 2_000
+      })
+    expect(facts(withVerdict('success'), withVerdict('failure')).retentionRelevantChange).toBe(true)
+    expect(facts(withVerdict('failure'), withVerdict('failure')).retentionRelevantChange).toBe(
+      false
+    )
+    // A main agent failing while its subagents keep the row working is a verdict change too.
+    const held = (outcome: 'success' | 'failure'): AgentStatusEntry => ({
+      ...withVerdict(outcome),
+      state: 'working'
+    })
+    expect(facts(held('success'), held('failure')).retentionRelevantChange).toBe(true)
+  })
+
+  it('treats a verdict change as a different record even when interrupted did not move', () => {
+    const clean = record({ mainAgent: { ...FAILED_MAIN_AGENT, outcome: 'success' } })
+    const failed = record({ mainAgent: FAILED_MAIN_AGENT })
+    expect(sleepingRecordsEquivalentIgnoringCaptureTime(clean, failed)).toBe(false)
+    expect(recoveryRecordMatches(clean, failed)).toBe(false)
+    expect(sleepingRecordsEquivalentIgnoringCaptureTime(failed, { ...failed })).toBe(true)
+  })
+})
diff --git a/src/renderer/src/store/slices/agent-status-worktree-drop-actions.ts b/src/renderer/src/store/slices/agent-status-worktree-drop-actions.ts
index b7d88675f6b..f8ac95b5dce 100644
--- a/src/renderer/src/store/slices/agent-status-worktree-drop-actions.ts
+++ b/src/renderer/src/store/slices/agent-status-worktree-drop-actions.ts
@@ -9,6 +9,7 @@ import {
   shouldReplaceRetainedWithLive
 } from './agent-status-pane-key-tab-binding'
 import { removePaneKeys } from './agent-status-pane-keyed-records'
+import { agentTurnStoppedByUser } from '../../../../shared/agent-main-agent-verdict'
 
 export function createAgentStatusWorktreeDropActions(
   runtime: AgentStatusRuntime
@@ -63,7 +64,7 @@ export function createAgentStatusWorktreeDropActions(
               allowedPaneKeys.has(paneKey) &&
               entry.state === 'done' &&
               entry.agentType !== undefined &&
-              entry.interrupted !== true
+              !agentTurnStoppedByUser(entry)
             ) {
               retainedEvidence.set(
                 paneKey,
diff --git a/src/renderer/src/store/slices/browser-remote-tab-creation.test.ts b/src/renderer/src/store/slices/browser-remote-tab-creation.test.ts
index 96230bf88a4..06fcaab8512 100644
--- a/src/renderer/src/store/slices/browser-remote-tab-creation.test.ts
+++ b/src/renderer/src/store/slices/browser-remote-tab-creation.test.ts
@@ -12,8 +12,9 @@ const createWebRuntimeSessionBrowserTabMock = vi.hoisted(() => vi.fn())
 const runtimeEnvironmentCall = vi.fn()
 const runtimeEnvironmentTransportCall = vi.fn()
 
-vi.mock('@/runtime/web-runtime-session', () => ({
-  createWebRuntimeSessionBrowserTab: createWebRuntimeSessionBrowserTabMock
+vi.mock('@/store/slices/browser/paired-browser-tab-creator', () => ({
+  getRegisteredPairedBrowserTabCreator: () => null,
+  loadPairedBrowserTabCreator: async () => createWebRuntimeSessionBrowserTabMock
 }))
 
 const mockApi = createBrowserMockApi(runtimeEnvironmentTransportCall)
diff --git a/src/renderer/src/store/slices/browser-slice-test-harness.ts b/src/renderer/src/store/slices/browser-slice-test-harness.ts
index dd60b4cacda..bad5a94139c 100644
--- a/src/renderer/src/store/slices/browser-slice-test-harness.ts
+++ b/src/renderer/src/store/slices/browser-slice-test-harness.ts
@@ -49,11 +49,13 @@ export function createBrowserMockApi(runtimeEnvironmentTransportCall: Mock): Bro
 export function createTestStore() {
   return create<AppState>()(
     (...a) =>
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a partial store; browser actions touch only the fields seeded here.
       ({
         settings: { activeRuntimeEnvironmentId: null } as AppState['settings'],
         activeWorktreeId: 'wt-1',
         browserDefaultUrl: 'about:blank',
         unifiedTabsByWorktree: {},
+        groupsByWorktree: {},
         tabBarOrderByWorktree: {},
         tabsByWorktree: {},
         openFiles: [],
diff --git a/src/renderer/src/store/slices/browser-tab-creation-placement.test.ts b/src/renderer/src/store/slices/browser-tab-creation-placement.test.ts
new file mode 100644
index 00000000000..37e44fd9cc5
--- /dev/null
+++ b/src/renderer/src/store/slices/browser-tab-creation-placement.test.ts
@@ -0,0 +1,459 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as AgentStatusModule from '@/lib/agent-status'
+import type { Tab, TabGroup } from '../../../../shared/tab-types'
+import type { ExecutionHostId } from '../../../../shared/execution-host'
+import type { FolderWorkspace } from '../../../../shared/folder-workspace-types'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
+import {
+  createTestStore,
+  makeTabGroup,
+  makeUnifiedTab,
+  makeWorktree,
+  seedStore
+} from './store-test-helpers'
+import { createStoreCascadesMockApi } from './store-cascades-test-harness'
+
+vi.mock('sonner', () => ({
+  toast: { info: vi.fn(), success: vi.fn(), error: vi.fn(), warning: vi.fn() }
+}))
+vi.mock('@/components/terminal-pane/pty-dispatcher', () => ({
+  restorePtyDataHandlersAfterFailedShutdown: vi.fn(),
+  unregisterPtyDataHandlers: vi.fn(() => [])
+}))
+vi.mock('@/lib/agent-status', async (importOriginal) => {
+  const actual = await importOriginal<typeof AgentStatusModule>()
+  return { ...actual, detectAgentStatusFromTitle: vi.fn().mockReturnValue(null) }
+})
+
+createStoreCascadesMockApi()
+
+const WT = 'repo1::/path/wt-placement'
+const G1 = 'group-1'
+const G2 = 'group-2'
+
+type Store = ReturnType<typeof createTestStore>
+
+function browserTab(id: string, groupId: string, extra: Partial<Tab> = {}): Tab {
+  return makeUnifiedTab({
+    id,
+    worktreeId: WT,
+    groupId,
+    contentType: 'browser',
+    entityId: `${id}-workspace`,
+    lastFocusedAt: 100,
+    ...extra
+  })
+}
+
+/** Unpinned A B C in G1 with B active; G2 holds X and is the focused group. */
+function seedSplit(store: Store, overrides: { tabs?: Tab[]; groups?: TabGroup[] } = {}): void {
+  seedStore(store, {
+    worktreesByRepo: { repo1: [makeWorktree({ id: WT, repoId: 'repo1' })] },
+    activeWorktreeId: WT,
+    unifiedTabsByWorktree: {
+      [WT]: overrides.tabs ?? [
+        browserTab('A', G1),
+        browserTab('B', G1),
+        browserTab('C', G1),
+        browserTab('X', G2)
+      ]
+    },
+    groupsByWorktree: {
+      [WT]: overrides.groups ?? [
+        makeTabGroup({
+          id: G1,
+          worktreeId: WT,
+          activeTabId: 'B',
+          tabOrder: ['A', 'B', 'C'],
+          recentTabIds: ['A', 'B']
+        }),
+        makeTabGroup({
+          id: G2,
+          worktreeId: WT,
+          activeTabId: 'X',
+          tabOrder: ['X'],
+          recentTabIds: ['X']
+        })
+      ]
+    },
+    activeGroupIdByWorktree: { [WT]: G2 },
+    layoutByWorktree: {
+      [WT]: {
+        type: 'split',
+        direction: 'horizontal',
+        first: { type: 'leaf', groupId: G1 },
+        second: { type: 'leaf', groupId: G2 }
+      }
+    }
+  })
+}
+
+function group(store: Store, groupId: string, worktreeId = WT): TabGroup | undefined {
+  return store.getState().groupsByWorktree[worktreeId]?.find((g) => g.id === groupId)
+}
+
+function createdUnifiedId(store: Store, workspaceId: string, worktreeId = WT): string {
+  const tab = store
+    .getState()
+    .unifiedTabsByWorktree[worktreeId]?.find((candidate) => candidate.entityId === workspaceId)
+  if (!tab) {
+    throw new Error(`no wrapper for ${workspaceId}`)
+  }
+  return tab.id
+}
+
+describe('browser tab creation placement', () => {
+  let store: Store
+
+  beforeEach(() => {
+    store = createTestStore()
+  })
+
+  it('appends Group New Browser Tab regardless of the active tab', async () => {
+    seedSplit(store)
+    await store.getState().openNewBrowserTabInActiveWorkspace(G1)
+    const n = store.getState().unifiedTabsByWorktree[WT]!.at(-1)!
+    expect(group(store, G1)?.tabOrder).toEqual(['A', 'B', 'C', n.id])
+
+    store.getState().activateTab('A')
+    await store.getState().openNewBrowserTabInActiveWorkspace(G1)
+    const m = store.getState().unifiedTabsByWorktree[WT]!.at(-1)!
+    expect(group(store, G1)?.tabOrder).toEqual(['A', 'B', 'C', n.id, m.id])
+  })
+
+  it('uses the invoking group workspace instead of the globally selected one', async () => {
+    seedSplit(store)
+    store.setState({ activeWorktreeId: 'repo1::/elsewhere' })
+    await store.getState().openNewBrowserTabInActiveWorkspace(G1)
+    expect(group(store, G1)?.tabOrder).toHaveLength(4)
+    expect(store.getState().unifiedTabsByWorktree['repo1::/elsewhere']).toBeUndefined()
+  })
+
+  it('places a duplicate directly after its source', () => {
+    seedSplit(store)
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { afterTabId: 'B' })
+    const duplicate = createdUnifiedId(store, workspace.id)
+    expect(group(store, G1)?.tabOrder).toEqual(['A', 'B', duplicate, 'C'])
+    expect(
+      store
+        .getState()
+        .unifiedTabsByWorktree[WT]!.filter((tab) => tab.groupId === G1)
+        .map((tab) => [tab.id, tab.sortOrder])
+    ).toEqual([
+      ['A', 0],
+      ['B', 1],
+      ['C', 3],
+      [duplicate, 2]
+    ])
+  })
+
+  it('places a background link after its source without touching selection or MRU', () => {
+    seedSplit(store)
+    const before = store.getState()
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com/link', { afterTabId: 'B', activate: false })
+    const link = createdUnifiedId(store, workspace.id)
+    const after = store.getState()
+
+    expect(group(store, G1)).toMatchObject({
+      tabOrder: ['A', 'B', link, 'C'],
+      activeTabId: 'B',
+      recentTabIds: ['A', 'B']
+    })
+    expect(after.activeGroupIdByWorktree[WT]).toBe(G2)
+    expect(after.activeWorktreeId).toBe(WT)
+    expect(after.activeTabType).toBe(before.activeTabType)
+    expect(after.activeBrowserTabId).toBe(before.activeBrowserTabId)
+    expect(after.unifiedTabsByWorktree[WT]!.find((tab) => tab.id === link)?.lastFocusedAt).toBe(
+      undefined
+    )
+    expect(after.unifiedTabsByWorktree[WT]!.find((tab) => tab.id === 'B')?.lastFocusedAt).toBe(100)
+  })
+
+  it('focuses the resolved group for a foreground source action in an unfocused split', () => {
+    seedSplit(store)
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { afterTabId: 'B' })
+    const created = createdUnifiedId(store, workspace.id)
+    const state = store.getState()
+    expect(state.activeGroupIdByWorktree[WT]).toBe(G1)
+    expect(group(store, G1)).toMatchObject({ activeTabId: created })
+    expect(group(store, G1)?.recentTabIds).toEqual(['A', 'B', created])
+    expect(state.activeBrowserTabId).toBe(workspace.id)
+    expect(state.activeTabType).toBe('browser')
+  })
+
+  it('lets an explicit destination win over the anchor group', () => {
+    seedSplit(store)
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { afterTabId: 'B', targetGroupId: G2 })
+    expect(group(store, G2)?.tabOrder).toEqual(['X', createdUnifiedId(store, workspace.id)])
+    expect(group(store, G1)?.tabOrder).toEqual(['A', 'B', 'C'])
+  })
+
+  it('treats a closed anchor as absent and appends in the active group', () => {
+    seedSplit(store)
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { afterTabId: 'closed-tab' })
+    expect(group(store, G2)?.tabOrder).toEqual(['X', createdUnifiedId(store, workspace.id)])
+  })
+
+  it('falls back to the active group, not the first group, for an expired requested group', () => {
+    seedSplit(store)
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { targetGroupId: 'deleted-group' })
+    expect(group(store, G2)?.tabOrder).toEqual(['X', createdUnifiedId(store, workspace.id)])
+  })
+
+  it('ignores an ambiguous anchor id', () => {
+    seedSplit(store, {
+      tabs: [browserTab('A', G1), browserTab('B', G1), browserTab('B', G2), browserTab('C', G1)]
+    })
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { afterTabId: 'B' })
+    expect(group(store, G2)?.tabOrder).toEqual(['X', createdUnifiedId(store, workspace.id)])
+  })
+
+  it('ignores an anchor whose group order no longer contains it', () => {
+    seedSplit(store, {
+      groups: [
+        makeTabGroup({ id: G1, worktreeId: WT, activeTabId: 'A', tabOrder: ['A', 'C'] }),
+        makeTabGroup({ id: G2, worktreeId: WT, activeTabId: 'X', tabOrder: ['X'] })
+      ]
+    })
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { afterTabId: 'B' })
+    expect(group(store, G2)?.tabOrder).toEqual(['X', createdUnifiedId(store, workspace.id)])
+  })
+
+  it('collapses duplicate order entries while inserting once', () => {
+    seedSplit(store, {
+      groups: [
+        makeTabGroup({ id: G1, worktreeId: WT, activeTabId: 'B', tabOrder: ['A', 'B', 'A', 'C'] }),
+        makeTabGroup({ id: G2, worktreeId: WT, activeTabId: 'X', tabOrder: ['X'] })
+      ]
+    })
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { afterTabId: 'B' })
+    expect(group(store, G1)?.tabOrder).toEqual([
+      'A',
+      'B',
+      createdUnifiedId(store, workspace.id),
+      'C'
+    ])
+  })
+
+  it('keeps an unpinned tab from a pinned source after the pinned prefix', () => {
+    seedSplit(store, {
+      tabs: [
+        browserTab('P1', G1, { isPinned: true }),
+        browserTab('P2', G1, { isPinned: true }),
+        browserTab('C', G1),
+        browserTab('X', G2)
+      ],
+      groups: [
+        makeTabGroup({ id: G1, worktreeId: WT, activeTabId: 'P1', tabOrder: ['P1', 'P2', 'C'] }),
+        makeTabGroup({ id: G2, worktreeId: WT, activeTabId: 'X', tabOrder: ['X'] })
+      ]
+    })
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { afterTabId: 'P1' })
+    expect(group(store, G1)?.tabOrder).toEqual([
+      'P1',
+      'P2',
+      createdUnifiedId(store, workspace.id),
+      'C'
+    ])
+  })
+
+  it('keeps a pinned candidate before the unpinned suffix and beside a pinned anchor', () => {
+    seedSplit(store, {
+      tabs: [
+        browserTab('P1', G1, { isPinned: true }),
+        browserTab('P2', G1, { isPinned: true }),
+        browserTab('C', G1),
+        browserTab('X', G2)
+      ],
+      groups: [
+        makeTabGroup({ id: G1, worktreeId: WT, activeTabId: 'P1', tabOrder: ['P1', 'P2', 'C'] }),
+        makeTabGroup({ id: G2, worktreeId: WT, activeTabId: 'X', tabOrder: ['X'] })
+      ]
+    })
+    const fromUnpinned = store
+      .getState()
+      .createUnifiedTab(WT, 'editor', { afterTabId: 'C', isPinned: true })
+    expect(group(store, G1)?.tabOrder).toEqual(['P1', 'P2', fromUnpinned.id, 'C'])
+    const fromPinned = store
+      .getState()
+      .createUnifiedTab(WT, 'editor', { afterTabId: 'P1', isPinned: true })
+    expect(group(store, G1)?.tabOrder).toEqual(['P1', fromPinned.id, 'P2', fromUnpinned.id, 'C'])
+    expect(fromPinned.sortOrder).toBe(1)
+  })
+
+  it('appends in the partition when preview replacement removes the anchor', () => {
+    seedSplit(store, {
+      tabs: [
+        browserTab('A', G1, { sortOrder: 0 }),
+        makeUnifiedTab({
+          id: 'P',
+          worktreeId: WT,
+          groupId: G1,
+          contentType: 'editor',
+          isPreview: true,
+          sortOrder: 1
+        }),
+        browserTab('C', G1, { sortOrder: 2 }),
+        browserTab('X', G2)
+      ],
+      groups: [
+        makeTabGroup({ id: G1, worktreeId: WT, activeTabId: 'P', tabOrder: ['A', 'P', 'C'] }),
+        makeTabGroup({ id: G2, worktreeId: WT, activeTabId: 'X', tabOrder: ['X'] })
+      ]
+    })
+    const created = store
+      .getState()
+      .createUnifiedTab(WT, 'editor', { afterTabId: 'P', isPreview: true, targetGroupId: G1 })
+    expect(group(store, G1)?.tabOrder).toEqual(['A', 'C', created.id])
+    expect(created.sortOrder).toBe(2)
+    const sortOrderById = Object.fromEntries(
+      store.getState().unifiedTabsByWorktree[WT]!.map((tab) => [tab.id, tab.sortOrder])
+    )
+    expect(sortOrderById).toMatchObject({ A: 0, C: 1, [created.id]: 2 })
+  })
+
+  it('leaves the wrapper host unset instead of stamping a substituted routing host', () => {
+    seedSplit(store)
+    // Why: no repo row and a focused runtime make the routing resolver substitute runtime:env-1.
+    store.setState({
+      activeWorktreeId: 'repo1::/elsewhere',
+      settings: { ...store.getState().settings!, activeRuntimeEnvironmentId: 'env-1' }
+    })
+    const workspace = store.getState().createBrowserTab(WT, 'https://example.com', {
+      activate: false,
+      browserRuntimeEnvironmentId: null
+    })
+    const wrapper = store
+      .getState()
+      .unifiedTabsByWorktree[WT]!.find((tab) => tab.entityId === workspace.id)
+    expect(wrapper).toBeDefined()
+    expect(wrapper?.executionHostId).toBeUndefined()
+  })
+
+  it('rejects an anchor owned by a foreign execution host', () => {
+    seedSplit(store, {
+      tabs: [browserTab('A', G1, { executionHostId: 'ssh:other' }), browserTab('X', G2)],
+      groups: [
+        makeTabGroup({ id: G1, worktreeId: WT, activeTabId: 'A', tabOrder: ['A'] }),
+        makeTabGroup({ id: G2, worktreeId: WT, activeTabId: 'X', tabOrder: ['X'] })
+      ]
+    })
+    const workspace = store.getState().createBrowserTab(WT, 'https://example.com', {
+      afterTabId: 'A',
+      executionHostId: 'runtime:env-1'
+    })
+    expect(group(store, G2)?.tabOrder).toEqual(['X', createdUnifiedId(store, workspace.id)])
+  })
+
+  it('accepts an SSH-backed anchor through the worktree runtime-owner alias', () => {
+    const sshHost: ExecutionHostId = 'ssh:target-1'
+    seedSplit(store, {
+      tabs: [browserTab('A', G1, { executionHostId: sshHost }), browserTab('C', G1)],
+      groups: [makeTabGroup({ id: G1, worktreeId: WT, activeTabId: 'A', tabOrder: ['A', 'C'] })]
+    })
+    store.setState({
+      worktreesByRepo: {
+        repo1: [
+          makeWorktree({
+            id: WT,
+            repoId: 'repo1',
+            hostId: sshHost,
+            runtimeOwnerEnvironmentId: 'env-1'
+          })
+        ]
+      }
+    })
+    const workspace = store.getState().createBrowserTab(WT, 'https://example.com', {
+      afterTabId: 'A',
+      executionHostId: 'runtime:env-1'
+    })
+    expect(group(store, G1)?.tabOrder).toEqual(['A', createdUnifiedId(store, workspace.id), 'C'])
+  })
+
+  it('places source actions in folder and floating workspaces', () => {
+    const folderWt = 'folder:folder-1'
+    const folder: FolderWorkspace = {
+      id: 'folder-1',
+      projectGroupId: 'pg',
+      name: 'Folder',
+      folderPath: '/tmp/folder',
+      executionHostId: 'local',
+      linkedTask: null,
+      comment: '',
+      isArchived: false,
+      isUnread: false,
+      isPinned: false,
+      sortOrder: 0,
+      lastActivityAt: 0,
+      createdAt: 0,
+      updatedAt: 0
+    }
+    for (const worktreeId of [folderWt, FLOATING_TERMINAL_WORKTREE_ID]) {
+      store.setState({
+        folderWorkspaces: [folder],
+        unifiedTabsByWorktree: {
+          ...store.getState().unifiedTabsByWorktree,
+          [worktreeId]: ['A', 'B'].map((id) =>
+            makeUnifiedTab({ id: `${worktreeId}-${id}`, worktreeId, groupId: `${worktreeId}-g` })
+          )
+        },
+        groupsByWorktree: {
+          ...store.getState().groupsByWorktree,
+          [worktreeId]: [
+            makeTabGroup({
+              id: `${worktreeId}-g`,
+              worktreeId,
+              activeTabId: `${worktreeId}-A`,
+              tabOrder: [`${worktreeId}-A`, `${worktreeId}-B`]
+            })
+          ]
+        }
+      })
+      const workspace = store.getState().createBrowserTab(worktreeId, 'https://example.com', {
+        afterTabId: `${worktreeId}-A`,
+        browserRuntimeEnvironmentId: null
+      })
+      expect(group(store, `${worktreeId}-g`, worktreeId)?.tabOrder).toEqual([
+        `${worktreeId}-A`,
+        createdUnifiedId(store, workspace.id, worktreeId),
+        `${worktreeId}-B`
+      ])
+    }
+  })
+
+  it('selects the first tab of an empty group structurally without recording a visit', () => {
+    seedSplit(store, {
+      groups: [
+        makeTabGroup({ id: G1, worktreeId: WT, activeTabId: null, tabOrder: [], recentTabIds: [] }),
+        makeTabGroup({ id: G2, worktreeId: WT, activeTabId: 'X', tabOrder: ['X'] })
+      ],
+      tabs: [browserTab('X', G2)]
+    })
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { targetGroupId: G1, activate: false })
+    const created = createdUnifiedId(store, workspace.id)
+    expect(group(store, G1)).toMatchObject({ activeTabId: created, recentTabIds: [] })
+    expect(store.getState().activeGroupIdByWorktree[WT]).toBe(G2)
+  })
+})
diff --git a/src/renderer/src/store/slices/browser/browser-slice-contract.ts b/src/renderer/src/store/slices/browser/browser-slice-contract.ts
index 3f3aa6ead2b..3cbeba14d98 100644
--- a/src/renderer/src/store/slices/browser/browser-slice-contract.ts
+++ b/src/renderer/src/store/slices/browser/browser-slice-contract.ts
@@ -39,6 +39,10 @@ export type CreateBrowserTabOptions = {
   sessionPartition?: string | null
   // Place the new tab in a specific group (e.g. "Open Preview to the Side"); defaults to the worktree's active group.
   targetGroupId?: string
+  /** Client-local unified tab id of the source; the new tab lands right after it when still live. */
+  afterTabId?: string
+  /** Verified execution host for the new wrapper; unset keeps createUnifiedTab's active-workspace fallback. */
+  executionHostId?: ExecutionHostId
   // Explicit "New Tab" focuses the address bar even with a real home URL; link-opened tabs leave it unset.
   focusAddressBar?: boolean
   browserRuntimeEnvironmentId?: string | null
diff --git a/src/renderer/src/store/slices/browser/browser-tab-actions.ts b/src/renderer/src/store/slices/browser/browser-tab-actions.ts
index 95ae0e7c7a7..2635cd32651 100644
--- a/src/renderer/src/store/slices/browser/browser-tab-actions.ts
+++ b/src/renderer/src/store/slices/browser/browser-tab-actions.ts
@@ -18,6 +18,11 @@ import {
 import { getBrowserSessionProfileHostId } from './browser-host-state'
 import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
 import { admitBrowserPageMount } from '@/components/browser-pane/host-guest/browser-page-mount-admission'
+import {
+  getRegisteredPairedBrowserTabCreator,
+  loadPairedBrowserTabCreator
+} from './paired-browser-tab-creator'
+import { findGroupAndWorktree } from '../tab-group-state'
 
 export function createBrowserTabActions(
   set: BrowserSliceSet,
@@ -151,19 +156,29 @@ export function createBrowserTabActions(
         (t) => t.contentType === 'browser' && t.entityId === workspaceId
       )
       if (!alreadyHasUnifiedTab) {
-        state.createUnifiedTab(worktreeId, 'browser', {
+        const shouldActivate = options?.activate ?? true
+        const created = state.createUnifiedTab(worktreeId, 'browser', {
           entityId: workspaceId,
           label: browserTab.title,
           targetGroupId: options?.targetGroupId,
-          activate: options?.activate ?? true
+          ...(options?.afterTabId ? { afterTabId: options.afterTabId } : {}),
+          // Why no routing-host default: a substituted host would disown the wrapper from its worktree.
+          ...(options?.executionHostId ? { executionHostId: options.executionHostId } : {}),
+          activate: shouldActivate
         })
+        // Why: unified creation already selected the tab and recorded the visit; only the group moves.
+        if (shouldActivate && created) {
+          get().focusGroup(worktreeId, created.groupId)
+        }
       }
       return browserTab
     },
 
     openNewBrowserTabInActiveWorkspace: async (groupId) => {
       const state = get()
-      const worktreeId = state.activeWorktreeId
+      // Why: the invoking group owns its workspace; global selection may already point elsewhere.
+      const worktreeId =
+        findGroupAndWorktree(state.groupsByWorktree, groupId)?.worktreeId ?? state.activeWorktreeId
       if (!worktreeId) {
         return
       }
@@ -179,9 +194,11 @@ export function createBrowserTabActions(
         if (!runtimeEnvironmentId) {
           throw new Error('The paired runtime browser provider is unavailable.')
         }
-        const { createWebRuntimeSessionBrowserTab } = await import('@/runtime/web-runtime-session')
+        // The registered path stages on the click; a cold runtime loads before staging.
+        const createPairedBrowserTab =
+          getRegisteredPairedBrowserTabCreator() ?? (await loadPairedBrowserTabCreator())
         try {
-          const created = await createWebRuntimeSessionBrowserTab({
+          const created = await createPairedBrowserTab({
             worktreeId,
             environmentId: runtimeEnvironmentId,
             url: defaultUrl,
@@ -230,9 +247,10 @@ export function createBrowserTabActions(
         if (!runtimeEnvironmentId) {
           return false
         }
-        const { createWebRuntimeSessionBrowserTab } = await import('@/runtime/web-runtime-session')
+        const createPairedBrowserTab =
+          getRegisteredPairedBrowserTabCreator() ?? (await loadPairedBrowserTabCreator())
         try {
-          return await createWebRuntimeSessionBrowserTab({
+          return await createPairedBrowserTab({
             worktreeId,
             environmentId: runtimeEnvironmentId,
             url,
diff --git a/src/renderer/src/store/slices/browser/paired-browser-tab-creator.ts b/src/renderer/src/store/slices/browser/paired-browser-tab-creator.ts
new file mode 100644
index 00000000000..bed32bd7f3b
--- /dev/null
+++ b/src/renderer/src/store/slices/browser/paired-browser-tab-creator.ts
@@ -0,0 +1,21 @@
+import type { CreateWebRuntimeSessionBrowserTabArgs } from '@/runtime/web-runtime-browser-creation-context'
+
+type PairedBrowserTabCreator = (args: CreateWebRuntimeSessionBrowserTabArgs) => Promise<boolean>
+
+let registeredCreator: PairedBrowserTabCreator | null = null
+
+// Why: the runtime imports the store, so its loaded module registers a synchronous creation path.
+// Cold calls use the lazy import below and stage once it resolves.
+export function registerPairedBrowserTabCreator(create: PairedBrowserTabCreator): void {
+  registeredCreator = create
+}
+
+export function getRegisteredPairedBrowserTabCreator(): PairedBrowserTabCreator | null {
+  return registeredCreator
+}
+
+export async function loadPairedBrowserTabCreator(): Promise<PairedBrowserTabCreator> {
+  const { createWebRuntimeSessionBrowserTab } =
+    await import('@/runtime/web-runtime-browser-creation')
+  return createWebRuntimeSessionBrowserTab
+}
diff --git a/src/renderer/src/store/slices/cmd-j-create-actions.test.ts b/src/renderer/src/store/slices/cmd-j-create-actions.test.ts
index acd617a9759..15cb73f3181 100644
--- a/src/renderer/src/store/slices/cmd-j-create-actions.test.ts
+++ b/src/renderer/src/store/slices/cmd-j-create-actions.test.ts
@@ -12,10 +12,14 @@ const createWebRuntimeSessionBrowserTabMock = vi.hoisted(() => vi.fn())
 const createWebRuntimeSessionTerminalMock = vi.hoisted(() => vi.fn())
 
 vi.mock('@/runtime/web-runtime-session', () => ({
-  createWebRuntimeSessionBrowserTab: createWebRuntimeSessionBrowserTabMock,
   createWebRuntimeSessionTerminal: createWebRuntimeSessionTerminalMock
 }))
 
+vi.mock('@/store/slices/browser/paired-browser-tab-creator', () => ({
+  getRegisteredPairedBrowserTabCreator: () => null,
+  loadPairedBrowserTabCreator: async () => createWebRuntimeSessionBrowserTabMock
+}))
+
 vi.mock('@/lib/focus-terminal-tab-surface', () => ({
   focusTerminalTabSurface: vi.fn()
 }))
diff --git a/src/renderer/src/store/slices/editor/actions/editor-cursor-line.test.ts b/src/renderer/src/store/slices/editor/actions/editor-cursor-line.test.ts
new file mode 100644
index 00000000000..2a5bae3024d
--- /dev/null
+++ b/src/renderer/src/store/slices/editor/actions/editor-cursor-line.test.ts
@@ -0,0 +1,61 @@
+import { describe, expect, it, vi } from 'vitest'
+import { createEditorStore } from '../../editor-slice-test-harness'
+
+describe('editor cursor-line store notifications', () => {
+  it('does not notify subscribers or copy accumulated lines for same-line cursor movement', () => {
+    const store = createEditorStore()
+    store.setState({
+      editorCursorLine: Object.fromEntries(
+        Array.from({ length: 250 }, (_, index) => [`file-${index}`, index + 1])
+      )
+    })
+    const before = store.getState()
+    let subscriberCalls = 0
+    const unsubscribe = store.subscribe(() => {
+      subscriberCalls += 1
+    })
+
+    for (let column = 1; column <= 2_000; column += 1) {
+      store.getState().setEditorCursorLine('file-49', 50)
+    }
+
+    unsubscribe()
+    expect(subscriberCalls).toBe(0)
+    expect(store.getState()).toBe(before)
+    expect(store.getState().editorCursorLine).toBe(before.editorCursorLine)
+  })
+
+  it('publishes exactly once for a changed line and preserves other file positions', () => {
+    const store = createEditorStore()
+    store.getState().setEditorCursorLine('local-file', 10)
+    store.getState().setEditorCursorLine('remote-file', 30)
+    const before = store.getState().editorCursorLine
+    const subscriber = vi.fn()
+    const unsubscribe = store.subscribe(subscriber)
+
+    store.getState().setEditorCursorLine('local-file', 11)
+    store.getState().setEditorCursorLine('local-file', 11)
+
+    unsubscribe()
+    expect(subscriber).toHaveBeenCalledOnce()
+    expect(before).toEqual({ 'local-file': 10, 'remote-file': 30 })
+    expect(store.getState().editorCursorLine).toEqual({ 'local-file': 11, 'remote-file': 30 })
+  })
+
+  it('records the initial position independently for each file identity', () => {
+    const store = createEditorStore()
+    const subscriber = vi.fn()
+    const unsubscribe = store.subscribe(subscriber)
+
+    store.getState().setEditorCursorLine('editor:workspace:local:file.ts', 1)
+    store.getState().setEditorCursorLine('editor:workspace:runtime-a:file.ts', 1)
+    store.getState().setEditorCursorLine('editor:workspace:runtime-a:file.ts', 1)
+
+    unsubscribe()
+    expect(subscriber).toHaveBeenCalledTimes(2)
+    expect(store.getState().editorCursorLine).toEqual({
+      'editor:workspace:local:file.ts': 1,
+      'editor:workspace:runtime-a:file.ts': 1
+    })
+  })
+})
diff --git a/src/renderer/src/store/slices/editor/actions/editor-cursor-line.ts b/src/renderer/src/store/slices/editor/actions/editor-cursor-line.ts
index 7b193b3521b..bda6ed3c808 100644
--- a/src/renderer/src/store/slices/editor/actions/editor-cursor-line.ts
+++ b/src/renderer/src/store/slices/editor/actions/editor-cursor-line.ts
@@ -8,8 +8,10 @@ export function createEditorCursorLine(
   return {
     editorCursorLine: {},
     setEditorCursorLine: (fileId, line) =>
-      set((s) => ({
-        editorCursorLine: { ...s.editorCursorLine, [fileId]: line }
-      }))
+      set((s) =>
+        s.editorCursorLine[fileId] === line
+          ? s
+          : { editorCursorLine: { ...s.editorCursorLine, [fileId]: line } }
+      )
   }
 }
diff --git a/src/renderer/src/store/slices/editor/actions/editor-draft-state.test.ts b/src/renderer/src/store/slices/editor/actions/editor-draft-state.test.ts
new file mode 100644
index 00000000000..1bf0ea275ac
--- /dev/null
+++ b/src/renderer/src/store/slices/editor/actions/editor-draft-state.test.ts
@@ -0,0 +1,50 @@
+import { describe, expect, it, vi } from 'vitest'
+import { createEditorStore } from '../../editor-slice-test-harness'
+
+describe('editor draft publications', () => {
+  it.each(['', 'unsaved edit'])('does not publish an identical existing draft: %j', (content) => {
+    const store = createEditorStore()
+    store.getState().setEditorDraft('/repo/file.ts', content)
+    const before = store.getState()
+    const listener = vi.fn()
+    const unsubscribe = store.subscribe(listener)
+
+    store.getState().setEditorDraft('/repo/file.ts', content)
+
+    expect(store.getState()).toBe(before)
+    expect(listener).not.toHaveBeenCalled()
+    unsubscribe()
+  })
+
+  it('publishes a new empty draft and a changed draft exactly once each', () => {
+    const store = createEditorStore()
+    const listener = vi.fn()
+    const unsubscribe = store.subscribe(listener)
+
+    store.getState().setEditorDraft('/repo/file.ts', '')
+    expect(store.getState().editorDrafts).toEqual({ '/repo/file.ts': '' })
+    expect(listener).toHaveBeenCalledTimes(1)
+
+    listener.mockClear()
+    store.getState().setEditorDraft('/repo/file.ts', 'changed')
+    expect(store.getState().editorDrafts).toEqual({ '/repo/file.ts': 'changed' })
+    expect(listener).toHaveBeenCalledTimes(1)
+    unsubscribe()
+  })
+
+  it('scopes draft equality to the exact editor identity', () => {
+    const store = createEditorStore()
+    store.getState().setEditorDraft('local-file', 'same text')
+    const listener = vi.fn()
+    const unsubscribe = store.subscribe(listener)
+
+    store.getState().setEditorDraft('remote-file', 'same text')
+
+    expect(store.getState().editorDrafts).toEqual({
+      'local-file': 'same text',
+      'remote-file': 'same text'
+    })
+    expect(listener).toHaveBeenCalledTimes(1)
+    unsubscribe()
+  })
+})
diff --git a/src/renderer/src/store/slices/editor/actions/editor-draft-state.ts b/src/renderer/src/store/slices/editor/actions/editor-draft-state.ts
index 19501b60fe2..dc650ab750a 100644
--- a/src/renderer/src/store/slices/editor/actions/editor-draft-state.ts
+++ b/src/renderer/src/store/slices/editor/actions/editor-draft-state.ts
@@ -34,6 +34,9 @@ export function createEditorDraftState(set: EditorSet, _get: EditorGet): EditorD
     editorDrafts: {},
     setEditorDraft: (fileId, content) =>
       set((s) => {
+        if (s.editorDrafts[fileId] === content) {
+          return s
+        }
         // Why: read-only tabs must never accrue a draft — it seeds dirty/autosave/hot-exit restore that could overwrite an agent transcript.
         const file = s.openFiles.find((f) => f.id === fileId)
         if (file?.readOnly === true) {
diff --git a/src/renderer/src/store/slices/github-pr-comments.test.ts b/src/renderer/src/store/slices/github-pr-comments.test.ts
index 8432f944fd4..b78fe1589f6 100644
--- a/src/renderer/src/store/slices/github-pr-comments.test.ts
+++ b/src/renderer/src/store/slices/github-pr-comments.test.ts
@@ -234,62 +234,6 @@ describe('createGitHubSlice.fetchPRComments', () => {
       vi.useRealTimers()
     }
   })
-
-  it('preserves cached checks when the checks IPC fails', async () => {
-    const store = createTestStore()
-    const repoPath = '/repo'
-    const branch = 'feature/test'
-    const checksCacheKey = `${repoPath}::pr-checks::12`
-    const cachedChecks = [
-      { name: 'build', status: 'completed', conclusion: 'failure', url: null } as const
-    ]
-
-    store.setState({
-      checksCache: {
-        [checksCacheKey]: {
-          data: cachedChecks,
-          fetchedAt: 1,
-          headSha: 'abc123head'
-        }
-      }
-    } as unknown as Partial<AppState>)
-    mockApi.gh.prChecks.mockRejectedValueOnce(new Error('rate limited'))
-
-    await expect(
-      store.getState().fetchPRChecks(repoPath, 12, branch, 'abc123head', null, { force: true })
-    ).resolves.toEqual(cachedChecks)
-
-    expect(store.getState().checksCache[checksCacheKey]?.data).toEqual(cachedChecks)
-    expect(store.getState().checksCache[checksCacheKey]?.fetchedAt).toBe(1)
-  })
-
-  it('does not return cached checks for a different requested head SHA after IPC failure', async () => {
-    const store = createTestStore()
-    const repoPath = '/repo'
-    const branch = 'feature/test'
-    const checksCacheKey = `${repoPath}::pr-checks::12`
-    const oldHeadChecks = [
-      { name: 'build', status: 'completed', conclusion: 'success', url: null } as const
-    ]
-
-    store.setState({
-      checksCache: {
-        [checksCacheKey]: {
-          data: oldHeadChecks,
-          fetchedAt: 1,
-          headSha: 'old-head'
-        }
-      }
-    } as unknown as Partial<AppState>)
-    mockApi.gh.prChecks.mockRejectedValueOnce(new Error('rate limited'))
-
-    await expect(
-      store.getState().fetchPRChecks(repoPath, 12, branch, 'new-head', null, { force: true })
-    ).resolves.toEqual([])
-
-    expect(store.getState().checksCache[checksCacheKey]?.data).toEqual(oldHeadChecks)
-    expect(store.getState().checksCache[checksCacheKey]?.headSha).toBe('old-head')
-  })
 })
 
 describe('createGitHubSlice PR comment mutations', () => {
diff --git a/src/renderer/src/store/slices/github-pr-request-lifetime.test.ts b/src/renderer/src/store/slices/github-pr-request-lifetime.test.ts
new file mode 100644
index 00000000000..ddd96471231
--- /dev/null
+++ b/src/renderer/src/store/slices/github-pr-request-lifetime.test.ts
@@ -0,0 +1,154 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { PRRefreshOutcome } from '../../../../shared/github/pull-request-refresh-types'
+import { inflightPRRequests, prRequestGenerations } from '../github/request-coordination'
+import {
+  createTestStore,
+  makePR,
+  mockApi,
+  resetRemoteRuntimeMocks,
+  runtimeEnvironmentCall
+} from './github-slice-test-harness'
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.setSystemTime(1000)
+  vi.clearAllMocks()
+  resetRemoteRuntimeMocks()
+  mockApi.gh.refreshPRNow.mockReset()
+  vi.spyOn(console, 'error').mockImplementation(() => undefined)
+})
+
+afterEach(() => {
+  vi.clearAllTimers()
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+})
+
+function found(number: number): PRRefreshOutcome {
+  return { kind: 'found', pr: makePR({ number }), fetchedAt: Date.now() }
+}
+
+const cases = [
+  { route: 'local', replacement: 'force', outcome: 'found' },
+  { route: 'local', replacement: 'hint', outcome: 'found' },
+  { route: 'local', replacement: 'force', outcome: 'rejected' },
+  { route: 'runtime', replacement: 'force', outcome: 'found' },
+  { route: 'runtime', replacement: 'force', outcome: 'upstream-error' },
+  { route: 'runtime', replacement: 'hint', outcome: 'no-pr' }
+] as const
+
+describe('pull-request lookup ownership after newer settlement', () => {
+  it.each(cases)(
+    'preserves $route lookup after late $outcome with $replacement replacement',
+    async ({ route, replacement, outcome }) => {
+      const store = createTestStore()
+      const pending: ReturnType<typeof Promise.withResolvers<PRRefreshOutcome>>[] = []
+      const startRequest = () => {
+        const request = Promise.withResolvers<PRRefreshOutcome>()
+        pending.push(request)
+        return request.promise
+      }
+      if (route === 'runtime') {
+        store.setState({
+          repos: [
+            {
+              id: 'runtime-repo',
+              path: '/runtime/repo',
+              displayName: 'Runtime repo',
+              badgeColor: 'blue',
+              addedAt: 1,
+              executionHostId: 'runtime:env-1'
+            }
+          ]
+        })
+        runtimeEnvironmentCall.mockImplementation(async () => ({
+          id: 'rpc',
+          ok: true,
+          result: await startRequest()
+        }))
+      } else {
+        mockApi.gh.refreshPRNow.mockImplementation(startRequest)
+      }
+      const path = route === 'runtime' ? '/runtime/repo' : '/local/repo'
+      const branch = `lifetime-${route}-${replacement}-${outcome}`
+      const options = replacement === 'hint' ? { force: true, fallbackPRNumber: 10 } : undefined
+      const first = store.getState().fetchPRForBranch(path, branch, options)
+      await vi.waitFor(() => expect(pending).toHaveLength(1))
+      vi.setSystemTime(2000)
+      const secondOptions =
+        replacement === 'hint' ? { force: true, fallbackPRNumber: 20 } : { force: true }
+      const second = store.getState().fetchPRForBranch(path, branch, secondOptions)
+      await vi.waitFor(() => expect(pending).toHaveLength(2))
+      pending[1].resolve(found(20))
+      await second
+      expect(prRequestGenerations.size).toBe(0)
+
+      vi.setSystemTime(3000)
+      const third = store.getState().fetchPRForBranch(path, branch, secondOptions)
+      await vi.waitFor(() => expect(pending).toHaveLength(3))
+      const activeBefore = [...inflightPRRequests.values()][0]
+      const key = [...inflightPRRequests.keys()][0]
+      expect(activeBefore).toBeDefined()
+      if (outcome === 'rejected') {
+        pending[0].reject(new Error('old lookup failed'))
+      } else if (outcome === 'upstream-error') {
+        pending[0].resolve({
+          kind: 'upstream-error',
+          message: 'old error',
+          errorType: 'unknown',
+          fetchedAt: 3000
+        })
+      } else if (outcome === 'no-pr') {
+        pending[0].resolve({ kind: 'no-pr', fetchedAt: 3000 })
+      } else {
+        pending[0].resolve(found(10))
+      }
+      await first
+      const activeAfter = inflightPRRequests.get(key)
+      const cachedAfterStale = store.getState().prCache[key]?.data?.number
+      const refreshStateAfter = store.getState().prRefreshStates[key]
+      vi.setSystemTime(4000)
+      const follower = store.getState().fetchPRForBranch(path, branch, secondOptions)
+      await vi.waitFor(() => expect(pending.length).toBeGreaterThanOrEqual(3))
+      await Promise.resolve()
+      const requestCount = pending.length
+      pending[2].resolve(found(30))
+      pending[3]?.resolve(found(40))
+      const results = await Promise.all([third, follower])
+
+      expect(activeAfter).toBe(activeBefore)
+      // The stale lookup asked for PR 10; only the live lookup may publish.
+      expect(cachedAfterStale).toBe(20)
+      expect(refreshStateAfter).toBeUndefined()
+      expect(requestCount).toBe(3)
+      expect(results.map((result) => result?.number)).toEqual([30, 30])
+      expect(store.getState().prCache[key]?.data?.number).toBe(30)
+      expect(inflightPRRequests.size).toBe(0)
+      expect(prRequestGenerations.size).toBe(0)
+      if (route === 'runtime') {
+        expect(mockApi.gh.refreshPRNow).not.toHaveBeenCalled()
+      } else {
+        expect(runtimeEnvironmentCall).not.toHaveBeenCalled()
+      }
+    }
+  )
+
+  it('dedupes each branch independently and removes settled generation entries', async () => {
+    const store = createTestStore()
+    const pending = Promise.withResolvers<PRRefreshOutcome>()
+    mockApi.gh.refreshPRNow.mockReturnValue(pending.promise)
+    const calls = ['one', 'two'].flatMap((branch) =>
+      Array.from({ length: 10 }, () =>
+        store.getState().fetchPRForBranch('/repo', branch, { force: true })
+      )
+    )
+    expect(mockApi.gh.refreshPRNow).toHaveBeenCalledTimes(2)
+    expect(prRequestGenerations.size).toBe(2)
+
+    pending.resolve(found(12))
+    await Promise.all(calls)
+
+    expect(inflightPRRequests.size).toBe(0)
+    expect(prRequestGenerations.size).toBe(0)
+  })
+})
diff --git a/src/renderer/src/store/slices/github-project-request-coordination.test.ts b/src/renderer/src/store/slices/github-project-request-coordination.test.ts
index 96e4632e909..40a64f77ce7 100644
--- a/src/renderer/src/store/slices/github-project-request-coordination.test.ts
+++ b/src/renderer/src/store/slices/github-project-request-coordination.test.ts
@@ -73,7 +73,7 @@ describe('createGitHubSlice.fetchProjectViewTable coordination', () => {
     expect(mockApi.gh.getProjectViewTable).toHaveBeenCalledTimes(1)
   })
 
-  it('lets each forced waiter start after a weaker request settles', async () => {
+  it('shares one fresh request across twenty forced waiters after a weaker request', async () => {
     const store = createTestStore()
     const weak = Promise.withResolvers<GetProjectViewTableResult>()
     mockApi.gh.getProjectViewTable
@@ -81,12 +81,16 @@ describe('createGitHubSlice.fetchProjectViewTable coordination', () => {
       .mockResolvedValue({ ok: true, data: makeTable('forced') })
 
     const first = store.getState().fetchProjectViewTable(request)
-    const forcedOne = store.getState().fetchProjectViewTable(request, { force: true })
-    const forcedTwo = store.getState().fetchProjectViewTable(request, { force: true })
+    const forced = Array.from({ length: 20 }, () =>
+      store.getState().fetchProjectViewTable(request, { force: true })
+    )
     weak.resolve({ ok: true, data: makeTable('weak') })
 
-    await expect(Promise.all([first, forcedOne, forcedTwo])).resolves.toHaveLength(3)
-    expect(mockApi.gh.getProjectViewTable).toHaveBeenCalledTimes(3)
+    await expect(first).resolves.toEqual({ ok: true, data: makeTable('weak') })
+    await expect(Promise.all(forced)).resolves.toEqual(
+      Array.from({ length: 20 }, () => ({ ok: true, data: makeTable('forced') }))
+    )
+    expect(mockApi.gh.getProjectViewTable).toHaveBeenCalledTimes(2)
   })
 
   it('stamps a classified failure onto stale data only when the view key is known', async () => {
diff --git a/src/renderer/src/store/slices/github-work-items-query-bounds.test.ts b/src/renderer/src/store/slices/github-work-items-query-bounds.test.ts
deleted file mode 100644
index 40b89fdd4d5..00000000000
--- a/src/renderer/src/store/slices/github-work-items-query-bounds.test.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-import { describe, expect, it } from 'vitest'
-
-import {
-  GITHUB_WORK_ITEMS_QUERY_MAX_BYTES,
-  isGitHubWorkItemsQueryTooLarge
-} from './github-work-items-query-bounds'
-
-describe('GitHub work item query bounds', () => {
-  it('allows normal GitHub search syntax', () => {
-    expect(isGitHubWorkItemsQueryTooLarge('is:pr is:open label:bug')).toBe(false)
-  })
-
-  it('rejects oversized pasted work item queries', () => {
-    expect(isGitHubWorkItemsQueryTooLarge('x'.repeat(GITHUB_WORK_ITEMS_QUERY_MAX_BYTES))).toBe(
-      false
-    )
-    expect(isGitHubWorkItemsQueryTooLarge('x'.repeat(GITHUB_WORK_ITEMS_QUERY_MAX_BYTES + 1))).toBe(
-      true
-    )
-  })
-
-  it('measures UTF-8 bytes for non-ASCII query text', () => {
-    expect(isGitHubWorkItemsQueryTooLarge(String.fromCodePoint(0x1f600).repeat(3_000))).toBe(true)
-  })
-})
diff --git a/src/renderer/src/store/slices/hosted-review-request-lifetime.test.ts b/src/renderer/src/store/slices/hosted-review-request-lifetime.test.ts
new file mode 100644
index 00000000000..747e2fefd03
--- /dev/null
+++ b/src/renderer/src/store/slices/hosted-review-request-lifetime.test.ts
@@ -0,0 +1,169 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { create } from 'zustand'
+import type { HostedReviewInfo } from '../../../../shared/hosted-review'
+import type { AppState } from '../types'
+import { createHostedReviewSlice } from './hosted-review'
+import {
+  _clearHostedReviewRequestGenerationsForTest,
+  hostedReviewRequestGenerations,
+  inflightHostedReviewRequests
+} from './hosted-review-request-state'
+
+const runtimeRpc = vi.hoisted(() => ({ callRuntimeRpc: vi.fn() }))
+vi.mock('@/runtime/runtime-rpc-client', () => ({
+  callRuntimeRpc: runtimeRpc.callRuntimeRpc,
+  getActiveRuntimeTarget: (settings: AppState['settings']) => {
+    const environmentId = settings?.activeRuntimeEnvironmentId
+    return environmentId ? { kind: 'environment', environmentId } : { kind: 'local' }
+  }
+}))
+
+const forBranch = vi.fn()
+type TestState = Pick<
+  AppState,
+  | 'settings'
+  | 'repos'
+  | 'prCache'
+  | 'hostedReviewCache'
+  | 'fetchHostedReviewForBranch'
+  | 'getHostedReviewCreationEligibility'
+  | 'createHostedReview'
+  | 'createStackedHostedReview'
+>
+
+function makeStore(runtime = false) {
+  return create<TestState>()((...args) => ({
+    settings: null,
+    repos: [
+      {
+        id: 'repo',
+        path: '/repo',
+        displayName: 'Repo',
+        badgeColor: 'blue',
+        addedAt: 1,
+        ...(runtime ? { executionHostId: 'runtime:env-1' } : {})
+      }
+    ],
+    prCache: {},
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This harness provides every state field read by the hosted-review slice.
+    ...createHostedReviewSlice(...(args as Parameters<typeof createHostedReviewSlice>))
+  }))
+}
+
+function review(number: number): HostedReviewInfo {
+  return {
+    provider: 'gitlab',
+    number,
+    title: `Review ${number}`,
+    state: 'open',
+    url: `https://gitlab.com/group/project/-/merge_requests/${number}`,
+    status: 'success',
+    updatedAt: '2026-09-25T00:00:00Z',
+    mergeable: 'MERGEABLE'
+  }
+}
+
+beforeEach(() => {
+  _clearHostedReviewRequestGenerationsForTest()
+  vi.useFakeTimers()
+  vi.setSystemTime(1000)
+  forBranch.mockReset()
+  runtimeRpc.callRuntimeRpc.mockReset()
+  vi.stubGlobal('window', { api: { hostedReview: { forBranch } } })
+  vi.spyOn(console, 'error').mockImplementation(() => undefined)
+})
+
+afterEach(() => {
+  _clearHostedReviewRequestGenerationsForTest()
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+  vi.unstubAllGlobals()
+})
+
+const cases = [
+  { route: 'local', replacement: 'force', outcome: 'found' },
+  { route: 'local', replacement: 'force', outcome: 'rejected' },
+  { route: 'local', replacement: 'hint', outcome: 'found' },
+  { route: 'runtime', replacement: 'force', outcome: 'found' },
+  { route: 'runtime', replacement: 'force', outcome: 'missing' },
+  { route: 'runtime', replacement: 'hint', outcome: 'rejected' }
+] as const
+
+describe('hosted review lookup ownership after newer settlement', () => {
+  it.each(cases)(
+    'preserves $route lookup after late $outcome with $replacement replacement',
+    async ({ route, replacement, outcome }) => {
+      const store = makeStore(route === 'runtime')
+      const pending: ReturnType<typeof Promise.withResolvers<HostedReviewInfo | null>>[] = []
+      const startRequest = () => {
+        const request = Promise.withResolvers<HostedReviewInfo | null>()
+        pending.push(request)
+        return request.promise
+      }
+      const dispatch = route === 'runtime' ? runtimeRpc.callRuntimeRpc : forBranch
+      dispatch.mockImplementation(startRequest)
+      const branch = `${route}-${replacement}-${outcome}`
+      const firstOptions = replacement === 'hint' ? { force: true, linkedGitLabMR: 10 } : {}
+      const first = store.getState().fetchHostedReviewForBranch('/repo', branch, firstOptions)
+      vi.setSystemTime(2000)
+      const options = replacement === 'hint' ? { force: true, linkedGitLabMR: 20 } : { force: true }
+      const second = store.getState().fetchHostedReviewForBranch('/repo', branch, options)
+      expect(pending).toHaveLength(2)
+      pending[1].resolve(review(20))
+      await second
+      expect(hostedReviewRequestGenerations.size).toBe(0)
+      vi.setSystemTime(3000)
+      const third = store.getState().fetchHostedReviewForBranch('/repo', branch, options)
+      expect(pending).toHaveLength(3)
+      const entry = [...inflightHostedReviewRequests.entries()].at(-1)
+      expect(entry).toBeDefined()
+      if (!entry) {
+        throw new Error('Expected a pending lookup')
+      }
+      const [key, owner] = entry
+      const cacheKey = [...hostedReviewRequestGenerations.keys()][0]
+      const generationBefore = hostedReviewRequestGenerations.get(cacheKey)
+      if (outcome === 'rejected') {
+        pending[0].reject(new Error('Old lookup failed'))
+      } else {
+        pending[0].resolve(outcome === 'missing' ? null : review(10))
+      }
+      await first
+      const currentOwner = inflightHostedReviewRequests.get(key)
+      const generationAfter = hostedReviewRequestGenerations.get(cacheKey)
+      const cachedBefore = store.getState().hostedReviewCache[cacheKey].data
+      const follower = store.getState().fetchHostedReviewForBranch('/repo', branch, options)
+      const requestCount = pending.length
+      pending[2].resolve(review(30))
+      pending[3]?.resolve(review(40))
+      const results = await Promise.all([third, follower])
+
+      expect(currentOwner).toBe(owner)
+      expect(generationAfter).toBe(generationBefore)
+      expect(cachedBefore?.number).toBe(20)
+      expect(requestCount).toBe(3)
+      expect(results.map((result) => result?.number)).toEqual([30, 30])
+      expect(store.getState().hostedReviewCache[cacheKey].data?.number).toBe(30)
+      expect(inflightHostedReviewRequests.size).toBe(0)
+      expect(hostedReviewRequestGenerations.size).toBe(0)
+      expect(route === 'runtime' ? forBranch : runtimeRpc.callRuntimeRpc).not.toHaveBeenCalled()
+    }
+  )
+
+  it('dedupes each branch independently and removes settled generation entries', async () => {
+    const store = makeStore()
+    const pending = Promise.withResolvers<HostedReviewInfo | null>()
+    forBranch.mockReturnValue(pending.promise)
+    const callers = ['one', 'two'].flatMap((branch) =>
+      Array.from({ length: 10 }, () =>
+        store.getState().fetchHostedReviewForBranch('/repo', branch, { force: true })
+      )
+    )
+    expect(forBranch).toHaveBeenCalledTimes(2)
+    expect(hostedReviewRequestGenerations.size).toBe(2)
+    pending.resolve(review(20))
+    await Promise.all(callers)
+    expect(inflightHostedReviewRequests.size).toBe(0)
+    expect(hostedReviewRequestGenerations.size).toBe(0)
+  })
+})
diff --git a/src/renderer/src/store/slices/hosted-review.ts b/src/renderer/src/store/slices/hosted-review.ts
index cad350d986b..af4dff3e862 100644
--- a/src/renderer/src/store/slices/hosted-review.ts
+++ b/src/renderer/src/store/slices/hosted-review.ts
@@ -8,6 +8,7 @@ import type {
 } from '../../../../shared/hosted-review'
 import { callRuntimeRpc, getActiveRuntimeTarget } from '@/runtime/runtime-rpc-client'
 import type { AppState } from '../types'
+import { nextLookupGeneration } from '../lookup-generation-sequence'
 import {
   getHostedReviewCacheKey,
   linkedReviewHintKey,
@@ -186,7 +187,7 @@ export const createHostedReviewSlice: StateCreator<AppState, [], [], HostedRevie
 
     const inflightRequest = inflightHostedReviewRequests.get(requestKey)
     const startRequest = (): Promise<HostedReviewInfo | null> => {
-      const generation = (requestGenerations.get(cacheKey) ?? 0) + 1
+      const generation = nextLookupGeneration()
       const requestStartedAt = Date.now()
       const requestStartedEntry = get().hostedReviewCache[cacheKey]
       requestGenerations.set(cacheKey, generation)
diff --git a/src/renderer/src/store/slices/jira-collection-read-actions.ts b/src/renderer/src/store/slices/jira-collection-read-actions.ts
index c604b92a501..b79d358cea5 100644
--- a/src/renderer/src/store/slices/jira-collection-read-actions.ts
+++ b/src/renderer/src/store/slices/jira-collection-read-actions.ts
@@ -42,19 +42,15 @@ function handleJiraCollectionReadError(
   mutationGeneration: number,
   set: JiraSliceSet,
   get: JiraSliceGet,
-  options?: { abortable?: boolean }
+  options: { abortable?: boolean; currentRequest: boolean }
 ): JiraIssue[] {
-  if (
-    isIntegrationCredentialDecryptionError(error) &&
-    canWriteCollectionResult(scope, mutationGeneration, get)
-  ) {
+  const canWrite =
+    options.currentRequest && canWriteCollectionResult(scope, mutationGeneration, get)
+  if (isIntegrationCredentialDecryptionError(error) && canWrite) {
     if (!shouldRefreshJiraStatusAfterRead(siteId, get().jiraStatus, options)) {
       void get().checkJiraConnection()
     }
-  } else if (
-    looksLikeJiraAuthError(error) &&
-    canWriteCollectionResult(scope, mutationGeneration, get)
-  ) {
+  } else if (looksLikeJiraAuthError(error) && canWrite) {
     markJiraConnectionLost(set, scope)
   }
   if (isIntegrationCredentialDecryptionError(error) || looksLikeJiraAuthError(error)) {
@@ -74,7 +70,7 @@ export function createJiraCollectionReadActions(
         options && 'siteId' in options ? options.siteId : getSelectedJiraSiteId(get().jiraStatus)
       const cacheKey = scopedJiraCacheKey(scope, `${siteId ?? 'default'}::${jql}::${limit}`)
       const cached = get().jiraSearchCache[cacheKey]
-      if (isFreshJiraCacheEntry(cached)) {
+      if (!options?.force && isFreshJiraCacheEntry(cached)) {
         return cached.data ?? []
       }
       const inflight = inflightSearchRequests.get(cacheKey)
@@ -82,6 +78,7 @@ export function createJiraCollectionReadActions(
       const requestMutationGeneration = currentJiraMutationGeneration()
       if (
         !abortable &&
+        !options?.force &&
         inflight &&
         inflight.contextKey === scope.contextKey &&
         inflight.mutationGeneration === requestMutationGeneration
@@ -119,7 +116,10 @@ export function createJiraCollectionReadActions(
             requestMutationGeneration,
             set,
             get,
-            { abortable }
+            {
+              abortable,
+              currentRequest: abortable || inflightSearchRequests.get(cacheKey) === entry
+            }
           )
         })
         .finally(() => {
@@ -153,12 +153,13 @@ export function createJiraCollectionReadActions(
         `${siteId ?? 'default'}::list::${filter}::${limit}`
       )
       const cached = get().jiraSearchCache[cacheKey]
-      if (isFreshJiraCacheEntry(cached)) {
+      if (!options?.force && isFreshJiraCacheEntry(cached)) {
         return cached.data ?? []
       }
       const inflight = inflightListRequests.get(cacheKey)
       const requestMutationGeneration = currentJiraMutationGeneration()
       if (
+        !options?.force &&
         inflight &&
         inflight.contextKey === scope.contextKey &&
         inflight.mutationGeneration === requestMutationGeneration
@@ -189,7 +190,8 @@ export function createJiraCollectionReadActions(
             siteId,
             requestMutationGeneration,
             set,
-            get
+            get,
+            { currentRequest: inflightListRequests.get(cacheKey) === entry }
           )
         })
         .finally(() => {
diff --git a/src/renderer/src/store/slices/jira-slice-contract.ts b/src/renderer/src/store/slices/jira-slice-contract.ts
index c33a3068c7a..0ffc9d04d36 100644
--- a/src/renderer/src/store/slices/jira-slice-contract.ts
+++ b/src/renderer/src/store/slices/jira-slice-contract.ts
@@ -16,7 +16,8 @@ export type JiraReadOptions = {
   siteId?: JiraSiteSelection | null
 }
 
-export type JiraSearchOptions = JiraReadOptions & { signal?: AbortSignal }
+export type JiraCollectionReadOptions = JiraReadOptions & { force?: boolean }
+export type JiraSearchOptions = JiraCollectionReadOptions & { signal?: AbortSignal }
 export type JiraPatchOptions = { sourceContext?: TaskSourceContext | null }
 export type JiraIssueSummaryLookupOptions = { force?: boolean; signal?: AbortSignal }
 
@@ -61,7 +62,7 @@ export type JiraSlice = {
   listJiraIssues: (
     filter?: JiraIssueFilter,
     limit?: number,
-    options?: JiraReadOptions
+    options?: JiraCollectionReadOptions
   ) => Promise<JiraIssue[]>
   patchJiraIssue: (issueKey: string, patch: Partial<JiraIssue>, options?: JiraPatchOptions) => void
 }
diff --git a/src/renderer/src/store/slices/jira.test.ts b/src/renderer/src/store/slices/jira.test.ts
index 1e6d0fc7234..48f46e2e7e3 100644
--- a/src/renderer/src/store/slices/jira.test.ts
+++ b/src/renderer/src/store/slices/jira.test.ts
@@ -10,6 +10,7 @@ import {
 import { credentialDecryptionMessage } from '../../../../shared/integration-credential-errors'
 import { getProviderRuntimeContextKey } from '@/lib/provider-runtime-context'
 import { createJiraSlice } from './jira'
+import { beginJiraMutation } from './jira-read-coordination'
 
 const jiraStatus = vi.fn()
 const jiraConnect = vi.fn()
@@ -212,6 +213,146 @@ describe('createJiraSlice runtime context', () => {
     expect(store.getState().jiraSearchCache['site-1::list::assigned::30']).toBeUndefined()
   })
 
+  it('forces fresh list and search reads while keeping ordinary cache reads', async () => {
+    const store = createTestStore()
+    store.setState({
+      jiraStatus: { connected: true, viewer: null, selectedSiteId: 'site-1' },
+      jiraSearchCache: {
+        'site-1::list::assigned::30': { data: [issue('ALP-OLD')], fetchedAt: Date.now() },
+        'site-1::project = ALP::30': { data: [issue('ALP-OLD')], fetchedAt: Date.now() }
+      }
+    })
+    jiraListIssues.mockResolvedValueOnce([issue('ALP-LIST-FRESH')])
+    jiraSearchIssues.mockResolvedValueOnce([issue('ALP-SEARCH-FRESH')])
+
+    await expect(store.getState().listJiraIssues('assigned', 30)).resolves.toMatchObject([
+      { key: 'ALP-OLD' }
+    ])
+    await expect(
+      store.getState().listJiraIssues('assigned', 30, { force: true })
+    ).resolves.toMatchObject([{ key: 'ALP-LIST-FRESH' }])
+    await expect(store.getState().searchJiraIssues('project = ALP', 30)).resolves.toMatchObject([
+      { key: 'ALP-OLD' }
+    ])
+    await expect(
+      store.getState().searchJiraIssues('project = ALP', 30, { force: true })
+    ).resolves.toMatchObject([{ key: 'ALP-SEARCH-FRESH' }])
+
+    expect(jiraListIssues).toHaveBeenCalledTimes(1)
+    expect(jiraSearchIssues).toHaveBeenCalledTimes(1)
+    expect(store.getState().jiraSearchCache['site-1::list::assigned::30']?.data).toMatchObject([
+      { key: 'ALP-LIST-FRESH' }
+    ])
+    expect(store.getState().jiraSearchCache['site-1::project = ALP::30']?.data).toMatchObject([
+      { key: 'ALP-SEARCH-FRESH' }
+    ])
+  })
+
+  it('reuses ordinary in-flight reads but force starts a fresh list and search request', async () => {
+    const store = createTestStore()
+    store.setState({ jiraStatus: { connected: true, viewer: null, selectedSiteId: 'site-1' } })
+    const listOld = deferred<JiraIssue[]>()
+    const listFresh = deferred<JiraIssue[]>()
+    const searchOld = deferred<JiraIssue[]>()
+    const searchFresh = deferred<JiraIssue[]>()
+    jiraListIssues.mockReturnValueOnce(listOld.promise).mockReturnValueOnce(listFresh.promise)
+    jiraSearchIssues.mockReturnValueOnce(searchOld.promise).mockReturnValueOnce(searchFresh.promise)
+
+    const listRequest = store.getState().listJiraIssues('assigned', 30)
+    const listReuse = store.getState().listJiraIssues('assigned', 30)
+    const searchRequest = store.getState().searchJiraIssues('project = ALP', 30)
+    const searchReuse = store.getState().searchJiraIssues('project = ALP', 30)
+    await Promise.resolve()
+    expect(jiraListIssues).toHaveBeenCalledTimes(1)
+    expect(jiraSearchIssues).toHaveBeenCalledTimes(1)
+
+    const listRefresh = store.getState().listJiraIssues('assigned', 30, { force: true })
+    const searchRefresh = store.getState().searchJiraIssues('project = ALP', 30, { force: true })
+    await Promise.resolve()
+    expect(jiraListIssues).toHaveBeenCalledTimes(2)
+    expect(jiraSearchIssues).toHaveBeenCalledTimes(2)
+
+    listFresh.resolve([issue('ALP-LIST-FRESH')])
+    searchFresh.resolve([issue('ALP-SEARCH-FRESH')])
+    await expect(listRefresh).resolves.toMatchObject([{ key: 'ALP-LIST-FRESH' }])
+    await expect(searchRefresh).resolves.toMatchObject([{ key: 'ALP-SEARCH-FRESH' }])
+    listOld.resolve([issue('ALP-LIST-LATE')])
+    searchOld.resolve([issue('ALP-SEARCH-LATE')])
+    await expect(listRequest).resolves.toMatchObject([{ key: 'ALP-LIST-LATE' }])
+    await expect(listReuse).resolves.toMatchObject([{ key: 'ALP-LIST-LATE' }])
+    await expect(searchRequest).resolves.toMatchObject([{ key: 'ALP-SEARCH-LATE' }])
+    await expect(searchReuse).resolves.toMatchObject([{ key: 'ALP-SEARCH-LATE' }])
+
+    expect(store.getState().jiraSearchCache['site-1::list::assigned::30']?.data).toMatchObject([
+      { key: 'ALP-LIST-FRESH' }
+    ])
+    expect(store.getState().jiraSearchCache['site-1::project = ALP::30']?.data).toMatchObject([
+      { key: 'ALP-SEARCH-FRESH' }
+    ])
+  })
+
+  it.each(['list', 'search'] as const)(
+    'ignores an older %s auth failure after a forced refresh succeeds',
+    async (kind) => {
+      const store = createTestStore()
+      store.setState({ jiraStatus: { connected: true, viewer: null, selectedSiteId: 'site-1' } })
+      let rejectOld: (error: Error) => void = () => {}
+      const old = new Promise<JiraIssue[]>((_resolve, reject) => {
+        rejectOld = reject
+      })
+      const service = kind === 'list' ? jiraListIssues : jiraSearchIssues
+      service.mockReturnValueOnce(old).mockResolvedValueOnce([issue('ALP-FRESH')])
+      const read = (force = false) =>
+        kind === 'list'
+          ? store.getState().listJiraIssues('assigned', 30, { force })
+          : store.getState().searchJiraIssues('project = ALP', 30, { force })
+      const previous = read()
+      await expect(read(true)).resolves.toMatchObject([{ key: 'ALP-FRESH' }])
+      rejectOld(new Error('401 Unauthorized'))
+      await expect(previous).resolves.toEqual([])
+      expect(store.getState().jiraStatus.connected).toBe(true)
+      expect(store.getState().jiraConnectionRevisions).toEqual({})
+    }
+  )
+
+  it('rejects a forced late write after the Jira mutation generation changes', async () => {
+    const store = createTestStore()
+    store.setState({ jiraStatus: { connected: true, viewer: null, selectedSiteId: 'site-1' } })
+    const pending = deferred<JiraIssue[]>()
+    jiraListIssues.mockReturnValueOnce(pending.promise)
+
+    const request = store.getState().listJiraIssues('assigned', 30, { force: true })
+    await Promise.resolve()
+    beginJiraMutation()
+    pending.resolve([issue('ALP-STALE')])
+    await expect(request).resolves.toMatchObject([{ key: 'ALP-STALE' }])
+    expect(store.getState().jiraSearchCache['site-1::list::assigned::30']).toBeUndefined()
+  })
+
+  it('does not cache a late abortable search response', async () => {
+    const store = createTestStore()
+    store.setState({ jiraStatus: { connected: true, viewer: null, selectedSiteId: 'site-1' } })
+    const pending = deferred<JiraIssue[]>()
+    let signal: AbortSignal | undefined
+    jiraSearchIssues.mockImplementationOnce(
+      (_settings: unknown, _jql: string, _limit: number, _site: string, provided: AbortSignal) => {
+        signal = provided
+        return pending.promise
+      }
+    )
+    const controller = new AbortController()
+    const request = store
+      .getState()
+      .searchJiraIssues('project = ALP', 30, { signal: controller.signal })
+    await Promise.resolve()
+    const rejection = expect(request).rejects.toMatchObject({ name: 'AbortError' })
+    controller.abort()
+    pending.resolve([issue('ALP-LATE')])
+    await rejection
+    expect(signal?.aborted).toBe(true)
+    expect(store.getState().jiraSearchCache['site-1::project = ALP::30']).toBeUndefined()
+  })
+
   it('keeps isolated status failures from mutating the focused Jira Settings state', async () => {
     const store = createTestStore()
     const focusedStatus = {
diff --git a/src/renderer/src/store/slices/linear-invalidation.test.ts b/src/renderer/src/store/slices/linear-invalidation.test.ts
index febf6bc222f..59c0bd666c6 100644
--- a/src/renderer/src/store/slices/linear-invalidation.test.ts
+++ b/src/renderer/src/store/slices/linear-invalidation.test.ts
@@ -136,35 +136,6 @@ describe('createLinearSlice invalidation', () => {
     ).toMatchObject({ items: [{ id: 'LIST' }] })
   })
 
-  it('caches teams by workspace and dedupes fresh reads', async () => {
-    const store = createTestStore()
-    linearListTeams.mockResolvedValueOnce([team('team-1')])
-
-    await expect(store.getState().listLinearTeams('workspace-1')).resolves.toMatchObject([
-      { id: 'team-1' }
-    ])
-    await expect(store.getState().listLinearTeams('workspace-1')).resolves.toMatchObject([
-      { id: 'team-1' }
-    ])
-
-    expect(linearListTeams).toHaveBeenCalledTimes(1)
-    expect(store.getState().getCachedLinearTeams('workspace-1')).toMatchObject([{ id: 'team-1' }])
-  })
-
-  it('patches issue-cache entries keyed by workspace-qualified ids', () => {
-    const store = createTestStore()
-    store.setState({
-      linearIssueCache: {
-        'workspace-1::issue-id': { data: issue('issue-id'), fetchedAt: Date.now() }
-      }
-    })
-
-    store.getState().patchLinearIssue('issue-id', { title: 'Updated' })
-
-    expect(store.getState().linearIssueCache['workspace-1::issue-id'].data?.title).toBe('Updated')
-    expect(store.getState().linearIssueCache['workspace-1::issue-id'].fetchedAt).toBe(0)
-  })
-
   it('refreshing a linked Linear issue invalidates stale issue collection caches', async () => {
     const store = createTestStore()
     linearGetIssue.mockResolvedValueOnce(issue('issue-id'))
diff --git a/src/renderer/src/store/slices/persisted-ui-write-baseline.test.ts b/src/renderer/src/store/slices/persisted-ui-write-baseline.test.ts
index 300d0fbabc5..f39ef11b03f 100644
--- a/src/renderer/src/store/slices/persisted-ui-write-baseline.test.ts
+++ b/src/renderer/src/store/slices/persisted-ui-write-baseline.test.ts
@@ -26,6 +26,7 @@ function makeBaseline(overrides: Partial<PersistedUIWriteBaseline> = {}): Persis
     hideDetachedHeadWorkspaces: false,
     hideWorkspacesFromOtherDevices: false,
     alwaysShowDefaultBranchWorkspace: true,
+    explorerDisplayRootByWorktree: {},
     showDotfilesByWorktree: {},
     filterRepoIds: [],
     acknowledgedAgentsByPaneKey: {},
diff --git a/src/renderer/src/store/slices/persisted-ui-write-baseline.ts b/src/renderer/src/store/slices/persisted-ui-write-baseline.ts
index 2d9da5d1ea4..158e1b31bf2 100644
--- a/src/renderer/src/store/slices/persisted-ui-write-baseline.ts
+++ b/src/renderer/src/store/slices/persisted-ui-write-baseline.ts
@@ -26,6 +26,7 @@ export type PersistedUIWriteBaseline = {
   hideDetachedHeadWorkspaces: boolean
   hideWorkspacesFromOtherDevices: boolean
   alwaysShowDefaultBranchWorkspace: boolean
+  explorerDisplayRootByWorktree: Record<string, string>
   showDotfilesByWorktree: Record<string, boolean>
   filterRepoIds: readonly string[]
   acknowledgedAgentsByPaneKey: Record<string, number>
@@ -55,6 +56,7 @@ const PERSISTED_UI_WRITE_BASELINE_FIELD_SET = {
   hideDetachedHeadWorkspaces: true,
   hideWorkspacesFromOtherDevices: true,
   alwaysShowDefaultBranchWorkspace: true,
+  explorerDisplayRootByWorktree: true,
   showDotfilesByWorktree: true,
   filterRepoIds: true,
   acknowledgedAgentsByPaneKey: true,
@@ -95,11 +97,13 @@ function stringArrayEqual(a: readonly string[], b: readonly string[]): boolean {
   return a === b || (a.length === b.length && a.every((value, i) => value === b[i]))
 }
 
+/** Compares collection fields by value so hydration does not produce redundant persistence writes from new identities. */
 function writeFieldEqual(field: keyof PersistedUIWriteBaseline, a: unknown, b: unknown): boolean {
   if (field === 'filterRepoIds') {
     return stringArrayEqual(a as readonly string[], b as readonly string[])
   }
   if (
+    field === 'explorerDisplayRootByWorktree' ||
     field === 'showDotfilesByWorktree' ||
     field === 'acknowledgedAgentsByPaneKey' ||
     field === 'activityClearedAtByPaneKey' ||
diff --git a/src/renderer/src/store/slices/repo-identity-reconcile.test.ts b/src/renderer/src/store/slices/repo-identity-reconcile.test.ts
index 43afafe717f..703ff483306 100644
--- a/src/renderer/src/store/slices/repo-identity-reconcile.test.ts
+++ b/src/renderer/src/store/slices/repo-identity-reconcile.test.ts
@@ -1,5 +1,4 @@
 import { describe, expect, it } from 'vitest'
-import fs from 'node:fs'
 import type { Repo } from '../../../../shared/repo-types'
 import { reconcileFetchedRepos, reuseEqualRecordMap } from './repo-identity-reconcile'
 
@@ -119,8 +118,6 @@ describe('reconcileFetchedRepos', () => {
 
     expect(result).toBe(previous)
     expect(result.every((repo, index) => repo === previous[index])).toBe(true)
-    const source = fs.readFileSync(new URL('./repo-identity-reconcile.ts', import.meta.url), 'utf8')
-    expect(source).not.toMatch(/previous\.find|next\.find|findIndex/)
   })
 })
 
diff --git a/src/renderer/src/store/slices/repos-catalog-notifications.test.ts b/src/renderer/src/store/slices/repos-catalog-notifications.test.ts
new file mode 100644
index 00000000000..88fbd339ec3
--- /dev/null
+++ b/src/renderer/src/store/slices/repos-catalog-notifications.test.ts
@@ -0,0 +1,229 @@
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import type { FolderWorkspace } from '../../../../shared/folder-workspace-types'
+import type { ProjectGroup } from '../../../../shared/project-group-types'
+import { createTestStore } from './store-test-helpers'
+
+const group: ProjectGroup = {
+  id: 'group-1',
+  name: 'Group',
+  parentPath: '/parent',
+  parentGroupId: null,
+  createdFrom: 'manual',
+  tabOrder: 0,
+  isCollapsed: false,
+  color: null,
+  createdAt: 1,
+  updatedAt: 3
+}
+const folder: FolderWorkspace = {
+  id: 'folder-1',
+  projectGroupId: group.id,
+  name: 'Folder',
+  folderPath: '/parent/folder',
+  linkedTask: null,
+  comment: '',
+  isArchived: false,
+  isUnread: false,
+  isPinned: false,
+  sortOrder: 0,
+  lastActivityAt: 1,
+  createdAt: 1,
+  updatedAt: 3
+}
+const groupsList = vi.fn<() => Promise<ProjectGroup[]>>()
+const foldersList = vi.fn<() => Promise<FolderWorkspace[]>>()
+const folderUpdate = vi.fn<Window['api']['folderWorkspaces']['update']>()
+type TestStore = ReturnType<typeof createTestStore>
+type CatalogCase = {
+  label: string
+  catalog: 'projectGroups' | 'folderWorkspaces'
+  refresh: (store: TestStore) => Promise<void>
+}
+const cases: CatalogCase[] = [
+  {
+    label: 'selected groups',
+    catalog: 'projectGroups',
+    refresh: (s) => s.getState().fetchProjectGroups()
+  },
+  {
+    label: 'all-host local groups',
+    catalog: 'projectGroups',
+    refresh: (s) => s.getState().fetchProjectGroupsForAllHosts({ remoteHosts: 'skip' })
+  },
+  {
+    label: 'selected folders',
+    catalog: 'folderWorkspaces',
+    refresh: (s) => s.getState().fetchFolderWorkspaces()
+  },
+  {
+    label: 'all-host local folders',
+    catalog: 'folderWorkspaces',
+    refresh: (s) => s.getState().fetchFolderWorkspacesForAllHosts({ remoteHosts: 'skip' })
+  }
+]
+
+beforeEach(() => {
+  groupsList.mockReset().mockImplementation(async () => structuredClone([group]))
+  foldersList.mockReset().mockImplementation(async () => structuredClone([folder]))
+  folderUpdate.mockReset()
+  vi.stubGlobal('window', {
+    api: {
+      projectGroups: { list: groupsList },
+      folderWorkspaces: { list: foldersList, update: folderUpdate },
+      runtimeEnvironments: { list: async () => [] }
+    },
+    dispatchEvent: vi.fn()
+  })
+  vi.spyOn(console, 'error').mockImplementation(() => {})
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.unstubAllGlobals()
+})
+
+function seed(): TestStore {
+  const store = createTestStore()
+  store.setState({
+    projectGroups: [{ ...group, executionHostId: 'local' }],
+    folderWorkspaces: [{ ...folder, executionHostId: 'local' }],
+    folderWorkspacePathStatuses: {
+      cached: {
+        status: { path: folder.folderPath, exists: true },
+        checkedAt: 1,
+        requestSnapshot: 'snapshot'
+      }
+    }
+  })
+  return store
+}
+
+it.each(cases)('does not notify for ten equal $label refreshes', async ({ refresh, catalog }) => {
+  const store = seed()
+  const initial = store.getState()
+  const changed = vi.fn()
+  const unsubscribe = store.subscribe(changed)
+  for (let index = 0; index < 10; index += 1) {
+    await refresh(store)
+  }
+  unsubscribe()
+  expect(changed).not.toHaveBeenCalled()
+  expect(store.getState()).toBe(initial)
+  expect(store.getState()[catalog]).toBe(initial[catalog])
+  expect(store.getState().folderWorkspacePathStatuses).toBe(initial.folderWorkspacePathStatuses)
+})
+
+it.each(cases)(
+  'publishes changed $label and invalidates path statuses',
+  async ({ refresh, catalog }) => {
+    const store = seed()
+    groupsList.mockResolvedValue([{ ...group, name: 'Changed group' }])
+    foldersList.mockResolvedValue([{ ...folder, name: 'Changed folder' }])
+    const changed = vi.fn()
+    const unsubscribe = store.subscribe(changed)
+    await refresh(store)
+    unsubscribe()
+    expect(changed).toHaveBeenCalledOnce()
+    expect(store.getState()[catalog][0]?.name).toMatch(/^Changed /)
+    expect(store.getState().folderWorkspacePathStatuses).toEqual({})
+  }
+)
+
+it.each(cases)('retains state after a failed $label read', async ({ refresh }) => {
+  const store = seed()
+  const initial = store.getState()
+  groupsList.mockRejectedValue(new Error('offline'))
+  foldersList.mockRejectedValue(new Error('offline'))
+  const changed = vi.fn()
+  const unsubscribe = store.subscribe(changed)
+  await refresh(store)
+  unsubscribe()
+  expect(store.getState()).toBe(initial)
+  expect(changed).not.toHaveBeenCalled()
+})
+
+it.each(cases)(
+  'fences an older $label response after a newer no-op response',
+  async ({ refresh, catalog }) => {
+    const store = seed()
+    const initial = store.getState()
+    const olderGroups = Promise.withResolvers<ProjectGroup[]>()
+    const olderFolders = Promise.withResolvers<FolderWorkspace[]>()
+    if (catalog === 'projectGroups') {
+      groupsList.mockReturnValueOnce(olderGroups.promise)
+    } else {
+      foldersList.mockReturnValueOnce(olderFolders.promise)
+    }
+    const older = refresh(store)
+    const changed = vi.fn()
+    const unsubscribe = store.subscribe(changed)
+    await refresh(store)
+    olderGroups.resolve([{ ...group, name: 'Obsolete group' }])
+    olderFolders.resolve([{ ...folder, name: 'Obsolete folder' }])
+    await older
+    unsubscribe()
+    expect(store.getState()).toBe(initial)
+    expect(changed).not.toHaveBeenCalled()
+  }
+)
+
+it.each(cases.filter((entry) => entry.catalog === 'folderWorkspaces'))(
+  'keeps update revision fencing after an equal $label response',
+  async ({ refresh }) => {
+    const store = seed()
+    const pending = Promise.withResolvers<FolderWorkspace>()
+    folderUpdate.mockReturnValueOnce(pending.promise)
+    const update = store.getState().updateFolderWorkspace(folder.id, { isUnread: true })
+    const initial = store.getState()
+    await refresh(store)
+    expect(store.getState()).toBe(initial)
+    pending.resolve({ ...folder, isUnread: true, updatedAt: 2 })
+    await update
+    expect(store.getState().folderWorkspaces[0]?.isUnread).toBe(false)
+    expect(store.getState().folderWorkspaces[0]?.updatedAt).toBe(3)
+  }
+)
+
+it('accepts a newer update after an equal catalog response', async () => {
+  const store = seed()
+  const pending = Promise.withResolvers<FolderWorkspace>()
+  folderUpdate.mockReturnValueOnce(pending.promise)
+  const update = store.getState().updateFolderWorkspace(folder.id, { isUnread: true })
+  await store.getState().fetchFolderWorkspaces()
+  pending.resolve({ ...folder, isUnread: true, updatedAt: 4 })
+  await update
+  expect(store.getState().folderWorkspaces[0]?.isUnread).toBe(true)
+  expect(store.getState().folderWorkspaces[0]?.updatedAt).toBe(4)
+})
+
+it('still clears restored folder owners after a successful all-host refresh', async () => {
+  const store = seed()
+  store.setState({
+    restoredRuntimeHostIdByWorkspaceSessionKey: {
+      'folder:folder-1': 'runtime:retired',
+      unrelated: 'runtime:kept'
+    }
+  })
+  const changed = vi.fn()
+  const unsubscribe = store.subscribe(changed)
+  await store.getState().fetchFolderWorkspacesForAllHosts()
+  unsubscribe()
+  expect(changed).toHaveBeenCalledOnce()
+  expect(store.getState().restoredRuntimeHostIdByWorkspaceSessionKey).toEqual({
+    unrelated: 'runtime:kept'
+  })
+})
+
+it('does not publish an all-host refresh whose restored owners need no cleanup', async () => {
+  const store = seed()
+  store.setState({ restoredRuntimeHostIdByWorkspaceSessionKey: { unrelated: 'runtime:kept' } })
+  const initial = store.getState()
+  const changed = vi.fn()
+  const unsubscribe = store.subscribe(changed)
+  await store.getState().fetchFolderWorkspacesForAllHosts()
+  unsubscribe()
+  expect(changed).not.toHaveBeenCalled()
+  expect(store.getState()).toBe(initial)
+  expect(store.getState().restoredRuntimeHostIdByWorkspaceSessionKey).toBe(
+    initial.restoredRuntimeHostIdByWorkspaceSessionKey
+  )
+})
diff --git a/src/renderer/src/store/slices/repos-onboarding-folder-startup.test.ts b/src/renderer/src/store/slices/repos-onboarding-folder-startup.test.ts
index 18f6cfb1f5e..e52a34f4f46 100644
--- a/src/renderer/src/store/slices/repos-onboarding-folder-startup.test.ts
+++ b/src/renderer/src/store/slices/repos-onboarding-folder-startup.test.ts
@@ -1,5 +1,6 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { getDefaultOnboardingState, getDefaultSettings } from '../../../../shared/constants'
+import { getDefaultSettings } from '../../../../shared/constants'
+import { getDefaultOnboardingState } from '../../../../shared/onboarding-defaults'
 import { createTestStore, makeWorktree } from './store-test-helpers'
 
 const worktreeActivation = vi.hoisted(() => ({
diff --git a/src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts b/src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts
index 3302e041c45..fe9a08dd7c8 100644
--- a/src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts
+++ b/src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts
@@ -5,11 +5,9 @@ import { act, createElement } from 'react'
 import { createRoot } from 'react-dom/client'
 import { useAppStore } from '@/store'
 import { buildEditorSessionData } from '@/lib/workspace-session'
-import {
-  createExternalWatchEventHandler,
-  getEditorExternalWatchTargets,
-  useEditorExternalWatch
-} from '@/hooks/useEditorExternalWatch'
+import { useEditorExternalWatch } from '@/hooks/useEditorExternalWatch'
+import { buildEditorExternalWatchEventHandler as createExternalWatchEventHandler } from '@/hooks/editor-external-watch-event-reconciliation'
+import { selectEditorExternalWatchTargets as getEditorExternalWatchTargets } from '@/hooks/editor-external-watch-targets'
 import {
   captureEditorFileOperationProvenance,
   getEditorFileOperationContext
diff --git a/src/renderer/src/store/slices/runtime-environment-ssh-selectors.ts b/src/renderer/src/store/slices/runtime-environment-ssh-selectors.ts
index 7cd1942db3a..90f09222099 100644
--- a/src/renderer/src/store/slices/runtime-environment-ssh-selectors.ts
+++ b/src/renderer/src/store/slices/runtime-environment-ssh-selectors.ts
@@ -60,6 +60,24 @@ export function selectRuntimeAwareSshError(
   return bucket.connectionStates.get(targetId)?.error ?? null
 }
 
+export function selectRuntimeAwareSshConnectionGeneration(
+  state: RuntimeAwareSshReadState,
+  environmentId: string | null,
+  targetId: string
+): number | null {
+  if (environmentId === null) {
+    return state.sshConnectionStates.get(targetId)?.connectionGeneration ?? null
+  }
+  if (!isEnvironmentReachable(state, environmentId)) {
+    return null
+  }
+  const bucket = state.sshStateByEnvironment.get(environmentId)
+  if (!bucket?.targetsHydrated) {
+    return null
+  }
+  return bucket.connectionStates.get(targetId)?.connectionGeneration ?? null
+}
+
 export function selectRuntimeAwareSshTargetLabel(
   state: RuntimeAwareSshReadState,
   environmentId: string | null,
diff --git a/src/renderer/src/store/slices/runtime-environment-ssh.ts b/src/renderer/src/store/slices/runtime-environment-ssh.ts
index 3efbf0e7805..e6b2f30db61 100644
--- a/src/renderer/src/store/slices/runtime-environment-ssh.ts
+++ b/src/renderer/src/store/slices/runtime-environment-ssh.ts
@@ -4,6 +4,7 @@ import type { SshConnectionState, SshTargetSummary } from '../../../../shared/ss
 import { sanitizeSshTargetGeneration } from '../../../../shared/ssh-target-generation'
 import { sshConnectionStatesEqual, sshTargetLabelsEqual } from './ssh-target-cleanup'
 export {
+  selectRuntimeAwareSshConnectionGeneration,
   selectRuntimeAwareSshError,
   selectRuntimeAwareSshStatus,
   selectRuntimeAwareSshTargetLabel,
diff --git a/src/renderer/src/store/slices/runtime-host-status-entry-parity.test.ts b/src/renderer/src/store/slices/runtime-host-status-entry-parity.test.ts
deleted file mode 100644
index 63c3de2e708..00000000000
--- a/src/renderer/src/store/slices/runtime-host-status-entry-parity.test.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-// The store's host-status entry is one shape, and every reader of the map has to accept exactly
-// it. A narrower local copy still typechecks against the store — the fields it is missing are all
-// optional — so it freezes at the vintage it was written at and never fails. #17710 added
-// `remoteControl` and #20003 added `snapshot`; the copies these assertions cover were not updated
-// either time. Like the other typed-contract tests, they fail at typecheck, not at runtime.
-import { describe, expectTypeOf, it } from 'vitest'
-import type { buildExecutionHostRegistry } from '../../../../shared/execution-host-registry'
-import type { buildSidebarHostOptions } from '@/components/sidebar/sidebar-host-options'
-import type { getRuntimeAutomationAvailability } from '@/components/automations/automation-target-availability'
-import type { getRuntimeSourceHostAvailability } from '@/components/automations/automation-source-context'
-import type { AutomationListLocalRowProps } from '@/components/automations/AutomationListLocalRow'
-import type { AutomationsListPanelProps } from '@/components/automations/AutomationsListPanel'
-import type { RuntimeEnvironmentStatus } from './runtime-status-types'
-
-// Compare the entry each reader accepts rather than the surrounding map, so a mismatch names the
-// field that drifted instead of every ReadonlyMap method signature.
-type AcceptedEntry<T> = NonNullable<T> extends ReadonlyMap<string, infer TEntry> ? TEntry : never
-
-type RegistryEntry = AcceptedEntry<
-  Parameters<typeof buildExecutionHostRegistry>[0]['runtimeStatusByEnvironmentId']
->
-type SidebarEntry = AcceptedEntry<
-  Parameters<typeof buildSidebarHostOptions>[0]['runtimeStatusByEnvironmentId']
->
-type AutomationEntry = AcceptedEntry<Parameters<typeof getRuntimeAutomationAvailability>[1]>
-type SourceContextEntry = AcceptedEntry<Parameters<typeof getRuntimeSourceHostAvailability>[1]>
-type LocalRowEntry = AcceptedEntry<AutomationListLocalRowProps['runtimeStatusByEnvironmentId']>
-type ListPanelEntry = AcceptedEntry<AutomationsListPanelProps['runtimeStatusByEnvironmentId']>
-
-describe('every reader of the runtime host status map accepts the store entry', () => {
-  it('holds for the execution-host registry', () => {
-    expectTypeOf<RegistryEntry>().toEqualTypeOf<RuntimeEnvironmentStatus>()
-  })
-
-  it('holds for the sidebar host options', () => {
-    expectTypeOf<SidebarEntry>().toEqualTypeOf<RuntimeEnvironmentStatus>()
-  })
-
-  it('holds for runtime automation availability', () => {
-    expectTypeOf<AutomationEntry>().toEqualTypeOf<RuntimeEnvironmentStatus>()
-  })
-
-  // These three only forward the map, which is exactly how a stale copy survives: nothing they
-  // do with it can fail, so the drift surfaces in whatever they hand it to.
-  it('holds for the automation source-context reader', () => {
-    expectTypeOf<SourceContextEntry>().toEqualTypeOf<RuntimeEnvironmentStatus>()
-  })
-
-  it('holds for the automation list row', () => {
-    expectTypeOf<LocalRowEntry>().toEqualTypeOf<RuntimeEnvironmentStatus>()
-  })
-
-  it('holds for the automations list panel', () => {
-    expectTypeOf<ListPanelEntry>().toEqualTypeOf<RuntimeEnvironmentStatus>()
-  })
-})
diff --git a/src/renderer/src/store/slices/settings.ts b/src/renderer/src/store/slices/settings.ts
index 8189ec5e5f9..55821c10667 100644
--- a/src/renderer/src/store/slices/settings.ts
+++ b/src/renderer/src/store/slices/settings.ts
@@ -35,6 +35,7 @@ import {
 import * as ownerHydration from './settings-owner-hydration-publication'
 import { persistVisibilityAwareSettings } from './worktree-visibility-settings-write'
 import { getSettingsFocusedExecutionHostId } from '../../../../shared/execution-host'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export type SettingsSlice = SettingsSearchState & {
   settings: GlobalSettings | null
@@ -57,13 +58,6 @@ function normalizeRuntimeEnvironmentId(value: string | null | undefined): string
   return trimmed ? trimmed : null
 }
 
-function createOpenInApplicationId(): string {
-  return (
-    globalThis.crypto?.randomUUID?.() ??
-    `open-in-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`
-  )
-}
-
 function normalizeSettingsUpdates(
   updates: Partial<GlobalSettings>,
   currentSettings: GlobalSettings | null
@@ -97,7 +91,7 @@ function normalizeSettingsUpdates(
   }
   if ('openInApplications' in updates) {
     sanitizedUpdates.openInApplications = normalizeOpenInApplications(updates.openInApplications, {
-      createId: createOpenInApplicationId
+      createId: createBrowserUuid
     })
   }
   if ('disabledTuiAgents' in updates) {
diff --git a/src/renderer/src/store/slices/ssh-target-cleanup.test.ts b/src/renderer/src/store/slices/ssh-target-cleanup.test.ts
index 91872ff245e..b3b7323ce20 100644
--- a/src/renderer/src/store/slices/ssh-target-cleanup.test.ts
+++ b/src/renderer/src/store/slices/ssh-target-cleanup.test.ts
@@ -127,4 +127,17 @@ describe('SSH target cleanup tab map', () => {
     store.getState().clearRemovedSshTargetState('removed')
     expect(store.getState().tabsByWorktree).toBe(tabsByWorktree)
   })
+
+  it('clears pending split edits owned by the removed target', () => {
+    const store = createTestStore()
+    const removed = { targetId: 'removed', root: null }
+    const retained = { targetId: 'other', root: null }
+    store.setState({
+      pendingDirectSshLayoutEditsByTabId: { removedTab: removed, otherTab: retained }
+    })
+
+    const patch = buildRemovedSshTargetCleanupPatch(store.getState(), 'removed')
+
+    expect(patch?.pendingDirectSshLayoutEditsByTabId).toEqual({ otherTab: retained })
+  })
 })
diff --git a/src/renderer/src/store/slices/ssh-target-cleanup.ts b/src/renderer/src/store/slices/ssh-target-cleanup.ts
index 9cac633bedd..859fde228f6 100644
--- a/src/renderer/src/store/slices/ssh-target-cleanup.ts
+++ b/src/renderer/src/store/slices/ssh-target-cleanup.ts
@@ -227,6 +227,14 @@ export function buildRemovedSshTargetCleanupPatch(
     targetId,
     targetTabIds
   )
+  const nextPendingLayoutEdits = Object.fromEntries(
+    Object.entries(state.pendingDirectSshLayoutEditsByTabId ?? {}).filter(
+      ([, entry]) => entry.targetId !== targetId
+    )
+  )
+  const removedPendingLayoutEdits =
+    Object.keys(nextPendingLayoutEdits).length !==
+    Object.keys(state.pendingDirectSshLayoutEditsByTabId ?? {}).length
 
   const nextDeferredTargets = state.deferredSshReconnectTargets.filter((id) => id !== targetId)
   const nextTransientClearedConnections = {
@@ -273,7 +281,8 @@ export function buildRemovedSshTargetCleanupPatch(
     removedPendingReconnect ||
     removedPaneRetries ||
     removedLiveBindings ||
-    removedRetryHistory
+    removedRetryHistory ||
+    removedPendingLayoutEdits
   if (!changed) {
     return null
   }
@@ -304,6 +313,9 @@ export function buildRemovedSshTargetCleanupPatch(
     ...(removedPendingReconnect ? { pendingReconnectPtyIdByTabId: nextPendingReconnect } : {}),
     ...(removedPaneRetries ? { directSshPaneRetryByTabId: nextPaneRetries } : {}),
     ...(removedLiveBindings ? { directSshLivePtyBindingByTabId: nextLiveBindings } : {}),
-    ...(removedRetryHistory ? { directSshPaneRetryHistoryByTabId: nextRetryHistory } : {})
+    ...(removedRetryHistory ? { directSshPaneRetryHistoryByTabId: nextRetryHistory } : {}),
+    ...(removedPendingLayoutEdits
+      ? { pendingDirectSshLayoutEditsByTabId: nextPendingLayoutEdits }
+      : {})
   }
 }
diff --git a/src/renderer/src/store/slices/ssh.ts b/src/renderer/src/store/slices/ssh.ts
index 36142d0c1c6..ddeaf415fd5 100644
--- a/src/renderer/src/store/slices/ssh.ts
+++ b/src/renderer/src/store/slices/ssh.ts
@@ -29,6 +29,9 @@ export type SshCredentialRequest = {
   targetId: string
   kind: 'passphrase' | 'password' | 'keyboard-interactive'
   detail: string
+  /** RFC 4256 echo flag for keyboard-interactive prompts: when true the
+   * server allows the typed response to be shown. */
+  echo?: boolean
 }
 
 export type SshSlice = {
diff --git a/src/renderer/src/store/slices/tabs/tabs-close-actions.ts b/src/renderer/src/store/slices/tabs/tabs-close-actions.ts
index 35a7be70ced..b9187c8b0d8 100644
--- a/src/renderer/src/store/slices/tabs/tabs-close-actions.ts
+++ b/src/renderer/src/store/slices/tabs/tabs-close-actions.ts
@@ -64,7 +64,6 @@ export function createTabsCloseActions(
             activeRuntimeEnvironmentId: getRuntimeEnvironmentIdForWorktree(state, worktreeId)
           }),
           worktreeId,
-          tabId: tab.id,
           sessionId: tab.entityId,
           provisional
         })
diff --git a/src/renderer/src/store/slices/tabs/tabs-create-actions.ts b/src/renderer/src/store/slices/tabs/tabs-create-actions.ts
index bc3f08558a1..2149b84cbc1 100644
--- a/src/renderer/src/store/slices/tabs/tabs-create-actions.ts
+++ b/src/renderer/src/store/slices/tabs/tabs-create-actions.ts
@@ -12,7 +12,13 @@ import {
   sanitizeRecentTabIds,
   updateGroup
 } from '../tab-group-state'
-import { canReplacePreviewContentType } from './tabs-tab-order'
+import {
+  applyTabOrderSortValues,
+  canReplacePreviewContentType,
+  insertTabIdIntoOrder
+} from './tabs-tab-order'
+import { resolveUnifiedTabCreatePlacement } from './tabs-create-placement'
+import { folderWorkspaceToWorktree } from '../../../../../shared/folder-workspace-worktree'
 
 export function createTabsCreateActions(
   set: TabsSliceSet,
@@ -23,13 +29,26 @@ export function createTabsCreateActions(
       const id = init?.id ?? createBrowserUuid()
       let created!: Tab
       set((state) => {
+        const existingTabs = state.unifiedTabsByWorktree[worktreeId] ?? []
+        const placement = resolveUnifiedTabCreatePlacement({
+          groups: state.groupsByWorktree[worktreeId] ?? [],
+          tabs: existingTabs,
+          activeGroupId: state.activeGroupIdByWorktree[worktreeId],
+          targetGroupId: init?.targetGroupId,
+          afterTabId: init?.afterTabId,
+          executionHostId: init?.executionHostId,
+          lookupWorktrees: () =>
+            [
+              ...(state.allWorktrees?.() ?? []),
+              ...(state.folderWorkspaces ?? []).map(folderWorkspaceToWorktree)
+            ].filter((worktree) => worktree.id === worktreeId)
+        })
         const { group, groupsByWorktree, activeGroupIdByWorktree } = ensureGroup(
           state.groupsByWorktree,
           state.activeGroupIdByWorktree,
           worktreeId,
-          init?.targetGroupId ?? state.activeGroupIdByWorktree[worktreeId]
+          placement.groupId
         )
-        const existingTabs = state.unifiedTabsByWorktree[worktreeId] ?? []
 
         let nextTabs = existingTabs
         let nextOrder = dedupeTabOrder(group.tabOrder)
@@ -50,6 +69,17 @@ export function createTabsCreateActions(
         const createdAt = Date.now()
         const executionHostId =
           init?.executionHostId ?? getActiveExecutionHostIdForWorktree(state, worktreeId)
+        // Why: preview replacement may have removed the anchor; the order then appends in-partition.
+        nextOrder = insertTabIdIntoOrder(
+          nextOrder,
+          nextTabs,
+          id,
+          init?.isPinned === true,
+          placement.anchorTabId
+        )
+        const insertedIndex = nextOrder.indexOf(id)
+        // Why always: preview replacement can leave a gap, so an append alone would reuse a sibling's sortOrder.
+        nextTabs = applyTabOrderSortValues(nextTabs, nextOrder)
         created = {
           id,
           entityId: init?.entityId ?? id,
@@ -67,7 +97,7 @@ export function createTabsCreateActions(
             : {}),
           customLabel: init?.customLabel ?? null,
           color: init?.color ?? null,
-          sortOrder: nextOrder.length,
+          sortOrder: insertedIndex,
           createdAt,
           // Why: creating an active tab is a focus event; Cmd+J recency reads lastFocusedAt.
           ...(shouldActivate ? { lastFocusedAt: createdAt } : {}),
@@ -75,7 +105,6 @@ export function createTabsCreateActions(
           isPinned: init?.isPinned
         }
 
-        nextOrder = dedupeTabOrder([...nextOrder, created.id])
         const nextActiveTabId = shouldActivate ? created.id : (group.activeTabId ?? created.id)
         const sanitizedRecent = sanitizeRecentTabIds(group.recentTabIds, nextOrder)
         // Why: automation-created browser tabs must paint without stealing the visible group selection from the user's current tab.
diff --git a/src/renderer/src/store/slices/tabs/tabs-create-placement.ts b/src/renderer/src/store/slices/tabs/tabs-create-placement.ts
new file mode 100644
index 00000000000..f354b30e802
--- /dev/null
+++ b/src/renderer/src/store/slices/tabs/tabs-create-placement.ts
@@ -0,0 +1,73 @@
+import type { Tab, TabGroup } from '../../../../../shared/tab-types'
+import type { ExecutionHostId } from '../../../../../shared/execution-host'
+import type { Worktree } from '../../../../../shared/worktree/types'
+import { isExecutionHostAliasForWorktree } from '@/lib/worktree-execution-host-alias'
+
+type WorktreeHostAliases = Pick<Worktree, 'hostId' | 'runtimeOwnerEnvironmentId'>
+
+export type UnifiedTabCreatePlacementInput = {
+  groups: readonly TabGroup[]
+  tabs: readonly Tab[]
+  activeGroupId: string | undefined
+  targetGroupId?: string
+  afterTabId?: string
+  /** The caller's verified host; an anchor owned by another host is foreign. */
+  executionHostId?: ExecutionHostId
+  /** Records sharing this worktree id; host aliases only count when exactly one exists. */
+  lookupWorktrees: () => readonly WorktreeHostAliases[]
+}
+
+export type UnifiedTabCreatePlacement = {
+  /** A live group, or undefined to let ensureGroup pick its first-group/new-root fallback. */
+  groupId: string | undefined
+  anchorTabId: string | undefined
+}
+
+function isAnchorHostCompatible(
+  anchorHostId: ExecutionHostId | undefined,
+  input: UnifiedTabCreatePlacementInput
+): boolean {
+  const requestedHostId = input.executionHostId
+  if (!requestedHostId || !anchorHostId || anchorHostId === requestedHostId) {
+    return true
+  }
+  const worktrees = input.lookupWorktrees()
+  return (
+    worktrees.length === 1 &&
+    isExecutionHostAliasForWorktree(requestedHostId, worktrees[0]) &&
+    isExecutionHostAliasForWorktree(anchorHostId, worktrees[0])
+  )
+}
+
+function resolveAnchor(input: UnifiedTabCreatePlacementInput): Tab | undefined {
+  if (!input.afterTabId) {
+    return undefined
+  }
+  const matches = input.tabs.filter((tab) => tab.id === input.afterTabId)
+  if (matches.length !== 1) {
+    return undefined
+  }
+  const anchor = matches[0]
+  const group = input.groups.find((candidate) => candidate.id === anchor.groupId)
+  if (!group?.tabOrder.includes(anchor.id)) {
+    return undefined
+  }
+  return isAnchorHostCompatible(anchor.executionHostId, input) ? anchor : undefined
+}
+
+/** Resolve a new tab's destination group and the live anchor it should follow there. */
+export function resolveUnifiedTabCreatePlacement(
+  input: UnifiedTabCreatePlacementInput
+): UnifiedTabCreatePlacement {
+  const isLiveGroup = (groupId: string | undefined): groupId is string =>
+    Boolean(groupId && input.groups.some((group) => group.id === groupId))
+  const anchor = resolveAnchor(input)
+  // Why validate first: an expired requested id must fall to the active group, not ensureGroup's first group.
+  const groupId = isLiveGroup(input.targetGroupId)
+    ? input.targetGroupId
+    : (anchor?.groupId ?? (isLiveGroup(input.activeGroupId) ? input.activeGroupId : undefined))
+  return {
+    groupId,
+    anchorTabId: anchor && anchor.groupId === groupId ? anchor.id : undefined
+  }
+}
diff --git a/src/renderer/src/store/slices/tabs/tabs-slice-contract.ts b/src/renderer/src/store/slices/tabs/tabs-slice-contract.ts
index 6291588c27b..efb2da8adda 100644
--- a/src/renderer/src/store/slices/tabs/tabs-slice-contract.ts
+++ b/src/renderer/src/store/slices/tabs/tabs-slice-contract.ts
@@ -35,6 +35,8 @@ export type TabsSlice = {
         | 'isPinned'
       > & {
         targetGroupId: string
+        /** Client-local unified tab id to insert after; an explicit targetGroupId still wins. */
+        afterTabId: string
         activate: boolean
         recordInteraction: boolean
       }
diff --git a/src/renderer/src/store/slices/tabs/tabs-tab-order.ts b/src/renderer/src/store/slices/tabs/tabs-tab-order.ts
index 236465ba6d1..b62e85fdb08 100644
--- a/src/renderer/src/store/slices/tabs/tabs-tab-order.ts
+++ b/src/renderer/src/store/slices/tabs/tabs-tab-order.ts
@@ -17,10 +17,35 @@ export function applyTabOrderSortValues(tabs: Tab[], tabOrder: string[]): Tab[]
   const orderMap = new Map(tabOrder.map((id, index) => [id, index]))
   return tabs.map((tab) => {
     const sortOrder = orderMap.get(tab.id)
-    return sortOrder === undefined ? tab : { ...tab, sortOrder }
+    return sortOrder === undefined || sortOrder === tab.sortOrder ? tab : { ...tab, sortOrder }
   })
 }
 
+/**
+ * Insert `tabId` after `anchorTabId` when both share a pin partition; otherwise at the end of the
+ * new tab's partition. Siblings keep their relative order.
+ */
+export function insertTabIdIntoOrder(
+  tabOrder: readonly string[],
+  tabs: readonly Tab[],
+  tabId: string,
+  isPinned: boolean,
+  anchorTabId?: string
+): string[] {
+  const tabById = new Map(tabs.map((tab) => [tab.id, tab]))
+  const order = dedupeTabOrder([...tabOrder]).filter((id) => id !== tabId)
+  const firstUnpinnedIndex = order.findIndex((id) => !tabById.get(id)?.isPinned)
+  const pinnedPrefixEnd = firstUnpinnedIndex === -1 ? order.length : firstUnpinnedIndex
+  const anchorIndex = anchorTabId ? order.indexOf(anchorTabId) : -1
+  const anchorIsPinned = anchorIndex !== -1 && tabById.get(order[anchorIndex])?.isPinned === true
+  let index = isPinned ? pinnedPrefixEnd : order.length
+  if (anchorIndex !== -1) {
+    index = anchorIsPinned === isPinned ? anchorIndex + 1 : pinnedPrefixEnd
+  }
+  order.splice(index, 0, tabId)
+  return order
+}
+
 export function isReplaceablePreviewContentType(contentType: Tab['contentType']): boolean {
   return (
     contentType === 'editor' ||
diff --git a/src/renderer/src/store/slices/terminal-write-identity-bailouts.test.ts b/src/renderer/src/store/slices/terminal-write-identity-bailouts.test.ts
index 14aecc47129..e559829a29f 100644
--- a/src/renderer/src/store/slices/terminal-write-identity-bailouts.test.ts
+++ b/src/renderer/src/store/slices/terminal-write-identity-bailouts.test.ts
@@ -14,7 +14,7 @@
  */
 import { describe, expect, it } from 'vitest'
 import type { TerminalLayoutSnapshot } from '../../../../shared/terminal-tab-types'
-import { createTestStore } from './store-test-helpers'
+import { createTestStore, makeTab, makeWorktree } from './store-test-helpers'
 
 const REPEATS = 1_000
 
@@ -151,6 +151,7 @@ describe('setTabLayout identity bailout', () => {
     const mutations: Partial<TerminalLayoutSnapshot>[] = [
       { activeLeafId: 'leaf-b' },
       { expandedLeafId: 'leaf-a' },
+      { chatLeafId: 'leaf-b' },
       { titlesByLeafId: { 'leaf-a': 'test' } },
       { ptyIdsByLeafId: { 'leaf-a': 'pty-a', 'leaf-b': 'pty-c' } },
       { buffersByLeafId: { 'leaf-a': 'scrollback' } },
@@ -224,4 +225,73 @@ describe('setTabLayout identity bailout', () => {
     unsubscribe()
     expect(wakeups).toBe(0)
   })
+
+  it('guards SSH acknowledgements by captured edit identity and target', () => {
+    const store = createTestStore()
+    const worktreeA = 'repo-a::/tmp/a'
+    const worktreeB = 'repo-b::/tmp/b'
+    store.setState({
+      repos: [
+        {
+          id: 'repo-a',
+          path: '/tmp',
+          displayName: 'Repo A',
+          badgeColor: '#000',
+          addedAt: 0,
+          connectionId: 'target-a'
+        },
+        {
+          id: 'repo-b',
+          path: '/tmp',
+          displayName: 'Repo B',
+          badgeColor: '#000',
+          addedAt: 0,
+          connectionId: 'target-b'
+        }
+      ],
+      worktreesByRepo: {
+        'repo-a': [makeWorktree({ id: worktreeA, repoId: 'repo-a', hostId: 'ssh:target-a' })],
+        'repo-b': [makeWorktree({ id: worktreeB, repoId: 'repo-b', hostId: 'ssh:target-b' })]
+      },
+      tabsByWorktree: {
+        [worktreeA]: [makeTab({ id: 'tab-a', worktreeId: worktreeA })],
+        [worktreeB]: [makeTab({ id: 'tab-b', worktreeId: worktreeB })]
+      }
+    })
+    const empty = { root: null, activeLeafId: null, expandedLeafId: null }
+
+    store.getState().setTabLayout('tab-a', {
+      ...empty,
+      root: { type: 'leaf', leafId: 'leaf-initial' },
+      activeLeafId: 'leaf-initial'
+    })
+    store.getState().setTabLayout('tab-a', empty)
+    const firstEdit = store.getState().pendingDirectSshLayoutEditsByTabId['tab-a']
+    store.getState().setTabLayout('tab-a', {
+      ...empty,
+      root: { type: 'leaf', leafId: 'leaf-a' },
+      activeLeafId: 'leaf-a'
+    })
+    const currentEdit = store.getState().pendingDirectSshLayoutEditsByTabId['tab-a']
+    expect(currentEdit).not.toBe(firstEdit)
+
+    store.getState().acknowledgeDirectSshLayoutEdits({ 'tab-a': firstEdit })
+    expect(store.getState().pendingDirectSshLayoutEditsByTabId['tab-a']).toBe(currentEdit)
+
+    store.getState().setTabLayout('tab-b', {
+      ...empty,
+      root: { type: 'leaf', leafId: 'leaf-initial-b' },
+      activeLeafId: 'leaf-initial-b'
+    })
+    store.getState().setTabLayout('tab-b', empty)
+    const targetBEdit = store.getState().pendingDirectSshLayoutEditsByTabId['tab-b']
+    store.getState().acknowledgeDirectSshLayoutEdits({ 'tab-a': currentEdit })
+    expect(store.getState().pendingDirectSshLayoutEditsByTabId['tab-a']).toBeUndefined()
+    expect(store.getState().pendingDirectSshLayoutEditsByTabId['tab-b']).toBe(targetBEdit)
+
+    store.getState().acknowledgeDirectSshLayoutEdits({
+      'tab-b': { targetId: 'target-a', root: targetBEdit.root }
+    })
+    expect(store.getState().pendingDirectSshLayoutEditsByTabId['tab-b']).toBe(targetBEdit)
+  })
 })
diff --git a/src/renderer/src/store/slices/terminals.ts b/src/renderer/src/store/slices/terminals.ts
index 36f08c497ca..1da1c484509 100644
--- a/src/renderer/src/store/slices/terminals.ts
+++ b/src/renderer/src/store/slices/terminals.ts
@@ -42,6 +42,7 @@ export const createTerminalSlice: StateCreator<AppState, [], [], TerminalSlice>
   expandedPaneByTabId: {},
   canExpandPaneByTabId: {},
   terminalLayoutsByTabId: {},
+  pendingDirectSshLayoutEditsByTabId: {},
   localOnlyScrollbackByTabId: {},
   pendingStartupByTabId: {},
   pendingInitialCwdByTabId: {},
diff --git a/src/renderer/src/store/slices/ui-hydration-view-layout.test.ts b/src/renderer/src/store/slices/ui-hydration-view-layout.test.ts
index d08e291d982..c6219d1be5c 100644
--- a/src/renderer/src/store/slices/ui-hydration-view-layout.test.ts
+++ b/src/renderer/src/store/slices/ui-hydration-view-layout.test.ts
@@ -487,6 +487,24 @@ describe('createUISlice hydratePersistedUI', () => {
     expect(setUI).toHaveBeenCalledWith({ groupBy: 'none', collapsedGroups: [] })
   })
 
+  it('hydrates persisted per-worktree explorer roots', () => {
+    const store = createUIStore()
+
+    store.getState().hydratePersistedUI(
+      makePersistedUI({
+        explorerDisplayRootByWorktree: {
+          'repo-1::/repo': '/',
+          'repo-2::/repo': 'packages/app'
+        }
+      })
+    )
+
+    expect(store.getState().explorerDisplayRootByWorktree).toEqual({
+      'repo-1::/repo': '/',
+      'repo-2::/repo': 'packages/app'
+    })
+  })
+
   it('hydrates persisted per-worktree dotfile visibility', () => {
     const store = createUIStore()
 
diff --git a/src/renderer/src/store/slices/ui-hydration-workspace-preferences.test.ts b/src/renderer/src/store/slices/ui-hydration-workspace-preferences.test.ts
index 586dbe7c683..815ae36b523 100644
--- a/src/renderer/src/store/slices/ui-hydration-workspace-preferences.test.ts
+++ b/src/renderer/src/store/slices/ui-hydration-workspace-preferences.test.ts
@@ -139,7 +139,9 @@ describe('createUISlice hydratePersistedUI', () => {
       'kimi',
       'minimax',
       'antigravity',
-      'grok'
+      'grok',
+      'cursor',
+      'zcode'
     ])
     expect(setUI).toHaveBeenCalledWith({
       statusBarItems: [
@@ -149,13 +151,17 @@ describe('createUISlice hydratePersistedUI', () => {
         'kimi',
         'minimax',
         'antigravity',
-        'grok'
+        'grok',
+        'cursor',
+        'zcode'
       ],
       _portsStatusBarDefaultAdded: true,
       _kimiStatusBarDefaultAdded: true,
       _minimaxStatusBarDefaultAdded: true,
       _antigravityStatusBarDefaultAdded: true,
-      _grokStatusBarDefaultAdded: true
+      _grokStatusBarDefaultAdded: true,
+      _cursorStatusBarDefaultAdded: true,
+      _zcodeStatusBarDefaultAdded: true
     })
   })
 
@@ -171,7 +177,9 @@ describe('createUISlice hydratePersistedUI', () => {
         _kimiStatusBarDefaultAdded: true,
         _minimaxStatusBarDefaultAdded: true,
         _antigravityStatusBarDefaultAdded: true,
-        _grokStatusBarDefaultAdded: true
+        _grokStatusBarDefaultAdded: true,
+        _cursorStatusBarDefaultAdded: true,
+        _zcodeStatusBarDefaultAdded: true
       })
     )
 
diff --git a/src/renderer/src/store/slices/ui/ui-slice-contract-preferences.ts b/src/renderer/src/store/slices/ui/ui-slice-contract-preferences.ts
index 3fb49ea5afc..085dd44c2b3 100644
--- a/src/renderer/src/store/slices/ui/ui-slice-contract-preferences.ts
+++ b/src/renderer/src/store/slices/ui/ui-slice-contract-preferences.ts
@@ -59,7 +59,9 @@ export type UISlicePreferences = {
   setHideWorkspacesFromOtherDevices: (v: boolean) => void
   alwaysShowDefaultBranchWorkspace: boolean
   setAlwaysShowDefaultBranchWorkspace: (v: boolean) => void
+  explorerDisplayRootByWorktree: Record<string, string>
   showDotfilesByWorktree: Record<string, boolean>
+  setExplorerDisplayRootForWorktree: (worktreeId: string, value: string) => void
   setShowDotfilesForWorktree: (worktreeId: string, showDotfiles: boolean) => void
   toggleShowDotfilesForWorktree: (worktreeId: string) => void
   filterRepoIds: readonly string[]
diff --git a/src/renderer/src/store/slices/ui/ui-slice-hydration-actions.ts b/src/renderer/src/store/slices/ui/ui-slice-hydration-actions.ts
index 6ca8d702bd3..6ee5424e480 100644
--- a/src/renderer/src/store/slices/ui/ui-slice-hydration-actions.ts
+++ b/src/renderer/src/store/slices/ui/ui-slice-hydration-actions.ts
@@ -1,6 +1,5 @@
 import type { UISlice, UISliceGet, UISliceSet } from './ui-slice-contract'
 import type { AppState } from '../../types'
-import type { PersistedUIState } from '../../../../../shared/persisted-ui-state-types'
 import { normalizeRightSidebarRoute } from '../../right-sidebar-route'
 import {
   applyManualRepoOrder,
@@ -38,7 +37,6 @@ import { normalizeStatusBarUsageMode } from '../../../../../shared/status-bar-us
 import { normalizeBrowserPageZoomLevel } from '../../../../../shared/browser-page-zoom'
 import { normalizeKagiSessionLink } from '../../../../../shared/browser-url'
 import { isReleaseChannel } from '../../../../../shared/release-channel'
-import type { StatusBarItem } from '../../../../../shared/ui-chrome-types'
 import {
   filterSetupScriptPromptDismissalsToValidRepos,
   sanitizeSetupScriptPromptDismissals
@@ -57,47 +55,21 @@ import {
   preserveStringArrayIdentity,
   sanitizeHydratedActiveView,
   sanitizePersistedRepoIds,
-  sanitizeShowDotfilesByWorktree,
+  sanitizeExplorerPreferences,
   sanitizeWorkspaceCleanupDismissals,
   sanitizePersistedSidebarWidth,
   hydratedUIPartialMatchesState,
-  migrateStatusBarItems,
   clampPetSize
 } from './ui-slice-hydration-sanitizers'
 import { hydrateAgentReadState, sanitizeTaskResumeState } from './ui-slice-hydration-values'
+import { hydrateStatusBarItems } from './ui-slice-hydration-status-bar-items'
 
 const MAX_LEFT_SIDEBAR_WIDTH = 500
 const MAX_RIGHT_SIDEBAR_WIDTH = 4000
-const DEFAULT_ON_PORTS_STATUS_BAR_ITEM: StatusBarItem = 'ports'
-const DEFAULT_ON_KIMI_STATUS_BAR_ITEM: StatusBarItem = 'kimi'
-const DEFAULT_ON_MINIMAX_STATUS_BAR_ITEM: StatusBarItem = 'minimax'
-const DEFAULT_ON_ANTIGRAVITY_STATUS_BAR_ITEM: StatusBarItem = 'antigravity'
-const DEFAULT_ON_GROK_STATUS_BAR_ITEM: StatusBarItem = 'grok'
-
-function hydrateStatusBarItems(ui: PersistedUIState): StatusBarItem[] {
-  let items = migrateStatusBarItems(ui.statusBarItems)
-  const defaults = [
-    ['_portsStatusBarDefaultAdded', DEFAULT_ON_PORTS_STATUS_BAR_ITEM],
-    ['_kimiStatusBarDefaultAdded', DEFAULT_ON_KIMI_STATUS_BAR_ITEM],
-    ['_minimaxStatusBarDefaultAdded', DEFAULT_ON_MINIMAX_STATUS_BAR_ITEM],
-    ['_antigravityStatusBarDefaultAdded', DEFAULT_ON_ANTIGRAVITY_STATUS_BAR_ITEM],
-    ['_grokStatusBarDefaultAdded', DEFAULT_ON_GROK_STATUS_BAR_ITEM]
-  ] as const
-  for (const [flag, item] of defaults) {
-    if (!ui[flag] && !items.includes(item)) {
-      items = [...items, item]
-    }
-  }
-  if (typeof window !== 'undefined' && defaults.some(([flag]) => !ui[flag])) {
-    window.api.ui
-      .set({ statusBarItems: items, ...Object.fromEntries(defaults.map(([flag]) => [flag, true])) })
-      .catch(console.error)
-  }
-  return items
-}
-
+/** Builds hydration actions that reconcile authoritative UI state without discarding pending local edits. */
 export function createUiHydrationActions(set: UISliceSet, _get: UISliceGet): Partial<UISlice> {
   return {
+    /** Captures the incoming write baseline before overlaying dirty or in-flight local fields. */
     hydratePersistedUI: (ui, source = 'sync') =>
       set((s) => {
         const manualRepoOrder = normalizeManualRepoOrder(ui.manualRepoOrder)
@@ -169,7 +141,7 @@ export function createUiHydrationActions(set: UISliceSet, _get: UISliceGet): Par
           // Why !== false: profiles written before #8873 have no key, and they are
           // precisely the ones showing the bug, so absence must mean "exempt".
           alwaysShowDefaultBranchWorkspace: ui.alwaysShowDefaultBranchWorkspace !== false,
-          showDotfilesByWorktree: sanitizeShowDotfilesByWorktree(ui.showDotfilesByWorktree),
+          ...sanitizeExplorerPreferences(ui),
           // Why: startup hydrates UI before repo catalogs, so defer repo-filter validation to the all-host refresh.
           filterRepoIds:
             validRepoIds.size === 0
diff --git a/src/renderer/src/store/slices/ui/ui-slice-hydration-sanitizers.ts b/src/renderer/src/store/slices/ui/ui-slice-hydration-sanitizers.ts
index 9737a575f06..7617b66f3f8 100644
--- a/src/renderer/src/store/slices/ui/ui-slice-hydration-sanitizers.ts
+++ b/src/renderer/src/store/slices/ui/ui-slice-hydration-sanitizers.ts
@@ -1,3 +1,4 @@
+import { normalizeExplorerDisplayRootByWorktree } from '../../../../../shared/file-explorer-display-root'
 import type { AppState } from '../../types'
 import type { PersistedTrustedOrcaHooks } from '../../../../../shared/orca-yaml-hook-types'
 import type { PersistedUIState } from '../../../../../shared/persisted-ui-state-types'
@@ -251,3 +252,15 @@ export function hydrateUnexpectedSignoutDismissal(
       typeof version === 'string' && !observed.includes(version) ? [...observed, version] : observed
   }
 }
+
+/** Normalizes persisted explorer records before hydration, including malformed or absent legacy values. */
+export function sanitizeExplorerPreferences(
+  ui: PersistedUIState
+): Pick<AppState, 'explorerDisplayRootByWorktree' | 'showDotfilesByWorktree'> {
+  return {
+    explorerDisplayRootByWorktree: normalizeExplorerDisplayRootByWorktree(
+      ui.explorerDisplayRootByWorktree
+    ),
+    showDotfilesByWorktree: sanitizeShowDotfilesByWorktree(ui.showDotfilesByWorktree)
+  }
+}
diff --git a/src/renderer/src/store/slices/ui/ui-slice-hydration-status-bar-items.ts b/src/renderer/src/store/slices/ui/ui-slice-hydration-status-bar-items.ts
new file mode 100644
index 00000000000..26b6071d64d
--- /dev/null
+++ b/src/renderer/src/store/slices/ui/ui-slice-hydration-status-bar-items.ts
@@ -0,0 +1,35 @@
+import type { PersistedUIState } from '../../../../../shared/persisted-ui-state-types'
+import type { StatusBarItem } from '../../../../../shared/ui-chrome-types'
+import { migrateStatusBarItems } from './ui-slice-hydration-sanitizers'
+
+const DEFAULT_ON_PORTS_STATUS_BAR_ITEM: StatusBarItem = 'ports'
+const DEFAULT_ON_KIMI_STATUS_BAR_ITEM: StatusBarItem = 'kimi'
+const DEFAULT_ON_MINIMAX_STATUS_BAR_ITEM: StatusBarItem = 'minimax'
+const DEFAULT_ON_ANTIGRAVITY_STATUS_BAR_ITEM: StatusBarItem = 'antigravity'
+const DEFAULT_ON_GROK_STATUS_BAR_ITEM: StatusBarItem = 'grok'
+const DEFAULT_ON_CURSOR_STATUS_BAR_ITEM: StatusBarItem = 'cursor'
+const DEFAULT_ON_ZCODE_STATUS_BAR_ITEM: StatusBarItem = 'zcode'
+
+export function hydrateStatusBarItems(ui: PersistedUIState): StatusBarItem[] {
+  let items = migrateStatusBarItems(ui.statusBarItems)
+  const defaults = [
+    ['_portsStatusBarDefaultAdded', DEFAULT_ON_PORTS_STATUS_BAR_ITEM],
+    ['_kimiStatusBarDefaultAdded', DEFAULT_ON_KIMI_STATUS_BAR_ITEM],
+    ['_minimaxStatusBarDefaultAdded', DEFAULT_ON_MINIMAX_STATUS_BAR_ITEM],
+    ['_antigravityStatusBarDefaultAdded', DEFAULT_ON_ANTIGRAVITY_STATUS_BAR_ITEM],
+    ['_grokStatusBarDefaultAdded', DEFAULT_ON_GROK_STATUS_BAR_ITEM],
+    ['_cursorStatusBarDefaultAdded', DEFAULT_ON_CURSOR_STATUS_BAR_ITEM],
+    ['_zcodeStatusBarDefaultAdded', DEFAULT_ON_ZCODE_STATUS_BAR_ITEM]
+  ] as const
+  for (const [flag, item] of defaults) {
+    if (!ui[flag] && !items.includes(item)) {
+      items = [...items, item]
+    }
+  }
+  if (typeof window !== 'undefined' && defaults.some(([flag]) => !ui[flag])) {
+    window.api.ui
+      .set({ statusBarItems: items, ...Object.fromEntries(defaults.map(([flag]) => [flag, true])) })
+      .catch(console.error)
+  }
+  return items
+}
diff --git a/src/renderer/src/store/slices/ui/ui-slice-preference-actions.ts b/src/renderer/src/store/slices/ui/ui-slice-preference-actions.ts
index a95121e504a..205a40acf9f 100644
--- a/src/renderer/src/store/slices/ui/ui-slice-preference-actions.ts
+++ b/src/renderer/src/store/slices/ui/ui-slice-preference-actions.ts
@@ -38,6 +38,7 @@ import {
   WORKSPACE_BOARD_COLUMN_WIDTH_DEFAULT
 } from '../../../../../shared/workspace-statuses'
 
+/** Builds preference defaults and setters for the UI slice, leaving durable writes to the persistence layer. */
 export function createUiPreferenceActions(set: UISliceSet, get: UISliceGet): Partial<UISlice> {
   return {
     sidebarBody: 'workspaces',
@@ -116,6 +117,19 @@ export function createUiPreferenceActions(set: UISliceSet, get: UISliceGet): Par
     alwaysShowDefaultBranchWorkspace: true,
     setAlwaysShowDefaultBranchWorkspace: (v) => set({ alwaysShowDefaultBranchWorkspace: v }),
 
+    explorerDisplayRootByWorktree: {},
+    /** Stores an explicit root choice while rejecting empty IDs and prototype-related record keys. */
+    setExplorerDisplayRootForWorktree: (worktreeId, value) => {
+      if (!worktreeId || ['__proto__', 'constructor', 'prototype'].includes(worktreeId)) {
+        return
+      }
+      set((s) => ({
+        explorerDisplayRootByWorktree: {
+          ...s.explorerDisplayRootByWorktree,
+          [worktreeId]: value
+        }
+      }))
+    },
     showDotfilesByWorktree: {},
     setShowDotfilesForWorktree: (worktreeId, showDotfiles) =>
       set((s) => {
diff --git a/src/renderer/src/store/slices/workspace-cleanup-removal-targets.ts b/src/renderer/src/store/slices/workspace-cleanup-removal-targets.ts
index 49f8814ca62..efdd165910d 100644
--- a/src/renderer/src/store/slices/workspace-cleanup-removal-targets.ts
+++ b/src/renderer/src/store/slices/workspace-cleanup-removal-targets.ts
@@ -34,6 +34,7 @@ import {
   hasValidWorkspaceCleanupUnverifiedConsent,
   hasWorkspaceCleanupRiskEscalated
 } from './workspace-cleanup-preflight-failures'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 /** Distinct from every ExecutionHostId, so a hostless row cannot alias one. */
 const UNQUALIFIED_HOST_BUCKET = Symbol('unqualified-cleanup-host')
@@ -190,7 +191,7 @@ export async function preflightWorkspaceCleanupCandidates(
     const chunk = worktreeIds.slice(start, start + WORKSPACE_CLEANUP_TARGET_BATCH_LIMIT)
     const scan = await window.api.workspaceCleanup.scan({
       worktreeIds: [...chunk],
-      scanId: crypto.randomUUID(),
+      scanId: createBrowserUuid(),
       refreshActivity: true
     })
     const enriched = await enrich(scan.candidates, getState())
diff --git a/src/renderer/src/store/slices/workspace-cleanup-scan-lifecycle.ts b/src/renderer/src/store/slices/workspace-cleanup-scan-lifecycle.ts
index 72438524614..d8e21f94cf5 100644
--- a/src/renderer/src/store/slices/workspace-cleanup-scan-lifecycle.ts
+++ b/src/renderer/src/store/slices/workspace-cleanup-scan-lifecycle.ts
@@ -22,6 +22,7 @@ import {
   finalizeWorkspaceCleanupScan,
   isLatestWorkspaceCleanupScan
 } from './workspace-cleanup-scan-progress'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 type SetState = (
   partial: Partial<AppState> | ((state: AppState) => Partial<AppState>),
@@ -54,7 +55,7 @@ export async function scanWorkspaceCleanup(
     ],
     // Broad scan identity belongs to this store request; caller-provided IDs
     // are reserved for focused scans and can collide across refresh variants.
-    scanId: crypto.randomUUID()
+    scanId: createBrowserUuid()
   }
   const scanKey = getWorkspaceCleanupScanKey(scanArgs)
 
diff --git a/src/renderer/src/store/slices/workspace-cleanup.ts b/src/renderer/src/store/slices/workspace-cleanup.ts
index 00c58e81b4b..23bff42e763 100644
--- a/src/renderer/src/store/slices/workspace-cleanup.ts
+++ b/src/renderer/src/store/slices/workspace-cleanup.ts
@@ -27,6 +27,7 @@ import {
   type WorkspaceCleanupRemoveOptions,
   type WorkspaceCleanupRemoveResult
 } from './workspace-cleanup-removal'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export type { WorkspaceCleanupFailure, WorkspaceCleanupRemoveOptions, WorkspaceCleanupRemoveResult }
 export { enrichWorkspaceCleanupCandidates, WORKSPACE_CLEANUP_ENRICHMENT_CONCURRENCY }
@@ -150,7 +151,7 @@ export const createWorkspaceCleanupSlice: StateCreator<AppState, [], [], Workspa
     if (existing.has(identity)) {
       return null
     }
-    const attemptId = crypto.randomUUID()
+    const attemptId = createBrowserUuid()
     existing.set(identity, attemptId)
     return attemptId
   },
diff --git a/src/renderer/src/store/slices/worktrees-runtime-host-metadata-retirement.test.ts b/src/renderer/src/store/slices/worktrees-runtime-host-metadata-retirement.test.ts
index eeaf49dd5e4..076e7a69a97 100644
--- a/src/renderer/src/store/slices/worktrees-runtime-host-metadata-retirement.test.ts
+++ b/src/renderer/src/store/slices/worktrees-runtime-host-metadata-retirement.test.ts
@@ -86,6 +86,20 @@ describe('runtime-host persisted metadata retirement', () => {
     expect(forgetRemovedForExecutionHostMock).not.toHaveBeenCalled()
   })
 
+  // Why: a host that does not answer is lost contact, never evidence a checkout is gone.
+  it('retires nothing when the runtime host does not answer', async () => {
+    const store = seedClientWithBothRows()
+    runtimeEnvironmentCall.mockRejectedValue(new Error('runtime host unreachable'))
+
+    await store
+      .getState()
+      .fetchWorktrees(REPO_ID, { executionHostId: HOST_ID })
+      .catch(() => undefined)
+
+    expect(forgetRemovedForExecutionHostMock).not.toHaveBeenCalled()
+    expect(store.getState().worktreesByRepo[REPO_ID]).toEqual([live, deletedOnHost])
+  })
+
   // `session-fallback` claims authoritative but is the truncated, visibility-filtered `worktree.list`
   // reply from a host too old for `worktree.detectedList`. Its omissions prove nothing.
   it('retires nothing from a legacy session-fallback listing', async () => {
diff --git a/src/renderer/src/store/slices/worktrees-slice-test-harness.ts b/src/renderer/src/store/slices/worktrees-slice-test-harness.ts
index 09076982e8a..af06bed1402 100644
--- a/src/renderer/src/store/slices/worktrees-slice-test-harness.ts
+++ b/src/renderer/src/store/slices/worktrees-slice-test-harness.ts
@@ -126,9 +126,11 @@ export function resetRemoteRuntimeMocks() {
   })
 }
 
+/** Supplies the worktree slice with the minimal UI and runtime state needed to exercise creation and teardown. */
 export function createTestStore() {
   return create<AppState>()(
     (...a) =>
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This slice fixture supplies the state read by worktree actions; unrelated slices are intentionally omitted.
       ({
         // Why: this test isolates the worktree slice, so it provides only the state surface createWorktreeSlice touches.
         ...createWorktreeSlice(...a),
@@ -168,6 +170,7 @@ export function createTestStore() {
         markdownViewMode: {},
         markdownRichModeSizeOverride: {},
         editorViewMode: {},
+        explorerDisplayRootByWorktree: {},
         showDotfilesByWorktree: {},
         expandedDirs: {},
         gitStatusByWorktree: {},
diff --git a/src/renderer/src/store/slices/worktrees/session/worktree-identity-rename-row-worktree-ids.test.ts b/src/renderer/src/store/slices/worktrees/session/worktree-identity-rename-row-worktree-ids.test.ts
index 039b1b5ca91..cb6dd89e026 100644
--- a/src/renderer/src/store/slices/worktrees/session/worktree-identity-rename-row-worktree-ids.test.ts
+++ b/src/renderer/src/store/slices/worktrees/session/worktree-identity-rename-row-worktree-ids.test.ts
@@ -41,7 +41,7 @@ describe('buildWorktreeRenameState value-owned worktree rows', () => {
     const next = buildWorktreeRenameState(
       appState({
         closedTerminalTabTombstonesByTabId: {
-          'tab-1': { closedAt: 5, worktreeId: OLD, ackRevision: 3 },
+          'tab-1': { closedAt: 5, worktreeId: OLD, reason: 'user' },
           'tab-2': { closedAt: 6, worktreeId: OTHER }
         }
       }),
@@ -49,7 +49,7 @@ describe('buildWorktreeRenameState value-owned worktree rows', () => {
       NEW
     )
     expect(next.closedTerminalTabTombstonesByTabId).toEqual({
-      'tab-1': { closedAt: 5, worktreeId: NEW, ackRevision: 3 },
+      'tab-1': { closedAt: 5, worktreeId: NEW, reason: 'user' },
       'tab-2': { closedAt: 6, worktreeId: OTHER }
     })
   })
diff --git a/src/renderer/src/store/slices/worktrees/session/worktree-identity-rename-state.ts b/src/renderer/src/store/slices/worktrees/session/worktree-identity-rename-state.ts
index 1d863890685..7cfbd6f674c 100644
--- a/src/renderer/src/store/slices/worktrees/session/worktree-identity-rename-state.ts
+++ b/src/renderer/src/store/slices/worktrees/session/worktree-identity-rename-state.ts
@@ -45,6 +45,7 @@ const WORKTREE_ID_KEYED_MAP_KEYS = [
   'gitBranchCompareSummaryByWorktree',
   'gitBranchCompareRequestKeyByWorktree',
   'gitBranchCompareRequestStatusHeadByWorktree',
+  'explorerDisplayRootByWorktree',
   'showDotfilesByWorktree',
   'expandedDirs',
   'defaultTerminalTabsAppliedByWorktreeId',
diff --git a/src/renderer/src/store/slices/worktrees/teardown/remove-worktree-store-cleanup.ts b/src/renderer/src/store/slices/worktrees/teardown/remove-worktree-store-cleanup.ts
index 2a0068e3f4b..edb6d228a9f 100644
--- a/src/renderer/src/store/slices/worktrees/teardown/remove-worktree-store-cleanup.ts
+++ b/src/renderer/src/store/slices/worktrees/teardown/remove-worktree-store-cleanup.ts
@@ -6,6 +6,7 @@ import { removeWorktreeVisitEntries } from '@/lib/worktree-visit-recency'
 import { forgetAmbiguousOwnerWarnings } from '../listing/worktree-owner-settings'
 import { omitRecordKeys } from './record-key-omission'
 
+/** Clears worktree-owned renderer state after successful removal so a reused identity cannot inherit stale preferences. */
 export function applyRemoveWorktreeSuccessState(
   set: WorktreeSliceSet,
   worktreeId: string,
@@ -60,6 +61,7 @@ export function applyRemoveWorktreeSuccessState(
       nativeChatLaunchDraftByTabId: omitByTabId(s.nativeChatLaunchDraftByTabId),
       unverifiedPtyLossTabIds: omitByTabId(s.unverifiedPtyLossTabIds),
       terminalLayoutsByTabId: omitByTabId(s.terminalLayoutsByTabId),
+      pendingDirectSshLayoutEditsByTabId: omitByTabId(s.pendingDirectSshLayoutEditsByTabId),
       localOnlyScrollbackByTabId: omitByTabId(s.localOnlyScrollbackByTabId),
       // Why: closeTab deletes these per-tab maps but removeWorktree missed them, leaking a split pane's expand flags.
       expandedPaneByTabId: omitByTabId(s.expandedPaneByTabId),
@@ -110,6 +112,7 @@ export function applyRemoveWorktreeSuccessState(
       markdownFrontmatterVisible: omitByFileId(s.markdownFrontmatterVisible),
       // Why: editorCursorLine is keyed by fileId; clear it with the other per-file state so it doesn't leak.
       editorCursorLine: omitByFileId(s.editorCursorLine),
+      explorerDisplayRootByWorktree: omitByWorktree(s.explorerDisplayRootByWorktree),
       showDotfilesByWorktree: omitByWorktree(s.showDotfilesByWorktree),
       expandedDirs: omitByWorktree(s.expandedDirs),
       // Why: clear the huge-status marker so it doesn't linger after the worktree is gone.
diff --git a/src/renderer/src/store/slices/worktrees/teardown/removed-worktree-snapshot-prune.ts b/src/renderer/src/store/slices/worktrees/teardown/removed-worktree-snapshot-prune.ts
index 785ea0ffce3..a4cec350d4a 100644
--- a/src/renderer/src/store/slices/worktrees/teardown/removed-worktree-snapshot-prune.ts
+++ b/src/renderer/src/store/slices/worktrees/teardown/removed-worktree-snapshot-prune.ts
@@ -1,4 +1,5 @@
 import type { ExecutionHostId } from '../../../../../../shared/execution-host'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 /**
  * Drop a removed row from the local persisted cleanup snapshots.
@@ -16,7 +17,7 @@ export async function recordRemovedWorktreeSnapshotPrune(args: {
       // Why: an unknown batch id degrades to an immediate one-off prune. The id
       // must stay bounded — main rejects batch ids over 128 chars, so it cannot
       // embed the unbounded worktreeId.
-      batchId: args.snapshotPruneBatchId ?? `single-removal:${crypto.randomUUID()}`,
+      batchId: args.snapshotPruneBatchId ?? `single-removal:${createBrowserUuid()}`,
       worktreeId: args.worktreeId,
       ...(args.hostId ? { executionHostId: args.hostId } : {})
     })
diff --git a/src/renderer/src/store/slices/worktrees/teardown/worktree-purge-state.ts b/src/renderer/src/store/slices/worktrees/teardown/worktree-purge-state.ts
index db501c284f4..31ef6cda2e3 100644
--- a/src/renderer/src/store/slices/worktrees/teardown/worktree-purge-state.ts
+++ b/src/renderer/src/store/slices/worktrees/teardown/worktree-purge-state.ts
@@ -18,6 +18,7 @@ import { discardStructuredAgentSessionLaunchOutbox } from '@/components/native-c
 import { clearWebSessionFocusIntentIfMatches } from '@/runtime/web-session-focus-intent'
 import { LOCAL_STRUCTURED_SESSION_OWNER } from '@/runtime/local-structured-session-owner'
 
+/** Builds a bulk cleanup patch and clears auxiliary warning records without requiring individual terminal teardown. */
 export function buildWorktreePurgeState(
   s: AppState,
   worktreeTargets: WorktreePurgeTargets
@@ -117,6 +118,7 @@ export function buildWorktreePurgeState(
     workspaceLineageByChildKey: omitWorkspaceLineageByWorktree(s.workspaceLineageByChildKey),
     tabsByWorktree: omitByWorktree(s.tabsByWorktree),
     terminalLayoutsByTabId: omitByTabId(s.terminalLayoutsByTabId),
+    pendingDirectSshLayoutEditsByTabId: omitByTabId(s.pendingDirectSshLayoutEditsByTabId),
     localOnlyScrollbackByTabId: omitByTabId(s.localOnlyScrollbackByTabId),
     ptyIdsByTabId: omitByTabId(s.ptyIdsByTabId),
     runtimePaneTitlesByTabId: omitByTabId(s.runtimePaneTitlesByTabId),
@@ -218,6 +220,7 @@ export function buildWorktreePurgeState(
     ),
     // Why: keyed by worktreeId; without this it leaks a huge-status marker per removed worktree.
     gitStatusHugeByWorktree: omitByWorktree(s.gitStatusHugeByWorktree),
+    explorerDisplayRootByWorktree: omitByWorktree(s.explorerDisplayRootByWorktree),
     showDotfilesByWorktree: omitByWorktree(s.showDotfilesByWorktree),
     expandedDirs: omitByWorktree(s.expandedDirs),
     // Per-file editor state for removed files
diff --git a/src/renderer/src/store/terminals/terminal-actions.ts b/src/renderer/src/store/terminals/terminal-actions.ts
index 9720e08cacf..d1bc838346d 100644
--- a/src/renderer/src/store/terminals/terminal-actions.ts
+++ b/src/renderer/src/store/terminals/terminal-actions.ts
@@ -1,5 +1,5 @@
 import type { AgentAttentionUnreadReason } from '@/attention/agent-attention-contract'
-import type { TerminalState } from './terminal-state'
+import type { DirectSshLayoutEdit, TerminalState } from './terminal-state'
 import type { Tab } from '../../../../shared/tab-types'
 import type { TerminalLayoutSnapshot, TerminalTab } from '../../../../shared/terminal-tab-types'
 import type { TuiAgent } from '../../../../shared/tui-agent'
@@ -189,6 +189,7 @@ export type TerminalActions = {
   setTabPaneExpanded: (tabId: string, expanded: boolean) => void
   setTabCanExpandPane: (tabId: string, canExpand: boolean) => void
   setTabLayout: (tabId: string, layout: TerminalLayoutSnapshot | null) => void
+  acknowledgeDirectSshLayoutEdits: (uploaded: Readonly<Record<string, DirectSshLayoutEdit>>) => void
   /** Client-local park scrollback for a tab. Never uploaded; read via `resolveLeafScrollback`. */
   setTabLocalOnlyScrollback: (tabId: string, buffersByLeafId: Record<string, string> | null) => void
   syncPaneDetachPtyOwnership: (args: {
diff --git a/src/renderer/src/store/terminals/terminal-layout-state.ts b/src/renderer/src/store/terminals/terminal-layout-state.ts
index 4e33ce87fc6..455e73eb0b5 100644
--- a/src/renderer/src/store/terminals/terminal-layout-state.ts
+++ b/src/renderer/src/store/terminals/terminal-layout-state.ts
@@ -1,5 +1,7 @@
 import { makePaneKey } from '../../../../shared/stable-pane-id'
-import { terminalLayoutEqual } from '@/lib/terminal-layout-equality'
+import { terminalLayoutEqual, terminalLayoutNodeEqual } from '@/lib/terminal-layout-equality'
+import { getConnectionIdFromState } from '@/lib/connection-owner-resolution'
+import { omitRecordKeys } from '../slices/worktrees/teardown/record-key-omission'
 import {
   normalizeTerminalLayoutPtyOwnership,
   resolveTerminalLayoutPtyOwnershipTransfers
@@ -23,6 +25,7 @@ export function createTerminalLayoutActions(
   | 'setTabPaneExpanded'
   | 'setTabCanExpandPane'
   | 'setTabLayout'
+  | 'acknowledgeDirectSshLayoutEdits'
   | 'setTabLocalOnlyScrollback'
   | 'syncPaneDetachPtyOwnership'
 > {
@@ -75,6 +78,19 @@ export function createTerminalLayoutActions(
           : { canExpandPaneByTabId: { ...s.canExpandPaneByTabId, [tabId]: canExpand } }
       )
     },
+    acknowledgeDirectSshLayoutEdits: (uploaded) => {
+      set((s) => {
+        const acknowledged = Object.keys(uploaded).filter((tabId) => {
+          const pending = s.pendingDirectSshLayoutEditsByTabId[tabId]
+          const candidate = uploaded[tabId]
+          return pending === candidate
+        })
+        const pending = omitRecordKeys(s.pendingDirectSshLayoutEditsByTabId, acknowledged)
+        return pending === s.pendingDirectSshLayoutEditsByTabId
+          ? s
+          : { pendingDirectSshLayoutEditsByTabId: pending }
+      })
+    },
     setTabLayout: (tabId, layout) => {
       let ownershipTransfers: ReturnType<typeof resolveTerminalLayoutPtyOwnershipTransfers> = []
       set((s) => {
@@ -84,7 +100,13 @@ export function createTerminalLayoutActions(
           }
           const next = { ...s.terminalLayoutsByTabId }
           delete next[tabId]
-          return { terminalLayoutsByTabId: next }
+          return {
+            terminalLayoutsByTabId: next,
+            pendingDirectSshLayoutEditsByTabId: omitRecordKeys(
+              s.pendingDirectSshLayoutEditsByTabId,
+              [tabId]
+            )
+          }
         }
         const normalized = normalizeTerminalLayoutPtyOwnership(layout)
         // Resolved before the bailout: normalization can transfer pane ownership even when the stored snapshot is untouched.
@@ -99,8 +121,23 @@ export function createTerminalLayoutActions(
         if (existing && terminalLayoutEqual(existing, normalized.snapshot)) {
           return s
         }
+        const structuralEdit = !terminalLayoutNodeEqual(existing?.root, normalized.snapshot.root)
+        const workspaceId = structuralEdit
+          ? Object.keys(s.tabsByWorktree).find((id) =>
+              s.tabsByWorktree[id].some((tab) => tab.id === tabId)
+            )
+          : undefined
+        const tracksRemoteEdit = workspaceId && getConnectionIdFromState(s, workspaceId)
         return {
-          terminalLayoutsByTabId: { ...s.terminalLayoutsByTabId, [tabId]: normalized.snapshot }
+          terminalLayoutsByTabId: { ...s.terminalLayoutsByTabId, [tabId]: normalized.snapshot },
+          ...(tracksRemoteEdit
+            ? {
+                pendingDirectSshLayoutEditsByTabId: {
+                  ...s.pendingDirectSshLayoutEditsByTabId,
+                  [tabId]: { targetId: tracksRemoteEdit, root: normalized.snapshot.root }
+                }
+              }
+            : {})
         }
       })
       transferNormalizedTerminalLayoutPtyOwnership(get(), tabId, ownershipTransfers)
diff --git a/src/renderer/src/store/terminals/terminal-state.ts b/src/renderer/src/store/terminals/terminal-state.ts
index 5a4b097f057..d0595b8721f 100644
--- a/src/renderer/src/store/terminals/terminal-state.ts
+++ b/src/renderer/src/store/terminals/terminal-state.ts
@@ -23,6 +23,11 @@ import type { StateCreator } from 'zustand'
 import type { AppState } from '../types'
 import type { TerminalActions } from './terminal-actions'
 
+export type DirectSshLayoutEdit = {
+  targetId: string
+  root: TerminalLayoutSnapshot['root']
+}
+
 export type TerminalState = {
   tabsByWorktree: Record<string, TerminalTab[]>
   activeTabId: string | null
@@ -44,6 +49,8 @@ export type TerminalState = {
   expandedPaneByTabId: Record<string, boolean>
   canExpandPaneByTabId: Record<string, boolean>
   terminalLayoutsByTabId: Record<string, TerminalLayoutSnapshot>
+  /** Local structural edits remain protected until the owning SSH host acknowledges them. */
+  pendingDirectSshLayoutEditsByTabId: Record<string, DirectSshLayoutEdit>
   /** Ordinary-park scrollback, tabId -> leafId -> buffer. Never uploaded to a peer; see
    *  WorkspaceSessionState.localOnlyScrollbackByTabId. Read via resolveLeafScrollbackBuffers only. */
   localOnlyScrollbackByTabId: Record<string, Record<string, string>>
diff --git a/src/renderer/src/store/terminals/terminal-surface-close-intent.ts b/src/renderer/src/store/terminals/terminal-surface-close-intent.ts
new file mode 100644
index 00000000000..25393aa8129
--- /dev/null
+++ b/src/renderer/src/store/terminals/terminal-surface-close-intent.ts
@@ -0,0 +1,16 @@
+import type { TerminalSurfaceCloseTarget } from '../../../../shared/terminal-surface-close-target'
+
+/** Commits a terminal tab or split-pane close in main, which owns membership: a renderer save
+ *  cannot shrink it, so without this the close would ride on the PTY exit. */
+export function commitTerminalSurfaceClose(
+  worktreeId: string,
+  target: TerminalSurfaceCloseTarget,
+  reason?: 'user' | 'cleanup'
+): void {
+  // Why optional: an older preload can linger through an in-place renderer reload.
+  void globalThis.window?.api?.session
+    ?.closeTerminalSurface?.({ worktreeId, target, ...(reason ? { reason } : {}) })
+    ?.catch((error: unknown) => {
+      console.warn('[terminal-close] main did not commit the close', error)
+    })
+}
diff --git a/src/renderer/src/store/terminals/terminal-tab-close-intent.test.ts b/src/renderer/src/store/terminals/terminal-tab-close-intent.test.ts
new file mode 100644
index 00000000000..61b51c05337
--- /dev/null
+++ b/src/renderer/src/store/terminals/terminal-tab-close-intent.test.ts
@@ -0,0 +1,100 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import type * as AgentStatusModule from '@/lib/agent-status'
+import {
+  TEST_REPO,
+  createTestStore,
+  makeTab,
+  makeWorktree,
+  seedStore
+} from '../slices/store-test-helpers'
+import { createStoreCascadesMockApi } from '../slices/store-cascades-test-harness'
+
+vi.mock('sonner', () => ({
+  toast: { info: vi.fn(), success: vi.fn(), error: vi.fn(), warning: vi.fn() }
+}))
+
+vi.mock('@/components/terminal-pane/pty-dispatcher', () => ({
+  restorePtyDataHandlersAfterFailedShutdown: vi.fn(),
+  unregisterPtyDataHandlers: vi.fn<() => unknown[]>(() => [])
+}))
+
+vi.mock('@/lib/agent-status', async (importOriginal) => ({
+  ...(await importOriginal<typeof AgentStatusModule>()),
+  detectAgentStatusFromTitle: vi.fn().mockReturnValue(null)
+}))
+
+const mockApi = createStoreCascadesMockApi()
+const closeTerminalSurface = vi.fn()
+Object.assign(mockApi, { session: { closeTerminalSurface } })
+
+const SSH_WORKTREE = 'remote-repo::/srv/app'
+const SSH_PTY = 'ssh:target@@pty2:1:1'
+
+function storeWithSshTab(): ReturnType<typeof createTestStore> {
+  const store = createTestStore()
+  seedStore(store, {
+    repos: [{ ...TEST_REPO, id: 'remote-repo', path: '/srv/app', connectionId: 'ssh-1' }],
+    worktreesByRepo: {
+      'remote-repo': [makeWorktree({ id: SSH_WORKTREE, repoId: 'remote-repo', path: '/srv/app' })]
+    },
+    tabsByWorktree: {
+      [SSH_WORKTREE]: [makeTab({ id: 'ssh-tab', worktreeId: SSH_WORKTREE, ptyId: SSH_PTY })]
+    },
+    ptyIdsByTabId: { 'ssh-tab': [SSH_PTY] }
+  })
+  return store
+}
+
+describe('closeTab close intent', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    closeTerminalSurface.mockResolvedValue(undefined)
+    mockApi.worktrees.updateMeta.mockResolvedValue({})
+  })
+
+  it('commits the close in main even when the SSH shutdown throws', async () => {
+    mockApi.pty.kill.mockRejectedValue(new Error('relay shutdown failed'))
+    const store = storeWithSshTab()
+
+    store.getState().closeTab('ssh-tab')
+    await Promise.resolve()
+
+    expect(mockApi.pty.kill).toHaveBeenCalledWith(SSH_PTY)
+    expect(closeTerminalSurface).toHaveBeenCalledWith({
+      worktreeId: SSH_WORKTREE,
+      target: { kind: 'tab', tabId: 'ssh-tab' },
+      reason: 'user'
+    })
+  })
+
+  it('removes the tab and kills it without waiting for main to write the close', async () => {
+    closeTerminalSurface.mockReturnValue(new Promise<void>(() => {}))
+    const store = storeWithSshTab()
+
+    store.getState().closeTab('ssh-tab')
+
+    expect(closeTerminalSurface).toHaveBeenCalledTimes(1)
+    expect(store.getState().tabsByWorktree[SSH_WORKTREE]).toEqual([])
+    await Promise.resolve()
+    expect(mockApi.pty.kill).toHaveBeenCalledWith(SSH_PTY)
+  })
+
+  it.each([['user'], ['cleanup']] as const)('sends the intent for a %s close', (reason) => {
+    storeWithSshTab().getState().closeTab('ssh-tab', { reason })
+
+    expect(closeTerminalSurface).toHaveBeenCalledTimes(1)
+  })
+
+  // Why: exits still retire through main's own exit handling until main decides exits itself.
+  it('sends nothing for a pty-exit close', () => {
+    storeWithSshTab().getState().closeTab('ssh-tab', { reason: 'pty-exit' })
+
+    expect(closeTerminalSurface).not.toHaveBeenCalled()
+  })
+
+  it('sends nothing when a paired host owns the close', () => {
+    storeWithSshTab().getState().closeTab('ssh-tab', { remoteCloseOwnedByHost: true })
+
+    expect(closeTerminalSurface).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/store/terminals/terminal-tab-close-tombstone.test.ts b/src/renderer/src/store/terminals/terminal-tab-close-tombstone.test.ts
index 8a7d5039c8a..9d7820c7bd3 100644
--- a/src/renderer/src/store/terminals/terminal-tab-close-tombstone.test.ts
+++ b/src/renderer/src/store/terminals/terminal-tab-close-tombstone.test.ts
@@ -2,6 +2,9 @@ import { describe, it, expect, vi, beforeEach } from 'vitest'
 import type * as AgentStatusModule from '@/lib/agent-status'
 import { createTestStore, makeTab, makeWorktree, seedStore } from '../slices/store-test-helpers'
 import { createStoreCascadesMockApi } from '../slices/store-cascades-test-harness'
+import { mergeDirectSshRemoteWorkspaceSession } from '@/hooks/remote-workspace-session-merge'
+import { buildWorkspaceSessionPayload } from '@/lib/workspace-session'
+import { getDefaultWorkspaceSession } from '../../../../shared/constants'
 
 vi.mock('sonner', () => ({
   toast: { info: vi.fn(), success: vi.fn(), error: vi.fn(), warning: vi.fn() }
@@ -43,38 +46,93 @@ function storeWithBothWorktrees(): ReturnType<typeof createTestStore> {
   return store
 }
 
-describe('closeTab close tombstones', () => {
+const closeTerminalSurface = vi.fn()
+Object.assign(mockApi, { session: { closeTerminalSurface } })
+
+describe('closeTab close-record mirror', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    closeTerminalSurface.mockResolvedValue(undefined)
     mockApi.worktrees.updateMeta.mockResolvedValue({})
   })
 
-  it('records the closed tab against the worktree it was closed in', () => {
+  // Why every workspace kind: main records every close it is told about, and the mirror is what
+  // the seeding predicate reads before the next launch hydrates main's copy.
+  it.each([
+    ['remote-tab', REMOTE_WORKTREE],
+    ['local-tab', LOCAL_WORKTREE]
+  ])('mirrors the record main is told to write for %s', (tabId, worktreeId) => {
     const store = storeWithBothWorktrees()
 
-    store.getState().closeTab('remote-tab')
+    store.getState().closeTab(tabId)
 
-    expect(store.getState().closedTerminalTabTombstonesByTabId['remote-tab']).toEqual({
+    expect(store.getState().closedTerminalTabTombstonesByTabId[tabId]).toEqual({
       closedAt: expect.any(Number),
-      worktreeId: REMOTE_WORKTREE
+      worktreeId,
+      reason: 'user'
+    })
+    expect(closeTerminalSurface).toHaveBeenCalledWith({
+      worktreeId,
+      target: { kind: 'tab', tabId },
+      reason: 'user'
     })
   })
 
-  // A tombstone outlives the host's own record, so the only claim it may ever make is "the user
-  // closed this". Neither of these closes is that claim.
-  it.each([['pty-exit'], ['cleanup']] as const)('records nothing for a %s close', (reason) => {
+  it('mirrors a cleanup close with its reason', () => {
     const store = storeWithBothWorktrees()
 
-    store.getState().closeTab('remote-tab', { reason })
+    store.getState().closeTab('remote-tab', { reason: 'cleanup' })
 
-    expect(store.getState().closedTerminalTabTombstonesByTabId['remote-tab']).toBeUndefined()
+    expect(store.getState().closedTerminalTabTombstonesByTabId['remote-tab']?.reason).toBe(
+      'cleanup'
+    )
   })
 
-  it('records nothing for a definitively local worktree, which no pull merge ever reads', () => {
+  // Main alone closes for a process exit; a paired host owns its own records.
+  it.each([
+    ['a pty-exit close', { reason: 'pty-exit' as const }],
+    ['a host-owned close', { remoteCloseOwnedByHost: true }]
+  ])('mirrors nothing for %s', (_label, opts) => {
     const store = storeWithBothWorktrees()
 
-    store.getState().closeTab('local-tab')
+    store.getState().closeTab('remote-tab', opts)
 
     expect(store.getState().closedTerminalTabTombstonesByTabId).toEqual({})
+    expect(closeTerminalSurface).not.toHaveBeenCalled()
+  })
+
+  // The race the mirror exists for: a host pull lands after closeTab and before main has answered
+  // the close intent (which never resolves here). The host still lists the tab.
+  it('keeps a closed SSH tab closed through a pull that lands before main answers', () => {
+    closeTerminalSurface.mockReturnValue(new Promise(() => {}))
+    const store = storeWithBothWorktrees()
+    const hostStillListing = {
+      ...getDefaultWorkspaceSession(),
+      tabsByWorktree: {
+        [REMOTE_WORKTREE]: [makeTab({ id: 'remote-tab', worktreeId: REMOTE_WORKTREE })]
+      }
+    }
+    const applyPull = (): void => {
+      const state = store.getState()
+      const merged = mergeDirectSshRemoteWorkspaceSession(
+        buildWorkspaceSessionPayload(state),
+        hostStillListing,
+        new Set([REMOTE_WORKTREE]),
+        state.tabsByWorktree,
+        new Set(),
+        undefined,
+        state.closedTerminalTabTombstonesByTabId
+      )
+      const replaceWorkspaceKeys = [REMOTE_WORKTREE]
+      store.getState().hydrateWorkspaceSession(merged, { replaceWorkspaceKeys })
+      store.getState().hydrateTabsSession(merged, { replaceWorkspaceKeys })
+    }
+
+    store.getState().closeTab('remote-tab')
+    applyPull()
+    // A second pull: once re-added, a live local tab would override its record for good.
+    applyPull()
+
+    expect(store.getState().tabsByWorktree[REMOTE_WORKTREE]?.map((tab) => tab.id) ?? []).toEqual([])
   })
 })
diff --git a/src/renderer/src/store/terminals/terminal-tab-close.ts b/src/renderer/src/store/terminals/terminal-tab-close.ts
index b4ff87f4f10..8227521d2ec 100644
--- a/src/renderer/src/store/terminals/terminal-tab-close.ts
+++ b/src/renderer/src/store/terminals/terminal-tab-close.ts
@@ -1,6 +1,4 @@
-import { recordClosedTerminalTabTombstone } from '../../../../shared/closed-terminal-tab-tombstones'
 import type { TerminalTab } from '../../../../shared/terminal-tab-types'
-import { getConnectionIdFromState } from '@/lib/connection-owner-resolution'
 import { sweepRetiredTerminalTabState } from '../slices/retired-terminal-tab-state-sweep'
 import {
   getRecentlyClosedTabPosition,
@@ -15,6 +13,7 @@ import {
 } from '../slices/terminal-tab-retirement'
 import type { TerminalSlice, TerminalStoreGet, TerminalStoreSet } from './terminal-state'
 import { startTerminalTabProviderRetirement } from './terminal-tab-close-providers'
+import { commitTerminalSurfaceClose } from './terminal-surface-close-intent'
 import { omitUnverifiedPtyLossTabIds } from './terminal-unverified-pty-loss'
 import { removePaneKeysByTabPrefix } from '../slices/agent-status-pane-keyed-records'
 import { omitRecordKeys } from '../slices/worktrees/teardown/record-key-omission'
@@ -26,7 +25,9 @@ export function createTerminalTabCloseActions(
   return {
     closeTab: (tabId, opts) => {
       const closeReason = opts?.reason ?? 'user'
-      const retiresSession = closeReason === 'user' || closeReason === 'cleanup'
+      // Why narrowed separately: main alone records a close for a process exit.
+      const intentReason = closeReason === 'pty-exit' ? null : closeReason
+      const retiresSession = intentReason !== null
       const retirementPlan =
         opts?.precomputedRetirementPlan?.tabId === tabId
           ? opts.precomputedRetirementPlan
@@ -68,22 +69,19 @@ export function createTerminalTabCloseActions(
             next[wId] = after
           }
         }
-        // Why `user` and not retiresSession: a tombstone outlives the host's own record, so the only
-        // thing it may ever say is "the user closed this". A pty-exit close is the process ending,
-        // and a `cleanup` close retires a tab the app itself created — neither is that claim.
-        // Why a non-local worktree only: the tombstone is read solely by the direct-SSH pull merge,
-        // and a definitively local tab would just consume the map's cap. An unresolved repo
-        // (undefined, not null) still records — losing the tombstone reinstates the resurrection.
+        // Why mirrored here and never persisted: main records the close through the intent below,
+        // and the direct-SSH pull merge reads this synchronously, so a pull landing before main
+        // answered would otherwise re-add the tab. Goes away when that merge moves to main.
         const nextClosedTombstones =
-          closeReason === 'user' &&
-          closedWorktreeId &&
-          getConnectionIdFromState(s, closedWorktreeId) !== null
-            ? recordClosedTerminalTabTombstone(
-                s.closedTerminalTabTombstonesByTabId,
-                tabId,
-                closedWorktreeId,
-                Date.now()
-              )
+          intentReason && closedWorktreeId && opts?.remoteCloseOwnedByHost !== true
+            ? {
+                ...s.closedTerminalTabTombstonesByTabId,
+                [tabId]: {
+                  closedAt: Date.now(),
+                  worktreeId: closedWorktreeId,
+                  reason: intentReason
+                }
+              }
             : s.closedTerminalTabTombstonesByTabId
         // Why: only explicit user closes feed the Cmd+Shift+T reopen stack; cleanup/PTY-exit closes must not pollute undo history.
         const closedPosition =
@@ -220,6 +218,7 @@ export function createTerminalTabCloseActions(
           expandedPaneByTabId: nextExpanded,
           canExpandPaneByTabId: nextCanExpand,
           terminalLayoutsByTabId: nextLayouts,
+          pendingDirectSshLayoutEditsByTabId: omitByTabId(s.pendingDirectSshLayoutEditsByTabId),
           localOnlyScrollbackByTabId: nextLocalOnlyScrollback,
           pendingStartupByTabId: nextPendingStartupByTabId,
           automaticAgentResumeClaimsByTabId: nextAutomaticAgentResumeClaimsByTabId,
@@ -248,6 +247,9 @@ export function createTerminalTabCloseActions(
             : {})
         }
       })
+      if (intentReason && closingWorktreeId && opts?.remoteCloseOwnedByHost !== true) {
+        commitTerminalSurfaceClose(closingWorktreeId, { kind: 'tab', tabId }, intentReason)
+      }
       // Why shared with the paired snapshot apply: every path that removes a tab owes it the same sweep, and a second copy of the list is how one path silently misses a new entry.
       sweepRetiredTerminalTabState(get(), tabId, closingWorktreeId)
       for (const tabs of Object.values(get().unifiedTabsByWorktree)) {
diff --git a/src/renderer/src/store/terminals/workspace-terminal-hydration-patch.ts b/src/renderer/src/store/terminals/workspace-terminal-hydration-patch.ts
index e2713203a41..ef53641d0dc 100644
--- a/src/renderer/src/store/terminals/workspace-terminal-hydration-patch.ts
+++ b/src/renderer/src/store/terminals/workspace-terminal-hydration-patch.ts
@@ -174,6 +174,11 @@ export function targetScopedWorkspaceHydrationPatch(
       hydrated.activeTabIdByWorktree,
       workspaceKeys
     ),
+    pendingDirectSshLayoutEditsByTabId: Object.fromEntries(
+      Object.entries(state.pendingDirectSshLayoutEditsByTabId ?? {}).filter(
+        ([tabId]) => !deletedTargetTabIds.has(tabId)
+      )
+    ),
     tabsByWorktree: replaceHydratedRecordKeys(
       state.tabsByWorktree,
       hydrated.tabsByWorktree,
@@ -193,7 +198,7 @@ export function targetScopedWorkspaceHydrationPatch(
       ),
       ...state.defaultTerminalTabsAppliedByWorktreeId
     },
-    // Why passed through whole: hydration already unioned it with live store state, and the map is
+    // Why passed through whole: hydration already fell back to live store state, and the map is
     // keyed by tab id rather than by workspace key so replaceHydratedRecordKeys has nothing to match.
     closedTerminalTabTombstonesByTabId: hydrated.closedTerminalTabTombstonesByTabId,
     automaticAgentResumeClaimsByTabId: replaceHydratedRecordKeys(
diff --git a/src/renderer/src/store/terminals/workspace-terminal-hydration.ts b/src/renderer/src/store/terminals/workspace-terminal-hydration.ts
index db278e05d92..9cfe4e687e8 100644
--- a/src/renderer/src/store/terminals/workspace-terminal-hydration.ts
+++ b/src/renderer/src/store/terminals/workspace-terminal-hydration.ts
@@ -191,11 +191,10 @@ export function createWorkspaceTerminalHydrationActions(
             ...session.defaultTerminalTabsAppliedByWorktreeId,
             ...s.defaultTerminalTabsAppliedByWorktreeId
           },
-          // Why replace and not union: both callers hand over a map they derived from this store
-          // synchronously (the pull merge) or from disk before the store had one (startup), so there
-          // is no local tombstone to lose — and a union would resurrect the ones the merge just
-          // retired on the host's acknowledgement, which is the whole bound on this map.
-          closedTerminalTabTombstonesByTabId: session.closedTerminalTabTombstonesByTabId ?? {},
+          // Why keep the store's when absent: only main's session carries close records, and the
+          // pull merge's session does not, so re-hydrating from it must not clear the mirror.
+          closedTerminalTabTombstonesByTabId:
+            session.closedTerminalTabTombstonesByTabId ?? s.closedTerminalTabTombstonesByTabId,
           automaticAgentResumeClaimsByTabId: {},
           sleepingAgentSessionsByPaneKey,
           pendingReconnectWorktreeIds,
diff --git a/src/renderer/src/web/preload-api/web-agent-accounts-api.ts b/src/renderer/src/web/preload-api/web-agent-accounts-api.ts
index 8738039de61..900757900a6 100644
--- a/src/renderer/src/web/preload-api/web-agent-accounts-api.ts
+++ b/src/renderer/src/web/preload-api/web-agent-accounts-api.ts
@@ -1,3 +1,4 @@
+import { translate } from '@/i18n/i18n'
 import type { PreloadApi } from '../../../../preload/api-types'
 
 export function createMiniMaxCredentialsApi(): NonNullable<
@@ -14,6 +15,28 @@ export function createMiniMaxCredentialsApi(): NonNullable<
   }
 }
 
+export function createCursorAccountsApi(): NonNullable<Partial<PreloadApi>['cursorAccounts']> {
+  // Why an explanation and not a bare `signedIn: false`: Cursor's session lives on
+  // the machine running Orca, and this bridge cannot read it. The host may well be
+  // signed in — its usage meter still arrives over the rate-limit snapshot — so
+  // asserting "not signed in" here would contradict the meter beside it.
+  return {
+    getStatus: () =>
+      Promise.resolve({
+        signedIn: false,
+        email: null,
+        displayName: null,
+        credentialSource: null,
+        planType: null,
+        tokenFresh: false,
+        error: translate(
+          'auto.components.web.preloadApi.cursorAccounts.hostOnly',
+          'Cursor sign-in details are only readable on the computer running Orca.'
+        )
+      })
+  }
+}
+
 export function createGrokAccountsApi(): NonNullable<Partial<PreloadApi>['grokAccounts']> {
   const unsigned = {
     signedIn: false,
diff --git a/src/renderer/src/web/preload-api/web-explorer-root-sync.ts b/src/renderer/src/web/preload-api/web-explorer-root-sync.ts
new file mode 100644
index 00000000000..64598b21761
--- /dev/null
+++ b/src/renderer/src/web/preload-api/web-explorer-root-sync.ts
@@ -0,0 +1,67 @@
+import type { PreloadApi } from '../../../../preload/api-types'
+import type { PairedUiState } from '../../../../shared/pairing-local-ui-fields'
+import { readJson, writeJson } from './web-storage'
+import { callRuntimeResult } from './web-runtime-calls'
+
+type Roots = NonNullable<PairedUiState['explorerDisplayRootByWorktree']>
+type Updates = Parameters<PreloadApi['ui']['set']>[0]
+const PENDING_ROOTS_KEY = 'orca.web.pendingExplorerRoots.v1'
+
+/** Queues explorer-root writes per host until supported and acknowledged, surviving hydration and browser reloads. */
+export function createWebExplorerRootSync() {
+  const capableHosts = new Set<string>()
+  const latestPrepared = new Map<string, Roots>()
+  /** Reads the durable queue on demand so acknowledgments consider writes made since the request began. */
+  const pending = () => readJson<Record<string, Roots>>(PENDING_ROOTS_KEY, {})
+  /** Removes only the matching queued snapshot, preserving a newer preference written during the request. */
+  const acknowledge = (environmentId: string, roots: Roots) => {
+    const queued = pending()
+    if (JSON.stringify(queued[environmentId]) === JSON.stringify(roots)) {
+      delete queued[environmentId]
+      writeJson(PENDING_ROOTS_KEY, queued)
+    }
+  }
+  return {
+    /** Queues a host-scoped preference before stripping unsupported fields from the outgoing update. */
+    prepare(environmentId: string | undefined, updates: Updates): void {
+      const roots = updates.explorerDisplayRootByWorktree
+      if (environmentId && roots !== undefined) {
+        latestPrepared.set(environmentId, roots)
+        writeJson(PENDING_ROOTS_KEY, { ...pending(), [environmentId]: roots })
+      }
+      if (!environmentId || !capableHosts.has(environmentId)) {
+        delete updates.explorerDisplayRootByWorktree
+      }
+    },
+    /** Acknowledges explorer roots only when they were included in the successful host update. */
+    acknowledge(environmentId: string | undefined, updates: Updates): void {
+      if (environmentId && updates.explorerDisplayRootByWorktree !== undefined) {
+        acknowledge(environmentId, updates.explorerDisplayRootByWorktree)
+      }
+    },
+    /** Learns host support and replays queued roots before hydration, retaining any newer edit made during replay. */
+    async read(environmentId: string | undefined, ui: PairedUiState): Promise<void> {
+      if (!environmentId) {
+        return
+      }
+      if (ui.explorerDisplayRootByWorktree === undefined) {
+        capableHosts.delete(environmentId)
+        return
+      }
+      capableHosts.add(environmentId)
+      const roots = pending()[environmentId]
+      if (roots === undefined) {
+        return
+      }
+      const preparedAtRead = latestPrepared.get(environmentId)
+      // Replay survives hydration and browser reloads, even if the diff baseline became clean.
+      await callRuntimeResult('ui.set', { explorerDisplayRootByWorktree: roots }, 15_000)
+      acknowledge(environmentId, roots)
+      const newerPrepared = latestPrepared.get(environmentId)
+      ui.explorerDisplayRootByWorktree =
+        newerPrepared && newerPrepared !== preparedAtRead
+          ? newerPrepared
+          : (pending()[environmentId] ?? roots)
+    }
+  }
+}
diff --git a/src/renderer/src/web/preload-api/web-onboarding-api.ts b/src/renderer/src/web/preload-api/web-onboarding-api.ts
index 4fcf9593623..904381707bf 100644
--- a/src/renderer/src/web/preload-api/web-onboarding-api.ts
+++ b/src/renderer/src/web/preload-api/web-onboarding-api.ts
@@ -1,5 +1,8 @@
 import type { PreloadApi } from '../../../../preload/api-types'
-import { ONBOARDING_FLOW_VERSION, getDefaultOnboardingState } from '../../../../shared/constants'
+import {
+  ONBOARDING_FLOW_VERSION,
+  getDefaultOnboardingState
+} from '../../../../shared/onboarding-defaults'
 import type { OnboardingState } from '../../../../shared/onboarding-state-types'
 import { ONBOARDING_STORAGE_KEY, readJson, writeJson } from './web-storage'
 
diff --git a/src/renderer/src/web/preload-api/web-terminal-api.ts b/src/renderer/src/web/preload-api/web-terminal-api.ts
index 535c3454431..be6dc77cd7d 100644
--- a/src/renderer/src/web/preload-api/web-terminal-api.ts
+++ b/src/renderer/src/web/preload-api/web-terminal-api.ts
@@ -17,6 +17,8 @@ export function createPtyApi(): NonNullable<Partial<PreloadApi>['pty']> {
     signal: () => {},
     // Web panes clear the host buffer via the terminal.clearBuffer runtime RPC.
     clearBuffer: () => {},
+    // Likewise terminal.resetInputModes.
+    resetInputModes: () => {},
     kill: () => Promise.resolve(),
     ackColdRestore: () => {},
     ackData: () => {},
@@ -84,6 +86,7 @@ export function createPtyApi(): NonNullable<Partial<PreloadApi>['pty']> {
     onSpawned: () => noopUnsubscribe,
     onSerializeBufferRequest: () => noopUnsubscribe,
     onClearBufferRequest: () => noopUnsubscribe,
+    onResetInputModesRequest: () => noopUnsubscribe,
     sendSerializedBuffer: () => {},
     declarePendingPaneSerializer: () => Promise.resolve(0),
     settlePaneSerializer: () => Promise.resolve(),
diff --git a/src/renderer/src/web/preload-api/web-ui-api.ts b/src/renderer/src/web/preload-api/web-ui-api.ts
index 2755fc5663b..f24d6f1079c 100644
--- a/src/renderer/src/web/preload-api/web-ui-api.ts
+++ b/src/renderer/src/web/preload-api/web-ui-api.ts
@@ -1,3 +1,4 @@
+import { createWebExplorerRootSync } from './web-explorer-root-sync'
 import type { PreloadApi } from '../../../../preload/api-types'
 import { assertClipboardTextWithinLimitWithYield } from '../../../../shared/clipboard-text'
 import type { ReadClipboardTextOptions } from '../../../../shared/clipboard-text'
@@ -23,12 +24,30 @@ import { callRuntimeResult } from './web-runtime-calls'
 import { requireActiveEnvironmentOrNull } from './web-runtime-session'
 import { UI_STORAGE_KEY, noopUnsubscribe, writeJson } from './web-storage'
 
+/** Combines browser-local preferences with host persistence; acknowledged writes remain distinct from best-effort writes. */
 export function createWebUiApi(): NonNullable<Partial<PreloadApi>['ui']> {
+  const explorerRoots = createWebExplorerRootSync()
+  /** Captures the target host and strips browser-local or unsupported fields before sending a UI update. */
+  const prepareHostUpdates = (updates: Parameters<PreloadApi['ui']['set']>[0]) => {
+    const environmentId = requireActiveEnvironmentOrNull()?.id
+    const hostUpdates = omitPairingLocalUiFields(updates)
+    explorerRoots.prepare(environmentId, hostUpdates)
+    return { environmentId, hostUpdates }
+  }
   let zoomLevel = readLocalWebUIState().uiZoomLevel
   return {
+    /** Hydrates from the active host after replaying pending roots, falling back to local state on failure or host changes. */
     get: async () => {
       try {
+        const environmentId = requireActiveEnvironmentOrNull()?.id
         const result = await callRuntimeResult<{ ui: PairedUiState }>('ui.get', undefined, 15_000)
+        if (environmentId !== requireActiveEnvironmentOrNull()?.id) {
+          return readLocalWebUIState()
+        }
+        await explorerRoots.read(environmentId, result.ui)
+        if (environmentId !== requireActiveEnvironmentOrNull()?.id) {
+          return readLocalWebUIState()
+        }
         const local = readLocalWebUIState()
         const next = {
           ...mergeHostWebUIState(local, result.ui),
@@ -49,28 +68,35 @@ export function createWebUiApi(): NonNullable<Partial<PreloadApi>['ui']> {
         return readLocalWebUIState()
       }
     },
+    /** Persists locally first and attempts the host write without propagating offline failures to fire-and-forget callers. */
     set: async (updates) => {
       const next = mergeWebUIState(readLocalWebUIState(), updates)
       writeJson(UI_STORAGE_KEY, next)
       zoomLevel = next.uiZoomLevel
       // Why strip here too when the host also strips: an old host predating that strip would
       // otherwise persist this browser's runtime:web-* keys over the desktop profile's order.
-      const hostUpdates = omitPairingLocalUiFields(updates)
+      const { environmentId, hostUpdates } = prepareHostUpdates(updates)
       try {
         await callRuntimeResult('ui.set', hostUpdates, 15_000)
+        explorerRoots.acknowledge(environmentId, hostUpdates)
       } catch {
         // Why: unpaired/offline web clients still need local UI persistence.
       }
     },
-    // Why a separate entry point: set must stay best-effort for its many fire-and-forget
-    // callers, but the diff writer must NOT fold a patch the host never received into its
-    // baseline — that write would silently never be retried (STA-5781).
+    /** Rejects failed or stripped host updates so the diff writer cannot acknowledge preferences the host never received. */
     setWithAck: async (updates) => {
       const next = mergeWebUIState(readLocalWebUIState(), updates)
       writeJson(UI_STORAGE_KEY, next)
       zoomLevel = next.uiZoomLevel
-      const hostUpdates = omitPairingLocalUiFields(updates)
+      const { environmentId, hostUpdates } = prepareHostUpdates(updates)
       await callRuntimeResult('ui.set', hostUpdates, 15_000)
+      explorerRoots.acknowledge(environmentId, hostUpdates)
+      if (
+        updates.explorerDisplayRootByWorktree !== undefined &&
+        hostUpdates.explorerDisplayRootByWorktree === undefined
+      ) {
+        throw new Error('Explorer root preference is pending host support')
+      }
     },
     recordFeatureInteraction: async (id: FeatureInteractionId) => {
       const current = readLocalWebUIState()
diff --git a/src/renderer/src/web/preload-api/web-ui-explorer-root.test.ts b/src/renderer/src/web/preload-api/web-ui-explorer-root.test.ts
new file mode 100644
index 00000000000..81abf1af530
--- /dev/null
+++ b/src/renderer/src/web/preload-api/web-ui-explorer-root.test.ts
@@ -0,0 +1,144 @@
+// @vitest-environment happy-dom
+import { beforeEach, expect, it, vi } from 'vitest'
+import { getDefaultUIState } from '../../../../shared/constants'
+import { createWebUiApi } from './web-ui-api'
+
+const runtime = vi.hoisted(() => ({ call: vi.fn(), id: 'old' }))
+vi.mock('./web-runtime-calls', () => ({ callRuntimeResult: runtime.call }))
+vi.mock('./web-runtime-session', () => ({
+  webRuntimeState: { activeEnvironment: null },
+  requireActiveEnvironmentOrNull: () => ({ id: runtime.id })
+}))
+beforeEach(() => {
+  localStorage.clear()
+  runtime.call.mockReset()
+  runtime.id = 'old'
+})
+
+it('keeps explorer preferences local when an old host rejects unknown keys', async () => {
+  const ui = createWebUiApi()
+  const { explorerDisplayRootByWorktree: _unused, ...oldUI } = getDefaultUIState()
+  runtime.call.mockResolvedValue({ ui: oldUI })
+  await ui.get()
+  await expect(
+    ui.setWithAck!({ explorerDisplayRootByWorktree: { wt: 'src' }, sidebarWidth: 300 })
+  ).rejects.toThrow('pending host support')
+  expect(runtime.call).toHaveBeenLastCalledWith('ui.set', { sidebarWidth: 300 }, 15000)
+  expect((await ui.get()).explorerDisplayRootByWorktree).toEqual({ wt: 'src' })
+})
+
+it('sends roots only to the host that advertised the field', async () => {
+  const ui = createWebUiApi()
+  runtime.id = 'new'
+  runtime.call.mockResolvedValue({ ui: getDefaultUIState() })
+  await ui.get()
+  await ui.setWithAck!({ explorerDisplayRootByWorktree: { wt: '/' } })
+  expect(runtime.call).toHaveBeenLastCalledWith(
+    'ui.set',
+    { explorerDisplayRootByWorktree: { wt: '/' } },
+    15000
+  )
+  runtime.id = 'old'
+  await expect(
+    ui.setWithAck!({ explorerDisplayRootByWorktree: { wt: 'src' }, sidebarWidth: 300 })
+  ).rejects.toThrow('pending host support')
+  expect(runtime.call).toHaveBeenLastCalledWith('ui.set', { sidebarWidth: 300 }, 15000)
+})
+
+it('replays unacknowledged preferences after reload and host upgrade', async () => {
+  let ui = createWebUiApi()
+  const { explorerDisplayRootByWorktree: _unused, ...oldUI } = getDefaultUIState()
+  runtime.call.mockResolvedValue({ ui: oldUI })
+  await ui.get()
+  await expect(ui.setWithAck!({ explorerDisplayRootByWorktree: { wt: 'src' } })).rejects.toThrow()
+  expect((await ui.get()).explorerDisplayRootByWorktree).toEqual({ wt: 'src' })
+  ui = createWebUiApi()
+  runtime.call.mockResolvedValue({ ui: getDefaultUIState() })
+  expect((await ui.get()).explorerDisplayRootByWorktree).toEqual({ wt: 'src' })
+  expect(runtime.call).toHaveBeenLastCalledWith(
+    'ui.set',
+    { explorerDisplayRootByWorktree: { wt: 'src' } },
+    15000
+  )
+  runtime.call.mockClear().mockResolvedValue({ ui: getDefaultUIState() })
+  await ui.get()
+  expect(runtime.call).toHaveBeenCalledTimes(1)
+})
+
+it('isolates queued preferences by host and retries a failed replay', async () => {
+  const ui = createWebUiApi()
+  runtime.call.mockResolvedValue({})
+  await expect(ui.setWithAck!({ explorerDisplayRootByWorktree: { wt: 'src' } })).rejects.toThrow()
+  runtime.id = 'another'
+  runtime.call.mockClear().mockResolvedValue({ ui: getDefaultUIState() })
+  await ui.get()
+  expect(runtime.call).toHaveBeenCalledTimes(1)
+  runtime.id = 'old'
+  runtime.call
+    .mockResolvedValueOnce({ ui: getDefaultUIState() })
+    .mockRejectedValueOnce(new Error('Offline'))
+  await ui.get()
+  runtime.call.mockClear().mockResolvedValue({ ui: getDefaultUIState() })
+  await ui.get()
+  expect(runtime.call).toHaveBeenLastCalledWith(
+    'ui.set',
+    { explorerDisplayRootByWorktree: { wt: 'src' } },
+    15000
+  )
+})
+
+it.each([true, false])(
+  'preserves a newer preference during replay (write succeeds: %j)',
+  async (succeeds) => {
+    const ui = createWebUiApi()
+    runtime.call.mockResolvedValue({})
+    await expect(
+      ui.setWithAck!({ explorerDisplayRootByWorktree: { wt: 'first' } })
+    ).rejects.toThrow()
+    let finish!: () => void
+    runtime.call.mockResolvedValueOnce({ ui: getDefaultUIState() }).mockImplementationOnce(
+      () =>
+        new Promise<void>((resolve) => {
+          finish = resolve
+        })
+    )
+    const reading = ui.get()
+    await vi.waitFor(() => expect(finish).toBeTypeOf('function'))
+    runtime.call.mockImplementationOnce(() =>
+      succeeds ? Promise.resolve({}) : Promise.reject(new Error('Offline'))
+    )
+    const writing = ui.setWithAck!({ explorerDisplayRootByWorktree: { wt: 'second' } })
+    await (succeeds ? writing : expect(writing).rejects.toThrow('Offline'))
+    finish()
+    expect((await reading).explorerDisplayRootByWorktree).toEqual({ wt: 'second' })
+    runtime.call.mockClear().mockResolvedValue({ ui: getDefaultUIState() })
+    await ui.get()
+    if (succeeds) {
+      expect(runtime.call).toHaveBeenCalledTimes(1)
+    } else {
+      expect(runtime.call).toHaveBeenLastCalledWith(
+        'ui.set',
+        { explorerDisplayRootByWorktree: { wt: 'second' } },
+        15000
+      )
+    }
+  }
+)
+
+it('does not replay to a different host when the active host changes during ui.get', async () => {
+  const ui = createWebUiApi()
+  runtime.call.mockResolvedValue({})
+  await expect(ui.setWithAck!({ explorerDisplayRootByWorktree: { wt: 'src' } })).rejects.toThrow()
+  let finish!: (value: unknown) => void
+  runtime.call.mockClear().mockImplementationOnce(
+    () =>
+      new Promise((resolve) => {
+        finish = resolve
+      })
+  )
+  const reading = ui.get()
+  runtime.id = 'another'
+  finish({ ui: getDefaultUIState() })
+  await reading
+  expect(runtime.call).toHaveBeenCalledTimes(1)
+})
diff --git a/src/renderer/src/web/preload-api/web-workspace-session-api.ts b/src/renderer/src/web/preload-api/web-workspace-session-api.ts
index 2a8abc03b61..553b065c992 100644
--- a/src/renderer/src/web/preload-api/web-workspace-session-api.ts
+++ b/src/renderer/src/web/preload-api/web-workspace-session-api.ts
@@ -81,6 +81,8 @@ export function createWebWorkspaceSessionApi(): Partial<PreloadApi> {
           })
         )
       },
+      // Why a no-op: web closes reach the host through its session-tab and terminal close RPCs.
+      closeTerminalSurface: async () => {},
       // localStorage writes synchronously, so there is no deferred web flush.
       flush: async () => {},
       readTerminalScrollback: () => null,
diff --git a/src/renderer/src/web/web-preload-api-composition.test.ts b/src/renderer/src/web/web-preload-api-composition.test.ts
index 8bac20f5097..fc119f88258 100644
--- a/src/renderer/src/web/web-preload-api-composition.test.ts
+++ b/src/renderer/src/web/web-preload-api-composition.test.ts
@@ -55,6 +55,7 @@ describe('web preload API composition', () => {
       'rateLimits',
       'minimaxCredentials',
       'grokAccounts',
+      'cursorAccounts',
       'codexAccounts',
       'claudeAccounts',
       'cli',
diff --git a/src/renderer/src/web/web-preload-api.ts b/src/renderer/src/web/web-preload-api.ts
index 0f6848a1827..17f77ded803 100644
--- a/src/renderer/src/web/web-preload-api.ts
+++ b/src/renderer/src/web/web-preload-api.ts
@@ -4,6 +4,7 @@ import { createWebE2EApi } from './preload-api/web-e2e-api'
 import {
   createClaudeAccountsApi,
   createCodexAccountsApi,
+  createCursorAccountsApi,
   createGrokAccountsApi,
   createMiniMaxCredentialsApi
 } from './preload-api/web-agent-accounts-api'
@@ -107,6 +108,7 @@ function createWebPreloadApi(): Partial<PreloadApi> {
     rateLimits: createRateLimitsApi(),
     minimaxCredentials: createMiniMaxCredentialsApi(),
     grokAccounts: createGrokAccountsApi(),
+    cursorAccounts: createCursorAccountsApi(),
     codexAccounts: createCodexAccountsApi(),
     claudeAccounts: createClaudeAccountsApi(),
     cli: createCliApi(),
diff --git a/src/renderer/src/web/web-runtime-client-export-parity.test.ts b/src/renderer/src/web/web-runtime-client-export-parity.test.ts
deleted file mode 100644
index 6ba87eaad36..00000000000
--- a/src/renderer/src/web/web-runtime-client-export-parity.test.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-import { expect, expectTypeOf, it } from 'vitest'
-import type { WebPairingOffer } from './web-pairing'
-import * as WebClient from './web-runtime-client'
-
-it('keeps the paired-web client public export surface exact', () => {
-  expectTypeOf<WebClient.SubscribeOptions>().toEqualTypeOf<WebClient.SubscribeOptions>()
-  expectTypeOf<WebClient.WebRuntimeSubscriptionHandle>().toEqualTypeOf<WebClient.WebRuntimeSubscriptionHandle>()
-  expectTypeOf<ConstructorParameters<typeof WebClient.WebRuntimeClient>>().toEqualTypeOf<
-    [
-      pairing: WebPairingOffer,
-      options?: ConstructorParameters<typeof WebClient.WebRuntimeClient>[1]
-    ]
-  >()
-  expectTypeOf<keyof WebClient.WebRuntimeClient>().toEqualTypeOf<
-    'call' | 'close' | 'subscribe' | 'statusOwner'
-  >()
-  expect(Object.keys(WebClient)).toEqual(['WebRuntimeClient'])
-})
diff --git a/src/renderer/src/web/web-runtime-client-heartbeat.test.ts b/src/renderer/src/web/web-runtime-client-heartbeat.test.ts
index ab85698660b..cde7022eefd 100644
--- a/src/renderer/src/web/web-runtime-client-heartbeat.test.ts
+++ b/src/renderer/src/web/web-runtime-client-heartbeat.test.ts
@@ -6,6 +6,7 @@ import { WebRuntimeClient } from './web-runtime-client'
 // keeping its timer armed while the window is hidden.
 
 const fakeSockets: FakeWebSocket[] = []
+const clients: WebRuntimeClient[] = []
 let visibilityState: DocumentVisibilityState = 'visible'
 let nextIntervalId = 1
 const documentListeners = new Map<string, () => void>()
@@ -73,6 +74,7 @@ function makeConnectedClient(): {
     deviceToken: 'token',
     publicKeyB64: Buffer.alloc(32).toString('base64')
   })
+  clients.push(client)
   const internals = client as unknown as HeartbeatInternals
   // Override the protected time/visibility seams deterministically.
   internals.now = () => nowMs
@@ -130,6 +132,7 @@ describe('WebRuntimeClient liveness heartbeat', () => {
   })
 
   afterEach(() => {
+    clients.splice(0).forEach((client) => client.close())
     vi.unstubAllGlobals()
   })
 
diff --git a/src/shared/__fixtures__/codebuddy-question-hooks.jsonl b/src/shared/__fixtures__/codebuddy-question-hooks.jsonl
new file mode 100644
index 00000000000..81a69a899b6
--- /dev/null
+++ b/src/shared/__fixtures__/codebuddy-question-hooks.jsonl
@@ -0,0 +1,6 @@
+{"hook_event_name": "UserPromptSubmit", "prompt": "Use AskUserQuestion to ask me to choose red or blue. After I answer, reply with my color and stop.", "permission_mode": "default", "version": "2.159.0", "model": "fast-model", "session_id": "codebuddy-verification", "transcript_path": "/sessions/codebuddy-verification.jsonl"}
+{"hook_event_name": "SessionStart", "source": "startup", "permission_mode": "default", "version": "2.159.0", "model": "fast-model", "session_id": "codebuddy-verification", "transcript_path": "/sessions/codebuddy-verification.jsonl"}
+{"hook_event_name": "Notification", "notification_type": "permission_prompt", "message": "needs your permission to use AskUserQuestion", "permission_mode": "default", "version": "2.159.0", "model": "fast-model", "session_id": "codebuddy-verification", "transcript_path": "/sessions/codebuddy-verification.jsonl"}
+{"hook_event_name": "PreToolUse", "tool_name": "AskUserQuestion", "tool_input": {"questions": [{"header": "Color", "multiSelect": false, "options": [{"description": "Choose red", "label": "Red"}, {"description": "Choose blue", "label": "Blue"}], "question": "Which color do you choose?"}]}, "permission_mode": "default", "version": "2.159.0", "model": "fast-model", "session_id": "codebuddy-verification", "transcript_path": "/sessions/codebuddy-verification.jsonl"}
+{"hook_event_name": "PostToolUse", "tool_name": "AskUserQuestion", "tool_input": {"questions": [{"header": "Color", "multiSelect": false, "options": [{"description": "Choose red", "label": "Red"}, {"description": "Choose blue", "label": "Blue"}], "question": "Which color do you choose?"}]}, "tool_response": " \u00b7 Which color do you choose? \u2192 Red", "permission_mode": "default", "version": "2.159.0", "model": "fast-model", "session_id": "codebuddy-verification", "transcript_path": "/sessions/codebuddy-verification.jsonl"}
+{"hook_event_name": "Stop", "last_assistant_message": "Red", "permission_mode": "default", "version": "2.159.0", "model": "fast-model", "session_id": "codebuddy-verification", "transcript_path": "/sessions/codebuddy-verification.jsonl"}
diff --git a/src/shared/__fixtures__/codebuddy-question-hooks.meta.json b/src/shared/__fixtures__/codebuddy-question-hooks.meta.json
new file mode 100644
index 00000000000..28ac3a2d76b
--- /dev/null
+++ b/src/shared/__fixtures__/codebuddy-question-hooks.meta.json
@@ -0,0 +1,6 @@
+{
+  "version": "2.159.0",
+  "platform": "darwin",
+  "model": "fast-model",
+  "description": "Live CLI: question notification precedes PreToolUse; PreToolUse follows the answer; SessionStart follows UserPromptSubmit. Host paths and session identifiers replaced."
+}
diff --git a/src/shared/__fixtures__/qoder-no-account-hooks.jsonl b/src/shared/__fixtures__/qoder-no-account-hooks.jsonl
new file mode 100644
index 00000000000..0508c506368
--- /dev/null
+++ b/src/shared/__fixtures__/qoder-no-account-hooks.jsonl
@@ -0,0 +1,6 @@
+{"session_id":"00000000-0000-4000-8000-000000000000","transcript_path":"/private/tmp/orca-qoder-probe/config/projects/-private-tmp-orca-qoder-probe-workspace/00000000-0000-4000-8000-000000000000.jsonl","cwd":"/private/tmp/orca-qoder-probe/workspace","hook_event_name":"SessionStart","permission_mode":"default","source":"startup"}
+{"session_id":"00000000-0000-4000-8000-000000000000","transcript_path":"/private/tmp/orca-qoder-probe/config/projects/-private-tmp-orca-qoder-probe-workspace/00000000-0000-4000-8000-000000000000.jsonl","cwd":"/private/tmp/orca-qoder-probe/workspace","hook_event_name":"UserPromptSubmit","permission_mode":"default","prompt":"Reply with hello.","request_set_id":"00000000-0000-4000-8000-000000000000"}
+{"session_id":"00000000-0000-4000-8000-000000000000","transcript_path":"/private/tmp/orca-qoder-probe/config/projects/-private-tmp-orca-qoder-probe-workspace/00000000-0000-4000-8000-000000000000.jsonl","cwd":"/private/tmp/orca-qoder-probe/workspace","hook_event_name":"Notification","permission_mode":"default","notification_type":"idle_prompt","message":"Qoder CLI finished responding and is awaiting input.","details":{"streamingState":"idle"}}
+{"session_id":"00000000-0000-4000-8000-000000000000","transcript_path":"/private/tmp/orca-qoder-probe/config/projects/-private-tmp-orca-qoder-probe-workspace/00000000-0000-4000-8000-000000000000.jsonl","cwd":"/private/tmp/orca-qoder-probe/workspace","hook_event_name":"SessionEnd","permission_mode":"default","reason":"other"}
+{"session_id":"00000000-0000-4000-8000-000000000000","transcript_path":"/tmp/orca-qoder-probe/config/projects/-private-tmp-orca-qoder-probe-workspace/00000000-0000-4000-8000-000000000000.jsonl","cwd":"/private/tmp/orca-qoder-probe/workspace","hook_event_name":"SessionStart","permission_mode":"default","source":"resume"}
+{"session_id":"00000000-0000-4000-8000-000000000000","transcript_path":"/private/tmp/orca-qoder-probe/config/projects/-private-tmp-orca-qoder-probe-workspace/00000000-0000-4000-8000-000000000000.jsonl","cwd":"/private/tmp/orca-qoder-probe/workspace","hook_event_name":"SessionEnd","permission_mode":"default","reason":"other"}
diff --git a/src/shared/agent-child-row-model.test.ts b/src/shared/agent-child-row-model.test.ts
new file mode 100644
index 00000000000..a99ef0a7152
--- /dev/null
+++ b/src/shared/agent-child-row-model.test.ts
@@ -0,0 +1,384 @@
+import { describe, expect, it } from 'vitest'
+import {
+  agentChildRowContextForParent,
+  buildAgentChildRowModels,
+  buildLegacyAgentChildRowModels,
+  buildLegacyTaskRowModels,
+  flattenAgentChildRowModels,
+  type AgentChildRowContext,
+  type AgentChildRowModel
+} from './agent-child-row-model'
+import type { AgentChildWorkView } from './agent-status-child-work-view'
+
+const FRESH: AgentChildRowContext = {
+  parentEvidenceFresh: true,
+  transportObservation: 'live',
+  parentObservedAt: 900,
+  hostClockOffsetMs: 0
+}
+const STALE: AgentChildRowContext = { ...FRESH, parentEvidenceFresh: false }
+const LOST: AgentChildRowContext = { ...FRESH, transportObservation: 'unverifiable' }
+
+function view(id: string, overrides: Partial<AgentChildWorkView> = {}): AgentChildWorkView {
+  return {
+    id,
+    providerId: `task-${id}`,
+    kind: 'agent',
+    description: `child ${id}`,
+    agentType: 'general-purpose',
+    state: 'working',
+    membership: 'live',
+    firstObservedAt: 100,
+    observedAt: 500,
+    stoppable: true,
+    invocation: { invocationId: `spawn-${id}`, generation: 1 },
+    ...overrides
+  }
+}
+
+function settled(
+  id: string,
+  outcome: NonNullable<AgentChildWorkView['outcome']>,
+  overrides: Partial<AgentChildWorkView> = {}
+): AgentChildWorkView {
+  return view(id, {
+    state: 'done',
+    membership: 'settled',
+    outcome,
+    settledAt: 450,
+    ...overrides
+  })
+}
+
+function shell(id: string, owner: string, overrides: Partial<AgentChildWorkView> = {}) {
+  return view(id, {
+    kind: 'command',
+    description: 'npm run dev',
+    agentType: undefined,
+    state: 'monitoring',
+    parentChildWorkId: owner,
+    ...overrides
+  })
+}
+
+function only(views: AgentChildWorkView[], context = FRESH): AgentChildRowModel {
+  const [row] = buildAgentChildRowModels(views, context)
+  return row
+}
+
+describe('buildAgentChildRowModels: the display vocabulary', () => {
+  it.each<[string, AgentChildWorkView[], Pick<AgentChildRowModel, 'displayState' | 'detail'>]>([
+    [
+      'working with no known operation names its role',
+      [view('a')],
+      { displayState: 'working', detail: { kind: 'role', agentType: 'general-purpose' } }
+    ],
+    [
+      'working with a foreground tool names the tool the way a CLI row does',
+      [view('a', { operation: { toolName: 'Read', basis: 'open', observedAt: 400 } })],
+      { displayState: 'working', detail: { kind: 'operation', toolName: 'Read' } }
+    ],
+    [
+      'a foreground shell reads as working with its command',
+      [
+        view('a', {
+          operation: { toolName: 'Bash', input: 'npm test', basis: 'open', observedAt: 400 }
+        })
+      ],
+      {
+        displayState: 'working',
+        detail: { kind: 'operation', toolName: 'Bash', input: 'npm test' }
+      }
+    ],
+    [
+      'an idle child whose own shell runs reads monitoring',
+      [view('a', { state: 'idle' }), shell('s', 'a')],
+      { displayState: 'monitoring', detail: { kind: 'monitoring' } }
+    ],
+    [
+      'a finished child whose own shell runs reads monitoring',
+      [settled('a', 'succeeded', { lastMessage: 'All green' }), shell('s', 'a')],
+      { displayState: 'monitoring', detail: { kind: 'monitoring' } }
+    ],
+    [
+      'waiting names the tool the approval is for',
+      [
+        view('a', {
+          state: 'waiting',
+          operation: { toolName: 'Edit', input: 'src/a.ts', basis: 'open', observedAt: 400 }
+        })
+      ],
+      {
+        displayState: 'waiting',
+        detail: { kind: 'operation', toolName: 'Edit', input: 'src/a.ts' }
+      }
+    ],
+    [
+      'blocked says why',
+      [view('a', { state: 'blocked', lastMessage: 'Rate limited' })],
+      { displayState: 'blocked', detail: { kind: 'message', text: 'Rate limited' } }
+    ],
+    [
+      'succeeded reads done with its last message',
+      [settled('a', 'succeeded', { lastMessage: 'Found 3 call sites' })],
+      { displayState: 'done', detail: { kind: 'message', text: 'Found 3 call sites' } }
+    ],
+    [
+      'failed reads failed with its error',
+      [settled('a', 'failed', { lastMessage: 'Exit code 1' })],
+      { displayState: 'failed', detail: { kind: 'message', text: 'Exit code 1' } }
+    ],
+    [
+      'cancelled reads interrupted and adds no message',
+      [settled('a', 'cancelled', { lastMessage: 'half a thought' })],
+      { displayState: 'interrupted', detail: { kind: 'role', agentType: 'general-purpose' } }
+    ],
+    [
+      'an ending the lane cannot classify is neutral and says Ended',
+      [settled('a', 'unknown')],
+      { displayState: 'idle', detail: { kind: 'ended' } }
+    ],
+    [
+      'a parked live child names its role',
+      [view('a', { state: 'idle' })],
+      { displayState: 'idle', detail: { kind: 'role', agentType: 'general-purpose' } }
+    ],
+    [
+      'a host-reported unverifiable child reports its silence',
+      [view('a', { state: 'unverifiable' })],
+      { displayState: 'unverifiable', detail: { kind: 'no-update' } }
+    ]
+  ])('%s', (_name, views, expected) => {
+    expect(only(views)).toMatchObject(expected)
+  })
+
+  it('suppresses the tool line while monitoring, even when a stale operation arrives', () => {
+    const row = only([
+      view('a', {
+        state: 'idle',
+        operation: { toolName: 'Bash', input: 'npm test', basis: 'reported', observedAt: 400 }
+      }),
+      shell('s', 'a')
+    ])
+    expect(row.displayState).toBe('monitoring')
+    expect(row.detail).toEqual({ kind: 'monitoring' })
+  })
+
+  it('makes every live claim unverifiable under a stale parent or a lost transport', () => {
+    for (const context of [STALE, LOST]) {
+      expect(only([view('a')], context)).toMatchObject({
+        displayState: 'unverifiable',
+        detail: { kind: 'no-update' }
+      })
+      // A finished child's monitoring is a claim about live work; its outcome is history.
+      expect(only([settled('a', 'succeeded'), shell('s', 'a')], context).displayState).toBe(
+        'unverifiable'
+      )
+      expect(only([settled('a', 'failed')], context).displayState).toBe('failed')
+      expect(only([view('a', { state: 'idle' })], context).displayState).toBe('idle')
+    }
+  })
+
+  it('gives sibling rows their own clocks, never the parent one', () => {
+    const [busy, quiet] = buildAgentChildRowModels(
+      [view('busy', { observedAt: 880 }), view('quiet', { firstObservedAt: 200, observedAt: 300 })],
+      STALE
+    )
+    expect([busy.recencyAt, quiet.recencyAt]).toEqual([880, 300])
+    expect([busy.observedAt, quiet.observedAt]).toEqual([880, 300])
+    expect([busy.firstObservedAt, quiet.firstObservedAt]).toEqual([100, 200])
+  })
+
+  it('nests owned work under its owner and keeps host order', () => {
+    const rows = buildAgentChildRowModels(
+      [
+        view('a'),
+        shell('s', 'a', { state: 'working' }),
+        view('b'),
+        view('grandchild', { parentChildWorkId: 'a' })
+      ],
+      FRESH
+    )
+    expect(rows.map((row) => row.id)).toEqual(['a', 'b'])
+    expect(rows[0].owned.map((row) => row.id)).toEqual(['s', 'grandchild'])
+    expect(flattenAgentChildRowModels(rows).map((row) => row.id)).toEqual([
+      'a',
+      's',
+      'grandchild',
+      'b'
+    ])
+    // A shell names itself; only an agent's own tool line can go stale.
+    expect(rows[0].owned[0]).toMatchObject({ displayState: 'working', detail: null })
+  })
+
+  it('names a row by its label and omits a role that restates it', () => {
+    expect(
+      only([view('a', { description: '  ', name: 'subagent', agentType: 'Explore' })])
+    ).toMatchObject({ name: 'Explore', detail: null })
+    expect(only([view('a', { description: undefined, agentType: undefined })])).toMatchObject({
+      name: '',
+      detail: { kind: 'role', agentType: 'unknown' }
+    })
+  })
+
+  it('offers a stop only for a live row the host can target', () => {
+    expect(only([view('a')]).canStop).toBe(true)
+    expect(only([view('a', { providerId: undefined })]).canStop).toBe(false)
+    expect(only([view('a', { stoppable: false })]).canStop).toBe(false)
+    expect(only([settled('a', 'succeeded')]).canStop).toBe(false)
+  })
+})
+
+describe('buildLegacyAgentChildRowModels', () => {
+  it('reads a legacy snapshot as before: no clock of its own, no outcome, no operation', () => {
+    const rows = buildLegacyAgentChildRowModels(
+      [
+        { id: 'w', state: 'working', startedAt: 10, description: 'Review', agentType: 'Explore' },
+        { id: 'i', state: 'idle', startedAt: 20, agentType: 'writer' },
+        { id: 'u', state: 'unverifiable', startedAt: 30 }
+      ],
+      FRESH
+    )
+    expect(rows).toEqual([
+      expect.objectContaining({
+        id: 'w',
+        providerId: 'w',
+        displayState: 'working',
+        name: 'Review',
+        detail: { kind: 'role', agentType: 'Explore' },
+        firstObservedAt: 10,
+        recencyAt: 900,
+        settled: false,
+        canStop: false
+      }),
+      expect.objectContaining({ id: 'i', displayState: 'idle', name: 'writer', detail: null }),
+      expect.objectContaining({
+        id: 'u',
+        displayState: 'unverifiable',
+        detail: { kind: 'no-update' }
+      })
+    ])
+    expect(rows.every((row) => row.observedAt === undefined)).toBe(true)
+  })
+
+  it('decays live legacy states under a stale parent, as before', () => {
+    const rows = buildLegacyAgentChildRowModels(
+      [
+        { id: 'w', state: 'working', startedAt: 10 },
+        { id: 'q', state: 'waiting', startedAt: 10 },
+        { id: 'i', state: 'idle', startedAt: 10 }
+      ],
+      STALE
+    )
+    expect(rows.map((row) => row.displayState)).toEqual(['unverifiable', 'unverifiable', 'idle'])
+  })
+})
+
+describe('buildLegacyTaskRowModels', () => {
+  it('keeps the state the host decided and says only its reason', () => {
+    const rows = buildLegacyTaskRowModels(
+      [
+        { id: 'w', kind: 'agent', description: 'Review', state: 'working', startedAt: 10 },
+        { id: 'q', kind: 'agent', description: 'Approve', state: 'waiting' },
+        { id: 'u', kind: 'agent', description: 'Lost', state: 'unverifiable' },
+        { id: 'm', kind: 'monitor', description: 'tail -f log' },
+        { id: 'c', kind: 'command', description: 'npm test', stoppable: false }
+      ],
+      [{ id: 'd', kind: 'agent', description: 'Done', totalTokens: 900 }]
+    )
+    expect(rows.map((row) => [row.id, row.displayState, row.detail])).toEqual([
+      ['d', 'done', null],
+      ['w', 'working', null],
+      ['q', 'waiting', { kind: 'reason', state: 'waiting' }],
+      ['u', 'unverifiable', { kind: 'reason', state: 'unverifiable' }],
+      ['m', 'monitoring', null],
+      ['c', 'working', null]
+    ])
+    expect(rows.map((row) => row.canStop)).toEqual([true, true, true, true, true, false])
+    expect(rows[0]).toMatchObject({ settled: true, totalTokens: 900 })
+  })
+
+  it('lets a resumed live task replace its retained settled row', () => {
+    const rows = buildLegacyTaskRowModels(
+      [{ id: 'r', kind: 'agent', state: 'working' }],
+      [{ id: 'r', kind: 'agent', state: 'done' }]
+    )
+    expect(rows).toHaveLength(1)
+    expect(rows[0]).toMatchObject({ settled: false, displayState: 'working' })
+  })
+})
+
+describe('one label rule for every shape a host publishes', () => {
+  it.each(['task', ' Subagent ', 'unknown', '   '])(
+    'skips the placeholder %j on all three',
+    (label) => {
+      const [fromView] = buildAgentChildRowModels(
+        [view('a', { description: label, agentType: 'Explore' })],
+        FRESH
+      )
+      const [fromSnapshot] = buildLegacyAgentChildRowModels(
+        [{ id: 'a', state: 'working', startedAt: 10, description: label, agentType: 'Explore' }],
+        FRESH
+      )
+      const [fromRoster] = buildLegacyTaskRowModels(
+        [{ id: 'a', kind: 'agent', state: 'working', description: label, name: 'Explore' }],
+        []
+      )
+      expect([fromView.name, fromSnapshot.name, fromRoster.name]).toEqual([
+        'Explore',
+        'Explore',
+        'Explore'
+      ])
+    }
+  )
+
+  it('leaves a row with no usable label unnamed on all three', () => {
+    const [fromSnapshot] = buildLegacyAgentChildRowModels(
+      [{ id: 'a', state: 'working', startedAt: 10, description: 'task' }],
+      FRESH
+    )
+    const [fromRoster] = buildLegacyTaskRowModels(
+      [{ id: 'a', kind: 'agent', state: 'working', description: 'task' }],
+      []
+    )
+    expect([only([view('a', { description: 'task', agentType: undefined })]).name]).toEqual([''])
+    expect([fromSnapshot.name, fromRoster.name]).toEqual(['', ''])
+  })
+})
+
+describe('agentChildRowContextForParent: the reader clock', () => {
+  const MIRRORED_PARENT = {
+    // The host's clock runs 20 minutes ahead of this machine's.
+    updatedAt: 1_200_000 + 20 * 60_000,
+    evidenceObservedAt: 1_190_000 + 20 * 60_000,
+    mirroredEvidenceReceivedAt: 1_190_000
+  }
+
+  it("measures a mirrored parent on this machine's receipt clock, never the host's", () => {
+    const context = agentChildRowContextForParent(MIRRORED_PARENT, false)
+    expect(context).toMatchObject({ parentObservedAt: 1_190_000, hostClockOffsetMs: -20 * 60_000 })
+    const [legacy] = buildLegacyAgentChildRowModels(
+      [{ id: 'a', state: 'working', startedAt: 10 }],
+      context
+    )
+    expect(legacy.recencyAt).toBe(1_190_000)
+    // A view's own host stamp moves onto the reader clock; its host-clock age is kept.
+    const [child] = buildAgentChildRowModels(
+      [view('a', { observedAt: 1_100_000 + 20 * 60_000 })],
+      context
+    )
+    expect(child.recencyAt).toBe(1_100_000)
+    expect(child.observedAt).toBe(1_100_000 + 20 * 60_000)
+  })
+
+  it('leaves a parent observed on this machine on its own clock', () => {
+    expect(
+      agentChildRowContextForParent({ updatedAt: 500, evidenceObservedAt: 400 }, true)
+    ).toEqual({
+      parentEvidenceFresh: true,
+      transportObservation: 'live',
+      parentObservedAt: 400,
+      hostClockOffsetMs: 0
+    })
+  })
+})
diff --git a/src/shared/agent-child-row-model.ts b/src/shared/agent-child-row-model.ts
new file mode 100644
index 00000000000..8e1cf606eea
--- /dev/null
+++ b/src/shared/agent-child-row-model.ts
@@ -0,0 +1,376 @@
+/**
+ * One row model for every surface that lists child work (the sidebar's child rows and the chat
+ * strip), with one builder per shape a host may publish. All three name a row with one label rule
+ * (`usableAgentChildLabel`) and decide what it says with one detail rule (`agentChildRowDetail`):
+ *  - `buildAgentChildRowModels`: the host's child views (`children`), the source of record.
+ *  - `buildLegacyAgentChildRowModels`: the `subagents` snapshot.
+ *  - `buildLegacyTaskRowModels`: the session feed's `tasks` / `settledTasks` roster.
+ *
+ * The two legacy builders exist only for hosts that publish no views, and each is deleted, not
+ * migrated, when its last publisher is gone: the snapshot builder once CLI panes publish
+ * `children` and no supported paired host predates that; the roster builder once no supported
+ * paired host predates child views on the session feed.
+ */
+import type { AgentSessionBackgroundTask } from './agent-session-background-task-wire'
+import type { AgentChildWorkKind } from './agent-status-child-work'
+import { resolveAgentChildWorkFreshness } from './agent-status-child-work-freshness'
+import {
+  agentChildWorkOwnedLiveness,
+  deriveAgentChildDisplayState,
+  type AgentChildDisplayState
+} from './agent-status-child-work-display'
+import type { AgentChildWorkView } from './agent-status-child-work-view'
+import {
+  agentStatusAuthorityObservedAt,
+  agentStatusEvidenceObservedAt
+} from './agent-status-freshness'
+import type { AgentStatusEntry, AgentSubagentSnapshot } from './agent-status-types'
+
+/** What a child row says beside its name. Surfaces format it; they never decide it. */
+export type AgentChildRowDetail =
+  /** The tool the child is running now, as `tool: input` — the line a CLI agent row shows. */
+  | { kind: 'operation'; toolName: string; input?: string }
+  /** Its own work is over and only work it owns still runs; the tool line is stale. */
+  | { kind: 'monitoring' }
+  | { kind: 'message'; text: string }
+  /** Settled, and the lane cannot say how. */
+  | { kind: 'ended' }
+  /** How long since the last evidence for this child (see `recencyAt`). */
+  | { kind: 'no-update' }
+  /** The child's role, when nothing more specific is known. */
+  | { kind: 'role'; agentType: string }
+  /** A host that publishes only a run state: that state's reason word. */
+  | { kind: 'reason'; state: 'waiting' | 'blocked' | 'unverifiable' }
+
+/** One child row, for every surface that lists child work (sidebar and chat strip). */
+export type AgentChildRowModel = {
+  /** Row identity: the host's child id, or the provider id an old host names it by. */
+  id: string
+  /** The id a targeted stop names; absent when the host holds none. */
+  providerId?: string
+  kind: AgentChildWorkKind
+  displayState: AgentChildDisplayState
+  /** '' when the child reported no label; a surface then names the row by its state. */
+  name: string
+  agentType?: string
+  model?: string
+  detail: AgentChildRowDetail | null
+  /** When the child was first seen: the elapsed anchor. */
+  firstObservedAt: number
+  /** Last evidence for THIS child. Absent from a host that reports none. */
+  observedAt?: number
+  /** The reader-clock time a "no update" reading measures from: the child's own evidence, else
+   *  its parent's. */
+  recencyAt: number
+  settledAt?: number
+  totalTokens?: number
+  canStop: boolean
+  settled: boolean
+  /** Work this child owns (a nested agent, a shell it launched), in host order. */
+  owned: AgentChildRowModel[]
+}
+
+export type AgentChildRowContext = {
+  /** A stale parent makes every live claim beneath it unverifiable. */
+  parentEvidenceFresh: boolean
+  transportObservation: 'live' | 'unverifiable'
+  /** The parent's last evidence on the READER's clock (its receipt time when mirrored from another
+   *  host): recency for a child whose host reports no clock of its own. */
+  parentObservedAt: number
+  /** Reader clock minus the host's, at that evidence; 0 for a parent observed on this machine. Moves
+   *  a child's host-stamped clock onto the reader's, so no age subtracts across two machines. */
+  hostClockOffsetMs: number
+}
+
+/** The context a parent row gives its children. Every surface that lists one parent's children
+ *  builds it here, from the same parent row, so a lost child reads the same everywhere. */
+export function agentChildRowContextForParent(
+  parent: Pick<
+    AgentStatusEntry,
+    'updatedAt' | 'evidenceObservedAt' | 'mirroredEvidenceReceivedAt' | 'subagentObservation'
+  >,
+  parentEvidenceFresh: boolean
+): AgentChildRowContext {
+  // The parent row decays on this same clock, so a child's silence reads the same as its parent's.
+  const parentObservedAt = agentStatusEvidenceObservedAt(parent)
+  return {
+    parentEvidenceFresh,
+    transportObservation: parent.subagentObservation ?? 'live',
+    parentObservedAt,
+    hostClockOffsetMs: parentObservedAt - agentStatusAuthorityObservedAt(parent)
+  }
+}
+
+/** Provider strings that carry no identity; the next label wins. */
+const PLACEHOLDER_LABELS = new Set(['unknown', 'untitled', 'task', 'subagent'])
+
+/** A provider label that names the child, or undefined for an empty or placeholder one. */
+export function usableAgentChildLabel(value: string | undefined): string | undefined {
+  const trimmed = value?.trim()
+  return trimmed && !PLACEHOLDER_LABELS.has(trimmed.toLowerCase()) ? trimmed : undefined
+}
+
+// A live claim beneath a parent Orca no longer hears from asserts nothing; settled history stands.
+function withFreshness(
+  displayState: AgentChildDisplayState,
+  context: AgentChildRowContext
+): AgentChildDisplayState {
+  if (
+    displayState === 'done' ||
+    displayState === 'failed' ||
+    displayState === 'interrupted' ||
+    displayState === 'idle'
+  ) {
+    return displayState
+  }
+  return resolveAgentChildWorkFreshness({
+    state: displayState,
+    membership: 'live',
+    parentEvidenceFresh: context.parentEvidenceFresh,
+    transportObservation: context.transportObservation
+  })
+}
+
+type AgentChildRowDetailSource = {
+  /** `run-state`: the host reported only the child's run state (the legacy task roster). */
+  evidence: 'child' | 'run-state'
+  kind: AgentChildWorkKind
+  name: string
+  agentType?: string
+  operation?: { toolName: string; input?: string }
+  lastMessage?: string
+  settled: boolean
+}
+
+// A role that restates the name adds nothing.
+function roleDetail(source: AgentChildRowDetailSource): AgentChildRowDetail | null {
+  if (source.kind !== 'agent') {
+    return null
+  }
+  const agentType = source.agentType ?? 'unknown'
+  return source.name.trim() === agentType.trim() ? null : { kind: 'role', agentType }
+}
+
+function messageOrRole(source: AgentChildRowDetailSource): AgentChildRowDetail | null {
+  const text = source.lastMessage?.trim()
+  return text ? { kind: 'message', text } : roleDetail(source)
+}
+
+/** The one rule for what a child row says, in the order a CLI agent row decides it. */
+function agentChildRowDetail(
+  source: AgentChildRowDetailSource,
+  displayState: AgentChildDisplayState
+): AgentChildRowDetail | null {
+  if (source.evidence === 'run-state') {
+    return displayState === 'waiting' ||
+      displayState === 'blocked' ||
+      displayState === 'unverifiable'
+      ? { kind: 'reason', state: displayState }
+      : null
+  }
+  switch (displayState) {
+    case 'unverifiable':
+      return { kind: 'no-update' }
+    case 'monitoring':
+      // A shell or monitor names itself; only an agent's own tool line goes stale.
+      return source.kind === 'agent' ? { kind: 'monitoring' } : null
+    case 'working':
+    case 'waiting':
+      return source.operation
+        ? {
+            kind: 'operation',
+            toolName: source.operation.toolName,
+            ...(source.operation.input !== undefined ? { input: source.operation.input } : {})
+          }
+        : messageOrRole(source)
+    case 'blocked':
+    case 'done':
+    case 'failed':
+      return messageOrRole(source)
+    case 'interrupted':
+      return roleDetail(source)
+    case 'idle':
+      return source.settled ? { kind: 'ended' } : roleDetail(source)
+  }
+}
+
+function viewName(view: AgentChildWorkView): string {
+  return (
+    usableAgentChildLabel(view.description) ??
+    usableAgentChildLabel(view.name) ??
+    usableAgentChildLabel(view.agentType) ??
+    ''
+  )
+}
+
+function rowFromView(
+  view: AgentChildWorkView,
+  views: readonly AgentChildWorkView[],
+  ownedByOwner: ReadonlyMap<string, AgentChildWorkView[]>,
+  context: AgentChildRowContext,
+  path: ReadonlySet<string>
+): AgentChildRowModel {
+  const displayState = withFreshness(
+    deriveAgentChildDisplayState(view, agentChildWorkOwnedLiveness(views, view.id)),
+    context
+  )
+  const settled = view.membership === 'settled'
+  const name = viewName(view)
+  const nextPath = new Set(path).add(view.id)
+  return {
+    id: view.id,
+    ...(view.providerId !== undefined ? { providerId: view.providerId } : {}),
+    kind: view.kind,
+    displayState,
+    name,
+    ...(view.agentType !== undefined ? { agentType: view.agentType } : {}),
+    ...(view.model !== undefined ? { model: view.model } : {}),
+    detail: agentChildRowDetail(
+      {
+        evidence: 'child',
+        kind: view.kind,
+        name,
+        agentType: view.agentType,
+        operation: view.operation,
+        lastMessage: view.lastMessage,
+        settled
+      },
+      displayState
+    ),
+    firstObservedAt: view.firstObservedAt,
+    observedAt: view.observedAt,
+    recencyAt: view.observedAt + context.hostClockOffsetMs,
+    ...(view.settledAt !== undefined ? { settledAt: view.settledAt } : {}),
+    ...(view.totalTokens !== undefined ? { totalTokens: view.totalTokens } : {}),
+    canStop: !settled && view.stoppable && view.providerId !== undefined,
+    settled,
+    owned: (ownedByOwner.get(view.id) ?? [])
+      .filter((owned) => !nextPath.has(owned.id))
+      .map((owned) => rowFromView(owned, views, ownedByOwner, context, nextPath))
+  }
+}
+
+/**
+ * Child rows from the host's views: the main agent's children at the top, and everything a child
+ * owns nested beneath it. Display state comes from the shared child fold, so a finished subagent
+ * whose shell still runs reads `monitoring` exactly as a CLI agent does.
+ */
+export function buildAgentChildRowModels(
+  views: readonly AgentChildWorkView[],
+  context: AgentChildRowContext
+): AgentChildRowModel[] {
+  const ownedByOwner = new Map<string, AgentChildWorkView[]>()
+  for (const view of views) {
+    if (view.parentChildWorkId !== undefined) {
+      ownedByOwner.set(view.parentChildWorkId, [
+        ...(ownedByOwner.get(view.parentChildWorkId) ?? []),
+        view
+      ])
+    }
+  }
+  return views
+    .filter((view) => view.parentChildWorkId === undefined)
+    .map((view) => rowFromView(view, views, ownedByOwner, context, new Set()))
+}
+
+/**
+ * Child rows from a host that sends only the legacy `subagents` snapshot (an old host, or any CLI
+ * pane): live agents with a lifecycle state and a spawn time, and no clock of their own.
+ */
+export function buildLegacyAgentChildRowModels(
+  subagents: readonly AgentSubagentSnapshot[],
+  context: AgentChildRowContext
+): AgentChildRowModel[] {
+  return subagents.map((subagent) => {
+    const displayState = withFreshness(
+      deriveAgentChildDisplayState({ state: subagent.state, membership: 'live' }, null),
+      context
+    )
+    const name =
+      usableAgentChildLabel(subagent.description) ?? usableAgentChildLabel(subagent.agentType) ?? ''
+    return {
+      id: subagent.id,
+      providerId: subagent.id,
+      kind: 'agent',
+      displayState,
+      name,
+      ...(subagent.agentType !== undefined ? { agentType: subagent.agentType } : {}),
+      ...(subagent.model !== undefined ? { model: subagent.model } : {}),
+      detail: agentChildRowDetail(
+        { evidence: 'child', kind: 'agent', name, agentType: subagent.agentType, settled: false },
+        displayState
+      ),
+      firstObservedAt: subagent.startedAt,
+      recencyAt: context.parentObservedAt,
+      canStop: false,
+      settled: false,
+      owned: []
+    }
+  })
+}
+
+function legacyTaskDisplayState(
+  task: AgentSessionBackgroundTask,
+  settled: boolean
+): AgentChildDisplayState {
+  if (task.state) {
+    return task.state
+  }
+  if (settled) {
+    return 'done'
+  }
+  return task.kind === 'monitor' ? 'monitoring' : 'working'
+}
+
+// The host decided each row's state; the row keeps it.
+function legacyTaskRow(task: AgentSessionBackgroundTask, settled: boolean): AgentChildRowModel {
+  const displayState = legacyTaskDisplayState(task, settled)
+  const name = usableAgentChildLabel(task.description) ?? usableAgentChildLabel(task.name) ?? ''
+  const startedAt = task.startedAt ?? 0
+  return {
+    id: task.id,
+    providerId: task.id,
+    kind: task.kind,
+    displayState,
+    name,
+    detail: agentChildRowDetail(
+      { evidence: 'run-state', kind: task.kind, name, settled },
+      displayState
+    ),
+    firstObservedAt: startedAt,
+    recencyAt: startedAt,
+    ...(task.totalTokens !== undefined ? { totalTokens: task.totalTokens } : {}),
+    // Absent means stoppable: a host predating the field published only rows its stop could act on.
+    canStop: task.stoppable !== false,
+    settled,
+    owned: []
+  }
+}
+
+/**
+ * Rows from a host that publishes only the session feed's task roster (a host predating child
+ * views): flat, each with the run state the host decided and no clock beyond its start.
+ */
+export function buildLegacyTaskRowModels(
+  tasks: readonly AgentSessionBackgroundTask[],
+  settledTasks: readonly AgentSessionBackgroundTask[]
+): AgentChildRowModel[] {
+  // Older hosts can retain a previous turn beside its resumed live task; the live row wins.
+  const rows = new Map<string, AgentChildRowModel>()
+  for (const [roster, settled] of [
+    [settledTasks, true],
+    [tasks, false]
+  ] as const) {
+    for (const task of roster) {
+      rows.set(task.id, legacyTaskRow(task, settled))
+    }
+  }
+  return [...rows.values()]
+}
+
+/** Every row of a tree, owners before what they own. */
+export function flattenAgentChildRowModels(
+  rows: readonly AgentChildRowModel[]
+): AgentChildRowModel[] {
+  return rows.flatMap((row) => [row, ...flattenAgentChildRowModels(row.owned)])
+}
diff --git a/src/shared/agent-command-plan.ts b/src/shared/agent-command-plan.ts
new file mode 100644
index 00000000000..20190d0451b
--- /dev/null
+++ b/src/shared/agent-command-plan.ts
@@ -0,0 +1,29 @@
+import { extractLeadingEnvAssignments } from './command-environment'
+import {
+  tokenizeCustomCommandTemplate,
+  type CommandTemplateBackslash
+} from './commit-message-prompt'
+
+export function planAgentBinary(
+  defaultBinary: string,
+  commandOverride: string | undefined,
+  backslash: CommandTemplateBackslash = 'escape'
+):
+  | { ok: true; binary: string; prefixArgs: string[]; env?: Record<string, string> }
+  | { ok: false; error: string } {
+  const command = commandOverride?.trim()
+  if (!command) {
+    return { ok: true, binary: defaultBinary, prefixArgs: [] }
+  }
+
+  const tokenized = tokenizeCustomCommandTemplate(command, backslash)
+  if (!tokenized.ok) {
+    return { ok: false, error: `Agent command override is invalid: ${tokenized.error}` }
+  }
+  const { env, rest } = extractLeadingEnvAssignments(tokenized.tokens)
+  const [binary, ...prefixArgs] = rest
+  if (!binary) {
+    return { ok: false, error: 'Agent command override must start with a binary name.' }
+  }
+  return { ok: true, binary, prefixArgs, ...(env ? { env } : {}) }
+}
diff --git a/src/shared/agent-completion-time.ts b/src/shared/agent-completion-time.ts
index 4b7ea78c430..a0794139b62 100644
--- a/src/shared/agent-completion-time.ts
+++ b/src/shared/agent-completion-time.ts
@@ -1,9 +1,10 @@
 import type { AgentStateHistoryEntry, AgentStatusEntry } from './agent-status-types'
+import { agentTurnStoppedByUser } from './agent-main-agent-verdict'
 
 /** The subset of a hook entry a completion time is derived from. */
 export type AgentCompletionSource = Pick<
   AgentStatusEntry,
-  'state' | 'stateStartedAt' | 'stateHistory' | 'interrupted' | 'sessionBoundary'
+  'state' | 'stateStartedAt' | 'stateHistory' | 'interrupted' | 'mainAgent' | 'sessionBoundary'
 >
 
 function mostRecentCompletedTurnInHistory(
@@ -13,7 +14,7 @@ function mostRecentCompletedTurnInHistory(
   for (const row of history ?? []) {
     if (
       row.state === 'done' &&
-      row.interrupted !== true &&
+      !agentTurnStoppedByUser(row) &&
       Number.isFinite(row.startedAt) &&
       row.startedAt > max
     ) {
@@ -29,11 +30,11 @@ function mostRecentCompletedTurnInHistory(
  * can't rank as freshly done while showing an age past the staleness threshold.
  *
  * A completion is only:
- *   - a non-interrupted `done` (its `stateStartedAt` — unmoved by same-state tool/prompt pings); or
+ *   - a `done` the user did not stop, failures included (its `stateStartedAt` — unmoved by same-state tool/prompt pings); or
  *   - for a session-boundary `done` (connected idle, not a turn), the real completion it displaced.
  */
 export function agentEntryCompletionAt(entry: AgentCompletionSource): number | null {
-  if (entry.state !== 'done' || entry.interrupted === true) {
+  if (entry.state !== 'done' || agentTurnStoppedByUser(entry)) {
     return null
   }
   if (entry.sessionBoundary === true) {
diff --git a/src/shared/agent-headless-command.ts b/src/shared/agent-headless-command.ts
index 3ce26e949c3..9f742a5355d 100644
--- a/src/shared/agent-headless-command.ts
+++ b/src/shared/agent-headless-command.ts
@@ -1,4 +1,7 @@
+import { isCodebuddyNonInteractiveCommand } from './codebuddy-headless-command'
+import { isQoderHeadlessCommand } from './qoder-headless-command'
 import { isAnteHeadlessOneShotCommand } from './ante-headless-command'
+import { isDshNonInteractiveCommand } from './dsh-launch-command'
 import { isMuseHeadlessOneShotCommand } from './muse-headless-command'
 import { isZCodeHeadlessOneShotCommand } from './zcode-headless-command'
 import { isPrimeAgentHeadlessOneShotCommand } from './prime-agent-headless-command'
@@ -8,16 +11,21 @@ import type { TuiAgent } from './tui-agent'
 // Why: a table (not an if-chain) so adding an agent is one entry; Claude and Trae share
 // the same `--print` one-shot contract, Ante's `--prompt` form, Prime Agent's
 // `--mode` forms, Muse's `exec` subcommand, and ZCode's `--prompt`/`--target` forms need
-// their own matchers.
+// their own matchers. DSH's entry is wider than a one-shot: `dsh` also boots a web server
+// and JSON-RPC stdio profiles, and none of those can answer a prompt in the pane either,
+// which is what this table gates.
 const HEADLESS_ONE_SHOT_MATCHERS: Partial<
   Record<TuiAgent, (tokens: readonly string[]) => boolean>
 > = {
+  qoder: isQoderHeadlessCommand,
   claude: isPrintModeHeadlessOneShotCommand,
+  codebuddy: isCodebuddyNonInteractiveCommand,
   trae: isPrintModeHeadlessOneShotCommand,
   'prime-agent': isPrimeAgentHeadlessOneShotCommand,
   ante: isAnteHeadlessOneShotCommand,
   muse: isMuseHeadlessOneShotCommand,
-  zcode: isZCodeHeadlessOneShotCommand
+  zcode: isZCodeHeadlessOneShotCommand,
+  dsh: isDshNonInteractiveCommand
 }
 
 export function isHeadlessOneShotAgentCommand(agent: TuiAgent, tokens: readonly string[]): boolean {
diff --git a/src/shared/agent-hook-listener-interactive-prompts.test.ts b/src/shared/agent-hook-listener-interactive-prompts.test.ts
index 214035ae575..ec8d7722c75 100644
--- a/src/shared/agent-hook-listener-interactive-prompts.test.ts
+++ b/src/shared/agent-hook-listener-interactive-prompts.test.ts
@@ -41,32 +41,34 @@ describe('shared agent-hook-listener', () => {
     expect(event!.payload.agentType).toBe('claude')
   })
 
-  it('normalizes a BOM-prefixed Cursor hook payload to a working state', () => {
-    const event = normalizeHookPayload(
-      state,
-      'cursor',
-      {
-        paneKey: PANE_KEY,
-        payload: '\uFEFF{"hook_event_name":"beforeSubmitPrompt","prompt":"Synthetic Cursor prompt"}'
-      },
-      'production'
-    )
+  it.each([0, 1, 2, 3])(
+    'normalizes %i leading Cursor BOMs to a working state (#21421)',
+    (count) => {
+      const event = normalizeHookPayload(
+        state,
+        'cursor',
+        {
+          paneKey: PANE_KEY,
+          payload: `${'\uFEFF'.repeat(count)}{"hook_event_name":"beforeSubmitPrompt","prompt":"Synthetic Cursor prompt"}`
+        },
+        'production'
+      )
 
-    expect(event?.payload).toMatchObject({
-      agentType: 'cursor',
-      state: 'working',
-      prompt: 'Synthetic Cursor prompt'
-    })
-    expect(event?.hookEventName).toBe('beforeSubmitPrompt')
-  })
+      expect(event?.payload).toMatchObject({
+        agentType: 'cursor',
+        state: 'working',
+        prompt: 'Synthetic Cursor prompt'
+      })
+      expect(event?.hookEventName).toBe('beforeSubmitPrompt')
+    }
+  )
 
-  // Why: pins the allowance to exactly one leading U+FEFF, so nobody widens it into a trim.
-  it('still rejects a hook payload that is malformed once the BOM is removed', () => {
+  // Only contiguous leading BOMs are transport framing; misplaced BOMs remain invalid JSON.
+  it('still rejects malformed JSON after leading BOMs are removed', () => {
     const bom = '\uFEFF'
     const body = '{"hook_event_name":"beforeSubmitPrompt"}'
     for (const payload of [
-      `${bom}${bom}${body}`,
-      `${bom}not json`,
+      `${bom}${bom}not json`,
       ` ${bom}${body}`,
       `{"hook_event_name"${bom}:"beforeSubmitPrompt"}`
     ]) {
diff --git a/src/shared/agent-hook-listener-transport.test.ts b/src/shared/agent-hook-listener-transport.test.ts
index cf0a801ede1..50a4df2860b 100644
--- a/src/shared/agent-hook-listener-transport.test.ts
+++ b/src/shared/agent-hook-listener-transport.test.ts
@@ -11,6 +11,7 @@ import {
 } from './agent-hook-listener/endpoint-publication'
 import {
   HOOK_REQUEST_MAX_BYTES,
+  parseAgentHookJson,
   parseFormEncodedBody,
   readRequestBody
 } from './agent-hook-listener/request-body'
@@ -161,12 +162,66 @@ describe('shared agent-hook-listener', () => {
     expectRequestParserListenersReleased(req)
   })
 
-  it('strips exactly one outer JSON BOM', async () => {
+  it.each([0, 1, 2, 3])(
+    'reads %i outer BOMs with every UTF-8 byte in a separate chunk',
+    async (count) => {
+      const req = createReadableRequest({ 'content-type': 'application/json' })
+      const body = readRequestBody(req as unknown as IncomingMessage)
+      const bytes = Buffer.concat([
+        ...Array.from({ length: count }, () => Buffer.from([0xef, 0xbb, 0xbf])),
+        Buffer.from('{"text":"café 日本語 😀"}')
+      ])
+      for (const byte of bytes) {
+        req.emit('data', Buffer.from([byte]))
+      }
+      req.emit('end')
+      await expect(body).resolves.toEqual({ text: 'café 日本語 😀' })
+      expectRequestParserListenersReleased(req)
+    }
+  )
+
+  it.each(['', '\uFEFF', '\uFEFF\uFEFF'])(
+    'preserves JSON whitespace and string BOMs after prefix %j',
+    (prefix) => {
+      expect(parseAgentHookJson(`${prefix} \r\n\t{"text":"a\uFEFFb"} \t\r\n`)).toEqual({
+        text: 'a\uFEFFb'
+      })
+    }
+  )
+
+  it.each([
+    '',
+    ' ',
+    '\uFEFF',
+    '\uFEFF\uFEFF',
+    '\uFEFF\uFEFFnot json',
+    ' \uFEFF{}',
+    '\uFEFF \uFEFF{}',
+    '{\uFEFF"ok":true}',
+    '{}\uFEFF',
+    '\uFEFF\uFEFF{"ok":}'
+  ])('rejects invalid JSON %j without trimming misplaced BOMs', (body) => {
+    expect(() => parseAgentHookJson(body)).toThrow()
+  })
+
+  it('keeps an empty HTTP body as an empty envelope', async () => {
     const req = createReadableRequest({ 'content-type': 'application/json' })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The existing request harness supplies the headers and stream events used by the reader.
     const body = readRequestBody(req as unknown as IncomingMessage)
-    req.emit('data', Buffer.concat([Buffer.from([0xef, 0xbb, 0xbf]), Buffer.from('{"ok":true}')]))
     req.emit('end')
-    await expect(body).resolves.toEqual({ ok: true })
+    await expect(body).resolves.toEqual({})
+    expectRequestParserListenersReleased(req)
+  })
+
+  it('counts BOM bytes toward the cap across incremental chunks', async () => {
+    const req = createReadableRequest({ 'content-type': 'application/json' })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The existing request harness supplies the headers and stream events used by the reader.
+    const body = readRequestBody(req as unknown as IncomingMessage)
+    req.emit('data', Buffer.from([0xef, 0xbb, 0xbf, 0xef, 0xbb, 0xbf]))
+    req.emit('data', Buffer.from(JSON.stringify({ x: 'a'.repeat(HOOK_REQUEST_MAX_BYTES - 8) })))
+    await expect(body).rejects.toThrow('payload too large')
+    expect(req.destroy).toHaveBeenCalledTimes(1)
+    expectRequestParserListenersReleased(req)
   })
 
   it('rejects JSON beyond the nesting-depth limit', async () => {
diff --git a/src/shared/agent-hook-listener/provider-dispatch.ts b/src/shared/agent-hook-listener/provider-dispatch.ts
index d3abd287e89..ab7e847c4ca 100644
--- a/src/shared/agent-hook-listener/provider-dispatch.ts
+++ b/src/shared/agent-hook-listener/provider-dispatch.ts
@@ -1,3 +1,5 @@
+import { normalizeCompatibleLifecycleEvent } from './providers/compatible-lifecycle-events'
+import { normalizeQoderEvent } from './providers/qoder-events'
 import type { ParsedAgentStatusPayload } from '../agent-status-types'
 import type { AgentHookSource } from '../agent-hook-relay'
 import { readLastCommandCodeUserPromptEntryFromTranscript } from './command-code-transcript'
@@ -23,6 +25,7 @@ import { normalizeHermesEvent } from './providers/hermes-events'
 import { normalizeDevinEvent } from './providers/devin-events'
 import { normalizeKimiEvent } from './providers/kimi-events'
 import { normalizeMuseEvent } from './providers/muse-events'
+import { normalizeDshEvent } from './providers/dsh-events'
 import { normalizeZCodeEvent } from './providers/zcode-events'
 
 export type ProviderDispatchResult = {
@@ -51,6 +54,16 @@ export function normalizeProviderEvent(input: {
   let payload: ParsedAgentStatusPayload | null
 
   switch (source) {
+    case 'codebuddy':
+      payload = normalizeCompatibleLifecycleEvent(
+        source,
+        state,
+        eventName,
+        promptText,
+        paneKey,
+        hookPayload
+      )
+      break
     case 'claude':
       payload = normalizeClaudeEvent(state, eventName, promptText, paneKey, hookPayload)
       break
@@ -148,12 +161,18 @@ export function normalizeProviderEvent(input: {
     case 'devin':
       payload = normalizeDevinEvent(state, eventName, promptText, paneKey, hookPayload)
       break
+    case 'qoder':
+      payload = normalizeQoderEvent(state, eventName, promptText, paneKey, hookPayload)
+      break
     case 'kimi':
       payload = normalizeKimiEvent(state, eventName, promptText, paneKey, hookPayload)
       break
     case 'muse':
       payload = normalizeMuseEvent(state, eventName, promptText, paneKey, hookPayload)
       break
+    case 'dsh':
+      payload = normalizeDshEvent(state, eventName, promptText, paneKey, hookPayload)
+      break
     case 'zcode':
       payload = normalizeZCodeEvent(state, eventName, promptText, paneKey, hookPayload)
       break
diff --git a/src/shared/agent-hook-listener/provider-event-routing.ts b/src/shared/agent-hook-listener/provider-event-routing.ts
index f9dc1e6d5d7..80cd0fdc91c 100644
--- a/src/shared/agent-hook-listener/provider-event-routing.ts
+++ b/src/shared/agent-hook-listener/provider-event-routing.ts
@@ -25,16 +25,22 @@ import { extractHermesToolFields } from './providers/hermes-tool-fields'
 export function isNewTurnEvent(source: AgentHookSource, eventName: unknown): boolean {
   // Why: exhaustive switch so a new AgentHookSource fails typecheck here instead of falling through to false.
   switch (source) {
+    case 'qoder':
     case 'claude':
       // Why: SessionStart lands an idle row (STA-3386) and must also drop stale
       // tool/prompt caches left by the pane's previous session.
       return eventName === 'SessionStart' || eventName === 'UserPromptSubmit'
+    case 'codebuddy':
     case 'kimi':
       // Why: Kimi Code emits Claude-compatible hook events, so UserPromptSubmit is its new-turn boundary too.
       return eventName === 'UserPromptSubmit'
     case 'muse':
       // Muse uses Claude-compatible lifecycle events.
       return eventName === 'UserPromptSubmit'
+    case 'dsh':
+      // Why: DSH's Claude-Code hook bridge fires SessionStart once per session before the
+      // first turn, which is the point stale tool/prompt caches from a reused pane must go.
+      return eventName === 'SessionStart' || eventName === 'UserPromptSubmit'
     case 'zcode':
       // Why: matches Codex/Claude — SessionStart lands an idle boundary row and drops stale
       // tool/prompt caches, while UserPromptSubmit is the actual turn boundary.
@@ -134,13 +140,18 @@ export function extractToolFields(
 ): ToolSnapshot {
   // Why: exhaustive switch so a new AgentHookSource fails typecheck here instead of silently routing through OpenCode's extractor.
   switch (source) {
+    case 'qoder':
     case 'claude':
     // Why: Kimi Code uses Claude's tool_name/tool_input payload fields verbatim.
     // falls through
+    case 'codebuddy':
     case 'kimi':
     // Muse uses Claude-compatible tool fields.
     // falls through
     case 'muse':
+    // DSH's own Claude-Code hook bridge emits Claude's tool_name/tool_input verbatim.
+    // falls through
+    case 'dsh':
     // Why: ZCode's hook runner writes Claude's `tool_name`/`tool_input`/`tool_response` aliases.
     // falls through
     case 'zcode':
diff --git a/src/shared/agent-hook-listener/providers/compatible-lifecycle-events.ts b/src/shared/agent-hook-listener/providers/compatible-lifecycle-events.ts
new file mode 100644
index 00000000000..2678dfc5e1e
--- /dev/null
+++ b/src/shared/agent-hook-listener/providers/compatible-lifecycle-events.ts
@@ -0,0 +1,104 @@
+import { isAskUserQuestionTool } from '../../agent-question-answered-intent'
+import {
+  normalizeAgentStatusPayload,
+  type ParsedAgentStatusPayload
+} from '../../agent-status-types'
+import type { HookListenerState } from '../listener-state'
+import {
+  resolvePrompt,
+  resolveToolState,
+  shouldIgnoreCompactContinuationUserPromptSubmit
+} from '../prompt-fields'
+import { extractToolFields, isNewTurnEvent } from '../provider-event-routing'
+import { readString } from '../tool-input-preview'
+
+function readCompatibleState(
+  eventName: unknown,
+  payload: Record<string, unknown>
+): 'working' | 'waiting' | 'done' | null {
+  switch (eventName) {
+    case 'SessionStart':
+      // Compaction restarts the session during an active turn.
+      return ['startup', 'resume', 'clear', 'new'].includes(String(payload.source)) ? 'done' : null
+    case 'UserPromptSubmit':
+    case 'PostToolUse':
+    case 'PostToolUseFailure':
+      return 'working'
+    case 'PreToolUse':
+      return isAskUserQuestionTool(readString(payload, 'tool_name')) ? 'waiting' : 'working'
+    case 'PermissionRequest':
+      return 'waiting'
+    case 'Stop':
+    case 'StopFailure':
+    case 'SessionEnd':
+      return 'done'
+    case 'PostCompact':
+      return payload.trigger === 'manual' ? 'done' : null
+    case 'Notification':
+      if (
+        payload.notification_type === 'permission_prompt' ||
+        payload.notification_type === 'elicitation_dialog'
+      ) {
+        return 'waiting'
+      }
+      return payload.notification_type === 'idle_prompt' ? 'done' : null
+    default:
+      return null
+  }
+}
+
+export function normalizeCompatibleLifecycleEvent(
+  source: 'qoder' | 'codebuddy',
+  state: HookListenerState,
+  eventName: unknown,
+  promptText: string,
+  paneKey: string,
+  hookPayload: Record<string, unknown>
+): ParsedAgentStatusPayload | null {
+  if (shouldIgnoreCompactContinuationUserPromptSubmit(eventName, promptText)) {
+    return null
+  }
+  // CodeBuddy emits SessionStart after UserPromptSubmit, so it cannot settle a turn.
+  if (source === 'codebuddy' && eventName === 'SessionStart') {
+    return null
+  }
+  const stateName =
+    source === 'codebuddy' && eventName === 'PreToolUse'
+      ? 'working'
+      : readCompatibleState(eventName, hookPayload)
+  if (!stateName) {
+    return null
+  }
+  const resetOnNewTurn = isNewTurnEvent(source, eventName)
+  const toolFields = extractToolFields(source, eventName, hookPayload)
+  if (
+    source === 'codebuddy' &&
+    eventName === 'Notification' &&
+    hookPayload.notification_type === 'permission_prompt' &&
+    hookPayload.message === 'needs your permission to use AskUserQuestion'
+  ) {
+    toolFields.toolName = 'AskUserQuestion'
+  }
+  const snapshot = resolveToolState(state, paneKey, toolFields, { resetOnNewTurn })
+  return normalizeAgentStatusPayload({
+    state: stateName,
+    agentType: source,
+    prompt: resolvePrompt(
+      state,
+      paneKey,
+      source === 'codebuddy' && eventName === 'Notification' ? '' : promptText,
+      { resetOnNewTurn }
+    ),
+    toolName: snapshot.toolName,
+    toolInput: snapshot.toolInput,
+    interactivePrompt: snapshot.interactivePrompt,
+    lastAssistantMessage: snapshot.lastAssistantMessage,
+    lastAssistantMessageIsToolOutput: snapshot.lastAssistantMessageIsToolOutput,
+    sessionBoundary: eventName === 'SessionStart' || eventName === 'PostCompact' ? true : undefined,
+    interrupted: eventName === 'Stop' && hookPayload.is_interrupt === true ? true : undefined,
+    mainAgent:
+      eventName === 'StopFailure'
+        ? { state: 'done', outcome: 'failure', stateStartedAt: Date.now() }
+        : undefined
+  })
+}
diff --git a/src/shared/agent-hook-listener/providers/dsh-events.test.ts b/src/shared/agent-hook-listener/providers/dsh-events.test.ts
new file mode 100644
index 00000000000..b552018845d
--- /dev/null
+++ b/src/shared/agent-hook-listener/providers/dsh-events.test.ts
@@ -0,0 +1,122 @@
+import { beforeEach, describe, expect, it } from 'vitest'
+import { createHookListenerState, type HookListenerState } from '../listener-state'
+import { normalizeAndAccept } from '../../agent-hook-listener-test-harness'
+
+// Payload shape copied from a live run of @deepseek-ai/dsh-hooks-claude-code 0.1.5-rc.3
+// mounted through $DSH_HOME/cordis.patch.yml: `session_id`, an always-empty
+// `transcript_path`, `cwd`, `hook_event_name`, plus the per-event fields.
+const SESSION_ID = '9478e2d8-29bc-4009-ab32-657efa2bd763'
+const CHILD_SESSION_ID = 'b1c4fb80-4f12-4a6f-9a68-7c0d5f0f5a12'
+
+const base = { transcript_path: '', cwd: '/tmp/ws', session_id: SESSION_ID }
+
+function event(name: string, extra: Record<string, unknown> = {}): Record<string, unknown> {
+  return { ...base, hook_event_name: name, ...extra }
+}
+
+describe('normalizeDshEvent', () => {
+  let state: HookListenerState
+
+  beforeEach(() => {
+    state = createHookListenerState()
+  })
+
+  it('reports a prompt as working and a stop as done', () => {
+    const submitted = normalizeAndAccept(
+      state,
+      'dsh',
+      event('UserPromptSubmit', { prompt: 'fix the flaky test' })
+    )
+    expect(submitted?.payload.state).toBe('working')
+    expect(submitted?.payload.agentType).toBe('dsh')
+    expect(submitted?.payload.prompt).toBe('fix the flaky test')
+
+    const stopped = normalizeAndAccept(state, 'dsh', event('Stop', { stop_hook_active: false }))
+    expect(stopped?.payload.state).toBe('done')
+    // The prompt is carried across the turn so a finished row still names the work.
+    expect(stopped?.payload.prompt).toBe('fix the flaky test')
+  })
+
+  it('lands an idle row on SessionStart', () => {
+    const started = normalizeAndAccept(state, 'dsh', event('SessionStart', { source: 'startup' }))
+    expect(started?.payload.state).toBe('done')
+    expect(started?.payload.agentType).toBe('dsh')
+  })
+
+  it('treats an ordinary tool as working and surfaces its name', () => {
+    normalizeAndAccept(state, 'dsh', event('UserPromptSubmit', { prompt: 'read the readme' }))
+    const pre = normalizeAndAccept(
+      state,
+      'dsh',
+      event('PreToolUse', {
+        tool_name: 'read',
+        tool_input: { path: 'README.md' },
+        tool_use_id: 'call-1'
+      })
+    )
+    expect(pre?.payload.state).toBe('working')
+    expect(pre?.payload.toolName).toBe('read')
+  })
+
+  it('reports ask_user_question as waiting and its answer as working again', () => {
+    normalizeAndAccept(state, 'dsh', event('UserPromptSubmit', { prompt: 'pick a colour' }))
+    const asked = normalizeAndAccept(
+      state,
+      'dsh',
+      event('PreToolUse', {
+        tool_name: 'ask_user_question',
+        tool_input: {
+          questions: [{ header: 'Colour', question: 'Which one?', options: [{ label: 'Blue' }] }]
+        },
+        tool_use_id: 'call-2'
+      })
+    )
+    // Why this matters: DSH's bridge has no Notification/PermissionRequest event, so the
+    // ask-the-user tool is the only structured signal that a pane needs the user.
+    expect(asked?.payload.state).toBe('waiting')
+    expect(asked?.payload.interactivePrompt).toContain('Which one?')
+
+    const answered = normalizeAndAccept(
+      state,
+      'dsh',
+      event('PostToolUse', {
+        tool_name: 'ask_user_question',
+        tool_use_id: 'call-2',
+        tool_response: 'Blue'
+      })
+    )
+    expect(answered?.payload.state).toBe('working')
+  })
+
+  it('ignores subagent lifecycle events', () => {
+    normalizeAndAccept(state, 'dsh', event('UserPromptSubmit', { prompt: 'delegate this' }))
+    const done = normalizeAndAccept(state, 'dsh', event('Stop', {}))
+    expect(done?.payload.state).toBe('done')
+
+    // The bridge stamps the CHILD's session id and a constant `general-purpose` agent_type
+    // on both subagent events, so a child that outlives the lead's Stop would otherwise
+    // flip the finished pane back to working (the Muse regression in #22216).
+    for (const name of ['SubagentStart', 'SubagentStop']) {
+      expect(
+        normalizeAndAccept(state, 'dsh', {
+          ...base,
+          session_id: CHILD_SESSION_ID,
+          hook_event_name: name,
+          agent_id: 'agent-7',
+          agent_type: 'general-purpose'
+        })
+      ).toBeNull()
+    }
+  })
+
+  it('ignores events the bridge cannot send', () => {
+    // Notification and PermissionRequest are Claude-only; if one ever arrives it is not
+    // from this bridge, and guessing a state from it would be unfounded.
+    expect(
+      normalizeAndAccept(state, 'dsh', event('Notification', { message: 'waiting' }))
+    ).toBeNull()
+    expect(
+      normalizeAndAccept(state, 'dsh', event('PermissionRequest', { tool_name: 'bash' }))
+    ).toBeNull()
+  })
+})
diff --git a/src/shared/agent-hook-listener/providers/dsh-events.ts b/src/shared/agent-hook-listener/providers/dsh-events.ts
new file mode 100644
index 00000000000..670cba55c17
--- /dev/null
+++ b/src/shared/agent-hook-listener/providers/dsh-events.ts
@@ -0,0 +1,84 @@
+import { isAskUserQuestionTool } from '../../agent-question-answered-intent'
+import {
+  normalizeAgentStatusPayload,
+  type ParsedAgentStatusPayload
+} from '../../agent-status-types'
+import type { HookListenerState } from '../listener-state'
+import {
+  resolvePrompt,
+  resolveToolState,
+  shouldIgnoreCompactContinuationUserPromptSubmit
+} from '../prompt-fields'
+import { extractToolFields, isNewTurnEvent } from '../provider-event-routing'
+import { readString } from '../tool-input-preview'
+
+/**
+ * DeepSeek Harness reaches Orca through its own `@deepseek-ai/dsh-hooks-claude-code`
+ * bridge, so the payloads are Claude-shaped (`session_id`, `tool_name`, `tool_input`,
+ * `tool_use_id`, `prompt`) and the event names are a strict subset of Claude's:
+ * SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, Stop, SubagentStart and
+ * SubagentStop. There is no Notification and no PermissionRequest.
+ *
+ * That missing pair is why the waiting state is read from the tool instead: DSH asks the
+ * user through `ask_user_question` (`@deepseek-ai/dsh-tool-ask-user`), whose PreToolUse
+ * fires while the question card owns the screen and whose PostToolUse only lands once the
+ * user answers. An approval pause has no hook of its own and reads as `working`, which is
+ * the honest answer — the harness is mid-tool, not idle.
+ */
+export function normalizeDshEvent(
+  state: HookListenerState,
+  eventName: unknown,
+  promptText: string,
+  paneKey: string,
+  hookPayload: Record<string, unknown>
+): ParsedAgentStatusPayload | null {
+  if (shouldIgnoreCompactContinuationUserPromptSubmit(eventName, promptText)) {
+    return null
+  }
+
+  // Why: the bridge stamps the *child's* session id on both subagent events and labels
+  // every child `general-purpose`, so a child turn cannot be told from the lead's. Muse
+  // (#22216) showed what that costs: child hooks flip a finished pane back to working.
+  if (eventName === 'SubagentStart' || eventName === 'SubagentStop') {
+    return null
+  }
+
+  const toolName = readString(hookPayload, 'tool_name')
+
+  let stateName: 'working' | 'waiting' | 'done'
+  switch (eventName) {
+    case 'UserPromptSubmit':
+    case 'PostToolUse':
+      stateName = 'working'
+      break
+    case 'PreToolUse':
+      stateName = isAskUserQuestionTool(toolName) ? 'waiting' : 'working'
+      break
+    case 'SessionStart':
+    case 'Stop':
+      stateName = 'done'
+      break
+    default:
+      return null
+  }
+
+  const snapshot = resolveToolState(
+    state,
+    paneKey,
+    extractToolFields('dsh', eventName, hookPayload),
+    { resetOnNewTurn: isNewTurnEvent('dsh', eventName) }
+  )
+
+  return normalizeAgentStatusPayload({
+    state: stateName,
+    prompt: resolvePrompt(state, paneKey, promptText, {
+      resetOnNewTurn: isNewTurnEvent('dsh', eventName)
+    }),
+    agentType: 'dsh',
+    toolName: snapshot.toolName,
+    toolInput: snapshot.toolInput,
+    interactivePrompt: snapshot.interactivePrompt,
+    lastAssistantMessage: snapshot.lastAssistantMessage,
+    lastAssistantMessageIsToolOutput: snapshot.lastAssistantMessageIsToolOutput
+  })
+}
diff --git a/src/shared/agent-hook-listener/providers/qoder-events.ts b/src/shared/agent-hook-listener/providers/qoder-events.ts
new file mode 100644
index 00000000000..c83923d58f7
--- /dev/null
+++ b/src/shared/agent-hook-listener/providers/qoder-events.ts
@@ -0,0 +1,19 @@
+import { normalizeCompatibleLifecycleEvent } from './compatible-lifecycle-events'
+import type { HookListenerState } from '../listener-state'
+
+export function normalizeQoderEvent(
+  state: HookListenerState,
+  eventName: unknown,
+  promptText: string,
+  paneKey: string,
+  hookPayload: Record<string, unknown>
+) {
+  return normalizeCompatibleLifecycleEvent(
+    'qoder',
+    state,
+    eventName,
+    promptText,
+    paneKey,
+    hookPayload
+  )
+}
diff --git a/src/shared/agent-hook-listener/request-body.ts b/src/shared/agent-hook-listener/request-body.ts
index b453c7c1f7e..88f01252783 100644
--- a/src/shared/agent-hook-listener/request-body.ts
+++ b/src/shared/agent-hook-listener/request-body.ts
@@ -12,10 +12,12 @@ const AGENT_HOOK_JSON_STRUCTURE_LIMITS = {
 } as const
 
 export function parseAgentHookJson(content: string): unknown {
-  // Why: Cursor on Windows writes UTF-8-with-BOM to the hook's stdin and `JSON.parse` rejects U+FEFF,
-  // so the whole event was dropped. Strip exactly one leading BOM — not a trim — to keep every other
-  // malformed payload rejected as before.
-  const normalizedContent = content.charCodeAt(0) === 0xfeff ? content.slice(1) : content
+  // Cursor on Windows can pipe duplicated BOMs before the JSON (#21421).
+  let offset = 0
+  while (offset < content.length && content.charCodeAt(offset) === 0xfeff) {
+    offset += 1
+  }
+  const normalizedContent = offset > 0 ? content.slice(offset) : content
   assertJsonTextStructureWithinLimits(normalizedContent, AGENT_HOOK_JSON_STRUCTURE_LIMITS)
   return JSON.parse(normalizedContent) as unknown
 }
diff --git a/src/shared/agent-hook-listener/source-routing.ts b/src/shared/agent-hook-listener/source-routing.ts
index e84313b0c26..2940685665c 100644
--- a/src/shared/agent-hook-listener/source-routing.ts
+++ b/src/shared/agent-hook-listener/source-routing.ts
@@ -5,6 +5,8 @@ import type { AgentHookSource } from '../agent-hook-relay'
 export const HOOK_SOURCE_BY_PATHNAME: Readonly<Record<string, AgentHookSource>> = Object.freeze({
   '/hook/claude': 'claude',
   '/hook/codex': 'codex',
+  '/hook/qoder': 'qoder',
+  '/hook/codebuddy': 'codebuddy',
   '/hook/gemini': 'gemini',
   '/hook/antigravity': 'antigravity',
   '/hook/amp': 'amp',
@@ -23,7 +25,8 @@ export const HOOK_SOURCE_BY_PATHNAME: Readonly<Record<string, AgentHookSource>>
   '/hook/devin': 'devin',
   '/hook/kimi': 'kimi',
   '/hook/muse': 'muse',
-  '/hook/zcode': 'zcode'
+  '/hook/zcode': 'zcode',
+  '/hook/dsh': 'dsh'
 })
 
 export function resolveHookSource(pathname: string): AgentHookSource | null {
diff --git a/src/shared/agent-hook-relay.ts b/src/shared/agent-hook-relay.ts
index cc5d21ba8f7..bb2dca99f72 100644
--- a/src/shared/agent-hook-relay.ts
+++ b/src/shared/agent-hook-relay.ts
@@ -37,6 +37,8 @@ import type { AgentHookTarget } from './agent-hook-types'
 const AGENT_HOOK_SOURCES = [
   'claude',
   'codex',
+  'qoder',
+  'codebuddy',
   'gemini',
   'antigravity',
   'amp',
@@ -55,7 +57,8 @@ const AGENT_HOOK_SOURCES = [
   'devin',
   'kimi',
   'muse',
-  'zcode'
+  'zcode',
+  'dsh'
 ] as const
 
 export type AgentHookSource = (typeof AGENT_HOOK_SOURCES)[number]
diff --git a/src/shared/agent-hook-scrub-safe-env.test.ts b/src/shared/agent-hook-scrub-safe-env.test.ts
new file mode 100644
index 00000000000..42368b03b19
--- /dev/null
+++ b/src/shared/agent-hook-scrub-safe-env.test.ts
@@ -0,0 +1,59 @@
+import { describe, expect, it } from 'vitest'
+import {
+  applyScrubSafeAgentEnvAliases,
+  ORCA_SCRUB_SAFE_LAUNCH_ENV,
+  ORCA_SCRUB_SAFE_PANE_ENV
+} from './agent-hook-scrub-safe-env'
+
+/** The rule DeepSeek Harness's shell executor applies, measured against dsh 0.1.5-rc.1. */
+function isScrubbedName(name: string): boolean {
+  return /KEY|TOKEN|SECRET|PASSWORD/.test(name)
+}
+
+describe('applyScrubSafeAgentEnvAliases', () => {
+  it('mirrors pane identity onto names a credential scrub keeps', () => {
+    const env: Record<string, string> = {
+      ORCA_PANE_KEY: 'tab-1:11111111-1111-4111-8111-111111111111',
+      ORCA_AGENT_LAUNCH_TOKEN: 'launch-abc'
+    }
+    applyScrubSafeAgentEnvAliases(env)
+    expect(env[ORCA_SCRUB_SAFE_PANE_ENV]).toBe(env.ORCA_PANE_KEY)
+    expect(env[ORCA_SCRUB_SAFE_LAUNCH_ENV]).toBe(env.ORCA_AGENT_LAUNCH_TOKEN)
+  })
+
+  it('picks alias names the scrub does not take', () => {
+    // The whole point: if an alias were itself scrubbed it would carry nothing.
+    expect(isScrubbedName(ORCA_SCRUB_SAFE_PANE_ENV)).toBe(false)
+    expect(isScrubbedName(ORCA_SCRUB_SAFE_LAUNCH_ENV)).toBe(false)
+    expect(isScrubbedName('ORCA_PANE_KEY')).toBe(true)
+    expect(isScrubbedName('ORCA_AGENT_LAUNCH_TOKEN')).toBe(true)
+  })
+
+  it('leaves the canonical names untouched', () => {
+    const env: Record<string, string> = { ORCA_PANE_KEY: 'pane', ORCA_AGENT_LAUNCH_TOKEN: 'tok' }
+    applyScrubSafeAgentEnvAliases(env)
+    expect(env.ORCA_PANE_KEY).toBe('pane')
+    expect(env.ORCA_AGENT_LAUNCH_TOKEN).toBe('tok')
+  })
+
+  it('drops a stale alias when its source is gone', () => {
+    // Why this matters: an alias inherited from a parent pane would attribute this pane's
+    // hooks to the wrong row — worse than reporting no status at all.
+    const env: Record<string, string> = {
+      [ORCA_SCRUB_SAFE_PANE_ENV]: 'inherited-pane',
+      [ORCA_SCRUB_SAFE_LAUNCH_ENV]: 'inherited-launch'
+    }
+    applyScrubSafeAgentEnvAliases(env)
+    expect(env[ORCA_SCRUB_SAFE_PANE_ENV]).toBeUndefined()
+    expect(env[ORCA_SCRUB_SAFE_LAUNCH_ENV]).toBeUndefined()
+  })
+
+  it('treats an empty source as absent', () => {
+    const env: Record<string, string> = {
+      ORCA_PANE_KEY: '',
+      [ORCA_SCRUB_SAFE_PANE_ENV]: 'stale'
+    }
+    applyScrubSafeAgentEnvAliases(env)
+    expect(env[ORCA_SCRUB_SAFE_PANE_ENV]).toBeUndefined()
+  })
+})
diff --git a/src/shared/agent-hook-scrub-safe-env.ts b/src/shared/agent-hook-scrub-safe-env.ts
new file mode 100644
index 00000000000..e83895e2a30
--- /dev/null
+++ b/src/shared/agent-hook-scrub-safe-env.ts
@@ -0,0 +1,49 @@
+/**
+ * Scrub-safe aliases for the two pane-identity env vars whose NAMES some agent harnesses
+ * refuse to pass through to a hook process.
+ *
+ * DeepSeek Harness runs command hooks through its own shell executor, which drops every
+ * variable whose name contains `KEY`, `TOKEN`, `SECRET` or `PASSWORD` before the hook
+ * process starts. That is a reasonable credential-scrub default, and it is not something
+ * Orca can turn off — but it takes `ORCA_PANE_KEY` and `ORCA_AGENT_LAUNCH_TOKEN` with it,
+ * which are the two values a status hook needs to say *which pane* it is reporting for.
+ * Without them the hook has nothing to attribute to and exits without posting, so the pane
+ * reads as an agent Orca never hears from.
+ *
+ * Verified against `@deepseek-ai/dsh` 0.1.5-rc.1 by running a probe hook that printed its
+ * own environment: `PROBE_PLAIN`, `PROBE_AUTH`, `PROBE_CREDENTIAL`, `PROBE_HOOK_PORT` and
+ * `PROBE_PANE_ID` arrive; `PROBE_KEY`, `PROBE_TOKEN`, `PROBE_SECRET`, `PROBE_PASSWORD` and
+ * `PROBE_PANE_KEY` do not.
+ *
+ * These are aliases, never replacements: the canonical names stay exactly as they are, so
+ * every existing agent, script and test keeps reading what it reads today.
+ */
+
+/** Alias for `ORCA_PANE_KEY`. */
+export const ORCA_SCRUB_SAFE_PANE_ENV = 'ORCA_AGENT_PANE' as const
+
+/** Alias for `ORCA_AGENT_LAUNCH_TOKEN`. */
+export const ORCA_SCRUB_SAFE_LAUNCH_ENV = 'ORCA_AGENT_LAUNCH' as const
+
+const ALIASES: readonly (readonly [source: string, alias: string])[] = [
+  ['ORCA_PANE_KEY', ORCA_SCRUB_SAFE_PANE_ENV],
+  ['ORCA_AGENT_LAUNCH_TOKEN', ORCA_SCRUB_SAFE_LAUNCH_ENV]
+]
+
+/**
+ * Mirror pane identity onto its scrub-safe aliases, in place.
+ *
+ * An alias is written only when its source is present, and dropped when the source is
+ * absent — a stale alias inherited from a parent pane would attribute this pane's hooks to
+ * the wrong row, which is worse than no status at all.
+ */
+export function applyScrubSafeAgentEnvAliases(env: Record<string, string>): void {
+  for (const [source, alias] of ALIASES) {
+    const value = env[source]
+    if (value === undefined || value === '') {
+      delete env[alias]
+      continue
+    }
+    env[alias] = value
+  }
+}
diff --git a/src/shared/agent-hook-types.ts b/src/shared/agent-hook-types.ts
index a006c2cc37d..0bc5b67bc28 100644
--- a/src/shared/agent-hook-types.ts
+++ b/src/shared/agent-hook-types.ts
@@ -7,6 +7,8 @@ export const AGENT_HOOK_TARGETS = [
   'claude',
   'openclaude',
   'codex',
+  'qoder',
+  'codebuddy',
   'gemini',
   'antigravity',
   'amp',
@@ -19,7 +21,8 @@ export const AGENT_HOOK_TARGETS = [
   'devin',
   'kimi',
   'muse',
-  'zcode'
+  'zcode',
+  'dsh'
 ] as const
 export type AgentHookTarget = (typeof AGENT_HOOK_TARGETS)[number]
 
diff --git a/src/shared/agent-icons/codebuddy.png b/src/shared/agent-icons/codebuddy.png
new file mode 100644
index 00000000000..ecaab1216f4
Binary files /dev/null and b/src/shared/agent-icons/codebuddy.png differ
diff --git a/src/shared/agent-icons/dsh.png b/src/shared/agent-icons/dsh.png
new file mode 100644
index 00000000000..b5835f8f61f
Binary files /dev/null and b/src/shared/agent-icons/dsh.png differ
diff --git a/src/shared/agent-icons/freebuff.png b/src/shared/agent-icons/freebuff.png
new file mode 100644
index 00000000000..acb0e0aadde
Binary files /dev/null and b/src/shared/agent-icons/freebuff.png differ
diff --git a/src/shared/agent-icons/qoder.png b/src/shared/agent-icons/qoder.png
new file mode 100644
index 00000000000..42c952ed33a
Binary files /dev/null and b/src/shared/agent-icons/qoder.png differ
diff --git a/src/shared/agent-kind.ts b/src/shared/agent-kind.ts
index 06fa51ab76c..3fb112e6114 100644
--- a/src/shared/agent-kind.ts
+++ b/src/shared/agent-kind.ts
@@ -16,6 +16,7 @@ type ConcreteAgentKind = Exclude<AgentKind, 'other'>
 const TUI_AGENT_KIND_BY_AGENT = {
   claude: 'claude-code',
   'claude-agent-teams': 'claude-agent-teams',
+  codebuddy: 'codebuddy',
   openclaude: 'openclaude',
   codex: 'codex',
   autohand: 'autohand',
@@ -25,6 +26,7 @@ const TUI_AGENT_KIND_BY_AGENT = {
   pi: 'pi',
   omp: 'omp',
   'prime-agent': 'prime-agent',
+  qoder: 'qoder',
   gemini: 'gemini',
   antigravity: 'antigravity',
   aider: 'aider',
@@ -36,6 +38,7 @@ const TUI_AGENT_KIND_BY_AGENT = {
   aug: 'aug',
   cline: 'cline',
   codebuff: 'codebuff',
+  freebuff: 'freebuff',
   'command-code': 'command-code',
   continue: 'continue',
   cursor: 'cursor',
@@ -52,7 +55,8 @@ const TUI_AGENT_KIND_BY_AGENT = {
   ante: 'ante',
   trae: 'trae',
   muse: 'muse',
-  zcode: 'zcode'
+  zcode: 'zcode',
+  dsh: 'dsh'
 } satisfies Record<TuiAgent, ConcreteAgentKind>
 
 // Why: `satisfies Record<TuiAgent, …>` makes the lookup exhaustive at compile
diff --git a/src/shared/agent-launch-intent.ts b/src/shared/agent-launch-intent.ts
index 7e68340fdba..bffb93c1b9a 100644
--- a/src/shared/agent-launch-intent.ts
+++ b/src/shared/agent-launch-intent.ts
@@ -105,7 +105,7 @@ export type AgentLaunchOutcome =
       sessionId: string
       handle: string
       /** The host-owned id of the tab that shows this chat: the tab half of the reserved `paneKey`
-       *  when one was sent, else the one the host recorded. Identity, not placement, like the
+       *  when one was sent, else the one the host gave its tab. Identity, not placement, like the
        *  terminal arm's `paneKey`. Absent from hosts that predate it. */
       tabId?: string
     }
@@ -305,7 +305,9 @@ export const AGENT_LAUNCH_RESERVED_CREATE_FIELDS = [
   'startupDraft',
   'startupLaunchConfig',
   'startupEnv',
-  'startupCommandDelivery'
+  'startupCommandDelivery',
+  // The launch carries its own; a create's copy would be a second, possibly contradicting, answer.
+  'launchSource'
 ] as const
 
 /** Strips the reserved agent fields from a create payload. Callers migrating from
diff --git a/src/shared/agent-main-agent-verdict.test.ts b/src/shared/agent-main-agent-verdict.test.ts
new file mode 100644
index 00000000000..b41d44af4ab
--- /dev/null
+++ b/src/shared/agent-main-agent-verdict.test.ts
@@ -0,0 +1,124 @@
+import { describe, expect, it } from 'vitest'
+import {
+  agentMainAgentVerdict,
+  agentTurnEndedUncleanly,
+  agentTurnStoppedByUser,
+  agentVerdictDisplayMark,
+  agentVerdictFields,
+  type AgentMainAgentVerdictSource
+} from './agent-main-agent-verdict'
+import type { AgentStatusState } from './agent-status-types'
+import { AGENT_JOURNAL_TURN_OUTCOMES, type AgentJournalTurnOutcome } from './agent-turn-outcome'
+
+const STATES: AgentStatusState[] = ['working', 'blocked', 'waiting', 'done']
+const OUTCOMES: (AgentJournalTurnOutcome | undefined)[] = [
+  undefined,
+  ...AGENT_JOURNAL_TURN_OUTCOMES
+]
+
+// The rule as the plan states it: the main agent's own state decides when a row carries it; a row
+// without it (a legacy or old-host row) reads the legacy flag, which alone needs the combined `done`.
+function expected(row: AgentMainAgentVerdictSource): AgentJournalTurnOutcome | null {
+  const legacyFlag = row.state === 'done' && row.interrupted === true ? 'cancellation' : null
+  if (row.mainAgent) {
+    return row.mainAgent.state === 'done' ? (row.mainAgent.outcome ?? legacyFlag) : null
+  }
+  return legacyFlag
+}
+
+const MAIN_AGENTS: (AgentMainAgentVerdictSource['mainAgent'] | undefined)[] = [
+  undefined,
+  ...STATES.flatMap((state) =>
+    OUTCOMES.map((outcome) => ({ state, ...(outcome ? { outcome } : {}) }))
+  )
+]
+
+const PRODUCT: AgentMainAgentVerdictSource[] = STATES.flatMap((state) =>
+  MAIN_AGENTS.flatMap((mainAgent) =>
+    [undefined, false, true].map((interrupted) => ({
+      state,
+      ...(interrupted !== undefined ? { interrupted } : {}),
+      ...(mainAgent ? { mainAgent } : {})
+    }))
+  )
+)
+
+describe('agentMainAgentVerdict', () => {
+  it('decodes the one verdict over (main agent present/absent) x combined state x outcomes x flag', () => {
+    for (const row of PRODUCT) {
+      const verdict = expected(row)
+      const label = JSON.stringify(row)
+      expect(agentMainAgentVerdict(row), label).toBe(verdict)
+      expect(agentTurnEndedUncleanly(row), label).toBe(
+        verdict === 'cancellation' || verdict === 'failure'
+      )
+      expect(agentTurnStoppedByUser(row), label).toBe(verdict === 'cancellation')
+      expect(agentVerdictDisplayMark(row), label).toBe(
+        verdict === 'failure'
+          ? 'failed'
+          : verdict === 'cancellation' && row.state === 'done'
+            ? 'interrupted'
+            : null
+      )
+    }
+  })
+
+  it('reads a main agent that failed while its subagent still works as failed', () => {
+    const row = {
+      state: 'working' as const,
+      mainAgent: { state: 'done' as const, outcome: 'failure' as const }
+    }
+    expect(agentMainAgentVerdict(row)).toBe('failure')
+    expect(agentVerdictDisplayMark(row)).toBe('failed')
+  })
+
+  it('keeps a success or a stop with live subagent work reading working', () => {
+    for (const outcome of ['success', 'cancellation'] as const) {
+      const row = { state: 'working' as const, mainAgent: { state: 'done' as const, outcome } }
+      expect(agentVerdictDisplayMark(row)).toBeNull()
+    }
+  })
+
+  it('has no verdict while the main agent itself is not done, whatever the combined row says', () => {
+    const row = {
+      state: 'done' as const,
+      interrupted: true,
+      mainAgent: { state: 'working' as const }
+    }
+    expect(agentMainAgentVerdict(row)).toBeNull()
+  })
+
+  it('reads the legacy flag only on a done row, and under a done main agent with no outcome', () => {
+    expect(agentMainAgentVerdict({ state: 'working', interrupted: true })).toBeNull()
+    expect(
+      agentMainAgentVerdict({ state: 'done', interrupted: true, mainAgent: { state: 'done' } })
+    ).toBe('cancellation')
+    expect(agentMainAgentVerdict({ state: 'done', interrupted: true })).toBe('cancellation')
+  })
+
+  it('prefers the recorded verdict over the legacy flag', () => {
+    expect(
+      agentMainAgentVerdict({
+        state: 'done',
+        interrupted: true,
+        mainAgent: { state: 'done', outcome: 'failure' }
+      })
+    ).toBe('failure')
+  })
+})
+
+describe('agentVerdictFields', () => {
+  const mainAgent = { state: 'done' as const, outcome: 'failure' as const, stateStartedAt: 7 }
+
+  it('copies the whole main agent status and a true legacy flag together', () => {
+    expect(agentVerdictFields({ interrupted: true, mainAgent })).toEqual({
+      interrupted: true,
+      mainAgent
+    })
+  })
+
+  it('copies nothing a row does not carry, and never a false flag', () => {
+    expect(agentVerdictFields({ interrupted: false })).toEqual({})
+    expect(agentVerdictFields({})).toEqual({})
+  })
+})
diff --git a/src/shared/agent-main-agent-verdict.ts b/src/shared/agent-main-agent-verdict.ts
new file mode 100644
index 00000000000..f9754cf0c38
--- /dev/null
+++ b/src/shared/agent-main-agent-verdict.ts
@@ -0,0 +1,75 @@
+import type { AgentJournalTurnOutcome } from './agent-turn-outcome'
+import type { AgentStatusState } from './agent-status-types'
+import type { AgentMainAgentStatus } from './main-agent-status'
+
+export type AgentMainAgentVerdictSource = {
+  state: AgentStatusState
+  interrupted?: boolean
+  mainAgent?: { state: AgentStatusState; outcome?: AgentJournalTurnOutcome }
+}
+
+/** The fields that carry the verdict. History entries, sleep records and `worktree ps` rows copy
+ *  them through {@link agentVerdictFields}, so no copy keeps one form and drops the other. */
+export type AgentVerdictFields = {
+  interrupted?: true
+  mainAgent?: AgentMainAgentStatus
+}
+
+/** The verdict-bearing fields to copy from a row onto another record. */
+export function agentVerdictFields(row: {
+  interrupted?: boolean
+  mainAgent?: AgentMainAgentStatus
+}): AgentVerdictFields {
+  return {
+    ...(row.interrupted === true ? { interrupted: true } : {}),
+    ...(row.mainAgent ? { mainAgent: row.mainAgent } : {})
+  }
+}
+
+/**
+ * The recorded verdict on the main agent's latest finished turn. One fact at two fidelities:
+ * `mainAgent.outcome`, and the legacy `interrupted` flag, which only ever meant a cancellation.
+ * Read from the main agent's own state, not the combined row's: a main agent that failed while its
+ * subagents still work has a verdict. Null while the main agent is not done, and when no verdict
+ * was recorded. Only the legacy flag needs the combined `done`, because a row without `mainAgent`
+ * has nothing else that says the main agent itself finished.
+ */
+export function agentMainAgentVerdict(
+  row: AgentMainAgentVerdictSource
+): AgentJournalTurnOutcome | null {
+  if (row.mainAgent && row.mainAgent.state !== 'done') {
+    return null
+  }
+  return (
+    row.mainAgent?.outcome ??
+    (row.state === 'done' && row.interrupted === true ? 'cancellation' : null)
+  )
+}
+
+/**
+ * What the verdict marks on the agent's own display. A failure outranks every combined state: it
+ * is news the user must see even while subagents still run. A stop marks only a row that is itself
+ * done, so a stopped main agent's live child work still reads working, as a clean finish does.
+ */
+export function agentVerdictDisplayMark(
+  row: AgentMainAgentVerdictSource
+): 'failed' | 'interrupted' | null {
+  const verdict = agentMainAgentVerdict(row)
+  if (verdict === 'failure') {
+    return 'failed'
+  }
+  return verdict === 'cancellation' && row.state === 'done' ? 'interrupted' : null
+}
+
+/** The turn ended without finishing its work: stopped, or failed. Clean-finish policy
+ *  (hibernation, pane ownership, the value moment) treats both alike. */
+export function agentTurnEndedUncleanly(row: AgentMainAgentVerdictSource): boolean {
+  const verdict = agentMainAgentVerdict(row)
+  return verdict === 'cancellation' || verdict === 'failure'
+}
+
+/** The user stopped the turn. Attention (completion time, Smart Sort, sticky retention) demotes
+ *  only this: a failure is news the user has not seen, so it ranks like a completion. */
+export function agentTurnStoppedByUser(row: AgentMainAgentVerdictSource): boolean {
+  return agentMainAgentVerdict(row) === 'cancellation'
+}
diff --git a/src/shared/agent-node-entrypoint-identities.ts b/src/shared/agent-node-entrypoint-identities.ts
index e71118312d0..fb4327c076f 100644
--- a/src/shared/agent-node-entrypoint-identities.ts
+++ b/src/shared/agent-node-entrypoint-identities.ts
@@ -26,5 +26,13 @@ export const EXACT_NODE_ENTRYPOINT_IDENTITIES: readonly {
     pattern: /(?:^|\/)node_modules\/prime-agent\/dist\/bundle\/cli\.js$/,
     agent: 'prime-agent',
     processName: 'prime-agent'
+  },
+  // Why: DSH's npm shim launches a generic `lib/bin.js`, and the launcher re-execs it
+  // directly on Windows, so only the package path identifies it. The profile still decides
+  // whether the pane is the agent — `dsh web` resolves here too and is filtered after.
+  {
+    pattern: /(?:^|\/)node_modules\/@deepseek-ai\/dsh\/lib\/bin\.js$/,
+    agent: 'dsh',
+    processName: 'dsh'
   }
 ]
diff --git a/src/shared/agent-node-package-entrypoints.ts b/src/shared/agent-node-package-entrypoints.ts
new file mode 100644
index 00000000000..7f8f9abd7cb
--- /dev/null
+++ b/src/shared/agent-node-package-entrypoints.ts
@@ -0,0 +1,17 @@
+// Node CLIs whose shim launches a script named after the agent, but generic enough that
+// the basename alone is not identity (`dsh-tui.js` could be anyone's file). The package
+// directory in the resolved path is what makes the match authoritative.
+//
+// Split out of agent-process-recognition.ts so the recognizer keeps only its logic and a
+// new agent's install path is a data edit, as in agent-node-entrypoint-identities.ts.
+export const NODE_PACKAGE_SCRIPT_ENTRYPOINTS: Record<string, readonly string[]> = {
+  codex: ['node_modules/@openai/codex/'],
+  codebuddy: ['node_modules/@tencent-ai/codebuddy-code/'],
+  gemini: ['node_modules/@google/gemini-cli/'],
+  // Why: ZCode's npm bin is `dist/zcode.cjs`, so a package install runs as `node …zcode.cjs`
+  // and never shows `zcode` as the foreground name (a SEA build still matches by name).
+  zcode: ['node_modules/@zcode/cli/'],
+  // Why: the `dsh-tui` launcher is installed twice — once on PATH and once inside the
+  // profile it bootstraps — and the PATH copy re-execs the profile copy by absolute path.
+  'dsh-tui': ['node_modules/@deepseek-harness-tui/dsh-tui/']
+}
diff --git a/src/shared/agent-overlay-env.ts b/src/shared/agent-overlay-env.ts
new file mode 100644
index 00000000000..91e1f85b6ab
--- /dev/null
+++ b/src/shared/agent-overlay-env.ts
@@ -0,0 +1,27 @@
+// Why: a nested terminal can inherit prior OpenCode/Pi/OMP overlay env; restore the user's recorded source dir, else strip only Orca-owned values.
+export function restoreOrStripOverlayEnv(
+  baseEnv: Record<string, string>,
+  keys: {
+    primary: string
+    overlay: string
+    source: string
+    preserveExplicitPrimary?: boolean
+  },
+  inheritedEnv: NodeJS.ProcessEnv = process.env
+): void {
+  const sourceValue = baseEnv[keys.source] ?? inheritedEnv[keys.source]
+  const overlayValue = baseEnv[keys.overlay] ?? inheritedEnv[keys.overlay]
+  // Source-only markers from older launches still identify an inherited overlay.
+  const preservePrimary =
+    keys.preserveExplicitPrimary &&
+    Boolean(overlayValue) &&
+    baseEnv[keys.primary] !== undefined &&
+    baseEnv[keys.primary] !== overlayValue
+  if (sourceValue && !preservePrimary) {
+    baseEnv[keys.primary] = sourceValue
+  } else if (overlayValue && baseEnv[keys.primary] === overlayValue) {
+    delete baseEnv[keys.primary]
+  }
+  delete baseEnv[keys.overlay]
+  delete baseEnv[keys.source]
+}
diff --git a/src/shared/agent-process-recognition.ts b/src/shared/agent-process-recognition.ts
index a0f0faa68e7..a8262eb4760 100644
--- a/src/shared/agent-process-recognition.ts
+++ b/src/shared/agent-process-recognition.ts
@@ -1,5 +1,6 @@
 import { getTuiAgentDetectCommands, TUI_AGENT_CONFIG } from './tui-agent-config'
 import { EXACT_NODE_ENTRYPOINT_IDENTITIES } from './agent-node-entrypoint-identities'
+import { NODE_PACKAGE_SCRIPT_ENTRYPOINTS } from './agent-node-package-entrypoints'
 import type { AgentType } from './agent-status-types'
 import type { TuiAgent } from './tui-agent'
 import { filterHeadlessOneShotAgentCommand } from './agent-headless-command'
@@ -35,13 +36,6 @@ function normalizeProcessName(
 }
 
 const FOREGROUND_AGENT_WRAPPER_PROCESS_NAMES = new Set(['node', 'python', 'python3'])
-const NODE_PACKAGE_SCRIPT_ENTRYPOINTS: Record<string, readonly string[]> = {
-  codex: ['node_modules/@openai/codex/'],
-  gemini: ['node_modules/@google/gemini-cli/'],
-  // Why: ZCode's npm bin is `dist/zcode.cjs`, so a package install runs as `node …zcode.cjs`
-  // and never shows `zcode` as the foreground name (a SEA build still matches by name).
-  zcode: ['node_modules/@zcode/cli/']
-}
 const PYTHON_SCRIPT_ENTRYPOINT_DIRECTORIES = ['/bin/', '/scripts/', '/site-packages/']
 
 const PROCESS_TO_AGENT = new Map<string, TuiAgent>()
@@ -79,6 +73,10 @@ function agentForNormalizedProcess(normalized: string): TuiAgent | undefined {
   if (normalized.startsWith('codex-')) {
     return PROCESS_TO_AGENT.get('codex')
   }
+  // Qoder's launcher resolves to a versioned native binary.
+  if (/^qodercli-\d/.test(normalized)) {
+    return PROCESS_TO_AGENT.get('qodercli')
+  }
   if (normalized.startsWith('grok-')) {
     return PROCESS_TO_AGENT.get('grok')
   }
@@ -164,6 +162,7 @@ export function isExpectedAgentProcess(
   return (
     normalizedProcess === normalizedExpected ||
     normalizedProcess.startsWith(`${normalizedExpected}.`) ||
+    (normalizedExpected === 'qodercli' && /^qodercli-\d/.test(normalizedProcess)) ||
     (normalizedExpected === 'muse' && normalizedProcess.startsWith('muse-bin-'))
   )
 }
diff --git a/src/shared/agent-session-caller-env.ts b/src/shared/agent-session-caller-env.ts
new file mode 100644
index 00000000000..5f66128dc5f
--- /dev/null
+++ b/src/shared/agent-session-caller-env.ts
@@ -0,0 +1,38 @@
+/**
+ * The Orca-minted agent session id, injected into a structured session's own child processes. When
+ * it is present it IS the orchestration caller: the CLI sends it in the orchestration envelope and
+ * the host resolves the session it names, so no terminal is resolved or guessed on its behalf.
+ *
+ * Identity by session id assumes one machine and one user. A host boundary (SSH, a paired peer,
+ * WSL) re-opens that decision: the host refuses a claim that arrives across one, and the SSH
+ * passthrough never carries the id.
+ */
+import { ORCA_SESSION_ADDRESS_PREFIX } from './orca-session-address-prefix'
+import { isStructuredWorkerHandle } from './structured-worker-handle'
+
+export const ORCA_AGENT_SESSION_ID_ENV = 'ORCA_AGENT_SESSION_ID'
+
+export function readInjectedAgentSessionId(
+  env: Readonly<Record<string, string | undefined>> = process.env
+): string | undefined {
+  const value = env[ORCA_AGENT_SESSION_ID_ENV]?.trim()
+  return value ? value : undefined
+}
+
+/**
+ * The address the host gives this session (`mailboxAddressOf` on its resolved party): a structured
+ * worker keeps the handle it was minted, any other session is `session:<id>`. Only for text that
+ * must match what the host writes; the CLI spells it without the host resolver.
+ */
+export function injectedSessionAddress(
+  env: Readonly<Record<string, string | undefined>> = process.env
+): string | undefined {
+  const sessionId = readInjectedAgentSessionId(env)
+  if (!sessionId) {
+    return undefined
+  }
+  const ownHandle = env.ORCA_TERMINAL_HANDLE
+  return isStructuredWorkerHandle(ownHandle)
+    ? ownHandle
+    : `${ORCA_SESSION_ADDRESS_PREFIX}${sessionId}`
+}
diff --git a/src/shared/agent-session-conversation-command.ts b/src/shared/agent-session-conversation-command.ts
index e1c038de934..8b5ecb6ccf0 100644
--- a/src/shared/agent-session-conversation-command.ts
+++ b/src/shared/agent-session-conversation-command.ts
@@ -1,11 +1,20 @@
+import type { AgentSessionFailureFact } from './agent-session-failure'
+import type { AgentSessionFailureSentence } from './agent-session-failure-words'
+
 export type AgentSessionConversationCommand = 'clear' | 'compact'
 
 export type AgentSessionConversationCommandResult = {
   command: AgentSessionConversationCommand
   state: 'completed' | 'unknown'
   replacementSessionId?: string
-  error?: string
-}
+} &
+  /** `error`: a sentence for a person; released clients print it as it is. */
+  (
+    | { error?: string; failure?: undefined }
+    /** What failed, typed, beside its sentence, both from `agentSessionFailureWords`; `failure` is
+     *  absent from older hosts. */
+    | { error: AgentSessionFailureSentence; failure: AgentSessionFailureFact }
+  )
 
 export type AgentSessionConversationCommandRecord = AgentSessionConversationCommandResult & {
   runtimeFence?: number
diff --git a/src/shared/agent-session-conversation-outline.ts b/src/shared/agent-session-conversation-outline.ts
index bc4fa3b40ad..2b6bb846adb 100644
--- a/src/shared/agent-session-conversation-outline.ts
+++ b/src/shared/agent-session-conversation-outline.ts
@@ -75,8 +75,8 @@ export function truncateOutlinePreview(text: string, maxChars: number): string {
 
 /** User messages that draw a transcript row, in transcript order. Projected over the
  *  whole journal, not user items alone: whether a user row survives depends on its
- *  neighbours (a harness sidecar folds into the turn before it) and its order on
- *  when it was observed. Previews are uncut; the reply bound owns length. */
+ *  neighbours (a harness sidecar folds into the turn before it), and its order is
+ *  its journal position. Previews are uncut; the reply bound owns length. */
 export function projectAgentSessionConversationOutline(
   items: readonly AgentJournalRenderItem[],
   submissions: readonly AgentJournalSubmission[]
diff --git a/src/shared/agent-session-failure-words.test.ts b/src/shared/agent-session-failure-words.test.ts
new file mode 100644
index 00000000000..82fd9caca69
--- /dev/null
+++ b/src/shared/agent-session-failure-words.test.ts
@@ -0,0 +1,260 @@
+import { describe, expect, it } from 'vitest'
+import {
+  AGENT_SESSION_ATTACHMENT_PROBLEM_REASONS,
+  AGENT_SESSION_FAILURE_KINDS,
+  isSubmissionRejectionFact,
+  readAgentSessionFailureFact,
+  type AgentSessionFailureFact,
+  type AgentSessionFailureKind,
+  type SubmissionRejectionKind
+} from './agent-session-failure'
+import {
+  agentSessionFailureSentence,
+  agentSessionFailureWords,
+  type AgentSessionFailureSurface
+} from './agent-session-failure-words'
+import {
+  classifyDispatchRejection,
+  DISPATCH_REJECTED_CANCELLED,
+  DISPATCH_REJECTED_CODEX_QUEUE_FULL,
+  DISPATCH_REJECTED_QUEUE_FULL,
+  DISPATCH_REJECTED_WRITE_FAILED
+} from './structured-agent-session-dispatch-rejection'
+
+/** What Orca's own text looks like: a code or marker, a uuid, a path, an exception. */
+const ORCA_INTERNAL = /\b[a-z]+_[a-z_]+\b|[0-9a-f]{8}-[0-9a-f]{4}-|[/\\][\w.-]+[/\\]|Error:|ENOENT/
+
+const SURFACES: readonly AgentSessionFailureSurface[] = ['row', 'rejection']
+const LEGACY_MARKER_KINDS: ReadonlySet<SubmissionRejectionKind> = new Set([
+  'cancelled',
+  'writeFailed',
+  'queueFull'
+])
+
+/** Every fact shape a kind can carry: bare, with a person or a log detail, with a refusal, and
+ *  for an attachment each reason with and without its limit. */
+function factsFor(kind: AgentSessionFailureKind): AgentSessionFailureFact[] {
+  const facts: AgentSessionFailureFact[] = [
+    { kind },
+    { kind, detail: { text: 'Context window exceeded.', audience: 'person' } },
+    {
+      kind,
+      // A log detail and a refusal ride with the fact; neither may reach the sentence.
+      detail: { text: 'Error: ENOENT /Users/me/.claude/x agent_session_conflict', audience: 'log' },
+      refusal: { code: 'agent_session_identity_required', details: { reason: 'recordMissing' } }
+    }
+  ]
+  if (kind === 'providerRetrying') {
+    facts.push({ kind, retry: { error: 'rate_limit', status: 429 } })
+    facts.push({ kind, retry: { error: 'overloaded', status: 529 } })
+    facts.push({ kind, retry: { status: 500 } })
+  }
+  if (kind === 'attachmentInvalid') {
+    for (const reason of AGENT_SESSION_ATTACHMENT_PROBLEM_REASONS) {
+      facts.push({ kind, attachment: { reason } })
+      facts.push({ kind, attachment: { reason, limit: 5 * 1024 * 1024 } })
+    }
+  }
+  return facts
+}
+
+describe('the words written beside a failure fact', () => {
+  describe.each(SURFACES)('on the %s surface', (surface) => {
+    it.each(AGENT_SESSION_FAILURE_KINDS)('for %s are one sentence a person can read', (kind) => {
+      for (const fact of factsFor(kind)) {
+        for (const [agentName, command] of [
+          ['Claude', undefined],
+          [undefined, undefined],
+          ['Codex', 'clear']
+        ] as const) {
+          const sentence = agentSessionFailureSentence(fact, surface, { agentName, command })
+          expect([fact, sentence]).toEqual([fact, expect.stringMatching(/[^.]\.$/)])
+          expect(sentence).not.toMatch(/\.\./)
+          expect(sentence).not.toMatch(ORCA_INTERNAL)
+          const context = { agentName, command, provider: 'claude' } as const
+          if (surface === 'row') {
+            expect(agentSessionFailureWords(fact, { ...context, surface }).text).toBe(sentence)
+          } else if (isSubmissionRejectionFact(fact) && !LEGACY_MARKER_KINDS.has(fact.kind)) {
+            expect(agentSessionFailureWords(fact, { ...context, surface }).reason).toBe(sentence)
+          }
+        }
+      }
+    })
+  })
+
+  it('writes the legacy markers released clients hide, byte for byte, on a rejection', () => {
+    const reason = (kind: SubmissionRejectionKind, provider?: 'claude' | 'codex') =>
+      agentSessionFailureWords({ kind }, { surface: 'rejection', provider }).reason
+    expect(reason('cancelled')).toBe(DISPATCH_REJECTED_CANCELLED)
+    expect(DISPATCH_REJECTED_CANCELLED).toBe('provider_cancelled_before_start')
+    expect(reason('queueFull', 'claude')).toBe(DISPATCH_REJECTED_QUEUE_FULL)
+    expect(DISPATCH_REJECTED_QUEUE_FULL).toBe('claude structured dispatch queue is full')
+    expect(reason('queueFull', 'codex')).toBe(DISPATCH_REJECTED_CODEX_QUEUE_FULL)
+    expect(DISPATCH_REJECTED_CODEX_QUEUE_FULL).toBe('codex structured dispatch queue is full')
+    // Bare: the error that once followed it belongs in the log.
+    expect(reason('writeFailed')).toBe(DISPATCH_REJECTED_WRITE_FAILED)
+    expect(DISPATCH_REJECTED_WRITE_FAILED).toBe('provider_write_failed')
+    // With no provider to name its marker, a full queue gets a sentence.
+    expect(reason('queueFull')).toBe(
+      'Too many messages were waiting for the agent, so this one was not sent.'
+    )
+    for (const kind of LEGACY_MARKER_KINDS) {
+      const written = agentSessionFailureWords(
+        { kind },
+        { surface: 'rejection', provider: 'codex' }
+      )
+      expect(classifyDispatchRejection({ reason: written.reason })).toMatchObject({ kind })
+    }
+  })
+
+  it('names /clear as the next step for the start a /clear needed', () => {
+    const clear = (kind: AgentSessionFailureKind) =>
+      agentSessionFailureSentence({ kind }, 'row', { agentName: 'Codex', command: 'clear' })
+    expect(clear('notSignedIn')).toBe(
+      'Codex is not signed in for the selected account. Sign in, then run /clear again.'
+    )
+    expect(clear('startFailed')).toBe("Codex couldn't start. Run /clear again.")
+    expect(clear('restartFailed')).toBe("Codex couldn't restart. Run /clear again.")
+    expect(clear('providerStartFailed')).toBe(
+      'Codex stopped before it finished starting. Run /clear again.'
+    )
+  })
+
+  it('names /compact as the next step for the start a /compact needed', () => {
+    const compact = (kind: AgentSessionFailureKind) =>
+      agentSessionFailureSentence({ kind }, 'rejection', {
+        agentName: 'Claude',
+        command: 'compact'
+      })
+    expect(compact('notSignedIn')).toBe(
+      'Claude is not signed in for the selected account. Sign in, then run /compact again.'
+    )
+    expect(compact('startFailed')).toBe("Claude couldn't start. Run /compact again.")
+    expect(compact('restartFailed')).toBe("Claude couldn't restart. Run /compact again.")
+    expect(compact('providerStartFailed')).toBe(
+      'Claude stopped before it finished starting. Run /compact again.'
+    )
+  })
+
+  it('names the agent that stopped starting, and a failed start or restart gives a next step', () => {
+    const sentence = (kind: AgentSessionFailureKind, agentName?: string) =>
+      agentSessionFailureSentence({ kind }, 'rejection', { agentName })
+    expect(sentence('providerStartFailed', 'Claude')).toBe(
+      'Claude stopped before it finished starting. Send your message to try again.'
+    )
+    expect(sentence('providerStartFailed')).toBe(
+      'The agent stopped before it finished starting. Send your message to try again.'
+    )
+    expect(sentence('startFailed', 'Codex')).toBe(
+      "Codex couldn't start. Send your message to try again."
+    )
+    expect(sentence('restartFailed')).toBe(
+      "The agent couldn't restart. Send your message to try again."
+    )
+    // Nothing to restart from: a new chat is the only step, so no retry is offered.
+    expect(
+      agentSessionFailureSentence(
+        {
+          kind: 'startFailed',
+          refusal: { code: 'agent_session_identity_required', details: { reason: 'recordMissing' } }
+        },
+        'row',
+        { agentName: 'Codex' }
+      )
+    ).toBe("Codex couldn't start. Start a new chat to continue.")
+  })
+
+  it('names the exit a row reports differently from the message it left unsent', () => {
+    expect(
+      agentSessionFailureWords({ kind: 'providerExited' }, { surface: 'row', agentName: 'Claude' })
+        .text
+    ).toBe(
+      'Claude stopped while this response was in progress. You can continue in this conversation.'
+    )
+    expect(
+      agentSessionFailureWords(
+        { kind: 'providerExited' },
+        { surface: 'rejection', agentName: 'Codex' }
+      ).reason
+    ).toBe('Codex stopped before this message was sent.')
+    expect(agentSessionFailureWords({ kind: 'providerExited' }, { surface: 'row' }).text).toBe(
+      'The agent stopped while this response was in progress. You can continue in this conversation.'
+    )
+    expect(
+      agentSessionFailureWords({ kind: 'providerExited' }, { surface: 'rejection' }).reason
+    ).toBe('The agent stopped before this message was sent.')
+  })
+
+  it('says a refused Stop reached the agent, which declined it', () => {
+    const refused = (detail?: { text: string; audience: 'person' | 'log' }, agentName?: string) =>
+      agentSessionFailureWords(
+        { kind: 'stopRefused', ...(detail ? { detail } : {}) },
+        { surface: 'row', agentName }
+      ).text
+    expect(refused(undefined, 'Codex')).toBe('Codex had no turn running to stop.')
+    expect(refused()).toBe('The agent had no turn running to stop.')
+    expect(refused({ text: 'no active turn to interrupt.', audience: 'person' }, 'Codex')).toBe(
+      "Codex didn't stop: no active turn to interrupt."
+    )
+    // Words Codex wrote for the log are never quoted to a person.
+    expect(refused({ text: 'rpc -32600', audience: 'log' }, 'Codex')).toBe(
+      'Codex had no turn running to stop.'
+    )
+  })
+
+  it('says what frees a chat a terminal agent still holds, without naming its process', () => {
+    expect(
+      agentSessionFailureSentence(
+        {
+          kind: 'restartFailed',
+          refusal: { code: 'agent_session_conflict', details: { reason: 'claimConflicted' } }
+        },
+        'row',
+        { agentName: 'Codex' }
+      )
+    ).toBe(
+      "Codex couldn't restart. This chat is still open in a terminal agent. Quit that agent to continue the chat here."
+    )
+  })
+
+  it('says which limit an attachment broke, in megabytes', () => {
+    const sentence = (attachment: AgentSessionFailureFact['attachment']) =>
+      agentSessionFailureSentence({ kind: 'attachmentInvalid', attachment }, 'rejection', {
+        agentName: 'Claude'
+      })
+    expect(sentence({ reason: 'tooLarge', limit: 5 * 1024 * 1024 })).toBe(
+      'An image on this message is larger than 5 MB, so the message was not sent.'
+    )
+    expect(sentence({ reason: 'totalTooLarge', limit: 20 * 1024 * 1024 })).toBe(
+      'The images on this message add up to more than 20 MB, so the message was not sent.'
+    )
+    expect(sentence({ reason: 'tooMany', limit: 20 })).toBe(
+      'Claude accepts at most 20 images in one message, so this message was not sent.'
+    )
+    expect(sentence(undefined)).toBe("An attachment on this message can't be sent to the agent.")
+  })
+})
+
+describe('an attachment problem as a reader meets it', () => {
+  it('keeps what it can place and drops what it cannot', () => {
+    expect(
+      readAgentSessionFailureFact({
+        kind: 'attachmentInvalid',
+        attachment: { reason: 'tooMany', limit: 20 }
+      })
+    ).toEqual({ kind: 'attachmentInvalid', attachment: { reason: 'tooMany', limit: 20 } })
+    expect(
+      readAgentSessionFailureFact({
+        kind: 'attachmentInvalid',
+        attachment: { reason: 'tooMany', limit: 'twenty' }
+      })
+    ).toEqual({ kind: 'attachmentInvalid', attachment: { reason: 'tooMany' } })
+    // A reason a newer host added reads as the generic attachment failure.
+    expect(
+      readAgentSessionFailureFact({
+        kind: 'attachmentInvalid',
+        attachment: { reason: 'futureReason' }
+      })
+    ).toEqual({ kind: 'attachmentInvalid' })
+  })
+})
diff --git a/src/shared/agent-session-failure-words.ts b/src/shared/agent-session-failure-words.ts
new file mode 100644
index 00000000000..2b334cf9629
--- /dev/null
+++ b/src/shared/agent-session-failure-words.ts
@@ -0,0 +1,281 @@
+// The sentence a person reads beside each failure fact, and the one constructor that writes both.
+//
+// A row's `text`, a rejected message's `reason` and a conversation command's `error` are what
+// every released client prints as they are, so the host writes them here, from the fact, and
+// nowhere else: never Orca's own error text, a refusal's message, or a probe's evidence. A
+// provider's words reach the sentence only when the provider wrote them for a person. The table
+// is also the English default for a client that chooses its own copy from the fact.
+
+import {
+  isSubmissionRejectionFact,
+  type AgentSessionAttachmentProblem,
+  type AgentSessionAttachmentProblemReason,
+  type AgentSessionFailureFact,
+  type AgentSessionFailureKind,
+  type ProviderDiagnostic,
+  type SubmissionRejectionFact,
+  type SubmissionRejectionKind
+} from './agent-session-failure'
+import type { AgentSessionConversationCommand } from './agent-session-conversation-command'
+import type { AgentSessionWireRefusalCode } from './agent-session-wire-refusals'
+import {
+  DISPATCH_REJECTED_CANCELLED,
+  DISPATCH_REJECTED_CODEX_QUEUE_FULL,
+  DISPATCH_REJECTED_QUEUE_FULL,
+  DISPATCH_REJECTED_WRITE_FAILED
+} from './structured-agent-session-dispatch-rejection'
+
+declare const failureSentence: unique symbol
+
+/** Words only `agentSessionFailureWords` makes, so no writer can put its own beside a fact. */
+export type AgentSessionFailureSentence = string & { readonly [failureSentence]: true }
+
+/** A status row that reports a failure. */
+export type AgentSessionFailureRowWords = {
+  text: AgentSessionFailureSentence
+  failure: AgentSessionFailureFact
+}
+
+/** A rejection as the host writes it: the sentence (or, for the cases released clients already
+ *  hide, the legacy marker) they print, and the fact newer ones read. */
+export type AgentJournalDispatchRejection = {
+  reason: AgentSessionFailureSentence
+  rejection: SubmissionRejectionFact
+}
+
+/** `row`: a status row, about the chat. `rejection`: a rejected message's reason, about it. */
+export type AgentSessionFailureSurface = 'row' | 'rejection'
+
+export type AgentSessionFailureWordsContext = {
+  /** The chat's agent, when the writer knows it. */
+  agentName?: string
+  /** Names the legacy queue-full marker; without it a full queue is worded as a sentence. */
+  provider?: 'claude' | 'codex'
+  /** The conversation command a failed start was for, so the next step is to run it again
+   *  rather than to send a message. */
+  command?: AgentSessionConversationCommand
+  /** The surface retries for the person — its own Retry beside the words, or a read that reconnects
+   *  on its own — so they leave out sending or trying again. */
+  retryControl?: boolean
+}
+
+/**
+ * Whether a refused start leaves the chat anything to start again from. `false`: this host has
+ * nothing to restart it from — no record, or none it can run — so only a new chat continues.
+ * A new wire code does not compile until it is classified here.
+ */
+export const START_REFUSAL_RESUMABLE: Record<AgentSessionWireRefusalCode, boolean> = {
+  execution_owner_reconciling: true,
+  agent_session_conflict: true,
+  agent_session_checkpoint_stale: true,
+  agent_session_ownership_unknown: true,
+  agent_session_operation_capacity: true,
+  structured_agent_session_unsupported: false,
+  agent_session_operation_conflict: true,
+  agent_session_operation_expired: true,
+  agent_session_operation_invalid: true,
+  agent_session_operation_unknown: true,
+  agent_session_item_revision_stale: true,
+  agent_session_already_resolved: true,
+  agent_session_identity_required: false,
+  agent_session_journal_unreadable: true,
+  agent_session_owner_restart_failed: true
+}
+
+/** Sentences a refusal notice shows too, so a chat says them one way. */
+export const TERMINAL_AGENT_HOLDS_CHAT = 'This chat is still open in a terminal agent.'
+export const QUIT_TERMINAL_AGENT = 'Quit that agent to continue the chat here.'
+export const START_NEW_CHAT = 'Start a new chat to continue.'
+
+/** Person-facing provider text is quoted, but bounded so the sentence stays one. */
+const MAX_QUOTED_DETAIL_CHARS = 512
+const BYTES_PER_MB = 1024 * 1024
+
+type Sentence = (
+  context: AgentSessionFailureWordsContext,
+  fact: AgentSessionFailureFact,
+  surface: AgentSessionFailureSurface
+) => string
+
+function quotingPersonDetail(lead: string, detail: ProviderDiagnostic | undefined): string {
+  const quoted =
+    detail?.audience === 'person'
+      ? detail.text
+          .slice(0, MAX_QUOTED_DETAIL_CHARS)
+          .trim()
+          .replace(/[.\s]+$/, '')
+      : ''
+  return quoted ? `${lead}: ${quoted}.` : `${lead}.`
+}
+
+/** What to do once the start can work, for a sentence that ends in it. */
+function retryStep({ command }: AgentSessionFailureWordsContext): string {
+  return command ? `run /${command} again` : 'send your message again'
+}
+
+/** The next step after a start or restart that failed: the command, or the message, again. */
+function startRetry({ command, retryControl }: AgentSessionFailureWordsContext): string {
+  if (retryControl) {
+    return ''
+  }
+  return command ? ` Run /${command} again.` : ' Send your message to try again.'
+}
+
+function couldNot(verb: string): Sentence {
+  return (context, fact) => {
+    const { agentName } = context
+    const failed = `${agentName ?? 'The agent'} couldn't ${verb}.`
+    // Only a terminal agent an older build recorded holds a claim; quitting it frees the chat.
+    if (fact.refusal?.details?.reason === 'claimConflicted') {
+      return `${failed} ${TERMINAL_AGENT_HOLDS_CHAT} ${QUIT_TERMINAL_AGENT}`
+    }
+    const code = fact.refusal?.code
+    return code && !START_REFUSAL_RESUMABLE[code]
+      ? `${failed} ${START_NEW_CHAT}`
+      : `${failed}${startRetry(context)}`
+  }
+}
+
+function megabytes(bytes: number): string {
+  return `${Math.round((bytes / BYTES_PER_MB) * 10) / 10} MB`
+}
+
+const NOT_SENT = 'so the message was not sent.'
+
+const ATTACHMENT_SENTENCES = {
+  empty: () => `An image on this message is empty, ${NOT_SENT}`,
+  tooLarge: (_, { limit }) =>
+    limit
+      ? `An image on this message is larger than ${megabytes(limit)}, ${NOT_SENT}`
+      : `An image on this message is too large, ${NOT_SENT}`,
+  tooMany: ({ agentName }, { limit }) =>
+    limit
+      ? `${agentName ?? 'The agent'} accepts at most ${limit} images in one message, so this message was not sent.`
+      : 'This message has too many images, so it was not sent.',
+  totalTooLarge: (_, { limit }) =>
+    limit
+      ? `The images on this message add up to more than ${megabytes(limit)}, ${NOT_SENT}`
+      : `The images on this message are too large together, ${NOT_SENT}`,
+  unsupportedType: ({ agentName }) =>
+    `${agentName ?? 'The agent'} accepts only PNG, JPEG, GIF, and WebP images, so this message was not sent.`,
+  notAFile: () => `An image on this message isn't a file, ${NOT_SENT}`,
+  noSource: () => `An image on this message has no file to send, ${NOT_SENT}`
+} satisfies Record<
+  AgentSessionAttachmentProblemReason,
+  (context: AgentSessionFailureWordsContext, problem: AgentSessionAttachmentProblem) => string
+>
+
+const FAILURE_SENTENCES = {
+  providerStartFailed: (context) =>
+    `${context.agentName ?? 'The agent'} stopped before it finished starting.${startRetry(context)}`,
+  startFailed: couldNot('start'),
+  // Beside a Retry the resend is the button, but signing in is still a step to take first.
+  notSignedIn: (context) =>
+    `${context.agentName ?? 'The agent'} is not signed in for the selected account. ${context.retryControl ? 'Sign in first.' : `Sign in, then ${retryStep(context)}.`}`,
+  historyTooLarge: () =>
+    `This conversation's history is too large to restore here. ${START_NEW_CHAT}`,
+  managedAccountEnvOverride: () =>
+    'This Claude launch sets its own Anthropic sign-in variables. Remove them to use a managed Claude account.',
+  accountSwitchInProgress: () =>
+    'A Claude account switch is in progress. Try again after it finishes.',
+  managedAccountUnsupported: (context) =>
+    `While a Claude account is added in WSL, Claude chats need a Windows Claude account. Choose or add one in Claude Accounts settings${context.retryControl ? '' : `, then ${retryStep(context)}`}.`,
+  providerExited: ({ agentName }, _, surface) =>
+    surface === 'row'
+      ? `${agentName ?? 'The agent'} stopped while this response was in progress. You can continue in this conversation.`
+      : `${agentName ?? 'The agent'} stopped before this message was sent.`,
+  restartFailed: couldNot('restart'),
+  providerRejected: (_, fact) =>
+    quotingPersonDetail('The provider did not accept this message', fact.detail),
+  attachmentInvalid: (context, fact) =>
+    fact.attachment
+      ? ATTACHMENT_SENTENCES[fact.attachment.reason](context, fact.attachment)
+      : "An attachment on this message can't be sent to the agent.",
+  attachmentUnreadable: () => `An attachment on this message couldn't be read, ${NOT_SENT}`,
+  emptyMessage: () => 'This message is empty, so it was not sent.',
+  queueFull: () => 'Too many messages were waiting for the agent, so this one was not sent.',
+  writeFailed: () => "Orca couldn't hand this message to the agent, so it was not sent.",
+  cancelled: () => 'This message was withdrawn before the agent started it.',
+  chatClosed: () => 'The chat closed before this message was sent.',
+  hostRestarted: () => 'Orca restarted before this message was sent.',
+  notDelivered: ({ retryControl }) =>
+    retryControl
+      ? 'This message was not delivered.'
+      : 'This message was not delivered. Send it again to continue.',
+  commandRefused: ({ retryControl }) =>
+    `This command didn't run.${retryControl ? '' : ' Try it again.'}`,
+  compactionFailed: (_, fact) => quotingPersonDetail('Compaction failed', fact.detail),
+  compactionUnconfirmed: () => 'Compaction completion is unconfirmed.',
+  cancelUnconfirmed: () => 'Cancellation was not confirmed.',
+  // The agent was reached and declined, so the sentence says that, not that the Stop was lost.
+  stopRefused: ({ agentName }, fact) =>
+    fact.detail?.audience === 'person'
+      ? quotingPersonDetail(`${agentName ?? 'The agent'} didn't stop`, fact.detail)
+      : `${agentName ?? 'The agent'} had no turn running to stop.`,
+  answerUnconfirmed: () => 'Your answer was recorded but the agent did not confirm it.',
+  hostFault: ({ retryControl }) =>
+    `Orca ran into a problem, so this didn't go through.${retryControl ? '' : ' Try again.'}`,
+  hostStopped: ({ agentName }) =>
+    `${agentName ?? 'The agent'} never finished starting, so Orca stopped it.`,
+  providerRetrying: ({ agentName }, { retry }) =>
+    retry?.error === 'rate_limit' || retry?.status === 429
+      ? `${agentName ?? 'The agent'} is rate-limited and retrying.`
+      : `${agentName ?? 'The agent'} hit a temporary problem and is retrying.`
+} satisfies Record<AgentSessionFailureKind, Sentence>
+
+/** The sentence a person reads for this fact on this surface; never a marker. */
+export function agentSessionFailureSentence(
+  fact: AgentSessionFailureFact,
+  surface: AgentSessionFailureSurface,
+  context: AgentSessionFailureWordsContext = {}
+): string {
+  const sentence: Sentence = FAILURE_SENTENCES[fact.kind]
+  return sentence(context, fact, surface)
+}
+
+/** The markers released clients hide, for the rejections that had one before rows carried a fact.
+ *  A write failure is the bare marker: its error belongs in the log. */
+const LEGACY_REJECTION_MARKERS: Partial<
+  Record<SubmissionRejectionKind, (context: AgentSessionFailureWordsContext) => string | undefined>
+> = {
+  cancelled: () => DISPATCH_REJECTED_CANCELLED,
+  writeFailed: () => DISPATCH_REJECTED_WRITE_FAILED,
+  queueFull: ({ provider }) =>
+    provider === 'codex'
+      ? DISPATCH_REJECTED_CODEX_QUEUE_FULL
+      : provider === 'claude'
+        ? DISPATCH_REJECTED_QUEUE_FULL
+        : undefined
+}
+
+/** The words a status row reporting this fact records. */
+export function agentSessionFailureWords(
+  fact: AgentSessionFailureFact,
+  context: AgentSessionFailureWordsContext & { surface: 'row' }
+): AgentSessionFailureRowWords
+/** The words a message rejected for this fact records. */
+export function agentSessionFailureWords(
+  fact: SubmissionRejectionFact,
+  context: AgentSessionFailureWordsContext & { surface: 'rejection' }
+): AgentJournalDispatchRejection
+export function agentSessionFailureWords(
+  fact: AgentSessionFailureFact,
+  context: AgentSessionFailureWordsContext & { surface: AgentSessionFailureSurface }
+): AgentSessionFailureRowWords | AgentJournalDispatchRejection {
+  if (context.surface === 'row') {
+    return { text: branded(agentSessionFailureSentence(fact, 'row', context)), failure: fact }
+  }
+  // The rejection overload admits only these; a caller that got past the types is Orca's bug.
+  if (!isSubmissionRejectionFact(fact)) {
+    throw new Error(`agent session failure kind ${fact.kind} cannot reject a message`)
+  }
+  const words =
+    LEGACY_REJECTION_MARKERS[fact.kind]?.(context) ??
+    agentSessionFailureSentence(fact, 'rejection', context)
+  return { reason: branded(words), rejection: fact }
+}
+
+function branded(words: string): AgentSessionFailureSentence {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only `agentSessionFailureWords` calls this, with words from the table or a legacy marker for its fact.
+  return words as AgentSessionFailureSentence
+}
diff --git a/src/shared/agent-session-failure.test.ts b/src/shared/agent-session-failure.test.ts
new file mode 100644
index 00000000000..4dc12f9bfe8
--- /dev/null
+++ b/src/shared/agent-session-failure.test.ts
@@ -0,0 +1,93 @@
+import { describe, expect, it } from 'vitest'
+import {
+  MAX_PROVIDER_DIAGNOSTIC_CHARS,
+  providerDiagnostic,
+  providerDiagnosticOf,
+  readAgentSessionFailureFact,
+  withProviderDiagnostic
+} from './agent-session-failure'
+
+describe('provider diagnostics', () => {
+  it('bounds the text and records nothing for an empty one', () => {
+    expect(providerDiagnostic('  ', 'log')).toBeUndefined()
+    expect(
+      providerDiagnostic('x'.repeat(MAX_PROVIDER_DIAGNOSTIC_CHARS + 50), 'log')?.text
+    ).toHaveLength(MAX_PROVIDER_DIAGNOSTIC_CHARS)
+  })
+
+  it('is read from the error that carries it, or from what it wraps', () => {
+    const diagnostic = { text: 'bad request', audience: 'person' as const }
+    const carried = withProviderDiagnostic(
+      new Error('codex turn/start failed: bad request'),
+      diagnostic
+    )
+    expect(providerDiagnosticOf(carried)).toEqual(diagnostic)
+    expect(providerDiagnosticOf(new Error('wrapped', { cause: carried }))).toEqual(diagnostic)
+    expect(providerDiagnosticOf(new AggregateError([new Error('other'), carried], 'both'))).toEqual(
+      diagnostic
+    )
+  })
+
+  it('ends on an aggregate error that contains itself', () => {
+    const loop = new AggregateError([], 'loop')
+    loop.errors.push(loop)
+    expect(providerDiagnosticOf(loop)).toBeUndefined()
+  })
+
+  it('is never inferred from an error that did not carry one', () => {
+    // Orca's own wording, even when it quotes something that looks like a provider message.
+    expect(
+      providerDiagnosticOf(new Error('claude stream-json exited (code 1): not signed in'))
+    ).toBe(undefined)
+    expect(providerDiagnosticOf('a string')).toBeUndefined()
+  })
+})
+
+describe('reading a failure fact', () => {
+  it('keeps what this build can place', () => {
+    expect(
+      readAgentSessionFailureFact({
+        kind: 'restartFailed',
+        refusal: { code: 'agent_session_conflict', details: { reason: 'claimConflicted' } },
+        detail: { text: 'x', audience: 'person' }
+      })
+    ).toEqual({
+      kind: 'restartFailed',
+      refusal: { code: 'agent_session_conflict', details: { reason: 'claimConflicted' } },
+      detail: { text: 'x', audience: 'person' }
+    })
+  })
+
+  it('keeps what a provider said it is retrying, and only that', () => {
+    expect(
+      readAgentSessionFailureFact({
+        kind: 'providerRetrying',
+        retry: { error: 'rate_limit', status: 429, attempt: 3 }
+      })
+    ).toEqual({ kind: 'providerRetrying', retry: { error: 'rate_limit', status: 429 } })
+    expect(
+      readAgentSessionFailureFact({ kind: 'providerRetrying', retry: { error: '', status: 'x' } })
+    ).toEqual({ kind: 'providerRetrying' })
+  })
+
+  it('reads a row an unreleased build wrote with a cause as a refusal with no details', () => {
+    expect(
+      readAgentSessionFailureFact({
+        kind: 'restartFailed',
+        refusal: { code: 'agent_session_conflict', cause: 'claimConflicted' }
+      })
+    ).toEqual({ kind: 'restartFailed', refusal: { code: 'agent_session_conflict' } })
+  })
+
+  it('drops what a newer host wrote that this build cannot place', () => {
+    expect(readAgentSessionFailureFact({ kind: 'futureKind' })).toBeUndefined()
+    expect(readAgentSessionFailureFact(undefined)).toBeUndefined()
+    expect(
+      readAgentSessionFailureFact({
+        kind: 'restartFailed',
+        refusal: { code: 'agent_session_conflict', details: { reason: 'futureReason' } },
+        detail: { text: 'x', audience: 'future' }
+      })
+    ).toEqual({ kind: 'restartFailed', refusal: { code: 'agent_session_conflict' } })
+  })
+})
diff --git a/src/shared/agent-session-failure.ts b/src/shared/agent-session-failure.ts
new file mode 100644
index 00000000000..13568348f34
--- /dev/null
+++ b/src/shared/agent-session-failure.ts
@@ -0,0 +1,268 @@
+// What went wrong in a chat, typed where the host decides it, beside the sentence a person reads.
+//
+// The host writes both at once: `text`/`reason` stays a complete sentence because released clients
+// print it as it is, and this fact is what newer clients choose their copy and action from. A
+// provider's own words ride separately as `detail`, set only where Orca composed them from a
+// value the provider wrote — never recovered from a string afterwards, since by then nothing can
+// tell a provider's sentence from Orca's.
+
+import {
+  readAgentSessionRefusalReference,
+  type AgentSessionRefusalReference
+} from './agent-session-wire-refusals'
+
+/** One per situation with its own honest next step; a new one needs copy before it compiles. */
+export const AGENT_SESSION_FAILURE_KINDS = [
+  /** Only an observed exit: the provider stopped while starting. */
+  'providerStartFailed',
+  /** A start that did not land, with no one to blame: Orca's fault, a failed spawn, a close. */
+  'startFailed',
+  'notSignedIn',
+  'historyTooLarge',
+  'managedAccountEnvOverride',
+  'accountSwitchInProgress',
+  'managedAccountUnsupported',
+  'providerExited',
+  'restartFailed',
+  'providerRejected',
+  'attachmentInvalid',
+  'attachmentUnreadable',
+  'emptyMessage',
+  'queueFull',
+  'writeFailed',
+  'cancelled',
+  'chatClosed',
+  'hostRestarted',
+  'notDelivered',
+  /** A conversation command the chat's state refused when its turn to run came. */
+  'commandRefused',
+  'compactionFailed',
+  'compactionUnconfirmed',
+  'cancelUnconfirmed',
+  /** A Stop naming no turn reached the agent, which ended nothing while the chat read working. */
+  'stopRefused',
+  'answerUnconfirmed',
+  'hostFault',
+  /** Orca stopped an agent whose start never finished. */
+  'hostStopped',
+  /** The provider is retrying a request its API refused; not a failure yet. */
+  'providerRetrying'
+] as const
+export type AgentSessionFailureKind = (typeof AGENT_SESSION_FAILURE_KINDS)[number]
+
+export function isAgentSessionFailureKind(value: unknown): value is AgentSessionFailureKind {
+  return typeof value === 'string' && AGENT_SESSION_FAILURE_KINDS.some((kind) => kind === value)
+}
+
+/** Kinds only a status row reports: none is ever why a message was not sent. */
+const STATUS_ROW_ONLY_FAILURE_KINDS = [
+  'compactionFailed',
+  'compactionUnconfirmed',
+  'cancelUnconfirmed',
+  'stopRefused',
+  'answerUnconfirmed',
+  'providerRetrying'
+] as const satisfies readonly AgentSessionFailureKind[]
+
+/** Why a message was not sent. A new failure kind is one of these until listed above. */
+export type SubmissionRejectionKind = Exclude<
+  AgentSessionFailureKind,
+  (typeof STATUS_ROW_ONLY_FAILURE_KINDS)[number]
+>
+
+export function isSubmissionRejectionKind(value: unknown): value is SubmissionRejectionKind {
+  return (
+    isAgentSessionFailureKind(value) &&
+    !STATUS_ROW_ONLY_FAILURE_KINDS.some((statusOnly) => statusOnly === value)
+  )
+}
+
+/** `person`: written by the provider for whoever reads the chat, shown inline. `log`: a stderr
+ *  tail or exit status, shown only behind Details. */
+export type ProviderDiagnosticAudience = 'person' | 'log'
+
+export type ProviderDiagnostic = {
+  text: string
+  audience: ProviderDiagnosticAudience
+}
+
+/** Stderr can be a whole dump; the row keeps enough to act on. The same cap as the exit reason a
+ *  lease record keeps, so a diagnostic never outgrows what the record may store. */
+export const MAX_PROVIDER_DIAGNOSTIC_CHARS = 512
+
+/** Which of Orca's checks an image failed. A new one needs a sentence before it compiles. */
+export const AGENT_SESSION_ATTACHMENT_PROBLEM_REASONS = [
+  'empty',
+  'tooLarge',
+  'tooMany',
+  'totalTooLarge',
+  'unsupportedType',
+  'notAFile',
+  'noSource'
+] as const
+export type AgentSessionAttachmentProblemReason =
+  (typeof AGENT_SESSION_ATTACHMENT_PROBLEM_REASONS)[number]
+
+export type AgentSessionAttachmentProblem = {
+  reason: AgentSessionAttachmentProblemReason
+  /** The limit it broke: bytes for `tooLarge` and `totalTooLarge`, a count for `tooMany`. */
+  limit?: number
+}
+
+/** What the provider said it is retrying, in its own fields. */
+export type AgentSessionProviderRetry = {
+  /** The provider's error type, e.g. `rate_limit` or `overloaded`. */
+  error?: string
+  /** The HTTP status the request failed with. */
+  status?: number
+}
+
+export type AgentSessionFailureFact = {
+  kind: AgentSessionFailureKind
+  /** Provider-authored only; absent whenever Orca wrote the words. */
+  detail?: ProviderDiagnostic
+  /** On `restartFailed` and `startFailed`: the refusal that kept the agent from starting. On
+   *  `commandRefused`: the refusal that kept the command from running. */
+  refusal?: AgentSessionRefusalReference
+  /** On `attachmentInvalid`: which check the attachment failed. */
+  attachment?: AgentSessionAttachmentProblem
+  /** On `providerRetrying`: why the provider is retrying. */
+  retry?: AgentSessionProviderRetry
+}
+
+/** A fact as a row stores it: its kind may be one a newer host added, so only
+ *  `readAgentSessionFailureFact` or the rejection classifier may place it. */
+export type UnreadAgentSessionFailureFact = { kind: string }
+
+/** A fact a rejected message may carry. */
+export type SubmissionRejectionFact = AgentSessionFailureFact & { kind: SubmissionRejectionKind }
+
+export function isSubmissionRejectionFact(
+  fact: AgentSessionFailureFact
+): fact is SubmissionRejectionFact {
+  return isSubmissionRejectionKind(fact.kind)
+}
+
+/** Null for empty text, so a writer never records a detail with nothing in it. */
+export function providerDiagnostic(
+  text: string,
+  audience: ProviderDiagnosticAudience
+): ProviderDiagnostic | undefined {
+  const bounded = text.trim().slice(0, MAX_PROVIDER_DIAGNOSTIC_CHARS).trim()
+  return bounded ? { text: bounded, audience } : undefined
+}
+
+export function agentSessionFailureFact<TKind extends AgentSessionFailureKind>(
+  kind: TKind,
+  extra: {
+    detail?: ProviderDiagnostic
+    refusal?: AgentSessionRefusalReference
+    attachment?: AgentSessionAttachmentProblem
+    retry?: AgentSessionProviderRetry
+  } = {}
+): AgentSessionFailureFact & { kind: TKind } {
+  // Re-bounded here, so no writer can store more than the cap however it built the detail.
+  const detail = extra.detail
+    ? providerDiagnostic(extra.detail.text, extra.detail.audience)
+    : undefined
+  return {
+    kind,
+    ...(detail ? { detail } : {}),
+    ...(extra.refusal ? { refusal: extra.refusal } : {}),
+    ...(extra.attachment ? { attachment: extra.attachment } : {}),
+    ...(extra.retry ? { retry: extra.retry } : {})
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+export function isProviderDiagnostic(value: unknown): value is ProviderDiagnostic {
+  return (
+    isRecord(value) &&
+    typeof value.text === 'string' &&
+    (value.audience === 'person' || value.audience === 'log')
+  )
+}
+
+function readAttachmentProblem(value: unknown): AgentSessionAttachmentProblem | undefined {
+  if (!isRecord(value)) {
+    return undefined
+  }
+  const reason = AGENT_SESSION_ATTACHMENT_PROBLEM_REASONS.find((known) => known === value.reason)
+  if (!reason) {
+    return undefined
+  }
+  const limit = value.limit
+  return typeof limit === 'number' && Number.isFinite(limit) && limit > 0
+    ? { reason, limit }
+    : { reason }
+}
+
+/** A retry as a reader meets it; undefined when it names neither field. */
+export function readProviderRetry(value: unknown): AgentSessionProviderRetry | undefined {
+  if (!isRecord(value)) {
+    return undefined
+  }
+  const error =
+    typeof value.error === 'string' && value.error.trim() ? value.error.trim() : undefined
+  const status =
+    typeof value.status === 'number' && Number.isInteger(value.status) && value.status > 0
+      ? value.status
+      : undefined
+  return error || status
+    ? { ...(error ? { error } : {}), ...(status ? { status } : {}) }
+    : undefined
+}
+
+/** A fact as a reader meets it. Undefined for anything this build cannot place, including a kind a
+ *  newer host added, so the reader falls back to what it does for a row with no fact. */
+export function readAgentSessionFailureFact(value: unknown): AgentSessionFailureFact | undefined {
+  if (!isRecord(value) || !isAgentSessionFailureKind(value.kind)) {
+    return undefined
+  }
+  const refusal = readAgentSessionRefusalReference(value.refusal)
+  const attachment = readAttachmentProblem(value.attachment)
+  const retry = readProviderRetry(value.retry)
+  return agentSessionFailureFact(value.kind, {
+    ...(isProviderDiagnostic(value.detail) ? { detail: value.detail } : {}),
+    ...(refusal ? { refusal } : {}),
+    ...(attachment ? { attachment } : {}),
+    ...(retry ? { retry } : {})
+  })
+}
+
+/** The provider-authored diagnostic an error carries, set only where it was composed. Follows the
+ *  `cause` chain, since wrappers such as the acquisition errors keep the original as their cause. */
+export function providerDiagnosticOf(error: unknown): ProviderDiagnostic | undefined {
+  return providerDiagnosticWithin(error, 0)
+}
+
+// One depth bound across `cause` and aggregated errors, so an error that contains itself ends.
+function providerDiagnosticWithin(error: unknown, start: number): ProviderDiagnostic | undefined {
+  let current: unknown = error
+  for (let depth = start; depth < 6 && current instanceof Error; depth += 1) {
+    if ('providerDiagnostic' in current && isProviderDiagnostic(current.providerDiagnostic)) {
+      return current.providerDiagnostic
+    }
+    if (current instanceof AggregateError) {
+      for (const inner of current.errors) {
+        const found = providerDiagnosticWithin(inner, depth + 1)
+        if (found) {
+          return found
+        }
+      }
+    }
+    current = current.cause
+  }
+  return undefined
+}
+
+/** Attaches the provider's words to the error Orca built around them. */
+export function withProviderDiagnostic<TError extends Error>(
+  error: TError,
+  diagnostic: ProviderDiagnostic | undefined
+): TError {
+  return diagnostic ? Object.assign(error, { providerDiagnostic: diagnostic }) : error
+}
diff --git a/src/shared/agent-session-journal-position.ts b/src/shared/agent-session-journal-position.ts
new file mode 100644
index 00000000000..9e317f1ee71
--- /dev/null
+++ b/src/shared/agent-session-journal-position.ts
@@ -0,0 +1,36 @@
+// The journal's own order: the sequence of the row that created an item, then the
+// item's place among that row's writes. Time never enters it — a row recovered
+// after a crash carries the provider's earlier clock at a later sequence.
+
+import type { AgentJournalPosition, AgentJournalRenderItem } from './agent-session-journal-types'
+import type { NativeChatMessage } from './native-chat-types'
+
+type PositionedItem = Pick<AgentJournalRenderItem, 'sequence' | 'sequenceIndex'>
+
+/** What every transcript row projected from a journal item carries, so a row
+ *  that changes shape (a question once answered) keeps its identity and place. */
+export function agentJournalItemRowOrigin(
+  item: AgentJournalRenderItem
+): Pick<NativeChatMessage, 'id' | 'timestamp' | 'source' | 'journalPosition'> {
+  return {
+    id: item.itemId,
+    timestamp: item.observedAt,
+    source: 'transcript',
+    journalPosition: agentJournalItemPosition(item)
+  }
+}
+
+export function agentJournalItemPosition(item: PositionedItem): AgentJournalPosition {
+  return { sequence: item.sequence, index: item.sequenceIndex ?? 0 }
+}
+
+export function compareAgentJournalPositions(
+  a: AgentJournalPosition,
+  b: AgentJournalPosition
+): number {
+  return a.sequence - b.sequence || a.index - b.index
+}
+
+export function compareAgentJournalItems(a: PositionedItem, b: PositionedItem): number {
+  return a.sequence - b.sequence || (a.sequenceIndex ?? 0) - (b.sequenceIndex ?? 0)
+}
diff --git a/src/shared/agent-session-journal-producer.ts b/src/shared/agent-session-journal-producer.ts
index ff51c6eaf57..2a5410eb275 100644
--- a/src/shared/agent-session-journal-producer.ts
+++ b/src/shared/agent-session-journal-producer.ts
@@ -25,7 +25,15 @@ import type {
 export function isRootAgentJournalItem(
   item: Pick<AgentJournalRenderItem, 'agentId'> | undefined
 ): boolean {
-  return item?.agentId == null
+  return agentJournalItemSubagentId(item) === null
+}
+
+/** The subagent that produced a row, or null when the session's own agent did.
+ *  Same reading of absence as {@link isRootAgentJournalItem}. */
+export function agentJournalItemSubagentId(
+  item: Pick<AgentJournalRenderItem, 'agentId'> | undefined
+): string | null {
+  return item?.agentId ?? null
 }
 
 /** Whether a write names its producer at all. One that does not revises a row
diff --git a/src/shared/agent-session-journal-schemas.test.ts b/src/shared/agent-session-journal-schemas.test.ts
index ec66caaa059..594d6a04b11 100644
--- a/src/shared/agent-session-journal-schemas.test.ts
+++ b/src/shared/agent-session-journal-schemas.test.ts
@@ -332,6 +332,57 @@ describe('optional notice metadata', () => {
   })
 })
 
+describe('typed failure facts', () => {
+  it('admits a status row and a submission with a fact, and the same rows without one', () => {
+    const failure = {
+      kind: 'providerStartFailed',
+      detail: { text: 'exit status 1', audience: 'log' }
+    }
+    expect(isAdmissibleAgentJournalItemBody({ kind: 'status', text: 'Stopped.', failure })).toBe(
+      true
+    )
+    expect(isAdmissibleAgentJournalItemBody({ kind: 'status', text: 'Stopped.' })).toBe(true)
+    const submission = {
+      clientMessageId: 'cm-1',
+      fence: 1,
+      payloadFingerprint: 'fp',
+      dispatchState: 'rejected',
+      providerItemId: null,
+      reason: 'Not sent.',
+      submittedAt: 1,
+      resolvedAt: 2
+    }
+    expect(isAdmissibleAgentJournalSubmission(submission)).toBe(true)
+    expect(isAdmissibleAgentJournalSubmission({ ...submission, rejection: failure })).toBe(true)
+  })
+
+  it("admits a refusal's details, and a row an earlier build wrote with its cause", () => {
+    const refused = (refusal: Record<string, unknown>) =>
+      isAdmissibleAgentJournalItemBody({
+        kind: 'status',
+        text: "Codex couldn't restart.",
+        failure: { kind: 'restartFailed', refusal }
+      })
+    expect(
+      refused({
+        code: 'agent_session_conflict',
+        details: { reason: 'claimConflicted', futureFact: 1 }
+      })
+    ).toBe(true)
+    expect(refused({ code: 'agent_session_conflict', cause: 'claimConflicted' })).toBe(true)
+  })
+
+  it('keeps a kind or audience a newer host writes admissible', () => {
+    expect(
+      isAdmissibleAgentJournalItemBody({
+        kind: 'status',
+        text: 'Stopped.',
+        failure: { kind: 'futureKind', detail: { text: 'x', audience: 'future' } }
+      })
+    ).toBe(true)
+  })
+})
+
 describe('optional tool annotations', () => {
   const body = { kind: 'tool-call', name: 'shell', input: null, state: 'completed' }
   it('admits old rows and rows with optional annotations without a new kind', () => {
diff --git a/src/shared/agent-session-journal-schemas.ts b/src/shared/agent-session-journal-schemas.ts
index 29271faa2b1..035bb7d1d01 100644
--- a/src/shared/agent-session-journal-schemas.ts
+++ b/src/shared/agent-session-journal-schemas.ts
@@ -18,6 +18,7 @@ import { AgentSessionContextUsageSchema } from './agent-session-context-usage-sc
 import type {
   AgentJournalItemBody,
   AgentJournalMessageItem,
+  AgentJournalResolution,
   AgentJournalRenderItem,
   AgentJournalSubmission
 } from './agent-session-journal-types'
@@ -147,6 +148,15 @@ const Question = z
 const Resolution = z.object({
   state: z.string().min(1),
   selectedOptionId: z.string().nullable(),
+  answers: z
+    .array(
+      z.object({
+        questionId: z.string(),
+        optionIds: z.array(z.string()),
+        other: z.string().optional()
+      })
+    )
+    .optional(),
   resolvedBy: z.string().nullable(),
   resolvedAt: z.number().nullable()
 })
@@ -168,7 +178,8 @@ const MessageBody = z.object({
   role: z.string().min(1),
   blocks: z.array(Block),
   // Open like roles: a send mode a newer build writes must not turn the row malformed.
-  sentAs: z.string().min(1).optional()
+  sentAs: z.string().min(1).optional(),
+  command: z.object({ name: z.string().min(1) }).optional()
 })
 
 const ThreadGoal = z.object({
@@ -190,6 +201,14 @@ const ThreadGoalState = z.union([
   z.object({ state: z.string() }).refine((value) => !['set', 'cleared'].includes(value.state))
 ])
 
+/** Open like `state`: a kind, audience or refusal detail a newer host writes must not turn the row
+ *  malformed; the fact reader is where an unplaceable one is dropped. */
+const FailureFact = z.object({
+  kind: z.string().min(1),
+  detail: z.object({ text: z.string(), audience: z.string().min(1) }).optional(),
+  refusal: z.object({ code: z.string().min(1), details: z.looseObject({}).optional() }).optional()
+})
+
 export const AgentJournalItemBodySchema = z.discriminatedUnion('kind', [
   MessageBody,
   z.object({
@@ -242,7 +261,8 @@ export const AgentJournalItemBodySchema = z.discriminatedUnion('kind', [
       })
       .optional(),
     providerFrame: ProviderFrame.optional(),
-    threadGoal: ThreadGoalState.optional()
+    threadGoal: ThreadGoalState.optional(),
+    failure: FailureFact.optional()
   }),
   z.object({
     kind: z.literal('turn'),
@@ -257,7 +277,8 @@ export const AgentJournalItemBodySchema = z.discriminatedUnion('kind', [
     requestedAt: z.number().finite().positive().optional(),
     completedAt: z.number().finite().positive().optional(),
     durationMs: z.number().finite().nonnegative().optional(),
-    contextUsage: AgentSessionContextUsageSchema.optional()
+    contextUsage: AgentSessionContextUsageSchema.optional(),
+    providerTurnId: z.string().min(1).optional()
   })
 ])
 
@@ -275,14 +296,23 @@ export const AgentJournalProducerLinkageFields = {
   attempt: z.number().int().optional()
 } as const
 
+/** Open like the other persisted vocabularies: a scope kind a newer host states must not turn
+ *  the row malformed. A reader places only `turn` with an id; anything else reads as `thread`. */
+export const AgentJournalTurnScopeSchema = z.object({
+  kind: z.string().min(1),
+  turnItemId: z.string().min(1).optional()
+})
+
 export const AgentJournalRenderItemSchema = z.object({
   itemId: z.string().min(1),
   revision: z.number().int(),
   body: AgentJournalItemBodySchema,
   sequence: z.number().int(),
+  sequenceIndex: z.number().int().nonnegative().optional(),
   observedAt: z.number(),
   recovered: z.literal(true).optional(),
   recoveredAt: z.number().optional(),
+  turnScope: AgentJournalTurnScopeSchema.optional(),
   ...AgentJournalProducerLinkageFields
 })
 
@@ -295,9 +325,18 @@ export const AgentJournalSubmissionSchema = z.object({
   reason: z.string().nullable(),
   submittedAt: z.number(),
   resolvedAt: z.number().nullable(),
-  recovered: z.literal(true).optional()
+  recovered: z.literal(true).optional(),
+  handoverRecorded: z.literal(true).optional(),
+  handedOverAt: z.number().optional(),
+  rejection: FailureFact.optional(),
+  // Listed, or the parse strips it: this schema drops unknown keys.
+  queuedMessageId: z.string().min(1).optional()
 })
 
+export function isAgentJournalResolution(value: unknown): value is AgentJournalResolution {
+  return Resolution.safeParse(value).success
+}
+
 export function isAdmissibleAgentJournalItemBody(value: unknown): value is AgentJournalItemBody {
   return AgentJournalItemBodySchema.safeParse(value).success
 }
diff --git a/src/shared/agent-session-journal-types.ts b/src/shared/agent-session-journal-types.ts
index a13f3b1f676..43ed994964f 100644
--- a/src/shared/agent-session-journal-types.ts
+++ b/src/shared/agent-session-journal-types.ts
@@ -7,7 +7,10 @@
 // rewritten in place, so a host that cannot read a row refuses to write the
 // journal rather than skipping or compacting past it.
 
+import type { UnreadAgentSessionFailureFact } from './agent-session-failure'
+import type { AgentSessionFailureRowWords } from './agent-session-failure-words'
 import type { AgentType } from './agent-status-types'
+import type { AgentSessionQuestionAnswer } from './agent-session-question-answer'
 import type { AgentJournalTurnOutcome } from './agent-turn-outcome'
 import type { NativeChatToolMetadata } from './native-chat-tool-identity'
 import type { AgentSessionContextUsage } from './agent-session-context-usage'
@@ -100,6 +103,9 @@ export type AgentJournalMessageItem = {
   /** Absent ⇒ an ordinary turn input. `goal` ⇒ the text was set as the thread
    *  goal's objective, and the provider pursues it without a turn of its own. */
   sentAs?: AgentJournalMessageSendMode
+  /** Present on a conversation command the user sent, such as `/compact`. The text is what the
+   *  user typed; this names the command so no reader parses it. Open like `sentAs`. */
+  command?: { name: string }
 }
 
 export type AgentJournalToolCallState = 'running' | 'completed' | 'failed'
@@ -128,8 +134,11 @@ export type AgentJournalResolutionState = (typeof AGENT_JOURNAL_RESOLUTION_STATE
  *  invoking the provider callback twice. */
 export type AgentJournalResolution = {
   state: AgentJournalResolutionState
-  /** Option id the winner picked; null while pending or cancelled. */
+  /** Option id the winner picked; null while pending or cancelled. For a question, the answer in the
+   *  packed form older clients read; `answers` is the same answer structured. */
   selectedOptionId: string | null
+  /** Question answers. Absent on approvals and on rows written before hosts recorded it. */
+  answers?: AgentSessionQuestionAnswer[]
   /** Opaque client identity of the resolver, for "answered on <device>". */
   resolvedBy: string | null
   resolvedAt: number | null
@@ -222,6 +231,9 @@ export type AgentJournalTurnLifecycle = {
   /** What the provider said about its context window during or after this turn.
    *  Usually written by a later revision, since the provider answers after the end. */
   contextUsage?: AgentSessionContextUsage
+  /** On a turn a conversation command opened: the provider turn that carried out the command,
+   *  once the provider opened one. Nothing else re-derives it after the command settles. */
+  providerTurnId?: string
 }
 
 /** Provider thread-goal lifecycle. Open like other persisted vocabularies: a
@@ -253,9 +265,8 @@ export type AgentJournalThreadGoalState =
   | { state: 'set'; goal: AgentJournalThreadGoal }
   | { state: 'cleared' }
 
-export type AgentJournalStatusItem = {
+type AgentJournalStatusItemFields = {
   kind: 'status'
-  text: string
   /** Optional display hints; unknown values retain the ordinary text fallback. */
   presentation?: string
   tone?: string
@@ -274,6 +285,19 @@ export type AgentJournalStatusItem = {
   threadGoal?: AgentJournalThreadGoalState
 }
 
+/** A status row that reports no failure; its text is its writer's own. */
+export type AgentJournalPlainStatusItem = AgentJournalStatusItemFields & {
+  text: string
+  failure?: undefined
+}
+
+export type AgentJournalStatusItem =
+  | AgentJournalPlainStatusItem
+  | (AgentJournalStatusItemFields &
+      /** A row that reports a failure: what failed, typed, beside the sentence older clients print,
+       *  both from `agentSessionFailureWords`. Absent on rows from older hosts. */
+      AgentSessionFailureRowWords)
+
 /** The durable record of one root turn. `running` exposes cancellation while
  *  the provider can still accept it; the item is revised to a terminal state,
  *  never tombstoned, so the endpoints survive. Timestamps are the execution
@@ -323,6 +347,25 @@ export type AgentJournalProducerLinkage = {
   attempt?: number
 }
 
+/** Which turn a row belongs to, stated by the write that created it. `turn` names the turn
+ *  record's journal key; `thread` is a row that belongs to no turn — a notice about the
+ *  conversation, or a message not yet delivered into one. Turn records themselves are `thread`. */
+export type AgentJournalTurnScope = { kind: 'turn'; turnItemId: string } | { kind: 'thread' }
+
+export const AGENT_JOURNAL_THREAD_SCOPE: AgentJournalTurnScope = { kind: 'thread' }
+
+/** Who produced a row and which turn it belongs to: what every item write states. */
+export type AgentJournalRowAttribution = AgentJournalProducerLinkage & {
+  turnScope: AgentJournalTurnScope
+}
+
+/** Where the journal placed an item: the sequence of the row that created it,
+ *  then its place among that row's writes. The timeline's only ordering key. */
+export type AgentJournalPosition = {
+  sequence: number
+  index: number
+}
+
 /** One reduced timeline entry. `sequence` orders the list; `observedAt` is the
  *  provider's own clock and may sort earlier than a later sequence when the row
  *  was recovered after a crash. */
@@ -331,11 +374,16 @@ export type AgentJournalRenderItem = AgentJournalProducerLinkage & {
   revision: number
   body: AgentJournalItemBody
   sequence: number
+  /** Place among the writes of the row at `sequence`, which one lifecycle batch
+   *  shares across every item it creates. Absent ⇒ 0, and on a host that predates it. */
+  sequenceIndex?: number
   observedAt: number
   /** Set when the row was appended by crash reconciliation rather than live. */
   recovered?: true
   /** When crash reconciliation wrote this revision; present exactly when `recovered` is. */
   recoveredAt?: number
+  /** Absent only from a host that predates it. */
+  turnScope?: AgentJournalTurnScope
 }
 
 // ─── Submissions ────────────────────────────────────────────────────────────
@@ -353,13 +401,29 @@ export type AgentJournalSubmission = {
   dispatchState: AgentJournalDispatchState
   /** Provider item identity adopted on accept; null otherwise. */
   providerItemId: string | null
-  /** Terminal reason on `rejected`. */
+  /** Terminal reason on `rejected`: a sentence a person can read, or one of the legacy markers
+   *  older clients already recognise. On `unknown`, the doubt marker. */
   reason: string | null
+  /** On `rejected`, why, typed; absent on rows from older hosts. */
+  rejection?: UnreadAgentSessionFailureFact
   submittedAt: number
   resolvedAt: number | null
   /** Set when crash reconciliation resolved the dispatch, not the provider. A live
    *  `unknown` is a send still outstanding; a recovered one outlived its writer. */
   recovered?: true
+  /** The host accepted this send to hand over later; absent on sends dispatched as they were
+   *  recorded (older hosts). With no `handedOverAt` yet, a pending one is still queued. */
+  handoverRecorded?: true
+  /** When the host handed it to the provider (its `dispatch{pending}` row). */
+  handedOverAt?: number
+  /** Host-only: the submission row's sequence, which tells which host process accepted it. */
+  acceptedSequence?: number
+  /** The queued draft this submission hands off; absent for a direct send. Read this, never
+   *  a draft id compared with `clientMessageId`. */
+  queuedMessageId?: string
+  /** Host-only: who asked for this turn — a person over the client send RPC, or Orca itself.
+   *  A person's turn is what ends a Stop's queue pause. */
+  origin?: 'client' | 'host'
 }
 
 /** Durable answer to "did my send land?", keyed by client message id. Only an
diff --git a/src/shared/agent-session-lease-adjudication.test.ts b/src/shared/agent-session-lease-adjudication.test.ts
index ff1020ece74..35e794efd0d 100644
--- a/src/shared/agent-session-lease-adjudication.test.ts
+++ b/src/shared/agent-session-lease-adjudication.test.ts
@@ -2,7 +2,6 @@ import { describe, expect, it } from 'vitest'
 import {
   adjudicateAgentSessionRestart,
   agentSessionLeaseAdmitsWriter,
-  classifyObservedAgentSessionSpawnToken,
   evaluateAgentSessionAcquisition,
   isProvenAliveProbe,
   isProvenDeadProbe,
@@ -91,7 +90,11 @@ describe('acquisition compare-and-swap', () => {
         handoffOperationId: null,
         probe: MATCHED
       })
-    ).toEqual({ decision: 'refused', code: 'agent_session_checkpoint_stale' })
+    ).toEqual({
+      decision: 'refused',
+      code: 'agent_session_checkpoint_stale',
+      details: { reason: 'fenceStale' }
+    })
     expect(acquire(held, MATCHED)).toEqual({ decision: 'granted', nextFence: 8 })
   })
 
@@ -108,7 +111,11 @@ describe('acquisition compare-and-swap', () => {
         handoffOperationId: null,
         probe: MATCHED
       })
-    ).toEqual({ decision: 'refused', code: 'agent_session_checkpoint_stale' })
+    ).toEqual({
+      decision: 'refused',
+      code: 'agent_session_checkpoint_stale',
+      details: { reason: 'fenceStale' }
+    })
   })
 
   it('never grants a second owner on expiry alone', () => {
@@ -116,11 +123,13 @@ describe('acquisition compare-and-swap', () => {
     const expired = lease({ leaseDeadlineAt: 1, lastRenewedAt: 1 })
     expect(acquire(expired, INDETERMINATE)).toEqual({
       decision: 'refused',
-      code: 'agent_session_ownership_unknown'
+      code: 'agent_session_ownership_unknown',
+      details: { reason: 'ownerUnproven' }
     })
     expect(acquire(expired, MATCHED)).toEqual({
       decision: 'refused',
-      code: 'agent_session_conflict'
+      code: 'agent_session_conflict',
+      details: { reason: 'ownerAlive' }
     })
     expect(acquire(expired, { outcome: 'pid-absent' })).toEqual({
       decision: 'granted',
@@ -131,24 +140,25 @@ describe('acquisition compare-and-swap', () => {
   it('refuses while unreconciled even with proof the owner is dead', () => {
     expect(acquire(lease({ unreconciled: true }), { outcome: 'pid-absent' })).toEqual({
       decision: 'refused',
-      code: 'execution_owner_reconciling'
+      code: 'execution_owner_reconciling',
+      details: { reason: 'hostReconciling' }
     })
   })
 
   it('keeps a conflicted claim conflicted regardless of proof', () => {
+    // Restart adjudication and recovery resolution are what retire it, once its owner is gone.
     expect(acquire(lease({ claimStatus: 'conflicted' }), { outcome: 'exit-observed' })).toEqual({
       decision: 'refused',
-      code: 'agent_session_conflict'
+      code: 'agent_session_conflict',
+      details: { reason: 'claimConflicted' }
     })
   })
 
-  it.each([
-    ['recovering', 'agent_session_ownership_unknown'],
-    ['manual-recovery', 'agent_session_ownership_unknown']
-  ] as const)('refuses acquisition in stage %s', (handoffStage, code) => {
-    expect(acquire(lease({ handoffStage }), { outcome: 'pid-absent' })).toEqual({
+  it('refuses acquisition in the recovering stage', () => {
+    expect(acquire(lease({ handoffStage: 'recovering' }), { outcome: 'pid-absent' })).toEqual({
       decision: 'refused',
-      code
+      code: 'agent_session_ownership_unknown',
+      details: { reason: 'ownerUnproven' }
     })
   })
 
@@ -161,7 +171,8 @@ describe('acquisition compare-and-swap', () => {
     })
     expect(acquire(mid, { outcome: 'reservation-unused' }, 'op-2')).toEqual({
       decision: 'refused',
-      code: 'agent_session_operation_conflict'
+      code: 'agent_session_operation_conflict',
+      details: { reason: 'handoffInFlight' }
     })
     expect(acquire(mid, { outcome: 'reservation-unused' }, 'op-1')).toEqual({
       decision: 'retry-reservation',
@@ -173,7 +184,8 @@ describe('acquisition compare-and-swap', () => {
     const reserved = lease({ ownerProcess: null, claimStatus: 'reserved', handoffStage: null })
     expect(acquire(reserved, INDETERMINATE)).toEqual({
       decision: 'refused',
-      code: 'agent_session_ownership_unknown'
+      code: 'agent_session_ownership_unknown',
+      details: { reason: 'ownerUnproven' }
     })
     expect(acquire(reserved, { outcome: 'reservation-unused' })).toEqual({
       decision: 'granted',
@@ -190,7 +202,7 @@ describe('restart reconciliation', () => {
         probe: MATCHED,
         observedAt: 9_000
       })
-    ).toMatchObject({ disposition: 'conflicted' })
+    ).toMatchObject({ disposition: 'recovering', stage: 'recovering' })
   })
 
   it('routes a surviving native owner to recovery instead of readopting a dead transport', () => {
@@ -210,17 +222,29 @@ describe('restart reconciliation', () => {
     expect(result).toEqual({
       disposition: 'evicted',
       nextFence: 8,
+      // The death happened between the last renewal and the probe.
       evidence: {
         kind: 'identity-mismatch',
         detail: 'mismatched process-start-time',
-        observedAt: 9_000
+        observedAt: 9_000,
+        ownerFence: 7,
+        lastProvenAliveAt: 500
       }
     })
   })
 
-  it('keeps re-asking about an unverifiable owner instead of evicting it', () => {
-    // A recorded exact identity can still be probed later; manual recovery is reserved
-    // for leases that name no process at all.
+  it('never records the owner alive after the probe that found it gone', () => {
+    // A clock stepped back across the restart would otherwise write an interval load rejects.
+    expect(
+      adjudicateAgentSessionRestart({
+        lease: lease({ lastRenewedAt: 9_500 }),
+        probe: { outcome: 'pid-absent' },
+        observedAt: 9_000
+      })
+    ).toMatchObject({ evidence: { observedAt: 9_000, lastProvenAliveAt: 9_000 } })
+  })
+
+  it('hands an unverifiable owner to recovery resolution instead of evicting it', () => {
     expect(
       adjudicateAgentSessionRestart({
         lease: lease({ leaseDeadlineAt: 1 }),
@@ -230,24 +254,21 @@ describe('restart reconciliation', () => {
     ).toEqual({ disposition: 'recovering', stage: 'recovering', reason: 'no answer' })
   })
 
-  it('keeps a pre-restart conflict conflicted while its owner cannot be proven gone', () => {
+  it('re-adjudicates a claim an older record marked conflicted by the owner it names', () => {
     expect(
       adjudicateAgentSessionRestart({
         lease: lease({ claimStatus: 'conflicted' }),
         probe: INDETERMINATE,
         observedAt: 9_000
       })
-    ).toEqual({ disposition: 'conflicted', reason: 'claim conflicted before restart' })
-  })
-
-  it('keeps a conflict conflicted when it names no process to prove anything about', () => {
+    ).toEqual({ disposition: 'recovering', stage: 'recovering', reason: 'no answer' })
     expect(
       adjudicateAgentSessionRestart({
         lease: lease({ claimStatus: 'conflicted', ownerProcess: null }),
-        probe: { outcome: 'pid-absent' },
+        probe: INDETERMINATE,
         observedAt: 9_000
       })
-    ).toEqual({ disposition: 'conflicted', reason: 'claim conflicted before restart' })
+    ).toEqual({ disposition: 'evicted', nextFence: 8, evidence: null })
   })
 
   it('frees a conflict whose named owner is proven gone', () => {
@@ -262,7 +283,13 @@ describe('restart reconciliation', () => {
     ).toEqual({
       disposition: 'evicted',
       nextFence: 8,
-      evidence: { kind: 'pid-absent', detail: 'recorded pid absent on host', observedAt: 9_000 }
+      evidence: {
+        kind: 'pid-absent',
+        detail: 'recorded pid absent on host',
+        observedAt: 9_000,
+        ownerFence: 7,
+        lastProvenAliveAt: 500
+      }
     })
   })
 
@@ -283,34 +310,37 @@ describe('restart reconciliation', () => {
     ).toEqual({ disposition: 'free', reason: 'lease has no owner and no reservation' })
   })
 
-  it('does not infer an ownerless native reservation is unused from restart alone', () => {
-    const reserved = lease({ ownerProcess: null, claimStatus: 'reserved' })
-    expect(
-      adjudicateAgentSessionRestart({ lease: reserved, probe: INDETERMINATE, observedAt: 9_000 })
-    ).toEqual({
-      disposition: 'recovering',
-      stage: 'manual-recovery',
-      reason: 'reservation with no proven process'
-    })
-  })
-
-  it('frees an ownerless reservation only when a probe proves nothing ever spawned', () => {
-    // A child can outlive the runtime that reserved it, so absence needs proof.
-    const reserved = lease({ ownerProcess: null, claimStatus: 'reserved' })
-    expect(
-      adjudicateAgentSessionRestart({
-        lease: reserved,
-        probe: { outcome: 'reservation-unused' },
-        observedAt: 9_000
+  it.each([null, 'recovering'] as const)(
+    'releases an ownerless reservation at stage %s, with evidence only when a scan proved nothing spawned',
+    (handoffStage) => {
+      // A child spawned before its identity was recorded lost its stdio with the runtime that
+      // crashed, and a token scan is the only proof there can be.
+      const reserved = lease({ ownerProcess: null, claimStatus: 'reserved', handoffStage })
+      expect(
+        adjudicateAgentSessionRestart({ lease: reserved, probe: INDETERMINATE, observedAt: 9_000 })
+      ).toEqual({ disposition: 'evicted', nextFence: 8, evidence: null })
+      expect(
+        adjudicateAgentSessionRestart({
+          lease: reserved,
+          probe: { outcome: 'reservation-unused' },
+          observedAt: 9_000
+        })
+      ).toEqual({
+        disposition: 'evicted',
+        nextFence: 8,
+        // The proof is about this reservation's own fence.
+        evidence: {
+          kind: 'pid-absent',
+          detail: 'reservation never spawned',
+          observedAt: 9_000,
+          ownerFence: 7
+        }
       })
-    ).toMatchObject({ disposition: 'evicted', nextFence: 8 })
-    expect(
-      adjudicateAgentSessionRestart({ lease: reserved, probe: INDETERMINATE, observedAt: 9_000 })
-    ).toMatchObject({ disposition: 'recovering', stage: 'manual-recovery' })
-  })
+    }
+  )
 })
 
-describe('writer admission and orphan spawn tokens', () => {
+describe('writer admission', () => {
   it('admits a writer only when reconciled, settled, live, and holding a process', () => {
     expect(agentSessionLeaseAdmitsWriter(lease())).toBe(true)
     expect(agentSessionLeaseAdmitsWriter(lease({ unreconciled: true }))).toBe(false)
@@ -318,18 +348,4 @@ describe('writer admission and orphan spawn tokens', () => {
     expect(agentSessionLeaseAdmitsWriter(lease({ claimStatus: 'reserved' }))).toBe(false)
     expect(agentSessionLeaseAdmitsWriter(lease({ ownerProcess: null }))).toBe(false)
   })
-
-  it('calls a spawn token with no matching lease an orphan', () => {
-    const leases = [lease(), lease({ sessionId: 'session-beta-1', reservedSpawnToken: 'spawn-b' })]
-    expect(classifyObservedAgentSessionSpawnToken({ spawnToken: 'spawn-a', leases })).toBe('owned')
-    expect(classifyObservedAgentSessionSpawnToken({ spawnToken: 'spawn-b', leases })).toBe('owned')
-    expect(classifyObservedAgentSessionSpawnToken({ spawnToken: 'spawn-z', leases })).toBe('orphan')
-  })
-
-  it('still recognises an owner whose reservation token was cleared after proving', () => {
-    const proved = lease({ reservedSpawnToken: null })
-    expect(
-      classifyObservedAgentSessionSpawnToken({ spawnToken: 'spawn-a', leases: [proved] })
-    ).toBe('owned')
-  })
 })
diff --git a/src/shared/agent-session-lease-adjudication.ts b/src/shared/agent-session-lease-adjudication.ts
index 6c1d07820ad..271b136456f 100644
--- a/src/shared/agent-session-lease-adjudication.ts
+++ b/src/shared/agent-session-lease-adjudication.ts
@@ -1,10 +1,10 @@
 /**
  * Single-writer lease adjudication.
  *
- * Every decision here fails closed: expiry alone never grants a second owner, an unverifiable
- * process counts as possibly alive, and a stage that cannot prove an owner keeps re-asking —
- * or, when it names no process at all, ends in manual recovery — rather than handing the
- * session to the other runtime. This is the opposite polarity
+ * Every decision here fails closed: expiry alone never grants a second owner, and an
+ * unverifiable process counts as possibly alive until recovery resolution concludes about it. A
+ * lease that names no process at all is released: nothing was recorded that could be holding it.
+ * This is the opposite polarity
  * from daemon adoption checks, which fail open on a missing start time — a wrong answer there
  * refuses an adoption, a wrong answer here creates two writers on one provider session.
  */
@@ -15,7 +15,10 @@ import type {
   AgentSessionHandoffStage,
   AgentSessionLease
 } from './agent-session-record'
-import type { AgentSessionOwnerVerdict } from './agent-session-wire-refusals'
+import type {
+  AgentSessionOwnerVerdict,
+  AgentSessionRefusalDetailsByCode
+} from './agent-session-wire-refusals'
 
 export type AgentSessionIdentityMatchField = 'process-start-time' | 'spawn-token'
 
@@ -44,23 +47,20 @@ export type AgentSessionAcquisitionDecision =
   | { decision: 'granted'; nextFence: number }
   /** The same acquisition operation re-entering its own reservation; no new fence, no new spawn. */
   | { decision: 'retry-reservation'; fence: number }
-  | { decision: 'refused'; code: AgentSessionLeaseRefusalCode }
+  | {
+      [C in AgentSessionLeaseRefusalCode]: {
+        decision: 'refused'
+        code: C
+        details: AgentSessionRefusalDetailsByCode[C]
+      }
+    }[AgentSessionLeaseRefusalCode]
 
 export type AgentSessionRestartAdjudication =
-  /** A journal settlement latch survives restart without changing its handoff stage. */
-  | { disposition: 'settlement-pending' }
   /** Nothing is outstanding — no owner, no reservation. Clear any latched stage; the fence stays. */
   | { disposition: 'free'; reason: string }
-  | { disposition: 'evicted'; nextFence: number; evidence: AgentSessionDeathEvidence }
+  /** `evidence` is null when nothing proved the owner gone: it was never recorded. */
+  | { disposition: 'evicted'; nextFence: number; evidence: AgentSessionDeathEvidence | null }
   | { disposition: 'recovering'; stage: AgentSessionHandoffStage; reason: string }
-  | { disposition: 'conflicted'; reason: string }
-
-export function agentSessionRestartEvictionSettlementId(
-  lease: Pick<AgentSessionLease, 'sessionId'>,
-  eviction: Extract<AgentSessionRestartAdjudication, { disposition: 'evicted' }>
-): string {
-  return `restart-eviction:${lease.sessionId}:${eviction.nextFence}`
-}
 
 export function isProvenDeadProbe(probe: AgentSessionOwnerProbe): boolean {
   return (
@@ -80,21 +80,29 @@ export function isProvenAliveProbe(probe: AgentSessionOwnerProbe): boolean {
 
 function deathEvidenceFor(
   probe: AgentSessionOwnerProbe,
-  observedAt: number
+  observedAt: number,
+  lease: AgentSessionLease
 ): AgentSessionDeathEvidence | null {
+  // Capped so a clock that stepped back across the restart still writes a valid interval.
+  const interval = {
+    observedAt,
+    ownerFence: lease.runtimeFence,
+    lastProvenAliveAt: Math.min(lease.lastRenewedAt, observedAt)
+  }
   if (probe.outcome === 'exit-observed') {
-    return { kind: 'exit-observed', detail: 'observed process exit', observedAt }
+    return { kind: 'exit-observed', detail: 'observed process exit', ...interval }
   }
   if (probe.outcome === 'pid-absent') {
-    return { kind: 'pid-absent', detail: 'recorded pid absent on host', observedAt }
+    return { kind: 'pid-absent', detail: 'recorded pid absent on host', ...interval }
   }
   if (probe.outcome === 'identity-mismatch') {
-    return { kind: 'identity-mismatch', detail: `mismatched ${probe.field}`, observedAt }
+    return { kind: 'identity-mismatch', detail: `mismatched ${probe.field}`, ...interval }
   }
   return null
 }
 
-/** The store releases a lease only on proven exit or eviction; anything held or mid-handoff may run. */
+/** `exited` only for a lease released on death evidence; one recovery released without proof, like
+ *  anything held or mid-handoff, may still be running. */
 export function agentSessionLeaseOwnerVerdict(lease: AgentSessionLease): AgentSessionOwnerVerdict {
   if (agentSessionLeaseAdmitsWriter(lease)) {
     return 'live'
@@ -102,11 +110,17 @@ export function agentSessionLeaseOwnerVerdict(lease: AgentSessionLease): AgentSe
   return lease.claimStatus === 'released' &&
     lease.handoffStage === null &&
     lease.ownerProcess === null &&
-    lease.reservedSpawnToken === null
+    lease.reservedSpawnToken === null &&
+    lease.deathEvidence !== null
     ? 'exited'
     : 'unverifiable'
 }
 
+/** Nothing holds this lease: released, no handoff in flight, and reconciled since the last restart. */
+export function agentSessionLeaseIsReleased(lease: AgentSessionLease): boolean {
+  return !lease.unreconciled && lease.claimStatus === 'released' && lease.handoffStage === null
+}
+
 /** True when the recorded owner may write right now. Used by every mutating path in later parts. */
 export function agentSessionLeaseAdmitsWriter(lease: AgentSessionLease): boolean {
   return (
@@ -133,22 +147,43 @@ export function evaluateAgentSessionAcquisition(args: {
 }): AgentSessionAcquisitionDecision {
   const { lease, expectedFence, handoffOperationId, probe } = args
   if (lease.unreconciled) {
-    return { decision: 'refused', code: 'execution_owner_reconciling' }
+    return {
+      decision: 'refused',
+      code: 'execution_owner_reconciling',
+      details: { reason: 'hostReconciling' }
+    }
   }
   if (!isAgentSessionFenceCurrent(lease, expectedFence)) {
-    return { decision: 'refused', code: 'agent_session_checkpoint_stale' }
+    return {
+      decision: 'refused',
+      code: 'agent_session_checkpoint_stale',
+      details: { reason: 'fenceStale' }
+    }
   }
   if (lease.claimStatus === 'conflicted') {
-    return { decision: 'refused', code: 'agent_session_conflict' }
+    // Why: the user's own terminal agent; restart adjudication and recovery retire it once gone.
+    return {
+      decision: 'refused',
+      code: 'agent_session_conflict',
+      details: { reason: 'claimConflicted' }
+    }
   }
-  if (lease.handoffStage === 'recovering' || lease.handoffStage === 'manual-recovery') {
-    // Why: no stage expires into an owner; recovery is resolved by proof or by the user.
-    return { decision: 'refused', code: 'agent_session_ownership_unknown' }
+  if (lease.handoffStage === 'recovering') {
+    // Why: no stage expires into an owner; recovery resolution concludes about it first.
+    return {
+      decision: 'refused',
+      code: 'agent_session_ownership_unknown',
+      details: { reason: 'ownerUnproven' }
+    }
   }
   if (lease.handoffStage !== null && lease.handoffOperationId !== null) {
     if (handoffOperationId !== lease.handoffOperationId) {
       // Why: the retry key is operation id + fence + stage; a different id is a different intent.
-      return { decision: 'refused', code: 'agent_session_operation_conflict' }
+      return {
+        decision: 'refused',
+        code: 'agent_session_operation_conflict',
+        details: { reason: 'handoffInFlight' }
+      }
     }
     if (
       lease.ownerProcess === null &&
@@ -163,19 +198,24 @@ export function evaluateAgentSessionAcquisition(args: {
     if (!isProvenDeadProbe(probe)) {
       // Why: a lapsed deadline means Orca stopped hearing from the owner, not that the child
       // stopped editing files and spending tokens.
-      return {
-        decision: 'refused',
-        code: isProvenAliveProbe(probe)
-          ? 'agent_session_conflict'
-          : 'agent_session_ownership_unknown'
-      }
+      return isProvenAliveProbe(probe)
+        ? { decision: 'refused', code: 'agent_session_conflict', details: { reason: 'ownerAlive' } }
+        : {
+            decision: 'refused',
+            code: 'agent_session_ownership_unknown',
+            details: { reason: 'ownerUnproven' }
+          }
     }
     return { decision: 'granted', nextFence: nextAgentSessionFence(lease) }
   }
   if (lease.claimStatus === 'reserved' && probe.outcome !== 'reservation-unused') {
     // Why: a reservation with no proven process is not a free lease — the crash may have lost
     // the race with the spawn rather than beaten it.
-    return { decision: 'refused', code: 'agent_session_ownership_unknown' }
+    return {
+      decision: 'refused',
+      code: 'agent_session_ownership_unknown',
+      details: { reason: 'ownerUnproven' }
+    }
   }
   return { decision: 'granted', nextFence: nextAgentSessionFence(lease) }
 }
@@ -190,44 +230,30 @@ export function adjudicateAgentSessionRestart(args: {
   observedAt: number
 }): AgentSessionRestartAdjudication {
   const { lease, probe, observedAt } = args
-  if (lease.claimStatus === 'conflicted') {
-    const conflictedOwnerDeath =
-      lease.ownerProcess === null ? null : deathEvidenceFor(probe, observedAt)
-    if (conflictedOwnerDeath) {
-      // Why: the conflict names one specific process. Present-time proof that THAT process is gone
-      // leaves no claimant to protect, and a conflict with no exit is a session the user can never
-      // open again. Without such proof the conflict still outlives the process that observed it.
-      return {
-        disposition: 'evicted',
-        nextFence: nextAgentSessionFence(lease),
-        evidence: conflictedOwnerDeath
-      }
-    }
-    return { disposition: 'conflicted', reason: 'claim conflicted before restart' }
-  }
   if (lease.ownerProcess === null) {
-    if (lease.settlementRetryRequired) {
-      // A watched provider death can leave terminal rows unsettled. This latch is not owner
-      // uncertainty and must survive restart until the journal settlement is durably accepted.
-      return { disposition: 'settlement-pending' }
-    }
-    if (lease.reservedSpawnToken === null && lease.claimStatus !== 'reserved') {
+    if (lease.reservedSpawnToken === null && lease.claimStatus === 'released') {
       // Why: the spawn token is minted before the child and is the only thing a child could be
       // carrying. With no owner and no token nothing can hold this lease, so it is already free —
       // treating it as an unproven reservation is what re-latches every released record on restart.
       return { disposition: 'free', reason: 'lease has no owner and no reservation' }
     }
-    if (probe.outcome === 'reservation-unused') {
-      return {
-        disposition: 'evicted',
-        nextFence: nextAgentSessionFence(lease),
-        evidence: { kind: 'pid-absent', detail: 'reservation never spawned', observedAt }
-      }
-    }
+    // Why: a child spawned before its identity was recorded lost its stdio with the runtime that
+    // crashed, so nothing can drive it. A token scan that proves no child is the only evidence there
+    // can be; without it the lease is released anyway. A live child still carrying the token is
+    // never signalled: the token is inherited by every descendant, so it cannot prove which one is
+    // the provider child.
     return {
-      disposition: 'recovering',
-      stage: 'manual-recovery',
-      reason: 'reservation with no proven process'
+      disposition: 'evicted',
+      nextFence: nextAgentSessionFence(lease),
+      evidence:
+        probe.outcome === 'reservation-unused'
+          ? {
+              kind: 'pid-absent',
+              detail: 'reservation never spawned',
+              observedAt,
+              ownerFence: lease.runtimeFence
+            }
+          : null
     }
   }
   if (isProvenAliveProbe(probe)) {
@@ -239,32 +265,15 @@ export function adjudicateAgentSessionRestart(args: {
       reason: 'owner outlived the runtime that held its transport'
     }
   }
-  const evidence = deathEvidenceFor(probe, observedAt)
+  const evidence = deathEvidenceFor(probe, observedAt, lease)
   if (evidence) {
     return { disposition: 'evicted', nextFence: nextAgentSessionFence(lease), evidence }
   }
   return {
-    // Why: an exact recorded identity can still be probed later, so the system keeps
-    // re-asking; only a record naming nobody (above) needs the user to decide.
+    // Why: recovery resolution, which runs next, owns the verdict on a recorded identity.
     disposition: 'recovering',
     stage: 'recovering',
     reason:
       probe.outcome === 'indeterminate' ? probe.reason : 'process identity could not be verified'
   }
 }
-
-/**
- * A process carrying an Orca spawn token with no matching lease is an orphan: stop it, never
- * adopt it. Neither age nor CPU is evidence — only a token match justifies acting on a process.
- */
-export function classifyObservedAgentSessionSpawnToken(args: {
-  spawnToken: string
-  leases: readonly AgentSessionLease[]
-}): 'owned' | 'orphan' {
-  const owned = args.leases.some(
-    (lease) =>
-      lease.reservedSpawnToken === args.spawnToken ||
-      lease.ownerProcess?.spawnToken === args.spawnToken
-  )
-  return owned ? 'owned' : 'orphan'
-}
diff --git a/src/shared/agent-session-legacy-handoff-lease.test.ts b/src/shared/agent-session-legacy-handoff-lease.test.ts
index b38c411fc6d..49a10558b81 100644
--- a/src/shared/agent-session-legacy-handoff-lease.test.ts
+++ b/src/shared/agent-session-legacy-handoff-lease.test.ts
@@ -3,6 +3,7 @@ import {
   leaseCarriesLegacyHandoffValues,
   normalizeLegacyHandoffLease,
   normalizeLegacyHandoffRecord,
+  terminalOwnerRefusalMessage,
   type PersistedAgentSessionLease
 } from './agent-session-legacy-handoff-lease'
 import type { AgentSessionClaimStatus, AgentSessionHandoffStage } from './agent-session-record'
@@ -12,12 +13,7 @@ import {
 } from './agent-session-record.test-fixture'
 
 const CLAIMS: AgentSessionClaimStatus[] = ['reserved', 'live', 'conflicted', 'released']
-const STAGES: (AgentSessionHandoffStage | null)[] = [
-  null,
-  'new-owner-proving',
-  'recovering',
-  'manual-recovery'
-]
+const STAGES: (AgentSessionHandoffStage | null)[] = [null, 'new-owner-proving', 'recovering']
 
 function persisted(overrides: Partial<PersistedAgentSessionLease>): PersistedAgentSessionLease {
   return { ...agentSessionLeaseFixture(), ...overrides }
@@ -36,7 +32,7 @@ describe('normalizing a lease the removed terminal handoff wrote', () => {
     }
   })
 
-  it.each(['preparing', 'old-owner-stopped'] as const)(
+  it.each(['preparing', 'old-owner-stopped', 'manual-recovery'] as const)(
     'maps the %s stage to recovering and keeps its operation id',
     (handoffStage) => {
       const lease = persisted({ handoffStage, handoffOperationId: 'op-handoff' })
@@ -85,3 +81,24 @@ describe('normalizing a lease the removed terminal handoff wrote', () => {
     })
   })
 })
+
+describe('the refusal for a chat a terminal agent holds', () => {
+  const owner = { hostId: 'local', pid: 4242, spawnToken: 'token' }
+
+  it('names the process only when its start time can tell it from a reused pid', () => {
+    const verifiable = agentSessionLeaseFixture({
+      claimStatus: 'conflicted',
+      ownerProcess: { ...owner, processStartTimeMs: 1_000 }
+    })
+    const reusable = agentSessionLeaseFixture({
+      claimStatus: 'conflicted',
+      ownerProcess: { ...owner, processStartTimeMs: null }
+    })
+    expect(terminalOwnerRefusalMessage(verifiable)).toBe(
+      'This chat is still open in a terminal agent (process 4242). Quit that agent to continue the chat here.'
+    )
+    expect(terminalOwnerRefusalMessage(reusable)).toBe(
+      'This chat is still open in a terminal agent. Quit that agent to continue the chat here.'
+    )
+  })
+})
diff --git a/src/shared/agent-session-legacy-handoff-lease.ts b/src/shared/agent-session-legacy-handoff-lease.ts
index af2216d0ab3..ea4ef2909e8 100644
--- a/src/shared/agent-session-legacy-handoff-lease.ts
+++ b/src/shared/agent-session-legacy-handoff-lease.ts
@@ -1,9 +1,10 @@
 /**
- * Lease values only the removed terminal handoff wrote.
+ * Lease values only older builds wrote.
  *
- * Records an older build persisted can still carry a terminal owner (`runtimeKind: 'tui'`) or a
- * handoff stage (`preparing`, `old-owner-stopped`). They are accepted on disk and mapped here, once,
- * at decode, so no in-memory lease holds a value nothing in this build produces.
+ * Records an older build persisted can still carry a terminal owner (`runtimeKind: 'tui'`), a
+ * handoff stage (`preparing`, `old-owner-stopped`), or the removed ownerless-reservation latch
+ * (`manual-recovery`). They are accepted on disk and mapped here, once, at decode, so no in-memory
+ * lease holds a value nothing in this build produces.
  */
 
 import type {
@@ -14,7 +15,7 @@ import type {
 } from './agent-session-record'
 
 type LegacyHandoffRuntimeKind = 'tui'
-type LegacyHandoffStage = 'preparing' | 'old-owner-stopped'
+type LegacyHandoffStage = 'preparing' | 'old-owner-stopped' | 'manual-recovery'
 
 export type PersistedAgentSessionRuntimeKind =
   | AgentSessionOwnerRuntimeKind
@@ -49,21 +50,21 @@ export function isPersistedAgentSessionHandoffStage(
   )
 }
 
+function isLegacyHandoffStage(
+  stage: PersistedAgentSessionHandoffStage | null
+): stage is LegacyHandoffStage {
+  return stage === 'preparing' || stage === 'old-owner-stopped' || stage === 'manual-recovery'
+}
+
 export function leaseCarriesLegacyHandoffValues(lease: PersistedAgentSessionLease): boolean {
-  return (
-    lease.runtimeKind === 'tui' ||
-    lease.handoffStage === 'preparing' ||
-    lease.handoffStage === 'old-owner-stopped'
-  )
+  return lease.runtimeKind === 'tui' || isLegacyHandoffStage(lease.handoffStage)
 }
 
 /** Identity for every lease this build writes. */
 export function normalizeLegacyHandoffLease(lease: PersistedAgentSessionLease): AgentSessionLease {
   const { runtimeKind, handoffStage } = lease
-  const stage =
-    handoffStage === 'preparing' || handoffStage === 'old-owner-stopped'
-      ? 'recovering'
-      : handoffStage
+  // Why: every one of these awaited proof about an owner, which is what `recovering` resolves.
+  const stage = isLegacyHandoffStage(handoffStage) ? 'recovering' : handoffStage
   if (runtimeKind === 'native') {
     return { ...lease, runtimeKind, handoffStage: stage }
   }
@@ -77,6 +78,14 @@ export function normalizeLegacyHandoffLease(lease: PersistedAgentSessionLease):
   }
 }
 
+/** A `conflicted` claim is a terminal agent an older build recorded, and only its exit frees the chat. */
+export function terminalOwnerRefusalMessage(lease: AgentSessionLease): string {
+  // Why: without a start time the pid may since belong to an unrelated process.
+  const owner = lease.ownerProcess
+  const process = owner?.processStartTimeMs != null ? ` (process ${owner.pid})` : ''
+  return `This chat is still open in a terminal agent${process}. Quit that agent to continue the chat here.`
+}
+
 /** The in-memory record, plus whether decode changed anything the store must write back. */
 export function normalizeLegacyHandoffRecord(record: PersistedAgentSessionRecord): {
   record: AgentSessionRecord
diff --git a/src/shared/agent-session-mutation-envelope.test.ts b/src/shared/agent-session-mutation-envelope.test.ts
index e929d628de5..028de74935a 100644
--- a/src/shared/agent-session-mutation-envelope.test.ts
+++ b/src/shared/agent-session-mutation-envelope.test.ts
@@ -109,16 +109,15 @@ describe('admitAgentSessionMutation', () => {
     expect(admission.decision).toBe('replay')
   })
 
-  it('refuses a stale fence and hands back the current one', () => {
-    const admission = admitAgentSessionMutation({
-      ...base,
-      envelope: envelope({ expectedRuntimeFence: 3 }),
-      ledger: ADMIT('f'.repeat(64))
-    })
-    expect(admission).toMatchObject({
-      decision: 'refused',
-      refusal: { code: 'agent_session_checkpoint_stale', currentFence: 4 }
-    })
+  it('admits a writer whatever fence the client last saw', () => {
+    for (const expectedRuntimeFence of [3, 5, null]) {
+      const admission = admitAgentSessionMutation({
+        ...base,
+        envelope: envelope({ expectedRuntimeFence }),
+        ledger: ADMIT('f'.repeat(64))
+      })
+      expect(admission, String(expectedRuntimeFence)).toMatchObject({ decision: 'admit' })
+    }
   })
 
   it('refuses a writer while the lease is unreconciled', () => {
@@ -164,11 +163,18 @@ describe('admitAgentSessionMutation', () => {
   it('surfaces a ledger refusal verbatim', () => {
     const admission = admitAgentSessionMutation({
       ...base,
-      ledger: { decision: 'refused', code: 'agent_session_operation_expired' }
+      ledger: {
+        decision: 'refused',
+        code: 'agent_session_operation_expired',
+        details: { reason: 'operationExpired' }
+      }
     })
     expect(admission).toMatchObject({
       decision: 'refused',
-      refusal: { code: 'agent_session_operation_expired' }
+      refusal: {
+        code: 'agent_session_operation_expired',
+        details: { reason: 'operationExpired' }
+      }
     })
   })
 })
diff --git a/src/shared/agent-session-mutation-envelope.ts b/src/shared/agent-session-mutation-envelope.ts
index 83fdb65e9ae..770c184b562 100644
--- a/src/shared/agent-session-mutation-envelope.ts
+++ b/src/shared/agent-session-mutation-envelope.ts
@@ -11,12 +11,11 @@ import type {
   AgentSessionOperationDecision,
   AgentSessionOperationRow
 } from './agent-session-operation-ledger'
-import {
-  agentSessionLeaseAdmitsWriter,
-  isAgentSessionFenceCurrent
-} from './agent-session-lease-adjudication'
+import { agentSessionLeaseAdmitsWriter } from './agent-session-lease-adjudication'
 import type { AgentSessionLease } from './agent-session-record'
+import { terminalOwnerRefusalMessage } from './agent-session-legacy-handoff-lease'
 import type { AgentSessionMutationEnvelope, AgentSessionWireRefusal } from './agent-session-wire'
+import { refuse } from './agent-session-wire-refusals'
 
 /**
  * Stable digest over the fields that define what this call DOES. Keys are
@@ -66,11 +65,11 @@ export function agentSessionFingerprintConflict(
 ): AgentSessionWireRefusal | null {
   return envelope.payloadFingerprint === hostFingerprint
     ? null
-    : {
-        code: 'agent_session_operation_conflict',
-        message:
-          'The payload does not match the fingerprint the client declared for this operation.'
-      }
+    : refuse(
+        'agent_session_operation_conflict',
+        { reason: 'fingerprintMismatch' },
+        'The payload does not match the fingerprint the client declared for this operation.'
+      )
 }
 
 export type AgentSessionMutationAdmission =
@@ -81,10 +80,11 @@ export type AgentSessionMutationAdmission =
 
 /**
  * Fixed order: fingerprint agreement, then the ledger (so a retry replays
- * before anything else can refuse it), then the lease, then the fence. Putting
- * the ledger ahead of the fence is deliberate — a retry that crossed an owner
- * change must still return its recorded answer instead of a stale-checkpoint
- * refusal the client would then resend as a second effect.
+ * before anything else can refuse it), then the lease.
+ *
+ * `expectedRuntimeFence` is not checked: each write names its own target (a
+ * turn, an item revision, an epoch) or is last-writer-wins, so an owner restart
+ * the client has not seen yet refuses nothing. Older hosts still check it.
  */
 export function admitAgentSessionMutation(input: {
   envelope: AgentSessionMutationEnvelope
@@ -93,6 +93,9 @@ export function admitAgentSessionMutation(input: {
   /** Decision from the durable ledger, evaluated under `hostFingerprint`. */
   ledger: AgentSessionOperationDecision
   lease: AgentSessionLease
+  /** A write to the conversation, not to the provider child: a send is accepted and a Stop
+   *  withdraws queued messages whoever owns the child, so the lease does not admit them. */
+  conversationWrite?: true
 }): AgentSessionMutationAdmission {
   const { envelope, lease, ledger } = input
   const mismatch = agentSessionFingerprintConflict(envelope, input.hostFingerprint)
@@ -102,32 +105,23 @@ export function admitAgentSessionMutation(input: {
   if (ledger.decision === 'refused') {
     return {
       decision: 'refused',
-      refusal: {
-        code: ledger.code,
-        message: `Operation ${envelope.clientOperationId} was refused: ${ledger.code}.`
-      }
+      refusal: refuse(
+        ledger.code,
+        ledger.details,
+        `Operation ${envelope.clientOperationId} was refused: ${ledger.code}.`
+      )
     }
   }
   if (ledger.decision === 'replay') {
     return { decision: 'replay', row: ledger.row }
   }
+  if (input.conversationWrite) {
+    return { decision: 'admit', row: ledger.row }
+  }
   const leaseRefusal = refuseUnlessWriterAdmitted(lease)
   if (leaseRefusal) {
     return { decision: 'refused', refusal: leaseRefusal }
   }
-  if (
-    envelope.expectedRuntimeFence === null ||
-    !isAgentSessionFenceCurrent(lease, envelope.expectedRuntimeFence)
-  ) {
-    return {
-      decision: 'refused',
-      refusal: {
-        code: 'agent_session_checkpoint_stale',
-        message: `Expected runtime fence ${envelope.expectedRuntimeFence ?? 'none'}; the session is at ${lease.runtimeFence}.`,
-        currentFence: lease.runtimeFence
-      }
-    }
-  }
   return { decision: 'admit', row: ledger.row }
 }
 
@@ -138,22 +132,31 @@ function refuseUnlessWriterAdmitted(lease: AgentSessionLease): AgentSessionWireR
     return null
   }
   if (lease.unreconciled) {
-    return {
-      code: 'execution_owner_reconciling',
-      message: 'This host has not yet adjudicated the session lease.'
-    }
+    return refuse(
+      'execution_owner_reconciling',
+      { reason: 'hostReconciling' },
+      'This host has not yet adjudicated the session lease.'
+    )
   }
   if (lease.handoffStage !== null) {
-    return {
-      code: 'agent_session_conflict',
-      message:
-        lease.handoffStage === 'new-owner-proving'
-          ? 'The chat is still starting.'
-          : "Orca has not yet confirmed that this chat's previous agent process stopped. Reopen the chat to check again."
+    if (lease.claimStatus === 'conflicted') {
+      return refuse(
+        'agent_session_conflict',
+        { reason: 'claimConflicted' },
+        terminalOwnerRefusalMessage(lease)
+      )
     }
+    return lease.handoffStage === 'new-owner-proving'
+      ? refuse('agent_session_conflict', { reason: 'chatStarting' }, 'The chat is still starting.')
+      : refuse(
+          'agent_session_conflict',
+          { reason: 'ownerUnproven' },
+          "Orca has not yet confirmed that this chat's previous agent process stopped. Reopen the chat to check again."
+        )
   }
-  return {
-    code: 'agent_session_ownership_unknown',
-    message: 'The session has no live owner to accept writes.'
-  }
+  return refuse(
+    'agent_session_ownership_unknown',
+    { reason: 'noLiveOwner' },
+    'The session has no live owner to accept writes.'
+  )
 }
diff --git a/src/shared/agent-session-operation-ledger.test.ts b/src/shared/agent-session-operation-ledger.test.ts
index 0710eade461..ef10fac8f2b 100644
--- a/src/shared/agent-session-operation-ledger.test.ts
+++ b/src/shared/agent-session-operation-ledger.test.ts
@@ -64,7 +64,8 @@ describe('operation admission', () => {
     admit(rows)
     expect(evaluate(rows, { fingerprint: 'fp-2' })).toEqual({
       decision: 'refused',
-      code: 'agent_session_operation_conflict'
+      code: 'agent_session_operation_conflict',
+      details: { reason: 'operationIdReused' }
     })
   })
 
@@ -78,14 +79,19 @@ describe('operation admission', () => {
     const rows = new Map<string, AgentSessionOperationRow>()
     expect(evaluate(rows, { operationId: 'not-an-operation-id' })).toEqual({
       decision: 'refused',
-      code: 'agent_session_operation_invalid'
+      code: 'agent_session_operation_invalid',
+      details: { reason: 'operationIdInvalid' }
     })
     // Why: a future-dated id would look new again after its own tombstone is collected.
     expect(
       evaluate(rows, {
         operationId: operationId(NOW + AGENT_SESSION_OPERATION_FUTURE_SKEW_MS + 1)
       })
-    ).toEqual({ decision: 'refused', code: 'agent_session_operation_invalid' })
+    ).toEqual({
+      decision: 'refused',
+      code: 'agent_session_operation_invalid',
+      details: { reason: 'operationIdInvalid' }
+    })
     expect(
       evaluate(rows, { operationId: operationId(NOW + AGENT_SESSION_OPERATION_FUTURE_SKEW_MS) })
         .decision
@@ -97,7 +103,8 @@ describe('operation admission', () => {
     const stale = operationId(NOW - AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS - 1)
     expect(evaluate(rows, { operationId: stale })).toEqual({
       decision: 'refused',
-      code: 'agent_session_operation_expired'
+      code: 'agent_session_operation_expired',
+      details: { reason: 'operationExpired' }
     })
     expect(
       evaluate(rows, { operationId: operationId(NOW - AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS) })
@@ -110,12 +117,14 @@ describe('operation admission', () => {
     admit(rows, { operationId: operationId(NOW, 'b'.repeat(32)) })
     expect(evaluate(rows, { perClientLimit: 1 })).toEqual({
       decision: 'refused',
-      code: 'agent_session_operation_capacity'
+      code: 'agent_session_operation_capacity',
+      details: { reason: 'operationCapacity' }
     })
     // A different caller is still refused once the global cap is reached.
     expect(evaluate(rows, { callerKey: 'client-2', globalLimit: 1 })).toEqual({
       decision: 'refused',
-      code: 'agent_session_operation_capacity'
+      code: 'agent_session_operation_capacity',
+      details: { reason: 'operationCapacity' }
     })
     expect(evaluate(rows, { callerKey: 'client-2', perClientLimit: 1 }).decision).toBe('admit')
   })
diff --git a/src/shared/agent-session-operation-ledger.ts b/src/shared/agent-session-operation-ledger.ts
index 765f8e51142..90caec22bb7 100644
--- a/src/shared/agent-session-operation-ledger.ts
+++ b/src/shared/agent-session-operation-ledger.ts
@@ -1,3 +1,7 @@
+import type {
+  AgentSessionAnyRefusalDetails,
+  AgentSessionRefusalDetailsByCode
+} from './agent-session-refusal-details'
 import {
   isAgentSessionRewindResult,
   type AgentSessionRewindReason,
@@ -55,7 +59,15 @@ export type AgentSessionOperationOutcome =
        */
       launch?: unknown
     }
-  | { status: 'failed'; code: string; message?: string; rewindReason?: AgentSessionRewindReason }
+  | {
+      status: 'failed'
+      code: string
+      message?: string
+      rewindReason?: AgentSessionRewindReason
+      /** Beside the code, so a replay says what the first answer did. Read back against the code,
+       *  since the code is a string here; a row written before details carries none. */
+      details?: AgentSessionAnyRefusalDetails
+    }
   /** The effect may or may not have happened; replay this answer instead of spawning again. */
   | { status: 'unknown' }
 
@@ -78,7 +90,13 @@ export type AgentSessionOperationRefusalCode =
 export type AgentSessionOperationDecision =
   | { decision: 'replay'; row: AgentSessionOperationRow }
   | { decision: 'admit'; row: AgentSessionOperationRow }
-  | { decision: 'refused'; code: AgentSessionOperationRefusalCode }
+  | {
+      [C in AgentSessionOperationRefusalCode]: {
+        decision: 'refused'
+        code: C
+        details: AgentSessionRefusalDetailsByCode[C]
+      }
+    }[AgentSessionOperationRefusalCode]
 
 /** NUL cannot occur in a caller key or operation id, so no pair can forge another pair's key. */
 const OPERATION_KEY_SEPARATOR = '\u0000'
@@ -228,19 +246,31 @@ export function evaluateAgentSessionOperation(args: {
     operationTimestamp > now + AGENT_SESSION_OPERATION_FUTURE_SKEW_MS
   ) {
     // Why: a future-dated id could look new again after its tombstone is collected.
-    return { decision: 'refused', code: 'agent_session_operation_invalid' }
+    return {
+      decision: 'refused',
+      code: 'agent_session_operation_invalid',
+      details: { reason: 'operationIdInvalid' }
+    }
   }
   const key = agentSessionOperationKey(callerKey, operationId)
   const existing = rows.get(key)
   if (existing) {
     return existing.fingerprint === fingerprint
       ? { decision: 'replay', row: existing }
-      : { decision: 'refused', code: 'agent_session_operation_conflict' }
+      : {
+          decision: 'refused',
+          code: 'agent_session_operation_conflict',
+          details: { reason: 'operationIdReused' }
+        }
   }
   if (now - operationTimestamp > AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS) {
     // Why: once a tombstone could have expired, an unseen replay must never be reinterpreted as
     // permission to start another fresh agent.
-    return { decision: 'refused', code: 'agent_session_operation_expired' }
+    return {
+      decision: 'refused',
+      code: 'agent_session_operation_expired',
+      details: { reason: 'operationExpired' }
+    }
   }
   const perClientLimit = args.perClientLimit ?? AGENT_SESSION_DURABLE_OPERATION_PER_CLIENT_LIMIT
   const globalLimit = args.globalLimit ?? AGENT_SESSION_DURABLE_OPERATION_GLOBAL_LIMIT
@@ -253,19 +283,37 @@ export function evaluateAgentSessionOperation(args: {
   if (callerCount >= perClientLimit || rows.size >= globalLimit) {
     // Why: tombstones cannot be evicted early without making an old replay capable of spawning
     // again; reject new ids until retained rows age out.
-    return { decision: 'refused', code: 'agent_session_operation_capacity' }
+    return {
+      decision: 'refused',
+      code: 'agent_session_operation_capacity',
+      details: { reason: 'operationCapacity' }
+    }
   }
   return {
     decision: 'admit',
-    row: {
-      callerKey,
-      operationId,
-      fingerprint,
-      operationTimestamp,
-      recordedAt: now,
-      expiresAt: agentSessionOperationExpiry(operationTimestamp, now),
-      outcome: { status: 'pending' }
-    }
+    row: pendingAgentSessionOperationRow({ callerKey, operationId, fingerprint, now })
+  }
+}
+
+/** A `pending` row for this id, retained for the full replay window from `now`. */
+export function pendingAgentSessionOperationRow(args: {
+  callerKey: string
+  operationId: string
+  fingerprint: string
+  now: number
+}): AgentSessionOperationRow {
+  const operationTimestamp = parseAgentSessionOperationTimestamp(args.operationId)
+  if (operationTimestamp === null) {
+    throw new Error('agent_session_operation_invalid')
+  }
+  return {
+    callerKey: args.callerKey,
+    operationId: args.operationId,
+    fingerprint: args.fingerprint,
+    operationTimestamp,
+    recordedAt: args.now,
+    expiresAt: agentSessionOperationExpiry(operationTimestamp, args.now),
+    outcome: { status: 'pending' }
   }
 }
 
diff --git a/src/shared/agent-session-option-catalog-codebuddy.ts b/src/shared/agent-session-option-catalog-codebuddy.ts
new file mode 100644
index 00000000000..d0a8afa04c5
--- /dev/null
+++ b/src/shared/agent-session-option-catalog-codebuddy.ts
@@ -0,0 +1,44 @@
+import { hasFlag } from './agent-cli-flag-detection'
+import { removeAgentArgOption } from './agent-session-option-agent-args'
+import type { AgentSessionOptionCatalog, CatalogOption } from './agent-session-option-catalog-types'
+
+const CODEBUDDY_EFFORT: CatalogOption = {
+  id: 'effort',
+  label: 'Reasoning effort',
+  category: 'thought_level',
+  kind: {
+    type: 'select',
+    choices: [
+      { value: 'minimal', label: 'Minimal' },
+      { value: 'low', label: 'Low' },
+      { value: 'medium', label: 'Medium' },
+      { value: 'high', label: 'High' },
+      { value: 'xhigh', label: 'Extra high' },
+      { value: 'max', label: 'Max' }
+    ],
+    defaultValue: 'medium'
+  },
+  apply: {
+    launchArgs: (value) => ['--effort', String(value)],
+    agentArgsOverride: (tokens) => hasFlag(tokens, ['--effort']),
+    removeAgentArgs: (tokens) => removeAgentArgOption(tokens, ['--effort'])
+  }
+}
+
+export const CODEBUDDY_SESSION_OPTION_CATALOG: AgentSessionOptionCatalog = {
+  supportsWorkerLaunchPreferences: true,
+  // Stable CLI aliases let CodeBuddy resolve the account's current model choices.
+  models: [
+    { id: 'default-model', label: 'Default' },
+    { id: 'fast-model', label: 'Fast' },
+    { id: 'balanced-model', label: 'Balanced' },
+    { id: 'primary-model', label: 'Primary' },
+    { id: 'deep-model', label: 'Deep' }
+  ].map((model) => ({ ...model, options: [CODEBUDDY_EFFORT] })),
+  modelApply: {
+    launchArgs: (value) => ['--model', String(value)],
+    agentArgsOverride: (tokens) => hasFlag(tokens, ['--model']),
+    removeAgentArgs: (tokens) => removeAgentArgOption(tokens, ['--model'])
+  },
+  unknownModelOptions: [CODEBUDDY_EFFORT]
+}
diff --git a/src/shared/agent-session-option-catalog.ts b/src/shared/agent-session-option-catalog.ts
index a8e26f5a0ed..74a7f384801 100644
--- a/src/shared/agent-session-option-catalog.ts
+++ b/src/shared/agent-session-option-catalog.ts
@@ -1,3 +1,4 @@
+import { CODEBUDDY_SESSION_OPTION_CATALOG } from './agent-session-option-catalog-codebuddy'
 import type { AgentType } from './agent-status-types'
 import { ANTIGRAVITY_SESSION_OPTION_CATALOG } from './agent-session-option-catalog-antigravity'
 import {
@@ -34,6 +35,7 @@ export { createClaudeCatalogOptions }
 const CATALOGS: AgentSessionOptionCatalogMap = {
   antigravity: ANTIGRAVITY_SESSION_OPTION_CATALOG,
   claude: CLAUDE_SESSION_OPTION_CATALOG,
+  codebuddy: CODEBUDDY_SESSION_OPTION_CATALOG,
   codex: CODEX_SESSION_OPTION_CATALOG,
   gemini: GEMINI_SESSION_OPTION_CATALOG,
   cursor: CURSOR_SESSION_OPTION_CATALOG,
diff --git a/src/shared/agent-session-question-answer.ts b/src/shared/agent-session-question-answer.ts
index 072dfce200a..08374adc3d5 100644
--- a/src/shared/agent-session-question-answer.ts
+++ b/src/shared/agent-session-question-answer.ts
@@ -1,13 +1,112 @@
-import type { AgentJournalQuestion } from './agent-session-journal-types'
+import type { AgentJournalQuestion, AgentJournalQuestionItem } from './agent-session-journal-types'
 
 const GROUP_ANSWER_PREFIX = 'question-group:'
 
+/** A single-question item has no question list; the client and host must agree on its id. */
+const SINGLE_QUESTION_ID = 'q1'
+
+/** Longest option id a host takes, which also bounds an answer packed into one. */
+export const AGENT_SESSION_RESPONSE_OPTION_ID_MAX_LENGTH = 1024
+
+/** Largest typed answer to one question, in UTF-8 bytes. */
+export const AGENT_SESSION_QUESTION_ANSWER_MAX_BYTES = 64 * 1024
+
 export type AgentSessionQuestionAnswer = {
   questionId: string
   optionIds: string[]
   other?: string
 }
 
+/** What a client chose on a prompt: a decision id for an approval, per-question answers for a question. */
+export type AgentSessionPromptResponse =
+  | { kind: 'option'; optionId: string }
+  | { kind: 'answers'; answers: AgentSessionQuestionAnswer[] }
+
+/** The questions an item asks: its grouped list, or the item itself as one question. */
+export function agentSessionPromptQuestions(
+  body: Pick<AgentJournalQuestionItem, 'question' | 'options' | 'questions' | 'freeTextQuestionId'>
+): AgentJournalQuestion[] {
+  if (body.questions) {
+    return body.questions
+  }
+  return [
+    {
+      id: body.freeTextQuestionId ?? SINGLE_QUESTION_ID,
+      question: body.question,
+      options: body.options,
+      multiSelect: false,
+      ...(body.freeTextQuestionId ? { freeTextQuestionId: body.freeTextQuestionId } : {})
+    }
+  ]
+}
+
+function encodeLegacyFreeTextAnswer(questionId: string, answer: string): string {
+  return `${encodeURIComponent(questionId)}:${encodeURIComponent(answer)}`
+}
+
+function decodeLegacyFreeTextAnswer(
+  optionId: string
+): { questionId: string; answer: string } | null {
+  const separator = optionId.indexOf(':')
+  if (separator <= 0) {
+    return null
+  }
+  try {
+    return {
+      questionId: decodeURIComponent(optionId.slice(0, separator)),
+      answer: decodeURIComponent(optionId.slice(separator + 1))
+    }
+  } catch {
+    return null
+  }
+}
+
+/**
+ * The answer packed into one option-id string, the only form older peers read: hosts that
+ * predate structured answers take it as `optionId`, and older clients render receipts from it.
+ */
+export function legacyAgentSessionSelectedOptionId(
+  body: Pick<AgentJournalQuestionItem, 'questions'>,
+  answers: readonly AgentSessionQuestionAnswer[]
+): string | null {
+  if (body.questions) {
+    return encodeAgentSessionQuestionAnswers(answers)
+  }
+  const [answer] = answers
+  if (!answer || answers.length !== 1) {
+    return null
+  }
+  const other = answer.other?.trim()
+  return (
+    answer.optionIds[0] ?? (other ? encodeLegacyFreeTextAnswer(answer.questionId, other) : null)
+  )
+}
+
+/** Reads an answer an older client packed into `optionId`. */
+export function legacyAgentSessionQuestionAnswers(
+  body: Pick<AgentJournalQuestionItem, 'question' | 'options' | 'questions' | 'freeTextQuestionId'>,
+  optionId: string
+): AgentSessionQuestionAnswer[] | null {
+  const grouped = body.questions ? decodeAgentSessionQuestionAnswers(optionId) : null
+  if (grouped) {
+    return grouped
+  }
+  const questions = agentSessionPromptQuestions(body)
+  const questionId = questions.length === 1 ? questions[0]!.id : null
+  if (!questionId) {
+    return null
+  }
+  if (body.options.some((option) => option.id === optionId)) {
+    return [{ questionId, optionIds: [optionId] }]
+  }
+  const freeText = decodeLegacyFreeTextAnswer(optionId)
+  return body.freeTextQuestionId &&
+    freeText?.questionId === body.freeTextQuestionId &&
+    freeText.answer.trim().length > 0
+    ? [{ questionId, optionIds: [], other: freeText.answer }]
+    : null
+}
+
 export function encodeAgentSessionQuestionAnswers(
   answers: readonly AgentSessionQuestionAnswer[]
 ): string {
diff --git a/src/shared/agent-session-queued-message-wire.ts b/src/shared/agent-session-queued-message-wire.ts
new file mode 100644
index 00000000000..f7659c95873
--- /dev/null
+++ b/src/shared/agent-session-queued-message-wire.ts
@@ -0,0 +1,54 @@
+// The queued-message part of the agent-session wire: the published draft cards,
+// the queue's pause beside them, and the draft mutations' answers.
+
+import type { UnreadAgentSessionFailureFact } from './agent-session-failure'
+import type { AgentJournalMessageItem } from './agent-session-journal-types'
+
+/** The draft could not be converted into a send; an explicit Send retries it. */
+export const QUEUED_MESSAGE_PAUSED_SEND_FAILED = 'send_failed' as const
+
+export type AgentSessionQueuedMessagePausedReason = typeof QUEUED_MESSAGE_PAUSED_SEND_FAILED
+
+/** The whole queue is paused and sends nothing on its own: 'stopped' — the user
+ *  interrupted ("Queue paused because you interrupted") — 'cleared' — a /clear
+ *  carried the cards into a fresh conversation — or 'restarted' — Orca restarted
+ *  with cards waiting. Resume (`agentSession.queuedMessagesResume`), or the user's own next
+ *  turn starting, lifts it; Send-now on one card sends that card and leaves the
+ *  rest paused until its turn starts. A client treats an unknown reason as a
+ *  plain pause, so a newer host can add one. */
+export type AgentSessionQueuePause = { reason: 'stopped' | 'restarted' | 'cleared' }
+
+export type AgentSessionQueuedMessagesResumeResult = {
+  /** False when nothing was paused, and on a replay of an already-run Resume. */
+  resumed: boolean
+}
+
+/** One draft the host holds for this conversation, published whole-list on the
+ *  subscribe stream and on history pages. Text-only v1. */
+export type AgentSessionQueuedMessage = {
+  messageId: string
+  position: number
+  body: AgentJournalMessageItem
+  state: 'waiting' | 'returned'
+  /** This one card is held, whatever the queue's pause: its conversion failed. */
+  paused?: true
+  /** Why it is held, as a marker the client localizes: 'send_failed' ("couldn't
+   *  send"; only an explicit Send releases it). A client must treat an unknown
+   *  marker as a plain hold, so a newer host can add one. The queue-level
+   *  pause is `queuePause`, published beside the list. */
+  pausedReason?: AgentSessionQueuedMessagePausedReason
+  /** A returned card's refusal: the `reason` and `rejection` pair its submission settled with.
+   *  Only a failure returns a card; a draft a Stop or restart took back waits again. Clients classify it from `returnedRejection` (falling back to `returnedReason` when a host
+   *  wrote no fact) exactly as they classify a rejected submission's `rejection`, e.g.
+   *  `classifyDispatchRejection({ reason: returnedReason, rejection: returnedRejection })`. */
+  returnedReason?: string | null
+  returnedRejection?: UnreadAgentSessionFailureFact
+}
+
+/** No body: the card leaving the published list IS the outcome, so a lost
+ *  answer needs no re-ask and no text ever rides the wire back. */
+export type AgentSessionQueuedMessageDeleteResult =
+  | { deleted: true; messageId: string }
+  /** `dispatched` means it already became a submission; `missing` covers a
+   *  pruned tombstone. Replays answer from tombstone receipts. */
+  | { deleted: false; messageId: string; disposition: 'dispatched' | 'withdrawn' | 'missing' }
diff --git a/src/shared/agent-session-queued-submission.ts b/src/shared/agent-session-queued-submission.ts
new file mode 100644
index 00000000000..6295897fd54
--- /dev/null
+++ b/src/shared/agent-session-queued-submission.ts
@@ -0,0 +1,13 @@
+import type { AgentJournalSubmission } from './agent-session-journal-types'
+
+/** Accepted by the host and not yet handed to the provider: provably unwritten, so every way out
+ *  of this state is delivery or a rejection, never doubt. */
+export function isQueuedAgentJournalSubmission(
+  submission: Pick<AgentJournalSubmission, 'handoverRecorded' | 'dispatchState' | 'handedOverAt'>
+): boolean {
+  return (
+    submission.handoverRecorded === true &&
+    submission.dispatchState === 'pending' &&
+    submission.handedOverAt === undefined
+  )
+}
diff --git a/src/shared/agent-session-record.ts b/src/shared/agent-session-record.ts
index 6cfe07e70b4..12a26e64ac7 100644
--- a/src/shared/agent-session-record.ts
+++ b/src/shared/agent-session-record.ts
@@ -1,6 +1,5 @@
 import { isAgentSessionRewindRecord, type AgentSessionRewindRecord } from './agent-session-rewind'
 import { isAgentSessionLaunchArgs } from './agent-session-launch-args'
-import { isAgentSessionSurfaceTabId } from './agent-session-surface-tab-id'
 import { isAgentSessionConversationName } from './agent-session-conversation-name'
 import {
   isPersistedAgentSessionHandoffStage,
@@ -61,13 +60,12 @@ export type AgentSessionLaunchArgs = string[]
  *  away at decode (agent-session-legacy-handoff-lease). */
 export type AgentSessionOwnerRuntimeKind = 'native'
 
-/** The acquisition stage. The removed terminal handoff's stages are mapped away at decode. */
-export type AgentSessionHandoffStage = 'new-owner-proving' | 'recovering' | 'manual-recovery'
+/** The acquisition stage. Stages only older builds wrote are mapped away at decode. */
+export type AgentSessionHandoffStage = 'new-owner-proving' | 'recovering'
 
 /**
  * PID-reuse-safe process identity. `spawnToken` is the only element available on every platform:
- * process start time costs a CIM query on Windows and is absent in some containers. An exact
- * identity stays in `recovering`; an ownerless, unattributable reservation uses `manual-recovery`.
+ * process start time costs a CIM query on Windows and is absent in some containers.
  */
 export type AgentSessionProcessIdentity = {
   hostId: string
@@ -79,9 +77,9 @@ export type AgentSessionProcessIdentity = {
 export type AgentSessionJournalCheckpoint = { epoch: number; sequence: number }
 
 /**
- * Mirrors the in-memory claim registry's reserved / live / conflicted states so a conflict
- * survives a restart. `released` has no registry equivalent: the registry expresses "no owner" by
- * deleting the entry, and a durable record that outlives its owner needs a name for that.
+ * `released` means no owner: a durable record that outlives its owner needs a name for that.
+ * `conflicted` is how a terminal owner an older build recorded loads: recovery waits it out and
+ * never stops it, because it is the user's own agent.
  */
 export type AgentSessionClaimStatus = 'reserved' | 'live' | 'conflicted' | 'released'
 
@@ -89,6 +87,13 @@ export type AgentSessionDeathEvidence = {
   kind: 'exit-observed' | 'pid-absent' | 'identity-mismatch'
   detail: string
   observedAt: number
+  /** Fence of the owner (or reservation) this death is about; a fence names exactly one. Absent on
+   *  evidence older builds wrote, which then speaks for no turn. */
+  ownerFence?: number
+  /** The death interval's lower bound: the last time the runtime holding the owner's transport
+   *  proved it alive. Only a probe's proof records it: absent on a surface-release exit, a failed
+   *  start, and evidence older builds wrote. */
+  lastProvenAliveAt?: number
 }
 
 export type AgentSessionLease = {
@@ -103,9 +108,9 @@ export type AgentSessionLease = {
   ownerProcess: AgentSessionProcessIdentity | null
   /** Reserved before any process exists, then matched against the child's environment. */
   reservedSpawnToken: string | null
-  /** Set only when acquisition failed before any spawn attempt. */
-  processlessAt?: number | null
   leaseDeadlineAt: number
+  /** While `ownerProcess` is set, the last time its transport holder proved it alive; parking in
+   *  `recovering` proves nothing, so it leaves this alone. */
   lastRenewedAt: number
   handoffOperationId: string | null
   journalCheckpoint: AgentSessionJournalCheckpoint | null
@@ -121,11 +126,8 @@ export type AgentSessionLease = {
    * so rewriting it would invalidate the record it is trying to save.
    */
   minimumNextFence?: number
+  /** Null on a released lease when nothing proved its owner gone. */
   deathEvidence: AgentSessionDeathEvidence | null
-  /** A positively observed provider exit whose terminal journal settlement still needs retry. */
-  settlementRetryRequired?: boolean
-  /** Stable lifecycle batch id used when retrying the terminal settlement. */
-  settlementRetryId?: string
 }
 
 export type AgentSessionRecord = {
@@ -142,9 +144,6 @@ export type AgentSessionRecord = {
   /** The name Orca gave this conversation, so a later acquisition need not name it again. */
   conversationName?: string
   launchArgs?: AgentSessionLaunchArgs
-  /** The id of the tab that shows this conversation on every client: host-owned and pinned once;
-   *  readers copy it, never derive it. Older records are backfilled at load with the derived id. */
-  surfaceTabId?: string
   lease: AgentSessionLease
   createdAt: number
   updatedAt: number
@@ -286,13 +285,20 @@ function isAgentSessionDeathEvidence(value: unknown): value is AgentSessionDeath
     return false
   }
   const evidence = value as Partial<AgentSessionDeathEvidence>
+  const { observedAt, lastProvenAliveAt, ownerFence } = evidence
   return (
     (evidence.kind === 'exit-observed' ||
       evidence.kind === 'pid-absent' ||
       evidence.kind === 'identity-mismatch') &&
     isBoundedString(evidence.detail, MAX_ID_LENGTH) &&
-    Number.isSafeInteger(evidence.observedAt) &&
-    (evidence.observedAt as number) >= 0
+    typeof observedAt === 'number' &&
+    Number.isSafeInteger(observedAt) &&
+    observedAt >= 0 &&
+    (ownerFence === undefined || (Number.isSafeInteger(ownerFence) && ownerFence >= 0)) &&
+    (lastProvenAliveAt === undefined ||
+      (Number.isSafeInteger(lastProvenAliveAt) &&
+        lastProvenAliveAt >= 0 &&
+        lastProvenAliveAt <= observedAt))
   )
 }
 
@@ -311,9 +317,6 @@ function isPersistedAgentSessionLease(value: unknown): value is PersistedAgentSe
     (lease.ownerProcess === null || isAgentSessionProcessIdentity(lease.ownerProcess)) &&
     (lease.reservedSpawnToken === null ||
       isBoundedString(lease.reservedSpawnToken, MAX_ID_LENGTH)) &&
-    (lease.processlessAt === undefined ||
-      lease.processlessAt === null ||
-      (Number.isSafeInteger(lease.processlessAt) && (lease.processlessAt as number) >= 0)) &&
     Number.isSafeInteger(lease.leaseDeadlineAt) &&
     Number.isSafeInteger(lease.lastRenewedAt) &&
     (lease.handoffOperationId === null ||
@@ -326,10 +329,6 @@ function isPersistedAgentSessionLease(value: unknown): value is PersistedAgentSe
       lease.claimStatus === 'conflicted' ||
       lease.claimStatus === 'released') &&
     typeof lease.unreconciled === 'boolean' &&
-    (lease.settlementRetryRequired === undefined ||
-      typeof lease.settlementRetryRequired === 'boolean') &&
-    (lease.settlementRetryId === undefined ||
-      isBoundedString(lease.settlementRetryId, MAX_ID_LENGTH)) &&
     (lease.deathEvidence === null || isAgentSessionDeathEvidence(lease.deathEvidence))
   )
 }
@@ -357,7 +356,6 @@ export function isPersistedAgentSessionRecord(
     (record.conversationName === undefined ||
       isAgentSessionConversationName(record.conversationName)) &&
     (record.launchArgs === undefined || isAgentSessionLaunchArgs(record.launchArgs)) &&
-    (record.surfaceTabId === undefined || isAgentSessionSurfaceTabId(record.surfaceTabId)) &&
     !Object.hasOwn(record, 'launchEnv') &&
     isPersistedAgentSessionLease(record.lease) &&
     record.lease.sessionId === record.sessionId &&
diff --git a/src/shared/agent-session-refusal-details.ts b/src/shared/agent-session-refusal-details.ts
new file mode 100644
index 00000000000..eea4e305fcc
--- /dev/null
+++ b/src/shared/agent-session-refusal-details.ts
@@ -0,0 +1,272 @@
+// What a refusal says beyond its code: one reason list and one set of facts per code.
+//
+// A code alone cannot say what to do: `agent_session_operation_invalid` covers a cleared
+// conversation (open the current one) and a busy command (wait). Each reason here is one situation
+// with its own honest words and next step; a reason two codes share is listed under each. There is
+// no catch-all: a site that cannot name its situation sends the code with no reason, the same as an
+// older host, and the reader falls back to what it does for the code.
+
+import type { AgentJournalResolution } from './agent-session-journal-types'
+import { isAgentJournalResolution } from './agent-session-journal-schemas'
+import { AGENT_SESSION_REWIND_REASONS, type AgentSessionRewindReason } from './agent-session-rewind'
+import type {
+  AgentSessionOwnerVerdict,
+  AgentSessionWireRefusalCode
+} from './agent-session-wire-refusals'
+
+export const AGENT_SESSION_REFUSAL_REASONS = {
+  agent_session_operation_invalid: [
+    // The request
+    'requestMalformed',
+    'operationIdInvalid',
+    'messageIdReused',
+    'operationRefusedEarlier',
+    'journalWriteFailed',
+    // The conversation's state
+    'conversationCleared',
+    /** Older hosts only: a /clear that never committed; its replacement may not exist. */
+    'clearUnconfirmed',
+    /** Older hosts only: a command blocked behind that /clear. */
+    'conversationCommandUnconfirmed',
+    'conversationCommandInFlight',
+    'handoffInFlight',
+    'turnActive',
+    'promptPending',
+    'backgroundTasksRunning',
+    'messagesUnsettled',
+    'rewindRefused',
+    'rewindUnconfirmed',
+    // A prompt card or an option
+    'promptGone',
+    'optionRejected',
+    // The provider
+    'providerStarting',
+    'goalsUnsupported',
+    'providerRejected',
+    'providerStartFailed',
+    'notSignedIn',
+    'historyTooLarge',
+    /** The launch's own Anthropic sign-in variables would override the managed Claude account. */
+    'managedAccountEnvOverride',
+    'accountSwitchInProgress',
+    /** A Claude account is added in WSL and no Windows one is selected, which a chat can't run under. */
+    'managedAccountUnsupported',
+    /** The agent started, then Orca could not open the chat's conversation for it. */
+    'attachFailed'
+  ],
+  agent_session_ownership_unknown: [
+    'sessionNotAttached',
+    'noLiveOwner',
+    /** Orca cannot prove an agent process it recorded or started has exited. */
+    'ownerUnproven',
+    'claimConflicted',
+    'recordMissing',
+    'replaySuperseded',
+    'leaseMoved',
+    'spawnIdentityMismatch',
+    'notResumable',
+    'noProviderChild',
+    'conversationHeldElsewhere'
+  ],
+  agent_session_conflict: [
+    'chatStarting',
+    'ownerUnproven',
+    'claimConflicted',
+    'ownerAlive',
+    'identityMismatch',
+    'sessionExists',
+    'conversationHeldElsewhere',
+    'tabIdTaken'
+  ],
+  execution_owner_reconciling: ['hostReconciling', 'recordUnreadable'],
+  agent_session_checkpoint_stale: ['fenceStale', 'leaseMoved', 'recordMissing'],
+  agent_session_identity_required: ['recordMissing', 'transcriptNotFound', 'transcriptUnreadable'],
+  agent_session_operation_conflict: ['fingerprintMismatch', 'operationIdReused', 'handoffInFlight'],
+  agent_session_operation_expired: ['operationExpired'],
+  agent_session_operation_capacity: ['operationCapacity'],
+  agent_session_operation_unknown: [
+    'outcomeUnknown',
+    'resultLost',
+    'rewindUnconfirmed',
+    'tabUnconfirmed'
+  ],
+  agent_session_item_revision_stale: ['promptMoved'],
+  agent_session_already_resolved: ['promptAlreadyResolved'],
+  agent_session_journal_unreadable: [
+    /** SQLite reports the chat's journal damaged or not a database; no retry reads past it. */
+    'journalCorrupt',
+    /** Any other failed open, which can clear. */
+    'journalUnavailable'
+  ],
+  structured_agent_session_unsupported: [
+    'clientCapabilityMissing',
+    'hostDisabled',
+    'hostUnsupported'
+  ],
+  // Sent with no reason when starting the agent for an operation throws; older clients read it too.
+  agent_session_owner_restart_failed: []
+} as const satisfies Record<AgentSessionWireRefusalCode, readonly string[]>
+
+export type AgentSessionRefusalReason<C extends AgentSessionWireRefusalCode> =
+  (typeof AGENT_SESSION_REFUSAL_REASONS)[C][number]
+
+/** A reason under any code, for a reader that keys words on the name alone. */
+export type AgentSessionAnyRefusalReason = AgentSessionRefusalReason<AgentSessionWireRefusalCode>
+
+type RewindFacts = {
+  /** Which rewind check refused. */
+  rewindReason?: AgentSessionRewindReason
+}
+
+type PromptFacts = {
+  /** The revision the host actually holds. */
+  currentRevision?: number
+  /** The winning answer and who gave it. */
+  resolution?: AgentJournalResolution
+}
+
+type NoFacts = Record<never, never>
+
+/** The facts a code carries beside its reason. */
+type AgentSessionRefusalFactsByCode = {
+  agent_session_operation_invalid: RewindFacts
+  agent_session_operation_unknown: RewindFacts
+  agent_session_checkpoint_stale: {
+    /** So the client can retry without another round trip. */
+    currentFence?: number
+  }
+  agent_session_item_revision_stale: PromptFacts
+  agent_session_already_resolved: PromptFacts
+  agent_session_ownership_unknown: NoFacts
+  agent_session_conflict: NoFacts
+  execution_owner_reconciling: NoFacts
+  agent_session_identity_required: NoFacts
+  agent_session_operation_conflict: NoFacts
+  agent_session_operation_expired: NoFacts
+  agent_session_operation_capacity: NoFacts
+  agent_session_journal_unreadable: NoFacts
+  structured_agent_session_unsupported: NoFacts
+  agent_session_owner_restart_failed: NoFacts
+}
+
+/** A durably failed create says whether anything still runs for it, whichever code it failed
+ *  with: `exited` proves nothing does, so a new operation cannot collide with this one. */
+type AgentSessionRefusalCommonFacts = { ownerVerdict?: AgentSessionOwnerVerdict }
+
+export type AgentSessionRefusalFacts<C extends AgentSessionWireRefusalCode> =
+  AgentSessionRefusalFactsByCode[C] & AgentSessionRefusalCommonFacts
+
+/** What an emitter must name: a reason its code lists, and that code's facts. */
+export type AgentSessionRefusalDetailsByCode = {
+  [C in AgentSessionWireRefusalCode]: {
+    reason: AgentSessionRefusalReason<C>
+  } & AgentSessionRefusalFacts<C>
+}
+
+/** Details as the wire and a durable record carry them. The reason is absent where the host could
+ *  not name the situation; the whole object is absent from older hosts. */
+export type AgentSessionRefusalDetails<C extends AgentSessionWireRefusalCode> = {
+  reason?: AgentSessionRefusalReason<C>
+} & AgentSessionRefusalFacts<C>
+
+/** Details under whichever code, for a store that keeps them beside a code it reads as a string. */
+export type AgentSessionAnyRefusalDetails = AgentSessionRefusalDetails<AgentSessionWireRefusalCode>
+
+/** The loose top-level fields released clients read; the host writes them only from details. */
+export type AgentSessionLegacyRefusalFields = {
+  currentFence?: number
+  currentRevision?: number
+  resolution?: AgentJournalResolution
+  ownerVerdict?: AgentSessionOwnerVerdict
+  rewindReason?: AgentSessionRewindReason
+}
+
+const FACT_KEYS_BY_CODE: Partial<
+  Record<AgentSessionWireRefusalCode, readonly (keyof AgentSessionLegacyRefusalFields)[]>
+> = {
+  agent_session_operation_invalid: ['rewindReason'],
+  agent_session_operation_unknown: ['rewindReason'],
+  agent_session_checkpoint_stale: ['currentFence'],
+  agent_session_item_revision_stale: ['currentRevision', 'resolution'],
+  agent_session_already_resolved: ['currentRevision', 'resolution']
+}
+
+const OWNER_VERDICTS: readonly AgentSessionOwnerVerdict[] = ['live', 'unverifiable', 'exited']
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function readFact(
+  key: keyof AgentSessionLegacyRefusalFields,
+  value: unknown
+): AgentSessionLegacyRefusalFields {
+  switch (key) {
+    case 'currentFence':
+      return Number.isSafeInteger(value) && typeof value === 'number' ? { currentFence: value } : {}
+    case 'currentRevision':
+      return Number.isSafeInteger(value) && typeof value === 'number'
+        ? { currentRevision: value }
+        : {}
+    case 'resolution':
+      return isAgentJournalResolution(value) ? { resolution: value } : {}
+    case 'ownerVerdict': {
+      const ownerVerdict = OWNER_VERDICTS.find((verdict) => verdict === value)
+      return ownerVerdict ? { ownerVerdict } : {}
+    }
+    case 'rewindReason': {
+      const rewindReason = AGENT_SESSION_REWIND_REASONS.find((reason) => reason === value)
+      return rewindReason ? { rewindReason } : {}
+    }
+  }
+}
+
+export function isAgentSessionRefusalReason<C extends AgentSessionWireRefusalCode>(
+  code: C,
+  value: unknown
+): value is AgentSessionRefusalReason<C> {
+  const reasons: readonly string[] = AGENT_SESSION_REFUSAL_REASONS[code]
+  return typeof value === 'string' && reasons.includes(value)
+}
+
+/**
+ * Details as a reader meets them: from the wire, a ledger row or a stored failure, possibly
+ * written by another build. Keeps only a reason and facts this code lists, so a reason a newer
+ * host added reads as none; undefined when nothing is left.
+ */
+export function readAgentSessionRefusalDetails<C extends AgentSessionWireRefusalCode>(
+  code: C,
+  value: unknown
+): AgentSessionRefusalDetails<C> | undefined {
+  if (!isRecord(value)) {
+    return undefined
+  }
+  const keys = [...(FACT_KEYS_BY_CODE[code] ?? []), 'ownerVerdict' as const]
+  const facts = keys.reduce<AgentSessionLegacyRefusalFields>(
+    (kept, key) => ({ ...kept, ...readFact(key, value[key]) }),
+    {}
+  )
+  const read = {
+    ...(isAgentSessionRefusalReason(code, value.reason) ? { reason: value.reason } : {}),
+    ...facts
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the reason was checked against `code`'s list and only the facts `code` lists (plus the verdict every code may carry) were kept.
+  return Object.keys(read).length > 0 ? (read as AgentSessionRefusalDetails<C>) : undefined
+}
+
+/** The loose fields released clients read, taken from details; the one place they are written. */
+export function agentSessionLegacyRefusalFields(
+  details: AgentSessionLegacyRefusalFields | undefined
+): AgentSessionLegacyRefusalFields {
+  if (!details) {
+    return {}
+  }
+  const { currentFence, currentRevision, resolution, ownerVerdict, rewindReason } = details
+  return {
+    ...(rewindReason !== undefined ? { rewindReason } : {}),
+    ...(currentFence !== undefined ? { currentFence } : {}),
+    ...(resolution !== undefined ? { resolution } : {}),
+    ...(currentRevision !== undefined ? { currentRevision } : {}),
+    ...(ownerVerdict !== undefined ? { ownerVerdict } : {})
+  }
+}
diff --git a/src/shared/agent-session-refusal-notice.test.ts b/src/shared/agent-session-refusal-notice.test.ts
new file mode 100644
index 00000000000..a83a95c4388
--- /dev/null
+++ b/src/shared/agent-session-refusal-notice.test.ts
@@ -0,0 +1,645 @@
+import { describe, expect, it } from 'vitest'
+import {
+  AGENT_SESSION_WIRE_REFUSAL_CODES,
+  type AgentSessionWireRefusalCode
+} from './agent-session-wire-refusals'
+import {
+  agentSessionReadHistoryRefusalParts,
+  agentSessionRefusalCauseParts,
+  agentSessionRefusalNotice,
+  agentSessionRefusalReasonWords,
+  agentSessionWriteFailureNotice,
+  agentSessionWriteNoticeEnglish,
+  agentSessionWriteNoticeParts
+} from './agent-session-refusal-notice'
+import {
+  AGENT_SESSION_WRITE_NOTICE_COPY,
+  type AgentSessionWriteNoticeSentence
+} from './agent-session-write-notice-copy'
+import { AGENT_SESSION_REFUSAL_REASONS } from './agent-session-refusal-details'
+import { agentSessionFailureSentence } from './agent-session-failure-words'
+import {
+  agentSessionRefusalFailure,
+  agentSessionRpcErrorFailure,
+  agentSessionWriteKindForMethod,
+  type AgentSessionWriteFailure,
+  type AgentSessionWriteKind,
+  type AgentSessionWriteRefusal
+} from './agent-session-write-failure'
+import {
+  DISPATCH_REJECTED_NOT_DELIVERED,
+  DISPATCH_REJECTED_QUEUE_FULL,
+  DISPATCH_REJECTED_WRITE_FAILED
+} from './structured-agent-session-dispatch-rejection'
+import { structuredAgentSessionRejectionParts } from './structured-agent-session-send-disposition'
+
+const WRITES: AgentSessionWriteKind[] = [
+  'read-history',
+  'send',
+  'composer-send',
+  'stop',
+  'stop-task',
+  'stop-tasks',
+  'answer',
+  'option',
+  'command',
+  'goal'
+]
+const HOST_TEXT = 'Expected runtime fence 1; the session is at 3.'
+
+// A cause is named only where every host emitter of the code means it; any other code says only
+// what did not happen, because one code covers owner states or reasons the client cannot tell apart.
+const CAUSES: Partial<Record<AgentSessionWireRefusalCode, AgentSessionWriteNoticeSentence>> = {
+  // Only send preparation, when the owner it restarted for this send failed to start.
+  agent_session_owner_restart_failed: 'restartFailed',
+  // Only the ledger, when a day's retained operation ids fill a client's or the host's quota.
+  agent_session_operation_capacity: 'capacity',
+  // A replayed operation with no recorded outcome, or a send behind a rewind whose outcome is
+  // unrecorded: either way Orca cannot say what happened.
+  agent_session_operation_unknown: 'outcomeUnknown',
+  // Only the pending-prompt check.
+  agent_session_item_revision_stale: 'questionChanged',
+  agent_session_already_resolved: 'questionChanged',
+  // Send preparation, for any failed open; the code names nothing else.
+  agent_session_journal_unreadable: 'historyUnreadable',
+  // On these writes, only an older host, or the phone reading an unknown method.
+  structured_agent_session_unsupported: 'unsupported'
+}
+
+function isCause(part: unknown): boolean {
+  return typeof part === 'string' && !part.startsWith('notDone') && part !== 'tryAgainComposerSend'
+}
+
+// A newer host can send a code this client has never heard of.
+const FUTURE_CODE: AgentSessionWriteFailure = JSON.parse(
+  '{"kind":"refused","code":"agent_session_from_the_future"}'
+)
+const FAILURES: AgentSessionWriteFailure[] = [
+  ...AGENT_SESSION_WIRE_REFUSAL_CODES.map((code) => ({ kind: 'refused' as const, code })),
+  { kind: 'failed' },
+  { kind: 'unconfirmed' },
+  FUTURE_CODE
+]
+const NOT_DONE: Record<AgentSessionWriteKind, AgentSessionWriteNoticeSentence> = {
+  'read-history': 'notDoneReadHistory',
+  send: 'notDoneSend',
+  'composer-send': 'notDoneSend',
+  stop: 'notDoneStop',
+  'stop-task': 'notDoneStopTask',
+  'stop-tasks': 'notDoneStopTasks',
+  answer: 'notDoneAnswer',
+  option: 'notDoneOption',
+  command: 'notDoneCommand',
+  goal: 'notDoneGoal'
+}
+
+function codeOf(failure: AgentSessionWriteFailure): string {
+  return failure.kind === 'refused' ? failure.code : failure.kind
+}
+
+// The host may have run it: a thrown request, or a replayed id with no recorded outcome.
+function mayHaveRun(failure: AgentSessionWriteFailure): boolean {
+  return codeOf(failure) === 'unconfirmed' || codeOf(failure) === 'agent_session_operation_unknown'
+}
+
+// Where the cause sentence alone already says the write cannot take effect.
+function causeSaysNotDone(
+  failure: AgentSessionWriteFailure,
+  write: AgentSessionWriteKind
+): boolean {
+  const code = codeOf(failure)
+  return (
+    code === 'structured_agent_session_unsupported' ||
+    (write === 'read-history' && code === 'agent_session_journal_unreadable') ||
+    (write === 'answer' &&
+      (code === 'agent_session_item_revision_stale' || code === 'agent_session_already_resolved'))
+  )
+}
+
+// The phone resends under the same id. These record nothing under it (the lease refusals drop the
+// row they admitted), so a resend can go through; every other code can be refused again.
+const RESEND_CAN_WORK = new Set([
+  'failed',
+  'agent_session_checkpoint_stale',
+  'agent_session_conflict',
+  'agent_session_ownership_unknown',
+  'execution_owner_reconciling'
+])
+
+// Every (failure x write) cell of the table, checked against the rules a notice must keep.
+describe('the notice for every failure and write', () => {
+  const cells = FAILURES.flatMap((failure) =>
+    WRITES.map((write) => {
+      const parts = agentSessionWriteNoticeParts(failure, write)
+      return {
+        failure,
+        write,
+        parts,
+        english: agentSessionWriteNoticeEnglish(parts),
+        cell: `${codeOf(failure)} x ${write}`
+      }
+    })
+  )
+
+  it('says the write did not happen, once and for that write, whenever that is certain', () => {
+    for (const { failure, write, parts, cell } of cells.filter((c) => !mayHaveRun(c.failure))) {
+      const notDone = parts.filter((part) => typeof part === 'string' && part.startsWith('notDone'))
+      expect(notDone, cell).toEqual(causeSaysNotDone(failure, write) ? [] : [NOT_DONE[write]])
+    }
+  })
+
+  it('never says a write did not happen when the host may have run it', () => {
+    for (const { parts, cell } of cells.filter((c) => mayHaveRun(c.failure))) {
+      expect(parts, cell).toEqual(['outcomeUnknown'])
+    }
+  })
+
+  // The control that sent the write is how to try again; only the phone's composer has none.
+  it('says how to try again only to update Orca, or on the phone where a resend can work', () => {
+    for (const { failure, write, parts, english, cell } of cells) {
+      const phoneResend = write === 'composer-send' && RESEND_CAN_WORK.has(codeOf(failure))
+      expect(parts.includes('tryAgainComposerSend'), cell).toBe(phoneResend)
+      expect(/again/i.test(english), cell).toBe(
+        phoneResend || codeOf(failure) === 'structured_agent_session_unsupported'
+      )
+    }
+    for (const reason of [null, DISPATCH_REJECTED_WRITE_FAILED, DISPATCH_REJECTED_QUEUE_FULL]) {
+      expect(
+        agentSessionWriteNoticeEnglish(structuredAgentSessionRejectionParts(reason, 'send'))
+      ).not.toMatch(/again/i)
+    }
+  })
+
+  it('names a cause only for a code on the allowlist', () => {
+    for (const { failure, parts, cell } of cells) {
+      const cause =
+        failure.kind === 'unconfirmed'
+          ? 'outcomeUnknown'
+          : failure.kind === 'refused'
+            ? CAUSES[failure.code]
+            : undefined
+      expect(parts.filter(isCause), cell).toEqual(cause ? [cause] : [])
+    }
+  })
+
+  // Census of host emitters, one per code, that write for a log or carry a marker. One is enough
+  // to rule out showing the host's message for that code:
+  // - every code a planned write settles: "Operation <id> was already refused: <code>."
+  //   (structured-agent-session-replay-outcome.ts; the settlement stores no message)
+  // - operation_conflict / _expired / _invalid / _capacity: "Operation <id> was refused: <code>."
+  //   (agent-session-mutation-envelope.ts, the ledger)
+  // - operation_invalid, operation_unknown: `agent_session_rewind:<reason>` (structured-rewind-refusal.ts)
+  // - operation_unknown: "The outcome of operation <id> is unknown; it was not run again."
+  // - checkpoint_stale, conflict, identity_required, execution_owner_reconciling, unsupported: the
+  //   bare code thrown as the message (lease-release, reservation-admission, tab-table,
+  //   claim-identity, lease-transitions, reveal)
+  // - ownership_unknown: "The session attached without a provider child to write to." (agent-start)
+  // - item_revision_stale / already_resolved: "Item <id> has moved on." (prompt-state)
+  // - owner_restart_failed: "<agent> couldn't restart: <cause>.", where the cause is the resume's
+  //   own refusal message, including the ledger's (dead-generation-settlement, agent-start)
+  // - journal_unreadable: "The conversation could not be opened: <error>" (send preparation, before
+  //   it named a reason)
+  it('is never empty and never shows the host message', () => {
+    for (const { failure, write, parts, cell } of cells) {
+      expect(parts.length, cell).toBeGreaterThan(0)
+      expect(
+        parts.every((part) => typeof part === 'string'),
+        cell
+      ).toBe(true)
+      if (failure.kind === 'refused') {
+        expect(
+          agentSessionRefusalNotice({ code: failure.code, message: HOST_TEXT }, write),
+          cell
+        ).not.toContain('fence')
+      }
+    }
+  })
+})
+
+describe('structuredAgentSessionRejectionParts', () => {
+  it('never shows the crash-recovery marker as the reason', () => {
+    expect(structuredAgentSessionRejectionParts(DISPATCH_REJECTED_NOT_DELIVERED, 'send')).toEqual([
+      'notDoneSend'
+    ])
+  })
+})
+
+describe('agentSessionRefusalNotice', () => {
+  // The phone resends under the same operation id. Owner refusals and failed requests record
+  // nothing under it, so a resend can go through; a conflicting or expired id is refused again.
+  it.each([
+    ['agent_session_checkpoint_stale', 'Your message was not sent. Send it again.'],
+    ['execution_owner_reconciling', 'Your message was not sent. Send it again.'],
+    ['agent_session_operation_expired', 'Your message was not sent.'],
+    ['agent_session_operation_conflict', 'Your message was not sent.'],
+    ['agent_session_operation_invalid', 'Your message was not sent.'],
+    ['agent_session_owner_restart_failed', "The agent couldn't restart. Your message was not sent."]
+  ] as const)('tells the phone to send it again only where that can work: %s', (code, expected) => {
+    expect(agentSessionRefusalNotice({ code, message: HOST_TEXT }, 'composer-send')).toBe(expected)
+  })
+
+  it('says what did not happen for a failed request', () => {
+    expect(agentSessionWriteFailureNotice('composer-send')).toBe(
+      'Your message was not sent. Send it again.'
+    )
+    expect(agentSessionWriteFailureNotice('stop')).toBe("The agent wasn't stopped.")
+  })
+
+  // A request that may have run must not say it did not happen.
+  it.each(['runtime_timeout', 'runtime_error', undefined])(
+    'claims nothing about a request that threw with %s',
+    (code) => {
+      for (const write of WRITES) {
+        expect(
+          agentSessionWriteNoticeEnglish(
+            agentSessionWriteNoticeParts(agentSessionRpcErrorFailure(code), write)
+          )
+        ).toBe("Orca couldn't confirm what happened. Check the chat.")
+      }
+    }
+  )
+
+  it('says what did not happen when the host turned the request away before running it', () => {
+    expect(agentSessionRpcErrorFailure('invalid_argument')).toEqual({
+      kind: 'refused',
+      code: 'agent_session_operation_invalid'
+    })
+    expect(agentSessionRpcErrorFailure('method_not_found')).toEqual({
+      kind: 'refused',
+      code: 'structured_agent_session_unsupported'
+    })
+  })
+
+  it('says an agent could not restart without promising a retry will work', () => {
+    // The host words the cause into the chat's status row; some causes need a new chat.
+    expect(
+      agentSessionRefusalNotice(
+        {
+          code: 'agent_session_owner_restart_failed',
+          message:
+            "Claude couldn't restart: Operation 1-a was refused: agent_session_operation_expired."
+        },
+        'send'
+      )
+    ).toBe("The agent couldn't restart. Your message was not sent.")
+  })
+
+  it('names a background-task stop as that, not as stopping the agent', () => {
+    const stop = (fields: Record<string, unknown>): string =>
+      agentSessionRefusalNotice(
+        { code: 'agent_session_checkpoint_stale', message: HOST_TEXT },
+        agentSessionWriteKindForMethod('agentSession.cancel', fields)
+      )
+    expect(stop({ turnId: 't1' })).toBe("The agent wasn't stopped.")
+    expect(stop({ turnId: 'background-tasks', scope: 'background-tasks', taskId: 'b1' })).toBe(
+      "The background task wasn't stopped."
+    )
+    expect(stop({ turnId: 'background-tasks', scope: 'background-tasks' })).toBe(
+      "The background tasks weren't stopped."
+    )
+  })
+
+  it('says a Stop refused over a moved-on prompt did not stop the agent', () => {
+    const refusal = {
+      code: 'agent_session_already_resolved' as const,
+      message: 'Item q1 moved on.'
+    }
+    expect(agentSessionRefusalNotice(refusal, 'stop')).toBe(
+      "This question was already answered or has changed. The agent wasn't stopped."
+    )
+    expect(agentSessionRefusalNotice(refusal, 'answer')).toBe(
+      'This question was already answered or has changed.'
+    )
+  })
+
+  it('says only what did not happen for a code from a newer host', () => {
+    const refusal = JSON.parse('{"code":"agent_session_from_the_future","message":"internal"}')
+    expect(agentSessionRefusalNotice(refusal, 'stop')).toBe("The agent wasn't stopped.")
+  })
+})
+
+// Every (code x reason) a host can name, as a write keeps it.
+const REASONED: AgentSessionWriteRefusal[] = AGENT_SESSION_WIRE_REFUSAL_CODES.flatMap((code) =>
+  AGENT_SESSION_REFUSAL_REASONS[code].map((reason) =>
+    agentSessionRefusalFailure({ code, details: { reason } })
+  )
+)
+
+function reasonOf(failure: AgentSessionWriteRefusal): string {
+  return `${failure.code}/${failure.details?.reason}`
+}
+
+describe('the notice for every reason a host names', () => {
+  const cells = REASONED.flatMap((failure) =>
+    WRITES.map((write) => ({
+      failure,
+      write,
+      parts: agentSessionWriteNoticeParts(failure, write),
+      words: agentSessionRefusalReasonWords(failure),
+      cell: `${reasonOf(failure)} x ${write}`
+    }))
+  )
+
+  it('has words for every reason', () => {
+    for (const { words, cell } of cells) {
+      expect(words, cell).toBeDefined()
+    }
+  })
+
+  it('keeps the code words where the table says the reason means nothing more', () => {
+    for (const { failure, write, parts, words, cell } of cells) {
+      if (words && 'words' in words) {
+        expect(parts, cell).toEqual(
+          agentSessionWriteNoticeParts({ ...failure, details: undefined }, write)
+        )
+      }
+    }
+  })
+
+  // A retry is the control that sent the write; only an open that can clear says to try again.
+  it('names a step exactly where the person has one to take', () => {
+    for (const { words, cell } of cells) {
+      if (words && 'cause' in words) {
+        const retryNow = words.action === 'retry' && words.step === 'tryAgain'
+        expect(words.step !== undefined && !retryNow, cell).toBe(
+          words.action === 'wait' || words.action === 'actFirst' || words.action === 'goElsewhere'
+        )
+        expect(retryNow, cell).toBe(words.cause === 'historyUnavailable')
+      }
+    }
+  })
+
+  // Beside a Retry, that Retry is the step for a reason whose action is to retry, and only for it.
+  it('leaves out only a retry step when a Retry stands beside the words', () => {
+    const beside = { agentName: 'Codex', retryControl: true }
+    for (const { failure, write, parts, words, cell } of cells) {
+      if (words && 'cause' in words) {
+        const retried = words.action === 'retry' ? words.step : undefined
+        expect(agentSessionWriteNoticeParts(failure, write, beside), cell).toEqual(
+          parts.filter((part) => part !== retried)
+        )
+      }
+    }
+    const send = (failure: AgentSessionWriteRefusal) =>
+      agentSessionWriteNoticeParts(failure, 'send', beside)
+    expect(
+      send({
+        kind: 'refused',
+        code: 'agent_session_journal_unreadable',
+        details: { reason: 'journalUnavailable' }
+      })
+    ).toEqual(['historyUnavailable', 'notDoneSend'])
+    expect(
+      send({
+        kind: 'refused',
+        code: 'agent_session_operation_invalid',
+        details: { reason: 'notSignedIn' }
+      })
+    ).toEqual([
+      'notDoneSend',
+      { text: 'Codex is not signed in for the selected account. Sign in first.' }
+    ])
+    expect(
+      send({
+        kind: 'refused',
+        code: 'agent_session_operation_invalid',
+        details: { reason: 'providerStartFailed' }
+      })
+    ).toEqual(['notDoneSend', { text: 'Codex stopped before it finished starting.' }])
+  })
+
+  it('says the write did not happen, once, and never shows the host message', () => {
+    for (const { failure, write, parts, cell } of cells) {
+      const english = agentSessionWriteNoticeEnglish(parts)
+      expect(english.length, cell).toBeGreaterThan(0)
+      expect(agentSessionRefusalNotice({ ...failure, message: HOST_TEXT }, write), cell).toBe(
+        english
+      )
+      if (failure.code === 'agent_session_operation_unknown') {
+        expect(parts, cell).toEqual(['outcomeUnknown'])
+        continue
+      }
+      const notDone = parts.filter((part) => typeof part === 'string' && part.startsWith('notDone'))
+      const answeredAway = write === 'answer' && parts.includes('questionChanged')
+      const unsupported = failure.code === 'structured_agent_session_unsupported'
+      const saysNotDone =
+        write === 'read-history' && failure.code === 'agent_session_journal_unreadable'
+      expect(notDone, cell).toEqual(
+        answeredAway || unsupported || saysNotDone ? [] : [NOT_DONE[write]]
+      )
+    }
+  })
+
+  it("uses the failure's own sentence for a start that failed, and only for a message", () => {
+    const failure = agentSessionRefusalFailure({
+      code: 'agent_session_operation_invalid',
+      details: { reason: 'notSignedIn' }
+    })
+    expect(agentSessionWriteNoticeParts(failure, 'send')).toEqual([
+      'notDoneSend',
+      { text: agentSessionFailureSentence({ kind: 'notSignedIn' }, 'rejection') }
+    ])
+    // Its next step is to send the message again, which a Stop cannot do.
+    expect(agentSessionWriteNoticeParts(failure, 'stop')).toEqual(['notDoneStop'])
+  })
+
+  it.each([
+    [
+      'agent_session_operation_invalid',
+      'conversationCleared',
+      'send',
+      'This conversation has been cleared. Your message was not sent. Open the current conversation to continue.'
+    ],
+    [
+      'agent_session_operation_invalid',
+      'clearUnconfirmed',
+      'send',
+      "The last /clear didn't finish. Your message was not sent. Start a new chat to continue."
+    ],
+    [
+      'agent_session_operation_invalid',
+      'turnActive',
+      'command',
+      "The agent is still responding. The command didn't run. Wait for the agent to finish responding, or stop it."
+    ],
+    [
+      'agent_session_conflict',
+      'claimConflicted',
+      'composer-send',
+      'This chat is still open in a terminal agent. Your message was not sent. Quit that agent to continue the chat here.'
+    ],
+    [
+      'agent_session_conflict',
+      'chatStarting',
+      'stop',
+      "The agent is still starting. The agent wasn't stopped. Wait for the agent to finish starting."
+    ],
+    [
+      'agent_session_operation_invalid',
+      'promptGone',
+      'answer',
+      'This question was already answered or has changed.'
+    ],
+    [
+      'agent_session_checkpoint_stale',
+      'fenceStale',
+      'composer-send',
+      'Your message was not sent. Send it again.'
+    ]
+  ] as const)('%s / %s on %s', (code, reason, write, expected) => {
+    expect(
+      agentSessionRefusalNotice({ code, message: HOST_TEXT, details: { reason } }, write)
+    ).toBe(expected)
+  })
+})
+
+describe('a refusal from a host that names no reason this build knows', () => {
+  it.each([
+    ['an older host', undefined],
+    ['a reason a newer host added', { reason: 'fromTheFuture' }],
+    ['facts with no reason', { ownerVerdict: 'unverifiable' }]
+  ])("reads as the code's row: %s", (_label, details) => {
+    const refusal = JSON.parse(
+      JSON.stringify({ code: 'agent_session_operation_invalid', message: HOST_TEXT, details })
+    )
+    expect(agentSessionRefusalNotice(refusal, 'command')).toBe("The command didn't run.")
+  })
+})
+
+it('keeps a sentence the failure rows share word for word', () => {
+  expect(agentSessionFailureSentence({ kind: 'historyTooLarge' }, 'row')).toContain(
+    AGENT_SESSION_WRITE_NOTICE_COPY.startNewChat
+  )
+})
+
+// A failed journal open says what happened to the history, not what was asked of it.
+describe('a chat whose history the host could not open', () => {
+  const notice = (details: unknown, write: AgentSessionWriteKind): string =>
+    agentSessionRefusalNotice(
+      JSON.parse(
+        JSON.stringify({ code: 'agent_session_journal_unreadable', message: HOST_TEXT, details })
+      ),
+      write
+    )
+
+  it.each([
+    ['journalCorrupt', 'read-history', 'Unable to load this chat.'],
+    ['journalCorrupt', 'send', 'Unable to load this chat. Your message was not sent.'],
+    [
+      'journalUnavailable',
+      'read-history',
+      "Orca couldn't open this chat's history right now. Try again."
+    ],
+    [
+      'journalUnavailable',
+      'send',
+      "Orca couldn't open this chat's history right now. Your message was not sent. Try again."
+    ]
+  ] as const)('%s on %s', (reason, write, expected) => {
+    expect(notice({ reason }, write)).toBe(expected)
+  })
+
+  // Damage can't be told apart from an open that can clear, so it never says to start over.
+  it.each([
+    ['an older host', undefined],
+    ['a reason an unreleased build wrote', { reason: 'journalUnreadable' }]
+  ])('promises nothing for a refusal that names no reason: %s', (_label, details) => {
+    expect(notice(details, 'read-history')).toBe("Orca couldn't read this chat's saved history.")
+    expect(notice(details, 'send')).toBe(
+      "Orca couldn't read this chat's saved history. Your message was not sent."
+    )
+    expect(
+      agentSessionReadHistoryRefusalParts('agent_session_journal_unreadable', details)
+    ).toEqual(['historyUnreadable'])
+  })
+
+  it('says only that the history did not load for any other read refusal', () => {
+    expect(agentSessionReadHistoryRefusalParts('agent_session_ownership_unknown')).toEqual([
+      'notDoneReadHistory'
+    ])
+    expect(agentSessionReadHistoryRefusalParts('agent_session_from_the_future')).toEqual([
+      'notDoneReadHistory'
+    ])
+  })
+})
+
+// For a line that already says what did not happen and shows its own Retry, such as a chat that
+// could not start: the Retry is the step for retrying and for sending again, and only for those.
+describe('agentSessionRefusalCauseParts', () => {
+  it('keeps a step other than retrying, beside the cause', () => {
+    expect(
+      agentSessionRefusalCauseParts({
+        kind: 'refused',
+        code: 'agent_session_operation_invalid',
+        details: { reason: 'turnActive' }
+      })
+    ).toEqual(['turnActive', 'waitForTurn'])
+    expect(
+      agentSessionRefusalCauseParts({
+        kind: 'refused',
+        code: 'agent_session_operation_invalid',
+        details: { reason: 'historyTooLarge' }
+      })
+    ).toEqual([
+      {
+        text: "This conversation's history is too large to restore here. Start a new chat to continue."
+      }
+    ])
+  })
+
+  it('leaves out a step the Retry beside it takes', () => {
+    expect(
+      agentSessionRefusalCauseParts({
+        kind: 'refused',
+        code: 'agent_session_journal_unreadable',
+        details: { reason: 'journalUnavailable' }
+      })
+    ).toEqual(['historyUnavailable'])
+    expect(
+      agentSessionRefusalCauseParts(
+        {
+          kind: 'refused',
+          code: 'agent_session_operation_invalid',
+          details: { reason: 'notSignedIn' }
+        },
+        { agentName: 'Claude' }
+      )
+    ).toEqual([{ text: 'Claude is not signed in for the selected account. Sign in first.' }])
+    expect(
+      agentSessionRefusalCauseParts({
+        kind: 'refused',
+        code: 'agent_session_operation_invalid',
+        details: { reason: 'providerStartFailed' }
+      })
+    ).toEqual([{ text: 'The agent stopped before it finished starting.' }])
+    expect(
+      agentSessionRefusalCauseParts({
+        kind: 'refused',
+        code: 'agent_session_operation_invalid',
+        details: { reason: 'managedAccountUnsupported' }
+      })
+    ).toEqual([
+      {
+        text: 'While a Claude account is added in WSL, Claude chats need a Windows Claude account. Choose or add one in Claude Accounts settings.'
+      }
+    ])
+  })
+
+  it('writes the same sentences as before where no Retry stands beside them', () => {
+    expect(agentSessionFailureSentence({ kind: 'notSignedIn' }, 'rejection')).toBe(
+      'The agent is not signed in for the selected account. Sign in, then send your message again.'
+    )
+  })
+
+  it.each<[string, AgentSessionWriteFailure]>([
+    ['a refusal with no reason', { kind: 'refused', code: 'agent_session_operation_invalid' }],
+    [
+      "a reason whose code's words stand",
+      { kind: 'refused', code: 'agent_session_conflict', details: { reason: 'ownerAlive' } }
+    ],
+    ['a failed request', { kind: 'failed' }],
+    ['an unconfirmed one', { kind: 'unconfirmed' }]
+  ])('names nothing for %s', (_label, failure) => {
+    expect(agentSessionRefusalCauseParts(failure)).toEqual([])
+  })
+})
diff --git a/src/shared/agent-session-refusal-notice.ts b/src/shared/agent-session-refusal-notice.ts
new file mode 100644
index 00000000000..64cdf19e917
--- /dev/null
+++ b/src/shared/agent-session-refusal-notice.ts
@@ -0,0 +1,375 @@
+// The one way a chat surface puts a write that did not happen into words.
+//
+// A refusal's `message` is never shown. Every code has at least one host emitter whose message is
+// written for a log or carries a marker (the census is pinned in the test), so the refusal's
+// reason, when the host names one, and otherwise its code, pick the copy with the write. A code's
+// own row names a cause only where every emitter of the code means it; it is also the words for a
+// host too old to send a reason. A notice says how to get past a refusal only where the person has
+// a step to take; retrying is the control that sent the write, except on the phone, whose message
+// goes back to the composer, and a history that couldn't open right now says to try again unless
+// something beside the words retries it.
+// Surfaces keep the fact and choose the words when they show it, so nothing saved carries copy.
+
+import type { AgentSessionFailureKind } from './agent-session-failure'
+import {
+  agentSessionFailureSentence,
+  type AgentSessionFailureWordsContext
+} from './agent-session-failure-words'
+import type { AgentSessionRefusalReason } from './agent-session-refusal-details'
+import {
+  AGENT_SESSION_WRITE_NOTICE_COPY,
+  type AgentSessionWriteNoticePart,
+  type AgentSessionWriteNoticeSentence
+} from './agent-session-write-notice-copy'
+import type {
+  AgentSessionWireRefusal,
+  AgentSessionWireRefusalCode
+} from './agent-session-wire-refusals'
+import {
+  agentSessionRefusalFailure,
+  parseAgentSessionWriteFailure,
+  type AgentSessionWriteFailure,
+  type AgentSessionWriteKind,
+  type AgentSessionWriteRefusal
+} from './agent-session-write-failure'
+
+const NOT_DONE: Record<AgentSessionWriteKind, AgentSessionWriteNoticeSentence> = {
+  'read-history': 'notDoneReadHistory',
+  send: 'notDoneSend',
+  'composer-send': 'notDoneSend',
+  stop: 'notDoneStop',
+  'stop-task': 'notDoneStopTask',
+  'stop-tasks': 'notDoneStopTasks',
+  answer: 'notDoneAnswer',
+  option: 'notDoneOption',
+  command: 'notDoneCommand',
+  goal: 'notDoneGoal'
+}
+
+/** That the write did not happen, for one that a second attempt can carry out. Only the phone says
+ *  how: its message goes back to the composer and it has no Retry control. Everywhere else the
+ *  control that sent the write is the way to try again. */
+export function agentSessionWriteNotDoneParts(
+  write: AgentSessionWriteKind
+): AgentSessionWriteNoticeSentence[] {
+  return write === 'composer-send' ? ['notDoneSend', 'tryAgainComposerSend'] : [NOT_DONE[write]]
+}
+
+/** What the person can do about a refusal with this reason. */
+export type AgentSessionRefusalAction =
+  /** Use the control that sent the write again. */
+  | 'retry'
+  /** Wait for what the notice names; its step says what. */
+  | 'wait'
+  /** Take the step the notice names first. */
+  | 'actFirst'
+  /** Continue somewhere else: the current conversation, or a new chat. */
+  | 'goElsewhere'
+  | 'checkChat'
+  | 'updateOrca'
+  /** What the write was for is over: the question it answered moved on. */
+  | 'nothingLeft'
+  /** Orca's own state or fault; nothing the person does gets past it. */
+  | 'hostFinding'
+
+export type AgentSessionRefusalReasonWords =
+  /** The code's own words are the honest ones for this reason. */
+  | { words: 'code'; action: AgentSessionRefusalAction }
+  /** What stopped the write, and the step past it where the person has one to take. */
+  | {
+      cause: AgentSessionWriteNoticeSentence
+      step?: AgentSessionWriteNoticeSentence
+      action: AgentSessionRefusalAction
+    }
+  /** A start that failed: the sentence that failure has everywhere, whose next step is a send. */
+  | { fact: AgentSessionFailureKind; action: AgentSessionRefusalAction }
+
+function codeWords(action: AgentSessionRefusalAction): AgentSessionRefusalReasonWords {
+  return { words: 'code', action }
+}
+
+function causeWords(
+  cause: AgentSessionWriteNoticeSentence,
+  action: AgentSessionRefusalAction,
+  step?: AgentSessionWriteNoticeSentence
+): AgentSessionRefusalReasonWords {
+  return step ? { cause, step, action } : { cause, action }
+}
+
+const AGENT_STARTING = causeWords('agentStarting', 'wait', 'waitForStart')
+const OWNER_UNPROVEN = causeWords('ownerUnproven', 'actFirst', 'reopenChat')
+// Only a terminal agent an older build recorded holds a claim; quitting it frees the chat.
+const TERMINAL_CLAIM = causeWords('terminalAgentHoldsChat', 'actFirst', 'quitTerminalAgent')
+
+// Every reason of every code, so a reason the host adds does not compile until it has words.
+// Reasons only a create, attach, hold or adopted import meets never reach a chat write; they keep
+// their code's words.
+const REASON_WORDS = {
+  agent_session_operation_invalid: {
+    requestMalformed: codeWords('hostFinding'),
+    operationIdInvalid: codeWords('hostFinding'),
+    messageIdReused: codeWords('hostFinding'),
+    // Settled under that id, so the control's retry goes out under a new one.
+    operationRefusedEarlier: codeWords('retry'),
+    journalWriteFailed: causeWords('recordFailed', 'retry'),
+    conversationCleared: causeWords(
+      'conversationCleared',
+      'goElsewhere',
+      'openCurrentConversation'
+    ),
+    // Only an older host sends this, and it keeps refusing the chat, so only a new chat continues.
+    clearUnconfirmed: causeWords('clearUnfinished', 'goElsewhere', 'startNewChat'),
+    // Only an older host sends this, for a /clear it never settled; only that host resolves it.
+    conversationCommandUnconfirmed: codeWords('hostFinding'),
+    conversationCommandInFlight: causeWords('commandRunning', 'wait', 'waitForCommand'),
+    // The chat's agent process is being replaced, which a start or restart does.
+    handoffInFlight: AGENT_STARTING,
+    turnActive: causeWords('turnActive', 'wait', 'waitForTurn'),
+    promptPending: causeWords('promptPending', 'actFirst', 'answerFirst'),
+    backgroundTasksRunning: causeWords('backgroundTasksRunning', 'wait', 'waitForBackgroundTasks'),
+    messagesUnsettled: causeWords('messagesUnsettled', 'actFirst', 'settleEarlierMessage'),
+    // No chat surface sends a rewind; a replayed one says only that it did not happen.
+    rewindRefused: codeWords('hostFinding'),
+    rewindUnconfirmed: codeWords('hostFinding'),
+    promptGone: causeWords('questionChanged', 'nothingLeft'),
+    optionRejected: causeWords('optionRejected', 'retry'),
+    providerStarting: AGENT_STARTING,
+    goalsUnsupported: causeWords('goalsUnsupported', 'hostFinding'),
+    providerRejected: causeWords('agentRefused', 'retry'),
+    providerStartFailed: { fact: 'providerStartFailed', action: 'retry' },
+    notSignedIn: { fact: 'notSignedIn', action: 'actFirst' },
+    historyTooLarge: { fact: 'historyTooLarge', action: 'goElsewhere' },
+    managedAccountEnvOverride: { fact: 'managedAccountEnvOverride', action: 'actFirst' },
+    accountSwitchInProgress: { fact: 'accountSwitchInProgress', action: 'wait' },
+    managedAccountUnsupported: { fact: 'managedAccountUnsupported', action: 'actFirst' },
+    attachFailed: codeWords('retry')
+  },
+  agent_session_ownership_unknown: {
+    sessionNotAttached: codeWords('retry'),
+    noLiveOwner: codeWords('retry'),
+    ownerUnproven: OWNER_UNPROVEN,
+    claimConflicted: TERMINAL_CLAIM,
+    recordMissing: codeWords('retry'),
+    replaySuperseded: codeWords('retry'),
+    leaseMoved: codeWords('retry'),
+    spawnIdentityMismatch: codeWords('hostFinding'),
+    notResumable: codeWords('retry'),
+    noProviderChild: codeWords('retry'),
+    conversationHeldElsewhere: codeWords('retry')
+  },
+  agent_session_conflict: {
+    chatStarting: AGENT_STARTING,
+    ownerUnproven: OWNER_UNPROVEN,
+    claimConflicted: TERMINAL_CLAIM,
+    ownerAlive: codeWords('retry'),
+    identityMismatch: codeWords('hostFinding'),
+    sessionExists: codeWords('retry'),
+    conversationHeldElsewhere: codeWords('retry'),
+    tabIdTaken: codeWords('retry')
+  },
+  execution_owner_reconciling: {
+    hostReconciling: causeWords('hostReconciling', 'wait', 'waitMoment'),
+    recordUnreadable: causeWords('recordUnreadable', 'hostFinding')
+  },
+  agent_session_checkpoint_stale: {
+    fenceStale: codeWords('retry'),
+    leaseMoved: codeWords('retry'),
+    recordMissing: codeWords('retry')
+  },
+  agent_session_identity_required: {
+    recordMissing: causeWords('chatNotFound', 'goElsewhere', 'startNewChat'),
+    transcriptNotFound: codeWords('retry'),
+    transcriptUnreadable: codeWords('hostFinding')
+  },
+  agent_session_operation_conflict: {
+    fingerprintMismatch: codeWords('hostFinding'),
+    operationIdReused: codeWords('hostFinding'),
+    handoffInFlight: codeWords('retry')
+  },
+  agent_session_operation_expired: { operationExpired: codeWords('retry') },
+  agent_session_operation_capacity: { operationCapacity: codeWords('wait') },
+  agent_session_operation_unknown: {
+    outcomeUnknown: codeWords('checkChat'),
+    resultLost: codeWords('checkChat'),
+    rewindUnconfirmed: codeWords('checkChat'),
+    tabUnconfirmed: codeWords('checkChat')
+  },
+  agent_session_item_revision_stale: { promptMoved: codeWords('nothingLeft') },
+  agent_session_already_resolved: { promptAlreadyResolved: codeWords('nothingLeft') },
+  agent_session_journal_unreadable: {
+    // No retry reads past damage, and the words name no step: it only can't load.
+    journalCorrupt: causeWords('historyUnusable', 'hostFinding'),
+    // Says its step despite 'retry' unless a Retry stands beside it: the phone often has none.
+    journalUnavailable: causeWords('historyUnavailable', 'retry', 'tryAgain')
+  },
+  // Thrown, so a client meets these only as an RPC error; the code's words stand.
+  structured_agent_session_unsupported: {
+    clientCapabilityMissing: codeWords('updateOrca'),
+    hostDisabled: codeWords('hostFinding'),
+    hostUnsupported: codeWords('updateOrca')
+  },
+  agent_session_owner_restart_failed: {}
+} satisfies {
+  [C in AgentSessionWireRefusalCode]: Record<
+    AgentSessionRefusalReason<C>,
+    AgentSessionRefusalReasonWords
+  >
+}
+
+/** The words and next step a reason gets; undefined when the refusal names none. */
+export function agentSessionRefusalReasonWords(
+  failure: AgentSessionWriteRefusal
+): AgentSessionRefusalReasonWords | undefined {
+  const reason = failure.details?.reason
+  const byReason: Partial<Record<string, AgentSessionRefusalReasonWords>> | undefined =
+    REASON_WORDS[failure.code]
+  return reason === undefined ? undefined : byReason?.[reason]
+}
+
+// Each already says the history was not read.
+const HISTORY_CAUSES: ReadonlySet<AgentSessionWriteNoticeSentence> = new Set([
+  'historyUnusable',
+  'historyUnavailable',
+  'historyUnreadable'
+])
+
+/** A cause, and that the request did not happen unless the cause already says so. */
+function causeParts(
+  cause: AgentSessionWriteNoticeSentence,
+  write: AgentSessionWriteKind
+): AgentSessionWriteNoticeSentence[] {
+  const saysNotDone =
+    (write === 'read-history' && HISTORY_CAUSES.has(cause)) ||
+    (cause === 'questionChanged' && write === 'answer')
+  return saysNotDone ? [cause] : [cause, NOT_DONE[write]]
+}
+
+/** The notice a named reason has of its own; undefined leaves the code's words. */
+function reasonParts(
+  failure: AgentSessionWriteRefusal,
+  write: AgentSessionWriteKind,
+  context: AgentSessionFailureWordsContext
+): AgentSessionWriteNoticePart[] | undefined {
+  const words = agentSessionRefusalReasonWords(failure)
+  if (!words || 'words' in words) {
+    return undefined
+  }
+  if ('fact' in words) {
+    const sentence = agentSessionFailureSentence({ kind: words.fact }, 'rejection', context)
+    return write === 'send' || write === 'composer-send'
+      ? [NOT_DONE[write], { text: sentence }]
+      : undefined
+  }
+  const said = causeParts(words.cause, write)
+  // A Retry beside the words is the step for a reason whose action is to retry.
+  const retried = context.retryControl && words.action === 'retry'
+  return words.step && !retried ? [...said, words.step] : said
+}
+
+/** What stopped a refused start, for a line that already says the chat did not start and shows its
+ *  own Retry. Empty when the refusal names no reason with words of its own. */
+export function agentSessionRefusalCauseParts(
+  failure: AgentSessionWriteFailure,
+  context: { agentName?: string } = {}
+): AgentSessionWriteNoticePart[] {
+  const parts =
+    failure.kind === 'refused'
+      ? reasonParts(failure, 'send', { ...context, retryControl: true })
+      : undefined
+  return parts?.filter((part) => part !== 'notDoneSend') ?? []
+}
+
+/** `context.retryControl`: a Retry beside the words is the step for a reason whose action is to
+ *  retry, and for sending again; any other step stays. */
+export function agentSessionWriteNoticeParts(
+  failure: AgentSessionWriteFailure,
+  write: AgentSessionWriteKind,
+  context: AgentSessionFailureWordsContext = {}
+): AgentSessionWriteNoticePart[] {
+  const notDone = NOT_DONE[write]
+  if (failure.kind === 'failed') {
+    return agentSessionWriteNotDoneParts(write)
+  }
+  if (failure.kind === 'unconfirmed') {
+    return ['outcomeUnknown']
+  }
+  const byReason = reasonParts(failure, write, context)
+  if (byReason) {
+    return byReason
+  }
+  switch (failure.code) {
+    // The cause is in the chat's own status row. Some restarts can be retried and some need a new
+    // chat, and the code does not say which.
+    case 'agent_session_owner_restart_failed':
+      return ['restartFailed', notDone]
+    // Several different owner states share these codes. Each is refused before the id is recorded,
+    // so the phone's resend under the same id can go through.
+    case 'agent_session_checkpoint_stale':
+    case 'agent_session_conflict':
+    case 'agent_session_ownership_unknown':
+    case 'execution_owner_reconciling':
+      return agentSessionWriteNotDoneParts(write)
+    // Counted across every chat and freed only as a day's requests age out, so trying again now
+    // would likely be refused again.
+    case 'agent_session_operation_capacity':
+      return ['capacity', notDone]
+    // The phone resends under the same id, which the host refuses the same way again. The rest
+    // stand for reasons the code does not name (a cleared conversation, a pending question, a
+    // provider's own rejection...), so any cause or next step could be false.
+    case 'agent_session_operation_conflict':
+    case 'agent_session_operation_expired':
+    case 'agent_session_operation_invalid':
+    case 'agent_session_identity_required':
+      return [notDone]
+    case 'agent_session_operation_unknown':
+      return ['outcomeUnknown']
+    // A Stop names the prompt it was pressed under, so it can be refused this way too.
+    case 'agent_session_item_revision_stale':
+    case 'agent_session_already_resolved':
+      return causeParts('questionChanged', write)
+    // A host that names no reason raised it for damage and for an open that can clear alike.
+    case 'agent_session_journal_unreadable':
+      return causeParts('historyUnreadable', write)
+    case 'structured_agent_session_unsupported':
+      return ['unsupported']
+  }
+  // A newer host can send a code this client has never heard of.
+  return [notDone]
+}
+
+export function agentSessionWriteNoticeEnglish(
+  parts: readonly AgentSessionWriteNoticePart[]
+): string {
+  return parts
+    .map((part) => (typeof part === 'string' ? AGENT_SESSION_WRITE_NOTICE_COPY[part] : part.text))
+    .join(' ')
+}
+
+/** English, for a surface without translations. Takes the refusal as the wire gives it; its
+ *  message is not read. */
+export function agentSessionRefusalNotice(
+  refusal: Pick<AgentSessionWireRefusal, 'code' | 'message' | 'details'>,
+  write: AgentSessionWriteKind
+): string {
+  return agentSessionWriteNoticeEnglish(
+    agentSessionWriteNoticeParts(agentSessionRefusalFailure(refusal), write)
+  )
+}
+
+/** English, for a write whose request failed without a refusal. */
+export function agentSessionWriteFailureNotice(write: AgentSessionWriteKind): string {
+  return agentSessionWriteNoticeEnglish(agentSessionWriteNoticeParts({ kind: 'failed' }, write))
+}
+
+/** The notice for a refused read of a chat's history, from the refusal's code and any details a
+ *  host sent; a code this build does not know says only that the history did not load. */
+export function agentSessionReadHistoryRefusalParts(
+  code: string,
+  details?: unknown,
+  context: AgentSessionFailureWordsContext = {}
+): AgentSessionWriteNoticePart[] {
+  const failure = parseAgentSessionWriteFailure({ kind: 'refused', code, details })
+  return failure
+    ? agentSessionWriteNoticeParts(failure, 'read-history', context)
+    : agentSessionWriteNotDoneParts('read-history')
+}
diff --git a/src/shared/agent-session-refusal-retry.test.ts b/src/shared/agent-session-refusal-retry.test.ts
new file mode 100644
index 00000000000..30a9a177f8e
--- /dev/null
+++ b/src/shared/agent-session-refusal-retry.test.ts
@@ -0,0 +1,104 @@
+import { describe, expect, it } from 'vitest'
+import type { AgentSessionOwnerVerdict } from './agent-session-wire'
+import { agentSessionOwnerVerdictAllowsFreshOperationId } from './agent-session-refusal-retry'
+import { parseAgentSessionWriteFailure } from './agent-session-write-failure'
+import {
+  admitStructuredAgentSessionOutboxEntry,
+  createStructuredAgentSessionOutboxEntry,
+  requeueStructuredAgentSessionSendRefusal
+} from './structured-agent-session-outbox'
+import { disposeStructuredAgentSessionSendResult } from './structured-agent-session-send-disposition'
+
+const entry = createStructuredAgentSessionOutboxEntry({
+  clientMessageId: 'message-1',
+  sessionId: 'session-1',
+  text: 'hello',
+  attachments: [],
+  queuedAt: 1
+})
+
+/** A refused send as a reloaded entry holds it: through the saved shape and back. */
+function storedOwnershipRefusal(ownerVerdict: AgentSessionOwnerVerdict | undefined) {
+  const failure = parseAgentSessionWriteFailure(
+    JSON.parse(
+      JSON.stringify({
+        kind: 'refused',
+        code: 'agent_session_ownership_unknown',
+        details: { reason: 'ownerUnproven', ...(ownerVerdict ? { ownerVerdict } : {}) }
+      })
+    )
+  )
+  if (failure?.kind !== 'refused') {
+    throw new Error('the saved refusal did not read back')
+  }
+  return failure
+}
+
+function retried(ownerVerdict: AgentSessionOwnerVerdict | undefined) {
+  return requeueStructuredAgentSessionSendRefusal(
+    entry,
+    storedOwnershipRefusal(ownerVerdict),
+    () => 'message-2'
+  )
+}
+
+describe("the owner's verdict decides a retry's operation id only as a floor", () => {
+  it('lets a retry use a new id once the stored verdict proves nothing runs', () => {
+    expect(agentSessionOwnerVerdictAllowsFreshOperationId('exited')).toBe(true)
+    // A new id only: nothing recorded the message, so it stays queued at the head.
+    expect(retried('exited')).toMatchObject({ clientMessageId: 'message-2', state: 'queued' })
+  })
+
+  it('keeps later sends behind the message after an exited refusal', () => {
+    const later = createStructuredAgentSessionOutboxEntry({
+      clientMessageId: 'message-3',
+      sessionId: 'session-1',
+      text: 'after',
+      attachments: [],
+      queuedAt: 2
+    })
+    const disposition = disposeStructuredAgentSessionSendResult({
+      entries: [entry, later],
+      entry,
+      blockedClientMessageId: null,
+      result: {
+        ok: false,
+        refusal: {
+          code: 'agent_session_ownership_unknown',
+          message: 'x',
+          details: { reason: 'ownerUnproven', ownerVerdict: 'exited' }
+        }
+      },
+      createOperationId: () => 'message-2'
+    })
+    expect(disposition.blockedClientMessageId).toBe('message-2')
+    expect(
+      admitStructuredAgentSessionOutboxEntry(
+        disposition.entries,
+        disposition.blockedClientMessageId
+      )
+    ).toMatchObject({ state: 'blocked', entry: { clientMessageId: 'message-2' } })
+  })
+
+  it.each<AgentSessionOwnerVerdict | undefined>(['unverifiable', 'live', undefined])(
+    'keeps the id for a stored %s verdict, whose operation may still land',
+    (stored) => {
+      expect(agentSessionOwnerVerdictAllowsFreshOperationId(stored)).toBe(false)
+      expect(retried(stored)).toMatchObject({ clientMessageId: 'message-1', state: 'queued' })
+    }
+  )
+
+  it.each<AgentSessionOwnerVerdict | undefined>(['unverifiable', 'live', undefined])(
+    'moves off a stored %s verdict only when the current lease proves the owner exited',
+    (stored) => {
+      expect(agentSessionOwnerVerdictAllowsFreshOperationId(stored, 'exited')).toBe(true)
+      expect(agentSessionOwnerVerdictAllowsFreshOperationId(stored, 'unverifiable')).toBe(false)
+      expect(agentSessionOwnerVerdictAllowsFreshOperationId(stored, 'live')).toBe(false)
+    }
+  )
+
+  it('never lowers a stored exited', () => {
+    expect(agentSessionOwnerVerdictAllowsFreshOperationId('exited', 'live')).toBe(true)
+    expect(agentSessionOwnerVerdictAllowsFreshOperationId('exited', 'unverifiable')).toBe(true)
+  })
+})
diff --git a/src/shared/agent-session-refusal-retry.ts b/src/shared/agent-session-refusal-retry.ts
index 9777cfd42d1..093d3549729 100644
--- a/src/shared/agent-session-refusal-retry.ts
+++ b/src/shared/agent-session-refusal-retry.ts
@@ -1,4 +1,4 @@
-import type { AgentSessionWireRefusalCode } from './agent-session-wire'
+import type { AgentSessionOwnerVerdict, AgentSessionWireRefusalCode } from './agent-session-wire'
 
 export type AgentSessionRefusalOperationState = 'settled-rejected' | 'pending-admission' | 'unknown'
 
@@ -28,3 +28,16 @@ export function agentSessionRefusalOperationState(
       return 'pending-admission'
   }
 }
+
+/**
+ * Whether a verdict lets a retry use a new operation id. A stored `exited` is final: nothing runs
+ * the refused operation, so a new id cannot collide with it. Any other stored verdict is a floor:
+ * the first operation may still land, so only a verdict re-derived from the current lease can prove
+ * `exited`, and nothing lowers a stored `exited`.
+ */
+export function agentSessionOwnerVerdictAllowsFreshOperationId(
+  stored: AgentSessionOwnerVerdict | undefined,
+  current?: AgentSessionOwnerVerdict
+): boolean {
+  return stored === 'exited' || current === 'exited'
+}
diff --git a/src/shared/agent-session-resume-marker.ts b/src/shared/agent-session-resume-marker.ts
index 2c308ec998e..3890bd8f81d 100644
--- a/src/shared/agent-session-resume-marker.ts
+++ b/src/shared/agent-session-resume-marker.ts
@@ -6,8 +6,9 @@
 // the stop, because that fact exists only in memory at that moment — the provider rewrites the
 // journal in its own words on reattach.
 //
-// A marker has no expiry. It ends only by the user's own actions: a newer message in that chat, a
-// successful resume, a dismissal, or closing the chat — each of which deletes it.
+// A marker has no expiry. It ends when the chat's agent is started again other than by its own
+// continuation, or by a successful resume, a dismissal, or closing the chat — each of which
+// deletes it.
 
 import { z } from 'zod'
 import { AGENT_STATUS_STATES } from './agent-status-types'
@@ -18,6 +19,7 @@ import {
   AGENT_SESSION_RESTART_ACTIVITY_MAX_TASKS
 } from './agent-session-restart-activity'
 import type { AgentSessionRestartActivity } from './agent-session-restart-activity'
+import type { AgentJournalCursor } from './agent-session-journal-types'
 
 /** Why the app went away. Recorded because an update install is a restart the user did not choose,
  *  and the surface that offers the resume says so. */
@@ -48,8 +50,9 @@ export type AgentSessionResumeMarker = {
   /** The work in flight when teardown observed it — a running turn, or a send that had not yet
    *  become one. */
   work: AgentSessionResumeWork
-  /** The user message observed at teardown; a newer one supersedes this offer before its turn opens. */
-  latestUserItemId: string | null
+  /** The user message observed at teardown. Nothing reads it; still written for one release so the
+   *  previous build, whose parser requires it, can read this marker after a downgrade. */
+  latestUserItemId?: string | null
   /** Execution host's clock at teardown. */
   recordedAt: number
   trigger: AgentSessionResumeTrigger
@@ -65,6 +68,12 @@ export type AgentSessionResumeMarker = {
   providerHandleRoot: string
   /** Stable teardown identity for continuation deduplication, not launch ancestry. */
   teardownId: string
+  /**
+   * Where the chat's journal stood when the offer was taken. A message accepted after it, or a
+   * journal on another epoch, means the chat moved on. Absent on markers from builds that did not
+   * record it.
+   */
+  journalCursor?: AgentJournalCursor
   /**
    * What the session was doing, captured at the same stop-time snapshot that decided the offer.
    * The dialog row, the status bar and the wire candidate read ONLY this; nothing re-reads the
@@ -114,11 +123,15 @@ const agentSessionRestartActivitySchema = z.object({
 const agentSessionResumeMarkerSchema = z.object({
   sessionId: markerField,
   work: agentSessionResumeWorkSchema,
-  latestUserItemId: markerField.nullable(),
+  latestUserItemId: markerField.nullable().optional(),
   recordedAt: z.number().int().nonnegative(),
   trigger: z.enum(AGENT_SESSION_RESUME_TRIGGERS),
   providerHandleRoot: markerField,
   teardownId: markerField,
+  journalCursor: z
+    .object({ epoch: markerField, sequence: z.number().int().nonnegative() })
+    .optional()
+    .catch(undefined),
   activity: agentSessionRestartActivitySchema.optional().catch(undefined)
 })
 
@@ -129,6 +142,10 @@ export function parseAgentSessionResumeMarker(value: unknown): AgentSessionResum
   if (!parsed.success) {
     return null
   }
-  const { activity, ...marker } = parsed.data
-  return activity === undefined ? marker : { ...marker, activity }
+  const { activity, journalCursor, ...marker } = parsed.data
+  return {
+    ...marker,
+    ...(journalCursor === undefined ? {} : { journalCursor }),
+    ...(activity === undefined ? {} : { activity })
+  }
 }
diff --git a/src/shared/agent-session-resume.test.ts b/src/shared/agent-session-resume.test.ts
index 577492ddefc..397a1a9451f 100644
--- a/src/shared/agent-session-resume.test.ts
+++ b/src/shared/agent-session-resume.test.ts
@@ -28,6 +28,10 @@ describe('agent session resume metadata', () => {
     expect(isResumableTuiAgent('kimi')).toBe(true)
   })
 
+  it('treats CodeBuddy as a resumable TUI agent', () => {
+    expect(isResumableTuiAgent('codebuddy')).toBe(true)
+  })
+
   it.each([
     ['claude', { session_id: 'claude-session' }, { key: 'session_id', id: 'claude-session' }],
     ['codex', { session_id: 'codex-session' }, { key: 'session_id', id: 'codex-session' }],
@@ -70,6 +74,7 @@ describe('agent session resume metadata', () => {
 
   it.each([
     ['claude', { key: 'session_id', id: 's1' }, ['claude', '--resume', 's1']],
+    ['codebuddy', { key: 'session_id', id: 's1' }, ['codebuddy', '--resume', 's1']],
     ['codex', { key: 'session_id', id: 's1' }, ['codex', 'resume', 's1']],
     ['gemini', { key: 'session_id', id: 's1' }, ['gemini', '--resume', 's1']],
     ['antigravity', { key: 'conversation_id', id: 's1' }, ['agy', '--conversation', 's1']],
diff --git a/src/shared/agent-session-resume.ts b/src/shared/agent-session-resume.ts
index 89bef799a22..40a3699af3c 100644
--- a/src/shared/agent-session-resume.ts
+++ b/src/shared/agent-session-resume.ts
@@ -1,10 +1,13 @@
 import type { AgentHookSource } from './agent-hook-relay'
 import type { AgentStatusState } from './agent-status-types'
+import type { AgentMainAgentStatus } from './main-agent-status'
 import type { TuiAgent } from './tui-agent'
 
 export const RESUMABLE_TUI_AGENTS = [
   'claude',
+  'codebuddy',
   'codex',
+  'qoder',
   'gemini',
   'antigravity',
   'opencode',
@@ -19,7 +22,8 @@ export const RESUMABLE_TUI_AGENTS = [
   'copilot',
   'kimi',
   'muse',
-  'zcode'
+  'zcode',
+  'dsh'
 ] as const satisfies readonly TuiAgent[]
 
 export type ResumableTuiAgent = (typeof RESUMABLE_TUI_AGENTS)[number]
@@ -58,6 +62,9 @@ export type SleepingAgentSessionRecord = {
   terminalTitle?: string
   lastAssistantMessage?: string
   interrupted?: boolean
+  /** The main agent's own status when captured, copied with `interrupted` by `agentVerdictFields`;
+   *  read the verdict through `agentMainAgentVerdict`. */
+  mainAgent?: AgentMainAgentStatus
   connectionId?: string | null
   launchConfig?: SleepingAgentLaunchConfig
   /** How the record was captured. Worktree-sleep records (legacy records have
@@ -189,6 +196,8 @@ export function extractAgentProviderSession(
     // Native-chat agents: also capture the hook's authoritative transcript_path,
     // since recent Claude Code names the transcript file with a UUID that differs
     // from the hook session_id (so the id-based glob no longer finds it).
+    case 'qoder':
+    case 'codebuddy':
     case 'claude':
     case 'codex': {
       const id = readSessionId(payload, ['session_id'])
@@ -212,6 +221,12 @@ export function extractAgentProviderSession(
       const id = readSessionId(payload, ['session_id'])
       return id ? { key: 'session_id', id } : null
     }
+    // Why: DSH's hook bridge always sends an empty `transcript_path` (its persistence seam
+    // exposes no artifact path), so the session id alone carries the resume target.
+    case 'dsh': {
+      const id = readSessionId(payload, ['session_id'])
+      return id ? { key: 'session_id', id } : null
+    }
     case 'antigravity': {
       const id = readSessionId(payload, ['conversationId'])
       return id ? { key: 'conversation_id', id } : null
@@ -264,10 +279,14 @@ export function getAgentResumeArgv(
 ): string[] | null {
   const id = providerSession.id
   switch (agent) {
+    case 'codebuddy':
+      return providerSession.key === 'session_id' ? ['codebuddy', '--resume', id] : null
     case 'claude':
       return providerSession.key === 'session_id' ? ['claude', '--resume', id] : null
     case 'codex':
       return providerSession.key === 'session_id' ? ['codex', 'resume', id] : null
+    case 'qoder':
+      return providerSession.key === 'session_id' ? ['qodercli', '--resume', id] : null
     case 'gemini':
       return providerSession.key === 'session_id' ? ['gemini', '--resume', id] : null
     case 'antigravity':
@@ -314,5 +333,9 @@ export function getAgentResumeArgv(
       return providerSession.key === 'session_id' ? ['muse', 'resume', id] : null
     case 'zcode':
       return providerSession.key === 'session_id' ? ['zcode', '--resume', id] : null
+    // Why: `dsh-tui --resume <id>` re-enters the session the launcher recorded for this
+    // workspace. DSH keys sessions by workspace path, so callers must keep the cwd.
+    case 'dsh':
+      return providerSession.key === 'session_id' ? ['dsh-tui', '--resume', id] : null
   }
 }
diff --git a/src/shared/agent-session-rewind.ts b/src/shared/agent-session-rewind.ts
index 3767a1c59fc..805d74b8843 100644
--- a/src/shared/agent-session-rewind.ts
+++ b/src/shared/agent-session-rewind.ts
@@ -1,5 +1,9 @@
 import { z } from 'zod'
-import { AgentJournalItemBodySchema } from './agent-session-journal-schemas'
+import {
+  AgentJournalItemBodySchema,
+  AgentJournalProducerLinkageFields,
+  AgentJournalTurnScopeSchema
+} from './agent-session-journal-schemas'
 import { parseAgentJournalItemKey } from './agent-session-journal-item-key'
 import type { AgentSessionMutationEnvelope } from './agent-session-wire'
 
@@ -35,14 +39,16 @@ export const AgentSessionRewindRecordSchema = z.object({
   phase: z.enum(['prepared', 'provider-succeeded', 'completed', 'refused']),
   epoch: Key.optional(),
   hydrationVerified: z.boolean().optional(),
-  providerApplied: z.boolean().optional(),
   reason: z.string().min(1).max(512).optional(),
   retained: z
     .array(
       z.object({
         itemId: Key.refine((key) => parseAgentJournalItemKey(key) !== null),
         body: AgentJournalItemBodySchema,
-        observedAt: z.number().finite()
+        observedAt: z.number().finite(),
+        // Absent on records written before rows stated them: the rebuild then places the row by position.
+        turnScope: AgentJournalTurnScopeSchema.optional(),
+        ...AgentJournalProducerLinkageFields
       })
     )
     .max(10_000)
diff --git a/src/shared/agent-session-turn-record.ts b/src/shared/agent-session-turn-record.ts
index d321b663b7b..2932eef5c1f 100644
--- a/src/shared/agent-session-turn-record.ts
+++ b/src/shared/agent-session-turn-record.ts
@@ -59,12 +59,17 @@ export function agentJournalTurnBody(turn: AgentJournalTurnLifecycle): AgentJour
   return { kind: 'turn', ...turn }
 }
 
-/** The pre-v3 carrier, for clients that predate the `turn` item. The agent name
+/** The pre-v3 carrier, for clients that predate the `turn` item. The agent name is the session's
+ *  when the caller knows it — a command's turn is keyed `orca:…` whatever agent ran it — else it
  *  comes from the lifecycle identity (`legacy:<agent>:…`). */
 export function legacyAgentJournalTurnStatusBody(
   turn: AgentJournalTurnLifecycle,
-  itemId: string
+  itemId: string,
+  sessionAgent?: string | null
 ): AgentJournalStatusItem {
-  const agent = itemId.startsWith('legacy:claude:') ? 'Claude' : 'Codex'
+  const agent =
+    (sessionAgent ?? (itemId.startsWith('legacy:claude:') ? 'claude' : 'codex')) === 'claude'
+      ? 'Claude'
+      : 'Codex'
   return { kind: 'status', text: agentTurnLifecycleText(agent, turn.state), turnLifecycle: turn }
 }
diff --git a/src/shared/agent-session-wire-refusals.test.ts b/src/shared/agent-session-wire-refusals.test.ts
new file mode 100644
index 00000000000..af017a617e7
--- /dev/null
+++ b/src/shared/agent-session-wire-refusals.test.ts
@@ -0,0 +1,218 @@
+import { describe, expect, it } from 'vitest'
+import {
+  AGENT_SESSION_REFUSAL_REASONS,
+  readAgentSessionRefusalDetails
+} from './agent-session-refusal-details'
+import {
+  AGENT_SESSION_WIRE_REFUSAL_CODES,
+  agentSessionRefusalError,
+  agentSessionRefusalReference,
+  readAgentSessionRefusalReference,
+  refuse,
+  refuseUnclassified,
+  withAgentSessionRefusalFacts,
+  type AgentSessionWireRefusal
+} from './agent-session-wire-refusals'
+import type { AgentJournalResolution } from './agent-session-journal-types'
+
+const RESOLUTION: AgentJournalResolution = {
+  state: 'resolved',
+  selectedOptionId: 'allow',
+  resolvedBy: 'phone-1',
+  resolvedAt: 1_789_000_000_000
+}
+
+/** The refusal with its new field removed: exactly what a released client reads. */
+function asReleasedClientSeesIt(refusal: AgentSessionWireRefusal): unknown {
+  const { details: _details, ...rest } = JSON.parse(JSON.stringify(refusal))
+  return rest
+}
+
+describe('a refusal names only a reason its code lists', () => {
+  it('rejects a reason another code lists, at compile time', () => {
+    // @ts-expect-error `promptGone` is an operation_invalid reason, not a conflict one.
+    refuse('agent_session_conflict', { reason: 'promptGone' }, 'm')
+    // @ts-expect-error the thrown form is held to the same list.
+    agentSessionRefusalError('agent_session_identity_required', { reason: 'claimConflicted' })
+    // @ts-expect-error a fact another code carries is not this code's.
+    refuse('agent_session_conflict', { reason: 'ownerAlive', currentFence: 3 }, 'm')
+    // @ts-expect-error the unclassified path cannot carry a reason.
+    refuseUnclassified('agent_session_conflict', 'm', { reason: 'claimConflicted' })
+    expect(refuse('agent_session_conflict', { reason: 'ownerAlive' }, 'm').details).toEqual({
+      reason: 'ownerAlive'
+    })
+  })
+
+  it('has no catch-all reason under any code', () => {
+    for (const code of AGENT_SESSION_WIRE_REFUSAL_CODES) {
+      for (const reason of AGENT_SESSION_REFUSAL_REASONS[code]) {
+        expect([code, reason]).not.toEqual([code, expect.stringMatching(/^(other|unknown)$/i)])
+        expect(reason).not.toMatch(/fault|generic|misc/i)
+      }
+    }
+  })
+})
+
+describe('the loose fields released clients read', () => {
+  it('are copied from details by refuse, one field at a time', () => {
+    expect(
+      refuse('agent_session_checkpoint_stale', { reason: 'fenceStale', currentFence: 4 }, 'm')
+    ).toMatchObject({ currentFence: 4 })
+    expect(
+      refuse(
+        'agent_session_item_revision_stale',
+        { reason: 'promptMoved', currentRevision: 2, resolution: RESOLUTION },
+        'm'
+      )
+    ).toMatchObject({ currentRevision: 2, resolution: RESOLUTION })
+    expect(
+      refuse(
+        'agent_session_operation_invalid',
+        { reason: 'rewindRefused', rewindReason: 'busy' },
+        'm'
+      )
+    ).toMatchObject({ rewindReason: 'busy' })
+    expect(
+      refuse(
+        'agent_session_ownership_unknown',
+        { reason: 'ownerUnproven', ownerVerdict: 'exited' },
+        'm'
+      )
+    ).toMatchObject({ ownerVerdict: 'exited' })
+    expect(
+      refuseUnclassified('agent_session_checkpoint_stale', 'm', { currentFence: 9 })
+    ).toMatchObject({ currentFence: 9, details: { currentFence: 9 } })
+  })
+
+  it('gain a verdict learned after the refusal, in details and at the top level', () => {
+    const stamped = withAgentSessionRefusalFacts(
+      refuse('agent_session_operation_invalid', { reason: 'providerStartFailed' }, 'm'),
+      { ownerVerdict: 'exited' }
+    )
+    expect(stamped).toEqual({
+      code: 'agent_session_operation_invalid',
+      message: 'm',
+      details: { reason: 'providerStartFailed', ownerVerdict: 'exited' },
+      ownerVerdict: 'exited'
+    })
+    // A refusal an older row replayed, with no reason, still reaches released clients with it.
+    expect(
+      withAgentSessionRefusalFacts(refuseUnclassified('agent_session_conflict', 'm'), {
+        ownerVerdict: 'unverifiable'
+      })
+    ).toEqual({
+      code: 'agent_session_conflict',
+      message: 'm',
+      details: { ownerVerdict: 'unverifiable' },
+      ownerVerdict: 'unverifiable'
+    })
+  })
+
+  // Each expected value is the literal the host built for the same situation before details.
+  it.each([
+    [
+      'a moved prompt',
+      refuse(
+        'agent_session_item_revision_stale',
+        { reason: 'promptMoved', currentRevision: 2, resolution: RESOLUTION },
+        'Item i has moved on.'
+      ),
+      {
+        code: 'agent_session_item_revision_stale',
+        message: 'Item i has moved on.',
+        currentRevision: 2,
+        resolution: RESOLUTION
+      }
+    ],
+    [
+      'a resolved prompt',
+      refuse(
+        'agent_session_already_resolved',
+        { reason: 'promptAlreadyResolved', currentRevision: 2, resolution: RESOLUTION },
+        'Item i was already resolved.'
+      ),
+      {
+        code: 'agent_session_already_resolved',
+        message: 'Item i was already resolved.',
+        currentRevision: 2,
+        resolution: RESOLUTION
+      }
+    ],
+    [
+      'a stale fence',
+      refuse('agent_session_checkpoint_stale', { reason: 'fenceStale', currentFence: 4 }, 'm'),
+      { code: 'agent_session_checkpoint_stale', message: 'm', currentFence: 4 }
+    ],
+    [
+      'a refused rewind',
+      refuse(
+        'agent_session_operation_invalid',
+        { reason: 'rewindRefused', rewindReason: 'busy' },
+        'agent_session_rewind:busy'
+      ),
+      {
+        code: 'agent_session_operation_invalid',
+        message: 'agent_session_rewind:busy',
+        rewindReason: 'busy'
+      }
+    ],
+    [
+      'a failed create',
+      withAgentSessionRefusalFacts(
+        refuse('agent_session_operation_invalid', { reason: 'providerStartFailed' }, 'exited 1'),
+        { ownerVerdict: 'exited' }
+      ),
+      { code: 'agent_session_operation_invalid', message: 'exited 1', ownerVerdict: 'exited' }
+    ],
+    [
+      'a refusal with no facts',
+      refuse('agent_session_conflict', { reason: 'claimConflicted' }, 'm'),
+      { code: 'agent_session_conflict', message: 'm' }
+    ]
+  ] as const)('read by a released client exactly as before for %s', (_label, refusal, before) => {
+    expect(asReleasedClientSeesIt(refusal)).toEqual(before)
+  })
+})
+
+describe('a stored refusal read back', () => {
+  it('keeps what the code lists and drops the rest', () => {
+    expect(
+      readAgentSessionRefusalDetails('agent_session_checkpoint_stale', {
+        reason: 'fenceStale',
+        currentFence: 3,
+        currentRevision: 8,
+        cause: 'fenceStale'
+      })
+    ).toEqual({ reason: 'fenceStale', currentFence: 3 })
+    // A reason a newer host added reads as none, but the facts beside it still count.
+    expect(
+      readAgentSessionRefusalDetails('agent_session_checkpoint_stale', {
+        reason: 'futureReason',
+        currentFence: 3
+      })
+    ).toEqual({ currentFence: 3 })
+    expect(readAgentSessionRefusalDetails('agent_session_conflict', { reason: 'x' })).toBe(
+      undefined
+    )
+  })
+
+  it('round-trips through its reference, and reads an older shape as naming nothing', () => {
+    const refusal = refuse(
+      'agent_session_ownership_unknown',
+      { reason: 'noLiveOwner', ownerVerdict: 'live' },
+      'm'
+    )
+    const reference = agentSessionRefusalReference(refusal)
+    expect(reference).toEqual({
+      code: 'agent_session_ownership_unknown',
+      details: { reason: 'noLiveOwner', ownerVerdict: 'live' }
+    })
+    expect(readAgentSessionRefusalReference(JSON.parse(JSON.stringify(reference)))).toEqual(
+      reference
+    )
+    expect(
+      readAgentSessionRefusalReference({ code: 'agent_session_conflict', cause: 'claimConflicted' })
+    ).toEqual({ code: 'agent_session_conflict' })
+    expect(readAgentSessionRefusalReference({ code: 'agent_session_future' })).toBeUndefined()
+  })
+})
diff --git a/src/shared/agent-session-wire-refusals.ts b/src/shared/agent-session-wire-refusals.ts
index 12cd63d4490..8fd1602377b 100644
--- a/src/shared/agent-session-wire-refusals.ts
+++ b/src/shared/agent-session-wire-refusals.ts
@@ -1,8 +1,24 @@
 // How the host declines an `agentSession.*` mutation: the closed code list, its
 // narrowing guard, and the refusal body a client reads.
 
-import type { AgentJournalResolution } from './agent-session-journal-types'
-import type { AgentSessionRewindReason } from './agent-session-rewind'
+import {
+  agentSessionLegacyRefusalFields,
+  readAgentSessionRefusalDetails,
+  type AgentSessionAnyRefusalDetails,
+  type AgentSessionLegacyRefusalFields,
+  type AgentSessionRefusalDetails,
+  type AgentSessionRefusalDetailsByCode,
+  type AgentSessionRefusalFacts
+} from './agent-session-refusal-details'
+
+export type {
+  AgentSessionAnyRefusalDetails,
+  AgentSessionAnyRefusalReason,
+  AgentSessionLegacyRefusalFields,
+  AgentSessionRefusalDetails,
+  AgentSessionRefusalDetailsByCode,
+  AgentSessionRefusalReason
+} from './agent-session-refusal-details'
 
 export const AGENT_SESSION_WIRE_REFUSAL_CODES = [
   'structured_agent_session_unsupported',
@@ -38,17 +54,140 @@ export function isAgentSessionWireRefusalCode(
 /** What the host last proved about a session's provider process; see the SSH execution boundary. */
 export type AgentSessionOwnerVerdict = 'live' | 'unverifiable' | 'exited'
 
-export type AgentSessionWireRefusal = {
-  rewindReason?: AgentSessionRewindReason
-  code: AgentSessionWireRefusalCode
+/** One variant per code, so a refusal's details can only be that code's. */
+export type AgentSessionRefusalOf<C extends AgentSessionWireRefusalCode> = {
+  [K in C]: {
+    code: K
+    /** For logs and released clients, which print it; newer clients choose words from details. */
+    message: string
+    /** Absent from older hosts. */
+    details?: AgentSessionRefusalDetails<K>
+  } & AgentSessionLegacyRefusalFields
+}[C]
+
+export type AgentSessionWireRefusal = AgentSessionRefusalOf<AgentSessionWireRefusalCode>
+
+/** A refusal named without its prose: what a durable record or an error's data keeps. */
+export type AgentSessionRefusalReference = {
+  [K in AgentSessionWireRefusalCode]: { code: K; details?: AgentSessionRefusalDetails<K> }
+}[AgentSessionWireRefusalCode]
+
+function buildRefusal(
+  code: AgentSessionWireRefusalCode,
+  details: AgentSessionAnyRefusalDetails | undefined,
   message: string
-  /** On a stale fence, so the client can retry without another round trip. */
-  currentFence?: number
-  /** On a lost compare-and-set: the winning answer and who gave it. */
-  resolution?: AgentJournalResolution
-  /** On a lost compare-and-set: the revision the host actually holds. */
-  currentRevision?: number
-  /** On a durably failed create: `exited` proves nothing runs for the session, so a new
-   *  operation cannot collide with this one. Absent (older hosts) reads as unverifiable. */
-  ownerVerdict?: AgentSessionOwnerVerdict
+): AgentSessionWireRefusal {
+  const kept = details && Object.keys(details).length > 0 ? details : undefined
+  const refusal = {
+    code,
+    message,
+    ...(kept ? { details: kept } : {}),
+    ...agentSessionLegacyRefusalFields(kept)
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: every caller passes details typed for `code` (refuse and refuseUnclassified by their signatures, the reference by its own union).
+  return refusal as AgentSessionWireRefusal
+}
+
+/** A refusal built at its emitter. The reason must be one `code` lists; the legacy top-level fields
+ *  released clients read are copied from `details` here and nowhere else. */
+export function refuse<C extends AgentSessionWireRefusalCode>(
+  code: C,
+  details: NoInfer<AgentSessionRefusalDetailsByCode[C]>,
+  message: string
+): AgentSessionWireRefusal {
+  return buildRefusal(code, details, message)
+}
+
+/**
+ * A refusal whose situation this site cannot name: the code, and whatever facts it does know, with
+ * no reason, exactly as an older host sends it. The explicit path, so no emitter reaches for a
+ * catch-all reason instead.
+ */
+export function refuseUnclassified<C extends AgentSessionWireRefusalCode>(
+  code: C,
+  message: string,
+  facts?: NoInfer<AgentSessionRefusalFacts<C>>
+): AgentSessionWireRefusal {
+  return buildRefusal(code, facts, message)
+}
+
+/** A refusal rebuilt from what a record or a decision kept of it. */
+export function agentSessionRefusalFromReference(
+  reference: AgentSessionRefusalReference,
+  message: string
+): AgentSessionWireRefusal {
+  return buildRefusal(reference.code, reference.details, message)
+}
+
+/** The same refusal with more facts: a failed create's verdict, learned after the refusal was. */
+export function withAgentSessionRefusalFacts(
+  refusal: AgentSessionWireRefusal,
+  facts: { ownerVerdict: AgentSessionOwnerVerdict }
+): AgentSessionWireRefusal {
+  return buildRefusal(refusal.code, { ...refusal.details, ...facts }, refusal.message)
+}
+
+/** The refusal reduced to what may be stored or put in an error's data. */
+export function agentSessionRefusalReference(
+  refusal: AgentSessionWireRefusal
+): AgentSessionRefusalReference {
+  return buildReference(refusal.code, refusal.details)
+}
+
+/** A reference read back from a record another build may have written; details are checked
+ *  against the code, and anything else they held (an older build's `cause`) is dropped. */
+export function readAgentSessionRefusalReference(
+  value: unknown
+): AgentSessionRefusalReference | undefined {
+  if (
+    typeof value !== 'object' ||
+    value === null ||
+    !('code' in value) ||
+    !isAgentSessionWireRefusalCode(value.code)
+  ) {
+    return undefined
+  }
+  return buildReference(
+    value.code,
+    'details' in value ? readAgentSessionRefusalDetails(value.code, value.details) : undefined
+  )
+}
+
+function buildReference(
+  code: AgentSessionWireRefusalCode,
+  details: AgentSessionAnyRefusalDetails | undefined
+): AgentSessionRefusalReference {
+  const reference = { code, ...(details ? { details } : {}) }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: `details` is the refusal's own, or was read against `code`.
+  return reference as AgentSessionRefusalReference
+}
+
+/**
+ * A refusal raised rather than returned. Its message is the bare code, exactly as the
+ * `Error(code)` it replaces: the RPC passthrough, the restart-resume ledger and released clients
+ * all read a thrown refusal's message as its code. The details ride on `refusal` and reach the
+ * client only in the RPC error's data. Deliberately no `code` property, so no `'code' in error`
+ * passthrough meant for another subsystem can claim it.
+ */
+export class AgentSessionRefusalError extends Error {
+  readonly refusal: AgentSessionWireRefusal
+
+  constructor(refusal: AgentSessionWireRefusal, options?: { cause?: unknown }) {
+    super(refusal.code, options)
+    this.name = 'AgentSessionRefusalError'
+    this.refusal = refusal
+  }
+}
+
+/** A store or host refusal thrown under its situation; the error's message stays the code. */
+export function agentSessionRefusalError<C extends AgentSessionWireRefusalCode>(
+  code: C,
+  details: NoInfer<AgentSessionRefusalDetailsByCode[C]>,
+  message: string = code
+): AgentSessionRefusalError {
+  return new AgentSessionRefusalError(refuse(code, details, message))
+}
+
+export function isAgentSessionRefusalError(error: unknown): error is AgentSessionRefusalError {
+  return error instanceof AgentSessionRefusalError
 }
diff --git a/src/shared/agent-session-wire.ts b/src/shared/agent-session-wire.ts
index 38849ab0f05..311cfcfdade 100644
--- a/src/shared/agent-session-wire.ts
+++ b/src/shared/agent-session-wire.ts
@@ -4,8 +4,13 @@ import type {
 } from './agent-session-background-task-wire'
 import type { AgentSessionRewindReason, AgentSessionRewindSupport } from './agent-session-rewind'
 import type { AgentSessionWireRefusal } from './agent-session-wire-refusals'
+import type {
+  AgentSessionQueuedMessage,
+  AgentSessionQueuePause
+} from './agent-session-queued-message-wire'
 
 export * from './agent-session-wire-refusals'
+export * from './agent-session-queued-message-wire'
 import type { AgentSessionConversationCommand } from './agent-session-conversation-command'
 import type { AgentSessionContextUsage } from './agent-session-context-usage'
 // ─── Structured agent-session wire contract ─────────────────────────────────
@@ -103,6 +108,12 @@ export type AgentSessionHistoryPage = {
   hasNewer: boolean
   /** Present on hosts that expose provider-owned background task lifecycle. */
   backgroundTasks?: AgentSessionBackgroundTaskState | null
+  /** The host's queued drafts. Absent = no claim (older host); `[]`/null = empty.
+   *  Live subscription state stays authoritative over a stale history answer. */
+  queuedMessages?: AgentSessionQueuedMessage[] | null
+  /** The queue's pause, published with the list: present whenever `queuedMessages` is, null
+   *  when the queue sends on its own. */
+  queuePause?: AgentSessionQueuePause | null
   /** Host wall clock (ms epoch) when the page was read, so a client attaching mid-turn
    *  can anchor a live counter on the real start. Absent from older hosts. */
   hostNow?: number
@@ -140,6 +151,10 @@ export type AgentSessionSubscribeEvent =
       page: AgentSessionHistoryPage
       fence: number
       backgroundTasks?: AgentSessionBackgroundTaskState | null
+      /** Whole-list draft publication; omitted when unchanged since the last frame sent. */
+      queuedMessages?: AgentSessionQueuedMessage[] | null
+      /** Rides with `queuedMessages`; null when the queue sends on its own. */
+      queuePause?: AgentSessionQueuePause | null
       /** Omitted when unchanged; null clears a previous provider catalog. */
       commands?: AgentSessionSlashCommand[] | null
       /** Latest provider-authored turn activity; optional for mixed-version hosts. */
@@ -152,6 +167,11 @@ export type AgentSessionSubscribeEvent =
       /** Optional so mixed-version cursors retain the ownership fence. */
       fence?: number
       backgroundTasks?: AgentSessionBackgroundTaskState | null
+      /** Whole-list draft publication. On a multi-page catch-up it rides only the
+       *  final page, so a consumed card never vanishes before its bubble arrives. */
+      queuedMessages?: AgentSessionQueuedMessage[] | null
+      /** Rides with `queuedMessages`; null when the queue sends on its own. */
+      queuePause?: AgentSessionQueuePause | null
       /** Omitted when unchanged; null clears a previous provider catalog. */
       commands?: AgentSessionSlashCommand[] | null
       /** Additive ephemeral state; it never creates or advances journal rows. */
@@ -164,6 +184,10 @@ export type AgentSessionSubscribeEvent =
       page: AgentSessionHistoryPage
       fence: number
       backgroundTasks?: AgentSessionBackgroundTaskState | null
+      /** Whole-list draft publication; a reset re-hydrates it with the page. */
+      queuedMessages?: AgentSessionQueuedMessage[] | null
+      /** Rides with `queuedMessages`; null when the queue sends on its own. */
+      queuePause?: AgentSessionQueuePause | null
       /** Omitted when unchanged; null clears a previous provider catalog. */
       commands?: AgentSessionSlashCommand[] | null
       activity?: AgentSessionTurnActivity | null
@@ -187,6 +211,9 @@ export type AgentSessionStatusSummary = {
   /** With `hostExecutionOwned`: whether that child has proven its start. `starting` is a
    *  published session whose provider has not yet answered startup; absent on older hosts. */
   hostExecutionPhase?: 'starting' | 'ready'
+  /** The current provider child, distinct from the conversation and from replacement children.
+   *  Absent on older hosts and whenever this host has no live child. */
+  hostExecutionChild?: { generation: string | null; fence: number }
   latestPrompt: string
   /** Provider model in force for the next turn; absent until the host has read the options. */
   model?: string
@@ -223,7 +250,8 @@ export type AgentSessionStatusEvent =
 // ─── Turn completion feed ───────────────────────────────────────────────────
 
 /**
- * One root turn reaching a terminal outcome, derived by the EXECUTION HOST at journal commit.
+ * The session's latest request reaching a terminal outcome — a root turn, or a send the agent or
+ * its start refused — derived by the EXECUTION HOST at journal commit.
  *
  * This is the EDGE, with turn identity; `AgentSessionStatusSummary.turnOutcome` is the STATE.
  * The summary carries the verdict only while the session is idle, as a fact about the main agent's
@@ -239,11 +267,14 @@ export type AgentSessionTurnCompletion = {
   /** Host-and-workspace scope; a bare provider turn id is not globally unique. */
   scope: AgentSessionExecutionLocation
   sessionId: string
-  /** Root turn identity from the journal turn record; no second identity is minted. */
+  /** The request's identity: the root turn's id, or for a send refused before any turn, that
+   *  send's journal item key. Neither is minted here. */
   turnId: string
   outcome: AgentJournalTurnOutcome
   /** Execution host's clock at journal commit. */
   completedAt: number
+  /** The request settled while a prompt waits on the user. Absent otherwise, and from older hosts. */
+  awaitingUser?: true
 }
 
 /**
@@ -295,20 +326,41 @@ export type AgentSessionAttachResult = {
   sessionId: string
   fence: number
   page: AgentSessionHistoryPage
-  /** Submissions the crash boundary settled as `unknown` while attaching. */
+  /** Submissions a crash boundary left `unknown` that provider history could not decide. */
   unconfirmedClientMessageIds: string[]
-  /** The host-owned id of the tab that shows this chat. Absent from hosts that predate it. */
+  /** The host-owned id of the tab showing this chat, when it has one. Absent from older hosts. */
   tabId?: string
 }
 
-export type AgentSessionSendResult = {
-  clientMessageId: string
-  submission: AgentJournalSubmission
+/** The host queued the send as a draft instead of submitting it. Only clients
+ *  that sent `delivery: 'queue-if-active'` — gated on
+ *  `agent-session.queued-messages.v1` — ever receive this arm; `state` other
+ *  than `waiting` appears only on replays of an already-settled draft. */
+export type AgentSessionQueuedSendReceipt = {
+  messageId: string
+  position: number
+  state: 'waiting' | 'dispatched' | 'returned' | 'withdrawn'
+}
+
+export type AgentSessionSendResult =
+  | {
+      clientMessageId: string
+      submission: AgentJournalSubmission
+    }
+  | { clientMessageId: string; queued: AgentSessionQueuedSendReceipt }
+
+/** The submission arm's payload; undefined for a queued answer. For callers that
+ *  never send `delivery` the queued arm cannot arrive, and `undefined` reads as
+ *  delivery-unknown rather than as an error. */
+export function agentSessionSendSubmission(
+  result: AgentSessionSendResult | undefined
+): AgentJournalSubmission | undefined {
+  return result !== undefined && 'submission' in result ? result.submission : undefined
 }
 
 export type AgentSessionCancelResult = {
-  /** The turn the client named, echoed so a late reply can be matched. */
-  turnId: string
+  /** The turn the client named, echoed so a late reply can be matched; absent when it named none. */
+  turnId?: string
   cancelled: boolean
 }
 
diff --git a/src/shared/agent-session-write-failure.test.ts b/src/shared/agent-session-write-failure.test.ts
new file mode 100644
index 00000000000..0b614b3a265
--- /dev/null
+++ b/src/shared/agent-session-write-failure.test.ts
@@ -0,0 +1,167 @@
+import { describe, expect, it } from 'vitest'
+import {
+  agentSessionRefusalFailure,
+  agentSessionThrownFailure,
+  parseAgentSessionWriteFailure,
+  readAgentSessionErrorRefusal
+} from './agent-session-write-failure'
+
+const HOST_TEXT = 'Expected runtime fence 1; the session is at 3.'
+
+function saved(value: unknown): unknown {
+  return JSON.parse(JSON.stringify(value))
+}
+
+describe('parseAgentSessionWriteFailure', () => {
+  // The shape saved before refusals carried a reason; it loads as it was and reads as its code.
+  it('reads back an entry saved with the code alone, unchanged', () => {
+    expect(
+      parseAgentSessionWriteFailure(saved({ kind: 'refused', code: 'agent_session_conflict' }))
+    ).toEqual({ kind: 'refused', code: 'agent_session_conflict' })
+    expect(parseAgentSessionWriteFailure({ kind: 'failed' })).toEqual({ kind: 'failed' })
+    expect(
+      parseAgentSessionWriteFailure({
+        kind: 'refused',
+        code: 'agent_session_conflict',
+        message: HOST_TEXT
+      })
+    ).toEqual({ kind: 'refused', code: 'agent_session_conflict' })
+  })
+
+  it.each([
+    [
+      'a reason',
+      { kind: 'refused', code: 'agent_session_conflict', details: { reason: 'chatStarting' } }
+    ],
+    [
+      "a rewind's reason",
+      {
+        kind: 'refused',
+        code: 'agent_session_operation_invalid',
+        details: { reason: 'rewindRefused', rewindReason: 'busy' }
+      }
+    ],
+    [
+      "the owner's verdict",
+      {
+        kind: 'refused',
+        code: 'agent_session_ownership_unknown',
+        details: { reason: 'ownerUnproven', ownerVerdict: 'exited' }
+      }
+    ]
+  ])('keeps %s', (_label, value) => {
+    expect(parseAgentSessionWriteFailure(saved(value))).toEqual(value)
+  })
+
+  // A newer build's reason or verdict is dropped, never guessed; the code's words stand.
+  it.each([
+    [{ reason: 'fromTheFuture' }, undefined],
+    [{ reason: 'fromTheFuture', ownerVerdict: 'exited' }, { ownerVerdict: 'exited' }],
+    [{ reason: 'ownerUnproven', ownerVerdict: 'gone' }, { reason: 'ownerUnproven' }],
+    [{ reason: 'chatStarting' }, undefined]
+  ])('drops what this build cannot place: %j', (details, kept) => {
+    expect(
+      parseAgentSessionWriteFailure({
+        kind: 'refused',
+        code: 'agent_session_ownership_unknown',
+        details
+      })
+    ).toEqual({
+      kind: 'refused',
+      code: 'agent_session_ownership_unknown',
+      ...(kept ? { details: kept } : {})
+    })
+  })
+
+  it.each([
+    null,
+    'The agent was restarting.',
+    { kind: 'refused' },
+    { kind: 'refused', code: 'agent_session_from_the_future' },
+    { kind: 'something-else' }
+  ])('drops %j instead of guessing', (value) => {
+    expect(parseAgentSessionWriteFailure(value)).toBeUndefined()
+  })
+})
+
+describe('agentSessionRefusalFailure', () => {
+  // What moves with the owner, the question's answer and the host's words are never kept.
+  it('keeps only the facts that stay true after a reload', () => {
+    expect(
+      agentSessionRefusalFailure({
+        code: 'agent_session_checkpoint_stale',
+        details: { reason: 'fenceStale', currentFence: 3, ownerVerdict: 'exited' }
+      })
+    ).toEqual({
+      kind: 'refused',
+      code: 'agent_session_checkpoint_stale',
+      details: { reason: 'fenceStale' }
+    })
+    // A prompt's revision and winning answer, and a provider's diagnostic, as a host may send them.
+    const answered = JSON.parse(
+      JSON.stringify({
+        code: 'agent_session_already_resolved',
+        details: {
+          reason: 'promptAlreadyResolved',
+          currentRevision: 2,
+          resolution: { state: 'answered', selectedOptionId: 'yes', resolvedBy: 'phone' },
+          detail: { text: 'stderr', audience: 'log' }
+        }
+      })
+    )
+    expect(agentSessionRefusalFailure(answered)).toEqual({
+      kind: 'refused',
+      code: 'agent_session_already_resolved',
+      details: { reason: 'promptAlreadyResolved' }
+    })
+  })
+
+  it('keeps a code from a newer host without reading its details', () => {
+    const refusal = JSON.parse('{"code":"agent_session_from_the_future","details":{"reason":"x"}}')
+    expect(agentSessionRefusalFailure(refusal)).toEqual({
+      kind: 'refused',
+      code: 'agent_session_from_the_future'
+    })
+  })
+})
+
+describe('a refusal a failed request carried in its error', () => {
+  const refusal = {
+    code: 'agent_session_journal_unreadable',
+    details: { reason: 'journalCorrupt', stray: 'dropped' }
+  }
+  const payload = { code: 'runtime_error', message: 'agent_session_journal_unreadable' }
+
+  it('is read from a thrown RPC error and from a stream payload alike', () => {
+    const expected = {
+      code: 'agent_session_journal_unreadable',
+      details: { reason: 'journalCorrupt' }
+    }
+    expect(
+      readAgentSessionErrorRefusal({ response: { error: { ...payload, data: { refusal } } } })
+    ).toEqual(expected)
+    expect(readAgentSessionErrorRefusal(saved({ ...payload, data: { refusal } }))).toEqual(expected)
+  })
+
+  it.each([
+    ['an older host', payload],
+    ['a thrown error without a response', new Error('agent_session_journal_unreadable')],
+    ['a code this build does not know', { ...payload, data: { refusal: { code: 'from_later' } } }],
+    ['nothing', undefined]
+  ])('is absent from %s', (_label, error) => {
+    expect(readAgentSessionErrorRefusal(error)).toBeUndefined()
+  })
+
+  it("words the refusal when there is one, else what the request's error code proves", () => {
+    expect(agentSessionThrownFailure({ ...payload, data: { refusal } }, 'runtime_error')).toEqual({
+      kind: 'refused',
+      code: 'agent_session_journal_unreadable',
+      details: { reason: 'journalCorrupt' }
+    })
+    expect(agentSessionThrownFailure(payload, 'runtime_error')).toEqual({ kind: 'unconfirmed' })
+    expect(agentSessionThrownFailure(payload, 'method_not_found')).toEqual({
+      kind: 'refused',
+      code: 'structured_agent_session_unsupported'
+    })
+  })
+})
diff --git a/src/shared/agent-session-write-failure.ts b/src/shared/agent-session-write-failure.ts
new file mode 100644
index 00000000000..81809133871
--- /dev/null
+++ b/src/shared/agent-session-write-failure.ts
@@ -0,0 +1,183 @@
+// A chat write that did not happen, as a fact: what the person was doing, and what the host said.
+// Saved with a queued message, so it holds only what stays true after a reload; the words are
+// chosen from it when it is shown (`agent-session-refusal-notice.ts`).
+
+import {
+  readAgentSessionRefusalDetails,
+  type AgentSessionRefusalReason
+} from './agent-session-refusal-details'
+import type { AgentSessionRewindReason } from './agent-session-rewind'
+import {
+  isAgentSessionWireRefusalCode,
+  readAgentSessionRefusalReference,
+  type AgentSessionOwnerVerdict,
+  type AgentSessionRefusalReference,
+  type AgentSessionWireRefusal,
+  type AgentSessionWireRefusalCode
+} from './agent-session-wire-refusals'
+
+/** What the person was doing, which decides what the notice says did not happen. `send` keeps
+ *  the message behind a Retry control; `composer-send` puts it back in the composer, as the phone
+ *  does. `read-history` is opening the chat to show its history, which writes nothing. */
+export type AgentSessionWriteKind =
+  | 'read-history'
+  | 'send'
+  | 'composer-send'
+  | 'stop'
+  | 'stop-task'
+  | 'stop-tasks'
+  | 'answer'
+  | 'option'
+  | 'command'
+  | 'goal'
+
+/** The kind of write an `agentSession.*` call stands for. */
+export function agentSessionWriteKindForMethod(
+  fingerprintMethod: string,
+  fields: Record<string, unknown>
+): AgentSessionWriteKind {
+  if (fingerprintMethod === 'agentSession.send') {
+    return 'send'
+  }
+  if (fingerprintMethod === 'agentSession.cancel') {
+    // A background-task stop never asked the agent to stop.
+    if (fields.scope !== 'background-tasks') {
+      return 'stop'
+    }
+    return typeof fields.taskId === 'string' ? 'stop-task' : 'stop-tasks'
+  }
+  if (fingerprintMethod.startsWith('agentSession.respondTo')) {
+    return 'answer'
+  }
+  if (fingerprintMethod === 'agentSession.setOption') {
+    return 'option'
+  }
+  if (fingerprintMethod === 'agentSession.threadGoal') {
+    return 'goal'
+  }
+  return 'command'
+}
+
+/** What a saved refusal keeps beside its reason: facts about the refused operation that stay true
+ *  after a reload. Never the fence, revision or resolution, which move, nor any provider text. */
+type DurableRefusalFacts = {
+  agent_session_operation_invalid: { rewindReason?: AgentSessionRewindReason }
+  agent_session_operation_unknown: { rewindReason?: AgentSessionRewindReason }
+  /** A snapshot from when it was refused; see `agentSessionOwnerVerdictAllowsFreshOperationId`. */
+  agent_session_ownership_unknown: { ownerVerdict?: AgentSessionOwnerVerdict }
+}
+
+const DURABLE_FACT_KEYS: Partial<Record<AgentSessionWireRefusalCode, readonly string[]>> = {
+  agent_session_operation_invalid: ['rewindReason'],
+  agent_session_operation_unknown: ['rewindReason'],
+  agent_session_ownership_unknown: ['ownerVerdict']
+} satisfies { [C in keyof DurableRefusalFacts]: readonly (keyof DurableRefusalFacts[C])[] }
+
+export type AgentSessionWriteRefusalDetails<C extends AgentSessionWireRefusalCode> = {
+  reason?: AgentSessionRefusalReason<C>
+} & (C extends keyof DurableRefusalFacts ? DurableRefusalFacts[C] : Record<never, never>)
+
+/** A refused write: its code, and what the host said about it that outlives the reply. */
+export type AgentSessionWriteRefusal = {
+  [C in AgentSessionWireRefusalCode]: {
+    kind: 'refused'
+    code: C
+    /** Absent from older hosts and from entries saved before refusals carried a reason. */
+    details?: AgentSessionWriteRefusalDetails<C>
+  }
+}[AgentSessionWireRefusalCode]
+
+/** Why a write did not happen, or that nothing proves it did not. */
+export type AgentSessionWriteFailure =
+  | AgentSessionWriteRefusal
+  /** The request failed without a refusal before the host ran it, so nothing is known about why. */
+  | { kind: 'failed' }
+  /** The request failed where the host may already have run it (a timeout, a lost connection, an
+   *  error inside the method). */
+  | { kind: 'unconfirmed' }
+
+/** The refusal as a write keeps it. Details are read against the code, so a reason or verdict
+ *  another build added is dropped and the code's own words stand. */
+function agentSessionWriteRefusal(
+  code: AgentSessionWireRefusalCode,
+  details: unknown
+): AgentSessionWriteRefusal {
+  const durable: readonly string[] = ['reason', ...(DURABLE_FACT_KEYS[code] ?? [])]
+  const kept = Object.fromEntries(
+    Object.entries(readAgentSessionRefusalDetails(code, details) ?? {}).filter(([key]) =>
+      durable.includes(key)
+    )
+  )
+  const refusal = {
+    kind: 'refused',
+    code,
+    ...(Object.keys(kept).length > 0 ? { details: kept } : {})
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: `kept` holds only a reason and facts read against `code` and allowed for it above.
+  return refusal as AgentSessionWriteRefusal
+}
+
+export function agentSessionRefusalFailure(
+  refusal: Pick<AgentSessionWireRefusal, 'code' | 'details'>
+): AgentSessionWriteRefusal {
+  // A newer host can send a code this client has never heard of; its details mean nothing here.
+  return isAgentSessionWireRefusalCode(refusal.code)
+    ? agentSessionWriteRefusal(refusal.code, refusal.details)
+    : { kind: 'refused', code: refusal.code }
+}
+
+/** A request that threw, from the RPC error code the host answered with (undefined when none came
+ *  back). Only a host that turned it away before running the method proves the write did not
+ *  happen. */
+export function agentSessionRpcErrorFailure(code: string | undefined): AgentSessionWriteFailure {
+  if (code === 'method_not_found' || code === 'method_not_supported') {
+    return { kind: 'refused', code: 'structured_agent_session_unsupported' }
+  }
+  return code === 'invalid_argument' || code === 'unauthorized'
+    ? { kind: 'refused', code: 'agent_session_operation_invalid' }
+    : { kind: 'unconfirmed' }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null
+}
+
+/** The refusal a failed request's error carries in its data. Takes both shapes a client meets: an
+ *  RPC call's thrown error, whose payload is on `response.error`, and the payload a stream hands
+ *  its error callback. Undefined from an older host, or for a failure that was not a refusal. */
+export function readAgentSessionErrorRefusal(
+  error: unknown
+): AgentSessionRefusalReference | undefined {
+  const payload =
+    isRecord(error) && isRecord(error.response) && isRecord(error.response.error)
+      ? error.response.error
+      : error
+  const data = isRecord(payload) ? payload.data : undefined
+  return isRecord(data) ? readAgentSessionRefusalReference(data.refusal) : undefined
+}
+
+/** What to say about a request that threw: the host's refusal when its error carried one, else
+ *  what the RPC error code proves. Words only: whether the write may have happened stays the
+ *  caller's own classification. */
+export function agentSessionThrownFailure(
+  error: unknown,
+  rpcCode: string | undefined
+): AgentSessionWriteFailure {
+  const refusal = readAgentSessionErrorRefusal(error)
+  return refusal ? agentSessionRefusalFailure(refusal) : agentSessionRpcErrorFailure(rpcCode)
+}
+
+/** A saved failure, or undefined when it is not one this build wrote. */
+export function parseAgentSessionWriteFailure(
+  value: unknown
+): AgentSessionWriteFailure | undefined {
+  if (typeof value !== 'object' || value === null || !('kind' in value)) {
+    return undefined
+  }
+  if (value.kind === 'failed') {
+    return { kind: 'failed' }
+  }
+  return value.kind === 'refused' && 'code' in value && isAgentSessionWireRefusalCode(value.code)
+    ? agentSessionWriteRefusal(value.code, 'details' in value ? value.details : undefined)
+    : undefined
+}
diff --git a/src/shared/agent-session-write-notice-copy.ts b/src/shared/agent-session-write-notice-copy.ts
new file mode 100644
index 00000000000..d0c36e27a40
--- /dev/null
+++ b/src/shared/agent-session-write-notice-copy.ts
@@ -0,0 +1,64 @@
+// The sentences a chat notice is made of, each whole so desktop can translate it on its own.
+
+import {
+  QUIT_TERMINAL_AGENT,
+  START_NEW_CHAT,
+  TERMINAL_AGENT_HOLDS_CHAT
+} from './agent-session-failure-words'
+
+/** Every sentence a notice is made of. Desktop translates each whole sentence with this as its
+ *  fallback; mobile shows it as is. */
+export const AGENT_SESSION_WRITE_NOTICE_COPY = {
+  notDoneReadHistory: "This chat's history couldn't be loaded.",
+  notDoneSend: 'Your message was not sent.',
+  tryAgainComposerSend: 'Send it again.',
+  notDoneStop: "The agent wasn't stopped.",
+  notDoneStopTask: "The background task wasn't stopped.",
+  notDoneStopTasks: "The background tasks weren't stopped.",
+  notDoneAnswer: 'Your answer was not sent.',
+  notDoneOption: "The setting wasn't changed.",
+  notDoneCommand: "The command didn't run.",
+  notDoneGoal: "The goal wasn't changed.",
+  restartFailed: "The agent couldn't restart.",
+  capacity: 'Orca has received too many requests in the last day.',
+  outcomeUnknown: "Orca couldn't confirm what happened. Check the chat.",
+  questionChanged: 'This question was already answered or has changed.',
+  historyUnreadable: "Orca couldn't read this chat's saved history.",
+  historyUnusable: 'Unable to load this chat.',
+  historyUnavailable: "Orca couldn't open this chat's history right now.",
+  unsupported: "The Orca running this chat doesn't support this. Update Orca, then try again.",
+  unreachable: "Orca couldn't reach the agent.",
+  recordFailed: "Orca couldn't record it in this chat's history.",
+  conversationCleared: 'This conversation has been cleared.',
+  openCurrentConversation: 'Open the current conversation to continue.',
+  clearUnfinished: "The last /clear didn't finish.",
+  commandRunning: 'A /compact or /clear is still running.',
+  waitForCommand: 'Wait for the /compact or /clear to finish.',
+  agentStarting: 'The agent is still starting.',
+  waitForStart: 'Wait for the agent to finish starting.',
+  turnActive: 'The agent is still responding.',
+  waitForTurn: 'Wait for the agent to finish responding, or stop it.',
+  promptPending: 'The agent is waiting for an answer to a question or approval.',
+  answerFirst: 'Answer the question or approval first.',
+  backgroundTasksRunning: 'Background tasks are still running.',
+  waitForBackgroundTasks: 'Wait for the background tasks to finish.',
+  messagesUnsettled: "A message you sent earlier hasn't been confirmed yet.",
+  settleEarlierMessage: 'Wait for your earlier message to go through, or retry it.',
+  optionRejected: "The agent didn't accept this setting.",
+  goalsUnsupported: "This agent doesn't support goals.",
+  agentRefused: 'The agent turned this down.',
+  ownerUnproven: "Orca hasn't confirmed that this chat's previous agent stopped.",
+  reopenChat: 'Reopen the chat to check again.',
+  terminalAgentHoldsChat: TERMINAL_AGENT_HOLDS_CHAT,
+  quitTerminalAgent: QUIT_TERMINAL_AGENT,
+  hostReconciling: 'Orca is still checking on this chat after restarting.',
+  waitMoment: 'Wait a moment.',
+  recordUnreadable: "Orca couldn't read this chat's saved state.",
+  chatNotFound: 'The Orca running this chat has no record of it.',
+  startNewChat: START_NEW_CHAT,
+  tryAgain: 'Try again.'
+} as const
+
+export type AgentSessionWriteNoticeSentence = keyof typeof AGENT_SESSION_WRITE_NOTICE_COPY
+/** A notice as whole sentences, each translated on its own; `text` is a provider's own words. */
+export type AgentSessionWriteNoticePart = AgentSessionWriteNoticeSentence | { text: string }
diff --git a/src/shared/agent-state-history.ts b/src/shared/agent-state-history.ts
index 4833d351c66..105d8e54908 100644
--- a/src/shared/agent-state-history.ts
+++ b/src/shared/agent-state-history.ts
@@ -1,4 +1,5 @@
 import type { AgentStatusState } from './agent-status-types'
+import type { AgentMainAgentStatus } from './main-agent-status'
 
 /** A snapshot of a previous agent state, used to render activity blocks.
  *  Why: intentionally narrower than AgentStatusEntry — tool/assistant context is
@@ -16,6 +17,9 @@ export type AgentStateHistoryEntry = {
   /** True when this `done` was a cancellation (agent hook like Claude `is_interrupt`,
    *  or Orca's guarded fallback). Always falsy for non-`done` states so retention logic can preserve it. */
   interrupted?: boolean
+  /** The main agent's own status when this state was left, copied with `interrupted` by
+   *  `agentVerdictFields`; read the verdict through `agentMainAgentVerdict`. */
+  mainAgent?: AgentMainAgentStatus
 }
 
 /** Maximum number of history entries kept per agent to bound memory. */
diff --git a/src/shared/agent-status-child-work-alias.ts b/src/shared/agent-status-child-work-alias.ts
index 539c9c38214..c7ff29a5c6a 100644
--- a/src/shared/agent-status-child-work-alias.ts
+++ b/src/shared/agent-status-child-work-alias.ts
@@ -16,11 +16,17 @@ const CHILD_ALIAS_KEY_PREFIX = 'agent-child-work-alias-v1:'
 const MAX_ALIAS_PART_LENGTH = 512
 
 /**
- * `thread_id` names a child by its own provider thread (a Codex subagent). The hook lane registers
- * a Claude `agent_id` under `task_id` (it is the same registry id) and a Codex `agent_id` under
- * `thread_id`; no `agent_id` kind exists on purpose.
+ * `thread_id` names a child by its own provider thread (a Codex subagent); `turn_id` names one run
+ * of such a child, as `tool_use_id` names one run of a task. The hook lane registers a Claude
+ * `agent_id` under `task_id` (it is the same registry id) and a Codex `agent_id` under `thread_id`;
+ * no `agent_id` kind exists on purpose.
  */
-export const AGENT_CHILD_WORK_ALIAS_KINDS = ['task_id', 'tool_use_id', 'thread_id'] as const
+export const AGENT_CHILD_WORK_ALIAS_KINDS = [
+  'task_id',
+  'tool_use_id',
+  'thread_id',
+  'turn_id'
+] as const
 export type AgentChildWorkAliasKind = (typeof AGENT_CHILD_WORK_ALIAS_KINDS)[number]
 const ALIAS_KIND_SET: ReadonlySet<string> = new Set(AGENT_CHILD_WORK_ALIAS_KINDS)
 
diff --git a/src/shared/agent-status-child-work-display.ts b/src/shared/agent-status-child-work-display.ts
new file mode 100644
index 00000000000..c83957199f9
--- /dev/null
+++ b/src/shared/agent-status-child-work-display.ts
@@ -0,0 +1,114 @@
+import { foldAgentLeadStatus } from './agent-lead-status-fold'
+import type { AgentSessionBackgroundTaskRunState } from './agent-session-background-task-wire'
+import type { AgentChildWorkId, AgentChildWorkOutcome } from './agent-status-child-work'
+import {
+  agentChildWorkLiveness,
+  type AgentChildWorkLiveness
+} from './agent-status-child-work-liveness'
+import type { AgentChildWorkView } from './agent-status-child-work-view'
+import type { AgentStatusState } from './agent-status-types'
+import { groupedBy } from './grouped-by'
+
+// What a surface derives from child views. Kept apart from the projection, which resolves owners
+// against status subjects and so reaches host-only code: every surface, renderer included, loads
+// this module.
+
+type AgentChildWorkOwnershipView = Pick<
+  AgentChildWorkView,
+  'id' | 'kind' | 'state' | 'membership' | 'parentChildWorkId'
+>
+
+/** Liveness of all live work beneath a child, at any depth — the same input a parent row folds. */
+export function agentChildWorkOwnedLiveness(
+  views: readonly AgentChildWorkOwnershipView[],
+  ownerId: AgentChildWorkId
+): AgentChildWorkLiveness {
+  const owned = groupedBy(views, (view) => view.parentChildWorkId)
+  const seen = new Set<AgentChildWorkId>([ownerId])
+  const frontier = [ownerId]
+  const liveDescendants: AgentChildWorkOwnershipView[] = []
+  for (let owner = frontier.pop(); owner !== undefined; owner = frontier.pop()) {
+    for (const view of owned.get(owner) ?? []) {
+      if (!seen.has(view.id)) {
+        seen.add(view.id)
+        frontier.push(view.id)
+        if (view.membership === 'live') {
+          liveDescendants.push(view)
+        }
+      }
+    }
+  }
+  return agentChildWorkLiveness(liveDescendants)
+}
+
+/** The dot a child row renders; every value is an `AgentStateDot` state. */
+export type AgentChildDisplayState =
+  | 'working'
+  | 'monitoring'
+  | 'waiting'
+  | 'blocked'
+  | 'done'
+  | 'failed'
+  | 'interrupted'
+  | 'idle'
+  | 'unverifiable'
+
+const SETTLED_DISPLAY_STATE: Record<AgentChildWorkOutcome, AgentChildDisplayState> = {
+  succeeded: 'done',
+  failed: 'failed',
+  cancelled: 'interrupted',
+  // Neutral: an ending the lane cannot classify asserts nothing.
+  unknown: 'idle'
+}
+
+/**
+ * A child's display state, through the same fold that decides a parent row's: work that is idle
+ * or finished enters it as `done`, so a live shell the child owns reads `monitoring` exactly as it
+ * would under a CLI agent. `unverifiable` is a freshness verdict and bypasses the fold.
+ */
+export function deriveAgentChildDisplayState(
+  view: Pick<AgentChildWorkView, 'state' | 'membership' | 'outcome'>,
+  ownedLiveness: AgentChildWorkLiveness
+): AgentChildDisplayState {
+  if (view.state === 'unverifiable') {
+    return 'unverifiable'
+  }
+  // Stored only by a shell or a monitor, and neither owns work.
+  if (view.state === 'monitoring') {
+    return 'monitoring'
+  }
+  const leadState: AgentStatusState =
+    view.membership === 'settled' || view.state === 'done' || view.state === 'idle'
+      ? 'done'
+      : view.state
+  // A child's cancel never hides the work it left running.
+  const foldInput = { leadState, childWorkLiveness: ownedLiveness, interrupted: false }
+  const folded = foldAgentLeadStatus(foldInput)
+  if (folded.stateName !== 'done') {
+    return folded.workingMode ?? folded.stateName
+  }
+  return view.membership === 'live' ? 'idle' : SETTLED_DISPLAY_STATE[view.outcome ?? 'unknown']
+}
+
+/**
+ * A display state in the run-state words a host publishes and every older reader already speaks:
+ * a failure reads as `blocked`, a cancel as `idle`. The row's own dot keeps the real outcome.
+ */
+export function agentChildRunStateFor(
+  displayState: AgentChildDisplayState
+): AgentSessionBackgroundTaskRunState {
+  switch (displayState) {
+    case 'failed':
+      return 'blocked'
+    case 'interrupted':
+      return 'idle'
+    case 'working':
+    case 'monitoring':
+    case 'waiting':
+    case 'blocked':
+    case 'done':
+    case 'idle':
+    case 'unverifiable':
+      return displayState
+  }
+}
diff --git a/src/shared/agent-status-child-work-evidence-resolution.ts b/src/shared/agent-status-child-work-evidence-resolution.ts
index 50c80e5bdbd..14c31bee4b6 100644
--- a/src/shared/agent-status-child-work-evidence-resolution.ts
+++ b/src/shared/agent-status-child-work-evidence-resolution.ts
@@ -20,7 +20,15 @@ import { agentStatusSubjectsEqual, type AgentStatusSubject } from './agent-statu
  *  a handle is unique per parent and provider without being unique across producers. */
 export const STRUCTURED_CHILD_WORK_PRODUCER_ID = 'structured-session-child-work'
 const SEGMENT_ID = STRUCTURED_CHILD_WORK_PRODUCER_ID
-const RUN_ALIAS_KIND: AgentChildWorkAliasKind = 'tool_use_id'
+/** A run is named in the provider's own terms: a task runs under its spawn call, a thread under
+ *  its turn. The kinds stay apart so a turn id can never pass for a spawn call. */
+const RUN_ALIAS_KIND_BY_ID_KIND = {
+  task_id: 'tool_use_id',
+  thread_id: 'turn_id'
+} as const satisfies Record<AgentChildWorkEvidenceHandle['idKind'], AgentChildWorkAliasKind>
+const RUN_ALIAS_KINDS: ReadonlySet<AgentChildWorkAliasKind> = new Set(
+  Object.values(RUN_ALIAS_KIND_BY_ID_KIND)
+)
 
 export const STRUCTURED_CHILD_WORK_PROVENANCE: AgentChildWorkProvenance = {
   source: 'structured-session',
@@ -70,7 +78,13 @@ export function agentChildWorkHandleAliases(
   return [
     { segmentId: SEGMENT_ID, aliasKind: handle.idKind, alias: handle.id },
     ...(handle.runId !== undefined && handle.runId !== handle.id
-      ? [{ segmentId: SEGMENT_ID, aliasKind: RUN_ALIAS_KIND, alias: handle.runId }]
+      ? [
+          {
+            segmentId: SEGMENT_ID,
+            aliasKind: RUN_ALIAS_KIND_BY_ID_KIND[handle.idKind],
+            alias: handle.runId
+          }
+        ]
       : [])
   ]
 }
@@ -123,14 +137,14 @@ export function resolveAgentChildWorkHandle(
     : { child: child ?? null, ambiguous: false, highestGeneration }
 }
 
-/** The owner a handle id names, by its stable id or by the run handle it spawned under. */
+/** The owner a handle id names, by its stable id or by the spawn call it runs under. */
 export function resolveAgentChildWorkOwner(
   scope: AgentChildWorkEvidenceScope,
   ownerId: string
 ): string | undefined {
   const resolution = resolveAgentChildWorkHandle(
     scope,
-    ['task_id', 'thread_id', RUN_ALIAS_KIND],
+    ['task_id', 'thread_id', 'tool_use_id'],
     ownerId
   )
   return resolution?.child?.childWorkId
@@ -164,7 +178,7 @@ export function currentAgentChildWorkAliases(
   return {
     ...(stable ? { stable } : {}),
     stableId: stable?.id,
-    runId: current.find((alias) => alias.aliasKind === RUN_ALIAS_KIND)?.alias,
+    runId: current.find((alias) => RUN_ALIAS_KINDS.has(alias.aliasKind))?.alias,
     aliases: current.map((alias) => ({
       segmentId: alias.segmentId,
       aliasKind: alias.aliasKind,
@@ -183,7 +197,7 @@ export function isPreviousAgentChildWorkRun(
     .getAliasesForChild(child.childWorkId)
     .some(
       (alias) =>
-        alias.aliasKind === RUN_ALIAS_KIND &&
+        RUN_ALIAS_KINDS.has(alias.aliasKind) &&
         alias.alias === runId &&
         !agentChildWorkFencesEqual(alias.fence, child.invocation)
     )
diff --git a/src/shared/agent-status-child-work-evidence.ts b/src/shared/agent-status-child-work-evidence.ts
index 06fe05d38a8..8df08126827 100644
--- a/src/shared/agent-status-child-work-evidence.ts
+++ b/src/shared/agent-status-child-work-evidence.ts
@@ -2,7 +2,8 @@
 //
 // A producer decodes provider frames into these edges and the host folds them into the one
 // record per child it owns. Edges carry facts, not records: which child is live, what it is
-// doing, how it ended. Only a child's own ending settles it, or the end of its session.
+// doing, how it ended, or that it is gone. Only a child's own ending settles it, or the end of its
+// session. Edges are host-internal: the producer and the store share one process.
 
 import type { AgentChildWorkAliasKind } from './agent-status-child-work-alias'
 import type {
@@ -13,9 +14,9 @@ import type {
   AgentChildWorkState
 } from './agent-status-child-work'
 
-/** How the provider names one child. `id` is the stable handle today's wire already publishes
- *  (a Claude task id); `runId` names the current run when the provider mints one per run (the
- *  spawn call), and a different one is the provider starting the child again. */
+/** How the provider names one child. `id` is the stable handle: a task id, or the child's own
+ *  thread. `runId` names the current run when the provider mints one per run (a task's spawn
+ *  call, a thread's turn), and a different one is the provider starting the child again. */
 export type AgentChildWorkEvidenceHandle = {
   idKind: Extract<AgentChildWorkAliasKind, 'task_id' | 'thread_id'>
   id: string
@@ -74,8 +75,17 @@ export type AgentChildWorkEndedEvidence = {
  *  with an outcome nobody reported. Settled children stay; the parent's removal drops them. */
 export type AgentChildWorkSessionEndedEvidence = { type: 'session-ended'; observedAt: number }
 
+/** Work that leaves nothing to report once it stops, such as a command whose process exited: its
+ *  record goes rather than settles. For work that owns no other record. */
+export type AgentChildWorkRemovedEvidence = {
+  type: 'removed'
+  observedAt: number
+  handle: AgentChildWorkEvidenceHandle
+}
+
 export type AgentChildWorkEvidence =
   | AgentChildWorkLiveEvidence
   | AgentChildWorkOperationEvidence
   | AgentChildWorkEndedEvidence
+  | AgentChildWorkRemovedEvidence
   | AgentChildWorkSessionEndedEvidence
diff --git a/src/shared/agent-status-child-work-reconciliation.test.ts b/src/shared/agent-status-child-work-reconciliation.test.ts
index 377c580fc41..79ffc1c5761 100644
--- a/src/shared/agent-status-child-work-reconciliation.test.ts
+++ b/src/shared/agent-status-child-work-reconciliation.test.ts
@@ -5,10 +5,7 @@ import type {
   AgentChildWorkEvidence,
   AgentChildWorkLiveObservation
 } from './agent-status-child-work-evidence'
-import {
-  reconcileAgentChildWorkEvidence,
-  STRUCTURED_CHILD_WORK_MAX_SETTLED
-} from './agent-status-child-work-reconciliation'
+import { reconcileAgentChildWorkEvidence } from './agent-status-child-work-reconciliation'
 import { STRUCTURED_CHILD_WORK_MAX_LIVE } from './agent-status-child-work-evidence-admission'
 import { createAgentStatusStore, type AgentStatusStore } from './agent-status-store'
 import { makeStructuredAgentStatusSubject } from './agent-status-subject'
@@ -399,17 +396,9 @@ describe('structured child-work reconciliation', () => {
     expect(records(store)).toHaveLength(STRUCTURED_CHILD_WORK_MAX_LIVE)
   })
 
-  it('keeps a bounded settled history, never dropping a child that owns live work', () => {
+  it('keeps every settled child until the parent row goes', () => {
     const { store, apply } = harness()
-    apply(live(child('owner')))
-    apply(live(child('shell', { kind: 'command', ownerId: 'owner' })))
-    apply({
-      type: 'ended',
-      observedAt: 101,
-      handle: { idKind: 'task_id', id: 'owner' },
-      outcome: 'succeeded'
-    })
-    for (let index = 0; index < STRUCTURED_CHILD_WORK_MAX_SETTLED + 1; index += 1) {
+    for (let index = 0; index < 100; index += 1) {
       apply(live(child(`done-${index}`), 200 + index), {
         type: 'ended',
         observedAt: 200 + index,
@@ -418,9 +407,22 @@ describe('structured child-work reconciliation', () => {
       })
     }
     const settled = records(store).filter((record) => record.membership === 'settled')
-    expect(settled).toHaveLength(STRUCTURED_CHILD_WORK_MAX_SETTLED)
-    expect(settled.map((record) => record.description)).toContain('Task owner')
-    expect(settled.map((record) => record.description)).not.toContain('Task done-0')
-    expect(settled.map((record) => record.description)).not.toContain('Task done-1')
+    expect(settled).toHaveLength(100)
+    expect(settled.map((record) => record.description)).toContain('Task done-0')
+  })
+
+  it('removes work that stopped with nothing to report, and only the record it names', () => {
+    const { store, apply } = harness()
+    apply(live(child('owner')), live(child('shell', { kind: 'command', ownerId: 'owner' })))
+    expect(
+      apply({ type: 'removed', observedAt: 200, handle: { idKind: 'task_id', id: 'shell' } })
+    ).toMatchObject({ removed: 1, settled: 0 })
+    expect(only(store)).toMatchObject({ description: 'Task owner', membership: 'live' })
+    expect(store.getAliasesForChild('child-2')).toEqual([])
+    // A handle it no longer answers to removes nothing.
+    expect(
+      apply({ type: 'removed', observedAt: 201, handle: { idKind: 'task_id', id: 'shell' } })
+    ).toMatchObject({ removed: 0 })
+    expect(records(store)).toHaveLength(1)
   })
 })
diff --git a/src/shared/agent-status-child-work-reconciliation.ts b/src/shared/agent-status-child-work-reconciliation.ts
index 08d057afc96..43f23b85483 100644
--- a/src/shared/agent-status-child-work-reconciliation.ts
+++ b/src/shared/agent-status-child-work-reconciliation.ts
@@ -1,14 +1,17 @@
 // Fold one structured session's child-work evidence into the host's records.
 //
 // The store holds the only current record per child; evidence patches it. A child settles on its
-// own ending, or `unknown` when its session ends while it is still live. It owns only the records
-// its own producer admitted, and never claims an outcome the evidence did not report.
+// own ending, or `unknown` when its session ends while it is still live; work with nothing to
+// report once it stops is removed instead. Settled children stay until the host drops the parent's
+// row. It owns only the records its own producer admitted, and never claims an outcome the
+// evidence did not report.
 
 import type { AgentChildWorkAdmission } from './agent-status-child-work-admission'
 import type {
   AgentChildWorkEndedEvidence,
   AgentChildWorkEvidence,
-  AgentChildWorkOperationEvidence
+  AgentChildWorkOperationEvidence,
+  AgentChildWorkRemovedEvidence
 } from './agent-status-child-work-evidence'
 import {
   applyAgentChildWorkLive,
@@ -26,9 +29,6 @@ import {
 
 export type { AgentChildWorkReconcileOutcome } from './agent-status-child-work-evidence-admission'
 
-/** Settled children kept per session. The oldest go first, never one that owns live work. */
-export const STRUCTURED_CHILD_WORK_MAX_SETTLED = 32
-
 export type AgentChildWorkReconcileInput = AgentChildWorkEvidenceScope & {
   admission: AgentChildWorkAdmission
   evidence: readonly AgentChildWorkEvidence[]
@@ -98,32 +98,20 @@ function settleLive(ctx: ReconcileContext, observedAt: number): void {
   }
 }
 
-function removeChildren(ctx: ReconcileContext, childWorkIds: string[]): void {
-  if (childWorkIds.length > 0 && ctx.store.applyMutation({ removeChildren: childWorkIds })) {
-    ctx.outcome.removed += childWorkIds.length
-  }
-}
-
-/** Oldest-settled first; a settled child that still owns live work stays so its work keeps an owner. */
-function trimSettled(ctx: ReconcileContext): void {
-  const owned = ownedStructuredChildWork(ctx)
-  const settled = owned.filter((record) => record.membership === 'settled')
-  const excess = settled.length - STRUCTURED_CHILD_WORK_MAX_SETTLED
-  if (excess <= 0) {
+/** The work is gone and has no ending to keep: its record, and the handles it answered to, go. */
+function applyRemoved(ctx: ReconcileContext, edge: AgentChildWorkRemovedEvidence): void {
+  const resolution = resolveAgentChildWorkHandle(ctx, [edge.handle.idKind], edge.handle.id)
+  if (resolution?.ambiguous) {
+    ctx.outcome.rejected.push({ handleId: edge.handle.id, reason: 'ambiguous' })
     return
   }
-  const owners = new Set(
-    owned.flatMap((record) =>
-      record.membership === 'live' && record.parentChildWorkId ? [record.parentChildWorkId] : []
-    )
-  )
-  const removable = settled
-    .filter((record) => !owners.has(record.childWorkId))
-    .sort((a, b) => (a.settledAt ?? a.observedAt) - (b.settledAt ?? b.observedAt))
-  removeChildren(
-    ctx,
-    removable.slice(0, excess).map((record) => record.childWorkId)
-  )
+  const existing = resolution?.child
+  if (!existing || agentChildWorkRunVerdict(ctx, existing, edge.handle.runId) === 'previous') {
+    return
+  }
+  if (ctx.store.applyMutation({ removeChildren: [existing.childWorkId] })) {
+    ctx.outcome.removed += 1
+  }
 }
 
 /** Apply one batch of evidence. The parent must already be held: the store refuses a child whose
@@ -145,13 +133,11 @@ export function reconcileAgentChildWorkEvidence(
       applyOperation(ctx, edge)
     } else if (edge.type === 'ended') {
       applyEnded(ctx, edge)
+    } else if (edge.type === 'removed') {
+      applyRemoved(ctx, edge)
     } else {
       settleLive(ctx, edge.observedAt)
     }
   }
-  // Only a settle adds settled history; skipping the scan otherwise keeps progress edges cheap.
-  if (ctx.outcome.settled > 0) {
-    trimSettled(ctx)
-  }
   return ctx.outcome
 }
diff --git a/src/shared/agent-status-child-work-view.test.ts b/src/shared/agent-status-child-work-view.test.ts
index 9c79a545183..da0de4e752c 100644
--- a/src/shared/agent-status-child-work-view.test.ts
+++ b/src/shared/agent-status-child-work-view.test.ts
@@ -15,7 +15,9 @@ import {
 } from './agent-status-child-work-projection'
 import {
   agentChildWorkOwnedLiveness,
-  deriveAgentChildDisplayState,
+  deriveAgentChildDisplayState
+} from './agent-status-child-work-display'
+import {
   projectAgentChildWorkViews,
   type AgentChildWorkView,
   type AgentChildWorkViewAlias
diff --git a/src/shared/agent-status-child-work-view.ts b/src/shared/agent-status-child-work-view.ts
index 80324d854e4..bfcbcfc11d5 100644
--- a/src/shared/agent-status-child-work-view.ts
+++ b/src/shared/agent-status-child-work-view.ts
@@ -1,4 +1,3 @@
-import { foldAgentLeadStatus } from './agent-lead-status-fold'
 import {
   AGENT_CHILD_WORK_ALIAS_KINDS,
   type AgentChildWorkAliasInput,
@@ -15,12 +14,8 @@ import {
   type AgentChildWorkOutcome,
   type AgentChildWorkState
 } from './agent-status-child-work'
-import {
-  agentChildWorkLiveness,
-  type AgentChildWorkLiveness
-} from './agent-status-child-work-liveness'
 import { agentStatusSubjectsEqual } from './agent-status-subject'
-import type { AgentStatusState } from './agent-status-types'
+import { groupedBy } from './grouped-by'
 
 /** What a surface reads about one child: a read-only projection of the host's record.
  *  Host bookkeeping (residency, invocation history, provenance, aliases) never travels. A view
@@ -60,7 +55,8 @@ export type AgentChildWorkViewAlias = Pick<
 const PROVIDER_ID_ALIAS_RANK: Record<AgentChildWorkAliasKind, number> = {
   task_id: 0,
   thread_id: 1,
-  tool_use_id: 2
+  tool_use_id: 2,
+  turn_id: 3
 }
 const PROVIDER_ID_ALIAS_ORDER = [...AGENT_CHILD_WORK_ALIAS_KINDS].sort(
   (left, right) => PROVIDER_ID_ALIAS_RANK[left] - PROVIDER_ID_ALIAS_RANK[right]
@@ -82,21 +78,6 @@ function providerIdFor(
   return undefined
 }
 
-// Not `Map.groupBy`: the relay runs this core on Node 18, which lacks it.
-function groupedBy<T, K>(items: readonly T[], keyOf: (item: T) => K): Map<K, T[]> {
-  const groups = new Map<K, T[]>()
-  for (const item of items) {
-    const key = keyOf(item)
-    const group = groups.get(key)
-    if (group) {
-      group.push(item)
-    } else {
-      groups.set(key, [item])
-    }
-  }
-  return groups
-}
-
 function isOnOwnershipCycle(
   start: AgentChildWorkInput,
   byId: ReadonlyMap<AgentChildWorkId, AgentChildWorkInput>
@@ -160,80 +141,3 @@ export function projectAgentChildWorkViews(
     }
   })
 }
-
-type AgentChildWorkOwnershipView = Pick<
-  AgentChildWorkView,
-  'id' | 'kind' | 'state' | 'membership' | 'parentChildWorkId'
->
-
-/** Liveness of all live work beneath a child, at any depth — the same input a parent row folds. */
-export function agentChildWorkOwnedLiveness(
-  views: readonly AgentChildWorkOwnershipView[],
-  ownerId: AgentChildWorkId
-): AgentChildWorkLiveness {
-  const owned = groupedBy(views, (view) => view.parentChildWorkId)
-  const seen = new Set<AgentChildWorkId>([ownerId])
-  const frontier = [ownerId]
-  const liveDescendants: AgentChildWorkOwnershipView[] = []
-  for (let owner = frontier.pop(); owner !== undefined; owner = frontier.pop()) {
-    for (const view of owned.get(owner) ?? []) {
-      if (!seen.has(view.id)) {
-        seen.add(view.id)
-        frontier.push(view.id)
-        if (view.membership === 'live') {
-          liveDescendants.push(view)
-        }
-      }
-    }
-  }
-  return agentChildWorkLiveness(liveDescendants)
-}
-
-/** The dot a child row renders; every value is an `AgentStateDot` state. */
-export type AgentChildDisplayState =
-  | 'working'
-  | 'monitoring'
-  | 'waiting'
-  | 'blocked'
-  | 'done'
-  | 'failed'
-  | 'interrupted'
-  | 'idle'
-  | 'unverifiable'
-
-const SETTLED_DISPLAY_STATE: Record<AgentChildWorkOutcome, AgentChildDisplayState> = {
-  succeeded: 'done',
-  failed: 'failed',
-  cancelled: 'interrupted',
-  // Neutral: an ending the lane cannot classify asserts nothing.
-  unknown: 'idle'
-}
-
-/**
- * A child's display state, through the same fold that decides a parent row's: work that is idle
- * or finished enters it as `done`, so a live shell the child owns reads `monitoring` exactly as it
- * would under a CLI agent. `unverifiable` is a freshness verdict and bypasses the fold.
- */
-export function deriveAgentChildDisplayState(
-  view: Pick<AgentChildWorkView, 'state' | 'membership' | 'outcome'>,
-  ownedLiveness: AgentChildWorkLiveness
-): AgentChildDisplayState {
-  if (view.state === 'unverifiable') {
-    return 'unverifiable'
-  }
-  // Stored only by a shell or a monitor, and neither owns work.
-  if (view.state === 'monitoring') {
-    return 'monitoring'
-  }
-  const leadState: AgentStatusState =
-    view.membership === 'settled' || view.state === 'done' || view.state === 'idle'
-      ? 'done'
-      : view.state
-  // A child's cancel never hides the work it left running.
-  const foldInput = { leadState, childWorkLiveness: ownedLiveness, interrupted: false }
-  const folded = foldAgentLeadStatus(foldInput)
-  if (folded.stateName !== 'done') {
-    return folded.workingMode ?? folded.stateName
-  }
-  return view.membership === 'live' ? 'idle' : SETTLED_DISPLAY_STATE[view.outcome ?? 'unknown']
-}
diff --git a/src/shared/agent-status-field-normalization.ts b/src/shared/agent-status-field-normalization.ts
index 25d6b6413d4..4fb741b5ec1 100644
--- a/src/shared/agent-status-field-normalization.ts
+++ b/src/shared/agent-status-field-normalization.ts
@@ -2,12 +2,17 @@
 // String normalizers shared by every agent-status payload field: trim/fold to
 // a single line for previews, preserve structure for multiline bodies, and
 // truncate without splitting surrogate pairs. Extracted from
-// agent-status-types.ts, which owns the payload shapes and per-field caps.
+// agent-status-types.ts, which owns the payload shapes and the caps no other module applies.
 
 import { compactDispatchPromptForStatus } from './orca-dispatch-status-prompt'
 
 /** Maximum character length for the prompt field. Truncated on parse. */
 export const AGENT_STATUS_MAX_FIELD_LENGTH = 200
+/** Maximum character length for the toolInput preview. */
+export const AGENT_STATUS_TOOL_INPUT_MAX_LENGTH = 160
+/** Maximum character length for the agentType label. Truncated on parse. */
+export const AGENT_TYPE_MAX_LENGTH = 40
+export const AGENT_MODEL_MAX_LENGTH = 120
 
 const SINGLE_LINE_FIELD_SCAN_OVERHEAD = 64
 const SINGLE_LINE_FIELD_SCAN_MULTIPLIER = 8
diff --git a/src/shared/agent-status-hooks-setting.ts b/src/shared/agent-status-hooks-setting.ts
new file mode 100644
index 00000000000..1c2c49feb0c
--- /dev/null
+++ b/src/shared/agent-status-hooks-setting.ts
@@ -0,0 +1,25 @@
+import type { GlobalSettings } from './global-settings-types'
+import type { TuiAgent } from './tui-agent'
+import { isTuiAgentEnabled } from './tui-agent-selection'
+
+export type AgentStatusHooksSettings =
+  | Partial<Pick<GlobalSettings, 'agentStatusHooksEnabled' | 'disabledTuiAgents'>>
+  | null
+  | undefined
+
+// Why shared: the CLI compiles shared/ itself, so its per-launch Codex preflight needs no out/main entry.
+export function isAgentStatusHooksEnabled(
+  settings: Partial<Pick<GlobalSettings, 'agentStatusHooksEnabled'>> | null | undefined
+): boolean {
+  return settings?.agentStatusHooksEnabled !== false
+}
+
+// Why: turning an agent off removes its hooks, so any install that reads only the global switch writes them back.
+export function isAgentStatusHooksEnabledForAgent(
+  settings: AgentStatusHooksSettings,
+  agent: TuiAgent
+): boolean {
+  return (
+    isAgentStatusHooksEnabled(settings) && isTuiAgentEnabled(agent, settings?.disabledTuiAgents)
+  )
+}
diff --git a/src/shared/agent-status-ipc-payload.ts b/src/shared/agent-status-ipc-payload.ts
index a15282b0018..68398a6d0de 100644
--- a/src/shared/agent-status-ipc-payload.ts
+++ b/src/shared/agent-status-ipc-payload.ts
@@ -55,6 +55,10 @@ export type AgentStatusIpcPayload = ParsedAgentStatusPayload & {
   evidenceObservedAt?: number
   /** Timestamp (ms) when the current state first appeared for this pane. */
   stateStartedAt: number
+  /** When the main agent's current turn began, stamped by the hook server from the main agent's
+   *  own turn-opening event. Optional: old hosts and turns opened unseen omit it, and readers fall
+   *  back to `stateStartedAt`. */
+  turnStartedAt?: number
   orchestration?: AgentStatusOrchestrationContext
   providerSession?: AgentProviderSessionMetadata
   /** Resume identity update only; the status-shaped fields are transport placeholders. */
diff --git a/src/shared/agent-status-observation.ts b/src/shared/agent-status-observation.ts
index b106e43fe63..e926a582ee5 100644
--- a/src/shared/agent-status-observation.ts
+++ b/src/shared/agent-status-observation.ts
@@ -7,6 +7,8 @@
 //
 // NOTHING READS IT YET. It is stamped so consumers can be migrated one at a time.
 
+import { createNonSecureContextUuid } from './non-secure-context-uuid'
+
 /** Where the evidence for a status row came from — the ingress, not the transport.
  *  A hook event relayed over SSH is still `hook`; the relay is a carrier. */
 export const AGENT_STATUS_OBSERVATION_ORIGINS = [
@@ -195,5 +197,5 @@ export class AgentStatusObservationSequencer {
  *  authority's revision counter starts over, so its observations must not be comparable
  *  with the ones it emitted before (including any rehydrated from disk). */
 export function createAgentStatusAuthorityId(role: string): string {
-  return `${role}:${globalThis.crypto.randomUUID()}`
+  return `${role}:${createNonSecureContextUuid()}`
 }
diff --git a/src/shared/agent-status-osc-scan-budget.test.ts b/src/shared/agent-status-osc-scan-budget.test.ts
index c61e2faded1..d0520056462 100644
--- a/src/shared/agent-status-osc-scan-budget.test.ts
+++ b/src/shared/agent-status-osc-scan-budget.test.ts
@@ -17,24 +17,26 @@ function parseWithSearchBudget(data: string) {
     }
     return found
   })
-  const execSpy = vi
-    .spyOn(RegExp.prototype, 'exec')
-    .mockImplementation(function (this: RegExp, input) {
-      const from = this.global || this.sticky ? this.lastIndex : 0
-      const found = exec.call(this, input)
-      if (input === data) {
-        searchedChars += (found === null ? data.length : found.index + found[0].length) - from
-      }
-      return found
-    })
-  const charCodeAtSpy = vi
-    .spyOn(String.prototype, 'charCodeAt')
-    .mockImplementation(function (this: string, index) {
-      if (this === data) {
-        searchedChars += 1
-      }
-      return charCodeAt.call(this, index)
-    })
+  const execSpy = vi.spyOn(RegExp.prototype, 'exec').mockImplementation(function (
+    this: RegExp,
+    input
+  ) {
+    const from = this.global || this.sticky ? this.lastIndex : 0
+    const found = exec.call(this, input)
+    if (input === data) {
+      searchedChars += (found === null ? data.length : found.index + found[0].length) - from
+    }
+    return found
+  })
+  const charCodeAtSpy = vi.spyOn(String.prototype, 'charCodeAt').mockImplementation(function (
+    this: string,
+    index
+  ) {
+    if (this === data) {
+      searchedChars += 1
+    }
+    return charCodeAt.call(this, index)
+  })
   try {
     return { result: createAgentStatusOscProcessor()(data), searchedChars }
   } finally {
diff --git a/src/shared/agent-status-store-copying-oracle.test-fixture.ts b/src/shared/agent-status-store-copying-oracle.test-fixture.ts
index cec2a2556e0..06446079c56 100644
--- a/src/shared/agent-status-store-copying-oracle.test-fixture.ts
+++ b/src/shared/agent-status-store-copying-oracle.test-fixture.ts
@@ -83,6 +83,9 @@ export function createCopyingAgentStatusStoreOracle(epoch: string): CopyingAgent
     getAliasesForChild: (childWorkId) =>
       [...current.aliases.values()].filter((alias) => alias.childWorkId === childWorkId),
     resolveChildAliases(aliases) {
+      if (aliases.length === 0) {
+        return []
+      }
       const keys = new Set(aliases.map(serializeAgentChildWorkAliasKey))
       const matches: AgentChildWorkAliasRecord[] = []
       for (const alias of current.aliases.values()) {
diff --git a/src/shared/agent-status-store-in-place.test.ts b/src/shared/agent-status-store-in-place.test.ts
index e67da48dfdf..efc999aef56 100644
--- a/src/shared/agent-status-store-in-place.test.ts
+++ b/src/shared/agent-status-store-in-place.test.ts
@@ -168,9 +168,10 @@ describe('AgentStatusStore applied in place', () => {
         for (const parent of parents) {
           expect(store.getChildren(parent)).toEqual(oracle.getChildren(parent))
         }
-        for (const id of CHILD_IDS) {
-          expect(store.getAliasesForChild(id)).toEqual(oracle.getAliasesForChild(id))
-        }
+        // Keep every child-id read in CHILD_IDS order while comparing one aggregate.
+        const aliasesByChildInIdOrder = CHILD_IDS.map((id) => store.getAliasesForChild(id))
+        const oracleAliasesByChildInIdOrder = CHILD_IDS.map((id) => oracle.getAliasesForChild(id))
+        expect(aliasesByChildInIdOrder).toEqual(oracleAliasesByChildInIdOrder)
         mostAliases = Math.max(mostAliases, oracle.state().aliases.size)
         const probe = mutation.aliases ?? []
         expect(store.resolveChildAliases(probe)).toEqual(oracle.resolveChildAliases(probe))
diff --git a/src/shared/agent-status-subagent-snapshot.ts b/src/shared/agent-status-subagent-snapshot.ts
new file mode 100644
index 00000000000..b5a9f5af8fa
--- /dev/null
+++ b/src/shared/agent-status-subagent-snapshot.ts
@@ -0,0 +1,108 @@
+// A pane's in-process subagents as the hook lane publishes them on a status row: the snapshot
+// shape, its normalization at every admission point, and the equality stores reuse arrays by.
+
+import {
+  AGENT_MODEL_MAX_LENGTH,
+  AGENT_STATUS_TOOL_INPUT_MAX_LENGTH,
+  AGENT_TYPE_MAX_LENGTH,
+  normalizeOptionalField
+} from './agent-status-field-normalization'
+
+export type AgentSubagentState = 'working' | 'blocked' | 'waiting' | 'idle' | 'unverifiable'
+
+/** A live in-process child of the pane's provider session. Rendered as an
+ *  indented child row with no PTY of its own. */
+export type AgentSubagentSnapshot = {
+  /** Provider-assigned lifecycle id. */
+  id: string
+  agentType?: string
+  /** Provider model used by this child, when exposed by its lifecycle event. */
+  model?: string
+  description?: string
+  state: AgentSubagentState
+  /** Timestamp (ms) when this subagent was first observed. */
+  startedAt: number
+}
+
+/** Maximum subagent child rows carried per status entry. Bounds per-pane cache
+ *  and IPC fanout against a runaway spawner. */
+export const AGENT_STATUS_MAX_SUBAGENTS = 32
+const AGENT_SUBAGENT_ID_MAX_LENGTH = 64
+
+function normalizeSubagentSnapshot(value: unknown): AgentSubagentSnapshot | null {
+  if (typeof value !== 'object' || value === null) {
+    return null
+  }
+  const obj = value as Record<string, unknown>
+  if (typeof obj.id !== 'string') {
+    return null
+  }
+  const id = obj.id.trim()
+  if (id.length === 0 || id.length > AGENT_SUBAGENT_ID_MAX_LENGTH) {
+    return null
+  }
+  if (
+    obj.state !== 'working' &&
+    obj.state !== 'blocked' &&
+    obj.state !== 'waiting' &&
+    obj.state !== 'idle' &&
+    obj.state !== 'unverifiable'
+  ) {
+    return null
+  }
+  return {
+    id,
+    state: obj.state,
+    startedAt:
+      typeof obj.startedAt === 'number' && Number.isFinite(obj.startedAt) ? obj.startedAt : 0,
+    agentType: normalizeOptionalField(obj.agentType, AGENT_TYPE_MAX_LENGTH),
+    model: normalizeOptionalField(obj.model, AGENT_MODEL_MAX_LENGTH),
+    description: normalizeOptionalField(obj.description, AGENT_STATUS_TOOL_INPUT_MAX_LENGTH)
+  }
+}
+
+export function normalizeAgentSubagentsField(value: unknown): AgentSubagentSnapshot[] | undefined {
+  if (!Array.isArray(value) || value.length === 0) {
+    return undefined
+  }
+  const normalized: AgentSubagentSnapshot[] = []
+  for (const item of value) {
+    const snapshot = normalizeSubagentSnapshot(item)
+    if (snapshot) {
+      normalized.push(snapshot)
+      if (normalized.length >= AGENT_STATUS_MAX_SUBAGENTS) {
+        break
+      }
+    }
+  }
+  return normalized.length > 0 ? normalized : undefined
+}
+
+/** Structural equality for subagent lists so stores can reuse the previous
+ *  array reference (and skip fanout) when nothing actually changed. */
+export function agentSubagentsEqual(
+  a: AgentSubagentSnapshot[] | undefined,
+  b: AgentSubagentSnapshot[] | undefined
+): boolean {
+  if (a === b) {
+    return true
+  }
+  if (!a || !b || a.length !== b.length) {
+    return !a && !b
+  }
+  for (let i = 0; i < a.length; i++) {
+    const x = a[i]
+    const y = b[i]
+    if (
+      x.id !== y.id ||
+      x.state !== y.state ||
+      x.startedAt !== y.startedAt ||
+      x.agentType !== y.agentType ||
+      x.model !== y.model ||
+      x.description !== y.description
+    ) {
+      return false
+    }
+  }
+  return true
+}
diff --git a/src/shared/agent-status-types.ts b/src/shared/agent-status-types.ts
index dcd447e6bef..5a9d34ae7d3 100644
--- a/src/shared/agent-status-types.ts
+++ b/src/shared/agent-status-types.ts
@@ -8,8 +8,12 @@ import type { AgentStateHistoryEntry } from './agent-state-history'
 import { isAgentJournalTurnOutcome } from './agent-turn-outcome'
 import type { OrchestrationFleetAttention } from './orchestration-fleet-attention'
 import type { AgentStatusRowFacets } from './agent-status-observation'
+import type { AgentChildWorkView } from './agent-status-child-work-view'
 import type { TuiAgent } from './tui-agent'
 import {
+  AGENT_MODEL_MAX_LENGTH,
+  AGENT_STATUS_TOOL_INPUT_MAX_LENGTH,
+  AGENT_TYPE_MAX_LENGTH,
   normalizeInteractivePromptField,
   normalizeOptionalField,
   normalizeOptionalMultilineField,
@@ -18,7 +22,23 @@ import {
 } from './agent-status-field-normalization'
 import { assertJsonTextStructureWithinLimits } from './json-text-structure-limit'
 
-export { AGENT_STATUS_MAX_FIELD_LENGTH } from './agent-status-field-normalization'
+import {
+  normalizeAgentSubagentsField,
+  type AgentSubagentSnapshot
+} from './agent-status-subagent-snapshot'
+
+export {
+  AGENT_MODEL_MAX_LENGTH,
+  AGENT_STATUS_MAX_FIELD_LENGTH,
+  AGENT_STATUS_TOOL_INPUT_MAX_LENGTH,
+  AGENT_TYPE_MAX_LENGTH
+} from './agent-status-field-normalization'
+export {
+  AGENT_STATUS_MAX_SUBAGENTS,
+  agentSubagentsEqual,
+  type AgentSubagentSnapshot,
+  type AgentSubagentState
+} from './agent-status-subagent-snapshot'
 export type {
   AgentStatusCacheIdentity,
   AgentStatusClearIpcPayload,
@@ -53,22 +73,6 @@ export type AgentStatusOrchestrationContext = {
   attention?: OrchestrationFleetAttention
 }
 
-export type AgentSubagentState = 'working' | 'blocked' | 'waiting' | 'idle' | 'unverifiable'
-
-/** A live in-process child of the pane's provider session. Rendered as an
- *  indented child row with no PTY of its own. */
-export type AgentSubagentSnapshot = {
-  /** Provider-assigned lifecycle id. */
-  id: string
-  agentType?: string
-  /** Provider model used by this child, when exposed by its lifecycle event. */
-  model?: string
-  description?: string
-  state: AgentSubagentState
-  /** Timestamp (ms) when this subagent was first observed. */
-  startedAt: number
-}
-
 export type AgentStatusEntry = {
   /** Renderer-local status-feed confirmation for children; absent on hook rows. */
   subagentObservation?: 'live' | 'unverifiable'
@@ -91,6 +95,9 @@ export type AgentStatusEntry = {
   stateStartedAt: number
   /** `updatedAt` of the write that switched into `state`; see AgentStateHistoryEntry.observedAt. */
   stateObservedAt?: number
+  /** When the main agent's current turn began, as the hook server stamped it. Absent from old hosts
+   *  and writers without a turn clock; readers fall back to `stateStartedAt`. */
+  turnStartedAt?: number
   agentType?: AgentType
   /** Provider model currently used by this session. */
   model?: string
@@ -142,6 +149,9 @@ export type AgentStatusEntry = {
   /** The main agent's own state; absent from old hosts and from writers that carry no main agent fact
    *  (OSC, launch seeds), where readers fall back to `state`. */
   mainAgent?: AgentMainAgentStatus
+  /** The host's child-work views for this session, when it publishes them; child rows then read
+   *  these instead of `subagents`. Absent from older hosts. */
+  children?: AgentChildWorkView[]
   /** Provider-owned conversation/session id captured from hook payloads.
    *  Used only for exact CLI resume; Orca terminal ids are not agent-session ids. */
   providerSession?: AgentProviderSessionMetadata
@@ -237,8 +247,6 @@ export function pickParsedAgentStatusPayload(
  */
 /** Maximum character length for the toolName field. */
 export const AGENT_STATUS_TOOL_NAME_MAX_LENGTH = 60
-/** Maximum character length for the toolInput preview. */
-export const AGENT_STATUS_TOOL_INPUT_MAX_LENGTH = 160
 /** Maximum character length for the lastAssistantMessage preview.
  *  Why: 8 KB fits a multi-paragraph summary while bounding per-pane cache against a buggy/malicious agent spamming huge strings. */
 export const AGENT_STATUS_ASSISTANT_MESSAGE_MAX_LENGTH = 8000
@@ -260,71 +268,15 @@ const VALID_STATES: ReadonlySet<string> = new Set<string>(AGENT_STATUS_STATES)
 export function isAgentStatusState(value: unknown): value is AgentStatusState {
   return typeof value === 'string' && VALID_STATES.has(value)
 }
-/** Maximum character length for the agentType label. Truncated on parse. */
-export const AGENT_TYPE_MAX_LENGTH = 40
-export const AGENT_MODEL_MAX_LENGTH = 120
 
-/** Maximum subagent child rows carried per status entry. Bounds per-pane cache
- *  and IPC fanout against a runaway spawner. */
-export const AGENT_STATUS_MAX_SUBAGENTS = 32
 export const AGENT_STATUS_JSON_STRUCTURE_LIMITS = {
   structuralTokens: 4096,
   nestingDepth: 16
 } as const
-const AGENT_SUBAGENT_ID_MAX_LENGTH = 64
-
-function normalizeSubagentSnapshot(value: unknown): AgentSubagentSnapshot | null {
-  if (typeof value !== 'object' || value === null) {
-    return null
-  }
-  const obj = value as Record<string, unknown>
-  if (typeof obj.id !== 'string') {
-    return null
-  }
-  const id = obj.id.trim()
-  if (id.length === 0 || id.length > AGENT_SUBAGENT_ID_MAX_LENGTH) {
-    return null
-  }
-  if (
-    obj.state !== 'working' &&
-    obj.state !== 'blocked' &&
-    obj.state !== 'waiting' &&
-    obj.state !== 'idle' &&
-    obj.state !== 'unverifiable'
-  ) {
-    return null
-  }
-  return {
-    id,
-    state: obj.state,
-    startedAt:
-      typeof obj.startedAt === 'number' && Number.isFinite(obj.startedAt) ? obj.startedAt : 0,
-    agentType: normalizeOptionalField(obj.agentType, AGENT_TYPE_MAX_LENGTH),
-    model: normalizeOptionalField(obj.model, AGENT_MODEL_MAX_LENGTH),
-    description: normalizeOptionalField(obj.description, AGENT_STATUS_TOOL_INPUT_MAX_LENGTH)
-  }
-}
-
-function normalizeSubagentsField(value: unknown): AgentSubagentSnapshot[] | undefined {
-  if (!Array.isArray(value) || value.length === 0) {
-    return undefined
-  }
-  const normalized: AgentSubagentSnapshot[] = []
-  for (const item of value) {
-    const snapshot = normalizeSubagentSnapshot(item)
-    if (snapshot) {
-      normalized.push(snapshot)
-      if (normalized.length >= AGENT_STATUS_MAX_SUBAGENTS) {
-        break
-      }
-    }
-  }
-  return normalized.length > 0 ? normalized : undefined
-}
 
 /** A malformed `mainAgent` drops the FIELD, never the row: the combined `state` is still valid
  *  evidence, and readers fall back to it exactly as they do for a host that predates the field. */
-function normalizeMainAgentStatusField(value: unknown): AgentMainAgentStatus | undefined {
+export function normalizeMainAgentStatusField(value: unknown): AgentMainAgentStatus | undefined {
   if (typeof value !== 'object' || value === null) {
     return undefined
   }
@@ -344,35 +296,6 @@ function normalizeMainAgentStatusField(value: unknown): AgentMainAgentStatus | u
   }
 }
 
-/** Structural equality for subagent lists so stores can reuse the previous
- *  array reference (and skip fanout) when nothing actually changed. */
-export function agentSubagentsEqual(
-  a: AgentSubagentSnapshot[] | undefined,
-  b: AgentSubagentSnapshot[] | undefined
-): boolean {
-  if (a === b) {
-    return true
-  }
-  if (!a || !b || a.length !== b.length) {
-    return !a && !b
-  }
-  for (let i = 0; i < a.length; i++) {
-    const x = a[i]
-    const y = b[i]
-    if (
-      x.id !== y.id ||
-      x.state !== y.state ||
-      x.startedAt !== y.startedAt ||
-      x.agentType !== y.agentType ||
-      x.model !== y.model ||
-      x.description !== y.description
-    ) {
-      return false
-    }
-  }
-  return true
-}
-
 /**
  * Normalize and validate an already-parsed agent status object. Shared by the
  * JSON string entry point (`parseAgentStatusPayload`) and the object entry
@@ -420,7 +343,7 @@ function normalizeAgentStatusObject(parsed: unknown): ParsedAgentStatusPayload |
     interrupted: obj.interrupted === true && state === 'done' ? true : undefined,
     sessionBoundary: obj.sessionBoundary === true && state === 'done' ? true : undefined,
     turnCompletedAt: normalizeTurnCompletedAtField(obj.turnCompletedAt, state),
-    subagents: normalizeSubagentsField(obj.subagents),
+    subagents: normalizeAgentSubagentsField(obj.subagents),
     mainAgent: normalizeMainAgentStatusField(obj.mainAgent)
   }
 }
diff --git a/src/shared/agent-title-core.ts b/src/shared/agent-title-core.ts
index 3d0bdbc0feb..a3bc238a7e1 100644
--- a/src/shared/agent-title-core.ts
+++ b/src/shared/agent-title-core.ts
@@ -1,3 +1,6 @@
+import { isDshTerminalTitle } from './dsh-terminal-title'
+export { DSH_WHALE, isDshTerminalTitle } from './dsh-terminal-title'
+import { isQoderTerminalTitle } from './qoder-terminal-title'
 import {
   AGY_AGENT_NAME_RE,
   DROID_AGENT_NAME_RE,
@@ -56,6 +59,13 @@ export const BRAILLE_SPINNER_RE = /[\u2800-\u28ff]/g
 export const QUARTER_CIRCLE_SPINNER_RE = /[\u25d0-\u25d3]/g
 
 function computeIsGeminiTerminalTitle(title: string): boolean {
+  // Why first: see isDshTerminalTitle — the two agents share the `✦` glyph.
+  if (isQoderTerminalTitle(title)) {
+    return false
+  }
+  if (isDshTerminalTitle(title)) {
+    return false
+  }
   // Why: Gemini OSC glyphs are stronger evidence than any cwd/session text.
   if (
     title.includes(GEMINI_PERMISSION) ||
diff --git a/src/shared/agent-title-decoration.test.ts b/src/shared/agent-title-decoration.test.ts
index a87426c83cf..5a5666696e0 100644
--- a/src/shared/agent-title-decoration.test.ts
+++ b/src/shared/agent-title-decoration.test.ts
@@ -5,6 +5,11 @@ import {
 } from './agent-title-decoration'
 
 describe('stripLeadingAgentTitleDecoration', () => {
+  it('strips Qoder permission decoration without stripping triangles inside a title', () => {
+    expect(stripLeadingAgentTitleDecoration('▲ Qoder CLI')).toBe('Qoder CLI')
+    expect(stripLeadingAgentTitleDecoration('deploy ▲ complete')).toBe('deploy ▲ complete')
+  })
+
   it("strips Claude's ✳ idle glyph", () => {
     expect(stripLeadingAgentTitleDecoration('✳ Claude Code')).toBe('Claude Code')
   })
diff --git a/src/shared/agent-title-decoration.ts b/src/shared/agent-title-decoration.ts
index 47a6db679e7..3ae4d0075e6 100644
--- a/src/shared/agent-title-decoration.ts
+++ b/src/shared/agent-title-decoration.ts
@@ -1,11 +1,11 @@
 // Leading status decorations that coding agents prepend to their OSC title —
-// Claude's '✳', Gemini's glyphs (✦ ⏲ ◇ ✋), braille and quarter-circle spinners,
+// Claude's '✳', Gemini's glyphs (✦ ⏲ ◇ ✋), Qoder’s ▲, braille and quarter-circle spinners,
 // and Claude's '. '/'* ' working/idle prefixes. Once the tab bar shows the
 // provider icon, this leading glyph reads as a redundant second icon, so strip
 // it from the displayed title. Scoped to titles we already know belong to an agent.
 const LEADING_AGENT_TITLE_DECORATION_RE =
   // eslint-disable-next-line no-control-regex -- intentional unicode status-glyph ranges
-  /^(?:[✳✦⏲◇✋⠀-⣿◐-◓]+|[.*]\s)\s*/
+  /^(?:[✳✦⏲◇✋▲⠀-⣿◐-◓]+|[.*]\s)\s*/
 
 export function stripLeadingAgentTitleDecorationOrEmpty(title: string): string {
   return title.replace(LEADING_AGENT_TITLE_DECORATION_RE, '').trimStart()
diff --git a/src/shared/agent-title-identity.ts b/src/shared/agent-title-identity.ts
index 949768e03b5..69d1531fb9e 100644
--- a/src/shared/agent-title-identity.ts
+++ b/src/shared/agent-title-identity.ts
@@ -1,3 +1,4 @@
+import { isQoderTerminalTitle } from './qoder-terminal-title'
 import { getPiStateTitleBrand } from './pi-state-title-marker'
 import {
   AGY_AGENT_NAME_RE,
@@ -72,6 +73,9 @@ function computeAgentLabel(title: string): string | null {
   if (piStateBrand) {
     return piStateBrand
   }
+  if (isQoderTerminalTitle(title)) {
+    return 'Qoder CLI'
+  }
   if (isGeminiTerminalTitle(title)) {
     return 'Gemini CLI'
   }
diff --git a/src/shared/agent-title-status.ts b/src/shared/agent-title-status.ts
index a74ae15d6bf..7cd7a2c292c 100644
--- a/src/shared/agent-title-status.ts
+++ b/src/shared/agent-title-status.ts
@@ -1,3 +1,4 @@
+import { qoderTitleStatus } from './qoder-terminal-title'
 import {
   AGY_AGENT_NAME_RE,
   BRAILLE_SPINNER_RE,
@@ -19,6 +20,7 @@ import {
   containsQuarterCircleSpinner,
   containsLegacyAgentName,
   isClaudeManagementTitle,
+  isDshTerminalTitle,
   isGeminiTerminalTitle,
   isPiAgentTitle,
   isPiTerminalTitle
@@ -128,6 +130,10 @@ export function createAgentStatusTracker(
  * Normalize high-churn agent titles into stable display labels before storage.
  */
 export function normalizeTerminalTitle(title: string): string {
+  const qoderStatus = qoderTitleStatus(title)
+  if (qoderStatus) {
+    return `${qoderStatus === 'working' ? '✦' : qoderStatus === 'permission' ? '▲' : '◇'} Qoder CLI`
+  }
   if (!title) {
     return title
   }
@@ -180,6 +186,10 @@ function canonicalizeBrailleSpinnerFrame(title: string): string {
 }
 
 function computeAgentStatusFromTitle(title: string): AgentStatus | null {
+  const qoderStatus = qoderTitleStatus(title)
+  if (qoderStatus) {
+    return qoderStatus
+  }
   if (!title || isClaudeManagementTitle(title)) {
     return null
   }
@@ -198,14 +208,20 @@ function computeAgentStatusFromTitle(title: string): AgentStatus | null {
     return piStateStatus
   }
 
-  if (title.includes(GEMINI_PERMISSION)) {
-    return 'permission'
-  }
-  if (title.includes(GEMINI_WORKING) || title.includes(GEMINI_SILENT_WORKING)) {
-    return 'working'
-  }
-  if (title.includes(GEMINI_IDLE)) {
-    return 'idle'
+  // Why the guard: DSH-TUI prefixes its title with `✦` while it is at REST, and that is
+  // Gemini's WORKING glyph. Reading it here made a finished DSH pane report working
+  // forever. DSH's own spinner prefixes are braille, which the spinner check below
+  // already covers, and its hooks are the authority either way.
+  if (!isDshTerminalTitle(title)) {
+    if (title.includes(GEMINI_PERMISSION)) {
+      return 'permission'
+    }
+    if (title.includes(GEMINI_WORKING) || title.includes(GEMINI_SILENT_WORKING)) {
+      return 'working'
+    }
+    if (title.includes(GEMINI_IDLE)) {
+      return 'idle'
+    }
   }
 
   // Why: resolve synthetic Pi/OMP permission/idle labels before the broader
diff --git a/src/shared/agent-type-label.ts b/src/shared/agent-type-label.ts
index 24febeaafa7..72d1b1b6d63 100644
--- a/src/shared/agent-type-label.ts
+++ b/src/shared/agent-type-label.ts
@@ -4,8 +4,11 @@ import type { AgentType } from './agent-status-types'
 // (e.g. native chat's empty state on both surfaces) from one source of truth.
 const WELL_KNOWN_LABELS: Record<string, string> = {
   claude: 'Claude',
+  codebuddy: 'CodeBuddy',
   openclaude: 'OpenClaude',
   codex: 'Codex',
+  qoder: 'Qoder CLI',
+  qodercli: 'Qoder CLI',
   gemini: 'Gemini',
   antigravity: 'Antigravity',
   amp: 'Amp',
@@ -27,7 +30,8 @@ const WELL_KNOWN_LABELS: Record<string, string> = {
   trae: 'Trae',
   kimi: 'Kimi',
   muse: 'Muse',
-  zcode: 'ZCode'
+  zcode: 'ZCode',
+  dsh: 'DeepSeek Harness'
 }
 
 export function formatAgentTypeLabel(agentType: AgentType | null | undefined): string {
diff --git a/src/shared/agent-workspace-trust-spawn-request.ts b/src/shared/agent-workspace-trust-spawn-request.ts
new file mode 100644
index 00000000000..02ac3765e2c
--- /dev/null
+++ b/src/shared/agent-workspace-trust-spawn-request.ts
@@ -0,0 +1,21 @@
+import { z } from 'zod'
+
+/**
+ * Optional `pty.spawn` field: the desktop decided to pre-trust `workspacePath` for this launch
+ * (setting on, fresh launch). The relay derives the preset from `launchAgent` and writes on
+ * its own disk; a relay that does not know the field ignores it, so the agent just asks.
+ */
+export type AgentWorkspaceTrustSpawnRequest = {
+  workspacePath: string
+}
+
+const agentWorkspaceTrustSpawnRequestSchema = z.object({
+  workspacePath: z.string().min(1)
+})
+
+export function parseAgentWorkspaceTrustSpawnRequest(
+  value: unknown
+): AgentWorkspaceTrustSpawnRequest | null {
+  const parsed = agentWorkspaceTrustSpawnRequestSchema.safeParse(value)
+  return parsed.success ? { workspacePath: parsed.data.workspacePath } : null
+}
diff --git a/src/shared/ai-vault-resume-command.test.ts b/src/shared/ai-vault-resume-command.test.ts
index da8ced39e0e..db89cb41263 100644
--- a/src/shared/ai-vault-resume-command.test.ts
+++ b/src/shared/ai-vault-resume-command.test.ts
@@ -28,6 +28,17 @@ describe('buildAiVaultResumeCommand', () => {
     ).toBe('cmd /d /s /c "cd /d ""C:\\Users\\Ada Lovelace\\repo"" && codex resume ""session-1"""')
   })
 
+  it('resumes CodeBuddy sessions with the Claude-compatible --resume flag', () => {
+    expect(
+      buildAiVaultResumeCommand({
+        agent: 'codebuddy',
+        sessionId: 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee',
+        cwd: '/repo/app',
+        platform: 'darwin'
+      })
+    ).toBe("cd '/repo/app' && codebuddy --resume 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee'")
+  })
+
   it('builds a direct queued command for a live cmd shell', () => {
     expect(
       buildAiVaultResumeCommand({
diff --git a/src/shared/ai-vault-resume-command.ts b/src/shared/ai-vault-resume-command.ts
index fbd0658def1..efb2ddbe5d3 100644
--- a/src/shared/ai-vault-resume-command.ts
+++ b/src/shared/ai-vault-resume-command.ts
@@ -218,7 +218,9 @@ function buildAgentResumeInvocation(
       return `${baseCommand} resume ${sessionArg}`
     case 'cline':
       return `${baseCommand} --id ${sessionArg}`
+    case 'codebuddy':
     case 'claude':
+    case 'zcode':
     case 'cursor':
     case 'gemini':
     case 'grok':
diff --git a/src/shared/ai-vault-session-deletion.ts b/src/shared/ai-vault-session-deletion.ts
index d3c2211ab84..4875ab6e889 100644
--- a/src/shared/ai-vault-session-deletion.ts
+++ b/src/shared/ai-vault-session-deletion.ts
@@ -40,6 +40,7 @@ export const AI_VAULT_DELETABLE_AGENTS = [
   'pi',
   'omp',
   'claude',
+  'codebuddy',
   'rovo',
   'grok',
   'cline'
diff --git a/src/shared/ai-vault-types.ts b/src/shared/ai-vault-types.ts
index b2635555bf6..e337f98d7a0 100644
--- a/src/shared/ai-vault-types.ts
+++ b/src/shared/ai-vault-types.ts
@@ -3,6 +3,7 @@ import type { ExecutionHostId, ExecutionHostScope } from './execution-host'
 
 export const AI_VAULT_AGENTS = [
   'claude',
+  'codebuddy',
   'codex',
   'hermes',
   'pi',
@@ -15,6 +16,7 @@ export const AI_VAULT_AGENTS = [
   'copilot',
   'opencode',
   'opencode2',
+  'zcode',
   'grok',
   'openclaw',
   'devin',
@@ -50,6 +52,7 @@ export type AiVaultGroup = 'project' | 'folder' | 'agent'
 
 export const AI_VAULT_AGENT_LABELS = {
   claude: 'Claude',
+  codebuddy: 'CodeBuddy',
   codex: 'Codex',
   hermes: 'Hermes',
   pi: 'Pi',
@@ -62,6 +65,7 @@ export const AI_VAULT_AGENT_LABELS = {
   copilot: 'GitHub Copilot',
   opencode: 'OpenCode',
   opencode2: 'OpenCode 2',
+  zcode: 'ZCode',
   grok: 'Grok',
   openclaw: 'OpenClaw',
   devin: 'Devin',
diff --git a/src/shared/browser-network-tunnel-stream-framing.test.ts b/src/shared/browser-network-tunnel-stream-framing.test.ts
index 4ca73810cdf..c4efcbca83a 100644
--- a/src/shared/browser-network-tunnel-stream-framing.test.ts
+++ b/src/shared/browser-network-tunnel-stream-framing.test.ts
@@ -82,12 +82,14 @@ describe('browser network tunnel stream framing', () => {
     )
     const originalSet = Uint8Array.prototype.set
     let copiedBytes = 0
-    const set = vi
-      .spyOn(Uint8Array.prototype, 'set')
-      .mockImplementation(function (this: Uint8Array, source, offset) {
-        copiedBytes += source.length
-        originalSet.call(this, source, offset)
-      })
+    const set = vi.spyOn(Uint8Array.prototype, 'set').mockImplementation(function (
+      this: Uint8Array,
+      source,
+      offset
+    ) {
+      copiedBytes += source.length
+      originalSet.call(this, source, offset)
+    })
     try {
       for (const byte of encoded) {
         decoder.feed(new Uint8Array([byte]))
diff --git a/src/shared/browser-url.test.ts b/src/shared/browser-url.test.ts
index 27437766867..2f947601bda 100644
--- a/src/shared/browser-url.test.ts
+++ b/src/shared/browser-url.test.ts
@@ -212,6 +212,44 @@ describe('browser-url helpers', () => {
     )
   })
 
+  it.each([
+    ['example.com:8443/docs?q=one#section', 'https://example.com:8443/docs?q=one#section'],
+    ['EXAMPLE.COM:443', 'https://example.com/'],
+    ['example.com:80', 'https://example.com:80/'],
+    ['app.localhost:3000', 'http://app.localhost:3000/'],
+    ['app.localhost:443', 'http://app.localhost:443/'],
+    ['app.localhost:80', 'http://app.localhost/'],
+    ['deep.app.localhost:5173/path?x=1#preview', 'http://deep.app.localhost:5173/path?x=1#preview'],
+    ['https://app.localhost:3000', 'https://app.localhost:3000/'],
+    ['http://example.com:80/docs', 'http://example.com/docs'],
+    ['example.com:65535/docs', 'https://example.com:65535/docs'],
+    ['example.com:0', 'https://example.com:0/'],
+    ['APP.LOCALHOST.:443/docs', 'http://app.localhost.:443/docs'],
+    ['[::1]:3000/docs', 'http://[::1]:3000/docs'],
+    ['https://user:pass@example.com:8443/docs', 'https://user:pass@example.com:8443/docs'],
+    [
+      'example.com:8443/path@evil.test?next=:80#part',
+      'https://example.com:8443/path@evil.test?next=:80#part'
+    ]
+  ])('navigates a domain with a port: %s', (input, expected) => {
+    expect(normalizeBrowserNavigationUrl(input, 'google')).toBe(expected)
+    expect(normalizeBrowserNavigationUrl(input)).toBe(expected)
+  })
+
+  it.each([
+    'javascript:1234',
+    'data:1234',
+    'custom:3000',
+    'example.com:65536',
+    'example.com:8443@evil.test',
+    'example.com:8443\\evil.test',
+    'example.com:-1',
+    'example.com:3.5',
+    'example.com:8443evil.test'
+  ])('does not turn an unsupported scheme or invalid port into a navigation: %s', (input) => {
+    expect(normalizeBrowserNavigationUrl(input, 'google')).toBeNull()
+  })
+
   it('builds search URLs correctly', () => {
     expect(buildSearchUrl('hello world', 'google')).toBe(
       'https://www.google.com/search?q=hello%20world'
diff --git a/src/shared/browser-url.ts b/src/shared/browser-url.ts
index eaaf8211c6d..7854a24bac6 100644
--- a/src/shared/browser-url.ts
+++ b/src/shared/browser-url.ts
@@ -64,6 +64,24 @@ function isValidDnsName(name: string): boolean {
     )
 }
 
+/** Avoids parsing a dotted host and port as a scheme; .localhost defaults to HTTP. */
+function classifySchemeLessDomainPortAddress(input: string): URL | null {
+  const match = /^([^\s/\\:@?#]+):\d+(?:[/?#].*)?$/.exec(input)
+  if (!match || !match[1].includes('.')) {
+    return null
+  }
+  try {
+    const url = new URL(`https://${input}`)
+    const hostname = normalizeCertificateHostname(url.hostname)
+    if (!isValidDnsName(hostname)) {
+      return null
+    }
+    return hostname.endsWith('.localhost') ? new URL(`http://${input}`) : url
+  } catch {
+    return null
+  }
+}
+
 function isIpv4Loopback(hostname: string): boolean {
   const octets = hostname.split('.')
   if (octets.length !== 4 || octets.some((octet) => !/^\d{1,3}$/.test(octet))) {
@@ -290,6 +308,11 @@ export function normalizeBrowserNavigationUrl(
     return absolutePathToFileUrl(trimmed)
   }
 
+  const domainPortAddress = classifySchemeLessDomainPortAddress(trimmed)
+  if (domainPortAddress) {
+    return domainPortAddress.toString()
+  }
+
   try {
     const parsed = new URL(trimmed)
     // Why: file:// is allowed so the browser pane can render local files the
diff --git a/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt b/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt
index 2dd034cbe5f..7741c9907dd 100644
--- a/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt
+++ b/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt
@@ -52,7 +52,6 @@ src/main/browser/agent-browser-bridge-state.ts
 src/main/browser/agent-browser-bridge-types.ts
 src/main/browser/browser-route-egress-electron-launch.ts
 src/main/browser/browser-route-persisted-worker-electron-process.ts
-src/main/claude-accounts/keychain.ts
 src/main/codex-accounts/legacy-wsl-runtime-auth-drain-recovery-script-harness.ts
 src/main/codex-accounts/legacy-wsl-runtime-auth-drain-script-harness.ts
 src/main/codex-accounts/legacy-wsl-runtime-auth-drain-script-interference-shims.ts
@@ -115,6 +114,7 @@ src/main/ipc/repos/repo-clone-lifecycle.ts
 src/main/ipc/worktree-apfs-clone.ts
 src/main/ipc/wsl-watcher-process-exit.ts
 src/main/local-builds/local-build-candidate.ts
+src/main/macos-keychain/generic-password.ts
 src/main/macos-system-sleep-assertion.ts
 src/main/macos-tcc-prompt-watch.ts
 src/main/memory/collector.ts
@@ -130,7 +130,6 @@ src/main/providers/process-cwd.ts
 src/main/providers/windows-console-attached-processes.ts
 src/main/pty-descendant-termination.ts
 src/main/pty/posix-pty-foreground-group.ts
-src/main/pty/posix-pty-process-groups.ts
 src/main/pty/windows-environment-path.ts
 src/main/rate-limits/codex-fetcher.ts
 src/main/rate-limits/gemini-cli-oauth-extractor.ts
@@ -165,7 +164,6 @@ src/relay/ai-vault-service-spawn.ts
 src/relay/external-automations-handler.ts
 src/relay/fs-handler-git-fallback.ts
 src/relay/fs-handler-list-files.ts
-src/relay/fs-handler-utils.ts
 src/relay/fs-list-files-fallback-chain.ts
 src/relay/git-handler.ts
 src/relay/git-stdout-stream.ts
@@ -178,5 +176,4 @@ src/shared/ephemeral-vm-recipe-runner.ts
 src/shared/fish-binary-requirement.ts
 src/shared/process-table-snapshot-reader.ts
 src/shared/pty-slave-line-discipline-echo.ts
-src/shared/ripgrep-process-availability.ts
 src/shared/shell-process-readiness.ts
diff --git a/src/shared/child-process/__fixtures__/windows-console-visibility-allowlist.txt b/src/shared/child-process/__fixtures__/windows-console-visibility-allowlist.txt
index 828a01350bb..6de7701b81b 100644
--- a/src/shared/child-process/__fixtures__/windows-console-visibility-allowlist.txt
+++ b/src/shared/child-process/__fixtures__/windows-console-visibility-allowlist.txt
@@ -9,7 +9,7 @@ main/agent-hooks/managed-hook-owner-identity.ts
 main/agent-hooks/managed-hook-runtime.ts
 main/app-icon.ts
 main/automations/precheck-runner.ts
-main/claude-accounts/keychain.ts
+main/macos-keychain/generic-password.ts
 main/computer/macos-computer-use-permission-status.ts
 main/computer/macos-computer-use-permissions.ts
 main/computer/macos-native-provider-transport.ts
@@ -37,7 +37,6 @@ main/providers/macos-login-session-pty-probe.ts
 main/providers/process-cwd.ts
 main/pty-descendant-termination.ts
 main/pty/posix-pty-foreground-group.ts
-main/pty/posix-pty-process-groups.ts
 main/pty/windows-environment-path.ts
 main/rate-limits/codex-fetcher.ts
 main/runtime/tls-certificate.ts
diff --git a/src/shared/child-process/child-process-import-boundary.test.ts b/src/shared/child-process/child-process-import-boundary.test.ts
index 2ae150cc8be..f7d78c9f84b 100644
--- a/src/shared/child-process/child-process-import-boundary.test.ts
+++ b/src/shared/child-process/child-process-import-boundary.test.ts
@@ -23,14 +23,6 @@ const CHILD_PROCESS_IMPORT_ALLOWLIST: readonly string[] = readFileSync(
   .map((line) => line.trim())
   .filter((line) => line.length > 0 && !line.startsWith('#'))
 
-/**
- * The true count of files importing child_process directly.
- *
- * May only ever be DECREASED, and only by migrating a file off
- * `node:child_process`. Raising it is never the fix.
- */
-const DIRECT_IMPORTER_PIN = 152
-
 const IMPORT_PATTERN =
   /(?:from\s+['"]node:child_process['"]|from\s+['"]child_process['"]|require\(\s*['"]node:child_process['"]|require\(\s*['"]child_process['"])/
 
@@ -118,23 +110,4 @@ describe('child_process import boundary', () => {
     const stale = CHILD_PROCESS_IMPORT_ALLOWLIST.filter((path) => !offenders.includes(path))
     expect(stale, 'Allowlist entry no longer imports child_process — delete the line.').toEqual([])
   })
-
-  it('holds the offender count at the pin', () => {
-    // Bounding by the allowlist's own length proves nothing: the two move
-    // together, so a swap (one file migrated off, one new file added with its
-    // entry) kept the bound satisfied. The pin is a literal for that reason.
-    expect(
-      offenders.length,
-      `${offenders.length} files import child_process directly; the pin is ${DIRECT_IMPORTER_PIN}. ` +
-        'Never raise the pin -- migrate the file to runProcess/spawnProcess from ' +
-        'src/shared/child-process instead.'
-    ).toBeLessThanOrEqual(DIRECT_IMPORTER_PIN)
-    // A pin left above reality is how a ratchet rots: it re-opens room for the
-    // next direct import to land for free.
-    expect(
-      offenders.length,
-      `Only ${offenders.length} files import child_process directly. Lower DIRECT_IMPORTER_PIN to ` +
-        `${offenders.length} to keep the ground you just took.`
-    ).toBeGreaterThanOrEqual(DIRECT_IMPORTER_PIN)
-  })
 })
diff --git a/src/shared/child-process/windows-command-line.ts b/src/shared/child-process/windows-command-line.ts
index e3402f93c19..a7821b5a05c 100644
--- a/src/shared/child-process/windows-command-line.ts
+++ b/src/shared/child-process/windows-command-line.ts
@@ -83,6 +83,15 @@ export function quoteWindowsCmdArgument(value: string): string {
   return quoteWindows(value, true)
 }
 
+export function validateWindowsCmdArguments(values: readonly string[]): void {
+  for (const value of values) {
+    // cmd ends a command at CR/LF regardless of quoting.
+    if (/[\r\n]/.test(value)) {
+      throw new Error('cmd.exe cannot receive an argument containing a line break')
+    }
+  }
+}
+
 /**
  * Build the argv Node should spawn to run `program` with `args` through
  * `cmd.exe`, for targets cmd must interpret (`.cmd`, `.bat`).
@@ -99,19 +108,7 @@ export function quoteWindowsCmdArgument(value: string): string {
  * outer quote pair and treat the rest verbatim.
  */
 export function buildWindowsCmdShimCommandLine(program: string, args: readonly string[]): string {
-  // Why reject rather than encode: cmd's line parser ends the command at a raw
-  // CR or LF whatever the quote state, so there is no escape for it -- quoting
-  // does not survive a line break. Encoding one anyway truncates the argument
-  // and can leave the remainder to be interpreted as a further command. Agent
-  // prompts are the motivating input here and can contain newlines, so this
-  // has to fail loudly rather than silently mangle. Recognised npm/pnpm shims
-  // no longer reach this line at all — windows-cmd-shim-resolution.ts spawns
-  // their target directly, where a newline is just another character.
-  for (const value of [program, ...args]) {
-    if (/[\r\n]/.test(value)) {
-      throw new Error('cmd.exe cannot receive an argument containing a line break')
-    }
-  }
+  validateWindowsCmdArguments([program, ...args])
   // The program path needs the same treatment as the arguments: it is just as
   // likely to contain `%USERNAME%`, and cmd expands it just the same.
   const inner = [program, ...args].map(quoteWindowsCmdArgument).join(' ')
diff --git a/src/shared/child-process/windows-console-visibility.test.ts b/src/shared/child-process/windows-console-visibility.test.ts
index 8331f18892a..0f92d943d29 100644
--- a/src/shared/child-process/windows-console-visibility.test.ts
+++ b/src/shared/child-process/windows-console-visibility.test.ts
@@ -34,7 +34,7 @@ const ALLOWLIST: readonly string[] = readAllowlist(
  * the allowlist does not bound this: a swap (one file fixed and delisted, one
  * new file added with its entry) satisfies both membership assertions.
  */
-const UNHIDDEN_SPAWNER_PIN = 62
+const UNHIDDEN_SPAWNER_PIN = 61
 
 const CHILD_PROCESS_IMPORT =
   /from\s+['"](?:node:)?child_process['"]|require\(\s*['"](?:node:)?child_process['"]/
diff --git a/src/shared/cli-argument-boundary.ts b/src/shared/cli-argument-boundary.ts
index f4252c03e4a..a1d02eb8ece 100644
--- a/src/shared/cli-argument-boundary.ts
+++ b/src/shared/cli-argument-boundary.ts
@@ -9,6 +9,8 @@ export const CLI_BOOLEAN_FLAGS = new Set([
   'comments',
   'connect',
   'current',
+  'current-json',
+  'current-sqlite',
   'debug',
   'dry-run',
   'enter',
diff --git a/src/shared/closed-terminal-tab-tombstones.test.ts b/src/shared/closed-terminal-tab-tombstones.test.ts
index a2db1828ac3..b28c64d9dd9 100644
--- a/src/shared/closed-terminal-tab-tombstones.test.ts
+++ b/src/shared/closed-terminal-tab-tombstones.test.ts
@@ -2,37 +2,29 @@ import { describe, expect, it } from 'vitest'
 import {
   CLOSED_TERMINAL_TAB_TOMBSTONE_TTL_MS,
   MAX_CLOSED_TERMINAL_TAB_TOMBSTONES,
+  closedTerminalTabTombstoneSchema,
+  hasClosedTerminalTabRecord,
+  isTerminalWorkspaceEmptiedOnPurpose,
   pruneClosedTerminalTabTombstones,
   recordClosedTerminalTabTombstone,
-  reconcileClosedTerminalTabTombstones,
   type ClosedTerminalTabTombstonesByTabId
 } from './closed-terminal-tab-tombstones'
 
 const NOW = 1_800_000_000_000
 const WT = 'repo-1::/srv/app'
 
-function reconcile(
-  tombstones: ClosedTerminalTabTombstonesByTabId,
-  args: {
-    acknowledgedWorktreeIds?: string[]
-    hostKnownTabIds?: string[]
-    hostRevision?: number
-  }
-): ClosedTerminalTabTombstonesByTabId {
-  return reconcileClosedTerminalTabTombstones({
-    tombstones,
-    acknowledgedWorktreeIds: new Set(args.acknowledgedWorktreeIds ?? [WT]),
-    hostKnownTabIds: new Set(args.hostKnownTabIds ?? []),
-    hostRevision: args.hostRevision,
-    now: NOW
+describe('closed terminal tab records', () => {
+  it('records the closing worktree, reason and time', () => {
+    expect(
+      recordClosedTerminalTabTombstone({}, 'tab-1', { worktreeId: WT, reason: 'cleanup' }, NOW)
+    ).toEqual({ 'tab-1': { closedAt: NOW, worktreeId: WT, reason: 'cleanup' } })
   })
-}
 
-describe('closed terminal tab tombstones', () => {
-  it('records the closing worktree and time', () => {
-    expect(recordClosedTerminalTabTombstone({}, 'tab-1', WT, NOW)).toEqual({
-      'tab-1': { closedAt: NOW, worktreeId: WT }
-    })
+  it('treats a record past the TTL as absent, even before its partition prunes it', () => {
+    const stale = {
+      'tab-1': { closedAt: NOW - CLOSED_TERMINAL_TAB_TOMBSTONE_TTL_MS - 1, worktreeId: WT }
+    }
+    expect(hasClosedTerminalTabRecord(stale, 'tab-1', undefined, NOW)).toBe(false)
   })
 
   it('prunes past the TTL and caps at the newest entries', () => {
@@ -57,53 +49,46 @@ describe('closed terminal tab tombstones', () => {
     expect(capped['tab-0']).toBeDefined()
     expect(capped[`tab-${MAX_CLOSED_TERMINAL_TAB_TOMBSTONES + 9}`]).toBeUndefined()
   })
-})
 
-describe('closed terminal tab tombstone acknowledgement', () => {
-  const tombstones = { 'tab-1': { closedAt: NOW, worktreeId: WT } }
-
-  it('a snapshot carrying no revision acknowledges nothing', () => {
-    expect(reconcile(tombstones, { hostRevision: undefined })).toEqual(tombstones)
-  })
-
-  it('a snapshot with no row for the tombstone worktree acknowledges nothing', () => {
-    const kept = reconcile(tombstones, { acknowledgedWorktreeIds: [], hostRevision: 9 })
-    expect(kept['tab-1']).toEqual({ closedAt: NOW, worktreeId: WT })
-  })
-
-  it('the first omitting snapshot only stamps the revision — it could predate the close', () => {
-    const kept = reconcile(tombstones, { hostRevision: 4 })
-    expect(kept['tab-1']).toEqual({ closedAt: NOW, worktreeId: WT, ackRevision: 4 })
-  })
-
-  it('a strictly newer omitting snapshot retires the tombstone', () => {
-    const stamped = reconcile(tombstones, { hostRevision: 4 })
-    expect(reconcile(stamped, { hostRevision: 5 })['tab-1']).toBeUndefined()
-  })
-
-  it('a repeat of the same revision does not retire it', () => {
-    const stamped = reconcile(tombstones, { hostRevision: 4 })
-    expect(reconcile(stamped, { hostRevision: 4 })['tab-1']).toBeDefined()
-  })
-
-  it('a host that still lists the tab re-arms the watermark instead of retiring', () => {
-    const stamped = reconcile(tombstones, { hostRevision: 4 })
-    const stillListed = reconcile(stamped, { hostRevision: 7, hostKnownTabIds: ['tab-1'] })
-    expect(stillListed['tab-1']).toEqual({ closedAt: NOW, worktreeId: WT, ackRevision: 7 })
-    expect(reconcile(stillListed, { hostRevision: 7 })['tab-1']).toBeDefined()
-    expect(reconcile(stillListed, { hostRevision: 8 })['tab-1']).toBeUndefined()
-  })
-
-  it('a host revision that went backwards never retires', () => {
-    const stamped = reconcile(tombstones, { hostRevision: 40 })
-    const rewound = reconcile(stamped, { hostRevision: 1 })
-    expect(rewound['tab-1']).toEqual({ closedAt: NOW, worktreeId: WT, ackRevision: 40 })
-  })
-
-  it('a tab listed under a different worktree still counts as known to the host', () => {
-    const stamped = reconcile(tombstones, { hostRevision: 4 })
+  it('reads an older build record as a close, and an unknown reason as no reason', () => {
+    expect(closedTerminalTabTombstoneSchema.parse({ closedAt: 1, worktreeId: WT })).toEqual({
+      closedAt: 1,
+      worktreeId: WT
+    })
     expect(
-      reconcile(stamped, { hostRevision: 5, hostKnownTabIds: ['tab-1'] })['tab-1']
-    ).toBeDefined()
+      closedTerminalTabTombstoneSchema.parse({ closedAt: 1, worktreeId: WT, reason: 'later' })
+    ).toEqual({ closedAt: 1, worktreeId: WT, reason: undefined })
+  })
+})
+
+describe('emptied on purpose', () => {
+  const closed: ClosedTerminalTabTombstonesByTabId = { 'tab-1': { closedAt: NOW, worktreeId: WT } }
+
+  it('an empty row with a close record in that workspace was emptied on purpose', () => {
+    expect(
+      isTerminalWorkspaceEmptiedOnPurpose(
+        { tabsByWorktree: { [WT]: [] }, closedTerminalTabTombstonesByTabId: closed },
+        WT
+      )
+    ).toBe(true)
+  })
+
+  it('an empty row with no record is unknown, as is a missing row', () => {
+    expect(isTerminalWorkspaceEmptiedOnPurpose({ tabsByWorktree: { [WT]: [] } }, WT)).toBe(false)
+    expect(
+      isTerminalWorkspaceEmptiedOnPurpose(
+        { tabsByWorktree: {}, closedTerminalTabTombstonesByTabId: closed },
+        WT
+      )
+    ).toBe(false)
+  })
+
+  it('a record for another workspace does not count', () => {
+    expect(
+      isTerminalWorkspaceEmptiedOnPurpose(
+        { tabsByWorktree: { other: [] }, closedTerminalTabTombstonesByTabId: closed },
+        'other'
+      )
+    ).toBe(false)
   })
 })
diff --git a/src/shared/closed-terminal-tab-tombstones.ts b/src/shared/closed-terminal-tab-tombstones.ts
index 3db0a585987..80653b70030 100644
--- a/src/shared/closed-terminal-tab-tombstones.ts
+++ b/src/shared/closed-terminal-tab-tombstones.ts
@@ -1,18 +1,24 @@
 import { z } from 'zod'
+import type { RuntimeSessionTabCloseReason } from './runtime-session-contracts'
 
-/** A client's own record that the user closed a terminal tab.
+const TERMINAL_TAB_CLOSE_REASONS = [
+  'user',
+  'cleanup',
+  'pty-exit'
+] as const satisfies readonly RuntimeSessionTabCloseReason[]
+
+/** Main's record that a terminal tab was closed, written by its close transaction only.
  *
- *  Why it must exist: absence alone cannot distinguish "the host was never told" from "the user
- *  closed it", so the merge keeps the tab — and a `pty.kill` that died on the transport means the
- *  host keeps listing it forever. This is the close signal that outlives the failed RPC.
- *  Safe because tab ids are uuids: a tombstoned id never legitimately returns. */
+ *  Why it must exist: absence alone cannot distinguish "never told" from "closed", so without it a
+ *  host snapshot or a late spawn commit brings the tab back, and an emptied workspace reads as one
+ *  that was never initialized. Safe because tab ids are uuids: a closed id never legitimately
+ *  returns. Nothing acknowledges it away; it dies by TTL, the per-host cap, or when its workspace's
+ *  session rows are removed. */
 export type ClosedTerminalTabTombstone = {
   closedAt: number
   worktreeId: string
-  /** Newest host revision seen for this tab's scope since the close. Retirement needs a STRICTLY
-   *  newer snapshot that omits the tab, so a pull already in flight when the user closed cannot
-   *  acknowledge a close it predates. */
-  ackRevision?: number
+  /** Absent on records an older build wrote, when only user closes were recorded. */
+  reason?: RuntimeSessionTabCloseReason
 }
 
 export type ClosedTerminalTabTombstonesByTabId = Record<string, ClosedTerminalTabTombstone>
@@ -22,11 +28,12 @@ export type ClosedTerminalTabTombstonesByTabId = Record<string, ClosedTerminalTa
 export const closedTerminalTabTombstoneSchema = z.object({
   closedAt: z.number().int().nonnegative(),
   worktreeId: z.string().min(1),
-  ackRevision: z.number().int().nonnegative().optional()
+  // Why catch: a reason a newer build adds must not cost this build the record itself.
+  reason: z.enum(TERMINAL_TAB_CLOSE_REASONS).optional().catch(undefined)
 })
 
-/** Backstops only — host acknowledgement is the normal exit. These cover a target the user never
- *  reconnects to, whose tombstones would otherwise never be retired. */
+/** Bounds on one host partition's map: pruned per partition, so one host's churn cannot evict
+ *  another host's records. */
 export const CLOSED_TERMINAL_TAB_TOMBSTONE_TTL_MS = 30 * 24 * 60 * 60 * 1000
 export const MAX_CLOSED_TERMINAL_TAB_TOMBSTONES = 500
 
@@ -44,61 +51,49 @@ export function pruneClosedTerminalTabTombstones(
 export function recordClosedTerminalTabTombstone(
   map: ClosedTerminalTabTombstonesByTabId | undefined,
   tabId: string,
-  worktreeId: string,
+  record: Omit<ClosedTerminalTabTombstone, 'closedAt'>,
   now: number
 ): ClosedTerminalTabTombstonesByTabId {
-  return pruneClosedTerminalTabTombstones({ ...map, [tabId]: { closedAt: now, worktreeId } }, now)
+  return pruneClosedTerminalTabTombstones({ ...map, [tabId]: { ...record, closedAt: now } }, now)
 }
 
-function maxAckRevision(a: number | undefined, b: number | undefined): number | undefined {
-  if (a === undefined) {
-    return b
-  }
-  return b === undefined ? a : Math.max(a, b)
+/** Whether a tab id was closed within the TTL, by the record's own worktree. The TTL is checked
+ *  here because pruning only runs when the partition next records a close. Object.hasOwn because
+ *  the map is a plain object: `in` answers true for every Object.prototype key. */
+export function hasClosedTerminalTabRecord(
+  map: ClosedTerminalTabTombstonesByTabId | undefined,
+  tabId: string,
+  worktreeId?: string,
+  now = Date.now()
+): boolean {
+  const record = map !== undefined && Object.hasOwn(map, tabId) ? map[tabId] : undefined
+  return (
+    record !== undefined &&
+    now - record.closedAt <= CLOSED_TERMINAL_TAB_TOMBSTONE_TTL_MS &&
+    (worktreeId === undefined || record.worktreeId === worktreeId)
+  )
 }
 
-export type ClosedTerminalTabTombstoneAck = {
-  tombstones: ClosedTerminalTabTombstonesByTabId | undefined
-  /** Worktrees this snapshot actually carries a tab row for. A worktree the snapshot says nothing
-   *  about — including one whose path never resolved to a local id — is not evidence of anything,
-   *  so its tombstones are left untouched. */
-  acknowledgedWorktreeIds: ReadonlySet<string>
-  /** Every tab id the snapshot lists, across all worktrees: an id the host still carries anywhere
-   *  has not been acknowledged, whichever worktree it now sits under. */
-  hostKnownTabIds: ReadonlySet<string>
-  hostRevision: number | undefined
-  now: number
-}
-
-/** Retires tombstones the host has demonstrably seen, and stamps the rest with the revision that
- *  proved it had not yet.
- *
- *  Retirement takes a snapshot that both covers the tombstone's worktree and is strictly newer than
- *  the last one that did — one snapshot alone can be the pull that was already in flight when the
- *  user closed. Absence never deletes here: a snapshot with no revision, or one carrying no row for
- *  the worktree, retires nothing. */
-export function reconcileClosedTerminalTabTombstones({
-  tombstones,
-  acknowledgedWorktreeIds,
-  hostKnownTabIds,
-  hostRevision,
-  now
-}: ClosedTerminalTabTombstoneAck): ClosedTerminalTabTombstonesByTabId {
-  const pruned = pruneClosedTerminalTabTombstones(tombstones, now)
-  if (hostRevision === undefined) {
-    return pruned
-  }
-  const kept: ClosedTerminalTabTombstonesByTabId = {}
-  for (const [tabId, tombstone] of Object.entries(pruned)) {
-    if (!acknowledgedWorktreeIds.has(tombstone.worktreeId)) {
-      kept[tabId] = tombstone
-      continue
-    }
-    const observed = tombstone.ackRevision
-    if (!hostKnownTabIds.has(tabId) && observed !== undefined && hostRevision > observed) {
-      continue
-    }
-    kept[tabId] = { ...tombstone, ackRevision: maxAckRevision(observed, hostRevision) }
-  }
-  return kept
+/** Emptied on purpose: the workspace's terminal row exists, is empty, and some tab in it was
+ *  closed within the TTL. An empty row with no live record is unknown (legacy data, an expired
+ *  record, or a writer that is not a close), so it reads as never initialized. Any record
+ *  suffices, which is weaker than "the last removal was a close" until every membership shrink is
+ *  a close. */
+export function isTerminalWorkspaceEmptiedOnPurpose(
+  state: {
+    tabsByWorktree: Readonly<Record<string, readonly unknown[] | undefined>>
+    closedTerminalTabTombstonesByTabId?: ClosedTerminalTabTombstonesByTabId
+  },
+  worktreeId: string,
+  now = Date.now()
+): boolean {
+  return (
+    Object.hasOwn(state.tabsByWorktree, worktreeId) &&
+    (state.tabsByWorktree[worktreeId]?.length ?? 0) === 0 &&
+    Object.values(state.closedTerminalTabTombstonesByTabId ?? {}).some(
+      (record) =>
+        record.worktreeId === worktreeId &&
+        now - record.closedAt <= CLOSED_TERMINAL_TAB_TOMBSTONE_TTL_MS
+    )
+  )
 }
diff --git a/src/shared/codebuddy-agent.test.ts b/src/shared/codebuddy-agent.test.ts
new file mode 100644
index 00000000000..6915cf8d573
--- /dev/null
+++ b/src/shared/codebuddy-agent.test.ts
@@ -0,0 +1,67 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { createHookListenerState } from './agent-hook-listener/listener-state'
+import { normalizeAndAccept } from './agent-hook-listener-test-harness'
+import { recognizeAgentProcessFromCommandLine } from './agent-process-recognition'
+import { getAgentSessionOptionCatalog } from './agent-session-option-catalog'
+import { getAgentResumeArgv } from './agent-session-resume'
+
+describe('CodeBuddy harness', () => {
+  it('replays the live question lifecycle without settling at late SessionStart', () => {
+    const state = createHookListenerState()
+    const events = readFileSync(
+      join(__dirname, '__fixtures__/codebuddy-question-hooks.jsonl'),
+      'utf8'
+    )
+      .trim()
+      .split('\n')
+      .map((line) => JSON.parse(line))
+    const rows = events.map((event) => normalizeAndAccept(state, 'codebuddy', event))
+    expect(rows.map((row) => row?.payload.state ?? null)).toEqual([
+      'working',
+      null,
+      'waiting',
+      'working',
+      'working',
+      'done'
+    ])
+    expect(rows[2]?.payload).toMatchObject({ agentType: 'codebuddy', toolName: 'AskUserQuestion' })
+    expect(rows[5]?.payload).toMatchObject({ agentType: 'codebuddy', lastAssistantMessage: 'Red' })
+    expect(rows[5]?.providerSession?.id).toBe('codebuddy-verification')
+  })
+
+  it.each([
+    'codebuddy',
+    'cbc',
+    'C:\\Tools\\codebuddy.cmd',
+    'node /usr/lib/node_modules/@tencent-ai/codebuddy-code/dist/codebuddy.js'
+  ])('recognizes interactive %s', (command) => {
+    expect(recognizeAgentProcessFromCommandLine(command)?.agent).toBe('codebuddy')
+  })
+
+  it('excludes print runs and resumes the original provider session', () => {
+    for (const flag of ['--print', '--serve', '--acp', '--bg', '--background']) {
+      expect(recognizeAgentProcessFromCommandLine(`codebuddy ${flag}`)).toBeNull()
+    }
+    expect(recognizeAgentProcessFromCommandLine('codebuddy -- --serve')?.agent).toBe('codebuddy')
+    expect(getAgentResumeArgv('codebuddy', { key: 'session_id', id: 'session-1' })).toEqual([
+      'codebuddy',
+      '--resume',
+      'session-1'
+    ])
+  })
+
+  it('passes explicit model and effort preferences through the CLI flags', () => {
+    const catalog = getAgentSessionOptionCatalog('codebuddy')
+    expect(catalog?.modelApply.launchArgs?.('fast-model')).toEqual(['--model', 'fast-model'])
+    expect(catalog?.unknownModelOptions?.[0].apply.launchArgs?.('high')).toEqual([
+      '--effort',
+      'high'
+    ])
+    expect(catalog?.modelApply.removeAgentArgs?.(['--model', 'old', '--', 'prompt'])).toEqual([
+      '--',
+      'prompt'
+    ])
+  })
+})
diff --git a/src/shared/codebuddy-headless-command.ts b/src/shared/codebuddy-headless-command.ts
new file mode 100644
index 00000000000..5c632b27b3b
--- /dev/null
+++ b/src/shared/codebuddy-headless-command.ts
@@ -0,0 +1,13 @@
+import { agentArgOptionTokens } from './agent-session-option-agent-args'
+import { isPrintModeHeadlessOneShotCommand, optionName } from './print-mode-headless-command'
+
+const NON_INTERACTIVE_FLAGS = new Set(['--serve', '--acp', '--bg', '--background'])
+
+export function isCodebuddyNonInteractiveCommand(tokens: readonly string[]): boolean {
+  return (
+    isPrintModeHeadlessOneShotCommand(tokens) ||
+    agentArgOptionTokens(tokens)
+      .slice(1)
+      .some((token) => NON_INTERACTIVE_FLAGS.has(optionName(token)))
+  )
+}
diff --git a/src/shared/command-environment.test.ts b/src/shared/command-environment.test.ts
new file mode 100644
index 00000000000..91241a36c0f
--- /dev/null
+++ b/src/shared/command-environment.test.ts
@@ -0,0 +1,90 @@
+import { describe, expect, it } from 'vitest'
+import { extractLeadingEnvAssignments, mergeCommandEnvironment } from './command-environment'
+import { planAgentBinary, planCommitMessageGeneration } from './commit-message-plan'
+import { planCustomCommand } from './commit-message-prompt'
+
+describe('command environment assignments', () => {
+  it('parses only leading valid names and retains literal values', () => {
+    expect(extractLeadingEnvAssignments(['A=x=y', '_EMPTY=', 'agent', 'B=later'])).toEqual({
+      env: { A: 'x=y', _EMPTY: '' },
+      rest: ['agent', 'B=later']
+    })
+    for (const name of ['1BAD=x', 'BAD-NAME=x', '=empty']) {
+      expect(extractLeadingEnvAssignments([name, 'agent'])).toEqual({ rest: [name, 'agent'] })
+    }
+  })
+
+  it('uses the real binary for presets and custom commands without expanding expressions', () => {
+    expect(planAgentBinary('claude', 'FLAG=1 npx claude')).toEqual({
+      ok: true,
+      binary: 'npx',
+      prefixArgs: ['claude'],
+      env: { FLAG: '1' }
+    })
+    expect(
+      planCustomCommand('VALUE="a b=$HOME;$(echo unsafe)" agent KEY=arg {prompt}', 'hello')
+    ).toEqual({
+      ok: true,
+      binary: 'agent',
+      args: ['KEY=arg', 'hello'],
+      stdinPayload: null,
+      env: { VALUE: 'a b=$HOME;$(echo unsafe)' }
+    })
+    expect(
+      planCommitMessageGeneration(
+        { agentId: 'claude', model: 'sonnet', agentCommandOverride: 'FLAG=1 claude' },
+        'hello'
+      )
+    ).toMatchObject({ ok: true, plan: { binary: 'claude', env: { FLAG: '1' } } })
+  })
+
+  it('rejects assignment-only commands and preserves no-prefix plans', () => {
+    expect(planAgentBinary('claude', 'ONLY=env')).toMatchObject({ ok: false })
+    expect(planCustomCommand('ONLY=env', 'prompt')).toMatchObject({ ok: false })
+    expect(planCustomCommand('agent', 'prompt')).toEqual({
+      ok: true,
+      binary: 'agent',
+      args: [],
+      stdinPayload: 'prompt'
+    })
+  })
+
+  it('keeps Windows paths and empty or prototype-named values intact', () => {
+    const result = planCustomCommand(
+      'DIR="C:\\my dir" __proto__=data "C:\\bin\\agent.exe"',
+      'prompt',
+      'literal'
+    )
+    expect(result).toMatchObject({
+      ok: true,
+      binary: 'C:\\bin\\agent.exe',
+      env: { DIR: 'C:\\my dir' }
+    })
+    if (result.ok) {
+      expect(Object.getOwnPropertyDescriptor(result.env, '__proto__')?.value).toBe('data')
+    }
+  })
+
+  it('lets the last assignment override every Windows spelling without mutating the base', () => {
+    const base = { PATH: 'old', Path: 'also old', TOKEN: 'old', KEEP: 'keep', ComSpec: 'cmd.exe' }
+    const { env } = extractLeadingEnvAssignments([
+      'Path=first',
+      'PATH=second',
+      'Path=last',
+      'token=',
+      'agent'
+    ])
+    expect(mergeCommandEnvironment(base, env, 'win32')).toEqual({
+      PATH: 'last',
+      TOKEN: '',
+      KEEP: 'keep',
+      COMSPEC: 'cmd.exe'
+    })
+    expect(base.PATH).toBe('old')
+    expect(mergeCommandEnvironment({ PATH: 'old' }, { Path: 'new' }, 'linux')).toEqual({
+      PATH: 'old',
+      Path: 'new'
+    })
+    expect(mergeCommandEnvironment(undefined, undefined, 'darwin')).toBeUndefined()
+  })
+})
diff --git a/src/shared/command-environment.ts b/src/shared/command-environment.ts
new file mode 100644
index 00000000000..971e0fc61b9
--- /dev/null
+++ b/src/shared/command-environment.ts
@@ -0,0 +1,38 @@
+/** Leading assignments are data, never shell expressions. */
+export function extractLeadingEnvAssignments(tokens: string[]): {
+  env?: Record<string, string>
+  rest: string[]
+} {
+  const assignments = new Map<string, string>()
+  let index = 0
+  for (const token of tokens) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)) {
+      break
+    }
+    const equals = token.indexOf('=')
+    const name = token.slice(0, equals)
+    // Preserve last-assignment order when Windows folds differently cased names.
+    assignments.delete(name)
+    assignments.set(name, token.slice(equals + 1))
+    index++
+  }
+  return {
+    ...(assignments.size ? { env: Object.fromEntries(assignments) } : {}),
+    rest: tokens.slice(index)
+  }
+}
+
+export function mergeCommandEnvironment(
+  base: Record<string, string | undefined> | undefined,
+  overrides: Record<string, string> | undefined,
+  platform: NodeJS.Platform
+): Record<string, string | undefined> | undefined {
+  if (!overrides) {
+    return base
+  }
+  const entries = [...Object.entries(base ?? process.env), ...Object.entries(overrides)]
+  // Windows keys share one spelling so guards cannot retain differently cased aliases.
+  return Object.fromEntries(
+    platform === 'win32' ? entries.map(([key, value]) => [key.toUpperCase(), value]) : entries
+  )
+}
diff --git a/src/shared/commit-message-agent-spec.test.ts b/src/shared/commit-message-agent-spec.test.ts
index fee9a9f1046..2a6ad8c3b7c 100644
--- a/src/shared/commit-message-agent-spec.test.ts
+++ b/src/shared/commit-message-agent-spec.test.ts
@@ -36,6 +36,7 @@ describe('COMMIT_MESSAGE_AGENT_SPECS', () => {
       'codex',
       'copilot',
       'cursor',
+      'dsh',
       'kimi',
       'muse',
       'omp',
diff --git a/src/shared/commit-message-agent-specs-secondary.ts b/src/shared/commit-message-agent-specs-secondary.ts
index 80dfe37212f..0ad5086bec7 100644
--- a/src/shared/commit-message-agent-specs-secondary.ts
+++ b/src/shared/commit-message-agent-specs-secondary.ts
@@ -137,6 +137,27 @@ export function buildSecondaryCommitMessageAgentSpecs({
       models: [{ id: 'default', label: 'Config default' }],
       defaultModelId: 'default'
     },
+    dsh: {
+      id: 'dsh',
+      label: 'DeepSeek Harness',
+      binary: 'dsh',
+      // Why: `dsh --profile headless` runs one fresh persisted session, prints the final
+      // answer and exits — the documented one-shot entry mode. The interactive `dsh-tui`
+      // profile is deliberately not used here; Source Control AI stays one-shot.
+      // Why stdin and not argv: the prompt carries the whole diff. On argv it would sit in
+      // the process table for every user on the box, and it would eventually hit the argv
+      // limit. `-` is DSH's explicit stdin marker; measured against 0.1.5-rc.1, omitting the
+      // positional entirely is rejected ("a task is required") even when stdin is a pipe.
+      promptDelivery: 'stdin',
+      buildArgs: () => ['--profile', 'headless', '-'],
+      // Why: the launcher owns `--profile`; a second one would boot a different profile.
+      singletonOptions: [['--profile']],
+      modelSource: 'static',
+      // Why: the headless app parses no `--model`. The model comes from the profile's
+      // `llm-deepseek` row, so the only honest choice here is the configured default.
+      models: [{ id: 'default', label: 'Config default' }],
+      defaultModelId: 'default'
+    },
     copilot: {
       id: 'copilot',
       label: 'GitHub Copilot',
diff --git a/src/shared/commit-message-plan.ts b/src/shared/commit-message-plan.ts
index 83760f00ae1..1d0bf1e02de 100644
--- a/src/shared/commit-message-plan.ts
+++ b/src/shared/commit-message-plan.ts
@@ -1,3 +1,5 @@
+import { planAgentBinary } from './agent-command-plan'
+export { planAgentBinary } from './agent-command-plan'
 import type { CommandTemplateBackslash } from './commit-message-prompt'
 import {
   getCommitMessageAgentSpec,
@@ -33,33 +35,14 @@ export type CommitMessagePlan = {
   stdinPayload: string | null
   /** Human-readable label used in error prefixes (e.g. "Claude failed: ..."). */
   label: string
+  /** Leading command assignments, applied on the execution host. */
+  env?: Record<string, string>
 }
 
 export type CommitMessagePlanResult =
   | { ok: true; plan: CommitMessagePlan }
   | { ok: false; error: string }
 
-export function planAgentBinary(
-  defaultBinary: string,
-  commandOverride: string | undefined,
-  backslash: CommandTemplateBackslash = 'escape'
-): { ok: true; binary: string; prefixArgs: string[] } | { ok: false; error: string } {
-  const command = commandOverride?.trim()
-  if (!command) {
-    return { ok: true, binary: defaultBinary, prefixArgs: [] }
-  }
-
-  const tokenized = tokenizeCustomCommandTemplate(command, backslash)
-  if (!tokenized.ok) {
-    return { ok: false, error: `Agent command override is invalid: ${tokenized.error}` }
-  }
-  const [binary, ...prefixArgs] = tokenized.tokens
-  if (!binary) {
-    return { ok: false, error: 'Agent command override must start with a binary name.' }
-  }
-  return { ok: true, binary, prefixArgs }
-}
-
 function planAdditionalAgentArgs(
   agentArgs: string | null | undefined,
   backslash: CommandTemplateBackslash = 'escape'
@@ -267,7 +250,8 @@ export function planCommitMessageGeneration(
         stdinPayload: planned.stdinPayload,
         // Why: a custom command has no friendly name, so the binary doubles
         // as the label in error prefixes ("ollama failed: ...").
-        label: planned.binary
+        label: planned.binary,
+        ...(planned.env ? { env: planned.env } : {})
       }
     }
   }
@@ -329,7 +313,8 @@ export function planCommitMessageGeneration(
       binary: command.binary,
       args: [...merged.prefixArgs, ...args],
       stdinPayload: spec.promptDelivery === 'stdin' ? prompt : null,
-      label: spec.label
+      label: spec.label,
+      ...(command.env ? { env: command.env } : {})
     }
   }
 }
diff --git a/src/shared/commit-message-prompt.ts b/src/shared/commit-message-prompt.ts
index 7fb9da76d66..ecf4cb39069 100644
--- a/src/shared/commit-message-prompt.ts
+++ b/src/shared/commit-message-prompt.ts
@@ -1,3 +1,4 @@
+import { extractLeadingEnvAssignments } from './command-environment'
 // Why: keeping the base prompt and assembly here (in shared) lets both the
 // renderer (preview/tests) and main (actual generation) reach the exact same
 // string without duplicating the wording.
@@ -265,7 +266,13 @@ export function tokenizeCustomCommandTemplate(
 }
 
 export type CustomCommandPlan =
-  | { ok: true; binary: string; args: string[]; stdinPayload: string | null }
+  | {
+      ok: true
+      binary: string
+      args: string[]
+      stdinPayload: string | null
+      env?: Record<string, string>
+    }
   | { ok: false; error: string }
 
 /**
@@ -289,7 +296,8 @@ export function planCustomCommand(
   if (tokenized.tokens.length === 0) {
     return { ok: false, error: 'Custom command is empty.' }
   }
-  const [binary, ...rest] = tokenized.tokens
+  const { env, rest: commandTokens } = extractLeadingEnvAssignments(tokenized.tokens)
+  const [binary, ...rest] = commandTokens
   if (!binary) {
     return { ok: false, error: 'Custom command must start with a binary name.' }
   }
@@ -298,14 +306,15 @@ export function planCustomCommand(
     token.includes(CUSTOM_PROMPT_PLACEHOLDER)
       ? token.split(CUSTOM_PROMPT_PLACEHOLDER).join(prompt)
       : token
-  const usesPlaceholder = tokenized.tokens.some((t) => t.includes(CUSTOM_PROMPT_PLACEHOLDER))
+  const usesPlaceholder = commandTokens.some((t) => t.includes(CUSTOM_PROMPT_PLACEHOLDER))
   if (usesPlaceholder) {
     return {
       ok: true,
       binary: substitute(binary),
       args: rest.map(substitute),
-      stdinPayload: null
+      stdinPayload: null,
+      ...(env ? { env } : {})
     }
   }
-  return { ok: true, binary, args: rest, stdinPayload: prompt }
+  return { ok: true, binary, args: rest, stdinPayload: prompt, ...(env ? { env } : {}) }
 }
diff --git a/src/shared/constants.test.ts b/src/shared/constants.test.ts
index be50ca8464c..664ad7dc313 100644
--- a/src/shared/constants.test.ts
+++ b/src/shared/constants.test.ts
@@ -1,11 +1,10 @@
 import { describe, expect, it } from 'vitest'
+import { DEFAULT_TERMINAL_INACTIVE_PANE_OPACITY, getDefaultSettings } from './constants'
+import { getDefaultNotificationSettings } from './notification-settings-defaults'
 import {
-  DEFAULT_TERMINAL_INACTIVE_PANE_OPACITY,
-  getDefaultNotificationSettings,
   getDefaultPrimarySelectionMiddleClickPaste,
-  getDefaultTerminalRightClickToPaste,
-  getDefaultSettings
-} from './constants'
+  getDefaultTerminalRightClickToPaste
+} from './terminal-platform-defaults'
 
 describe('getDefaultSettings', () => {
   it('uses platform-consistent separators for the default workspace directory', () => {
diff --git a/src/shared/constants.ts b/src/shared/constants.ts
index aa919cdec38..f26fe093676 100644
--- a/src/shared/constants.ts
+++ b/src/shared/constants.ts
@@ -1,6 +1,4 @@
 import type { GlobalSettings } from './global-settings-types'
-import type { NotificationSettings } from './notification-settings-types'
-import type { OnboardingChecklistState, OnboardingState } from './onboarding-state-types'
 import type { RepoHookSettings } from './orca-yaml-hook-types'
 import type { PersistedState } from './persisted-state-types'
 import type { PersistedUIState } from './persisted-ui-state-types'
@@ -17,6 +15,13 @@ import { DEFAULT_STATUS_BAR_USAGE_MODE } from './status-bar-usage-mode'
 import { buildDefaultSettings } from './default-global-settings'
 import { DEFAULT_SETUP_AGENT_STARTUP_POLICY } from './setup-agent-startup-policy'
 import { DEFAULT_BROWSER_PAGE_ZOOM_LEVEL } from './browser-page-zoom'
+import { getDefaultNotificationSettings } from './notification-settings-defaults'
+import { getDefaultOnboardingState } from './onboarding-defaults'
+import {
+  defaultTerminalFontFamily,
+  getDefaultPrimarySelectionMiddleClickPaste,
+  getDefaultTerminalRightClickToPaste
+} from './terminal-platform-defaults'
 
 export { DEFAULT_STATUS_BAR_ITEMS } from './status-bar-defaults'
 export {
@@ -40,10 +45,6 @@ export function normalizeAgentActivityDisplayMode(value: unknown): AgentActivity
   return value === 'full' || value === 'compact' ? value : DEFAULT_AGENT_ACTIVITY_DISPLAY_MODE
 }
 
-// Why: onboarding wizard's last step index, centralized so backfill, clamps, and UI agree on the bound.
-export const ONBOARDING_FINAL_STEP = 5
-export const ONBOARDING_FLOW_VERSION = 4
-
 export const ORCA_BROWSER_PARTITION = 'persist:orca-browser'
 // Why: inert blank-tab URL shared by main/renderer so the attach policy can allow just this one data URL and reject others.
 export const ORCA_BROWSER_BLANK_URL = 'data:text/html,'
@@ -64,26 +65,6 @@ export const BROWSER_FAMILY_LABELS: Record<string, string> = {
   manual: 'File'
 }
 
-// Why: only the initial value shown in Settings; buildFontFamily() adds the real cross-platform fallback chain.
-function defaultTerminalFontFamily(): string {
-  const platform = typeof process !== 'undefined' ? process.platform : ''
-  if (platform === 'win32') {
-    return 'Cascadia Mono'
-  }
-  if (platform === 'linux') {
-    return 'DejaVu Sans Mono'
-  }
-  return 'SF Mono' // macOS default
-}
-
-export const getDefaultPrimarySelectionMiddleClickPaste = (
-  platform = typeof process !== 'undefined' ? process.platform : ''
-): boolean => platform === 'linux' || platform === 'darwin'
-
-export const getDefaultTerminalRightClickToPaste = (
-  platform = typeof process !== 'undefined' ? process.platform : ''
-): boolean => platform === 'win32'
-
 /** Why: ProseMirror renders the whole document without virtualization. After the
  *  parser/highlighter work in #17134/#17147/#17158, M-series Electron measurements
  *  on distinct code blocks every ~600 bytes put visible mount / longest task at
@@ -118,41 +99,6 @@ export const REPO_COLORS = [
 
 export const DEFAULT_REPO_BADGE_COLOR = REPO_COLORS[0]
 
-export function getDefaultNotificationSettings(): NotificationSettings {
-  return {
-    enabled: true,
-    agentTaskComplete: true,
-    terminalBell: false,
-    suppressWhenFocused: true,
-    customSoundId: 'system',
-    customSoundPath: null,
-    customSoundVolume: 100
-  }
-}
-
-export function getDefaultOnboardingState(): OnboardingState {
-  return {
-    flowVersion: ONBOARDING_FLOW_VERSION,
-    closedAt: null,
-    outcome: null,
-    lastCompletedStep: -1,
-    checklist: {
-      addedRepo: false,
-      choseAgent: false,
-      ranFirstAgent: false,
-      ranSecondAgentOnSameTask: false,
-      triedCmdJ: false,
-      shapedSidebar: false,
-      reviewedDiff: false,
-      openedPr: false,
-      addedFolder: false,
-      openedFile: false,
-      ranAgentOnFile: false,
-      dismissed: false
-    } satisfies OnboardingChecklistState
-  }
-}
-
 /** The stock worktree root. Exported so callers can tell an untouched default apart
  *  from a workspace directory the user actually chose. */
 export function getDefaultWorkspaceDir(homeDir: string): string {
@@ -240,6 +186,7 @@ export function getDefaultPersistedState(homedir: string): PersistedState {
   }
 }
 
+/** Creates fresh UI defaults with completed migration markers so new profiles are not treated as legacy installations. */
 export function getDefaultUIState(): PersistedUIState {
   return {
     lastActiveRepoId: null,
@@ -269,6 +216,8 @@ export function getDefaultUIState(): PersistedUIState {
     hideDetachedHeadWorkspaces: false,
     hideWorkspacesFromOtherDevices: false,
     alwaysShowDefaultBranchWorkspace: true,
+    _explorerDisplayRootMigrated: true,
+    explorerDisplayRootByWorktree: {},
     showDotfilesByWorktree: {},
     filterRepoIds: [],
     agentsVisibleHostIds: null,
diff --git a/src/shared/cross-platform-path-guards.test.ts b/src/shared/cross-platform-path-guards.test.ts
index cf6c729b89b..aec52a1f676 100644
--- a/src/shared/cross-platform-path-guards.test.ts
+++ b/src/shared/cross-platform-path-guards.test.ts
@@ -293,12 +293,6 @@ describe('no-op regex passes stay skipped', () => {
  * this is the price. Keep the raw-candidate entry point the plain `relativePathInsideRoot` call.
  */
 describe('cross-platform-path exposes a single root-bound factory', () => {
-  it('has no raw-candidate sibling to the normalized matcher', () => {
-    expect(Object.keys(guarded).filter((name) => name.startsWith('create'))).toEqual([
-      'createNormalizedPathInsideOrEqualMatcher'
-    ])
-  })
-
   it('shows what mixing the two contracts would cost', () => {
     const root = '//wsl.localhost/Ubuntu/Repo'
     const candidate = '//wsl.localhost/Ubuntu/Repo/src/App.tsx'
diff --git a/src/shared/cursor-usage-buckets.ts b/src/shared/cursor-usage-buckets.ts
new file mode 100644
index 00000000000..a7b834f5f53
--- /dev/null
+++ b/src/shared/cursor-usage-buckets.ts
@@ -0,0 +1,18 @@
+/**
+ * Cursor bills individual plans from two pools that both reset with the monthly
+ * billing cycle, plus optional on-demand spend once the pools run out.
+ * https://cursor.com/docs/account/pricing
+ */
+export const CURSOR_MODELS_BUCKET_NAME = 'Cursor Models'
+export const CURSOR_OTHER_MODELS_BUCKET_NAME = 'Other Models'
+export const CURSOR_ON_DEMAND_BUCKET_NAME = 'On-demand'
+
+export const CURSOR_USAGE_BUCKET_NAMES = [
+  CURSOR_MODELS_BUCKET_NAME,
+  CURSOR_OTHER_MODELS_BUCKET_NAME,
+  CURSOR_ON_DEMAND_BUCKET_NAME
+] as const
+
+export function isCursorUsageBucket(name: string): boolean {
+  return CURSOR_USAGE_BUCKET_NAMES.some((bucket) => bucket === name)
+}
diff --git a/src/shared/default-global-settings.ts b/src/shared/default-global-settings.ts
index 2fd16df1c4f..33deed6de9c 100644
--- a/src/shared/default-global-settings.ts
+++ b/src/shared/default-global-settings.ts
@@ -220,6 +220,7 @@ export function buildDefaultSettings(args: {
     agentDefaultEnv: { ...DEFAULT_TUI_AGENT_ENV },
     agentYoloDefaultsMigrated: true,
     agentStatusHooksEnabled: true,
+    agentWorkspaceTrustEnabled: true,
     tabAutoGenerateTitle: false,
     confirmClosePinnedTab: true,
     editorPreviewTabsEnabled: true,
diff --git a/src/shared/draft-paste-ready-scanner.ts b/src/shared/draft-paste-ready-scanner.ts
index 1e586031a4e..f7a9cb7c0c5 100644
--- a/src/shared/draft-paste-ready-scanner.ts
+++ b/src/shared/draft-paste-ready-scanner.ts
@@ -67,6 +67,16 @@ const DRAFT_PASTE_READY_SIGNALS: Record<DraftPasteReadySignal, DraftPasteReadySi
     // the main-process caller drops the draft when readiness never resolves.
     quietAnchor: DECSET_BRACKETED_PASTE
   },
+  // Why: DSH-TUI draws the same U+276F composer glyph inside the alternate screen, and
+  // animates its intro continuously behind it, so it needs grok's marker-plus-quiet shape
+  // rather than the default quiet window. Its own entry (not grok's) so the two agents'
+  // evidence — and any future divergence — stay separable.
+  'dsh-composer-prompt': {
+    markerAnchor: DECSET_ALT_SCREEN,
+    markerAnchorEnd: DECRST_ALT_SCREEN,
+    marker: GROK_COMPOSER_PROMPT,
+    quietAnchor: DECSET_BRACKETED_PASTE
+  },
   'zcode-composer-prompt': {
     markerAnchor: DECSET_ALT_SCREEN,
     markerAnchorEnd: DECRST_ALT_SCREEN,
@@ -126,6 +136,10 @@ export type DraftPasteReadyScanResult = {
  *     that keeps those launches on the pre-existing delivery path. The alt-screen
  *     anchor is revoked on `\x1b[?1049l`: leaving it hands the terminal back to
  *     the shell, so a glyph after that is the shell's prompt, not grok's composer.
+ *   - `dsh-composer-prompt`: the grok shape applied to DSH-TUI, whose composer draws the
+ *     same `❯` inside the alternate screen. The committed
+ *     `dsh-tui-ready-no-key.txt` transcript is the evidence: DECSET 2004 at byte 6,
+ *     `\x1b[?1049h` at byte 40, and the first `❯` at byte 5910.
  *   - `zcode-composer-prompt`: ready when ZCode's composer box corner (`╭`) renders
  *     after the alternate-screen switch. ZCode repaints its animated ASCII banner
  *     indefinitely — the captured transcript is still repainting 30s after the composer
diff --git a/src/shared/dsh-launch-command.test.ts b/src/shared/dsh-launch-command.test.ts
new file mode 100644
index 00000000000..6585318cc98
--- /dev/null
+++ b/src/shared/dsh-launch-command.test.ts
@@ -0,0 +1,91 @@
+import { describe, expect, it } from 'vitest'
+import { isDshNonInteractiveCommand } from './dsh-launch-command'
+import { recognizeAgentProcessFromCommandLine } from './agent-process-recognition'
+
+function tokens(commandLine: string): string[] {
+  return commandLine.split(' ')
+}
+
+describe('isDshNonInteractiveCommand', () => {
+  it.each([
+    'dsh web',
+    'dsh --profile web',
+    'dsh --profile=web --port 8080',
+    'dsh --profile headless "run the tests"',
+    'dsh --profile sdk',
+    'dsh --profile sdk-minimal',
+    'dsh --profile acp',
+    'dsh plugin --profile dsh-tui add some-plugin',
+    'dsh --profile dsh-tui --dump-config'
+  ])('rejects %s', (commandLine) => {
+    expect(isDshNonInteractiveCommand(tokens(commandLine))).toBe(true)
+  })
+
+  it.each([
+    'dsh --profile dsh-tui',
+    'dsh --profile=dsh-tui',
+    'dsh --profile dsh-tui --resume 9478e2d8-29bc-4009-ab32-657efa2bd763',
+    'dsh-tui',
+    'dsh-tui --resume',
+    'dst'
+  ])('accepts %s', (commandLine) => {
+    expect(isDshNonInteractiveCommand(tokens(commandLine))).toBe(false)
+  })
+
+  it('reads only the first --profile, so app arguments cannot retarget it', () => {
+    // `--resume web` belongs to the terminal app, not the launcher.
+    expect(isDshNonInteractiveCommand(tokens('dsh --profile dsh-tui --resume web'))).toBe(false)
+  })
+
+  it.each([
+    'dsh-tui web',
+    'dst web',
+    'dsh-tui plugin',
+    'dsh-tui --continue web',
+    'dsh-tui /home/dev/projects/web',
+    'node /usr/local/lib/node_modules/.bin/dsh-tui web',
+    'C:\\Users\\dev\\AppData\\npm\\dsh-tui.cmd web'
+  ])('keeps %s interactive: the launcher already chose the TUI profile', (commandLine) => {
+    // Everything after `dsh-tui`/`dst` is the terminal app's argv — a workspace target or a
+    // resume id — so a folder named `web` or `plugin` is a directory name, not a subcommand.
+    expect(isDshNonInteractiveCommand(tokens(commandLine))).toBe(false)
+  })
+})
+
+describe('dsh foreground process recognition', () => {
+  it.each([
+    'dsh-tui',
+    'dst',
+    '/opt/homebrew/bin/dsh --profile dsh-tui',
+    'node /usr/local/lib/node_modules/.bin/dsh-tui',
+    'node /home/dev/.dsh/profiles/dsh-tui/node_modules/@deepseek-harness-tui/dsh-tui/bin/dsh-tui.js',
+    'node /usr/local/lib/node_modules/@deepseek-ai/dsh/lib/bin.js --profile dsh-tui'
+  ])('recognizes %s as dsh', (commandLine) => {
+    expect(recognizeAgentProcessFromCommandLine(commandLine)?.agent).toBe('dsh')
+  })
+
+  it.each([
+    'dsh web',
+    'dsh --profile headless "summarize the diff"',
+    'node /usr/local/lib/node_modules/@deepseek-ai/dsh/lib/bin.js --profile acp'
+  ])('does not claim %s as an interactive agent pane', (commandLine) => {
+    expect(recognizeAgentProcessFromCommandLine(commandLine)).toBeNull()
+  })
+
+  it.each(['dsh-tui web', 'dst plugin'])(
+    'still recognizes %s as the dsh agent pane',
+    (commandLine) => {
+      expect(recognizeAgentProcessFromCommandLine(commandLine)?.agent).toBe('dsh')
+    }
+  )
+
+  it('still reports non-interactive dsh when headless one-shots are included', () => {
+    // Non-interactivity guards ask for the wider set: a `dsh web` pane is not a shell
+    // either, so callers that protect agent panes from reuse must still see it.
+    expect(
+      recognizeAgentProcessFromCommandLine('dsh --profile headless "go"', {
+        includeHeadlessOneShot: true
+      })?.agent
+    ).toBe('dsh')
+  })
+})
diff --git a/src/shared/dsh-launch-command.ts b/src/shared/dsh-launch-command.ts
new file mode 100644
index 00000000000..60100a9823b
--- /dev/null
+++ b/src/shared/dsh-launch-command.ts
@@ -0,0 +1,115 @@
+// DeepSeek Harness ships one binary, `dsh`, and boots a *profile* with it. Only the
+// `dsh-tui` profile paints an interactive composer; `web` serves HTTP, `headless` answers
+// one task and exits, `sdk`/`sdk-minimal`/`acp` speak JSON-RPC on stdio, and `plugin` is
+// package management. All five are `dsh` in the process table, so foreground recognition
+// has to read the profile to tell an agent pane from a server or a one-shot.
+//
+// `dsh-tui` (and its `dst` alias) forward straight to `dsh --profile dsh-tui`, so they are
+// always interactive and never reach this matcher.
+
+/** Profiles that boot something other than the interactive terminal UI. */
+const NON_INTERACTIVE_PROFILES = new Set([
+  'web',
+  'headless',
+  'sdk',
+  'sdk-minimal',
+  'acp',
+  'desktop'
+])
+
+/** Bare-word subcommands the launcher accepts: `plugin` boots no profile at all, and `web`
+ *  is the documented alias for `--profile web`. Neither hosts an interactive pane. */
+const SUBCOMMANDS = new Set(['plugin', 'web'])
+
+/** Launcher flags that print a composed config and exit. */
+const DUMP_FLAGS = new Set(['--dump-config', '--dump-default-config', '--dump-config-schema'])
+
+/** Binaries that always boot `--profile dsh-tui` and forward the rest to the terminal app. */
+const TUI_LAUNCHER_NAMES = new Set(['dsh-tui', 'dst'])
+
+const PROGRAM_EXTENSION_RE = /\.(?:exe|cmd|bat|ps1|js|mjs|cjs)$/
+
+function programBasename(token: string | undefined): string {
+  const unquoted = token?.trim().replace(/^["']|["']$/g, '') ?? ''
+  const basename = unquoted.split(/[\\/]/).pop() ?? unquoted
+  return basename.toLowerCase().replace(PROGRAM_EXTENSION_RE, '')
+}
+
+function readProfileName(tokens: readonly string[], index: number): string | null {
+  const token = tokens[index]
+  if (token === undefined) {
+    return null
+  }
+  if (token.startsWith('--profile=')) {
+    return token.slice('--profile='.length)
+  }
+  return token === '--profile' ? (tokens[index + 1] ?? null) : null
+}
+
+/** Launcher flags that take a value, so the token after them is never an app argument. */
+const LAUNCHER_FLAGS_WITH_VALUE = new Set(['--profile', '--from-default-profile', '--patch'])
+
+/** Valueless launcher flags. */
+const LAUNCHER_FLAGS = new Set(['-V', '--version', '-h', '--help', ...DUMP_FLAGS])
+
+/** Splits `--profile=web` down to `--profile` so both spellings match one lookup. */
+function flagName(token: string): string {
+  return token.split('=', 1)[0]
+}
+
+function isLauncherToken(token: string): boolean {
+  return LAUNCHER_FLAGS.has(token) || LAUNCHER_FLAGS_WITH_VALUE.has(flagName(token))
+}
+
+/**
+ * Whether a `dsh` command line runs something other than the interactive agent.
+ *
+ * Only the launcher's own tokens are read. Everything after the first token the launcher
+ * does not recognize belongs to the booted app (`dsh --profile dsh-tui --resume <id>`),
+ * and a prompt or session id is free text that must never be read as a launcher flag.
+ */
+export function isDshNonInteractiveCommand(tokens: readonly string[]): boolean {
+  // Why first: `dsh-tui`/`dst` have already chosen the interactive profile, and everything
+  // after them is the TERMINAL APP's argv — a `--resume` id or a workspace target. A
+  // workspace folder named `web` or `plugin` is an ordinary directory name, and reading it
+  // as a `dsh` subcommand would mark a live agent pane non-interactive, costing it status
+  // hooks and prompt delivery. Index 1 as well as 0 because a node shim puts the launcher
+  // script path there.
+  if (
+    TUI_LAUNCHER_NAMES.has(programBasename(tokens[0])) ||
+    TUI_LAUNCHER_NAMES.has(programBasename(tokens[1]))
+  ) {
+    return false
+  }
+  let profile: string | null = null
+  let index = 1
+  // Skip the leading non-flag tokens: an interpreter invocation puts the script path here.
+  while (index < tokens.length && !isLauncherToken(tokens[index])) {
+    const token = tokens[index]
+    if (SUBCOMMANDS.has(token)) {
+      return true
+    }
+    if (!token.startsWith('-') && index > 1) {
+      // A bare word that is neither a subcommand nor a flag: the app's arguments start here.
+      return false
+    }
+    index += 1
+  }
+  for (; index < tokens.length; index += 1) {
+    const token = tokens[index]
+    if (DUMP_FLAGS.has(token)) {
+      return true
+    }
+    if (!isLauncherToken(token)) {
+      break
+    }
+    const explicitProfile = readProfileName(tokens, index)
+    if (explicitProfile !== null && profile === null) {
+      profile = explicitProfile
+    }
+    if (LAUNCHER_FLAGS_WITH_VALUE.has(token)) {
+      index += 1
+    }
+  }
+  return profile !== null && NON_INTERACTIVE_PROFILES.has(profile)
+}
diff --git a/src/shared/dsh-terminal-title.test.ts b/src/shared/dsh-terminal-title.test.ts
new file mode 100644
index 00000000000..ab28f4d56f4
--- /dev/null
+++ b/src/shared/dsh-terminal-title.test.ts
@@ -0,0 +1,45 @@
+import { describe, expect, it } from 'vitest'
+import { detectAgentStatusFromTitle, normalizeTerminalTitle } from './agent-title-status'
+import { isDshTerminalTitle, isGeminiTerminalTitle } from './agent-title-core'
+import { getAgentLabel, resolveExplicitTerminalTitleAgentType } from './terminal-title-agent-type'
+
+// DSH-TUI titles are `<prefix> 🐋 <session title>`: `✦` at rest, `⠂`/`⠐` while a turn
+// runs. Both halves collide with an existing agent — `✦` is Gemini CLI's WORKING glyph,
+// and the braille frames are what Claude's generic heuristic claims — so the whale has to
+// outrank both. Evidence: src/main/runtime/__fixtures__/dsh-tui-ready-no-key.txt.
+const RESTING = '✦ \u{1F40B} dsh-demo-repo'
+const WORKING_FRAMES = ['⠂ \u{1F40B} fix the flaky test', '⠐ \u{1F40B} fix the flaky test']
+
+describe('a DSH-TUI terminal title', () => {
+  it('is recognized by its whale', () => {
+    expect(isDshTerminalTitle(RESTING)).toBe(true)
+    expect(isDshTerminalTitle('✦ some other agent')).toBe(false)
+  })
+
+  it('is never read as Gemini CLI', () => {
+    expect(isGeminiTerminalTitle(RESTING)).toBe(false)
+    expect(getAgentLabel(RESTING)).toBe('DeepSeek Harness')
+    expect(resolveExplicitTerminalTitleAgentType(RESTING)).toBe('dsh')
+  })
+
+  it('survives normalization instead of being rewritten to Gemini', () => {
+    expect(normalizeTerminalTitle(RESTING)).toBe(RESTING)
+  })
+
+  it('does not report working just because it carries Gemini’s working glyph', () => {
+    // The regression this guards: a finished DSH pane reported working forever, because
+    // `✦` is DSH's REST prefix and Gemini's WORKING glyph.
+    expect(detectAgentStatusFromTitle(RESTING)).toBeNull()
+  })
+
+  it('keeps its working frames out of Claude’s braille lane', () => {
+    for (const frame of WORKING_FRAMES) {
+      expect(getAgentLabel(frame)).toBe('DeepSeek Harness')
+    }
+  })
+
+  it('leaves a real Gemini title alone', () => {
+    expect(isGeminiTerminalTitle('✦ gemini')).toBe(true)
+    expect(normalizeTerminalTitle('✦ gemini')).toBe('✦ Gemini CLI')
+  })
+})
diff --git a/src/shared/dsh-terminal-title.ts b/src/shared/dsh-terminal-title.ts
new file mode 100644
index 00000000000..76662bd10d0
--- /dev/null
+++ b/src/shared/dsh-terminal-title.ts
@@ -0,0 +1,10 @@
+/** DSH-TUI titles are always `<prefix> 🐋 <session title>` (its Chat screen's
+ *  `useTerminalTitle`), and the whale is the only part no other agent emits. It has to
+ *  outrank the Gemini glyphs below: DSH's IDLE prefix is `✦`, which is Gemini's WORKING
+ *  glyph, so without this a resting DSH pane reads as a working Gemini — wrong agent,
+ *  wrong state. Evidence: src/main/runtime/__fixtures__/dsh-tui-ready-no-key.txt. */
+export const DSH_WHALE = '\u{1F40B}' // 🐋
+
+export function isDshTerminalTitle(title: string): boolean {
+  return title.includes(DSH_WHALE)
+}
diff --git a/src/shared/emoji-shortcode-catalog.lazy.test.ts b/src/shared/emoji-shortcode-catalog.lazy.test.ts
index dc05160696b..f46e0e742aa 100644
--- a/src/shared/emoji-shortcode-catalog.lazy.test.ts
+++ b/src/shared/emoji-shortcode-catalog.lazy.test.ts
@@ -1,5 +1,3 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import emojiShortcodes from 'emojibase-data/en/shortcodes/emojibase.json'
 
@@ -29,37 +27,4 @@ describe('emoji shortcode catalog laziness', () => {
     expect(catalog.replaceKnownEmojiWithShortcodes('ship \u{1F389}')).toBe('ship  party ')
     expect(catalog.isEmojiShortcodeCatalogBuiltForTest()).toBe(true)
   })
-
-  it('leaves the main-process worktree namer importing only the deferred entry points', () => {
-    // A cross-project import would drag src/main into the shared tsconfig, so assert on source.
-    const worktreeLogic = readFileSync(join(__dirname, '../main/ipc/worktree-logic.ts'), 'utf8')
-    const catalogImport = worktreeLogic.match(
-      /import \{([^}]*)\} from '[^']*emoji-shortcode-catalog'/
-    )
-
-    expect(catalogImport?.[1].split(',').map((name) => name.trim())).toEqual([
-      'replaceKnownEmojiWithShortcodes',
-      'setEmojiShortcodeDatasetLoader'
-    ])
-  })
-
-  it('keeps the catalog build out of module scope', () => {
-    const sharedSource = readFileSync(join(__dirname, 'emoji-shortcode-catalog.ts'), 'utf8')
-
-    // A module-scope `const X = <expression over the dataset>` is the regression this guards.
-    expect(sharedSource).not.toMatch(/^const \w+ = Object\.entries\(/m)
-    expect(sharedSource).not.toMatch(/^const \w+ = new (?:Map|Intl\.Segmenter)\(/m)
-    expect(sharedSource).toContain('function loadCatalog()')
-  })
-
-  it('keeps the 166 KB dataset off every module main statically imports', () => {
-    const sharedSource = readFileSync(join(__dirname, 'emoji-shortcode-catalog.ts'), 'utf8')
-    const worktreeLogic = readFileSync(join(__dirname, '../main/ipc/worktree-logic.ts'), 'utf8')
-
-    // A static `emojibase-data` import anywhere main reaches inlines the dataset into
-    // out/main/index.js and JSON.parses it on every launch.
-    const staticDatasetImport = /\bfrom '[^']*emojibase-data[^']*'/
-    expect(sharedSource).not.toMatch(staticDatasetImport)
-    expect(worktreeLogic).not.toMatch(staticDatasetImport)
-  })
 })
diff --git a/src/shared/ephemeral-vm-recipe-output-capture.test.ts b/src/shared/ephemeral-vm-recipe-output-capture.test.ts
new file mode 100644
index 00000000000..27fe3c13466
--- /dev/null
+++ b/src/shared/ephemeral-vm-recipe-output-capture.test.ts
@@ -0,0 +1,356 @@
+import { EventEmitter } from 'node:events'
+import { PassThrough } from 'node:stream'
+import { setImmediate } from 'node:timers/promises'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  clampRecipeCaptureBytes,
+  DEFAULT_MAX_CAPTURE_BYTES,
+  runRecipeCommand
+} from './ephemeral-vm-recipe-process'
+import { GrowingByteBuffer } from './growing-byte-buffer'
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+})
+
+/** The pre-ring policy: re-encode the retained tail on every chunk and trim to a character boundary. */
+function oldAppend(current: string, chunk: string, maxBytes: number): string {
+  if (maxBytes <= 0) {
+    return ''
+  }
+  const chunkBytes = Buffer.byteLength(chunk, 'utf8')
+  return chunkBytes >= maxBytes
+    ? utf8Tail(chunk, maxBytes)
+    : utf8Tail(current, maxBytes - chunkBytes) + chunk
+}
+
+function utf8Tail(value: string, maxBytes: number): string {
+  const bytes = Buffer.from(value, 'utf8')
+  if (bytes.byteLength <= maxBytes) {
+    return value
+  }
+  let start = bytes.byteLength - maxBytes
+  while (start < bytes.byteLength && (bytes[start]! & 0xc0) === 0x80) {
+    start += 1
+  }
+  return bytes.subarray(start).toString('utf8')
+}
+
+/** What the capture now retains: the last maxBytes raw bytes, minus a leading partial sequence. */
+function rawByteTail(bytes: Buffer, maxBytes: number): string {
+  let start = Math.max(0, bytes.byteLength - maxBytes)
+  while (start < bytes.byteLength && (bytes[start]! & 0xc0) === 0x80) {
+    start += 1
+  }
+  return bytes.toString('utf8', start)
+}
+
+/** Independent oracle: keep whole code points from the end until the byte limit is reached. */
+function codePointTail(text: string, maxBytes: number): string {
+  const points = Array.from(text)
+  const retained: string[] = []
+  let bytes = 0
+  while (points.length > 0) {
+    const point = points.pop()!
+    bytes += Buffer.byteLength(point, 'utf8')
+    if (bytes > maxBytes) {
+      break
+    }
+    retained.unshift(point)
+  }
+  return retained.join('')
+}
+
+function deterministicRandom(seed: number): (max: number) => number {
+  let state = seed
+  return (max: number): number => {
+    state = (Math.imul(state, 1664525) + 1013904223) >>> 0
+    return max <= 0 ? 0 : state % max
+  }
+}
+
+function fakeCommand(maxCaptureBytes?: number, signal?: AbortSignal) {
+  const child = Object.assign(new EventEmitter(), {
+    pid: undefined,
+    stdin: new PassThrough(),
+    stdout: new PassThrough(),
+    stderr: new PassThrough(),
+    kill: vi.fn<(signal?: NodeJS.Signals) => boolean>(() => true),
+    unref: vi.fn()
+  })
+  const stdoutChunks: string[] = []
+  const stderrChunks: string[] = []
+  const result = runRecipeCommand({
+    command: 'synthetic-recipe',
+    repoPath: process.cwd(),
+    context: { recipeId: 'fixture', repoPath: process.cwd() },
+    mode: 'create',
+    resultSchemaVersion: 1,
+    maxCaptureBytes,
+    signal,
+    onStdout: (chunk) => stdoutChunks.push(chunk),
+    onStderr: (chunk) => stderrChunks.push(chunk),
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture implements every child member used by runRecipeCommand.
+    spawnCommand: vi.fn(() => child) as never
+  })
+  return { child, result, stdoutChunks, stderrChunks }
+}
+
+/**
+ * Counts the bytes the capture moves, scoped to our own buffer class: a spy on Buffer itself would
+ * also see unrelated allocations in the same tick and make the budget assertions flaky.
+ */
+function countCaptureWork() {
+  const appendedValues: (Buffer | Uint8Array)[] = []
+  const counts = { appendedBytes: 0, decodedBytes: 0, decodeCalls: 0 }
+  const append = GrowingByteBuffer.prototype.appendRetainedSuffix
+  const take = GrowingByteBuffer.prototype.takeBuffer
+  vi.spyOn(GrowingByteBuffer.prototype, 'appendRetainedSuffix').mockImplementation(function (
+    this: GrowingByteBuffer,
+    bytes: Buffer | Uint8Array,
+    maxBytes: number
+  ): void {
+    appendedValues.push(bytes)
+    counts.appendedBytes += bytes.byteLength
+    append.call(this, bytes, maxBytes)
+  })
+  vi.spyOn(GrowingByteBuffer.prototype, 'takeBuffer').mockImplementation(function (
+    this: GrowingByteBuffer
+  ): Buffer {
+    const taken = take.call(this)
+    counts.decodeCalls += 1
+    counts.decodedBytes += taken.byteLength
+    return taken
+  })
+  return { appendedValues, counts }
+}
+
+describe('recipe output capture', () => {
+  it.each([0, -1, 1, 2, 3, 4, 7, 16, 255, 256, 257, 1024])(
+    'matches the old per-chunk UTF-8 tail for limit %s across varied chunk boundaries',
+    async (limit) => {
+      const random = deterministicRandom(0x19780728)
+      const alphabet = ['a', '\0', '\n', 'é', '中', '😀', '�', '́']
+      for (let sample = 0; sample < 4; sample += 1) {
+        const fixture = fakeCommand(limit)
+        let expected = ''
+        for (let index = 0; index < 80; index += 1) {
+          const chunk = Array.from(
+            { length: random(40) },
+            () => alphabet[random(alphabet.length)]
+          ).join('')
+          fixture.child.stdout.emit('data', Buffer.from(chunk, 'utf8'))
+          expected = oldAppend(expected, chunk, limit)
+        }
+        fixture.child.emit('close', 0, null)
+        await expect(fixture.result).resolves.toMatchObject({ stdout: expected, stderr: '' })
+      }
+    }
+  )
+
+  it('does not restore bytes discarded at an earlier chunk boundary', async () => {
+    const fixture = fakeCommand(5)
+    for (const chunk of ['😀', 'ab', 'c']) {
+      fixture.child.stdout.emit('data', Buffer.from(chunk, 'utf8'))
+    }
+    fixture.child.emit('close', 0, null)
+    await expect(fixture.result).resolves.toMatchObject({ stdout: 'abc' })
+  })
+
+  it.each([1, 7, 31, 255, 4097])(
+    'retains the same code-point tail for limit %s wherever byte boundaries fall',
+    async (limit) => {
+      const random = deterministicRandom(0x5eed1234 + limit)
+      let text = ''
+      for (let index = 0; index < 2000; index += 1) {
+        text += index % 29 === 0 ? 'a中😀é'.repeat(200) : ['x', '😀', '中', 'é'][index % 4]
+      }
+      const bytes = Buffer.from(text, 'utf8')
+      const fixture = fakeCommand(limit)
+      // Split mid-character on purpose: retention is over raw bytes, so the tail must not depend on it.
+      for (let cursor = 0; cursor < bytes.byteLength;) {
+        const size = Math.min(1 + random(2048), bytes.byteLength - cursor)
+        fixture.child.stdout.emit('data', bytes.subarray(cursor, cursor + size))
+        cursor += size
+      }
+      fixture.child.emit('close', 0, null)
+      const result = await fixture.result
+      expect(result.stdout).toBe(codePointTail(text, limit))
+      expect(Buffer.byteLength(result.stdout, 'utf8')).toBeLessThanOrEqual(limit)
+    }
+  )
+
+  it('preserves stream decoding, callback boundaries and independent tails', async () => {
+    const fixture = fakeCommand(9)
+    const stdoutBytes = Buffer.from('α😀中文invalid:�:end')
+    const stderrBytes = Buffer.from('stderr:\n😀!')
+    const malformed = Buffer.from([0xff, 0xe2, 0x28, 0xa1])
+    for (const byte of stdoutBytes) {
+      fixture.child.stdout.write(Buffer.from([byte]))
+    }
+    for (const byte of stderrBytes) {
+      fixture.child.stderr.write(Buffer.from([byte]))
+    }
+    fixture.child.stdout.write(malformed)
+    fixture.child.emit('close', 17, null)
+    const result = await fixture.result
+    // Callbacks still see exactly what setEncoding('utf8') produced, split character by character.
+    expect(fixture.stdoutChunks.join('')).toBe(`${stdoutBytes.toString()}��(�`)
+    expect(fixture.stderrChunks.join('')).toBe(stderrBytes.toString())
+    // The tail is now the last 9 raw bytes rather than the last 9 bytes of re-encoded replacement
+    // characters, so malformed output keeps more of what the recipe actually wrote.
+    expect(result).toEqual({
+      stdout: rawByteTail(Buffer.concat([stdoutBytes, malformed]), 9),
+      stderr: rawByteTail(stderrBytes, 9),
+      exitCode: 17,
+      signal: null
+    })
+    expect(result.stdout).toBe(':end��(�')
+  })
+
+  it('moves at most 5 MiB through the capture for 4 MiB of output', async () => {
+    const fixture = fakeCommand()
+    const chunk = Buffer.from('a'.repeat(4096))
+    const { appendedValues, counts } = countCaptureWork()
+    for (let index = 0; index < 1024; index += 1) {
+      fixture.child.stdout.emit('data', chunk)
+    }
+    fixture.child.emit('close', 0, null)
+    const result = await fixture.result
+    expect(result.stdout).toBe('a'.repeat(1024 * 1024))
+    expect(fixture.stdoutChunks).toHaveLength(1024)
+    // The pre-ring policy re-encoded the retained tail per chunk: 943,194,112 bytes for this input.
+    expect(counts.appendedBytes + counts.decodedBytes).toBeLessThanOrEqual(5 * 1024 * 1024)
+    expect(counts.appendedBytes).toBe(4 * 1024 * 1024)
+    expect(counts.decodedBytes).toBe(1024 * 1024)
+    // Nothing is encoded: the capture stores the very Buffers the stream delivered.
+    expect(appendedValues.every((value) => value === chunk)).toBe(true)
+  })
+
+  it('returns the captured tails when cancellation needs force-kill', async () => {
+    vi.useFakeTimers()
+    const controller = new AbortController()
+    const fixture = fakeCommand(6, controller.signal)
+    fixture.child.stdout.emit('data', Buffer.from('abc😀Z'))
+    fixture.child.stderr.emit('data', Buffer.from('error tail'))
+    controller.abort()
+    fixture.child.stdout.emit('data', Buffer.from('!'))
+    await vi.advanceTimersByTimeAsync(5000)
+    await expect(fixture.result).resolves.toEqual({
+      stdout: '😀Z!',
+      stderr: 'r tail',
+      exitCode: null,
+      signal: null,
+      aborted: true
+    })
+    expect(fixture.child.kill.mock.calls).toEqual([['SIGTERM'], ['SIGKILL']])
+    expect(fixture.child.unref).toHaveBeenCalledOnce()
+  })
+
+  it('preserves failures after output and synchronous spawn errors', async () => {
+    const fixture = fakeCommand(5)
+    const error = new Error('recipe failed')
+    fixture.child.stdout.emit('data', Buffer.from('earlier output'))
+    fixture.child.emit('error', error)
+    await expect(fixture.result).rejects.toBe(error)
+    fixture.child.emit('close', 1, null)
+    await expect(
+      runRecipeCommand({
+        command: 'synthetic-recipe',
+        repoPath: process.cwd(),
+        context: { recipeId: 'fixture', repoPath: process.cwd() },
+        mode: 'create',
+        resultSchemaVersion: 1,
+        spawnCommand: () => {
+          throw error
+        }
+      })
+    ).rejects.toBe(error)
+  })
+
+  it.each(['close', 'error'])(
+    'releases capture storage after %s while preserving late callbacks',
+    async (event) => {
+      if (!global.gc) {
+        throw new Error('This regression requires --expose-gc')
+      }
+      const fixture = fakeCommand(128 * 1024)
+      const allocations: WeakRef<Buffer>[] = []
+      const allocUnsafe = Buffer.allocUnsafe
+      const allocationSpy = vi.spyOn(Buffer, 'allocUnsafe').mockImplementation((size) => {
+        const bytes = allocUnsafe(size)
+        allocations.push(new WeakRef(bytes))
+        return bytes
+      })
+      for (let index = 0; index < 3; index++) {
+        fixture.child.stdout.emit('data', Buffer.from('a'.repeat(4096)))
+        fixture.child.stderr.emit('data', Buffer.from('b'.repeat(4096)))
+      }
+      allocationSpy.mockRestore()
+      if (event === 'error') {
+        fixture.child.emit('error', new Error('recipe failed'))
+        await expect(fixture.result).rejects.toThrow('recipe failed')
+      } else {
+        fixture.child.emit('close', 0, null)
+        await expect(fixture.result).resolves.toMatchObject({
+          stdout: 'a'.repeat(3 * 4096),
+          stderr: 'b'.repeat(3 * 4096)
+        })
+      }
+      for (let turn = 0; turn < 3; turn++) {
+        await setImmediate()
+        global.gc()
+      }
+      expect(allocations.length).toBeGreaterThan(0)
+      expect(allocations.filter((ref) => ref.deref() !== undefined)).toHaveLength(0)
+      const { counts } = countCaptureWork()
+      fixture.child.stdout.emit('data', Buffer.from('late stdout'))
+      fixture.child.stderr.emit('data', Buffer.from('late stderr'))
+      fixture.child.emit('close', 1, null)
+      expect(counts).toEqual({ appendedBytes: 0, decodedBytes: 0, decodeCalls: 0 })
+      expect(fixture.stdoutChunks.at(-1)).toBe('late stdout')
+      expect(fixture.stderrChunks.at(-1)).toBe('late stderr')
+    }
+  )
+
+  it('decodes once per stream when force-kill closes synchronously', async () => {
+    vi.useFakeTimers()
+    const controller = new AbortController()
+    const fixture = fakeCommand(8, controller.signal)
+    fixture.child.kill.mockImplementation((signal) => {
+      if (signal === 'SIGKILL') {
+        fixture.child.emit('close', null, 'SIGKILL')
+      }
+      return true
+    })
+    fixture.child.stdout.emit('data', Buffer.from('before😀'))
+    const { counts } = countCaptureWork()
+    controller.abort()
+    await vi.advanceTimersByTimeAsync(5000)
+    await expect(fixture.result).resolves.toEqual({
+      stdout: 'fore😀',
+      stderr: '',
+      exitCode: null,
+      signal: 'SIGKILL',
+      aborted: true
+    })
+    expect(vi.getTimerCount()).toBe(0)
+    expect(counts.decodeCalls).toBe(2)
+  })
+
+  it.each([
+    { limit: undefined, expected: DEFAULT_MAX_CAPTURE_BYTES },
+    { limit: 1024, expected: 1024 },
+    { limit: 1.5, expected: 1 },
+    { limit: 4.5, expected: 4 },
+    { limit: 0, expected: 0 },
+    { limit: -1, expected: 0 },
+    { limit: -Infinity, expected: 0 },
+    { limit: Number.NaN, expected: DEFAULT_MAX_CAPTURE_BYTES },
+    { limit: Infinity, expected: DEFAULT_MAX_CAPTURE_BYTES },
+    { limit: Number.MAX_VALUE, expected: DEFAULT_MAX_CAPTURE_BYTES }
+  ])('clamps a $limit capture limit to a bounded byte count', ({ limit, expected }) => {
+    expect(clampRecipeCaptureBytes(limit)).toBe(expected)
+  })
+})
diff --git a/src/shared/ephemeral-vm-recipe-process.ts b/src/shared/ephemeral-vm-recipe-process.ts
index 30d44ac1dbc..e943567095c 100644
--- a/src/shared/ephemeral-vm-recipe-process.ts
+++ b/src/shared/ephemeral-vm-recipe-process.ts
@@ -1,8 +1,10 @@
 import { spawn, type ChildProcessWithoutNullStreams } from 'node:child_process'
+import { StringDecoder } from 'node:string_decoder'
 import type { EphemeralVmRecipeContext } from './ephemeral-vm-recipe-runner'
 import { admitProcessTreeKill } from './child-process/process-tree-kill-gate'
+import { GrowingByteBuffer } from './growing-byte-buffer'
 
-const DEFAULT_MAX_CAPTURE_BYTES = 1024 * 1024
+export const DEFAULT_MAX_CAPTURE_BYTES = 1024 * 1024
 const CANCEL_FORCE_KILL_DELAY_MS = 5_000
 
 export type ProcessRunResult = {
@@ -37,7 +39,7 @@ export async function runRecipeCommand(args: {
   onStderr?: (chunk: string) => void
   spawnCommand?: typeof spawn
 }): Promise<ProcessRunResult> {
-  const maxBytes = args.maxCaptureBytes ?? DEFAULT_MAX_CAPTURE_BYTES
+  const maxBytes = clampRecipeCaptureBytes(args.maxCaptureBytes)
   const spawnCommand = args.spawnCommand ?? spawn
 
   return new Promise((resolve, reject) => {
@@ -55,12 +57,12 @@ export async function runRecipeCommand(args: {
       return
     }
 
-    let stdout = ''
-    let stderr = ''
+    const stdout = new GrowingByteBuffer()
+    const stderr = new GrowingByteBuffer()
     let settled = false
     let aborted = false
     let forceKillTimer: ReturnType<typeof setTimeout> | undefined
-    const finish = (result: ProcessRunResult): void => {
+    const finish = (result: Omit<ProcessRunResult, 'stdout' | 'stderr'>): void => {
       if (settled) {
         return
       }
@@ -69,7 +71,7 @@ export async function runRecipeCommand(args: {
         clearTimeout(forceKillTimer)
       }
       args.signal?.removeEventListener('abort', abort)
-      resolve(result)
+      resolve({ stdout: takeRetainedTail(stdout), stderr: takeRetainedTail(stderr), ...result })
     }
     const fail = (error: Error): void => {
       if (settled) {
@@ -80,6 +82,8 @@ export async function runRecipeCommand(args: {
         clearTimeout(forceKillTimer)
       }
       args.signal?.removeEventListener('abort', abort)
+      stdout.clear()
+      stderr.clear()
       reject(error)
     }
     const abort = (): void => {
@@ -92,7 +96,7 @@ export async function runRecipeCommand(args: {
           return
         }
         killRecipeProcess(child, true)
-        finish({ stdout, stderr, exitCode: null, signal: null, aborted: true })
+        finish({ exitCode: null, signal: null, aborted: true })
         child.stdin.destroy()
         child.stdout.destroy()
         child.stderr.destroy()
@@ -102,21 +106,37 @@ export async function runRecipeCommand(args: {
       killRecipeProcess(child)
     }
 
-    child.stdout.setEncoding('utf8')
-    child.stderr.setEncoding('utf8')
-    child.stdout.on('data', (chunk: string) => {
-      stdout = appendBounded(stdout, chunk, maxBytes)
-      args.onStdout?.(chunk)
-    })
-    child.stderr.on('data', (chunk: string) => {
-      stderr = appendBounded(stderr, chunk, maxBytes)
-      args.onStderr?.(chunk)
-    })
+    // No setEncoding: the retained tail stays raw bytes, and a per-stream StringDecoder gives the
+    // callbacks the same character boundaries setEncoding would have (it uses the same decoder).
+    const stdoutDecoder = new StringDecoder('utf8')
+    const stderrDecoder = new StringDecoder('utf8')
+    const capture = (
+      buffer: GrowingByteBuffer,
+      decoder: StringDecoder,
+      chunk: Buffer,
+      forward: ((chunk: string) => void) | undefined
+    ): void => {
+      if (!settled) {
+        buffer.appendRetainedSuffix(chunk, maxBytes)
+      }
+      if (!forward) {
+        return
+      }
+      const decoded = decoder.write(chunk)
+      if (decoded.length > 0) {
+        forward(decoded)
+      }
+    }
+    child.stdout.on('data', (chunk: Buffer) => capture(stdout, stdoutDecoder, chunk, args.onStdout))
+    child.stderr.on('data', (chunk: Buffer) => capture(stderr, stderrDecoder, chunk, args.onStderr))
+    // setEncoding flushes its decoder at end-of-stream; keep that final replacement character.
+    child.stdout.on('end', () => flushDecoder(stdoutDecoder, args.onStdout))
+    child.stderr.on('end', () => flushDecoder(stderrDecoder, args.onStderr))
     child.on('error', (error) => {
       fail(error)
     })
     child.on('close', (exitCode, signal) => {
-      finish({ stdout, stderr, exitCode, signal, ...(aborted ? { aborted: true } : {}) })
+      finish({ exitCode, signal, ...(aborted ? { aborted: true } : {}) })
     })
 
     if (args.signal?.aborted) {
@@ -133,6 +153,38 @@ export async function runRecipeCommand(args: {
   })
 }
 
+/** No production caller overrides the cap, so odd values are clamped rather than coerced per chunk. */
+export function clampRecipeCaptureBytes(value: number | undefined): number {
+  if (value === undefined || Number.isNaN(value)) {
+    return DEFAULT_MAX_CAPTURE_BYTES
+  }
+  if (value <= 0) {
+    return 0
+  }
+  const floored = Math.floor(value)
+  return Number.isSafeInteger(floored) ? floored : DEFAULT_MAX_CAPTURE_BYTES
+}
+
+// Retention cuts on a byte boundary, so drop the partial sequence the old per-chunk trim removed.
+function takeRetainedTail(buffer: GrowingByteBuffer): string {
+  const bytes = buffer.takeBuffer()
+  let start = 0
+  while (start < bytes.byteLength && (bytes[start]! & 0xc0) === 0x80) {
+    start += 1
+  }
+  return bytes.toString('utf8', start)
+}
+
+function flushDecoder(
+  decoder: StringDecoder,
+  forward: ((chunk: string) => void) | undefined
+): void {
+  const trailing = decoder.end()
+  if (trailing.length > 0) {
+    forward?.(trailing)
+  }
+}
+
 /** Exported for the refusal-fallback test; the abort path is otherwise unreachable. */
 export function killRecipeProcess(child: ChildProcessWithoutNullStreams, force = false): void {
   const signal = force ? 'SIGKILL' : 'SIGTERM'
@@ -199,26 +251,3 @@ function buildRecipeEnv(
     ORCA_VERSION: context.orcaVersion ?? ''
   }
 }
-
-function appendBounded(current: string, chunk: string, maxBytes: number): string {
-  if (maxBytes <= 0) {
-    return ''
-  }
-  const chunkBytes = Buffer.byteLength(chunk, 'utf8')
-  if (chunkBytes >= maxBytes) {
-    return utf8Tail(chunk, maxBytes)
-  }
-  return utf8Tail(current, maxBytes - chunkBytes) + chunk
-}
-
-function utf8Tail(value: string, maxBytes: number): string {
-  const bytes = Buffer.from(value, 'utf8')
-  if (bytes.byteLength <= maxBytes) {
-    return value
-  }
-  let start = bytes.byteLength - maxBytes
-  while (start < bytes.byteLength && (bytes[start]! & 0xc0) === 0x80) {
-    start += 1
-  }
-  return bytes.subarray(start).toString('utf8')
-}
diff --git a/src/shared/file-explorer-display-root.test.ts b/src/shared/file-explorer-display-root.test.ts
new file mode 100644
index 00000000000..fe57dcb7a50
--- /dev/null
+++ b/src/shared/file-explorer-display-root.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it } from 'vitest'
+import {
+  FILE_EXPLORER_FULL_ROOT,
+  migrateExplorerDisplayRoots,
+  normalizeExplorerDisplayRootByWorktree
+} from './file-explorer-display-root'
+
+describe('explorer root persistence', () => {
+  it('preserves existing sparse worktrees without overriding explicit choices', () => {
+    expect(
+      migrateExplorerDisplayRoots({ chosen: 'packages/app' }, false, {
+        old: { sparseDirectories: ['src'] },
+        chosen: { sparseDirectories: ['packages/app'] },
+        normal: {}
+      })
+    ).toEqual({ old: FILE_EXPLORER_FULL_ROOT, chosen: 'packages/app' })
+  })
+  it('does not seed newly created worktrees on subsequent loads', () => {
+    const migrated = migrateExplorerDisplayRoots({}, false, { old: { sparseDirectories: ['src'] } })
+    expect(
+      migrateExplorerDisplayRoots(migrated, true, {
+        old: { sparseDirectories: ['src'] },
+        newlyCreated: { sparseDirectories: ['app'] }
+      })
+    ).toEqual({ old: FILE_EXPLORER_FULL_ROOT })
+  })
+  it('rejects malformed records and unsafe keys', () => {
+    expect(normalizeExplorerDisplayRootByWorktree(['src'])).toEqual({})
+    expect(
+      normalizeExplorerDisplayRootByWorktree(
+        JSON.parse('{"__proto__":"src","constructor":"src","ok":"/","bad":false}')
+      )
+    ).toEqual({ ok: '/' })
+  })
+})
diff --git a/src/shared/file-explorer-display-root.ts b/src/shared/file-explorer-display-root.ts
new file mode 100644
index 00000000000..4f5b8cf2489
--- /dev/null
+++ b/src/shared/file-explorer-display-root.ts
@@ -0,0 +1,37 @@
+export const FILE_EXPLORER_FULL_ROOT = '/'
+
+/** Accepts only string-valued choices with safe record keys; directory eligibility is validated against the current worktree. */
+export function normalizeExplorerDisplayRootByWorktree(value: unknown): Record<string, string> {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return {}
+  }
+  return Object.fromEntries(
+    Object.entries(value).filter(
+      ([key, choice]) =>
+        key &&
+        !['__proto__', 'constructor', 'prototype'].includes(key) &&
+        typeof choice === 'string'
+    )
+  )
+}
+
+/** Preserves full-root navigation for preexisting sparse worktrees without replacing explicit saved choices. */
+export function migrateExplorerDisplayRoots(
+  saved: unknown,
+  migrated: boolean,
+  worktreeMeta: Record<string, { sparseDirectories?: string[] }>
+): Record<string, string> {
+  const choices = normalizeExplorerDisplayRootByWorktree(saved)
+  if (!migrated) {
+    for (const [id, meta] of Object.entries(worktreeMeta)) {
+      if (
+        meta?.sparseDirectories?.length &&
+        !['__proto__', 'constructor', 'prototype'].includes(id) &&
+        choices[id] === undefined
+      ) {
+        choices[id] = FILE_EXPLORER_FULL_ROOT
+      }
+    }
+  }
+  return choices
+}
diff --git a/src/shared/filesystem-directory-listing-limit.test.ts b/src/shared/filesystem-directory-listing-limit.test.ts
deleted file mode 100644
index 73e9feaadf7..00000000000
--- a/src/shared/filesystem-directory-listing-limit.test.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import {
-  assertFilesystemDirectoryWithinLimit,
-  createFilesystemDirectoryLimitState,
-  FILESYSTEM_DIRECTORY_LIMIT_MESSAGE,
-  FILESYSTEM_DIRECTORY_MAX_ENTRIES,
-  FILESYSTEM_DIRECTORY_MAX_RETAINED_BYTES,
-  resolveFilesystemDirectoryListingLimits,
-  trackFilesystemDirectoryEntry
-} from './filesystem-directory-listing-limit'
-
-describe('filesystem directory listing limit', () => {
-  it('accepts ordinary complete listings', () => {
-    expect(() =>
-      assertFilesystemDirectoryWithinLimit([
-        { name: 'src' },
-        { name: 'README.md' },
-        { name: '文件.txt' }
-      ])
-    ).not.toThrow()
-  })
-
-  it('rejects the first entry beyond the count limit', () => {
-    const state = createFilesystemDirectoryLimitState({
-      maxEntries: 2,
-      maxRetainedBytes: FILESYSTEM_DIRECTORY_MAX_RETAINED_BYTES
-    })
-
-    trackFilesystemDirectoryEntry(state, { name: 'one' })
-    trackFilesystemDirectoryEntry(state, { name: 'two' })
-    expect(() => trackFilesystemDirectoryEntry(state, { name: 'three' })).toThrow(
-      FILESYSTEM_DIRECTORY_LIMIT_MESSAGE
-    )
-    expect(state.entries).toBe(3)
-  })
-
-  it('rejects names beyond the retained-byte limit', () => {
-    const state = createFilesystemDirectoryLimitState({
-      maxEntries: FILESYSTEM_DIRECTORY_MAX_ENTRIES,
-      maxRetainedBytes: 100
-    })
-
-    expect(() => trackFilesystemDirectoryEntry(state, { name: 'xx' })).toThrow(
-      FILESYSTEM_DIRECTORY_LIMIT_MESSAGE
-    )
-  })
-
-  it('never lets callers raise the process-wide ceilings', () => {
-    expect(
-      resolveFilesystemDirectoryListingLimits({
-        maxEntries: Number.MAX_SAFE_INTEGER,
-        maxRetainedBytes: Number.MAX_SAFE_INTEGER
-      })
-    ).toEqual({
-      maxEntries: FILESYSTEM_DIRECTORY_MAX_ENTRIES,
-      maxRetainedBytes: FILESYSTEM_DIRECTORY_MAX_RETAINED_BYTES
-    })
-  })
-})
diff --git a/src/shared/filesystem-directory-listing-limit.ts b/src/shared/filesystem-directory-listing-limit.ts
deleted file mode 100644
index c43f0eebbcf..00000000000
--- a/src/shared/filesystem-directory-listing-limit.ts
+++ /dev/null
@@ -1,75 +0,0 @@
-export const FILESYSTEM_DIRECTORY_MAX_ENTRIES = 100_000
-export const FILESYSTEM_DIRECTORY_MAX_RETAINED_BYTES = 12 * 1024 * 1024
-export const FILESYSTEM_DIRECTORY_LIMIT_MESSAGE =
-  'This folder is too large to list safely (limit: 100,000 items or a 12 MB listing).'
-
-export type FilesystemDirectoryListingLimits = {
-  maxEntries: number
-  maxRetainedBytes: number
-}
-
-type NamedDirectoryEntry = { name: string }
-
-export type FilesystemDirectoryLimitState = {
-  entries: number
-  retainedBytes: number
-  limits: FilesystemDirectoryListingLimits
-}
-
-export function resolveFilesystemDirectoryListingLimits(
-  requested?: Partial<FilesystemDirectoryListingLimits>
-): FilesystemDirectoryListingLimits {
-  return {
-    maxEntries: clampLimit(requested?.maxEntries, FILESYSTEM_DIRECTORY_MAX_ENTRIES),
-    maxRetainedBytes: clampLimit(
-      requested?.maxRetainedBytes,
-      FILESYSTEM_DIRECTORY_MAX_RETAINED_BYTES
-    )
-  }
-}
-
-export function createFilesystemDirectoryLimitState(
-  requested?: Partial<FilesystemDirectoryListingLimits>
-): FilesystemDirectoryLimitState {
-  return {
-    entries: 0,
-    retainedBytes: 0,
-    limits: resolveFilesystemDirectoryListingLimits(requested)
-  }
-}
-
-export function trackFilesystemDirectoryEntry(
-  state: FilesystemDirectoryLimitState,
-  entry: NamedDirectoryEntry
-): void {
-  state.entries += 1
-  state.retainedBytes += estimateFilesystemDirectoryEntryBytes(entry)
-  if (
-    state.entries > state.limits.maxEntries ||
-    state.retainedBytes > state.limits.maxRetainedBytes
-  ) {
-    throw new Error(FILESYSTEM_DIRECTORY_LIMIT_MESSAGE)
-  }
-}
-
-export function assertFilesystemDirectoryWithinLimit(
-  entries: readonly NamedDirectoryEntry[],
-  requested?: Partial<FilesystemDirectoryListingLimits>
-): void {
-  const state = createFilesystemDirectoryLimitState(requested)
-  for (const entry of entries) {
-    trackFilesystemDirectoryEntry(state, entry)
-  }
-}
-
-export function estimateFilesystemDirectoryEntryBytes(entry: NamedDirectoryEntry): number {
-  // Why: this covers worst-case JSON escaping plus each result object's fixed overhead.
-  return entry.name.length * 6 + 96
-}
-
-function clampLimit(value: number | undefined, maximum: number): number {
-  if (typeof value !== 'number' || !Number.isSafeInteger(value) || value <= 0) {
-    return maximum
-  }
-  return Math.min(value, maximum)
-}
diff --git a/src/shared/freebuff-launch.test.ts b/src/shared/freebuff-launch.test.ts
new file mode 100644
index 00000000000..b58dc4bd091
--- /dev/null
+++ b/src/shared/freebuff-launch.test.ts
@@ -0,0 +1,58 @@
+import { describe, expect, it } from 'vitest'
+import { buildAgentDraftLaunchPlan, buildAgentStartupPlan } from './tui-agent-startup'
+import { isExpectedAgentProcess, recognizeAgentProcess } from './agent-process-recognition'
+import { pickTuiAgent } from './tui-agent-selection'
+
+describe('Freebuff terminal launches', () => {
+  it.each(['darwin', 'linux', 'win32'] as const)(
+    'delivers task text through the interactive terminal on %s',
+    (platform) => {
+      const prompt = '--help\nFix "quoted" paths and $HOME handling'
+      const plan = buildAgentStartupPlan({
+        agent: 'freebuff',
+        prompt,
+        cmdOverrides: {},
+        platform
+      })
+      expect(plan).toMatchObject({
+        launchCommand: 'freebuff',
+        expectedProcess: 'freebuff',
+        followupPrompt: prompt
+      })
+      expect(
+        buildAgentDraftLaunchPlan({
+          agent: 'freebuff',
+          draft: prompt,
+          cmdOverrides: {},
+          platform
+        })
+      ).toBeNull()
+    }
+  )
+
+  it('uses the same launch contract on SSH hosts', () => {
+    expect(
+      buildAgentStartupPlan({
+        agent: 'freebuff',
+        prompt: 'Inspect this folder',
+        cmdOverrides: {},
+        platform: 'linux',
+        isRemote: true
+      })
+    ).toMatchObject({ launchCommand: 'freebuff', followupPrompt: 'Inspect this folder' })
+  })
+
+  it.each(['/usr/local/bin/freebuff', 'C:\\tools\\freebuff.exe'])(
+    'recognizes %s separately from Codebuff',
+    (processName) => {
+      expect(recognizeAgentProcess(processName)?.agent).toBe('freebuff')
+      expect(isExpectedAgentProcess(processName, 'codebuff')).toBe(false)
+    }
+  )
+
+  it('honors independent installation and disabled-agent preferences', () => {
+    expect(pickTuiAgent('freebuff', ['freebuff', 'codebuff'])).toBe('freebuff')
+    expect(pickTuiAgent(null, ['freebuff'])).toBe('freebuff')
+    expect(pickTuiAgent('freebuff', ['freebuff', 'codebuff'], ['freebuff'])).toBe('codebuff')
+  })
+})
diff --git a/src/shared/freebuff-screen-status.ts b/src/shared/freebuff-screen-status.ts
new file mode 100644
index 00000000000..e5f18472a7d
--- /dev/null
+++ b/src/shared/freebuff-screen-status.ts
@@ -0,0 +1,152 @@
+import type { ParsedAgentStatusPayload } from './agent-status-types'
+import { extractLastOscTitle } from './osc-title-extraction'
+import { extractOscTitleScanTail } from './osc-title-scan-tail'
+import { advancePartialEscapeTail } from './terminal-partial-escape-tail'
+
+export function splitFreebuffScreenUpdates(data: string, pendingEscape: string): string[] {
+  const input = pendingEscape + data
+  const chunks: string[] = []
+  let start = 0
+  // oxlint-disable-next-line no-control-regex -- Terminal protocol delimiters contain ESC and BEL.
+  for (const match of input.matchAll(/\x1b\[\?2026l/g)) {
+    const end = match.index + match[0].length - pendingEscape.length
+    if (end > start) {
+      chunks.push(data.slice(start, end))
+    }
+    start = Math.max(start, end)
+  }
+  if (start < data.length) {
+    chunks.push(data.slice(start))
+  }
+  return chunks
+}
+
+function cleanBoxLine(line: string): string {
+  return line.replace(/^[│┃\s]+|[│┃\s]+$/g, '').trim()
+}
+
+/** Reads the live composer area, never status words in the conversation above it. */
+export function readFreebuffScreenStatus(
+  lines: readonly string[],
+  alternate: boolean
+): Omit<ParsedAgentStatusPayload, 'prompt' | 'agentType'> | null {
+  const text = lines.join('\n')
+  if (!alternate) {
+    if (
+      /freebuff found agent files in this repository/.test(text) &&
+      /Load and run these\? \[y\/N\]/.test(text)
+    ) {
+      return { state: 'blocked', toolInput: 'Trust repository agent files? [y/N]' }
+    }
+    return null
+  }
+  if (/Press ENTER to login\.\.\./.test(text)) {
+    return { state: 'blocked', toolInput: 'Sign in to Freebuff' }
+  }
+  const footer = lines.findLastIndex((line) => /\/model\s+to change.*Chat:/.test(line))
+  if (footer === -1) {
+    return null
+  }
+  const dialog = lines.findLastIndex((line) => /[╭─].*Some questions for you.*[─╮]/.test(line))
+  if (
+    dialog !== -1 &&
+    dialog < footer &&
+    /↑↓ navigate/.test(lines.slice(dialog, footer).join('\n'))
+  ) {
+    const body = lines.slice(dialog + 1, footer).map(cleanBoxLine)
+    const question = body.find((line) => /^[▼▶▸▾►]/.test(line))?.replace(/^[▼▶▸▾►]\s*/, '')
+    const options = body.flatMap((line) => {
+      const match = /^[○●]\s+(.+)$/.exec(line)
+      return match ? [{ label: match[1], description: '' }] : []
+    })
+    return {
+      state: 'waiting',
+      toolName: 'ask_user',
+      toolInput: question ?? 'Freebuff is waiting for an answer',
+      ...(question
+        ? { interactivePrompt: JSON.stringify({ questions: [{ question, options }] }) }
+        : {})
+    }
+  }
+  const composerTop = lines.findLastIndex(
+    (line, index) => index < footer && /^\s*╭─+╮\s*$/.test(line)
+  )
+  if (composerTop === -1 || footer - composerTop > 12) {
+    return null
+  }
+  const status = lines[composerTop - 1]?.trim() ?? ''
+  if (
+    /^(?:thinking|working|connecting|retrying)\.\.\./.test(status) ||
+    status.startsWith('high demand — in line')
+  ) {
+    return { state: 'working' }
+  }
+  if (status === '' && text.includes('Your first message starts the session.')) {
+    return { state: 'done', sessionBoundary: true }
+  }
+  if (/^(?:\d+[hms]\s*)+left\b|^unlimited\b/.test(status) && /End session/.test(status)) {
+    return { state: 'done' }
+  }
+  return null
+}
+
+/** One observation stream per execution-host terminal; recreated with its screen model. */
+export class FreebuffScreenStatusTracker {
+  private titleTail = ''
+  private frameTail = ''
+  private insideFrame = false
+  private identified: boolean
+  private prompt = ''
+  private previous: string | null = null
+  private worked = false
+
+  constructor(identified = false) {
+    this.identified = identified
+  }
+
+  observe(
+    data: string,
+    readScreen: () => { lines: readonly string[]; alternate: boolean }
+  ): ParsedAgentStatusPayload | null {
+    const titleInput = this.titleTail + data
+    this.titleTail = extractOscTitleScanTail(titleInput)
+    const title = extractLastOscTitle(titleInput)
+    if (title?.startsWith('Freebuff: ')) {
+      this.identified = true
+      this.prompt = title.slice('Freebuff: '.length)
+    }
+    const frameInput = this.frameTail + data
+    // oxlint-disable-next-line no-control-regex -- Terminal protocol delimiters contain ESC and BEL.
+    for (const match of frameInput.matchAll(/\x1b\[\?2026([hl])/g)) {
+      this.insideFrame = match[1] === 'h'
+    }
+    this.frameTail = advancePartialEscapeTail(this.frameTail, data)
+    if (!this.identified || this.insideFrame || this.frameTail.length > 0) {
+      return null
+    }
+    const { lines, alternate } = readScreen()
+    const result = readFreebuffScreenStatus(lines, alternate)
+    if (!result) {
+      return null
+    }
+    if (result.sessionBoundary) {
+      this.prompt = ''
+      this.worked = false
+    }
+    const payload: ParsedAgentStatusPayload = {
+      ...result,
+      agentType: 'freebuff',
+      prompt: this.prompt,
+      ...(result.state === 'done' && !this.worked ? { sessionBoundary: true } : {})
+    }
+    if (result.state === 'working' || result.state === 'waiting') {
+      this.worked = true
+    }
+    const signature = JSON.stringify(payload)
+    if (signature === this.previous) {
+      return null
+    }
+    this.previous = signature
+    return payload
+  }
+}
diff --git a/src/shared/freebuff-startup.test.ts b/src/shared/freebuff-startup.test.ts
new file mode 100644
index 00000000000..2d614c53d1a
--- /dev/null
+++ b/src/shared/freebuff-startup.test.ts
@@ -0,0 +1,56 @@
+import { describe, expect, it } from 'vitest'
+import { buildAgentStartupPlan } from './tui-agent-startup'
+
+describe('Freebuff startup', () => {
+  it.each([
+    ['darwin', 'posix', false],
+    ['linux', 'posix', false],
+    ['win32', 'powershell', false],
+    ['win32', 'cmd', false],
+    ['linux', 'posix', true]
+  ] as const)('delivers prompts after launch on %s/%s (remote=%s)', (platform, shell, isRemote) => {
+    const prompt = 'Review "quoted paths"; $(echo task)\nThen explain the changes.'
+    const plan = buildAgentStartupPlan({
+      agent: 'freebuff',
+      prompt,
+      cmdOverrides: { codebuff: 'codebuff --debug' },
+      platform,
+      shell,
+      isRemote
+    })
+
+    expect(plan).toMatchObject({
+      agent: 'freebuff',
+      launchCommand: 'freebuff',
+      expectedProcess: 'freebuff',
+      followupPrompt: prompt
+    })
+  })
+
+  it('keeps Freebuff command overrides separate from Codebuff', () => {
+    const cmdOverrides = { freebuff: 'freebuff --debug' }
+    const freebuff = buildAgentStartupPlan({
+      agent: 'freebuff',
+      prompt: '',
+      allowEmptyPromptLaunch: true,
+      cmdOverrides,
+      platform: 'linux',
+      isRemote: true
+    })
+    const codebuff = buildAgentStartupPlan({
+      agent: 'codebuff',
+      prompt: '',
+      allowEmptyPromptLaunch: true,
+      cmdOverrides,
+      platform: 'linux',
+      isRemote: true
+    })
+
+    expect(freebuff).toMatchObject({
+      launchCommand: 'freebuff --debug',
+      expectedProcess: 'freebuff',
+      followupPrompt: null
+    })
+    expect(codebuff).toMatchObject({ launchCommand: 'codebuff', expectedProcess: 'codebuff' })
+  })
+})
diff --git a/src/shared/git-binary-compatibility.test.ts b/src/shared/git-binary-compatibility.test.ts
index b76814f8b83..457dad2d419 100644
--- a/src/shared/git-binary-compatibility.test.ts
+++ b/src/shared/git-binary-compatibility.test.ts
@@ -216,6 +216,7 @@ describeBinaryCompatibility('real Git binary compatibility', () => {
   })
 
   it('supports prepared worktree creation and finalization', async () => {
+    const head = (await runGit(['rev-parse', 'HEAD'])).stdout.trim()
     await runGit(['worktree', 'add', '--detach', '--no-checkout', 'compat-prepared', 'HEAD'])
     await runGit(['-C', 'compat-prepared', 'reset', '--hard', 'HEAD'])
     await runGit([
@@ -234,12 +235,15 @@ describeBinaryCompatibility('real Git binary compatibility', () => {
       '--no-track',
       '-b',
       'compat-prepared-final',
-      'HEAD'
+      head
     ])
 
     await expect(runGit(['-C', 'compat-final', 'branch', '--show-current'])).resolves.toMatchObject(
       { stdout: 'compat-prepared-final\n' }
     )
+    await expect(runGit(['-C', 'compat-final', 'rev-parse', 'HEAD'])).resolves.toMatchObject({
+      stdout: `${head}\n`
+    })
     await runGit(['worktree', 'unlock', 'compat-final'])
     await runGit(['worktree', 'remove', '--force', 'compat-final'])
     await runGit(['branch', '-D', 'compat-prepared-final'])
diff --git a/src/shared/git-remote-identity.test.ts b/src/shared/git-remote-identity.test.ts
index cc4fa4dff57..a159f5d39d9 100644
--- a/src/shared/git-remote-identity.test.ts
+++ b/src/shared/git-remote-identity.test.ts
@@ -51,6 +51,25 @@ describe('normalizeGitRemoteUrl', () => {
 })
 
 describe('deriveGitRemoteIdentity', () => {
+  it.each(['blob:none', 'blob:limit=1024', 'tree:0'])(
+    'prefers a partial-clone origin with filter %s over contributor remotes',
+    (filter) => {
+      expect(
+        deriveGitRemoteIdentity(
+          [
+            'amoaba\thttps://github.com/AmoabaKelvin/orca.git (fetch)',
+            `origin\thttps://github.com/stablyai/orca.git (fetch) [${filter}]`,
+            'origin\thttps://github.com/another/orca.git (push)'
+          ].join('\r\n')
+        )
+      ).toEqual({
+        canonicalKey: 'github.com/stablyai/orca',
+        remoteName: 'origin',
+        remoteUrl: 'https://github.com/stablyai/orca.git'
+      })
+    }
+  )
+
   it('prefers upstream, then origin, then the first named remote', () => {
     expect(
       deriveGitRemoteIdentity(
diff --git a/src/shared/git-remote-identity.ts b/src/shared/git-remote-identity.ts
index bc221157a2e..c4c215e125d 100644
--- a/src/shared/git-remote-identity.ts
+++ b/src/shared/git-remote-identity.ts
@@ -95,10 +95,8 @@ export function parseGitRemoteVerboseOutput(stdout: string): GitRemoteEntry[] {
   const entries: GitRemoteEntry[] = []
   for (const rawLine of stdout.split(/\r?\n/)) {
     const line = rawLine.trim()
-    if (!line.endsWith('(fetch)')) {
-      continue
-    }
-    const match = /^(\S+)\s+(.+?)\s+\(fetch\)$/.exec(line)
+    // Partial clones append their object filter after the fetch marker.
+    const match = /^(\S+)\s+(.+?)\s+\(fetch\)(?:\s+\[[^\]\r\n]*\])?$/.exec(line)
     if (!match) {
       continue
     }
diff --git a/src/shared/global-settings-test-fixture.ts b/src/shared/global-settings-test-fixture.ts
index dd87c6a17af..a106bbef52e 100644
--- a/src/shared/global-settings-test-fixture.ts
+++ b/src/shared/global-settings-test-fixture.ts
@@ -1,5 +1,6 @@
 import type { GlobalSettings } from './global-settings-types'
-import { getDefaultNotificationSettings, getDefaultVoiceSettings } from './constants'
+import { getDefaultVoiceSettings } from './constants'
+import { getDefaultNotificationSettings } from './notification-settings-defaults'
 import { buildDefaultSettings } from './default-global-settings'
 
 // Why: tests need a complete GlobalSettings without hand-copying every field, so
diff --git a/src/shared/global-settings-types.ts b/src/shared/global-settings-types.ts
index 1e0410f4c22..eedb140c3ad 100644
--- a/src/shared/global-settings-types.ts
+++ b/src/shared/global-settings-types.ts
@@ -417,6 +417,8 @@ export type GlobalSettings = {
   agentYoloDefaultsMigrated?: boolean
   /** Why: disabling must persist so startup doesn't reinstall global agent hook entries the user just removed. */
   agentStatusHooksEnabled: boolean
+  /** Pre-trust the worktree or folder Orca starts an agent in, so its "trust this folder?" prompt is skipped. Defaults on. */
+  agentWorkspaceTrustEnabled: boolean
   /** Dismissed freshness tuples: no write authority, just suppress re-nudging the same official placement/revision. */
   dismissedSkillFreshnessNudges?: string[]
   /** Why: generated tab titles are subjective, so they stay opt-in and manual renames win. */
diff --git a/src/shared/grok-session-paths.test.ts b/src/shared/grok-session-paths.test.ts
index 78b0a1fd52c..f4c9cbaca1b 100644
--- a/src/shared/grok-session-paths.test.ts
+++ b/src/shared/grok-session-paths.test.ts
@@ -3,7 +3,6 @@ import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { afterEach, describe, expect, it } from 'vitest'
 import {
-  GROK_ENCODED_CWD_DIR_MAX_BYTES,
   GROK_SESSION_SCAN_ACTIVE_ROOT_MAX,
   GROK_SESSION_SCAN_QUEUE_MAX_ENTRIES,
   buildGrokChatHistoryPathCandidates,
@@ -11,7 +10,6 @@ import {
   findGrokChatHistoryBySessionId,
   getCachedGrokChatHistoryBySessionId,
   grokEncodedCwdDirName,
-  isGrokChatHistoryPath,
   isSafeGrokSessionId,
   resolveGrokChatHistoryPathSync,
   resolveGrokHomeDir,
@@ -76,9 +74,6 @@ describe('grok-session-paths', () => {
 
   it('refuses to invent encodeURIComponent names longer than 255 bytes', () => {
     const longCwd = `/${'a'.repeat(200)}/${'b'.repeat(200)}`
-    expect(Buffer.byteLength(encodeURIComponent(longCwd), 'utf8')).toBeGreaterThan(
-      GROK_ENCODED_CWD_DIR_MAX_BYTES
-    )
     expect(grokEncodedCwdDirName(longCwd)).toBeNull()
     expect(
       buildGrokChatHistoryPathCandidates({
@@ -100,7 +95,6 @@ describe('grok-session-paths', () => {
         []
       )
       await expect(findGrokChatHistoryBySessionId(sessionsDir, sessionId)).resolves.toBeNull()
-      expect(isGrokChatHistoryPath('/repo/chat_history.jsonl', sessionId)).toBe(false)
     }
 
     expect(isSafeGrokSessionId('019e37f4-5135-7b63-a4ab-6d13aa6bf528')).toBe(true)
diff --git a/src/shared/grok-session-paths.ts b/src/shared/grok-session-paths.ts
index b40db0174b4..39f8bfc4a94 100644
--- a/src/shared/grok-session-paths.ts
+++ b/src/shared/grok-session-paths.ts
@@ -1,7 +1,7 @@
 import { lstatSync } from 'node:fs'
 import { lstat, opendir } from 'node:fs/promises'
 import { homedir } from 'node:os'
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'
 import { resolveAbsoluteDirOverride } from './absolute-dir-override'
 import {
   GrokSessionPathLookupQueue,
@@ -18,7 +18,7 @@ export {
 export const GROK_CHAT_HISTORY_FILE = 'chat_history.jsonl'
 // Why: Grok URL-encodes the cwd for the sessions group directory. When that
 // encoded name exceeds 255 bytes it switches to a slug+hash layout.
-export const GROK_ENCODED_CWD_DIR_MAX_BYTES = 255
+const GROK_ENCODED_CWD_DIR_MAX_BYTES = 255
 export const GROK_SESSION_ID_MAX_LENGTH = 128
 // Why: session discovery runs in hook/main hot paths; one corrupt or enormous
 // sessions root must not cause unbounded candidate probes.
@@ -282,13 +282,3 @@ async function isSafeChatHistoryFile(sessionsDir: string, candidate: string): Pr
     return false
   }
 }
-
-/** True when path looks like a Grok chat history under a safe session id. */
-export function isGrokChatHistoryPath(path: string, sessionId: string): boolean {
-  const trimmedId = sessionId.trim()
-  return (
-    isSafeGrokSessionId(trimmedId) &&
-    basename(path) === GROK_CHAT_HISTORY_FILE &&
-    basename(dirname(path)) === trimmedId
-  )
-}
diff --git a/src/shared/grouped-by.ts b/src/shared/grouped-by.ts
new file mode 100644
index 00000000000..0797dca9620
--- /dev/null
+++ b/src/shared/grouped-by.ts
@@ -0,0 +1,14 @@
+// Not `Map.groupBy`: the relay runs this core on Node 18, which lacks it.
+export function groupedBy<T, K>(items: readonly T[], keyOf: (item: T) => K): Map<K, T[]> {
+  const groups = new Map<K, T[]>()
+  for (const item of items) {
+    const key = keyOf(item)
+    const group = groups.get(key)
+    if (group) {
+      group.push(item)
+    } else {
+      groups.set(key, [item])
+    }
+  }
+  return groups
+}
diff --git a/src/shared/growing-byte-buffer.test.ts b/src/shared/growing-byte-buffer.test.ts
index 731da290c05..988d63bb2ae 100644
--- a/src/shared/growing-byte-buffer.test.ts
+++ b/src/shared/growing-byte-buffer.test.ts
@@ -65,4 +65,31 @@ describe('GrowingByteBuffer', () => {
 
     expect(buffer.toString()).toBe('345678')
   })
+
+  it('reads and writes correctly after the head offset has advanced', () => {
+    const buffer = new GrowingByteBuffer()
+    buffer.append(Buffer.from('aaa\nbbb\nccc'))
+
+    expect(buffer.takePrefixString(buffer.indexOfByte(0x0a))).toBe('aaa')
+    buffer.discardPrefix(1)
+    expect(buffer.indexOfByte(0x0a)).toBe(3)
+    expect(buffer.byteLength).toBe(7)
+    buffer.append(Buffer.from('!'))
+    expect(buffer.toString()).toBe('bbb\nccc!')
+    expect(buffer.takeBuffer()).toEqual(Buffer.from('bbb\nccc!'))
+    expect(buffer.byteLength).toBe(0)
+  })
+
+  it('keeps a bounded suffix stable across many small appends without unbounded growth', () => {
+    const buffer = new GrowingByteBuffer()
+    let expected = ''
+    for (let index = 0; index < 5_000; index += 1) {
+      const chunk = String(index % 10).repeat(3)
+      buffer.appendRetainedSuffix(Buffer.from(chunk), 64)
+      expected = (expected + chunk).slice(-64)
+    }
+
+    expect(buffer.byteLength).toBe(64)
+    expect(buffer.takeString()).toBe(expected)
+  })
 })
diff --git a/src/shared/growing-byte-buffer.ts b/src/shared/growing-byte-buffer.ts
index beba2cd02d6..bbcdab4ba30 100644
--- a/src/shared/growing-byte-buffer.ts
+++ b/src/shared/growing-byte-buffer.ts
@@ -1,5 +1,7 @@
 export class GrowingByteBuffer {
   private storage = Buffer.alloc(0)
+  // Live bytes are storage[start, start + length); the head offset keeps prefix discards O(1).
+  private start = 0
   private length = 0
 
   get byteLength(): number {
@@ -11,16 +13,13 @@ export class GrowingByteBuffer {
       return
     }
     const required = this.length + bytes.byteLength
-    if (required > this.storage.byteLength) {
-      const capacity = Math.max(required, Math.max(256, this.storage.byteLength * 2))
-      const next = Buffer.allocUnsafe(capacity)
-      this.storage.copy(next, 0, 0, this.length)
-      this.storage = next
+    if (this.start + required > this.storage.byteLength) {
+      this.reclaimHeadRoom(required)
     }
     const source = Buffer.isBuffer(bytes)
       ? bytes
       : Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength)
-    source.copy(this.storage, this.length)
+    source.copy(this.storage, this.start + this.length)
     this.length = required
   }
 
@@ -37,26 +36,23 @@ export class GrowingByteBuffer {
       : Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength)
     if (source.byteLength >= maxBytes) {
       this.storage = Buffer.from(source.subarray(source.byteLength - maxBytes))
+      this.start = 0
       this.length = maxBytes
       return
     }
-    const retainedBytes = Math.min(this.length, maxBytes - source.byteLength)
-    if (retainedBytes < this.length) {
-      this.storage.copy(this.storage, 0, this.length - retainedBytes, this.length)
-      this.length = retainedBytes
-    }
+    this.retainSuffix(maxBytes - source.byteLength)
     this.append(source)
   }
 
   indexOfByte(value: number, byteOffset = 0): number {
-    return this.storage.subarray(0, this.length).indexOf(value, byteOffset)
+    return this.storage.subarray(this.start, this.start + this.length).indexOf(value, byteOffset)
   }
 
   takePrefixString(byteLength: number, encoding: BufferEncoding = 'utf8'): string {
     if (!Number.isSafeInteger(byteLength) || byteLength < 0 || byteLength > this.length) {
       throw new RangeError('Prefix length exceeds retained bytes')
     }
-    const value = this.storage.toString(encoding, 0, byteLength)
+    const value = this.storage.toString(encoding, this.start, this.start + byteLength)
     this.discardPrefix(byteLength)
     return value
   }
@@ -65,11 +61,11 @@ export class GrowingByteBuffer {
     if (!Number.isSafeInteger(byteLength) || byteLength < 0 || byteLength > this.length) {
       throw new RangeError('Prefix length exceeds retained bytes')
     }
-    if (byteLength === 0) {
-      return
-    }
-    this.storage.copy(this.storage, 0, byteLength, this.length)
+    this.start += byteLength
     this.length -= byteLength
+    if (this.length === 0) {
+      this.start = 0
+    }
   }
 
   retainSuffix(maxBytes: number): void {
@@ -79,12 +75,15 @@ export class GrowingByteBuffer {
     if (this.length <= maxBytes) {
       return
     }
-    this.storage.copy(this.storage, 0, this.length - maxBytes, this.length)
+    this.start += this.length - maxBytes
     this.length = maxBytes
+    if (this.length === 0) {
+      this.start = 0
+    }
   }
 
   toString(encoding: BufferEncoding = 'utf8'): string {
-    return this.storage.toString(encoding, 0, this.length)
+    return this.storage.toString(encoding, this.start, this.start + this.length)
   }
 
   takeString(encoding: BufferEncoding = 'utf8'): string {
@@ -95,13 +94,27 @@ export class GrowingByteBuffer {
 
   // Returns a view over the released storage, not a copy; the buffer never writes to it again.
   takeBuffer(): Buffer {
-    const value = this.storage.subarray(0, this.length)
+    const value = this.storage.subarray(this.start, this.start + this.length)
     this.clear()
     return value
   }
 
   clear(): void {
     this.storage = Buffer.alloc(0)
+    this.start = 0
     this.length = 0
   }
+
+  private reclaimHeadRoom(required: number): void {
+    // Slide the live bytes down while they fit in half the storage; only grow when they do not.
+    if (required * 2 <= this.storage.byteLength) {
+      this.storage.copy(this.storage, 0, this.start, this.start + this.length)
+    } else {
+      const capacity = Math.max(required, Math.max(256, this.storage.byteLength * 2))
+      const next = Buffer.allocUnsafe(capacity)
+      this.storage.copy(next, 0, this.start, this.start + this.length)
+      this.storage = next
+    }
+    this.start = 0
+  }
 }
diff --git a/src/shared/home-or-filesystem-root.test.ts b/src/shared/home-or-filesystem-root.test.ts
new file mode 100644
index 00000000000..cb13c1c6bff
--- /dev/null
+++ b/src/shared/home-or-filesystem-root.test.ts
@@ -0,0 +1,40 @@
+import { describe, expect, it } from 'vitest'
+import { isTooBroadToPreTrust } from './home-or-filesystem-root'
+
+describe('isTooBroadToPreTrust', () => {
+  it.each([
+    ['/'],
+    ['C:\\'],
+    ['c:/'],
+    ['\\\\server\\share'],
+    ['\\\\wsl.localhost\\Ubuntu\\'],
+    ['//wsl$/Ubuntu']
+  ])('treats %s as a filesystem root', (folderPath) => {
+    expect(isTooBroadToPreTrust(folderPath, [])).toBe(true)
+  })
+
+  it('matches a home however its separators, trailing slash or drive case are spelled', () => {
+    expect(isTooBroadToPreTrust('/home/u/', ['/home/u'])).toBe(true)
+    expect(isTooBroadToPreTrust('c:\\users\\alice', [null, 'C:/Users/alice/'])).toBe(true)
+    expect(
+      isTooBroadToPreTrust('\\\\wsl.localhost\\Ubuntu\\home\\u', [
+        undefined,
+        '\\\\wsl$\\Ubuntu\\home\\u'
+      ])
+    ).toBe(true)
+  })
+
+  it('refuses a folder above a home, which would cover the home too', () => {
+    expect(isTooBroadToPreTrust('/home', ['/home/u'])).toBe(true)
+    expect(isTooBroadToPreTrust('/Users/', [null, '/Users/alice'])).toBe(true)
+    expect(isTooBroadToPreTrust('C:\\Users', ['c:/users/alice'])).toBe(true)
+  })
+
+  it('leaves folders inside a home, and other folders, alone', () => {
+    expect(isTooBroadToPreTrust('/home/u/repo', ['/home/u'])).toBe(false)
+    expect(isTooBroadToPreTrust('/home/u2', ['/home/u'])).toBe(false)
+    expect(isTooBroadToPreTrust('C:\\Users\\alice\\repo', ['C:\\Users\\alice'])).toBe(false)
+    expect(isTooBroadToPreTrust('\\\\server\\share\\repo', [])).toBe(false)
+    expect(isTooBroadToPreTrust('/srv/wt', [null, undefined])).toBe(false)
+  })
+})
diff --git a/src/shared/home-or-filesystem-root.ts b/src/shared/home-or-filesystem-root.ts
new file mode 100644
index 00000000000..640396577c5
--- /dev/null
+++ b/src/shared/home-or-filesystem-root.ts
@@ -0,0 +1,22 @@
+import { normalizeRuntimePathForComparison } from './cross-platform-path'
+
+/** Drive, UNC share, WSL distro or POSIX root, as `normalizeRuntimePathForComparison` spells it. */
+const FILESYSTEM_ROOT_KEY = /^(?:\/|[a-z]:\/?|\/\/[^/]+(?:\/[^/]+)?)$/i
+
+/**
+ * Whether `folderPath` is a filesystem root, a home folder or a folder above one. Pre-trusting
+ * one would trust a home for agents that let a trusted folder cover its subfolders.
+ */
+export function isTooBroadToPreTrust(
+  folderPath: string,
+  homePaths: readonly (string | null | undefined)[]
+): boolean {
+  const key = normalizeRuntimePathForComparison(folderPath)
+  return (
+    FILESYSTEM_ROOT_KEY.test(key) ||
+    homePaths.some((home) => {
+      const homeKey = home ? normalizeRuntimePathForComparison(home) : null
+      return homeKey !== null && (homeKey === key || homeKey.startsWith(`${key}/`))
+    })
+  )
+}
diff --git a/src/shared/host-balanced-listing-scaling.test.ts b/src/shared/host-balanced-listing-scaling.test.ts
index 0a0d2a093bf..3d33e54da84 100644
--- a/src/shared/host-balanced-listing-scaling.test.ts
+++ b/src/shared/host-balanced-listing-scaling.test.ts
@@ -8,26 +8,26 @@ it('retires exhausted host buckets from subsequent listing rounds', () => {
   ]
   const original = Map.prototype.values
   let reads = 0
-  const spy = vi
-    .spyOn(Map.prototype, 'values')
-    .mockImplementation(function (this: Map<string, number[]>) {
-      const iterator = original.call(this)
-      if (!this.has('large-host')) {
-        return iterator
-      }
-      return iterator.map(
-        (bucket: number[]) =>
-          new Proxy(bucket, {
-            get(target, key, receiver) {
-              if (typeof key === 'string' && /^\d+$/.test(key)) {
-                reads += 1
-              }
-              // oxlint-disable-next-line anti-slop/no-reflect-get -- Proxy `get` trap: only Reflect.get forwards a raw string|symbol key with the proxy receiver.
-              return Reflect.get(target, key, receiver)
+  const spy = vi.spyOn(Map.prototype, 'values').mockImplementation(function (
+    this: Map<string, number[]>
+  ) {
+    const iterator = original.call(this)
+    if (!this.has('large-host')) {
+      return iterator
+    }
+    return iterator.map(
+      (bucket: number[]) =>
+        new Proxy(bucket, {
+          get(target, key, receiver) {
+            if (typeof key === 'string' && /^\d+$/.test(key)) {
+              reads += 1
             }
-          })
-      )
-    })
+            // oxlint-disable-next-line anti-slop/no-reflect-get -- Proxy `get` trap: only Reflect.get forwards a raw string|symbol key with the proxy receiver.
+            return Reflect.get(target, key, receiver)
+          }
+        })
+    )
+  })
   let result: typeof rows
   try {
     result = selectHostBalancedPage(rows, 2000, (row) => row.host)
diff --git a/src/shared/keybindings-keyboard-layout.test.ts b/src/shared/keybindings-keyboard-layout.test.ts
index 9c23b0b5269..282c59cbb67 100644
--- a/src/shared/keybindings-keyboard-layout.test.ts
+++ b/src/shared/keybindings-keyboard-layout.test.ts
@@ -85,10 +85,18 @@ describe('keybindings', () => {
       shift: false
     }
 
-    expect(keybindingMatchesAction('app.settings', dvorakPhysicalW, 'darwin')).toBe(true)
+    expect(
+      keybindingMatchesAction('app.settings', dvorakPhysicalW, 'darwin', {
+        'app.settings': ['Mod+Comma']
+      })
+    ).toBe(true)
     expect(keybindingMatchesAction('tab.close', dvorakPhysicalW, 'darwin')).toBe(false)
     expect(keybindingMatchesAction('tab.close', dvorakPhysicalComma, 'darwin')).toBe(true)
-    expect(keybindingMatchesAction('app.settings', dvorakPhysicalComma, 'darwin')).toBe(false)
+    expect(
+      keybindingMatchesAction('app.settings', dvorakPhysicalComma, 'darwin', {
+        'app.settings': ['Mod+Comma']
+      })
+    ).toBe(false)
     expect(keybindingFromInput(dvorakPhysicalW, 'darwin')).toEqual({
       ok: true,
       value: 'Mod+Comma'
diff --git a/src/shared/keybindings/definitions-core-1.ts b/src/shared/keybindings/definitions-core-1.ts
index fe8797c7684..fb151bc495a 100644
--- a/src/shared/keybindings/definitions-core-1.ts
+++ b/src/shared/keybindings/definitions-core-1.ts
@@ -18,7 +18,8 @@ export const KEYBINDING_DEFINITION_CORE_1: readonly KeybindingDefinition[] = [
     group: 'Global',
     scope: 'global',
     searchKeywords: ['shortcut', 'settings', 'preferences'],
-    defaultBindings: platformBindings(['Mod+Comma']),
+    // Leave Cmd/Ctrl+, to terminal apps such as Codex unless the user opts in.
+    defaultBindings: platformBindings([]),
     conflictGroup: 'menu'
   },
   {
diff --git a/src/shared/linear/links.test.ts b/src/shared/linear/links.test.ts
index 48005d93d06..71148426e74 100644
--- a/src/shared/linear/links.test.ts
+++ b/src/shared/linear/links.test.ts
@@ -49,6 +49,18 @@ describe('linear links', () => {
     expect(parseLinearIssueInput('eng-123')).toEqual({ identifier: 'ENG-123' })
   })
 
+  it('parses Linear team keys that start with a digit', () => {
+    expect(parseLinearIssueInput('4k-12')).toEqual({ identifier: '4K-12' })
+    expect(parseLinearIssueInput('https://linear.app/acme/issue/4K-12')).toEqual({
+      identifier: '4K-12',
+      organizationUrlKey: 'acme'
+    })
+  })
+
+  it('rejects bare identifiers with no letter in the team key', () => {
+    expect(parseLinearIssueInput('2026-09')).toBeNull()
+  })
+
   it('parses Linear issue URLs with organization URL keys', () => {
     expect(parseLinearIssueInput('https://linear.app/acme/issue/eng-123/fix-auth')).toEqual({
       identifier: 'ENG-123',
@@ -139,6 +151,19 @@ describe('buildLinearIssueLinkUpdates', () => {
     expectNoUndefinedValues(result as Record<string, unknown>)
   })
 
+  it('links digit-prefixed Linear team keys from bare identifiers and URLs', () => {
+    expect(buildLinearIssueLinkUpdates('4K-12')).toEqual({
+      linkedLinearIssue: '4K-12',
+      linkedLinearIssueWorkspaceId: null,
+      linkedLinearIssueOrganizationUrlKey: null
+    })
+    expect(buildLinearIssueLinkUpdates('https://linear.app/acme/issue/4K-12')).toEqual({
+      linkedLinearIssue: '4K-12',
+      linkedLinearIssueWorkspaceId: null,
+      linkedLinearIssueOrganizationUrlKey: 'acme'
+    })
+  })
+
   it('returns null for unparseable input', () => {
     expect(buildLinearIssueLinkUpdates('not an issue')).toBeNull()
     expect(buildLinearIssueLinkUpdates('https://github.com/o/r/issues/12')).toBeNull()
diff --git a/src/shared/linear/links.ts b/src/shared/linear/links.ts
index c4b7f6b2c52..d6c7e080a51 100644
--- a/src/shared/linear/links.ts
+++ b/src/shared/linear/links.ts
@@ -70,7 +70,7 @@ export type LinearIssueLinkUpdates = {
   linkedLinearIssueOrganizationUrlKey: string | null
 }
 
-const LINEAR_IDENTIFIER_PATTERN = /^[A-Za-z][A-Za-z0-9_]*-\d+$/
+const LINEAR_IDENTIFIER_PATTERN = /^(?=[A-Za-z0-9_]*[A-Za-z])[A-Za-z0-9][A-Za-z0-9_]*-\d+$/
 
 export function parseLinearIssueInput(input: string): ParsedLinearIssueInput | null {
   const trimmed = input.trim()
diff --git a/src/shared/local-build-compatibility-contract.json b/src/shared/local-build-compatibility-contract.json
index 7c918c73a0d..596ccb30f71 100644
--- a/src/shared/local-build-compatibility-contract.json
+++ b/src/shared/local-build-compatibility-contract.json
@@ -3,9 +3,9 @@
   "appId": "com.stablyai.orca",
   "stateSchemaVersion": 1,
   "readableStateSchemaVersions": [1],
-  "daemonProtocolVersion": 36,
+  "daemonProtocolVersion": 37,
   "attachableDaemonProtocolVersions": [
     1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26,
-    27, 28, 29, 30, 31, 32, 33, 34, 35, 36
+    27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37
   ]
 }
diff --git a/src/shared/local-build-compatibility-contract.ts b/src/shared/local-build-compatibility-contract.ts
index 7e61c309180..164d6687810 100644
--- a/src/shared/local-build-compatibility-contract.ts
+++ b/src/shared/local-build-compatibility-contract.ts
@@ -3,9 +3,9 @@ export const LOCAL_BUILD_COMPATIBILITY_CONTRACT = {
   appId: 'com.stablyai.orca',
   stateSchemaVersion: 1,
   readableStateSchemaVersions: [1],
-  daemonProtocolVersion: 36,
+  daemonProtocolVersion: 37,
   attachableDaemonProtocolVersions: [
     1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26,
-    27, 28, 29, 30, 31, 32, 33, 34, 35, 36
+    27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37
   ]
 } as const
diff --git a/src/shared/main-process-ndjson-framer.ts b/src/shared/main-process-ndjson-framer.ts
index a348b9a4e39..790f058b5c5 100644
--- a/src/shared/main-process-ndjson-framer.ts
+++ b/src/shared/main-process-ndjson-framer.ts
@@ -63,6 +63,8 @@ export function createIncrementalNdjsonFramer(
   options: IncrementalNdjsonFramerOptions = {}
 ): IncrementalNdjsonFramer {
   const maxLineBytes = Math.max(1, options.maxLineBytes ?? NDJSON_MAX_LINE_BYTES)
+  // No line can exceed an unbounded limit, so measuring segments and keeping a rejection prefix is dead work.
+  const unbounded = maxLineBytes === Number.POSITIVE_INFINITY
   const maxPendingInputBytes = Math.max(REJECTED_LINE_PREFIX_MAX_BYTES, maxLineBytes * 2)
   let lineSegments: string[] = []
   let lineBytes = 0
@@ -152,9 +154,11 @@ export function createIncrementalNdjsonFramer(
           return
         }
       } else {
-        const segmentBytes = Buffer.byteLength(segment, 'utf8')
+        const segmentBytes = unbounded ? 0 : Buffer.byteLength(segment, 'utf8')
         const nextLineBytes = lineBytes + segmentBytes
-        rememberPrefix(segment, segmentBytes)
+        if (!unbounded) {
+          rememberPrefix(segment, segmentBytes)
+        }
         if (nextLineBytes > maxLineBytes) {
           const rejected: NdjsonRejectedRecord = {
             kind: 'line-too-long',
diff --git a/src/shared/markdown-document-listing-limits.test.ts b/src/shared/markdown-document-listing-limits.test.ts
index 54a3ee18500..01e0809f5c1 100644
--- a/src/shared/markdown-document-listing-limits.test.ts
+++ b/src/shared/markdown-document-listing-limits.test.ts
@@ -3,9 +3,7 @@ import type { MarkdownDocument } from './filesystem-entry-types'
 import {
   assertMarkdownDocumentsWithinLimit,
   createMarkdownDocumentListingBudget,
-  isMarkdownDocumentListingCapacityError,
   MARKDOWN_DOCUMENT_LISTING_ERROR_CODE,
-  MARKDOWN_DOCUMENT_LISTING_ERROR_MESSAGE,
   MarkdownDocumentListingCapacityError,
   retainMarkdownDocument,
   visitMarkdownDocumentListingEntry
@@ -21,12 +19,6 @@ function document(path: string): MarkdownDocument {
 }
 
 describe('Markdown document listing limits', () => {
-  it('preserves an under-limit listing and reports its retained estimate', () => {
-    const documents = [document('README.md'), document('docs/guide.mdx')]
-
-    expect(assertMarkdownDocumentsWithinLimit(documents)).toBeGreaterThan(0)
-  })
-
   it('rejects the first document beyond the count limit with a typed error', () => {
     const budget = createMarkdownDocumentListingBudget({ maxDocuments: 2 })
     retainMarkdownDocument(budget, document('one.md'))
@@ -67,17 +59,4 @@ describe('Markdown document listing limits', () => {
       MarkdownDocumentListingCapacityError
     )
   })
-
-  it('recognizes structured runtime and Electron-wrapped capacity failures', () => {
-    const structured = Object.assign(new Error('remote listing rejected'), {
-      code: MARKDOWN_DOCUMENT_LISTING_ERROR_CODE
-    })
-    const electronWrapped = new Error(
-      `Error invoking remote method 'fs:listMarkdownDocuments': Error: ${MARKDOWN_DOCUMENT_LISTING_ERROR_MESSAGE}`
-    )
-
-    expect(isMarkdownDocumentListingCapacityError(structured)).toBe(true)
-    expect(isMarkdownDocumentListingCapacityError(electronWrapped)).toBe(true)
-    expect(isMarkdownDocumentListingCapacityError(new Error('unrelated failure'))).toBe(false)
-  })
 })
diff --git a/src/shared/markdown-document-listing-limits.ts b/src/shared/markdown-document-listing-limits.ts
index 9b3676bb3d4..14a4cc8ff8a 100644
--- a/src/shared/markdown-document-listing-limits.ts
+++ b/src/shared/markdown-document-listing-limits.ts
@@ -7,7 +7,7 @@ export const MARKDOWN_DOCUMENT_LISTING_MAX_PATH_BYTES = 64 * 1024
 export const MARKDOWN_DOCUMENT_LISTING_MAX_VISITED_ENTRIES = 100_000
 export const MARKDOWN_DOCUMENT_LISTING_MAX_DEPTH = 256
 export const MARKDOWN_DOCUMENT_LISTING_ERROR_CODE = 'markdown_document_listing_capacity'
-export const MARKDOWN_DOCUMENT_LISTING_ERROR_MESSAGE =
+const MARKDOWN_DOCUMENT_LISTING_ERROR_MESSAGE =
   'Workspace is too large for Markdown link completion.'
 
 const MARKDOWN_DOCUMENT_RETAINED_OVERHEAD_BYTES = 256
@@ -36,17 +36,6 @@ export class MarkdownDocumentListingCapacityError extends Error {
   }
 }
 
-export function isMarkdownDocumentListingCapacityError(error: unknown): boolean {
-  if (!(error instanceof Error)) {
-    return false
-  }
-  return (
-    ('code' in error &&
-      (error as { code?: unknown }).code === MARKDOWN_DOCUMENT_LISTING_ERROR_CODE) ||
-    error.message.includes(MARKDOWN_DOCUMENT_LISTING_ERROR_MESSAGE)
-  )
-}
-
 export function createMarkdownDocumentListingBudget(
   requested: Partial<MarkdownDocumentListingLimits> = {}
 ): MarkdownDocumentListingBudget {
diff --git a/src/shared/mobile-markdown-document.test.ts b/src/shared/mobile-markdown-document.test.ts
index f4d2a003261..a44191edf91 100644
--- a/src/shared/mobile-markdown-document.test.ts
+++ b/src/shared/mobile-markdown-document.test.ts
@@ -3,6 +3,7 @@ import {
   hashMarkdownContent,
   isMarkdownContentByteLengthOverLimit,
   MOBILE_MARKDOWN_EDIT_MAX_BYTES,
+  MOBILE_MARKDOWN_READ_MAX_BYTES,
   utf8ByteLength
 } from './mobile-markdown-document'
 
@@ -45,4 +46,9 @@ describe('mobile markdown document byte accounting', () => {
   it('keeps content hashes prefixed with exact byte length', () => {
     expect(hashMarkdownContent('😀')).toMatch(/^content:4:/)
   })
+
+  it('keeps the read budget above the edit budget', () => {
+    // Behavioural pin for truncated => not editable: the bridge's over-budget read test.
+    expect(MOBILE_MARKDOWN_READ_MAX_BYTES).toBeGreaterThan(MOBILE_MARKDOWN_EDIT_MAX_BYTES)
+  })
 })
diff --git a/src/shared/mobile-markdown-document.ts b/src/shared/mobile-markdown-document.ts
index dced4bb8c85..14a6474cf5d 100644
--- a/src/shared/mobile-markdown-document.ts
+++ b/src/shared/mobile-markdown-document.ts
@@ -1,6 +1,11 @@
 import { getClipboardTextByteLength, isClipboardTextByteLengthOverLimit } from './clipboard-text'
+import { clampUtf8TextPrefix } from './utf8-byte-limits'
 
 export const MOBILE_MARKDOWN_EDIT_MAX_BYTES = 256 * 1024
+/** Markdown preview budget; the file preview keeps its own. Above it a mobile read returns a
+ *  UTF-8-boundary prefix marked `truncated`, never a refusal. Sized like the 2 MiB terminal
+ *  snapshot; the relay splice frame cap is 8 MiB. */
+export const MOBILE_MARKDOWN_READ_MAX_BYTES = 2 * 1024 * 1024
 
 export type RuntimeMarkdownReadOnlyReason =
   | 'unsupported_preview'
@@ -46,6 +51,10 @@ export type RuntimeMarkdownReadTabResult = {
   source: 'draft' | 'file'
   editable: boolean
   readOnlyReason?: RuntimeMarkdownReadOnlyReason
+  /** Present only when `content` is a prefix; older phones ignore both fields. */
+  truncated?: boolean
+  /** The full document's UTF-8 size, sent with `truncated`. */
+  byteLength?: number
 }
 
 export type RuntimeMarkdownSaveTabResult = {
@@ -71,3 +80,19 @@ export function isMarkdownContentByteLengthOverLimit(content: string, maxBytes:
 export function utf8ByteLength(content: string): number {
   return getClipboardTextByteLength(content)
 }
+
+export function truncateMobileMarkdownRead(
+  content: string
+):
+  | { content: string; truncated: false }
+  | { content: string; truncated: true; byteLength: number } {
+  const byteLength = utf8ByteLength(content)
+  if (byteLength <= MOBILE_MARKDOWN_READ_MAX_BYTES) {
+    return { content, truncated: false }
+  }
+  return {
+    content: clampUtf8TextPrefix(content, MOBILE_MARKDOWN_READ_MAX_BYTES),
+    truncated: true,
+    byteLength
+  }
+}
diff --git a/src/shared/mobile-web-bundle/manifest-contract.test.ts b/src/shared/mobile-web-bundle/manifest-contract.test.ts
index c072b9de63b..089fb9c9149 100644
--- a/src/shared/mobile-web-bundle/manifest-contract.test.ts
+++ b/src/shared/mobile-web-bundle/manifest-contract.test.ts
@@ -11,6 +11,7 @@ import {
   MOBILE_WEB_BUNDLE_MAX_ROUTES,
   MOBILE_WEB_BUNDLE_MAX_TOTAL_BYTES,
   MOBILE_WEB_BUNDLE_SCHEMA_VERSION,
+  MOBILE_WEB_PAGE_VERSION,
   type MobileWebBundleAsset
 } from './manifest-contract'
 
@@ -104,6 +105,24 @@ describe('MobileWebBundleManifestSchema', () => {
   })
 })
 
+describe('the page version a manifest carries', () => {
+  it('takes a count, which is what a shell floors on', () => {
+    expect(
+      MobileWebBundleManifestSchema.safeParse(manifestOf([ENTRY], { pageVersion: 1 })).success
+    ).toBe(true)
+    for (const bad of [-1, 1.5, '1']) {
+      expect(
+        MobileWebBundleManifestSchema.safeParse(manifestOf([ENTRY], { pageVersion: bad })).success,
+        String(bad)
+      ).toBe(false)
+    }
+  })
+
+  it('is at least 1, so a manifest without one reads as older than every page that has one', () => {
+    expect(MOBILE_WEB_PAGE_VERSION).toBeGreaterThanOrEqual(1)
+  })
+})
+
 describe('the page routes a manifest declares', () => {
   function withRoutes(routes: unknown): boolean {
     return MobileWebBundleManifestSchema.safeParse(manifestOf([ENTRY], { routes })).success
diff --git a/src/shared/mobile-web-bundle/manifest-contract.ts b/src/shared/mobile-web-bundle/manifest-contract.ts
index 644c0dc1e09..e12443cb7a2 100644
--- a/src/shared/mobile-web-bundle/manifest-contract.ts
+++ b/src/shared/mobile-web-bundle/manifest-contract.ts
@@ -4,6 +4,12 @@ import { sha256 } from '../sha256'
 /** A reader that sees another value must reject rather than guess at the shape. */
 export const MOBILE_WEB_BUNDLE_SCHEMA_VERSION = 1 as const
 
+/**
+ * The page's build number, written into every manifest. A shell requires a page at least as new as
+ * its own floor and walls an older desktop; bump this when a shell stops handling an older page.
+ */
+export const MOBILE_WEB_PAGE_VERSION = 1
+
 /** The only stable-named asset, and the only one that references the content-addressed names. */
 export const MOBILE_WEB_BUNDLE_ENTRYPOINT = 'index.html'
 
@@ -259,6 +265,8 @@ export const MobileWebBundleManifestSchema = z
     desktopVersion: z.string().min(1).max(MAX_DESKTOP_VERSION_LENGTH),
     minCompatibleRuntimeProtocolVersion: z.number().int().nonnegative(),
     runtimeProtocolVersion: z.number().int().nonnegative(),
+    /** `MOBILE_WEB_PAGE_VERSION` at build time; absent from a desktop older than the field. */
+    pageVersion: z.number().int().nonnegative().optional(),
     entrypoint: z.literal(MOBILE_WEB_BUNDLE_ENTRYPOINT),
     totalBytes: z.number().int().nonnegative().max(MOBILE_WEB_BUNDLE_MAX_TOTAL_BYTES),
     assets: z.array(MobileWebBundleAssetSchema).min(1).max(MOBILE_WEB_BUNDLE_MAX_ASSETS),
diff --git a/src/shared/native-chat-ask-row.test.ts b/src/shared/native-chat-ask-row.test.ts
index f032f88c73f..05cdcce2900 100644
--- a/src/shared/native-chat-ask-row.test.ts
+++ b/src/shared/native-chat-ask-row.test.ts
@@ -42,7 +42,7 @@ describe('native chat ask row', () => {
       nativeChatAskRunSubject([
         askCall({ questions: [{ question: 'Which branch?' }, { question: 'Proceed?' }] })
       ])
-    ).toEqual({ kind: 'count', count: 2 })
+    ).toEqual({ kind: 'questions', questions: ['Which branch?', 'Proceed?'] })
   })
 
   it('aggregates the per-question calls Codex journals for a single prompt', () => {
@@ -53,7 +53,7 @@ describe('native chat ask row', () => {
         askCall({ questions: [{ question: 'Which branch?' }] }, 'request_user_input'),
         askCall({ questions: [{ question: 'Proceed?' }] }, 'request_user_input')
       ])
-    ).toEqual({ kind: 'count', count: 2 })
+    ).toEqual({ kind: 'questions', questions: ['Which branch?', 'Proceed?'] })
   })
 
   it('decodes the JSON-string arguments Codex delivers', () => {
diff --git a/src/shared/native-chat-ask-row.ts b/src/shared/native-chat-ask-row.ts
index 4944e10e649..6d92f244f8e 100644
--- a/src/shared/native-chat-ask-row.ts
+++ b/src/shared/native-chat-ask-row.ts
@@ -9,16 +9,17 @@ import { pairToolBlocks } from './native-chat-tool-fold'
 
 export const NATIVE_CHAT_ASK_ROW_COPY = {
   awaiting: 'Awaiting user input:',
+  awaitingUnnamed: 'Awaiting user input',
   asked: 'Asked:',
   questionCount: '{{value0}} questions'
 } as const
 
-/** What the row names after its label: the question itself, or how many were
- *  asked. One row stands for the whole prompt, so a grouped prompt may not quote
- *  just its first question as though it were the only one. */
+/** What was asked: the one question, or every question of a grouped prompt. One
+ *  row stands for the whole prompt, so a grouped prompt names its count on the
+ *  line rather than quoting its first question as though it were the only one. */
 export type NativeChatAskRowSubject =
   | { kind: 'question'; text: string }
-  | { kind: 'count'; count: number }
+  | { kind: 'questions'; questions: string[] }
 
 /** Whether this block is a question tool call, and so is drawn as the awaiting
  *  row rather than as an ordinary tool line. */
@@ -93,7 +94,7 @@ export function nativeChatAskRunSubject(
     return null
   }
   if (questions.length > 1) {
-    return { kind: 'count', count: questions.length }
+    return { kind: 'questions', questions }
   }
   const text = questions[0]
   return text ? { kind: 'question', text } : null
diff --git a/src/shared/native-chat-empty-state.ts b/src/shared/native-chat-empty-state.ts
index 2797648afd0..3ef7b1a1902 100644
--- a/src/shared/native-chat-empty-state.ts
+++ b/src/shared/native-chat-empty-state.ts
@@ -19,6 +19,11 @@ export const NATIVE_CHAT_EMPTY_STATE_COPY = {
     title: 'Could not load conversation',
     subtitle: 'The transcript could not be read. Toggle back to the terminal to keep working.'
   },
+  // The structured chat's read reconnects on its own; the terminal-backed read does not.
+  retryingError: {
+    title: 'Could not load conversation',
+    subtitle: 'The transcript could not be read. Orca keeps trying to load it.'
+  },
   notAgent: {
     title: 'No conversation here',
     subtitle: 'This terminal is not running a recognized coding agent.'
diff --git a/src/shared/native-chat-stream-unsubscribe.test.ts b/src/shared/native-chat-stream-unsubscribe.test.ts
index 60f3cc26099..368b93537ae 100644
--- a/src/shared/native-chat-stream-unsubscribe.test.ts
+++ b/src/shared/native-chat-stream-unsubscribe.test.ts
@@ -9,6 +9,10 @@ describe('native-chat stream unsubscribe key builder', () => {
     expect(buildNativeChatSubscriptionId('claude', 'sess-1')).toBe('claude:sess-1')
   })
 
+  it('suffixes a per-subscription instance onto the cleanup token', () => {
+    expect(buildNativeChatSubscriptionId('claude', 'sess-1', 'sub-7')).toBe('claude:sess-1:sub-7')
+  })
+
   it('builds the unsubscribe RPC frame mobile and web share', () => {
     expect(buildNativeChatUnsubscribe('codex', 'abc')).toEqual({
       method: 'nativeChat.unsubscribe',
diff --git a/src/shared/native-chat-stream-unsubscribe.ts b/src/shared/native-chat-stream-unsubscribe.ts
index ae7c52587fe..a62c5eda267 100644
--- a/src/shared/native-chat-stream-unsubscribe.ts
+++ b/src/shared/native-chat-stream-unsubscribe.ts
@@ -1,18 +1,22 @@
-// Why: the runtime keys a native-chat transcript fs-watcher by the cleanup token
-// `agent:sessionId`. A subscribing client must echo that exact token on
-// `nativeChat.unsubscribe` so the watcher is closed when the chat view toggles
-// off (not just on socket close) — otherwise watchers leak per session-switch.
-// Both the web runtime client and mobile use this single key shape; centralizing
-// it here keeps the token from drifting between the two surfaces.
+// Why: the runtime keys a native-chat transcript fs-watcher by the client's cleanup token
+// (`agent:sessionId` when none is sent). A subscribing client must echo that exact token on
+// `nativeChat.unsubscribe` so the watcher is closed when the chat view toggles off (not just on
+// socket close) — otherwise watchers leak per session-switch. Centralizing the key shape keeps the
+// token from drifting between the web runtime client and mobile.
 
 export type NativeChatUnsubscribeRpc = {
   method: 'nativeChat.unsubscribe'
   params: { subscriptionId: string }
 }
 
-/** The cleanup token the server keys the transcript watcher under. */
-export function buildNativeChatSubscriptionId(agent: string, sessionId: string): string {
-  return `${agent}:${sessionId}`
+/** The cleanup token the server keys the transcript watcher under. An `instance` makes it one
+ *  subscription's own, so two views of the same chat on one connection never evict each other. */
+export function buildNativeChatSubscriptionId(
+  agent: string,
+  sessionId: string,
+  instance?: string
+): string {
+  return instance ? `${agent}:${sessionId}:${instance}` : `${agent}:${sessionId}`
 }
 
 /** The unsubscribe RPC frame a client sends on teardown to close the watcher. */
diff --git a/src/shared/native-chat-subagent-attribution.ts b/src/shared/native-chat-subagent-attribution.ts
new file mode 100644
index 00000000000..19619ec6c87
--- /dev/null
+++ b/src/shared/native-chat-subagent-attribution.ts
@@ -0,0 +1,42 @@
+// Whose words a transcript row carries, when they are not the session's own agent's.
+//
+// A session's subagents write into its journal, and the transcript keeps their rows
+// where they happened. Each such row names the subagent that wrote it, using the
+// label that subagent's spawn roster already gives it, so a child's words are never
+// read as its parent's. Shared so desktop and mobile name the same agent.
+
+import { agentJournalItemSubagentId } from './agent-session-journal-producer'
+import { isSubagentGroupBlock, type NativeChatMessage } from './native-chat-types'
+
+/** English copy: the desktop's i18n fallbacks, and mobile's text as-is. */
+export const NATIVE_CHAT_SUBAGENT_ATTRIBUTION_COPY = {
+  unnamed: 'Subagent',
+  writtenBy: 'Written by subagent {{value0}}'
+} as const
+
+/** Each subagent's roster label, by the id its rows carry. */
+export function nativeChatSubagentLabels(
+  messages: readonly NativeChatMessage[]
+): ReadonlyMap<string, string> {
+  const labels = new Map<string, string>()
+  for (const message of messages) {
+    for (const block of message.blocks) {
+      if (isSubagentGroupBlock(block)) {
+        for (const agent of block.agents) {
+          labels.set(agent.id, agent.label)
+        }
+      }
+    }
+  }
+  return labels
+}
+
+/** The roster's name for the subagent that wrote a row. Undefined for the
+ *  session's own rows, and for a subagent no loaded roster names. */
+export function nativeChatSubagentLabel(
+  labels: ReadonlyMap<string, string> | undefined,
+  message: NativeChatMessage
+): string | undefined {
+  const agentId = agentJournalItemSubagentId(message)
+  return agentId === null ? undefined : labels?.get(agentId)
+}
diff --git a/src/shared/native-chat-tool-fold.ts b/src/shared/native-chat-tool-fold.ts
index e08a722c242..f3c72a45a6b 100644
--- a/src/shared/native-chat-tool-fold.ts
+++ b/src/shared/native-chat-tool-fold.ts
@@ -8,6 +8,7 @@ import {
   type NativeChatToolCallBlock,
   type NativeChatToolResultBlock
 } from './native-chat-types'
+import { agentJournalItemSubagentId } from './agent-session-journal-producer'
 import { isKnownHarnessInjectedUserTurnText } from './harness-injected-user-turns'
 import { isNoiseMessage } from './native-chat-noise'
 
@@ -78,14 +79,23 @@ function dropUnattributableToolResults(message: NativeChatMessage): NativeChatMe
   return blocks.length > 0 ? { ...message, blocks } : null
 }
 
-/** Fold consecutive tool-only messages into their preceding assistant turn. */
+/** Fold consecutive tool-only messages into their preceding assistant turn.
+ *  Only into a run the same agent wrote: a subagent's calls interleave with its
+ *  parent's in one journal, and absorbing one into the other would present one
+ *  agent's work as the other's. */
 export function foldToolMessages(messages: readonly NativeChatMessage[]): NativeChatMessage[] {
   const output: NativeChatMessage[] = []
   let mutableAssistantIndex = -1
   let clonedAssistantIndex = -1
   for (const message of messages) {
-    if (isHarnessSidecarToolMessage(message) && mutableAssistantIndex >= 0) {
-      const index = mutableAssistantIndex
+    const foldTarget =
+      mutableAssistantIndex >= 0 &&
+      agentJournalItemSubagentId(output[mutableAssistantIndex]) ===
+        agentJournalItemSubagentId(message)
+        ? mutableAssistantIndex
+        : -1
+    if (isHarnessSidecarToolMessage(message) && foldTarget >= 0) {
+      const index = foldTarget
       const assistant = output[index]
       if (assistant?.role === 'assistant') {
         if (clonedAssistantIndex !== index) {
@@ -100,8 +110,8 @@ export function foldToolMessages(messages: readonly NativeChatMessage[]): Native
         continue
       }
     }
-    if (isToolOnlyMessage(message) && mutableAssistantIndex >= 0) {
-      const index = mutableAssistantIndex
+    if (isToolOnlyMessage(message) && foldTarget >= 0) {
+      const index = foldTarget
       const assistant = output[index]
       if (assistant?.role !== 'assistant') {
         output.push(message)
diff --git a/src/shared/native-chat-transcript-projection.ts b/src/shared/native-chat-transcript-projection.ts
index 26b21824711..45f2488f4aa 100644
--- a/src/shared/native-chat-transcript-projection.ts
+++ b/src/shared/native-chat-transcript-projection.ts
@@ -4,6 +4,7 @@
 // of exactly what the renderer's transcript runs, not a second reading of it.
 
 import type { NativeChatMessage } from './native-chat-types'
+import { compareAgentJournalPositions } from './agent-session-journal-position'
 import { stripNoiseMessages } from './native-chat-noise'
 import { foldToolMessages } from './native-chat-tool-fold'
 
@@ -27,11 +28,32 @@ export function compareNativeChatMessagesByTime(
   return 0
 }
 
+/** Rows the journal holds read in the journal's own order, never its clock: a
+ *  batch shares one timestamp, and a row recovered after a crash carries an
+ *  earlier one. A row not in the journal yet — a send still in the outbox — was
+ *  made after everything the journal holds, so it follows them; only such rows,
+ *  and terminal-backed transcripts, which have no journal, order by time. */
+export function compareNativeChatTranscriptMessages(
+  a: NativeChatMessage,
+  b: NativeChatMessage
+): number {
+  if (a.journalPosition && b.journalPosition) {
+    return compareAgentJournalPositions(a.journalPosition, b.journalPosition)
+  }
+  if (a.journalPosition || b.journalPosition) {
+    return a.journalPosition ? -1 : 1
+  }
+  return compareNativeChatMessagesByTime(a, b)
+}
+
 /** `compare` lets the renderer order its own tail rows (streaming, optimistic
  *  sends), which never exist on the host. */
 export function projectNativeChatTranscriptMessages(
   messages: readonly NativeChatMessage[],
-  compare: (a: NativeChatMessage, b: NativeChatMessage) => number = compareNativeChatMessagesByTime
+  compare: (
+    a: NativeChatMessage,
+    b: NativeChatMessage
+  ) => number = compareNativeChatTranscriptMessages
 ): NativeChatMessage[] {
   // Not `toSorted`: mobile's Hermes lacks it, and src/shared must stay loadable there.
   return stripNoiseMessages(foldToolMessages(Array.from(messages).sort(compare)))
diff --git a/src/shared/native-chat-turn-fold.test.ts b/src/shared/native-chat-turn-fold.test.ts
index cd7e4de024d..8d718df0be1 100644
--- a/src/shared/native-chat-turn-fold.test.ts
+++ b/src/shared/native-chat-turn-fold.test.ts
@@ -11,6 +11,8 @@ function row(overrides: Partial<NativeChatTurnFoldRow> = {}): NativeChatTurnFold
     role: 'assistant',
     rendersProse: true,
     outlivesTurn: false,
+    reportsFailure: false,
+    reportsCompaction: false,
     ...overrides
   }
 }
@@ -24,6 +26,9 @@ const TURN: NativeChatTurnFoldRow[] = [
   row()
 ]
 
+/** An error-toned system row: the agent or host reporting the turn failed. */
+const FAILURE = row({ role: 'system', reportsFailure: true })
+
 const SETTLED = new Set(['turn-1'])
 const NONE = new Set<string>()
 
@@ -42,6 +47,21 @@ describe('nativeChatTurnAnswerRows', () => {
     expect(nativeChatTurnAnswerRows(rows).get('turn-1')).toBe(1)
   })
 
+  it('names a failure report as the answer when nothing the agent said comes after it', () => {
+    const rows = [row({ role: 'user' }), row(), FAILURE]
+    expect(nativeChatTurnAnswerRows(rows).get('turn-1')).toBe(2)
+  })
+
+  it('names the later prose as the answer when the agent recovered from a failure', () => {
+    const rows = [row({ role: 'user' }), FAILURE, row()]
+    expect(nativeChatTurnAnswerRows(rows).get('turn-1')).toBe(2)
+  })
+
+  it("keeps the session's own answer when a subagent's failure comes after it", () => {
+    const rows = [row({ role: 'user' }), row(), row({ ...FAILURE, agentId: 'sub-1' })]
+    expect(nativeChatTurnAnswerRows(rows).get('turn-1')).toBe(1)
+  })
+
   it('reports no answer for a turn that only ran tools', () => {
     const rows = [row({ role: 'user' }), row({ rendersProse: false })]
     expect(nativeChatTurnAnswerRows(rows).has('turn-1')).toBe(false)
@@ -146,4 +166,83 @@ describe('nativeChatTurnFold', () => {
     })
     expect(foldedRows.size).toBe(0)
   })
+
+  it('ends a failed turn on its error, folding the work and prose before it', () => {
+    const rows = [row({ role: 'user' }), row(), row({ rendersProse: false }), FAILURE]
+    const { foldedRows, foldableTurnKeys } = nativeChatTurnFold({
+      rows,
+      settledTurnKeys: SETTLED,
+      expandedTurnKeys: NONE
+    })
+    expect([...foldedRows].sort()).toEqual([1, 2])
+    expect([...foldableTurnKeys]).toEqual(['turn-1'])
+  })
+
+  it('folds an error the agent recovered from behind the answer that followed it', () => {
+    const rows = [row({ role: 'user' }), row({ rendersProse: false }), FAILURE, row()]
+    const { foldedRows } = nativeChatTurnFold({
+      rows,
+      settledTurnKeys: SETTLED,
+      expandedTurnKeys: NONE
+    })
+    expect([...foldedRows].sort()).toEqual([1, 2])
+  })
+
+  it('shows a turn that is nothing but its error as that error, with no disclosure', () => {
+    const rows = [row({ role: 'user' }), FAILURE]
+    const { foldedRows, foldableTurnKeys } = nativeChatTurnFold({
+      rows,
+      settledTurnKeys: SETTLED,
+      expandedTurnKeys: NONE
+    })
+    expect(foldedRows.size).toBe(0)
+    expect(foldableTurnKeys.size).toBe(0)
+  })
+
+  it('never folds a compaction report, and keeps the last prose as the answer', () => {
+    const rows = [
+      row({ role: 'user' }),
+      row(),
+      row({ role: 'system', reportsCompaction: true }),
+      row(),
+      row({ role: 'system', reportsCompaction: true })
+    ]
+    const { foldedRows } = nativeChatTurnFold({
+      rows,
+      settledTurnKeys: SETTLED,
+      expandedTurnKeys: NONE
+    })
+    expect([...foldedRows]).toEqual([1])
+    expect(nativeChatTurnAnswerRows(rows).get('turn-1')).toBe(3)
+  })
+})
+
+describe("a subagent's words are never the turn's answer", () => {
+  // The reported shape: the parent replies, then a subagent it launched keeps
+  // narrating into the same journal after the parent's last word.
+  const rows: NativeChatTurnFoldRow[] = [
+    row({ role: 'user' }),
+    row(),
+    row({ agentId: 'task-1' }),
+    row({ agentId: 'task-1', rendersProse: false })
+  ]
+
+  it("names the session's own last prose, not a subagent's later prose", () => {
+    expect(nativeChatTurnAnswerRows(rows).get('turn-1')).toBe(1)
+  })
+
+  it("folds the subagent's prose behind a settled turn and keeps the parent's answer", () => {
+    const { foldedRows } = nativeChatTurnFold({
+      rows,
+      settledTurnKeys: SETTLED,
+      expandedTurnKeys: NONE
+    })
+    expect(foldedRows.has(1)).toBe(false)
+    expect(foldedRows.has(2)).toBe(true)
+  })
+
+  it('reports no answer for a turn in which only subagents spoke', () => {
+    const onlyChildren = [row({ role: 'user' }), row({ agentId: 'task-1' })]
+    expect(nativeChatTurnAnswerRows(onlyChildren).has('turn-1')).toBe(false)
+  })
 })
diff --git a/src/shared/native-chat-turn-fold.ts b/src/shared/native-chat-turn-fold.ts
index 5ceb0ef8989..056360b7817 100644
--- a/src/shared/native-chat-turn-fold.ts
+++ b/src/shared/native-chat-turn-fold.ts
@@ -1,14 +1,12 @@
 // Which rows a settled turn folds behind its "Worked for N" status row.
 //
-// A turn's answer is its last assistant row that renders prose; everything the
-// agent said before it is the work that produced it. The journal carries no
-// "this one is the answer" marker on a message, so the answer is derived rather
-// than read — last prose row wins. A provider that starts publishing one can
-// override this derivation without moving the fold.
-//
-// Shared because desktop and mobile both draw this disclosure, and a fold that
-// hides a different row on each surface is the same bug twice.
+// A turn's answer is its last assistant row that renders prose, or its last
+// failure report; everything before it is the work that produced it. The journal
+// carries no "this one is the answer" marker on a message, so the answer is
+// derived rather than read — last candidate wins. So a failed turn ends on its
+// error, and an error the agent recovered from folds behind the answer after it.
 
+import { isRootAgentJournalItem } from './agent-session-journal-producer'
 import type { NativeChatRole } from './native-chat-types'
 
 /** What the fold needs to know about one transcript row. Deliberately not a
@@ -24,6 +22,14 @@ export type NativeChatTurnFoldRow = {
    *  spawn roster or a background task. That row is the durable report of how
    *  the work ended — often the only one — so it never folds. */
   outlivesTurn: boolean
+  /** Whether a system row reports a failure. It competes with prose to be the
+   *  turn's answer, so a turn that failed shows the error as its end. */
+  reportsFailure: boolean
+  /** Whether the row reports a compaction's result. It never folds: hiding it
+   *  would leave the turn's status as the only trace the context was rewritten. */
+  reportsCompaction: boolean
+  /** The subagent that produced the row. Absent ⇒ the session's own agent. */
+  agentId?: string
 }
 
 export type NativeChatTurnFold = {
@@ -39,14 +45,20 @@ export const NATIVE_CHAT_EMPTY_TURN_FOLD: NativeChatTurnFold = {
   foldableTurnKeys: new Set()
 }
 
-/** The index of each turn's answer: its last assistant row that renders prose.
- *  A turn with no such row has no answer, and folds whole. */
+/** The index of each turn's answer: the last prose the session's own agent
+ *  wrote, or its last system row reporting a failure. A subagent that is still
+ *  narrating after its parent's last word would otherwise stand as the turn's
+ *  only visible reply. A turn with neither has no answer, and folds whole. */
 export function nativeChatTurnAnswerRows(
   rows: readonly NativeChatTurnFoldRow[]
 ): ReadonlyMap<string, number> {
   const answers = new Map<string, number>()
   for (const [index, row] of rows.entries()) {
-    if (row.turnKey !== undefined && row.role === 'assistant' && row.rendersProse) {
+    const isCandidate =
+      row.rendersProse &&
+      isRootAgentJournalItem(row) &&
+      (row.role === 'assistant' || (row.role === 'system' && row.reportsFailure))
+    if (row.turnKey !== undefined && isCandidate) {
       answers.set(row.turnKey, index)
     }
   }
@@ -77,11 +89,12 @@ export function nativeChatTurnFold({
   for (const [index, row] of rows.entries()) {
     const { turnKey } = row
     // Outside the fold by construction: the reader's own message anchors the
-    // turn, and a roster or background-task row outlives it.
+    // turn, a roster or background-task row outlives it, and a compaction report explains it.
     if (
       turnKey === undefined ||
       row.role === 'user' ||
       row.outlivesTurn ||
+      row.reportsCompaction ||
       !settledTurnKeys.has(turnKey)
     ) {
       continue
diff --git a/src/shared/native-chat-turn-grouping.test.ts b/src/shared/native-chat-turn-grouping.test.ts
new file mode 100644
index 00000000000..fed223cc83f
--- /dev/null
+++ b/src/shared/native-chat-turn-grouping.test.ts
@@ -0,0 +1,131 @@
+import { describe, expect, it } from 'vitest'
+import type { NativeChatMessage } from './native-chat-types'
+import {
+  nativeChatRowTurnKeys,
+  nativeChatTurnBarRows,
+  nativeChatTurnDrawOrder
+} from './native-chat-turn-grouping'
+
+function message(id: string, role: NativeChatMessage['role'] = 'assistant'): NativeChatMessage {
+  return { id, role, blocks: [{ type: 'text', text: id }], timestamp: null, source: 'transcript' }
+}
+
+describe('nativeChatRowTurnKeys', () => {
+  it('keeps rows after a mid-turn send with the turn that produced them', () => {
+    // The #23621 shape: B lands mid-turn, three tool rows follow, all one turn.
+    const messages = [
+      message('A', 'user'),
+      message('t1'),
+      message('B', 'user'),
+      message('t2'),
+      message('t3'),
+      message('t4')
+    ]
+    const owned = new Map([
+      ['A', 'A'],
+      ['t1', 'A'],
+      ['B', 'A'],
+      ['t2', 'A'],
+      ['t3', 'A'],
+      ['t4', 'A']
+    ])
+    expect(nativeChatRowTurnKeys(messages, owned)).toEqual(['A', 'A', 'A', 'A', 'A', 'A'])
+  })
+
+  it('lets an unmapped user row key itself and unmapped rows inherit it', () => {
+    // C is an optimistic echo the journal has not admitted yet: positional rules.
+    const messages = [message('A', 'user'), message('t1'), message('C', 'user'), message('t2')]
+    const owned = new Map([
+      ['A', 'A'],
+      ['t1', 'A']
+    ])
+    expect(nativeChatRowTurnKeys(messages, owned)).toEqual(['A', 'A', 'C', 'C'])
+  })
+
+  it('reproduces preceding-user grouping exactly when the host attributes nothing', () => {
+    const messages = [
+      message('lead'),
+      message('A', 'user'),
+      message('t1'),
+      message('B', 'user'),
+      message('t2')
+    ]
+    const positional = [undefined, 'A', 'A', 'B', 'B']
+    expect(nativeChatRowTurnKeys(messages, null)).toEqual(positional)
+    expect(nativeChatRowTurnKeys(messages, new Map())).toEqual(positional)
+  })
+
+  it('keys a provider-opened turn to a record no message carries', () => {
+    const messages = [message('A', 'user'), message('t1'), message('t2')]
+    const owned = new Map([
+      ['A', 'A'],
+      ['t1', 'wake-turn'],
+      ['t2', 'wake-turn']
+    ])
+    expect(nativeChatRowTurnKeys(messages, owned)).toEqual(['A', 'wake-turn', 'wake-turn'])
+  })
+})
+
+describe('nativeChatTurnBarRows', () => {
+  it('anchors a turn with no user bubble above its first rendered row', () => {
+    const messages = [message('A', 'user'), message('t1'), message('t2'), message('t3')]
+    const turnKeys = ['A', 'A', 'wake-turn', 'wake-turn']
+    expect(nativeChatTurnBarRows(messages, turnKeys)).toEqual(
+      new Map([
+        ['A', { index: 0, above: false }],
+        ['wake-turn', { index: 2, above: true }]
+      ])
+    )
+  })
+
+  it('puts a turn opened by a rendered message under that message', () => {
+    const messages = [message('A', 'user'), message('t1')]
+    expect(nativeChatTurnBarRows(messages, ['A', 'A']).get('A')).toEqual({ index: 0, above: false })
+  })
+})
+
+describe('nativeChatTurnDrawOrder', () => {
+  it("draws a message that opened a later turn after the earlier turn's remaining rows", () => {
+    // B was sent while A ran and Claude queued it: A's tool run and answer follow B in the journal.
+    const messages = [
+      message('A', 'user'),
+      message('a1'),
+      message('B', 'user'),
+      message('a2'),
+      message('a-done'),
+      message('b1')
+    ]
+    const turnKeys = ['A', 'A', 'B', 'A', 'A', 'B']
+    expect(nativeChatTurnDrawOrder(messages, turnKeys, new Set(['A', 'B']))).toEqual([
+      0, 1, 3, 4, 2, 5
+    ])
+  })
+
+  it('keeps each of several queued openers ahead of its own rows', () => {
+    const messages = [
+      message('A', 'user'),
+      message('B', 'user'),
+      message('C', 'user'),
+      message('a-done'),
+      message('b1'),
+      message('c1')
+    ]
+    const turnKeys = ['A', 'B', 'C', 'A', 'B', 'C']
+    const order = nativeChatTurnDrawOrder(messages, turnKeys, new Set(['A', 'B', 'C']))
+    expect(order?.map((index) => messages[index]!.id)).toEqual([
+      'A',
+      'a-done',
+      'B',
+      'b1',
+      'C',
+      'c1'
+    ])
+  })
+
+  it('leaves a steer, and a message that opened no turn, where they were written', () => {
+    const messages = [message('A', 'user'), message('steer', 'user'), message('a1')]
+    expect(nativeChatTurnDrawOrder(messages, ['A', 'A', 'A'], new Set(['A']))).toBeNull()
+    const waiting = [message('A', 'user'), message('C', 'user'), message('a1')]
+    expect(nativeChatTurnDrawOrder(waiting, ['A', 'C', 'A'], new Set(['A']))).toBeNull()
+  })
+})
diff --git a/src/shared/native-chat-turn-grouping.ts b/src/shared/native-chat-turn-grouping.ts
new file mode 100644
index 00000000000..97570b23edd
--- /dev/null
+++ b/src/shared/native-chat-turn-grouping.ts
@@ -0,0 +1,155 @@
+// Which turn each transcript row belongs to, where each turn draws its bar, and the order the rows
+// draw in. Shared because desktop and mobile both group rows and place bars from these keys, and a
+// row grouped differently on each surface is the same bug twice.
+
+import type { AgentJournalRenderItem } from './agent-session-journal-types'
+import { readAgentJournalTurn } from './agent-session-turn-record'
+import type { NativeChatRole } from './native-chat-types'
+
+type NativeChatTurnRow = { id: string; role: NativeChatRole }
+
+/**
+ * Resolve each row's turn key. The host's attribution (`turnKeysByItemId`) wins, so rows after a
+ * mid-turn send stay with the turn that produced them. Rows it cannot name keep positional
+ * grouping — an unmapped user row keys itself, anything else inherits the previous row's key —
+ * which with no attribution is exactly preceding-user-message grouping.
+ */
+export function nativeChatRowTurnKeys(
+  messages: readonly NativeChatTurnRow[],
+  turnKeysByItemId?: ReadonlyMap<string, string> | null
+): (string | undefined)[] {
+  let currentTurnKey: string | undefined
+  return messages.map((message) => {
+    const owned = turnKeysByItemId?.get(message.id)
+    if (owned !== undefined) {
+      currentTurnKey = owned
+      return owned
+    }
+    if (message.role === 'user') {
+      currentTurnKey = message.id
+    }
+    return currentTurnKey
+  })
+}
+
+/**
+ * Turn ownership for a host that states no turn scope, read from journal order: every item between
+ * a root turn record and the next belongs to that record's turn (the record is appended when the
+ * turn opens, and an opener's user item is written ahead of dispatch). `recordKeys` maps each root
+ * record to its anchor, or null when it names no opener. A user item that opened any turn keys
+ * itself; one the provider folded into a running turn (a steer) takes that turn's key, but only
+ * once the turn produces more rows after it, so a fresh tail send is not pulled into the turn it
+ * is merely waiting behind. Items before the first record stay absent.
+ */
+export function nativeChatJournalOrderTurnKeys(
+  items: readonly AgentJournalRenderItem[],
+  recordKeys: ReadonlyMap<string, string | null>
+): ReadonlyMap<string, string> {
+  const openers = new Set([...recordKeys.values()].filter((key) => key !== null))
+  const keys = new Map<string, string>()
+  let currentKey: string | null = null
+  // User items folded into the current turn, held until a later row proves the turn continued.
+  let pendingUserItemIds: string[] = []
+  for (const item of items) {
+    if (recordKeys.has(item.itemId)) {
+      currentKey = recordKeys.get(item.itemId) ?? null
+      pendingUserItemIds = []
+      continue
+    }
+    if (readAgentJournalTurn(item.body)) {
+      continue
+    }
+    if (item.body.kind === 'message' && item.body.role === 'user') {
+      if (openers.has(item.itemId)) {
+        keys.set(item.itemId, item.itemId)
+      } else if (currentKey !== null) {
+        pendingUserItemIds.push(item.itemId)
+      }
+      continue
+    }
+    if (currentKey !== null) {
+      for (const userItemId of pendingUserItemIds) {
+        keys.set(userItemId, currentKey)
+      }
+      pendingUserItemIds = []
+      keys.set(item.itemId, currentKey)
+    }
+  }
+  return keys
+}
+
+/** Where each turn draws its bar: its first row, and above that row when the turn has no user
+ *  bubble of its own (one the provider opened, or whose opener is outside the loaded window). */
+export function nativeChatTurnBarRows(
+  messages: readonly { id: string }[],
+  turnKeys: readonly (string | undefined)[]
+): ReadonlyMap<string, { index: number; above: boolean }> {
+  const bars = new Map<string, { index: number; above: boolean }>()
+  turnKeys.forEach((turnKey, index) => {
+    if (turnKey !== undefined && !bars.has(turnKey)) {
+      bars.set(turnKey, { index, above: messages[index]?.id !== turnKey })
+    }
+  })
+  return bars
+}
+
+/**
+ * Row indexes in the order the transcript draws them, or null when that is journal order. A
+ * message is written when it is sent, but a provider that queues it behind the running turn opens
+ * its turn only after that turn ends: the rows the earlier turn wrote meanwhile are still that
+ * turn's. So a message that opened a turn draws after them, just before its own turn's rows.
+ */
+export function nativeChatTurnDrawOrder(
+  messages: readonly NativeChatTurnRow[],
+  turnKeys: readonly (string | undefined)[],
+  openers: ReadonlySet<string>
+): number[] | null {
+  const opensTurn = (index: number): boolean =>
+    messages[index]?.role === 'user' &&
+    turnKeys[index] === messages[index].id &&
+    openers.has(messages[index].id)
+  const firstRow = new Map<string, number>()
+  turnKeys.forEach((turnKey, index) => {
+    if (turnKey !== undefined && !firstRow.has(turnKey)) {
+      firstRow.set(turnKey, index)
+    }
+  })
+  const movedAfter = new Map<number, number[]>()
+  const moved = new Set<number>()
+  for (const [index, message] of messages.entries()) {
+    if (!opensTurn(index)) {
+      continue
+    }
+    let after = -1
+    for (let row = index + 1; row < messages.length; row += 1) {
+      const turnKey = turnKeys[row]
+      if (turnKey === undefined || opensTurn(row)) {
+        continue
+      }
+      // Its own turn's rows, or a later turn's, end the earlier turns' rows it waited behind.
+      if (turnKey === message.id || (firstRow.get(turnKey) ?? row) > index) {
+        break
+      }
+      after = row
+    }
+    if (after !== -1) {
+      moved.add(index)
+      movedAfter.set(after, [...(movedAfter.get(after) ?? []), index])
+    }
+  }
+  if (moved.size === 0) {
+    return null
+  }
+  return messages.flatMap((_, index) => [
+    ...(moved.has(index) ? [] : [index]),
+    ...(movedAfter.get(index) ?? [])
+  ])
+}
+
+/** `rows` in the transcript's draw order. */
+export function nativeChatRowsInDrawOrder<T>(
+  rows: readonly T[],
+  drawOrder: readonly number[] | null
+): readonly T[] {
+  return drawOrder === null ? rows : drawOrder.map((index) => rows[index]!)
+}
diff --git a/src/shared/native-chat-turn-membership.test.ts b/src/shared/native-chat-turn-membership.test.ts
new file mode 100644
index 00000000000..53963b73ef0
--- /dev/null
+++ b/src/shared/native-chat-turn-membership.test.ts
@@ -0,0 +1,242 @@
+import { describe, expect, it } from 'vitest'
+import { agentJournalItemKey, agentJournalSubmissionKey } from './agent-session-journal-item-key'
+import type {
+  AgentJournalItemBody,
+  AgentJournalRenderItem,
+  AgentJournalSubmission,
+  AgentJournalTurnScope
+} from './agent-session-journal-types'
+import { nativeChatRowsInDrawOrder } from './native-chat-turn-grouping'
+import { nativeChatTurnMembership, structuredAgentTurnAnchors } from './native-chat-turn-membership'
+import type { NativeChatRole } from './native-chat-types'
+
+const THREAD: AgentJournalTurnScope = { kind: 'thread' }
+let sequence = 0
+
+function item(
+  itemId: string,
+  body: AgentJournalItemBody,
+  /** Null for a host that predates scopes. */
+  turnScope: AgentJournalTurnScope | null = THREAD
+): AgentJournalRenderItem {
+  sequence += 1
+  return {
+    itemId,
+    revision: 0,
+    sequence,
+    observedAt: sequence,
+    body,
+    ...(turnScope ? { turnScope } : {})
+  }
+}
+
+const user = (itemId: string, scope?: AgentJournalTurnScope | null) =>
+  item(itemId, { kind: 'message', role: 'user', blocks: [{ type: 'text', text: itemId }] }, scope)
+const assistant = (itemId: string, scope?: AgentJournalTurnScope | null) =>
+  item(
+    itemId,
+    { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: itemId }] },
+    scope
+  )
+const status = (itemId: string, scope?: AgentJournalTurnScope | null) =>
+  item(itemId, { kind: 'status', text: itemId }, scope)
+const turn = (
+  itemId: string,
+  userItemId: string | undefined,
+  scope?: AgentJournalTurnScope | null,
+  state: 'running' | 'completed' = 'completed'
+) =>
+  item(
+    itemId,
+    {
+      kind: 'turn',
+      turnId: itemId,
+      state,
+      ...(userItemId === undefined ? {} : { userItemId })
+    },
+    scope
+  )
+const inTurn = (turnItemId: string): AgentJournalTurnScope => ({ kind: 'turn', turnItemId })
+
+/** Rows as a surface hands them over: journal items that draw, in order. */
+function rows(items: readonly AgentJournalRenderItem[]): { id: string; role: NativeChatRole }[] {
+  return items.flatMap((entry): { id: string; role: NativeChatRole }[] => {
+    if (entry.body.kind === 'message') {
+      return [{ id: entry.itemId, role: entry.body.role === 'user' ? 'user' : 'assistant' }]
+    }
+    return entry.body.kind === 'status' ? [{ id: entry.itemId, role: 'system' }] : []
+  })
+}
+
+function keys(
+  items: readonly AgentJournalRenderItem[],
+  submissions: readonly AgentJournalSubmission[] = []
+) {
+  return nativeChatTurnMembership(rows(items), { items, submissions }).turnKeys
+}
+
+function liveTurnKey(items: readonly AgentJournalRenderItem[]) {
+  return nativeChatTurnMembership(rows(items), { items, submissions: [] }).liveTurnKey
+}
+
+describe('nativeChatTurnMembership', () => {
+  it('groups rows by the turn their scope names, and a steer into the turn it joined', () => {
+    const items = [
+      user('u1'),
+      turn('t1', 'u1'),
+      assistant('a1', inTurn('t1')),
+      user('steer', inTurn('t1')),
+      assistant('a2', inTurn('t1')),
+      status('note')
+    ]
+    expect(keys(items)).toEqual(['u1', 'u1', 'u1', 'u1', undefined])
+  })
+
+  it('keys a turn no message opened on its own record', () => {
+    const items = [
+      user('u1'),
+      turn('t1', 'u1'),
+      assistant('a1', inTurn('t1')),
+      // A provider-resumed turn: its record names no present user entry.
+      turn('wake', 'codex:thread:wake:0'),
+      assistant('a2', inTurn('wake'))
+    ]
+    expect(keys(items)).toEqual(['u1', 'u1', 'wake'])
+  })
+
+  it('anchors a command turn on its /compact entry, and leaves the turn before it alone', () => {
+    const compactKey = agentJournalSubmissionKey('cmd-1')
+    const commandTurn = agentJournalItemKey({
+      provider: 'orca',
+      clientMessageId: 'command-turn:cmd-1'
+    })
+    const items = [
+      user('u1'),
+      turn('t1', 'u1'),
+      assistant('a1', inTurn('t1')),
+      item(compactKey, {
+        kind: 'message',
+        role: 'user',
+        blocks: [{ type: 'text', text: '/compact' }],
+        command: { name: 'compact' }
+      }),
+      turn(commandTurn, compactKey),
+      status('compacted', inTurn(commandTurn))
+    ]
+    expect(keys(items)).toEqual(['u1', 'u1', compactKey, compactKey])
+  })
+
+  it('resolves a turn record naming the provider item a submission adopted', () => {
+    const sent = agentJournalSubmissionKey('send-1')
+    const items = [user(sent), turn('t1', 'codex:thread:t1:0'), assistant('a1', inTurn('t1'))]
+    const submissions: AgentJournalSubmission[] = [
+      {
+        clientMessageId: 'send-1',
+        fence: 1,
+        payloadFingerprint: 'f',
+        dispatchState: 'accepted',
+        providerItemId: 'codex:thread:t1:0',
+        reason: null,
+        submittedAt: 1,
+        resolvedAt: 2
+      }
+    ]
+    expect(keys(items, submissions)).toEqual([sent, sent])
+    expect(structuredAgentTurnAnchors(items, submissions).get('t1')).toBe(sent)
+  })
+
+  it('places a conversation row, and a row naming a turn the journal no longer holds, in none', () => {
+    const items = [
+      user('u1'),
+      turn('t1', 'u1'),
+      status('restart-note'),
+      assistant('orphan', inTurn('gone'))
+    ]
+    expect(keys(items)).toEqual(['u1', undefined, undefined])
+  })
+
+  it('groups by position for a host that states no scope, and with no journal', () => {
+    const items = [user('u1', null), assistant('a1', null), user('u2', null), status('s', null)]
+    expect(keys(items)).toEqual(['u1', 'u1', 'u2', 'u2'])
+    expect(nativeChatTurnMembership(rows(items)).turnKeys).toEqual(['u1', 'u1', 'u2', 'u2'])
+  })
+})
+
+describe('the live turn', () => {
+  it('is a running turn the provider opened on its own, not the settled user turn before it', () => {
+    const settled = [user('u1'), turn('t1', 'u1'), assistant('a1', inTurn('t1'))]
+    const wake = turn('wake', 'codex:thread:wake:0', THREAD, 'running')
+    // Just opened: nothing drawn for it yet, and still the live turn.
+    expect(liveTurnKey([...settled, wake])).toBe('wake')
+    expect(liveTurnKey([...settled, wake, assistant('a2', inTurn('wake'))])).toBe('wake')
+  })
+
+  it('is the user row that opened the running turn, including after a steer into it', () => {
+    const items = [
+      user('u1'),
+      turn('t1', 'u1', THREAD, 'running'),
+      assistant('a1', inTurn('t1')),
+      user('steer', inTurn('t1'))
+    ]
+    expect(liveTurnKey(items)).toBe('u1')
+  })
+
+  it('is the newest user row while its send has not opened a turn', () => {
+    const items = [user('u1'), turn('t1', 'u1'), assistant('a1', inTurn('t1')), user('u2')]
+    expect(liveTurnKey(items)).toBe('u2')
+  })
+
+  it('is the newest user row for a host that states no scope, and with no journal', () => {
+    const items = [
+      user('u1', null),
+      turn('wake', undefined, null, 'running'),
+      assistant('a1', null),
+      user('u2', null),
+      status('s', null)
+    ]
+    expect(liveTurnKey(items)).toBe('u2')
+    expect(nativeChatTurnMembership(rows(items)).liveTurnKey).toBe('u2')
+    expect(nativeChatTurnMembership([]).liveTurnKey).toBeUndefined()
+  })
+})
+
+// A message sent while A runs, which the provider queued behind A: its turn opens only after A's
+// remaining rows, which the journal wrote after it.
+describe('a message the provider answered after the running turn', () => {
+  const journal = (statesScope: boolean) => {
+    const scope = (turnItemId?: string) =>
+      statesScope ? (turnItemId ? inTurn(turnItemId) : THREAD) : null
+    return [
+      user('A', scope()),
+      turn('tA', 'A', scope()),
+      assistant('a1', scope('tA')),
+      user('B', scope('tA')),
+      assistant('a-tool', scope('tA')),
+      assistant('FIRST DONE', scope('tA')),
+      turn('tB', 'B', scope(), 'running'),
+      assistant('b1', scope('tB'))
+    ]
+  }
+
+  it.each([
+    ['states each row’s turn', true],
+    ['states no scope', false]
+  ])("draws A's remaining rows in A's turn, then B, on a host that %s", (_host, statesScope) => {
+    const items = journal(statesScope)
+    const transcript = rows(items)
+    const membership = nativeChatTurnMembership(transcript, { items, submissions: [] })
+    const drawn = nativeChatRowsInDrawOrder(
+      transcript.map((row, index) => [row.id, membership.turnKeys[index]]),
+      membership.drawOrder
+    )
+    expect(drawn).toEqual([
+      ['A', 'A'],
+      ['a1', 'A'],
+      ['a-tool', 'A'],
+      ['FIRST DONE', 'A'],
+      ['B', 'B'],
+      ['b1', 'B']
+    ])
+    expect(membership.liveTurnKey).toBe('B')
+  })
+})
diff --git a/src/shared/native-chat-turn-membership.ts b/src/shared/native-chat-turn-membership.ts
new file mode 100644
index 00000000000..67cd3172e6c
--- /dev/null
+++ b/src/shared/native-chat-turn-membership.ts
@@ -0,0 +1,228 @@
+// Which turn each transcript row belongs to, and which turn is live, read from the turn record
+// rather than from position.
+//
+// A turn's anchor is the user entry that opened it — its record's `userItemId`, directly or
+// through the provider item a submission adopted — or, for a turn no entry opened (one the
+// provider resumed on its own), the turn record itself. A row belongs to the turn its stated scope
+// names; a row scoped to the conversation, or to a turn the journal no longer holds, belongs to
+// none. A host that states no scope is read by journal order, and by position where that names
+// nothing.
+// Shared by desktop and mobile, whose keys must agree.
+
+import { agentJournalSubmissionKey } from './agent-session-journal-item-key'
+import { isRootAgentJournalItem } from './agent-session-journal-producer'
+import type {
+  AgentJournalRenderItem,
+  AgentJournalSubmission,
+  AgentJournalTurnLifecycle
+} from './agent-session-journal-types'
+import { readAgentJournalTurn } from './agent-session-turn-record'
+import {
+  nativeChatJournalOrderTurnKeys,
+  nativeChatRowTurnKeys,
+  nativeChatTurnDrawOrder
+} from './native-chat-turn-grouping'
+import type { NativeChatRole } from './native-chat-types'
+import { isStructuredAgentSessionCommandTurn } from './structured-agent-session-command-entry'
+import { liveStructuredAgentSessionTurnScope } from './structured-agent-session-live-turn'
+
+/** Whether the host writing this journal states each row's turn. Only a host that runs `/compact`
+ *  as a turn of the send path does, so this is also how a client tells that host from an older one. */
+export function hostStatesTurnScopes(items: readonly AgentJournalRenderItem[]): boolean {
+  return items.some((item) => item.turnScope !== undefined)
+}
+
+export type NativeChatTurnJournal = {
+  items: readonly AgentJournalRenderItem[]
+  submissions: readonly AgentJournalSubmission[]
+}
+
+/**
+ * Each root turn record's anchor, by the record's item id. `userItemId` resolves to a present user
+ * entry, directly or through a submission's adopted provider item; a record that names no entry
+ * falls back to the nearest user entry before it, which only older hosts write. A key nothing
+ * resolves yet is the send still in flight ahead of the record — Codex reports a turn open before
+ * it echoes the send — and with none, the turn anchors on its own record.
+ */
+export function structuredAgentTurnAnchors(
+  items: readonly AgentJournalRenderItem[],
+  submissions: readonly AgentJournalSubmission[] = []
+): ReadonlyMap<string, string> {
+  const userItemIds = new Set(
+    items.flatMap((item) =>
+      item.body.kind === 'message' && item.body.role === 'user' ? [item.itemId] : []
+    )
+  )
+  const aliases = new Map<string, string>()
+  // Codex folds a send issued mid-turn into the running turn under the SAME provider key, so the
+  // earliest submission that names a key is the prompt that opened the turn.
+  for (const submission of submissions) {
+    if (submission.providerItemId && !aliases.has(submission.providerItemId)) {
+      aliases.set(submission.providerItemId, agentJournalSubmissionKey(submission.clientMessageId))
+    }
+  }
+  const inFlight = new Set(
+    submissions
+      .filter((submission) => submission.dispatchState === 'pending' && !submission.providerItemId)
+      .map((submission) => agentJournalSubmissionKey(submission.clientMessageId))
+  )
+  const anchors = new Map<string, string>()
+  let precedingUserItemId: string | null = null
+  let inFlightSinceLastTurn: string | null = null
+  for (const item of items) {
+    if (userItemIds.has(item.itemId)) {
+      precedingUserItemId = item.itemId
+      if (inFlightSinceLastTurn === null && inFlight.has(item.itemId)) {
+        inFlightSinceLastTurn = item.itemId
+      }
+      continue
+    }
+    const turn = readAgentJournalTurn(item.body)
+    if (!turn || !isRootAgentJournalItem(item)) {
+      continue
+    }
+    anchors.set(
+      item.itemId,
+      anchorOf(item.itemId, turn, userItemIds, aliases, precedingUserItemId, inFlightSinceLastTurn)
+    )
+    inFlightSinceLastTurn = null
+  }
+  return anchors
+}
+
+function anchorOf(
+  turnItemId: string,
+  turn: AgentJournalTurnLifecycle,
+  userItemIds: ReadonlySet<string>,
+  aliases: ReadonlyMap<string, string>,
+  precedingUserItemId: string | null,
+  inFlightUserItemId: string | null
+): string {
+  const key = turn.userItemId
+  if (key === undefined) {
+    return precedingUserItemId ?? turnItemId
+  }
+  if (userItemIds.has(key)) {
+    return key
+  }
+  const aliased = aliases.get(key)
+  return aliased !== undefined && userItemIds.has(aliased)
+    ? aliased
+    : (inFlightUserItemId ?? turnItemId)
+}
+
+export type NativeChatTurnMembership = {
+  /** Each row's turn by index: the anchor of the turn it belongs to, or undefined for none. */
+  turnKeys: (string | undefined)[]
+  /** The turn live now, whose bar carries the running clock and whose rows stay live: the running
+   *  root turn's anchor, else the newest user row's turn (a send whose turn has not opened yet). A
+   *  turn the provider opened on its own is live without one. */
+  liveTurnKey: string | undefined
+  /** Row indexes in the order the transcript draws them (`nativeChatTurnDrawOrder`), or null when
+   *  that is the order given. */
+  drawOrder: readonly number[] | null
+}
+
+/**
+ * Places each row in its turn. A user entry that anchors a turn, or is scoped to none, keys
+ * itself; one delivered into a running turn (a steer) takes that turn's key. A host that states no
+ * scope is read by journal order instead (`nativeChatJournalOrderTurnKeys`).
+ */
+export function nativeChatTurnMembership(
+  messages: readonly { id: string; role: NativeChatRole }[],
+  journal?: NativeChatTurnJournal | null
+): NativeChatTurnMembership {
+  if (!journal) {
+    const turnKeys = nativeChatRowTurnKeys(messages)
+    return { turnKeys, liveTurnKey: newestUserTurnKey(messages, turnKeys), drawOrder: null }
+  }
+  const anchors = structuredAgentTurnAnchors(journal.items, journal.submissions)
+  const running = liveStructuredAgentSessionTurnScope(journal.items)
+  if (!hostStatesTurnScopes(journal.items)) {
+    const recordKeys = namedRecordKeys(journal.items, anchors)
+    const turnKeys = nativeChatRowTurnKeys(
+      messages,
+      nativeChatJournalOrderTurnKeys(journal.items, recordKeys)
+    )
+    const runningNamed = running.kind === 'turn' ? recordKeys.get(running.turnItemId) : null
+    return {
+      turnKeys,
+      liveTurnKey: runningNamed ?? newestUserTurnKey(messages, turnKeys),
+      drawOrder: nativeChatTurnDrawOrder(messages, turnKeys, anchoringUserItems(recordKeys))
+    }
+  }
+  const runningKey = running.kind === 'turn' ? anchors.get(running.turnItemId) : undefined
+  const anchoring = new Set(anchors.values())
+  const scopes = new Map(journal.items.map((item) => [item.itemId, item.turnScope]))
+  const turnKeys = messages.map((message) => {
+    const scope = scopes.get(message.id)
+    const turnKey =
+      scope?.kind === 'turn' && scope.turnItemId ? anchors.get(scope.turnItemId) : undefined
+    if (message.role !== 'user') {
+      return turnKey
+    }
+    return anchoring.has(message.id) ? message.id : (turnKey ?? message.id)
+  })
+  return {
+    turnKeys,
+    liveTurnKey: runningKey ?? newestUserTurnKey(messages, turnKeys),
+    drawOrder: nativeChatTurnDrawOrder(messages, turnKeys, anchoring)
+  }
+}
+
+/** Each root record's anchor, or null for a record that names no opener (only older hosts write
+ *  one): such a record owns no rows, which keep their position. */
+function namedRecordKeys(
+  items: readonly AgentJournalRenderItem[],
+  anchors: ReadonlyMap<string, string>
+): ReadonlyMap<string, string | null> {
+  const keys = new Map<string, string | null>()
+  for (const item of items) {
+    const anchor = anchors.get(item.itemId)
+    if (anchor !== undefined) {
+      keys.set(
+        item.itemId,
+        readAgentJournalTurn(item.body)?.userItemId === undefined ? null : anchor
+      )
+    }
+  }
+  return keys
+}
+
+function anchoringUserItems(recordKeys: ReadonlyMap<string, string | null>): ReadonlySet<string> {
+  return new Set([...recordKeys.values()].filter((key) => key !== null))
+}
+
+/**
+ * The rows accepted but not yet handed over while a conversation command's turn runs, as a message
+ * sent during `/compact` is: the host hands nothing over until the command ends, so they draw after
+ * that turn's live activity. Any other running turn takes a send within moments, so it stays put.
+ */
+export function nativeChatMessagesWaitingBehindLiveTurn(
+  messages: readonly { id: string; queued?: true }[],
+  items: readonly AgentJournalRenderItem[] | null | undefined
+): ReadonlySet<string> {
+  const queued = messages.filter((message) => message.queued === true)
+  return new Set(
+    queued.length > 0 && items && commandTurnRunning(items)
+      ? queued.map((message) => message.id)
+      : []
+  )
+}
+
+function commandTurnRunning(items: readonly AgentJournalRenderItem[]): boolean {
+  const running = liveStructuredAgentSessionTurnScope(items)
+  const bodyOf = (itemId: string) => items.find((item) => item.itemId === itemId)?.body
+  return (
+    running.kind === 'turn' &&
+    isStructuredAgentSessionCommandTurn(readAgentJournalTurn(bodyOf(running.turnItemId)), bodyOf)
+  )
+}
+
+function newestUserTurnKey(
+  messages: readonly { role: NativeChatRole }[],
+  turnKeys: readonly (string | undefined)[]
+): string | undefined {
+  const index = messages.findLastIndex((message) => message.role === 'user')
+  return index === -1 ? undefined : turnKeys[index]
+}
diff --git a/src/shared/native-chat-turn-status.test.ts b/src/shared/native-chat-turn-status.test.ts
index 8157676a22c..e36eaa86fd3 100644
--- a/src/shared/native-chat-turn-status.test.ts
+++ b/src/shared/native-chat-turn-status.test.ts
@@ -32,81 +32,66 @@ describe('formatNativeChatDuration', () => {
 })
 
 describe('describeNativeChatTurnStatus', () => {
-  it('prefers the settled duration over the thinking and counting labels', () => {
-    expect(
-      describeNativeChatTurnStatus({ thinking: true, workedSeconds: 184, elapsedSeconds: 9 })
-    ).toEqual({ key: 'workedFor', duration: '3m 4s' })
+  it('prefers the settled duration over the running clock', () => {
+    expect(describeNativeChatTurnStatus({ workedSeconds: 184, elapsedSeconds: 9 })).toEqual({
+      key: 'workedFor',
+      duration: '3m 4s'
+    })
   })
 
-  it('reports thinking before the turn produces output', () => {
-    expect(
-      describeNativeChatTurnStatus({ thinking: true, workedSeconds: null, elapsedSeconds: 9 })
-    ).toEqual({ key: 'thinking', duration: null })
-  })
-
-  it('counts once the turn has output', () => {
-    expect(
-      describeNativeChatTurnStatus({ thinking: false, workedSeconds: null, elapsedSeconds: 12 })
-    ).toEqual({ key: 'workingFor', duration: '12s' })
+  it('counts from the first second of the turn', () => {
+    expect(describeNativeChatTurnStatus({ workedSeconds: null, elapsedSeconds: 0 })).toEqual({
+      key: 'workingFor',
+      duration: '0s'
+    })
   })
 })
 
 describe('describeNativeChatActiveTurnLabel', () => {
   it('lets provider activity beat both fallbacks', () => {
     expect(
-      describeNativeChatActiveTurnLabel({
-        activityText: 'Reading src/main.ts',
-        thinking: true,
-        elapsedSeconds: 12
-      })
+      describeNativeChatActiveTurnLabel({ activityText: 'Reading src/main.ts', thinking: true })
     ).toEqual({ source: 'activity', text: 'Reading src/main.ts' })
   })
 
   it('falls back to reasoning when the provider says nothing usable', () => {
-    expect(
-      describeNativeChatActiveTurnLabel({ activityText: '   ', thinking: true, elapsedSeconds: 12 })
-    ).toEqual({ source: 'status', key: 'thinking', duration: null })
-    expect(
-      describeNativeChatActiveTurnLabel({ activityText: null, thinking: true, elapsedSeconds: 12 })
-    ).toEqual({ source: 'status', key: 'thinking', duration: null })
+    expect(describeNativeChatActiveTurnLabel({ activityText: '   ', thinking: true })).toEqual({
+      source: 'status',
+      key: 'thinking'
+    })
+    expect(describeNativeChatActiveTurnLabel({ activityText: null, thinking: true })).toEqual({
+      source: 'status',
+      key: 'thinking'
+    })
   })
 
-  it('falls back to the running clock when the turn is neither talking nor reasoning', () => {
-    expect(describeNativeChatActiveTurnLabel({ thinking: false, elapsedSeconds: 184 })).toEqual({
+  // The clock belongs to the turn bar; repeating it here is two rows saying "Working for".
+  it('falls back to plain working, never the clock, when neither applies', () => {
+    expect(describeNativeChatActiveTurnLabel({ thinking: false })).toEqual({
       source: 'status',
-      key: 'workingFor',
-      duration: '3m 4s'
+      key: 'working'
     })
   })
 })
 
 describe('formatNativeChatActiveTurnLabel', () => {
-  it('renders the one live row in English for platforms without i18n', () => {
+  it('renders the live tail line in English for platforms without i18n', () => {
     expect(
-      formatNativeChatActiveTurnLabel({
-        activityText: 'Running pnpm test',
-        thinking: false,
-        elapsedSeconds: 4
-      })
+      formatNativeChatActiveTurnLabel({ activityText: 'Running pnpm test', thinking: false })
     ).toBe('Running pnpm test')
-    expect(formatNativeChatActiveTurnLabel({ thinking: true, elapsedSeconds: 4 })).toBe('Thinking')
-    expect(formatNativeChatActiveTurnLabel({ thinking: false, elapsedSeconds: 12 })).toBe(
-      'Working for 12s'
-    )
+    expect(formatNativeChatActiveTurnLabel({ thinking: true })).toBe('Thinking')
+    expect(formatNativeChatActiveTurnLabel({ thinking: false })).toBe('Working…')
   })
 })
 
 describe('formatNativeChatTurnStatusLabel', () => {
-  it('renders each state in English for platforms without i18n', () => {
-    expect(
-      formatNativeChatTurnStatusLabel({ thinking: true, workedSeconds: null, elapsedSeconds: 0 })
-    ).toBe('Thinking')
-    expect(
-      formatNativeChatTurnStatusLabel({ thinking: false, workedSeconds: null, elapsedSeconds: 12 })
-    ).toBe('Working for 12s')
-    expect(
-      formatNativeChatTurnStatusLabel({ thinking: false, workedSeconds: 184, elapsedSeconds: 0 })
-    ).toBe('Worked for 3m 4s')
+  it('renders the turn bar in English for platforms without i18n', () => {
+    expect(formatNativeChatTurnStatusLabel({ workedSeconds: null, elapsedSeconds: 12 })).toBe(
+      'Working for 12s'
+    )
+    expect(formatNativeChatTurnStatusLabel({ workedSeconds: 184, elapsedSeconds: 0 })).toBe(
+      'Worked for 3m 4s'
+    )
   })
 })
 
@@ -380,6 +365,24 @@ describe('selectNativeChatTurnStatuses', () => {
     )
     expect(completedByTurn).toEqual({})
   })
+
+  it('keeps the just-ended turn live until its local duration is stamped', () => {
+    const running = { u1: { startedAt: 1_000, workedSeconds: null } }
+    const { active } = selectNativeChatTurnStatuses(running, {
+      activeTurnKey: 'u1',
+      isWorking: false,
+      thinking: true
+    })
+    expect(active).toEqual({ startedAt: 1_000, thinking: false, workedSeconds: null })
+    // The host saying it never saw the end still wins.
+    const unverifiable = selectNativeChatTurnStatuses(running, {
+      activeTurnKey: 'u1',
+      isWorking: false,
+      thinking: false,
+      settledByTurn: new Map([['u1', null]])
+    })
+    expect(unverifiable.active).toBeNull()
+  })
 })
 
 describe('nativeChatElapsedSeconds', () => {
diff --git a/src/shared/native-chat-turn-status.ts b/src/shared/native-chat-turn-status.ts
index 9f942ad7e21..3773a9bf423 100644
--- a/src/shared/native-chat-turn-status.ts
+++ b/src/shared/native-chat-turn-status.ts
@@ -1,10 +1,12 @@
-// Turn-status derivation and copy for the native-chat "Thinking / Working for N /
-// Worked for N" row, shared by the desktop renderer (as its i18n fallback strings)
-// and the mobile app (used directly — mobile ships English only) so the two
-// surfaces never drift. Everything here is pure; each platform owns its own clock.
+// Turn-status derivation and copy for the native-chat turn rows — the "Working for N /
+// Worked for N" bar under the user's message and the live line at the turn's tail —
+// shared by the desktop renderer (as its i18n fallback strings) and the mobile app
+// (used directly — mobile ships English only) so the two surfaces never drift.
+// Everything here is pure; each platform owns its own clock.
 
 export const NATIVE_CHAT_TURN_STATUS_COPY = {
   thinking: 'Thinking',
+  working: 'Working…',
   workingFor: 'Working for {{value0}}',
   workedFor: 'Worked for {{value0}}',
   toggleDetails: 'Toggle turn details',
@@ -26,28 +28,22 @@ export function formatNativeChatDuration(seconds: number): string {
   return `${hours}h ${minutes % 60}m ${remainingSeconds}s`
 }
 
-/** Which of the three copy keys a turn-status row renders, and its duration
- *  argument. Desktop maps this onto `translate`; mobile formats it directly. */
+/** The turn bar's copy key and duration: the running clock, then the settled one.
+ *  Desktop maps this onto `translate`; mobile formats it directly. */
 export function describeNativeChatTurnStatus({
-  thinking,
   workedSeconds,
   elapsedSeconds
 }: {
-  thinking: boolean
   workedSeconds?: number | null
   elapsedSeconds: number
-}): { key: 'thinking' | 'workingFor' | 'workedFor'; duration: string | null } {
-  if (workedSeconds != null) {
-    return { key: 'workedFor', duration: formatNativeChatDuration(workedSeconds) }
-  }
-  if (thinking) {
-    return { key: 'thinking', duration: null }
-  }
-  return { key: 'workingFor', duration: formatNativeChatDuration(elapsedSeconds) }
+}): { key: 'workingFor' | 'workedFor'; duration: string } {
+  return workedSeconds != null
+    ? { key: 'workedFor', duration: formatNativeChatDuration(workedSeconds) }
+    : { key: 'workingFor', duration: formatNativeChatDuration(elapsedSeconds) }
 }
 
-/** The two readings that label a live turn's one indicator row, carried together
- *  so a surface cannot pick up one without the other. */
+/** The two readings that label a live turn's tail line, carried together so a
+ *  surface cannot pick up one without the other. */
 export type NativeChatLiveTurnIndicator = {
   thinking: boolean
   activityText: string | null
@@ -55,52 +51,41 @@ export type NativeChatLiveTurnIndicator = {
 
 export type NativeChatActiveTurnLabel =
   | { source: 'activity'; text: string }
-  | { source: 'status'; key: 'thinking' | 'workingFor'; duration: string | null }
+  | { source: 'status'; key: 'thinking' | 'working' }
 
-/** The live turn's single indicator label. Provider activity wins because it is the
- *  only text that says what the turn is actually doing; reasoning is next; the
- *  running clock is the floor. Shared so desktop and mobile cannot disagree. */
+/** The live tail line's label. Provider activity wins because it is the only text
+ *  that says what the turn is actually doing; reasoning is next. It never carries
+ *  the clock — the turn bar owns that. Shared so desktop and mobile cannot disagree. */
 export function describeNativeChatActiveTurnLabel({
   activityText,
-  thinking,
-  elapsedSeconds
+  thinking
 }: {
   activityText?: string | null
   thinking: boolean
-  elapsedSeconds: number
 }): NativeChatActiveTurnLabel {
   const text = activityText?.trim()
   if (text) {
     return { source: 'activity', text }
   }
-  return thinking
-    ? { source: 'status', key: 'thinking', duration: null }
-    : { source: 'status', key: 'workingFor', duration: formatNativeChatDuration(elapsedSeconds) }
+  return { source: 'status', key: thinking ? 'thinking' : 'working' }
 }
 
-/** The live turn's label in English. For platforms without i18n (mobile). */
+/** The live tail line's label in English. For platforms without i18n (mobile). */
 export function formatNativeChatActiveTurnLabel(input: {
   activityText?: string | null
   thinking: boolean
-  elapsedSeconds: number
 }): string {
   const label = describeNativeChatActiveTurnLabel(input)
-  if (label.source === 'activity') {
-    return label.text
-  }
-  const copy = NATIVE_CHAT_TURN_STATUS_COPY[label.key]
-  return label.duration == null ? copy : copy.replaceAll('{{value0}}', label.duration)
+  return label.source === 'activity' ? label.text : NATIVE_CHAT_TURN_STATUS_COPY[label.key]
 }
 
-/** Resolve the turn-status label in English. For platforms without i18n (mobile). */
+/** Resolve the turn bar's label in English. For platforms without i18n (mobile). */
 export function formatNativeChatTurnStatusLabel(input: {
-  thinking: boolean
   workedSeconds?: number | null
   elapsedSeconds: number
 }): string {
   const { key, duration } = describeNativeChatTurnStatus(input)
-  const copy = NATIVE_CHAT_TURN_STATUS_COPY[key]
-  return duration == null ? copy : copy.replaceAll('{{value0}}', duration)
+  return NATIVE_CHAT_TURN_STATUS_COPY[key].replaceAll('{{value0}}', duration)
 }
 
 export type NativeChatTurnTiming = {
@@ -116,6 +101,9 @@ export type NativeChatTurnStatus = {
 
 export type NativeChatTurnTimingByTurn = Readonly<Record<string, NativeChatTurnTiming>>
 
+/** The live turn's key when the transcript has no user message to hang it on. */
+export const NATIVE_CHAT_UNANCHORED_TURN_KEY = '__unanchored__'
+
 /** The turn-timing state machine, lifted out of the React hook so desktop and
  *  mobile stamp start/stop identically. Returns the same reference when nothing
  *  changed so callers can bail out of a state update. */
@@ -241,14 +229,20 @@ export function selectNativeChatTurnStatuses(
       workedSeconds: settled.workedSeconds
     }
   }
+  const activeTiming = timingByTurn[activeTurnKey]
   return {
     active: isWorking
       ? {
-          startedAt: timingByTurn[activeTurnKey]?.startedAt ?? workingStartedAt ?? null,
+          startedAt: activeTiming?.startedAt ?? workingStartedAt ?? null,
           thinking,
           workedSeconds: null
         }
-      : (completedByTurn[activeTurnKey] ?? null),
+      : (completedByTurn[activeTurnKey] ??
+        // Ended, but the local duration is stamped a pass later: stay live until then so
+        // the bar settles in place instead of blinking out. The host's null still hides it.
+        (activeTiming?.workedSeconds === null && !settledByTurn?.has(activeTurnKey)
+          ? { startedAt: activeTiming.startedAt, thinking: false, workedSeconds: null }
+          : null)),
     completedByTurn
   }
 }
diff --git a/src/shared/native-chat-types.ts b/src/shared/native-chat-types.ts
index 24bf8652fb2..b090666511c 100644
--- a/src/shared/native-chat-types.ts
+++ b/src/shared/native-chat-types.ts
@@ -10,7 +10,12 @@ import type {
   AgentSessionBackgroundTask,
   AgentSessionBackgroundTaskRunState
 } from './agent-session-background-task-wire'
-import type { AgentJournalMessageSendMode } from './agent-session-journal-types'
+import type { AgentSessionFailureFact } from './agent-session-failure'
+import type {
+  AgentJournalMessageSendMode,
+  AgentJournalPosition,
+  AgentJournalProducerLinkage
+} from './agent-session-journal-types'
 import type { AgentType } from './agent-status-types'
 import type { NativeChatToolMetadata } from './native-chat-tool-identity'
 
@@ -51,6 +56,8 @@ export type NativeChatTextBlock = {
       truncated: boolean
     }
   }
+  /** On a status line that reports a failure: what failed, typed. */
+  failure?: AgentSessionFailureFact
 }
 
 /** A tool invocation by the agent. `input` is the (already-serialized) tool
@@ -184,7 +191,9 @@ export type NativeChatBlock =
   | NativeChatSubagentGroupBlock
   | NativeChatBackgroundTaskBlock
 
-export type NativeChatMessage = {
+/** A transcript row. Structured rows carry the journal row's producer linkage, so
+ *  "who said this" survives the projection; terminal-backed rows carry none. */
+export type NativeChatMessage = AgentJournalProducerLinkage & {
   /** Stable across re-reads/appends so the assembler and the renderer list can
    *  dedup and key by it. */
   id: string
@@ -199,6 +208,11 @@ export type NativeChatMessage = {
   turnId?: string
   /** How a user message was delivered when it was not an ordinary prompt. */
   sentAs?: AgentJournalMessageSendMode
+  /** Accepted but not yet handed to the agent: drawn after everything the agent has done. */
+  queued?: true
+  /** Set only by the structured projection, on rows the journal holds, and ranks
+   *  them ahead of time. Terminal-backed messages never carry it, and worker reads strip it. */
+  journalPosition?: AgentJournalPosition
 }
 
 export const NATIVE_CHAT_TURN_LIFECYCLE_STATES = ['working', 'completed', 'interrupted'] as const
diff --git a/src/shared/nested-repo-telemetry.ts b/src/shared/nested-repo-telemetry.ts
index 7aea296c57a..48ac131cebf 100644
--- a/src/shared/nested-repo-telemetry.ts
+++ b/src/shared/nested-repo-telemetry.ts
@@ -3,6 +3,7 @@ import type {
   ProjectGroupImportMode,
   ProjectGroupImportResult
 } from './project-group-types'
+import { createNonSecureContextUuid } from './non-secure-context-uuid'
 
 export const NESTED_REPO_TELEMETRY_MAX_REPO_COUNT = 500
 
@@ -117,25 +118,8 @@ export function shouldEmitNestedRepoImportSubmitTelemetry(args: {
 }
 
 export function createNestedRepoTelemetryAttemptId(): string {
-  const cryptoApi = globalThis.crypto
-  if (typeof cryptoApi?.randomUUID === 'function') {
-    return cryptoApi.randomUUID()
-  }
-
-  const bytes = new Uint8Array(16)
-  if (typeof cryptoApi?.getRandomValues === 'function') {
-    cryptoApi.getRandomValues(bytes)
-  } else {
-    for (let i = 0; i < bytes.length; i++) {
-      bytes[i] = Math.floor(Math.random() * 256)
-    }
-  }
-
-  // Why: keep the fallback schema-compatible without deriving from any stable repo input.
-  bytes[6] = (bytes[6] & 0x0f) | 0x40
-  bytes[8] = (bytes[8] & 0x3f) | 0x80
-  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0'))
-  return `${hex.slice(0, 4).join('')}-${hex.slice(4, 6).join('')}-${hex.slice(6, 8).join('')}-${hex.slice(8, 10).join('')}-${hex.slice(10, 16).join('')}`
+  // Why a UUID: the attempt id must not derive from any stable repo input.
+  return createNonSecureContextUuid()
 }
 
 export function buildNestedRepoScanTelemetry(args: {
diff --git a/src/shared/network/manual-address.test.ts b/src/shared/network/manual-address.test.ts
index 6ef59536129..0260eeb7d72 100644
--- a/src/shared/network/manual-address.test.ts
+++ b/src/shared/network/manual-address.test.ts
@@ -1,16 +1,8 @@
 import { describe, it, expect } from 'vitest'
-import { readFileSync } from 'node:fs'
-import { resolve } from 'node:path'
 import { parseManualNetworkAddress } from './manual-address'
 import { PAIRING_ENDPOINT_MAX_CHARACTERS } from '../mobile-pairing-protocol-limits'
 
 describe('parseManualNetworkAddress', () => {
-  it('keeps renderer validation off the Zod schema import path', () => {
-    const source = readFileSync(resolve('src/shared/network/manual-address.ts'), 'utf8')
-    expect(source).not.toContain('mobile-relay-pairing-offer')
-    expect(source).not.toContain("from 'zod'")
-  })
-
   describe('IPv4', () => {
     it('accepts canonical IPv4', () => {
       expect(parseManualNetworkAddress('192.168.1.24')).toEqual({
diff --git a/src/shared/non-secure-context-uuid.ts b/src/shared/non-secure-context-uuid.ts
new file mode 100644
index 00000000000..d9fe33e0459
--- /dev/null
+++ b/src/shared/non-secure-context-uuid.ts
@@ -0,0 +1,38 @@
+/**
+ * The one v4 UUID generator that is safe everywhere Orca's code runs.
+ *
+ * Why: browsers hide `crypto.randomUUID` outside a secure context, so a renderer served
+ * over plain HTTP (Remote Web on a LAN/Tailscale address) throws on any direct call — at
+ * module scope that white-screens the app before it paints. `getRandomValues` stays
+ * available there, and Node/Electron main satisfy the first branch, so this is
+ * runtime-agnostic rather than browser-specific.
+ */
+export function createNonSecureContextUuid(): string {
+  const cryptoApi = globalThis.crypto
+  // oxlint-disable-next-line no-restricted-properties -- the sanctioned escape hatch: the one guarded call every other site routes through.
+  if (typeof cryptoApi?.randomUUID === 'function') {
+    // oxlint-disable-next-line no-restricted-properties -- the sanctioned escape hatch (see above).
+    return cryptoApi.randomUUID()
+  }
+
+  const bytes = new Uint8Array(16)
+  if (typeof cryptoApi?.getRandomValues === 'function') {
+    cryptoApi.getRandomValues(bytes)
+  } else {
+    // Why: these are local UI and correlation ids, not auth credentials.
+    for (let index = 0; index < bytes.length; index += 1) {
+      bytes[index] = Math.floor(Math.random() * 256)
+    }
+  }
+
+  bytes[6] = (bytes[6] & 0x0f) | 0x40
+  bytes[8] = (bytes[8] & 0x3f) | 0x80
+  return bytesToUuid(bytes)
+}
+
+function bytesToUuid(bytes: Uint8Array): string {
+  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0'))
+  return `${hex.slice(0, 4).join('')}-${hex.slice(4, 6).join('')}-${hex
+    .slice(6, 8)
+    .join('')}-${hex.slice(8, 10).join('')}-${hex.slice(10, 16).join('')}`
+}
diff --git a/src/shared/notebook-kernel-types.ts b/src/shared/notebook-kernel-types.ts
index 02947ead5e7..022a07eaafd 100644
--- a/src/shared/notebook-kernel-types.ts
+++ b/src/shared/notebook-kernel-types.ts
@@ -4,7 +4,8 @@ export type PythonEnvironment = {
   path: string
   /** `.venv`, `python3`, … — what the kernel picker shows first. */
   name: string
-  version: string
+  /** Absent for a workspace env listed before trust, which is read from disk rather than run. */
+  version?: string
 }
 
 export type PythonEnvironments = {
diff --git a/src/shared/notification-settings-defaults.ts b/src/shared/notification-settings-defaults.ts
new file mode 100644
index 00000000000..5f8be0f6cf1
--- /dev/null
+++ b/src/shared/notification-settings-defaults.ts
@@ -0,0 +1,13 @@
+import type { NotificationSettings } from './notification-settings-types'
+
+export function getDefaultNotificationSettings(): NotificationSettings {
+  return {
+    enabled: true,
+    agentTaskComplete: true,
+    terminalBell: false,
+    suppressWhenFocused: true,
+    customSoundId: 'system',
+    customSoundPath: null,
+    customSoundVolume: 100
+  }
+}
diff --git a/src/shared/notification-settings-types.ts b/src/shared/notification-settings-types.ts
index 49573c04c1a..4bc22e4aac1 100644
--- a/src/shared/notification-settings-types.ts
+++ b/src/shared/notification-settings-types.ts
@@ -1,4 +1,5 @@
 import type { AgentStatusState, AgentType } from './agent-status-types'
+import type { AgentJournalTurnOutcome } from './agent-turn-outcome'
 
 export type NotificationSettings = {
   enabled: boolean
@@ -43,7 +44,8 @@ export type NotificationDispatchRequest = {
   agentToolName?: string
   agentToolInput?: string
   agentLastAssistantMessage?: string
-  agentInterrupted?: boolean
+  /** The verdict on the turn this notification reports, which picks its wording. */
+  agentTurnOutcome?: AgentJournalTurnOutcome
   /**
    * Which lane raised this, so the click handler knows how to reveal the subject. Absent means the
    * terminal lane, which is every sender that predates structured chat.
diff --git a/src/shared/onboarding-defaults.ts b/src/shared/onboarding-defaults.ts
new file mode 100644
index 00000000000..83b23dcbdaf
--- /dev/null
+++ b/src/shared/onboarding-defaults.ts
@@ -0,0 +1,28 @@
+import type { OnboardingChecklistState, OnboardingState } from './onboarding-state-types'
+
+// Why: onboarding wizard's last step index, centralized so backfill, clamps, and UI agree on the bound.
+export const ONBOARDING_FINAL_STEP = 5
+export const ONBOARDING_FLOW_VERSION = 4
+
+export function getDefaultOnboardingState(): OnboardingState {
+  return {
+    flowVersion: ONBOARDING_FLOW_VERSION,
+    closedAt: null,
+    outcome: null,
+    lastCompletedStep: -1,
+    checklist: {
+      addedRepo: false,
+      choseAgent: false,
+      ranFirstAgent: false,
+      ranSecondAgentOnSameTask: false,
+      triedCmdJ: false,
+      shapedSidebar: false,
+      reviewedDiff: false,
+      openedPr: false,
+      addedFolder: false,
+      openedFile: false,
+      ranAgentOnFile: false,
+      dismissed: false
+    } satisfies OnboardingChecklistState
+  }
+}
diff --git a/src/shared/opencode-installed-plugin.test.ts b/src/shared/opencode-installed-plugin.test.ts
new file mode 100644
index 00000000000..d7814c1229b
--- /dev/null
+++ b/src/shared/opencode-installed-plugin.test.ts
@@ -0,0 +1,47 @@
+import { mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import {
+  isInstalledOpenCodePluginCurrent,
+  isOverlayOpenCodePluginCurrent
+} from './opencode-installed-plugin'
+
+describe('installed OpenCode plugin currency', () => {
+  let dir: string
+  let pluginPath: string
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'orca-opencode-installed-plugin-'))
+    pluginPath = join(dir, 'orca-opencode-status.js')
+  })
+
+  afterEach(() => {
+    rmSync(dir, { recursive: true, force: true })
+  })
+
+  it('treats a missing or different file as stale', () => {
+    expect(isInstalledOpenCodePluginCurrent(pluginPath, 'plugin')).toBe(false)
+    expect(isOverlayOpenCodePluginCurrent(pluginPath, 'plugin')).toBe(false)
+    writeFileSync(pluginPath, 'older plugin')
+    expect(isInstalledOpenCodePluginCurrent(pluginPath, 'plugin')).toBe(false)
+    expect(isOverlayOpenCodePluginCurrent(pluginPath, 'plugin')).toBe(false)
+  })
+
+  it('treats a regular file with the same bytes as current', () => {
+    writeFileSync(pluginPath, 'plugin')
+    expect(isInstalledOpenCodePluginCurrent(pluginPath, 'plugin')).toBe(true)
+    expect(isOverlayOpenCodePluginCurrent(pluginPath, 'plugin')).toBe(true)
+  })
+
+  it.skipIf(process.platform === 'win32')(
+    'follows a symlink except in an overlay, where a link is a mirrored user entry',
+    () => {
+      const targetPath = join(dir, 'target.js')
+      writeFileSync(targetPath, 'plugin')
+      symlinkSync(targetPath, pluginPath)
+      expect(isInstalledOpenCodePluginCurrent(pluginPath, 'plugin')).toBe(true)
+      expect(isOverlayOpenCodePluginCurrent(pluginPath, 'plugin')).toBe(false)
+    }
+  )
+})
diff --git a/src/shared/opencode-installed-plugin.ts b/src/shared/opencode-installed-plugin.ts
new file mode 100644
index 00000000000..33a80f4d168
--- /dev/null
+++ b/src/shared/opencode-installed-plugin.ts
@@ -0,0 +1,22 @@
+import { lstatSync } from 'node:fs'
+import { nodeFileContentsEqualSync } from './node-file-content-equality'
+
+// Why: OpenCode 2 reloads a plugin (and every plugin loaded after it) when its file's mtime changes,
+// even with identical bytes, so installers must skip the write when Orca's plugin is already current.
+// Follows symlinks: OpenCode 2 loads through them, so a linked file with Orca's bytes is current.
+export function isInstalledOpenCodePluginCurrent(pluginPath: string, source: string): boolean {
+  try {
+    return nodeFileContentsEqualSync(pluginPath, source)
+  } catch {
+    return false
+  }
+}
+
+// Overlay variant: a symlink there mirrors a user entry, never Orca's file, even when the bytes match.
+export function isOverlayOpenCodePluginCurrent(pluginPath: string, source: string): boolean {
+  try {
+    return lstatSync(pluginPath).isFile() && nodeFileContentsEqualSync(pluginPath, source)
+  } catch {
+    return false
+  }
+}
diff --git a/src/shared/opencode-launch-command.test.ts b/src/shared/opencode-launch-command.test.ts
index a422633f4bf..d9457de42e0 100644
--- a/src/shared/opencode-launch-command.test.ts
+++ b/src/shared/opencode-launch-command.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { isOpenCode2LaunchCommand } from './opencode-launch-command'
+import { isOpenCode2LaunchCommand, selectOpenCodeHookAgent } from './opencode-launch-command'
 
 describe('isOpenCode2LaunchCommand', () => {
   it.each(['opencode2', '/usr/local/bin/opencode2', 'opencode2.exe', 'opencode2.cmd'])(
@@ -13,3 +13,19 @@ describe('isOpenCode2LaunchCommand', () => {
     expect(isOpenCode2LaunchCommand(command)).toBe(false)
   })
 })
+
+describe('OpenCode hook selection', () => {
+  it.each([
+    'opencode --session fixture',
+    '"C:\\tools\\opencode.exe" --session fixture',
+    '/usr/local/bin/opencode'
+  ])('preserves disabled v1 identity for %s', (command) => {
+    expect(selectOpenCodeHookAgent(undefined, command, (agent) => agent === 'opencode2')).toBeNull()
+  })
+  it('trusts the supplied identity for wrapped or renamed commands', () => {
+    expect(selectOpenCodeHookAgent('opencode', 'opencode2', () => true)).toBe('opencode')
+    expect(
+      selectOpenCodeHookAgent('opencode2', 'my-wrapper', (agent) => agent === 'opencode2')
+    ).toBe('opencode2')
+  })
+})
diff --git a/src/shared/opencode-launch-command.ts b/src/shared/opencode-launch-command.ts
index 44dd3038e6b..92c4896b094 100644
--- a/src/shared/opencode-launch-command.ts
+++ b/src/shared/opencode-launch-command.ts
@@ -1,8 +1,31 @@
 import { getCommandTokenPathBasename, getFirstCommandToken } from './command-token-scanner'
+import type { TuiAgent } from './tui-agent'
 
-export function isOpenCode2LaunchCommand(launchCommand: string | undefined): boolean {
+function openCodeCommandAgent(launchCommand: string | undefined): 'opencode' | 'opencode2' | null {
   const binary = getCommandTokenPathBasename(getFirstCommandToken(launchCommand ?? ''))
     .toLowerCase()
     .replace(/\.(?:cmd|exe|sh)$/, '')
-  return binary === 'opencode2'
+  return binary === 'opencode' || binary === 'opencode2' ? binary : null
+}
+
+export function isOpenCode2LaunchCommand(launchCommand: string | undefined): boolean {
+  return openCodeCommandAgent(launchCommand) === 'opencode2'
+}
+
+export function selectOpenCodeHookAgent(
+  launchAgent: TuiAgent | undefined,
+  launchCommand: string | undefined,
+  isEnabled: (agent: 'opencode' | 'opencode2') => boolean
+): 'opencode' | 'opencode2' | null {
+  const explicit =
+    launchAgent === 'opencode' || launchAgent === 'opencode2'
+      ? launchAgent
+      : launchAgent === undefined
+        ? openCodeCommandAgent(launchCommand)
+        : null
+  // An explicit version selects its own integration; disabling it never substitutes the other.
+  if (explicit) {
+    return isEnabled(explicit) ? explicit : null
+  }
+  return isEnabled('opencode') ? 'opencode' : isEnabled('opencode2') ? 'opencode2' : null
 }
diff --git a/src/shared/orca-session-address-prefix.ts b/src/shared/orca-session-address-prefix.ts
new file mode 100644
index 00000000000..984aec9d789
--- /dev/null
+++ b/src/shared/orca-session-address-prefix.ts
@@ -0,0 +1,2 @@
+// A leaf with no imports, so the CLI entry can spell a session address without the codec's zod graph.
+export const ORCA_SESSION_ADDRESS_PREFIX = 'session:'
diff --git a/src/shared/orca-session-address-test-fixture.ts b/src/shared/orca-session-address-test-fixture.ts
new file mode 100644
index 00000000000..8c41b49b8b2
--- /dev/null
+++ b/src/shared/orca-session-address-test-fixture.ts
@@ -0,0 +1,9 @@
+import { isOrcaSessionId, type OrcaSessionId } from './orca-session-address'
+
+/** A literal Orca session id for a test, checked by the same predicate production uses. */
+export function testOrcaSessionId(id: string): OrcaSessionId {
+  if (!isOrcaSessionId(id)) {
+    throw new Error(`Not an Orca session id: ${id}`)
+  }
+  return id
+}
diff --git a/src/shared/orca-session-address.test.ts b/src/shared/orca-session-address.test.ts
index 96b8a2268e5..0d9875f936d 100644
--- a/src/shared/orca-session-address.test.ts
+++ b/src/shared/orca-session-address.test.ts
@@ -5,8 +5,9 @@ import {
   isOrcaSessionId,
   parseOrcaSessionAddress
 } from './orca-session-address'
+import { testOrcaSessionId } from './orca-session-address-test-fixture'
 
-const SESSION_ID = '0b7e4c2a-5f1d-4e8a-9c3b-2d6f8a1e4b70'
+const SESSION_ID = testOrcaSessionId('0b7e4c2a-5f1d-4e8a-9c3b-2d6f8a1e4b70')
 const ADDRESS = `session:${SESSION_ID}`
 
 describe('Orca session address', () => {
@@ -14,7 +15,8 @@ describe('Orca session address', () => {
     expect(ORCA_SESSION_ADDRESS_PREFIX).toBe('session:')
     expect(formatOrcaSessionAddress(SESSION_ID)).toBe(ADDRESS)
     expect(parseOrcaSessionAddress(ADDRESS)).toBe(SESSION_ID)
-    expect(formatOrcaSessionAddress(parseOrcaSessionAddress(ADDRESS) ?? '')).toBe(ADDRESS)
+    const parsed = parseOrcaSessionAddress(ADDRESS)
+    expect(parsed && formatOrcaSessionAddress(parsed)).toBe(ADDRESS)
   })
 
   it('reads only the addressed spelling when parsing an address', () => {
diff --git a/src/shared/orca-session-address.ts b/src/shared/orca-session-address.ts
index f2ccd4fe00c..d0098ea2ef9 100644
--- a/src/shared/orca-session-address.ts
+++ b/src/shared/orca-session-address.ts
@@ -1,36 +1,55 @@
 import { isAgentSessionId } from './agent-session-record'
+import { STRUCTURED_WORKER_HANDLE_PREFIX } from './structured-worker-handle'
+import { ORCA_SESSION_ADDRESS_PREFIX } from './orca-session-address-prefix'
 
 /**
- * The Orca session id is the id Orca minted for a structured session (its session record id), never
- * the provider's own session id. Orchestration stores, bare, the one the agent is addressed by: for
- * a `/clear`ed chat, its lineage root's, not the live session's. Mail addresses the session as
- * `session:<id>`, beside `run:<id>` and `dispatch:<id>`, and derives that spelling here rather than
- * storing it.
+ * The Orca session id is the id Orca minted for a structured session (its session record id, the
+ * value of `ORCA_AGENT_SESSION_ID`), never the provider's own session id. Orchestration stores,
+ * bare, the one the agent is addressed by: for a `/clear`ed chat, its lineage root's, not the live
+ * session's. Mail addresses the session as `session:<id>`, beside `run:<id>` and `dispatch:<id>`,
+ * and derives that spelling here rather than storing it.
  *
  * Where the session runs is not part of the id; it is read from the session record when needed. PTY
  * agents have none today, and never a pane-keyed one: a pane outlives the agent in it, so such an id
  * would be inherited by the pane's next occupant.
  */
-export const ORCA_SESSION_ADDRESS_PREFIX = 'session:'
+export { ORCA_SESSION_ADDRESS_PREFIX }
+
+declare const orcaSessionIdBrand: unique symbol
+declare const orcaSessionAddressBrand: unique symbol
+
+/** A bare Orca session id; only `isOrcaSessionId` and `parseOrcaSessionAddress` produce one. */
+export type OrcaSessionId = string & { readonly [orcaSessionIdBrand]: true }
+/** A `session:<id>` mail address; only `formatOrcaSessionAddress` produces one. */
+export type OrcaSessionAddress = string & { readonly [orcaSessionAddressBrand]: true }
 
 // Terminal handles (`term_` from the PTY runtime, `structworker_` from structured-worker-identity)
 // share the session-id charset. A handle is never a session, so one handed over by mistake must not
 // become a durable Orca session id.
-const TERMINAL_HANDLE_PREFIXES = ['term_', 'structworker_'] as const
+const TERMINAL_HANDLE_PREFIXES = ['term_', STRUCTURED_WORKER_HANDLE_PREFIX] as const
 
-export function isOrcaSessionId(id: string): boolean {
+export function isOrcaSessionId(id: string): id is OrcaSessionId {
   return isAgentSessionId(id) && !TERMINAL_HANDLE_PREFIXES.some((prefix) => id.startsWith(prefix))
 }
 
-export function formatOrcaSessionAddress(orcaSessionId: string): string {
-  return `${ORCA_SESSION_ADDRESS_PREFIX}${orcaSessionId}`
+export function formatOrcaSessionAddress(orcaSessionId: OrcaSessionId): OrcaSessionAddress {
+  const address = `${ORCA_SESSION_ADDRESS_PREFIX}${orcaSessionId}`
+  // Always true for a checked id; the check brands the address without a type assertion.
+  if (!isOrcaSessionAddress(address)) {
+    throw new Error(`Not an Orca session id: ${orcaSessionId}`)
+  }
+  return address
 }
 
 /** The bare Orca session id of a `session:<id>` address; anything else reads as null. */
-export function parseOrcaSessionAddress(address: string | null | undefined): string | null {
+export function parseOrcaSessionAddress(address: string | null | undefined): OrcaSessionId | null {
   if (!address?.startsWith(ORCA_SESSION_ADDRESS_PREFIX)) {
     return null
   }
   const id = address.slice(ORCA_SESSION_ADDRESS_PREFIX.length)
   return isOrcaSessionId(id) ? id : null
 }
+
+function isOrcaSessionAddress(address: string): address is OrcaSessionAddress {
+  return parseOrcaSessionAddress(address) !== null
+}
diff --git a/src/shared/orcad-agent-browser-name.ts b/src/shared/orcad-agent-browser-name.ts
new file mode 100644
index 00000000000..5cd22beaa50
--- /dev/null
+++ b/src/shared/orcad-agent-browser-name.ts
@@ -0,0 +1,10 @@
+export function orcadAgentBrowserNativeName(
+  platformName: NodeJS.Platform,
+  architecture: string,
+  linuxLibc: 'glibc' | 'musl' = 'glibc'
+): string {
+  const ext = platformName === 'win32' ? '.exe' : ''
+  const platformToken =
+    platformName === 'linux' && linuxLibc === 'musl' ? 'linux-musl' : platformName
+  return `agent-browser-${platformToken}-${architecture}${ext}`
+}
diff --git a/src/shared/orcad-artifacts.ts b/src/shared/orcad-artifacts.ts
index 9a2598caefb..fea71dc63c4 100644
--- a/src/shared/orcad-artifacts.ts
+++ b/src/shared/orcad-artifacts.ts
@@ -8,6 +8,27 @@
  * Keep this file erasable-only TypeScript — build-orcad.mjs imports it directly under
  * Node's type stripping, which rejects enums, namespaces and parameter properties.
  */
+export const ORCAD_BUN_RUNTIME_FILENAME = 'bun-runtime'
+export const ORCAD_WINDOWS_BUN_RUNTIME_FILENAME = 'bun-runtime.exe'
+export const ORCAD_WINDOWS_PROCESS_TREE_FILENAME = 'windows-process-tree.node'
+
+export function orcadBunRuntimeFilename(target: string): string {
+  return target === 'win32' || target.startsWith('win32-')
+    ? ORCAD_WINDOWS_BUN_RUNTIME_FILENAME
+    : ORCAD_BUN_RUNTIME_FILENAME
+}
+
+/** Keep renamed Windows executables in a new content-addressed slot. */
+export function orcadArtifactHashPrefix(target: string): string {
+  return orcadBunRuntimeFilename(target) === ORCAD_WINDOWS_BUN_RUNTIME_FILENAME
+    ? `${ORCAD_WINDOWS_BUN_RUNTIME_FILENAME}\0`
+    : ''
+}
+export const ORCAD_BUILD_TARGET_FILENAME = '.build-target'
+export const ORCAD_PARCEL_WATCHER_ENTRY = 'node_modules/@parcel/watcher/index.js'
+export const ORCAD_PARCEL_WATCHER_NATIVE = 'node_modules/@parcel/watcher/watcher.node'
+export const ORCAD_EMOJI_SHORTCODE_DATASET =
+  'node_modules/emojibase-data/en/shortcodes/emojibase.json'
 
 export const ORCAD_VERSION = '0.1.0'
 
@@ -49,18 +70,45 @@ export const ORCAD_ARTIFACTS: readonly OrcadArtifact[] = [
   { filename: 'parcel-watcher-process-entry.js' },
   // Forked so PTYs outlive the runtime process; its absence makes every restart destructive.
   { filename: 'daemon-entry.js' },
+  { filename: 'windows-bun-pty-gate-entry.js' },
+  { filename: 'profile-state-writer-worker-entry.js' },
+  { filename: 'profile-state-backup-worker-entry.js' },
+  // Target-specific even when the JavaScript bundle is shared across packaged slots.
+  { filename: ORCAD_BUILD_TARGET_FILENAME },
+  // orcad never depends on a host runtime or host-installed native module.
+  { filename: ORCAD_BUN_RUNTIME_FILENAME },
+  { filename: ORCAD_PARCEL_WATCHER_ENTRY },
+  { filename: ORCAD_PARCEL_WATCHER_NATIVE },
+  { filename: ORCAD_EMOJI_SHORTCODE_DATASET },
   ...ORCAD_RIPGREP_ARTIFACTS.map((filename) => ({ filename })),
   ...ORCAD_RIPGREP_LICENSE_ARTIFACTS.map((filename) => ({ filename }))
 ]
 
 /** Written after the artifacts, so it is never an input to its own hash. */
 export const ORCAD_VERSION_FILENAME = '.version'
+export const ORCAD_TEMPLATE_MANIFEST_FILENAME = 'orcad-template.json'
+export const ORCAD_TEMPLATE_TARGETS_DIR = 'targets'
 
 /** Written last by the installer; its absence means a torn install. */
 export const ORCAD_INSTALL_COMPLETE_FILENAME = '.install-complete'
 
-export function orcadArtifactFilenames(): string[] {
-  return ORCAD_ARTIFACTS.filter((artifact) => !artifact.optional).map(
-    (artifact) => artifact.filename
+export function orcadArtifactFilenames(target = ''): string[] {
+  const filenames = ORCAD_ARTIFACTS.filter((artifact) => !artifact.optional).map((artifact) =>
+    artifact.filename === ORCAD_BUN_RUNTIME_FILENAME
+      ? orcadBunRuntimeFilename(target)
+      : artifact.filename
+  )
+  if (target === 'win32' || target.startsWith('win32-')) {
+    filenames.push(ORCAD_WINDOWS_PROCESS_TREE_FILENAME)
+  }
+  return filenames
+}
+
+export function orcadTemplateCommonFilenames(): string[] {
+  return orcadArtifactFilenames().filter(
+    (filename) =>
+      filename !== ORCAD_BUN_RUNTIME_FILENAME &&
+      filename !== ORCAD_BUILD_TARGET_FILENAME &&
+      filename !== ORCAD_PARCEL_WATCHER_NATIVE
   )
 }
diff --git a/src/shared/orcad-bun-runtime.ts b/src/shared/orcad-bun-runtime.ts
new file mode 100644
index 00000000000..76fc03258c8
--- /dev/null
+++ b/src/shared/orcad-bun-runtime.ts
@@ -0,0 +1,72 @@
+export const ORCAD_BUN_VERSION = '1.4.2'
+
+export const ORCAD_BUN_TARGETS = [
+  'darwin-arm64',
+  'darwin-x64',
+  'linux-arm64-glibc',
+  'linux-x64-glibc',
+  'linux-arm64-musl',
+  'linux-x64-musl',
+  'win32-arm64',
+  'win32-x64'
+] as const
+
+export type OrcadBunTarget = (typeof ORCAD_BUN_TARGETS)[number]
+
+// Managed SSH deployment supports POSIX hosts; Windows uses standalone builds.
+export const ORCAD_TEMPLATE_TARGETS = ORCAD_BUN_TARGETS.filter(
+  (target) => !target.startsWith('win32-')
+)
+
+export type OrcadBunReleaseAsset = {
+  filename: string
+  sha256: string
+  executableSha256: string
+}
+
+export const ORCAD_BUN_RELEASE_ASSETS: Record<OrcadBunTarget, OrcadBunReleaseAsset> = {
+  'darwin-arm64': {
+    filename: 'bun-darwin-aarch64.zip',
+    sha256: '90987a3a16d7db556d886ac3d551e7b6d3edf0a1cf43acaed622e8676be1d12f',
+    executableSha256: '35d20dd0263e5c950194434b925454fdfa9ba6e4467da960410fa05b08a7a5b5'
+  },
+  'darwin-x64': {
+    filename: 'bun-darwin-x64.zip',
+    sha256: '80520d7e17526308c9185d261679ac6d27798d3803a0e9f7ff9121ab8affb012',
+    executableSha256: '2fa513af22ac59e03aae640cad302e73cb1ddb0f6398501e2ddccf7dcd613596'
+  },
+  'linux-arm64-glibc': {
+    filename: 'bun-linux-aarch64.zip',
+    sha256: '54328bbc2d9c8e0c9f892c544d66c57a83b84139e34909e5ee81758f1ac8fda7',
+    executableSha256: '616f267a34278ff5ac282df37ffdfba1d7141f4f6926bca99af2cd6ef3ad32b1'
+  },
+  'linux-x64-glibc': {
+    filename: 'bun-linux-x64.zip',
+    sha256: '36368faef7527875d5ffa52e53cd48021741f2a83eb6208a8dd64068d422a913',
+    executableSha256: 'a83d263767d839e4d2649ca8e35d07159c7afc99afdc96d731ced29e056dda0c'
+  },
+  'linux-arm64-musl': {
+    filename: 'bun-linux-aarch64-musl.zip',
+    sha256: '71760b6c8ea30623b81a4907cb815d48e2ea266f2e73e751534a44a0607950df',
+    executableSha256: '1101cd0aa92ea214c2aaf4bb3761ca3c76a90aae0e6f94c07efb4e8c4f18a8fc'
+  },
+  'linux-x64-musl': {
+    filename: 'bun-linux-x64-musl.zip',
+    sha256: '4835eca59d6da70f4674f5642f6e459dcadab773695b2ed9922d131057989742',
+    executableSha256: '16b72935ffd7a503b978c186874539c92aade4e3515b70a5abf5db2581fdef7d'
+  },
+  'win32-arm64': {
+    filename: 'bun-windows-aarch64.zip',
+    sha256: 'a7a16b876a305fd1029c66dbd27007b4f6112ae896532f675878731a21e50cfd',
+    executableSha256: '3d7e98d3201c55c3bde6c069a5dfa0d34da9edc9145187c76594f685f8aa54c6'
+  },
+  'win32-x64': {
+    filename: 'bun-windows-x64.zip',
+    sha256: 'ce4c17497b2f29712a99d3d53f028de28cd42e3bacb8589599e7f000e49b6405',
+    executableSha256: '15277c59ccd6c6c20f8dc9716c2b59c1776320d606b6a8658f70be8799519ca4'
+  }
+}
+
+export function orcadBunReleaseUrl(asset: OrcadBunReleaseAsset): string {
+  return `https://github.com/oven-sh/bun/releases/download/bun-v${ORCAD_BUN_VERSION}/${asset.filename}`
+}
diff --git a/src/shared/orcad-profile-preflight.test.ts b/src/shared/orcad-profile-preflight.test.ts
new file mode 100644
index 00000000000..54dd7d819d3
--- /dev/null
+++ b/src/shared/orcad-profile-preflight.test.ts
@@ -0,0 +1,49 @@
+import { randomUUID } from 'node:crypto'
+import { describe, expect, it } from 'vitest'
+import { parseOrcadProfilePreflight } from './orcad-profile-preflight'
+
+const response = {
+  type: 'orca_profile_state_ready',
+  nonce: randomUUID(),
+  runtime: 'bun',
+  runtimeVersion: '1.4.2',
+  artifactVersion: '0.1.0+123456789abc',
+  sqliteVersion: '3.51.0',
+  revision: 1
+}
+
+function parse(value: unknown) {
+  return parseOrcadProfilePreflight(
+    JSON.stringify(value),
+    response.nonce,
+    response.runtimeVersion,
+    response.artifactVersion
+  )
+}
+
+describe('candidate profile readiness', () => {
+  it('admits an acknowledged write and backup under the expected installed runtime', () => {
+    expect(parse(response)).toEqual(response)
+  })
+
+  it.each([
+    { nonce: randomUUID() },
+    { runtime: 'node' },
+    { runtimeVersion: '1.4.0' },
+    { artifactVersion: '0.1.0+000000000000' },
+    { revision: 0 },
+    { sqliteVersion: '' }
+  ])('refuses stale or incomplete evidence: %j', (change) => {
+    expect(() => parse({ ...response, ...change })).toThrow()
+  })
+
+  it('does not choose a successful line out of contradictory output', () => {
+    expect(() =>
+      parseOrcadProfilePreflight(
+        `${JSON.stringify(response)}\n${JSON.stringify({ ...response, revision: 0 })}`,
+        response.nonce,
+        response.runtimeVersion
+      )
+    ).toThrow()
+  })
+})
diff --git a/src/shared/orcad-profile-preflight.ts b/src/shared/orcad-profile-preflight.ts
new file mode 100644
index 00000000000..2541a09ebde
--- /dev/null
+++ b/src/shared/orcad-profile-preflight.ts
@@ -0,0 +1,38 @@
+import { z } from 'zod'
+
+export const ORCAD_PROFILE_PREFLIGHT_FLAG = '--orcad-profile-state-preflight'
+export const ORCAD_STARTUP_PREFLIGHT_FLAG = '--orcad-startup-preflight'
+export const ORCAD_PROFILE_PREFLIGHT_TIMEOUT_MS = 90_000
+// Server startup follows the disposable native/SQLite probe on every bundled launch.
+export const ORCAD_STARTUP_READINESS_TIMEOUT_MS = ORCAD_PROFILE_PREFLIGHT_TIMEOUT_MS + 90_000
+
+export const orcadProfilePreflightResponseSchema = z.object({
+  type: z.literal('orca_profile_state_ready'),
+  nonce: z.string().uuid(),
+  runtime: z.enum(['node', 'bun']),
+  runtimeVersion: z.string().min(1),
+  artifactVersion: z.string().regex(/^\d+\.\d+\.\d+\+[a-f0-9]{12}$/),
+  sqliteVersion: z.string().min(1),
+  revision: z.number().int().positive()
+})
+
+export type OrcadProfilePreflightResponse = z.infer<typeof orcadProfilePreflightResponseSchema>
+
+/** A fresh challenge prevents stale or unrelated output from admitting a candidate. */
+export function parseOrcadProfilePreflight(
+  output: string,
+  nonce: string,
+  runtimeVersion: string,
+  artifactVersion?: string
+): OrcadProfilePreflightResponse {
+  const response = orcadProfilePreflightResponseSchema.parse(JSON.parse(output.trim()))
+  if (
+    response.nonce !== nonce ||
+    response.runtime !== 'bun' ||
+    response.runtimeVersion !== runtimeVersion ||
+    (artifactVersion !== undefined && response.artifactVersion !== artifactVersion)
+  ) {
+    throw new Error('Profile preflight did not run under the expected candidate runtime')
+  }
+  return response
+}
diff --git a/src/shared/orchestration-compatibility-evidence.ts b/src/shared/orchestration-compatibility-evidence.ts
index 72c7a03c20c..14beca112b7 100644
--- a/src/shared/orchestration-compatibility-evidence.ts
+++ b/src/shared/orchestration-compatibility-evidence.ts
@@ -26,6 +26,11 @@ export type OrchestrationCompatibilityEvidence = {
   paneKey?: string
   launchToken?: string
   host?: OrchestrationCompatibilityHostStamp
+  /**
+   * The Orca-minted agent session id from the caller's injected environment. When present it is
+   * the caller's identity: the dispatch entry resolves it, and a declared handle must name it.
+   */
+  agentSessionId?: string
 }
 
 const SECRET_KEYS = new Set([
diff --git a/src/shared/orchestration-session-caller-codes.ts b/src/shared/orchestration-session-caller-codes.ts
new file mode 100644
index 00000000000..7710ee95659
--- /dev/null
+++ b/src/shared/orchestration-session-caller-codes.ts
@@ -0,0 +1,15 @@
+/** Refusals for an orchestration party named by its Orca agent session id; each applies no effects. */
+export const ORCHESTRATION_SESSION_CALLER_ERROR_CODES = {
+  /** The request crossed a host boundary (a paired client, SSH, or WSL); session identity is same-host only. */
+  hostBoundary: 'session_caller_host_boundary',
+  /** No Orca agent session with that id exists on this host. */
+  unknown: 'session_caller_unknown',
+  /** The id is a provider's own session id, which rotates on `/clear`; the refusal names the Orca id. */
+  providerId: 'session_caller_provider_id',
+  /** The session exists but has no live owner here: released, switching owners, or unreconciled. */
+  notLive: 'session_caller_not_live',
+  /** A request with no session id named a chat's address as its caller. */
+  chatNotDeclarable: 'session_caller_chat_not_declarable',
+  /** A Dispatch named a chat as its assignee, which a chat cannot be yet. */
+  chatNotDispatchable: 'session_chat_not_dispatchable'
+} as const
diff --git a/src/shared/pane-agent-identity-inventory.test.ts b/src/shared/pane-agent-identity-inventory.test.ts
deleted file mode 100644
index 8cb5a88f702..00000000000
--- a/src/shared/pane-agent-identity-inventory.test.ts
+++ /dev/null
@@ -1,492 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-import { glob } from 'tinyglobby'
-import {
-  blankStringContents,
-  blankStringContentsDesynced,
-  isTestFile,
-  stripComments
-} from './source-scan/source-tree-scan'
-
-const HELPERS = [
-  'getAgentLabel',
-  'isClaudeAgent',
-  'titleHasAgentName',
-  'buildAgentNameRe',
-  'resolveTerminalTitleAgentType',
-  'resolveExplicitTerminalTitleAgentType',
-  'resolveCommittedTitleAgentType',
-  'resolvePaneAgentOwner',
-  'resolveCompatibleAgentTypeForOwner',
-  'classifyTitleActivity',
-  'detectAgentStatusFromTitle',
-  'resolveAgentTypeFromTerminalTitle',
-  'resolvePaneAgentIdentity',
-  'resolveCanonicalPaneAgentIdentity',
-  'resolvePublishedPaneAgentIdentity'
-] as const
-
-const TEST_SUPPORT_PATHS = new Set([
-  'src/renderer/src/components/terminal-pane/pty-connection-test-environment.ts'
-])
-
-type Helper = (typeof HELPERS)[number]
-type InventoryPath = string | readonly [path: string, occurrences: number]
-type Classification =
-  | 'parser-implementation'
-  | 'activity-only'
-  | 'enum-formatter'
-  | 'evidence-producer'
-  | 'identity-consumer'
-  | 'action-consumer'
-
-type InventoryGroup = {
-  helper: Helper
-  classification: Classification
-  paths: readonly InventoryPath[]
-}
-
-const INVENTORY: readonly InventoryGroup[] = [
-  {
-    helper: 'getAgentLabel',
-    classification: 'enum-formatter',
-    paths: [
-      [
-        'src/renderer/src/components/agent-session-continuation/AgentSessionContinuationDialog.tsx',
-        2
-      ],
-      ['src/renderer/src/components/automations/AutomationListLocalRow.tsx', 2],
-      'src/renderer/src/components/automations/automation-draft-model.ts',
-      ['src/renderer/src/components/automations/automation-list-search-rows.ts', 2],
-      ['src/renderer/src/components/settings/NativeChatSupportedAgents.tsx', 2],
-      ['src/renderer/src/components/settings/QuickCommandsList.tsx', 2],
-      ['src/renderer/src/components/tab-bar/TabBarQuickCommandItem.tsx', 2],
-      ['src/renderer/src/components/tab-bar/TabBarQuickCommandsMenu.tsx', 2],
-      'src/renderer/src/lib/agent-catalog.tsx',
-      ['src/renderer/src/lib/launch-agent-session-continuation.ts', 3],
-      ['src/renderer/src/lib/orchestration-skill-coverage.ts', 2]
-    ]
-  },
-  {
-    helper: 'getAgentLabel',
-    classification: 'activity-only',
-    paths: [['src/renderer/src/lib/pane-agent-evidence.ts', 2]]
-  },
-  {
-    helper: 'getAgentLabel',
-    classification: 'parser-implementation',
-    paths: [
-      'src/renderer/src/lib/agent-status.ts',
-      'src/shared/agent-detection.ts',
-      'src/shared/agent-title-identity.ts',
-      ['src/shared/agent-title-owner.ts', 2],
-      ['src/shared/terminal-title-agent-type.ts', 2]
-    ]
-  },
-  {
-    helper: 'isClaudeAgent',
-    classification: 'action-consumer',
-    paths: [
-      ['src/renderer/src/components/terminal-pane/cache-timer-seeding.ts', 2],
-      ['src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.ts', 2],
-      ['src/renderer/src/components/terminal-pane/pty-connection/agent-task-complete-notify.ts', 2],
-      ['src/renderer/src/store/terminals/terminal-ephemeral-state.ts', 2]
-    ]
-  },
-  {
-    helper: 'isClaudeAgent',
-    classification: 'action-consumer',
-    paths: [
-      ['src/renderer/src/components/terminal-pane/pty-connection/command-inferred-pane-agent.ts', 2]
-    ]
-  },
-  {
-    helper: 'isClaudeAgent',
-    classification: 'parser-implementation',
-    paths: [
-      'src/renderer/src/lib/agent-status.ts',
-      'src/shared/agent-detection.ts',
-      ['src/shared/agent-title-identity.ts', 2],
-      ['src/shared/terminal-title-agent-type.ts', 2]
-    ]
-  },
-  {
-    helper: 'titleHasAgentName',
-    classification: 'parser-implementation',
-    paths: [
-      'src/shared/agent-detection.ts',
-      'src/shared/agent-name-token-match.ts',
-      ['src/shared/agent-title-core.ts', 4],
-      ['src/shared/agent-title-evidence.ts', 2],
-      ['src/shared/agent-title-identity.ts', 11],
-      ['src/shared/terminal-title-agent-type.ts', 15]
-    ]
-  },
-  {
-    helper: 'titleHasAgentName',
-    classification: 'evidence-producer',
-    paths: [['src/renderer/src/hooks/ipc-events/agent-status-routing.ts', 2]]
-  },
-  {
-    helper: 'buildAgentNameRe',
-    classification: 'parser-implementation',
-    paths: [['src/shared/agent-name-token-match.ts', 2]]
-  },
-  {
-    helper: 'resolveTerminalTitleAgentType',
-    classification: 'identity-consumer',
-    paths: [['src/renderer/src/lib/notes-send-agent-targets.ts', 2]]
-  },
-  {
-    helper: 'resolveTerminalTitleAgentType',
-    classification: 'parser-implementation',
-    paths: [['src/shared/terminal-title-agent-type.ts', 2]]
-  },
-  {
-    helper: 'resolveExplicitTerminalTitleAgentType',
-    classification: 'identity-consumer',
-    paths: [
-      ['mobile/src/session/mobile-terminal-tab-agent.ts', 2],
-      ['src/main/runtime/tui-idle-evidence.ts', 2],
-      ['src/renderer/src/lib/open-tab-occupant-agent.ts', 2],
-      ['src/renderer/src/lib/use-tab-agent.ts', 3]
-    ]
-  },
-  {
-    helper: 'resolveExplicitTerminalTitleAgentType',
-    classification: 'parser-implementation',
-    paths: [
-      ['src/renderer/src/lib/pane-agent-evidence.ts', 2],
-      ['src/renderer/src/lib/tab-agent-from-signals.ts', 2],
-      'src/shared/terminal-title-agent-type.ts'
-    ]
-  },
-  {
-    helper: 'resolveCommittedTitleAgentType',
-    classification: 'action-consumer',
-    paths: [
-      ['src/renderer/src/components/tab-bar/native-chat-tab-agent-evidence.ts', 3],
-      ['src/renderer/src/components/terminal-pane/pty-connection/connect-pane-pty.ts', 2],
-      ['src/renderer/src/components/terminal-pane/terminal-ctrl-enter.ts', 2],
-      ['src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.ts', 2],
-      ['src/renderer/src/components/terminal-pane/use-notification-dispatch.ts', 2]
-    ]
-  },
-  {
-    helper: 'resolveCommittedTitleAgentType',
-    classification: 'identity-consumer',
-    paths: [
-      ['src/renderer/src/components/terminal-pane/native-chat-leaf-title-agent.ts', 4],
-      ['src/renderer/src/components/terminal-pane/pty-connection/pane-agent-identity.ts', 2]
-    ]
-  },
-  {
-    helper: 'resolveCommittedTitleAgentType',
-    classification: 'parser-implementation',
-    paths: ['src/renderer/src/lib/pane-agent-evidence.ts']
-  },
-  {
-    helper: 'resolveCommittedTitleAgentType',
-    classification: 'action-consumer',
-    paths: [
-      ['src/renderer/src/components/terminal-pane/pty-connection/command-inferred-pane-agent.ts', 2]
-    ]
-  },
-  {
-    helper: 'resolvePaneAgentOwner',
-    classification: 'parser-implementation',
-    paths: ['src/shared/pane-agent-owner.ts']
-  },
-  {
-    helper: 'resolvePaneAgentOwner',
-    classification: 'evidence-producer',
-    paths: [['src/renderer/src/components/terminal-pane/parked-terminal-command-status.ts', 2]]
-  },
-  {
-    helper: 'resolvePaneAgentOwner',
-    classification: 'identity-consumer',
-    paths: [
-      ['src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.ts', 2],
-      ['src/renderer/src/components/terminal-pane/pty-connection/shell-command-inference.ts', 2],
-      ['src/renderer/src/lib/use-tab-agent.ts', 2]
-    ]
-  },
-  {
-    helper: 'resolveCompatibleAgentTypeForOwner',
-    classification: 'parser-implementation',
-    paths: [['src/shared/agent-title-owner.ts', 2]]
-  },
-  {
-    helper: 'resolveCompatibleAgentTypeForOwner',
-    classification: 'identity-consumer',
-    paths: [
-      ['src/renderer/src/components/sidebar/worktree-agent-row-type.ts', 2],
-      ['src/main/runtime/runtime-mobile-session-projection.ts', 3],
-      ['src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.ts', 2],
-      ['src/renderer/src/lib/tab-agent-from-signals.ts', 2],
-      ['src/renderer/src/lib/use-tab-agent.ts', 2]
-    ]
-  },
-  {
-    helper: 'resolveCompatibleAgentTypeForOwner',
-    classification: 'action-consumer',
-    paths: [
-      ['src/renderer/src/components/terminal-pane/pty-connection/agent-task-complete-notify.ts', 2],
-      [
-        'src/renderer/src/components/terminal-pane/pty-connection/command-inferred-pane-agent.ts',
-        3
-      ],
-      ['src/renderer/src/components/terminal-pane/pty-connection/terminal-keydown-fit.ts', 3]
-    ]
-  },
-  {
-    helper: 'resolveCompatibleAgentTypeForOwner',
-    classification: 'evidence-producer',
-    paths: [
-      ['src/renderer/src/components/terminal-pane/pty-connection/direct-ssh-retry-status.ts', 2],
-      ['src/renderer/src/components/terminal-pane/pty-connection/title-spawn-bell.ts', 2]
-    ]
-  },
-  {
-    helper: 'classifyTitleActivity',
-    classification: 'identity-consumer',
-    paths: [
-      ['src/renderer/src/components/sidebar/smart-attention.ts', 3],
-      ['src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.ts', 2],
-      ['src/renderer/src/components/status-bar/workspace-space-presentation.ts', 3],
-      ['src/renderer/src/lib/active-agent-note-target.ts', 2],
-      ['src/renderer/src/lib/worktree-status.ts', 3],
-      ['src/renderer/src/store/slices/terminal-helpers.ts', 2]
-    ]
-  },
-  {
-    helper: 'classifyTitleActivity',
-    classification: 'action-consumer',
-    paths: [
-      ['src/renderer/src/components/terminal-pane/cache-timer-seeding.ts', 2],
-      ['src/renderer/src/lib/agent-ready-wait.ts', 2],
-      ['src/renderer/src/store/terminals/terminal-ephemeral-state.ts', 2]
-    ]
-  },
-  {
-    helper: 'classifyTitleActivity',
-    classification: 'activity-only',
-    paths: [
-      ['src/renderer/src/store/slices/workspace-cleanup-local-evidence.ts', 3],
-      ['src/renderer/src/store/terminals/terminal-tab-presentation.ts', 4]
-    ]
-  },
-  {
-    helper: 'classifyTitleActivity',
-    classification: 'evidence-producer',
-    paths: [
-      ['src/renderer/src/lib/agent-send-title-status.ts', 2],
-      ['src/renderer/src/lib/agent-status-terminal-title.ts', 2]
-    ]
-  },
-  {
-    helper: 'classifyTitleActivity',
-    classification: 'parser-implementation',
-    paths: [
-      ['src/renderer/src/lib/agent-status.ts', 5],
-      'src/renderer/src/lib/pane-agent-evidence.ts'
-    ]
-  },
-  {
-    helper: 'detectAgentStatusFromTitle',
-    classification: 'evidence-producer',
-    paths: [
-      ['src/main/runtime/orca-runtime-apply-tracked-pty-title.ts', 2],
-      ['src/main/runtime/orca-runtime-get-pty-record-for-pane-key.ts', 2],
-      ['src/main/runtime/orca-runtime-get-unpersisted-tracked-title-for-pty.ts', 2],
-      ['src/main/runtime/orca-runtime-maybe-hydrate-headless-from-renderer.ts', 2],
-      ['src/main/runtime/orca-runtime-record-agent-prompt-lifecycle-state.ts', 2],
-      ['src/main/runtime/runtime-terminal-agent-status-query.ts', 3],
-      ['src/main/runtime/runtime-worktree-status-projection.ts', 4],
-      ['src/main/runtime/terminal-wait-detection.ts', 2],
-      ['src/renderer/src/components/terminal-pane/agent-completion-title-observer.ts', 2],
-      ['src/renderer/src/components/terminal-pane/pty-connection/shell-command-inference.ts', 4],
-      ['src/renderer/src/components/terminal-pane/pty-output-title-observer.ts', 2],
-      ['src/shared/terminal-output-side-effects.ts', 3]
-    ]
-  },
-  {
-    helper: 'detectAgentStatusFromTitle',
-    classification: 'action-consumer',
-    paths: [
-      ['src/renderer/src/components/terminal-pane/pty-connection/agent-task-complete-notify.ts', 2],
-      [
-        'src/renderer/src/components/terminal-pane/pty-connection/command-inferred-pane-agent.ts',
-        3
-      ],
-      ['src/renderer/src/components/terminal-pane/pty-connection/interrupt-input-intent.ts', 3]
-    ]
-  },
-  {
-    helper: 'detectAgentStatusFromTitle',
-    classification: 'parser-implementation',
-    paths: [
-      ['src/renderer/src/components/terminal-pane/title-agent-identity.ts', 2],
-      'src/renderer/src/lib/agent-status.ts',
-      ['src/renderer/src/lib/pane-agent-evidence.ts', 3],
-      ['src/shared/agent-decorative-title-signature.ts', 2],
-      'src/shared/agent-detection.ts',
-      ['src/shared/agent-title-owner.ts', 2],
-      ['src/shared/agent-title-status.ts', 6]
-    ]
-  },
-  {
-    helper: 'resolveAgentTypeFromTerminalTitle',
-    classification: 'identity-consumer',
-    paths: [
-      ['src/renderer/src/components/sidebar/worktree-agent-row-type.ts', 2],
-      'src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.ts',
-      ['src/renderer/src/lib/worktree-status.ts', 2]
-    ]
-  },
-  {
-    helper: 'resolvePaneAgentIdentity',
-    classification: 'parser-implementation',
-    paths: ['src/shared/pane-agent-identity-resolver.ts']
-  },
-  {
-    helper: 'resolvePaneAgentIdentity',
-    classification: 'identity-consumer',
-    paths: [['src/shared/published-pane-agent-identity.ts', 2]]
-  },
-  {
-    helper: 'resolveCanonicalPaneAgentIdentity',
-    classification: 'parser-implementation',
-    paths: ['src/shared/pane-agent-identity-adapter.ts']
-  },
-  {
-    helper: 'resolveCanonicalPaneAgentIdentity',
-    classification: 'identity-consumer',
-    paths: [['src/shared/agent-status-identity.ts', 2]]
-  },
-  {
-    helper: 'resolveCanonicalPaneAgentIdentity',
-    classification: 'identity-consumer',
-    paths: [['src/shared/terminal-title-agent-type.ts', 2]]
-  },
-  {
-    helper: 'resolvePublishedPaneAgentIdentity',
-    classification: 'parser-implementation',
-    paths: [
-      'src/shared/published-pane-agent-identity.ts',
-      ['src/main/runtime/orca-runtime-write-orchestration-pointer-pty.ts', 2]
-    ]
-  }
-]
-
-const DIRECT_SINGLE_SOURCE_SURFACES: readonly {
-  path: string
-  classification: Classification
-  marker: string
-}[] = [
-  {
-    path: 'src/renderer/src/components/terminal-pane/terminal-renderer-policy.ts',
-    classification: 'identity-consumer',
-    marker: 'resolveGeminiCompatFallback'
-  },
-  {
-    path: 'src/renderer/src/components/terminal-pane/terminal-title-evidence.ts',
-    classification: 'identity-consumer',
-    marker: 'resolvePaneTitleDecision'
-  },
-  {
-    path: 'src/renderer/src/components/terminal/terminal-close-copy-kind.ts',
-    classification: 'identity-consumer',
-    marker: 'resolveLeafCloseCopyKind'
-  },
-  {
-    path: 'src/main/runtime/orchestration/mailbox-pointer-stage.ts',
-    classification: 'action-consumer',
-    marker: 'isCursorAgentTitle'
-  },
-  {
-    path: 'src/main/providers/local-pty-session-activation.ts',
-    classification: 'action-consumer',
-    marker: 'launchAgent'
-  },
-  {
-    path: 'src/renderer/src/components/terminal-pane/pty-connection/pane-serializer-settle.ts',
-    classification: 'action-consumer',
-    marker: 'sendStartupDraftPaste'
-  },
-  {
-    path: 'src/renderer/src/lib/active-agent-note-send.ts',
-    classification: 'action-consumer',
-    marker: 'sendNotesToActiveAgentSession'
-  },
-  {
-    path: 'src/renderer/src/components/native-chat/native-chat-runtime-send.ts',
-    classification: 'action-consumer',
-    marker: 'sendNativeChatMessage'
-  },
-  {
-    path: 'mobile/src/session/mobile-native-chat-send.ts',
-    classification: 'action-consumer',
-    marker: 'sendMobileNativeChatMessageWithOutcome'
-  },
-  {
-    path: 'mobile/src/session/mobile-native-chat-image-send.ts',
-    classification: 'action-consumer',
-    marker: 'pasteMobileNativeChatImagePaths'
-  },
-  {
-    path: 'mobile/src/session/pr-ai-triage-launch.ts',
-    classification: 'action-consumer',
-    marker: 'createTerminalAndSendPrompt'
-  }
-]
-
-describe('pane agent identity inventory ratchet', () => {
-  it('classifies every legacy helper definition, import, and callsite in src and mobile/src', async () => {
-    const files = await glob(['src/**/*.{ts,tsx}', 'mobile/src/**/*.{ts,tsx}'], {
-      ignore: ['**/*.test.*', '**/*.spec.*']
-    })
-    const actual: { helper: Helper; path: string; occurrences: number }[] = []
-    for (const path of files) {
-      if (isTestFile(path) || TEST_SUPPORT_PATHS.has(path)) {
-        continue
-      }
-      const rawSource = readFileSync(join(process.cwd(), path), 'utf8')
-      if (!HELPERS.some((helper) => rawSource.includes(helper))) {
-        continue
-      }
-      const decommentedSource = stripComments(rawSource)
-      if (blankStringContentsDesynced(decommentedSource)) {
-        throw new Error(`String scanner desynchronized while inventorying ${path}`)
-      }
-      const source = blankStringContents(decommentedSource)
-      for (const helper of HELPERS) {
-        const occurrences = source.match(new RegExp(`\\b${helper}\\b`, 'g'))?.length ?? 0
-        if (occurrences > 0) {
-          actual.push({ helper, path, occurrences })
-        }
-      }
-    }
-    const expected = INVENTORY.flatMap(({ helper, paths }) =>
-      paths.map((site) => {
-        const [path, occurrences] = typeof site === 'string' ? [site, 1] : site
-        return { helper, path, occurrences }
-      })
-    )
-    const byHelperAndPath = (left: (typeof actual)[number], right: (typeof actual)[number]) =>
-      left.helper.localeCompare(right.helper) || left.path.localeCompare(right.path)
-    expect(actual.sort(byHelperAndPath)).toEqual(expected.sort(byHelperAndPath))
-  }, 30_000)
-
-  it('pins direct single-source identity and action branches outside named helpers', () => {
-    for (const site of DIRECT_SINGLE_SOURCE_SURFACES) {
-      const source = stripComments(readFileSync(join(process.cwd(), site.path), 'utf8'))
-      expect({
-        path: site.path,
-        classification: site.classification,
-        hasMarker: source.includes(site.marker)
-      }).toEqual({ path: site.path, classification: site.classification, hasMarker: true })
-    }
-  })
-})
diff --git a/src/shared/pane-agent-identity-surface-inventory.test.ts b/src/shared/pane-agent-identity-surface-inventory.test.ts
deleted file mode 100644
index 77d9edb3b84..00000000000
--- a/src/shared/pane-agent-identity-surface-inventory.test.ts
+++ /dev/null
@@ -1,284 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-import { glob } from 'tinyglobby'
-import { isTestFile, stripComments } from './source-scan/source-tree-scan'
-
-/**
- * Surface half of the identity inventory ratchet: every consumer decision point from the closed
- * 65-row inventory (rows 32–65 — the direct title/native-chat selectors, tab projections, mobile
- * sync graph, lifecycle selectors, status/OSC ingress, worktree status, attention, and
- * title-reset paths) is pinned to a marker symbol in its file. The helper-name census
- * (`pane-agent-identity-inventory.test.ts`) is necessary but not sufficient — these files reach
- * identity through direct reads a name census cannot see. Moving or renaming a marker means the
- * inventory row must be re-classified, deliberately, before review.
- */
-
-type SurfaceRow = {
-  /** Row number in the closed consumer inventory. */
-  row: number
-  path: string
-  marker: string
-}
-
-const SURFACE_ROWS: readonly SurfaceRow[] = [
-  {
-    row: 32,
-    path: 'src/renderer/src/components/terminal-pane/native-chat-leaf-title-agent.ts',
-    marker: 'resolveNativeChatLeafTitleAgent'
-  },
-  {
-    row: 32,
-    path: 'src/renderer/src/components/terminal-pane/use-terminal-pane-chat-state.ts',
-    marker: 'resolveNativeChatLeafTitleAgent'
-  },
-  {
-    row: 33,
-    path: 'src/renderer/src/components/terminal-pane/pty-connection/pane-agent-identity.ts',
-    marker: 'installPaneAgentIdentity'
-  },
-  { row: 34, path: 'src/main/runtime/orchestration/groups.ts', marker: 'terminalIsAgent' },
-  {
-    row: 35,
-    path: 'src/renderer/src/lib/active-agent-note-target.ts',
-    marker: 'getActiveTerminalNoteTarget'
-  },
-  {
-    row: 36,
-    path: 'src/renderer/src/components/terminal-pane/terminal-agent-paste-bracketing.ts',
-    marker: 'resolveProtectedMultilinePasteOptionsForPane'
-  },
-  {
-    row: 37,
-    path: 'src/renderer/src/components/terminal-pane/command-code-output-ownership.ts',
-    marker: 'canCommandCodeOutputOwnPane'
-  },
-  { row: 38, path: 'src/renderer/src/lib/agent-ready-wait.ts', marker: 'waitForAgentReady' },
-  {
-    row: 39,
-    path: 'src/renderer/src/lib/agent-paste-draft.ts',
-    marker: 'getSettingsForAgentTabRuntimeOwner'
-  },
-  {
-    row: 40,
-    path: 'src/renderer/src/lib/agent-followup-delivery.ts',
-    marker: 'sendFollowupPromptWhenAgentReady'
-  },
-  {
-    row: 41,
-    path: 'src/renderer/src/lib/codex-session-restart.ts',
-    marker: 'markLiveCodexSessionsForRestart'
-  },
-  {
-    row: 41,
-    path: 'src/renderer/src/lib/codex-pane-restart-eligibility.ts',
-    marker: 'isCodexForegroundProcess'
-  },
-  {
-    row: 42,
-    path: 'src/renderer/src/components/native-chat/native-chat-availability.ts',
-    marker: 'canToggleNativeChat'
-  },
-  {
-    row: 43,
-    path: 'src/renderer/src/components/native-chat/native-chat-pane-resolution.ts',
-    marker: 'resolveNativeChatSession'
-  },
-  {
-    row: 44,
-    path: 'src/renderer/src/components/terminal-pane/terminal-agent-session-continuation.ts',
-    marker: 'canContinueAgentSessionInNewSession'
-  },
-  {
-    row: 45,
-    path: 'src/renderer/src/components/terminal-pane/terminal-agent-session-fork.ts',
-    marker: 'prepareAgentSessionForkFromPane'
-  },
-  {
-    row: 46,
-    path: 'src/renderer/src/components/terminal-pane/agent-interrupt-inference.ts',
-    marker: 'isPlainEscapeKeyEvent'
-  },
-  {
-    row: 46,
-    path: 'src/renderer/src/components/terminal-pane/agent-question-answered-inference.ts',
-    marker: 'inferQuestionAnsweredFromCurrentStatus'
-  },
-  {
-    row: 47,
-    path: 'src/renderer/src/components/terminal-pane/terminal-keyboard-protocol-pane-agent.ts',
-    marker: 'resolvePaneKeyboardProtocolAgent'
-  },
-  {
-    row: 47,
-    path: 'src/renderer/src/components/terminal-pane/terminal-pane-manager-options.ts',
-    marker: 'resolvePaneKeyboardProtocolAgent'
-  },
-  {
-    row: 48,
-    path: 'src/renderer/src/components/tab-bar/tab-agent-types-by-tab-id.ts',
-    marker: 'selectTabAgentTypesByTabId'
-  },
-  {
-    row: 49,
-    path: 'src/renderer/src/components/terminal-pane/terminal-tab-agent-type-index.ts',
-    marker: 'createTerminalTabAgentTypeSelector'
-  },
-  {
-    row: 50,
-    path: 'src/renderer/src/lib/tab-agent-status-index.ts',
-    marker: 'selectLiveTabAgentPanes'
-  },
-  {
-    row: 51,
-    path: 'src/renderer/src/components/tab-bar/terminal-tab-activity-status.ts',
-    marker: 'resolveTerminalTabActivityStatus'
-  },
-  {
-    row: 52,
-    path: 'src/renderer/src/lib/workspace-tab-agent-metadata.ts',
-    marker: 'maxAgentActivityAt'
-  },
-  {
-    row: 52,
-    path: 'src/renderer/src/lib/workspace-tab-palette-entry-builder.ts',
-    marker: 'buildSearchableWorkspaceTabEntries'
-  },
-  {
-    row: 53,
-    path: 'src/renderer/src/lib/running-agent-targets.ts',
-    marker: 'deriveRunningAgentSendTargets'
-  },
-  {
-    row: 54,
-    path: 'src/renderer/src/runtime/sync-runtime-graph.ts',
-    marker: 'buildMobileSessionTabSnapshots'
-  },
-  {
-    row: 55,
-    path: 'src/renderer/src/lib/agent-hibernation-pane-eligibility.ts',
-    marker: 'toRuntimePtyId'
-  },
-  {
-    row: 56,
-    path: 'src/renderer/src/lib/resume-sleeping-agent-session.ts',
-    marker: 'resumeSleepingAgentSessionsForWorktree'
-  },
-  {
-    row: 57,
-    path: 'src/renderer/src/lib/automation-session-reuse.ts',
-    marker: 'findReusableAutomationSession'
-  },
-  {
-    row: 58,
-    path: 'src/renderer/src/components/terminal-pane/pty-connection/cold-restore-resume-startup.ts',
-    marker: 'bindBuildColdRestoreAgentResumeStartup'
-  },
-  {
-    row: 59,
-    path: 'src/main/agent-hooks/server/server-authority-evidence.ts',
-    marker: 'recordCurrentAuthorityObservation'
-  },
-  {
-    row: 59,
-    path: 'src/main/runtime/orca-runtime-write-orchestration-pointer-pty.ts',
-    marker: 'resolvePaneAgentIdentityField'
-  },
-  {
-    row: 59,
-    path: 'src/renderer/src/hooks/ipc-events/agent-status-event-applicator.ts',
-    marker: 'createAgentStatusEventApplicator'
-  },
-  {
-    row: 59,
-    path: 'src/renderer/src/store/slices/agent-status-authority-actions.ts',
-    marker: 'transferAgentPaneAuthority'
-  },
-  {
-    row: 59,
-    path: 'src/renderer/src/store/slices/pane-foreground-agent.ts',
-    marker: 'createPaneForegroundAgentSlice'
-  },
-  {
-    row: 59,
-    path: 'src/renderer/src/hooks/ipc-events/agent-status-routing.ts',
-    marker: 'isAgentStatusForRecentlyClosedTab'
-  },
-  {
-    row: 60,
-    path: 'src/renderer/src/components/terminal-pane/pty-connection/title-spawn-bell.ts',
-    marker: 'installTitleSpawnBell'
-  },
-  { row: 61, path: 'src/renderer/src/lib/worktree-status.ts', marker: 'getWorktreeStatus' },
-  {
-    row: 62,
-    path: 'src/main/runtime/runtime-worktree-status-projection.ts',
-    marker: 'getLeafWorktreeStatus'
-  },
-  {
-    row: 63,
-    path: 'src/renderer/src/components/sidebar/smart-attention.ts',
-    marker: 'buildAttentionByWorktree'
-  },
-  {
-    row: 64,
-    path: 'src/renderer/src/components/status-bar/workspace-space-presentation.ts',
-    marker: 'countWorkspaceSpaceActiveAgents'
-  },
-  { row: 65, path: 'src/renderer/src/store/slices/terminal-helpers.ts', marker: 'getResetTitle' },
-  {
-    row: 6,
-    path: 'src/renderer/src/runtime/web-session-tabs-sync.ts',
-    marker: 'applyWebSessionTabs'
-  }
-]
-
-describe('pane agent identity surface inventory (rows 6, 32–65)', () => {
-  it('every pinned surface still carries its marker symbol', () => {
-    for (const row of SURFACE_ROWS) {
-      const source = stripComments(readFileSync(join(process.cwd(), row.path), 'utf8'))
-      expect({ row: row.row, path: row.path, hasMarker: source.includes(row.marker) }).toEqual({
-        row: row.row,
-        path: row.path,
-        hasMarker: true
-      })
-    }
-  })
-})
-
-/**
- * Identity-observation rebind audit. Advancing a pane incarnation without a positive replacement
- * proof is how a legitimate reclaim and a stale-hook bug get conflated (see
- * `PaneReplacementProof` in pane-agent-identity-adapter.ts). Every existing sequencer `rebind`
- * call is pinned here by file and count: today they are the retired-pane `restart` disposition
- * (three ingress paths) and the renderer pane-key transfer. Adding a rebind call, or changing
- * these, requires updating this audit — and per the migration plan, a `replacementProof`.
- */
-const IDENTITY_SEQUENCER_REBIND_RE = /\b(?:observations|rendererAgentStatusObservations)\.rebind\(/g
-
-const EXPECTED_REBIND_SITES: readonly (readonly [path: string, occurrences: number])[] = [
-  ['src/main/agent-hooks/server/server-ingest-normalization.ts', 1],
-  ['src/main/agent-hooks/server/server-ingest-remote.ts', 1],
-  ['src/main/agent-hooks/server/server-lifecycle.ts', 1],
-  ['src/renderer/src/store/slices/agent-status-authority-actions.ts', 1]
-]
-
-describe('identity observation rebind audit', () => {
-  it('pins every identity-sequencer rebind call site by file and count', async () => {
-    const files = await glob(['src/**/*.{ts,tsx}', 'mobile/src/**/*.{ts,tsx}'], {
-      ignore: ['**/*.test.*', '**/*.spec.*']
-    })
-    const actual: [string, number][] = []
-    for (const path of files.sort()) {
-      if (isTestFile(path)) {
-        continue
-      }
-      const source = stripComments(readFileSync(join(process.cwd(), path), 'utf8'))
-      const occurrences = source.match(IDENTITY_SEQUENCER_REBIND_RE)?.length ?? 0
-      if (occurrences > 0) {
-        actual.push([path, occurrences])
-      }
-    }
-    expect(actual).toEqual(EXPECTED_REBIND_SITES.map((site) => [...site]))
-  }, 30_000)
-})
diff --git a/src/shared/persisted-ui-state-types.ts b/src/shared/persisted-ui-state-types.ts
index db5bd7ac377..97e7afced95 100644
--- a/src/shared/persisted-ui-state-types.ts
+++ b/src/shared/persisted-ui-state-types.ts
@@ -73,6 +73,8 @@ export type PersistedUIState = {
   /** Keep each project's main workspace out of the "Hide sleeping" sweep. Absent means on (#8873). */
   alwaysShowDefaultBranchWorkspace?: boolean
   /** Per-worktree Explorer dotfile visibility. Missing entries inherit the default: show. */
+  _explorerDisplayRootMigrated?: boolean
+  explorerDisplayRootByWorktree?: Record<string, string>
   showDotfilesByWorktree?: Record<string, boolean>
   filterRepoIds: string[]
   /** Agents-view host scope; deliberately separate from visibleWorkspaceHostIds so a monitoring surface never inherits nav filters silently. `null` = all hosts. */
@@ -118,6 +120,10 @@ export type PersistedUIState = {
   _antigravityStatusBarDefaultAdded?: boolean
   /** One-shot migration flag for adding the default-on Grok status item. */
   _grokStatusBarDefaultAdded?: boolean
+  /** One-shot migration flag for adding the default-on Cursor status item. */
+  _cursorStatusBarDefaultAdded?: boolean
+  /** One-shot migration flag for adding the default-on ZCode status item. */
+  _zcodeStatusBarDefaultAdded?: boolean
   statusBarItems: StatusBarItem[]
   statusBarVisible: boolean
   /** Why: this is client-side presentation, not a provider/account or execution-host setting. */
diff --git a/src/shared/powershell-native-argument.test.ts b/src/shared/powershell-native-argument.test.ts
index 276413f4fac..b8e1feb8aa2 100644
--- a/src/shared/powershell-native-argument.test.ts
+++ b/src/shared/powershell-native-argument.test.ts
@@ -4,6 +4,9 @@ import { quotePowerShellLiteral, quotePowerShellNativeArgument } from './powersh
 describe('PowerShell native argument quoting', () => {
   it('escapes literals for PowerShell source parsing', () => {
     expect(quotePowerShellLiteral("WSL 'Preview'")).toBe("'WSL ''Preview'''")
+    expect(quotePowerShellLiteral('O\u2019Brien \u2018x\u201A\u201B')).toBe(
+      "'O\u2019\u2019Brien \u2018\u2018x\u201A\u201A\u201B\u201B'"
+    )
   })
 
   it('pre-escapes embedded quotes for Windows native argv parsing', () => {
diff --git a/src/shared/powershell-native-argument.ts b/src/shared/powershell-native-argument.ts
index 6376ab5d842..f357a8e8fb7 100644
--- a/src/shared/powershell-native-argument.ts
+++ b/src/shared/powershell-native-argument.ts
@@ -1,5 +1,6 @@
 export function quotePowerShellLiteral(value: string): string {
-  return `'${value.replace(/'/g, "''")}'`
+  // Why: PowerShell also ends single-quoted strings at typographic single quotes.
+  return `'${value.replace(/['\u2018\u2019\u201A\u201B]/g, '$&$&')}'`
 }
 
 export function quotePowerShellNativeArgument(value: string): string {
diff --git a/src/shared/priority-semaphore.test.ts b/src/shared/priority-semaphore.test.ts
index aeeacda94ef..5cfbe898bdc 100644
--- a/src/shared/priority-semaphore.test.ts
+++ b/src/shared/priority-semaphore.test.ts
@@ -2,19 +2,6 @@ import { describe, expect, it } from 'vitest'
 import { PrioritySemaphore } from './priority-semaphore'
 
 describe('PrioritySemaphore', () => {
-  it('allows up to N concurrent acquires', async () => {
-    const sem = new PrioritySemaphore(2)
-    const r1 = await sem.acquire(0)
-    const r2 = await sem.acquire(0)
-
-    // Both acquired immediately
-    expect(typeof r1).toBe('function')
-    expect(typeof r2).toBe('function')
-
-    r1()
-    r2()
-  })
-
   it('blocks when concurrency limit is reached', async () => {
     const sem = new PrioritySemaphore(1)
     const r1 = await sem.acquire(0)
@@ -129,23 +116,6 @@ describe('PrioritySemaphore', () => {
     expect(order[0]).toBe('B-high')
   })
 
-  it('works with zero waiters', async () => {
-    const sem = new PrioritySemaphore(3)
-    const r1 = await sem.acquire(0)
-    r1()
-    // No crash, no hanging
-  })
-
-  it('release is idempotent', async () => {
-    const sem = new PrioritySemaphore(1)
-    const r1 = await sem.acquire(0)
-    r1()
-    r1() // double release should not throw or corrupt state
-
-    const r2 = await sem.acquire(0)
-    r2()
-  })
-
   it('removes an aborted waiter without consuming the next permit', async () => {
     const sem = new PrioritySemaphore(1)
     const release = await sem.acquire(0)
diff --git a/src/shared/process-table-index.test.ts b/src/shared/process-table-index.test.ts
new file mode 100644
index 00000000000..61f59ee1c99
--- /dev/null
+++ b/src/shared/process-table-index.test.ts
@@ -0,0 +1,160 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  buildProcessTableIndex,
+  collectDescendantsFromIndex,
+  type ProcessIdentityRow
+} from './process-table-index'
+import { parseStrictProcessTableRows } from './process-table-snapshot'
+
+function boundedWalk<Row extends ProcessIdentityRow>(rows: readonly Row[], rootPid: number) {
+  const index = buildProcessTableIndex(rows)
+  const get = index.childrenByPpid.get.bind(index.childrenByPpid)
+  let lookups = 0
+  // A missing cycle guard must fail the test before it can hang or exhaust memory.
+  const spy = vi.spyOn(index.childrenByPpid, 'get').mockImplementation((pid) => {
+    if (++lookups > rows.length + 1) {
+      throw new Error('Descendant walk exceeded the row budget')
+    }
+    return get(pid)
+  })
+  try {
+    const result = collectDescendantsFromIndex(index, rootPid)
+    expect(result.some((row) => row.pid === rootPid)).toBe(false)
+    expect(new Set(result.map((row) => row.pid)).size).toBe(result.length)
+    return result
+  } finally {
+    spy.mockRestore()
+  }
+}
+
+describe('collectDescendantsFromIndex', () => {
+  it('preserves capture-order stack traversal, depth, row fields and input ownership', () => {
+    const rows = Object.freeze([
+      Object.freeze({ pid: 100, ppid: 1, command: 'shell' }),
+      Object.freeze({ pid: 200, ppid: 100, command: 'left' }),
+      Object.freeze({ pid: 201, ppid: 100, command: 'right' }),
+      Object.freeze({ pid: 300, ppid: 200, command: 'left-first' }),
+      Object.freeze({ pid: 301, ppid: 200, command: 'left-last' }),
+      Object.freeze({ pid: 400, ppid: 201, command: 'right-child' })
+    ])
+    const result = boundedWalk(rows, 100)
+    expect(result).toEqual([
+      { ...rows[2], depth: 1 },
+      { ...rows[5], depth: 2 },
+      { ...rows[1], depth: 1 },
+      { ...rows[4], depth: 2 },
+      { ...rows[3], depth: 2 }
+    ])
+    expect(result[0]).not.toBe(rows[2])
+    expect(Object.isFrozen(result[0])).toBe(false)
+  })
+
+  it('excludes a self-parented root', () => {
+    expect(
+      boundedWalk(
+        [
+          { pid: 5, ppid: 5 },
+          { pid: 6, ppid: 5 }
+        ],
+        5
+      )
+    ).toEqual([{ pid: 6, ppid: 5, depth: 1 }])
+  })
+
+  it('excludes the root from a two-node cycle with unique PIDs', () => {
+    expect(
+      boundedWalk(
+        [
+          { pid: 5, ppid: 6 },
+          { pid: 6, ppid: 5 }
+        ],
+        5
+      )
+    ).toEqual([{ pid: 6, ppid: 5, depth: 1 }])
+  })
+
+  it('terminates on a reachable two-node cycle with duplicate rows', () => {
+    const rows = [
+      { pid: 9, ppid: 1 },
+      { pid: 3, ppid: 9 },
+      { pid: 2, ppid: 3 },
+      { pid: 3, ppid: 2 }
+    ]
+    expect(boundedWalk(rows, 9)).toEqual([
+      { pid: 3, ppid: 9, depth: 1 },
+      { pid: 2, ppid: 3, depth: 2 }
+    ])
+  })
+
+  it('terminates on a reachable self-cycle', () => {
+    expect(
+      boundedWalk(
+        [
+          { pid: 2, ppid: 1 },
+          { pid: 2, ppid: 2 }
+        ],
+        1
+      )
+    ).toEqual([{ pid: 2, ppid: 1, depth: 1 }])
+  })
+
+  it('never returns a duplicate row that reuses the root PID', () => {
+    const rows = [
+      { pid: 50, ppid: 1 },
+      { pid: 60, ppid: 50 },
+      { pid: 50, ppid: 60 }
+    ]
+    expect(boundedWalk(rows, 50)).toEqual([{ pid: 60, ppid: 50, depth: 1 }])
+  })
+
+  it('ignores disconnected cycles and unrelated components', () => {
+    const rows = [
+      { pid: 2, ppid: 1 },
+      { pid: 8, ppid: 9 },
+      { pid: 9, ppid: 8 },
+      { pid: 20, ppid: 19 }
+    ]
+    expect(boundedWalk(rows, 1)).toEqual([{ pid: 2, ppid: 1, depth: 1 }])
+    expect(boundedWalk(rows, 99)).toEqual([])
+    expect(boundedWalk([], 1)).toEqual([])
+  })
+
+  it('queues each PID once, retaining the first queued duplicate', () => {
+    const rows = [
+      { pid: 2, ppid: 1, marker: 'first' },
+      { pid: 2, ppid: 1, marker: 'duplicate' },
+      { pid: 3, ppid: 1, marker: 'sibling' },
+      { pid: 2, ppid: 3, marker: 'other-parent' },
+      { pid: 4, ppid: 2, marker: 'child' }
+    ]
+    expect(boundedWalk(rows, 1)).toEqual([
+      { ...rows[2], depth: 1 },
+      { ...rows[0], depth: 1 },
+      { ...rows[4], depth: 2 }
+    ])
+    expect(buildProcessTableIndex(rows).byPid.get(2)).toBe(rows[0])
+  })
+
+  it('walks a deep valid tree without recursion or changing depth', () => {
+    const rows = Array.from({ length: 10_000 }, (_, index) => ({ pid: index + 2, ppid: index + 1 }))
+    expect(boundedWalk(rows, 1)).toEqual(rows.map((row, index) => ({ ...row, depth: index + 1 })))
+  })
+
+  it('preserves reverse capture order for a broad valid tree', () => {
+    const rows = Array.from({ length: 10_000 }, (_, index) => ({ pid: index + 2, ppid: 1 }))
+    expect(boundedWalk(rows, 1)).toEqual(rows.toReversed().map((row) => ({ ...row, depth: 1 })))
+  })
+
+  it('retains synthetic POSIX host identity fields through a cycle', () => {
+    const rows = parseStrictProcessTableRows('5 6 5 6 S pts/1 100 bash\n6 5 6 6 S+ pts/1 200 codex')
+    expect(boundedWalk(rows, 5)).toEqual([{ ...rows[1], depth: 1 }])
+  })
+
+  it('retains synthetic Windows creation markers without treating a PID as an incarnation', () => {
+    const rows = [
+      { pid: 5, ppid: 6, creationTimeMs: 100, name: 'pwsh.exe' },
+      { pid: 6, ppid: 5, creationTimeMs: 200, name: 'node.exe' }
+    ]
+    expect(boundedWalk(rows, 5)).toEqual([{ ...rows[1], depth: 1 }])
+  })
+})
diff --git a/src/shared/process-table-index.ts b/src/shared/process-table-index.ts
index dd4d29195af..e8dc308b80b 100644
--- a/src/shared/process-table-index.ts
+++ b/src/shared/process-table-index.ts
@@ -70,12 +70,24 @@ export function collectDescendantsFromIndex<Row extends ProcessIdentityRow>(
   rootPid: number
 ): (Row & { depth: number })[] {
   const descendants: (Row & { depth: number })[] = []
-  const stack = (index.childrenByPpid.get(rootPid) ?? []).map((row) => ({ row, depth: 1 }))
+  // PID reuse can make a process snapshot cyclic; queue each PID at most once.
+  const visited = new Set<number>([rootPid])
+  const stack: { row: Row; depth: number }[] = []
+  const pushUnvisited = (row: Row, depth: number): void => {
+    if (visited.has(row.pid)) {
+      return
+    }
+    visited.add(row.pid)
+    stack.push({ row, depth })
+  }
+  for (const child of index.childrenByPpid.get(rootPid) ?? []) {
+    pushUnvisited(child, 1)
+  }
   while (stack.length > 0) {
     const { row, depth } = stack.pop()!
     descendants.push({ ...row, depth })
     for (const child of index.childrenByPpid.get(row.pid) ?? []) {
-      stack.push({ row: child, depth: depth + 1 })
+      pushUnvisited(child, depth + 1)
     }
   }
   return descendants
diff --git a/src/shared/process-table-snapshot.test.ts b/src/shared/process-table-snapshot.test.ts
index fea3d891b6d..19aa4312764 100644
--- a/src/shared/process-table-snapshot.test.ts
+++ b/src/shared/process-table-snapshot.test.ts
@@ -300,16 +300,6 @@ describe('shared process-table capture', () => {
     ])
   })
 
-  it('builds only the indexes a resolver reads', () => {
-    // Why: an unread group index costs two maps plus a per-row array on every
-    // capture, on the exact path this reader exists to make cheap.
-    const index = buildProcessTableIndex(
-      parseStrictProcessTableRows('100 1 100 101 Ss /bin/zsh\n101 100 101 101 S+ node /opt/codex')
-    )
-
-    expect(Object.keys(index).sort()).toEqual(['byPid', 'childrenByPpid', 'rows', 'stats'])
-  })
-
   it('keeps the lenient view readable when the same capture is strictly unreadable', async () => {
     const forks = mockPsCaptures('100 1 Ss+ /bin/zsh\n')
 
@@ -502,14 +492,6 @@ describe('getProcessTableIndex', () => {
     expect(buildProcessTableIndex(rows).byPid.get(100)).toBe(rows[0])
   })
 
-  it('materializes only the maps the descendant walk reads', () => {
-    // Why: this memo exists to cut relay CPU; four indexes for two readers would
-    // make a single-pane relay pay more per capture than the code it replaced.
-    const index = getProcessTableIndex(parseProcessTableRows('100 1 Ss bash'))
-
-    expect(Object.keys(index).sort()).toEqual(['byPid', 'childrenByPpid', 'rows', 'stats'])
-  })
-
   it('keeps the memo out of measured builds so a cache hit cannot satisfy a perf gate', () => {
     const rows = parseProcessTableRows('100 1 Ss bash')
     const stats: ProcessTableIndexStats = {
diff --git a/src/shared/profile-state-recovery-command.test.ts b/src/shared/profile-state-recovery-command.test.ts
new file mode 100644
index 00000000000..8036ecac085
--- /dev/null
+++ b/src/shared/profile-state-recovery-command.test.ts
@@ -0,0 +1,28 @@
+import { describe, expect, it } from 'vitest'
+import { profileStateRecoveryRequestSchema } from './profile-state-recovery-command'
+
+describe('offline recovery source selection', () => {
+  it.each([
+    { kind: 'current-json' },
+    { kind: 'json', revision: 1 },
+    { kind: 'sqlite', backupId: 'selected-backup' }
+  ])('accepts an explicit source: %j', (selector) => {
+    expect(
+      profileStateRecoveryRequestSchema.parse({ userDataPath: '/profile', selector }).selector
+    ).toEqual(selector)
+  })
+
+  it.each([
+    { kind: 'current-json', revision: 1 },
+    { kind: 'current-json', backupId: 'selected-backup' },
+    { kind: 'current-json', path: '../different-profile/orca-data.json' },
+    { kind: 'json', revision: null },
+    { kind: 'json', revision: 0 },
+    { kind: 'sqlite' },
+    { kind: 'json' }
+  ])('rejects ambiguous or incomplete sources: %j', (selector) => {
+    expect(
+      profileStateRecoveryRequestSchema.safeParse({ userDataPath: '/profile', selector }).success
+    ).toBe(false)
+  })
+})
diff --git a/src/shared/profile-state-recovery-command.ts b/src/shared/profile-state-recovery-command.ts
new file mode 100644
index 00000000000..a18ec454414
--- /dev/null
+++ b/src/shared/profile-state-recovery-command.ts
@@ -0,0 +1,75 @@
+import { z } from 'zod'
+
+export const PROFILE_STATE_RECOVERY_FLAG = '--profile-state-recovery'
+export const PROFILE_STATE_RECOVERY_RESULT_PREFIX = '[profile-state-recovery] '
+/** Desktop variant: applies a startup-dialog choice, then relaunches Orca normally. */
+export const PROFILE_STATE_DESKTOP_RECOVERY_FLAG = '--profile-state-desktop-recovery'
+
+const positiveInteger = z.number().int().positive().max(Number.MAX_SAFE_INTEGER)
+const selectorSchema = z.discriminatedUnion('kind', [
+  z.object({ kind: z.literal('json'), revision: positiveInteger }).strict(),
+  z.object({ kind: z.literal('current-json') }).strict(),
+  z.object({ kind: z.literal('current-sqlite') }).strict(),
+  z.object({ kind: z.literal('sqlite'), backupId: z.string().min(1) }).strict()
+])
+
+export const profileStateRecoveryRequestSchema = z
+  .object({
+    userDataPath: z.string().min(1),
+    selector: selectorSchema
+  })
+  .strict()
+
+const exportsSchema = z.object({
+  profileId: z.string(),
+  dataFile: z.string(),
+  databaseFile: z.string(),
+  exportPaths: z.array(z.string()).readonly(),
+  backups: z
+    .array(z.object({ id: z.string(), path: z.string(), createdAtMs: positiveInteger }))
+    .readonly()
+})
+const rollbackSchema = exportsSchema.extend({
+  // Canonical JSON edited outside SQLite has no database revision.
+  revision: positiveInteger.nullable(),
+  quarantineDirectory: z.string(),
+  removedDatabaseFiles: z.array(z.string()).readonly(),
+  storage: z.enum(['json', 'sqlite']),
+  restoredPath: z.string(),
+  backupId: z.string().optional()
+})
+
+export const profileStateRecoveryResponseSchema = z.discriminatedUnion('ok', [
+  z.object({ ok: z.literal(true), result: rollbackSchema }),
+  z.object({
+    ok: z.literal(false),
+    code: z.enum(['invalid_argument', 'runtime_error']),
+    message: z.string()
+  })
+])
+
+export type ProfileStateRecoverySelector = z.infer<typeof selectorSchema>
+export type ProfileStateRecoveryRequest = z.infer<typeof profileStateRecoveryRequestSchema>
+export type ProfileStateRecoveryResponse = z.infer<typeof profileStateRecoveryResponseSchema>
+export type ProfileStateExportsResult = z.infer<typeof exportsSchema>
+export type ProfileStateRollbackResult = z.infer<typeof rollbackSchema>
+
+export class ProfileStateRecoveryCommandError extends Error {
+  constructor(
+    readonly code: 'invalid_argument' | 'runtime_error',
+    message: string
+  ) {
+    super(message)
+    this.name = 'ProfileStateRecoveryCommandError'
+  }
+}
+
+export function isProfileStateRecoveryCommandError(
+  error: unknown
+): error is Error & { code: 'invalid_argument' | 'runtime_error' } {
+  return (
+    error instanceof Error &&
+    'code' in error &&
+    (error.code === 'invalid_argument' || error.code === 'runtime_error')
+  )
+}
diff --git a/src/shared/profile-state-storage-paths.ts b/src/shared/profile-state-storage-paths.ts
new file mode 100644
index 00000000000..0dea3dbb0a5
--- /dev/null
+++ b/src/shared/profile-state-storage-paths.ts
@@ -0,0 +1,16 @@
+import { join } from 'node:path'
+
+export const PROFILE_STATE_DATABASE_FILE_NAME = 'profile-state.db'
+
+/** Pure profile-state path helpers shared by the offline CLI and main process. */
+export function profileStateDatabaseFile(profileDirectory: string): string {
+  return join(profileDirectory, PROFILE_STATE_DATABASE_FILE_NAME)
+}
+
+export function getOrcaProfileDataFile(profileId: string, userDataPath: string): string {
+  return join(userDataPath, 'profiles', profileId, 'orca-data.json')
+}
+
+export function getOrcaProfileStateDatabaseFile(profileId: string, userDataPath: string): string {
+  return profileStateDatabaseFile(join(userDataPath, 'profiles', profileId))
+}
diff --git a/src/shared/profile-state-telemetry-schema.test.ts b/src/shared/profile-state-telemetry-schema.test.ts
new file mode 100644
index 00000000000..63c9dd88ab0
--- /dev/null
+++ b/src/shared/profile-state-telemetry-schema.test.ts
@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest'
+import { eventSchemas } from './telemetry-events'
+
+describe('profile state authority telemetry', () => {
+  it('accepts the bounded startup selection payload', () => {
+    expect(
+      eventSchemas.profile_state_authority_selected.safeParse({
+        backend: 'sqlite',
+        classification: 'json-only',
+        authority_mode: 'sqlite-candidate',
+        runtime: 'desktop',
+        migrated: true
+      }).success
+    ).toBe(true)
+  })
+
+  it('rejects paths or other unbounded diagnostic fields', () => {
+    expect(
+      eventSchemas.profile_state_authority_selected.safeParse({
+        backend: 'sqlite',
+        classification: 'sqlite-only',
+        authority_mode: 'sqlite-established',
+        runtime: 'desktop',
+        migrated: false,
+        database_path: '/private/profile.sqlite'
+      }).success
+    ).toBe(false)
+  })
+})
diff --git a/src/shared/project-groups.ts b/src/shared/project-groups.ts
index 5b37aadce8c..4cfa87080e2 100644
--- a/src/shared/project-groups.ts
+++ b/src/shared/project-groups.ts
@@ -1,17 +1,10 @@
 import { normalizeExecutionHostId } from './execution-host'
 import type { ProjectGroup, ProjectGroupCreatedFrom } from './project-group-types'
 import type { Repo } from './repo-types'
+import { createNonSecureContextUuid } from './non-secure-context-uuid'
 
 export const UNGROUPED_PROJECT_GROUP_KEY = 'project-group:ungrouped'
 
-function createProjectGroupId(): string {
-  const randomUUID = globalThis.crypto?.randomUUID
-  if (randomUUID) {
-    return randomUUID.call(globalThis.crypto)
-  }
-  return `project-group-${Date.now()}-${Math.random().toString(36).slice(2)}`
-}
-
 export function normalizeProjectGroupName(name: string, fallback = 'Untitled group'): string {
   const trimmed = name.trim()
   return trimmed.length > 0 ? trimmed : fallback
@@ -28,7 +21,7 @@ export function createProjectGroup(input: {
 }): ProjectGroup {
   const now = input.now ?? Date.now()
   return {
-    id: createProjectGroupId(),
+    id: createNonSecureContextUuid(),
     name: normalizeProjectGroupName(input.name),
     parentPath: input.parentPath ?? null,
     connectionId: input.connectionId ?? null,
diff --git a/src/shared/protocol-version.ts b/src/shared/protocol-version.ts
index dac7fa084bd..d3880313897 100644
--- a/src/shared/protocol-version.ts
+++ b/src/shared/protocol-version.ts
@@ -165,6 +165,28 @@ export const STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY = 'agent-session.struct
 // clients skip the host's bounded best-effort settlement observation.
 export const AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY =
   'agent-session.pending-send-result.v1' as const
+// Why: a send is now answered once the host accepts it, before any agent has it. A client without
+// this cannot show a message rejected after that answer, so the host holds its reply until the
+// message is handed over or rejected. Transitional: drop the hold once no supported desktop or
+// mobile client lacks the capability; mobile must first show a rejected message in place.
+export const AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY =
+  'agent-session.accepted-send.v1' as const
+// Why: `agentSession.cancel` params are strict and older hosts require `turnId`. A host advertising
+// this takes a cancel naming no turn as "stop what the conversation has in flight", which is the
+// only Stop a client can send before the provider has opened a turn.
+export const AGENT_SESSION_CONVERSATION_STOP_RUNTIME_CAPABILITY =
+  'agent-session.conversation-stop.v1' as const
+// Why: `agentSession.send`'s params are strict, so an older host rejects `delivery`; and only a
+// capable client can render the `queued` result arm, the draft list, and returned cards. DARK ON
+// PURPOSE — not in RUNTIME_CAPABILITIES: advertising still requires the integrated Codex steer
+// matrix (#21062) in the shipped host, and the desktop and phone clients that render the queue.
+// v1 includes `submission.queuedMessageId` on every draft hand-off: a client reads that link and
+// never compares a draft id with a submission id. It also publishes the queue's pause once, as
+// `queuePause` beside the list, lifted by `agentSession.queuedMessagesResume` or the user's next
+// turn; cards carry a hold of their own only when their conversion failed. The host mechanism lands first; the constant
+// gates the rollout.
+export const AGENT_SESSION_QUEUED_MESSAGES_RUNTIME_CAPABILITY =
+  'agent-session.queued-messages.v1' as const
 // Why: paired clients advertise Claude-structured support so the host can gate its agent-specific
 // journal and lifecycle surfaces independently from Codex support.
 export const CLAUDE_STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY =
@@ -211,6 +233,10 @@ export const AGENT_SESSION_BACKGROUND_TASK_STOP_CAPABILITY =
 // older host that would reject the whole cancellation instead of falling back to turn stop.
 export const AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY =
   'agent-session.prompt-cancel.v1' as const
+// Why: agentSession.respondToQuestion has a strict schema, so clients must not send structured
+// `answers` to an older host; they fall back to the answer packed into `optionId`.
+export const AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY =
+  'agent-session.question-answers.v1' as const
 // Why: the host now publishes rows for work that is live inside a turn, and such
 // a row carries `stoppable: false` because no targeted stop can reach it. A
 // reader that predates the field draws a per-row Stop on every row it is given,
@@ -225,6 +251,11 @@ export const AGENT_SESSION_KIMI_RESUME_RUNTIME_CAPABILITY = 'agent-session.kimi-
 export const AGENT_SESSION_OPENCODE2_RESUME_RUNTIME_CAPABILITY =
   'agent-session.opencode2-resume.v1' as const
 export const AGENT_SESSION_MUSE_RESUME_RUNTIME_CAPABILITY = 'agent-session.muse-resume.v1' as const
+export const AGENT_SESSION_DSH_RESUME_RUNTIME_CAPABILITY = 'agent-session.dsh-resume.v1' as const
+export const AGENT_SESSION_CODEBUDDY_RESUME_RUNTIME_CAPABILITY =
+  'agent-session.codebuddy-resume.v1' as const
+export const AGENT_SESSION_QODER_RESUME_RUNTIME_CAPABILITY =
+  'agent-session.qoder-resume.v1' as const
 export const AGENT_SESSION_ZCODE_RESUME_RUNTIME_CAPABILITY =
   'agent-session.zcode-resume.v1' as const
 // Why: older runtimes strip mutation owner fields, so clients must fence writes before RPC.
@@ -298,6 +329,7 @@ export const NATIVE_REMOTE_RUNTIME_CLIENT_CAPABILITIES = [
 export const ELECTRON_REMOTE_RUNTIME_CLIENT_CAPABILITIES = [
   ...NATIVE_REMOTE_RUNTIME_CLIENT_CAPABILITIES,
   AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY,
+  AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
   BROWSER_CLIENT_HOST_RUNTIME_CAPABILITY,
   BROWSER_CLIENT_PAGE_METADATA_RUNTIME_CAPABILITY,
   // Why: only the renderer runs the retirement-proof ledger; CLI and mobile must keep full lists.
@@ -368,6 +400,10 @@ export const RUNTIME_CAPABILITIES = [
   AGENT_SESSION_KEYBOARD_RUNTIME_CAPABILITY,
   STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
   AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY,
+  // The host side: it accepts a send before any agent has it, and a Stop with no writer before a
+  // turn starts, so a client may gate on either.
+  AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
+  AGENT_SESSION_CONVERSATION_STOP_RUNTIME_CAPABILITY,
   STRUCTURED_AGENT_SESSION_HOLD_RUNTIME_CAPABILITY,
   STRUCTURED_AGENT_SESSION_REVEAL_RUNTIME_CAPABILITY,
   STRUCTURED_AGENT_SESSION_RESUME_HISTORY_RUNTIME_CAPABILITY,
@@ -377,11 +413,15 @@ export const RUNTIME_CAPABILITIES = [
   AGENT_SESSION_CONVERSATION_OUTLINE_RUNTIME_CAPABILITY,
   AGENT_SESSION_BACKGROUND_TASK_STOP_CAPABILITY,
   AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY,
+  AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY,
   AGENT_SESSION_TURN_ITEM_CAPABILITY,
   AGENT_SESSION_BACKGROUND_TASK_ROW_STOP_CAPABILITY,
   AGENT_SESSION_KIMI_RESUME_RUNTIME_CAPABILITY,
   AGENT_SESSION_OPENCODE2_RESUME_RUNTIME_CAPABILITY,
   AGENT_SESSION_MUSE_RESUME_RUNTIME_CAPABILITY,
+  AGENT_SESSION_DSH_RESUME_RUNTIME_CAPABILITY,
+  AGENT_SESSION_QODER_RESUME_RUNTIME_CAPABILITY,
+  AGENT_SESSION_CODEBUDDY_RESUME_RUNTIME_CAPABILITY,
   AGENT_SESSION_ZCODE_RESUME_RUNTIME_CAPABILITY,
   FILE_MUTATION_OWNERSHIP_RUNTIME_CAPABILITY,
   GITHUB_MARK_PR_READY_RUNTIME_CAPABILITY,
diff --git a/src/shared/pty-liveness-verdict.ts b/src/shared/pty-liveness-verdict.ts
index 0dd650161f3..ae163257242 100644
--- a/src/shared/pty-liveness-verdict.ts
+++ b/src/shared/pty-liveness-verdict.ts
@@ -27,6 +27,17 @@ export function describeUnconfirmedStop(reason: string): string {
   return `The PTY was not confirmed stopped: ${endSentence(reason)}`
 }
 
+/** A close's unconfirmed-stop sentence; it promises a retry only when the host recorded one. */
+export function describeUnconfirmedCloseStop(close: {
+  ptyStopReason?: string
+  pendingKillRecorded?: true
+}): string {
+  const sentence = describeUnconfirmedStop(close.ptyStopReason ?? 'its host could not be reached')
+  return close.pendingKillRecorded === true
+    ? `${sentence} The kill retries when the host reconnects.`
+    : sentence
+}
+
 /** Words a close whose PTY teardown was never confirmed, for a stop receipt. */
 export function describeUnconfirmedAgentStop(close: {
   ptyStopVerdict?: 'live' | 'unverifiable'
diff --git a/src/shared/qoder-agent.test.ts b/src/shared/qoder-agent.test.ts
new file mode 100644
index 00000000000..8db665e7209
--- /dev/null
+++ b/src/shared/qoder-agent.test.ts
@@ -0,0 +1,160 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import {
+  recognizeAgentProcessFromCommandLine,
+  isExpectedAgentProcess
+} from './agent-process-recognition'
+import {
+  getAgentLabel,
+  isGeminiTerminalTitle,
+  normalizeTerminalTitle,
+  detectAgentStatusFromTitle
+} from './agent-detection'
+import { buildAgentStartupPlan } from './tui-agent-startup'
+import { getAgentResumeArgv } from './agent-session-resume'
+import { createHookListenerState } from './agent-hook-listener/listener-state'
+import { normalizeAndAccept } from './agent-hook-listener-test-harness'
+
+describe('Qoder agent identity and lifecycle', () => {
+  it('recognizes the installed versioned binary on native platforms and excludes headless runs', () => {
+    for (const command of [
+      'qodercli',
+      '/home/dev/.qoder/bin/qodercli/qodercli-1.1.64',
+      'C:\\Qoder\\qodercli-1.1.64.exe'
+    ]) {
+      expect(recognizeAgentProcessFromCommandLine(command)?.agent).toBe('qoder')
+      expect(isExpectedAgentProcess(command, 'qodercli')).toBe(true)
+    }
+    expect(recognizeAgentProcessFromCommandLine('qodercli --print hello')).toBeNull()
+    for (const args of [
+      '-o json',
+      '--input-format=stream-json',
+      '--remote-control session',
+      '--acp',
+      '--delete-session 1'
+    ]) {
+      expect(recognizeAgentProcessFromCommandLine(`qodercli ${args}`)).toBeNull()
+    }
+    expect(recognizeAgentProcessFromCommandLine('qodercli --prompt-interactive hello')?.agent).toBe(
+      'qoder'
+    )
+    expect(recognizeAgentProcessFromCommandLine('qodercli-unrelated')).toBeNull()
+  })
+
+  it.each([
+    ['◇ Qoder CLI | Ready', 'idle'],
+    ['✦ Implement feature | Thinking', 'working'],
+    ['▲ Implement feature | Confirm', 'permission']
+  ] as const)('keeps %s attributed through title storage', (title, status) => {
+    const stored = normalizeTerminalTitle(title.padEnd(80))
+    expect(getAgentLabel(stored)).toBe('Qoder CLI')
+    expect(isGeminiTerminalTitle(title)).toBe(false)
+    expect(detectAgentStatusFromTitle(stored)).toBe(status)
+    expect(normalizeTerminalTitle(stored)).toBe(stored)
+  })
+
+  it('keeps upstream Gemini titles and arbitrary triangle text unchanged', () => {
+    expect(isGeminiTerminalTitle('✦  Working (project)')).toBe(true)
+    expect(getAgentLabel('deploy ▲ complete')).not.toBe('Qoder CLI')
+  })
+
+  it('tracks start, work, permission, completion and resume without becoming Claude', () => {
+    const state = createHookListenerState()
+    const session = { session_id: 'qoder-session', transcript_path: '/tmp/qoder-session.jsonl' }
+    const send = (hook_event_name: string, extra = {}) =>
+      normalizeAndAccept(state, 'qoder', { ...session, hook_event_name, ...extra })
+    const started = send('SessionStart', { source: 'startup' })
+    expect(started?.payload).toMatchObject({
+      agentType: 'qoder',
+      state: 'done',
+      sessionBoundary: true
+    })
+    expect(started?.providerSession).toMatchObject({ id: 'qoder-session' })
+    expect(send('UserPromptSubmit', { prompt: 'Fix the bug' })?.payload).toMatchObject({
+      state: 'working',
+      agentType: 'qoder',
+      prompt: 'Fix the bug'
+    })
+    expect(
+      send('PermissionRequest', { tool_name: 'Bash', tool_input: { command: 'pwd' } })?.payload
+    ).toMatchObject({ state: 'waiting', toolName: 'Bash' })
+    expect(send('PostToolUse', { tool_name: 'Bash' })?.payload.state).toBe('working')
+    expect(send('SessionStart', { source: 'compact' })).toBeNull()
+    expect(send('Stop', { last_assistant_message: 'Fixed.' })?.payload).toMatchObject({
+      state: 'done',
+      lastAssistantMessage: 'Fixed.'
+    })
+    expect(send('StopFailure', { error: 'Unavailable' })?.payload.mainAgent).toMatchObject({
+      outcome: 'failure'
+    })
+    expect(getAgentResumeArgv('qoder', { key: 'session_id', id: 'qoder-session' })).toEqual([
+      'qodercli',
+      '--resume',
+      'qoder-session'
+    ])
+  })
+})
+
+it('replays captured unauthenticated startup, prompt, idle and resume hooks', () => {
+  const state = createHookListenerState()
+  const lines = readFileSync(
+    join(__dirname, '__fixtures__', 'qoder-no-account-hooks.jsonl'),
+    'utf8'
+  )
+    .trim()
+    .split('\n')
+  const events = lines.map((line) => normalizeAndAccept(state, 'qoder', JSON.parse(line)))
+  expect(events.map((event) => event?.payload.state)).toEqual([
+    'done',
+    'working',
+    'done',
+    'done',
+    'done',
+    'done'
+  ])
+  expect(events.every((event) => event?.payload.agentType === 'qoder')).toBe(true)
+  expect(events[4]?.payload.sessionBoundary).toBe(true)
+  expect(events[4]?.providerSession?.id).toBe(events[0]?.providerSession?.id)
+})
+
+it.each(['darwin', 'linux', 'win32'] as const)(
+  'launches a Qoder prompt safely on %s',
+  (platform) => {
+    const plan = buildAgentStartupPlan({
+      agent: 'qoder',
+      prompt: "fix Bob's branch; echo $HOME",
+      cmdOverrides: {},
+      platform
+    })
+    expect(plan?.expectedProcess).toBe('qodercli')
+    expect(plan?.followupPrompt).toBeNull()
+    expect(plan?.launchCommand).toBe(
+      platform === 'win32'
+        ? "qodercli --prompt-interactive 'fix Bob''s branch; echo $HOME'"
+        : `qodercli --prompt-interactive 'fix Bob'"'"'s branch; echo $HOME'`
+    )
+  }
+)
+
+it('does not rewrite DSH titles containing a pipe as Qoder', () => {
+  const title = '✦ 🐋 refactor parser | run tests'
+  expect(normalizeTerminalTitle(title)).toBe(title)
+  expect(getAgentLabel(title)).not.toBe('Qoder CLI')
+  expect(detectAgentStatusFromTitle(title)).not.toBe('working')
+})
+
+it('settles manual compaction without interrupting automatic compaction', () => {
+  const state = createHookListenerState()
+  const send = (hook_event_name: string, extra = {}) =>
+    normalizeAndAccept(state, 'qoder', { hook_event_name, ...extra })
+  expect(send('UserPromptSubmit', { prompt: 'Refactor' })?.payload.state).toBe('working')
+  expect(send('PreCompact', { trigger: 'manual' })).toBeNull()
+  expect(send('PostCompact', { trigger: 'auto' })).toBeNull()
+  expect(send('SessionStart', { source: 'compact' })).toBeNull()
+  expect(send('PostCompact', { trigger: 'manual' })?.payload).toMatchObject({
+    state: 'done',
+    sessionBoundary: true,
+    agentType: 'qoder'
+  })
+})
diff --git a/src/shared/qoder-headless-command.ts b/src/shared/qoder-headless-command.ts
new file mode 100644
index 00000000000..6ffb16ca9b3
--- /dev/null
+++ b/src/shared/qoder-headless-command.ts
@@ -0,0 +1,31 @@
+import { isPrintModeHeadlessOneShotCommand, optionName } from './print-mode-headless-command'
+
+export function isQoderHeadlessCommand(tokens: readonly string[]): boolean {
+  if (isPrintModeHeadlessOneShotCommand(tokens)) {
+    return true
+  }
+  for (let index = 1; index < tokens.length; index += 1) {
+    const token = tokens[index]
+    if (token === '--') {
+      return false
+    }
+    const name = optionName(token)
+    const value = token.includes('=') ? token.slice(token.indexOf('=') + 1) : tokens[index + 1]
+    if (name === '-o' && (value === 'json' || value === 'stream-json')) {
+      return true
+    }
+    if (name === '--input-format' && value === 'stream-json') {
+      return true
+    }
+    if (
+      name === '--remote-control' ||
+      name === '--remote' ||
+      name === '--list-sessions' ||
+      name === '--delete-session' ||
+      name === '--acp'
+    ) {
+      return true
+    }
+  }
+  return false
+}
diff --git a/src/shared/qoder-terminal-title.ts b/src/shared/qoder-terminal-title.ts
new file mode 100644
index 00000000000..e21b9dbb0e3
--- /dev/null
+++ b/src/shared/qoder-terminal-title.ts
@@ -0,0 +1,21 @@
+import { isDshTerminalTitle } from './dsh-terminal-title'
+
+// Qoder 1.1.64: one space after the glyph, then a session title and a pipe-delimited status.
+const QODER_DYNAMIC_TITLE_RE = /^[✦◇▲] (?! ).*\s\|\s[^|]+$/
+const QODER_LABEL_RE = /^(?:[✦◇▲] )?Qoder CLI(?: CN)?(?: \(.*\))?$/
+
+export function isQoderTerminalTitle(title: string): boolean {
+  if (isDshTerminalTitle(title)) {
+    return false
+  }
+  const trimmed = title.trim()
+  return QODER_DYNAMIC_TITLE_RE.test(trimmed) || QODER_LABEL_RE.test(trimmed)
+}
+
+export function qoderTitleStatus(title: string): 'working' | 'permission' | 'idle' | null {
+  if (!isQoderTerminalTitle(title)) {
+    return null
+  }
+  const glyph = title.trimStart()[0]
+  return glyph === '✦' ? 'working' : glyph === '▲' ? 'permission' : 'idle'
+}
diff --git a/src/shared/quick-open-listing-limits.test.ts b/src/shared/quick-open-listing-limits.test.ts
index bd24c80da6c..e5e3235e782 100644
--- a/src/shared/quick-open-listing-limits.test.ts
+++ b/src/shared/quick-open-listing-limits.test.ts
@@ -1,12 +1,7 @@
 import { describe, expect, it, vi } from 'vitest'
 import {
-  createQuickOpenListingBudget,
   QuickOpenSubprocessPathAccumulator,
   resolveQuickOpenResultLimit,
-  retainQuickOpenPath,
-  QUICK_OPEN_LISTING_MAX_PATH_BYTES,
-  QUICK_OPEN_LISTING_MAX_RETAINED_PATH_BYTES,
-  QUICK_OPEN_LISTING_MAX_RETAINED_PATHS,
   QUICK_OPEN_LISTING_MAX_RESULTS
 } from './quick-open-listing-limits'
 
@@ -20,42 +15,6 @@ describe('Quick Open listing limits', () => {
     expect(resolveQuickOpenResultLimit(0)).toBe(0)
   })
 
-  it('keeps the production memory ceilings explicit', () => {
-    expect(QUICK_OPEN_LISTING_MAX_RESULTS).toBe(20_001)
-    expect(QUICK_OPEN_LISTING_MAX_RETAINED_PATHS).toBe(100_000)
-    expect(QUICK_OPEN_LISTING_MAX_RETAINED_PATH_BYTES).toBe(32 * 1024 * 1024)
-    expect(QUICK_OPEN_LISTING_MAX_PATH_BYTES).toBe(64 * 1024)
-  })
-
-  it('accepts the exact retained path boundaries without charging duplicates', () => {
-    const paths = new Set<string>()
-    const budget = createQuickOpenListingBudget({
-      maxRetainedPaths: 2,
-      maxRetainedPathBytes: 3,
-      maxPathBytes: 2
-    })
-
-    expect(retainQuickOpenPath(paths, 'ab', budget)).toBe(true)
-    expect(retainQuickOpenPath(paths, 'ab', budget)).toBe(false)
-    expect(retainQuickOpenPath(paths, 'c', budget)).toBe(true)
-    expect(budget).toMatchObject({ retainedPathCount: 2, retainedPathBytes: 3 })
-    expect(() => retainQuickOpenPath(paths, '', budget)).toThrow('2 retained paths')
-  })
-
-  it('rejects path-byte overflow without mutating the retained budget', () => {
-    const paths = new Set<string>()
-    const budget = createQuickOpenListingBudget({
-      maxRetainedPaths: 3,
-      maxRetainedPathBytes: 2,
-      maxPathBytes: 2
-    })
-    retainQuickOpenPath(paths, 'ab', budget)
-
-    expect(() => retainQuickOpenPath(paths, 'c', budget)).toThrow('2 retained path bytes')
-    expect(paths).toEqual(new Set(['ab']))
-    expect(budget).toMatchObject({ retainedPathCount: 1, retainedPathBytes: 2 })
-  })
-
   it('bounds one fragmented subprocess path and recovers after overflow', () => {
     const onPath = vi.fn(() => true)
     const fields = new QuickOpenSubprocessPathAccumulator(0, 3)
diff --git a/src/shared/quick-open-listing-limits.ts b/src/shared/quick-open-listing-limits.ts
index 0e28f8b1d3a..09c4f113c92 100644
--- a/src/shared/quick-open-listing-limits.ts
+++ b/src/shared/quick-open-listing-limits.ts
@@ -1,17 +1,7 @@
 import { GrowingByteBuffer } from './growing-byte-buffer'
 
 export const QUICK_OPEN_LISTING_MAX_RESULTS = 20_001
-export const QUICK_OPEN_LISTING_MAX_RETAINED_PATHS = 100_000
-export const QUICK_OPEN_LISTING_MAX_RETAINED_PATH_BYTES = 32 * 1024 * 1024
-export const QUICK_OPEN_LISTING_MAX_PATH_BYTES = 64 * 1024
-
-export type QuickOpenListingBudget = {
-  retainedPathCount: number
-  retainedPathBytes: number
-  maxRetainedPaths: number
-  maxRetainedPathBytes: number
-  maxPathBytes: number
-}
+const QUICK_OPEN_LISTING_MAX_PATH_BYTES = 64 * 1024
 
 export function resolveQuickOpenResultLimit(requested?: number): number {
   if (requested === undefined || requested === Number.POSITIVE_INFINITY) {
@@ -23,59 +13,6 @@ export function resolveQuickOpenResultLimit(requested?: number): number {
   return Math.min(Math.max(Math.trunc(requested), 0), QUICK_OPEN_LISTING_MAX_RESULTS)
 }
 
-export function createQuickOpenListingBudget(
-  limits: Partial<
-    Pick<QuickOpenListingBudget, 'maxRetainedPaths' | 'maxRetainedPathBytes' | 'maxPathBytes'>
-  > = {}
-): QuickOpenListingBudget {
-  const maxRetainedPaths = limits.maxRetainedPaths ?? QUICK_OPEN_LISTING_MAX_RETAINED_PATHS
-  const maxRetainedPathBytes =
-    limits.maxRetainedPathBytes ?? QUICK_OPEN_LISTING_MAX_RETAINED_PATH_BYTES
-  const maxPathBytes = limits.maxPathBytes ?? QUICK_OPEN_LISTING_MAX_PATH_BYTES
-  for (const [name, value] of Object.entries({
-    maxRetainedPaths,
-    maxRetainedPathBytes,
-    maxPathBytes
-  })) {
-    if (!Number.isSafeInteger(value) || value < 0) {
-      throw new RangeError(`${name} must be a non-negative safe integer`)
-    }
-  }
-  return {
-    retainedPathCount: 0,
-    retainedPathBytes: 0,
-    maxRetainedPaths,
-    maxRetainedPathBytes,
-    maxPathBytes
-  }
-}
-
-export function retainQuickOpenPath(
-  paths: Set<string>,
-  path: string,
-  budget: QuickOpenListingBudget
-): boolean {
-  if (paths.has(path)) {
-    return false
-  }
-  const pathBytes = Buffer.byteLength(path, 'utf8')
-  if (pathBytes > budget.maxPathBytes) {
-    throw new Error(`Quick Open file path exceeded ${budget.maxPathBytes} bytes`)
-  }
-  if (budget.retainedPathCount >= budget.maxRetainedPaths) {
-    throw new Error(`Quick Open file listing exceeded ${budget.maxRetainedPaths} retained paths`)
-  }
-  if (pathBytes > budget.maxRetainedPathBytes - budget.retainedPathBytes) {
-    throw new Error(
-      `Quick Open file listing exceeded ${budget.maxRetainedPathBytes} retained path bytes`
-    )
-  }
-  budget.retainedPathCount++
-  budget.retainedPathBytes += pathBytes
-  paths.add(path)
-  return true
-}
-
 export type QuickOpenPathAccumulatorResult = 'continue' | 'stopped' | 'path-too-large'
 
 export class QuickOpenSubprocessPathAccumulator {
diff --git a/src/shared/rate-limit-state-factory.ts b/src/shared/rate-limit-state-factory.ts
index 96ae50f9b28..494f56e4dff 100644
--- a/src/shared/rate-limit-state-factory.ts
+++ b/src/shared/rate-limit-state-factory.ts
@@ -11,10 +11,13 @@ export function createEmptyRateLimitState(overrides: Partial<RateLimitState> = {
     antigravity: null,
     minimax: null,
     grok: null,
+    cursor: null,
+    zcode: null,
     minimaxCookieConfigured: false,
     minimaxApiKeyConfigured: false,
     opencodeGoApiKeyConfigured: false,
     grokAuthConfigured: false,
+    cursorAuthConfigured: false,
     claudeTarget: { runtime: 'host', wslDistro: null },
     codexTarget: { runtime: 'host', wslDistro: null },
     inactiveClaudeAccounts: [],
diff --git a/src/shared/rate-limit-types.test.ts b/src/shared/rate-limit-types.test.ts
index d3276b1afe4..556af578565 100644
--- a/src/shared/rate-limit-types.test.ts
+++ b/src/shared/rate-limit-types.test.ts
@@ -16,10 +16,13 @@ describe('RateLimitState', () => {
       antigravity: null,
       minimax: null,
       grok: null,
+      cursor: null,
+      zcode: null,
       minimaxCookieConfigured: false,
       minimaxApiKeyConfigured: false,
       opencodeGoApiKeyConfigured: false,
       grokAuthConfigured: false,
+      cursorAuthConfigured: false,
       claudeTarget: { runtime: 'host', wslDistro: null },
       codexTarget: { runtime: 'host', wslDistro: null },
       inactiveClaudeAccounts: [],
@@ -30,5 +33,7 @@ describe('RateLimitState', () => {
     expect(state.minimax).toBeNull()
     expect(state.minimaxCookieConfigured).toBe(false)
     expect(state.minimaxApiKeyConfigured).toBe(false)
+    expect(state.cursor).toBeNull()
+    expect(state.cursorAuthConfigured).toBe(false)
   })
 })
diff --git a/src/shared/rate-limit-types.ts b/src/shared/rate-limit-types.ts
index dd89c9e8ec6..6b06f09d10e 100644
--- a/src/shared/rate-limit-types.ts
+++ b/src/shared/rate-limit-types.ts
@@ -57,15 +57,17 @@ export type ProviderRateLimits = {
     | 'minimax'
     | 'grok'
     | 'antigravity'
+    | 'cursor'
+    | 'zcode'
   /** 5-hour session window, null if not available. */
   session: RateLimitWindow | null
   /** 7-day weekly window, null if not available. */
   weekly: RateLimitWindow | null
   /** Claude Fable 7-day weekly window, null if not available. */
   fableWeekly?: RateLimitWindow | null
-  /** 30-day monthly window (OpenCode Go, Grok unified billing), null if not available. */
+  /** 30-day monthly window (OpenCode Go, Grok unified billing, Cursor plan pools), null if not available. */
   monthly?: RateLimitWindow | null
-  /** Named per-model buckets (Gemini only). */
+  /** Named per-model buckets (Gemini models, Cursor plan pools). */
   buckets?: RateLimitBucket[]
   /** Available earned Codex rate-limit reset credits, if reported. */
   rateLimitResetCredits?: {
@@ -117,6 +119,17 @@ export type GrokAccountStatus = {
   error: string | null
 }
 
+export type CursorAccountStatus = {
+  signedIn: boolean
+  email: string | null
+  displayName: string | null
+  /** Which local store the session came from: the macOS Keychain, the CLI auth file, or Cursor IDE. */
+  credentialSource: 'keychain' | 'cli' | 'desktop' | null
+  planType: string | null
+  tokenFresh: boolean
+  error: string | null
+}
+
 export type RateLimitState = {
   claude: ProviderRateLimits | null
   codex: ProviderRateLimits | null
@@ -126,6 +139,8 @@ export type RateLimitState = {
   antigravity: ProviderRateLimits | null
   minimax: ProviderRateLimits | null
   grok: ProviderRateLimits | null
+  cursor: ProviderRateLimits | null
+  zcode: ProviderRateLimits | null
   /**
    * True when a MiniMax session cookie is persisted on disk. The cookie lives
    * outside GlobalSettings, so this flag is the durable signal that the
@@ -149,6 +164,12 @@ export type RateLimitState = {
   opencodeGoApiKeyConfigured: boolean
   /** True when main finds a Grok CLI session file (~/.grok/auth.json or GROK_HOME). */
   grokAuthConfigured: boolean
+  /**
+   * True when main finds a Cursor session on this machine: the macOS Keychain
+   * item cursor-agent writes, its legacy auth.json, or the Cursor IDE's own
+   * stored login. The token itself never leaves main.
+   */
+  cursorAuthConfigured: boolean
   claudeTarget: RateLimitRuntimeTarget
   codexTarget: RateLimitRuntimeTarget
   inactiveClaudeAccounts: InactiveAccountUsage[]
diff --git a/src/shared/relay-artifacts.ts b/src/shared/relay-artifacts.ts
index 73ce8c7af1b..4e4c834f220 100644
--- a/src/shared/relay-artifacts.ts
+++ b/src/shared/relay-artifacts.ts
@@ -47,11 +47,13 @@ export type RelayArtifact = {
 
 /** The bare Windows process-table addon; see docs/reference/windows-process-enumeration.md. */
 export const RELAY_WINDOWS_PROCESS_TREE_FILENAME = 'windows-process-tree.node'
+export const RELAY_OPENCODE_SQLITE_READER_FILENAME = 'opencode-sqlite-reader.cjs'
 
 export const RELAY_ARTIFACTS: readonly RelayArtifact[] = [
   { filename: 'relay.js' },
   { filename: 'relay-watcher.js', daemonServiceChild: true },
   { filename: 'relay-ai-vault-service.js', daemonServiceChild: true },
+  { filename: RELAY_OPENCODE_SQLITE_READER_FILENAME },
   { filename: 'managed-hook-runtime.js' },
   // Forked by the AI Vault title reader; without it a relay answers every WSL
   // title request with no title and no error.
diff --git a/src/shared/release-channel.test.ts b/src/shared/release-channel.test.ts
index fb530d66347..cca341ea2c5 100644
--- a/src/shared/release-channel.test.ts
+++ b/src/shared/release-channel.test.ts
@@ -1,9 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import {
   findInstallerAssetName,
-  formatAdhocVersion,
-  formatDailyVersion,
-  formatHourlyVersion,
   getReleaseNotesUrlForVersion,
   getReleaseRepoForChannel,
   getVersionChannel,
@@ -79,13 +76,13 @@ describe('release channel', () => {
   })
 
   it('round-trips an hourly version stamp as UTC', () => {
-    const version = formatHourlyVersion('1.4.160', '202607281405')
+    const version = '1.4.160-hourly.202607281405'
     expect(isHourlyVersion(version)).toBe(true)
     expect(parseHourlyVersionStamp(version)?.toISOString()).toBe('2026-07-28T14:05:00.000Z')
   })
 
   it('round-trips a daily version stamp as UTC', () => {
-    const version = formatDailyVersion('1.4.160', '202607281300')
+    const version = '1.4.160-daily.202607281300'
     expect(isDailyVersion(version)).toBe(true)
     expect(parseDailyVersionStamp(version)?.toISOString()).toBe('2026-07-28T13:00:00.000Z')
   })
@@ -118,7 +115,7 @@ describe('release channel', () => {
   // so two people cutting from different branches inside the same minute is
   // ordinary — at minute resolution the second would collide on the tag.
   it('round-trips an adhoc version stamp as UTC, to the second', () => {
-    const version = formatAdhocVersion('1.4.160', '20260728140533')
+    const version = '1.4.160-adhoc.20260728140533'
     expect(isAdhocVersion(version)).toBe(true)
     expect(parseAdhocVersionStamp(version)?.toISOString()).toBe('2026-07-28T14:05:33.000Z')
   })
diff --git a/src/shared/release-channel.ts b/src/shared/release-channel.ts
index 7a7f3aa96b0..96dcf8dc501 100644
--- a/src/shared/release-channel.ts
+++ b/src/shared/release-channel.ts
@@ -26,10 +26,6 @@ export const DAILY_RELEASE_REPO = 'stablyai/orca-daily'
 export const ADHOC_RELEASE_REPO = 'stablyai/orca-adhoc'
 export const MAIN_RELEASE_REPO = 'stablyai/orca'
 
-export const HOURLY_PRERELEASE_IDENTIFIER = 'hourly'
-export const DAILY_PRERELEASE_IDENTIFIER = 'daily'
-export const ADHOC_PRERELEASE_IDENTIFIER = 'adhoc'
-
 /** The dev channels, each published to its own repo rather than the main one. */
 const DEDICATED_REPO_CHANNELS = ['hourly', 'daily', 'adhoc'] as const
 
@@ -180,18 +176,6 @@ export function isAdhocVersion(version: string): boolean {
   return ADHOC_VERSION.test(normalizeTagToVersion(version))
 }
 
-export function formatHourlyVersion(baseVersion: string, stamp: string): string {
-  return `${baseVersion}-${HOURLY_PRERELEASE_IDENTIFIER}.${stamp}`
-}
-
-export function formatDailyVersion(baseVersion: string, stamp: string): string {
-  return `${baseVersion}-${DAILY_PRERELEASE_IDENTIFIER}.${stamp}`
-}
-
-export function formatAdhocVersion(baseVersion: string, stamp: string): string {
-  return `${baseVersion}-${ADHOC_PRERELEASE_IDENTIFIER}.${stamp}`
-}
-
 /** Returns the build's UTC timestamp, or null when the version isn't hourly. */
 export function parseHourlyVersionStamp(version: string): Date | null {
   return parseStampedVersion(version, HOURLY_VERSION)
diff --git a/src/shared/remote-runtime-subscription-frame-router.test.ts b/src/shared/remote-runtime-subscription-frame-router.test.ts
index 8563c9b0d2f..e75ca2e8b6d 100644
--- a/src/shared/remote-runtime-subscription-frame-router.test.ts
+++ b/src/shared/remote-runtime-subscription-frame-router.test.ts
@@ -1,6 +1,6 @@
 import { Buffer } from 'node:buffer'
 import { describe, expect, it, vi } from 'vitest'
-import { encrypt } from './e2ee-crypto'
+import { encrypt, encryptBytes } from './e2ee-crypto'
 import type { RemoteRuntimeClientError } from './remote-runtime-client-error'
 import { RemoteRuntimeSubscriptionFrameRouter } from './remote-runtime-subscription-frame-router'
 
@@ -58,3 +58,60 @@ describe('RemoteRuntimeSubscriptionFrameRouter authentication frames', () => {
     })
   })
 })
+
+function createReadyRouter(callbacks: {
+  onResponse: (response: unknown) => void
+  onBinary?: (bytes: Uint8Array) => void
+}) {
+  const fail = vi.fn<(error: RemoteRuntimeClientError) => void>()
+  const router = new RemoteRuntimeSubscriptionFrameRouter<unknown>({
+    sharedKey: SHARED_KEY,
+    serializedAuth: '{}',
+    serializedRequest: '{}',
+    requestId: 'request-1',
+    send: vi.fn(),
+    fail,
+    onAuthenticated: vi.fn(),
+    callbacks
+  })
+  router.state = 'ready'
+  return { fail, router }
+}
+
+describe('RemoteRuntimeSubscriptionFrameRouter consumer callbacks', () => {
+  it('fails the subscription instead of throwing out of the socket message handler', () => {
+    const { fail, router } = createReadyRouter({
+      onResponse: () => {
+        throw new Error('Unknown environment: env-1')
+      }
+    })
+    const response = JSON.stringify({
+      id: 'request-1',
+      ok: true,
+      result: {},
+      _meta: { runtimeId: 'r' }
+    })
+
+    expect(() => handleEncryptedAuthFrame(router, response)).not.toThrow()
+    expect(fail).toHaveBeenCalledOnce()
+    expect(fail.mock.calls[0][0]).toMatchObject({
+      code: 'runtime_error',
+      message: 'Unknown environment: env-1'
+    })
+  })
+
+  it('fails the subscription when a binary consumer throws', () => {
+    const { fail, router } = createReadyRouter({
+      onResponse: vi.fn(),
+      onBinary: () => {
+        throw new Error('consumer exploded')
+      }
+    })
+
+    expect(() =>
+      router.handleFrame(Buffer.from(encryptBytes(new Uint8Array([1, 2, 3]), SHARED_KEY)), true)
+    ).not.toThrow()
+    expect(fail).toHaveBeenCalledOnce()
+    expect(fail.mock.calls[0][0]).toMatchObject({ code: 'runtime_error' })
+  })
+})
diff --git a/src/shared/remote-runtime-subscription-frame-router.ts b/src/shared/remote-runtime-subscription-frame-router.ts
index fa8e6f3dce4..e6f2e2e3986 100644
--- a/src/shared/remote-runtime-subscription-frame-router.ts
+++ b/src/shared/remote-runtime-subscription-frame-router.ts
@@ -116,7 +116,7 @@ export class RemoteRuntimeSubscriptionFrameRouter<TResult> {
     }
     const response = parsed.data as RuntimeRpcResponse<TResult>
     if (response.id === this.options.requestId) {
-      this.options.callbacks.onResponse(response)
+      this.deliver(() => this.options.callbacks.onResponse(response))
       return
     }
     if (this.options.resolvePendingRequest?.(response as RuntimeRpcResponse<unknown>)) {
@@ -150,6 +150,24 @@ export class RemoteRuntimeSubscriptionFrameRouter<TResult> {
       )
       return
     }
-    this.options.callbacks.onBinary?.(plaintext)
+    this.deliver(() => this.options.callbacks.onBinary?.(plaintext))
+  }
+
+  // Why: `handleFrame` runs straight off the ws 'message' emitter, so a consumer throw becomes an
+  // uncaught exception that kills the process. The request router already routes one to
+  // `finishError`; mirror that here rather than leaving the subscription path unguarded.
+  private deliver(emit: () => void): void {
+    try {
+      emit()
+    } catch (error) {
+      this.options.fail(
+        error instanceof RemoteRuntimeClientError
+          ? error
+          : new RemoteRuntimeClientError(
+              'runtime_error',
+              error instanceof Error ? error.message : String(error)
+            )
+      )
+    }
   }
 }
diff --git a/src/shared/remote-runtime-subscription-request.test.ts b/src/shared/remote-runtime-subscription-request.test.ts
index 14f904308cc..800c0a78184 100644
--- a/src/shared/remote-runtime-subscription-request.test.ts
+++ b/src/shared/remote-runtime-subscription-request.test.ts
@@ -214,6 +214,26 @@ describe('remote runtime subscription JSON requests', () => {
       )
     }
   )
+
+  // Why: `ws.on('message')` calls the frame router directly, so before this was guarded a consumer
+  // throw here left the emitter and became main_uncaught_exception, killing the whole app.
+  it('fails the subscription instead of crashing the process when a consumer throws', async () => {
+    const server = await createServer()
+    const onError = vi.fn<(error: unknown) => void>()
+    const onClose = vi.fn<() => void>()
+    await subscribe(server.pairing, {
+      onResponse: () => {
+        throw new Error('Unknown environment: env-1')
+      },
+      onError,
+      onClose
+    })
+
+    await vi.waitFor(() => expect(onClose).toHaveBeenCalledOnce())
+    expect(onError).toHaveBeenCalledWith(
+      expect.objectContaining({ code: 'runtime_error', message: 'Unknown environment: env-1' })
+    )
+  })
 })
 
 function requireSender(subscription: RemoteRuntimeSubscription) {
diff --git a/src/shared/ripgrep-process-availability.ts b/src/shared/ripgrep-process-availability.ts
index 4c39916aed8..6fa761cc02e 100644
--- a/src/shared/ripgrep-process-availability.ts
+++ b/src/shared/ripgrep-process-availability.ts
@@ -1,6 +1,7 @@
 import { constants } from 'node:fs'
 import { access, stat } from 'node:fs/promises'
-import { spawn, type ChildProcess } from 'node:child_process'
+import { spawnProcess, type ChildProcessHandle } from './child-process/run-process'
+import { abortSignalReason, throwIfSignalAborted } from './abort-signal-reason'
 
 const RIPGREP_CWD_CHECK_TIMEOUT_MS = 1000
 const RIPGREP_FAILURE_PROBE_TIMEOUT_MS = 5000
@@ -36,7 +37,7 @@ export function isTransientRipgrepSpawnError(error: unknown): boolean {
 
 function ignoreRipgrepSpawnError(): void {}
 
-export function killSpawnedRipgrepProcess(child: ChildProcess): boolean {
+export function killSpawnedRipgrepProcess(child: ChildProcessHandle): boolean {
   // Why: killing a failed-spawn handle can signal the relay's own process group.
   if (Object.hasOwn(child, 'pid') && child.pid === undefined) {
     return false
@@ -45,7 +46,7 @@ export function killSpawnedRipgrepProcess(child: ChildProcess): boolean {
 }
 
 export function absorbPendingRipgrepSpawnError(
-  child: ChildProcess,
+  child: ChildProcessHandle,
   state: { errorObserved: boolean; unavailableExitObserved: boolean }
 ): void {
   if (
@@ -77,12 +78,19 @@ export async function isRipgrepSpawnCwdUsable(cwd: string): Promise<boolean> {
   }
 }
 
-function probeRipgrepVersion(command: string, env: NodeJS.ProcessEnv): Promise<boolean> {
-  return new Promise((resolve) => {
-    let child: ChildProcess
+function probeRipgrepVersion(
+  command: string,
+  env: NodeJS.ProcessEnv,
+  signal?: AbortSignal
+): Promise<boolean> {
+  if (signal?.aborted) {
+    return Promise.reject(abortSignalReason(signal))
+  }
+  return new Promise((resolve, reject) => {
+    let child: ChildProcessHandle
     try {
       // windowsHide: a probe must never flash a console window on Windows.
-      child = spawn(command, ['--version'], { env, stdio: 'ignore', windowsHide: true })
+      child = spawnProcess({ program: command, args: ['--version'], env, stdio: 'ignore' })
     } catch {
       resolve(false)
       return
@@ -91,26 +99,45 @@ function probeRipgrepVersion(command: string, env: NodeJS.ProcessEnv): Promise<b
     // Why kill on timeout: a `rg --version` that hangs -- a stalled network mount, or antivirus
     // holding a just-installed rg.exe -- would otherwise leave a live process and a ref'd handle
     // behind for the relay's lifetime, once per launch failure.
-    const settle = (available: boolean, kill = false): void => {
+    const settle = (available: boolean, kill = false, error?: Error): void => {
       if (settled) {
         return
       }
       settled = true
       clearTimeout(timeout)
+      signal?.removeEventListener('abort', onAbort)
       child.off('close', onClose)
-      if (kill) {
-        killSpawnedRipgrepProcess(child)
-      }
-      // Why leave one 'error' listener attached: a spawn error can still arrive after this
-      // settles, and an unhandled 'error' on a ChildProcess throws.
+      child.off('error', onError)
+      // A queued spawn error or synchronous kill failure can arrive after cleanup.
       child.once('error', ignoreRipgrepSpawnError)
-      resolve(available)
+      if (kill) {
+        try {
+          killSpawnedRipgrepProcess(child)
+        } catch {
+          // A refused kill must not strand the probe's settlement.
+        }
+      }
+      if (error) {
+        reject(error)
+      } else {
+        resolve(available)
+      }
     }
+    const onAbort = (): void => {
+      if (signal) {
+        settle(false, true, abortSignalReason(signal))
+      }
+    }
+    const onError = (): void => settle(false)
     const onClose = (code: number | null): void => settle(code === 0)
-    child.once('error', () => settle(false))
+    child.once('error', onError)
     child.once('close', onClose)
     const timeout = setTimeout(() => settle(false, true), RIPGREP_FAILURE_PROBE_TIMEOUT_MS)
     timeout.unref?.()
+    signal?.addEventListener('abort', onAbort, { once: true })
+    if (signal?.aborted) {
+      onAbort()
+    }
   })
 }
 
@@ -129,13 +156,18 @@ function probeRipgrepVersion(command: string, env: NodeJS.ProcessEnv): Promise<b
 export async function classifyRipgrepLaunchFailure(
   cwd: string,
   candidates: readonly (string | null)[],
-  env: NodeJS.ProcessEnv
+  env: NodeJS.ProcessEnv,
+  signal?: AbortSignal
 ): Promise<'cwd-unreachable' | 'ripgrep-unavailable'> {
-  if (await isRipgrepSpawnCwdUsable(cwd)) {
+  throwIfSignalAborted(signal)
+  const usable = await isRipgrepSpawnCwdUsable(cwd)
+  throwIfSignalAborted(signal)
+  if (usable) {
     return 'ripgrep-unavailable'
   }
   for (const command of new Set(candidates.filter((entry) => entry !== null))) {
-    if (await probeRipgrepVersion(command, env)) {
+    throwIfSignalAborted(signal)
+    if (await probeRipgrepVersion(command, env, signal)) {
       return 'cwd-unreachable'
     }
   }
@@ -179,7 +211,7 @@ export async function classifySynchronousRipgrepSpawnFailure(
 }
 
 export function isRipgrepUnavailableExit(
-  child: ChildProcess,
+  child: ChildProcessHandle,
   code: number | null,
   signal: NodeJS.Signals | null,
   options: { classifyNativeLauncherExit?: boolean } = {}
diff --git a/src/shared/rpc-contract/agent-launch-params.ts b/src/shared/rpc-contract/agent-launch-params.ts
index 3fd12f52eed..3926c610708 100644
--- a/src/shared/rpc-contract/agent-launch-params.ts
+++ b/src/shared/rpc-contract/agent-launch-params.ts
@@ -18,6 +18,7 @@ import { isValidHostTerminalTabId } from '../terminal-tab-id'
 import { isTuiAgent } from '../tui-agent-config'
 import type { TuiAgent } from '../tui-agent'
 import { WorktreeCreate } from './worktree-create-params'
+import { LaunchSourceParam } from './launch-source-param'
 import { TerminalTabIdParam } from './agent-session-params'
 import { SessionId } from './structured-agent-session-params'
 import { isStructuredAgentSessionIdFor } from '../structured-agent-session-create'
@@ -78,16 +79,7 @@ export const AgentLaunchFields = z.object({
   /** A start directory other than the workspace root. Terminal-only, and the host downgrades a
    *  structured launch that carries one rather than ignoring it. */
   cwd: z.string().min(1, 'Empty launch cwd').optional(),
-  /**
-   * Telemetry attribution, deliberately `z.string()` rather than the closed `launchSourceSchema`.
-   *
-   * Params are validated by the HOST, so a closed enum here is a version claim pointing the wrong
-   * way: a newer client naming a launch surface an older host has never heard of would have its
-   * whole launch refused over a label nothing reads as behaviour. Bookkeeping must not gate a user
-   * action, so the arm set stays open here and the host parses it leniently at the point it is
-   * actually used — the same `safeParse`-and-skip the PTY spawn already does.
-   */
-  launchSource: z.string().optional(),
+  launchSource: LaunchSourceParam.optional(),
   /**
    * The pane a terminal launch should create, minted by a caller that places its own tabs.
    *
diff --git a/src/shared/rpc-contract/client-ui-params.ts b/src/shared/rpc-contract/client-ui-params.ts
index df84a06a256..c5a5cd2195b 100644
--- a/src/shared/rpc-contract/client-ui-params.ts
+++ b/src/shared/rpc-contract/client-ui-params.ts
@@ -69,6 +69,8 @@ export const StatusBarItem = z.enum([
   'kimi',
   'minimax',
   'grok',
+  'cursor',
+  'zcode',
   'ssh',
   'resource-usage',
   'ports'
@@ -161,6 +163,7 @@ export const UiUpdateFields = z
     ...ClientUiWorkspaceFilterFields,
     // Why: rides App.tsx's debounced writer, so omitting it rejected that entire
     // payload (sidebar widths, filters, agent acks) for every paired client.
+    explorerDisplayRootByWorktree: z.record(z.string(), z.string()).optional(),
     showDotfilesByWorktree: z.record(z.string(), z.boolean()).optional(),
     collapsedGroups: StringArray.optional(),
     uiZoomLevel: z.number().finite().optional(),
@@ -182,6 +185,8 @@ export const UiUpdateFields = z
     _minimaxStatusBarDefaultAdded: z.boolean().optional(),
     _antigravityStatusBarDefaultAdded: z.boolean().optional(),
     _grokStatusBarDefaultAdded: z.boolean().optional(),
+    _cursorStatusBarDefaultAdded: z.boolean().optional(),
+    _zcodeStatusBarDefaultAdded: z.boolean().optional(),
     statusBarVisible: z.boolean().optional(),
     usagePercentageDisplay: z.enum(['used', 'remaining']).optional(),
     statusBarUsageMode: z.enum(['verbose', 'compact']).optional(),
diff --git a/src/shared/rpc-contract/launch-source-param.ts b/src/shared/rpc-contract/launch-source-param.ts
new file mode 100644
index 00000000000..61004422483
--- /dev/null
+++ b/src/shared/rpc-contract/launch-source-param.ts
@@ -0,0 +1,12 @@
+import { z } from 'zod'
+
+/**
+ * Which surface started an agent launch, deliberately `z.string()` rather than the closed
+ * `launchSourceSchema`.
+ *
+ * Params are validated by the HOST, so a closed enum here is a version claim pointing the wrong
+ * way: a newer client naming a launch surface an older host has never heard of would have its
+ * whole launch refused over a label nothing reads as behaviour. Bookkeeping must not gate a user
+ * action, so the arm set stays open here and the host resolves it leniently where it is used.
+ */
+export const LaunchSourceParam = z.string()
diff --git a/src/shared/rpc-contract/rpc-params-catalog.generated.ts b/src/shared/rpc-contract/rpc-params-catalog.generated.ts
index 57d90d2218a..ca4932528b0 100644
--- a/src/shared/rpc-contract/rpc-params-catalog.generated.ts
+++ b/src/shared/rpc-contract/rpc-params-catalog.generated.ts
@@ -473,7 +473,10 @@ import {
   HoldParams,
   ModelCatalogParams,
   OptionsParams,
+  QueuedMessageActionParams,
+  QueuedMessagesResumeParams,
   RespondParams,
+  RespondToQuestionParams,
   RestartResumableParams,
   RestartResumeParams,
   RewindParams,
@@ -577,9 +580,12 @@ export const RPC_PARAMS_BY_METHOD = {
   'agentSession.hold': HoldParams,
   'agentSession.modelCatalog': ModelCatalogParams,
   'agentSession.options': OptionsParams,
+  'agentSession.queuedMessageDelete': QueuedMessageActionParams,
+  'agentSession.queuedMessageSend': QueuedMessageActionParams,
+  'agentSession.queuedMessagesResume': QueuedMessagesResumeParams,
   'agentSession.release': HoldParams,
   'agentSession.respondToApproval': RespondParams,
-  'agentSession.respondToQuestion': RespondParams,
+  'agentSession.respondToQuestion': RespondToQuestionParams,
   'agentSession.restartContinue': RestartResumeParams,
   'agentSession.restartResumable': RestartResumableParams,
   'agentSession.restartResumableDismiss': RestartResumableParams,
@@ -1136,6 +1142,7 @@ export const RPC_PARAMS_BY_METHOD = {
   'terminal.read': TerminalRead,
   'terminal.recoverPane': TerminalRecoverPane,
   'terminal.rename': TerminalRename,
+  'terminal.resetInputModes': TerminalHandle,
   'terminal.resizeForClient': TerminalResizeForClient,
   'terminal.resolveActive': TerminalResolveActive,
   'terminal.resolveIdentity': TerminalHandle,
diff --git a/src/shared/rpc-contract/session-tabs-schemas-params.ts b/src/shared/rpc-contract/session-tabs-schemas-params.ts
index d04f5443477..7947e236891 100644
--- a/src/shared/rpc-contract/session-tabs-schemas-params.ts
+++ b/src/shared/rpc-contract/session-tabs-schemas-params.ts
@@ -117,6 +117,7 @@ export const UpdatePaneLayout = WorktreeTabSelector.extend({
     .pipe(z.string().min(1, 'Missing tab id')),
   root: z.union([z.null(), TerminalPaneLayoutNodeSchema]),
   expandedLeafId: z.string().max(128).nullable().optional(),
+  chatLeafId: z.string().max(128).nullable().optional(),
   titlesByLeafId: z.record(z.string(), z.string()).optional()
 })
 
diff --git a/src/shared/rpc-contract/structured-agent-session-params.ts b/src/shared/rpc-contract/structured-agent-session-params.ts
index 7f41bd2c4b8..b44f7204168 100644
--- a/src/shared/rpc-contract/structured-agent-session-params.ts
+++ b/src/shared/rpc-contract/structured-agent-session-params.ts
@@ -2,6 +2,10 @@ import { z } from 'zod'
 import { isAgentSessionSurfaceTabId } from '../agent-session-surface-tab-id'
 import { isAgentSessionId } from '../agent-session-record'
 import { normalizeExecutionHostId } from '../execution-host'
+import {
+  AGENT_SESSION_QUESTION_ANSWER_MAX_BYTES,
+  AGENT_SESSION_RESPONSE_OPTION_ID_MAX_LENGTH
+} from '../agent-session-question-answer'
 import {
   AGENT_SESSION_ID_MAX_LENGTH,
   AGENT_SESSION_HISTORY_DIRECTIONS,
@@ -12,10 +16,14 @@ import {
 export const MAX_ID_LENGTH = AGENT_SESSION_ID_MAX_LENGTH
 
 // Four Claude questions with all four generated choices occupy 610 chars when fully percent-encoded.
-export const MAX_RESPONSE_OPTION_ID_LENGTH = 1024
+export const MAX_RESPONSE_OPTION_ID_LENGTH = AGENT_SESSION_RESPONSE_OPTION_ID_MAX_LENGTH
 
 export const MAX_PROMPT_BYTES = 256 * 1024
 
+/** Matches the journal's bounds on one grouped prompt. */
+const MAX_QUESTION_ANSWER_QUESTIONS = 4
+const MAX_QUESTION_ANSWER_OPTIONS = 64
+
 export const MAX_BLOCKS = 64
 
 export const MAX_OPTION_LABEL = 512
@@ -160,6 +168,10 @@ export const SendParams = z
   .object({
     envelope: MutationEnvelope,
     retryUnknown: z.literal(true).optional(),
+    /** Queue the send as a host-held draft while the main agent is working. Strict object, so an
+     *  older host refuses it: clients send it only when `agent-session.queued-messages.v1` is
+     *  advertised. Participates in the operation fingerprint, never the body fingerprint. */
+    delivery: z.literal('queue-if-active').optional(),
     body: z
       .object({
         kind: z.literal('message'),
@@ -177,7 +189,8 @@ export const SendParams = z
 export const CancelParams = z
   .object({
     envelope: MutationEnvelope,
-    turnId: Identifier('Invalid turn id'),
+    // Absent: stop whatever the conversation has in flight. Present: only if that turn is current.
+    turnId: Identifier('Invalid turn id').optional(),
     scope: z.literal('background-tasks').optional(),
     taskId: Identifier('Invalid task id').optional(),
     prompt: z
@@ -196,8 +209,24 @@ export const CancelParams = z
     if (value.prompt !== undefined && value.scope === 'background-tasks') {
       ctx.addIssue({ code: 'custom', message: 'A prompt cannot use background-task scope' })
     }
+    if (value.turnId === undefined && (value.prompt !== undefined || value.scope !== undefined)) {
+      ctx.addIssue({ code: 'custom', message: 'A prompt or background-task cancel names its turn' })
+    }
   })
 
+/** `agentSession.queuedMessageSend` / `agentSession.queuedMessageDelete`. Gated on
+ *  `agent-session.queued-messages.v1`; an older host lacks the methods entirely. */
+export const QueuedMessageActionParams = z
+  .object({
+    envelope: MutationEnvelope,
+    messageId: Identifier('Invalid queued message id')
+  })
+  .strict()
+
+/** `agentSession.queuedMessagesResume`: ends the queue's pause (a Stop's, or a
+ *  restart's) so the cards send again. Gated like the draft actions above. */
+export const QueuedMessagesResumeParams = z.object({ envelope: MutationEnvelope }).strict()
+
 export const RespondParams = z
   .object({
     envelope: MutationEnvelope,
@@ -208,6 +237,50 @@ export const RespondParams = z
   })
   .strict()
 
+const QuestionAnswer = z
+  .object({
+    // Codex question ids are model-written and untrimmed; the host matches them exactly.
+    questionId: z
+      .string()
+      .min(1, 'Invalid question id')
+      .max(MAX_RESPONSE_OPTION_ID_LENGTH, 'Invalid question id'),
+    optionIds: z
+      .array(Identifier('Invalid option id', MAX_RESPONSE_OPTION_ID_LENGTH))
+      .max(MAX_QUESTION_ANSWER_OPTIONS),
+    // Hashed verbatim by both peers, so no trim or transform here.
+    other: z
+      .string()
+      .max(AGENT_SESSION_QUESTION_ANSWER_MAX_BYTES)
+      .refine(
+        (value) => Buffer.byteLength(value, 'utf8') <= AGENT_SESSION_QUESTION_ANSWER_MAX_BYTES,
+        'Answer is too large'
+      )
+      .optional()
+  })
+  .strict()
+
+export const RespondToQuestionParams = z
+  .object({
+    envelope: MutationEnvelope,
+    itemId: Identifier('Invalid item id'),
+    expectedRevision: z.number().int().positive(),
+    /** An answer packed into one id, from clients that predate `answers`. */
+    optionId: Identifier('Invalid option id', MAX_RESPONSE_OPTION_ID_LENGTH).optional(),
+    answers: z.array(QuestionAnswer).min(1).max(MAX_QUESTION_ANSWER_QUESTIONS).optional()
+  })
+  .strict()
+  .superRefine((value, ctx) => {
+    if ((value.optionId === undefined) === (value.answers === undefined)) {
+      ctx.addIssue({ code: 'custom', message: 'Send exactly one of an option id or answers' })
+    }
+    if (
+      value.answers !== undefined &&
+      Buffer.byteLength(JSON.stringify(value.answers), 'utf8') > MAX_PROMPT_BYTES
+    ) {
+      ctx.addIssue({ code: 'custom', message: 'Answer is too large' })
+    }
+  })
+
 export const SetOptionParams = z
   .object({
     envelope: MutationEnvelope,
diff --git a/src/shared/rpc-contract/terminal-viewport-schemas-params.ts b/src/shared/rpc-contract/terminal-viewport-schemas-params.ts
index aac38a1858e..416ce7859e0 100644
--- a/src/shared/rpc-contract/terminal-viewport-schemas-params.ts
+++ b/src/shared/rpc-contract/terminal-viewport-schemas-params.ts
@@ -29,7 +29,9 @@ export const TerminalUnsubscribe = z.object({
     .object({
       id: requiredString('Missing client ID')
     })
-    .optional()
+    .optional(),
+  // Why: the `terminal.subscribe` frame id; addresses that exact request, so a stale unsubscribe can't end a newer stream on the same slot.
+  requestId: z.string().min(1).optional()
 })
 
 // Why: in-place update avoids an unsubscribe→resubscribe that flashed the lock banner and stranded the PTY at phone dims (docs/mobile-presence-lock.md).
diff --git a/src/shared/rpc-contract/worktree-create-params.ts b/src/shared/rpc-contract/worktree-create-params.ts
index 7c0b1f55fad..04de055a639 100644
--- a/src/shared/rpc-contract/worktree-create-params.ts
+++ b/src/shared/rpc-contract/worktree-create-params.ts
@@ -5,6 +5,7 @@ import { workspaceSourceSchema } from '../telemetry-events'
 import { RUNTIME_NAVIGATION_TARGETS } from '../runtime-navigation'
 import { sleepingAgentLaunchConfigSchema } from '../workspace-session-sleeping-agents'
 import { isTuiAgent } from '../tui-agent-config'
+import { LaunchSourceParam } from './launch-source-param'
 import {
   OptionalBoolean,
   OptionalFiniteNumber,
@@ -110,6 +111,8 @@ export const WorktreeCreate = z
     // workspaces execute in a different shell than the client process.
     startupAgent: OptionalTuiAgent,
     startupPrompt: OptionalString,
+    // Which surface asked for the agent the host launches from `startupAgent` or `startupDraft`.
+    launchSource: LaunchSourceParam.optional(),
     // Why: task-driven mobile creates need desktop parity: the host chooses
     // the same default/detected agent and drafts the linked issue/PR URL into it.
     startupDraft: OptionalString,
diff --git a/src/shared/runtime-client-export-parity.test.ts b/src/shared/runtime-client-export-parity.test.ts
deleted file mode 100644
index 2b86d2e6e99..00000000000
--- a/src/shared/runtime-client-export-parity.test.ts
+++ /dev/null
@@ -1,242 +0,0 @@
-import { describe, expect, expectTypeOf, it } from 'vitest'
-import type { PairingOffer } from './pairing'
-import type { RuntimeCapability } from './protocol-version'
-import * as RemoteClient from './remote-runtime-client'
-import type { RuntimeOrchestrationEnvelope, RuntimeRpcResponse } from './runtime-rpc-envelope'
-import * as Runtime from './runtime-types'
-
-type RuntimeTypeInventory = [
-  Runtime.BrowserBackResult,
-  Runtime.BrowserCaptureStartResult,
-  Runtime.BrowserCaptureStopResult,
-  Runtime.BrowserCheckResult,
-  Runtime.BrowserClearResult,
-  Runtime.BrowserClickResult,
-  Runtime.BrowserConsoleEntry,
-  Runtime.BrowserConsoleResult,
-  Runtime.BrowserCookie,
-  Runtime.BrowserCookieDeleteResult,
-  Runtime.BrowserCookieGetResult,
-  Runtime.BrowserCookieSetResult,
-  Runtime.BrowserDetectedInfo,
-  Runtime.BrowserDetectedProfileInfo,
-  Runtime.BrowserDetectProfilesResult,
-  Runtime.BrowserDragResult,
-  Runtime.BrowserErrorCode,
-  Runtime.BrowserEvalResult,
-  Runtime.BrowserFillResult,
-  Runtime.BrowserFocusResult,
-  Runtime.BrowserGeolocationResult,
-  Runtime.BrowserGotoResult,
-  Runtime.BrowserHoverResult,
-  Runtime.BrowserInterceptDisableResult,
-  Runtime.BrowserInterceptedRequest,
-  Runtime.BrowserInterceptEnableResult,
-  Runtime.BrowserKeypressResult,
-  Runtime.BrowserNetworkEntry,
-  Runtime.BrowserNetworkLogResult,
-  Runtime.BrowserPdfResult,
-  Runtime.BrowserProfileClearDefaultCookiesResult,
-  Runtime.BrowserProfileCreateResult,
-  Runtime.BrowserProfileDeleteResult,
-  Runtime.BrowserProfileImportFromBrowserResult,
-  Runtime.BrowserProfileListResult,
-  Runtime.BrowserReloadResult,
-  Runtime.BrowserScreencastDialogClosedResult,
-  Runtime.BrowserScreencastDialogResult,
-  Runtime.BrowserScreencastEndResult,
-  Runtime.BrowserScreencastErrorResult,
-  Runtime.BrowserScreencastReadyResult,
-  Runtime.BrowserScreencastResult,
-  Runtime.BrowserScreenshotResult,
-  Runtime.BrowserScrollResult,
-  Runtime.BrowserSelectAllResult,
-  Runtime.BrowserSelectResult,
-  Runtime.BrowserSnapshotRef,
-  Runtime.BrowserSnapshotResult,
-  Runtime.BrowserTabCreateResult,
-  Runtime.BrowserTabCurrentResult,
-  Runtime.BrowserTabInfo,
-  Runtime.BrowserTabListResult,
-  Runtime.BrowserTabProfileCloneResult,
-  Runtime.BrowserTabProfileShowResult,
-  Runtime.BrowserTabSetProfileResult,
-  Runtime.BrowserTabShowResult,
-  Runtime.BrowserTabSwitchResult,
-  Runtime.BrowserTypeResult,
-  Runtime.BrowserUploadResult,
-  Runtime.BrowserViewportResult,
-  Runtime.BrowserWaitResult,
-  Runtime.CliRuntimeState,
-  Runtime.CliStatusResult,
-  Runtime.ComputerActionMetadata,
-  Runtime.ComputerActionResult,
-  Runtime.ComputerActionVerification,
-  Runtime.ComputerAppInfo,
-  Runtime.ComputerAppQuery,
-  Runtime.ComputerErrorCode,
-  Runtime.ComputerListAppsResult,
-  Runtime.ComputerListWindowsResult,
-  Runtime.ComputerProviderCapabilities,
-  Runtime.ComputerScreenshotData,
-  Runtime.ComputerScreenshotMetadata,
-  Runtime.ComputerScreenshotStatus,
-  Runtime.ComputerSnapshotData,
-  Runtime.ComputerSnapshotResult,
-  Runtime.ComputerWindowInfo,
-  Runtime.ComputerWindowListWindow,
-  Runtime.DeviceScope,
-  Runtime.RuntimeBrowserDriverState,
-  Runtime.RuntimeBrowserUnavailableReason,
-  Runtime.RuntimeDegradation,
-  Runtime.RuntimeDesktopWindowStatus,
-  Runtime.RuntimeFileListEntry,
-  Runtime.RuntimeFileListResult,
-  Runtime.RuntimeFileOpenResult,
-  Runtime.RuntimeFilePreviewResult,
-  Runtime.RuntimeFileReadChunkResult,
-  Runtime.RuntimeFileReadResult,
-  Runtime.RuntimeGitCheckoutResult,
-  Runtime.RuntimeGitLocalBranches,
-  Runtime.RuntimeGraphStatus,
-  Runtime.RuntimeMarkdownReadTabResult,
-  Runtime.RuntimeMarkdownSaveTabResult,
-  Runtime.RuntimeMobileSessionBrowserTab,
-  Runtime.RuntimeMobileSessionClientTab,
-  Runtime.RuntimeMobileSessionCreateTerminalResult,
-  Runtime.RuntimeMobileSessionFileTab,
-  Runtime.RuntimeMobileSessionMarkdownTab,
-  Runtime.RuntimeMobileSessionSnapshotTab,
-  Runtime.RuntimeMobileSessionTabCloseResult,
-  Runtime.RuntimeMobileSessionTabGroup,
-  Runtime.RuntimeMobileSessionTabMove,
-  Runtime.RuntimeMobileSessionTabMoveResult,
-  Runtime.RuntimeMobileSessionTabsRemovedResult,
-  Runtime.RuntimeMobileSessionTabsResult,
-  Runtime.RuntimeMobileSessionTabsSnapshot,
-  Runtime.RuntimeMobileSessionTerminalClientTab,
-  Runtime.RuntimeMobileSessionTerminalTab,
-  Runtime.RuntimeMobileTerminalTheme,
-  Runtime.RuntimeNativeChatFileContext,
-  Runtime.RuntimeNativeChatLaunchDraftResolution,
-  Runtime.RuntimeRendererSyncWindowGraph,
-  Runtime.RuntimeRepoList,
-  Runtime.RuntimeRepoSearchRefs,
-  Runtime.RuntimeSessionTabCloseReason,
-  Runtime.RuntimeSpeechModelSummary,
-  Runtime.RuntimeSpeechSetupState,
-  Runtime.RuntimeStatus,
-  Runtime.RuntimeSyncedLeaf,
-  Runtime.RuntimeSyncedTab,
-  Runtime.RuntimeSyncWindowGraph,
-  Runtime.RuntimeSyncWindowGraphResult,
-  Runtime.RuntimeTerminalAgentStatus,
-  Runtime.RuntimeTerminalAgentStatusState,
-  Runtime.RuntimeTerminalClose,
-  Runtime.RuntimeTerminalCreate,
-  Runtime.RuntimeTerminalCreateRequestPayload,
-  Runtime.RuntimeTerminalDriverState,
-  Runtime.RuntimeTerminalFocus,
-  Runtime.RuntimeTerminalInteractiveWait,
-  Runtime.RuntimeTerminalInteractiveWaitSource,
-  Runtime.RuntimeTerminalListHostScope,
-  Runtime.RuntimeTerminalListResult,
-  Runtime.RuntimeTerminalOrphanAdoptionClaim,
-  Runtime.RuntimeTerminalOrphanAdoptionRequest,
-  Runtime.RuntimeTerminalOrphanAdoptionResult,
-  Runtime.RuntimeTerminalOrphanTopology,
-  Runtime.RuntimeTerminalOrphanTopologyGroup,
-  Runtime.RuntimeTerminalOrphanTopologyTab,
-  Runtime.RuntimeTerminalPathOpenTarget,
-  Runtime.RuntimeTerminalPathResolution,
-  Runtime.RuntimeTerminalPresentation,
-  Runtime.RuntimeTerminalRead,
-  Runtime.RuntimeTerminalRename,
-  Runtime.RuntimeTerminalResolvePane,
-  Runtime.RuntimeTerminalSend,
-  Runtime.RuntimeTerminalShow,
-  Runtime.RuntimeTerminalSplit,
-  Runtime.RuntimeTerminalState,
-  Runtime.RuntimeTerminalSummary,
-  Runtime.RuntimeTerminalUnavailableReason,
-  Runtime.RuntimeTerminalVisualGroupNode,
-  Runtime.RuntimeTerminalVisualLayout,
-  Runtime.RuntimeTerminalVisualLayoutNode,
-  Runtime.RuntimeTerminalVisualPaneNode,
-  Runtime.RuntimeTerminalVisualTab,
-  Runtime.RuntimeTerminalVisualTerminalNode,
-  Runtime.RuntimeTerminalWait,
-  Runtime.RuntimeTerminalWaitBlockedReason,
-  Runtime.RuntimeTerminalWaitCondition,
-  Runtime.RuntimeWorktreeAgentRow,
-  Runtime.RuntimeWorktreeCreateResult,
-  Runtime.RuntimeWorktreeListResult,
-  Runtime.RuntimeWorktreePsConditionalResult,
-  Runtime.RuntimeWorktreePsResult,
-  Runtime.RuntimeWorktreePsSnapshotResult,
-  Runtime.RuntimeWorktreePsSummary,
-  Runtime.RuntimeWorktreePsUnchangedResult,
-  Runtime.RuntimeWorktreeRecord,
-  Runtime.RuntimeWorktreeRemoveResult,
-  Runtime.RuntimeWorktreeStatus,
-  Runtime.RuntimeWorktreeTerminalSleepResult
-]
-
-describe('runtime client public export parity', () => {
-  it('keeps the runtime type inventory compile-visible', () => {
-    expectTypeOf<RuntimeTypeInventory>().toEqualTypeOf<RuntimeTypeInventory>()
-    expectTypeOf<RemoteClient.RemoteRuntimeSubscription>().toEqualTypeOf<RemoteClient.RemoteRuntimeSubscription>()
-    expectTypeOf<RemoteClient.RemoteRuntimeSubscriptionCallbacks>().toEqualTypeOf<RemoteClient.RemoteRuntimeSubscriptionCallbacks>()
-    expectTypeOf(RemoteClient.sendRemoteRuntimeRequest).toEqualTypeOf<
-      <TResult>(
-        pairing: PairingOffer,
-        method: string,
-        params: unknown,
-        timeoutMs: number,
-        envelope?: RuntimeOrchestrationEnvelope,
-        signal?: AbortSignal,
-        clientCapabilities?: readonly RuntimeCapability[]
-      ) => Promise<RuntimeRpcResponse<TResult>>
-    >()
-    expectTypeOf(RemoteClient.sendRemoteRuntimeRequestWithStatusPreflight).toEqualTypeOf<
-      <TResult>(
-        pairing: PairingOffer,
-        method: string,
-        params: unknown,
-        timeoutMs: number,
-        validateStatus: (response: RuntimeRpcResponse<Runtime.RuntimeStatus>) => void,
-        envelope?: RuntimeOrchestrationEnvelope,
-        clientCapabilities?: readonly RuntimeCapability[]
-      ) => Promise<RuntimeRpcResponse<TResult>>
-    >()
-    expectTypeOf(RemoteClient.subscribeRemoteRuntimeRequest).toEqualTypeOf<
-      <TResult>(
-        pairing: PairingOffer,
-        method: string,
-        params: unknown,
-        timeoutMs: number,
-        callbacks: RemoteClient.RemoteRuntimeSubscriptionCallbacks<TResult>,
-        options?: RemoteClient.RemoteRuntimeSubscriptionOptions
-      ) => Promise<RemoteClient.RemoteRuntimeSubscription>
-    >()
-  })
-
-  it('keeps the runtime and transport value exports exact', () => {
-    expect(Object.keys(Runtime).sort()).toEqual([
-      'BROWSER_UNAVAILABLE_ERROR_CODE',
-      'COMPUTER_ERROR_CODES',
-      'HEADLESS_RUNTIME_WINDOW_ID',
-      'TERMINAL_PTY_DEGRADATION_CAPABILITY',
-      'TERMINAL_UNAVAILABLE_ERROR_CODE',
-      'UNPUBLISHED_WORKTREE_PUBLICATION_EPOCH',
-      'browserUnavailableMessage',
-      'terminalUnavailableMessage'
-    ])
-    expect(Object.keys(RemoteClient).sort()).toEqual([
-      'RemoteRuntimeClientError',
-      'sendRemoteRuntimeRequest',
-      'sendRemoteRuntimeRequestWithStatusPreflight',
-      'subscribeRemoteRuntimeRequest'
-    ])
-  })
-})
diff --git a/src/shared/runtime-terminal-contracts.ts b/src/shared/runtime-terminal-contracts.ts
index 235ef1e6b79..63adc2d67f8 100644
--- a/src/shared/runtime-terminal-contracts.ts
+++ b/src/shared/runtime-terminal-contracts.ts
@@ -322,6 +322,9 @@ export type RuntimeTerminalClose = {
   ptyKilled: boolean
   ptyStopVerdict?: 'live' | 'unverifiable'
   ptyStopReason?: string
+  /** The host durably recorded a kill order it replays when the PTY's SSH host reconnects.
+   *  Older hosts never send it, so a client promises no retry without it. */
+  pendingKillRecorded?: true
 }
 
 export type RuntimeTerminalWaitCondition = 'exit' | 'tui-idle'
diff --git a/src/shared/runtime-worktree-contracts.ts b/src/shared/runtime-worktree-contracts.ts
index c56bc3a17e6..3d95fb0a3dc 100644
--- a/src/shared/runtime-worktree-contracts.ts
+++ b/src/shared/runtime-worktree-contracts.ts
@@ -1,4 +1,5 @@
 import type { AgentStatusState, AgentType, AgentWorkingMode } from './agent-status-types'
+import type { AgentMainAgentStatus } from './main-agent-status'
 import type { BaseRefSearchResult, Repo } from './repo-types'
 import type { CreateWorktreeResult, RemoveWorktreeResult } from './worktree/create-types'
 import type {
@@ -22,6 +23,10 @@ export type RuntimeWorktreeAgentRow = {
   toolName: string | null
   toolInput: string | null
   interrupted: boolean
+  /** The main agent's own state, verdict and clock, sent whenever the host row has one, including
+   *  while subagents hold the row `working`. Optional on the wire: old hosts never send it, and a
+   *  reader without it falls back to `interrupted`. */
+  mainAgent?: AgentMainAgentStatus
   stateStartedAt: number
   updatedAt: number
   restoredUnconfirmed?: boolean
diff --git a/src/shared/setup-agent-sequencing.test.ts b/src/shared/setup-agent-sequencing.test.ts
index 1b8d69f0aa5..908ea149cef 100644
--- a/src/shared/setup-agent-sequencing.test.ts
+++ b/src/shared/setup-agent-sequencing.test.ts
@@ -122,6 +122,20 @@ describe('createSequencedSetupAgentCommands', () => {
     )
   })
 
+  it('doubles typographic single quotes in native Windows gate literals', () => {
+    const commands = createSequencedSetupAgentCommands({
+      runnerScriptPath: 'C:\\O\u2019Brien\\.git\\orca\\setup-runner.cmd',
+      platform: 'windows',
+      startupCommand: 'codex',
+      nonce: 'nonce-3'
+    })
+    const decoded = Buffer.from(
+      commands.setupCommand.split('-EncodedCommand ')[1] ?? '',
+      'base64'
+    ).toString('utf16le')
+    expect(decoded).toContain("$runner = 'C:\\O\u2019\u2019Brien\\.git\\orca\\setup-runner.cmd'")
+  })
+
   it('leaves the failure and timeout messages as the only other outcomes', () => {
     const script =
       createSequencedSetupAgentCommands({
diff --git a/src/shared/setup-agent-sequencing.ts b/src/shared/setup-agent-sequencing.ts
index 367be99c212..a865b23f837 100644
--- a/src/shared/setup-agent-sequencing.ts
+++ b/src/shared/setup-agent-sequencing.ts
@@ -6,6 +6,8 @@ import {
   type SetupRunnerCommandShell,
   type SetupRunnerShell
 } from './setup-runner-command'
+import { createNonSecureContextUuid } from './non-secure-context-uuid'
+import { quotePowerShellLiteral } from './powershell-native-argument'
 
 const DEFAULT_WAIT_TIMEOUT_SECONDS = 2 * 60 * 60
 // Exported so the gate and its tests share one definition.
@@ -28,11 +30,7 @@ export function resolveSetupAgentSequenceLaunchCommand(
 }
 
 export function createSetupAgentSequenceNonce(): string {
-  const cryptoApi = globalThis.crypto
-  if (typeof cryptoApi?.randomUUID === 'function') {
-    return cryptoApi.randomUUID()
-  }
-  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`
+  return createNonSecureContextUuid()
 }
 
 export function createSequencedSetupAgentCommands(args: {
@@ -196,10 +194,10 @@ function buildWindowsSetupCommand(
 ): string {
   // Why: delayed expansion keeps path metacharacters as data when cmd invokes the batch runner.
   const script = [
-    `$runner = ${quotePowerShellString(runnerScriptPath)}`,
-    `$marker = ${quotePowerShellString(markerPath)}`,
+    `$runner = ${quotePowerShellLiteral(runnerScriptPath)}`,
+    `$marker = ${quotePowerShellLiteral(markerPath)}`,
     '$tmp = $marker + ".tmp"',
-    `$nonce = ${quotePowerShellString(nonce)}`,
+    `$nonce = ${quotePowerShellLiteral(nonce)}`,
     'Remove-Item -LiteralPath $marker, $tmp -Force -ErrorAction SilentlyContinue',
     '$processInfo = [System.Diagnostics.ProcessStartInfo]::new()',
     '$processInfo.FileName = $env:ComSpec',
@@ -248,13 +246,13 @@ function buildWindowsStartupCommand(
       '"session (" + $_.FullyQualifiedErrorId + "). A startup command that runs a .ps1 " + ' +
       '"may be blocked.") }',
     '$ProgressPreference = $orcaProgress',
-    `$marker = ${quotePowerShellString(markerPath)}`,
+    `$marker = ${quotePowerShellLiteral(markerPath)}`,
     'if ([string]::IsNullOrWhiteSpace($marker)) {',
     '  [Console]::Error.WriteLine("Missing setup marker path.")',
     '  exit 1',
     '}',
     '$tmp = $marker + ".tmp"',
-    `$nonce = ${quotePowerShellString(nonce)}`,
+    `$nonce = ${quotePowerShellLiteral(nonce)}`,
     `$deadline = (Get-Date).AddSeconds(${timeout})`,
     '[Console]::Error.WriteLine("Waiting for setup to finish before starting agent...")',
     'while ($true) {',
@@ -272,7 +270,7 @@ function buildWindowsStartupCommand(
     '        [Console]::Error.WriteLine("Missing sequenced startup command.")',
     '        exit 1',
     '      }',
-    `      [Console]::Error.WriteLine(${quotePowerShellString(SETUP_COMPLETE_MESSAGE)})`,
+    `      [Console]::Error.WriteLine(${quotePowerShellLiteral(SETUP_COMPLETE_MESSAGE)})`,
     '      Invoke-Expression $startup',
     '      if ($global:LASTEXITCODE -ne $null) { exit $global:LASTEXITCODE }',
     '      if (-not $?) { exit 1 }',
@@ -304,10 +302,6 @@ function quotePosixArg(value: string): string {
   return `'${value.replace(/'/g, `'\\''`)}'`
 }
 
-function quotePowerShellString(value: string): string {
-  return `'${value.replace(/'/g, "''")}'`
-}
-
 export function getSetupAgentSequenceShellForTests(
   runnerScriptPath: string,
   platform: SetupRunnerCommandPlatform
diff --git a/src/shared/setup-agent-sequencing.windows.test.ts b/src/shared/setup-agent-sequencing.windows.test.ts
index 10b1e76d908..b27ee5ccc41 100644
--- a/src/shared/setup-agent-sequencing.windows.test.ts
+++ b/src/shared/setup-agent-sequencing.windows.test.ts
@@ -9,6 +9,7 @@ import {
   createSequencedSetupAgentCommands,
   SETUP_AGENT_SEQUENCE_STARTUP_COMMAND_ENV
 } from './setup-agent-sequencing'
+import { quotePowerShellLiteral } from './powershell-native-argument'
 
 const TEMP_DIRS: string[] = []
 const WINDOWS_PROCESS_TEST_TIMEOUT_MS = 30_000
@@ -49,14 +50,14 @@ describe.skipIf(process.platform !== 'win32')('Windows setup-agent sequencing',
         [
           'param([string]$Value)',
           '$utf8 = [System.Text.UTF8Encoding]::new($false)',
-          `[System.IO.File]::AppendAllText('${quotePowerShell(logPath)}', $Value + [Environment]::NewLine, $utf8)`
+          `[System.IO.File]::AppendAllText(${quotePowerShellLiteral(logPath)}, $Value + [Environment]::NewLine, $utf8)`
         ].join('\r\n'),
         'utf8'
       )
 
       const commands = createSequencedSetupAgentCommands({
         runnerScriptPath,
-        startupCommand: `& '${quotePowerShell(startupScriptPath)}' '${quotePowerShell(prompt)}'`,
+        startupCommand: `& ${quotePowerShellLiteral(startupScriptPath)} ${quotePowerShellLiteral(prompt)}`,
         platform: 'windows',
         nonce: 'windows-sequence',
         waitTimeoutSeconds: 2
@@ -167,10 +168,6 @@ function spawnWindowsCommand(
   })
 }
 
-function quotePowerShell(value: string): string {
-  return value.replace(/'/g, "''")
-}
-
 function waitForExit(
   child: ReturnType<typeof spawn>
 ): Promise<{ code: number | null; stderr: string }> {
diff --git a/src/shared/skills-cli-agent-keys.ts b/src/shared/skills-cli-agent-keys.ts
index a85fa9d80ab..1955bfa6d58 100644
--- a/src/shared/skills-cli-agent-keys.ts
+++ b/src/shared/skills-cli-agent-keys.ts
@@ -14,6 +14,7 @@ import type { TuiAgent } from './tui-agent'
 export const SKILLS_CLI_AGENT_KEY_BY_TUI_AGENT = {
   claude: 'claude-code',
   'claude-agent-teams': 'claude-code',
+  codebuddy: 'codebuddy',
   // Why: Orca states OpenClaude reads Claude-owned roots (native-chat-agent-profiles).
   openclaude: 'claude-code',
   codex: 'codex',
@@ -24,6 +25,7 @@ export const SKILLS_CLI_AGENT_KEY_BY_TUI_AGENT = {
   pi: 'pi',
   omp: null,
   'prime-agent': null,
+  qoder: 'qoder',
   gemini: 'gemini-cli',
   antigravity: 'antigravity',
   aider: null,
@@ -35,6 +37,7 @@ export const SKILLS_CLI_AGENT_KEY_BY_TUI_AGENT = {
   aug: 'augment',
   cline: 'cline',
   codebuff: null,
+  freebuff: null,
   'command-code': 'command-code',
   continue: 'continue',
   cursor: 'cursor',
@@ -52,7 +55,9 @@ export const SKILLS_CLI_AGENT_KEY_BY_TUI_AGENT = {
   // Why: Orca detects trae by `traecli`, an alias only TRAE CN ships.
   trae: 'trae-cn',
   muse: null,
-  zcode: 'zcode'
+  zcode: 'zcode',
+  // Why: DSH ships skills as Cordis plugins, not a `skills --agent` target.
+  dsh: null
 } satisfies Record<TuiAgent, string | null>
 
 /**
diff --git a/src/shared/source-control-ai-action-recipes.test.ts b/src/shared/source-control-ai-action-recipes.test.ts
index 352f9cfa337..15e09ebe912 100644
--- a/src/shared/source-control-ai-action-recipes.test.ts
+++ b/src/shared/source-control-ai-action-recipes.test.ts
@@ -427,7 +427,7 @@ describe('source-control AI action recipes', () => {
     ).toEqual({
       ok: false,
       error:
-        'Agent "aider" does not support Source Control AI commit messages. Supported agents: OMP, Claude, Codex, OpenCode, OpenCode 2, Pi, Amp, Cursor, Kimi, Muse, GitHub Copilot, Antigravity, or Custom command.'
+        'Agent "aider" does not support Source Control AI commit messages. Supported agents: OMP, Claude, Codex, OpenCode, OpenCode 2, Pi, Amp, Cursor, Kimi, Muse, DeepSeek Harness, GitHub Copilot, Antigravity, or Custom command.'
     })
   })
 })
diff --git a/src/renderer/src/lib/source-control-launch-agent-selection.test.ts b/src/shared/source-control-launch-agent-selection.test.ts
similarity index 94%
rename from src/renderer/src/lib/source-control-launch-agent-selection.test.ts
rename to src/shared/source-control-launch-agent-selection.test.ts
index 3ef15b580d9..1862122d871 100644
--- a/src/renderer/src/lib/source-control-launch-agent-selection.test.ts
+++ b/src/shared/source-control-launch-agent-selection.test.ts
@@ -1,8 +1,8 @@
 import { describe, expect, it } from 'vitest'
-import { getDefaultSettings } from '../../../shared/constants'
-import type { GlobalSettings } from '../../../shared/global-settings-types'
-import type { Repo } from '../../../shared/repo-types'
-import type { TuiAgent } from '../../../shared/tui-agent'
+import { getDefaultSettings } from './constants'
+import type { GlobalSettings } from './global-settings-types'
+import type { Repo } from './repo-types'
+import type { TuiAgent } from './tui-agent'
 import {
   resolveSourceControlLaunchAgentScope,
   summarizeReposOverridingActionRecipe
diff --git a/src/renderer/src/lib/source-control-launch-agent-selection.ts b/src/shared/source-control-launch-agent-selection.ts
similarity index 88%
rename from src/renderer/src/lib/source-control-launch-agent-selection.ts
rename to src/shared/source-control-launch-agent-selection.ts
index 379f5640544..4a408b2ffc6 100644
--- a/src/renderer/src/lib/source-control-launch-agent-selection.ts
+++ b/src/shared/source-control-launch-agent-selection.ts
@@ -1,17 +1,13 @@
-import { getAgentCatalog } from '@/lib/agent-catalog'
-import { isCustomAgentId } from '../../../shared/commit-message-agent-spec'
+import { isCustomAgentId } from './commit-message-agent-spec'
 import {
   normalizeRepoSourceControlAiOverrides,
   resolveSourceControlActionRecipe
-} from '../../../shared/source-control-ai'
-import type {
-  SourceControlActionId,
-  SourceControlActionRecipe
-} from '../../../shared/source-control-ai-actions'
-import { filterEnabledTuiAgents } from '../../../shared/tui-agent-selection'
-import type { GlobalSettings } from '../../../shared/global-settings-types'
-import type { Repo } from '../../../shared/repo-types'
-import type { TuiAgent } from '../../../shared/tui-agent'
+} from './source-control-ai'
+import type { SourceControlActionId, SourceControlActionRecipe } from './source-control-ai-actions'
+import { filterEnabledTuiAgents, TUI_AGENT_AUTO_PICK_ORDER } from './tui-agent-selection'
+import type { GlobalSettings } from './global-settings-types'
+import type { Repo } from './repo-types'
+import type { TuiAgent } from './tui-agent'
 
 export function readSourceControlLaunchRecipeAgentId(
   recipe: Pick<SourceControlActionRecipe, 'agentId'> | null | undefined
@@ -37,7 +33,7 @@ export function pickSourceControlLaunchAgent(args: {
   ) {
     return args.defaultAgent
   }
-  return getAgentCatalog().find((entry) => enabledAgents.includes(entry.id))?.id ?? null
+  return TUI_AGENT_AUTO_PICK_ORDER.find((agent) => enabledAgents.includes(agent)) ?? null
 }
 
 export type SourceControlLaunchAgentScope = {
diff --git a/src/shared/source-scan/call-argument-scan.ts b/src/shared/source-scan/call-argument-scan.ts
new file mode 100644
index 00000000000..59a411aa2f0
--- /dev/null
+++ b/src/shared/source-scan/call-argument-scan.ts
@@ -0,0 +1,83 @@
+import { stripComments } from './source-tree-scan'
+
+const CLOSER_BY_OPENER: Record<string, string> = { '(': ')', '[': ']', '{': '}' }
+
+/** Top-level argument texts of the call whose `(` ends at `start`; quote-aware, not a parser. */
+export function splitCallArguments(source: string, start: number): string[] {
+  const args: string[] = []
+  const closers: string[] = [')']
+  let current = ''
+  let quote: string | null = null
+  for (let index = start; index < source.length; index += 1) {
+    const char = source[index]!
+    if (quote) {
+      current += char
+      if (char === '\\') {
+        current += source[index + 1] ?? ''
+        index += 1
+      } else if (char === quote) {
+        quote = null
+      }
+      continue
+    }
+    const closer = CLOSER_BY_OPENER[char]
+    if (char === "'" || char === '"' || char === '`') {
+      quote = char
+    } else if (closer) {
+      closers.push(closer)
+    } else if (char === closers.at(-1)) {
+      closers.pop()
+      if (closers.length === 0) {
+        break
+      }
+    } else if (char === ',' && closers.length === 1) {
+      args.push(current.trim())
+      current = ''
+      continue
+    }
+    current += char
+  }
+  if (current.trim()) {
+    args.push(current.trim())
+  }
+  return args
+}
+
+export type RequiredCallArgument = {
+  /** Which positional argument must be present. */
+  index: number
+  /** The call counts only when the text before `.method(` matches, e.g. its receiver. */
+  receiver?: RegExp
+  /** When the argument is an object literal, whether it carries the required field. */
+  acceptsObjectLiteral?: (literal: string) => boolean
+}
+
+/**
+ * `line: .method(args)` for each call that leaves out a required argument. For code the compiler
+ * cannot check, such as `@ts-nocheck` files and `any`-typed receivers.
+ */
+export function findCallsMissingArgument(
+  source: string,
+  requiredByMethod: Record<string, RequiredCallArgument>
+): string[] {
+  const code = stripComments(source)
+  const callRe = new RegExp(`\\.\\s*(${Object.keys(requiredByMethod).join('|')})\\s*\\(`, 'g')
+  const missing: string[] = []
+  for (const match of code.matchAll(callRe)) {
+    const method = match[1]!
+    const required = requiredByMethod[method]!
+    const before = code.slice(0, match.index)
+    if (required.receiver && !required.receiver.test(before)) {
+      continue
+    }
+    const args = splitCallArguments(code, match.index + match[0].length)
+    const argument = args[required.index]
+    const present =
+      argument !== undefined &&
+      (!argument.startsWith('{') || (required.acceptsObjectLiteral?.(argument) ?? true))
+    if (!present) {
+      missing.push(`${before.split('\n').length}: .${method}(${args.join(', ')})`)
+    }
+  }
+  return missing
+}
diff --git a/src/shared/ssh-pending-pty-kill.test.ts b/src/shared/ssh-pending-pty-kill.test.ts
index 9b13a193a07..c2ba4cb95f1 100644
--- a/src/shared/ssh-pending-pty-kill.test.ts
+++ b/src/shared/ssh-pending-pty-kill.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it } from 'vitest'
 import {
   decideSshPendingPtyKill,
   MAX_SSH_PENDING_PTY_KILLS_PER_TARGET,
+  normalizeSshPendingPtyKill,
   prunePendingSshPtyKills,
   SSH_PENDING_PTY_KILL_TTL_MS,
   type SshPendingPtyKill,
@@ -64,6 +65,26 @@ describe('decideSshPendingPtyKill', () => {
   })
 })
 
+// A close whose incarnation was never learned (the host was offline across a relaunch) still owes
+// the kill: a `pty2:` id carries a per-start mint epoch, so the id alone names one process.
+describe('a pending kill with no incarnation', () => {
+  const unfenced = { requestedAt: NOW, attempts: 0 }
+
+  it('is kept for an epoch-scoped relay id and dropped for a legacy one', () => {
+    expect(normalizeSshPendingPtyKill(unfenced, 'pty2:epoch-a:3')).toEqual(unfenced)
+    expect(normalizeSshPendingPtyKill(unfenced, 'pty-3')).toBeNull()
+  })
+
+  it('replays while the host lists the id and retires once it does not', () => {
+    expect(
+      decideSshPendingPtyKill(unfenced, { hostListsPty: true, hostIncarnationId: 'inc-z' }, NOW)
+    ).toEqual({ action: 'replay' })
+    expect(
+      decideSshPendingPtyKill(unfenced, { hostListsPty: false, hostIncarnationId: undefined }, NOW)
+    ).toEqual({ action: 'retire', reason: 'host-reports-absent' })
+  })
+})
+
 describe('prunePendingSshPtyKills', () => {
   it('drops expired entries and caps the rest newest-first', () => {
     const entries: SshPendingPtyKillEntry[] = [
diff --git a/src/shared/ssh-pending-pty-kill.ts b/src/shared/ssh-pending-pty-kill.ts
index 186ecd65acc..89472aee27f 100644
--- a/src/shared/ssh-pending-pty-kill.ts
+++ b/src/shared/ssh-pending-pty-kill.ts
@@ -12,21 +12,32 @@ import type { SshRemotePtyLease } from './ssh-types'
  *  already the durable, restart-surviving, per-`(targetId, relayPtyId)` record of a remote PTY. */
 export type SshPendingPtyKill = {
   requestedAt: number
-  /** The host-minted PTY incarnation this kill was aimed at, and the whole fence.
+  /** The host-minted PTY incarnation this kill was aimed at, and the fence.
    *
-   *  A relay renumbers from `pty-1` on every start, so `(targetId, relayPtyId)` alone can name a
-   *  DIFFERENT shell after a redeploy — the collision behind #16970. Current relays enforce this
-   *  identity on `pty.shutdown`; the client also proves it from `pty.listProcesses` before replay so
-   *  older relays that ignore the additive field keep the safest available fallback. */
-  incarnationId: string
+   *  A legacy relay renumbers from `pty-1` on every start, so `(targetId, relayPtyId)` alone can
+   *  name a DIFFERENT shell after a redeploy — the collision behind #16970. Current relays enforce
+   *  this identity on `pty.shutdown`; the client also proves it from `pty.listProcesses` before
+   *  replay so older relays that ignore the additive field keep the safest available fallback.
+   *
+   *  Absent only for a `pty2:` id, whose per-start mint epoch makes the id itself the fence. */
+  incarnationId?: string
   /** Replays attempted since. Diagnostic; the TTL, not this, is the bound. */
   attempts: number
 }
 
+/** Whether a relay PTY id names exactly one process: current relays mint `pty2:<epoch>:<n>` with a
+ *  fresh epoch per start, so the id never recurs. Legacy `pty-N` ids restart at 1. */
+export function isEpochScopedRelayPtyId(relayPtyId: string): boolean {
+  return relayPtyId.startsWith('pty2:')
+}
+
 /** Colocated with the type so the two cannot drift. The lease loader is a strict whitelist that
  *  drops anything it does not name, so a record omitted here would be silently stripped on every
  *  launch — the exact failure `closed-terminal-tab-tombstones.ts` records having shipped once. */
-export function normalizeSshPendingPtyKill(value: unknown): SshPendingPtyKill | null {
+export function normalizeSshPendingPtyKill(
+  value: unknown,
+  relayPtyId: string
+): SshPendingPtyKill | null {
   if (!value || typeof value !== 'object') {
     return null
   }
@@ -34,7 +45,11 @@ export function normalizeSshPendingPtyKill(value: unknown): SshPendingPtyKill |
   if (typeof raw.requestedAt !== 'number' || !Number.isFinite(raw.requestedAt)) {
     return null
   }
-  // No incarnation, no fence, and an unfenced kill order is worse than none.
+  const attempts = typeof raw.attempts === 'number' && raw.attempts >= 0 ? raw.attempts : 0
+  if (raw.incarnationId === undefined && isEpochScopedRelayPtyId(relayPtyId)) {
+    return { requestedAt: raw.requestedAt, attempts }
+  }
+  // No fence, and an unfenced kill order is worse than none.
   if (
     typeof raw.incarnationId !== 'string' ||
     !raw.incarnationId ||
@@ -42,11 +57,7 @@ export function normalizeSshPendingPtyKill(value: unknown): SshPendingPtyKill |
   ) {
     return null
   }
-  return {
-    requestedAt: raw.requestedAt,
-    incarnationId: raw.incarnationId,
-    attempts: typeof raw.attempts === 'number' && raw.attempts >= 0 ? raw.attempts : 0
-  }
+  return { requestedAt: raw.requestedAt, incarnationId: raw.incarnationId, attempts }
 }
 
 /** Backstop only — host acknowledgement is the normal exit. This covers a target the user never
@@ -107,6 +118,10 @@ export function decideSshPendingPtyKill(
   if (!observation.hostListsPty) {
     return { action: 'retire', reason: 'host-reports-absent' }
   }
+  if (intent.incarnationId === undefined) {
+    // The id is the fence: only an epoch-scoped id is ever recorded without an incarnation.
+    return { action: 'replay' }
+  }
   if (observation.hostIncarnationId === undefined) {
     // Why not replay: an unfenced kill against a renumbered relay id destroys a shell nobody asked
     // to close, which is strictly worse than the leak. Hosts predating the published incarnation
diff --git a/src/shared/status-bar-defaults.ts b/src/shared/status-bar-defaults.ts
index 73d72a70ab2..c32958ee949 100644
--- a/src/shared/status-bar-defaults.ts
+++ b/src/shared/status-bar-defaults.ts
@@ -9,6 +9,8 @@ export const DEFAULT_STATUS_BAR_ITEMS: StatusBarItem[] = [
   'kimi',
   'minimax',
   'grok',
+  'cursor',
+  'zcode',
   'ssh',
   'resource-usage',
   'ports'
diff --git a/src/shared/storage-capacity-error.ts b/src/shared/storage-capacity-error.ts
new file mode 100644
index 00000000000..63575e7fa1c
--- /dev/null
+++ b/src/shared/storage-capacity-error.ts
@@ -0,0 +1,25 @@
+export function storageCapacityErrorCode(
+  error: unknown,
+  seen = new Set<object>()
+): 'ENOSPC' | 'EDQUOT' | 'SQLITE_FULL' | null {
+  if (typeof error !== 'object' || error === null || seen.has(error)) {
+    return null
+  }
+  seen.add(error)
+  // node:sqlite reports SQLITE_FULL through its numeric SQLite result code.
+  if (
+    'code' in error &&
+    error.code === 'ERR_SQLITE_ERROR' &&
+    'errcode' in error &&
+    error.errcode === 13
+  ) {
+    return 'SQLITE_FULL'
+  }
+  if (
+    'code' in error &&
+    (error.code === 'ENOSPC' || error.code === 'EDQUOT' || error.code === 'SQLITE_FULL')
+  ) {
+    return error.code
+  }
+  return 'cause' in error ? storageCapacityErrorCode(error.cause, seen) : null
+}
diff --git a/src/shared/structured-agent-session-command-entry.ts b/src/shared/structured-agent-session-command-entry.ts
new file mode 100644
index 00000000000..fd76b45d43a
--- /dev/null
+++ b/src/shared/structured-agent-session-command-entry.ts
@@ -0,0 +1,54 @@
+// A conversation command the user sent, such as `/compact`, and the turn it ran as. Neither is a
+// request of the user's to the agent: the sidebar's prompt, preview and verdict, the completion
+// feed and restart resume all read past them to the last real request.
+
+import type {
+  AgentJournalItemBody,
+  AgentJournalRenderItem,
+  AgentJournalTurnLifecycle
+} from './agent-session-journal-types'
+import { readAgentJournalTurn } from './agent-session-turn-record'
+
+export function isStructuredAgentSessionCommandEntry(
+  body: AgentJournalItemBody | null | undefined
+): boolean {
+  return body?.kind === 'message' && body.command !== undefined
+}
+
+/** A turn a command entry opened: the entry its record names carries the command. */
+export function isStructuredAgentSessionCommandTurn(
+  turn: Pick<AgentJournalTurnLifecycle, 'userItemId'> | null | undefined,
+  bodyOf: (itemId: string) => AgentJournalItemBody | null | undefined
+): boolean {
+  return (
+    turn?.userItemId !== undefined && isStructuredAgentSessionCommandEntry(bodyOf(turn.userItemId))
+  )
+}
+
+/** The item ids of every command turn record in `items`, for readers that skip their rows. */
+export function structuredAgentSessionCommandTurnItemIds(
+  items: readonly AgentJournalRenderItem[]
+): ReadonlySet<string> {
+  const bodies = new Map(items.map((item) => [item.itemId, item.body]))
+  const ids = new Set<string>()
+  for (const item of items) {
+    if (
+      isStructuredAgentSessionCommandTurn(readAgentJournalTurn(item.body), (id) => bodies.get(id))
+    ) {
+      ids.add(item.itemId)
+    }
+  }
+  return ids
+}
+
+/** A command entry, or a row its turn produced. */
+export function isStructuredAgentSessionCommandRow(
+  item: Pick<AgentJournalRenderItem, 'body' | 'turnScope'>,
+  commandTurnItemIds: ReadonlySet<string>
+): boolean {
+  const scope = item.turnScope
+  return (
+    isStructuredAgentSessionCommandEntry(item.body) ||
+    (scope?.kind === 'turn' && commandTurnItemIds.has(scope.turnItemId))
+  )
+}
diff --git a/src/shared/structured-agent-session-dispatch-rejection.test.ts b/src/shared/structured-agent-session-dispatch-rejection.test.ts
new file mode 100644
index 00000000000..95f522a765d
--- /dev/null
+++ b/src/shared/structured-agent-session-dispatch-rejection.test.ts
@@ -0,0 +1,142 @@
+import { describe, expect, it } from 'vitest'
+import {
+  AGENT_SESSION_FAILURE_KINDS,
+  agentSessionFailureFact,
+  isSubmissionRejectionKind
+} from './agent-session-failure'
+import { agentSessionFailureWords } from './agent-session-failure-words'
+import {
+  classifyDispatchRejection,
+  DISPATCH_REJECTED_CANCELLED,
+  DISPATCH_REJECTED_CODEX_QUEUE_FULL,
+  DISPATCH_REJECTED_HOST_RESTARTED,
+  DISPATCH_REJECTED_PROVIDER_CLOSED,
+  DISPATCH_REJECTED_QUEUE_FULL,
+  isWriteFailureSubmission
+} from './structured-agent-session-dispatch-rejection'
+
+describe('classifyDispatchRejection', () => {
+  it.each([
+    [DISPATCH_REJECTED_CANCELLED, 'withdrawn', null, 'cancelled'],
+    [DISPATCH_REJECTED_HOST_RESTARTED, 'undelivered', null, 'hostRestarted'],
+    [DISPATCH_REJECTED_PROVIDER_CLOSED, 'undelivered', null, 'chatClosed'],
+    ['not_delivered', 'undelivered', null, 'notDelivered'],
+    [DISPATCH_REJECTED_QUEUE_FULL, 'transport', 'failure', 'queueFull'],
+    [DISPATCH_REJECTED_CODEX_QUEUE_FULL, 'transport', 'failure', 'queueFull'],
+    ['provider_write_failed: broken pipe', 'transport', 'failure', 'writeFailed'],
+    ['provider_write_failed', 'transport', 'failure', 'writeFailed']
+  ] as const)('reads the legacy marker %j', (reason, category, verdict, kind) => {
+    expect(classifyDispatchRejection({ reason })).toEqual({ category, verdict, kind })
+  })
+
+  it('reads any other legacy reason as a sentence that failed the send', () => {
+    expect(classifyDispatchRejection({ reason: 'Claude does not support .bmp' })).toEqual({
+      category: 'content',
+      verdict: 'failure'
+    })
+    expect(classifyDispatchRejection({ reason: null })).toEqual({
+      category: 'content',
+      verdict: 'failure'
+    })
+  })
+
+  it('fails the send for every kind but a withdrawal, a restart, a close, or a lost send', () => {
+    const noOneFailed = ['cancelled', 'hostRestarted', 'chatClosed', 'notDelivered']
+    for (const kind of AGENT_SESSION_FAILURE_KINDS.filter(isSubmissionRejectionKind)) {
+      const verdict = classifyDispatchRejection({ reason: 'x', rejection: { kind } }).verdict
+      expect([kind, verdict]).toEqual([kind, noOneFailed.includes(kind) ? null : 'failure'])
+    }
+  })
+
+  it.each([
+    ['cancelled', 'withdrawn', null],
+    ['hostRestarted', 'undelivered', null],
+    ['chatClosed', 'undelivered', null],
+    ['notDelivered', 'undelivered', null],
+    // Orca stopped a start that hung: the agent failed, and the message never reached it.
+    ['hostStopped', 'undelivered', 'failure'],
+    ['writeFailed', 'transport', 'failure'],
+    ['queueFull', 'transport', 'failure'],
+    // The chat's state refused a queued command when its turn to run came.
+    ['commandRefused', 'content', 'failure']
+  ] as const)('reads the written %s rejection as %s, verdict %s', (kind, category, verdict) => {
+    const written = agentSessionFailureWords(agentSessionFailureFact(kind), {
+      surface: 'rejection',
+      provider: 'claude'
+    })
+    expect(classifyDispatchRejection(written)).toEqual({ category, verdict, kind })
+  })
+
+  it('reads a legacy not_delivered row with no fact as a send nobody failed', () => {
+    expect(classifyDispatchRejection({ reason: 'not_delivered' })).toEqual({
+      category: 'undelivered',
+      verdict: null,
+      kind: 'notDelivered'
+    })
+  })
+
+  it('reads the typed fact over the sentence beside it', () => {
+    expect(
+      classifyDispatchRejection({
+        reason: 'The provider stopped before it finished starting.',
+        rejection: { kind: 'providerStartFailed' }
+      })
+    ).toEqual({ category: 'startFailed', verdict: 'failure', kind: 'providerStartFailed' })
+    expect(
+      classifyDispatchRejection({ reason: 'Not sent.', rejection: { kind: 'queueFull' } })
+    ).toMatchObject({ category: 'transport', verdict: 'failure' })
+  })
+
+  it('writes a sentence, not a marker released clients would print, for a restart or a close', () => {
+    for (const kind of ['hostRestarted', 'chatClosed'] as const) {
+      const written = agentSessionFailureWords(agentSessionFailureFact(kind), {
+        surface: 'rejection'
+      })
+      expect(written.reason).not.toMatch(/^[a-z_]+$/)
+      expect(classifyDispatchRejection(written)).toEqual({
+        category: 'undelivered',
+        verdict: null,
+        kind
+      })
+    }
+  })
+
+  it('gives a fact it cannot place no verdict, whatever the reason beside it says', () => {
+    // A newer host's kind, a status-row kind, and a fact with no kind at all.
+    for (const rejection of [{ kind: 'futureKind' }, { kind: 'providerRetrying' }, {}]) {
+      for (const reason of [
+        DISPATCH_REJECTED_QUEUE_FULL,
+        DISPATCH_REJECTED_CANCELLED,
+        'Refused.'
+      ]) {
+        expect(classifyDispatchRejection({ reason, rejection })).toEqual({
+          category: 'undelivered',
+          verdict: null
+        })
+      }
+    }
+  })
+})
+
+describe('isWriteFailureSubmission', () => {
+  it('holds for a legacy row in any state that carries the marker', () => {
+    expect(
+      isWriteFailureSubmission({ reason: 'provider_write_failed: closed before enqueue' })
+    ).toBe(true)
+  })
+
+  it('holds for the bare marker a new host writes, as released clients already read it', () => {
+    const written = agentSessionFailureWords(agentSessionFailureFact('writeFailed'), {
+      surface: 'rejection'
+    })
+    expect(written.reason).toBe('provider_write_failed')
+    expect(isWriteFailureSubmission({ reason: written.reason })).toBe(true)
+  })
+
+  it('holds for a typed write failure and for nothing else', () => {
+    expect(isWriteFailureSubmission({ reason: 'x', rejection: { kind: 'writeFailed' } })).toBe(true)
+    expect(isWriteFailureSubmission({ reason: DISPATCH_REJECTED_QUEUE_FULL })).toBe(false)
+    expect(isWriteFailureSubmission({ reason: 'x', rejection: { kind: 'queueFull' } })).toBe(false)
+    expect(isWriteFailureSubmission({ reason: null })).toBe(false)
+  })
+})
diff --git a/src/shared/structured-agent-session-dispatch-rejection.ts b/src/shared/structured-agent-session-dispatch-rejection.ts
index 14e197325d8..57b8e745ca5 100644
--- a/src/shared/structured-agent-session-dispatch-rejection.ts
+++ b/src/shared/structured-agent-session-dispatch-rejection.ts
@@ -1,23 +1,23 @@
 // Why a submission is `rejected`: the message provably did not happen.
 //
-// Two different facts reach this state, and the reason string is what tells them
-// apart. A CONTENT rejection is permanent — the provider looked at this payload
-// and refused it, and it would refuse the same payload again; its reason is the
-// provider's own explanation ("Claude messages support at most 20 images") and is
-// meant to be read. A TRANSPORT rejection is transient — the frame was never
-// handed to the provider at all, so the same text under a fresh id is a first
-// delivery and the next attempt may well succeed; its reason names an internal
-// cause and must NOT be put in front of a person.
+// The host writes each rejection twice: `reason`, a sentence (or, for the cases older clients
+// already recognise, one of the legacy markers below) that released clients print as it is, and
+// `rejection`, the typed fact newer clients read — both from `agentSessionFailureWords`.
+// `classifyDispatchRejection` is the only place a reader judges either.
 //
-// Both are `rejected` because both make the single claim that state exists to
-// make: this message did not reach the provider. Neither is ever re-delivered
-// under its own id — `rejected` is terminal in the reducer — so a retry rotates
-// the client message id, which is a new message and cannot duplicate.
-//
-// Shared rather than main-only because both sides need it: the host writes the
-// reason, and a client has to know which kind it is holding before it can decide
-// whether the string is showable.
+// Every rejection makes the one claim that state exists to make: this message did not reach the
+// provider. None is ever re-delivered under its own id — `rejected` is terminal in the reducer — so
+// a retry rotates the client message id, which is a new message and cannot duplicate.
 
+import {
+  isSubmissionRejectionKind,
+  readAgentSessionFailureFact,
+  type SubmissionRejectionKind
+} from './agent-session-failure'
+import type { AgentJournalSubmission } from './agent-session-journal-types'
+
+/** Orca could not hand the message over. Written bare: released clients hide it, and the error
+ *  that once followed it belongs in the log. Rows from older hosts carry `: <error>` after it. */
 export const DISPATCH_REJECTED_WRITE_FAILED = 'provider_write_failed'
 
 /** Local admission refused the frame before any transport was involved. Two
@@ -29,15 +29,21 @@ export const DISPATCH_REJECTED_CODEX_QUEUE_FULL = 'codex structured dispatch que
 /** The provider confirmed a queued frame was withdrawn before execution. */
 export const DISPATCH_REJECTED_CANCELLED = 'provider_cancelled_before_start'
 
-export function dispatchWriteFailureReason(error: unknown): string {
-  const detail = error instanceof Error ? error.message : String(error)
-  return `${DISPATCH_REJECTED_WRITE_FAILED}: ${detail}`
-}
+/** Legacy marker: accepted by a host process that ended before handing it to any provider.
+ *  Read only; released clients print it raw, so new rows carry a sentence. */
+export const DISPATCH_REJECTED_HOST_RESTARTED = 'host_restarted_before_delivery'
 
-/** True for the internal transport marker, false for a provider's own words. */
-export function dispatchRejectionWasTransportWriteFailure(
-  reason: string | null | undefined
-): boolean {
+/** Legacy marker: accepted, then the provider was closed before the message was handed to it.
+ *  Read only, like the one above. */
+export const DISPATCH_REJECTED_PROVIDER_CLOSED = 'provider_closed_before_delivery'
+
+/** Restart reconciliation found the send absent from a provider history it could trust. Rows
+ *  written before rows carried a fact hold it as their reason; released clients printed it. */
+export const DISPATCH_REJECTED_NOT_DELIVERED = 'not_delivered'
+
+/** True for the internal transport marker, false for a provider's own words. Legacy-reason half
+ *  of `isWriteFailureSubmission`; readers go through that or the classifier. */
+function dispatchRejectionWasTransportWriteFailure(reason: string | null | undefined): boolean {
   return (
     reason === DISPATCH_REJECTED_WRITE_FAILED ||
     reason?.startsWith(`${DISPATCH_REJECTED_WRITE_FAILED}: `) === true
@@ -45,15 +51,140 @@ export function dispatchRejectionWasTransportWriteFailure(
 }
 
 /**
- * True when the reason is ours rather than the provider's, so it must not be
- * shown verbatim. A content rejection carries the provider's own explanation and
- * is the only kind a person should read.
+ * What a rejection means for the chat, whatever wrote it:
+ * - `withdrawn`: the user's Stop took it back; nothing failed.
+ * - `undelivered`: accepted, then never handed over (Orca restarted, the chat closed, the provider
+ *   never took it or stopped first).
+ * - `startFailed`: the agent it waited on did not start.
+ * - `content`: the provider, or Orca's check of the message, refused this payload.
+ * - `transport`: Orca could not hand it over.
  */
-export function dispatchRejectionReasonIsInternal(reason: string | null | undefined): boolean {
+export type DispatchRejectionCategory =
+  | 'withdrawn'
+  | 'undelivered'
+  | 'startFailed'
+  | 'content'
+  | 'transport'
+
+export type DispatchRejectionClassification = {
+  category: DispatchRejectionCategory
+  /** `failure` when the chat reads Failed; null only when no one failed the user: a withdrawal, a
+   *  host restart, a chat close, or a send the provider never received after a restart. */
+  verdict: 'failure' | null
+  /** The situation, when the row carried one or a legacy marker names it; absent for a legacy
+   *  sentence, whose words are all a reader has, and for a fact this build cannot place. */
+  kind?: SubmissionRejectionKind
+}
+
+const KIND_CATEGORY = {
+  cancelled: 'withdrawn',
+  hostRestarted: 'undelivered',
+  chatClosed: 'undelivered',
+  notDelivered: 'undelivered',
+  providerExited: 'undelivered',
+  hostStopped: 'undelivered',
+  providerStartFailed: 'startFailed',
+  startFailed: 'startFailed',
+  notSignedIn: 'startFailed',
+  historyTooLarge: 'startFailed',
+  managedAccountEnvOverride: 'startFailed',
+  accountSwitchInProgress: 'startFailed',
+  managedAccountUnsupported: 'startFailed',
+  restartFailed: 'startFailed',
+  providerRejected: 'content',
+  attachmentInvalid: 'content',
+  attachmentUnreadable: 'content',
+  emptyMessage: 'content',
+  commandRefused: 'content',
+  queueFull: 'transport',
+  writeFailed: 'transport',
+  hostFault: 'transport'
+} satisfies Record<SubmissionRejectionKind, DispatchRejectionCategory>
+
+/** Null only where no one failed the user; a new kind does not compile until it is placed here. */
+const KIND_VERDICT = {
+  cancelled: null,
+  hostRestarted: null,
+  chatClosed: null,
+  notDelivered: null,
+  providerExited: 'failure',
+  providerStartFailed: 'failure',
+  startFailed: 'failure',
+  notSignedIn: 'failure',
+  historyTooLarge: 'failure',
+  managedAccountEnvOverride: 'failure',
+  accountSwitchInProgress: 'failure',
+  managedAccountUnsupported: 'failure',
+  restartFailed: 'failure',
+  providerRejected: 'failure',
+  attachmentInvalid: 'failure',
+  attachmentUnreadable: 'failure',
+  emptyMessage: 'failure',
+  commandRefused: 'failure',
+  queueFull: 'failure',
+  writeFailed: 'failure',
+  hostFault: 'failure',
+  // Orca stopped a start that hung: the agent failed.
+  hostStopped: 'failure'
+} satisfies Record<SubmissionRejectionKind, 'failure' | null>
+
+/** The legacy markers, by the kind each stands for. */
+const LEGACY_MARKER_KINDS: ReadonlyMap<string, SubmissionRejectionKind> = new Map([
+  [DISPATCH_REJECTED_CANCELLED, 'cancelled'],
+  [DISPATCH_REJECTED_HOST_RESTARTED, 'hostRestarted'],
+  [DISPATCH_REJECTED_PROVIDER_CLOSED, 'chatClosed'],
+  [DISPATCH_REJECTED_QUEUE_FULL, 'queueFull'],
+  [DISPATCH_REJECTED_CODEX_QUEUE_FULL, 'queueFull'],
+  [DISPATCH_REJECTED_NOT_DELIVERED, 'notDelivered']
+])
+
+/** The kind a legacy marker stands for; undefined for any other reason, which is a sentence. */
+function legacyMarkerKind(reason: string | null): SubmissionRejectionKind | undefined {
+  if (dispatchRejectionWasTransportWriteFailure(reason)) {
+    return 'writeFailed'
+  }
+  return reason === null ? undefined : LEGACY_MARKER_KINDS.get(reason)
+}
+
+/**
+ * The one reader of why a submission was rejected. The typed fact decides when the row carries
+ * one; a fact this build cannot place says only that the message was not sent. A row with no
+ * fact, from an older host, is read by its legacy marker, and any other reason is a sentence — a
+ * provider's, or Orca's before rows were typed — which reads as a content failure.
+ */
+export function classifyDispatchRejection(
+  submission: Pick<AgentJournalSubmission, 'reason'> & { rejection?: unknown }
+): DispatchRejectionClassification {
+  const { rejection } = submission
+  const factKind = readAgentSessionFailureFact(rejection)?.kind
+  if (typeof rejection === 'object' && rejection !== null && !isSubmissionRejectionKind(factKind)) {
+    // Undelivered, not content: all a fact this build can't place proves is the message didn't happen.
+    return { category: 'undelivered', verdict: null }
+  }
+  const kind = isSubmissionRejectionKind(factKind) ? factKind : legacyMarkerKind(submission.reason)
+  if (!kind) {
+    return { category: 'content', verdict: 'failure' }
+  }
+  return { category: KIND_CATEGORY[kind], verdict: KIND_VERDICT[kind], kind }
+}
+
+/** A Stop withdrew it before it ran: it will not land, and only its sender can send it again. */
+export function dispatchWasWithdrawn(
+  submission: Pick<AgentJournalSubmission, 'dispatchState' | 'reason' | 'rejection'> | undefined
+): boolean {
   return (
-    dispatchRejectionWasTransportWriteFailure(reason) ||
-    reason === DISPATCH_REJECTED_QUEUE_FULL ||
-    reason === DISPATCH_REJECTED_CODEX_QUEUE_FULL ||
-    reason === DISPATCH_REJECTED_CANCELLED
+    submission?.dispatchState === 'rejected' &&
+    classifyDispatchRejection(submission).category === 'withdrawn'
+  )
+}
+
+/** A submission that says Orca never handed it over, in any dispatch state: journals written
+ *  before this state moved hold it as `unknown` carrying the marker. */
+export function isWriteFailureSubmission(
+  submission: Pick<AgentJournalSubmission, 'reason' | 'rejection'>
+): boolean {
+  return (
+    readAgentSessionFailureFact(submission.rejection)?.kind === 'writeFailed' ||
+    dispatchRejectionWasTransportWriteFailure(submission.reason)
   )
 }
diff --git a/src/shared/structured-agent-session-latest-request.test.ts b/src/shared/structured-agent-session-latest-request.test.ts
new file mode 100644
index 00000000000..6bb7f117bf8
--- /dev/null
+++ b/src/shared/structured-agent-session-latest-request.test.ts
@@ -0,0 +1,321 @@
+import { describe, expect, it } from 'vitest'
+import type {
+  AgentJournalRenderItem,
+  AgentJournalSubmission,
+  AgentJournalTurnLifecycle
+} from './agent-session-journal-types'
+import { AGENT_SESSION_FAILURE_KINDS, isSubmissionRejectionKind } from './agent-session-failure'
+import { agentJournalSubmissionKey } from './agent-session-journal-item-key'
+import {
+  classifyDispatchRejection,
+  DISPATCH_REJECTED_CANCELLED,
+  DISPATCH_REJECTED_CODEX_QUEUE_FULL,
+  DISPATCH_REJECTED_HOST_RESTARTED,
+  DISPATCH_REJECTED_NOT_DELIVERED,
+  DISPATCH_REJECTED_PROVIDER_CLOSED,
+  DISPATCH_REJECTED_QUEUE_FULL,
+  DISPATCH_REJECTED_WRITE_FAILED
+} from './structured-agent-session-dispatch-rejection'
+import {
+  hasStructuredAgentSessionRequest,
+  latestStructuredAgentSessionRequest
+} from './structured-agent-session-latest-request'
+import { projectStructuredAgentSessionStatusSummary } from './structured-agent-session-projection'
+
+const START_FAILURE = 'Claude is not signed in.'
+
+/** `intoTurn` names the turn the message's handover delivered it into — a steer. */
+function userEntry(
+  clientMessageId: string,
+  sequence: number,
+  intoTurn?: string
+): AgentJournalRenderItem {
+  return {
+    itemId: agentJournalSubmissionKey(clientMessageId),
+    revision: 0,
+    sequence,
+    observedAt: sequence,
+    body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: clientMessageId }] },
+    turnScope: intoTurn
+      ? { kind: 'turn', turnItemId: `codex:turn:${intoTurn}` }
+      : { kind: 'thread' }
+  }
+}
+
+function turn(
+  turnId: string,
+  sequence: number,
+  fields: Omit<AgentJournalTurnLifecycle, 'turnId'>
+): AgentJournalRenderItem {
+  return {
+    itemId: `codex:turn:${turnId}`,
+    revision: 1,
+    sequence,
+    observedAt: sequence,
+    body: { kind: 'turn', turnId, ...fields }
+  }
+}
+
+function sent(
+  clientMessageId: string,
+  fields: Partial<AgentJournalSubmission> & Pick<AgentJournalSubmission, 'dispatchState'>
+): AgentJournalSubmission {
+  return {
+    clientMessageId,
+    fence: 1,
+    payloadFingerprint: clientMessageId,
+    providerItemId: null,
+    reason: null,
+    submittedAt: 10,
+    resolvedAt: 20,
+    handoverRecorded: true,
+    ...fields
+  }
+}
+
+const rejected = (clientMessageId: string, reason: string, handedOverAt?: number) =>
+  sent(clientMessageId, {
+    dispatchState: 'rejected',
+    reason,
+    ...(handedOverAt !== undefined ? { handedOverAt } : {})
+  })
+
+type Row = {
+  name: string
+  items: AgentJournalRenderItem[]
+  submissions: AgentJournalSubmission[]
+  fence?: number
+  outcome: 'success' | 'failure' | 'cancellation' | null
+  listed: boolean
+}
+
+const ROWS: Row[] = [
+  {
+    name: 'a send the agent start refused',
+    items: [userEntry('m1', 1)],
+    submissions: [rejected('m1', START_FAILURE)],
+    outcome: 'failure',
+    listed: true
+  },
+  {
+    name: 'a send the user withdrew (no verdict)',
+    items: [userEntry('m1', 1)],
+    submissions: [rejected('m1', DISPATCH_REJECTED_CANCELLED)],
+    outcome: null,
+    listed: false
+  },
+  {
+    name: 'a send still queued when the host restarted (no verdict)',
+    items: [userEntry('m1', 1)],
+    submissions: [rejected('m1', DISPATCH_REJECTED_HOST_RESTARTED)],
+    outcome: null,
+    listed: false
+  },
+  {
+    name: 'a send still queued when the provider closed (no verdict)',
+    items: [userEntry('m1', 1)],
+    submissions: [rejected('m1', DISPATCH_REJECTED_PROVIDER_CLOSED)],
+    outcome: null,
+    listed: false
+  },
+  {
+    name: 'a send crash recovery found the provider never received (no verdict)',
+    items: [userEntry('m1', 1)],
+    submissions: [
+      sent('m1', {
+        dispatchState: 'rejected',
+        reason: DISPATCH_REJECTED_NOT_DELIVERED,
+        recovered: true
+      })
+    ],
+    outcome: null,
+    listed: false
+  },
+  {
+    name: 'a turn that succeeded, then a send crash recovery found the provider never received',
+    items: [
+      userEntry('m1', 1),
+      turn('t1', 2, { state: 'completed', outcome: 'success', completedAt: 15 }),
+      userEntry('m2', 3)
+    ],
+    submissions: [
+      sent('m1', { dispatchState: 'accepted' }),
+      sent('m2', {
+        dispatchState: 'rejected',
+        reason: DISPATCH_REJECTED_NOT_DELIVERED,
+        recovered: true
+      })
+    ],
+    outcome: 'success',
+    listed: true
+  },
+  {
+    name: 'a send crash recovery left unknown',
+    items: [userEntry('m1', 1)],
+    submissions: [sent('m1', { dispatchState: 'unknown', recovered: true })],
+    outcome: null,
+    listed: false
+  },
+  {
+    name: 'a send pending at an older fence',
+    items: [userEntry('m1', 1)],
+    submissions: [sent('m1', { dispatchState: 'pending', handedOverAt: 11, resolvedAt: null })],
+    fence: 2,
+    outcome: null,
+    listed: false
+  },
+  {
+    name: 'a turn that succeeded, then a send the start refused',
+    items: [
+      userEntry('m1', 1),
+      turn('t1', 2, { state: 'completed', outcome: 'success', completedAt: 15 }),
+      userEntry('m2', 3)
+    ],
+    submissions: [sent('m1', { dispatchState: 'accepted' }), rejected('m2', START_FAILURE)],
+    outcome: 'failure',
+    listed: true
+  },
+  {
+    name: 'a refused send, then a turn that succeeded',
+    items: [
+      userEntry('m1', 1),
+      userEntry('m2', 2),
+      turn('t2', 3, { state: 'completed', outcome: 'success', completedAt: 40 })
+    ],
+    submissions: [rejected('m1', START_FAILURE), sent('m2', { dispatchState: 'accepted' })],
+    outcome: 'success',
+    listed: true
+  },
+  {
+    name: 'a steer the provider refused inside a turn that then succeeded',
+    items: [
+      userEntry('m1', 1),
+      turn('t1', 2, { state: 'completed', outcome: 'success', completedAt: 50 }),
+      userEntry('steer', 3, 't1')
+    ],
+    submissions: [
+      sent('m1', { dispatchState: 'accepted' }),
+      rejected('steer', 'no active turn to steer', 30)
+    ],
+    outcome: 'success',
+    listed: true
+  },
+  {
+    name: 'a user message the provider journaled itself (history, an older host)',
+    items: [
+      {
+        itemId: 'codex:thread-1:turn-1:0',
+        revision: 0,
+        sequence: 1,
+        observedAt: 1,
+        body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'from history' }] }
+      }
+    ],
+    submissions: [],
+    outcome: null,
+    listed: true
+  },
+  {
+    name: 'a goal and nothing else yet',
+    items: [
+      {
+        itemId: 'codex:goal-entry',
+        revision: 0,
+        sequence: 1,
+        observedAt: 1,
+        body: {
+          kind: 'message',
+          role: 'user',
+          sentAs: 'goal',
+          blocks: [{ type: 'text', text: 'ship it' }]
+        }
+      }
+    ],
+    submissions: [],
+    outcome: null,
+    listed: true
+  }
+]
+
+describe('the latest request and its verdict', () => {
+  it.each(ROWS)('$name', ({ items, submissions, fence, outcome, listed }) => {
+    expect(latestStructuredAgentSessionRequest(items, submissions)?.outcome ?? null).toBe(outcome)
+    const summary = projectStructuredAgentSessionStatusSummary(items, submissions, fence)
+    expect(summary.status !== null).toBe(listed)
+    if (listed && summary.status === 'idle') {
+      expect(summary.turnOutcome ?? null).toBe(outcome)
+    }
+  })
+
+  it('dates an idle session by the refusal it reports, not by the older turn', () => {
+    const items = [
+      userEntry('m1', 1),
+      turn('t1', 2, { state: 'completed', outcome: 'success', completedAt: 15 }),
+      userEntry('m2', 3)
+    ]
+    const submissions = [sent('m1', { dispatchState: 'accepted' }), rejected('m2', START_FAILURE)]
+    expect(projectStructuredAgentSessionStatusSummary(items, submissions)).toMatchObject({
+      status: 'idle',
+      turnOutcome: 'failure',
+      statusStartedAt: 20
+    })
+  })
+})
+
+describe('the sidebar verdict agrees with the rejection classifier', () => {
+  // A sentence as the reason, so only the typed fact can make a kind read as no verdict.
+  const typed = AGENT_SESSION_FAILURE_KINDS.filter(isSubmissionRejectionKind).map((kind) => ({
+    name: `typed ${kind}`,
+    submission: sent('m1', {
+      dispatchState: 'rejected',
+      reason: 'The message was not sent.',
+      rejection: { kind }
+    })
+  }))
+  const legacy = [
+    DISPATCH_REJECTED_CANCELLED,
+    DISPATCH_REJECTED_QUEUE_FULL,
+    DISPATCH_REJECTED_CODEX_QUEUE_FULL,
+    DISPATCH_REJECTED_HOST_RESTARTED,
+    DISPATCH_REJECTED_PROVIDER_CLOSED,
+    DISPATCH_REJECTED_NOT_DELIVERED,
+    DISPATCH_REJECTED_WRITE_FAILED,
+    `${DISPATCH_REJECTED_WRITE_FAILED}: broken pipe`
+  ].map((reason) => ({ name: `legacy ${reason}`, submission: rejected('m1', reason) }))
+  const unknownKind = {
+    name: 'a kind this build cannot place',
+    submission: sent('m1', {
+      dispatchState: 'rejected',
+      reason: 'A newer host wrote this.',
+      rejection: { kind: 'someFutureKind' }
+    })
+  }
+
+  it.each([...typed, ...legacy, unknownKind])('$name', ({ submission }) => {
+    const items = [userEntry('m1', 1)]
+    const { verdict } = classifyDispatchRejection(submission)
+    expect(latestStructuredAgentSessionRequest(items, [submission])?.outcome ?? null).toBe(verdict)
+    expect(hasStructuredAgentSessionRequest(items, [submission])).toBe(verdict === 'failure')
+  })
+
+  const failedNobody = new Set([
+    'typed notDelivered',
+    'typed cancelled',
+    'typed hostRestarted',
+    'typed chatClosed',
+    `legacy ${DISPATCH_REJECTED_NOT_DELIVERED}`,
+    `legacy ${DISPATCH_REJECTED_CANCELLED}`,
+    `legacy ${DISPATCH_REJECTED_HOST_RESTARTED}`,
+    `legacy ${DISPATCH_REJECTED_PROVIDER_CLOSED}`
+  ])
+  const failedNobodyCases = [...typed, ...legacy].filter(({ name }) => failedNobody.has(name))
+  it('covers every send that failed nobody', () => {
+    expect(failedNobodyCases).toHaveLength(failedNobody.size)
+  })
+  it.each(failedNobodyCases)(
+    'gives no verdict for a send that failed nobody: $name',
+    ({ submission }) => {
+      expect(latestStructuredAgentSessionRequest([userEntry('m1', 1)], [submission])).toBeNull()
+    }
+  )
+})
diff --git a/src/shared/structured-agent-session-latest-request.ts b/src/shared/structured-agent-session-latest-request.ts
new file mode 100644
index 00000000000..c6742e8408b
--- /dev/null
+++ b/src/shared/structured-agent-session-latest-request.ts
@@ -0,0 +1,196 @@
+// The session's latest request and what became of it: the verdict a sidebar row reports once
+// the session is idle, whether there is a request to list at all, and the prompt and answer its row
+// quotes.
+//
+// A request is either a turn, whose record carries the provider's verdict, or a send that never
+// became one because the agent or its start refused it. A send its handover placed inside a
+// running turn (a steer) is not a request of its own: the turn it joined answers for it. Nor is a
+// conversation command.
+
+import type {
+  AgentJournalRenderItem,
+  AgentJournalSubmission,
+  AgentJournalTurnLifecycle,
+  AgentJournalTurnOutcome
+} from './agent-session-journal-types'
+import { agentJournalSubmissionKey } from './agent-session-journal-item-key'
+import { isRootAgentJournalItem } from './agent-session-journal-producer'
+import { readAgentJournalTurn, readAgentJournalTurnOutcome } from './agent-session-turn-record'
+import { classifyDispatchRejection } from './structured-agent-session-dispatch-rejection'
+import { isUnansweredStructuredAgentSessionDispatch } from './structured-agent-session-unanswered-dispatch'
+import {
+  isStructuredAgentSessionCommandEntry,
+  isStructuredAgentSessionCommandRow,
+  structuredAgentSessionCommandTurnItemIds
+} from './structured-agent-session-command-entry'
+import type { NativeChatBlock } from './native-chat-types'
+
+export type StructuredAgentSessionLatestRequest = {
+  kind: 'turn' | 'refused-send'
+  /** The turn's id, or the refused send's journal item key. Unique only within its kind. */
+  id: string
+  running: boolean
+  /** Null while the turn runs, and for a turn whose end carried no verdict. */
+  outcome: AgentJournalTurnOutcome | null
+  /** When it settled: the turn's end, or the refusal. Undefined while it runs. */
+  settledAt: number | undefined
+}
+
+/** Null when the journal holds no request with a verdict to give. Accepted and unanswered sends
+ *  are passed over — the session is working until their turn records — and so are sends that
+ *  failed nobody (withdrawn, or left undelivered by a restart or a close). */
+export function latestStructuredAgentSessionRequest(
+  items: readonly AgentJournalRenderItem[],
+  submissions: readonly AgentJournalSubmission[]
+): StructuredAgentSessionLatestRequest | null {
+  const rejected = rejectedSubmissionsByItem(submissions)
+  const commandTurns = structuredAgentSessionCommandTurnItemIds(items)
+  for (let index = items.length - 1; index >= 0; index -= 1) {
+    const item = items[index]
+    // A conversation command is not a request: the verdict stays the last real request's.
+    if (
+      !item ||
+      !isRootAgentJournalItem(item) ||
+      commandTurns.has(item.itemId) ||
+      isStructuredAgentSessionCommandEntry(item.body)
+    ) {
+      continue
+    }
+    const turn = readAgentJournalTurn(item.body)
+    if (turn) {
+      const running = turn.state === 'running'
+      return {
+        kind: 'turn',
+        id: turn.turnId,
+        running,
+        outcome: readAgentJournalTurnOutcome(turn),
+        settledAt: running ? undefined : turnEndedAt(item, turn)
+      }
+    }
+    const submission = rejected.get(item.itemId)
+    if (
+      submission &&
+      classifyDispatchRejection(submission).verdict === 'failure' &&
+      // Handed into a running turn (a steer): that turn answers for it.
+      item.turnScope?.kind !== 'turn'
+    ) {
+      return {
+        kind: 'refused-send',
+        id: item.itemId,
+        running: false,
+        outcome: 'failure',
+        settledAt: submission.resolvedAt ?? undefined
+      }
+    }
+  }
+  return null
+}
+
+/** Whether the session has a request to list. A send that failed nobody and never became a turn
+ *  leaves nothing to report, so a session holding only those is not listed; a user message the
+ *  provider journaled itself (history, an older host) still is. Deliberately NOT scoped by
+ *  producer: a session whose only content came from a subagent still has content. */
+export function hasStructuredAgentSessionRequest(
+  items: readonly AgentJournalRenderItem[],
+  submissions: readonly AgentJournalSubmission[],
+  currentFence?: number | null
+): boolean {
+  const sent = new Set(
+    submissions.map((submission) => agentJournalSubmissionKey(submission.clientMessageId))
+  )
+  return (
+    items.some(
+      (item) =>
+        readAgentJournalTurn(item.body) !== null ||
+        (item.body.kind === 'message' &&
+          (item.body.role === 'assistant' || (item.body.role === 'user' && !sent.has(item.itemId))))
+    ) ||
+    submissions.some(
+      (submission) =>
+        submission.dispatchState === 'accepted' ||
+        isUnansweredStructuredAgentSessionDispatch(submission, currentFence) ||
+        (submission.dispatchState === 'rejected' &&
+          classifyDispatchRejection(submission).verdict === 'failure')
+    )
+  )
+}
+
+function rejectedSubmissionsByItem(
+  submissions: readonly AgentJournalSubmission[]
+): Map<string, AgentJournalSubmission> {
+  const rejected = new Map<string, AgentJournalSubmission>()
+  for (const submission of submissions) {
+    if (submission.dispatchState === 'rejected') {
+      rejected.set(agentJournalSubmissionKey(submission.clientMessageId), submission)
+    }
+  }
+  return rejected
+}
+
+/** A turn recovery settled ended when that settle was written: when the user learns it stopped. */
+function turnEndedAt(
+  item: AgentJournalRenderItem,
+  turn: AgentJournalTurnLifecycle
+): number | undefined {
+  return item.recoveredAt ?? turn.completedAt
+}
+
+function messageProse(blocks: readonly NativeChatBlock[]): string {
+  return blocks.flatMap((block) => (block.type === 'text' ? [block.text] : [])).join('\n')
+}
+
+/** The newest prompt the session's own user turn carries, as the sidebar quotes
+ *  it. Scoped to root rows for the same reason the assistant line is: a provider
+ *  that journals a subagent's own prompt would otherwise requote it as the
+ *  session's. */
+export function latestStructuredAgentSessionPrompt(
+  items: readonly AgentJournalRenderItem[]
+): string {
+  const body = latestStructuredAgentSessionUserItem(items)?.body
+  return body?.kind === 'message' ? messageProse(body.blocks) : ''
+}
+
+export function latestStructuredAgentSessionUserItem(
+  items: readonly AgentJournalRenderItem[]
+): AgentJournalRenderItem | null {
+  for (let index = items.length - 1; index >= 0; index -= 1) {
+    const item = items[index]
+    if (
+      item?.body.kind === 'message' &&
+      item.body.role === 'user' &&
+      isRootAgentJournalItem(item) &&
+      !isStructuredAgentSessionCommandEntry(item.body)
+    ) {
+      return item
+    }
+  }
+  return null
+}
+
+/** The newest prose THE SESSION'S OWN AGENT wrote in the latest user turn — not a
+ *  subagent's, whose rows share this journal and are usually the newer ones while
+ *  a child runs. Tool-only assistant items are skipped; the user boundary clears
+ *  prose from the preceding turn. */
+export function latestStructuredAgentSessionAssistantMessage(
+  items: readonly AgentJournalRenderItem[]
+): string {
+  const commandTurns = structuredAgentSessionCommandTurnItemIds(items)
+  for (let index = items.length - 1; index >= 0; index -= 1) {
+    const item = items[index]
+    const body = item?.body
+    // A command and what its turn produced are not the conversation's latest answer.
+    if (!isRootAgentJournalItem(item) || isStructuredAgentSessionCommandRow(item, commandTurns)) {
+      continue
+    }
+    if (body?.kind === 'message' && body.role === 'user') {
+      return ''
+    }
+    if (body?.kind === 'message' && body.role === 'assistant') {
+      const prose = messageProse(body.blocks)
+      if (prose.trim()) {
+        return prose
+      }
+    }
+  }
+  return ''
+}
diff --git a/src/shared/structured-agent-session-live-turn.ts b/src/shared/structured-agent-session-live-turn.ts
index 2f5a0747667..d4cba70f616 100644
--- a/src/shared/structured-agent-session-live-turn.ts
+++ b/src/shared/structured-agent-session-live-turn.ts
@@ -17,9 +17,11 @@
 // (none). So a child-linked row can never be what terminates one of these
 // scans. Re-check that before giving any of those sites a producer.
 
-import type {
-  AgentJournalRenderItem,
-  AgentJournalTurnLifecycle
+import {
+  AGENT_JOURNAL_THREAD_SCOPE,
+  type AgentJournalRenderItem,
+  type AgentJournalTurnLifecycle,
+  type AgentJournalTurnScope
 } from './agent-session-journal-types'
 import { isRootAgentJournalItem } from './agent-session-journal-producer'
 import { readAgentJournalTurn } from './agent-session-turn-record'
@@ -64,6 +66,22 @@ export function newestStructuredAgentSessionTurnBySequence(
   return newest
 }
 
+/** The scope a row written now joins: the running turn, or the conversation when none runs.
+ *  By sequence, for items held unordered. */
+export function liveStructuredAgentSessionTurnScope(
+  items: Iterable<AgentJournalRenderItem>
+): AgentJournalTurnScope {
+  let newest: AgentJournalRenderItem | null = null
+  for (const item of items) {
+    if ((newest === null || item.sequence >= newest.sequence) && readAgentJournalTurn(item.body)) {
+      newest = item
+    }
+  }
+  return newest && readAgentJournalTurn(newest.body)?.state === 'running'
+    ? { kind: 'turn', turnItemId: newest.itemId }
+    : AGENT_JOURNAL_THREAD_SCOPE
+}
+
 /** Whether that newest turn is still running, which is all most callers want. */
 export function activeStructuredAgentSessionTurnIdBySequence(
   items: Iterable<AgentJournalRenderItem>
diff --git a/src/shared/structured-agent-session-main-agent-working.ts b/src/shared/structured-agent-session-main-agent-working.ts
new file mode 100644
index 00000000000..05e3b775aaa
--- /dev/null
+++ b/src/shared/structured-agent-session-main-agent-working.ts
@@ -0,0 +1,14 @@
+import type { AgentJournalSubmission } from './agent-session-journal-types'
+import { hasUnansweredStructuredAgentSessionDispatch } from './structured-agent-session-unanswered-dispatch'
+
+/** Whether the session's own agent is working: a running turn, or a send it has not answered.
+ *  The one rule behind every session list's Working and the chat's own Stop. */
+export function isStructuredAgentSessionMainAgentWorking(
+  activeTurnId: string | null,
+  submissions: readonly AgentJournalSubmission[],
+  currentFence?: number | null
+): boolean {
+  return (
+    activeTurnId !== null || hasUnansweredStructuredAgentSessionDispatch(submissions, currentFence)
+  )
+}
diff --git a/src/shared/structured-agent-session-message-projection.ts b/src/shared/structured-agent-session-message-projection.ts
index 6219538fbec..da8017a2d50 100644
--- a/src/shared/structured-agent-session-message-projection.ts
+++ b/src/shared/structured-agent-session-message-projection.ts
@@ -1,5 +1,7 @@
 import type { AgentJournalRenderItem, AgentJournalSubmission } from './agent-session-journal-types'
 import { agentJournalSubmissionKey } from './agent-session-journal-item-key'
+import { agentJournalItemPosition } from './agent-session-journal-position'
+import { isQueuedAgentJournalSubmission } from './agent-session-queued-submission'
 import type { NativeChatMessage } from './native-chat-types'
 import {
   reconcileStructuredAgentSessionOutbox,
@@ -20,18 +22,49 @@ export function projectStructuredAgentSessionMessages(
       .filter((submission) => submission.dispatchState === 'rejected')
       .map((submission) => agentJournalSubmissionKey(submission.clientMessageId))
   )
-  const visibleItems = items.filter((item) => !rejected.has(item.itemId))
+  const visibleItems: AgentJournalRenderItem[] = []
+  const refused = new Map<string, AgentJournalRenderItem>()
+  for (const item of items) {
+    if (rejected.has(item.itemId)) {
+      refused.set(item.itemId, item)
+    } else {
+      visibleItems.push(item)
+    }
+  }
   const journalled = new Set(visibleItems.map((item) => item.itemId))
+  // Not delivered yet, so nothing the agent does meanwhile — a command it waits behind — comes
+  // after it. Its handover places it in the conversation.
+  const queued = new Set(
+    submissions
+      .filter(isQueuedAgentJournalSubmission)
+      .map((submission) => agentJournalSubmissionKey(submission.clientMessageId))
+  )
+  const delivered: NativeChatMessage[] = []
+  const held: NativeChatMessage[] = []
+  for (const message of projectItems(visibleItems)) {
+    if (queued.has(message.id)) {
+      held.push({ ...message, queued: true })
+    } else {
+      delivered.push(message)
+    }
+  }
   return [
-    ...projectItems(visibleItems),
+    ...delivered,
+    ...held,
     ...optimistic
       .filter((entry) => !journalled.has(agentJournalSubmissionKey(entry.clientMessageId)))
-      .map((entry): NativeChatMessage => ({
-        id: agentJournalSubmissionKey(entry.clientMessageId),
-        role: 'user',
-        source: 'transcript',
-        timestamp: entry.queuedAt,
-        blocks: entry.body.blocks
-      }))
+      .map((entry): NativeChatMessage => {
+        const id = agentJournalSubmissionKey(entry.clientMessageId)
+        const recorded = refused.get(id)
+        return {
+          id,
+          role: 'user',
+          source: 'transcript',
+          timestamp: entry.queuedAt,
+          blocks: entry.body.blocks,
+          // A send the journal recorded before refusing it keeps its place there.
+          ...(recorded ? { journalPosition: agentJournalItemPosition(recorded) } : {})
+        }
+      })
   ]
 }
diff --git a/src/shared/structured-agent-session-operation-identity.test.ts b/src/shared/structured-agent-session-operation-identity.test.ts
new file mode 100644
index 00000000000..f0b05ed86d3
--- /dev/null
+++ b/src/shared/structured-agent-session-operation-identity.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it } from 'vitest'
+import { structuredAgentSessionWriteNamesItsTarget } from './structured-agent-session-operation-identity'
+
+describe('structuredAgentSessionWriteNamesItsTarget', () => {
+  it('holds for a cancel naming its turn, prompt or task, as every mobile cancel does', () => {
+    expect(structuredAgentSessionWriteNamesItsTarget('agentSession.cancel', { turnId: 't' })).toBe(
+      true
+    )
+    expect(
+      structuredAgentSessionWriteNamesItsTarget('agentSession.cancel', {
+        turnId: 't',
+        prompt: { itemId: 'i', expectedRevision: 1 }
+      })
+    ).toBe(true)
+    expect(
+      structuredAgentSessionWriteNamesItsTarget('agentSession.cancel', {
+        turnId: 'background-tasks',
+        scope: 'background-tasks',
+        taskId: 'task-1'
+      })
+    ).toBe(true)
+  })
+
+  it('fails for a Stop naming no turn, and for a stop of every background task', () => {
+    expect(structuredAgentSessionWriteNamesItsTarget('agentSession.cancel', {})).toBe(false)
+    expect(
+      structuredAgentSessionWriteNamesItsTarget('agentSession.cancel', {
+        turnId: 'background-tasks',
+        scope: 'background-tasks'
+      })
+    ).toBe(false)
+  })
+
+  it('leaves every other write as it was', () => {
+    expect(
+      structuredAgentSessionWriteNamesItsTarget('agentSession.setOption', { key: 'k', value: 'v' })
+    ).toBe(true)
+  })
+})
diff --git a/src/shared/structured-agent-session-operation-identity.ts b/src/shared/structured-agent-session-operation-identity.ts
new file mode 100644
index 00000000000..bae28095695
--- /dev/null
+++ b/src/shared/structured-agent-session-operation-identity.ts
@@ -0,0 +1,17 @@
+/**
+ * Whether a structured-session cancel names what it stops (a turn, a prompt, a task), so another
+ * cancel with the same payload is the same intent and may reuse its operation id to replay. A Stop
+ * naming no turn, or one stopping every background task, acts on whatever is in flight when the
+ * host reaches it: its payload is shared with every later one, so each press gets its own id.
+ */
+export function structuredAgentSessionWriteNamesItsTarget(
+  fingerprintMethod: string,
+  fields: Readonly<Record<string, unknown>>
+): boolean {
+  if (fingerprintMethod !== 'agentSession.cancel') {
+    return true
+  }
+  return fields.scope === 'background-tasks'
+    ? fields.taskId !== undefined
+    : fields.turnId !== undefined
+}
diff --git a/src/shared/structured-agent-session-outbox-stop-withdrawal.ts b/src/shared/structured-agent-session-outbox-stop-withdrawal.ts
new file mode 100644
index 00000000000..7d35f9e8720
--- /dev/null
+++ b/src/shared/structured-agent-session-outbox-stop-withdrawal.ts
@@ -0,0 +1,52 @@
+import type { AgentJournalSubmission } from './agent-session-journal-types'
+import type { StructuredAgentSessionOutboxEntry } from './structured-agent-session-outbox'
+
+/** Whether only the user's Retry sends this entry again: a refused one, the one the drain stopped
+ *  on, or one in doubt the unconfirmed probe leaves alone. `NativeChatDeliveryRetry` offers it. */
+function awaitsStructuredAgentSessionRetry(
+  entry: StructuredAgentSessionOutboxEntry,
+  blockedClientMessageId: string | null
+): boolean {
+  return (
+    entry.state === 'rejected' ||
+    entry.clientMessageId === blockedClientMessageId ||
+    (entry.state === 'unconfirmed' && entry.retryAfterUnknownSubmittedAt !== null)
+  )
+}
+
+function unsentStructuredAgentSessionOutboxEntry(
+  submissions: readonly AgentJournalSubmission[],
+  blockedClientMessageId: string | null
+): (entry: StructuredAgentSessionOutboxEntry) => boolean {
+  const held = new Set(submissions.map((submission) => submission.clientMessageId))
+  return (entry) =>
+    !held.has(entry.clientMessageId) &&
+    !awaitsStructuredAgentSessionRetry(entry, blockedClientMessageId)
+}
+
+/**
+ * What a Stop leaves in the outbox: nothing the journal does not already hold may go out after it,
+ * so every such entry goes, as a message the host withdraws leaves the chat. The send on its way
+ * stays: it reaches the host ahead of the Stop, and it comes back from the host's answer, since
+ * the agent may already have it. One waiting on Retry keeps it.
+ */
+export function withdrawUnsentStructuredAgentSessionOutboxEntries(
+  entries: readonly StructuredAgentSessionOutboxEntry[],
+  submissions: readonly AgentJournalSubmission[],
+  blockedClientMessageId: string | null,
+  inFlightClientMessageId: string | null
+): StructuredAgentSessionOutboxEntry[] {
+  const unsent = unsentStructuredAgentSessionOutboxEntry(submissions, blockedClientMessageId)
+  return entries.filter(
+    (entry) => entry.clientMessageId === inFlightClientMessageId || !unsent(entry)
+  )
+}
+
+/** Whether a Stop has something here to withdraw: a message that would still go out on its own. */
+export function hasUnsentStructuredAgentSessionOutboxEntry(
+  entries: readonly StructuredAgentSessionOutboxEntry[],
+  submissions: readonly AgentJournalSubmission[],
+  blockedClientMessageId: string | null
+): boolean {
+  return entries.some(unsentStructuredAgentSessionOutboxEntry(submissions, blockedClientMessageId))
+}
diff --git a/src/shared/structured-agent-session-outbox.ts b/src/shared/structured-agent-session-outbox.ts
index a336dea6fed..c14209a716c 100644
--- a/src/shared/structured-agent-session-outbox.ts
+++ b/src/shared/structured-agent-session-outbox.ts
@@ -1,13 +1,25 @@
+import { readAgentSessionFailureFact, type AgentSessionFailureFact } from './agent-session-failure'
 import type { AgentJournalMessageItem, AgentJournalSubmission } from './agent-session-journal-types'
-import { agentSessionRefusalOperationState } from './agent-session-refusal-retry'
-import type {
-  AgentSessionMutationEnvelope,
-  AgentSessionWireRefusalCode
-} from './agent-session-wire'
+import {
+  parseAgentSessionWriteFailure,
+  type AgentSessionWriteFailure,
+  type AgentSessionWriteRefusal
+} from './agent-session-write-failure'
+import {
+  agentSessionOwnerVerdictAllowsFreshOperationId,
+  agentSessionRefusalOperationState
+} from './agent-session-refusal-retry'
+import type { AgentSessionMutationEnvelope } from './agent-session-wire'
 import { structuredAgentSessionPayloadFingerprint } from './structured-agent-session-mutation'
-import { DISPATCH_REJECTED_CANCELLED } from './structured-agent-session-dispatch-rejection'
+import { classifyDispatchRejection } from './structured-agent-session-dispatch-rejection'
 
-export type StructuredAgentSessionOutboxState = 'queued' | 'dispatching' | 'unconfirmed'
+/** `rejected`: the host settled the send as not delivered. The drain never sends it again on its
+ *  own and nothing queues behind it; only the user's Retry does. */
+export type StructuredAgentSessionOutboxState =
+  | 'queued'
+  | 'dispatching'
+  | 'unconfirmed'
+  | 'rejected'
 
 export type StructuredAgentSessionOutboxEntry = {
   clientMessageId: string
@@ -19,6 +31,64 @@ export type StructuredAgentSessionOutboxEntry = {
   lastAttemptAt: number | null
   retryAfterUnknownSubmittedAt: number | null
   source?: 'launch'
+  /** Why the last attempt did not go through. Lives on the message so it goes when the message
+   *  is sent again or delivered, instead of outliving it as a separate error. */
+  lastFailure?: StructuredAgentSessionAttemptFailure
+}
+
+/** A host's rejection fact as a message keeps it: never its provider detail, whose log text is not
+ *  kept client-side, or its refusal. The journal row keeps the whole fact, and words the notice
+ *  while it is loaded; this copy words it when it is not. */
+export type StructuredAgentSessionRejectionFact = Pick<
+  AgentSessionFailureFact,
+  'kind' | 'attachment'
+>
+
+/** Kept as the fact, not the words: the Retry row chooses those when it shows the entry. */
+export type StructuredAgentSessionAttemptFailure =
+  | AgentSessionWriteFailure
+  /** The host recorded the message and the provider turned it down, with the provider's reason. */
+  | { kind: 'rejected'; reason: string | null; rejection?: StructuredAgentSessionRejectionFact }
+
+/** The failure a rejected submission leaves on its message. A fact this build cannot place is
+ *  dropped, leaving the reason. */
+export function structuredAgentSessionRejectedFailure(submission: {
+  reason: string | null
+  rejection?: unknown
+}): Extract<StructuredAgentSessionAttemptFailure, { kind: 'rejected' }> {
+  const fact = readAgentSessionFailureFact(submission.rejection)
+  return {
+    kind: 'rejected',
+    reason: submission.reason,
+    ...(fact
+      ? {
+          rejection: {
+            kind: fact.kind,
+            ...(fact.attachment ? { attachment: fact.attachment } : {})
+          }
+        }
+      : {})
+  }
+}
+
+function parseStructuredAgentSessionAttemptFailure(
+  value: unknown
+): StructuredAgentSessionAttemptFailure | undefined {
+  if (
+    typeof value === 'object' &&
+    value !== null &&
+    'kind' in value &&
+    value.kind === 'rejected' &&
+    'reason' in value
+  ) {
+    return value.reason === null || typeof value.reason === 'string'
+      ? structuredAgentSessionRejectedFailure({
+          reason: value.reason,
+          rejection: 'rejection' in value ? value.rejection : undefined
+        })
+      : undefined
+  }
+  return parseAgentSessionWriteFailure(value)
 }
 
 export type StructuredAgentSessionAttachment = {
@@ -73,25 +143,41 @@ export function updateStructuredAgentSessionOutboxEntry(
   })
 }
 
+/** Staged for another attempt; the last attempt's failure no longer describes it. */
+export function stageStructuredAgentSessionOutboxEntryForSend(
+  { lastFailure: _sentAgain, ...entry }: StructuredAgentSessionOutboxEntry,
+  now: number
+): StructuredAgentSessionOutboxEntry {
+  return { ...entry, state: 'dispatching', lastAttemptAt: now }
+}
+
 export function requeueStructuredAgentSessionSendRefusal(
   entry: StructuredAgentSessionOutboxEntry,
-  code: AgentSessionWireRefusalCode,
+  refusal: AgentSessionWriteRefusal,
   createOperationId: () => string,
   retainOperationId = false
 ): StructuredAgentSessionOutboxEntry {
-  const refusalState = agentSessionRefusalOperationState(code)
+  const refusalSettled = agentSessionRefusalOperationState(refusal.code) === 'settled-rejected'
+  // An exited owner runs nothing under the old id, so a new one can't collide; the message still
+  // holds the head, since nothing recorded it.
+  const ownerExited =
+    refusal.code === 'agent_session_ownership_unknown' &&
+    agentSessionOwnerVerdictAllowsFreshOperationId(refusal.details?.ownerVerdict)
   if (
-    refusalState !== 'settled-rejected' ||
+    !(refusalSettled || ownerExited) ||
     retainOperationId ||
     entry.state === 'unconfirmed' ||
     entry.retryAfterUnknownSubmittedAt !== null
   ) {
     return { ...entry, state: 'queued' }
   }
+  // Only here may the id rotate: an earlier attempt under this id, or one whose delivery was in
+  // doubt, may have landed, so those stay queued behind the block. Only a settled refusal proves
+  // the message never landed and so releases the queue.
   return {
     ...entry,
     clientMessageId: createOperationId(),
-    state: 'queued',
+    state: refusalSettled ? 'rejected' : 'queued',
     lastAttemptAt: null,
     retryAfterUnknownSubmittedAt: null
   }
@@ -109,13 +195,28 @@ export function reconcileStructuredAgentSessionOutbox(
     }
     if (
       submission?.dispatchState === 'rejected' &&
-      submission.reason === DISPATCH_REJECTED_CANCELLED
+      classifyDispatchRejection(submission).category === 'withdrawn'
     ) {
       return []
     }
     if (submission?.dispatchState === 'pending') {
       return entry.state === 'dispatching' ? [entry] : [{ ...entry, state: 'dispatching' as const }]
     }
+    // Accepted, then not delivered — the agent never started, or its start was refused. The text
+    // and why stay here for the user's Retry, and nothing queues behind it. `unconfirmed` is how a
+    // remount reads an entry it left dispatching; the journal has since answered it.
+    if (
+      submission?.dispatchState === 'rejected' &&
+      (entry.state === 'dispatching' || entry.state === 'unconfirmed')
+    ) {
+      return [
+        {
+          ...entry,
+          state: 'rejected' as const,
+          lastFailure: structuredAgentSessionRejectedFailure(submission)
+        }
+      ]
+    }
     if (
       submission?.dispatchState === 'unknown' &&
       entry.retryAfterUnknownSubmittedAt !== -1 &&
@@ -147,6 +248,10 @@ export function admitStructuredAgentSessionOutboxEntry(
   blockedClientMessageId: string | null
 ): StructuredAgentSessionOutboxAdmission {
   for (const entry of entries) {
+    // It can no longer land, so nothing it could be reordered around; it waits for Retry.
+    if (entry.state === 'rejected') {
+      continue
+    }
     if (entry.state === 'unconfirmed' || entry.clientMessageId === blockedClientMessageId) {
       return { state: 'blocked', entry }
     }
@@ -176,10 +281,12 @@ export function parseStructuredAgentSessionOutboxEntry(
     !Array.isArray(body.blocks) ||
     !Array.isArray(entry.previewUris) ||
     !entry.previewUris.every((uri) => typeof uri === 'string') ||
-    !['queued', 'dispatching', 'unconfirmed'].includes(entry.state ?? '')
+    !['queued', 'dispatching', 'unconfirmed', 'rejected'].includes(entry.state ?? '')
   ) {
     return null
   }
+  // A malformed failure is dropped: the row then says only that the message was not sent.
+  const lastFailure = parseStructuredAgentSessionAttemptFailure(entry.lastFailure)
   return {
     clientMessageId: entry.clientMessageId,
     sessionId,
@@ -192,7 +299,8 @@ export function parseStructuredAgentSessionOutboxEntry(
       typeof entry.retryAfterUnknownSubmittedAt === 'number'
         ? entry.retryAfterUnknownSubmittedAt
         : null,
-    ...(entry.source === 'launch' ? { source: 'launch' as const } : {})
+    ...(entry.source === 'launch' ? { source: 'launch' as const } : {}),
+    ...(lastFailure ? { lastFailure } : {})
   }
 }
 
diff --git a/src/shared/structured-agent-session-owed-work.ts b/src/shared/structured-agent-session-owed-work.ts
new file mode 100644
index 00000000000..324c5160ed0
--- /dev/null
+++ b/src/shared/structured-agent-session-owed-work.ts
@@ -0,0 +1,17 @@
+import type { AgentJournalRenderItem, AgentJournalSubmission } from './agent-session-journal-types'
+import { activeStructuredAgentSessionTurnId } from './structured-agent-session-live-turn'
+import { isStructuredAgentSessionMainAgentWorking } from './structured-agent-session-main-agent-working'
+
+/** A running turn or an unanswered send: what a `working` status means, and what an `attention`
+ *  status hides beneath its pending prompt. The main-agent rule, read from the journal's items. */
+export function owesStructuredAgentSessionWork(
+  items: readonly AgentJournalRenderItem[],
+  submissions: readonly AgentJournalSubmission[],
+  currentFence?: number | null
+): boolean {
+  return isStructuredAgentSessionMainAgentWorking(
+    activeStructuredAgentSessionTurnId(items),
+    submissions,
+    currentFence
+  )
+}
diff --git a/src/shared/structured-agent-session-projection.test.ts b/src/shared/structured-agent-session-projection.test.ts
index 3c16614cf45..8570b0c3374 100644
--- a/src/shared/structured-agent-session-projection.test.ts
+++ b/src/shared/structured-agent-session-projection.test.ts
@@ -1,19 +1,20 @@
 import { describe, expect, it } from 'vitest'
 import { AGENT_STATUS_MAX_FIELD_LENGTH } from './agent-status-field-normalization'
+import { agentSessionFailureWords } from './agent-session-failure-words'
 import type { AgentJournalRenderItem, AgentJournalSubmission } from './agent-session-journal-types'
 import { parsePaneKey } from './stable-pane-id'
 import {
   activeStructuredAgentSessionTurnId,
-  hasPersistedStructuredAgentSessionTurn,
   hasUnansweredStructuredAgentSessionDispatch,
   projectStructuredItemToNativeChat,
   projectStructuredItemsToNativeChat,
-  latestStructuredAgentSessionAssistantMessage,
   projectStructuredAgentSessionStatus,
+  projectStructuredAgentSessionStatusState,
   projectStructuredAgentSessionStatusSummary,
   structuredAgentSessionPaneKey
 } from './structured-agent-session-projection'
 import { statusStructuredAgentSessionToolCall } from './structured-agent-session-live-turn'
+import { latestStructuredAgentSessionAssistantMessage } from './structured-agent-session-latest-request'
 
 function item(
   itemId: string,
@@ -103,6 +104,26 @@ describe('structured agent session status projection', () => {
     })
   })
 
+  it("forwards a status row's failure fact and drops one this build cannot place", () => {
+    const words = agentSessionFailureWords(
+      {
+        kind: 'providerExited',
+        detail: { text: 'stderr tail', audience: 'log' }
+      },
+      { surface: 'row' }
+    )
+    expect(
+      projectStructuredItemToNativeChat(item('exit', 1, { kind: 'status', ...words }))?.blocks[0]
+    ).toEqual({ type: 'text', ...words })
+    const future = item('future', 2, { kind: 'status', text: 'Stopped.' })
+    // A newer host's kind reads as no fact, so the row keeps its text and nothing else.
+    Object.assign(future.body, { failure: { kind: 'futureKind' } })
+    expect(projectStructuredItemToNativeChat(future)?.blocks[0]).toEqual({
+      type: 'text',
+      text: 'Stopped.'
+    })
+  })
+
   it('projects running, attention, and completed lifecycle states', () => {
     const running = item('running', 1, {
       kind: 'status',
@@ -129,7 +150,7 @@ describe('structured agent session status projection', () => {
     expect(projectStructuredAgentSessionStatus([running, completed])).toBe('idle')
   })
 
-  it('summarizes status with the newest user prompt, and null before any persisted turn', () => {
+  it('summarizes status with the newest user prompt, and null before any request', () => {
     const running = item('running', 3, {
       kind: 'status',
       text: 'Working',
@@ -149,10 +170,16 @@ describe('structured agent session status projection', () => {
       ]
     })
 
-    expect(projectStructuredAgentSessionStatusSummary([running])).toEqual({
+    expect(projectStructuredAgentSessionStatusSummary([])).toEqual({
       status: null,
       latestPrompt: ''
     })
+    // A turn the provider opened on its own is a request, with no prompt to quote.
+    expect(projectStructuredAgentSessionStatusSummary([running])).toEqual({
+      status: 'working',
+      latestPrompt: '',
+      statusStartedAt: 3
+    })
     expect(projectStructuredAgentSessionStatusSummary([first, second, running])).toEqual({
       status: 'working',
       latestPrompt: 'second line',
@@ -235,6 +262,42 @@ describe('structured agent session status projection', () => {
     })
   })
 
+  it('still reports owed work beneath a pending prompt, which the attention status hides', () => {
+    const asked = item('asked', 1, {
+      kind: 'message',
+      role: 'user',
+      blocks: [{ type: 'text', text: 'go' }]
+    })
+    const prompt = item('prompt', 3, {
+      kind: 'approval',
+      title: 'Run command?',
+      detail: null,
+      options: [{ id: 'yes', label: 'Allow' }],
+      resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
+    })
+    const running = item('turn', 2, { kind: 'turn', turnId: 't1', state: 'running' })
+    const settled = item('turn', 2, {
+      kind: 'turn',
+      turnId: 't1',
+      state: 'completed',
+      outcome: 'success'
+    })
+    const accepted = [submission('m1', 'accepted')]
+    const owes = (items: AgentJournalRenderItem[], submissions = accepted) => {
+      const state = projectStructuredAgentSessionStatusState(items, submissions)
+      return [state.summary.status, state.owesWork]
+    }
+
+    expect(owes([asked, running, prompt])).toEqual(['attention', true])
+    expect(owes([asked, settled, prompt])).toEqual(['attention', false])
+    expect(owes([asked, settled, prompt], [...accepted, submission('m2', 'pending')])).toEqual([
+      'attention',
+      true
+    ])
+    expect(owes([asked, running])).toEqual(['working', true])
+    expect(owes([asked, settled])).toEqual(['idle', false])
+  })
+
   it('carries the running tool and the newest assistant prose the sidebar row shows', () => {
     const ask = item('ask', 1, {
       kind: 'message',
@@ -394,15 +457,6 @@ describe('structured agent session status projection', () => {
     expect(parsePaneKey(paneKey)).toMatchObject({ tabId: 'structured-agent-session-1' })
   })
 
-  it('requires a persisted provider conversation turn before TUI resume', () => {
-    const status = item('status', 1, { kind: 'status', text: 'Connected' })
-    const user = item('user', 2, { kind: 'message', role: 'user', blocks: [] })
-
-    expect(hasPersistedStructuredAgentSessionTurn([])).toBe(false)
-    expect(hasPersistedStructuredAgentSessionTurn([status])).toBe(false)
-    expect(hasPersistedStructuredAgentSessionTurn([status, user])).toBe(true)
-  })
-
   it('preserves provider-frame detail on the backward-compatible status line', () => {
     const projected = projectStructuredItemToNativeChat(
       item('frame', 1, {
@@ -611,6 +665,18 @@ describe("producer linkage — a subagent's output never speaks for the parent",
     expect(prose).toContain('delegating')
   })
 
+  it("keeps the child's output as the child's: the transcript message names its producer", () => {
+    // Rendering the child's rows is not enough; unless the message still says who
+    // wrote it, the transcript can only present it as the parent speaking.
+    const messages = projectStructuredItemsToNativeChat(items)
+    const byId = new Map(messages.map((message) => [message.id, message]))
+    expect(byId.get('child-prose')).toMatchObject({ agentId: 'task-1', producerKind: 'agent' })
+    expect(byId.get('child-grep')).toMatchObject({ agentId: 'task-1' })
+    // The session's own rows name no producer: absence is the claim that they are its own.
+    expect(byId.get('root-prose')).not.toHaveProperty('agentId')
+    expect(byId.get('root-task')).not.toHaveProperty('agentId')
+  })
+
   it("falls back to nothing rather than a child's line when the parent said nothing", () => {
     const summary = projectStructuredAgentSessionStatusSummary([
       userAsk,
diff --git a/src/shared/structured-agent-session-projection.ts b/src/shared/structured-agent-session-projection.ts
index 6e61603c758..0adac0f6d2e 100644
--- a/src/shared/structured-agent-session-projection.ts
+++ b/src/shared/structured-agent-session-projection.ts
@@ -10,18 +10,22 @@ import {
   type AgentJournalSubmission,
   type AgentJournalTurnOutcome
 } from './agent-session-journal-types'
-import { isRootAgentJournalItem } from './agent-session-journal-producer'
-import { readAgentJournalTurnOutcome } from './agent-session-turn-record'
+import { agentJournalLinkageFields } from './agent-session-journal-producer'
+import { structuredAgentSessionStatusBlock } from './structured-agent-session-status-block'
+import { agentJournalItemRowOrigin } from './agent-session-journal-position'
 import {
   AGENT_STATUS_TOOL_INPUT_MAX_LENGTH,
   AGENT_STATUS_TOOL_NAME_MAX_LENGTH
 } from './agent-status-types'
 import { describeToolInput } from './native-chat-tool-summary'
+import { statusStructuredAgentSessionToolCall } from './structured-agent-session-live-turn'
 import {
-  activeStructuredAgentSessionTurnId,
-  newestStructuredAgentSessionTurn,
-  statusStructuredAgentSessionToolCall
-} from './structured-agent-session-live-turn'
+  hasStructuredAgentSessionRequest,
+  latestStructuredAgentSessionAssistantMessage,
+  latestStructuredAgentSessionPrompt,
+  latestStructuredAgentSessionRequest,
+  type StructuredAgentSessionLatestRequest
+} from './structured-agent-session-latest-request'
 import {
   isStructuredAgentSessionToolAction,
   structuredAgentSessionToolCallBlock
@@ -30,13 +34,15 @@ import {
 import type { NativeChatBlock, NativeChatMessage } from './native-chat-types'
 import { sha256 } from './sha256'
 import { structuredAgentSessionStatusStartedAt } from './structured-agent-session-status-started-at'
-import { isUnansweredStructuredAgentSessionDispatch } from './structured-agent-session-unanswered-dispatch'
+import { owesStructuredAgentSessionWork } from './structured-agent-session-owed-work'
 
-// Re-exported so the live-turn readers' existing consumers keep one import site.
+// Re-exported so the live-turn readers' and the unanswered-send rule's existing consumers keep one
+// import site.
 export {
   activeStructuredAgentSessionTurnId,
   newestStructuredAgentSessionTurn
 } from './structured-agent-session-live-turn'
+export { hasUnansweredStructuredAgentSessionDispatch } from './structured-agent-session-unanswered-dispatch'
 
 function boundedText(payload: { head: string; truncated: boolean; byteLength: number }): string {
   return payload.truncated ? `${payload.head}\n… (${payload.byteLength} bytes)` : payload.head
@@ -119,18 +125,7 @@ function itemBlocks(item: AgentJournalRenderItem): {
   if (body.kind !== 'status' || body.turnLifecycle) {
     return null
   }
-  return {
-    role: 'system',
-    blocks: [
-      {
-        type: 'text',
-        text: body.text,
-        ...(body.presentation !== undefined ? { presentation: body.presentation } : {}),
-        ...(body.tone !== undefined ? { tone: body.tone } : {}),
-        ...(body.providerFrame ? { providerFrame: body.providerFrame } : {})
-      }
-    ]
-  }
+  return { role: 'system', blocks: [structuredAgentSessionStatusBlock(body)] }
 }
 
 function isAgentJournalMessageSendMode(value: string): value is AgentJournalMessageSendMode {
@@ -140,8 +135,8 @@ function isAgentJournalMessageSendMode(value: string): value is AgentJournalMess
 const projectedItems = new WeakMap<AgentJournalRenderItem, NativeChatMessage | null>()
 
 /** Deliberately NOT scoped by producer: the transcript shows every agent's
- *  output. The line this module draws is that the transcript renders every item,
- *  while every "what is this agent doing right now" scan renders only the
+ *  output, and each message keeps its row's linkage so the transcript can say
+ *  whose it is. Every "what is this agent doing right now" scan renders only the
  *  session's own agent's. */
 export function projectStructuredItemsToNativeChat(
   items: readonly AgentJournalRenderItem[]
@@ -168,11 +163,10 @@ export function projectStructuredItemToNativeChat(
   const sentAs = item.body.kind === 'message' ? item.body.sentAs : undefined
   const message: NativeChatMessage | null = projected
     ? {
-        id: item.itemId,
+        ...agentJournalItemRowOrigin(item),
+        ...agentJournalLinkageFields(item),
         role: projected.role,
         blocks: projected.blocks,
-        timestamp: item.observedAt,
-        source: 'transcript',
         // A send mode this build cannot name renders as an ordinary message.
         ...(sentAs !== undefined && isAgentJournalMessageSendMode(sentAs) ? { sentAs } : {})
       }
@@ -181,39 +175,6 @@ export function projectStructuredItemToNativeChat(
   return message
 }
 
-/** Deliberately NOT scoped by producer: this is an existence test ("is this
- *  session listable at all"), not an attribution one. A session whose only
- *  content came from a subagent still has content. */
-export function hasPersistedStructuredAgentSessionTurn(
-  items: readonly AgentJournalRenderItem[]
-): boolean {
-  return items.some(
-    (item) =>
-      item.body.kind === 'message' && (item.body.role === 'user' || item.body.role === 'assistant')
-  )
-}
-
-/**
- * A send the host has journaled that the provider has neither opened a turn for nor refused.
- *
- * Codex declares `turn/started` within ~150ms, but Claude's running row can only be written once
- * the SDK echoes the user message back — a 3.4s median and 18s at p90 on real journals. Waiting
- * on that echo to call a session working leaves the whole gap reading idle in the chat and in
- * every session list, so the send itself is the evidence.
- *
- * A live `unknown` still counts because an ambiguous adapter reply does not prove the provider
- * stopped. A recovered `unknown` does not — it outlived the host generation that sent it, so
- * there is nothing still running to report.
- */
-export function hasUnansweredStructuredAgentSessionDispatch(
-  submissions: readonly AgentJournalSubmission[],
-  currentFence?: number | null
-): boolean {
-  return submissions.some((submission) =>
-    isUnansweredStructuredAgentSessionDispatch(submission, currentFence)
-  )
-}
-
 export type StructuredAgentSessionProjectedStatus = 'working' | 'attention' | 'idle'
 
 export function structuredAgentSessionTabId(sessionId: string): string {
@@ -234,67 +195,7 @@ export function projectStructuredAgentSessionStatus(
   ) {
     return 'attention'
   }
-  return activeStructuredAgentSessionTurnId(items) ||
-    hasUnansweredStructuredAgentSessionDispatch(submissions, currentFence)
-    ? 'working'
-    : 'idle'
-}
-
-function messageProse(blocks: readonly NativeChatBlock[]): string {
-  return blocks.flatMap((block) => (block.type === 'text' ? [block.text] : [])).join('\n')
-}
-
-/** The newest prompt the session's own user turn carries, as the sidebar quotes
- *  it. Scoped to root rows for the same reason the assistant line is: a provider
- *  that journals a subagent's own prompt would otherwise requote it as the
- *  session's. */
-export function latestStructuredAgentSessionPrompt(
-  items: readonly AgentJournalRenderItem[]
-): string {
-  const body = latestStructuredAgentSessionUserItem(items)?.body
-  return body?.kind === 'message' ? messageProse(body.blocks) : ''
-}
-
-export function latestStructuredAgentSessionUserItem(
-  items: readonly AgentJournalRenderItem[]
-): AgentJournalRenderItem | null {
-  for (let index = items.length - 1; index >= 0; index -= 1) {
-    const item = items[index]
-    if (
-      item?.body.kind === 'message' &&
-      item.body.role === 'user' &&
-      isRootAgentJournalItem(item)
-    ) {
-      return item
-    }
-  }
-  return null
-}
-
-/** The newest prose THE SESSION'S OWN AGENT wrote in the latest user turn — not a
- *  subagent's, whose rows share this journal and are usually the newer ones while
- *  a child runs. Tool-only assistant items are skipped; the user boundary clears
- *  prose from the preceding turn. */
-export function latestStructuredAgentSessionAssistantMessage(
-  items: readonly AgentJournalRenderItem[]
-): string {
-  for (let index = items.length - 1; index >= 0; index -= 1) {
-    const item = items[index]
-    const body = item?.body
-    if (!isRootAgentJournalItem(item)) {
-      continue
-    }
-    if (body?.kind === 'message' && body.role === 'user') {
-      return ''
-    }
-    if (body?.kind === 'message' && body.role === 'assistant') {
-      const prose = messageProse(body.blocks)
-      if (prose.trim()) {
-        return prose
-      }
-    }
-  }
-  return ''
+  return owesStructuredAgentSessionWork(items, submissions, currentFence) ? 'working' : 'idle'
 }
 
 /** The activity fields a sidebar row shows beside the prompt, named as the agent-status
@@ -307,7 +208,8 @@ export type StructuredAgentSessionStatusProjection = {
   toolName?: string
   toolInput?: string
   lastAssistantMessage?: string
-  /** The newest settled turn's provider verdict; present only while `status` is idle. */
+  /** The latest request's verdict: its turn's, or `failure` for a send the agent or its start
+   *  refused. Present only while `status` is idle. */
   turnOutcome?: AgentJournalTurnOutcome
   statusStartedAt?: number
 }
@@ -323,13 +225,23 @@ export function projectStructuredAgentSessionStatusSummary(
   submissions: readonly AgentJournalSubmission[] = [],
   currentFence?: number | null
 ): StructuredAgentSessionStatusProjection {
-  // A first send has no journalled message until the provider replays it, so the pending
-  // dispatch is also what makes a brand-new session listable at all.
-  if (
-    !hasPersistedStructuredAgentSessionTurn(items) &&
-    !hasUnansweredStructuredAgentSessionDispatch(submissions, currentFence)
-  ) {
-    return { status: null, latestPrompt: '' }
+  return projectStructuredAgentSessionStatusState(items, submissions, currentFence).summary
+}
+
+/** The summary plus the latest request it was read from, whatever the status, so the host's
+ *  completion feed follows the same request the row reports without scanning again. */
+export function projectStructuredAgentSessionStatusState(
+  items: readonly AgentJournalRenderItem[],
+  submissions: readonly AgentJournalSubmission[] = [],
+  currentFence?: number | null
+): {
+  summary: StructuredAgentSessionStatusProjection
+  latestRequest: StructuredAgentSessionLatestRequest | null
+  /** Whether a running turn or an unanswered send is still owed, even beneath a pending prompt. */
+  owesWork: boolean
+} {
+  if (!hasStructuredAgentSessionRequest(items, submissions, currentFence)) {
+    return { summary: { status: null, latestPrompt: '' }, latestRequest: null, owesWork: false }
   }
   const status = projectStructuredAgentSessionStatus(items, submissions, currentFence)
   const statusToolCall = status === 'working' ? statusStructuredAgentSessionToolCall(items) : null
@@ -346,24 +258,29 @@ export function projectStructuredAgentSessionStatusSummary(
     latestStructuredAgentSessionAssistantMessage(items),
     AGENT_STATUS_MAX_FIELD_LENGTH
   )
-  // A verdict is a fact about a finished turn: only an idle session has one to report, and
-  // `readAgentJournalTurnOutcome` already answers null for anything it cannot place.
-  const turnOutcome =
-    status === 'idle' ? readAgentJournalTurnOutcome(newestStructuredAgentSessionTurn(items)) : null
+  const latestRequest = latestStructuredAgentSessionRequest(items, submissions)
+  // A verdict is a fact about a finished request: only an idle session has one to report.
+  const request = status === 'idle' ? latestRequest : null
+  const turnOutcome = request?.outcome
   const statusStartedAt = structuredAgentSessionStatusStartedAt(
     status,
     items,
     submissions,
-    currentFence
+    currentFence,
+    request
   )
   return {
-    status,
-    latestPrompt: normalizePromptField(latestStructuredAgentSessionPrompt(items)),
-    ...(toolName ? { toolName } : {}),
-    ...(toolInput ? { toolInput } : {}),
-    ...(lastAssistantMessage ? { lastAssistantMessage } : {}),
-    ...(turnOutcome ? { turnOutcome } : {}),
-    ...(statusStartedAt !== undefined ? { statusStartedAt } : {})
+    latestRequest,
+    owesWork: status !== 'idle' && owesStructuredAgentSessionWork(items, submissions, currentFence),
+    summary: {
+      status,
+      latestPrompt: normalizePromptField(latestStructuredAgentSessionPrompt(items)),
+      ...(toolName ? { toolName } : {}),
+      ...(toolInput ? { toolInput } : {}),
+      ...(lastAssistantMessage ? { lastAssistantMessage } : {}),
+      ...(turnOutcome ? { turnOutcome } : {}),
+      ...(statusStartedAt !== undefined ? { statusStartedAt } : {})
+    }
   }
 }
 
diff --git a/src/shared/structured-agent-session-read-refusal.ts b/src/shared/structured-agent-session-read-refusal.ts
index 18487f12be3..74279d7811d 100644
--- a/src/shared/structured-agent-session-read-refusal.ts
+++ b/src/shared/structured-agent-session-read-refusal.ts
@@ -1,11 +1,13 @@
+import type { AgentSessionRefusalReference } from './agent-session-wire-refusals'
+
 /**
  * The one refusal a structured-session READ can raise that is not a failure to read.
  *
- * `agentSession.history` and `agentSession.subscribe` both resolve the session through the host's
- * `requireSession`, which raises this code when the host holds no session object by that id. That
- * is never a transcript Orca could not read — it is a session this host has not attached YET (the
- * surface's hold is what attaches one) or one it has just closed. Both windows end on their own:
- * the first when the hold lands, the second when the chat tab retires.
+ * A current host opens a conversation for any read, so a read meets this code only once quit began.
+ * An older host resolves `agentSession.history` and `agentSession.subscribe` against the sessions it
+ * has attached, and raises it when it holds none by that id. Either way it is never a transcript
+ * Orca could not read: an older host's session is not attached YET (the surface's hold attaches
+ * one) or was just closed, and both windows end on their own.
  *
  * The genuinely latched lease — "Orca cannot prove the previous owner exited" — reaches the client
  * through the ACQUISITION path instead, so narrowing on the code costs a read no real diagnosis.
@@ -43,3 +45,17 @@ export function isUnattachedAgentSessionReadRefusal(error: unknown): boolean {
     message === AGENT_SESSION_UNATTACHED_REFUSAL_CODE
   )
 }
+
+/**
+ * A read refusal no retry reads past: SQLite reported the chat's journal damaged. Decided from the
+ * reason, never the message, which is the bare code for every journal refusal; a journal that
+ * failed to open for any other reason can clear, so its read keeps reconnecting.
+ */
+export function isFinalAgentSessionReadRefusal(
+  refusal: AgentSessionRefusalReference | undefined
+): boolean {
+  return (
+    refusal?.code === 'agent_session_journal_unreadable' &&
+    refusal.details?.reason === 'journalCorrupt'
+  )
+}
diff --git a/src/shared/structured-agent-session-reducer.test.ts b/src/shared/structured-agent-session-reducer.test.ts
index aa90749ffdf..ca108710bcf 100644
--- a/src/shared/structured-agent-session-reducer.test.ts
+++ b/src/shared/structured-agent-session-reducer.test.ts
@@ -54,6 +54,37 @@ function hydrationPage(
 }
 
 describe('structured agent session reducer', () => {
+  it("orders one journal write's items by their place in it, whatever order they arrive in", () => {
+    const at = (id: string, sequence: number, sequenceIndex: number): AgentJournalRenderItem => ({
+      ...item(id, sequence),
+      ...(sequenceIndex > 0 ? { sequenceIndex } : {})
+    })
+    const paged = reduceStructuredAgentSession(EMPTY_STRUCTURED_AGENT_SESSION, {
+      type: 'history-page',
+      page: hydrationPage([
+        item('before', 4),
+        at('third', 5, 2),
+        at('first', 5, 0),
+        at('second', 5, 1)
+      ])
+    })
+    expect(paged.items.map(({ itemId }) => itemId)).toEqual(['before', 'first', 'second', 'third'])
+    const live = reduceStructuredAgentSession(paged, {
+      type: 'event',
+      event: {
+        type: 'batch',
+        sessionId: 'session-a',
+        batch: {
+          cursor: { epoch: 'epoch-a', sequence: 6 },
+          items: [at('next-b', 6, 1), at('next-a', 6, 0)],
+          removedItemIds: [],
+          submissions: []
+        }
+      }
+    })
+    expect(live.items.map(({ itemId }) => itemId).slice(-2)).toEqual(['next-a', 'next-b'])
+  })
+
   it('applies an additive targeted-stop capability update without journal churn', () => {
     const backgroundTasks = {
       state: 'monitoring' as const,
@@ -127,6 +158,46 @@ describe('structured agent session reducer', () => {
     ])
   })
 
+  it("keeps a failed read's refusal beside its text until the read recovers", () => {
+    const refusal = {
+      code: 'agent_session_journal_unreadable',
+      details: { reason: 'journalCorrupt' }
+    } as const
+    const failed = reduceStructuredAgentSession(EMPTY_STRUCTURED_AGENT_SESSION, {
+      type: 'error',
+      message: 'agent_session_journal_unreadable',
+      refusal
+    })
+    expect(failed).toMatchObject({ status: 'error', readRefusal: refusal })
+
+    expect(reduceStructuredAgentSession(failed, { type: 'loading' }).readRefusal).toBeUndefined()
+    const live = reduceStructuredAgentSession(
+      reduceStructuredAgentSession(failed, {
+        type: 'history-page',
+        page: hydrationPage([item('a', 1)])
+      }),
+      { type: 'error', message: 'transport died' }
+    )
+    expect(live.readRefusal).toBeUndefined()
+    const recovered = reduceStructuredAgentSession(
+      { ...live, readRefusal: refusal },
+      {
+        type: 'event',
+        event: {
+          type: 'batch',
+          sessionId: 'session-a',
+          batch: {
+            cursor: { epoch: 'epoch-a', sequence: 2 },
+            items: [item('b', 2)],
+            removedItemIds: [],
+            submissions: []
+          }
+        }
+      }
+    )
+    expect(recovered).toMatchObject({ status: 'ready', error: undefined, readRefusal: undefined })
+  })
+
   it('uses the bounded hydration page pagination boundary', () => {
     const restored = reduceStructuredAgentSession(EMPTY_STRUCTURED_AGENT_SESSION, {
       type: 'event',
diff --git a/src/shared/structured-agent-session-reducer.ts b/src/shared/structured-agent-session-reducer.ts
index 2f839f93330..02c554628fb 100644
--- a/src/shared/structured-agent-session-reducer.ts
+++ b/src/shared/structured-agent-session-reducer.ts
@@ -10,8 +10,10 @@ import type {
   AgentSessionSubscribeEvent,
   AgentSessionTurnActivity
 } from './agent-session-wire'
+import type { AgentSessionRefusalReference } from './agent-session-wire-refusals'
 import { backgroundTaskStatesEqual } from './agent-session-background-task-state-equality'
 import { agentJournalSubmissionKey } from './agent-session-journal-item-key'
+import { compareAgentJournalItems } from './agent-session-journal-position'
 import { readAgentJournalTurn } from './agent-session-turn-record'
 
 /** The last host clock sample: `hostNow - receivedAt` is the client's skew from the host,
@@ -31,7 +33,10 @@ export type StructuredAgentSessionState = {
   retainedItemLimit: number
   hasOlder: boolean
   status: 'idle' | 'loading' | 'ready' | 'error'
+  /** The failed read's own text, for logs; a surface words `readRefusal` instead. */
   error?: string
+  /** The refusal the failed read met, when the host sent one; cleared with `error`. */
+  readRefusal?: AgentSessionRefusalReference
   backgroundTasks?: AgentSessionBackgroundTaskState | null
   commands?: AgentSessionSlashCommand[] | null
   activity?: AgentSessionTurnActivity | null
@@ -44,7 +49,7 @@ export type StructuredAgentSessionState = {
 
 export type StructuredAgentSessionAction =
   | { type: 'loading' }
-  | { type: 'error'; message: string }
+  | { type: 'error'; message: string; refusal?: AgentSessionRefusalReference }
   | { type: 'event'; event: AgentSessionSubscribeEvent }
   | { type: 'history-page'; page: AgentSessionHistoryPage }
   | { type: 'older-page'; requestedCursor: AgentJournalCursor; page: AgentSessionHistoryPage }
@@ -85,7 +90,7 @@ function replacePage(
     epoch: page.epoch,
     cursor: page.liveCursor ?? page.window.nextCursor,
     fence,
-    items: [...page.items].sort((left, right) => left.sequence - right.sequence),
+    items: [...page.items].sort(compareAgentJournalItems),
     submissions: page.submissions,
     retainedItemLimit: Math.max(MAX_RETAINED_ITEMS, page.items.length),
     hasOlder: page.hasOlder,
@@ -114,7 +119,7 @@ function mergeItems(
       byId.set(item.itemId, item)
     }
   }
-  return [...byId.values()].sort((left, right) => left.sequence - right.sequence)
+  return [...byId.values()].sort(compareAgentJournalItems)
 }
 
 /**
@@ -175,10 +180,10 @@ export function reduceStructuredAgentSession(
 ): StructuredAgentSessionState {
   if (action.type === 'loading') {
     // Keep the last transcript visible while a reconnect rehydrates the stream.
-    return { ...state, status: 'loading', error: undefined }
+    return { ...state, status: 'loading', error: undefined, readRefusal: undefined }
   }
   if (action.type === 'error') {
-    return { ...state, status: 'error', error: action.message }
+    return { ...state, status: 'error', error: action.message, readRefusal: action.refusal }
   }
   if (action.type === 'history-page') {
     return {
@@ -271,6 +276,7 @@ export function reduceStructuredAgentSession(
         : mergeSubmissions(state.submissions, event.batch.submissions, items),
     status: 'ready',
     error: undefined,
+    readRefusal: undefined,
     commands: event.commands !== undefined ? event.commands : state.commands,
     ...(backgroundTasks !== undefined ? { backgroundTasks } : {}),
     ...(activity !== undefined ? { activity } : {}),
diff --git a/src/shared/structured-agent-session-send-disposition.test.ts b/src/shared/structured-agent-session-send-disposition.test.ts
index 66a7a9b32fa..c905584fd80 100644
--- a/src/shared/structured-agent-session-send-disposition.test.ts
+++ b/src/shared/structured-agent-session-send-disposition.test.ts
@@ -4,14 +4,19 @@
 // which is the whole reason it was split out.
 
 import { describe, expect, it } from 'vitest'
+import type { AgentSessionFailureFact } from './agent-session-failure'
 import type { AgentJournalSubmission } from './agent-session-journal-types'
 import type { AgentSessionMutationResult, AgentSessionSendResult } from './agent-session-wire'
 import {
-  dispatchWriteFailureReason,
   DISPATCH_REJECTED_CANCELLED,
   DISPATCH_REJECTED_QUEUE_FULL
 } from './structured-agent-session-dispatch-rejection'
-import { disposeStructuredAgentSessionSendResult } from './structured-agent-session-send-disposition'
+import { agentSessionWriteNoticeEnglish } from './agent-session-refusal-notice'
+import {
+  disposeStructuredAgentSessionSendFailure,
+  disposeStructuredAgentSessionSendResult,
+  structuredAgentSessionAttemptFailureParts
+} from './structured-agent-session-send-disposition'
 import {
   createStructuredAgentSessionOutboxEntry,
   reconcileStructuredAgentSessionOutbox,
@@ -26,7 +31,10 @@ const entry: StructuredAgentSessionOutboxEntry = createStructuredAgentSessionOut
   queuedAt: 1
 })
 
-function rejectedWith(reason: string | null): AgentSessionMutationResult<AgentSessionSendResult> {
+function rejectedWith(
+  reason: string | null,
+  extra: { rejection?: AgentSessionFailureFact; replayed?: boolean } = {}
+): AgentSessionMutationResult<AgentSessionSendResult> {
   const submission: AgentJournalSubmission = {
     clientMessageId: 'client-1',
     fence: 1,
@@ -35,31 +43,82 @@ function rejectedWith(reason: string | null): AgentSessionMutationResult<AgentSe
     providerItemId: null,
     reason,
     submittedAt: 10,
-    resolvedAt: 10
+    resolvedAt: 10,
+    ...(extra.rejection ? { rejection: extra.rejection } : {})
   }
   return {
     ok: true,
-    replayed: false,
+    replayed: extra.replayed ?? false,
     fence: 1,
     cursor: { epoch: 'epoch-1', sequence: 10 },
     value: { clientMessageId: 'client-1', submission }
-  } as AgentSessionMutationResult<AgentSessionSendResult>
+  }
 }
 
-function notice(reason: string | null): string | null {
-  return disposeStructuredAgentSessionSendResult({
+function notice(reason: string | null, rejection?: AgentSessionFailureFact): string | undefined {
+  const disposition = disposeStructuredAgentSessionSendResult({
     entries: [entry],
     entry,
     blockedClientMessageId: null,
-    result: rejectedWith(reason),
+    result: rejectedWith(reason, rejection ? { rejection } : {}),
     createOperationId: () => 'unused'
-  }).error
+  })
+  // The reason travels with the message it explains, never as a separate error.
+  expect(disposition.error).toBeNull()
+  const failure = disposition.entries[0]?.lastFailure
+  return (
+    failure && agentSessionWriteNoticeEnglish(structuredAgentSessionAttemptFailureParts(failure))
+  )
 }
 
+describe('a queued draft answer', () => {
+  it('retires the outbox entry: the host-held draft carries any later refusal', () => {
+    const disposition = disposeStructuredAgentSessionSendResult({
+      entries: [entry],
+      entry,
+      blockedClientMessageId: null,
+      result: {
+        ok: true,
+        replayed: false,
+        fence: 1,
+        cursor: { epoch: 'epoch-1', sequence: 10 },
+        value: {
+          clientMessageId: 'client-1',
+          queued: { messageId: 'client-1', position: 1, state: 'waiting' }
+        }
+      },
+      createOperationId: () => 'unused'
+    })
+    expect(disposition.entries).toEqual([])
+    expect(disposition.error).toBeNull()
+  })
+
+  it('a withdrawn replay is spent, not unknown', () => {
+    const disposition = disposeStructuredAgentSessionSendResult({
+      entries: [entry],
+      entry,
+      blockedClientMessageId: null,
+      result: {
+        ok: true,
+        replayed: true,
+        fence: 1,
+        cursor: { epoch: 'epoch-1', sequence: 10 },
+        value: {
+          clientMessageId: 'client-1',
+          queued: { messageId: 'client-1', position: 1, state: 'withdrawn' }
+        }
+      },
+      createOperationId: () => 'unused'
+    })
+    expect(disposition.entries).toEqual([])
+    expect(disposition.error).toBeNull()
+  })
+})
+
 describe('what a rejection shows the user', () => {
   it('removes a queued message the provider confirms Stop cancelled', () => {
     const result = rejectedWith(DISPATCH_REJECTED_CANCELLED)
-    if (!result.ok) {
+    if (!result.ok || !('submission' in result.value)) {
       throw new Error('expected rejected submission fixture')
     }
 
@@ -67,14 +126,11 @@ describe('what a rejection shows the user', () => {
   })
 
   it('never puts the transport marker on screen', () => {
-    const shown = notice(dispatchWriteFailureReason(new Error('broken pipe')))
+    const shown = notice('provider_write_failed: broken pipe')
     // `provider_write_failed: broken pipe` names nothing a person can act on.
     expect(shown).not.toContain('provider_write_failed')
     expect(shown).not.toContain('broken pipe')
-    // And it says the message is safe to send again, which it is: the frame never left.
-    expect(shown).toBe(
-      "Couldn't reach the agent. Your message was not sent — Retry to send it again."
-    )
+    expect(shown).toBe("Orca couldn't reach the agent. Your message was not sent.")
   })
 
   it('shows a content rejection in the provider own words', () => {
@@ -84,15 +140,55 @@ describe('what a rejection shows the user', () => {
     )
   })
 
-  it('names the cause of a start that died before it could take the message', () => {
-    // The host words this reason for the user: the child's own diagnostic, nothing internal.
-    const reason =
-      'The provider stopped before it finished starting: claude stream-json exited (code 1): claude: not signed in.'
+  it('shows the sentence a host wrote for the person reading it', () => {
+    const reason = 'The provider stopped before it finished starting.'
     expect(notice(reason)).toBe(reason)
   })
 
+  it('never puts the legacy not_delivered marker on screen', () => {
+    // Released clients printed it as it was; it is a marker, not a sentence.
+    expect(notice('not_delivered')).toBe('Your message was not sent.')
+  })
+
+  it.each([
+    ['the legacy marker alone', undefined],
+    ['the marker and its typed fact', { kind: 'cancelled' as const }]
+  ])('fails nothing for a Stop-withdrawn send, first reply or replay: %s', (_label, rejection) => {
+    for (const replayed of [false, true]) {
+      const disposition = disposeStructuredAgentSessionSendResult({
+        entries: [entry],
+        entry,
+        blockedClientMessageId: null,
+        result: rejectedWith(DISPATCH_REJECTED_CANCELLED, { rejection, replayed }),
+        createOperationId: () => 'unused'
+      })
+      expect(disposition).toEqual({
+        entries: [],
+        error: null,
+        blockedClientMessageId: null
+      })
+    }
+  })
+
+  it('reads a withdrawal off the typed fact whatever the reason says', () => {
+    const result = rejectedWith('Withdrawn.', { rejection: { kind: 'cancelled' } })
+    if (!result.ok || !('submission' in result.value)) {
+      throw new Error('expected rejected submission fixture')
+    }
+    expect(reconcileStructuredAgentSessionOutbox([entry], [result.value.submission])).toEqual([])
+    expect(
+      disposeStructuredAgentSessionSendResult({
+        entries: [entry],
+        entry,
+        blockedClientMessageId: null,
+        result,
+        createOperationId: () => 'unused'
+      }).error
+    ).toBeNull()
+  })
+
   it('claims no cause when the rejection names none', () => {
-    expect(notice(null)).toBe('Message was not sent.')
+    expect(notice(null)).toBe('Your message was not sent.')
   })
 
   it('never puts a local-capacity marker on screen either', () => {
@@ -100,7 +196,184 @@ describe('what a rejection shows the user', () => {
     // ourselves. It has no user-facing meaning, so it gets copy rather than the token.
     const shown = notice(DISPATCH_REJECTED_QUEUE_FULL)
     expect(shown).not.toContain('queue is full')
-    expect(shown).toBe('Orca could not send your message — Retry to send it again.')
+    expect(shown).toBe('Your message was not sent.')
+  })
+})
+
+// A row that carries the host's fact is worded from it; the reason is not read.
+describe('what a rejection with a typed fact shows the user', () => {
+  it('says Orca could not hand the message over, whatever the reason holds', () => {
+    expect(notice('provider_write_failed', { kind: 'writeFailed' })).toBe(
+      "Orca couldn't reach the agent. Your message was not sent."
+    )
+    expect(notice('Something unrelated.', { kind: 'writeFailed' })).toBe(
+      "Orca couldn't reach the agent. Your message was not sent."
+    )
+  })
+
+  it("rebuilds the fact's sentence where a marker stands in for it", () => {
+    expect(notice(DISPATCH_REJECTED_QUEUE_FULL, { kind: 'queueFull' })).toBe(
+      'Too many messages were waiting for the agent, so this one was not sent.'
+    )
+  })
+
+  // The surface names the agent; the host's own sentence is never compared or shown.
+  it('words the fact itself, never the sentence the host wrote beside it', () => {
+    expect(
+      notice('Claude never finished starting, so Orca stopped it.', { kind: 'hostStopped' })
+    ).toBe('The agent never finished starting, so Orca stopped it.')
+  })
+
+  // The message keeps no fact it cannot place, so the host's sentence stands, as on an older host.
+  it("shows a newer host's sentence when its fact cannot be placed", () => {
+    expect(notice('A sentence a newer host wrote.', JSON.parse('{"kind":"fromTheFuture"}'))).toBe(
+      'A sentence a newer host wrote.'
+    )
+  })
+
+  // The message's copy drops the detail and the refusal these kinds are worded from, so the
+  // sentence the host wrote for the person stands in for them; with none, the table's words.
+  it("shows the host's sentence for a kind whose words its copy cannot rebuild", () => {
+    expect(
+      notice('The provider did not accept this message: Image type .bmp.', {
+        kind: 'providerRejected',
+        detail: { text: 'Image type .bmp', audience: 'person' }
+      })
+    ).toBe('The provider did not accept this message: Image type .bmp.')
+    expect(
+      notice("Claude couldn't start. Start a new chat to continue.", {
+        kind: 'startFailed',
+        refusal: { code: 'agent_session_identity_required' }
+      })
+    ).toBe("Claude couldn't start. Start a new chat to continue.")
+    expect(notice(null, { kind: 'providerRejected' })).toBe(
+      'The provider did not accept this message.'
+    )
+  })
+
+  it('says only that the message was not sent for a fact no message can carry', () => {
+    expect(notice('Compaction failed.', { kind: 'compactionFailed' })).toBe(
+      'Your message was not sent.'
+    )
+  })
+})
+
+describe('what a refusal shows the user', () => {
+  it('keeps the refusal as a fact on the message, without the host diagnostic', () => {
+    const disposition = disposeStructuredAgentSessionSendResult({
+      entries: [entry],
+      entry,
+      blockedClientMessageId: null,
+      result: {
+        ok: false,
+        refusal: {
+          code: 'agent_session_checkpoint_stale',
+          message: 'Expected runtime fence 1; the session is at 3.'
+        }
+      },
+      createOperationId: () => 'unused'
+    })
+
+    expect(disposition.error).toBeNull()
+    expect(disposition.blockedClientMessageId).toBe(entry.clientMessageId)
+    expect(disposition.entries).toMatchObject([
+      {
+        clientMessageId: entry.clientMessageId,
+        state: 'queued',
+        lastFailure: { kind: 'refused', code: 'agent_session_checkpoint_stale' }
+      }
+    ])
+    expect(
+      agentSessionWriteNoticeEnglish(
+        structuredAgentSessionAttemptFailureParts(disposition.entries[0]!.lastFailure!)
+      )
+    ).toBe('Your message was not sent.')
+  })
+
+  it("keeps the reason the host named, and says it on the message's Retry row", () => {
+    const disposition = disposeStructuredAgentSessionSendResult({
+      entries: [entry],
+      entry,
+      blockedClientMessageId: null,
+      result: {
+        ok: false,
+        refusal: {
+          code: 'agent_session_conflict',
+          message: 'The chat is still starting.',
+          details: { reason: 'chatStarting' }
+        }
+      },
+      createOperationId: () => 'unused'
+    })
+
+    const lastFailure = disposition.entries[0]?.lastFailure
+    expect(lastFailure).toEqual({
+      kind: 'refused',
+      code: 'agent_session_conflict',
+      details: { reason: 'chatStarting' }
+    })
+    expect(
+      agentSessionWriteNoticeEnglish(structuredAgentSessionAttemptFailureParts(lastFailure!))
+    ).toBe(
+      'The agent is still starting. Your message was not sent. Wait for the agent to finish starting.'
+    )
+  })
+
+  it("keeps a rejected message's typed fact without the provider's detail", () => {
+    const disposition = disposeStructuredAgentSessionSendResult({
+      entries: [entry],
+      entry,
+      blockedClientMessageId: null,
+      result: rejectedWith('An image on this message is empty, so the message was not sent.', {
+        rejection: {
+          kind: 'attachmentInvalid',
+          attachment: { reason: 'empty' },
+          detail: { text: 'image block 2: zero bytes', audience: 'log' }
+        }
+      }),
+      createOperationId: () => 'unused'
+    })
+
+    expect(disposition.entries[0]?.lastFailure).toEqual({
+      kind: 'rejected',
+      reason: 'An image on this message is empty, so the message was not sent.',
+      rejection: { kind: 'attachmentInvalid', attachment: { reason: 'empty' } }
+    })
+  })
+
+  it('keeps a failed request as a fact, not a transport error string', () => {
+    const disposition = disposeStructuredAgentSessionSendFailure({
+      entries: [entry],
+      entry,
+      blockedClientMessageId: null,
+      cause: new Error('socket hang up: ECONNRESET 10.0.0.2:443'),
+      isDeliveryUnknown: () => false
+    })
+
+    expect(disposition.error).toBeNull()
+    expect(disposition.entries[0]?.lastFailure).toEqual({ kind: 'failed' })
+  })
+
+  it('drops the reason once the same message is accepted', () => {
+    const refused: StructuredAgentSessionOutboxEntry = {
+      ...entry,
+      lastFailure: { kind: 'refused', code: 'agent_session_checkpoint_stale' }
+    }
+    const result = rejectedWith(null)
+    if (!result.ok || !('submission' in result.value)) {
+      throw new Error('expected a send result')
+    }
+    result.value.submission = { ...result.value.submission, dispatchState: 'accepted' }
+    const disposition = disposeStructuredAgentSessionSendResult({
+      entries: [refused],
+      entry: refused,
+      blockedClientMessageId: null,
+      result,
+      createOperationId: () => 'unused'
+    })
+
+    expect(disposition.entries).toEqual([])
+    expect(disposition.error).toBeNull()
   })
 })
 
@@ -131,7 +404,7 @@ describe('ambiguous operation refusals', () => {
 
   it('parks a recovered missing submission without polling forever', () => {
     const result = rejectedWith(null)
-    if (!result.ok) {
+    if (!result.ok || !('submission' in result.value)) {
       throw new Error('expected a send result')
     }
     result.value.submission = {
diff --git a/src/shared/structured-agent-session-send-disposition.ts b/src/shared/structured-agent-session-send-disposition.ts
index 16765a02471..ce6143369ec 100644
--- a/src/shared/structured-agent-session-send-disposition.ts
+++ b/src/shared/structured-agent-session-send-disposition.ts
@@ -7,25 +7,36 @@
 // the refs, the React state and the storage write, and nothing else decides an
 // entry's state.
 
+import type { AgentJournalSubmission } from './agent-session-journal-types'
 import type { AgentSessionMutationResult, AgentSessionSendResult } from './agent-session-wire'
 import {
-  dispatchRejectionReasonIsInternal,
-  dispatchRejectionWasTransportWriteFailure
-} from './structured-agent-session-dispatch-rejection'
+  agentSessionWriteNoticeEnglish,
+  agentSessionWriteNoticeParts,
+  agentSessionWriteNotDoneParts
+} from './agent-session-refusal-notice'
+import type { AgentSessionWriteNoticePart } from './agent-session-write-notice-copy'
+import { agentSessionRefusalFailure } from './agent-session-write-failure'
+import type { AgentSessionFailureFact } from './agent-session-failure'
+import {
+  agentSessionFailureSentence,
+  type AgentSessionFailureWordsContext
+} from './agent-session-failure-words'
+import { classifyDispatchRejection } from './structured-agent-session-dispatch-rejection'
 import {
   classifyStructuredAgentSessionSendFailure,
   requeueStructuredAgentSessionSendRefusal,
+  structuredAgentSessionRejectedFailure,
+  type StructuredAgentSessionAttemptFailure,
   type StructuredAgentSessionOutboxEntry
 } from './structured-agent-session-outbox'
 
 export type StructuredAgentSessionSendDisposition = {
   entries: StructuredAgentSessionOutboxEntry[]
+  /** Only for an outcome with no entry left to carry it; a kept entry holds its own failure. */
   error: string | null
   /** The entry the queue is stuck on, or null when nothing blocks it. Always the
    *  next value, never "unchanged": the caller assigns it verbatim. */
   blockedClientMessageId: string | null
-  /** A rejected result arrived before the journal snapshot; Retry must rotate this id. */
-  retryWithFreshClientMessageId: string | null
 }
 
 type SendDispositionInput = {
@@ -36,13 +47,24 @@ type SendDispositionInput = {
 
 function replaceEntryState(
   input: SendDispositionInput,
-  state: StructuredAgentSessionOutboxEntry['state']
+  state: StructuredAgentSessionOutboxEntry['state'],
+  lastFailure?: StructuredAgentSessionAttemptFailure
 ): StructuredAgentSessionOutboxEntry[] {
   return input.entries.map((candidate) =>
-    candidate.clientMessageId === input.entry.clientMessageId ? { ...candidate, state } : candidate
+    candidate.clientMessageId === input.entry.clientMessageId
+      ? withLastFailure({ ...candidate, state }, lastFailure)
+      : candidate
   )
 }
 
+function withLastFailure(
+  entry: StructuredAgentSessionOutboxEntry,
+  lastFailure: StructuredAgentSessionAttemptFailure | undefined
+): StructuredAgentSessionOutboxEntry {
+  const { lastFailure: _previous, ...rest } = entry
+  return lastFailure === undefined ? rest : { ...rest, lastFailure }
+}
+
 function dropEntry(input: SendDispositionInput): StructuredAgentSessionOutboxEntry[] {
   return input.entries.filter(
     (candidate) => candidate.clientMessageId !== input.entry.clientMessageId
@@ -63,7 +85,7 @@ function dropEntry(input: SendDispositionInput): StructuredAgentSessionOutboxEnt
  */
 function refusedRedelivery(
   entry: StructuredAgentSessionOutboxEntry,
-  submission: AgentSessionSendResult['submission']
+  submission: AgentJournalSubmission
 ): boolean {
   return (
     entry.retryAfterUnknownSubmittedAt !== null &&
@@ -72,6 +94,18 @@ function refusedRedelivery(
   )
 }
 
+/** Whether the journal already answers a send still in flight, so its own reply adds nothing: the
+ *  host holds the message, or rejected it — a later `pending` reply must not undo that. */
+export function journalAnswersInFlightSend(
+  submissions: readonly AgentJournalSubmission[],
+  clientMessageId: string | null
+): boolean {
+  return submissions.some(
+    (submission) =>
+      submission.clientMessageId === clientMessageId && submission.dispatchState !== 'unknown'
+  )
+}
+
 /**
  * What to put on screen for a rejection.
  *
@@ -80,27 +114,81 @@ function refusedRedelivery(
  * a generic string would throw it away. A transport rejection's reason is an
  * internal marker; printing it put `provider_write_failed: broken pipe` in front of
  * users, which names nothing they can act on. That case gets copy that says what
- * happened and that the message is safe to send again — which it is, because the
- * frame provably never left, so a resend cannot duplicate.
+ * happened, and on the phone that the message can be sent again — which it can,
+ * because the frame provably never left, so a resend cannot duplicate.
  *
- * The null default claims no cause, because at that point we know none: all it
- * asserts is the one thing every rejection shares.
+ * The null default claims no cause and no next step, because at that point we know
+ * neither: all it asserts is the one thing every rejection shares.
  *
  * Exported because a client without an outbox needs the same copy: the rule about
  * which reasons a person may read is a property of the reason, not of the queue.
  */
-export function structuredAgentSessionRejectionNotice(reason: string | null): string {
+export function structuredAgentSessionRejectionNotice(
+  reason: string | null,
+  write: 'send' | 'composer-send'
+): string {
+  return agentSessionWriteNoticeEnglish(structuredAgentSessionRejectionParts(reason, write))
+}
+
+export function structuredAgentSessionRejectionParts(
+  reason: string | null,
+  write: 'send' | 'composer-send',
+  /** The host's typed fact, which decides when the row carried one. */
+  fact?: AgentSessionFailureFact,
+  context: AgentSessionFailureWordsContext = {}
+): AgentSessionWriteNoticePart[] {
+  if (fact) {
+    return rejectionFactParts(write, fact, context)
+  }
   if (reason === null) {
-    return 'Message was not sent.'
+    return ['notDoneSend']
   }
-  if (dispatchRejectionWasTransportWriteFailure(reason)) {
-    return "Couldn't reach the agent. Your message was not sent — Retry to send it again."
+  const rejection = classifyDispatchRejection({ reason })
+  if (rejection.kind === 'writeFailed') {
+    return ['unreachable', ...agentSessionWriteNotDoneParts(write)]
   }
-  // Any other reason we minted is an internal cause with no user-facing meaning;
-  // only a provider's own explanation is worth reading verbatim.
-  return dispatchRejectionReasonIsInternal(reason)
-    ? 'Orca could not send your message — Retry to send it again.'
-    : reason
+  // A legacy marker is an internal cause with no user-facing meaning; any other reason is a
+  // sentence written to be read — the provider's, or the host's own.
+  return rejection.kind ? agentSessionWriteNotDoneParts(write) : [{ text: reason }]
+}
+
+function rejectionFactParts(
+  write: 'send' | 'composer-send',
+  fact: AgentSessionFailureFact,
+  context: AgentSessionFailureWordsContext
+): AgentSessionWriteNoticePart[] {
+  const { kind } = classifyDispatchRejection({ reason: null, rejection: fact })
+  if (kind === 'writeFailed') {
+    return ['unreachable', ...agentSessionWriteNotDoneParts(write)]
+  }
+  // A fact this build cannot place proves only that the message did not happen.
+  return kind
+    ? [{ text: agentSessionFailureSentence({ ...fact, kind }, 'rejection', context) }]
+    : agentSessionWriteNotDoneParts(write)
+}
+
+/** Kinds whose words need what the message's copy drops: the provider's detail, or the refusal. */
+const WORDED_FROM_WHOLE_FACT: ReadonlySet<AgentSessionFailureFact['kind']> = new Set<
+  AgentSessionFailureFact['kind']
+>(['providerRejected', 'startFailed', 'restartFailed'])
+
+/** What the Retry row says about why its message did not go through. */
+export function structuredAgentSessionAttemptFailureParts(
+  failure: StructuredAgentSessionAttemptFailure,
+  context: AgentSessionFailureWordsContext = {},
+  /** The journal's whole fact for a recorded rejection, when its submission is loaded: the
+   *  message's own copy keeps only its kind and attachment. */
+  recorded?: AgentSessionFailureFact
+): AgentSessionWriteNoticePart[] {
+  if (failure.kind !== 'rejected') {
+    return agentSessionWriteNoticeParts(failure, 'send', context)
+  }
+  const fact = recorded ?? failure.rejection
+  // Without the journal's fact, the host's sentence still holds what the copy dropped.
+  if (!recorded && fact && WORDED_FROM_WHOLE_FACT.has(fact.kind) && failure.reason !== null) {
+    return [{ text: failure.reason }]
+  }
+  return structuredAgentSessionRejectionParts(failure.reason, 'send', fact, context)
 }
 
 export function disposeStructuredAgentSessionSendResult(
@@ -114,23 +202,41 @@ export function disposeStructuredAgentSessionSendResult(
     const refusedIndex = input.entries.findIndex(
       (candidate) => candidate.clientMessageId === input.entry.clientMessageId
     )
+    const refusal = agentSessionRefusalFailure(result.refusal)
     const entries = input.entries.map((candidate) =>
       candidate.clientMessageId === input.entry.clientMessageId
-        ? requeueStructuredAgentSessionSendRefusal(
-            candidate,
-            result.refusal.code,
-            input.createOperationId,
-            input.entry.lastAttemptAt !== null
+        ? withLastFailure(
+            requeueStructuredAgentSessionSendRefusal(
+              candidate,
+              refusal,
+              input.createOperationId,
+              input.entry.lastAttemptAt !== null
+            ),
+            refusal
           )
         : candidate
     )
+    const refused = entries[refusedIndex]
     return {
       entries,
-      error: result.refusal.message,
+      error: null,
       // Read back by index rather than from the input: a refusal can rotate the id, and the
       // refused entry is not always the head now that an admitted one no longer holds the queue.
-      blockedClientMessageId: entries[refusedIndex]?.clientMessageId ?? null,
-      retryWithFreshClientMessageId: null
+      // A rejected one holds nothing: it can no longer land, and it keeps its own Retry.
+      blockedClientMessageId:
+        !refused || refused.state === 'rejected'
+          ? input.blockedClientMessageId
+          : refused.clientMessageId
+    }
+  }
+  if ('queued' in result.value) {
+    // The host holds the draft (or already settled it, on a replay). Either way
+    // the send is spent and the queue owns it now: the outbox entry retires,
+    // and the draft card — not this queue — carries any later refusal.
+    return {
+      entries: dropEntry(input),
+      error: null,
+      blockedClientMessageId: input.blockedClientMessageId
     }
   }
   const submission = result.value.submission
@@ -138,24 +244,37 @@ export function disposeStructuredAgentSessionSendResult(
     return {
       entries: dropEntry(input),
       error: 'Message delivery is unconfirmed and Orca will not send it again',
-      blockedClientMessageId: input.blockedClientMessageId,
-      retryWithFreshClientMessageId: null
+      blockedClientMessageId: input.blockedClientMessageId
     }
   }
   if (submission.dispatchState === 'accepted') {
     return {
       entries: dropEntry(input),
       error: null,
-      blockedClientMessageId: input.blockedClientMessageId,
-      retryWithFreshClientMessageId: null
+      blockedClientMessageId: input.blockedClientMessageId
+    }
+  }
+  // A Stop's withdrawal failed nothing, first reply or replay: the entry leaves as the reconcile
+  // drops it, with no notice.
+  if (
+    submission.dispatchState === 'rejected' &&
+    classifyDispatchRejection(submission).category === 'withdrawn'
+  ) {
+    return {
+      entries: dropEntry(input),
+      error: null,
+      blockedClientMessageId: input.blockedClientMessageId
     }
   }
   if (submission.dispatchState === 'rejected') {
     return {
-      entries: replaceEntryState(input, 'queued'),
-      error: structuredAgentSessionRejectionNotice(submission.reason),
-      blockedClientMessageId: input.entry.clientMessageId,
-      retryWithFreshClientMessageId: input.entry.clientMessageId
+      entries: replaceEntryState(
+        input,
+        'rejected',
+        structuredAgentSessionRejectedFailure(submission)
+      ),
+      error: null,
+      blockedClientMessageId: input.blockedClientMessageId
     }
   }
   if (submission.dispatchState === 'unknown' && submission.recovered) {
@@ -166,8 +285,7 @@ export function disposeStructuredAgentSessionSendResult(
           : candidate
       ),
       error: null,
-      blockedClientMessageId: input.blockedClientMessageId,
-      retryWithFreshClientMessageId: null
+      blockedClientMessageId: input.blockedClientMessageId
     }
   }
   // `pending` is the host saying the message was written and is awaiting the
@@ -182,8 +300,7 @@ export function disposeStructuredAgentSessionSendResult(
       submission.dispatchState === 'unknown' ? 'unconfirmed' : 'dispatching'
     ),
     error: null,
-    blockedClientMessageId: input.blockedClientMessageId,
-    retryWithFreshClientMessageId: null
+    blockedClientMessageId: input.blockedClientMessageId
   }
 }
 
@@ -196,11 +313,13 @@ export function disposeStructuredAgentSessionSendFailure(
   const failure = classifyStructuredAgentSessionSendFailure(input.cause, input.isDeliveryUnknown)
   const deliveryUnknown = failure === 'delivery-unknown'
   return {
-    entries: replaceEntryState(input, deliveryUnknown ? 'unconfirmed' : 'queued'),
-    error: deliveryUnknown ? 'Message delivery is unconfirmed' : String(input.cause),
+    // An unconfirmed entry's Retry row already says delivery is unconfirmed.
+    entries: deliveryUnknown
+      ? replaceEntryState(input, 'unconfirmed')
+      : replaceEntryState(input, 'queued', { kind: 'failed' }),
+    error: null,
     blockedClientMessageId: deliveryUnknown
       ? input.blockedClientMessageId
-      : input.entry.clientMessageId,
-    retryWithFreshClientMessageId: null
+      : input.entry.clientMessageId
   }
 }
diff --git a/src/shared/structured-agent-session-start-failure-row-key.ts b/src/shared/structured-agent-session-start-failure-row-key.ts
new file mode 100644
index 00000000000..6dc4a4817b1
--- /dev/null
+++ b/src/shared/structured-agent-session-start-failure-row-key.ts
@@ -0,0 +1,17 @@
+// A failed start's one row is keyed by the start, so a reader finds it by identity, not by its words.
+
+import { parseAgentJournalItemKey } from './agent-session-journal-item-key'
+import type { AgentJournalItemIdentity } from './agent-session-journal-types'
+
+const START_FAILURE_ROW = 'start-failure:'
+
+export function structuredAgentSessionStartFailureRowIdentity(
+  startKey: string
+): Extract<AgentJournalItemIdentity, { provider: 'orca' }> {
+  return { provider: 'orca', clientMessageId: `${START_FAILURE_ROW}${startKey}` }
+}
+
+export function isStructuredAgentSessionStartFailureRow(itemId: string): boolean {
+  const identity = parseAgentJournalItemKey(itemId)
+  return identity?.provider === 'orca' && identity.clientMessageId.startsWith(START_FAILURE_ROW)
+}
diff --git a/src/shared/structured-agent-session-status-block.ts b/src/shared/structured-agent-session-status-block.ts
new file mode 100644
index 00000000000..58dbbe9131c
--- /dev/null
+++ b/src/shared/structured-agent-session-status-block.ts
@@ -0,0 +1,18 @@
+import { readAgentSessionFailureFact } from './agent-session-failure'
+import type { AgentJournalStatusItem } from './agent-session-journal-types'
+import type { NativeChatTextBlock } from './native-chat-types'
+
+/** A status row as the line a chat paints: named fields only, so a host-only key never leaks. */
+export function structuredAgentSessionStatusBlock(
+  body: AgentJournalStatusItem
+): NativeChatTextBlock {
+  const failure = readAgentSessionFailureFact(body.failure)
+  return {
+    type: 'text',
+    text: body.text,
+    ...(body.presentation !== undefined ? { presentation: body.presentation } : {}),
+    ...(body.tone !== undefined ? { tone: body.tone } : {}),
+    ...(body.providerFrame ? { providerFrame: body.providerFrame } : {}),
+    ...(failure ? { failure } : {})
+  }
+}
diff --git a/src/shared/structured-agent-session-status-started-at.ts b/src/shared/structured-agent-session-status-started-at.ts
index 54f5b44764f..6588e82026b 100644
--- a/src/shared/structured-agent-session-status-started-at.ts
+++ b/src/shared/structured-agent-session-status-started-at.ts
@@ -10,6 +10,7 @@ import type { AgentJournalRenderItem, AgentJournalSubmission } from './agent-ses
 import { isRootAgentJournalItem } from './agent-session-journal-producer'
 import { readAgentJournalTurn } from './agent-session-turn-record'
 import type { StructuredAgentSessionProjectedStatus } from './structured-agent-session-projection'
+import type { StructuredAgentSessionLatestRequest } from './structured-agent-session-latest-request'
 import type { AgentSessionStatusSummary } from './agent-session-wire'
 import type { AgentMainAgentStatus } from './main-agent-status'
 import type { AgentStatusState } from './agent-status-types'
@@ -20,20 +21,18 @@ export function structuredAgentSessionStatusStartedAt(
   status: StructuredAgentSessionProjectedStatus,
   items: readonly AgentJournalRenderItem[],
   submissions: readonly AgentJournalSubmission[],
-  currentFence?: number | null
+  currentFence: number | null | undefined,
+  latestRequest: Pick<StructuredAgentSessionLatestRequest, 'settledAt'> | null
 ): number | undefined {
   if (status === 'attention') {
     return oldestPendingPromptAt(items)
   }
+  if (status === 'idle') {
+    // The session went idle when the request it reports settled, not when its newest turn did.
+    return latestRequest?.settledAt
+  }
   const turnItem = newestTurnItem(items)
   const turn = readAgentJournalTurn(turnItem?.body)
-  if (status === 'idle') {
-    if (!turnItem || !turn || turn.state === 'running') {
-      return undefined
-    }
-    // A turn recovery settled ended when that settle was written: when the user learns it stopped.
-    return turnItem.recoveredAt ?? turn.completedAt
-  }
   if (turnItem && turn?.state === 'running') {
     // A mid-turn send joins the running turn; it does not restart the stretch.
     return turn.requestedAt ?? turn.startedAt ?? turnItem.observedAt
diff --git a/src/shared/structured-agent-session-turn-bars.test.ts b/src/shared/structured-agent-session-turn-bars.test.ts
new file mode 100644
index 00000000000..30ca3af6a38
--- /dev/null
+++ b/src/shared/structured-agent-session-turn-bars.test.ts
@@ -0,0 +1,592 @@
+import { describe, expect, it } from 'vitest'
+import type {
+  AgentJournalRenderItem,
+  AgentJournalSubmission,
+  AgentJournalTurnLifecycle
+} from './agent-session-journal-types'
+import type { NativeChatMessage } from './native-chat-types'
+import { nativeChatTurnMembership } from './native-chat-turn-membership'
+import {
+  reduceNativeChatTurnTiming,
+  selectNativeChatTurnStatuses,
+  type NativeChatTurnTimingByTurn
+} from './native-chat-turn-status'
+import {
+  selectStructuredAgentSettledTurns,
+  selectStructuredAgentTurnBars,
+  structuredAgentTurnLocalStartedAt,
+  structuredAgentTurnOrigin
+} from './structured-agent-session-turn-timing'
+
+// Host clock of a live Claude repro (journal rows 44-79): prompt A runs a ~60 s tool
+// chain; 4 s later the user sends B, which Claude picks up by interrupting A's turn.
+const T = 1_790_580_000_000
+const PRIOR = { requestedAt: 1_790_579_265_055, startedAt: 1_790_579_270_679 }
+const PRIOR_END = 1_790_579_272_584
+const A = { sent: T + 74_595, started: T + 76_146, ended: T + 92_372 }
+const B = { sent: T + 79_006, started: T + 92_372, ended: T + 144_349 }
+const SESSION = 'claude:55368cfb'
+
+function user(
+  sequence: number,
+  clientMessageId: string,
+  observedAt: number
+): AgentJournalRenderItem {
+  return {
+    itemId: `orca:${clientMessageId}`,
+    revision: 0,
+    sequence,
+    observedAt,
+    body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: clientMessageId }] }
+  }
+}
+
+function turn(
+  sequence: number,
+  observedAt: number,
+  record: AgentJournalTurnLifecycle
+): AgentJournalRenderItem {
+  return {
+    itemId: `legacy:claude:55368cfb:turn-lifecycle%3A${record.turnId}`,
+    revision: 1,
+    sequence,
+    observedAt,
+    body: { kind: 'turn', ...record }
+  }
+}
+
+function tool(sequence: number, observedAt: number): AgentJournalRenderItem {
+  return {
+    itemId: `orca:claude-tool%3A${sequence}`,
+    revision: 1,
+    sequence,
+    observedAt,
+    body: { kind: 'tool-call', name: 'Bash', input: { command: 'sleep 15' }, state: 'running' }
+  }
+}
+
+function accepted(clientMessageId: string, providerItemId: string | null): AgentJournalSubmission {
+  return {
+    clientMessageId,
+    fence: 1,
+    payloadFingerprint: 'fp',
+    dispatchState: providerItemId ? 'accepted' : 'pending',
+    providerItemId,
+    reason: null,
+    submittedAt: 1,
+    resolvedAt: providerItemId ? 2 : null
+  }
+}
+
+const priorTurn = turn(47, PRIOR_END + 153, {
+  turnId: '5901cefd',
+  state: 'completed',
+  ...PRIOR,
+  completedAt: PRIOR_END,
+  durationMs: 6_218,
+  userItemId: `${SESSION}:5901cefd`
+})
+const turn1 = { turnId: '1020ab78', userItemId: `${SESSION}:1020ab78` }
+const turn2 = { turnId: '6891a0bc', userItemId: `${SESSION}:6891a0bc` }
+const history = [user(44, 'prior', PRIOR.requestedAt), priorTurn]
+const priorSubmission = accepted('prior', `${SESSION}:5901cefd`)
+
+/** B sent while turn 1 still runs (rows 54-61). */
+const whileQueued = {
+  turnId: turn1.turnId,
+  items: [
+    ...history,
+    user(54, 'A', A.sent),
+    turn(57, T + 77_224, {
+      ...turn1,
+      state: 'running',
+      startedAt: A.started,
+      requestedAt: A.sent
+    }),
+    tool(58, T + 77_223),
+    user(60, 'B', B.sent)
+  ],
+  submissions: [priorSubmission, accepted('A', turn1.userItemId), accepted('B', null)]
+}
+
+/** Claude ended turn 1 to pick up B (rows 62-65). */
+const turn1Ended = turn(57, A.ended + 1, {
+  ...turn1,
+  state: 'interrupted',
+  startedAt: A.started,
+  requestedAt: A.sent,
+  completedAt: A.ended
+})
+const whileB = {
+  turnId: turn2.turnId,
+  items: [
+    ...history,
+    user(54, 'A', A.sent),
+    turn1Ended,
+    tool(58, T + 92_329),
+    user(60, 'B', B.sent),
+    turn(65, B.started, { ...turn2, state: 'running', startedAt: B.started, requestedAt: B.sent })
+  ],
+  submissions: [priorSubmission, accepted('A', turn1.userItemId), accepted('B', turn2.userItemId)]
+}
+
+/** Both settled (row 78). Claude's own duration for B counts from turn 1's start. */
+const settled = {
+  items: [
+    ...whileB.items.slice(0, -1),
+    turn(65, B.ended + 1, {
+      ...turn2,
+      state: 'completed',
+      startedAt: B.started,
+      requestedAt: B.sent,
+      completedAt: B.ended,
+      durationMs: 69_595
+    })
+  ],
+  submissions: whileB.submissions
+}
+
+function message(id: string, role: NativeChatMessage['role'] = 'user'): NativeChatMessage {
+  return { id, role, blocks: [{ type: 'text', text: id }], timestamp: null, source: 'transcript' }
+}
+
+/** The row whose bar carries the running clock, as a surface places it. These journals are from a
+ *  host that states no row's turn, so the bar follows the running record's named opener. */
+function barOf(
+  transcript: readonly NativeChatMessage[],
+  snapshot: {
+    items: readonly AgentJournalRenderItem[]
+    submissions: readonly AgentJournalSubmission[]
+  }
+): string | undefined {
+  return nativeChatTurnMembership(transcript, snapshot).liveTurnKey
+}
+
+/** The same journal from a host that states each row's turn: a user row belongs to no turn, a
+ *  steer to the turn `steers` names, and any other row to the root turn record before it. */
+function scoped(
+  items: readonly AgentJournalRenderItem[],
+  steers: ReadonlyMap<string, string> = new Map()
+): AgentJournalRenderItem[] {
+  let open: string | null = null
+  return items.map((item) => {
+    const steered = steers.get(item.itemId)
+    if (item.body.kind === 'turn') {
+      open = item.itemId
+    }
+    const turnItemId =
+      steered ??
+      (item.body.kind === 'turn' || (item.body.kind === 'message' && item.body.role === 'user')
+        ? null
+        : open)
+    return {
+      ...item,
+      turnScope: turnItemId ? { kind: 'turn' as const, turnItemId } : { kind: 'thread' as const }
+    }
+  })
+}
+
+describe('a send queued behind a running Claude turn', () => {
+  it('leaves the live bar with the prompt that opened the running turn', () => {
+    const bars = selectStructuredAgentTurnBars(
+      whileQueued.items,
+      whileQueued.submissions,
+      whileQueued.turnId
+    )
+    const transcript = [message('orca:prior'), message('orca:A'), message('orca:B')]
+    expect(barOf(transcript, whileQueued)).toBe('orca:A')
+    // A was sent into an idle session: it counts from its own send, as before.
+    expect(bars.runningTiming).toEqual({
+      state: 'running',
+      startedAt: A.started,
+      requestedAt: A.sent,
+      observedAt: T + 77_224
+    })
+    expect(bars.settledTurns.has('orca:B')).toBe(false)
+  })
+
+  it("moves the bar to B when its own turn opens, counting from A's end", () => {
+    const bars = selectStructuredAgentTurnBars(whileB.items, whileB.submissions, whileB.turnId)
+    const transcript = [message('orca:prior'), message('orca:A'), message('orca:B')]
+    expect(barOf(transcript, whileB)).toBe('orca:B')
+    expect(bars.settledTurns.get('orca:A')).toEqual({ startedAt: A.started, workedSeconds: 17 })
+    expect(bars.runningTiming && structuredAgentTurnOrigin(bars.runningTiming)).toBe(A.ended)
+    // A client attaching 3 s into turn 2 counts 3 s, not the 13 s B waited behind turn 1.
+    expect(structuredAgentTurnLocalStartedAt(bars.runningTiming!, 50_000, B.started + 3_000)).toBe(
+      47_000
+    )
+  })
+
+  it('settles from the same origin the live counter used, so the bars sum to wall time', () => {
+    const settledTurns = selectStructuredAgentSettledTurns(settled.items, settled.submissions)
+    expect(settledTurns.get('orca:A')).toEqual({ startedAt: A.started, workedSeconds: 17 })
+    // Not 65 s from B's send, and not Claude's own 69.6 s, which counts from turn 1's start.
+    expect(settledTurns.get('orca:B')).toEqual({ startedAt: B.started, workedSeconds: 51 })
+    // The turn before A never overlapped a send; its duration is unchanged.
+    expect(settledTurns.get('orca:prior')).toEqual({ startedAt: PRIOR.startedAt, workedSeconds: 7 })
+
+    const liveOriginB = structuredAgentTurnOrigin(
+      selectStructuredAgentTurnBars(whileB.items, whileB.submissions, whileB.turnId).runningTiming!
+    )
+    expect(Math.floor((B.ended - liveOriginB) / 1000)).toBe(51)
+    expect(A.ended - A.sent + (B.ended - liveOriginB)).toBe(B.ended - A.sent)
+    expect(selectStructuredAgentTurnBars(settled.items, settled.submissions, null)).toMatchObject({
+      runningTiming: null
+    })
+  })
+
+  it('shows one live bar under A while B waits, then A settled and B live', () => {
+    const transcript = [message('orca:A'), message('orca:tool', 'assistant'), message('orca:B')]
+    const validTurnKeys = new Set(['orca:A', 'orca:B'])
+    let timing: NativeChatTurnTimingByTurn = {}
+    const pass = (
+      snapshot: { items: AgentJournalRenderItem[]; submissions: AgentJournalSubmission[] },
+      turnId: string,
+      now: number
+    ) => {
+      const bars = selectStructuredAgentTurnBars(snapshot.items, snapshot.submissions, turnId)
+      const activeTurnKey = barOf(transcript, snapshot)!
+      const workingStartedAt = structuredAgentTurnLocalStartedAt(bars.runningTiming!, now, now)
+      timing = reduceNativeChatTurnTiming(timing, {
+        activeTurnKey,
+        validTurnKeys,
+        isWorking: true,
+        workingStartedAt,
+        now
+      })
+      return selectNativeChatTurnStatuses(timing, {
+        activeTurnKey,
+        isWorking: true,
+        workingStartedAt,
+        thinking: false,
+        settledByTurn: bars.settledTurns
+      })
+    }
+
+    const queued = pass(whileQueued, whileQueued.turnId, B.sent + 1_000)
+    expect(timing['orca:A']?.startedAt).toBe(A.sent)
+    expect(timing['orca:B']).toBeUndefined()
+    expect(queued.completedByTurn['orca:B']).toBeUndefined()
+
+    const running = pass(whileB, whileB.turnId, B.started + 1_000)
+    expect(running.completedByTurn['orca:A']?.workedSeconds).toBe(17)
+    expect(running.active?.startedAt).toBe(A.ended)
+  })
+})
+
+describe('a send Codex folds into the running turn', () => {
+  const key = 'codex:thread:t1:0'
+  const items: AgentJournalRenderItem[] = [
+    { ...user(1, 'first', 1_000) },
+    {
+      itemId: 'legacy:codex:s:turn-lifecycle%3At1',
+      revision: 1,
+      sequence: 2,
+      observedAt: 1_200,
+      body: {
+        kind: 'turn',
+        turnId: 't1',
+        state: 'running',
+        userItemId: key,
+        requestedAt: 1_000,
+        startedAt: 1_200
+      }
+    },
+    { ...user(3, 'second', 4_000) }
+  ]
+  const submissions = [accepted('first', key), accepted('second', key)]
+  const ended: AgentJournalRenderItem[] = [
+    items[0]!,
+    {
+      ...items[1]!,
+      observedAt: 9_000,
+      body: {
+        kind: 'turn',
+        turnId: 't1',
+        state: 'completed',
+        userItemId: key,
+        requestedAt: 1_000,
+        startedAt: 1_200,
+        completedAt: 9_000
+      }
+    },
+    items[2]!
+  ]
+  const transcript = [message('orca:first'), message('orca:second')]
+
+  it('keeps exactly one bar, under the opening prompt, live and settled', () => {
+    const live = selectStructuredAgentTurnBars(items, submissions, 't1')
+    expect(barOf(transcript, { items, submissions })).toBe('orca:first')
+    expect(live.runningTiming && structuredAgentTurnOrigin(live.runningTiming)).toBe(1_000)
+
+    let timing: NativeChatTurnTimingByTurn = {}
+    const validTurnKeys = new Set(['orca:first', 'orca:second'])
+    timing = reduceNativeChatTurnTiming(timing, {
+      activeTurnKey: 'orca:first',
+      validTurnKeys,
+      isWorking: true,
+      workingStartedAt: 1_000,
+      now: 4_500
+    })
+    const after = selectStructuredAgentTurnBars(ended, submissions, null)
+    // The turn is over: nothing names an owner, so the key falls back to the newest prompt,
+    // which never ran a turn of its own and so has nothing to settle.
+    const activeTurnKey = barOf(transcript, { items: ended, submissions })!
+    expect(activeTurnKey).toBe('orca:second')
+    timing = reduceNativeChatTurnTiming(timing, {
+      activeTurnKey,
+      validTurnKeys,
+      isWorking: false,
+      workingStartedAt: null,
+      now: 9_500
+    })
+    const statuses = selectNativeChatTurnStatuses(timing, {
+      activeTurnKey,
+      isWorking: false,
+      thinking: false,
+      settledByTurn: after.settledTurns
+    })
+    expect(statuses.active).toBeNull()
+    expect(Object.keys(statuses.completedByTurn)).toEqual(['orca:first'])
+    expect(statuses.completedByTurn['orca:first']?.workedSeconds).toBe(8)
+  })
+})
+
+describe('turns whose host names no opener', () => {
+  it('falls back to the newest prompt for an older host row with no user key', () => {
+    const items = [
+      user(1, 'u1', 1_000),
+      turn(2, 1_100, { turnId: 't1', state: 'running', startedAt: 1_100 }),
+      user(3, 'u2', 2_000)
+    ]
+    expect(barOf([message('orca:u1'), message('orca:u2')], { items, submissions: [] })).toBe(
+      'orca:u2'
+    )
+    // Settled timing keeps its journal-order attribution.
+    expect([...selectStructuredAgentSettledTurns(items).keys()]).toEqual(['orca:u1'])
+  })
+
+  it('anchors a turn the provider opened to its own record, never a bystander prompt', () => {
+    const self = 'legacy:claude:55368cfb:turn-lifecycle%3Aresumed'
+    const items = [
+      user(1, 'u1', 1_000),
+      turn(2, 5_000, {
+        turnId: 'resumed',
+        state: 'running',
+        startedAt: 5_000,
+        userItemId: self
+      })
+    ]
+    expect(barOf([message('orca:u1')], { items, submissions: [] })).toBe(self)
+    // A host that states each row's turn anchors it the same way.
+    expect(barOf([message('orca:u1')], { items: scoped(items), submissions: [] })).toBe(self)
+  })
+
+  it('keeps the running bar on the send Codex opened a turn for before it echoes it', () => {
+    // Codex reports turn/started before hooks and prewarm run, so the turn names its
+    // provider key while the send that opened it is still pending (no alias yet).
+    const key = 'codex:thread:t2:0'
+    const items: AgentJournalRenderItem[] = [
+      user(1, 'first', 1_000),
+      turn(2, 1_100, {
+        turnId: 't1',
+        state: 'completed',
+        userItemId: 'orca:first',
+        startedAt: 1_100,
+        completedAt: 2_000
+      }),
+      tool(3, 1_500),
+      user(4, 'second', 3_000),
+      turn(5, 3_100, { turnId: 't2', state: 'running', startedAt: 3_100, userItemId: key })
+    ]
+    const transcript = [message('orca:first'), message('orca:second')]
+    const submissions = [accepted('first', 'claude:first'), accepted('second', null)]
+    for (const journal of [items, scoped(items)]) {
+      const membership = nativeChatTurnMembership(transcript, { items: journal, submissions })
+      expect(membership.liveTurnKey).toBe('orca:second')
+      expect(membership.turnKeys[1]).toBe('orca:second')
+      // A turn with no send in flight still anchors to its own record.
+      const selfOpened = [accepted('first', 'claude:first'), accepted('second', 'claude:second')]
+      expect(barOf(transcript, { items: journal, submissions: selfOpened })).toBe(
+        'legacy:claude:55368cfb:turn-lifecycle%3At2'
+      )
+    }
+  })
+
+  it('names nothing for the unanchored transcript', () => {
+    expect(nativeChatTurnMembership([message('a', 'assistant')], null).liveTurnKey).toBeUndefined()
+  })
+})
+
+describe('the previous turn has no recorded end', () => {
+  it('leaves an unverifiable turn null and a later send counting from itself', () => {
+    const items = [
+      user(1, 'u1', 1_000),
+      turn(2, 3_000, { turnId: 't1', state: 'unverifiable', userItemId: 'orca:u1' }),
+      user(3, 'u2', 10_000),
+      turn(4, 12_000, {
+        turnId: 't2',
+        state: 'completed',
+        userItemId: 'orca:u2',
+        requestedAt: 10_000,
+        startedAt: 11_000,
+        completedAt: 20_000
+      })
+    ]
+    const settledTurns = selectStructuredAgentSettledTurns(items)
+    expect(settledTurns.get('orca:u1')).toBeNull()
+    expect(settledTurns.get('orca:u2')).toEqual({ startedAt: 11_000, workedSeconds: 10 })
+  })
+
+  it("waits out the previous row's last host revision, never past its own start", () => {
+    const queued = (lastSeenAt: number) =>
+      selectStructuredAgentTurnBars(
+        [
+          user(1, 'u1', 1_000),
+          turn(2, lastSeenAt, {
+            turnId: 't1',
+            state: 'unverifiable',
+            userItemId: 'orca:u1',
+            startedAt: 1_000
+          }),
+          user(3, 'u2', 2_000),
+          turn(4, 9_000, {
+            turnId: 't2',
+            state: 'running',
+            userItemId: 'orca:u2',
+            requestedAt: 2_000,
+            startedAt: 9_000
+          })
+        ],
+        [],
+        't2'
+      ).runningTiming!
+    expect(structuredAgentTurnOrigin(queued(6_000))).toBe(6_000)
+    expect(structuredAgentTurnOrigin(queued(12_000))).toBe(9_000)
+  })
+})
+
+describe('which turn owns each transcript row', () => {
+  /** Each drawn row's turn, by id, as a surface places it. */
+  const keysOf = (snapshot: {
+    items: AgentJournalRenderItem[]
+    submissions: AgentJournalSubmission[]
+  }): ReadonlyMap<string, string | undefined> => {
+    const transcript = snapshot.items.flatMap((item) =>
+      item.body.kind === 'turn'
+        ? []
+        : [
+            message(
+              item.itemId,
+              item.body.kind === 'message' && item.body.role === 'user' ? 'user' : 'tool'
+            )
+          ]
+    )
+    const { turnKeys } = nativeChatTurnMembership(transcript, snapshot)
+    return new Map(transcript.map((row, index) => [row.id, turnKeys[index]]))
+  }
+  const turn1Record = `legacy:claude:55368cfb:turn-lifecycle%3A${turn1.turnId}`
+
+  it('keeps the rows Claude produces after a mid-turn send with the turn that ran them', () => {
+    // The #23621 shape: B lands mid-turn and three tool calls follow, one turn.
+    const items = [
+      user(54, 'A', A.sent),
+      turn(57, T + 77_224, {
+        ...turn1,
+        state: 'running',
+        startedAt: A.started,
+        requestedAt: A.sent
+      }),
+      tool(58, T + 77_300),
+      user(60, 'B', B.sent),
+      tool(61, T + 80_100),
+      tool(62, T + 80_200),
+      tool(63, T + 80_300)
+    ]
+    const submissions = [accepted('A', turn1.userItemId), accepted('B', null)]
+    const steer = new Map([['orca:B', turn1Record]])
+    for (const journal of [items, scoped(items, steer)]) {
+      const keys = keysOf({ items: journal, submissions })
+      expect(keys.get('orca:A')).toBe('orca:A')
+      expect(keys.get('orca:B')).toBe('orca:A')
+      for (const sequence of [58, 61, 62, 63]) {
+        expect(keys.get(`orca:claude-tool%3A${sequence}`)).toBe('orca:A')
+      }
+    }
+  })
+
+  it('leaves a fresh tail send in its own group until the turn proves it continued past it', () => {
+    // B is the newest row: nothing after it says the running turn absorbed it.
+    expect(keysOf(whileQueued).get('orca:B')).toBe('orca:B')
+    // B's own turn opened: B is an opener and keys itself.
+    expect(keysOf(whileB).get('orca:B')).toBe('orca:B')
+    expect(keysOf(whileB).get(`orca:claude-tool%3A58`)).toBe('orca:A')
+  })
+
+  it('folds a Codex-coalesced send into the turn its provider key names', () => {
+    const key = 'codex:thread:t1:0'
+    const record = 'legacy:codex:s:turn-lifecycle%3At1'
+    const items: AgentJournalRenderItem[] = [
+      user(1, 'first', 1_000),
+      {
+        itemId: record,
+        revision: 1,
+        sequence: 2,
+        observedAt: 1_200,
+        body: {
+          kind: 'turn',
+          turnId: 't1',
+          state: 'running',
+          userItemId: key,
+          requestedAt: 1_000,
+          startedAt: 1_200
+        }
+      },
+      user(3, 'second', 4_000),
+      tool(4, 5_000)
+    ]
+    const submissions = [accepted('first', key), accepted('second', key)]
+    for (const journal of [items, scoped(items, new Map([['orca:second', record]]))]) {
+      const keys = keysOf({ items: journal, submissions })
+      expect(keys.get('orca:first')).toBe('orca:first')
+      expect(keys.get('orca:second')).toBe('orca:first')
+      expect(keys.get('orca:claude-tool%3A4')).toBe('orca:first')
+    }
+  })
+
+  it('keys a provider-opened turn and its rows to the turn record itself', () => {
+    const self = 'legacy:claude:55368cfb:turn-lifecycle%3Aresumed'
+    const items = [
+      user(1, 'u1', 1_000),
+      turn(2, 5_000, {
+        turnId: 'resumed',
+        state: 'running',
+        startedAt: 5_000,
+        userItemId: self
+      }),
+      tool(3, 6_000)
+    ]
+    for (const journal of [items, scoped(items)]) {
+      const keys = keysOf({ items: journal, submissions: [] })
+      // u1 predates the wake turn and never opened one: it keeps its own group.
+      expect(keys.get('orca:u1')).toBe('orca:u1')
+      expect(keys.get('orca:claude-tool%3A3')).toBe(self)
+    }
+  })
+
+  it('groups by position for an older host that names no opener', () => {
+    const items = [
+      user(1, 'u1', 1_000),
+      turn(2, 1_100, { turnId: 't1', state: 'running', startedAt: 1_100 }),
+      tool(3, 1_200),
+      user(4, 'u2', 1_300),
+      tool(5, 1_400)
+    ]
+    expect([...keysOf({ items, submissions: [] }).values()]).toEqual([
+      'orca:u1',
+      'orca:u1',
+      'orca:u2',
+      'orca:u2'
+    ])
+  })
+})
diff --git a/src/shared/structured-agent-session-turn-timing.test.ts b/src/shared/structured-agent-session-turn-timing.test.ts
index ba9af94258f..1cf2d32db91 100644
--- a/src/shared/structured-agent-session-turn-timing.test.ts
+++ b/src/shared/structured-agent-session-turn-timing.test.ts
@@ -226,7 +226,7 @@ describe('explicit user-item attribution', () => {
     expect([...selectStructuredAgentTurnTimings(items).keys()]).toEqual(['claude:s:u1'])
   })
 
-  it('attributes nothing when a keyed row names a user item nobody journaled', () => {
+  it('anchors to the record itself when a keyed row names a user item nobody journaled', () => {
     const items = [
       user('orca:first'),
       lifecycle('auto', {
@@ -236,7 +236,11 @@ describe('explicit user-item attribution', () => {
         completedAt: 2_000
       })
     ]
-    expect(selectStructuredAgentTurnTimings(items).size).toBe(0)
+    // Never the preceding prompt, which did not open this turn; the record's own
+    // key gives the turn a bar at its own position instead.
+    expect([...selectStructuredAgentTurnTimings(items).keys()]).toEqual([
+      'legacy:codex:s:turn-lifecycle%3Aauto'
+    ])
   })
 
   it('falls back to journal order only for rows without a key (older hosts)', () => {
diff --git a/src/shared/structured-agent-session-turn-timing.ts b/src/shared/structured-agent-session-turn-timing.ts
index 3f480013886..3f3607638b9 100644
--- a/src/shared/structured-agent-session-turn-timing.ts
+++ b/src/shared/structured-agent-session-turn-timing.ts
@@ -10,6 +10,7 @@ import type {
   AgentJournalTurnLifecycleState
 } from './agent-session-journal-types'
 import { readAgentJournalTurn } from './agent-session-turn-record'
+import { structuredAgentTurnAnchors } from './native-chat-turn-membership'
 import type { NativeChatSettledTurn, NativeChatSettledTurns } from './native-chat-turn-status'
 
 export type StructuredAgentTurnTiming = {
@@ -23,12 +24,18 @@ export type StructuredAgentTurnTiming = {
   completedAt?: number
   /** The provider's own measurement; used when exact host endpoints are unavailable. */
   durationMs?: number
+  /** Host clock this turn's send stopped waiting behind the journal's previous
+   *  turn; present only when the send was issued before that turn ended. */
+  queuedUntil?: number
   /** Host clock when the lifecycle row was appended; with `startedAt` it gives
    *  the host-side lag a client must subtract to anchor a live counter. */
   observedAt: number
 }
 
-function readTiming(item: AgentJournalRenderItem): StructuredAgentTurnTiming | null {
+function readTiming(
+  item: AgentJournalRenderItem,
+  precedingTurnEndedAt: number | undefined
+): StructuredAgentTurnTiming | null {
   const turn = readAgentJournalTurn(item.body)
   if (!turn) {
     return null
@@ -49,55 +56,61 @@ function readTiming(item: AgentJournalRenderItem): StructuredAgentTurnTiming | n
     durationMs !== undefined && Number.isFinite(durationMs) && durationMs >= 0
       ? durationMs
       : undefined
+  // A send queued behind the previous turn counts from that turn's end (recorded, else its row's
+  // last host revision), never past this turn's own start: the provider opens it only after.
+  const queuedUntil =
+    precedingTurnEndedAt === undefined ? undefined : Math.min(precedingTurnEndedAt, startedAt)
   return {
     state,
     startedAt,
     ...(requested !== undefined ? { requestedAt: requested } : {}),
     ...(end !== undefined ? { completedAt: end } : {}),
     ...(measured !== undefined ? { durationMs: measured } : {}),
+    ...(requested !== undefined && queuedUntil !== undefined && queuedUntil > requested
+      ? { queuedUntil }
+      : {}),
     observedAt: item.observedAt
   }
 }
 
-/** Timing keyed by the user message that opened each turn. A row can name the
- *  submission directly or by a provider key that resolves through its alias.
- *  Rows from older hosts carry no key and fall back
- *  to the nearest user message before them in journal order — the submission
- *  row is written ahead of dispatch, so it always precedes the provider's
- *  turn-start. Untimed rows are skipped unless explicitly unverifiable (null). */
+/** Every root turn record in one pass over the journal, keyed by its anchor (see
+ *  `structuredAgentTurnAnchors`: the user message that opened it, or the record itself for a turn
+ *  no message opened) and by provider turn id. Untimed rows are skipped from the anchor map unless
+ *  explicitly unverifiable (null). */
+type StructuredAgentJournalTurns = {
+  byAnchor: ReadonlyMap<string, StructuredAgentTurnTiming | null>
+  byTurnId: ReadonlyMap<string, StructuredAgentTurnTiming | null>
+}
+
+function readStructuredAgentJournalTurns(
+  items: readonly AgentJournalRenderItem[],
+  submissions: readonly AgentJournalSubmission[] = []
+): StructuredAgentJournalTurns {
+  const anchors = structuredAgentTurnAnchors(items, submissions)
+  const byAnchor = new Map<string, StructuredAgentTurnTiming | null>()
+  const byTurnId = new Map<string, StructuredAgentTurnTiming | null>()
+  let precedingTurnEndedAt: number | undefined
+  for (const item of items) {
+    const anchor = anchors.get(item.itemId)
+    const turn = anchor === undefined ? null : readAgentJournalTurn(item.body)
+    if (anchor === undefined || !turn) {
+      continue
+    }
+    const timing = readTiming(item, precedingTurnEndedAt)
+    precedingTurnEndedAt = timing?.completedAt ?? item.observedAt
+    byTurnId.set(turn.turnId, timing)
+    if (timing || turn.state === 'unverifiable') {
+      byAnchor.set(anchor, timing)
+    }
+  }
+  return { byAnchor, byTurnId }
+}
+
 export function selectStructuredAgentTurnTimings(
   items: readonly AgentJournalRenderItem[],
   submissions: readonly AgentJournalSubmission[] = []
 ): ReadonlyMap<string, StructuredAgentTurnTiming | null> {
-  const itemIds = new Set(items.map((item) => item.itemId))
-  const aliases = new Map<string, string>()
-  // Codex folds a send issued mid-turn into the running turn under the SAME provider
-  // key, so the earliest submission that names a key is the prompt that opened the turn.
-  for (const submission of submissions) {
-    if (submission.providerItemId && !aliases.has(submission.providerItemId)) {
-      aliases.set(submission.providerItemId, agentJournalSubmissionKey(submission.clientMessageId))
-    }
-  }
-  const timings = new Map<string, StructuredAgentTurnTiming | null>()
-  let precedingUserItemId: string | null = null
-  for (const item of items) {
-    if (item.body.kind === 'message' && item.body.role === 'user') {
-      precedingUserItemId = item.itemId
-      continue
-    }
-    const turn = readAgentJournalTurn(item.body)
-    const timing = readTiming(item)
-    if (!timing && turn?.state !== 'unverifiable') {
-      continue
-    }
-    const key = turn?.userItemId
-    const userItemId =
-      key === undefined ? precedingUserItemId : itemIds.has(key) ? key : (aliases.get(key) ?? null)
-    if (userItemId !== null) {
-      timings.set(userItemId, timing)
-    }
-  }
-  return timings
+  return readStructuredAgentJournalTurns(items, submissions).byAnchor
 }
 
 /** The live turn's lifecycle timing, or null when its row carries no host start
@@ -106,20 +119,15 @@ export function selectStructuredAgentRunningTurnTiming(
   items: readonly AgentJournalRenderItem[],
   turnId: string
 ): StructuredAgentTurnTiming | null {
-  for (let index = items.length - 1; index >= 0; index -= 1) {
-    const item = items[index]
-    if (item && readAgentJournalTurn(item.body)?.turnId === turnId) {
-      return readTiming(item)
-    }
-  }
-  return null
+  return readStructuredAgentJournalTurns(items).byTurnId.get(turnId) ?? null
 }
 
 /** The single instant every reading of a turn's elapsed time counts from: the
- *  send that opened it when the host named one, the provider turn-open otherwise.
+ *  send that opened it when the host named one — or, for a send queued behind the
+ *  previous turn, that turn's end — and the provider turn-open otherwise.
  *  One origin is what keeps the live counter and the settled duration agreeing. */
 export function structuredAgentTurnOrigin(timing: StructuredAgentTurnTiming): number {
-  return timing.requestedAt ?? timing.startedAt
+  return timing.queuedUntil ?? timing.requestedAt ?? timing.startedAt
 }
 
 /** Whole seconds a settled turn ran, or null when the host never observed its end. */
@@ -129,9 +137,9 @@ export function completedStructuredAgentTurnSeconds(
   if (!timing || (timing.state !== 'completed' && timing.state !== 'interrupted')) {
     return null
   }
-  // Provider durations may begin at turn-open, so exact host endpoints preserve the live origin.
+  // Provider durations may begin before the live origin (turn-open, or a turn this send queued behind).
   if (timing.requestedAt !== undefined && timing.completedAt !== undefined) {
-    return Math.max(0, Math.floor((timing.completedAt - timing.requestedAt) / 1000))
+    return Math.max(0, Math.floor((timing.completedAt - structuredAgentTurnOrigin(timing)) / 1000))
   }
   if (timing.durationMs !== undefined) {
     return Math.floor(timing.durationMs / 1000)
@@ -170,9 +178,16 @@ export function structuredAgentTurnLocalStartedAt(
 export function selectStructuredAgentSettledTurns(
   items: readonly AgentJournalRenderItem[],
   submissions: readonly AgentJournalSubmission[] = []
+): NativeChatSettledTurns {
+  return settledTurnsOf(readStructuredAgentJournalTurns(items, submissions), submissions)
+}
+
+function settledTurnsOf(
+  turns: StructuredAgentJournalTurns,
+  submissions: readonly AgentJournalSubmission[]
 ): NativeChatSettledTurns {
   const settled = new Map<string, NativeChatSettledTurn | null>()
-  for (const [userItemId, timing] of selectStructuredAgentTurnTimings(items, submissions)) {
+  for (const [userItemId, timing] of turns.byAnchor) {
     const workedSeconds = completedStructuredAgentTurnSeconds(timing)
     settled.set(
       userItemId,
@@ -189,3 +204,21 @@ export function selectStructuredAgentSettledTurns(
   }
   return settled
 }
+
+/** Everything a chat surface reads off the journal for its turn bars, from one
+ *  pass: settled durations and the running turn's timing. Which bar carries the
+ *  running clock is the turn membership's answer (`nativeChatTurnMembership`). */
+export function selectStructuredAgentTurnBars(
+  items: readonly AgentJournalRenderItem[],
+  submissions: readonly AgentJournalSubmission[],
+  turnId: string | null
+): {
+  settledTurns: NativeChatSettledTurns
+  runningTiming: StructuredAgentTurnTiming | null
+} {
+  const turns = readStructuredAgentJournalTurns(items, submissions)
+  return {
+    settledTurns: settledTurnsOf(turns, submissions),
+    runningTiming: turnId === null ? null : (turns.byTurnId.get(turnId) ?? null)
+  }
+}
diff --git a/src/shared/structured-agent-session-unanswered-dispatch.ts b/src/shared/structured-agent-session-unanswered-dispatch.ts
index 36c70a357cb..412b3e98196 100644
--- a/src/shared/structured-agent-session-unanswered-dispatch.ts
+++ b/src/shared/structured-agent-session-unanswered-dispatch.ts
@@ -1,4 +1,5 @@
 import type { AgentJournalSubmission } from './agent-session-journal-types'
+import { isQueuedAgentJournalSubmission } from './agent-session-queued-submission'
 
 /** One send the provider has neither opened a turn for nor refused; the rule is explained on
  *  `hasUnansweredStructuredAgentSessionDispatch`, which asks it of every send. */
@@ -6,6 +7,10 @@ export function isUnansweredStructuredAgentSessionDispatch(
   submission: AgentJournalSubmission,
   currentFence?: number | null
 ): boolean {
+  if (isQueuedAgentJournalSubmission(submission)) {
+    // Accepted and still owed to whichever child the host starts next, whatever the fence.
+    return true
+  }
   return (
     (currentFence == null || submission.fence >= currentFence) &&
     (submission.dispatchState === 'pending' ||
@@ -15,3 +20,25 @@ export function isUnansweredStructuredAgentSessionDispatch(
         submission.reason !== 'host_restarted_before_acknowledgement'))
   )
 }
+
+/**
+ * A send the host has journaled that the provider has neither opened a turn for nor refused.
+ *
+ * Codex declares `turn/started` within ~150ms, but Claude's running row can only be written once
+ * the SDK echoes the user message back — a 3.4s median and 18s at p90 on real journals, and no
+ * echo at all while it retries a rate-limited request. Waiting on that echo to call a session
+ * working leaves the whole gap reading idle in the chat and in every session list, so the send
+ * itself is the evidence.
+ *
+ * A live `unknown` still counts because an ambiguous adapter reply does not prove the provider
+ * stopped. A recovered `unknown` does not — it outlived the host generation that sent it, so
+ * there is nothing still running to report.
+ */
+export function hasUnansweredStructuredAgentSessionDispatch(
+  submissions: readonly AgentJournalSubmission[],
+  currentFence?: number | null
+): boolean {
+  return submissions.some((submission) =>
+    isUnansweredStructuredAgentSessionDispatch(submission, currentFence)
+  )
+}
diff --git a/src/shared/structured-session-marker.ts b/src/shared/structured-session-marker.ts
index 36c90f432ee..c30dc5a6139 100644
--- a/src/shared/structured-session-marker.ts
+++ b/src/shared/structured-session-marker.ts
@@ -1,13 +1,18 @@
 /**
- * The marker a structured chat session's child carries when it has NO orchestration identity.
+ * Marks a structured session's child. It names nothing — no handle, no pane key, no token.
  *
- * It names nothing on purpose — no handle, no pane key, no session id, no token — so it grants no
- * authority and cannot be replayed or impersonated. Its only job is to let a CLI verb that would
- * otherwise GUESS an implicit terminal refuse instead: a structured session has no pane, so every
- * guess resolves to a sibling, and `orchestration check` is destructive by default.
+ * Every structured child now also carries its injected session id, and a current CLI checks the id
+ * first, so for it the marker only matters when the id is absent: a child spawned by an Orca that
+ * predates injection. The marker is still written for the opposite case, a CLI that predates the
+ * id, which refuses on it. Either way the answer is refuse, never guess: a structured session has
+ * no pane, so every implicit-terminal guess resolves to a sibling, and `orchestration check` is
+ * destructive by default.
+ *
+ * The reader answers only "does this process carry the marker": a current CLI reaches it after the
+ * id check has already returned, which is what makes a marked child with an id act as its session.
  */
 export const ORCA_STRUCTURED_SESSION_ENV = 'ORCA_STRUCTURED_SESSION'
 
-export function isStructuredSessionWithoutIdentity(env: NodeJS.ProcessEnv = process.env): boolean {
+export function hasStructuredSessionMarker(env: NodeJS.ProcessEnv = process.env): boolean {
   return (env[ORCA_STRUCTURED_SESSION_ENV] ?? '').length > 0
 }
diff --git a/src/shared/structured-worker-handle.ts b/src/shared/structured-worker-handle.ts
new file mode 100644
index 00000000000..c9fd3927c02
--- /dev/null
+++ b/src/shared/structured-worker-handle.ts
@@ -0,0 +1,7 @@
+// Deliberately not `term_`: `issueHandle` revalidates the renderer graph epoch against the
+// renderer-driven leaves map, so a main-minted `term_` leaf evaporates on the next window reload.
+export const STRUCTURED_WORKER_HANDLE_PREFIX = 'structworker_'
+
+export function isStructuredWorkerHandle(handle: string | null | undefined): handle is string {
+  return typeof handle === 'string' && handle.startsWith(STRUCTURED_WORKER_HANDLE_PREFIX)
+}
diff --git a/src/shared/telemetry-agent-token-usage-schema.ts b/src/shared/telemetry-agent-token-usage-schema.ts
new file mode 100644
index 00000000000..18a3d4a08d5
--- /dev/null
+++ b/src/shared/telemetry-agent-token-usage-schema.ts
@@ -0,0 +1,23 @@
+import { z } from 'zod'
+
+const tokenCount = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER)
+
+export const agentTokenCountsSchema = z
+  .object({
+    input_tokens: tokenCount,
+    output_tokens: tokenCount,
+    cached_input_tokens: tokenCount,
+    cache_write_input_tokens: tokenCount
+  })
+  .strict()
+
+export const agentTokenUsageSchema = agentTokenCountsSchema
+  .extend({
+    provider: z.enum(['claude', 'codex', 'opencode']),
+    analytics_session_id: z.uuidv4(),
+    revision: z.number().int().positive().max(Number.MAX_SAFE_INTEGER)
+  })
+  .strict()
+
+export type AgentTokenCounts = z.infer<typeof agentTokenCountsSchema>
+export type AgentTokenUsage = z.infer<typeof agentTokenUsageSchema>
diff --git a/src/shared/telemetry-daemon-event-schemas.ts b/src/shared/telemetry-daemon-event-schemas.ts
index 26762e5a52e..9632e75bd05 100644
--- a/src/shared/telemetry-daemon-event-schemas.ts
+++ b/src/shared/telemetry-daemon-event-schemas.ts
@@ -201,6 +201,19 @@ export const settingsChangedSchema = z
   })
   .strict()
 
+// Why: profile-state cutover needs fleet-level evidence that authority selection and migration
+// agree with the rollout plan. Keep this enum-only: paths, profile IDs, and serialized state never
+// belong in telemetry.
+export const profileStateAuthoritySelectedSchema = z
+  .object({
+    backend: z.enum(['json', 'sqlite']),
+    classification: z.enum(['neither', 'json-only', 'sqlite-only', 'both']),
+    authority_mode: z.enum(['legacy', 'sqlite-candidate', 'sqlite-established']),
+    runtime: z.enum(['desktop', 'orcad']),
+    migrated: z.boolean()
+  })
+  .strict()
+
 // Managed-hook installer label from `AGENT_HOOK_TARGETS`, distinct from `AGENT_KIND_VALUES`; `claude` (not `claude-code`) is intentional.
 export const hookInstallAgentSchema = z.enum(AGENT_HOOK_TARGETS)
 export type HookInstallAgent = z.infer<typeof hookInstallAgentSchema>
diff --git a/src/shared/telemetry-event-registry.ts b/src/shared/telemetry-event-registry.ts
index 810ba8b35d1..f24e60eccd2 100644
--- a/src/shared/telemetry-event-registry.ts
+++ b/src/shared/telemetry-event-registry.ts
@@ -1,3 +1,4 @@
+import { agentTokenUsageSchema } from './telemetry-agent-token-usage-schema'
 import {
   agentErrorSchema,
   agentPromptSentSchema,
@@ -21,6 +22,7 @@ import {
   daemonPtyCwdVerdictSchema,
   daemonStartFailedSchema,
   mainThreadHangDetectedSchema,
+  profileStateAuthoritySelectedSchema,
   remoteOutboundBudgetCloseSchema,
   runtimeRpcStartFailedSchema,
   settingsChangedSchema
@@ -115,6 +117,7 @@ export const eventSchemas = {
   setup_script_prompt_shown: setupScriptPromptShownSchema,
   setup_script_prompt_action: setupScriptPromptActionSchema,
 
+  agent_token_usage: agentTokenUsageSchema,
   agent_started: agentStartedSchema,
   agent_prompt_sent: agentPromptSentSchema,
   agent_error: agentErrorSchema,
@@ -132,6 +135,7 @@ export const eventSchemas = {
   daemon_audit_eligibility: daemonAuditEligibilitySchema,
   runtime_rpc_start_failed: runtimeRpcStartFailedSchema,
   remote_outbound_budget_close: remoteOutboundBudgetCloseSchema,
+  profile_state_authority_selected: profileStateAuthoritySelectedSchema,
 
   codex_trust_grant: codexTrustGrantSchema,
 
diff --git a/src/shared/telemetry-events.ts b/src/shared/telemetry-events.ts
index c2cf9036dc0..d1bec760ecd 100644
--- a/src/shared/telemetry-events.ts
+++ b/src/shared/telemetry-events.ts
@@ -49,6 +49,7 @@ export {
 } from './telemetry-app-event-schemas'
 export {
   hookInstallAgentSchema,
+  profileStateAuthoritySelectedSchema,
   runtimeRpcStartErrorClassSchema
 } from './telemetry-daemon-event-schemas'
 export type { HookInstallAgent, RuntimeRpcStartErrorClass } from './telemetry-daemon-event-schemas'
diff --git a/src/shared/telemetry-property-schemas.ts b/src/shared/telemetry-property-schemas.ts
index 903af48e959..a45a2f8d9f2 100644
--- a/src/shared/telemetry-property-schemas.ts
+++ b/src/shared/telemetry-property-schemas.ts
@@ -10,6 +10,7 @@ import type { GlobalSettings } from './global-settings-types'
 export const AGENT_KIND_VALUES = [
   'claude-code',
   'claude-agent-teams',
+  'codebuddy',
   'openclaude',
   'codex',
   'autohand',
@@ -19,6 +20,7 @@ export const AGENT_KIND_VALUES = [
   'pi',
   'omp',
   'prime-agent',
+  'qoder',
   'gemini',
   'antigravity',
   'aider',
@@ -30,6 +32,7 @@ export const AGENT_KIND_VALUES = [
   'aug',
   'cline',
   'codebuff',
+  'freebuff',
   'command-code',
   'continue',
   'cursor',
@@ -46,6 +49,7 @@ export const AGENT_KIND_VALUES = [
   'ante',
   'trae',
   'muse',
+  'dsh',
   'zcode',
   'other'
 ] as const
@@ -137,6 +141,10 @@ export const launchSourceSchema = z.enum([
   'conflict_resolution',
   'source_control_recovery',
   'terminal_context_menu',
+  // Launches the host performs for a caller outside the desktop app.
+  'cli',
+  'mobile',
+  'orchestration',
   'unknown'
 ])
 export type LaunchSource = z.infer<typeof launchSourceSchema>
diff --git a/src/shared/terminal-input-kind.ts b/src/shared/terminal-input-kind.ts
new file mode 100644
index 00000000000..f9cef0e2a18
--- /dev/null
+++ b/src/shared/terminal-input-kind.ts
@@ -0,0 +1,8 @@
+/**
+ * Why bytes are written to a PTY. Every host write entry point takes one, so no producer inherits
+ * a transport's default.
+ * - `driving`: input that drives the run, from a person or any client, driver or agent acting on it.
+ * - `launch`: bytes Orca writes to start the run: startup commands, a create-time draft or prompt.
+ * - `query-reply`: the terminal's automatic answer to a query the running program made.
+ */
+export type TerminalInputKind = 'driving' | 'launch' | 'query-reply'
diff --git a/src/shared/terminal-kitty-keyboard-mode-tracker.test.ts b/src/shared/terminal-kitty-keyboard-mode-tracker.test.ts
index d3c6334c921..7dbf7b94e1a 100644
--- a/src/shared/terminal-kitty-keyboard-mode-tracker.test.ts
+++ b/src/shared/terminal-kitty-keyboard-mode-tracker.test.ts
@@ -1,5 +1,7 @@
+import { Terminal } from '@xterm/headless'
 import { describe, expect, it } from 'vitest'
 import { TerminalKittyKeyboardModeTracker } from './terminal-kitty-keyboard-mode-tracker'
+import { CONFIRMED_SHELL_MODE_RESET } from './terminal-mode-reset-profiles'
 
 describe('TerminalKittyKeyboardModeTracker', () => {
   it('starts inactive and ignores non-kitty sequences', () => {
@@ -68,6 +70,33 @@ describe('TerminalKittyKeyboardModeTracker', () => {
     expect(tracker.flags).toBe(0)
   })
 
+  // Why: a confirmed-shell reset lands between live chunks in both records, so they must agree.
+  it('agrees with xterm when the confirmed-shell reset interrupts a split live sequence', async () => {
+    const term = new Terminal({ allowProposedApi: true, vtExtensions: { kittyKeyboard: true } })
+    const tracker = new TerminalKittyKeyboardModeTracker()
+    const replies: string[] = []
+    term.onData((data) => replies.push(data))
+    const feed = (data: string): Promise<void> => {
+      tracker.scan(data)
+      return new Promise((resolve) => term.write(data, resolve))
+    }
+    const xtermReport = async (): Promise<string> => {
+      replies.length = 0
+      await new Promise<void>((resolve) => term.write('\x1b[?u', resolve))
+      return replies.join('')
+    }
+
+    await feed('\x1b[>5u\x1b[?1049h\x1b[>3u\x1b[>')
+    await feed(CONFIRMED_SHELL_MODE_RESET)
+    await feed('1u')
+    expect(tracker.flags).toBe(0)
+    expect(await xtermReport()).toBe('\x1b[?0u')
+    await feed('\x1b[?1049l')
+    expect(tracker.flags).toBe(5)
+    expect(await xtermReport()).toBe('\x1b[?5u')
+    term.dispose()
+  })
+
   it('keeps per-screen flags across alternate-screen switches', () => {
     const tracker = new TerminalKittyKeyboardModeTracker()
     tracker.scan('\x1b[>1u')
@@ -315,4 +344,14 @@ describe('TerminalKittyKeyboardModeTracker', () => {
       expect(softReset.hasProvenBaseline).toBe(true)
     })
   })
+
+  // Why: xterm ignores CSI u while the protocol is withheld, so the mirror must stay at 0 too.
+  it('ignores kitty sequences and snapshot flags when the protocol is withheld', () => {
+    const tracker = new TerminalKittyKeyboardModeTracker({ kittyKeyboard: false })
+    tracker.scan('\x1b[>5u\x1b[=31u')
+    expect(tracker.flags).toBe(0)
+    tracker.resetForSnapshot()
+    tracker.restoreSnapshotFlags(31)
+    expect(tracker.flags).toBe(0)
+  })
 })
diff --git a/src/shared/terminal-kitty-keyboard-mode-tracker.ts b/src/shared/terminal-kitty-keyboard-mode-tracker.ts
index 032fc4ec991..6b2b0e26f83 100644
--- a/src/shared/terminal-kitty-keyboard-mode-tracker.ts
+++ b/src/shared/terminal-kitty-keyboard-mode-tracker.ts
@@ -19,14 +19,13 @@ type KittyStackFrame = { flags: number; known: boolean }
  * DECSET/DECRST 47/1047/1049, the full reset on RIS, and the soft reset on
  * DECSTR (CSI ! p).
  *
- * Why a mirror instead of reading xterm's internal state: Orca defensively
- * wipes the renderer terminal's kitty flags at moments when the TUI may have
- * died (Ctrl+C interrupts, reattach resets) while the TUI is usually still
- * alive and expecting protocol-encoded input. This tracker is fed only by
- * application output, so it reflects what the *application* negotiated,
- * independent of renderer-side defensive writes. The daemon reuses it to
- * carry flags into snapshots (xterm's SerializeAddon does not serialize kitty
- * state).
+ * Why a mirror instead of reading xterm's internal state: xterm's public API
+ * exposes no kitty flags. The renderer scans application output as it queues
+ * it and every mode write of its own; wherever xterm may skip or discard
+ * scanned bytes (snapshot replays, abandoned restores) the renderer re-asserts
+ * the mirror's flags into xterm, so their active-screen flags converge.
+ * The daemon reuses it to carry flags into snapshots (xterm's SerializeAddon does
+ * not serialize kitty state).
  */
 export class TerminalKittyKeyboardModeTracker {
   private scanTail = ''
@@ -48,6 +47,12 @@ export class TerminalKittyKeyboardModeTracker {
   // one. Grounding flips on evidence only: an explicit fresh-PTY reset, a
   // proven snapshot restore, or scanned bytes that state flags absolutely.
   private baselineProven = false
+  private readonly kittyKeyboard: boolean
+
+  /** `kittyKeyboard: false` mirrors an xterm with the protocol withheld, which ignores `CSI u`. */
+  constructor(options: { kittyKeyboard?: boolean } = {}) {
+    this.kittyKeyboard = options.kittyKeyboard ?? true
+  }
 
   /**
    * Current effective kitty keyboard flags. `0` doubles as the conservative
@@ -128,7 +133,7 @@ export class TerminalKittyKeyboardModeTracker {
    */
   restoreSnapshotFlags(flags: number): void {
     const parsed = parseTerminalKittyKeyboardFlags(flags)
-    if (parsed === undefined) {
+    if (parsed === undefined || !this.kittyKeyboard) {
       return
     }
     this.currentFlags = parsed
@@ -183,7 +188,9 @@ export class TerminalKittyKeyboardModeTracker {
         this.applyScreenSwitch(match[1], match[2] === 'h')
         continue
       }
-      this.applyKittySequence(match[3], match[4] ?? '', replay)
+      if (this.kittyKeyboard) {
+        this.applyKittySequence(match[3], match[4] ?? '', replay)
+      }
     }
   }
 
diff --git a/src/shared/terminal-mode-reset-profiles.test.ts b/src/shared/terminal-mode-reset-profiles.test.ts
index d3de25ea4fe..203d836a3f8 100644
--- a/src/shared/terminal-mode-reset-profiles.test.ts
+++ b/src/shared/terminal-mode-reset-profiles.test.ts
@@ -10,9 +10,13 @@ import {
   PROCESS_BOUNDARY_GROUND,
   RESET_GRAPHIC_RENDITION,
   RESET_MOUSE_REPORTING,
+  buildKittyKeyboardRestore,
   buildPostReplayLiveAgentReattachReset,
+  CONFIRMED_SHELL_MODE_RESET,
+  POST_REPLAY_DEAD_TUI_RESET,
   replayPayloadEndsWithCursorHidden
 } from './terminal-mode-reset-profiles'
+import { TerminalKittyKeyboardModeTracker } from './terminal-kitty-keyboard-mode-tracker'
 
 // Why literal expectations: consumers import these constants, so only a byte-level
 // assertion here can catch a profile silently losing a mode it is meant to clear.
@@ -31,7 +35,7 @@ describe('terminal mode reset profiles', () => {
 
   it('pins the daemon-reattach profile, which keeps bracketed paste', () => {
     expect(POST_REPLAY_REATTACH_RESET).toBe(
-      '\x1b[0m\x1b[0 q\x1b[<99u\x1b[=0u\x1b[?25h\x1b[?9l\x1b[?1000l\x1b[?1002l\x1b[?1003l\x1b[?1006l\x1b[?1016l\x1b[?1004l\x1b7'
+      '\x1b[0m\x1b[0 q\x1b[?25h\x1b[?9l\x1b[?1000l\x1b[?1002l\x1b[?1003l\x1b[?1006l\x1b[?1016l\x1b[?1004l\x1b7'
     )
     expect(POST_REPLAY_REATTACH_RESET).toContain(RESET_GRAPHIC_RENDITION)
     expect(POST_REPLAY_REATTACH_RESET).not.toContain('\x1b[?2004l')
@@ -41,9 +45,7 @@ describe('terminal mode reset profiles', () => {
   // so this profile can reach a plain shell, where armed focus reporting rings BEL on every pane
   // switch. Dropping it would also make this byte-identical to the live-agent profile.
   it('pins the live alternate-screen profile, which keeps mouse reporting but not focus', () => {
-    expect(POST_REPLAY_REATTACH_RESET_KEEP_MOUSE).toBe(
-      '\x1b[0 q\x1b[<99u\x1b[=0u\x1b[?25h\x1b[?1004l'
-    )
+    expect(POST_REPLAY_REATTACH_RESET_KEEP_MOUSE).toBe('\x1b[0 q\x1b[?25h\x1b[?1004l')
     expect(POST_REPLAY_REATTACH_RESET_KEEP_MOUSE).not.toContain(RESET_MOUSE_REPORTING)
     expect(POST_REPLAY_REATTACH_RESET_KEEP_MOUSE).not.toBe(POST_REPLAY_LIVE_AGENT_REATTACH_RESET)
   })
@@ -87,7 +89,7 @@ describe('terminal mode reset profiles', () => {
   // coverage asserts they were passed through unchanged — need a literal here.
   it('pins the live-snapshot and live-agent profiles', () => {
     expect(POST_REPLAY_LIVE_SNAPSHOT_RESET).toBe('\x1b[0 q\x1b[?25h\x1b[?1004l')
-    expect(POST_REPLAY_LIVE_AGENT_REATTACH_RESET).toBe('\x1b[0 q\x1b[<99u\x1b[=0u\x1b[?25h')
+    expect(POST_REPLAY_LIVE_AGENT_REATTACH_RESET).toBe('\x1b[0 q\x1b[?25h')
     expect(POST_REPLAY_LIVE_AGENT_SNAPSHOT_RESET).toBe('\x1b[0 q')
   })
 
@@ -116,4 +118,57 @@ describe('terminal mode reset profiles', () => {
       expect(buildPostReplayLiveAgentReattachReset('x\x1b[?25h')).toContain('\x1b[?25h')
     })
   })
+
+  // Why: a live reattach must keep the app's negotiated flags; the epilogue restores them instead.
+  it('keeps Kitty resets out of every live reattach profile', () => {
+    for (const profile of [
+      POST_REPLAY_REATTACH_RESET,
+      POST_REPLAY_REATTACH_RESET_KEEP_MOUSE,
+      POST_REPLAY_DEAD_TUI_RESET,
+      POST_REPLAY_LIVE_AGENT_REATTACH_RESET,
+      POST_REPLAY_LIVE_SNAPSHOT_RESET,
+      POST_REPLAY_LIVE_AGENT_SNAPSHOT_RESET,
+      buildPostReplayLiveAgentReattachReset('x\x1b[?25l')
+    ]) {
+      // oxlint-disable-next-line no-control-regex -- terminal escape sequences require control chars
+      expect(profile).not.toMatch(/\x1b\[[<=>][0-9;]*u/)
+    }
+    expect(CONFIRMED_SHELL_MODE_RESET).toBe(`${POST_REPLAY_REATTACH_RESET}\x1b[<99u\x1b[=0u`)
+  })
+
+  it('restores proven Kitty flags and only pops unproven ones', () => {
+    expect(buildKittyKeyboardRestore(5)).toBe('\x1b[<99u\x1b[=5u')
+    expect(buildKittyKeyboardRestore(undefined)).toBe('\x1b[<99u')
+  })
+
+  // Why: xterm pushes a relay-redelivered push again while the mirror applies it as a set, so
+  // without the pop-all the app's single pop would leave xterm on the stale frame.
+  it("brings xterm and the mirror to 0 on the app's pop after a redelivered push", async () => {
+    const term = new Terminal({ allowProposedApi: true, vtExtensions: { kittyKeyboard: true } })
+    const mirror = new TerminalKittyKeyboardModeTracker()
+    const replies: string[] = []
+    term.onData((data) => replies.push(data))
+    const write = (data: string): Promise<void> =>
+      new Promise((resolve) => term.write(data, resolve))
+    const xtermFlags = async (): Promise<string> => {
+      replies.length = 0
+      await write('\x1b[?u')
+      return replies.join('')
+    }
+    for (const redelivery of ['\x1b[>1u', '\x1b[>1u']) {
+      mirror.scanReplay(redelivery)
+      await write(redelivery)
+    }
+    const restore = buildKittyKeyboardRestore(mirror.snapshotFlags)
+    mirror.scan(restore)
+    await write(restore)
+    expect(mirror.flags).toBe(1)
+    expect(await xtermFlags()).toBe('\x1b[?1u')
+
+    mirror.scan('\x1b[<u')
+    await write('\x1b[<u')
+    expect(mirror.flags).toBe(0)
+    expect(await xtermFlags()).toBe('\x1b[?0u')
+    term.dispose()
+  })
 })
diff --git a/src/shared/terminal-mode-reset-profiles.ts b/src/shared/terminal-mode-reset-profiles.ts
index 50d6d3aa8e0..a219c2d70d0 100644
--- a/src/shared/terminal-mode-reset-profiles.ts
+++ b/src/shared/terminal-mode-reset-profiles.ts
@@ -6,6 +6,16 @@
 // Why: SerializeAddon replays mode bits assuming reattach to a live TUI, but Orca restores against a fresh shell with none, so stale bits (e.g. focus reporting rings the bell on click) must be reset.
 export const RESET_TERMINAL_CURSOR_STYLE = '\x1b[0 q'
 export const RESET_KITTY_KEYBOARD_PROTOCOL = '\x1b[<99u\x1b[=0u'
+
+/**
+ * Re-asserts replayed Kitty flags. Pop-all first, so a push a replay
+ * redelivered into xterm's stack cannot resurface on the app's next pop.
+ * Unproven flags only pop, which lands on 0 without proving it.
+ */
+export function buildKittyKeyboardRestore(provenFlags: number | undefined): string {
+  return provenFlags === undefined ? '\x1b[<99u' : `\x1b[<99u\x1b[=${provenFlags}u`
+}
+
 // Why: abandoned byte-gap replay drains live chunks, so a dropped intensity reset must not style them (STA-4042).
 export const RESET_GRAPHIC_RENDITION = '\x1b[0m'
 // Last so a dead process cannot leave stale attributes in the DECSC register.
@@ -17,11 +27,15 @@ export const RESET_MOUSE_REPORTING =
 // Why: serialized panes can end with a live pen, but the following shell assumes default attributes.
 export const POST_REPLAY_MODE_RESET = `${RESET_GRAPHIC_RENDITION}${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}\x1b[?25h${RESET_MOUSE_REPORTING}\x1b[?1004l\x1b[?2004l${SAVE_GROUNDED_CURSOR}`
 
-// Why: same-session live replay; keep cursor/focus cleanup but preserve Kitty flags the running TUI relies on.
+// Why: same-session live replay; keep cursor/focus cleanup (the replay epilogue re-asserts Kitty flags).
 export const POST_REPLAY_LIVE_SNAPSHOT_RESET = `${RESET_TERMINAL_CURSOR_STYLE}\x1b[?25h\x1b[?1004l`
 
 // Why: the normal-buffer fallback can follow a dead TUI, so its stale pen and saved pen must not reach the surviving shell.
-export const POST_REPLAY_REATTACH_RESET = `${RESET_GRAPHIC_RENDITION}${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}\x1b[?25h${RESET_MOUSE_REPORTING}\x1b[?1004l${SAVE_GROUNDED_CURSOR}`
+// No Kitty reset in any reattach profile: the replay epilogue restores the host's flags instead.
+export const POST_REPLAY_REATTACH_RESET = `${RESET_GRAPHIC_RENDITION}${RESET_TERMINAL_CURSOR_STYLE}\x1b[?25h${RESET_MOUSE_REPORTING}\x1b[?1004l${SAVE_GROUNDED_CURSOR}`
+
+// Why: a foreground proof says the app is gone, so its Kitty flags go with its other modes.
+export const CONFIRMED_SHELL_MODE_RESET = `${POST_REPLAY_REATTACH_RESET}${RESET_KITTY_KEYBOARD_PROTOCOL}`
 
 // Why: a foreground shell proves an alternate-screen owner died without its
 // ?1049l cleanup; leave the renderer on the shell's normal buffer as well.
@@ -30,10 +44,10 @@ export const POST_REPLAY_DEAD_TUI_RESET = `\x1b[?1049l${POST_REPLAY_REATTACH_RES
 // Why: an alt-screen reattach replays the daemon's rehydrateSequences, which re-arm the live TUI's
 // mouse modes; wiping them one write later hands drags back to xterm's row selection (#8291).
 // Normal-buffer panes keep RESET_MOUSE_REPORTING so a dead TUI's stale modes never reach a shell (#7893).
-export const POST_REPLAY_REATTACH_RESET_KEEP_MOUSE = `${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}\x1b[?25h\x1b[?1004l`
+export const POST_REPLAY_REATTACH_RESET_KEEP_MOUSE = `${RESET_TERMINAL_CURSOR_STYLE}\x1b[?25h\x1b[?1004l`
 
 // Why: a live agent owns focus reporting; resetting ?1004h suppresses the focus-in it needs to re-anchor its cursor (IME).
-export const POST_REPLAY_LIVE_AGENT_REATTACH_RESET = `${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}\x1b[?25h`
+export const POST_REPLAY_LIVE_AGENT_REATTACH_RESET = `${RESET_TERMINAL_CURSOR_STYLE}\x1b[?25h`
 
 // Why: a live agent owns cursor/focus here; forcing ?25h/?1004l breaks a parked agent that only arms ?1004h at startup.
 export const POST_REPLAY_LIVE_AGENT_SNAPSHOT_RESET = RESET_TERMINAL_CURSOR_STYLE
@@ -134,6 +148,6 @@ export function replayPayloadEndsWithCursorHidden(payload: string): boolean {
 // Why: some agents hide the real cursor and draw their own, so preserve the payload's final visibility (pty-connection re-shows it if the agent was actually a dead TUI).
 export function buildPostReplayLiveAgentReattachReset(payload: string): string {
   return replayPayloadEndsWithCursorHidden(payload)
-    ? `${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}`
+    ? RESET_TERMINAL_CURSOR_STYLE
     : POST_REPLAY_LIVE_AGENT_REATTACH_RESET
 }
diff --git a/src/shared/terminal-osc133-command-finished.ts b/src/shared/terminal-osc133-command-finished.ts
index 9468e1aaa5f..f0a9831d029 100644
--- a/src/shared/terminal-osc133-command-finished.ts
+++ b/src/shared/terminal-osc133-command-finished.ts
@@ -59,15 +59,19 @@ export type Osc133CommandFinishedScanner = {
 
 export function createOsc133CommandFinishedScanner(
   onCommandFinished: (bestEffortExitCode: number | null) => void,
-  /** OSC 133;C — the shell exec'd a command; the pane's foreground changed. */
-  onCommandStarted?: () => void
+  /**
+   * OSC 133;C — the shell exec'd a command; the pane's foreground changed.
+   * `endInChunk` is the index in the scanned chunk just past the sequence, where the command's own
+   * output begins.
+   */
+  onCommandStarted?: (endInChunk: number) => void
 ): Osc133CommandFinishedScanner {
   let carry = ''
 
-  const handleOsc133 = (payload: string): void => {
+  const handleOsc133 = (payload: string, endInChunk: number): void => {
     const [sequence, exitCode] = payload.split(';')
     if (sequence === 'C') {
-      onCommandStarted?.()
+      onCommandStarted?.(endInChunk)
       return
     }
     if (sequence === 'D') {
@@ -77,6 +81,8 @@ export function createOsc133CommandFinishedScanner(
 
   const scan = (data: string): void => {
     let combined = carry + data
+    // `combined` starts at this index in `data`; negative while it still holds the carry.
+    let combinedStartInChunk = -carry.length
     carry = ''
 
     while (combined.length > 0) {
@@ -97,8 +103,13 @@ export function createOsc133CommandFinishedScanner(
         return
       }
 
-      handleOsc133(combined.slice(payloadStart, terminator.index))
-      combined = combined.slice(terminator.index + terminator.length)
+      const sequenceEnd = terminator.index + terminator.length
+      handleOsc133(
+        combined.slice(payloadStart, terminator.index),
+        combinedStartInChunk + sequenceEnd
+      )
+      combined = combined.slice(sequenceEnd)
+      combinedStartInChunk += sequenceEnd
     }
   }
 
diff --git a/src/shared/terminal-platform-defaults.ts b/src/shared/terminal-platform-defaults.ts
new file mode 100644
index 00000000000..998de73d81b
--- /dev/null
+++ b/src/shared/terminal-platform-defaults.ts
@@ -0,0 +1,19 @@
+// Why: only the initial value shown in Settings; buildFontFamily() adds the real cross-platform fallback chain.
+export function defaultTerminalFontFamily(): string {
+  const platform = typeof process !== 'undefined' ? process.platform : ''
+  if (platform === 'win32') {
+    return 'Cascadia Mono'
+  }
+  if (platform === 'linux') {
+    return 'DejaVu Sans Mono'
+  }
+  return 'SF Mono' // macOS default
+}
+
+export const getDefaultPrimarySelectionMiddleClickPaste = (
+  platform = typeof process !== 'undefined' ? process.platform : ''
+): boolean => platform === 'linux' || platform === 'darwin'
+
+export const getDefaultTerminalRightClickToPaste = (
+  platform = typeof process !== 'undefined' ? process.platform : ''
+): boolean => platform === 'win32'
diff --git a/src/shared/terminal-render-desync-evidence.ts b/src/shared/terminal-render-desync-evidence.ts
index 1621626e187..cc0e292983a 100644
--- a/src/shared/terminal-render-desync-evidence.ts
+++ b/src/shared/terminal-render-desync-evidence.ts
@@ -1,3 +1,7 @@
+/** The capture id becomes a directory name under userData, so main validates it before
+ *  use. Both sides import this so the renderer cannot mint an id main will reject. */
+export const TERMINAL_RENDER_DESYNC_CAPTURE_ID_PATTERN = /^[a-zA-Z0-9_-]{1,120}$/
+
 export type TerminalRenderDesyncEvidencePhase = 'corrupt' | 'healed'
 
 export type WriteTerminalRenderDesyncEvidenceArgs = {
diff --git a/src/shared/terminal-session-state-save-failure.test.ts b/src/shared/terminal-session-state-save-failure.test.ts
new file mode 100644
index 00000000000..aee76908a62
--- /dev/null
+++ b/src/shared/terminal-session-state-save-failure.test.ts
@@ -0,0 +1,44 @@
+import { describe, expect, it } from 'vitest'
+import {
+  createTerminalSessionStateSaveFailureMessage,
+  isTerminalSessionStateSaveFailure,
+  isTerminalSessionStorageCapacityFailure
+} from './terminal-session-state-save-failure'
+
+describe('terminal save failure classification', () => {
+  it.each(['ENOSPC', 'EDQUOT', 'SQLITE_FULL'])('recognizes %s through a wrapper', (code) => {
+    const message = createTerminalSessionStateSaveFailureMessage(
+      new Error('write failed', { cause: Object.assign(new Error('failure'), { code }) })
+    )
+    expect(isTerminalSessionStorageCapacityFailure(message)).toBe(true)
+    expect(isTerminalSessionStateSaveFailure(message)).toBe(true)
+  })
+
+  it.each(['EACCES', 'EPERM', 'EIO', 'SQLITE_BUSY', 'profile-state-writer-exit'])(
+    'does not diagnose %s as exhausted storage',
+    (code) => {
+      const message = createTerminalSessionStateSaveFailureMessage({ code, message: 'disk full' })
+      expect(isTerminalSessionStateSaveFailure(message)).toBe(true)
+      expect(isTerminalSessionStorageCapacityFailure(message)).toBe(false)
+    }
+  )
+
+  it('treats legacy and unknown host errors as unclassified', () => {
+    for (const message of [
+      'ORCA_TERMINAL_SESSION_STATE_SAVE_FAILED: local storage is unavailable.',
+      'Failed to save terminal session state',
+      createTerminalSessionStateSaveFailureMessage(new Error('disk full'))
+    ]) {
+      expect(isTerminalSessionStateSaveFailure(message)).toBe(true)
+      expect(isTerminalSessionStorageCapacityFailure(message)).toBe(false)
+    }
+  })
+
+  it('handles cyclic causes', () => {
+    const error = new Error('cycle')
+    error.cause = error
+    expect(
+      isTerminalSessionStorageCapacityFailure(createTerminalSessionStateSaveFailureMessage(error))
+    ).toBe(false)
+  })
+})
diff --git a/src/shared/terminal-session-state-save-failure.ts b/src/shared/terminal-session-state-save-failure.ts
index 309a98b653a..c286cd568bd 100644
--- a/src/shared/terminal-session-state-save-failure.ts
+++ b/src/shared/terminal-session-state-save-failure.ts
@@ -1,10 +1,18 @@
+import { storageCapacityErrorCode } from './storage-capacity-error'
+
 export const TERMINAL_SESSION_STATE_SAVE_FAILED_CODE = 'ORCA_TERMINAL_SESSION_STATE_SAVE_FAILED'
 
 export const TERMINAL_SESSION_STATE_SAVE_FAILED_MESSAGE =
-  'Orca could not save this terminal session because local storage is unavailable.'
+  'Orca could not save this terminal session.'
+const CAPACITY_MARKER = '[storage-capacity-exhausted]'
 
-export function createTerminalSessionStateSaveFailureMessage(): string {
-  return `${TERMINAL_SESSION_STATE_SAVE_FAILED_CODE}: ${TERMINAL_SESSION_STATE_SAVE_FAILED_MESSAGE}`
+export function createTerminalSessionStateSaveFailureMessage(error?: unknown): string {
+  const capacity = storageCapacityErrorCode(error) ? ` ${CAPACITY_MARKER}` : ''
+  return `${TERMINAL_SESSION_STATE_SAVE_FAILED_CODE}: ${TERMINAL_SESSION_STATE_SAVE_FAILED_MESSAGE}${capacity}`
+}
+
+export function isTerminalSessionStorageCapacityFailure(message: string): boolean {
+  return isTerminalSessionStateSaveFailure(message) && message.includes(CAPACITY_MARKER)
 }
 
 export function isTerminalSessionStateSaveFailure(message: string): boolean {
diff --git a/src/shared/terminal-spawn-error-copy.ts b/src/shared/terminal-spawn-error-copy.ts
new file mode 100644
index 00000000000..872c3c76b64
--- /dev/null
+++ b/src/shared/terminal-spawn-error-copy.ts
@@ -0,0 +1,25 @@
+// Host-published English copy; the renderer matches it to show a translation (#9194).
+export const PTY_ALLOCATION_HINT =
+  'Your system cannot allocate any more pty devices. Close some terminals you are not using, in Orca or another program, then try again.'
+
+export const TERMINAL_PROCESS_LIMIT_HINT =
+  'Your system cannot start another terminal process. Close unused terminals or quit unused processes, then try again.'
+
+// Older hosts still publish these multi-line forms.
+export const LEGACY_PTY_ALLOCATION_HINT = [
+  'Your system cannot allocate any more pty devices.',
+  '',
+  'Orca requires a pty device to launch a new terminal. This error is usually due to having too many terminal windows or terminal sessions open, either in Orca or another program.',
+  '',
+  'Free up some pty devices and try again.'
+].join('\n')
+
+export const LEGACY_TERMINAL_PROCESS_LIMIT_HINT = [
+  'Your system cannot start another terminal process.',
+  '',
+  'This is usually due to having too many terminal sessions or other processes running.',
+  '',
+  'Close unused terminals or quit unused processes and try again.'
+].join('\n')
+
+export const TERMINAL_SPAWN_ISSUE_REQUEST = 'If this persists, please file an issue.'
diff --git a/src/shared/terminal-startup-cwd.ts b/src/shared/terminal-startup-cwd.ts
index 828e8e8ef65..a500cbfe723 100644
--- a/src/shared/terminal-startup-cwd.ts
+++ b/src/shared/terminal-startup-cwd.ts
@@ -71,7 +71,8 @@ export function resolveTerminalStartupCwdForWorkspace(args: {
   return resolveTerminalStartupCwd(workspacePath, args.requestedCwd, args.missingDirFallback)
 }
 
-function resolveTerminalWorkspacePath(
+/** Root folder of a worktree, repo checkout or folder workspace id; null for floating terminals. */
+export function resolveTerminalWorkspacePath(
   workspaceId: string | undefined,
   resolveFolderWorkspacePath: ((folderWorkspaceId: string) => string | null | undefined) | undefined
 ): string | null {
diff --git a/src/shared/terminal-surface-close-target.test.ts b/src/shared/terminal-surface-close-target.test.ts
new file mode 100644
index 00000000000..54613ca879b
--- /dev/null
+++ b/src/shared/terminal-surface-close-target.test.ts
@@ -0,0 +1,28 @@
+import { describe, expect, it } from 'vitest'
+import { parseTerminalSurfaceCloseTarget } from './terminal-surface-close-target'
+
+describe('parseTerminalSurfaceCloseTarget', () => {
+  it('keeps a well-formed tab or pane target', () => {
+    expect(parseTerminalSurfaceCloseTarget({ kind: 'tab', tabId: 't', leafId: 'x' })).toEqual({
+      kind: 'tab',
+      tabId: 't'
+    })
+    expect(parseTerminalSurfaceCloseTarget({ kind: 'pane', tabId: 't', leafId: 'l' })).toEqual({
+      kind: 'pane',
+      tabId: 't',
+      leafId: 'l'
+    })
+  })
+
+  it.each([
+    null,
+    'tab',
+    { tabId: 't' },
+    { kind: 'tab', tabId: '' },
+    { kind: 'pane', tabId: 't' },
+    { kind: 'pane', tabId: 't', leafId: '' },
+    { kind: 'leaf', tabId: 't', leafId: 'l' }
+  ])('rejects %j', (value) => {
+    expect(parseTerminalSurfaceCloseTarget(value)).toBeNull()
+  })
+})
diff --git a/src/shared/terminal-surface-close-target.ts b/src/shared/terminal-surface-close-target.ts
new file mode 100644
index 00000000000..d2b4d5fa6d2
--- /dev/null
+++ b/src/shared/terminal-surface-close-target.ts
@@ -0,0 +1,28 @@
+/** What an explicit terminal close removes. A pane close never stands in for its tab. */
+export type TerminalSurfaceCloseTarget =
+  | { kind: 'tab'; tabId: string }
+  | { kind: 'pane'; tabId: string; leafId: string }
+
+export type TerminalPaneCloseTarget = Extract<TerminalSurfaceCloseTarget, { kind: 'pane' }>
+
+function isNonEmptyString(value: unknown): value is string {
+  return typeof value === 'string' && value.length > 0
+}
+
+/** Validates a close target that crossed a process boundary; anything malformed is rejected. */
+export function parseTerminalSurfaceCloseTarget(value: unknown): TerminalSurfaceCloseTarget | null {
+  if (typeof value !== 'object' || value === null || !('kind' in value) || !('tabId' in value)) {
+    return null
+  }
+  const { kind, tabId } = value
+  if (!isNonEmptyString(tabId)) {
+    return null
+  }
+  if (kind === 'tab') {
+    return { kind, tabId }
+  }
+  if (kind !== 'pane' || !('leafId' in value) || !isNonEmptyString(value.leafId)) {
+    return null
+  }
+  return { kind, tabId, leafId: value.leafId }
+}
diff --git a/src/shared/terminal-tab-types.ts b/src/shared/terminal-tab-types.ts
index d99472e2fde..9f7d9428b0a 100644
--- a/src/shared/terminal-tab-types.ts
+++ b/src/shared/terminal-tab-types.ts
@@ -132,6 +132,8 @@ export type TerminalLayoutSnapshot = {
   root: TerminalPaneLayoutNode | null
   activeLeafId: string | null
   expandedLeafId: string | null
+  /** Stable leaf that owns the terminal tab's native chat surface. */
+  chatLeafId?: string
   /** Live PTY IDs per leaf for in-session remounts such as tab-group moves.
    *  Not used for app restart because PTYs are transient processes. */
   ptyIdsByLeafId?: Record<string, string>
diff --git a/src/shared/terminal-title-agent-type.ts b/src/shared/terminal-title-agent-type.ts
index 8e8f8b12405..045b0aeceec 100644
--- a/src/shared/terminal-title-agent-type.ts
+++ b/src/shared/terminal-title-agent-type.ts
@@ -1,10 +1,17 @@
+import { isQoderTerminalTitle } from './qoder-terminal-title'
 import {
   AGY_AGENT_NAME_RE,
   DROID_AGENT_NAME_RE,
   HERMES_AGENT_NAME_RE,
   titleHasAgentName
 } from './agent-name-token-match'
-import { containsAgentSpinnerGlyph, isCursorAgentTitle } from './agent-title-core'
+import {
+  containsAgentSpinnerGlyph,
+  isCursorAgentTitle,
+  isDshTerminalTitle
+} from './agent-title-core'
+
+export { DSH_WHALE, isDshTerminalTitle } from './agent-title-core'
 import { isOpenCodeNativeTitle } from './opencode-terminal-title'
 import {
   getPiCompatibleSyntheticAgentLabel,
@@ -34,6 +41,14 @@ export function containsBrailleSpinner(title: string): boolean {
 }
 
 export function isGeminiTerminalTitle(title: string): boolean {
+  // Why: DSH-TUI's idle prefix is `✦`, Gemini's working glyph. The whale is decisive
+  // and is checked first so a resting DSH pane never reads as a working Gemini.
+  if (isQoderTerminalTitle(title)) {
+    return false
+  }
+  if (isDshTerminalTitle(title)) {
+    return false
+  }
   // Why: Gemini OSC glyphs are stronger evidence than any cwd/session text.
   if (
     title.includes(GEMINI_PERMISSION) ||
@@ -90,6 +105,11 @@ function computeIsClaudeAgent(title: string): boolean {
   if (!title || isClaudeManagementTitle(title) || isOpenCodeNativeTitle(title)) {
     return false
   }
+  // Why: DSH's working title is `⠂ 🐋 …`/`⠐ 🐋 …`, and the braille branch below would
+  // otherwise claim every frame of it for Claude.
+  if (isDshTerminalTitle(title)) {
+    return false
+  }
   const lower = title.toLowerCase()
 
   // Why: Claude Code titles are prefixed with status indicators (✳, ". ", "* ",
@@ -150,6 +170,13 @@ function computeAgentLabel(title: string): string | null {
   ) {
     return 'Claude Code'
   }
+  // Why before Gemini: see isDshTerminalTitle — the two share the `✦` glyph.
+  if (isDshTerminalTitle(title)) {
+    return 'DeepSeek Harness'
+  }
+  if (isQoderTerminalTitle(title)) {
+    return 'Qoder CLI'
+  }
   if (isGeminiTerminalTitle(title)) {
     return 'Gemini CLI'
   }
@@ -226,9 +253,11 @@ export const getAgentLabel: (title: string) => string | null =
   memoizeTitleClassification(computeAgentLabel)
 
 const TITLE_LABEL_TO_AGENT: Partial<Record<string, TuiAgent>> = {
+  'DeepSeek Harness': 'dsh',
   'Claude Code': 'claude',
   OpenClaude: 'openclaude',
   Codex: 'codex',
+  'Qoder CLI': 'qoder',
   'Gemini CLI': 'gemini',
   'GitHub Copilot': 'copilot',
   Grok: 'grok',
diff --git a/src/shared/text-search-glob-patterns.test.ts b/src/shared/text-search-glob-patterns.test.ts
new file mode 100644
index 00000000000..0bd96723a9d
--- /dev/null
+++ b/src/shared/text-search-glob-patterns.test.ts
@@ -0,0 +1,205 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { runProcess } from './child-process/run-process'
+import { splitSearchGlobPatterns } from './text-search-glob-patterns'
+import {
+  buildGitGrepArgs,
+  buildRgArgs,
+  createAccumulator,
+  finalize,
+  ingestRgJsonLine
+} from './text-search'
+
+describe('compound search globs', () => {
+  it.each([
+    ['', []],
+    [' , *.ts,, *.md, ', ['*.ts', '*.md']],
+    ['}.ts, *.md', ['}.ts', '*.md']],
+    ['*.{ts,tsx}, *.md', ['*.{ts,tsx}', '*.md']],
+    ['{src,{lib,test}}/**, *.md', ['{src,{lib,test}}/**', '*.md']],
+    ['*[a,b].ts, *.md', ['*[a,b].ts', '*.md']],
+    ['[{},].ts, *.md', ['[{},].ts', '*.md']],
+    ['[]a,b].ts, *.md', ['[]a,b].ts', '*.md']],
+    ['[!]a,b].ts, *.md', ['[!]a,b].ts', '*.md']],
+    ['[^]a,b].ts, *.md', ['[^]a,b].ts', '*.md']],
+    ['[[:alpha:],].ts, *.md', ['[[:alpha:],].ts', '*.md']],
+    ['[a\\],b].ts, *.md', ['[a\\],b].ts', '*.md']],
+    ['foo\\,bar/**, *.ts', ['foo\\,bar/**', '*.ts']],
+    ['\\{a,b\\}, *.ts', ['\\{a', 'b\\}', '*.ts']],
+    ['\\[a,b\\], *.ts', ['\\[a', 'b\\]', '*.ts']],
+    ['src\\', ['src\\']],
+    ['*.{ts,tsx', ['*.{ts,tsx']],
+    ['[a,b', ['[a,b']]
+  ])('preserves grouped and escaped commas in %s', (input, expected) => {
+    expect(splitSearchGlobPatterns(input, 'git')).toEqual(expected)
+  })
+
+  it('scans deeply nested groups without recursion or expanding alternatives', () => {
+    const pattern = `${'{'.repeat(20_000)}a,b${'}'.repeat(20_000)}`
+    expect(splitSearchGlobPatterns(`${pattern}, *.md`)).toEqual([pattern, '*.md'])
+  })
+})
+
+describe('file search with real search engines', () => {
+  let root: string
+
+  beforeAll(async () => {
+    root = await mkdtemp(join(tmpdir(), 'orca-search-globs-'))
+    for (const file of ['a.ts', 'b.tsx', 'c.md', ',.ts']) {
+      await writeFile(join(root, file), 'needle\n')
+    }
+    const initialized = await runProcess({ program: 'git', args: ['init'], cwd: root })
+    expect(initialized.code).toBe(0)
+  })
+
+  afterAll(async () => {
+    if (root) {
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
+  it.each([
+    [{ includePattern: '*.{ts,tsx}' }, [',.ts', 'a.ts', 'b.tsx']],
+    [{ includePattern: '[a,b].ts, *.md' }, [',.ts', 'a.ts', 'c.md']],
+    [{ excludePattern: '*.{ts,tsx}' }, ['c.md']],
+    [{ includePattern: '[]a,b].ts, *.md' }, [',.ts', 'a.ts', 'c.md']],
+    [{ excludePattern: '[a,b].ts' }, ['b.tsx', 'c.md']],
+    [{ includePattern: '*.ts, *.tsx', excludePattern: '[a,b].ts' }, ['b.tsx']]
+  ])('matches files with ripgrep using %j', async (options, expected) => {
+    const { rgPath } = await import('@vscode/ripgrep-universal')
+    const result = await runProcess({
+      program: rgPath,
+      args: buildRgArgs('needle', root, options),
+      cwd: root
+    })
+    expect(result.stderr).toBe('')
+    expect(result.code).toBe(0)
+    const accumulator = createAccumulator()
+    for (const line of result.stdout.split('\n')) {
+      ingestRgJsonLine(line, root, accumulator, 100)
+    }
+    expect(
+      finalize(accumulator)
+        .files.map((file) => file.relativePath)
+        .sort()
+    ).toEqual(expected)
+  })
+
+  it.each(['*.{ts,tsx', '[a,b'])('leaves invalid %s for ripgrep to reject', async (pattern) => {
+    const { rgPath } = await import('@vscode/ripgrep-universal')
+    for (const options of [{ includePattern: pattern }, { excludePattern: pattern }]) {
+      const result = await runProcess({
+        program: rgPath,
+        args: buildRgArgs('needle', root, options),
+        cwd: root
+      })
+      expect(result.code).toBe(2)
+      expect(result.stderr).toContain('error parsing glob')
+      expect(result.stderr).toContain(pattern)
+    }
+  })
+
+  it('keeps Git brace syntax literal instead of expanding it', async () => {
+    const result = await runProcess({
+      program: 'git',
+      args: buildGitGrepArgs('needle', { includePattern: '*.{ts,tsx}' }),
+      cwd: root
+    })
+    expect(result.code).toBe(1)
+    expect(result.stdout).toBe('')
+    expect(result.stderr).toBe('')
+  })
+
+  it('preserves character classes in Git exclusions', async () => {
+    const result = await runProcess({
+      program: 'git',
+      args: buildGitGrepArgs('needle', { excludePattern: '[[:alpha:],].ts' }),
+      cwd: root
+    })
+    expect(result.code).toBe(0)
+    expect(result.stdout).toContain('b.tsx\0')
+    expect(result.stdout).toContain('c.md\0')
+    expect(result.stdout).not.toContain('a.ts\0')
+    expect(result.stdout).not.toContain(',.ts\0')
+  })
+
+  it.each(['[a,b].ts', '[[:alpha:],].ts'])(
+    'preserves %s in the Git fallback too',
+    async (includePattern) => {
+      const result = await runProcess({
+        program: 'git',
+        args: buildGitGrepArgs('needle', { includePattern }),
+        cwd: root
+      })
+      expect(result.code).toBe(0)
+      expect(result.stdout).toContain('a.ts\0')
+      expect(result.stdout).toContain(',.ts\0')
+      expect(result.stdout).not.toContain('b.tsx\0')
+      expect(result.stdout).not.toContain('c.md\0')
+    }
+  )
+})
+
+describe('engine-specific character classes', () => {
+  let root: string
+  const files = [',.ts', '[.ts', '].ts', 'a.ts', 'a,b].ts', 'b.tsx', 'c.md']
+
+  beforeAll(async () => {
+    root = await mkdtemp(join(tmpdir(), 'orca-search-class-syntax-'))
+    for (const file of files) {
+      await writeFile(join(root, file), 'needle\n')
+    }
+    expect((await runProcess({ program: 'git', args: ['init'], cwd: root })).code).toBe(0)
+  })
+
+  afterAll(async () => {
+    if (root) {
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
+  it.each([
+    ['rg', '[a\\].ts, *.md', ['a.ts', 'c.md']],
+    ['rg', '[[:].ts, *.md', ['[.ts', 'c.md']],
+    ['git', '[[:].ts, *.md', ['[.ts', 'c.md']],
+    ['git', '[a\\],b].ts, *.md', [',.ts', '].ts', 'a.ts', 'c.md']],
+    ['git', '[[:alpha:],].ts, *.md', [',.ts', 'a.ts', 'c.md']],
+    ['rg', '[[:alpha:], *.md', ['c.md']]
+  ] as const)(
+    'respects %s syntax in %s for includes and excludes',
+    async (engine, pattern, matches) => {
+      const { rgPath } = await import('@vscode/ripgrep-universal')
+      for (const exclude of [false, true]) {
+        const options = exclude ? { excludePattern: pattern } : { includePattern: pattern }
+        const result = await runProcess({
+          program: engine === 'rg' ? rgPath : 'git',
+          args:
+            engine === 'rg'
+              ? buildRgArgs('needle', root, options)
+              : buildGitGrepArgs('needle', options),
+          cwd: root
+        })
+        expect(result.code).toBe(0)
+        expect(result.stderr).toBe('')
+        let actual: string[]
+        if (engine === 'rg') {
+          const accumulator = createAccumulator()
+          for (const line of result.stdout.split('\n')) {
+            ingestRgJsonLine(line, root, accumulator, 100)
+          }
+          actual = finalize(accumulator).files.map((file) => file.relativePath)
+        } else {
+          actual = result.stdout
+            .trim()
+            .split('\n')
+            .map((line) => line.split('\0')[0])
+        }
+        const selected = new Set<string>(matches)
+        const expected = exclude ? files.filter((file) => !selected.has(file)) : [...matches]
+        expect(actual.sort()).toEqual(expected.sort())
+      }
+    }
+  )
+})
diff --git a/src/shared/text-search-glob-patterns.ts b/src/shared/text-search-glob-patterns.ts
index 5e1e9487a36..b8d511f072d 100644
--- a/src/shared/text-search-glob-patterns.ts
+++ b/src/shared/text-search-glob-patterns.ts
@@ -1,18 +1,47 @@
-export function splitSearchGlobPatterns(patterns: string): string[] {
+/** Keeps grouped and escaped commas inside globs so search engines receive complete patterns. */
+export function splitSearchGlobPatterns(patterns: string, engine: 'rg' | 'git' = 'rg'): string[] {
   const out: string[] = []
   let current = ''
   let escaping = false
-  for (const ch of patterns) {
+  let braceDepth = 0
+  let characterClassContentStart = -1
+  let posixClassStart = -1
+  for (let index = 0; index < patterns.length; index += 1) {
+    const ch = patterns[index]
     if (escaping) {
       current += `\\${ch}`
       escaping = false
       continue
     }
-    if (ch === '\\') {
+    // Ripgrep treats backslashes literally inside classes; Git uses them as escapes.
+    if (ch === '\\' && (characterClassContentStart === -1 || engine === 'git')) {
       escaping = true
       continue
     }
-    if (ch === ',') {
+    if (characterClassContentStart !== -1) {
+      // A leading ']' (also after negation) is a member, not the end of the class.
+      if (posixClassStart !== -1) {
+        if (ch === ']') {
+          // An incomplete POSIX opener can just be literal '[' and ':' members.
+          if (patterns[index - 1] !== ':' || index <= posixClassStart + 3) {
+            characterClassContentStart = -1
+          }
+          posixClassStart = -1
+        }
+      } else if (engine === 'git' && ch === '[' && patterns[index + 1] === ':') {
+        posixClassStart = index
+      } else if (ch === ']' && index > characterClassContentStart) {
+        characterClassContentStart = -1
+      }
+    } else if (ch === '[') {
+      const next = patterns[index + 1]
+      characterClassContentStart = index + (next === '!' || next === '^' ? 2 : 1)
+    } else if (ch === '{') {
+      braceDepth += 1
+    } else if (ch === '}') {
+      braceDepth = Math.max(0, braceDepth - 1)
+    }
+    if (ch === ',' && braceDepth === 0 && characterClassContentStart === -1) {
       const trimmed = current.trim()
       if (trimmed) {
         out.push(trimmed)
diff --git a/src/shared/text-search.ts b/src/shared/text-search.ts
index 8d5972ffabd..7bb54243c4d 100644
--- a/src/shared/text-search.ts
+++ b/src/shared/text-search.ts
@@ -75,12 +75,12 @@ export function buildRgArgs(query: string, target: string, opts: SearchOptionsLi
     args.push('--fixed-strings')
   }
   if (opts.includePattern) {
-    for (const pat of splitSearchGlobPatterns(opts.includePattern)) {
+    for (const pat of splitSearchGlobPatterns(opts.includePattern, 'rg')) {
       args.push('--glob', pat)
     }
   }
   if (opts.excludePattern) {
-    for (const pat of splitSearchGlobPatterns(opts.excludePattern)) {
+    for (const pat of splitSearchGlobPatterns(opts.excludePattern, 'rg')) {
       args.push('--glob', `!${pat}`)
     }
   }
@@ -197,7 +197,7 @@ export function buildGitGrepArgs(query: string, opts: SearchOptionsLike): string
   let hasPathspecs = false
   let hasIncludePathspecs = false
   if (opts.includePattern) {
-    for (const pat of splitSearchGlobPatterns(opts.includePattern)) {
+    for (const pat of splitSearchGlobPatterns(opts.includePattern, 'git')) {
       const pathspecs = toGitGlobPathspecs(pat)
       gitArgs.push(...pathspecs)
       hasPathspecs ||= pathspecs.length > 0
@@ -205,7 +205,7 @@ export function buildGitGrepArgs(query: string, opts: SearchOptionsLike): string
     }
   }
   if (opts.excludePattern) {
-    for (const pat of splitSearchGlobPatterns(opts.excludePattern)) {
+    for (const pat of splitSearchGlobPatterns(opts.excludePattern, 'git')) {
       const pathspecs = toGitGlobPathspecs(pat, true)
       gitArgs.push(...pathspecs)
       hasPathspecs ||= pathspecs.length > 0
diff --git a/src/shared/tui-agent-config-types.ts b/src/shared/tui-agent-config-types.ts
new file mode 100644
index 00000000000..aa393fd522b
--- /dev/null
+++ b/src/shared/tui-agent-config-types.ts
@@ -0,0 +1,56 @@
+export type AgentPromptInjectionMode =
+  | 'argv'
+  | 'flag-prompt'
+  | 'flag-prompt-interactive'
+  | 'flag-interactive'
+  | 'hermes-query'
+  | 'stdin-after-start'
+
+export type DraftPasteReadySignal =
+  | 'render-quiet-after-bracketed-paste'
+  | 'codex-composer-prompt'
+  | 'render-cursor-after-bracketed-paste'
+  | 'grok-composer-prompt'
+  | 'dsh-composer-prompt'
+  | 'zcode-composer-prompt'
+
+export type TuiAgentDetectionRuntime = NodeJS.Platform | 'wsl'
+
+export type TuiAgentConfig = {
+  detectCmd: string
+  /** Additional executable names that identify the same agent on PATH. */
+  detectCmdAliases?: readonly string[]
+  /** Other commands that must also be present before this agent counts as installed. */
+  detectRequiredCommands?: readonly string[]
+  /** Detection runtimes where this launch mode is not available as a detected agent. */
+  detectUnsupportedRuntimes?: readonly TuiAgentDetectionRuntime[]
+  launchCmd: string
+  /** Platform-specific launch command when the public binary name differs. */
+  launchCmdByPlatform?: Partial<Record<NodeJS.Platform, string>>
+  expectedProcess: string
+  promptInjectionMode: AgentPromptInjectionMode
+  /** Option terminator required before positional prompts that may look like CLI syntax. */
+  argvPromptSeparator?: '--'
+  /** Native CLI flag that seeds the input without submitting (e.g. Claude's `--prefill <text>`); preferred over the paste-after-ready path. */
+  draftPromptFlag?: string
+  /** Startup env var that seeds the input without submitting, for agents with no `--prefill`-style flag (e.g. pi); avoids the paste-after-ready race. */
+  draftPromptEnvVar?: string
+  /** Claude Code follows pasted text only where the user's typed words ask, so dispatch briefs need a typed lead line. */
+  pasteNeedsTypedRequest?: boolean
+  /** Trust Orca pre-writes at PTY spawn (agent-workspace-trust.ts) so the agent's first-launch "trust this folder?" menu doesn't consume the bracketed paste. */
+  preflightTrust?: 'claude' | 'cursor' | 'copilot' | 'codex' | 'antigravity' | 'qoder'
+  /** Agent-specific signal that the composer is ready for paste, stronger than the default quiet-render window. */
+  draftPasteReadySignal?: DraftPasteReadySignal
+  /** Hard deadline for the agent's composer readiness signal. */
+  draftPasteReadyTimeoutMs?: number
+  /** Delay before one extra blind submit Enter, for agents that render their composer before Enter is live (codex); a no-op if the first Enter landed. */
+  submitRetryDelayMs?: number
+  /** Extra ms per logical prompt line before Enter, for TUIs that expand multiline paste slowly (antigravity). */
+  submitLineSettleMsPerLine?: number
+  /** Windows Shift+Enter encoding override; omitted agents keep the legacy Esc+CR path. */
+  windowsShiftEnterEncoding?: 'csi-u'
+  /** Paste newlines for TUIs that read Windows console input records instead of VT paste frames. */
+  windowsInputRecordPasteNewline?: 'alt-enter' | 'csi-u'
+  /** Ctrl+Enter encoding for agents that consume CSI-u without active kitty flags. */
+  ctrlEnterEncoding?: 'csi-u'
+}
diff --git a/src/shared/tui-agent-config.ts b/src/shared/tui-agent-config.ts
index 55082bc2470..d9fdabb14c3 100644
--- a/src/shared/tui-agent-config.ts
+++ b/src/shared/tui-agent-config.ts
@@ -1,61 +1,13 @@
 import type { TuiAgent } from './tui-agent'
 import { getOrcaCliCommandNameForPlatform } from './orca-cli-command-name'
+import type { TuiAgentConfig } from './tui-agent-config-types'
 
-export type AgentPromptInjectionMode =
-  | 'argv'
-  | 'flag-prompt'
-  | 'flag-prompt-interactive'
-  | 'flag-interactive'
-  | 'hermes-query'
-  | 'stdin-after-start'
-
-export type DraftPasteReadySignal =
-  | 'render-quiet-after-bracketed-paste'
-  | 'codex-composer-prompt'
-  | 'render-cursor-after-bracketed-paste'
-  | 'grok-composer-prompt'
-  | 'zcode-composer-prompt'
-
-export type TuiAgentDetectionRuntime = NodeJS.Platform | 'wsl'
-
-export type TuiAgentConfig = {
-  detectCmd: string
-  /** Additional executable names that identify the same agent on PATH. */
-  detectCmdAliases?: readonly string[]
-  /** Other commands that must also be present before this agent counts as installed. */
-  detectRequiredCommands?: readonly string[]
-  /** Detection runtimes where this launch mode is not available as a detected agent. */
-  detectUnsupportedRuntimes?: readonly TuiAgentDetectionRuntime[]
-  launchCmd: string
-  /** Platform-specific launch command when the public binary name differs. */
-  launchCmdByPlatform?: Partial<Record<NodeJS.Platform, string>>
-  expectedProcess: string
-  promptInjectionMode: AgentPromptInjectionMode
-  /** Option terminator required before positional prompts that may look like CLI syntax. */
-  argvPromptSeparator?: '--'
-  /** Native CLI flag that seeds the input without submitting (e.g. Claude's `--prefill <text>`); preferred over the paste-after-ready path. */
-  draftPromptFlag?: string
-  /** Startup env var that seeds the input without submitting, for agents with no `--prefill`-style flag (e.g. pi); avoids the paste-after-ready race. */
-  draftPromptEnvVar?: string
-  /** Claude Code follows pasted text only where the user's typed words ask, so dispatch briefs need a typed lead line. */
-  pasteNeedsTypedRequest?: boolean
-  /** Pre-write a trust artifact so the agent's first-launch "trust this folder?" menu doesn't consume the bracketed paste (see agent-trust-presets.ts). */
-  preflightTrust?: 'cursor' | 'copilot' | 'codex' | 'antigravity'
-  /** Agent-specific signal that the composer is ready for paste, stronger than the default quiet-render window. */
-  draftPasteReadySignal?: DraftPasteReadySignal
-  /** Hard deadline for the agent's composer readiness signal. */
-  draftPasteReadyTimeoutMs?: number
-  /** Delay before one extra blind submit Enter, for agents that render their composer before Enter is live (codex); a no-op if the first Enter landed. */
-  submitRetryDelayMs?: number
-  /** Extra ms per logical prompt line before Enter, for TUIs that expand multiline paste slowly (antigravity). */
-  submitLineSettleMsPerLine?: number
-  /** Windows Shift+Enter encoding override; omitted agents keep the legacy Esc+CR path. */
-  windowsShiftEnterEncoding?: 'csi-u'
-  /** Paste newlines for TUIs that read Windows console input records instead of VT paste frames. */
-  windowsInputRecordPasteNewline?: 'alt-enter' | 'csi-u'
-  /** Ctrl+Enter encoding for agents that consume CSI-u without active kitty flags. */
-  ctrlEnterEncoding?: 'csi-u'
-}
+export type {
+  AgentPromptInjectionMode,
+  DraftPasteReadySignal,
+  TuiAgentConfig,
+  TuiAgentDetectionRuntime
+} from './tui-agent-config-types'
 
 /** Authoring form: `launchCmd` and `expectedProcess` default to `detectCmd` (true for most agents). */
 type TuiAgentConfigSource = Omit<TuiAgentConfig, 'launchCmd' | 'expectedProcess'> & {
@@ -77,7 +29,8 @@ const TUI_AGENT_CONFIG_SOURCE: Record<TuiAgent, TuiAgentConfigSource> = {
     promptInjectionMode: 'argv',
     pasteNeedsTypedRequest: true,
     // Why: `claude --prefill <text>` seeds the input without submitting, avoiding the paste-after-ready race (PR https://github.com/stablyai/orca/pull/926).
-    draftPromptFlag: '--prefill'
+    draftPromptFlag: '--prefill',
+    preflightTrust: 'claude'
   },
   'claude-agent-teams': {
     // Why: an Orca-provided launch mode, not a separate binary; detection follows the Orca CLI.
@@ -94,7 +47,13 @@ const TUI_AGENT_CONFIG_SOURCE: Record<TuiAgent, TuiAgentConfigSource> = {
     },
     expectedProcess: 'claude',
     promptInjectionMode: 'stdin-after-start',
-    pasteNeedsTypedRequest: true
+    pasteNeedsTypedRequest: true,
+    preflightTrust: 'claude'
+  },
+  codebuddy: {
+    detectCmd: 'codebuddy',
+    detectCmdAliases: ['cbc'],
+    promptInjectionMode: 'argv'
   },
   openclaude: {
     detectCmd: 'openclaude',
@@ -147,7 +106,6 @@ const TUI_AGENT_CONFIG_SOURCE: Record<TuiAgent, TuiAgentConfigSource> = {
     detectCmd: 'opencode2',
     // The private server inherits this pane's hook endpoint and identity.
     launchCmd: 'opencode2 --standalone',
-    expectedProcess: 'opencode2',
     promptInjectionMode: 'flag-prompt',
     draftPasteReadySignal: 'render-cursor-after-bracketed-paste',
     draftPasteReadyTimeoutMs: 20_000
@@ -183,6 +141,11 @@ const TUI_AGENT_CONFIG_SOURCE: Record<TuiAgent, TuiAgentConfigSource> = {
     // Why: Prime Agent embeds Pi's TUI and decodes CSI-u the same way (see pi above).
     windowsShiftEnterEncoding: 'csi-u'
   },
+  qoder: {
+    detectCmd: 'qodercli',
+    promptInjectionMode: 'flag-prompt-interactive',
+    preflightTrust: 'qoder'
+  },
   gemini: {
     detectCmd: 'gemini',
     promptInjectionMode: 'flag-prompt-interactive'
@@ -235,6 +198,10 @@ const TUI_AGENT_CONFIG_SOURCE: Record<TuiAgent, TuiAgentConfigSource> = {
     detectCmd: 'cline',
     promptInjectionMode: 'stdin-after-start'
   },
+  freebuff: {
+    detectCmd: 'freebuff',
+    promptInjectionMode: 'stdin-after-start'
+  },
   codebuff: {
     detectCmd: 'codebuff',
     promptInjectionMode: 'stdin-after-start'
@@ -322,6 +289,24 @@ const TUI_AGENT_CONFIG_SOURCE: Record<TuiAgent, TuiAgentConfigSource> = {
     // Muse 1.3 treats subcommand-shaped prompts as commands even after `--`.
     promptInjectionMode: 'stdin-after-start'
   },
+  dsh: {
+    // Why: DeepSeek Harness publishes one binary (`dsh`) that boots a profile, and only the
+    // `dsh-tui` profile paints a composer. `dsh-tui` (alias `dst`) is the launcher that
+    // selects it, so detect that and require `dsh` too — the launcher delegates to it and
+    // fails without it.
+    detectCmd: 'dsh-tui',
+    detectCmdAliases: ['dst'],
+    detectRequiredCommands: ['dsh'],
+    // Why: the launcher re-execs `dsh --profile dsh-tui`, so the pane's foreground process
+    // is `dsh`, never `dsh-tui`. Readiness and follow-up delivery key off this name.
+    expectedProcess: 'dsh',
+    // Why: the terminal app parses only `--resume`/`--continue` and a workspace target; it
+    // has no prompt flag, so the first prompt is pasted into the composer after startup.
+    promptInjectionMode: 'stdin-after-start',
+    // Why: DSH-TUI animates a whale intro continuously behind its composer, so the default
+    // quiet window never settles (the grok failure mode). See dsh-tui-ready-no-key.txt.
+    draftPasteReadySignal: 'dsh-composer-prompt'
+  },
   zcode: {
     detectCmd: 'zcode',
     // Why: ZCode's entrypoint sets `process.title = 'zcode-cli'` (its `process-name.ts`
diff --git a/src/shared/tui-agent-detection-commands.ts b/src/shared/tui-agent-detection-commands.ts
index 1d9409a090b..dbce135b4c7 100644
--- a/src/shared/tui-agent-detection-commands.ts
+++ b/src/shared/tui-agent-detection-commands.ts
@@ -48,9 +48,11 @@ export function getTuiAgentDetectionProbeCommands(
 ): string[] {
   return [
     ...new Set(
-      commands
-        .filter((command) => !isDetectionUnsupportedInRuntime(command, runtime))
-        .flatMap((command) => [command.cmd, ...(command.requiredCommands ?? [])])
+      commands.flatMap((command) =>
+        isDetectionUnsupportedInRuntime(command, runtime)
+          ? []
+          : [command.cmd, ...(command.requiredCommands ?? [])]
+      )
     )
   ]
 }
diff --git a/src/shared/tui-agent-display-names.ts b/src/shared/tui-agent-display-names.ts
index f85a87834b2..31b6035a953 100644
--- a/src/shared/tui-agent-display-names.ts
+++ b/src/shared/tui-agent-display-names.ts
@@ -8,12 +8,14 @@ import type { TuiAgent } from './tui-agent'
 export const TUI_AGENT_DISPLAY_NAMES: Record<TuiAgent, string> = {
   claude: 'Claude',
   'claude-agent-teams': 'Claude Agent Teams',
+  codebuddy: 'CodeBuddy',
   openclaude: 'OpenClaude',
   codex: 'Codex',
   devin: 'Devin',
   ante: 'Ante',
   trae: 'Trae',
   muse: 'Muse',
+  dsh: 'DeepSeek Harness',
   zcode: 'ZCode',
   autohand: 'Autohand Code',
   opencode: 'OpenCode',
@@ -22,6 +24,7 @@ export const TUI_AGENT_DISPLAY_NAMES: Record<TuiAgent, string> = {
   pi: 'Pi',
   omp: 'OMP',
   'prime-agent': 'Prime Agent',
+  qoder: 'Qoder CLI',
   gemini: 'Gemini',
   antigravity: 'Antigravity',
   aider: 'Aider',
@@ -33,6 +36,7 @@ export const TUI_AGENT_DISPLAY_NAMES: Record<TuiAgent, string> = {
   aug: 'Auggie',
   cline: 'Cline',
   codebuff: 'Codebuff',
+  freebuff: 'Freebuff',
   'command-code': 'Command Code',
   continue: 'Continue',
   cursor: 'Cursor',
diff --git a/src/shared/tui-agent-permissions.ts b/src/shared/tui-agent-permissions.ts
index 6d6a6bec856..9fc8eb0a691 100644
--- a/src/shared/tui-agent-permissions.ts
+++ b/src/shared/tui-agent-permissions.ts
@@ -5,9 +5,11 @@ export type AgentPermissionMode = 'yolo' | 'manual' | 'mixed'
 
 export const YOLO_TUI_AGENT_ARGS: Partial<Record<TuiAgent, string>> = {
   claude: '--dangerously-skip-permissions',
+  codebuddy: '--dangerously-skip-permissions',
   'claude-agent-teams': '--dangerously-skip-permissions',
   openclaude: '--dangerously-skip-permissions',
   codex: '--dangerously-bypass-approvals-and-sandbox',
+  qoder: '--dangerously-skip-permissions',
   gemini: '--yolo',
   antigravity: '--dangerously-skip-permissions',
   aider: '--yes-always',
diff --git a/src/shared/tui-agent-rest-signal.test.ts b/src/shared/tui-agent-rest-signal.test.ts
new file mode 100644
index 00000000000..6e573acc0b0
--- /dev/null
+++ b/src/shared/tui-agent-rest-signal.test.ts
@@ -0,0 +1,63 @@
+import { describe, expect, it } from 'vitest'
+import type { TuiAgent } from './tui-agent'
+import { isTuiAgent, TUI_AGENT_CONFIG } from './tui-agent-config'
+import { getTuiAgentRestSignal, type TuiAgentRestSignal } from './tui-agent-rest-signal'
+
+// Why a full Record: adding a TuiAgent fails to compile here until someone decides what its
+// rest signal is, and a title-table change that moves an agent shows up in review.
+const EXPECTED_REST_SIGNALS: Record<TuiAgent, TuiAgentRestSignal> = {
+  dsh: 'hook-done',
+  codex: 'synthetic-title',
+  cursor: 'synthetic-title',
+  pi: 'synthetic-title',
+  omp: 'synthetic-title',
+  droid: 'synthetic-title',
+  hermes: 'synthetic-title',
+  devin: 'synthetic-title',
+  zcode: 'synthetic-title',
+  claude: 'title',
+  'claude-agent-teams': 'title',
+  openclaude: 'title',
+  opencode: 'title',
+  opencode2: 'title',
+  'mimo-code': 'title',
+  gemini: 'title',
+  antigravity: 'title',
+  aider: 'title',
+  openclaw: 'title',
+  copilot: 'title',
+  grok: 'title',
+  muse: 'ready-body',
+  qoder: 'ready-body',
+  codebuddy: 'none',
+  autohand: 'none',
+  ante: 'none',
+  trae: 'none',
+  'prime-agent': 'none',
+  goose: 'none',
+  amp: 'none',
+  kilo: 'none',
+  kiro: 'none',
+  crush: 'none',
+  aug: 'none',
+  cline: 'none',
+  codebuff: 'none',
+  freebuff: 'none',
+  'command-code': 'none',
+  continue: 'none',
+  kimi: 'none',
+  'mistral-vibe': 'none',
+  'qwen-code': 'none',
+  rovo: 'none'
+}
+
+describe('getTuiAgentRestSignal', () => {
+  it('declares a rest signal for every launchable agent', () => {
+    const derived = Object.fromEntries(
+      Object.keys(TUI_AGENT_CONFIG)
+        .filter(isTuiAgent)
+        .map((agent) => [agent, getTuiAgentRestSignal(agent)])
+    )
+    expect(derived).toEqual(EXPECTED_REST_SIGNALS)
+  })
+})
diff --git a/src/shared/tui-agent-rest-signal.ts b/src/shared/tui-agent-rest-signal.ts
new file mode 100644
index 00000000000..93f694a5d79
--- /dev/null
+++ b/src/shared/tui-agent-rest-signal.ts
@@ -0,0 +1,41 @@
+import { detectAgentStatusFromTitle } from './agent-title-status'
+import { getSyntheticAgentTerminalTitle } from './synthetic-agent-title'
+import type { TuiAgent } from './tui-agent'
+import { TUI_AGENT_CONFIG } from './tui-agent-config'
+
+/**
+ * The strongest lane tui-idle-evidence.ts trusts to say an agent's TUI is at rest:
+ * - `hook-done`: its own hook reports the lead turn ended (DSH).
+ * - `synthetic-title`: its hooks drive an Orca-written `<Agent> ready` title.
+ * - `title`: its running process names itself in a title the status classifier reads.
+ * - `ready-body`: a ready screen Orca recognises (Muse; Qoder, whose idle title can show while
+ *   its trust menu still owns input).
+ * - `none`: no stronger lane, so a quiet foreground process is its only one. Hooks or a first-party
+ *   `done` (amp, kimi, command-code, freebuff) do not count: tui-idle takes their `working` as a
+ *   veto, and trusts a first-party `done` only from DSH.
+ */
+export type TuiAgentRestSignal = 'hook-done' | 'synthetic-title' | 'title' | 'ready-body' | 'none'
+
+/** Lanes keyed on agent identity in tui-idle-evidence.ts, which no title table records. */
+const IDENTITY_REST_SIGNALS: Partial<Record<TuiAgent, TuiAgentRestSignal>> = {
+  dsh: 'hook-done',
+  muse: 'ready-body',
+  qoder: 'ready-body'
+}
+
+// Why derived, not declared per agent: the title tables are the evidence, so a second
+// hand-kept copy could only drift from them. An agent with no evidence falls to `none`.
+export function getTuiAgentRestSignal(agent: TuiAgent): TuiAgentRestSignal {
+  const identitySignal = IDENTITY_REST_SIGNALS[agent]
+  if (identitySignal) {
+    return identitySignal
+  }
+  if (getSyntheticAgentTerminalTitle(agent, 'done') !== null) {
+    return 'synthetic-title'
+  }
+  // Why the process name: the title tables match an agent by the name it runs as.
+  if (detectAgentStatusFromTitle(TUI_AGENT_CONFIG[agent].expectedProcess) !== null) {
+    return 'title'
+  }
+  return 'none'
+}
diff --git a/src/shared/tui-agent-selection.ts b/src/shared/tui-agent-selection.ts
index f3eb7322fb1..acf305dad59 100644
--- a/src/shared/tui-agent-selection.ts
+++ b/src/shared/tui-agent-selection.ts
@@ -16,6 +16,8 @@ export const TUI_AGENT_AUTO_PICK_ORDER = [
   'ante',
   'trae',
   'muse',
+  'dsh',
+  'qoder',
   'zcode',
   'pi',
   'omp',
@@ -32,6 +34,7 @@ export const TUI_AGENT_AUTO_PICK_ORDER = [
   'autohand',
   'cline',
   'codebuff',
+  'freebuff',
   'command-code',
   'continue',
   'cursor',
@@ -42,7 +45,8 @@ export const TUI_AGENT_AUTO_PICK_ORDER = [
   'rovo',
   'hermes',
   'devin',
-  'openclaw'
+  'openclaw',
+  'codebuddy'
 ] as const satisfies readonly TuiAgent[]
 
 // Why: fresh installs should expose Claude Agent Teams in agent pickers; the
diff --git a/src/shared/tui-agent-startup-shell.test.ts b/src/shared/tui-agent-startup-shell.test.ts
index 1698e86b08b..39c46e5fbf3 100644
--- a/src/shared/tui-agent-startup-shell.test.ts
+++ b/src/shared/tui-agent-startup-shell.test.ts
@@ -65,6 +65,12 @@ describe('tokenizeStartupCommand spans (windows shells)', () => {
   })
 })
 
+describe('powershell startup argument quoting', () => {
+  it('doubles typographic single quotes, which PowerShell also treats as delimiters', () => {
+    expect(quoteStartupArg('it\u2019s', 'powershell')).toBe("'it\u2019\u2019s'")
+  })
+})
+
 describe('one Unix startup dialect', () => {
   it('clears variables with a self-contained branch, not a per-shell builtin', () => {
     // Why not `unset`/`set -e` alone, and why not a wrapper-defined helper:
diff --git a/src/shared/tui-agent-startup-shell.ts b/src/shared/tui-agent-startup-shell.ts
index 94df0f80ac5..83bfbd584d2 100644
--- a/src/shared/tui-agent-startup-shell.ts
+++ b/src/shared/tui-agent-startup-shell.ts
@@ -1,4 +1,5 @@
 import { tokenizeCustomCommandTemplate, type CommandTokenSpan } from './commit-message-prompt'
+import { quotePowerShellLiteral } from './powershell-native-argument'
 
 /**
  * `'posix'` covers every Unix shell Orca can type into, fish included — not
@@ -217,7 +218,7 @@ function quotePortableUnixArg(value: string): string {
 
 export function quoteStartupArg(value: string, shell: AgentStartupShell): string {
   if (shell === 'powershell') {
-    return `'${value.replace(/'/g, "''")}'`
+    return quotePowerShellLiteral(value)
   }
   if (shell === 'cmd') {
     return `"${value.replace(/([\^&|<>()%!"])/g, '^$1')}"`
diff --git a/src/shared/tui-agent.ts b/src/shared/tui-agent.ts
index d19fcb0b1ce..a98c45101fd 100644
--- a/src/shared/tui-agent.ts
+++ b/src/shared/tui-agent.ts
@@ -3,6 +3,7 @@
 export type TuiAgent =
   | 'claude' // Claude Code
   | 'claude-agent-teams' // Claude Code Agent Teams via Orca native panes
+  | 'codebuddy' // CodeBuddy Code
   | 'openclaude' // OpenClaude
   | 'codex' // OpenAI Codex
   | 'autohand' // Autohand Code CLI
@@ -11,6 +12,7 @@ export type TuiAgent =
   | 'mimo-code'
   | 'pi' // Pi (pi.dev)
   | 'omp' // OMP (omp.sh)
+  | 'qoder' // Qoder CLI
   | 'gemini' // Gemini CLI
   | 'antigravity' // Google Antigravity CLI
   | 'aider' // Aider
@@ -22,6 +24,7 @@ export type TuiAgent =
   | 'aug' // Augment/Auggie
   | 'cline' // Cline
   | 'codebuff' // Codebuff
+  | 'freebuff' // Freebuff
   | 'command-code' // Command Code
   | 'continue' // Continue
   | 'cursor' // Cursor
@@ -40,3 +43,4 @@ export type TuiAgent =
   | 'muse' // Muse (Meta `muse` CLI)
   | 'zcode' // ZCode (Z.ai `zcode` CLI)
   | 'prime-agent' // Prime Agent (Prime Intellect)
+  | 'dsh' // DeepSeek Harness (`dsh`, launched through its `dsh-tui` terminal profile)
diff --git a/src/shared/ui-chrome-types.ts b/src/shared/ui-chrome-types.ts
index fe6157d870b..8d55b56f3e5 100644
--- a/src/shared/ui-chrome-types.ts
+++ b/src/shared/ui-chrome-types.ts
@@ -62,6 +62,8 @@ export type StatusBarItem =
   | 'kimi'
   | 'minimax'
   | 'grok'
+  | 'cursor'
+  | 'zcode'
   | 'ssh'
   | 'resource-usage'
   | 'ports'
diff --git a/src/shared/uuid-v4.test.ts b/src/shared/uuid-v4.test.ts
new file mode 100644
index 00000000000..a12396accca
--- /dev/null
+++ b/src/shared/uuid-v4.test.ts
@@ -0,0 +1,25 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createUuidV4 } from './uuid-v4'
+
+const UUID_V4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
+
+describe('createUuidV4', () => {
+  afterEach(() => vi.unstubAllGlobals())
+
+  it('uses the browser crypto fallback when randomUUID is unavailable', () => {
+    vi.stubGlobal('crypto', {
+      getRandomValues: (bytes: Uint8Array) => {
+        bytes.fill(0xab)
+        return bytes
+      }
+    })
+
+    expect(createUuidV4()).toMatch(UUID_V4)
+  })
+
+  it('still returns a UUID when Web Crypto is unavailable', () => {
+    vi.stubGlobal('crypto', undefined)
+
+    expect(createUuidV4()).toMatch(UUID_V4)
+  })
+})
diff --git a/src/shared/uuid-v4.ts b/src/shared/uuid-v4.ts
new file mode 100644
index 00000000000..2bda84ec25e
--- /dev/null
+++ b/src/shared/uuid-v4.ts
@@ -0,0 +1 @@
+export { createNonSecureContextUuid as createUuidV4 } from './non-secure-context-uuid'
diff --git a/src/shared/window-shortcut-policy.test.ts b/src/shared/window-shortcut-policy.test.ts
index 77bc37a5cf9..edc48f12438 100644
--- a/src/shared/window-shortcut-policy.test.ts
+++ b/src/shared/window-shortcut-policy.test.ts
@@ -40,14 +40,26 @@ describe('resolveWindowShortcutAction', () => {
     ).toEqual({ type: 'dictationKeyDown' })
   })
 
-  it('resolves the explicit window shortcut allowlist on macOS', () => {
-    expect(
-      resolveWindowShortcutAction(
-        { code: 'Comma', key: ',', meta: true, control: false, alt: false, shift: false },
-        'darwin'
-      )
-    ).toEqual({ type: 'openSettings' })
+  it.each(['darwin', 'linux', 'win32'] as const)(
+    'leaves Cmd/Ctrl+, to terminal apps on %s unless explicitly rebound',
+    (platform) => {
+      const input = {
+        code: 'Comma',
+        key: ',',
+        meta: platform === 'darwin',
+        control: platform !== 'darwin',
+        alt: false,
+        shift: false
+      }
+      expect(resolveWindowShortcutAction(input, platform)).toBeNull()
+      expect(resolveWindowShortcutAction(input, platform, { 'tab.close': ['Mod+W'] })).toBeNull()
+      expect(
+        resolveWindowShortcutAction(input, platform, { 'app.settings': ['Mod+Comma'] })
+      ).toEqual({ type: 'openSettings' })
+    }
+  )
 
+  it('resolves the explicit window shortcut allowlist on macOS', () => {
     expect(
       resolveWindowShortcutAction(
         { code: 'KeyJ', key: 'j', meta: true, control: false, alt: false, shift: false },
diff --git a/src/shared/windows-cmd-runner-delayed-launch.test.ts b/src/shared/windows-cmd-runner-delayed-launch.test.ts
index 21c5cc8befe..af3e409484c 100644
--- a/src/shared/windows-cmd-runner-delayed-launch.test.ts
+++ b/src/shared/windows-cmd-runner-delayed-launch.test.ts
@@ -33,4 +33,11 @@ describe('buildWindowsCmdRunnerDelayedLaunchCommand', () => {
     expect(script).toContain("$runner = 'C:\\work (x86)\\se&tup.cmd'")
     expect(script).toContain('/d /s /v:on /c ""!ORCA_SETUP_RUNNER!""')
   })
+
+  it('doubles typographic single quotes in the runner path literal', () => {
+    const script = decodePayload(
+      buildWindowsCmdRunnerDelayedLaunchCommand('C:\\O\u2019Brien\\setup.cmd')
+    )
+    expect(script).toContain("$runner = 'C:\\O\u2019\u2019Brien\\setup.cmd'")
+  })
 })
diff --git a/src/shared/windows-cmd-runner-delayed-launch.ts b/src/shared/windows-cmd-runner-delayed-launch.ts
index cdc0af3a48a..29403b26362 100644
--- a/src/shared/windows-cmd-runner-delayed-launch.ts
+++ b/src/shared/windows-cmd-runner-delayed-launch.ts
@@ -1,4 +1,5 @@
 import { encodePowerShellCommand } from './powershell-command-encoding'
+import { quotePowerShellLiteral } from './powershell-native-argument'
 
 // Why: `cmd.exe /c "<path>"` is typed into the terminal's shell, so the path is parsed twice.
 // cmd expands %VAR% even inside quotes (no escape exists on the command line), and PowerShell
@@ -18,7 +19,7 @@ export function windowsRunnerPathNeedsCmdGuard(runnerScriptPath: string): boolea
  */
 export function buildWindowsCmdRunnerDelayedLaunchCommand(runnerScriptPath: string): string {
   const script = [
-    `$runner = ${quotePowerShellString(runnerScriptPath)}`,
+    `$runner = ${quotePowerShellLiteral(runnerScriptPath)}`,
     // Why: an empty value would silently degrade to `cmd /c ""`, which exits 0 without running setup.
     'if ([string]::IsNullOrEmpty($runner)) { exit 1 }',
     '$processInfo = [System.Diagnostics.ProcessStartInfo]::new()',
@@ -39,7 +40,3 @@ export function buildWindowsCmdRunnerDelayedLaunchCommand(runnerScriptPath: stri
   // base64 stays: this string is typed into a shell, which is the whole point of the guard above.
   return `powershell.exe -NoProfile -NonInteractive -EncodedCommand ${encodePowerShellCommand(script)}`
 }
-
-function quotePowerShellString(value: string): string {
-  return `'${value.replace(/'/g, "''")}'`
-}
diff --git a/src/shared/worker-transcript-background-task-text.test.ts b/src/shared/worker-transcript-background-task-text.test.ts
index 1e9d727406b..a612dbe0d8c 100644
--- a/src/shared/worker-transcript-background-task-text.test.ts
+++ b/src/shared/worker-transcript-background-task-text.test.ts
@@ -1,6 +1,9 @@
 import { describe, expect, it } from 'vitest'
 import type { NativeChatMessage } from './native-chat-types'
-import { formatWorkerTranscriptMessage } from './worker-transcript-text'
+import { formatWorkerTranscriptMessages } from './worker-transcript-text'
+
+const formatWorkerTranscriptMessage = (message: NativeChatMessage): string =>
+  formatWorkerTranscriptMessages([message]).join('')
 
 function message(blocks: NativeChatMessage['blocks']): NativeChatMessage {
   return { id: 'm-1', role: 'system', blocks, timestamp: null, source: 'hook' }
diff --git a/src/shared/worker-transcript-subagent-attribution.test.ts b/src/shared/worker-transcript-subagent-attribution.test.ts
new file mode 100644
index 00000000000..f67a12d6702
--- /dev/null
+++ b/src/shared/worker-transcript-subagent-attribution.test.ts
@@ -0,0 +1,49 @@
+import { describe, expect, it } from 'vitest'
+import type { NativeChatMessage } from './native-chat-types'
+import { formatWorkerTranscriptMessages } from './worker-transcript-text'
+
+function message(
+  id: string,
+  text: string,
+  overrides: Partial<NativeChatMessage> = {}
+): NativeChatMessage {
+  return {
+    id,
+    role: 'assistant',
+    blocks: [{ type: 'text', text }],
+    timestamp: 0,
+    source: 'transcript',
+    ...overrides
+  }
+}
+
+const roster = message('roster', 'Kicked off 1 subagent', {
+  role: 'system',
+  blocks: [
+    { type: 'text', text: 'Kicked off 1 subagent' },
+    {
+      type: 'subagent-group',
+      groupId: 'group-1',
+      agents: [{ id: 'task-1', label: 'review the PR', state: 'working' }]
+    }
+  ]
+})
+
+describe("a worker's transcript never gives a subagent's words to the worker", () => {
+  it("tags a subagent's line with the subagent the roster names", () => {
+    const [own, , child] = formatWorkerTranscriptMessages([
+      message('own', 'Delegating the review.'),
+      roster,
+      message('child', 'The PR is CLEAN.', { agentId: 'task-1' })
+    ])
+    expect(own).toBe('[assistant] Delegating the review.')
+    expect(child).toBe('[assistant, subagent review the PR] The PR is CLEAN.')
+  })
+
+  it('still tags a subagent that no roster on the page names', () => {
+    const [child] = formatWorkerTranscriptMessages([
+      message('child', 'Still looking.', { agentId: 'task-9' })
+    ])
+    expect(child).toBe('[assistant, subagent] Still looking.')
+  })
+})
diff --git a/src/shared/worker-transcript-text-scaling.test.ts b/src/shared/worker-transcript-text-scaling.test.ts
index 92283cb2431..d00778e4d1a 100644
--- a/src/shared/worker-transcript-text-scaling.test.ts
+++ b/src/shared/worker-transcript-text-scaling.test.ts
@@ -1,7 +1,10 @@
 import { expect, it, vi } from 'vitest'
-import { formatWorkerTranscriptMessage } from './worker-transcript-text'
+import { formatWorkerTranscriptMessages } from './worker-transcript-text'
 import type { NativeChatMessage } from './native-chat-types'
 
+const formatWorkerTranscriptMessage = (message: NativeChatMessage): string =>
+  formatWorkerTranscriptMessages([message]).join('')
+
 it('does not shift the remaining twin list for each matching roster', () => {
   const blocks: NativeChatMessage['blocks'] = Array.from({ length: 1000 }, (_, index) => ({
     type: 'subagent-group',
diff --git a/src/shared/worker-transcript-text.ts b/src/shared/worker-transcript-text.ts
index 45a98a87835..fd42193edd8 100644
--- a/src/shared/worker-transcript-text.ts
+++ b/src/shared/worker-transcript-text.ts
@@ -12,8 +12,36 @@ import {
   subagentGroupFallbackText
 } from './native-chat-subagent-summary'
 import type { NativeChatMessage } from './native-chat-types'
+import { agentJournalItemSubagentId } from './agent-session-journal-producer'
+import {
+  nativeChatSubagentLabel,
+  nativeChatSubagentLabels
+} from './native-chat-subagent-attribution'
 
-export function formatWorkerTranscriptMessage(message: NativeChatMessage): string {
+/** Every message in one read, each tagged with who it speaks as. A subagent is
+ *  named by the roster on the same page. */
+export function formatWorkerTranscriptMessages(messages: readonly NativeChatMessage[]): string[] {
+  const subagentLabels = nativeChatSubagentLabels(messages)
+  return messages.map((message) => formatWorkerTranscriptMessage(message, subagentLabels))
+}
+
+/** Who a line speaks as. A subagent's lines are tagged as its own, so a peer reading
+ *  a worker's transcript never takes a subagent's words for the worker's. */
+function workerTranscriptSpeaker(
+  message: NativeChatMessage,
+  subagentLabels: ReadonlyMap<string, string> | undefined
+): string {
+  if (agentJournalItemSubagentId(message) === null) {
+    return message.role
+  }
+  const label = nativeChatSubagentLabel(subagentLabels, message)
+  return label === undefined ? `${message.role}, subagent` : `${message.role}, subagent ${label}`
+}
+
+function formatWorkerTranscriptMessage(
+  message: NativeChatMessage,
+  subagentLabels: ReadonlyMap<string, string>
+): string {
   // Every roster block is written beside a plain-text twin carrying the same
   // sentence, for clients that cannot draw the block. Text surfaces are those
   // clients, so they print the twin and drop the block. The renderer reaches the
@@ -49,7 +77,7 @@ export function formatWorkerTranscriptMessage(message: NativeChatMessage): strin
     // than reading fields off a shape that has none.
     return '[unsupported block]'
   })
-  return `[${message.role}] ${blocks.filter((line) => line !== null).join('\n')}`.trimEnd()
+  return `[${workerTranscriptSpeaker(message, subagentLabels)}] ${blocks.filter((line) => line !== null).join('\n')}`.trimEnd()
 }
 
 /** For each roster block, the sentence it must print itself — absent when a twin
diff --git a/src/shared/workspace-session-schema-field-coverage.test.ts b/src/shared/workspace-session-schema-field-coverage.test.ts
index 28572703d5a..c7001060b7b 100644
--- a/src/shared/workspace-session-schema-field-coverage.test.ts
+++ b/src/shared/workspace-session-schema-field-coverage.test.ts
@@ -91,13 +91,16 @@ describe('workspaceSessionStateSchema field coverage', () => {
     const parsed = parseWorkspaceSession({
       ...MINIMAL_SESSION,
       closedTerminalTabTombstonesByTabId: {
-        'tab-1': { closedAt: 1_700_000_000_000, worktreeId: 'repo:wt-1', ackRevision: 4 }
+        'tab-1': { closedAt: 1_700_000_000_000, worktreeId: 'repo:wt-1', reason: 'cleanup' },
+        // An older build's acknowledgement stamp is dropped; the record itself survives.
+        'tab-2': { closedAt: 1_700_000_000_000, worktreeId: 'repo:wt-1', ackRevision: 4 }
       }
     })
 
     expect(parsed.ok).toBe(true)
     expect(parsed.ok && parsed.value.closedTerminalTabTombstonesByTabId).toEqual({
-      'tab-1': { closedAt: 1_700_000_000_000, worktreeId: 'repo:wt-1', ackRevision: 4 }
+      'tab-1': { closedAt: 1_700_000_000_000, worktreeId: 'repo:wt-1', reason: 'cleanup' },
+      'tab-2': { closedAt: 1_700_000_000_000, worktreeId: 'repo:wt-1' }
     })
   })
 
diff --git a/src/shared/workspace-session-schema.ts b/src/shared/workspace-session-schema.ts
index f2138905960..54448e1e547 100644
--- a/src/shared/workspace-session-schema.ts
+++ b/src/shared/workspace-session-schema.ts
@@ -71,6 +71,7 @@ const terminalLayoutSnapshotSchema = z.object({
   root: terminalPaneLayoutNodeSchema.nullable(),
   activeLeafId: z.string().nullable(),
   expandedLeafId: z.string().nullable(),
+  chatLeafId: z.string().optional(),
   ptyIdsByLeafId: salvagedOptional('ptyIdsByLeafId', leafStringsSchema),
   buffersByLeafId: salvagedOptional('buffersByLeafId', leafStringsSchema),
   scrollbackRefsByLeafId: salvagedOptional('scrollbackRefsByLeafId', leafStringsSchema),
diff --git a/src/shared/workspace-session-sleeping-agents.ts b/src/shared/workspace-session-sleeping-agents.ts
index 2f2ac1252bb..624996e0dc2 100644
--- a/src/shared/workspace-session-sleeping-agents.ts
+++ b/src/shared/workspace-session-sleeping-agents.ts
@@ -5,6 +5,7 @@ import {
   RESUMABLE_TUI_AGENTS
 } from './agent-session-resume'
 import { isValidTerminalTabId } from './terminal-tab-id'
+import { normalizeMainAgentStatusField } from './agent-status-types'
 import { salvagingRecord } from './zod-salvage'
 
 const terminalTabIdSchema = z
@@ -96,6 +97,8 @@ const sleepingAgentSessionRecordSchema = z
     terminalTitle: z.string().optional(),
     lastAssistantMessage: z.string().optional(),
     interrupted: z.boolean().optional(),
+    // A malformed value drops the field, never the record.
+    mainAgent: z.unknown().transform(normalizeMainAgentStatusField).optional(),
     connectionId: z.string().nullable().optional(),
     launchConfig: sleepingAgentLaunchConfigSchema.optional(),
     origin: z.enum(['worktree-sleep', 'quit', 'live']).optional(),
diff --git a/src/shared/workspace-session-terminal-schema.test.ts b/src/shared/workspace-session-terminal-schema.test.ts
index 18a930fa492..a01998a9512 100644
--- a/src/shared/workspace-session-terminal-schema.test.ts
+++ b/src/shared/workspace-session-terminal-schema.test.ts
@@ -2,6 +2,28 @@ import { describe, expect, it } from 'vitest'
 import { parseWorkspaceSession } from './workspace-session-schema'
 
 describe('parseWorkspaceSession terminal fields', () => {
+  it('preserves the native chat owner leaf in a terminal layout', () => {
+    const result = parseWorkspaceSession({
+      activeRepoId: null,
+      activeWorktreeId: 'wt',
+      activeTabId: 'tab1',
+      tabsByWorktree: {},
+      terminalLayoutsByTabId: {
+        tab1: {
+          root: { type: 'leaf', leafId: 'leaf-chat' },
+          activeLeafId: 'leaf-chat',
+          expandedLeafId: null,
+          chatLeafId: 'leaf-chat'
+        }
+      }
+    })
+
+    expect(result.ok).toBe(true)
+    if (result.ok) {
+      expect(result.value.terminalLayoutsByTabId.tab1?.chatLeafId).toBe('leaf-chat')
+    }
+  })
+
   it('preserves terminal startup cwd while accepting older omitted fields', () => {
     const result = parseWorkspaceSession({
       activeRepoId: null,
diff --git a/src/shared/zip-extractor-command.ts b/src/shared/zip-extractor-command.ts
new file mode 100644
index 00000000000..1f6564e22f6
--- /dev/null
+++ b/src/shared/zip-extractor-command.ts
@@ -0,0 +1,20 @@
+import { join } from 'node:path'
+
+/** The destination must already exist; callers extract only checksum-verified archives. */
+export function getZipExtractorCommand(
+  zipPath: string,
+  extractDir: string
+): { file: string; args: string[]; label: string } {
+  if (process.platform === 'win32' && !process.env.ORCA_UNZIP_BIN) {
+    return {
+      file: join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe'),
+      args: ['-xf', zipPath, '-C', extractDir],
+      label: 'tar'
+    }
+  }
+  return {
+    file: process.env.ORCA_UNZIP_BIN || 'unzip',
+    args: ['-q', zipPath, '-d', extractDir],
+    label: 'unzip'
+  }
+}
diff --git a/tests/e2e/add-project-error-toast-stacking.spec.ts b/tests/e2e/add-project-error-toast-stacking.spec.ts
new file mode 100644
index 00000000000..e482404367a
--- /dev/null
+++ b/tests/e2e/add-project-error-toast-stacking.spec.ts
@@ -0,0 +1,180 @@
+import path from 'node:path'
+import type { ElectronApplication, TestInfo } from '@stablyai/playwright-test'
+import { test, expect } from './helpers/orca-app'
+import { openSidebarProjectDialog } from './helpers/sidebar-project-dialog'
+import {
+  createRuntimeDesktopPairingOffer,
+  launchPairedElectronClient
+} from './helpers/paired-electron-client'
+
+test.use({
+  seedTestRepo: false,
+  testRepoPath: '',
+  orcaAppExtraEnv: { ORCA_BACKGROUND_LAUNCH: '1' }
+})
+
+async function assertHiddenIsolation(app: ElectronApplication, testInfo: TestInfo, name: string) {
+  const isolation = await app.evaluate(({ app, BrowserWindow }) => ({
+    home: app.getPath('home'),
+    expectedHome: process.env.ORCA_E2E_HOME_DIR,
+    appPath: app.getAppPath(),
+    background: process.env.ORCA_BACKGROUND_LAUNCH,
+    windows: BrowserWindow.getAllWindows().map((window) => ({
+      visible: window.isVisible(),
+      focused: window.isFocused()
+    }))
+  }))
+  expect(isolation.home).toBe(isolation.expectedHome)
+  expect(isolation.background).toBe('1')
+  expect(isolation.appPath).toContain(process.cwd())
+  expect(isolation.windows.every((window) => !window.visible && !window.focused)).toBe(true)
+  await testInfo.attach(name, { body: JSON.stringify(isolation), contentType: 'application/json' })
+  return isolation.home
+}
+
+for (const theme of ['dark', 'light'] as const) {
+  test(`invalid host project path stays readable over its dialog (${theme})`, async ({
+    electronApp,
+    orcaPage
+  }, testInfo) => {
+    const hostHome = await assertHiddenIsolation(electronApp, testInfo, 'host-isolation')
+    const offer = await createRuntimeDesktopPairingOffer(orcaPage)
+    const client = await launchPairedElectronClient(offer, testInfo, 'Disposable host', {
+      extraEnv: { ORCA_BACKGROUND_LAUNCH: '1' }
+    })
+    try {
+      await assertHiddenIsolation(client.app, testInfo, 'client-isolation')
+      const page = client.page
+      await page.evaluate(async (theme) => {
+        await window.__store?.getState().updateSettings({ theme })
+      }, theme)
+      await openSidebarProjectDialog(page)
+      const dialog = page.getByRole('dialog', { name: /Add a project/i })
+      const hostPicker = dialog.getByRole('combobox')
+      await hostPicker.click()
+      await page.locator('[cmdk-item]').filter({ hasText: 'Disposable host' }).click()
+      await dialog.getByRole('button', { name: /Browse folder|Browse host/i }).click()
+      await page
+        .getByRole('dialog', { name: /Browse host filesystem/i })
+        .getByRole('button', { name: 'Cancel', exact: true })
+        .click()
+      const pathField = page.locator('#server-project-path')
+      const missingPath = path.join(hostHome, 'missing-project')
+      await pathField.fill(missingPath)
+      await page.getByRole('button', { name: 'Add Git Project' }).click()
+      const toast = page
+        .locator('[data-sonner-toast]')
+        .filter({ hasText: 'Cannot open folder on selected runtime' })
+        .first()
+      await expect(toast).toBeVisible()
+      await expect(pathField).toHaveValue(missingPath)
+      await expect(page.getByRole('dialog', { name: /Open host project/i })).toBeVisible()
+      await page.screenshot({
+        path: testInfo.outputPath(`toast-over-dialog-${theme}.png`),
+        animations: 'disabled'
+      })
+      const layers = await toast.evaluate((element) => {
+        const overlay = document.querySelector('[data-slot="dialog-overlay"]')
+        const toaster = element.closest('[data-sonner-toaster]')
+        if (!overlay || !toaster) {
+          throw new Error('Missing modal/toast layers')
+        }
+        return {
+          toast: Number(getComputedStyle(toaster).zIndex),
+          overlay: Number(getComputedStyle(overlay).zIndex),
+          pointerEvents: getComputedStyle(element).pointerEvents
+        }
+      })
+      await testInfo.attach('layers', {
+        body: JSON.stringify(layers),
+        contentType: 'application/json'
+      })
+      expect(layers.toast, 'dialog overlay covers the project error').toBeGreaterThan(
+        layers.overlay
+      )
+      expect(layers.pointerEvents).toBe('none')
+      await pathField.click()
+      // Radix still owns pointer/focus containment; a visible toast must not steal the form.
+      await expect(
+        toast.locator('[data-close-button]').click({ trial: true, timeout: 300 })
+      ).rejects.toThrow()
+      await expect(pathField).toHaveValue(missingPath)
+      expect(await pathField.evaluate((input) => input === document.activeElement)).toBe(true)
+
+      // A real action-toast renderer, fed a synthetic notification in this disposable client only.
+      await client.app.evaluate(({ ipcMain, BrowserWindow }) => {
+        ipcMain.removeHandler('mobile:consumePendingUnpairedDeviceAuthFailure')
+        ipcMain.handle('mobile:consumePendingUnpairedDeviceAuthFailure', () => true)
+        BrowserWindow.getAllWindows()[0].webContents.send('mobile:unpairedDeviceAuthFailure')
+      })
+      const actionToast = page
+        .locator('[data-sonner-toast]')
+        .filter({ hasText: 'A device tried to connect but is not paired' })
+      const action = actionToast.getByRole('button', { name: 'Open Mobile Settings' })
+      await expect(action).toBeVisible()
+      await expect(action.click({ trial: true, timeout: 300 })).rejects.toThrow()
+      await expect(pathField).toHaveValue(missingPath)
+      expect(await pathField.evaluate((input) => input === document.activeElement)).toBe(true)
+
+      // Credential prompts deliberately use a higher tier; this visibility fix does not cross it.
+      await page.evaluate(() =>
+        window.__store?.getState().enqueueSshCredentialRequest({
+          requestId: 'toast-layer-fixture',
+          targetId: 'Simulated SSH prompt',
+          kind: 'password',
+          detail: 'Layering fixture only'
+        })
+      )
+      await expect(page.getByRole('dialog', { name: 'SSH Password' })).toBeVisible()
+      await page.screenshot({
+        path: testInfo.outputPath(`higher-modal-residual-${theme}.png`),
+        animations: 'disabled'
+      })
+      expect(
+        await page
+          .locator('[data-slot="dialog-overlay"]')
+          .evaluateAll((overlays) =>
+            Math.max(...overlays.map((overlay) => Number(getComputedStyle(overlay).zIndex)))
+          )
+      ).toBe(140)
+      await page.evaluate(() =>
+        window.__store?.getState().removeSshCredentialRequest('toast-layer-fixture')
+      )
+      await expect(pathField).toHaveValue(missingPath)
+      await page
+        .getByRole('dialog', { name: /Open host project/i })
+        .getByRole('button', { name: 'Close', exact: true })
+        .click()
+      await expect(page.locator('[data-slot="dialog-overlay"]')).toHaveCount(0)
+      const toaster = page.locator('[data-sonner-toaster]')
+      await expect(toaster).toHaveCSS('z-index', '40')
+      await toast.locator('[data-close-button]').click()
+      await expect(toast).toBeHidden()
+
+      await page.evaluate(async () => {
+        await window.__store?.getState().updateSettings({ experimentalAgentDashboardPopout: true })
+      })
+      await page.evaluate(() => window.__store?.getState().setAgentDashboardDrawerOpen(true))
+      await expect(page.locator('[data-agent-dashboard-sheet]')).toBeVisible()
+      await expect(page.locator('[data-slot="sheet-overlay"]')).toHaveCount(0)
+      await expect(toaster).toHaveCSS('z-index', '40')
+      await page.screenshot({
+        path: testInfo.outputPath(`nonmodal-drawer-${theme}.png`),
+        animations: 'disabled'
+      })
+      await page.evaluate(() => window.__store?.getState().setAgentDashboardDrawerOpen(false))
+      // Scroll-lock is also used by selects and menus and must not by itself lift notifications.
+      await page.evaluate(() => document.body.setAttribute('data-scroll-locked', '1'))
+      await expect(toaster).toHaveCSS('z-index', '40')
+      await page.evaluate(() => document.body.removeAttribute('data-scroll-locked'))
+      await action.click()
+      await expect(page.getByPlaceholder('Search settings')).toBeVisible()
+      await assertHiddenIsolation(client.app, testInfo, 'client-final-isolation')
+      await assertHiddenIsolation(electronApp, testInfo, 'host-final-isolation')
+      expect(await client.getDirectSshAttemptTargetIds()).toEqual([])
+      expect(await orcaPage.evaluate(() => window.api.repos.list())).toEqual([])
+    } finally {
+      await client.dispose()
+    }
+  })
+}
diff --git a/tests/e2e/agent-session-live-force-exit-resume.spec.ts b/tests/e2e/agent-session-live-force-exit-resume.spec.ts
index 18e98409094..b6609c29df7 100644
--- a/tests/e2e/agent-session-live-force-exit-resume.spec.ts
+++ b/tests/e2e/agent-session-live-force-exit-resume.spec.ts
@@ -1,5 +1,9 @@
+import {
+  readPersistedProfileState,
+  mutateStoppedProfileState
+} from './helpers/persisted-profile-state'
 import { execFileSync } from 'node:child_process'
-import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import type { ChildProcess } from 'node:child_process'
 import type { ElectronApplication } from '@stablyai/playwright-test'
@@ -16,7 +20,6 @@ import {
 import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
 import { attachRepoAndOpenTerminal, createRestartSession } from './helpers/orca-restart'
 import { PROTOCOL_VERSION } from '../../src/main/daemon/types'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 
 const PROVIDER_SESSION_ID = 'e2e-live-force-exit-session'
 
@@ -41,17 +44,9 @@ type PersistedData = {
   workspaceSession?: PersistedWorkspaceSession
 }
 
-function dataFilePath(userDataDir: string): string {
-  // Fresh sessions migrate the seeded legacy file, then persist only here.
-  return path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID, 'orca-data.json')
-}
-
 function readPersistedData(userDataDir: string): PersistedData {
-  return JSON.parse(readFileSync(dataFilePath(userDataDir), 'utf8')) as PersistedData
-}
-
-function writePersistedData(userDataDir: string, data: PersistedData): void {
-  writeFileSync(dataFilePath(userDataDir), `${JSON.stringify(data, null, 2)}\n`, 'utf8')
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+  return readPersistedProfileState(userDataDir) as PersistedData
 }
 
 function daemonPidPath(userDataDir: string): string {
@@ -115,29 +110,31 @@ function killPid(pid: number): void {
 }
 
 function stripPersistedPtyOwnership(userDataDir: string): void {
-  const data = readPersistedData(userDataDir)
-  const session = data.workspaceSession
-  if (!session) {
-    throw new Error('Expected persisted workspace session')
-  }
-  for (const tabs of Object.values(session.tabsByWorktree ?? {})) {
-    for (const tab of tabs) {
-      tab.ptyId = null
+  return mutateStoppedProfileState(userDataDir, (state) => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+    const data = state as PersistedData
+    const session = data.workspaceSession
+    if (!session) {
+      throw new Error('Expected persisted workspace session')
     }
-  }
-  // Why: this models the updater/crash artifact from #6370: the UI tab and
-  // live resume record survive, but no pane has the old stable leaf key or
-  // daemon session to own resume.
-  session.terminalLayoutsByTabId = {}
-  session.activeWorktreeIdsOnShutdown = []
-  for (const record of Object.values(session.sleepingAgentSessionsByPaneKey ?? {})) {
-    if (record.providerSession?.id === PROVIDER_SESSION_ID) {
-      // Why: the e2e proof should verify Orca launches the resumed command,
-      // not depend on a developer machine having a real Codex CLI installed.
-      record.launchConfig = { agentCommand: 'echo', agentArgs: '', agentEnv: {} }
+    for (const tabs of Object.values(session.tabsByWorktree ?? {})) {
+      for (const tab of tabs) {
+        tab.ptyId = null
+      }
     }
-  }
-  writePersistedData(userDataDir, data)
+    // Why: this models the updater/crash artifact from #6370: the UI tab and
+    // live resume record survive, but no pane has the old stable leaf key or
+    // daemon session to own resume.
+    session.terminalLayoutsByTabId = {}
+    session.activeWorktreeIdsOnShutdown = []
+    for (const record of Object.values(session.sleepingAgentSessionsByPaneKey ?? {})) {
+      if (record.providerSession?.id === PROVIDER_SESSION_ID) {
+        // Why: the e2e proof should verify Orca launches the resumed command,
+        // not depend on a developer machine having a real Codex CLI installed.
+        record.launchConfig = { agentCommand: 'echo', agentArgs: '', agentEnv: {} }
+      }
+    }
+  })
 }
 
 function persistedLiveRecordExists(userDataDir: string): boolean {
diff --git a/tests/e2e/agent-session-quit-resume.spec.ts b/tests/e2e/agent-session-quit-resume.spec.ts
index 17c68f01ca7..b4a8573904f 100644
--- a/tests/e2e/agent-session-quit-resume.spec.ts
+++ b/tests/e2e/agent-session-quit-resume.spec.ts
@@ -1,4 +1,5 @@
-import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { mutateStoppedProfileState } from './helpers/persisted-profile-state'
+import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import type { ElectronApplication } from '@stablyai/playwright-test'
 import { test, expect } from './helpers/orca-app'
@@ -14,40 +15,35 @@ import {
 import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
 import { attachRepoAndOpenTerminal, createRestartSession } from './helpers/orca-restart'
 import { PROTOCOL_VERSION } from '../../src/main/daemon/types'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 
 const PROVIDER_SESSION_ID = 'e2e-quit-resume-session'
 
 function stubPersistedResumeCommand(userDataDir: string): void {
-  const dataPath = path.join(
-    userDataDir,
-    'profiles',
-    DEFAULT_LOCAL_ORCA_PROFILE_ID,
-    'orca-data.json'
-  )
-  const data = JSON.parse(readFileSync(dataPath, 'utf8')) as {
-    workspaceSession?: {
-      sleepingAgentSessionsByPaneKey?: Record<
-        string,
-        {
-          providerSession?: { id?: unknown }
-          launchConfig?: {
-            agentCommand?: string
-            agentArgs?: string
-            agentEnv?: Record<string, string>
+  return mutateStoppedProfileState(userDataDir, (state) => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+    const data = state as {
+      workspaceSession?: {
+        sleepingAgentSessionsByPaneKey?: Record<
+          string,
+          {
+            providerSession?: { id?: unknown }
+            launchConfig?: {
+              agentCommand?: string
+              agentArgs?: string
+              agentEnv?: Record<string, string>
+            }
           }
-        }
-      >
+        >
+      }
     }
-  }
-  const record = Object.values(data.workspaceSession?.sleepingAgentSessionsByPaneKey ?? {}).find(
-    (candidate) => candidate.providerSession?.id === PROVIDER_SESSION_ID
-  )
-  if (!record) {
-    throw new Error('Expected a persisted resumable agent session')
-  }
-  record.launchConfig = { agentCommand: 'echo', agentArgs: '', agentEnv: {} }
-  writeFileSync(dataPath, `${JSON.stringify(data, null, 2)}\n`, 'utf8')
+    const record = Object.values(data.workspaceSession?.sleepingAgentSessionsByPaneKey ?? {}).find(
+      (candidate) => candidate.providerSession?.id === PROVIDER_SESSION_ID
+    )
+    if (!record) {
+      throw new Error('Expected a persisted resumable agent session')
+    }
+    record.launchConfig = { agentCommand: 'echo', agentArgs: '', agentEnv: {} }
+  })
 }
 
 function readDaemonPid(userDataDir: string): number {
diff --git a/tests/e2e/browser-address-bar-narrow-toolbar.spec.ts b/tests/e2e/browser-address-bar-narrow-toolbar.spec.ts
index de24f0f4e6d..4c75f9cdd35 100644
--- a/tests/e2e/browser-address-bar-narrow-toolbar.spec.ts
+++ b/tests/e2e/browser-address-bar-narrow-toolbar.spec.ts
@@ -24,8 +24,8 @@ import { BROWSER_ADDRESS_BAR_MIN_INLINE_WIDTH } from '../../src/renderer/src/com
 // the middle of that band rather than a fixed window width, because how much
 // chrome flanks the pane (left sidebar, and a right sidebar that other startup
 // paths may re-open) varies between runs.
-const TARGET_TOOLBAR_WIDTH = 420
-const MIN_USABLE_TOOLBAR_WIDTH = BROWSER_ADDRESS_BAR_MIN_INLINE_WIDTH + 100
+const TARGET_TOOLBAR_WIDTH = 260
+const MIN_USABLE_TOOLBAR_WIDTH = BROWSER_ADDRESS_BAR_MIN_INLINE_WIDTH + 20
 const NARROW_WINDOW_HEIGHT = 800
 
 async function startDestinationServer(): Promise<{ url: string; close: () => Promise<void> }> {
@@ -62,6 +62,8 @@ async function setWindowWidth(electronApp: ElectronApplication, width: number):
       if (!window) {
         throw new Error('No Electron window')
       }
+      // Window minimums otherwise mask the narrow-pane state on some runners.
+      window.setMinimumSize(0, 0)
       window.setSize(size.width, size.height)
     },
     { width: Math.round(width), height: NARROW_WINDOW_HEIGHT }
@@ -118,8 +120,11 @@ async function settleToSqueezedRestingState(
         // Chrome flanking the pane is everything the toolbar didn't get.
         await setWindowWidth(electronApp, innerWidth - toolbar + TARGET_TOOLBAR_WIDTH)
         await addressBarInput(page).evaluate((node) => node.blur())
+        const measuredToolbar = await toolbarWidth(page)
         return {
-          toolbar: (await toolbarWidth(page)) > MIN_USABLE_TOOLBAR_WIDTH,
+          toolbar:
+            measuredToolbar > MIN_USABLE_TOOLBAR_WIDTH &&
+            measuredToolbar <= TARGET_TOOLBAR_WIDTH + 5,
           collapsed: (await addressBarOverlay(page).count()) === 0
         }
       },
diff --git a/tests/e2e/browser-floating-shortcut-scope.spec.ts b/tests/e2e/browser-floating-shortcut-scope.spec.ts
index 653c81a0dd9..a7df8992b44 100644
--- a/tests/e2e/browser-floating-shortcut-scope.spec.ts
+++ b/tests/e2e/browser-floating-shortcut-scope.spec.ts
@@ -69,16 +69,20 @@ function findInput(page: Page, browserTabId: string) {
   return browserOverlay(page, browserTabId).getByPlaceholder('Find in page...')
 }
 
-function grabButton(page: Page, browserTabId: string) {
+function cancelGrabButton(page: Page, browserTabId: string) {
   return browserOverlay(page, browserTabId).getByRole('button', {
-    name: 'Grab page element',
+    name: 'Cancel',
     exact: true
   })
 }
 
 // Why: a non-editable chrome target, so reload and grab are not skipped as text-field keys.
 async function focusChrome(page: Page, browserTabId: string): Promise<void> {
-  const target = grabButton(page, browserTabId)
+  // Reload stays in the toolbar when narrow panes fold their element tools into the menu.
+  const target = browserOverlay(page, browserTabId).getByRole('button', {
+    name: 'Reload',
+    exact: true
+  })
   await expect(target).toBeEnabled()
   await target.focus()
   await expect(target).toBeFocused()
@@ -148,10 +152,10 @@ test.describe('floating browser shortcut scope', () => {
 
           await focusChrome(orcaPage, owner)
           await orcaPage.keyboard.press(`${shortcutModifier}+c`)
-          await expect(grabButton(orcaPage, owner)).toHaveAttribute('data-variant', 'default')
-          await expect(grabButton(orcaPage, other)).toHaveAttribute('data-variant', 'ghost')
-          await grabButton(orcaPage, owner).click()
-          await expect(grabButton(orcaPage, owner)).toHaveAttribute('data-variant', 'ghost')
+          await expect(cancelGrabButton(orcaPage, owner)).toBeVisible()
+          await expect(cancelGrabButton(orcaPage, other)).toBeHidden()
+          await cancelGrabButton(orcaPage, owner).click()
+          await expect(cancelGrabButton(orcaPage, owner)).toBeHidden()
         })
       }
 
diff --git a/tests/e2e/browser-pointer-input-dispatch.spec.ts b/tests/e2e/browser-pointer-input-dispatch.spec.ts
index 3068d062680..6a797117a64 100644
--- a/tests/e2e/browser-pointer-input-dispatch.spec.ts
+++ b/tests/e2e/browser-pointer-input-dispatch.spec.ts
@@ -178,7 +178,9 @@ function clickSteps(x: number, y: number, button = 'left'): RpcStep[] {
   ]
 }
 
-test('dispatches coordinate pointer input fast enough for real gestures', async ({ orcaPage }) => {
+test('dispatches coordinate pointer input fast enough for real gestures @headful', async ({
+  orcaPage
+}) => {
   // Why: the measurement loop plus the gesture checks drive a few hundred serialized RPCs;
   // a loaded CI runner needs more than the default budget even when each one is fast.
   test.setTimeout(240_000)
@@ -244,13 +246,11 @@ test('dispatches coordinate pointer input fast enough for real gestures', async
     // numbers ride along in the annotation where the failure artifact will carry them.
     test.info().annotations.push({ type: 'pointer-latency', description: latencyReport })
 
-    // Why: absolute milliseconds vary by host, so compare against browser.eval on the same
-    // socket and queue — a pointer event that spawns the helper costs that plus a process
-    // launch. Measured multiples of the control: in process 1.5x/1.5x/4x, via the helper
-    // 5.7x/5.5x/20.5x. These thresholds sit between the two, not near either.
-    expect(latency.mouseMove, latencyReport).toBeLessThan(latency.evalControl * 3)
-    expect(latency.mouseWheel, latencyReport).toBeLessThan(latency.evalControl * 3)
-    expect(latency.click, latencyReport).toBeLessThan(latency.evalControl * 10)
+    // CDP pointer dispatch waits for a frame; fast evaluation can finish far below one.
+    const dispatchControlMs = Math.max(latency.evalControl, 1000 / 60)
+    expect(latency.mouseMove, latencyReport).toBeLessThan(dispatchControlMs * 3)
+    expect(latency.mouseWheel, latencyReport).toBeLessThan(dispatchControlMs * 3)
+    expect(latency.click, latencyReport).toBeLessThan(dispatchControlMs * 10)
 
     // ── Gesture fidelity ──
 
diff --git a/tests/e2e/codex-child-approval-activity-row.unit.test.ts b/tests/e2e/codex-child-approval-activity-row.unit.test.ts
index b9210bf79e8..71bb0fddce1 100644
--- a/tests/e2e/codex-child-approval-activity-row.unit.test.ts
+++ b/tests/e2e/codex-child-approval-activity-row.unit.test.ts
@@ -143,7 +143,9 @@ async function openHost() {
     journalDir: join(root, SESSION)
   })
   const feed = new StructuredAgentSessionStatusFeed({
-    sessions: new Map([[SESSION, indexedStatusFeedSession({ journal, hasProviderChild: true })]]),
+    sessions: new Map([
+      [SESSION, indexedStatusFeedSession({ journal, child: { phase: 'ready' } })]
+    ]),
     getRecord: () => null,
     now: () => 1,
     readBackgroundTasks: () => ({ state: 'monitoring', tasks: [] })
diff --git a/tests/e2e/combined-diff-invalidation-freeze-repro.spec.ts b/tests/e2e/combined-diff-invalidation-freeze-repro.spec.ts
index cb11acf25f3..99b6b939f6d 100644
--- a/tests/e2e/combined-diff-invalidation-freeze-repro.spec.ts
+++ b/tests/e2e/combined-diff-invalidation-freeze-repro.spec.ts
@@ -299,6 +299,7 @@ test.describe('Combined diff invalidation freeze repro (STA-3420)', () => {
       )
 
       console.log(`external-change burst measurement ${JSON.stringify(measurement)}`)
+      expect(measurement.sectionRowCount).toBe(1)
       expect(measurement.stuckLoadingRowCount).toBe(0)
       expect(measurement.editorCount).toBeGreaterThan(0)
       // Why: before the fix this window blocked continuously — p95 3963ms, 16 samples in 23s.
diff --git a/tests/e2e/combined-diff-scroll-restore.spec.ts b/tests/e2e/combined-diff-scroll-restore.spec.ts
index 496bead3db6..da02f8d0bdd 100644
--- a/tests/e2e/combined-diff-scroll-restore.spec.ts
+++ b/tests/e2e/combined-diff-scroll-restore.spec.ts
@@ -370,26 +370,27 @@ async function clickVisibleDiffLine(page: Page): Promise<void> {
             return null
           }
           const containerRect = container.getBoundingClientRect()
-          const visibleLine = Array.from(
-            container.querySelectorAll<HTMLElement>('.monaco-diff-editor .view-line')
-          ).find((line) => {
+          for (const line of container.querySelectorAll<HTMLElement>(
+            '.monaco-diff-editor .view-line'
+          )) {
             const rect = line.getBoundingClientRect()
-            return (
-              rect.height > 0 &&
-              rect.bottom > containerRect.top &&
-              rect.top < containerRect.bottom &&
-              rect.right > containerRect.left &&
-              rect.left < containerRect.right
-            )
-          })
-          if (!visibleLine) {
-            return null
-          }
-          const rect = visibleLine.getBoundingClientRect()
-          return {
-            x: rect.left + Math.min(12, Math.max(1, rect.width / 2)),
-            y: rect.top + rect.height / 2
+            const left = Math.max(rect.left, containerRect.left)
+            const right = Math.min(rect.right, containerRect.right)
+            const top = Math.max(rect.top, containerRect.top)
+            const bottom = Math.min(rect.bottom, containerRect.bottom)
+            if (left >= right || top >= bottom) {
+              continue
+            }
+            const point = {
+              x: left + Math.min(12, (right - left) / 2),
+              y: (top + bottom) / 2
+            }
+            // Sticky headers can cover a line whose rectangle intersects the viewport.
+            if (line.contains(document.elementFromPoint(point.x, point.y))) {
+              return point
+            }
           }
+          return null
         })
         return linePoint !== null
       },
diff --git a/tests/e2e/completed-worker-retirement-resume.spec.ts b/tests/e2e/completed-worker-retirement-resume.spec.ts
index 6935cbe1895..0af7ca46f12 100644
--- a/tests/e2e/completed-worker-retirement-resume.spec.ts
+++ b/tests/e2e/completed-worker-retirement-resume.spec.ts
@@ -160,21 +160,13 @@ for (const closeMode of ['terminal-close-cli', 'worker-release'] as const) {
     const workerBefore = terminalIdentity(worker)
     const workerPaneKey = `${worker.tabId}:${worker.leafId}`
     expect(worker.worktreeId).toBe(targetWorktreeId)
-    await orcaPage.evaluate(
-      ({ tabId, worktreeId }) => {
-        window.dispatchEvent(
-          new CustomEvent('orca-background-mount-terminal-worktree', {
-            detail: { worktreeId, tabIds: [tabId] }
-          })
-        )
-      },
-      { tabId: worker.tabId, worktreeId: targetWorktreeId }
-    )
-    await expect
-      .poll(() =>
-        orcaPage.evaluate((tabId) => Boolean(window.__paneManagers?.get(tabId)), workerBefore.tabId)
+    // Keep the never-opened worker dormant so foreground-shell cleanup cannot retire it first.
+    expect(
+      await orcaPage.evaluate(
+        (tabId) => Boolean(window.__paneManagers?.get(tabId)),
+        workerBefore.tabId
       )
-      .toBe(true)
+    ).toBe(false)
     expect(
       await orcaPage.evaluate(
         (worktreeId) => window.__store?.getState().everActivatedWorktreeIds.has(worktreeId),
@@ -202,70 +194,13 @@ for (const closeMode of ['terminal-close-cli', 'worker-release'] as const) {
       throw new Error('Background worker did not receive its dispatch capability')
     }
 
-    const transcriptPath = seedCurrentCodexTranscript(
-      isolatedHome,
-      PROVIDER_SESSION_ID,
-      targetWorktreePath
-    )
+    seedCurrentCodexTranscript(isolatedHome, PROVIDER_SESSION_ID, targetWorktreePath)
 
-    await orcaPage.evaluate(
-      ({
-        agentCommand,
-        paneKey,
-        providerSessionId,
-        tabId,
-        terminalHandle,
-        transcriptPath,
-        worktreeId
-      }) => {
-        const state = window.__store?.getState()
-        if (!state) {
-          throw new Error('Renderer store unavailable')
-        }
-        const providerSession = {
-          key: 'session_id' as const,
-          id: providerSessionId,
-          transcriptPath
-        }
-        const metadata = { tabId, worktreeId, terminalHandle }
-        const recovery = {
-          providerSession,
-          launchConfig: {
-            // Why not bare 'codex': resume prefers the captured command over
-            // agentCmdOverrides, so a bare name would resolve the machine's real
-            // Codex off PATH and unpin the adoption leg this spec exercises.
-            agentCommand,
-            agentArgs: '--dangerously-bypass-approvals-and-sandbox',
-            agentEnv: {}
-          }
-        }
-        state.setAgentStatus(
-          paneKey,
-          { state: 'working', prompt: 'Report completion, then exit normally', agentType: 'codex' },
-          'Completed background worker',
-          undefined,
-          metadata,
-          recovery
-        )
-        state.setAgentStatus(
-          paneKey,
-          { state: 'done', prompt: 'Report completion, then exit normally', agentType: 'codex' },
-          'Completed background worker',
-          undefined,
-          metadata,
-          recovery
-        )
-      },
-      {
-        agentCommand: completedWorkerFakeCodexCommand,
-        paneKey: workerPaneKey,
-        providerSessionId: PROVIDER_SESSION_ID,
-        tabId: worker.tabId,
-        terminalHandle: workerHandle,
-        transcriptPath,
-        worktreeId: targetWorktreeId
-      }
-    )
+    await client.call('terminal.send', {
+      terminal: workerHandle,
+      text: 'ORCA_E2E_PUBLISH_DONE',
+      enter: true
+    })
 
     const expectedRecovery = {
       origin: 'live',
@@ -348,18 +283,23 @@ for (const closeMode of ['terminal-close-cli', 'worker-release'] as const) {
     await expect
       .poll(() => readCompletedWorkerLedger().filter((event) => event.event === 'normal-exit'))
       .toHaveLength(1)
-    expect(
-      await orcaPage.evaluate(
-        ({ paneKey, tabId, worktreeId }) => {
-          const state = window.__store?.getState()
-          return {
-            tabPresent: Boolean(state?.tabsByWorktree[worktreeId]?.some((tab) => tab.id === tabId)),
-            recoveryPresent: Boolean(state?.sleepingAgentSessionsByPaneKey[paneKey])
-          }
-        },
-        { paneKey: workerPaneKey, tabId: workerBefore.tabId, worktreeId: targetWorktreeId }
+    // The exit marker precedes the asynchronous renderer recovery update.
+    await expect
+      .poll(() =>
+        orcaPage.evaluate(
+          ({ paneKey, tabId, worktreeId }) => {
+            const state = window.__store?.getState()
+            return {
+              tabPresent: Boolean(
+                state?.tabsByWorktree[worktreeId]?.some((tab) => tab.id === tabId)
+              ),
+              recoveryPresent: Boolean(state?.sleepingAgentSessionsByPaneKey[paneKey])
+            }
+          },
+          { paneKey: workerPaneKey, tabId: workerBefore.tabId, worktreeId: targetWorktreeId }
+        )
       )
-    ).toEqual({ tabPresent: true, recoveryPresent: true })
+      .toEqual({ tabPresent: true, recoveryPresent: true })
 
     await orcaPage.evaluate(
       ({ paneKey, tabId, worktreeId }) => {
diff --git a/tests/e2e/cross-version-wire/agent-session-death-evidence-downgrade.unit.test.ts b/tests/e2e/cross-version-wire/agent-session-death-evidence-downgrade.unit.test.ts
new file mode 100644
index 00000000000..96780a18517
--- /dev/null
+++ b/tests/e2e/cross-version-wire/agent-session-death-evidence-downgrade.unit.test.ts
@@ -0,0 +1,61 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { expect, test } from 'vitest'
+import {
+  agentSessionLeaseFixture,
+  agentSessionRecordFixture
+} from '../../../src/shared/agent-session-record.test-fixture'
+import { AgentSessionRecordStore } from '../../../src/main/runtime/agent-session-record-store'
+import { agentSessionStorePath } from '../../../src/main/runtime/agent-session-record-store-file'
+import { importReleaseCheckoutModule, materializeReleaseCheckout } from './release-checkout'
+
+// The last release before a proof of death named its owner and its last proof of life.
+const BASELINE_REF = 'v1.4.211'
+const SESSION = 'session-alpha-1'
+
+test('an older build loads a proof of death that names its owner and its last proof of life', async () => {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-death-evidence-downgrade-'))
+  try {
+    // A live owner at fence 7, last renewed at 30000, found gone when this build relaunches.
+    writeFileSync(
+      agentSessionStorePath(directory),
+      JSON.stringify({
+        schemaVersion: 2,
+        hostId: 'local',
+        records: { [SESSION]: agentSessionRecordFixture(agentSessionLeaseFixture()) },
+        operations: {},
+        retiredClaimKeys: [],
+        unusableRecords: {}
+      })
+    )
+    const store = await AgentSessionRecordStore.open({ directory, hostId: 'local' })
+    await store.reconcileOnRestart({ probe: async () => ({ outcome: 'pid-absent' }), now: 90_000 })
+    const evidence = store.getRecord(SESSION)?.lease.deathEvidence
+    expect(evidence).toEqual({
+      kind: 'pid-absent',
+      detail: 'recorded pid absent on host',
+      observedAt: 90_000,
+      ownerFence: 7,
+      lastProvenAliveAt: 30_000
+    })
+
+    const checkout = await materializeReleaseCheckout(BASELINE_REF)
+    const baseline = await importReleaseCheckoutModule(
+      checkout,
+      'src/main/runtime/agent-session-record-store.ts'
+    )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the pinned release exports this class with the open/read members called below; a missing one fails the test.
+    const OldStore = baseline.AgentSessionRecordStore as {
+      open: (args: { directory: string; hostId: string }) => Promise<AgentSessionRecordStore>
+    }
+    const old = await OldStore.open({ directory, hostId: 'local' })
+    expect(old.isSessionUnreadable(SESSION)).toBe(false)
+    expect(old.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
+      deathEvidence: evidence
+    })
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
diff --git a/tests/e2e/cross-version-wire/agent-session-resume-marker-downgrade.unit.test.ts b/tests/e2e/cross-version-wire/agent-session-resume-marker-downgrade.unit.test.ts
new file mode 100644
index 00000000000..f7f23d528aa
--- /dev/null
+++ b/tests/e2e/cross-version-wire/agent-session-resume-marker-downgrade.unit.test.ts
@@ -0,0 +1,52 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { expect, test } from 'vitest'
+import { structuredAgentSessionWorkingAtStop } from '../../../src/main/native-chat/agent-session-wire/structured-agent-session-working-at-teardown'
+import {
+  journal,
+  NOW,
+  record,
+  SESSION,
+  TEARDOWN_CURRENT,
+  turnItem
+} from '../../../src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-test-harness'
+import { AgentSessionRecoveryCapsule } from '../../../src/main/runtime/agent-session-recovery-capsule'
+import { importReleaseCheckoutModule, materializeReleaseCheckout } from './release-checkout'
+
+// A release whose marker parser still requires the chat's newest message id.
+const BASELINE_REF = 'v1.4.211'
+
+test('an older build reads the restart offer this build records at quit', async () => {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-resume-marker-downgrade-'))
+  try {
+    // This build: the offer teardown takes for a chat whose turn was running.
+    const marker = structuredAgentSessionWorkingAtStop({
+      sessionId: SESSION,
+      session: { journal: journal([turnItem('turn-1', 'running')]), child: { fence: 1 } },
+      getRecord: () => record(),
+      backgroundTasks: () => undefined,
+      trigger: 'quit',
+      teardownId: TEARDOWN_CURRENT,
+      now: NOW
+    })
+    if (!marker) {
+      throw new Error('this build recorded no offer for a running turn')
+    }
+    await new AgentSessionRecoveryCapsule(directory).record([marker], NOW)
+
+    // The older build, after a downgrade, still lists it.
+    const checkout = await materializeReleaseCheckout(BASELINE_REF)
+    const baseline = await importReleaseCheckoutModule(
+      checkout,
+      'src/main/runtime/agent-session-recovery-capsule.ts'
+    )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the pinned release exports this class with the constructor and `list` called below; a missing one fails the test.
+    const OldCapsule = baseline.AgentSessionRecoveryCapsule as new (directory: string) => {
+      list: (now: number) => Promise<{ sessionId: string }[]>
+    }
+    expect(await new OldCapsule(directory).list(NOW)).toMatchObject([{ sessionId: SESSION }])
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
diff --git a/tests/e2e/cross-version-wire/agent-session-unproven-release-downgrade.unit.test.ts b/tests/e2e/cross-version-wire/agent-session-unproven-release-downgrade.unit.test.ts
new file mode 100644
index 00000000000..80626f79ae3
--- /dev/null
+++ b/tests/e2e/cross-version-wire/agent-session-unproven-release-downgrade.unit.test.ts
@@ -0,0 +1,107 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { expect, test } from 'vitest'
+import { resolveStructuredSessionRecovery } from '../../../src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution'
+import { AgentSessionRecordStore } from '../../../src/main/runtime/agent-session-record-store'
+import { importReleaseCheckoutModule, materializeReleaseCheckout } from './release-checkout'
+
+// The last release before recovery released an owner it could not prove gone.
+const BASELINE_REF = 'v1.4.211'
+const SESSION = 'session-unproven'
+const NOW = 1_800_000_000_000
+const LOCATION = {
+  executionHostId: 'local',
+  wslDistro: null,
+  workspaceId: 'workspace-1',
+  workspaceKind: 'folder' as const
+}
+
+function reserveRequest(expectedFence: number | null, spawnToken: string, operation: number) {
+  return {
+    sessionId: SESSION,
+    location: LOCATION,
+    provider: 'codex' as const,
+    accountHome: { variable: 'CODEX_HOME' as const, path: '/tmp/codex' },
+    // Older builds still read the owner kind from the request.
+    runtimeKind: 'native' as const,
+    expectedFence,
+    spawnToken,
+    claimKeyId: 'key-1',
+    handoffOperationId: null,
+    probe: { outcome: 'reservation-unused' as const },
+    operation: {
+      callerKey: 'test',
+      operationId: `${NOW}-${String(operation).padStart(32, '0')}`,
+      fingerprint: 'create'
+    },
+    now: NOW
+  }
+}
+
+test('an older build loads, and starts over, a lease released with no death evidence', async () => {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-unproven-release-downgrade-'))
+  try {
+    // This build: an owner whose identity can never be verified is released, with no evidence.
+    const store = await AgentSessionRecordStore.open({ directory, hostId: 'local' })
+    const reserved = await store.reserveOwner(reserveRequest(null, 'spawn-a', 1))
+    const fence = reserved.record.lease.runtimeFence
+    await store.commitProcessIdentity({
+      sessionId: SESSION,
+      fence,
+      process: { hostId: 'local', pid: 4242, processStartTimeMs: NOW, spawnToken: 'spawn-a' },
+      now: NOW
+    })
+    await store.transitionHandoff(SESSION, (record) => ({
+      ...record,
+      lease: { ...record.lease, handoffStage: 'recovering' }
+    }))
+    await expect(
+      resolveStructuredSessionRecovery(
+        {
+          store,
+          probeRecord: async () => ({ outcome: 'indeterminate', reason: 'no start time' }),
+          now: () => NOW
+        },
+        SESSION
+      )
+    ).resolves.toBe('resolved')
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
+      handoffStage: null,
+      deathEvidence: null
+    })
+
+    // The older build reads exactly what this one wrote.
+    const checkout = await materializeReleaseCheckout(BASELINE_REF)
+    const baseline = await importReleaseCheckoutModule(
+      checkout,
+      'src/main/runtime/agent-session-record-store.ts'
+    )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the pinned release exports this class with the open/read/reconcile/reserve members called below; a missing one fails the test.
+    const OldStore = baseline.AgentSessionRecordStore as {
+      open: (args: { directory: string; hostId: string }) => Promise<AgentSessionRecordStore>
+    }
+    const old = await OldStore.open({ directory, hostId: 'local' })
+    expect(old.isSessionUnreadable(SESSION)).toBe(false)
+    expect(old.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
+      handoffStage: null,
+      ownerProcess: null,
+      deathEvidence: null
+    })
+    await old.reconcileOnRestart({
+      probe: async () => ({ outcome: 'indeterminate', reason: 'no owner to probe' }),
+      now: NOW + 1
+    })
+    const released = old.getRecord(SESSION)?.lease
+    expect(released).toMatchObject({ claimStatus: 'released', handoffStage: null })
+    // And it can start a new owner over it.
+    const restarted = await old.reserveOwner(
+      reserveRequest(released?.runtimeFence ?? null, 'spawn-b', 2)
+    )
+    expect(restarted.record.lease).toMatchObject({ claimStatus: 'reserved' })
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
diff --git a/tests/e2e/cross-version-wire/cross-version-agent-session-wire.unit.test.ts b/tests/e2e/cross-version-wire/cross-version-agent-session-wire.unit.test.ts
index d244fba1ba6..3087385da1d 100644
--- a/tests/e2e/cross-version-wire/cross-version-agent-session-wire.unit.test.ts
+++ b/tests/e2e/cross-version-wire/cross-version-agent-session-wire.unit.test.ts
@@ -22,7 +22,10 @@ import { AgentSessionRecordStore } from '../../../src/main/runtime/agent-session
 import { RuntimeSubscriptionRegistry } from '../../../src/main/runtime/runtime-subscription-registry'
 import type { AgentSessionSubscribeEvent } from '../../../src/shared/agent-session-wire'
 import {
+  AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
+  AGENT_SESSION_CONVERSATION_STOP_RUNTIME_CAPABILITY,
   AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY,
+  AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY,
   AGENT_SESSION_REWIND_RUNTIME_CAPABILITY,
   AGENT_SESSION_CONVERSATION_OUTLINE_RUNTIME_CAPABILITY,
   AGENT_SESSION_STATUS_FEED_RUNTIME_CAPABILITY,
@@ -42,6 +45,7 @@ import {
   resetOperationIds,
   REWIND_METHOD,
   CONVERSATION_OUTLINE_METHOD,
+  envelope,
   STATUS_FEED_METHOD,
   sendParams,
   SESSION,
@@ -288,6 +292,40 @@ describe('cross-version structured agent sessions', () => {
       expect(current.protocolVersion).toBe(baseline.protocolVersion)
     })
 
+    // The client sends a Stop naming no turn only to a host advertising this, because older cancel
+    // params are strict and require the turn. The invariant survives a release cut: each build
+    // advertises the capability exactly when its dispatcher accepts that cancel.
+    it('advertises conversation stop exactly where a cancel naming no turn is accepted', async () => {
+      const named = paramsFor('agentSession.cancel')
+      if (typeof named !== 'object' || named === null) {
+        throw new Error('the manifest has no cancel params')
+      }
+      const unnamed = Object.fromEntries(Object.entries(named).filter(([key]) => key !== 'turnId'))
+      for (const build of [current, baseline]) {
+        if (!build.methodNames.includes('agentSession.cancel')) {
+          continue
+        }
+        // Without a host every call answers `structured_agent_session_unsupported`, which would
+        // read as the params refusal this looks for.
+        const hostCalls = structuredHostStub(SESSION, WORKSPACE)
+        await build.installStructuredHost(installableHost(hostCalls))
+        try {
+          const replies = await callBuild(build, 'agentSession.cancel', unnamed, {
+            clientKind: 'runtime',
+            clientCapabilities: current.capabilities
+          })
+          expect(replies, `${build.label}: a cancel naming no turn`).toHaveLength(1)
+          expect(replies[0]?.ok, `${build.label}: a cancel naming no turn`).toBe(
+            build.capabilities.includes(AGENT_SESSION_CONVERSATION_STOP_RUNTIME_CAPABILITY)
+          )
+          expect(hostCalls.cancel).toHaveBeenCalledTimes(replies[0]?.ok ? 1 : 0)
+        } finally {
+          await build.installStructuredHost(null)
+        }
+      }
+      expect(current.capabilities).toContain(AGENT_SESSION_CONVERSATION_STOP_RUNTIME_CAPABILITY)
+    })
+
     it('gets a clean answer from the old dispatcher rather than silence', async () => {
       const registered = new Set(baselineStructuredMethods())
       for (const { method } of STRUCTURED_CALLS) {
@@ -313,6 +351,41 @@ describe('cross-version structured agent sessions', () => {
       }
     })
 
+    it('takes structured question answers exactly where the host advertises them', async () => {
+      // A client sends `answers` only on this capability, so the two must never disagree:
+      // a strict older schema refuses the field and the answer is lost rather than degraded.
+      const method = 'agentSession.respondToQuestion'
+      const fields = {
+        itemId: 'item-1',
+        expectedRevision: 1,
+        answers: [{ questionId: 'q1', optionIds: [], other: 'Wait for the capture. '.repeat(80) }]
+      }
+      const params = { envelope: envelope({ method, fields, fence: 1 }), ...fields }
+      expect(current.capabilities).toContain(AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY)
+      for (const build of [current, baseline]) {
+        const advertised = build.capabilities.includes(
+          AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY
+        )
+        if (!build.methodNames.includes(method)) {
+          expect(advertised, `${build.label} advertises answers without the method`).toBe(false)
+          continue
+        }
+        const hostCalls = structuredHostStub(SESSION, WORKSPACE)
+        await build.installStructuredHost(installableHost(hostCalls))
+        try {
+          const replies = await callBuild(build, method, params, {
+            clientKind: 'runtime',
+            clientCapabilities: current.capabilities
+          })
+          expect(replies, `${build.label}: ${method} must answer exactly once`).toHaveLength(1)
+          expect(replies[0]?.ok, `${build.label}: ${JSON.stringify(replies[0])}`).toBe(advertised)
+          expect(hostCalls.respondToPrompt).toHaveBeenCalledTimes(advertised ? 1 : 0)
+        } finally {
+          await build.installStructuredHost(null)
+        }
+      }
+    })
+
     it(
       'executes every method a release-shaped checkout registers',
       async () => {
@@ -582,6 +655,10 @@ describe('cross-version structured agent sessions', () => {
     let store: AgentSessionRecordStore
     let runtime: unknown
 
+    /** Holds a provider start open, so a reply's timing can be read against it. */
+    let startGate: Promise<void> = Promise.resolve()
+    let starts = 0
+
     /** Phase 2 owns provider processes; the adapter is the only stub here. */
     function adapter(): StructuredAgentSessionAdapter {
       return {
@@ -589,23 +666,27 @@ describe('cross-version structured agent sessions', () => {
         // `supportsLocation`, which this fake also lacks, so the client-supplied-location gate
         // refused for the fake's silence rather than for the location.
         supportsCreate: () => true,
-        acquire: async ({ fence }) => ({
-          process: {
-            hostId: 'local',
-            pid: 4242,
-            processStartTimeMs: 1_700_000_000_000,
-            spawnToken: store.getRecord(SESSION)?.lease.reservedSpawnToken ?? 'spawn-a'
-          },
-          link: {
-            linkId: `link-${fence}`,
-            handle: { provider: 'codex', threadId: THREAD },
-            // A restarted host re-proves the thread it inherited; only the first
-            // owner of a session may claim to have created it.
-            origin: store.getRecord(SESSION)?.providerHandleChain.length ? 'resumed' : 'created',
-            mintedAtFence: fence,
-            observedAt: NOW
+        acquire: async ({ fence }) => {
+          starts += 1
+          await startGate
+          return {
+            process: {
+              hostId: 'local',
+              pid: 4242,
+              processStartTimeMs: 1_700_000_000_000,
+              spawnToken: store.getRecord(SESSION)?.lease.reservedSpawnToken ?? 'spawn-a'
+            },
+            link: {
+              linkId: `link-${fence}`,
+              handle: { provider: 'codex', threadId: THREAD },
+              // A restarted host re-proves the thread it inherited; only the first
+              // owner of a session may claim to have created it.
+              origin: store.getRecord(SESSION)?.providerHandleChain.length ? 'resumed' : 'created',
+              mintedAtFence: fence,
+              observedAt: NOW
+            }
           }
-        }),
+        },
         dispatch: async () => ({
           state: 'accepted',
           providerIdentity: { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 1 }
@@ -660,14 +741,18 @@ describe('cross-version structured agent sessions', () => {
       return reattached
     }
 
-    async function call(method: string, params: unknown): Promise<RpcReply[]> {
+    async function call(
+      method: string,
+      params: unknown,
+      clientCapabilities: readonly string[] = [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY]
+    ): Promise<RpcReply[]> {
       return callBuild(
         current,
         method,
         params,
         {
           clientKind: 'runtime',
-          clientCapabilities: [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY],
+          clientCapabilities,
           clientId: 'paired-device-1',
           connectionId: 'connection-1'
         },
@@ -686,6 +771,7 @@ describe('cross-version structured agent sessions', () => {
 
     beforeEach(async () => {
       resetOperationIds()
+      startGate = Promise.resolve()
       root = await mkdtemp(join(tmpdir(), 'orca-cross-version-agent-session-'))
       runtime = runtimeStub()
       await bootHost('a')
@@ -726,16 +812,70 @@ describe('cross-version structured agent sessions', () => {
       expect(batch?.cursor.sequence).toBeGreaterThan(held.sequence)
     })
 
-    it('refuses a write still fenced to the host generation that died', async () => {
+    // Every released client still sends the fence it last saw; this host names a write by its
+    // target and ignores that fence. Only the attach keeps comparing one, which `reattach` pins.
+    it('delivers a write still fenced to the host generation that died', async () => {
       const created = await answer('agentSession.create', createIntentParams())
       await bootHost('b')
       const reattached = await reattach(created.fence)
       expect(reattached.fence).toBeGreaterThan(created.fence)
 
       expect(await answer('agentSession.send', sendParams('stale', created.fence))).toMatchObject({
-        ok: false,
-        refusal: { code: 'agent_session_checkpoint_stale' }
+        ok: true,
+        fence: reattached.fence
       })
     })
+
+    // A released client answers a send's `pending` as delivered-or-refused; it has no way to show
+    // a rejection that arrives after it. So it is answered once the message is handed over, while
+    // a client that advertises accepted sends is answered at acceptance, start or no start (W9).
+    it('holds the send reply of a released client until the handover, and answers a current one at once', async () => {
+      // Why: the baseline is the newest release, which will itself carry accepted sends.
+      const released = baseline.capabilities.filter(
+        (capability) => capability !== AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY
+      )
+      const created = await answer('agentSession.create', createIntentParams())
+      await bootHost('b')
+      let open = (): void => undefined
+      startGate = new Promise((resolve) => (open = resolve))
+
+      let answered = false
+      const releasedReply = call(
+        'agentSession.send',
+        sendParams('released', created.fence),
+        released
+      ).finally(() => (answered = true))
+      // The start that delivers it is under way, and the reply still waits for it.
+      const before = starts
+      await vi.waitFor(() => expect(starts).toBeGreaterThan(before))
+      await new Promise((resolve) => setTimeout(resolve, 20))
+      expect(answered).toBe(false)
+      open()
+      const [reply] = await releasedReply
+      // Handed over, whatever the provider has said since.
+      expect(reply).toMatchObject({
+        ok: true,
+        result: { value: { submission: { handedOverAt: expect.any(Number) } } }
+      })
+
+      const restarted = await bootHost('c')
+      startGate = new Promise((resolve) => (open = resolve))
+      const currentReply = await call('agentSession.send', sendParams('current', created.fence), [
+        ...released,
+        AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY
+      ])
+      expect(currentReply[0]).toMatchObject({
+        ok: true,
+        result: { value: { submission: { dispatchState: 'pending', handoverRecorded: true } } }
+      })
+      open()
+      await vi.waitFor(async () =>
+        expect(
+          (await restarted.journalSnapshot(SESSION)).submissions.every(
+            (row) => row.dispatchState !== 'pending' || row.handedOverAt
+          )
+        ).toBe(true)
+      )
+    })
   })
 })
diff --git a/tests/e2e/cross-version-wire/cross-version-worktree-ps-verdict.unit.test.ts b/tests/e2e/cross-version-wire/cross-version-worktree-ps-verdict.unit.test.ts
new file mode 100644
index 00000000000..fffef650f6c
--- /dev/null
+++ b/tests/e2e/cross-version-wire/cross-version-worktree-ps-verdict.unit.test.ts
@@ -0,0 +1,197 @@
+import { beforeAll, describe, expect, it } from 'vitest'
+import {
+  importReleaseCheckoutModule,
+  importWorkingTreeModuleCopy,
+  materializeReleaseCheckout
+} from './release-checkout'
+
+/**
+ * The verdict on a `worktree ps` agent row, paired across two builds.
+ *
+ * The host now sends `mainAgent` (the main agent's own state, verdict and clock) on each row,
+ * beside the `interrupted` flag every build reads. That is Rule 1 only if an old phone still reads
+ * a new host's row by the flag, and a new phone reads an old host's row, which has no `mainAgent`,
+ * by the same flag. Both halves run a real old build here rather than being reasoned about.
+ *
+ * The pre-change ref is pinned rather than derived: a newer baseline would carry the new reader,
+ * and every "old reader" cell would then pair the change against itself.
+ */
+const PRE_CHANGE_REF = 'v1.4.212'
+const SUITE_TIMEOUT_MS = 180_000
+// Both builds load a copy in the checkout cache, out of reach of `mobile/tsconfig.json`.
+const PHONE_ROW_READER = 'mobile/src/worktree/agent-row-display.ts'
+
+const WORKTREE_ID = 'repo::/worktree'
+const NOW = 1_000_000
+
+type HookSnapshot = Record<string, unknown>
+type AgentRow = Record<string, unknown>
+type DotState = (row: AgentRow, now: number) => string
+
+type HostRowModules = {
+  collectRuntimeWorktreeAgentSources: (args: Record<string, unknown>) => unknown
+  attachRuntimeWorktreeAgentRows: (args: Record<string, unknown>) => void
+}
+
+type Build = {
+  label: string
+  host: HostRowModules
+  agentDotState: DotState
+}
+
+function snapshot(
+  tabId: string,
+  fields: Pick<HookSnapshot, 'state'> & Partial<HookSnapshot>
+): HookSnapshot {
+  return {
+    paneKey: `${tabId}:11111111-1111-4111-8111-111111111111`,
+    tabId,
+    worktreeId: WORKTREE_ID,
+    connectionId: null,
+    prompt: 'ship it',
+    agentType: 'claude',
+    receivedAt: NOW - 1_000,
+    stateStartedAt: NOW - 600_000,
+    ...fields
+  }
+}
+
+// The three verdicts the change separates: a failure the old flag cannot express, the same
+// failure while subagents keep the row working, and a stop the old flag already carries.
+const SNAPSHOTS: HookSnapshot[] = [
+  snapshot('failed-done', {
+    state: 'done',
+    mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: NOW - 600_000 }
+  }),
+  snapshot('failed-working', {
+    state: 'working',
+    mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: NOW - 120_000 }
+  }),
+  snapshot('stopped', {
+    state: 'done',
+    interrupted: true,
+    mainAgent: { state: 'done', outcome: 'cancellation', stateStartedAt: NOW - 600_000 }
+  })
+]
+
+/** A host's `worktree ps` rows, JSON round-tripped as the wire carries them. */
+function publishRows(host: HostRowModules): Record<string, AgentRow> {
+  const summary: Record<string, unknown> = {
+    worktreeId: WORKTREE_ID,
+    status: 'inactive',
+    hasHostSidebarActivity: false,
+    agents: []
+  }
+  host.attachRuntimeWorktreeAgentRows({
+    summaries: new Map([[WORKTREE_ID, summary]]),
+    pathIndex: { byPath: new Map(), byRealPath: new Map() },
+    missingWorktreeIds: new Set(),
+    workingTerminalEvidenceByWorktreeId: new Map(),
+    rowSources: host.collectRuntimeWorktreeAgentSources({
+      hookSnapshots: SNAPSHOTS,
+      mirroredWorktreeIdByTabId: new Map(),
+      connectedPtyEvidence: {
+        tabIds: new Set(SNAPSHOTS.map((row) => row.tabId)),
+        paneKeys: new Set(),
+        ptyIdByTerminalHandle: new Map()
+      }
+    }),
+    orchestrationByPaneKey: null,
+    getSummary: (map: Map<string, unknown>, _paths: unknown, _missing: unknown, id: string) =>
+      map.get(id) ?? null
+  })
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: JSON.parse of the rows the host just attached, which are plain objects keyed by paneKey.
+  const rows = JSON.parse(JSON.stringify(summary.agents)) as AgentRow[]
+  return Object.fromEntries(rows.map((row) => [String(row.paneKey).split(':')[0], row]))
+}
+
+function dotStates(build: Build, rows: Record<string, AgentRow>): Record<string, string> {
+  return Object.fromEntries(
+    Object.entries(rows).map(([tabId, row]) => [tabId, build.agentDotState(row, NOW)])
+  )
+}
+
+async function loadBuild(ref: string | null): Promise<Build> {
+  if (ref === null) {
+    const [sources, rows, display] = await Promise.all([
+      import('../../../src/main/runtime/runtime-worktree-agent-sources'),
+      import('../../../src/main/runtime/runtime-worktree-agent-rows'),
+      importWorkingTreeModuleCopy(PHONE_ROW_READER)
+    ])
+    return {
+      label: 'current',
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a dynamic import is typed by its module; this spec drives both builds through one untyped surface.
+      host: { ...sources, ...rows } as unknown as HostRowModules,
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a dynamic import of a copy is typed unknown; this is the current phone's row reader by path.
+      agentDotState: display.agentDotState as unknown as DotState
+    }
+  }
+  const checkout = await materializeReleaseCheckout(ref)
+  const [sources, rows, display] = await Promise.all([
+    importReleaseCheckoutModule(checkout, 'src/main/runtime/runtime-worktree-agent-sources.ts'),
+    importReleaseCheckoutModule(checkout, 'src/main/runtime/runtime-worktree-agent-rows.ts'),
+    importReleaseCheckoutModule(checkout, PHONE_ROW_READER)
+  ])
+  return {
+    label: ref,
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a dynamic import is typed unknown; these two modules are the old host's row surface by path.
+    host: { ...sources, ...rows } as unknown as HostRowModules,
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a dynamic import is typed unknown; this is the old phone's row reader by path.
+    agentDotState: display.agentDotState as unknown as DotState
+  }
+}
+
+let oldBuild: Build
+let newBuild: Build
+let agentRowTimeAt: (row: AgentRow) => number
+
+beforeAll(async () => {
+  ;[oldBuild, newBuild] = await Promise.all([loadBuild(PRE_CHANGE_REF), loadBuild(null)])
+  const display = await importWorkingTreeModuleCopy(PHONE_ROW_READER)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the rows are JSON the current host published, so the current reader's row type holds.
+  agentRowTimeAt = display.agentRowTimeAt as unknown as (row: AgentRow) => number
+}, SUITE_TIMEOUT_MS)
+
+describe('cross-version worktree ps verdict', () => {
+  it('pairs two real builds that disagree on the row shape', () => {
+    // Anti-vacuous-pass oracle: one module resolved twice would make every cell same-version.
+    expect(oldBuild.agentDotState).not.toBe(newBuild.agentDotState)
+    expect(Object.values(publishRows(oldBuild.host)).some((row) => 'mainAgent' in row)).toBe(false)
+    expect(Object.values(publishRows(newBuild.host)).every((row) => 'mainAgent' in row)).toBe(true)
+  })
+
+  it('an OLD phone reads a new host row by the interrupted flag it always read', () => {
+    const rows = publishRows(newBuild.host)
+    expect(rows.stopped).toMatchObject({ interrupted: true })
+    expect(dotStates(oldBuild, rows)).toEqual({
+      'failed-done': 'done',
+      'failed-working': 'working',
+      stopped: 'interrupted'
+    })
+  })
+
+  it('a NEW phone reads an old host row, which has no mainAgent, by the same flag', () => {
+    const rows = publishRows(oldBuild.host)
+    expect(dotStates(newBuild, rows)).toEqual({
+      'failed-done': 'done',
+      'failed-working': 'working',
+      stopped: 'interrupted'
+    })
+    // Without the main agent's clock the row dates itself, as it always did.
+    expect(agentRowTimeAt(rows['failed-working'])).toBe(NOW - 600_000)
+  })
+
+  it('a NEW phone reads a new host failure as failed, dated by the main agent clock', () => {
+    const rows = publishRows(newBuild.host)
+    expect(dotStates(newBuild, rows)).toEqual({
+      'failed-done': 'failed',
+      'failed-working': 'failed',
+      stopped: 'interrupted'
+    })
+    expect(rows['failed-working']).toMatchObject({
+      state: 'working',
+      mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: NOW - 120_000 }
+    })
+    expect(agentRowTimeAt(rows['failed-working'])).toBe(NOW - 120_000)
+  })
+})
diff --git a/tests/e2e/cross-version-wire/release-checkout-tree.ts b/tests/e2e/cross-version-wire/release-checkout-tree.ts
index 14674bfeefd..b5f97e78b24 100644
--- a/tests/e2e/cross-version-wire/release-checkout-tree.ts
+++ b/tests/e2e/cross-version-wire/release-checkout-tree.ts
@@ -6,7 +6,15 @@ const CHECKOUT_MAX_OUTPUT_BYTES = 1024 * 1024
 
 // Why: the wire endpoints only need the runtime RPC host, the renderer client, and
 // the shared codec. Skipping cli/relay keeps a cold CI extraction a few seconds.
-const ARCHIVE_PATHS = ['src/main', 'src/shared', 'src/preload', 'src/renderer', 'src/types']
+// The phone's `worktree ps` row reader is one self-contained file, so it rides along alone.
+const ARCHIVE_PATHS = [
+  'src/main',
+  'src/shared',
+  'src/preload',
+  'src/renderer',
+  'src/types',
+  'mobile/src/worktree/agent-row-display.ts'
+]
 
 const ALIAS_SPECIFIER =
   /(\bfrom\s*|\bimport\s*\(\s*|\brequire\s*\(\s*)(['"])@(renderer)?\/([^'"]+)\2/g
diff --git a/tests/e2e/cross-version-wire/release-checkout.ts b/tests/e2e/cross-version-wire/release-checkout.ts
index eafee3802be..6a2d58312d3 100644
--- a/tests/e2e/cross-version-wire/release-checkout.ts
+++ b/tests/e2e/cross-version-wire/release-checkout.ts
@@ -1,6 +1,6 @@
 import { execFileSync } from 'node:child_process'
 import { constants } from 'node:fs'
-import { access, mkdtemp, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
+import { access, copyFile, mkdtemp, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'
 import { lock } from 'proper-lockfile'
 import {
@@ -12,7 +12,7 @@ export const REPO_ROOT = resolve(import.meta.dirname, '..', '..', '..')
 const DEFAULT_CACHE_ROOT = join(REPO_ROOT, 'tests', 'e2e', '.cross-version-checkouts')
 
 // Bump when extraction or the alias rewrite changes so cached trees are rebuilt.
-const CHECKOUT_FORMAT = 3
+const CHECKOUT_FORMAT = 4
 
 const BASELINE_REF_ENV = 'ORCA_CROSS_VERSION_BASELINE_REF'
 const STABLE_DESKTOP_RELEASE_TAG = /^v\d+\.\d+\.\d+$/
@@ -182,10 +182,10 @@ async function assertCheckoutWireSurface(root: string, ref: string): Promise<voi
   }
 }
 
-function checkoutModulePath(checkout: ReleaseCheckout, rootRelativePath: string): string {
+function checkoutModulePath(root: string, rootRelativePath: string): string {
   const fromRoot = rootRelativePath.replace(/^[/\\]+/, '')
-  const absolute = resolve(checkout.root, fromRoot)
-  const fromCheckout = relative(checkout.root, absolute)
+  const absolute = resolve(root, fromRoot)
+  const fromCheckout = relative(root, absolute)
   if (
     !fromRoot ||
     fromCheckout === '..' ||
@@ -213,7 +213,28 @@ export function importReleaseCheckoutModule(
   importModule: (specifier: string) => Promise<Record<string, unknown>> = (specifier) =>
     import(/* @vite-ignore */ specifier) as Promise<Record<string, unknown>>
 ): Promise<Record<string, unknown>> {
-  return importModule(checkoutModulePath(checkout, rootRelativePath))
+  return importModule(checkoutModulePath(checkout.root, rootRelativePath))
+}
+
+/**
+ * Import a copy of a self-contained working-tree module placed under the cache root.
+ *
+ * Why: vite transforms a file against its nearest tsconfig, and `mobile/tsconfig.json` extends
+ * Expo's, which the root-only CI lane does not install. The copy gets the root tsconfig, as the
+ * release checkout's copy does. A relative runtime import would not resolve from the copy.
+ */
+export async function importWorkingTreeModuleCopy(
+  rootRelativePath: string,
+  cacheRoot: string = DEFAULT_CACHE_ROOT
+): Promise<Record<string, unknown>> {
+  const copy = checkoutModulePath(join(cacheRoot, 'working-tree'), rootRelativePath)
+  const staged = `${copy}.${process.pid}.tmp`
+  await mkdir(dirname(copy), { recursive: true })
+  await copyFile(checkoutModulePath(REPO_ROOT, rootRelativePath), staged)
+  // Rename so a concurrent run never imports a half-written copy.
+  await rename(staged, copy)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a module namespace is a plain record of its exports; callers narrow each export they read.
+  return import(/* @vite-ignore */ copy) as Promise<Record<string, unknown>>
 }
 
 /**
diff --git a/tests/e2e/cross-version-wire/structured-agent-session-host-fixture.ts b/tests/e2e/cross-version-wire/structured-agent-session-host-fixture.ts
index 7af9283f328..681c65f50c1 100644
--- a/tests/e2e/cross-version-wire/structured-agent-session-host-fixture.ts
+++ b/tests/e2e/cross-version-wire/structured-agent-session-host-fixture.ts
@@ -53,6 +53,9 @@ export function structuredHostStub(
     })),
     waitForSendSettlement: vi.fn(),
     cancel: vi.fn(async () => ({ ok: true, replayed: false })),
+    queuedMessageSend: vi.fn(async () => ({ ok: true, replayed: false })),
+    queuedMessageDelete: vi.fn(async () => ({ ok: true, replayed: false })),
+    queuedMessagesResume: vi.fn(async () => ({ ok: true, replayed: false })),
     rewind: vi.fn(async () => ({
       ok: true,
       replayed: false,
@@ -75,6 +78,7 @@ export function structuredHostStub(
     modelCatalog: vi.fn(() => ({ origin: 'unknown' as const })),
     readCommands: vi.fn(() => ({ commands: [{ name: 'clear', kind: 'command' as const }] })),
     history: vi.fn(() => ({ ok: true, page: { items: [] } })),
+    sessionAgent: vi.fn(() => null),
     journalSnapshot: vi.fn(() => ({
       sessionId,
       cursor: { epoch: 'epoch-a', sequence: 0 },
diff --git a/tests/e2e/cross-version-wire/structured-agent-session-surface-manifest.ts b/tests/e2e/cross-version-wire/structured-agent-session-surface-manifest.ts
index d8c8b80b329..7eb4920deec 100644
--- a/tests/e2e/cross-version-wire/structured-agent-session-surface-manifest.ts
+++ b/tests/e2e/cross-version-wire/structured-agent-session-surface-manifest.ts
@@ -64,6 +64,23 @@ export const STRUCTURED_CALLS: {
   },
   { method: 'agentSession.send', hostMethod: 'send', result: { ok: true, replayed: false } },
   { method: 'agentSession.cancel', hostMethod: 'cancel', result: { ok: true, replayed: false } },
+  // Draft mutations for mid-turn queueing. Methods exist ahead of the
+  // capability's advertisement; only capability-gated clients ever call them.
+  {
+    method: 'agentSession.queuedMessageSend',
+    hostMethod: 'queuedMessageSend',
+    result: { ok: true, replayed: false }
+  },
+  {
+    method: 'agentSession.queuedMessageDelete',
+    hostMethod: 'queuedMessageDelete',
+    result: { ok: true, replayed: false }
+  },
+  {
+    method: 'agentSession.queuedMessagesResume',
+    hostMethod: 'queuedMessagesResume',
+    result: { ok: true, replayed: false }
+  },
   {
     method: REWIND_METHOD,
     hostMethod: 'rewind',
@@ -115,7 +132,8 @@ export const STRUCTURED_CALLS: {
     hostMethod: 'revealSession',
     result: { ok: true, sessionId: SESSION, workspaceId: WORKSPACE, agent: 'codex', readable: true }
   },
-  { method: 'agentSession.hold', hostMethod: 'hold', result: { held: true } },
+  // A no-op on a host that starts an agent only for work; it still builds the host.
+  { method: 'agentSession.hold', hostMethod: null, result: { held: true } },
   // The restart-resume surface. Bare additions, not capability-negotiated: an RPC method's
   // absence is explicit (`method_not_found`), which the old-dispatcher case below asserts, so a
   // newer client learns it during negotiation instead of by being met with silence.
@@ -129,17 +147,14 @@ export const STRUCTURED_CALLS: {
     hostMethod: 'restartResumableDismiss',
     result: { dismissed: 0 }
   },
-  {
-    method: 'agentSession.restartResume',
-    hostMethod: 'restartResumeAll',
-    result: { results: [] }
-  },
+  // Reattaching alone is nothing now, so this answers that nothing was resumed.
+  { method: 'agentSession.restartResume', hostMethod: null, result: { results: [] } },
   {
     method: 'agentSession.restartContinue',
     hostMethod: 'restartContinueAll',
     result: { resumed: [], continued: [] }
   },
-  { method: 'agentSession.release', hostMethod: 'release', result: { released: true } },
+  { method: 'agentSession.release', hostMethod: null, result: { released: true } },
   {
     method: 'agentSession.history',
     hostMethod: 'history',
@@ -252,6 +267,13 @@ export function paramsFor(method: string): unknown {
         envelope: envelope({ method: 'agentSession.cancel', fields: { turnId: 'turn-1' }, fence }),
         turnId: 'turn-1'
       }
+    case 'agentSession.queuedMessageSend':
+    case 'agentSession.queuedMessageDelete': {
+      const fields = { messageId: 'queued-1' }
+      return { envelope: envelope({ method, fields, fence }), ...fields }
+    }
+    case 'agentSession.queuedMessagesResume':
+      return { envelope: envelope({ method, fields: {}, fence }) }
     case 'agentSession.respondToApproval':
     case 'agentSession.respondToQuestion': {
       const fields = { itemId: 'item-1', expectedRevision: 1, optionId: 'allow' }
diff --git a/tests/e2e/daemon-running-work-probe.unit.test.ts b/tests/e2e/daemon-running-work-probe.unit.test.ts
new file mode 100644
index 00000000000..39bf29323f8
--- /dev/null
+++ b/tests/e2e/daemon-running-work-probe.unit.test.ts
@@ -0,0 +1,92 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import { Session } from '../../src/main/daemon/session'
+import { inspectTerminalHostProcess } from '../../src/main/daemon/terminal-host-process-inspection'
+import type * as SnapshotReader from '../../src/shared/process-table-snapshot-reader'
+import type { ProcessTableRow } from '../../src/shared/process-table-snapshot'
+import { probePtyRunningWork } from '../../src/renderer/src/components/terminal/pty-running-work-probe'
+
+const { readSnapshot, inspectRuntime } = vi.hoisted(() => ({
+  readSnapshot: vi.fn(),
+  inspectRuntime: vi.fn()
+}))
+vi.mock('../../src/shared/process-table-snapshot-reader', async (importOriginal) => ({
+  ...(await importOriginal<typeof SnapshotReader>()),
+  getStrictProcessTableSnapshotWithAge: readSnapshot
+}))
+vi.mock('@/runtime/runtime-terminal-inspection', () => ({
+  inspectRuntimeTerminalProcess: inspectRuntime
+}))
+
+afterEach(() => vi.restoreAllMocks())
+
+it.each(['stopped', 'background', 'idle', 'unreadable'] as const)(
+  'carries daemon child evidence through the real close guard for %s work',
+  async (state) => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+    const root: ProcessTableRow = {
+      pid: 100,
+      ppid: 1,
+      pgid: 100,
+      tpgid: 101,
+      tty: 'ttys001',
+      startTime: 'Thu Sep  3 16:02:01 2026',
+      stat: 'Ss',
+      command: 'login -fp user'
+    }
+    const rows = [root, { ...root, pid: 101, ppid: 100, pgid: 101, stat: 'S+', command: '-zsh' }]
+    if (state === 'background' || state === 'stopped') {
+      rows.push({
+        ...root,
+        pid: 102,
+        ppid: 101,
+        pgid: 102,
+        stat: state === 'stopped' ? 'T' : 'S',
+        command: 'vim draft.txt'
+      })
+    }
+    if (state === 'unreadable') {
+      readSnapshot.mockRejectedValue(new Error('unreadable'))
+    } else {
+      readSnapshot.mockResolvedValue({ rows, capturedAgeMs: 0 })
+    }
+    const session = new Session({
+      sessionId: 'close-guard',
+      cols: 80,
+      rows: 24,
+      scrollback: 10,
+      shellReadySupported: false,
+      subprocess: {
+        pid: 100,
+        processNameIsSpawnFile: true,
+        getForegroundProcess: () => 'zsh',
+        write() {},
+        resize() {},
+        kill() {},
+        forceKill() {},
+        signal() {},
+        dispose() {},
+        onData() {},
+        onExit() {},
+        terminateOwnedTree: () => 'unavailable'
+      }
+    })
+    try {
+      inspectRuntime.mockImplementation(() =>
+        inspectTerminalHostProcess({
+          sessionId: session.sessionId,
+          session,
+          authorityGeneration: 'owner',
+          nextObservationEpoch: () => 1
+        })
+      )
+      const [result] = await probePtyRunningWork(null, ['remote:owner:close-guard'], {
+        timeoutMs: 1000
+      })
+      expect(result.verdict).toBe(
+        state === 'idle' ? 'exited' : state === 'unreadable' ? 'unverifiable' : 'live'
+      )
+    } finally {
+      session.dispose()
+    }
+  }
+)
diff --git a/tests/e2e/diff-note-draft.spec.ts b/tests/e2e/diff-note-draft.spec.ts
new file mode 100644
index 00000000000..270971d11f9
--- /dev/null
+++ b/tests/e2e/diff-note-draft.spec.ts
@@ -0,0 +1,120 @@
+import type { Page, TestInfo } from '@stablyai/playwright-test'
+import { expect, test } from './helpers/orca-app'
+import { waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+
+const DRAFT_LINE = 6
+const FOLLOWING_LINE = 'export const line07 = "draft-following-line-marker"'
+const NOTE_BODY = 'This note was added from the inline draft card.'
+
+async function attachDiffScreenshot(page: Page, testInfo: TestInfo, name: string): Promise<void> {
+  const screenshotPath = testInfo.outputPath(`${name}.png`)
+  await page.locator('.monaco-diff-editor').first().screenshot({ path: screenshotPath })
+  await testInfo.attach(name, { path: screenshotPath, contentType: 'image/png' })
+}
+
+test.describe('Diff note draft', () => {
+  test.beforeEach(async ({ orcaPage }) => {
+    await waitForSessionReady(orcaPage)
+    await waitForActiveWorktree(orcaPage)
+  })
+
+  test('opens an inline draft without overlapping code and saves it', async ({
+    orcaPage
+  }, testInfo) => {
+    await orcaPage.setViewportSize({ width: 1200, height: 800 })
+    const worktreeId = await waitForActiveWorktree(orcaPage)
+    const relativePath = await orcaPage.evaluate(async (wId) => {
+      const store = window.__store
+      if (!store) {
+        throw new Error('window.__store is not available')
+      }
+      const state = store.getState()
+      const worktree = Object.values(state.worktreesByRepo)
+        .flat()
+        .find((entry) => entry.id === wId)
+      if (!worktree) {
+        throw new Error('active worktree not found')
+      }
+      const separator = worktree.path.includes('\\') ? '\\' : '/'
+      const relative = `src${separator}diff-note-draft.ts`
+      const lines = Array.from({ length: 14 }, (_, index) => {
+        const number = String(index + 1).padStart(2, '0')
+        const value = index + 1 === 7 ? 'draft-following-line-marker' : `value-${number}`
+        return `export const line${number} = "${value}"`
+      })
+      await window.api.fs.writeFile({
+        filePath: `${worktree.path}${separator}${relative}`,
+        content: `${lines.join('\n')}\n`
+      })
+      await state.updateSettings({ diffDefaultView: 'side-by-side' })
+      state.openDiff(wId, `${worktree.path}${separator}${relative}`, relative, 'typescript', false)
+      return relative
+    }, worktreeId)
+
+    const followingLine = orcaPage
+      .locator('.modified-in-monaco-diff-editor .view-lines .view-line')
+      .filter({ hasText: FOLLOWING_LINE })
+      .first()
+    await expect(followingLine).toBeVisible({ timeout: 15_000 })
+    // Let the filesystem watcher finish its model refresh before opening a draft in that model.
+    await orcaPage.waitForTimeout(3_000)
+
+    const draftLine = orcaPage
+      .locator('.modified-in-monaco-diff-editor .view-lines .view-line')
+      .filter({ hasText: `export const line${String(DRAFT_LINE).padStart(2, '0')} = "value-06"` })
+      .first()
+    await draftLine.hover({ position: { x: 4, y: 8 } })
+    const addButton = orcaPage.locator('.orca-diff-comment-add-btn')
+    await expect(addButton).toBeVisible()
+    await addButton.click()
+
+    const draftCard = orcaPage.locator('.orca-diff-comment-draft-card')
+    const textarea = draftCard.locator('textarea')
+    await expect(draftCard).toBeVisible({ timeout: 15_000 })
+    await expect(draftCard).toContainText('Line 6')
+    await expect(draftCard).not.toContainText('You')
+    await expect
+      .poll(() => textarea.evaluate((element) => document.activeElement === element))
+      .toBe(true)
+    await expect(orcaPage.locator('.orca-diff-comment-draft-margin')).toBeVisible()
+    await expect
+      .poll(
+        async () => {
+          const [cardBox, lineBox] = await Promise.all([
+            draftCard.boundingBox(),
+            followingLine.boundingBox()
+          ])
+          return cardBox && lineBox ? lineBox.y - (cardBox.y + cardBox.height) : -1
+        },
+        { message: 'inline draft overlaps the following diff line' }
+      )
+      .toBeGreaterThanOrEqual(0)
+    await attachDiffScreenshot(orcaPage, testInfo, 'inline-diff-note-draft')
+
+    await textarea.fill(NOTE_BODY)
+    const submitButton = draftCard.locator('button').filter({ hasText: /add note/i })
+    await expect(submitButton).toBeEnabled()
+    await submitButton.click()
+    await expect(draftCard).toBeHidden()
+    const savedCard = orcaPage
+      .locator('.orca-diff-comment-card')
+      .filter({ hasText: NOTE_BODY })
+      .first()
+    await expect(savedCard).toBeVisible({ timeout: 15_000 })
+    await expect
+      .poll(
+        async () =>
+          await orcaPage.evaluate(
+            ({ wId, filePath, body }) => {
+              const comments = window.__store?.getState().getDiffComments(wId) ?? []
+              return comments.some(
+                (comment) => comment.filePath === filePath && comment.body === body
+              )
+            },
+            { wId: worktreeId, filePath: relativePath, body: NOTE_BODY }
+          )
+      )
+      .toBe(true)
+    await attachDiffScreenshot(orcaPage, testInfo, 'saved-inline-diff-note')
+  })
+})
diff --git a/tests/e2e/direct-ssh-snapshot-parking.unit.test.ts b/tests/e2e/direct-ssh-snapshot-parking.unit.test.ts
new file mode 100644
index 00000000000..7ac0ec897a7
--- /dev/null
+++ b/tests/e2e/direct-ssh-snapshot-parking.unit.test.ts
@@ -0,0 +1,290 @@
+// @vitest-environment happy-dom
+import { act, cleanup, render } from '@testing-library/react'
+import { createElement, Fragment, useEffect } from 'react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { exportRemoteWorkspaceSession } from '../../src/shared/remote-workspace-session-projection'
+import type {
+  RemoteWorkspaceObservedSnapshot,
+  RemoteWorkspaceSnapshot
+} from '../../src/shared/remote-workspace-types'
+import {
+  resyncStaleRemoteWorkspace,
+  _resetRemoteWorkspaceStaleResyncForTests
+} from '../../src/main/ipc/remote-workspace-stale-resync'
+import {
+  clearRemoteWorkspaceSnapshotCache,
+  rememberLocallyPatchedRemoteWorkspaceSnapshot,
+  rememberRemoteWorkspaceSnapshot
+} from '../../src/main/ipc/remote-workspace-snapshot-cache'
+import type { DirectSshAuthority, SshProviderEpoch, SshTarget } from '../../src/shared/ssh-types'
+import { useAppStore } from '@/store'
+import { makeTerminalTab, makeWorktree } from '@/store/slices/worktrees-slice-test-fixtures'
+import { buildWorkspaceSessionPayload } from '@/lib/workspace-session'
+import { applyDirectSshRemoteWorkspaceSnapshot } from '@/hooks/remote-workspace-snapshot-apply'
+import { singlePaneLayoutSnapshot } from '@/store/slices/terminal-helpers'
+import { selectColdParkedTerminalWorktrees } from '@/components/terminal-pane/terminal-hidden-view-parking'
+import {
+  canWatcherCoverParkedTerminalTab,
+  disposeAllParkedTerminalWatchers
+} from '@/components/terminal-pane/terminal-parked-tab-watchers'
+import { useTerminalTabColdParking } from '@/components/terminal-pane/use-terminal-tab-cold-parking'
+
+const { request } = vi.hoisted(() => ({ request: vi.fn() }))
+
+vi.mock('../../src/main/ipc/ssh', () => ({
+  getActiveMultiplexer: () => ({ request })
+}))
+
+vi.mock('@/components/terminal-pane/parked-terminal-byte-watcher', () => ({
+  startParkedTerminalByteWatcher: () => () => {}
+}))
+
+const START_MS = 1_000_000
+const TARGET_ID = 'ssh-parking-host'
+const TARGET: SshTarget = {
+  id: TARGET_ID,
+  label: 'SSH',
+  host: 'example.test',
+  port: 22,
+  username: 'dev'
+}
+const ptyIdFor = (tabId: string): string => `ssh:${TARGET_ID}@@${tabId}`
+const WORKTREE_ID = 'repo-ssh::/work/ssh-parking'
+const LEAF_ID = '11111111-1111-4111-8111-111111111111'
+const TABS = ['tab-a', 'tab-b'].map((id) =>
+  makeTerminalTab({ id, worktreeId: WORKTREE_ID, ptyId: ptyIdFor(id) })
+)
+const ASSIGNMENTS = new Map<string, { groupId: string; isActiveInGroup: boolean }>()
+const PORTALS: never[] = []
+const mounts = new Map<string, number>()
+const authority: DirectSshAuthority = {
+  targetId: TARGET_ID,
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: main-issued opaque tokens are stable strings; this fixture models one unchanged provider incarnation.
+  providerEpoch: 'parking-provider' as SshProviderEpoch,
+  connectionGeneration: 1
+}
+let parkedTabIds: ReadonlySet<string> = new Set()
+
+function AttachedPane({ tabId }: { tabId: string }): null {
+  useEffect(() => {
+    mounts.set(tabId, (mounts.get(tabId) ?? 0) + 1)
+    // Model transport attachment completing through the real store action.
+    const timer = setTimeout(() => {
+      useAppStore.getState().updateTabPtyId(tabId, ptyIdFor(tabId))
+    }, 1_100)
+    return () => clearTimeout(timer)
+  }, [tabId])
+  return null
+}
+
+function ParkingHost(): React.JSX.Element {
+  const tabsByWorktree = useAppStore((state) => state.tabsByWorktree)
+  const pendingStartupByTabId = useAppStore((state) => state.pendingStartupByTabId)
+  const terminalTabs = tabsByWorktree[WORKTREE_ID]
+  const parkedWorktrees = selectColdParkedTerminalWorktrees({
+    worktrees: [
+      {
+        worktreeId: WORKTREE_ID,
+        terminalTabs,
+        hiddenSinceMs: START_MS - 6 * 60_000,
+        isVisible: false,
+        shouldMeasureHiddenWorktree: false,
+        hasActivityTerminalPortal: false
+      },
+      {
+        worktreeId: 'retained-peer',
+        terminalTabs: [],
+        hiddenSinceMs: START_MS - 5 * 60_000,
+        isVisible: false,
+        shouldMeasureHiddenWorktree: false,
+        hasActivityTerminalPortal: false
+      }
+    ],
+    pendingStartupByTabId,
+    parkingEnabled: true,
+    restorePolicy: { sshParkingEnabled: true },
+    nowMs: START_MS
+  })
+  parkedTabIds = useTerminalTabColdParking({
+    worktreeId: WORKTREE_ID,
+    terminalTabs,
+    assignments: ASSIGNMENTS,
+    isWorktreeActive: false,
+    activeTerminalTabId: null,
+    coldParkTerminalPanes:
+      parkedWorktrees.has(WORKTREE_ID) &&
+      terminalTabs.every((tab) => canWatcherCoverParkedTerminalTab(WORKTREE_ID, tab)),
+    shouldMeasureHiddenWorktree: false,
+    activityTerminalPortals: PORTALS
+  })
+  return createElement(
+    Fragment,
+    null,
+    terminalTabs.map((tab) =>
+      parkedTabIds.has(tab.id) ? null : createElement(AttachedPane, { key: tab.id, tabId: tab.id })
+    )
+  )
+}
+
+function ownSnapshot(revision: number): RemoteWorkspaceSnapshot {
+  return {
+    namespace: 'workspace',
+    revision,
+    updatedAt: Date.now(),
+    schemaVersion: 1,
+    session: exportRemoteWorkspaceSession(buildWorkspaceSessionPayload(useAppStore.getState()), {
+      isTargetWorktree: (id) => id === WORKTREE_ID
+    })
+  }
+}
+
+async function applySnapshot(snapshot: RemoteWorkspaceObservedSnapshot): Promise<void> {
+  const result = await applyDirectSshRemoteWorkspaceSnapshot({
+    store: useAppStore,
+    snapshot,
+    token: {
+      authority,
+      catalogRevision: 0,
+      repoFingerprint: 'parking-repo',
+      authorityRequirement: 'required',
+      snapshotRevision: snapshot.revision,
+      outcome: 'complete'
+    },
+    arrival: snapshot.revision,
+    isArrivalCurrent: () => true,
+    isPreparationTokenCurrent: () => true,
+    waitForWorkspaceSessionReady: async () => true,
+    finalizeHydratedTerminals: () => useAppStore.getState().retryDirectSshTargetPanes(authority)
+  })
+  expect(result).toBe('applied')
+}
+
+async function deliverReadAfterOwnReply(own: RemoteWorkspaceSnapshot, read = own): Promise<void> {
+  request.mockResolvedValue(read)
+  let releaseRead: ((snapshot: RemoteWorkspaceSnapshot) => void) | undefined
+  request.mockImplementationOnce(
+    () =>
+      new Promise<RemoteWorkspaceSnapshot>((resolve) => {
+        releaseRead = resolve
+      })
+  )
+  const applies: Promise<void>[] = []
+  const errors: unknown[] = []
+  const resync = resyncStaleRemoteWorkspace(
+    TARGET,
+    (snapshot) => {
+      applies.push(applySnapshot(snapshot))
+    },
+    (error) => errors.push(error)
+  )
+  expect(request).toHaveBeenLastCalledWith('workspace.get', { namespace: expect.any(String) })
+  rememberLocallyPatchedRemoteWorkspaceSnapshot(TARGET_ID, own)
+  await act(async () => {
+    releaseRead?.(read)
+    await resync
+    await Promise.all(applies)
+  })
+  expect(errors).toEqual([])
+}
+
+describe('direct SSH snapshot delivery and parking', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(START_MS)
+    mounts.clear()
+    request.mockReset()
+    clearRemoteWorkspaceSnapshotCache()
+    _resetRemoteWorkspaceStaleResyncForTests()
+    Object.defineProperty(window, 'api', {
+      configurable: true,
+      value: {
+        pty: {
+          onData: () => () => {},
+          onReplay: () => () => {},
+          onExit: () => () => {}
+        }
+      }
+    })
+    disposeAllParkedTerminalWatchers()
+    useAppStore.setState({
+      ...useAppStore.getInitialState(),
+      workspaceSessionReady: true,
+      hydrationSucceeded: true,
+      repos: [
+        {
+          id: 'repo-ssh',
+          path: '/work',
+          displayName: 'SSH',
+          badgeColor: 'blue',
+          addedAt: 0,
+          connectionId: TARGET_ID
+        }
+      ],
+      worktreesByRepo: {
+        'repo-ssh': [
+          makeWorktree({
+            id: WORKTREE_ID,
+            repoId: 'repo-ssh',
+            path: '/work/ssh-parking',
+            hostId: `ssh:${TARGET_ID}`
+          })
+        ]
+      },
+      sshConnectionStates: new Map([
+        [TARGET_ID, { ...authority, status: 'connected', error: null, reconnectAttempt: 0 }]
+      ]),
+      tabsByWorktree: { [WORKTREE_ID]: TABS },
+      ptyIdsByTabId: Object.fromEntries(TABS.map((tab) => [tab.id, [ptyIdFor(tab.id)]])),
+      lastKnownRelayPtyIdByTabId: Object.fromEntries(TABS.map((tab) => [tab.id, ptyIdFor(tab.id)])),
+      terminalLayoutsByTabId: Object.fromEntries(
+        TABS.map((tab) => [tab.id, singlePaneLayoutSnapshot(LEAF_ID, ptyIdFor(tab.id))])
+      )
+    })
+  })
+
+  afterEach(() => {
+    cleanup()
+    disposeAllParkedTerminalWatchers()
+    useAppStore.setState(useAppStore.getInitialState(), true)
+    vi.useRealTimers()
+  })
+
+  it('keeps panes parked through pending-read own echoes while still applying a peer edit', async () => {
+    render(createElement(ParkingHost))
+    expect(parkedTabIds).toEqual(new Set(TABS.map((tab) => tab.id)))
+    expect(mounts.size).toBe(0)
+    rememberRemoteWorkspaceSnapshot(TARGET_ID, ownSnapshot(0))
+
+    // Visibility, ordering, measurement and saved PTY coverage stay unchanged throughout.
+
+    for (let revision = 1; revision <= 4; revision += 1) {
+      act(() => {
+        vi.advanceTimersByTime(2_000)
+        useAppStore.getState().updateTabTitle('tab-a', `Local title ${revision}`)
+      })
+      await deliverReadAfterOwnReply(ownSnapshot(revision))
+      expect(parkedTabIds).toEqual(new Set(TABS.map((tab) => tab.id)))
+      expect(mounts.size).toBe(0)
+    }
+
+    const own = ownSnapshot(5)
+    const peer = structuredClone(own)
+    peer.revision = 6
+    for (const tabs of Object.values(peer.session.tabsByWorktreePath)) {
+      for (const tab of tabs) {
+        if (tab.id === 'tab-a') {
+          tab.title = 'Peer title'
+        }
+      }
+    }
+    await deliverReadAfterOwnReply(own, peer)
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE_ID][0].title).toBe('Peer title')
+    expect([...mounts.values()]).toEqual([1, 1])
+    expect(parkedTabIds.size).toBe(0)
+    act(() => vi.advanceTimersByTime(1_100))
+    expect(parkedTabIds).toEqual(new Set(TABS.map((tab) => tab.id)))
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE_ID].map((tab) => tab.ptyId)).toEqual(
+      TABS.map((tab) => ptyIdFor(tab.id))
+    )
+  })
+})
diff --git a/tests/e2e/finished-agent-ghost-resume.spec.ts b/tests/e2e/finished-agent-ghost-resume.spec.ts
index 5d135161f08..6022edbf201 100644
--- a/tests/e2e/finished-agent-ghost-resume.spec.ts
+++ b/tests/e2e/finished-agent-ghost-resume.spec.ts
@@ -1,3 +1,7 @@
+import {
+  readPersistedProfileState,
+  mutateStoppedProfileState
+} from './helpers/persisted-profile-state'
 /**
  * A LOCAL agent that FINISHED its turn must not be respawned when the app
  * reopens the workspace.
@@ -15,8 +19,7 @@
  *   pnpm exec playwright test tests/e2e/finished-agent-ghost-resume.spec.ts \
  *     --config tests/playwright.config.ts --project electron-headless --workers=1
  */
-import { existsSync, readFileSync, writeFileSync } from 'node:fs'
-import path from 'node:path'
+import { existsSync, readFileSync } from 'node:fs'
 import type { ElectronApplication } from '@stablyai/playwright-test'
 import { test, expect } from './helpers/orca-app'
 import { TEST_REPO_PATH_FILE } from './global-setup'
@@ -31,7 +34,6 @@ import {
 import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
 import { attachRepoAndOpenTerminal, createRestartSession } from './helpers/orca-restart'
 import { createHostRendererTerminalTab } from './helpers/host-created-terminal-retention-oracle'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 
 const PROVIDER_SESSION_ID = 'e2e-finished-agent-session'
 
@@ -43,13 +45,8 @@ type PersistedRecord = {
 }
 
 function readPersistedRecords(userDataDir: string): Record<string, PersistedRecord> {
-  const dataPath = path.join(
-    userDataDir,
-    'profiles',
-    DEFAULT_LOCAL_ORCA_PROFILE_ID,
-    'orca-data.json'
-  )
-  const data = JSON.parse(readFileSync(dataPath, 'utf8')) as {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+  const data = readPersistedProfileState(userDataDir) as {
     workspaceSession?: { sleepingAgentSessionsByPaneKey?: Record<string, PersistedRecord> }
   }
   return data.workspaceSession?.sleepingAgentSessionsByPaneKey ?? {}
@@ -57,24 +54,20 @@ function readPersistedRecords(userDataDir: string): Record<string, PersistedReco
 
 /** Make the resume hermetic: the respawned tab echoes instead of running codex. */
 function stubPersistedResumeCommand(userDataDir: string): PersistedRecord {
-  const dataPath = path.join(
-    userDataDir,
-    'profiles',
-    DEFAULT_LOCAL_ORCA_PROFILE_ID,
-    'orca-data.json'
-  )
-  const data = JSON.parse(readFileSync(dataPath, 'utf8')) as {
-    workspaceSession?: { sleepingAgentSessionsByPaneKey?: Record<string, PersistedRecord> }
-  }
-  const record = Object.values(data.workspaceSession?.sleepingAgentSessionsByPaneKey ?? {}).find(
-    (candidate) => candidate.providerSession?.id === PROVIDER_SESSION_ID
-  )
-  if (!record) {
-    throw new Error('Expected the finished agent turn to leave a persisted record')
-  }
-  record.launchConfig = { agentCommand: 'echo', agentArgs: '', agentEnv: {} }
-  writeFileSync(dataPath, `${JSON.stringify(data, null, 2)}\n`, 'utf8')
-  return record
+  return mutateStoppedProfileState(userDataDir, (state) => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+    const data = state as {
+      workspaceSession?: { sleepingAgentSessionsByPaneKey?: Record<string, PersistedRecord> }
+    }
+    const record = Object.values(data.workspaceSession?.sleepingAgentSessionsByPaneKey ?? {}).find(
+      (candidate) => candidate.providerSession?.id === PROVIDER_SESSION_ID
+    )
+    if (!record) {
+      throw new Error('Expected the finished agent turn to leave a persisted record')
+    }
+    record.launchConfig = { agentCommand: 'echo', agentArgs: '', agentEnv: {} }
+    return record
+  })
 }
 
 test.describe.configure({ mode: 'serial' })
diff --git a/tests/e2e/fixtures/daemon-generation-legacy-close-client.ts b/tests/e2e/fixtures/daemon-generation-legacy-close-client.ts
index 730ebbeffc9..473071c030b 100644
--- a/tests/e2e/fixtures/daemon-generation-legacy-close-client.ts
+++ b/tests/e2e/fixtures/daemon-generation-legacy-close-client.ts
@@ -1,11 +1,13 @@
 import { readFileSync } from 'node:fs'
 import process from 'node:process'
+import type { Store } from '../../../src/main/persistence'
 import { OrcaRuntimeService } from '../../../src/main/runtime/orca-runtime'
 import { RpcDispatcher } from '../../../src/main/runtime/rpc/dispatcher'
 import { SESSION_TAB_METHODS } from '../../../src/main/runtime/rpc/methods/session-tabs'
 import { SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY } from '../../../src/shared/protocol-version'
 import type { RuntimeMobileSessionTabsSnapshot } from '../../../src/shared/runtime-types'
 import { createDesktopDiscoveredDaemonRouter } from './daemon-generation-desktop-discovery'
+import { createDaemonGenerationProfileStore } from './daemon-generation-profile-store'
 
 type FixtureSession = {
   protocolVersion: number
@@ -126,6 +128,7 @@ async function waitForFinish(): Promise<void> {
 async function main(): Promise<void> {
   const config = readConfig()
   const { router } = await createDesktopDiscoveredDaemonRouter(config)
+  let store: Store | null = null
   try {
     const outputBySessionId = new Map<string, string>()
     router.onData((event) => {
@@ -149,7 +152,8 @@ async function main(): Promise<void> {
       }
     }
 
-    const runtime = new OrcaRuntimeService()
+    store = createDaemonGenerationProfileStore(config.cwd)
+    const runtime = new OrcaRuntimeService(store)
     const calls: Record<string, unknown>[] = []
     const sessionByTabId = new Map(config.sessions.map((session) => [session.tabId, session]))
     runtime.setPtyController({
@@ -296,6 +300,7 @@ async function main(): Promise<void> {
   } finally {
     await router.disconnectOnly().catch(() => {})
     router.dispose()
+    await store?.freezeWritesAsync()
   }
 }
 
diff --git a/tests/e2e/fixtures/daemon-generation-profile-store.ts b/tests/e2e/fixtures/daemon-generation-profile-store.ts
new file mode 100644
index 00000000000..a709d84bcc8
--- /dev/null
+++ b/tests/e2e/fixtures/daemon-generation-profile-store.ts
@@ -0,0 +1,14 @@
+import path from 'node:path'
+import { installOrcadHostAdapters } from '../../../src/main/orcad/orcad-entry'
+import type { Store } from '../../../src/main/persistence'
+import { createProfileStateStore } from '../../../src/main/persistence/profile-state/profile-state-store-factory'
+
+export function createDaemonGenerationProfileStore(directory: string): Store {
+  installOrcadHostAdapters()
+  // The bundled fixture has no profile writer worker; use the synchronous SQLite authority.
+  return createProfileStateStore({
+    dataFile: path.join(directory, 'orca-data.json'),
+    databaseFile: path.join(directory, 'profile-state.sqlite'),
+    profileId: 'legacy-close-fixture'
+  }).store
+}
diff --git a/tests/e2e/global-setup-cli-artifact.unit.test.ts b/tests/e2e/global-setup-cli-artifact.unit.test.ts
new file mode 100644
index 00000000000..4c22d1a219d
--- /dev/null
+++ b/tests/e2e/global-setup-cli-artifact.unit.test.ts
@@ -0,0 +1,85 @@
+import path from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const fixture = vi.hoisted(() => ({
+  exec: vi.fn(),
+  exists: vi.fn(),
+  write: vi.fn()
+}))
+
+vi.mock('node:child_process', () => ({ execSync: fixture.exec }))
+vi.mock('node:fs', () => ({
+  existsSync: fixture.exists,
+  mkdirSync: vi.fn(),
+  mkdtempSync: (prefix: string) => `${prefix}fixture`,
+  realpathSync: (value: string) => value,
+  writeFileSync: fixture.write
+}))
+vi.mock('./helpers/docker-ssh-relay-image', () => ({ prepareDockerSshRelayImage: vi.fn() }))
+
+import globalSetup from './global-setup'
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  fixture.exists.mockReturnValue(true)
+  for (const name of [
+    'SKIP_BUILD',
+    'ORCA_E2E_WEB_CLIENT',
+    'ORCA_E2E_SSH_LOCALHOST',
+    'ORCA_E2E_SSH_DOCKER',
+    'ORCA_E2E_NESTED_RUNTIME_SSH',
+    'ORCA_E2E_SKILL_STAGING',
+    'ORCA_E2E_TEST_REPO_PATH_FILE'
+  ]) {
+    vi.stubEnv(name, '')
+  }
+})
+
+afterEach(() => vi.unstubAllEnvs())
+
+function commands(): string[] {
+  return fixture.exec.mock.calls.map(([command]) => command)
+}
+
+describe('E2E shared CLI artifact', () => {
+  it('repairs downloaded permissions and installs the local launcher without recompiling', () => {
+    vi.stubEnv('SKIP_BUILD', '1')
+    globalSetup()
+    const prepare = commands().find((command) => command.includes('prepare:cli-output'))
+    expect(prepare).toBe('pnpm run prepare:cli-output')
+    expect(commands()).not.toContain('pnpm run build:cli')
+    expect(commands()).toContain('git init')
+    expect(fixture.exec.mock.calls.find(([command]) => command === prepare)?.[1]).toEqual({
+      cwd: process.cwd(),
+      stdio: 'inherit',
+      timeout: 120_000
+    })
+  })
+
+  it('builds a missing CLI even when the other artifacts exist', () => {
+    vi.stubEnv('SKIP_BUILD', '1')
+    fixture.exists.mockImplementation(
+      (file) => file !== path.join(process.cwd(), 'out', 'cli', 'index.js')
+    )
+    globalSetup()
+    expect(commands()).toContain('pnpm run build:cli')
+    expect(commands().some((command) => command.includes('prepare:cli-output'))).toBe(false)
+  })
+
+  it('rebuilds existing artifacts when reuse is not requested', () => {
+    globalSetup()
+    expect(commands()).toContain('npx electron-vite build --mode e2e')
+    expect(commands()).toContain('pnpm run build:cli')
+  })
+
+  it('fails setup if the downloaded CLI cannot be verified', () => {
+    vi.stubEnv('SKIP_BUILD', '1')
+    fixture.exec.mockImplementation((command) => {
+      if (command.includes('prepare:cli-output')) {
+        throw new Error('Invalid CLI artifact')
+      }
+    })
+    expect(() => globalSetup()).toThrow('Invalid CLI artifact')
+    expect(commands()).not.toContain('git init')
+  })
+})
diff --git a/tests/e2e/global-setup.ts b/tests/e2e/global-setup.ts
index cd5d9b3c4e0..210c713159b 100644
--- a/tests/e2e/global-setup.ts
+++ b/tests/e2e/global-setup.ts
@@ -54,6 +54,12 @@ export default function globalSetup(): void {
   }
   if (process.env.SKIP_BUILD && existsSync(outCli)) {
     console.error('[e2e] SKIP_BUILD set and out/cli/index.js exists — skipping CLI build')
+    // Artifact downloads lose executable bits; each runner still needs its local dev launcher.
+    execSync('pnpm run prepare:cli-output', {
+      cwd: root,
+      stdio: 'inherit',
+      timeout: CLI_E2E_BUILD_TIMEOUT_MS
+    })
   } else {
     console.error('[e2e] Building bundled CLI...')
     execSync('pnpm run build:cli', {
diff --git a/tests/e2e/headless-serve-desktop-activation.spec.ts b/tests/e2e/headless-serve-desktop-activation.spec.ts
index 1d4b4a0f82c..673f548d18c 100644
--- a/tests/e2e/headless-serve-desktop-activation.spec.ts
+++ b/tests/e2e/headless-serve-desktop-activation.spec.ts
@@ -1,3 +1,4 @@
+import { readPersistedProfileState } from './helpers/persisted-profile-state'
 import { spawn, type ChildProcess } from 'node:child_process'
 import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
@@ -31,7 +32,6 @@ import type {
 } from '../../src/shared/runtime-types'
 import { PROTOCOL_VERSION } from '../../src/main/daemon/types'
 import { parsePaneKey } from '../../src/shared/stable-pane-id'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 
 const electronPackageDir = path.join(process.cwd(), 'node_modules', 'electron')
 const electronPath = path.join(
@@ -76,12 +76,8 @@ function readPersistedPromotionBinding(
   leafId: string
 ): { tabId: string; leafId: string; ptyId: string } | null {
   try {
-    const persisted = JSON.parse(
-      readFileSync(
-        path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID, 'orca-data.json'),
-        'utf8'
-      )
-    ) as {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+    const persisted = readPersistedProfileState(userDataDir) as {
       workspaceSession?: {
         tabsByWorktree?: Record<string, { id?: string; ptyId?: string | null }[]>
         terminalLayoutsByTabId?: Record<string, { ptyIdsByLeafId?: Record<string, string | null> }>
diff --git a/tests/e2e/helpers/completed-worker-retirement-fixture.ts b/tests/e2e/helpers/completed-worker-retirement-fixture.ts
index d3ef3fb8195..89ae5297fe4 100644
--- a/tests/e2e/helpers/completed-worker-retirement-fixture.ts
+++ b/tests/e2e/helpers/completed-worker-retirement-fixture.ts
@@ -1,3 +1,4 @@
+import { readPersistedProfileState } from './persisted-profile-state'
 import { execFileSync } from 'node:child_process'
 import {
   chmodSync,
@@ -11,7 +12,6 @@ import {
 import os from 'node:os'
 import path from 'node:path'
 import type { RuntimeClient } from '../../../src/cli/runtime-client'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../../src/shared/orca-profiles'
 import type {
   RuntimeTerminalListResult,
   RuntimeTerminalSummary
@@ -20,14 +20,34 @@ import { buildFakeAgentCommandOverride } from './fake-agent-command-override'
 import { FAKE_AGENT_PASTE_END_SCANNER_SOURCE } from './fake-agent-paste-end-scanner'
 
 const fakeCliDir = mkdtempSync(path.join(os.tmpdir(), 'orca-e2e-retired-worker-'))
+const recoveryConfigPath = path.join(fakeCliDir, 'recovery-config.json')
 const lifecycleLedgerPath = path.join(fakeCliDir, 'codex-lifecycle.jsonl')
 export const completedWorkerFakeCodexCommand = buildFakeAgentCommandOverride(
   path.join(fakeCliDir, process.platform === 'win32' ? 'codex.cmd' : 'codex')
 )
 const fakeCodexSource = `
-const { appendFileSync } = require('node:fs')
+const { appendFileSync, readFileSync } = require('node:fs')
 const ledger = process.env.ORCA_E2E_CODEX_LIFECYCLE_LEDGER
 const append = (event) => appendFileSync(ledger, JSON.stringify({ pid: process.pid, ...event }) + '\\n')
+async function publishRecovery() {
+  const config = JSON.parse(readFileSync(${JSON.stringify(recoveryConfigPath)}, 'utf8'))
+  for (const hook_event_name of ['UserPromptSubmit', 'Stop']) {
+    const response = await fetch('http://127.0.0.1:' + process.env.ORCA_AGENT_HOOK_PORT + '/hook/codex', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'X-Orca-Agent-Hook-Token': process.env.ORCA_AGENT_HOOK_TOKEN },
+      body: JSON.stringify({
+        paneKey: process.env.ORCA_PANE_KEY,
+        tabId: process.env.ORCA_TAB_ID,
+        worktreeId: process.env.ORCA_WORKTREE_ID,
+        launchToken: process.env.ORCA_AGENT_LAUNCH_TOKEN,
+        env: process.env.ORCA_AGENT_HOOK_ENV,
+        version: process.env.ORCA_AGENT_HOOK_VERSION,
+        payload: { hook_event_name, prompt: 'Report completion, then exit normally', ...config }
+      })
+    })
+    if (response.status !== 204) throw new Error('Recovery hook rejected: ' + response.status)
+  }
+}
 const args = process.argv.slice(2)
 if (args.includes('app-server')) {
   process.stderr.write("error: unrecognized subcommand 'app-server'\\n")
@@ -44,6 +64,10 @@ process.stdin.on('data', (chunk) => {
     process.stdout.write('\\x1b[?25h')
   }
   append({ event: 'input', input })
+  if (input.includes('ORCA_E2E_PUBLISH_DONE')) {
+    void publishRecovery().catch((error) => process.stderr.write(String(error)))
+    return
+  }
   if (input.includes('ORCA_E2E_EXIT_AFTER_DONE')) {
     append({ event: 'normal-exit' })
     process.exit(0)
@@ -179,6 +203,10 @@ export function seedCurrentCodexTranscript(
       payload: { id: providerSessionId, cwd }
     })}\n`
   )
+  writeFileSync(
+    recoveryConfigPath,
+    JSON.stringify({ session_id: providerSessionId, transcript_path: transcriptPath })
+  )
   return transcriptPath
 }
 
@@ -194,16 +222,8 @@ export async function listRuntimeTerminals(
 }
 
 export function readPersistedWorkerRecoveryRecord(userDataDir: string, paneKey: string) {
-  const dataPath = path.join(
-    userDataDir,
-    'profiles',
-    DEFAULT_LOCAL_ORCA_PROFILE_ID,
-    'orca-data.json'
-  )
-  if (!existsSync(dataPath)) {
-    return null
-  }
-  const data = JSON.parse(readFileSync(dataPath, 'utf8')) as {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+  const data = readPersistedProfileState(userDataDir) as {
     workspaceSession?: {
       sleepingAgentSessionsByPaneKey?: Record<
         string,
diff --git a/tests/e2e/helpers/computer-driver.ts b/tests/e2e/helpers/computer-driver.ts
index bc7e7a0acb8..aa1c8cecb8f 100644
--- a/tests/e2e/helpers/computer-driver.ts
+++ b/tests/e2e/helpers/computer-driver.ts
@@ -10,6 +10,7 @@ import {
   stopOrcaRuntime,
   type CliResult
 } from './computer-cli-driver'
+import { quotePowerShellLiteral } from '../../../src/shared/powershell-native-argument'
 
 const execFileAsync = promisify(execFile)
 let textEditTempDir: string | null = null
@@ -185,7 +186,7 @@ export async function ensureNotepadLaunched(): Promise<void> {
     '-NoProfile',
     '-NonInteractive',
     '-Command',
-    `Start-Process notepad.exe -ArgumentList ${powerShellSingleQuoted(filePath)}`
+    `Start-Process notepad.exe -ArgumentList ${quotePowerShellLiteral(filePath)}`
   ])
   notepadAppSelector = `pid:${await findNotepadWindowPid(filePath)}`
 }
@@ -232,7 +233,7 @@ function delay(ms: number): Promise<void> {
 async function findNotepadWindowPid(filePath: string): Promise<number> {
   const targetName = filePath.split(/[\\/]/).at(-1) ?? filePath
   const script = [
-    `$targetName = ${powerShellSingleQuoted(targetName)}`,
+    `$targetName = ${quotePowerShellLiteral(targetName)}`,
     '$deadline = (Get-Date).AddSeconds(15)',
     '$target = $null',
     'while ((Get-Date) -lt $deadline -and $null -eq $target) {',
@@ -260,10 +261,6 @@ async function findNotepadWindowPid(filePath: string): Promise<number> {
   return Number.parseInt(result.stdout.trim(), 10)
 }
 
-function powerShellSingleQuoted(value: string): string {
-  return `'${value.replaceAll("'", "''")}'`
-}
-
 function escapeAppleScript(value: string): string {
   return value.replaceAll('\\', '\\\\').replaceAll('"', '\\"')
 }
diff --git a/tests/e2e/helpers/daemon-generation-runtime-fixture.ts b/tests/e2e/helpers/daemon-generation-runtime-fixture.ts
index 88111024368..332d21aa271 100644
--- a/tests/e2e/helpers/daemon-generation-runtime-fixture.ts
+++ b/tests/e2e/helpers/daemon-generation-runtime-fixture.ts
@@ -1,4 +1,12 @@
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync
+} from 'node:fs'
 import { homedir, tmpdir } from 'node:os'
 import path from 'node:path'
 import { build } from 'esbuild'
@@ -109,6 +117,12 @@ export async function createDaemonGenerationRuntime(
   const reconnectClientEntryPath = path.join(rootDir, 'daemon-generation-reconnect-client.cjs')
   const legacyCloseClientEntryPath = path.join(rootDir, 'daemon-generation-legacy-close-client.cjs')
   const repoRoot = process.cwd()
+  // ESM imports in the bundled fixture resolve from its temp directory, not NODE_PATH.
+  symlinkSync(
+    path.join(repoRoot, 'node_modules'),
+    path.join(rootDir, 'node_modules'),
+    process.platform === 'win32' ? 'junction' : 'dir'
+  )
   await buildFixtureEntry(
     path.join(repoRoot, 'tests/e2e/fixtures/daemon-generation-entry.ts'),
     entryPath
diff --git a/tests/e2e/helpers/docker-ssh-relay-target.ts b/tests/e2e/helpers/docker-ssh-relay-target.ts
index f535b22d073..9d96859968e 100644
--- a/tests/e2e/helpers/docker-ssh-relay-target.ts
+++ b/tests/e2e/helpers/docker-ssh-relay-target.ts
@@ -200,6 +200,36 @@ export function blockDockerSshRelayTargetTcpForwarding(target: DockerSshRelayTar
   )
 }
 
+/**
+ * Makes the target unreachable over SSH while the container, its fixtures and `docker exec` stay
+ * up: sshd re-binds to the container's loopback, so the published port stops reaching it. Only new
+ * connections are refused; an established session lives until its client closes it. Returns once
+ * a real ssh client fails to connect, so a config that silently failed to apply surfaces here.
+ */
+export function refuseDockerSshRelayTargetConnections(target: DockerSshRelayTarget): void {
+  // Why HUP, not a restart: see blockDockerSshRelayTargetTcpForwarding — PID 1 is sshd.
+  execDockerSshRelayTargetControlCommand(
+    target,
+    "printf '%s\\n' 'ListenAddress 127.0.0.1' >> /etc/ssh/sshd_config; kill -HUP 1"
+  )
+  const deadline = Date.now() + 60_000
+  let lastProbe = ''
+  while (Date.now() < deadline) {
+    const result = spawnSync('ssh', sshArgs(target, 'true'), {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: 15_000
+    })
+    lastProbe = result.stderr || result.stdout || `exit ${result.status}`
+    // Why the auth check: a refusal must look like a dead host, never a credential prompt.
+    if (result.status !== 0 && !/permission denied/i.test(lastProbe)) {
+      return
+    }
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 500)
+  }
+  throw new Error(`sshd kept accepting connections after ListenAddress 127.0.0.1: ${lastProbe}`)
+}
+
 export function writeDockerSshRelayTargetFile(
   target: DockerSshRelayTarget,
   filePath: string,
diff --git a/tests/e2e/helpers/e2e-completed-onboarding-profile.ts b/tests/e2e/helpers/e2e-completed-onboarding-profile.ts
index 0fa738dee73..82f79564dd3 100644
--- a/tests/e2e/helpers/e2e-completed-onboarding-profile.ts
+++ b/tests/e2e/helpers/e2e-completed-onboarding-profile.ts
@@ -1,4 +1,7 @@
-import { ONBOARDING_FINAL_STEP, ONBOARDING_FLOW_VERSION } from '../../../src/shared/constants'
+import {
+  ONBOARDING_FINAL_STEP,
+  ONBOARDING_FLOW_VERSION
+} from '../../../src/shared/onboarding-defaults'
 import { FEATURE_INTERACTION_IDS } from '../../../src/shared/feature-interactions'
 import { FEATURE_TIP_IDS } from '../../../src/shared/feature-tips'
 
diff --git a/tests/e2e/helpers/electron-home-isolation.ts b/tests/e2e/helpers/electron-home-isolation.ts
index e81cbae1907..0c800e2bb9a 100644
--- a/tests/e2e/helpers/electron-home-isolation.ts
+++ b/tests/e2e/helpers/electron-home-isolation.ts
@@ -9,6 +9,8 @@ const RESTRICTED_ENV_KEYS = new Set([
   'HOMEPATH',
   'CODEX_HOME',
   'ORCA_CODEX_HOME',
+  // Why: Orca's spawn hook writes Claude folder trust into the config this names.
+  'CLAUDE_CONFIG_DIR',
   'ORCA_E2E_USER_DATA_DIR',
   'ORCA_E2E_HOME_DIR',
   'ZDOTDIR',
diff --git a/tests/e2e/helpers/electron-home-isolation.unit.test.ts b/tests/e2e/helpers/electron-home-isolation.unit.test.ts
index b84770bcdeb..3d2e9a4adb6 100644
--- a/tests/e2e/helpers/electron-home-isolation.unit.test.ts
+++ b/tests/e2e/helpers/electron-home-isolation.unit.test.ts
@@ -31,6 +31,7 @@ describe('createElectronHomeIsolation', () => {
         USERPROFILE: '/real/home',
         CODEX_HOME: '/real/codex',
         ORCA_CODEX_HOME: '/real/orca-codex',
+        CLAUDE_CONFIG_DIR: '/real/claude',
         ZDOTDIR: '/real/zdotdir',
         PATH: '/bin'
       },
@@ -54,6 +55,7 @@ describe('createElectronHomeIsolation', () => {
     })
     expect(isolation.env.CODEX_HOME).toBeUndefined()
     expect(isolation.env.ORCA_CODEX_HOME).toBeUndefined()
+    expect(isolation.env.CLAUDE_CONFIG_DIR).toBeUndefined()
     expect(isolation.env.ZDOTDIR).toBeUndefined()
     // Codex always routes to the resolved home, so the post-launch guard must
     // accept the boundary this env produces.
diff --git a/tests/e2e/helpers/electron-launch-args.ts b/tests/e2e/helpers/electron-launch-args.ts
index 6868f48b083..e749945eddb 100644
--- a/tests/e2e/helpers/electron-launch-args.ts
+++ b/tests/e2e/helpers/electron-launch-args.ts
@@ -1,12 +1,14 @@
 import { dirname } from 'node:path'
 
+export function getElectronIsolatedKeychainArgs(): string[] {
+  // Isolated macOS profiles must not invoke the system keychain UI.
+  return process.platform === 'darwin' ? ['--password-store=basic', '--use-mock-keychain'] : []
+}
+
 export function getOrcaElectronLaunchArgs(mainPath: string, headful: boolean): string[] {
   // Launch through package.json so app version and resource paths match a packaged app.
   const appPath = dirname(dirname(dirname(mainPath)))
-  // Isolated macOS profiles must not invoke the system keychain UI. Without
-  // these Chromium switches startup can block before the first renderer target.
-  const keychainArgs =
-    process.platform === 'darwin' ? ['--password-store=basic', '--use-mock-keychain'] : []
+  const keychainArgs = getElectronIsolatedKeychainArgs()
   if (process.platform === 'darwin') {
     // Crash tests must not block later launches on AppKit's saved-window recovery dialog.
     return [...keychainArgs, appPath, '-ApplePersistenceIgnoreState', 'YES']
diff --git a/tests/e2e/helpers/electron-launch-args.unit.test.ts b/tests/e2e/helpers/electron-launch-args.unit.test.ts
index c538d6f9a85..301548a9f4e 100644
--- a/tests/e2e/helpers/electron-launch-args.unit.test.ts
+++ b/tests/e2e/helpers/electron-launch-args.unit.test.ts
@@ -1,10 +1,24 @@
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { getOrcaElectronLaunchArgs } from './electron-launch-args'
+import { getElectronIsolatedKeychainArgs, getOrcaElectronLaunchArgs } from './electron-launch-args'
 
 describe('getOrcaElectronLaunchArgs', () => {
   afterEach(() => vi.unstubAllGlobals())
 
+  it.each(['darwin', 'linux', 'win32'])(
+    'isolates packaged and source test keychains on %s',
+    (platform) => {
+      vi.stubGlobal('process', { ...process, platform })
+      const args = getElectronIsolatedKeychainArgs()
+      expect(args).toEqual(
+        platform === 'darwin' ? ['--password-store=basic', '--use-mock-keychain'] : []
+      )
+      expect(getOrcaElectronLaunchArgs(join('orca', 'out', 'main', 'index.js'), false)).toEqual(
+        expect.arrayContaining(args)
+      )
+    }
+  )
+
   it.each([
     ['linux', 'true', true, true],
     ['linux', undefined, true, false],
diff --git a/tests/e2e/helpers/electron-main-evaluate-retry.ts b/tests/e2e/helpers/electron-main-evaluate-retry.ts
index 502e93152a0..c7794c40728 100644
--- a/tests/e2e/helpers/electron-main-evaluate-retry.ts
+++ b/tests/e2e/helpers/electron-main-evaluate-retry.ts
@@ -1,13 +1,13 @@
 const MAIN_EVALUATE_ATTEMPTS = 5
 const MAIN_EVALUATE_RETRY_MS = 200
 
-/**
- * Playwright raises this message for any main-process CDP failure that is neither
- * a JS error nor a closed session, so it does not mean anything navigated — it is
- * also what a handle the main process has not finished publishing looks like.
- */
+// Startup can invalidate the CDP context or collect a pending evaluation promise.
 function isTransientMainEvaluateError(error: unknown): boolean {
-  return error instanceof Error && error.message.includes('Execution context was destroyed')
+  return (
+    error instanceof Error &&
+    (error.message.includes('Execution context was destroyed') ||
+      error.message.includes('Resulting promise was garbage collected'))
+  )
 }
 
 function waitBeforeRetry(): Promise<void> {
diff --git a/tests/e2e/helpers/electron-main-evaluate-retry.unit.test.ts b/tests/e2e/helpers/electron-main-evaluate-retry.unit.test.ts
index 7909a4d6eab..c6735e2fd1f 100644
--- a/tests/e2e/helpers/electron-main-evaluate-retry.unit.test.ts
+++ b/tests/e2e/helpers/electron-main-evaluate-retry.unit.test.ts
@@ -1,8 +1,10 @@
 import { describe, expect, it } from 'vitest'
 import { retryTransientMainEvaluate } from './electron-main-evaluate-retry'
 
-const transient = (): Error =>
-  new Error('Execution context was destroyed, most likely because of a navigation.')
+const transientMessages = [
+  'Execution context was destroyed, most likely because of a navigation.',
+  'electronApplication.evaluate: Resulting promise was garbage collected.'
+]
 
 describe('retryTransientMainEvaluate', () => {
   it('returns the first successful read without retrying', async () => {
@@ -16,13 +18,13 @@ describe('retryTransientMainEvaluate', () => {
     expect(calls).toBe(1)
   })
 
-  it('rides out the startup window that made the paired-client launch flaky', async () => {
+  it.each(transientMessages)('retries a transient startup failure: %s', async (message) => {
     let calls = 0
     await expect(
       retryTransientMainEvaluate(async () => {
         calls += 1
         if (calls < 3) {
-          throw transient()
+          throw new Error(message)
         }
         return '/isolated/home'
       })
@@ -41,14 +43,30 @@ describe('retryTransientMainEvaluate', () => {
     expect(calls).toBe(1)
   })
 
-  it('gives up rather than looping forever when the app never becomes evaluable', async () => {
+  it.each(transientMessages)(
+    'bounds retries when evaluation keeps failing: %s',
+    async (message) => {
+      let calls = 0
+      await expect(
+        retryTransientMainEvaluate(async () => {
+          calls += 1
+          throw new Error(message)
+        })
+      ).rejects.toThrow(message)
+      expect(calls).toBe(5)
+    }
+  )
+
+  it('does not retry a closed application', async () => {
     let calls = 0
     await expect(
       retryTransientMainEvaluate(async () => {
         calls += 1
-        throw transient()
+        throw new Error(
+          'electronApplication.evaluate: Target page, context or browser has been closed'
+        )
       })
-    ).rejects.toThrow(/Execution context was destroyed/)
-    expect(calls).toBe(5)
+    ).rejects.toThrow(/has been closed/)
+    expect(calls).toBe(1)
   })
 })
diff --git a/tests/e2e/helpers/electron-process-shutdown.ts b/tests/e2e/helpers/electron-process-shutdown.ts
index f9b642a676e..5d78b761b96 100644
--- a/tests/e2e/helpers/electron-process-shutdown.ts
+++ b/tests/e2e/helpers/electron-process-shutdown.ts
@@ -157,11 +157,20 @@ async function forceKillProcessTree(proc: ChildProcess): Promise<void> {
  * Use `closeElectronAppForE2E` for an ordinary quit — this exists for specs that need a client to
  * vanish without unwinding its sockets or subscriptions.
  */
-export async function forceQuitElectronAppForE2E(app: ElectronApplication): Promise<void> {
+export async function forceQuitElectronAppForE2E(
+  app: ElectronApplication,
+  options: { preserveDaemons?: boolean } = {}
+): Promise<void> {
   const proc = app.process()
   const pid = proc.pid
   if (pid) {
-    if (process.platform === 'win32') {
+    if (options.preserveDaemons) {
+      // Chromium helpers hold Windows profile handles; Electron's list excludes detached daemons.
+      const appPids = await app.evaluate(({ app }) => app.getAppMetrics().map(({ pid }) => pid))
+      for (const targetPid of new Set([pid, ...appPids])) {
+        killPid(targetPid, 'SIGKILL')
+      }
+    } else if (process.platform === 'win32') {
       try {
         execFileSync('taskkill', ['/pid', String(pid), '/T', '/F'], {
           stdio: 'ignore'
@@ -178,8 +187,12 @@ export async function forceQuitElectronAppForE2E(app: ElectronApplication): Prom
   }
   await waitForExit(proc, PROCESS_EXIT_TIMEOUT_MS)
   releaseExitedProcessPipes(proc)
-  // Hands the dead app back to Playwright so worker teardown has nothing left to wait on.
-  await app.close().catch(() => undefined)
+  // Playwright close can remain pending after an external force-kill.
+  await withTimeout(
+    app.close(),
+    PROCESS_EXIT_TIMEOUT_MS,
+    'Timed out releasing killed Electron app'
+  ).catch(() => undefined)
 }
 
 export async function closeElectronAppForE2E(app: ElectronApplication): Promise<void> {
diff --git a/tests/e2e/helpers/orca-restart.ts b/tests/e2e/helpers/orca-restart.ts
index 2560fde154d..8be4adb79f8 100644
--- a/tests/e2e/helpers/orca-restart.ts
+++ b/tests/e2e/helpers/orca-restart.ts
@@ -20,6 +20,7 @@ import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:
 import { createServer } from 'node:net'
 import os from 'node:os'
 import path from 'node:path'
+import { runProcess, type ProcessResult } from '../../../src/shared/child-process/run-process'
 import { getE2ECompletedOnboardingProfile } from './e2e-completed-onboarding-profile'
 import { getOrcaElectronLaunchArgs } from './electron-launch-args'
 import { retryTransientMainEvaluate } from './electron-main-evaluate-retry'
@@ -51,6 +52,7 @@ type RestartSession = {
   userDataDir: string
   seedCodexResumeRollout: (sessionId: string, cwd: string) => string
   launch: (options?: LaunchOptions) => Promise<LaunchedOrca>
+  launchUntilExit: (executablePath: string) => Promise<ProcessResult>
   /** Gracefully close a launch, letting beforeunload flush session state. */
   close: (app: ElectronApplication) => Promise<void>
   /** Remove the shared userDataDir after the test is done. */
@@ -190,23 +192,45 @@ export function createRestartSession(
     }
     try {
       const resolvedHome = await retryTransientMainEvaluate(() =>
-        app.evaluate(({ app }) => app.getPath('home'))
+        app.evaluate(({ app }) => {
+          // This fixture owns every launch; native relaunch leaves an unattached Playwright child.
+          app.relaunch = () => {}
+          return app.getPath('home')
+        })
       )
       assertElectronResolvedIsolatedHome(resolvedHome, homeIsolation)
+      const page = await app.firstWindow({ timeout: 120_000 })
+      await page.waitForLoadState('domcontentloaded')
+      await page.waitForFunction(() => Boolean(window.__store), null, { timeout: 30_000 })
+      return { app, page }
     } catch (error) {
       await closeElectronAppForE2E(app)
       throw error
     }
-    const page = await app.firstWindow({ timeout: 120_000 })
-    await page.waitForLoadState('domcontentloaded')
-    await page.waitForFunction(() => Boolean(window.__store), null, { timeout: 30_000 })
-    return { app, page }
   }
 
   const close = async (app: ElectronApplication): Promise<void> => {
     await closeElectronAppForE2E(app)
   }
 
+  // Startup refusals exit before a renderer exists; capture their output from process creation.
+  const launchUntilExit = async (executablePath: string): Promise<ProcessResult> => {
+    runtimeWsPort ??= await reserveRestartRuntimeWsPort()
+    return runProcess({
+      program: executablePath,
+      args: getOrcaElectronLaunchArgs(mainPath, false),
+      env: {
+        ...homeIsolation.env,
+        ORCA_BACKGROUND_LAUNCH: '1',
+        ORCA_E2E_HEADLESS: '1',
+        ORCA_E2E_RUNTIME_WS_PORT: String(runtimeWsPort)
+      },
+      timeoutMs: 30_000,
+      detached: process.platform !== 'win32',
+      terminationBarrier: true
+    })
+  }
+
   const dispose = async (): Promise<void> => {
     await cleanupE2EDaemons(userDataDir)
     if (process.env.ORCA_E2E_PRESERVE_RESTART_PROFILE === '1') {
@@ -218,7 +242,7 @@ export function createRestartSession(
     }
   }
 
-  return { userDataDir, seedCodexResumeRollout, launch, close, dispose }
+  return { userDataDir, seedCodexResumeRollout, launch, launchUntilExit, close, dispose }
 }
 
 /**
diff --git a/tests/e2e/helpers/pdf-find-fixture.ts b/tests/e2e/helpers/pdf-find-fixture.ts
new file mode 100644
index 00000000000..fb7d90d6292
--- /dev/null
+++ b/tests/e2e/helpers/pdf-find-fixture.ts
@@ -0,0 +1,35 @@
+export function createPdfFindFixture(): Buffer {
+  const objects = [
+    '<< /Type /Catalog /Pages 2 0 R >>',
+    '<< /Type /Pages /Kids [4 0 R 6 0 R 8 0 R] /Count 3 >>',
+    '<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>'
+  ]
+  for (let page = 0; page < 3; page += 1) {
+    const contentId = 5 + page * 2
+    objects.push(
+      `<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Resources << /Font << /F1 3 0 R >> >> /Contents ${contentId} 0 R >>`
+    )
+    const lines = [
+      `PDF search fixture - page ${page + 1}`,
+      `needle result ${page * 2 + 1}`,
+      `needle result ${page * 2 + 2}`,
+      page === 1 ? 'Plain text without the alternate query' : 'beacon alternate query'
+    ]
+    const stream = `BT /F1 20 Tf 60 700 Td 40 TL ${lines.map((line) => `(${line}) Tj T*`).join(' ')} ET\n`
+    objects.push(`<< /Length ${Buffer.byteLength(stream)} >>\nstream\n${stream}endstream`)
+  }
+  let pdf = '%PDF-1.4\n'
+  const offsets = [0]
+  for (const [index, object] of objects.entries()) {
+    offsets.push(Buffer.byteLength(pdf))
+    pdf += `${index + 1} 0 obj\n${object}\nendobj\n`
+  }
+  const xref = Buffer.byteLength(pdf)
+  pdf += `xref\n0 ${objects.length + 1}\n0000000000 65535 f \n`
+  pdf += offsets
+    .slice(1)
+    .map((offset) => `${String(offset).padStart(10, '0')} 00000 n \n`)
+    .join('')
+  pdf += `trailer\n<< /Size ${objects.length + 1} /Root 1 0 R >>\nstartxref\n${xref}\n%%EOF\n`
+  return Buffer.from(pdf)
+}
diff --git a/tests/e2e/helpers/persisted-profile-state.ts b/tests/e2e/helpers/persisted-profile-state.ts
new file mode 100644
index 00000000000..02e00a89873
--- /dev/null
+++ b/tests/e2e/helpers/persisted-profile-state.ts
@@ -0,0 +1,60 @@
+import { join } from 'node:path'
+import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../../src/shared/orca-profiles'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission
+} from '../../../src/main/persistence/profile-state/profile-state-access'
+import { openProfileStateDatabaseReadOnly } from '../../../src/main/persistence/profile-state/profile-state-database'
+import { readProfileStateParsedSnapshot } from '../../../src/main/persistence/profile-state/profile-state-documents'
+import { parseProfileStateRoot } from '../../../src/main/persistence/profile-state/profile-state-document-validation'
+import { ProfileStateSqliteAuthority } from '../../../src/main/persistence/profile-state/profile-state-sqlite-authority'
+
+/** Read committed storage without consulting a retained migration JSON snapshot. */
+export function readPersistedProfileState(
+  userDataDir: string,
+  profileId = DEFAULT_LOCAL_ORCA_PROFILE_ID
+): Record<string, unknown> {
+  const admission = acquireProfileStateRuntimeAdmission(userDataDir)
+  try {
+    const opened = openProfileStateDatabaseReadOnly(
+      join(userDataDir, 'profiles', profileId, 'profile-state.db'),
+      profileId
+    )
+    try {
+      return readProfileStateParsedSnapshot(opened.db).state
+    } finally {
+      opened.db.close()
+    }
+  } finally {
+    admission.release()
+  }
+}
+
+/** Seed restart artifacts only while no runtime or other fixture writer owns the profile. */
+export function mutateStoppedProfileState<T>(
+  userDataDir: string,
+  mutate: (state: Record<string, unknown>) => T,
+  profileId = DEFAULT_LOCAL_ORCA_PROFILE_ID
+): T {
+  const maintenance = acquireProfileStateMaintenance(userDataDir)
+  const authority = new ProfileStateSqliteAuthority(
+    join(userDataDir, 'profiles', profileId, 'profile-state.db'),
+    profileId
+  )
+  try {
+    const serialized = authority.readSerializedState()
+    if (serialized === undefined) {
+      throw new Error('Expected an established profile before seeding restart state')
+    }
+    const state = parseProfileStateRoot(serialized)
+    const result = mutate(state)
+    authority.writeSerializedState(Buffer.from(JSON.stringify(state)))
+    return result
+  } finally {
+    try {
+      authority.close()
+    } finally {
+      maintenance.release()
+    }
+  }
+}
diff --git a/tests/e2e/helpers/persisted-profile-state.unit.test.ts b/tests/e2e/helpers/persisted-profile-state.unit.test.ts
new file mode 100644
index 00000000000..50588174d27
--- /dev/null
+++ b/tests/e2e/helpers/persisted-profile-state.unit.test.ts
@@ -0,0 +1,71 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, expect, it } from 'vitest'
+import { openProfileStateDatabase } from '../../../src/main/persistence/profile-state/profile-state-database'
+import { importProfileStateJson } from '../../../src/main/persistence/profile-state/profile-state-documents'
+import { acquireProfileStateRuntimeAdmission } from '../../../src/main/persistence/profile-state/profile-state-access'
+import { mutateStoppedProfileState, readPersistedProfileState } from './persisted-profile-state'
+
+const roots: string[] = []
+afterEach(() => {
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), 'orca-persisted-test-state-'))
+  roots.push(root)
+  const directory = join(root, 'profiles', 'local-default')
+  mkdirSync(directory, { recursive: true })
+  const databaseFile = join(directory, 'profile-state.db')
+  const dataFile = join(directory, 'orca-data.json')
+  const state = { settings: { sealed: 'ciphertext' }, unknown: { kept: null, output: '\ud800' } }
+  const opened = openProfileStateDatabase(databaseFile, 'local-default')
+  try {
+    importProfileStateJson(opened.db, JSON.stringify(state))
+  } finally {
+    opened.db.close()
+  }
+  writeFileSync(dataFile, '{"retained":"old migration snapshot"}')
+  return { root, databaseFile, dataFile, state }
+}
+
+it('reads committed SQLite and changes stopped fixtures without rewriting retained JSON', () => {
+  const item = fixture()
+  const before = readFileSync(item.dataFile)
+  expect(readPersistedProfileState(item.root)).toEqual(item.state)
+  const result = mutateStoppedProfileState(item.root, (state) => {
+    expect(() => acquireProfileStateRuntimeAdmission(item.root)).toThrow()
+    state.fixture = { changed: true }
+    return 'complete'
+  })
+  expect(result).toBe('complete')
+  expect(readPersistedProfileState(item.root)).toEqual({
+    ...item.state,
+    fixture: { changed: true }
+  })
+  expect(readFileSync(item.dataFile)).toEqual(before)
+})
+
+it('refuses a fixture write while a runtime is admitted and releases the refused owner', () => {
+  const item = fixture()
+  const runtime = acquireProfileStateRuntimeAdmission(item.root)
+  try {
+    expect(() => mutateStoppedProfileState(item.root, () => {})).toThrow()
+    expect(readPersistedProfileState(item.root)).toEqual(item.state)
+  } finally {
+    runtime.release()
+  }
+  expect(() => mutateStoppedProfileState(item.root, () => {})).not.toThrow()
+})
+
+it('does not create missing authority when a test points at the wrong profile', () => {
+  const item = fixture()
+  rmSync(item.databaseFile)
+  expect(() => mutateStoppedProfileState(item.root, () => {})).toThrow()
+  expect(existsSync(item.databaseFile)).toBe(false)
+  const runtime = acquireProfileStateRuntimeAdmission(item.root)
+  runtime.release()
+})
diff --git a/tests/e2e/helpers/ssh-reconnect-failure-observation.ts b/tests/e2e/helpers/ssh-reconnect-failure-observation.ts
new file mode 100644
index 00000000000..4a1dd4f9d58
--- /dev/null
+++ b/tests/e2e/helpers/ssh-reconnect-failure-observation.ts
@@ -0,0 +1,120 @@
+import type { Page, TestInfo } from '@stablyai/playwright-test'
+import {
+  execDockerSshRelayTargetControlCommand,
+  type DockerSshRelayTarget
+} from './docker-ssh-relay-target'
+import { getTerminalContent, readPaneIdentitySnapshot } from './terminal-pane-identity'
+
+export async function attachSshReconnectFailureObservation(
+  page: Page,
+  testInfo: TestInfo,
+  target: DockerSshRelayTarget | null,
+  targetId: string | null,
+  originalPtyId: string | null
+): Promise<void> {
+  const observations: Record<string, unknown> = { originalPtyId, targetId }
+  const observe = async (name: string, read: () => unknown): Promise<void> => {
+    let timer: ReturnType<typeof setTimeout> | undefined
+    try {
+      observations[name] = await Promise.race([
+        Promise.resolve().then(read),
+        new Promise((_, reject) => {
+          timer = setTimeout(() => reject(new Error('Observation timed out')), 5_000)
+        })
+      ])
+    } catch (error) {
+      observations[name] = { error: String(error) }
+    } finally {
+      clearTimeout(timer)
+    }
+  }
+  await Promise.all([
+    observe('paneIdentity', () => readPaneIdentitySnapshot(page)),
+    observe('renderedContent', () => getTerminalContent(page, 8000)),
+    observe('renderer', () =>
+      page.evaluate((targetId) => {
+        const state = window.__store?.getState()
+        const worktreeId = state?.activeWorktreeId
+        return {
+          authority: targetId ? state?.sshConnectionStates.get(targetId) : null,
+          worktreeId,
+          activeTabId: state?.activeTabId,
+          tabs: worktreeId
+            ? state?.tabsByWorktree[worktreeId]?.map(({ id, title }) => ({ id, title }))
+            : null,
+          panes: [...(window.__paneManagers?.entries() ?? [])].map(([tabId, manager]) => ({
+            tabId,
+            diagnostics: manager.getRenderingDiagnostics()
+          }))
+        }
+      }, targetId)
+    ),
+    observe('pty', () =>
+      page.evaluate(async (originalPtyId) => {
+        const ids = new Set<string>(originalPtyId ? [originalPtyId] : [])
+        for (const manager of window.__paneManagers?.values() ?? []) {
+          for (const pane of manager.getPanes()) {
+            const id = pane.container.dataset.ptyId
+            if (id) {
+              ids.add(id)
+            }
+          }
+        }
+        const read = async (request: Promise<unknown>): Promise<unknown> => {
+          let timer: ReturnType<typeof setTimeout> | undefined
+          try {
+            return await Promise.race([
+              request,
+              new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error('PTY observation timed out')), 3_000)
+              })
+            ])
+          } catch (error) {
+            return { error: String(error) }
+          } finally {
+            clearTimeout(timer)
+          }
+        }
+        const [delivery, processes] = await Promise.all([
+          read(window.api.pty.getRendererDeliveryDebugSnapshot()),
+          Promise.all(
+            [...ids].map(async (id) => {
+              const [process, buffer] = await Promise.all([
+                read(window.api.pty.inspectProcess(id, { scanChildProcesses: true })),
+                read(
+                  window.api.pty.getMainBufferSnapshot(id, { scrollbackRows: 40 }).then((buffer) =>
+                    buffer
+                      ? {
+                          source: buffer.source,
+                          seq: buffer.seq,
+                          alternateScreen: buffer.alternateScreen,
+                          cols: buffer.cols,
+                          rows: buffer.rows,
+                          data: buffer.data.slice(-8000),
+                          scrollbackAnsi: buffer.scrollbackAnsi?.slice(-8000)
+                        }
+                      : null
+                  )
+                )
+              ])
+              return { id, process, buffer }
+            })
+          )
+        ])
+        return { delivery, processes }
+      }, originalPtyId)
+    )
+  ])
+  if (target) {
+    await observe('remoteProcesses', () =>
+      execDockerSshRelayTargetControlCommand(
+        target,
+        'ps -eo pid,ppid,pgid,sid,tpgid,stat,comm,args'
+      )
+    )
+  }
+  await testInfo.attach('ssh-reconnect-failure.json', {
+    body: JSON.stringify(observations, null, 2),
+    contentType: 'application/json'
+  })
+}
diff --git a/tests/e2e/helpers/terminal-kitty-keyboard.ts b/tests/e2e/helpers/terminal-kitty-keyboard.ts
new file mode 100644
index 00000000000..61b298a4c3e
--- /dev/null
+++ b/tests/e2e/helpers/terminal-kitty-keyboard.ts
@@ -0,0 +1,122 @@
+import type { ElectronApplication, Page } from '@stablyai/playwright-test'
+import { expect } from './orca-app'
+import { execInTerminal, focusActiveTerminalInput } from './terminal'
+import { clearTerminalPtyWriteLog, readTerminalPtyWrites } from './terminal-pty-write-spy'
+
+async function dispatchCtrlCToActiveTerminalTextarea(
+  page: Page,
+  options: { keyupCtrlKey?: boolean } = {}
+): Promise<{
+  keydownDefaultPrevented: boolean
+  keyupDefaultPrevented: boolean
+}> {
+  return page.evaluate((dispatchOptions) => {
+    const state = window.__store?.getState()
+    const worktreeId = state?.activeWorktreeId
+    const tabId =
+      state?.activeTabType === 'terminal'
+        ? state.activeTabId
+        : worktreeId
+          ? (state?.activeTabIdByWorktree?.[worktreeId] ?? null)
+          : null
+    const manager = tabId ? window.__paneManagers?.get(tabId) : null
+    const pane = manager?.getActivePane?.() ?? manager?.getPanes?.()[0] ?? null
+    const textarea = pane?.container.querySelector(
+      '.xterm-helper-textarea'
+    ) as HTMLTextAreaElement | null
+    if (!pane || !textarea) {
+      throw new Error('No active terminal textarea for Ctrl+C dispatch')
+    }
+    pane.terminal.clearSelection()
+    pane.terminal.focus()
+    textarea.focus()
+
+    const createEvent = (type: 'keydown' | 'keyup', ctrlKey: boolean): KeyboardEvent => {
+      const event = new KeyboardEvent(type, {
+        key: 'c',
+        code: 'KeyC',
+        ctrlKey,
+        bubbles: true,
+        cancelable: true
+      })
+      Object.defineProperty(event, 'keyCode', { get: () => 67 })
+      Object.defineProperty(event, 'which', { get: () => 67 })
+      return event
+    }
+
+    // Why: Electron headless consumes real Ctrl+C before xterm in automation;
+    // synthetic DOM events still exercise Orca's installed xterm boundary.
+    const keydown = createEvent('keydown', true)
+    textarea.dispatchEvent(keydown)
+    const keyup = createEvent('keyup', dispatchOptions.keyupCtrlKey !== false)
+    textarea.dispatchEvent(keyup)
+    return {
+      keydownDefaultPrevented: keydown.defaultPrevented,
+      keyupDefaultPrevented: keyup.defaultPrevented
+    }
+  }, options)
+}
+
+export async function getKittyKeyboardFlags(page: Page): Promise<number | null> {
+  return page.evaluate(() => {
+    const state = window.__store?.getState()
+    const worktreeId = state?.activeWorktreeId
+    const tabId =
+      state?.activeTabType === 'terminal'
+        ? state.activeTabId
+        : worktreeId
+          ? (state?.activeTabIdByWorktree?.[worktreeId] ?? null)
+          : null
+    const manager = tabId ? window.__paneManagers?.get(tabId) : null
+    const pane = manager?.getActivePane?.() ?? manager?.getPanes?.()[0] ?? null
+    const terminal = pane?.terminal as
+      | {
+          core?: { coreService?: { kittyKeyboard?: { flags?: number } } }
+          _core?: { coreService?: { kittyKeyboard?: { flags?: number } } }
+        }
+      | undefined
+    return (
+      terminal?.core?.coreService?.kittyKeyboard?.flags ??
+      terminal?._core?.coreService?.kittyKeyboard?.flags ??
+      null
+    )
+  })
+}
+
+// Why arm from the PTY: the mirror the shortcut policy reads only sees application output.
+export async function armKittyKeyboardFromPty(
+  page: Page,
+  ptyId: string,
+  command: string
+): Promise<void> {
+  await execInTerminal(page, ptyId, command)
+  await expect
+    .poll(async () => await getKittyKeyboardFlags(page), {
+      timeout: 15_000,
+      message: 'the application never armed kitty keyboard reporting'
+    })
+    .toBe(31)
+}
+
+export async function interruptAndExpectEtx(page: Page, app: ElectronApplication): Promise<void> {
+  await clearTerminalPtyWriteLog(app)
+  await focusActiveTerminalInput(page)
+  await page.keyboard.down('Control')
+  await page.keyboard.up('Control')
+  expect((await readTerminalPtyWrites(app)).join('')).toBe('')
+  await clearTerminalPtyWriteLog(app)
+
+  expect(await dispatchCtrlCToActiveTerminalTextarea(page, { keyupCtrlKey: false })).toEqual({
+    keydownDefaultPrevented: false,
+    keyupDefaultPrevented: false
+  })
+  await expect
+    .poll(async () => (await readTerminalPtyWrites(app)).some((write) => write.includes('\x03')), {
+      timeout: 5_000,
+      message: 'Ctrl+C did not reach the PTY as ETX'
+    })
+    .toBe(true)
+  const writes = (await readTerminalPtyWrites(app)).join('')
+  expect(writes).not.toContain('\x1b[99;5u')
+  expect(writes).not.toContain('\x1b[99')
+}
diff --git a/tests/e2e/helpers/terminal-restart-persistence.ts b/tests/e2e/helpers/terminal-restart-persistence.ts
new file mode 100644
index 00000000000..46ba4efda9f
--- /dev/null
+++ b/tests/e2e/helpers/terminal-restart-persistence.ts
@@ -0,0 +1,186 @@
+import { readFileSync, existsSync } from 'node:fs'
+import type { ElectronApplication, Page } from '@stablyai/playwright-test'
+import { test, expect } from './orca-app'
+import { TEST_REPO_PATH_FILE } from '../global-setup'
+import { attachRepoAndOpenTerminal } from './orca-restart'
+import { discoverActivePtyId, waitForActiveTerminalManager, waitForPaneCount } from './terminal'
+import {
+  waitForSessionReady,
+  waitForActiveWorktree,
+  getActiveWorktreeId,
+  getActiveTabId,
+  ensureTerminalVisible
+} from './store'
+
+const REQUIRE_WINDOWS_TERMINAL_RESTART_E2E =
+  process.env.ORCA_REQUIRE_WINDOWS_TERMINAL_RESTART_E2E === '1'
+const MISSING_SEEDED_REPO_MESSAGE = 'Global setup did not produce a seeded test repo'
+
+export function seededRepoPathOrSkip(): string {
+  const repoPath = existsSync(TEST_REPO_PATH_FILE)
+    ? readFileSync(TEST_REPO_PATH_FILE, 'utf-8').trim()
+    : ''
+  const unavailable = !repoPath || !existsSync(repoPath)
+  if (unavailable && REQUIRE_WINDOWS_TERMINAL_RESTART_E2E) {
+    throw new Error('Required Windows restart E2E seeded repo is unavailable')
+  }
+  test.skip(unavailable, MISSING_SEEDED_REPO_MESSAGE)
+  return repoPath
+}
+
+/**
+ * Shared bootstrap for a *first* launch: attach the seeded test repo,
+ * activate its worktree, ensure a terminal is mounted, and return the
+ * PTY id we can drive with `execInTerminal`.
+ *
+ * Why: every test in this file needs the exact same starting state on the
+ * first launch. Inlining it would obscure the thing each test is actually
+ * asserting about the *second* launch.
+ */
+export async function bootstrapFirstLaunch(
+  page: Page,
+  repoPath: string
+): Promise<{ worktreeId: string; ptyId: string }> {
+  const worktreeId = await attachRepoAndOpenTerminal(page, repoPath)
+  await waitForSessionReady(page)
+  await waitForActiveWorktree(page)
+  await ensureTerminalVisible(page)
+
+  const hasPaneManager = await waitForActiveTerminalManager(page, 30_000)
+    .then(() => true)
+    .catch(() => false)
+  if (!hasPaneManager && REQUIRE_WINDOWS_TERMINAL_RESTART_E2E) {
+    throw new Error('Required Windows restart E2E TerminalPane manager did not mount')
+  }
+  test.skip(
+    !hasPaneManager,
+    'Electron automation in this environment never mounts the TerminalPane manager, so restart-persistence assertions would only fail on harness setup.'
+  )
+  await waitForPaneCount(page, 1, 30_000)
+
+  const ptyId = await discoverActivePtyId(page)
+  return { worktreeId, ptyId }
+}
+
+/**
+ * Shared bootstrap for a *second* launch: just wait for the session to
+ * restore, and confirm the previously-active worktree is the active one
+ * again so downstream assertions operate against the right worktree.
+ */
+export async function bootstrapRestoredLaunch(
+  page: Page,
+  expectedWorktreeId: string
+): Promise<void> {
+  await waitForSessionReady(page)
+  await expect
+    .poll(async () => getActiveWorktreeId(page), { timeout: 10_000 })
+    .toBe(expectedWorktreeId)
+  await ensureTerminalVisible(page)
+  // Why: the PaneManager remounts asynchronously after session hydration. The
+  // restored terminal surface is what we're about to assert against, so make
+  // sure it exists before any content/layout assertion races.
+  await waitForActiveTerminalManager(page, 30_000)
+  await waitForPaneCount(page, 1, 30_000)
+}
+
+export async function setPaneTitleFromTerminalMenu(page: Page, title: string): Promise<void> {
+  const modifiers: ('Alt' | 'Control' | 'Meta' | 'Shift')[] =
+    process.platform === 'win32' ? ['Control'] : []
+  await page
+    .locator('.xterm:visible')
+    .first()
+    .click({ button: 'right', position: { x: 40, y: 40 }, modifiers })
+  await page.getByText('Set Title…', { exact: true }).click()
+  const titleInput = page.locator('.pane-title-input').first()
+  await expect(titleInput).toBeVisible()
+  await titleInput.fill(title)
+  await titleInput.press('Enter')
+}
+
+export async function getTabCustomTitle(
+  page: Page,
+  worktreeId: string,
+  tabId: string
+): Promise<string | null> {
+  return page.evaluate(
+    ({ targetWorktreeId, targetTabId }) => {
+      const state = window.__store!.getState()
+      const tab = (state.tabsByWorktree[targetWorktreeId] ?? []).find(
+        (entry) => entry.id === targetTabId
+      )
+      return tab?.customTitle ?? null
+    },
+    { targetWorktreeId: worktreeId, targetTabId: tabId }
+  )
+}
+
+export async function readTerminalActiveLine(page: Page): Promise<string | null> {
+  const tabId = await getActiveTabId(page)
+  if (!tabId) {
+    return null
+  }
+  return page.evaluate((tabId) => {
+    const manager = window.__paneManagers?.get(tabId)
+    const pane = manager?.getActivePane?.() ?? manager?.getPanes?.()[0] ?? null
+    const buffer = pane?.terminal?.buffer.active
+    if (!buffer) {
+      return null
+    }
+    const cursorLine = buffer.baseY + buffer.cursorY
+    return buffer.getLine(cursorLine)?.translateToString(true) ?? null
+  }, tabId)
+}
+
+export async function waitForTerminalActiveLine(page: Page, expectedText: string): Promise<string> {
+  await expect
+    .poll(async () => (await readTerminalActiveLine(page))?.includes(expectedText), {
+      timeout: 15_000,
+      message: `Terminal cursor line did not contain "${expectedText}"`
+    })
+    .toBe(true)
+
+  const activeLine = await readTerminalActiveLine(page)
+  if (activeLine === null) {
+    throw new Error('Terminal cursor line disappeared after settling')
+  }
+  return activeLine
+}
+
+export async function waitForElectronProcessExit(app: ElectronApplication): Promise<void> {
+  const process = app.process()
+  if (process.exitCode !== null || process.signalCode !== null) {
+    return
+  }
+  await new Promise<void>((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      process.off('exit', onExit)
+      reject(new Error('Electron profile-switch relaunch did not exit'))
+    }, 15_000)
+    const onExit = (): void => {
+      clearTimeout(timeout)
+      process.off('exit', onExit)
+      resolve()
+    }
+    process.once('exit', onExit)
+  })
+}
+
+export async function expectSavedLayoutToContainTitle(
+  page: Page,
+  tabId: string,
+  title: string
+): Promise<void> {
+  await expect
+    .poll(
+      () =>
+        page.evaluate(
+          ({ targetTabId, title }) => {
+            const layout = window.__store!.getState().terminalLayoutsByTabId[targetTabId]
+            return Object.values(layout?.titlesByLeafId ?? {}).includes(title)
+          },
+          { targetTabId: tabId, title }
+        ),
+      { timeout: 3_000 }
+    )
+    .toBe(true)
+}
diff --git a/tests/e2e/host-parked-pane-remote-viewer.spec.ts b/tests/e2e/host-parked-pane-remote-viewer.spec.ts
index 6846369f9de..f2f8dd7fb39 100644
--- a/tests/e2e/host-parked-pane-remote-viewer.spec.ts
+++ b/tests/e2e/host-parked-pane-remote-viewer.spec.ts
@@ -45,7 +45,7 @@ import {
   launchPairedElectronClient
 } from './helpers/paired-electron-client'
 import { focusActiveTerminalInput } from './helpers/terminal'
-import { waitForTabParked } from './helpers/terminal-hidden-parking'
+import { parkHiddenTabBehindDecoy } from './helpers/terminal-hidden-parking'
 
 const PARK_DELAY_MS = 30_000
 const PAINT_BUDGET_MS = 20_000
@@ -269,19 +269,6 @@ test('a cold-parked host pane keeps serving its paired remote viewer', async ({
 
     // 3. The host cold-parks the pane the client is watching. Nobody touches
     //    it on the host again.
-    // Two decoy tabs on the host: one to age the target, one to take the
-    // most-recently-hidden exemption. Sampled before and after the park lands
-    // so decoy churn cannot be mistaken for the park itself.
-    for (let i = 0; i < 2; i += 1) {
-      await orcaPage.evaluate((id) => {
-        const state = window.__store?.getState()
-        const tab = state?.createTab(id, undefined, undefined, { activate: true })
-        if (tab) {
-          state?.setActiveTab(tab.id)
-          state?.setActiveTabType('terminal', window.__store?.getState().activeWorktreeId ?? null)
-        }
-      }, worktreeId)
-    }
     const readClientState = async (): Promise<unknown> =>
       client.page.evaluate((id) => {
         const manager = window.__paneManagers?.get(id)
@@ -292,8 +279,10 @@ test('a cold-parked host pane keeps serving its paired remote viewer', async ({
           recoveryState: pane?.container?.dataset?.ptyRecoveryState ?? null
         }
       }, webTabId)
-    console.log(`[sta2854] decoys-created client=${JSON.stringify(await readClientState())}`)
-    await waitForTabParked(orcaPage, hostTabId, { parkDelayMs: PARK_DELAY_MS })
+    console.log(`[sta2854] before-park client=${JSON.stringify(await readClientState())}`)
+    await parkHiddenTabBehindDecoy(orcaPage, worktreeId, hostTabId, {
+      parkDelayMs: PARK_DELAY_MS
+    })
     console.log(`[sta2854] post-park client=${JSON.stringify(await readClientState())}`)
 
     // Direct probe: is the host-minted terminal handle still resolvable once
diff --git a/tests/e2e/local-ssh-browser-routing.spec.ts b/tests/e2e/local-ssh-browser-routing.spec.ts
index e2f5249c93c..427d6ebd6d1 100644
--- a/tests/e2e/local-ssh-browser-routing.spec.ts
+++ b/tests/e2e/local-ssh-browser-routing.spec.ts
@@ -6,6 +6,7 @@ import { waitForSessionReady } from './helpers/store'
 import {
   blockDockerSshRelayTargetTcpForwarding,
   cleanupDockerSshRelayTarget,
+  refuseDockerSshRelayTargetConnections,
   startDockerSshRelayTarget,
   type DockerSshRelayTarget
 } from './helpers/docker-ssh-relay-target'
@@ -88,6 +89,17 @@ async function readSshState(page: Page, targetId: string): Promise<SshState> {
   }, targetId)
 }
 
+/**
+ * The status the panes read. Main's `ssh:getState` drops a target's entry on disconnect and on a
+ * failed connect, so only the renderer store still holds a settled failure verdict.
+ */
+async function readRendererSshStatus(page: Page, targetId: string): Promise<string | null> {
+  return page.evaluate(
+    (targetId) => window.__store?.getState().sshConnectionStates.get(targetId)?.status ?? null,
+    targetId
+  )
+}
+
 /**
  * `ssh:connect` short-circuits for a still-live session, so an advancing generation here is proof
  * the `kill -9` actually landed rather than an artifact of asking for a reconnect.
@@ -570,6 +582,9 @@ test('holds the mount and offers a working local escape hatch when the SSH host
     const worktreeId = remote.worktreeId
 
     await installBrowserPaneMountCensus(orcaPage)
+    // Why: the workspace's terminal redials a disconnected host, and a redial that connects
+    // rightly recovers the route; only a host that stays unreachable can hold the card.
+    refuseDockerSshRelayTargetConnections(target)
     await orcaPage.evaluate(
       async (targetId) => window.api.ssh.disconnect({ targetId }),
       remote.targetId
@@ -620,6 +635,17 @@ test('holds the mount and offers a working local escape hatch when the SSH host
     ).toHaveCount(0)
 
     // (d) The escape hatch, proven by an origin only this device can reach.
+    await expect
+      .poll(() => readRendererSshStatus(orcaPage, remote.targetId), {
+        timeout: 180_000,
+        message: 'the redial of an unreachable host must settle as a failure, not an auth prompt'
+      })
+      .toMatch(/^(disconnected|error|reconnection-failed)$/)
+    await expect(strandedPane.getByText(SSH_UNAVAILABLE_TITLE)).toBeVisible()
+    expect(
+      (await readSshState(orcaPage, remote.targetId)).status,
+      'a host that reconnected would make this escape hatch vacuous'
+    ).not.toBe('connected')
     await strandedPane.getByRole('button', { name: BROWSE_LOCALLY_LABEL }).click()
     await expect
       .poll(
diff --git a/tests/e2e/markdown-callout-source-fidelity.spec.ts b/tests/e2e/markdown-callout-source-fidelity.spec.ts
new file mode 100644
index 00000000000..82fdf9c26ce
--- /dev/null
+++ b/tests/e2e/markdown-callout-source-fidelity.spec.ts
@@ -0,0 +1,95 @@
+import { readFileSync } from 'node:fs'
+import { test, expect } from './helpers/orca-app'
+import { waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+import {
+  cleanupMarkdownFixture,
+  closeActiveEditorTab,
+  createMarkdownFixture,
+  getActiveWorktreeContext,
+  openMarkdownFixture,
+  waitForRichMarkdownEditor
+} from './helpers/markdown-editor-fixture'
+
+const ARTICLE = [
+  '---',
+  'title: Turing-Test',
+  'draft: true',
+  '---',
+  '',
+  '# Der Turing-Test',
+  '',
+  'First paragraph with user_name_field and feature~2.',
+  '',
+  '> [!wissenswert] Das Original war ein Ratespiel',
+  '> In Turings Aufsatz heißt der Test "Imitation Game".',
+  '',
+  'Second paragraph with a literal * and an unmatched `.',
+  '',
+  '> [!zeitstrahl] 75 Jahre Imitation Game',
+  '> - 1950 · Alan Turing veröffentlicht seinen Aufsatz.',
+  '> - 1980 · John Searle widerspricht.',
+  '',
+  'Third paragraph to edit.',
+  '',
+  '> [!NOTE]',
+  '> Keep this callout unchanged.',
+  '',
+  '> [!selbsttest]',
+  '> - Was bedeutet Intelligenz?',
+  ''
+].join('\n')
+
+for (const large of [false, true]) {
+  test(`keeps callout source byte-for-byte across edits, save and reopen (${large ? 'large' : 'article'})`, async ({
+    orcaPage
+  }, testInfo) => {
+    await waitForSessionReady(orcaPage)
+    await waitForActiveWorktree(orcaPage)
+    const context = await getActiveWorktreeContext(orcaPage)
+    const source = ARTICLE + (large ? `\n${'Unchanged user_name prose. '.repeat(2_100)}\n` : '')
+    const filePath = await createMarkdownFixture(
+      context,
+      'callout-fidelity',
+      'article',
+      testInfo.workerIndex,
+      source
+    )
+    try {
+      await openMarkdownFixture(orcaPage, context, filePath)
+      const editor = await waitForRichMarkdownEditor(orcaPage)
+      await expect(editor).toContainText('[!wissenswert]')
+      let expected = source
+      for (const prefix of ['First paragraph', 'Second paragraph', 'Third paragraph']) {
+        const paragraph = editor.locator('p').filter({ hasText: prefix }).first()
+        await paragraph.click()
+        await paragraph.evaluate((element) => {
+          const range = document.createRange()
+          range.selectNodeContents(element)
+          range.collapse(true)
+          const selection = window.getSelection()!
+          selection.removeAllRanges()
+          selection.addRange(range)
+        })
+        await orcaPage.keyboard.insertText('Edited ')
+        expected = expected.replace(prefix, `Edited ${prefix}`)
+        await orcaPage.keyboard.press('ControlOrMeta+S')
+        await expect.poll(() => readFileSync(filePath, 'utf8')).toBe(expected)
+      }
+      await testInfo.attach('saved-source', { body: expected, contentType: 'text/markdown' })
+      await closeActiveEditorTab(orcaPage, filePath)
+      await openMarkdownFixture(orcaPage, context, filePath)
+      const reopened = await waitForRichMarkdownEditor(orcaPage)
+      await expect(reopened).toContainText('Edited First paragraph')
+      await expect(reopened).toContainText('Edited Third paragraph')
+      await expect(reopened.locator('blockquote')).toHaveCount(4)
+      await expect(reopened).toContainText('[!zeitstrahl]')
+      await testInfo.attach('reopened-article', {
+        body: await orcaPage.screenshot({ path: testInfo.outputPath('reopened-article.png') }),
+        contentType: 'image/png'
+      })
+      expect(readFileSync(filePath, 'utf8')).toBe(expected)
+    } finally {
+      await cleanupMarkdownFixture(filePath)
+    }
+  })
+}
diff --git a/tests/e2e/native-chat-history-prepend-anchor.spec.ts b/tests/e2e/native-chat-history-prepend-anchor.spec.ts
index d299cadae6e..236d30c4475 100644
--- a/tests/e2e/native-chat-history-prepend-anchor.spec.ts
+++ b/tests/e2e/native-chat-history-prepend-anchor.spec.ts
@@ -138,6 +138,13 @@ test.describe('Native chat transcript anchoring', () => {
         sessionId,
         transcriptPath
       })
+      // Exercise the supported manual paging fallback while the reader stays mid-transcript.
+      await orcaPage.evaluate(() => {
+        Object.defineProperty(window, 'IntersectionObserver', {
+          value: undefined,
+          configurable: true
+        })
+      })
       await toggleTerminalTabToChatView(orcaPage, {
         tabId,
         worktreeId: descriptor.worktreeId
diff --git a/tests/e2e/native-chat-message-rail.spec.ts b/tests/e2e/native-chat-message-rail.spec.ts
index 25ca0a4745b..16d01060224 100644
--- a/tests/e2e/native-chat-message-rail.spec.ts
+++ b/tests/e2e/native-chat-message-rail.spec.ts
@@ -143,7 +143,7 @@ test.describe('Native chat message rail', () => {
 
     // Activating the hover preview transfers focus into the prompt picker.
     await rail.press('Enter')
-    await expect(panel.getByRole('button').first()).toBeFocused()
+    await expect(panel.locator('button[data-current="true"]')).toBeFocused()
     await panel.getByRole('button', { name: 'Question 5:', exact: false }).click()
     await expect(panel).not.toBeVisible()
     const target = transcriptWindow.locator('[data-index="10"]')
diff --git a/tests/e2e/onboarding.spec.ts b/tests/e2e/onboarding.spec.ts
index 2852ad43c07..826503ebcf4 100644
--- a/tests/e2e/onboarding.spec.ts
+++ b/tests/e2e/onboarding.spec.ts
@@ -12,7 +12,7 @@ import { waitForSessionReady } from './helpers/store'
 import type { Page } from '@stablyai/playwright-test'
 import type { GlobalSettings } from '../../src/shared/global-settings-types'
 import type { TuiAgent } from '../../src/shared/tui-agent'
-import { ONBOARDING_FINAL_STEP } from '../../src/shared/constants'
+import { ONBOARDING_FINAL_STEP } from '../../src/shared/onboarding-defaults'
 import { encodePairingOffer, PAIRING_OFFER_VERSION } from '../../src/shared/pairing'
 
 type OnboardingState = {
diff --git a/tests/e2e/orchestration-legacy-worker-missing-terminal-recovery.spec.ts b/tests/e2e/orchestration-legacy-worker-missing-terminal-recovery.spec.ts
index 73527afa50d..28d8f5565df 100644
--- a/tests/e2e/orchestration-legacy-worker-missing-terminal-recovery.spec.ts
+++ b/tests/e2e/orchestration-legacy-worker-missing-terminal-recovery.spec.ts
@@ -1,3 +1,4 @@
+import { readPersistedProfileState } from './helpers/persisted-profile-state'
 import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -17,7 +18,6 @@ import { DaemonClient } from '../../src/main/daemon/client'
 import { getDaemonSocketPath, getDaemonTokenPath } from '../../src/main/daemon/daemon-spawner'
 import Database from '../../src/main/sqlite/sync-database'
 import { LEGACY_CONTRACT_VERSION } from '../../src/main/runtime/orchestration/db'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 import type { RuntimeTerminalListResult, RuntimeTerminalRead } from '../../src/shared/runtime-types'
 import {
   buildFakeAgentCommandOverride,
@@ -144,12 +144,9 @@ async function detachedDaemonSessionExists(userDataDir: string, ptyId: string):
   }
 }
 
-function persistedDataPath(userDataDir: string): string {
-  return path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID, 'orca-data.json')
-}
-
 function hasPersistedResumeRecord(userDataDir: string, paneKey: string): boolean {
-  const data = JSON.parse(readFileSync(persistedDataPath(userDataDir), 'utf8')) as {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+  const data = readPersistedProfileState(userDataDir) as {
     workspaceSession?: {
       sleepingAgentSessionsByPaneKey?: Record<string, { providerSession?: { id?: unknown } }>
     }
diff --git a/tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts b/tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts
index 68c508eca62..a7090c0fd92 100644
--- a/tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts
+++ b/tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts
@@ -1,3 +1,7 @@
+import {
+  readPersistedProfileState,
+  mutateStoppedProfileState
+} from './helpers/persisted-profile-state'
 import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -21,7 +25,6 @@ import {
   LEGACY_CONTRACT_VERSION,
   LEGACY_RUN_ID
 } from '../../src/main/runtime/orchestration/db'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 import type { RuntimeTerminalListResult, RuntimeTerminalRead } from '../../src/shared/runtime-types'
 import { listAllOrchestrationRuns } from './orchestration-run-pages'
 import {
@@ -231,12 +234,9 @@ function isProcessAlive(pid: number): boolean {
   }
 }
 
-function persistedDataPath(userDataDir: string): string {
-  return path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID, 'orca-data.json')
-}
-
 function readPersistedData(userDataDir: string): PersistedData {
-  return JSON.parse(readFileSync(persistedDataPath(userDataDir), 'utf8')) as PersistedData
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+  return readPersistedProfileState(userDataDir) as PersistedData
 }
 
 function hasPersistedResumeRecord(userDataDir: string, paneKey: string): boolean {
@@ -273,42 +273,44 @@ function stripLegacyWorkerRendererBinding(
     workerPaneKey: string
   }
 ): void {
-  const data = readPersistedData(userDataDir)
-  const session = data.workspaceSession
-  if (!session) {
-    throw new Error('Expected a persisted workspace session')
-  }
-  const sleeping = session.sleepingAgentSessionsByPaneKey?.[input.workerPaneKey]
-  if (sleeping?.providerSession?.id !== PROVIDER_SESSION_ID) {
-    throw new Error('Expected the legacy worker resume record before removing its tab binding')
-  }
-  session.tabsByWorktree = {
-    ...session.tabsByWorktree,
-    [input.worktreeId]: (session.tabsByWorktree?.[input.worktreeId] ?? []).filter(
-      (tab) => tab.id !== input.workerTabId
-    )
-  }
-  delete session.terminalLayoutsByTabId?.[input.workerTabId]
-  if (session.unifiedTabs?.[input.worktreeId]) {
-    session.unifiedTabs[input.worktreeId] = session.unifiedTabs[input.worktreeId].filter(
-      (tab) => tab.id !== input.workerTabId && tab.entityId !== input.workerTabId
-    )
-  }
-  for (const group of session.tabGroups?.[input.worktreeId] ?? []) {
-    group.tabOrder = group.tabOrder.filter((tabId) => tabId !== input.workerTabId)
-    group.recentTabIds = group.recentTabIds?.filter((tabId) => tabId !== input.workerTabId)
-    if (group.activeTabId === input.workerTabId) {
-      group.activeTabId = input.coordinatorTabId
+  return mutateStoppedProfileState(userDataDir, (state) => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+    const data = state as PersistedData
+    const session = data.workspaceSession
+    if (!session) {
+      throw new Error('Expected a persisted workspace session')
     }
-  }
-  session.activeTabId = input.coordinatorTabId
-  session.activeTabIdByWorktree = {
-    ...session.activeTabIdByWorktree,
-    [input.worktreeId]: input.coordinatorTabId
-  }
-  delete session.terminalPtyIncarnationsByPaneKey?.[input.workerPaneKey]
-  delete session.terminalSurfaceTombstonesByPaneKey?.[input.workerPaneKey]
-  writeFileSync(persistedDataPath(userDataDir), `${JSON.stringify(data, null, 2)}\n`, 'utf8')
+    const sleeping = session.sleepingAgentSessionsByPaneKey?.[input.workerPaneKey]
+    if (sleeping?.providerSession?.id !== PROVIDER_SESSION_ID) {
+      throw new Error('Expected the legacy worker resume record before removing its tab binding')
+    }
+    session.tabsByWorktree = {
+      ...session.tabsByWorktree,
+      [input.worktreeId]: (session.tabsByWorktree?.[input.worktreeId] ?? []).filter(
+        (tab) => tab.id !== input.workerTabId
+      )
+    }
+    delete session.terminalLayoutsByTabId?.[input.workerTabId]
+    if (session.unifiedTabs?.[input.worktreeId]) {
+      session.unifiedTabs[input.worktreeId] = session.unifiedTabs[input.worktreeId].filter(
+        (tab) => tab.id !== input.workerTabId && tab.entityId !== input.workerTabId
+      )
+    }
+    for (const group of session.tabGroups?.[input.worktreeId] ?? []) {
+      group.tabOrder = group.tabOrder.filter((tabId) => tabId !== input.workerTabId)
+      group.recentTabIds = group.recentTabIds?.filter((tabId) => tabId !== input.workerTabId)
+      if (group.activeTabId === input.workerTabId) {
+        group.activeTabId = input.coordinatorTabId
+      }
+    }
+    session.activeTabId = input.coordinatorTabId
+    session.activeTabIdByWorktree = {
+      ...session.activeTabIdByWorktree,
+      [input.worktreeId]: input.coordinatorTabId
+    }
+    delete session.terminalPtyIncarnationsByPaneKey?.[input.workerPaneKey]
+    delete session.terminalSurfaceTombstonesByPaneKey?.[input.workerPaneKey]
+  })
 }
 
 function assertDispatchRemainsCurrent(
diff --git a/tests/e2e/paired-client-hosted-browser-ghost-close.spec.ts b/tests/e2e/paired-client-hosted-browser-ghost-close.spec.ts
index b9cd2b35dc7..bc6514a3904 100644
--- a/tests/e2e/paired-client-hosted-browser-ghost-close.spec.ts
+++ b/tests/e2e/paired-client-hosted-browser-ghost-close.spec.ts
@@ -1,4 +1,5 @@
-import { readdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { readdirSync, existsSync } from 'node:fs'
+import { mutateStoppedProfileState } from './helpers/persisted-profile-state'
 import path from 'node:path'
 import { expect, test } from './helpers/orca-app'
 import { launchHeadlessPairedRuntimeHost } from './helpers/headless-paired-runtime-host'
@@ -35,61 +36,44 @@ const RECONNECT_GRACE_OVERSHOOT_MS = 20_000
  * nothing on the host answers for.
  */
 function forgetPersistedClientHostedPages(userDataDir: string): number {
-  return listOrcaDataFiles(userDataDir).reduce(
-    (total, dataFile) => total + forgetPersistedClientHostedPagesIn(dataFile),
-    0
-  )
-}
-
-/**
- * Every orca-data.json under a user-data dir.
- *
- * The live one is `profiles/<id>/orca-data.json`; the root file is only the harness's onboarding
- * seed, which the first boot migrates from. Reading the seed alone made the strip a no-op that
- * looked exactly like a runtime that had persisted nothing.
- */
-function listOrcaDataFiles(userDataDir: string): string[] {
   const profilesDir = path.join(userDataDir, 'profiles')
-  let profileFiles: string[] = []
-  try {
-    profileFiles = readdirSync(profilesDir, { withFileTypes: true })
-      .filter((entry) => entry.isDirectory())
-      .map((entry) => path.join(profilesDir, entry.name, 'orca-data.json'))
-  } catch {
-    // No profile directory yet; only the harness seed exists.
-  }
-  return [path.join(userDataDir, 'orca-data.json'), ...profileFiles].filter((file) => {
-    try {
-      readFileSync(file, 'utf8')
-      return true
-    } catch {
-      return false
-    }
-  })
-}
-
-function forgetPersistedClientHostedPagesIn(dataFile: string): number {
-  const state = JSON.parse(readFileSync(dataFile, 'utf8')) as {
-    workspaceSession?: { clientHostedBrowserPagesByWorktree?: Record<string, unknown[]> }
-    workspaceSessionsByHostId?: Record<
-      string,
-      { clientHostedBrowserPagesByWorktree?: Record<string, unknown[]> }
-    >
-  }
-  let forgotten = 0
-  for (const session of [
-    state.workspaceSession,
-    ...Object.values(state.workspaceSessionsByHostId ?? {})
-  ]) {
-    const rows = session?.clientHostedBrowserPagesByWorktree
-    if (!rows) {
-      continue
-    }
-    forgotten += Object.values(rows).reduce((total, list) => total + list.length, 0)
-    delete session.clientHostedBrowserPagesByWorktree
-  }
-  writeFileSync(dataFile, `${JSON.stringify(state, null, 2)}\n`)
-  return forgotten
+  return readdirSync(profilesDir, { withFileTypes: true })
+    .filter(
+      (entry) =>
+        entry.isDirectory() && existsSync(path.join(profilesDir, entry.name, 'profile-state.db'))
+    )
+    .reduce(
+      (total, entry) =>
+        total +
+        mutateStoppedProfileState(
+          userDataDir,
+          (raw) => {
+            // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+            const state = raw as {
+              workspaceSession?: { clientHostedBrowserPagesByWorktree?: Record<string, unknown[]> }
+              workspaceSessionsByHostId?: Record<
+                string,
+                { clientHostedBrowserPagesByWorktree?: Record<string, unknown[]> }
+              >
+            }
+            let forgotten = 0
+            for (const session of [
+              state.workspaceSession,
+              ...Object.values(state.workspaceSessionsByHostId ?? {})
+            ]) {
+              const rows = session?.clientHostedBrowserPagesByWorktree
+              if (!rows) {
+                continue
+              }
+              forgotten += Object.values(rows).reduce((count, list) => count + list.length, 0)
+              delete session.clientHostedBrowserPagesByWorktree
+            }
+            return forgotten
+          },
+          entry.name
+        ),
+      0
+    )
 }
 
 /**
diff --git a/tests/e2e/paired-client-hosted-browser-restart-survival.spec.ts b/tests/e2e/paired-client-hosted-browser-restart-survival.spec.ts
index 03eb0e0b18d..0f8e24ecd6e 100644
--- a/tests/e2e/paired-client-hosted-browser-restart-survival.spec.ts
+++ b/tests/e2e/paired-client-hosted-browser-restart-survival.spec.ts
@@ -112,24 +112,22 @@ test('keeps a client-hosted browser tab across a paired runtime restart', async
       })
       .toContain(opened.remotePageId)
 
-    await expect
-      .poll(() => findMirroredBrowserPage(client!.page, restartedWorktreeId, fixture.origin), {
-        timeout: 180_000,
-        message: 'the client lost its client-hosted row across the runtime restart'
-      })
-      .not.toBeNull()
+    let survivor: Awaited<ReturnType<typeof findMirroredBrowserPage>> = null
+    // Reconnection can replace the retained row between reads; wait for the whole contract.
+    await expect(async () => {
+      const rows = await readClientBrowserRows(client!.page, restartedWorktreeId)
+      const survivorRows = rows.filter((row) => row.url.startsWith(fixture.origin))
+      expect(survivorRows, 'the tab must survive the restart exactly once').toHaveLength(1)
 
-    // Counted across the whole fixture origin: a recovery that also replays the create URL leaves
-    // two rows, and matching only the moved one would call that a pass.
-    const rows = await readClientBrowserRows(client.page, restartedWorktreeId)
-    const survivorRows = rows.filter((row) => row.url.startsWith(fixture.origin))
-    expect(survivorRows, 'the tab must survive the restart exactly once').toHaveLength(1)
-
-    const survivor = await findMirroredBrowserPage(client.page, restartedWorktreeId, fixture.origin)
-    expect(survivor?.remotePageId, 'recovery must keep the page identity it was created with').toBe(
-      opened.remotePageId
-    )
-    expect(survivor?.placementKind, 'the surviving tab must still be client-hosted').toBe('client')
+      survivor = await findMirroredBrowserPage(client!.page, restartedWorktreeId, fixture.origin)
+      expect(
+        survivor?.remotePageId,
+        'recovery must keep the page identity it was created with'
+      ).toBe(opened.remotePageId)
+      expect(survivor?.placementKind, 'the surviving tab must still be client-hosted').toBe(
+        'client'
+      )
+    }).toPass({ timeout: 180_000 })
 
     await focusClientBrowserRow(client.page, restartedWorktreeId, survivor!.localPageId)
     expect(
@@ -140,6 +138,11 @@ test('keeps a client-hosted browser tab across a paired runtime restart', async
       ),
       'the tab must come back where the user left it, not on its create URL'
     ).toBe('moved-on')
+    const renderedRows = await readClientBrowserRows(client.page, restartedWorktreeId)
+    expect(
+      renderedRows.filter((row) => row.url.startsWith(fixture.origin)),
+      'rendering the recovered guest must leave exactly one surviving tab'
+    ).toHaveLength(1)
   } finally {
     if (client) {
       await cleanupE2EDaemons(client.userDataDir).catch(() => undefined)
diff --git a/tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts b/tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts
index fe045e3814a..7c413c06126 100644
--- a/tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts
+++ b/tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts
@@ -286,8 +286,16 @@ async function probeInteractivity(
     `LINE:${token}`,
     LIVE_PAINT_BUDGET_MS
   )
-  const paneGrid = await readActivePaneGrid(page, target.webTabId)
+  let paneGrid = await readActivePaneGrid(page, target.webTabId)
+  let ptyGrid = readPtyGridFromContent(readSink(target.sinkPath))
+  console.log(`[paired-grid-initial] ${JSON.stringify({ name, paneGrid, ptyGrid })}`)
   const diagnostics = await readPaneDiagnostics(page, worktreeId, target.webTabId)
+  const screenshotPath = test.info().outputPath(`paired-terminal-${name}.png`)
+  await page.screenshot({ path: screenshotPath })
+  await test.info().attach(`paired-terminal-${name}`, {
+    path: screenshotPath,
+    contentType: 'image/png'
+  })
   let paintedAfterFlip = paintedLive
   if (!paintedLive) {
     await openClientTab(page, worktreeId, flipTo.webTabId)
@@ -299,6 +307,31 @@ async function probeInteractivity(
       LIVE_PAINT_BUDGET_MS
     )
   }
+  // Preserve the scenario report even when geometry fails to converge.
+  await expect
+    .configure({ soft: true })
+    .poll(
+      async () => {
+        paneGrid = await readActivePaneGrid(page, target.webTabId)
+        ptyGrid = readPtyGridFromContent(readSink(target.sinkPath))
+        return {
+          paneGrid,
+          ptyGrid,
+          converged:
+            paneGrid !== null &&
+            ptyGrid !== null &&
+            paneGrid.cols > 0 &&
+            paneGrid.rows > 0 &&
+            paneGrid.cols === ptyGrid.cols &&
+            paneGrid.rows === ptyGrid.rows
+        }
+      },
+      {
+        timeout: REVEAL_BUDGET_MS,
+        message: `${name}: revealed pane and host PTY grids did not converge`
+      }
+    )
+    .toMatchObject({ converged: true })
   const sink = readSink(target.sinkPath)
   return {
     name,
@@ -307,7 +340,7 @@ async function probeInteractivity(
     paintedLive,
     paintedAfterFlip,
     paneGrid,
-    ptyGrid: readPtyGridFromContent(sink),
+    ptyGrid,
     diagnostics
   }
 }
diff --git a/tests/e2e/paired-remote-terminal-parked-scrollback-restart.spec.ts b/tests/e2e/paired-remote-terminal-parked-scrollback-restart.spec.ts
index 5d83bef49f4..608c31111af 100644
--- a/tests/e2e/paired-remote-terminal-parked-scrollback-restart.spec.ts
+++ b/tests/e2e/paired-remote-terminal-parked-scrollback-restart.spec.ts
@@ -21,18 +21,18 @@
  *     the remote host's partition never received the capture (#21295). This is the test that fails
  *     with the fix reverted.
  *
- * The on-disk reader walks the local `workspaceSession` AND every `workspaceSessionsByHostId`
+ * The SQLite reader walks the local `workspaceSession` AND every `workspaceSessionsByHostId`
  * partition, and names the partition each reading came from — the issue's original "onDisk: 0" was a
  * reader that inspected only the local blob while the capture sat in the runtime partition, a
- * reading that could not contradict itself. An empty list means no session file at all (a deleted
- * profile), distinguished from an empty buffer.
+ * reading that could not contradict itself. A missing database fails the read; an empty list means
+ * no session partitions were persisted, distinguished from an empty buffer.
  *
  * Run:
  *   pnpm exec playwright test \
  *     tests/e2e/paired-remote-terminal-parked-scrollback-restart.spec.ts \
  *     --config tests/playwright.config.ts --project electron-headless --workers=1
  */
-import { globSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { randomUUID } from 'node:crypto'
 import os from 'node:os'
 import path from 'node:path'
@@ -49,10 +49,12 @@ import {
   callEnvironment,
   createPairedHostTerminal,
   openPairedClientTab,
-  waitForPairedPaneMarker
+  waitForPairedPaneMarker,
+  type PairedHostTerminal
 } from './helpers/paired-host-terminal'
 import { focusActiveTerminalInput } from './helpers/terminal'
 import { waitForTabParked } from './helpers/terminal-hidden-parking'
+import { readPersistedProfileState } from './helpers/persisted-profile-state'
 
 const PARK_DELAY_MS = 2_000
 const PAINT_BUDGET_MS = 30_000
@@ -137,31 +139,21 @@ function stringRecord(value: unknown): Record<string, string> | undefined {
   )
 }
 
-/** Walks the local `workspaceSession` and every `workspaceSessionsByHostId` partition. An empty
- *  list means no session file was found at all — a reader problem, not an empty buffer. */
+/** Read committed session partitions without consulting the retained compatibility export. */
 function readOnDiskPartitions(userDataDir: string, webTabId: string): OnDiskPartitionReading[] {
+  const state = readPersistedProfileState(userDataDir)
   const readings: OnDiskPartitionReading[] = []
-  for (const file of globSync(path.join(userDataDir, '**', 'orca-data.json'))) {
-    try {
-      const parsed: unknown = JSON.parse(readFileSync(file, 'utf8'))
-      if (!isRecord(parsed)) {
-        continue
-      }
-      const local = readSessionPartition('local', parsed.workspaceSession, webTabId)
-      if (local) {
-        readings.push(local)
-      }
-      const partitions = isRecord(parsed.workspaceSessionsByHostId)
-        ? parsed.workspaceSessionsByHostId
-        : {}
-      for (const [hostId, session] of Object.entries(partitions)) {
-        const reading = readSessionPartition(hostId, session, webTabId)
-        if (reading) {
-          readings.push(reading)
-        }
-      }
-    } catch {
-      // A partially written profile is itself a datapoint; keep scanning the rest.
+  const local = readSessionPartition('local', state.workspaceSession, webTabId)
+  if (local) {
+    readings.push(local)
+  }
+  const partitions = isRecord(state.workspaceSessionsByHostId)
+    ? state.workspaceSessionsByHostId
+    : {}
+  for (const [hostId, session] of Object.entries(partitions)) {
+    const reading = readSessionPartition(hostId, session, webTabId)
+    if (reading) {
+      readings.push(reading)
     }
   }
   return readings
@@ -258,7 +250,7 @@ async function parkRemoteTerminalWithToken(
     fixtureCommand()
   )
   createdTerminals.push(target.terminal)
-  const decoys = []
+  const decoys: PairedHostTerminal[] = []
   for (let index = 0; index < 2; index += 1) {
     const decoy = await createPairedHostTerminal(
       client.page,
@@ -428,7 +420,7 @@ test.describe('host retains nothing', () => {
       expect({
         tokenBeforePark: parked.tokenBeforePark,
         capturedAtPark: parked.storeAtPark > 0,
-        // Distinguishes a deleted profile (no partitions) from an empty buffer.
+        // Distinguishes missing session partitions from an empty buffer.
         profileSurvived: onDiskAfterQuit.length > 0,
         runtimePartitionHoldsCapture: runtimePartitionBufferLength(onDiskAfterQuit) > 0,
         localPartitionDidNotKeepCapture: localPartitionBufferLength(onDiskAfterQuit) <= 0
diff --git a/tests/e2e/paired-remote-terminal-serve-restart-binding.spec.ts b/tests/e2e/paired-remote-terminal-serve-restart-binding.spec.ts
index b9d2242de22..7047f8a6dcb 100644
--- a/tests/e2e/paired-remote-terminal-serve-restart-binding.spec.ts
+++ b/tests/e2e/paired-remote-terminal-serve-restart-binding.spec.ts
@@ -8,11 +8,13 @@
  *     tests/e2e/paired-remote-terminal-serve-restart-binding.spec.ts \
  *     --config tests/playwright.config.ts --project electron-headless --workers=1
  */
-import { readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import type { ElectronApplication, Page } from '@stablyai/playwright-test'
 import { getHistorySessionDirName } from '../../src/main/daemon/history-paths'
 import { LOG_HEADER_BYTES } from '../../src/main/daemon/terminal-history-log'
+import { profileStateDatabaseFile } from '../../src/main/persistence/profile-state/profile-state-database'
+import { ProfileStateSqliteAuthority } from '../../src/main/persistence/profile-state/profile-state-sqlite-authority'
 import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 import type { RuntimeMobileSessionTabsResult } from '../../src/shared/runtime-types'
 import { toRemoteRuntimePtyId } from '../../src/shared/remote-runtime-pty-id'
@@ -87,6 +89,80 @@ test.afterAll(() => {
   rmSync(scratch, { recursive: true, force: true })
 })
 
+test('SQLite candidate retains a remote automation run across serve restart', async ({
+  testRepoPath
+}) => {
+  test.setTimeout(240_000)
+
+  const host = await launchHeadlessPairedRuntimeHost({ pinnedServePort: true })
+  try {
+    const added = await host.client.call<{ repo: { id: string } }>('repo.add', {
+      path: testRepoPath,
+      kind: 'git'
+    })
+    const automation = await host.client.call<{ automation: { id: string } }>('automation.create', {
+      agentId: 'codex',
+      name: `remote-sqlite-restart-${Date.now()}`,
+      prompt: 'Retain this remote automation run through a SQLite-only serve restart.',
+      repo: `id:${added.result.repo.id}`,
+      runContext: {
+        kind: 'workspace-run',
+        projectId: added.result.repo.id,
+        hostId: 'runtime:missing',
+        projectHostSetupId: `missing-${Date.now()}`,
+        repoId: added.result.repo.id,
+        path: testRepoPath
+      },
+      workspaceMode: 'new_per_run',
+      reuseSession: false,
+      timezone: 'UTC',
+      rrule: 'FREQ=DAILY;BYHOUR=9;BYMINUTE=0',
+      dtstart: Date.now(),
+      enabled: false,
+      missedRunGraceMinutes: 720
+    })
+    const run = await host.client.call<{ run: { id: string; status: string } }>(
+      'automation.runNow',
+      { id: automation.result.automation.id }
+    )
+    expect(['dispatching', 'dispatched']).toContain(run.result.run.status)
+
+    const beforeRestart = await host.client.call<{ runs: { id: string }[] }>('automation.runs', {
+      automationId: automation.result.automation.id
+    })
+    expect(beforeRestart.result.runs.some((entry) => entry.id === run.result.run.id)).toBe(true)
+
+    const profileDirectory = path.join(host.userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID)
+    const profileJsonPath = path.join(profileDirectory, 'orca-data.json')
+    const rootJsonPath = path.join(host.userDataDir, 'orca-data.json')
+    const databasePath = profileStateDatabaseFile(profileDirectory)
+    expect(existsSync(databasePath)).toBe(true)
+    await host.restartServeProcess({
+      betweenProcesses: () => {
+        rmSync(profileJsonPath, { force: true })
+        rmSync(rootJsonPath, { force: true })
+      }
+    })
+    expect(existsSync(profileJsonPath)).toBe(false)
+    expect(existsSync(rootJsonPath)).toBe(false)
+
+    const afterRestartDefinitions = await host.client.call<{
+      automations: { id: string }[]
+    }>('automation.list')
+    expect(
+      afterRestartDefinitions.result.automations.some(
+        (entry) => entry.id === automation.result.automation.id
+      )
+    ).toBe(true)
+    const afterRestart = await host.client.call<{ runs: { id: string }[] }>('automation.runs', {
+      automationId: automation.result.automation.id
+    })
+    expect(afterRestart.result.runs.some((entry) => entry.id === run.result.run.id)).toBe(true)
+  } finally {
+    await host.dispose()
+  }
+})
+
 type HostSurface = {
   leafId: string
   parentTabId: string
@@ -125,14 +201,35 @@ function removePersistedTerminalBinding(
   terminal: Pick<MirroredTerminal, 'leafId' | 'parentTabId' | 'ptyId'>
 ): void {
   const dataPath = persistedDataPath(userDataDir)
-  const data = JSON.parse(readFileSync(dataPath, 'utf8')) as PersistedData
-  const bindings =
-    data.workspaceSession?.terminalLayoutsByTabId?.[terminal.parentTabId]?.ptyIdsByLeafId
-  if (bindings?.[terminal.leafId] !== terminal.ptyId) {
-    throw new Error('Expected the live terminal binding before removing it from persisted state')
+  const authority = new ProfileStateSqliteAuthority(
+    profileStateDatabaseFile(path.dirname(dataPath)),
+    DEFAULT_LOCAL_ORCA_PROFILE_ID
+  )
+  try {
+    const serialized = authority.readSerializedState()
+    if (!serialized) {
+      throw new Error('Expected established SQLite state before removing terminal binding')
+    }
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the SQLite authority validates the complete storage snapshot before returning it.
+    const session = JSON.parse(serialized) as PersistedData
+    const layout = session.workspaceSession?.terminalLayoutsByTabId?.[terminal.parentTabId]
+    const bindings = layout?.ptyIdsByLeafId
+    if (!layout || !bindings || bindings[terminal.leafId] !== terminal.ptyId) {
+      throw new Error('Expected the live terminal binding before removing it from SQLite state')
+    }
+    const nextBindings = { ...bindings }
+    delete nextBindings[terminal.leafId]
+    session.workspaceSession = {
+      ...session.workspaceSession,
+      terminalLayoutsByTabId: {
+        ...session.workspaceSession?.terminalLayoutsByTabId,
+        [terminal.parentTabId]: { ...layout, ptyIdsByLeafId: nextBindings }
+      }
+    }
+    authority.writeSerializedState(Buffer.from(JSON.stringify(session)))
+  } finally {
+    authority.close?.()
   }
-  delete bindings[terminal.leafId]
-  writeFileSync(dataPath, `${JSON.stringify(data, null, 2)}\n`, 'utf8')
 }
 
 function readHistoryLogEvidence(outputLogPath: string, marker: string): HistoryLogEvidence {
diff --git a/tests/e2e/pdf-find-counter.spec.ts b/tests/e2e/pdf-find-counter.spec.ts
new file mode 100644
index 00000000000..7a8d4b13b04
--- /dev/null
+++ b/tests/e2e/pdf-find-counter.spec.ts
@@ -0,0 +1,168 @@
+import { writeFileSync, rmSync, mkdtempSync } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { expect, test } from './helpers/orca-app'
+import { createPdfFindFixture } from './helpers/pdf-find-fixture'
+import { pressShortcut } from './helpers/shortcuts'
+
+test('PDF counter follows navigation, new queries, and reopening', async ({
+  orcaPage,
+  electronApp,
+  seededRepoPath,
+  registerPostElectronShutdownCleanup
+}, testInfo) => {
+  const filePath = path.join(seededRepoPath, 'pdf-find-fixture.pdf')
+  writeFileSync(filePath, createPdfFindFixture())
+  registerPostElectronShutdownCleanup(async () => rmSync(filePath, { force: true }))
+  await orcaPage.evaluate((filePath) => {
+    const state = window.__store?.getState()
+    if (!state?.activeWorktreeId) {
+      throw new Error('Missing fixture worktree')
+    }
+    state.openFile({
+      filePath,
+      relativePath: 'pdf-find-fixture.pdf',
+      worktreeId: state.activeWorktreeId,
+      language: 'plaintext',
+      mode: 'edit'
+    })
+  }, filePath)
+  await expect(orcaPage.locator('.pdfViewer .page')).toHaveCount(3)
+  await expect(orcaPage.locator('.pdfViewer .page').first().locator('.textLayer')).toContainText(
+    'needle result 1'
+  )
+  await pressShortcut(orcaPage, 'f')
+  const input = orcaPage.getByPlaceholder('Find in page...')
+  const bar = input.locator('..')
+  const selected = orcaPage.locator('.pdfViewer .highlight.selected')
+  const observations: object[] = []
+  const capture = async (name: string, counter: string, selectedText?: string): Promise<void> => {
+    if (selectedText) {
+      await expect(selected).toHaveCount(1)
+      await expect(selected.locator('..')).toHaveText(selectedText)
+    }
+    await expect.soft(bar).toContainText(counter, { timeout: 1000 })
+    observations.push({
+      name,
+      expected: counter,
+      actual: await bar.innerText(),
+      selected: await selected.locator('..').allTextContents()
+    })
+    await orcaPage.screenshot({ path: testInfo.outputPath(`${name}.png`) })
+  }
+  await input.fill('needle')
+  await capture('initial', '1 of 6', 'needle result 1')
+  await bar.getByTitle('Next match', { exact: true }).click()
+  await capture('next', '2 of 6', 'needle result 2')
+  await input.press('Enter')
+  await capture('enter', '3 of 6', 'needle result 3')
+  await input.press('Shift+Enter')
+  await capture('shift-enter', '2 of 6', 'needle result 2')
+  await bar.getByTitle('Previous match', { exact: true }).click()
+  await capture('previous', '1 of 6', 'needle result 1')
+  await bar.getByTitle('Previous match', { exact: true }).click()
+  await capture('wrap-previous', '6 of 6', 'needle result 6')
+  await input.press('Enter')
+  await capture('wrap-next', '1 of 6', 'needle result 1')
+  await input.fill('beacon')
+  await capture('query-change', '1 of 2', 'beacon alternate query')
+  await input.fill('absentword')
+  await expect(selected).toHaveCount(0)
+  await capture('no-results', 'No matches')
+  await input.fill('needle')
+  await capture('query-restored', '1 of 6', 'needle result 1')
+  await input.fill('beacon')
+  await input.fill('absentword')
+  await input.fill('needle')
+  // The final query is unchanged; let PDF.js's 250ms debounce finish before stepping.
+  await orcaPage.waitForTimeout(350)
+  await capture('rapid-query', '1 of 6', 'needle result 1')
+  await bar.getByTitle('Next match', { exact: true }).click()
+  await capture('before-close', '2 of 6', 'needle result 2')
+  await input.press('Escape')
+  await expect(input).toHaveCount(0)
+  await expect(selected).toHaveCount(0)
+  await pressShortcut(orcaPage, 'f')
+  await capture('reopened', '1 of 6', 'needle result 1')
+  await input.press('Enter')
+  await capture('reopened-enter', '2 of 6', 'needle result 2')
+  const windows = await electronApp.evaluate(({ BrowserWindow, app }) => ({
+    appPath: app.getAppPath(),
+    windows: BrowserWindow.getAllWindows().map((window) => ({
+      visible: window.isVisible(),
+      focused: window.isFocused()
+    }))
+  }))
+  expect(windows.windows.every((window) => !window.focused)).toBe(true)
+  const headful =
+    process.env.ORCA_E2E_FORCE_HEADFUL === '1' || testInfo.project.metadata.orcaHeadful === true
+  if (process.env.ORCA_BACKGROUND_LAUNCH === '1' || !headful) {
+    expect(windows.windows.every((window) => !window.visible)).toBe(true)
+  }
+  writeFileSync(
+    testInfo.outputPath('observations.json'),
+    JSON.stringify({ windows, observations }, null, 2)
+  )
+})
+
+test.describe('PDF in a folder workspace', () => {
+  test.use({ seedTestRepo: false })
+
+  test('finds and navigates a PDF without a Git repository', async ({
+    orcaPage,
+    registerPostElectronShutdownCleanup
+  }, testInfo) => {
+    const folderPath = mkdtempSync(path.join(os.tmpdir(), 'orca-pdf-folder-'))
+    const filePath = path.join(folderPath, 'pdf-find-fixture.pdf')
+    writeFileSync(filePath, createPdfFindFixture())
+    registerPostElectronShutdownCleanup(async () =>
+      rmSync(folderPath, { recursive: true, force: true })
+    )
+    await orcaPage.evaluate(
+      async ({ folderPath, filePath }) => {
+        const state = window.__store?.getState()
+        if (!state) {
+          throw new Error('Missing fixture store')
+        }
+        const group = await window.api.projectGroups.create({
+          name: 'PDF fixture',
+          parentPath: folderPath,
+          createdFrom: 'folder-scan'
+        })
+        await state.fetchProjectGroups()
+        const folder = await state.createFolderWorkspace({
+          projectGroupId: group.id,
+          name: 'PDF documents',
+          folderPath
+        })
+        if (!folder) {
+          throw new Error('Missing fixture folder')
+        }
+        const worktreeId = `folder:${folder.id}`
+        state.setActiveWorktree(worktreeId)
+        state.openFile({
+          filePath,
+          relativePath: 'pdf-find-fixture.pdf',
+          worktreeId,
+          language: 'plaintext',
+          mode: 'edit'
+        })
+      },
+      { folderPath, filePath }
+    )
+    await expect(orcaPage.locator('.pdfViewer .page')).toHaveCount(3)
+    await expect(orcaPage.locator('.pdfViewer .page').first().locator('.textLayer')).toContainText(
+      'needle result 1'
+    )
+    await pressShortcut(orcaPage, 'f')
+    const input = orcaPage.getByPlaceholder('Find in page...')
+    await input.fill('needle')
+    await expect(input.locator('..')).toContainText('1 of 6')
+    const selected = orcaPage.locator('.pdfViewer .highlight.selected').locator('..')
+    await expect(selected).toHaveText('needle result 1')
+    await input.press('Enter')
+    await expect(input.locator('..')).toContainText('2 of 6')
+    await expect(selected).toHaveText('needle result 2')
+    await orcaPage.screenshot({ path: testInfo.outputPath('folder-next.png') })
+  })
+})
diff --git a/tests/e2e/persisted-session-production-upgrade.spec.ts b/tests/e2e/persisted-session-production-upgrade.spec.ts
index 3f63366b25f..cff20197a0e 100644
--- a/tests/e2e/persisted-session-production-upgrade.spec.ts
+++ b/tests/e2e/persisted-session-production-upgrade.spec.ts
@@ -1,12 +1,29 @@
-import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync, readdirSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
-import type { ElectronApplication, Page } from '@stablyai/playwright-test'
+import {
+  _electron as electron,
+  type ElectronApplication,
+  type Page,
+  type TestInfo
+} from '@stablyai/playwright-test'
 import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 import { PTY_SESSION_ID_SEPARATOR } from '../../src/shared/pty-session-id-format'
-import { test, expect } from './helpers/orca-app'
+import { forwardElectronProcessLogs, test, expect } from './helpers/orca-app'
 import { TEST_REPO_PATH_FILE } from './global-setup'
 import { attachRepoAndOpenTerminal, createRestartSession } from './helpers/orca-restart'
+import { cleanupE2EDaemons, closeElectronAppForE2E } from './helpers/electron-process-shutdown'
+import { getElectronIsolatedKeychainArgs } from './helpers/electron-launch-args'
+import {
+  areSameHomePath,
+  assertElectronResolvedIsolatedHome,
+  createElectronHomeIsolation
+} from './helpers/electron-home-isolation'
 import { ensureTerminalVisible, waitForSessionReady } from './helpers/store'
+import { openProfileStateDatabaseReadOnly } from '../../src/main/persistence/profile-state/profile-state-database'
+import { readProfileStateSnapshot } from '../../src/main/persistence/profile-state/profile-state-documents'
+import { ProfileStateSqliteAuthority } from '../../src/main/persistence/profile-state/profile-state-sqlite-authority'
+import { acquireProfileStateMaintenance } from '../../src/main/persistence/profile-state/profile-state-access'
+import { restoreProfileStateJsonExport } from '../../src/main/persistence/profile-state/legacy-json/profile-state-recovery'
 import {
   discoverActivePtyId,
   execInTerminal,
@@ -26,6 +43,7 @@ const FIXTURE_PATH = path.join(
 )
 // This fixture captures a legacy production schema boundary; the test runs the current build.
 const RESTORED_TITLE = 'Production agent session'
+const PACKAGED_OLD_EXECUTABLE_ENV = 'ORCA_PROFILE_STATE_PACKAGED_OLD_EXECUTABLE'
 
 type FixtureSession = {
   _fixtureProvenance?: unknown
@@ -75,6 +93,125 @@ function installProductionSessionFixture(
   writeFileSync(profilePath, `${JSON.stringify(profile, null, 2)}\n`)
 }
 
+function materializeLegacyProfileJson(userDataDir: string): void {
+  const profileDirectory = path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID)
+  const databasePath = path.join(profileDirectory, 'profile-state.db')
+  const dataPath = path.join(profileDirectory, 'orca-data.json')
+  const opened = openProfileStateDatabaseReadOnly(databasePath, DEFAULT_LOCAL_ORCA_PROFILE_ID)
+  try {
+    writeFileSync(dataPath, `${readProfileStateSnapshot(opened.db).json}\n`)
+  } finally {
+    opened.db.close()
+  }
+}
+
+function publishLegacyCompatibilitySnapshot(userDataDir: string): string {
+  const profileDirectory = path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID)
+  const dataPath = path.join(profileDirectory, 'orca-data.json')
+  const databasePath = path.join(profileDirectory, 'profile-state.db')
+  const authority = new ProfileStateSqliteAuthority(databasePath, DEFAULT_LOCAL_ORCA_PROFILE_ID)
+  try {
+    authority.readSerializedState()
+    const revision = authority.writeJsonCompatibilityExport(dataPath)
+    if (revision === undefined) {
+      throw new Error('Expected the candidate profile to have a persisted revision')
+    }
+    return dataPath
+  } finally {
+    authority.close()
+  }
+}
+
+function restoreLegacyProfileJson(userDataDir: string): void {
+  const profileDirectory = path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID)
+  const databasePath = path.join(profileDirectory, 'profile-state.db')
+  const dataFile = path.join(profileDirectory, 'orca-data.json')
+  const maintenance = acquireProfileStateMaintenance(userDataDir)
+  try {
+    restoreProfileStateJsonExport({
+      maintenance,
+      databasePath,
+      dataFile,
+      exportPath: dataFile,
+      profileId: DEFAULT_LOCAL_ORCA_PROFILE_ID
+    })
+  } finally {
+    maintenance.release()
+  }
+}
+
+async function launchPackagedOldProfile(args: {
+  executablePath: string
+  userDataDir: string
+  testInfo: TestInfo
+}): Promise<{ app: ElectronApplication; page: Page }> {
+  const { ELECTRON_RUN_AS_NODE: _unused, ...cleanEnv } = process.env
+  void _unused
+  const homeIsolation = createElectronHomeIsolation({
+    inheritedEnv: cleanEnv,
+    launchEnv: {},
+    extraEnv: {},
+    userDataDir: args.userDataDir
+  })
+  const app = await electron.launch({
+    executablePath: args.executablePath,
+    args: [...getElectronIsolatedKeychainArgs(), `--user-data-dir=${args.userDataDir}`],
+    env: {
+      ...homeIsolation.env,
+      NODE_ENV: 'production',
+      ORCA_BACKGROUND_LAUNCH: '1',
+      ORCA_E2E_HEADLESS: '1',
+      ORCA_BYPASS_SINGLE_INSTANCE_LOCK: '1'
+    }
+  })
+  forwardElectronProcessLogs(app, args.testInfo)
+  try {
+    assertElectronResolvedIsolatedHome(
+      await app.evaluate(({ app: electronApp }) => electronApp.getPath('home')),
+      homeIsolation
+    )
+    const resolvedUserDataDir = await app.evaluate(({ app: electronApp }) =>
+      electronApp.getPath('userData')
+    )
+    if (!areSameHomePath(resolvedUserDataDir, args.userDataDir)) {
+      throw new Error('Packaged old build escaped the disposable user-data boundary')
+    }
+    await app.firstWindow({ timeout: 120_000 })
+    let apiPage: Page | undefined
+    await expect
+      .poll(
+        async () => {
+          for (const candidate of app.windows()) {
+            const hasSettingsApi = await Promise.race([
+              candidate.evaluate(() => Boolean(window.api?.settings?.get)).catch(() => false),
+              new Promise<boolean>((resolve) => {
+                const timeout = setTimeout(() => resolve(false), 2_000)
+                timeout.unref?.()
+              })
+            ])
+            if (hasSettingsApi) {
+              apiPage = candidate
+              return true
+            }
+          }
+          return false
+        },
+        // Older packaged builds can spend longer in their first-run renderer bootstrap
+        // while the candidate daemon from the same test worker is shutting down.
+        { timeout: 120_000 }
+      )
+      .toBe(true)
+    if (!apiPage) {
+      throw new Error('Packaged old build did not expose its renderer API')
+    }
+    await apiPage.waitForLoadState('domcontentloaded')
+    return { app, page: apiPage }
+  } catch (error) {
+    await closeElectronAppForE2E(app).catch(() => {})
+    throw error
+  }
+}
+
 async function expectProductionSessionRestored(
   page: Page,
   expected: { marker: string; ptyId: string; repoId: string; worktreeId: string }
@@ -147,7 +284,11 @@ test('upgrades a legacy daemon session and keeps it stable after relaunch', asyn
 
     await session.close(oldApp)
     oldApp = null
+    // Recreate a pre-cutover profile while retaining its live terminal identity.
+    materializeLegacyProfileJson(session.userDataDir)
     installProductionSessionFixture(session.userDataDir, repoId, worktreeId, ptyId)
+    await cleanupE2EDaemons(session.userDataDir)
+    restoreLegacyProfileJson(session.userDataDir)
 
     const currentLaunch = await session.launch()
     currentApp = currentLaunch.app
@@ -169,3 +310,288 @@ test('upgrades a legacy daemon session and keeps it stable after relaunch', asyn
     await session.dispose()
   }
 })
+
+// oxlint-disable-next-line no-empty-pattern -- This mixed-version test owns its Electron launches.
+test('restores a JSON compatibility snapshot and migrates it on normal restart', async ({}, testInfo) => {
+  test.setTimeout(240_000)
+
+  const session = createRestartSession(testInfo)
+  let candidateApp: ElectronApplication | null = null
+  let reupgradedApp: ElectronApplication | null = null
+  try {
+    const candidateLaunch = await session.launch()
+    candidateApp = candidateLaunch.app
+    await waitForSessionReady(candidateLaunch.page)
+    const marker = 17
+    await candidateLaunch.page.evaluate(async (terminalFontSize) => {
+      const updateSettings = window.__store?.getState().updateSettingsOrThrow
+      if (!updateSettings) {
+        throw new Error('Candidate renderer did not expose settings persistence')
+      }
+      await updateSettings({ terminalFontSize })
+    }, marker)
+    await expect
+      .poll(
+        () =>
+          candidateLaunch.page.evaluate(
+            () => window.__store?.getState().settings?.terminalFontSize
+          ),
+        { timeout: 15_000 }
+      )
+      .toBe(marker)
+
+    const profileDirectory = path.join(
+      session.userDataDir,
+      'profiles',
+      DEFAULT_LOCAL_ORCA_PROFILE_ID
+    )
+    const databasePath = path.join(profileDirectory, 'profile-state.db')
+    await session.close(candidateApp)
+    candidateApp = null
+    const dataPath = publishLegacyCompatibilitySnapshot(session.userDataDir)
+    expect(existsSync(databasePath)).toBe(true)
+    expect(existsSync(dataPath)).toBe(true)
+
+    // Restore the exported JSON, then exercise normal first migration again.
+    await cleanupE2EDaemons(session.userDataDir)
+    restoreLegacyProfileJson(session.userDataDir)
+    expect(existsSync(databasePath)).toBe(false)
+    expect(JSON.parse(readFileSync(dataPath, 'utf8')).settings.terminalFontSize).toBe(marker)
+    const reupgradedLaunch = await session.launch()
+    reupgradedApp = reupgradedLaunch.app
+    await waitForSessionReady(reupgradedLaunch.page)
+    await expect
+      .poll(
+        () =>
+          reupgradedLaunch.page.evaluate(
+            () => window.__store?.getState().settings?.terminalFontSize
+          ),
+        { timeout: 15_000 }
+      )
+      .toBe(marker)
+    expect(existsSync(databasePath)).toBe(true)
+  } finally {
+    for (const app of [reupgradedApp, candidateApp]) {
+      if (app) {
+        await session.close(app).catch(() => {})
+      }
+    }
+    await session.dispose()
+  }
+})
+
+test('real packaged old build reads compatibility JSON before candidate re-import', async ({
+  browserName: _browserName
+}, testInfo) => {
+  test.setTimeout(300_000)
+  const executablePath = process.env[PACKAGED_OLD_EXECUTABLE_ENV]
+  test.skip(
+    !executablePath || !existsSync(executablePath),
+    `${PACKAGED_OLD_EXECUTABLE_ENV} must point at an older packaged Orca executable`
+  )
+
+  const session = createRestartSession(testInfo)
+  let candidateApp: ElectronApplication | null = null
+  let oldApp: ElectronApplication | null = null
+  let reupgradedApp: ElectronApplication | null = null
+  try {
+    const candidateLaunch = await session.launch()
+    candidateApp = candidateLaunch.app
+    const marker = 19
+    await candidateLaunch.page.evaluate(async (terminalFontSize) => {
+      const updateSettings = window.__store?.getState().updateSettingsOrThrow
+      if (!updateSettings) {
+        throw new Error('Candidate renderer did not expose settings persistence')
+      }
+      await updateSettings({ terminalFontSize })
+    }, marker)
+    await expect
+      .poll(() =>
+        candidateLaunch.page.evaluate(() => window.__store?.getState().settings?.terminalFontSize)
+      )
+      .toBe(marker)
+    await session.close(candidateApp)
+    candidateApp = null
+
+    const databasePath = path.join(
+      session.userDataDir,
+      'profiles',
+      DEFAULT_LOCAL_ORCA_PROFILE_ID,
+      'profile-state.db'
+    )
+    const compatibilityPath = publishLegacyCompatibilitySnapshot(session.userDataDir)
+    expect(existsSync(databasePath)).toBe(true)
+    expect(existsSync(compatibilityPath)).toBe(true)
+    await cleanupE2EDaemons(session.userDataDir)
+    // A pre-migration build reads the canonical JSON restored by rollback.
+    restoreLegacyProfileJson(session.userDataDir)
+
+    const oldLaunch = await launchPackagedOldProfile({
+      executablePath: executablePath!,
+      userDataDir: session.userDataDir,
+      testInfo
+    })
+    oldApp = oldLaunch.app
+    await expect
+      .poll(() => oldLaunch.page.evaluate(() => window.api.settings.get()))
+      .toMatchObject({
+        terminalFontSize: marker
+      })
+    await closeElectronAppForE2E(oldApp)
+    oldApp = null
+
+    const reupgradedLaunch = await session.launch()
+    reupgradedApp = reupgradedLaunch.app
+    await expect
+      .poll(
+        () =>
+          reupgradedLaunch.page.evaluate(
+            () => window.__store?.getState().settings?.terminalFontSize
+          ),
+        { timeout: 30_000 }
+      )
+      .toBe(marker)
+    expect(existsSync(databasePath)).toBe(true)
+  } finally {
+    for (const app of [reupgradedApp, oldApp, candidateApp]) {
+      if (app) {
+        await closeElectronAppForE2E(app).catch(() => {})
+      }
+    }
+    await session.dispose()
+  }
+})
+
+test('fails closed when a packaged old build mutates live SQLite compatibility JSON', async ({
+  browserName: _browserName
+}, testInfo) => {
+  test.setTimeout(300_000)
+  const executablePath = process.env[PACKAGED_OLD_EXECUTABLE_ENV]
+  test.skip(
+    !executablePath || !existsSync(executablePath),
+    `${PACKAGED_OLD_EXECUTABLE_ENV} must point at an older packaged Orca executable`
+  )
+
+  const session = createRestartSession(testInfo)
+  let candidateApp: ElectronApplication | null = null
+  let oldApp: ElectronApplication | null = null
+  try {
+    const candidateLaunch = await session.launch()
+    candidateApp = candidateLaunch.app
+    const candidateExecutable = await candidateApp.evaluate(() => process.execPath)
+    await waitForSessionReady(candidateLaunch.page)
+    await candidateLaunch.page.evaluate(async () => {
+      const updateSettings = window.__store?.getState().updateSettingsOrThrow
+      if (!updateSettings) {
+        throw new Error('Candidate renderer did not expose settings persistence')
+      }
+      await updateSettings({ terminalFontSize: 19 })
+    })
+    await expect
+      .poll(() =>
+        candidateLaunch.page.evaluate(() => window.__store?.getState().settings?.terminalFontSize)
+      )
+      .toBe(19)
+    await session.close(candidateApp)
+    candidateApp = null
+
+    const profileDirectory = path.join(
+      session.userDataDir,
+      'profiles',
+      DEFAULT_LOCAL_ORCA_PROFILE_ID
+    )
+    const databasePath = path.join(profileDirectory, 'profile-state.db')
+    const compatibilityPath = publishLegacyCompatibilitySnapshot(session.userDataDir)
+    expect(existsSync(databasePath)).toBe(true)
+    expect(existsSync(compatibilityPath)).toBe(true)
+
+    const oldLaunch = await launchPackagedOldProfile({
+      executablePath: executablePath!,
+      userDataDir: session.userDataDir,
+      testInfo
+    })
+    oldApp = oldLaunch.app
+    await expect
+      .poll(() => oldLaunch.page.evaluate(() => window.api.settings.get()))
+      .toMatchObject({ terminalFontSize: 19 })
+    await oldLaunch.page.evaluate(async () => {
+      await window.api.settings.set({ terminalFontSize: 23 })
+    })
+    await expect
+      .poll(() => oldLaunch.page.evaluate(() => window.api.settings.get()))
+      .toMatchObject({ terminalFontSize: 23 })
+    await closeElectronAppForE2E(oldApp)
+    oldApp = null
+
+    const mutatedJson = JSON.parse(readFileSync(compatibilityPath, 'utf8'))
+    expect(mutatedJson).toMatchObject({ settings: { terminalFontSize: 23 } })
+    expect(existsSync(databasePath)).toBe(true)
+
+    const refused = await session.launchUntilExit(candidateExecutable)
+    expect(refused, refused.stderr).toMatchObject({ code: 1, signal: null, timedOut: false })
+    expect(refused.stderr).toContain(
+      'both JSON and SQLite storage without a matching acceptance marker'
+    )
+    expect(existsSync(databasePath)).toBe(true)
+    const opened = openProfileStateDatabaseReadOnly(databasePath, DEFAULT_LOCAL_ORCA_PROFILE_ID)
+    try {
+      expect(JSON.parse(readProfileStateSnapshot(opened.db).json)).toMatchObject({
+        settings: { terminalFontSize: 19 }
+      })
+    } finally {
+      opened.db.close()
+    }
+  } finally {
+    for (const app of [oldApp, candidateApp]) {
+      if (app) {
+        await closeElectronAppForE2E(app).catch(() => {})
+      }
+    }
+    await session.dispose()
+  }
+})
+
+// oxlint-disable-next-line no-empty-pattern -- This recovery test owns its Electron launches.
+test('fails closed on a corrupt established SQLite profile and retains recovery evidence', async ({}, testInfo) => {
+  test.setTimeout(180_000)
+
+  const session = createRestartSession(testInfo)
+  let app: ElectronApplication | null = null
+  try {
+    const initialLaunch = await session.launch()
+    app = initialLaunch.app
+    const candidateExecutable = await app.evaluate(() => process.execPath)
+    await waitForSessionReady(initialLaunch.page)
+    await session.close(app)
+    app = null
+
+    const profileDirectory = path.join(
+      session.userDataDir,
+      'profiles',
+      DEFAULT_LOCAL_ORCA_PROFILE_ID
+    )
+    const dataFile = path.join(profileDirectory, 'orca-data.json')
+    const databaseFile = path.join(profileDirectory, 'profile-state.db')
+    const retainedExports = readdirSync(profileDirectory).filter((name) =>
+      /^orca-data\.json\.sqlite-export\.\d+\.json$/.test(name)
+    )
+    expect(retainedExports.length).toBeGreaterThan(0)
+    const jsonBeforeCorruption = readFileSync(dataFile)
+
+    writeFileSync(databaseFile, 'corrupt profile-state database')
+    const refused = await session.launchUntilExit(candidateExecutable)
+    expect(refused, refused.stderr).toMatchObject({ code: 1, signal: null, timedOut: false })
+    expect(refused.stderr).toContain('cannot safely open the active profile')
+    expect(readFileSync(dataFile)).toEqual(jsonBeforeCorruption)
+    expect(
+      readdirSync(profileDirectory).filter((name) =>
+        /^orca-data\.json\.sqlite-export\.\d+\.json$/.test(name)
+      )
+    ).toEqual(retainedExports)
+  } finally {
+    if (app) {
+      await session.close(app).catch(() => {})
+    }
+    await session.dispose()
+  }
+})
diff --git a/tests/e2e/plugin-startup-budget.spec.ts b/tests/e2e/plugin-startup-budget.spec.ts
index 8f03d03d3e7..369a0c6e24e 100644
--- a/tests/e2e/plugin-startup-budget.spec.ts
+++ b/tests/e2e/plugin-startup-budget.spec.ts
@@ -126,27 +126,28 @@ function median(values: readonly number[]): number {
 // oxlint-disable-next-line no-empty-pattern -- Playwright passes fixtures before testInfo.
 test('keeps real Electron launch stable with 20 approved inert plugins', async ({}, testInfo) => {
   test.setTimeout(240_000)
-  const session = createRestartSession(testInfo, { ORCA_STARTUP_DIAGNOSTICS: '1' })
   const baseline: StartupSample[] = []
   const populated: StartupSample[] = []
-  let markerPaths: string[] = []
-  try {
-    for (let sample = 0; sample < SAMPLE_COUNT; sample += 1) {
-      seedPlugins(session.userDataDir, 0)
-      baseline.push(await launchSample(session, 0, testInfo))
-      markerPaths = seedPlugins(session.userDataDir, PLUGIN_COUNT)
-      populated.push(await launchSample(session, PLUGIN_COUNT, testInfo))
+  for (let sample = 0; sample < SAMPLE_COUNT; sample += 1) {
+    for (const count of [0, PLUGIN_COUNT]) {
+      // Seed each profile before its first migration into authoritative SQLite state.
+      const session = createRestartSession(testInfo, { ORCA_STARTUP_DIAGNOSTICS: '1' })
+      try {
+        const markerPaths = seedPlugins(session.userDataDir, count)
+        const samples = count === 0 ? baseline : populated
+        samples.push(await launchSample(session, count, testInfo))
+        expect(markerPaths.every((markerPath) => !existsSync(markerPath))).toBe(true)
+      } finally {
+        await session.dispose()
+      }
     }
-
-    // The isolated 20-sample unit gate owns the ≤50 ms P95. This app-level
-    // complement measures the user-visible launch delta because background
-    // discovery completion overlaps unrelated main-process startup work.
-    expect(populated.every((sample) => Number.isFinite(sample.pluginDurationMs))).toBe(true)
-    expect(median(populated.map((sample) => sample.readyToShowMs))).toBeLessThanOrEqual(
-      median(baseline.map((sample) => sample.readyToShowMs)) + 50
-    )
-    expect(markerPaths.every((markerPath) => !existsSync(markerPath))).toBe(true)
-  } finally {
-    await session.dispose()
   }
+
+  // The isolated 20-sample unit gate owns the ≤50 ms P95. This app-level
+  // complement measures the user-visible launch delta because background
+  // discovery completion overlaps unrelated main-process startup work.
+  expect(populated.every((sample) => Number.isFinite(sample.pluginDurationMs))).toBe(true)
+  expect(median(populated.map((sample) => sample.readyToShowMs))).toBeLessThanOrEqual(
+    median(baseline.map((sample) => sample.readyToShowMs)) + 50
+  )
 })
diff --git a/tests/e2e/profile-state-automatic-backup-recovery.spec.ts b/tests/e2e/profile-state-automatic-backup-recovery.spec.ts
new file mode 100644
index 00000000000..d3eb3a815e9
--- /dev/null
+++ b/tests/e2e/profile-state-automatic-backup-recovery.spec.ts
@@ -0,0 +1,222 @@
+import { existsSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import type { ElectronApplication } from '@stablyai/playwright-test'
+import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
+import { runProcess } from '../../src/shared/child-process/run-process'
+import { openProfileStateDatabaseReadOnly } from '../../src/main/persistence/profile-state/profile-state-database'
+import { readProfileStateSnapshot } from '../../src/main/persistence/profile-state/profile-state-documents'
+import { profileStateDatabaseBackups } from '../../src/main/persistence/profile-state/profile-state-backup-path'
+import { test, expect } from './helpers/orca-app'
+import { createRestartSession } from './helpers/orca-restart'
+import { getE2ECompletedOnboardingProfile } from './helpers/e2e-completed-onboarding-profile'
+import { createElectronHomeIsolation } from './helpers/electron-home-isolation'
+import { cleanupE2EDaemons } from './helpers/electron-process-shutdown'
+import { waitForSessionReady } from './helpers/store'
+
+function readSnapshot(databasePath: string) {
+  const opened = openProfileStateDatabaseReadOnly(databasePath, DEFAULT_LOCAL_ORCA_PROFILE_ID)
+  try {
+    return readProfileStateSnapshot(opened.db)
+  } finally {
+    opened.db.close()
+  }
+}
+
+function rollbackProfileBackup(userDataDir: string, backupId: string, executable?: string) {
+  const cliIsolation = createElectronHomeIsolation({
+    inheritedEnv: process.env,
+    launchEnv: { ORCA_USER_DATA_PATH: userDataDir, ORCA_BACKGROUND_LAUNCH: '1' },
+    extraEnv: {
+      ...(executable
+        ? { ORCA_APP_EXECUTABLE: executable, ORCA_APP_EXECUTABLE_NEEDS_APP_ROOT: '1' }
+        : {}),
+      // Raw development Electron needs the same sandbox opt-out as Playwright.
+      ...(process.platform === 'linux' ? { ELECTRON_DISABLE_SANDBOX: '1' } : {})
+    },
+    userDataDir
+  })
+  return runProcess({
+    program: process.execPath,
+    args: [
+      path.join(process.cwd(), 'out', 'cli', 'index.js'),
+      'profile',
+      'state',
+      'rollback',
+      '--backup',
+      backupId,
+      '--json'
+    ],
+    env: cliIsolation.env,
+    timeoutMs: 30_000,
+    maxOutputBytes: 64 * 1024
+  })
+}
+
+for (const recoveryRuntime of ['node', 'electron'] as const) {
+  // oxlint-disable-next-line no-empty-pattern -- This test owns both hidden Electron launches.
+  test(`restores an automatic SQLite backup through the ${recoveryRuntime} CLI after primary corruption`, async ({}, testInfo) => {
+    test.setTimeout(180_000)
+    const session = createRestartSession(testInfo, { ORCA_BACKGROUND_LAUNCH: '1' })
+    const rootJson = path.join(session.userDataDir, 'orca-data.json')
+    const profileDirectory = path.join(
+      session.userDataDir,
+      'profiles',
+      DEFAULT_LOCAL_ORCA_PROFILE_ID
+    )
+    const databasePath = path.join(profileDirectory, 'profile-state.db')
+    const dataFile = path.join(profileDirectory, 'orca-data.json')
+    const marker = `automatic-backup-${Date.now()}`
+    const recoveryMarker = {
+      marker,
+      // Exercise native cloning in the Electron recovery process on macOS.
+      payload: recoveryRuntime === 'electron' ? 'retained recovery data'.repeat(450_000) : ''
+    }
+    const seed = getE2ECompletedOnboardingProfile()
+    writeFileSync(
+      rootJson,
+      JSON.stringify({
+        ...seed,
+        settings: { ...seed.settings, terminalFontSize: 19, theme: 'light' },
+        backupRecoveryMarker: recoveryMarker
+      })
+    )
+    let firstApp: ElectronApplication | null = null
+    let restoredApp: ElectronApplication | null = null
+    try {
+      const first = await session.launch()
+      firstApp = first.app
+      await waitForSessionReady(first.page)
+      expect(
+        await first.app.evaluate(({ BrowserWindow }) =>
+          BrowserWindow.getAllWindows().every((window) => !window.isVisible())
+        )
+      ).toBe(true)
+      await first.page.evaluate(async () => {
+        const update = window.__store?.getState().updateSettingsOrThrow
+        if (!update) {
+          throw new Error('Renderer settings persistence is unavailable')
+        }
+        await update({ theme: 'dark' })
+      })
+
+      // Only normal app writes create this recovery point; the test never calls a snapshot writer.
+      await expect
+        .poll(() => profileStateDatabaseBackups(databasePath).length, { timeout: 30_000 })
+        .toBeGreaterThan(0)
+      const backup = profileStateDatabaseBackups(databasePath)[0]
+      const chosen = readSnapshot(backup.path)
+      expect(JSON.parse(chosen.json)).toMatchObject({
+        settings: { terminalFontSize: 19 },
+        backupRecoveryMarker: recoveryMarker
+      })
+      if (recoveryRuntime === 'electron') {
+        expect(statSync(backup.path).size).toBeGreaterThan(8 * 1024 * 1024)
+      }
+      const backupBytes = readFileSync(backup.path)
+      await first.page.evaluate(async () => {
+        const update = window.__store?.getState().updateSettingsOrThrow
+        if (!update) {
+          throw new Error('Renderer settings persistence is unavailable')
+        }
+        await update({ terminalFontSize: 23 })
+      })
+      await expect
+        .poll(() => JSON.parse(readSnapshot(databasePath).json).settings.terminalFontSize)
+        .toBe(23)
+      expect(readFileSync(backup.path).equals(backupBytes)).toBe(true)
+      const beforeRefusal = readSnapshot(databasePath)
+      const recoveryExecutable =
+        recoveryRuntime === 'electron'
+          ? await first.app.evaluate(() => process.execPath)
+          : undefined
+      const refused = await rollbackProfileBackup(
+        session.userDataDir,
+        backup.id,
+        recoveryExecutable
+      )
+      expect(refused.code).toBe(1)
+      expect(refused.stdout + refused.stderr).toContain(
+        recoveryRuntime === 'electron' ? 'Stop Orca' : 'in use'
+      )
+      expect(readSnapshot(databasePath)).toEqual(beforeRefusal)
+      expect(readFileSync(backup.path).equals(backupBytes)).toBe(true)
+      await session.close(firstApp)
+      firstApp = null
+      await cleanupE2EDaemons(session.userDataDir)
+
+      for (const file of [dataFile, rootJson, `${databasePath}-wal`, `${databasePath}-shm`]) {
+        rmSync(file, { force: true })
+      }
+      // Preserve both large artifacts so quarantine exercises batched recovery copies.
+      const corruptPrimary = readFileSync(databasePath)
+      corruptPrimary.write('deliberately corrupt SQLite primary')
+      writeFileSync(databasePath, corruptPrimary)
+      if (recoveryRuntime === 'electron') {
+        expect(corruptPrimary.length).toBeGreaterThan(8 * 1024 * 1024)
+      }
+      expect(() => readSnapshot(databasePath)).toThrow()
+      const restored = await rollbackProfileBackup(
+        session.userDataDir,
+        backup.id,
+        recoveryExecutable
+      )
+      expect(restored.code, restored.stderr || restored.stdout).toBe(0)
+      const recovered = JSON.parse(restored.stdout)
+      expect(recovered).toMatchObject({
+        ok: true,
+        result: {
+          storage: 'sqlite',
+          backupId: backup.id,
+          revision: chosen.revision,
+          profileId: DEFAULT_LOCAL_ORCA_PROFILE_ID,
+          restoredPath: recoveryRuntime === 'electron' ? realpathSync(databasePath) : databasePath
+        }
+      })
+      expect(readSnapshot(databasePath)).toEqual(chosen)
+      const quarantineDirectory: unknown = recovered.result.quarantineDirectory
+      if (typeof quarantineDirectory !== 'string') {
+        throw new Error('Recovery did not report its quarantine directory')
+      }
+      expect(
+        readFileSync(path.join(quarantineDirectory, 'profile-state.db')).equals(corruptPrimary)
+      ).toBe(true)
+      expect(
+        readFileSync(path.join(quarantineDirectory, path.basename(backup.path))).equals(backupBytes)
+      ).toBe(true)
+      expect(readFileSync(backup.path).equals(backupBytes)).toBe(true)
+      expect(existsSync(dataFile)).toBe(false)
+
+      const relaunched = await session.launch()
+      restoredApp = relaunched.app
+      await waitForSessionReady(relaunched.page)
+      await expect
+        .poll(() =>
+          relaunched.page.evaluate(() => window.__store?.getState().settings?.terminalFontSize)
+        )
+        .toBe(19)
+      await expect(relaunched.page.locator('html')).toHaveClass(
+        JSON.parse(chosen.json).settings.theme === 'dark' ? /\bdark\b/ : /\blight\b/
+      )
+      expect(JSON.parse(readSnapshot(databasePath).json).backupRecoveryMarker).toEqual(
+        recoveryMarker
+      )
+      expect(
+        await relaunched.app.evaluate(({ BrowserWindow }) =>
+          BrowserWindow.getAllWindows().every((window) => !window.isVisible())
+        )
+      ).toBe(true)
+      expect(existsSync(dataFile)).toBe(false)
+    } finally {
+      try {
+        if (restoredApp) {
+          await session.close(restoredApp)
+        }
+        if (firstApp) {
+          await session.close(firstApp)
+        }
+      } finally {
+        await session.dispose()
+      }
+    }
+  })
+}
diff --git a/tests/e2e/profile-state-terminal-restart-persistence.spec.ts b/tests/e2e/profile-state-terminal-restart-persistence.spec.ts
new file mode 100644
index 00000000000..656692e9f68
--- /dev/null
+++ b/tests/e2e/profile-state-terminal-restart-persistence.spec.ts
@@ -0,0 +1,591 @@
+/** Candidate SQLite terminal restart/profile journeys. */
+
+import { readFileSync, existsSync, rmSync } from 'node:fs'
+import path from 'node:path'
+import type { ElectronApplication } from '@stablyai/playwright-test'
+import { getRepoIdFromWorktreeId } from '../../src/shared/worktree/id'
+import { test, expect } from './helpers/orca-app'
+import { forceQuitElectronAppForE2E } from './helpers/electron-process-shutdown'
+import { attachRepoAndOpenTerminal, createRestartSession } from './helpers/orca-restart'
+import { execInTerminal, waitForTerminalOutput, waitForActivePanePtyId } from './helpers/terminal'
+import {
+  waitForSessionReady,
+  waitForActiveWorktree,
+  getActiveWorktreeId,
+  getWorktreeTabs
+} from './helpers/store'
+import {
+  seededRepoPathOrSkip,
+  bootstrapFirstLaunch,
+  bootstrapRestoredLaunch,
+  waitForElectronProcessExit
+} from './helpers/terminal-restart-persistence'
+
+test.describe.configure({ mode: 'serial' })
+
+test.describe('SQLite candidate terminal restart persistence', () => {
+  test('SQLite survives restart after legacy JSON is removed', async (// oxlint-disable-next-line no-empty-pattern -- Playwright's second fixture arg is testInfo; the first must be an object destructure to opt out of the default fixture set.
+  {}, testInfo) => {
+    const repoPath = seededRepoPathOrSkip()
+
+    const session = createRestartSession(testInfo)
+    let firstApp: ElectronApplication | null = null
+    let secondApp: ElectronApplication | null = null
+
+    try {
+      const firstLaunch = await session.launch()
+      firstApp = firstLaunch.app
+      const { worktreeId, ptyId } = await bootstrapFirstLaunch(firstLaunch.page, repoPath)
+
+      const automationName = `sqlite-candidate-restart-${Date.now()}`
+      const automationPrompt = 'Persist this candidate automation across an SQLite-only restart.'
+      const automationLifecycle = await firstLaunch.page.evaluate(
+        async ({ name, prompt }) => {
+          const isRecord = (value: unknown): value is Record<string, unknown> =>
+            typeof value === 'object' && value !== null && !Array.isArray(value)
+          const repo = window.__store?.getState().repos[0]
+          if (!repo) {
+            throw new Error('SQLite candidate E2E did not find a seeded repository')
+          }
+          const response = await window.api.runtime.call({
+            method: 'automation.create',
+            params: {
+              agentId: 'codex',
+              name,
+              prompt,
+              repo: `id:${repo.id}`,
+              // Keep a full run context in the persisted definition so `runNow`
+              // exercises the same runtime RPC and normalized automationRuns
+              // path used by real scheduled work.
+              runContext: {
+                kind: 'workspace-run',
+                projectId: repo.id,
+                hostId: 'runtime:missing',
+                projectHostSetupId: `missing-${Date.now()}`,
+                repoId: repo.id,
+                path: repo.path
+              },
+              workspaceMode: 'new_per_run',
+              reuseSession: false,
+              timezone: 'UTC',
+              rrule: 'FREQ=DAILY;BYHOUR=9;BYMINUTE=0',
+              dtstart: Date.now(),
+              enabled: false,
+              missedRunGraceMinutes: 720
+            }
+          })
+          if (!response.ok) {
+            throw new Error(`${response.error.code}: ${response.error.message}`)
+          }
+          const createResult = isRecord(response.result) ? response.result : null
+          const automation =
+            createResult && isRecord(createResult.automation) ? createResult.automation : null
+          if (!automation || typeof automation.id !== 'string') {
+            throw new Error('automation.create returned an invalid automation')
+          }
+          const runResponse = await window.api.runtime.call({
+            method: 'automation.runNow',
+            params: { id: automation.id }
+          })
+          if (!runResponse.ok) {
+            throw new Error(`${runResponse.error.code}: ${runResponse.error.message}`)
+          }
+          const runResult = isRecord(runResponse.result) ? runResponse.result : null
+          const run = runResult && isRecord(runResult.run) ? runResult.run : null
+          if (!run || typeof run.id !== 'string' || typeof run.status !== 'string') {
+            throw new Error('automation.runNow returned an invalid run')
+          }
+          return {
+            automationId: automation.id,
+            runId: run.id,
+            runStatus: run.status
+          }
+        },
+        { name: automationName, prompt: automationPrompt }
+      )
+      expect(automationLifecycle.runStatus).toBe('dispatching')
+
+      const profileIndex: unknown = JSON.parse(
+        readFileSync(path.join(session.userDataDir, 'orca-profile-index.json'), 'utf8')
+      )
+      if (
+        typeof profileIndex !== 'object' ||
+        profileIndex === null ||
+        Array.isArray(profileIndex) ||
+        !('activeProfileId' in profileIndex) ||
+        typeof profileIndex.activeProfileId !== 'string'
+      ) {
+        throw new Error('SQLite cutover E2E did not find an active profile id')
+      }
+      const profileDirectory = path.join(
+        session.userDataDir,
+        'profiles',
+        profileIndex.activeProfileId
+      )
+      const legacyProfileState = path.join(profileDirectory, 'orca-data.json')
+      const legacyRootState = path.join(session.userDataDir, 'orca-data.json')
+      const databasePath = path.join(profileDirectory, 'profile-state.db')
+      expect(existsSync(databasePath)).toBe(true)
+      expect(existsSync(legacyProfileState)).toBe(true)
+
+      await session.close(firstApp)
+      firstApp = null
+      expect(JSON.parse(readFileSync(legacyProfileState, 'utf8'))).toMatchObject({
+        automations: expect.arrayContaining([
+          expect.objectContaining({ id: automationLifecycle.automationId, name: automationName })
+        ])
+      })
+      // Prove the next launch has only the SQLite authority available.
+      rmSync(legacyProfileState, { force: true })
+      rmSync(legacyRootState, { force: true })
+      expect(existsSync(legacyProfileState)).toBe(false)
+      expect(existsSync(legacyRootState)).toBe(false)
+
+      const secondLaunch = await session.launch()
+      secondApp = secondLaunch.app
+      await bootstrapRestoredLaunch(secondLaunch.page, worktreeId)
+      expect(existsSync(legacyProfileState)).toBe(false)
+      expect(existsSync(legacyRootState)).toBe(false)
+      // The daemon survives the clean Electron restart, so a SQLite-only launch
+      // must reattach the same PTY binding instead of silently spawning a new shell.
+      await expect
+        .poll(() => waitForActivePanePtyId(secondLaunch.page), { timeout: 15_000 })
+        .toBe(ptyId)
+      const ptyMarker = `SQLITE_PTY_REATTACHED_${Date.now()}`
+      await execInTerminal(secondLaunch.page, ptyId, `echo ${ptyMarker}`)
+      await waitForTerminalOutput(secondLaunch.page, ptyMarker)
+      await expect
+        .poll(
+          async () =>
+            await secondLaunch.page.evaluate(
+              async ({ name, prompt }) => {
+                const response = await window.api.runtime.call({ method: 'automation.list' })
+                if (!response.ok) {
+                  return false
+                }
+                if (
+                  typeof response.result !== 'object' ||
+                  response.result === null ||
+                  !('automations' in response.result) ||
+                  !Array.isArray(response.result.automations)
+                ) {
+                  return false
+                }
+                return response.result.automations.some((automation) => {
+                  if (typeof automation !== 'object' || automation === null) {
+                    return false
+                  }
+                  return (
+                    'name' in automation &&
+                    'prompt' in automation &&
+                    automation.name === name &&
+                    automation.prompt === prompt
+                  )
+                })
+              },
+              { name: automationName, prompt: automationPrompt }
+            ),
+          { timeout: 10_000 }
+        )
+        .toBe(true)
+      await expect
+        .poll(
+          async () =>
+            await secondLaunch.page.evaluate(async ({ automationId, runId }) => {
+              const response = await window.api.runtime.call({
+                method: 'automation.runs',
+                params: { automationId }
+              })
+              if (
+                !response.ok ||
+                typeof response.result !== 'object' ||
+                response.result === null ||
+                !('runs' in response.result) ||
+                !Array.isArray(response.result.runs)
+              ) {
+                return false
+              }
+              return response.result.runs.some(
+                (run) => typeof run === 'object' && run !== null && 'id' in run && run.id === runId
+              )
+            }, automationLifecycle),
+          { timeout: 10_000 }
+        )
+        .toBe(true)
+      await expect
+        .poll(async () => (await getWorktreeTabs(secondLaunch.page, worktreeId)).length, {
+          timeout: 10_000
+        })
+        .toBeGreaterThanOrEqual(1)
+    } finally {
+      if (secondApp) {
+        await session.close(secondApp)
+      }
+      if (firstApp) {
+        await session.close(firstApp)
+      }
+      await session.dispose()
+    }
+  })
+
+  test('SQLite profile switch keeps independent profiles isolated', async (// oxlint-disable-next-line no-empty-pattern -- Playwright's second fixture arg is testInfo; the first must be an object destructure to opt out of the default fixture set.
+  {}, testInfo) => {
+    const repoPath = seededRepoPathOrSkip()
+
+    const session = createRestartSession(testInfo)
+    let firstApp: ElectronApplication | null = null
+    let secondApp: ElectronApplication | null = null
+    let thirdApp: ElectronApplication | null = null
+
+    try {
+      const firstLaunch = await session.launch()
+      firstApp = firstLaunch.app
+      const defaultWorktreeId = await attachRepoAndOpenTerminal(firstLaunch.page, repoPath)
+      await waitForSessionReady(firstLaunch.page)
+      const defaultProfileId = await firstLaunch.page.evaluate(async () => {
+        const profiles = await window.api.orcaProfiles.list()
+        return profiles.activeProfileId
+      })
+      const targetProfileId = await firstLaunch.page.evaluate(async () => {
+        const created = await window.api.orcaProfiles.createLocal({
+          name: `SQLite switch target ${Date.now()}`
+        })
+        return created.profile.id
+      })
+
+      const defaultProfileDirectory = path.join(session.userDataDir, 'profiles', defaultProfileId)
+      const defaultJson = path.join(defaultProfileDirectory, 'orca-data.json')
+      const rootJson = path.join(session.userDataDir, 'orca-data.json')
+      const defaultDatabase = path.join(defaultProfileDirectory, 'profile-state.db')
+      expect(existsSync(defaultDatabase)).toBe(true)
+
+      // The target switch must flush and publish the index before relaunching.
+      await expect(
+        firstLaunch.page.evaluate(
+          (profileId) => window.api.orcaProfiles.switchProfile({ profileId }),
+          targetProfileId
+        )
+      ).resolves.toEqual({ status: 'relaunching' })
+      await waitForElectronProcessExit(firstApp)
+      firstApp = null
+
+      const secondLaunch = await session.launch()
+      secondApp = secondLaunch.app
+      await waitForSessionReady(secondLaunch.page)
+      const targetList = await secondLaunch.page.evaluate(() => window.api.orcaProfiles.list())
+      expect(targetList.activeProfileId).toBe(targetProfileId)
+      const targetProfileDirectory = path.join(session.userDataDir, 'profiles', targetProfileId)
+      const targetDatabase = path.join(targetProfileDirectory, 'profile-state.db')
+      const targetJson = path.join(targetProfileDirectory, 'orca-data.json')
+      expect(existsSync(targetDatabase)).toBe(true)
+
+      // Seed an independent target-profile document before switching back.
+      await attachRepoAndOpenTerminal(secondLaunch.page, repoPath)
+      await waitForSessionReady(secondLaunch.page)
+
+      await expect(
+        secondLaunch.page.evaluate(
+          (profileId) => window.api.orcaProfiles.switchProfile({ profileId }),
+          defaultProfileId
+        )
+      ).resolves.toEqual({ status: 'relaunching' })
+      await waitForElectronProcessExit(secondApp)
+      secondApp = null
+
+      // Clean maintenance refreshes compatibility JSON before releasing the profile.
+      expect(existsSync(targetJson)).toBe(true)
+      for (const legacyPath of [targetJson, defaultJson, rootJson]) {
+        rmSync(legacyPath, { force: true })
+      }
+      const thirdLaunch = await session.launch()
+      thirdApp = thirdLaunch.app
+      await waitForSessionReady(thirdLaunch.page)
+      const finalList = await thirdLaunch.page.evaluate(() => window.api.orcaProfiles.list())
+      expect(finalList.activeProfileId).toBe(defaultProfileId)
+      expect(existsSync(defaultDatabase)).toBe(true)
+      expect(existsSync(targetDatabase)).toBe(true)
+      expect(existsSync(defaultJson)).toBe(false)
+      expect(existsSync(targetJson)).toBe(false)
+      await waitForActiveWorktree(thirdLaunch.page)
+      await expect
+        .poll(() => getActiveWorktreeId(thirdLaunch.page), { timeout: 10_000 })
+        .toBe(defaultWorktreeId)
+    } finally {
+      if (thirdApp) {
+        await session.close(thirdApp)
+      }
+      if (secondApp) {
+        await session.close(secondApp)
+      }
+      if (firstApp) {
+        await session.close(firstApp)
+      }
+      await session.dispose()
+    }
+  })
+
+  test('SQLite moves a project across JSON-free profiles', async (// oxlint-disable-next-line no-empty-pattern -- Playwright's second fixture arg is testInfo; the first must be an object destructure to opt out of the default fixture set.
+  {}, testInfo) => {
+    const repoPath = seededRepoPathOrSkip()
+
+    const session = createRestartSession(testInfo)
+    let firstApp: ElectronApplication | null = null
+    let secondApp: ElectronApplication | null = null
+    let thirdApp: ElectronApplication | null = null
+
+    try {
+      const firstLaunch = await session.launch()
+      firstApp = firstLaunch.app
+      const worktreeId = await attachRepoAndOpenTerminal(firstLaunch.page, repoPath)
+      await waitForSessionReady(firstLaunch.page)
+      const profileState = await firstLaunch.page.evaluate(async (repoId) => {
+        const profiles = await window.api.orcaProfiles.list()
+        const repo = window.__store?.getState().repos.find((entry) => entry.id === repoId)
+        if (!repo) {
+          throw new Error('SQLite profile move E2E did not find the seeded repository')
+        }
+        const target = await window.api.orcaProfiles.createLocal({
+          name: `SQLite move target ${Date.now()}`
+        })
+        return {
+          sourceProfileId: profiles.activeProfileId,
+          targetProfileId: target.profile.id,
+          repoId: repo.id
+        }
+      }, getRepoIdFromWorktreeId(worktreeId))
+
+      const sourceDirectory = path.join(
+        session.userDataDir,
+        'profiles',
+        profileState.sourceProfileId
+      )
+      const targetDirectory = path.join(
+        session.userDataDir,
+        'profiles',
+        profileState.targetProfileId
+      )
+      const sourceDatabase = path.join(sourceDirectory, 'profile-state.db')
+      const targetDatabase = path.join(targetDirectory, 'profile-state.db')
+      const sourceJson = path.join(sourceDirectory, 'orca-data.json')
+      const targetJson = path.join(targetDirectory, 'orca-data.json')
+      const rootJson = path.join(session.userDataDir, 'orca-data.json')
+      expect(existsSync(sourceDatabase)).toBe(true)
+
+      // Visit the target once so candidate startup establishes its own database before the move.
+      await expect(
+        firstLaunch.page.evaluate(
+          (profileId) => window.api.orcaProfiles.switchProfile({ profileId }),
+          profileState.targetProfileId
+        )
+      ).resolves.toEqual({ status: 'relaunching' })
+      await waitForElectronProcessExit(firstApp)
+      firstApp = null
+
+      const secondLaunch = await session.launch()
+      secondApp = secondLaunch.app
+      await waitForSessionReady(secondLaunch.page)
+      expect(await secondLaunch.page.evaluate(() => window.api.orcaProfiles.list())).toMatchObject({
+        activeProfileId: profileState.targetProfileId
+      })
+      expect(existsSync(targetDatabase)).toBe(true)
+
+      await expect(
+        secondLaunch.page.evaluate(
+          (profileId) => window.api.orcaProfiles.switchProfile({ profileId }),
+          profileState.sourceProfileId
+        )
+      ).resolves.toEqual({ status: 'relaunching' })
+      await waitForElectronProcessExit(secondApp)
+      secondApp = null
+
+      const thirdLaunch = await session.launch()
+      thirdApp = thirdLaunch.app
+      await waitForSessionReady(thirdLaunch.page)
+      const moveResult = await thirdLaunch.page.evaluate(
+        (args) => window.api.orcaProfiles.transferProject(args),
+        {
+          sourceProfileId: profileState.sourceProfileId,
+          targetProfileId: profileState.targetProfileId,
+          repoId: profileState.repoId,
+          mode: 'move' as const
+        }
+      )
+      expect(moveResult).toMatchObject({
+        status: 'transferred',
+        mode: 'move',
+        willRelaunch: true
+      })
+      await waitForElectronProcessExit(thirdApp)
+      thirdApp = null
+
+      // The move commits both SQLite participants before relaunch. Remove every JSON mirror to
+      // prove the target and source are both reopened from their databases alone.
+      for (const legacyPath of [sourceJson, targetJson, rootJson]) {
+        rmSync(legacyPath, { force: true })
+      }
+      expect(existsSync(sourceJson)).toBe(false)
+      expect(existsSync(targetJson)).toBe(false)
+
+      const targetLaunch = await session.launch()
+      secondApp = targetLaunch.app
+      await waitForSessionReady(targetLaunch.page)
+      expect(await targetLaunch.page.evaluate(() => window.api.orcaProfiles.list())).toMatchObject({
+        activeProfileId: profileState.targetProfileId
+      })
+      expect(
+        await targetLaunch.page.evaluate(
+          (repoId) => window.__store?.getState().repos.some((repo) => repo.id === repoId),
+          profileState.repoId
+        )
+      ).toBe(true)
+      expect(existsSync(targetDatabase)).toBe(true)
+
+      await expect(
+        targetLaunch.page.evaluate(
+          (profileId) => window.api.orcaProfiles.switchProfile({ profileId }),
+          profileState.sourceProfileId
+        )
+      ).resolves.toEqual({ status: 'relaunching' })
+      await waitForElectronProcessExit(secondApp)
+      secondApp = null
+
+      // Switching away refreshes the target export; remove it before the SQL-only source launch.
+      rmSync(targetJson, { force: true })
+      const sourceLaunch = await session.launch()
+      thirdApp = sourceLaunch.app
+      await waitForSessionReady(sourceLaunch.page)
+      expect(await sourceLaunch.page.evaluate(() => window.api.orcaProfiles.list())).toMatchObject({
+        activeProfileId: profileState.sourceProfileId
+      })
+      expect(
+        await sourceLaunch.page.evaluate(
+          (repoId) => window.__store?.getState().repos.some((repo) => repo.id === repoId),
+          profileState.repoId
+        )
+      ).toBe(false)
+      expect(existsSync(sourceDatabase)).toBe(true)
+      expect(existsSync(sourceJson)).toBe(false)
+      expect(existsSync(targetJson)).toBe(false)
+    } finally {
+      if (thirdApp) {
+        await session.close(thirdApp)
+      }
+      if (secondApp) {
+        await session.close(secondApp)
+      }
+      if (firstApp) {
+        await session.close(firstApp)
+      }
+      await session.dispose()
+    }
+  })
+
+  test('SQLite survives abrupt process termination after legacy JSON is removed', async (// oxlint-disable-next-line no-empty-pattern -- Playwright's second fixture arg is testInfo; the first must be an object destructure to opt out of the default fixture set.
+  {}, testInfo) => {
+    const repoPath = seededRepoPathOrSkip()
+
+    const session = createRestartSession(testInfo)
+    const stderr: string[] = []
+    const launchOptions = {
+      onStderr: (chunk: string): void => {
+        stderr.push(chunk)
+      }
+    }
+    let firstApp: ElectronApplication | null = null
+    let secondApp: ElectronApplication | null = null
+
+    try {
+      const firstLaunch = await session.launch(launchOptions)
+      firstApp = firstLaunch.app
+      const { worktreeId, ptyId } = await bootstrapFirstLaunch(firstLaunch.page, repoPath)
+
+      const profileIndex: unknown = JSON.parse(
+        readFileSync(path.join(session.userDataDir, 'orca-profile-index.json'), 'utf8')
+      )
+      if (
+        typeof profileIndex !== 'object' ||
+        profileIndex === null ||
+        Array.isArray(profileIndex) ||
+        !('activeProfileId' in profileIndex) ||
+        typeof profileIndex.activeProfileId !== 'string'
+      ) {
+        throw new Error('SQLite crash E2E did not find an active profile id')
+      }
+      const profileDirectory = path.join(
+        session.userDataDir,
+        'profiles',
+        profileIndex.activeProfileId
+      )
+      const legacyProfileState = path.join(profileDirectory, 'orca-data.json')
+      const legacyRootState = path.join(session.userDataDir, 'orca-data.json')
+      const databasePath = path.join(profileDirectory, 'profile-state.db')
+      expect(existsSync(databasePath)).toBe(true)
+
+      // Remove both JSON mirrors before the kill. Any state recovered by the next
+      // launch must therefore come from SQLite, including the terminal topology.
+      rmSync(legacyProfileState, { force: true })
+      rmSync(legacyRootState, { force: true })
+      expect(existsSync(legacyProfileState)).toBe(false)
+      expect(existsSync(legacyRootState)).toBe(false)
+
+      const mainPid = await firstApp.evaluate(() => process.pid)
+      await forceQuitElectronAppForE2E(firstApp, { preserveDaemons: true })
+      // Windows Playwright exposes a cmd wrapper; verify the actual Electron process exited.
+      await expect
+        .poll(() => {
+          try {
+            process.kill(mainPid, 0)
+            return false
+          } catch (error) {
+            if (error instanceof Error && 'code' in error && error.code === 'ESRCH') {
+              return true
+            }
+            throw error
+          }
+        })
+        .toBe(true)
+      firstApp = null
+      for (const suffix of ['', '-wal', '-shm']) {
+        const filename = `profile-state.db${suffix}`
+        const filePath = path.join(profileDirectory, filename)
+        if (existsSync(filePath)) {
+          await testInfo.attach(filename, {
+            body: readFileSync(filePath),
+            contentType: 'application/octet-stream'
+          })
+        }
+      }
+
+      const secondLaunch = await session.launch(launchOptions)
+      secondApp = secondLaunch.app
+      await bootstrapRestoredLaunch(secondLaunch.page, worktreeId)
+      expect(existsSync(legacyProfileState)).toBe(false)
+      expect(existsSync(legacyRootState)).toBe(false)
+      // The daemon survives the Electron crash, so a SQLite-only restart must
+      // reattach the same PTY binding instead of silently spawning a new shell.
+      await expect
+        .poll(() => waitForActivePanePtyId(secondLaunch.page), { timeout: 15_000 })
+        .toBe(ptyId)
+      const ptyMarker = `SQLITE_PTY_REATTACHED_AFTER_KILL_${Date.now()}`
+      await execInTerminal(secondLaunch.page, ptyId, `echo ${ptyMarker}`)
+      await waitForTerminalOutput(secondLaunch.page, ptyMarker)
+      await expect
+        .poll(async () => (await getWorktreeTabs(secondLaunch.page, worktreeId)).length, {
+          timeout: 10_000
+        })
+        .toBeGreaterThanOrEqual(1)
+    } finally {
+      if (secondApp) {
+        await session.close(secondApp)
+      }
+      if (firstApp) {
+        await session.close(firstApp)
+      }
+      await session.dispose()
+      await testInfo.attach('restart-stderr', {
+        body: stderr.join(''),
+        contentType: 'text/plain'
+      })
+    }
+  })
+})
diff --git a/tests/e2e/remote-terminal-tab-retirement.unit.test.ts b/tests/e2e/remote-terminal-tab-retirement.unit.test.ts
index 45ac2f8b0a0..4d5ee50a1d7 100644
--- a/tests/e2e/remote-terminal-tab-retirement.unit.test.ts
+++ b/tests/e2e/remote-terminal-tab-retirement.unit.test.ts
@@ -10,6 +10,7 @@ import {
   type WebSessionTabsSyncState
 } from '../../src/renderer/src/runtime/web-session-tabs-sync'
 import { OrcaRuntimeService } from '../../src/main/runtime/orca-runtime'
+import { withDurableRuntimeStore } from '../../src/main/runtime/runtime-durable-store-fixture'
 
 vi.mock('../../src/renderer/src/store', () => ({
   useAppStore: { setState: vi.fn() }
@@ -129,13 +130,16 @@ describe('remote terminal tab retirement publication', () => {
   it('removes a permanent host exit from simultaneous viewers without stale resurrection', async () => {
     let session = makePersistedSession()
     const flushOrThrow = vi.fn()
-    const runtime = new OrcaRuntimeService({
-      getWorkspaceSession: () => session,
-      setWorkspaceSession: (next) => {
-        session = next
-      },
-      flushOrThrow
-    } as never)
+    const runtime = new OrcaRuntimeService(
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This retirement fixture implements the Store session and durability operations used by the runtime.
+      withDurableRuntimeStore({
+        getWorkspaceSession: () => session,
+        setWorkspaceSession: (next) => {
+          session = next
+        },
+        flushOrThrow
+      }) as never
+    )
     runtime.attachWindow(1)
     const staleLiveSnapshot = makeHostSnapshot()
     runtime.syncWindowGraph(1, {
@@ -177,7 +181,7 @@ describe('remote terminal tab retirement publication', () => {
 
     const publications: (typeof livePublication)[] = []
     const unsubscribe = runtime.onMobileSessionTabsChanged((event) => publications.push(event))
-    runtime.onPtyExit(PTY_ID, 0, INCARNATION_ID)
+    await runtime.onPtyExit(PTY_ID, 0, INCARNATION_ID)
     const retiredPublication = publications.at(-1)
     expect(retiredPublication).toBeDefined()
     if (!retiredPublication) {
diff --git a/tests/e2e/settled-worker-tab-survives-restart.spec.ts b/tests/e2e/settled-worker-tab-survives-restart.spec.ts
index db3b03409dd..695abfa0325 100644
--- a/tests/e2e/settled-worker-tab-survives-restart.spec.ts
+++ b/tests/e2e/settled-worker-tab-survives-restart.spec.ts
@@ -1,8 +1,9 @@
+import { parseWorkspaceSession } from '../../src/shared/workspace-session-schema'
+import { readPersistedProfileState } from './helpers/persisted-profile-state'
 import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import { DaemonClient } from '../../src/main/daemon/client'
 import { getDaemonSocketPath, getDaemonTokenPath } from '../../src/main/daemon/daemon-spawner'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 import type { ElectronApplication, Page } from '@stablyai/playwright-test'
 import { test, expect } from './helpers/orca-app'
 import { TEST_REPO_PATH_FILE } from './global-setup'
@@ -71,6 +72,8 @@ async function findSecondaryWorktree(
 }
 
 async function backgroundMountTab(page: Page, worktreeId: string, tabId: string): Promise<void> {
+  // The synthetic event bypasses the production queue, so its Terminal listener must be mounted.
+  await waitForActiveTerminalManager(page)
   await page.evaluate(
     ({ tabId, worktreeId }) => {
       window.dispatchEvent(
@@ -87,21 +90,20 @@ async function backgroundMountTab(page: Page, worktreeId: string, tabId: string)
 }
 
 function readPersistedSession(userDataDir: string) {
-  return JSON.parse(
-    readFileSync(
-      path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID, 'orca-data.json'),
-      'utf8'
-    )
-  ).workspaceSession
+  const parsed = parseWorkspaceSession(readPersistedProfileState(userDataDir).workspaceSession)
+  if (!parsed.ok) {
+    throw new Error(`Invalid persisted workspace session: ${parsed.error}`)
+  }
+  return parsed.value
 }
 
 function expectNoPersistedWorkerFence(userDataDir: string, paneKey: string): void {
-  const persisted = readPersistedSession(userDataDir)
+  const persisted = readPersistedProfileState(userDataDir).workspaceSession
   // Keep the baseline running through reveal even when it still writes the withdrawn policy.
   expect
-    .soft(persisted.sleepingAgentSessionsByPaneKey?.[paneKey] ?? {})
-    .not.toHaveProperty('automaticResumeBlockedBy')
-  expect.soft(persisted.legacyWorkerResumeFencesByPaneKey ?? {}).not.toHaveProperty(paneKey)
+    .soft(persisted)
+    .not.toHaveProperty(['sleepingAgentSessionsByPaneKey', paneKey, 'automaticResumeBlockedBy'])
+  expect.soft(persisted).not.toHaveProperty(['legacyWorkerResumeFencesByPaneKey', paneKey])
 }
 
 // A restored worker must attach through main so revealing it never fabricates a missing PTY.
@@ -479,7 +481,7 @@ for (const daemonSessionGone of [false, true]) {
       const paneKeys = await second.page.evaluate((tabId) => {
         const layout = window.__store?.getState().terminalLayoutsByTabId[tabId]
         const leaves: string[] = []
-        const visit = (node: NonNullable<typeof layout>['root']) => {
+        const visit = (node: NonNullable<NonNullable<typeof layout>['root']>) => {
           if (node.type === 'leaf') {
             leaves.push(`${tabId}:${node.leafId}`)
           } else {
@@ -514,7 +516,7 @@ for (const daemonSessionGone of [false, true]) {
       expect(persisted.terminalLayoutsByTabId[workerTabId]).toBeDefined()
       if (!daemonSessionGone) {
         expect(
-          Object.values(persisted.terminalLayoutsByTabId[workerTabId].ptyIdsByLeafId)
+          Object.values(persisted.terminalLayoutsByTabId[workerTabId].ptyIdsByLeafId ?? {})
         ).toContain(workerPtyId)
       }
     } finally {
diff --git a/tests/e2e/sidebar-measured-row-scroll.spec.ts b/tests/e2e/sidebar-measured-row-scroll.spec.ts
index a328d9fac70..84c21cd92d1 100644
--- a/tests/e2e/sidebar-measured-row-scroll.spec.ts
+++ b/tests/e2e/sidebar-measured-row-scroll.spec.ts
@@ -71,6 +71,8 @@ test('keeps a collapsed group visible when an idle card below it grows', async (
   orcaPage,
   registerPostElectronShutdownCleanup
 }, testInfo) => {
+  // Why: the fixture's collapse slides rows in from their old position; a hidden window can freeze that mid-flight baseline.
+  await orcaPage.emulateMedia({ reducedMotion: 'reduce' })
   await waitForSessionReady(orcaPage)
   await orcaPage.setViewportSize({ width: 1200, height: 900 })
   const root = realpathSync(mkdtempSync(path.join(os.tmpdir(), 'orca-sidebar-measured-row-')))
diff --git a/tests/e2e/sparse-explorer-proof.spec.ts b/tests/e2e/sparse-explorer-proof.spec.ts
new file mode 100644
index 00000000000..06d7e183e8c
--- /dev/null
+++ b/tests/e2e/sparse-explorer-proof.spec.ts
@@ -0,0 +1,214 @@
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import os from 'node:os'
+import { runProcess } from '../../src/shared/child-process/run-process'
+import { test as base, expect } from './helpers/orca-app'
+import { openFileExplorer } from './helpers/file-explorer'
+import { waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+
+async function git(cwd: string, args: string[]): Promise<void> {
+  const result = await runProcess({ program: 'git', args, cwd })
+  if (result.code !== 0) {
+    throw new Error(result.stderr)
+  }
+}
+
+const test = base.extend({
+  minimumSeededWorktreeCount: 1,
+  seededRepoPath: async ({ testRepoPath }, provideFixture) => {
+    const fixtureRoot = mkdtempSync(path.join(os.tmpdir(), 'orca-sparse-proof-'))
+    const sparseRepo = path.join(fixtureRoot, 'repo')
+    await git(fixtureRoot, ['clone', '--local', testRepoPath, sparseRepo])
+    await git(sparseRepo, ['config', 'user.email', 'sparse-proof@example.invalid'])
+    await git(sparseRepo, ['config', 'user.name', 'Sparse proof'])
+    for (const [name, content] of [
+      ['omitted/private.txt', 'sparse-proof-marker omitted\n'],
+      ['apps/web/src/App.tsx', 'export const App = () => "sparse-proof-marker Web app"\n'],
+      ['apps/web/package.json', '{"name":"web-app"}\n'],
+      ['packages/ui/src/Button.tsx', 'export const Button = () => "sparse-proof-marker Button"\n']
+    ]) {
+      const file = path.join(sparseRepo, name)
+      mkdirSync(path.dirname(file), { recursive: true })
+      writeFileSync(file, content)
+    }
+    await git(sparseRepo, ['add', '.'])
+    await git(sparseRepo, ['commit', '-m', 'Sparse fixture'])
+    await git(sparseRepo, ['sparse-checkout', 'init', '--cone'])
+    await git(sparseRepo, ['sparse-checkout', 'set', '--', 'apps/web'])
+    expect(existsSync(path.join(sparseRepo, 'omitted', 'private.txt'))).toBe(false)
+    try {
+      await provideFixture(sparseRepo)
+    } finally {
+      rmSync(fixtureRoot, { recursive: true, force: true })
+    }
+  }
+})
+
+test('sparse explorer defaults and outside reveal', async ({ orcaPage }, testInfo) => {
+  await waitForSessionReady(orcaPage)
+  await waitForActiveWorktree(orcaPage)
+  const activeWorkspace = await orcaPage.evaluate(() => {
+    const s = window.__store!.getState()
+    const w = Object.values(s.worktreesByRepo)
+      .flat()
+      .find((w) => w.id === s.activeWorktreeId)!
+    return { id: w.id, path: w.path, repoId: w.repoId }
+  })
+  const workspace = {
+    ...activeWorkspace,
+    appsPath: path.join(activeWorkspace.path, 'apps'),
+    packagesPath: path.join(activeWorkspace.path, 'packages'),
+    readmePath: path.join(activeWorkspace.path, 'README.md')
+  }
+  await orcaPage.setViewportSize({ width: 1440, height: 960 })
+  await orcaPage.evaluate(
+    ({ workspace }) => {
+      const store = window.__store!
+      const s = store.getState()
+      store.setState({
+        rightSidebarWidth: 430,
+        explorerDisplayRootByWorktree: {},
+        expandedDirs: {
+          [workspace.id]: new Set([workspace.appsPath, workspace.packagesPath])
+        },
+        worktreesByRepo: {
+          ...s.worktreesByRepo,
+          [workspace.repoId]: s.worktreesByRepo[workspace.repoId].map((w) =>
+            w.id === workspace.id ? { ...w, isSparse: true, sparseDirectories: ['apps/web'] } : w
+          )
+        }
+      })
+    },
+    { workspace }
+  )
+  const board = orcaPage.getByRole('button', { name: 'Workspace board', exact: true })
+  await board.click()
+  await board.click()
+  await openFileExplorer(orcaPage)
+  const picker = orcaPage.getByRole('button', { name: 'Explorer root', exact: true })
+  await expect(picker).toContainText('apps/web')
+  const rows = orcaPage.locator('[data-file-explorer-row]')
+  await expect(rows.filter({ hasText: 'package.json' })).toBeVisible()
+  const proofDir = process.env.ORCA_SPARSE_PROOF_DIR
+  const capture = async (name: string) => {
+    const file = proofDir
+      ? path.resolve(proofDir, `${name}.png`)
+      : testInfo.outputPath(`${name}.png`)
+    mkdirSync(path.dirname(file), { recursive: true })
+    await orcaPage.mouse.move(700, 500)
+    await expect(
+      orcaPage.getByRole('tooltip').filter({ hasText: 'Workspace board moved to the bottom bar' })
+    ).toBeHidden({ timeout: 20000 })
+    await orcaPage.screenshot({ path: file, animations: 'disabled' })
+    await testInfo.attach(name, { path: file, contentType: 'image/png' })
+  }
+  await capture('single-folder')
+  await git(workspace.path, ['sparse-checkout', 'set', '--', 'apps/web', 'packages/ui'])
+  await orcaPage.evaluate(
+    ({ workspace }) => {
+      const store = window.__store!
+      const s = store.getState()
+      store.setState({
+        explorerDisplayRootByWorktree: {},
+        worktreesByRepo: {
+          ...s.worktreesByRepo,
+          [workspace.repoId]: s.worktreesByRepo[workspace.repoId].map((w) =>
+            w.id === workspace.id
+              ? { ...w, isSparse: true, sparseDirectories: ['apps/web', 'packages/ui'] }
+              : w
+          )
+        }
+      })
+    },
+    { workspace }
+  )
+  const baseline = process.env.ORCA_SPARSE_PROOF_BASELINE === '1'
+  await expect(picker).toContainText(baseline ? 'apps/web' : 'Repository root')
+  if (!baseline) {
+    await expect(rows.filter({ hasText: 'README.md' })).toBeVisible()
+    await expect(rows.filter({ hasText: 'apps' })).toBeVisible()
+    await expect(rows.filter({ hasText: 'packages' })).toBeVisible()
+  }
+  await capture('multiple-folders')
+  await picker.click()
+  await orcaPage.getByRole('menuitemradio', { name: 'apps/web', exact: true }).click()
+  await expect(picker).toContainText('apps/web')
+  await orcaPage.evaluate(
+    ({ workspace }) => {
+      window.__store!.getState().revealInExplorer(workspace.id, workspace.readmePath)
+    },
+    { workspace }
+  )
+  await expect(picker).toContainText(baseline ? 'Full repo root' : 'Repository root')
+  await expect(rows.filter({ hasText: 'README.md' })).toBeVisible()
+  await orcaPage.keyboard.press('Escape')
+  await capture('outside-reveal')
+  if (!baseline) {
+    await orcaPage.getByRole('button', { name: 'Back to apps/web', exact: true }).click()
+    await expect(picker).toContainText('apps/web')
+    await expect(rows.filter({ hasText: 'README.md' })).toHaveCount(0)
+    await capture('returned-to-folder')
+    await orcaPage.getByRole('button', { name: 'Repository root', exact: true }).click()
+    await expect(picker).toContainText('Repository root')
+    await picker.click()
+    await orcaPage.getByRole('menuitemradio', { name: 'apps/web', exact: true }).click()
+    await expect(picker).toContainText('apps/web')
+    await orcaPage.getByLabel('Search file contents', { exact: true }).click()
+    await expect(orcaPage.getByText('Search scope: workspace files', { exact: true })).toBeVisible()
+    await expect(orcaPage.getByLabel('Search file contents', { exact: true })).toHaveAttribute(
+      'data-state',
+      'on'
+    )
+    await orcaPage
+      .getByRole('textbox', { name: 'Search files', exact: true })
+      .fill('sparse-proof-marker')
+    await expect(orcaPage.getByText('App.tsx', { exact: true })).toBeVisible()
+    await expect(orcaPage.getByText('Button.tsx', { exact: true })).toBeVisible()
+    await expect(orcaPage.getByText('private.txt', { exact: true })).toHaveCount(0)
+    await capture('content-search')
+    await orcaPage.getByRole('textbox', { name: 'Search files', exact: true }).fill('')
+    await orcaPage.getByLabel('Filter files by name', { exact: true }).click()
+    await expect(picker).toContainText('apps/web')
+    await picker.click()
+    await orcaPage.getByRole('menuitemradio', { name: 'packages/ui', exact: true }).click()
+    await expect(picker).toContainText('packages/ui')
+    await expect(
+      orcaPage.getByRole('button', { name: 'Back to apps/web', exact: true })
+    ).toHaveCount(0)
+    await orcaPage.evaluate(async () => {
+      await window.__store!.getState().updateSettingsOrThrow({ theme: 'dark' })
+    })
+    await expect(orcaPage.locator('html')).toHaveClass(/dark/)
+    await orcaPage.keyboard.press('Escape')
+    await capture('saved-choice-dark')
+    await orcaPage.getByRole('button', { name: 'About sparse checkout scope' }).click()
+    await capture('scope-details')
+    await orcaPage.keyboard.press('Escape')
+    await orcaPage.evaluate(() => window.__store!.setState({ rightSidebarWidth: 220 }))
+    await capture('narrow-explorer')
+    await picker.click()
+    await capture('root-menu')
+    await orcaPage.keyboard.press('Escape')
+    await orcaPage.evaluate(() => window.__store!.setState({ rightSidebarWidth: 430 }))
+    await git(workspace.path, ['sparse-checkout', 'disable'])
+    expect(existsSync(path.join(workspace.path, 'omitted', 'private.txt'))).toBe(true)
+    await orcaPage.evaluate(
+      ({ workspace }) => {
+        const store = window.__store!
+        const s = store.getState()
+        store.setState({
+          worktreesByRepo: {
+            ...s.worktreesByRepo,
+            [workspace.repoId]: s.worktreesByRepo[workspace.repoId].map((w) =>
+              w.id === workspace.id ? { ...w, isSparse: false, sparseDirectories: [] } : w
+            )
+          }
+        })
+      },
+      { workspace }
+    )
+    await expect(picker).toHaveCount(0)
+    await expect(rows.filter({ hasText: 'README.md' })).toBeVisible()
+    await capture('ordinary-workspace')
+  }
+})
diff --git a/tests/e2e/sparse-preset-proof.spec.ts b/tests/e2e/sparse-preset-proof.spec.ts
new file mode 100644
index 00000000000..c3f0b6cdc98
--- /dev/null
+++ b/tests/e2e/sparse-preset-proof.spec.ts
@@ -0,0 +1,267 @@
+import type { Locator } from '@stablyai/playwright-test'
+import { mkdirSync } from 'node:fs'
+import path from 'node:path'
+import { test, expect } from './helpers/orca-app'
+import { waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+
+test('sparse preset editor visual proof', async ({ orcaPage }, testInfo) => {
+  await waitForSessionReady(orcaPage)
+  await waitForActiveWorktree(orcaPage)
+  await orcaPage.setViewportSize({ width: 1200, height: 800 })
+  const board = orcaPage.getByRole('button', { name: 'Workspace board', exact: true })
+  await board.click()
+  await board.click()
+  await orcaPage.evaluate(() => {
+    window.__store!.getState().openModal('new-workspace-composer', {})
+  })
+  const capture = async (name: string) => {
+    const file = process.env.ORCA_SPARSE_PROOF_DIR
+      ? path.resolve(process.env.ORCA_SPARSE_PROOF_DIR, `${name}.png`)
+      : testInfo.outputPath(`${name}.png`)
+    mkdirSync(path.dirname(file), { recursive: true })
+    await orcaPage.mouse.move(20, 20)
+    await expect(orcaPage.locator('[data-sonner-toast]')).toHaveCount(0, { timeout: 15000 })
+    await expect(
+      orcaPage.getByRole('tooltip').filter({ hasText: 'Workspace board moved to the bottom bar' })
+    ).toBeHidden({ timeout: 20000 })
+    await orcaPage.screenshot({ path: file, animations: 'disabled' })
+    await testInfo.attach(name, { path: file, contentType: 'image/png' })
+  }
+  // Why: free-form entry keeps the proof independent of the fixture repo's real folders.
+  const addDirectory = async (scope: Locator, directory: string): Promise<void> => {
+    await scope.getByRole('combobox', { name: 'Add a folder' }).click()
+    await orcaPage
+      .getByRole('combobox', { name: 'Find a folder, or type any path…' })
+      .fill(directory)
+    await orcaPage.locator(`[data-value="__literal__:${directory}"]`).click()
+    await expect(scope.getByRole('button', { name: `Remove ${directory}` })).toBeVisible()
+  }
+  await orcaPage.getByRole('button', { name: 'Advanced', exact: true }).click()
+  await orcaPage.getByRole('combobox', { name: 'Checkout preset' }).click()
+  await orcaPage.getByRole('button', { name: 'New preset', exact: true }).click()
+  await expect(orcaPage.getByLabel('Name', { exact: true })).toHaveAttribute(
+    'aria-invalid',
+    'false'
+  )
+  await expect(orcaPage.getByText('No folders added yet.')).toBeVisible()
+  await capture('preset-pristine')
+  const baseline = process.env.ORCA_SPARSE_PROOF_BASELINE === '1'
+  await orcaPage.getByLabel('Name', { exact: true }).fill('Web app and shared UI')
+  const composerEditor = orcaPage.getByRole('region', { name: 'New sparse preset' })
+  const initialDirectories = [
+    'apps/web',
+    'packages/ui',
+    'packages/design-tokens',
+    'packages/icons',
+    'packages/analytics',
+    'packages/auth'
+  ]
+  for (const directory of initialDirectories) {
+    await addDirectory(composerEditor, directory)
+  }
+  await capture('preset-editor')
+  await expect(orcaPage.getByRole('button', { name: 'Advanced', exact: true })).toBeDisabled()
+  if (baseline) {
+    return
+  }
+  const editor = orcaPage.getByRole('region', { name: 'New sparse preset' })
+  await expect(editor).toBeVisible()
+  await expect(orcaPage.getByRole('button', { name: /^Create worktree/ })).toHaveCount(0)
+  await expect(orcaPage.getByRole('dialog')).toHaveCount(1)
+  await expect(orcaPage.locator('[data-workspace-composer-root]')).toHaveAttribute(
+    'data-sparse-preset-editing',
+    'true'
+  )
+  await expect(editor.getByRole('button', { name: /^Remove / })).toHaveCount(
+    initialDirectories.length
+  )
+  await editor.getByRole('combobox', { name: 'Add a folder' }).click()
+  const pathInput = orcaPage.getByRole('combobox', { name: 'Find a folder, or type any path…' })
+  await pathInput.fill('../outside')
+  await expect(
+    orcaPage.getByText(
+      'Use repo-relative directories, not root, absolute paths, or parent segments.'
+    )
+  ).toBeVisible()
+  await expect(orcaPage.locator('[data-value^="__literal__:"]')).toHaveCount(0)
+  await capture('preset-validation')
+  await orcaPage.keyboard.press('Escape')
+  for (const directory of initialDirectories.slice(2)) {
+    await editor.getByRole('button', { name: `Remove ${directory}` }).click()
+  }
+  await expect(editor.getByRole('button', { name: /^Remove / })).toHaveCount(2)
+  await editor.getByRole('button', { name: 'Save preset', exact: true }).click()
+  await expect(editor).toHaveCount(0)
+  await expect(
+    orcaPage.getByRole('combobox').filter({ hasText: /^Web app and shared UI$/ })
+  ).toBeFocused()
+  await orcaPage
+    .getByRole('combobox')
+    .filter({ hasText: /^Web app and shared UI$/ })
+    .click()
+  await expect(orcaPage.getByRole('combobox', { name: 'Find a preset…' })).toBeFocused()
+  await orcaPage.getByRole('combobox', { name: 'Find a preset…' }).fill('packages/ui')
+  await capture('preset-search')
+  const chooser = orcaPage.locator('[data-slot="popover-content"]').filter({
+    has: orcaPage.getByRole('combobox', { name: 'Find a preset…' })
+  })
+  const presetTrigger = orcaPage.getByRole('combobox', { name: 'Checkout preset' })
+  await expect
+    .poll(async () => {
+      const popup = await chooser.boundingBox()
+      const trigger = await presetTrigger.boundingBox()
+      if (!popup || !trigger) {
+        return Infinity
+      }
+      return Math.min(
+        Math.abs(popup.y + popup.height - trigger.y),
+        Math.abs(trigger.y + trigger.height - popup.y)
+      )
+    })
+    .toBeLessThanOrEqual(1)
+  await orcaPage.getByRole('combobox', { name: 'Find a preset…' }).press('Enter')
+  await expect(chooser).toHaveCount(0)
+  await expect(presetTrigger).toBeFocused()
+  await presetTrigger.click()
+  const originalPresets = await orcaPage.evaluate(() => {
+    const store = window.__store!
+    const state = store.getState()
+    const original = state.sparsePresetsByRepo
+    const selected = Object.values(original)
+      .flat()
+      .find((preset) => preset.name === 'Web app and shared UI')!
+    store.setState({
+      sparsePresetsByRepo: {
+        ...original,
+        [selected.repoId]: [
+          ...original[selected.repoId],
+          ...Array.from({ length: 24 }, (_, index) => ({
+            ...selected,
+            id: `proof-${index}`,
+            name: `Team ${index} services`,
+            directories: [`services/team-${index}/a-long-directory-name`]
+          }))
+        ]
+      }
+    })
+    return original
+  })
+  const resultList = chooser.locator('[cmdk-list]')
+  await resultList.hover()
+  await orcaPage.mouse.wheel(0, 600)
+  await expect.poll(() => resultList.evaluate((node) => node.scrollTop)).toBeGreaterThan(0)
+  await capture('preset-many')
+  await expect(orcaPage.getByRole('button', { name: 'New preset', exact: true })).toBeInViewport()
+  await orcaPage.getByRole('combobox', { name: 'Find a preset…' }).fill('team-23')
+  await expect(orcaPage.getByRole('option', { name: /Team 23 services/ })).toBeVisible()
+  await capture('preset-many-filtered')
+  await orcaPage.evaluate(
+    (original) => window.__store!.setState({ sparsePresetsByRepo: original }),
+    originalPresets
+  )
+  await orcaPage.getByRole('combobox', { name: 'Find a preset…' }).fill('')
+  await orcaPage.setViewportSize({ width: 800, height: 640 })
+  await orcaPage.getByRole('button', { name: 'Edit Web app and shared UI', exact: true }).click()
+  const edit = orcaPage.getByRole('region', { name: 'Edit sparse preset' })
+  await expect(edit.getByRole('button', { name: 'Remove apps/web' })).toBeVisible()
+  await expect(edit.getByRole('button', { name: 'Remove packages/ui' })).toBeVisible()
+  await orcaPage.evaluate(async () => {
+    await window.__store!.getState().updateSettingsOrThrow({ theme: 'dark' })
+  })
+  await expect(edit.getByRole('button', { name: 'Save preset', exact: true })).toBeInViewport()
+  await expect(edit.getByRole('button', { name: 'Cancel', exact: true })).toBeInViewport()
+  await capture('preset-narrow-dark')
+  await edit.getByLabel('Name', { exact: true }).focus()
+  await orcaPage.keyboard.press('Escape')
+  await expect(edit).toHaveCount(0)
+  await expect(orcaPage.getByRole('dialog')).toHaveCount(1)
+  await orcaPage.setViewportSize({ width: 1200, height: 800 })
+  await orcaPage
+    .getByRole('combobox')
+    .filter({ hasText: /^Web app and shared UI$/ })
+    .click()
+  await orcaPage.getByRole('combobox', { name: 'Find a preset…' }).fill('nothing-matches')
+  await expect(orcaPage.getByText('No matching presets.')).toBeVisible()
+  await capture('preset-no-matches')
+  await orcaPage.getByRole('button', { name: 'New preset', exact: true }).click()
+  const second = orcaPage.getByRole('region', { name: 'New sparse preset' })
+  await second.getByLabel('Name', { exact: true }).fill('web app and shared ui')
+  await addDirectory(second, 'packages/ui')
+  await expect(
+    second.getByText('A preset named “Web app and shared UI” already exists.')
+  ).toBeVisible()
+  await expect(second.getByRole('button', { name: 'Save preset', exact: true })).toBeDisabled()
+  await capture('preset-duplicate')
+  await second.getByLabel('Name', { exact: true }).fill('Shared UI')
+  await orcaPage.evaluate(() => {
+    const store = window.__store!
+    const save = store.getState().saveSparsePreset
+    store.setState({
+      saveSparsePreset: async () => {
+        store.setState({ saveSparsePreset: save })
+        throw new Error('Proof fixture: persistence unavailable')
+      }
+    })
+  })
+  await second.getByRole('button', { name: 'Save preset', exact: true }).click()
+  await expect(second.getByRole('alert')).toHaveText('Could not save the preset. Try again.')
+  await expect(second.getByLabel('Name', { exact: true })).toHaveValue('Shared UI')
+  const errorBox = await second.getByRole('alert').boundingBox()
+  const saveBox = await second
+    .getByRole('button', { name: 'Save preset', exact: true })
+    .boundingBox()
+  expect(errorBox).not.toBeNull()
+  expect(saveBox).not.toBeNull()
+  expect(errorBox!.y + errorBox!.height).toBeLessThanOrEqual(saveBox!.y)
+  await capture('preset-save-error')
+  await orcaPage.evaluate(() => {
+    const store = window.__store!
+    const save = store.getState().saveSparsePreset
+    store.setState({
+      saveSparsePreset: async (args) => {
+        store.setState({ saveSparsePreset: save })
+        await new Promise((resolve) => setTimeout(resolve, 1500))
+        return save(args)
+      }
+    })
+  })
+  await second.getByRole('button', { name: 'Save preset', exact: true }).click()
+  await expect(second.getByRole('button', { name: 'Save preset', exact: true })).toBeDisabled()
+  await expect(second.getByRole('button', { name: 'Cancel', exact: true })).toBeDisabled()
+  await expect(second.getByLabel('Name', { exact: true })).toBeDisabled()
+  await orcaPage.keyboard.press('Escape')
+  await expect(second).toBeVisible()
+  await expect(second).toHaveCount(0)
+  await orcaPage.keyboard.press('Escape')
+  await orcaPage.evaluate(() => {
+    const state = window.__store!.getState()
+    const active = Object.values(state.worktreesByRepo)
+      .flat()
+      .find((w) => w.id === state.activeWorktreeId)!
+    state.setSettingsSearchQuery('')
+    state.openSettingsTarget({ pane: 'repo', repoId: active.repoId })
+    state.openSettingsPage()
+  })
+  await orcaPage.getByRole('button', { name: 'New Preset', exact: true }).click()
+  const settingsEditor = orcaPage.getByRole('region', { name: 'New sparse preset' })
+  await settingsEditor.getByLabel('Name', { exact: true }).fill('web app and shared ui')
+  await addDirectory(settingsEditor, 'apps/web')
+  await expect(
+    settingsEditor.getByText('A preset named “Web app and shared UI” already exists.')
+  ).toBeVisible()
+  await expect(orcaPage.getByRole('dialog')).toHaveCount(0)
+  await capture('preset-settings')
+  await settingsEditor.getByRole('button', { name: 'Cancel', exact: true }).click()
+  await expect(orcaPage.getByRole('button', { name: 'New Preset', exact: true })).toBeFocused()
+  await orcaPage
+    .getByRole('button', { name: /^Edit (Shared UI|Web app and shared UI)$/ })
+    .first()
+    .click()
+  const settingsEdit = orcaPage.getByRole('region', { name: 'Edit sparse preset' })
+  await expect(settingsEdit).toBeVisible()
+  await expect(
+    orcaPage.getByRole('button', { name: /^Edit (Shared UI|Web app and shared UI)$/ })
+  ).toBeDisabled()
+  await capture('preset-settings-edit')
+  await settingsEdit.getByRole('button', { name: 'Cancel', exact: true }).click()
+})
diff --git a/tests/e2e/ssh-docker-reconnect-pane-restore.spec.ts b/tests/e2e/ssh-docker-reconnect-pane-restore.spec.ts
index a7a2261de68..27be0b9ad1b 100644
--- a/tests/e2e/ssh-docker-reconnect-pane-restore.spec.ts
+++ b/tests/e2e/ssh-docker-reconnect-pane-restore.spec.ts
@@ -18,6 +18,7 @@ import {
   reconnectDockerSshRelayTarget
 } from './helpers/docker-ssh-relay-connection'
 import { openTerminalTabInActiveGroup } from './helpers/terminal-tab-open'
+import { attachSshReconnectFailureObservation } from './helpers/ssh-reconnect-failure-observation'
 
 const RUN_DOCKER_SSH = process.env.ORCA_E2E_SSH_DOCKER === '1'
 
@@ -63,6 +64,8 @@ test.describe('SSH reconnect pane restore', () => {
   }, testInfo) => {
     test.slow()
     let target: DockerSshRelayTarget | null = null
+    let targetId: string | null = null
+    let originalPtyId: string | null = null
     try {
       target = startDockerSshRelayTarget(testInfo)
       // The fixture image's shell emits no OSC 0, so without this every tab keeps its placeholder
@@ -71,9 +74,11 @@ test.describe('SSH reconnect pane restore', () => {
       await waitForSessionReady(orcaPage)
       await waitForActiveWorktree(orcaPage)
       const remote = await connectDockerSshRelayTarget(orcaPage, target)
+      targetId = remote.targetId
       await ensureTerminalVisible(orcaPage, 45_000)
       await waitForActiveTerminalManager(orcaPage, 60_000)
       const ptyId = await waitForActivePanePtyId(orcaPage, 60_000)
+      originalPtyId = ptyId
 
       // A marker rather than a prompt: a prompt reappears on its own after a reconnect, so it cannot
       // distinguish restored scrollback from a fresh shell. This string only exists if the pane kept
@@ -108,13 +113,15 @@ test.describe('SSH reconnect pane restore', () => {
       await execInTerminal(orcaPage, ptyId, 'top -b -n 1 > /dev/null; top')
       await waitForTerminalOutput(orcaPage, 'load average', 30_000, 8000)
 
-      await reconnectDockerSshRelayTarget(orcaPage, remote.targetId)
-      await waitForActiveTerminalManager(orcaPage, 60_000)
-      await waitForActivePanePtyId(orcaPage, 60_000)
+      for (let reconnect = 0; reconnect < 3; reconnect += 1) {
+        await reconnectDockerSshRelayTarget(orcaPage, remote.targetId)
+        await waitForActiveTerminalManager(orcaPage, 60_000)
+        await waitForActivePanePtyId(orcaPage, 60_000)
 
-      await waitForTerminalOutput(orcaPage, 'load average', 60_000, 8000)
-      const tuiContent = await getTerminalContent(orcaPage, 8000)
-      expect(tuiContent).toContain('PID')
+        await waitForTerminalOutput(orcaPage, 'load average', 60_000, 8000)
+        const tuiContent = await getTerminalContent(orcaPage, 8000)
+        expect(tuiContent).toContain('PID')
+      }
 
       // REGRESSION 2: opening a tab AFTER a reconnect. The prepaint could still fire on this mount
       // and write over the new shell, leaving a pane with no prompt and a generic tab title.
@@ -152,6 +159,17 @@ test.describe('SSH reconnect pane restore', () => {
           { timeout: 60_000, message: 'New tab kept its placeholder title' }
         )
         .not.toMatch(/^Terminal \d+$/)
+    } catch (error) {
+      await attachSshReconnectFailureObservation(
+        orcaPage,
+        testInfo,
+        target,
+        targetId,
+        originalPtyId
+      ).catch((diagnosticError) =>
+        console.warn('SSH reconnect diagnostics failed', diagnosticError)
+      )
+      throw error
     } finally {
       if (target) {
         cleanupDockerSshRelayTarget(target)
diff --git a/tests/e2e/ssh-docker-resource-accumulation.spec.ts b/tests/e2e/ssh-docker-resource-accumulation.spec.ts
index f028ef0d2ab..bb4a3520183 100644
--- a/tests/e2e/ssh-docker-resource-accumulation.spec.ts
+++ b/tests/e2e/ssh-docker-resource-accumulation.spec.ts
@@ -71,17 +71,22 @@ const DESCRIBE_MASTER_FD_HOLDERS = [
   'done'
 ].join('\n')
 
+function readRelayFdCount(target: DockerSshRelayTarget, relayPid: number): number {
+  const raw = execDockerSshRelayTargetCommand(
+    target,
+    `set -o pipefail\nls /proc/${relayPid}/fd | wc -l`
+  )
+  return Number(raw.trim())
+}
+
 function sampleRemoteResources(target: DockerSshRelayTarget): RemoteResourceSample {
   const groups = readDockerSshRelayProcessSnapshots(target)
   // Why: fd growth is only meaningful against the relay that owns the PTYs, so read
   // the table of every relay group and sum, rather than assuming a single relay.
-  const relayFdCount = groups.reduce((total, group) => {
-    const raw = execDockerSshRelayTargetCommand(
-      target,
-      `ls /proc/${group.relayPid}/fd 2>/dev/null | wc -l`
-    )
-    return total + Number(raw.trim() || '0')
-  }, 0)
+  const relayFdCount = groups.reduce(
+    (total, group) => total + readRelayFdCount(target, group.relayPid),
+    0
+  )
   const ptsCount = Number(
     execDockerSshRelayTargetCommand(target, 'ls /dev/pts | grep -c "^[0-9]" || true').trim() || '0'
   )
@@ -192,7 +197,36 @@ test.describe('Docker SSH relay resource accumulation', () => {
       // Why: the interesting failure is monotonic growth across cycles, not the
       // absolute count, so compare the last cycle against the first.
       expect(last.ptsCount).toBeLessThanOrEqual(first.ptsCount)
-      expect(last.relayFdCount).toBeLessThanOrEqual(first.relayFdCount + 4)
+      let settledFdCount = last.relayFdCount
+      if (settledFdCount > first.relayFdCount + 4) {
+        const groups = readDockerSshRelayProcessSnapshots(target)
+        expect(groups).toHaveLength(1)
+        const relayPid = groups[0]!.relayPid
+        const diagnostics = execDockerSshRelayTargetCommand(
+          target,
+          [`ls -l /proc/${relayPid}/fd || true`, 'ps -eo pid,ppid,stat,tty,args'].join('\n')
+        )
+        console.log(`[resource-accumulation] over-budget relay fds\n${diagnostics}`)
+        await testInfo.attach('relay-fd-over-budget', {
+          body: diagnostics,
+          contentType: 'text/plain'
+        })
+        // Background inventory reads can overlap this sample; allow 10s for their FDs to close.
+        await expect
+          .poll(
+            () => {
+              expect(
+                readDockerSshRelayProcessSnapshots(captured).map((group) => group.relayPid)
+              ).toEqual([relayPid])
+              settledFdCount = readRelayFdCount(captured, relayPid)
+              console.log(`[resource-accumulation] settling relay fds ${settledFdCount}`)
+              return settledFdCount
+            },
+            { timeout: 10_000, intervals: [100, 250, 500] }
+          )
+          .toBeLessThanOrEqual(first.relayFdCount + 4)
+      }
+      expect(settledFdCount).toBeLessThanOrEqual(first.relayFdCount + 4)
       expect(last.nodeProcessCount).toBeLessThanOrEqual(first.nodeProcessCount)
       expect(last.leakedMasterFdCount).toBeLessThanOrEqual(first.leakedMasterFdCount)
     } finally {
diff --git a/tests/e2e/ssh-docker-transport-drop-recovery.spec.ts b/tests/e2e/ssh-docker-transport-drop-recovery.spec.ts
index 83a7ae66f65..7939320d666 100644
--- a/tests/e2e/ssh-docker-transport-drop-recovery.spec.ts
+++ b/tests/e2e/ssh-docker-transport-drop-recovery.spec.ts
@@ -1,8 +1,6 @@
-import path from 'node:path'
-import { readFileSync } from 'node:fs'
+import { readPersistedProfileState } from './helpers/persisted-profile-state'
 import type { ElectronApplication } from '@playwright/test'
 import { test, expect } from './helpers/orca-app'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 import { sshRemotePtyLeaseAllowsReattach, type SshRemotePtyLease } from '../../src/shared/ssh-types'
 import { toRelaySshPtyId } from '../../src/shared/ssh-pty-id'
 import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
@@ -60,13 +58,8 @@ const RUN_DOCKER_SSH = process.env.ORCA_E2E_SSH_DOCKER === '1'
  * drift from the fan-out it exists to bound.
  */
 function readSshLeases(userDataDir: string, targetId: string): SshRemotePtyLease[] {
-  const dataPath = path.join(
-    userDataDir,
-    'profiles',
-    DEFAULT_LOCAL_ORCA_PROFILE_ID,
-    'orca-data.json'
-  )
-  const parsed = JSON.parse(readFileSync(dataPath, 'utf8')) as {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+  const parsed = readPersistedProfileState(userDataDir) as {
     sshRemotePtyLeases?: SshRemotePtyLease[]
   }
   return (parsed.sshRemotePtyLeases ?? []).filter((lease) => lease.targetId === targetId)
diff --git a/tests/e2e/structured-chat-owner-status-activation.unit.test.ts b/tests/e2e/structured-chat-owner-status-activation.unit.test.ts
new file mode 100644
index 00000000000..3d8858b3658
--- /dev/null
+++ b/tests/e2e/structured-chat-owner-status-activation.unit.test.ts
@@ -0,0 +1,154 @@
+// A chat whose agent is not running still owns its conversation. Released desktop clients gate
+// worktree activation on the host's owner answer, so a chat at rest that answered anything but
+// `native` blocked the gate, which then skips adopting and resuming the worktree's paneless agents.
+// This drives the real host's answer through the desktop's activation gate for the two ways a chat
+// comes to rest.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+import type { StructuredAgentSessionAdapter } from '../../src/main/native-chat/agent-session-wire/structured-agent-session-adapter'
+import { StructuredAgentSessionHost } from '../../src/main/native-chat/agent-session-wire/structured-agent-session-host'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  resetHostTestOperationIds
+} from '../../src/main/native-chat/agent-session-wire/structured-agent-session-host-test-data'
+import { STRUCTURED_AGENT_SESSION_IDLE_MS } from '../../src/main/native-chat/agent-session-wire/structured-agent-session-idle-sweep'
+import { AgentSessionRecordStore } from '../../src/main/runtime/agent-session-record-store'
+import { useAppStore } from '../../src/renderer/src/store'
+import { runWorktreeAgentActivationGate } from '../../src/renderer/src/lib/worktree-agent-activation-gate'
+import { readWorktreeStructuredActivationInventory } from '../../src/renderer/src/lib/worktree-agent-structured-inventory'
+import type { RuntimeMobileSessionTabsResult } from '../../src/shared/runtime-types'
+
+const WORKTREE = 'repo-1::/workspace/repo'
+
+let root: string
+let clock: number
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let closeSession: Mock<NonNullable<StructuredAgentSessionAdapter['closeSession']>>
+
+function openHost(): void {
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: {
+      acquire: async ({ fence, spawnToken }) => ({
+        process: { hostId: 'local', pid: 4242, processStartTimeMs: 1_700_000_000_000, spawnToken },
+        link: {
+          linkId: `link-${fence}`,
+          handle: { provider: 'codex', threadId: THREAD },
+          origin: store.getRecord(SESSION)?.providerHandleChain.length ? 'resumed' : 'created',
+          mintedAtFence: fence,
+          observedAt: NOW
+        }
+      }),
+      closeSession,
+      releaseAcquisition: async () => true,
+      dispatch: async () => ({ state: 'rejected', reason: 'unused' }),
+      cancelTurn: async () => ({ cancelled: false }),
+      answerPrompt: async () => undefined,
+      setOption: async () => undefined
+    },
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-a',
+    idleSweep: { intervalMs: 5 },
+    probeOwner: async () => ({ outcome: 'pid-absent' }),
+    now: () => clock
+  })
+}
+
+/** The desktop's runtime bridge, answering the two reads the gate makes from the real host. */
+function serveDesktopRuntime(): void {
+  const tabs: RuntimeMobileSessionTabsResult = {
+    worktree: WORKTREE,
+    publicationEpoch: 'owner-status-test',
+    snapshotVersion: 1,
+    activeGroupId: null,
+    activeTabId: null,
+    activeTabType: null,
+    tabs: [
+      {
+        type: 'agent-session',
+        id: `structured-agent-session-${SESSION}`,
+        title: 'Codex Chat',
+        sessionId: SESSION,
+        agent: 'codex',
+        isActive: false
+      }
+    ]
+  }
+  const call = async ({ method, params }: { method: string; params: { sessionId?: string } }) => {
+    if (method === 'session.tabs.list') {
+      return { ok: true, result: tabs }
+    }
+    if (method === 'agentSession.handoffStatus') {
+      try {
+        return { ok: true, result: host.handoffStatus(params.sessionId ?? '') }
+      } catch (error) {
+        return { ok: false, error: { code: String(error), message: String(error) } }
+      }
+    }
+    throw new Error(`Unexpected runtime method: ${method}`)
+  }
+  vi.stubGlobal('window', { api: { runtime: { call } } })
+}
+
+function activate(): ReturnType<typeof runWorktreeAgentActivationGate> {
+  return runWorktreeAgentActivationGate(WORKTREE, {
+    getState: () => useAppStore.getState(),
+    listSessions: async () => [],
+    listSurfaceOwners: async () => null,
+    hasStructuredSession: readWorktreeStructuredActivationInventory,
+    resume: () => 0
+  })
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-owner-status-'))
+  clock = NOW
+  resetHostTestOperationIds()
+  closeSession = vi.fn(async () => true)
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  openHost()
+  expect(await host.attach({ callerKey: 'client-1' }, hostTestAttachParams(null))).toMatchObject({
+    ok: true
+  })
+  serveDesktopRuntime()
+})
+
+afterEach(async () => {
+  vi.unstubAllGlobals()
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('a chat at rest keeps its worktree activatable', () => {
+  it('after the idle sweep stopped its agent and closed the conversation', async () => {
+    clock += STRUCTURED_AGENT_SESSION_IDLE_MS + 1
+    await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
+    expect(closeSession).toHaveBeenCalledWith(SESSION)
+
+    expect(host.handoffStatus(SESSION)).toMatchObject({ owner: 'native' })
+    expect(await activate()).toBe('structured')
+  })
+
+  it('after an app restart restored it for reading', async () => {
+    await host.flushAllStreamedEvents()
+    store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+    openHost()
+    await host.restoreReadableSessions()
+    expect(host.hasSession(SESSION)).toBe(true)
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
+      ownerProcess: null
+    })
+
+    expect(host.handoffStatus(SESSION)).toMatchObject({ owner: 'native' })
+    expect(await activate()).toBe('structured')
+  })
+})
diff --git a/tests/e2e/structured-session-reopened-tab-close.unit.test.ts b/tests/e2e/structured-session-reopened-tab-close.unit.test.ts
new file mode 100644
index 00000000000..35547145c32
--- /dev/null
+++ b/tests/e2e/structured-session-reopened-tab-close.unit.test.ts
@@ -0,0 +1,231 @@
+// @vitest-environment happy-dom
+
+/**
+ * After /clear the current chat keeps the tab id derived from its first session, so reopening that
+ * first session from history lands in a suffixed tab. Closing or focusing the reopened tab from
+ * main must reach that tab, not the current chat. Runs the real main close/focus path against the
+ * real window store, mirror and IPC bridges; only the process boundary is stubbed.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { RuntimeMobileSessionTabsResult } from '../../src/shared/runtime-types'
+import type * as RuntimeRpcClient from '../../src/renderer/src/runtime/runtime-rpc-client'
+import { OrcaRuntimeService } from '../../src/main/runtime/orca-runtime'
+import { setStructuredAgentSessionHost } from '../../src/main/native-chat/agent-session-wire/structured-agent-session-registry'
+import { useAppStore } from '../../src/renderer/src/store'
+import { applyStructuredSessionTabSnapshots } from '../../src/renderer/src/runtime/local-structured-session-tabs-sync/snapshot-apply'
+import { resetLocalStructuredSessionVersionForTests } from '../../src/renderer/src/runtime/local-structured-session-tabs-sync'
+import { resetWebSessionTabsSnapshotFreshnessForTests } from '../../src/renderer/src/runtime/web-session-tabs-sync'
+import { registerSessionTabIpcBridge } from '../../src/renderer/src/hooks/ipc-events/session-tab-ipc-bridge'
+import { registerTerminalUiRoutingIpcBridge } from '../../src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge'
+
+const WORKTREE = 'repo-1::/tmp/wt-reopen'
+const CURRENT_SESSION = 'clear-x'
+const REOPENED_SESSION = 'session-s'
+const CURRENT_TAB = `structured-agent-session-${REOPENED_SESSION}`
+const REOPENED_TAB = `${CURRENT_TAB}:history-1`
+
+type CloseRequest = { requestId: string; tabId: string; worktreeId: string; expiresAt?: number }
+type Listener<T> = (payload: T) => void
+
+type ProcessBoundary = {
+  runtime: Pick<OrcaRuntimeService, 'closeMobileSessionTab'> | null
+  rendererSessionCloses: string[]
+}
+
+const bridge = vi.hoisted((): ProcessBoundary => ({
+  runtime: null,
+  rendererSessionCloses: []
+}))
+
+vi.mock('../../src/renderer/src/runtime/runtime-rpc-client', async (importOriginal) => {
+  const actual = await importOriginal<typeof RuntimeRpcClient>()
+  return {
+    ...actual,
+    callRuntimeRpc: async (
+      _target: unknown,
+      method: string,
+      params: { worktree: string; tabId: string; reason?: 'user' }
+    ) => {
+      if (method !== 'session.tabs.close') {
+        throw new Error(`unexpected rpc ${method}`)
+      }
+      return bridge.runtime!.closeMobileSessionTab(params.worktree, params.tabId, {
+        reason: params.reason
+      })
+    }
+  }
+})
+
+vi.mock('../../src/renderer/src/runtime/structured-agent-session-close', () => ({
+  closeStructuredAgentSession: async (_target: unknown, sessionId: string) => {
+    bridge.rendererSessionCloses.push(sessionId)
+    return 'closed'
+  }
+}))
+
+async function setup() {
+  const listeners: {
+    closeSessionTab?: Listener<{ tabId: string; worktreeId: string }>
+    closeRequest?: Listener<CloseRequest>
+    focusEditorTab?: Listener<{ tabId: string; worktreeId: string; userInitiated?: boolean }>
+  } = {}
+  const pendingResponses = new Map<string, (error?: string) => void>()
+  const register =
+    <T>(assign: (listener: Listener<T>) => void) =>
+    (listener: Listener<T>) => {
+      assign(listener)
+      return () => {}
+    }
+  const noop = () => () => {}
+  vi.stubGlobal('api', {
+    ui: {
+      onCloseSessionTab: register((l) => (listeners.closeSessionTab = l)),
+      onSessionTabCloseRequest: register((l) => (listeners.closeRequest = l)),
+      onFocusEditorTab: register((l) => (listeners.focusEditorTab = l)),
+      onMoveSessionTab: noop,
+      onSplitTerminal: noop,
+      onRenameTerminal: noop,
+      onFocusTerminal: noop,
+      respondSessionTabClose: ({ requestId, error }: { requestId: string; error?: string }) =>
+        pendingResponses.get(requestId)?.(error)
+    }
+  })
+  registerSessionTabIpcBridge([])
+  registerTerminalUiRoutingIpcBridge([])
+
+  const hostSessionCloses: string[] = []
+  const closeResponses: (string | undefined)[] = []
+  const runtime = new OrcaRuntimeService()
+  bridge.runtime = runtime
+  let nextRequest = 0
+  runtime.setNotifier(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the chat close and focus paths call only these two notifier members.
+    {
+      // Same contract as the window relay: a request the renderer answers with an optional error.
+      closeSessionTab: (tabId: string, worktreeId: string) =>
+        new Promise<void>((resolve, reject) => {
+          const requestId = `close-${++nextRequest}`
+          pendingResponses.set(requestId, (error) => {
+            closeResponses.push(error)
+            return error ? reject(new Error(error)) : resolve()
+          })
+          listeners.closeRequest!({ requestId, tabId, worktreeId })
+        }),
+      focusEditorTab: (tabId: string, worktreeId: string) =>
+        listeners.focusEditorTab!({ tabId, worktreeId })
+    } as never
+  )
+  // No durable store, PTYs or workspace session on disk: the host tab list below is the whole state.
+  Object.assign(runtime, {
+    hasPersistedStructuredAgentSessionStore: () => true,
+    getKnownWorkspaceSessionWorktreeIds: () => new Set(),
+    hydrateHeadlessMobileSessionTabsFromWorkspaceSession: () => new Set(),
+    refreshMobileSessionPtyRecords: async () => new Set(),
+    ensureStructuredAgentSessionHost: async () => undefined
+  })
+  setStructuredAgentSessionHost(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: restore and tab close call only these host members.
+    {
+      reconcileRestartLeases: async () => undefined,
+      restoreReadableSessions: async () => undefined,
+      close: async (sessionId: string) => {
+        hostSessionCloses.push(sessionId)
+      },
+      setSessionTabVisibility: async () => undefined,
+      listSessionTabs: () => [
+        { sessionId: CURRENT_SESSION, workspaceId: WORKTREE, agent: 'claude' },
+        { sessionId: REOPENED_SESSION, workspaceId: WORKTREE, agent: 'claude' }
+      ]
+    } as never
+  )
+  await runtime.restoreStructuredAgentSessionTabs()
+  const hostSnapshot: RuntimeMobileSessionTabsResult = await runtime.listMobileSessionTabs(
+    `id:${WORKTREE}`
+  )
+
+  // The current chat after /clear: first session's tab id, new session's entity.
+  useAppStore.setState({ activeWorktreeId: WORKTREE })
+  useAppStore.getState().createUnifiedTab(WORKTREE, 'agent-session', {
+    id: CURRENT_TAB,
+    entityId: CURRENT_SESSION,
+    label: 'Claude Chat'
+  })
+  applyStructuredSessionTabSnapshots([hostSnapshot])
+
+  const agentTabs = () =>
+    (useAppStore.getState().unifiedTabsByWorktree[WORKTREE] ?? [])
+      .filter((tab) => tab.contentType === 'agent-session')
+      .map((tab) => ({ id: tab.id, entityId: tab.entityId }))
+  return { runtime, agentTabs, hostSessionCloses, closeResponses }
+}
+
+const initialStoreState = useAppStore.getState()
+
+beforeEach(() => {
+  bridge.rendererSessionCloses = []
+})
+
+afterEach(() => {
+  setStructuredAgentSessionHost(null)
+  bridge.runtime = null
+  useAppStore.setState(initialStoreState, true)
+  resetLocalStructuredSessionVersionForTests()
+  resetWebSessionTabsSnapshotFreshnessForTests()
+  vi.unstubAllGlobals()
+})
+
+describe('closing a chat reopened from history after /clear', () => {
+  it('mirrors the reopened session into a suffixed tab beside the current chat', async () => {
+    const { agentTabs } = await setup()
+
+    expect(agentTabs()).toEqual(
+      expect.arrayContaining([
+        { id: CURRENT_TAB, entityId: CURRENT_SESSION },
+        { id: REOPENED_TAB, entityId: REOPENED_SESSION }
+      ])
+    )
+  })
+
+  it('closes only the reopened tab when the user closes it on the desktop', async () => {
+    const { agentTabs, hostSessionCloses, closeResponses } = await setup()
+
+    useAppStore.getState().closeUnifiedTab(REOPENED_TAB)
+
+    await vi.waitFor(() => expect(hostSessionCloses).toEqual([REOPENED_SESSION]))
+    // Let any stray echo reach the window before asserting the current chat survived.
+    await new Promise((resolve) => setTimeout(resolve, 0))
+    expect(agentTabs()).toEqual([{ id: CURRENT_TAB, entityId: CURRENT_SESSION }])
+    expect(bridge.rendererSessionCloses).toEqual([REOPENED_SESSION])
+    expect(hostSessionCloses).toEqual([REOPENED_SESSION])
+    // The window already removed the tab, so main's relay is acknowledged, not reported missing.
+    expect(closeResponses).toEqual([undefined])
+  })
+
+  it('closes only the reopened tab when a phone closes it through the runtime', async () => {
+    const { runtime, agentTabs, hostSessionCloses } = await setup()
+
+    await runtime.closeMobileSessionTab(`id:${WORKTREE}`, `agent-session:${REOPENED_SESSION}`, {
+      reason: 'user'
+    })
+
+    await vi.waitFor(() =>
+      expect(agentTabs()).toEqual([{ id: CURRENT_TAB, entityId: CURRENT_SESSION }])
+    )
+    expect(bridge.rendererSessionCloses).not.toContain(CURRENT_SESSION)
+    expect(hostSessionCloses).not.toContain(CURRENT_SESSION)
+  })
+
+  it('focuses the reopened tab when a phone activates it through the runtime', async () => {
+    const { runtime } = await setup()
+    useAppStore.getState().activateTab(CURRENT_TAB, { worktreeId: WORKTREE })
+
+    await runtime.activateMobileSessionTab(`id:${WORKTREE}`, `agent-session:${REOPENED_SESSION}`)
+
+    const state = useAppStore.getState()
+    const group = state.groupsByWorktree[WORKTREE]?.find((candidate) =>
+      candidate.tabOrder.includes(REOPENED_TAB)
+    )
+    expect(group?.activeTabId).toBe(REOPENED_TAB)
+  })
+})
diff --git a/tests/e2e/terminal-binding-crash-hydration.unit.test.ts b/tests/e2e/terminal-binding-crash-hydration.unit.test.ts
new file mode 100644
index 00000000000..ec83a396e38
--- /dev/null
+++ b/tests/e2e/terminal-binding-crash-hydration.unit.test.ts
@@ -0,0 +1,101 @@
+import '../../src/renderer/src/store/slices/terminal-hydration-store-test-bootstrap'
+import { describe, expect, it, vi } from 'vitest'
+import { applyPtyBinding } from '../../src/main/persistence/loading-store/pty-binding-session-update'
+import { getDefaultWorkspaceSession } from '../../src/shared/constants'
+import { folderWorkspaceKey } from '../../src/shared/workspace-scope'
+import type { WorkspaceSessionState } from '../../src/shared/workspace-session-state-types'
+import { reconcileHydratedWorkspaceTabModels } from '../../src/renderer/src/app-shell/reconcile-hydrated-workspace-tab-models'
+import {
+  createTestStore,
+  makeTab,
+  makeWorktree,
+  TEST_REPO
+} from '../../src/renderer/src/store/slices/store-test-helpers'
+
+vi.mock('sonner', () => ({ toast: { info: vi.fn(), success: vi.fn(), error: vi.fn() } }))
+vi.mock('@/runtime/sync-runtime-graph', () => ({ scheduleRuntimeGraphSync: vi.fn() }))
+vi.mock('@/components/terminal-pane/pty-transport', () => ({
+  registerEagerPtyBuffer: vi.fn(),
+  ensurePtyDispatcher: vi.fn()
+}))
+
+const TAB_ID = 'crash-survivor'
+const LEAF_ID = '11111111-1111-4111-8111-111111111111'
+const INCARNATION_ID = '22222222-2222-4222-8222-222222222222'
+const FOLDER_KEY = folderWorkspaceKey('crash-folder')
+
+describe.each(['repo1::/repo1', FOLDER_KEY])('binding crash hydration for %s', (worktreeId) => {
+  it.each([false, true])(
+    'restores the acknowledged terminal before a renderer snapshot (existing row: %s)',
+    async (existingRow) => {
+      const ptyId = `${worktreeId}@@surviving-pty`
+      const persisted: WorkspaceSessionState = {
+        ...getDefaultWorkspaceSession(),
+        activeWorktreeId: worktreeId,
+        activeTabId: TAB_ID,
+        activeTabIdByWorktree: { [worktreeId]: TAB_ID },
+        activeWorktreeIdsOnShutdown: [],
+        unifiedTabs: {},
+        tabGroups: {},
+        tabGroupLayouts: {},
+        ...(existingRow
+          ? { tabsByWorktree: { [worktreeId]: [makeTab({ id: TAB_ID, worktreeId, ptyId: null })] } }
+          : {})
+      }
+      applyPtyBinding(
+        { worktreeId, tabId: TAB_ID, leafId: LEAF_ID, ptyId, incarnationId: INCARNATION_ID },
+        persisted,
+        worktreeId,
+        `${TAB_ID}:${LEAF_ID}`
+      )
+
+      // A crash leaves only the binding transaction; no renderer snapshot can fill its gaps.
+      const restoredSession = structuredClone(persisted)
+      const store = createTestStore()
+      store.setState({
+        repos: [TEST_REPO],
+        worktreesByRepo: {
+          repo1: [makeWorktree({ id: 'repo1::/repo1', repoId: 'repo1', path: '/repo1' })]
+        }
+      })
+      const options = { additionalValidWorkspaceKeys: [FOLDER_KEY] }
+      store.getState().hydrateWorkspaceSession(restoredSession, options)
+      store.getState().hydrateTabsSession(restoredSession, options)
+      reconcileHydratedWorkspaceTabModels(
+        restoredSession,
+        store.getState().reconcileWorktreeTabModels
+      )
+
+      const beforeReconnect = store.getState()
+      expect(beforeReconnect.tabsByWorktree[worktreeId]?.map((tab) => tab.id)).toEqual([TAB_ID])
+      expect(beforeReconnect.pendingReconnectPtyIdByTabId[TAB_ID]).toBe(ptyId)
+      expect(beforeReconnect.unifiedTabsByWorktree[worktreeId]).toEqual([
+        expect.objectContaining({ id: TAB_ID, entityId: TAB_ID, contentType: 'terminal' })
+      ])
+      expect(beforeReconnect.groupsByWorktree[worktreeId]).toEqual([
+        expect.objectContaining({ activeTabId: TAB_ID, tabOrder: [TAB_ID] })
+      ])
+      expect(beforeReconnect.layoutByWorktree[worktreeId]).toEqual({
+        type: 'leaf',
+        groupId: beforeReconnect.groupsByWorktree[worktreeId][0].id
+      })
+      expect(beforeReconnect.terminalLayoutsByTabId[TAB_ID]).toMatchObject({
+        root: { type: 'leaf', leafId: LEAF_ID },
+        activeLeafId: LEAF_ID,
+        ptyIdsByLeafId: { [LEAF_ID]: ptyId }
+      })
+      expect(restoredSession.terminalPtyIncarnationsByPaneKey?.[`${TAB_ID}:${LEAF_ID}`]).toBe(
+        INCARNATION_ID
+      )
+
+      await store.getState().reconnectPersistedTerminals()
+
+      expect(store.getState().workspaceSessionReady).toBe(true)
+      expect(store.getState().activeTabId).toBe(TAB_ID)
+      expect(store.getState().tabsByWorktree[worktreeId]).toEqual([
+        expect.objectContaining({ id: TAB_ID, ptyId })
+      ])
+      expect(store.getState().ptyIdsByTabId[TAB_ID]).toEqual([ptyId])
+    }
+  )
+})
diff --git a/tests/e2e/terminal-codex-cursor-jitter-repro.spec.ts b/tests/e2e/terminal-codex-cursor-jitter-repro.spec.ts
index be3ce0f5003..ad8de6ecd8e 100644
--- a/tests/e2e/terminal-codex-cursor-jitter-repro.spec.ts
+++ b/tests/e2e/terminal-codex-cursor-jitter-repro.spec.ts
@@ -5,6 +5,7 @@ import { test, expect } from './helpers/orca-app'
 import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
 import { waitForActiveTerminalManager } from './helpers/terminal'
 import { analyzeRasterCursorCells, type RasterCursorCell } from './terminal-cursor-raster-probe'
+import { quotePowerShellLiteral } from '../../src/shared/powershell-native-argument'
 
 type ShellCase = {
   label: string
@@ -168,10 +169,6 @@ function isUnexpectedVisibleCursorFrame(frame: ScreenSnapshot): boolean {
   return !isInputCursorRow(frame, frame.marker.cellY)
 }
 
-function quotePowerShellSingleQuoted(value: string): string {
-  return `'${value.replaceAll("'", "''")}'`
-}
-
 async function createShellTab(
   page: Page,
   shellOverride: ShellCase['shellOverride']
@@ -251,7 +248,7 @@ async function prepareCodexTerminal(
 
   const launchCommand =
     shellCase.shellOverride === 'powershell.exe'
-      ? `Set-Location -LiteralPath ${quotePowerShellSingleQuoted(process.cwd())}; ${shellCase.codexCommand}`
+      ? `Set-Location -LiteralPath ${quotePowerShellLiteral(process.cwd())}; ${shellCase.codexCommand}`
       : shellCase.codexCommand
   await page.keyboard.insertText(launchCommand)
   await page.keyboard.press('Enter')
diff --git a/tests/e2e/terminal-duplicate-pty-renderer-reveal.spec.ts b/tests/e2e/terminal-duplicate-pty-renderer-reveal.spec.ts
index 2eec7356f65..48a0f7a118c 100644
--- a/tests/e2e/terminal-duplicate-pty-renderer-reveal.spec.ts
+++ b/tests/e2e/terminal-duplicate-pty-renderer-reveal.spec.ts
@@ -1,9 +1,8 @@
+import { mutateStoppedProfileState } from './helpers/persisted-profile-state'
 import { randomUUID } from 'node:crypto'
-import { existsSync, readFileSync, writeFileSync } from 'node:fs'
-import path from 'node:path'
+import { existsSync, readFileSync } from 'node:fs'
 import type { ElectronApplication, Page } from '@stablyai/playwright-test'
 import type { TerminalLayoutSnapshot } from '../../src/shared/terminal-tab-types'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 import { test, expect } from './helpers/orca-app'
 import {
   findMarkerFrame,
@@ -59,39 +58,36 @@ setInterval(() => {
 `.trim()
 }
 
-function persistedDataPath(userDataDir: string): string {
-  return path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID, 'orca-data.json')
-}
-
 function seedDuplicatePtyOwnership(userDataDir: string): void {
-  const dataPath = persistedDataPath(userDataDir)
-  const data = JSON.parse(readFileSync(dataPath, 'utf8')) as PersistedData
-  const session = data.workspaceSession
-  const tabId = session?.activeTabId
-  const layout = tabId ? session?.terminalLayoutsByTabId?.[tabId] : undefined
-  const retainedLeafId = layout?.activeLeafId
-  const ptyId = retainedLeafId ? layout?.ptyIdsByLeafId?.[retainedLeafId] : undefined
-  if (!session?.terminalLayoutsByTabId || !tabId || !layout || !retainedLeafId || !ptyId) {
-    throw new Error('Persisted terminal ownership was unavailable for duplicate-layout seeding')
-  }
-
-  const duplicateLeafId = randomUUID()
-  session.terminalLayoutsByTabId[tabId] = {
-    ...layout,
-    root: {
-      type: 'split',
-      direction: 'vertical',
-      first: { type: 'leaf', leafId: retainedLeafId },
-      second: { type: 'leaf', leafId: duplicateLeafId }
-    },
-    activeLeafId: retainedLeafId,
-    expandedLeafId: null,
-    ptyIdsByLeafId: {
-      [retainedLeafId]: ptyId,
-      [duplicateLeafId]: ptyId
+  return mutateStoppedProfileState(userDataDir, (state) => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+    const data = state as PersistedData
+    const session = data.workspaceSession
+    const tabId = session?.activeTabId
+    const layout = tabId ? session?.terminalLayoutsByTabId?.[tabId] : undefined
+    const retainedLeafId = layout?.activeLeafId
+    const ptyId = retainedLeafId ? layout?.ptyIdsByLeafId?.[retainedLeafId] : undefined
+    if (!session?.terminalLayoutsByTabId || !tabId || !layout || !retainedLeafId || !ptyId) {
+      throw new Error('Persisted terminal ownership was unavailable for duplicate-layout seeding')
     }
-  }
-  writeFileSync(dataPath, `${JSON.stringify(data, null, 2)}\n`)
+
+    const duplicateLeafId = randomUUID()
+    session.terminalLayoutsByTabId[tabId] = {
+      ...layout,
+      root: {
+        type: 'split',
+        direction: 'vertical',
+        first: { type: 'leaf', leafId: retainedLeafId },
+        second: { type: 'leaf', leafId: duplicateLeafId }
+      },
+      activeLeafId: retainedLeafId,
+      expandedLeafId: null,
+      ptyIdsByLeafId: {
+        [retainedLeafId]: ptyId,
+        [duplicateLeafId]: ptyId
+      }
+    }
+  })
 }
 
 async function waitForRestoredTerminal(page: Page, worktreeId: string): Promise<string> {
diff --git a/tests/e2e/terminal-hidden-view-parking.spec.ts b/tests/e2e/terminal-hidden-view-parking.spec.ts
index 6cf877c6257..f050a0e4280 100644
--- a/tests/e2e/terminal-hidden-view-parking.spec.ts
+++ b/tests/e2e/terminal-hidden-view-parking.spec.ts
@@ -20,7 +20,7 @@ import {
 } from './helpers/terminal'
 import { parkHiddenTabBehindDecoy, waitForTabParked } from './helpers/terminal-hidden-parking'
 import { waitForPtyShellEcho } from './terminal-pty-readiness'
-import { TERMINAL_TAB_PARK_FLIP_BURST_WINDOW_MS } from '../../src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry'
+import { TERMINAL_TAB_PARK_FLIP_WINDOW_MS } from '../../src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry'
 
 // Why: the parking wiring registers this handle (dev/exposeStore builds only)
 // so tests can detect that hidden-view parking is compiled in and which delay
@@ -43,7 +43,7 @@ test.use({
 
 const PARKED_FRAME_SCRIPT_DELAY_MS = 750
 const PARKED_FRAME_COUNT = 25
-const PARK_VERDICT_BURST_SETTLE_MS = TERMINAL_TAB_PARK_FLIP_BURST_WINDOW_MS * 4
+const PARK_VERDICT_WINDOW_SETTLE_MS = Math.ceil(TERMINAL_TAB_PARK_FLIP_WINDOW_MS / 5)
 
 function parkedTuiFrame(runId: string, frame: number): string {
   const progress = `${'█'.repeat((frame % 8) + 1)}${'░'.repeat(8 - ((frame % 8) + 1))}`
@@ -478,7 +478,7 @@ test.describe('Terminal hidden view parking', () => {
     orcaPage,
     testRepoPath
   }, testInfo: TestInfo) => {
-    test.setTimeout(180_000)
+    test.setTimeout(420_000)
     await waitForSessionReady(orcaPage)
     const setup = await setUpParkableTabA(orcaPage)
     const { worktreeId, tabAId, tabAPtyId } = setup
@@ -542,8 +542,8 @@ test.describe('Terminal hidden view parking', () => {
       const mismatches: string[] = []
       for (let cycle = 1; cycle < CYCLES; cycle++) {
         // Why: each cycle intentionally flips this tab's rendered verdict twice.
-        // Let the production anti-churn burst window lapse before the next one.
-        await orcaPage.waitForTimeout(PARK_VERDICT_BURST_SETTLE_MS)
+        // Keep each tab below the 12-flip sustained-churn pin in a 60s window.
+        await orcaPage.waitForTimeout(PARK_VERDICT_WINDOW_SETTLE_MS)
         const rows = await runOneParkRevealCycle(cycle)
         if (JSON.stringify(rows) !== JSON.stringify(referenceRows)) {
           mismatches.push(
diff --git a/tests/e2e/terminal-kitty-reattach-parity.spec.ts b/tests/e2e/terminal-kitty-reattach-parity.spec.ts
new file mode 100644
index 00000000000..bb328a2dd27
--- /dev/null
+++ b/tests/e2e/terminal-kitty-reattach-parity.spec.ts
@@ -0,0 +1,119 @@
+/**
+ * A live app's kitty keyboard flags survive park and reveal in both records:
+ * xterm (which encodes keys) and the pane mirror (which Orca's shortcut policy
+ * reads). The reveal builds a fresh xterm, so without the replay epilogue's
+ * restore xterm would sit at 0 while the mirror adopted the host's flags.
+ */
+import type { ElectronApplication, Page } from '@stablyai/playwright-test'
+import { expect, test } from './helpers/orca-app'
+import { parkHiddenTabBehindDecoy } from './helpers/terminal-hidden-parking'
+import {
+  ensureTerminalVisible,
+  getActiveTabId,
+  waitForActiveWorktree,
+  waitForSessionReady
+} from './helpers/store'
+import {
+  focusActiveTerminalInput,
+  sendToTerminal,
+  waitForActivePanePtyId,
+  waitForActiveTerminalManager
+} from './helpers/terminal'
+import {
+  clearTerminalPtyWriteLog,
+  installTerminalPtyWriteSpy,
+  readTerminalPtyWrites
+} from './helpers/terminal-pty-write-spy'
+import { waitForPtyShellEcho } from './terminal-pty-readiness'
+
+const PARKING_DELAY_MS = Number(process.env.ORCA_E2E_TERMINAL_PARKING_DELAY_MS) || 500
+const APP_FLAGS = 5
+
+test.use({
+  orcaAppExtraEnv: { ORCA_E2E_TERMINAL_PARKING_DELAY_MS: String(PARKING_DELAY_MS) }
+})
+
+async function readXtermKittyFlags(page: Page): Promise<number | null> {
+  return page.evaluate(() => {
+    const state = window.__store?.getState()
+    const tabId = state?.activeTabId ?? null
+    const manager = tabId ? window.__paneManagers?.get(tabId) : null
+    const pane = manager?.getActivePane?.() ?? manager?.getPanes?.()[0] ?? null
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: xterm exposes kitty flags only on its private core; null when absent.
+    const terminal = pane?.terminal as
+      | { _core?: { coreService?: { kittyKeyboard?: { flags?: number } } } }
+      | undefined
+    return terminal?._core?.coreService?.kittyKeyboard?.flags ?? null
+  })
+}
+
+// Why Shift+Enter: the policy emits CSI-u only when the pane mirror reports kitty flags.
+async function expectShiftEnterWrite(
+  page: Page,
+  app: ElectronApplication,
+  expected: string
+): Promise<void> {
+  await clearTerminalPtyWriteLog(app)
+  await focusActiveTerminalInput(page)
+  await page.keyboard.press('Shift+Enter')
+  await expect
+    .poll(async () => (await readTerminalPtyWrites(app)).includes(expected), {
+      timeout: 5_000,
+      message: `Shift+Enter did not write ${JSON.stringify(expected)}`
+    })
+    .toBe(true)
+}
+
+async function activateTerminalTab(page: Page, tabId: string): Promise<void> {
+  await page.evaluate((tabId) => {
+    const state = window.__store?.getState()
+    if (!state) {
+      throw new Error('Orca store unavailable')
+    }
+    state.setActiveTabType('terminal', window.__store?.getState().activeWorktreeId ?? null)
+    state.setActiveTab(tabId)
+  }, tabId)
+  await expect.poll(() => getActiveTabId(page)).toBe(tabId)
+  await waitForActiveTerminalManager(page, 30_000)
+}
+
+test("park and reveal keep a live app's kitty flags in xterm and the mirror", async ({
+  orcaPage,
+  electronApp
+}) => {
+  test.skip(process.platform === 'win32', 'ConPTY panes withhold the kitty protocol')
+  await installTerminalPtyWriteSpy(electronApp)
+  await waitForSessionReady(orcaPage)
+  const worktreeId = await waitForActiveWorktree(orcaPage)
+  await ensureTerminalVisible(orcaPage)
+  await waitForActiveTerminalManager(orcaPage, 30_000)
+  const tabId = await getActiveTabId(orcaPage)
+  if (!tabId) {
+    throw new Error('no active terminal tab')
+  }
+  const ptyId = await waitForActivePanePtyId(orcaPage)
+  await waitForPtyShellEcho(orcaPage, ptyId, 15_000)
+
+  try {
+    // The app stays alive through the park, so nothing grounds its flags.
+    await sendToTerminal(orcaPage, ptyId, `printf '\\033[=${APP_FLAGS}u'; sleep 120\r`)
+    await expect.poll(() => readXtermKittyFlags(orcaPage)).toBe(APP_FLAGS)
+    await expectShiftEnterWrite(orcaPage, electronApp, '\x1b[13;2u')
+
+    await parkHiddenTabBehindDecoy(orcaPage, worktreeId, tabId, {
+      parkDelayMs: PARKING_DELAY_MS
+    })
+    await activateTerminalTab(orcaPage, tabId)
+    await waitForActivePanePtyId(orcaPage)
+
+    await expect
+      .poll(() => readXtermKittyFlags(orcaPage), {
+        timeout: 10_000,
+        message: 'the revealed xterm did not get the live app kitty flags back'
+      })
+      .toBe(APP_FLAGS)
+    await expectShiftEnterWrite(orcaPage, electronApp, '\x1b[13;2u')
+  } finally {
+    await sendToTerminal(orcaPage, ptyId, '\x03').catch(() => undefined)
+  }
+})
diff --git a/tests/e2e/terminal-node-command.ts b/tests/e2e/terminal-node-command.ts
index 140316497a5..c85dd813698 100644
--- a/tests/e2e/terminal-node-command.ts
+++ b/tests/e2e/terminal-node-command.ts
@@ -1,13 +1,11 @@
+import { quotePowerShellLiteral } from '../../src/shared/powershell-native-argument'
+
 function quotePosixShellArg(value: string): string {
   return `'${value.replaceAll("'", "'\\''")}'`
 }
 
-function quotePowerShellArg(value: string): string {
-  return `'${value.replaceAll("'", "''")}'`
-}
-
 function quoteTerminalArg(value: string): string {
-  return process.platform === 'win32' ? quotePowerShellArg(value) : quotePosixShellArg(value)
+  return process.platform === 'win32' ? quotePowerShellLiteral(value) : quotePosixShellArg(value)
 }
 
 export function nodeTerminalCommand(args: readonly string[]): string {
diff --git a/tests/e2e/terminal-option-composed-ascii.spec.ts b/tests/e2e/terminal-option-composed-ascii.spec.ts
index 93fe9a74b00..8aec5f4471c 100644
--- a/tests/e2e/terminal-option-composed-ascii.spec.ts
+++ b/tests/e2e/terminal-option-composed-ascii.spec.ts
@@ -120,30 +120,32 @@ async function pressOptionComposedKey(
   }, press)
 }
 
-async function armKittyKeyboardFromPty(page: Page, ptyId: string): Promise<void> {
+async function armKittyKeyboardFromPty(page: Page, ptyId: string, flags: number): Promise<void> {
   // Why: this is the byte a real kitty-protocol TUI pushes at startup; routing it
   // through the PTY exercises the same output-scanning mirror the policy reads.
-  await execInTerminal(page, ptyId, `printf '\\033[>1u'`)
+  // `cat` stays in the foreground: flags left armed at exit are grounded by the host.
+  await execInTerminal(page, ptyId, `printf '\\033[>${flags}u'; cat`)
   await expect
     .poll(async () => getPaneKittyKeyboardFlags(page), {
       timeout: 15_000,
       message: 'the pane never mirrored the application kitty keyboard flags'
     })
-    .toBeGreaterThan(0)
+    .toBe(flags)
 }
 
 async function setUpPane(
   page: Page,
-  app: ElectronApplication
-): Promise<{ ptyId: string; joinedWrites: () => Promise<string> }> {
+  app: ElectronApplication,
+  kittyFlags = 1
+): Promise<{ joinedWrites: () => Promise<string> }> {
   await waitForSessionReady(page)
   await waitForActiveWorktree(page)
   await ensureTerminalVisible(page)
   await waitForActiveTerminalManager(page)
   const ptyId = await waitForActivePanePtyId(page)
   await installMainProcessPtyWriteSpy(app)
-  await armKittyKeyboardFromPty(page, ptyId)
-  return { ptyId, joinedWrites: async () => (await getPtyWrites(app)).join('') }
+  await armKittyKeyboardFromPty(page, ptyId, kittyFlags)
+  return { joinedWrites: async () => (await getPtyWrites(app)).join('') }
 }
 
 test.describe('Option-composed text in a kitty-keyboard pane', () => {
@@ -239,9 +241,7 @@ test.describe('Option-composed text in a kitty-keyboard pane', () => {
     orcaPage,
     electronApp
   }) => {
-    const { ptyId, joinedWrites } = await setUpPane(orcaPage, electronApp)
-    await execInTerminal(orcaPage, ptyId, `printf '\\033[<u\\033[>5u'`)
-    await expect.poll(() => getPaneKittyKeyboardFlags(orcaPage)).toBe(5)
+    const { joinedWrites } = await setUpPane(orcaPage, electronApp, 5)
     await setMacOptionAsAlt(orcaPage, 'false')
     await clearPtyWriteLog(electronApp)
     const letters = [
@@ -278,9 +278,7 @@ test.describe('Option-composed text in a kitty-keyboard pane', () => {
     orcaPage,
     electronApp
   }) => {
-    const { ptyId, joinedWrites } = await setUpPane(orcaPage, electronApp)
-    await execInTerminal(orcaPage, ptyId, `printf '\\033[<u\\033[>29u'`)
-    await expect.poll(() => getPaneKittyKeyboardFlags(orcaPage)).toBe(29)
+    const { joinedWrites } = await setUpPane(orcaPage, electronApp, 29)
     await setMacOptionAsAlt(orcaPage, 'false')
     await clearPtyWriteLog(electronApp)
     await pressOptionComposedKey(orcaPage, { key: 'ą', code: 'KeyA' })
@@ -291,9 +289,7 @@ test.describe('Option-composed text in a kitty-keyboard pane', () => {
     orcaPage,
     electronApp
   }, testInfo) => {
-    const { ptyId, joinedWrites } = await setUpPane(orcaPage, electronApp)
-    await execInTerminal(orcaPage, ptyId, `printf '\\033[<u\\033[>5u'; cat`)
-    await expect.poll(() => getPaneKittyKeyboardFlags(orcaPage)).toBe(5)
+    const { joinedWrites } = await setUpPane(orcaPage, electronApp, 5)
     await setMacOptionAsAlt(orcaPage, 'false')
     await clearPtyWriteLog(electronApp)
     const cdp = await orcaPage.context().newCDPSession(orcaPage)
diff --git a/tests/e2e/terminal-reset-input-modes.spec.ts b/tests/e2e/terminal-reset-input-modes.spec.ts
new file mode 100644
index 00000000000..f10797666af
--- /dev/null
+++ b/tests/e2e/terminal-reset-input-modes.spec.ts
@@ -0,0 +1,131 @@
+/**
+ * Reset Terminal grounds the input modes an app left armed where the host saw
+ * no command end, and the ground survives park and reveal. The reveal builds a
+ * fresh xterm from the host's model, so a renderer-only reset would come back
+ * armed.
+ */
+import type { ElectronApplication, Page } from '@stablyai/playwright-test'
+import { expect, test } from './helpers/orca-app'
+import { parkHiddenTabBehindDecoy } from './helpers/terminal-hidden-parking'
+import {
+  ensureTerminalVisible,
+  getActiveTabId,
+  waitForActiveWorktree,
+  waitForSessionReady
+} from './helpers/store'
+import {
+  focusActiveTerminalInput,
+  sendToTerminal,
+  waitForActivePanePtyId,
+  waitForActiveTerminalManager
+} from './helpers/terminal'
+import { openTerminalContextMenu } from './helpers/terminal-pane-title-actions'
+import {
+  clearTerminalPtyWriteLog,
+  installTerminalPtyWriteSpy,
+  readTerminalPtyWrites
+} from './helpers/terminal-pty-write-spy'
+import { waitForPtyShellEcho } from './terminal-pty-readiness'
+
+const PARKING_DELAY_MS = Number(process.env.ORCA_E2E_TERMINAL_PARKING_DELAY_MS) || 500
+const KITTY_SHIFT_ENTER = '\x1b[13;2u'
+
+test.use({
+  orcaAppExtraEnv: { ORCA_E2E_TERMINAL_PARKING_DELAY_MS: String(PARKING_DELAY_MS) }
+})
+
+type XtermInputModes = { kittyFlags: number | null; mouse: string | null }
+
+async function readXtermInputModes(page: Page): Promise<XtermInputModes> {
+  return page.evaluate(() => {
+    const state = window.__store?.getState()
+    const tabId = state?.activeTabId ?? null
+    const manager = tabId ? window.__paneManagers?.get(tabId) : null
+    const pane = manager?.getActivePane?.() ?? manager?.getPanes?.()[0] ?? null
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: xterm exposes kitty flags only on its private core; null when absent.
+    const terminal = pane?.terminal as
+      | {
+          modes?: { mouseTrackingMode?: string }
+          _core?: { coreService?: { kittyKeyboard?: { flags?: number } } }
+        }
+      | undefined
+    return {
+      kittyFlags: terminal?._core?.coreService?.kittyKeyboard?.flags ?? null,
+      mouse: terminal?.modes?.mouseTrackingMode ?? null
+    }
+  })
+}
+
+// Why Shift+Enter: the policy emits CSI-u only when the pane mirror reports kitty flags.
+async function readShiftEnterWrite(page: Page, app: ElectronApplication): Promise<string> {
+  await clearTerminalPtyWriteLog(app)
+  await focusActiveTerminalInput(page)
+  await page.keyboard.press('Shift+Enter')
+  let written = ''
+  await expect
+    .poll(
+      async () => {
+        written = (await readTerminalPtyWrites(app)).join('')
+        return written.length
+      },
+      { timeout: 5_000, message: 'Shift+Enter wrote nothing' }
+    )
+    .toBeGreaterThan(0)
+  return written
+}
+
+async function expectGrounded(page: Page, app: ElectronApplication, when: string): Promise<void> {
+  await expect
+    .poll(() => readXtermInputModes(page), { timeout: 10_000, message: `xterm armed ${when}` })
+    .toEqual({ kittyFlags: 0, mouse: 'none' })
+  expect(await readShiftEnterWrite(page, app)).not.toContain(KITTY_SHIFT_ENTER)
+}
+
+async function activateTerminalTab(page: Page, tabId: string): Promise<void> {
+  await page.evaluate((tabId) => {
+    const state = window.__store?.getState()
+    if (!state) {
+      throw new Error('Orca store unavailable')
+    }
+    state.setActiveTabType('terminal', window.__store?.getState().activeWorktreeId ?? null)
+    state.setActiveTab(tabId)
+  }, tabId)
+  await expect.poll(() => getActiveTabId(page)).toBe(tabId)
+  await waitForActiveTerminalManager(page, 30_000)
+}
+
+test('Reset Terminal grounds modes an unhooked crash left armed, through park and reveal', async ({
+  orcaPage,
+  electronApp
+}) => {
+  test.skip(process.platform === 'win32', 'ConPTY panes withhold the kitty protocol')
+  await installTerminalPtyWriteSpy(electronApp)
+  await waitForSessionReady(orcaPage)
+  const worktreeId = await waitForActiveWorktree(orcaPage)
+  await ensureTerminalVisible(orcaPage)
+  await waitForActiveTerminalManager(orcaPage, 30_000)
+  const tabId = await getActiveTabId(orcaPage)
+  if (!tabId) {
+    throw new Error('no active terminal tab')
+  }
+  const ptyId = await waitForActivePanePtyId(orcaPage)
+  await waitForPtyShellEcho(orcaPage, ptyId, 15_000)
+
+  // `exec` drops the shell hooks, so no OSC 133;D ever lets the host ground the
+  // modes the printf arms and leaves behind.
+  await sendToTerminal(orcaPage, ptyId, 'exec bash --norc --noprofile\r')
+  await sendToTerminal(orcaPage, ptyId, "printf '\\033[>5u\\033[?1000h\\033[?1006h'\r")
+  await expect
+    .poll(() => readXtermInputModes(orcaPage), { timeout: 10_000 })
+    .toEqual({ kittyFlags: 5, mouse: 'vt200' })
+  expect(await readShiftEnterWrite(orcaPage, electronApp)).toContain(KITTY_SHIFT_ENTER)
+
+  await openTerminalContextMenu(orcaPage)
+  await orcaPage.getByRole('menuitem', { name: 'Reset Terminal', exact: true }).click()
+  await expectGrounded(orcaPage, electronApp, 'after Reset Terminal')
+
+  await parkHiddenTabBehindDecoy(orcaPage, worktreeId, tabId, { parkDelayMs: PARKING_DELAY_MS })
+  await activateTerminalTab(orcaPage, tabId)
+  await waitForActivePanePtyId(orcaPage)
+  await expectGrounded(orcaPage, electronApp, 'after park and reveal')
+})
diff --git a/tests/e2e/terminal-restart-persistence.spec.ts b/tests/e2e/terminal-restart-persistence.spec.ts
index b9cbd6a00b6..95bc5a4dd5d 100644
--- a/tests/e2e/terminal-restart-persistence.spec.ts
+++ b/tests/e2e/terminal-restart-persistence.spec.ts
@@ -24,187 +24,33 @@
  *   - Crash/SIGKILL recovery — that is covered by daemon history checkpoints.
  */
 
-import { readFileSync, existsSync } from 'node:fs'
-import type { ElectronApplication, Page } from '@stablyai/playwright-test'
+import type { ElectronApplication } from '@stablyai/playwright-test'
 import { test, expect } from './helpers/orca-app'
-import { TEST_REPO_PATH_FILE } from './global-setup'
 import {
-  discoverActivePtyId,
   execInTerminal,
-  waitForActiveTerminalManager,
   waitForTerminalOutput,
   waitForPaneCount,
   getTerminalContent,
   splitActiveTerminalPane
 } from './helpers/terminal'
-import {
-  waitForSessionReady,
-  waitForActiveWorktree,
-  getActiveWorktreeId,
-  getActiveTabId,
-  getWorktreeTabs,
-  ensureTerminalVisible
-} from './helpers/store'
-import { attachRepoAndOpenTerminal, createRestartSession } from './helpers/orca-restart'
+import { getActiveTabId, getWorktreeTabs } from './helpers/store'
+import { createRestartSession } from './helpers/orca-restart'
 import { PTY_SESSION_ID_SEPARATOR } from '../../src/shared/pty-session-id-format'
+import {
+  seededRepoPathOrSkip,
+  bootstrapFirstLaunch,
+  bootstrapRestoredLaunch,
+  waitForTerminalActiveLine,
+  readTerminalActiveLine,
+  setPaneTitleFromTerminalMenu,
+  getTabCustomTitle,
+  expectSavedLayoutToContainTitle
+} from './helpers/terminal-restart-persistence'
 
-const REQUIRE_WINDOWS_TERMINAL_RESTART_E2E =
-  process.env.ORCA_REQUIRE_WINDOWS_TERMINAL_RESTART_E2E === '1'
-const MISSING_SEEDED_REPO_MESSAGE = 'Global setup did not produce a seeded test repo'
-
-// Why: each test in this file does a full quit→relaunch cycle, which spawns
-// two Electron instances back-to-back. Running in serial keeps the isolated
-// userDataDirs from competing for the same Electron cache lock on cold start
-// and keeps the failure mode interpretable when something goes wrong.
+// Each test performs a full quit/relaunch cycle; serialize them to avoid
+// competing Electron cache locks and to keep failures interpretable.
 test.describe.configure({ mode: 'serial' })
 
-function seededRepoPathOrSkip(): string {
-  const repoPath = existsSync(TEST_REPO_PATH_FILE)
-    ? readFileSync(TEST_REPO_PATH_FILE, 'utf-8').trim()
-    : ''
-  const unavailable = !repoPath || !existsSync(repoPath)
-  if (unavailable && REQUIRE_WINDOWS_TERMINAL_RESTART_E2E) {
-    throw new Error('Required Windows restart E2E seeded repo is unavailable')
-  }
-  test.skip(unavailable, MISSING_SEEDED_REPO_MESSAGE)
-  return repoPath
-}
-
-/**
- * Shared bootstrap for a *first* launch: attach the seeded test repo,
- * activate its worktree, ensure a terminal is mounted, and return the
- * PTY id we can drive with `execInTerminal`.
- *
- * Why: every test in this file needs the exact same starting state on the
- * first launch. Inlining it would obscure the thing each test is actually
- * asserting about the *second* launch.
- */
-async function bootstrapFirstLaunch(
-  page: Page,
-  repoPath: string
-): Promise<{ worktreeId: string; ptyId: string }> {
-  const worktreeId = await attachRepoAndOpenTerminal(page, repoPath)
-  await waitForSessionReady(page)
-  await waitForActiveWorktree(page)
-  await ensureTerminalVisible(page)
-
-  const hasPaneManager = await waitForActiveTerminalManager(page, 30_000)
-    .then(() => true)
-    .catch(() => false)
-  if (!hasPaneManager && REQUIRE_WINDOWS_TERMINAL_RESTART_E2E) {
-    throw new Error('Required Windows restart E2E TerminalPane manager did not mount')
-  }
-  test.skip(
-    !hasPaneManager,
-    'Electron automation in this environment never mounts the TerminalPane manager, so restart-persistence assertions would only fail on harness setup.'
-  )
-  await waitForPaneCount(page, 1, 30_000)
-
-  const ptyId = await discoverActivePtyId(page)
-  return { worktreeId, ptyId }
-}
-
-/**
- * Shared bootstrap for a *second* launch: just wait for the session to
- * restore, and confirm the previously-active worktree is the active one
- * again so downstream assertions operate against the right worktree.
- */
-async function bootstrapRestoredLaunch(page: Page, expectedWorktreeId: string): Promise<void> {
-  await waitForSessionReady(page)
-  await expect
-    .poll(async () => getActiveWorktreeId(page), { timeout: 10_000 })
-    .toBe(expectedWorktreeId)
-  await ensureTerminalVisible(page)
-  // Why: the PaneManager remounts asynchronously after session hydration. The
-  // restored terminal surface is what we're about to assert against, so make
-  // sure it exists before any content/layout assertion races.
-  await waitForActiveTerminalManager(page, 30_000)
-  await waitForPaneCount(page, 1, 30_000)
-}
-
-async function setPaneTitleFromTerminalMenu(page: Page, title: string): Promise<void> {
-  const modifiers: ('Alt' | 'Control' | 'Meta' | 'Shift')[] =
-    process.platform === 'win32' ? ['Control'] : []
-  await page
-    .locator('.xterm:visible')
-    .first()
-    .click({ button: 'right', position: { x: 40, y: 40 }, modifiers })
-  await page.getByText('Set Title…', { exact: true }).click()
-  const titleInput = page.locator('.pane-title-input').first()
-  await expect(titleInput).toBeVisible()
-  await titleInput.fill(title)
-  await titleInput.press('Enter')
-}
-
-async function getTabCustomTitle(
-  page: Page,
-  worktreeId: string,
-  tabId: string
-): Promise<string | null> {
-  return page.evaluate(
-    ({ targetWorktreeId, targetTabId }) => {
-      const state = window.__store!.getState()
-      const tab = (state.tabsByWorktree[targetWorktreeId] ?? []).find(
-        (entry) => entry.id === targetTabId
-      )
-      return tab?.customTitle ?? null
-    },
-    { targetWorktreeId: worktreeId, targetTabId: tabId }
-  )
-}
-
-async function readTerminalActiveLine(page: Page): Promise<string | null> {
-  const tabId = await getActiveTabId(page)
-  if (!tabId) {
-    return null
-  }
-  return page.evaluate((tabId) => {
-    const manager = window.__paneManagers?.get(tabId)
-    const pane = manager?.getActivePane?.() ?? manager?.getPanes?.()[0] ?? null
-    const buffer = pane?.terminal?.buffer.active
-    if (!buffer) {
-      return null
-    }
-    const cursorLine = buffer.baseY + buffer.cursorY
-    return buffer.getLine(cursorLine)?.translateToString(true) ?? null
-  }, tabId)
-}
-
-async function waitForTerminalActiveLine(page: Page, expectedText: string): Promise<string> {
-  await expect
-    .poll(async () => (await readTerminalActiveLine(page))?.includes(expectedText), {
-      timeout: 15_000,
-      message: `Terminal cursor line did not contain "${expectedText}"`
-    })
-    .toBe(true)
-
-  const activeLine = await readTerminalActiveLine(page)
-  if (activeLine === null) {
-    throw new Error('Terminal cursor line disappeared after settling')
-  }
-  return activeLine
-}
-
-async function expectSavedLayoutToContainTitle(
-  page: Page,
-  tabId: string,
-  title: string
-): Promise<void> {
-  await expect
-    .poll(
-      () =>
-        page.evaluate(
-          ({ targetTabId, title }) => {
-            const layout = window.__store!.getState().terminalLayoutsByTabId[targetTabId]
-            return Object.values(layout?.titlesByLeafId ?? {}).includes(title)
-          },
-          { targetTabId: tabId, title }
-        ),
-      { timeout: 3_000 }
-    )
-    .toBe(true)
-}
-
 test.describe('Terminal restart persistence', () => {
   test('scrollback survives clean quit and relaunch', async (// oxlint-disable-next-line no-empty-pattern -- Playwright's second fixture arg is testInfo; the first must be an object destructure to opt out of the default fixture set.
   {}, testInfo) => {
diff --git a/tests/e2e/terminal-shortcuts.spec.ts b/tests/e2e/terminal-shortcuts.spec.ts
index 85524ec08f7..0ea9f19b354 100644
--- a/tests/e2e/terminal-shortcuts.spec.ts
+++ b/tests/e2e/terminal-shortcuts.spec.ts
@@ -34,6 +34,11 @@ import {
   installTerminalPtyWriteSpy as installMainProcessPtyWriteSpy,
   readTerminalPtyWrites as getPtyWrites
 } from './helpers/terminal-pty-write-spy'
+import {
+  armKittyKeyboardFromPty,
+  getKittyKeyboardFlags,
+  interruptAndExpectEtx
+} from './helpers/terminal-kitty-keyboard'
 
 async function setActivePaneForegroundAgent(
   page: Page,
@@ -65,60 +70,6 @@ async function setActivePaneForegroundAgent(
   }, agent)
 }
 
-async function dispatchCtrlCToActiveTerminalTextarea(
-  page: Page,
-  options: { keyupCtrlKey?: boolean } = {}
-): Promise<{
-  keydownDefaultPrevented: boolean
-  keyupDefaultPrevented: boolean
-}> {
-  return page.evaluate((dispatchOptions) => {
-    const state = window.__store?.getState()
-    const worktreeId = state?.activeWorktreeId
-    const tabId =
-      state?.activeTabType === 'terminal'
-        ? state.activeTabId
-        : worktreeId
-          ? (state?.activeTabIdByWorktree?.[worktreeId] ?? null)
-          : null
-    const manager = tabId ? window.__paneManagers?.get(tabId) : null
-    const pane = manager?.getActivePane?.() ?? manager?.getPanes?.()[0] ?? null
-    const textarea = pane?.container.querySelector(
-      '.xterm-helper-textarea'
-    ) as HTMLTextAreaElement | null
-    if (!pane || !textarea) {
-      throw new Error('No active terminal textarea for Ctrl+C dispatch')
-    }
-    pane.terminal.clearSelection()
-    pane.terminal.focus()
-    textarea.focus()
-
-    const createEvent = (type: 'keydown' | 'keyup', ctrlKey: boolean): KeyboardEvent => {
-      const event = new KeyboardEvent(type, {
-        key: 'c',
-        code: 'KeyC',
-        ctrlKey,
-        bubbles: true,
-        cancelable: true
-      })
-      Object.defineProperty(event, 'keyCode', { get: () => 67 })
-      Object.defineProperty(event, 'which', { get: () => 67 })
-      return event
-    }
-
-    // Why: Electron headless consumes real Ctrl+C before xterm in automation;
-    // synthetic DOM events still exercise Orca's installed xterm boundary.
-    const keydown = createEvent('keydown', true)
-    textarea.dispatchEvent(keydown)
-    const keyup = createEvent('keyup', dispatchOptions.keyupCtrlKey !== false)
-    textarea.dispatchEvent(keyup)
-    return {
-      keydownDefaultPrevented: keydown.defaultPrevented,
-      keyupDefaultPrevented: keyup.defaultPrevented
-    }
-  }, options)
-}
-
 async function focusFloatingTerminal(page: Page): Promise<void> {
   await page
     .locator(
@@ -227,53 +178,6 @@ async function getActiveTerminalViewport(
   })
 }
 
-async function enableKittyKeyboardReporting(page: Page, flags: number): Promise<void> {
-  await page.evaluate(async (flags) => {
-    const state = window.__store?.getState()
-    const worktreeId = state?.activeWorktreeId
-    const tabId =
-      state?.activeTabType === 'terminal'
-        ? state.activeTabId
-        : worktreeId
-          ? (state?.activeTabIdByWorktree?.[worktreeId] ?? null)
-          : null
-    const manager = tabId ? window.__paneManagers?.get(tabId) : null
-    const pane = manager?.getActivePane?.() ?? manager?.getPanes?.()[0] ?? null
-    if (!pane) {
-      throw new Error('No active terminal pane for kitty keyboard setup')
-    }
-    await new Promise<void>((resolve) => {
-      pane.terminal.write(`\x1b[=${flags}u`, resolve)
-    })
-  }, flags)
-}
-
-async function getKittyKeyboardFlags(page: Page): Promise<number | null> {
-  return page.evaluate(() => {
-    const state = window.__store?.getState()
-    const worktreeId = state?.activeWorktreeId
-    const tabId =
-      state?.activeTabType === 'terminal'
-        ? state.activeTabId
-        : worktreeId
-          ? (state?.activeTabIdByWorktree?.[worktreeId] ?? null)
-          : null
-    const manager = tabId ? window.__paneManagers?.get(tabId) : null
-    const pane = manager?.getActivePane?.() ?? manager?.getPanes?.()[0] ?? null
-    const terminal = pane?.terminal as
-      | {
-          core?: { coreService?: { kittyKeyboard?: { flags?: number } } }
-          _core?: { coreService?: { kittyKeyboard?: { flags?: number } } }
-        }
-      | undefined
-    return (
-      terminal?.core?.coreService?.kittyKeyboard?.flags ??
-      terminal?._core?.coreService?.kittyKeyboard?.flags ??
-      null
-    )
-  })
-}
-
 async function pressShiftedRussianLayoutKey(page: Page): Promise<{
   keydownDefaultPrevented: boolean
   keypressSent: boolean
@@ -481,14 +385,12 @@ test.describe('Terminal Shortcuts', () => {
 
     // Why: exercise the production PTY-output tracker, not xterm's renderer-
     // local flag state, so the test covers the bytes the shortcut policy sees.
-    await execInTerminal(orcaPage, ptyId, "printf '\\033[>1u'")
+    // The command disarms its own flags: ones left armed at exit are grounded by the host.
+    await execInTerminal(orcaPage, ptyId, "printf '\\033[>1u'; read -r _; printf '\\033[<u'")
     await expect.poll(() => getKittyKeyboardFlags(orcaPage)).toBe(1)
     await pressAndExpectWrite(orcaPage, electronApp, 'Shift+Enter', '\x1b[13;2u')
 
-    // Clear the shell's unconsumed CSI-u line before resetting flags in a settled
-    // command; otherwise its line editor can swallow the reset bytes.
-    await sendToTerminal(orcaPage, ptyId, '\x15\x03')
-    await execInTerminal(orcaPage, ptyId, "printf '\\033[=0u'")
+    await sendToTerminal(orcaPage, ptyId, '\r')
     await expect.poll(() => getKittyKeyboardFlags(orcaPage)).toBe(0)
     await pressAndExpectWrite(orcaPage, electronApp, 'Shift+Enter', '\x1b\r')
   })
@@ -552,42 +454,55 @@ test.describe('Terminal Shortcuts', () => {
     await pressAndExpectWrite(orcaPage, electronApp, 'Control+Enter', '\x1b[13;5u')
   })
 
-  test('plain Ctrl+C sends ETX under kitty keyboard reporting', async ({
+  test('plain Ctrl+C sends ETX and leaves a surviving app its kitty flags', async ({
     orcaPage,
     electronApp
   }) => {
+    test.skip(process.platform === 'win32', 'POSIX trap and printf fixture')
     await installMainProcessPtyWriteSpy(electronApp)
-    await waitForActivePanePtyId(orcaPage)
-    await enableKittyKeyboardReporting(orcaPage, 31)
-    await clearPtyWriteLog(electronApp)
-    await focusActiveTerminalInput(orcaPage)
-    await orcaPage.keyboard.down('Control')
-    await orcaPage.keyboard.up('Control')
-    expect((await getPtyWrites(electronApp)).join('')).toBe('')
-    await clearPtyWriteLog(electronApp)
+    const ptyId = await waitForActivePanePtyId(orcaPage)
+    // SIGINT during shell startup kills the shell, so interrupt only a ready prompt.
+    await execInTerminal(orcaPage, ptyId, 'echo "CTRL_C_""READY"')
+    await waitForTerminalOutput(orcaPage, 'CTRL_C_READY')
+    // An app that survives SIGINT, like an agent TUI, and disarms its own flags on exit.
+    await armKittyKeyboardFromPty(
+      orcaPage,
+      ptyId,
+      `bash -c 'trap "" INT; printf "\\033[=31u"; read -r _; printf "\\033[=0u"'`
+    )
 
-    expect(await dispatchCtrlCToActiveTerminalTextarea(orcaPage, { keyupCtrlKey: false })).toEqual({
-      keydownDefaultPrevented: false,
-      keyupDefaultPrevented: false
-    })
+    await interruptAndExpectEtx(orcaPage, electronApp)
 
-    await expect
-      .poll(async () => (await getPtyWrites(electronApp)).some((write) => write.includes('\x03')), {
-        timeout: 5_000,
-        message: 'Ctrl+C did not reach the PTY as ETX'
-      })
-      .toBe(true)
-    const writes = (await getPtyWrites(electronApp)).join('')
-    expect(writes).not.toContain('\x1b[99;5u')
-    expect(writes).not.toContain('\x1b[99')
+    // Orca no longer guesses the app died: xterm keeps encoding for it, and the
+    // mirror the shortcut policy reads agrees (Shift+Enter stays CSI-u).
+    expect(await getKittyKeyboardFlags(orcaPage)).toBe(31)
+    await pressAndExpectWrite(orcaPage, electronApp, 'Shift+Enter', '\x1b[13;2u')
+
+    await sendToTerminal(orcaPage, ptyId, '\r')
+    await expect.poll(async () => await getKittyKeyboardFlags(orcaPage)).toBe(0)
+    await pressAndExpectWrite(orcaPage, electronApp, 'Shift+Enter', '\x1b\r')
+  })
+
+  test('the host grounds kitty flags an app killed by Ctrl+C left armed', async ({
+    orcaPage,
+    electronApp
+  }) => {
+    test.skip(process.platform === 'win32', 'POSIX printf fixture')
+    await installMainProcessPtyWriteSpy(electronApp)
+    const ptyId = await waitForActivePanePtyId(orcaPage)
+    await execInTerminal(orcaPage, ptyId, 'echo "CTRL_C_""READY"')
+    await waitForTerminalOutput(orcaPage, 'CTRL_C_READY')
+    // `cat` dies on SIGINT with the flags still armed, like a crashed TUI.
+    await armKittyKeyboardFromPty(orcaPage, ptyId, `printf '\\033[=31u'; cat`)
+
+    await interruptAndExpectEtx(orcaPage, electronApp)
 
     await expect
       .poll(async () => await getKittyKeyboardFlags(orcaPage), {
         timeout: 5_000,
-        message: 'Ctrl+C did not clear stale Kitty keyboard flags'
+        message: 'the host did not ground the dead app kitty flags at command end'
       })
       .toBe(0)
-
     await clearPtyWriteLog(electronApp)
     await focusActiveTerminalInput(orcaPage)
     await orcaPage.keyboard.type('x')
@@ -597,11 +512,85 @@ test.describe('Terminal Shortcuts', () => {
         message: 'Post-interrupt keyboard input stayed in Kitty CSI-u mode'
       })
       .toBe(true)
-    const postInterruptWrites = (await getPtyWrites(electronApp)).join('')
-    expect(postInterruptWrites).not.toContain('\x1b[')
+    expect((await getPtyWrites(electronApp)).join('')).not.toContain('\x1b[')
     await orcaPage.keyboard.press('Backspace')
   })
 
+  test('unselected Cmd+C reaches a Kitty app, including after Ctrl+C', async ({
+    orcaPage,
+    electronApp
+  }) => {
+    test.skip(process.platform !== 'darwin', 'macOS copy binding')
+    await installMainProcessPtyWriteSpy(electronApp)
+    const ptyId = await waitForActivePanePtyId(orcaPage)
+    await execInTerminal(orcaPage, ptyId, 'echo "CMD_C_""READY"')
+    await waitForTerminalOutput(orcaPage, 'CMD_C_READY')
+    const select = (text: string | null): Promise<string> =>
+      orcaPage.evaluate(async (selectedText) => {
+        const state = window.__store!.getState()
+        const pane = window.__paneManagers!.get(state.activeTabId!)!.getActivePane()!
+        if (selectedText === null) {
+          pane.terminal.clearSelection()
+          return ''
+        }
+        await new Promise<void>((resolve) =>
+          pane.terminal.write(`\r\n${selectedText}\r\n`, resolve)
+        )
+        const buffer = pane.terminal.buffer.active
+        pane.terminal.select(0, buffer.baseY + buffer.cursorY - 1, selectedText.length)
+        return pane.terminal.getSelection()
+      }, text)
+    // Presses Cmd+C, then a marker chord whose write proves the Cmd+C bytes had their turn.
+    const pressCmdC = async (marker: string, markerWrite: string): Promise<string[]> => {
+      await clearPtyWriteLog(electronApp)
+      await focusActiveTerminalInput(orcaPage)
+      await orcaPage.keyboard.press('Meta+c')
+      await orcaPage.keyboard.press(marker)
+      await expect.poll(async () => await getPtyWrites(electronApp)).toContain(markerWrite)
+      const writes = await getPtyWrites(electronApp)
+      return writes.slice(0, writes.indexOf(markerWrite))
+    }
+    const kittyCmdC = ['\x1b[99;9;99u', '\x1b[99;9:3u']
+    const originalClipboard = await electronApp.evaluate(({ clipboard }) => clipboard.readText())
+    try {
+      await select(null)
+      expect(await pressCmdC('x', 'x')).toEqual([])
+      await orcaPage.keyboard.press('Backspace')
+
+      // An app that survives SIGINT, like an agent TUI, and disarms its own flags on exit.
+      await armKittyKeyboardFromPty(
+        orcaPage,
+        ptyId,
+        `bash -c 'trap "" INT; printf "\\033[=31u"; read -r _; printf "\\033[=0u"'`
+      )
+      await select(null)
+      expect(await pressCmdC('Shift+Enter', '\x1b[13;2u')).toEqual(kittyCmdC)
+
+      const selectedText = await select('Terminal copy selection')
+      expect(selectedText).toBe('Terminal copy selection')
+      await electronApp.evaluate(({ clipboard }) => clipboard.writeText(''))
+      expect(await pressCmdC('Shift+Enter', '\x1b[13;2u')).toEqual([])
+      await expect
+        .poll(() => electronApp.evaluate(({ clipboard }) => clipboard.readText()))
+        .toBe(selectedText)
+
+      await interruptAndExpectEtx(orcaPage, electronApp)
+      expect(await getKittyKeyboardFlags(orcaPage)).toBe(31)
+      await select(null)
+      expect(await pressCmdC('Shift+Enter', '\x1b[13;2u')).toEqual(kittyCmdC)
+
+      await sendToTerminal(orcaPage, ptyId, '\r')
+      await expect.poll(async () => await getKittyKeyboardFlags(orcaPage)).toBe(0)
+      expect(await pressCmdC('x', 'x')).toEqual([])
+      await orcaPage.keyboard.press('Backspace')
+    } finally {
+      await electronApp.evaluate(
+        ({ clipboard }, text) => clipboard.writeText(text),
+        originalClipboard
+      )
+    }
+  })
+
   test('@headful Codex-like background output stays visible without disabling WebGL in auto mode', async ({
     orcaPage
   }) => {
@@ -909,12 +898,13 @@ test.describe('Terminal Shortcuts', () => {
     orcaPage,
     electronApp
   }) => {
+    test.skip(process.platform === 'win32', 'ConPTY panes withhold the kitty protocol')
     await installMainProcessPtyWriteSpy(electronApp)
     // Why: CI can mount the xterm surface before the pane transport has a
     // live PTY. Probe first so xterm onData cannot race a disconnected
     // sendInput path, then clear the probe writes before the layout assertion.
-    await waitForActivePanePtyId(orcaPage)
-    await enableKittyKeyboardReporting(orcaPage, 31)
+    const ptyId = await waitForActivePanePtyId(orcaPage)
+    await armKittyKeyboardFromPty(orcaPage, ptyId, `printf '\\033[=31u'; cat`)
     await clearPtyWriteLog(electronApp)
 
     const dispatch = await pressShiftedRussianLayoutKey(orcaPage)
@@ -936,5 +926,6 @@ test.describe('Terminal Shortcuts', () => {
     const joinedWrites = writes.join('')
     expect(joinedWrites).not.toContain('\x1b[97:1060;2;1060u')
     expect(joinedWrites).not.toContain('\x1b[97:1060;2:3u')
+    await sendToTerminal(orcaPage, ptyId, '\x03')
   })
 })
diff --git a/tests/e2e/terminal-tab-close-restart-persistence.spec.ts b/tests/e2e/terminal-tab-close-restart-persistence.spec.ts
index 9df296d287b..20421dd1730 100644
--- a/tests/e2e/terminal-tab-close-restart-persistence.spec.ts
+++ b/tests/e2e/terminal-tab-close-restart-persistence.spec.ts
@@ -137,8 +137,19 @@ test('durable whole-tab close removes a split tab across restart', async (// oxl
     const secondLaunch = await session.launch()
     secondApp = secondLaunch.app
     await waitForSessionReady(secondLaunch.page)
-    const restoredWorktreeId = await attachRepoAndOpenTerminal(secondLaunch.page, repoPath)
-    expect(restoredWorktreeId).toBe(worktreeId)
+    // Activation deliberately creates a fresh terminal; observe passive hydration first.
+    await expect
+      .poll(() =>
+        secondLaunch.page.evaluate(
+          (id) =>
+            window.__store
+              ?.getState()
+              .allWorktrees()
+              .some((worktree) => worktree.id === id),
+          worktreeId
+        )
+      )
+      .toBe(true)
 
     // Why: wait past initial worktree effects so this checks resurrection, not
     // only the first hydrated frame before default-tab logic has run.
diff --git a/tests/e2e/terminal-tui-wheel-reports.spec.ts b/tests/e2e/terminal-tui-wheel-reports.spec.ts
index ab02cf7a98b..f3259409cdb 100644
--- a/tests/e2e/terminal-tui-wheel-reports.spec.ts
+++ b/tests/e2e/terminal-tui-wheel-reports.spec.ts
@@ -47,8 +47,6 @@ async function probeSmallMouseWheelReports(
       const reports: string[] = []
       const disposable = pane.terminal.onData((data) => reports.push(data))
       try {
-        await new Promise<void>((resolve) => pane.terminal.write('\x1b[?1003h\x1b[?1006h', resolve))
-        await new Promise((resolve) => requestAnimationFrame(() => resolve(undefined)))
         if (!pane.terminal.element.classList.contains('enable-mouse-events')) {
           throw new Error('Mouse reporting mode did not activate')
         }
@@ -139,8 +137,6 @@ async function probeTimedSmallMouseWheelReports(
       const reports: string[] = []
       const disposable = pane.terminal.onData((data) => reports.push(data))
       try {
-        await new Promise<void>((resolve) => pane.terminal.write('\x1b[?1003h\x1b[?1006h', resolve))
-        await new Promise((resolve) => requestAnimationFrame(() => resolve(undefined)))
         if (!pane.terminal.element.classList.contains('enable-mouse-events')) {
           throw new Error('Mouse reporting mode did not activate')
         }
@@ -284,6 +280,18 @@ async function dispatchTuiWheel(
   }, options)
 }
 
+// Let a running TUI own mouse mode; late shell startup output can reset injected modes.
+async function startTuiFixture(page: Page): Promise<void> {
+  const ptyId = await waitForActivePanePtyId(page)
+  await execInTerminal(page, ptyId, `node ${JSON.stringify(VISIBLE_TUI_FIXTURE_PATH)}`)
+  await expect
+    .poll(() => readVisibleTuiOffset(page), {
+      timeout: 10_000,
+      message: 'fullscreen TUI did not render numbered rows'
+    })
+    .toBe(0)
+}
+
 test.describe('terminal TUI wheel reports', () => {
   test('notched mouse wheel ticks produce immediate mouse-reporting TUI scroll reports', async ({
     orcaPage
@@ -296,6 +304,7 @@ test.describe('terminal TUI wheel reports', () => {
       window.__store?.getState().updateSettings({ terminalTuiScrollSensitivity: 1 })
     )
 
+    await startTuiFixture(orcaPage)
     const samples = await probeSmallMouseWheelReports(orcaPage, 4)
 
     expect(
@@ -338,15 +347,7 @@ test.describe('terminal TUI wheel reports', () => {
       window.__store?.getState().updateSettings({ terminalTuiScrollSensitivity: 1 })
     )
 
-    const ptyId = await waitForActivePanePtyId(orcaPage)
-    await execInTerminal(orcaPage, ptyId, `node ${JSON.stringify(VISIBLE_TUI_FIXTURE_PATH)}`)
-
-    await expect
-      .poll(() => readVisibleTuiOffset(orcaPage), {
-        timeout: 10_000,
-        message: 'visible fullscreen TUI did not render numbered rows'
-      })
-      .toBe(0)
+    await startTuiFixture(orcaPage)
 
     await dispatchTuiWheel(orcaPage, {
       deltaY: 10,
@@ -399,6 +400,7 @@ test.describe('terminal TUI wheel reports', () => {
       window.__store?.getState().updateSettings({ terminalTuiScrollSensitivity: 5 })
     )
 
+    await startTuiFixture(orcaPage)
     const slow = await probeTimedSmallMouseWheelReports(orcaPage, {
       drainWaitMs: 120,
       intervalMs: 220,
diff --git a/tests/e2e/workspace-session-corrupt-tab-salvage.spec.ts b/tests/e2e/workspace-session-corrupt-tab-salvage.spec.ts
index 50c3d153101..26ce06e0da8 100644
--- a/tests/e2e/workspace-session-corrupt-tab-salvage.spec.ts
+++ b/tests/e2e/workspace-session-corrupt-tab-salvage.spec.ts
@@ -1,7 +1,9 @@
-import { existsSync, readFileSync, writeFileSync } from 'node:fs'
-import path from 'node:path'
+import {
+  readPersistedProfileState,
+  mutateStoppedProfileState
+} from './helpers/persisted-profile-state'
+import { existsSync, readFileSync } from 'node:fs'
 import type { ElectronApplication, Page } from '@stablyai/playwright-test'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 import { test, expect } from './helpers/orca-app'
 import { attachRepoAndOpenTerminal, createRestartSession } from './helpers/orca-restart'
 import { ensureTerminalVisible, getActiveWorktreeId, waitForSessionReady } from './helpers/store'
@@ -18,34 +20,32 @@ type PersistedData = {
   }
 }
 
-function persistedDataPath(userDataDir: string): string {
-  return path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID, 'orca-data.json')
-}
-
 function injectTruncatedTab(userDataDir: string, worktreeId: string, startupCwd: string): void {
-  const dataPath = persistedDataPath(userDataDir)
-  const data = JSON.parse(readFileSync(dataPath, 'utf8')) as PersistedData
-  const tabs = data.workspaceSession?.tabsByWorktree?.[worktreeId]
-  if (!tabs) {
-    throw new Error('Persisted terminal tabs were unavailable for corruption seeding')
-  }
-  tabs.push({
-    id: CORRUPT_TAB_ID,
-    ptyId: null,
-    worktreeId,
-    title: 'Truncated terminal',
-    sortOrder: 999,
-    generation: 3,
-    startupCwd
+  return mutateStoppedProfileState(userDataDir, (state) => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+    const data = state as PersistedData
+    const tabs = data.workspaceSession?.tabsByWorktree?.[worktreeId]
+    if (!tabs) {
+      throw new Error('Persisted terminal tabs were unavailable for corruption seeding')
+    }
+    tabs.push({
+      id: CORRUPT_TAB_ID,
+      ptyId: null,
+      worktreeId,
+      title: 'Truncated terminal',
+      sortOrder: 999,
+      generation: 3,
+      startupCwd
+    })
   })
-  writeFileSync(dataPath, `${JSON.stringify(data, null, 2)}\n`)
 }
 
 function persistedSessionEvidence(
   userDataDir: string,
   worktreeId: string
 ): { corruptLegacyTabPresent: boolean; unifiedTabIds: string[] } {
-  const data = JSON.parse(readFileSync(persistedDataPath(userDataDir), 'utf8')) as PersistedData
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+  const data = readPersistedProfileState(userDataDir) as PersistedData
   const legacyTabs = data.workspaceSession?.tabsByWorktree?.[worktreeId] ?? []
   const unifiedTabs = data.workspaceSession?.unifiedTabs?.[worktreeId] ?? []
   return {
diff --git a/tests/e2e/worktree-jump-sleep-focus.spec.ts b/tests/e2e/worktree-jump-sleep-focus.spec.ts
new file mode 100644
index 00000000000..eacdea6b892
--- /dev/null
+++ b/tests/e2e/worktree-jump-sleep-focus.spec.ts
@@ -0,0 +1,68 @@
+import { test, expect } from './helpers/orca-app'
+import {
+  ensureTerminalVisible,
+  getAllWorktreeIds,
+  switchToWorktree,
+  waitForActiveWorktree,
+  waitForSessionReady
+} from './helpers/store'
+import {
+  waitForActivePanePtyId,
+  waitForActiveTerminalManager,
+  waitForTerminalOutput
+} from './helpers/terminal'
+
+test('Cmd+J focuses the terminal after waking a sleeping workspace', async ({
+  orcaPage
+}, testInfo) => {
+  await waitForSessionReady(orcaPage)
+  const source = await waitForActiveWorktree(orcaPage)
+  const target = (await getAllWorktreeIds(orcaPage)).find((id) => id !== source)
+  if (!target) {
+    throw new Error('Expected a second seeded workspace')
+  }
+  await switchToWorktree(orcaPage, target)
+  await ensureTerminalVisible(orcaPage)
+  await waitForActiveTerminalManager(orcaPage)
+  await waitForActivePanePtyId(orcaPage)
+  const targetName = await orcaPage.evaluate((id) => {
+    const state = window.__store!.getState()
+    const worktree = state.getKnownWorktreeById(id)
+    if (!worktree) {
+      throw new Error('Missing target workspace')
+    }
+    return worktree.branch.replace(/^refs\/heads\//, '')
+  }, target)
+  await switchToWorktree(orcaPage, source)
+  await orcaPage.evaluate(async (id) => {
+    await window.__store!.getState().shutdownWorktreeTerminals(id, { keepIdentifiers: true })
+  }, target)
+  await orcaPage.evaluate(() => {
+    const listSessions = window.api.pty.listSessions
+    window.api.pty.listSessions = async (...args) => {
+      await new Promise((resolve) => setTimeout(resolve, 100))
+      return listSessions(...args)
+    }
+  })
+  // Native menu accelerators require OS focus; open the same palette in the hidden renderer.
+  await orcaPage.evaluate(() => window.__store!.getState().openModal('worktree-palette'))
+  const dialog = orcaPage.getByRole('dialog', { name: 'Jump to...' })
+  await expect(dialog).toBeVisible()
+  await dialog.getByRole('combobox').fill(targetName)
+  await expect(dialog.locator('[cmdk-item][data-selected="true"]')).toContainText(targetName)
+  const cdp = await orcaPage.context().newCDPSession(orcaPage)
+  await cdp.send('Emulation.setCPUThrottlingRate', { rate: 8 })
+  await orcaPage.keyboard.press('Enter')
+  await expect(dialog).toBeHidden()
+  await waitForActiveTerminalManager(orcaPage)
+  await waitForActivePanePtyId(orcaPage)
+  const terminal = orcaPage.locator('[data-terminal-tab-id]:visible .xterm-helper-textarea').first()
+  await orcaPage.screenshot({ path: testInfo.outputPath('wake-focus.png') })
+  await expect(terminal).toBeFocused()
+  await cdp.send('Emulation.setCPUThrottlingRate', { rate: 1 })
+  await cdp.detach()
+  await orcaPage.keyboard.type('echo WAKE_KEYBOARD_OK')
+  await orcaPage.keyboard.press('Enter')
+  await waitForTerminalOutput(orcaPage, 'WAKE_KEYBOARD_OK')
+  await orcaPage.screenshot({ path: testInfo.outputPath('wake-typing.png') })
+})
diff --git a/tests/e2e/worktree-scroll-to-current.spec.ts b/tests/e2e/worktree-scroll-to-current.spec.ts
index 07f9f87d05c..cdb39420ef0 100644
--- a/tests/e2e/worktree-scroll-to-current.spec.ts
+++ b/tests/e2e/worktree-scroll-to-current.spec.ts
@@ -40,7 +40,7 @@ test.describe('Reveal active workspace button', () => {
   // (not a scenario real users hit). Reveal-into-view is covered robustly by
   // the "outside the virtualized window" test below.
 
-  test('clears sidebar filters before revealing a hidden current workspace', async ({
+  test('adjusts sidebar filters before revealing a hidden current workspace', async ({
     orcaPage,
     testRepoPath
   }, testInfo) => {
@@ -94,6 +94,13 @@ test.describe('Reveal active workspace button', () => {
     if (!targetId) {
       throw new Error('Seeded secondary worktree is missing')
     }
+    const targetRepoId = await orcaPage.evaluate(
+      (repoPath) => window.__store!.getState().repos.find((repo) => repo.path === repoPath)?.id,
+      testRepoPath
+    )
+    if (!targetRepoId) {
+      throw new Error('Seeded repository is missing')
+    }
 
     const targetRows = orcaPage.locator(
       `[data-worktree-sidebar] [data-worktree-id=${JSON.stringify(targetId)}]`
@@ -132,7 +139,7 @@ test.describe('Reveal active workspace button', () => {
     await revealButton.click()
     await orcaPage
       .getByRole('dialog', { name: 'Reveal hidden workspace?' })
-      .getByRole('button', { name: 'Clear filters and reveal' })
+      .getByRole('button', { name: 'Adjust filters and reveal' })
       .click()
 
     await expect(targetRow).toBeVisible()
@@ -149,10 +156,11 @@ test.describe('Reveal active workspace button', () => {
           }),
         {
           timeout: 10_000,
-          message: 'Reveal button should clear repo filters that hide the current workspace'
+          message:
+            'Reveal button should preserve selected repos while revealing the current workspace'
         }
       )
-      .toEqual([])
+      .toEqual([filterRepoId, targetRepoId])
   })
 
   test('reveals the current workspace when it starts outside the virtualized window', async ({
diff --git a/tests/tools/google-signin-ua-probe.cjs b/tests/tools/google-signin-ua-probe.cjs
index 47d8b419d7a..2b3e9638720 100644
--- a/tests/tools/google-signin-ua-probe.cjs
+++ b/tests/tools/google-signin-ua-probe.cjs
@@ -241,7 +241,7 @@ app.whenReady().then(async () => {
       return
     }
     if (isAppMode) {
-      // Mirror applyGoogleAuthUserAgent: Firefox UA on auth navs, restore the
+      // Mirror presentTabIdentityAtNavigationStart: Firefox UA on auth navs, restore the
       // cleaned session UA otherwise. This WebContents UA is what leaks onto
       // cross-host subresource requests while the auth document is on screen.
       const current = window.webContents.getUserAgent()
diff --git a/tests/tools/omp-source-control-runtime-smoke.mjs b/tests/tools/omp-source-control-runtime-smoke.mjs
index 8dce4a54775..9e806320270 100644
--- a/tests/tools/omp-source-control-runtime-smoke.mjs
+++ b/tests/tools/omp-source-control-runtime-smoke.mjs
@@ -4,7 +4,9 @@ import { join, resolve } from 'node:path'
 import { getCommitMessageAgentSpec } from '../../src/shared/commit-message-agent-spec.ts'
 const reference = process.argv[2]
 assert.ok(reference, 'Pass the read-only source checkout path')
-const { parseArgs } = await import(pathToFileURL(join(resolve(reference), 'packages/coding-agent/src/cli/args.ts')).href)
+const { parseArgs } = await import(
+  pathToFileURL(join(resolve(reference), 'packages/coding-agent/src/cli/args.ts')).href
+)
 const spec = getCommitMessageAgentSpec('omp')
 assert.ok(spec)
 for (const model of ['default', 'provider/model']) {
@@ -20,4 +22,12 @@ for (const model of ['default', 'provider/model']) {
   assert.equal(parsed.model, model === 'default' ? undefined : model)
   assert.deepEqual(parsed.messages, [])
 }
-console.log(JSON.stringify({ actualArgumentParser: true, promptDelivery: spec.promptDelivery, configDefault: true, explicitModel: true, modelCalls: 0 }))
+console.log(
+  JSON.stringify({
+    actualArgumentParser: true,
+    promptDelivery: spec.promptDelivery,
+    configDefault: true,
+    explicitModel: true,
+    modelCalls: 0
+  })
+)
diff --git a/tests/tools/win-update-e2e/app-driver.mjs b/tests/tools/win-update-e2e/app-driver.mjs
index 33f59121f87..62165bfdcd1 100644
--- a/tests/tools/win-update-e2e/app-driver.mjs
+++ b/tests/tools/win-update-e2e/app-driver.mjs
@@ -20,6 +20,7 @@ import { execFileSync } from 'node:child_process'
 import { mkdirSync, realpathSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import { seedFreshProfile } from './onboarding-profile.mjs'
+import { isPidAlive } from './daemon-processes.mjs'
 
 const NEW_TAB_BUTTON = { role: 'button', name: 'New tab' }
 const NEW_TERMINAL_ITEM = /New Terminal/i
@@ -237,7 +238,7 @@ export async function waitForTerminalReady(page, timeoutMs = 60_000, terminalTab
  *     workspace (which would mask a broken restore).
  */
 export async function ensureTerminal(page, { allowCreate = true, timeoutMs = 60_000 } = {}) {
-  // Why: the agent-CLI feature-wall modal can already be up at first interaction
+  // Why: a feature-tip modal can already be up at first interaction
   // (it renders off an async capability check that races app launch). Use the
   // Escape-free dismissal so we never inject a keypress into a restored terminal.
   await dismissKnownOverlays(page)
@@ -295,14 +296,20 @@ async function createWorkspaceFromSeededRepo(page, timeoutMs) {
 }
 
 const OVERLAY_DISMISS_LABELS = ['Got it', 'Dismiss setup scripts', 'Dismiss tip', 'Dismiss update']
-const CLI_FEATURE_TIP_TITLE = 'Let agents drive Orca with the Orca CLI'
+const FEATURE_TIP_DIALOG_TITLES = [
+  'Let agents drive Orca with the Orca CLI',
+  'Search every agent session'
+]
 
 async function dismissKnownOverlays(page) {
   let acted = false
-  const cliFeatureTip = page.getByRole('dialog', { name: CLI_FEATURE_TIP_TITLE }).first()
-  if (await cliFeatureTip.isVisible().catch(() => false)) {
+  for (const name of FEATURE_TIP_DIALOG_TITLES) {
+    const featureTip = page.getByRole('dialog', { name }).first()
+    if (!(await featureTip.isVisible().catch(() => false))) {
+      continue
+    }
     // Why: a global "Close" role also matches the Windows/Linux title-bar button.
-    const dialogClose = cliFeatureTip.locator('[data-slot="dialog-close"]').first()
+    const dialogClose = featureTip.locator('[data-slot="dialog-close"]').first()
     if (await dialogClose.isVisible().catch(() => false)) {
       const clicked = await dialogClose
         .click({ timeout: 3_000 })
@@ -484,30 +491,84 @@ export async function readTerminalTextBestEffort(page) {
   })
 }
 
-/**
- * Close the app gracefully; force-kill its process tree on timeout. Mirrors
- * tests/e2e/helpers/electron-process-shutdown.ts so the daemon (detached) is
- * left alive exactly as a normal quit would.
- */
-export async function closeApp(app, timeoutMs = 10_000) {
+const appShutdownProcesses = {
+  isPidAlive,
+  killTree(pid) {
+    execFileSync('taskkill', ['/pid', String(pid), '/T', '/F'], { stdio: 'ignore' })
+  }
+}
+
+/** Cleanup may kill the tree; survival proofs must disable that fallback. */
+export async function closeApp(
+  app,
+  timeoutMs = 10_000,
+  { allowForceKill = true, processes = appShutdownProcesses } = {}
+) {
   // A partially-created session (launch failed before assignment) passes undefined.
   if (!app) {
     return
   }
-  const mainPid = await resolveElectronMainPid(app)
+  const mainPid = await resolveElectronMainPid(app, { allowLauncherFallback: allowForceKill })
+  const launcher = app.process()
+  let closeStatus = 'not-started'
   let closeTimeout
   try {
+    if (!allowForceKill && mainPid === null) {
+      throw new Error('Cannot verify graceful close without the authoritative Electron PID')
+    }
+    closeStatus = 'pending'
+    const closePromise = app.close().then(
+      () => {
+        closeStatus = 'resolved'
+      },
+      (error) => {
+        closeStatus = 'rejected'
+        throw error
+      }
+    )
     await Promise.race([
-      app.close(),
+      closePromise,
       new Promise((_, reject) => {
         closeTimeout = setTimeout(() => reject(new Error('close timeout')), timeoutMs)
         closeTimeout.unref?.()
       })
     ])
-  } catch {
+    if (!allowForceKill && processes.isPidAlive(mainPid)) {
+      throw new Error('Playwright close resolved while the authoritative Electron PID remains live')
+    }
+  } catch (error) {
+    if (!allowForceKill) {
+      const evidence = {
+        closeStatus,
+        error: error instanceof Error ? error.message : String(error),
+        main: readClosePidEvidence(mainPid, processes),
+        launcher: {
+          ...readClosePidEvidence(launcher?.pid, processes),
+          exitCode: launcher?.exitCode ?? null,
+          signalCode: launcher?.signalCode ?? null,
+          stdio:
+            launcher?.stdio.map((pipe, fd) => ({
+              fd,
+              destroyed: pipe?.destroyed ?? null,
+              readableEnded: pipe?.readableEnded ?? null
+            })) ?? []
+        }
+      }
+      // A surviving daemon can keep the launcher's pipes open after both app processes exit.
+      if (
+        closeStatus === 'pending' &&
+        evidence.main.state === 'exited' &&
+        evidence.launcher.state === 'exited'
+      ) {
+        console.log(`[win-update-e2e] close-verified-by-pids: ${JSON.stringify(evidence)}`)
+        return
+      }
+      console.error(`[win-update-e2e] strict-close-failed: ${JSON.stringify(evidence)}`)
+      throw error
+    }
     if (mainPid) {
       try {
-        execFileSync('taskkill', ['/pid', String(mainPid), '/T', '/F'], { stdio: 'ignore' })
+        processes.killTree(mainPid)
       } catch {
         /* already gone */
       }
@@ -518,3 +579,18 @@ export async function closeApp(app, timeoutMs = 10_000) {
     clearTimeout(closeTimeout)
   }
 }
+
+function readClosePidEvidence(pid, processes) {
+  if (!Number.isInteger(pid) || pid <= 0) {
+    return { pid: pid ?? null, state: 'unverifiable', error: 'PID unavailable' }
+  }
+  try {
+    return { pid, state: processes.isPidAlive(pid) ? 'live' : 'exited' }
+  } catch (error) {
+    return {
+      pid,
+      state: 'unverifiable',
+      error: error instanceof Error ? error.message : String(error)
+    }
+  }
+}
diff --git a/tests/tools/win-update-e2e/app-driver.test.mjs b/tests/tools/win-update-e2e/app-driver.test.mjs
index ac034766257..14eda7caf17 100644
--- a/tests/tools/win-update-e2e/app-driver.test.mjs
+++ b/tests/tools/win-update-e2e/app-driver.test.mjs
@@ -10,46 +10,51 @@ function hiddenButton() {
   }
 }
 
+const FEATURE_TIP_TITLES = ['Let agents drive Orca with the Orca CLI', 'Search every agent session']
+
 describe('dismissOverlays', () => {
-  it('dismisses a dialog without clicking the desktop window Close button', async () => {
-    const dialogClose = {
-      first: vi.fn(),
-      isVisible: vi.fn().mockResolvedValue(true),
-      click: vi.fn().mockResolvedValue(undefined)
-    }
-    dialogClose.first.mockReturnValue(dialogClose)
-    const windowClose = {
-      first: vi.fn(),
-      isVisible: vi.fn().mockResolvedValue(true),
-      click: vi.fn().mockRejectedValue(new Error('window closed'))
-    }
-    windowClose.first.mockReturnValue(windowClose)
-    const featureTipDialog = {
-      first: vi.fn(),
-      isVisible: vi.fn().mockResolvedValue(true),
-      locator: vi.fn().mockReturnValue(dialogClose)
-    }
-    featureTipDialog.first.mockReturnValue(featureTipDialog)
+  it.each(FEATURE_TIP_TITLES)(
+    'dismisses %s without clicking the desktop window Close button',
+    async (title) => {
+      const dialogClose = {
+        first: vi.fn(),
+        isVisible: vi.fn().mockResolvedValue(true),
+        click: vi.fn().mockResolvedValue(undefined)
+      }
+      dialogClose.first.mockReturnValue(dialogClose)
+      const windowClose = {
+        first: vi.fn(),
+        isVisible: vi.fn().mockResolvedValue(true),
+        click: vi.fn().mockRejectedValue(new Error('window closed'))
+      }
+      windowClose.first.mockReturnValue(windowClose)
+      const featureTipDialog = {
+        first: vi.fn(),
+        isVisible: vi.fn().mockResolvedValue(true),
+        locator: vi.fn().mockReturnValue(dialogClose)
+      }
+      featureTipDialog.first.mockReturnValue(featureTipDialog)
 
-    const page = {
-      getByRole: vi.fn((role, { name }) => {
-        if (role === 'dialog') {
-          return featureTipDialog
-        }
-        return name === 'Close' ? windowClose : hiddenButton()
-      }),
-      keyboard: { press: vi.fn().mockResolvedValue(undefined) },
-      waitForTimeout: vi.fn().mockResolvedValue(undefined)
+      const page = {
+        getByRole: vi.fn((role, { name }) => {
+          if (role === 'dialog') {
+            return name === title ? featureTipDialog : hiddenButton()
+          }
+          return name === 'Close' ? windowClose : hiddenButton()
+        }),
+        keyboard: { press: vi.fn().mockResolvedValue(undefined) },
+        waitForTimeout: vi.fn().mockResolvedValue(undefined)
+      }
+
+      await dismissOverlays(page, 1)
+
+      expect(dialogClose.click).toHaveBeenCalledOnce()
+      expect(windowClose.click).not.toHaveBeenCalled()
+      expect(page.getByRole).toHaveBeenCalledWith('dialog', {
+        name: title
+      })
     }
-
-    await dismissOverlays(page, 1)
-
-    expect(dialogClose.click).toHaveBeenCalledOnce()
-    expect(windowClose.click).not.toHaveBeenCalled()
-    expect(page.getByRole).toHaveBeenCalledWith('dialog', {
-      name: 'Let agents drive Orca with the Orca CLI'
-    })
-  })
+  )
 
   it('keeps overlay retries within the caller timeout budget', async () => {
     vi.useFakeTimers()
@@ -145,44 +150,64 @@ describe('dismissOverlays', () => {
     }
   })
 
-  it('dismisses the CLI tip without sending Escape into an already-restored terminal', async () => {
-    const dialogClose = {
-      first: vi.fn(),
-      isVisible: vi.fn().mockResolvedValue(true),
-      click: vi.fn().mockResolvedValue(undefined)
-    }
-    dialogClose.first.mockReturnValue(dialogClose)
-    const featureTipDialog = {
-      first: vi.fn(),
-      isVisible: vi.fn().mockResolvedValue(true),
-      locator: vi.fn().mockReturnValue(dialogClose)
-    }
-    featureTipDialog.first.mockReturnValue(featureTipDialog)
-    const xterm = {
-      first: vi.fn(),
-      waitFor: vi.fn().mockResolvedValue(undefined)
-    }
-    xterm.first.mockReturnValue(xterm)
-    const terminalSurface = {
-      first: vi.fn(),
-      isVisible: vi.fn().mockResolvedValue(true),
-      waitFor: vi.fn().mockResolvedValue(undefined),
-      locator: vi.fn().mockReturnValue(xterm)
-    }
-    terminalSurface.first.mockReturnValue(terminalSurface)
-    const page = {
-      locator: vi.fn().mockReturnValue(terminalSurface),
-      getByRole: vi.fn((role) => (role === 'dialog' ? featureTipDialog : hiddenButton())),
-      keyboard: { press: vi.fn().mockResolvedValue(undefined) }
-    }
+  it.each(FEATURE_TIP_TITLES)(
+    'dismisses %s without sending Escape into an already-restored terminal',
+    async (title) => {
+      const dialogClose = {
+        first: vi.fn(),
+        isVisible: vi.fn().mockResolvedValue(true),
+        click: vi.fn().mockResolvedValue(undefined)
+      }
+      dialogClose.first.mockReturnValue(dialogClose)
+      const featureTipDialog = {
+        first: vi.fn(),
+        isVisible: vi.fn().mockResolvedValue(true),
+        locator: vi.fn().mockReturnValue(dialogClose)
+      }
+      featureTipDialog.first.mockReturnValue(featureTipDialog)
+      const xterm = {
+        first: vi.fn(),
+        waitFor: vi.fn().mockResolvedValue(undefined)
+      }
+      xterm.first.mockReturnValue(xterm)
+      const terminalSurface = {
+        first: vi.fn(),
+        isVisible: vi.fn().mockResolvedValue(true),
+        waitFor: vi.fn().mockResolvedValue(undefined),
+        locator: vi.fn().mockReturnValue(xterm)
+      }
+      terminalSurface.first.mockReturnValue(terminalSurface)
+      const page = {
+        locator: vi.fn().mockReturnValue(terminalSurface),
+        getByRole: vi.fn((role, { name }) =>
+          role === 'dialog' && name === title ? featureTipDialog : hiddenButton()
+        ),
+        keyboard: { press: vi.fn().mockResolvedValue(undefined) }
+      }
 
-    await ensureTerminal(page, { allowCreate: false })
+      await ensureTerminal(page, { allowCreate: false })
 
-    expect(dialogClose.click).toHaveBeenCalledOnce()
-    expect(page.keyboard.press).not.toHaveBeenCalled()
-  })
+      expect(dialogClose.click).toHaveBeenCalledOnce()
+      expect(page.keyboard.press).not.toHaveBeenCalled()
+    }
+  )
 
-  it('submits within the composer without dismissing and reopening it', async () => {
+  it('dismisses a late session-search tip without dismissing or reopening the composer', async () => {
+    let tipVisible = false
+    const tipClose = {
+      first: vi.fn(),
+      isVisible: vi.fn(async () => tipVisible),
+      click: vi.fn(async () => {
+        tipVisible = false
+      })
+    }
+    tipClose.first.mockReturnValue(tipClose)
+    const sessionSearchTip = {
+      first: vi.fn(),
+      isVisible: vi.fn(async () => tipVisible),
+      locator: vi.fn().mockReturnValue(tipClose)
+    }
+    sessionSearchTip.first.mockReturnValue(sessionSearchTip)
     const newWorkspace = {
       first: vi.fn(),
       click: vi.fn().mockResolvedValue(undefined)
@@ -192,8 +217,13 @@ describe('dismissOverlays', () => {
       last: vi.fn(),
       click: vi
         .fn()
-        .mockRejectedValueOnce(new Error('submit was briefly intercepted'))
-        .mockResolvedValueOnce(undefined)
+        .mockImplementationOnce(async () => {
+          tipVisible = true
+          throw new Error('session-search tip intercepted submission')
+        })
+        .mockImplementationOnce(async () => {
+          expect(tipVisible).toBe(false)
+        })
     }
     createWorktree.last.mockReturnValue(createWorktree)
     const composer = {
@@ -226,6 +256,9 @@ describe('dismissOverlays', () => {
       ),
       getByRole: vi.fn((role, { name }) => {
         if (role === 'dialog') {
+          if (name === 'Search every agent session') {
+            return sessionSearchTip
+          }
           return name === 'Create worktree' ? composer : hiddenButton()
         }
         return name === 'New workspace' ? newWorkspace : hiddenButton()
@@ -238,6 +271,9 @@ describe('dismissOverlays', () => {
 
     expect(composer.getByRole).toHaveBeenCalledWith('button', { name: /^Create worktree/ })
     expect(unintendedDialogClose.click).not.toHaveBeenCalled()
+    expect(tipClose.click).toHaveBeenCalledOnce()
+    expect(page.keyboard.press).not.toHaveBeenCalled()
+    expect(newWorkspace.click).toHaveBeenCalledOnce()
     expect(createWorktree.click).toHaveBeenCalledTimes(2)
   })
 
diff --git a/tests/tools/win-update-e2e/app-shutdown.test.mjs b/tests/tools/win-update-e2e/app-shutdown.test.mjs
new file mode 100644
index 00000000000..bad1ab8e6f6
--- /dev/null
+++ b/tests/tools/win-update-e2e/app-shutdown.test.mjs
@@ -0,0 +1,119 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { closeApp } from './app-driver.mjs'
+
+const processes = {
+  isPidAlive: vi.fn().mockReturnValue(true),
+  killTree: vi.fn()
+}
+const strictCloseOptions = { allowForceKill: false, processes }
+
+afterEach(() => {
+  vi.useRealTimers()
+  vi.clearAllMocks()
+  processes.isPidAlive.mockReturnValue(true)
+})
+
+describe('update-survival shutdown', () => {
+  it('keeps the force-kill fallback enabled for best-effort cleanup', async () => {
+    const app = {
+      evaluate: vi.fn().mockResolvedValue(123),
+      process: () => ({ pid: 124, stdio: [] }),
+      close: vi.fn().mockRejectedValue(new Error('quit rejected'))
+    }
+
+    await closeApp(app, 45_000, { processes })
+
+    expect(processes.killTree).toHaveBeenCalledExactlyOnceWith(123)
+  })
+
+  it('fails before installation instead of killing the daemon tree after a rejected close', async () => {
+    const failure = new Error('quit rejected')
+    const app = {
+      evaluate: vi.fn().mockResolvedValue(123),
+      process: () => ({ pid: 124, stdio: [] }),
+      close: vi.fn().mockRejectedValue(failure)
+    }
+
+    await expect(closeApp(app, 45_000, strictCloseOptions)).rejects.toBe(failure)
+    expect(processes.killTree).not.toHaveBeenCalled()
+  })
+
+  it('allows normal teardown past ten seconds and still rejects a wedged quit without a tree kill', async () => {
+    vi.useFakeTimers()
+    const app = {
+      evaluate: vi.fn().mockResolvedValue(123),
+      process: () => ({ pid: 124, stdio: [] }),
+      close: vi.fn(() => new Promise(() => {}))
+    }
+    const closed = closeApp(app, 45_000, strictCloseOptions)
+    const rejected = expect(closed).rejects.toThrow('close timeout')
+
+    await vi.advanceTimersByTimeAsync(30_000)
+    expect(vi.getTimerCount()).toBe(1)
+    expect(processes.killTree).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(15_000)
+    await rejected
+    expect(processes.killTree).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('rejects a resolved close while the authoritative main remains live', async () => {
+    const app = {
+      evaluate: vi.fn().mockResolvedValue(123),
+      process: () => ({ pid: 124, stdio: [] }),
+      close: vi.fn().mockResolvedValue(undefined)
+    }
+
+    await expect(closeApp(app, 45_000, strictCloseOptions)).rejects.toThrow(
+      'authoritative Electron PID remains live'
+    )
+    expect(processes.isPidAlive).toHaveBeenCalledWith(123)
+    expect(processes.killTree).not.toHaveBeenCalled()
+  })
+
+  it('accepts verified main and launcher exit while inherited pipes keep close pending', async () => {
+    vi.useFakeTimers()
+    processes.isPidAlive.mockReturnValue(false)
+    const app = {
+      evaluate: vi.fn().mockResolvedValue(123),
+      process: () => ({ pid: 124, exitCode: 0, stdio: [{ readableEnded: false }] }),
+      close: vi.fn(() => new Promise(() => {}))
+    }
+    const closed = expect(closeApp(app, 45_000, strictCloseOptions)).resolves.toBeUndefined()
+
+    await vi.advanceTimersByTimeAsync(45_000)
+    await closed
+    expect(processes.isPidAlive).toHaveBeenCalledWith(123)
+    expect(processes.isPidAlive).toHaveBeenCalledWith(124)
+    expect(processes.killTree).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it.each(['live', 'unverifiable'])(
+    'rejects a %s launcher even when the main exited',
+    async (state) => {
+      vi.useFakeTimers()
+      processes.isPidAlive.mockImplementation((pid) => {
+        if (pid === 123) {
+          return false
+        }
+        if (state === 'unverifiable') {
+          throw new Error('process query failed')
+        }
+        return true
+      })
+      const app = {
+        evaluate: vi.fn().mockResolvedValue(123),
+        process: () => ({ pid: 124, stdio: [] }),
+        close: vi.fn(() => new Promise(() => {}))
+      }
+      const closed = expect(closeApp(app, 45_000, strictCloseOptions)).rejects.toThrow(
+        'close timeout'
+      )
+
+      await vi.advanceTimersByTimeAsync(45_000)
+      await closed
+      expect(processes.killTree).not.toHaveBeenCalled()
+    }
+  )
+})
diff --git a/tests/tools/win-update-e2e/onboarding-profile.mjs b/tests/tools/win-update-e2e/onboarding-profile.mjs
index a621d420982..8f65323bbb2 100644
--- a/tests/tools/win-update-e2e/onboarding-profile.mjs
+++ b/tests/tools/win-update-e2e/onboarding-profile.mjs
@@ -15,7 +15,7 @@
 // on quit; overwriting it before the post-update relaunch would destroy the
 // persisted session that the cold-restore/survival assertions depend on.
 //
-// Onboarding flow-version / final-step mirror src/shared/constants
+// Onboarding flow-version / final-step mirror src/shared/onboarding-defaults
 // (ONBOARDING_FLOW_VERSION=4, ONBOARDING_FINAL_STEP=5); refresh if the app bumps
 // the flow version, or a stale version re-arms onboarding.
 
diff --git a/tests/tools/win-update-e2e/run.mjs b/tests/tools/win-update-e2e/run.mjs
index 7c8d8cde6c5..fc0ec4b36a6 100644
--- a/tests/tools/win-update-e2e/run.mjs
+++ b/tests/tools/win-update-e2e/run.mjs
@@ -220,9 +220,19 @@ async function runProof(ctx, args) {
   const preScrollback = await readTerminalTextBestEffort(session.page)
 
   // Close app normally; the detached daemon must remain alive.
-  await closeApp(session.app)
+  // Allow renderer acknowledgement and teardown; a tree kill invalidates survival evidence.
+  await closeApp(session.app, 45_000, { allowForceKill: false })
   const daemonAliveAfterClose = preDaemon.pid != null && isPidAlive(preDaemon.pid)
   log('daemon', `alive after app close: ${daemonAliveAfterClose}`)
+  log('marker', `alive after graceful app close: ${isPidAlive(created.markerPid)}`)
+  await delay(60_000)
+  log(
+    'pre-install-control',
+    JSON.stringify({
+      daemonAlive: preDaemon.pid != null && isPidAlive(preDaemon.pid),
+      markerAlive: isPidAlive(created.markerPid)
+    })
+  )
 
   // --- Start the console-window watch through the whole update + soak ---
   const watchDuration = 120 + opts.soakSeconds
@@ -241,6 +251,15 @@ async function runProof(ctx, args) {
   // uninstalls THAT and never scan-discovers the developer's real install.
   ctx.installedExePath = updated.exePath
   log('update', `installed ${updated.exePath} (version ${updated.version})`)
+  log(
+    'post-install-before-relaunch',
+    JSON.stringify({
+      daemonPid: preDaemon.pid,
+      daemonAlive: preDaemon.pid == null ? null : isPidAlive(preDaemon.pid),
+      markerPid: created.markerPid,
+      markerAlive: created.markerPid == null ? null : isPidAlive(created.markerPid)
+    })
+  )
 
   // --- Relaunch and gather post-update evidence ---
   session = await launchInstalledApp({ exePath: updated.exePath, userDataDir })
diff --git a/tests/tools/win-update-e2e/trace-installer-branches.mjs b/tests/tools/win-update-e2e/trace-installer-branches.mjs
new file mode 100644
index 00000000000..78dc59b64f8
--- /dev/null
+++ b/tests/tools/win-update-e2e/trace-installer-branches.mjs
@@ -0,0 +1,115 @@
+import { readFileSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const require = createRequire(import.meta.url)
+const builderRequire = createRequire(require.resolve('electron-builder/package.json'))
+const builderRoot = path.dirname(builderRequire.resolve('app-builder-lib/package.json'))
+const processChecks = path.join(
+  builderRoot,
+  'templates/nsis/include/allowOnlyOneInstallerInstance.nsh'
+)
+const hooks = fileURLToPath(
+  new URL('../../../config/nsis/orca-installer-hooks.nsh', import.meta.url)
+)
+const capabilityCheck = fileURLToPath(
+  new URL('../../../config/nsis/orca-process-check.nsh', import.meta.url)
+)
+
+// CI-only patch: the installer and its embedded uninstaller share these macros.
+const traceMacro = `
+!macro ORCA_E2E_TRACE TEXT
+  Push $R8
+  Push $R9
+  StrCpy $R8 0
+  \${if} \${Errors}
+    StrCpy $R8 1
+  \${endIf}
+  ClearErrors
+  ReadEnvStr $R9 ORCA_E2E_NSIS_TRACE
+  \${if} $R9 != ""
+    FileOpen $R9 "$R9" a
+    \${ifNot} \${Errors}
+      FileSeek $R9 0 END
+      FileWrite $R9 "$EXEPATH | $CMDLINE | dir=$INSTDIR | \${TEXT}$\\r$\\n"
+      FileClose $R9
+    \${endIf}
+  \${endIf}
+  ClearErrors
+  \${if} $R8 == 1
+    SetErrors
+  \${endIf}
+  Pop $R9
+  Pop $R8
+!macroend
+`
+
+function replaceOnce(source, anchor, replacement) {
+  if (source.split(anchor).length !== 2) {
+    throw new Error(`Expected one NSIS trace anchor: ${anchor}`)
+  }
+  return source.replace(anchor, () => replacement)
+}
+
+function insertAfter(source, anchor, insertion) {
+  return replaceOnce(source, anchor, `${anchor}\n${insertion}`)
+}
+
+let checks = readFileSync(processChecks, 'utf8').replaceAll('\r\n', '\n')
+checks = traceMacro + checks
+checks = insertAfter(
+  checks,
+  '!macro FIND_PROCESS _FILE _RETURN',
+  '  !insertmacro ORCA_E2E_TRACE "find image=${_FILE} branch=$IsPowerShellAvailable"'
+)
+checks = insertAfter(
+  checks,
+  '!macro KILL_PROCESS _FILE _FORCE',
+  '  !insertmacro ORCA_E2E_TRACE "kill image=${_FILE} force=${_FORCE} branch=$IsPowerShellAvailable"'
+)
+checks = replaceOnce(
+  checks,
+  '  Pop $0\n!macroend ',
+  '  Pop $0\n  !insertmacro ORCA_E2E_TRACE "kill-result=$0"\n!macroend '
+)
+const findCall = '!insertmacro FIND_PROCESS "${APP_EXECUTABLE_FILENAME}" $R0'
+if (checks.split(findCall).length !== 4) {
+  throw new Error('Expected three find-process calls')
+}
+checks = checks.replaceAll(
+  findCall,
+  () => `${findCall}\n    !insertmacro ORCA_E2E_TRACE "find-result=$R0"`
+)
+let uninstall = readFileSync(hooks, 'utf8').replaceAll('\r\n', '\n')
+uninstall = insertAfter(
+  uninstall,
+  '!macro customUnInstall',
+  '  !insertmacro ORCA_E2E_TRACE "custom-uninstall entered"'
+)
+uninstall = insertAfter(
+  uninstall,
+  '  ${ifNot} ${isUpdated}',
+  '    !insertmacro ORCA_E2E_TRACE "genuine-uninstall daemon sweep"'
+)
+let capability = readFileSync(capabilityCheck, 'utf8').replaceAll('\r\n', '\n')
+capability = insertAfter(
+  capability,
+  '  Pop $0',
+  '  !insertmacro ORCA_E2E_TRACE "capability=$0 powershell=$PowerShellPath"'
+)
+capability = replaceOnce(
+  capability,
+  '  !insertmacro _CHECK_APP_RUNNING',
+  '  !insertmacro ORCA_E2E_TRACE "selected-branch=$IsPowerShellAvailable (0=path,1=image)"\n  !insertmacro _CHECK_APP_RUNNING'
+)
+
+if (!process.argv.includes('--check')) {
+  if (process.env.GITHUB_ACTIONS !== 'true' || process.platform !== 'win32') {
+    throw new Error('Installer tracing may only patch a disposable Windows CI checkout')
+  }
+  writeFileSync(processChecks, checks)
+  writeFileSync(hooks, uninstall)
+  writeFileSync(capabilityCheck, capability)
+}
+console.log('Validated installer/uninstaller branch-trace anchors')
diff --git a/tests/tools/windows-pty-native-capability-smoke/run.test.mjs b/tests/tools/windows-pty-native-capability-smoke/run.test.mjs
index bb8ab525da6..27439cb498e 100644
--- a/tests/tools/windows-pty-native-capability-smoke/run.test.mjs
+++ b/tests/tools/windows-pty-native-capability-smoke/run.test.mjs
@@ -1,10 +1,7 @@
-import { readFileSync } from 'node:fs'
 import path from 'node:path'
 import { describe, expect, it } from 'vitest'
 import { checkoutRunProcessPath, formatProbeFailure, packagedProbeInvocation } from './run.mjs'
 
-const runnerSource = readFileSync(new URL('./run.mjs', import.meta.url), 'utf8')
-
 describe('packaged Windows native smoke runner boundary', () => {
   it('uses one checkout-owned runner for current and affected package paths', () => {
     const current = packagedProbeInvocation('/ci/current/dist/win-unpacked/Orca.exe')
@@ -36,12 +33,4 @@ describe('packaged Windows native smoke runner boundary', () => {
     expect(failure).toContain('stdout-tail')
     expect(failure).toContain('stage=target-spawn:start')
   })
-
-  it('does not import child_process or resolve the runner from the artifact', () => {
-    expect(runnerSource).not.toContain('node:child_process')
-    expect(runnerSource).not.toMatch(
-      /path\.join\(resourcesDir[\s\S]*?app\.asar\.unpacked[\s\S]*?run-process\.js/
-    )
-    expect(runnerSource).toContain("'../../../out/shared/child-process/run-process.js'")
-  })
 })